diff --git a/NEWS b/NEWS
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,18 @@
 CPSA NEWS
 
+  December, 2017:
+
+* The release of CPSA version 3.4.1 includes the following changes:
+  - Fixed a bug that caused a crash in certain situations involving
+    generalization
+  - Fixed a bug in the chase algorithm that caused the tool to enter
+    an infinite loop
+  - Added a new declaration "eq" which declares pairs of values to be
+    equal to each other.
+  - Added a new command-line flag to skip analysis, "noanalyze" / -z.
+    This allows defgoal inputs to be read in and characteristic
+    skeletons computed, for model debugging.
+
   September, 2017:
 
 * In CPSA version 3.4, the algorithm for handling Diffie-Hellman
diff --git a/cpsa.cabal b/cpsa.cabal
--- a/cpsa.cabal
+++ b/cpsa.cabal
@@ -1,5 +1,5 @@
 Name:			cpsa
-Version:		3.4.0
+Version:		3.4.1
 Maintainer:		mliskov@mitre.org
 Cabal-Version:		>= 1.6
 License:		BSD3
@@ -97,7 +97,9 @@
   tst/unilateral.tst tst/uniq-gen-test.scm tst/uniq-gen-test.tst
   tst/wang.tst tst/woolam.scm tst/woolam.tst tst/wrap_decrypt.lsp
   tst/wrap_decrypt.tst tst/yahalom.scm tst/yahalom.tst
-
+  tst/aik.scm tst/aik.tst tst/reflect.scm tst/reflect.tst
+  tst/station.scm tst/station.tst tst/kerb.scm tst/kerb.tst
+  
 Source-Repository head
   Type:     git
   Location: git://github.com/mitre/cpsa.git
@@ -208,3 +210,15 @@
     Paths_cpsa CPSA.Lib.Utilities CPSA.Lib.Pretty CPSA.Lib.SExpr
     CPSA.Lib.Printer CPSA.Lib.Entry CPSA.Lib.Algebra CPSA.SAS.SAS
     CPSA.Basic.Algebra CPSA.DiffieHellman.Algebra
+
+Executable cpsadebase
+  Main-Is:		CPSA/Debase/Main.hs
+  Build-Depends:	base >= 3 && < 5, containers
+  GHC-Options:
+    -Wall -fno-warn-name-shadowing -fwarn-unused-imports
+  Hs-Source-Dirs:	src
+  Other-Modules:
+    Paths_cpsa CPSA.Lib.Utilities CPSA.Lib.Pretty CPSA.Lib.SExpr
+    CPSA.Lib.Printer CPSA.Lib.Entry CPSA.Lib.Algebra
+    CPSA.Basic.Algebra
+
diff --git a/doc/cpsamanual.pdf b/doc/cpsamanual.pdf
Binary files a/doc/cpsamanual.pdf and b/doc/cpsamanual.pdf differ
diff --git a/src/CPSA/Debase/Main.hs b/src/CPSA/Debase/Main.hs
new file mode 100644
--- /dev/null
+++ b/src/CPSA/Debase/Main.hs
@@ -0,0 +1,120 @@
+-- Pretty print the input
+
+-- Copyright (c) 2009 The MITRE Corporation
+--
+-- This program is free software: you can redistribute it and/or
+-- modify it under the terms of the BSD License as published by the
+-- University of California.
+
+module Main (main) where
+
+import System.IO
+import CPSA.Lib.SExpr
+import CPSA.Lib.Printer (pp)
+import CPSA.Lib.Entry
+
+-- Runtime parameters
+
+defaultIndent :: Int
+defaultIndent = optIndent defaultOptions
+
+main :: IO ()
+main =
+    do
+      (p, (output, margin)) <- start filterOptions filterInterp
+      h <- outputHandle output
+      go (writeCpsaLn (pp margin defaultIndent) h) p
+      hClose h
+
+writeCpsaLn :: (SExpr () -> String) -> Handle -> SExpr a -> IO ()
+writeCpsaLn printer h sexpr =
+    do
+      hPutStrLn h $ printer $ transform $ strip sexpr
+      hPutStrLn h ""
+
+go :: (SExpr Pos -> IO ()) -> PosHandle -> IO ()
+go f p =
+    loop
+    where
+      loop =
+          do
+            x <- gentlyReadSExpr p
+            case x of
+              Nothing ->
+                  return ()
+              Just sexpr ->
+                  do
+                    f sexpr
+                    loop
+
+strip :: SExpr a -> SExpr ()
+strip (S _ s) = S () s
+strip (Q _ s) = Q () s
+strip (N _ n) = N () n
+strip (L _ l) = L () (map strip l)
+
+-- | Make a symbol.
+sym :: String -> SExpr ()
+sym s = S () s
+
+{-
+
+-- | Make a quoted string.
+str :: String -> SExpr ()
+str s = Q () s
+
+-- | Make a number.
+num :: Int -> SExpr ()
+num n = N () n
+-}
+
+-- | Make a list of S-expressions.
+lst :: [SExpr ()] -> SExpr ()
+lst xs = L () xs
+
+transform :: SExpr () -> SExpr ()
+transform (L () (S () "defprotocol" : name : alg : rest)) =
+  lst (sym "defprotocol" : name : alg : map role rest)
+transform (L () (S () "defskeleton" : xs)) =
+  skel xs
+transform x = x
+
+role :: SExpr () -> SExpr ()
+role (L () (S () "defrole" : name : L () (S () "vars" : v) : rest)) =
+  let (decl, bases) = vars v in
+    lst (sym "defrole" : name : lst (sym "vars" : decl) :
+         map (subst bases) rest)
+role x = x
+
+skel :: [SExpr ()] -> SExpr ()
+skel (p@(S _ _) : L () (S () "vars" : v) : rest) =
+  let (decl, _) = vars v in
+    lst (sym "defskeleton" : p : lst (sym "vars" : decl) : rest)
+skel xs = lst (sym "defskeleton" : xs)
+
+vars :: [SExpr ()] -> ([SExpr ()], [String])
+vars [] = ([], [])
+vars (L () x : xs)
+  | symStr (last x) == "base" =
+      let (xs', ss) = vars xs in
+        (lst (butLast x ++ [sym "expr"]) : xs',
+         map symStr (butLast x) ++ ss)
+  | otherwise =
+      let (xs', ss) = vars xs in
+        (lst x : xs', ss)
+vars _ = error "vars: bad input"
+
+symStr :: SExpr a -> String
+symStr (S _ s) = s
+symStr _ = error "symStr: not a symbol"
+
+butLast :: [a] -> [a]
+butLast [] = []
+butLast [_] = []
+butLast (x : xs) = x : butLast xs
+
+subst :: [String] -> SExpr () -> SExpr ()
+subst bases (S () s)
+  | elem s bases = lst [sym "exp", lst [sym "gen"], sym s]
+subst bases (L () (x : xs)) = L () (x : map (subst bases) xs)
+subst _ x = x
diff --git a/src/CPSA/DiffieHellman/Algebra.hs b/src/CPSA/DiffieHellman/Algebra.hs
--- a/src/CPSA/DiffieHellman/Algebra.hs
+++ b/src/CPSA/DiffieHellman/Algebra.hs
@@ -308,11 +308,14 @@
 getGroupVar x = head $ M.keys x
                 
 -- Create group var as a basis element if be is true
-groupVar :: Bool -> Id -> Term
-groupVar be x = G $ M.singleton x (be, 1)
+groupVarG :: Bool -> Id -> Group
+groupVarG be x = M.singleton x (be, 1)
 
+groupVar :: Bool -> Id -> Term
+groupVar be x = G $ groupVarG be x
+                
 groupVarGroup :: Id -> Group
-groupVarGroup x = M.singleton x (False, 1)
+groupVarGroup x = groupVarG False x
 
 dMapCoef :: (Coef -> Coef) -> Desc -> Desc
 dMapCoef f (be, c) = (be, f c)
@@ -782,6 +785,7 @@
     foldVars f acc t
 foldVars f acc t@(D _) = f acc t          -- Node variable
 foldVars _ acc (C _) = acc
+foldVars _ acc (P _) = acc
 foldVars _ _ t = error $ "Algebra.foldVars: Bad term " ++ show t
 
 -- Fold f through a term applying it to each term that is carried by the term.
@@ -1441,6 +1445,7 @@
       Just t -> chase (Subst s) t
 chase s (F Invk [t]) = chaseInvk s t
 chase s (F Exp [t0, G t1]) = chaseExp s t0 t1
+chase (Subst s) (G t) = G $ chaseGroup s t
 chase _ t = t
 
 chaseInvk :: Subst -> Term -> Term
@@ -1456,19 +1461,39 @@
     | M.null t1 = chase s t0
 chaseExp s@(Subst ss) (I x) t1 =
     case chase s (I x) of
-      F Exp [t0', G t1'] -> -- chaseExp s t0' (mul t1 t1')
-        if M.null t1t1'
-           then t0'
-           else F Exp [t0', G t1t1']
-        where t1t1' = mul t1' (groupSubst ss t1)
-      t0 -> F Exp [t0, chaseGroup s t1]
+      F Exp [t0', G t1'] ->
+        chaseExpFinalize t0' t1t1'
+        where t1t1' = mul t1' (chaseGroup ss t1)
+      t0 -> chaseExpFinalize t0 t1'
+        where t1' = chaseGroup ss t1
 chaseExp s (F Exp [t0', G t1']) t1 =
     chaseExp s t0' (mul t1 t1')
-chaseExp s t0 t1 = F Exp [t0, chaseGroup s t1]
+chaseExp (Subst s) t0 t1 =
+    chaseExpFinalize t0 t1'
+    where t1' = chaseGroup s t1
 
-chaseGroup :: Subst -> Group -> Term
-chaseGroup (Subst s) x = G $ groupSubst s x
+chaseExpFinalize :: Term -> Group -> Term
+chaseExpFinalize t0 t1 =
+    if M.null t1
+       then t0
+       else F Exp [t0, G t1]
+                
+chaseGroup :: IdMap -> Group -> Group
+chaseGroup s t =
+    M.foldrWithKey f M.empty t
+     where
+       f x (be, c) t =
+           mul (expg (chaseGroupLookup s be x) c) t
 
+chaseGroupLookup :: IdMap -> Bool -> Id -> Group
+chaseGroupLookup s be x =
+    case M.lookup x s of
+      Nothing -> groupVarG be x
+      Just (G t) -> chaseGroup s t
+      Just w -> error ("Algebra.chaseGroupLookup: Bad substitution: " ++
+                     show x ++ " -> " ++ show w)
+               
+                   
 -- Does x occur in t?
 occurs :: Id -> Term -> Bool
 occurs x (I y) = x == y
@@ -1604,7 +1629,7 @@
 -- A chasing version of substitution.
 
 substChase :: Subst -> Term -> Term
-substChase subst t =
+substChase subst@(Subst ss) t =
     case chase subst t of
       t@(I _) -> t
       t@(C _) -> t
@@ -1615,24 +1640,15 @@
       F Exp [t0, G t1] ->
           case substChase subst t0 of
             F Exp [t0', G t1'] ->
-              case mul t1' $ groupChase subst t1 of
+              case mul t1' $ chaseGroup ss t1 of
                 t2 | M.null t2 -> t0'
                    | otherwise -> F Exp [t0', G t2]
-            t -> expChase subst t t1
+            t -> chaseExp subst t t1
       F s u ->
           F s (map (substChase subst) u)
-      G t -> G $ groupChase subst t
+      G t -> G $ chaseGroup ss t
       t@(D _) -> t
       t@(P _) -> t
-
-expChase :: Subst -> Term -> Group -> Term
-expChase subst t0 t1 =
-    case groupChase subst t1 of
-      t1' | M.null t1' -> t0
-          | otherwise -> F Exp [t0, G t1']
-
-groupChase :: Subst -> Group -> Group
-groupChase (Subst subst) t = groupSubst subst t
 
 destroyer :: Term -> Maybe Subst
 destroyer t@(G m) | isVar t =
diff --git a/src/CPSA/Lib/Declaration.hs b/src/CPSA/Lib/Declaration.hs
--- a/src/CPSA/Lib/Declaration.hs
+++ b/src/CPSA/Lib/Declaration.hs
@@ -11,7 +11,7 @@
         dknon, dkpnon, dkunique, dkuniqFull, mkDecls, declsUnion, dkuniqgen,
         tagDeclsTermsOnly, tagDeclsLocsOnly, declFormats, declInputFormats,
         dterms, dlocs, daux, declInst, declInstAux, DeclInst, dkugenFull,
-        dkabsent, declsTerms, addDeclInst, declMember,
+        dkabsent, declsTerms, addDeclInst, declMember, nsdecls,
         DeclInstList, Declaration, DeclInFormat(..), DeclOutFormat(..),
         DeclList, declarationRoleTags,
 --        BasicOutFmt, MultiTermOutFmt, NullOutFmt, BasicRoleOutFmt, GeneralOutFmt,
@@ -216,6 +216,8 @@
 
 modname :: (Algebra t p g s e c, Loc l) => String -> DeclInstList t l ->
            Declarations t l -> Declarations t l
+modname name [] decls =
+    mkDecls (filter (\(n, _) -> not (n == name) ) (dlist decls))
 modname name ds decls =
   case lookup name (dlist decls) of
     Nothing -> mkDecls ((dlist decls) ++ [(name, ds)])
@@ -256,14 +258,13 @@
 declCompare dec1 dec2 = compare (fst dec1) (fst dec2)
 
 -- Exported
--- MDL: Note "Forgot t" limitation here (use of head)
 forgetSomeDecls :: (Algebra t p g s e c, Loc l) => Declarations t l ->
-                   [(t, Declarations t l)]
+                   [(Declarations t l, Declarations t l)]
 forgetSomeDecls decls =
   concatMap delNamedDecl (map fst (dlist decls))
   where
     delNamedDecl name =
-      [ (head $ dterms d, modname name (delete d (tagDecls name decls)) decls)
+      [ (Declarations {dlist = [(name, [d])]}, modname name (delete d (tagDecls name decls)) decls)
       | d <- tagDecls name decls ]
 
 declsNub :: (Algebra t p g s e c, Loc l) => Declarations t l ->
@@ -394,6 +395,14 @@
     f dinst = declInstAux (map (instantiate env) $ dterms dinst)
                        (map locmap $ dlocs dinst) (daux dinst)
 
+-- Exported
+nsdecls :: Declarations t l -> Set (String, Int)
+nsdecls decls =
+  nsdeclsloop S.empty (dlist decls)
+  where
+    nsdeclsloop s [] = s
+    nsdeclsloop s ((tag, ds) : rest) = nsdeclsloop (S.insert (tag, length ds) s) rest
+                                                  
 avoidTerms :: Algebra t p g s e c => Declarations t l -> Set t
 avoidTerms decls =
   S.unions [ns, as, uos, ugs]
diff --git a/src/CPSA/Lib/Displayer.hs b/src/CPSA/Lib/Displayer.hs
--- a/src/CPSA/Lib/Displayer.hs
+++ b/src/CPSA/Lib/Displayer.hs
@@ -396,8 +396,8 @@
           [S () "weakened", L () [displayNode n0, displayNode n1] ]
       displayMethod ctx (Separated t) =
           [S () "separated", displayOpTerm ctx t]
-      displayMethod ctx (Forgot t) =
-          [S () "forgot", displayOpTerm ctx t]
+      displayMethod ctx (Forgot decls) = 
+          [S () "forgot", L () (displaySkelDeclarations ctx decls [])]
 
 -- Terms in the operation field may contain variables not in the skeleton
 displayOpTerm :: Algebra t p g s e c => c -> t -> SExpr ()
diff --git a/src/CPSA/Lib/Entry.hs b/src/CPSA/Lib/Entry.hs
--- a/src/CPSA/Lib/Entry.hs
+++ b/src/CPSA/Lib/Entry.hs
@@ -73,6 +73,7 @@
       optFile :: Maybe FilePath, -- Nothing specifies standard output
       optAlg :: String,          -- Name of the algebra
       optAnalyze :: Bool,        -- False when only expanding macros
+      optDoAnalyze :: Bool,      -- False when only printing inputs
       optNoIsoChk :: Bool, -- True when not performing isomorphism checks
       optCheckNoncesFirst :: Bool, -- True when checking nonces first
       optTryOldStrandsFirst :: Bool, -- True when visiting old strands first
@@ -90,6 +91,7 @@
   optFile = Nothing,
   optAlg = CPSA.Basic.Algebra.name,
   optAnalyze = True,
+  optDoAnalyze = True,
   optNoIsoChk = False,
   optCheckNoncesFirst = False,
   optTryOldStrandsFirst = False,
diff --git a/src/CPSA/Lib/Main.hs b/src/CPSA/Lib/Main.hs
--- a/src/CPSA/Lib/Main.hs
+++ b/src/CPSA/Lib/Main.hs
@@ -194,6 +194,7 @@
     | Depth String              -- Tree depth bound
     | Margin String             -- Output line length
     | Expand                    -- Expand macros only
+    | NoAnalyze                 -- Don't analyze, just echo outputs
     | NoIsoChk                  -- Disable isomorphism checks
     | CheckNoncesFirst          -- Check nonces first
     | TryOldStrandsFirst        -- Try old strands first
@@ -218,6 +219,7 @@
       ("set output margin (default " ++ show (optMargin defaultOptions) ++ ")"),
       Option ['e'] ["expand"]   (NoArg Expand)
       "expand macros only; don't analyze",
+      Option ['z'] ["noanalyze"] (NoArg NoAnalyze) "don't analyze",
       Option ['n'] ["noisochk"] (NoArg NoIsoChk)
       "disable isomorphism checks",
       Option ['c'] ["check-nonces"] (NoArg CheckNoncesFirst)
@@ -277,6 +279,8 @@
                   abort msg
       loop (Expand : flags) opts =
           loop flags $ opts { optAnalyze = False }
+      loop (NoAnalyze : flags) opts =
+          loop flags $ opts { optDoAnalyze = False }
       loop (NoIsoChk : flags) opts =
           loop flags $ opts { optNoIsoChk = True }
       loop (CheckNoncesFirst : flags) opts =
diff --git a/src/CPSA/Lib/Reduction.hs b/src/CPSA/Lib/Reduction.hs
--- a/src/CPSA/Lib/Reduction.hs
+++ b/src/CPSA/Lib/Reduction.hs
@@ -125,6 +125,12 @@
          [Preskel t g s e] -> Int -> IO ()
 solve _ h [] _ =                -- Done
     hClose h
+solve p h (k : ks) n | (not $ optDoAnalyze p) =
+    do 
+      wrt p h (displayProt (protocol k))
+      -- Just display the preskel
+      wrt p h (displayPreskel k [])
+      solve p h ks n
 solve p h (k : ks) n =
     do
       wrt p h (displayProt (protocol k)) -- show protocol
diff --git a/src/CPSA/Lib/Strand.hs b/src/CPSA/Lib/Strand.hs
--- a/src/CPSA/Lib/Strand.hs
+++ b/src/CPSA/Lib/Strand.hs
@@ -400,7 +400,7 @@
     = Deleted Node
     | Weakened Pair
     | Separated t
-    | Forgot t
+    | Forgot (SkelDeclarations t)
     deriving Show
 
 -- The operation used to generate the preskeleteton is either new via
@@ -648,6 +648,16 @@
       dvars = foldl f S.empty $ declsTerms (decls k)
       f s t = foldVars (flip S.insert) s t
 
+traceBase :: Int
+traceBase = 3
+
+-- Convert a trace to a number based on its pattern of events
+tracePattern :: Trace t -> Int
+tracePattern [] = 1
+tracePattern (In _:r) = traceBase*(tracePattern r)
+tracePattern (Out _:r) = traceBase*(tracePattern r) + 1
+tracePattern (Sync _:r) = traceBase*(tracePattern r) + 2                         
+                          
 -- Isomorphism Check
 
 -- Are two skeletons equivalent?  Two skeletons are equivalent if they
@@ -673,6 +683,7 @@
       gtraces :: [(Int, Trace t)],
       gorderings :: [Pair],
       gleadsto :: [Pair],
+      gpatterns :: [Int],
       gdecls :: SkelDeclarations t,
       nvars :: !Int,           -- Number of variables
       ntraces :: !Int,         -- Number of traces
@@ -688,17 +699,21 @@
            gorderings = gorderings,
            gleadsto = gleadsto,
            gdecls = gdecls,
+           gpatterns = patterns,
            nvars = length (kvars k),
            ntraces = length gtraces,
            norderings = length gorderings,
            nleadsto = length gleadsto,
-           nsndecls = nsdecls gdecls }
+           nsndecls = nsds gdecls }
     where
       gtraces = map (\i -> (height i, trace i)) (insts k)
       gorderings = orderings k
       gleadsto = leadsto k
       gdecls = decls k
+      patterns = L.sort (map (tracePattern . trace) (insts k))
+      nsds decls = [length (dknon decls), length (dkpnon decls), length (dkunique decls)]
 
+
 -- Test to see if two preskeletons are isomorphic
 
 -- First, ensure the two preskeletons have:
@@ -723,6 +738,7 @@
 --    nvars g == nvars g' &&  -- Wrong in DH
     ntraces g == ntraces g' &&
     norderings g == norderings g' &&
+    gpatterns g == gpatterns g' &&
     nleadsto g == nleadsto g' &&
     nsndecls g == nsndecls g' &&
     any (tryPerm g g') (permutations g g')
@@ -1959,17 +1975,19 @@
 --}
 
 -- Exported
+{-
 nsdecls :: Declarations t l -> [Int]
 nsdecls decls =
   [length (dknon decls), length (dkpnon decls), length (dkunique decls)]
+-}
 
 -- Exported
 -- JDR: duplicate code with mkPreskel
 forgetSomeTerm :: Algebra t p g s e c => Preskel t g s e ->
                   [Candidate t p g s e c]
 forgetSomeTerm k =
-  [ addIdentity (k { decls = d, operation = Generalized (Forgot t) }) |
-      (t, d) <- forgetSomeDecls (decls k),
+  [ addIdentity (k { decls = d, operation = Generalized (Forgot dd) }) |
+      (dd, d) <- forgetSomeDecls (decls k),
       let insts' = insts k,
       let rd = foldl addInstOrigs (declsUnion [])
                (zip (nats (length insts')) insts'),
diff --git a/tst/Makefile b/tst/Makefile
--- a/tst/Makefile
+++ b/tst/Makefile
@@ -10,18 +10,18 @@
 SAS	= ../dist/build/cpsasas/cpsasas$(EXE)
 ANNOTATIONS = ../dist/build/cpsaannotations/cpsaannotations$(EXE)
 GRAPH	= ../dist/build/cpsagraph/cpsagraph$(EXE)
-CPSAFLAGS = +RTS -M512m -RTS
+CPSAFLAGS = +RTS -M512m -N8 -RTS
 
 # The expected answers are in files with the .tst extension.
 
 # Analyze protocols for shapes expecting success
 %.txt:	%.scm $(CPSA)
-	$(CPSA) $(CPSAFLAGS) -o $@ $*.scm
+	time $(CPSA) $(CPSAFLAGS) -o $@ $*.scm
 	-$(DIFF) $(DIFFFLAGS) $*.tst $*.txt
 
 # Analyze protocols for shapes expecting failure
 %.txt:	%.lsp $(CPSA)
-	-$(CPSA) $(CPSAFLAGS) -o $@ $*.lsp
+	-time $(CPSA) $(CPSAFLAGS) -o $@ $*.lsp
 	-$(DIFF) $(DIFFFLAGS) $*.tst $*.txt
 
 # Extract shapes
diff --git a/tst/aik.scm b/tst/aik.scm
new file mode 100644
--- /dev/null
+++ b/tst/aik.scm
@@ -0,0 +1,31 @@
+(herald "Anonymous identity protocol from TCG")
+
+(defprotocol aikprot basic
+  (defrole ca
+    (vars (mf name) (ek akey))
+    (trace (send (enc "ekc" mf ek (privk mf))))
+    (non-orig (invk ek)))
+  (defrole tpm
+    (vars (i x mf pc name) (ek k akey) (srk skey))
+    (trace (recv (cat x i (enc "ekc" mf ek (privk mf))))
+      (send (cat i k x (enc "ekc" mf ek (privk mf))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    (non-orig srk (invk ek))
+    (uniq-orig k (invk k)))
+  (defrole pca
+    (vars (i x mf pc name) (ek k akey))
+    (trace (recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    (non-orig (privk mf))))
+
+(defskeleton aikprot
+  (vars (i x mf pc name) (ek k akey) (srk skey))
+  (defstrand tpm 4 (mf mf) (pc pc))
+  (non-orig (privk pc)))
+
+(defskeleton aikprot
+  (vars (i x mf pc name) (ek k akey) (srk skey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (non-orig (privk pc)))
+
diff --git a/tst/aik.tst b/tst/aik.tst
new file mode 100644
--- /dev/null
+++ b/tst/aik.tst
@@ -0,0 +1,561 @@
+(herald "Anonymous identity protocol from TCG")
+
+(comment "CPSA 3.4.0")
+(comment "All input read from aik.scm")
+
+(defprotocol aikprot basic
+  (defrole ca
+    (vars (mf name) (ek akey))
+    (trace (send (enc "ekc" mf ek (privk mf))))
+    (non-orig (invk ek)))
+  (defrole tpm
+    (vars (i x mf pc name) (ek k akey) (srk skey))
+    (trace (recv (cat x i (enc "ekc" mf ek (privk mf))))
+      (send (cat i k x (enc "ekc" mf ek (privk mf))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    (non-orig srk (invk ek))
+    (uniq-orig k (invk k)))
+  (defrole pca
+    (vars (i x mf pc name) (ek k akey))
+    (trace (recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    (non-orig (privk mf))))
+
+(defskeleton aikprot
+  (vars (mf pc i x name) (srk skey) (ek k akey))
+  (defstrand tpm 4 (i i) (x x) (mf mf) (pc pc) (srk srk) (ek ek) (k k))
+  (non-orig srk (invk ek) (privk pc))
+  (uniq-orig k (invk k))
+  (traces
+    ((recv (cat x i (enc "ekc" mf ek (privk mf))))
+      (send (cat i k x (enc "ekc" mf ek (privk mf))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk)))))
+  (label 0)
+  (unrealized (0 2))
+  (origs (k (0 1)) ((invk k) (0 3)))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton aikprot
+  (vars (mf pc i x mf-0 name) (srk skey) (ek k ek-0 akey))
+  (defstrand tpm 4 (i i) (x x) (mf mf) (pc pc) (srk srk) (ek ek) (k k))
+  (defstrand pca 2 (i i) (x x) (mf mf-0) (pc pc) (ek ek-0) (k k))
+  (precedes ((0 1) (1 0)) ((1 1) (0 2)))
+  (non-orig srk (invk ek) (privk pc) (privk mf-0))
+  (uniq-orig k (invk k))
+  (operation encryption-test (added-strand pca 2)
+    (enc "aic" i k x (privk pc)) (0 2))
+  (traces
+    ((recv (cat x i (enc "ekc" mf ek (privk mf))))
+      (send (cat i k x (enc "ekc" mf ek (privk mf))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    ((recv (cat i k x (enc "ekc" mf-0 ek-0 (privk mf-0))))
+      (send (enc (enc "aic" i k x (privk pc)) ek-0))))
+  (label 1)
+  (parent 0)
+  (unrealized (1 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton aikprot
+  (vars (mf pc i x mf-0 name) (srk skey) (ek k ek-0 akey))
+  (defstrand tpm 4 (i i) (x x) (mf mf) (pc pc) (srk srk) (ek ek) (k k))
+  (defstrand pca 2 (i i) (x x) (mf mf-0) (pc pc) (ek ek-0) (k k))
+  (defstrand ca 1 (mf mf-0) (ek ek-0))
+  (precedes ((0 1) (1 0)) ((1 1) (0 2)) ((2 0) (1 0)))
+  (non-orig srk (invk ek) (invk ek-0) (privk pc) (privk mf-0))
+  (uniq-orig k (invk k))
+  (operation encryption-test (added-strand ca 1)
+    (enc "ekc" mf-0 ek-0 (privk mf-0)) (1 0))
+  (traces
+    ((recv (cat x i (enc "ekc" mf ek (privk mf))))
+      (send (cat i k x (enc "ekc" mf ek (privk mf))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    ((recv (cat i k x (enc "ekc" mf-0 ek-0 (privk mf-0))))
+      (send (enc (enc "aic" i k x (privk pc)) ek-0)))
+    ((send (enc "ekc" mf-0 ek-0 (privk mf-0)))))
+  (label 2)
+  (parent 1)
+  (unrealized (0 2))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton aikprot
+  (vars (mf pc i x mf-0 name) (srk skey) (k ek akey))
+  (defstrand tpm 4 (i i) (x x) (mf mf) (pc pc) (srk srk) (ek ek) (k k))
+  (defstrand pca 2 (i i) (x x) (mf mf-0) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf-0) (ek ek))
+  (precedes ((0 1) (1 0)) ((1 1) (0 2)) ((2 0) (1 0)))
+  (non-orig srk (invk ek) (privk pc) (privk mf-0))
+  (uniq-orig k (invk k))
+  (operation encryption-test (contracted (ek-0 ek))
+    (enc "aic" i k x (privk pc)) (0 2)
+    (enc (enc "aic" i k x (privk pc)) ek))
+  (traces
+    ((recv (cat x i (enc "ekc" mf ek (privk mf))))
+      (send (cat i k x (enc "ekc" mf ek (privk mf))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    ((recv (cat i k x (enc "ekc" mf-0 ek (privk mf-0))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf-0 ek (privk mf-0)))))
+  (label 3)
+  (parent 2)
+  (unrealized)
+  (shape)
+  (maps ((0) ((mf mf) (pc pc) (i i) (x x) (ek ek) (k k) (srk srk))))
+  (origs (k (0 1)) ((invk k) (0 3))))
+
+(defskeleton aikprot
+  (vars (mf pc i x mf-0 mf-1 name) (srk skey) (ek k ek-0 ek-1 akey))
+  (defstrand tpm 4 (i i) (x x) (mf mf) (pc pc) (srk srk) (ek ek) (k k))
+  (defstrand pca 2 (i i) (x x) (mf mf-0) (pc pc) (ek ek-0) (k k))
+  (defstrand ca 1 (mf mf-0) (ek ek-0))
+  (defstrand pca 2 (i i) (x x) (mf mf-1) (pc pc) (ek ek-1) (k k))
+  (precedes ((0 1) (1 0)) ((0 1) (3 0)) ((1 1) (0 2)) ((2 0) (1 0))
+    ((3 1) (0 2)))
+  (non-orig srk (invk ek) (invk ek-0) (privk pc) (privk mf-0)
+    (privk mf-1))
+  (uniq-orig k (invk k))
+  (operation encryption-test (added-strand pca 2)
+    (enc "aic" i k x (privk pc)) (0 2)
+    (enc (enc "aic" i k x (privk pc)) ek-0))
+  (traces
+    ((recv (cat x i (enc "ekc" mf ek (privk mf))))
+      (send (cat i k x (enc "ekc" mf ek (privk mf))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    ((recv (cat i k x (enc "ekc" mf-0 ek-0 (privk mf-0))))
+      (send (enc (enc "aic" i k x (privk pc)) ek-0)))
+    ((send (enc "ekc" mf-0 ek-0 (privk mf-0))))
+    ((recv (cat i k x (enc "ekc" mf-1 ek-1 (privk mf-1))))
+      (send (enc (enc "aic" i k x (privk pc)) ek-1))))
+  (label 4)
+  (parent 2)
+  (seen 2)
+  (unrealized (3 0))
+  (comment "1 in cohort - 0 not yet seen"))
+
+(comment "Nothing left to do")
+
+(defprotocol aikprot basic
+  (defrole ca
+    (vars (mf name) (ek akey))
+    (trace (send (enc "ekc" mf ek (privk mf))))
+    (non-orig (invk ek)))
+  (defrole tpm
+    (vars (i x mf pc name) (ek k akey) (srk skey))
+    (trace (recv (cat x i (enc "ekc" mf ek (privk mf))))
+      (send (cat i k x (enc "ekc" mf ek (privk mf))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    (non-orig srk (invk ek))
+    (uniq-orig k (invk k)))
+  (defrole pca
+    (vars (i x mf pc name) (ek k akey))
+    (trace (recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    (non-orig (privk mf))))
+
+(defskeleton aikprot
+  (vars (i x pc name) (k akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (non-orig (privk pc))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc)))))
+  (label 5)
+  (unrealized (0 0))
+  (origs)
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton aikprot
+  (vars (i x pc mf name) (k ek akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (defstrand pca 2 (i i) (x x) (mf mf) (pc pc) (ek ek) (k k))
+  (precedes ((1 1) (0 0)))
+  (non-orig (privk pc) (privk mf))
+  (operation encryption-test (added-strand pca 2)
+    (enc "aic" i k x (privk pc)) (0 0))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc))))
+    ((recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek))))
+  (label 6)
+  (parent 5)
+  (unrealized (1 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton aikprot
+  (vars (i x pc mf name) (k ek akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (defstrand pca 2 (i i) (x x) (mf mf) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf) (ek ek))
+  (precedes ((1 1) (0 0)) ((2 0) (1 0)))
+  (non-orig (invk ek) (privk pc) (privk mf))
+  (operation encryption-test (added-strand ca 1)
+    (enc "ekc" mf ek (privk mf)) (1 0))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc))))
+    ((recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf ek (privk mf)))))
+  (label 7)
+  (parent 6)
+  (unrealized (0 0))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton aikprot
+  (vars (i x pc mf mf-0 name) (srk skey) (k ek akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (defstrand pca 2 (i i) (x x) (mf mf) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf) (ek ek))
+  (defstrand tpm 4 (i i) (x x) (mf mf-0) (pc pc) (srk srk) (ek ek)
+    (k k))
+  (precedes ((1 1) (0 0)) ((2 0) (1 0)) ((3 1) (1 0)) ((3 3) (0 0)))
+  (non-orig srk (invk ek) (privk pc) (privk mf))
+  (uniq-orig k (invk k))
+  (operation encryption-test (added-strand tpm 4)
+    (enc "aic" i k x (privk pc)) (0 0)
+    (enc (enc "aic" i k x (privk pc)) ek))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc))))
+    ((recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf ek (privk mf))))
+    ((recv (cat x i (enc "ekc" mf-0 ek (privk mf-0))))
+      (send (cat i k x (enc "ekc" mf-0 ek (privk mf-0))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk)))))
+  (label 8)
+  (parent 7)
+  (unrealized (3 2))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton aikprot
+  (vars (i x pc mf mf-0 name) (k ek ek-0 akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (defstrand pca 2 (i i) (x x) (mf mf) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf) (ek ek))
+  (defstrand pca 2 (i i) (x x) (mf mf-0) (pc pc) (ek ek-0) (k k))
+  (precedes ((1 1) (0 0)) ((2 0) (1 0)) ((3 1) (0 0)))
+  (non-orig (invk ek) (privk pc) (privk mf) (privk mf-0))
+  (operation encryption-test (added-strand pca 2)
+    (enc "aic" i k x (privk pc)) (0 0)
+    (enc (enc "aic" i k x (privk pc)) ek))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc))))
+    ((recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf ek (privk mf))))
+    ((recv (cat i k x (enc "ekc" mf-0 ek-0 (privk mf-0))))
+      (send (enc (enc "aic" i k x (privk pc)) ek-0))))
+  (label 9)
+  (parent 7)
+  (seen 7)
+  (unrealized (3 0))
+  (comment "1 in cohort - 0 not yet seen"))
+
+(defskeleton aikprot
+  (vars (i x pc mf mf-0 name) (srk skey) (k ek akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (defstrand pca 2 (i i) (x x) (mf mf) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf) (ek ek))
+  (defstrand tpm 4 (i i) (x x) (mf mf-0) (pc pc) (srk srk) (ek ek)
+    (k k))
+  (precedes ((1 1) (3 2)) ((2 0) (1 0)) ((3 1) (1 0)) ((3 3) (0 0)))
+  (non-orig srk (invk ek) (privk pc) (privk mf))
+  (uniq-orig k (invk k))
+  (operation encryption-test (displaced 4 1 pca 2)
+    (enc "aic" i k x (privk pc)) (3 2))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc))))
+    ((recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf ek (privk mf))))
+    ((recv (cat x i (enc "ekc" mf-0 ek (privk mf-0))))
+      (send (cat i k x (enc "ekc" mf-0 ek (privk mf-0))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk)))))
+  (label 10)
+  (parent 8)
+  (unrealized)
+  (shape)
+  (maps ((0) ((i i) (x x) (pc pc) (k k))))
+  (origs (k (3 1)) ((invk k) (3 3))))
+
+(defskeleton aikprot
+  (vars (i x pc mf mf-0 mf-1 name) (srk skey) (k ek ek-0 akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (defstrand pca 2 (i i) (x x) (mf mf) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf) (ek ek))
+  (defstrand tpm 4 (i i) (x x) (mf mf-0) (pc pc) (srk srk) (ek ek)
+    (k k))
+  (defstrand pca 2 (i i) (x x) (mf mf-1) (pc pc) (ek ek-0) (k k))
+  (precedes ((1 1) (0 0)) ((2 0) (1 0)) ((3 1) (1 0)) ((3 1) (4 0))
+    ((3 3) (0 0)) ((4 1) (3 2)))
+  (non-orig srk (invk ek) (privk pc) (privk mf) (privk mf-1))
+  (uniq-orig k (invk k))
+  (operation encryption-test (added-strand pca 2)
+    (enc "aic" i k x (privk pc)) (3 2))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc))))
+    ((recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf ek (privk mf))))
+    ((recv (cat x i (enc "ekc" mf-0 ek (privk mf-0))))
+      (send (cat i k x (enc "ekc" mf-0 ek (privk mf-0))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    ((recv (cat i k x (enc "ekc" mf-1 ek-0 (privk mf-1))))
+      (send (enc (enc "aic" i k x (privk pc)) ek-0))))
+  (label 11)
+  (parent 8)
+  (unrealized (4 0))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton aikprot
+  (vars (i x pc mf mf-0 name) (srk skey) (k ek akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (defstrand pca 2 (i i) (x x) (mf mf) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf) (ek ek))
+  (defstrand tpm 4 (i i) (x x) (mf mf-0) (pc pc) (srk srk) (ek ek)
+    (k k))
+  (defstrand pca 2 (i i) (x x) (mf mf) (pc pc) (ek ek) (k k))
+  (precedes ((1 1) (0 0)) ((2 0) (1 0)) ((2 0) (4 0)) ((3 1) (1 0))
+    ((3 1) (4 0)) ((3 3) (0 0)) ((4 1) (3 2)))
+  (non-orig srk (invk ek) (privk pc) (privk mf))
+  (uniq-orig k (invk k))
+  (operation encryption-test (displaced 5 2 ca 1)
+    (enc "ekc" mf-1 ek-0 (privk mf-1)) (4 0))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc))))
+    ((recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf ek (privk mf))))
+    ((recv (cat x i (enc "ekc" mf-0 ek (privk mf-0))))
+      (send (cat i k x (enc "ekc" mf-0 ek (privk mf-0))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    ((recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek))))
+  (label 12)
+  (parent 11)
+  (seen 10)
+  (unrealized)
+  (comment "1 in cohort - 0 not yet seen"))
+
+(defskeleton aikprot
+  (vars (i x pc mf mf-0 mf-1 name) (srk skey) (k ek ek-0 akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (defstrand pca 2 (i i) (x x) (mf mf) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf) (ek ek))
+  (defstrand tpm 4 (i i) (x x) (mf mf-0) (pc pc) (srk srk) (ek ek)
+    (k k))
+  (defstrand pca 2 (i i) (x x) (mf mf-1) (pc pc) (ek ek-0) (k k))
+  (defstrand ca 1 (mf mf-1) (ek ek-0))
+  (precedes ((1 1) (0 0)) ((2 0) (1 0)) ((3 1) (1 0)) ((3 1) (4 0))
+    ((3 3) (0 0)) ((4 1) (3 2)) ((5 0) (4 0)))
+  (non-orig srk (invk ek) (invk ek-0) (privk pc) (privk mf)
+    (privk mf-1))
+  (uniq-orig k (invk k))
+  (operation encryption-test (added-strand ca 1)
+    (enc "ekc" mf-1 ek-0 (privk mf-1)) (4 0))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc))))
+    ((recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf ek (privk mf))))
+    ((recv (cat x i (enc "ekc" mf-0 ek (privk mf-0))))
+      (send (cat i k x (enc "ekc" mf-0 ek (privk mf-0))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    ((recv (cat i k x (enc "ekc" mf-1 ek-0 (privk mf-1))))
+      (send (enc (enc "aic" i k x (privk pc)) ek-0)))
+    ((send (enc "ekc" mf-1 ek-0 (privk mf-1)))))
+  (label 13)
+  (parent 11)
+  (unrealized (3 2))
+  (comment "3 in cohort - 3 not yet seen"))
+
+(defskeleton aikprot
+  (vars (i x pc mf mf-0 mf-1 name) (srk skey) (k ek akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (defstrand pca 2 (i i) (x x) (mf mf) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf) (ek ek))
+  (defstrand tpm 4 (i i) (x x) (mf mf-0) (pc pc) (srk srk) (ek ek)
+    (k k))
+  (defstrand pca 2 (i i) (x x) (mf mf-1) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf-1) (ek ek))
+  (precedes ((1 1) (0 0)) ((2 0) (1 0)) ((3 1) (1 0)) ((3 1) (4 0))
+    ((3 3) (0 0)) ((4 1) (3 2)) ((5 0) (4 0)))
+  (non-orig srk (invk ek) (privk pc) (privk mf) (privk mf-1))
+  (uniq-orig k (invk k))
+  (operation encryption-test (contracted (ek-0 ek))
+    (enc "aic" i k x (privk pc)) (3 2)
+    (enc (enc "aic" i k x (privk pc)) ek))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc))))
+    ((recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf ek (privk mf))))
+    ((recv (cat x i (enc "ekc" mf-0 ek (privk mf-0))))
+      (send (cat i k x (enc "ekc" mf-0 ek (privk mf-0))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    ((recv (cat i k x (enc "ekc" mf-1 ek (privk mf-1))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf-1 ek (privk mf-1)))))
+  (label 14)
+  (parent 13)
+  (unrealized)
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton aikprot
+  (vars (i x pc mf mf-0 mf-1 name) (srk skey) (k ek ek-0 akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (defstrand pca 2 (i i) (x x) (mf mf) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf) (ek ek))
+  (defstrand tpm 4 (i i) (x x) (mf mf-0) (pc pc) (srk srk) (ek ek)
+    (k k))
+  (defstrand pca 2 (i i) (x x) (mf mf-1) (pc pc) (ek ek-0) (k k))
+  (defstrand ca 1 (mf mf-1) (ek ek-0))
+  (precedes ((1 1) (3 2)) ((2 0) (1 0)) ((3 1) (1 0)) ((3 1) (4 0))
+    ((3 3) (0 0)) ((4 1) (3 2)) ((5 0) (4 0)))
+  (non-orig srk (invk ek) (invk ek-0) (privk pc) (privk mf)
+    (privk mf-1))
+  (uniq-orig k (invk k))
+  (operation encryption-test (displaced 6 1 pca 2)
+    (enc "aic" i k x (privk pc)) (3 2)
+    (enc (enc "aic" i k x (privk pc)) ek-0))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc))))
+    ((recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf ek (privk mf))))
+    ((recv (cat x i (enc "ekc" mf-0 ek (privk mf-0))))
+      (send (cat i k x (enc "ekc" mf-0 ek (privk mf-0))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    ((recv (cat i k x (enc "ekc" mf-1 ek-0 (privk mf-1))))
+      (send (enc (enc "aic" i k x (privk pc)) ek-0)))
+    ((send (enc "ekc" mf-1 ek-0 (privk mf-1)))))
+  (label 15)
+  (parent 13)
+  (unrealized)
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton aikprot
+  (vars (i x pc mf mf-0 mf-1 mf-2 name) (srk skey)
+    (k ek ek-0 ek-1 akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (defstrand pca 2 (i i) (x x) (mf mf) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf) (ek ek))
+  (defstrand tpm 4 (i i) (x x) (mf mf-0) (pc pc) (srk srk) (ek ek)
+    (k k))
+  (defstrand pca 2 (i i) (x x) (mf mf-1) (pc pc) (ek ek-0) (k k))
+  (defstrand ca 1 (mf mf-1) (ek ek-0))
+  (defstrand pca 2 (i i) (x x) (mf mf-2) (pc pc) (ek ek-1) (k k))
+  (precedes ((1 1) (0 0)) ((2 0) (1 0)) ((3 1) (1 0)) ((3 1) (4 0))
+    ((3 1) (6 0)) ((3 3) (0 0)) ((4 1) (3 2)) ((5 0) (4 0))
+    ((6 1) (3 2)))
+  (non-orig srk (invk ek) (invk ek-0) (privk pc) (privk mf) (privk mf-1)
+    (privk mf-2))
+  (uniq-orig k (invk k))
+  (operation encryption-test (added-strand pca 2)
+    (enc "aic" i k x (privk pc)) (3 2)
+    (enc (enc "aic" i k x (privk pc)) ek-0))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc))))
+    ((recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf ek (privk mf))))
+    ((recv (cat x i (enc "ekc" mf-0 ek (privk mf-0))))
+      (send (cat i k x (enc "ekc" mf-0 ek (privk mf-0))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    ((recv (cat i k x (enc "ekc" mf-1 ek-0 (privk mf-1))))
+      (send (enc (enc "aic" i k x (privk pc)) ek-0)))
+    ((send (enc "ekc" mf-1 ek-0 (privk mf-1))))
+    ((recv (cat i k x (enc "ekc" mf-2 ek-1 (privk mf-2))))
+      (send (enc (enc "aic" i k x (privk pc)) ek-1))))
+  (label 16)
+  (parent 13)
+  (seen 13)
+  (unrealized (6 0))
+  (comment "1 in cohort - 0 not yet seen"))
+
+(defskeleton aikprot
+  (vars (i x pc mf mf-0 mf-1 name) (srk skey) (k ek akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (defstrand ca 1 (mf mf) (ek ek))
+  (defstrand tpm 4 (i i) (x x) (mf mf-0) (pc pc) (srk srk) (ek ek)
+    (k k))
+  (defstrand pca 2 (i i) (x x) (mf mf-1) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf-1) (ek ek))
+  (precedes ((1 0) (0 0)) ((2 1) (3 0)) ((2 3) (0 0)) ((3 1) (2 2))
+    ((4 0) (3 0)))
+  (non-orig srk (invk ek) (privk pc) (privk mf) (privk mf-1))
+  (uniq-orig k (invk k))
+  (operation generalization deleted (1 0))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc))))
+    ((send (enc "ekc" mf ek (privk mf))))
+    ((recv (cat x i (enc "ekc" mf-0 ek (privk mf-0))))
+      (send (cat i k x (enc "ekc" mf-0 ek (privk mf-0))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    ((recv (cat i k x (enc "ekc" mf-1 ek (privk mf-1))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf-1 ek (privk mf-1)))))
+  (label 17)
+  (parent 14)
+  (seen 10)
+  (unrealized)
+  (comment "1 in cohort - 0 not yet seen"))
+
+(defskeleton aikprot
+  (vars (i x pc mf mf-0 mf-1 name) (srk skey) (k ek ek-0 akey))
+  (deflistener (enc "aic" i k x (privk pc)))
+  (defstrand pca 2 (i i) (x x) (mf mf) (pc pc) (ek ek) (k k))
+  (defstrand ca 1 (mf mf) (ek ek))
+  (defstrand tpm 4 (i i) (x x) (mf mf-0) (pc pc) (srk srk) (ek ek)
+    (k k))
+  (defstrand ca 1 (mf mf-1) (ek ek-0))
+  (precedes ((1 1) (3 2)) ((2 0) (1 0)) ((3 1) (1 0)) ((3 3) (0 0))
+    ((4 0) (3 2)))
+  (non-orig srk (invk ek) (invk ek-0) (privk pc) (privk mf)
+    (privk mf-1))
+  (uniq-orig k (invk k))
+  (operation generalization deleted (4 0))
+  (traces
+    ((recv (enc "aic" i k x (privk pc)))
+      (send (enc "aic" i k x (privk pc))))
+    ((recv (cat i k x (enc "ekc" mf ek (privk mf))))
+      (send (enc (enc "aic" i k x (privk pc)) ek)))
+    ((send (enc "ekc" mf ek (privk mf))))
+    ((recv (cat x i (enc "ekc" mf-0 ek (privk mf-0))))
+      (send (cat i k x (enc "ekc" mf-0 ek (privk mf-0))))
+      (recv (enc (enc "aic" i k x (privk pc)) ek))
+      (send (cat (enc "aic" i k x (privk pc)) (enc k (invk k) srk))))
+    ((send (enc "ekc" mf-1 ek-0 (privk mf-1)))))
+  (label 18)
+  (parent 15)
+  (seen 10)
+  (unrealized)
+  (comment "1 in cohort - 0 not yet seen"))
+
+(comment "Nothing left to do")
diff --git a/tst/kerb.scm b/tst/kerb.scm
new file mode 100644
--- /dev/null
+++ b/tst/kerb.scm
@@ -0,0 +1,76 @@
+; Flawed and Fixed Kerberos
+
+; In this example, the initiator is trying to send a private message
+; to the responder.  Each are presumed to share a long-term private key
+; with the key server, which will choose a fresh session key on request
+; and encrypt it for both parties.
+
+; A flaw exists in the protocol intentionally: the initiator will need
+; confirmation that the session key is shared between the initiator and
+; the partner they specified.
+
+; This version of the protocol is not modeled properly and misses the flaw.
+(defprotocol kerb-flawed basic
+  (defrole init
+    (vars (a b s name) (m n text) (k skey))
+    (trace
+       ;; Make the request
+       (send (cat a b n))
+       ;; Receive the encrypted key and ticket
+       (recv (cat (enc k n (ltk a s)) (enc k a b (ltk b s))))
+       (send (cat (enc m k) (enc k a b (ltk b s)))))
+    (uniq-orig n))
+  (defrole resp
+    (vars (a b s name) (m text) (k skey))
+    (trace
+       (recv (cat (enc m k) (enc k a b (ltk b s))))))
+  (defrole keyserv
+    (vars (a b s name) (m n text) (k skey))
+    (trace
+       ;; Receive the request
+       (recv (cat a b n))
+       ;; Send the encrypted key and ticket
+       (send (cat (enc k n (ltk a s)) (enc k a b (ltk b s)))))
+    (uniq-orig k))
+)
+
+; This skeleton should be dead, even though m can leak
+(defskeleton kerb-flawed
+  (vars (a b s name) (m text))
+  (defstrand init 3 (a a) (b b) (s s) (m m))
+  (deflistener m)
+  (non-orig (ltk a s) (ltk b s))
+  (uniq-orig m))
+
+; This version of the protocol is not modeled properly, with a generic variable (ticket)
+(defprotocol kerb-flawed2 basic
+  (defrole init
+    (vars (a b s name) (ticket mesg) (m n text) (k skey))
+    (trace
+       ;; Make the request
+       (send (cat a b n))
+       ;; Receive the encrypted key and ticket
+       (recv (cat (enc k n (ltk a s)) ticket))
+       (send (cat (enc m k) ticket)))
+    (uniq-orig n))
+  (defrole resp
+    (vars (a b s name) (m text) (k skey))
+    (trace
+       (recv (cat (enc m k) (enc k a b (ltk b s))))))
+  (defrole keyserv
+    (vars (a b s name) (m n text) (k skey))
+    (trace
+       ;; Receive the request
+       (recv (cat a b n))
+       ;; Send the encrypted key and ticket
+       (send (cat (enc k n (ltk a s)) (enc k a b (ltk b s)))))
+    (uniq-orig k))
+)
+
+; This skeleton should have a shape, demonstrating that m may be leaked.
+(defskeleton kerb-flawed2
+  (vars (a b s name) (m text))
+  (defstrand init 3 (a a) (b b) (s s) (m m))
+  (deflistener m)
+  (non-orig (ltk a s) (ltk b s))
+  (uniq-orig m))
diff --git a/tst/kerb.tst b/tst/kerb.tst
new file mode 100644
--- /dev/null
+++ b/tst/kerb.tst
@@ -0,0 +1,186 @@
+(comment "CPSA 3.4.0")
+(comment "All input read from kerb.scm")
+
+(defprotocol kerb-flawed basic
+  (defrole init
+    (vars (a b s name) (m n text) (k skey))
+    (trace (send (cat a b n))
+      (recv (cat (enc k n (ltk a s)) (enc k a b (ltk b s))))
+      (send (cat (enc m k) (enc k a b (ltk b s)))))
+    (uniq-orig n))
+  (defrole resp
+    (vars (a b s name) (m text) (k skey))
+    (trace (recv (cat (enc m k) (enc k a b (ltk b s))))))
+  (defrole keyserv
+    (vars (a b s name) (n text) (k skey))
+    (trace (recv (cat a b n))
+      (send (cat (enc k n (ltk a s)) (enc k a b (ltk b s)))))
+    (uniq-orig k)))
+
+(defskeleton kerb-flawed
+  (vars (m n text) (a b s name) (k skey))
+  (defstrand init 3 (m m) (n n) (a a) (b b) (s s) (k k))
+  (deflistener m)
+  (non-orig (ltk a s) (ltk b s))
+  (uniq-orig m n)
+  (traces
+    ((send (cat a b n))
+      (recv (cat (enc k n (ltk a s)) (enc k a b (ltk b s))))
+      (send (cat (enc m k) (enc k a b (ltk b s))))) ((recv m) (send m)))
+  (label 0)
+  (unrealized (0 1) (1 0))
+  (preskeleton)
+  (comment "Not a skeleton"))
+
+(defskeleton kerb-flawed
+  (vars (m n text) (a b s name) (k skey))
+  (defstrand init 3 (m m) (n n) (a a) (b b) (s s) (k k))
+  (deflistener m)
+  (precedes ((0 2) (1 0)))
+  (non-orig (ltk a s) (ltk b s))
+  (uniq-orig m n)
+  (traces
+    ((send (cat a b n))
+      (recv (cat (enc k n (ltk a s)) (enc k a b (ltk b s))))
+      (send (cat (enc m k) (enc k a b (ltk b s))))) ((recv m) (send m)))
+  (label 1)
+  (parent 0)
+  (unrealized (0 1))
+  (origs (n (0 0)) (m (0 2)))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton kerb-flawed
+  (vars (m n text) (a b s b-0 name) (k skey))
+  (defstrand init 3 (m m) (n n) (a a) (b b) (s s) (k k))
+  (deflistener m)
+  (defstrand keyserv 2 (n n) (a a) (b b-0) (s s) (k k))
+  (precedes ((0 0) (2 0)) ((0 2) (1 0)) ((2 1) (0 1)))
+  (non-orig (ltk a s) (ltk b s))
+  (uniq-orig m n k)
+  (operation encryption-test (added-strand keyserv 2)
+    (enc k n (ltk a s)) (0 1))
+  (traces
+    ((send (cat a b n))
+      (recv (cat (enc k n (ltk a s)) (enc k a b (ltk b s))))
+      (send (cat (enc m k) (enc k a b (ltk b s))))) ((recv m) (send m))
+    ((recv (cat a b-0 n))
+      (send (cat (enc k n (ltk a s)) (enc k a b-0 (ltk b-0 s))))))
+  (label 2)
+  (parent 1)
+  (unrealized (0 1))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton kerb-flawed
+  (vars (m n text) (a s b name) (k skey))
+  (defstrand init 3 (m m) (n n) (a a) (b b) (s s) (k k))
+  (deflistener m)
+  (defstrand keyserv 2 (n n) (a a) (b b) (s s) (k k))
+  (precedes ((0 0) (2 0)) ((0 2) (1 0)) ((2 1) (0 1)))
+  (non-orig (ltk a s) (ltk b s))
+  (uniq-orig m n k)
+  (operation encryption-test (displaced 3 2 keyserv 2)
+    (enc k a b-0 (ltk b-0 s)) (0 1))
+  (traces
+    ((send (cat a b n))
+      (recv (cat (enc k n (ltk a s)) (enc k a b (ltk b s))))
+      (send (cat (enc m k) (enc k a b (ltk b s))))) ((recv m) (send m))
+    ((recv (cat a b n))
+      (send (cat (enc k n (ltk a s)) (enc k a b (ltk b s))))))
+  (label 3)
+  (parent 2)
+  (unrealized (1 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton kerb-flawed
+  (vars (m n text) (a s b name) (k skey))
+  (defstrand init 3 (m m) (n n) (a a) (b b) (s s) (k k))
+  (deflistener m)
+  (defstrand keyserv 2 (n n) (a a) (b b) (s s) (k k))
+  (deflistener k)
+  (precedes ((0 0) (2 0)) ((0 2) (1 0)) ((2 1) (0 1)) ((2 1) (3 0))
+    ((3 1) (1 0)))
+  (non-orig (ltk a s) (ltk b s))
+  (uniq-orig m n k)
+  (operation nonce-test (added-listener k) m (1 0) (enc m k))
+  (traces
+    ((send (cat a b n))
+      (recv (cat (enc k n (ltk a s)) (enc k a b (ltk b s))))
+      (send (cat (enc m k) (enc k a b (ltk b s))))) ((recv m) (send m))
+    ((recv (cat a b n))
+      (send (cat (enc k n (ltk a s)) (enc k a b (ltk b s)))))
+    ((recv k) (send k)))
+  (label 4)
+  (parent 3)
+  (unrealized (3 0))
+  (comment "empty cohort"))
+
+(comment "Nothing left to do")
+
+(defprotocol kerb-flawed2 basic
+  (defrole init
+    (vars (a b s name) (ticket mesg) (m n text) (k skey))
+    (trace (send (cat a b n)) (recv (cat (enc k n (ltk a s)) ticket))
+      (send (cat (enc m k) ticket)))
+    (uniq-orig n))
+  (defrole resp
+    (vars (a b s name) (m text) (k skey))
+    (trace (recv (cat (enc m k) (enc k a b (ltk b s))))))
+  (defrole keyserv
+    (vars (a b s name) (n text) (k skey))
+    (trace (recv (cat a b n))
+      (send (cat (enc k n (ltk a s)) (enc k a b (ltk b s)))))
+    (uniq-orig k)))
+
+(defskeleton kerb-flawed2
+  (vars (ticket mesg) (m n text) (a b s name) (k skey))
+  (defstrand init 3 (ticket ticket) (m m) (n n) (a a) (b b) (s s) (k k))
+  (deflistener m)
+  (non-orig (ltk a s) (ltk b s))
+  (uniq-orig m n)
+  (traces
+    ((send (cat a b n)) (recv (cat (enc k n (ltk a s)) ticket))
+      (send (cat (enc m k) ticket))) ((recv m) (send m)))
+  (label 5)
+  (unrealized (0 1) (1 0))
+  (preskeleton)
+  (comment "Not a skeleton"))
+
+(defskeleton kerb-flawed2
+  (vars (ticket mesg) (m n text) (a b s name) (k skey))
+  (defstrand init 3 (ticket ticket) (m m) (n n) (a a) (b b) (s s) (k k))
+  (deflistener m)
+  (precedes ((0 2) (1 0)))
+  (non-orig (ltk a s) (ltk b s))
+  (uniq-orig m n)
+  (traces
+    ((send (cat a b n)) (recv (cat (enc k n (ltk a s)) ticket))
+      (send (cat (enc m k) ticket))) ((recv m) (send m)))
+  (label 6)
+  (parent 5)
+  (unrealized (0 1))
+  (origs (n (0 0)) (m (0 2)))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton kerb-flawed2
+  (vars (ticket mesg) (m n text) (a b s b-0 name) (k skey))
+  (defstrand init 3 (ticket ticket) (m m) (n n) (a a) (b b) (s s) (k k))
+  (deflistener m)
+  (defstrand keyserv 2 (n n) (a a) (b b-0) (s s) (k k))
+  (precedes ((0 0) (2 0)) ((0 2) (1 0)) ((2 1) (0 1)))
+  (non-orig (ltk a s) (ltk b s))
+  (uniq-orig m n k)
+  (operation encryption-test (added-strand keyserv 2)
+    (enc k n (ltk a s)) (0 1))
+  (traces
+    ((send (cat a b n)) (recv (cat (enc k n (ltk a s)) ticket))
+      (send (cat (enc m k) ticket))) ((recv m) (send m))
+    ((recv (cat a b-0 n))
+      (send (cat (enc k n (ltk a s)) (enc k a b-0 (ltk b-0 s))))))
+  (label 7)
+  (parent 6)
+  (unrealized)
+  (shape)
+  (maps ((0 1) ((a a) (b b) (s s) (m m) (ticket ticket) (n n) (k k))))
+  (origs (k (2 1)) (n (0 0)) (m (0 2))))
+
+(comment "Nothing left to do")
diff --git a/tst/plaindh.tst b/tst/plaindh.tst
--- a/tst/plaindh.tst
+++ b/tst/plaindh.tst
@@ -773,7 +773,7 @@
   (defstrand init 4 (n n) (h (exp (gen) y)) (x x))
   (uniq-gen x)
   (uniq-orig n)
-  (operation generalization forgot y)
+  (operation generalization forgot ((absent (y (exp (gen) x)))))
   (traces
     ((send (exp (gen) x)) (recv (exp (gen) y))
       (send (enc n (exp (gen) (mul y x)))) (recv n)))
@@ -3311,7 +3311,7 @@
   (precur (1 0))
   (uniq-gen x)
   (uniq-orig n)
-  (operation generalization forgot y)
+  (operation generalization forgot ((absent (y (exp (gen) (mul w x))))))
   (traces
     ((send (exp (gen) x)) (recv (exp (gen) (mul y w)))
       (send (enc n (exp (gen) (mul y w x)))) (recv n))
diff --git a/tst/reflect.scm b/tst/reflect.scm
new file mode 100644
--- /dev/null
+++ b/tst/reflect.scm
@@ -0,0 +1,32 @@
+(herald reflect)
+
+;; A simple protocol vulnerable to a reflection attack
+
+(defprotocol reflect basic
+  (defrole init
+    (vars (a b akey))
+    (trace
+     (send (enc b (invk a)))
+     (recv (enc a (invk b)))))
+  (defrole resp
+    (vars (a b akey))
+    (trace
+     (recv (enc b (invk a)))
+     (send (enc a (invk b))))))
+
+;; Expect two shapes
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b b))
+  (non-orig (invk a) (invk b)))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand init 2 (a a) (b b))
+  (non-orig (invk a) (invk b)))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b (invk b)))
+  (non-orig (invk a) b))
diff --git a/tst/reflect.tst b/tst/reflect.tst
new file mode 100644
--- /dev/null
+++ b/tst/reflect.tst
@@ -0,0 +1,482 @@
+(herald reflect)
+
+(comment "CPSA 3.4.0")
+(comment "All input read from reflect.scm")
+
+(defprotocol reflect basic
+  (defrole init
+    (vars (a b akey))
+    (trace (send (enc b (invk a))) (recv (enc a (invk b)))))
+  (defrole resp
+    (vars (a b akey))
+    (trace (recv (enc b (invk a))) (send (enc a (invk b))))))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b b))
+  (non-orig (invk a) (invk b))
+  (traces ((recv (enc b (invk a)))))
+  (label 0)
+  (unrealized (0 0))
+  (origs)
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b b))
+  (defstrand init 1 (a a) (b b))
+  (precedes ((1 0) (0 0)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand init 1) (enc b (invk a))
+    (0 0))
+  (traces ((recv (enc b (invk a)))) ((send (enc b (invk a)))))
+  (label 1)
+  (parent 0)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a a) (b b))))
+  (origs))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (precedes ((1 1) (0 0)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand resp 2) (enc b (invk a))
+    (0 0))
+  (traces ((recv (enc b (invk a))))
+    ((recv (enc a (invk b))) (send (enc b (invk a)))))
+  (label 2)
+  (parent 0)
+  (unrealized (1 0))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (defstrand init 1 (a b) (b a))
+  (precedes ((1 1) (0 0)) ((2 0) (1 0)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand init 1) (enc a (invk b))
+    (1 0))
+  (traces ((recv (enc b (invk a))))
+    ((recv (enc a (invk b))) (send (enc b (invk a))))
+    ((send (enc a (invk b)))))
+  (label 3)
+  (parent 2)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a a) (b b))))
+  (origs))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (defstrand resp 2 (a a) (b b))
+  (precedes ((1 1) (0 0)) ((2 1) (1 0)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand resp 2) (enc a (invk b))
+    (1 0))
+  (traces ((recv (enc b (invk a))))
+    ((recv (enc a (invk b))) (send (enc b (invk a))))
+    ((recv (enc b (invk a))) (send (enc a (invk b)))))
+  (label 4)
+  (parent 2)
+  (unrealized (2 0))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (defstrand resp 2 (a a) (b b))
+  (defstrand init 1 (a a) (b b))
+  (precedes ((1 1) (0 0)) ((2 1) (1 0)) ((3 0) (2 0)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand init 1) (enc b (invk a))
+    (2 0))
+  (traces ((recv (enc b (invk a))))
+    ((recv (enc a (invk b))) (send (enc b (invk a))))
+    ((recv (enc b (invk a))) (send (enc a (invk b))))
+    ((send (enc b (invk a)))))
+  (label 5)
+  (parent 4)
+  (unrealized)
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (defstrand resp 2 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (precedes ((1 1) (0 0)) ((2 1) (1 0)) ((3 1) (2 0)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand resp 2) (enc b (invk a))
+    (2 0))
+  (traces ((recv (enc b (invk a))))
+    ((recv (enc a (invk b))) (send (enc b (invk a))))
+    ((recv (enc b (invk a))) (send (enc a (invk b))))
+    ((recv (enc a (invk b))) (send (enc b (invk a)))))
+  (label 6)
+  (parent 4)
+  (seen 4)
+  (unrealized (3 0))
+  (comment "1 in cohort - 0 not yet seen"))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b b))
+  (defstrand resp 2 (a a) (b b))
+  (defstrand init 1 (a a) (b b))
+  (precedes ((1 1) (0 0)) ((2 0) (1 0)))
+  (non-orig (invk a) (invk b))
+  (operation generalization deleted (1 0))
+  (traces ((recv (enc b (invk a))))
+    ((recv (enc b (invk a))) (send (enc a (invk b))))
+    ((send (enc b (invk a)))))
+  (label 7)
+  (parent 5)
+  (seen 1)
+  (unrealized)
+  (comment "1 in cohort - 0 not yet seen"))
+
+(comment "Nothing left to do")
+
+(defprotocol reflect basic
+  (defrole init
+    (vars (a b akey))
+    (trace (send (enc b (invk a))) (recv (enc a (invk b)))))
+  (defrole resp
+    (vars (a b akey))
+    (trace (recv (enc b (invk a))) (send (enc a (invk b))))))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand init 2 (a a) (b b))
+  (non-orig (invk a) (invk b))
+  (traces ((send (enc b (invk a))) (recv (enc a (invk b)))))
+  (label 8)
+  (unrealized (0 1))
+  (origs)
+  (comment "3 in cohort - 3 not yet seen"))
+
+(defskeleton reflect
+  (vars (b akey))
+  (defstrand init 2 (a b) (b b))
+  (non-orig (invk b))
+  (operation encryption-test (displaced 1 0 init 1) (enc a (invk b))
+    (0 1))
+  (traces ((send (enc b (invk b))) (recv (enc b (invk b)))))
+  (label 9)
+  (parent 8)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a b) (b b))))
+  (origs))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand init 2 (a a) (b b))
+  (defstrand init 1 (a b) (b a))
+  (precedes ((1 0) (0 1)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand init 1) (enc a (invk b))
+    (0 1))
+  (traces ((send (enc b (invk a))) (recv (enc a (invk b))))
+    ((send (enc a (invk b)))))
+  (label 10)
+  (parent 8)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a a) (b b))))
+  (origs))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand init 2 (a a) (b b))
+  (defstrand resp 2 (a a) (b b))
+  (precedes ((1 1) (0 1)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand resp 2) (enc a (invk b))
+    (0 1))
+  (traces ((send (enc b (invk a))) (recv (enc a (invk b))))
+    ((recv (enc b (invk a))) (send (enc a (invk b)))))
+  (label 11)
+  (parent 8)
+  (unrealized (1 0))
+  (comment "3 in cohort - 3 not yet seen"))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand init 2 (a a) (b b))
+  (defstrand resp 2 (a a) (b b))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (displaced 2 0 init 1) (enc b (invk a))
+    (1 0))
+  (traces ((send (enc b (invk a))) (recv (enc a (invk b))))
+    ((recv (enc b (invk a))) (send (enc a (invk b)))))
+  (label 12)
+  (parent 11)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a a) (b b))))
+  (origs))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand init 2 (a a) (b b))
+  (defstrand resp 2 (a a) (b b))
+  (defstrand init 1 (a a) (b b))
+  (precedes ((1 1) (0 1)) ((2 0) (1 0)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand init 1) (enc b (invk a))
+    (1 0))
+  (traces ((send (enc b (invk a))) (recv (enc a (invk b))))
+    ((recv (enc b (invk a))) (send (enc a (invk b))))
+    ((send (enc b (invk a)))))
+  (label 13)
+  (parent 11)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a a) (b b))))
+  (origs))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand init 2 (a a) (b b))
+  (defstrand resp 2 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (precedes ((1 1) (0 1)) ((2 1) (1 0)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand resp 2) (enc b (invk a))
+    (1 0))
+  (traces ((send (enc b (invk a))) (recv (enc a (invk b))))
+    ((recv (enc b (invk a))) (send (enc a (invk b))))
+    ((recv (enc a (invk b))) (send (enc b (invk a)))))
+  (label 14)
+  (parent 11)
+  (unrealized (2 0))
+  (comment "3 in cohort - 3 not yet seen"))
+
+(defskeleton reflect
+  (vars (b akey))
+  (defstrand init 2 (a b) (b b))
+  (defstrand resp 2 (a b) (b b))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)))
+  (non-orig (invk b))
+  (operation encryption-test (displaced 3 0 init 1) (enc a (invk b))
+    (2 0))
+  (traces ((send (enc b (invk b))) (recv (enc b (invk b))))
+    ((recv (enc b (invk b))) (send (enc b (invk b)))))
+  (label 15)
+  (parent 14)
+  (seen 9)
+  (unrealized)
+  (comment "1 in cohort - 0 not yet seen"))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand init 2 (a a) (b b))
+  (defstrand resp 2 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (defstrand init 1 (a b) (b a))
+  (precedes ((1 1) (0 1)) ((2 1) (1 0)) ((3 0) (2 0)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand init 1) (enc a (invk b))
+    (2 0))
+  (traces ((send (enc b (invk a))) (recv (enc a (invk b))))
+    ((recv (enc b (invk a))) (send (enc a (invk b))))
+    ((recv (enc a (invk b))) (send (enc b (invk a))))
+    ((send (enc a (invk b)))))
+  (label 16)
+  (parent 14)
+  (unrealized)
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand init 2 (a a) (b b))
+  (defstrand resp 2 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (defstrand resp 2 (a a) (b b))
+  (precedes ((1 1) (0 1)) ((2 1) (1 0)) ((3 1) (2 0)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand resp 2) (enc a (invk b))
+    (2 0))
+  (traces ((send (enc b (invk a))) (recv (enc a (invk b))))
+    ((recv (enc b (invk a))) (send (enc a (invk b))))
+    ((recv (enc a (invk b))) (send (enc b (invk a))))
+    ((recv (enc b (invk a))) (send (enc a (invk b)))))
+  (label 17)
+  (parent 14)
+  (seen 14)
+  (unrealized (3 0))
+  (comment "1 in cohort - 0 not yet seen"))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand init 2 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (defstrand init 1 (a b) (b a))
+  (precedes ((1 1) (0 1)) ((2 0) (1 0)))
+  (non-orig (invk a) (invk b))
+  (operation generalization deleted (1 0))
+  (traces ((send (enc b (invk a))) (recv (enc a (invk b))))
+    ((recv (enc a (invk b))) (send (enc b (invk a))))
+    ((send (enc a (invk b)))))
+  (label 18)
+  (parent 16)
+  (seen 10)
+  (unrealized)
+  (comment "1 in cohort - 0 not yet seen"))
+
+(comment "Nothing left to do")
+
+(defprotocol reflect basic
+  (defrole init
+    (vars (a b akey))
+    (trace (send (enc b (invk a))) (recv (enc a (invk b)))))
+  (defrole resp
+    (vars (a b akey))
+    (trace (recv (enc b (invk a))) (send (enc a (invk b))))))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b (invk b)))
+  (non-orig b (invk a))
+  (traces ((recv (enc (invk b) (invk a)))))
+  (label 19)
+  (unrealized (0 0))
+  (origs)
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b (invk b)))
+  (defstrand init 1 (a a) (b (invk b)))
+  (precedes ((1 0) (0 0)))
+  (non-orig b (invk a))
+  (operation encryption-test (added-strand init 1)
+    (enc (invk b) (invk a)) (0 0))
+  (traces ((recv (enc (invk b) (invk a))))
+    ((send (enc (invk b) (invk a)))))
+  (label 20)
+  (parent 19)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a a) (b b))))
+  (origs))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b (invk b)))
+  (defstrand resp 2 (a (invk b)) (b a))
+  (precedes ((1 1) (0 0)))
+  (non-orig b (invk a))
+  (operation encryption-test (added-strand resp 2)
+    (enc (invk b) (invk a)) (0 0))
+  (traces ((recv (enc (invk b) (invk a))))
+    ((recv (enc a b)) (send (enc (invk b) (invk a)))))
+  (label 21)
+  (parent 19)
+  (unrealized (1 0))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton reflect
+  (vars (a a-0 akey))
+  (defstrand resp 1 (a a) (b a-0))
+  (defstrand resp 2 (a a-0) (b a))
+  (defstrand init 1 (a a-0) (b a))
+  (precedes ((1 1) (0 0)) ((2 0) (1 0)))
+  (non-orig (invk a) (invk a-0))
+  (operation encryption-test (added-strand init 1) (enc a (invk a-0))
+    (1 0))
+  (traces ((recv (enc a-0 (invk a))))
+    ((recv (enc a (invk a-0))) (send (enc a-0 (invk a))))
+    ((send (enc a (invk a-0)))))
+  (label 22)
+  (parent 21)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a a) (b (invk a-0)))))
+  (origs))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (defstrand resp 2 (a a) (b b))
+  (precedes ((1 1) (0 0)) ((2 1) (1 0)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand resp 2) (enc a (invk b))
+    (1 0))
+  (traces ((recv (enc b (invk a))))
+    ((recv (enc a (invk b))) (send (enc b (invk a))))
+    ((recv (enc b (invk a))) (send (enc a (invk b)))))
+  (label 23)
+  (parent 21)
+  (unrealized (2 0))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (defstrand resp 2 (a a) (b b))
+  (defstrand init 1 (a a) (b b))
+  (precedes ((1 1) (0 0)) ((2 1) (1 0)) ((3 0) (2 0)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand init 1) (enc b (invk a))
+    (2 0))
+  (traces ((recv (enc b (invk a))))
+    ((recv (enc a (invk b))) (send (enc b (invk a))))
+    ((recv (enc b (invk a))) (send (enc a (invk b))))
+    ((send (enc b (invk a)))))
+  (label 24)
+  (parent 23)
+  (unrealized)
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (defstrand resp 2 (a a) (b b))
+  (defstrand resp 2 (a b) (b a))
+  (precedes ((1 1) (0 0)) ((2 1) (1 0)) ((3 1) (2 0)))
+  (non-orig (invk a) (invk b))
+  (operation encryption-test (added-strand resp 2) (enc b (invk a))
+    (2 0))
+  (traces ((recv (enc b (invk a))))
+    ((recv (enc a (invk b))) (send (enc b (invk a))))
+    ((recv (enc b (invk a))) (send (enc a (invk b))))
+    ((recv (enc a (invk b))) (send (enc b (invk a)))))
+  (label 25)
+  (parent 23)
+  (seen 23)
+  (unrealized (3 0))
+  (comment "1 in cohort - 0 not yet seen"))
+
+(defskeleton reflect
+  (vars (a b akey))
+  (defstrand resp 1 (a a) (b b))
+  (defstrand resp 2 (a a) (b b))
+  (defstrand init 1 (a a) (b b))
+  (precedes ((1 1) (0 0)) ((2 0) (1 0)))
+  (non-orig (invk a) (invk b))
+  (operation generalization deleted (1 0))
+  (traces ((recv (enc b (invk a))))
+    ((recv (enc b (invk a))) (send (enc a (invk b))))
+    ((send (enc b (invk a)))))
+  (label 26)
+  (parent 24)
+  (seen 20)
+  (unrealized)
+  (comment "1 in cohort - 0 not yet seen"))
+
+(comment "Nothing left to do")
diff --git a/tst/station.scm b/tst/station.scm
new file mode 100644
--- /dev/null
+++ b/tst/station.scm
@@ -0,0 +1,74 @@
+; Station-to-station
+
+; This is an authenticated form of a Diffie-Hellman key exchange.
+
+; The file contains two different models of the station-to-station
+; protocol.  In the first, an assumption is made that *any* initiator
+; or responder properly picks a fresh random exponent and does not
+; allow it to be obtained by the adversary.
+
+; In the second, we do not include this assumption, and as a result,
+; less can be guaranteed.
+
+(herald "Station-to-station protocol" (algebra diffie-hellman))
+
+(defprotocol station-to-station diffie-hellman
+  (defrole init
+    (vars (x expn) (h base) (a b name))
+    (trace
+     (send (exp (gen) x))
+     (recv (cat h (enc (enc h (exp (gen) x) (privk b)) (exp h x))))
+     (send (enc (enc (exp (gen) x) h (privk a)) (exp h x))))
+    (uniq-gen x))
+  (defrole resp
+    (vars (y expn) (h base) (a b name))
+    (trace
+     (recv h)
+     (send (cat (exp (gen) y) (enc (enc (exp (gen) y) h (privk b)) (exp h y))))
+     (recv (enc (enc h (exp (gen) y) (privk a)) (exp h y))))
+    (uniq-gen y))
+)
+
+(defskeleton station-to-station
+  (vars (a b name))
+  (defstrand init 3 (a a) (b b))
+  (non-orig (privk b) (privk a))
+)
+
+(defskeleton station-to-station
+  (vars (a b name))
+  (defstrand resp 3 (a a) (b b))
+  (non-orig (privk a) (privk b))
+)
+
+(defprotocol station-weak diffie-hellman
+  (defrole weak-init
+    (vars (x expn) (h base) (a b name))
+    (trace
+     (send (exp (gen) x))
+     (recv (cat h (enc (enc h (exp (gen) x) (privk b)) (exp h x))))
+     (send (enc (enc (exp (gen) x) h (privk a)) (exp h x))))
+  )
+  (defrole weak-resp
+    (vars (y expn) (h base) (a b name))
+    (trace
+     (recv h)
+     (send (cat (exp (gen) y) (enc (enc (exp (gen) y) h (privk b)) (exp h y))))
+     (recv (enc (enc h (exp (gen) y) (privk a)) (exp h y))))
+    (absent (y h))
+    )
+)
+
+(defskeleton station-weak
+  (vars (a b name) (x expn))
+  (defstrand weak-init 3 (a a) (b b) (x x))
+  (uniq-gen x)
+  (non-orig (privk b) (privk a))
+)
+
+(defskeleton station-weak
+  (vars (a b name) (y expn))
+  (defstrand weak-resp 3 (a a) (b b) (y y))
+  (uniq-gen y)
+  (non-orig (privk a) (privk b))
+)
diff --git a/tst/station.tst b/tst/station.tst
new file mode 100644
--- /dev/null
+++ b/tst/station.tst
@@ -0,0 +1,5262 @@
+(herald "Station-to-station protocol" (algebra diffie-hellman))
+
+(comment "CPSA 3.4.0")
+(comment "All input read from station.scm")
+
+(defprotocol station-to-station diffie-hellman
+  (defrole init
+    (vars (x expn) (h base) (a b name))
+    (trace (send (exp (gen) x))
+      (recv (cat h (enc (enc h (exp (gen) x) (privk b)) (exp h x))))
+      (send (enc (enc (exp (gen) x) h (privk a)) (exp h x))))
+    (uniq-gen x))
+  (defrole resp
+    (vars (y expn) (h base) (a b name))
+    (trace (recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b)) (exp h y))))
+      (recv (enc (enc h (exp (gen) y) (privk a)) (exp h y))))
+    (uniq-gen y)
+    (absent (y h))))
+
+(defskeleton station-to-station
+  (vars (a b name) (h base) (x expn))
+  (defstrand init 3 (a a) (b b) (h h) (x x))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (traces
+    ((send (exp (gen) x))
+      (recv (cat h (enc (enc h (exp (gen) x) (privk b)) (exp h x))))
+      (send (enc (enc (exp (gen) x) h (privk a)) (exp h x)))))
+  (label 0)
+  (unrealized (0 1))
+  (origs)
+  (comment "3 in cohort - 3 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (precedes ((0 0) (1 1)) ((1 2) (0 1)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x x-0)
+  (operation encryption-test (added-strand init 3)
+    (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+      (exp (gen) (mul x x-0))) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0))))))
+  (label 1)
+  (parent 0)
+  (unrealized (1 1))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (x y expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (defstrand resp 2 (b b) (h (exp (gen) x)) (y y))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x y)
+  (operation encryption-test (added-strand resp 2)
+    (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+      (exp (gen) (mul x y))) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))))
+  (label 2)
+  (parent 0)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a a) (b b) (x x) (h (exp (gen) y)))))
+  (origs))
+
+(defskeleton station-to-station
+  (vars (a b name) (h base) (x expn))
+  (defstrand init 3 (a a) (b b) (h h) (x x))
+  (deflistener (exp h x))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (operation encryption-test (added-listener (exp h x))
+    (enc (enc h (exp (gen) x) (privk b)) (exp h x)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv (cat h (enc (enc h (exp (gen) x) (privk b)) (exp h x))))
+      (send (enc (enc (exp (gen) x) h (privk a)) (exp h x))))
+    ((recv (exp h x)) (send (exp h x))))
+  (label 3)
+  (parent 0)
+  (unrealized (0 1) (1 0))
+  (comment "5 in cohort - 5 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (precedes ((0 0) (2 0)) ((1 0) (2 0)) ((1 2) (0 1)) ((2 1) (1 1)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x x-0)
+  (operation encryption-test (added-listener (exp (gen) (mul x x-0)))
+    (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+      (exp (gen) (mul x x-0))) (1 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0)))))
+  (label 4)
+  (parent 1)
+  (unrealized (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (x expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) (rec x))) (x x))
+  (deflistener (gen))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (operation nonce-test (contracted (h (exp (gen) (rec x)))) (gen)
+    (1 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) (rec x))
+          (enc (enc (exp (gen) (rec x)) (exp (gen) x) (privk b))
+            (gen))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) (rec x)) (privk a)) (gen))))
+    ((recv (gen)) (send (gen))))
+  (label 5)
+  (parent 3)
+  (unrealized (0 1))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b name) (x expn))
+  (defstrand init 3 (a a) (b b) (h (gen)) (x x))
+  (deflistener (exp (gen) x))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (operation nonce-test (displaced 2 0 init 1) (exp (gen) x-0) (1 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (gen)
+          (enc (enc (gen) (exp (gen) x) (privk b)) (exp (gen) x))))
+      (send (enc (enc (exp (gen) x) (gen) (privk a)) (exp (gen) x))))
+    ((recv (exp (gen) x)) (send (exp (gen) x))))
+  (label 6)
+  (parent 3)
+  (unrealized (0 1))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) (mul (rec x) x-0))) (x x))
+  (deflistener (exp (gen) x-0))
+  (defstrand init 1 (x x-0))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)) ((2 0) (1 0)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x x-0)
+  (operation nonce-test (added-strand init 1) (exp (gen) x-0) (1 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) (mul (rec x) x-0))
+          (enc
+            (enc (exp (gen) (mul (rec x) x-0)) (exp (gen) x) (privk b))
+            (exp (gen) x-0))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) (mul (rec x) x-0)) (privk a))
+          (exp (gen) x-0))))
+    ((recv (exp (gen) x-0)) (send (exp (gen) x-0)))
+    ((send (exp (gen) x-0))))
+  (label 7)
+  (parent 3)
+  (unrealized (0 1))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (h base) (x y expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) (mul (rec x) y))) (x x))
+  (deflistener (exp (gen) y))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)) ((2 1) (1 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x y)
+  (operation nonce-test (added-strand resp 2) (exp (gen) y) (1 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) (mul (rec x) y))
+          (enc (enc (exp (gen) (mul (rec x) y)) (exp (gen) x) (privk b))
+            (exp (gen) y))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) (mul (rec x) y)) (privk a))
+          (exp (gen) y)))) ((recv (exp (gen) y)) (send (exp (gen) y)))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y))))))
+  (label 8)
+  (parent 3)
+  (unrealized (0 1))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b name) (h base) (x expn) (w expr))
+  (defstrand init 3 (a a) (b b) (h h) (x x))
+  (deflistener (exp h x))
+  (deflistener (cat (exp h (mul x (rec w))) w))
+  (precedes ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (1 0)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (precur (2 0))
+  (operation nonce-test (added-listener (cat (exp h (mul x (rec w))) w))
+    (exp h x) (1 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv (cat h (enc (enc h (exp (gen) x) (privk b)) (exp h x))))
+      (send (enc (enc (exp (gen) x) h (privk a)) (exp h x))))
+    ((recv (exp h x)) (send (exp h x)))
+    ((recv (cat (exp h (mul x (rec w))) w))
+      (send (cat (exp h (mul x (rec w))) w))))
+  (label 9)
+  (parent 3)
+  (unrealized (0 1) (2 0))
+  (comment "4 in cohort - 4 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn) (w expr))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) (mul x x-0 (rec w))) w))
+  (precedes ((0 0) (3 0)) ((1 0) (3 0)) ((1 2) (0 1)) ((2 1) (1 1))
+    ((3 1) (2 0)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x x-0)
+  (precur (3 0))
+  (operation nonce-test
+    (added-listener (cat (exp (gen) (mul x x-0 (rec w))) w))
+    (exp (gen) (mul x x-0)) (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) (mul x x-0 (rec w))) w))
+      (send (cat (exp (gen) (mul x x-0 (rec w))) w))))
+  (label 10)
+  (parent 4)
+  (unrealized (3 0))
+  (comment "5 in cohort - 5 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (x expn) (w expr))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) (mul (rec x) w))) (x x))
+  (deflistener (exp (gen) w))
+  (deflistener (cat (gen) w))
+  (precedes ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (1 0)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (precur (2 0))
+  (operation nonce-test (contracted (h (exp (gen) (mul (rec x) w))))
+    (gen) (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) (mul (rec x) w))
+          (enc (enc (exp (gen) (mul (rec x) w)) (exp (gen) x) (privk b))
+            (exp (gen) w))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) (mul (rec x) w)) (privk a))
+          (exp (gen) w)))) ((recv (exp (gen) w)) (send (exp (gen) w)))
+    ((recv (cat (gen) w)) (send (cat (gen) w))))
+  (label 11)
+  (parent 9)
+  (unrealized (0 1))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (w expr) (x expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) w)) (x x))
+  (deflistener (exp (gen) (mul w x)))
+  (deflistener (cat (exp (gen) x) w))
+  (precedes ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (1 0)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation nonce-test (displaced 3 0 init 1) (exp (gen) x-0) (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) w)
+          (enc (enc (exp (gen) w) (exp (gen) x) (privk b))
+            (exp (gen) (mul w x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) w) (privk a))
+          (exp (gen) (mul w x)))))
+    ((recv (exp (gen) (mul w x))) (send (exp (gen) (mul w x))))
+    ((recv (cat (exp (gen) x) w)) (send (cat (exp (gen) x) w))))
+  (label 12)
+  (parent 9)
+  (unrealized (0 1))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (x expn) (w expr) (x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) (mul (rec x) w x-0)))
+    (x x))
+  (deflistener (exp (gen) (mul w x-0)))
+  (deflistener (cat (exp (gen) x-0) w))
+  (defstrand init 1 (x x-0))
+  (precedes ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (1 0)) ((3 0) (2 0)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x x-0)
+  (operation nonce-test (added-strand init 1) (exp (gen) x-0) (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) (mul (rec x) w x-0))
+          (enc
+            (enc (exp (gen) (mul (rec x) w x-0)) (exp (gen) x)
+              (privk b)) (exp (gen) (mul w x-0)))))
+      (send
+        (enc
+          (enc (exp (gen) x) (exp (gen) (mul (rec x) w x-0)) (privk a))
+          (exp (gen) (mul w x-0)))))
+    ((recv (exp (gen) (mul w x-0))) (send (exp (gen) (mul w x-0))))
+    ((recv (cat (exp (gen) x-0) w)) (send (cat (exp (gen) x-0) w)))
+    ((send (exp (gen) x-0))))
+  (label 13)
+  (parent 9)
+  (unrealized (0 1))
+  (comment "3 in cohort - 3 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (h base) (x expn) (w expr) (y expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) (mul (rec x) w y))) (x x))
+  (deflistener (exp (gen) (mul w y)))
+  (deflistener (cat (exp (gen) y) w))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (precedes ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (1 0)) ((3 1) (2 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x y)
+  (operation nonce-test (added-strand resp 2) (exp (gen) y) (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) (mul (rec x) w y))
+          (enc
+            (enc (exp (gen) (mul (rec x) w y)) (exp (gen) x) (privk b))
+            (exp (gen) (mul w y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) (mul (rec x) w y)) (privk a))
+          (exp (gen) (mul w y)))))
+    ((recv (exp (gen) (mul w y))) (send (exp (gen) (mul w y))))
+    ((recv (cat (exp (gen) y) w)) (send (cat (exp (gen) y) w)))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y))))))
+  (label 14)
+  (parent 9)
+  (unrealized (0 1))
+  (comment "3 in cohort - 3 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (precedes ((0 0) (3 0)) ((1 0) (3 0)) ((1 2) (0 1)) ((2 1) (1 1))
+    ((3 1) (2 0)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x x-0)
+  (precur (3 0))
+  (operation nonce-test (contracted (x-1 x) (x-2 x-0) (w (mul x x-0)))
+    (gen) (3 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0)))))
+  (label 15)
+  (parent 10)
+  (unrealized (2 0) (3 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x)) (x x-0))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (precedes ((0 0) (3 0)) ((1 0) (3 0)) ((1 2) (0 1)) ((2 1) (1 1))
+    ((3 1) (2 0)))
+  (non-orig (privk a) (privk b))
+  (precur (3 0))
+  (uniq-gen x x-0)
+  (operation nonce-test (displaced 4 0 init 1) (exp (gen) x-1) (3 0))
+  (traces
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x))))
+  (label 16)
+  (parent 10)
+  (unrealized (3 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (precedes ((0 0) (3 0)) ((1 0) (3 0)) ((1 2) (0 1)) ((2 1) (1 1))
+    ((3 1) (2 0)))
+  (non-orig (privk a) (privk b))
+  (precur (3 0))
+  (uniq-gen x x-0)
+  (operation nonce-test (displaced 4 1 init 1) (exp (gen) x-1) (3 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x))))
+  (label 17)
+  (parent 10)
+  (unrealized (3 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 x-1 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+  (defstrand init 1 (x x-1))
+  (precedes ((0 0) (3 0)) ((1 0) (3 0)) ((1 2) (0 1)) ((2 1) (1 1))
+    ((3 1) (2 0)) ((4 0) (3 0)))
+  (non-orig (privk a) (privk b))
+  (precur (3 0))
+  (uniq-gen x x-0 x-1)
+  (operation nonce-test (added-strand init 1) (exp (gen) x-1) (3 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+      (send (cat (exp (gen) x-1) (mul x x-0 (rec x-1)))))
+    ((send (exp (gen) x-1))))
+  (label 18)
+  (parent 10)
+  (unrealized (2 0) (3 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (x x-0 y expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul x x-0 (rec y))))
+  (defstrand resp 2 (b b-1) (h h) (y y))
+  (precedes ((0 0) (3 0)) ((1 0) (3 0)) ((1 2) (0 1)) ((2 1) (1 1))
+    ((3 1) (2 0)) ((4 1) (3 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (3 0))
+  (uniq-gen x x-0 y)
+  (operation nonce-test (added-strand resp 2) (exp (gen) y) (3 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul x x-0 (rec y))))
+      (send (cat (exp (gen) y) (mul x x-0 (rec y)))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-1)) (exp h y))))))
+  (label 19)
+  (parent 10)
+  (unrealized (2 0) (3 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (precedes ((0 0) (2 0)) ((0 0) (3 1)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 2) (0 1)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x x-0)
+  (operation encryption-test (added-strand init 3)
+    (enc (exp (gen) x-0) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0))))))
+  (label 20)
+  (parent 11)
+  (unrealized (1 0) (2 0) (3 1))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (x y expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (gen) (mul x y)))
+  (defstrand resp 2 (b b) (h (exp (gen) x)) (y y))
+  (precedes ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (1 0)) ((3 1) (2 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x y)
+  (operation encryption-test (added-strand resp 2)
+    (enc (exp (gen) y) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (gen) (mul x y))) (send (cat (gen) (mul x y))))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))))
+  (label 21)
+  (parent 11)
+  (unrealized (1 0) (2 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x) x-0))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (precedes ((0 0) (2 0)) ((0 0) (3 1)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 2) (0 1)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x x-0)
+  (operation encryption-test (added-strand init 3)
+    (enc (exp (gen) x-0) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x) x-0)) (send (cat (exp (gen) x) x-0)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0))))))
+  (label 22)
+  (parent 12)
+  (unrealized (2 0) (3 1))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (x y expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (exp (gen) x) y))
+  (defstrand resp 2 (b b) (h (exp (gen) x)) (y y))
+  (precedes ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (1 0)) ((3 1) (2 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x y)
+  (operation encryption-test (added-strand resp 2)
+    (enc (exp (gen) y) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (exp (gen) x) y)) (send (cat (exp (gen) x) y)))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))))
+  (label 23)
+  (parent 12)
+  (unrealized (2 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (precedes ((0 0) (2 0)) ((0 0) (3 1)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 2) (0 1)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x x-0)
+  (operation encryption-test (displaced 3 4 init 3)
+    (enc (exp (gen) x-1) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0))))))
+  (label 24)
+  (parent 13)
+  (unrealized (2 0) (3 1))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 x-1 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-1)) (x x))
+  (deflistener (exp (gen) (mul x x-1)))
+  (deflistener (cat (exp (gen) x-0) (mul x (rec x-0) x-1)))
+  (defstrand init 1 (x x-0))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-1))
+  (precedes ((0 0) (2 0)) ((0 0) (4 1)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((4 0) (2 0)) ((4 2) (0 1)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x x-0 x-1)
+  (operation encryption-test (added-strand init 3)
+    (enc (exp (gen) x-1) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-1)
+          (enc (enc (exp (gen) x-1) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-1)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-1) (privk a))
+          (exp (gen) (mul x x-1)))))
+    ((recv (exp (gen) (mul x x-1))) (send (exp (gen) (mul x x-1))))
+    ((recv (cat (exp (gen) x-0) (mul x (rec x-0) x-1)))
+      (send (cat (exp (gen) x-0) (mul x (rec x-0) x-1))))
+    ((send (exp (gen) x-0)))
+    ((send (exp (gen) x-1))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-1) (privk b-0))
+            (exp (gen) (mul x x-1)))))
+      (send
+        (enc (enc (exp (gen) x-1) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-1))))))
+  (label 25)
+  (parent 13)
+  (unrealized (1 0) (2 0) (4 1))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (x x-0 y expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (exp (gen) x-0) (mul x (rec x-0) y)))
+  (defstrand init 1 (x x-0))
+  (defstrand resp 2 (b b) (h (exp (gen) x)) (y y))
+  (precedes ((0 0) (4 0)) ((1 1) (0 1)) ((2 1) (1 0)) ((3 0) (2 0))
+    ((4 1) (2 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x x-0 y)
+  (operation encryption-test (added-strand resp 2)
+    (enc (exp (gen) y) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (exp (gen) x-0) (mul x (rec x-0) y)))
+      (send (cat (exp (gen) x-0) (mul x (rec x-0) y))))
+    ((send (exp (gen) x-0)))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))))
+  (label 26)
+  (parent 13)
+  (unrealized (1 0) (2 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (x y x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul x (rec y) x-0)))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (defstrand init 3 (a b) (b b-1) (h (exp (gen) x)) (x x-0))
+  (precedes ((0 0) (2 0)) ((0 0) (4 1)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (2 0)) ((4 0) (2 0)) ((4 2) (0 1)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x y x-0)
+  (operation encryption-test (added-strand init 3)
+    (enc (exp (gen) x-0) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul x (rec y) x-0)))
+      (send (cat (exp (gen) y) (mul x (rec y) x-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-1))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0))))))
+  (label 27)
+  (parent 14)
+  (unrealized (1 0) (2 0) (4 1))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (x y expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (exp (gen) y) x))
+  (defstrand resp 2 (b b) (h (exp (gen) x)) (y y))
+  (precedes ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (1 0)) ((3 1) (2 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x y)
+  (operation encryption-test (displaced 4 3 resp 2)
+    (enc (exp (gen) y-0) (exp (gen) x) (privk b-0)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x)))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))))
+  (label 28)
+  (parent 14)
+  (unrealized (2 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (h base) (x y y-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) y-0)) (x x))
+  (deflistener (exp (gen) (mul x y-0)))
+  (deflistener (cat (exp (gen) y) (mul x (rec y) y-0)))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (defstrand resp 2 (b b) (h (exp (gen) x)) (y y-0))
+  (precedes ((0 0) (4 0)) ((1 1) (0 1)) ((2 1) (1 0)) ((3 1) (2 0))
+    ((4 1) (2 0)))
+  (absent (y-0 (exp (gen) x)) (y h))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x y y-0)
+  (operation encryption-test (added-strand resp 2)
+    (enc (exp (gen) y-0) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y-0) (privk a))
+          (exp (gen) (mul x y-0)))))
+    ((recv (exp (gen) (mul x y-0))) (send (exp (gen) (mul x y-0))))
+    ((recv (cat (exp (gen) y) (mul x (rec y) y-0)))
+      (send (cat (exp (gen) y) (mul x (rec y) y-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y-0)))))))
+  (label 29)
+  (parent 14)
+  (unrealized (1 0) (2 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (precedes ((0 0) (2 0)) ((0 0) (4 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (4 0)) ((3 2) (0 1)) ((4 1) (3 1)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x x-0)
+  (operation encryption-test (added-listener (exp (gen) (mul x x-0)))
+    (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+      (exp (gen) (mul x x-0))) (3 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0)))))
+  (label 30)
+  (parent 20)
+  (unrealized (1 0) (2 0) (4 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x) x-0))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (precedes ((0 0) (2 0)) ((0 0) (4 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (4 0)) ((3 2) (0 1)) ((4 1) (3 1)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x x-0)
+  (operation encryption-test (added-listener (exp (gen) (mul x x-0)))
+    (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+      (exp (gen) (mul x x-0))) (3 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x) x-0)) (send (cat (exp (gen) x) x-0)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0)))))
+  (label 31)
+  (parent 22)
+  (unrealized (2 0) (4 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (precedes ((0 0) (2 0)) ((0 0) (4 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (4 0)) ((3 2) (0 1)) ((4 1) (3 1)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x x-0)
+  (operation encryption-test (added-listener (exp (gen) (mul x x-0)))
+    (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+      (exp (gen) (mul x x-0))) (3 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0)))))
+  (label 32)
+  (parent 24)
+  (unrealized (2 0) (4 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 x-1 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-1)) (x x))
+  (deflistener (exp (gen) (mul x x-1)))
+  (deflistener (cat (exp (gen) x-0) (mul x (rec x-0) x-1)))
+  (defstrand init 1 (x x-0))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-1))
+  (deflistener (exp (gen) (mul x x-1)))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((4 0) (2 0)) ((4 0) (5 0)) ((4 2) (0 1))
+    ((5 1) (4 1)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x x-0 x-1)
+  (operation encryption-test (added-listener (exp (gen) (mul x x-1)))
+    (enc (enc (exp (gen) x) (exp (gen) x-1) (privk b-0))
+      (exp (gen) (mul x x-1))) (4 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-1)
+          (enc (enc (exp (gen) x-1) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-1)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-1) (privk a))
+          (exp (gen) (mul x x-1)))))
+    ((recv (exp (gen) (mul x x-1))) (send (exp (gen) (mul x x-1))))
+    ((recv (cat (exp (gen) x-0) (mul x (rec x-0) x-1)))
+      (send (cat (exp (gen) x-0) (mul x (rec x-0) x-1))))
+    ((send (exp (gen) x-0)))
+    ((send (exp (gen) x-1))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-1) (privk b-0))
+            (exp (gen) (mul x x-1)))))
+      (send
+        (enc (enc (exp (gen) x-1) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-1)))))
+    ((recv (exp (gen) (mul x x-1))) (send (exp (gen) (mul x x-1)))))
+  (label 33)
+  (parent 25)
+  (unrealized (1 0) (2 0) (5 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (x y x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul x (rec y) x-0)))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (defstrand init 3 (a b) (b b-1) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (2 0)) ((4 0) (2 0)) ((4 0) (5 0)) ((4 2) (0 1))
+    ((5 1) (4 1)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x y x-0)
+  (operation encryption-test (added-listener (exp (gen) (mul x x-0)))
+    (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-1))
+      (exp (gen) (mul x x-0))) (4 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul x (rec y) x-0)))
+      (send (cat (exp (gen) y) (mul x (rec y) x-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-1))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0)))))
+  (label 34)
+  (parent 27)
+  (unrealized (1 0) (2 0) (5 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn) (w expr))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) (mul x x-0 (rec w))) w))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0)
+  (operation nonce-test
+    (added-listener (cat (exp (gen) (mul x x-0 (rec w))) w))
+    (exp (gen) (mul x x-0)) (4 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) (mul x x-0 (rec w))) w))
+      (send (cat (exp (gen) (mul x x-0 (rec w))) w))))
+  (label 35)
+  (parent 30)
+  (unrealized (1 0) (2 0) (5 0))
+  (comment "5 in cohort - 5 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn) (w expr))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x) x-0))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) (mul x x-0 (rec w))) w))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0)
+  (operation nonce-test
+    (added-listener (cat (exp (gen) (mul x x-0 (rec w))) w))
+    (exp (gen) (mul x x-0)) (4 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x) x-0)) (send (cat (exp (gen) x) x-0)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) (mul x x-0 (rec w))) w))
+      (send (cat (exp (gen) (mul x x-0 (rec w))) w))))
+  (label 36)
+  (parent 31)
+  (unrealized (2 0) (5 0))
+  (comment "5 in cohort - 5 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn) (w expr))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) (mul x x-0 (rec w))) w))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0)
+  (operation nonce-test
+    (added-listener (cat (exp (gen) (mul x x-0 (rec w))) w))
+    (exp (gen) (mul x x-0)) (4 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) (mul x x-0 (rec w))) w))
+      (send (cat (exp (gen) (mul x x-0 (rec w))) w))))
+  (label 37)
+  (parent 32)
+  (unrealized (2 0) (5 0))
+  (comment "5 in cohort - 5 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 x-1 expn) (w expr))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-1)) (x x))
+  (deflistener (exp (gen) (mul x x-1)))
+  (deflistener (cat (exp (gen) x-0) (mul x (rec x-0) x-1)))
+  (defstrand init 1 (x x-0))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-1))
+  (deflistener (exp (gen) (mul x x-1)))
+  (deflistener (cat (exp (gen) (mul x x-1 (rec w))) w))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((4 0) (2 0)) ((4 0) (6 0)) ((4 2) (0 1))
+    ((5 1) (4 1)) ((6 1) (5 0)))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen x x-0 x-1)
+  (operation nonce-test
+    (added-listener (cat (exp (gen) (mul x x-1 (rec w))) w))
+    (exp (gen) (mul x x-1)) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-1)
+          (enc (enc (exp (gen) x-1) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-1)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-1) (privk a))
+          (exp (gen) (mul x x-1)))))
+    ((recv (exp (gen) (mul x x-1))) (send (exp (gen) (mul x x-1))))
+    ((recv (cat (exp (gen) x-0) (mul x (rec x-0) x-1)))
+      (send (cat (exp (gen) x-0) (mul x (rec x-0) x-1))))
+    ((send (exp (gen) x-0)))
+    ((send (exp (gen) x-1))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-1) (privk b-0))
+            (exp (gen) (mul x x-1)))))
+      (send
+        (enc (enc (exp (gen) x-1) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-1)))))
+    ((recv (exp (gen) (mul x x-1))) (send (exp (gen) (mul x x-1))))
+    ((recv (cat (exp (gen) (mul x x-1 (rec w))) w))
+      (send (cat (exp (gen) (mul x x-1 (rec w))) w))))
+  (label 38)
+  (parent 33)
+  (unrealized (1 0) (2 0) (6 0))
+  (comment "6 in cohort - 6 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (x y x-0 expn) (w expr))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul x (rec y) x-0)))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (defstrand init 3 (a b) (b b-1) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) (mul x x-0 (rec w))) w))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (2 0)) ((4 0) (2 0)) ((4 0) (6 0)) ((4 2) (0 1))
+    ((5 1) (4 1)) ((6 1) (5 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen x y x-0)
+  (operation nonce-test
+    (added-listener (cat (exp (gen) (mul x x-0 (rec w))) w))
+    (exp (gen) (mul x x-0)) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul x (rec y) x-0)))
+      (send (cat (exp (gen) y) (mul x (rec y) x-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-1))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) (mul x x-0 (rec w))) w))
+      (send (cat (exp (gen) (mul x x-0 (rec w))) w))))
+  (label 39)
+  (parent 34)
+  (unrealized (1 0) (2 0) (6 0))
+  (comment "6 in cohort - 6 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0)
+  (operation nonce-test (contracted (x-1 x) (x-2 x-0) (w (mul x x-0)))
+    (gen) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0)))))
+  (label 40)
+  (parent 35)
+  (unrealized (1 0) (2 0) (4 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0)
+  (operation nonce-test (displaced 6 0 init 1) (exp (gen) x-1) (5 0))
+  (traces
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0))))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x))))
+  (label 41)
+  (parent 35)
+  (unrealized (1 0) (2 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0)
+  (operation nonce-test (displaced 6 3 init 1) (exp (gen) x-1) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x))))
+  (label 42)
+  (parent 35)
+  (unrealized (1 0) (2 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 x-1 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+  (defstrand init 1 (x x-1))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)) ((6 0) (5 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0 x-1)
+  (operation nonce-test (added-strand init 1) (exp (gen) x-1) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+      (send (cat (exp (gen) x-1) (mul x x-0 (rec x-1)))))
+    ((send (exp (gen) x-1))))
+  (label 43)
+  (parent 35)
+  (unrealized (1 0) (2 0) (4 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (x x-0 y expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul x x-0 (rec y))))
+  (defstrand resp 2 (b b-1) (h h) (y y))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)) ((6 1) (5 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0 y)
+  (operation nonce-test (added-strand resp 2) (exp (gen) y) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul x x-0 (rec y))))
+      (send (cat (exp (gen) y) (mul x x-0 (rec y)))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-1)) (exp h y))))))
+  (label 44)
+  (parent 35)
+  (unrealized (1 0) (2 0) (4 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x) x-0))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0)
+  (operation nonce-test (contracted (x-1 x) (x-2 x-0) (w (mul x x-0)))
+    (gen) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x) x-0)) (send (cat (exp (gen) x) x-0)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0)))))
+  (label 45)
+  (parent 36)
+  (unrealized (2 0) (4 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0)
+  (operation nonce-test (displaced 6 0 init 1) (exp (gen) x-1) (5 0))
+  (traces
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x)))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x))))
+  (label 46)
+  (parent 36)
+  (unrealized (2 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x) x-0))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0)
+  (operation nonce-test (displaced 6 3 init 1) (exp (gen) x-1) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x) x-0)) (send (cat (exp (gen) x) x-0)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x))))
+  (label 47)
+  (parent 36)
+  (unrealized (2 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 x-1 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x) x-0))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+  (defstrand init 1 (x x-1))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)) ((6 0) (5 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0 x-1)
+  (operation nonce-test (added-strand init 1) (exp (gen) x-1) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x) x-0)) (send (cat (exp (gen) x) x-0)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+      (send (cat (exp (gen) x-1) (mul x x-0 (rec x-1)))))
+    ((send (exp (gen) x-1))))
+  (label 48)
+  (parent 36)
+  (unrealized (2 0) (4 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (x x-0 y expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x) x-0))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul x x-0 (rec y))))
+  (defstrand resp 2 (b b-1) (h h) (y y))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)) ((6 1) (5 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0 y)
+  (operation nonce-test (added-strand resp 2) (exp (gen) y) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x) x-0)) (send (cat (exp (gen) x) x-0)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul x x-0 (rec y))))
+      (send (cat (exp (gen) y) (mul x x-0 (rec y)))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-1)) (exp h y))))))
+  (label 49)
+  (parent 36)
+  (unrealized (2 0) (4 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0)
+  (operation nonce-test (contracted (x-1 x) (x-2 x-0) (w (mul x x-0)))
+    (gen) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0)))))
+  (label 50)
+  (parent 37)
+  (unrealized (2 0) (4 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x) x-0))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0)
+  (operation nonce-test (displaced 6 0 init 1) (exp (gen) x-1) (5 0))
+  (traces
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x) x-0)) (send (cat (exp (gen) x) x-0)))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x))))
+  (label 51)
+  (parent 37)
+  (unrealized (2 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0)
+  (operation nonce-test (displaced 6 3 init 1) (exp (gen) x-1) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x))))
+  (label 52)
+  (parent 37)
+  (unrealized (2 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 x-1 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+  (defstrand init 1 (x x-1))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)) ((6 0) (5 0)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0 x-1)
+  (operation nonce-test (added-strand init 1) (exp (gen) x-1) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+      (send (cat (exp (gen) x-1) (mul x x-0 (rec x-1)))))
+    ((send (exp (gen) x-1))))
+  (label 53)
+  (parent 37)
+  (unrealized (2 0) (4 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (x x-0 y expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul x x-0 (rec y))))
+  (defstrand resp 2 (b b-1) (h h) (y y))
+  (precedes ((0 0) (2 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (5 0)) ((3 2) (0 1)) ((4 1) (3 1))
+    ((5 1) (4 0)) ((6 1) (5 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x x-0 y)
+  (operation nonce-test (added-strand resp 2) (exp (gen) y) (5 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul x x-0 (rec y))))
+      (send (cat (exp (gen) y) (mul x x-0 (rec y)))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-1)) (exp h y))))))
+  (label 54)
+  (parent 37)
+  (unrealized (2 0) (4 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 x-1 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-1)) (x x-0))
+  (deflistener (exp (gen) (mul x-0 x-1)))
+  (deflistener (cat (exp (gen) x) (mul (rec x) x-0 x-1)))
+  (defstrand init 1 (x x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x-0)) (x x-1))
+  (deflistener (exp (gen) (mul x-0 x-1)))
+  (deflistener (cat (gen) (mul x-0 x-1)))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((4 0) (2 0)) ((4 0) (6 0)) ((4 2) (0 1))
+    ((5 1) (4 1)) ((6 1) (5 0)))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen x x-0 x-1)
+  (operation nonce-test
+    (contracted (x-2 x-0) (x-3 x-1) (w (mul x-0 x-1))) (gen) (6 0))
+  (traces
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x-1)
+          (enc (enc (exp (gen) x-1) (exp (gen) x-0) (privk b))
+            (exp (gen) (mul x-0 x-1)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x-1) (privk a))
+          (exp (gen) (mul x-0 x-1)))))
+    ((recv (exp (gen) (mul x-0 x-1))) (send (exp (gen) (mul x-0 x-1))))
+    ((recv (cat (exp (gen) x) (mul (rec x) x-0 x-1)))
+      (send (cat (exp (gen) x) (mul (rec x) x-0 x-1))))
+    ((send (exp (gen) x)))
+    ((send (exp (gen) x-1))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x-1) (privk b-0))
+            (exp (gen) (mul x-0 x-1)))))
+      (send
+        (enc (enc (exp (gen) x-1) (exp (gen) x-0) (privk b))
+          (exp (gen) (mul x-0 x-1)))))
+    ((recv (exp (gen) (mul x-0 x-1))) (send (exp (gen) (mul x-0 x-1))))
+    ((recv (cat (gen) (mul x-0 x-1))) (send (cat (gen) (mul x-0 x-1)))))
+  (label 55)
+  (parent 38)
+  (unrealized (1 0) (2 0) (5 0) (6 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 x-1 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x-1))
+  (deflistener (exp (gen) (mul x-0 x-1)))
+  (deflistener (cat (exp (gen) x) (mul (rec x) x-0 x-1)))
+  (defstrand init 1 (x x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x-1)) (x x-0))
+  (deflistener (exp (gen) (mul x-0 x-1)))
+  (deflistener (cat (exp (gen) x-1) x-0))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((4 0) (2 0)) ((4 0) (6 0)) ((4 2) (0 1))
+    ((5 1) (4 1)) ((6 1) (5 0)))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen x x-0 x-1)
+  (operation nonce-test (displaced 7 0 init 1) (exp (gen) x-2) (6 0))
+  (traces
+    ((send (exp (gen) x-1))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x-1) (privk b))
+            (exp (gen) (mul x-0 x-1)))))
+      (send
+        (enc (enc (exp (gen) x-1) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x-0 x-1)))))
+    ((recv (exp (gen) (mul x-0 x-1))) (send (exp (gen) (mul x-0 x-1))))
+    ((recv (cat (exp (gen) x) (mul (rec x) x-0 x-1)))
+      (send (cat (exp (gen) x) (mul (rec x) x-0 x-1))))
+    ((send (exp (gen) x)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x-1)
+          (enc (enc (exp (gen) x-1) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x-0 x-1)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x-1) (privk b))
+          (exp (gen) (mul x-0 x-1)))))
+    ((recv (exp (gen) (mul x-0 x-1))) (send (exp (gen) (mul x-0 x-1))))
+    ((recv (cat (exp (gen) x-1) x-0)) (send (cat (exp (gen) x-1) x-0))))
+  (label 56)
+  (parent 38)
+  (unrealized (1 0) (2 0) (6 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 x-1 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+  (defstrand init 1 (x x-1))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 0) (6 0)) ((4 0) (2 0)) ((4 0) (6 0))
+    ((4 2) (0 1)) ((5 1) (4 1)) ((6 1) (5 0)))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen x x-0 x-1)
+  (operation nonce-test (displaced 7 3 init 1) (exp (gen) x-2) (6 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+      (send (cat (exp (gen) x-1) (mul x x-0 (rec x-1)))))
+    ((send (exp (gen) x-1)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+      (send (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))))
+  (label 57)
+  (parent 38)
+  (unrealized (1 0) (2 0) (5 0) (6 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 x-1 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-1)) (x x-0))
+  (deflistener (exp (gen) (mul x-0 x-1)))
+  (deflistener (cat (exp (gen) x) (mul (rec x) x-0 x-1)))
+  (defstrand init 1 (x x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x-0)) (x x-1))
+  (deflistener (exp (gen) (mul x-0 x-1)))
+  (deflistener (cat (exp (gen) x-1) x-0))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((4 0) (2 0)) ((4 0) (6 0)) ((4 2) (0 1))
+    ((5 1) (4 1)) ((6 1) (5 0)))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen x x-0 x-1)
+  (operation nonce-test (displaced 7 4 init 1) (exp (gen) x-2) (6 0))
+  (traces
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x-1)
+          (enc (enc (exp (gen) x-1) (exp (gen) x-0) (privk b))
+            (exp (gen) (mul x-0 x-1)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x-1) (privk a))
+          (exp (gen) (mul x-0 x-1)))))
+    ((recv (exp (gen) (mul x-0 x-1))) (send (exp (gen) (mul x-0 x-1))))
+    ((recv (cat (exp (gen) x) (mul (rec x) x-0 x-1)))
+      (send (cat (exp (gen) x) (mul (rec x) x-0 x-1))))
+    ((send (exp (gen) x)))
+    ((send (exp (gen) x-1))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x-1) (privk b-0))
+            (exp (gen) (mul x-0 x-1)))))
+      (send
+        (enc (enc (exp (gen) x-1) (exp (gen) x-0) (privk b))
+          (exp (gen) (mul x-0 x-1)))))
+    ((recv (exp (gen) (mul x-0 x-1))) (send (exp (gen) (mul x-0 x-1))))
+    ((recv (cat (exp (gen) x-1) x-0)) (send (cat (exp (gen) x-1) x-0))))
+  (label 58)
+  (parent 38)
+  (unrealized (1 0) (2 0) (6 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x x-0 x-1 x-2 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-1)) (x x-0))
+  (deflistener (exp (gen) (mul x-0 x-1)))
+  (deflistener (cat (exp (gen) x) (mul (rec x) x-0 x-1)))
+  (defstrand init 1 (x x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x-0)) (x x-1))
+  (deflistener (exp (gen) (mul x-0 x-1)))
+  (deflistener (cat (exp (gen) x-2) (mul x-0 x-1 (rec x-2))))
+  (defstrand init 1 (x x-2))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((4 0) (2 0)) ((4 0) (6 0)) ((4 2) (0 1))
+    ((5 1) (4 1)) ((6 1) (5 0)) ((7 0) (6 0)))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen x x-0 x-1 x-2)
+  (operation nonce-test (added-strand init 1) (exp (gen) x-2) (6 0))
+  (traces
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x-1)
+          (enc (enc (exp (gen) x-1) (exp (gen) x-0) (privk b))
+            (exp (gen) (mul x-0 x-1)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x-1) (privk a))
+          (exp (gen) (mul x-0 x-1)))))
+    ((recv (exp (gen) (mul x-0 x-1))) (send (exp (gen) (mul x-0 x-1))))
+    ((recv (cat (exp (gen) x) (mul (rec x) x-0 x-1)))
+      (send (cat (exp (gen) x) (mul (rec x) x-0 x-1))))
+    ((send (exp (gen) x)))
+    ((send (exp (gen) x-1))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x-1) (privk b-0))
+            (exp (gen) (mul x-0 x-1)))))
+      (send
+        (enc (enc (exp (gen) x-1) (exp (gen) x-0) (privk b))
+          (exp (gen) (mul x-0 x-1)))))
+    ((recv (exp (gen) (mul x-0 x-1))) (send (exp (gen) (mul x-0 x-1))))
+    ((recv (cat (exp (gen) x-2) (mul x-0 x-1 (rec x-2))))
+      (send (cat (exp (gen) x-2) (mul x-0 x-1 (rec x-2)))))
+    ((send (exp (gen) x-2))))
+  (label 59)
+  (parent 38)
+  (unrealized (1 0) (2 0) (5 0) (6 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (x x-0 x-1 y expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-1)) (x x-0))
+  (deflistener (exp (gen) (mul x-0 x-1)))
+  (deflistener (cat (exp (gen) x) (mul (rec x) x-0 x-1)))
+  (defstrand init 1 (x x))
+  (defstrand init 3 (a b) (b b-0) (h (exp (gen) x-0)) (x x-1))
+  (deflistener (exp (gen) (mul x-0 x-1)))
+  (deflistener (cat (exp (gen) y) (mul x-0 x-1 (rec y))))
+  (defstrand resp 2 (b b-1) (h h) (y y))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((4 0) (2 0)) ((4 0) (6 0)) ((4 2) (0 1))
+    ((5 1) (4 1)) ((6 1) (5 0)) ((7 1) (6 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen x x-0 x-1 y)
+  (operation nonce-test (added-strand resp 2) (exp (gen) y) (6 0))
+  (traces
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x-1)
+          (enc (enc (exp (gen) x-1) (exp (gen) x-0) (privk b))
+            (exp (gen) (mul x-0 x-1)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x-1) (privk a))
+          (exp (gen) (mul x-0 x-1)))))
+    ((recv (exp (gen) (mul x-0 x-1))) (send (exp (gen) (mul x-0 x-1))))
+    ((recv (cat (exp (gen) x) (mul (rec x) x-0 x-1)))
+      (send (cat (exp (gen) x) (mul (rec x) x-0 x-1))))
+    ((send (exp (gen) x)))
+    ((send (exp (gen) x-1))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x-1) (privk b-0))
+            (exp (gen) (mul x-0 x-1)))))
+      (send
+        (enc (enc (exp (gen) x-1) (exp (gen) x-0) (privk b))
+          (exp (gen) (mul x-0 x-1)))))
+    ((recv (exp (gen) (mul x-0 x-1))) (send (exp (gen) (mul x-0 x-1))))
+    ((recv (cat (exp (gen) y) (mul x-0 x-1 (rec y))))
+      (send (cat (exp (gen) y) (mul x-0 x-1 (rec y)))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-1)) (exp h y))))))
+  (label 60)
+  (parent 38)
+  (unrealized (1 0) (2 0) (5 0) (6 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (y x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul (rec y) x x-0)))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (defstrand init 3 (a b) (b b-1) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (2 0)) ((4 0) (2 0)) ((4 0) (6 0)) ((4 2) (0 1))
+    ((5 1) (4 1)) ((6 1) (5 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen y x x-0)
+  (operation nonce-test (contracted (x-1 x) (x-2 x-0) (w (mul x x-0)))
+    (gen) (6 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul (rec y) x x-0)))
+      (send (cat (exp (gen) y) (mul (rec y) x x-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-1))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0)))))
+  (label 61)
+  (parent 39)
+  (unrealized (1 0) (2 0) (5 0) (6 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (y x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul (rec y) x x-0)))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (defstrand init 3 (a b) (b b-1) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (2 0)) ((4 0) (2 0)) ((4 0) (6 0)) ((4 2) (0 1))
+    ((5 1) (4 1)) ((6 1) (5 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen y x x-0)
+  (operation nonce-test (displaced 7 0 init 1) (exp (gen) x-1) (6 0))
+  (traces
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul (rec y) x x-0)))
+      (send (cat (exp (gen) y) (mul (rec y) x x-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b-1))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x))))
+  (label 62)
+  (parent 39)
+  (unrealized (1 0) (2 0) (6 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (y x x-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul (rec y) x x-0)))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (defstrand init 3 (a b) (b b-1) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (2 0)) ((4 0) (2 0)) ((4 0) (6 0)) ((4 2) (0 1))
+    ((5 1) (4 1)) ((6 1) (5 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen y x x-0)
+  (operation nonce-test (displaced 7 4 init 1) (exp (gen) x-1) (6 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul (rec y) x x-0)))
+      (send (cat (exp (gen) y) (mul (rec y) x x-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-1))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x))))
+  (label 63)
+  (parent 39)
+  (unrealized (1 0) (2 0) (6 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (y x x-0 x-1 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul (rec y) x x-0)))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (defstrand init 3 (a b) (b b-1) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+  (defstrand init 1 (x x-1))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (2 0)) ((4 0) (2 0)) ((4 0) (6 0)) ((4 2) (0 1))
+    ((5 1) (4 1)) ((6 1) (5 0)) ((7 0) (6 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen y x x-0 x-1)
+  (operation nonce-test (added-strand init 1) (exp (gen) x-1) (6 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul (rec y) x x-0)))
+      (send (cat (exp (gen) y) (mul (rec y) x x-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-1))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-1) (mul x x-0 (rec x-1))))
+      (send (cat (exp (gen) x-1) (mul x x-0 (rec x-1)))))
+    ((send (exp (gen) x-1))))
+  (label 64)
+  (parent 39)
+  (unrealized (1 0) (2 0) (5 0) (6 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (x x-0 y expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul x x-0 (rec y))))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (defstrand init 3 (a b) (b b-1) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul x x-0 (rec y))))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (2 0)) ((3 1) (6 0)) ((4 0) (2 0)) ((4 0) (6 0))
+    ((4 2) (0 1)) ((5 1) (4 1)) ((6 1) (5 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen x x-0 y)
+  (operation nonce-test (displaced 7 3 resp 2) (exp (gen) y-0) (6 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul x x-0 (rec y))))
+      (send (cat (exp (gen) y) (mul x x-0 (rec y)))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-1))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul x x-0 (rec y))))
+      (send (cat (exp (gen) y) (mul x x-0 (rec y))))))
+  (label 65)
+  (parent 39)
+  (unrealized (1 0) (2 0) (5 0) (6 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 b-2 name) (h h-0 base) (y x x-0 y-0 expn))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul (rec y) x x-0)))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (defstrand init 3 (a b) (b b-1) (h (exp (gen) x)) (x x-0))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y-0) (mul x x-0 (rec y-0))))
+  (defstrand resp 2 (b b-2) (h h-0) (y y-0))
+  (precedes ((0 0) (2 0)) ((0 0) (6 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (2 0)) ((4 0) (2 0)) ((4 0) (6 0)) ((4 2) (0 1))
+    ((5 1) (4 1)) ((6 1) (5 0)) ((7 1) (6 0)))
+  (absent (y-0 h-0) (y h))
+  (non-orig (privk a) (privk b))
+  (precur (6 0) (2 0))
+  (uniq-gen y x x-0 y-0)
+  (operation nonce-test (added-strand resp 2) (exp (gen) y-0) (6 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul (rec y) x x-0)))
+      (send (cat (exp (gen) y) (mul (rec y) x x-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-1))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y-0) (mul x x-0 (rec y-0))))
+      (send (cat (exp (gen) y-0) (mul x x-0 (rec y-0)))))
+    ((recv h-0)
+      (send
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) h-0 (privk b-2)) (exp h-0 y-0))))))
+  (label 66)
+  (parent 39)
+  (unrealized (1 0) (2 0) (5 0) (6 0))
+  (comment "empty cohort"))
+
+(comment "Nothing left to do")
+
+(defprotocol station-to-station diffie-hellman
+  (defrole init
+    (vars (x expn) (h base) (a b name))
+    (trace (send (exp (gen) x))
+      (recv (cat h (enc (enc h (exp (gen) x) (privk b)) (exp h x))))
+      (send (enc (enc (exp (gen) x) h (privk a)) (exp h x))))
+    (uniq-gen x))
+  (defrole resp
+    (vars (y expn) (h base) (a b name))
+    (trace (recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b)) (exp h y))))
+      (recv (enc (enc h (exp (gen) y) (privk a)) (exp h y))))
+    (uniq-gen y)
+    (absent (y h))))
+
+(defskeleton station-to-station
+  (vars (a b name) (h base) (y expn))
+  (defstrand resp 3 (a a) (b b) (h h) (y y))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (traces
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b)) (exp h y))))
+      (recv (enc (enc h (exp (gen) y) (privk a)) (exp h y)))))
+  (label 67)
+  (unrealized (0 2))
+  (origs)
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (y x expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (precedes ((0 1) (1 1)) ((1 0) (0 0)) ((1 2) (0 2)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y x)
+  (operation encryption-test (added-strand init 3)
+    (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+      (exp (gen) (mul y x))) (0 2))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x))))))
+  (label 68)
+  (parent 67)
+  (unrealized (1 1))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (h base) (y expn))
+  (defstrand resp 3 (a a) (b b) (h h) (y y))
+  (deflistener (exp h y))
+  (precedes ((0 1) (1 0)) ((1 1) (0 2)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (operation encryption-test (added-listener (exp h y))
+    (enc (enc h (exp (gen) y) (privk a)) (exp h y)) (0 2))
+  (traces
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b)) (exp h y))))
+      (recv (enc (enc h (exp (gen) y) (privk a)) (exp h y))))
+    ((recv (exp h y)) (send (exp h y))))
+  (label 69)
+  (parent 67)
+  (unrealized (0 2) (1 0))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (x y expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (precedes ((0 1) (1 1)) ((1 0) (0 0)) ((1 2) (0 2)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x y)
+  (operation encryption-test (displaced 2 0 resp 2)
+    (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+      (exp (gen) (mul x y))) (1 1))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y))))))
+  (label 70)
+  (parent 68)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a a) (b b) (y y) (h (exp (gen) x)))))
+  (origs))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (y x expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul y x)))
+  (precedes ((0 1) (2 0)) ((1 0) (0 0)) ((1 2) (0 2)) ((2 1) (1 1)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y x)
+  (operation encryption-test (added-listener (exp (gen) (mul y x)))
+    (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+      (exp (gen) (mul y x))) (1 1))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x)))))
+  (label 71)
+  (parent 68)
+  (unrealized (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (y expn))
+  (defstrand resp 3 (a a) (b b) (h (gen)) (y y))
+  (deflistener (exp (gen) y))
+  (precedes ((0 1) (1 0)) ((1 1) (0 2)))
+  (absent (y (gen)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (operation nonce-test (displaced 2 0 resp 2) (exp (gen) y-0) (1 0))
+  (traces
+    ((recv (gen))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (gen) (privk b)) (exp (gen) y))))
+      (recv (enc (enc (gen) (exp (gen) y) (privk a)) (exp (gen) y))))
+    ((recv (exp (gen) y)) (send (exp (gen) y))))
+  (label 72)
+  (parent 69)
+  (unrealized (0 2))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b name) (h base) (y expn) (w expr))
+  (defstrand resp 3 (a a) (b b) (h h) (y y))
+  (deflistener (exp h y))
+  (deflistener (cat (exp h (mul y (rec w))) w))
+  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (precur (2 0))
+  (operation nonce-test (added-listener (cat (exp h (mul y (rec w))) w))
+    (exp h y) (1 0))
+  (traces
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b)) (exp h y))))
+      (recv (enc (enc h (exp (gen) y) (privk a)) (exp h y))))
+    ((recv (exp h y)) (send (exp h y)))
+    ((recv (cat (exp h (mul y (rec w))) w))
+      (send (cat (exp h (mul y (rec w))) w))))
+  (label 73)
+  (parent 69)
+  (unrealized (0 2) (2 0))
+  (comment "4 in cohort - 4 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (y x expn) (w expr))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) (mul y x (rec w))) w))
+  (precedes ((0 1) (3 0)) ((1 0) (0 0)) ((1 2) (0 2)) ((2 1) (1 1))
+    ((3 1) (2 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y x)
+  (precur (3 0))
+  (operation nonce-test
+    (added-listener (cat (exp (gen) (mul y x (rec w))) w))
+    (exp (gen) (mul y x)) (2 0))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) (mul y x (rec w))) w))
+      (send (cat (exp (gen) (mul y x (rec w))) w))))
+  (label 74)
+  (parent 71)
+  (unrealized (3 0))
+  (comment "5 in cohort - 5 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (w expr) (y expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) w)) (y y))
+  (deflistener (exp (gen) (mul w y)))
+  (deflistener (cat (gen) (mul w y)))
+  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0)))
+  (absent (y (exp (gen) w)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (precur (2 0))
+  (operation nonce-test
+    (contracted (y-0 y) (h (exp (gen) w)) (w (mul w y))) (gen) (2 0))
+  (traces
+    ((recv (exp (gen) w))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) w) (privk b))
+            (exp (gen) (mul w y)))))
+      (recv
+        (enc (enc (exp (gen) w) (exp (gen) y) (privk a))
+          (exp (gen) (mul w y)))))
+    ((recv (exp (gen) (mul w y))) (send (exp (gen) (mul w y))))
+    ((recv (cat (gen) (mul w y))) (send (cat (gen) (mul w y)))))
+  (label 75)
+  (parent 73)
+  (unrealized (0 2) (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (w expr) (x y expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) (mul w x))) (y y))
+  (deflistener (exp (gen) (mul w x y)))
+  (deflistener (cat (exp (gen) x) (mul w y)))
+  (defstrand init 1 (x x))
+  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0)) ((3 0) (0 0)))
+  (absent (y (exp (gen) (mul w x))))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x y)
+  (operation nonce-test (added-strand init 1) (exp (gen) x) (2 0))
+  (traces
+    ((recv (exp (gen) (mul w x)))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) (mul w x)) (privk b))
+            (exp (gen) (mul w x y)))))
+      (recv
+        (enc (enc (exp (gen) (mul w x)) (exp (gen) y) (privk a))
+          (exp (gen) (mul w x y)))))
+    ((recv (exp (gen) (mul w x y))) (send (exp (gen) (mul w x y))))
+    ((recv (cat (exp (gen) x) (mul w y)))
+      (send (cat (exp (gen) x) (mul w y)))) ((send (exp (gen) x))))
+  (label 76)
+  (parent 73)
+  (unrealized (0 2) (1 0) (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b name) (w expr) (y expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) w)) (y y))
+  (deflistener (exp (gen) (mul w y)))
+  (deflistener (cat (exp (gen) y) w))
+  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0)))
+  (absent (y (exp (gen) w)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen y)
+  (operation nonce-test (displaced 3 0 resp 2) (exp (gen) y-0) (2 0))
+  (traces
+    ((recv (exp (gen) w))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) w) (privk b))
+            (exp (gen) (mul w y)))))
+      (recv
+        (enc (enc (exp (gen) w) (exp (gen) y) (privk a))
+          (exp (gen) (mul w y)))))
+    ((recv (exp (gen) (mul w y))) (send (exp (gen) (mul w y))))
+    ((recv (cat (exp (gen) y) w)) (send (cat (exp (gen) y) w))))
+  (label 77)
+  (parent 73)
+  (unrealized (0 2))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (h base) (w expr) (y y-0 expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) (mul w y))) (y y-0))
+  (deflistener (exp (gen) (mul w y y-0)))
+  (deflistener (cat (exp (gen) y) (mul w y-0)))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0)) ((3 1) (0 0)))
+  (absent (y h) (y-0 (exp (gen) (mul w y))))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen y y-0)
+  (operation nonce-test (added-strand resp 2) (exp (gen) y) (2 0))
+  (traces
+    ((recv (exp (gen) (mul w y)))
+      (send
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) (exp (gen) (mul w y)) (privk b))
+            (exp (gen) (mul w y y-0)))))
+      (recv
+        (enc (enc (exp (gen) (mul w y)) (exp (gen) y-0) (privk a))
+          (exp (gen) (mul w y y-0)))))
+    ((recv (exp (gen) (mul w y y-0))) (send (exp (gen) (mul w y y-0))))
+    ((recv (cat (exp (gen) y) (mul w y-0)))
+      (send (cat (exp (gen) y) (mul w y-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y))))))
+  (label 78)
+  (parent 73)
+  (unrealized (0 2) (1 0) (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (y x expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (gen) (mul y x)))
+  (precedes ((0 1) (3 0)) ((1 0) (0 0)) ((1 2) (0 2)) ((2 1) (1 1))
+    ((3 1) (2 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y x)
+  (precur (3 0))
+  (operation nonce-test (contracted (y-0 y) (x-0 x) (w (mul y x))) (gen)
+    (3 0))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (gen) (mul y x))) (send (cat (gen) (mul y x)))))
+  (label 79)
+  (parent 74)
+  (unrealized (2 0) (3 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (y x expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) x) y))
+  (precedes ((0 1) (3 0)) ((1 0) (0 0)) ((1 2) (0 2)) ((2 1) (1 1))
+    ((3 1) (2 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (3 0))
+  (uniq-gen y x)
+  (operation nonce-test (displaced 4 1 init 1) (exp (gen) x-0) (3 0))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) x) y)) (send (cat (exp (gen) x) y))))
+  (label 80)
+  (parent 74)
+  (unrealized (3 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (y x x-0 expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) x-0) (mul y x (rec x-0))))
+  (defstrand init 1 (x x-0))
+  (precedes ((0 1) (3 0)) ((1 0) (0 0)) ((1 2) (0 2)) ((2 1) (1 1))
+    ((3 1) (2 0)) ((4 0) (3 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (3 0))
+  (uniq-gen y x x-0)
+  (operation nonce-test (added-strand init 1) (exp (gen) x-0) (3 0))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) x-0) (mul y x (rec x-0))))
+      (send (cat (exp (gen) x-0) (mul y x (rec x-0)))))
+    ((send (exp (gen) x-0))))
+  (label 81)
+  (parent 74)
+  (unrealized (2 0) (3 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x y expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (exp (gen) y) x))
+  (precedes ((0 1) (3 0)) ((1 0) (0 0)) ((1 2) (0 2)) ((2 1) (1 1))
+    ((3 1) (2 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (3 0))
+  (uniq-gen x y)
+  (operation nonce-test (displaced 4 0 resp 2) (exp (gen) y-0) (3 0))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x))))
+  (label 82)
+  (parent 74)
+  (unrealized (3 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (y x y-0 expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) y-0) (mul y x (rec y-0))))
+  (defstrand resp 2 (b b-1) (h h) (y y-0))
+  (precedes ((0 1) (3 0)) ((1 0) (0 0)) ((1 2) (0 2)) ((2 1) (1 1))
+    ((3 1) (2 0)) ((4 1) (3 0)))
+  (absent (y-0 h) (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (3 0))
+  (uniq-gen y x y-0)
+  (operation nonce-test (added-strand resp 2) (exp (gen) y-0) (3 0))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) y-0) (mul y x (rec y-0))))
+      (send (cat (exp (gen) y-0) (mul y x (rec y-0)))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) h (privk b-1)) (exp h y-0))))))
+  (label 83)
+  (parent 74)
+  (unrealized (2 0) (3 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b name) (w expr) (y expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) w)) (y y))
+  (deflistener (exp (gen) (mul w y)))
+  (deflistener (cat (gen) (mul w y)))
+  (deflistener y)
+  (precedes ((0 1) (3 0)) ((1 1) (0 2)) ((2 1) (1 0)) ((3 1) (2 0)))
+  (absent (y (exp (gen) w)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (precur (2 0))
+  (operation nonce-test (added-listener y) (mul w y) (2 0))
+  (traces
+    ((recv (exp (gen) w))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) w) (privk b))
+            (exp (gen) (mul w y)))))
+      (recv
+        (enc (enc (exp (gen) w) (exp (gen) y) (privk a))
+          (exp (gen) (mul w y)))))
+    ((recv (exp (gen) (mul w y))) (send (exp (gen) (mul w y))))
+    ((recv (cat (gen) (mul w y))) (send (cat (gen) (mul w y))))
+    ((recv y) (send y)))
+  (label 84)
+  (parent 75)
+  (unrealized (0 2) (3 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b name) (w expr) (x y expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) (mul w x))) (y y))
+  (deflistener (exp (gen) (mul w x y)))
+  (deflistener (cat (exp (gen) x) (mul w y)))
+  (defstrand init 1 (x x))
+  (deflistener y)
+  (precedes ((0 1) (4 0)) ((1 1) (0 2)) ((2 1) (1 0)) ((3 0) (0 0))
+    ((4 1) (2 0)))
+  (absent (y (exp (gen) (mul w x))))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x y)
+  (operation nonce-test (added-listener y) (mul w y) (2 0))
+  (traces
+    ((recv (exp (gen) (mul w x)))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) (mul w x)) (privk b))
+            (exp (gen) (mul w x y)))))
+      (recv
+        (enc (enc (exp (gen) (mul w x)) (exp (gen) y) (privk a))
+          (exp (gen) (mul w x y)))))
+    ((recv (exp (gen) (mul w x y))) (send (exp (gen) (mul w x y))))
+    ((recv (cat (exp (gen) x) (mul w y)))
+      (send (cat (exp (gen) x) (mul w y)))) ((send (exp (gen) x)))
+    ((recv y) (send y)))
+  (label 85)
+  (parent 76)
+  (unrealized (0 2) (4 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (y x expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) y) x))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (precedes ((0 1) (2 0)) ((0 1) (3 1)) ((1 1) (0 2)) ((2 1) (1 0))
+    ((3 0) (0 0)) ((3 2) (0 2)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen y x)
+  (operation encryption-test (added-strand init 3)
+    (enc (exp (gen) x) (exp (gen) y) (privk a)) (0 2))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x)))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x))))))
+  (label 86)
+  (parent 77)
+  (unrealized (2 0) (3 1))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (h base) (w expr) (y y-0 expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) (mul w y))) (y y-0))
+  (deflistener (exp (gen) (mul w y y-0)))
+  (deflistener (cat (exp (gen) y) (mul w y-0)))
+  (defstrand resp 2 (b b-0) (h h) (y y))
+  (deflistener y-0)
+  (precedes ((0 1) (4 0)) ((1 1) (0 2)) ((2 1) (1 0)) ((3 1) (0 0))
+    ((4 1) (2 0)))
+  (absent (y h) (y-0 (exp (gen) (mul w y))))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen y y-0)
+  (operation nonce-test (added-listener y-0) (mul w y-0) (2 0))
+  (traces
+    ((recv (exp (gen) (mul w y)))
+      (send
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) (exp (gen) (mul w y)) (privk b))
+            (exp (gen) (mul w y y-0)))))
+      (recv
+        (enc (enc (exp (gen) (mul w y)) (exp (gen) y-0) (privk a))
+          (exp (gen) (mul w y y-0)))))
+    ((recv (exp (gen) (mul w y y-0))) (send (exp (gen) (mul w y y-0))))
+    ((recv (cat (exp (gen) y) (mul w y-0)))
+      (send (cat (exp (gen) y) (mul w y-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((recv y-0) (send y-0)))
+  (label 87)
+  (parent 78)
+  (unrealized (0 2) (4 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b name) (x y expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (exp (gen) y) x))
+  (defstrand init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (precedes ((0 1) (2 0)) ((0 1) (3 1)) ((1 1) (0 2)) ((2 1) (1 0))
+    ((3 0) (0 0)) ((3 2) (0 2)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x y)
+  (operation encryption-test (displaced 4 0 resp 2)
+    (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+      (exp (gen) (mul x y))) (3 1))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x)))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y))))))
+  (label 88)
+  (parent 86)
+  (unrealized (2 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (y x expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) y) x))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul y x)))
+  (precedes ((0 1) (2 0)) ((0 1) (4 0)) ((1 1) (0 2)) ((2 1) (1 0))
+    ((3 0) (0 0)) ((3 2) (0 2)) ((4 1) (3 1)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen y x)
+  (operation encryption-test (added-listener (exp (gen) (mul y x)))
+    (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+      (exp (gen) (mul y x))) (3 1))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x)))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x)))))
+  (label 89)
+  (parent 86)
+  (unrealized (2 0) (4 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (y x expn) (w expr))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) y) x))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) (mul y x (rec w))) w))
+  (precedes ((0 1) (2 0)) ((0 1) (5 0)) ((1 1) (0 2)) ((2 1) (1 0))
+    ((3 0) (0 0)) ((3 2) (0 2)) ((4 1) (3 1)) ((5 1) (4 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen y x)
+  (operation nonce-test
+    (added-listener (cat (exp (gen) (mul y x (rec w))) w))
+    (exp (gen) (mul y x)) (4 0))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x)))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) (mul y x (rec w))) w))
+      (send (cat (exp (gen) (mul y x (rec w))) w))))
+  (label 90)
+  (parent 89)
+  (unrealized (2 0) (5 0))
+  (comment "5 in cohort - 5 not yet seen"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (y x expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) y) x))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (gen) (mul y x)))
+  (precedes ((0 1) (2 0)) ((0 1) (5 0)) ((1 1) (0 2)) ((2 1) (1 0))
+    ((3 0) (0 0)) ((3 2) (0 2)) ((4 1) (3 1)) ((5 1) (4 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen y x)
+  (operation nonce-test (contracted (y-0 y) (x-0 x) (w (mul y x))) (gen)
+    (5 0))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x)))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (gen) (mul y x))) (send (cat (gen) (mul y x)))))
+  (label 91)
+  (parent 90)
+  (unrealized (2 0) (4 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (y x expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) y) x))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) x) y))
+  (precedes ((0 1) (2 0)) ((0 1) (5 0)) ((1 1) (0 2)) ((2 1) (1 0))
+    ((3 0) (0 0)) ((3 2) (0 2)) ((4 1) (3 1)) ((5 1) (4 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen y x)
+  (operation nonce-test (displaced 6 3 init 1) (exp (gen) x-0) (5 0))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x)))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) x) y)) (send (cat (exp (gen) x) y))))
+  (label 92)
+  (parent 90)
+  (unrealized (2 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (y x x-0 expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) y) x))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) x-0) (mul y x (rec x-0))))
+  (defstrand init 1 (x x-0))
+  (precedes ((0 1) (2 0)) ((0 1) (5 0)) ((1 1) (0 2)) ((2 1) (1 0))
+    ((3 0) (0 0)) ((3 2) (0 2)) ((4 1) (3 1)) ((5 1) (4 0))
+    ((6 0) (5 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen y x x-0)
+  (operation nonce-test (added-strand init 1) (exp (gen) x-0) (5 0))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x)))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) x-0) (mul y x (rec x-0))))
+      (send (cat (exp (gen) x-0) (mul y x (rec x-0)))))
+    ((send (exp (gen) x-0))))
+  (label 93)
+  (parent 90)
+  (unrealized (2 0) (4 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 name) (x y expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (exp (gen) y) x))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (exp (gen) y) x))
+  (precedes ((0 1) (2 0)) ((0 1) (5 0)) ((1 1) (0 2)) ((2 1) (1 0))
+    ((3 0) (0 0)) ((3 2) (0 2)) ((4 1) (3 1)) ((5 1) (4 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen x y)
+  (operation nonce-test (displaced 6 0 resp 2) (exp (gen) y-0) (5 0))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x)))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x))))
+  (label 94)
+  (parent 90)
+  (unrealized (2 0) (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-to-station
+  (vars (a b b-0 b-1 name) (h base) (y x y-0 expn))
+  (defstrand resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) y) x))
+  (defstrand init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) y-0) (mul y x (rec y-0))))
+  (defstrand resp 2 (b b-1) (h h) (y y-0))
+  (precedes ((0 1) (2 0)) ((0 1) (5 0)) ((1 1) (0 2)) ((2 1) (1 0))
+    ((3 0) (0 0)) ((3 2) (0 2)) ((4 1) (3 1)) ((5 1) (4 0))
+    ((6 1) (5 0)))
+  (absent (y-0 h) (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (5 0) (2 0))
+  (uniq-gen y x y-0)
+  (operation nonce-test (added-strand resp 2) (exp (gen) y-0) (5 0))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x)))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) y-0) (mul y x (rec y-0))))
+      (send (cat (exp (gen) y-0) (mul y x (rec y-0)))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) h (privk b-1)) (exp h y-0))))))
+  (label 95)
+  (parent 90)
+  (unrealized (2 0) (4 0) (5 0))
+  (comment "empty cohort"))
+
+(comment "Nothing left to do")
+
+(defprotocol station-weak diffie-hellman
+  (defrole weak-init
+    (vars (x expn) (h base) (a b name))
+    (trace (send (exp (gen) x))
+      (recv (cat h (enc (enc h (exp (gen) x) (privk b)) (exp h x))))
+      (send (enc (enc (exp (gen) x) h (privk a)) (exp h x)))))
+  (defrole weak-resp
+    (vars (y expn) (h base) (a b name))
+    (trace (recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b)) (exp h y))))
+      (recv (enc (enc h (exp (gen) y) (privk a)) (exp h y))))
+    (absent (y h))))
+
+(defskeleton station-weak
+  (vars (a b name) (h base) (x expn))
+  (defstrand weak-init 3 (a a) (b b) (h h) (x x))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (traces
+    ((send (exp (gen) x))
+      (recv (cat h (enc (enc h (exp (gen) x) (privk b)) (exp h x))))
+      (send (enc (enc (exp (gen) x) h (privk a)) (exp h x)))))
+  (label 96)
+  (unrealized (0 1))
+  (origs)
+  (comment "3 in cohort - 3 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (defstrand weak-init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (precedes ((0 0) (1 1)) ((1 2) (0 1)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (operation encryption-test (added-strand weak-init 3)
+    (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+      (exp (gen) (mul x x-0))) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0))))))
+  (label 97)
+  (parent 96)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a a) (b b) (x x) (h (exp (gen) x-0)))))
+  (origs))
+
+(defskeleton station-weak
+  (vars (a b name) (x y expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (defstrand weak-resp 2 (b b) (h (exp (gen) x)) (y y))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (operation encryption-test (added-strand weak-resp 2)
+    (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+      (exp (gen) (mul x y))) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))))
+  (label 98)
+  (parent 96)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a a) (b b) (x x) (h (exp (gen) y)))))
+  (origs))
+
+(defskeleton station-weak
+  (vars (a b name) (h base) (x expn))
+  (defstrand weak-init 3 (a a) (b b) (h h) (x x))
+  (deflistener (exp h x))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (operation encryption-test (added-listener (exp h x))
+    (enc (enc h (exp (gen) x) (privk b)) (exp h x)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv (cat h (enc (enc h (exp (gen) x) (privk b)) (exp h x))))
+      (send (enc (enc (exp (gen) x) h (privk a)) (exp h x))))
+    ((recv (exp h x)) (send (exp h x))))
+  (label 99)
+  (parent 96)
+  (unrealized (0 1) (1 0))
+  (comment "5 in cohort - 5 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (x expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) (rec x))) (x x))
+  (deflistener (gen))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (operation nonce-test (contracted (h (exp (gen) (rec x)))) (gen)
+    (1 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) (rec x))
+          (enc (enc (exp (gen) (rec x)) (exp (gen) x) (privk b))
+            (gen))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) (rec x)) (privk a)) (gen))))
+    ((recv (gen)) (send (gen))))
+  (label 100)
+  (parent 99)
+  (unrealized (0 1))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b name) (x expn))
+  (defstrand weak-init 3 (a a) (b b) (h (gen)) (x x))
+  (deflistener (exp (gen) x))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (operation nonce-test (displaced 2 0 weak-init 1) (exp (gen) x-0)
+    (1 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (gen)
+          (enc (enc (gen) (exp (gen) x) (privk b)) (exp (gen) x))))
+      (send (enc (enc (exp (gen) x) (gen) (privk a)) (exp (gen) x))))
+    ((recv (exp (gen) x)) (send (exp (gen) x))))
+  (label 101)
+  (parent 99)
+  (unrealized (0 1))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b name) (x x-0 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) (mul (rec x) x-0)))
+    (x x))
+  (deflistener (exp (gen) x-0))
+  (defstrand weak-init 1 (x x-0))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)) ((2 0) (1 0)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (operation nonce-test (added-strand weak-init 1) (exp (gen) x-0)
+    (1 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) (mul (rec x) x-0))
+          (enc
+            (enc (exp (gen) (mul (rec x) x-0)) (exp (gen) x) (privk b))
+            (exp (gen) x-0))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) (mul (rec x) x-0)) (privk a))
+          (exp (gen) x-0))))
+    ((recv (exp (gen) x-0)) (send (exp (gen) x-0)))
+    ((send (exp (gen) x-0))))
+  (label 102)
+  (parent 99)
+  (unrealized (0 1))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (h base) (x y expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) (mul (rec x) y)))
+    (x x))
+  (deflistener (exp (gen) y))
+  (defstrand weak-resp 2 (b b-0) (h h) (y y))
+  (precedes ((0 0) (1 0)) ((1 1) (0 1)) ((2 1) (1 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (operation nonce-test (added-strand weak-resp 2) (exp (gen) y) (1 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) (mul (rec x) y))
+          (enc (enc (exp (gen) (mul (rec x) y)) (exp (gen) x) (privk b))
+            (exp (gen) y))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) (mul (rec x) y)) (privk a))
+          (exp (gen) y)))) ((recv (exp (gen) y)) (send (exp (gen) y)))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y))))))
+  (label 103)
+  (parent 99)
+  (unrealized (0 1))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b name) (h base) (x expn) (w expr))
+  (defstrand weak-init 3 (a a) (b b) (h h) (x x))
+  (deflistener (exp h x))
+  (deflistener (cat (exp h (mul x (rec w))) w))
+  (precedes ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (1 0)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (precur (2 0))
+  (operation nonce-test (added-listener (cat (exp h (mul x (rec w))) w))
+    (exp h x) (1 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv (cat h (enc (enc h (exp (gen) x) (privk b)) (exp h x))))
+      (send (enc (enc (exp (gen) x) h (privk a)) (exp h x))))
+    ((recv (exp h x)) (send (exp h x)))
+    ((recv (cat (exp h (mul x (rec w))) w))
+      (send (cat (exp h (mul x (rec w))) w))))
+  (label 104)
+  (parent 99)
+  (unrealized (0 1) (2 0))
+  (comment "4 in cohort - 4 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (x expn) (w expr))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) (mul (rec x) w)))
+    (x x))
+  (deflistener (exp (gen) w))
+  (deflistener (cat (gen) w))
+  (precedes ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (1 0)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen x)
+  (precur (2 0))
+  (operation nonce-test (contracted (h (exp (gen) (mul (rec x) w))))
+    (gen) (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) (mul (rec x) w))
+          (enc (enc (exp (gen) (mul (rec x) w)) (exp (gen) x) (privk b))
+            (exp (gen) w))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) (mul (rec x) w)) (privk a))
+          (exp (gen) w)))) ((recv (exp (gen) w)) (send (exp (gen) w)))
+    ((recv (cat (gen) w)) (send (cat (gen) w))))
+  (label 105)
+  (parent 104)
+  (unrealized (0 1))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (w expr) (x expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) w)) (x x))
+  (deflistener (exp (gen) (mul w x)))
+  (deflistener (cat (exp (gen) x) w))
+  (precedes ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (1 0)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation nonce-test (displaced 3 0 weak-init 1) (exp (gen) x-0)
+    (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) w)
+          (enc (enc (exp (gen) w) (exp (gen) x) (privk b))
+            (exp (gen) (mul w x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) w) (privk a))
+          (exp (gen) (mul w x)))))
+    ((recv (exp (gen) (mul w x))) (send (exp (gen) (mul w x))))
+    ((recv (cat (exp (gen) x) w)) (send (cat (exp (gen) x) w))))
+  (label 106)
+  (parent 104)
+  (unrealized (0 1))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (x expn) (w expr) (x-0 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) (mul (rec x) w x-0)))
+    (x x))
+  (deflistener (exp (gen) (mul w x-0)))
+  (deflistener (cat (exp (gen) x-0) w))
+  (defstrand weak-init 1 (x x-0))
+  (precedes ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (1 0)) ((3 0) (2 0)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation nonce-test (added-strand weak-init 1) (exp (gen) x-0)
+    (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) (mul (rec x) w x-0))
+          (enc
+            (enc (exp (gen) (mul (rec x) w x-0)) (exp (gen) x)
+              (privk b)) (exp (gen) (mul w x-0)))))
+      (send
+        (enc
+          (enc (exp (gen) x) (exp (gen) (mul (rec x) w x-0)) (privk a))
+          (exp (gen) (mul w x-0)))))
+    ((recv (exp (gen) (mul w x-0))) (send (exp (gen) (mul w x-0))))
+    ((recv (cat (exp (gen) x-0) w)) (send (cat (exp (gen) x-0) w)))
+    ((send (exp (gen) x-0))))
+  (label 107)
+  (parent 104)
+  (unrealized (0 1))
+  (comment "3 in cohort - 3 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (h base) (x expn) (w expr) (y expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) (mul (rec x) w y)))
+    (x x))
+  (deflistener (exp (gen) (mul w y)))
+  (deflistener (cat (exp (gen) y) w))
+  (defstrand weak-resp 2 (b b-0) (h h) (y y))
+  (precedes ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (1 0)) ((3 1) (2 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation nonce-test (added-strand weak-resp 2) (exp (gen) y) (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) (mul (rec x) w y))
+          (enc
+            (enc (exp (gen) (mul (rec x) w y)) (exp (gen) x) (privk b))
+            (exp (gen) (mul w y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) (mul (rec x) w y)) (privk a))
+          (exp (gen) (mul w y)))))
+    ((recv (exp (gen) (mul w y))) (send (exp (gen) (mul w y))))
+    ((recv (cat (exp (gen) y) w)) (send (cat (exp (gen) y) w)))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y))))))
+  (label 108)
+  (parent 104)
+  (unrealized (0 1))
+  (comment "3 in cohort - 3 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (defstrand weak-init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (precedes ((0 0) (2 0)) ((0 0) (3 1)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 2) (0 1)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation encryption-test (added-strand weak-init 3)
+    (enc (exp (gen) x-0) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0))))))
+  (label 109)
+  (parent 105)
+  (unrealized (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (x y expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (gen) (mul x y)))
+  (defstrand weak-resp 2 (b b) (h (exp (gen) x)) (y y))
+  (precedes ((0 0) (2 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (0 1)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation encryption-test (added-strand weak-resp 2)
+    (enc (exp (gen) y) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (gen) (mul x y))) (send (cat (gen) (mul x y))))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))))
+  (label 110)
+  (parent 105)
+  (unrealized (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x) x-0))
+  (defstrand weak-init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (precedes ((0 0) (2 0)) ((0 0) (3 1)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 2) (0 1)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation encryption-test (added-strand weak-init 3)
+    (enc (exp (gen) x-0) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x) x-0)) (send (cat (exp (gen) x) x-0)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0))))))
+  (label 111)
+  (parent 106)
+  (unrealized)
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (x y expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (exp (gen) x) y))
+  (defstrand weak-resp 2 (b b) (h (exp (gen) x)) (y y))
+  (precedes ((0 0) (2 0)) ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (0 1)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation encryption-test (added-strand weak-resp 2)
+    (enc (exp (gen) y) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (exp (gen) x) y)) (send (cat (exp (gen) x) y)))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))))
+  (label 112)
+  (parent 106)
+  (unrealized)
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) x-0) x))
+  (defstrand weak-init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (precedes ((0 0) (2 0)) ((0 0) (3 1)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((3 2) (0 1)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation encryption-test (displaced 3 4 weak-init 3)
+    (enc (exp (gen) x-1) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) x-0) x)) (send (cat (exp (gen) x-0) x)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0))))))
+  (label 113)
+  (parent 107)
+  (unrealized (2 0))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (x x-0 x-1 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) x-1)) (x x))
+  (deflistener (exp (gen) (mul x x-1)))
+  (deflistener (cat (exp (gen) x-0) (mul x (rec x-0) x-1)))
+  (defstrand weak-init 1 (x x-0))
+  (defstrand weak-init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-1))
+  (precedes ((0 0) (2 0)) ((0 0) (4 1)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((4 2) (0 1)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation encryption-test (added-strand weak-init 3)
+    (enc (exp (gen) x-1) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-1)
+          (enc (enc (exp (gen) x-1) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-1)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-1) (privk a))
+          (exp (gen) (mul x x-1)))))
+    ((recv (exp (gen) (mul x x-1))) (send (exp (gen) (mul x x-1))))
+    ((recv (cat (exp (gen) x-0) (mul x (rec x-0) x-1)))
+      (send (cat (exp (gen) x-0) (mul x (rec x-0) x-1))))
+    ((send (exp (gen) x-0)))
+    ((send (exp (gen) x-1))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-1) (privk b-0))
+            (exp (gen) (mul x x-1)))))
+      (send
+        (enc (enc (exp (gen) x-1) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-1))))))
+  (label 114)
+  (parent 107)
+  (unrealized (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (x x-0 y expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (exp (gen) x-0) (mul x (rec x-0) y)))
+  (defstrand weak-init 1 (x x-0))
+  (defstrand weak-resp 2 (b b) (h (exp (gen) x)) (y y))
+  (precedes ((0 0) (2 0)) ((0 0) (4 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((4 1) (0 1)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation encryption-test (added-strand weak-resp 2)
+    (enc (exp (gen) y) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (exp (gen) x-0) (mul x (rec x-0) y)))
+      (send (cat (exp (gen) x-0) (mul x (rec x-0) y))))
+    ((send (exp (gen) x-0)))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))))
+  (label 115)
+  (parent 107)
+  (unrealized (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b b-0 b-1 name) (h base) (x y x-0 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul x (rec y) x-0)))
+  (defstrand weak-resp 2 (b b-0) (h h) (y y))
+  (defstrand weak-init 3 (a b) (b b-1) (h (exp (gen) x)) (x x-0))
+  (precedes ((0 0) (2 0)) ((0 0) (4 1)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (2 0)) ((4 2) (0 1)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation encryption-test (added-strand weak-init 3)
+    (enc (exp (gen) x-0) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul x (rec y) x-0)))
+      (send (cat (exp (gen) y) (mul x (rec y) x-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-1))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0))))))
+  (label 116)
+  (parent 108)
+  (unrealized (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (x y expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (exp (gen) y) x))
+  (defstrand weak-resp 2 (b b) (h (exp (gen) x)) (y y))
+  (precedes ((0 0) (3 0)) ((1 1) (0 1)) ((2 1) (1 0)) ((3 1) (2 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation encryption-test (displaced 4 3 weak-resp 2)
+    (enc (exp (gen) y-0) (exp (gen) x) (privk b-0)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x)))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))))
+  (label 117)
+  (parent 108)
+  (unrealized (2 0))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (h base) (x y y-0 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) y-0)) (x x))
+  (deflistener (exp (gen) (mul x y-0)))
+  (deflistener (cat (exp (gen) y) (mul x (rec y) y-0)))
+  (defstrand weak-resp 2 (b b-0) (h h) (y y))
+  (defstrand weak-resp 2 (b b) (h (exp (gen) x)) (y y-0))
+  (precedes ((0 0) (2 0)) ((0 0) (4 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (2 0)) ((4 1) (0 1)))
+  (absent (y-0 (exp (gen) x)) (y h))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation encryption-test (added-strand weak-resp 2)
+    (enc (exp (gen) y-0) (exp (gen) x) (privk b)) (0 1))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y-0) (privk a))
+          (exp (gen) (mul x y-0)))))
+    ((recv (exp (gen) (mul x y-0))) (send (exp (gen) (mul x y-0))))
+    ((recv (cat (exp (gen) y) (mul x (rec y) y-0)))
+      (send (cat (exp (gen) y) (mul x (rec y) y-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y-0)))))))
+  (label 118)
+  (parent 108)
+  (unrealized (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (gen) (mul x x-0)))
+  (defstrand weak-init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (deflistener x)
+  (precedes ((0 0) (3 1)) ((0 0) (4 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 2) (0 1)) ((4 1) (2 0)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation nonce-test (added-listener x) (mul x x-0) (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (gen) (mul x x-0))) (send (cat (gen) (mul x x-0))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0))))) ((recv x) (send x)))
+  (label 119)
+  (parent 109)
+  (unrealized (4 0))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b name) (x y expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (gen) (mul x y)))
+  (defstrand weak-resp 2 (b b) (h (exp (gen) x)) (y y))
+  (deflistener x)
+  (precedes ((0 0) (3 0)) ((0 0) (4 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (0 1)) ((4 1) (2 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation nonce-test (added-listener x) (mul x y) (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (gen) (mul x y))) (send (cat (gen) (mul x y))))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))) ((recv x) (send x)))
+  (label 120)
+  (parent 110)
+  (unrealized (4 0))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (x x-0 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (cat (exp (gen) x) x-0))
+  (defstrand weak-init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-0))
+  (precedes ((0 0) (1 0)) ((0 0) (2 1)) ((1 1) (0 1)) ((2 2) (0 1)))
+  (non-orig (privk a) (privk b))
+  (precur (1 0))
+  (uniq-gen x)
+  (operation generalization deleted (1 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (cat (exp (gen) x) x-0)) (send (cat (exp (gen) x) x-0)))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-0))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0))))))
+  (label 121)
+  (parent 111)
+  (seen 97)
+  (unrealized)
+  (comment "1 in cohort - 0 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (x y expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (deflistener (cat (exp (gen) x) y))
+  (defstrand weak-resp 2 (b b) (h (exp (gen) x)) (y y))
+  (precedes ((0 0) (1 0)) ((0 0) (2 0)) ((1 1) (0 1)) ((2 1) (0 1)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (1 0))
+  (uniq-gen x)
+  (operation generalization deleted (1 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (cat (exp (gen) x) y)) (send (cat (exp (gen) x) y)))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))))
+  (label 122)
+  (parent 112)
+  (seen 98)
+  (unrealized)
+  (comment "1 in cohort - 0 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (x x-0 x-1 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) x-1)) (x x))
+  (deflistener (exp (gen) (mul x x-1)))
+  (deflistener (cat (exp (gen) x-0) (mul x (rec x-0) x-1)))
+  (defstrand weak-init 1 (x x-0))
+  (defstrand weak-init 3 (a b) (b b-0) (h (exp (gen) x)) (x x-1))
+  (deflistener x)
+  (precedes ((0 0) (4 1)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((4 2) (0 1)) ((5 1) (2 0)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation nonce-test (added-listener x) (mul x (rec x-0) x-1) (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-1)
+          (enc (enc (exp (gen) x-1) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-1)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-1) (privk a))
+          (exp (gen) (mul x x-1)))))
+    ((recv (exp (gen) (mul x x-1))) (send (exp (gen) (mul x x-1))))
+    ((recv (cat (exp (gen) x-0) (mul x (rec x-0) x-1)))
+      (send (cat (exp (gen) x-0) (mul x (rec x-0) x-1))))
+    ((send (exp (gen) x-0)))
+    ((send (exp (gen) x-1))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-1) (privk b-0))
+            (exp (gen) (mul x x-1)))))
+      (send
+        (enc (enc (exp (gen) x-1) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-1))))) ((recv x) (send x)))
+  (label 123)
+  (parent 114)
+  (unrealized (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b name) (x x-0 y expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) y)) (x x))
+  (deflistener (exp (gen) (mul x y)))
+  (deflistener (cat (exp (gen) x-0) (mul x (rec x-0) y)))
+  (defstrand weak-init 1 (x x-0))
+  (defstrand weak-resp 2 (b b) (h (exp (gen) x)) (y y))
+  (deflistener x)
+  (precedes ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 0) (2 0)) ((4 1) (0 1)) ((5 1) (2 0)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation nonce-test (added-listener x) (mul x (rec x-0) y) (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul x y)))))
+    ((recv (exp (gen) (mul x y))) (send (exp (gen) (mul x y))))
+    ((recv (cat (exp (gen) x-0) (mul x (rec x-0) y)))
+      (send (cat (exp (gen) x-0) (mul x (rec x-0) y))))
+    ((send (exp (gen) x-0)))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y)))))) ((recv x) (send x)))
+  (label 124)
+  (parent 115)
+  (unrealized (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b b-0 b-1 name) (h base) (x y x-0 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) x-0)) (x x))
+  (deflistener (exp (gen) (mul x x-0)))
+  (deflistener (cat (exp (gen) y) (mul x (rec y) x-0)))
+  (defstrand weak-resp 2 (b b-0) (h h) (y y))
+  (defstrand weak-init 3 (a b) (b b-1) (h (exp (gen) x)) (x x-0))
+  (deflistener x)
+  (precedes ((0 0) (4 1)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (2 0)) ((4 2) (0 1)) ((5 1) (2 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation nonce-test (added-listener x) (mul x (rec y) x-0) (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) x-0)
+          (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) x-0) (privk a))
+          (exp (gen) (mul x x-0)))))
+    ((recv (exp (gen) (mul x x-0))) (send (exp (gen) (mul x x-0))))
+    ((recv (cat (exp (gen) y) (mul x (rec y) x-0)))
+      (send (cat (exp (gen) y) (mul x (rec y) x-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((send (exp (gen) x-0))
+      (recv
+        (cat (exp (gen) x)
+          (enc (enc (exp (gen) x) (exp (gen) x-0) (privk b-1))
+            (exp (gen) (mul x x-0)))))
+      (send
+        (enc (enc (exp (gen) x-0) (exp (gen) x) (privk b))
+          (exp (gen) (mul x x-0))))) ((recv x) (send x)))
+  (label 125)
+  (parent 116)
+  (unrealized (5 0))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (h base) (x y y-0 expn))
+  (defstrand weak-init 3 (a a) (b b) (h (exp (gen) y-0)) (x x))
+  (deflistener (exp (gen) (mul x y-0)))
+  (deflistener (cat (exp (gen) y) (mul x (rec y) y-0)))
+  (defstrand weak-resp 2 (b b-0) (h h) (y y))
+  (defstrand weak-resp 2 (b b) (h (exp (gen) x)) (y y-0))
+  (deflistener x)
+  (precedes ((0 0) (4 0)) ((0 0) (5 0)) ((1 1) (0 1)) ((2 1) (1 0))
+    ((3 1) (2 0)) ((4 1) (0 1)) ((5 1) (2 0)))
+  (absent (y-0 (exp (gen) x)) (y h))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen x)
+  (operation nonce-test (added-listener x) (mul x (rec y) y-0) (2 0))
+  (traces
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y-0)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y-0) (privk a))
+          (exp (gen) (mul x y-0)))))
+    ((recv (exp (gen) (mul x y-0))) (send (exp (gen) (mul x y-0))))
+    ((recv (cat (exp (gen) y) (mul x (rec y) y-0)))
+      (send (cat (exp (gen) y) (mul x (rec y) y-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) (exp (gen) x) (privk b))
+            (exp (gen) (mul x y-0)))))) ((recv x) (send x)))
+  (label 126)
+  (parent 118)
+  (unrealized (5 0))
+  (comment "empty cohort"))
+
+(comment "Nothing left to do")
+
+(defprotocol station-weak diffie-hellman
+  (defrole weak-init
+    (vars (x expn) (h base) (a b name))
+    (trace (send (exp (gen) x))
+      (recv (cat h (enc (enc h (exp (gen) x) (privk b)) (exp h x))))
+      (send (enc (enc (exp (gen) x) h (privk a)) (exp h x)))))
+  (defrole weak-resp
+    (vars (y expn) (h base) (a b name))
+    (trace (recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b)) (exp h y))))
+      (recv (enc (enc h (exp (gen) y) (privk a)) (exp h y))))
+    (absent (y h))))
+
+(defskeleton station-weak
+  (vars (a b name) (h base) (y expn))
+  (defstrand weak-resp 3 (a a) (b b) (h h) (y y))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (traces
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b)) (exp h y))))
+      (recv (enc (enc h (exp (gen) y) (privk a)) (exp h y)))))
+  (label 127)
+  (unrealized (0 2))
+  (origs)
+  (comment "3 in cohort - 3 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (y x expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (defstrand weak-init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (precedes ((0 1) (1 1)) ((1 2) (0 2)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (operation encryption-test (added-strand weak-init 3)
+    (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+      (exp (gen) (mul y x))) (0 2))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x))))))
+  (label 128)
+  (parent 127)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a a) (b b) (y y) (h (exp (gen) x)))))
+  (origs))
+
+(defskeleton station-weak
+  (vars (a b name) (y y-0 expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (exp (gen) y-0)) (y y))
+  (defstrand weak-resp 2 (b a) (h (exp (gen) y)) (y y-0))
+  (precedes ((0 1) (1 0)) ((1 1) (0 2)))
+  (absent (y-0 (exp (gen) y)) (y (exp (gen) y-0)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (operation encryption-test (added-strand weak-resp 2)
+    (enc (enc (exp (gen) y-0) (exp (gen) y) (privk a))
+      (exp (gen) (mul y y-0))) (0 2))
+  (traces
+    ((recv (exp (gen) y-0))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) y-0) (privk b))
+            (exp (gen) (mul y y-0)))))
+      (recv
+        (enc (enc (exp (gen) y-0) (exp (gen) y) (privk a))
+          (exp (gen) (mul y y-0)))))
+    ((recv (exp (gen) y))
+      (send
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) (exp (gen) y) (privk a))
+            (exp (gen) (mul y y-0)))))))
+  (label 129)
+  (parent 127)
+  (unrealized)
+  (shape)
+  (maps ((0) ((a a) (b b) (y y) (h (exp (gen) y-0)))))
+  (origs))
+
+(defskeleton station-weak
+  (vars (a b name) (h base) (y expn))
+  (defstrand weak-resp 3 (a a) (b b) (h h) (y y))
+  (deflistener (exp h y))
+  (precedes ((0 1) (1 0)) ((1 1) (0 2)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (operation encryption-test (added-listener (exp h y))
+    (enc (enc h (exp (gen) y) (privk a)) (exp h y)) (0 2))
+  (traces
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b)) (exp h y))))
+      (recv (enc (enc h (exp (gen) y) (privk a)) (exp h y))))
+    ((recv (exp h y)) (send (exp h y))))
+  (label 130)
+  (parent 127)
+  (unrealized (0 2) (1 0))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (y expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (gen)) (y y))
+  (deflistener (exp (gen) y))
+  (precedes ((0 1) (1 0)) ((1 1) (0 2)))
+  (absent (y (gen)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (operation nonce-test (displaced 2 0 weak-resp 2) (exp (gen) y-0)
+    (1 0))
+  (traces
+    ((recv (gen))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (gen) (privk b)) (exp (gen) y))))
+      (recv (enc (enc (gen) (exp (gen) y) (privk a)) (exp (gen) y))))
+    ((recv (exp (gen) y)) (send (exp (gen) y))))
+  (label 131)
+  (parent 130)
+  (unrealized (0 2))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b name) (h base) (y expn) (w expr))
+  (defstrand weak-resp 3 (a a) (b b) (h h) (y y))
+  (deflistener (exp h y))
+  (deflistener (cat (exp h (mul y (rec w))) w))
+  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0)))
+  (absent (y h))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (precur (2 0))
+  (operation nonce-test (added-listener (cat (exp h (mul y (rec w))) w))
+    (exp h y) (1 0))
+  (traces
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b)) (exp h y))))
+      (recv (enc (enc h (exp (gen) y) (privk a)) (exp h y))))
+    ((recv (exp h y)) (send (exp h y)))
+    ((recv (cat (exp h (mul y (rec w))) w))
+      (send (cat (exp h (mul y (rec w))) w))))
+  (label 132)
+  (parent 130)
+  (unrealized (0 2) (2 0))
+  (comment "4 in cohort - 4 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (w expr) (y expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (exp (gen) w)) (y y))
+  (deflistener (exp (gen) (mul w y)))
+  (deflistener (cat (gen) (mul w y)))
+  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0)))
+  (absent (y (exp (gen) w)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (precur (2 0))
+  (operation nonce-test
+    (contracted (y-0 y) (h (exp (gen) w)) (w (mul w y))) (gen) (2 0))
+  (traces
+    ((recv (exp (gen) w))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) w) (privk b))
+            (exp (gen) (mul w y)))))
+      (recv
+        (enc (enc (exp (gen) w) (exp (gen) y) (privk a))
+          (exp (gen) (mul w y)))))
+    ((recv (exp (gen) (mul w y))) (send (exp (gen) (mul w y))))
+    ((recv (cat (gen) (mul w y))) (send (cat (gen) (mul w y)))))
+  (label 133)
+  (parent 132)
+  (unrealized (0 2) (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (w expr) (x y expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (exp (gen) (mul w x))) (y y))
+  (deflistener (exp (gen) (mul w x y)))
+  (deflistener (cat (exp (gen) x) (mul w y)))
+  (defstrand weak-init 1 (x x))
+  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0)) ((3 0) (2 0)))
+  (absent (y (exp (gen) (mul w x))))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen y)
+  (operation nonce-test (added-strand weak-init 1) (exp (gen) x) (2 0))
+  (traces
+    ((recv (exp (gen) (mul w x)))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) (mul w x)) (privk b))
+            (exp (gen) (mul w x y)))))
+      (recv
+        (enc (enc (exp (gen) (mul w x)) (exp (gen) y) (privk a))
+          (exp (gen) (mul w x y)))))
+    ((recv (exp (gen) (mul w x y))) (send (exp (gen) (mul w x y))))
+    ((recv (cat (exp (gen) x) (mul w y)))
+      (send (cat (exp (gen) x) (mul w y)))) ((send (exp (gen) x))))
+  (label 134)
+  (parent 132)
+  (unrealized (0 2) (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (w expr) (y expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (exp (gen) w)) (y y))
+  (deflistener (exp (gen) (mul w y)))
+  (deflistener (cat (exp (gen) y) w))
+  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0)))
+  (absent (y (exp (gen) w)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen y)
+  (operation nonce-test (displaced 3 0 weak-resp 2) (exp (gen) y-0)
+    (2 0))
+  (traces
+    ((recv (exp (gen) w))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) w) (privk b))
+            (exp (gen) (mul w y)))))
+      (recv
+        (enc (enc (exp (gen) w) (exp (gen) y) (privk a))
+          (exp (gen) (mul w y)))))
+    ((recv (exp (gen) (mul w y))) (send (exp (gen) (mul w y))))
+    ((recv (cat (exp (gen) y) w)) (send (cat (exp (gen) y) w))))
+  (label 135)
+  (parent 132)
+  (unrealized (0 2))
+  (comment "2 in cohort - 2 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (h base) (w expr) (y y-0 expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (exp (gen) (mul w y))) (y y-0))
+  (deflistener (exp (gen) (mul w y y-0)))
+  (deflistener (cat (exp (gen) y) (mul w y-0)))
+  (defstrand weak-resp 2 (b b-0) (h h) (y y))
+  (precedes ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (1 0)) ((3 1) (2 0)))
+  (absent (y h) (y-0 (exp (gen) (mul w y))))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen y-0)
+  (operation nonce-test (added-strand weak-resp 2) (exp (gen) y) (2 0))
+  (traces
+    ((recv (exp (gen) (mul w y)))
+      (send
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) (exp (gen) (mul w y)) (privk b))
+            (exp (gen) (mul w y y-0)))))
+      (recv
+        (enc (enc (exp (gen) (mul w y)) (exp (gen) y-0) (privk a))
+          (exp (gen) (mul w y y-0)))))
+    ((recv (exp (gen) (mul w y y-0))) (send (exp (gen) (mul w y y-0))))
+    ((recv (cat (exp (gen) y) (mul w y-0)))
+      (send (cat (exp (gen) y) (mul w y-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y))))))
+  (label 136)
+  (parent 132)
+  (unrealized (0 2) (2 0))
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (w expr) (y expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (exp (gen) w)) (y y))
+  (deflistener (exp (gen) (mul w y)))
+  (deflistener (cat (gen) (mul w y)))
+  (deflistener y)
+  (precedes ((0 1) (3 0)) ((1 1) (0 2)) ((2 1) (1 0)) ((3 1) (2 0)))
+  (absent (y (exp (gen) w)))
+  (non-orig (privk a) (privk b))
+  (uniq-gen y)
+  (precur (2 0))
+  (operation nonce-test (added-listener y) (mul w y) (2 0))
+  (traces
+    ((recv (exp (gen) w))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) w) (privk b))
+            (exp (gen) (mul w y)))))
+      (recv
+        (enc (enc (exp (gen) w) (exp (gen) y) (privk a))
+          (exp (gen) (mul w y)))))
+    ((recv (exp (gen) (mul w y))) (send (exp (gen) (mul w y))))
+    ((recv (cat (gen) (mul w y))) (send (cat (gen) (mul w y))))
+    ((recv y) (send y)))
+  (label 137)
+  (parent 133)
+  (unrealized (0 2) (3 0))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b name) (w expr) (x y expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (exp (gen) (mul w x))) (y y))
+  (deflistener (exp (gen) (mul w x y)))
+  (deflistener (cat (exp (gen) x) (mul w y)))
+  (defstrand weak-init 1 (x x))
+  (deflistener y)
+  (precedes ((0 1) (4 0)) ((1 1) (0 2)) ((2 1) (1 0)) ((3 0) (2 0))
+    ((4 1) (2 0)))
+  (absent (y (exp (gen) (mul w x))))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen y)
+  (operation nonce-test (added-listener y) (mul w y) (2 0))
+  (traces
+    ((recv (exp (gen) (mul w x)))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) (mul w x)) (privk b))
+            (exp (gen) (mul w x y)))))
+      (recv
+        (enc (enc (exp (gen) (mul w x)) (exp (gen) y) (privk a))
+          (exp (gen) (mul w x y)))))
+    ((recv (exp (gen) (mul w x y))) (send (exp (gen) (mul w x y))))
+    ((recv (cat (exp (gen) x) (mul w y)))
+      (send (cat (exp (gen) x) (mul w y)))) ((send (exp (gen) x)))
+    ((recv y) (send y)))
+  (label 138)
+  (parent 134)
+  (unrealized (0 2) (4 0))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (y x expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (deflistener (exp (gen) (mul y x)))
+  (deflistener (cat (exp (gen) y) x))
+  (defstrand weak-init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (precedes ((0 1) (2 0)) ((0 1) (3 1)) ((1 1) (0 2)) ((2 1) (1 0))
+    ((3 2) (0 2)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen y)
+  (operation encryption-test (added-strand weak-init 3)
+    (enc (exp (gen) x) (exp (gen) y) (privk a)) (0 2))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (exp (gen) (mul y x))) (send (exp (gen) (mul y x))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x)))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x))))))
+  (label 139)
+  (parent 135)
+  (unrealized)
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (y y-0 expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (exp (gen) y-0)) (y y))
+  (deflistener (exp (gen) (mul y y-0)))
+  (deflistener (cat (exp (gen) y) y-0))
+  (defstrand weak-resp 2 (b a) (h (exp (gen) y)) (y y-0))
+  (precedes ((0 1) (2 0)) ((0 1) (3 0)) ((1 1) (0 2)) ((2 1) (1 0))
+    ((3 1) (0 2)))
+  (absent (y-0 (exp (gen) y)) (y (exp (gen) y-0)))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen y)
+  (operation encryption-test (added-strand weak-resp 2)
+    (enc (exp (gen) y-0) (exp (gen) y) (privk a)) (0 2))
+  (traces
+    ((recv (exp (gen) y-0))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) y-0) (privk b))
+            (exp (gen) (mul y y-0)))))
+      (recv
+        (enc (enc (exp (gen) y-0) (exp (gen) y) (privk a))
+          (exp (gen) (mul y y-0)))))
+    ((recv (exp (gen) (mul y y-0))) (send (exp (gen) (mul y y-0))))
+    ((recv (cat (exp (gen) y) y-0)) (send (cat (exp (gen) y) y-0)))
+    ((recv (exp (gen) y))
+      (send
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) (exp (gen) y) (privk a))
+            (exp (gen) (mul y y-0)))))))
+  (label 140)
+  (parent 135)
+  (unrealized)
+  (comment "1 in cohort - 1 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (h base) (w expr) (y y-0 expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (exp (gen) (mul w y))) (y y-0))
+  (deflistener (exp (gen) (mul w y y-0)))
+  (deflistener (cat (exp (gen) y) (mul w y-0)))
+  (defstrand weak-resp 2 (b b-0) (h h) (y y))
+  (deflistener y-0)
+  (precedes ((0 1) (4 0)) ((1 1) (0 2)) ((2 1) (1 0)) ((3 1) (2 0))
+    ((4 1) (2 0)))
+  (absent (y h) (y-0 (exp (gen) (mul w y))))
+  (non-orig (privk a) (privk b))
+  (precur (2 0))
+  (uniq-gen y-0)
+  (operation nonce-test (added-listener y-0) (mul w y-0) (2 0))
+  (traces
+    ((recv (exp (gen) (mul w y)))
+      (send
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) (exp (gen) (mul w y)) (privk b))
+            (exp (gen) (mul w y y-0)))))
+      (recv
+        (enc (enc (exp (gen) (mul w y)) (exp (gen) y-0) (privk a))
+          (exp (gen) (mul w y y-0)))))
+    ((recv (exp (gen) (mul w y y-0))) (send (exp (gen) (mul w y y-0))))
+    ((recv (cat (exp (gen) y) (mul w y-0)))
+      (send (cat (exp (gen) y) (mul w y-0))))
+    ((recv h)
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) h (privk b-0)) (exp h y)))))
+    ((recv y-0) (send y-0)))
+  (label 141)
+  (parent 136)
+  (unrealized (0 2) (4 0))
+  (comment "empty cohort"))
+
+(defskeleton station-weak
+  (vars (a b b-0 name) (y x expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (exp (gen) x)) (y y))
+  (deflistener (cat (exp (gen) y) x))
+  (defstrand weak-init 3 (a a) (b b-0) (h (exp (gen) y)) (x x))
+  (precedes ((0 1) (1 0)) ((0 1) (2 1)) ((1 1) (0 2)) ((2 2) (0 2)))
+  (absent (y (exp (gen) x)))
+  (non-orig (privk a) (privk b))
+  (precur (1 0))
+  (uniq-gen y)
+  (operation generalization deleted (1 0))
+  (traces
+    ((recv (exp (gen) x))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b))
+            (exp (gen) (mul y x)))))
+      (recv
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x)))))
+    ((recv (cat (exp (gen) y) x)) (send (cat (exp (gen) y) x)))
+    ((send (exp (gen) x))
+      (recv
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) x) (privk b-0))
+            (exp (gen) (mul y x)))))
+      (send
+        (enc (enc (exp (gen) x) (exp (gen) y) (privk a))
+          (exp (gen) (mul y x))))))
+  (label 142)
+  (parent 139)
+  (seen 128)
+  (unrealized)
+  (comment "1 in cohort - 0 not yet seen"))
+
+(defskeleton station-weak
+  (vars (a b name) (y y-0 expn))
+  (defstrand weak-resp 3 (a a) (b b) (h (exp (gen) y-0)) (y y))
+  (deflistener (cat (exp (gen) y) y-0))
+  (defstrand weak-resp 2 (b a) (h (exp (gen) y)) (y y-0))
+  (precedes ((0 1) (1 0)) ((0 1) (2 0)) ((1 1) (0 2)) ((2 1) (0 2)))
+  (absent (y-0 (exp (gen) y)) (y (exp (gen) y-0)))
+  (non-orig (privk a) (privk b))
+  (precur (1 0))
+  (uniq-gen y)
+  (operation generalization deleted (1 0))
+  (traces
+    ((recv (exp (gen) y-0))
+      (send
+        (cat (exp (gen) y)
+          (enc (enc (exp (gen) y) (exp (gen) y-0) (privk b))
+            (exp (gen) (mul y y-0)))))
+      (recv
+        (enc (enc (exp (gen) y-0) (exp (gen) y) (privk a))
+          (exp (gen) (mul y y-0)))))
+    ((recv (cat (exp (gen) y) y-0)) (send (cat (exp (gen) y) y-0)))
+    ((recv (exp (gen) y))
+      (send
+        (cat (exp (gen) y-0)
+          (enc (enc (exp (gen) y-0) (exp (gen) y) (privk a))
+            (exp (gen) (mul y y-0)))))))
+  (label 143)
+  (parent 140)
+  (seen 129)
+  (unrealized)
+  (comment "1 in cohort - 0 not yet seen"))
+
+(comment "Nothing left to do")