| ((del-list(to_delete0, m) * P))(H0), ((del-list(to_delete, m + 1) * P))(H) ⊦ [tree_buffer_heap_process_one#(; H0, to_delete0)] (((del-list(to_delete0, m - 1) * P))(H0) ∧ (m = 0 → to_delete0 = [] ∧ P(H0)) → 1 ≤ m → ((del-list(to_delete0, m + 1 - 2) * P))(H0)) |
((del-list(to_delete, m + 1) * P))(H), ((del-list(to_delete0, m) * P))(H0) ⊦ ∀ H0, to_delete0. ((del-list(to_delete0, m - 1) * P))(H0) ∧ (m = 0 → to_delete0 = [] ∧ P(H0)) → 1 ≤ m → ((del-list(to_delete0, m + 1 - 2) * P))(H0)