anchor.diff:             (cond ((equal first 'v)
                     (list 'v (simplify-formula second)
                           (simplify-formula third)))
  +                 ((equal first 'box)
  +                  (list 'box second (simplify-formula third)))
                    ((equal first 'diamond)
  -                  (list 'diamond second (simplify-formula third)))
  +                  (list '~ 'box second (list '~ (simplify-formula third))))
                    ((equal first '^)
                     (list '~ (list 'v
                                    (list '~ (simplify-formula second))
  
positive.code:             (prog-accessible-worlds m w (second f))
              nil)))
  
  (defthm diamond-sem-kinda
    (implies (and (equal (len f) 3)
                  (equal (first f) 'diamond))
             (equal (pdl-satisfies m w f)
                    (pdl-satisfies-aux m
                                       w
  
negative.code:            (cond ((equal (first f) 'v)
                    (or (pdl-satisfies-mutual m w (second f) worlds)
                        (pdl-satisfies-mutual m w (third f) worlds)))
                   ((equal (first f) 'box)
                    (pdl-satisfies-box-mutual
                     m
                     (prog-accessible-worlds m w (second f))
                     (third f)))))
            (t nil)))
    (defun pdl-satisfies-box-mutual (m p-accessible-worlds f)
      (declare (xargs :measure (list (acl2-count f)
                                     (acl2-count p-accessible-worlds))))
      (if (consp p-accessible-worlds)
          (and (pdl-satisfies-mutual m (car p-accessible-worlds) f nil)
               (pdl-satisfies-box-mutual m (cdr p-accessible-worlds) f))
        t))))
  
  
  ; ...and here is the non-mutually-recursive equivalent that we WILL end up
  