anchor.diff:              mkImplies
                   (mkLe (AInt 0L) (AVar (Reg iterator)))
                   (mkImplies succDefn defn)
  -
  -        // Expression equivalence cannot handle symbols, so try remove them.
  -        // TODO(CaptainHayashi): is it sound to approximate here?
           bind
  -            (fun chk ->
  -                // Pose that the check is a tautology, and use Z3 to check it.
  -                let closed = equivHolds id (equiv chk BTrue)
  -
  -                if closed
  +            (fun indHolds ->
  +                if indHolds
                   then ok (func, defn)
                   else fail (InductiveDownclosureError ([func], succDefn, defn)))
  -            (check
  -             |> Mapper.mapBoolCtx (tsfRemoveSym SymInIteratedConstraint) NoCtx
  -             |> snd)
  +            (runDownclosureCheck check)
   
       /// <summary>
       ///     Checks the base and inductive downclosure properties on a given
  
positive.code:            The definition of emp can only mention global variables, so it does
             not need to be freshened. *)
          let check = mkImplies empDefn baseDefn
  
          // Expression equivalence cannot handle symbols, so try remove them.
          // TODO(CaptainHayashi): is it sound to approximate here?
          bind
              (fun chk ->
                  // Pose that the check is a tautology, and use Z3 to check it.
                  let closed = equivHolds id (equiv chk BTrue)
  
                  if closed
                  then ok (func, defn)
                  else fail (BaseDownclosureError ([func], defn, empDefn)))
              (check
               |> Mapper.mapBoolCtx (tsfRemoveSym SymInIteratedConstraint) NoCtx
               |> snd)
  
      let checkInductiveDownclosure (iterator : Var)
        (func : IteratedDFunc)
        (defn : BoolExpr<Sym<Var>>)
        : Result<IteratedDFunc * BoolExpr<Sym<Var>>, Error> =
          (* To do the inductive downclosure, we need to replace all instances of
             the iterator in the definition with (iterator + 1) in one version. *)
          let increment v =
              if v = iterator
              then mkAdd2 (AVar (Reg v)) (AInt 1L)
              else AVar (Reg v)
  
          let succDefn = downclosureMap increment defn
  
          (* Base downclosure for a view V[n](x):
               (0 <= n) => (D(V[n+1](x)) => D(V[n](x)))
             That is, the definition of V when the iterator is n+1 implies the
             definition of V when the iterator is n, for all positive n. *)
  
negative.code:                             (fun (v, r) -> ([v], r))
                              (checkDownclosure i empDefn rhs))
                       | Some { IsIterated = _ } -> fail (IteratorOnNonIterated i)
                       | None -> fail (NoSuchView i.Func))
              // Over-large iterated view definition (for now, anyway).
              | xs, [] -> return! fail (TooManyIteratedFuncs (lhs, List.length xs))
              // Mixed view definition (currently not allowed).
  