| a0 ≠ st[a, d].min ⊦ a0 = a, a = st[a, d].min, (a0 ∈ st[a, d] -- st[a, d].min ↔ a0 ∈ st -- st.min) ∧ st[a, d][a0] = (st -- st.min)[a0] |
⊦ a0 = a, a = st[a, d].min, a0 = st[a, d].min, (a0 ∈ st ↔ a0 ∈ st -- st.min) ∧ st[a0] = (st -- st.min)[a0]
Used simplifier rules: At-other: ⊦ a ≠ b → st[b, d][a] = st[a]; from specification store%in-neq: ⊦ a ≠ b → (a ∈ st[b, d] ↔ a ∈ st); from specification store%Del-in: ⊦ a ∈ st -- b ↔ a ≠ b ∧ a ∈ st; from specification store