| x0 = a1 + y, max(ins≤(a, x0)) < a, a0 < a, max(ins≤(a, x0)) < a0, ∀ a. max(ins≤(a, x0)) = a ∨ a < max(x0) ⊦ a0 = a, x0 = [], a < (max(x0) < a0 ⊃ a0;max(x0)), ¬ a1 < a ∧ ordered≤(x0) |
a1 < a, a0 < a, max(a1 ' + ins≤(a, y)) < a0, max(a1 ' + ins≤(a, y)) < a, ∀ a2. max(ins≤(a2, a1 ' + y)) = a2 ∨ a2 < max(a1 ' + y) ⊦ a0 = a, a < (max(a1 ' + y) < a0 ⊃ a0;max(a1 ' + y))
Used simplifier rules: max-ge-first: ⊦ max(a ' + x) < a ↔ false;% ⊦ b < a → ins≤(a, b ' + x) = b + ins≤(a, x); (s)% ⊦ ¬ b < a → ins≤(a, b ' + x) = a + b + x; (s)%transitivity: ⊦ a < b ∧ b < c → a < c; (forward) from specification oelem%a: ⊦ (x + y) + z = x + y + z; from specification list% ⊦ a ' + x ≠ []; (s)% ⊦ a + x = a ' + x; (s)