inv(nσ)[nσ[n]] < n, ⌜n⌝ < # nσ, ⌜nσ[n]⌝ < leninv(nσ), stutf(nσ) ⊦
Used simplifier rules: ⊦ m < n → n ≠ 0; (s)%f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic