| ar[m3].idx = m0, kar[0, key-index(key, n)][m0] = key-index(key0, m1), kar[m] = key-index(key, n), ar[n, ar[n].idx:= 0][m1] = elemindex(a, m2), kar[m0] = key-index(key1, m3), m0 < # kar, m0 < m, m < # kar, m0 + 1 < # kar, m3 < # ar, ∀ m0. ¬ m < m0 → kar[m0].idx < # ar ∧ ar[kar[m0].idx].idx = m0 ⊦ m1 < # ar ∧ m2 = m0 |
kar[0, key-index(key, n)][ar[m3].idx] = key-index(key0, m1), kar[m] = key-index(key, n), ar[n, ar[n].idx:= 0][m1] = elemindex(a, m2), kar[ar[m3].idx] = key-index(key1, m3), ar[m3].idx < # kar, ar[m3].idx < m, m < # kar, m3 < # ar, ar[m3].idx + 1 < # kar, ∀ m0. ¬ m < m0 → kar[m0].idx < # ar ∧ ar[kar[m0].idx].idx = m0 ⊦ m1 < # ar ∧ m2 = ar[m3].idx
Used simplifier rules: ⊦ m +1 = m + 1; (s)%trans: ⊦ n < n0 ∧ n0 < n1 → n < n1; (forward) from specification nat-basic%lf: ⊦ m < n ∧ n < n0 → m +1 < n0; (forward) from specification nat-basic