| ∃ s0. s = s0 ++ a ∧ ¬ a ∈ s0, ∀ s0, P. # s0 < # s → true → # s0 = 0 ∨ s0 = ∅ ∨ (λ a. P) ∧_ s0 = P ⊦ # s = 0, (λ a. P) ∧_ s = P |
∀ s1, P. # s1 < #(s0 ++ a) → true → # s1 = 0 ∨ s1 = ∅ ∨ (λ a. P) ∧_ s1 = P ⊦ (P ∧ (λ a. P) ∧_ s0) = P, a ∈ s0
Used simplifier rules: And-ins: ⊦ ¬ a ∈ s → aP ∧_ (s ++ a) = (aP(a) ∧ aP ∧_ s);%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ m + 1 ≠ 0; (s)% ⊦ ¬ a ∈ s → #(s ++ a) = # s + 1; (s)