allow CanProve to exit early
Document and test CanProve's once semantics

TestCanProveOnce fails before commit
191f088b10e7a7d02d40370f592f9474c285b379.
Merge branch 'can-prove'