| # nσ = ∞, nσ[n] = n2 + 1, n < m, n2 + 1 < nσ[m], stutf(nσ), stutf(nσ) ∧ ⌜m⌝ < # nσ ∧ 2 + n2 ≤ nσ[m] → (∃ m0. m0 ≤ m ∧ nσ[m0] = 2 + n2), ∀ n. nσ[n] ≠ (n2 + 1) + 1, ∀ n0, nσ. n0 < n2 +1 → # nσ = ∞ ∧ stutf(nσ) ∧ (∀ n1. nσ[n1] ≠ n0 + 1) ∧ (∀ m. ∃ m0. m < m0 ∧ nσ[m] < nσ[m0]) → false ⊦ |
# nσ = ∞, nσ[n] = n2 + 1, nσ[m0] = 2 + n2, n < m, n2 + 1 < nσ[m], stutf(nσ), 2 + n2 ≤ nσ[m], m0 ≤ m, ∀ n0. nσ[n0] ≠ 2 + n2, ∀ n0, nσ. n0 < n2 +1 → # nσ = ∞ ∧ stutf(nσ) ∧ (∀ n1. nσ[n1] ≠ n0 + 1) ∧ (∀ m. ∃ m0. m < m0 ∧ nσ[m] < nσ[m0]) → false ⊦
Used simplifier rules: ⊦ ¬ n < n; (s)% ⊦ m + n < m + n0 ↔ n < n0; (s)% ⊦ m +1 = m + 1; (s)%n < n0 ⊦ (* n) ≠ m0 + (* n0); (s)%trans: ⊦ n < n0 ∧ n0 < n1 → n < n1; (forward) from specification nat-basic%lf: ⊦ m < n ∧ n < n0 → m +1 < n0; (forward) from specification nat-basic%f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic% ⊦ m ≤ n ↔ ¬ n < m; (ss)% ⊦ ⌜m⌝ < ∞; (s)%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic