Used simplifier rules: Butmin: ⊦ s ≠ ∅ → s.butmin = s -- s.min;% ⊦ s ⊆ s0 -- a ↔ s ⊆ s0 ∧ ¬ a ∈ s; (ws)% ⊦ s ⊆ s0 ∧ ¬ a ∈ s → s ⊆ s0 -- a; (s)