Fundamental axioms and methods of definition:
--
(1) Set Booleans and other decidable stuff, including Singleton: {x} and conditional expressions
'if e1 then a1 elseif e2 then a2... end if'
--
(2) Axiom of choice:  (S = 0 and arb(S) = 0) or (arb(S) in S & arb(S) * S = 0)
--
(3) Axiom of infinity: s_inf /= 0 and (FORALL x in s_inf | {x} in s_inf)
--
(4) Algebraic definition, in the ordinary way, including setformers
--
(5) Recursive definition of f(S,A1,...,An) using predefined h(S,A1,...,An) and g(S,A1,...,An)
--
	f(S,A1,..,An) = g({h(f(t,A1,...,An),A1,...,An): t in S},A1,...,An)
--
(6) Definition of groups of symbols by theory application.
--
    THEORY theory_name(list_of_assumed_symbols);
	assumptions...
    END theory_name;
--
    APPLY(new_symbol:defined_symbol_of_theory,...)
	theory_name(list_of_replacements_for_assumed_symbols)
--
    new_theory_name := Combine(theory_name(list_of_replacements_for_assumed_symbols),...)
--
    sets_of_groups := Combine_all(theory_name,s)
--
A remark concerning the 'Axiom of Replacement'. One formulation of this axiom is: if P(x,y) is a predicate such that (FORALL x in s, y, z | ((P(x,y) & P(x,z)) ¥imp (y = z))) then there is a set t such that (FORALL y | (y in t ¥eq (EXISTS x in s | P(x,y)))). This may be subsumed by the very general way in which we Skolemize and allow setformers to be written. I will try to think through this point.
--
-----------------------------------------------------------------------------
	Catalog of Theorems and Definitions

(1) Theorem 0: [Axiom of Choice] ((S = 0) & (arb(S) = 0)) or ((arb(S) in S) & (arb(S) * S = 0))<P>
(2) Theorem 00: [Axiom of Infinity] (s_inf /= 0) & (FORALL x in s_inf | {x} in s_inf)<P>
(3) Theorem 1: [Choice from singleton] arb({X}) = X<P>
(4) Theorem 2: [Choice from set of 2] (X in Y) ¥imp (arb({Y,X}) = X)<P>
(5) Theorem 3: [Choice from pair] arb([X,Y]) = {X}<P>
(6) Theorem 4: [Choice from special set of 2] arb({X,{X,Y}}) = X<P>
(7) Theorem 5: [Choice from pair, 2] arb(arb([X,Y])) = X<P>
(8) Theorem 6: [cdr choice] arb(arb(arb([X,Y] - {arb([X,Y])}) - {arb([X,Y])})) = Y<P>
(9) Theorem 7: [car of pair] car([X,Y]) = X<P>
(10) Theorem 8: [cdr of pair] cdr([X,Y]) = Y<P>
(11) Theorem 9: [Ordered pair property] (car([X,Y]) = X) & (cdr([X,Y]) = Y)<P>
(12) Theorem 10: [Ordered pair property, 2] [X,Y] = [car([X,Y]),cdr([X,Y])]<P>
(13) Theorem 11: [Pair reconstruction lemma] (U = [A,B]) ¥imp (U = [car(U),cdr(U)])<P>
(14) Theorem if_then_else.1: [commutativity property of if_then_else] f(if p then a else b end if) = if p then f(a) else f(b) end if<P>
(15) Theorem if_then_else2.1: [Conditioned interchange of nested occurrences of if_then_else] if p then if q then a else b end if else c end if = if q then ap else if pp then bp else cp end if end if<P>
(16) Theorem setformer.1: [Equality of setformers] ((x1_thryvar notin s) or ((e(x1_thryvar) = e0(x1_thryvar)) & (P(x1_thryvar) ¥eq PP(x1_thryvar)))) ¥imp							({e(x): x in s | P(x)} = {e0(x): x in s | PP(x)})<P>
(17) Theorem setformer01: [Empty setformer lemma] (s /= 0) ¥imp ({e(x): x in s} /= 0)<P>
(18) Theorem setformer02: [Empty setformer lemma 2] ({x in s | P(x)} /= 0) ¥imp ({e(x): x in s | P(x)} /= 0)<P>
(19)     Theorem setformer2_1: [Equality of mapformers] (((x2_thryvar notin s) or (y2_thryvar notin (f(x2_thryvar) + fp(x2_thryvar)))) or    	(((f(x2_thryvar) = fp(x2_thryvar)) & (e2(x2_thryvar,y2_thryvar) = ep2(x2_thryvar,y2_thryvar)) &    		(R(x2_thryvar,y2_thryvar) ¥eq PQ(x2_thryvar,y2_thryvar))))) ¥imp    			({e2(x,y): x in s, y in f(x) | R(x,y)} = {ep2(x,y): x in s, y in fp(x) | PQ(x,y)})<P>
(20) Theorem comprehension1: [Setformer existence] (X in tt_thryvar) ¥eq ((X in s) & P(X))<P>
(21) Theorem comprehension2: [Setformer inclusion lemma] {x in s | P(x)} ¥incin s<P>
(22) Theorem 12: [Members of ordinals are ordinals] (Ord(S) & (T in S)) ¥imp Ord(T)<P>
(23) Theorem 13: [Ordinal membership implies inclusion] (Ord(S) & (T in S)) ¥imp (T ¥incin S)<P>
(24) Theorem ord_ind1: [Transfinite induction principle] Ord(t_thryvar) & P(t_thryvar) & (t_thryvar ¥incin o) & (FORALL x in t_thryvar | not P(x))<P>
(25) Theorem 14: [Ultimate members lemma] S ¥incin Ult_membs(S)<P>
(26) Theorem 15: [Ultimate members lemma 2] Ult_membs(S) = S + {v: x in S, v in Ult_membs(x)}<P>
(27) Theorem 16: [Key property of ultimate members set] ((X in S) & (Y in X)) ¥imp (Y in Ult_membs(S))<P>
(28) Theorem 17: [An ordinal is its own set of ultimate members] (Ord(S)) ¥imp (Ult_membs(S) = S)<P>
(29) Theorem 18: [Ultimate members of a singleton] Ult_membs({S}) = {S} + Ult_membs(S)<P>
(30) Theorem 19: [Ultimate members of an ordinal singleton] Ord(S) ¥imp (Ult_membs({S}) = S + {S})<P>
(31) Theorem 20: [Ultimate members of the basic infinite set] (X in s_inf) ¥imp (membs_x(S,{X}) = membs_x(S,X) + Un(membs_x(S,X)))<P>
(32) Theorem 21: [Ultimate members lemma 3] (S ¥incin Ult_memb1(S)) & (((X in Ult_memb1(S)) & (Y in X)) ¥imp (Y in Ult_memb1(S)))<P>
(33) Theorem transfinite_induction.1: [Transfinite membership induction] P(mt1_thryvar) & ((K in mt1_thryvar) ¥imp (not P(K)))<P>
(34) Theorem 22: [Monotonicity of ultimate members set] (Y in Ult_membs(S)) ¥imp (Ult_membs(Y) ¥incin Ult_membs(S))<P>
(35) Theorem 23: [Members of ultimate members are also subsets] (Y in Ult_membs(S)) ¥imp (Y ¥incin Ult_membs(S))<P>
(36) Theorem transfinite_member_induction1: [Ultimate members and transfinite induction] P(mt2_thryvar) & (mt2_thryvar in Ult_membs({n})) & ((K in mt2_thryvar) ¥imp (not P(K)))<P>
(37) Theorem 24: [Only the null set has a null domain] (S = 0) ¥eq (domain(S) = 0)<P>
(38) Theorem 25: [Only the null set has a null range] (S = 0) ¥eq (range(S) = 0)<P>
(39) Theorem 26: [Maps are mapformers] Is_map(F) ¥eq (F ¥incin {[car(x),cdr(x)]: x in F})<P>
(40) Theorem iz_map.1: [Mapformers are maps] Is_map({[a(x),b(x)]: x in s}) & (domain({[a(x),b(x)]: x in s}) = {a(x): x in s}) & (range({[a(x),b(x)]: x in s}) = {b(x): x in s})<P>
(41) Theorem iz_map_2.1: [Two-variable mapformers] Is_map({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)})<P>
(42) Theorem iz_map_3.1: [Three-variable mapformers] Is_map({[a3(x,y,yy),b3(x,y,yy)]: x in s, y in t, yy in u | P3(x,y,yy)})<P>
(43) Theorem Svm_test.1: [Single-valuedness test] ((x3_thryvar in s) & (y3_thryvar in s) & (a(x3_thryvar) = a(y3_thryvar)) & (b(x3_thryvar) /= b(y3_thryvar))) or				Svm({[a(x),b(x)]: x in s})<P>
(44) Theorem Svm_test_2.1: [Single-valuedness test, two-variable case] ((x4_thryvar in s) & (y4_thryvar in t) & (xp1_thryvar in s) & (yp1_thryvar in t) &	(a2(x4_thryvar,y4_thryvar) = a2(xp1_thryvar,yp1_thryvar)) & (b2(x4_thryvar,y4_thryvar) /= b2(xp1_thryvar,yp1_thryvar))) or	 		Svm({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)})<P>
(45) Theorem Svm_test_3.1: [Single-valuedness test, three-variable case] ((x5_thryvar in s) & (y5_thryvar in t) & (z1_thryvar in u) & (xp2_thryvar in s) & (yp2_thryvar in t) &	(zp1_thryvar in u) & P3(x5_thryvar,y5_thryvar,z1_thryvar) & P3(xp2_thryvar,yp2_thryvar,zp1_thryvar) &	(a3(x5_thryvar,y5_thryvar,z1_thryvar) = a3(xp2_thryvar,yp2_thryvar,zp1_thryvar))		& (b3(x5_thryvar,y5_thryvar,z1_thryvar) /= b3(xp2_thryvar,yp2_thryvar,zp1_thryvar))) or			Svm({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)})<P>
(46) Theorem one_1_test.1: [One-one map former test] ((x6_thryvar in s) & (y6_thryvar in s) & (((a(x6_thryvar) = a(y6_thryvar)) ¥neq (b(x6_thryvar) = b(y6_thryvar))))) or			 one_1_map({[a(x),b(x)]: x in s})<P>
(47) Theorem one_1_test_2.1: [One-one map former test, two-variable case] ((x7_thryvar in s) & (y7_thryvar in t) & (x2_thryvar in s) & (y2_thryvar in t) &		(not((a2(x7_thryvar,y7_thryvar) = a2(x2_thryvar,y2_thryvar)) ¥eq (b2(x7_thryvar,y7_thryvar) = b2(x2_thryvar,y2_thryvar))))) or			 one_1_map({[a2(x,y),b2(x,y)]: x in s, y in t})<P>
(48) Theorem one_1_test_3.1: [Single-valued map former, three-variable case] ((x8_thryvar in s) & (y8_thryvar in t) & (z2_thryvar in r) &                (xp3_thryvar in s) & (yp3_thryvar in t) & (zp2_thryvar in r) &                P3(x8_thryvar,y8_thryvar,z2_thryvar) & P3(xp3_thryvar,yp3_thryvar,zp2_thryvar) &		(((a3(x8_thryvar,y8_thryvar,z2_thryvar) /= a3(xp3_thryvar,yp3_thryvar,zp2_thryvar)) ¥eq (b3(x8_thryvar,y8_thryvar,z2_thryvar) = b3(xp3_thryvar,yp3_thryvar,zp2_thryvar))))) or			 one_1_map({[a3(x,y,wz),b3(x,y,wz)]: x in s, y in t,wz in r | P3(x,y,wz)})<P>
(49) Theorem 27: [Ordinal comparison lemma] (Ord(S) & Ord(T) & (T ¥incin S)) ¥imp ((T = S) or (T = arb(S - T)))<P>
(50) Theorem 28: [Ordinal intersection] (Ord(S) & Ord(T)) ¥imp Ord(S * T)<P>
(51) Theorem 29: [Second ordinal comparison lemma] (Ord(S) & Ord(T)) ¥imp ((S ¥incin T) or (T ¥incin S))<P>
(52) Theorem 30: [Ordinal maximum and minimum] (Ord(S) & Ord(T)) ¥imp (Ord(S + T) & Ord(S * T))<P>
(53) Theorem 31: [Ordinal membership comparison] (Ord(S) & Ord(T)) ¥imp ((S in T) or (T in S) or (S = T))<P>
(54) Theorem 32: [Successor ordinal] Ord(S) ¥imp Ord(next(S))<P>
(55) Theorem 33: [Successor ordinal 2] Ord(S) ¥imp Ord(S + {S})<P>
(56) Theorem 34: [Third ordinal comparison lemma] (Ord(S) & Ord(T)) ¥imp ((T ¥incin S) ¥eq ((T in S) or (T = S)))<P>
(57) Theorem 35: [Ordinal membership and comparison] (Ord(S) & Ord(T)) ¥imp ((T notin S) ¥eq (S ¥incin T))<P>
(58) Theorem 36: [Membership in the successor of an ordinal $s$] Ord(S) ¥imp ((T in next(S)) ¥eq ((T ¥incin S) & Ord(T)))<P>
(59) Theorem 37: [Membership of $s$ in an ordinal $t$ implies inclusion of $next(s)$ in $t$] (Ord(T) & (S in T)) ¥imp (next(S) ¥incin T)<P>
(60) Theorem 38: [The class of all sets is not a set] not(EXISTS x | (FORALL y | y in x))<P>
(61) Theorem 39: [There is no antinomic Russell's set] not(EXISTS x | (FORALL y | (y in x) ¥eq (y notin y)))<P>
(62) Theorem 40: [The class of ordinals is not a set]    not (FORALL x | ((x in OS) ¥eq Ord(x)))<P>
(63) Theorem 41: [Enumerability principle] ((Ord(X) & S in {enum(y,S): y in X})) ¥imp (S ¥incin {enum(y,S): y in X})<P>
(64) Theorem 42: [Enumeration membership lemma] (enum(X,S) = S) or (enum(X,S) in S)<P>
(65) Theorem 43: [Enumeration inclusion lemma] ((enum(X,S) = S) & (Y incs X)) ¥imp (enum(Y,S) = S)<P>
(66) Theorem 44: [The enumeration of a set is 1-1]    (Ord(X) & Ord(W) & (X /= W)) ¥imp	((S in {enum(u,S): u in X}) or (S in {enum(u,S): u in W}) or (enum(X,S) /= enum(W,S)))<P>
(67) Theorem 45: [Enumeration lemma] (EXISTS x | (Ord(x) & (S in {enum(y,S): y in x})))<P>
(68) Theorem 46: [Main enumeration theorem]    (EXISTS x | Ord(x) & (S = {enum(y,S): y in x}) &	(FORALL y in x, z0 in x | ((y /= z0) ¥imp (enum(y,S) /= enum(z0,S)))))<P>
(68+) Theorem 47: [Enumeration single-valuedness principle] (FORALL s | (Ord(enum_Ord(s)) & (s = {enum(y,s): y in enum_Ord(s)}) &		(FORALL y in enum_Ord(s), z0 in enum_Ord(s) | ((y /= z0) ¥imp (enum(y,s) /= enum(z0,s))))))<P>
(69) Theorem 48: [Map restriction lemma] (F ¥ON A) ¥incin F<P>
(70) Theorem 49: [Set intersection formula] S * T = {x in S | x in T}<P>
(71) Theorem 50: [Set difference formula] S - T = {x in S | x notin T}<P>
(72) Theorem 51: [Map members are pairs] (Is_map(F) ¥imp ((X in F) ¥imp (X = [car(X),cdr(X)]))) &		((FORALL x in F | x = [car(x),cdr(x)]) ¥imp Is_map(F))<P>
(73) Theorem 52: [Map subsets are maps] (G ¥incin F & Is_map(F)) ¥imp Is_map(G)<P>
(74) Theorem 53: [Single-valued map subsets are single-valued] ((G ¥incin F) & Svm(F)) ¥imp Svm(G)<P>
(75) Theorem 54: [One-one map subsets are one-one] ((G ¥incin F) & one_1_map(F)) ¥imp one_1_map(G)<P>
(76) Theorem 55: [Map compositions are maps] Is_map(F @ G)<P>
(77) Theorem 56: [Map restrictions are maps] Is_map(F) ¥imp Is_map(F ¥ON S)<P>
(78) Theorem 57: [Restrictions of single-valed maps are single-valued] Svm(F) ¥imp Svm(F ¥ON S)<P>
(79) Theorem 58: [Restrictions of one-one maps are one-one] one_1_map(F) ¥imp one_1_map(F ¥ON S)<P>
(80) Theorem 59: [The null set as a map] Is_map(0) & Svm(0) & (one_1_map(0)) & (range(0) = 0) & (domain(0) = 0)<P>
(81) Theorem 60: [Domain membership lemma] (X in F) ¥imp (car(X) in domain(F))<P>
(82) Theorem 61: [Range membership lemma] (X in F) ¥imp (cdr(X) in range(F))<P>
(83) Theorem 62: [Map unions are maps] (Is_map(F) & Is_map(G)) ¥imp Is_map(F + G)<P>
(84) Theorem 63: [Map restriction is additive] F ¥ON (A + B) = (F ¥ON A) + (F ¥ON B)<P>
(85) Theorem 64: [Restriction of union maps] (F + G) ¥ON A = (F ¥ON A) + (G ¥ON A)<P>
(86) Theorem 65: [Monotonicity of range and domain sets] (F ¥incin G) ¥imp ((range(F) ¥incin range(G)) & (domain(F) ¥incin domain(G)))<P>
(87) Theorem 66: [Associativity of map multiplication] F @ (G @ H) = (F @ G) @ H<P>
(88) Theorem 67: [Restriction of a map to its own domain] F ¥ON domain(F) = F<P>
(89) Theorem 68: [Restriction to an intersection set] F ¥ON (domain(F) * T) = F ¥ON T<P>
(90) Theorem 69: [Double restriction] F ¥ON (S * T) = (F ¥ON S) ¥ON T<P>
(91) Theorem 70: [Null restriction] F ¥ON 0 = 0<P>
(92) Theorem 71: [Map image elements belong to the map range] (X in domain(F)) ¥imp ((F~[X]) in range(F))<P>
(93) Theorem fcn_symbol.1: [Mapformer domain] domain(g) = s<P>
(94) Theorem fcn_symbol.2: [Image by a mapformer] (XX in s) ¥imp (g~[XX] = f(XX))<P>
(95) Theorem fcn_symbol.2a: [Image by a mapformer, quantified form] (FORALL x in s | g~[x] = f(x))<P>
(96) Theorem fcn_symbol.3: [Elements not in a mapformer domain] (XX notin s) ¥imp (g~[XX] = 0)<P>
(97) Theorem fcn_symbol.4: [Mapformer image in general] g~[XX] = if XX in s then f(XX) else 0 end if<P>
(98) Theorem fcn_symbol.4a: [Image by a mapformer, quantified form] (FORALL x | g~[x] = if x in s then f(x) else 0 end if)<P>
(99) Theorem fcn_symbol.5: [Range of a mapformer] range(g) = {f(xx) : xx in s}<P>
(100) Theorem fcn_symbol.6: [Mapformer one-to-oneness test] ((x9_thryvar in s) & (y9_thryvar in s) & (f(x9_thryvar) = f(y9_thryvar)) & (x9_thryvar /= y9_thryvar)) or					 one_1_map(g)<P>
(101)  Theorem fcn_symbol.7: [?] Svm(g)<P>
(102) Theorem 72: [Form of a single-valued map] Svm(F) ¥eq (F = {[x,F~[x]]: x in domain(F)})<P>
(103) Theorem 73: [Form of a single-valued map range] Svm(F) ¥imp (F = {[x,F~[x]]: x in domain(F)} & (range(F) = {F~[x]: x in domain(F)}))<P>
(104) Theorem 74: [Map image formula] (Svm(F) & (X in F)) ¥imp (F~[car(X)] = cdr(X))<P>
(105)  Theorem 75: (X in domain(F)) ¥imp (F~[X] in range(F))<P>
(106) Theorem 76: [Map members are pairs, 2] (Is_map(F) & (U in F)) ¥imp (U = [car(U),cdr(U)])<P>
(107) Theorem 77: [Map domain member lemma] Is_map(F) ¥imp ((X in domain(F)) ¥eq ([X,F~[X]] in F))<P>
(108) Theorem Must_be_svm.1: [Single-valued map former] Svm({[x,b(x)]: x in s}) & (domain({[x,b(x)]: x in s}) = s) & (range({[x,b(x)]: x in s}) = {b(x): x in s}) & ((u in s) ¥imp ({[x,b(x)]: x in s}~[u] = b(u)))<P>
(109) Theorem Must_be_svm_2.1: [Single-valued map former, two-variable case] Svm({[[x,y],b2(x,y)]: x in s, y in t | P2(x,y)})<P>
(110) Theorem 78: [Map domains are additive] domain(F + G) = domain(F) + domain(G)<P>
(111) Theorem 79: [Map ranges are additive] range(F + G) = range(F) + range(G)<P>
(112) Theorem 80: [Range of a restriction map] range(F ¥ON S) ¥incin range(F)<P>
(113) Theorem 81: [Range of restriction to a union] range(F ¥ON (S + T)) = range(F ¥ON S) + range(F ¥ON T)<P>
(114) Theorem 82: [Restriction to a subset] (S incs T) ¥imp (range(F ¥ON S) incs range(F ¥ON T))<P>
(115) Theorem 83: [One-one map-restriction to an intersection] one_1_map(F) ¥imp (range(F ¥ON (S * T)) = range(F ¥ON S) * range(F ¥ON T))<P>
(116) Theorem 84: [Restriction to the null set] ((F ¥ON 0) = 0) & (range(F ¥ON 0) = 0)<P>
(117) Theorem 85: [One-one map restriction to disjoint sets] (one_1_map(F) & (S * T = 0)) ¥imp (range(F ¥ON S) * range(F ¥ON T) = 0)<P>
(118) Theorem 86: [Domain is null only when range is null] (domain(F) = 0) ¥eq (range(F) = 0)<P>
(119) Theorem 87: [Union of single-valued maps] (Svm(F) & Svm(G) & (domain(F) * domain(G) = 0)) ¥imp Svm(F + G)<P>
(120) Theorem 88: [Union of 1-1 maps]    (one_1_map(F) & one_1_map(G) & (range(F) * range(G) = 0) & (domain(F) * domain(G) = 0)) ¥imp one_1_map(F + G)<P>
(121) Theorem 89: [Union of 1-1 maps, 2] (one_1_map(F + G) & ((G * F) = 0)) ¥imp ((domain(G) = (domain(F + G) - domain(F))) & (range(G) = (range(F + G) - range(F))))<P>
(122) Theorem 90: [Members of the inverse map] Is_map(F) ¥imp (([X,Y] in F) ¥eq ([Y,X] in inv(F)))<P>
(123) Theorem 91: [Singletons as maps] Svm({[X,Y]}) & one_1_map({[X,Y]}) & (({[X,Y]}~[X]) = Y)<P>
(124) Theorem 92: [Doubletons as maps] Is_map({[X,Y],[Z,W]}) & (domain({[X,Y],[Z,W]}) = {X,Z}) & (range({[X,Y],[Z,W]}) = {Y,W}) &	((X /= Z) ¥imp Svm({[X,Y],[Z,W]}))<P>
(125) Theorem 93: [Doubletons as maps, 2] (X /= Z) ¥imp ({[X,Y],[Z,W]}~[X] = Y)<P>
(126) Theorem 94: [Domain of restriction] domain(F ¥ON S) = domain(F) * S<P>
(127) Theorem 95: [Range and domain of map product] (range(F @ G) = range(F ¥ON range(G))) & ((range(G) ¥incin domain(F)) ¥imp (domain(F @ G) = domain(G)))<P>
(128) Theorem 96: [Range and domain of map product, 2] (range(G) = domain(F)) ¥imp ((range(F @ G) = range(F)) & (domain(F @ G) = domain(G)))<P>
(129) Theorem 97: [Range and domain of map product, 3] (range(G) ¥incin domain(F)) ¥imp ((range(F @ G) ¥incin range(F)) & (domain(F @ G) = domain(G)))<P>
(130) Theorem 98: [Range of restriction of one-one map] (one_1_map(F) & (S ¥incin domain(F)) & (S /= domain(F))) ¥imp	((range(F ¥ON S) ¥incin range(F)) & (range(F ¥ON S) /= range(F)))<P>
(131) Theorem 99: [Inverse map basic properties] Is_map(inv(F)) & range(inv(F)) = domain(F) & domain(inv(F)) = range(F)<P>
(132) Theorem 100: [Double inverse map] Is_map(F) ¥imp (F = inv(inv(F)))<P>
(133) Theorem 101: [Inverse of a one-one map]    one_1_map(F) ¥imp (one_1_map(inv(F)) & (F = inv(inv(F))) & (range(inv(F)) = domain(F)) & (domain(inv(F)) = range(F)))<P>
(134) Theorem 102: [Inverse image of an element] (one_1_map(F) & (X in domain(F))) ¥imp (inv(F)~[F~[X]] = X)<P>
(135) Theorem 103: [Inverse image of an element's map image] one_1_map(F) ¥imp	(((X in domain(F)) ¥imp (inv(F)~[F~[X]] = X)) & ((X in range(F)) ¥imp (F~[inv(F)~[X]] = X)))<P>
(136) Theorem setformer_unravel1: {x: y in {e(f): f in s}, x in g(y)} = {x: f in s, x in g(e(f))}<P>
(137) Theorem 104: [binary intersection distributes over monadic union]	Un(F) * X = Un({y * X : y in F})<P>
(138) Theorem 105: [membership in unionset] (X in Un(Y)) ¥eq ({v in Y | X in v} /= 0)<P>
(139) Theorem 106: [Union set of a doubleton] Un({X,Y}) = (X + Y)<P>
(140) Theorem 107: [Union set of a singleton] Un({X}) = X<P>
(141) Theorem 108: [Recursive relationship for the union set] (Un(0) = 0) & ((X in M) ¥imp (Un(M) = (X + Un(M - {X}))))<P>
(142) Theorem 109: [Recursive relationship for the union set, 2] (Un(0) = 0) & ((M /= 0) ¥imp (Un(M) = (arb(M) + Un(M - {arb(M)}))))<P>
(143) Theorem unionset_commuter1: [Set separation and unionset formation commute] {e(x): x in Un(s)} = Un({{e(x): x in f}: f in s})<P>
(144) Theorem unionset_commuter2: [Set formation and set enumeration commute] {e(x): x in s} = Un({{e(x)}: x in s})<P>
(145) Theorem unionset_commuter3: [setformers whose iteration variable is bounded by 0 designate 0] {e(x): x in 0} = 0<P>
(146) Theorem unionset_commuter4: [setformers whose iteration variable is bounded by a doubleton designate doubletons] {e(x): x in {s,T}} = {e(s),e(T)}<P>
(147) Theorem unionset_commuter5: [setformers whose iteration variable is bounded by a singleton designate singletons] {e(x): x in {s}} = {e(s)}<P>
(148) Theorem unionset_commuter6: [split of setformer over union-bounded iterator] {e(x): x in (s + T)} = {e(x): x in s} + {e(x): x in T}<P>
(149) Theorem 110: [Map inversion and unionset formation commute] inv(Un(S)) = Un({inv(f): f in S})<P>
(150) Theorem 111: [Map inversion and the union operation commute] inv(X + Y) = inv(X) + inv(Y)<P>
(151) Theorem 112: [Range formation and unionset formation commute] range(Un(S)) = Un({range(f): f in S})<P>
(152) Theorem 113: [Domain formation and unionset formation commute] domain(Un(S)) = Un({domain(f): f in S})<P>
(153) Theorem 114: [Domain and range of singleton and doubleton maps] (domain({[X,Y]}) = {X}) & (range({[X,Y]}) = {Y}) & (domain({[X,Y],[U,V]}) = {X,U}) & (range({[X,Y],[U,V]}) = {Y,V})<P>
(154) Theorem 115: [Elementary properties of identity maps]	one_1_map(ident(S)) & (domain(ident(S)) = S) & (range(ident(S)) = S) & (inv(ident(S)) = ident(S)) &	 ((X in S) ¥imp (ident(S)~[X] = X)) &	(Is_map(F) ¥imp (((domain(F) ¥incin S) ¥imp (F @ ident(S) = F)) & ((range(F) ¥incin S) ¥imp (ident(S) @ F = F))))<P>
(155) Theorem 116: [Composition with an identity map is restriction] (Is_map(F)) ¥imp (F @ ident(S) = F ¥ON S)<P>
(156) Theorem 117: [Composition with the inverse map] Svm(F) ¥imp (F @ inv(F) = ident(range(F)))<P>
(157) Theorem 118: [Inverses of one-one maps] one_1_map(F) ¥imp (((F @ inv(F)) = ident(range(F))) & ((inv(F) @ F) = ident(domain(F))))<P>
(158) Theorem 119: [Product of inverses lemma]	(Is_map(F) & Is_map(G) & (domain(F) ¥incin range(G)) & Svm(F @ G)) ¥imp Svm(F)<P>
(159) Theorem 120: [Product of Inverses] (Is_map(F) & Is_map(G)) ¥imp (inv(F @ G) = inv(G) @ inv(F))<P>
(160) Theorem 121: [One-one-ness and singlevaluedness] one_1_map(F) ¥eq (Svm(F) & Svm(inv(F)))<P>
(161) Theorem 122: [An inverse pair of maps must be 1-1 and must be each other's inverses]    (Is_map(F) & Is_map(G) & (domain(F) = range(G)) & (range(F) = domain(G)) &	(F @ G = ident(range(F))) & (G @ F = ident(domain(F)))) ¥imp (one_1_map(F) & (G = inv(F)))<P>
(162) Theorem 123: [Single-valued map restrictions as setformers] Svm(F) ¥imp (((F ¥ON S) = {[x,F~[x]]: x in domain(F) | x in S}) &	(domain(F ¥ON S) = {x: x in domain(F) | x in S}) &	(range(F ¥ON S) = {F~[x]: x in domain(F) | x in S}))<P>
(163) Theorem 124: [Image of a non-domain element] (X notin domain(F)) ¥imp ((F~[X]) = 0)<P>
(164) Theorem 125: [Value of a restriction map] (F ¥ON S)~[X] = if X in domain(F ¥ON S) then F~[X] else 0 end if<P>
(165) Theorem 126: [Single-valued map restrictions as setformers, 2] Svm(F) ¥imp (((F ¥ON S) = {[x,F~[x]]: x in domain(F ¥ON S)}) &	(range(F ¥ON S) = {F~[x]: x in domain(F ¥ON S)}))<P>
(166) Theorem 127: [Images under one-one maps] (one_1_map(F) & (X in domain(F)) & (Y in domain(F)) & (F~[X] = F~[Y])) ¥imp (X = Y)<P>
(167) Theorem 128: [Composition of single-valued maps] (Svm(F) & Svm(G)) ¥imp Svm(F @ G)<P>
(168) Theorem 129: [Images under single-valued map composition] (Svm(F) & Svm(G) & (X in domain(G)) & (range(G) ¥incin domain(F))) ¥imp ((F @ G)~[X] = F~[G~[X]])<P>
(169) Theorem 130: [Single-valued map ranges and domains as set formers] (Svm(F) & Svm(G) & (X in domain(G)) & (range(G) ¥incin domain(F))) ¥imp	(((F @ G)~[X] = F~[G~[X]]) & (F @ G = {[x,F~[G~[x]]]: x in domain(G)}) & (range(F @ G) = {F~[G~[x]]: x in domain(G)}))<P>
(170) Theorem 131: [Image under single-valued map] (Svm(F) & (G ¥incin F) & (X in domain(G))) ¥imp (F~[X]=G~[X])<P>
(171) Theorem 132: [Single-valued and one-one maps] Is_map(F) ¥imp (one_1_map(F) ¥eq one_1_map(inv(F)))<P>
(172) Theorem 133: [Composition of one-one maps] (one_1_map(F) & one_1_map(G)) ¥imp one_1_map(F @ G)<P>
(173) Theorem 134: [Elements are defined uniquely by their one-one images] Svm(F) ¥imp (one_1_map(F) ¥eq	(FORALL x in domain(F), y in domain(F) | ((F~[x] = F~[y]) ¥imp (x = y))))<P>
(174) Theorem 135: [A 1-1 map on a set $u$ induces a 1-1 map on the power set of $u$]    (one_1_map(F) & (S ¥incin domain(F)) & (T ¥incin domain(F)) & (S /= T)) ¥imp    			(range(F ¥ON S) /= range(F ¥ON T))<P>
(175) Theorem 136: [Union of map composition] (F + FF) @ G = (F @ G) + (FF @ G)<P>
(176) Theorem 137: [Union of map composition, 2] G @ (F + FF) = (G @ F) + (G @ FF)<P>
(177) Theorem 138: [Single-valued maps have 1-1 partial inverses]    Svm(F) ¥imp (EXISTS h | ((domain(h) = range(F)) & (range(h) ¥incin domain(F)) & one_1_map(h)) &	(FORALL x in range(F) | (F~[h~[x]] = x)))<P>
(178) Theorem 139: [Cartesian product with a null set] (N ¥PROD 0 = 0) & (0 ¥PROD N = 0)<P>
(179) Theorem 140: [Members of Cartesian products] (X in (S ¥PROD T)) ¥imp ((car(X) in S) & (cdr(X) in T))<P>
(180) Theorem 141: [Subsets of Cartesian products] (Y ¥incin (S ¥PROD T)) ¥eq (Is_map(Y) & (domain(Y) ¥incin S) & (range(Y) ¥incin T))<P>
(181) Theorem 142: [Image of Cartesian product by a singleton] (U in Z) ¥imp (((Z ¥PROD {V})~[U]) = V)<P>
(182) Theorem 143: [Cartesian product disjointness] (A * B = 0) ¥imp ((X ¥PROD A) * (Y ¥PROD B) = 0)<P>
(183) Theorem 144: [Cartesian modified associativity] (F = {[[[x,y],z],[x,[y,z]]]: x in A, y in B, z in C}) ¥imp	(one_1_map(F) & (domain(F) = ((A ¥PROD B) ¥PROD C)) & (range(F) = (A ¥PROD (B ¥PROD C))))<P>
(184) Theorem 145: [Cartesian modified commutativity] (F = {[[x,y],[y,x]]: x in A, y in B}) ¥imp			(one_1_map(F) & (domain(F) = (A ¥PROD B)) & (range(F) = (B ¥PROD A)))<P>
(185) Theorem 146: [Enumeration of an ordinal] (Ord(S) & X in S) ¥imp (enum(X,S) = X)<P>
(186) Theorem 147: [Cardinality lemma] Ord(#S) & (EXISTS f in OM | (one_1_map(f) & (range(f) = S) & (domain(f) = #S))) &	(not((EXISTS o in #S | (EXISTS g in OM | one_1_map(g) & (range(g) = S) & (domain(g) = o)))))<P>
(187) Theorem 148: [Cardinality minimum theorem] S notin #S<P>
(188) Theorem 149: ['arb' is monotone decreasing for non-empty sets of ordinals]    (Ord(R) & (R incs S) & (S incs T)) ¥imp (arb(S) in arb(T) or arb(S) = arb(T) or T = 0)<P>
(189) Theorem 150: [Axiom of choice variant] ((S /= 0) & (FORALL x in S | Ord(x))) ¥imp (FORALL x in S | x incs arb(S))<P>
(190) Theorem 151: [Lemma for ordinal enumeration]	(Ord(S) & (T ¥incin S) & (X in S) & (Y in X)) ¥imp (enum(Y,T) in enum(X,T) or enum(X,T) incs T)<P>
(191) Theorem 152: [Subsets of an ordinal enumerate at least as rapidly as the ordinal]	(Ord(S) & (T ¥incin S) & (X in S)) ¥imp (enum(X,T) incs X or enum(X,T) incs T)<P>
(192) Theorem 153: [Subset enumeration lemma] (Ord(S) & (T ¥incin S)) ¥imp ({enum(x,T): x in S} incs T)<P>
(193) Theorem 154: [Second subset enumeration lemma] (Ord(S) & (T ¥incin S)) ¥imp (EXISTS x ¥incin S | (Ord(x) & (T = {enum(y,T): y in x}) &	(FORALL y in x, z in x | ((y /= z) ¥imp (enum(y,T) /= enum(z,T))))))<P>
(194) Theorem 155: [Enumerability lemma] (Ord(S) & (T ¥incin S)) ¥imp	(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (domain(f) ¥incin S) & (range(f) = T))<P>
(195) Theorem 156: [Cardinality theorem] Card(#S) & Ord(#S) & (EXISTS f in OM | one_1_map(f) & (range(f) = S) & (domain(f) = #S))<P>
(196) Theorem 157: [One-one maps are cardinality preserving] one_1_map(F) ¥imp (#range(F) = #domain(F))<P>
(197) Theorem 158: [Equicardinality is equivalent to one-one correspondence] (EXISTS F in OM | (one_1_map(F) & (range(F) = S) & (domain(F) = T))) ¥eq (#S = #T)<P>
(198) Theorem 159: [The enumerating ordinal of a set has the same cardinality as the set]    (EXISTS o | Ord(o) & (S = {enum(x,S): x in o}) & (#o = #S))<P>
(199) Theorem 160: [Associative Law for Cardinals] #((A ¥PROD B) ¥PROD C) = #(A ¥PROD (B ¥PROD C))<P>
(200) Theorem 161: [Commutative Law for Cardinals] #(A ¥PROD B) = #(B ¥PROD A)<P>
(201) Theorem 162: [Sets of cardinality 0 must be null] (#S = 0) ¥eq (S = 0)<P>
(202) Theorem 163: [Non-null sets have cardinality greater than 0] (0 in #S) ¥eq (S /= 0)<P>
(203) Theorem 164: [A cardinal is its own cardinality] Card(S) ¥eq (S = #S)<P>
(204) Theorem 165: [Uniqueness of Cardinality]	(Card(C) & (EXISTS f in OM | (one_1_map(f) & (range(f) = S) & domain(f) = C))) ¥imp (C = #S)<P>
(205) Theorem 166: [The cardinality operator is idempotent] #S = ##S<P>
(206) Theorem 167: [All cardinals are comparable] (#S in #T) or (#S = #T) or (#T in #S)<P>
(207) Theorem 168: [Cardinal comparison is transitive] ((#S in #T) & (#T in #R)) ¥imp (#S in #R)<P>
(208) Theorem 169: [Subsets of an ordinal have a cardinality that is no larger than the ordinal]    (Ord(S) & (T ¥incin S)) ¥imp (#T ¥incin S)<P>
(209) Theorem 170: [Subset cardinality theorem] (T ¥incin S) ¥imp (#T ¥incin #S)<P>
(210) Theorem 171: [Single-valued mapping cannot increase cardinality] Svm(F) ¥imp (#range(F) ¥incin #domain(F))<P>
(211) Theorem 172: [The cardinality of a map is no smaller than the cardinality of its domain] #domain(F) ¥incin #F<P>
(212) Theorem 173: [The cardinality of a map is no smaller than the cardinality of its range] #range(F) ¥incin #F<P>
(213) Theorem 174: [The cardinality of a single-valued map equals the cardinality of its domain] Svm(F) ¥imp (#domain(F) = #F)<P>
(214) Theorem 175: [Cardinality of restriction maps] (Svm(F) & (domain(F) incs A)) ¥imp (#(F ¥ON A) = #A)<P>
(215) Theorem fcn_symbol1: [Cardinality of mapformers and range formers] (#{[xx,f(xx)]: xx in s} = #s) & (#{f(xx): xx in s} ¥incin #s)<P>
(216) Theorem 176: [Condition for existence of a single-valued map between two sets] (#S incs #T) ¥eq (T = 0 or (EXISTS f in OM | Svm(f) & (domain(f) = S) & (range(f) = T)))<P>
(217) Theorem 177: [Domains and ranges of inverse] domain(G) = (G ¥INV_IM R) + (G ¥INV_IM (range(G) - R))<P>
(218) Theorem 178: [Range-decomposition of a map domain] ((S * R = 0) & Svm(G)) ¥imp (((G ¥INV_IM S) * (G ¥INV_IM R)) = 0)<P>
(219) Theorem 179: [Inverse image of a range element] (Y in range(G)) ¥imp ((G ¥INV_IM {Y}) /= 0)<P>
(220) Theorem 180: [Range of a restricted inverse map] G ¥INV_IM R = range(inv(G) ¥ON R)<P>
(221) Theorem 181: [Single-valued inverse image as a setformer] Svm(inv(G)) ¥imp (G ¥INV_IM R = {inv(G)~[w]: w in (R * range(G))})<P>
(222) Theorem 182: [Inverse image of a range element] (one_1_map(G) & (Y in range(G))) ¥imp (G ¥INV_IM {Y} = {inv(G)~[Y]})<P>
(223) Theorem 183: [Range of a map restricted to an inverse image] range(G ¥ON (G ¥INV_IM R)) incs (range(G) * R)<P>
(224) Theorem 184: [Range of a single-valued map restricted to an inverse image] Svm(G) ¥imp (range(G ¥ON (G ¥INV_IM A)) = range(G) * A)<P>
(225) Theorem 185: [Inverse images by a single-valued map] Svm(G) ¥imp ((G ¥ON (G ¥INV_IM A)) ¥INV_IM B = (G ¥INV_IM A) * (G ¥INV_IM B))<P>
(226) Theorem 186: [Monotonicity of inverse image] (B ¥incin A) ¥imp ((G ¥INV_IM B) ¥incin (G ¥INV_IM A))<P>
(227) Theorem 187: [Successive map restrictions] (((F ¥ON A) ¥ON B) = (F ¥ON (A * B)))<P>
(228) Theorem 188: [0 is a finite cardinal] Ord(0) & Finite(0) & Card(0)<P>
(229) Theorem 189: [A subset of a finite set is finite] (Finite(S) & (S incs T)) ¥imp Finite(T)<P>
(230) Theorem 190: [One-one maps preserve finiteness] one_1_map(F) ¥imp ((Finite(domain(F))) ¥imp (Finite(range(F))))<P>
(231) Theorem 191: [One-one maps preserve finiteness, 2] one_1_map(F) ¥imp (Finite(domain(F)) ¥eq Finite(range(F)))<P>
(232) Theorem 192: [A single-valued map with finite domain has a finite range]	(Svm(F) & Finite(domain(F))) ¥imp Finite(range(F))<P>
(233) Theorem finite_image.1: [Any image of a finite set is finite] Finite({e(x): x in s0})<P>
(234) Theorem 193: [A set is finite if and only if its cardinality is finite] Finite(S) ¥eq Finite(#S)<P>
(235) Theorem 194: [Proper subsets of a finite set have fewer elements] (Finite(S) & (T ¥incin S) & (T /= S)) ¥imp (#T in #S)<P>
(236) Theorem 195: [A set is finite if and only if it is not the single-valued image of any of its finite subsets] Finite(S) ¥eq	(not(EXISTS f in OM | (Svm(f) & (range(f) = S) & (domain(f) ¥incin S) & (S /= domain(f)))))<P>
(237) Theorem 196: [Members of a finite ordinal are finite] (Ord(S) & Finite(S) & (T in S)) ¥imp Finite(T)<P>
(238) Theorem 197: [Any infinite ordinal is larger than any finite ordinal]	(Ord(S) & Ord(T) & (not Finite(S)) & Finite(T)) ¥imp (T in S)<P>
(239) Theorem 198: [Interchange lemma]    ((X in S) & (Y in S)) ¥imp (EXISTS f | one_1_map(f) & (range(f) = S) & (domain(f) = S) & ((f~[X]) = Y) & ((f~[Y]) = X))<P>
(240) Theorem 199: [Adding one element to a finite set leaves it finite] Finite(S) ¥eq Finite(S + {X})<P>
(241) Theorem 200: [Finiteness of successor set] Finite(S) ¥imp Finite(next(S))<P>
(242) Theorem 201: [Singletons are finite] Finite({S})<P>
(243) Theorem 202: [Doubletons are finite] Finite({S,T})<P>
(244) Theorem 203: [The basic infinite set is not finite] not(Finite(s_inf))<P>
(245) Theorem 204: [Infinite cardinality theorem] not Finite(#s_inf)<P>
(246) Theorem 205: [All finite ordinals are cardinals] (Ord(X) & Finite(X)) ¥imp Card(X)<P>
(247) Theorem setformer_meet_join.1: [Disjunction in a setformer] {h(u,v): u in s, v in t | R(u,v) or Q(u,v)} = ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)})<P>
(248) Theorem setformer_meet_join.2: [Conjunction in a setformer] {h(u,v): u in s, v in t | R(u,v) & Q(u,v)} ¥incin ({h(u,v): u in s, v in t | R(u,v)} * {h(u,v): u in s, v in t | Q(u,v)})<P>
(249) Theorem setformer_meet_join.3: [Implication in a setformer] (FORALL u in s, v in t | Q(u,v) ¥imp R(u,v)) ¥imp ({h(u,v): u in s, v in t | Q(u,v)} ¥incin {h(u,v): u in s, v in t | R(u,v)})<P>
(250) Theorem setformer_meet_join.4: [Setformer cardinality inclusion, two-variable case] #{[u,v]: u in s, v in t | R(u,v)} incs #{h(u,v): u in s, v in t | R(u,v)}<P>
(251) Theorem setformer_meet_join.5: [Setformer finiteness implication, two-variable case] Finite({[u,v]: u in s, v in t | R(u,v)}) ¥imp Finite({h(u,v): u in s, v in t | R(u,v)})<P>
(252) Theorem 206: [The set of integers is an infinite ordinal consisting of all finite ordinals] Ord(Za) & (not Finite(Za)) & ((Card(X) & Finite(X)) ¥eq (X in Za))<P>
(253) Theorem 207: [All integers are finite ordinals and cardinals] (X in Za) ¥imp ((X = #X) & Card(X) & Ord(X) & Finite(X))<P>
(254) Theorem 208: [Transitivity of integer comparison] ((M in Za) & (N in Za) & (I in N)) ¥imp ((M in N) or (I in M))<P>
(255) Theorem 209: [The set of integers is a Cardinal] Card(Za)<P>
(256) Theorem 210: [The successor of an integer is an integer] (I in Za) ¥imp (Card(next(I)) & (next(I) in Za))<P>
(257) Theorem 211: [The first few integers are all cardinals] Ord(0) & (0 in Za) & (1 in Za) & (2 in Za) & (3 in Za) & Card(0) & Card(1) & Card(2) & Card(3)<P>
(258) Theorem 212: [The first few integers are all distinct] (0 in Za) & (1 in Za) & (2 in Za) & (3 in Za) & (1 /= 0) & (2 /= 0) & (3 /= 0) & (1 /= 2) & (1 /= 3) & (2 /= 3)<P>
(259) Theorem 213: [Powerset of the null set] pow(0) = {0}<P>
(260) Theorem 214: [Membership, singleton, and powerset] (X in L) ¥eq ({X} in pow(L))<P>
(261) Theorem 215: [Singleton and powerset] ({0,X} ¥incin pow(X)) & ((X = {Y}) ¥imp (pow(X) = {0,X}))<P>
(262) Theorem 216: [Disjointness of simple Cartesian products] {[x,0]: x in N} * {[x,1]: x in M} = 0<P>
(263) Theorem 217: [First Disjoint sum lemma] ((N * M = 0) & (K * J = 0) & (#N = #K) & (#M = #J)) ¥imp			(#(N + M) = #(K + J))<P>
(264) Theorem 218: [Cardinality of Cartesian product by a singleton] (#{[x,A]: x in M} = #M)<P>
(265) Theorem 219: [Monotonicity of arithmetic addition] ((N incs N1) and (M incs M1)) ¥imp (N ¥PLUS M incs N1 ¥PLUS M1)<P>
(266) Theorem 220: [Disjoint sum lemma] (N * M = 0) ¥imp (N ¥PLUS M = #(N + M))<P>
(267) Theorem 221: [Arithmetic addition lemma] N ¥PLUS M = #N ¥PLUS #M<P>
(268) Theorem 222: [Second Disjoint sum lemma] (N * M = 0) ¥imp (#N ¥PLUS #M = #(N + M))<P>
(269) Theorem 223: [Cardinality of Cartesian product by a singleton, 2] #({C} ¥PROD N) = #N<P>
(270) Theorem 224:  [Cardinality of Cartesian product by a singleton, 3] #(N ¥PROD {C}) = #N<P>
(271) Theorem 225:  [Cardinality of a Cartesian product union] (A /= B) ¥imp (#N ¥PLUS #M = #((N ¥PROD {A}) + (M ¥PROD {B})))<P>
(272) Theorem 226: [Arithmetic addition lemma 2] N ¥PLUS M = N ¥PLUS #M<P>
(273) Theorem 227: [Arithmetic addition lemma 3] N ¥PLUS M = #N ¥PLUS M<P>
(274) Theorem 228: [Arithmetic associativity lemma] ((N * M = 0) & (N * K = 0) & (M * K = 0)) ¥imp (((N ¥PLUS M) ¥PLUS K) = #((N + M) + K))<P>
(275) Theorem 229: [Arithmetic associativity lemma 2] ((N * M = 0) & (N * K = 0) & (M * K = 0)) ¥imp ((N ¥PLUS (M ¥PLUS K)) = #(N + (M + K)))<P>
(276) Theorem 230: [Arithmetic multiplication lemma] (N ¥TIMES M) = (#N ¥TIMES #M)<P>
(277) Theorem 231: [Arithmetic multiplication lemma 2] N ¥TIMES M = N ¥TIMES #M<P>
(278) Theorem 232: [Arithmetic multiplication lemma 3] #(N ¥PROD M) = #(#N ¥PROD #M)<P>
(279) Theorem 233: [Arithmetic multiplication lemma 4] #(N ¥PROD M) = #(N ¥PROD #M)<P>
(280) Theorem 234: [Arithmetic multiplication lemma 5] #(N ¥PROD M) = #(#N ¥PROD M)<P>
(281) Theorem 235: [Strict monotonicity of finite cardinality] (Finite(N) & (M ¥incin N) & (M /= N)) ¥imp (#M in #N)<P>
(282) Theorem finite_induction1: [Induction principle for finite sets] (m1_thryvar ¥incin n) & P(m1_thryvar) &			(FORALL k ¥incin m1_thryvar | ((k /= m1_thryvar) ¥imp (not P(k))))<P>
(283) Theorem 236: [The union of finite sets is finite] (Finite(N) & Finite(M)) ¥eq Finite(N + M)<P>
(284) Theorem 237: [Removal of an initial segment from $Za$ yields an infinite set] (N in Za) ¥imp (not Finite(Za - N))<P>
(285) Theorem 238: [The union of finitely many finite sets is finite] ((FORALL x in S | Finite(x)) & Finite(S)) ¥imp Finite(Un(S))<P>
(286) Theorem 239: [Finite subsets of $Un(S)$ where $S$ is a nonvoid inclusion-chain] ((S /= 0) & (FORALL u in S, v in S | (u incs v) or (v incs u)) & Finite(Y) & (Un(S) incs Y)) ¥imp (EXISTS z in S | z incs Y)<P>
(287) Theorem 240: [An arithmetic sum is finite if its two terms are finite] Finite(N ¥PLUS M) ¥eq Finite(N + M)<P>
(288) Theorem 241: [An arithmetic sum is finite if and only if both its terms are finite] (Finite(N) & Finite(M)) ¥eq Finite(N ¥PLUS M)<P>
(289) Theorem 242: [acyclicity of the closure of membership] X notin Ult_membs(X)<P>
(290) Theorem 243: [acyclicity of the closure of membership] ((X in Ult_membs({Y})) & (Y in Ult_membs({X}))) ¥imp (X = Y)<P>
(291) Theorem 244: [existence of an $in$-maximal set in any finite set] (EXISTS v | Finite(F) ¥imp (((F = 0) or (v in F)) & ({y in (F-{v}) | v in Ult_membs({y})} = 0)))<P>
(292) Theorem 245: [Anything times 0 is 0] (N ¥TIMES 0) = 0<P>
(293) Theorem 246: [0 times anything is 0] (0 ¥TIMES N) = 0<P>
(294) Theorem 247: [0 is a right additive identity] (#N ¥PLUS 0) = #N<P>
(295) Theorem 248: [1 is a left multiplicative identity] (1 ¥TIMES N) = #N<P>
(296) Theorem 249: [1 is a right multiplicative identity] (N ¥TIMES 1) = #N<P>
(297) Theorem 250: [Monotonicity of multiplication] (M /= 0) ¥imp (#(N ¥PROD M) incs #N)<P>
(298) Theorem 251: [Distributivity lemma] (A /= B) ¥imp (N ¥PLUS M = #((N ¥PROD {A}) + (M ¥PROD {B})))<P>
(299) Theorem 252: [Commutative law for addition] (N ¥PLUS M) = (M ¥PLUS N)<P>
(300) Theorem 253: [Commutative law for multiplication] N ¥TIMES M = M ¥TIMES N<P>
(301) Theorem 254: [0 is bilateral additive identity] (X in Za) ¥imp (((X ¥PLUS 0) = X) & ((0 ¥PLUS X) = X))<P>
(302) Theorem 255: [Rules for intersection and union of Cartesian products] ((A ¥PROD X) * (B ¥PROD X) = (A * B) ¥PROD X) & ((A ¥PROD X) + (B ¥PROD X) = (A + B) ¥PROD X) &	(((X ¥PROD A) * (X ¥PROD B)) = X ¥PROD (A * B)) & (((X ¥PROD A) + (X ¥PROD B)) = X ¥PROD (A + B))<P>
(303) Theorem 256: [Cartesian product monotonicity] ((A ¥incin B) & (C ¥incin D)) ¥imp ((A ¥PROD C) ¥incin (B ¥PROD D))<P>
(304) Theorem 257: [Intersection of Cartesian products] ((A ¥PROD C) * (B ¥PROD D) = (A * B) ¥PROD (C * D))<P>
(305) Theorem 258: [Associativity of arithmetic addition] N ¥PLUS (M ¥PLUS K) = (N ¥PLUS M) ¥PLUS K<P>
(306) Theorem 259: [Associativity of arithmetic multiplication] N ¥TIMES (M ¥TIMES K) = (N ¥TIMES M) ¥TIMES K<P>
(307) Theorem 260: [Arithmetic distributive law] N ¥TIMES (M ¥PLUS K) = (N ¥TIMES M) ¥PLUS (N ¥TIMES K)<P>
(308) Theorem 261: [The arithmetic product of two finite sets is finite] (Finite(N) & Finite(M)) ¥imp Finite(N ¥TIMES M)<P>
(309) Theorem 262: [The Cartesian product of two finite sets is finite] (Finite(N) & Finite(M)) ¥imp Finite(N ¥PROD M)<P>
(310) Theorem 263: [If the product of two nonzero terms is finite, so are the terms] ((Finite(N) & Finite(M)) or N = 0 or M = 0) ¥eq Finite(N ¥TIMES M)<P>
(311) Theorem 264: [A set is finite if and only if its powerset is finite] Finite(N) ¥eq Finite(pow(N))<P>
(312) Theorem 265: [Cantor's Theorem] #N in #pow(N)<P>
(313) Theorem 266: (S ¥incin pow(Un(S))) & ((Finite(Un(S)) & (X ¥incin S)) ¥imp Finite(X))<P>
(314) Theorem 267: [Arithmetic subtraction principle] N ¥MINUS N = 0<P>
(315) Theorem 268: [0 is right identity for arithmetic subtraction] N ¥MINUS 0 = #N<P>
(316) Theorem 269: [Disjoint additivity lemma] ((N * M = 0) & (N2 * M2 = 0) & (#N = #N2) & (#M = #M2)) ¥imp (#(N + M) = #(N2 + M2))<P>
(317) Theorem 270: [Excess subtraction lemma] (Ord(Y) & (X in Y)) ¥imp ((X ¥MINUS Y) = 0)<P>
(318) Theorem 271: [Subtraction lemma] (M ¥incin N) ¥imp (#N = #M ¥PLUS (N ¥MINUS M))<P>
(319) Theorem 272: [Subtraction in the non-negative case] (M ¥incin N) ¥imp (#N = (N ¥MINUS M) ¥PLUS M)<P>
(320) Theorem 273: [Subtraction lemma 2] (#M in #N or #M = #N) ¥imp (#N = #M ¥PLUS (#N ¥MINUS #M))<P>
(321) Theorem 274: [Union set as an upper bound] (FORALL x in S | x ¥incin Un(S)) & ((FORALL x in S | x ¥incin T) ¥imp (Un(S) ¥incin T))<P>
(322) Theorem 275: (Un(S) = 0) ¥eq ((S = 0) or (S = {0}))<P>
(323) Theorem 276: [Monotonicity of the union-set operator] (S ¥incin T) ¥imp (Un(S) ¥incin Un(T))<P>
(324) Theorem 277: [Binary and unary union operations commute] Un(X + Y) = Un(X) + Un(Y)<P>
(325) Theorem 278: [Equivalent characterizations of transitive sets] (S ¥incin pow(S)) ¥eq (Un(S) ¥incin S)<P>
(326) Theorem 279: (Un(S) incs Un({c: c in S | H notin c})) & (H notin Un({c: c in S | H notin c}))<P>
(327) Theorem 280: [The union of a set of ordinals is an ordinal] (FORALL x in S | Ord(x)) ¥imp Ord(Un(S))<P>
(328) Theorem 281: [Division monotonicity lemma] (M /= 0) ¥imp ((N ¥OVER M) ¥incin N)<P>
(329) Theorem 282: [Extended division monotonicity lemma] ((M /= 0) & (N in Za)) ¥imp (((N ¥OVER M) in Za) & ((N ¥OVER M) ¥incin N))<P>
(330) Theorem 283: [Closure properties of arithmetic operators] ((N in Za) & (M in Za)) ¥imp ((N ¥PLUS M in Za) & (N ¥TIMES M in Za) & (N ¥MINUS M in Za))<P>
(331) Theorem 284: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (N /= 0)) ¥imp (M in (M ¥PLUS N))<P>
(332) Theorem 285: [Only the nullset has cardinality zero] (#N = 0) ¥imp (N = 0)<P>
(333) Theorem 286: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (K in N)) ¥imp (M ¥PLUS K in M ¥PLUS N)<P>
(334) Theorem 287: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (K in N)) ¥imp (M ¥PLUS K in M ¥PLUS N)<P>
(335) Theorem 288: [Strict monotonicity of addition, 2] ((M in Za) & (N in Za) & (K in N)) ¥imp (K ¥PLUS M in N ¥PLUS M)<P>
(336) Theorem 289: [Cancellation] ((M in Za) & (N in Za) & (K in Za) & (M ¥PLUS K = N ¥PLUS K)) ¥imp (M = N)<P>
(337) Theorem 290: [Monotonicity of addition] (M ¥incin N) ¥imp ((M ¥PLUS K) ¥incin (N ¥PLUS K))<P>
(338) Theorem 291: [Monotonicity of addition, 2] Card(M) ¥imp ((M ¥incin (I ¥PLUS M)) & (M ¥incin (M ¥PLUS I)))<P>
(339) Theorem 292: [Monotonicity of addition, 3] (M in Za) ¥imp ((M ¥incin (I ¥PLUS M)) & (M ¥incin (M ¥PLUS I)) & ((M ¥PLUS I) notin M) & ((I ¥PLUS M) notin M))<P>
(340) Theorem 293: [Monotonicity of multiplication] (M ¥incin N) ¥imp ((M ¥TIMES K) ¥incin (N ¥TIMES K))<P>
(341) Theorem 294: [Strict monotonicity of integer multiplication] ((M in N) & (N in Za) & (K in Za) & (K /= 0))	¥imp ((M ¥TIMES K) in (N ¥TIMES K))<P>
(342) Theorem 295: [The sum of non-negative integers is at least as big at each addend] ((X in Za) & (Y in Za)) ¥imp ((X ¥PLUS Y) notin Y)<P>
(343) Theorem 296: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (K in Za)) ¥imp			(((M ¥PLUS K) ¥incin (N ¥PLUS K)) ¥eq (M ¥incin N))<P>
(344) Theorem 297: [Strict monotonicity of addition] ((M in Za) & (N in M) & (K in Za)) ¥imp ((N ¥PLUS K) in (M ¥PLUS K))<P>
(345) Theorem 298: [Subtraction Lemma] (N in Za) ¥imp ((N ¥MINUS M) in Za)<P>
(346) Theorem 299: [Strict monotonicity of subtraction] ((N in Za) & (M in Za) & (K in N) & (M incs N)) ¥imp		((M ¥MINUS N) in (M ¥MINUS K))<P>
(347) Theorem 300: [Monotonicity of subtraction] (K incs M) ¥imp ((K ¥MINUS N) incs (M ¥MINUS N))<P>
(348) Theorem 301: [Monotonicity of subtraction, 2] (M incs N) ¥imp ((K ¥MINUS N) incs (K ¥MINUS M))<P>
(349) Theorem 302: [Strict monotonicity of subtraction, 2] ((N in Za) & (M in Za) & (K in M) & (K incs N)) ¥imp		((K ¥MINUS N) in (M ¥MINUS N))<P>
(350) Theorem 303: [Addition-subtraction commutativity] ((M in Za) & (N in Za) & (K in Za) & (N incs M) & ((N ¥MINUS M) incs K)) ¥imp	((N incs (M ¥PLUS K)) & (N ¥MINUS (M ¥PLUS K) = (N ¥MINUS M) ¥MINUS K))<P>
(351) Theorem 304: [Subtraction reverses addition] ((M in Za) & (N in Za)) ¥imp ((M ¥PLUS N) ¥MINUS N = M)<P>
(???) Theorem 304a: [Over finite sets, difference corresponds to subtraction] (Finite(N) & (M ¥incin N)) ¥imp (#N ¥MINUS #M = #(N - M))<P>
(352) Theorem 305: [Singletons have one element] #{S} = {0}<P>
(353) Theorem 306: ({X} incs Y) ¥imp (#Y in 2)<P>
(354) Theorem 307: (#X = 1) ¥eq (X = {arb(X)})<P>
(???) Theorem 305a: [Over finite sets, difference corresponds to subtraction, 2] (Finite(N) & (M in N)) ¥imp (#N ¥MINUS 1 = #(N - {M}))<P>
(355) Theorem 308: [Integer division with remainder] ((M in Za) & (N in Za) & (N /= 0)) ¥imp (((M ¥OVER N) in Za) & (M incs ((M ¥OVER N) ¥TIMES N)) & ((M ¥MOD N) in N))<P>
(356) Theorem 309: [If an integer product is zero, one of its factors is 0] (N ¥TIMES M = 0) ¥eq (N = 0 or M = 0)<P>
(357) Theorem 310: [Subtraction monotonicity lemma] (N incs M) ¥imp ((N ¥MINUS K) incs (M ¥MINUS K))<P>
(358) Theorem 311: [Cardinality of set difference] (Finite(N) & (N incs M)) ¥imp (#(N - M) = #(#N - #M))<P>
(359) Theorem 312: [Strong monotonicity of integer addition] ((N in Za) & (M in Za) & (K in Za)) ¥imp ((N incs M) ¥eq ((N ¥PLUS K) incs (M ¥PLUS K)))<P>
(360) Theorem 313: [Addition reverses subtraction] (N incs M) ¥imp (#N = #M ¥PLUS #(N - M))<P>
(361) Theorem 314: [Addition-subtraction commutativity, 2] ((N in Za) & (M in Za) & (K in Za) & (N incs M)) ¥imp ((N ¥PLUS K) ¥MINUS (M ¥PLUS K) = N ¥MINUS M)<P>
(362) Theorem 315: [Addition-subtraction lemma] ((N in Za) & (M in Za)) ¥imp (N = (M ¥PLUS (N ¥MINUS M)) or N = (M ¥MINUS (M ¥MINUS N)))<P>
(363) Theorem 316: [The successor integer as a sum] (N ¥PLUS 1) = #next(N)<P>
(364) Theorem 317: [The successor integer as a sum, 2] (N in Za) ¥imp ((next(N) in Za) & ((N ¥PLUS 1) = next(N)))<P>
(365) Theorem 318: [To witness that $n$ sets are different, fewer than $n$ elements suffice] (Finite(F) & (F /= 0)) ¥imp (EXISTS d ¥incin Un(F) | (#d in #F) & (FORALL w in F, y in F | (w * d = y * d) ¥imp (w = y)))<P>
(366) Theorem 319: [To witness that $n$ sets are different, fewer than $n$ elements suffice, 2] (Finite(F) & (F /= 0)) ¥imp ({d ¥incin Un(F) | (#d in #F) & (#{w * d : w in F} = #F)} /= 0)<P>
(367) Theorem 320: [The union set of a finite collection of integers is an integer] ((M ¥incin Za) & Finite(M)) ¥imp (((M /= 0) ¥imp (Un(M) in M)) & (Un(M) in Za))<P>
(368) Theorem 321: [The union set of a set of integers is the least upper bound of its elements] (M in Za) ¥imp	(((Un(M) in Za) & (Un(M) ¥incin M)) & ((M /= 0) ¥imp (Un(M) in M)))<P>
(369) Theorem 322: [Every nonzero integer has a predecessor] ((M in Za) & (M /= 0)) ¥imp (M = (Un(M) ¥PLUS 1))<P>
(370) Theorem 323: [The sum of integers as the union of smaller sums] ((X in Za) & (Y in Za)) ¥imp ((X ¥PLUS Y) = X + {(X ¥PLUS u): u in Y})<P>
(371) Theorem 324: [The sum of integers as the union of smaller sums, 2] ((X in Za) & (Y in Za)) ¥imp ((X ¥PLUS Y) = X + {(u ¥PLUS X): u in Y})<P>
(372) Theorem 325: [Subtraction reverses addition] ((X in Za) & (Y in Za) & (Y ¥incin X)) ¥imp (X = Y ¥PLUS (X ¥MINUS Y))<P>
(373) Theorem 326: [Subtraction monotonicity lemma, 2] ((X in Za) & (Y in Za) & (U in (X ¥PLUS Y)) & (Y /= 0)) ¥imp ((U ¥MINUS X) in Y)<P>
(374) Theorem 327: [The integer difference as  a set of smaller differences] ((N in Za) & (M in Za)) ¥imp ((N ¥MINUS M) = {k ¥MINUS M: k in N | M ¥incin k})<P>
(375) Theorem 328: [The integer difference as a set of smaller differences] ((N in Za) & (M in Za)) ¥imp ((N ¥MINUS M) = {k in Za | (k ¥PLUS M) in N})<P>
(376) Theorem 329: ((J in Za - X) & (FORALL i | (next(i) in X) ¥imp (i in X))) ¥imp		({h in Za | (h notin J) & (h in X)} = 0)<P>
(377) Theorem 330: ((X ¥incin Za) & (FORALL i | (next(i) in X) ¥imp (i in X))) ¥eq (X in next(Za))<P>
(378) Theorem 331: (({X,Y} ¥incin next(Za)) & (#X in next(Y))) ¥imp (((X = Y) & (Y = Za)) or (X in (next(Y) * Za)))<P>
(379) Theorem unsigned_integer_bynd.0: [Every finite set of unsigned integers has an upper bound]		(bynd_thryvar in Za) & (FORALL i in Za | (Q1(i) ¥imp (i in bynd_thryvar)))<P>
(380) Theorem unsigned_integer_bynd.1: [Every finite set of unsigned integers has an upper bound] (bynd_thryvar in Za) &	 (Za incs bynd_thryvar) & Ord(bynd_thryvar) & (FORALL i in Za | (Q1(i) ¥imp (i in bynd_thryvar))) & (not Finite(Za - bynd_thryvar))<P>
(381) Theorem cauchyseq_lemma.1: (not Finite({i * j : i in (Za - n0), j in (Za - n0) | R(i,j)}))<P>
(382) Theorem 332: [Ordinal member maximum and minimum] (Ord(U) & (S in U) & (T in U)) ¥imp		((S + T in U) & (S * T in U))<P>
(383) Theorem 333: [Integer member maximum and minimum] ((S in Za) & (T in Za)) ¥imp ((S + T in Za) & (S * T in Za))<P>
(384) Theorem cauchyseq_lemma2.1: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i incs k) & (j incs k)) ¥imp (not (R(i,j)))))<P>
(385) Theorem 334: ((N in Za) & (S ¥incin N) & (#S = N)) ¥imp (S = N)<P>
(386) Theorem 335: [Finite sequences are single-valued maps with integer domains] (F in Fin_seqs(S)) ¥eq (Svm(F) & (domain(F) in Za) & (range(F) ¥incin S))<P>
(387) Theorem 336: [Other properties of finite sequences] (F in Fin_seqs(S)) ¥imp ((domain(F) = #domain(F)) & (domain(F) = #F) & (#F in Za) & Finite(F))<P>
(388) Theorem 337: [Two single-valued functions with common domain are equal if all their values are equal] (Svm(F) & Svm(G) & (domain(F) = S) & (domain(G) = S) & (FORALL n0 in S | F~[n0] = G~[n0])) ¥imp (F = G)<P>
(389) Theorem 338: [Two functions from a collection of single-valued functions with common domain are equal if all their values are equal] ((S /= 0) & (FORALL h in Mapset | ((domain(h) = S) & Svm(h)))) ¥imp ((FORALL n in S | ((F in Mapset) & (G in Mapset) & (F~[n] = G~[n]))) ¥imp (F = G))<P>
(390) Theorem 339: [The shift-map of an integer is single-valued and maps Za into Za] ((M in Za) & (N in Za)) ¥imp (Svm(Shift(M)) & (domain(Shift(M)) = Za) & (range(Shift(M)) ¥incin Za) & (Shift(M)~[N] = M ¥PLUS N))<P>
(391) Theorem 340: [Composition of shift-maps yields a shift-map] ((M in Za) & (N in Za)) ¥imp (Shift(M) @ Shift(N) = Shift(M ¥PLUS N))<P>
(392) Theorem 341: [Double shifting can be emulated by a single shift] ((M in Za) & (N in Za)) ¥imp (shifted_seq(shifted_seq(F,M),N) = shifted_seq(F,M ¥PLUS N))<P>
(393) Theorem 342: [Shift(0) is the identity map on Za] (Shift(0) = {[n,n]: n in Za}) & ((Is_map(F) & (domain(F) ¥incin Za)) ¥imp (F @ Shift(0) = F))<P>
(394) Theorem 343: [Shift-by-0 is the identity map on sequences] (Is_map(F) & (domain(F) ¥incin Za)) ¥imp (shifted_seq(F,0) = F)<P>
(395) Theorem 344: [Form of a shifted sequence] ((M in Za) & (domain(F) ¥incin Za)) ¥imp (shifted_seq(F,M) = {[car(x) ¥MINUS M,cdr(x)]: x in F | car(x) incs M})<P>
(396) Theorem 345: [Properties of finite and shifted finite sequences] ((F in Fin_seqs(S)) & (G in Fin_seqs(S))) ¥imp				(Svm({[car(x) ¥PLUS #F, cdr(x)]: x in G})					& (domain(F) * domain({[car(x) ¥PLUS #F, cdr(x)]: x in G}) = 0))<P>
(397) Theorem 346: ((F in Fin_seqs(S)) & (M in Za)) ¥imp (((F ¥ON M) in Fin_seqs(S)) & (shifted_seq(F,M) in Fin_seqs(S)) & (domain(shifted_seq(F,M)) = (#F ¥MINUS M)))<P>
(398) Theorem 347: [Concatenation of finite sequences] ((F in Fin_seqs(S)) & (G in Fin_seqs(S))) ¥imp			((concat(F,G) in Fin_seqs(S)) & (domain(concat(F,G)) = domain(F) ¥PLUS domain(G)) & (range(concat(F,G)) = range(F) + range(G))) & ((U in domain(F) ¥PLUS domain(G)) ¥imp (concat(F,G)~[U] = if U in domain(F) then F~[U] else G~[U ¥MINUS domain(F)] end if))<P>
(399) Theorem 348: [$0$ is bilateral unit for sequence concatenation] (F in Fin_seqs(S)) ¥imp ((concat(F,0) = F) & (concat(0,F) = F))<P>
(400) Theorem 349: [Associativity of sequence concatenation] ((F in Fin_seqs(S)) & (G in Fin_seqs(S)) & (H in Fin_seqs(S))) ¥imp (concat(F,concat(G,H)) = concat(concat(F,G),H))<P>
(401) Theorem 350: [Concatenation of shifted sequences] ((F in Fin_seqs(S)) & (M in domain(F))) ¥imp ((shifted_seq(F,M) in Fin_seqs(S)) & (F = concat((F ¥ON M), shifted_seq(F,M))))<P>
(402) Theorem subseq.1: (g = (f @ h_thryvar)) & one_1_map(h_thryvar) & (domain(h_thryvar) in next(Za)) & (range(h_thryvar) ¥incin domain(f)) &	(FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) ¥imp ((h_thryvar~[i]) in (h_thryvar~[j])))<P>
(403) Theorem subseq.2: {i in domain(h_thryvar) | i ¥nincin (h_thryvar~[i])} = 0<P>
(404) Theorem subseq.3: Svm(g) & (g ¥incin (domain(f) ¥PROD range(f))) & (domain(g) in (next(Za) * next(domain(f))))<P>
(405) Theorem subseq.4: (domain(h_thryvar) /= Za) ¥imp Finite(g)<P>
(406) Theorem 351: ((F in Fin_seqs(S)) & (G in Subseqs(F))) ¥imp ((G in Fin_seqs(S)) & (domain(G) in next(domain(F))))<P>
(407) Theorem 352: (M in Za) ¥imp (shifted_seq(F,M) in Subseqs(F))<P>
(408) Theorem 353: ((F in Fin_seqs(S)) & (M in Za)) ¥imp ((shifted_seq(F,M) in Fin_seqs(S)) & (domain(shifted_seq(F,M)) in next(domain(F))))<P>
(409) Theorem 354: ((domain(F) = Za) & (M in Za)) ¥imp (domain(shifted_seq(F,M)) = Za)<P>
(410) Theorem ordval_fcn1: [An ordinal-valued function attains its minimum]    (rng_thryvar /= 0) & (FORALL x in rng_thryvar, y in s | f(x) ¥incin f(y)) &    	(rng_thryvar = {x: x in s | f(x) = arb({f(u): u in s})})<P>
(411) Theorem ordval_fcn2: rng_thryvar ¥incin s<P>
(412) Theorem ordval_fcn3: (FORALL x in rng_thryvar, y in s | (f(x) = f(y)) ¥imp (y in rng_thryvar))<P>
(413) Theorem well_founded_set.0:    ((X in s) & (Y in s)) ¥imp ((not(arg1_bef_arg2(X,Y) & arg1_bef_arg2(Y,X))) & (not arg1_bef_arg2(X,X)))<P>
(414) Theorem well_founded_set.00: Minrel1_thryvar(T) = if (T ¥incin s) & (T /= 0) then	arb({m: m in T | (FORALL y in T | (not arg1_bef_arg2(y,m)))}) else s end if<P>
(415) Theorem well_founded_set.0a:  ((T ¥incin s) & (T /= 0)) ¥imp ((Minrel1_thryvar(T) in T) & (FORALL y in T | (not arg1_bef_arg2(y,Minrel1_thryvar(T)))))<P>
(416) Theorem well_founded_set.0b: [Monotonicity of $Minrel1_thryvar$]    ((R ¥incin s) & (T ¥incin R) & (T /= 0)) ¥imp (not(arg1_bef_arg2(Minrel1_thryvar(T),Minrel1_thryvar(R))))<P>
(417) Theorem well_founded_set.0c: ((S incs T) & (T /= 0)) ¥imp (Minrel1_thryvar(T) in T)<P>
(418) Theorem well_founded_set.1a: ordenm_thryvar(X) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in X})<P>
(419) Theorem well_founded_set.1:  (not(s ¥incin {ordenm_thryvar(y): y in X})) ¥imp ((ordenm_thryvar(X) in (s - {ordenm_thryvar(y): y in X}))		& (FORALL y in (s - {ordenm_thryvar(y): y in X}) | not(arg1_bef_arg2(y,ordenm_thryvar(X)))))<P>
(420) Theorem well_founded_set.2: (s ¥incin {ordenm_thryvar(y): y in X}) ¥eq (ordenm_thryvar(X) = s)<P>
(421) Theorem well_founded_set.3: (ordenm_thryvar(X) /= s) ¥imp (ordenm_thryvar(X) in s)<P>
(422) Theorem well_founded_set.5: [Ordinal enumeration is monotone on ordinals] (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V))) ¥imp (U in V)<P>
(423) Theorem well_founded_set.6: {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} ¥incin {ordenm_thryvar(x): x in V}<P>
(424) Theorem well_founded_set.7: [Well-ordering is initially 1-1]	 (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s) & (U /= V)) ¥imp (ordenm_thryvar(U) /= ordenm_thryvar(V))<P>
(425) Theorem well_founded_set.8:    (EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})			& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))<P>
(426) Theorem well_founded_set.9:    (ord_thryvar in next(#pow(s))) & Ord(ord_thryvar) & (s = {ordenm_thryvar(x): x in ord_thryvar})			& (FORALL x in ord_thryvar | (ordenm_thryvar(x) /= s)) &				one_1_map({[x,ordenm_thryvar(x)]: x in ord_thryvar})<P>
(427) Theorem well_ordered_set.0: ((X in s) & (Y in s)) ¥imp (arg1_bef_arg2(X,Y) or arg1_bef_arg2(Y,X) or (X = Y))<P>
(428) Theorem well_ordered_set.0a: ((T ¥incin s) & (T /= 0)) ¥imp (EXISTS x in T | (FORALL y in T | (not arg1_bef_arg2(y,x))))<P>
(429) Theorem well_ordered_set.100:	(FORALL x,y | ((x in s) & (y in s)) ¥imp ((not (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x))) & (not arg1_bef_arg2(x,x)))) &	(FORALL x | (not(s ¥incin {ordenm_thryvar(y): y in x})) ¥imp ((ordenm_thryvar(x) in (s - {ordenm_thryvar(y): y in x})) &			(FORALL y in (s - {ordenm_thryvar(y): y in x}) | not(arg1_bef_arg2(y,ordenm_thryvar(x)))))) &	(FORALL x | (s ¥incin {ordenm_thryvar(y): y in x}) ¥eq (ordenm_thryvar(x) = s)) &	(FORALL x | (ordenm_thryvar(x) /= s) ¥imp (ordenm_thryvar(x) in s)) &	(FORALL u, v | (Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) & arg1_bef_arg2(ordenm_thryvar(u),ordenm_thryvar(v))) ¥imp (u in v)) &	(FORALL v | {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(v))} ¥incin {ordenm_thryvar(x): x in v}) &	(FORALL u, v | (Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) & (ordenm_thryvar(v) /= s) & (u /= v)) ¥imp			(ordenm_thryvar(u) /= ordenm_thryvar(v))) &	(EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})			 		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))) &	(FORALL x | ordenm_thryvar(x) = Minrel2_thryvar(s - {ordenm_thryvar(y): y in x})) &	(FORALL t | Minrel2_thryvar(t) = if (t ¥incin s) & (t /= 0) then				arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) else s end if)<P>
(429+) Theorem well_ordered_set.10:  ((X in s) & (Y in s)) ¥imp		 	((arg1_bef_arg2(X,Y) ¥imp (not arg1_bef_arg2(Y,X))) &		 		(not arg1_bef_arg2(X,X)))<P>
(430) Theorem well_ordered_set.1:  (not(s ¥incin {ordenm_thryvar(y): y in X})) ¥imp	((ordenm_thryvar(X) in (s - {ordenm_thryvar(y): y in X})) &		(FORALL y in (s - {ordenm_thryvar(y): y in X}) | not(arg1_bef_arg2(y,ordenm_thryvar(X)))))<P>
(431) Theorem well_ordered_set.2:  ((s ¥incin {ordenm_thryvar(y): y in X}) ¥eq (ordenm_thryvar(X) = s))<P>
(432) Theorem well_ordered_set.3:  ((ordenm_thryvar(X) /= s) ¥imp (ordenm_thryvar(X) in s))<P>
(433) Theorem well_ordered_set.5a:	(Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V))) ¥imp (U in V)<P>
(434) Theorem well_ordered_set.6a: ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} ¥incin {ordenm_thryvar(x): x in V})<P>
(435) Theorem well_ordered_set.7:  ((Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) &	(ordenm_thryvar(V) /= s) & (U /= V)) ¥imp (ordenm_thryvar(U) /= ordenm_thryvar(V)))<P>
(436) Theorem well_ordered_set.8:  (EXISTS o | (Ord(o) & (s = {ordenm_thryvar(x): x in o})		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))<P>
(437) Theorem well_ordered_set.8a: ordenm_thryvar(X) = Minrel2_thryvar(s - {ordenm_thryvar(y): y in X})<P>
(438) Theorem well_ordered_set.8b: Minrel2_thryvar(T) = if (T ¥incin s) & (T /= 0) then		arb({m: m in T | (FORALL y in T | (not arg1_bef_arg2(y,m)))}) else s end if<P>
(439) Theorem well_ordered_set.5: [Any well-ordering is isomorphic to an ordinal enumeration] (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s)) ¥imp (arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V)) ¥eq (U in V))<P>
(440) Theorem well_ordered_set.6: (Ord(V) & (ordenm_thryvar(V) /= s)) ¥imp ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} = {ordenm_thryvar(x): x in V})<P>
(441) Theorem well_ordered_set.9: (Ord(V) & (ordenm_thryvar(V) /= s)) ¥imp  ( one_1_map({[x,ordenm_thryvar(x)]: x in V})   & (domain({[x,ordenm_thryvar(x)]: x in V}) = V)   & (range({[x,ordenm_thryvar(x)]: x in V}) = {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))})   & ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} = {ordenm_thryvar(x): x in V}))<P>
(442) Theorem inh_well_founded_set1: ((T ¥incin sp) & (T /= 0)) ¥imp (EXISTS w in T | (FORALL v in T | (not arg1_bef_arg2(displace(v),displace(w)))))<P>
(443) Theorem product_order_1: [The first component of any member of a Cartesian product of ordinals is an ordinal] (X in o1 ¥PROD o2) ¥imp Ord(car(X))<P>
(444) Theorem product_order_2: [The second component of any member of a Cartesian product of ordinals is an ordinal] (X in o1 ¥PROD o2) ¥imp Ord(cdr(X))<P>
(445) Theorem product_order_3: [The maximum of the components of any member of a Cartesian product of ordinals is an ordinal] (X in o1 ¥PROD o2) ¥imp Ord(car(X) + cdr(X))<P>
(446) Theorem product_order_4: ((X in o1 ¥PROD o2) & (Y in o1 ¥PROD o2)) ¥imp	((Ord1p2_thryvar(X,Y) or Ord1p2_thryvar(Y,X) or X = Y) & (not Ord1p2_thryvar(X,X)))<P>
(447) Theorem product_order_5: ((X in o1 ¥PROD o2) & (Y in o1 ¥PROD o2) & (Z in o1 ¥PROD o2) &		Ord1p2_thryvar(X,Y) & Ord1p2_thryvar(Y,Z)) ¥imp Ord1p2_thryvar(X,Z)<P>
(448) Theorem product_order_6: ((T ¥incin (o1 ¥PROD o2)) & (T /= 0)) ¥imp	(EXISTS x in T | (FORALL y in t | (Ord1p2_thryvar(x,y) or (x = y))))<P>
(449) Theorem 355: ['One-more' lemma] (not Finite(S)) ¥imp (#S = #(S + {C}))<P>
(450) Theorem 356: ['Few-more' lemma] ((not Finite(S)) & Finite(T)) ¥imp (#S = #(S + T))<P>
(451) Theorem 357: [Any infinite cardinal is a limit ordinal] ((not Finite(S)) & (X in #S)) ¥imp (X + {X} in #S)<P>
(452) Theorem 358: [If ordinal $S$ dominates the members of an ordinal $T$, $#S$ is no less than $#T$] (Ord(S) & Ord(T) & (not Finite(S)) & (FORALL u in T | #u in #S)) ¥imp (#T ¥incin #S)<P>
(453) Theorem 359: [The cardinality of a non-null Cartesian product is at least the cardinality of its first factor] (T /= 0) ¥imp (#S ¥incin #(S ¥PROD T))<P>
(454) Theorem 360: (Ord(O1) & Ord(O2)) ¥imp	(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (O1 ¥PROD O2)) &	(FORALL x in domain(f), y in domain(f) | (x in y) ¥eq (((car(f~[x]) + cdr(f~[x])) in (car(f~[y]) + cdr(f~[y]))) or 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) in car(f~[y]))) or 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) = car(f~[y])) & (cdr(f~[x]) in cdr(f~[y]))))))<P>
(455) Theorem 361: (Card(O1) & Card(O2) & (not Finite(O1 + O2))) ¥imp	(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (O1 ¥PROD O2)) &		(FORALL x in domain(f) | (EXISTS y in (O1 + O2) | range(f ¥ON x) ¥incin (y ¥PROD y))))<P>
(456) Theorem 362: [Cardinal Doubling Theorem] (not Finite(S)) ¥imp (#(S ¥PROD {0,1}) = #S)<P>
(457) Theorem 363: [The sum of two infinite quantities is their maximum] (not Finite(S)) ¥imp ((S ¥PLUS T) = #S + #T)<P>
(458) Theorem 364: [The cardinality of the union of two infinite quantities is the cardinality of the larger] (not Finite(S)) ¥imp (#(S + T) = #S + #T)<P>
(459) Theorem 365: [Cardinal Square Theorem] (not Finite(S)) ¥imp (#(S ¥PROD S) = #S)<P>
(460) Theorem 366: [Reduced form of an integer pair] ((M in Za) & (N in Za)) ¥imp ((Red([M,N]) in Si) & (M * N in Za))<P>
(461) Theorem 367: [Embedding of integers in the signed integers] (N in Za) ¥imp (([N,0] in Si) & ([0,N] in Si))<P>
(462) Theorem 368: [Basic properties of the signed integers 0,1, and -1] ([0,0] in Si) & ([1,0] in Si) & ([0,1] in Si) & ([1,0] /= [0,0]) & ([0,1] /= [0,0]) & ([1,0] /= [0,1])<P>
(463) Theorem 369: [The signed integers as integer pairs with one component equal to 0] (N in Si) ¥imp ((N = [car(N),cdr(N)]) & (car(N) = 0 or cdr(N) = 0) & (car(N) in Za) & (cdr(N) in Za) &			(Red(N) = N) & (car(N) * cdr(N) = 0))<P>
(464) Theorem 370: [Signed integers as integer pairs, 2] (N in Si) ¥imp ((N = [car(N),0] or N = [0,cdr(N)]) & (car(N) = 0 or cdr(N) = 0) &				(car(N) in Za) & (cdr(N) in Za) & (Red(N) = N) & (car(N) * cdr(N) = 0))<P>
(465) Theorem 371: ((N in Si) & (M in Si)) ¥imp ((N ¥S_PLUS M in Si) & (N ¥S_TIMES M in Si))<P>
(466) Theorem 372: [Sign reversal and subtraction for signed integers] ((N in Si) & (M in Si)) ¥imp ((S_Rev(M) in Si) & (N ¥S_MINUS M in Si))<P>
(467) Theorem 373: [Reduction of an integer pair $(n,n)$ always gives the signed 0 value] (N in Za) ¥imp (Red([N,N]) = [0,0])<P>
(468) Theorem 374: [Reduction removes any common value added to the components of an integer pair] ((J in Za) & (K in Za) & (M in Za)) ¥imp (Red([J ¥PLUS M,K ¥PLUS M]) = Red([J,K]))<P>
(469) Theorem 375: [The intersection of two unsigned integers is the smaller of the two] ((N in Za) & (M in Za)) ¥imp (((N * M) in Za) & ((N * M) in {N,M}) & ((N ¥MINUS (N * M)) in Za) & ((M ¥MINUS (N * M)) in Za))<P>
(470) Theorem 376: [The signed sum of two integer pairs is the sum of the first with the reduced form of the second] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) ¥imp ([J,K] ¥S_PLUS [N,M] = [J,K] ¥S_PLUS Red([N,M]))<P>
(471) Theorem 377: [The sum of a signed integer and an integer pair remains the same if the pair is reduced] ((K in Si) & (N in Za) & (M in Za)) ¥imp (K ¥S_PLUS [N,M] = K ¥S_PLUS Red([N,M]))<P>
(472) Theorem 378: [The product of a signed integer and an integer pair remains the same if the pair is reduced] ((K in Si) & (N in Za) & (M in Za)) ¥imp (K ¥S_TIMES [N,M] = K ¥S_TIMES Red([N,M]))<P>
(473) Theorem 379: [Commutativity lemma for signed integers] ((K in Si) & (N in Za) & (M in Za)) ¥imp (K ¥S_PLUS [N,M] = [N,M] ¥S_PLUS K)<P>
(474) Theorem 380: [Commutativity lemma for signed integers, 2] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) ¥imp ([J,K] ¥S_PLUS [N,M] = [N,M] ¥S_PLUS [J,K])<P>
(475) Theorem 381: [Commutative law for signed integer addition] ((N in Si) & (M in Si)) ¥imp (N ¥S_PLUS M = M ¥S_PLUS N)<P>
(476) Theorem 382: [The sum of two integer pairs remains the same if the first is reduced] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) ¥imp ([J,K] ¥S_PLUS [N,M] = Red([J,K]) ¥S_PLUS [N,M])<P>
(477) Theorem 383: [The sum of two integer pairs remains the same if both are reduced] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) ¥imp ([J,K] ¥S_PLUS [N,M] = Red([J,K]) ¥S_PLUS Red([N,M]))<P>
(478) Theorem 384: [Commutative law for signed integer multiplication] ((N in Si) & (M in Si)) ¥imp (N ¥S_TIMES M = M ¥S_TIMES N)<P>
(479) Theorem 385: [Associative law for signed integer addition] ((K in Si) & (N in Si) & (M in Si)) ¥imp (N ¥S_PLUS (M ¥S_PLUS K) = (N ¥S_PLUS M) ¥S_PLUS K)<P>
(480) Theorem 386: [Distributive law for signed integers]    ((K in Si) & (N in Si) & (M in Si)) ¥imp (N ¥S_TIMES (M ¥S_PLUS K) = (N ¥S_TIMES M) ¥S_PLUS (N ¥S_TIMES K))<P>
(481) Theorem 387: [Reduction of a pair $(N,0)$ gives $(N,0)$] (N in Za) ¥imp (Red([N,0]) = [N,0])<P>
(482) Theorem 388: [Embedding of Integers in Signed Integers]     ((N in Za) & (M in Za)) ¥imp (([N ¥PLUS M,0] = [N,0] ¥S_PLUS [M,0] & [N ¥TIMES M,0] = [N,0] ¥S_TIMES [M,0]) &				((N incs M) ¥imp ([N,0] ¥S_MINUS [M,0] = [N ¥MINUS M,0])))<P>
(483) Theorem 389: [Sign-reversal of signed integers] ((N in Za) & (M in Za)) ¥imp (S_Rev(Red([M,N])) = Red([N,M]))<P>
(484) Theorem 390: [$n*-m=-(n*m)$ for signed integers] ((N in Si) & (M in Si)) ¥imp (N ¥S_TIMES S_Rev(M) = S_Rev(N ¥S_TIMES M))<P>
(485) Theorem 391: [Basic properties of the signed negative] (N in Si) ¥imp ((S_Rev(N) in Si) & (S_Rev(N) ¥S_PLUS N = [0,0]) & (S_Rev(S_Rev(N)) = N))<P>
(486) Theorem 392: [Inversion lemma] ((N in Si) & (M in Si)) ¥imp		((S_Rev(N ¥S_TIMES M) = S_Rev(N) ¥S_TIMES M) & (S_Rev(N ¥S_TIMES M) = N ¥S_TIMES S_Rev(M)))<P>
(487) Theorem 393: [Inversion lemma II] (N in Si) ¥imp (S_Rev(S_Rev(N)) = N)<P>
(488) Theorem 394: [Associativity lemma] 	((N in Za) & (M in Za) & (K in Za)) ¥imp ([N,0] ¥S_TIMES ([M,0] ¥S_TIMES [K,0]) = ([N,0] ¥S_TIMES [M,0]) ¥S_TIMES [K,0])<P>
(489) Theorem 395: [Associativity lemma]    ((K in Si) & (N in Za) & (M in Za)) ¥imp ([N,0] ¥S_TIMES ([M,0] ¥S_TIMES K) = ([N,0] ¥S_TIMES [M,0]) ¥S_TIMES K)<P>
(490) Theorem 396: [Associativity lemma II]    ((K in Si) & (N in Za) & (M in Si)) ¥imp ([N,0] ¥S_TIMES (M ¥S_TIMES K) = ([N,0] ¥S_TIMES M) ¥S_TIMES K)<P>
(491) Theorem 397: [Associative law] ((K in Si) & (N in Si) & (M in Si)) ¥imp (N ¥S_TIMES (M ¥S_TIMES K) = (N ¥S_TIMES M) ¥S_TIMES K)<P>
(492) Theorem 398: [Subtraction is addition of the negative] ((N in Si) & (M in Si)) ¥imp ((N ¥S_MINUS M) = (N ¥S_PLUS S_Rev(M)))<P>
(493) Theorem 399: [Subtraction reverses signed integer addition] ((N in Si) & (M in Si)) ¥imp (N = M ¥S_PLUS (N ¥S_MINUS M))<P>
(494) Theorem 400: [The negative of a sum is the sum of the negatives] ((N in Si) & (M in Si)) ¥imp (S_Rev(N ¥S_PLUS M) = S_Rev(N) ¥S_PLUS S_Rev(M))<P>
(495) Theorem 401: [Basic properties of the signed integers 0 and 1] (([0,1] ¥S_TIMES [0,1]) = [1,0]) & ((X in Si) ¥imp ((([1,0] ¥S_TIMES X) = X) & (([0,0] ¥S_TIMES X) = [0,0])))<P>
(496) Theorem 402: [1 is the multiplicative unit for signed integers] (K in Si) ¥imp (K ¥S_TIMES [1,0] = K)<P>
(497) Theorem 403: [The negative of a signed integer is its product by -1] ((K in Si) & (M in Si)) ¥imp (K ¥S_MINUS M = K ¥S_PLUS (M ¥S_TIMES [0,1]))<P>
(498) Theorem 404: [A signed integer minus itself gives 0] (K in Si) ¥imp (K ¥S_MINUS K = [0,0])<P>
(499) Theorem 405: [0 is the right additive identity for signed integers] (K in Si) ¥imp (K ¥S_PLUS [0,0] = K)<P>
(500) Theorem 406: [0 is the left additive identity for signed integers] (K in Si) ¥imp ([0,0] ¥S_PLUS K = K)<P>
(501) Theorem 407: [$Si$ is an Integral Domain]	((N in Si) & (M in Si) & ((M ¥S_TIMES N) = [0,0])) ¥imp ((M = [0,0]) or (N = [0,0]))<P>
(502) Theorem 408: [Distributivity of multiplication over subtraction]    ((N in Si) & (M in Si) & (K in Si)) ¥imp ((m ¥S_TIMES n) ¥S_MINUS (k ¥S_TIMES n) = (m ¥S_MINUS k) ¥S_TIMES n)<P>
(503) Theorem 409: [$Si$ multiplicative cancellation]	((N in Si) & (M in Si) & (K in Si) & (M ¥S_TIMES N = K ¥S_TIMES N) & (N /= [0,0])) ¥imp (M = K)<P>
(504) Theorem 410: [Multiplication by -1] (N in Si) ¥imp (S_Rev(N) = [0,1] ¥S_TIMES N)<P>
(505) Theorem mathematical_induction00: [Basic assumption for proofs by mathematical induction] (n in Za) & P(n)<P>
(506)     	Theorem mathematical_induction0: [The minimum integer having a given property, preliminary version] (FORALL k | ((m2_thryvar in Za) & P(m2_thryvar)) & ((k in m2_thryvar) ¥imp (not ((k in Za) & P(k)))))<P>
(507) Theorem mathematical_induction1: [The minimum integer having a given property] (m2_thryvar in Za) & P(m2_thryvar) & (FORALL k in m2_thryvar | not P(k))<P>
(507+) Theorem double_transfinite_induction.0: [Basic assumption for proofs by double transfinite induction] (EXISTS i | R(n,i))<P>
(508) 	Theorem double_transfinite_induction.1: [Minimum first element in a double transfinite induction] (FORALL k | ((EXISTS i | R(m3_thryvar,i)) & ((k in m3_thryvar) ¥imp (not (EXISTS i | R(k,i))))))<P>
(509) Theorem double_transfinite_induction.2: [Existence of a second element corresponding to the minimum first element] (EXISTS i | R(m3_thryvar,i))<P>
(510) 	Theorem double_transfinite_induction.3: [Minimum second element in a double transfinite induction] R(m3_thryvar,ei1)<P>
(510+) 	Theorem double_transfinite_induction.4: [Minimal element properties in a double transfinite induction] (FORALL k | R(m3_thryvar,j1_thryvar) & ((k in j1_thryvar) ¥imp (not R(m3_thryvar,k))))<P>
(511) Theorem double_transfinite_induction.5: [Minimal element properties in a double transfinite induction, 2] R(m3_thryvar,j1_thryvar) & ((K in m3_thryvar) ¥imp (not R(K,I))) & ((I in j1_thryvar) ¥imp (not R(m3_thryvar,I)))<P>
(512) Theorem double_mathematical_induction.0: [Basic assumption for double integer induction] (EXISTS i | (i in Za) & R(n,i))<P>
(512+) 	Theorem double_mathematical_induction.1: [Minimum first element for a double integer induction] (mm_thryvar in Za) & (EXISTS i | (i in Za) & R(mm_thryvar,i)) & (FORALL k in mm_thryvar | not (EXISTS i | (i in Za) & R(k,i)))<P>
(513) Theorem double_mathematical_induction.2: (EXISTS i | (i in Za) & R(mm_thryvar,i))<P>
(513+) 	Theorem double_mathematical_induction.3: (ei2 in Za) & R(mm_thryvar,ei2)<P>
(514) 	Theorem double_mathematical_induction.4:  (FORALL i | (j2_thryvar in Za) & R(mm_thryvar,j2_thryvar) &			((i in j2_thryvar) ¥imp (not ((i in Za) & R(mm_thryvar,i)))))<P>
(515) Theorem double_mathematical_induction.5: (mm_thryvar in Za) & (j2_thryvar in Za) & R(mm_thryvar,j2_thryvar) & (((K in mm_thryvar) & (I in Za)) ¥imp (not R(K,I))) & ((I in j2_thryvar) ¥imp (not R(mm_thryvar,I)))<P>
(516) Theorem confinedIncrSeq1: [global increase of a stepwise increasing sequence] ((I in J) & (J in Za)) ¥imp (e(I) ¥incin e(J))<P>
(516+) Theorem confinedIncrSeq2: [position of first repetition in confined increasing sequence] (m5_thryvar in Za) & (e(next(m5_thryvar)) = e(m5_thryvar)) & ((m5_thryvar * {i in Za | e(next(i)) ¥incin e(i)}) = 0)<P>
(517) Theorem wellfounded_recursive_fcn.100: (FORALL u, v | (Ord(u) & Ord(v) & (orden(u) /= s) &				arg1_bef_arg2(orden(u),orden(v))) ¥imp (u in v)) &		(EXISTS o in next(#pow(s)) | (Ord(o) & (s = {orden(x): x in o}) &			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o})))<P>
(518) Theorem wellfounded_recursive_fcn.100a: (EXISTS o | (Ord(o) & (s = {orden(x): x in o}) &			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o})))<P>
(518+) Theorem wellfounded_recursive_fcn.101: (Ord(o2) & (s = {orden(x): x in o2}) &			(FORALL x in o2 | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o2}))<P>
(519) Theorem wellfounded_recursive_fcn.1: (V in s) ¥imp ((index(V) in o2) & Ord(index(V)) & (orden(index(V)) = V))<P>
(519+) Theorem wellfounded_recursive_fcn.2: (V in s) ¥imp ({j: j in index(V) | arg1_bef_arg2(orden(j),V)} = {index(w): w in s | arg1_bef_arg2(w,V)})<P>
(520) Theorem wellfounded_recursive_fcn.3: (X in s) ¥imp (wfh2_thryvar(X,T) = f3({g4(wfh2_thryvar(y,T),y,X,T): y in s | arg1_bef_arg2(y,X) & P4(wfh2_thryvar(y,T),y,X,T)},X,T))<P>
(521) 	Theorem wellfounded_recursive_fcn.4: (FORALL x, t | (x in s) ¥imp (rk_thryvar(x,t) = Un({next(rk_thryvar(y,t)): y in s | arg1_bef_arg2(y,x) & ([y,x] in t)})))<P>
(522) Theorem 411: [well-foundedness of inclusion between finite sets] ((FORALL v in X | Finite(v)) & (U ¥incin X) & (U /= 0)) ¥imp		(EXISTS w in U | (FORALL y in U | not((y ¥incin w) & (y /= w))))<P>
(523) Theorem finite_recursion_coherence.1: ((X in q) & (X in r)) ¥imp (h_q(X,T) = h_r(X,T))<P>
(523+) Theorem fin_well_founded.1: ((V ¥incin s) & (V /= 0)) ¥imp (EXISTS m in V | (FORALL y in V | not(arg1_bef_arg2(y,m))))<P>
(524) Theorem finite_recursive_fcn.0: ((T ¥incin {y: y ¥incin S | Finite(y)}) & (T /= 0)) ¥imp (EXISTS x in T | (FORALL y in T | not((y ¥incin x) & (y /= x))))<P>
(525) Theorem finite_recursive_fcn.1: (FORALL s,t | (EXISTS h | (FORALL x | ((x ¥incin s) & Finite(x)) ¥imp			(h~[x] = f3({g4(h~[y],y,x,t): y ¥incin x | (y /= x) & P4(h~[y],y,x,t)},x,t)))))<P>
(525+)     Theorem finite_recursive_fcn.a: (FORALL s,t | (FORALL x | ((x ¥incin s) & Finite(x)) ¥imp			(hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y ¥incin x | (y /= x) & P4(hsko(s,t)~[y],y,x,t)},x,t))))<P>
(526) Theorem finite_recursive_fcn.2: (FORALL x | ((x ¥incin S) & Finite(x)) ¥imp			(hsko(S,T)~[x] = f3({g4(hsko(S,T)~[y],y,x,T): y ¥incin x | (y /= x) & P4(hsko(S,T)~[y],y,x,T)},x,T)))<P>
(527) Theorem finite_recursive_fcn.3: Finite(S) ¥imp (rech2_thryvar(S,T) = f3({g4(rech2_thryvar(y,T),y,S,T): y ¥incin S | (y /= S) & P4(rech2_thryvar(y,T),y,S,T)},S,T))<P>
(528) Theorem finite_tailrecursive_fcn.0: (FORALL s,t | Finite(s) ¥imp (trech2_thryvar(s,t) =		if      ({g3(trech2_thryvar(y,t),s,t): y ¥incin s | (y /= s) & (y = sl(s))} = 0) then f(t)		else arb({g3(trech2_thryvar(y,t),s,t): y ¥incin s | (y /= s) & (y = sl(s))}) end if))<P>
(529) Theorem finite_tailrecursive_fcn.1: Finite(S) ¥imp (trech2_thryvar(S,T) = if (S = 0) then f(T) else g3(trech2_thryvar(sl(S), T), S,T) end if)<P>
(529+) Theorem finite_tailrecursive_fcn1.0: ((X - {arb(X)}) ¥incin X) & ((X /= 0) ¥imp ((X - {arb(X)}) /= X))<P>
(530) Theorem finite_tailrecursive_fcn1.1: (FORALL s,t | Finite(s) ¥imp (trech_thryvar(s,t) =		if (s = 0) then f(t)		else g3(trech_thryvar(s - {arb(s)}, t), s,t) end if))<P>
(531) Theorem finite_tailrecursive_fcn2.0: (FORALL s,t | Finite(s) ¥imp (h(s,t) = if s = 0 then f0 else g2(h(s - {arb(s)},t),s) end if))<P>
(532) Theorem finite_tailrecursive_fcn2.1: Finite(S) ¥imp (h1_thryvar(S) = if S = 0 then f0 else g2(h1_thryvar(S - {arb(S)}),S) end if)<P>
(533)     Theorem sigma_theory0: [Recursive formula for generalized sum] (FORALL x | Finite(x) ¥imp (sigma_thryvar(x) = if x = 0 then e else pluz(sigma_thryvar(x - {arb(x)}),cdr(arb(x))) end if))<P>
(534) Theorem sigma_theory1: [Summation of null map is zero] sigma_thryvar(0) = e<P>
(535) Theorem sigma_theory2: [Summation of singleton map is range element] (cdr(X) in s) ¥imp (sigma_thryvar({X}) = cdr(X))<P>
(535+) Theorem sigma_theory3: [Sum value belongs to closed range of map] (Finite(F) & (range(F) ¥incin s)) ¥imp (sigma_thryvar(F) in s)<P>
(536) Theorem sigma_theory4: [Removal of single element from domain of a sum] ((C in F) &	Finite(F) & (range(F) ¥incin s)) ¥imp (sigma_thryvar(F) = pluz(sigma_thryvar(F - {C}),cdr(C)))<P>
(537) Theorem sigma_theory5: [The generalized sum of a union map is a sum of sums] (Finite(F) & Is_map(F) & (range(F) ¥incin s)) ¥imp	(sigma_thryvar(F) = pluz(sigma_thryvar(F ¥ON (domain(F) * T)), sigma_thryvar(F ¥ON (domain(F) - T))))<P>
(538) Theorem sigma_theory6: [Rearrangement-of-sums theorem]    (Finite(F) & Svm(F) & Svm(G) & (domain(F) = domain(G)) & (range(F) ¥incin s)) ¥imp	(sigma_thryvar(F) = sigma_thryvar({[y,sigma_thryvar(F ¥ON (G ¥INV_IM {y}))]: y in range(G)}))<P>
(538+) Theorem sigma_theory7: [Sum permutation theorem]    (Finite(F) & Svm(F) & one_1_map(G) & (domain(F) = domain(G)) & (range(F) ¥incin s)) ¥imp					(sigma_thryvar(F) = sigma_thryvar({[y,F~[inv(G)~[y]]]: y in range(G)}))<P>
(539) Theorem equivalence_classes1: [Elements are equivalent if and only if their equivalence classes are equal] ((X in s) & (Y in s)) ¥imp (R(X,Y) ¥eq (f1_thryvar(X) = f1_thryvar(Y)))<P>
(540) Theorem equivalence_classes2:  [The equivalence class of any element is an equivalence class] (X in s) ¥imp (f1_thryvar(X) in Eqc_thryvar)<P>
(541) Theorem equivalence_classes2b: [Any element of an equivalence class can represent the class] ((X in Eqc_thryvar) ¥imp ((arb(X) in s) & (f1_thryvar(arb(X)) = X)))<P>
(541+) Theorem equivalence_classes3: [Any two elements of an equivalence class are equivalent] (X in s) ¥imp R(x,arb(f1_thryvar(x)))<P>
(542) Theorem linear_order_1: (({U,V,W} ¥incin s0) & (U ¥le_thryvar V) & (V ¥le_thryvar W)) ¥imp (U ¥le_thryvar W)<P>
(542+) Theorem linear_order_2: (({U,V} ¥incin s0) & (U ¥le_thryvar V) & (V ¥le_thryvar U)) ¥imp (U = V)<P>
(543) Theorem linear_order_3: smaller_thryvar(X,Y) = smaller_thryvar(Y,X)<P>
(544) Theorem linear_order_4: ({U,V} ¥incin s0) ¥imp ((U ¥le_thryvar V) or (V ¥le_thryvar U))<P>
(544+) Theorem linear_order_5: ({U,V,W} ¥incin s0) ¥imp (((U ¥le_thryvar V) & (U ¥le_thryvar W)) or	((V ¥le_thryvar U) & (V ¥le_thryvar W)) or ((W ¥le_thryvar U) & (W ¥le_thryvar V)))<P>
(545) Theorem linear_order_6: ({X,Y} ¥incin s0) ¥imp (smaller_thryvar(X,Y) in {X,Y})<P>
(546) Theorem linear_order_7: (({X,Y} ¥incin s0) & (arg1_bef_arg2(X,Y) or (X = Y))) ¥imp ((smaller_thryvar(X,Y) = X) & (smaller_thryvar(Y,X) = X))<P>
(547) Theorem linear_order_8: (X in next(s0)) ¥imp (smaller_thryvar(X,s0) = X)<P>
(548) Theorem linear_order_9: smaller_thryvar(X,smaller_thryvar(Y,W)) = smaller_thryvar(smaller_thryvar(X,Y),W)<P>
(549) Theorem linear_order_10: ((X in next(s0)) & (Y in next(s0))) ¥imp (smaller_thryvar(X,Y) in next(s0))<P>
(550) Theorem linear_order_11: (s0 in next(s0)) & (FORALL x,y,z | ((x in next(s0)) & (y in next(s0)) & (z in next(s0))) ¥imp (smaller_thryvar(x,smaller_thryvar(y,z)) = smaller_thryvar(smaller_thryvar(x,y),z))) &	(FORALL x,y | ((x in next(s0)) & (y in next(s0))) ¥imp (smaller_thryvar(x,y) = smaller_thryvar(y,x)))<P>
(551) Theorem linear_order_12: (FORALL f | (Finite(f) & (range(f) ¥incin next(s0))) ¥imp (min_over_thryvar(f) in next(s0))) &	(FORALL x | (cdr(x) in next(s0)) ¥imp (min_over_thryvar({x}) = cdr(x))) &	(FORALL f,t | (Finite(f) & Is_map(f) & (range(f) ¥incin next(s0))) ¥imp (min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f ¥ON (domain(f) * t)),min_over_thryvar(f ¥ON (domain(f) - t))))) &	(FORALL c,f | ((c in f) & Finite(f) & (range(f) ¥incin next(s0))) ¥imp (min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f - {c}),cdr(c))))<P>
(552) Theorem linear_order_13: (Svm(F) & (range(F) ¥incin s0) & Finite(F)) ¥imp	(((P in F) ¥imp (min_over_thryvar({P}) = (F~[car(P)]))) &	 (min_over_thryvar(F) = smaller_thryvar(min_over_thryvar(F ¥ON (domain(F) * A)),min_over_thryvar(F ¥ON (domain(F) - A)))))<P>
(553) Theorem linear_order_14: (Svm(F) & (range(F) ¥incin s0) & Finite(F) & (F /= 0)) ¥imp	(min_over_thryvar(F) in range(F))<P>
(554) Theorem linear_order_15: ({X,Y} ¥incin s0) ¥imp ((smaller_thryvar(X,Y) = X) ¥eq (arg1_bef_arg2(X,Y) or (X = Y)))<P>
(555) Theorem linear_order_16: (ubs_thryvar(0) = s0) & (max_thryvar(0) = s0)<P>
(556) Theorem linear_order_17: (ubs_thryvar(T) ¥incin s0) & (ubs_thryvar(T) = ubs_thryvar(T * s0)) & (max_thryvar(T) = max_thryvar(T * s0))<P>
(557) Theorem linear_order_18: (Finite(T) & (X in T) & (T ¥incin s0)) ¥imp ((max_thryvar(T) in T) & ((X = max_thryvar(T)) or (arg1_bef_arg2(X,max_thryvar(T)))))<P>
(558) Theorem linear_order_19: (FORALL x in  s0, y in s0, z in s0 | (arg1_aft_arg2(x,y) & arg1_aft_arg2(y,z)) ¥imp arg1_aft_arg2(x,z)) &    (FORALL x in s0 | not(arg1_aft_arg2(x,x))) &    (FORALL x in  s0, y in s0 | arg1_aft_arg2(x,y) or (x = y) or arg1_aft_arg2(y,x))<P>
(559) Theorem linear_order_20:	(FORALL x, y | larger_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_aft_arg2(x,y) then x else y end if) &	(FORALL x, y | larger_thryvar(x,y) = larger_thryvar(y,x)) &	(FORALL x, y | ({x,y} ¥incin s0) ¥imp (larger_thryvar(x,y) in {x,y})) &	(FORALL x | (x in next(s0)) ¥imp (larger_thryvar(x,s0) = x)) &	(FORALL x, y, z | larger_thryvar(x,larger_thryvar(y,z)) = larger_thryvar(larger_thryvar(x,y),z)) &	(FORALL x, y | ((x in next(s0)) & (y in next(s0))) ¥imp (larger_thryvar(x,y) in next(s0))) &	(FORALL f,p,a | (Svm(f) & (range(f) ¥incin s0) & Finite(f)) ¥imp		(((p in f) ¥imp (max_over_thryvar({p}) = (f~[car(p)]))) &		(max_over_thryvar(f) = larger_thryvar(max_over_thryvar(f ¥ON (domain(f) * a)),max_over_thryvar(f ¥ON (domain(f) - a)))))) &	(FORALL f | (Svm(f) & (range(f) ¥incin s0) & Finite(f) & (f /= 0)) ¥imp (max_over_thryvar(f) in range(f))) &	(FORALL x, y | ({x,y} ¥incin s0) ¥imp ((larger_thryvar(x,y) = x) ¥eq (arg1_aft_arg2(x,y) or (x = y)))) &	(FORALL t | lbs_thryvar(t) = {x in s0 | (FORALL y in (t * s0) | larger_thryvar(y,x) = y)}) &	(FORALL t | min_thryvar(t) = arb({s0} + (t * lbs_thryvar(t)))) &	(FORALL t | glb_thryvar(t) = arb({s0} + {x in lbs_thryvar(t) | lbs_thryvar(t) ¥incin lbs_thryvar({x})})) &	(lbs_thryvar(0) = s0) & (min_thryvar(0) = s0) &	(FORALL t | (lbs_thryvar(t) ¥incin s0) & (lbs_thryvar(t) = lbs_thryvar(t * s0)) & (min_thryvar(t) = min_thryvar(t * s0))) &	(FORALL t, x | (Finite(t) & (x in t) & (t ¥incin s0)) ¥imp ((min_thryvar(t) in t) & ((x = min_thryvar(t)) or (arg1_aft_arg2(x,min_thryvar(t))))))<P>
(560) Theorem transfinite_definition_0_params1: [One-parameter transfinite recursive function definition] f_thryvar(X) = g({h1(f_thryvar(t)): t in X})<P>
(561) Theorem transfinite_definition_1_params1: [Recursive transfinite function definition with auxilliary parameter] f2_thryvar(X,A) = g2({h(f2_thryvar(t,A),A): t in X},A)<P>
(562) Theorem 412: [Zorn's lemma] (FORALL x ¥incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp (EXISTS w in T | (FORALL y in x | w incs y))))		 ¥imp (EXISTS y in T | (FORALL x in T | not ((x incs y) & (x /= y))))<P>
(563) Theorem 413: [Zorn's lemma generalized form] (FORALL x ¥incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp (EXISTS w in T | (FORALL y in x | w incs y))))		 ¥imp (FORALL u in T | (EXISTS y in T | (y incs u) & (FORALL x in T | not ((x incs y) & (x /= y)))))<P>
(564) Theorem 414: [Zorn's lemma for union-closed collections] (FORALL x ¥incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp (Un(x) in T)))		 ¥imp (FORALL u in T | (EXISTS y in T | (y incs u) & (FORALL x in T | not ((x incs y) & (x /= y)))))<P>
(565) Theorem 415: ((FORALL t in TP | Filter(t,S)) & (FORALL u in TP, v in TP | (u incs v or v incs u))) ¥imp  Filter(Un(TP),S)<P>
(566) Theorem 416: (S /= 0) ¥imp ((Filter(T,S) & (FORALL x ¥incin pow(S) | ((x incs T) & Filter(x,S)) ¥imp (x = T))) ¥eq Ultrafilter(T,S))<P>
(567) Theorem 417: [Every filter on a set $S$ can be extended to an ultrafilter on $S$] (Filter(T,S) & (S /= 0)) ¥imp (EXISTS u | ((u incs T) & Ultrafilter(u,S)))<P>
(567+) Theorem 418: [Equivalence of fractions is reflexive and symmetric] (FORALL x in Fr,y in Fr | (Same_frac(x,y) ¥eq Same_frac(y,x)) & Same_frac(x,x))<P>
(568) Theorem 419: [Equivalence of fractions is transitive] (FORALL x in Fr, y in Fr, wz in Fr | (Same_frac(x,y) & Same_frac(y,wz)) ¥imp Same_frac(x,wz))<P>
(569)     Theorem 420: [Fractions are equivalent if and only if the rational numbers they define are equal] (FORALL x, y | ((x in Fr) & (y in Fr)) ¥imp ((Same_frac(x,y) ¥eq (Fr_to_Ra(x) = Fr_to_Ra(y))))) &    (FORALL x  | (x in Ra) ¥imp ((arb(x) in Fr) & (Fr_to_Ra(arb(x)) = x))) &    (FORALL x | (x in Fr) ¥imp (Fr_to_Ra(x) in Ra)) &    (FORALL x | (x in Fr) ¥imp Same_frac(x,arb(Fr_to_Ra(x))))<P>
(570) Theorem 421: [Every fraction is equivalent to every member of its rational number class] (X in Fr) ¥imp ((Fr_to_Ra(X) in Ra) & Same_frac(X,arb(Fr_to_Ra(X))))<P>
(571) Theorem 422: [Alternate version of Theorem 420] ((X in Fr) & (Y in Fr)) ¥imp (Same_frac(X,Y) ¥eq (Fr_to_Ra(X) = Fr_to_Ra(Y)))<P>
(572) Theorem 423: [Alternate version of Theorem 421] (Y in Ra) ¥imp ((arb(Y) in Fr) & (Fr_to_Ra(arb(Y)) = Y))<P>
(573) Theorem Ordered_add.0: [Echo of relator definitions] (GE_thryvar(X,Y) ¥eq nneg(pluz(X,rvz(Y)))) &	(LE_thryvar(X,Y) ¥eq GE_thryvar(Y,X)) &	(GT_thryvar(X,Y) ¥eq (GE_thryvar(X,Y) & (X /= Y))) &	(LT_thryvar(X,Y) ¥eq GT_thryvar(Y,X))<P>
(574) Theorem Ordered_add.1: [Interface to Otter-based THEORY of orderedGroups] (LE_thryvar(X,Y) ¥eq nneg(pluz(Y,rvz(X)))) &	(((X in g) & (Y in g)) ¥imp (GT_thryvar(X,Y) ¥eq (nneg(pluz(X,rvz(Y))) & (X /= Y)))) &	(((X in g) & (Y in g)) ¥imp (GT_thryvar(X,Y) ¥eq (nneg(minz(X,Y)) & (X /= Y))))<P>
(575) Theorem Ordered_add.2: [The ordering by $GE_thryvar$ is a linear ordering] ((X in g) & (Y in g) & ((X = Y) or (not GE_thryvar(X,Y)))) ¥imp GE_thryvar(Y,X)<P>
(575+) Theorem 424: [If a signed integer and its additive inverse are both nonnegative, the signed integer is zero] (X in Si) ¥imp ((is_nonneg(X) or is_nonneg(S_Rev(X))) & ((is_nonneg(X) & is_nonneg(S_Rev(X))) ¥imp (X = [0,0])))<P>
(576) Theorem 425: [The sum of two non-negative signed integers is non-negative] (((X in Si) & (Y in Si) & is_nonneg(X) & is_nonneg(Y))) ¥imp (is_nonneg(X ¥S_PLUS Y) & is_nonneg(X ¥S_TIMES Y))<P>
(577) Theorem 426: ([0,0] in Si) & (FORALL x in Si | ((x ¥S_PLUS [0,0]) = x) & ((x ¥S_PLUS S_Rev(x)) = [0,0]) & (S_Rev(x) in Si)) &	(FORALL x in Si, y in Si | ((x ¥S_PLUS y) in Si) & ((x ¥S_PLUS y) = (y ¥S_PLUS x)) & ((x ¥S_PLUS S_Rev(y)) = (x ¥S_MINUS y))) &	(FORALL x in Si, y in Si, z in Si | ((x ¥S_PLUS y) ¥S_PLUS z) = (x ¥S_PLUS (y ¥S_PLUS z))) &	(FORALL x in Si, y in Si | (is_nonneg(x) & is_nonneg(y)) ¥imp is_nonneg(x ¥S_PLUS y)) &	(FORALL x in Si | (is_nonneg(x) or is_nonneg(S_Rev(x))) & ((is_nonneg(x) & is_nonneg(S_Rev(x))) ¥imp (x = [0,0])))<P>
(578) Theorem 427: [The ordering of two signed integers is defined by the sign of their differences] (FORALL x, y | (S_GE(x,y) ¥eq is_nonneg(x ¥S_PLUS S_Rev(y))) & (S_LE(x,y) ¥eq S_GE(y,x)) &	(S_GT(x,y) ¥eq (S_GE(x,y) & (x /= y))) & (S_LT(x,y) ¥eq S_GT(y,x)))<P>
(579) Theorem 428: [The ordering of two signed integers is defined by the sign of their differences] ((X ¥S_GE Y) ¥eq is_nonneg(X ¥S_PLUS S_Rev(Y))) & ((X ¥S_LE Y) ¥eq (Y ¥S_GE X)) &	((X ¥S_GT Y) ¥eq ((X ¥S_GE Y) & (X /= Y))) & ((X ¥S_LT Y) ¥eq (Y ¥S_GT X))<P>
(580) Theorem 429: [The square of any signed integer is non-negative] (X in Si) ¥imp is_nonneg(X ¥S_TIMES X)<P>
(581) Theorem 430: [The product of signed integers $x,y$ of which $x$ is positive is non-negative iff $y$ is non-negative] ((X in Si) & (Y in Si) & (X /= [0,0]) & is_nonneg(X)) ¥imp (is_nonneg(X ¥S_TIMES Y) ¥eq is_nonneg(Y))<P>
(582) Theorem 431: [Fractions are pairs of signed integers with non-zero denominator] (X in Fr) ¥eq ((X = [car(X),cdr(X)]) & (car(X) in Si) & (cdr(X) in Si) & (cdr(X) /= [0,0]))<P>
(583) Theorem 432: [Fractions are pairs of signed integers with non-zero denominator, 2] ((X in Si) & (Y in Si)) ¥imp (([X,Y] in Fr) ¥eq (Y /= [0,0]))<P>
(584) Theorem 433: [Rational numbers are classes of pairs of signed integers] (N in Ra) ¥imp ((arb(N) in Fr) & (arb(N) = [car(arb(N)),cdr(arb(N))]) & (car(arb(N)) in Si) &				(cdr(arb(N)) in Si) & (cdr(arb(N)) /= [0,0]))<P>
(585) Theorem 434: [Fractions are equivalent if their cross-products are equal] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) ¥imp    Same_frac([(car(X) ¥S_TIMES cdr(W)) ¥S_PLUS (car(W) ¥S_TIMES cdr(X)),cdr(X) ¥S_TIMES cdr(W)],	[(car(Y) ¥S_TIMES cdr(Z)) ¥S_PLUS (car(Z) ¥S_TIMES cdr(Y)),cdr(Y) ¥S_TIMES cdr(Z)])<P>
(586) Theorem 435: [If two pair of fractions are equivalent, their formal sums are also equivalent] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) ¥imp	(Fr_to_Ra([(car(X) ¥S_TIMES cdr(W)) ¥S_PLUS (car(W) ¥S_TIMES cdr(X)),cdr(X) ¥S_TIMES cdr(W)]) =	Fr_to_Ra([(car(Y) ¥S_TIMES cdr(Z)) ¥S_PLUS (car(Z) ¥S_TIMES cdr(Y)),cdr(Y) ¥S_TIMES cdr(Z)]))<P>
(586+) Theorem 436: [If two pairs of fractions are equivalent, their formal products are also equivalent] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) ¥imp    Same_frac([car(X) ¥S_TIMES car(W),cdr(X) ¥S_TIMES cdr(W)],[car(Y) ¥S_TIMES car(Z),cdr(Y) ¥S_TIMES cdr(Z)])<P>
(587) Theorem 437: [If two pairs of fractions are equivalent, their formal sums define the same rational number] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) ¥imp	(Fr_to_Ra([car(X) ¥S_TIMES car(W),cdr(X) ¥S_TIMES cdr(W)]) = Fr_to_Ra([car(Y) ¥S_TIMES car(Z),cdr(Y) ¥S_TIMES cdr(Z)]))<P>
(588) Theorem 438: [The sum of a rational number and a formal fraction can be expressed as a sum of formal fractions] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) ¥imp (X ¥Ra_PLUS Fr_to_Ra([Y,Z]) =    Fr_to_Ra([(car(arb(X)) ¥S_TIMES Z) ¥S_PLUS (cdr(arb(X)) ¥S_TIMES Y),(cdr(arb(X)) ¥S_TIMES Z)]))<P>
(589) Theorem 439: [The product of a rational number and a formal fraction can be expressed as a product of formal fractions] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) ¥imp (X ¥Ra_TIMES Fr_to_Ra([Y,Z]) =			Fr_to_Ra([car(arb(X)) ¥S_TIMES Y,cdr(arb(X)) ¥S_TIMES Z]))<P>
(590) Theorem 440: [Reversing both the numerator and denominator of a formal fraction does not change the rational it represents] (X in Fr) ¥imp Same_frac(X,[S_Rev(car(X)),S_Rev(cdr(X))])<P>
(591) Theorem 441: [?] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & is_nonneg(cdr(X)) & is_nonneg(cdr(Y))) ¥imp	((is_nonneg(car(X)) or car(X) = [0,0]) ¥eq (is_nonneg(car(Y)) or car(Y) = [0,0]))<P>
(592) Theorem 442: [The sign of the product of the numerator and denominator of a fraction defines the sign of the rational number which it represents]    ((X in Fr) & (Y in Fr) & Same_frac(X,Y)) ¥imp (is_nonneg(car(X) ¥S_TIMES cdr(X)) ¥eq is_nonneg(car(Y) ¥S_TIMES cdr(Y)))<P>
(593) Theorem 443: [?] (X in Fr) ¥imp (Fr_is_nonneg(X) ¥eq Fr_is_nonneg([S_Rev(car(X)),S_Rev(cdr(X))]))<P>
(594) Theorem 444: [?] ((X in Fr) & (Y in Fr) & Same_frac(X,Y)) ¥imp (Fr_is_nonneg(X) ¥eq Fr_is_nonneg(Y))<P>
(595) Theorem 445: [Commutativity of rational addition] ((N in Ra) & (M in Ra)) ¥imp	((N ¥Ra_PLUS M in Ra) & (N ¥Ra_PLUS M = M ¥Ra_PLUS N))<P>
(596) Theorem 446: [?] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) ¥imp (Fr_to_Ra([Y,Z]) ¥Ra_PLUS X =    Fr_to_Ra([(car(arb(X)) ¥S_TIMES Z) ¥S_PLUS (cdr(arb(X)) ¥S_TIMES Y),(cdr(arb(X)) ¥S_TIMES Z)]))<P>
(596+) Theorem 447: [?] ((X in Si) & (Y in Si) & (Z in Si) & (W in Si) & (Y /= [0,0]) & (W /= [0,0])) ¥imp  (Fr_to_Ra([X,Y]) ¥Ra_PLUS Fr_to_Ra([Z,W]) = Fr_to_Ra([(X ¥S_TIMES W) ¥S_PLUS (Z ¥S_TIMES Y),Y ¥S_TIMES W]))<P>
(597) Theorem 448: [Commutativity of rational multiplication] ((N in Ra) & (M in Ra)) ¥imp		((N ¥Ra_TIMES M in Ra) & (N ¥Ra_TIMES M = M ¥Ra_TIMES N))<P>
(598) Theorem 449: [?] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) ¥imp	((Fr_to_Ra([Y,Z]) ¥Ra_TIMES X) =			Fr_to_Ra([car(arb(X)) ¥S_TIMES Y,cdr(arb(X)) ¥S_TIMES Z]))<P>
(599) Theorem 450: [Associative law for rational addition] ((K in Ra) & (N in Ra) & (M in Ra)) ¥imp (N ¥Ra_PLUS (M ¥Ra_PLUS K) = (N ¥Ra_PLUS M) ¥Ra_PLUS K)<P>
(600) Theorem 451: [The zero rational is the identity for rational addition] (Ra_0 in Ra) & (Ra_1 in Ra) & ((M in Ra) ¥imp (M = M ¥Ra_PLUS Ra_0))<P>
(601) Theorem 452: [The sum of a rational number and its additive inverse is zero] (M in Ra) ¥imp ((Ra_Rev(M) in Ra) & ((M ¥Ra_PLUS Ra_Rev(M)) = Ra_0))<P>
(602) Theorem 453: [The sum of a rational number and its additive inverse is zero, 2] (M in Ra) ¥imp ((Ra_Rev(M) in Ra) & ((Ra_Rev(M) ¥Ra_PLUS M) = Ra_0))<P>
(603) Theorem 454: [The difference of two rationals is rational] ((N in Ra) & (M in Ra)) ¥imp ((N ¥Ra_MINUS M) in Ra)<P>
(604) Theorem 455: [Rational subtraction is equivalent to addition of the rational negative] ((N in Ra) & (M in Ra)) ¥imp (N = M ¥Ra_PLUS (N ¥Ra_MINUS M))<P>
(605) Theorem 456: [Associative law for rational multiplication] ((K in Ra) & (N in Ra) & (M in Ra)) ¥imp (N ¥Ra_TIMES (M ¥Ra_TIMES K) = (N ¥Ra_TIMES M) ¥Ra_TIMES K)<P>
(606) Theorem 457: [Muliplication of numerator and denominator by a common nonzero function does not change the rational number it represents]    ((K in Si) & (N in Si) & (M in Si) & (K /= [0,0]) & (M /= [0,0])) ¥imp (Fr_to_Ra([N,M]) = Fr_to_Ra([K ¥S_TIMES N,K ¥S_TIMES M]))<P>
(607) Theorem 458: [Distributive law for rationals] ((K in Ra) & (N in Ra) & (M in Ra)) ¥imp (N ¥Ra_TIMES (M ¥Ra_PLUS K) = (N ¥Ra_TIMES M) ¥Ra_PLUS (N ¥Ra_TIMES K))<P>
(608) Theorem 459: [Expressing the sign of a rational in terms of the numerator and denominator of any representing fraction] ((X in Si) & (Y in Si) & (Y /= [0,0])) ¥imp (Ra_is_nonneg(Fr_to_Ra([X,Y])) ¥eq is_nonneg(X ¥S_TIMES Y))<P>
(609) Theorem 460: [The unit and zero signed signed integers addition] ([1,0] in Si) & ([0,0] in Si) & ([1,0] /= [0,0]) & ([[0,0],[1,0]] in Fr) & ([[1,0],[1,0]] in Fr)<P>
(610) Theorem 461: [The unit rational is the rational multiplicative identity] (M in Ra) ¥imp (M = M ¥Ra_TIMES Ra_1)<P>
(611) Theorem 462: [Multiplication of a rational by its reciprocal gives 1] ((M in Ra) & (M /= Ra_0)) ¥imp ((Recip(M) in Ra) & (M ¥Ra_TIMES Recip(M) = Ra_1))<P>
(612) Theorem 463: ((N in Ra) & (M in Ra) & (M /= Ra_0)) ¥imp (((N ¥Ra_TIMES (M ¥Ra_TIMES M)) ¥Ra_TIMES (Recip(M) ¥Ra_TIMES Recip(M))) = N)<P>
(613) Theorem 464: [Rational division is multiplication by the reciprocal] ((N in Ra) & (M in Ra) & (M /= Ra_0)) ¥imp (N = M ¥Ra_TIMES (N ¥Ra_OVER M))<P>
(614) Theorem 465: [0 and 1 have non-negative rationals] Ra_is_nonneg(Ra_0) & Ra_is_nonneg(Ra_1)<P>
(615) Theorem 466: [One of a rational and its additive inverse is always non-negative, and both are non-negative only if the rational is zero] (X in Ra) ¥imp ((Ra_is_nonneg(X) or Ra_is_nonneg(Ra_Rev(X))) &	((Ra_is_nonneg(X) & Ra_is_nonneg(Ra_Rev(X))) ¥imp (X = Ra_0)))<P>
(616) Theorem 467: [The unit rational is the identity for multiplication] (X in Ra) ¥imp (X = X ¥Ra_TIMES Ra_1)<P>
(617) Theorem 468: [The zero rational is represented by any fraction whose numerator is 0] (X in Ra) ¥imp ((X = Ra_0) ¥eq (car(arb(X)) = [0,0]))<P>
(618) Theorem 469: [The sum and product of two non-negative rationals is non-negative] ((X in Ra) & (Y in Ra) & Ra_is_nonneg(X) & Ra_is_nonneg(Y)) ¥imp	(Ra_is_nonneg(X ¥Ra_PLUS Y) & Ra_is_nonneg(X ¥Ra_TIMES Y))<P>
(619) Theorem 470: (Ra_0 in Ra) &	(FORALL x in Ra | ((x ¥Ra_PLUS Ra_0) = x) & ((x ¥Ra_PLUS Ra_Rev(x)) = Ra_0) & (Ra_Rev(x) in Ra))  &	(FORALL x in Ra, y in Ra | ((x ¥Ra_PLUS y) in Ra) & ((x ¥Ra_PLUS y) = (y ¥Ra_PLUS x)) & ((x ¥Ra_PLUS Ra_Rev(y)) = (x ¥Ra_MINUS y))) &	(FORALL x in Ra, y in Ra, z in Ra | ((x ¥Ra_PLUS y) ¥Ra_PLUS z) = (x ¥Ra_PLUS (y ¥Ra_PLUS z))) &	(FORALL x in Ra, y in Ra | (Ra_is_nonneg(x) & Ra_is_nonneg(y)) ¥imp Ra_is_nonneg(x ¥Ra_PLUS y)) &	(FORALL x in Ra | (Ra_is_nonneg(x) or Ra_is_nonneg(Ra_Rev(x))) & ((Ra_is_nonneg(x) & Ra_is_nonneg(Ra_Rev(x))) ¥imp (x = Ra_0)))<P>
(620) Theorem 471: [The ordering of two rationals is defined by the sign of their differences, 0] (FORALL x, y | (Ra_GE(x,y) ¥eq Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y))) & (Ra_LE(x,y) ¥eq Ra_GE(y,x)) &	(Ra_GT(x,y) ¥eq (Ra_GE(x,y) & (x /= y))) & (Ra_LT(x,y) ¥eq Ra_GT(y,x))) &	(FORALL x, y | (Ra_LE(x,y) ¥eq Ra_is_nonneg((y ¥Ra_PLUS Ra_Rev(x)))) &		(((x in Ra) & (y in Ra)) ¥imp (Ra_GT(x,y) ¥eq (Ra_is_nonneg((x ¥Ra_PLUS Ra_Rev(y))) & (x /= y)))) &		(((x in Ra) & (y in Ra)) ¥imp (Ra_GT(x,y) ¥eq (Ra_is_nonneg((x ¥Ra_MINUS y)) & (x /= y))))) &	(FORALL x, y | ((x in Ra) & (y in Ra) & ((x = y) or (not Ra_GE(x,y)))) ¥imp Ra_GE(y,x))<P>
(621) Theorem 472: [The ordering of two rationals is defined by the sign of their differences] (FORALL x,y | ((x ¥Ra_GE y) ¥eq Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y)))) &	(FORALL x,y | (x ¥Ra_LE y) ¥eq (y ¥Ra_GE x)) &	(FORALL x,y | ((x ¥Ra_GT y) ¥eq ((x ¥Ra_GE y) & (x /= y)))) &	(FORALL x,y | ((x ¥Ra_LT y) ¥eq (y ¥Ra_GT x)))  &    (FORALL x,y | ((x ¥Ra_LE y) ¥eq Ra_is_nonneg(y ¥Ra_PLUS Ra_Rev(x)))) &	(FORALL x,y | (((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_GT y) ¥eq (Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y)) & (x /= y))))) &	(FORALL x,y | (((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_GT y) ¥eq (Ra_is_nonneg(x ¥Ra_MINUS y) & (x /= y))))) &    (FORALL x,y | (((x in Ra) & (y in Ra) & ((x = y) or (not(x ¥Ra_GE y)))) ¥imp (y ¥Ra_GE x)))<P>
(622) Theorem 473: [Various basic properties of rational comparison] ((X ¥Ra_GE Y) ¥eq Ra_is_nonneg(X ¥Ra_PLUS Ra_Rev(Y))) &	((X ¥Ra_LE Y) ¥eq (Y ¥Ra_GE X)) &	((X ¥Ra_GT Y) ¥eq ((X ¥Ra_GE Y) & (X /= Y))) &	((X ¥Ra_LT Y) ¥eq (Y ¥Ra_GT X))  &	((X ¥Ra_LE Y) ¥eq Ra_is_nonneg(Y ¥Ra_PLUS Ra_Rev(X))) &	(((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_GT Y) ¥eq (Ra_is_nonneg(X ¥Ra_PLUS Ra_Rev(Y)) & (X /= Y)))) &	(((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_GT Y) ¥eq (Ra_is_nonneg(X ¥Ra_MINUS Y) & (X /= Y)))) &	(((X in Ra) & (Y in Ra) & ((X = Y) or (not(X ¥Ra_GE Y)))) ¥imp (Y ¥Ra_GE X))<P>
(623) Theorem 474: [Greater_than_equal is greater-than and equal] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_GE Y) ¥eq ((X ¥Ra_GT Y) or (X = Y)))<P>
(624) Theorem 475: [Less_than_equal is less-than and equal] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_LE Y) ¥eq ((X ¥Ra_LT Y) or (X = Y)))<P>
(625) Theorem 476: [The rationals are a linearly ordered set] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_GT Y) or (X = Y) or (Y ¥Ra_GT X))<P>
(626) Theorem 477: [The rationals are a linearly ordered set, 2] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_LT Y) or (X = Y) or (Y ¥Ra_LT X))<P>
(627) Theorem 478: [The rationals are a linearly ordered set,3] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_GT Y) or (Y ¥Ra_GE X))<P>
(628) Theorem 479: [The rationals are a linearly ordered set,4] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_LT Y) or (Y ¥Ra_LE X))<P>
(629) Theorem 480: [Transitivity of ordering] ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_GE Y) & (Y ¥Ra_GE Z)) ¥imp (X ¥Ra_GE Z))<P>
(630) Theorem 481: [Properties of the rational zero and unit] (Ra_Rev(Ra_0) = Ra_0) & (Ra_1 /= Ra_0) & (Ra_1 ¥Ra_GT Ra_0)<P>
(631) Theorem 482: [Alternate characterization of non-negativity for rationals] (X in Ra) ¥imp ((Ra_is_nonneg(X) ¥eq (X ¥Ra_GE Ra_0)) & ((X ¥Ra_GT Ra_0) ¥imp Ra_is_nonneg(X)))<P>
(632) Theorem 483: [Reversing the numerators of two equivalent rational fractions leaves them equivalent] ((X in Si) & (Y in Si) & (XP in Si) & (YP in Si) & Same_frac([X,Y],[XP,YP])) ¥imp	Same_frac([S_Rev(X),Y],[S_Rev(XP),YP])<P>
(633) Theorem 484: [Alternate form of Theorem 483] ((X in Si) & (Y in Si) & (Y /= [0,0])) ¥imp (Ra_Rev(Fr_to_Ra([X,Y])) = Fr_to_Ra([S_Rev(X),Y]))<P>
(634) Theorem 485: [First law of signs for rational multiplication] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_TIMES Ra_Rev(Y)) = Ra_Rev(X ¥Ra_TIMES Y))<P>
(635) Theorem 486: [The reverse of a rational $X$ is the reverse of 1, times $X$] (X in Ra) ¥imp (Ra_Rev(X) = (Ra_Rev(Ra_1) ¥Ra_TIMES X))<P>
(636) Theorem 487: ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp ((X ¥Ra_TIMES (Y ¥Ra_MINUS Z)) = (X ¥Ra_TIMES Y) ¥Ra_MINUS (X ¥Ra_TIMES Z))<P>
(637) Theorem 488: [Strict monotonicity of rational multiplication over 1st argument] ((X in Ra) & (Y in Ra) & (X1 in Ra) & (X ¥Ra_GT Y) & (X1 ¥Ra_GT Ra_0)) ¥imp ((X ¥Ra_TIMES X1) ¥Ra_GT (Y ¥Ra_TIMES X1))<P>
(638) Theorem 489: (X in Ra) ¥imp (X ¥Ra_TIMES Ra_0 = Ra_0)<P>
(639) Theorem 490: ((X in Ra) & (Y in Ra) & (X ¥Ra_GT Ra_0) & (Y ¥Ra_GT Ra_0)) ¥imp ((X ¥Ra_TIMES Y) ¥Ra_GT Ra_0)<P>
(640) Theorem 491: ((X in Ra) & (X ¥Ra_GT Ra_0)) ¥imp (Recip(X) ¥Ra_GT Ra_0)<P>
(640+) Theorem 492: ((X in Ra) & (Y in Ra)) ¥imp (Ra_Rev(X ¥Ra_PLUS Y) = (Ra_Rev(X) ¥Ra_PLUS Ra_Rev(Y)))<P>
(641) Theorem 493: [Monotonicity of rational addition] ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X ¥Ra_GE Y) &	 (XP ¥Ra_GE YP)) ¥imp ((X ¥Ra_PLUS XP) ¥Ra_GE (Y ¥Ra_PLUS YP))<P>
(642) Theorem 494: (X in Ra) ¥imp (Ra_Rev(Ra_Rev(X)) = X)<P>
(643) Theorem 495: ((X in Ra) & (Y in Ra)) ¥imp (((X ¥Ra_GE Y) or (Y ¥Ra_GE X)) &	(((X ¥Ra_GE Y) & (Y ¥Ra_GE X)) ¥imp (X = Y)))<P>
(644) Theorem 496: [Transitivity of ordering, strict case]  ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_GE Y) & (Y ¥Ra_GT Z)) ¥imp (X ¥Ra_GT Z))<P>
(645) Theorem 497: [Transitivity of ordering, strict case 2] ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_GT Y) & (Y ¥Ra_GE Z)) ¥imp (X ¥Ra_GT Z))<P>
(646) Theorem 498: [Transitivity of ordering, strict case 3]  ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_GT Y) & (Y ¥Ra_GT Z)) ¥imp (X ¥Ra_GT Z))<P>
(647) Theorem 499:  [Transitivity of ordering by 'less than'] ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_LE Y) & (Y ¥Ra_LT Z)) ¥imp (X ¥Ra_LT Z))<P>
(648) Theorem 500: [Transitivity of ordering by 'less than', 2] ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_LT Y) & (Y ¥Ra_LE Z)) ¥imp (X ¥Ra_LT Z))<P>
(649) Theorem 501: [Transitivity of ordering by 'less than', 3] ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_LT Y) & (Y ¥Ra_LT Z)) ¥imp (X ¥Ra_LT Z))<P>
(650) Theorem 502: ((X in Ra) & (Y in Ra) & (X ¥Ra_GE Y)) ¥imp (Ra_Rev(Y) ¥Ra_GE Ra_Rev(X))<P>
(651) Theorem 503: ((X in Ra) & (Y in Ra) & (X ¥Ra_GT Y)) ¥imp (Ra_Rev(Y) ¥Ra_GT Ra_Rev(X))<P>
(652) Theorem 504: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X ¥Ra_GE Y) &	 (XP ¥Ra_GT YP)) ¥imp ((X ¥Ra_PLUS XP) ¥Ra_GT (Y ¥Ra_PLUS YP))<P>
(653) Theorem 505: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X ¥Ra_GT Y) &	 (XP ¥Ra_GE YP)) ¥imp ((X ¥Ra_PLUS XP) ¥Ra_GT (Y ¥Ra_PLUS YP))<P>
(654) Theorem 506: ((X in Ra) & (X /= Ra_0)) ¥imp ((Recip(X) /= Ra_0) & Recip(Recip(X)) = X)<P>
(655) Theorem 507: ([2,0] in Si) & (is_nonneg([2,0])) & is_nonneg([1,0]) & (Fr_to_Ra([[1,0],[2,0]]) in Ra) &		(Fr_to_Ra([[1,0],[2,0]]) ¥Ra_GT Ra_0)<P>
(656) Theorem 508: [Transitivity of ordering by 'greater than'] ((X in Ra) & (Y in Ra) & (Z in Ra) &	(X ¥Ra_GE Y) & (Y ¥Ra_GE Z)) ¥imp (X ¥Ra_GE Z)<P>
(657) Theorem 509: [Transitivity of ordering, strict case] ((X in Ra) & (Y in Ra) & (Z in Ra) &	(X ¥Ra_GT Y) & (Y ¥Ra_GE Z)) ¥imp (X ¥Ra_GT Z)<P>
(658) Theorem 510: [Transitivity of ordering, strict case 2] ((X in Ra) & (Y in Ra) & (Z in Ra) &	(X ¥Ra_GE Y) & (Y ¥Ra_GT Z)) ¥imp (X ¥Ra_GT Z)<P>
(659) Theorem 511: ((X in Ra) & (Y in Ra) & (Z in Ra) & (X ¥Ra_GT Y) & (Y ¥Ra_GT Z)) ¥imp (X ¥Ra_GT Z)<P>
(660) Theorem 512: (FORALL x in Ra, y in Ra, z in Ra | ((x ¥Ra_LT y) & (y ¥Ra_LT z)) ¥imp (x ¥Ra_LT z))<P>
(661) Theorem 513: (FORALL x in Ra | not(x ¥Ra_LT x))<P>
(662) Theorem 514: (FORALL x in Ra, y in Ra | (x ¥Ra_LT y) or (x = y) or (y ¥Ra_LT x))<P>
(663) Theorem 515: (FORALL x, y | smaller_Ra(x,y) = if ((x notin Ra) & (y notin Ra)) then Ra elseif (x notin Ra) then y elseif (y notin Ra) then x elseif (x ¥Ra_LT y) then x else y end if) &	(FORALL x, y | smaller_Ra(x,y) = smaller_Ra(y,x)) &	(FORALL x, y | ({x,y} ¥incin Ra) ¥imp (smaller_Ra(x,y) in {x,y})) &	(FORALL x | (x in next(Ra)) ¥imp (smaller_Ra(x,Ra) = x)) &	(FORALL x, y, z | smaller_Ra(x,smaller_Ra(y,z)) = smaller_Ra(smaller_Ra(x,y),z)) &	(FORALL x, y | ((x in next(Ra)) & (y in next(Ra))) ¥imp (smaller_Ra(x,y) in next(Ra))) &	(FORALL f,p,a | (Svm(f) & (range(f) ¥incin Ra) & Finite(f)) ¥imp		(((p in f) ¥imp (min_over_Ra({p}) = (f~[car(p)]))) &		(min_over_Ra(f) = smaller_Ra(min_over_Ra(f ¥ON (domain(f) * a)),min_over_Ra(f ¥ON (domain(f) - a)))))) &	(FORALL f | (Svm(f) & (range(f) ¥incin Ra) & Finite(f) & (f /= 0)) ¥imp (min_over_Ra(f) in range(f))) &	(FORALL x, y | ({x,y} ¥incin Ra) ¥imp ((smaller_Ra(x,y) = x) ¥eq ((x ¥Ra_LT y) or (x = y)))) &	(FORALL t | ubs_Ra(t) = {x in Ra | (FORALL y in (t * Ra) | smaller_Ra(y,x) = y)}) &	(FORALL t | max_Ra(t) = arb({Ra} + (t * ubs_Ra(t)))) &	(FORALL t | lub_Ra(t) = arb({Ra} + {x in ubs_Ra(t) | ubs_Ra(t) ¥incin ubs_Ra({x})})) &	(ubs_Ra(0) = Ra) & (max_Ra(0) = Ra) &	(FORALL t | (ubs_Ra(t) ¥incin Ra) & (ubs_Ra(t) = ubs_Ra(t * Ra)) & (max_Ra(t) = max_Ra(t * Ra))) &	(FORALL t, x | (Finite(t) & (x in t) & (t ¥incin Ra)) ¥imp ((max_Ra(t) in t) & ((x = max_Ra(t)) or ((x ¥Ra_LT max_Ra(t))))))<P>
(664) Theorem 516: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X ¥Ra_GE Y) & (Y ¥Ra_GE Ra_0) &	 (YP ¥Ra_GE Ra_0) & (XP ¥Ra_GE YP)) ¥imp ((X ¥Ra_TIMES XP) ¥Ra_GE (Y ¥Ra_TIMES YP))<P>
(665) Theorem 517: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X ¥Ra_GT Y) & (Y ¥Ra_GT Ra_0) &	 (YP ¥Ra_GT Ra_0) & (XP ¥Ra_GE YP)) ¥imp ((X ¥Ra_TIMES XP) ¥Ra_GT (Y ¥Ra_TIMES YP))<P>
(666) Theorem 518: [The rational reciprocal is monotone decreasing for positive rationals] ((X in Ra) & (Y in Ra) & (X ¥Ra_GT Y) & (Y ¥Ra_GT Ra_0)) ¥imp (Recip(Y) ¥Ra_GT Recip(X))<P>
(667) Theorem 519: [The average of two rational numbers lies between them] ((X in Ra) & (Y in Ra) & (X ¥Ra_GT Y)) ¥imp	((X ¥Ra_GT ((X ¥Ra_PLUS Y) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1))) & (((X ¥Ra_PLUS Y) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_GT Y))<P>
(668) Theorem 520: [Properties of the rational number 2] ((Ra_1 ¥Ra_PLUS Ra_1) in Ra) & ((Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_GT Ra_0) &                (Recip(Ra_1 ¥Ra_PLUS Ra_1) in Ra) &		((X in Ra) ¥imp ((X ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) in Ra))<P>
(669) Theorem 521: [Any rational number can be divided into two equal halves] (X in Ra) ¥imp (X = ((X ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_PLUS (X ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1))))<P>
(670) Theorem 522: [Every positive rational exceeds the sum of two smaller positive rationals] ((X in Ra) & (X ¥Ra_GT Ra_0)) ¥imp (EXISTS e in Ra, e0 in Ra | (X ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e ¥Ra_GT Ra_0) & (X ¥Ra_GT (e ¥Ra_PLUS e0)))<P>
(671) Theorem 523: [Every positive rational exceeds some smaller positive rational] ((X in Ra) & (X ¥Ra_GT Ra_0)) ¥imp (EXISTS e in Ra | (X ¥Ra_GT e) & (e ¥Ra_GT Ra_0))<P>
(672) Theorem 524: [the squares of rational numbers are non-negative] (X in Ra) ¥imp ((X ¥Ra_TIMES X) ¥Ra_GE Ra_0)<P>
(673) Theorem 525: [rational numbers meet facts known about ordered groups in general] (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_PLUS y) = (x ¥Ra_PLUS z)) ¥imp (y = z))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_Rev(x ¥Ra_PLUS Ra_Rev(y)) = (y ¥Ra_PLUS Ra_Rev(x)))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_LE y) or (y ¥Ra_LE x))) &	(FORALL x | (x in Ra) ¥imp (x ¥Ra_LE x)) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_LE y) & (y ¥Ra_LE z)) ¥imp (x ¥Ra_LE z))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_LE y) & (x /= y) & (y ¥Ra_LE z)) ¥imp (x /= z))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_LE y) & (y ¥Ra_LE z) & (y /= z)) ¥imp (x /= z))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp ((x ¥Ra_LE y) ¥imp ((x ¥Ra_PLUS z) ¥Ra_LE (y ¥Ra_PLUS z)))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_PLUS z) = (y ¥Ra_PLUS z)) ¥imp (x = y))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_LE y) & (x /= y)) ¥imp ((x ¥Ra_PLUS z) /= (y ¥Ra_PLUS z)))) &	(FORALL x | (x in Ra) ¥imp (Ra_ABS(x ¥Ra_PLUS Ra_Rev(x)) = Ra_0)) &	(FORALL x | (x in Ra) ¥imp (x ¥Ra_LE Ra_ABS(x))) &	(FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_ABS(x)) = Ra_ABS(x))) &	(FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0))) &	(FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_PLUS y) ¥Ra_LE (Ra_ABS(x) ¥Ra_PLUS Ra_ABS(y)))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp ((Ra_ABS(x ¥Ra_PLUS Ra_Rev(y)) ¥Ra_LE z) ¥imp (y ¥Ra_LE (x ¥Ra_PLUS z)))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_ABS(x ¥Ra_PLUS y) ¥Ra_LE (Ra_ABS(x) ¥Ra_PLUS Ra_ABS(y)))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp ((not(Ra_is_nonneg(x))) ¥imp ((x ¥Ra_LE Ra_ABS(y)) & (x /= Ra_ABS(y))))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (Ra_ABS((x ¥Ra_PLUS Ra_Rev(z))) ¥Ra_LE (Ra_ABS(x ¥Ra_PLUS Ra_Rev(y)) ¥Ra_PLUS Ra_ABS(y ¥Ra_PLUS Ra_Rev(z))))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_is_nonneg(y) ¥imp ((x ¥Ra_PLUS Ra_Rev(y)) ¥Ra_LE (x ¥Ra_PLUS y)))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_ABS(Ra_ABS(x) ¥Ra_PLUS Ra_Rev(Ra_ABS(y))) ¥Ra_LE Ra_ABS(x ¥Ra_PLUS Ra_Rev(y)))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_ABS(x) ¥Ra_PLUS Ra_Rev(Ra_ABS(Ra_ABS(y) ¥Ra_PLUS Ra_Rev(Ra_ABS(x)))) ¥Ra_LE Ra_ABS(y)))<P>
(674) Theorem 526: ((X in Ra) & (Y in Ra) & (not(X ¥Ra_LE Y))) ¥imp (X ¥Ra_GT Y)<P>
(675) Theorem 527: [The absolute value of a rational $x$ is a non-negative rational no smaller than $x$] (X in Ra) ¥imp ((Ra_ABS(X) in Ra) & (Ra_ABS(X) ¥Ra_GE Ra_0) & (Ra_ABS(X) ¥Ra_GE X))<P>
(676) Theorem 528: [The absolute value of a non-negative rational $x$ is $x$] (X in Ra) ¥imp ((X ¥Ra_GE Ra_0) ¥eq (Ra_ABS(X) = X))<P>
(677) Theorem 529: [The absolute value of a rational $x$ greater than $Ra_0$ is $x$] ((X in Ra) & (X ¥Ra_GT Ra_0)) ¥imp (Ra_ABS(X) = X)<P>
(678) Theorem 530: [The absolute value of a rational product is the product of the absolute values] ((X in Ra) & (Y in Ra)) ¥imp (Ra_ABS(X ¥Ra_TIMES Y) = (Ra_ABS(X) ¥Ra_TIMES Ra_ABS(Y)))<P>
(679) Theorem 531: [If the product of two rationals is 0, one of them is 0] ((X in Ra) & (Y in Ra)) ¥imp (((X ¥Ra_TIMES Y) = Ra_0) ¥eq ((X = Ra_0) or (Y = Ra_0)))<P>
(680) Theorem 532: [Cancellation rule for rational multiplication] ((X in Ra) & (Y in Ra) & (U in Ra) & (X /= Ra_0) & ((X ¥Ra_TIMES Y) = (X ¥Ra_TIMES U))) ¥imp (Y = U)<P>
(681) Theorem 533: [The reciprocal of a rational product is the product of the reciprocals] ((X in Ra) & (Y in Ra) & (X /= Ra_0) & (Y /= Ra_0)) ¥imp (Recip(X ¥Ra_TIMES Y) = (Recip(X) ¥Ra_TIMES Recip(Y)))<P>
(682) Theorem 534: [Formula for the sum of two rational quotients] ((X in Ra) & (Y in Ra) & (U in Ra) & (V in Ra) & (X /= Ra_0) & (Y /= Ra_0)) ¥imp (((U ¥Ra_OVER X) ¥Ra_PLUS (V ¥Ra_OVER Y)) = (((Y ¥Ra_TIMES U) ¥Ra_PLUS (X ¥Ra_TIMES V)) ¥Ra_OVER (X ¥Ra_TIMES Y)))<P>
(683) Theorem 535: ((X in Ra) & (Y in Ra) & (X /= Ra_0) & (Y /= Ra_0)) ¥imp ((Recip(X) ¥Ra_MINUS Recip(Y)) = ((Y ¥Ra_MINUS X) ¥Ra_OVER (X ¥Ra_TIMES Y)))<P>
(684) Theorem 536: [The absolute value of the reciprocal equals the reciprocal of the absolute value] ((X in Ra) & (X /= Ra_0)) ¥imp (Ra_ABS(Recip(X)) = Recip(Ra_ABS(X)))<P>
(684+) Theorem 537: ((X in Ra) & (Y in Ra)) ¥imp (Ra_ABS(X ¥Ra_MINUS Y) = Ra_ABS(Y ¥Ra_MINUS X))<P>
(685) Theorem 538: ((X in Ra) & (Y in Ra) & (A in Ra) & (B in Ra) & (Ra_ABS(X) ¥Ra_GT A) & (Ra_ABS(Y) ¥Ra_GT B) & (A ¥Ra_GT Ra_0) & (B ¥Ra_GT Ra_0)) ¥imp (Ra_ABS(Recip(X) ¥Ra_MINUS Recip(Y)) ¥Ra_LE (Ra_ABS(X ¥Ra_MINUS Y) ¥Ra_TIMES (Recip(A) ¥Ra_TIMES Recip(B))))<P>
(686) Theorem 539: [Every Rational Cauchy sequence is a rational sequence] RaCauchy ¥incin RaSeq<P>
(687) Theorem 540: [The range of a rational sequence is included in the set of rationals] (F in RaSeq) ¥imp ((domain(F) = Za) & Svm(F) & (range(F) ¥incin Ra) & ((X in Za) ¥imp (F~[X] in Ra)))<P>
(688) Theorem 541: [Reformulation of condition for sequence equivalence] ({F,G} ¥incin RaSeq) ¥imp (Ra_eqseq(F,G) ¥eq (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp		Finite({x : x in Za | Ra_ABS((F~[x]) ¥Ra_MINUS (G~[x])) ¥Ra_GT eps})))<P>
(689) Theorem 542: [Condition for rational sequence equality] (FORALL n in Za | ((F in RaSeq) & (G in RaSeq) & (F~[n] = G~[n]))) ¥imp (F = G)<P>
(690) Theorem pointwiseU.1: h = {[u,uop(fp~[u])]: u in d}<P>
(691) Theorem pointwiseU.2: Svm(h) & (domain(h) = d) & (range(h) ¥incin r)<P>
(692) Theorem pointwiseU.3: (FORALL x in d | h~[x] = uop(fp~[x]))<P>
(693) Theorem pointwise.1: h = {[u,bop(fq~[u],fp~[u])]: u in d}<P>
(694) Theorem pointwise.2: Svm(h) & (domain(h) = d) & (range(h) ¥incin r)<P>
(694+) Theorem pointwise.3: (FORALL x in d | h~[x] = bop(fq~[x],fp~[x]))<P>
(695) Theorem 543: (X in Ra) ¥imp ((Za ¥PROD {X}) in RaCauchy)<P>
(696) Theorem 544: (X in Ra) ¥imp (Ras_ABS(Za ¥PROD {X}) = (Za ¥PROD {Ra_ABS(X)}))<P>
(697) Theorem 545: {Ra0Seq,Ra1Seq} ¥incin RaCauchy<P>
(698) Theorem 546: (F in RaSeq) ¥imp ((domain(F) = Za) & Svm(F) & (range(F) ¥incin Ra) & Ra_eqseq(F,F))<P>
(699) Theorem 547: ((F in RaSeq) & (N in Za) & (I in Za)) ¥imp ((shifted_seq(F,N)~[I]) = (F~[N ¥PLUS I]))<P>
(700) Theorem 548: (U in Za) ¥imp (((Ra0Seq~[U]) = Ra_0) & ((Ra1Seq~[U]) = Ra_1))<P>
(701) Theorem 549: ((F in RaCauchy) & (G in Subseqs(F)) & (not Finite(G))) ¥imp ((G in RaCauchy) & Ra_eqseq(F,G))<P>
(702) Theorem 550: (F in RaCauchy) ¥imp ((H in Za) ¥imp (F~[H] in Ra))<P>
(703) Theorem 551: ((Eps in Ra) & (Eps ¥Ra_GT Ra_0) & (F in RaCauchy)) ¥imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (not (Ra_ABS((F~[i]) ¥Ra_MINUS (F~[j]))) ¥Ra_GT Eps)))<P>
(704)  Theorem 552: ((Eps in Ra) & (Eps ¥Ra_GT Ra_0) & (F in RaCauchy)) ¥imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (Eps ¥Ra_GT (Ra_ABS((F~[i]) ¥Ra_MINUS (F~[j])))) ))<P>
(705) Theorem 553: (({F,G,H} ¥incin RaSeq) & Ra_eqseq(F,G) & Ra_eqseq(G,H)) ¥imp Ra_eqseq(H,F)<P>
(706) Theorem 554: ({F,G} ¥incin RaSeq) ¥imp	(((F ¥Ras_PLUS G) in RaSeq) &		(Ras_ABS(G) in RaSeq) &		(Ras_Rev(G) in RaSeq) &		((F ¥Ras_TIMES G) in RaSeq) &		((F ¥Ras_PLUS G) = {[u,((F~[u]) ¥Ra_PLUS  (G~[u]))]: u in Za}) &		(Ras_ABS(G) = {[u,Ra_ABS(G~[u])]: u in Za}) &		(Ras_Rev(G) = {[u,Ra_Rev(G~[u])]: u in Za}) &		((F ¥Ras_TIMES G) = {[u,((F~[u]) ¥Ra_TIMES (G~[u]))]: u in Za}))<P>
(707) Theorem 555: (({F1,G1} ¥incin RaSeq) & (N in Za)) ¥imp ((F1~[N] in Ra) & (G1~[N] in Ra) &		((F1 ¥Ras_PLUS G1 in RaSeq) & ((F1 ¥Ras_PLUS G1)~[N] = (F1~[N]) ¥Ra_PLUS (G1~[N]))) &		(((Ras_ABS(G1) in RaSeq) & (Ras_ABS(G1)~[N] = Ra_ABS(G1~[N])))) &		(((Ras_Rev(G1) in RaSeq) & (Ras_Rev(G1)~[N] = Ra_Rev(G1~[N])))) &		(((F1 ¥Ras_TIMES G1 in RaSeq) & (F1 ¥Ras_TIMES G1)~[N] = ((F1~[N]) ¥Ra_TIMES (G1~[N])))))<P>
(708) Theorem 556: ({F,G} ¥incin RaCauchy) ¥imp	(((F ¥Ras_PLUS G) in RaCauchy) & (Ras_ABS(F) in RaCauchy) & (Ras_Rev(F) in RaCauchy))<P>
(709) Theorem 557: ((S ¥incin Ra) & Finite(S)) ¥imp (EXISTS u in Ra | (FORALL y in S | u ¥Ra_GE y))<P>
(710) Theorem 558: [Every finite set of integers has a strict upper bound] ((S ¥incin Za) & Finite(S)) ¥imp (EXISTS u in Za | (FORALL y in S | y in u))<P>
(711) Theorem 559: [Every rational Cauchy sequence has an upper bound] (F in RaCauchy) ¥imp (EXISTS x in Ra | (FORALL y in range(F) | y ¥Ra_LE x))<P>
(712) Theorem 560: (F in RaCauchy) ¥imp (EXISTS x in Ra | (FORALL y in range(F) | Ra_ABS(y) ¥Ra_LT x ))<P>
(713) Theorem 561: ({F,G} ¥incin RaCauchy) ¥imp (((F ¥Ras_MINUS G) in RaCauchy) & ((F ¥Ras_TIMES G) in RaCauchy))<P>
(714) Theorem 562: ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) ¥imp (EXISTS eps in Ra | (eps ¥Ra_GT Ra_0) & Finite({i in Za | eps ¥Ra_GE Ra_ABS(G~[i])}))<P>
(715) Theorem 563: ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) ¥imp (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &		(FORALL i in (Za - n) | (Ra_ABS(G~[i]) ¥Ra_GT eps) & (Ra_ABS(G~[i]) ¥Ra_GT Ra_0)) & (Ra_ABS(G~[n]) ¥Ra_GT Ra_0))<P>
(716) Theorem 564: ((H in RaCauchy) & (not Ra_eqseq(H,Ra0Seq))) ¥imp (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &	(FORALL i in (Za - n) | Ra_ABS(H~[i]) ¥Ra_GT eps) &	(FORALL i in Za, j in Za | ((i notin n) & (j notin n)) ¥imp (eps ¥Ra_GT (Ra_ABS((H~[i]) ¥Ra_MINUS (H~[j]))))))<P>
(717) Theorem 565: ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) ¥imp ({h in Za | (FORALL i in (Za - h) | (G~[i]) /= Ra_0)} /= 0)<P>
(718) Theorem 566: ((F in RaSeq) & (M = arb({h in Za | (FORALL i in (Za - h) | (F~[i]) /= Ra_0)}))) ¥imp (Ras_Recip(F) = Ras_Recip(shifted_seq(F,M)))<P>
(719) Theorem 567: ((F in RaCauchy) & (M in Za)) ¥imp ((shifted_seq(F,M) in RaCauchy) & Ra_eqseq(F,shifted_seq(F,M)))<P>
(720) Theorem 568: ((F in RaCauchy) & (not Ra_eqseq(F,Ra0Seq))) ¥imp (EXISTS g in RaCauchy | Ra_eqseq(F,g) & (Ras_Recip(F) = Ras_Recip(g)) &	(FORALL i in Za | ((g~[i]) /= Ra_0) & (Ras_Recip(g)~[i] = Recip(g~[i]))))<P>
(721) Theorem 569: [The reciprocal of a non-null rational sequence is a rational sequence] ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) ¥imp (Ras_Recip(G) in RaSeq)<P>
(722) Theorem 570: [Reciprocal and quotient of rational Cauchy sequences are, when defined, Cauchy sequences] (({F,G} ¥incin RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) ¥imp ((Ras_Recip(G) in RaCauchy) & ((F ¥Ras_OVER G) in RaCauchy))<P>
(723) Theorem 571: (({F,G,Fp,Gp} ¥incin RaSeq) & Ra_eqseq(F,G) & Ra_eqseq(Fp,Gp)) ¥imp Ra_eqseq(F ¥Ras_PLUS Fp, G ¥Ras_PLUS Gp)<P>
(724) Theorem 572: (({F,G,Fp,Gp} ¥incin RaCauchy) & Ra_eqseq(F,G) & Ra_eqseq(Fp,Gp)) ¥imp Ra_eqseq(F ¥Ras_PLUS Fp, G ¥Ras_PLUS Gp)<P>
(725) Theorem 573: (({F,Fp,G} ¥incin RaCauchy) & Ra_eqseq(F,Fp)) ¥imp Ra_eqseq(F ¥Ras_TIMES G, Fp ¥Ras_TIMES G)<P>
(726) Theorem 574: (({F,G,Fp,Gp} ¥incin RaCauchy) & Ra_eqseq(F,G) & Ra_eqseq(Fp,Gp)) ¥imp Ra_eqseq(F ¥Ras_TIMES Fp, G ¥Ras_TIMES Gp)<P>
(727) Theorem 575: (({F,G} ¥incin RaCauchy) & Ra_eqseq(F,G)) ¥imp Ra_eqseq(Ras_Rev(F),Ras_Rev(G))<P>
(728) Theorem 576: (({F,G} ¥incin RaCauchy) & Ra_eqseq(F,G)) ¥imp Ra_eqseq(Ras_ABS(F),Ras_ABS(G))<P>
(729) Theorem 577: (({F,G} ¥incin RaCauchy) & Ra_eqseq(F,G) & (not(Ra_eqseq(F,Ra0Seq)))) ¥imp Ra_eqseq(Ras_Recip(F),Ras_Recip(G))<P>
(730) Theorem 578: ({F,G} ¥incin RaSeq) ¥imp (F ¥Ras_PLUS G = G ¥Ras_PLUS F)<P>
(731) Theorem 579: ({F,G} ¥incin RaSeq) ¥imp (F ¥Ras_TIMES G = G ¥Ras_TIMES F)<P>
(732) Theorem 580: ({F,G,H} ¥incin RaSeq) ¥imp	((F ¥Ras_PLUS G) ¥Ras_PLUS H = F ¥Ras_PLUS (G ¥Ras_PLUS H))<P>
(733) Theorem 581: ({F,G,H} ¥incin RaSeq) ¥imp	((F ¥Ras_TIMES G) ¥Ras_TIMES H = F ¥Ras_TIMES (G ¥Ras_TIMES H))<P>
(734) Theorem 582: [Double-inversion law for rational sequences] (X in RaSeq) ¥imp (Ras_Rev(Ras_Rev(X))=X)<P>
(735) Theorem 583: [Distributive law for multiplication of rational sequences] ({X,Y,V} ¥incin RaSeq) ¥imp ((X ¥Ras_TIMES (Y ¥Ras_PLUS V)) = ((X ¥Ras_TIMES Y) ¥Ras_PLUS (X ¥Ras_TIMES V)))<P>
(736) Theorem 584: [Law of signs for multiplication of rational sequences] ({X,Y} ¥incin RaSeq) ¥imp ((X ¥Ras_TIMES Ras_Rev(Y)) = Ras_Rev(X ¥Ras_TIMES Y))<P>
(737) Theorem 585: [Law of signs for multiplication of rational sequences, 2] ({X,Y} ¥incin RaSeq) ¥imp (((Ras_Rev(X) ¥Ras_TIMES Y) = Ras_Rev(X ¥Ras_TIMES Y)) & ((Ras_Rev(X) ¥Ras_TIMES Ras_Rev(Y)) = (X ¥Ras_TIMES Y)))<P>
(738) Theorem 586: [Any rational sequence times 0 is 0] (X in RaSeq) ¥imp ((X ¥Ras_TIMES Ra0Seq) = Ra0Seq)<P>
(739) Theorem 587: [0 is a right additive identity for rational sequences] (X in RaSeq) ¥imp (X ¥Ras_PLUS Ra0Seq = X)<P>
(740) Theorem 588: [1 is a left multiplicative identity for rational sequences] (X in RaSeq) ¥imp (X ¥Ras_TIMES Ra1Seq = X)<P>
(741) Theorem 589: [0 is right subtractive identity for rational sequence subtraction] (X in RaSeq) ¥imp (X ¥Ras_MINUS Ra0Seq = X)<P>
(742) Theorem 590: [Basic properties of the signed negative for rational sequences] (X in RaSeq) ¥imp ((Ras_Rev(X) in RaSeq) & ((Ras_Rev(X) ¥Ras_PLUS X) = Ra0Seq) & (Ras_Rev(Ras_Rev(X)) = X))<P>
(743) Theorem 591: [Reciprocal sequence principle] ((X in RaCauchy) & (not Ra_eqseq(X,Ra0Seq))) ¥imp Ra_eqseq(X ¥Ras_TIMES Ras_Recip(X),Ra1Seq)<P>
(744) Theorem 592: [The negative of a sum of rational sequences is the sum of the negatives] ((X in RaSeq) & (Y in RaSeq)) ¥imp (Ras_Rev(X ¥Ras_PLUS Y) = Ras_Rev(X) ¥Ras_PLUS Ras_Rev(Y))<P>
(745) Theorem 593: [A rational sequence minus itself gives 0] (X in RaSeq) ¥imp ((X ¥Ras_MINUS X) = Ra0Seq)<P>
(746) Theorem 594: [Multiplication by $Ras_Rev(Ra1Seq)$] (X in RaSeq) ¥imp (Ras_Rev(X) = (Ras_Rev(Ra1Seq) ¥Ras_TIMES X))<P>
(747) Theorem 595: [The zero sequence is its own negative] Ras_Rev(Ra0Seq) = Ra0Seq<P>
(748) Theorem 596: [The zero/unit sequence is its own absolute value] (Ras_ABS(Ra0Seq) = Ra0Seq) & (Ras_ABS(Ra1Seq) = Ra1Seq)<P>
(749) Theorem 597: [?] ((H in RaCauchy) & Ra_eqseq(H,Ra0Seq)) ¥imp (Ra_eqseq(Ras_ABS(H),Ra0Seq) & (Ra_eqseq(Ras_Rev(H),Ra0Seq)))<P>
(750) Theorem 598: [All terms of a Cauchy sequence not equivalent to zero have the same sign and have an absolute value bounded below beyond a certain point] ((F in RaCauchy) &	(not Ra_eqseq(F,Ra0Seq))) ¥imp (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) & (FORALL i in (Za - n) | (Ra_ABS(F~[i]) ¥Ra_GT eps) &	(Ra_ABS(F~[i]) = if ((F~[n]) ¥Ra_GE Ra_0) then (F~[i]) else Ra_Rev(F~[i]) end if) ))<P>
(751) Theorem 599: [All terms of a Cauchy sequence not equivalent to zero have the same sign beyond a certain point] ((F in RaCauchy) &	(not Ra_eqseq(F,Ra0Seq))) ¥imp (EXISTS n in Za | shifted_seq(Ras_ABS(F),n) =	if ((F~[n]) ¥Ra_GE Ra_0) then shifted_seq(F,n) else shifted_seq(Ras_Rev(F),n) end if)<P>
(752) Theorem 600: [A rational Cauchy sequence is equivalent to zero iff both it and its additive inverse are equivalent to its absolute value] (F in RaCauchy) ¥imp (Ra_eqseq(F,Ra0Seq) ¥eq (Ra_eqseq(Ras_ABS(F),F) & Ra_eqseq(Ras_ABS(F),Ras_Rev(F))))<P>
(753) Theorem 601: [One of a Cauchy sequence and its additive inverse is always equivalent to a non-negative sequence] ((F in RaCauchy) & (not Ra_eqseq(F,Ra0Seq))) ¥imp	(EXISTS n in Za | ((shifted_seq(Ras_ABS(F),n) = shifted_seq(F,n)) & Ra_eqseq(Ras_ABS(F),F)) or			((shifted_seq(Ras_ABS(F),n) = shifted_seq(Ras_Rev(F),n)) & Ra_eqseq(Ras_ABS(F),Ras_Rev(F))))<P>
(754) Theorem 602: [One of a Cauchy sequence $F$ and its additive inverse is always equivalent to a non-negative sequence, and both are equivalent to non-negative sequences only if $F$ is equivalent to zero] (F in RaCauchy) ¥imp ((Ra_eqseq(Ras_ABS(F),F) or Ra_eqseq(Ras_ABS(F),Ras_Rev(F))) & (((Ra_eqseq(Ras_ABS(F),F) & Ra_eqseq(Ras_ABS(F),Ras_Rev(F)))) ¥imp Ra_eqseq(F,Ra0Seq)))<P>
(755) Theorem 603: [The unit Cauchy sequences $Ra0Seq,Ra1Seq$ differ from one another] (not Ra_eqseq(Ra0Seq,Ra1Seq))<P>
(756) Theorem 604: [A rational sequence F and its additive inverse have the same absolute value] (F in RaSeq) ¥imp (Ras_ABS(Ras_Rev(F)) = Ras_ABS(F))<P>
(757) Theorem 605: (F in RaSeq) ¥imp (((F ¥Ras_PLUS Ra0Seq) = F) & ((F ¥Ras_TIMES Ra1Seq) = F))<P>
(758) Theorem 606: (FORALL f in RaCauchy, g in RaCauchy | (Ra_eqseq(f,g) ¥eq Ra_eqseq(g,f)) & Ra_eqseq(f,f))<P>
(759) Theorem 607: ((F in RaCauchy) & (G in RaCauchy)) ¥imp ((Ra_eqseq(F,G) ¥eq Ra_eqseq(G,F)) & Ra_eqseq(F,F))<P>
(760) Theorem 608: (FORALL f in RaCauchy, g in RaCauchy, h in RaCauchy | (Ra_eqseq(f,g) & Ra_eqseq(g,h)) ¥imp Ra_eqseq(f,h))<P>
(761)     Theorem 609: (FORALL x, y | ((x in RaCauchy) & (y in RaCauchy)) ¥imp ((Ra_eqseq(x,y) ¥eq (Cauchy_to_Re(x) = Cauchy_to_Re(y))))) &    (FORALL x | (x in Re) ¥imp ((arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x))) &    (FORALL x | (x in RaCauchy) ¥imp (Cauchy_to_Re(x) in Re)) &    (FORALL x | (x in RaCauchy) ¥imp Ra_eqseq(x,arb(Cauchy_to_Re(x))))<P>
(762) Theorem 610: ((X in RaCauchy) & (Y in RaCauchy)) ¥imp ((Ra_eqseq(X,Y) ¥eq (Cauchy_to_Re(X) = Cauchy_to_Re(Y))) & (Cauchy_to_Re(X) in Re) & Ra_eqseq(X,arb(Cauchy_to_Re(X))))<P>
(763) Theorem 611: (X in Re) ¥imp ((arb(X) in RaCauchy) & (arb(X) in RaSeq) & (Cauchy_to_Re(arb(X)) = X))<P>
(764) Theorem 612: (R_0 in Re) & (R_1 in Re)<P>
(765) Theorem 613: ({X,Y} ¥incin Re) ¥imp (((X ¥R_PLUS Y) in Re) & (R_Rev(X) in Re))<P>
(766) Theorem 614: ({X,Y} ¥incin Re) ¥imp (((X ¥R_MINUS Y) in Re) & ((X ¥R_TIMES Y) in Re))<P>
(767) Theorem 615: [Commutative law for real addition] ({X,Y} ¥incin Re) ¥imp ((X ¥R_PLUS Y) = (Y ¥R_PLUS X))<P>
(768) Theorem 616: [Elementary algebraic lemma for real addition] ((X in RaCauchy) & (Y in RaCauchy)) ¥imp (Cauchy_to_Re(X ¥Ras_PLUS Y) = (Cauchy_to_Re(X) ¥R_PLUS Cauchy_to_Re(Y)))<P>
(769) Theorem 617: [Associative law for real addition] ({X,Y,V} ¥incin Re) ¥imp ((X ¥R_PLUS (Y ¥R_PLUS V)) = ((X ¥R_PLUS Y) ¥R_PLUS V))<P>
(770) Theorem 618: [Commutative law for real multiplication] ({X,Y} ¥incin Re) ¥imp ((X ¥R_TIMES Y) = (Y ¥R_TIMES X))<P>
(771) Theorem 619: [Elementary algebraic lemma for real multiplication] ((X in RaCauchy) & (Y in RaCauchy)) ¥imp (Cauchy_to_Re(X ¥Ras_TIMES Y) = (Cauchy_to_Re(X) ¥R_TIMES Cauchy_to_Re(Y)))<P>
(772) Theorem 620: [Associative law for real multiplication] ({X,Y,V} ¥incin Re) ¥imp ((X ¥R_TIMES (Y ¥R_TIMES V)) = ((X ¥R_TIMES Y) ¥R_TIMES V))<P>
(773) Theorem 621: [Distributive law for real multiplication] ({X,Y,V} ¥incin Re) ¥imp ((X ¥R_TIMES (Y ¥R_PLUS V)) = ((X ¥R_TIMES Y) ¥R_PLUS (X ¥R_TIMES V)))<P>
(774) Theorem 622: [Lemma for law of signs] (X in RaCauchy) ¥imp (Cauchy_to_Re(Ras_Rev(X)) = R_Rev(Cauchy_to_Re(X)))<P>
(775) Theorem 623: [Law of signs for real multiplication] ({X,Y} ¥incin Re) ¥imp (((X ¥R_TIMES R_Rev(Y)) = R_Rev(X ¥R_TIMES Y)) & ((R_Rev(X) ¥R_TIMES Y) = R_Rev(X ¥R_TIMES Y)) & ((R_Rev(X) ¥R_TIMES R_Rev(Y)) = (X ¥R_TIMES Y)))<P>
(776) Theorem 624: [Any real times 0 is 0] (X in Re) ¥imp ((X ¥R_TIMES R_0) = R_0)<P>
(777) Theorem 625: [0 times any real is 0] (X in Re) ¥imp (R_0 ¥R_TIMES X = R_0)<P>
(778) Theorem 626: [0 is a right and left additive identity for reals] (X in Re) ¥imp ((X ¥R_PLUS R_0 = X) & (R_0 ¥R_PLUS X = X))<P>
(779) Theorem 627: [1 is a right multiplicative identity for reals] (X in Re) ¥imp (X ¥R_TIMES R_1 = X)<P>
(780) Theorem 628: [1 is a left multiplicative identity for reals] (X in Re) ¥imp (R_1 ¥R_TIMES X = X)<P>
(781) Theorem 629: [The zero real is its own negative] R_Rev(R_0) = R_0<P>
(782) Theorem 630: [0 is right identity for real subtraction] (X in Re) ¥imp (X ¥R_MINUS R_0 = X)<P>
(783) Theorem 631: [Real subtraction principle] (X in Re) ¥imp (X ¥R_MINUS X = R_0)<P>
(784) Theorem 632: [Basic properties of the signed negative for reals] (X in Re) ¥imp ((R_Rev(X) in Re) & ((R_Rev(X) ¥R_PLUS X) = R_0))<P>
(784+) Theorem 633: [Basic properties of the signed negative for reals, 2] (X in Re) ¥imp (R_Rev(R_Rev(X)) = X)<P>
(785) Theorem 634: [Real additive Cancellation] ((X in Re) & (Y in Re) & (V in Re) & (X ¥R_PLUS V = Y ¥R_PLUS V)) ¥imp (X = Y)<P>
(786) Theorem 635: [Real subtraction is addition of the negative] ((X in Re) & (Y in Re)) ¥imp ((X ¥R_MINUS Y) = (X ¥R_PLUS R_Rev(Y)))<P>
(787) Theorem 636: [The sum of a real number and its additive inverse is zero] (X in Re) ¥imp ((R_Rev(X) in Re) & ((X ¥R_PLUS R_Rev(X)) = R_0))<P>
(788) Theorem 637: [The negative of a real $x$ is zero iff $x$ is zero] (X in Re) ¥imp ((R_Rev(X) = R_0) ¥eq (X = R_0))<P>
(789) Theorem 638: [The negative of a real sum is the sum of the negatives] ((X in Re) & (Y in Re)) ¥imp (R_Rev(X ¥R_PLUS Y) = R_Rev(X) ¥R_PLUS R_Rev(Y))<P>
(790) Theorem 639: [Real addition-subtraction commutativity] ((X in Re) & (Y in Re) & (V in Re)) ¥imp (X ¥R_MINUS (Y ¥R_PLUS V) = (X ¥R_MINUS Y) ¥R_MINUS V)<P>
(791) Theorem 640: [Real subtraction reverses addition] ((X in Re) & (Y in Re)) ¥imp ((X ¥R_PLUS Y) ¥R_MINUS Y = X)<P>
(792) Theorem 641: [Real subtraction reverses  addition, 2] ((X in Re) & (Y in Re)) ¥imp (X = (Y ¥R_PLUS (X ¥R_MINUS Y)))<P>
(793) Theorem 642: [Multiplication by $R_Rev(R_1)$] (X in Re) ¥imp (R_Rev(X) = R_Rev(R_1) ¥R_TIMES X)<P>
(794) Theorem 643: [Distributivity of multiplication over subtraction] ((X in Re) & (Y in Re) & (V in Re)) ¥imp ((X ¥R_TIMES (Y ¥R_MINUS V)) = ((X ¥R_TIMES Y) ¥R_MINUS (X ¥R_TIMES V)))<P>
(795) Theorem 644: [Additive inverse of real difference] ((X in Re) & (Y in Re)) ¥imp (R_Rev(X ¥R_MINUS Y) = (Y ¥R_MINUS X))<P>
(796) Theorem 645: [Real reciprocal principle] ((X in Re) & (X /= R_0)) ¥imp (X ¥R_TIMES R_Recip(X) = R_1)<P>
(797) Theorem 646: [Real division principle] ((X in Re) & (X /= R_0)) ¥imp (X ¥R_OVER X = R_1)<P>
(798) Theorem 647: [Basic properties of the reciprocal for reals] ((X in Re) & (X /= R_0)) ¥imp ((R_Recip(X) in Re) & (R_Recip(X) /= R_0) & ((R_Recip(X) ¥R_TIMES X) = R_1))<P>
(799) Theorem 648: [Basic properties of the reciprocal for reals, 2] ((X in Re) & (X /= R_0)) ¥imp (R_Recip(R_Recip(X)) = X)<P>
(800) Theorem 649: [Reverse of real reciprocal] ((X in Re) & (X /= R_0)) ¥imp (R_Recip(R_Rev(X)) = R_Rev(R_Recip(X)))<P>
(801) Theorem 650: [Real multiplicative Cancellation] ((X in Re) & (Y in Re) & (V in Re) & (X ¥R_TIMES V = Y ¥R_TIMES V) & (V /= R_0)) ¥imp (X = Y)<P>
(802) Theorem 651: [Reals are closed under division] ((X in Re) & (Y in Re) & (Y /= R_0)) ¥imp ((X ¥R_OVER Y in Re) & ((X /= R_0) ¥imp ((X ¥R_OVER Y /= R_0) & (X ¥R_TIMES Y /= R_0))))<P>
(803) Theorem 652: [Real division is multiplication by the reciprocal] ((X in Re) & (Y in Re) & (Y /= R_0)) ¥imp ((X ¥R_OVER Y) = (X ¥R_TIMES R_Recip(Y)))<P>
(804) Theorem 653: [The reciprocal of a real product is the product of the reciprocals] ((X in Re) & (Y in Re) & (X /= R_0) & (Y /= R_0)) ¥imp ((X ¥R_TIMES Y /= R_0) & R_Recip(X ¥R_TIMES Y) = R_Recip(X) ¥R_TIMES R_Recip(Y))<P>
(805) Theorem 654: [Real multiplication-division commutativity] ((X in Re) & (Y in Re) & (Y /= R_0) & (V in Re) & (V /= R_0)) ¥imp (X ¥R_OVER (Y ¥R_TIMES V) = (X ¥R_OVER Y) ¥R_OVER V)<P>
(806) Theorem 655: [A real divided by itself gives 1] ((X in Re) & (X /= R_0)) ¥imp (X ¥R_OVER X = R_1)<P>
(807) Theorem 656: [Real reciprocal as a quotient] ((X in Re) & (X /= R_0)) ¥imp (R_Recip(X) = R_1 ¥R_OVER X)<P>
(808) Theorem 657: [Distributivity of division over addition] ((X in Re) & (Y in Re) & (V in Re) & (V /= R_0)) ¥imp ((X ¥R_PLUS Y) ¥R_OVER V = ((X ¥R_OVER V) ¥R_PLUS (Y ¥R_OVER V)))<P>
(809) Theorem 658: [Real division reverses multiplication] ((X in Re) & (Y in Re) & (Y /= R_0)) ¥imp ((X ¥R_TIMES Y) ¥R_OVER Y = X)<P>
(810) Theorem 659: [Real division reverses multiplication,2] ((X in Re) & (Y in Re) & (Y /= R_0)) ¥imp (X = (Y ¥R_TIMES (X ¥R_OVER Y)))<P>
(811) Theorem 660: [Distributivity of division over subtraction] ((X in Re) & (Y in Re) & (V in Re) & (V /= R_0)) ¥imp (((X ¥R_MINUS Y) ¥R_OVER V) = ((X ¥R_OVER V) ¥R_MINUS (Y ¥R_OVER V)))<P>
(812) Theorem 661: (X in Re) ¥imp ((R_Rev(X) = Cauchy_to_Re(arb(R_Rev(X)))) & Ra_eqseq(Ras_ABS(arb(X)),arb(Cauchy_to_Re(Ras_ABS(arb(X))))))<P>
(813) Theorem 662: ((X in Re) & (Y in Re)) ¥imp Ra_eqseq((arb(X) ¥Ras_PLUS arb(Y)),arb(Cauchy_to_Re(arb(X) ¥Ras_PLUS arb(Y))))<P>
(814) Theorem 663: [Any real $x$ or its reverse is non-negative, and if both are non-negative, then $x = 0$] (X in Re) ¥imp ((R_is_nonneg(X) or R_is_nonneg(R_Rev(X))) & ((R_is_nonneg(X) & R_is_nonneg(R_Rev(X))) ¥imp (X = R_0)))<P>
(815) Theorem 664: [Each non-negative rational Cauchy sequences is equivalent to its own absolute value] (X in Re) ¥imp (R_is_nonneg(X) ¥eq Ra_eqseq(arb(X),Ras_ABS(arb(X))))<P>
(816) Theorem 665: [The sum of two non-negative rational Cauchy sequences is equivalent to its own absolute value] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) ¥imp Ra_eqseq(arb(X) ¥Ras_PLUS arb(Y),Ras_ABS(arb(X) ¥Ras_PLUS arb(Y)))<P>
(817) Theorem 666: [The product of two non-negative rational Cauchy sequences is equivalent to its own absolute value] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) ¥imp Ra_eqseq(arb(X) ¥Ras_TIMES arb(Y),Ras_ABS(arb(X) ¥Ras_TIMES arb(Y)))<P>
(818) Theorem 667: [The sum and product of two non-negative reals is non-negative] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) ¥imp (R_is_nonneg(X ¥R_PLUS Y) & R_is_nonneg(X ¥R_TIMES Y))<P>
(819) Theorem 668: [Transitivity of ordering] ((X in Re) & (Y in Re) & (Z in Re) & (X ¥R_GE Y) & (Y ¥R_GE Z)) ¥imp (X ¥R_GE Z)<P>
(820) Theorem 669: [The reals are a linearly ordered set] ((X in Re) & (Y in Re)) ¥imp ((X ¥R_GT Y) or (X = Y) or (Y ¥R_GT X))<P>
(821) Theorem 670: [The reals are a linearly ordered set, 2] ((X in Re) & (Y in Re)) ¥imp ((X ¥R_LT Y) or (X = Y) or (Y ¥R_LT X))<P>
(822) Theorem 671: [0 and 1 are non-negative reals] R_is_nonneg(R_0) & R_is_nonneg(R_1)<P>
(823) Theorem 672: [The reals are a linearly ordered set, 3] ((X in Re) & (Y in Re)) ¥imp (((X ¥R_GE Y) or (Y ¥R_GE X)) & (((X ¥R_GE Y) & (Y ¥R_GE X)) ¥imp (X = Y)))<P>
(824) Theorem 673: [The ordering of reals is defined by the sign of their differences] ((((X in Re) & (Y in Re)) ¥imp ((X ¥R_GE Y) ¥eq R_is_nonneg(X ¥R_PLUS R_Rev(Y))))) & ((X ¥R_LE Y) ¥eq (Y ¥R_GE X)) & ((X ¥R_GT Y) ¥eq ((X ¥R_GE Y) & (X /= Y))) & ((X ¥R_LT Y) ¥eq (Y ¥R_GT X))<P>
(825) Theorem 674: [Various basic properties of real comparison, quantified form] (FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_GE y) ¥eq R_is_nonneg(x ¥R_PLUS R_Rev(y)))) & (FORALL x, y | ((x ¥R_LE y) ¥eq (y ¥R_GE x))) & (FORALL x, y | ((x ¥R_GT y) ¥eq ((x ¥R_GE y) & (x /= y)))) & (FORALL x, y | ((x ¥R_LT y) ¥eq (y ¥R_GT x))) & (FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_LE y) ¥eq (R_is_nonneg(y ¥R_PLUS R_Rev(x))))) & (FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_PLUS R_Rev(y)) & (x /= y)))) & (FORALL x, y | (((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_MINUS y) & (x /= y))))) & (FORALL x, y | ((x in Re) & (y in Re) & ((x = y) or (not(x ¥R_GE y)))) ¥imp (y ¥R_GE x))<P>
(826) Theorem 675: [Various basic properties of real comparison] (((X in Re) & (Y in Re)) ¥imp ((X ¥R_GE Y) ¥eq R_is_nonneg(X ¥R_PLUS R_Rev(Y)))) & ((X ¥R_LE Y) ¥eq (Y ¥R_GE X)) & ((X ¥R_GT Y) ¥eq ((X ¥R_GE Y) & (X /= Y))) & ((X ¥R_LT Y) ¥eq (Y ¥R_GT X)) & (((X in Re) & (Y in Re)) ¥imp ((X ¥R_LE Y) ¥eq R_is_nonneg(Y ¥R_PLUS R_Rev(X)))) & (((X in Re) & (Y in Re)) ¥imp ((X ¥R_GT Y) ¥eq (R_is_nonneg(X ¥R_PLUS R_Rev(Y)) & (X /= Y)))) & (((X in Re) & (Y in Re)) ¥imp ((X ¥R_GT Y) ¥eq (R_is_nonneg(X ¥R_MINUS Y) & (X /= Y)))) & (((X in Re) & (Y in Re) & ((X = Y) or (not(X ¥R_GE Y)))) ¥imp (Y ¥R_GE X))<P>
(827) Theorem 676: [Mutual exclusion of strict real comparators] ((X in Re) & (Y in Re) & (X ¥R_GT Y)) ¥imp (not(X ¥R_LT Y))<P>
(828) Theorem 677: [Transitivity of ordering, strict case] ((X in Re) & (Y in Re) & (Z in Re) & (X ¥R_GT Y) & (Y ¥R_GE Z)) ¥imp (X ¥R_GT Z)<P>
(829) Theorem 678: [Transitivity of ordering, strict case 2] ((X in Re) & (Y in Re) & (Z in Re) & (X ¥R_GE Y) & (Y ¥R_GT Z)) ¥imp (X ¥R_GT Z)<P>
(830) Theorem 679: [Transitivity of ordering,strict case 3] ((X in Re) & (Y in Re) & (Z in Re) & (X ¥R_GT Y) & (Y ¥R_GT Z)) ¥imp (X ¥R_GT Z)<P>
(831) Theorem 680: [Greater_than_equal is greater-than and equal] ((X in Re) & (Y in Re)) ¥imp ((X ¥R_GE Y) ¥eq ((X ¥R_GT Y) or (X = Y)))<P>
(832) Theorem 681: [Greater_than_equal is greater-than and equal] (X in Re) ¥imp ((X ¥R_GE R_0) ¥eq R_is_nonneg(X))<P>
(833) Theorem 682: [Less_than_equal is less-than and equal] ((X in Re) & (Y in Re)) ¥imp ((X ¥R_LE Y) ¥eq ((X ¥R_LT Y) or (X = Y)))<P>
(834) Theorem 683: [Transitivity of ordering by 'less than'] ((X in Re) & (Y in Re) & (Z in Re)) ¥imp (((X ¥R_LE Y) & (Y ¥R_LT Z)) ¥imp (X ¥R_LT Z))<P>
(835) Theorem 684: [Transitivity of ordering by 'less than', 2] ((X in Re) & (Y in Re) & (Z in Re)) ¥imp (((X ¥R_LT Y) & (Y ¥R_LE Z)) ¥imp (X ¥R_LT Z))<P>
(836) Theorem 685: [Transitivity of ordering by 'less than', 3] ((X in Re) & (Y in Re) & (Z in Re)) ¥imp (((X ¥R_LT Y) & (Y ¥R_LT Z)) ¥imp (X ¥R_LT Z))<P>
(837) Theorem 686: [No real is less than itself] not(X ¥R_LT X)<P>
(838) Theorem 687: (FORALL x in Re, y in Re, z in Re | ((x ¥R_LT y) & (y ¥R_LT z)) ¥imp (x ¥R_LT z))<P>
(839) Theorem 688: (FORALL x in Re | not(x ¥R_LT x))<P>
(840) Theorem 689: (FORALL x in Re, y in Re | (x ¥R_LT y) or (x = y) or (y ¥R_LT x))<P>
(841) Theorem 690: (FORALL x, y | smaller_Re(x,y) = if ((x notin Re) & (y notin Re)) then Re elseif (x notin Re) then y elseif (y notin Re) then x elseif (x ¥R_LT y) then x else y end if) &	(FORALL x, y | smaller_Re(x,y) = smaller_Re(y,x)) &	(FORALL x, y | ({x,y} ¥incin Re) ¥imp (smaller_Re(x,y) in {x,y})) &	(FORALL x | (x in next(Re)) ¥imp (smaller_Re(x,Re) = x)) &	(FORALL x, y, z | smaller_Re(x,smaller_Re(y,z)) = smaller_Re(smaller_Re(x,y),z)) &	(FORALL x, y | ((x in next(Re)) & (y in next(Re))) ¥imp (smaller_Re(x,y) in next(Re))) &	(FORALL f,p,a | (Svm(f) & (range(f) ¥incin Re) & Finite(f)) ¥imp		(((p in f) ¥imp (min_over_Re({p}) = (f~[car(p)]))) &		(min_over_Re(f) = smaller_Re(min_over_Re(f ¥ON (domain(f) * a)),min_over_Re(f ¥ON (domain(f) - a)))))) &	(FORALL f | (Svm(f) & (range(f) ¥incin Re) & Finite(f) & (f /= 0)) ¥imp (min_over_Re(f) in range(f))) &	(FORALL x, y | ({x,y} ¥incin Re) ¥imp ((smaller_Re(x,y) = x) ¥eq ((x ¥R_LT y) or (x = y)))) &	(FORALL t | ubs_Re(t) = {x in Re | (FORALL y in (t * Re) | smaller_Re(y,x) = y)}) &	(FORALL t | max_Re(t) = arb({Re} + (t * ubs_Re(t)))) &	(FORALL t | lub_Re(t) = arb({Re} + {x in ubs_Re(t) | ubs_Re(t) ¥incin ubs_Re({x})})) &	(ubs_Re(0) = Re) & (max_Re(0) = Re) &	(FORALL t | (ubs_Re(t) ¥incin Re) & (ubs_Re(t) = ubs_Re(t * Re)) & (max_Re(t) = max_Re(t * Re))) &	(FORALL t, x | (Finite(t) & (x in t) & (t ¥incin Re)) ¥imp ((max_Re(t) in t) & ((x = max_Re(t)) or ((x ¥R_LT max_Re(t))))))<P>
(842) Theorem 691: [Sign reversal inverts comparisons] ((X in Re) & (Y in Re) & (X ¥R_GE Y)) ¥imp (R_Rev(Y) ¥R_GE R_Rev(X))<P>
(843) Theorem 692: [Sign reversal inverts comparisons,2] ((X in Re) & (Y in Re)) ¥imp (((X ¥R_GE Y) ¥eq (R_Rev(Y) ¥R_GE R_Rev(X))) & ((X ¥R_GT Y) ¥eq (R_Rev(Y) ¥R_GT R_Rev(X))))<P>
(844) Theorem 693: [Properties of the real zero and unit] (R_Rev(R_0) = R_0) & (R_1 /= R_0) & (R_1 ¥R_GT R_0) & (R_Recip(R_1) = R_1)<P>
(845) Theorem 694: [Monotonicity of addition over 2nd argument] ((X in Re) & (XP in Re) & (YP in Re) & (XP ¥R_GE YP)) ¥imp ((X ¥R_PLUS XP) ¥R_GE (X ¥R_PLUS YP))<P>
(846) Theorem 695: [Monotonicity of real addition] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X ¥R_GE Y) & (XP ¥R_GE YP)) ¥imp ((X ¥R_PLUS XP) ¥R_GE (Y ¥R_PLUS YP))<P>
(847) Theorem 696: [Strict monotonicity of addition] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X ¥R_GE Y) & (XP ¥R_GT YP)) ¥imp ((X ¥R_PLUS XP) ¥R_GT (Y ¥R_PLUS YP))<P>
(848) Theorem 697: [Strict monotonicity of addition] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X ¥R_GT Y) & (XP ¥R_GE YP)) ¥imp ((X ¥R_PLUS XP) ¥R_GT (Y ¥R_PLUS YP))<P>
(849) Theorem 698: [Strict monotonicity of addition, 2] ((X in Re) & (Y in Re) & (V in Re) & (X ¥R_GE Y)) ¥imp (((Y ¥R_PLUS V) ¥R_GE (X ¥R_PLUS V)) ¥eq (X = Y))<P>
(850) Theorem 699: ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & (X ¥R_PLUS Y = R_0)) ¥imp ((X = R_0) & (Y = R_0))<P>
(851) Theorem 700: [The product of two reals is 0 if and only if one of them is 0] ((X in Re) & (Y in Re)) ¥imp (((X ¥R_TIMES Y) = R_0) ¥eq ((X = R_0) or (Y = R_0)))<P>
(852) Theorem 701: [Monotonicity of multiplication over 2nd argument] ((X in Re) & (XP in Re) & (YP in Re) & (X ¥R_GE R_0) & (XP ¥R_GE YP)) ¥imp ((X ¥R_TIMES XP) ¥R_GE (X ¥R_TIMES YP))<P>
(853) Theorem 702: [Monotonicity of multiplication] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X ¥R_GE Y) & (Y ¥R_GE R_0) & (YP ¥R_GE R_0) & (XP ¥R_GE YP)) ¥imp ((X ¥R_TIMES XP) ¥R_GE (Y ¥R_TIMES YP))<P>
(854) Theorem 703: [Strict monotonicity of multiplication over 2nd argument] ((X in Re) & (XP in Re) & (YP in Re) & (X ¥R_GT R_0) & (XP ¥R_GT YP)) ¥imp ((X ¥R_TIMES XP) ¥R_GT (X ¥R_TIMES YP))<P>
(855) Theorem 704: [Strict monotonicity of multiplication] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X ¥R_GE Y) & (Y ¥R_GT R_0) & (YP ¥R_GT R_0) & (XP ¥R_GT YP)) ¥imp ((X ¥R_TIMES XP) ¥R_GT (Y ¥R_TIMES YP))<P>
(856) Theorem 705: [Multiplication by a positive real is strictly monotone] ((X in Re) & (Y in Re) & (Z in Re) & (X ¥R_GT Y) & (Z ¥R_GT R_0)) ¥imp ((X ¥R_TIMES Z) ¥R_GT (Y ¥R_TIMES Z))<P>
(857) Theorem 706: [The product of reals $x,y$ of which $x$ is positive is non-negative iff $y$ is non-negative] ((X in Re) & (Y in Re) & (X /= R_0) & R_is_nonneg(X)) ¥imp (R_is_nonneg(X ¥R_TIMES Y) ¥eq R_is_nonneg(Y))<P>
(858) Theorem 707: [The product of nonnegative reals is non-negative] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) ¥imp R_is_nonneg(X ¥R_TIMES Y)<P>
(859) Theorem 708: [Condition for positiveness of a product of reals] ((X in Re) & (Y in Re)) ¥imp (((X ¥R_TIMES Y) ¥R_GT R_0) ¥eq (((X ¥R_GT R_0) & (Y ¥R_GT R_0)) or ((R_0 ¥R_GT X) & (R_0 ¥R_GT Y))))<P>
(860) Theorem 709: [The reciprocal of a positive real is positive] ((X in Re) & (X ¥R_GT R_0)) ¥imp (R_Recip(X) ¥R_GT R_0)<P>
(861) Theorem 710: [The sum of non-negative reals is at least as big at each addend] ((X in Re) & (Y in Re) & (X ¥R_GE R_0)) ¥imp ((X ¥R_PLUS Y) ¥R_GE Y)<P>
(862) Theorem 711: [The sum of non-negative reals is zero only if the addends are zero] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & (X ¥R_PLUS Y = R_0)) ¥imp ((X = R_0) & (Y = R_0))<P>
(863) Theorem 712: [The reciprocal is monotone decreasing for positive reals] ((X in Re) & (Y in Re) & (X ¥R_GT Y) & (Y ¥R_GT R_0)) ¥imp (R_Recip(Y) ¥R_GT R_Recip(X))<P>
(864) Theorem 713: [Two non-null reals are equal iff their reciprocals are equal] ((X in Re) & (X /= R_0) & (Y in Re) & (Y /= R_0) & (R_Recip(X) = R_Recip(Y))) ¥imp (X = Y)<P>
(865) Theorem 714: [The square of any real is non-negative] (X in Re) ¥imp R_is_nonneg(X ¥R_TIMES X)<P>
(865+) Theorem 715: [Monotonicity of squaring] ((X in Re) & (Y in Re) & (X ¥R_GE R_0) & (Y ¥R_GE R_0)) ¥imp ((X ¥R_GE Y) ¥eq ((X ¥R_TIMES X) ¥R_GE (Y ¥R_TIMES Y)))<P>
(866) Theorem 716: [Properties of the real number 2] ((R_1 ¥R_PLUS R_1) in Re) & ((R_1 ¥R_PLUS R_1) ¥R_GT R_0) & (R_Recip(R_1 ¥R_PLUS R_1) in Re) & (R_Recip(R_1 ¥R_PLUS R_1) /= R_0) & ((X in Re) ¥imp ((X ¥R_OVER (R_1 ¥R_PLUS R_1)) in Re))<P>
(867) Theorem 717: [Any real number can be divided into two equal halves] (X in Re) ¥imp (X = (X ¥R_OVER (R_1 ¥R_PLUS R_1)) ¥R_PLUS (X ¥R_OVER (R_1 ¥R_PLUS R_1)))<P>
(868) Theorem 718: [The average of two real numbers lies between them] ((X in Re) & (Y in Re) & (X ¥R_GT Y)) ¥imp ((X ¥R_GT ((X ¥R_PLUS Y) ¥R_OVER (R_1 ¥R_PLUS R_1))) & (((X ¥R_PLUS Y) ¥R_OVER (R_1 ¥R_PLUS R_1)) ¥R_GT Y))<P>
(869) Theorem 719: [Every positive real exceeds the sum of two smaller positive reals] ((X in Re) & (X ¥R_GT R_0)) ¥imp (EXISTS e in Re , e0 in Re | (X ¥R_GT e) & (e ¥R_GT e0) & (e0 ¥R_GT R_0) & (e ¥R_GT R_0) & (X ¥R_GT (e ¥R_PLUS e0)))<P>
(870) Theorem 720: [Every positive real exceeds some smaller positive real] ((X in Re) & (X ¥R_GT R_0)) ¥imp (EXISTS e in Re | (X ¥R_GT e) & (e ¥R_GT R_0))<P>
(871) Theorem 721: [Trigger for Otter theory 'orderedGroups'] (R_0 in Re) &	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) in Re)) &	(FORALL x | (x in Re) ¥imp (R_Rev(x) in Re)) &	(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) ¥imp (((x ¥R_PLUS y) ¥R_PLUS z) = (x ¥R_PLUS (y ¥R_PLUS z)))) &	(FORALL x | (x in Re) ¥imp ((x ¥R_PLUS R_0) = x)) &	(FORALL x | (x in Re) ¥imp ((x ¥R_PLUS R_Rev(x)) = R_0)) &	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) = (y ¥R_PLUS x))) &	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((R_is_nonneg(x) & R_is_nonneg(y)) ¥imp R_is_nonneg(x ¥R_PLUS y))) &	(FORALL x | (x in Re) ¥imp (R_is_nonneg(x) or R_is_nonneg(R_Rev(x)))) &	(FORALL x | (x in Re) ¥imp ((R_is_nonneg(x) & R_is_nonneg(R_Rev(x))) ¥imp (x = R_0))) &	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_LE y) ¥eq R_is_nonneg(y ¥R_PLUS R_Rev(x))))<P>
(872) Theorem 722: [Basic properties of the absolute value function] (FORALL x | abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if) &	(FORALL x | (x in Re) ¥imp (x ¥R_LE abs(x))) &	(FORALL x | (x in Re) ¥imp (abs(abs(x)) = abs(x))) &	(FORALL x | (x in Re) ¥imp ((abs(x) = R_0) ¥eq (x = R_0))) &	(FORALL x | (x in Re) ¥imp (abs(R_Rev(x)) = abs(x))) &	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) ¥R_LE (abs(x) ¥R_PLUS abs(y)))) &	(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) ¥imp ((abs(x ¥R_PLUS R_Rev(y)) ¥R_LE z) ¥imp (y ¥R_LE (x ¥R_PLUS z)))) &	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp (abs(x ¥R_PLUS y) ¥R_LE (abs(x) ¥R_PLUS abs(y)))) &	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((not(R_is_nonneg(x))) ¥imp ((x ¥R_LE abs(y)) & (x /= abs(y))))) &	(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) ¥imp (abs((x ¥R_PLUS R_Rev(z))) ¥R_LE (abs(x ¥R_PLUS R_Rev(y)) ¥R_PLUS abs(y ¥R_PLUS R_Rev(z))))) &	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp (abs(abs(x) ¥R_PLUS R_Rev(abs(y))) ¥R_LE abs(x ¥R_PLUS R_Rev(y)))) &	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp (abs(x) ¥R_PLUS R_Rev(abs(abs(y) ¥R_PLUS R_Rev(abs(x)))) ¥R_LE abs(y)))<P>
(873) Theorem 723: [The absolute value of $x$ is a non-negative real no smaller than $x$] (X in Re) ¥imp ((abs(X) in Re) & (abs(X) ¥R_GE R_0) & (abs(X) ¥R_GE X) & (R_is_nonneg(abs(X))))<P>
(874) Theorem 724: [The absolute value of $x$ is whichever of $x$ and $-x$ is non-negative] (X in Re) ¥imp (abs(X) = if R_is_nonneg(X) then X else R_Rev(X) end if)<P>
(875) Theorem 725: [The absolute value of $x$ is whichever of $x$ and $-x$ is non-negative, 2] (X in Re) ¥imp (abs(X) = if R_is_nonneg(R_Rev(X)) then R_Rev(X) else X end if)<P>
(876) Theorem 726: [The absolute value of a real product is the product of absolute values] ((X in Re) & (Y in Re)) ¥imp (abs(X ¥R_TIMES Y) = (abs(X) ¥R_TIMES abs(Y)))<P>
(877) Theorem 727: [$x$ and $-x$ have the same absolute value] (X in Re) ¥imp (abs(X) = abs(R_Rev(X)))<P>
(878) Theorem 728: [Monotonicity of addition, 2] ((X in Re) & (Y in Re) & R_is_nonneg(R_Rev(Y))) ¥imp ((X ¥R_GT (X ¥R_PLUS Y)) or (X = (X ¥R_PLUS Y)))<P>
(879) Theorem 729: ((X in Re) & (Y in Re) & R_is_nonneg(X) & (not R_is_nonneg(Y))) ¥imp		((X ¥R_GE abs(X ¥R_PLUS Y)) or (R_Rev(Y) ¥R_GE abs(X ¥R_PLUS Y)))<P>
(880) Theorem 730: ((X in Re) & (Y in Re)) ¥imp (((X ¥R_PLUS abs(Y)) ¥R_GE X))<P>
(881) Theorem 731: ((X in Re) & (Y in Re)) ¥imp (((abs(X) ¥R_PLUS abs(Y)) ¥R_GT abs(X ¥R_PLUS Y)) or ((abs(X) ¥R_PLUS abs(Y)) = abs(X ¥R_PLUS Y)))<P>
(882) Theorem 732: [The absolute value of a real quotient is the quotient of absolute values]  ((X in Re) & (Y in Re) & (Y /= R_0)) ¥imp ((abs(X) ¥R_OVER abs(Y)) = abs(X ¥R_OVER Y))<P>
(883) Theorem 733: (X in Ra) ¥imp (Ra_is_nonneg(X) ¥eq Ra_eqseq(Za ¥PROD {Ra_ABS(X)},Za ¥PROD {X}))<P>
(884) Theorem 734: (X in Ra) ¥imp (R_is_nonneg(Cauchy_to_Re(Za ¥PROD {X})) ¥eq (ReRa(Ra_ABS(X)) = ReRa(X)))<P>
(885) Theorem 735: [The embedding of rationals into reals preserves all elementary algebraic operations, 1]  (Y in Ra) ¥imp ((ReRa(Y) in Re) &	(ReRa(Ra_Rev(Y)) = R_Rev(ReRa(Y))) &	(R_is_nonneg(ReRa(Y)) ¥eq Ra_is_nonneg(Y)) &	(ReRa(Ra_ABS(Y)) = abs(ReRa(Y))))<P>
(886) Theorem 736: [The embedding of rationals into reals preserves all elementary algebraic operations, 2]  ((X in Ra) & (Y in Ra)) ¥imp ((ReRa(X) in Re) & (ReRa(Y) in Re) &	(ReRa(X ¥Ra_PLUS Y) = ReRa(X) ¥R_PLUS ReRa(Y)) &	(ReRa(X ¥Ra_TIMES Y) = ReRa(X) ¥R_TIMES ReRa(Y)))<P>
(887) Theorem 737: [The embedding of rationals into reals preserves all elementary algebraic operations, 3]  ((X in Ra) & (Y in Ra)) ¥imp			(ReRa(X ¥Ra_MINUS Y) = (ReRa(X) ¥R_MINUS ReRa(Y)))<P>
(888) Theorem 738: [The embedding of rationals into reals is 1-1]  ((X in Ra) & (Y in Ra)) ¥imp ((ReRa(X) = ReRa(Y)) ¥eq (X = Y))<P>
(889) Theorem 739: [The embedding of rationals into reals preserves 0 and 1]  (ReRa(Ra_0) = R_0) & (ReRa(Ra_1) = R_1)<P>
(890) Theorem 740: [The embedding of rationals into reals preserves quotients by nonzero quantities]  ((X in Ra) & (Y in Ra) & (Y /= Ra_0)) ¥imp			((R_Recip(ReRa(Y)) = ReRa(Recip(Y))) &			((ReRa(X) ¥R_OVER ReRa(Y)) = ReRa(X ¥Ra_OVER Y)))<P>
(891) Theorem 741: [The embedding of rationals into reals preserves ordering]  ((X in Ra) & (Y in Ra)) ¥imp (((ReRa(X) ¥R_GE ReRa(Y)) ¥eq (X ¥Ra_GE Y)) &		((ReRa(X) ¥R_GT ReRa(Y)) ¥eq (X ¥Ra_GT Y)) &		((ReRa(Y) ¥R_LE ReRa(X)) ¥eq (Y ¥Ra_LE X)) &		((ReRa(Y) ¥R_LT ReRa(X)) ¥eq (Y ¥Ra_LT X)))<P>
(892) Theorem 742: [The images of rationals via the embedding form a dense subset of the reals, 1] ((X in Re) & (Eps in Ra) & (Eps ¥Ra_GT Ra_0)) ¥imp (EXISTS y in Ra | Finite({m in Za | Ra_ABS(((arb(X))~[m]) ¥Ra_MINUS y) ¥Ra_GE Eps}) )<P>
(893) Theorem 743: [The embedding of signed integers into rationals preserves all elementary algebraic operations, 1]  (X in Si) ¥imp ((RaSi(X) in Ra) &	(Ra_is_nonneg(RaSi(X)) ¥eq is_nonneg(X)) & (RaSi(S_Rev(X)) = Ra_Rev(RaSi(X))) & (RaSi(S_ABS(X)) = Ra_ABS(RaSi(X))))<P>
(894) Theorem 744: [The embedding of signed integers into rationals preserves all elementary algebraic operations, 2]  ((X in Si) & (Y in Si)) ¥imp ((RaSi(X) in Ra) & (RaSi(Y) in Ra) &	(RaSi(X ¥S_PLUS Y) = RaSi(X) ¥Ra_PLUS RaSi(Y)) &	(RaSi(X ¥S_TIMES Y) = RaSi(X) ¥Ra_TIMES RaSi(Y)))<P>
(895) Theorem 745: [The embedding of signed integers into rationals preserves all elementary algebraic operations, 3]  ((X in Si) & (Y in Si)) ¥imp	(RaSi(X ¥S_MINUS Y) = RaSi(X) ¥Ra_MINUS RaSi(Y))<P>
(896) Theorem 746: [The embedding of signed integers into rationals is 1-1]  ((X in Si) & (Y in Si)) ¥imp ((RaSi(X) = RaSi(Y)) ¥eq (X = Y))<P>
(897) Theorem 747: [The embedding of signed integers into rationals preserves 0 and 1]  RaSi([0,0]) = Ra_0 & RaSi([1,0]) = Ra_1<P>
(897+) Theorem 748: [The embedding of signed integers into rationals preserves ordering]  ((X in Si) & (Y in Si)) ¥imp (((RaSi(X) ¥Ra_GE RaSi(Y)) ¥eq (X ¥S_GE Y)) &			((RaSi(X) ¥Ra_GT RaSi(Y)) ¥eq (X ¥S_GT Y)) &			((RaSi(Y) ¥Ra_LE RaSi(X)) ¥eq (Y ¥S_LE X)) &			((RaSi(Y) ¥Ra_LT RaSi(X)) ¥eq (Y ¥S_LT X)))<P>
(898) Theorem 749: [The embedding of integers into signed integers preserves all elementary algebraic operations on integers]  ((X in Za) & (Y in Za)) ¥imp ((SiZa(X) in Si) & (SiZa(Y) in Si) &	(SiZa(X ¥PLUS Y) = SiZa(X) ¥S_PLUS SiZa(Y)) &	(SiZa(X ¥TIMES Y) = SiZa(X) ¥S_TIMES SiZa(Y)))<P>
(899) Theorem 750: [The embedding of integers into signed integers is 1-1]  ((X in Za) & (Y in Za) & (SiZa(X) = SiZa(Y))) ¥imp (X = Y)<P>
(900) Theorem 751: [The embedding of integers into signed integers preserves 0 and 1]  (SiZa(0) = [0,0]) & (SiZa(1) = [1,0])<P>
(901) Theorem 752: [The embedding of integers into signed integers preserves ordering]  ((X in Za) & (Y in Za)) ¥imp (((SiZa(X) ¥S_GE SiZa(Y)) ¥eq (X incs Y)) &			((SiZa(X) ¥S_GT SiZa(Y)) ¥eq (Y in X)) &			((SiZa(Y) ¥S_LE SiZa(X)) ¥eq (Y ¥incin X)) &			((SiZa(Y) ¥S_LT SiZa(X)) ¥eq (Y in X)))<P>
(902) Theorem 753: [Elementary properties of the real absolute value]  ((X in Re) & (Y in Re)) ¥imp ((abs(X) in Re) & (abs(Y) in Re) &			(abs(X ¥R_TIMES Y) = (abs(X) ¥R_TIMES abs(Y))) & ((abs(X) ¥R_PLUS abs(Y)) ¥R_GE abs(X ¥R_PLUS Y) & (abs(R_Rev(X)) = abs(X))))<P>
(903) Theorem 754: [Every real Cauchy sequence is a real sequence] ReCauchy ¥incin ReSeq<P>
(904) Theorem 755: [The range of a real sequence is included in the set of reals] (F in ReSeq) ¥imp ((domain(F) = Za) & Svm(F) & (range(F) ¥incin Re) & ((X in Za) ¥imp (F~[X] in Re)))<P>
(905) Theorem 756: ({F,G} ¥incin ReSeq) ¥imp	(((F ¥Res_PLUS G) in ReSeq) &		(Res_ABS(G) in ReSeq) &		(Res_Rev(G) in ReSeq) &		((F ¥Res_TIMES G) in ReSeq) &		((F ¥Res_PLUS G) = {[u,((F~[u]) ¥R_PLUS  (G~[u]))]: u in Za}) &		(Res_ABS(G) = {[u,abs(G~[u])]: u in Za}) &		(Res_Rev(G) = {[u,R_Rev(G~[u])]: u in Za}) &		((F ¥Res_TIMES G) = {[u,((F~[u]) ¥R_TIMES (G~[u]))]: u in Za}))<P>
(906) Theorem 757: (({F1,G1} ¥incin ReSeq) & (N in Za)) ¥imp ((F1~[N] in Re) & (G1~[N] in Re) &		((F1 ¥Res_PLUS G1 in ReSeq) & ((F1 ¥Res_PLUS G1)~[N] = (F1~[N]) ¥R_PLUS (G1~[N]))) &		(((Res_ABS(G1) in ReSeq) & (Res_ABS(G1)~[N] = abs(G1~[N])))) &		(((Res_Rev(G1) in ReSeq) & (Res_Rev(G1)~[N] = R_Rev(G1~[N])))) &		(((F1 ¥Res_TIMES G1 in ReSeq) & (F1 ¥Res_TIMES G1)~[N] = ((F1~[N]) ¥R_TIMES (G1~[N])))))<P>
(907) Theorem 758: ({F,G} ¥incin ReCauchy) ¥imp	(((F ¥Res_PLUS G) in ReCauchy) & (Res_ABS(F) in ReCauchy) & (Res_Rev(F) in ReCauchy))<P>
(908) Theorem 759: ((Eps in Re) & (Eps ¥R_GT R_0) & (F in ReCauchy)) ¥imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (not (abs((F~[i]) ¥R_MINUS (F~[j]))) ¥R_GT Eps)))<P>
(909) Theorem 760: ((Eps in Re) & (Eps ¥R_GT R_0) & (F in ReCauchy)) ¥imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (Eps ¥R_GT (abs((F~[i]) ¥R_MINUS (F~[j])))) ))<P>
(910) Theorem 761: ((S ¥incin Re) & Finite(S)) ¥imp (EXISTS u in Re | (FORALL y in S | u ¥R_GE y))<P>
(911) Theorem 762: [Every real Cauchy sequence has an upper bound] (F in ReCauchy) ¥imp (EXISTS x in Re | (FORALL y in range(F) | y ¥R_LE x))<P>
(912) Theorem 763: (F in ReCauchy) ¥imp (EXISTS x in Re | (FORALL y in range(F) | abs(y) ¥R_LT x ))<P>
(913) Theorem 764: ({F,G} ¥incin ReCauchy) ¥imp (((F ¥Res_MINUS G) in ReCauchy) & ((F ¥Res_TIMES G) in ReCauchy))<P>
(914) Theorem 765: [Every real Cauchy sequence can be approximated by a rational sequence] (F in ReCauchy) ¥imp (0 /= {g in RaCauchy | Ra_apseq(F,g)})<P>
(915) Theorem 766: [Every real Cauchy sequence has a real limit] (F in ReCauchy) ¥imp ((Ra_approx(F) in RaCauchy) & (Ra_approx(F) in RaSeq) & Ra_apseq(F,Ra_approx(F)) & (limit(F) in Re))<P>
(916) Theorem 767: [The limit of a real Cauchy sequence is the real defined by any of its rational approximations] ((F in ReCauchy) & (G in RaSeq) & Ra_apseq(F,G)) ¥imp ((G in RaCauchy) & (Cauchy_to_Re(G) = limit(F)))<P>
(917) Theorem 768: [The elementary operations on reals map Cauchy sequences into Cauchy sequences] ((F in ReCauchy) & (G in ReCauchy) & (Fp in RaCauchy) & (Gp in RaCauchy) & Ra_apseq(F,Fp) & Ra_apseq(G,Gp)) ¥imp			((((F ¥Res_PLUS G in ReCauchy) & Ra_apseq(F ¥Res_PLUS G,Fp ¥Ras_PLUS Gp))) &			(((F ¥Res_MINUS G in ReCauchy) & Ra_apseq(F ¥Res_MINUS G,Fp ¥Ras_MINUS Gp))) &			(((F ¥Res_TIMES G in ReCauchy) & Ra_apseq(F ¥Res_TIMES G,Fp ¥Ras_TIMES Gp))))<P>
(918) Theorem 769: [The limit of a sum is the sum of limits] ((F in ReCauchy) & (G in ReCauchy)) ¥imp (limit(F ¥Res_PLUS G) = (limit(F) ¥R_PLUS limit(G)))<P>
(919) Theorem 770: [The limit of a difference is the difference of limits] ((F in ReCauchy) & (G in ReCauchy)) ¥imp (limit(F ¥Res_MINUS G) = limit(F) ¥R_MINUS limit(G))<P>
(920) Theorem 771: [The limit of a product is the product of limits] ((F in ReCauchy) & (G in ReCauchy)) ¥imp (limit(F ¥Res_TIMES G) = limit(F) ¥R_TIMES limit(G))<P>
(921) Theorem 772: [The limit of a quotient is the quotient of limits, provided that the denominator limit  is non-zero] ((F in ReCauchy) & (G in ReCauchy) & (limit(G) /= R_0)) ¥imp (limit(F ¥Res_OVER G) = limit(F) ¥R_OVER limit(G))<P>
(922) Theorem 773: [Any real $x$ is included between two rationals which can be arbitrarily close together] ((X in Re) & (EPS in Re) & (EPS ¥R_GT R_0)) ¥imp (EXISTS r1 in Ra, r2 in Ra | ((ReRa(r1) ¥R_GT X) & (X ¥R_GT ReRa(r2)) & (ReRa(r1 ¥Ra_MINUS r2) ¥R_LE EPS)))<P>
(923) Theorem 774: [For any real $x$, there exists a rational $r$ such that $r >= x$] (X in Re) ¥imp (EXISTS r in Ra | ReRa(r) ¥R_GT X)<P>
(924) Theorem 775: [Any rational $r$ is the quotient of two signed integers, of which the second is positive] (x in Ra) ¥imp (EXISTS m in Si, n in Si | ((n ¥S_GE [1,0]) & (x = RaSi(m) ¥Ra_OVER RaSi(n))))<P>
(925) Theorem 776: [For any rational $r$, there exists an integer $n$ such that $n >= r$] (R in Ra) ¥imp (EXISTS n in Za | RaSi(SiZa(n)) ¥Ra_GE R)<P>
(926) Theorem 777: [For any real $x$, there exists an integer $n$ such that $n > x$] (X in Re) ¥imp (EXISTS n in Za | ReRa(RaSi(SiZa(n))) ¥R_GT X)<P>
(927) Theorem 778: [For any real $x$ and $eps > 0$, there exists an integer $n$ such that $n ¥ eps > x$] ((X in Re) & (Eps in Re) & (Eps ¥R_GT R_0)) ¥imp (EXISTS n in Za | ((ReRa(RaSi(SiZa(n))) ¥R_TIMES Eps) ¥R_GT X))<P>
(928) Theorem 779: [For any real $x$ and $eps > 0$, there exists an integer $n$ such that $eps > x/n$] ((X in Re) & (Eps in Re) & (Eps ¥R_GT R_0)) ¥imp (EXISTS n in Za | (Eps ¥R_GT (X ¥R_OVER ReRa(RaSi(SiZa(n))))))<P>
(929) Theorem 780: [For any non-negative real $x$ and $eps > 0$, there exists an integer $n$ such that $n ¥R_TIMES eps > x$ and $(n - 1) ¥ eps <= x$] ((X in Re) & (Eps in Re) & (Eps ¥R_GT R_0)) ¥imp (EXISTS n in Za | (Eps ¥R_GT (X ¥R_OVER ReRa(RaSi(SiZa(n))))))<P>
(930) Theorem 781: [Every positive real is bounded below by a rational fraction of the form $1/n$]  ((X in Re) & (X ¥R_GT R_0)) ¥imp (EXISTS n in Za | (R_1 ¥R_OVER ReRa(RaSi(SiZa(n)))) ¥R_LT X)<P>
(931) Theorem 782: [Every real Cauchy sequence is approximated by a rational Cauchy sequence] (F in ReCauchy) ¥imp (EXISTS g in RaCauchy | Ra_apseq(F,g))<P>
(932) Theorem 783: [Any two approximating rational sequences for a given real Cauchy sequence are equivalent]  ((F in ReCauchy) & Ra_apseq(F,G) & Ra_apseq(F,GP)) ¥imp ((G in RaCauchy) & (GP in RaCauchy) & (Cauchy_to_Re(G) = Cauchy_to_Re(GP)))<P>
(933) Theorem 784: [For any non-empty set $s$ of reals which is bounded above, and for any positive real $eps$, there exists an $u in s$ such that $u + eps$ is an upper bound of $s$] ((S ¥incin Re) & (S /= 0) & (Eps in Re) & (Eps ¥R_GT R_0) & (Y in Re) & (FORALL x in S | Y ¥R_GE x)) ¥imp (EXISTS u in S | (FORALL x in S | u ¥R_GE x))<P>
(934) Theorem 785: [Any bounded set of reals has a least upper bound] ((S ¥incin Re) & (S /= 0) & (EXISTS y in Re | (FORALL x in S | y ¥R_GE x))) ¥imp (EXISTS u in Re | ((FORALL x in S | u ¥R_GE x) & (FORALL v in Re | (v ¥R_LT u ¥imp (not (FORALL x in s | v ¥R_GE x))))))<P>
(935) 	Theorem 786: (FORALL s, t | Finite(s) ¥imp (ToThe1(s,t) = if (s = 0) then R_1 else (ToThe1(s - {arb(s)},t) ¥R_TIMES t) end if))<P>
(936) Theorem 787: ((N in Za) & (X in Re)) ¥imp (X ¥ToThe N = if (N = 0) then R_1 else X ¥R_TIMES (X ¥ToThe (N - 1)) end if)<P>
(937) Theorem 788: (X in Re) ¥imp ((X ¥ToThe 0 = R_0) & (X ¥ToThe 1 = X) & (((M in Za) & (N in Za)) ¥imp (X ¥ToThe (M ¥PLUS N) = (X ¥ToThe M) ¥R_TIMES (X ¥ToThe N))))<P>
(938) Theorem 789: ((X in Re) & (M in Za) & (N in Za)) ¥imp (((X ¥ToThe M) ¥ToThe N) = (X ¥ToThe (M ¥TIMES N)))<P>
(939) Theorem 790: (R_SIGMA(0) = R_0) &	(FORALL x in OM | (cdr(x) in Re) ¥imp (R_SIGMA({x}) = cdr(x))) &	(FORALL f in OM | (Finite(f) & (range(f) ¥incin Re)) ¥imp (R_SIGMA(f) in Re)) &	(FORALL f in OM, c in f | (Finite(f) & (range(f) ¥incin Re)) ¥imp (R_SIGMA(f) = R_SIGMA(f - {c}) ¥R_PLUS cdr(c))) &	(FORALL f in OM | (Finite(f) & Is_map(f) & (range(f) ¥incin Re)) ¥imp	(FORALL t | R_SIGMA(f) = R_SIGMA(f ¥ON (domain(f) * t)) ¥R_PLUS R_SIGMA(f ¥ON (domain(f) - t)))) &	(FORALL f in OM, g | (Finite(f) & Svm(f) & Svm(g) & (domain(f) = domain(g)) & (range(f) ¥incin Re)) ¥imp		(R_SIGMA(f) = R_SIGMA({[y,R_SIGMA(f ¥ON (g ¥INV_IM {y}))]: y in range(g)}))) &	(FORALL f in OM, g | (Finite(f) & Svm(f) & one_1_map(g) & (domain(f) = domain(g)) & (range(f) ¥incin Re)) ¥imp		(R_SIGMA(f) = R_SIGMA({[y,f~[inv(g)~[y]]]: y in range(g)})))<P>
(940) Theorem 791: (R_SIGMA(0) = R_0) &	((cdr(X) in Re) ¥imp (R_SIGMA({X}) = cdr(X))) &	((Finite(F) & (range(F) ¥incin Re)) ¥imp (R_SIGMA(F) in Re)) &	((Finite(F) & (range(F) ¥incin Re)) ¥imp (R_SIGMA(F) = R_SIGMA(F - {c}) ¥R_PLUS cdr(c))) &	((Finite(F) & Is_map(F) & (range(F) ¥incin Re)) ¥imp		R_SIGMA(F) = R_SIGMA(F ¥ON (domain(F) * T)) ¥R_PLUS R_SIGMA(F ¥ON (domain(F) - T))) &	((Finite(F) & Svm(F) & Svm(G) & (domain(F) = domain(G)) & (range(F) ¥incin Re)) ¥imp		(R_SIGMA(F) = R_SIGMA({[y,R_SIGMA(F ¥ON (G ¥INV_IM {y}))]: y in range(G)}))) &	((Finite(F) & Svm(F) & one_1_map(G) & (domain(F) = domain(G)) & (range(F) ¥incin Re)) ¥imp		(R_SIGMA(F) = R_SIGMA({[y,F~[inv(G)~[y]]]: y in range(G)})))<P>
(941) Theorem 792: ((F in Fin_Seqs(Re)) & (G in Fin_Seqs(Re)) & (X in Re)) ¥imp (((Polval(F,X) ¥R_PLUS Polval(G,X)) = Polval(F ¥PolPlus G,X)) & ((Polval(F,X) ¥R_MINUS Polval(G,X)) = Polval(F ¥PolMinus G,X)) & ((Polval(F,X) ¥R_TIMES Polval(G,X)) = Polval(F ¥PolTimes G,X)))<P>
(942) Theorem 793: ((F in Fin_Seqs(Re)) & (G in Fin_Seqs(Re))) ¥imp (((PolFcn(F) ¥F_PLUS PolFcn(G)) = PolFcn(F ¥PolPlus G)) & ((PolFcn(F) ¥F_MINUS PolFcn(G)) = PolFcn(F ¥PolMinus G)) & ((PolFcn(F) ¥F_TIMES PolFcn(G)) = PolFcn(F ¥PolTimes G)))<P>
(943) Theorem 794: [Continuous functions map limits into limits] (Cf_RR(F,S) & (G in ReCauchy) & (range(G) ¥incin S)) ¥imp ((F @ G in ReCauchy) & (limit(F @ G) = F~[limit(G)]))<P>
(944) Theorem 795: [The pointwise sum and product of two real continuous functions on two sets is continuous on their intersection] (Cf_RR(F,S) & Cf_RR(G,S2)) ¥imp (Cf_RR(F ¥Res_PLUS G,S * S2) & Cf_RR(F ¥Res_TIMES G,S * S2))<P>
(945) Theorem 796: [The quotient of two real continuous functions on two sets is continuous on the set of points in their intersection at which the denominator is nonzero] (Cf_RR(F,S) & Cf_RR(G,S2)) ¥imp Cf_RR(F ¥Res_OVER G,{x in S * S2 | G~[x] /= R_0})<P>
(946) Theorem 797: [The composition of two real continuous functions is continuous.] (Cf_RR(F,S) & Cf_RR(G,T) & (range(G ¥ON T) ¥incin S)) ¥imp Cf_RR(F @ G,T)<P>
(947) Theorem 798: [Polynomial functions are continuous everywhere] (F in Fin_Seqs(Re)) ¥imp Cf_RR(PolFcn(F),Re)<P>
(948) Theorem 799: [Polynomial quotients are continuous wherever their denominator is nonzero] ((F in Fin_Seqs(Re)) & (G in Fin_Seqs(Re))) ¥imp Cf_RR(F ¥F_OVER G,{x in Re | G~[x] /= R_0})<P>
(949) Theorem 800: [Crossing-completness principle for the real numbers] ((Cf_RR(F,I(X,Y)) & (X in Re) & (Y in Re) & (R_0 ¥R_GE F~[X]) & (R_0 ¥R_LE F~[Y]) & (X ¥R_LE Y)) ¥imp (EXISTS v | ((X ¥R_LE v) & (v ¥R_LE Y) & (F~[v] = R_0))))<P>
(950) Theorem 801: (Cf_RR(F,S) & BoundedClosedRe(S)) ¥imp (EXISTS u in S | (FORALL v in S | F~[u] ¥R_GE F~[v]))<P>
(951) Theorem 802: (Cf_RR(F,S) & BoundedClosedRe(S)) ¥imp (EXISTS u in I(X,Y) | (FORALL v in S | F~[u] ¥R_LE F~[v]))<P>
(952) Theorem 803: (Cf_RR(F,I(X,Y)) & (X in Re) & (Y in Re)) ¥imp (EXISTS u in I(X,Y), v in  I(X,Y) | range(F ¥ON I(X,Y)) = I(f~[u],f~[v]))<P>
(953) Theorem 804: (BoundedClosedRe(S) & (S ¥incin Un({OI(car(ends),cdr(ends)): ends in T})) & (FORALL ends in T | ends in (Re ¥PROD Re))) ¥imp (EXISTS t1 | (t1 ¥incin T) & Finite(t1) & (S ¥incin Un({OI(car(ends),cdr(ends)): ends in t1})))<P>
(954) Theorem 805: [Square of binomials] ((X in Re) & (Y in Re)) ¥imp ( ((X ¥R_PLUS Y) ¥R_TIMES (X ¥R_PLUS Y)) = ((X ¥R_TIMES X) ¥R_PLUS (Y ¥R_TIMES Y)) ¥R_PLUS ((X ¥R_TIMES Y) ¥R_PLUS (X ¥R_TIMES Y)) )<P>
(955) Theorem 806: [Square of binomials, 2] ((X in Re) & (Y in Re)) ¥imp ( ((X ¥R_MINUS Y) ¥R_TIMES (X ¥R_MINUS Y)) = ((X ¥R_TIMES X) ¥R_PLUS (Y ¥R_TIMES Y)) ¥R_MINUS ((X ¥R_TIMES Y) ¥R_PLUS (X ¥R_TIMES Y)) )<P>
(956) Theorem 807: [Noticeable product of binomials] ((X in Re) & (Y in Re)) ¥imp (((X ¥R_MINUS Y) ¥R_TIMES (X ¥R_PLUS Y)) = ((X ¥R_TIMES X) ¥R_MINUS (Y ¥R_TIMES Y)))<P>
(957) Theorem 808: [The square of the square root of any positive $x$ is $x$] ((X in Re) & (R_is_nonneg(X))) ¥imp ((sqrt(X) in Re) & (R_is_nonneg(sqrt(X))) & ((sqrt(X) ¥R_TIMES sqrt(X)) = X))<P>
(958) Theorem 809: [The positive square root is unique] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & ((Y ¥R_TIMES Y) = X)) ¥imp (Y = sqrt(X))<P>
(959) Theorem 810: [The square root is monotone increasing for positive numbers] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & (X ¥R_GT Y)) ¥imp (sqrt(X) ¥R_GT sqrt(Y))<P>
(960) Theorem 811: [The square root of a product is the product of the square roots] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) ¥imp (sqrt(X ¥R_TIMES Y) = (sqrt(X) ¥R_TIMES sqrt(Y)))<P>
(961) Theorem 812: [The square of the square root of any real $w=(x ¥R_TIMES x) ¥R_PLUS (y ¥R_TIMES y)$ is $w$] ((X in Re) & (Y in Re)) ¥imp (sqrt((X ¥R_TIMES X) ¥R_PLUS (Y ¥R_TIMES Y)) ¥R_TIMES sqrt((X ¥R_TIMES X) ¥R_PLUS (Y ¥R_TIMES Y)) = ((X ¥R_TIMES X) ¥R_PLUS (Y ¥R_TIMES Y)))<P>
(961+) Theorem 813: ((N in Si) & (M in Si) & (M /= [0,0]) & is_nonneg(M)) ¥imp	(EXISTS k in Si | is_nonneg(N ¥S_MINUS (k ¥S_TIMES M)) & is_nonneg(((k ¥S_PLUS [1,0])¥S_TIMES M)) ¥S_MINUS N)<P>
(962) Theorem 814: ((N in Re) & (M in Re)) ¥imp (((abs(N) ¥R_PLUS abs(M)) ¥R_GT abs(N ¥R_MINUS M)) or ((abs(N) ¥R_PLUS abs(M)) = abs(N ¥R_MINUS M)))<P>
(963) Theorem 815: ((X in Re) & (Y in Re)) ¥imp ([X,Y] in Cm)<P>
(964) Theorem 816: (M in Cm) ¥eq ((M = [car(M),cdr(M)]) & (car(M) in Re) & (cdr(M) in Re))<P>
(965) Theorem 817: (C_0 in Cm) & (C_1 in Cm)<P>
(966) Theorem 818: ((N in Cm) & (M in Cm)) ¥imp ((N ¥C_PLUS M in Cm) & (N ¥C_TIMES M in Cm))<P>
(967) Theorem 819: ((N in Cm) & (M in Cm)) ¥imp (N ¥C_PLUS M = M ¥C_PLUS N)<P>
(968) Theorem 820: (N in Cm) ¥imp ((N = N ¥C_PLUS C_0) & (N = C_0 ¥C_PLUS  N))<P>
(969) Theorem 821: (N in Cm) ¥imp ((C_Rev(N) in Cm) & (C_Rev(C_Rev(N)) = N))<P>
(970) Theorem 822: (N in Cm) ¥imp (C_Rev(N) ¥C_PLUS N = C_0)<P>
(971) Theorem 823: ((N in Cm) & (M in Cm)) ¥imp (N = M ¥C_PLUS (N ¥C_MINUS M))<P>
(972) Theorem 824: ((N in Cm) & (M in Cm)) ¥imp (N ¥C_TIMES M = M ¥C_TIMES N)<P>
(973) Theorem 825: (N in Cm) ¥imp ((C_abs(N) in Re) & R_is_nonneg(C_abs(N)))<P>
(974) Theorem 826: (N in Cm) ¥imp (C_abs(N) = C_abs(C_Rev(N)))<P>
(975) Theorem 827: ((N in Cm) & (M in Cm)) ¥imp	(((C_abs(N) ¥R_PLUS C_abs(M)) ¥R_GT C_abs(N ¥C_PLUS M)) or (C_abs(N) ¥R_PLUS C_abs(M) = C_abs(N ¥C_PLUS M)))<P>
(976) Theorem 828: ((N in Cm) & (M in Cm)) ¥imp    (((C_abs(N) ¥R_PLUS C_abs(M)) ¥R_GT C_abs(N ¥C_MINUS M)) or (C_abs(N) ¥R_PLUS C_abs(M) = C_abs(N ¥C_MINUS M)))<P>
(977) Theorem 829: ((N in Cm) & (M in Cm)) ¥imp (C_abs(N) ¥R_TIMES C_abs(M) = C_abs(N ¥C_TIMES M))<P>
(978) Theorem 830: ((N in Cm) & (M in Cm) & (M /= C_0)) ¥imp (C_abs(N) ¥R_OVER C_abs(M) = C_abs(N ¥C_OVER M))<P>
(979) Theorem 831: ((K in Cm) & (N in Cm) & (M in Cm)) ¥imp (N ¥C_PLUS (M ¥C_PLUS K) = (N ¥C_PLUS M) ¥C_PLUS K)<P>
(980) Theorem 832: ((K in Cm) & (N in Cm) & (M in Cm)) ¥imp ((N ¥C_TIMES (M ¥C_TIMES K)) = ((N ¥C_TIMES M) ¥C_TIMES K))<P>
(981) Theorem 833: ((K in Cm) & (N in Cm) & (M in Cm)) ¥imp ((N ¥C_TIMES (M ¥C_PLUS K)) = ((N ¥C_TIMES M) ¥C_PLUS (N ¥C_TIMES K)))<P>
(982) Theorem 834: (M in Cm) ¥imp ((M = (M ¥C_TIMES C_1)) & (M = (C_1 ¥C_TIMES M)))<P>
(983) Theorem 835: ((M in Cm) & (M /= C_0)) ¥imp ((C_Recip(M) in Cm) & ((M ¥C_TIMES C_Recip(M)) = C_1))<P>
(984) Theorem 836: ((N in Cm) & (M in Cm) & (M /= C_0)) ¥imp (N = M ¥C_TIMES (N ¥C_OVER M))<P>
(985) Theorem 837: (R_0 in Re) & (FORALL x | (x in Re) ¥imp ((x ¥R_PLUS R_0) = x)) &	(FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) = (y ¥R_PLUS x))) &	(FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) in Re)) &	(FORALL x, y, z | ((x in Re) & (y in Re) & (z in Re)) ¥imp (((x ¥R_PLUS y) ¥R_PLUS z) = (x ¥R_PLUS (y ¥R_PLUS z))))<P>
(986) Theorem real_sigma0: (Sig(0) = R_0) &    (FORALL x | (cdr(x) in Re) ¥imp (Sig({x}) = cdr(x))) &	(FORALL f | (Finite(f) & (range(f) ¥incin Re)) ¥imp (Sig(f) in Re)) &	(FORALL c,f | ((c in f) & Finite(f) & (range(f) ¥incin Re)) ¥imp (Sig(f) = Sig(f - {c}) ¥R_PLUS cdr(c))) &	(FORALL f,t | (Finite(f) & Is_map(f) & (range(f) ¥incin Re)) ¥imp (Sig(f) = (Sig(f ¥ON (domain(f) * t)) ¥R_PLUS Sig(f ¥ON (domain(f) - t)))))<P>
(987) Theorem real_sigma: (Svm(F) & (range(F) ¥incin Re) & Finite(F)) ¥imp	((Sig(F) in Re) & ((P in F) ¥imp (Sig({P}) = (F~[car(P)]))) &	 (Sig(F) = (Sig(F ¥ON (domain(F) * A)) ¥R_PLUS Sig(F ¥ON (domain(F) - A)))))<P>
(988) Theorem 838: (RF_0 in RF)<P>
(989) Theorem 839: (N in RF) ¥imp ((N ¥F_PLUS RF_0) = N)<P>
(990) Theorem 840: ((N in RF) & (M in RF)) ¥imp ((N ¥F_PLUS M) = (M ¥F_PLUS N))<P>
(991) Theorem 841: ((N in RF) & (M in RF)) ¥imp ((N ¥F_PLUS M) in RF)<P>
(992) Theorem 842: ((N in RF) & (M in RF)) ¥imp (N ¥F_TIMES M = M ¥F_TIMES N)<P>
(993) Theorem 843: ((N in RF) & (M in RF) & (K in RF)) ¥imp (N ¥F_PLUS (M ¥F_PLUS K) = (N ¥F_PLUS M) ¥F_PLUS K)<P>
(994) Theorem 844: ((K in RF) & (N in RF) & (M in RF)) ¥imp (N ¥F_TIMES (M ¥F_TIMES K) = (N ¥F_TIMES M) ¥F_TIMES K)<P>
(995) Theorem 845: ((K in RF) & (N in RF) & (M in RF)) ¥imp (N ¥F_TIMES (M ¥F_PLUS K) = (N ¥F_TIMES M) ¥F_PLUS (N ¥F_TIMES K))<P>
(996) Theorem real_function_sigma: (FSig(0) = RF_0) &	(FORALL x | (cdr(x) in RF) ¥imp (FSig({x}) = cdr(x))) &	(FORALL ser | (Finite(ser) & (range(ser) ¥incin RF)) ¥imp (FSig(ser) in RF)) &	(FORALL ser, a | (Finite(ser) & Is_map(ser) & (range(ser) ¥incin RF)) ¥imp			(FSig(ser) = (FSig(ser ¥ON (domain(ser) * a)) ¥F_PLUS FSig(ser ¥ON (domain(ser) - a))))) &    (FORALL p, ser | ((p in ser) & Finite(ser) & (range(ser) ¥incin RF)) ¥imp			(FSig(ser) = FSig(ser - {p}) ¥F_PLUS cdr(p)))<P>
(997) Theorem 846: [Cauchy integral theorem]    is_analytic_CF(F) ¥imp (EXISTS eps in Re | (eps ¥R_GT R_0) &	 (FORALL crv1, crv2 | (is_CD_curv(crv1,R_0,R_1) & is_CD_curv(crv2,R_0,R_1) &	 ((crv1~[R_0]) = (crv1~[R_1])) & ((crv2~[R_0]) = (crv2~[R_1])) &	 (FORALL x in Interval(R_0,R_1) | eps ¥R_GE C_abs((crv1~[x]) ¥C_MINUS (crv2~[x]))))	¥imp (Line_Int(F,crv1,R_0,R_1) = Line_Int(F,crv2,R_0,R_1)) ))<P>
(998) Theorem 847: [Cauchy integral formula]    (is_analytic_CF(F) & (domain(F) incs {w in Cm | C_abs(w) ¥R_GE R_1})) ¥imp	(FORALL w in Cm | (C_abs(w) ¥R_GT R_1) ¥imp ((F~[w]) = (Line_Int({[x,(F~[x]) ¥C_OVER (x ¥C_MINUS w)]: x in (Cm -{w})},		{[x,C_exp_fcn([R_0,x])]: x in Re}, R_0, pi ¥R_PLUS pi) ¥C_OVER ([R_0,pi ¥R_PLUS pi])) ))<P>
(999) Theorem 848: (S = 0) ¥eq (rk(S) = 0)<P>
(1000) Theorem 849: rk({X}) = next(rk(X))<P>
(1001) Theorem 850: rk(X + Y) = rk(X) + rk(Y)<P>
(1002) Theorem 851: rk({X,Y}) = next(rk(X)) + next(rk(Y))<P>
(1003) Theorem 852: ((X ¥incin Y) ¥imp (rk(X) ¥incin rk(Y))) & ((X in Y) ¥imp (rk(X) in rk(Y)))<P>
(1004) Theorem 853: rk(Un(X)) = Un({rk(y): y in X})<P>
(1005) Theorem 854: [The values of the rank function are ordinals] Ord(rk(X))<P>
(1006) Theorem 855: rk([X,Y]) = next(next(next(rk(X)))) + next(next(next(next(rk(Y)))))<P>
(1007) Theorem 856: [Every ordinal equals its own rank] Ord(X) ¥imp (X = rk(X))<P>
(1008) Theorem 857: [iterated singleton formation produces increasing ranks] (rk(V) in rk(snglIter(0,V))) &	(((N in Za) & (M in Za) & (N in M)) ¥imp (rk(snglIter(N,V)) in rk(snglIter(M,V))))<P>
(1009) Theorem 858: [the 0-th level of any cumulative structure equals the base] cumstr(B,0) = B<P>
(1010) Theorem 859: [The constructor of the cumulative structure is monotone non-decreasing] cumstr(B,X) ¥incin cumstr(B,X + Y)<P>
(1011) Theorem 860: [The constructor of the cumulative structure inserts 0 at all levels but the first] (0 notin B) ¥imp ((X /= 0) ¥eq (0 in cumstr(B,X)))<P>
(1012) Theorem 861: [All subsets of each layer of a cumulative structure belong to its subsequent layers] ((Y in X) & (Z ¥incin cumstr(B,Y))) ¥imp (Z in cumstr(B,X))<P>
(1013) Theorem 862: [Quasi-transitivity of the layers of a cumulative structure] Ord(X) ¥imp ((cumstr(B,X) - B) ¥incin pow(cumstr(B,X)))<P>
(1013+) Theorem 863: [Transitivity of each layer in the von Neumann hierarchy] Ord(X) ¥imp ((cumstr(0,X) ¥incin pow(cumstr(0,X))) & (Un(cumstr(0,X)) ¥incin cumstr(0,X)))<P>
(1014) Theorem 864: [closedness under dyadic union of the cumulative hierarchy $cumstr(B,Za)$] ((S in cumstr(B,Za) - B) & (T in cumstr(B,Za) - B)) ¥imp ((S + T) in cumstr(B,Za))<P>
(1015) Theorem 865: [All sets of rank bounded by $X$ belong to $pow(cumstr(0,X))$] (rk(Y) ¥incin X) ¥imp (Y ¥incin cumstr(0,X))<P>
(1016) Theorem 866: [The sets of rank bounded by $X$ form $pow(cumstr(0,X))$] Ord(X) ¥imp ((rk(Y) ¥incin X) ¥eq (Y ¥incin cumstr(0,X)))<P>
(1017) Theorem 867: [All sets of rank $X$ belong to $cumstr(0,next(X))-cumstr(0,X)$] (X = rk(Y)) ¥imp (Y in (cumstr(0,next(X)) - cumstr(0,X)))<P>
(1018) Theorem 868: [The rank of sets in $cumstr(0,next(X))-cumstr(0,X)$ does not exceed $X$] (Ord(X) & (Y in (cumstr(0,next(X)) - cumstr(0,X)))) ¥imp (rk(Y) ¥incin X)<P>
(1019) Theorem 869: [The sets of rank $X$ form $cumstr(0,next(X))-cumstr(0,X)$] Ord(X) ¥imp ((rk(Y) = X) ¥eq (Y in (cumstr(0,next(X)) - cumstr(0,X))))<P>
(1020) Theorem 870: [Sets whose rank belongs to an ordinal are those in its level] Ord(X) ¥imp ((rk(Y) in X) ¥eq (Y in cumstr(0,X)))<P>
(1021) Theorem 871: Ord(X) ¥imp (rk(cumstr(0,X)) = X)<P>
(1022) Theorem 872: (Ord(X) & Ord(Y) & (X in Y) & (Z notin cumstr(0,Y))) ¥imp (X in rk(Z))<P>
(1023) Theorem 873: (N in Za) ¥imp Finite(cumstr(0,N))<P>
(1023+) Theorem 874: (W = cumstr(0,rk({snglIter(n,X): n in Za}))) ¥imp ((X ¥incin W) & (not Finite(W - X)) & (1 in rk(W)))<P>
(1024) Theorem superstructure.0: (EXISTS f | one_1_map(f) & (range(f) = b) & (domain(f) = #b))<P>
(1025) Theorem superstructure.1: one_1_map(f) & (range(f) = b) & (domain(f) = #b)<P>
(1026) Theorem superstructure.2: one_1_map(bij_thryvar) & (domain(bij_thryvar)=b) & (range(bij_thryvar)=ur_thryvar)<P>
(1027) Theorem superstructure.3: supstr(ur_thryvar,sst_thryvar)<P>
(1028) Theorem 875: [the null set is hereditarily finite] 0 in HF<P>
(1029) Theorem 876: [transitivity of the collection of hereditarily finite sets] ((S in HF) & (X in S)) ¥imp (X in HF)<P>
(1030) Theorem 877: [extensionality of membership over the hereditarily finite sets] ((S in HF) & (T in HF) & (FORALL x | (x in HF) ¥imp ((x in S) ¥eq (x in T)))) ¥imp (S = T)<P>
(1031) Theorem 878: [closedness under powerset formation of the collection of hereditarily finite sets] (S in HF) ¥imp (pow(S) in HF)<P>
(1032) Theorem 879: [closedness under singleton formation of the collection of hereditarily finite sets] (S in HF) ¥imp ({S} in HF)<P>
(1033) Theorem 880: [closedness under dyadic union of the collection of hereditarily finite sets] ((S in HF) & (T in HF)) ¥imp ((S + T) in HF)<P>
(1034) Theorem 881: [closedness under set difference of the collection of hereditarily finite sets] ((S in HF) & (T in HF)) ¥imp (((S - T) in HF) & ({S,T} in HF))<P>
(1035) Theorem 882: [closedness under selection of the collection of hereditarily finite sets] (S in HF) ¥imp (arb(S) in HF)<P>
(1036) Theorem 883: [all subsets of an hereditarily finite set are hereditarily finite] ((S in HF) & (T ¥incin S)) ¥imp (T in HF)<P>
(1037) Theorem 884: [alternative characterization of hereditarily finite sets] (S in HF) ¥eq (Finite(S) & ({u in S | not (u in HF)} = 0))<P>
(1038) Theorem 885: [closedness under unionset of the collection of hereditarily finite sets] (S in HF) ¥imp (Un(S) in HF)<P>
(1039) Theorem herfin_induction0: [finiteness ensues from hereditary finiteness] Finite(s0)<P>
(1040) Theorem herfin_induction1: [inclusion-minimal hereditarily finite set satisfying $P$] (hf0_thryvar ¥incin s0) & P(hf0_thryvar) &	(FORALL k ¥incin hf0_thryvar | (k /= hf0_thryvar) ¥imp (not P(k)))<P>
(1041) Theorem herfin_induction2: [rank-minimal hereditarily finite set satisfying $P$] (EXISTS x in cumstr(0,Za) | P(x) & (FORALL k | (rk(k) in rk(x)) ¥imp (not P(k))))<P>
(1042) Theorem herfin_induction3: [existence of membership/inclusion-minimal hereditarily finite set satisfying $P$] (EXISTS x | (x in HF) & P(x) & (FORALL k | ((k in x) or ((k ¥incin x) & (k /= x))) ¥imp (not P(k))))<P>
(1043) Theorem herfin_induction4: [membership/inclusion-minimal hereditarily finite set satisfying $P$] (hf1_thryvar in HF) & P(hf1_thryvar) & (FORALL k | ((k in hf1_thryvar) or ((k ¥incin hf1_thryvar) & (k /= hf1_thryvar))) ¥imp (not P(k)))<P>
(1044) Theorem 886: [alternative characterization of hereditarily finite sets, 2] (S in HF) ¥eq (Finite(Ult_membs(S)))<P>
(1045) Theorem based_maps.1: ((X in rr) & (Y in rr)) ¥imp ((X + Y) = (Y + X))<P>
(1046) Theorem based_maps.2: ((X in rr) & (Y in rr) & (Z in rr)) ¥imp ((X + Y) + Z = X + (Y + Z))<P>
(1047) Theorem based_maps.3: ((X in rr) & (Y in rr)) ¥imp (compl_thryvar(compl_thryvar(X + Y) + compl_thryvar(X + compl_thryvar(Y))) = X)<P>
(1048) Theorem based_maps.4: ((X in rr) & (Y in rr) & (Z in rr)) ¥imp ((X @ Y) @ Z = X @ (Y @ Z))<P>
(1049) Theorem based_maps.5: ((X in rr) & (Y in rr) & (Z in rr)) ¥imp (Z @ (X + Y) = (Z @ X) + (Z @ Y))<P>
(1050) Theorem based_maps.6: (X in rr) ¥imp ((ident_thryvar @ X) = X)<P>
(1051) Theorem based_maps.7: (X in rr) ¥imp (inv(inv(X)) = X)<P>
(1052) Theorem based_maps.8: ((X in rr) & (Y in rr)) ¥imp (inv(X + Y) = inv(X) + inv(Y))<P>
(1053) Theorem based_maps.9: ((X in rr) & (Y in rr)) ¥imp (inv(X @ Y) = inv(Y) @ inv(X))<P>
(1054) Theorem based_maps.10: ((X in rr) & (Y in rr)) ¥imp ((compl_thryvar(Y @ X) @ inv(X)) + compl_thryvar(Y) = compl_thryvar(Y))<P>
(1054+) Theorem nfa1: [transition triples are finitely many] Finite(d)<P>
(1055) Theorem nfa2: [strict inclusion between strings is a well-founded relation] ((W ¥incin Fin_seqs(a)) & (W /= 0)) ¥imp (EXISTS m in W | (FORALL y in W | not((y ¥incin m) & (y /= m))))<P>
(1056) Theorem nfa3: [consumption of a string over the alphabet] (FORALL w,q | (w in Fin_seqs(a)) ¥imp	(nfa_thryvar(w,q) = (nfaEps_thryvar~[if w=0 then q else nfa1_thryvar(w~[#w ¥MINUS 1],arb({nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp ¥incin w) & (wp /= w)) & (wp = w ¥ON (#w ¥MINUS 1))})) end if])))<P>
(1057) Theorem nfa4: [consumption of a string over the alphabet, 2] (W in Fin_seqs(a)) ¥imp	(nfa_thryvar(W,Q) = (nfaEps_thryvar~[if W = 0 then Q else nfa1_thryvar(W~[#W ¥MINUS 1],nfa_thryvar(W ¥ON (#W ¥MINUS 1),Q)) end if]))<P>
(1058) Theorem nfa5: [consumption of a string leads to states] (W in Fin_seqs(a)) ¥imp (nfa_thryvar(W,Q) ¥incin v)<P>
(1059) Theorem nfa6: [characterization of determinism, 1] ((#s = 1) & Svm(d) & (domain(d) ¥incin (v ¥PROD a))) ¥imp Is_dfa_thryvar<P>
(1060) Theorem nfa7: Is_dfa_thryvar ¥imp (nfaNeighbor_thryvar(P,Q) ¥eq (P incs Q))<P>
(1061) Theorem nfa8: Is_dfa_thryvar ¥imp (((Q ¥incin v) ¥imp ((nfaEps_thryvar~[Q]) = Q)) & ((Q ¥nincin v) ¥imp ((nfaEps_thryvar~[Q]) = 0)))<P>
(1062) Theorem nfa9: [characterization of determinism, 2] (Is_dfa_thryvar & (W in Fin_seqs(a))) ¥imp (#nfa_thryvar(W,{Y}) in 2)<P>
(1063) Theorem nfa10: [deterministic consumption of a string over the alphabet, 3] (Is_dfa_thryvar & (W in Fin_seqs(a)) & (Y in v)) ¥imp	(nfa_thryvar(W,{Y}) = if W = 0 then {Y}	elseif nfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y}) = 0 then 0	elseif [arb(nfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y})),W~[#W ¥MINUS 1]] notin domain(d) then 0	else {d~[[arb(nfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y})),W~[#W ¥MINUS 1]]]} end if)<P>
(1064) Theorem nfa11: [language accepted by a deterministic automaton] Is_dfa_thryvar ¥imp (nfaLang_thryvar = {z in Fin_seqs(a) | (#nfa_thryvar(z,s) = 1) & (nfa_thryvar(z,s) ¥incin t)})<P>
(1065) Theorem nfa12: [preparation for self-application of this THEORY]	(({dfaStart_thryvar} + dfaAccept_thryvar) ¥incin dfaStates_thryvar) & Finite(dfaStates_thryvar) &	(dfaTrans_thryvar ¥incin ((dfaStates_thryvar ¥PROD next(a)) ¥PROD dfaStates_thryvar)) &	Svm(dfaTrans_thryvar) & (domain(dfaTrans_thryvar) ¥incin (dfaStates_thryvar ¥PROD a)) &	(range(dfaTrans_thryvar) ¥incin dfaStates_thryvar)<P>
(1066) Theorem nfa13: Finite(dfaTrans_thryvar) &	(((#{dfaStart_thryvar} = 1) & Svm(dfaTrans_thryvar) & (domain(dfaTrans_thryvar) ¥incin (dfaStates_thryvar ¥PROD a))) ¥imp Js_dfa_thryvar) &	(FORALL w, y | (Js_dfa_thryvar & (w in Fin_seqs(a))) ¥imp (#dfa_thryvar(w,{y}) in 2)) &	(FORALL w, y | (Js_dfa_thryvar & (w in Fin_seqs(a)) & (y in dfaStates_thryvar)) ¥imp		(dfa_thryvar(w,{y}) = if w = 0 then {y}		elseif dfa_thryvar(w ¥ON (#w ¥MINUS 1),{y}) = 0 then 0		elseif [arb(dfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y})),W~[#W ¥MINUS 1]] notin domain(dfaTrans_thryvar) then 0		else {dfaTrans_thryvar~[[arb(dfa_thryvar(w ¥ON (#w ¥MINUS 1),{y})),w~[#w ¥MINUS 1]]]} end if)) &	(Js_dfa_thryvar  ¥imp (dfaLang_thryvar =		{z in Fin_seqs(a) | (#dfa_thryvar(z,{dfaStart_thryvar}) = 1) & (dfa_thryvar(z,{dfaStart_thryvar}) ¥incin dfaAccept_thryvar)}))<P>
(1067) Theorem nfa14: Js_dfa_thryvar<P>
(1068) Theorem nfa15: (W in Fin_seqs(a)) ¥imp (#dfa_thryvar(W,{Y}) in 2)<P>
(1069) Theorem nfa16: ((W in Fin_seqs(a)) & (Y in dfaStates_thryvar)) ¥imp (dfa_thryvar(W,{Y}) = if W = 0 then {Y}		elseif dfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y}) = 0 then 0		elseif [arb(dfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y})),W~[#W ¥MINUS 1]] notin domain(dfaTrans_thryvar) then 0		else {dfaTrans_thryvar~[[arb(dfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y})),W~[#W ¥MINUS 1]]]} end if)<P>
(1069+) Theorem nfa17: dfaLang_thryvar = {z in Fin_seqs(a) | (#dfa_thryvar(z,{dfaStart_thryvar}) = 1) & (dfa_thryvar(z,{dfaStart_thryvar}) ¥incin dfaAccept_thryvar)}<P>
(1070) Theorem collapse1: (W(C) & W(D) & (D in C)) ¥imp (Mostowski_thryvar(D) in Mostowski_thryvar(C))<P>
(1071) Theorem collapse2: ((FORALL c, cp | (W(c) & W(cp) & (Mostowski_thryvar(cp) = Mostowski_thryvar(c))) ¥imp (cp = c) ) &		W(C) & W(D)) ¥imp ((Mostowski_thryvar(D) in Mostowski_thryvar(C)) ¥eq (D in C))<P>
(1072) Theorem mutual_climbing1: (Ord(I) & Ord(J)) ¥imp (car(om_thryvar(I)) /= cdr(om_thryvar(J)))<P>
(1072+) Theorem mutual_climbing2: (Ord(I) & Ord(J) & (I /= J)) ¥imp ((car(om_thryvar(I)) /= car(om_thryvar(J))) &		(cdr(om_thryvar(I)) /= cdr(om_thryvar(J))))<P>
(1073) Theorem mutual_climbing3: ((X in om1_thryvar) & (Y in om2_thryvar)) ¥imp ((X in Y) or (Y in X))<P>
(1074) Theorem mutual_climbing4: ((om1_thryvar * om2_thryvar) = 0) & (om1_thryvar /= om2_thryvar)<P>
(1075) Theorem mutual_climbing5: (om1_thryvar notin om2_thryvar) & (om2_thryvar notin om1_thryvar)<P>
(1076) Theorem mutual_climbing6: (Un(om1_thryvar) ¥incin om2_thryvar) & (Un(om2_thryvar) ¥incin om1_thryvar)<P>
(1077) Theorem twin_infinities1: not(Finite(om1 + om2))<P>
(1078) Theorem twin_infinities2: not(Finite(om1) or Finite(om2))<P>
(1079) Theorem twin_infinities3: (om1 * om2) = 0<P>
(1080) Theorem twin_infinities4: (om1 /= 0) & (om2 /= 0)<P>
(1081) Theorem 887: (Is_tog(T) & (X in domain(T))) ¥imp (((T~[X]) /= X) & ((T~[T~[X]]) = X))<P>
(1082) Theorem 888: (not Finite(S)) ¥imp (EXISTS f | Is_tog(f) & (domain(f) = S))<P>
(1083) Theorem globalizeMap1: Finite(t) ¥imp ((range(t) = domain(t)) & (one_1_map(t)))<P>
(1084) Theorem globalizeMap2: (EXISTS o | Ord(o) & (1 in o) & (domain(t) ¥incin cumstr(0,o)) & (not Finite(cumstr(0,o) - domain(t))))<P>
(1085) Theorem globalizeMap3: Ord(rk_thryvar) & (1 in rk_thryvar) & (domain(t) ¥incin cumstr(0,rk_thryvar)) & (not Finite(cumstr(0,rk_thryvar) - domain(t)))<P>
(1086) Theorem globalizeMap4: (EXISTS tp | Is_tog(tp) & (domain(tp) = cumstr(0,rk_thryvar) - domain(t)))<P>
(1086+) Theorem globalizeMap5:  Is_tog(tg_thryvar) & (domain(tg_thryvar) = cumstr(0,rk_thryvar) - domain(t))<P>
(1087) Theorem globalizeMap6: [alternative characterization of formal negative, via toggling; symmetry and irreflexivity of toggling] ((((X - 1) = (Y - 1)) & ((X * 1) = (1 - Y))) ¥eq (Y = togg_thryvar(X))) & ((((X - 1) = (Y - 1)) & ((X * 1) = (1 - Y))) ¥imp ((((Y - 1) = (X - 1)) & ((Y * 1) = (1 - X))) & (X /= Y)))<P>
(1088) Theorem globalizeMap7: [double negation affirms] (togg_thryvar(togg_thryvar(X)) = X) & (togg_thryvar(X) /= X)<P>
(1089) Theorem globalizeMap8: [negation of special sets] (togg_thryvar(0) = 1) & (togg_thryvar(1) = 0) & (togg_thryvar({{X,Y}}) = {0,{X,Y}}) & ((X /= 0) ¥imp (togg_thryvar({0,X}) = {X}))<P>
(1090) Theorem globalizeMap9: [global toggling preserves rank] (1 in rk(X)) ¥imp (rk(X) = rk((X - 1) + (1 - X)))<P>
(1091) Theorem globalizeMap10: (X in domain(t)) ¥imp (qtog_thryvar(X) = t~[X])<P>
(1092) Theorem globalizeMap11: (X notin range(t)) ¥imp ((qtog_thryvar(X) /= X) & (qtog_thryvar(qtog_thryvar(X)) = X))<P>
(1093) Theorem globalizeTog0: Svm(t) & (range(t) = domain(t))<P>
(1094) Theorem globalizeTog1: (FORALL x | (x in domain(t)) ¥imp (tog_thryvar(x) = t~[x])) &	(FORALL x | (x notin range(t)) ¥imp ((tog_thryvar(x) /= x) & (tog_thryvar(tog_thryvar(x)) = x)))<P>
(1095) Theorem globalizeTog2: (tog_thryvar(X) /= X) & (tog_thryvar(tog_thryvar(X)) = X)<P>
(1096) Theorem 889: Svm(0) & (range(0) incs domain(0))<P>
(1096+) Theorem 890: (FORALL x | togg(x) = ((x - 1) + (1 - x))) &	(FORALL x | (togg(togg(x)) = x) & (togg(x) /= x)) &	(FORALL x | (1 in rk(x)) ¥imp (rk(x) = rk((x - 1) + (1 - x)))) &	(FORALL x, y | (togg(0) = 1) & (togg(1) = 0) & (togg({{x,y}}) = {0,{x,y}}) & ((x /= 0) ¥imp (togg({0,x}) = {x})))<P>
(1097) Theorem 891: [specification of formal negative] togg(X) = ((X - 1) + (1 - X))<P>
(1098) Theorem 892: [formal negative and affirmative have the same rank] (1 in rk(X)) ¥imp (rk(X) = rk((X - 1) + (1 - X)))<P>
(1099) Theorem 893: [double negation affirms] (togg(togg(X)) = X) & (togg(X) /= X)<P>
(1100) Theorem 894: [negation of special sets] (togg(0) = 1) & (togg(1) = 0) & (togg({{X,Y}}) = {0,{X,Y}}) & ((X /= 0) ¥imp (togg({0,X}) = {X}))<P>
(1101) Theorem 895: [unsigned symbol retrieval from literal] (B ¥incin 1) ¥imp (atm(B + {{G}}) = G)<P>
(1102) Theorem 896:  [sign removal from literal] (atm(togg(X)) = atm(X)) & ((X in signedSymbs(C)) ¥imp (atm(X) in C))<P>
(1103) Theorem 897: [equal literals share the same atom] (((B + {H}) = (D + {K})) & (B in {0,{0}}) & (K /= 0)) ¥imp (H = K)<P>
(1104) Theorem 898: [literals associated with a singleton alphabet] (signedSymbs(0) = 0) & (signedSymbs({G}) = {{{G}},togg({{G}})})<P>
(1105) Theorem 899: [literals over disjoint alphabets] ((C * D) = 0) ¥imp (((signedSymbs(C) * signedSymbs(D)) = 0) & ((signedSymbs(C) + signedSymbs(D)) = signedSymbs(C + D)))<P>
(1106) Theorem 900: [decomposition of the set of all literals over a nonnull set] (C /= 0) ¥imp (signedSymbs(C) = {{{arb(C)}},togg({{arb(C)}})} + signedSymbs(C - {arb(C)}))<P>
(1107) Theorem signedSymbols1: [affirmation is one-one] (X /= Y) ¥imp (aff_thryvar(x) /= aff_thryvar(y))<P>
(1108) Theorem signedSymbols2: [negation is a Galois correspondence] (neg_thryvar(neg_thryvar(X)) = X) & (neg_thryvar(X) /= X)<P>
(1109) Theorem signedSymbols3: [positive and negative literals do not intersect] aff_thryvar(X) /= neg_thryvar(aff_thryvar(Y))<P>
(1110) Theorem signedSymbols4: [affirmation of an atom produced a literal] {aff_thryvar(x): x in atms} ¥incin lits_thryvar<P>
(1111) Theorem signedSymbols5: [literals are closed under negation] {neg_thryvar(x): x in lits_thryvar} = lits_thryvar<P>
(1112) Theorem signedSymbols6: false_thryvar notin lits_thryvar<P>
(1113) Theorem signedSymbols7: {rk(x): x in lits_thryvar} ¥incin {rk(false_thryvar)}<P>
(1114) Theorem signedSymbols8: (N in next(Za)) ¥imp (N in rk(false_thryvar))<P>
(1115) Theorem signedSymbols9: (rk(X) notin rk(false_thryvar)) ¥imp (rk(neg_thryvar(X)) = rk(X))<P>
(1116) Theorem cnfModels0: [assumption concerning tog] (tog(tog(X)) = X) & (tog(X) /= X)<P>
(1117) Theorem cnfModels1: [property of the models of $0$] Has_cnfModel_thryvar(0,M) ¥eq ({h in M | tog(h) in M} = 0)<P>
(1117+) Theorem cnfModels2: [blatant truth, manifest absurdity] Has_cnfModel_thryvar(0,0) & Is_cnfSat_thryvar(0) & ((0 in S) ¥imp (not(Is_cnfSat_thryvar(S))))<P>
(1118) Theorem cnfModels3: [plain satisfiability] (({h in Un(S) | tog(h) in Un(S)} = 0) & (0 notin S)) ¥imp (Has_cnfModel_thryvar(S,Un(S)) & Is_cnfSat_thryvar(S))<P>
(1119) Theorem cnfModels4: [plain satisfiability, 2] ({u: u in S, h in u | (u = {h}) & ({h,tog(h)} * Un(S - {u}) = 0)} incs S) ¥imp (Has_cnfModel_thryvar(S,Un(S)) & Is_cnfSat_thryvar(S))<P>
(1119+) Theorem cnfModels5: [cnf model subsumption] ((T ¥incin S) & Has_cnfModel_thryvar(S,M)) ¥imp Has_cnfModel_thryvar(T,M)<P>
(1120) Theorem cnfModels6: [cnf model subsumption,2] ((T ¥incin S) & Is_cnfSat_thryvar(S)) ¥imp Is_cnfSat_thryvar(T)<P>
(1121) Theorem cnfModels7: [shrinking of cnf_model] Has_cnfModel_thryvar(S,M) ¥imp Has_cnfModel_thryvar(S, M * Un(S))<P>
(1122) Theorem cnfModels8: [broadening of cnf-model] (Has_cnfModel_thryvar(S,M) & ({h in (N - M) | tog(h) in N} = 0) & (M ¥incin N)) ¥imp Has_cnfModel_thryvar(S,N)<P>
(1123) Theorem cnfModels9: [broadening of cnf-model, 2] (Has_cnfModel_thryvar(S,M) & (N incs M) & Has_cnfModel_thryvar(T,N)) ¥imp Has_cnfModel_thryvar(S,N)<P>
(1124) Theorem cnfModels10: [shrinking of cnf_model, 2] (Has_cnfModel_thryvar(S,M) & (H notin Un(S))) ¥imp (Has_cnfModel_thryvar(S, M - {H}))<P>
(1125) Theorem cnfModels11: [broadening of cnf_model, 3] ({H,tog(H)} * M = 0) ¥imp (Has_cnfModel_thryvar(0,M) ¥eq Has_cnfModel_thryvar(0, M + {H}))<P>
(1126) Theorem cnfModels12: [disjunctive tautology] {h in C | tog(h) in C} ¥incin {h in C | Has_cnfModel_thryvar({C},{h}) & Has_cnfModel_thryvar({C},{tog(h)})}<P>
(1127) Theorem cnfModels13: [disjunctive tautology, 2] ((H in C) & (tog(H) in C)) ¥imp (Has_cnfModel_thryvar({C},{H}) & Has_cnfModel_thryvar({C},{tog(H)}))<P>
(1127+) Theorem cnfModels14: [extensibility of models] Has_cnfModel_thryvar(S,M) ¥imp	Has_cnfModel_thryvar(0, M + {arb({k,tog(k)}): c in T, k in (c - M) | tog(k) in (c - M)})<P>
(1128) Theorem cnfModels15: [tautology withdrawal rule] Has_cnfModel_thryvar(S,M) ¥imp	Has_cnfModel_thryvar(S + {c: c in T, h in c | tog(h) in c},		M + {arb({h,tog(h)}): c in T, h in (c - M) | tog(h) in (c - M)})<P>
(1129) Theorem cnfModels16: [tautology withdrawal rule, 2] ({c: c in S, h in c | tog(h) in c} incs T) ¥imp (Is_cnfSat_thryvar(S) ¥eq Is_cnfSat_thryvar(S - T))<P>
(1130) Theorem cnfModels17: [preliminary to splitting rule] (Has_cnfModel_thryvar(S,M) & (not Has_cnfModel_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}, M + {H}))) ¥imp (tog(H) in M)<P>
(1130+) Theorem cnfModels18: [splitting rule] Has_cnfModel_thryvar(S,M) ¥imp (Has_cnfModel_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}, M + {H}) or Has_cnfModel_thryvar({{tog(H)}} + {c - {H}: c in S | tog(H) notin c}, M + {tog(H)}))<P>
(1131) Theorem cnfModels19: [splitting rule, 2] Has_cnfModel_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}, M) ¥imp Has_cnfModel_thryvar(S,M)<P>
(1132) Theorem cnfModels20: [preliminary to splitting rule, 2] Is_cnfSat_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}) ¥imp Is_cnfSat_thryvar(S)<P>
(1133) Theorem cnfModels21: [splitting rule, 2] Is_cnfSat_thryvar(S) ¥eq (Is_cnfSat_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}) or Is_cnfSat_thryvar({{tog(H)}} + {c - {H}: c in S | tog(H) notin c}))<P>
(1134) Theorem cnfModels22: [pure literal rule] ((H in Un(S)) & (tog(H) notin Un(S)) & Has_cnfModel_thryvar(0,M) & (not(Has_cnfModel_thryvar({{H,tog(H)}},M)))) ¥imp (Has_cnfModel_thryvar(S, M + {H}) ¥eq Has_cnfModel_thryvar({c in S | H notin c}, M))<P>
(1135) Theorem cnfModels23: [pure literal rule, 2] (tog(H) notin Un(S)) ¥imp (Is_cnfSat_thryvar(S) ¥eq Is_cnfSat_thryvar({{H}} + {c in S | H notin c}))<P>
(1136) Theorem cnfModels24: [unit literal rule, 0] (({H} in S) & Has_cnfModel_thryvar(S,M)) ¥imp ((H in M) & (tog(H) notin M))<P>
(1137) Theorem cnfModels25: [unit literal rule] (({H} in S) & Has_cnfModel_thryvar(0,M) & ({H,tog(H)} * M = 0)) ¥imp (Has_cnfModel_thryvar(S, M + {H}) ¥eq Has_cnfModel_thryvar({c - {tog(H)}: c in S | H notin c}, M))<P>
(1138) Theorem cnfModels26: [unit literal rule, 2] ({H} in S) ¥imp (Is_cnfSat_thryvar(S) ¥eq Is_cnfSat_thryvar({c - {tog(H)}: c in S | H notin c}))<P>
(1139) Theorem cnfModels27: (Un(S) incs Un({c - {tog(H)}: c in S | H notin c})) & (H notin Un({c - {tog(H)}: c in S | H notin c}))<P>
(1140) Theorem cnfModels28: (Is_cnfFinSat_thryvar(P) & (P incs Q)) ¥imp Is_cnfFinSat_thryvar(Q)<P>
(1141) Theorem cnfModels29: Is_cnfFinSat_thryvar(P) ¥imp Is_cnfFinSat_thryvar(P + {{{X}}}) or Is_cnfFinSat_thryvar(P + {{{tog(X)}}})<P>
(1142) Theorem cnfModels30: [compactness of classical propositional logic] (Is_cnfFinSat_thryvar(P) & (FORALL s in P, c in s | Finite(c))) ¥imp (EXISTS m | (FORALL s in P | Has_cnfModel_thryvar(s,m)))<P>
(1143) Theorem davisPutnam0: (tog(tog(H)) = H) & (tog(H) /= H) &((tog(H) notin Un(S)) ¥imp ({c in S | H notin c} = {c - {tog(H)}: c  in S | H notin c}))<P>
(1144) Theorem davisPutnam1: (S in clauSets_thryvar) ¥imp (Finite(S) & Finite(Un(S)) &		(Un(S) ¥incin lits) & (fail notin Un(S)) & (tog(fail) notin Un(S)))<P>
(1145) Theorem davisPutnam2: ((S in clauSets_thryvar) & (C in S)) ¥imp Finite(C)<P>
(1146) Theorem davisPutnam3: ((S in clauSets_thryvar) & ((T ¥incin S) or (Un(T) ¥incin Un(S)))) ¥imp (T in clauSets_thryvar)<P>
(1147) Theorem davisPutnam4:	(FORALL s | Is_dpSat_thryvar(s) = (EXISTS m | Has_dpModel_thryvar(s,m))) &	(FORALL s | Has_dpModel_thryvar(0,0) & Is_dpSat_thryvar(0) & ((0 in s) ¥imp (not(Is_dpSat_thryvar(s))))) &	(FORALL s | ({u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)} incs s) ¥imp (Has_dpModel_thryvar(s,Un(s)) & Is_dpSat_thryvar(s))) &	(FORALL s, h | Is_dpSat_thryvar(s) ¥eq		(Is_dpSat_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}) or			Is_dpSat_thryvar({{tog(h)}} + {c - {h}: c in s | tog(h) notin c}))) &	(FORALL h, s | (tog(h) notin Un(s)) ¥imp		(Is_dpSat_thryvar(s) ¥eq Is_dpSat_thryvar({{h}} + {c in s | h notin c}))) &	(FORALL h, s, m | (({h} in s) & Has_dpModel_thryvar(s,m)) ¥imp ((h in m) & (tog(h) notin m))) &	(FORALL h, s, m | Has_dpModel_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}, m) ¥imp		Has_dpModel_thryvar(s,m)) &	(FORALL s, m, t | Has_dpModel_thryvar(s,m) ¥imp Has_dpModel_thryvar(s + {c: c in t, h in c | tog(h) in c}, m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)})) &	(FORALL t,s | ((t ¥incin s) & Is_dpSat_thryvar(s)) ¥imp Is_dpSat_thryvar(t))<P>
(1148) Theorem davisPutnam5: ((G ¥incin clauSets_thryvar) & (G /= 0)) ¥imp	(EXISTS m in G | (FORALL v in G | not((Un(v - settled_thryvar(v)) ¥incin Un(m - settled_thryvar(m))) &				(Un(v - settled_thryvar(v)) /= Un(m - settled_thryvar(m))))))<P>
(1149) Theorem davisPutnam6: (FORALL x, p | (x in clauSets_thryvar) ¥imp (dp0_thryvar(x,p) =	f3_dp_thryvar(x,{dp0_thryvar(y,p): y in clauSets_thryvar |		((Un(y - settled_thryvar(y)) ¥incin Un(x - settled_thryvar(x))) &		 (Un(y - settled_thryvar(y)) /= Un(x - settled_thryvar(x)))) &		P3_dp_thryvar(x,y,p)},p)))<P>
(1150) Theorem davisPutnam7: (X in clauSets_thryvar) ¥imp (#Un(X - settled_thryvar(X))  in Za)<P>
(1151) Theorem davisPutnam8: ((X in clauSets_thryvar) & (H in Un(X - settled_thryvar(X))) & ((Y = {{H}} + {c - {tog(H)}: c in X | H notin c}))) ¥imp	((Y in clauSets_thryvar) & (Un(Y - settled_thryvar(Y)) /= Un(X - settled_thryvar(X))) &	(Un(Y - settled_thryvar(Y)) ¥incin Un(X - settled_thryvar(X))))<P>
(1152) Theorem davisPutnam9: ((S in clauSets_thryvar) & (0 notin S) &		(S ¥nincin settled_thryvar(S))) ¥imp		(((pk_thryvar~[S]) in Un(S - settled_thryvar(S))) &		((pk_thryvar~[S]) /= fail) & (tog(pk_thryvar~[S]) /= fail) &		((tog(pk_thryvar~[S]) in Un(S)) ¥imp		(tog(pk_thryvar~[S]) in Un(S - settled_thryvar(S)))))<P>
(1153) Theorem davisPutnam10: ((S in clauSets_thryvar) & ((0 in S) or (S ¥incin settled_thryvar(S)) or (#Un(S - settled_thryvar(S)) = 0))) ¥imp(if fail in dp0_thryvar(S,pk_thryvar) then (not Is_dpSat_thryvar(S)) else Has_dpModel_thryvar(S,dp0_thryvar(S,pk_thryvar)) end if)<P>
(1154) Theorem davisPutnam11: (S in clauSets_thryvar) ¥imp(if fail in dp0_thryvar(S,pk_thryvar) then (not Is_dpSat_thryvar(S)) else Has_dpModel_thryvar(S,dp0_thryvar(S,pk_thryvar)) end if)<P>
(1155) Theorem davisPutnam12: (S in clauSets_thryvar) ¥imp (Is_dpSat_thryvar(S) ¥eq (fail notin dp_thryvar(S)))<P>
(1156) Theorem davisPutnam13: (S in clauSets_thryvar) ¥imp		(Is_dpSat_thryvar(S) ¥eq Has_dpModel_thryvar(S,dp_thryvar(S)))<P>
(1157) Theorem 901: (Svm(P) & Finite(P) & (range(P) incs domain(P))) ¥imp Is_perm(P)<P>
(1158) Theorem 902: (Scycle(P) ¥imp ((P /= 0) & Is_perm(P) & Svm(P) & Finite(P))) & (Straight(P,X,Y) ¥imp (Svm(P) & Finite(P)))<P>
(1159) Theorem 903: (Is_perm(P) & (P /= 0)) ¥imp (EXISTS c ¥incin P | Scycle(c))<P>
(1160) Theorem 904: (Is_map(P) & Finite(P) & (range(P) ¥incin domain(P)) & (P /= 0)) ¥imp (EXISTS c ¥incin P | Scycle(c))<P>
(1161) Theorem 905: Is_perm(0) & (Is_perm(P) ¥imp one_1_map(P))<P>
(1162) Theorem 906: Acyclic(A) ¥imp (not Scycle(A))<P>
(1163) Theorem 907: ((B incs A) & Acyclic(B)) ¥imp Acyclic(A)<P>
(1164) Theorem 908: Acyclic(0) & Is_perm({[X,X]}) & Scycle({[X,X]}) & ((X /= Y) ¥eq Acyclic({[X,Y]}))<P>
(1165) Theorem 909: Is_perm({[X,Y],[Y,X]}) & Scycle({[X,Y],[Y,X]}) & ((X /= Y) ¥imp Straight({[X,Y]},X,Y))<P>
(1166) Theorem 910: Straight(0,X,Y) ¥eq (Y = X)<P>
(1167) Theorem 911: ((X /= Y) & (Y /= Z)) ¥imp ((X /= Z) ¥eq Acyclic({[X,Y],[Y,Z]}))<P>
(1168) Theorem 912: (Straight(Q,X,Y) & Is_perm(P) & (P /= 0)) ¥imp (P ¥nincin Q)<P>
(1169) Theorem 913: Acyclic({[X,Y],[Y,Z]}) ¥imp Straight({[X,Y],[Y,Z]},X,Z)<P>
(1170) Theorem 914: (Scycle(C) & (X in domain(C))) ¥imp Straight(C - {[X,C~[X]]}, C~[X], X)<P>
(1171) Theorem 915: (Straight(P,X,Y) & (P /= 0)) ¥imp ((X in (domain(P) - range(P))) & (Y in (range(P) - domain(P))))<P>
(1172) Theorem 916: (Straight(P,X,Y) & (P /= 0)) ¥imp (({Y} = (range(P) - domain(P))) & ({X} = (domain(P) - range(P))))<P>
(1173) Theorem 917: Ord(N) ¥imp (segm(N,P,S) ¥incin segm(next(N),P,S))<P>
(1174) Theorem 918: (Is_perm(C) & (S ¥incin C) & Ord(Y)) ¥imp (segm(Y,C,S) ¥incin C)<P>
(1175) Theorem 919: (Straight(Q,X,Y) & (Q /= 0)) ¥imp ([X,Q~[X]] in prefix(Q,Q~[X]))<P>
(1176) Theorem 920: (Straight(Q,X,Y) & (Q /= 0)) ¥imp (EXISTS p ¥incin (Q - {[X,Q~[X]]}) | Straight(p, Q~[X], Y))<P>
(1177) Theorem 921: not(Acyclic(R) & Straight(P,Z,Y) & Straight(Q,Y,Z) & ((P + Q) ¥incin R) & ((P + Q) /= 0))<P>
(1178) Theorem 922: (Acyclic(R) & Straight(P,Z,Y) & Straight(Q,X,Z) & ((P + Q) ¥incin R)) ¥imp (EXISTS s ¥incin (P + Q) | Straight(s,X,Y))<P>
(1179) Theorem 923: Is_map(on(R,V)) & (on(R,V) ¥incin R) & (Is_map(R) ¥imp (on(R + inv(R),V) = (on(R,V) + inv(on(R,V)))))<P>
(1180) Theorem 924: Is_map(transCl(R)) & Is_map(trans_reflCl(R,V)) & (trans_reflCl(R,V) ¥incin (V ¥PROD V))<P>
(1181) Theorem 925: Is_map(R) ¥imp (R ¥incin transCl(R))<P>
(1182) Theorem 926: (R ¥incin S) ¥imp (transCl(R) ¥incin transCl(S))<P>
(1183) Theorem 927: ((R ¥incin S) & (N ¥incin M)) ¥imp (trans_reflCl(R,N) ¥incin trans_reflCl(S,M))<P>
(1184) Theorem 928: (transCl(R) ¥incin (domain(R) ¥PROD range(R))) & (Finite(R) ¥imp Finite(transCl(R)))<P>
(1185) Theorem 929: Acyclic(A) ¥imp (([X,X] notin transCl(A)) & (({[X,Y],[Y,Z]} ¥incin transCl(A)) ¥imp ([X,Z] in transCl(A))))<P>
(1185+) Theorem 930: (Acyclic(F) & Finite(T) & (T /= 0)) ¥imp (EXISTS w in T | (FORALL v in T | [v,w] notin transCl(F)))<P>
(1186) Theorem taggedGraph0: [association of its tag to each vertex] (FORALL v | Is_vertex(v) ¥imp (Is_tag(tag1_thryvar(v)) & (v in tag1_thryvar(v))))<P>
(1187) Theorem taggedGraph1: SameTag_thryvar(X,X)<P>
(1187+) Theorem taggedGraph2: (SameTag_thryvar(X,Y) & SameTag_thryvar(Y,Z)) ¥imp SameTag_thryvar(Z,X)<P>
(1188) Theorem taggedGraph3: ((Q ¥incin (R + inv(R))) & Is_map(R) & (FORALL e in R | SameTag_thryvar(car(e),cdr(e))) & (X in domain(Q))) ¥imp SameTag_thryvar(X,(Q~[X]))<P>
(1189) Theorem taggedGraph4: ((Q ¥incin (R + inv(R))) & Is_map(R) & (FORALL e in R | SameTag_thryvar(car(e),cdr(e))) & Straight(Q,X,Y)) ¥imp SameTag_thryvar(X,Y)<P>
(1190) Theorem taggedGraph5: (Is_map(R) & (FORALL e in R | SameTag_thryvar(car(e),cdr(e))) & ([X,Y] in trans_reflCl(R + inv(R),V))) ¥imp SameTag_thryvar(X,Y)<P>
(1191) Theorem acyclicFiniteGraph1: (FORALL t | ((t ¥incin vertices) & (t /= 0)) ¥imp (EXISTS w in t | (FORALL v in t | not([v,w] in transCl(edges)))))<P>
(1192) 	Theorem acyclicFiniteGraph2: (FORALL x, t | (x in vertices) ¥imp (rk2(x,t) = Un({next(rk2(y,t)): y in vertices | ([y,x] in transCl(edges)) & ([y,x] in t)})))<P>
(1193) Theorem acyclicFiniteGraph3: (X in vertices) ¥imp (height_thryvar(X) = Un({next(height_thryvar(y)): y in vertices | [y,X] in edges}))<P>
(1194) Theorem labeledGraph0: (E in edges) ¥imp ((E = [car(E),cdr(E)]) & (car(E) in vertices) & (cdr(E) in vertices))<P>
(1195) Theorem labeledGraph1: (EXISTS y | (V in vertices) ¥imp ((y in tags) & (V in y)))<P>
(1196) Theorem labeledGraph2: ((X in tags) & (Y in tags) & (X /= Y)) ¥imp ((X * Y) = 0)<P>
(1197) Theorem labeledGraph3: [properties of labeled graphs inherited from tagged graphs] (FORALL v | (v in vertices) ¥imp ((tag2_thryvar(v) in tags) & (v in tag2_thryvar(v)))) &	(FORALL v | block_thryvar(v) = if v in vertices then {w in tag2_thryvar(v) | w in vertices} else 0 end if) &	(FORALL v, w | SameTag_thryvar(v,w) ¥eq (block_thryvar(v) = block_thryvar(w))) &	(FORALL v | SameTag_thryvar(v,v)) &	(FORALL q, r, x | ((q ¥incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & (x in domain(q))) ¥imp SameTag_thryvar(x,(q~[x]))) &	(FORALL q, r, x, y | ((q ¥incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & Straight(q,x,y)) ¥imp SameTag_thryvar(x,y)) &	(FORALL r, x, y, v | (Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & ([x,y] in trans_reflCl(r + inv(r),v))) ¥imp SameTag_thryvar(x,y))<P>
(1198) Theorem labeledGraph4: (0 in bisim_thryvar) & (bisim_thryvar ¥incin sim_thryvar) & ((X in bisim_thryvar) ¥imp (X ¥incin (vertices ¥PROD vertices)))<P>
(1199) Theorem labeledGraph5: (B in bisim_thryvar) ¥imp (B ¥incin bisimilar_thryvar)<P>
(1200) Theorem labeledGraph6: (B in bisim_thryvar) ¥imp (inv(B) in bisim_thryvar)<P>
(1201) Theorem labeledGraph7: bisimilar_thryvar ¥incin similar_thryvar<P>
(1202) Theorem labeledGraph8: (B in sim_thryvar) ¥imp (trans_reflCl(B,vertices) in sim_thryvar)<P>
(1203) Theorem labeledGraph9: (B in bisim_thryvar) ¥imp (trans_reflCl(B + inv(B), vertices) in bisim_thryvar)<P>
(1204) Theorem labeledGraph10: ((R in sim_thryvar) & (S in sim_thryvar)) ¥imp ((R + S) in sim_thryvar)<P>
(1205) Theorem labeledGraph11: ((R in bisim_thryvar) & (S in bisim_thryvar)) ¥imp ((R + S) in bisim_thryvar)<P>
(1206) Theorem labeledGraph12: (R in bisim_thryvar) ¥imp (inv(R) in bisim_thryvar)<P>
(1207) Theorem labeledGraph13: Transitive(bisimilar_thryvar) & Symmetric(bisimilar_thryvar) & Reflexive(bisimilar_thryvar,vertices)<P>
(1208) Theorem labeledGraph14: Transitive(similar_thryvar) & Symmetric(similar_thryvar) & Reflexive(similar_thryvar,vertices)<P>
(1209) Theorem 931: [Domains and ranges of direct image] range(G)=(G ¥IM D) + (G ¥IM (domain(G)-D))<P>
(1210) Theorem 932: [Domain decomposition of a map range] ((D*E=0) & Inj(G)) ¥imp ((G ¥IM D) * (G ¥IM E) = 0)<P>
(1211) Theorem 933: [Direct image of a domain element] (X in domain(G)) ¥imp (G ¥IM {X} /=0)<P>
(1212) Theorem 934: [Range of a restricted direct map] G ¥IM D = range(G ¥ON D)<P>
(1213) Theorem 935: [Monotonicity of direct image] (B ¥incin A) ¥imp ((G ¥IM B) ¥incin (G ¥IM A))<P>
(1214) Theorem 936: (0 in Za) &	(FORALL x | (x in Za) ¥imp ((x ¥PLUS 0) = x)) &	(FORALL x,y | ((x in Za) & (y in Za)) ¥imp ((x ¥PLUS y) = (y ¥PLUS x))) &	(FORALL x,y | ((x in Za) & (y in Za)) ¥imp ((x ¥PLUS y) in Za)) &	(FORALL x,y,z | ((x in Za) & (y in Za) & (z in Za)) ¥imp (((x ¥PLUS y) ¥PLUS z) = (x ¥PLUS (y ¥PLUS z))))<P>
(1215) Theorem 937: (FORALL f | (Finite(f) & (range(f) ¥incin Za)) ¥imp (sumZa(f) in Za)) &	(FORALL x | (cdr(x) in Za) ¥imp (sumZa({x}) = cdr(x))) &	(FORALL f,t | (Finite(f) & Is_map(f) & (range(f) ¥incin Za)) ¥imp (sumZa(f) = (sumZa(f ¥ON (domain(f) * t)) ¥PLUS sumZa(f ¥ON (domain(f) - t))))) &	(FORALL c,f | ((c in f) & Finite(f) & (range(f) ¥incin Za)) ¥imp (sumZa(f) = (sumZa(f - {c}) ¥PLUS cdr(c)))) &	(FORALL f,g | (Finite(f) & Svm(f) & Svm(g) & (domain(f) = domain(g)) & (range(f) ¥incin Za)) ¥imp		(sumZa(f) = sumZa({[y,sumZa(f ¥ON (g ¥INV_IM {y}))]: y in range(g)}))) &	(FORALL f,g | (Finite(f) & Svm(f) & one_1_map(g) & (domain(f) = domain(g)) & (range(f) ¥incin Za)) ¥imp		(sumZa(f) = sumZa({[y,f~[inv(g)~[y]]]: y in range(g)})))<P>
(1216) Theorem 938: [basic inclusion-exclusion lemma for two sets] (Finite(X + Y) ¥imp (#(X + Y) = ((#X ¥PLUS #Y) ¥MINUS #(X * Y)))) &	((#(X + Y) ¥PLUS #(X * Y)) = (#X ¥PLUS #Y))<P>
(1217) Theorem 939: [basic inclusion-exclusion lemma for tuples of finite sets] ((domain(A) in Za) & Svm(A) & Finite(Un(range(A)))) ¥imp	(#Un(range(A)) = sumZa({[g,#int(A ¥IM g)]: g ¥incin domain(A) | Odd(#g)}) ¥MINUS sumZa({[g,#int(A ¥IM g)]: g ¥incin domain(A) | (g /= 0) & (not Odd(#g))}))<P>
(1218) Theorem 940: [basic inclusion-exclusion lemma for finitely many finite sets] (Finite(F) & Finite(Un(F))) ¥imp	(#Un(F) = sumZa({[g,#int(g)]: g ¥incin F | Odd(#g)}) ¥MINUS sumZa({[g,#int(g)]: g ¥incin F | (g /= 0) & (not Odd(#g))}))<P>
(1219) 	Theorem 941: [oddity-characterizing assertion] (FORALL s | Finite(s) ¥imp (oddity(s) = if s = 0 then R_0 elseif oddity(s - {arb(s)}) /= R_1 then R_1 else R_Rev(R_1) end if))<P>
(1220) Theorem 942: [basic inclusion-exclusion lemma for finite real-valued maps] (Svm(F) & (F /= 0) & (range(F) ¥incin Re)) ¥imp	(max_over_Re(F) = sumRe({[g,min_over_Re(g)]: g ¥incin F | oddity(g) = R_1}) ¥R_MINUS sumRe({[g,min_over_Re(g)]: g ¥incin F | oddity(g) = R_Rev(R_1)}))<P>
(1221) Theorem 943: [basic inclusion-exclusion lemma for finite real-valued maps, 2] (Svm(F) & (F /= 0) & (range(F) ¥incin Re)) ¥imp	(max_over_Re(F) = sumRe({[g,oddity(g) ¥R_TIMES min_over_Re(g)]: g ¥incin F | g /= 0}))<P>
(1222) Theorem 944: (P in F) ¥imp (pow(F) = {0,{P}} + {g ¥incin (F - {P}) | g /= 0} +				{g + {P} : g ¥incin (F - {P}) | g /= 0})<P>
(1223) Theorem 945: (P in F) ¥imp (pow(F) = {g: g ¥incin (F - {P})} +				{g + {P} : g ¥incin (F - {P})})<P>
(1224) Theorem 946: ({[F,Fp],[G,Gp]} ¥incin samePath(S)) ¥imp ([concat(F,G),concat(Fp,Gp)] in samePath(S))<P>
(1225) Theorem 947: (F in Fin_seqs(S) - {0}) ¥imp (Is_perm({[F~[i],F~[i ¥PLUS 1]]: i in #F ¥MINUS 1} + {[F~[#F ¥MINUS 1],F~[0]]}) ¥eq (0 = {p in redexLoops | car(p) = F}))<P>
(1225+) Theorem 948: ({[F,Fp],[G,Gp]} ¥incin sameWord(S)) ¥imp ([concat(F,G),concat(Fp,Gp)] in sameWord(S))<P>
(1226) Theorem 949: Ord(K) ¥imp divides(K,0)<P>
(1227) Theorem 950: (Card(M) or (M in Za)) ¥imp (divides(1,M) & divides(M,M))<P>
(1228) Theorem 951: (divides(K,I) & divides(I,N)) ¥imp divides(K,N)<P>
(1229) Theorem 952: ((M in Za) & (1 in M)) ¥imp (Is_prime(smallest_factor(M)) & divides(smallest_factor(M),M))<P>
(1230) Theorem 16500: (D in F) ¥imp (pow(F) = {g: g ¥incin (F - {D})} + {g + {D} : g ¥incin (F - {D})})<P>
(1231) Theorem halvesPow1: ((D in s0) & (domain(F) = pow(s0 - {D})) & Is_oddPow(F) & (G = F + {[q + {D},R_Rev(F~[q])]: q in pow(s0 - {D})})) ¥imp		((domain(G) = pow(s0)) & Is_oddPow(G))<P>
(1232) Theorem halvesPow2: ((domain(F) = pow(s0)) & Is_oddPow(F) & (R_0 notin range(F))) ¥imp		(#{q: q ¥incin s0 | F~[q] ¥R_GT R_0} = #{q: q ¥incin s0 | F~[q] ¥R_LT R_0})<P>
(1232+) Theorem halves0: Is_map(wholeP_thryvar) & Finite(wholeP_thryvar)<P>
(1233) Theorem halves1: (H in halvesP_thryvar) ¥imp (sgg_thryvar(H) in oddFcn_thryvar)<P>
(1234) Theorem halves2: (({H,G} ¥incin halvesP_thryvar) & (Q in wholeP_thryvar)) ¥imp ((sgg_thryvar(H)~[Q]) ¥R_OVER (sgg_thryvar(G)~[Q]) = (sgg_thryvar(H)~[Q]) ¥R_TIMES (sgg_thryvar(G)~[Q]))<P>
(1235) Theorem halves3: ({H,G} ¥incin halvesP_thryvar) ¥imp ({[p,(sgg_thryvar(H)~[p]) ¥R_OVER (sgg_thryvar(G)~[p])]: p in wholeP_thryvar} in evenFcn_thryvar)<P>
(1236) Theorem halves4: (({H,G} ¥incin halvesP_thryvar) & Is_even(E) & (domain(E) = wholeP_thryvar)) ¥imp (E ¥H_TIMES H = E ¥H_TIMES G)<P>
(1237) Theorem halves5: ({H,G} ¥incin halvesP_thryvar) ¥imp ((sign_thryvar~[[G,H]] in {R_1,R_Rev(R_1)}) & (sign_thryvar~[[G,H]] = R_1))<P>
(1237+) Theorem halves6: (Is_perm(F) & (domain(F) = s0) & (H in halvesP_thryvar)) ¥imp ((F ¥H_PROD H) in halvesP_thryvar)<P>
(1238) Theorem halves7: (Is_perm(F) & (domain(F) = s0) & ({H,G} ¥incin halvesP_thryvar)) ¥imp (sign_thryvar~[[F ¥H_PROD G,F ¥H_PROD H]] = sign_thryvar~[[G,H]])<P>
(1239) Theorem halves8: (Is_perm(F) & (domain(F) = s0) & (H in halvesP_thryvar)) ¥imp ((sgn_thryvar~[F] in {R_1,R_Rev(R_1)}) & (sgn_thryvar~[F] = sign_thryvar~[[F ¥H_PROD H,H]]))<P>
(1240) Theorem halves9: (Is_perm(D) & Is_perm(F) & (domain(D) = s0) & (domain(F) = s0) & (H in halvesP_thryvar)) ¥imp (Is_perm(D @ F) & (domain(D @ F) = s0) & ((D @ F) ¥H_PROD H) = (D ¥H_PROD (F ¥H_PROD H)))<P>
(1241) Theorem halves10: (Is_perm(D) & Is_perm(F) & (domain(D) = s0) & (domain(F) = s0)) ¥imp (sgn_thryvar~[D @ F] = (sgn_thryvar~[D]) ¥R_TIMES (sgn_thryvar~[F]))<P>
--
--BEGIN HERE ----------------------------------------------------------------------------------------------------
--
-- ************************************************************************************************
--						The Formal Foundations of Mathematical Analysis
-- ************************************************************************************************
--
-- The text which follows is a mixture of formulae and comments, acceptable to the Referee proof verifier
-- and verified thereby, which gives a sequence of formal definitions and proofs covering the foundations of
-- mathematical analysis from its set theoretic roots. These definitions and proofs are expected to
-- extend in time to culminate in a proof of the Cauchy integral theorem of complex analysis.
--
-- The verifier uses an extended form of natural deduction, in which each inference
-- within a proof consists of a 'hint' part defining the inference primitive used to
-- derive a statement, followed (after an occurrence of the separator "$==>$") by
-- the statement itself. Just 18 inference primitives, are used, namely
-- \nextline \begin{tabular}{ll}
-- ELEM   	\nextitem		extended mlss inference \nextline
-- Suppose   	\nextitem	open natural deduction context \nextline
-- Suppose_not   	\nextitem	open proof-by-contradiction argument \nextline
-- Discharge  	\nextitem	close natural deduction context if current context is contradictory \nextline
-- Citation  	\nextitem	statement citation followed by extended mlss inference \nextline
-- Tcitation   	\nextitem	theorem citation followed by extended mlss inference \nextline
-- EQUAL   	\nextitem		use of equalities during blobbing, followed by extended mlss inference \nextline
-- ALGEBRA   	\nextitem	use of algebraic identities during blobbing, followed by extended mlss inference \nextline
-- SIMPLF   	\nextitem	simplify nested setformers \nextline
-- Set_monot   	\nextitem		handle quantifiers and exploit set-theoretic monotonicity relationships \nextline
-- Def    	\nextitem		make a (possibly recursive) definition \nextline
-- Use_def   	\nextitem	cite and use a definition \nextline
-- Loc_def   	\nextitem	make a local definition of some auxiliary constant \nextline
-- THEORY \nextitem	introduce a new named theory \nextline
-- ENTER_THEORY \nextitem	enter the context defined by a theory \nextline
-- Assump   	\nextitem	cite a theory assumption \nextline
-- APPLY   	\nextitem		apply a theory
-- QED \nextitem terminate the proof of a theorem
--\end{tabular}
-- The formal material presented falls into various sections, each roughly corresponding to some
-- recognized area of mathematics.
--
-- ************************************************************************************************
--			Section 1: Basic Operations of set theory and the theory of ordinals
-- ************************************************************************************************
--
-- Our first step is to recast the axioms of choice and of infinity, which are built-in
-- assumptions of set theory, as the two following small utility theorems.
--
Theorem 0: [Axiom of Choice] ((S = 0) & (arb(S) = 0)) or ((arb(S) in S) & (arb(S) * S = 0)). Proof:
Suppose_not(s) ==> AUTO
Assump ==> Stat1: (FORALL s in OM | (((s = 0) & (arb(s) = 0)) or ((arb(s) in s) & (arb(s) * s = 0))))
s-->Stat1 ==> false; Discharge ==> QED
--
-- The following theorem simply restates the axiom of infinity.
--
Theorem 00: [Axiom of Infinity] (s_inf /= 0) & (FORALL x in s_inf | {x} in s_inf). Proof:
Suppose_not ==> AUTO
Assump ==> (s_inf /= 0) & (FORALL x in s_inf | {x} in s_inf)
Discharge ==> QED
--
-- After this, we begin by making a trick, purely set-theoretic definition of the notion of ordered pair,
-- and proving a few simple lemmas which tell us how to extract the first and second components of a pair.
--
Def 1: [Ordered pair] Def([X,Y]) := {{X},{{X},{{Y},Y}}}
--
-- Our first result is a lemma stating a basic property of 'arb'.
-- Its proof is elementary.
--
Theorem 1: [Choice from singleton] arb({X}) = X. Proof:
Suppose_not(c) ==> AUTO
Discharge ==> QED
--
-- Next we give a lemma which prepares for definition of the first-component extractor
-- from an ordered pair. Its proof is elementary.
--
Theorem 2: [Choice from set of 2] (X in Y) ¥imp (arb({Y,X}) = X). Proof:
Suppose_not(c,d) ==> AUTO
Discharge ==> QED
--
-- The following lemma also prepares for definition of the first-component extractor
-- from an ordered pair. Its proof is elementary.
--
Theorem 3: [Choice from pair] arb([X,Y]) = {X}. Proof:
Suppose_not(c,d) ==> AUTO
Use_def([]) ==> Stat1: arb({{c},{{c},{{d},d}}}) /= {c}
({c},{{c},{{d},d}})-->T2(Stat1*) ==> false; Discharge ==> QED
--
-- The following is a third lemma which prepares for definition of the first-component extractor
-- from an ordered pair. Its proof is elementary.
--
Theorem 4: [Choice from special set of 2] arb({X,{X,Y}}) = X. Proof:
Suppose_not(x,y) ==> AUTO
Discharge ==> QED
--
-- Finally, we give the formula for the first-component extractor
-- from an ordered pair, along with its proof, which remains elementary.
--
Theorem 5: [Choice from pair, 2] arb(arb([X,Y])) = X. Proof:
    Suppose_not(c,d) ==> arb(arb([c,d])) /= c
    Use_def([]) ==> Stat1: arb(arb({{c},{{c},{{d},d}}})) /= c
    ()ELEM ==> (arb({{c},{{c},{{d},d}}}) = {c}) & (arb({c}) = c)
    EQUAL(Stat1) ==> false; Discharge ==> QED
--
-- Next we give a lemma which prepares for definition of the second-component extractor
-- from an ordered pair. Its proof is elementary.
--
Theorem 6: [cdr choice] arb(arb(arb([X,Y] - {arb([X,Y])}) - {arb([X,Y])})) = Y. Proof:
    Suppose_not(c,d) ==> arb(arb(arb([c,d] - {arb([c,d])}) - {arb([c,d])})) /= d
    (c,d)-->T3 ==> arb([c,d]) = {c}
    EQUAL ==> arb(arb(arb([c,d] - {{c}}) - {{c}})) /= d
    Use_def([]) ==> arb(arb(arb({{c},{{c},{{d},d}}} - {{c}}) - {{c}})) /= d
--    Use_def([](c,d)->Stat1) ==> AUTO
    TELEM ==> arb({{c},{{c},{{d},d}}} - {{c}}) = {{c},{{d},d}}
    EQUAL ==> Stat2: arb(arb({{c},{{d},d}} - {{c}}))  /= d
    (Stat2)Discharge ==> QED
--
-- Now we can give formal definitions of both ordered-pair component extractor functions.
--
Def 2: [First component of ordered pair] car(X) := arb(arb(X))
Def 3: [Second component of ordered pair] cdr(X) := arb(arb(arb(X - {arb(X)}) - {arb(X)}))
--
-- The following basic property of the  first-component extractor function
-- is an elementary consequence of the preceding lemmas.
--
Theorem 7: [car of pair] car([X,Y]) = X. Proof:
	Suppose_not(x,y) ==> car([x,y]) /= x
	Use_def(car) ==> arb(arb([x,y])) /= x
	(x,y)-->T5 ==> false;  Discharge ==> QED
--
-- Similarly, the basic property of the second-component extractor function
-- is an elementary consequence of the preceding lemmas.
--
Theorem 8: [cdr of pair] cdr([X,Y]) = Y. Proof:
	Suppose_not(x,y) ==> cdr([x,y]) /= y
	Use_def(cdr) ==> arb(arb(arb([x,y] - {arb([x,y])}) - {arb([x,y])})) /= y
	(x,y)-->T6 ==> false;  Discharge ==> QED
--
-- The following basic relationship between ordered pair formation and component extraction
-- is also an elementary consequence of the preceding lemmas.
--
Theorem 9: [Ordered pair property] (car([X,Y]) = X) & (cdr([X,Y]) = Y). Proof:
Suppose_not(x,y) ==> AUTO
(x,y)-->T7 ==> AUTO
(x,y)-->T8 ==> AUTO
Discharge ==> QED
--
Theorem 10: [Ordered pair property, 2] [X,Y] = [car([X,Y]),cdr([X,Y])]. Proof:
Suppose_not(x,y) ==> AUTO
(x,y)-->T9 ==> AUTO
EQUAL ==> false; Discharge ==> QED
--
-- The fact that any pair is the pair of its first and second components is equally elementary.
--
Theorem 11: [Pair reconstruction lemma] (U = [A,B]) ¥imp (U = [car(U),cdr(U)]). Proof:
Suppose_not(u,a,b) ==> AUTO
(a,b)-->T7 ==> AUTO
(a,b)-->T8 ==> AUTO
Discharge ==> QED
--
-- Next we introduce a first 'THEORY', which simply encapsulates the fact that
-- the 'if ... then ... else ... end if'
-- term constructor commutes with any monadic term constructor.
--
THEORY if_then_else(p,a,b,f(x)) [Elementary properties of if_then_else]
END if_then_else
--
ENTER_THEORY if_then_else
--
Theorem if_then_else.1: [commutativity property of if_then_else] f(if p then a else b end if) = if p then f(a) else f(b) end if. Proof:
Suppose_not ==> AUTO
	Suppose ==> p
		ELEM ==> (a = if p then a else b end if) & (f(a) = if p then f(a) else f(b) end if)
	EQUAL ==> false; Discharge ==> (b = if p then a else b end if) & (f(b) = if p then f(a) else f(b) end if)
EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY if_then_else
--
--THEORY if_then_else(p,a,b,f(x)) [Elementary properties of if_then_else]
--==>
--f(if p then a else b end if) = if p then f(a) else f(b) end if
--END if_then_else
--
-- Next we introduce a second 'THEORY', which regards nested occurrences
-- of the 'if ... then ... else ... end if'
-- term constructor.
--
THEORY if_then_else2(q,p,a,b,c,pp,ap,bp,cp) [Conditioned interchange of nested occurrences of if_then_else]
	(q ¥imp (p & (a = ap)))
	(not q) ¥imp (p ¥eq pp)
	((not q) & p) ¥imp (b = bp)
	((not q) & (not p)) ¥imp (c = cp)
END if_then_else2
--
ENTER_THEORY if_then_else2
--
Theorem if_then_else2.1: [Conditioned interchange of nested occurrences of if_then_else] if p then if q then a else b end if else c end if = if q then ap else if pp then bp else cp end if end if. Proof:
Suppose_not ==> AUTO
	Suppose ==> q
		Assump ==> (q ¥imp (p & (a = ap)))
	Discharge ==> (not q)
	Assump ==> (not q) ¥imp (p ¥eq pp)
	Suppose ==> p
		Assump ==> ((not q) & p) ¥imp (b = bp)
 	Discharge ==> (not p)
	Assump ==> ((not q) & (not p)) ¥imp (c = cp)
Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY if_then_else2
--
--THEORY if_then_else2(q,p,a,b,c,pp,ap,bp,cp) [Conditioned interchange of nested occurrences of if_then_else]
--	(q ¥imp (p & (a = ap)))
--	(not q) ¥imp (p ¥eq pp)
--	((not q) & p) ¥imp (b = bp)
--	((not q) & (not p)) ¥imp (c = cp)
--==>
--	if p then if q then a else b end if else c end if = if q then ap else if pp then bp else cp end if end if
--END if_then_else2
--
-- Next we introduce a third 'THEORY', which simply encapsulates the fact that the value of
-- a set former is defined uniquely by the expression and predicate it contains.
--
THEORY setformer(e(x),ep1(x),s,p(x),pp1(x))	[Elementary properties of setformers]
END setformer;
--
ENTER_THEORY setformer
--
-- The following theorem results easily by use of our mechanism of
-- variable substitution into setformers known to be different.
--
Def setformer.0: [Witness to difference of two setformers] x1_thryvar := arb({x in s | (e(x) /= e0(x) or (not(P(x) ¥eq PP(x))))})
--
Theorem setformer.1: [Equality of setformers] ((x1_thryvar notin s) or ((e(x1_thryvar) = e0(x1_thryvar)) & (P(x1_thryvar) ¥eq PP(x1_thryvar)))) ¥imp
							({e(x): x in s | P(x)} = {e0(x): x in s | PP(x)}). Proof:
    Suppose_not ==> ((x1_thryvar notin s) or ((e(x1_thryvar) = e0(x1_thryvar)) & (P(x1_thryvar) ¥eq PP(x1_thryvar)))) &
    		Stat1: ({e(x): x in s | P(x)} /= {e0(x): x in s | PP(x)})
--
-- For let $s$ be a counterexample to our assertion, and let $c$ be some element of one of the sets
-- ${e(x): x in s | P(x)}$ and ${e0(x): x in s | PP(x)}$ but not the other.
-- Supposing that $c$ belongs to the first of these sets but not the second, a
-- contradiction results immediately from the axiom of choice, and similarly in
-- the symmetric case. So the negative of our assertion leads to a contradiction in every case,
-- proving the present theorem.
--
    c-->Stat1 ==> (c in s) & ((e(c) /= e0(c)) or ((P(c) and (not PP(c))) or ((not P(c)) and PP(c))))
    Suppose ==> Stat2: c notin {x in s | (e(x) /= e0(x) or (not(P(x) ¥eq PP(x))))}
    c-->Stat2 ==> false; Discharge ==> {x in s | (e(x) /= e0(x) or (not(P(x) ¥eq PP(x))))} /= 0
    {x in s | (e(x) /= e0(x) or (not(P(x) ¥eq PP(x))))}-->T0 ==>
    	arb({x in s | (e(x) /= e0(x) or (not(P(x) ¥eq PP(x))))}) in {x in s | (e(x) /= e0(x) or (not(P(x) ¥eq PP(x))))}
    Use_def(x1_thryvar) ==> Stat3: x1_thryvar in {x in s | (e(x) /= e0(x) or (not(P(x) ¥eq PP(x))))}
	()-->Stat3 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The following small utility theory describes a few elementary cases
-- in which we can be sure that a set is non-null
--
THEORY setformer0(e(x),s,P(x))	[More elementary properties of setformers]
END setformer0;
--
ENTER_THEORY setformer0
--
-- The following theorem results easily by use of our mechanism of
-- variable substitution into a setformer known to be non-null.
--
Theorem setformer01: [Empty setformer lemma] (s /= 0) ¥imp ({e(x): x in s} /= 0). Proof:
    Suppose_not ==> Stat1: (s /= 0) & Stat2: ({e(x): x in s} = 0)
    c-->Stat1 ==> AUTO
    c-->Stat2 ==> AUTO
    Discharge ==> QED
--
-- The following theorem also results easily by use of our mechanism of
-- variable substitution into a setformer known to be non-null.
--
Theorem setformer02: [Empty setformer lemma 2] ({x in s | P(x)} /= 0) ¥imp ({e(x): x in s | P(x)} /= 0). Proof:
    Suppose_not ==> Stat1: AUTO
    (c)-->Stat1 ==> AUTO
    ELEM ==> Stat2: e(c) notin {e(x): x in s | P(x)}
    c-->Stat2 ==> AUTO
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The following utility theory is the two-variable analog of the 'setformer'
-- theory given above. It encapsulates the fact that the value of
-- a two-variable set former is defined uniquely by the expression and predicate it contains.
--
THEORY setformer2(e2(x,y),ep2(x,y),f(x),fp(x),s,R(x,y),PQ(x,y))
END setformer2;
--
ENTER_THEORY setformer2
--
Def setformer2.0a: [Witness to difference of two setformers, two-variable case] xy1_thryvar := arb({[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))})
Def setformer2.0b: [First component of difference witness] x2_thryvar := car(xy1_thryvar)
Def setformer2.0c: [Second component of difference witness] y2_thryvar := cdr(xy1_thryvar)
--
-- The following theorem results easily along the same line of proof used in proving Theorem setformer.1.
--
    Theorem setformer2_1: [Equality of mapformers] (((x2_thryvar notin s) or (y2_thryvar notin (f(x2_thryvar) + fp(x2_thryvar)))) or
    	(((f(x2_thryvar) = fp(x2_thryvar)) & (e2(x2_thryvar,y2_thryvar) = ep2(x2_thryvar,y2_thryvar)) &
    		(R(x2_thryvar,y2_thryvar) ¥eq PQ(x2_thryvar,y2_thryvar))))) ¥imp
    			({e2(x,y): x in s, y in f(x) | R(x,y)} = {ep2(x,y): x in s, y in fp(x) | PQ(x,y)}). Proof:
--
-- For let $s$ be a counterexample to our assertion, and let $c$ be some element of one of the sets
-- ${e2(x,y): x in s, y in f(x) | R(x,y)}$ and ${ep2(x,y): x in s, y in fp(x) | PQ(x,y)}$ but not the other.
-- Supposing that $c$ belongs to the first of these sets but not the second, a
-- contradiction results easily from the axiom of choice.
--
    Suppose_not ==> (((x2_thryvar notin s) or (y2_thryvar notin (f(x2_thryvar) + fp(x2_thryvar)))) or
    	(((f(x2_thryvar) = fp(x2_thryvar)) & (e2(x2_thryvar,y2_thryvar) = ep2(x2_thryvar,y2_thryvar)) &
    		(R(x2_thryvar,y2_thryvar) ¥eq PQ(x2_thryvar,y2_thryvar))))) &
    		Stat1: ({e2(x,y): x in s, y in f(x) | R(x,y)} /= {ep2(x,y): x in s, y in fp(x) | PQ(x,y)})
    c-->Stat1 ==> (c in {e2(x,y): x in s, y in f(x) | R(x,y)}) ¥eq (c notin {ep2(x,y): x in s, y in fp(x) | PQ(x,y)})
    Suppose ==> Stat2: (c in {e2(x,y): x in s, y in f(x) | R(x,y)}) & (c notin {ep2(x,y): x in s, y in fp(x) | PQ(x,y)})
--
-- Indeed, there must exist $x$ and $y$ in $s$ and $f(x)$ respectively for which $c = e2(x,y)$
-- but for which one of the clauses of $(y in fp(x)) & PQ(x,y) & (c = ep2(x,y))$ is false.
--
    (x,y,x,y)-->Stat2 ==> (x in s) & (y in f(x)) & R(x,y) & (c = e2(x,y)) &
    							(not((x in s) & (y in fp(x)) & PQ(x,y) & (c = ep2(x,y))))
    Suppose ==> Stat3: [x,y] notin {[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))}
    (x,y)-->Stat3 ==> false; Discharge ==>
    	{[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))} /= 0
--
-- This is easily seen to imply that the set
--
--	${[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))}$
--
-- is non-null, so that by the axiom of choice $xy1_thryvar$ is a member of it.
-- But then the components $x2_thryvar$ and  $y2_thryvar$ of $xy1_thryvar$ plainly
-- violate the hypotheses of the present theorem, and so rule out our initial supposition.
--
    {[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))}-->T0 ==>
    	arb({[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))}) in
    		{[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))}
    Use_def(xy1_thryvar) ==>
    	Stat4: xy1_thryvar in {[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))}
    (x2,y2)-->Stat4 ==> (xy1_thryvar = [x2,y2]) & (x2 in s) & (y2 in (f(x2) + fp(x2))) &
    		((f(x2) /= fp(x2)) or e2(x2,y2) /= ep2(x2,y2) or (not(R(x2,y2) ¥eq PQ(x2,y2))))
    ELEM ==> (x2 = car(xy1_thryvar)) & (y2 = cdr(xy1_thryvar))
    Use_def(x2_thryvar) ==> x2_thryvar = x2
    Use_def(y2_thryvar) ==> y2_thryvar = y2
    EQUAL ==> false; Discharge ==>
    	Stat5: (c in {ep2(x,y): x in s, y in fp(x) | PQ(x,y)}) & (c notin {e2(x,y): x in s, y in f(x) | R(x,y)})
--
-- The same argument can be given in the symmetric case,
-- and so the negative of our assertion leads to a contradiction in every case,
-- proving the present theorem.
--
   (xx,yy,xx,yy)-->Stat5 ==> (xx in s) & (yy in fp(xx)) & PQ(xx,yy) & (c = ep2(xx,yy)) &
    						(not((xx in s) & (yy in f(xx)) & R(xx,yy) & (c = e2(xx,yy))))
    Suppose ==> Stat6: [xx,yy] notin {[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))}
   	(xx,yy)-->Stat6 ==> false; Discharge ==>
    	{[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))} /= 0
    {[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))}-->T0 ==>
    	arb({[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))}) in
    		{[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))}
    Use_def(xy1_thryvar) ==>
    	Stat7: xy1_thryvar in {[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) ¥eq PQ(x,y))))}
    (x3,y3)-->Stat4 ==> (xy1_thryvar = [x3,y3]) & (x3 in s) & (y3 in (f(x3) + fp(x3))) &
    		((f(x3) /= fp(x3)) or e2(x3,y3) /= ep2(x3,y3) or (not(R(x3,y3) ¥eq PQ(x3,y3))))
    ELEM ==> (x3 = car(xy1_thryvar)) & (y3 = cdr(xy1_thryvar))
    Use_def(x2_thryvar) ==> x2_thryvar = x3
    Use_def(y2_thryvar) ==> y2_thryvar = y3
    EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The following utility theory encapsulates the fact that given any set and predicate $P(x)$,
-- one can always obtain a (generally smaller) set consisting of precisely
-- those entities which satisfy $P$.
--
THEORY comprehension(s,P(x))
END comprehension;
--
ENTER_THEORY comprehension
--
-- We begin by defining the element considered in the proof which follows.
--
Def 00g: [Set former] tt_thryvar := {x in s | P(x)}
--
Theorem comprehension1: [Setformer existence] (X in tt_thryvar) ¥eq ((X in s) & P(X)). Proof:
    Suppose_not(x) ==> not(((x in S) & P(x)) ¥eq (x in tt_thryvar))
--
-- For the contrary assumption would lead to the following contradiction:
--
	Use_def(tt_thryvar) ==> not(((x in s) & P(x)) ¥eq (x in {u in s | P(u)}))
	Suppose ==> (x in s) & P(x) & Stat1: (x notin {u in s | P(u)})
	x-->Stat1 ==> false; Discharge ==> (not ((x in S) & P(x))) & Stat2: (x in {u in s | P(u)})
	()-->Stat2 ==> false; Discharge ==> QED
--
Theorem comprehension2: [Setformer inclusion lemma] {x in s | P(x)} ¥incin s. Proof:
    Suppose_not ==> Stat1: not({x in s | P(x)} ¥incin s)
        x-->Stat1 ==> Stat2: (x in {x in s | P(x)}) & (x notin s)
    ()-->Stat2 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The following summarizes what has just been proved.
--
--DISPLAY comprehension
--
--THEORY comprehension(s,P(x))
--==>(tt_thryvar)
--	 (X in tt_thryvar) ¥eq ((X in s) & P(X))
--	 {x in s | P(x)} ¥incin s
--END comprehension;
--
-- Our more serious work now begins with proofs of the basic properties
-- of ordinals. Our first step is to give von Neumann's
-- definition of ordinals: an ordinal is a set which is transitively closed
-- and totally ordered under membership.
--
Def 10: [Is-an-ordinal predicate] Ord(S) := (FORALL x in S | x ¥incin S) & (FORALL x in S, y in S | (x in y or y in x or x = y))
--
-- Next we prove a first basic property of ordinals: any member of an ordinal is an ordinal.
--
Theorem 12: [Members of ordinals are ordinals] (Ord(S) & (T in S)) ¥imp Ord(T). Proof:
    Suppose_not(s,t) ==> AUTO
--
-- We proceed by contradiction. If our theorem is false, there is an ordinal $s$
-- having a member $t$ which is not an ordinal.
--
    Use_def(Ord) ==>
	Stat1: not((FORALL x in t | x ¥incin t) & (FORALL x in t, y in t | (x in y or y in x or x = y)))
--
-- Hence, by definition of ordinal, $t$ must either have a member $a$ not included in $t$,
-- or a pair $b, c$ of distinct members not related by membership.
--
    (a,b,c)-->Stat1 ==> AUTO
--
-- But since $s$ is an ordinal, it must include its member $t$, so that the second case is impossible.
--
    Use_def(Ord) ==>
	Stat2: (FORALL x in s | x ¥incin s) & Stat3: (FORALL x in s, y in s | (x in y or y in x or x = y))
    t-->Stat2 ==> AUTO
    Suppose ==> (b in t) & (c in t) & (not(b in c or c in b or b = c))
    (b,c)-->Stat3 ==> AUTO
    Discharge ==> Stat4: (not(a ¥incin t)) & (a in t)
--
-- Thus we need only consider the first case, in which $a$ is a member but not a subset of $t$.
-- In this case there plainly exists a $d$ in $a$ but not in $t$. Plainly $a$ is a member of $s$,
-- and thus a subset of $s$; so $d$ is also a member of $s$.
--
     (d)-->Stat4 ==> (d in a) & (not(d in t))
     a-->Stat2 ==> a ¥incin s
     ELEM ==> d in s
--
-- By definition of ordinal, it follows that $d$ either equals $t$, is a member of $t$, or that
-- $t$ is a member of $d$. But all three of these cases are impossible, since any would imply the
-- existence of a membership cycle. This contradiction proves our theorem.
--
     (d,t)-->Stat3 ==> (d in t or t in d or t = d)
     (Stat4)Discharge ==> QED
--
-- The following property of ordinals follows directly from their definition.
--
Theorem 13: [Ordinal membership implies inclusion] (Ord(S) & (T in S)) ¥imp (T ¥incin S). Proof:
     Suppose_not(s,t) ==> Ord(s) & (t in s) & (not (t ¥incin s))
     Use_def(Ord) ==> Stat1: (FORALL x in s | x ¥incin s)
     t-->Stat1 ==> false; Discharge ==> QED
--
-- We continue by considering and proving various useful forms of the principle of transfinite
-- induction, formulating  these as a succession of utility theories. We begin with an induction
-- principle for ordinals. This tells us that if an ordinal has a certain property, it must
-- include some subset which is an ordinal with this same property, but which contains no member
-- that has the property in question. In fact, this subset can be defined as $arb(aux_set)$, where
--	$aux_set := {x ¥incin o | Ord(x) & P(x)}$.
--
THEORY ordinal_induction(o,P(x))
    Ord(o) & P(o)
END ordinal_induction;
--
ENTER_THEORY ordinal_induction
--
-- We begin by defining the element considered in the proof which follows.
--
Def ordinal_induction.0: [Witness for ordinal induction arguments] t_thryvar := arb({x ¥incin o | Ord(x) & P(x)})
--
Theorem ord_ind1: [Transfinite induction principle] Ord(t_thryvar) & P(t_thryvar) & (t_thryvar ¥incin o) & (FORALL x in t_thryvar | not P(x)). Proof:
	Suppose_not ==>
	Stat1: not((FORALL x in t_thryvar | not P(x)) & Ord(t_thryvar) & P(t_thryvar) & (t_thryvar ¥incin o))
	c-->Stat1 ==> AUTO
--
-- We proceed by contradiction, and begin by noting that the set $aux_set$
-- displayed above is not empty.  Indeed, $o$ is obviously a member of it.
--
    Suppose ==> Stat2: {x ¥incin o | Ord(x) & P(x)} = 0
    ELEM ==> Stat3: o notin {x ¥incin o | Ord(x) & P(x)}
    o-->Stat3 ==> AUTO
    Assump ==> Ord(o) & P(o)
    Discharge ==> {x ¥incin o | Ord(x) & P(x)} /= 0
--
-- The axiom of choice now tells us that $t_thryvar$ as defined above must be a minimal element of $aux_set$,
-- and so must clearly satisfy $Ord(t_thryvar) & P(t_thryvar) & (t_thryvar ¥incin o)$.
-- This rules out the first of the two cases listed above, leaving only the second.
--
	Use_def(t_thryvar) ==> t_thryvar = arb({x ¥incin o | Ord(x) & P(x)})
    {x ¥incin o | Ord(x) & P(x)}-->T0 ==>
	Stat4: (t_thryvar in {x ¥incin o | Ord(x) & P(x)}) & (t_thryvar * {x ¥incin o | Ord(x) & P(x)} = 0)
    t_thryvar-->Stat4 ==> AUTO
    ELEM ==> (c in t_thryvar) & P(c)
--
-- Since $t_thryvar$ is an ordinal, it must by definition include its member $c$,
-- which must therefore also be a subset of $o$ and an ordinal.
--
    (t_thryvar,c)-->T13 ==> c ¥incin t_thryvar
    ELEM ==> c ¥incin o
    (t_thryvar,c)-->T12 ==> Ord(c)
--
-- Thus $c$ has the properties required to make it an element of $aux_set$.
-- But this contradicts the minimality of $t_thryvar$, and so proves our theorem.
--
   Suppose ==> Stat5: c notin {x ¥incin o | Ord(x) & P(x)}
   (c)-->Stat5 ==> false; Discharge ==> c in {x ¥incin o | Ord(x) & P(x)}
   Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The following small THEORY summarizes what has just been proved.
--
--DISPLAY ordinal_induction
--
--THEORY ordinal_induction(o,P(x))
--    Ord(o) & P(o)
--==>(t_thryvar)
--    Ord(t_thryvar) & P(t_thryvar) & (t_thryvar ¥incin o) & (FORALL x in t_thryvar | not P(x))
--END ordinal_induction;
--
-- ************************************************************************************************
--			Section 2: Other versions of the principle of transfinite induction
-- ************************************************************************************************
--
-- Next we consider and prove several other forms of the principle of transfinite
-- induction which are sometimes easier to use.
-- We aim to show that if a set has a specified property, it contains
-- a subset having this property, none of whose members have the property.
-- The following definition, of the set of all elements which are linked to
-- a set $s$ by a chain of memberships, and so are its 'ultimate members',
-- starts to prepare for this.
--
Def 35a: [Transitive membership closure of $S$] Ult_membs(S) := S + {y: u in {Ult_membs(x): x in S}, y in u}
--
-- Our goal is to prove that $Ult_membs(S)$ includes $S$, and that $Ult_membs(S)$ is
-- transitively closed under membership. The proof of this
-- second fact, which is given somewhat below,  will involve use of the axiom of infinity.
-- The first of these facts, captured in the following lemma, is an immediate
-- consequence of the definition of $Ult_membs$.
--
Theorem 14: [Ultimate members lemma] S ¥incin Ult_membs(S). Proof:
    Suppose_not(s) ==> AUTO
    Use_def(Ult_membs) ==> Ult_membs(s) = s + {y: u in {Ult_membs(x): x in s}, y in u}
    Discharge ==> QED
--
-- Our next small lemma simply reformulates the definition of $Ult_membs$ as an identity.
--
Theorem 15: [Ultimate members lemma 2] Ult_membs(S) = S + {v: x in S, v in Ult_membs(x)}. Proof:
    Suppose_not(s) ==> AUTO
    Use_def(Ult_membs) ==> Ult_membs(s) = s + {v: u in {Ult_membs(x): x in s}, v in u}
    SIMPLF ==> false; Discharge ==> QED
--
-- It follows immediately from the definition of $Ult_membs$ that $Ult_membs$
-- includes all the members of its members.
--
Theorem 16: [Key property of ultimate members set] ((X in S) & (Y in X)) ¥imp (Y in Ult_membs(S)). Proof:
    Suppose_not(x,s,y) ==> AUTO
    s-->T15 ==> Stat1: y notin {v: x in s, v in Ult_membs(x)}
    (x,y)-->Stat1 ==> y notin Ult_membs(x)
    x-->T15 ==> y notin x
    Discharge ==> QED
--
-- For the special case of an ordinal $s$ we can show, using the
-- principle of ordinal induction established above, that $Ult_membs(s) = s$.
--
Theorem 17: [An ordinal is its own set of ultimate members] (Ord(S)) ¥imp (Ult_membs(S) = S). Proof:
--
-- We proceed by contradiction. If our theorem is false, there is an ordinal $s$
-- which is not identical to $Ult_membs(s)$, and so, by Theorem 14, is not included in $s$.
--
    Suppose_not(s) ==> AUTO
    s-->T14 ==> Ord(s) & (not(Ult_membs(s) ¥incin s))
--
-- Thus the principle of ordinal induction tells us that $s$ contains
-- a minimal ordinal $t$ with this property.
--
    APPLY(t_thryvar:t) ordinal_induction(o->s,P(x)->not(Ult_membs(x) ¥incin x)) ==>
		Stat1: Ord(t) & (not(Ult_membs(t) ¥incin t)) & Stat2: (FORALL x in t | not(not(Ult_membs(x) ¥incin x)))
	a0-->Stat1 ==> Ord(t) & Stat3: (not(Ult_membs(t) ¥incin t))
--
-- It follows that $Ult_membs(t)$ has an element $c$ which does not belong to $t$.
-- By Theorem 15, $c$ must belong to ${v: x in t, v in Ult_membs(x)}$, and so
-- there must exist an $x in t$ such that $c in Ult_membs(x)$.
--
    c-->Stat3 ==> AUTO
    t-->T15 ==> Stat4: c in {v: x in t, v in Ult_membs(x)}
    (x,v)-->Stat4 ==> AUTO
--
-- By Stat2 above, $x$ must satisfy $Ult_membs(x) ¥incin x$, so $c$ must belong to $x$.
--
    x-->Stat2 ==> (Ult_membs(x) ¥incin x) & (c in x)
--
-- Since $t$ is an ordinal, its member $x$ must be included in it; so $c$ must be a member of $t$,
-- contrary to what has been proved above. This contradiction proves our theorem.
--
    (t,x)-->T13 ==> x ¥incin t
    Discharge ==> QED
--
-- Our next small lemma expresses $Ult_membs({s})$ in terms of $Ult_membs(s)$.
--
Theorem 18: [Ultimate members of a singleton] Ult_membs({S}) = {S} + Ult_membs(S). Proof:
    Suppose_not(s) ==> Ult_membs({s}) /= {s} + Ult_membs(s)
    Use_def(Ult_membs) ==> Ult_membs({s}) = {s} + {y: u in {Ult_membs(x): x in {s}}, y in u}
    ELEM ==> {s} + {y: u in {Ult_membs(x): x in {s}}, y in u} /= {s} + Ult_membs(s)
--
-- If our theorem were false, we could use the definition of $Ult_membs$ to obtain the
-- set inequality displayed above, which simplifies to an impossibility:
--
    SIMPLF ==> {y: u in {Ult_membs(x): x in {s}}, y in u} = {y: x in {s}, y in Ult_membs(x)}
    SIMPLF ==> {y: x in {s}, y in Ult_membs(x)} = {y: y in Ult_membs(s)}
    SIMPLF ==> {y: y in Ult_membs(s)} = Ult_membs(s)
    Discharge ==> QED
--
-- We also note the following elementary consequence of Theorem 17 and Theorem 18,
-- which tells us that the set of ultimate members of a singleton
-- consisting of just one ordinal is its successor ordinal.
--
Theorem 19: [Ultimate members of an ordinal singleton] Ord(S) ¥imp (Ult_membs({S}) = S + {S}). Proof:
    Suppose_not(s) ==> AUTO
    s-->T18 ==> AUTO
    s-->T17 ==> false; Discharge ==> QED
--
-- The 'union set' of a set $s$ is the union of all its members, or, equivalently,
-- the set of all members of members of $s$. For sets of ordinals, this is the least upper bound.
--
Def 25: [Union Set] Un(S) := {x: y in S, x in y}
--
-- Now we start to prepare more closely for the proof of a preliminary version of the principle
-- of transfinite induction by making a few auxiliary definitions.
-- First we introduce 'the set of all $x$ which are either members of $s$ or members of members of $s$:'
--
	Def 7g: [Set of members of members] membs2(S) := S + Un(S)
--
-- Next, using the axiom of infinity and the set $s_inf$ which it provides,
-- we extend this definition recursively.
--
	Def 7h: [Recursively defined iterated members] membs_x(S,X) := if X = arb(s_inf) then S else membs2(Un({membs_x(S,y): y in X})) end if
--
-- This lets us define a set including $s$ which we will show to be transitively closed under membership.
--
	Def 7i: [Ultimate members of a set, first definition] Ult_memb1(S) := Un({membs_x(S,x): x in s_inf})
--
-- First we need the following simple lemma:
--
Theorem 20: [Ultimate members of the basic infinite set] (X in s_inf) ¥imp (membs_x(S,{X}) = membs_x(S,X) + Un(membs_x(S,X))). Proof:
	Suppose_not(x,s) ==> (x in s_inf) & (membs_x(s,{x}) /= membs_x(s,x) + Un(membs_x(s,x)))
--
-- Since $x in s_inf$, ${x} /= arb(s_inf)$,
-- and so $membs_x(s,{x}) = membs2(Un({membs_x(s,y): y in {x}}))$ by definition.
--
	ELEM ==> {x} /= arb(s_inf)
	Use_def(membs_x) ==> membs_x(s,{x}) = if {x} = arb(s_inf) then s else membs2(Un({membs_x(s,y): y in {x}})) end if
	ELEM ==> membs2(Un({membs_x(s,y): y in {x}})) /= membs_x(s,x) + Un(membs_x(s,x))
--
-- This inequality simplifies to $membs2(membs_x(s,x)) /= membs_x(s,x) + Un(membs_x(s,x))$,
-- which contradicts the definition of $membs2(membs_x(s,x))$, and so proves our lemma.
--
	SIMPLF ==> membs2(Un({membs_x(s,x)})) /= membs_x(s,x) + Un(membs_x(s,x))
	Use_def(Un) ==> membs2({u: y in {membs_x(s,x)}, u in y}) /= membs_x(s,x) + Un(membs_x(s,x))
	SIMPLF ==> {u: y in {membs_x(s,x)}, u in y} = {u: u in membs_x(s,x)}
	SIMPLF ==> {u: u in membs_x(s,x)} = membs_x(s,x)
	EQUAL ==> membs2(membs_x(s,x)) /= membs_x(s,x) + Un(membs_x(s,x))
	Use_def(membs2) ==> false; Discharge ==> QED
--
-- Now we can prove that, for any set $s$, $Ult_memb1(s)$ includes $s$ and is membership-transitive.
--
Theorem 21: [Ultimate members lemma 3] (S ¥incin Ult_memb1(S)) & (((X in Ult_memb1(S)) & (Y in X)) ¥imp (Y in Ult_memb1(S))). Proof:
--
-- We proceed by contradiction. Suppose that our theorem is false, and let $s$, $x$, and $y$ be a counterexample.
--
	Suppose_not(s,x,y) ==> ((not(s ¥incin Ult_memb1(s))) or ((x in Ult_memb1(s)) & (y in x) & (y notin Ult_memb1(s))))
--
-- The first of these cases is impossible, since an $xx$ in $s$ but not in $Ult_memb1(s)$ could not be in any
-- of the sets $membs_x(s,v)$ where $v$ belongs to $s_inf$, contradicting the fact that $arb(s_inf)$ and ${arb(s_inf)}$
-- both belong to $s_inf$, while $membs_x(s,{arb(s_inf)}) incs membs_x(s,arb(s_inf))$ = $s$.
-- Hence we need only consider the second case.
--
	Suppose ==> Stat1: not(s ¥incin Ult_memb1(s))
	xx-->Stat1 ==> (xx in s) & (xx notin Ult_memb1(s))
	Use_def(Ult_memb1) ==> xx notin Un({membs_x(s,v): v in s_inf})
	Use_def(Un) ==> xx notin {y: u in {membs_x(s,v): v in s_inf}, y in u}
	SIMPLF ==> Stat2: xx notin {y: v in s_inf, y in membs_x(s,v)}
	T00 ==> s_inf /= 0 and Stat3: (FORALL v in s_inf | {v} in s_inf)
	s_inf-->T0 ==> arb(s_inf) in s_inf
	(arb(s_inf))-->Stat3 ==> {arb(s_inf)} in s_inf
	({arb(s_inf)},xx)-->Stat2 ==> not(xx in membs_x(s,{arb(s_inf)}))
	(arb(s_inf),s)-->T20 ==> xx notin membs_x(s,arb(s_inf))
	Use_def(membs_x) ==> membs_x(s,arb(s_inf)) = s
	Discharge ==> Stat4: (x in Ult_memb1(s)) & (y in x) & (y notin Ult_memb1(s))
--
-- But in this case there must exist some $d$ in $s_inf$ such that $x$ in $membs_x(s,d)$,
-- and then $membs_x(s,{d}) = membs_x(s,d) + {w: v in membs_x(s,d), w in v}$ must have $y$ as a member.
-- Since ${d}$ is a member of $s_inf$, this contradicts the fact that $y notin Ult_memb1(s)$,
-- and so proves our theorem.
--
	Use_def(Ult_memb1) ==> x in Un({membs_x(s,v): v in s_inf})
	Use_def(Un) ==> x in {w: u in {membs_x(s,v): v in s_inf}, w in u}
	SIMPLF ==> Stat5: x in {w: v in s_inf, w in membs_x(s,v)}
	(d,w)-->Stat5 ==> (d in s_inf) & (x in membs_x(s,d))
	(d)-->Stat3 ==> {d} in s_inf
	Use_def(Ult_memb1) ==> y notin Un({membs_x(s,v): v in s_inf})
	Use_def(Un) ==> y notin {w: u in {membs_x(s,v): v in s_inf}, w in u}
	SIMPLF ==> Stat6: y notin {w: v in s_inf, w in membs_x(s,v)}
	({d},y)-->Stat6 ==> y notin membs_x(s,{d})
	(d,s)-->T20 ==> membs_x(s,{d}) = membs_x(s,d) + Un(membs_x(s,d))
	ELEM ==> y notin Un(membs_x(s,d))
	Use_def(Un) ==> Stat7: y notin {u: v in membs_x(s,d), u in v}
	(x,y)-->Stat7 ==> not((x in membs_x(s,d)) & (y in x))
	Discharge ==> QED
--
-- Next we state a preliminary form of the principle of transfinite induction,
-- which simply asserts that if there is any $n$ satisfying a predicate $P$, there is a minimal $m$ such that $P(m)$.
-- Since an 'arbitrary predicate' is involved, we formulate this as a theory providing just one theorem.
--
THEORY transfinite_induction(n,P(x))
    P(n)
END transfinite_induction;
--
ENTER_THEORY transfinite_induction
--
 	Def transfinite_induction.0: [Witness for transfinite induction argument] mt1_thryvar := arb({m: m in Ult_memb1({n}) | P(m)})
--
Theorem transfinite_induction.1: [Transfinite membership induction] P(mt1_thryvar) & ((K in mt1_thryvar) ¥imp (not P(K))). Proof:
    Suppose_not(k) ==> (not P(mt1_thryvar)) or ((k in mt1_thryvar) & P(k))
--
-- Proceed by contradiction, first noting that ${m: m in Ult_memb1({n}) | P(m)}$ cannot be empty since
-- $n$ belongs to it.
--
    Suppose ==> Stat1: {m: m in Ult_memb1({n}) | P(m)} = 0
    ({n},junk,bunk)-->T21 ==> n in Ult_memb1({n})
    Assump ==> P(n)
    n-->Stat1 ==> false; Discharge ==> {m: m in Ult_memb1({n}) | P(m)} /= 0
--
-- The axiom of choice now tells us that there is a minimal element $mt1_thryvar$ of ${m: m in Ult_memb1({n}) | P(m)}$.
-- This necessarily satisfies $mt1_thryvar in Ult_memb1({n}) & P(mt1_thryvar)$.
--
    ({m: m in Ult_memb1({n}) | P(m)})-->T0 ==> (arb({m: m in Ult_memb1({n}) | P(m)}) in {m: m in Ult_memb1({n}) | P(m)}) &
	((arb({m: m in Ult_memb1({n}) | P(m)}) * {m: m in Ult_memb1({n}) | P(m)}) = 0)
    Use_def(mt1_thryvar) ==> Stat2: (mt1_thryvar in {u: u in Ult_memb1({n}) | P(u)}) & (mt1_thryvar * {u: u in Ult_memb1({n}) | P(u)} = 0)
    mt1_thryvar-->Stat2 ==> (mt1_thryvar in Ult_memb1({n})) & P(mt1_thryvar)
--
-- The negative of our theorem now tells us that there is a $k in mt1_thryvar$ such that $P(k)$; but
-- such a $k$ would clearly belong to ${u: Ult_memb1({n}) | P(u)}$, and so contradict the minimality of $mt1_thryvar$.
-- This contradiction proves our theorem.
	({n},mt1_thryvar,k)-->T21 ==> k in Ult_memb1({n})
	Suppose ==> Stat3: k notin {u: u in Ult_memb1({n}) | P(u)}
	k-->Stat3 ==> false; Discharge ==> k in {u: u in Ult_memb1({n}) | P(u)}
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- Now we have a preliminary form of the principle of transfinite induction,
-- which is given by the following theory:
--
--DISPLAY transfinite_induction
--
--THEORY transfinite_induction(n,P(x))
--    P(n)
--==>(mt1_thryvar)
--    (FORALL k | P(mt1_thryvar) & ((k in mt1_thryvar) ¥imp (not P(k))))
--END transfinite_induction;
--
-- We go on to sharpen the preceding results by proving that the minimal element
-- whose existence is asserted in the preceding theory can actually be taken to be
-- an element of $Ult_membs({n})$. For this, a few preparatory results are needed.
-- The first of these applies $transfinite_induction$ to show that $Ult_membs(S)$ itself
-- is transitively closed under membership.
--
Theorem 22: [Monotonicity of ultimate members set] (Y in Ult_membs(S)) ¥imp (Ult_membs(Y) ¥incin Ult_membs(S)). Proof:
    Suppose_not(yy,s) ==> (yy in Ult_membs(s)) & (not(Ult_membs(yy) ¥incin Ult_membs(s)))
--
-- We proceed by contradiction. If our theorem is false, there exist an $s$ and a $yy in Ult_membs(s)$
-- which contradict it, which therefore have the property stated above. But, by
-- $transfinite_induction$, this implies the existence of a minimal $t$ with the property
-- that there exists a $y in Ult_membs(t)$ such that $(not(Ult_membs(y) ¥incin Ult_membs(t)))$.
-- Consider a $y$ related in this way to $t$.
--
    Suppose ==> Stat1: not(EXISTS y | (y in Ult_membs(s)) & (not(Ult_membs(y) ¥incin Ult_membs(s))))
    yy-->Stat1 ==> false; Discharge ==> (EXISTS y | (y in Ult_membs(s)) & (not(Ult_membs(y) ¥incin Ult_membs(s))))
    APPLY(mt1_thryvar:t) transfinite_induction(n->s,P(x)->(EXISTS y | (y in Ult_membs(x)) & (not(Ult_membs(y) ¥incin Ult_membs(x))))) ==>
		Stat2: (FORALL x | (EXISTS y | (y in Ult_membs(t)) & (not(Ult_membs(y) ¥incin Ult_membs(t)))) &
			((x in t) ¥imp (not(EXISTS y | (y in Ult_membs(x)) & (not(Ult_membs(y) ¥incin Ult_membs(x)))))))
	a0-->Stat2 ==> Stat3: (EXISTS y | (y in Ult_membs(t)) & (not(Ult_membs(y) ¥incin Ult_membs(t))))
    y-->Stat3 ==> (y in Ult_membs(t)) & Stat4: (not(Ult_membs(y) ¥incin Ult_membs(t)))
--
-- Plainly, there must exist a $c in Ult_membs(y)$ which is not in $Ult_membs(t)$.
-- Since $Ult_membs(t) incs {v: u in t, v in Ult_membs(u)}$ by Theorem 15,
-- it follows that c is not in this latter set either.
--
    t-->T15 ==> Ult_membs(t) = t + {v: u in t, v in Ult_membs(u)}
    c-->Stat4 ==> (c in Ult_membs(y)) & (c notin Ult_membs(t)) & Stat5: (c notin {v: u in t, v in Ult_membs(u)})
--
-- $y$ cannot be in $t$, since this would contradict Stat6
-- hence $y$ must be in ${v: u in t, v in Ult_membs(u)}$,
-- and so there must exist a $u in t$ such that $y in Ult_membs(u)$.
--
    Suppose ==> y in t
    (y,c)-->Stat5 ==> c notin Ult_membs(y)
    Discharge ==> Stat7: y in {v: u in t, v in Ult_membs(u)}
    (u,v)-->Stat7 ==> (u in t) & (y in Ult_membs(u))
--
-- But now, by the minimality of $t$, $Ult_membs(y)$ must be included in $Ult_membs(u)$,
-- and therefore $Ult_membs(u)$ cannot be included in $Ult_membs(t)$,
-- from which it follows that there must exist a $d in Ult_membs(u)$
-- which is not in ${v: w in t, v in Ult_membs(w)}$; hence, since $u in t$,
-- $d$ cannot be in $Ult_membs(u)$, contradicting its definition.
-- This contradiction proves our theorem.
--
    u-->Stat2 ==> Stat8: (not(EXISTS y | (y in Ult_membs(u)) & (not(Ult_membs(y) ¥incin Ult_membs(u)))))
    y-->Stat8 ==> Ult_membs(y) ¥incin Ult_membs(u)
    ELEM ==> Stat9: not(Ult_membs(u) ¥incin Ult_membs(t))
    d-->Stat9 ==> (d in Ult_membs(u)) & Stat10: (d notin {v: w in t, v in Ult_membs(w)})
    (u,d)-->Stat10 ==> not(u in t & d in Ult_membs(u))
    Discharge ==> QED
--
-- Since we know by Theorem 15 that $s ¥incin Ult_membs(s)$, it follows
-- immediately from the preceding theorem that $Ult_membs(s)$ includes every one of its members.
--
Theorem 23: [Members of ultimate members are also subsets] (Y in Ult_membs(S)) ¥imp (Y ¥incin Ult_membs(S)). Proof:
    Suppose_not(y,s) ==> (y in Ult_membs(s)) & (not (y ¥incin Ult_membs(s)))
    (y,s)-->T22 ==> Ult_membs(y) ¥incin Ult_membs(s)
    y-->T15 ==> false; Discharge ==> QED
--
-- The preceding results easily yield the fact, captured in the following theory,
-- that if there exists an $n$ with a given property $P$ then either $n$ (if it is minimal) or
-- some other minimal element of the set of ultimate members of $n$ has the property $P$.
--
THEORY transfinite_member_induction(n,P(x))
    P(n)
END transfinite_member_induction;
--
ENTER_THEORY transfinite_member_induction
--
-- To derive the result stated just below,  we first define
-- the minimal element that we want, whose properties
-- are then established in the theorem following the definition.
--
Def 00h: [Restricted witness for transfinite induction argument] mt2_thryvar := arb({k in Ult_membs({n}) | P(k)})
--
Theorem transfinite_member_induction1: [Ultimate members and transfinite induction] P(mt2_thryvar) & (mt2_thryvar in Ult_membs({n})) & ((K in mt2_thryvar) ¥imp (not P(K))). Proof:
    Suppose_not(k) ==> Stat1: (not P(mt2_thryvar)) or (mt2_thryvar notin Ult_membs({n})) or ((k in mt2_thryvar) & P(k))
--
-- We proceed by contradiction. If our theorem is false, there exists a $k in m$ such that $P(k)$.
-- But, since $n$ is clearly a member of ${j: j in Ult_membs({n}) | P(j)}$, this set cannot be null, so
-- by the axiom of choice $mt2_thryvar$ must belong to it, but not intersect it.
--
    Suppose ==> Stat2: {j in Ult_membs({n}) | P(j)} = 0
    n-->T18(*) ==> Stat3: n in Ult_membs({n})
    Assump ==> P(n)
    n-->Stat2(Stat3*) ==> false; Discharge ==> Stat4: {j in Ult_membs({n}) | P(j)} /= 0
    Use_def(mt2_thryvar)(Stat4*) ==> mt2_thryvar = arb({k in Ult_membs({n}) | P(k)})
    {j in Ult_membs({n}) | P(j)}-->T0(Stat4*) ==>
	 Stat5: (mt2_thryvar in {j in Ult_membs({n}) | P(j)}) & (mt2_thryvar * {j in Ult_membs({n}) | P(j)} = 0)
    mt2_thryvar-->Stat5(Stat5*) ==> Stat6: (mt2_thryvar in Ult_membs({n})) & P(mt2_thryvar)
--
-- Thus $P(mt2_thryvar)$ and $(mt2_thryvar in Ult_membs({n}))$ are both true, so that $k in mt2_thryvar$ and $P(k)$ must both be true.
-- Since $Ult_membs(mt2_thryvar) incs mt2_thryvar$ by definition, $k$ must belong to $Ult_membs(mt2_thryvar)$, and hence to
-- $Ult_membs({n})$ by Theorem 23, which tells us that $Ult_membs(mt2_thryvar)$ is a subset of $Ult_membs({n})$
--
    (Stat1,Stat6*)ELEM ==> Stat7: (k in mt2_thryvar) & P(k)
    Suppose ==> k notin Ult_membs(mt2_thryvar)
    Use_def(Ult_membs) ==> Ult_membs(mt2_thryvar) = (mt2_thryvar + {w: u in {Ult_membs(v): v in mt2_thryvar}, w in u})
    (Stat7*)Discharge ==> k in Ult_membs(mt2_thryvar)
    (mt2_thryvar,{n})-->T23(Stat6,Stat7*) ==> Stat8: k in Ult_membs({n})
    Suppose ==> Stat9: k notin {j in Ult_membs({n}) | P(j)}
--
-- Hence $k$ belongs to ${j in Ult_membs({n}) | P(j)}$, a contradiction which proves our theorem.
--
    ()-->Stat9(Stat8,Stat7*) ==> false; Discharge ==> Stat10: k in {j in Ult_membs({n}) | P(j)}
    (Stat7,Stat10,Stat5*)Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- Formulated as a theory, the preceding result appears as follows.
--
--DISPLAY transfinite_member_induction
--
--THEORY transfinite_member_induction(n,P(x))
--    P(n)
--==>(mt2_thryvar)
--    (FORALL k | P(mt2_thryvar) & (mt2_thryvar in Ult_membs({n})) & ((k in mt2_thryvar) ¥imp (not P(k))))
--END transfinite_member_induction;
--
THEORY_otter orderedGroups(In_domain(x),pluz(x,y),e,rvz(x),nneg(x),leq(x,y))
	In_domain(e)	 								-- closure axiom
	(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp In_domain(pluz(x,y)))		-- closure axiom
	(FORALL x | In_domain(x) ¥imp In_domain(rvz(x)))				-- closure axiom
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) ¥imp (pluz(pluz(x,y),z) = pluz(x,pluz(y,z)))) -- associativity
	(FORALL x | In_domain(x) ¥imp (pluz(x,e) = x))	 -- right unit
	(FORALL x | In_domain(x) ¥imp (pluz(x,rvz(x)) = e))	 -- right inverse
	(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp (pluz(x,y) = pluz(y,x)))	 -- commutativity
	(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp ((nneg(x) & nneg(y)) ¥imp nneg(pluz(x,y))))
	(FORALL x | In_domain(x) ¥imp (nneg(x) or nneg(rvz(x))))
	(FORALL x | In_domain(x) ¥imp ((nneg(x) & nneg(rvz(x))) ¥imp (x = e)))
	(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp (leq(x,y) = nneg(pluz(y,rvz(x)))))
	ExtDef abs_thryvar(x) := if nneg(x) then x else rvz(x) end if
==>
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) ¥imp ((pluz(x,y) = pluz(x,z)) ¥imp (y = z))) 	[A1] -- cancellation law
	(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp (rvz(pluz(x,rvz(y))) = pluz(y,rvz(x))))	[B]
	(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp (leq(x,y) or leq(y,x)))			[C] -- totality
	(FORALL x | In_domain(x) ¥imp (leq(x,x))) 							[D] -- reflexivity
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) ¥imp ((leq(x,y) & leq(y,z)) ¥imp leq(x,z))) 	[E] -- transitivity
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) ¥imp ((leq(x,y) & (x /= y) & leq(y,z)) ¥imp (x /= z)))	[E1] -- transitivity
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) ¥imp ((leq(x,y) & leq(y,z) & (y /= z)) ¥imp (x /= z)))	[E2] -- transitivity
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) ¥imp (leq(x,y) ¥imp leq(pluz(x,z),pluz(y,z)))) 		[F] -- isotony
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) ¥imp ((pluz(x,z) = pluz(y,z)) ¥imp (x = y))) 		[A2] -- cancellation law
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) ¥imp ((leq(x,y) & (x /= y)) ¥imp (pluz(x,z) /= pluz(y,z)))) [F1] -- strictness of isotony
	(FORALL x | In_domain(x) ¥imp (abs_thryvar(pluz(x,rvz(x))) = e)) 						[1]
	(FORALL x | In_domain(x) ¥imp (leq(x,abs_thryvar(x))))							[2]
	(FORALL x | In_domain(x) ¥imp (abs_thryvar(abs_thryvar(x)) = abs_thryvar(x)))					[3]
	(FORALL x | In_domain(x) ¥imp ((abs_thryvar(x) = e) ¥eq (x = e)))						[4]
	(FORALL x | In_domain(x) ¥imp (abs_thryvar(rvz(x)) = abs_thryvar(x)))						[5]
	(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp (leq(pluz(x,y),pluz(abs_thryvar(x),abs_thryvar(y)))))	[6]
	(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp (leq(abs_thryvar(pluz(x,y)),pluz(abs_thryvar(x),abs_thryvar(y)))))	[7]
	(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp ((not(nneg(x))) ¥imp (leq(x,abs_thryvar(y)) & (x /= abs_thryvar(y)))))	[8]
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) ¥imp (leq(abs_thryvar(pluz(x,rvz(y))),z) ¥imp leq(y,pluz(x,z))))	[9]
--	$(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) ¥imp (pluz(x,z) = pluz(pluz(x,rvz(y)),pluz(y,z))))$ [10a]
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) ¥imp (leq(abs_thryvar(pluz(x,rvz(z))),pluz(abs_thryvar(pluz(x,rvz(y))),abs_thryvar(pluz(y,rvz(z))))))) [10]   -- (proved sans axioms)
	(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp (nneg(y) ¥imp leq(pluz(x,rvz(y)),pluz(x,y))))		[11]
--	$(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp ((nneg(x) & (not(nneg(y)))) ¥imp leq(abs_thryvar(pluz(abs_thryvar(x),rvz(abs_thryvar(y)))),abs_thryvar(pluz(x,rvz(y))))))$	[12a]
--	$(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp ((nneg(x) & nneg(y)) ¥imp (abs_thryvar(pluz(abs_thryvar(x),rvz(abs_thryvar(y)))) = abs_thryvar(pluz(x,rvz(y))))))$ [12b]
--	$(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp (((not(nneg(x))) & (not(nneg(y)))) ¥imp (abs_thryvar(pluz(abs_thryvar(rvz(x)),rvz(abs_thryvar(rvz(y))))) = abs_thryvar(pluz(rvz(x),y)))))$	[12c]
	(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp (leq(abs_thryvar(pluz(abs_thryvar(x),rvz(abs_thryvar(y)))),abs_thryvar(pluz(x,rvz(y))))))		[12]
	(FORALL x,y | (In_domain(x) & In_domain(y)) ¥imp (leq(pluz(abs_thryvar(x),rvz(abs_thryvar(pluz(abs_thryvar(y),rvz(abs_thryvar(x)))))),abs_thryvar(y))))	[13]
END orderedGroups;
--
--
-- ************************************************************************************************
--			Section 3: Additional basic operations of set theory; properties of setformers
-- ************************************************************************************************
--
-- Next we define various familiar notions of set theory: (possibly multivalued) maps,
-- their ranges and domains, and the subclasses of single valued and 1-1 maps.
-- After giving these definitions we build up a few small utility theories which
-- ease subsequent work with these predicates.
--
Def 4: [Is-a-map predicate] Is_map(F) := F = {[car(x),cdr(x)]: x in F}
Def 5: [Map domain] domain(F) := {car(x): x in F}
Def 6: [Map range] range(F) := {cdr(x): x in F}
Def 7: [Single-valued map predicate] Svm(F) := Is_map(F) & (FORALL x in F, y in F | (car(x) = car(y)) ¥imp (x = y))
Def 8: [One-one map predicate] one_1_map(F) := Svm(F) & (FORALL x in F, y in F | (cdr(x) = cdr(y)) ¥imp (x = y))
--
-- A set has a null range or a null domain if and oly if it is null.
--
Theorem 24: [Only the null set has a null domain] (S = 0) ¥eq (domain(S) = 0). Proof:
	Suppose_not(s) ==> AUTO
	Suppose ==> (s = 0) & (domain(s) /= 0)
	Use_def(domain) ==> Stat1: {car(x): x in s} /= 0
		c-->Stat1 ==> Stat2: c in {car(x): x in s}
	x-->Stat2 ==> false; Discharge ==> (domain(s) = 0) & Stat3: (s /= 0)
	x2-->Stat3 ==> x2 in s
	Use_def(domain) ==> Stat4: car(x2) notin {car(x): x in s}
	x2-->Stat4 ==> false; Discharge ==> QED
--
Theorem 25: [Only the null set has a null range] (S = 0) ¥eq (range(S) = 0). Proof:
	Suppose_not(s) ==> AUTO
	Suppose ==> (s = 0) & (range(s) /= 0)
	Use_def(range) ==> Stat1: {cdr(x): x in s} /= 0
		c-->Stat1 ==> Stat2: c in {cdr(x): x in s}
	x-->Stat2 ==> false; Discharge ==> (range(s) = 0) & Stat3: (s /= 0)
	x2-->Stat3 ==> x2 in s
	Use_def(range) ==> Stat4: cdr(x2) notin {cdr(x): x in s}
	x2-->Stat4 ==> false; Discharge ==> QED

--
-- Our next elementary result states that a set $f$ is a map if and only if
-- every element in it is an ordered pair.
--
Theorem 26: [Maps are mapformers] Is_map(F) ¥eq (F ¥incin {[car(x),cdr(x)]: x in F}). Proof:
    Suppose_not(f) ==> not(Is_map(f) ¥eq (f ¥incin {[car(x),cdr(x)]: x in f}))
--
-- For if we suppose the contrary and use the definition of $Is_map$, we see that
-- some element $c notin f$ must have the form $c = [car(d),cdr(d)]$, where $d in f$ and
-- so in turn must have the form $d = [car(e),cdr(e)]$ with $e in f$, implying $d = e$ and so
-- leading to an immediate contradiction.
--
	Use_def(Is_map) ==> Stat1: (f ¥incin {[car(x),cdr(x)]: x in f}) & Stat2: (f /= {[car(x),cdr(x)]: x in f})
	c-->Stat2(Stat1*) ==> Stat3: (c notin f) & Stat4: (c in {[car(x),cdr(x)]: x in f})
	d-->Stat4(Stat3*) ==> Stat5: (d in f) & (c = [car(d),cdr(d)])
	(Stat5,Stat1*)ELEM ==> Stat6: (d in {[car(x),cdr(x)]: x in f})
	e-->Stat6(Stat6) ==> Stat7: d = [car(d),cdr(d)]
    (Stat3,Stat5,Stat7*)Discharge ==> QED
--
-- The next small theory simply tells us that any setformer of the form ${[a(x),b(x)]: x in s}$
-- is a map. The proof of the one theorem it provides is an elementary consequence
-- of the definition of 'Is_map'
--
THEORY Iz_map(a(x),b(x),s)
END Iz_map;
--
ENTER_THEORY Iz_map
--
Theorem iz_map.1: [Mapformers are maps] Is_map({[a(x),b(x)]: x in s}) & (domain({[a(x),b(x)]: x in s}) = {a(x): x in s}) & (range({[a(x),b(x)]: x in s}) = {b(x): x in s}). Proof:
    Suppose_not ==> AUTO
    Use_def(domain) ==> domain({[a(x),b(x)]: x in s}) = {car(y): y in {[a(x),b(x)]: x in s}}
    SIMPLF ==> domain({[a(x),b(x)]: x in s}) = {car([a(x),b(x)]): x in s}
    Suppose ==> Stat1: {car([a(x),b(x)]): x in s} /= {a(x): x in s}
    c1-->Stat1 ==> false; Discharge ==> domain({[a(x),b(x)]: x in s}) = {a(x): x in s}
    Use_def(range) ==> range({[a(x),b(x)]: x in s}) = {cdr(y): y in {[a(x),b(x)]: x in s}}
    SIMPLF ==> range({[a(x),b(x)]: x in s}) = {cdr([a(x),b(x)]): x in s}
    Suppose ==> Stat2: {cdr([a(x),b(x)]): x in s} /= {b(x): x in s}
    c2-->Stat2 ==> false; Discharge ==> range({[a(x),b(x)]: x in s}) = {b(x): x in s}
    Use_def(Is_map) ==> {[a(x),b(x)]: x in s} /= {[car(x),cdr(x)]: x in {[a(x),b(x)]: x in s}}
    SIMPLF ==> Stat3: {[a(x),b(x)]: x in s} /= {[car([a(x),b(x)]),cdr([a(x),b(x)])]: x in s}
    c-->Stat3 ==> AUTO
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Iz_map
--
--THEORY Iz_map(a(x),b(x),s)
--==>
--    Is_map({[a(x),b(x)]: x in s}) & (domain({[a(x),b(x)]: x in s}) = {a(x): x in s}) & (range({[a(x),b(x)]: x in s}) = {b(x): x in s})
--END Iz_map;
--
-- The two small theories which follow extend 'Iz_map' to the 2- and 3-variable cases respectively.
--
THEORY Iz_map_2(a2(x,y),b2(x,y),s,t,P2(x,y))
END Iz_map_2;
--
ENTER_THEORY Iz_map_2
--
-- The proof of the one theorem of this theory is very close to, and just as elementary as,
-- the corresponding one-variable result.
--
Theorem iz_map_2.1: [Two-variable mapformers] Is_map({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}). Proof:
    Suppose_not ==> AUTO
    Use_def(Is_map) ==> {[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)} /= {[car(x),cdr(x)]: x in {[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}}
    SIMPLF ==> Stat1: {[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)} /= {[car([a2(x,y),b2(x,y)]),cdr([a2(x,y),b2(x,y)])]: x in s, y in t | P2(x,y)}
    (c,d)-->Stat1 ==> AUTO
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Iz_map_2
--
--THEORY Iz_map_2(a2(x,y),b2(x,y),s,t,P2(x,y))
--==>
--    Is_map({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)})
--END Iz_map_2;
--
THEORY Iz_map_3(a3(x,y,z),b3(x,y,z),s,t,u,P3(x,y,z))
END Iz_map_3;
--
ENTER_THEORY Iz_map_3
--
-- The proof of the one theorem of this theory is very close to, and just as elementary as,
-- the corresponding one-variable result.
--
Theorem iz_map_3.1: [Three-variable mapformers] Is_map({[a3(x,y,yy),b3(x,y,yy)]: x in s, y in t, yy in u | P3(x,y,yy)}). Proof:
    Suppose_not ==> AUTO
    Use_def(Is_map) ==> {[a3(x,y,yy),b3(x,y,yy)]: x in s, y in t, yy in u | P3(x,y,yy)} /= {[car(x),cdr(x)]: x in {[a3(x,y,yy),b3(x,y,yy)]: x in s, y in t, yy in u | P3(x,y,yy)}}
    SIMPLF ==> Stat1: {[a3(x,y,yy),b3(x,y,yy)]: x in s, y in t, yy in u | P3(x,y,yy)} /= {[car([a3(x,y,yy),b3(x,y,yy)]),cdr([a3(x,y,yy),b3(x,y,yy)])]: x in s, y in t, yy in u | P3(x,y,yy)}
    (c,d,dd)-->Stat1 ==> AUTO
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Iz_map_3
--
--THEORY Iz_map_3(a3(x,y,yy),b3(x,y,yy),s,t,u,P3(x,y,yy))
--==>
--    Is_map({[a3(x,y,yy),b3(x,y,yy)]: x in s, y in t, yy in u | P3(x,y,yy)})
--END Iz_map_3;
--
-- Our next utility theory tells us that a setformer of the form ${[a(x),b(x)]: x in s}$ is a single
-- valued map unless there are $x$ and $y$ in $s$ such that $a(x) = a(y)$ does not imply $b(x) = b(y)$,
-- and that ${[x,b(x)]: x in s}$ is always a single valued map.
--
THEORY Svm_test(a(x),b(x),s)
END Svm_test;
--
ENTER_THEORY Svm_test
--
Def Svm_test.0a: [Witness to non-singlevaluedness] xy2_thryvar := arb({[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))})
Def Svm_test.0b: [First component of witness to non-singlevaluedness] x3_thryvar := car(xy2_thryvar)
Def Svm_test.0c: [Second component of witness to non-singlevaluedness] y3_thryvar := cdr(xy2_thryvar)
--
Theorem Svm_test.1: [Single-valuedness test] ((x3_thryvar in s) & (y3_thryvar in s) & (a(x3_thryvar) = a(y3_thryvar)) & (b(x3_thryvar) /= b(y3_thryvar))) or
				Svm({[a(x),b(x)]: x in s}). Proof:
	Suppose_not ==> (not ((x3_thryvar in s) & (y3_thryvar in s) & (a(x3_thryvar) = a(y3_thryvar)) & (b(x3_thryvar) /= b(y3_thryvar)))) &
	(not Svm({[a(x),b(x)]: x in s}))
--
-- By definition, the contrary of our assertion can only be true if ${[a(x),b(x)]: x in s}$
-- is either not a map or fails the single-valuedness test. But the preceding theory $Iz_map$
-- tells us that the first case is impossible, and an elementary simplification shows
-- that the second case is impossible also.
--
	Use_def(Svm) ==> not(Is_map({[a(x),b(x)]: x in s})) or (not (FORALL u in {[a(x),b(x)]: x in s}, v in {[a(x),b(x)]: x in s} |
			(car(u) = car(v)) ¥imp (u = v)))
	APPLY() Iz_map(a(x)->a(x),b(x)->b(x),s->s)	 ==> Is_map({[a(x),b(x)]: x in s})
	SIMPLF ==> Stat1: (not (FORALL x in s, y in s | (car([a(x),b(x)]) = car([a(y),b(y)]))
				¥imp ([a(x),b(x)] = [a(y),b(y)])))
	(x,y)-->Stat1 ==> (x in s) & (y in s) & (car([a(x),b(x)]) = car([a(y),b(y)])) & ([a(x),b(x)] /= [a(y),b(y)])
	Suppose ==> Stat2: {[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))} = 0
	(x,y)-->Stat2 ==> not((x in s) & (y in s) & (a(x) = a(y)) & (b(x) /= b(y)))
	Discharge ==> {[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))} /= 0
	({[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))})-->T0 ==>
	arb({[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))}) in {[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))}
	Use_def(xy2_thryvar) ==> Stat3: xy2_thryvar in {[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))}
	(xx,yy)-->Stat3 ==> Stat4: (xx in s) & (yy in s) & (xy2_thryvar = [xx,yy]) & (a(xx) = a(yy)) & (b(xx) /= b(yy))
	(Stat4)ELEM ==> (xx = car(xy2_thryvar)) & (yy = cdr(xy2_thryvar))
	Use_def(x3_thryvar) ==> x3_thryvar = car(xy2_thryvar)
	Use_def(y3_thryvar) ==> y3_thryvar = cdr(xy2_thryvar)
	EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Svm_test
--
--THEORY Svm_test(a,b,s)
--==>
--     ((x3_thryvar in s) & (y3_thryvar in s) & (a(x3_thryvar) = a(y3_thryvar)) & (b(x3_thryvar) /= b(y3_thryvar))) or
--				 Svm({[a(x),b(x)]: x in s})
--END Svm_test;
--
-- As in the case of $Iz_map$, we give the 2-variable and 3-variable versions of the preceding theory.
--
THEORY Svm_test_2(a2(x,y),b2(x,y),s,t,P2(x,y))
END Svm_test_2;
--
ENTER_THEORY Svm_test_2
--
Def Svm_test.2a: [Witness to non-singlevaluedness, two-variable case] xy3_thryvar := arb({[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t |
		P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))})
Def Svm_test.2b: [1,1 component of witness to non-singlevaluedness, two-variable case] x4_thryvar := car(car(xy3_thryvar))
Def Svm_test.2c: [1,2 component of witness to non-singlevaluedness, two-variable case] y4_thryvar := cdr(car(xy3_thryvar))
Def Svm_test.2d: [2,1 component of witness to non-singlevaluedness, two-variable case] xp1_thryvar := car(cdr(xy3_thryvar))
Def Svm_test.2h: [2,2 component of witness to non-singlevaluedness, two-variable case] yp1_thryvar := cdr(cdr(xy3_thryvar))
--
Theorem Svm_test_2.1: [Single-valuedness test, two-variable case] ((x4_thryvar in s) & (y4_thryvar in t) & (xp1_thryvar in s) & (yp1_thryvar in t) &
	(a2(x4_thryvar,y4_thryvar) = a2(xp1_thryvar,yp1_thryvar)) & (b2(x4_thryvar,y4_thryvar) /= b2(xp1_thryvar,yp1_thryvar))) or
	 		Svm({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}). Proof:
	Suppose_not ==> Stat1: (not((x4_thryvar in s) & (y4_thryvar in t) & (xp1_thryvar in s) & (yp1_thryvar in t) &
	(a2(x4_thryvar,y4_thryvar) = a2(xp1_thryvar,yp1_thryvar)) & (b2(x4_thryvar,y4_thryvar) /= b2(xp1_thryvar,yp1_thryvar)))) &
	(not Svm({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}))
--
-- By definition, the negative of our assertion can only be true if
--	 ${[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}$
-- is either not a map or fails the single-valuedness test. But $Iz_map_2$ tells us
-- that the first case is impossible, so that this set must fail the single-valuedness test.
--
	Use_def(Svm) ==> not(Is_map({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)})) or
	(not (FORALL u in {[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}, v in {[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)} |
			(car(u) = car(v)) ¥imp (u = v)))
	APPLY() Iz_map_2(a2(x,y)->a2(x,y),b2(x,y)->b2(x,y),s->s,t->t,P2(x,y)->P2(x,y)) ==>
	Is_map({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)})
	ELEM ==> Stat2: not (FORALL u in {[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}, v in {[a2(xx,yy),b2(xx,yy)]: xx in s, yy in t | P2(xx,yy)} |
			(car(u) = car(v)) ¥imp (u = v))
--
-- Hence there must exist elements $x$, $y$, $xx$, $yy$ violating the single-valuedness condition,
-- and so implying that the set
--
--	 ${[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t | (P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp)))}$
--
-- is non-empty, which by the axiom of choice and definition of $xy3_thryvar$ implies that $xy3_thryvar$
--	belongs to this set.
--
	SIMPLF(Stat2) ==> Stat3: not (FORALL x in s, y in t, xx in s, yy in t |
	((P2(x,y) & P2(xx,yy)) ¥imp ((car([a2(x,y),b2(x,y)]) = car([a2(xx,yy),b2(xx,yy)]))
				¥imp ([a2(x,y),b2(x,y)] = [a2(xx,yy),b2(xx,yy)]))))
	(x,y,xx,yy)-->Stat3 ==> (x in s) &  (y in t) & (xx in s) & (yy in t) & P2(x,y) & P2(xx,yy) &
					(a2(x,y) = a2(xx,yy)) & (b2(x,y) /= b2(xx,yy))
	Suppose ==> Stat4: {[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t |
		 P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))} = 0
	(x,y,xx,yy)-->Stat4 ==> false; Discharge ==>
	{[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t | P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))} /= 0
	({[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t | P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))})-->T0 ==>
  arb({[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t | P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))}) in
	{[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t | P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))}
	Use_def(xy3_thryvar) ==> Stat5: xy3_thryvar in
	{[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t | P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))}
--
-- Hence there exist elements $x2$, $y2$, $xp2$, $yp2$ satisfying the condition seen just below, and it
-- is an elementary consequence of the definition of $x4_thryvar$, $y4_thryvar$,etc. that these must be
-- $x4_thryvar$, $y4_thryvar$, $xp1_thryvar$, $yp1_thryvar$, leading to an immediate contradiction with our
-- hypothesis, and so proving our theorem.
--
	(x2,y2,xp2,yp2)-->Stat5 ==> Stat6: (x2 in s) & (y2 in t) & (xp2 in s) & (yp2 in t) & P2(x2,y2) & P2(xp2,yp2) &
	(xy3_thryvar = [[x2,y2],[xp2,yp2]]) & (a2(x2,y2) = a2(xp2,yp2)) & (b2(x2,y2) /= b2(xp2,yp2))
	(Stat6)ELEM ==> (x2 = car(car(xy3_thryvar)))
	(Stat6)ELEM ==> (y2 = cdr(car(xy3_thryvar)))
	(Stat6)ELEM ==> (xp2 = car(cdr(xy3_thryvar)))
	(Stat6)ELEM ==> (yp2 = cdr(cdr(xy3_thryvar)))
	Use_def(x4_thryvar) ==> x4_thryvar = car(car(xy3_thryvar))
	Use_def(y4_thryvar) ==> y4_thryvar = cdr(car(xy3_thryvar))
	Use_def(xp1_thryvar) ==> xp1_thryvar = car(cdr(xy3_thryvar))
	Use_def(yp1_thryvar) ==> yp1_thryvar = cdr(cdr(xy3_thryvar))
	EQUAL(Stat6) ==> Stat7: (x4_thryvar in s) & (y4_thryvar in t) & (xp1_thryvar in s) & (yp1_thryvar in t) &
	P2(x4_thryvar,y4_thryvar) & P2(xp1_thryvar,yp1_thryvar) &
	(xy3_thryvar = [[x4_thryvar,y4_thryvar],[xp1_thryvar,yp1_thryvar]])
	& (a2(x4_thryvar,y4_thryvar) = a2(xp1_thryvar,yp1_thryvar)) & (b2(x4_thryvar,y4_thryvar) /= b2(xp1_thryvar,yp1_thryvar))
	(Stat7,Stat1*)Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Svm_test_2
--
--THEORY Svm_test_2(a2(x,y),b2(x,y),s,t,P2(x,y))
--==>
--	((x4_thryvar in s) & (y4_thryvar in t) & (xp1_thryvar in s) & (yp1_thryvar in t) &
--		(a2(x4_thryvar,y4_thryvar) = a2(xp1_thryvar,yp1_thryvar)) & (b2(x4_thryvar,y4_thryvar) /= b2(xp1_thryvar,yp1_thryvar))) or
--			Svm({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)})
--END Svm_test_2;
--
-- We will occasionally require the three-variable version of the single-valued map principle,
-- which is given by the following variant THEORY.
--
THEORY Svm_test_3(a3(x,y,z),b3(x,y,z),s,t,u,P3(x,y,z))
END Svm_test_3;
--
ENTER_THEORY Svm_test_3
--
Def Svm_test.3a: [Witness to non-singlevaluedness, three-variable case] xy4_thryvar := arb({[[x,[y,wz]],[xp,[yp,wzp]]]: x in s, y in t, wz in u, xp in s, yp in t, wzp in u |
	(a3(x,y,wz) = a3(xp,yp,wzp)) & (b3(x,y,wz) /= b3(xp,yp,wzp)) & P3(x,y,wz) & P3(xp,yp,wzp)})
Def Svm_test.3b: [1,1-component of witness to non-singlevaluedness, three-variable case] x5_thryvar := car(car(xy4_thryvar))
Def Svm_test.3c: [1,2,1-component of witness to non-singlevaluedness, three-variable case] y5_thryvar := car(cdr(car(xy4_thryvar)))
Def Svm_test.3e: [1,2,2-component of witness to non-singlevaluedness, three-variable case] z1_thryvar := cdr(cdr(car(xy4_thryvar)))
Def Svm_test.3d: [2,1-component of witness to non-singlevaluedness, three-variable case] xp2_thryvar := car(cdr(xy4_thryvar))
Def Svm_test.3h: [2,2,1-component of witness to non-singlevaluedness, three-variable case] yp2_thryvar := car(cdr(cdr(xy4_thryvar)))
Def Svm_test.3f: [2,2,2-component of witness to non-singlevaluedness, three-variable case] zp1_thryvar := cdr(cdr(cdr(xy4_thryvar)))
--
Theorem Svm_test_3.1: [Single-valuedness test, three-variable case] ((x5_thryvar in s) & (y5_thryvar in t) & (z1_thryvar in u) & (xp2_thryvar in s) & (yp2_thryvar in t) &
	(zp1_thryvar in u) & P3(x5_thryvar,y5_thryvar,z1_thryvar) & P3(xp2_thryvar,yp2_thryvar,zp1_thryvar) &
	(a3(x5_thryvar,y5_thryvar,z1_thryvar) = a3(xp2_thryvar,yp2_thryvar,zp1_thryvar))
		& (b3(x5_thryvar,y5_thryvar,z1_thryvar) /= b3(xp2_thryvar,yp2_thryvar,zp1_thryvar))) or
			Svm({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)}). Proof:
	Suppose_not ==>
	Stat1: (not((x5_thryvar in s) & (y5_thryvar in t) & (z1_thryvar in u) & (xp2_thryvar in s) & (yp2_thryvar in t) &
	(zp1_thryvar in u) & P3(x5_thryvar,y5_thryvar,z1_thryvar) & P3(xp2_thryvar,yp2_thryvar,zp1_thryvar)
	 & (a3(x5_thryvar,y5_thryvar,z1_thryvar) = a3(xp2_thryvar,yp2_thryvar,zp1_thryvar))
		& (b3(x5_thryvar,y5_thryvar,z1_thryvar) /= b3(xp2_thryvar,yp2_thryvar,zp1_thryvar)))) &
			(not Svm({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)}))
--
-- By definition, the negative of our assertion can only be true if
--	 ${[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)}$
-- is either not a map or fails the single-valuedness test. But Iz_map_3 tells us
-- that the first case is impossible, so that this set must fail the single-valuedness test.
--
--
	Use_def(Svm) ==> not(Is_map({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)})) or
	(not (FORALL z1 in {[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)},
	z2 in {[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)} |
			(car(z1) = car(z2)) ¥imp (z1 = z2)))
	APPLY() Iz_map_3(a3(x,y,w)->a3(x,y,w),b3(x,y,w)->b3(x,y,w),s->s,t->t,u->u,P3(x,y,w)->P3(x,y,w))	 ==>
	Is_map({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)})
	ELEM ==> not (FORALL z1 in {[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)},
	z2 in {[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)} |
			(car(z1) = car(z2)) ¥imp (z1 = z2))
	SIMPLF ==> Stat2:
	not (FORALL x in s, y in t, wz in u, xp in s, yp in t, wz0 in u |
	(P3(x,y,wz) & P3(xp,yp,wz0)) ¥imp ((car([a3(x,y,wz),b3(x,y,wz)]) = car([a3(xp,yp,wz0),b3(xp,yp,wz0)]))
				¥imp ([a3(x,y,wz),b3(x,y,wz)] = [a3(xp,yp,wz0),b3(xp,yp,wz0)])))
--
-- Hence there must exist elements $x$, $y$, $wz$, $xp$, $yp$, $wz0$ violating the single-valuedness condition,
-- and so implying that the set
--
--	 ${[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u | ((a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0))} /= 0$
--
-- is non-empty, which by the axiom of choice and definition of $xy4_thryvar$ implies that $xy4_thryvar$
-- belongs to this set.
--
	(x,y,wz,xp,yp,wz0)-->Stat2 ==>
	Stat3: (x in s) &  (y in t) & (wz in u) & (xp in s) & (yp in t) & (wz0 in u) & P3(x,y,wz) & P3(xp,yp,wz0) &
			(car([a3(x,y,wz),b3(x,y,wz)]) = car([a3(xp,yp,wz0),b3(xp,yp,wz0)])) & (b3(x,y,wz) /= b3(xp,yp,wz0))
	(Stat3)ELEM ==> a3(x,y,wz) = a3(xp,yp,wz0)
	Suppose ==> Stat4: {[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u |
	(a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0)} = 0
	(x,y,wz,xp,yp,wz0)-->Stat4 ==> false; Discharge ==>
	{[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u |
	(a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0)} /= 0
	({[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u | (a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0)})-->T0 ==>
	arb({[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u |
	(a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0)}) in
	{[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u |
		(a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0)}
	Use_def(xy4_thryvar) ==> Stat5: xy4_thryvar in {[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u |
		(a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0)}
--
-- Hence there exist elements $x2$, $y2$, $z2$, $xp2$, $yp2$, $zp2$ satisfying the condition seen just below, and it
-- is an elementary consequence of the definition of $x5_thryvar$, $y5_thryvar$,etc. that these must be
-- $x5_thryvar$, $y5_thryvar$, $z1_thryvar$, $xp2_thryvar$, $yp2_thryvar$, $zp1_thryvar$, leading to an immediate contradiction with our
-- hypothesis, and so proving our theorem.
--
	(x2,y2,z2,xp2,yp2,zp2)-->Stat5 ==> Stat6: (x2 in s) & (y2 in t) & (z2 in u) & (xp2 in s) & (yp2 in t) & (zp2 in u)
			& P3(x2,y2,z2) & P3(xp2,yp2,zp2) & (xy4_thryvar = [[x2,[y2,z2]],[xp2,[yp2,zp2]]]) &
	(a3(x2,y2,z2) = a3(xp2,yp2,zp2)) & (b3(x2,y2,z2) /= b3(xp2,yp2,zp2))
	(Stat6)ELEM ==> x2 = car(car(xy4_thryvar))
	(Stat6)ELEM ==> y2 = car(cdr(car(xy4_thryvar)))
	(Stat6)ELEM ==> z2 = cdr(cdr(car(xy4_thryvar)))
	(Stat6)ELEM ==> xp2 = car(cdr(xy4_thryvar))
	(Stat6)ELEM ==> yp2 = car(cdr(cdr(xy4_thryvar)))
	(Stat6)ELEM ==> zp2 = cdr(cdr(cdr(xy4_thryvar)))
	Use_def(x5_thryvar) ==> x5_thryvar = car(car(xy4_thryvar))
	Use_def(y5_thryvar) ==> y5_thryvar = car(cdr(car(xy4_thryvar)))
	Use_def(z1_thryvar) ==> z1_thryvar = cdr(cdr(car(xy4_thryvar)))
	Use_def(xp2_thryvar) ==> xp2_thryvar = car(cdr(xy4_thryvar))
	Use_def(yp2_thryvar) ==> yp2_thryvar = car(cdr(cdr(xy4_thryvar)))
	Use_def(zp1_thryvar) ==> zp1_thryvar = cdr(cdr(cdr(xy4_thryvar)))
	EQUAL(Stat6) ==> Stat7: (x5_thryvar in s) & (y5_thryvar in t) & (z1_thryvar in u) &
			(xp2_thryvar in s) & (yp2_thryvar in t) & (zp1_thryvar in u)
			& P3(x5_thryvar,y5_thryvar,z1_thryvar) & P3(xp2_thryvar,yp2_thryvar,zp1_thryvar) &
	(xy4_thryvar = [[x5_thryvar,[y5_thryvar,z1_thryvar]],[xp2_thryvar,[yp2_thryvar,zp1_thryvar]]]) &
	(a3(x5_thryvar,y5_thryvar,z1_thryvar) = a3(xp2_thryvar,yp2_thryvar,zp1_thryvar)) &
		(b3(x5_thryvar,y5_thryvar,z1_thryvar) /= b3(xp2_thryvar,yp2_thryvar,zp1_thryvar))
	(Stat7,Stat1*)Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Svm_test_3
--
--THEORY Svm_test_3(a3(x,y,z),b3(x,y,z),s,t,u,P3(x,y,z))
--==>(x5_thryvar,y5_thryvar,z1_thryvar,xp2_thryvar,yp2_thryvar,zp1_thryvar)
--	((x5_thryvar in s) & (y5_thryvar in t) & (z1_thryvar in u) & (xp2_thryvar in s) & (yp2_thryvar in t) &
--			(zp1_thryvar in u) & P3(x5_thryvar,y5_thryvar,z1_thryvar) & P3(xp2_thryvar,yp2_thryvar,zp1_thryvar) &
--				(a3(x5_thryvar,y5_thryvar,z1_thryvar) = a3(xp2_thryvar,yp2_thryvar,z1_thryvar))
--					& (b3(x5_thryvar,y5_thryvar,z1_thryvar) /= b3(xp2_thryvar,yp2_thryvar,z1_thryvar))) or
--						Svm({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)})
--END Svm_test_3;
--
-- The next mini-theory simply specializes $Svm_test$ to the form in which it is most commonly used.
-- The proof required is completely elementary.
-- The following final small theories in the present utility series adapt
-- $Svm_test$ and its multivariable analogs to the form more conveniently used in proving
-- that a map is 1-1. Once more the sole theorem provided has an easy proof.
--
THEORY one_1_test(a(x),b(x),s)
END one_1_test;
--
ENTER_THEORY one_1_test
--
Def one_1_test.0a: [Witness to non-one-oneness of a map] xy5_thryvar := arb({[x,y]: x in s, y in s | ((a(x) = a(y)) ¥neq (b(x) = b(y)))})
Def one_1_test.0b: [First component of witness to map non-one-oneness] x6_thryvar := car(xy5_thryvar)
Def one_1_test.0c: [Second component of witness to map non-one-oneness] y6_thryvar := cdr(xy5_thryvar)
--
Theorem one_1_test.1: [One-one map former test] ((x6_thryvar in s) & (y6_thryvar in s) & (((a(x6_thryvar) = a(y6_thryvar)) ¥neq (b(x6_thryvar) = b(y6_thryvar))))) or
			 one_1_map({[a(x),b(x)]: x in s}). Proof:
	Suppose_not ==> (not((x6_thryvar in s) & (y6_thryvar in s) & (((a(x6_thryvar) = a(y6_thryvar)) ¥neq (b(x6_thryvar) = b(y6_thryvar)))))) &
				(not one_1_map({[a(u),b(u)]: u in s}))
--
-- For let $s$ be a counterexample to our assertion. Then the set
--
--		(*) 	${[x,y]: x in s, y in s | ((a(x) = a(y)) ¥neq (b(x) = b(y)))}$
--
-- cannot be empty, since if it were ${[a(x),b(x)]: x in s}$ would necessarily be single valued,
-- in which case there would have to exist two elements $xx$, $yy$ of $s$ for which $((b(xx) = b(yy)) & (a(xx) /= a(yy)))$,
-- an impossibility given that the set (*) seen above is empty.
--
	Use_def(one_1_map) ==> Stat1: (not Svm({[a(u),b(u)]: u in s})) or
		(not (FORALL x in {[a(u),b(u)]: u in s}, y in {[a(v),b(v)]: v in s} | (cdr(x) = cdr(y)) ¥imp (x = y)))
	Suppose ==> Stat2: {[x,y]: x in s, y in s | ((a(x) = a(y)) ¥neq (b(x) = b(y)))} = 0
	Suppose ==> not Svm({[a(x),b(x)]: x in s})
	APPLY(x3_thryvar:x,y3_thryvar:y) Svm_test(a(x)->a(x),b(x)->b(x),s->s)	 ==>
		((x in s) & (y in s) & (a(x) = a(y)) & (b(x) /= b(y))) or Svm({[a(x),b(x)]: x in s})
	ELEM ==> (x in s) & (y in s) & (a(x) = a(y)) & (b(x) /= b(y))
	(x,y)-->Stat2 ==> (a(x) = a(y)) ¥eq (b(x) = b(y))
	ELEM ==> false; Discharge ==> (not (FORALL x in {[a(u),b(u)]: u in s}, y in {[a(v),b(v)]: v in s} | (cdr(x) = cdr(y)) ¥imp (x = y)))
	SIMPLF ==> Stat3: (not (FORALL u in s, v in s | (cdr([a(u),b(u)]) = cdr([a(v),b(v)])) ¥imp ([a(u),b(u)] = [a(v),b(v)])))
	(xx,yy)-->Stat3 ==> (xx in s) & (yy in s) & (cdr([a(xx),b(xx)]) = cdr([a(yy),b(yy)])) & ([a(xx),b(xx)] /= [a(yy),b(yy)])
	ELEM ==> (xx in s) & (yy in s) & (b(xx) = b(yy)) & (a(xx) /= a(yy))
	(xx,yy)-->Stat2 ==> (a(xx) = a(yy)) ¥eq (b(xx) = b(yy))
	ELEM ==> false; Discharge ==> {[x,y]: x in s, y in s | ((a(x) = a(y)) ¥neq (b(x) = b(y)))} /= 0
--
-- It therefore follows by the axiom of choice that $xy5_thryvar$, as defined above, is an element of the set (*),
-- and thus its two components $x6_thryvar$ and $y6_thryvar$ stand in contradiction to the hypotheses of the
-- present theorem. This contradiction proves our assertion.
--
	({[x,y]: x in s, y in s | ((a(x) = a(y)) ¥neq (b(x) = b(y)))})-->T0 ==>
	arb({[x,y]: x in s, y in s | ((a(x) = a(y)) ¥neq (b(x) = b(y)))}) in
	{[x,y]: x in s, y in s | ((a(x) = a(y)) ¥neq (b(x) = b(y)))}
	Use_def(xy5_thryvar) ==> Stat4: xy5_thryvar in {[x,y]: x in s, y in s | ((a(x) = a(y)) ¥neq (b(x) = b(y)))}
	(x2,y2)-->Stat4 ==> (xy5_thryvar = [x2,y2]) & (x2 in s) & (y2 in s) & (((a(x2) = a(y2)) ¥neq (b(x2) = b(y2))))
	ELEM ==> (car(xy5_thryvar) = x2) & (cdr(xy5_thryvar) = y2)
	Use_def(x6_thryvar) ==> x6_thryvar = car(xy5_thryvar)
	Use_def(y6_thryvar) ==> y6_thryvar = cdr(xy5_thryvar)
	EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The utility theory just developed can be summarized as follows.
--DISPLAY one_1_test
--
--THEORY one_1_test(a(x),b(x),s)
--==>(x6_thryvar,y6_thryvar)
--    ((x6_thryvar in s) & (y6_thryvar in s) & (not((a(x6_thryvar) = a(y6_thryvar)) ¥eq (b(x6_thryvar) = b(y6_thryvar))))) or
--						 one_1_map({[a(x),b(x)]: x in s})
--END one_1_test;
--
THEORY one_1_test_2(a2(x,y),b2(x,y),s,t)
END one_1_test_2;
--
ENTER_THEORY one_1_test_2
--
-- Next we give the two variable analog of the THEORY given just above.
-- The proof of the one theorem it provides differs little from that seen above.
--
Def one_1_test_2.0a: [Witness to map non-one-oneness, two-variable case] xy6_thryvar :=
	arb({[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) ¥eq (b2(x,y) = b2(x2,y2)))})
Def one_1_test_2.0b: [1,1-component of witness to map non-one-oneness, two-variable case] x7_thryvar := car(car(xy6_thryvar))
Def one_1_test_2.0c: [1-2-component of witness to map non-one-oneness, two-variable case] y7_thryvar := cdr(car(xy6_thryvar))
Def one_1_test_2.0d: [2,1-component of witness to map non-one-oneness, two-variable case] x2_thryvar := car(cdr(xy6_thryvar))
Def one_1_test_2.0h: [2,1-component of witness to map non-one-oneness, two-variable case] y2_thryvar := cdr(cdr(xy6_thryvar))
--
Theorem one_1_test_2.1: [One-one map former test, two-variable case] ((x7_thryvar in s) & (y7_thryvar in t) & (x2_thryvar in s) & (y2_thryvar in t) &
		(not((a2(x7_thryvar,y7_thryvar) = a2(x2_thryvar,y2_thryvar)) ¥eq (b2(x7_thryvar,y7_thryvar) = b2(x2_thryvar,y2_thryvar))))) or
			 one_1_map({[a2(x,y),b2(x,y)]: x in s, y in t}). Proof:
	Suppose_not ==> (not((x7_thryvar in s) & (y7_thryvar in t) & (x2_thryvar in s) & (y2_thryvar in t) &
		(not((a2(x7_thryvar,y7_thryvar) = a2(x2_thryvar,y2_thryvar)) ¥eq (b2(x7_thryvar,y7_thryvar) = b2(x2_thryvar,y2_thryvar)))))) &
			 (not one_1_map({[a2(x,y),b2(x,y)]: x in s, y in t}))
--
-- For let $s$ be a counterexample to our assertion. Then the set
--
--		(*) 	${[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) ¥eq (b2(x,y) = b2(x2,y2)))}$
--
-- cannot be empty, since if it were ${[a(u,v),b2(u,v)]: u in s, v in t}$ would necessarily be single valued,
-- in which case there would have to exist elements $x$, $xp$ of $s$ and elements $y$, $yp$ of $t$ for which
-- $((a2(x,y) = a2(xp,yp)) ¥eq (b2(x,y) = b2(xp,yp)))$, an impossibility given that the set (*) seen above is empty.
--
	Use_def(one_1_map) ==> Stat1: (not Svm({[a2(u,v),b2(u,v)]: u in s, v in t})) or
	(not (FORALL x in {[a2(u,v),b2(u,v)]: u in s,v in t}, y in {[a2(up,vp),b2(up,vp)]: up in s,vp in t} | (cdr(x) = cdr(y)) ¥imp (x = y)))
	Suppose ==> Stat2: {[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) ¥eq (b2(x,y) = b2(x2,y2)))} = 0
	Suppose ==> not Svm({[a2(u,v),b2(u,v)]: u in s, v in t})
	APPLY(x4_thryvar:x,y4_thryvar:y,xp1_thryvar:xp,yp1_thryvar:yp) Svm_test_2(a2(x,y)->a2(x,y),b2(x,y)->b2(x,y),s->s,t->t,P2(x,y)->true) ==>
	((x in s) & (y in t) & (xp in s) & (yp in t) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))) or Svm({[a2(u,v),b2(u,v)]: u in s, v in t | true})
	(x,y,xp,yp)-->Stat2 ==> (a2(x,y) = a2(xp,yp)) ¥eq (b2(x,y) = b2(xp,yp))
	ELEM ==> false; Discharge ==>
	not (FORALL x in {[a2(u,v),b2(u,v)]: u in s,v in t}, y in {[a2(u,v),b2(u,v)]: u in s,v in t} | (cdr(x) = cdr(y)) ¥imp (x = y))
	SIMPLF ==> Stat3: not (FORALL u in s, v in t, up in s, vp in t |
					(cdr([a2(u,v),b2(u,v)]) = cdr([a2(up,vp),b2(up,vp)])) ¥imp ([a2(u,v),b2(u,v)] = [a2(up,vp),b2(up,vp)]))
	(xx,yy,xxp,yyp)-->Stat3 ==> (xx in s) & (yy in t) & (xxp in s) & (yyp in t) &
	(cdr([a2(xx,yy),b2(xx,yy)]) = cdr([a2(xxp,yyp),b2(xxp,yyp)])) & ([a2(xx,yy),b2(xx,yy)] /= [a2(xxp,yyp),b2(xxp,yyp)])
	(xx,yy,xxp,yyp)-->Stat2 ==> (a2(xx,yy) = a2(xxp,yyp)) ¥eq (b2(xx,yy) = b2(xxp,yyp))
	ELEM ==> false; Discharge ==>
	{[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) ¥eq (b2(x,y) = b2(x2,y2)))} /= 0
--
-- It therefore follows by the axiom of choice that $xy6_thryvar$, as defined above, is an element of the set (*),
-- and thus its subcomponents $x7_thryvar$, $y7_thryvar$, $x2_thryvar$, $y2_thryvar$ stand in contradiction
-- to the hypotheses of the present theorem. This contradiction proves our assertion.
--
	({[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) ¥eq (b2(x,y) = b2(x2,y2)))})-->T0 ==>
	arb({[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) ¥eq (b2(x,y) = b2(x2,y2)))}) in
	{[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) ¥eq (b2(x,y) = b2(x2,y2)))}
	Use_def(xy6_thryvar) ==> Stat4:
	xy6_thryvar in {[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) ¥eq (b2(x,y) = b2(x2,y2)))}
	(x2,y2,xp2,yp2)-->Stat4 ==> (x2 in s) & (y2 in t) & (xp2 in s) & (yp2 in t) &
		(not((a2(x2,y2) = a2(xp2,yp2)) ¥eq (b2(x2,y2) = b2(xp2,yp2)))) & (xy6_thryvar = [[x2,y2],[xp2,yp2]])
	ELEM ==> (car(car([[x2,y2],[xp2,yp2]])) = x2) & (cdr(car([[x2,y2],[xp2,yp2]])) = y2)
	ELEM ==> (car(cdr([[x2,y2],[xp2,yp2]])) = xp2) & (cdr(cdr([[x2,y2],[xp2,yp2]])) = yp2)
	EQUAL ==> (car(car(xy6_thryvar)) = x2) & (cdr(car(xy6_thryvar)) = y2)
	EQUAL ==> (car(cdr(xy6_thryvar)) = xp2) & (cdr(cdr(xy6_thryvar)) = yp2)
	Use_def(x7_thryvar) ==> x7_thryvar = car(car(xy6_thryvar))
	Use_def(y7_thryvar) ==> y7_thryvar = cdr(car(xy6_thryvar))
	Use_def(x2_thryvar) ==> x2_thryvar = car(cdr(xy6_thryvar))
	Use_def(y2_thryvar) ==> y2_thryvar = cdr(cdr(xy6_thryvar))
	(x2,y2,xp2,yp2)-->Stat2 ==> (a2(x2,y2) = a2(xp2,yp2)) ¥eq (b2(x2,y2) = b2(xp2,yp2))
	EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The utility theory just developed can be summarized as follows.
--DISPLAY one_1_test_2
--
--THEORY one_1_test_2(a2(x,y),b2(x,y),s,t)
--==>(x7_thryvar,y7_thryvar,x2_thryvar,y2_thryvar)
--((x7_thryvar in s) & (y7_thryvar in t) & (x2_thryvar in s) & (y2_thryvar in t) &
--		(not((a2(x7_thryvar,y7_thryvar) = a2(x2_thryvar,y2_thryvar)) ¥eq (b2(x7_thryvar,y7_thryvar) = b2(x2_thryvar,y2_thryvar))))) or
--			 one_1_map({[a2(x,y),b2(x,y)]: x in s, y in t})
--END one_1_test_2;
--
--
THEORY one_1_test_3(a3(x,y,wz),b3(x,y,wz),s,t,r,P3(x,y,wz))
END one_1_test_3;
--
ENTER_THEORY one_1_test_3
--
-- Next we give the three variable analog of the THEORY given just above.
-- The proof of the one theorem it provides differs little from that seen above.
--
Def one_1_test_3.0a: [Witness to map non one-ness, three-variable case] xyz_thryvar :=
	arb({[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a3(x2,y2,z2)) ¥eq (b3(x,y,wz) = b3(x2,y2,z2)))})
Def one_1_test_3.0b: [1,1-component of witness to map non one-ness, three-variable case] x8_thryvar := car(car(xyz_thryvar))
Def one_1_test_3.0c: [1,2,1-component of witness to map non one-ness, three-variable case] y8_thryvar := car(cdr(car(xyz_thryvar)))
Def one_1_test_3.0e: [1,2,2-component of witness to map non one-ness, three-variable case] z2_thryvar := cdr(cdr(car(xyz_thryvar)))
Def one_1_test_3.0d: [2,1-component of witness to map non one-ness, three-variable case] xp3_thryvar := car(cdr(xyz_thryvar))
Def one_1_test_3.0h: [2,2,1-component of witness to map non one-ness, three-variable case] yp3_thryvar := car(cdr(cdr(xyz_thryvar)))
Def one_1_test_3.0f: [2,2,2-component of witness to map non one-ness, three-variable case] zp2_thryvar := cdr(cdr(cdr(xyz_thryvar)))
--
Theorem one_1_test_3.1: [Single-valued map former, three-variable case] ((x8_thryvar in s) & (y8_thryvar in t) & (z2_thryvar in r) &
                (xp3_thryvar in s) & (yp3_thryvar in t) & (zp2_thryvar in r) &
                P3(x8_thryvar,y8_thryvar,z2_thryvar) & P3(xp3_thryvar,yp3_thryvar,zp2_thryvar) &
		(((a3(x8_thryvar,y8_thryvar,z2_thryvar) /= a3(xp3_thryvar,yp3_thryvar,zp2_thryvar)) ¥eq (b3(x8_thryvar,y8_thryvar,z2_thryvar) = b3(xp3_thryvar,yp3_thryvar,zp2_thryvar))))) or
			 one_1_map({[a3(x,y,wz),b3(x,y,wz)]: x in s, y in t,wz in r | P3(x,y,wz)}). Proof:
	Suppose_not ==> (not((x8_thryvar in s) & (y8_thryvar in t) & (z2_thryvar in r) &
                (xp3_thryvar in s) & (yp3_thryvar in t) & (zp2_thryvar in r) &
                P3(x8_thryvar,y8_thryvar,z2_thryvar) & P3(xp3_thryvar,yp3_thryvar,zp2_thryvar) &
		(((a3(x8_thryvar,y8_thryvar,z2_thryvar) /= a3(xp3_thryvar,yp3_thryvar,zp2_thryvar)) ¥eq (b3(x8_thryvar,y8_thryvar,z2_thryvar) = b3(xp3_thryvar,yp3_thryvar,zp2_thryvar)))))) &
			 (not one_1_map({[a3(x,y,wz),b3(x,y,wz)]: x in s, y in t,wz in r | P3(x,y,wz)}))
--
-- For let $s$ be a counterexample to our assertion. Then the set
--
--		(*) 	${[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & (not((a(x,y) = a(x2,y2)) ¥eq (b(x,y) = b(x2,y2))))}$
--
--
-- cannot be empty, since if it were ${[a3(u,v,w),b3(u,v,w)]: u in s, v in t, w in r | P3(u,v,w)}$ would
-- necessarily be single valued,
-- in which case there would have to exist elements $x$, $xp$ of $s$, elements $y$, $yp$ of $t$, and
-- elements $z$, $zp$ of $w$ for which $((a3(x,y,w) = a3(xp,yp,wp)) ¥eq (b3(x,y,w) = b3(xp,yp,w)))$ and
-- $P3(x,y,wz)$, $P3(x2,y2,z2)$ an impossibility given that the set (*) seen above is empty.
--
	Use_def(one_1_map) ==> Stat1: (not Svm({[a3(u,v,w),b3(u,v,w)]: u in s, v in t, w in r | P3(u,v,w)})) or
		(not (FORALL x in {[a3(u,v,w),b3(u,v,w)]: u in s,v in t,w in r | P3(u,v,w)}, y in {[a3(up,vp,wp),b3(up,vp,wp)]: up in s,vp in t,wp in r | P3(up,vp,wp)} | (cdr(x) = cdr(y)) ¥imp (x = y)))
	Suppose ==> Stat2: {[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r  | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a3(x2,y2,z2)) ¥eq (b3(x,y,wz) = b3(x2,y2,z2)))} = 0
	Suppose ==> not Svm({[a3(u,v,w),b3(u,v,w)]: u in s, v in t, w in r | P3(u,v,w)})
	APPLY(x5_thryvar:x,y5_thryvar:y,z1_thryvar:z1,xp2_thryvar:xp,yp2_thryvar:yp,zp1_thryvar:zp) Svm_test_3(a3(x,y,wz)->a3(x,y,wz),b3(x,y,wz)->b3(x,y,wz),s->s,t->t,u->r,P3(x,y,wz)->P3(x,y,wz)) ==>
		((x in s) & (y in t) & (z1 in r) & (xp in s) & (yp in t) & (zp in r) & P3(x,y,z1) & P3(xp,yp,zp) &
		 (a3(x,y,z1) = a3(xp,yp,zp)) & (b3(x,y,z1) /= b3(xp,yp,zp))) or Svm({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in r | P3(x,y,w)})
	(x,y,z1,xp,yp,zp)-->Stat2 ==> (a3(x,y,z1) = a3(xp,yp,zp)) ¥eq (b3(x,y,z1) = b3(xp,yp,zp)) & P3(x,y,z1) & P3(xp,yp,zp)
	ELEM ==> false; Discharge ==> not (FORALL x in {[a3(u,v,w),b3(u,v,w)]: u in s,v in t,w in r | P3(u,v,w)}, y in {[a3(u,v,w),b3(u,v,w)]: u in s,v in t,w in r | P3(u,v,w)} | (cdr(x) = cdr(y)) ¥imp (x = y))
	SIMPLF ==> Stat3: not(FORALL u in s, v in t, w in r, up in s, vp in t, wp in r | (P3(u,v,w) & P3(up,vp,wp)) ¥imp ((cdr([a3(u,v,w),b3(u,v,w)]) = cdr([a3(up,vp,wp),b3(up,vp,wp)])) ¥imp ([a3(u,v,w),b3(u,v,w)] = [a3(up,vp,wp),b3(up,vp,wp)])))
	(xx,yy,wz,xxp,yyp,wz0)-->Stat3 ==> (xx in s) & (yy in t) & (wz in r) & (xxp in s) & (yyp in t) & (wz0 in r) & P3(xx,yy,wz) & P3(xxp,yyp,wz0) &
		(cdr([a3(xx,yy,wz),b3(xx,yy,wz)]) = cdr([a3(xxp,yyp,wz0),b3(xxp,yyp,wz0)])) & ([a3(xx,yy,wz),b3(xx,yy,wz)] /= [a3(xxp,yyp,wz0),b3(xxp,yyp,wz0)])
	(xx,yy,wz,xxp,yyp,wz0)-->Stat2 ==> (a3(xx,yy,wz) = a3(xxp,yyp,wz0)) ¥eq (b3(xx,yy,wz) = b3(xxp,yyp,wz0)) or (not(P3(xx,yy,wz))) or (not(P3(xxp,yyp,wz0)))
	ELEM ==> false; Discharge ==>
		{[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a3(x2,y2,z2)) ¥eq (b3(x,y,wz) = b3(x2,y2,z2)))} /= 0
--
-- It therefore follows by the axiom of choice that $xy6_thryvar$, as defined above, is an element of the set (*),
-- and thus its subcomponents $x8_thryvar$, $y8_thryvar$, $xp3_thryvar$, $yp3_thryvar$ stand in contradiction
-- to the hypotheses of the present theorem. This contradiction proves our assertion.
--
	({[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a(x2,y2,z2)) ¥eq (b3(x,y,wz) = b3(x2,y2,z2)))})-->T0 ==>
		arb({[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a3(x2,y2,z2)) ¥eq (b3(x,y,wz) = b3(x2,y2,z2)))}) in
		    {[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a3(x2,y2,z2)) ¥eq (b3(x,y,wz) = b3(x2,y2,z2)))}
	Use_def(xyz_thryvar) ==> Stat4:
	xyz_thryvar in {[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a3(x2,y2,z2)) ¥eq (b3(x,y,wz) = b3(x2,y2,z2)))}
	(x2,y2,z2,xp2,yp2,zp2)-->Stat4 ==> (x2 in s) & (y2 in t) & (z2 in r) & (xp2 in s) & (yp2 in t) & (zp2 in r) &
		P3(x2,y2,z2) & P3(xp2,yp2,zp2) &
		((a3(x2,y2,z2) /= a3(xp2,yp2,zp2)) ¥eq (b3(x2,y2,z2) = b3(xp2,yp2,zp2))) & (xyz_thryvar = [[x2,[y2,z2]],[xp2,[yp2,zp2]]])
	(x2,y2,z2,xp2,yp2,zp2)-->Stat2 ==> (a3(x2,y2,z2) = a3(xp2,yp2,zp2)) ¥eq (b3(x2,y2,z2) = b3(xp2,yp2,zp2))
	ELEM ==> (car(car([[x2,[y2,z2]],[xp2,[yp2,zp2]]])) = x2) & (car(cdr(car([[x2,[y2,z2]],[xp2,[yp2,zp2]]]))) = y2) & (cdr(cdr(car([[x2,[y2,z2]],[xp2,[yp2,zp2]]]))) = z2)
	ELEM ==> (car(cdr([[x2,[y2,z2]],[xp2,[yp2,zp2]]])) = xp2) & (car(cdr(cdr([[x2,[y2,z2]],[xp2,[yp2,zp2]]]))) = yp2) & (cdr(cdr(cdr([[x2,[y2,z2]],[xp2,[yp2,zp2]]]))) = zp2)
	EQUAL ==> (car(car(xyz_thryvar)) = x2) & (car(cdr(car(xyz_thryvar))) = y2) & (cdr(cdr(car(xyz_thryvar))) = z2)
	EQUAL ==> (car(cdr(xyz_thryvar)) = xp2) & (car(cdr(cdr(xyz_thryvar))) = yp2) & (cdr(cdr(cdr(xyz_thryvar))) = zp2)
	Use_def(x8_thryvar) ==> x8_thryvar = car(car(xyz_thryvar))
	Use_def(y8_thryvar) ==> y8_thryvar = car(cdr(car(xyz_thryvar)))
	Use_def(z2_thryvar) ==> z2_thryvar = cdr(cdr(car(xyz_thryvar)))
	Use_def(xp3_thryvar) ==> xp3_thryvar = car(cdr(xyz_thryvar))
	Use_def(yp3_thryvar) ==> yp3_thryvar = car(cdr(cdr(xyz_thryvar)))
	Use_def(zp2_thryvar) ==> zp2_thryvar = cdr(cdr(cdr(xyz_thryvar)))
	EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The utility theory just developed can be summarized as follows.
--DISPLAY one_1_test_3
--
--THEORY one_1_test_3(a3(x,y,wz),b3(x,y,wz),s,t,r,P3(x,y,wz))
--==>(x8_thryvar,y8_thryvar,z2_thryvar,xp3_thryvar,yp3_thryvar,zp2_thryvar)
--((x8_thryvar in s) & (y8_thryvar in t) & (z2_thryvar in u) &
--                (xp3_thryvar in s) & (yp3_thryvar in t) & (zp2_thryvar in u) &
--                P3(x8_thryvar,y8_thryvar,z2_thryvar) & P3(xp3_thryvar,yp3_thryvar,zp2_thryvar) &
--		(not((a3(x8_thryvar,y8_thryvar,z2_thryvar) = a3(xp3_thryvar,yp3_thryvar,zp2_thryvar)) ¥eq (b3(x8_thryvar,y8_thryvar,z2_thryvar) = b3(xp3_thryvar,yp3_thryvar,zp2_thryvar))))) or
--			 one_1_map({[a3(x,y,wz),b3(x,y,wz)]: x in s, y in t,wz in u})
--END one_1_test_3;
--
--
-- ************************************************************************************************
--						Section 4: The ordinal enumerability theorem
-- ************************************************************************************************
--
-- Now we begin more serious development of the theory of ordinals, along von Neumann's line.
-- Our first theorem uses induction to show that if one ordinal $t$ is included in another
-- ordinal $s$ but not equal to $s$, then $t$ must be a member of $s$, and in fact must be
-- the smallest element of $s - t$.
--
Theorem 27: [Ordinal comparison lemma] (Ord(S) & Ord(T) & (T ¥incin S)) ¥imp ((T = S) or (T = arb(S - T))). Proof:
    Suppose_not(s,t) ==> Ord(s) & Ord(t) & (t ¥incin s) & (t /= s) & (t /= arb(s - t))
--
-- For if our assertion is false, $s$ must have a proper subset $t$,
-- in which case the axiom of choice tells us that $s - t$ has a minimal element $arb(s - t)$
-- disjoint from $s - t$. Plainly  $arb(s - t)$ is also a member of the superset $s$ of $s - t$.
--
    ELEM ==> (arb(s - t) in s) & (arb(s - t) * (s - t) = 0)
    Use_def(Ord) ==>
	Stat1: (FORALL x in s| x ¥incin s) & Stat2: (FORALL x in s, y in s | (x in y or y in x or x = y))
--
-- But then, by definition of ordinal, $arb(s - t)$ must be a subset of $s * t$,
-- since it is disjoint from $s - t$. Therefore $arb(s - t)$ cannot include $t$, otherwise the initial
-- assumption  $t /= arb(s - t)$ would be contradicted.
--
    (arb(s - t))-->Stat1 ==> arb(s - t) ¥incin s
    ELEM ==> (arb(s - t) ¥incin s * t) & Stat3: (not(arb(s - t) incs t))
--
-- Since $arb(s - t)$ fails to include $t$, there must be some $b$ in $t$ but not in $arb(s - t)$.
-- By the definition of ordinals, this implies that $arb(s - t) = b or arb(s - t) in b$.
--
    (b)-->Stat3 ==> (b in t) & (not (b in arb(s - t)))
    (arb(s - t),b)-->Stat2 ==> (arb(s - t) in b or arb(s - t) = b)
	Use_def(Ord) ==>
	Stat4: (FORALL x in t| x ¥incin t) & (FORALL x in t, y in t | (x in y or y in x or x = y))
--
-- Using the definition of ordinals once more, this time for $t$, we see that $b$ must be a subset of $t$,
-- which rules out both $arb(s - t) in b$ and $arb(s - t) = b$, because either of these would yield
-- $arb(s - t) in t$ which is impossible. We have contradicted our original assumption, and so proved our theorem.
--
	(b)-->Stat4 ==> b ¥incin t
    Discharge ==> QED
--
-- Next we show that the intersection of any two ordinals is an ordinal.
-- (Indeed, as Theorem 29 shows, this intersection must be the smaller of the two ordinals.)
--
Theorem 28: [Ordinal intersection] (Ord(S) & Ord(T)) ¥imp Ord(S * T). Proof:
    Suppose_not(s,t) ==> Ord(s) & Ord(t) & (not Ord(s * t))
--
-- For suppose the contrary. Then by definition of ordinals there must exist $a$, $b$, $c$
-- such that $a$ is a member of $s * t$ but not included in it, or $b$ and $c$ are both
-- members or $s * t$, but are unrelated by membership.
--
    Use_def(Ord) ==> Stat1: not(((FORALL x in s * t | x ¥incin s * t)) &
	(FORALL x in s * t, y in s * t | (x in y or y in x or x = y)))
    (a,b,c)-->Stat1 ==> Stat2: ((a in s * t) & (not(a ¥incin s * t))) or
		((b in s * t) & (c in s * t) & (not(b in c or c in b or c = b)))
--
-- However, since $s$ and $t$ are both ordinals the first case is clearly impossible,
-- so we need only consider the second case.
--
    Suppose ==> Stat3: (a in s * t) & (not(a ¥incin s * t))
        Use_def(Ord) ==> Stat4: (FORALL x in s | x ¥incin s) &
		Stat5: (FORALL x in s, y in s | (x in y or y in x or x = y))
        Use_def(Ord) ==> Stat6: (FORALL x in t | x ¥incin t)
        a-->Stat4 ==> Stat7: (a in s) ¥imp (a ¥incin s)
        a-->Stat6 ==> Stat8: (a in t) ¥imp (a ¥incin t)
    (Stat3,Stat7,Stat8*)Discharge ==> Stat9: (b in s) & (c in s) & (not(b in c or c in b or c = b))
--
-- But using the definition of ordinal once more we see that this case is impossible also.
--
    (b,c)-->Stat5(Stat9,Stat9) ==> ((b in s) & (c in s)) ¥imp (b in c or c in b or c = b)
    (Stat9)Discharge ==> QED
--
-- Now we prove the related but slightly less elementary result that
-- one of any pair of ordinals must include the other.
--
Theorem 29: [Second ordinal comparison lemma] (Ord(S) & Ord(T)) ¥imp ((S ¥incin T) or (T ¥incin S)). Proof:
    Suppose_not(s,t) ==> Stat1: Ord(s) & Ord(t) & (not(s ¥incin t)) & (not(t ¥incin s))
--
-- For if not, neither of these ordinals is included in the other, so neither can equal
-- the intersection of the two, which is an ordinal by Theorem 28.
--
    (s,t)-->T28 ==> Ord(s * t)
--
-- It now follows, using Theorem 27 twice, that $s * t$ is equal to both $arb(s - (s * t))$ and $arb(t - (s * t))$,
-- and so, since neither of these sets is empty, is a member of both
-- $s - (s * t)$ and $t - (s * t)$, which is impossible since the intersection of these two sets is empty.
-- This contradiction proves our theorem.
--
    (s,s*t)-->T27(Stat1*) ==> s * t = arb(s - (s * t))
    (t,s*t)-->T27(Stat1*) ==> s * t = arb(t - (s * t))
    ELEM ==> s - (s * t) /= 0
    ELEM ==> t - (s * t) /= 0
    (s - (s * t))-->T0 ==> (((s - (s * t)) = 0) & (arb(s - (s * t)) = 0)) or
	((arb(s - (s * t)) in s - (s * t)) & (arb(s - (s * t)) * (s - (s * t)) = 0))
    ELEM ==> s * t in s
    (t - (s * t))-->T0 ==> (((t - (s * t)) = 0) & (arb(t - (s * t)) = 0)) or
	((arb(t - (s * t)) in t - (s * t)) & (arb(t - (s * t)) * (t - (s * t)) = 0))
    Discharge ==> QED
--
-- The following corollary to the preceding theorem asserts that the union of two ordinals is an ordinal
-- and that the intersection of two ordinals is an ordinal.
--
Theorem 30: [Ordinal maximum and minimum] (Ord(S) & Ord(T)) ¥imp (Ord(S + T) & Ord(S * T)). Proof:
    Suppose_not(s,t) ==> Ord(s) & Ord(t) & (not (Ord(s + t) & Ord(s * t)))
    (s,t)-->T29 ==> (s ¥incin t) or (t ¥incin s)
    Suppose ==> s ¥incin t
    ELEM ==> (s + t = t) & (s * t = s)
    EQUAL ==> false; Discharge ==> (s + t = s) & (s * t = t)
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the family of all ordinals (we will see shortly that this is not a set)
-- is linearly ordered by membership.
--
Theorem 31: [Ordinal membership comparison] (Ord(S) & Ord(T)) ¥imp ((S in T) or (T in S) or (S = T)). Proof:
    Suppose_not(s,t) ==> Ord(s) & Ord(t) & (not(s in t or t in s or s = t))
--
-- For if we suppose the contrary, and note that by Theorem 29 one must include the other
-- but not be equal to it, it follows  (by the axiom of choice)
-- that one must be a member of the other, a contradiction which proves our theorem.
--
    (s,t)-->T29 ==> Stat1: (s ¥incin t) or (t ¥incin s)
    (s,t)-->T27 ==> (t ¥incin s) ¥imp (t = arb(s - t))
    (t,s)-->T27 ==> (s ¥incin t) ¥imp (s = arb(t - s))
    Discharge ==> QED
--
-- The successor of an ordinal has a simple and very general definition:
--
Def 11: [successor (defined for any set, including ordinals and integers)] next(s) := s + {s}
--
-- It is easy to show that this successor is an ordinal.
--
Theorem 32: [Successor ordinal] Ord(S) ¥imp Ord(next(S)). Proof:
    Suppose_not(s) ==> AUTO
--
-- For if we suppose the contrary, and use the definition of ordinals,
-- we see that there must exist $a$, $b$, $c$
-- such that $a$ is a member of $s + {s}$ but not included in it, or $b$ and $c$ are both
-- members of $s + {s}$, but are unrelated by membership.
--
    Use_def(next) ==> Ord(s) & (not(Ord(s + {s})))
    Use_def(Ord) ==>
	Stat1: (not((FORALL x in (s + {s}) | x ¥incin (s + {s})) &
	(FORALL x in (s + {s}), y in (s + {s}) | (x in y or y in x or x = y))))
    (a,b,c)-->Stat1 ==> AUTO
--    (a,b,c)-->Stat1 ==> ((a in s + {s}) & (not(a ¥incin (s + {s})))) or
--	((b in s + {s}) & (c in s + {s}) & (not(b in c or c in b or b = c)))
--
-- Since the cases $a = s$, $b = s$, and $c = s$ are all impossible,
-- we must either have $a in s$ or $b in s$ and $c in s$.
--
    ELEM ==> ((a in s) & (not(a ¥incin s))) or ((b in s) & (c in s) & (not(b in c or c in b or b = c)))
--
-- But both of these cases are impossible since $s$ is an ordinal, a contradiction proving our theorem.
--
    Use_def(Ord) ==>
	Stat2: (FORALL x in s | x ¥incin s) & (FORALL x in s, y in s | (x in y or y in x or x = y))
    (a,b,c)-->Stat2 ==> AUTO
    Discharge ==> QED
--
-- Sometimes it is useful to have the preceding theorem in the following more direct form.
--
Theorem 33: [Successor ordinal 2] Ord(S) ¥imp Ord(S + {S}). Proof:
    Suppose_not(s) ==> AUTO
    Use_def(next) ==> Ord(s) & (not(Ord(next(s))))
    s-->T32 ==> false; Discharge ==> QED
--
-- Our next theorem shows that for ordinals inclusion is equivalent to the disjunction of identity and membership.
--
Theorem 34: [Third ordinal comparison lemma] (Ord(S) & Ord(T)) ¥imp ((T ¥incin S) ¥eq ((T in S) or (T = S))). Proof:
    Suppose_not(s,t) ==> AUTO
--
-- For in the contrary case there must exist two ordinals $s$ and $t$ such that either
-- $t$ is a member but not a subset of $s$, or $t$ is a subset of $s$ but neither a member of, or equal to, $s$;
--
    ELEM ==>  (((not(t ¥incin s)) & (t in s)) or ((t ¥incin s) & (not(t in s or t = s))))
--
-- but the first case is ruled out by definition of ordinal and the second case by Theorem 27,
-- proving our theorem.
--
    (s,t)-->T13 ==> (t ¥incin s) & (t notin s) & (t /= s)
    (s,t)-->T27 ==> t = arb(s - t)
    Discharge ==> QED
--
-- It is sometimes convenient to use this theorem in the following modified form.
--
Theorem 35: [Ordinal membership and comparison] (Ord(S) & Ord(T)) ¥imp ((T notin S) ¥eq (S ¥incin T)). Proof:
    Suppose_not(s,t) ==> Ord(s) & Ord(t) & (t notin s) & (not(s ¥incin t))
--
-- Since $(t in s) & (s ¥incin t)$ is impossible, a counterexample to our assertion must satisfy
-- $(t notin s) & (not(s ¥incin t))$. But by Theorem 31 we then have $s ¥incin t$,
-- a contradiction which proves the present corollary.
--
	(s,t)-->T31 ==> (s in t) or (s = t)
    (t,s)-->T34 ==> false; Discharge ==> QED
--
-- Our next lemma tells us that for ordinals membership in the successor of an ordinal s is equivalent to inclusion in $s$.
--
Theorem 36: [Membership in the successor of an ordinal $s$] Ord(S) ¥imp ((T in next(S)) ¥eq ((T ¥incin S) & Ord(T))). Proof:
Suppose_not(s,t) ==> AUTO
	Use_def(next) ==> Stat1: Ord(s) & (not((t in (s + {s})) ¥eq ((t ¥incin s) & Ord(t))))
	Suppose ==>  Stat2: ((t in s) or (t = s)) & (not((t ¥incin s) & Ord(t)))
		Suppose ==> Stat3: t = s
		EQUAL(Stat1,Stat3) ==> Stat4: false; (Stat4)Discharge ==> Stat5: t in s
		(s,t)-->T12(Stat1,Stat5) ==> Stat6: Ord(t)
	(s,t)-->T34(Stat1,Stat2,Stat5,Stat6) ==> Stat7: false; (Stat7)Discharge ==> Stat8: not(((t in s) or (t = s)) & (not((t ¥incin s) & Ord(t))))
(s,t)-->T34(Stat1,Stat8) ==> Stat9: false; (Stat9)Discharge ==> QED
--
Theorem 37: [Membership of $s$ in an ordinal $t$ implies inclusion of $next(s)$ in $t$] (Ord(T) & (S in T)) ¥imp (next(S) ¥incin T). Proof+:
    Suppose_not(m,i) ==> Ord(m) & (i in m) & Stat1: (not(next(i) ¥incin m))
        j-->Stat1 ==> (j in next(i)) & (j notin m)
        Use_def(next) ==> j in i
        (j,m)-->T34 ==> not(m ¥incin j)
    (m,j)-->T35 ==> false; Discharge ==> QED
--
-- Now we start to prepare for proof of the basic ordinal enumerability theorem,
-- Theorem 46 below. Our first step is to prove that both the collection of all
-- sets and the collection of all ordinals are 'too large' to be sets.
-- The following theorem gives the first of these results.
--
Theorem 38: [The class of all sets is not a set] not(EXISTS x | (FORALL y | y in x)). Proof:
    Suppose_not ==> Stat1: (EXISTS x | (FORALL y | y in x))
    u-->Stat1 ==> Stat2: (FORALL y | (y in u))
--
-- For, in the contrary case, consider the set $u$ of all sets. This $u$ would be
-- a member of itself, whereas the axiom of choice forbids membership loops.
-- A derivation of this fact from 'first principles' would be:
-- \nextline
--    $({u})$-->T0 ==> $(arb({u}) in {u}) & (arb({u}) * {u}) = 0$ \nextline
--     ELEM ==> $(arb({u}) = u) & (u notin u)$ \nextline
--     $u$-->Stat2 ==> $false$; Discharge ==> QED \nextline
-- \nextline
-- In our inference environment, the following abridged proof suffices:
--
    u-->Stat2 ==> u in u
    Discharge ==> QED
--
Theorem 39: [There is no antinomic Russell's set] not(EXISTS x | (FORALL y | (y in x) ¥eq (y notin y))). Proof:
    Suppose_not ==> Stat1: (EXISTS x | (FORALL y | (y in x) ¥eq (y notin y)))
    a-->Stat1 ==> Stat2: (FORALL y | (y in a) ¥eq (y notin y))
--
-- For in the contrary case consider the set $a$ of all sets which are not members of themselves.
-- Then $a$ cannot be a member of itself, or fail to be a member of itself.
-- This impossibility proves our theorem.
--
    a-->Stat2 ==> (a in a) ¥eq (a notin a)
    Discharge ==> QED
--
-- Next we show that the class of ordinals is not a set
--
Theorem 40: [The class of ordinals is not a set]
    not (FORALL x | ((x in OS) ¥eq Ord(x))). Proof+:
    Suppose_not(o) ==> Stat1: AUTO
--
-- For suppose the contrary, so that there is a set $o$ consisting of all ordinals.
-- But we can show that $o$ must be an ordinal. Indeed, if it were not,
-- then by the definition of ordinals there would exist $a$, $b$, $c$
-- such that either $a$ was a member but not a subset of $o$,
-- or $b$ and $c$ are two members of $o$ not related by membership.
--
    Suppose ==> not Ord(o)
    Use_def(Ord) ==> Stat2: not((FORALL x in o | x ¥incin o) & (FORALL x in o, y in o | (x in y) or (y in x) or (x = y)))
    (a,b,c)-->Stat2 ==> ((a in o) & (not(a ¥incin o))) or
		((b in o) & (c in o) & (not((b in c) or (c in b) or (b = c))))
--
-- In the  second of these cases $b$ and $c$ are both plainly ordinals.
-- so that this case is ruled out by Theorem 31. Hence only the first case need be considered.
--
    Suppose ==> (b in o) & (c in o) & (not((b in c) or (c in b) or (b = c)))
    b-->Stat1 ==> Ord(b)
    c-->Stat1 ==> Ord(c)
    (b,c)-->T31 ==> false; Discharge ==> Stat3: (a in o) & (not(a ¥incin o))
--
-- In this case the set $a$, which must plainly be an ordinal,
-- must have a member $d$ which is not in $o$, and hence not an ordinal
-- by Stat1 above, which is impossible, so our theorem is proved.
--
    a-->Stat1 ==> Ord(a)
    (d)-->Stat3 ==> (d in a) & (d notin o)
    d-->Stat1 ==> false; Discharge ==> Ord(o)
    o-->Stat1 ==> false; Discharge ==> QED
--
-- We now give the following transfinite recursive definition, which introduces the
-- function that will be shown to put every set in 1-1 correspondence with some ordinal.
--
Def 9: [The enumeration of a set]
    enum(X,S) := if S ¥incin {enum(y,S): y in X} then S else arb(S - {enum(y,S): y in X}) end if
--
-- To begin our work toward the culminating Theorem 46 seen below, we first show
-- that if a set $s$ is a member of $b := {enum(y,s): y in x}$ for some ordinal $x$,
-- so is every one of the members of $s$.
--
Theorem 41: [Enumerability principle] ((Ord(X) & S in {enum(y,S): y in X})) ¥imp (S ¥incin {enum(y,S): y in X}). Proof:
    Suppose_not(x,s) ==> Ord(x) & Stat1: (s in {enum(y,s): y in x}) & (not(s ¥incin {enum(u,s): u in x}))
--
-- For suppose not. Then there is a $v$ in $x$ such that $s = enum(v,s)$, but $s$ cannot be a subset
-- of ${enum(u,s): u in v}$; so by definition of $enum$,
-- $enum(v,s) = arb(s - {enum(z,s): z in v})$, which is impossible, since it wold imply $s in s$.
--
    v-->Stat1 ==> (s = enum(v,s)) & (v in x)
    (x,v)-->T13 ==> v ¥incin x
    Set_monot ==> {enum(u,s): u in x} incs {enum(u,s): u in v}
    ELEM ==> not(s ¥incin {enum(z,s): z in v})
    Use_def(enum) ==> enum(v,s) = if s ¥incin {enum(z,s): z in v} then s else arb(s - {enum(z,s): z in v}) end if
    ELEM ==> enum(v,s) = arb(s - {enum(z,s): z in v})
    Discharge ==> QED
--
-- It is also easy to show that for any $x$, $enum(x,s)$ is either $s$ or a member of $s$.
--
Theorem 42: [Enumeration membership lemma] (enum(X,S) = S) or (enum(X,S) in S). Proof:
    Suppose_not(x,s) ==> (enum(x,s) /= s) & (enum(x,s) notin s)
--
-- For in the contrary case, $s ¥incin {enum(y,s): y in x}$ must be false, so $enum(x,s) in s$
-- must be true by definition of $enum$ and by the axiom of choice.
--
    Use_def(enum) ==> enum(x,s) = if s ¥incin {enum(y,s): y in x} then s else arb(s - {enum(y,s): y in x}) end if
    ELEM ==> s - {enum(y,s): y in x} /= 0
    ELEM ==> enum(x,s) = arb(s - {enum(y,s): y in x})
    (s - {enum(y,s): y in x})-->T0 ==> arb(s - {enum(y,s): y in x}) in s - {enum(y,s): y in x}
    Discharge ==> QED
--
-- Next we show that if $enum(x,s)$ equals $s$ for any $x$, it also equals $s$ for any larger $y$:
--
Theorem 43: [Enumeration inclusion lemma] ((enum(X,S) = S) & (Y incs X)) ¥imp (enum(Y,S) = S). Proof:
Suppose_not(x,s,w) ==> Stat1: (enum(x,s) = s) & (w incs x) & (enum(w,s) /= s)
--
-- For in the contrary case, we must have $s ¥incin {enum(u,s): u in x}$ by definition of enum
-- and the axiom of choice.
--
Use_def(enum) ==> Stat2: enum(x,s) = if s ¥incin {enum(u,s): u in x} then s else arb(s - {enum(u,s): u in x}) end if
Suppose ==> not (s ¥incin {enum(u,s): u in x})
ELEM ==> Stat3: s - {enum(y,s): y in x} /= 0
(s - {enum(u,s): u in x})-->T0 ==> Stat4: arb(s - {enum(u): u in x}) in s - {enum(u,s): u in x}
Discharge ==> AUTO
--
-- Thus $s ¥incin {enum(u,s): u in w}$ by set monotonicity, and so $enum(w,s) = s$,
-- a contradiction which proves our theorem.
--
Set_monot ==> {enum(u,s): u in x} ¥incin {enum(u,s): u in w}
ELEM ==> s ¥incin {enum(u,s): u in w}
Use_def(enum) ==> enum(w,s) = if s ¥incin {enum(u,s): u in w} then s else arb(s - {enum(u,s): u in w}) end if
Discharge ==> QED
--
-- The following result tells us that, if we confine ourselves to the range of ordinals $x$ for which
-- $s notin {enum(u,s): u in x}$, the map $x$->$enum(x,s)$ is one-to-one:
--
Theorem 44: [The enumeration of a set is 1-1]
    (Ord(X) & Ord(W) & (X /= W)) ¥imp
	((S in {enum(u,S): u in X}) or (S in {enum(u,S): u in W}) or (enum(X,S) /= enum(W,S))). Proof:
    Suppose_not(x,wz,s) ==>
	Ord(x) & Ord(wz) & (x /= wz) &
	Stat1: (s notin {enum(u,s): u in x}) & Stat2: (s notin {enum(u,s): u in wz}) & (enum(x,s) = enum(wz,s))
--
-- For if not, there are two distinct ordinals $x$ and $wz$ in the stated range
-- such that $enum(x,s) = enum(wz,s)$. Theorem 31 tells us that
-- one of the ordinals $x$ and $wz$ must be a member of the other. First suppose that $wz in x$,
-- so that, by Stat1, $enum(wz,s) /= s$, and therefore $enum(x,s) /= s$.
--
    (x,wz)-->T31 ==> (x in wz) or (wz in x)
    Suppose ==> wz in x
    wz-->Stat1 ==> enum(wz,s) /= s
--
-- Then it follows from the definition of $enum$ that $s$ cannot be a member of ${enum(u,s): u in x}$,
-- so that $enum(x,s) = arb(s - {enum(y,s): y in x})$, in which case the axiom of choice tells us that
-- $enum(x,s)$ is in $s - {enum(y,s): y in x}$. But then, since $enum(wz,s)$ is clearly
-- a member of ${enum(y,s): y in x}$, $enum(x,s)$ and $enum(wz,s)$ must be different, contrary to assumption.
--
    Use_def(enum) ==> enum(x,s) = if s ¥incin {enum(u,s): u in x} then s else arb(s - {enum(y,s): y in x}) end if
    ELEM ==> (not(s ¥incin {enum(u,s): u in x})) & (enum(x,s) = arb(s - {enum(y,s): y in x}))
    (s - {enum(u,s): u in x})-->T0 ==> arb(s - {enum(u,s): u in x}) in s - {enum(u,s): u in x}
    Suppose ==> Stat3: enum(wz,s) notin {enum(y,s): y in x}
    wz-->Stat3 ==> false; Discharge ==> enum(wz,s) in {enum(u,s): u in x}
    Discharge ==> x in wz
--
-- This leaves us with the case $x in wz$ to consider: this can be treated symmetrically,
-- and another contradiction derived, thereby proving the present theorem.
--
    x-->Stat2 ==> enum(x,s) /= s
    Use_def(enum) ==> enum(wz,s) = if s ¥incin {enum(u,s): u in wz} then s else arb(s - {enum(y,s): y in wz}) end if
    ELEM ==> (not(s ¥incin {enum(u,s): u in wz})) & (enum(wz,s) = arb(s - {enum(y,s): y in wz}))
    (s - {enum(u,s): u in wz})-->T0 ==> arb(s - {enum(u,s): u in wz}) in s - {enum(u,s): u in wz}
    Suppose ==> Stat4: enum(x,s) notin {enum(y,s): y in wz}
    x-->Stat4 ==> false; Discharge ==> enum(x,s) in {enum(u,s): u in wz}
    Discharge ==>     QED
--
-- Next we prove that, for each set $s$, there must exist some ordinal $x$ for which $s$
-- belongs to ${enum(y,s): y in x}$. This is done by showing that in the contrary case
-- the collection of all ordinals would be a set, which we have already shown to be false.
--
Theorem 45: [Enumeration lemma] (EXISTS x | (Ord(x) & (S in {enum(y,S): y in x}))). Proof:
    Suppose_not(s) ==> Stat1: not(EXISTS x | (Ord(x) & (s in {enum(u,S): u in x})))
--
-- We proceed by contradiction. If our theorem is false, there must exist a set $s$ such that
-- $s notin {enum(y,s): y in x}$ for every ordinal $x$. In this case, Theorem 44 tells us that
-- $enum(x,s) /= enum(y,s)$ for every distinct pair $x,y$ of ordinals.
--
    Suppose ==> Stat2:
	not((FORALL x, y | ((Ord(x) & Ord(y)) ¥imp (((enum(x,s) in s) & (enum(y,s) in s) & (x /= y)) ¥imp (enum(x,s) /= enum(y,s))))))
    (x,y)-->Stat2 ==> Ord(x) & Ord(y) & (enum(x,s) in s) & (enum(y,s) in s) & (x /= y) & (enum(x,s) = enum(y,s))
    x-->Stat1 ==> s notin {enum(u,s): u in x}
    y-->Stat1 ==> s notin {enum(u,s): u in y}
    (x,y,s)-->T44 ==> false
    Discharge ==> Stat3:
	(FORALL x, y | ((Ord(x) & Ord(y)) ¥imp (((enum(x,s) in s) & (enum(y,s) in s) & (x /= y)) ¥imp (enum(x,s) /= enum(y,s)))))
--
-- We shall now show that $s$ is not a subset of ${enum(y,s): y in o1}$ for any ordinal $o1$.
-- For if $s ¥incin {enum(y,s): y in o1}$, then by definition of $enum$, $enum(o1,s) = s$, and hence
-- s in ${enum(x,s): s in next(o1)}$, contradicting Stat4 above.
-- It follows by a second use of the definition of $enum$ that $enum(o1,s) = arb(s - {{enum(y,s): y in o1}})$,
-- so that $enum(o1,s) in s$ for every ordinal $o1$.
--
	Suppose ==> Stat5: not(FORALL o1 | Ord(o1) ¥imp (not(s ¥incin {enum(y,s): y in o1})))
	o2-->Stat5 ==> Ord(o2) & (s ¥incin {enum(y,s): y in o2})
	Use_def(enum) ==> enum(o2,s) = if s ¥incin {enum(y,s): y in o2} then s else arb(s - {enum(y,s): y in o2}) end if
	ELEM ==> enum(o2,s) = s
	(next(o2))-->Stat1 ==> not(Ord(next(o2)) & (s in {enum(u,S): u in next(o2)}))
	o2-->T32 ==> Stat6: s notin {enum(u,S): u in next(o2)}
	o2-->Stat6 ==> o2 notin next(o2)
	Use_def(next) ==> false; Discharge ==> Stat7: (FORALL o1 | Ord(o1) ¥imp (not(s ¥incin {enum(y,s): y in o1})))
	Suppose ==> Stat8: not(FORALL o1 | Ord(o1) ¥imp (enum(o1,s) in s))
	o3-->Stat8 ==> Ord(o3) & (not(enum(o3,s) in s))
	o3-->Stat7 ==> not(s ¥incin {enum(y,s): y in o3})
	Use_def(enum) ==> enum(o3,s) = if s ¥incin {enum(y,s): y in o3} then s else arb(s - {enum(y,s): y in o3}) end if
	ELEM ==> enum(o3,s) = arb(s - {enum(y,s): y in o3})
	(s - {enum(y,s): y in o3})-->T0 ==> false
	Discharge ==> Stat9: (FORALL o1 | Ord(o1) ¥imp (enum(o1,s) in s))
--
-- Now consider the set $t$ of all $x in s$ having the form $enum(o,s)$ for some ordinal $o$, so that
-- for each $x in t$ there is an ordinal $o$ such that $x = enum(o,s)$.
--
    Loc_def ==> t = {x in s | (EXISTS o | Ord(o) & (enum(o,s) = x))}
    Suppose ==> Stat10: not (FORALL x | ((x in t) ¥imp (EXISTS o | (Ord(o) & (enum(o,s) = x)))))
    a-->Stat10 ==> (a in t) & (not(EXISTS o | (Ord(o) & (enum(o,s) = a))))
    ELEM ==> Stat11: a in {x in s | (EXISTS o | Ord(o) & (enum(o,s) = x))}
    ()-->Stat11 ==> false; Discharge ==> Stat12: (FORALL x | ((x in t) ¥imp (EXISTS o | Ord(o) & (enum(o,s) = x))))
    Suppose ==> Stat13: not(FORALL x | (EXISTS o | ((x in t) ¥imp (Ord(o) & (enum(o,s) = x)))))
    xa-->Stat13 ==> Stat14: not(EXISTS o | ((xa in t) ¥imp (Ord(o) & (enum(o,s) = xa))))
    xa-->Stat12 ==>  Stat15: (xa in t) ¥imp (EXISTS o | Ord(o) & (enum(o,s) = xa))
    oa-->Stat14 ==> not((xa in t) ¥imp (Ord(oa) & (enum(oa,s) = xa)))
    (Stat15)ELEM ==> (xa in t) & Stat16: (EXISTS o | Ord(o) & (enum(o,s) = xa))
    ob-->Stat16 ==> Ord(ob) & (enum(ob,s) = xa)
    ob-->Stat14 ==> false; Discharge ==> Stat17: (FORALL x | (EXISTS o | ((x in t) ¥imp (Ord(o) & (enum(o,s) = x)))))
--
-- Skolemize this last statement, rewriting it in the following form:
--
    APPLY(v1_thryvar:ord_for) Skolem() ==> Stat18: (FORALL x | ((x in t) ¥imp (Ord(ord_for(x)) & (enum(ord_for(x),s) = x))))
--
-- We will show that every ordinal belongs to the set ${ord_for(x): x in t}$. For suppose the contrary,
-- and consider an ordinal $o$ not in this set, which then plainly differs from $ord_for(enum(o,s))$;
--
    Suppose ==> Stat19: not(FORALL o in OM |(Ord(o) ¥imp (o in {ord_for(x): x in t})))
    o-->Stat19 ==> Ord(o) & Stat20: (o notin {ord_for(x): x in t})
    o-->Stat3 ==> not (EXISTS y | (not ((Ord(o) & Ord(y)) ¥imp (((((enum(o,s) in s) & (enum(y,s) in s)) & (o /= y))
								¥imp ((enum(o,s) /= enum(y,s))))))))
	o-->Stat9 ==> Stat21: enum(o,s) in s
	Suppose ==> enum(o,s) notin t
	ELEM ==> Stat22: enum(o,s) notin {x in s | (EXISTS oo | Ord(oo) & (enum(oo,s) = x))}
	()-->Stat22 ==> Stat23: not(EXISTS oo | Ord(oo) & (enum(oo,s) = enum(o,s)))
	o-->Stat23 ==> not (Ord(o) & (enum(o,s) = enum(o,s)))
	Discharge ==> enum(o,s) in t
    (enum(o,s))-->Stat20 ==> o /= ord_for(enum(o,s))
--
-- by definition of the set $t$, $enum(o,s)$ must belong to it, and hence to $s$.
--
    Suppose ==> enum(o,s) notin t
    ELEM ==> Stat24: enum(o,s) notin {x in s | (EXISTS o | (Ord(o) & (enum(o,s) = x)))}
    (enum(o,s))-->Stat24 ==> Stat25: not((enum(o,s) in s) & (EXISTS oo | (Ord(oo) & (enum(oo,s) = enum(o,s)))))
    (Stat21,Stat25*)ELEM ==> Stat26: not((EXISTS oo | (Ord(oo) & (enum(oo,s) = enum(o,s)))))
    o-->Stat26 ==> false; Discharge ==> enum(o,s) in t
    ELEM ==> Stat27: enum(o,s) in {x in s | (EXISTS o | Ord(o) & (enum(o,s) = x))}
    ()-->Stat27 ==> enum(o,s) in s
--
-- Since the definition of $ord_for$ implies the following formula,
-- the fact that $enum$ is one-to-one on ordinals (Stat3)
-- implies that $ord_for(enum(o,s)) = o$.
--
    (enum(o,s))-->Stat18 ==> Ord(ord_for(enum(o,s))) & (enum(ord_for(enum(o,s)),s) = enum(o,s))
    (ord_for(enum(o,s)),o)-->Stat3 ==> ord_for(enum(o,s)) = o
--
-- This contradiction shows that every ordinal belongs to the set ${ord_for(x): x in t}$,
-- contradicting the fact, proved as Theorem 40, that there can be no set to which all
-- ordinals belong. This final contradiction proves the present theorem.
--
    Discharge ==> Stat28: (FORALL o in OM | (Ord(o) ¥imp (o in {ord_for(u): u in t})))
    Suppose ==> Stat29: not(FORALL o | (Ord(o) ¥eq (o in {ord_for(x): x in t})))
    os-->Stat29 ==> not(Ord(os) ¥eq (os in {ord_for(x): x in t}))
    os-->Stat28 ==> Stat30: (os in {ord_for(x): x in t}) & (not Ord(os))
    xx-->Stat30 ==> (xx in t) & (os = ord_for(xx))
    xx-->Stat18 ==> Ord(ord_for(xx))
    EQUAL ==> false;  Discharge ==> (FORALL o | (Ord(o) ¥eq (o in {ord_for(u): u in t})))
    ({ord_for(x): x in t})-->T40 ==> false; Discharge ==> QED
--
-- We are now in position to prove the key fact that the function $enum(x,s)$ puts any
-- set $s$ in one-to-one correspondence with an ordinal.
-- The following theorem states this result formally.
--
Theorem 46: [Main enumeration theorem]
    (EXISTS x | Ord(x) & (S = {enum(y,S): y in x}) &
	(FORALL y in x, z0 in x | ((y /= z0) ¥imp (enum(y,S) /= enum(z0,S))))). Proof+:
    Suppose_not(s) ==> Stat1: (not(EXISTS x | Ord(x) & (s = {enum(y,s): y in x}) &
	(FORALL y in x, z0 in x | ((y /= z0) ¥imp ((enum(y,s) /= enum(z0,s)))))))
--
-- We proceed by contradiction. Suppose that our theorem is false, so that no ordinal having the properties
-- considered in the theorem exists. By Theorem 45, there exists an ordinal $x$ such that $s$ is in ${enum(y,s): y in x}$,
-- and hence an ordinal $y$ such that $s = enum(y,s)$.
--
    (s)-->T45 ==> Stat2: (EXISTS x | (Ord(x) & (s in {enum(y,s): y in x})))
    x-->Stat2 ==> Ord(x) & Stat3: (s in {enum(y,s): y in x})
    w-->Stat3 ==> (s = enum(w,s)) & (w in x)
--
-- By definition of $enum$, $enum(w,s)$ is a member of $s$ unless $s ¥incin {enum(u,s): u in w}$ is true;
-- since $s = {enum(u,s): u in w}$ this is impossible, so we must have $s ¥incin {enum(u,s): u in w}$.
--
    Use_def(enum) ==> Stat4: enum(w,s) = if s ¥incin {enum(u,s): u in w} then s else arb(s - {enum(u,s): u in w}) end if
    Suppose ==> not(s ¥incin {enum(u,s): u in w})
    (s - {enum(u,s): u in w})-->T0(Stat4*) ==> enum(w,s) in s - {enum(u,s): u in w}
    Discharge ==> s ¥incin {enum(u,s): u in w}
--
-- The principle of transfinite induction now tells us that there exists
-- a minimal ordinal $b$ such that $s ¥incin {enum(y,s): y in b}$. Since our theorem is false,
-- either $s$ must be different from ${enum(y,s): y in b}$, or the function
-- $enum(.,s)$ cannot be 1-1 on $b$.
--
    APPLY(mt1_thryvar:b) transfinite_induction(n->w,P(x)->(Ord(x) & (s ¥incin {enum(u,s): u in x}))) ==>
		Stat5: (FORALL u | (Ord(b) & (s ¥incin {enum(y,s): y in b})) &
					((u in b) ¥imp (not (Ord(u)) & (s ¥incin {enum(vv,s): vv in u}))))
	a0-->Stat5 ==> Ord(b) & (s ¥incin {enum(y,s): y in b})
    b-->Stat1 ==> (s /= {enum(y,s): y in b}) or
    		not(FORALL y in b, z0 in b | ((y /= z0) ¥imp (enum(y,s) /= enum(z0,s))))
--
-- First suppose that ${enum(y,s): y in b} /= s$, i.e. that the second of these sets
-- does not include the first, so that there is a $c$ in the first but not the second,
-- and so a $d in b$ such that $c = enum(d,s)$.
--
    Suppose ==> Stat6: not({enum(y,s): y in b} ¥incin s)
    c-->Stat6 ==> Stat7: (c in {enum(y,s): y in b}) & (c notin s)
    d-->Stat7 ==> (c = enum(d,s)) & (d in b) & (c notin s)
--
-- Since $b$ is an ordinal, $d$ is also an ordinal, so Stat5 tells us
-- that $s$ is not a subset of ${enum(y,s): y in d}$, and thus by definition
-- $c = enum(d,s)$ must be a member of $s$, a contradiction which tells us that
-- ${enum(y,s): y in b}$ must be equal to $s$.
--
    d-->Stat5 ==> (not Ord(d)) or (not s ¥incin {enum(y,s): y in d})
    (b,d)-->T12 ==> Stat8: (not s ¥incin {enum(y,s): y in d}) & (s - {enum(y,s): y in d} /= 0)
    Use_def(enum) ==> enum(d,s) = if s ¥incin {enum(u,s): u in d} then s else arb(s - {enum(u,s): u in d}) end if
    (s - {enum(u,s): u in d})-->T0(Stat8*) ==> enum(d,s) in s
    Discharge ==> s = {enum(y,s): y in b}
--
-- This leaves only the possibility that the function $enum(.,s)$ is not 1-1 on $b$,
-- in which case there must exist two distinct ordinals $v$ and $wp$, both in $b$, such that $enum(v,s) = enum(wp,s)$.
--
    ELEM ==> Stat9: not(FORALL y in b, wz in b | ((y /= wz) ¥imp (enum(y,s) /= enum(wz,s))))
    (v,wp)-->Stat9 ==> (v in b) & (wp in b) & (v /= wp) & (enum(v,s) = enum(wp,s))
--
-- But, by Theorem 44, this can only happen if $s$ is in one of the sets
-- ${enum(y,s): y in v}$ and ${enum(y,s): y in wp}$. However, both of these possibilities
-- are ruled out by Stat5 if we take Theorem 41 into account.
-- So we have a contradiction proving our theorem.
--
    (v,wp,s)-->T44 ==> (s in {enum(y,s): y in v}) or (s in {enum(y,s): y in wp})
    v-->Stat5 ==> not (s ¥incin {enum(x,s): x in v})
    wp-->Stat5 ==> not (s ¥incin {enum(x,s): x in wp})
    (v,s)-->T41 ==> (s in {enum(y,s): y in v}) ¥imp (s ¥incin {enum(y,s): y in v})
    (wp,s)-->T41 ==> (s in {enum(y,s): y in wp}) ¥imp (s ¥incin {enum(y,s): y in wp})
    Discharge ==> QED
--
-- ************************************************************************************************
--						Section 5: Maps, map restrictions, and Cardinality
-- ************************************************************************************************
--
-- Our next main goal is to introduce the notion of cardinality and prove its properties.
-- In working with this notion we will find use for the familiar mathematical ideas appearing
-- in the following auxiliary definitions.
--
Def 12: [Map Restriction] Def(f ¥ON a) := {p in f | car(p) in a}
Def 13: [Value of single-valued function] Def(f~[x]) := cdr(arb(f ¥ON {x}))
--
Def 14: [Map Product] Def(F @ G) := {[car(x),cdr(y)]: x in G, y in F | cdr(x) = car(y)}
Def 14a: [Inverse Map] inv(F) := {[cdr(x),car(x)]: x in F}
Def 14b: [Identity Map on a set $S$] ident(S) := {[x,x]: x in S}
--
-- We define the notion of 'the enumerating ordinal of a set' by Skolemizing Theorem 46.
-- The formal definition is as follows.

APPLY(v1_thryvar:enum_Ord) Skolem() ==>
Theorem 47: [Enumeration single-valuedness principle] (FORALL s | (Ord(enum_Ord(s)) & (s = {enum(y,s): y in enum_Ord(s)}) &
		(FORALL y in enum_Ord(s), z0 in enum_Ord(s) | ((y /= z0) ¥imp (enum(y,s) /= enum(z0,s))))))

--
-- Using the preceding definition, we can define the Cardinality $#s$ of a set $s$
-- as the smallest ordinal in one-one correspondence with $s$. (The existence of such an ordinal
-- follows from the fact that the set $next(enum_Ord(s))$ must contain at least one such.)
--
Def 15: [Cardinality]
    Def(#S) := arb({x: x in next(enum_Ord(S)) | (EXISTS f in OM | (one_1_map(f) & (domain(f) = x) & (range(f) = S)))})
--
-- An ordinal $c$ is said to be a cardinal if it cannot be seen as the range of any
-- single valued map on a smaller ordinal. We shall see below that this
-- is equivalent to the condition that $c$ cannot be put into
-- 1-1 correspondence with any smaller ordinal.
--
Def 16: [Is-a-cardinal predicate]
 Card(C) := Ord(C) &
	(FORALL y in C, f in OM | (not(domain(f) = y) or not(range(f) = C) or not(Svm(f))))
--
-- In preparation with our work with cardinals we prove various small
-- utility lemmas having to do with map restrictions, single-valued maps, 1-1 maps,
-- map products and inverses, identity maps, etc.
--
-- The first of these simply says that a restriction of a map $f$ is a subset of $f$,
-- a fact immediate if we use proof by monotonicity.
--
Theorem 48: [Map restriction lemma] (F ¥ON A) ¥incin F. Proof:
	Suppose_not(f,a) ==> not((f ¥ON a) ¥incin f)
	Use_def(¥ON) ==> not({p: p in f | car(p) in a} ¥incin f)
    Set_monot ==> {p: p in f | car(p) in a} ¥incin {p: p in f}
    Discharge ==> QED
--
-- Next we note the even more elementary fact that the intersection
-- of two sets can be written as a setformer.
--
Theorem 49: [Set intersection formula] S * T = {x in S | x in T}. Proof:
Suppose_not(s,t) ==> Stat1: s * t /= {x in s | x in t}
	c-->Stat1 ==> ((c in s * t) & (c notin {x in s | x in t})) or ((c notin s * t) & (c in {x in s | x in t}))
	Suppose ==>  Stat2: (c notin {x in s | x in t}) & (c in s * t)
	c-->Stat2 ==> false; Discharge ==> Stat3: (c in {x in s | x in t}) & (c notin s * t)
()-->Stat3 ==> false; Discharge ==> QED
--
-- The existence of a similar setformer defining the difference of two sets is equally elementary.
--
Theorem 50: [Set difference formula] S - T = {x in S | x notin T}. Proof:
Suppose_not(s,t) ==> Stat1: s - t /= {x in s | x notin t}
	c-->Stat1 ==> (((c in s - t) & (c notin {x in s | x notin t})) or ((c notin s - t) & (c in {x in s | x notin t})))
	Suppose ==>  Stat2: (c notin {x in s | x notin t}) & (c in s - t)
	c-->Stat2 ==> false; Discharge ==> (c notin s - t) & Stat3: (c in {x in s | x notin t})
()-->Stat3 ==> false; Discharge ==> QED
--
-- Our next utility lemma puts the definition of the $Is_map$ predicate
-- into a sightly more convenient form by showing that every element of a map $f$ is a pair,
-- and that every set all of whose elements are pairs must be a map.
--
Theorem 51: [Map members are pairs] (Is_map(F) ¥imp ((X in F) ¥imp (X = [car(X),cdr(X)]))) &
		((FORALL x in F | x = [car(x),cdr(x)]) ¥imp Is_map(F)). Proof:
Suppose_not(f,x) ==>(Is_map(f) & (x in f) & (x /= [car(x),cdr(x)])) or
		(not((FORALL x in f | x = [car(x),cdr(x)]) ¥imp Is_map(f)))
--
-- We must consider one of two contrary cases. Start with the first,
-- in which a map has an element which is not a pair.
-- This is impossible by definition; only the second case need be considered.
--
	Suppose ==> Stat1: Is_map(f) & (x in f) & (x /= [car(x),cdr(x)])
		Use_def(Is_map) ==> Stat2: x in {[car(y),cdr(y)]: y in f}
		c-->Stat2(Stat2*) ==> Stat3: x = [car(c),cdr(c)]
		(Stat3)ELEM ==> (car(x) = car(c))
		(Stat3)ELEM ==> (cdr(x) = cdr(c))
		EQUAL(Stat3) ==> x = [car(x),cdr(x)]
	(Stat1*)Discharge ==> Stat4: not(Is_map(f))
--
-- In this second case we have a set of pairs, which by definition
-- differs from the collection of all pairs in it, another impossibility.
-- So our theorem is proved.
--
	f-->T26(Stat4) ==> Stat5: not(f ¥incin {[car(x),cdr(x)]: x in f}) & Stat6: (FORALL x in f | x = [car(x),cdr(x)])
	d-->Stat5(Stat5) ==> Stat7: (d in f) & Stat8: (d notin {[car(x),cdr(x)]: x in f})
	Suppose ==> Stat9: not(FORALL x in f | d /= [car(x),cdr(x)])
		dd-->Stat9(Stat9) ==> Stat10: (dd in f) & (d = [car(dd),cdr(dd)])
	dd-->Stat8(Stat10) ==> false; Discharge ==> Stat11: (FORALL x in f | d /= [car(x),cdr(x)])
	d-->Stat11(Stat7,Stat7) ==> Stat12: d /= [car(d),cdr(d)]
d-->Stat6(Stat7,Stat12) ==> false; Discharge ==> QED
--
-- As stated next, any subset of a map is a map.
-- Once more we have only to use the definition, and then monotonicity.
--
Theorem 52: [Map subsets are maps] (G ¥incin F & Is_map(F)) ¥imp Is_map(G). Proof:
    Suppose_not(g,f) ==> AUTO
    Suppose ==> Stat1: not(FORALL x in f | x = [car(x),cdr(x)])
    y-->Stat1 ==> AUTO
    (f,y)-->T51 ==> false; Discharge ==> AUTO
    (g,junk)-->T51 ==> (not(FORALL x in g | x = [car(x),cdr(x)]))
    Pred_monot ==> (FORALL x in f | x = [car(x),cdr(x)]) ¥imp (FORALL x in g | x = [car(x),cdr(x)])
    Discharge ==> QED
--
-- Similarly, any subset of a single-valued map is a single-valued map.
-- Again, the proof is by monotonicity.
--
Theorem 53: [Single-valued map subsets are single-valued] ((G ¥incin F) & Svm(F)) ¥imp Svm(G). Proof:
    Suppose_not(g,f) ==> (g ¥incin f) & Svm(f) & (not Svm(g))
    Use_def(Svm) ==> Is_map(f) & (FORALL x in f, y in f | ((car(x) = car(y)) ¥imp (x = y))) &
	(not(Is_map(g) & (FORALL x in g, y in g | ((car(x) = car(y)) ¥imp (x = y)))))
    (g,f)-->T52 ==> (not((FORALL x in g, y in g | ((car(x) = car(y)) ¥imp (x = y)))))
    Pred_monot ==> ((FORALL x in f, y in f | ((car(x) = car(y)) ¥imp (x = y)))) ¥imp
	(FORALL x in g, y in g | ((car(x) = car(y)) ¥imp (x = y)))
    Discharge ==> QED
--
-- Proof by monotonicity also suffices to show that any subset of a 1-1 map is also a 1-1 map.
--
Theorem 54: [One-one map subsets are one-one] ((G ¥incin F) & one_1_map(F)) ¥imp one_1_map(G). Proof:
Suppose_not(g,f) ==> (g ¥incin f) & one_1_map(f) & (not one_1_map(g))
	Use_def(one_1_map) ==> Svm(f) & (FORALL x in f, y in f | ((cdr(x) = cdr(y)) ¥imp (x = y))) &
		(not(Svm(g) & (FORALL x in g, y in g | ((cdr(x) = cdr(y)) ¥imp (x = y)))))
	(g,f)-->T53 ==> (not(FORALL x in g, y in g | ((cdr(x) = cdr(y)) ¥imp (x = y))))
	Pred_monot ==> (FORALL x in f, y in f | ((cdr(x) = cdr(y)) ¥imp (x = y))) ¥imp
		(FORALL x in g, y in g | ((cdr(x) = cdr(y)) ¥imp (x = y)))
Discharge ==> QED
--
-- To show that a map product is always a map, we have only to expand the definition and simplify.
--
Theorem 55: [Map compositions are maps] Is_map(F @ G). Proof:
Suppose_not(f,g) ==> not Is_map(f @ g)
	Use_def(@) ==> not Is_map({[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)})
	Use_def(Is_map) ==> {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)} /=
		{[car(u),cdr(u)]: u in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}}
	SIMPLF ==> {[car(u),cdr(u)]: u in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}} =
		{[car([car(x),cdr(y)]),cdr([car(x),cdr(y)])]: x in g, y in f | cdr(x) = car(y)}
	Set_monot ==>  {[car([car(x),cdr(y)]),cdr([car(x),cdr(y)])]: x in g, y in f | cdr(x) = car(y)} =
		{[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}
Discharge ==> QED
--
-- The next three theorems are simple corollaries of Theorem 48 and of Theorem 52, Theorem 53, and Theorem 54 respectively.
--
Theorem 56: [Map restrictions are maps] Is_map(F) ¥imp Is_map(F ¥ON S). Proof:
    Suppose_not(f,s) ==> Is_map(f) & (not Is_map(f ¥ON s))
    (f,s)-->T48 ==> (f ¥ON s) ¥incin f
    (f ¥ON s,f)-->T52 ==> false; Discharge ==> QED
--
Theorem 57: [Restrictions of single-valed maps are single-valued] Svm(F) ¥imp Svm(F ¥ON S). Proof:
    Suppose_not(f,s) ==> Svm(f) & (not Svm(f ¥ON s))
    (f,s)-->T48 ==> (f ¥ON s) ¥incin f
    (f ¥ON s,f)-->T53 ==> false; Discharge ==> QED
--
Theorem 58: [Restrictions of one-one maps are one-one] one_1_map(F) ¥imp one_1_map(F ¥ON S). Proof:
    Suppose_not(f,s) ==> AUTO
    (f,s)-->T48 ==> (f ¥ON s) ¥incin f
    (f ¥ON s,f)-->T54 ==> false; Discharge ==> QED
--
-- Next we note the elementary fact that the empty set is a single-valued map,
-- a 1-1 map, and that its domain and range are both the empty set.
--
Theorem 59: [The null set as a map] Is_map(0) & Svm(0) & (one_1_map(0)) & (range(0) = 0) & (domain(0) = 0). Proof:
    Suppose_not ==> AUTO
--
-- Indeed, all the facts follow immediately by application of our utility
-- $fcn_symbol$ THEORY to $0 = {[x,x]: x in 0}$.
--
    Use_def(Svm(0)) ==> AUTO
 --    Use_def(Svm) ==> Svm(0) ¥eq (Is_map(0) &
 --			(FORALL x in 0, y in 0 | ((car(x) = car(y)) ¥imp (x = y))))
    ELEM ==> not (Svm(0) & (one_1_map(0)) & (range(0) = 0) & (domain(0) = 0))
    Loc_def ==> g = {[x,x]: x in 0}
    APPLY(x9_thryvar:a,y9_thryvar:b) fcn_symbol(f(x)->x,g->g,s->0) ==>
		Svm(g) & (domain(g) = 0) & (range(g) = {x: x in 0}) & (((a in 0) & (b in 0)) or one_1_map(g))
    Suppose ==> Stat1: not(FORALL x in 0, y in 0 | ((x = x) ¥imp (x = y)))
    c-->Stat1 ==> false; Discharge ==> one_1_map(g)
    Set_monot ==> {x: x in 0} = {[x,x]: x in 0}
    Set_monot ==> 0 = {x: x in 0}
    EQUAL ==> Svm(0) & (domain(0) = 0) & (range(0) = 0) & one_1_map(0)
    Discharge ==> QED
--
-- Next we state two entirely elementary facts concerning the range and domain of a map $f$:
-- for each $x in f$, $car(x)$ is in $domain(f)$ and $cdr(x)$ is in $range(f)$.
--
Theorem 60: [Domain membership lemma] (X in F) ¥imp (car(X) in domain(F)). Proof:
    Suppose_not(c,f) ==> AUTO
    Use_def(domain) ==> Stat1: not car(c) in {car(x): x in f}
    c-->Stat1 ==> AUTO
    Discharge ==> QED
--
Theorem 61: [Range membership lemma] (X in F) ¥imp (cdr(X) in range(F)). Proof:
    Suppose_not(c,f) ==> AUTO
    Use_def(range) ==> Stat1: not(cdr(c) in {cdr(x): x in f})
    c-->Stat1 ==> AUTO
    Discharge ==> QED
--
-- It is also an elementary consequence of the definition that the union of two maps is a map.
--
Theorem 62: [Map unions are maps] (Is_map(F) & Is_map(G)) ¥imp Is_map(F + G). Proof:
    Suppose_not(f,g) ==> AUTO
    Use_def(Is_map) ==> (f = {[car(x),cdr(x)]: x in f}) & (g = {[car(x),cdr(x)]: x in g}) &
	(f + g /= {[car(x),cdr(x)]: x in f + g})
    Set_monot ==> {[car(x),cdr(x)]: x in f + g} = {[car(x),cdr(x)]: x in f} + {[car(x),cdr(x)]: x in g}
    Discharge ==> QED
--
-- Next we show that the map restriction operation is additive in its second argument.
-- Again, this is an entirely elementary consequence of the definition, by set monotonicity.
--
Theorem 63: [Map restriction is additive] F ¥ON (A + B) = (F ¥ON A) + (F ¥ON B). Proof:
Suppose_not(f,a,b) ==> AUTO
	Use_def(¥ON) ==>
		{p in f | car(p) in a + b} /= {p in f | car(p) in a} + {p in f | car(p) in b}
	Set_monot ==> {p in f | car(p) in a + b} = {p in f | (car(p) in a) or (car(p) in b)}
	Set_monot ==> {p in f | (car(p) in a) or (car(p) in b)} = {p in f | car(p) in a} + {p in f | car(p) in b}
Discharge ==> QED
--
-- The map restriction operation is also additive in its first argument
-- the argument being similar and equally elementary.
--
Theorem 64: [Restriction of union maps] (F + G) ¥ON A = (F ¥ON A) + (G ¥ON A). Proof:
Suppose_not(f,g,a) ==> ((f + g) ¥ON a) /= (f ¥ON a) + (g ¥ON a)
	Use_def(¥ON) ==> {p in (f + g) | car(p) in a} /= {p in f | car(p) in a} + {p in g | car(p) in a}
	Set_monot ==> {p in (f + g) | car(p) in a} = {p in f | car(p) in a} + {p in g | car(p) in a}
Discharge ==> QED
--
-- The fact that the range and domain of a map $f$ are both monotone increasing functions of $f$
-- also follows immediately by set monotonicity.
--
Theorem 65: [Monotonicity of range and domain sets] (F ¥incin G) ¥imp ((range(F) ¥incin range(G)) & (domain(F) ¥incin domain(G))). Proof:
Suppose_not(f,g) ==> (f ¥incin g) & (not((range(f) ¥incin range(g)) & (domain(f) ¥incin domain(g))))
	Suppose ==> not(range(f) ¥incin range(g))
	Use_def(range) ==> not({cdr(x): x in f} ¥incin {cdr(x): x in g})
	Set_monot ==> {cdr(x): x in f} ¥incin {cdr(x): x in g}
	Discharge ==> not(domain(f) ¥incin domain(g))
	Use_def(domain) ==> not({car(x): x in f} ¥incin {car(x): x in g})
	Set_monot ==> {car(x): x in f} ¥incin {car(x): x in g}
Discharge ==> QED
--
-- Our next theorem states the important but elementary fact that map composition is associative.
--
Theorem 66: [Associativity of map multiplication] F @ (G @ H) = (F @ G) @ H. Proof:
Suppose_not(f,g,h) ==> f @ (g @ h) /= (f @ g) @ h
	Use_def(@) ==> f @ (g @ h) = {[car(x),cdr(v)]: x in {[car(x),cdr(y)]: x in h, y in g | cdr(x) = car(y)}, v in f | cdr(x) = car(v)}
	Use_def(@) ==> (f @ g) @ h = {[car(x),cdr(y)]: x in h, y in {[car(y),cdr(v)]: y in g, v in f | cdr(y) = car(v)} | cdr(x) = car(y)}
	ELEM ==> {[car(x),cdr(v)]: x in {[car(x),cdr(y)]: x in h, y in g | cdr(x) = car(y)}, v in f | cdr(x) = car(v)} /=
		 {[car(x),cdr(y)]: x in h, y in {[car(y),cdr(v)]: y in g, v in f | cdr(y) = car(v)} | cdr(x) = car(y)}
--
-- For if not, simplification after using the definition of map composition
-- gives us the following inequality, and so the elementary inequality seen just below it.
-- But since this is impossible our lemma follows.
--
	SIMPLF ==> Stat1: {[car([car(x),cdr(y)]),cdr(v)]: x in h, y in g, v in f | (cdr(x) = car(y)) & (cdr([car(x),cdr(y)]) = car(v))} /=
			  {[car(x),cdr([car(y),cdr(v)])]: x in h, y in g , v in f | (cdr(y) = car(v)) & (cdr(x) = car([car(y),cdr(v)]))}
	(x,y,v)-->Stat1 ==> ([car([car(x),cdr(y)]),cdr(v)] /= [car(x),cdr([car(y),cdr(v)])]) or
	(not(((cdr(x) = car(y)) & (cdr([car(x),cdr(y)]) = car(v))) ¥eq ((cdr(y) = car(v)) & (cdr(x) = car([car(y),cdr(v)])))))
Discharge ==> QED
--
-- Now we show that the restriction of a map $f$ to its own domain is simply $f$.
--
Theorem 67: [Restriction of a map to its own domain] F ¥ON domain(F) = F. Proof:
    Suppose_not(f) ==> not((f ¥ON domain(f)) = f)
--
-- For if not, it follows by Theorem 48 that there must be
-- some element $a in f$ which is not in ${p in f | car(p) in domain(f)}$,
-- which is clearly impossible by Theorem 60.
--
    (f,domain(f))-->T48 ==> (f ¥ON domain(f)) ¥incin f
    ELEM ==> not((f ¥ON domain(f)) incs f)
    Use_def(¥ON) ==> Stat1: not({p in f | car(p) in domain(f)} incs f)
    (a)-->Stat1 ==> (a in f) & Stat2: (not(a in {p in f | car(p) in domain(f)}))
    (a)-->Stat2 ==> car(a) notin domain(f)
    (a,f)-->T60 ==> false; Discharge ==> QED
--
-- The following easy lemma generalizes the fact that the restriction of any map $f$
-- to its own domain is $f$ itself.
--
Theorem 68: [Restriction to an intersection set] F ¥ON (domain(F) * T) = F ¥ON T. Proof:
    Suppose_not(f,t) ==> f ¥ON (domain(f) * t) /= f ¥ON t
--
-- For if not, the additivity of map restriction would imply that
-- $f ¥ON (t - domain(f)) /= 0$, which is easily seen to be imposible.
--
    TELEM ==> t = (domain(f) * t) + (t - domain(f))
    EQUAL ==> f ¥ON t = f ¥ON ((domain(f) * t) + (t - domain(f)))
    (f,(domain(f) * t), (t - domain(f)))-->T63 ==> f ¥ON (t - domain(f)) /= 0
    Use_def(¥ON) ==> Stat1: {p in f | car(p) in (t - domain(f))} /= 0
    a-->Stat1 ==> (a in f) & (car(a) in (t - domain(f)))
    (a,f)-->T60 ==> false; Discharge ==> QED
--
-- The preceding lemma can be put more generally.
--
Theorem 69: [Double restriction] F ¥ON (S * T) = (F ¥ON S) ¥ON T. Proof:
    Suppose_not(f,s,t) ==> f ¥ON (s * t) /= (f ¥ON s) ¥ON t
	Use_def(¥ON) ==> f ¥ON s = {q in f | car(q) in s}
 	Use_def(¥ON) ==> (f ¥ON s) ¥ON t = {p in {q in f | car(q) in s} | car(p) in t}
 	SIMPLF ==> (f ¥ON s) ¥ON t = {q in f | (car(q) in t) & (car(q) in s)}
 	Use_def(¥ON) ==> (f ¥ON (s * t)) = {q in f | car(q) in s * t}
 	ELEM ==> not(({q in f | (car(q) in t) & (car(q) in s)} ¥incin {q in f | car(q) in s * t}) & ({q in f | (car(q) in t) & (car(q) in s)} incs {q in f | car(q) in s * t}))
 	Suppose ==> Stat1: not({q in f | (car(q) in t) & (car(q) in s)} ¥incin {q in f | car(q) in s * t})
 	c-->Stat1 ==> (c in f) & (car(c) in t) & (car(c) in s) & (car(c) notin s * t)
 	ELEM ==> false; Discharge ==> Stat2: not({q in f | (car(q) in t) & (car(q) in s)} incs {q in f | car(q) in s * t})
  	c1-->Stat1 ==> (c1 in f) & (not((car(c1) in t) & (car(c1) in s))) & (car(c1) in s * t)
  	Discharge ==> QED
--
-- The following triviality is sometimes useful.
Theorem 70: [Null restriction] F ¥ON 0 = 0. Proof:
    Suppose_not(f) ==> AUTO
	Use_def(¥ON) ==> Stat1: {q in f | car(q) in 0} /= 0
	c-->Stat1 ==> false; Discharge ==> QED
--
-- The following theorem tells us that, as we have defined it,
-- the map value $f~[x]$ always belongs to the range of $f$,
-- provided that $x$ belongs to the domain of $f$;
-- this is true even if $f$ is not single-valued, or even if $f$ is not a map.
--
Theorem 71: [Map image elements belong to the map range] (X in domain(F)) ¥imp ((F~[X]) in range(F)). Proof:
    Suppose_not(x,f) ==> (x in domain(f)) & (not((f~[x]) in range(f)))
--
-- For if not, then by definition there must be some $c in f$
-- such that $cdr(arb({p in f | car(p) in {car(c)}}))$ does not belong to ${cdr(y): y in f}$.
--
    Use_def(range) ==> not((f~[x]) in {cdr(y): y in f})
    Use_def(~) ==> not(cdr(arb(f ¥ON {x})) in {cdr(y): y in f})
    Use_def(¥ON) ==> Stat1: cdr(arb({p in f | car(p) in {x}})) notin {cdr(y): y in f}
    Use_def(domain) ==> Stat2: x in {car(y): y in f}
    c-->Stat2 ==> (x = car(c)) & (c in f)
--
-- But $c$ clearly belongs to the set ${p in f | car(p) in {car(c)}}$,
-- which is therefore nonempty, from which it follows by the axiom of choice
-- that $arrb := arb({p in f | car(p) in {x}})$ belongs to this same set.
--
    Suppose ==> Stat3: not(c in {p in f | car(p) in {x}})
    Suppose ==> Stat4: not(FORALL p in f | ((car(p) in {x}) ¥imp (p /= c)))
    q-->Stat4 ==> (q in f) & (car(q) in {x}) & (q = c)
    q-->Stat3 ==>  false; Discharge ==> Stat5: (FORALL p in f | ((car(p) in {x}) ¥imp (p /= c)))
    c-->Stat5 ==> (car(c) in {x}) ¥imp (c /= c)
    Discharge ==> c in {p in f | car(p) in {x}}
    ({p in f | car(p) in {x}})-->T0 ==> arb({p in f | car(p) in {x}}) in {p in f | car(p) in {x}}
--
-- Hence $arrb$ must belong to the larger set $f$. By Stat1, this implies
-- the impossible inequality seen below, proving our theorem.
--
    Set_monot ==> {p in f | car(p) in {x}} ¥incin {p: p in f}
    ELEM ==> arb({p in f | car(p) in {x}}) in {p: p in f}
    SIMPLF ==> arb({p in f | car(p) in {x}}) in f
    (arb({p in f | car(p) in {x}}))-->Stat1 ==>
	cdr(arb({p in f | car(p) in {x}})) /= cdr(arb({p in f | car(p) in {x}}))
    Discharge ==> QED
--
-- It is convenient to summarize some of the key results derived above
-- in the following auxiliary THEORY, which specializes them and eases their use.
-- We focus on maps of the form ${[x,f(x)]: x in s}$, which are always single-valued.
--
THEORY fcn_symbol(f(x),g,s)  [Contains some elementary lemmas about single-valued functions]
     g = {[x,f(x)]: x in s}
END fcn_symbol;
--
ENTER_THEORY fcn_symbol

-- Note: till we return from 'fcn_symbol' to set theory, we are
--	reasoning within the theory, so $g = {[x,f(x)]: x in s}$ is available
--	as an axiom, and all theorems proved are added to the set
--	of conclusions of the theory, rather than to the set of conclusions
--	of the top-level set-theory.

--
-- First we show that the domain of $g$ is simply $s$.
--
Theorem fcn_symbol.1: [Mapformer domain] domain(g) = s. Proof:
    Suppose_not ==> domain(g) /= s
--
-- For in the contrary case we would have ${car(x): x in {[x,f(x)]: x in s}} /= s$
-- by definition, so there would exist an $x in s$ such that $car([x,f(x)]) /= x$,
-- which is impossible.
--
    Use_def(domain) ==> {car(x): x in g} /= s
    Assump ==> g = {[y,f(y)]: y in s}
    EQUAL ==> {car(x): x in g} = {car(x): x in {[y,f(y)]: y in s}}
    ELEM ==> {car(x): x in {[y,f(y)]: y in s}} /= s
	SIMPLF ==> {car([y,f(y)]): y in s} /= {x: x in s}
	Set_monot ==> {car([y,f(y)]): y in s} = {y: y in s}
    Discharge ==> QED
--
-- Next we show that $g~[x] = f(x)$ for any $x in s$.
--
Theorem fcn_symbol.2: [Image by a mapformer] (XX in s) ¥imp (g~[XX] = f(XX)). Proof:
    Suppose_not(c) ==> (c in s) & (g~[c] /= f(c))
--
-- For suppose not, and let $c in s$ be a counterexample, so that by definition
-- of functional application (and map restriction) we would have
-- $cdr(arb({[x,f(x)]: x in s | car([x,f(x)]) in {c}})) /= f(c)$.
--
    Use_def(~) ==> cdr(arb(g ¥ON {c})) /= f(c)
    Use_def(¥ON) ==> cdr(arb({p in g | car(p) in {c}})) /= f(c)
    Assump ==> g = {[x,f(x)]: x in s}
	EQUAL ==> cdr(arb({p in {[x,f(x)]: x in s} | car(p) in {c}})) /= f(c)
	SIMPLF ==> cdr(arb({[x,f(x)]: x in s | car([x,f(x)]) in {c}})) /= f(c)
--
-- We can simplify ${[x,f(x)]: x in s | car([x,f(x)]) in {c}}$ to ${[x,f(x)]: x in s | x in {c}}$,
-- for if these sets were different there would be a $d in s$ such that the conditions
-- $car([d,f(d)]) in {c}$ and $d in c$ were inequivalent, which is impossible.
--
	Suppose ==> Stat1: {[x,f(x)]: x in s | car([x,f(x)]) in {c}} /= {[x,f(x)]: x in s | x in {c}}
	d-->Stat1 ==> (d in s) & (not ((car([d,f(d)]) in {c}) ¥eq (d in {c})))
	Discharge ==> {[x,f(x)]: x in s | car([x,f(x)]) in {c}} = {[x,f(x)]: x in s | x in {c}}
--
-- But ${[x,f(x)]: x in s | x in {c}}$ simplifies in two steps to ${[x,f(x)]: x in {c}}$,
-- which is the same as ${[c,f(c)]}$. Hence if our theorem is false we would have
-- $cdr(arb({[c,f(c)]})) /= f(c)$, a contradiction proving the theorem.
--
	Suppose ==> Stat2: {[x,f(x)]: x in s | x in {c}} /= {[x,f(x)]: x in {c}}
	e-->Stat2 ==> ((e in {[x,f(x)]: x in s | x in {c}}) & (e notin {[x,f(x)]: x in {c}})) or
		((e notin {[x,f(x)]: x in s | x in {c}}) & (e in {[x,f(x)]: x in {c}}))
	Suppose ==> Stat3: (e in {[x,f(x)]: x in s | x in {c}}) & Stat4: (e notin {[x,f(x)]: x in {c}})
	e1-->Stat3 ==> (e = [e1,f(e1)]) & (e1 in s) & (e1 in {c})
	e1-->Stat4 ==> false; Discharge ==> Stat5: (e notin {[x,f(x)]: x in s | x in {c}}) & Stat6: (e in {[x,f(x)]: x in {c}})
	e2-->Stat6 ==> (e = [e2,f(e2)]) & (e2 in {c})
	e2-->Stat5 ==> false; Discharge ==> {[x,f(x)]: x in s | x in {c}} = {[x,f(x)]: x in {c}}
	SIMPLF ==> {[x,f(x)]: x in {c}} = {[c,f(c)]}
	EQUAL ==> cdr(arb({[c,f(c)]})) /= f(c)
	Discharge ==> QED
--
-- We reformulate the preceding theorem in quantified form.
--
Theorem fcn_symbol.2a: [Image by a mapformer, quantified form] (FORALL x in s | g~[x] = f(x)). Proof:
	Suppose_not ==> Stat1: AUTO
	x-->Stat1 ==> (x in s) & (g~[x] /= f(x))
	x-->Tfcn_symbol.2 ==> false; Discharge ==> QED
--
-- Our next theorem rounds out the preceding result by showing that $g~[x] = 0$ for $x notin s$.
--
Theorem fcn_symbol.3: [Elements not in a mapformer domain] (XX notin s) ¥imp (g~[XX] = 0). Proof:
    Suppose_not(c) ==> Stat1: ((c notin s) & g~[c] /= 0)
--
-- For suppose not, and let $c$ in $s$ be a counterexample. Then by definition
-- of functional application (and map restriction) the value
-- $arb({[x,f(x)]: x in s | car([x,f(x)]) in {c}})$ must be nonzero,
-- and then by the axiom of choice so is the set ${[x,f(x)]: x in s | car([x,f(x)]) in {c}}$.
--
    Use_def(~) ==> (c notin s) & cdr(arb(g ¥ON {c})) /= 0
    Suppose ==>  arb(g ¥ON {c}) = 0
        EQUAL ==> cdr(0) /= 0
        Use_def(cdr) ==> arb(arb(arb(0 - {arb(0)}) - {arb(0)})) /= 0
        TELEM ==> 0 - {arb(0)} = 0
        EQUAL ==> arb(arb(arb(0) - {arb(0)})) /= 0
        0-->T0(*) ==> arb(0) = 0
        TELEM ==> arb(0) - {arb(0)} = 0
        EQUAL ==> arb(arb(0)) /= 0
        EQUAL ==> arb(0) /= 0
    EQUAL ==> false; Discharge ==> arb(g ¥ON {c}) /= 0
    Use_def(¥ON) ==> (g ¥ON {c}) = {p in g | car(p) in {c}}
    EQUAL ==> arb({p in g | car(p) in {c}}) /= 0
    Assump ==> g = {[x,f(x)]: x in s}
    EQUAL ==> arb({p in {[x,f(x)]: x in s} | car(p) in {c}}) /= 0
    SIMPLF ==> Stat2: arb({[x,f(x)]: x in s | car([x,f(x)]) in {c}}) /= 0
    {[x,f(x)]: x in s | car([x,f(x)]) in {c}}-->T0(Stat2*) ==>
    				Stat3: {[x,f(x)]: x in s | car([x,f(x)]) in {c}} /= 0
--
-- Hence there would exist a $d in s$ such that $car([d,f(d)]) in {c}$, implying $c in s$,
-- a contradiction which proves our assertion.
--
    d-->Stat3() ==> Stat4: (d in s) & (car([d,f(d)]) in {c})
    (Stat1,Stat4)Discharge ==> QED
--
-- The following result summarizes the two which precede it.
--
Theorem fcn_symbol.4: [Mapformer image in general] g~[XX] = if XX in s then f(XX) else 0 end if. Proof:
    Suppose_not(c) ==> g~[c] /= if c in s then f(c) else 0 end if
	c-->Tfcn_symbol.3 ==> c in s
	c-->Tfcn_symbol.2 ==> false; Discharge ==> QED
--
-- We reformulate the preceding theorem in quantified form.
--
Theorem fcn_symbol.4a: [Image by a mapformer, quantified form] (FORALL x | g~[x] = if x in s then f(x) else 0 end if). Proof:
	Suppose_not ==> Stat1: AUTO
	x-->Stat1 ==> g~[x] /= if x in s then f(x) else 0 end if
	(g,x)-->Tfcn_symbol.4 ==> false; Discharge ==> QED
--
-- It is easy to derive the following formula for the range of a map $g$:
--
Theorem fcn_symbol.5: [Range of a mapformer] range(g) = {f(xx) : xx in s}. Proof:
Suppose_not ==> range(g) /= {f(x) : x in s}
--
-- For if not, it follows by definition of range that
-- ${cdr([x,f(x)]): x in s} /= {f(x) : x in s}$,
-- implying the existence of an x such that $cdr([x,f(x)]) /= f(x)$,
-- which is impossible.
--
	Use_def(range) ==> range(g) = {cdr(x): x in g}
	Assump ==> g = {[x,f(x)]: x in s}
	EQUAL ==> {cdr(x): x in {[x,f(x)]: x in s}} /= {f(x) : x in s}
	SIMPLF ==> {cdr([x,f(x)]): x in s} /= {f(x) : x in s}
	Set_monot ==> {cdr([x,f(x)]): x in s} = {f(x) : x in s}
Discharge ==> QED
--
-- And it is also easy to derive the following criterion for a map $g$ to be 1-1:
--
Def fcn_symbol.0a: [Witness to non-singlevaluedness of map inverse] xy7_thryvar := arb({[xx,yy]: xx in s, yy in s | (f(xx) = f(yy)) & (xx /= yy)})
Def fcn_symbol.0b: [First component of witness to non-singlevaluedness of map inverse] x9_thryvar := car(xy7_thryvar)
Def fcn_symbol.0c: [Second component of witness to non-singlevaluedness of map inverse] y9_thryvar := cdr(xy7_thryvar)
--
Theorem fcn_symbol.6: [Mapformer one-to-oneness test] ((x9_thryvar in s) & (y9_thryvar in s) & (f(x9_thryvar) = f(y9_thryvar)) & (x9_thryvar /= y9_thryvar)) or
					 one_1_map(g). Proof:
    Suppose_not ==> (not((x9_thryvar in s) & (y9_thryvar in s) & (f(x9_thryvar) = f(y9_thryvar)) & (x9_thryvar /= y9_thryvar))) &
    							(not one_1_map(g))
--
-- For if not, then it easily follows using our previously derived $one_1_test$ THEORY
-- that the set ${[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)}$ must be non-null,
-- so that by the axiom of choice and the definition of $x9_thryvar$, $y9_thryvar$
-- the pair $x9_thryvar,y9_thryvar$ must belong to it.
--
	APPLY(x6_thryvar:x,y6_thryvar:y) one_1_test(a(x)->x,b(x)->f(x),s->s) ==>
			((x in s) & (y in s) & (not((x = y) ¥eq (f(x) = f(y))))) or one_1_map({[x,f(x)]: x in s})
      Assump ==> g = {[x,f(x)]: x in s}
	EQUAL ==> not one_1_map({[x,f(x)]: x in s})
	Suppose ==> Stat1: {[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)} = 0
	    (x,y)-->Stat1 ==> not((x in s) & (y in s) & (f(x) = f(y)) & (x /= y))
          Suppose ==> x = y
              EQUAL ==> f(x) = f(y)
          Discharge ==> x /= y
	ELEM ==> false; Discharge ==> {[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)} /= 0
	({[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)})-->T0 ==>
	arb({[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)}) in {[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)}
	Use_def(xy7_thryvar) ==>	Stat2: xy7_thryvar in {[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)}
--
-- Hence there must exist elements $xx$ and $yy$ satisfying the condition seen below,
-- and since it is easily seen that these must be the two components $x9_thryvar$, $y9_thryvar$ of $xy7_thryvar$,
-- we have a contradiction with our hypothesis and so a proof of our assertion.
--
	(xx,yy)-->Stat2 ==> (xx in s) & (yy in s) & (xy7_thryvar = [xx,yy]) & (f(xx) = f(yy)) & (xx /= yy)
	ELEM ==> (xx = car(xy7_thryvar)) & (yy = cdr(xy7_thryvar))
    Use_def(x9_thryvar) ==> x9_thryvar = xx
    Use_def(y9_thryvar) ==> y9_thryvar = yy
    EQUAL ==> false; Discharge ==> QED
--
-- It follows immediately using our previously derived $Svm_test$ THEORY that $g$ must be single-valued.
--
 Theorem fcn_symbol.7: [?] Svm(g). Proof:
    Suppose_not ==> not Svm(g)
    APPLY(x3_thryvar:x,y3_thryvar:y) Svm_test(a(x)->x,b(x)->f(x),s->s) ==> (((x = y) & (f(x) /= f(y))) or Svm({[x,f(x)]: x in s}))
    Assump ==> g = {[x,f(x)]: x in s}
    EQUAL ==> (((x = y) & (f(x) /= f(y))) or Svm(g))
    ELEM ==> (x = y) & (f(x) /= f(y))
    EQUAL ==> false; Discharge ==> QED
--

ENTER_THEORY Set_theory
-- Note: this exits the subtheory 'fcn_symbol', and re-enters the main Set_theory.

-- Note: if we used 'DISPLAY fcn_symbol' at this point, the result would be as follows:
--
--DISPLAY fcn_symbol
--
--THEORY fcn_symbol(f(x),g,s)
--     g = {[x,f(x)]: x in s}
--==>(x9_thryvar,y9_thryvar)
--    domain(g) = s
--    (FORALL x | (x in s) ¥imp (g~[x] = f(x)))
--    (FORALL x | (x notin s) ¥imp (g~[x] = 0))
--    (FORALL x | g~[x] = if x in s then f(x) else 0 end if)
--    range(g) = {f(x) : x in s}
--   ((x9_thryvar in s) & (y9_thryvar in s) & (f(x9_thryvar) = f(y9_thryvar)) & (x9_thryvar /= y9_thryvar)) or
--								 one_1_map(g)
--    Svm(g)
--END fcn_symbol;

--
-- Single valued maps can always be represented in the convenient form
-- required by the preceding theory and repeated in the following theorem.
-- Conversely, the preceding theory tells us that any set of this form is a single-valued map.
--
Theorem 72: [Form of a single-valued map] Svm(F) ¥eq (F = {[x,F~[x]]: x in domain(F)}). Proof:
    Suppose_not(f) ==> (Svm(f) & (f /= {[x,f~[x]]: x in domain(f)})) or
						((not Svm(f)) & (f = {[x,f~[x]]: x in domain(f)}))
--
-- For the preceding theory tells us that ${[x,f~[x]]: x in domain(f)}$
-- is single valued, leaving only the first of the two above contrary possibilities.
--
    Suppose ==> Stat1: (not Svm(f)) & (f = {[x,f~[x]]: x in domain(f)})
    APPLY() fcn_symbol(f(x)->f~[x],g->f,s->domain(f)) ==> Svm(f)
    (Stat1)Discharge ==> Svm(f) & (f /= {[x,f~[x]]: x in domain(f)})
--
-- By definition of domain, map application, and map restriction,
-- the preceding inequality simplifies to
-- $f /= {[car(y),cdr(arb({u in f | car(u) in {car(y)}}))]: y in f}$.
--
    Use_def(domain) ==> f /= {[x,f~[x] ]: x in {car(y): y in f}}
    SIMPLF ==> f /= {[car(y),f~[car(y)]]: y in f}
    Use_def(~) ==> f /= {[car(y),cdr(arb(f ¥ON {car(y)}))]: y in f}
    Use_def(¥ON) ==> f /= {[car(y),cdr(arb({u in f | car(u) in {car(y)}}))]: y in f}
--
-- Since $f$ is a single-valued map and hence a map, this implies the inequality seen below:
--
    Use_def(Svm) ==> Is_map(f) & Stat2: (FORALL x in f, y1 in f | ((car(x) = car(y1)) ¥imp (x = y1)))
    Use_def(Is_map) ==> f = {[car(y),cdr(y)]: y in f}
    EQUAL ==> Stat3: {[car(y),cdr(y)]: y in f} /= {[car(y),cdr(arb({u in f | car(u) in {car(y)}}))]: y in f}
--
-- Hence there must exist a $y in f$ for which $cdr(y)$ and $cdr(arb({u in f | car(u) in {car(y)}}))$
-- are different,
--
	y-->Stat3 ==> Stat4: (y in f) & ([car(y),cdr(y)] /= [car(y),cdr(arb({u in f | car(u) in {car(y)}}))])
--
-- But it is easily seen that ${u in f | car(u) in {car(y)}} = {y}$.
--
	Suppose ==> Stat5: {u in f | car(u) in {car(y)}} /= {y}
	d-->Stat5(*) ==> Stat6: not((d in {u in f | car(u) in {car(y)}}) ¥eq (d in {y}))
	Set_monot ==> {u in f | car(u) in {car(y)}} = {u in f | car(u) = car(y)}
	(Stat6*)ELEM ==> not((d in {u in f | car(u) = car(y)}) ¥eq (d = y))
	Suppose ==> Stat7: (d = y) & Stat8: (d notin {u in f | car(u) = car(y)})
	d-->Stat8(Stat7,Stat4) ==> false; Discharge ==> Stat9: d in {u in f | car(u) = car(y)}
	()-->Stat9() ==> (d in f) & (car(d) = car(y))
	(d,y)-->Stat2 ==> false; Discharge ==> {u in f | car(u) in {car(y)}} = {y}
	EQUAL ==> Stat10: {[car(y),cdr(y)]: y in f} /= {[car(y),cdr(arb({y}))]: y in f}
	e-->Stat10 ==> false; Discharge ==> QED
--
-- The following corollary simply adds the formula for $range(f)$ to the preceding result.
--
Theorem 73: [Form of a single-valued map range] Svm(F) ¥imp (F = {[x,F~[x]]: x in domain(F)} & (range(F) = {F~[x]: x in domain(F)})). Proof:
    Suppose_not(f) ==> Svm(f) & (not((f = {[x,f~[x]]: x in domain(f)}) & (range(f) = {f~[x]: x in domain(f)})))
    f-->T72 ==> (f = {[x,f~[x]]: x in domain(f)}) & (range(f) /= {f~[x]: x in domain(f)})
    Use_def(range) ==> {cdr(x): x in f} /= {f~[x]: x in domain(f)}
    EQUAL ==> {cdr(x): x in {[x,f~[x]]: x in domain(f)}} /= {f~[x]: x in domain(f)}
    SIMPLF ==> Stat1: {cdr([x,f~[x]]): x in domain(f)} /= {f~[x]: x in domain(f)}
    x-->Stat1 ==> cdr([x,f~[x]]) /= f~[x]
    Discharge ==> QED
--
-- The following is a variant of Theorem 72.
--
Theorem 74: [Map image formula] (Svm(F) & (X in F)) ¥imp (F~[car(X)] = cdr(X)). Proof:
    Suppose_not(f,a) ==> AUTO
--
-- For if our theorem is false, then by Theorem 72 there is an $a$ in ${[car(x),f~[car(x)]]: x in f}$
-- such that $f~[car(a)] /= cdr(a)$.
--
    f-->T72 ==> a in {[x,f~[x]]: x in domain(f)}
    Use_def(domain) ==> a in {[x,f~[x]]: x in {car(x): x in f}}
    SIMPLF ==> Stat1: a in {[car(x),f~[car(x)]]: x in f}
--
-- Such an $a$ must have the form $[car(b),f~[car(b)]]$ where $b in f$, so that $car(a) = car(b)$;
-- but then, since $f$ is single valued, we must have $a = b$, so$ cdr(a) = f~[car(a)]$.
--
    b-->Stat1 ==> AUTO
    ELEM ==> car(a) = car(b)
    Use_def(Svm) ==> Stat2: (FORALL x in f, y in f | ((car(x) = car(y)) ¥imp (x = y)))
    (a,b)-->Stat2 ==> a = b
    EQUAL ==> f~[car(b)] = f~[car(a)]
    Discharge ==> QED
--
-- The following elementary lemma, related to that just stated, is sometimes useful.
--
 Theorem 75: (X in domain(F)) ¥imp (F~[X] in range(F)). Proof:
	Suppose_not(x,f) ==> AUTO
	Use_def(domain) ==> Stat1: x in {car(y): y in f}
	y-->Stat1 ==> (x = car(y)) & (y in f)
	Use_def(~) ==> f~[x] = cdr(arb(f ¥ON {x}))
	Use_def(¥ON) ==> arb(f ¥ON {x}) = arb({u in f | car(u) in {x}})
	Suppose ==> Stat2: y notin {u in f | car(u) in {x}}
	y-->Stat2 ==> false; Discharge ==> {u in f | car(u) in {x}} /= 0
	({u in f | car(u) in {x}})-->T0 ==> Stat3: arb(f ¥ON {x}) in {u in f | car(u) in {x}}
	()-->Stat3 ==> arb(f ¥ON {x}) in f
	Suppose ==> cdr(arb(f ¥ON {x})) notin range(f)
	Use_def(range) ==> Stat4: cdr(arb(f ¥ON {x})) notin {cdr(y): y in f}
	(arb(f ¥ON {x}))-->Stat4 ==> false; Discharge ==> cdr(arb(f ¥ON {x})) in range(f)
	Discharge ==> QED
--
-- The following lemma simply states the elementary fact that every element of a map is a pair.
--
Theorem 76: [Map members are pairs, 2] (Is_map(F) & (U in F)) ¥imp (U = [car(U),cdr(U)]). Proof:
    Suppose_not(g,u) ==> Is_map(g) & (u in g) & (u /= [car(u),cdr(u)])
    Use_def(Is_map) ==> Stat1: u in {[car(x),cdr(x)]: x in g}
    a-->Stat1 ==> (a in g) & (u = [car(a),cdr(a)])
    EQUAL ==> Stat2: ([car(a),cdr(a)] /= [car([car(a),cdr(a)]),cdr([car(a),cdr(a)])])
    (Stat2)Discharge ==> QED
--
-- The following is another lemma sometimes useful in connection with maps.
--
Theorem 77: [Map domain member lemma] Is_map(F) ¥imp ((X in domain(F)) ¥eq ([X,F~[X]] in F)). Proof:
    Suppose_not(f,x) ==> Is_map(f) & (not((x in domain(f)) ¥eq ([x,f~[x]] in f)))
--
-- For suppose the contrary, and first consider the case $x in domain(f)$,
-- so that there exists a $y in f$ such that $x = car(y)$.
--
	Suppose ==> (x in domain(f)) & ([x,f~[x]] notin f)
	Use_def(domain) ==> Stat1: (x in {car(y): y in f}) & ([x,f~[x]] notin f)
	y-->Stat1 ==> (x = car(y)) & (y in f)
--
-- By definition of the operators involved, $f~[x] is cdr(yy)$ for some $yy in f$
-- such that $car(yy) = x$.
--
	Use_def(~) ==> f~[x] = cdr(arb(f ¥ON {x}))
	Use_def(¥ON) ==> f~[x] = cdr(arb({u: u in f | car(u) in {x}}))
	Suppose ==> Stat2: y notin {u: u in f | car(u) in {x}}
	y-->Stat2 ==> false; Discharge ==> y in {u: u in f | car(u) in {x}}
	{u: u in f | car(u) in {x}}-->T0 ==>
	Stat3: arb({u: u in f | car(u) in {x}}) in {u: u in f | car(u) in {x}}
	yy-->Stat3 ==> (arb({u: u in f | car(u) in {x}}) = yy) & (yy in f) & (car(yy) = x)
	EQUAL ==> (f~[x] = cdr(yy)) & (yy in f) & (car(yy) = x)
--
-- But by Theorem 76, this implies that $yy notin f$, a contradiction which excludes
-- the case $x in domain(f)$ of our initial assumption, leaving only the case $[x,f~[x]] in f$.
--
	EQUAL ==> [car(yy),cdr(yy)] notin f
	(f,yy)-->T76 ==> yy  notin f
	Discharge ==> (x notin domain(f)) & ([x,f~[x]] in f)
--
-- But then by definition we have an immediate contradiction which proves our theorem.
--
	Use_def(domain) ==> Stat4: x notin {car(v): v in f}
	[x,f~[x]]-->Stat4 ==> false; Discharge ==> QED
--
--
THEORY Must_be_svm(b(x),s,u)
END Must_be_svm;
--
ENTER_THEORY Must_be_svm
--
Theorem Must_be_svm.1: [Single-valued map former] Svm({[x,b(x)]: x in s}) & (domain({[x,b(x)]: x in s}) = s) & (range({[x,b(x)]: x in s}) = {b(x): x in s}) & ((u in s) ¥imp ({[x,b(x)]: x in s}~[u] = b(u))). Proof:
	Suppose_not() ==> not(Svm({[x,b(x)]: x in s}) & (domain({[x,b(x)]: x in s}) = s) & (range({[x,b(x)]: x in s}) = {b(x): x in s}) & ((u in s) ¥imp ({[x,b(x)]: x in s}~[u] = b(u))))
	APPLY() Iz_map(a(x)->x,b(x)->b(x),s->s) ==> (domain({[x,b(x)]: x in s}) = {x: x in s}) & (range({[x,b(x)]: x in s}) = {b(x): x in s})
	SIMPLF ==> {x: x in s} = s
	Suppose ==> not Svm({[x,b(x)]: x in s})
	APPLY(x3_thryvar:x,y3_thryvar:y) Svm_test(a(x)->x,b(x)->b(x),s->s) ==>
	((x in s) & (y in s) & (x = y) & (b(x) /= b(y))) or Svm({[x,b(x)]: x in s})
	ELEM ==> ((x in s) & (y in s) & (x = y) & (b(x) /= b(y)))
	EQUAL ==> b(x) = b(y)
	Discharge ==> (u in s) & ({[x,b(x)]: x in s}~[u] /= b(u))
	APPLY(x9_thryvar:junk1,y9_thryvar:junk2) fcn_symbol(f(x)->b(x),g->{[y,b(y)]: y in s},s->s) ==> Stat1: (FORALL u in s | {[y,b(y)]: y in s}~[u] = b(u))
	u-->Stat1 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Must_be_svm
--
--THEORY Must_be_svm(b(x),s,u)
--==>
--     Svm({[x,b(x)]: x in s}) & (domain({[x,b(x)]: x in s}) = s) & (range({[x,b(x)]: x in s}) = {b(x): x in s}) & ((u in s) ¥imp ({[x,b(x)]: x in s}~[u] = b(u)))
--END Must_be_svm;
--
-- The preceding mini-theory has the following obvious 2-variable analog.
-- The proof of the one theorem it provides is completely elementary.
--
THEORY Must_be_svm_2(b2(x,y),s,t,P2(x,y))
END Must_be_svm_2;
--
ENTER_THEORY Must_be_svm_2
--
Theorem Must_be_svm_2.1: [Single-valued map former, two-variable case] Svm({[[x,y],b2(x,y)]: x in s, y in t | P2(x,y)}). Proof:
	Suppose_not ==> not Svm({[[x,y],b2(x,y)]: x in s, y in t | P2(x,y)})
	APPLY(x4_thryvar:x,y4_thryvar:y,xp1_thryvar:xx,yp1_thryvar:yy) 	Svm_test_2(a2(x,y)->[x,y],b2(x,y)->b2(x,y),P2(x,y)->P2(x,y),s->s,t->t)	 ==>
		(((x in s) & (y in t) & (xx in s) & (yy in t) &
			([x,y] = [xx,yy]) & (b2(x,y) /= b2(xx,yy))) or
				Svm({[[x,y],b2(x,y)]: x in s, y in t | P2(x,y)}))
	ELEM ==> (x = xx) & (y = yy)
	EQUAL ==> b2(x,y) = b2(xx,yy)
	ELEM ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Must_be_svm_2
--
--THEORY Must_be_svm_2(b2(x,y),s,t,P2(x,y))
--==>
--     Svm({[[x,y],b2(x,y)]: x in s, y in t | P2(x,y)})
--END Must_be_svm_2;
--
-- The additivity of domain and range, stated in the following theorems,
-- both follow immediately by application of set monotonicity.
--
Theorem 78: [Map domains are additive] domain(F + G) = domain(F) + domain(G). Proof:
Suppose_not(f,g) ==> domain(f + g) /= domain(f) + domain(g)
	Use_def(domain) ==> {car(x): x in f + g} /= {car(x): x in f} + {car(x): x in g}
	Set_monot ==> {car(x): x in f + g} = {car(x): x in f} + {car(x): x in g}
Discharge ==> QED
--
Theorem 79: [Map ranges are additive] range(F + G) = range(F) + range(G). Proof:
Suppose_not(f,g) ==> range(f + g) /= range(f) + range(g)
	Use_def(range) ==> {cdr(x): x in f + g} /= {cdr(x): x in f} + {cdr(x): x in g}
	Set_monot ==> {cdr(x): x in f + g} = {cdr(x): x in f} + {cdr(x): x in g}
Discharge ==> QED
--
-- The following is a corollary of Theorem 48 and Theorem 79.
--
Theorem 80: [Range of a restriction map] range(F ¥ON S) ¥incin range(F). Proof:
Suppose_not(f,s) ==> not(range(f ¥ON s) ¥incin range(f))
	(f,s)-->T48 ==> f = (f ¥ON s) + (f - (f ¥ON s))
	(f ¥ON s,f - (f ¥ON s))-->T79 ==> range((f ¥ON s) + (f - (f ¥ON s))) = range(f ¥ON s) + range(f - (f ¥ON s))
	EQUAL ==> range(f) = range(f ¥ON s) + range(f - (f ¥ON s))
ELEM ==> false;  Discharge ==> QED
--
-- The following elementary lemmas concerning the additivity, monotonicity of the range function,
-- and some easy additional properties specific to 1-1 maps, are also useful.
--
Theorem 81: [Range of restriction to a union] range(F ¥ON (S + T)) = range(F ¥ON S) + range(F ¥ON T). Proof:
Suppose_not(f,s,t) ==> range(f ¥ON (s + t)) /= range(f ¥ON s) + range(f ¥ON t)
	(f,s,t)-->T63 ==> (f ¥ON (s + t)) = (f ¥ON s) + (f ¥ON t)
	(f ¥ON s,f ¥ON t)-->T79 ==> range((f ¥ON s) + (f ¥ON t)) = range(f ¥ON s) + range(f ¥ON t);
EQUAL ==> false; Discharge ==> QED
--
Theorem 82: [Restriction to a subset] (S incs T) ¥imp (range(F ¥ON S) incs range(F ¥ON T)). Proof:
Suppose_not(s,t,f) ==> (s incs t) & (not(range(f ¥ON s) incs range(f ¥ON t)))
	(f,t,s - t)-->T81 ==> range(f ¥ON (t + (s - t))) incs range(f ¥ON t)
	ELEM ==> t + (s - t) = s
EQUAL ==> false; Discharge ==> QED
--
-- Next we prove that the range of a 1-1 map $f$ on the intersection of two sets
-- is the intersection of the restrictions of $f$ to each of these two sets.
--
Theorem 83: [One-one map-restriction to an intersection] one_1_map(F) ¥imp (range(F ¥ON (S * T)) = range(F ¥ON S) * range(F ¥ON T)). Proof:
   Suppose_not(f,s,t) ==> one_1_map(f) & (range(f ¥ON (s * t)) /= range(f ¥ON s) * range(f ¥ON t))
--
-- For suppose that $f$, $s$, and $t$ are a counterexample to our assertion.
-- Since by monotonicity $range(f ¥ON (s * t))$ must be a subset of
-- both $range(f ¥ON s)$ and   $range(f ¥ON t)$, and hence of their intersection,
-- it follows that the intersection $I$ of these two latter sets must contain $range(f ¥ON (s * t))$,
-- and so if our theorem is false $range(f ¥ON (s * t))$ cannot be a subset of $I$.
--
	(s,s * t,f)-->T82 ==> range(f ¥ON s) incs range(f ¥ON (s * t))
	(t,s * t,f)-->T82 ==> range(f ¥ON t) incs range(f ¥ON (s * t))
	ELEM ==> Stat1: not(range(f ¥ON (s * t)) incs range(f ¥ON s) * range(f ¥ON t))
--
-- Hence there must exist an element $c$ of $I$ which does not belong to $range(f ¥ON (s * t))$,
-- and therefore elements $d in f$, $d in f$ such that $c = cdr(d)$, $c = cdr(e)$ such that
-- $car(d)$ and $car(e)$ are members of  $s$, $t$ respectively.
--
	c-->Stat1 ==> (c in range(f ¥ON s) * range(f ¥ON t)) & (c notin range(f ¥ON (s * t)))
	Use_def(range) ==> (c in {cdr(x): x in (f ¥ON s)}) & (c in {cdr(x): x in (f ¥ON t)}) &
				(c notin {cdr(x): x in (f ¥ON (s * t))})
	Use_def(¥ON) ==> (c in {cdr(x): x in {y in f | car(y) in s}}) &
	(c in {cdr(x): x in {y in f | car(y) in t}}) &
	(c notin {cdr(x): x in {y in f | car(y) in (s * t)}})
	SIMPLF ==> Stat2: (c in {cdr(x): x in f | car(x) in s}) & Stat3: (c in {cdr(x): x in f | car(x) in t})
			& Stat4: (c notin {cdr(x): x in f | car(x) in (s * t)})
	d-->Stat2 ==> (c = cdr(d)) & (d in f) & (car(d) in s)
	e-->Stat3 ==> (c = cdr(e)) & (e in f) & (car(e) in t)
--
-- But now, since $f$ is 1-1, we must have $d = e$, so that $car(d) in (s * t)$,
-- which contradicts $c notin range(f ¥ON (s * t))$ and so proves our theorem.
--
	Use_def(one_1_map) ==> Stat5: (FORALL x in f, y in f | (cdr(x) = cdr(y)) ¥imp (x = y))
	(d,e)-->Stat5 ==> d = e
	ELEM ==> car(d) in (s * t)
	d-->Stat4 ==> false; Discharge ==> QED
--
-- Our next lemma gives the entirely elementary fact that the restriction of a map to the null set,
-- and the range of this restriction, are both null.
--
Theorem 84: [Restriction to the null set] ((F ¥ON 0) = 0) & (range(F ¥ON 0) = 0). Proof:
    Suppose_not(f) ==> (f ¥ON 0 /= 0) or (range(f ¥ON 0) /= 0)
    Suppose ==> f ¥ON 0 /= 0
	Use_def(¥ON) ==> Stat1: {y in f | car(y) in 0} /= 0
	d-->Stat1 ==> false; Discharge ==> f ¥ON 0 = 0
    EQUAL ==> range(0) /= 0
    T59 ==> false; Discharge ==> QED
--
Theorem 85: [One-one map restriction to disjoint sets] (one_1_map(F) & (S * T = 0)) ¥imp (range(F ¥ON S) * range(F ¥ON T) = 0). Proof:
   Suppose_not(f,s,t) ==> one_1_map(f) & (s * t = 0) & (range(f ¥ON s) * range(f ¥ON t) /= 0)
   (f,s,t)-->T83 ==> range(f ¥ON (s * t)) /= 0
    EQUAL ==> range(f ¥ON 0) /= 0
    f-->T84 ==> false; Discharge ==> QED
--
-- Next we show that if either of the domain and range of a set $f$ is empty, so is the other
-- (either of these conditions is equivalent to the condition that $f$ is empty).
--
Theorem 86: [Domain is null only when range is null] (domain(F) = 0) ¥eq (range(F) = 0). Proof:
    Suppose_not(f) ==> not((domain(f) = 0) ¥eq (range(f) = 0))
    Use_def(domain) ==> not(({car(x): x in f} = 0) ¥eq (range(f) = 0))
    Use_def(range) ==> not(({car(x): x in f} = 0) ¥eq ({cdr(x): x in f} = 0))
--
-- For if not, one of these sets must be empty and the other not.
-- Suppose first that ${cdr(x): x in f}$ is nonempty, so that there exists a $d$ in $f$.
-- Then the first set must also be nonempty. The same argument applies in the
-- case that ${car(x): x in f}$ is nonempty, and so our assertion holds in each case.
--
    Suppose ==> Stat1: ({car(x): x in f} = 0) & Stat2: ({cdr(x): x in f} /= 0)
    d-->Stat2 ==> d in f
    d-->Stat1 ==> false; Discharge ==> Stat3: ({car(x): x in f} /= 0) & Stat4: ({cdr(x): x in f} = 0)
    a-->Stat3 ==> a in f
    a-->Stat4 ==> false; Discharge ==> QED
--
-- The union of two single valued maps need not always be single valued,
-- but the following theorem tells us that it is if the domains of the two maps are disjoint.
--
Theorem 87: [Union of single-valued maps] (Svm(F) & Svm(G) & (domain(F) * domain(G) = 0)) ¥imp Svm(F + G). Proof:
    Suppose_not(f,g) ==>
	Svm(f) & Svm(g) & (domain(f) * domain(g) = 0) & (not(Svm(f + g)))
--
-- For suppose not, use the definition  of '$Svm$' to expand the negative of our theorem,
-- and use the fact, which follows from Theorem 62, that $f + g$ must be a map.
-- from which it follows that $f + g$ must have two distinct elements $a$ and $b$
-- such that $car(a) = car(b)$.
--
    Use_def(Svm) ==> Is_map(f) & Stat1: (FORALL x in f, y in f | ((car(x) = car(y)) ¥imp (x = y)))
    Use_def(Svm) ==> Is_map(g) & Stat2: (FORALL x in g, y in g | ((car(x) = car(y)) ¥imp (x = y)))
    Use_def(Svm) ==> not(Is_map(f + g)) or not(FORALL x in f + g, y in f + g | ((car(x) = car(y)) ¥imp (x = y)))
    (f,g)-->T62 ==> Stat3: not(FORALL x in f + g, y in f + g | ((car(x) = car(y)) ¥imp (x = y)))
    (a,b)-->Stat3 ==> (a in f + g) & (b in f + g) & (car(a) = car(b)) & (a /= b)
--
-- Then, since $f$ and $g$ are both single valued, it follows that one of $a$ and  $b$
-- must belong to $f$ and the other to $g$.
-- Suppose for definiteness that $a$ belongs to $f$ and $b$ to $g$.
-- Then by Theorem 60 $car(a)$ belongs to $domain(f)$ and $car(b)$ to the disjoint set $domain(g)$,
-- which is impossible since $car(a) = car(b)$.
--
    (a,b)-->Stat1 ==> ((a in f) & (b in f)) ¥imp ((car(a) = car(b)) ¥imp (a = b))
    (a,b)-->Stat2 ==> ((a in g) & (b in g)) ¥imp ((car(a) = car(b)) ¥imp (a = b))
    ELEM ==> (((a in f) & (b in g)) or ((a in g) & (b in f)))
    Suppose ==> (a in f) & (b in g)
    (a,f)-->T60 ==> car(a) in domain(f)
    (b,g)-->T60 ==> car(b) in domain(g)
    ELEM ==> false; Discharge ==> (a in g) & (b in f)
--
-- This leaves only the symmetric case $(a in g) & (b in f)$,
-- which can be treated in the same way, proving our theorem.
--
    (a,g)-->T60 ==> car(a) in domain(g)
    (b,f)-->T60 ==> car(b) in domain(f)
    Discharge ==> QED
--
-- A very similar argument shows that the union of two 1-1 maps
-- with disjoint ranges and domains must be 1-1.
--
Theorem 88: [Union of 1-1 maps]
    (one_1_map(F) & one_1_map(G) & (range(F) * range(G) = 0) & (domain(F) * domain(G) = 0)) ¥imp one_1_map(F + G). Proof:
    Suppose_not(f,g) ==>
	(one_1_map(f) & one_1_map(g) & (range(f) * range(g) = 0) & (domain(f) * domain(g) = 0)) &
	(not(one_1_map(f + g)))
--
-- For suppose not, use the definition  of 'one_1_map' to expand the negative of our theorem,
-- and use the fact, following by Theorem 87, that $f + g$ must be a single valued map.
-- from which it follows that $f + g$ must have two distinct elements $a$ and $b$
-- such that $cdr(a) = cdr(b)$.
--
    Use_def(one_1_map) ==> Svm(f) & Stat1:(FORALL x in f, y in f | ((cdr(x) = cdr(y)) ¥imp (x = y))) &
	Svm(g) & Stat2:(FORALL x in g, y in g | ((cdr(x) = cdr(y)) ¥imp (x = y))) &
	((not(Svm(f + g))) or not(FORALL x in f + g, y in f + g | ((cdr(x) = cdr(y)) ¥imp (x = y))))
    (f,g)-->T87 ==> Stat3: not(FORALL x in f + g, y in f + g |((cdr(x) = cdr(y)) ¥imp (x = y)))
    (a,b)-->Stat3 ==> Stat4: (a in f + g) & (b in f + g) & (cdr(a) = cdr(b)) & (not(a = b))
--
-- Then, since $f$ and $g$ are both 1-1 maps, it follows that one of $a$ and  $b$
-- must belong to $f$ and the other to $g$.
-- Suppose for definiteness that $a$ belongs to $f$ and $b$ to $g$.
-- Then by Theorem 61 $cdr(a)$ belongs to $range(f)$ and $cdr(a)$ to the disjoint set $range(g)$,
-- which is impossible since $cdr(a) = cdr(b)$.
--
    (a,b)-->Stat1 ==> ((a in f) & (b in f)) ¥imp ((cdr(a) = cdr(b)) ¥imp (a = b))
    (a,b)-->Stat2 ==> ((a in g) & (b in g)) ¥imp ((cdr(a) = cdr(b)) ¥imp (a = b))
    ELEM ==> (((a in f) & (b in g)) or ((a in g) & (b in f)))
    Suppose ==> (a in f) & (b in g)
    (a,f)-->T61 ==> cdr(a) in range(f)
    (b,g)-->T61 ==> cdr(b) in range(g)
    Discharge ==> (a in g) & (b in f)
--
-- This leaves only the symmetric case $(a in g) & (b in f)$,
-- which can be treated in the same way, proving our theorem.
--
    (a,g)-->T61 ==> cdr(a) in range(g)
    (b,f)-->T61 ==> cdr(b) in range(f)
    Discharge ==> QED
--
--
--
Theorem 89: [Union of 1-1 maps, 2] (one_1_map(F + G) & ((G * F) = 0)) ¥imp ((domain(G) = (domain(F + G) - domain(F))) & (range(G) = (range(F + G) - range(F)))). Proof:
Suppose_not(f0,g0) ==> AUTO
--
-- For, assuming the contrary, we would get a contradiction.
-- Indeed, $domain$ and $range$ are additive operators.
-- Hence, the negation of the statement we want to prove
-- implies that either the intersection of the domains
-- or the intersection of the ranges would be non-void.
-- Single-valuedness would be contradicted in the former case,
-- injectivity would be contradicted in the latter case.
--
	Use_def(one_1_map)(*) ==> Svm(f0 + g0) & Stat1: (FORALL x in (f0 + g0), y in (f0 + g0) | (cdr(x) = cdr(y)) ¥imp (x = y))
	Suppose ==> Stat2: domain(g0) /= (domain(f0 + g0) - domain(f0))
		(f0,g0)-->T78(Stat2*) ==> Stat3: (domain(f0) * domain(g0)) /= 0
		d-->Stat3(Stat3*) ==> (d in domain(f0)) & (d in domain(g0))
		Use_def(domain)(Stat3*) ==> Stat4: (d in {car(x): x in f0}) & (d in {car(x): x in g0})
		(x0,y0)-->Stat4(Stat4*) ==> (d = car(x0)) & (x0 in f0) & (d = car(y0)) & (y0 in g0)
		Use_def(Svm)(*) ==> Stat5: (FORALL x in (f0 + g0), y in (f0 + g0) | (car(x) = car(y)) ¥imp (x = y))
		(x0,y0)-->Stat5(Stat4*) ==> x0 = y0
	Discharge ==> Stat6: range(g0) /= (range(f0 + g0) - range(f0))
	(f0,g0)-->T79(Stat6*) ==> Stat7: (range(f0) * range(g0)) /= 0
	r-->Stat7(Stat7*) ==> (r in range(f0)) & (r in range(g0))
	Use_def(range)(Stat6*) ==> Stat8: (r in {cdr(x): x in f0}) & (r in {cdr(x): x in g0})
	(x1,y1)-->Stat8(Stat8*) ==> (r = cdr(x1)) & (x1 in f0) & (r = cdr(y1)) & (y1 in g0)
	(x1,y1)-->Stat1(Stat8*) ==> x1 = y1
Discharge ==> QED
--
-- The following simple lemma will be useful in our later work with map inverses.
--
Theorem 90: [Members of the inverse map] Is_map(F) ¥imp (([X,Y] in F) ¥eq ([Y,X] in inv(F))). Proof:
    Suppose_not(f,x,y) ==> Is_map(f) & (not(([x,y] in f) ¥eq ([y,x] in inv(f))))
--
-- In the contrary case, and first considering the subcase in which $[x,y]$ belongs to $f$,
-- use of the definition leads to an immediate contradiction, so that we must have
-- $[x,y] notin f$ and $[y,x] in inv(f)$.
--
    Suppose ==> ([x,y] in f) & ([y,x] notin inv(f))
    Use_def(inv) ==> Stat1: [y,x] notin {[cdr(u),car(u)]: u in f}
    ([x,y])-->Stat1 ==> [y,x] /= [cdr([x,y]),car([x,y])]
    Discharge ==> ([x,y] notin f) & ([y,x] in inv(f))
--
-- But in this case use of the definition also leads, via Theorem 76,
-- to an immediate contradiction, which completes the proof of the present lemma.
--
    Use_def(inv) ==>  ([x,y] notin f) & Stat2: ([y,x] in {[cdr(u),car(u)]: u in f})
    u-->Stat2 ==> ([y,x] = [cdr(u),car(u)]) & (u in f)
    ELEM ==> [car(u),cdr(u)] /= u;
    (f,u)-->T76 ==> false; Discharge ==> QED
--
-- The two following elementary lemmas note other ways in which
-- small 1-1 maps can be constructed.
-- First we observe that the singleton ${[x,y]}$ is always a 1-1 map.
--
Theorem 91: [Singletons as maps] Svm({[X,Y]}) & one_1_map({[X,Y]}) & (({[X,Y]}~[X]) = Y). Proof:
    Suppose_not(x1,y1) ==> not(Svm({[x1,y1]}) & one_1_map({[x1,y1]}) & (({[x1,y1]}~[x1]) = y1))
--
-- We prove the various clauses of this theorem successively.
-- The fact that ${[x1,y1]}$ is a map follows readily by use of our utility $Iz_map$ theory,
-- and by simplification.
--
    SIMPLF ==> {[car(u),cdr(u)]: u in {[x1,y1]}} = {[car([x1,y1]),cdr([x1,y1])]}
    ELEM ==> {[car(u),cdr(u)]: u in {[x1,y1]}} = {[x1,y1]}
    APPLY() Iz_map(a(u)->car(u),b(u)->cdr(u),s->{[x1,y1]}) ==> Is_map({[car(u),cdr(u)]: u in {[x1,y1]}})
    EQUAL ==> Is_map({[x1,y1]})
--
-- Likewise, to prove that ${[x1,y1]}$ is a single valued map we have only to use the definition of $Svm$.
--
    Suppose ==> not Svm({[x1,y1]})
    Use_def(Svm) ==> not(Is_map({[x1,y1]}) & (FORALL u in {[x1,y1]}, v in {[x1,y1]} | (car(u) = car(v)) ¥imp (u = v)))
    ELEM ==> Stat1: not (FORALL u in {[x1,y1]}, v in {[x1,y1]} | (car(u) = car(v)) ¥imp (u = v))
    (a,b)-->Stat1 ==> (a in {[x1,y1]}) & (b in {[x1,y1]}) & (car(a) = car(b)) & (a /= b)
    ELEM ==>  (a = [x1,y1]) & (b = [x1,y1])
    Discharge ==> Svm({[x1,y1]})
--
-- The proof that ${[x1,y1]}$ is 1-1 is equally elementary. Once this is done it only remains
-- to prove the final clause of our theorem.
--
    Suppose ==> not one_1_map({[x1,y1]})
    Use_def(one_1_map) ==> not (Svm({[x1,y1]}) & (FORALL u in {[x1,y1]}, v in {[x1,y1]} | ((cdr(u) = cdr(v)) ¥imp (u = v))))
    ELEM ==> Stat2: not(FORALL u in {[x1,y1]}, v in {[x1,y1]} | ((cdr(u) = cdr(v)) ¥imp (u = v)))
    (c,d)-->Stat2 ==> Stat3: (c in {[x1,y1]}) & (d in {[x1,y1]}) & (cdr(c) = cdr(d)) & (c /= d)
    (Stat3)Discharge ==> Stat4: {[x1,y1]}~[x1] /= y1
--
-- For this we simply use the definitions of map application, restriction, and range successively,
-- and simplify the resulting formula, to obtain a final contradiction which proves our theorem.
--
    Use_def(~) ==> {[x1,y1]}~[x1] = cdr(arb({[x1,y1]} ¥ON {x1}))
    Use_def(¥ON) ==> {[x1,y1]}~[x1] = cdr(arb({u in {[x1,y1]} | car(u) in {x1}}))
    SIMPLF ==> {[x1,y1]}~[x1] = cdr(arb(if car([x1,y1]) in {x1} then {[x1,y1]} else 0 end if))
    ELEM ==> if car([x1,y1]) in {x1} then {[x1,y1]} else 0 end if = {[x1,y1]}
    EQUAL ==> cdr(arb({[x1,y1]})) = cdr(arb(if car([x1,y1]) in {x1} then {[x1,y1]} else 0 end if))
    ELEM ==> {[x1,y1]}~[x] = cdr(arb({[x1,y1]}))
    ELEM ==> cdr(arb({[x1,y1]})) = y1
    Discharge ==> QED
--
-- Next we observe that the doubleton ${[x,y],[z,w]}$ is a single-valued map if
-- $x /= z$, in which case ${[x,y],[z,w]}~[x] = y$.
--
Theorem 92: [Doubletons as maps] Is_map({[X,Y],[Z,W]}) & (domain({[X,Y],[Z,W]}) = {X,Z}) & (range({[X,Y],[Z,W]}) = {Y,W}) &
	((X /= Z) ¥imp Svm({[X,Y],[Z,W]})). Proof:
Suppose_not(x0,y0,z0,w0) ==> AUTO
	TELEM ==> Is_map({[x0,y0],[z0,w0]})
	TELEM ==> domain({[x0,y0],[z0,w0]}) = {x0,z0}
	TELEM ==> range({[x0,y0],[z0,w0]}) = {y0,w0}
	Use_def(Svm) ==> Stat1: (not(FORALL x in {[x0,y0],[z0,w0]}, y in {[x0,y0],[z0,w0]} | (car(x) = car(y)) ¥imp (x = y))) & (x0 /= z0)
	(x0,y0)-->T9(Stat1*) ==> car([x0,y0]) = x0
	(z0,w0)-->T9(Stat1*) ==> car([z0,w0]) = z0
	(p,q)-->Stat1(Stat1*) ==> Stat2: (p in {[x0,y0],[z0,w0]}) & (q in {[x0,y0],[z0,w0]}) & (car(p) = car(q)) & (p /= q)
	Suppose ==> (p = [x0,y0]) & (q = [z0,w0])
		EQUAL(Stat1) ==> false
	Discharge ==> AUTO
	(Stat2*)ELEM ==> (q = [x0,y0]) & (p = [z0,w0])
	EQUAL(Stat1) ==> false
	Discharge ==> QED
--
--
--
Theorem 93: [Doubletons as maps, 2] (X /= Z) ¥imp ({[X,Y],[Z,W]}~[X] = Y). Proof:
    Suppose_not(x,wz,y,w) ==> Stat1: (x /= wz) & ({[x,y],[wz,w]}~[x] /= y)
--
-- To show this, use the definitions of map application, restriction, and range, and then
-- simplify, obtaining the equality seen below:
--
    Use_def(~) ==> {[x,y],[wz,w]}~[x] = cdr(arb({[x,y],[wz,w]} ¥ON {x}))
    Use_def(¥ON) ==> {[x,y],[wz,w]}~[x] = cdr(arb({v in {[x,y],[wz,w]} | car(v) in {x}}))
--
-- It is now easy to see, since $x /= wz$, that ${v in {[x,y],[wz,w]} | car(v) in {x}} /= {[x,y]}$
--
    Suppose ==> Stat2: {v in {[x,y],[wz,w]} | car(v) in {x}} /= {[x,y]}
    ww-->Stat2 ==> Stat3: (ww in {v in {[x,y],[wz,w]} | (car(v) in {x})}) ¥eq (ww /= [x,y])
    Suppose ==> Stat4: ww in {v in {[x,y],[wz,w]} | (car(v) in {x})}
        ()-->Stat4(Stat3) ==> Stat5: (ww = [wz,w]) & (car(ww) = x)
    (Stat1,Stat5)Discharge ==> Stat6: (ww = [x,y]) & Stat7: (ww notin {v in {[x,y],[wz,w]} | (car(v) in {x})})
    (Stat6)ELEM ==> car(ww) in {x}
    ww-->Stat7 ==> not ((ww in {[x,y],[wz,w]}) & (car(ww) in {x}))
    (Stat6)Discharge ==> {v in {[x,y],[wz,w]} | car(v) in {x}} = {[x,y]}
--
-- Hence, substituting into the third line of our proof, we find that ${[x,y],[wz,w]}~[x] = cdr(arb({[x,y]}))$,
-- which simplifies easily to the assertion of our theorem.
--
    EQUAL ==> {[x,y],[wz,w]}~[x] = cdr(arb({[x,y]}))
    ELEM ==> arb({[x,y]}) = [x,y]
    EQUAL ==> {[x,y],[wz,w]}~[x] = cdr([x,y])
    Discharge ==> QED
--
-- Next we give a simple formula for the restriction of  a map.
--
Theorem 94: [Domain of restriction] domain(F ¥ON S) = domain(F) * S. Proof:
    Suppose_not(f,s) ==> not(domain(f ¥ON s) = domain(f) * s)
--
-- For if we expand the negative of our theorem using the definitions
-- of the functions involved, we see that the two sets displayed below must differ:
--
    Use_def(domain) ==> {car(x): x in (f ¥ON s)} /= {car(x): x in f} * s
    Use_def(¥ON) ==> {car(x): x in {x in f | car(x) in s}} /= {car(x): x in f} * s
    SIMPLF ==> Stat1: {car(x): x in f | car(x) in s} /= {car(x): x in f} * s
    c-->Stat1 ==> ((c in {car(x): x in f | car(x) in s}) & (c notin {car(x): x in f} * s)) or
	((c notin {car(x): x in f | car(x) in s}) & (c in {car(x): x in f} * s))
--
-- This is a disjunction. The first of its cases is impossible, since it would imply that
-- $c$ had the form $car(d)$ and was both in $s$ and not in $s$.
--
    Suppose ==> Stat2: (c in {car(x): x in f | car(x) in s}) & Stat3: (c notin {car(x): x in f} or c notin s)
    d-->Stat2 ==> (c = car(d)) & (d in f) & (car(d) in s)
    d-->Stat3 ==> false
--
-- Hence we need only consider the second case, but this leads immediately to a similar impossibility, proving our theorem.
--
    Discharge ==> Stat4: (c notin {car(x): x in f | car(x) in s}) & Stat5: (c in {car(x): x in f}) & (c in s)
    e-->Stat5 ==> (c = car(e)) & (e in f)
    e-->Stat4 ==> false; Discharge ==> QED
--
-- The following theorem gives formulae for the range and domain of a product map $f @ g$,
-- under the simplifying hypothesis that the range of $g$ is included in the domain of $f$.
--
Theorem 95: [Range and domain of map product] (range(F @ G) = range(F ¥ON range(G))) & ((range(G) ¥incin domain(F)) ¥imp (domain(F @ G) = domain(G))). Proof:
    Suppose_not(f,g) ==>
	Stat1: (range(f @ g) /= range(f ¥ON range(g))) or ((range(g) ¥incin domain(f)) & (domain(f @ g) /= domain(g)))
--
-- Proceeding by contradiction, we have two cases to consider. First suppose that the two ranges
-- appearing in the theorem are different. Use the definitions
-- of the functions involved and simplify.
--
    Suppose ==> range(f @ g) /= range(f ¥ON range(g))
    Use_def(range) ==> range(f @ g) = {cdr(x): x in f @ g}
    Use_def(@) ==> range(f @ g) = {cdr(x): x in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}}
    SIMPLF ==> range(f @ g) = {cdr([car(x),cdr(y)]): x in g, y in f | cdr(x) = car(y)}
--
-- But $range(f @ g)$ can be simplified further to ${cdr(x): x in f | car(x) in range(g)}$.
--
    Suppose ==> Stat2: {cdr([car(x),cdr(y)]): x in g, y in f | cdr(x) = car(y)} /=
    						{cdr(y): x in g, y in f | cdr(x) = car(y)}
    (ap,bp)-->Stat2 ==> cdr([car(ap),cdr(bp)]) /= cdr(bp)
    Discharge ==> range(f @ g) = {cdr(y): x in g, y in f | cdr(x) = car(y)}
--
-- From this, using the definitions of '$range$' and '$¥ON$', we get the set inequality seen below.
--
    Use_def(range) ==> range(f ¥ON range(g)) = {cdr(x): x in f ¥ON range(g)}
    Use_def(¥ON) ==> range(f ¥ON range(g)) = {cdr(x): x in {x in f | car(x) in range(g)}}
    SIMPLF ==> range(f ¥ON range(g)) = {cdr(x): x in f | car(x) in range(g)}
    ELEM ==> Stat3: {cdr(y): x in g, y in f | cdr(x) = car(y)} /= {cdr(x): x in f | car(x) in range(g)}
--
-- Hence there is a $c$ which is in one of these sets but not the other.
-- Suppose first that $c$ is in the first of these sets, and so has the form seen below.
--
    c-->Stat3 ==> ((c in {cdr(y): x in g, y in f | cdr(x) = car(y)}) & (c notin {cdr(x): x in f | car(x) in range(g)})) or
	((c notin {cdr(y): x in g, y in f | cdr(x) = car(y)}) & (c in {cdr(x): x in f | car(x) in range(g)}))
    Suppose ==> Stat4:
	(c in {cdr(y): x in g, y in f | cdr(x) = car(y)}) & Stat5: (c notin {cdr(x): x in f | car(x) in range(g)})
    (a,b)-->Stat4 ==> (c = cdr(b)) & (a in g) & (b in f) & (cdr(a) = car(b))
--
-- Then by Stat5 $car(b)$ is not in $range(g)$, which, using the definition of $range$,
-- leads to an immediate contradiction with Stat6
--
    b-->Stat5 ==> car(b) notin range(g)
    Use_def(range) ==> Stat7: not (car(b) in {cdr(x): x in g})
    a-->Stat7 ==> false;
--
-- Hence $c$ must be in the second of the sets considered above,
-- but not in the first, and so must have the form seen below.
--
    Discharge ==> Stat8: (c notin {cdr(y): x in g, y in f | cdr(x) = car(y)}) &
			Stat9: (c in {cdr(x): x in f | car(x) in range(g)})
    u-->Stat9 ==> (c = cdr(u)) & (u in f) & (car(u) in range(g))
    Use_def(range) ==> Stat10: car(u) in {cdr(x): x in g}
    v-->Stat10 ==> (car(u) = cdr(v)) & (v in g)
--
-- But this leads to an immediate contradiction with Stat8,
-- and so rules out the first of our two main cases,
-- leaving the only case $domain(f @ g) /= domain(g)$ to be considered.
--
    (v,u)-->Stat8 ==> not(c = cdr(u) & (u in f) & (v in g) & (cdr(v) = car(u)))
    Discharge ==> Stat11: range(f @ g) = range(f ¥ON range(g))
    (Stat11,Stat1)ELEM ==> domain(f @ g) /= domain(g)
--
-- This can be handled in much the same way as the case just analyzed. Using the definitions
-- of the functions involved, we see that the two sets displayed below must differ.
--
    Use_def(domain) ==> {car(x): x in f @ g} /= {car(x): x in g}
    Use_def(@) ==> {car(x): x in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}} /= {car(x): x in g}
    SIMPLF ==> {car([car(x),cdr(y)]): x in g, y in f | cdr(x) = car(y)} /= {car(x): x in g}
    (car(X),cdr(Y))-->T7 ==> car([car(X),cdr(Y)]) = car(X)
    EQUAL ==> Stat12: {car(x): x in g, y in f | cdr(x) = car(y)} /= {car(x): x in g}
--
-- Hence there is a $ca$ which is in one of these sets but not the other.
-- Suppose first that $ca$ is in the first of these sets, and so has the form seen below.
--
    ca-->Stat12 ==> ((ca in {car(x): x in g, y in f | cdr(x) = car(y)}) & (ca notin {car(x): x in g})) or
	((ca notin {car(x): x in g, y in f | cdr(x) = car(y)}) & (ca in {car(x): x in g}))
    Suppose ==> Stat13: (ca in {car(x): x in g, y in f | cdr(x) = car(y)}) & Stat14: (ca notin {car(x): x in g})
--
-- Then by Stat15 $car(ba)$ is not in ${car(x): x in f}$,
-- which leads to an immediate contradiction.
--
    (aa,ba)-->Stat13 ==> (ca = car(aa)) & (aa in g) & (ba in f) & (cdr(aa) = car(ba))
    aa-->Stat14 ==> false
    Discharge ==> Stat16: (ca notin {car(x): x in g, y in f | cdr(x) = car(y)}) & Stat17: (ca in {car(x): x in g})
 --
-- Hence $ca$ must be in the second of the sets considered above,
-- but not in the first. Thus $ca$ must have the form $car(x)$ for some $x in g$.
-- Since $cdr(x)$ belongs to $range(g) ¥incin domain(f)$, it follows that
-- $cdr(x) = car(y)$ for some $y in f$. Substitution of $x$ and $y$ into
-- Stat18 31 now leads immediately to a contradiction which completes our proof.
--
    x-->Stat17 ==> (ca = car(x)) & (x in g)
    Suppose ==> Stat19: cdr(x) notin {cdr(x): x in g}
    x-->Stat19 ==> false; Discharge ==> cdr(x) in {cdr(x): x in g}
    Use_def(range) ==> cdr(x) in range(g)
    ELEM ==> cdr(x) in domain(f)
    Use_def(domain) ==> Stat20: cdr(x) in {car(y): y in f}
    y-->Stat20 ==> (cdr(x) = car(y)) & (y in f)
    (x,y)-->Stat16 ==> false; Discharge ==> QED
--
-- If the range of $g$ equals the domain of $f$, the following slightly stronger corollary
-- to the preceding result applies. The proof simply combines Theorem 95 and Theorem 67.
--
Theorem 96: [Range and domain of map product, 2] (range(G) = domain(F)) ¥imp ((range(F @ G) = range(F)) & (domain(F @ G) = domain(G))). Proof:
    Suppose_not(g,f) ==> (range(g) = domain(f)) & (not((range(f @ g) = range(f)) & (domain(f @ g) = domain(g))))
    (f,g)-->T95 ==> (range(f @ g) = range(f ¥ON range(g))) & (domain(f @ g) = domain(g))
    EQUAL ==> (range(f @ g) = range(f ¥ON domain(f))) & (domain(f @ g) = domain(g))
    f-->T67 ==> (f ¥ON domain(f)) = f
    EQUAL ==> range(f ¥ON domain(f)) = range(f)
    Discharge ==> QED
--
-- It is sometimes convenient to use the following corollary of Theorem 95
-- rather than the theorem itself.
--
Theorem 97: [Range and domain of map product, 3] (range(G) ¥incin domain(F)) ¥imp ((range(F @ G) ¥incin range(F)) & (domain(F @ G) = domain(G))). Proof:
    Suppose_not(g,f) ==>
	Stat1: (range(g) ¥incin domain(f)) & ((not(range(f @ g) ¥incin range(f))) or domain(f @ g) /= domain(g))
	(f,g)-->T95 ==> (range(f @ g) = range(f ¥ON range(g))) & (domain(f @ g) = domain(g))
	ELEM ==> not(range(f ¥ON range(g)) ¥incin range(f))
	(f,range(g))-->T80 ==> false; Discharge ==> QED
--
-- Our next easy theorem tells us that a 1-1 map, combined with the 'range' operator,
-- induces a 1-1 map on the set of subsets of its domain.
--
Theorem 98: [Range of restriction of one-one map] (one_1_map(F) & (S ¥incin domain(F)) & (S /= domain(F))) ¥imp
	((range(F ¥ON S) ¥incin range(F)) & (range(F ¥ON S) /= range(F))). Proof:
	Suppose_not(f,s) ==> one_1_map(f) & (s ¥incin domain(f)) & Stat1: (s /= domain(f)) &
	(not((range(f ¥ON s) ¥incin range(f)) & (range(f ¥ON s) /= range(f))))
	(f,s)-->T80 ==> range(f ¥ON s) = range(f)
	c-->Stat1 ==> (c in domain(f)) & (c notin s)
	Use_def(domain) ==> Stat2: c in {car(x): x in f}
	x-->Stat2 ==> (c = car(x)) & (x in f)
	Use_def(range) ==> range(f) = {cdr(x): x in f}
	Suppose ==> cdr(x) notin range(f)
	ELEM ==> Stat3: cdr(x) notin {cdr(x): x in f}
	x-->Stat3 ==> false; Discharge ==> cdr(x) in range(f ¥ON s)
	Use_def(range) ==> cdr(x) in {cdr(x): x in (f ¥ON s)}
	Use_def(¥ON) ==> cdr(x) in {cdr(x): x in {y in f | car(y) in s}}
	SIMPLF ==> Stat4: cdr(x) in {cdr(y): y in f | car(y) in s}
	y-->Stat4 ==> (cdr(x) = cdr(y)) & (y in f) & (car(y) in s)
	Use_def(one_1_map) ==> Stat5: (FORALL x in f, y in f | (cdr(x) = cdr(y)) ¥imp (x = y))
	(x,y)-->Stat5 ==> x = y
	Discharge ==> QED
--
-- Next we turn to a discussion of map inverses. The following theorem tells us that
-- the inverse of a map $f$ is always a map, whose range and domain are respectively the domain and range of $f$.
--
Theorem 99: [Inverse map basic properties] Is_map(inv(F)) & range(inv(F)) = domain(F) & domain(inv(F)) = range(F). Proof:
    Suppose_not(f) ==> not(Is_map(inv(f)) & range(inv(f)) = domain(f) & domain(inv(f)) = range(f))
--
-- For by our utility $Iz_map$ theory $inv(f)$ must clearly be a map.
--
    Use_def(inv) ==> inv(f) = {[cdr(x),car(x)]: x in f}
    APPLY() Iz_map(a(x)->cdr(x),b(x)->car(x),s->f) ==> Is_map({[cdr(x),car(x)]: x in f})
    EQUAL ==> Is_map(inv(f))
    ELEM ==> not((range(inv(f)) = domain(f)) & (domain(inv(f)) = range(f)))
--
-- If $range(inv(f))$ and $domain(f)$ are different, then by definition the two sets
-- seen below are different, so that there exists a $y$ such that
-- $cdr([cdr(y),car(y)]) /= car(y)$, another impossibility, leaving only the
-- third alternative $domain(inv(f)) /= range(f)$ to be considered.
--
    Suppose ==> range(inv(f)) /= domain(f)
    Use_def(range) ==> {cdr(x): x in inv(f)} /= domain(f)
    Use_def(domain) ==> {cdr(x): x in inv(f)} /= {car(x): x in f}
    EQUAL ==> {cdr(x): x in {[cdr(x),car(x)]: x in f}} /= {car(x): x in f}
    SIMPLF ==> Stat1: {cdr([cdr(x),car(x)]): x in f} /= {car(x): x in f}
    y-->Stat1 ==> (y in f) & (cdr([cdr(y),car(y)]) /= car(y))
    Discharge ==> domain(inv(f)) /= range(f)
--
-- But $domain(inv(f)) /= range(f)$ leads to the third set inequality seen below, and through it to
-- the impossible inequality $car([cdr(u),car(u)]) /= cdr(u)$,
-- a contradiction which proves our theorem.
--
    Use_def(range) ==> domain(inv(f)) /= {cdr(x): x in f}
    Use_def(domain) ==> {car(x): x in inv(f)} /= {cdr(x): x in f}
    EQUAL ==> {car(x): x in {[cdr(x),car(x)]: x in f}} /= {cdr(x): x in f}
    SIMPLF ==> Stat2: {car([cdr(x),car(x)]): x in f} /= {cdr(x): x in f}
    u-->Stat2 ==> car([cdr(u),car(u)]) /= cdr(u)
    Discharge ==> QED
--
-- Next we show that the iterated inverse of a map is the map itself.
-- This follows in an elementary way from the definitions involved,
-- by an evident set-theoretic simplification.
--
Theorem 100: [Double inverse map] Is_map(F) ¥imp (F = inv(inv(F))). Proof:
    Suppose_not(f) ==> Is_map(f) & (f /= inv(inv(f)))
    Use_def(Is_map) ==> (f = {[car(x),cdr(x)]: x in f}) & (f /= inv(inv(f)))
    Use_def(inv) ==> (f = {[car(x),cdr(x)]: x in f}) &
	(f /= {[cdr(x),car(x)]: x in {[cdr(y),car(y)]: y in f}})
    SIMPLF ==> {[cdr(x),car(x)]: x in {[cdr(y),car(y)]: y in f}} = {[cdr([cdr(y),car(y)]),car([cdr(y),car(y)])]: y in f}
    Set_monot ==> {[cdr([cdr(y),car(y)]),car([cdr(y),car(y)])]: y in f} = {[car(y),cdr(y)]: y in f}
    ELEM ==> f /= {[car(x),cdr(x)]: x in f}
    Discharge ==> QED
--
-- The following theorem tells us that if a map is one-to-one, so is its inverse.
-- The result follows easily by use of the two preceding theorems and use of the $one_1_test$
-- THEORY given earlier.
--
Theorem 101: [Inverse of a one-one map]
    one_1_map(F) ¥imp (one_1_map(inv(F)) & (F = inv(inv(F))) & (range(inv(F)) = domain(F)) & (domain(inv(F)) = range(F))). Proof:
    Suppose_not(f) ==>
	Stat1: one_1_map(f) & (not ((one_1_map(inv(f)) & (f = inv(inv(f))) & (range(inv(f)) = domain(f)) & (domain(inv(f)) = range(f)))))
  	Use_def(one_1_map) ==> Svm(f)
    Use_def(Svm) ==> Is_map(f)
 --
-- Suppose that one of the assertions of our theorem is false. Theorem 99 and Theorem 100
-- this can only be the assertion concerning one-to-one-ness of $inv(f)$.
--
    f-->T99 ==> not (one_1_map(inv(f)) & (f = inv(inv(f))))
    Suppose ==> one_1_map(inv(f))
    Use_def(one_1_map) ==> Svm(inv(f))
    f-->T100 ==> f = inv(inv(f))
    Discharge ==> not one_1_map(inv(f))
    Use_def(inv) ==> not one_1_map({[cdr(x),car(x)]: x in f})
--
-- Since $inv(f)$ can be expressed as a setformer, the $one_1_test$ theory given earlier
-- tells us that $f$ must have elements $x$ and $y$ for which
-- $cdr(x) = cdr(y)$ and $x = y$ are inequivalent.
--
    APPLY(x6_thryvar:x,y6_thryvar:y) one_1_test(a(x)->car(x),b(x)->cdr(x),s->f) ==> (((x in f) & (y in f) &
	(not((cdr(x) = cdr(y)) ¥eq (car(x) = car(y))))) or one_1_map({[cdr(x),car(x)]: x in f}))
    ELEM ==> not((cdr(x) = cdr(y)) ¥eq (car(x) = car(y)))
--
-- But using the definition of $one_1_map$ we see at once that this is impossible,
-- a contradiction which proves our theorem.
--
    Use_def(one_1_map) ==> Svm(f) & Stat2: (FORALL x in f, y in f | (cdr(x) = cdr(y)) ¥imp (x = y))
    Use_def(Svm) ==> Is_map(f) & Stat3: (FORALL x in f, y in f | (car(x) = car(y)) ¥imp (x = y))
    (x,y)-->Stat2 ==> (cdr(x) = cdr(y)) ¥imp (x = y)
    (x,y)-->Stat3 ==> (car(x) = car(y)) ¥imp (x = y)
    EQUAL ==> (x = y) ¥imp (car(x) = car(y))
    Discharge ==> QED
--
-- Next we prove that for any one-to-one map, the inverse map is a functional left inverse.
--
Theorem 102: [Inverse image of an element] (one_1_map(F) & (X in domain(F))) ¥imp (inv(F)~[F~[X]] = X). Proof:
    Suppose_not(f,x) ==> one_1_map(f) & (x in domain(f)) & (inv(f)~[f~[x]] /= x)
--
-- We proceed by contradiction. Suppose that the 1-1 map $f$ has a domain element
-- $car(c)$ such that $inv(f)~[f~[car(c)]]$ = $inv(f)~[cdr(c)] /= car(c)$, where $c in f$.
--
    Use_def(domain) ==> Stat1: x in {car(y): y in f}
    c-->Stat1 ==> (c in f) & (x = car(c))
    Use_def(one_1_map) ==> Svm(f)
    (f,c)-->T74 ==> f~[car(c)] = cdr(c)
    EQUAL ==> Stat2: inv(f)~[cdr(c)] /= car(c)
--
-- Theorem 101 tells us that $inv(f)$ is a 1-1 map, and thus single-valued.
-- $[cdr(c),car(c)]$ must clearly belong to $inv(f)$. But then Theorem 74 tells us that
-- $(inv(f)~[car([cdr(c),car(c)])]) = cdr([cdr(c),car(c)])$.
-- This simplifies to $inv(f)~[cdr(c)] = car(c)$, contradicting our initial assumption,
-- and so proving the present theorem.
--
    f-->T101 ==> one_1_map(inv(f))
    Use_def(one_1_map) ==> Svm(inv(f))
    Suppose ==> [cdr(c),car(c)] notin inv(f)
    Use_def(inv) ==> Stat3: [cdr(c),car(c)] notin {[cdr(x),car(x)]: x in f}
    c-->Stat3 ==> (not c in f) or [cdr(c),car(c)] /= [cdr(c),car(c)]
    Discharge ==> [cdr(c),car(c)] in inv(f)
    (inv(f),[cdr(c),car(c)])-->T74 ==> (inv(f)~[car([cdr(c),car(c)])]) = cdr([cdr(c),car(c)])
    ELEM ==> car([cdr(c),car(c)]) = cdr(c)
    EQUAL ==> inv(f)~[cdr(c)] = cdr([cdr(c),car(c)])
    (Stat2)Discharge ==> QED
--
-- Our next theorem extends the preceding result by showing that
-- for elements in the range of $f$, the inverse map is a functional right inverse.
--
Theorem 103: [Inverse image of an element's map image] one_1_map(F) ¥imp
	(((X in domain(F)) ¥imp (inv(F)~[F~[X]] = X)) & ((X in range(F)) ¥imp (F~[inv(F)~[X]] = X))). Proof:
    Suppose_not(f,c) ==> one_1_map(f) &
    	Stat1: (((c in domain(f)) & (inv(f)~[f~[c]] /= c)) or ((c in range(f))  &  (f~[inv(f)~[c]] /= c)))
--
-- For, supposing the contrary, there must either be a $c$ in the domain of $f$
-- for which $inv(f)~[f~[c]] /= c$, or a $c$ in the range of $f$ for which $f~[inv(f)~[c]] /= c$.
--
    (f,c)-->T102 ==> (c in domain(f)) ¥imp (inv(f)~[f~[c]] = c)
--
-- However, Theorem 102 rules out the first possibility, and,
-- combined with Theorem 101, rules out the second possibility also,
-- thereby proving our theorem.
--
    f-->T101 ==> one_1_map(inv(f)) & (domain(inv(f)) = range(f)) & (f = inv(inv(f)))
    (inv(f),c)-->T102 ==> (c in domain(inv(f))) ¥imp (inv(inv(f))~[inv(f)~[c]] = c)
    EQUAL ==> one_1_map(inv(f)) ¥imp ((c in range(f)) ¥imp (f~[inv(f)~[c]] = c))
    Discharge ==> QED
--
-- Our next small theory captures a simplification of nested setformer
-- similar to the one performed by SIMPLF inference, but where iterators
-- occur in inverse order.
--
THEORY setformer_unravel(e(f),s,g(y))
END setformer_unravel
--
ENTER_THEORY setformer_unravel
--
Theorem setformer_unravel1: {x: y in {e(f): f in s}, x in g(y)} = {x: f in s, x in g(e(f))}. Proof:
Suppose_not ==> Stat1: {x: y in {e(f): f in s}, x in g(y)} /= {x: f in s, x in g(e(f))}
	u-->Stat1 ==> (u in {x: y in {e(f): f in s}, x in g(y)}) ¥neq (u in {x: f in s, x in g(e(f))})
	Suppose ==> Stat2: (u in {x: y in {e(f): f in s}, x in g(y)}) &
			Stat3: (u notin {x: f in s, x in g(e(f))})
		(y,x)-->Stat2(Stat2*) ==> Stat4: (y in {e(f): f in s}) & (x in g(y)) & (u = x)
		f-->Stat4(Stat2*) ==> (y = e(f)) & (f in s)
		EQUAL(Stat4*) ==> u in g(e(f))
	(f,u)-->Stat3(Stat2*) ==> false; Discharge ==> Stat5: (u in {x: f in s, x in g(e(f))}) &
			(u notin {x: y in {e(f): f in s}, x in g(y)})
	(fp,xp,e(fp),xp)-->Stat5(Stat5*) ==> Stat6: (fp in s) & Stat7: (e(fp) notin {e(f): f in s})
fp-->Stat7(Stat6*) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The following summarizes what has just been proved.
--
--DISPLAY setformer_unravel
--
--THEORY setformer_unravel(e(f),s,g(y))
--==>
--	{x: y in {e(f): f in s}, x in g(y)} = {x: f in s, x in g(e(f))}
--END setformer_unravel
--
-- ================ Basic laws concerning union-set ==================================
--
Theorem 104: [binary intersection distributes over monadic union]
	Un(F) * X = Un({y * X : y in F}). Proof:
Suppose_not(f,c) ==> Stat1: Un(f) * c /= Un({y * c : y in f})
	e-->Stat1 ==> (e in Un(f) * c) ¥neq (e in Un({y * c : y in f}))
--
-- Arguing by contradiction, assume that $f,c$ are a counterexample to
-- the desired conclusion, so that we can choose a differentiator $e$ of
-- $Un({y * c : y in f})$ and $Un(f)$; recall, then, the definitions of
-- $Un({y * c : y in f}),Un(f)$, and simplify the formulation of the
-- former.
--
	Use_def(Un({y * c : y in f})) ==> AUTO
	SIMPLF ==> Un({y * c : y in f}) = {u: y in f, u in y * c}
	Use_def(Un(f)) ==> AUTO
	Suppose ==> Stat2: (e in {u: y in f, u in y * c}) &
			(e notin {u: v in f, u in v} * c)
--
-- If we suppose that the above-chosen differentiator $e$ belongs to
-- $Un({y * c : y in f})$, we reach a contradiction.
--
		(y0,u0)-->Stat2(Stat2*) ==> Stat3:
			(e notin {u: v in f, u in v}) &
			(y0 in f) & (e in y0)
		(y0,e)-->Stat3(Stat3*) ==> false
	Discharge ==> Stat4: (e in {u: v in f, u in v}) &
		(e notin {u: y in f, u in y * c}) & (e in c)
--
-- Even more readily we get a contradiction if we assume that the
-- differentiator belongs to $Un(f) + c$.
--
	(v1,u1,v1,u1)-->Stat4(Stat4*) ==> false
	Discharge ==> QED
--
Theorem 105: [membership in unionset] (X in Un(Y)) ¥eq ({v in Y | X in v} /= 0). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def(Un) ==> (x0 in {u: v in y0, u in v}) ¥eq ({v in y0 | x0 in v} = 0)
	Suppose ==> Stat1: (x0 in {u: v in y0, u in v}) & ({v in y0 | x0 in v} = 0)
		(v,u,v)-->Stat1(Stat1*) ==> false
	Discharge ==> Stat2: ({v in y0 | x0 in v} /= 0) & (x0 notin {u: v in y0, u in v})
	(w,w,x0)-->Stat2(Stat2*) ==> false
	Discharge ==> QED
--
Theorem 106: [Union set of a doubleton] Un({X,Y}) = (X + Y). Proof:
Suppose_not(u,v) ==> AUTO
	Use_def(Un) ==> Stat1: {x: y in {u,v}, x in y} /= (u + v)
	c-->Stat1 ==> (c in {x: y in {u,v}, x in y}) ¥neq (c in (u+v))
	Suppose ==> Stat2: c in {x: y in {u,v}, x in y}
		(y,x)-->Stat2 ==> (y in {u,v}) & (c in y)
		Suppose ==> y = u
		Discharge ==> y = v
	Discharge ==> Stat3: c notin {x: y in {u,v}, x in y}
	Suppose ==> c in u
	(u,c)-->Stat3(Stat3*) ==> false; Discharge ==> c in v
(v,c)-->Stat3(Stat3*) ==> false; Discharge ==> QED
--
Theorem 107: [Union set of a singleton] Un({X}) = X. Proof:
Suppose_not(x) ==> AUTO
	(x,x)-->T106 ==> (Un({x,x}) = x) & ({x,x} = {x})
EQUAL ==> false; Discharge ==> QED
--
Theorem 108: [Recursive relationship for the union set] (Un(0) = 0) & ((X in M) ¥imp (Un(M) = (X + Un(M - {X})))). Proof:
--
-- For, if not, there would be a counterexample $m$ to the second part of the
-- statement, since the first part of the statement trivially follows from
-- the very definition of the union-set operator.
--
Suppose_not(x0,m) ==> AUTO
	Suppose ==> Un(0) /= 0
		Use_def(Un) ==> Stat1: {x: y in 0, x in y} ¥nincin 0
		(y1,x1)-->Stat1 ==> false
--
-- Every non-null set $m$, and in particular our counterexample, can be
-- decomposed as disjoint union $m = {x} + (m - {x})$, where $x$ is any
-- member of $m$.
--
	Discharge ==> Stat3: (m = ({x0} + (m - {x0}))) & (Un(m) /= (x0 + Un(m - {x0})))
--
-- However, the union-set of the union of two disjoint sets equals the union of their
-- respective union-sets; in our case, when one of the two sets is singleton and hence
-- its member equals its union-set, this tells us that $Un(m) = x0 + Un(m-{x0})$
-- and hence leads to a contradiction.
--
	Use_def(Un)(Stat3*) ==> Stat4: {x: y in m, x in y} /= (x0 + {x: y in (m - {x0}), x in y})
	b-->Stat4(Stat4*) ==> Stat5: ((b notin {x: y in m, x in y}) ¥eq ((b in x0) or (b in {x: y in (m - {x0}), x in y})))
	Suppose ==> Stat6: (b in {x: y in m, x in y}) & (b notin x0) & (b notin {x: y in (m - {x0}), x in y})
		(u,x)-->Stat6(Stat6*) ==> Stat7: (u in m) & (b in u) & (u in (m - {x0}))
		(w,v,u,b)-->Stat6(Stat6*) ==> Stat8: b notin u
	(Stat7,Stat8*)Discharge ==> Stat9: (b notin {x: y in m, x in y}) & ((b in x0) or (b in {x: y in (m - {x0}), x in y}))
	(x0,b)-->Stat9(Stat3,Stat9*) ==> Stat11: b in {x: y in (m - {x0}), x in y}
	(ww,xx)-->Stat11(Stat11*) ==> (ww in (m - {x0})) & (b in ww)
	(ww,b)-->Stat9(Stat9*) ==> false
	Discharge ==> QED
--
Theorem 109: [Recursive relationship for the union set, 2] (Un(0) = 0) & ((M /= 0) ¥imp (Un(M) = (arb(M) + Un(M - {arb(M)})))). Proof:
Suppose_not(m) ==> AUTO
	(arb(m),m)-->T108 ==> false
	Discharge ==> QED
--
THEORY unionset_commuter(e(x),s)
END unionset_commuter
--
ENTER_THEORY unionset_commuter
--
Theorem unionset_commuter1: [Set separation and unionset formation commute] {e(x): x in Un(s)} = Un({{e(x): x in f}: f in s}). Proof:
Suppose_not ==> Stat1: {e(x): x in Un(s)} /= Un({{e(x): x in f}: f in s})
	p-->Stat1 ==> (p in {e(x): x in Un(s)}) ¥neq (p in Un({{e(u): u in f}: f in s}))
	Use_def(Un) ==> (p in {e(x): x in {q: f in s, q in f}}) ¥neq (p in {x: y in {{e(u): u in f}: f in s}, x in y})
	APPLY() setformer_unravel(e(f)->{e(u): u in f},s->s,g(y)->y) ==>
		{x: y in {{e(u): u in f}: f in s}, x in y} = {x: f in s, x in {e(u): u in f}}
	SIMPLF ==> {x: y in {{e(u): u in f}: f in s}, x in y} = {e(u): f in s, u in f}
	SIMPLF ==> {e(x): x in {q: f in s, q in f}} = {e(q): f in s, q in f}
Discharge ==> QED
--
Theorem unionset_commuter2: [Set formation and set enumeration commute] {e(x): x in s} = Un({{e(x)}: x in s}). Proof:
Suppose_not ==> Stat1: {e(x): x in s} /= Un({{e(x)}: x in s})
	p-->Stat1 ==> (p in {e(x): x in s}) ¥neq (p in Un({{e(f)}: f in s}))
	Use_def(Un) ==> (p in {e(x): x in s}) ¥neq (p in {x: y in {{e(f)}: f in s}, x in y})
	APPLY() setformer_unravel(e(f)->{e(f)},s->s,g(y)->y) ==>
		{x: y in {{e(f)}: f in s}, x in y} = {x: f in s, x in {e(f)}}
	SIMPLF ==> {x: y in {{e(f)}: f in s}, x in y} = {x: f in s, x in {e(f)}}
	SIMPLF ==> {x: f in s, x in {e(f)}} = {e(f): f in s}
Discharge ==> QED
--
Theorem unionset_commuter3: [setformers whose iteration variable is bounded by 0 designate 0] {e(x): x in 0} = 0. Proof:
Suppose_not ==> Stat1: {e(x): x in 0} /= 0
	c-->Stat1 ==> Stat2: c in {e(x): x in 0}
d-->Stat2 ==> false; Discharge ==> QED
--
Theorem unionset_commuter4: [setformers whose iteration variable is bounded by a doubleton designate doubletons] {e(x): x in {s,T}} = {e(s),e(T)}. Proof:
Suppose_not(t) ==> AUTO
	Suppose ==> Stat1: e(s) notin {e(x): x in {s,t}}
	s-->Stat1 ==> false; Discharge ==> AUTO
	Suppose ==> Stat2: e(t) notin {e(x): x in {s,t}}
	t-->Stat2 ==> false; Discharge ==> Stat3: not({e(x): x in {s,t}} ¥incin {e(s),e(t)})
	c-->Stat3(Stat3*) ==> Stat4: (c in {e(x): x in {s,t}}) & (c /= e(s)) & (c /= e(t))
	x-->Stat4(Stat4*) ==> (x in {s,t}) & (c = e(x))
	Suppose ==> x = s
	EQUAL(Stat4) ==> false; Discharge ==> x = t
EQUAL(Stat4) ==> false; Discharge ==> QED
--
Theorem unionset_commuter5: [setformers whose iteration variable is bounded by a singleton designate singletons] {e(x): x in {s}} = {e(s)}. Proof:
Suppose_not ==> AUTO
	(s,s)-->Tunionset_commuter4 ==> {e(x): x in {s,s}} = {e(s),e(s)}
	ELEM ==> ({s,s} = {s}) & ({e(s),e(s)} = {e(s)})
EQUAL ==> false; Discharge ==> QED
--
Theorem unionset_commuter6: [split of setformer over union-bounded iterator] {e(x): x in (s + T)} = {e(x): x in s} + {e(x): x in T}. Proof:
Suppose_not(t) ==> AUTO
	APPLY() unionset_commuter(e(x)->e(x),s->{s,t}) ==>
		{e(x): x in Un({s,t})} = Un({{e(x): x in f}: f in {s,t}})
	APPLY() unionset_commuter(e(f)->{e(u): u in f},s->s) ==>
		Stat1: (FORALL t | {{e(u): u in f}: f in {s,t}} = {{e(u): u in s},{e(u): u in t}})
	t-->Stat1(Stat1*) ==> {{e(u): u in f}: f in {s,t}} = {{e(u): u in s},{e(u): u in t}}
	({e(x): x in s},{e(x): x in t})-->T106 ==> Un({{e(x): x in s},{e(x): x in t}}) = ({e(x): x in s} + {e(x): x in t})
	(s,t)-->T106 ==> Un({s,t}) = (s + t)
EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY unionset_commuter
--
--THEORY unionset_commuter(e(x),s)
--	{e(x): x in Un(s)} = Un({{e(x): x in f}: f in s})
--	{e(x): x in s} = Un({{e(x)}: x in s})
--	{e(x): x in 0} = 0
--	(FORALL t | {e(x): x in {s,t}} = {e(s),e(t)})
--	{e(x): x in {s}} = {e(s)}
--	(FORALL t | {e(x): x in (s + t)} = {e(x): x in s} + {e(x): x in t})
--END unionset_commuter
--
-- Our next theorems state that the unionset operator
-- commutes with the map inversion operator, and with
-- range and domain operations.
--
Theorem 110: [Map inversion and unionset formation commute] inv(Un(S)) = Un({inv(f): f in S}). Proof:
Suppose_not(s) ==> AUTO
	APPLY() unionset_commuter(e(x)->[cdr(x),car(x)],s->s) ==>
		{[cdr(x),car(x)]: x in Un(s)} = Un({{[cdr(x),car(x)]: x in f}: f in s})
	Use_def(inv) ==> false
	Discharge ==> QED
--
Theorem 111: [Map inversion and the union operation commute] inv(X + Y) = inv(X) + inv(Y). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def(inv) ==> Stat1: {[cdr(v),car(v)]: v in (x0 + y0)} /= ({[cdr(v),car(v)]: v in x0} + {[cdr(v),car(v)]: v in y0})
	u-->Stat1(Stat1*) ==> (u in {[cdr(v),car(v)]: v in (x0 + y0)}) ¥neq (u in ({[cdr(v),car(v)]: v in x0} + {[cdr(v),car(v)]: v in y0}))
	Suppose ==> Stat2: (u in {[cdr(v),car(v)]: v in x0}) & (u notin {[cdr(v),car(v)]: v in (x0 + y0)})
		(v0,v0)-->Stat2(Stat2*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat3: (u in {[cdr(v),car(v)]: v in y0}) & (u notin {[cdr(v),car(v)]: v in (x0 + y0)})
		(v1,v1)-->Stat3(Stat3*) ==> false
	Discharge ==> AUTO
	(Stat1*)ELEM ==> Stat4: (u in {[cdr(v),car(v)]: v in (x0 + y0)}) & (u notin {[cdr(v),car(v)]: v in x0}) & (u notin {[cdr(v),car(v)]: v in y0})
	(v2,v2,v2)-->Stat4(Stat4*) ==> false
	Discharge ==> QED
--
Theorem 112: [Range formation and unionset formation commute] range(Un(S)) = Un({range(f): f in S}). Proof:
Suppose_not(s) ==> AUTO
	APPLY() unionset_commuter(e(x)->cdr(x),s->s) ==>
		{cdr(x): x in Un(s)} = Un({{cdr(x): x in f}: f in s})
	Use_def(range) ==> false
	Discharge ==> QED
--
Theorem 113: [Domain formation and unionset formation commute] domain(Un(S)) = Un({domain(f): f in S}). Proof:
Suppose_not(s) ==> AUTO
	APPLY() unionset_commuter(e(x)->car(x),s->s) ==>
		{car(x): x in Un(s)} = Un({{car(x): x in f}: f in s})
	Use_def(domain) ==> false
	Discharge ==> QED
--
-- Also note that the domain and range of ${[x,y],[u,v]}$ are ${x,u}$ and ${y,v}$, respectively.
--
Theorem 114: [Domain and range of singleton and doubleton maps] (domain({[X,Y]}) = {X}) & (range({[X,Y]}) = {Y}) & (domain({[X,Y],[U,V]}) = {X,U}) & (range({[X,Y],[U,V]}) = {Y,V}). Proof:
Suppose_not(x0,y0,u,v) ==> AUTO
	APPLY() unionset_commuter(e(x)->car(x),s->([x0,y0])) ==>
		Stat1: {car(x): x in {[x0,y0]}} = {car([x0,y0])}
	TELEM ==> Stat2: car([x0,y0]) = x0
	Use_def(domain)(Stat3*) ==> Stat3: domain({[x0,y0]}) = {car(x): x in {[x0,y0]}}
	EQUAL(Stat1) ==> domain({[x0,y0]}) = {x0}
	APPLY() unionset_commuter(e(x)->cdr(x),s->([x0,y0])) ==>
		Stat4: {cdr(x): x in {[x0,y0]}} = {cdr([x0,y0])}
	TELEM ==> Stat5: cdr([x0,y0]) = y0
	Use_def(range)(Stat6*) ==> Stat6: range({[x0,y0]}) = {cdr(x): x in {[x0,y0]}}
	EQUAL(Stat4) ==> range({[x0,y0]}) = {y0}
	APPLY() unionset_commuter(e(x)->car(x),s->([x0,y0])) ==>
		Stat7: (FORALL t | {car(x): x in {[x0,y0],t}} = {car([x0,y0]),car(t)})
	([u,v])-->Stat7(Stat7*) ==> Stat8: {car(x): x in {[x0,y0],[u,v]}} = {car([x0,y0]),car([u,v])}
	TELEM ==> Stat9: car([u,v]) = u
	Use_def(domain)(Stat10*) ==> Stat10: domain({[x0,y0],[u,v]}) = {car(x): x in {[x0,y0],[u,v]}}
	EQUAL(Stat8,Stat9,Stat10,Stat2) ==> domain({[x0,y0],[u,v]}) = {x0,u}
	APPLY() unionset_commuter(e(x)->cdr(x),s->([x0,y0])) ==>
		Stat11: (FORALL t | {cdr(x): x in {[x0,y0],t}} = {cdr([x0,y0]),cdr(t)})
	([u,v])-->Stat11(Stat11*) ==> Stat12: {cdr(x): x in {[x0,y0],[u,v]}} = {cdr([x0,y0]),cdr([u,v])}
	TELEM ==> Stat13: cdr([u,v]) = v
	Use_def(range)(Stat14*) ==> Stat14: range({[x0,y0],[u,v]}) = {cdr(x): x in {[x0,y0],[u,v]}}
	EQUAL(Stat12,Stat13,Stat14,Stat5) ==> range({[x0,y0],[u,v]}) = {y0,v}
	Discharge ==> QED
--
--
-- Inverse maps often occur together with identity maps,
-- whose (entirely elementary) properties are collected in the following theorem.
--
Theorem 115: [Elementary properties of identity maps]
	one_1_map(ident(S)) & (domain(ident(S)) = S) & (range(ident(S)) = S) & (inv(ident(S)) = ident(S)) &
	 ((X in S) ¥imp (ident(S)~[X] = X)) &
	(Is_map(F) ¥imp (((domain(F) ¥incin S) ¥imp (F @ ident(S) = F)) & ((range(F) ¥incin S) ¥imp (ident(S) @ F = F)))). Proof:
    Suppose_not(s,x,f) ==> Stat1: (not one_1_map(ident(s))) or (domain(ident(s)) /= s) or (range(ident(s)) /= s) or
	(inv(ident(s)) /= ident(s)) or ((x in s) & (ident(s)~[x] /= x)) or
	(Is_map(f) & (domain(f) ¥incin s) & ((f @ ident(s)) /= f)) or
	(Is_map(f) & (range(f) ¥incin s) & ((ident(s) @ f) /= f))
--
-- Proceeding by contradiction, we shall show successively
-- that none of the clauses of our theorem can be false.
-- Indeed, it follows immediately using the $one_1_test$ developed
-- earlier that the first clause cannot be false.
--
    Use_def(ident) ==> ident(s) = {[x,x]: x in s}
    APPLY(x6_thryvar:xx,y6_thryvar:y) one_1_test(a(x)->x,b(x)->x,s->s) ==>
    		((not((xx = y) ¥eq (xx = y))) or one_1_map({[x,x]: x in s}))
    ELEM ==> one_1_map({[x,x]: x in s})
    EQUAL ==> Stat2: one_1_map(ident(s))
--
-- In equally direct fashion, our 'fcn_symbol' theory tells us that neither the second, the
-- third, or the fifth clause of our theorem can be false.
-- --    (FORALL x in OM | (x in s) ¥imp (g~[x] = f(x)))
--    (FORALL x in OM | (x notin s) ¥imp (g~[X] = 0))
--    (FORALL x in OM | g~[x] = if x in s then f(x) else 0 end if)
--
    APPLY(x9_thryvar:u,y9_thryvar:v) fcn_symbol(f(x)->x,g->ident(s),s->s) ==>
	Svm(ident(s)) & (range(ident(s)) = {x: x in s}) & (domain(ident(s)) = s) &
		Stat3: (FORALL x | (x in s) ¥imp (ident(s)~[x] = x)) &
				(((u in s) & (v in s) & (u = v) & (v /= v)) or one_1_map(ident(s)))
    x-->Stat3 ==> (x in s) ¥imp (ident(s)~[x] = x)
    SIMPLF ==> Stat4: (range(ident(s))) = s
    (Stat2)ELEM ==> (range(ident(s)) = s) & (domain(ident(s)) = s) & ((x in domain(ident(s))) ¥imp (ident(s)~[x] = x)) & one_1_map(ident(s))
--
-- We hence see that the only clauses of our original assumption which could be false are
-- the fourth clause and the two final clauses.
--
	(Stat2)ELEM ==> Stat5: (range(ident(s)) = s) & (domain(ident(s)) = s) & ((x in domain(ident(s))) ¥imp (ident(s)~[x] = x)) & one_1_map(ident(s))
	EQUAL ==> Stat6: (range(ident(s)) = s) & (domain(ident(s)) = s) & ((x in s) ¥imp (ident(s)~[x] = x)) & one_1_map(ident(s))
    (Stat1,Stat6)ELEM ==> Stat7: ((inv(ident(s)) /= ident(s)) or
    	(Is_map(f) & (domain(f) ¥incin s) & ((f @ ident(s)) /= f))
	 or (Is_map(f) & (range(f) ¥incin s) & ((ident(s) @ f) /= f)))
--
-- Use of the definition of $inv$ and an elementary simplification
-- shows immediately that the fourth clause cannot be false.
--
    Suppose ==> inv(ident(s)) /= ident(s)
    Use_def(ident) ==> inv({[x,x]: x in s}) /= {[x,x]: x in s}
    Use_def(inv) ==> {[cdr(y),car(y)]: y in {[x,x]: x in s}} /= {[x,x]: x in s}
    SIMPLF ==> Stat8: {[cdr([x,x]),car([x,x])]: x in s} /= {[x,x]: x in s}
    d-->Stat8 ==> Stat9: [cdr([d,d]),car([d,d])] /= [d,d]
    (Stat9)Discharge ==> inv(ident(s)) = ident(s)
--
-- Thus only one of the last two of our original clauses need be considered.
-- In both of these cases $f$ is a map.
--
    (Stat7)ELEM ==> Stat10: (Is_map(f) & (domain(f) ¥incin s) & ((f @ ident(s)) /= f))
	 or (Is_map(f) & (range(f) ¥incin s) & ((ident(s) @ f) /= f))
    (Stat10)ELEM ==> Stat11: Is_map(f)
--
-- Consider the first of these possibilities, and expand the definitions involved,
-- thereby showing that there exists a $c$ for which the conditions $c in f$
-- and $c in {[z,cdr(y)]: z in s, y in f | z = car(y)}$ are inequivalent.
--
    Suppose ==> Stat12: ((domain(f) ¥incin s) & (f @ ident(s) /= f))
    Use_def(@) ==> {[car(x),cdr(y)]: x in ident(s), y in f | cdr(x) = car(y)} /= f
    Use_def(ident) ==> {[car(x),cdr(y)]: x in {[z,z]: z in s}, y in f | cdr(x) = car(y)} /= f
    SIMPLF ==> {[car(x),cdr(y)]: x in {[z,z]: z in s}, y in f | cdr(x) = car(y)} =
    				{[car([z,z]),cdr(y)]: z in s, y in f | cdr([z,z]) = car(y)}
    Set_monot ==> {[car([z,z]),cdr(y)]: z in s, y in f | cdr([z,z]) = car(y)} = {[z,cdr(y)]: z in s, y in f | z = car(y)}
    ELEM ==> Stat13: {[z,cdr(y)]: z in s, y in f | z = car(y)} /= f
    c-->Stat13 ==> ((c in {[z,cdr(y)]: z in s, y in f | z = car(y)}) & (c notin f)) or
	((c notin {[z,cdr(y)]: z in s, y in f | z = car(y)}) & (c in f))
--
-- In the first of the two resulting cases it follows, using Theorem 51, that
-- $c$ is both a member and not a member of $f$, a contradiction which rules out this case,
-- leaving only the case $c in f$.
--
    Suppose ==> Stat14: (c in {[z,cdr(y)]: z in s, y in f | z = car(y)}) & (c notin f)
    (a,b)-->Stat14 ==> Stat15: (c = [a,cdr(b)]) & (a in s) & (b in f) & (a = car(b)) & (c notin f)
    (f,b)-->T51 ==> b = [car(b),cdr(b)]
    (Stat15)Discharge ==> Stat16: (c notin {[z,cdr(y)]: z in s, y in f | z = car(y)}) & (c in f)
--
-- But in this case a contradiction follows immediately from Theorem 51,
-- leaving out for final consideration only the case $(range(f) ¥incin s) & ((ident(s) @ f) /= f)$.
--
    (f,c)-->T51 ==> c = [car(c),cdr(c)]
    (car(c),c)-->Stat16 ==> Stat17: (c in f) & (car(c) notin s)
    (Stat17,Stat12)ELEM ==> Stat18: (c in f)  & (car(c) notin domain(f))
    Use_def(domain) ==> Stat19: car(c) notin {car(x): x in f}
    c-->Stat19 ==> not((c in f) & (car(c)= car(c)))
    Discharge ==> Stat20: (range(f) ¥incin s) & ((ident(s) @ f) /= f)
--
-- By expanding the definitions involved, we see that there must exist an element $e$ for which
-- the conditions $e in f$ and $e in {[car(x),z]: x in f, z in s | cdr(x) = z}$ are inequivalent.
--
    Use_def(@) ==> {[car(x),cdr(y)]: x in f, y in ident(s) | cdr(x) = car(y)} /= f
    Use_def(ident) ==> {[car(x),cdr(y)]: x in f, y in {[z,z]: z in s} | cdr(x) = car(y)} /= f
    SIMPLF ==> {[car(x),cdr(y)]: x in f, y in {[z,z]: z in s} | cdr(x) = car(y)} =
    					{[car(x),cdr([z,z])]: x in f, z in s | cdr(x) = car([z,z])}
    Set_monot ==> {[car(x),cdr([z,z])]: x in f, z in s | cdr(x) = car([z,z])} = {[car(x),z]: x in f, z in s | cdr(x) = z}
    ELEM ==> Stat21: {[car(x),z]: x in f, z in s | cdr(x) = z} /= f
    e-->Stat21 ==> ((e in {[car(x),z]: x in f, z in s | cdr(x) = z}) & (e notin f)) or
	((e notin {[car(x),z]: x in f, z in s | cdr(x) = z}) & (e in f))
--
-- In the first of the two resulting cases it follows, using Theorem 51, that
-- $e$ is both a member and not a member of $f$, a contradiction which rules out this case,
-- leaving only the case $e in f$.
--
    Suppose ==> Stat22: (e in {[car(x),z]: x in f, z in s | cdr(x) = z}) & (e notin f)
    (aa,bb)-->Stat22 ==> (e = [car(aa),bb]) & (aa in f) & (bb in s) & (cdr(aa)=bb) & (e notin f)
    (f,aa)-->T51 ==> aa = [car(aa),cdr(aa)]
    (Stat22)Discharge ==> Stat23: (e notin {[car(x),z]: x in f, z in s | cdr(x) = z}) & (e in f)
--
-- But in this case a contradiction follows immediately from Theorem 51,
-- proving our theorem.
--
    (f,e)-->T51 ==> e = [car(e),cdr(e)]
    (e,cdr(e))-->Stat23 ==> Stat24: (e in f) & (cdr(e) notin s)
    (Stat24,Stat20)ELEM ==> (e in f)  & (cdr(e) notin range(f))
    Use_def(range) ==> Stat25: cdr(e) notin {cdr(x): x in f}
    e-->Stat25 ==> not((e in f) & (cdr(e)= cdr(e)))
    Discharge ==> QED
--
Theorem 116: [Composition with an identity map is restriction] (Is_map(F)) ¥imp (F @ ident(S) = F ¥ON S). Proof:
	Suppose_not(f,s) ==> Is_map(f) & (f @ ident(s) /= f ¥ON s)
	Use_def(ident) ==> f @ ident(s) = f @ {[u,u]: u in s}
	Use_def(@) ==> {[car(x),cdr(y)]: x in {[u,u]: u in s}, y in f | cdr(x) = car(y)} = f @ {[u,u]: u in s}
	SIMPLF ==> {[car([u,u]),cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)} = {[car(x),cdr(y)]: x in {[u,u]: u in s}, y in f | cdr(x) = car(y)}
	Suppose ==> Stat1: {[car([u,u]),cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)} /= {[u,cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)}
	(u,y)-->Stat1 ==> false; Discharge ==> {[car([u,u]),cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)} = {[u,cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)}
	Suppose ==> Stat2: {[u,cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)} /= {[u,cdr(y)]: u in s, y in f | u = car(y)}
	(u1,y1)-->Stat2 ==> false; Discharge ==> {[u,cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)} = {[u,cdr(y)]: u in s, y in f | u = car(y)}
	ELEM ==> {[u,cdr(y)]: u in s, y in f | u = car(y)} /= f ¥ON s
	Suppose ==> Stat3: {[u,cdr(y)]: u in s, y in f | u = car(y)} /= {[car(y),cdr(y)]: y in f | car(y) in s}
		c-->Stat3 ==> not((c in {[u,cdr(y)]: u in s, y in f | u = car(y)}) ¥eq (c in {[car(y),cdr(y)]: y in f | car(y) in s}))
		Suppose ==> Stat4: (c in {[u,cdr(y)]: u in s, y in f | u = car(y)}) & Stat5: (not(c in {[car(y),cdr(y)]: y in f | car(y) in s}))
			(u2,y2)-->Stat4 ==> (u2 in s) & (y2 in f) & (c = [u2,cdr(y2)]) & (u2 = car(y2))
			ELEM ==> (car(y2) in s) & (y2 in f) & (c = [car(y2),cdr(y2)])
		y2-->Stat5 ==> false; Discharge ==> Stat6: (not(c in {[u,cdr(y)]: u in s, y in f | u = car(y)})) & Stat7: (c in {[car(y),cdr(y)]: y in f | car(y) in s})
		y3-->Stat7 ==> (y3 in f) & (c = [car(y3),cdr(y3)]) & (car(y3) in s)
	(car(y3),y3)-->Stat6(Stat6) ==> false; Discharge ==> Stat8: {[car(y),cdr(y)]: y in f | car(y) in s} /= f ¥ON s
	Use_def(Is_map) ==> f = {[car(y),cdr(y)]: y in f}
	EQUAL ==> Stat9: f ¥ON s = {[car(y),cdr(y)]: y in f} ¥ON s
	Use_def(¥ON) ==> Stat10: {[car(y),cdr(y)]: y in f} ¥ON s = {u in {[car(y),cdr(y)]: y in f} | car(u) in s}
	SIMPLF ==> {u in {[car(y),cdr(y)]: y in f} | car(u) in s} = {[car(y),cdr(y)]: y in f | car([car(y),cdr(y)]) in s}
	ELEM ==> Stat11: {[car(y),cdr(y)]: y in f | car([car(y),cdr(y)]) in s} /= {[car(y),cdr(y)]: y in f | car(y) in s}
	y4-->Stat11 ==> car([car(y),cdr(y)]) /= car(y)
    Discharge ==> QED
--
-- Next we prove that the product of the inverse of a single-valued map $f$
-- by the map itself is the identity map on the range of $f$.
--
Theorem 117: [Composition with the inverse map] Svm(F) ¥imp (F @ inv(F) = ident(range(F))). Proof:
    Suppose_not(f) ==> Svm(f) & (f @ inv(f) /= ident(range(f)))
--
-- For suppose that there is a counterexample to our theorem, and then expand and simplify
-- all the definitions involved, getting the set-theoretic inequality seen below.
--
    Use_def(ident) ==> f @ inv(f) /= {[x,x]: x in range(f)}
    Use_def(range) ==> f @ inv(f) /= {[x,x]: x in {cdr(y): y in f}}
    SIMPLF ==> f @ inv(f) /= {[cdr(x),cdr(x)]: x in f}
    Use_def(@) ==>
	{[car(x),cdr(y)]: x in inv(f), y in f | cdr(x) = car(y)} /= {[cdr(x),cdr(x)]: x in f}
    Use_def(inv) ==>
	{[car(x),cdr(y)]: x in {[cdr(u),car(u)]: u in f}, y in f | cdr(x) = car(y)}
	/= {[cdr(x),cdr(x)]: x in f}
    SIMPLF ==> {[car(x),cdr(y)]: x in {[cdr(u),car(u)]: u in f}, y in f | cdr(x) = car(y)}  =
    					{[car([cdr(u),car(u)]),cdr(y)]: u in f, y in f | cdr([cdr(u),car(u)]) = car(y)}
    Set_monot ==> {[car([cdr(u),car(u)]),cdr(y)]: u in f, y in f | cdr([cdr(u),car(u)]) = car(y)} =
    					{[cdr(u),cdr(y)]: u in f, y in f | car(u) = car(y)}
    ELEM ==> Stat1: {[cdr(x),cdr(y)]: x in f, y in f | car(x) = car(y)} /= {[cdr(x),cdr(x)]: x in f}
--
-- Since the sets displayed are not equal, there is a $c$ that is in one but not the other.
-- If it is in the first of these two sets but not the second, a contradiction results from
-- the assumed single-valuedness of $f$, ruling out this case.
--
     c-->Stat1 ==> Stat2: (((c in {[cdr(x),cdr(y)]: x in f, y in f | car(x) = car(y)}) & (c notin {[cdr(x),cdr(x)]: x in f})) or
	((c notin {[cdr(x),cdr(y)]: x in f, y in f | car(x) = car(y)}) & (c in {[cdr(x),cdr(x)]: x in f})))
     Suppose ==> Stat3: (c in {[cdr(x),cdr(y)]: x in f, y in f | car(x) = car(y)}) & Stat4: (c notin {[cdr(x),cdr(x)]: x in f})
     (a,b)-->Stat3 ==> Stat5: (a in f) & (b in f) & (c = [cdr(a),cdr(b)]) & (car(a) = car(b))
     b-->Stat4(Stat5*) ==> Stat6: (c /= [cdr(b),cdr(b)]) & (c = [cdr(a),cdr(b)])
     (Stat6)ELEM ==> a /= b
     Use_def(Svm) ==> Stat7: (FORALL x in f, y in f | (car(x) = car(y)) ¥imp (x = y))
	 (a,b)-->Stat7 ==> false; Discharge ==>
	Stat8: (c notin {[cdr(x),cdr(y)]: x in f, y in f | car(x) = car(y)}) & Stat9: (c in {[cdr(x),cdr(x)]: x in f})
--
-- But in the remaining case $c$ has the form $[cdr(d),cdr(d)]$ for some $d in f$,
-- and a contradiction results in much the same way, proving our theorem.
--
	(d)-->Stat9 ==> (c = [cdr(d),cdr(d)]) & (d in f)
	(d,d)-->Stat8 ==> false; Discharge ==> QED
--
-- Next we extend Theorem 117: if a single-valued map $f$ is 1-1, the product of
-- its inverse by $f$ is also the identity map on the domain of $f$.
--
Theorem 118: [Inverses of one-one maps] one_1_map(F) ¥imp (((F @ inv(F)) = ident(range(F))) & ((inv(F) @ F) = ident(domain(F)))). Proof:
    Suppose_not(f) ==> one_1_map(f) & ((f @ inv(f)) /= ident(range(f)) or ((inv(f) @ f) /= ident(domain(f))))
--
-- This follows by simple algebraic reasoning using Theorem 99, Theorem 100, Theorem 101, and Theorem 117.
--
    Use_def(one_1_map) ==> Svm(f)
    Use_def(Svm) ==> Is_map(f)
    f-->T117 ==> inv(f) @ f /= ident(domain(f))
    f-->T101 ==> one_1_map(inv(f))
    f-->T99 ==> range(inv(f)) = domain(f)
    f-->T100 ==> inv(inv(f)) = f
    Use_def(one_1_map) ==> Svm(inv(f))
    (inv(f))-->T117 ==> inv(f) @ inv(inv(f)) = ident(range(inv(f)))
    EQUAL ==> inv(f) @ f = ident(domain(f))
    Discharge ==> QED
--
-- Our next aim, which we will reach in several steps, is to prove a kind of converse to Theorem 118:
-- mutually inverse maps are each other's inverses.
--
Theorem 119: [Product of inverses lemma]
	(Is_map(F) & Is_map(G) & (domain(F) ¥incin range(G)) & Svm(F @ G)) ¥imp Svm(F). Proof:
	Suppose_not(f,g) ==> Stat1: Is_map(f) & Is_map(g) & (domain(f) ¥incin range(g)) & Svm(f @ g) & (not(Svm(f)))
--
-- First we show that if the product $f @ g$ of two maps is single valued,
-- and if the range of $g$ includes the domain of $f$, then the map $f$ must be single valued.
-- For suppose that a counterexample exists, and apply the utility theory $Svm_test$.
--
	Use_def(Is_map) ==> f = {[car(x),cdr(x)]: x in f}
	APPLY(x3_thryvar:x,y3_thryvar:y) Svm_test(a(x)->car(x),b(x)->cdr(x),s->f) ==>
		(((x in f) & (y in f) & (car(x) = car(y)) & (cdr(x) /= cdr(y))) or Svm({[car(x),cdr(x)]: x in f}))
	EQUAL ==> (((x in f) & (y in f) & (car(x) = car(y)) & (cdr(x) /= cdr(y))) or Svm(f))
--
-- This tells us that there are elements $x$, $y$ in $f$ with $car(x) = car(y)$
-- such that $cdr(x) /= cdr(y)$.
--
	ELEM ==> Stat2: (x in f) & (y in f) & (car(x) = car(y)) & (cdr(x) /= cdr(y))
	Suppose ==> car(x) notin domain(f)
	Use_def(domain) ==> Stat3: car(x) notin {car(u): u in f}
	x-->Stat3 ==> false; Discharge ==> car(x) in range(g)
--
-- Therefore $car(x) = car(y)$ must have the form $cdr(u)$, where $u$ belongs to $g$.
-- It follows that $[car(u),cdr(x)]$ and $[car(u),cdr(y)]$ both belong to $f @ g$.
--
	Use_def(range) ==> Stat4: (car(x) in {cdr(u): u in g})
	u-->Stat4 ==> Stat5: (car(x) = cdr(u)) & (u in g)
	Suppose ==> [car(u),cdr(x)] notin (f @ g)
	Use_def(@) ==> Stat6: [car(u),cdr(x)] notin {[car(v),cdr(w)]: v in g, w in f | cdr(v) = car(w)}
	(u,x)-->Stat6 ==> Stat7: (u notin g or x notin f or [car(u),cdr(x)] /= [car(u),cdr(x)]
		or cdr(u) /= car(x))
	(Stat7,Stat2,Stat5*)Discharge ==> [car(u),cdr(x)] in (f @ g)
	Suppose ==> [car(u),cdr(y)] notin (f @ g)
	Use_def(@) ==> Stat8: [car(u),cdr(y)] notin {[car(v),cdr(w)]: v in g, w in f | cdr(v) = car(w)}
	(u,y)-->Stat8 ==> Stat9: (u notin g or y notin f or [car(u),cdr(y)] /= [car(u),cdr(y)]
		or cdr(u) /= car(y))
	(Stat9,Stat2,Stat5*)Discharge ==> [car(u),cdr(y)] in (f @ g)
--
-- But now, since $f @ g$ is single-valued, it follows that $[car(u),cdr(x)] = [car(u),cdr(y)]$
-- contrary to our initial assumption. This contradiction proves the present theorem.
--
    Use_def(Svm) ==> Stat10: (FORALL x in (f @ g), y in (f @ g) | ((car(x) = car(y)) ¥imp (x = y)))
    ([car(u),cdr(x)],[car(u),cdr(y)])-->Stat10 ==> Stat11: (car(x) = car(y)) ¥imp (x = y)
    (Stat2,Stat11)Discharge ==> QED
--
-- The following proof shows that the inverse of a product map is the
-- product of the inverses, taken in the reverse order.
--
Theorem 120: [Product of Inverses] (Is_map(F) & Is_map(G)) ¥imp (inv(F @ G) = inv(G) @ inv(F)). Proof:
Suppose_not(f,g) ==> Is_map(f) & Is_map(g) & (inv(f @ g) /= inv(g) @ inv(f))
--
-- For if we expand all the definitions involved, simplify, and reverse the order of the bound
-- variables in the setformers which appear, we get the set inequality seen below.
--
	Use_def(Is_map) ==> (f = {[car(x),cdr(x)]: x in f}) &
	(g = {[car(x),cdr(x)]: x in g}) & (inv(f @ g) /= inv(g) @ inv(f))
	Use_def(@) ==> inv({[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}) /=
			{[car(x),cdr(y)]: x in inv(f), y in inv(g) | cdr(x) = car(y)}
	Use_def(inv) ==> {[cdr(u),car(u)]: u in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}} /=
	{[car(x),cdr(y)]: x in {[cdr(u),car(u)]: u in f}, y in {[cdr(v),car(v)]: v in g} | cdr(x) = car(y)}
	SIMPLF ==> {[cdr([car(x),cdr(y)]),car([car(x),cdr(y)])]: x in g, y in f | cdr(x) = car(y)}  /=
	{[car([cdr(u),car(u)]),cdr([cdr(v),car(v)])]:  u in f, v in g | cdr([cdr(u),car(u)]) = car([cdr(v),car(v)])}
	Set_monot ==> {[cdr([car(x),cdr(y)]),car([car(x),cdr(y)])]: x in g, y in f | cdr(x) = car(y)} =
		{[cdr(y),car(x)]: x in g, y in f | cdr(x) = car(y)}
	Set_monot ==> {[car([cdr(u),car(u)]),cdr([cdr(v),car(v)])]:  u in f, v in g | cdr([cdr(u),car(u)]) = car([cdr(v),car(v)])} =
		{[cdr(u),car(v)]:  u in f, v in g | car(u) = cdr(v)}
	ELEM ==> Stat1: {[cdr(y),car(x)]: x in g, y in f | cdr(x) = car(y)} /= {[cdr(u),car(v)]: u in f, v in g | car(u) = cdr(v)}
--
-- Thus there must exist an element $c$ which belongs to one of these two last sets but not the other,
-- say the first but not the second. his leads immediately to an elementary contradiction, ruling out this case.
--
	c-->Stat1 ==> ((c in {[cdr(y),car(x)]: x in g, y in f | cdr(x) = car(y)}) &
			(c notin {[cdr(u),car(v)]: u in f, v in g | car(u) = cdr(v)})) or
		((c notin {[cdr(y),car(x)]: x in g, y in f | cdr(x) = car(y)}) &
			(c in {[cdr(u),car(v)]: u in f, v in g | car(u) = cdr(v)}))
	Suppose ==> Stat2: (c in {[cdr(y),car(x)]: x in g, y in f | cdr(x) = car(y)}) &
			(c notin {[cdr(u),car(v)]: u in f, v in g | car(u) = cdr(v)})
	(x,y,y,x)-->Stat2 ==> (x in g) & (y in f) & (c = [cdr(y),car(x)]) &
					(not((x in g) & (y in f) & (c = [cdr(y),car(x)])))
	Discharge ==> Stat3: (c in {[cdr(u),car(v)]: u in f, v in g | car(u) = cdr(v)}) &
			(c notin {[cdr(y),car(x)]: x in g, y in f | cdr(x) = car(y)})
--
-- But the case in which $c$ belongs to the second but not the first leads to an exactly similar contradiction,
-- thereby proving that our assertion holds in every possible case.
--
	(x2,y2,y2,x2)-->Stat3 ==> (x2 in f) & (y2 in g) & (c = [cdr(x2),car(y2)]) &
					(not((x2 in f) & (y2 in g) & (c = [cdr(x2),car(y2)])))
Discharge ==> QED
--
-- Next we prove that a map is 1-1 if and only if it and its inverse are both single-valued.
--
Theorem 121: [One-one-ness and singlevaluedness] one_1_map(F) ¥eq (Svm(F) & Svm(inv(F))). Proof:
 	Suppose_not(f) ==> Stat1: not(one_1_map(f) ¥eq (Svm(f) & Svm(inv(f))))
--
-- Suppose the contrary, and first consider the case in which $f$ and $inv(f)$
-- are both single-valued, but f is not 1-1, so that by definition there exist
-- distinct elements of the form $[car(u),cdr(u)]$ with $u in f$ having identical
-- second components but different first components.
--
 	Suppose ==> Svm(f) & Svm(inv(f))
 	Use_def(one_1_map) ==> Stat2: not (FORALL x in f, y in f | (cdr(x) = cdr(y)) ¥imp (x = y))
 	(x,y)-->Stat2 ==> Stat3: (x in f) & (y in f) & (cdr(x) = cdr(y)) & (x /= y)
 	Use_def(Svm) ==> Is_map(f)
 	Use_def(Is_map) ==> Stat4: x in {[car(u),cdr(u)]: u in f}
 	Use_def(Is_map) ==> Stat5: y in {[car(u),cdr(u)]: u in f}
 	u-->Stat4 ==> Stat6: (x = [car(u),cdr(u)]) & (u in f)
 	v-->Stat5 ==> Stat7: (y = [car(v),cdr(v)]) & (v in f)
	(Stat3,Stat6,Stat7*)ELEM ==>
	(cdr(x) = cdr(y)) & (x /= y) & (x = [car(u),cdr(u)]) & (y = [car(v),cdr(v)])
	EQUAL ==> Stat8: (cdr([car(u),cdr(u)]) = cdr([car(v),cdr(v)])) & ([car(u),cdr(u)] /= [car(v),cdr(v)])
	(Stat8)ELEM ==> Stat9: (cdr(u) = cdr(v))
	Suppose ==> car(u) = car(v)
            EQUAL ==> [car(u),cdr(u)] = [car(v),cdr(v)]
    (Stat8*)Discharge ==> Stat10: (car(u) /= car(v))
--
-- But then, by Theorem 90, $[cdr(u),car(u)]$ and $[cdr(v),car(v)]$
-- both belong to $inv(f)$, contradicting its single-valuedness.
--
	(f,car(u),cdr(u))-->T90 ==> Stat11: [cdr(u),car(u)] in inv(f)
	(f,car(v),cdr(v))-->T90 ==> Stat12: [cdr(v),car(v)] in inv(f)
	Use_def(Svm) ==> Stat13: (FORALL x in inv(f), y in inv(f) | (car(x) = car(y)) ¥imp (x = y))
	([cdr(u),car(u)],[cdr(v),car(v)])-->Stat13 ==> Stat14: not(([cdr(u),car(u)] in inv(f)) & ([cdr(v),car(v)] in inv(f)) &
		(car([cdr(u),car(u)]) = car([cdr(v),car(v)])) & ([cdr(u),car(u)] /= [cdr(v),car(v)]))
--
-- The single, direct step
--	(Stat9,Stat10,Stat11,Stat12,Stat14)ELEM ==> false; Discharge ==> (not(Svm(f) & Svm(inv(f)))) & one_1_map(f)
-- takes very long, and therefore we expand it into the following five steps.
--
	(Stat11,Stat12,Stat14*)ELEM ==> Stat15: (car([cdr(u),car(u)]) /= car([cdr(v),car(v)])) or ([cdr(u),car(u)] = [cdr(v),car(v)])
	Suppose ==> Stat16: car([cdr(u),car(u)]) /= car([cdr(v),car(v)])
	(Stat9,Stat16)Discharge ==> Stat17: car([cdr(u),car(u)]) = car([cdr(v),car(v)])
	(Stat15,Stat17*)ELEM ==> Stat18: [cdr(u),car(u)] = [cdr(v),car(v)]
	(Stat10,Stat18)ELEM ==> false; Discharge ==> (not(Svm(f) & Svm(inv(f)))) & one_1_map(f)
--
-- Next consider the case in which $f$ is 1-1, but $f$ and $inv(f)$ are not both single-valued.
-- By definition of 'one_1_map', it must be $inv(f)$ that is not single valued,
-- so that there must exist distinct $xx$ and $yy$ in $inv(f)$ with identical first components.
-- Since these are in effect distinct elements of $f$ with identical second components,
-- they violate the fact that $f$ is 1-1, a contradiction which
-- completes the proof of the present theorem.
--
	Use_def(one_1_map) ==> not(Svm(inv(f))) &
	Stat19: (FORALL x in f, y in f | ((cdr(x) = cdr(y)) ¥imp (x = y)))
	Use_def(Svm) ==>
	not(Is_map(inv(f)) & (FORALL x in inv(f), y in inv(f) | ((car(x) = car(y)) ¥imp (x = y))))
	f-->T99 ==> Stat20:
	not(FORALL x in inv(f), y in inv(f) | ((car(x) = car(y)) ¥imp (x = y)))
	(xx,yy)-->Stat20 ==> Stat21: (xx in inv(f)) & (yy in inv(f)) & (car(xx) = car(yy)) & (xx /= yy)
	Use_def(inv) ==> Stat22: xx in {[cdr(u),car(u)]: u in f}
	vv-->Stat22 ==> (xx = [cdr(vv),car(vv)]) & (vv in f)
	Use_def(inv) ==> Stat23: yy in {[cdr(u),car(u)]: u in f}
	w-->Stat23 ==> (yy = [cdr(w),car(w)]) & (w in f)
	(Stat21*)ELEM ==> Stat24: (xx /= yy) & (xx = [cdr(vv),car(vv)]) & (yy = [cdr(w),car(w)])
	Suppose ==> vv = w
	EQUAL ==> yy = [cdr(vv),car(vv)]
	(Stat24*)Discharge ==> vv /= w
	(Stat21*)ELEM ==> (car(xx) = car(yy)) & (xx = [cdr(vv),car(vv)]) & (yy = [cdr(w),car(w)])
	EQUAL ==> Stat25: car([cdr(vv),car(vv)]) = car([cdr(w),car(w)])
	(Stat25)ELEM ==> (cdr(vv) = cdr(w))
	(vv,w)-->Stat19 ==> false; Discharge ==> QED
--
-- The following theorem completes our proof that a pair of
-- mutually inverse maps are each other's inverses.
--
Theorem 122: [An inverse pair of maps must be 1-1 and must be each other's inverses]
    (Is_map(F) & Is_map(G) & (domain(F) = range(G)) & (range(F) = domain(G)) &
	(F @ G = ident(range(F))) & (G @ F = ident(domain(F)))) ¥imp (one_1_map(F) & (G = inv(F))) Proof:
    Suppose_not(f,g) ==>
	Stat1: (Is_map(f) & Is_map(g) & (domain(f) = range(g)) & (range(f) = domain(g)) &
	(f @ g = ident(range(f))) & (g @ f = ident(domain(f)))) & (not(one_1_map(f) & (g = inv(f))))
--
-- For consider a counterexample $f$, $g$. By Theorem 119, $f$ and $g$ must both must be single-valued,
-- so either $f$ is not 1-1, or $g$ is not its inverse.
-- But by Theorem 99, $g$ has the same range and domain as the inverse of $f$,
--
	(range(f))-->T115 ==> one_1_map(ident(range(f)))
	(domain(f))-->T115 ==> one_1_map(ident(domain(f)))
	EQUAL ==> one_1_map(f @ g) & one_1_map(g @ f)
	Use_def(one_1_map) ==> Svm(f @ g) & Svm(g @ f)
	(f,g)-->T119 ==> Svm(f)
	(g,f)-->T119 ==> Svm(g)
	EQUAL ==> ident(range(f)) = ident(domain(g))
	EQUAL ==> ident(domain(f)) = ident(range(g))
	f-->T99 ==> Is_map(inv(f)) & (domain(inv(f)) = range(f))
	g-->T99 ==> Is_map(inv(g)) & (range(inv(g)) = domain(g))
--
-- and by Theorem 120 $inv(f)$ has $inv(g)$ as a right inverse,
-- so that by Theorem 119 $inv(f)$ must also be single-valued.
--
	Use_def(Svm) ==> Is_map(f)
	Use_def(Svm) ==> Is_map(g)
	(g,f)-->T120 ==> inv(g @ f) = inv(f) @ inv(g)
	(range(g))-->T115 ==> one_1_map(ident(range(g))) & (inv(ident(range(g))) = ident(range(g)))
	EQUAL ==> inv(f) @ inv(g) = ident(range(g))
	Use_def(one_1_map) ==> Svm(ident(range(g)))
    EQUAL ==> Svm(inv(f) @ inv(g)) & (domain(inv(f)) = range(inv(g)))
   	(inv(f),inv(g))-->T119 ==> Svm(inv(f))
--
-- Theorem 121 tells us that $f$ must be 1-1, so only the possibility that $g /= inv(f)$ needs
-- to be considered. But since $f @ inv(f)$ and $g @ f$ are both identity maps, we can reassociate
-- to show that the triple product $g @ f @ inv(f)$ is equal to both $g$ and $inv(f)$,
-- a contradiction which proves our theorem
--
	f-->T121 ==> Stat2: one_1_map(f) & (g /= inv(f))
	f-->T118 ==> f @ inv(f) = ident(range(f))
	(range(f),junk,g)-->T115 ==>
	(Is_map(g) & (domain(g) ¥incin range(f))) ¥imp (g @ ident(range(f)) = g)
	EQUAL ==> g @ (f @ inv(f)) = g
	(g,f,inv(f))-->T66 ==> (g @ f) @ inv(f) = g
	EQUAL ==> Stat3: ident(domain(f)) @ inv(f) = g
	f-->T99 ==> Stat4: range(inv(f)) = domain(f)
	(domain(f),junk,inv(f))-->T115 ==>
	Stat5: ((range(inv(f)) ¥incin domain(f)) ¥imp (ident(domain(f)) @ inv(f) = inv(f)))
	(Stat1,Stat3,Stat4,Stat5*)ELEM ==> Stat6: inv(f) = g
    (Stat1,Stat2,Stat6*)Discharge ==> QED
--
-- The following elementary lemma expresses the restriction of a single-valued map as a setformer.
--
Theorem 123: [Single-valued map restrictions as setformers] Svm(F) ¥imp (((F ¥ON S) = {[x,F~[x]]: x in domain(F) | x in S}) &
	(domain(F ¥ON S) = {x: x in domain(F) | x in S}) &
	(range(F ¥ON S) = {F~[x]: x in domain(F) | x in S})). Proof:
    Suppose_not(f,s) ==>
	Svm(f) & ((f ¥ON s) /= {[x,f~[x]]: x in domain(f) | x in s} or domain(f ¥ON s) /= {x: x in domain(f) | x in s} or
	range(f ¥ON s) /= {f~[x]: x in domain(f) | x in s})
--
-- For if we suppose the first clause of our theorem to be false, use the definitions of the operators involved,
-- and simplify, we are led to the impossible inequalities seen below. Thus only the second and third
-- conclusion of the theorem need be considered.
--
    f-->T72 ==> f = {[u,f~[u]]: u in domain(f)}
    Use_def(¥ON) ==> (f ¥ON s) = {x: x in f | car(x) in s}
    EQUAL ==> (f ¥ON s) = {x: x in {[u,f~[u]]: u in domain(f)} | car(x) in s}
    SIMPLF ==> (f ¥ON s) = {[x,f~[x]]: x in domain(f) | car([x,f~[x]]) in s}
    Suppose ==> (f ¥ON s) /= {[x,f~[x]]: x in domain(f) | x in s}
    ELEM ==> Stat1: {[x,f~[x]]: x in domain(f) | x in s} /= {[x,f~[x]]: x in domain(f) | car([x,f~[x]]) in s}
    x-->Stat1 ==> (x in domain(f)) & (not ((x in s) ¥eq (car([x,f~[x]]) in s)))
    Discharge ==> f ¥ON s = {[x,f~[x]]: x in domain(f) | x in s}
--
-- Next suppose that our theorem's second conclusion is false. Using the relevant definitions
-- and simplifying much as above, we are led to a second impossible inequality. Hence only the
-- third conclusion of our theorem could be false.
--
    Suppose ==> range(f ¥ON s) /= {f~[x]: x in domain(f) | x in s}
    Use_def(range) ==> range(f ¥ON s) = {cdr(x): x in (f ¥ON s)}
    EQUAL ==> range(f ¥ON s) = {cdr(x): x in {[x,f~[x]]: x in domain(f) | x in s}}
    SIMPLF ==> range(f ¥ON s) = {cdr([x,f~[x]]): x in domain(f) | x in s}
    ELEM ==> Stat2: {f~[x]: x in domain(f) | x in s} /= {cdr([x,f~[x]]): x in domain(f) | x in s}
    Set_monot ==> {f~[x]: x in domain(f) | x in s} = {cdr([x,f~[x]]): x in domain(f) | x in s}
    Discharge ==> domain(f ¥ON s) /= {x: x in domain(f) | x in s}
--
-- But the domain can be handled in much the same way as the range, and so leads us to a final
-- contradiction which completes the proof of the present theorem.
--
    Use_def(domain) ==> domain(f ¥ON s) = {car(x): x in (f ¥ON s)}
    EQUAL ==> domain(f ¥ON s) = {car(x): x in {[x,f~[x]]: x in domain(f) | x in s}}
    SIMPLF ==> domain(f ¥ON s) = {car([x,f~[x]]): x in domain(f) | x in s}
    ELEM ==> Stat3: {x: x in domain(f) | x in s} /= {car([x,f~[x]]): x in domain(f) | x in s}
    Set_monot ==> {x: x in domain(f) | x in s} = {car([x,f~[x]]): x in domain(f) | x in s}
    Discharge ==> QED
--
-- The following elementary property of f~[x] is sometimes useful.
--
Theorem 124: [Image of a non-domain element] (X notin domain(F)) ¥imp ((F~[X]) = 0). Proof:
	Suppose_not(x,f) ==> (x notin domain(f)) & ((f~[x]) /= 0)
	Use_def(~) ==> cdr(arb(f ¥ON {x})) /= 0
	Suppose ==> f ¥ON {x} = 0
		EQUAL ==> cdr(arb(0)) /= 0
		0-->T0(Stat1*) ==> Stat1: (arb(0) = 0) & ((0 - {arb(0)}) = 0)
		EQUAL ==> cdr(0) /= 0
 		Use_def(cdr)(Stat1*) ==> arb(arb(arb(0 - {arb(0)}) - {arb(0)})) /= 0
	EQUAL(Stat1) ==> false; Discharge ==> f ¥ON {x} /= 0
	Use_def(¥ON) ==> Stat2: {p in f | car(p) in {x}} /= 0
	Use_def(domain) ==> Stat3: x notin {car(p): p in f}
	c--> Stat2 ==> (c in f) & (car(c) in {x})
	(Stat3)ELEM ==> car(c) = x
    c-->Stat3 ==> false; Discharge ==> QED
--
-- Our next elementary lemma generalizes the preceding to a useful relationship for (f ¥ON s1)~[x]
--
Theorem 125: [Value of a restriction map] (F ¥ON S)~[X] = if X in domain(F ¥ON S) then F~[X] else 0 end if. Proof:
Suppose_not(f,s,x) ==> Stat1: (f ¥ON s)~[x] /= if x in domain(f ¥ON s) then f~[x] else 0 end if
--??	0-->T0(Stat1*) ==> (arb(0) = 0) &  & ((0 - {arb(0)}) = 0)
	0-->T0(Stat1*) ==> (arb(0) = 0) & ((0 - {arb(0)}) = 0)
	Use_def(cdr)(Stat1*) ==> cdr(0) =  arb(arb(arb(0 - {arb(0)}) - {arb(0)}))
	EQUAL(Stat1) ==> cdr(0) = 0
	Use_def(~) ==> (f ¥ON s)~[x] = cdr(arb((f ¥ON s) ¥ON {x}))
	Use_def(~) ==> f~[x] = cdr(arb(f ¥ON {x}))
	(f,s,{x})-->T69 ==> (f ¥ON (s * {x})) = ((f ¥ON s) ¥ON {x})
	EQUAL ==> Stat2: (f ¥ON s)~[x] = cdr(arb(f ¥ON (s * {x})))
	(f,s)-->T94 ==> Stat3: domain(f ¥ON s) = domain(f) * s
	Suppose ==> Stat4: x notin s
		(Stat3)ELEM ==> Stat5: (s * {x} = 0) & (x notin domain(f ¥ON s))
		(Stat5,Stat1)ELEM ==> Stat6: (f ¥ON s)~[x] /= 0
		(Stat6,Stat2)ELEM ==> (cdr(arb(f ¥ON (s * {x})))) /= 0
		EQUAL ==> cdr(arb(f ¥ON 0)) /= 0
		f-->T70 ==> f ¥ON 0 = 0
		EQUAL ==> cdr(arb(0)) /= 0
		EQUAL ==> cdr(0) /= 0
	Discharge ==> x in s
	ELEM ==> s * {x} = {x}
	EQUAL ==> cdr(arb(f ¥ON {x})) = cdr(arb(f ¥ON (s * {x})))
	ELEM ==> Stat7: ((f ¥ON s)~[x]) = (f~[x])
	Suppose ==> Stat8: x notin domain(f ¥ON s)
		ELEM ==> x notin domain(f)
		(Stat1,Stat8)ELEM ==> (f ¥ON s)~[x] /= 0
	(x,f ¥ON s)-->T124 ==> false; Discharge ==> Stat9: x in domain(f ¥ON s)
    (Stat1,Stat9,Stat7)ELEM ==> false; Discharge ==> QED
--
-- The following form of theorem 123 is sometimes more convenient.
--
Theorem 126: [Single-valued map restrictions as setformers, 2] Svm(F) ¥imp (((F ¥ON S) = {[x,F~[x]]: x in domain(F ¥ON S)}) &
	(range(F ¥ON S) = {F~[x]: x in domain(F ¥ON S)})). Proof:
	Suppose_not(f,s1) ==> AUTO
	(f,s1)-->T57 ==> Svm(f ¥ON s1)
	(f ¥ON s1)-->T73 ==> ((f ¥ON s1) = {[x,(f ¥ON s1)~[x]]: x in domain(f ¥ON s1)}) & (range(f ¥ON s1) = {(f ¥ON s1)~[x]: x in domain(f ¥ON s1)})
	ELEM ==> ({[x,f~[x]]: x in domain(f ¥ON s1)} /= {[x,(f ¥ON s1)~[x]]: x in domain(f ¥ON s1)}) or ({f~[x]: x in domain(f ¥ON s1)} /= {(f ¥ON s1)~[x]: x in domain(f ¥ON s1)})
 	Suppose ==> Stat1: {f~[x]: x in domain(f ¥ON s1)} /= {(f ¥ON s1)~[x]: x in domain(f ¥ON s1)}
		ELEM ==> not (({f~[x]: x in domain(f ¥ON s1)} ¥incin {(f ¥ON s1)~[x]: x in domain(f ¥ON s1)}) & ({f~[x]: x in domain(f ¥ON s1)} incs {(f ¥ON s1)~[x]: x in domain(f ¥ON s1)}))
		Suppose ==> Stat2: not({f~[x]: x in domain(f ¥ON s1)} ¥incin {(f ¥ON s1)~[x]: x in domain(f ¥ON s1)})
			y-->Stat2 ==> (y in domain(f ¥ON s1)) & (((f ¥ON s1)~[y]) /= (f~[y]))
		(f,s1,y)-->T125 ==> false; Discharge ==> Stat3: not({f~[x]: x in domain(f ¥ON s1)} incs {(f ¥ON s1)~[x]: x in domain(f ¥ON s1)})
	y1-->Stat3 ==> Stat4: (y1 in domain(f ¥ON s1)) & (((f ¥ON s1)~[y1]) /= (f~[y1]))
	(f,s1,y1)-->T125 ==> false; Discharge ==> {[x,f~[x]]: x in domain(f ¥ON s1)} /= {[x,(f ¥ON s1)~[x]]: x in domain(f ¥ON s1)}
	ELEM ==> not (({[x,f~[x]]: x in domain(f ¥ON s1)} ¥incin {[x,(f ¥ON s1)~[x]]: x in domain(f ¥ON s1)}) & ({[x,f~[x]]: x in domain(f ¥ON s1)} incs {[x,(f ¥ON s1)~[x]]: x in domain(f ¥ON s1)}))
	Suppose ==> Stat5: not({[x,f~[x]]: x in domain(f ¥ON s1)} ¥incin {[x,(f ¥ON s1)~[x]]: x in domain(f ¥ON s1)})
		y2-->Stat5 ==> Stat6: (y2 in domain(f ¥ON s1)) & (([y2,(f ¥ON s1)~[y2]]) /= ([y2,f~[y2]]))
		EQUAL ==> (f ¥ON s1)~[y2] /= f~[y2]
		(f,s1,y2)-->T125 ==> false; Discharge ==> {[x,f~[x]]: x in domain(f ¥ON s1)} ¥incin {[x,(f ¥ON s1)~[x]]: x in domain(f ¥ON s1)}
		ELEM ==> Stat7: not({[x,f~[x]]: x in domain(f ¥ON s1)} incs {[x,(f ¥ON s1)~[x]]: x in domain(f ¥ON s1)})
	y3-->Stat7 ==> Stat8: (y3 in domain(f ¥ON s1)) & (((f ¥ON s1)~[y3]) /= (f~[y3]))
	EQUAL ==> (f ¥ON s1)~[y3] /= f~[y3]
	(f,s1,y3)-->T125 ==> false; Discharge ==> QED
--
-- Our next lemma simply re-expresses the condition that a map should be 1-1
-- in terms of the element-mapping operator $f~[x]$:
--
Theorem 127: [Images under one-one maps] (one_1_map(F) & (X in domain(F)) & (Y in domain(F)) & (F~[X] = F~[Y])) ¥imp (X = Y). Proof:
    Suppose_not(f,x,y) ==> one_1_map(f) & (x in domain(f)) & (y in domain(f)) & (f~[x] = f~[y]) & (x /= y)
--
-- For suppose the contrary, and let $f$ be a 1-1 map, with distinct elements $x$, $y$ in its domain such that
-- $f~[x] = f~[y]$. Since it is easily seen that $[x,f~[x]]$ and $[y,f~[y]]$ both belong to $f$,
-- this would violate the definition of '$one_1_map$', a contradiction which completes our proof.
--
    Use_def(one_1_map) ==> Svm(f) &
    	Stat1: (FORALL x in f, y in f | ((cdr(x) = cdr(y)) ¥imp (x = y)))
    f-->T72 ==> f = {[x,f~[x]]: x in domain(f)}
    Suppose ==> Stat2: [x,f~[x]] notin {[x,f~[x]]: x in domain(f)}
    x-->Stat2 ==> false; Discharge ==> [x,f~[x]] in f
    Suppose ==> Stat3: [y,f~[y]] notin {[x,f~[x]]: x in domain(f)}
    y-->Stat3 ==> false; Discharge ==> [y,f~[y]] in f
    ([x,f~[x]],[y,f~[y]])-->Stat1 ==> (cdr([x,f~[x]]) = cdr([y,f~[y]])) ¥imp (x = y)
    Discharge ==> QED
--
-- Next we show that the composition of two single-valued maps is single valued.
--
Theorem 128: [Composition of single-valued maps] (Svm(F) & Svm(G)) ¥imp Svm(F @ G). Proof:
    Suppose_not(f,g) ==> Svm(f) & Svm(g) & (not Svm(f @ g))
--
-- For suppose the contrary. Then by definition and using Theorem 55 it follows that
-- there exist $a$, $b$ in $f @ g$ with identical first components but distinct second components:
--
    Use_def(Svm) ==> Is_map(f) & Stat1: (FORALL x in f, y in f | ((car(x) = car(y)) ¥imp (x = y))) &
	Is_map(g) & Stat2: (FORALL x in g, y in g | ((car(x) = car(y)) ¥imp (x = y))) &
	(not(Is_map(f @ g) & (FORALL x in (f @ g), y in (f @ g) | ((car(x) = car(y)) ¥imp (x = y)))))
    (f,g)-->T55 ==> Is_map(f @ g)
    ELEM ==> Stat3: not(FORALL x in (f @ g), y in (f @ g)| ((car(x) = car(y)) ¥imp (x = y)))
    (a,b)-->Stat3 ==> (a in (f @ g)) & (b in (f @ g)) & (car(a) = car(b)) & (a /= b)
--
-- Thus, by definition of map multiplication, there exist $c$, $d$, $u$, $v$, with $c$, $u$ in $g$ and $d$, $v$ in $f$,
-- satisfying the condition displayed below.
--
    Use_def(@) ==> Stat4: (a in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}) &
									(b in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)})
    (c,d,u,v)-->Stat4 ==> Stat5: (c in g) & (d in f) & (a = [car(c),cdr(d)]) & (cdr(c) = car(d)) &
			(u in g) & (v in f) & (b = [car(u),cdr(v)]) & (cdr(u) = car(v)) &
					(car(a) = car(b)) & (a /= b)
--
-- But then $car(c) = car(u)$, so by Stat5 we have $car(d) = car(v)$.
--
    (Stat5*)ELEM ==> Stat6: (c in g) & (u in g) & (car(a) = car(b)) & (a = [car(c),cdr(d)])
   						& (b = [car(u),cdr(v)])
    EQUAL ==> Stat7: car([car(c),cdr(d)]) = car([car(u),cdr(v)])
    (Stat7)ELEM ==> Stat8: car(c) = car(u)
    (c,u)-->Stat2 ==> Stat9: ((c in g) & (u in g) & (car(c) = car(u))) ¥imp (c = u)
    (Stat6,Stat9,Stat8*)ELEM ==> Stat10: c = u
    EQUAL ==> cdr(c) = cdr(u)
    (Stat5*)ELEM ==> car(d) = car(v)
--
-- It follows by Stat5 that $cdr(d) = cdr(v)$, contradicting $a /= b$ and so proving our theorem.
--
    (d,v)-->Stat1 ==> Stat11: d = v
    (Stat5*)ELEM ==> Stat12: [car(c),cdr(d)] /= [car(u),cdr(v)]
    EQUAL ==> false; Discharge ==> QED
--
-- Our next theorem gives a standard elementary formula for $(f @ g)~[x]$.
--
Theorem 129: [Images under single-valued map composition] (Svm(F) & Svm(G) & (X in domain(G)) & (range(G) ¥incin domain(F))) ¥imp ((F @ G)~[X] = F~[G~[X]]). Proof:
    Suppose_not(f,g,x) ==>
    Svm(f) & Svm(g) & (x in domain(g)) & (range(g) ¥incin domain(f)) & ((f @ g)~[x] /= f~[g~[x]])
--
-- For suppose the contrary. By Theorem 77, we have $[x,g~[x]] in g$ and $[g~[x],f~[g~[x]]] in f$.
--
	Use_def(Svm) ==> Is_map(g)
	(g,x)-->T77 ==> [x,g~[x]] in g
	Suppose ==> g~[x] notin range(g)
	Use_def(range) ==> Stat1: g~[x] notin {cdr(u): u in g}
	[x,g~[x]]-->Stat1 ==> not((g~[x] = cdr([x,g~[x]])) & ([x,g~[x]] in g))
	Discharge ==> g~[x] in range(g)
	ELEM ==> g~[x] in domain(f)
	Use_def(Svm) ==> Is_map(f)
	(f,g~[x])-->T77 ==> [g~[x],f~[g~[x]]] in f
--
-- It follows that $[x,f~[g~[x]]]$ belongs to $f @ g$, and so, since $f @ g$ is single valued by
-- Theorem 128, we have $f~[g~[x]] = (f @ g)~[x]$.
--
	Suppose ==> [x,f~[g~[x]]] notin (f @ g)
	Use_def(@) ==> Stat2: [x,f~[g~[x]]] notin {[car(u),cdr(v)]: u in g, v in f | cdr(u) = car(v)}
	([x,g~[x]],[g~[x],f~[g~[x]]])-->Stat2 ==>
	Stat3: not (([x,f~[g~[x]]] = [car([x,g~[x]]),cdr([g~[x],f~[g~[x]]])])
	& (cdr([x,g~[x]]) = car([g~[x],f~[g~[x]]])) & ([x,g~[x]] in g) & ([g~[x],f~[g~[x]]] in f))
	Discharge ==> [x,f~[g~[x]]] in (f @ g)
	(f,g)-->T128 ==> Svm(f @ g)
	(f @ g,[x,f~[g~[x]]])-->T74 ==> (f @ g)~[car([x,f~[g~[x]]])] = cdr([x,f~[g~[x]]])
	ELEM ==> car([x,f~[g~[x]]]) = x
	EQUAL ==> (f @ g)~[x] = cdr([x,f~[g~[x]]])
    Discharge ==> QED
--
-- Our next result is a corollary of Theorem 129 which adds several useful clauses to it.
--
Theorem 130: [Single-valued map ranges and domains as set formers] (Svm(F) & Svm(G) & (X in domain(G)) & (range(G) ¥incin domain(F))) ¥imp
	(((F @ G)~[X] = F~[G~[X]]) & (F @ G = {[x,F~[G~[x]]]: x in domain(G)}) & (range(F @ G) = {F~[G~[x]]: x in domain(G)})). Proof:
    Suppose_not(f,g,x) ==> Svm(f) & Svm(g) & (x in domain(g)) & (range(g) ¥incin domain(f)) &
    (not(((f @ g)~[x] = f~[g~[x]]) & (f @ g = {[x,f~[g~[x]]]: x in domain(g)}) & (range(f @ g) = {f~[g~[x]]: x in domain(g)})))
--
-- For suppose that our statement is false, and let $f$, $g$ be a counterexample. It follows immediately
-- from Theorem 128, Theorem 73, and Theorem 95 that the two final clauses of our assertion must be true if
-- the expression $f~[g~[x]]$ appearing in the setformers seen there are replaced by $(f @ g)~[x]$.
--
    (f,g)-->T128 ==> Svm(f @ g)
    (f @ g)-->T73 ==> (f @ g = {[x,(f @ g)~[x]]: x in domain(f @ g)}) &
    						(range(f @ g) = {(f @ g)~[x]: x in domain(f @ g)})
    (f,g)-->T95 ==> domain(f @ g) = domain(g)
    EQUAL ==> (f @ g = {[x,(f @ g)~[x]]: x in domain(g)}) & (range(f @ g) = {(f @ g)~[x]: x in domain(g)})
--
-- However, Theorem 129 lets us replace $(f @ g)~[x]$ by $f~[g~[x]]$, after which our assertion is immediate.
--
    (f,g,x)-->T129 ==> (f @ g)~[x] = f~[g~[x]]
    ELEM ==> ({[x,(f @ g)~[x]]: x in domain(g)} /= {[x,f~[g~[x]]]: x in domain(g)}) or ({(f @ g)~[x]: x in domain(g)} /= {f~[g~[x]]: x in domain(g)})
    Suppose ==> Stat1: {[x,(f @ g)~[x]]: x in domain(g)} /= {[x,f~[g~[x]]]: x in domain(g)}
    xp-->Stat1 ==> ((f @ g)~[xp] /= f~[g~[xp]]) & (xp in domain(g))
    (f,g,xp)-->T129 ==> false; Discharge ==> Stat2: {(f @ g)~[x]: x in domain(g)} /= {f~[g~[x]]: x in domain(g)}
    xq-->Stat2 ==> ((f @ g)~[xq] /= f~[g~[xq]]) & (xq in domain(g))
    (f,g,xq)-->T129 ==> false; Discharge ==> QED
--
Theorem 131: [Image under single-valued map] (Svm(F) & (G ¥incin F) & (X in domain(G))) ¥imp (F~[X]=G~[X]). Proof:
    Suppose_not(f,g,x) ==> Stat1: Svm(f) & (g ¥incin f) & (x in domain(g)) & (f~[x] /= g~[x])
	Use_def(~) ==> cdr(arb(f ¥ON {x})) /= cdr(arb(g ¥ON {x}))
	Use_def(¥ON) ==> cdr(arb({q: q in f | car(q) in {x}})) /= cdr(arb({q: q in g | car(q) in {x}}))
	Use_def(domain) ==> Stat2: x in {car(p): p in g}
	q-->Stat2 ==> (q in g) & (x = car(q))
	Set_monot ==> {p: p in g | car(p) in {x}} ¥incin {p: p in f | car(p) in {x}}
	Suppose ==> Stat3: q notin {p: p in g | car(p) in {x}}
	q-->Stat3 ==> false; Discharge ==> Stat4: (q in {p: p in g | car(p) in {x}})
	Suppose ==> Stat5: not( {p: p in g | car(p) in {x}} incs {p: p in f | car(p) in {x}} )
	y-->Stat5 ==> Stat6: (y in {p: p in f | car(p) in {x}}) & (y notin {p: p in g | car(p) in {x}})
	(p,p)-->Stat6 ==> Stat7: (p in f) & (car(p) = x) & (p notin g)
	q1-->Stat4 ==> Stat8: (q1 in g) & (car(q1) = x)
	Use_def(Svm) ==>  Stat9: (FORALL x in f, y in f | (car(x) = car(y)) ¥imp (x = y))
	(p,q1)-->Stat9(Stat7,Stat8,Stat1) ==> false; Discharge ==> {p: p in g | car(p) in {x}} = {p: p in f | car(p) in {x}}
    Discharge ==> QED
--
-- The fact that a map $f$ and its inverse are both 1-1 if either is
-- results easily from Theorem 121.
--
Theorem 132: [Single-valued and one-one maps] Is_map(F) ¥imp (one_1_map(F) ¥eq one_1_map(inv(F))). Proof:
    Suppose_not(f) ==> Is_map(f) & ( not(one_1_map(f) ¥eq one_1_map(inv(f))))
    (f)-->T121 ==> one_1_map(f) ¥eq (Svm(f) & Svm(inv(f)))
    (inv(f))-->T121 ==> one_1_map(inv(f)) ¥eq (Svm(inv(f)) & Svm(inv(inv(f))))
    ELEM ==> not(Svm(f) ¥eq Svm(inv(inv(f))))
    f-->T100 ==> f = inv(inv(f))
    Suppose ==> Svm(f)
	EQUAL ==> Svm(inv(inv(f)))
    Discharge ==> Svm(inv(inv(f))) & (not Svm(f))
    EQUAL ==> Svm(f)
    Discharge ==> QED
--
 -- Theorem 121 also lets us give a purely algebraic argument to show that
 -- the product of one-to-one mappings is one-to-one.
--
Theorem 133: [Composition of one-one maps] (one_1_map(F) & one_1_map(G)) ¥imp one_1_map(F @ G).   Proof:
    Suppose_not(f,g) ==> one_1_map(f) & one_1_map(g) & (not one_1_map(f @ g))
--
-- For suppose the contrary, in which case it follows by Theorem 121 that
-- $f$, $g$ and their inverses are single-valued, but $f @ g$ is  not.
--
	f-->T121 ==> Svm(f) & Svm(inv(f))
	g-->T121 ==> Svm(g) & Svm(inv(g))
	(f @ g)-->T121 ==> not(Svm(f @ g) & Svm(inv(f @ g)))
--
-- But Theorem 128 tells us that $f @ g$ is single-valued, and Theorem 120 allows
-- $inv(f @ g)$ to be rewritten as a product of inverses which must be single-valued,
-- proving the present theorem.
--
	(f,g)-->T128 ==> Svm(f @ g)
	Use_def(Svm) ==> Is_map(f)
	Use_def(Svm) ==> Is_map(g)
 	(f,g)-->T120 ==> inv(f @ g) = inv(g) @ inv(f)
 	(inv(g),inv(f))-->T128 ==> Svm(inv(g) @ inv(f))
    EQUAL ==> false; Discharge ==> QED
--
-- The following slight variant of the definition of 'one_1_map' is sometimes useful.
--
Theorem 134: [Elements are defined uniquely by their one-one images] Svm(F) ¥imp (one_1_map(F) ¥eq
	(FORALL x in domain(F), y in domain(F) | ((F~[x] = F~[y]) ¥imp (x = y)))). Proof:
    Suppose_not(f) ==> Svm(f) & (not(one_1_map(f) ¥eq
    		(FORALL x in domain(f), y in domain(f) | ((f~[x] = f~[y]) ¥imp (x = y)))))
--
-- We argue by contradiction, and so suppose that $f$ is a counterexample to our theorem.
-- Since $f$ is single-valued, Theorem 72 lets us represent it by the set expression
--    				$f = {[x,f~[x]]: x in domain(f)}$.
--
	f-->T72 ==> f = {[x,f~[x]]: x in domain(f)}
--
-- We can easily show that $f$ is 1-1. For suppose the contrary.
-- Then the $fcn_symbol$ theory given previously tells us the quantified clause
-- of our theorem must be false, a contradiction which proves our claim.
--
	Suppose ==> not one_1_map(f)
	ELEM ==> Stat1: (FORALL x in domain(f), y in domain(f) | ((f~[x] = f~[y]) ¥imp (x = y)))
	APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(f(x)->f~[x],g->f,s->domain(f)) ==>
			((x in domain(f)) & (y in domain(f)) & (f~[x] = f~[y]) & (x /= y)) or one_1_map(f)
 	ELEM ==> (x in domain(f)) & (y in domain(f)) & (f~[x] = f~[y]) & (x /= y)
 	(x,y)-->Stat1 ==> false; Discharge ==> one_1_map(f) &
 			Stat2: (not(FORALL x in domain(f), y in domain(f) | ((f~[x] = f~[y]) ¥imp (x = y))))
--
-- But an elementary contradiction with the definition of 1-1 map follows easily
-- in this case also, so our theorem is proved.
--
  	(u,v)-->Stat2 ==> (u in domain(f)) & (v in domain(f)) & (f~[u] = f~[v]) & (u /= v)
  	Suppose ==> [u,f~[u]] notin f
  	ELEM ==> Stat3: [u,f~[u]] notin {[x,f~[x]]: x in domain(f)}
  	u-->Stat3 ==> false; Discharge ==> [u,f~[u]] in f
  	Suppose ==> [v,f~[v]] notin f
  	ELEM ==> Stat4: [v,f~[v]] notin {[x,f~[x]]: x in domain(f)}
  	v-->Stat4 ==> false; Discharge ==> [v,f~[v]] in f
  	Use_def(one_1_map) ==> Stat5: (FORALL x in f, y in f | (cdr(x) = cdr(y)) ¥imp (x = y))
    ([u,f~[u]],[v,f~[v]])-->Stat5 ==> false; Discharge ==> QED
--
-- Next we show that a 1-1 map on a set $u$ induces a 1-1 map on the power set of $u$.
--
Theorem 135: [A 1-1 map on a set $u$ induces a 1-1 map on the power set of $u$]
    (one_1_map(F) & (S ¥incin domain(F)) & (T ¥incin domain(F)) & (S /= T)) ¥imp
    			(range(F ¥ON S) /= range(F ¥ON T)). Proof:
    Suppose_not(f,s,t) ==> one_1_map(f) & (s ¥incin domain(f)) & (t ¥incin domain(f)) & Stat1: (s /= t) &
    	(range(f ¥ON s) = range(f ¥ON t))
    c-->Stat1 ==> ((c in s) & (c notin t)) or ((c notin s) & (c in t))
--
-- For let $f$ be 1-1, and suppose that there are distinct subsets $s$ and $t$ of its domain such that
-- $range(f ¥ON s)$ = $range(f ¥ON t)$. Then there is an element $c$ of $domain(f)$ which is in
-- one of $s$ and $t$ but not the other. Using the definitions of the functions involved and simplifying,
-- we can rewrite the equality $range(f ¥ON s) = range(f ¥ON t)$ as follows:
--
    Use_def(one_1_map) ==> Svm(f) & Stat2: (FORALL x in f, y in f | (cdr(x) = cdr(y)) ¥imp (x = y))
    f-->T72 ==> Stat3: f = {[x,f~[x]]: x in domain(f)}
    Use_def(range) ==> Stat4: {cdr(x): x in (f ¥ON s)} = {cdr(x): x in (f ¥ON t)}
    Use_def(¥ON) ==> {cdr(x): x in {x in f | car(x) in s}} = {cdr(x): x in {x in f | car(x) in t}}
    SIMPLF ==> {cdr(x): x in f | car(x) in s} = {cdr(x): x in f | car(x) in t}
    EQUAL ==> {cdr(x): x in {[x,f~[x]]: x in domain(f)} | car(x) in s} =
	{cdr(x): x in {[x,f~[x]]: x in domain(f)} | car(x) in t}
    SIMPLF ==> {cdr([x,f~[x]]): x in domain(f) | car([x,f~[x]]) in s} =
				{cdr([x,f~[x]]): x in domain(f) | car([x,f~[x]]) in t}
--
-- Suppose for definiteness sake that $c in s$, $c notin t$. Since $f~[c]$ must be in
-- $range(f ¥ON s) = range(f ¥ON t)$, it must have the form $f~[d]$ where $d in t$ and so $d /= c$.
--
   	Suppose ==> Stat5: [c,f~[c]] notin {[x,f~[x]]: x in domain(f)}
    c-->Stat5 ==> false; Discharge ==> [c,f~[c]] in f
    Suppose ==> (c in s) & (c notin t)
    Suppose ==> Stat6: f~[c] notin {cdr([x,f~[x]]): x in domain(f) | car([x,f~[x]]) in s}
    c-->Stat6 ==> (f~[c] /= cdr([c,f~[c]]) or c notin domain(f) or car([c,f~[c]]) notin s)
    Discharge ==> Stat7: f~[c] in {cdr([x,f~[x]]): x in domain(f) | car([x,f~[x]]) in t}
    d-->Stat7 ==> (f~[c] = cdr([d,f~[d]])) & ((d in domain(f)) & (car([d,f~[d]]) in t))
    ELEM ==> (f~[c] = f~[d]) & ((d in domain(f)) & (d in t))
    ELEM ==> c /= d
--
--  But since $f~[c] = f~[d]$, this contradicts the fact that $f$ is 1-1, and so we must have
--  $(c notin s) & (c in t)$.
--
   	Suppose ==> Stat8: [d,f~[d]] notin {[x,f~[x]]: x in domain(f)}
    d-->Stat8 ==> false; Discharge ==> [d,f~[d]] in f
    ([c,f~[c]],[d,f~[d]])-->Stat2 ==> (cdr([c,f~[c]]) = cdr([d,f~[d]])) ¥imp ([c,f~[c]] = [d,f~[d]])
    ELEM ==> false; Discharge ==> (c notin s) & (c in t)
--
--  However, the case $c notin s$, $c in t$ leads to an exactly similar contradiction, thus completing our proof.
--
    Suppose ==> Stat9: f~[c] notin {cdr([x,f~[x]]): x in domain(f) | car([x,f~[x]]) in t}
    c-->Stat9 ==> (f~[c] /= cdr([c,f~[c]]) or c notin domain(f) or car([c,f~[c]]) notin t)
    Discharge ==> Stat10: f~[c] in {cdr([x,f~[x]]): x in domain(f) | car([x,f~[x]]) in s}
    dd-->Stat10 ==> Stat11: (f~[c] = cdr([dd,f~[dd]])) & ((dd in domain(f)) & (car([dd,f~[dd]]) in s))
    (Stat11)ELEM ==> (f~[c] = f~[dd]) & ((dd in domain(f)) & (dd in s))
    ELEM ==> c /= dd
    Suppose ==> Stat12: [dd,f~[dd]] notin {[x,f~[x]]: x in domain(f)}
    dd-->Stat12 ==> false; Discharge ==> [dd,f~[dd]] in f
    ([c,f~[c]],[dd,f~[dd]])-->Stat2 ==> (cdr([c,f~[c]]) = cdr([dd,f~[dd]])) ¥imp ([c,f~[c]] = [dd,f~[dd]])
    Discharge ==> QED
--
-- The two following results, both elementary consequences by set monotonicity of the definitions
-- of the functions involved, show that map composition is distributive over map union,
-- both on the left and the right.
--
Theorem 136: [Union of map composition] (F + FF) @ G = (F @ G) + (FF @ G). Proof:
Suppose_not(f,ff,g) ==> (f + ff) @ g /= (f @ g) + (ff @ g)
    Use_def(@) ==> {[car(x),cdr(y)]: x in g, y in (f + ff) | cdr(x) = car(y)} /=
	{[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)} +
	{[car(x),cdr(y)]: x in g, y in ff | cdr(x) = car(y)}
    Set_monot ==> {[car(x),cdr(y)]: x in g, y in (f + ff) | cdr(x) = car(y)} =
	{[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)} +
	{[car(x),cdr(y)]: x in g, y in ff | cdr(x) = car(y)}
Discharge ==> QED
--
Theorem 137: [Union of map composition, 2] G @ (F + FF) = (G @ F) + (G @ FF). Proof:
    Suppose_not(g,f,ff) ==> g @ (f + ff) /= (g @ f) + (g @ ff)
    Use_def(@) ==> {[car(x),cdr(y)]: x in (f + ff), y in g | cdr(x) = car(y)} /=
	{[car(x),cdr(y)]: x in f, y in g | cdr(x) = car(y)} +
	{[car(x),cdr(y)]: x in ff, y in g | cdr(x) = car(y)}
    Set_monot ==> {[car(x),cdr(y)]: x in (f + ff), y in g | cdr(x) = car(y)} =
	{[car(x),cdr(y)]: x in f, y in g | cdr(x) = car(y)} +
	{[car(x),cdr(y)]: x in ff, y in g | cdr(x) = car(y)}
    Discharge ==> QED
--
-- The theorem that now follows tells us that a 1-1 partial inverse can be defined for
-- any single-valued map.
--
Theorem 138: [Single-valued maps have 1-1 partial inverses]
    Svm(F) ¥imp (EXISTS h | ((domain(h) = range(F)) & (range(h) ¥incin domain(F)) & one_1_map(h)) &
	(FORALL x in range(F) | (F~[h~[x]] = x))). Proof:
    Suppose_not(f) ==> Svm(f) &
	Stat1: (not(EXISTS h | ((domain(h) = range(f)) & (range(h) ¥incin domain(f)) & one_1_map(h) &
	(FORALL x in range(f) | f~[h~[x]] = x))))
--
-- We will refute the contrary supposition by giving the following
-- explicit definition of the partial inverse whose existence is asserted.
--
    Loc_def ==> h = {[x,arb({car(u): u in f | cdr(u) = x})]: x in range(f)}
--
-- The 'fcn_symbol' theory tells us immediately that this $h$ is a single-valued map with
-- domain equal to $range(f)$. Thus we have only to consider the three last clauses of our theorem.
--
	APPLY(x9_thryvar:x2,y9_thryvar:y2) fcn_symbol(f(x)->arb({car(u): u in f | cdr(u) = x}),g->h,s->range(f)) ==>
		Stat2: (domain(h) = range(f)) & Svm(h) &
			Stat3: (FORALL x | h~[x] = if x in range(f) then arb({car(u): u in f | cdr(u) = x}) else 0 end if)
    			& (range(h) = {arb({car(u): u in f | cdr(u) = x}): x in range(f)}) &
    				(((x2 in range(f)) & (y2 in range(f)) &
    		(arb({car(u): u in f | cdr(u) = x2}) = arb({car(u): u in f | cdr(u) = y2})) & (x2 /= y2))
    				 or one_1_map(h))
--
-- We first show that $(FORALL x in range(f) | h~[x] in {car(u): u in f | cdr(u) = x})$,
-- from which it will follow easily that $range(h) ¥incin domain(f)$.
-- Indeed, if we suppose the existence of an $x in range(f)$ for which
-- $h~[x] notin {car(u): u in f | cdr(u) = x}$,
-- use of the axiom of choice leads to an immediate contradiction.
--
    Suppose ==> Stat4: not(FORALL v in range(f) | arb({car(u): u in f | cdr(u) = v})
    						in {car(u): u in f | cdr(u) = v})
    v-->Stat4 ==> (v in range(f)) &
    	(not(arb({car(u): u in f | cdr(u) = v}) in {car(u): u in f | cdr(u) = v}))
    {car(u): u in f | cdr(u) = v}-->T0 ==> Stat5: {car(u): u in f | cdr(u) = v} = 0
    Use_def(range) ==> Stat6: v in {cdr(x): x in f}
    vv-->Stat6 ==> (v = cdr(vv)) & (vv in f)
    vv-->Stat5 ==> false; Discharge ==>
    	Stat7: (FORALL v in range(f) | arb({car(u): u in f | cdr(u) = v}) in {car(u): u in f | cdr(u) = v})
--
-- Next we show (by contradiction) that $range(h) ¥incin domain(f)$.
--
 	Suppose ==> Stat8: not(range(h) ¥incin domain(f))
 	w-->Stat8 ==> Stat9: (w in range(h)) & (w notin domain(f))
 	(Stat2,Stat9)ELEM ==> Stat10: w in {arb({car(u): u in f | cdr(u) = x}): x in range(f)}
 	ww-->Stat10 ==> (w = arb({car(u): u in f | cdr(u) = ww})) & (ww in range(f))
 	ww-->Stat7 ==> w in {car(u): u in f | cdr(u) = ww}
 	Use_def(domain) ==> w notin {car(u): u in f}
 	Set_monot ==> {car(u): u in f} incs {car(u): u in f | cdr(u) = ww}
 	Discharge ==> range(h) ¥incin domain(f)
--
-- The fact that $h$ is 1-1 also follows readily, since by repeated use of Stat11 10
-- its negative would imply the existence of $u1$ and $u2$ in $f$ with $car(u1) = car(u2)$ but
-- $cdr(u1) /= cdr(u2)$, contradicting the single-valuedness of $f$.
--
	Suppose ==> Stat12: not one_1_map(h)
	ELEM ==> Stat13: (x2 in range(f)) & (y2 in range(f) &
	arb({car(u): u in f | cdr(u) = x2}) = arb({car(u): u in f | cdr(u) = y2})) & (x2 /= y2)
	x2-->Stat7 ==> Stat14: arb({car(u): u in f | cdr(u) = x2}) in {car(u): u in f | cdr(u) = x2}
	y2-->Stat7 ==> Stat15: arb({car(u): u in f | cdr(u) = y2}) in {car(u): u in f | cdr(u) = y2}
	u1-->Stat14 ==> Stat16: (u1 in f) & (arb({car(u): u in f | cdr(u) = x2}) = car(u1)) & (cdr(u1) = x2)
	u2-->Stat15 ==> Stat17: (u2 in f) & (arb({car(u): u in f | cdr(u) = y2}) = car(u2)) & (cdr(u2) = y2)
	(Stat13,Stat16,Stat17)ELEM ==> (u1 in f) & (u2 in f) & (car(u1) = car(u2)) & (cdr(u1) /= cdr(u2))
	(f,u1)-->T74 ==> f~[car(u1)] = cdr(u1)
	(f,u2)-->T74 ==> f~[car(u2)] = cdr(u2)
	EQUAL ==> f~[car(u1)] = f~[car(u2)]
	Discharge ==> one_1_map(h)
--
-- It only remains to show that $f~[h~[x]] = x$ for all $x in range(f)$.
-- but it is easily seen that any counterexample $t$ to this assertion
-- would have to satisfy $h~[t] = car(tt)$ where $tt in f$ and $cdr(tt) = t$,
-- and hence $f~[car(tt)] = t$, contradicting $f~[h~[t]] /= t$,
-- and so completing the proof of the present theorem.
--
	Suppose ==> Stat18: not (FORALL x in range(f) | f~[h~[x]] = x)
	t-->Stat18 ==> (t in range(f)) & (f~[h~[t]] /= t)
	t-->Stat7 ==> arb({car(u): u in f | cdr(u) = t}) in {car(u): u in f | cdr(u) = t}
	t-->Stat3 ==> Stat19: h~[t] in {car(u): u in f | cdr(u) = t}
	tt-->Stat19 ==> (h~[t] = car(tt)) & (tt in f) & (cdr(tt) = t)
	(f,tt)-->T74 ==> f~[car(tt)] = t
	EQUAL ==> f~[h~[t]] = t
	Discharge ==> (FORALL x in range(f) | f~[h~[x]] = x)
	h-->Stat1 ==> false; Discharge ==> QED
--
-- The definition of the very useful Cartesian product operator is as follows:
--
Def 17: [Cartesian Product] Def(s ¥PROD t) := {[x,y]: x in s, y in t}
--
-- We begin our discussion of this important operator by proving the elementary fact
-- that a Cartesian product is empty if either of its factors is empty.
-- The equally easy converse of this result will be proved later.
--
Theorem 139: [Cartesian product with a null set] (N ¥PROD 0 = 0) & (0 ¥PROD N = 0). Proof:
    Suppose_not(n) ==> (n ¥PROD 0 /= 0) or (0 ¥PROD n /= 0)
--
-- For supposing the negative of either of our conclusions leads immediately
-- to an elementary contradiction:
--
    Use_def(¥PROD) ==> ({[x,y]: x in n, y in 0} /= 0) or ({[x,y]: x in 0, y in n} /= 0)
    Suppose ==> Stat1: {[x,y]: x in n, y in 0} /= 0
    (c,d)-->Stat1 ==> (c in n) & (d in 0)
    Discharge ==> Stat2: {[x,y]: x in 0, y in n} /= 0
    dp-->Stat2 ==> Stat3: dp in {[x,y]: x in 0, y in n}
    (x1,y1)-->Stat3 ==> (dp = [x1,y1]) & (y1 in n) & (x1 in 0)
    Discharge ==> QED
--
-- ================ Additional laws concerning Cartesian product ==========================
--
-- It is easy to show that the first component of any member of the Cartesian product $s ¥PROD t$
-- belongs to $s$, and its second component to $t$:
--
Theorem 140: [Members of Cartesian products] (X in (S ¥PROD T)) ¥imp ((car(X) in S) & (cdr(X) in T)). Proof:
--
-- This follows trivially from the very definition of Cartesian product.
--
    Suppose_not(x,s,t) ==> Stat1: (x in (s ¥PROD t)) & (not( car(x) in s & cdr(x) in t))
	Use_def(¥PROD) ==> Stat2: x in {[u,v]: u in s, v in t}
	(a,b)-->Stat2 ==> Stat3: (a in s) & (b in t) & (x = [a,b])
    (Stat1,Stat3)Discharge ==> QED
--
-- Next we show that every subset of a Cartesian $S ¥PROD T$ product is a map
-- whose domain and range are included in $S$ and $T$, respectively:
--
Theorem 141: [Subsets of Cartesian products] (Y ¥incin (S ¥PROD T)) ¥eq (Is_map(Y) & (domain(Y) ¥incin S) & (range(Y) ¥incin T)). Proof:
--
-- This follows trivially from the fact that a map is a set each
-- of whose elements $x$ is a pair $[car(x),cdr(x)]$
--
Suppose_not(y,s,t) ==> AUTO
	Suppose ==> Stat1: ((y ¥incin (s ¥PROD t)) & ((not Is_map(y)) or (domain(y) ¥nincin s) or (range(y) ¥nincin t)))
		Use_def(¥PROD) ==> Stat2: y ¥incin {[u,v]: u in s, v in t}
		Suppose ==> Stat3: not(Is_map(y))
			y-->T51(Stat3*) ==> Stat4: not(FORALL x in y | x = [car(x),cdr(x)])
			c-->Stat4(Stat4*) ==> Stat5: (c in y) & (c /= [car(c),cdr(c)])
			(Stat2,Stat5*)ELEM ==> Stat6: c in {[u,v]: u in s, v in t}
			(d,e)-->Stat6(Stat6*) ==> Stat7: c=[d,e]
		(Stat5,Stat7)Discharge ==> (domain(y) ¥nincin s) or (range(y) ¥nincin t)
		Suppose ==> Stat8: range(y) ¥nincin t
			Use_def(range(y)) ==> AUTO
			e0-->Stat8(Stat8*) ==> Stat9: (e0 in {cdr(w): w in y}) & (e0 notin t)
			w-->Stat9(Stat2,Stat2*) ==> Stat10: (e0 = cdr(w)) & Stat11: (w in {[u,v]: u in s, v in t})
			(u,v)-->Stat11(Stat10*) ==> (w = [u,v]) & (v in t)
		(Stat8)Discharge ==> Stat12: domain(y) ¥nincin s
		Use_def(domain(y)) ==> AUTO
		dp-->Stat12(Stat12*) ==> Stat13: (dp in {car(z): z in y}) & (dp notin s)
		z-->Stat13(Stat13,Stat2*) ==> Stat14: (dp = car(z)) & Stat15: (z in {[u,v]: u in s, v in t})
		(up,vp)-->Stat15(Stat14*) ==> (z = [up,vp]) & (up in s)
	(Stat12)Discharge ==> Stat16: Is_map(y) & (domain(y) ¥incin s) & (range(y) ¥incin t) & Stat17: (y ¥nincin (s ¥PROD t))
	cp-->Stat17(Stat16*) ==> (cp in y) & (cp notin (s ¥PROD t))
	Use_def(Is_map(y)) ==> AUTO
	Use_def(¥PROD)(Stat16*) ==> Stat18: (cp in {[car(w),cdr(w)]: w in y}) &
			Stat19: (cp notin {[u,v]: u in s, v in t})
	wp-->Stat18(Stat18*) ==> Stat20: (cp = [car(wp),cdr(wp)]) & (wp in y)
	Use_def(domain(y)) ==> AUTO
	Suppose ==> Stat21: car(wp) notin {car(w): w in y}
	wp-->Stat21(Stat20,Stat20*) ==> false; Discharge ==> car(wp) in s
	Use_def(range(y)) ==> AUTO
	Suppose ==> Stat22: cdr(wp) notin {cdr(w): w in y}
	wp-->Stat22(Stat20,Stat20*) ==> false; Discharge ==> cdr(wp) in t
	(car(wp),cdr(wp))-->Stat19(Stat18*) ==> false; Discharge ==> QED
--
--
--
Theorem 142: [Image of Cartesian product by a singleton] (U in Z) ¥imp (((Z ¥PROD {V})~[U]) = V). Proof:
Suppose_not(u,z,v) ==> AUTO
	Use_def(¥PROD) ==> (z ¥PROD {v}) = {[w,t]: w in z, t in {v}}
	SIMPLF ==> (z ¥PROD {v}) = {[w,v]: w in z}
	APPLY() fcn_symbol(f(w)->v,g->(z ¥PROD {v}),s->z) ==>
		Stat1: (FORALL w | (w in z) ¥imp (((z ¥PROD {v})~[w]) = v))
	u-->Stat1 ==> false; Discharge ==> QED
--
-- =======================================================================================
--
-- Our next result states another elementary property of the Cartesian product:
-- two such products are disjoint if their second factors are disjoint.
-- (The reader will readily perceive that the same is true for two Cartesian products
-- whose first factors are disjoint).
--
Theorem 143: [Cartesian product disjointness] (A * B = 0) ¥imp ((X ¥PROD A) * (Y ¥PROD B) = 0). Proof:
    Suppose_not(a,b,xx,yy) ==> (a * b = 0) & Stat1: ((xx ¥PROD a) * (yy ¥PROD b) /= 0)
    c-->Stat1 ==> (c in (xx ¥PROD a)) & (c in (yy ¥PROD b))
    Use_def(¥PROD) ==> Stat2: (c in {[u,v]: u in xx, v in a}) & (c in {[u,v]: u in yy, v in b})
    (a1,b1,a2,b2)-->Stat2 ==> (c = [a1,b1]) & (a1 in xx) & (b1 in a) & (c = [a2,b2]) & (a2 in yy) & (b2 in b)
    Discharge ==> QED
--
-- The following theorem shows that even though the Cartesian product operator
-- is not associative, there always exists a natural 1-1 correspondence between
-- $((A ¥PROD B) ¥PROD C)$ and $(A ¥PROD (B ¥PROD C))$.
--
Theorem 144: [Cartesian modified associativity] (F = {[[[x,y],z],[x,[y,z]]]: x in A, y in B, z in C}) ¥imp
	(one_1_map(F) & (domain(F) = ((A ¥PROD B) ¥PROD C)) & (range(F) = (A ¥PROD (B ¥PROD C)))). Proof:
    Suppose_not(f,a,b,c) ==> (f = {[[[x,y],z],[x,[y,z]]]: x in a, y in b, z in c}) &
	((not one_1_map(f)) or (domain(f) /= ((a ¥PROD b) ¥PROD c)) or
				(range(f) /= (a ¥PROD (b ¥PROD c))))
--
-- For suppose the contrary. Since we can apply one_1_test_3 to show that $f$ must be 1-1,
-- only the theorem clauses concerning the range and domain of f can be false.
--
    Suppose ==> not one_1_map(f)
        EQUAL ==> not one_1_map({[[[x,y],z],[x,[y,z]]]: x in a, y in b, z in c | true})
	Discharge ==> one_1_map(f)
--
-- Next suppose that the clause concerning $domain(f)$ is false.
-- Using the definitions of the operators involved we find that
-- there must exist elements x,y,u satisfying the impossible inequality seen below,
-- a contradiction leaving only the case $range(f) /= (a ¥PROD (b ¥PROD c))$ to be considered.
--
    Suppose ==> domain(f) /= ((a ¥PROD b) ¥PROD c)
    Use_def(domain) ==> {car(x): x in f} /= ((a ¥PROD b) ¥PROD c)
    EQUAL ==> {car(x): x in {[[[x,y],z],[x,[y,z]]]: x in a, y in b, z in c}} /= ((a ¥PROD b) ¥PROD c)
    SIMPLF ==> {car([[[x,y],z],[x,[y,z]]]): x in a, y in b, z in c} /= ((a ¥PROD b) ¥PROD c)
    Use_def(¥PROD) ==> {car([[[x,y],z],[x,[y,z]]]): x in a, y in b, z in c} /=
	{[u,z]: u in {[x,y]: x in a, y in b}, z in c}
    SIMPLF ==> Stat1: {car([[[x,y],z],[x,[y,z]]]): x in a, y in b, z in c} /=
    		{[[x,y],z]: x in a, y in b, z in c}
	(x,y,u)-->Stat1 ==> Stat2: car([[[x,y],u],[x,[y,u]]]) /= [[x,y],u]
    (Stat2)Discharge ==> range(f) /= (a ¥PROD (b ¥PROD c))
--
-- Expanding this last case using the definitions of the operators involved we see just as easily
-- that it leads to an impossible elementary inequality,
-- a final contradiction which completes the proof of our theorem.
--
    Use_def(range) ==> {cdr(x): x in f} /= (a ¥PROD (b ¥PROD c))
    EQUAL ==> {cdr(x): x in {[[[x,y],z],[x,[y,z]]]: x in a, y in b, z in c}} /= (a ¥PROD (b ¥PROD c))
    SIMPLF ==> {cdr([[[x,y],z],[x,[y,z]]]): x in a, y in b, z in c} /= (a ¥PROD (b ¥PROD c))
    Use_def(¥PROD) ==> {cdr([[[x,y],z],[x,[y,z]]]): x in a, y in b, z in c} /=
	{[x,v]: x in a, v in {[y,z]: y in b, z in c}}
    SIMPLF ==> Stat3: {cdr([[[x,y],z],[x,[y,z]]]): x in a, y in b, z in c} /=
    		{[x,[y,z]]: x in a, y in b, z in c}
	(xx,yy,uu)-->Stat3 ==> Stat4: cdr([[[xx,yy],uu],[xx,[yy,uu]]]) /= [xx,[yy,uu]]
    (Stat4)Discharge ==> QED
--
-- Moreover, even though the Cartesian product operator
-- is not commutative, there always exists a natural 1-1 correspondence between
-- $A ¥PROD B$ and $B ¥PROD A$.
--
Theorem 145: [Cartesian modified commutativity] (F = {[[x,y],[y,x]]: x in A, y in B}) ¥imp
			(one_1_map(F) & (domain(F) = (A ¥PROD B)) & (range(F) = (B ¥PROD A))). Proof:
    Suppose_not(f,a,b) ==> (f = {[[x,y],[y,x]]: x in a, y in b}) &
   			((not one_1_map(f)) or domain(f) /= (a ¥PROD b) or range(f) /= (b ¥PROD a))
--
-- For suppose the contrary. Since we can apply $one_1_test_2$ to show that $f$ must be 1-1,
-- only the theorem clauses concerning the range and domain of $f$ can be false.
--
    Suppose ==> not one_1_map(f)
	APPLY(x6_thryvar:x,y6_thryvar:y,x2_thryvar:xx,y2_thryvar:yy) one_1_test_2(a2(x,y)->[x,y],b2(x,y)->[y,x],s->a,t->b) ==>
		not(([x,y] = [xx,yy]) ¥eq ([y,x] = [yy,xx])) or one_1_map({[[x,y],[y,x]]: x in a, y in b})
	EQUAL ==> Stat1: not(([x,y] = [xx,yy]) ¥eq ([y,x] = [yy,xx]))
	(Stat1)Discharge ==> one_1_map(f)
--
-- Next suppose that the clause concerning $domain(f)$ is false.
-- Using the definitions of the operators involved we find that
-- there must exist elements $x,y,u$ satisfying the impossible inequality seen below,
-- a contradiction leaving only the case $range(f) /= (a ¥PROD (b ¥PROD c))$ to be considered.
--
    Suppose ==> domain(f) /= (a ¥PROD b)
    Use_def(domain) ==> {car(x): x in f} /= (a ¥PROD b)
    EQUAL ==> {car(u): u in {[[x,y],[y,x]]: x in a, y in b}} /= (a ¥PROD b)
    SIMPLF ==> {car([[x,y],[y,x]]): x in a, y in b} /= (a ¥PROD b)
    Use_def(¥PROD) ==> Stat2: {car([[x,y],[y,x]]): x in a, y in b} /= {[x,y]: x in a, y in b}
    (xp,yp)-->Stat2 ==> Stat3: car([[xp,yp],[yp,xp]]) /= [xp,yp]
    (Stat3)Discharge ==> range(f) /= (b ¥PROD a)
--
-- Expanding this last case using the definitions of the operators involved,
-- we see just as easily that it leads to an impossible elementary inequality,
-- a final contradiction which completes the proof of our theorem.
--
    Use_def(range) ==> {cdr(x): x in f} /= (b ¥PROD a)
    EQUAL ==> {cdr(u): u in {[[x,y],[y,x]]: x in a, y in b}} /= (b ¥PROD a)
    SIMPLF ==> {cdr([[x,y],[y,x]]): x in a, y in b} /= (b ¥PROD a)
    Use_def(¥PROD) ==> {cdr([[x,y],[y,x]]): x in a, y in b} /= {[x,y]: x in b, y in a}
    Suppose ==> Stat4: {[x,y]: x in b, y in a} /= {[y,x]: x in a, y in b}
    c-->Stat4 ==> Stat5: ((c in {[x,y]: x in b, y in a}) & (c notin {[y,x]: x in a, y in b})) or
    				((c notin {[x,y]: x in b, y in a}) & (c in {[y,x]: x in a, y in b}))
    Suppose ==> Stat6: (c in {[x,y]: x in b, y in a}) & (c notin {[y,x]: x in a, y in b})
    (x1,y1,y1,x1)-->Stat6 ==> Stat7: (x1 in b) & (y1 in a) & (c = [x1,y1]) &
    					(not((y1 in a) & (x1 in b) & (c = [x1,y1])))
    (Stat7)Discharge ==> Stat8: (c in {[y,x]: x in a, y in b}) &
    										(c notin {[x,y]: x in b, y in a})
    (x2,y2,y2,x2)-->Stat8 ==> Stat9: (x2 in a) & (y2 in b) & (c = [y2,x2]) &
    					(not((x2 in a) & (y2 in b) & (c = [y2,x2])))
    (Stat9)Discharge ==>
    	Stat10: {cdr([[x,y],[y,x]]): x in a, y in b} /= {[y,x]: x in a, y in b}
    (x3,y3)-->Stat10 ==> Stat11: cdr([[x3,y3],[y3,x3]]) /= [y3,x3]
    (Stat11)Discharge ==> QED
--
-- The preceding preliminaries now being completed, we return to
-- a more serious discussion of results on cardinality.
-- Our first, preparatory result states that the restriction of the previously introduced
-- enumerating function $enum(x,s)$ to any ordinal $s$ is the identity function on $s$.
--
Theorem 146: [Enumeration of an ordinal] (Ord(S) & X in S) ¥imp (enum(X,S) = X). Proof:
    Suppose_not(s,a) ==> Ord(s) & (a in s) & (enum(a,s) /= a)
--
-- For, supposing the contrary, there would necessarily exist a minimal ordinal
-- $b in s$ such that $enum(b,s) /= b$.
--
    APPLY(mt1_thryvar:b) transfinite_induction (n->a,P(x)->(x in s) & (enum(x,s) /= x)) ==>
		Stat1: (FORALL x | ((b in s) & (enum(b,s) /= b)) & (((x in b) ¥imp (not ((x in s) & (enum(x,s) /= x))))))
	a0-->Stat1 ==> Stat2: (b in s) & (enum(b,s) /= b)
    (s,b)-->T13 ==> Stat3: b ¥incin s
    Use_def(enum) ==> Stat4: enum(b,s) = if (s ¥incin {enum(y,s): y in b}) then s else arb(s - {enum(y,s): y in b}) end if
--
-- But we can show that such a $b$ must satisfy ${enum(y,s): y in b} = b$.
-- Indeed, supposing the contrary, there would exist a $c$
-- which was in one of these sets but not the other.
-- Suppose first that $c notin b$, so that $c$ must be of the form $enum(d,s)$ where $d in b$,
-- and so $d in s$ since the ordinal $s$ includes each of its members.
--
    Suppose ==> Stat5: {enum(y,s): y in b} /= b
    c-->Stat5 ==> ((c in {enum(y,s): y in b}) & (c notin b)) or ((c notin {enum(y,s): y in b}) & (c in b))
    Suppose ==> Stat6: (c in {enum(y,s): y in b}) & (c notin b)
    d-->Stat6 ==> (c = enum(d,s)) & (d in b)
    ELEM ==> d in s
--
-- However the minimality of $b$ then implies that $enum(d,s) = d$, and so $d = c$
-- which is impossible since $c notin b$. This contradiction  proves that
-- we need only consider the second of our two original cases, that in which
-- $c$ belongs to $b$ and $c /= enum(c,s)$.
--
    d-->Stat1 ==> enum(d,s) = d
    Discharge ==> Stat7: (c notin {enum(y,s): y in b}) & (c in b)
    c-->Stat7 ==> not((c in b) & (c = enum(c,s)))
    ELEM ==> c /= enum(c,s)
--
-- However in this case Stat8 0 leads immediately to the contradiction $c notin s$,
-- completing the proof of our claim ${enum(y,s): y in b} = b$.
-- Therefore since $b in s$ and so $not(b incs s) and s - b /= 0$, the
-- previously cited definition of '$enum$' tells us that $enum(b,s) = arb(s - b)$,
-- and so using the axiom of choice we must have $arb(s - b) in s - b$, which implies
-- $arb(s - b) in s$.
--
    c-->Stat1 ==> c notin s
    Discharge ==> Stat8: {enum(y,s): y in b} = b
    (Stat2,Stat4,Stat8*)ELEM ==> Stat9: (enum(b,s) = arb(s - {enum(y,s): y in b})) & (not(s ¥incin b))
    EQUAL(Stat8) ==> enum(b,s) = arb(s - b)
    (s - b)-->T0(Stat3,Stat9) ==> Stat10: (arb(s - b) in s - b) & (arb(s - b) * (s - b) = 0)
    (Stat10*)ELEM ==> Stat11: (arb(s - b) in s - b) & (arb(s - b) * (s - b) = 0) & (arb(s - b) in s)
--
-- But since $s$ is an ordinal, its elements $b$ and $arb(s - b)$ are ordered by membership,
-- and since $arb(s - b) in (s - b)$ we must have $b in arb(s - b)$ and hence $b notin s - b$
-- implying $b in b$, which is impossible.
--
    Use_def(Ord) ==> Stat12: (FORALL x in s, y in s | ((x in y) or (y in x) or (x = y)))
    (b,arb(s - b))-->Stat12(Stat2*) ==> Stat13: (b in arb(s - b)) or (arb(s - b) = b)
    (Stat8,Stat2,Stat9,Stat13*)Discharge ==> QED

--
-- Next we prove various key properties of the cardinality $#s$ of a set $s$,
-- showing first that $#s$ is the smallest ordinal in 1-1 correspondence with $s$.
--
Theorem 147: [Cardinality lemma] Ord(#S) & (EXISTS f in OM | (one_1_map(f) & (range(f) = S) & (domain(f) = #S))) &
	(not((EXISTS o in #S | (EXISTS g in OM | one_1_map(g) & (range(g) = S) & (domain(g) = o))))). Proof:
--
-- We proceed by contradiction. Let $s$ be a counterexample to our theorem, and first suppose that
-- either $#s$ is not an ordinal, or that there is no $f$ which puts $s$ into 1-1 correspondence
-- with $#s$. But then consider the specific $f$ defined as $f = {[x,enum(x,s)]: x in enum_Ord(s)}$.
--
    Suppose_not(s) ==> (not Ord(#s)) or (not(EXISTS f in OM | (one_1_map(f) & (range(f) = s) & (domain(f) = #s)))) or
	(EXISTS o in #s | (EXISTS g in OM | one_1_map(g) & (range(g) = s) & (domain(g) = o)))
    Use_def(#) ==> #s = arb({x: x in next(enum_Ord(s)) | (EXISTS f in OM | (one_1_map(f) & (domain(f) = x) & (range(f) = s)))})
	T47 ==> Stat1: (FORALL s | Ord(enum_Ord(s)) & (s = {enum(y,s): y in enum_Ord(s)}) &
		(FORALL y in enum_Ord(s), z in enum_Ord(s) | ((y /= z) ¥imp (enum(y,s) /= enum(z,s)))))
    s-->Stat1 ==> Ord(enum_Ord(s)) & (s = {enum(y,s): y in enum_Ord(s)})
    (enum_Ord(s))-->T32 ==> Ord(next(enum_Ord(s)))
    Use_def(Ord) ==> Stat2: (FORALL x in next(enum_Ord(s)) | x ¥incin next(enum_Ord(s)))
    Suppose ==> (not Ord(#s)) or (not(EXISTS f in OM | (one_1_map(f) & (domain(f) = #s) & (range(f) = s))))
    Loc_def ==> s1 = s
    Loc_def ==> f = {[x,enum(x,s1)]: x in enum_Ord(s1)}
--
-- Our general '$fcn_symbol$' theory tells us that this has $enum_Ord(s)$ as range,
-- and it is easily seen, using the definition of '$enum_Ord$' that it has domain $s$.
--
    APPLY(x9_thryvar:y,y9_thryvar:wz) fcn_symbol(f(x)->enum(x,s1),g->f,s->enum_Ord(s1)) ==>
		Svm(f) & (domain(f) = enum_Ord(s1)) & (range(f) = {enum(x,s1): x in enum_Ord(s1)}) &
			(((y in enum_Ord(s1)) & (wz in enum_Ord(s1)) &
						((enum(y,s1) = enum(wz,s1)) & (y /= wz))) or one_1_map(f))
	EQUAL ==>  Svm(f) & (domain(f) = enum_Ord(s)) & (range(f) = {enum(x,s): x in enum_Ord(s)}) &
			Stat3: (((y in enum_Ord(s)) & (wz in enum_Ord(s)) &
						((enum(y,s) = enum(wz,s)) & (y /= wz))) or one_1_map(f))
    ELEM ==> Svm(f) & (domain(f) = enum_Ord(s)) & (range(f) = s)
--
-- Next suppose that $f$ is not 1-1. Then, by Stat4 3, there would exist two distinct elements
-- $y$ and $wz$ of $enum_Ord(s)$ such that $enum(y,s) = enum(wz,s)$, which is impossible
-- by the definition of $enum_Ord$.
--
    Suppose ==> not one_1_map(f)
    ELEM ==> (y in enum_Ord(s)) & (wz in enum_Ord(s)) & (enum(y,s) = enum(wz,s)) & (y /= wz)
    s-->Stat1 ==> Stat5: (FORALL y in enum_Ord(s), z in enum_Ord(s) |
    								 (y /= z) ¥imp (enum(y,s) /= enum(z,s)))
    (y,wz)-->Stat5 ==> ((y in enum_Ord(s)) & (wz in enum_Ord(s)) &
    						(y /= wz)) ¥imp (enum(y,s) /= enum(wz,s))
    Discharge ==> one_1_map(f)
--
-- We know at this point that there is a 1-1 mapping $f$ between $s$ and some ordinal;
-- hence there is a least ordinal which can be mapped to $f$ in 1-1 fashion.
--
    Use_def(next) ==> next(enum_Ord(s)) = enum_Ord(s) + {enum_Ord(s)}
    Suppose ==>
	Stat6: enum_Ord(s) notin {x: x in next(enum_Ord(s)) | (EXISTS f in OM | (one_1_map(f) & (domain(f) = x) & (range(f) = s)))}
    (enum_Ord(s))-->Stat6 ==> (not ((enum_Ord(s) in next(enum_Ord(s))) &
	(EXISTS f in OM | (one_1_map(f) & (domain(f) = enum_Ord(s)) & (range(f) = s)))))
    ELEM ==> Stat7: not (EXISTS f in OM | (one_1_map(f) & (domain(f) = enum_Ord(s)) & (range(f) = s)))
    f-->Stat7 ==> false; Discharge ==>
    Stat8: enum_Ord(s) in {x: x in next(enum_Ord(s)) | (EXISTS f in OM | (one_1_map(f) & (domain(f) = x) & (range(f) = s)))}
   (Stat8)ELEM ==> {x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff)) & (domain(ff) = x) & (range(ff) = s))} /= 0
    {x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))}-->T0 ==>
	Stat9: (arb({x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))}) in
	{x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))}) &
	(arb({x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))}) *
	{x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))} = 0)
--
-- By definition, this least ordinal is the cardinality $#s$ of s, and so $#s$ is an ordinal,
-- and is in 1-1 correspondence with $s$. Therefore our theorem can only be false if
-- some smaller ordinal $o$ is also in 1-1 correspondence with $s$.
--
    ELEM ==> #s = arb({x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))})
    (Stat9*)ELEM ==> Stat10: (#s in {x: x in next(enum_Ord(s)) |
    				(EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))}) &
	 (#s * {x: x in next(enum_Ord(s)) |
	 		(EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))} = 0)
    x1-->Stat10 ==> (#s = x1) & (#s in next(enum_Ord(s))) &
    				(EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x1) & (range(ff) = s)))
    EQUAL ==> (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = #s) & (range(ff) = s)))
    (next(enum_Ord(s)),#s)-->T12 ==> false;
    Discharge ==> Stat11: (EXISTS o in #s | (EXISTS g in OM | (one_1_map(g) & (range(g) = s)
    				 & (domain(g) = o))))
    o-->Stat11 ==> Stat12: (o in #s) & (EXISTS g in OM | (one_1_map(g) & (domain(g) = o) &
    			(range(g) = s)))
--
-- But by definition $#s$ is the least ordinal in 1-1 correspondence with $s$,
-- a final contradiction which completes the proof of the present theorem.
--
	ELEM ==> Stat13: (#s in {x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) &
	(domain(ff) = x) & (range(ff) = s)))}) &
	 (#s * {x: x in next(enum_Ord(s)) |
	 	(EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))} = 0)
    ELEM ==> Stat14: o notin {x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) &
    			(domain(ff) = x) & (range(ff) = s)))}
    o-->Stat14 ==> o notin next(enum_Ord(s))
    x2-->Stat13 ==> #s in next(enum_Ord(s))
    (#s)-->Stat2 ==> false; Discharge ==> QED
--
-- Using Theorem 147 it is easy to prove that no set $s$ can be a member of its own cardinality.
--
Theorem 148: [Cardinality minimum theorem] S notin #S. Proof:
	Suppose_not(s) ==> s in #s
	s-->T147 ==> Stat1: not((EXISTS o in #s | (EXISTS g in OM | one_1_map(g) & (range(g) = s) & (domain(g) = o))))
	s-->Stat1 ==> Stat2: not(EXISTS g in OM | one_1_map(g) & (range(g) = s) & (domain(g) = s))
	s-->T115 ==> one_1_map(ident(s)) & (domain(ident(s)) = s) & (range(ident(s)) = s)
	(ident(s))-->Stat2 ==> false; Discharge ==> QED
--
-- The following theorem states  a special property of the choice operator
-- '$arb$' which is sometimes useful.
--
Theorem 149: ['arb' is monotone decreasing for non-empty sets of ordinals]
    (Ord(R) & (R incs S) & (S incs T)) ¥imp (arb(S) in arb(T) or arb(S) = arb(T) or T = 0). Proof+:
    Suppose_not(o,s,t) ==> Ord(o) & (o incs s) & (s incs t) &
    	(arb(s) notin arb(t)) & (arb(s) /= arb(t)) & (t /= 0)
--
-- For consider a nonempty subset $t$ of a set $s$ of ordinals.
-- Since $arb(t)$ is a member of $t$ and hence of $s$,
-- it cannot be a member of $arb(s)$. Thus, since both $arb(t)$ and $arb(s)$ must be
-- ordinals, our claim follows immediately from Theorem 31.
--
    s-->T0 ==> ((arb(s) in s) & (arb(s) * s = 0))
    t-->T0 ==> arb(t) in t
    (arb(s),arb(t))-->T31 ==> arb(t) in arb(s) * s
    Discharge ==> QED
--
-- Our next theorem, closely related to the preceding, tells us that '$arb$' selects the minimum
-- element of any set of ordinals.
--
Theorem 150: [Axiom of choice variant] ((S /= 0) & (FORALL x in S | Ord(x))) ¥imp (FORALL x in S | x incs arb(S)). Proof:
    Suppose_not(s) ==> (s /= 0) & Stat1: (FORALL x in s | Ord(x)) &
    						Stat2: (not((FORALL x in s | x incs arb(s))))
--
-- For otherwise there is a non-null set $s$ of ordinals with a member $x$ not including $arb(s)$.
-- But by the axiom of choice, $x$ cannot be a member of $arb(s)$, and so by Theorem 31
-- $s$ must be a member, and hence a subset, of $x$, contradicting the definition of $x$,
-- and so proving our theorem.
--
    x-->Stat2 ==> (x in s) & (not(x incs arb(s)))
    x-->Stat1 ==> Ord(x)
    s-->T0 ==> (arb(s) in s) & (x notin arb(s))
    (arb(s))-->Stat1 ==> Ord(arb(s))
    (arb(s),x)-->T31 ==> arb(s) in x
    (x,arb(s))-->T34 ==> false; Discharge ==> QED
--
-- Our next aim is to prove that the cardinality of any subset $t$ of a set $s$ is
-- no more than the cardinality of $s$, This will be established by showing that
-- the enumerating ordinal of $t$ is no larger than that of $s$.
-- We prepare for this by showing that if $t$ is a subset of an ordinal $s$,
-- then the function $enum(x,t)$ is nondecreasing in the variable $x$.
--
Theorem 151: [Lemma for ordinal enumeration]
	(Ord(S) & (T ¥incin S) & (X in S) & (Y in X)) ¥imp (enum(Y,T) in enum(X,T) or enum(X,T) incs T). Proof+:
Suppose_not(s,t,x,y2) ==>
	Stat1: Ord(s) & (t ¥incin s) & (x in s) & (y2 in x) & (enum(y2,t) notin enum(x,t)) & (not(enum(x,t) incs t))
--
-- For suppose the contrary. Then $enum(x,t)$ cannot be $t$, so by definition of '$enum$'
-- it must be a member of $t$, hence of $s$, hence an ordinal. Likewise $x$ must be an ordinal,
-- and so $y2$ must also be an ordinal. Moreover $t - {enum(u,t): u in x}$ must be nonempty.
--
	Use_def(enum) ==> enum(x,t) = if t ¥incin {enum(u,t): u in x} then t else arb(t - {enum(u,t): u in x}) end if
	ELEM ==> Stat2: ((t - {enum(u,t): u in x}) /= 0) & (enum(x,t) = arb(t - {enum(u,t): u in x}))
	(t - {enum(u,t): u in x})-->T0(*) ==> (enum(x,t) in t - {enum(u,t): u in x}) & (enum(x,t) in s)
--
-- Thus $y2$ must be a subset of $x$, and so it follows by the principle of set monotonicity
-- that ${enum(u,t): u in y2} ¥incin {enum(u,t): u in x}$. But then $t - {enum(u,t): u in y2}$ must be nonempty,
-- and so, by definition of '$enum$', $enum(y2,t) = arb(t - {enum(u,t): u in y2})$
--
	(x,y2)-->T13(Stat1,Stat1*) ==> y2 ¥incin x
	EQUAL ==> Stat3: Ord(enum(x,t)) & Ord(x) & Ord(y2)
	Set_monot ==> Stat4: {enum(u,t): u in y2} ¥incin {enum(u,t): u in x}
	Use_def(enum(y2,t)) ==> AUTO
	(Stat2,Stat4*)ELEM ==> Stat5: (t - {enum(u,t): u in y2} incs t - {enum(u,t): u in x}) & (t - {enum(u,t): u in y2} /= 0)
	(Stat4*)ELEM ==> Stat6: ((t - {enum(u,t): u in y2}) /= 0) & (enum(y2,t) = arb(t - {enum(u,t): u in y2}))
--
-- Thus, since we have seen that $t - {enum(u,t): u in y2} incs t - {enum(u,t): u in x}$,
-- it follows by Theorem 149 that $enum(y2,t)$ is no larger than $enum(x,t)$, so it must equal $enum(x,t)$.
-- But since $y2$ is in $x$ this is easily seen to be impossible, and so we have a contradiction
-- which proves our theorem.
--
	(s, t - {enum(u,t): u in y2},t - {enum(u,t): u in x})-->T149(Stat1,Stat2,Stat5,Stat6*) ==>
			Stat9: enum(y2,t) = enum(x,t)
	t-->T46(Stat10*) ==> Stat10: (EXISTS u | (Ord(u) & (t = {enum(y2,t): y2 in u})) &
							(FORALL y in u, wz in u | (y /= wz) ¥imp (enum(y,t) /= enum(wz,t))))
	u-->Stat10(Stat10*) ==> Stat11: (FORALL y in u, wz in u | (y /= wz) ¥imp (enum(y,t) /= enum(wz,t))) & Ord(u) & (t = {enum(y,t): y in u})
 	Suppose ==> y2 notin u
		(u,y2)-->T35(Stat3*) ==> u ¥incin y2
		Set_monot ==> {enum(v,t): v in u} ¥incin {enum(v,t): v in y2}
 	Discharge ==> Stat12: y2 in u
	Suppose ==> x notin u
		(u,x)-->T35(Stat3*) ==> u ¥incin x
		Set_monot ==> {enum(v,t): v in u} ¥incin {enum(v,t): v in x}
 	 Discharge ==> Stat13: x in u
	(x,y2)-->Stat11(Stat1,Stat12,Stat13,Stat9*) ==> false; Discharge ==> QED
--
-- We continue the sequence of steps which will lead us to a proof that the cardinality
-- of a subset of a set $s$ is no greater than $#s$. Our plan is to prove this first for ordinals
-- and then to generalize to arbitrary sets, using the fact that any set is in 1-1
-- correspondence with an ordinal. The following lemma states a related fact about
-- the standard enumeration of ordinals.
--
Theorem 152: [Subsets of an ordinal enumerate at least as rapidly as the ordinal]
	(Ord(S) & (T ¥incin S) & (X in S)) ¥imp (enum(X,T) incs X or enum(X,T) incs T). Proof+:
    Suppose_not(s,t,b) ==> Stat0: Ord(s) & (t ¥incin s) & (b in s) & (not ((enum(b,t) incs b) or (enum(b,t) incs t)))
--
-- For suppose the contrary, so that there is an ordinal $s$ with a subset $t$ for which there exists a $b in s$
-- such that $enum(b,t)$ fails to include $b$ and is not $t$. By the principle of transfinite induction, there
-- exists a least such element of $s$, which we call $a$.
--
    APPLY(mt1_thryvar:a) transfinite_induction (n->b,P(x)->((x in s) & (not((enum(x,t) incs x) or (enum(x,t) incs t))))) ==>
		Stat1: (FORALL x | ((a in s) & (not((enum(a,t) incs a) or (enum(a,t) incs t)))) &
			((x in a) ¥imp (not((x in s) & (not((enum(x,t) incs x) or (enum(x,t) incs t)))))))
	a0-->Stat1(Stat1*) ==> (a in s) & (not (enum(a,t) incs a)) & (not (enum(a,t) incs t))
--
-- It follows by definition of '$enum$' that $t$ cannot be a subset of ${enum(u,t): u in a}$, and that
-- $enum(a,t)$ is a member of $t - {enum(y,t): y in a}$
--
    Use_def(enum(a,t)) ==> AUTO
    (Stat0*)ELEM ==> ((t - {enum(y,t): y in a}) /= 0) & (enum(a,t) = arb(t - {enum(y,t): y in a}))
    (t - {enum(y,t): y in a})-->T0(Stat1*) ==> enum(a,t) in t - {enum(y,t): y in a}
--
-- Since $a$ is a member of $s$, it must be an ordinal and a subset of $s$.
-- Since $enum(a,t)$ belongs to $t$ it belongs to $s$, and so it is also an ordinal.
-- Since $enum(a,t)$ is not larger than $a$, it must be a member of $a$, so Theorem 151 tells us that
-- $enum(enum(a,t),t)$ is a member, and hence a subset, of $enum(a,t)$.
--
    (s,a)-->T34(Stat0*) ==> (a ¥incin s) & (enum(a,t) in s)
    (a,enum(a,t))-->T35(Stat0*) ==> enum(a,t) in a
    (s,t,a,enum(a,t))-->T151(Stat0*) ==> enum(enum(a,t),t) in enum(a,t)
--
-- Since $enum(a,t)$ is a member of $t$, $enum(enum(a,t),t)$ cannot include $t$ since if it did we would have
-- the membership cycle $enum(a,t)$ $in$ $enum(enum(a,t),t)$ $in$ $enum(a,t)$.
-- Applying Stat2 1 we therefore find that $enum(enum(a,t),t) incs enum(a,t)$,
-- and hence the same impossible membership cycle, a contradiction which proves our theorem.
--
    (enum(a,t))-->Stat1(Stat1*) ==> ((not (enum(a,t) in s)) or enum(enum(a,t),t) incs enum(a,t) or enum(enum(a,t),t) incs t)
    Discharge ==> QED
--
-- It follows from the preceding theorem that ${enum(x,t): x in s} incs t$ for every subset
-- $t$ of an ordinal $s$
--
Theorem 153: [Subset enumeration lemma] (Ord(S) & (T ¥incin S)) ¥imp ({enum(x,T): x in S} incs T). Proof+:
Suppose_not(s,t) ==> AUTO
--
-- For suppose the contrary. Since by definition $s$ is both a member and a subset of $next(s)$,
-- and since $next(s)$ is an ordinal by Theorem 32, it follows by the previous theorem that
-- $enum(s,t) incs t$
--
	Loc_def ==> s1 = next(s)
	Use_def(next(s)) ==> AUTO
	(s1,t,s)-->T152(*) ==> enum(s,t) incs t
--
-- But since by assumption $t - {enum(y,t): y in s}$ is not empty, it follows by definition of '$enum$'
-- and by the axiom of choice that $enum(s,t)$ is a member of $t$, and hence a member of itself,
-- a contradiction which proves our theorem.
--
	Use_def(enum(s,t)) ==> AUTO
	Discharge ==> QED
--
-- Next we show that if $t$ is a subset of an ordinal $s$, there is an ordinal $x$ no larger than $s$
-- which 'enum' puts into 1-1 correspondence with $t$.
--
Theorem 154: [Second subset enumeration lemma] (Ord(S) & (T ¥incin S)) ¥imp (EXISTS x ¥incin S | (Ord(x) & (T = {enum(y,T): y in x}) &
	(FORALL y in x, z in x | ((y /= z) ¥imp (enum(y,T) /= enum(z,T)))))). Proof+:
Suppose_not(s,t) ==> AUTO
--
-- Suppose the contrary: that the map $enum(.,t)$ does not put $t$ in 1-1 correspondence with
-- the set ${enum(y,t): y in x}$ for any ordinal no larger than $s$. Since Theorem 153 tells us that
-- ${enum(x,t): x in s} incs t$, we can use the principle of transfinite induction
-- to find a smallest ordinal $u$ for which ${enum(x,t): x in u}$ includes $t$.
--
	(s,t)-->T153 ==> AUTO
	APPLY(mt1_thryvar:u) transfinite_induction (n->s,P(x)->Ord(x) & (x ¥incin s) & ({enum(v,t): v in x} incs t)) ==>
		Stat1: (FORALL x | Ord(u) & (u ¥incin s) & ({enum(v,t): v in u} incs t) &
				((x in u) ¥imp (not(Ord(x) & (x ¥incin s) & ({enum(w,t): w in x} incs t)))))
	x0-->Stat1(*) ==> Stat2: (not(EXISTS x ¥incin s | (Ord(x) & (t = {enum(y,t): y in x}) & (FORALL y in x, z in x | ((y /= z) ¥imp (enum(y,t) /= enum(z,t))))))) &

		Ord(u) & (u ¥incin s) & ({enum(v,t): v in u} incs t)
--
-- We now aim to derive a contradiction.
-- By Stat3, '$enum$' cannot map $u$ onto $t$ in 1-1 fashion.
-- Thus it either (Case 1) does not map $u$ in 1-1 fashion, or (Case 2) maps $u$ onto a set different from $t$.
-- First suppose that we are in Case 2, so that there exist distinct $y$ and $wz$ in $u$
-- such that $enum(y,t) = enum(wz,t)$.
--
	Suppose ==> Stat4: not(FORALL y in u, z in u | ((y /= z) ¥imp (enum(y,t) /= enum(z,t))))
		(y,wz)-->Stat4(Stat4*) ==> (y in u) & (wz in u) & (y /= wz) & (enum(y,t) = enum(wz,t))
--
--  Since $u$ is an ordinal, its members $y$ and $wz$ must also be ordinals, and must be subsets of $u$.
--
		(u,y)-->T13(Stat2*) ==> y ¥incin u
		(u,wz)-->T13(Stat2*) ==> wz ¥incin u
--
-- Since $y$ is an ordinal, a member of $u$, and a subset of $s$, Stat3 3 tells us that
-- ${enum(v,t): v in y}$ cannot include $t$. Also, since $enum(y,t) = enum(wz,t)$, it follows by
-- Theorem 44 that $t$ must belong either to ${enum(v,t): v in y}$ or ${enum(v,t): v in wz}$.
-- Suppose the former, so that there is an ordinal $a in y$ such that $t = enum(a,t)$.
-- Plainly, $a$ is a subset of $y$.
--
		y-->Stat1(Stat2*) ==>  Stat5: not({enum(v,t): v in y} incs t)
		Suppose ==> Stat6: t in {enum(v,t): v in y}
			a-->Stat6(Stat6*) ==> (t = enum(a,t)) & (a in y)
			(y,a)-->T34(Stat2*) ==> a ¥incin y
--
-- Since $tv$ cannot be a member of $t$, it follows by definition of '$enum$' that $t$ must be a subset of
-- ${enum(v,t): v in a}$, and therefore of the larger set ${enum(v,t): v in y}$. But it was shown above
-- that ${enum(v,t): v in y}$ cannot include $t$. This contradiction excludes the possibility that
-- $t$ is a member of ${enum(v,t): v in y}$, and so implies that $t$ is a member of ${enum(v,t): v in wz}$.
--
			Use_def(enum(a,t)) ==> AUTO
			(Stat6)ELEM ==> t ¥incin {enum(v,t): v in a}
			Set_monot ==> {enum(v,t): v in a} ¥incin {enum(v,t): v in y}
		Discharge ==> AUTO

		(y,wz,t)-->T44(Stat2*) ==> Stat7: t in {enum(v,t): v in wz}
--
-- However, an exactly similar argument refutes this possibility, implying that $t /= {enum(y,t): y in u}$.
-- Also, as shown above, ${enum(v,t): v in u} incs t$, from which it is obvious that
-- there is a $c in {enum(y,t): y in u}$, hence of the form $enum(d,t)$ with $d in u$, such that  $c notin t$.
--
		b-->Stat7(Stat7*) ==> (t = enum(b,t)) & (b in wz)
		(wz,b)-->T34(Stat2*) ==> b ¥incin wz
		Use_def(enum(b,t)) ==> AUTO
		(Stat7)ELEM ==> t ¥incin {enum(v,t): v in b}
		Set_monot ==> {enum(v,t): v in b} ¥incin {enum(v,t): v in wz}
		Set_monot ==> {enum(v,t): v in wz} ¥incin {enum(v,t): v in u}
		(Stat7*)ELEM ==> t in {enum(v,t): v in u}
		(Stat7*)ELEM ==> Stat8: (t /= {enum(y,t): y in u}) & (t ¥incin {enum(y,t): y in u})
		(Stat8*)ELEM ==> Stat9: not (t incs {enum(y,t): y in u})
		c-->Stat9(Stat9*) ==> Stat10: (c in {enum(y,t): y in u}) & (c notin t)
		d-->Stat10(Stat10*) ==> Stat11: (c = enum(d,t)) & (d in u) & (c notin t)
--
-- Since $u$ is an ordinal, its member $d$ must also be an ordinal and a subset of $d$.
-- Thus, by the minimality of $u$ (Stat3 3), ${enum(v,t): v in d}$ cannot include $t$,
-- which, by definition of 'enum', tells us that c = enum(d,t) must be a member of $t$,
-- contradicting what has just been proved. This excludes the case (Case 2) that we have had
-- under consideration, and so leaves open only the possibility that $t /= {enum(y,t): y in u}$;
-- but, since we have shown above that the second of these sets includes the first, if follows that
-- the first does  not include the second.
--
		(u,d)-->T13(Stat2*) ==> Stat12: d ¥incin u
		d-->Stat1(Stat2,Stat11,Stat12*) ==> Stat13: not({enum(v,t): v in d} incs t)
		Use_def(enum(d,t)) ==> AUTO
		(t - {enum(y,t): y in d})-->T0(Stat13*) ==> enum(d,t) in t
	Discharge ==>  AUTO

	u-->Stat2(Stat2*) ==> Stat14: {enum(w,t): w in u} ¥nincin t
--
-- Hence there is a $v in u$ such that $enum(v,t) notin t$, so it follows by definition of 'enum'
-- that $enum(v,t) notin t$, implying that ${enum(w): w in v} incs t$. Since the minimality
-- of $u$ rules this out, we have a contradiction which completes the proof of the present theorem.
--
	dd-->Stat14(Stat14*) ==> Stat15: (dd in {enum(w,t): w in u}) & (dd notin t)
	v-->Stat15(Stat15*) ==> Stat16: (v in u) & (enum(v,t) notin t)
	(u,v)-->T34(Stat2,Stat16*) ==> v ¥incin s
	Use_def(enum(v,t)) ==> AUTO
	(t - {enum(w,t): w in v})-->T0(Stat16*) ==> {enum(w,t): w in v} incs t
	v-->Stat1(Stat2*) ==> false; Discharge ==> QED
--
-- In proving Theorem 156 below we will want the following direct consequence of Theorem 154,
-- which tells us that any subset of an ordinal $s$ is in 1-1 correspondence with an
-- ordinal no greater than $s$.
--
Theorem 155: [Enumerability lemma] (Ord(S) & (T ¥incin S)) ¥imp
	(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (domain(f) ¥incin S) & (range(f) = T)). Proof:
Suppose_not(s,t) ==> Stat1: (not(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (domain(f) ¥incin s) & (range(f) = t))) &
		 	Ord(s) & (t ¥incin s)
--
-- For suppose the contrary, and let $t$ be a subset of an ordinal $s$ for which there is no
-- 1-1 correspondence with an ordinal no larger than $s$. By Theorem 154 there is an ordinal $xx$ no larger than $s$
-- for which the map $y->enum(y,t)$ is a 1-1 mapping of $xx$ onto $t$, contradicting the statement we have just
-- made and so proving our theorem.
--
	(s,t)-->T154(*) ==> Stat2: (EXISTS x ¥incin s | (Ord(x) & (t = {enum(y,t): y in x}) &
			(FORALL y in x, wz in x | ((y /= wz) ¥imp (enum(y,t) /= enum(wz,t))))))
	x2-->Stat2(*) ==> Stat3: (FORALL y in x2, wz in x2 | ((y /= wz) ¥imp (enum(y,t) /= enum(wz,t)))) &
			Ord(x2) & (x2 ¥incin s) & (t = {enum(y,t): y in x2})
	Loc_def ==> f = {[x,enum(x,t)]: x in x2}
	APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(f(x)->enum(x,t),g->f,s->x2) ==>
		Svm(f) & (domain(f) = x2) & (range(f) = {enum(x,t): x in x2}) &
		(((x in x2) & (y in x2) & (enum(x,t) = enum(y,t)) & (x /= y)) or one_1_map(f))
	(x,y)-->Stat3(Stat3*) ==> one_1_map(f)
	EQUAL(Stat3) ==> Ord(domain(f))
	f-->Stat1(Stat3*) ==> false; Discharge ==> QED
--
-- A straightforward consequence of Theorem 155, which is stated in the following theorem, is that
-- $#s$ is a cardinal in 1-1 correspondence with $s$ (rather than merely in the single-valued
-- correspondence which the definition of cardinality requires.)
-- This result has several easy but important corollaries which we then digress to prove.
--
Theorem 156: [Cardinality theorem] Card(#S) & Ord(#S) & (EXISTS f in OM | one_1_map(f) & (range(f) = S) & (domain(f) = #S)). Proof+:
Suppose_not(s) ==> AUTO
--
-- For suppose the contrary, i.e. either $#s$ is not a cardinal or is not in 1-1 correspondence with $s$.
-- Since by Theorem 147 $#s$ is an ordinal in 1-1 correspondence with $s$, it follows that
-- $#s$ must not be a cardinal. Thus, by definition of 'cardinal', there must exist a member $c$
-- of $#s$ and a 1-1 map of $c$ onto $#s$.
--
	s-->T147(*) ==> Stat1: (EXISTS f in OM | one_1_map(f) & (range(f) = s) & (domain(f) = #s)) &
				Ord(#s) &
				(not Card(#s)) &
			Stat2: (not(EXISTS o in #s | (EXISTS g in OM | one_1_map(g) & (range(g) = s) & (domain(g) = o))))
	Use_def(Card(#s)) ==> AUTO
	ELEM ==> Stat3: not(FORALL y in #s, ff in OM | not(domain(ff) = y) or not(range(ff) = #s) or not(Svm(ff)))
	(c,g)-->Stat3(Stat3*) ==> (c in #s) & (domain(g) = c) & (range(g) = #s) & Svm(g) & Ord(c)
--
-- By Theorem 138, $g$ has a 1-1 partial inverse $h$, which maps $#s$ to a subset of $c$, so the inverse of
-- $h$ is a 1-1 mapping of this subset $ssc$ onto $#s$.
--
	g-->T138(Stat3*) ==> Stat4: (EXISTS h | (domain(h) = range(g)) & (range(h) ¥incin domain(g)) & one_1_map(h) &
								(FORALL x in range(g) | g~[h~[x]] = x))
	h-->Stat4(Stat3*) ==> Stat4a: (domain(h) = #s) & (range(h) ¥incin c) & one_1_map(h)
	h-->T101(Stat4*) ==> (range(inv(h)) = #s) & (domain(inv(h)) ¥incin c) & one_1_map(inv(h))
--
-- However, Theorem 155 tells us that there is a 1-1 map $f$ of an ordinal contained in $c$ onto $ssc$.
-- By Theorem 34, this ordinal must either be $c$ or a member of $c$, and so must be a member of
-- $#s$ in any case.
--
	(c,domain(inv(h)))-->T155(Stat3*) ==> Stat5: (EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (domain(f) ¥incin c) &
				(range(f) = domain(inv(h))))
	f-->Stat5(Stat5*) ==> Stat5a: one_1_map(f) & Ord(domain(f)) & (domain(f) ¥incin c) & (range(f) = domain(inv(h)))
	(c,domain(f))-->T34(Stat3*) ==> (domain(f) in c) or (domain(f) = c)
	(#s,c)-->T34(Stat1*) ==> (c ¥incin #s) & (domain(f) in #s)
--
-- But now the map product $inv(h) @ f$ is a 1-1 map of a member of $#s$ onto $#s$, so if we let $ff$
-- be a 1-1 map of $#s$ to $s$, then $ff @ (inv(h) @ f)$ is a 1-1 map of a member of $#s$ onto $s$.
--
	(f,inv(h))-->T96(Stat4*) ==> (domain(inv(h) @ f) = domain(f)) & (range(inv(h) @ f) = #s)
	ff-->Stat1(Stat1,Stat1*) ==> Stat6a: one_1_map(ff) & (range(ff) = s) & (domain(ff) = #s)
--	Loc_def ==> Stat7a: (f1 = inv(h)) & (f2 = (inv(h) @ f)) & (f3 = (ff @ (inv(h) @ f)))
--	EQUAL(Stat4a,Stat5a,Stat6a,Stat7a) ==> one_1_map(inv(h) @ f) & one_1_map(ff @ (inv(h) @ f))
	(inv(h),f)-->T133(Stat4a*) ==> one_1_map(inv(h) @ f)
	(ff,inv(h) @ f)-->T133(Stat5a*) ==> one_1_map(ff @ (inv(h) @ f))
	(inv(h) @ f,ff)-->T96(Stat5a*) ==> (domain(ff @ (inv(h) @ f)) = domain(f)) & (range(ff @ (inv(h) @ f)) = s)
--
-- By Stat2, this is impossible, a contradiction which proves our theorem.
--
	(domain(f))-->Stat2(Stat5a*) ==> Stat8: (not(EXISTS g in OM | one_1_map(g) & (range(g) = s) & (domain(g) = domain(f))))
	(ff @ (inv(h) @ f))-->Stat8(Stat6a*) ==> false
	Discharge ==> QED
--
-- Theorem 156 implies that any two sets which are in 1-1 correspondence have the same cardinality.
--
Theorem 157: [One-one maps are cardinality preserving] one_1_map(F) ¥imp (#range(F) = #domain(F)). Proof+:
Suppose_not(h) ==> AUTO
--
-- We proceed by contradiction, and so suppose that there exists
-- a 1-1 map whose range and domain have different cardinalities.
-- Since each of these two is are in 1-1 correspondence with its cardinality,
-- $#range(h)$ and $#domain(h)$ are in 1-1 correspondence with each other.
--
	(range(h))-->T147(*) ==> Stat1: (EXISTS f in OM | (one_1_map(f) & (range(f) = range(h)) & (domain(f) = #range(h)))) &
		Ord(#range(h))
	f-->Stat1(Stat1*) ==> one_1_map(f) & (range(f) = range(h)) & (domain(f) = #range(h))
	(domain(h))-->T147(*) ==> Stat2: (EXISTS f in OM | (one_1_map(f)  & (range(f) = domain(h)) & (domain(f) = #domain(h)))) &
		Ord(#domain(h))
	g-->Stat2(Stat2*) ==> one_1_map(g) & (range(g) = domain(h)) & (domain(g) = #domain(h))
	Loc_def ==> Stat3: (c0 = #range(h)) & (c1 = #domain(h)) & (hg = h @ g) & (f1 = inv(f)) & (f2 = (inv(f) @ (h @ g))) & (f3 = (inv(inv(f) @ (h @ g))))
	EQUAL ==> one_1_map(h @ g) & one_1_map(inv(f)) & one_1_map(inv(f) @ (h @ g)) & one_1_map(inv(inv(f) @ (h @ g)))
	f-->T101(*) ==> (range(inv(f)) = #range(h)) & (domain(inv(f)) = range(h))
	(g,h)-->T96(Stat2*) ==> (range(h @ g) = range(h)) & (domain(h @ g) = #domain(h))
	(h @ g,inv(f))-->T96(Stat1*) ==> Stat4: (range(inv(f) @ (h @ g)) = #range(h)) & (domain(inv(f) @ (h @ g)) = #domain(h))
	(inv(f) @ (h @ g))-->T101(Stat2*) ==> (range(inv(inv(f) @ (h @ g))) = #domain(h)) & (domain(inv(inv(f) @ (h @ g))) = #range(h))
	Use_def(one_1_map)(Stat3) ==> Svm(inv(inv(f) @ (h @ g))) & Svm(inv(f) @ (h @ g))
--
-- But by Theorem 31 one of the two distinct ordinals $#range(h)$ and $#domain(h)$,
-- must be a member of the other, even though both are cardinals by Theorem 156, so neither
-- can be in 1-1 correspondence with anything smaller. This contradiction proves our theorem.
--
	EQUAL(Stat3,Stat3) ==> Stat5: Card(#range(h)) & Card(#domain(h))
	Suppose ==> #range(h) in #domain(h)
		Use_def(Card)(Stat5,Stat5) ==> Stat6: (FORALL y in #domain(h), f in OM | (not(domain(f) = y) or not(range(f) = #domain(h)) or not(Svm(f))))
		(#range(h),inv(inv(f) @ (h @ g)))-->Stat6(Stat4*) ==> false
	Discharge ==> AUTO
	(#range(h),#domain(h))-->T31(*) ==> #domain(h) in #range(h)
	Use_def(Card)(Stat5,Stat5) ==> Stat7: (FORALL y in #range(h), f in OM | (not(domain(f) = y) or not(range(f) = #range(h)) or not(Svm(f))))
	(#domain(h),inv(f) @ (h @ g))-->Stat7(Stat4*) ==> false
	Discharge ==> QED
--
-- The following corollary rounds out Theorem 157 by proving that two sets
-- can be in 1-1 correspondence if and only if they have the same cardinality.
-- It is this result that captures the essence of the notion of cardinality.
--
Theorem 158: [Equicardinality is equivalent to one-one correspondence] (EXISTS F in OM | (one_1_map(F) & (range(F) = S) & (domain(F) = T))) ¥eq (#S = #T). Proof:
Suppose_not(s,t) ==> AUTO
--
-- We proceed by contradiction. Since Theorem 157 implies that $s$ and $t$ cannot have
-- different cardinalities if they are in 1-1 correspondence, it must be that
-- they have the same cardinality but are not in 1-1 correspondence.
--
	Suppose ==> Stat1: (EXISTS f in OM | (one_1_map(f) & (range(f) = s) & (domain(f) = t))) & (#s /= #t)
		f-->Stat1 ==> one_1_map(f) & (range(f) = s) & (domain(f) = t)
		f-->T157 ==> #range(f) = #domain(f)
		EQUAL ==> false
	Discharge ==> Stat2: (not(EXISTS f in OM | (one_1_map(f) & (range(f) = s) & (domain(f) = t)))) & (#s = #t)
--
-- But by Theorem 156, $s$ and $t$ are in 1-1 correspondence with their respective cardinalities $#s$ and $#t$,
-- by mappings $g$ and $h$ respectively.
--
	s-->T156 ==> Stat3: (EXISTS f in OM | one_1_map(f) & (range(f) = s) & (domain(f) = #s))
	t-->T156 ==> Stat4: (EXISTS f in OM | one_1_map(f) & (range(f) = t) & (domain(f) = #t))
	g-->Stat3(Stat3,Stat3*) ==> one_1_map(g) & (range(g) = s) & (domain(g) = #s)
	h-->Stat4(Stat4,Stat4*) ==> one_1_map(h) & (range(h) = t) & (domain(h) = #t)
--
-- Hence the map $(g @ inv(h))$, whose domain and range are $t$ and $s$ respectively,
-- is 1-1, contradicting Stat2 and thereby proving our theorem.
--
	h-->T101(Stat4*) ==> one_1_map(inv(h)) & (range(inv(h)) = #t) & (domain(inv(h)) = t)
	(g,inv(h))-->T133(Stat4*) ==> one_1_map(g @ inv(h))
	(inv(h),g)-->T96(*) ==> (range(g @ inv(h)) = range(g)) & (domain(g @ inv(h)) = t)
 	(g @ inv(h))-->Stat2(Stat4*) ==> false
	Discharge ==> QED
--
-- It follows from Theorem 158 that the enumerating ordinal of a set $s$, like any other
-- set $t$ in 1-1 correspondence with $s$, has the same cardinality as $s$.
--
Theorem 159: [The enumerating ordinal of a set has the same cardinality as the set]
	(EXISTS o | Ord(o) & (S = {enum(x,S): x in o}) & (#o = #S)). Proof:
Suppose_not(s1) ==> Stat1: not(EXISTS o | (Ord(o) & s1 = {enum(x,s1): x in o} & (#o = #s1)))
--
-- Suppose the contrary, so that no ordinal which '$enum$' puts in 1-1 correspondence with $s$
-- has the same cardinality as $s1$.  Theorem 46 tells us that there is some ordinal $o$
-- which '$enum$' puts in 1-1 correspondence with $s1$, i.e. '$enum$' defines a 1-1 function $f$
-- whose domain is $o$ and whose range is $s1$. Thus $o$ and $s1$ have the same cardinality, and so
-- $o$ is a counterexample to Stat1, a contradiction which proves our theorem.
--
	s1-->T46 ==> Stat2: (EXISTS o | (Ord(o) & (s1 = {enum(x,s1): x in o}))
				& (FORALL y in o, z in o | ((y /= z) ¥imp (enum(y,s1) /= enum(z,s1)))))
	o-->Stat2() ==> Stat3: Ord(o) & (s1 = {enum(x,s1): x in o}) &
		Stat4: (FORALL y in o, z in o | ((y /= z) ¥imp (enum(y,s1) /= enum(z,s1))))
	Loc_def ==> f = {[x,enum(x,s1)]: x in o}
	APPLY(x9_thryvar:a,y9_thryvar:b) fcn_symbol(f(x)->enum(x,s1),g->f,s->o) ==>
		Svm(f) & (domain(f) = o) & (range(f) = {enum(x,s1): x in o}) &
			(((a in o) & (b in o) & (enum(a,s1) = enum(b,s1)) & (a /= b)) or one_1_map(f))
	(a,b)-->Stat4(Stat3*) ==> Stat5: one_1_map(f) & (domain(f) = o) & (range(f) = s1)
	(s1,o)-->T158(Stat5*) ==> Stat6: (EXISTS f in OM | (one_1_map(f) & (range(f) = s1) & (domain(f) = o))) ¥imp (#s1 = #o)
	f-->Stat6(Stat5*) ==> #o = #s1
	o-->Stat1(Stat3*) ==> false
	Discharge ==> QED
--
-- Theorem 157 also has the two following corollaries, which state facts basic to the
-- arithmetic theory of infinite cardinals. The first of these is the associative law
-- for cardinal arithmetic, which follows as an elementary consequence of Theorem 144.
--
Theorem 160: [Associative Law for Cardinals] #((A ¥PROD B) ¥PROD C) = #(A ¥PROD (B ¥PROD C)). Proof:
Suppose_not(a,b,c) ==> AUTO
	Loc_def ==> f = {[[[x,y],wz],[x,[y,wz]]]: x in a, y in b, wz in c}
	(f,a,b,c)-->T144(*) ==> one_1_map(f) & (domain(f) = ((a ¥PROD b) ¥PROD c)) & (range(f) = (a ¥PROD (b ¥PROD c)))
	EQUAL ==> #domain(f) /= #range(f)
	f-->T157 ==> AUTO
	Discharge ==> QED
--
-- The following proof of the  associative law for cardinal arithmetic is equally elementary,
-- this time as a consequence of Theorem 145.
--
Theorem 161: [Commutative Law for Cardinals] #(A ¥PROD B) = #(B ¥PROD A). Proof:
Suppose_not(a,b) ==> AUTO
	Loc_def ==> f = {[[x,y],[y,x]]: x in a, y in b}
	(f,a,b)-->T145(*) ==> one_1_map(f) & (domain(f) = (a ¥PROD b)) & (range(f) = (b ¥PROD a))
	EQUAL ==> (#domain(f) = #(a ¥PROD b)) & (#range(f) = #(b ¥PROD a))
	f-->T157 ==> AUTO
	Discharge ==> QED
--
-- The following utility lemma simply notes that only the null set can have cardinality $0$.
--
Theorem 162: [Sets of cardinality 0 must be null] (#S = 0) ¥eq (S = 0). Proof:
Suppose_not(s) ==> AUTO
--
-- For since any set $s$ is in 1-1 correspondence with its cardinality,
-- our result follows immediately from Theorem 86
--
	s-->T147(*) ==> Stat1: (EXISTS f in OM | (one_1_map(f) & (range(f) = s) & (domain(f) = #s)))
	f-->Stat1(*) ==> one_1_map(f) & (range(f) = s) & (domain(f) = #s)
	f-->T86 ==> AUTO
	Discharge ==> QED
--
 -- It is also useful to state the following variant of the preceding lemma,
 -- which notes that every nonzero cardinal is larger than $0$
--
Theorem 163: [Non-null sets have cardinality greater than 0] (0 in #S) ¥eq (S /= 0). Proof:
Suppose_not(s) ==> AUTO
	s-->T162(*) ==> (0 notin #s) & (#s /= 0)
	s-->T147(*) ==> Ord(#s)
	Suppose ==> not Ord(0)
		Use_def(Ord(0)) ==> AUTO
		Suppose ==> Stat1: (not(FORALL x in 0 | x ¥incin 0))
		c-->Stat1 ==> false; Discharge ==> Stat2: (not(FORALL x in 0, y in 0 | x in y or y in x or x = y))
		d-->Stat2 ==> false
	Discharge ==> Ord(0)
	(#s,0)-->T31(*) ==> false
	Discharge ==> QED
--
-- Next we show that a set $s$ is a cardinal if and only if it is its own cardinal.
--
Theorem 164: [A cardinal is its own cardinality] Card(S) ¥eq (S = #S). Proof:
Suppose_not(s) ==> AUTO
--
-- We proceed by contradiction.  Since Theorem 156 tells us that $#s$ is a cardinal with which
-- $s$ is in 1-1 correspondence, only the first of the two cases displayed above need be considered.
-- In this case $s$ and $#s$ are both cardinals, hence ordinals, so one must be a member of the other.
--
	s-->T156 ==> Stat1: (EXISTS f in OM | one_1_map(f) & (range(f) = s) & (domain(f) = #s)) & Card(#s)
	Suppose ==> (not Card(s)) & (s = #s)
	EQUAL ==> false; Discharge ==> s /= #s
	f-->Stat1 ==> one_1_map(f) & (range(f) = s) & (domain(f) = #s)
	(s,#s)-->T31 ==> AUTO
	Use_def(Card)(Stat1) ==>
		Stat2: (FORALL y in s, f in OM | (not(domain(f) = y) or not(range(f) = s) or not(Svm(f)))) &
		Stat3: (FORALL y in #s, f in OM | (not(domain(f) = y) or not(range(f) = #s) or not(Svm(f)))) &
			 ((s in #s) or (#s in s))
--
-- But Stat2 (resp. Stat3) tells us that $#s$ cannot be a member of $s$
-- (resp. $s$ cannot be a member of $#s$), so we have a contradiction which proves our theorem.
--
	Suppose ==> #s in s
		Use_def(one_1_map(f)) ==> AUTO
		(#s,f)-->Stat2(Stat1*) ==> false
	Discharge ==> AUTO
	f-->T101(Stat1*) ==> one_1_map(inv(f)) & (range(inv(f)) = #s) & (domain(inv(f)) = s)
	Use_def(one_1_map(inv(f))) ==> AUTO 
	(s,inv(f))-->Stat3(Stat2*) ==> false
	Discharge ==> QED
--
-- In the following corollary we note that if $c$ is a cardinal
-- and is in 1-1 correspondence with a set $s$, then $c$ is $#s$.
--
Theorem 165: [Uniqueness of Cardinality]
	(Card(C) & (EXISTS f in OM | (one_1_map(f) & (range(f) = S) & domain(f) = C))) ¥imp (C = #S). Proof:
    Suppose_not(c,s) ==> Card(c) & Stat1: (EXISTS f in OM | (one_1_map(f) & (range(f) = S) & domain(f) = C)) & (c /= #s)
    f-->Stat1 ==> Card(c) & one_1_map(f) & (range(f) = s) & (domain(f) = c) & (c /= #s)
--
-- Suppose the contrary, i.e. that there is a cardinal $c$ in 1-1 correspondence with $s$
-- which is different from $#s$.
	f-->T157 ==> #range(f) = #domain(f)
	EQUAL ==> #c /= c
	c-->T164 ==> false; Discharge ==> QED
--
-- Our next two results are also simple corollaries of the foregoing: the cardinality operator
-- "$\#$" is idempotent, and any two distinct cardinals are ordered by membership.
--
Theorem 166: [The cardinality operator is idempotent] #S = ##S. Proof:
	Suppose_not(s) ==> #s /= ##s
    s-->T156 ==> Card(#s)
    (#s)-->T164 ==> false; Discharge ==> QED
--
Theorem 167: [All cardinals are comparable] (#S in #T) or (#S = #T) or (#T in #S). Proof:
	Suppose_not(s,t) ==> not((#s in #t) or (#s = #t) or (#t in #s))
    s-->T156 ==> Ord(#s)
    t-->T156 ==> Ord(#t)
    (#s,#t)-->T31 ==> false; Discharge ==> QED
--
-- Next we note that the ordering of cardinals by membership is transitive,
-- simply because cardinals must be ordinals and our claim holds for ordinals by Theorem 34.
--
Theorem 168: [Cardinal comparison is transitive] ((#S in #T) & (#T in #R)) ¥imp (#S in #R). Proof:
	Suppose_not(s,t,r) ==> (#s in #t) & (#t in #r) & (#s notin #r)
    r-->T156 ==> Ord(#r)
	(#r,#t)-->T12 ==> Ord(#t)
	(#r,#t)-->T34 ==> (Ord(#r) & Ord(#t)) ¥imp ((#t ¥incin #r) ¥eq ((#t in #r) or (#t = #r)))
	ELEM ==> #s notin #r
    Discharge ==> QED
--
-- We can use the preceding results to prove that subsets of an ordinal
-- have a cardinality that is no larger than the ordinal. This is just a bit
-- short of the more general result (which follows as Theorem 170)
-- that subsets of a set $s$ can never have a cardinality greater than $#s$.
--
Theorem 169: [Subsets of an ordinal have a cardinality that is no larger than the ordinal]
    (Ord(S) & (T ¥incin S)) ¥imp (#T ¥incin S). Proof:
    Suppose_not(s,t) ==> Ord(s) & (t ¥incin s) & (not(#t ¥incin s))
--
-- Proceeding by contradiction, let the ordinal $s$ and its subset $t$ be a counterexample.
-- By the preceding theorem, there is an ordinal $u$ no larger than $s$
-- which '$enum$' puts into 1-1 correspondence with $t$.
--
	(s,t)-->T154 ==> Stat1: (EXISTS x ¥incin s | (Ord(x) & (t = {enum(y,t): y in x}) &
		(FORALL y in x, z in x | ((y /= z) ¥imp (enum(y,t) /= enum(z,t))))))
    u-->Stat1 ==> Stat2: (u ¥incin s) & Ord(u) & (t = {enum(y,t): y in u}) &
						Stat3: (FORALL y in u, wz in u | ((y /= wz) ¥imp (enum(y,t) /= enum(wz,t))))
	Loc_def ==> g = {[x,enum(x,t)]: x in u}
    APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(f(x)->enum(x,t),g->g,s->u) ==>
			Svm(g) & (range(g) = {enum(x,t): x in u}) & (domain(g) = u) &
				(((x in u) & (y in u) & (enum(x,t) = enum(y,t)) & (x /= y)) or one_1_map(g))
    (x,y)-->Stat3 ==> one_1_map(g)
--
-- Theorem 157 now tells us that $#t = #u$. But it is easy to see that $u incs #u$ for every ordinal $u$.
--
    g-->T157 ==> #range(g) = #domain(g)
    EQUAL ==> #t = #u
    Suppose ==> Stat4: not(u incs #u)
    u-->T156 ==> Stat5: Card(#u) & Ord(#u) &
    	Stat6: (EXISTS f in OM | (one_1_map(f) & (range(f) = u) & (domain(f) = #u)))
    f-->Stat6 ==> Stat7: one_1_map(f) & (range(f) = u) & (domain(f) = #u)
    f-->T101(Stat7) ==> one_1_map(inv(f)) & (domain(inv(f)) = u) & (range(inv(f)) = #u)
    Use_def(one_1_map) ==> Stat8: Svm(inv(f))
    (u,#u)-->T29(Stat4,Stat5,Stat2) ==> Stat9: #u incs u
    (#u,u)-->T34(Stat2,Stat5,Stat9,Stat4) ==> u in #u
    Use_def(Card) ==>
    	Stat10: (FORALL y in #u, f in OM | (not(domain(f) = y) or not(range(f) = #u) or not(Svm(f))))
    (u,inv(f))-->Stat10 ==> false; Discharge ==> u incs #u
--
-- But now, since $s$ $incs$ $u$ $incs$ $#u = #t$, we must have $s incs #t$, contradicting our original
-- assumption and thus proving our theorem.
--
    Discharge ==> QED
--
-- The following theorem, which the preceding theorem anticipates,
-- states the basic fact that the cardinality of a subset $t$ of $s$
-- can be no larger than the cardinality of $s$.
--
Theorem 170: [Subset cardinality theorem] (T ¥incin S) ¥imp (#T ¥incin #S). Proof:
    Suppose_not(t,s) ==> Stat1: (t ¥incin s) & (not (#t ¥incin #s))
--
-- For suppose that $t$ is a subset of $s$ but has a larger cardinality.
-- Then $s$ is in 1-1 correspondence with $#s$ by some map $f$,
-- and so the inverse of $f$ maps $t$ to a subset of $#s$ in 1-1, and hence cardinality-preserving, fashion.
--
    (s)-->T156 ==> Stat2: Card(#s)  and  (EXISTS f in OM | one_1_map(f) & (range(f) = s) & (domain(f) = #s))
    (f)-->Stat2 ==> one_1_map(f) & (range(f) = s) & (domain(f) = #s)
    f-->T101 ==> one_1_map(inv(f)) & (f = inv(inv(f))) & (range(inv(f)) = domain(f)) & (domain(inv(f)) = range(f))
    (inv(f),t)-->T58 ==> one_1_map(inv(f) ¥ON t)
    (inv(f) ¥ON t)-->T157 ==> Stat3: #domain(inv(f) ¥ON t) = #range(inv(f) ¥ON t)
    (inv(f),t)-->T80 ==> range(inv(f) ¥ON t) ¥incin #s
--
-- Since the cardinal $#s$ is an ordinal, it follows by Theorem 169 that $#range(inv(f) ¥ON t)$
-- is not larger than $#s$. But since $inv(f) ¥ON t$ is 1-1 and has domain $t$, $#range(inv(f) ¥ON t) = #t$;
-- so $#t ¥incin #s$, a contradiction which proves our theorem.
--
    (s)-->T147 ==> Ord(#s)
    (#s,range(inv(f) ¥ON t))-->T169 ==> Stat4: #range(inv(f) ¥ON t) ¥incin #s
    (inv(f),t)-->T94 ==> domain(inv(f) ¥ON t) = t
    EQUAL ==> Stat5: #domain(inv(f) ¥ON t) = #t
    (Stat1,Stat3,Stat4,Stat5)Discharge ==> QED
--
-- The following somewhat more general result tells us that the range of a single-valued map is
-- never more numerous than its domain.
--
Theorem 171: [Single-valued mapping cannot increase cardinality] Svm(F) ¥imp (#range(F) ¥incin #domain(F)). Proof:
    Suppose_not(f) ==> Svm(f) & (not (#range(f) ¥incin #domain(f)))
    f-->T138 ==> Stat1: (EXISTS h | ((domain(h) = range(f)) & (range(h) ¥incin domain(f)) &
    				 one_1_map(h)) & (FORALL x in range(f) | (f~[h~[x]] = x)))
    h-->Stat1 ==> (domain(h) = range(f)) & (range(h) ¥incin domain(f)) & one_1_map(h)
    (range(h),domain(f))-->T170 ==> #range(h) ¥incin #domain(f)
    EQUAL ==> #domain(h) = #range(f)
    h-->T157 ==> false; Discharge ==> QED
--
-- Next we show that the domain and range of any map $f$ (and indeed of any set $f$) is no greater than $f$.
--
Theorem 172: [The cardinality of a map is no smaller than the cardinality of its domain] #domain(F) ¥incin #F. Proof:
    Suppose_not(f) ==> not(#domain(f) ¥incin #f)
--
-- For $domain(f)$ is a single-valued image of $f$ by the map ${[x,car(x)]: x in f}$, and so the
-- present theorem is a corollary of Theorem 171.
--
    Loc_def ==> g = {[x,car(x)]: x in f}
    APPLY() fcn_symbol(f(x)->car(x),g->g,s->f) ==> Svm(g) & (domain(g) = f) & (range(g) = {car(x): x in f})
    Use_def(domain) ==> range(g) = domain(f)
    g-->T171 ==> #range(g) ¥incin #domain(g)
    EQUAL ==> #domain(f) ¥incin #f
    Discharge ==> QED
--
Theorem 173: [The cardinality of a map is no smaller than the cardinality of its range] #range(F) ¥incin #F. Proof:
    Suppose_not(f) ==> not (#range(f) ¥incin #f)
--
-- For $range(f)$ is a single-valued image of $f$ by the map ${[x,cdr(x)]: x in f}$, and so the
-- present theorem is a corollary of Theorem 171.
--
   Loc_def ==> g = {[x,cdr(x)]: x in f}
   APPLY() fcn_symbol(f(x)->cdr(x),g->g,s->f) ==>
    		Svm(g) & (domain(g) = f) & (range(g) = {cdr(x): x in f})
    Use_def(range) ==> range(g) = range(f)
    g-->T171 ==> #range(g) ¥incin #domain(g)
    EQUAL ==> #range(f) ¥incin #f
    Discharge ==> QED
--
-- If the map $f$ is single-valued, the inequality given by Theorem 172 can be sharpened
-- to an equality:
--
Theorem 174: [The cardinality of a single-valued map equals the cardinality of its domain] Svm(F) ¥imp (#domain(F) = #F). Proof:
    Suppose_not(f) ==> Svm(f) & (#domain(f) /= #f)
--
-- For in this case $domain(f)$ is easily seen to be a 1-1 image of $f$ by the map ${[x,car(x)]: x in f}$,
-- and so the present theorem is a corollary of Theorem 157.
--
    Loc_def ==> g = {[u,car(u)]: u in f}
    APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(f(x)->car(x),g->g,s->f) ==>
		Svm(g) & (domain(g) = f) & (range(g) = {car(x): x in f}) &
			(((x in f) & (y in f) & (car(x) = car(y)) & (x /= y)) or one_1_map(g))
    Use_def(domain) ==> range(g) = domain(f)
	Suppose ==> not one_1_map(g)
	ELEM ==> (x in f) & (y in f) & (car(x) = car(y)) & (x /= y)
	Use_def(Svm) ==> Stat1: (FORALL x in f, y in f | (car(x) = car(y)) ¥imp (x = y))
    (x,y)-->Stat1 ==> false; Discharge ==> one_1_map(g)
    g-->T157 ==> #domain(g) = #range(g)
    EQUAL ==> #domain(f) = #f
    Discharge ==> QED
--
-- Our next theorem states that the restriction of a
-- single-valued map $f$ to any subset $a$ of $domain(f)$
-- has the same cardinality as $a$.
--
Theorem 175: [Cardinality of restriction maps] (Svm(F) & (domain(F) incs A)) ¥imp (#(F ¥ON A) = #A). Proof:
    Suppose_not(f,a) ==> Svm(f) & (domain(f) incs a) & (#(f ¥ON a) /= #a)
        (f,a)-->T94 ==> domain(f ¥ON a) = a
        EQUAL ==> #domain(f ¥ON a) = #a
        (f,a)-->T57 ==> Svm(f ¥ON a)
    (f¥ON a)-->T174 ==> false; Discharge ==> QED
--
-- The preceding theorems allow us to add an additional result to our utility fcn_symbol theory.
-- This simply states the fact that the cardinality of a single-valued map is the cardinality
-- of its domain, and is at least as large as the cardinality of its range.
--
ENTER_THEORY fcn_symbol   [Add an additional result to the fcn_symbol theory]
--
Theorem fcn_symbol1: [Cardinality of mapformers and range formers] (#{[xx,f(xx)]: xx in s} = #s) & (#{f(xx): xx in s} ¥incin #s). Proof:
	Suppose_not ==> not((#{[x,f(x)]: x in s} = #s) & (#{f(x): x in s} ¥incin #s))
    Assump ==> g = {[x,f(x)]: x in s}
    Tfcn_symbol.1 ==> domain(g) = s
    Tfcn_symbol.5 ==> range(g) = {f(x): x in s}
    Tfcn_symbol.7 ==> Svm(g)
    g-->T174 ==> #domain(g) = #g
    EQUAL ==> #{[x,f(x)]: x in s} = #s
    g-->T173 ==> #range(g) ¥incin #g
    EQUAL ==> #{f(x): x in s} ¥incin #{[x,f(x)]: x in s}
    Discharge ==> QED
--
ENTER_THEORY Set_theory   [Return to the top-level theory]
--
-- Next we show that if $t$ is not null, the condition $(#s incs #t)$ is equivalent
-- to the existence of a single-valued map of $s$ onto $t$.
--
Theorem 176: [Condition for existence of a single-valued map between two sets] (#S incs #T) ¥eq (T = 0 or (EXISTS f in OM | Svm(f) & (domain(f) = S) & (range(f) = T))). Proof:
    Suppose_not(s,t) ==> ((#s incs #t) & (t /= 0) & (not(EXISTS f in OM | Svm(f) & (domain(f) = s) & (range(f) = t)))) or
	((not (#s incs #t)) & (t = 0 or (EXISTS f in OM | Svm(f) & (domain(f) = s) & (range(f) = t))))
--
-- Proceed by contradiction, and so suppose that either (Case 1) $#s$ is at least as large as $#t$
-- but there exists no single-valued map of $s$ onto $t$, or that (Case 2) there exists such a map
-- but that $#t$ is larger than $#s$. Consider Case 1 first. By Theorem 147, there are 1-1 maps $h$ and $g$
-- which respectively send $#s$ and $#t$ to $s$ and $t$.
--
    Suppose ==> (#s incs #t) & (t /= 0) & Stat1: (not(EXISTS ff in OM | Svm(ff) & (domain(ff) = s) & (range(ff) = t)))
    (s)-->T147 ==> Stat2: (EXISTS f in OM | (one_1_map(f) & (range(f) = s) & (domain(f) = #s)))
    (h)-->Stat2 ==> one_1_map(h) & (range(h) = s) & (domain(h) = #s)
    (t)-->T147 ==> Stat3: (EXISTS f in OM | (one_1_map(f) & (range(f) = t) & (domain(f) = #t)))
    (g)-->Stat3 ==> one_1_map(g) & (range(g) = t) & (domain(g) = #t)
--
-- Moreover, we can easily define a single-valued map of $#s$ onto its subset $#t$.
-- Simply note that $0$ is an element of $#t$, and map all elements of $#s$ which
-- belong to $#t$ into themselves, and all other elements of $#s$ onto $0$.
--
	t-->T163 ==> 0 in #t
	Loc_def ==> f = {[x,if (x in (#t)) then x else 0 end if]: x in (#s)}
    APPLY() fcn_symbol(f(x)->if x in #t then x else 0 end if,g->f,s->#s) ==>
		Svm(f) & (domain(f) = #s) & (range(f) = {if x in #t then x else 0 end if: x in #s})
    Suppose ==> Stat4: range(f) /= #t
    c-->Stat4 ==> ((c in {if x in #t then x else 0 end if: x in #s}) & (c notin #t)) or
	((c notin {if x in #t then x else 0 end if: x in #s}) & (c in #t))
    Suppose ==> Stat5: (c notin {if x in #t then x else 0 end if: x in #s}) & (c in #t)
    c-->Stat5 ==> (c /= if c in #t then c else 0 end if or c notin #s)
    Discharge ==> Stat6: (c in {if x in #t then x else 0 end if: x in #s}) &
    										(c notin #t)
    d-->Stat6 ==> c = if d in #t then d else 0 end if
    Discharge ==> Svm(f) & (domain(f) = #s) & (range(f) = #t)
--
-- Theorem 101 now tells us that h has a 1-1 inverse which maps $s$ onto $#s$. Hence
-- $g @ (f @ inv(h))$ is a single-valued map of $s$ onto $t$, showing that Case 1 is impossible.
--
    h-->T101 ==> one_1_map(inv(h)) & (range(inv(h)) = #s) & (domain(inv(h)) = s)
    Use_def(one_1_map) ==> Svm(h) & Svm(g) & Svm(inv(h))
    (f,inv(h))-->T128 ==> Svm(f @ inv(h))
    (inv(h),f)-->T96 ==> (domain(f @ inv(h)) = s) & (range(f @ inv(h)) = #t)
    (g,f @ inv(h))-->T128 ==> Svm(g @ (f @ inv(h)))
    (f @ inv(h),g)-->T96 ==> (domain(g @ (f @ inv(h))) = s) & (range(g @ (f @ inv(h))) = t)
    (g @ (f @ inv(h)))-->Stat1 ==> false
--
-- So only Case2 remains to be considered. But in this case there is a single-valued map $hh$ of $s$ onto $t$,
-- and so Theorem 162, Theorem 174, and Theorem 173 lead to an immediate contradiction, proving our theorem.
--
    Discharge ==> (not #s incs #t) & (t = 0 or (EXISTS f in OM | Svm(f) & (domain(f) = s) & (range(f) = t)))
    ELEM ==> #t /= 0
    t-->T162 ==> t /= 0
    ELEM ==> Stat7: (EXISTS f in OM | Svm(f) & (domain(f) = s) & (range(f) = t))
    hh-->Stat7 ==> Svm(hh) & (domain(hh) = s) & (range(hh) = t)
    hh-->T174 ==> #hh = #domain(hh)
    EQUAL ==> #hh = #s
    hh-->T173 ==> #hh incs #range(hh)
    EQUAL ==> #hh incs #t
    Discharge ==> QED
--
-- The inverse image of a set under a map is the image of the set under the inverse of the map.
-- This notion, which appears in many arguments, has the following direct definition.
--
Def 14d: [Inverse Map Image] Def(G ¥INV_IM R) := {car(p): p in G | cdr(p) in R}
--
-- We can use the foregoing defintion to prove various elementary properties of the inverse image,
-- beginning with the following, which in effect tells us that the inverse image operation is additive.
--
Theorem 177: [Domains and ranges of inverse] domain(G) = (G ¥INV_IM R) + (G ¥INV_IM (range(G) - R)). Proof:
    Suppose_not(g,r) ==> domain(g) /= (g ¥INV_IM r) + (g ¥INV_IM (range(g) - r))
--
-- For if not, expansion of the definitions involved brigns us to the inequality between setformers seen below.
--
	Use_def(domain) ==> {car(p): p in g} /= (g ¥INV_IM r) + (g ¥INV_IM (range(g) - r))
	Use_def(¥INV_IM) ==> {car(p): p in g} /=
		{car(p): p in g | cdr(p) in r} + {car(p): p in g | cdr(p) in (range(g) - r)}
--
-- But it is easily seen, using set monotonicity that the left side of this last inequality
-- includes the right, and so the right side must fail to include the left. Hence here is a point q
-- in the left-hand set but in neither of those on the right.
--
	Set_monot ==> {car(p): p in g} incs {car(p): p in g | cdr(p) in r}
	Set_monot ==> {car(p): p in g | cdr(p) in (range(g) - r)} ¥incin {car(p): p in g}
	ELEM ==> Stat1: not( {car(p): p in g} ¥incin
				({car(p): p in g | cdr(p) in r} + {car(p): p in g | cdr(p) in (range(g) - r)}))
	q-->Stat1 ==> Stat2: (q in {car(p): p in g}) &
						Stat3: (q notin {car(p): p in g | cdr(p) in r}) &
							Stat4: (q notin {car(p): p in g | cdr(p) in (range(g) - r)})
--
-- It follows immediately that $q = car(p)$ for some $p in g$, but that $q notin range(g)$,
-- an impossibility which completes our proof.
--
	p-->Stat2 ==> (q = car(p)) & (p in g)
	p-->Stat3 ==> cdr(p) notin r
	p-->Stat4 ==> cdr(p) notin range(g)
	Use_def(range) ==> Stat5: cdr(p) notin {cdr(p): p in g}
    p-->Stat5 ==> false; Discharge ==> QED
--
-- Next we show that the inverse images of two disjoint sets by a single-valued map are disjoint.
--
Theorem 178: [Range-decomposition of a map domain] ((S * R = 0) & Svm(G)) ¥imp (((G ¥INV_IM S) * (G ¥INV_IM R)) = 0). Proof:
    Suppose_not(s,r,g) ==> (s * r = 0) & Svm(g) & (((g ¥INV_IM s) * (g ¥INV_IM r)) /= 0)
--
-- For if not there must exist points $p$ and $q$, in $s$ and $r$ respectively, such that $car(p) = car(q)$.
--
	Use_def(¥INV_IM) ==> Stat1: ({car(p): p in g | cdr(p) in s} * {car(p): p in g | cdr(p) in r}) /= 0
	c-->Stat1 ==> Stat2: (c in {car(p): p in g | cdr(p) in s}) & Stat3: (c in {car(p): p in g | cdr(p) in r})
	p-->Stat2 ==> (c = car(p)) & (p in g) & (cdr(p) in s)
	q-->Stat3 ==> (c = car(q)) & (q in g) & (cdr(q) in r)
	Use_def(Svm) ==> Stat4: (FORALL x in g, y in g | (car(x) = car(y)) ¥imp (x = y))
--
-- But then $p = q$, so that $cdr(p) = cdr(q)$ must belong to both $s$ and $r$, a contradiction
-- which completes our proof.
--
 	(p,q)-->Stat4 ==> p = q
    Discharge ==> QED
--
-- The following entirely elementary lemma tells us that the inverse image by a map g
-- of any element in the range of g is a nonempty set.
--
Theorem 179: [Inverse image of a range element] (Y in range(G)) ¥imp ((G ¥INV_IM {Y}) /= 0). Proof:
    Suppose_not(y,g) ==> (y in range(g)) & ((g ¥INV_IM {y}) = 0)
	Use_def(range) ==> Stat1: y in {cdr(p): p in g}
	Use_def(¥INV_IM) ==> Stat2: {car(p): p in g | cdr(p) in {y}} = 0
	p-->Stat1 ==> (y=cdr(p)) & (p in g)
    p-->Stat2 ==> false; Discharge ==> QED
--
-- The following easy lemma tells us that the "$¥INV_IM$" operator instroduced above is the
-- same as 'range of inverse', i.e. $f ¥INV_IM r /= range(inv(f) ¥ON r)$.
--
Theorem 180: [Range of a restricted inverse map] G ¥INV_IM R = range(inv(G) ¥ON R). Proof:
    Suppose_not(f,r) ==> f ¥INV_IM r /= range(inv(f) ¥ON r)
--
-- For the proof, we have only to expand our assertion using the defintions
-- of the operators involved and simplify the resulting setformers.
--
	Use_def(range) ==> f ¥INV_IM r /= {cdr(q): q in inv(f) ¥ON r}
	Use_def(¥ON) ==> f ¥INV_IM r /= {cdr(q): q in {s in inv(f) | car(s) in r}}
	Use_def(inv) ==> f ¥INV_IM r /= {cdr(q): q in {s in {[cdr(t),car(t)]: t in f} | car(s) in r}}
	SIMPLF ==> 	{cdr(s): s in {[cdr(t),car(t)]: t in f} | car(s) in r} =
							{cdr(q): q in {s in {[cdr(t),car(t)]: t in f} | car(s) in r}}
	SIMPLF ==> 	{cdr([cdr(t),car(t)]): t in f | car([cdr(t),car(t)]) in r} =
							{cdr(s): s in {[cdr(t),car(t)]: t in f} | car(s) in r}
	ELEM ==> f ¥INV_IM r /= {cdr([cdr(t),car(t)]): t in f | car([cdr(t),car(t)]) in r}
    Use_def(¥INV_IM) ==> false; Discharge ==> QED
--
-- Next we show that for single-valued maps, the inverse image $G ¥INV_IM R$ can be expressed
-- in an evident way as the set of images of the individual members of $R$ under $G$.
--
Theorem 181: [Single-valued inverse image as a setformer] Svm(inv(G)) ¥imp (G ¥INV_IM R = {inv(G)~[w]: w in (R * range(G))}). Proof:
    Suppose_not(f,r) ==> Svm(inv(f)) & (f ¥INV_IM r /= {inv(f)~[y]: y in (r * range(f))})
--
-- Suppose that $f$ and $r$ furnish a counterexample to our assertion. Since Theorem 180 and Theorem 73
-- allow us to write $f ¥INV_IM r$ as ${(inv(f) ¥ON r)~[y]: y in domain(inv(f) ¥ON r)}$,
-- the setformer inequality seen below would follow, and so there would exist an element c
-- in one of these sets but not the other.
--
	(f,r)-->T180 ==> range(inv(f) ¥ON r) /= {inv(f)~[y]: y in (r * range(f))}
	(inv(f),r)-->T48 ==> Stat1: inv(f) ¥ON r ¥incin inv(f)
	(inv(f),r)-->T57 ==> Svm(inv(f) ¥ON r)
	(inv(f) ¥ON r)-->T73 ==>
		Stat2: {inv(f)~[y]: y in (r * range(f))} /= {(inv(f) ¥ON r)~[y]: y in domain(inv(f) ¥ON r)}
	(inv(f),r)-->T94 ==> domain(inv(f) ¥ON r) = domain(inv(f)) * r
	f-->T99 ==> domain(inv(f) ¥ON r) = r * range(f)
	c-->Stat2 ==>
		(c in {inv(f)~[y]: y in (r * range(f))}) ¥eq (c notin {(inv(f) ¥ON r)~[y]: y in domain(inv(f) ¥ON r)})
--
-- If c is in the first set but not the second, it would follow since $domain(inv(f) ¥ON r) = r * range(f)$
-- that there was some $y$ in $domain(inv(f) ¥ON r)$ for which $inv(f)~[y] /= (inv(f) ¥ON r)~[y]$, which is impossible.
-- Hence c must belong to the second of our two sets but not the first.
--
	Suppose ==> Stat3: (c in {inv(f)~[y]: y in (r * range(f))}) &
						(c notin {(inv(f) ¥ON r)~[y]: y in domain(inv(f) ¥ON r)})
	(y,y)-->Stat3 ==> (y in domain(inv(f) ¥ON r)) & (inv(f)~[y] /= (inv(f) ¥ON r)~[y])
	(inv(f),inv(f) ¥ON r,y)-->T131 ==> false; Discharge ==>
				Stat4: (c in {(inv(f) ¥ON r)~[y]: y in domain(inv(f) ¥ON r)}) &
							(c notin {inv(f)~[y]: y in (r * range(f))})
--
-- However an equally elementary contradiction results in this case also, completing our proof.
--
	(yp,yp)-->Stat4 ==> (yp in domain(inv(f) ¥ON r)) & (inv(f)~[yp] /= (inv(f) ¥ON r)~[yp])
    (inv(f),inv(f) ¥ON r,yp)-->T131 ==> false; Discharge ==> QED
--
-- It is equally easy to show that for 1-1 maps $g$ the inverse image under $g$ of a singleton set ${y}$ is
-- the image of the point $y$ under the inverse map $inv(g)$.
--
Theorem 182: [Inverse image of a range element] (one_1_map(G) & (Y in range(G))) ¥imp (G ¥INV_IM {Y} = {inv(G)~[Y]}). Proof:
    Suppose_not(g,y) ==> Stat1: one_1_map(g) & (y in range(g)) & ((g ¥INV_IM {y}) /= {inv(g)~[y]})
--
-- Indeed, the negative of our assertion reduces to the set theoretic inequality seen below, and
-- since the first hand side of this inequality is plainly included in its left hand side, there
-- would have to exist an element u in the first of these sets but not the second.
--
	g-->T101 ==> one_1_map(inv(g))
	Use_def(one_1_map) ==> Stat2: Svm(inv(g))
	(g,{y})-->T181(Stat1,Stat2) ==> ({inv(g)~[v] : v in ({y} * range(g))} /= {inv(g)~[y]})
	Suppose ==> not({inv(g)~[v] : v in ({y} * range(g))} incs {inv(g)~[y]})
	ELEM ==> Stat3: inv(g)~[y] notin {inv(g)~[v] : v in ({y} * range(g))}
	y-->Stat3 ==> false; Discharge ==> Stat4: not({inv(g)~[v] : v in ({y} * range(g))} ¥incin {inv(g)~[y]})
	u-->Stat4 ==> Stat5: (u in {inv(g)~[v] : v in ({y} * range(g))}) & (u /= inv(g)~[y])
--
-- But this supposition immediately leads to a contradiction wihc proves our theorem.
--
	v-->Stat5 ==> (u = inv(g)~[v]) & (v=y) & (u /= inv(g)~[y])
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the range of any map $g$ on the inverse image of a set $r$ by $g$
-- is the intersection of $r$ with the range of $g$.
--
Theorem 183: [Range of a map restricted to an inverse image] range(G ¥ON (G ¥INV_IM R)) incs (range(G) * R). Proof:
    Suppose_not(g,r) ==> Stat1: not(range(g ¥ON (g ¥INV_IM r)) incs (range(g) * r))
--
-- For supposing the contrary and using the definitions of the operators involved we are led to the
-- set-theoretic inequality seen below.
--
	c-->Stat1 ==> (c notin range(g ¥ON (g ¥INV_IM r))) & (c in range(g)) & (c in r)
	Use_def(¥ON) ==> c notin range({q: q in g | car(q) in (g ¥INV_IM r)})
	Use_def(range) ==> (c notin {cdr(p): p in {q: q in g | car(q) in (g ¥INV_IM r)}}) & (c in {cdr(p): p in g})
	SIMPLF ==> Stat2: (c in {cdr(p): p in g}) & (c notin {cdr(q): q in g | car(q) in (g ¥INV_IM r)})
	(q1,q1)-->Stat2(Stat2*) ==> (c = cdr(q1)) & (q1 in g) & (car(q1) notin g ¥INV_IM r)
	Use_def(¥INV_IM) ==> Stat3: car(q1) notin {car(t): t in g | cdr(t) in r}
	q1-->Stat3 ==> false; Discharge ==> QED
--
-- Next we show that for any single-valued map $g$ and set $a$, the range of $g$ on
-- the inverse image of $a$ under $g$ is $range(g) * a$.
--
Theorem 184: [Range of a single-valued map restricted to an inverse image] Svm(G) ¥imp (range(G ¥ON (G ¥INV_IM A)) = range(G) * A). Proof:
Suppose_not(g,a) ==> AUTO
--
-- For supposing the contrary and using the definitions of the operators involved we are led to the
-- set-theoretic inequality seen below.
--
	(g,a)-->T183 ==> Svm(g) & (not(range(g ¥ON (g ¥INV_IM a)) ¥incin range(g) * a))
	Use_def(range) ==> not({cdr(p): p in g ¥ON (g ¥INV_IM a)} ¥incin {cdr(p): p in g} * a)
	Use_def(¥ON) ==> not({cdr(p): p in {q: q in g | car(q) in (g ¥INV_IM a)}} ¥incin {cdr(p): p in g} * a)
	SIMPLF ==> not({cdr(p): p in g | car(p) in (g ¥INV_IM a)} ¥incin {cdr(p): p in g} * a)
	Use_def(¥INV_IM) ==> Stat1: not({cdr(p): p in g | car(p) in {car(q): q in g | cdr(q) in a}} ¥incin
									{cdr(p): p in g} * a)
	c-->Stat1 ==> Stat2: (c in {cdr(p): p in g | car(p) in {car(q): q in g | cdr(q) in a}}) &
								((c notin {cdr(p): p in g}) or (c notin a))
	p-->Stat2 ==> Stat3: (c = cdr(p)) & (p in g) & Stat4: (car(p) in {car(q): q in g | cdr(q) in a}) &
								((c notin {cdr(p): p in g}) or (c notin a))
	(q,p)-->Stat4 ==> Stat5: (c = cdr(p)) & (p in g) & (car(p) = car(q)) & (q in g) & (cdr(q) in a) & (c notin a)
	Use_def(Svm) ==>  Stat6: (FORALL x in g, y in g | (car(x) = car(y)) ¥imp (x = y))
	(p,q)-->Stat6(Stat3*) ==> p = q
EQUAL(Stat5) ==> false; Discharge ==> QED
--
-- The following simple lemma tells us that for single-valued maps $g$ and sets $a$, $b$,
-- the inverse image of $b$ under the restriction of $g$ to the inverse image of $a$ is simply
-- the intersection $(g ¥INV_IM a) * (g ¥INV_IM b)$.
--
Theorem 185: [Inverse images by a single-valued map] Svm(G) ¥imp ((G ¥ON (G ¥INV_IM A)) ¥INV_IM B = (G ¥INV_IM A) * (G ¥INV_IM B)). Proof:
    Suppose_not(g,a,b) ==> Svm(g) & ((g ¥ON (g ¥INV_IM a)) ¥INV_IM b /= (g ¥INV_IM a) * (g ¥INV_IM b))
--
-- For supposing the contrary, and using the definitions of "$¥INV_IM$" and "$¥ON$", we are led to the setformer
-- inequality seen below.
--
	Use_def(¥INV_IM) ==> {car(w): w in (g ¥ON (g ¥INV_IM a)) | cdr(w) in b} /=
								{car(w): w in g | cdr(w) in a} * {car(w): w in g | cdr(w) in b}
	Use_def(¥ON) ==> {car(w): w in (g ¥ON (g ¥INV_IM a)) | cdr(w) in b} =
								{car(w): w in {u: u in g | car(u) in (g ¥INV_IM a)} | cdr(w) in b}
	SIMPLF() ==> {car(w): w in {u: u in g | car(u) in (g ¥INV_IM a)} | cdr(w) in b} =
								{car(w): w in g | (car(w) in (g ¥INV_IM a)) & (cdr(w) in b)}
	ELEM ==> {car(w): w in g | (car(w) in (g ¥INV_IM a)) & (cdr(w) in b)} /=
								{car(w): w in g | cdr(w) in a} * {car(w): w in g | cdr(w) in b}
--
-- One more use of the definitions of "$¥INV_IM$" reduces this last inequality to the following still more
-- elementary form:
--
	Use_def(¥INV_IM) ==> {car(w): w in g | (car(w) in {car(u): u in g | cdr(u) in a}) & (cdr(w) in b)}
								 /= {car(w): w in g | cdr(w) in a} * {car(w): w in g | cdr(w) in b}
--
-- But it is easy to see that the condition appearing in the left-hand setformer in this last
-- inequality can be replaced by the condition $(cdr(w) in a) & (cdr(w) in b)$.
--
	Use_def(Svm) ==> Stat1: (FORALL x in g, y in g | (car(x) = car(y)) ¥imp (x = y))
	Suppose ==> Stat2: {car(w): w in g | (car(w) in {car(u): u in g | cdr(u) in a}) & (cdr(w) in b)}
								 /= {car(w): w in g | (cdr(w) in a) & (cdr(w) in b)}
	c-->Stat2 ==> (c in g) & ((car(c) /= car(c) or
		(((car(c) in {car(u): u in g | (cdr(u) in a)}) & (cdr(c) in b)) & (not((cdr(c) in a) & (cdr(c) in b)))) or
		((not((car(c) in {car(u): u in g | (cdr(u) in a)}) & (cdr(c) in b))) & (cdr(c) in a) & (cdr(c) in b))))
	Suppose ==> Stat3: (((car(c) in {car(u): u in g | (cdr(u) in a)}) & (cdr(c) in b)) & (not((cdr(c) in a) & (cdr(c) in b))))
	v-->Stat3 ==> (v in g) & (car(c) = car(v)) & (cdr(v) in a)
	(v,c)-->Stat1 ==> c = v
	Discharge ==> (not((car(c) in {car(u): u in g | (cdr(u) in a)}) & (cdr(c) in b))) & (cdr(c) in a) & (cdr(c) in b)
	ELEM ==> Stat4: not(car(c) in {car(u): u in g | (cdr(u) in a)}) & (cdr(c) in b)
	c-->Stat4 ==> false;  Discharge ==>
		{car(w): w in g | (cdr(w) in a) & (cdr(w) in b)} /= {car(w): w in g | cdr(w) in a} * {car(w): w in g | cdr(w) in b}
--
-- But it is easy to see that this last inequality is impossible. Indeed, by set monotonicity
-- the left-hand side of this inequality is included in the right, so that the inequality would imply
-- the existence of a point $u$ such that $cdr(u) in a$, $cdr(u) in b$, whiel the conjuction
-- of these two conditions was false, and evident impossibility which completes the proof of our theorem.
--
	Set_monot() ==> {car(w): w in g | (cdr(w) in a) & (cdr(w) in b)} ¥incin {car(w): w in g | cdr(w) in a}
	Set_monot() ==> {car(w): w in g | (cdr(w) in a) & (cdr(w) in b)} ¥incin {car(w): w in g | cdr(w) in b}
	ELEM ==> Stat5: not({car(w): w in g | (cdr(w) in a) & (cdr(w) in b)} incs
					{car(w): w in g | cdr(w) in a} * {car(w): w in g | cdr(w) in b})
	d-->Stat5 ==> (d in {car(w): w in g | cdr(w) in a} * {car(w): w in g | cdr(w) in b}) &
					Stat6: (d notin {car(w): w in g | (cdr(w) in a) & (cdr(w) in b)})
	ELEM ==> Stat7: (d in {car(w): w in g | cdr(w) in a}) & Stat8: (d in {car(w): w in g | cdr(w) in b})
	u1-->Stat7 ==> (u1 in g) & (d = car(u1)) & (cdr(u1) in a)
	u2-->Stat8 ==> (u2 in g) & (d = car(u2)) & (cdr(u2) in b)
	(u1,u2)-->Stat1 ==> u1 = u2
	EQUAL ==> cdr(u1) in b
    u1-->Stat6 ==> false; Discharge ==> QED
--
-- It follows trivially using the principle of set monotonicity that the expression $g ¥INV_IM a$
-- is monotone increasing in its second argument.
--
Theorem 186: [Monotonicity of inverse image] (B ¥incin A) ¥imp ((G ¥INV_IM B) ¥incin (G ¥INV_IM A)). Proof:
    Suppose_not(b,a,g) ==> (b ¥incin a) & (not((g ¥INV_IM b) ¥incin (g ¥INV_IM a)))
	Set_monot ==> {car(p): p in g | cdr(p) in b} ¥incin {car(p): p in g | cdr(p) in a}
    Use_def(¥INV_IM) ==> false; Discharge ==> QED
--
-- The following simple lemma tells us that successive restriction of a map $f$, first to a set
-- $a$ and then to $b$, produces the same result as restriction of $f$ to the intersection set $a * b$
--
Theorem 187: [Successive map restrictions] (((F ¥ON A) ¥ON B) = (F ¥ON (A * B))). Proof:
    Suppose_not(f,a,b) ==> (f ¥ON a) ¥ON b /= f ¥ON (a * b)
--
-- For a counterexample $f,a,b$ would imply the existence of a point $p$ which was in one
-- of the two sets in the following inequality but not the other, and evident impossibility
-- which proves our assertion.
--
	Use_def(¥ON) ==> {p: p in (f ¥ON a) | car(p) in b} /= {p: p in f | car(p) in (a * b)}
	Use_def(¥ON) ==> {p: p in (f ¥ON a) | car(p) in b} = {p: p in {q: q in f | car(q) in a} | car(p) in b}
	SIMPLF ==> Stat1: {p: p in f | (car(p) in a) & (car(p) in b)} /= {p: p in f | car(p) in (a * b)}
	Set_monot ==> {p: p in f | (car(p) in a) & (car(p) in b)} = {p: p in f | car(p) in (a * b)}
	Discharge ==> QED
--
-- ************************************************************************************************
--									Section 6: Finiteness
-- ************************************************************************************************
--
-- Our arguments till now have concerned ordinals and cardinals irrespective of whether they
-- are finite or infinite. Now we introduce the concept of finiteness and prove
-- its basic properties, in preparation for introduction of the set of integers and
-- derivation of the basic properties of integers.
--
Def 18: [Finiteness]
    Finite(s) := not(EXISTS f in OM | one_1_map(f) & (domain(f) = s) & (range(f) ¥incin s) & (s /= range(f)))
--
-- We begin our work with the finiteness concept by proving the elementary but basic fact that
-- the null set is a finite cardinal.
--
Theorem 188: [0 is a finite cardinal] Ord(0) & Finite(0) & Card(0). Proof:
	Suppose_not ==> not(Ord(0) & Finite(0) & Card(0))
--
-- For the fact that $0$ is an ordinal is an immediate consequence of the definition of '$Ord$',
--
    Suppose ==> not Ord(0)
    Use_def(Ord) ==> (not(FORALL x in 0 | x ¥incin 0)) or
	(not(FORALL x in 0, y in 0 | x in y or y in x or x = y))
    Suppose ==> Stat1: (not(FORALL x in 0 | x ¥incin 0))
    c-->Stat1 ==> false; Discharge ==> Stat2: (not(FORALL x in 0, y in 0 | x in y or y in x or x = y))
    d-->Stat2 ==> false; Discharge ==> Ord(0)
--
-- Similarly, the fact that $0$ is a cardinal and is finite is an immediate consequence
-- of the definitions involved.
--
    Suppose ==> not Finite(0)
    Use_def(Finite) ==>
	Stat3:(EXISTS f in OM | one_1_map(f) & (domain(f) = 0) & (range(f) ¥incin 0) & (0 /= range(f)))
    f-->Stat3 ==> (range(f) ¥incin 0) & (0 /= range(f))
    Discharge ==> not Card(0)
    Use_def(Card) ==> (not Ord(0)) or
	(not(FORALL y in 0, f in OM | (not(domain(f) = y)) or (not(range(f) = 0)) or (not(Svm(f)))))
    ELEM ==>
	Stat4: not(FORALL y in 0, f in OM | (not(domain(f) = y)) or (not(range(f) = 0)) or (not(Svm(f))))
    a-->Stat4 ==> false; Discharge ==> QED
--
-- The following theorem states the important but elementary fact that subsets of a finite set are finite.
--
Theorem 189: [A subset of a finite set is finite] (Finite(S) & (S incs T)) ¥imp Finite(T). Proof:
    Suppose_not(s,t) ==> Finite(s) & (s incs t) & (not Finite(t))
--
-- For suppose that there existed a finite set $s$ having an infinite subset $t$.
-- Then by definition there would be a 1-1 map $f$ of $t$ into a proper subset of itself.
-- This can be extended to a 1-1 map of $s$ into a proper subset of itself simply
-- by setting the extension to the identity map on $s - t$. But since $s$ is finite by assumption,
-- this is impossible.
--
    Use_def(Finite) ==>
	Stat1: (not(EXISTS g in OM | one_1_map(g) & (domain(g) = s) & (range(g) ¥incin s) & (s /= range(g))))
    Use_def(Finite) ==>
	Stat2: (EXISTS h in OM  | one_1_map(h) & (domain(h) = t) & (range(h) ¥incin t) & (t /= range(h)))
    h-->Stat2 ==> one_1_map(h) & (domain(h) = t) & (range(h) ¥incin t) & (t /= range(h))
    (s - t)-->T115 ==> one_1_map(ident(s - t)) & (domain(ident(s - t)) = s - t) &
    							(range(ident(s - t)) = s - t)
    (h,ident(s - t))-->T88 ==> one_1_map(h + ident(s - t))
    (h,ident(s - t))-->T78 ==> domain(h + ident(s - t)) = domain(h) + (s - t)
    (h,ident(s - t))-->T79 ==> range(h + ident(s - t)) = range(h) + (s - t)
    (h + ident(s - t))-->Stat1 ==> false; Discharge ==> QED
--
-- Our next theorem states that if the domain of a 1-1 map is finite, so is its range.
-- This result is then easily generalized to single valued maps (Theorem 192 below).
--
Theorem 190: [One-one maps preserve finiteness] one_1_map(F) ¥imp ((Finite(domain(F))) ¥imp (Finite(range(F)))). Proof:
    Suppose_not(f2) ==> one_1_map(f2) & Finite(domain(f2)) & (not Finite(range(f2)))
--
-- If we suppose the contrary, then by definition there must exist a $g$ mapping $range(f2)$
-- into a proper subset of itself. But then $inv(f2) @ (g @ f2)$ is a 1-1 mapping of $domain(f2)$
-- into itself.
--
    Use_def(Finite) ==>
     Stat1: (not(EXISTS g in OM | one_1_map(g) & (domain(g) = domain(f2)) & (range(g) ¥incin domain(f2)) & (range(g) /= domain(f2))))
    Use_def(Finite) ==>
	Stat2: (EXISTS g in OM | one_1_map(g) & (domain(g) = range(f2)) & (range(g) ¥incin range(f2)) & (range(g) /= range(f2)))
    g-->Stat2 ==> one_1_map(g) & (domain(g) = range(f2)) &
    		(range(g) ¥incin range(f2)) & (range(g) /= range(f2))
    f2-->T101 ==> one_1_map(inv(f2)) & (domain(f2) = range(inv(f2))) & (range(f2) = domain(inv(f2)))
    (g,f2)-->T133 ==> one_1_map(g @ f2)
    (inv(f2),g @ f2)-->T133 ==> one_1_map(inv(f2) @ (g @ f2))
    Use_def(one_1_map) ==> Svm(f2) & Svm(g) & Svm(inv(f2))
    (f2,g)-->T96 ==> (domain(g @ f2) = domain(f2)) & (range(g @ f2) = range(g))
    (g @ f2,inv(f2))-->T97 ==>
    	(domain(inv(f2) @ (g @ f2)) = domain(f2)) & (range(inv(f2) @ (g @ f2)) ¥incin domain(f2))
--
-- and it is easily seen that $range(inv(f2) @ (g @ f2))$ must be a proper subset of $domain(f2)$,
-- contradicting the finiteness of $domain(f2)$, and so proving the present theorem.
--
    (inv(f2),g @ f2)-->T95 ==> range(inv(f2) @ (g @ f2)) = range(inv(f2) ¥ON range(g @ f2))
    EQUAL ==> range(inv(f2) @ (g @ f2)) = range(inv(f2) ¥ON range(g))
    (inv(f2),range(g))-->T98 ==> range(inv(f2)) /= range(inv(f2) ¥ON range(g))
    (inv(f2))-->T67 ==> (inv(f2) ¥ON domain(inv(f2))) = inv(f2)
    EQUAL ==> range(inv(f2) ¥ON domain(inv(f2))) /= range(inv(f2) ¥ON range(g))
    ELEM ==> range(inv(f2) @ (g @ f2)) /= domain(f2)
    (inv(f2) @ (g @ f2))-->Stat1 ==> false; Discharge ==> QED
--
-- If $s$ is a 1-1 map, the implication given in the preceding theorem
-- can be strengthened to an equivalence:
--
Theorem 191: [One-one maps preserve finiteness, 2] one_1_map(F) ¥imp (Finite(domain(F)) ¥eq Finite(range(F))). Proof:
    Suppose_not(f) ==> one_1_map(f) & (not(Finite(domain(f)) ¥eq Finite(range(f))))
--
-- For in this case Theorem 190 applies to both $f$ and its inverse,
-- giving us a pair of implications, and so yielding the asserted equivalence.
--
    f-->T190 ==> Finite(domain(f)) ¥imp Finite(range(f))
    f-->T101 ==> one_1_map(inv(f)) & (domain(inv(f)) = range(f)) & (range(inv(f)) = domain(f))
    (inv(f))-->T190 ==>  Finite(domain(inv(f))) ¥imp Finite(range(inv(f)))
    EQUAL ==> Finite(range(f)) ¥imp Finite(domain(f))
    Discharge ==> QED
--
-- We can also extend Theorem 190 from 1-1 maps to single-valued maps in general:
--
Theorem 192: [A single-valued map with finite domain has a finite range]
	(Svm(F) & Finite(domain(F))) ¥imp Finite(range(F)). Proof:
    Suppose_not(f) ==> Svm(f) & Finite(domain(f)) & (not Finite(range(f)))
--
-- The result follows easily from Theorem 191 if we use Theorem 138, which tells us that
-- there is a 1-1 map, partially inverse to $f$, which maps $range(f)$ into a subset of $domain(f)$.
--
    (f)-->T138 ==> Stat1: (EXISTS h | (domain(h) = range(f)) & (range(h) ¥incin domain(f)) & one_1_map(h) &
    									(FORALL x in range(f) | f~[h~[X]] = X))
    invm-->Stat1 ==> (domain(invm) = range(f)) & (range(invm) ¥incin domain(f)) & one_1_map(invm)
    EQUAL ==> not Finite(domain(invm))
--
-- At this point we have the desired contradiction, because $not Finite(range(invm))$
-- and hence $not Finite(domain(f))$.
--
    invm-->T191 ==> false
    Discharge ==> QED
--
-- As an application of Theorem 192, we develop the following mini-theory
-- showing that the image of any finite set is a finite set.
--
THEORY finite_image(e(x),s0)
	Finite(s0)
END finite_image
--
ENTER_THEORY finite_image
--
Theorem finite_image.1: [Any image of a finite set is finite] Finite({e(x): x in s0}). Proof:
Suppose_not ==> AUTO
	ELEM ==> Svm({[x,e(x)]: x in s0}) & (domain({[x,e(x)]: x in s0}) = s0) & (range({[x,e(x)]: x in s0}) = {e(x): x in s0})
	Assump ==> Finite(s0)
	EQUAL ==> Finite(domain({[x,e(x)]: x in s0}))
	({[x,e(x)]: x in s0})-->T192 ==> Finite(range({[x,e(x)]: x in s0}))
EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY finite_image
--
--THEORY finite_image(e(x),s0)
--	Finite(s0)
--==>
--	Finite({e(x): x in s0})
--END finite_image
--
--
-- The following corollary to Theorem 191 states that
-- a set is finite if and only if its cardinality is finite.
-- The proof merely applies Theorem 191 twice, once to a 1-1 map from $#s$ to $s$,
-- and once to the inverse of this map.
--
Theorem 193: [A set is finite if and only if its cardinality is finite] Finite(S) ¥eq Finite(#S). Proof:
    Suppose_not(s) ==> not(Finite(s) ¥eq Finite(#s))
    (s)-->T156 ==> Stat1: Card(#s)  and  (EXISTS f in OM | one_1_map(f)  and  (range(f) = s)  and  (domain(f) = #s))
    (f)-->Stat1 ==> one_1_map(f) & (domain(f) = s) & (range(f) = #s)
    f-->T191 ==> Finite(s) ¥imp Finite(#s)
    f-->T101 ==> one_1_map(inv(f)) & (range(inv(f)) = #s) & (domain(inv(f)) = s)
    f-->T191 ==> Finite(#s) ¥imp Finite(s)
    Discharge ==> QED
--
-- Even if $t$ is a proper subset of a general set $s$ we can only assert that $#t$ is no greater than $#s$.
-- But if $s$ is finite, then, as the following theorem shows, $#t$ must be less than $s$.
--
Theorem 194: [Proper subsets of a finite set have fewer elements] (Finite(S) & (T ¥incin S) & (T /= S)) ¥imp (#T in #S). Proof:
    Suppose_not(s,t) ==> Finite(s) & (t ¥incin s) & (t /= s) & (#t notin #s)
--
-- For, proceeding by contradiction, suppose that $t$ is a proper subset of the finite set $s$ and $#t notin #s$.
-- By Theorem 156, there exist 1-1 maps $f$ and $g$ of $#s$ and $#t$ to $s$ and $t$ respectively, and then
-- $inv(g)$ is a 1-1 map of $#s$ to $s$.
--
    t-->T156 ==> Stat1: Card(#t) & Ord(#t) &
    	(EXISTS f in OM | (one_1_map(f) & (range(f) = t) & (domain(f) = #t)))
    f-->Stat1 ==> one_1_map(f) & (range(f) = t) & (domain(f) = #t)
    s-->T156 ==> Stat2:  Card(#s) & Ord(#s) &
    	(EXISTS f in OM | (one_1_map(f) & (range(f) = s) & (domain(f) = #s)))
    g-->Stat2 ==> Card(#s) & one_1_map(g) & (domain(g) = #s) & (range(g) = s)
    g-->T101 ==> one_1_map(inv(g)) & (domain(inv(g)) = s) & (range(inv(g)) = #s)
--
-- Since $#t notin #s$ and both are ordinals, it follows by Theorem 170 and Theorem 34 that $#t = #s$, and so
-- $f @ inv(g)$ is a 1-1 map of $s$ onto $t$. Thus by the definition of finiteness
-- $t$ cannot be a proper subset of $s$, a contradiction proving our theorem.
--
    (t,s)-->T170 ==> #s incs #t
    (#s,#t)-->T34 ==>  #t = #s
    (inv(g),f)-->T96 ==> (domain(f @ inv(g)) = s) & (range(f @ inv(g)) = t)
    (f,inv(g))-->T133 ==> one_1_map(f @ inv(g))
    Use_def(Finite) ==> Stat3: not (EXISTS f in OM | one_1_map(f) & (domain(f) = s) & (range(f) ¥incin s) & (range(f) /= s))
    (f @ inv(g))-->Stat3 ==> false; Discharge ==> QED
--
-- Another property of finite sets (which could be used to define them)
-- is stated in the following theorem: a finite set is not the image of any proper subset of
-- itself by a single-valued map.
--
Theorem 195: [A set is finite if and only if it is not the single-valued image of any of its finite subsets] Finite(S) ¥eq
	(not(EXISTS f in OM | (Svm(f) & (range(f) = S) & (domain(f) ¥incin S) & (S /= domain(f))))). Proof:
    Suppose_not(s) ==> not(Finite(s) ¥eq
    	(not(EXISTS f in OM | (Svm(f) & (range(f) = s) & (domain(f) ¥incin s) & (s /= domain(f))))))
--
-- First suppose the contrary, and first consider the case in which $s$ is finite but there exists a
-- single-valued map $f$ of a proper subset $s$ of onto $s$. By Theorem 138,
-- this has a 1-1 partial inverse mapping $s$ to a proper subset of $s$,
-- which is impossible by definition of finiteness. Hence we need only consider the
-- case in which $s$ is not finite, but there exists no single-valued map $f$ of a proper subset of $s$ onto $s$.
--
    Suppose ==> Finite(s) & Stat1: (EXISTS f in OM | (Svm(f) & (range(f) = s) & (domain(f) ¥incin s) &
    								(s /= domain(f))))
    f-->Stat1 ==> Svm(f) & (range(f) = s) & (domain(f) ¥incin s) & (s /= domain(f))
    f-->T138 ==> Stat2: (EXISTS h | ((domain(h) = range(f)) & (range(h) ¥incin domain(f)) & one_1_map(h)) &
    						(FORALL x in range(f) | ((f~[h~[x]]) = x)))
    h-->Stat2 ==> (domain(h) = s) & (range(h) ¥incin s) & (s /= range(h)) & one_1_map(h)
    Use_def(Finite) ==>
    	Stat3: not(EXISTS h in OM | ((one_1_map(h) & (domain(h) = s) & (range(h) ¥incin s) & (range(h) /= s))))
    h-->Stat3 ==> false
    Discharge ==>  (not(Finite(s))) &
	Stat4: (not(EXISTS f in OM | Svm(f) & (range(f) = s) & (domain(f) ¥incin s) & (s /= domain(f))))
--
-- Since by definition of finiteness there exists a 1-1 map $g$ of a proper subset of $s$ onto $s$, and
-- since the inverse of $g$ is also a 1-1 map, we have a contradiction in this case also, and so
-- our theorem is proved.
--
    Use_def(Finite) ==> Stat5:
    	(EXISTS f in OM | (one_1_map(f) & (domain(f) = s) & (range(f) ¥incin s) & (s /= range(f))))
    g-->Stat5 ==> one_1_map(g) & (domain(g) = s) & (range(g) ¥incin s) & (s /= range(g))
    g-->T101 ==> one_1_map(inv(g)) & (range(inv(g)) = s) & (domain(inv(g)) ¥incin s) & (s /= domain(inv(g)))
    Use_def(one_1_map) ==> Svm(inv(g))
    (inv(g))-->Stat4 ==> false; Discharge ==> QED
--
-- Since members of an ordinal $s$ are also subsets of $s$, it follows immediately from Theorem 189
-- that any member of a finite ordinal is finite.
--
Theorem 196: [Members of a finite ordinal are finite] (Ord(S) & Finite(S) & (T in S)) ¥imp Finite(T). Proof:
    Suppose_not(s,t) ==> AUTO
    (s,t)-->T13 ==> false; Discharge ==> QED
--
-- A further corollary of Theorem 195 is that any infinite ordinal is larger than any finite ordinal:
--
Theorem 197: [Any infinite ordinal is larger than any finite ordinal]
	(Ord(S) & Ord(T) & (not Finite(S)) & Finite(T)) ¥imp (T in S). Proof:
    Suppose_not(s,t) ==> Ord(s) & Ord(t) & (not Finite(s)) & Finite(t) & (not(t in s))
    (s,t)-->T31 ==> (s in t) or (t in s) or (s = t)
 	EQUAL ==> s /= t
    ELEM ==> s in t
    (t,s)-->T196 ==> false; Discharge ==> QED
--
-- To exploit the fact that sets which are in 1-1 correspondence have the same cardinality,
-- we sometimes need to make use of elementary constructions of such maps.
-- The following lemma captures one such case: elements of a set $s$ can always be interchanged
-- by some 1-1 map.
--
Theorem 198: [Interchange lemma]
    ((X in S) & (Y in S)) ¥imp (EXISTS f | one_1_map(f) & (range(f) = S) & (domain(f) = S) & ((f~[X]) = Y) & ((f~[Y]) = X)). Proof:
Suppose_not(a,s,b) ==>
	Stat1: (a in s) & (b in s) & Stat2: (not(EXISTS f | one_1_map(f) & (range(f) = s) & (domain(f) = s) & ((f~[a]) = b) & ((f~[b]) = a)))
--
-- For the desired map $f$ can be defined by $(f~[x]) = if x = a then b elseif x = b then a else x end if$,
--
	Loc_def ==> f = {[x,if x = a then b elseif x = b then a else x end if]: x in s}
--
-- and it is easily seen that the range of this map is $s$.
--
        APPLY(x9_thryvar:c2,y9_thryvar:d2) fcn_symbol(f(x)->if x = a then b elseif x = b then a else x end if,g->f,s->s) ==>
		Stat3: (((c2 in s) & (d2 in s) & (if c2 = a then b elseif c2 = b then a else c2 end if =
					if d2 = a then b elseif d2 = b then a else d2 end if) & (c2 /= d2)) or one_1_map(f))
        APPLY() fcn_symbol(f(x)->if x = a then b elseif x = b then a else x end if,g->f,s->s) ==>
		Stat4: (FORALL x | (x in s) ¥imp ((f~[x]) = if x = a then b elseif x = b then a else x end if)) &
		Stat5: Svm(f) & (domain(f) = s) &
		(range(f) = {if x = a then b elseif x = b then a else x end if: x in s})
        Suppose ==> Stat6: s /= {if x = a then b elseif x = b then a else x end if: x in s}
            c-->Stat6 ==> Stat7: (c in s) ¥eq (c notin {if x = a then b elseif x = b then a else x end if: x in s})
            Suppose ==> Stat8: (c in s) & Stat9: (c notin {if x = a then b elseif x = b then a else x end if: x in s})
                Suppose ==> c = b
                a-->Stat9 ==> false; Discharge ==> c /= b
                Suppose ==> c = a
                b-->Stat9 ==> false; Discharge ==> c /= a
            c-->Stat9 ==> false; Discharge ==> not((c in s) & (c notin {if x = a then b elseif x = b then a else x end if: x in s}))
            (Stat7*)ELEM ==> Stat10: (c notin s) & Stat11: (c in {if x = a then b elseif x = b then a else x end if: x in s})
            d-->Stat11(Stat10*) ==> Stat12: (c = if d = a then b elseif d = b then a else d end if) & (d in s) & (c notin s)
        (Stat1,Stat12)Discharge ==> Stat13: range(f) = s
--
-- The fact that $f$ is 1-1 is also elementary, so $f$ has all the properties which our theorem asserts.
--
        (Stat3*)ELEM ==> Stat14: one_1_map(f)
        b-->Stat4(Stat1,Stat1*) ==> Stat15: (f~[b]) = a
        a-->Stat4(Stat1,Stat1*) ==> Stat16: (f~[a]) = b
f-->Stat2(Stat13,Stat4,Stat14,Stat16,Stat15) ==> false; Discharge ==> QED
--
-- The following utility lemma gives us expressions for the map restriction of any single-valued map,
-- and for the range and domain of this restriction.
--
-- Using Theorem 198, we can easily prove that the successor set of any finite set is also finite.
--
Theorem 199: [Adding one element to a finite set leaves it finite] Finite(S) ¥eq Finite(S + {X}). Proof:
    Suppose_not(s,a) ==> AUTO
--
-- Since any subset of a finite set is finite, our theorem can only be false
-- if $s$ is finite and $s + {a}$ is not, in which case $a$ is not in $s$ and there must exist
-- a 1-1 map $g$ of $s + {a}$ into a subset of $s + {a}$ which omits some element $c$ of $s + {a}$.
--
    ELEM ==> Finite(s) & (not Finite(s + {a}))
    Suppose ==> s = s + {a}
    EQUAL ==> false; Discharge ==> a notin s
    Use_def(Finite) ==>
	Stat1: (EXISTS f in OM | one_1_map(f) & (domain(f) = s + {a}) & (range(f) ¥incin (s + {a})) &
			((s + {a}) /= range(f))) &
	Stat2: (not(EXISTS f in OM | one_1_map(f) & (domain(f) = s) & (range(f) ¥incin s) & (s /= range(f))))
    g-->Stat1 ==> one_1_map(g) & (domain(g) = s + {a}) & Stat3: (s + {a} /= range(g)) & (range(g) ¥incin (s + {a}))
    c-->Stat3 ==> (c in s + {a}) & (c notin range(g))
    ELEM ==> (a notin s) & (a in domain(g)) & (c in domain(g)) & (c notin range(g))
--
-- But by Theorem 198 there is a 1-1 map $f$ of $s + {a}$ onto itself which interchanges $a$ and $c$.
-- The product map $f @ g$ is therefore a 1-1 map $f$ of $s + {a}$ into itself whose range omits $a$.
--
    (a,domain(g),c)-->T198 ==> Stat4: (EXISTS f | one_1_map(f) & (range(f) = domain(g)) & (domain(f) = domain(g)) &
    				(f~[a] = c) & (f~[c] = a))
    f-->Stat4 ==> one_1_map(f) & (range(f) = domain(g)) & (domain(f) = domain(g)) &
    				(f~[a] = c) & (f~[c] = a)
    (f,g)-->T95 ==> (range(f @ g) = range(f ¥ON range(g))) & (domain(f @ g) = s + {a})
    Use_def(one_1_map) ==> Svm(f)
    Suppose ==> a in range(f ¥ON range(g))
    (f,range(g))-->T123 ==> Stat5: a in {f~[x]: x in domain(f) | x in range(g)}
     e-->Stat5 ==> (a = f~[e]) & (e in domain(f)) & (e in range(g))
   	 ELEM ==> (c in domain(f)) & (a = f~[c])
   	(f,e,c)-->T127 ==> false; Discharge ==> a notin range(f @ g)
--
-- Hence the restriction of $f$ to $s$ is a 1-1 mapping of $s$ into itself.
--
    (f,range(g))-->T80 ==> range(f ¥ON range(g)) ¥incin (s + {a})
    ELEM ==> range(f @ g) ¥incin s
    (f,g)-->T133 ==> one_1_map(f @ g)
 	((f @ g),s)-->T58 ==> one_1_map((f @ g) ¥ON s)
 	(f @ g,s)-->T94 ==> domain((f @ g) ¥ON s) = s
 	(f @ g,s)-->T80 ==> range((f @ g) ¥ON s) ¥incin s
--
-- But it is easily seen that $(f @ g)~[a]$ must be an element of $s$,
--
 	ELEM ==> a in domain(f @ g)
 	Use_def(one_1_map) ==> Svm(f @ g)
 	(a,f @ g)-->T71 ==> (f @ g)~[a] in s
--
-- and that $(f @ g)~[a]$ is not a member of $range((f @ g) ¥ON s)$
--
	(f @ g)-->T72 ==> f @ g = {[x,(f @ g)~[x]]: x in domain(f @ g)}
 	EQUAL ==> f @ g = {[x,(f @ g)~[x]]: x in (s + {a})}
 	Suppose ==> (f @ g)~[a] in range((f @ g) ¥ON s)
 	Use_def(¥ON) ==> (f @ g)~[a] in range({x in (f @ g) | car(x) in s})
 	EQUAL ==> (f @ g)~[a] in range({x in {[x,(f @ g)~[x]]: x in (s + {a})} | car(x) in s})
 	SIMPLF ==> (f @ g)~[a] in range({[x,(f @ g)~[x]]: x in (s + {a}) | car([x,(f @ g)~[x]]) in s})
 	Use_def(range) ==>
 		(f @ g)~[a] in {cdr(y): y in {[x,(f @ g)~[x]]: x in (s + {a}) | car([x,(f @ g)~[x]]) in s}}
 	SIMPLF ==> Stat6: (f @ g)~[a] in {cdr([x,(f @ g)~[x]]): x in (s + {a}) | car([x,(f @ g)~[x]]) in s}
 	b-->Stat6 ==> (b in s + {a}) & (car([b,(f @ g)~[b]]) in s) & ((f @ g)~[a] = cdr([b,(f @ g)~[b]]))
 	ELEM ==> ((f @ g)~[a] = (f @ g)~[b]) & (b in s)
 	(f @ g,a)-->T103 ==> inv(f @ g)~[(f @ g)~[a]] = a
 	(f @ g,b)-->T103 ==> inv(f @ g)~[(f @ g)~[b]] = b
	EQUAL ==> a = b
	Discharge ==> range((f @ g) ¥ON s) /= s
--
-- Therefore $(f @ g) ¥ON s$ is a 1-1 mapping of $s$ into a proper subset of itself, violating our
-- assumption that $s$ is finite, and thereby proving the present theorem.
--
	Use_def(Finite) ==> Stat7: not(EXISTS f in OM |
	(one_1_map(f) & (domain(f) = s) & (range(f) ¥incin s) & (s /= range(f))))
    ((f @ g) ¥ON s)-->Stat7 ==> false; Discharge ==> QED
--
-- Theorem 199 has the following obvious corollary.
--
Theorem 200: [Finiteness of successor set] Finite(S) ¥imp Finite(next(S)). Proof:
	Suppose_not(s) ==> Finite(s) & (not Finite(next(s)))
    Use_def(next) ==> next(s) = s + {s}
    (s,s)-->T199 ==> Finite(s + {s})
    EQUAL ==> false; Discharge ==> QED
--
-- The following equally obvious corollaries of Theorem 199 are also useful.
-- The fist simply states that any singleton is finite.
--
Theorem 201: [Singletons are finite] Finite({S}). Proof:
	Suppose_not(s) ==> not Finite({s})
    T188 ==> Finite(0)
    (0,s)-->T199 ==> Finite(0 + {s})
    ELEM ==> 0 + {s} = {s}
    EQUAL ==> false; Discharge ==> QED
--
-- Our next elementary result states that any unordered pair is also a finite set.
--
Theorem 202: [Doubletons are finite] Finite({S,T}). Proof:
Suppose_not(s,t) ==> not Finite({s,t})
--
-- For assuming the contrary would lead to a contradiction, since
-- prior theorems ensure that $Finite({s})$ and, consequently
-- $Finite({s} + {t})$
--
--?    T201 ==> Finite({s})
	s-->T201 ==> AUTO
	({s},t)-->T199 ==> AUTO
	TELEM ==> {s} + {t} = {s,t}
	EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the set whose existence is asserted by the Axiom of Infinity
-- must actually be infinite.
--
Theorem 203: [The basic infinite set is not finite] not(Finite(s_inf)). Proof:
	Suppose_not ==> Finite(s_inf)
    Loc_def ==> g = {[x,{x}]: x in s_inf}
--
-- For by the axiomatic assumption defining $s_inf$, the single-valued map ${[x,{x}]: x in s_inf}$
-- sends $s_inf$ into itself.
--
    APPLY(x9_thryvar:a1,y9_thryvar:a2) fcn_symbol(f(x)->{x},g->g,s->s_inf) ==>
    	Svm(g) & (domain(g) = s_inf) & (range(g) = {{x}: x in s_inf}) &
    		((((a1 in s_inf) & (a2 in s_inf)) & ({a1} = {a2}) & (a1 /= a2)) or one_1_map(g))
    Suppose ==> Stat1: not (range(g) ¥incin s_inf)
    c-->Stat1 ==> Stat2: (c in {{x}: x in s_inf}) & (not c in s_inf)
    d-->Stat2 ==> (d in s_inf) & (c = {d}) & (not c in s_inf)
    T00 ==> (s_inf /= 0) & Stat3: (FORALL x in s_inf | {x} in s_inf)
    d-->Stat3 ==> (d in s_inf) ¥imp ({d} in s_inf)
    Discharge ==> range(g) ¥incin s_inf
--
-- But it is easily seen using the axiom of choice that $arb(s_inf)$ cannot be in the range of the map $g$.
-- Hence $g$ is a 1-1 map which maps $s_inf$ into a proper subset of itself, contradicting
-- the definition of finiteness, and thereby proving our theorem
--
	T00 ==> s_inf /= 0
    s_inf-->T0 ==> (arb(s_inf) in s_inf) & (arb(s_inf) * s_inf = 0)
    Suppose ==> range(g) = s_inf
    ELEM ==> Stat4: arb(s_inf) in {{x}: x in s_inf}
    e-->Stat4 ==> (e in s_inf) & (arb(s_inf) = {e})
    Discharge ==> range(g) /= s_inf
    Suppose ==> not one_1_map(g)
    Discharge ==> one_1_map(g)
    Use_def(Finite) ==>
    	Stat5: not(EXISTS f in OM | (one_1_map(f) & (domain(f) = s_inf) & (range(f) ¥incin s_inf) & (s_inf /= range(f))))
    g-->Stat5 ==> false; Discharge ==> QED
--
-- It follows as a corollary of the preceding theorem that $#s_inf$ is an infinite cardinal.
--
Theorem 204: [Infinite cardinality theorem] not Finite(#s_inf). Proof:
	Suppose_not ==> Finite(#s_inf)
    s_inf-->T193 ==> Finite(#s_inf) ¥eq Finite(s_inf)
    T203 ==> not(Finite(s_inf))
    Discharge ==> QED
--
-- The next theorem tells us that for finite sets there is no difference
-- between ordinals and cardinals, since all finite ordinals are cardinals.
--
Theorem 205: [All finite ordinals are cardinals] (Ord(X) & Finite(X)) ¥imp Card(X). Proof+:
    Suppose_not(x) ==> Ord(x) & Finite(x) & (not Card(x))
--
-- For if $x$ is a finite ordinal which is not a cardinal, then by definition
-- there must exist a single-valued map $f$ of a member $y$ of $x$ onto $x$.
-- Plainly $y$ must be an ordinal and a proper subset of $x$.
--
    Use_def(Card) ==>
	Stat1: not(FORALL y in x, f in OM | (not(domain(f) = y)) or (not(range(f) = x)) or (not(Svm(f))))
    (y,f)-->Stat1 ==> (domain(f) = y) & (y in x) & (range(f) = x) & Svm(f)
    (x,y)-->T34 ==> (y ¥incin x)
    ELEM ==> y /= x
--
-- By Theorem 138, $f$ has a 1-1 partial inverse $h$, whose domain is $range(f)$ and whose range is
-- a subset of $domain(f)$. Since $x$ is finite, this must map $x$ onto all of itself,
-- contradicting the fact that $y = domain(f)$ is a proper subset of $x$. This contradiction proves our theorem.
--
    f-->T138 ==> Stat2: (EXISTS h | ((domain(h) = range(f)) & (range(h) ¥incin domain(f)) & one_1_map(h)) &
    								(FORALL x in range(f) | f~[h~[x]] = x))
    h-->Stat2 ==> (domain(h) = range(f)) & (range(h) ¥incin domain(f)) & one_1_map(h)
    Use_def(Finite) ==>
	Stat3: not(EXISTS p in OM | one_1_map(p) & (domain(p) = x) & (range(p) ¥incin x) & (x /= range(p)))
    h-->Stat3 ==> not(one_1_map(h) & (domain(h) = x) & (range(h) ¥incin x) & (x /= range(h)))
    Discharge ==> QED
--
--
--
--
THEORY setformer_meet_join(s,t,h(u,v),R(u,v),Q(u,v))
END setformer_meet_join
--
ENTER_THEORY setformer_meet_join
--
Theorem setformer_meet_join.1: [Disjunction in a setformer] {h(u,v): u in s, v in t | R(u,v) or Q(u,v)} = ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)}). Proof:
    Suppose_not ==> Stat1: {h(u,v): u in s, v in t | R(u,v) or Q(u,v)} /= ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)})
    c-->Stat1 ==> (c in {h(u,v): u in s, v in t | R(u,v) or Q(u,v)}) ¥eq (c notin ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)}))
    Suppose ==> (c notin ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)})) & Stat2: (c in {h(u,v): u in s, v in t | R(u,v) or Q(u,v)})
        ELEM ==> Stat3: (c notin {h(u,v): u in s, v in t | Q(u,v)}) & (c notin {h(u,v): u in s, v in t | R(u,v)})
        (u,v)-->Stat2 ==> (c = h(u,v)) & (u in s) & (v in t) & (R(u,v) or Q(u,v))
    (u,v,u,v)-->Stat3 ==> false; Discharge ==> (c in ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)})) & Stat4: (c notin {h(u,v): u in s, v in t | R(u,v) or Q(u,v)})
    ELEM ==> (c in {h(u,v): u in s, v in t | R(u,v)}) or (c in {h(u,v): u in s, v in t | Q(u,v)})
    Suppose ==> Stat5: c in {h(u,v): u in s, v in t | R(u,v)}
        (up,vp)-->Stat5 ==> (c = h(up,vp)) & (up in s) & (vp in t) & R(up,vp)
    (up,vp)-->Stat4 ==> false; Discharge ==> Stat6: c in {h(u,v): u in s, v in t | Q(u,v)}
    (uq,vq)-->Stat6 ==> (c = h(uq,vq)) & (uq in s) & (vq in t) & Q(uq,vq)
    (uq,vq)-->Stat4 ==> false; Discharge ==> QED
--
Theorem setformer_meet_join.2: [Conjunction in a setformer] {h(u,v): u in s, v in t | R(u,v) & Q(u,v)} ¥incin ({h(u,v): u in s, v in t | R(u,v)} * {h(u,v): u in s, v in t | Q(u,v)}). Proof:
    Suppose_not ==> Stat1: not({h(u,v): u in s, v in t | R(u,v) & Q(u,v)} ¥incin ({h(u,v): u in s, v in t | R(u,v)} * {h(u,v): u in s, v in t | Q(u,v)}))
        c-->Stat1 ==> (c notin ({h(u,v): u in s, v in t | R(u,v)} * {h(u,v): u in s, v in t | Q(u,v)})) & Stat2: (c in {h(u,v): u in s, v in t | R(u,v) & Q(u,v)})
        ELEM ==> Stat3: (c notin {h(u,v): u in s, v in t | Q(u,v)}) or (c notin {h(u,v): u in s, v in t | R(u,v)})
        (u,v)-->Stat2 ==> (c = h(u,v)) & (u in s) & (v in t) & (R(u,v) & Q(u,v))
        Suppose ==> Stat4: c notin {h(u,v): u in s, v in t | Q(u,v)}
        (u,v)-->Stat4 ==> false; Discharge ==> Stat5: c notin {h(u,v): u in s, v in t | R(u,v)}
    (u,v)-->Stat5 ==> false; Discharge ==> QED
--
Theorem setformer_meet_join.3: [Implication in a setformer] (FORALL u in s, v in t | Q(u,v) ¥imp R(u,v)) ¥imp ({h(u,v): u in s, v in t | Q(u,v)} ¥incin {h(u,v): u in s, v in t | R(u,v)}). Proof:
    Suppose_not ==> Stat1: (FORALL u in s, v in t | Q(u,v) ¥imp R(u,v)) & Stat2: (not({h(u,v): u in s, v in t | Q(u,v)} ¥incin {h(u,v): u in s, v in t | R(u,v)}))
        (u,v)-->Stat2 ==> (u in s) & (v in t) & Q(u,v) & (not(R(u,v)))
    (u,v)-->Stat1 ==> false; Discharge ==> QED
--
Theorem setformer_meet_join.4: [Setformer cardinality inclusion, two-variable case] #{[u,v]: u in s, v in t | R(u,v)} incs #{h(u,v): u in s, v in t | R(u,v)}. Proof:
    Suppose_not ==> not(#{[u,v]: u in s, v in t | R(u,v)} incs #{h(u,v): u in s, v in t | R(u,v)})
        APPLY() Must_be_svm_2(b2(u,v)->h(u,v), s->s, t->t, P2(u,v)->R(u,v)) ==>
			Svm({[[u,v],h(u,v)]: u in s, v in t | R(u,v)}) &
			(domain({[[u,v],h(u,v)]: u in s, v in t | R(u,v)}) = {[u,v]: u in s, v in t | R(u,v)}) &
			(range({[[u,v],h(u,v)]: u in s, v in t | R(u,v)}) = {h(u,v): u in s, v in t | R(u,v)})
--        TELEM ==> Svm({[[u,v],h(u,v)]: u in s, v in t | R(u,v)})
--        TELEM ==> (domain({[[u,v],h(u,v)]: u in s, v in t | R(u,v)}) = {[u,v]: u in s, v in t | R(u,v)}) &
--			(range({[[u,v],h(u,v)]: u in s, v in t | R(u,v)}) = {h(u,v): u in s, v in t | R(u,v)})
	({[[u,v],h(u,v)]: u in s, v in t | R(u,v)})-->T171 ==> #domain({[[u,v],h(u,v)]: u in s, v in t | R(u,v)}) incs #range({[[u,v],h(u,v)]: u in s, v in t | R(u,v)})
    EQUAL ==> false; Discharge ==> QED
--
Theorem setformer_meet_join.5: [Setformer finiteness implication, two-variable case] Finite({[u,v]: u in s, v in t | R(u,v)}) ¥imp Finite({h(u,v): u in s, v in t | R(u,v)}). Proof:
    Suppose_not ==> Finite({[u,v]: u in s, v in t | R(u,v)}) & (not Finite({h(u,v): u in s, v in t | R(u,v)}))
        Tsetformer_meet_join.4 ==> (#({[u,v]: u in s, v in t | R(u,v)})) incs (#({h(u,v): u in s, v in t | R(u,v)}))
        ({[u,v]: u in s, v in t | R(u,v)})-->T193 ==> Finite(#{[u,v]: u in s, v in t | R(u,v)})
        (#({[u,v]: u in s, v in t | R(u,v)}),#({h(u,v): u in s, v in t | R(u,v)}))-->T189 ==> Finite(#({h(u,v): u in s, v in t | R(u,v)}))
    (#({h(u,v): u in s, v in t | R(u,v)}))-->T193 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY setformer_meet_join
--
--THEORY setformer_meet_join(s,t,h(u,v),R(u,v),Q(u,v))
--==>
--    {h(u,v): u in s, v in t | (R(u,v) or Q(u,v))} = ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)})
--    {h(u,v): u in s, v in t | R(u,v) & Q(u,v)} ¥incin ({h(u,v): u in s, v in t | R(u,v)} * {h(u,v): u in s, v in t | Q(u,v)})
--    (FORALL u in s, v in t | Q(u,v) ¥imp R(u,v)) ¥imp ({h(u,v): u in s, v in t | Q(u,v)} ¥incin {h(u,v): u in s, v in t | R(u,v)})
--    #{[u,v]: u in s, v in t | R(u,v)} incs #{h(u,v): u in s, v in t | R(u,v)}
--    Finite({[u,v]: u in s, v in t | R(u,v)}) ¥imp Finite({h(u,v): u in s, v in t | R(u,v)})
--END setformer_meet_join
--
--
-- ************************************************************************************************
--			Section 7: The set of all Integers, basic arithmetic of integers and cardinals
-- ************************************************************************************************
--
-- Now we can take a decisive step into the realm of traditional mathematics by defining the set of
-- positive integers as the smallest infinite cardinal. These are the 'unsigned' integers,
-- including $0$. The proofs of their properties with which we now continue prepare for
-- subsequent introduction of the signed integers, from these the rational and real numbers,
-- and finally the complex numbers.
--
Def 18a: [The set of integers] Za := arb({x: x in next(#s_inf) | not Finite(x)})
--
-- The definition just given is justified by the following theorem, which tells us that $Za$
-- is in fact an infinite ordinal, whose members are exactly the finite ordinals.
--
Theorem 206: [The set of integers is an infinite ordinal consisting of all finite ordinals] Ord(Za) & (not Finite(Za)) & ((Card(X) & Finite(X)) ¥eq (X in Za)). Proof+:
    Suppose_not(x) ==> (not Ord(Za)) or Finite(Za) or (not((Card(x) & Finite(x)) ¥eq (x in Za)))
--
-- First we show that there exists an infinite ordinal, which will imply that
-- there is a smallest infinite ordinal. This is done using the axiom of infinity:
-- the cardinal of the infinite set which this axiom gives us must be infinite.
--
    T204 ==> not Finite(#s_inf)
    s_inf-->T156 ==> Ord(#s_inf)
    Use_def(next) ==> next(#s_inf) = #s_inf + {#s_inf}
    ELEM ==> #s_inf in next(#s_inf)
    Suppose ==> {x: x in next(#s_inf) | not Finite(x)} = 0
    ELEM ==> Stat1: #s_inf notin {x: x in next(#s_inf) | not Finite(x)}
    (#s_inf)-->Stat1 ==> not(#s_inf in next(#s_inf)) or Finite(#s_inf)
    Discharge ==> Stat2: {x: x in next(#s_inf) | not Finite(x)} /= 0
--
-- Since we have just shown that there is some infinite ordinal,
-- the axiom of choice tells us that $Za$ must be an infinite ordinal.
--
   {x: x in next(#s_inf) | not Finite(x)}-->T0 ==>
	(arb({x: x in next(#s_inf) | not Finite(x)}) in {x: x in next(#s_inf) | not Finite(x)}) &
	 (arb({x: x in next(#s_inf) | not Finite(x)}) * {x: x in next(#s_inf) | not Finite(x)} = 0)
    Use_def(Za) ==> Stat3: (Za in {x: x in next(#s_inf) | not Finite(x)})
    					& (Za * {x: x in next(#s_inf) | not Finite(x)} = 0)
    Za-->Stat3 ==> (Za in next(#s_inf)) & (not Finite(Za))
    (#s_inf)-->T32 ==> Ord(next(#s_inf))
    (next(#s_inf),Za)-->T12 ==> Ord(Za)
--
-- It follows from what has now been proved that only the third clause of our theorem can be false.
-- Hence there exists an x for which $(Card(x) & Finite(x))$ and $(x in Za)$ are inequivalent.
-- This inequivalence falls into two possible cases.
--
    ELEM ==> (Card(x) & Finite(x) & (not (x in Za))) or (((not Card(x)) or (not Finite(x))) & (x in Za))
--
-- The first of these cases is impossible, so the second must hold.
--
    Suppose ==> Card(x) & Finite(x) & (not (x in Za))
   	Use_def(Card) ==> Ord(x) & Finite(x) & (not (x in Za))
    (Za,x)-->T197 ==> ((Ord(x) & Ord(Za) & (not Finite(Za)) & Finite(x))) ¥imp (x in Za)
    Discharge ==> ((not Card(x)) or (not Finite(x))) & (x in Za)
--
-- But since $Za$ has been defined as the smallest infinite ordinal,
-- each member of $Za$ is a finite ordinal, and hence a cardinal by Theorem 205.
--
    Suppose ==> not Finite(x)
    (next(#s_inf),Za)-->T34 ==> (x in next(#s_inf)) & (not Finite(x))
    Suppose ==> Stat4: x notin {u: u in next(#s_inf) | not Finite(u)}
    x-->Stat4 ==> false; Discharge ==> x in {u: u in next(#s_inf) | not Finite(u)}
    Discharge ==> Finite(x)
    x-->T205 ==> (Ord(x) & Finite(x)) ¥imp Card(x)
    (Za,x)-->T12 ==> false
    Discharge ==> QED
--
-- It follows trivially from Theorem 206 that every element of Za is its own cardinality.
--
Theorem 207: [All integers are finite ordinals and cardinals] (X in Za) ¥imp ((X = #X) & Card(X) & Ord(X) & Finite(X)). Proof:
--
-- Simply because every element of Za is finite and a cardinal, hence an ordinal.
--
    Suppose_not(m) ==> AUTO
	Use_def(Card(m)) ==> AUTO
	m-->T206 ==> Card(m) & Finite(m) & Ord(m)
	m-->T164 ==> m = #m
    Discharge ==> QED
--
Theorem 208: [Transitivity of integer comparison] ((M in Za) & (N in Za) & (I in N)) ¥imp ((M in N) or (I in M)). Proof+:
Suppose_not(m,n,i) ==> AUTO
	(m,n)-->T31 ==> AUTO
(m,n)-->T13 ==> false; Discharge ==> QED
--
-- The standard set-theoretic (von Neumann) definitions of
-- the first few positive integers $1,2,3,...$ are as follows:
--
--Def 18b: [Standard definitions of the integers, (1 is next(0)) & (2 is next(1)) & (3 is next(2)) &...  ] one := next(0)
--
Def 18b: [The integer 1] Def(1) := next(0)
Def 18c: [The integer 2] Def(2) := next(1)
Def 18d: [The integer 3] Def(3) := next(2)
Def 18f: [The integer 4] Def(4) := next(3)
--
-- We show next that the set of integers is not merely an ordinal, but is indeed a cardinal.
--
Theorem 209: [The set of integers is a Cardinal] Card(Za). Proof:
    Suppose_not ==> not Card(Za)
--
-- For in the contrary case there would exist an element $y$ of $Za$ and a 1-1 map $f$ of $y$ onto $Za$.
--
    Use_def(Card) ==> (not Ord(Za)) or
	not(FORALL y in Za, f in OM | (not(domain(f) = y)) or (not(range(f) = Za)) or (not(Svm(f))))
    junk-->T206 ==> Ord(Za)
    ELEM ==>
	Stat1: not(FORALL y in Za, f in OM | (not(domain(f) = y)) or (not(range(f) = Za)) or (not(Svm(f))))
--
-- But then Theorem 192 would tell us that $Za$ is finite, a contradiction proving our theorem.
--
    (y,f)-->Stat1 ==> (y in Za) & (domain(f) = y) & (range(f) = Za) & Svm(f)
    f-->T192 ==> Finite(domain(f)) ¥imp Finite(range(f))
    y-->T206 ==> Finite(y) & (not  Finite(Za))
    EQUAL ==> false; Discharge ==> QED
--
--
--
Theorem 210: [The successor of an integer is an integer] (I in Za) ¥imp (Card(next(I)) & (next(I) in Za)). Proof+:
Suppose_not(i0) ==> AUTO
	i0-->T32(*) ==> Ord(next(i0))
	i0-->T200(*) ==> Finite(next(i0))
	(next(i0))-->T205(*) ==> Card(next(i0))
(next(i0))-->T206(*) ==> false; Discharge ==> QED
--
-- Our next aim is to define the first few integers and establish their elementary properties.
-- This is done in the two following theorems.
--
Theorem 211: [The first few integers are all cardinals] Ord(0) & (0 in Za) & (1 in Za) & (2 in Za) & (3 in Za) & Card(0) & Card(1) & Card(2) & Card(3). Proof:
Suppose_not ==> AUTO
--
-- All these statements are trivial corollaries of the fact that 0 is a cardinal,
-- and of Theorem 188, Theorem 206, and Theorem 210.
--
	T188(*) ==> Finite(0) & Card(0)
   	0-->T206(*) ==> 0 in Za
	Use_def(Card)(*) ==> Ord(0)
	0-->T210(*) ==> Card(next(0)) & (next(0) in Za)
	Use_def(1)(*) ==> Card(1) & (1 in Za)
	1-->T210(*) ==> Card(next(1)) & (next(1) in Za)
	Use_def(2)(*) ==> Card(2) & (2 in Za)
	2-->T210(*) ==> Card(next(2)) & (next(2) in Za)
Use_def(3)(*) ==> false; Discharge ==> QED

--
-- The following corollary to Theorem 211 merely adds the elementary fact
-- that the first 3 integers are all different.
--
Theorem 212: [The first few integers are all distinct] (0 in Za) & (1 in Za) & (2 in Za) & (3 in Za) & (1 /= 0) & (2 /= 0) & (3 /= 0) & (1 /= 2) & (1 /= 3) & (2 /= 3). Proof:
	Suppose_not ==> not((0 in Za) & (1 in Za) & (2 in Za) & (3 in Za) & (1 /= 0) & (2 /= 0) & (3 /= 0) & (1 /= 2) & (1 /= 3) & (2 /= 3))
    T211 ==> (0 in Za) & (1 in Za) & (2 in Za) & (3 in Za)
    Use_def(1) ==> Stat1: 1 = next(0)
    Use_def(2) ==> 2 = next(1)
    Use_def(3) ==> 3 = next(2)
    Use_def(next) ==> false; Discharge ==> QED
--
-- Next, in preparation for our account of integer arithmetic,
-- we define the main arithmetic operators,
-- not merely for integers, but for all cardinals, whether finite or infinite.
--
Def 19: [Cardinal sum] Def(n ¥PLUS m) := #({[x,0]: x in n} + {[x,1]: x in m})
Def 20: [Cardinal product] Def(N ¥TIMES M) := #(N ¥PROD M)
Def 21: [Powerset of a set] pow(S) := {x: x ¥incin S}
Def 22: [Cardinal Difference] Def(N ¥MINUS M) := #(N - M)
--
-- The quotient $m ¥OVER n$ is defined as the largest integer $k$ such that $k ¥TIMES n$ is
-- no larger than $m$, and $m ¥MOD n$ is defined as the remainder $m ¥MINUS ((m ¥OVER n) ¥TIMES n)$.
--
Def 23: [Integer Quotient; Note that $x/0$ is defined as $Za$ for $x in Za$] Def(M ¥OVER N) := Un({k in Za | (k ¥TIMES N) ¥incin M})
Def 24: [Integer Remainder] Def(M ¥MOD N) := M ¥MINUS ((M ¥OVER N) ¥TIMES N)
--
-- The fact that the power set of the null set is the singleton whose sole member is the
-- null set is an elementary consequence of the definition of 'pow'.
--
Theorem 213: [Powerset of the null set] pow(0) = {0}. Proof:
    Suppose_not ==> Stat1: pow(0) /= {0}
    c-->Stat1 ==> ((c in pow(0)) & (c /= 0)) or ((c notin pow(0)) & (c = 0))
    Use_def(pow) ==> ((c in {x: x ¥incin 0}) & (c /= 0)) or ((c notin {x: x ¥incin 0}) & (c = 0))
    Suppose ==> Stat2: (c notin {x: x ¥incin 0}) & (c = 0)
    0-->Stat2 ==> false; Discharge ==> Stat3: (c in {x: x ¥incin 0}) & (c /= 0)
    d-->Stat3 ==> false; Discharge ==> QED
--
-- A set belongs to another if and only if its singleton belongs to the powerset of the other set.
--
Theorem 214: [Membership, singleton, and powerset] (X in L) ¥eq ({X} in pow(L)). Proof:
Suppose_not(x1,y1) ==> AUTO
	Use_def(pow)(*) ==> (x1 in y1) ¥neq ({x1} in {l1: l1 ¥incin y1})
	Suppose ==> Stat1: ({x1} in {l1: l1 ¥incin y1}) & (x1 notin y1)
		(x0)-->Stat1(Stat1*) ==> false
	Discharge ==> Stat2: ({x1} notin {l1: l1 ¥incin y1}) & (x1 in y1)
	({x1})-->Stat2(Stat2*) ==> false
	Discharge ==> QED
--
-- The powerset of a singleton is a doubleton consisting of $0$ and a singleton.
--
Theorem 215: [Singleton and powerset] ({0,X} ¥incin pow(X)) & ((X = {Y}) ¥imp (pow(X) = {0,X})). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def(pow(x0)) ==> AUTO
	Suppose ==> Stat1: {0,x0} ¥nincin {y: y ¥incin x0}
		a-->Stat1(Stat1*) ==> Stat2: (a notin  {y: y ¥incin x0}) & ((a = 0) or (a = x0))
		a-->Stat2(Stat2*) ==> false
	Discharge ==> Stat3: ({y: y ¥incin x0} ¥nincin {0,x0}) & (x0 = {y0})
	b-->Stat3(Stat3*) ==> Stat4: (b in {y: y ¥incin x0}) & (b /= 0) & (b /= {y0})
	c-->Stat4(Stat3*) ==> false
	Discharge ==> QED
--
-- The following elementary lemma just tells us that the two sets entering into the
-- definition of cardinal addition are always disjoint.
--
Theorem 216: [Disjointness of simple Cartesian products] {[x,0]: x in N} * {[x,1]: x in M} = 0. Proof:
    Suppose_not(n,m) ==> Stat1: {[x,0]: x in n} * {[x,1]: x in m} /= 0
    e-->Stat1 ==> Stat2: (e in {[x,0]: x in n}) & (e in {[x,1]: x in m})
    (x,y)-->Stat2 ==> (e = [x,0]) & (e = [y,1])
    T212 ==> 1 /= 0
    Discharge ==> QED
--
-- Next we show that the sum of two cardinalities $#n$, $#m$ can be computed using
-- any pair of disjoint sets of which the first has cardinality $#n$ and the second has cardinality $#m$.
--
Theorem 217: [First Disjoint sum lemma] ((N * M = 0) & (K * J = 0) & (#N = #K) & (#M = #J)) ¥imp
			(#(N + M) = #(K + J)). Proof:
    Suppose_not(n,m,k,j) ==> ((n * m = 0) & (k * j = 0) & (#n = #k) & (#m = #j)) & (#(n + m) /= #(k + j))
      ELEM ==> Stat1: (n * m = 0) & (k * j = 0)
--
-- For supposing the contrary, and noting that there exist 1-1 maps $f$ and $g$ of $n$ to $j$ and $m$ to $k$,
-- we see immediately that $f + g$ is a 1-1 map of $m + n$ onto $j + k$, and so our claim follows using Theorem 88.
--
	(n,k)-->T158 ==> Stat2: (EXISTS f in OM | (one_1_map(f) & (range(f) = n) & (domain(f) = k)))
	f-->Stat2 ==> one_1_map(f) & (range(f) = n) & (domain(f) = k)
	(m,j)-->T158 ==> Stat3: (EXISTS f in OM | (one_1_map(f) & (range(f) = m) & (domain(f) = j)))
	g-->Stat3 ==> one_1_map(g) & (range(g) = m) & (domain(g) = j)
    (f,g)-->T88(Stat1) ==> one_1_map(f + g)
    (f,g)-->T79 ==> range(f + g) = range(f) + range(g)
    (f,g)-->T78 ==> domain(f + g) = domain(f) + domain(g)
--
-- Our result now follows from Theorem 157.
--
   (f + g)-->T157 ==> #domain(f + g) = #range(f + g)
   EQUAL ==> #(domain(f) + domain(g)) = #(range(f) + range(g))
   EQUAL ==> false; Discharge ==> QED
--
-- The following lemma, which simply notes a consequence of the elementary fact
--that  ${[x,a]: x in n}$ and $n$ are in 1-1 correspondence,
-- prepares for the proof of Theorem 221 below.
--
Theorem 218: [Cardinality of Cartesian product by a singleton] (#{[x,A]: x in M} = #M). Proof:
--
-- Since ${[x,[x,a]]: x in m}$ is clearly a 1-1 map, the present lemma is an obvious
-- consequence of Theorem 157.
--
    Suppose_not(a,m) ==> #{[x,a]: x in m} /= #m
	Loc_def ==> f = {[x,[x,a]]: x in m}
    APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(g->f,f(x)->[x,a],s->m) ==> (domain(f) = m) & (range(f) = {[x,a]: x in m})
    	 & (((x in m) & (y in m) & ([x,a] = [y,a]) & (x /= y)) or one_1_map(f))
	ELEM ==> one_1_map(f)
    f-->T157 ==> #domain(f) = #range(f)
    EQUAL ==> false; Discharge ==> QED
--
--
-- The monotonicity of arithmetic addition follows immediately from its definition.
--
Theorem 219: [Monotonicity of arithmetic addition] ((N incs N1) and (M incs M1)) ¥imp (N ¥PLUS M incs N1 ¥PLUS M1). Proof:
    Suppose_not(n,n1,m,m1) ==> AUTO
    Use_def(¥PLUS) ==> (n ¥PLUS m) = #({[x,0]: x in n} + {[x,1]: x in m})
    Use_def(¥PLUS) ==> not (#({[x,0]: x in n} + {[x,1]: x in m}) incs #({[x,0]: x in n1} + {[x,1]: x in m1}))
    ({[x,0]: x in n1} + {[x,1]: x in m1},{[x,0]: x in n} + {[x,1]: x in m})-->T170 ==> not (({[x,0]: x in n} + {[x,1]: x in m}) incs ({[x,0]: x in n1} + {[x,1]: x in m1}))
    Set_monot ==> ({[x,0]: x in n} + {[x,1]: x in m}) incs ({[x,0]: x in n1} + {[x,1]: x in m1})
    Discharge ==> QED
--
-- Next we show that the numerical sum $n ¥PLUS m$ of any two disjoint sets is simply
-- the number of elements in their union.
--
Theorem 220: [Disjoint sum lemma] (N * M = 0) ¥imp (N ¥PLUS M = #(N + M)). Proof:
    Suppose_not(n,m) ==> (n * m = 0) & ((n ¥PLUS m) /= #(n + m))
    Use_def(¥PLUS) ==> #({[x,0]: x in n} + {[x,1]: x in m}) /= #(n + m)
    (0,n)-->T218 ==> #{[x,0]: x in n} = #n
    (1,m)-->T218 ==> #{[x,1]: x in m} = #m
    (n,m)-->T216 ==> {[x,0]: x in n} * {[x,1]: x in m} = 0
    (n,m,{[x,0]: x in n},{[x,1]: x in m})-->T217 ==> false; Discharge ==> QED
--
-- Our next theorem tells us that the sum of two cardinals $i$ and $j$
-- can be calculated using any two sets $n$ and $m$ whose cardinalities are n and m respectively.
--
Theorem 221: [Arithmetic addition lemma] N ¥PLUS M = #N ¥PLUS #M. Proof:
--
-- Supposing that our theorem is false and expanding the definition of '$¥PLUS$' brings us to
-- the cardinal inequality seen just below.
--
    Suppose_not(n,m) ==> n ¥PLUS m /= #n ¥PLUS #m
    Use_def(¥PLUS) ==> #({[x,0]: x in n} + {[x,1]: x in m}) /= #({[x,0]: x in #n} + {[x,1]: x in #m})
--
-- But the pairs of sets appearing in this inequality are evidently disjoint, and
-- have the respective cardinalities $#n$, $#m$, $##n$, $##m$.
--
    T212 ==> Stat1:  1 /= 0
    Suppose ==> Stat2: {[x,0]: x in n} * {[x,1]: x in m} /= 0
    c-->Stat2 ==> c in {[x,0]: x in n} * {[x,1]: x in m}
    ELEM ==> Stat3: (c in {[x,0]: x in n}) & (c in {[x,1]: x in m})
    (d,e)-->Stat3() ==> Stat4: (d in n) & (c = [d,0]) & (e in m) & (c = [e,1])
    (Stat4,Stat1)Discharge ==> {[x,0]: x in n} * {[x,1]: x in m} = 0
    Suppose ==> Stat5: {[x,0]: x in #n} * {[x,1]: x in #m} /= 0
    cc-->Stat5 ==> cc in {[x,0]: x in #n} * {[x,1]: x in #m}
    ELEM ==> Stat6: (cc in {[x,0]: x in #n}) & (cc in {[x,1]: x in #m})
    (dd,ee)-->Stat6() ==> Stat7: (dd in #n) & (cc = [dd,0]) & (ee in #m) & (cc = [ee,1])
    (Stat7,Stat1)Discharge ==> {[x,0]: x in #n} * {[x,1]: x in #m} = 0
    (0,n)-->T218 ==> #{[x,0]: x in n} = #n
    (1,m)-->T218 ==> #{[x,1]: x in m} = #m
    (0,#n)-->T218 ==> #{[x,0]: x in #n} = ##n
    (1,#m)-->T218 ==> #{[x,1]: x in #m} = ##m
--
-- Hence our assertion follows from Theorem 166 and Theorem 217.
--
	n-->T166 ==> #{[x,0]: x in n} = #{[x,0]: x in #n}
	m-->T166 ==> #{[x,1]: x in m} = #{[x,1]: x in #m}
	({[x,0]: x in n},{[x,1]: x in m},{[x,0]: x in #n},{[x,1]: x in #m})-->T217 ==> false; Discharge ==> QED
--
-- It is sometimes convenient to use Theorem 216 in the following variant form:
--
Theorem 222: [Second Disjoint sum lemma] (N * M = 0) ¥imp (#N ¥PLUS #M = #(N + M)). Proof:
    Suppose_not(n,m) ==> (n * m = 0) & ((#n ¥PLUS #m) /= #(n + m))
    (n,m)-->T221 ==> (n ¥PLUS m) /= #(n + m)
    (n,m)-->T220 ==> false; Discharge ==> QED
--
-- The fact that cardinal multiplication of any $n$ by $1 $leaves $n$ unchanged
-- will be derived from the corresponding fact for Cartesian products, as stated
-- in the following theorem.
--
Theorem 223: [Cardinality of Cartesian product by a singleton, 2] #({C} ¥PROD N) = #N. Proof:
    Suppose_not(c,n) ==> #({c} ¥PROD n) /= #n
--
-- Make the contrary hypothesis, and use the definition of '$¥PROD$'.
--
   Use_def(¥PROD) ==> ({c} ¥PROD n) = {[x,y]: x in {c}, y in n}
    SIMPLF ==> ({c} ¥PROD n) = {[c,x]: x in n}
    EQUAL ==> #({c} ¥PROD n) = #{[c,x]: x in n}
--
-- It is easily seen that {[x,[c,x]]: x in n} is a 1-1 map of n to {[c,x]: x in n}
--
    Loc_def ==> f = {[x,[c,x]]: x in n}
    APPLY(x9_thryvar:y,y9_thryvar:wz) fcn_symbol(f(x)->[c,x],g->f,s->n) ==>
		Svm(f) & (domain(f) = n) & (range(f) = {[c,x]: x in n}) &
				(((y in n) & (wz in n) & ([c,y] = [c,wz]) & (y /= wz)) or one_1_map(f))
     ELEM ==> one_1_map(f)
--
-- Thus the present theorem follows immediately from Theorem 157.
--
    f-->T157 ==> #domain(f) = #range(f)
    EQUAL ==> false; Discharge ==> QED
--
-- The following minor variant of Theorem 223 has much the same proof.
--
Theorem 224:  [Cardinality of Cartesian product by a singleton, 3] #(N ¥PROD {C}) = #N. Proof:
    Suppose_not(n,c) ==> #(n ¥PROD {c}) /= #n
--
-- Make the contrary hypothesis, and use the definition of '$¥PROD$'.
--
   Use_def(¥PROD) ==> (n ¥PROD {c}) = {[x,y]: x in n, y in {c}}
    SIMPLF ==> (n ¥PROD {c}) = {[x,c]: x in n}
    EQUAL ==> #(n ¥PROD {c}) = #{[x,c]: x in n}
--
-- It is easily seen that {[x,[x,c]]: x in n} is a 1-1 map of n to {[x,c]: x in n}
--
    Loc_def ==> f = {[x,[x,c]]: x in n}
    APPLY(x9_thryvar:y,y9_thryvar:wz) fcn_symbol(f(x)->[x,c],g->f,s->n) ==>
		Svm(f) & (domain(f) = n) & (range(f) = {[x,c]: x in n}) &
	(((y in n) & (wz in n) & ([y,c] = [wz,c]) & (y /= wz)) or one_1_map(f))
     ELEM ==> one_1_map(f)
--
-- Thus the present theorem follows immediately from Theorem 157.
--
    f-->T157 ==> #domain(f) = #range(f)
    EQUAL ==> #n = #{[x,c]: x in n}
    Discharge ==> QED
--
-- Theorem 222 has the following corollary, which restates the definition of the
-- arithmetic sum in a more 'algebraic' form.
--
Theorem 225:  [Cardinality of a Cartesian product union] (A /= B) ¥imp (#N ¥PLUS #M = #((N ¥PROD {A}) + (M ¥PROD {B}))). Proof:
    Suppose_not(a,b,n,m) ==> (a /= b) & (#n ¥PLUS #m /= #((n ¥PROD {a}) + (m ¥PROD {b})))
    ({a},{b},n,m)-->T143 ==> (n ¥PROD {a}) * (m ¥PROD {b})  = 0
    (n ¥PROD {a},m ¥PROD {b})-->T222 ==> #((n ¥PROD {a}) + (m ¥PROD {b})) = (#(n ¥PROD {a}) ¥PLUS #((m ¥PROD {b})))
    (n,a)-->T224 ==> #(n ¥PROD {a}) = #n
    (m,b)-->T224 ==> #(m ¥PROD {b}) = #m
    EQUAL ==> false; Discharge ==> QED
--
-- The following easy corollaries of Theorem 221 generalize it slightly.
-- The proofs, which use Theorem 168, have an elementary algebraic flavor.
-- We show first that the arithmetic sum of any two sets is the sum of the first
-- and the cardinality of the second.
--
Theorem 226: [Arithmetic addition lemma 2] N ¥PLUS M = N ¥PLUS #M. Proof:
	Suppose_not(n,m) ==> n ¥PLUS m /= n ¥PLUS #m
    (n,m)-->T221 ==> n ¥PLUS m = #n ¥PLUS #m
    (n,#m)-->T221 ==> n ¥PLUS #m = #n ¥PLUS ##m
    m-->T166 ==> ##m = #m
    EQUAL ==> n ¥PLUS #m = #n ¥PLUS #m
    Discharge ==> QED
--
-- Next we show that the arithmetic sum of any two sets is the sum of the second
-- and the cardinality of the first.
--
Theorem 227: [Arithmetic addition lemma 3] N ¥PLUS M = #N ¥PLUS M. Proof:
	Suppose_not(n,m) ==> n ¥PLUS m /= #n ¥PLUS m
    (n,m)-->T221 ==> n ¥PLUS m = #n ¥PLUS #m
    (#n,m)-->T221 ==> #n ¥PLUS m = ##n ¥PLUS #m
    m-->T166 ==> ##n = #n
    EQUAL ==> #n ¥PLUS m = #n ¥PLUS #m
    Discharge ==> QED
--
-- The following 3-set variants of our earlier disjoint sum lemma are useful
-- in proving the associativity of arithmetic addition. We first prove that
-- the arithmetic sum of any three disjoint sets is the cardinality of their union.
--
Theorem 228: [Arithmetic associativity lemma] ((N * M = 0) & (N * K = 0) & (M * K = 0)) ¥imp (((N ¥PLUS M) ¥PLUS K) = #((N + M) + K)). Proof:
    Suppose_not(n,m,k) ==> (n * m = 0) & (n * k = 0) & (m * k = 0) & (((n ¥PLUS m) ¥PLUS k) /= #((n + m) + k))
    (n,m)-->T220 ==> (n ¥PLUS m) = #(n + m)
    EQUAL ==> ((n ¥PLUS m) ¥PLUS k) = ((#(n + m)) ¥PLUS k)
    (n + m,k)-->T227 ==> ((#(n + m)) ¥PLUS k) = ((n + m) ¥PLUS k)
    (n + m,k)-->T220 ==> false; Discharge ==> QED
--
-- The following result also asserts that the arithmetic sum of any three disjoint sets
-- is the cardinality of their union, but now with the arithmetic sum differently associated.
--
Theorem 229: [Arithmetic associativity lemma 2] ((N * M = 0) & (N * K = 0) & (M * K = 0)) ¥imp ((N ¥PLUS (M ¥PLUS K)) = #(N + (M + K))). Proof:
    Suppose_not(n,m,k) ==> (n * m = 0) & (n * k = 0) & (m * k = 0) & ((n ¥PLUS (m ¥PLUS k)) /= #(n + (m + k)))
    (m,k)-->T220 ==> m ¥PLUS k = #(m + k)
    EQUAL ==> (n ¥PLUS (m ¥PLUS k)) = (n ¥PLUS #(m + k))
    (n,m + k)-->T226 ==>  (n ¥PLUS #(m + k)) =  (n ¥PLUS (m + k))
    (n,m + k)-->T220 ==> false; Discharge ==> QED
--
-- Our next theorem tells us that the product of two cardinals $#n$ and $#m$ can also
-- be calculated using any two sets $n$ and $m$ whose cardinalities are $#n$ and $#m$ respectively.
--
Theorem 230: [Arithmetic multiplication lemma] (N ¥TIMES M) = (#N ¥TIMES #M). Proof:
    Suppose_not(n,m) ==> (n ¥TIMES m) /= (#n ¥TIMES #m)
--
-- Supposing that our theorem is false and expanding the definition of '$¥TIMES$' brings us to
-- the cardinal inequality seen just below.
--
    Use_def(¥TIMES) ==> #(n ¥PROD m) /= #(#n ¥PROD #m)
--
-- Theorem 156 tells us that there always exist 1-1 maps of $#n$ onto $n$ and of $#m$ onto $m$.
--
    (n)-->T156 ==> Stat1: Card(#n) & (EXISTS f in OM | one_1_map(f) & (range(f) = n) & (domain(f) = #n))
    (f)-->Stat1 ==> Stat2: one_1_map(f) & (domain(f) = #n) & (range(f) = n)
    (m)-->T156 ==> Stat3: Card(#m) & (EXISTS f in OM | one_1_map(f) & (range(f) = m) & (domain(f) = #m))
    (g)-->Stat3 ==> Stat4: one_1_map(g) & (domain(g) = #m) & (range(g) = m)
    Use_def(one_1_map) ==> Svm(f)
    Use_def(one_1_map) ==> Svm(g)
    Use_def(Svm) ==> Is_map(f)
    Use_def(Svm) ==> Is_map(g)
    Loc_def ==> g1 = g
    Loc_def ==> h = {[x,[f~[car(x)],g1~[cdr(x)]]]: x in {[x,y]: x in #n, y in #m}}
--
-- Now consider the map $h$ defined by ${[x,[f~[car(x)],g~[cdr(x)]]]: x in (#n ¥PROD #m)}$.
-- We will show that this is a 1-1 map of $#n ¥PROD #m$ onto $n ¥PROD m$.
--
     APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(f(x)->[f~[car(x)],g1~[cdr(x)]],g->h,s->{[x,y]: x in #n, y in #m}) ==>
		Svm(h) & (range(h) = {[f~[car(x)],g1~[cdr(x)]]: x in {[x,y]: x in #n, y in #m}}) &
		(domain(h) = {[x,y]: x in #n, y in #m}) &
				(((x in {[x,y]: x in #n, y in #m}) & (y in {[x,y]: x in #n, y in #m}) &
					([f~[car(x)],g1~[cdr(x)]] = [f~[car(y)],g1~[cdr(y)]]) &  (x /= y)) or one_1_map(h))
	EQUAL ==> Stat5: Svm(h) & (range(h) = {[f~[car(x)],g~[cdr(x)]]: x in {[x,y]: x in #n, y in #m}}) &
		(domain(h) = {[x,y]: x in #n, y in #m}) &
				(((x in domain(h)) & (y in domain(h)) &
					([f~[car(x)],g~[cdr(x)]] = [f~[car(y)],g~[cdr(y)]]) &  (x /= y)) or one_1_map(h))
    SIMPLF ==> range(h) = {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m}
    Use_def(¥PROD) ==> #n ¥PROD #m = {[x,y]: x in #n, y in #m}
    ELEM ==> domain(h) = #n ¥PROD #m
--
-- Next we will show that $h$ is 1-1. Indeed, the distinct $x$ and $y$ which appear
-- in the final clause of the conjunction appearing as Stat6 6 above
-- must have the forms $[x1,y1]$ and $[x2,y2]$ respectively, and so either
-- $(x1 /= x2)$ or $(y1 /= y2)$.
--
	Suppose ==> not one_1_map(h)
	ELEM ==> Stat7: x /= y
	ELEM ==> Stat8: x in {[u,y]: u in #n, y in #m}
	(x1,y1)-->Stat8 ==> Stat9: (x = [x1,y1]) & (x1 in #n) & (y1 in #m)
	ELEM ==> Stat10: y in {[u,v]: u in #n, v in #m}
	(x2,y2)-->Stat10 ==> Stat11: (y = [x2,y2]) & (x2 in #n) & (y2 in #m)
	(Stat9,Stat11*)ELEM ==> Stat12: (x = [x1,y1]) & (y = [x2,y2])
	(Stat7,Stat12)ELEM ==> (x1 /= x2) or (y1 /= y2)
--
-- If $x1 /= x2$, then since $f$ is 1-1 it follows that $f(x1) /= f(x2)$, contradicting
-- $[f~[x1],g~[y1]] = [f~[x2],g~[y2]]$. Much the same argument applies if $y1 /= y2$.
-- Thus $[x1,y1] = [x2,y2]$, i.e. $x = y$, implying that $h$ is 1-1.
--
	EQUAL ==> [f~[car(x)],g~[cdr(x)]] = [f~[car([x1,y1])],g~[cdr([x1,y1])]]
	ELEM ==> (car([x1,y1]) = x1) & (cdr([x1,y1]) = y1)
	EQUAL ==> [f~[car(x)],g~[cdr(x)]] = [f~[x1],g~[y1]]
	EQUAL ==> [f~[car(y)],g~[cdr(y)]] = [f~[car([x2,y2])],g~[cdr([x2,y2])]]
	ELEM ==> (car([x2,y2]) = x2) & (cdr([x2,y2]) = y2)
	EQUAL ==> [f~[car(y)],g~[cdr(y)]] = [f~[x2],g~[y2]]
	Use_def(one_1_map) ==> Stat13: (FORALL x in f, y in f | (cdr(x) = cdr(y)) ¥imp (x = y))
	Use_def(one_1_map) ==> Stat14: (FORALL x in g, y in g | (cdr(x) = cdr(y)) ¥imp (x = y))
	(f,x1)-->T77 ==> [x1,f~[x1]] in f
	(f,x2)-->T77 ==> [x2,f~[x2]] in f
	([x1,f~[x1]],[x2,f~[x2]])-->Stat13 ==> (cdr([x1,f~[x1]]) = cdr([x2,f~[x2]])) ¥imp ([x1,f~[x1]] = [x2,f~[x2]])
	ELEM ==> x1 = x2
--
-- Much the same argument applies if $y1 /= y2$.
--
	(g,y1)-->T77 ==> Stat15: [y1,g~[y1]] in g
	(g,y2)-->T77 ==> [y2,g~[y2]] in g
	([y1,g~[y1]],[y2,g~[y2]])-->Stat14(Stat15) ==> (cdr([y1,g~[y1]]) = cdr([y2,g~[y2]])) ¥imp ([y1,g~[y1]] = [y2,g~[y2]])
	ELEM ==> y1 = y2
	EQUAL ==> [x1,y1] = [x2,y2]
	EQUAL ==> x = y
	Discharge ==> one_1_map(h)
--
-- Finally, we show that the range of $h$ is $n ¥PROD m$. First suppose that $range(h)$ is not included
-- in $n ¥PROD m$. Then there exists a $c = [f~[cx1],g~[cy1]]$, with $cx1 in #n$ and $cy1 in #m$,
-- such that $c notin n ¥PROD m$, which is impossible since $f$ and $g$ map $#n$ and $#m$ into $n$ and $m$
-- respectively.
--
	Suppose ==> n ¥PROD m /= {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m}
    Use_def(¥PROD) ==> n ¥PROD m = {[x,y]: x in n, y in m}
	Suppose ==> Stat16: not({[x,y]: x in n, y in m} incs {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m})
	c-->Stat16 ==> Stat17: (c in {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m}) &
			Stat18: (c notin {[x,y]: x in n, y in m})
	(cx1,cy1)-->Stat17 ==> Stat19: (c = [f~[car([cx1,cy1])],g~[cdr([cx1,cy1])]]) &
					(cx1 in #n) & (cy1 in #m)
	(Stat2,Stat4,Stat19)ELEM ==> (cx1 in domain(f)) & (cy1 in domain(g))
	(cx1,f)-->T71 ==> f~[cx1] in n
	(cy1,g)-->T71 ==> g~[cy1] in m
	ELEM ==> car([cx1,cy1]) = cx1
	ELEM ==> cdr([cx1,cy1]) = cy1
	EQUAL ==> c = [f~[cx1],g~[cy1]]
	(f~[cx1],g~[cy1])-->Stat18 ==> not ((f~[cx1] in n) & (g~[cy1] in m) & (c = [f~[cx1],g~[cy1]]))
	Discharge ==>
	Stat20: not({[x,y]: x in n, y in m} ¥incin {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m})
--
-- On the other hand, if $n ¥PROD m$ is not included in $range(h)$,
-- there is an element $d = [dx1,dy1]$ in the first of these two sets but not in the second.
-- but then there exist $ex1 in #n$ and $ey1 in #m$ such that $dx1 = f~[ex1]$ and  $dy1 = g~[ey1]$,
-- so $d$ does belong to the second set.
--
	d-->Stat20 ==> Stat21: (d in {[x,y]: x in n, y in m}) &
			Stat22: (d notin {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m})
	(dx1,dy1)-->Stat21 ==> (dx1 in range(f)) & (dy1 in range(g)) & (d = [dx1,dy1])
	f-->T72 ==> f = {[x,f~[x]]: x in domain(f)}
	g-->T72 ==> g = {[x,g~[x]]: x in domain(g)}
	APPLY(x9_thryvar:x3,y9_thryvar:x4) fcn_symbol(f(x)->g~[x],g->g,s->domain(g)) ==> range(g) = {g~[x]: x in domain(g)}
	APPLY(x9_thryvar:y3,y9_thryvar:y4) fcn_symbol(f(x)->f~[x],g->f,s->domain(f)) ==> range(f) = {f~[x]: x in domain(f)}
	ELEM ==> Stat23: dx1 in {f~[x]: x in domain(f)}
	ELEM ==> Stat24: dy1 in {g~[x]: x in domain(g)}
	ex1-->Stat23 ==> Stat25: (ex1 in #n) & (dx1 = f~[ex1])
	ey1-->Stat24 ==> (ey1 in #m) & (dy1 = g~[ey1])
	(ex1,ey1)-->Stat22 ==> not((ex1 in #n) & (ey1 in #m) &
			(d = [f~[car([ex1,ey1])],g~[cdr([ex1,ey1])]]))
	(Stat23*)ELEM ==> (car([ex1,ey1]) = ex1) & (cdr([ex1,ey1]) = ey1)
	(Stat25*)ELEM ==> d /= [f~[car([ex1,ey1])],g~[cdr([ex1,ey1])]]
	EQUAL ==> d /= [f~[ex1],g~[ey1]]
	EQUAL ==> d = [f~[ex1],g~[ey1]]
	Discharge ==> n ¥PROD m = {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m}
	ELEM ==> n ¥PROD m = range(h)
	h-->T157 ==> #range(h) = #domain(h)
	EQUAL ==> #(n ¥PROD m) = #(#n ¥PROD #m)
--
-- This final contradiction completes the proof of our theorem.
--
    Discharge ==> QED
--
-- The following corollary of Theorem 230 is the 'product' analog of Theorem 226.
-- Its simple proof is algebraic in flavor.
--
Theorem 231: [Arithmetic multiplication lemma 2] N ¥TIMES M = N ¥TIMES #M. Proof:
	Suppose_not(n,m) ==> n ¥TIMES m /= n ¥TIMES #m
    (n,m)-->T230 ==> n ¥TIMES m = #n ¥TIMES #m
    (n,#m)-->T230 ==> n ¥TIMES #m = #n ¥TIMES ##m
    m-->T166 ==> ##m = #m
    EQUAL ==> n ¥TIMES #m = #n ¥TIMES #m
    Discharge ==> QED
--
-- it is also useful to state the following variants of the same fact.
-- The first of these tells us that the arithmetic product of two sets is the same as
-- the arithmetic product of their cardinalities.
--
Theorem 232: [Arithmetic multiplication lemma 3] #(N ¥PROD M) = #(#N ¥PROD #M). Proof:
	Suppose_not(n,m) ==> #(n ¥PROD m) /= #(#n ¥PROD #m)
	Use_def(¥TIMES) ==> #(n ¥PROD m) = n ¥TIMES m
	Use_def(¥TIMES) ==> #(#n ¥PROD #m) = #n ¥TIMES #m
	(n,m)-->T230 ==> false; Discharge ==> QED
--
-- Next we show that the arithmetic product of two sets is the same as
-- the arithmetic product of the first by the cardinality of the second.
--
Theorem 233: [Arithmetic multiplication lemma 4] #(N ¥PROD M) = #(N ¥PROD #M). Proof:
	Suppose_not(n,m) ==> #(n ¥PROD m) /= #(n ¥PROD #m)
	Use_def(¥TIMES) ==> #(n ¥PROD m) = n ¥TIMES m
	Use_def(¥TIMES) ==> #(n ¥PROD #m) = n ¥TIMES #m
	(n,m)-->T231 ==> false; Discharge ==> QED
--
-- The final result in this smalls series show that the arithmetic product of two sets is the same as
-- the arithmetic product of the cardinality of the first by the second.
--
Theorem 234: [Arithmetic multiplication lemma 5] #(N ¥PROD M) = #(#N ¥PROD M). Proof:
	Suppose_not(n,m) ==> #(n ¥PROD m) /= #(#n ¥PROD m)
	(n,m)-->T161 ==> #(m ¥PROD n) /= #(#n ¥PROD m)
	(#n,m)-->T161 ==> #(m ¥PROD n) /= #(m ¥PROD #n)
	(m,n)-->T233 ==> false; Discharge ==> QED
--
-- Next we note that a proper subset of a finite set $n$ has a cardinality which
-- is definitely smaller than that of $n$.
--
Theorem 235: [Strict monotonicity of finite cardinality] (Finite(N) & (M ¥incin N) & (M /= N)) ¥imp (#M in #N). Proof:
    Suppose_not(n,m) ==> Finite(n) & (m ¥incin n) & (m /= n) & (#m notin #n)
--
-- Suppose than $n$ and $m$ constitute a counterexample to our theorem.
-- Since $m ¥incin n$, $#m ¥incin #n$ and since both $#m$ and $#n$ are ordinals
-- it follows by Theorem 170 that $#m = #n$. Thus $m$ and $n$ are in 1-1 correspondence,
-- which is impossible by the definition of finiteness.
--
    n-->T156 ==> Ord(#n)
    m-->T156 ==> Ord(#m)
    (#n,#m)-->T35 ==> #m incs #n
    (m,n)-->T170 ==> #m = #n
    (m,n)-->T158 ==> Stat1: (EXISTS f in OM | one_1_map(f) & (range(f) = m) & (domain(f) = n))
    g-->Stat1 ==> one_1_map(g) & (domain(g) = n) & (range(g) ¥incin n) & (range(g) /= n)
    Use_def(Finite) ==> Stat2: not (EXISTS f in OM | one_1_map(f) & (domain(f) = n) & (range(f) ¥incin n) & (range(f) /= n))
    g-->Stat2 ==> false; Discharge ==> QED
--
-- Using the result just proved, we can give the following variant
-- of the standard theory of transfinite induction.
--
THEORY finite_induction(n,P(x))
    Finite(n) & P(n)
END finite_induction;
--
ENTER_THEORY finite_induction
--
-- We show that if some finite set $n$ has a property $P$, there must exist a subset of $n$
-- which is finite, has property $P$, but has no strict subset also having property $P$.
-- This refines the ordinary principle of induction, which would only tell us that
-- $n$ has an element having property $P$, but itself having no element also having property $P$.
--
Def finite_induction0: [Witness for finite induction argument by subset induction] m1_thryvar :=
	arb({m: m ¥incin n | (P(m) & (FORALL k ¥incin m | ((k /= m) ¥imp (not P(k)))))})
--
Theorem finite_induction1: [Induction principle for finite sets] (m1_thryvar ¥incin n) & P(m1_thryvar) &
			(FORALL k ¥incin m1_thryvar | ((k /= m1_thryvar) ¥imp (not P(k)))). Proof:
--
-- The proof works by applying standard transfinite induction to the cardinality $#m$ of sets $m$
-- having the property $P(m)$. Since by our hypothesis $#n$ is an integer for which there exists a set $y$
-- such that $(#y = #n) & (y ¥incin n) & P(y)$, the standard principle of induction tells us that
-- there must exist a smallest integer $m$ with this property.
--
Suppose_not ==> AUTO
	Assump ==> Finite(n) & P(n)
	n-->T193 ==> Finite(#n)
	n-->T156 ==> Card(#n)
	(#n)-->T206 ==> (#n in Za) & P(n)
	Suppose ==> Stat1: not(EXISTS y | (#y = #n) & (y ¥incin n) & P(y))
		ELEM ==> (#n = #n) & (n ¥incin n) & P(n)
		n-->Stat1(Stat1*) ==> false
	Discharge ==> (#n in Za) & (EXISTS y | (#y = #n) & (y ¥incin n) & P(y))
	Loc_def ==> nn = n
	EQUAL ==> (#n in Za) & (EXISTS y | (#y = #n) & (y ¥incin nn) & P(y))
	APPLY(mt1_thryvar:j) transfinite_induction (n->#n,P(x)->((x in Za) & (EXISTS y | (#y = x) & (y ¥incin nn) & P(y)))) ==>
		(FORALL k | ((j in Za) & (EXISTS y | (#y = j) & (y ¥incin nn) & P(y))) &
			((k in j) ¥imp (not ((k in Za) & (EXISTS y | (#y = k) & (y ¥incin nn) & P(y))))))
	EQUAL ==> Stat2: (FORALL k | ((j in Za) & (EXISTS y | (#y = j) & (y ¥incin n) & P(y))) &
		((k in j) ¥imp (not ((k in Za) & (EXISTS y | (#y = k) & (y ¥incin n) & P(y))))))
	a-->Stat2 ==> (j in Za) & Stat3: (EXISTS y | (#y = j) & (y ¥incin n) & P(y))
	m-->Stat3 ==> Stat4: (#m = j) & (m ¥incin n) & P(m)
	Pred_monot ==> Finite(#m)
	Pred_monot ==> Finite(m)
	m-->T156 ==> Stat5: Ord(#m)
--
-- But now if the set $m$ has any proper subset $k$ such that $P(k)$, then by Theorem 194 $#k$
-- would be less than $#m$. Hence $m$ has the minimality property demanded by the present theorem.
--
	Suppose ==> Stat6: not ((FORALL k ¥incin m | ((k /= m) ¥imp (not P(k)))))
		k-->Stat6 ==> (k ¥incin m) & ((k /= m) & P(k))
		Set_monot ==> #k ¥incin #m
		Pred_monot ==> Finite(#k)
    		(m,k)-->T194 ==> #k /= #m
    		k-->T156 ==> Card(#k) & Ord(#k)
    		(#m,#k)-->T35(Stat5) ==> (#k in #m)
		(#k)-->T206 ==> #k in Za
		(#k)-->Stat2 ==> Stat7: not (EXISTS y | (#y = #k) & (y ¥incin n) & P(y))
		k-->Stat7(Stat4) ==> false
	Discharge ==> Stat8: (FORALL k ¥incin m | ((k /= m) ¥imp (not P(k))))
	Suppose ==> Stat9: {m: m ¥incin n | (P(m) & (FORALL k ¥incin m | ((k /= m) ¥imp (not P(k)))))} = 0
		m-->Stat9(Stat4,Stat8*) ==> false
	Discharge ==> AUTO
	Use_def(m1_thryvar) ==> m1_thryvar = arb({m: m ¥incin n | (P(m) & (FORALL k ¥incin m | ((k /= m) ¥imp (not P(k)))))})
	({m: m ¥incin n | (P(m) & (FORALL k ¥incin m | ((k /= m) ¥imp (not P(k)))))})-->T0(Stat8*) ==>
		Stat10: m1_thryvar in {m ¥incin n | (P(m) & (FORALL k ¥incin m | ((k /= m) ¥imp (not P(k)))))}
	()-->Stat10(*) ==> false
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY finite_induction
--
--THEORY finite_induction(n,P(x))
--    Finite(n) & P(n)
--==>(m1_thryvar)
--    (m1_thryvar ¥incin n) & P(m1_thryvar) & (FORALL k ¥incin m1_thryvar | ((k /= m1_thryvar) ¥imp (not P(k))))
--END finite_induction;
--
--
-- We can use the variant form of induction just derived to prove that the union of two sets is finite
-- if and only if both of the sets are finite.
--
Theorem 236: [The union of finite sets is finite] (Finite(N) & Finite(M)) ¥eq Finite(N + M). Proof:
    Suppose_not(n,m) ==> not((Finite(n) & Finite(m)) ¥eq Finite(n + m))
--
-- For if $n + m$ is finite, so are its subsets $m$ and $n$.
--
    ELEM ==> Finite(n) & Finite(m) & (not Finite(n + m))
--
-- Thus we only need to consider the possibility that $n$ and $m$ are finite, but $n + m$ is not.
-- In this case, we can apply the theory of finite induction developed just above
-- to show that there exists a finite set $nn$ such that $nn + m2$ is infinite, but $n2 + m$ is finite
-- for every proper subset $n2$ of $nn$.
--
    ELEM ==> (EXISTS m | Finite(m) & (not Finite(n + m)))
    APPLY(m1_thryvar:nn) finite_induction(n->n,P(x)->(Finite(x) & (EXISTS m | Finite(m) & (not Finite(x + m))))) ==>
		Finite(nn) & Stat1: (EXISTS m | Finite(m) & (not Finite(nn + m))) &
			Stat2: (FORALL n2 ¥incin nn | ((n2 /= nn) ¥imp
				(not (Finite(n2) & (EXISTS m | Finite(m) & (not Finite(n2 + m)))))))
    m2-->Stat1 ==> Finite(m2) & (not Finite(nn + m2))
--
-- If $nn$ is nonempty, then we can remove one element $c$ from it, getting a proper subset
-- $nn - {c}$ for which $(nn - {c}) + m2$ must therefore be finite. But then $nn + m2$ is also finite by Theorem 199,
-- a contradiction.
--
    Suppose ==> Stat3: nn /= 0
    c-->Stat3 ==> c in nn
    ELEM ==> ((nn - {c}) ¥incin nn) & ((nn - {c}) /= nn) & (nn = (nn - {c}) + {c})
    (nn - {c})-->Stat2 ==> Stat4: (not (EXISTS m | Finite(m) & (not Finite(nn - {c} + m))))
    m2-->Stat4 ==> Finite((nn - {c}) + m2)
--
-- It follows that $nn$ must be empty. But this obviously contradicts the fact that $m2$ is finite,
-- and so concludes the proof of the present theorem.
--
    ((nn - {c}) + m2,c)-->T199 ==> false; Discharge ==> nn = 0
    Discharge ==> QED
--
-- An easy corollary of the preceding theorem is that removal of an initial segment
-- from the set $Za$ yields an infinite set.
--
Theorem 237: [Removal of an initial segment from $Za$ yields an infinite set] (N in Za) ¥imp (not Finite(Za - N)). Proof:
Suppose_not(n) ==> AUTO
--
-- The key observation is that $n in Za$ implies that $n$ is finite;
-- hence, if $Za - n$ could be finite, so would be the superset
-- $(Za - n) + n$ of $Za$.
--
	n-->T206 ==> AUTO
	(Za - n, n)-->T236 ==> false; Discharge ==> QED
--
-- The union-set of a finite set of finite sets is finite:
--
Theorem 238: [The union of finitely many finite sets is finite] ((FORALL x in S | Finite(x)) & Finite(S)) ¥imp Finite(Un(S)). Proof:
--
-- For if there were a counterexample $s$, then by the finite induction principle it would include an
-- inclusion-minimal counterexample $t$.
--
    Suppose_not(s) ==> Stat1: (FORALL x in s | Finite(x)) & Finite(s) & (not(Finite(Un(s))))
	APPLY(m1_thryvar:m) finite_induction(n->s,P(y)->(not(Finite(Un(y))))) ==> Stat2:
		(m ¥incin s) & (not(Finite(Un(m)))) & (FORALL k ¥incin m | ((k /= m) ¥imp Finite(Un(k))))
--
-- Such a counterexample $m$ cannot be $0$, because $Un(0) = 0$, which is finite.
-- Consequently, the union set of $m$  can be decomposed as the
-- disjoint union $Un(m) = arb(m) + Un(m-{arb(m)})$.
--
	m-->T109 ==> Stat3: (Un(0) = 0) & ((m /= 0) ¥imp (Un(m) = (arb(m) + Un(m - {arb(m)}))))
	T188 ==> Stat4: Finite(0)
	Suppose ==> Stat5: m = 0
	EQUAL(Stat5,Stat3,Stat4) ==> Stat6: Finite(Un(m))
	(Stat2,Stat6)Discharge ==> Stat7: m /= 0
--
-- Since $arb(m)$ belongs to $m$, it is finite; moreover, by the minimality of $m$,
-- $Un(m - {arb(m)})$ is also finite.
--
	(Stat3,Stat7,Stat2)ELEM ==> Stat8: (Un(m) = (arb(m) + Un(m - {arb(m)}))) & (arb(m) in s) &
						((m - {arb(m)}) ¥incin m) & ((m - {arb(m)}) /= m)
	(arb(m))-->Stat1(Stat8) ==> Stat9: Finite(arb(m))
	(Stat2)ELEM ==> Stat10: (FORALL k ¥incin m | ((k /= m) ¥imp Finite(Un(k))))
	(m - {arb(m)})-->Stat10 ==> Stat11: Finite(Un(m - {arb(m)}))
	(arb(m),Un(m - {arb(m)}))-->T236(Stat9,Stat11) ==> Stat12: Finite(arb(m) + Un(m - {arb(m)}))
--
-- This implies that $Un(m)$ is finite, giving a contradiction which proves
-- the desired conclusion.
--
    (Stat8,Stat12,Stat2)Discharge ==> QED
--
Theorem 239: [Finite subsets of $Un(S)$ where $S$ is a nonvoid inclusion-chain] ((S /= 0) & (FORALL u in S, v in S | (u incs v) or (v incs u)) & Finite(Y) & (Un(S) incs Y)) ¥imp (EXISTS z in S | z incs Y). Proof:
Suppose_not(s0,y1) ==> Stat1: (FORALL u in s0, v in s0 | (u incs v) or (v incs u)) & Finite(y1) & (Un(s0) incs y1) & (s0 /= 0) & (not(EXISTS z in s0 | z incs y1))
--
-- Arguing by contradiction, let $s0,y0$ be a counterexample, so that
-- $s0$ is a nonvoid inclusion-chain and $y0$ is a finite subset of
-- $Un(s0)$ which is not included in any element of $s0$.
-- Finite induction enables us to assume that $y0$ is
-- inclusion-minimal; i.e., $y0$ has no strict subset $k$
-- which is not included in some $z in s0$.
--
	APPLY(m1_thryvar:y0) finite_induction(n->y1,P(y)->(not(EXISTS z in s0 | z incs y))) ==>
		Stat2: (not(EXISTS z in s0 | z incs y0)) & Stat3: (FORALL k ¥incin y0 | ((k /= y0) ¥imp (not(not(EXISTS z in s0 | z incs k))))) & (y0 ¥incin y1)
--
-- We readily exclude the equality $y0 = 0$ because, if it held, then
-- we would have $arb(s0) in s0$ and $arb(s0) incs y0$, which
-- conflicts with Stat4 Hence $arb(y0) in y0$.
-- Observe that $arb(y0) in z0$ holds for some
-- $z0 in s0$ (for, we have supposed $Un(s0) incs y0$); moreover,
-- $z1 incs y0 - {arb(y0)}$ holds for some $z1 in s0$, in view of
-- the supposed minimality of $y0$ in the counterexample. Both of
-- $z0,z1$ belong to $s0$, and therefore either one must include
-- the other; it is plain that the larger owns $arb(y0)$ as an
-- element and includes $y0 - {arb(y0)}$ as one of its subsets, but
-- then it includes the entire $y0$, which leads us to the sought
-- contradiction.
--
	(arb(s0))-->Stat2(Stat1,Stat1) ==> Stat5: y0 /= 0
	(Stat1,Stat2,Stat5)ELEM ==> arb(y0) in Un(s0)
	Use_def(Un)(Stat6*) ==> Stat7: arb(y0) in {u: v in s0, u in v}
	(z0,u0)-->Stat7(Stat7*) ==> (z0 in s0) & (arb(y0) in z0)
	(Stat5,Stat5)ELEM ==> (y0 incs (y0 - {arb(y0)})) & (y0 /= y0 - {arb(y0)})
	(y0 - {arb(y0)})-->Stat3 ==> Stat8: (EXISTS z in s0 | z incs (y0 - {arb(y0)}))
	z1-->Stat8(Stat8*) ==> (z1 in s0) & (z1 incs (y0 - {arb(y0)}))
	(z0,z1)-->Stat1(Stat7) ==> (z0 incs z1) or (z1 incs z0)
	z0-->Stat2(Stat7*) ==> Stat9: z1 incs z0
	z1-->Stat2(Stat7*) ==> false
    Discharge ==> QED
--
-- =======================================================================================
--
-- Next we prove a variant Theorem 236 which states that the union of two sets is finite
-- if and only if their arithmetic sum is finite.
--
Theorem 240: [An arithmetic sum is finite if its two terms are finite] Finite(N ¥PLUS M) ¥eq Finite(N + M). Proof:
    Suppose_not(n,m) ==> Stat1: not(Finite(n ¥PLUS m) ¥eq Finite(n + m))
--
-- For suppose that $n$, $m$ give a counterexample. By Theorem 193 and Theorem 236 our assertion
-- reduces to the pair of conditions $Finite(n) ¥eq Finite({[x,0]: x in n})$ and $Finite(m) ¥eq Finite({[x,1]: x in m})$.
--
    Use_def(¥PLUS) ==> Finite(n ¥PLUS m) ¥eq Finite(#({[x,0]: x in n} + {[x,1]: x in m}))
    ({[x,0]: x in n} + {[x,1]: x in m})-->T193 ==>
	Finite(#({[x,0]: x in n} + {[x,1]: x in m})) ¥eq (Finite({[x,0]: x in n} + {[x,1]: x in m}))
    ({[x,0]: x in n},{[x,1]: x in m})-->T236 ==>
	Finite({[x,0]: x in n} + {[x,1]: x in m}) ¥eq (Finite({[x,0]: x in n}) & Finite({[x,1]: x in m}))
    (n,m)-->T236(Stat2*) ==> Stat2: Finite(n + m) ¥eq (Finite(n) & Finite(m))
    (Stat1*)ELEM ==> Stat3: not((Finite(n) ¥eq Finite({[x,0]: x in n})) & (Finite(m) ¥eq Finite({[x,1]: x in m})))
	Loc_def ==> f = {[x,car(x)]: x in {[v,0]: v in n}}
--
-- But $n$ and ${[x,0]: x in n}$ are plainly in 1-1 correspondence, and similarly for m.
--
    APPLY(x9_thryvar:a,y9_thryvar:b) fcn_symbol(f(x)->car(x),g->f,s->{[x,0]: x in n}) ==>
		Stat4: Svm(f) & (domain(f) = {[x,0]: x in n}) & (range(f) = {car(x): x in {[v,0]: v in n}}) &
			Stat5: (((a in {[x,0]: x in n}) & (b in {[y,0]: y in n}) & ((car(a) = car(b)) & (a /= b))) or one_1_map(f))
    (aa,bb)--> Stat5(Stat4*) ==> Stat6: ((a = [aa,0]) &
    				(b = [bb,0]) & (car(a) = car(b)) & (a /= b)) or one_1_map(f)
    (Stat6)ELEM ==> Stat7: one_1_map(f)
    Loc_def ==> g = {[x,car(x)]: x in {[x,1]: x in m}}
    APPLY(x9_thryvar:c,y9_thryvar:d) fcn_symbol(f(x)->car(x),g->g,s->{[x,1]: x in m}) ==>
		Stat8: Svm(g) & (domain(g) = {[x,1]: x in m}) & (range(g) = {car(x): x in {[v,1]: v in m}}) &
	 		Stat9: (((c in {[x,1]: x in m}) & (d in {[y,1]: y in m}) & (car(c) = car(d)) & (c /= d)) or one_1_map(g))
    (cc,dd)--> Stat9(Stat8*) ==> Stat10: ((c = [cc,1]) &
				(d  = [dd,1]) & (car(c) = car(d)) & (c /= d)) or one_1_map(g)
    (Stat10)ELEM ==> Stat11: one_1_map(g)
    SIMPLF ==> {car(x): x in {[v,0]: v in n}} = {car([v,0]): v in n}
    Set_monot ==> {car([v,0]): v in n} = {v: v in n}
    SIMPLF ==> {v: v in n} = n
    ELEM ==> Stat12: range(f) = n
    SIMPLF ==> {car(x): x in {[v,1]: v in m}} = {car([v,1]): v in m}
    Set_monot ==> {car([v,1]): v in m} = {v: v in m}
    SIMPLF(Stat13) ==> Stat13: {v: v in m} = m
    ELEM ==> range(g) = m
    f-->T191(Stat7*) ==> Stat14: Finite(range(f)) ¥eq Finite(domain(f))
--
-- From which our assertion is obvious.
--
    EQUAL(Stat4,Stat12,Stat14) ==> Stat15: Finite(n) ¥eq Finite({[x,0]: x in n})
    g-->T191(Stat11*) ==> Finite(range(g)) ¥eq Finite(domain(g))
    EQUAL(Stat8) ==> Stat16: Finite(m) ¥eq Finite({[x,1]: x in m})
    (Stat3,Stat15,Stat16)Discharge ==> QED
--
-- It follows as a corollary of the preceding theorem that the arithmetic sum of two sets is finite
-- if and only if both of the sets are finite.
--
Theorem 241: [An arithmetic sum is finite if and only if both its terms are finite] (Finite(N) & Finite(M)) ¥eq Finite(N ¥PLUS M). Proof:
	Suppose_not(n,m) ==> not((Finite(n) & Finite(m)) ¥eq Finite(n ¥PLUS m))
    (n,m)-->T240 ==> Finite(n ¥PLUS m) ¥eq Finite(n + m)
    (n,m)-->T236 ==> false; Discharge ==> QED
--
Theorem 242: [acyclicity of the closure of membership] X notin Ult_membs(X). Proof:
Suppose_not(x) ==> AUTO
	APPLY(mt2_thryvar:m) transfinite_member_induction(n->x,P(x)->(x in Ult_membs(x))) ==>
		Stat1: (FORALL k | (m in Ult_membs(m)) & (m in Ult_membs({x})) & ((k in m) ¥imp (not (k in Ult_membs(k)))))
	0-->Stat1(Stat1*) ==> Stat2: m in Ult_membs(m)
	m-->T15(Stat1,Stat1*) ==> Ult_membs(m) = m + {v: k in m, v in Ult_membs(k)}
	(Stat2*)ELEM ==> Stat3: m in {v: k in m, v in Ult_membs(k)}
	(k,v)-->Stat3(Stat3*) ==> Stat4: (k in m) & (m in Ult_membs(k))
	(m,k)-->T22(Stat4*) ==> Ult_membs(m) ¥incin Ult_membs(k)
	Use_def(Ult_membs)(Stat4*) ==> Ult_membs(m) = (m + {y: u in {Ult_membs(x): x in m}, y in u})
	(Stat4*)ELEM ==> Stat5: k in Ult_membs(k)
k-->Stat1(Stat4,Stat5*) ==> false; Discharge ==> QED
--
--Theorem OM: [one-one-ness of $Ult_membs$] (Ult_membs(X) = Ult_membs(Y)) ¥imp (X = Y). Proof:
--Suppose_not(x,y) ==> AUTO
--Tsomehow ==> false; Discharge ==> QED
--
--
Theorem 243: [acyclicity of the closure of membership] ((X in Ult_membs({Y})) & (Y in Ult_membs({X}))) ¥imp (X = Y). Proof:
Suppose_not(x,y) ==> AUTO
--
-- (i) Suppose_not. Then $x /= y$. By Theorem 18,
--	$Ult_membs({y}) = {y} + Ult_membs(y)$,
--     so $x in Ult_membs(y)$, and similarly $y in Ult_membs(x)$.
--
	y-->T18 ==> Stat1: (x /= y) & (x in Ult_membs({y})) & (Ult_membs({y}) = ({y} + Ult_membs(y)))
	(Stat1*)ELEM ==> Stat2: x in Ult_membs(y)
	x-->T18 ==> Stat3: (y /= x) & (y in Ult_membs({x})) & (Ult_membs({x}) = ({x} + Ult_membs(x)))
	(Stat3*)ELEM ==> Stat4: y in Ult_membs(x)
--
-- (ii) By T22 $Ult_membs(y) ¥incin Ult_membs(x)$, so $x in Ult_membs(x)$,
--      and everything comes down to showing that this last is impossible.
--
	(y,x)-->T22(Stat4,Stat2*) ==> Stat5: x in Ult_membs(x)
--
-- (iii) Supposing the contrary, consider
--		$t = {a in Ult_membs({x}) | a in Ult_membs(a)}$.
--       Plainly $x in t$ so $t$ is not null and we can consider
--       (the rabbit!) $u = arb(t)$. Plainly $u in Ult_membs(u)$ and
--       $u in Ult_membs({x})$. By Theorem 15
--		$Ult_membs(u) = u + {v: w in u, v in Ult_membs(w)}$,
--       and since $u in u$ is impossible there must exist a $w in u$
--       such that $u in Ult_membs(w)$. But then $w in Ult_membs(w)$,
--       and since $w in Ult_membs(x)$ this contradicts the minimality
--       of $u$ (as a member of $t$) and proves our theorem.
--
x-->T242(Stat5*) ==> false; Discharge ==> QED
--
Theorem 244: [existence of an $in$-maximal set in any finite set] (EXISTS v | Finite(F) ¥imp (((F = 0) or (v in F)) & ({y in (F-{v}) | v in Ult_membs({y})} = 0))). Proof:
Suppose_not(f0) ==> Stat1: not(EXISTS v | Finite(f0) ¥imp (((f0 = 0) or (v in f0)) & ({y in (f0-{v}) | v in Ult_membs({y})} = 0)))
	Suppose ==> not(Finite(f0))
	0-->Stat1(Stat1*) ==> false; Discharge ==> Finite(f0)
	APPLY(m1_thryvar:f) finite_induction(n->f0,P(x)->(not(EXISTS v | Finite(x) ¥imp (((x = 0) or (v in x)) & ({y in (x-{v}) | v in Ult_membs({y})} = 0))))) ==>
		Stat2: (not(EXISTS v | Finite(f) ¥imp (((f = 0) or (v in f)) & ({y in (f-{v}) | v in Ult_membs({y})} = 0)))) &
		Stat3: (FORALL k ¥incin f | (k /= f) ¥imp (not(not(EXISTS v | Finite(k) ¥imp (((k = 0) or (v in k)) & ({y in (k-{v}) | v in Ult_membs({y})} = 0))))))
	Suppose ==> (not(Finite(f))) or (f = 0)
		0-->Stat2(Stat2*) ==> Stat4: ((f-{0}) = 0) & ({y in (f-{0}) | 0 in Ult_membs({y})} /= 0)
		EQUAL(Stat4*) ==> Stat5: {y in 0 | 0 in Ult_membs({y})} /= 0
	y0-->Stat5(Stat5*) ==> false; Discharge ==> Stat6: Finite(f) & (f /= 0)
	(f-{arb(f)})-->Stat3(Stat6) ==> Stat7: (EXISTS v | Finite(f-{arb(f)}) ¥imp ((((f-{arb(f)}) = 0) or (v in (f-{arb(f)}))) & ({y in ((f-{arb(f)})-{v}) | v in Ult_membs({y})} = 0)))
	(f,f-{arb(f)})-->T189(Stat6*) ==> Finite(f-{arb(f)})
	v0-->Stat7(Stat7*) ==> Stat8: (((f-{arb(f)}) = 0) or (v0 in (f-{arb(f)}))) & ({y in ((f-{arb(f)})-{v0}) | v0 in Ult_membs({y})} = 0)
	Suppose ==> Stat9: (f-{arb(f)}) = 0
		(Stat6,Stat9)ELEM ==> Stat10: f = {arb(f)}
		(arb(f))-->Stat2(Stat6,Stat10*) ==> Stat11: {y in (f-{arb(f)}) | arb(f) in Ult_membs({y})} /= 0
	y1-->Stat11(Stat9*) ==> false; Discharge ==> Stat12: (f-{arb(f)}) /= 0
	v0-->Stat2(Stat6,Stat8,Stat12*) ==> Stat13: {y in (f-{v0}) | v0 in Ult_membs({y})} /= 0
	v1-->Stat13(Stat13*) ==> Stat14: (v1 in (f-{v0})) & (v0 in Ult_membs({v1}))
	v1-->T18(Stat14*) ==> Stat15: v0 in Ult_membs(v1)
	Suppose ==> v1 /= arb(f)
		(Stat8*)ELEM ==> (v1 in ((f-{arb(f)})-{v0})) & Stat16: (v1 notin {y in ((f-{arb(f)})-{v0}) | v0 in Ult_membs({y})})
	v1-->Stat16(Stat14*) ==> false; Discharge ==>  Stat17: v1 = arb(f)
	v1-->Stat2(Stat6,Stat12,Stat17) ==> Stat18: {y in (f-{v1}) | v1 in Ult_membs({y})} /= 0
	v2-->Stat18(Stat18*) ==> Stat19: (v2 in (f-{v1})) & (v1 in Ult_membs({v2}))
	(v1,{v2})-->T22(Stat19,Stat15*) ==> v0 in Ult_membs({v2})
	(Stat8*)ELEM ==> Stat20: v2 notin {y in ((f-{arb(f)})-{v0}) | v0 in Ult_membs({y})}
	()-->Stat20(Stat14*) ==> (v2 = v0) & (v0 /= v1)
	EQUAL(Stat14*) ==> (v0 in Ult_membs({v1})) & (v1 in Ult_membs({v0}))
(v0,v1)-->T243(Stat20*) ==> false; Discharge ==> QED
--
-- The next two results, both trivial corollaries of Theorem 139,
-- state that an arithmetic product is zero if either of its factors is zero.
--
Theorem 245: [Anything times 0 is 0] (N ¥TIMES 0) = 0. Proof:
	Suppose_not(n) ==> (n ¥TIMES 0) /= 0
    Use_def(¥TIMES) ==> (n ¥TIMES 0) = #(n ¥PROD 0)
    n-->T139 ==> (n ¥PROD 0) = 0
    EQUAL ==> (n ¥TIMES 0) = #0
    0-->T162 ==> false; Discharge ==> QED
--
Theorem 246: [0 times anything is 0] (0 ¥TIMES N) = 0. Proof:
	Suppose_not(n) ==> (0 ¥TIMES n) /= 0
    Use_def(¥TIMES) ==> (0 ¥TIMES n) = #(0 ¥PROD n)
    n-->T139 ==> (0 ¥PROD n) = 0
    EQUAL ==> (0 ¥TIMES n) = #0
    0-->T162 ==> false; Discharge ==> QED
--
-- It is also trivial to show that arithmetic addition of $0$ to any $n$ leaves n unchanged.
--
Theorem 247: [0 is a right additive identity] (#N ¥PLUS 0) = #N. Proof:
	Suppose_not(n) ==> (#n ¥PLUS 0) /= #n
    Use_def(¥PLUS) ==> (#n ¥PLUS 0) = #({[x,0]: x in #n} + {[x,1]: x in 0})
    Set_monot ==> {[x,1]: x in 0} = {x: x in 0}
    SIMPLF ==> {[x,1]: x in 0} = 0
    ELEM ==> {[x,0]: x in #n} + {[x,1]: x in 0} = {[x,0]: x in #n}
    EQUAL ==> (#n ¥PLUS 0) = #{[x,0]: x in #n}
    (0,#n)-->T218 ==> #{[x,0]: x in #n} = ##n
    n-->T166 ==> false; Discharge ==> QED
--
-- The two following results simply translate Theorem 223 into
-- a statement concerning integer multiplication.
--
Theorem 248: [1 is a left multiplicative identity] (1 ¥TIMES N) = #N. Proof:
    Suppose_not(n) ==> (1 ¥TIMES n) /= #n
    Use_def(¥TIMES) ==> (1 ¥TIMES n) = #(1 ¥PROD n)
    Use_def(1) ==> 1 = next(0)
    Use_def(next) ==> 1 = 0 + {0}
    ELEM ==> 1 = {0}
    EQUAL ==> #n /= #({0} ¥PROD n)
    (0,n)-->T223 ==> false; Discharge ==> QED
--
Theorem 249: [1 is a right multiplicative identity] (N ¥TIMES 1) = #N. Proof:
    Suppose_not(n) ==> (n ¥TIMES 1) /= #n
    Use_def(¥TIMES) ==> (n ¥TIMES 1) = #(n ¥PROD 1)
    Use_def(1) ==> 1 = next(0)
    Use_def(next) ==> 1 = 0 + {0}
    ELEM ==> 1 = {0}
    EQUAL ==> #n /= #(n ¥PROD {0})
    (n,0)-->T224 ==> false; Discharge ==> QED
--
-- Next we state and prove a result valid not only in integer but in cardinal arithmetic:
-- the product of $n$ and $m$ is no smaller than $n$ if the cardinal $m$ is non-zero.
--
Theorem 250: [Monotonicity of multiplication] (M /= 0) ¥imp (#(N ¥PROD M) incs #N). Proof:
    Suppose_not(m,n) ==> Stat1: (m /= 0) & (not #(n ¥PROD m) incs #n)
--
-- For suppose that m and n are a counterexample to our assertion, and let d belong to m.
-- Consider the single-valued map f defined by f = {[x,car(x)]: x in {[y,d]: y in n}},
-- whose range is easily seen to be n, while its domain is plainly a subset of n ¥PROD m.
--
    d-->Stat1 ==> (d in m) & ({d} ¥incin m)
    Loc_def ==> f = {[x,car(x)]: x in {[y,d]: y in n}}
    APPLY() fcn_symbol(f(x)->car(x),g->f,s->{[y,d]: y in n}) ==>
		Svm(f) & (domain(f) = {[y,d]: y in n}) & (range(f) = {car(x): x in {[y,d]: y in n}})
    SIMPLF ==> range(f) = {car([y,d]): y in n}
    Set_monot ==> {car([y,d]): y in n} = {y: y in n}
    ELEM ==> range(f) = {y: y in n}
    SIMPLF ==> range(f) = n
    EQUAL ==> Stat2: #range(f) = #n
    SIMPLF ==> {[y,d]: y in n} = {[y,z]: y in n, z in {d}}
    Set_monot ==> {[y,z]: y in n, z in {d}} ¥incin {[y,z]: y in n, z in m}
    Use_def(¥PROD) ==> domain(f) ¥incin (n ¥PROD m)
--
-- It follows by Theorem 170 and Theorem 171 that the cardinality of the domain of $f$ is no more than that of
-- $n ¥PROD m$, while the cardinality of $range(f)$ is no more than that of $domain(f)$.
--
    (domain(f),n ¥PROD m)-->T170 ==> Stat3: #domain(f) ¥incin #(n ¥PROD m)
    (f)-->T171 ==> Stat4: #range(f) ¥incin #domain(f)
    (Stat1,Stat3,Stat4,Stat2*)Discharge ==> QED
--
-- The following elementary lemma prepares for the proof of the
-- commutative law for cardinal addition.
--
Theorem 251: [Distributivity lemma] (A /= B) ¥imp (N ¥PLUS M = #((N ¥PROD {A}) + (M ¥PROD {B}))). Proof:
    Suppose_not(a,b,n,m) ==> (a /= b) & (n ¥PLUS m /= #((n ¥PROD {a}) + (m ¥PROD {b})))
--
-- For supposing the contrary we can derive a contradiction
-- using Theorem 221, Theorem 143, Theorem 220, Theorem 221, and Theorem 224 in the following order:
--
    (n,m)-->T221 ==> n ¥PLUS m = #n ¥PLUS #m
    ({a},{b},n,m)-->T143 ==> (n ¥PROD {a}) * (m ¥PROD {b}) = 0
    (n ¥PROD {a},m ¥PROD {b})-->T220 ==> (n ¥PROD {a}) ¥PLUS (m ¥PROD {b}) = #((n ¥PROD {a}) + (m ¥PROD {b}))
    (n ¥PROD {a},m ¥PROD {b})-->T221 ==> (n ¥PROD {a}) ¥PLUS (m ¥PROD {b}) = #(n ¥PROD {a}) ¥PLUS #(m ¥PROD {b})
    ELEM ==> #(n ¥PROD {a}) ¥PLUS #(m ¥PROD {b}) = #((n ¥PROD {a}) + (m ¥PROD {b}))
    (n,a)-->T224 ==> #(n ¥PROD {a}) = #n
    (m,b)-->T224 ==> #(m ¥PROD {b}) = #m
    EQUAL ==> #n ¥PLUS #m = #((n ¥PROD {a}) + (m ¥PROD {b}))
    Discharge ==> QED
--
-- Next we prove the commutative laws for cardinal arithmetic.
-- For addition the proof results almost immediately from Theorem 251.
--
Theorem 252: [Commutative law for addition] (N ¥PLUS M) = (M ¥PLUS N). Proof:
    Suppose_not(n,m) ==> (n ¥PLUS m) /= (m ¥PLUS n)
    T212 ==> 1 /= 0
    (0,1,n,m)-->T251 ==> (n ¥PLUS m) = #((n ¥PROD {0}) + (m ¥PROD {1}))
    (1,0,m,n)-->T251 ==> (m ¥PLUS n) = #((m ¥PROD {1}) + (n ¥PROD {0}))
	ELEM ==> (n ¥PROD {0}) + (m ¥PROD {1}) = (m ¥PROD {1}) + (n ¥PROD {0})
    EQUAL ==> false; Discharge ==> QED
--
-- The commutative law for cardinal multiplication is
-- an equally elementary consequence of Theorem 251.
--
Theorem 253: [Commutative law for multiplication] N ¥TIMES M = M ¥TIMES N. Proof:
    Suppose_not(n,m) ==> n ¥TIMES m /= m ¥TIMES n
    Use_def(¥TIMES) ==> #(n ¥PROD m) /= #(m ¥PROD n)
    (n,m)-->T161 ==> false; Discharge ==> QED
--
-- We can now slightly generalize Theorem 247 by stating that 0 is a bilateral identity.
--
Theorem 254: [0 is bilateral additive identity] (X in Za) ¥imp (((X ¥PLUS 0) = X) & ((0 ¥PLUS X) = X)). Proof+:
    Suppose_not(x) ==> AUTO
        Suppose ==> (x ¥PLUS 0) /= x
            x-->T164 ==> x = #x
            EQUAL ==> ((#x) ¥PLUS 0) /= #x
        x-->T247 ==> false; Discharge ==> ((x ¥PLUS 0) = x) & ((0 ¥PLUS x) /= x)
        (x,0)-->T252 ==> (x ¥PLUS 0) = (0 ¥PLUS x)
    Discharge ==> QED
--
-- The following lemma states several facts which can be regarded as modified
-- 'distributive laws' for the Cartesian product.
--
Theorem 255: [Rules for intersection and union of Cartesian products] ((A ¥PROD X) * (B ¥PROD X) = (A * B) ¥PROD X) & ((A ¥PROD X) + (B ¥PROD X) = (A + B) ¥PROD X) &
	(((X ¥PROD A) * (X ¥PROD B)) = X ¥PROD (A * B)) & (((X ¥PROD A) + (X ¥PROD B)) = X ¥PROD (A + B)). Proof:
--
-- For suppose the contrary, and let a, b, and c be a counterexample to one of the four clauses of our theorem.
--
    Suppose_not(a,c,b) ==> ((a ¥PROD c) * (b ¥PROD c) /= ((a * b) ¥PROD c) or (a ¥PROD c) + (b ¥PROD c) /= ((a + b) ¥PROD c) or
	((c ¥PROD a) * (c ¥PROD b)) /= (c ¥PROD (a * b)) or ((c ¥PROD a) + (c ¥PROD b)) /= c ¥PROD (a + b))
--
-- Use of the definition of the cartesian product and of its evident additivity in both its arguments
-- tells us that neither the second or the fourth clause of our theorem can be violated.
--
    Suppose ==> ((a ¥PROD c) + (b ¥PROD c)) /= ((a + b) ¥PROD c)
    Use_def(¥PROD) ==> {[x,y]: x in a, y in c} + {[x,y]: x in b, y in c} /= {[x,y]: x in a + b, y in c}
    Set_monot ==> {[x,y]: x in a, y in c} + {[x,y]: x in b, y in c} = {[x,y]: x in a + b, y in c}
    Discharge ==> (a ¥PROD c) + (b ¥PROD c) = ((a + b) ¥PROD c)
    Suppose ==> ((c ¥PROD a) + (c ¥PROD b)) /= c ¥PROD (a + b)
    Use_def(¥PROD) ==> {[x,y]: x in c, y in a} + {[x,y]: x in c, y in b} /= {[x,y]: x in c, y in a + b}
    Set_monot ==> {[x,y]: x in c, y in a} + {[x,y]: x in c, y in b} = {[x,y]: x in c, y in a + b}
    Discharge ==> ((c ¥PROD a) + (c ¥PROD b)) = c ¥PROD (a + b)
--
-- Next suppose that the second clause of the theorem is violated. Using the definition of Cartesian product,
-- we see that there must exist an element $d$ which belongs to one of the two sets
--
--			${[x,y]: x in a, y in c} * {[x,y]: x in b, y in c}$	and		${[x,y]: x in a * b, y in c}$
--
-- but not the other. But if $d$ is in the first of these two sets but not the second we are led to the
-- elementary contradiction seen below.
--
    Suppose ==> (a ¥PROD c) * (b ¥PROD c) /= (a * b) ¥PROD c
    Use_def(¥PROD) ==> Stat1: {[x,y]: x in a, y in c} * {[x,y]: x in b, y in c} /= {[x,y]: x in a * b, y in c}
    d-->Stat1 ==>
	((not((d in {[x,y]: x in a, y in c}) & (d in {[x,y]: x in b, y in c})) & (d in {[x,y]: x in a * b, y in c})) or
	((d in {[x,y]: x in a, y in c}) & (d in {[x,y]: x in b, y in c}) & (d notin {[x,y]: x in a * b, y in c})))
 Suppose ==>
    Stat2: ((d in {[x,y]: x in a, y in c}) & (d in {[x,y]: x in b, y in c})) & Stat3: (d notin {[x,y]: x in a * b, y in c})
    (a1,c1,b1,c2)-->Stat2 ==> Stat4: (d = [a1,c1]) & (a1 in a) & (c1 in c) & (d = [b1,c2]) & (b1 in b) & (c2 in c)
    (Stat4)ELEM ==> a1 in a * b
    (a1,c1)-->Stat3 ==> not(d = [a1,c1]) & (a1 in a * b) & (c1 in c)
--
-- Thus $d$ must be in the second of the two sets displayed above, but not the first. However, this assertion
-- is in evident contradiction with the monotone dependence of the cartesian product on its arguments.
-- This shows that it is only the fourth clause of our theorem that could be false.
--
    Discharge ==> not((d in {[x,y]: x in a, y in c}) & (d in {[x,y]: x in b, y in c})) & (d in {[x,y]: x in a * b, y in c})
    Set_monot ==> {[x,y]: x in a * b, y in c} ¥incin {[x,y]: x in a, y in c}
    Set_monot ==> {[x,y]: x in a * b, y in c} ¥incin {[x,y]: x in b, y in c}
    Discharge ==> ((c ¥PROD a) * (c ¥PROD b)) /= (c ¥PROD (a * b))
--
-- But an argument almost identical to that just given can be used to rule out this last possibility.
-- For, using the definition of Cartesian product,
-- we see that there must exist an element $d2$ which belongs to one of the two sets seen just below, but not the other.
--
    Use_def(¥PROD) ==> Stat5: {[x,y]: x in c, y in a} * {[x,y]: x in c, y in b} /= {[x,y]: x in c, y in a * b}
    d2-->Stat5 ==>
	(((not((d2 in {[x,y]: x in c, y in a}) & (d2 in {[x,y]: x in c, y in b}))) & (d2 in {[x,y]: x in c, y in a * b})) or
	((d2 in {[x,y]: x in c, y in a}) & (d2 in {[x,y]: x in c, y in b}) & (d2 notin {[x,y]: x in c, y in a * b})))
--
-- If $d2$ is in the first of these two sets but not the second we are led to the
-- elementary contradiction seen below.
--
 Suppose ==>
    Stat6: (d2 in {[x,y]: x in c, y in a}) & (d2 in {[x,y]: x in c, y in b}) & Stat7: (d2 notin {[x,y]: x in c, y in a * b})
    (a21,c21,b21,c22)-->Stat6 ==> (d2 = [a21,c21]) & (a21 in c) & (c21 in a) & (d2 = [b21,c22]) & (b21 in c) & (c22 in b)
    ELEM ==> c21 in a * b
    (a21,c21)-->Stat7 ==> (not(d2 = [a21,c21])) & (a21 in c) & (c21 in a * b)
--
-- Thus $d2$ must be in the second of the two sets seen just above, but not the first. However, this assertion
-- is in contradiction with the monotone dependence of the cartesian product on its arguments.
-- This shows that none of the clauses of our theorem can be false, which is what we wanted to prove.
--
    Discharge ==> ((not((d2 in {[x,y]: x in c, y in a}) & (d2 in {[x,y]: x in c, y in b}))) & (d2 in {[x,y]: x in c, y in a * b}))
    Set_monot ==> {[x,y]: x in c, y in a * b} ¥incin {[x,y]: x in c, y in a}
    Set_monot ==> {[x,y]: x in c, y in a * b} ¥incin {[x,y]: x in c, y in b}
    Discharge ==> QED
--
-- The following 'monotonicity' consequence of Theorem 255 is often useful.
--
Theorem 256: [Cartesian product monotonicity] ((A ¥incin B) & (C ¥incin D)) ¥imp ((A ¥PROD C) ¥incin (B ¥PROD D)). Proof:
	Suppose_not(a,b,c,d) ==> (a ¥incin b) & (c ¥incin d) & (not ((a ¥PROD c) ¥incin (b ¥PROD d)))
--
-- For the proof we have only to use Theore 203 twice and the use the transitivity of inclusion.
--
	(c,a,d)-->T255 ==> (a ¥PROD c) * (a ¥PROD d) = (a ¥PROD (c * d))
	(a,d,b)-->T255 ==> (a ¥PROD d) * (b ¥PROD d) = ((a * b) ¥PROD d)
	ELEM ==> (c * d = c) & (a * b = a)
	EQUAL ==> ((a ¥PROD c) * (a ¥PROD d) = (a ¥PROD c)) & ((a ¥PROD d) * (b ¥PROD d) = (a ¥PROD d))
	Discharge ==> QED
--
-- Sometimes one needs the following generalization of Theorem 255.
--
Theorem 257: [Intersection of Cartesian products] ((A ¥PROD C) * (B ¥PROD D) = (A * B) ¥PROD (C * D)). Proof:
    Suppose_not(a,c,b,d) ==> (a ¥PROD c) * (b ¥PROD d) /= (a * b) ¥PROD (c * d)
--
-- For suppose that $a$, $c$, $b$, $d$ form a counterexample to our assertion.
--
    (a * b,a,c * d,c)-->T256 ==> ((a * b) ¥PROD (c * d)) ¥incin (a ¥PROD c)
    (a * b,b,c * d,d)-->T256 ==>((a * b) ¥PROD (c * d)) ¥incin (b ¥PROD d)
    ELEM ==> Stat1: not(((a * b) ¥PROD (c * d)) incs ((a ¥PROD c) * (b ¥PROD d)))
    u-->Stat1 ==> (u in (a ¥PROD c)) & (u in (b ¥PROD d)) & (u notin ((a * b) ¥PROD (c * d)))
    Use_def(¥PROD) ==> Stat2: (u in {[x,y]: x in a,y in c}) & (u in {[x,y]: x in b,y in d}) &
    							Stat3: (u notin {[x,y]: x in a * b,y in c * d})
    (x1,y1,x2,y2)-->Stat2 ==> (x1 in a) & (y1 in c) & (u = [x1,y1]) & (x2 in b) & (y2 in d) & (u = [x2,y2])
    ELEM ==> (x1 in b) & (y1 in d)
    (x1,y1)-->Stat3 ==> false; Discharge ==> QED
--
-- Next we prove the associative law, first for cardinal addition, then for cardinal multiplication.
--
Theorem 258: [Associativity of arithmetic addition] N ¥PLUS (M ¥PLUS K) = (N ¥PLUS M) ¥PLUS K. Proof:
    Suppose_not(n,m,k) ==> n ¥PLUS (m ¥PLUS k) /= (n ¥PLUS m) ¥PLUS k
--
-- For let $n$, $m$, and $k$ be a counterexample to our assertion. It is clear that the sets
-- $n ¥PROD {0}$, $m ¥PROD {1}$, and $k ¥PROD {2}$ are all disjoint, so that by Theorem 228 the sums
-- $((m ¥PROD {1}) ¥PLUS (k ¥PROD {2})) ¥PLUS (n ¥PROD {0})$ and $((n ¥PROD {0}) + (m ¥PROD {1})) + (k ¥PROD {2})$
-- can both be written as the cardinality of their union and so are equal.
--
	T212 ==> Stat1: (1 /= 0) & (2 /= 0) & (1 /= 2)
	ELEM ==> Stat2: ({1} * {0} = 0) & ({2} * {0} = 0) & ({1} * {2} = 0)
	({0},{1},n,m)-->T143 ==> (n ¥PROD {0}) * (m ¥PROD {1}) = 0
	({1},{2},m,k)-->T143 ==> (m ¥PROD {1}) * (k ¥PROD {2}) = 0
	({0},{2},n,k)-->T143 ==> (n ¥PROD {0}) * (k ¥PROD {2}) = 0
	(n ¥PROD {0},m ¥PROD {1},k ¥PROD {2})-->T228 ==>
	((n ¥PROD {0}) ¥PLUS (m ¥PROD {1})) ¥PLUS (k ¥PROD {2}) = #(((n ¥PROD {0}) + (m ¥PROD {1})) + (k ¥PROD {2}))
	(m ¥PROD {1},k ¥PROD {2},n ¥PROD {0})-->T228 ==>
	((m ¥PROD {1}) ¥PLUS (k ¥PROD {2})) ¥PLUS (n ¥PROD {0})  = #(((m ¥PROD {1}) + (k ¥PROD {2})) + (n ¥PROD {0}))
	(Stat1,Stat2*)ELEM ==>
	((m ¥PROD {1}) + (k ¥PROD {2})) + (n ¥PROD {0}) = ((n ¥PROD {0}) + (m ¥PROD {1})) + (k ¥PROD {2})
	EQUAL ==> #(((m ¥PROD {1}) + (k ¥PROD {2})) + (n ¥PROD {0})) = #(((n ¥PROD {0}) + (m ¥PROD {1})) + (k ¥PROD {2}))
	((m ¥PROD {1}) ¥PLUS (k ¥PROD {2}),n ¥PROD {0})-->T252 ==>
	((m ¥PROD {1}) ¥PLUS (k ¥PROD {2})) ¥PLUS (n ¥PROD {0}) = (n ¥PROD {0}) ¥PLUS((m ¥PROD {1}) ¥PLUS (k ¥PROD {2}))
	ELEM ==> Stat3: ((n ¥PROD {0}) ¥PLUS (m ¥PROD {1})) ¥PLUS (k ¥PROD {2}) =
				(n ¥PROD {0}) ¥PLUS ((m ¥PROD {1}) ¥PLUS (k ¥PROD {2}))
--
-- The cardinalities of the sets $n ¥PROD {0}$ etc. are clearly equal to $#n$, $#m$, and $#k$ respectively,
-- and so the inner sums appearing in this last formula can be replaced by sums like $n ¥PLUS m$ etc.
--
	(n,0)-->T224 ==> #(n ¥PROD {0}) = #n
	(m,1)-->T224 ==> #(m ¥PROD {1}) = #m
	(k,2)-->T224 ==> #(k ¥PROD {2}) = #k
	(n ¥PROD {0},m ¥PROD {1})-->T221 ==> (n ¥PROD {0}) ¥PLUS (m ¥PROD {1}) = (#(n ¥PROD {0}) ¥PLUS (#(m ¥PROD {1})))
	EQUAL ==> (n ¥PROD {0}) ¥PLUS (m ¥PROD {1}) = #n ¥PLUS #m
	(m ¥PROD {1},k ¥PROD {2})-->T221 ==> (m ¥PROD {1}) ¥PLUS (k ¥PROD {2}) = (#(m ¥PROD {1})) ¥PLUS (#(k ¥PROD {2}))
	EQUAL ==> (m ¥PROD {1}) ¥PLUS (k ¥PROD {2}) = (#m ¥PLUS #k)
	(n,m)-->T221 ==> #n ¥PLUS #m = n ¥PLUS m
	(m,k)-->T221 ==> #m ¥PLUS #k = m ¥PLUS k
	EQUAL ==> (n ¥PLUS m) ¥PLUS (k ¥PROD {2}) = (n ¥PROD {0}) ¥PLUS (m ¥PLUS k)
--
-- However, we can replace the sets $k ¥PROD {2}$ and $n ¥PROD {0}$ appearing in this last formula by their cardinalities.
--
	(n ¥PLUS m,(k ¥PROD {2}))-->T226 ==> (n ¥PLUS m) ¥PLUS (k ¥PROD {2}) = (n ¥PLUS m) ¥PLUS #(k ¥PROD {2})
	(n ¥PROD {0},m ¥PLUS k)-->T227 ==> (n ¥PROD {0}) ¥PLUS (m ¥PLUS k) = (#(n ¥PROD {0})) ¥PLUS (m ¥PLUS k)
	EQUAL ==> (n ¥PLUS m) ¥PLUS #k = #n ¥PLUS (m ¥PLUS k)
--
-- And finally can use remove the two cardinality operators appearing in this last formula
-- to obtain the assertion of the present theorem.
--
	(n ¥PLUS m,k)-->T226 ==> (n ¥PLUS m) ¥PLUS k = #n ¥PLUS (m ¥PLUS k)
	(n,m ¥PLUS k)-->T227 ==>  false; Discharge ==> QED
--
-- Our next two theorems respectively give the associative law for multiplication and the
-- distributive law for multiplication over addition.
--
Theorem 259: [Associativity of arithmetic multiplication] N ¥TIMES (M ¥TIMES K) = (N ¥TIMES M) ¥TIMES K. Proof:
    Suppose_not(n,m,k) ==> n ¥TIMES (m ¥TIMES k) /= (n ¥TIMES m) ¥TIMES k
--
-- For suppose that $n$, $m$, and $k$ be a counterexample to the asserted associative law.
-- Using the definition of '$¥TIMES$', we can easily see that #$(n ¥PROD (m ¥PROD k))$
-- and $#((n ¥PROD m) ¥PROD k)$ must then be different.
--
    Use_def(¥TIMES) ==> n ¥TIMES #(m ¥PROD k) /= #(n ¥PROD m) ¥TIMES k
    Use_def(¥TIMES) ==> #(n ¥PROD #(m ¥PROD k)) /= #(#(n ¥PROD m) ¥PROD k)
    (n,m ¥PROD k)-->T233 ==> #(n ¥PROD #(m ¥PROD k)) = #(n ¥PROD (m ¥PROD k))
    (n ¥PROD m,k)-->T234 ==> #(#(n ¥PROD m) ¥PROD k) = #((n ¥PROD m) ¥PROD k)
--
-- But this clearly violates Theorem 160.
--
    (n,m,k)-->T160 ==> #(n ¥PROD (m ¥PROD k)) = #((n ¥PROD m) ¥PROD k)
    Discharge ==> QED
--
-- The following is the 'right-hand' version of the distributive law for integer multiplication over addition.
--
Theorem 260: [Arithmetic distributive law] N ¥TIMES (M ¥PLUS K) = (N ¥TIMES M) ¥PLUS (N ¥TIMES K). Proof:
    Suppose_not(n,m,k) ==> n ¥TIMES (m ¥PLUS k) /= (n ¥TIMES m) ¥PLUS (n ¥TIMES k)
--
-- For supposing the contrary, we can use the definition of '$¥PLUS$' on the left of the resulting inequality
-- and of '$¥TIMES$' on the right, and then simplify further, removing superfluous cardinality operators to get
-- the final inequality seen just before the next comment below.
--
 	T212 ==> Stat1: 0 /= 1
 	(m,k)-->T221 ==> (m ¥PLUS k) = (#m ¥PLUS #k)
    (0,1,m,k)-->T225 ==> (#m ¥PLUS #k) = #((m ¥PROD {0}) + (k ¥PROD {1}))
    EQUAL ==> n ¥TIMES #((m ¥PROD {0}) + (k ¥PROD {1})) /= (n ¥TIMES m) ¥PLUS (n ¥TIMES k)
    Use_def(¥TIMES) ==> n ¥TIMES #((m ¥PROD {0}) + (k ¥PROD {1})) /= #(n ¥PROD m) ¥PLUS #(n ¥PROD k)
    (n,(m ¥PROD {0}) + (k ¥PROD {1}))-->T231 ==>
	n ¥TIMES ((m ¥PROD {0}) + (k ¥PROD {1})) /= #(n ¥PROD m) ¥PLUS #(n ¥PROD k)
    (#(n ¥PROD m),n ¥PROD k)-->T226 ==> n ¥TIMES ((m ¥PROD {0}) + (k ¥PROD {1})) /= #(n ¥PROD m) ¥PLUS (n ¥PROD k)
    (#(n ¥PROD m),n ¥PROD k)-->T252 ==> #(n ¥PROD m) ¥PLUS (n ¥PROD k) = (n ¥PROD k) ¥PLUS #(n ¥PROD m)
    (n ¥PROD k,n ¥PROD m)-->T226 ==> #(n ¥PROD m) ¥PLUS (n ¥PROD k) = (n ¥PROD k) ¥PLUS (n ¥PROD m)
    (n ¥PROD m,n ¥PROD k)-->T252 ==> #(n ¥PROD m) ¥PLUS (n ¥PROD k) = (n ¥PROD m) ¥PLUS (n ¥PROD k)
    Use_def(¥TIMES) ==> #(n ¥PROD ((m ¥PROD {0}) + (k ¥PROD {1}))) /= (n ¥PROD m) ¥PLUS (n ¥PROD k)
 --
-- The right-hand side of this last inequality can then be rewritten as follows
-- using Theorem 225:
--
  	(n ¥PROD m,n ¥PROD k)-->T221 ==> ((n ¥PROD m) ¥PLUS (n ¥PROD k)) = (#(n ¥PROD m) ¥PLUS #(n ¥PROD k))
    (0,1,n ¥PROD m,n ¥PROD k)-->T225 ==>
    	(#(n ¥PROD m) ¥PLUS #(n ¥PROD k)) = #(((n ¥PROD m) ¥PROD {0}) + ((n ¥PROD k) ¥PROD {1}))
    (m ¥PROD {0},n,k ¥PROD {1})-->T255 ==>
    	(n ¥PROD ((m ¥PROD {0}) + (k ¥PROD {1}))) = ((n ¥PROD (m ¥PROD {0})) + (n ¥PROD (k ¥PROD {1})))
    EQUAL ==> #((n ¥PROD (m ¥PROD {0})) + (n ¥PROD (k ¥PROD {1}))) /= #(((n ¥PROD m) ¥PROD {0}) + ((n ¥PROD k) ¥PROD {1}))
--
-- But the pairs of terms in this last inequality are easily seen to be disjoint:
--
	({0},{1},m,k)-->T143(Stat1,Stat1) ==> (m ¥PROD {0}) * (k ¥PROD {1}) = 0
	(m ¥PROD {0},n,k ¥PROD {1})-->T255 ==>
	(n ¥PROD (m ¥PROD {0})) * (n ¥PROD (k ¥PROD {1})) = (n ¥PROD ((m ¥PROD {0}) * (k ¥PROD {1})))
	EQUAL ==> (n ¥PROD (m ¥PROD {0})) * (n ¥PROD (k ¥PROD {1})) = (n ¥PROD 0)
	n-->T139 ==> (n ¥PROD (m ¥PROD {0})) * (n ¥PROD (k ¥PROD {1})) = 0
	({0},{1},n ¥PROD m,n ¥PROD k)-->T143 ==> ((n ¥PROD m) ¥PROD {0}) * ((n ¥PROD k) ¥PROD {1}) = 0
--
-- It now follows using Theorem 222 that the cardinalities of unions seen above
-- can be rewritten as arithmetic sums:
--
	(n ¥PROD (m ¥PROD {0}),n ¥PROD (k ¥PROD {1}))-->T222 ==>
	#((n ¥PROD (m ¥PROD {0})) + (n ¥PROD (k ¥PROD {1}))) = #(n ¥PROD (m ¥PROD {0})) ¥PLUS #(n ¥PROD (k ¥PROD {1}))
	((n ¥PROD m) ¥PROD {0},(n ¥PROD k) ¥PROD {1})-->T222 ==>
	#(((n ¥PROD m) ¥PROD {0}) + ((n ¥PROD k) ¥PROD {1})) = #((n ¥PROD m) ¥PROD {0}) ¥PLUS #((n ¥PROD k) ¥PROD {1})
	ELEM ==> Stat2: #(n ¥PROD (m ¥PROD {0})) ¥PLUS #(n ¥PROD (k ¥PROD {1})) /= #((n ¥PROD m) ¥PROD {0}) ¥PLUS #((n ¥PROD k) ¥PROD {1})
--
-- But this last inequality is easily seen to be impossible:
--
       (n,m,{0})-->T160 ==> #(n ¥PROD (m ¥PROD {0})) = #((n ¥PROD m) ¥PROD {0})
       (n,k,{1})-->T160 ==> #(n ¥PROD (k ¥PROD {1})) = #((n ¥PROD k) ¥PROD {1})
    EQUAL(Stat2) ==> false; Discharge ==> QED
--
-- Next we show that the product of two finite sets is finite. The  proof uses
-- the method of finite induction introduced above.
--
Theorem 261: [The arithmetic product of two finite sets is finite] (Finite(N) & Finite(M)) ¥imp Finite(N ¥TIMES M). Proof:
    Suppose_not(n,m) ==> Finite(n) & Finite(m) & (not Finite(n ¥TIMES m))
--
-- For suppose that there exist finite $n$ and $m$ such that $n ¥PROD m$ is infinite.
-- By our theory of finite induction, there exists finite $k$ and $mp$ such that $k ¥PROD mp$ is
-- infinite, but $j ¥PROD m2$ is finite for every finite m and proper subset $j$ of $k$.
--
    Use_def(¥TIMES) ==> Finite(n) & Finite(m) & (not Finite(#(n ¥PROD m)))
    ({[x,y]: x in n & y in m})-->T193 ==> Finite(n) & Finite(m) & (not Finite(n ¥PROD m))
    Suppose ==> Stat1: not(EXISTS m | Finite(m) & (not Finite(n ¥PROD m)))
    m-->Stat1 ==> false; Discharge ==> Finite(n) & (EXISTS m | Finite(m) & (not Finite(n ¥PROD m)))
    APPLY(m1_thryvar:k1) finite_induction (n->n,p(n)->Finite(n) & (EXISTS m | Finite(m) & (not Finite(n ¥PROD m)))) ==>
		Finite(k1) & (EXISTS m | Finite(m) & (not Finite(k1 ¥PROD m))) &
			(FORALL j ¥incin k1 | ((j /= k1) ¥imp (not(Finite(j) & (EXISTS m | Finite(m) & (not Finite(j ¥PROD m)))))))
	Loc_def ==> k = k1
	EQUAL ==> Finite(k) & Stat2: (EXISTS m | Finite(m) & (not Finite(k ¥PROD m))) &
			Stat3: (FORALL j ¥incin k | ((j /= k) ¥imp (not(Finite(j) & (EXISTS m | Finite(m) & (not Finite(j ¥PROD m)))))))
    mp-->Stat2 ==> Stat4: Finite(mp) & (not Finite(k ¥PROD mp))
--
-- Since $0 ¥PROD mp$ is $0$, $k$ obviously cannot be empty, and so has a member $c$.
--
    Suppose ==> k = 0
    EQUAL ==> k ¥PROD mp = 0 ¥PROD mp
    mp-->T139 ==> k ¥PROD mp = 0
    EQUAL ==> not Finite(0)
    T188 ==> false; Discharge ==> Stat5: k /= 0
    c-->Stat5 ==> Stat6: c in k
--
-- But then $k - {c}$ is a proper subset of $k$, so $(k - {c}) ¥PROD m$ must be finite, and therefore
-- $((k - {c}) ¥PROD m) + ({c} ¥PROD m) = k ¥PROD m$ must also be finite, a contradiction
-- which proves the present theorem.
--
   (Stat6)ELEM ==> (k = (k - {c}) + {c}) & ((k - {c}) ¥incin k) & ((k - {c}) * {c} = 0)
    ELEM ==> Finite(k - {c})
    (k - {c})-->Stat3 ==> Stat7: not(EXISTS m | Finite(m) & (not Finite((k - {c}) ¥PROD m)))
    mp-->Stat7 ==> Finite((k - {c}) ¥PROD mp)
    (k - {c},mp,{c})-->T255 ==> ((k - {c}) + {c}) ¥PROD mp = ((k - {c}) ¥PROD mp) + ({c} ¥PROD mp)
    ELEM ==> (k - {c}) + {c} = k
    EQUAL ==> k ¥PROD mp = ((k - {c}) ¥PROD mp) + ({c} ¥PROD mp)
    (mp)-->T193 ==> Finite(#mp)
    (c,mp)-->T223 ==> #({c} ¥PROD mp) = #mp
    EQUAL ==> Finite(#({c} ¥PROD mp))
    ({c} ¥PROD mp)-->T193 ==> Finite({c} ¥PROD mp)
    ((k - {c}) ¥PROD mp,{c} ¥PROD mp)-->T236 ==> Finite(((k - {c}) ¥PROD mp) + ({c} ¥PROD mp))
    EQUAL ==> Stat8: Finite(k ¥PROD mp)
    (Stat4,Stat8)Discharge ==> QED
--
-- The following is a simple corollary of Theorem 261
--
Theorem 262: [The Cartesian product of two finite sets is finite] (Finite(N) & Finite(M)) ¥imp Finite(N ¥PROD M). Proof:
    Suppose_not(n,m) ==> Finite(n) & Finite(m) & (not Finite(n ¥PROD m))
	(n ¥PROD m)-->T193 ==> not Finite(#(n ¥PROD m))
	Use_def(¥TIMES) ==> not Finite(#(n ¥TIMES m))
	(n,m)-->T261 ==> false; Discharge ==> QED
--
-- The following result restates the preceding theorem as a statement about the arithmetic multiplication operator.
--
Theorem 263: [If the product of two nonzero terms is finite, so are the terms] ((Finite(N) & Finite(M)) or N = 0 or M = 0) ¥eq Finite(N ¥TIMES M). Proof:
    Suppose_not(n,m) ==> Stat1: not(((Finite(n) & Finite(m)) or n = 0 or m = 0) ¥eq Finite(n ¥TIMES m))
--
-- For let $n$, $m$ be a counterexample to our assertion. It is easily seen that neither  $n$ nor $m$
-- can be empty, so either both must be finite and $n ¥TIMES m$ infinite, or the revers.
--
    T188 ==> Finite(0)
    Suppose ==> n = 0
    EQUAL ==> Finite(n ¥TIMES m) ¥eq Finite(0 ¥TIMES M)
    m-->T246 ==> 0 ¥TIMES m = 0
    EQUAL ==> Finite(n ¥TIMES m) ¥eq Finite(0)
    Discharge ==> Stat2: n /= 0
    Suppose ==> m = 0
    EQUAL ==> Finite(n ¥TIMES m) ¥eq Finite(n ¥TIMES 0)
    n-->T245 ==> n ¥TIMES 0 = 0
    EQUAL ==> Finite(n ¥TIMES 0) ¥eq Finite(0)
    Discharge ==> Stat3: m /= 0
    (Stat1,Stat2,Stat3*)ELEM ==> not((Finite(n) & Finite(m)) ¥eq Finite(n ¥TIMES m))
--
-- Since $#(n ¥PROD m)$ is evidently no less than
-- either $n$ and $m$, the second case is ruled out, so we have only to consider the first case.
--
    Suppose ==> Stat4: Finite(n ¥TIMES m) & (not(Finite(n) & Finite(m)))
    Use_def(¥TIMES) ==> Finite(#(n ¥PROD m))
    (m,n)-->T250 ==> #(n ¥PROD m) incs #n
    (#(n ¥PROD m),#n)-->T189 ==> Finite(#n)
    n-->T193 ==> Stat5: Finite(n)
    (n,m)-->T253 ==> n ¥TIMES m = m ¥TIMES n
    EQUAL ==> Finite(m ¥TIMES n)
    Use_def(¥TIMES) ==> Finite(#(m ¥PROD n))
    (n,m)-->T250 ==> #(m ¥PROD n) incs #m
    (#(m ¥PROD n),#m)-->T189 ==> Finite(#m)
    m-->T193 ==> Stat6: Finite(m)
    (Stat4,Stat5,Stat6*)Discharge ==> Finite(n) & Finite(m) & (not Finite(n ¥TIMES m))
--
-- But the preceding theorem rules out this case, so our proof is complete.
--
    Use_def(¥TIMES) ==> not Finite(#(n ¥PROD m))
    (n ¥PROD m)-->T193 ==> not Finite(n ¥PROD m)
    (n,m)-->T262 ==> false; Discharge ==>QED
--
-- We continue by proving that the power set of a finite set is also finite.
--
Theorem 264: [A set is finite if and only if its powerset is finite] Finite(N) ¥eq Finite(pow(N)). Proof:
    Suppose_not(n) ==> (Finite(n) & (not Finite(pow(n)))) or ((not Finite(n)) & Finite(pow(n)))
--
-- If the asserted equivalence is false, there must exist an either a finite $n$ with an infinite power set,
-- or an infinite $n$ with a finite power set. Consider the second of these cases first.
-- In this case  ${arb(x): x in pow(n) - {0}}$, which is the range of the function $arb$ on the set $n$, must be finite.
-- But since every singleton ${y}$, with $y in n$, belongs to $pow(n) - {0}$,
-- it is plain that ${arb(x): x in pow(n) - {0}}$ includes $n$, ruling out this case.
--
    Suppose ==> (not Finite(n)) & Finite(pow(n))
    Loc_def ==> f = {[x,arb(x)]: x in pow(n) - {0}}
    APPLY() fcn_symbol(f(x)->arb(x),g->f,s->pow(n) - {0}) ==>
		Svm(f) & (domain(f) = pow(n) - {0}) & (range(f) = {arb(x): x in pow(n) - {0}})
    Suppose ==> Stat1: not (range(f) ¥incin n)
    cp-->Stat1 ==> (cp in range(f)) & (cp notin n)
    ELEM ==> Stat2: cp in {arb(x): x in pow(n) - {0}}
    d-->Stat2 ==> (cp = arb(d)) & (d in pow(n) - {0})
    d-->T0 ==> cp in d
    Use_def(pow) ==> Stat3: d in {x: x ¥incin n}
    d1-->Stat3 ==> d ¥incin n
    Discharge ==> range(f) ¥incin n
    Suppose ==> Stat4: not (n ¥incin range(f))
    a-->Stat4 ==> (a notin range(f)) & (a in n)
    ELEM ==> Stat5: a notin {arb(x): x in pow(n) - {0}}
    {a}-->Stat5 ==> not(({a} /= 0) & (a = arb({a})) & ({a} in pow(n)))
    ELEM ==> {a} notin pow(n)
    Use_def(pow) ==> Stat6: {a} notin {x: x ¥incin n}
    {a}-->Stat6 ==> not ({a} ¥incin n)
    Discharge ==> range(f) = n
    ELEM ==> Finite(pow(n) - {0})
    EQUAL ==> Finite(domain(f))
    f-->T192 ==> Finite(range(f))
    Discharge ==> Finite(n) & (not Finite(pow(n)))
--
-- Thus it follows that if our theorem is false there must exist a finite $n$ with an infinite power set,
-- in which case the principle of finite induction tells us that there exists such a set $m$ with no
-- proper subset having the same property. Since {0} is finite, $m$ cannot be 0,
-- and therefore it must have some member $c$.
--
    APPLY(m1_thryvar:m) finite_induction(n->n,P(x)-> (not Finite(pow(x)))) ==> (m ¥incin n) & (not Finite(pow(m))) &
			Stat7: (FORALL k ¥incin m | ((k /= m) ¥imp Finite(pow(k))))
    Suppose ==> m = 0
    T213 ==> pow(0) = {0}
    EQUAL ==> pow(m) = {0}
    EQUAL ==> not Finite({0})
    T188 ==> Finite(0)
    (0,0)-->T199 ==> Finite(0 + {0})
    ELEM ==> 0 + {0} = {0}
    EQUAL ==> Finite({0})
    Discharge ==> Stat8: m /= 0
    c-->Stat8 ==> Stat9: c in m
--
-- We can therefore decompose $pow(m)$ into (i) the collection of all subsets of $m$ which do contain $c$,
-- and (ii) the collection of all subsets of $m$ which do not contain $c$. It is easily seen that collection $b$
-- is the power set of $m - {c}$, and so, by the minimality of $m$, collection $b$ must be finite,
-- and therefore collection (i) must be infinite.
--
    Set_monot ==> {x: x in pow(m) | true} = {x: x in pow(m) | c in x or c notin x}
    SIMPLF ==> pow(m) = {x: x in pow(m) | c in x or c notin x}
    Set_monot ==> {x: x in pow(m) | c in x or c notin x} = {x: x in pow(m) | c in x} + {x: x in pow(m) | c notin x}
    ELEM ==> pow(m) = {x: x in pow(m) | c in x} + {x: x in pow(m) | c notin x}
    Use_def(pow) ==> {x: x in pow(m) | c notin x} = {x: x in {x: x ¥incin m} | c notin x}
    SIMPLF ==> Stat10: {x: x in pow(m) | c notin x} = {x: x ¥incin m | c notin x}
    Suppose ==> Stat11: {x: x ¥incin m | c notin x} /= {x: x ¥incin (m - {c})}
    dq-->Stat11 ==> (((dq in {x: x ¥incin m | c notin x}) & (dq notin {x: x ¥incin (m - {c})})) or
	((dq notin {x: x ¥incin m | c notin x}) & (dq in {x: x ¥incin (m - {c})})))
    Suppose ==> Stat12: (dq in {x: x ¥incin m | c notin x}) & Stat13: (dq notin {x: x ¥incin (m - {c})})
    ap-->Stat12 ==> (dq = ap) & (ap ¥incin m) & (c notin ap)
    ap-->Stat13 ==> not((dq = ap) & (ap ¥incin (m - {c})))
    Discharge ==> Stat14: (dq notin {x: x ¥incin m | c notin x}) & Stat15: (dq in {x: x ¥incin (m - {c})})
    b-->Stat15 ==> (dq = b) & (b ¥incin (m - {c}))
    b-->Stat14 ==> not((dq ¥incin m) & (c notin dq))
    Discharge ==> Stat16: {x: x ¥incin m | c notin x} = {x: x ¥incin (m - {c})}
    (Stat16,Stat10)ELEM ==> {x: x in pow(m) | c notin x} = {x: x ¥incin (m - {c})}
    Use_def(pow) ==> {x: x in pow(m) | c notin x} = pow(m - {c})
    ELEM ==> (m - {c} ¥incin m) & (m - {c} /= m)
    (m - {c})-->Stat7 ==> Finite(pow(m - {c}))
    EQUAL ==> Finite({x: x ¥incin (m - {c})}) & Finite({x: x in pow(m) | c notin x})
    ({x: x in pow(m) | c in x},{x: x in pow(m) | c notin x})-->T236(*) ==>
    	(Finite({x: x in pow(m) | c in x}) & Finite({x: x in pow(m) | c notin x})) ¥eq
    		Finite({x: x in pow(m) | c in x} + {x: x in pow(m) | c notin x})
    EQUAL ==> (Finite({x: x in pow(m) | c in x}) & Finite({x: x in pow(m) | c notin x})) ¥eq Finite(pow(m))
    ELEM ==> not Finite({x: x in pow(m) | c in x})
    Use_def(pow) ==> not Finite({x: x in {y: y ¥incin m} | c in x})
    SIMPLF ==> {x: x in {y: y ¥incin m} | c in x} = {y: y ¥incin m | c in y}
    EQUAL ==>  not Finite({y: y ¥incin m | c in y})
--
-- But it is also easy to see that the single-valued map $ff(x)->x + {c}$ maps $pow(m - {c})$ onto the collection (i)
-- of sets, and the domain $pow(m - {c})$ of this map, and hence its range, is plainly finite.
--
	Loc_def ==> ff = {[x,x + {c}]: x in {x: x ¥incin (m - {c})}}
    APPLY() fcn_symbol(f(x)->x + {c},g->ff,s->{x: x ¥incin (m - {c})}) ==>
		Svm(ff) & (domain(ff) = {x: x ¥incin (m - {c})}) & (range(ff) = {x + {c}: x in {x: x ¥incin (m - {c})}})
    SIMPLF ==> range(ff) = {x + {c}: x ¥incin (m - {c})}
    EQUAL ==> Finite(domain(ff))
    ff-->T192 ==> Finite(range(ff))
    EQUAL ==> Finite({x + {c}: x ¥incin (m - {c})})
    Suppose ==> Stat17: {x + {c}: x ¥incin (m - {c})} /= {x: x ¥incin m | c in x}
    e-->Stat17(*) ==> Stat18: ((e in {x + {c}: x ¥incin (m - {c})}) & (e notin {x: x ¥incin m | c in x})) or
	((e notin {x + {c}: x ¥incin (m - {c})}) & (e in {x: x ¥incin m | c in x}))
    Suppose ==> Stat19: (e in {x + {c}: x ¥incin (m - {c})}) & Stat20: (e notin {x: x ¥incin m | c in x})
    e1-->Stat19 ==> Stat21: (e = e1 + {c}) & (e1 ¥incin (m - {c}))
    (e1 + {c})-->Stat20 ==> Stat22: not((e = e1 + {c}) & ((e1 + {c}) ¥incin m) & (c in e1 + {c}))
    (Stat21,Stat22,Stat9)ELEM ==> false;
    Discharge ==> Stat23: not((e in {x + {c}: x ¥incin (m - {c})}) & (e notin {x: x ¥incin m | c in x}))
    (Stat23,Stat18*)ELEM ==> Stat24: (e notin {x + {c}: x ¥incin (m - {c})}) & Stat25: (e in {x: x ¥incin m | c in x})
    e2-->Stat25 ==> Stat26: (e = e2) & (e2 ¥incin m) & (c in e2)
    (e2 - {c})-->Stat24 ==> Stat27: not((e = (e2 - {c}) + {c}) & ((e2 - {c}) ¥incin (m - {c})))
    EQUAL(Stat26,Stat27) ==> false; Discharge ==> {x + {c}: x ¥incin (m - {c})} = {x: x ¥incin m | c in x}
--
-- This contradiction proves our theorem.
--
    EQUAL ==> false; Discharge ==> QED
--
-- Our next proof, of Cantor's basic result that the cardinality of the power set of
-- any set $s$ is always larger than the cardinality of $s$, embodies a famous idea whose
-- discovery encouraged development if the theory of infinite cardinality in its early days.
--
Theorem 265: [Cantor's Theorem] #N in #pow(N). Proof:
    Suppose_not(n) ==> #n notin #pow(n)
--
-- For let $n$ be a counterexample to our assertion. $pow(n)$ in plainly not empty,
-- and since $#n$ and $#pow(n)$ are both ordinals we must have $#n incs #pow(n)$ by Theorem 35.
--
    Suppose ==> 0 notin pow(n)
    Use_def(pow) ==> Stat1:  0 notin {x: x ¥incin n}
    0-->Stat1 ==> Stat2: not (0 ¥incin n)
    Discharge ==> pow(n) /= 0
    n-->T156 ==> Ord(#n)
    (pow(n))-->T156 ==> Ord(#pow(n))
    (#pow(n),#n)-->T35 ==> #n incs #pow(n)
--
-- Hence Theorem 176 tells us that there is a single valued map $f$ of $n$ onto $pow(n)$.
-- Consider the subset $s = {x: x in n | x notin f~[x]}$ of $n$, which plainly belongs to $pow(n)$.
--
    (n,pow(n))-->T176 ==> Stat3: (EXISTS f in OM | Svm(f) & (domain(f) = n) & (range(f) = pow(n)))
    f-->Stat3 ==> Svm(f) & (domain(f) = n) & (range(f) = pow(n))
    Loc_def ==> s = {x: x in n | x notin f~[x]}
    Set_monot ==> {x: x in n | x notin f~[x]} ¥incin {x: x in n}
    ELEM ==> s ¥incin {x: x in n}
    SIMPLF ==> s ¥incin n
    Suppose ==> not(s in pow(n))
    Use_def(pow) ==> Stat4: not(s in {x: x ¥incin n})
    s-->Stat4 ==> not(s ¥incin n)
    Discharge ==> s in pow(n)
    ELEM ==> s in range(f)
--
-- It is clear since $s$ belongs to the range of $f$ that $s = f~[c]$ for some $c in n$.
--
    T72 ==> f = {[x,f~[x]]: x in domain(f)}
    EQUAL ==> s in range({[x,f~[x]]: x in domain(f)})
    Use_def(range) ==> s in {cdr(y): y in {[x,f~[x]]: x in domain(f)}}
    SIMPLF ==> Stat5: s in {cdr([x,f~[x]]): x in domain(f)}
    c-->Stat5 ==> (c in domain(f)) & (s = cdr([c,f~[c]]))
    ELEM ==> (c in n) & (s = f~[c])
--
-- If $c in s$, then it follows immediately that  $c notin s$.
--
    Suppose ==> c in s
    ELEM ==> Stat6: c in {x: x in n | x notin f~[x]}
    d-->Stat6 ==> (c = d) & (c in n) & (c notin f~[d])
    EQUAL ==> (c notin f~[c])
    Discharge ==> c notin s
--
-- But in much the same way $c notin s$ implies that $c in s$,
-- so we have a contradiction which proves Cantor's theorem.
--
   	ELEM ==> Stat7: c notin {x: x in n | x notin f~[x]}
    c-->Stat7 ==> not((c in n) & (c notin f~[c]))
    ELEM ==> not((c in n) & (c notin s))
    Discharge ==> QED
--
--
--
Theorem 266: (S ¥incin pow(Un(S))) & ((Finite(Un(S)) & (X ¥incin S)) ¥imp Finite(X)). Proof:
Suppose_not(s,x) ==> AUTO
	Suppose ==> Stat1: s ¥nincin pow(Un(s))
		c-->Stat1(Stat1*) ==> Stat2: (c in s) & (c notin pow(Un(s)))
		Use_def(Un(s)) ==> AUTO
		Use_def(pow(Un(s))) ==> AUTO
		EQUAL(Stat2) ==> Stat3: c notin {u: u ¥incin {v: y in s, v in y}}
		c-->Stat3(Stat3*) ==> Stat4: c ¥nincin {v: y in s, v in y}
		e-->Stat4(Stat4*) ==> Stat5: (e notin {v: y in s, v in y}) & (e in c)
	(c,e)-->Stat5(Stat2,Stat2*) ==> false; Discharge ==> AUTO
--
-- At this point we have derived that
--	$(x ¥incin s) & (s ¥incin pow(Un(s))) & Finite(Un(s)) & (not Finite(x))$,
-- but this will also lead to a contradiction.
--
	(Un(s))-->T264 ==> false; Discharge ==> QED
--
-- The two elementary lemmas which now follow state basic fact concerning arithmetic subtraction.
-- We first show that a quantity subtracted from itself gives 0.
--
Theorem 267: [Arithmetic subtraction principle] N ¥MINUS N = 0. Proof:
	Suppose_not(n) ==> n ¥MINUS n /= 0
    Use_def(¥MINUS) ==> n ¥MINUS n = #(n - n)
    ELEM ==> n - n = 0
    EQUAL ==> n ¥MINUS n = #0
    T188 ==> Card(0)
    0-->T164 ==> false; Discharge ==> QED
--
-- Next we show that a quantity subtracted from itself gives 0.
--
Theorem 268: [0 is right identity for arithmetic subtraction] N ¥MINUS 0 = #N. Proof:
	Suppose_not(n) ==> n ¥MINUS 0 /= #n
    Use_def(¥MINUS) ==> #(n - 0) /= #n
    ELEM ==> n - 0 = n
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the cardinality of the sum of any two disjoint sets $n$, $m$ is determined
-- by the two separate cardinalities $#n$, $#m$.
--
Theorem 269: [Disjoint additivity lemma] ((N * M = 0) & (N2 * M2 = 0) & (#N = #N2) & (#M = #M2)) ¥imp (#(N + M) = #(N2 + M2)). Proof:
    Suppose_not(n,m,n2,m2) ==> Stat1: (n * m = 0) & (n2 * m2 = 0) & (#n = #n2) & (#m = #m2) & (#(n + m) /= #(n2 + m2))
--
-- For our assertion results immediately by combining Theorem 220 and Theorem 221.
--
	(n,m)-->T220 ==> #(n + m) = n ¥PLUS m
	(n2,m2)-->T220 ==> #(n2 + m2) = n2 ¥PLUS m2
	(n,m)-->T221 ==> n ¥PLUS m = #n ¥PLUS #m
	(n2,m2)-->T221 ==> n2 ¥PLUS m2 = #n2 ¥PLUS #m2
    EQUAL ==> false; Discharge ==> QED
--
-- Our next theorem states that when, in a subtraction, the subtrahend
-- is an ordinal which exceeds the minuend, then the value of the
-- difference is 0.
--
Theorem 270: [Excess subtraction lemma] (Ord(Y) & (X in Y)) ¥imp ((X ¥MINUS Y) = 0). Proof:
    Suppose_not(y,x) ==> Ord(y) & (x in y) & ((x ¥MINUS y) /= 0)
        Use_def(¥MINUS) ==> #(x - y) /= 0
        (x - y)-->T162 ==> (x - y) /= 0
    (y,x)-->T13 ==> false; Discharge ==> QED
--
-- The two following results state (and generalize) the fact that if an integer $n$ is at least as large as
-- an integer $m$, then $n$ is the arithmetic sum of $m$ and $(n ¥MINUS m)$. The first of these theorems generalizes
-- this fact to arbitrary cardinals (and, indeed, sets). The second restates the same fact
-- in a more narrowly arithmetic form.
--
Theorem 271: [Subtraction lemma] (M ¥incin N) ¥imp (#N = #M ¥PLUS (N ¥MINUS M)). Proof:
    Suppose_not(m,n) ==> (m ¥incin n) & (#n /= #m ¥PLUS (n ¥MINUS m))
--
-- For our assertion results immediately from Theorem 220 and the definition of subtraction.
--
    ELEM ==> (n = m + (n - m)) & (m * (n - m) = 0)
    (m,n - m)-->T220 ==> #(m + (n - m)) = m ¥PLUS (n - m)
    EQUAL ==> #n = m ¥PLUS (n - m)
    (m,n - m)-->T221 ==> #n = #m ¥PLUS #(n - m)
    Use_def(¥MINUS) ==> false; Discharge ==> QED
--
-- The following variant form of the preceding lemma is sometimes useful.
--
Theorem 272: [Subtraction in the non-negative case] (M ¥incin N) ¥imp (#N = (N ¥MINUS M) ¥PLUS M). Proof:
	Suppose_not(m,n) ==> (m ¥incin n) & (#n /= (n ¥MINUS m) ¥PLUS m)
    (m,n)-->T271 ==> (n ¥MINUS m) ¥PLUS m /= #m ¥PLUS (n ¥MINUS m)
	(m,n ¥MINUS m)-->T227 ==> (n ¥MINUS m) ¥PLUS m /= m ¥PLUS (n ¥MINUS m)
	(m,n ¥MINUS m)-->T252 ==> false; Discharge ==> QED
--
-- If we confine our attention to cardinals $#m$ and $#n$, the preceding results tell us that
-- if $#m$ is no larger than $#n$, we have $#n = #m ¥PLUS (#n ¥MINUS #m)$.
--
Theorem 273: [Subtraction lemma 2] (#M in #N or #M = #N) ¥imp (#N = #M ¥PLUS (#N ¥MINUS #M)). Proof:
    Suppose_not(m,n) ==> (#m in #n or #m = #n) & (#n /= #m ¥PLUS (#n ¥MINUS #m))
--
-- Our assertion follows trivially form the preceding, since the present hypotheses imply that $#m ¥incin #n$.
--
	n-->T156 ==> Ord(#n)
	m-->T156 ==> Ord(#m)
    (#n,#m)-->T34 ==> #m ¥incin #n
    (#m,#n)-->T271 ==> ##n = ##m ¥PLUS (#n ¥MINUS #m)
    N-->T166 ==> ##n = #n
    M-->T166 ==> ##m = #m
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the union set of a set $s$ is the set-theoretic 'upper bound' of all its elements, i.e.
-- the smallest set which includes all these elements.
--
Theorem 274: [Union set as an upper bound] (FORALL x in S | x ¥incin Un(S)) & ((FORALL x in S | x ¥incin T) ¥imp (Un(S) ¥incin T)). Proof:
	Suppose_not(s,t) ==> (not(FORALL x in s | x ¥incin Un(s))) or ((FORALL x in s | x ¥incin t) & (not (Un(s) ¥incin t)))
--
-- For if not, one of the two clauses of our theorem must be false. By definition of '$Un$', this
-- cannot be the first clause, so it must be the second.
--
    Suppose ==> Stat1: not(FORALL x in s | x ¥incin Un(s))
    x-->Stat1 ==> Stat2: (x in s) & (not(x ¥incin Un(s)))
    c-->Stat2 ==> (c in x) & (c notin Un(s))
    Use_def(Un) ==> Stat3: c notin {z: y in s, z in y}
    (x,c)-->Stat3 ==> false; Discharge ==> Stat4: (FORALL x in s | x ¥incin t) & Stat5: (not (Un(s) ¥incin t))
--
-- But a second use of the definition of '$Un$' shows that this case is also impossible, proving our theorem.
--
    d-->Stat5 ==> (d in Un(s)) & (d notin t)
    Use_def(Un) ==> Stat6: d in {z: y in s, z in y}
    (b,a)-->Stat6 ==> (d = a) & (b in s) & (a in b)
    b-->Stat4 ==> false; Discharge ==> QED
--
Theorem 275: (Un(S) = 0) ¥eq ((S = 0) or (S = {0})). Proof:
Suppose_not(s) ==> AUTO
--
-- The implication
--	$((s = 0) or (s = {0})) ¥imp (Un(s) = 0)$
-- is quickly proved by virtue of Theorem 109. Hence,
-- assuming the assertion of this theorem to be false, we must
-- have $(Un(s) = 0) & (s /= 0) & (s /= {0})$; and therefore
-- $s ¥nincin {0}$, and we can find in $s$ a non-zero element $c$.
--
	ELEM ==> (arb({0}) = 0) & ({0} - {arb({0})} = 0)
	EQUAL ==> Un({0} - {arb({0})}) = Un(0)
	{0}-->T109(*) ==> Stat1: (Un(0) = 0) & (Un({0}) = 0)
	Suppose ==> (s = 0) & (Un(s) /= 0)
		EQUAL(Stat1) ==> false
	Discharge ==> AUTO
	Suppose ==> (s = {0}) & (Un(s) /= 0)
		EQUAL(Stat1) ==> false
	Discharge ==> Stat2: (s ¥nincin {0}) & (Un(s) = 0)
--
-- Such a $c$ cannot be included in $Un(s)$...
--
	c-->Stat2(Stat2*) ==> Stat3: (c in s) & (c ¥nincin Un(s))
--
-- ...contrary to one of the claims of Theorem 274. This
-- contradiction leads to the desired conclusion.
--
	s-->T274(Stat4*) ==> Stat4: (FORALL x in s | x ¥incin Un(s))
	c-->Stat4(Stat3*) ==> false
	Discharge ==> QED
--
Theorem 276: [Monotonicity of the union-set operator] (S ¥incin T) ¥imp (Un(S) ¥incin Un(T)). Proof:
Suppose_not(s,t) ==> Stat1: (s ¥incin t) & (not(Un(s) ¥incin Un(t)))
	(t,0)-->T274 ==> Stat2: (FORALL x in t | x ¥incin Un(t))
	(s,Un(t))-->T274 ==> Stat3: (FORALL x in s | x ¥incin Un(t)) ¥imp (Un(s) ¥incin Un(t))
	Suppose ==> Stat4: not(FORALL x in s | x ¥incin Un(t))
		c-->Stat4 ==> Stat5: (c in s) & (c ¥nincin Un(t))
	c-->Stat2(Stat5,Stat1*) ==> false; Discharge ==> Stat6: (FORALL x in s | x ¥incin Un(t))
(Stat3,Stat6,Stat1*)ELEM ==> false; Discharge ==> QED
--
--
--
Theorem 277: [Binary and unary union operations commute] Un(X + Y) = Un(X) + Un(Y). Proof:
Suppose_not(x0,y0) ==> AUTO
	(x0,x0 + y0)-->T276 ==> AUTO
	(y0,x0 + y0)-->T276(*) ==> Stat1: Un(x0 + y0) ¥nincin (Un(x0) + Un(y0))
	Use_def(Un(x0 + y0)) ==> AUTO
	Use_def(Un(x0)) ==> AUTO
	Use_def(Un(y0)) ==> AUTO
	u0-->Stat1(Stat1*) ==> Stat2: (u0 in {u: v in x0 + y0, u in v}) & (u0 notin {u: v in x0, u in v}) & (u0 notin {u: v in y0, u in v})
	(v1,u1,v1,u1,v1,u1)-->Stat2(Stat2*) ==> false
	Discharge ==> QED
--
Theorem 278: [Equivalent characterizations of transitive sets] (S ¥incin pow(S)) ¥eq (Un(S) ¥incin S). Proof:
Suppose_not(s0) ==> AUTO
	Use_def(Un(s0)) ==> AUTO
	Use_def(pow(s0)) ==> AUTO
	Suppose ==> Stat1: Un(s0) ¥nincin s0
		y0-->Stat1(*) ==> Stat2: (y0 in {u: v in s0, u in v}) & (y0 notin s0)
		(x1,y1)-->Stat2(*) ==> Stat3: (x1 in {y: y ¥incin s0}) & (y0 in x1)
		y2-->Stat3(Stat2*) ==> false
	Discharge ==> Stat4: (s0 ¥nincin pow(s0)) & (Un(s0) ¥incin s0)
	x0-->Stat4(*) ==> Stat5: (x0 notin {y: y ¥incin s0}) & (x0 in s0)
	s0-->T274(Stat4*) ==> Stat6: (FORALL x in s0 | x ¥incin Un(s0))
	x0-->Stat6(Stat4*) ==> x0 ¥incin s0
	x0-->Stat5(Stat6*) ==> false
	Discharge ==> QED
--
--
--
Theorem 279: (Un(S) incs Un({c: c in S | H notin c})) & (H notin Un({c: c in S | H notin c})). Proof:
Suppose_not(s,h) ==> AUTO
	Set_monot ==> {c: c in s} incs {c: c in s | h notin c}
	Use_def(Un({c: c in s | h notin c})) ==> AUTO
	({c: c in s | h notin c},s)-->T276 ==> Stat1: (h in {x: y in {c: c in s | h notin c}, x in y})
	(y1, x1)-->Stat1(Stat1*) ==> Stat2: (y1 in {c: c in s | h notin c}) & (h in y1)
	c1-->Stat2(Stat2*) ==> false
	Discharge ==> QED
--
-- If the set appearing in the preceding theorem is a collection of ordinals,
-- then its union set $Un(s)$ must be an ordinal. Indeed $Un(s)$ is the smallest ordinal
-- not smaller than any of the elements of $s$ (but this fact, an easy consequence of
-- Theorem 274, is not derived in what follows.)
--
Theorem 280: [The union of a set of ordinals is an ordinal] (FORALL x in S | Ord(x)) ¥imp Ord(Un(S)). Proof+:
    Suppose_not(s) ==> Stat1: (FORALL x in s | Ord(x)) & (not(Ord(Un(s))))
--
-- For suppose that $s$ is a set of ordinals whose union set is not an ordinal.
-- Then $Un(s)$ either has an element $x$ not included in $Un(s)$, or a pair of distinct elements
-- not related by membership. First consider the first of these two possibilities.
--
    Use_def(Ord) ==>
	not((FORALL x in Un(s) | x ¥incin Un(s)) & (FORALL x in Un(s), y in Un(s) | x in y or y in x or x = y))
    Use_def(Un) ==>
	(not((FORALL x in {wz: yy in s, wz in yy} | x ¥incin {wz: yy in s, wz in yy}))) or
	(not((FORALL x in {wz: yy in s, wz in yy}, y in {wz: yy in s, wz in yy} | x in y or y in x or x = y)))
    Suppose ==> Stat2: not (FORALL x in {wz: yy in s, wz in yy} | x ¥incin {wz: yy in s, wz in yy})
--
-- In this case there would have to be $a$, $c$ satisfying $a in s$, $x in a$, $c in s$ such that $c notin {wz: yy in s, wz in yy}$,
-- an evident impossibility which rules out this case.
--
    x-->Stat2 ==> Stat3: (x in {wz: yy in s, wz in yy}) & (not(x ¥incin {wz: yy in s, wz in yy}))
    (a,b)-->Stat3 ==> (x = b) & (a in s) & (b in a) & Stat4: (not(x ¥incin {wz: yy in s, wz in yy}))
    c-->Stat4 ==> (c in b) & Stat5: (not(c in {wz: yy in s, wz in yy}))
    a-->Stat1 ==> Ord(a)
    (a,b)-->T13 ==> c in a
    (a,c)-->Stat5 ==> false; Discharge ==>
	Stat6: not(FORALL x in {wz: yy in s, wz in yy}, y in {wz: yy in s, wz in yy} | x in y or y in x or x = y)
--
-- But if $Un(s)$ a pair of distinct elements $u$, $v$ not related by membership,
-- $u$ would be a member of some ordinal $au$ in s, and $v$ would be a member of some ordinal $av$ in s.
-- Since one of these ordinals would necessarily include the other this is impossible, so out theorem is proved.
--
    (u,v)-->Stat6 ==> Stat7: (u in {wz: yy in s, wz in yy}) & (v in {wz: yy in s, wz in yy})
    					& (not(u in v or v in u or u = v))
    (au,bu,av,bv)-->Stat7 ==> (au in s) & (u in au) & (av in s) & (v in av) & (not(u in v or v in u or u = v))
    au-->Stat1 ==> Ord(au)
    av-->Stat1 ==> Ord(av)
    (u,v)-->T31 ==> false; Discharge ==> QED
--
-- Next we prove that the arithmetic quotient of any $n$ by a nonzero $m$ is no larger than $n$.
--
Theorem 281: [Division monotonicity lemma] (M /= 0) ¥imp ((N ¥OVER M) ¥incin N). Proof:
    Suppose_not(m,n) ==> Stat1: (m /= 0) & (not((n ¥OVER m) ¥incin n))
--
-- For suppose that $m$, $n$ is a counterexample to our assertion.
-- Then by definition of division there must exist $k in Za$ and $c in k$, with $c notin n$
-- and $(k ¥TIMES m) ¥incin n$.
--
    Use_def(¥OVER) ==> Stat2: not(Un({k in Za | (k ¥TIMES m) ¥incin n}) ¥incin n)
    c-->Stat2 ==> (c notin n) & (c in Un({k in Za | (k ¥TIMES m) ¥incin n}))
    Use_def(Un) ==> c in {x: y in {k in Za | (k ¥TIMES m) ¥incin n}, x in y}
    SIMPLF ==> Stat3: c in {x: k in Za, x in k | (k ¥TIMES m) ¥incin n}
    (k,x)-->Stat3 ==> (k in Za) & (c in k) & ((k ¥TIMES m) ¥incin n)
--
-- Let $a$ be a member of $m$, so that $#(k ¥PROD m) incs #(k ¥PROD {a})$ and therefore
-- $k ¥TIMES m incs k$. It follows that $n incs k$, and so $c in n$, a contradiction which proves our theorem.
--
    a-->Stat1 ==> a in m
    (k,k,{a},m)-->T256 ==> (k ¥PROD m) incs (k ¥PROD {a})
    (k ¥PROD {a},k ¥PROD m)-->T170 ==> #(k ¥PROD m) incs #(k ¥PROD {a})
    (k,a)-->T224 ==> #(k ¥PROD m) incs #k
    Use_def(¥TIMES) ==> k ¥TIMES m incs #k
    k-->T207 ==> k ¥TIMES m incs k
    Discharge ==> QED
--
-- The following lemma tells us that if $n$ is and integer and $m$ is nonzero,
-- the arithmetic quotient of $n$ by $m$ is an integer.
--
Theorem 282: [Extended division monotonicity lemma] ((M /= 0) & (N in Za)) ¥imp (((N ¥OVER M) in Za) & ((N ¥OVER M) ¥incin N)). Proof+:
    Suppose_not(m,n) ==> (n in Za) & (m /= 0) & (((n ¥OVER m) notin Za) or (not((n ¥OVER m) ¥incin n)))
--
-- For otherwise, since it is clear that every element of ${k in Za | (k ¥TIMES m) ¥incin n}$
-- is an ordinal, It follows by definition that $n ¥OVER m$ is an ordinal.
--
    Suppose ==> Stat1: not(FORALL x in {k in Za | (k ¥TIMES m) ¥incin n} | Ord(x))
    x2-->Stat1 ==> Stat2: (x2 in {k in Za | (k ¥TIMES m) ¥incin n}) & (not Ord(x2))
	()-->Stat2 ==> false; Discharge ==> (FORALL x in {k in Za | (k ¥TIMES m) ¥incin n} | Ord(x))
    {k in Za | (k ¥TIMES m) ¥incin n}-->T280 ==> Ord(Un({k in Za | (k ¥TIMES m) ¥incin n}))
    Use_def(¥OVER) ==> (n ¥OVER m) = Un({k in Za | (k ¥TIMES m) ¥incin n})
    EQUAL ==> Ord(n ¥OVER m)
--
-- Since the second clause of our theorem is true by Theorem 281, $n ¥OVER m$ cannot be an integer, and since
-- it is an ordinal, it cannot be finite. But since $n$ is finite this is impossible, so our theorem is proved.
--
   (m,n)-->T281 ==> ((n ¥OVER m) ¥incin n) & ((n ¥OVER m) notin Za)
   (m,n)-->T281 ==> ((n ¥OVER m) ¥incin n) & Finite(n ¥OVER m)
(n ¥OVER m)-->T205 ==> false; Discharge ==> QED
--
-- Our next result asserts that the set of integers is closed under arithmetic addition, multiplication, and subtraction.
--
Theorem 283: [Closure properties of arithmetic operators] ((N in Za) & (M in Za)) ¥imp ((N ¥PLUS M in Za) & (N ¥TIMES M in Za) & (N ¥MINUS M in Za)). Proof+:
    Suppose_not(n,m) ==> (n in Za) & (m in Za) & (not((n ¥PLUS m in Za) & (n ¥TIMES m in Za) & (n ¥MINUS m in Za)))
--
-- We simply use the definitions of these operators, which make it immediately clear that
-- the sum, product, and difference are all cardinals, and so must be integers if they are finite.
-- But this has been proved earlier for the sum and product, and is obvious for the difference.
--
    Use_def(¥PLUS) ==> n ¥PLUS m = #({[x,0]: x in n} + {[x,1]: x in m})
    Use_def(¥TIMES) ==> n ¥TIMES m = #(n ¥PROD m)
    Use_def(¥MINUS) ==> n ¥MINUS m = #(n - m)
    ELEM ==> Finite(n) & Finite(m)
    (n,m)-->T241 ==> Finite(n ¥PLUS m)
    (n,m)-->T261 ==> Finite(n ¥TIMES m)
    ELEM ==> n - m ¥incin n
    (n,n - m)-->T189 ==> Finite(n - m)
    (n - m)-->T193 ==> Finite(#(n - m))
    EQUAL ==> Finite(n ¥MINUS m)
    ({[x,0]: x in n} + {[x,1]: x in m})-->T156 ==> Card(#({[x,0]: x in n} + {[x,1]: x in m}))
    EQUAL ==> Card(n ¥PLUS m)
    (n ¥PROD m)-->T156 ==> Card(#(n ¥PROD m))
    EQUAL ==> Card(n ¥TIMES m)
    (n - m)-->T156 ==> Card(#(n - m))
    EQUAL ==> Card(n ¥MINUS m)
    (n ¥PLUS m)-->T206 ==> (n ¥PLUS m) in Za
    (n ¥TIMES m)-->T206 ==> (n ¥TIMES m) in Za
    (n ¥MINUS m)-->T206 ==> false; Discharge ==> QED
--
-- Next we show that the sum $m ¥PLUS n$ of two integers is strictly larger than $n$ if $m /= 0$.
--
Theorem 284: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (N /= 0)) ¥imp (M in (M ¥PLUS N)). Proof:
    Suppose_not(m,n) ==> Stat1: (m in Za) & (n in Za) & Stat2: (n /= 0) & (m notin (m ¥PLUS n))
--
-- For suppose that $m$, $n$ is a counterexample to our assertion. Since the set
-- ${[x,0]: x in m} + {[x,1]: x in n}$ whose cardinality defines the sum is finite,
-- It follows by Theorem 194 that we have only to prove that its second term
-- is not included in its first. But these two terms are clearly disjoint, and the second
-- must be nonempty since $n$ is nonempty. So our assertion is clear.
--
    Use_def(¥PLUS) ==> (m ¥PLUS n) = #({[x,0]: x in m} + {[x,1]: x in n})
    (m,n)-->T216 ==> Stat3: {[x,0]: x in m} * {[x,1]: x in n} = 0
    e-->Stat2 ==> e in n
    Suppose ==> Stat4: [e,1] notin {[x,1]: x in n}
    e-->Stat4 ==> false; Discharge ==> Stat5: {[x,1]: x in n} /= 0
    (Stat5,Stat3)ELEM ==> ({[x,0]: x in m} ¥incin ({[x,0]: x in m} + {[x,1]: x in n})) &
									({[x,0]: x in m} /= {[x,0]: x in m} + {[x,1]: x in n})
	(m,n)-->T283 ==> (m ¥PLUS n) in Za
	(m ¥PLUS n)-->T206 ==> Finite(m ¥PLUS n)
	Use_def(¥PLUS) ==> m ¥PLUS n = #({[x,0]: x in m} + {[x,1]: x in n})
	EQUAL ==> Finite(#({[x,0]: x in m} + {[x,1]: x in n}))
	({[x,0]: x in m} + {[x,1]: x in n})-->T193 ==> Finite({[x,0]: x in m} + {[x,1]: x in n})
    ({[x,0]: x in m} + {[x,1]: x in n},{[x,0]: x in m})-->T194 ==> Stat6: #{[x,0]: x in m} in (m ¥PLUS n)
    (0,m)-->T218 ==> Stat7: #{[x,0]: x in m} = #m
    m-->T207 ==> Stat8: #m = m
    (Stat1,Stat6,Stat7,Stat8*)Discharge ==> QED
--
-- Our next elementary theorem asserts that only the empty set has cardinality $0$.
--
Theorem 285: [Only the nullset has cardinality zero] (#N = 0) ¥imp (N = 0). Proof:
    Suppose_not(n) ==> (#n = 0) & (n /= 0)
--
-- For if #n = 0, then Theorem 159 tell us that n is the range of a map with empty domain,
-- an impossibility.
--
    n-->T147 ==> Stat1: (EXISTS f in OM | (one_1_map(f) & (range(f) = n) & (domain(f) = #n)))
    f-->Stat1 ==> (domain(f) = 0) & (range(f) /= 0)
    f-->T86 ==> false; Discharge ==> QED
--
-- The following theorem asserts that for integers addition is not merely monotonic,
-- but even strictly monotonic, in its second argument.
--
Theorem 286: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (K in N)) ¥imp (M ¥PLUS K in M ¥PLUS N). Proof+:
    Suppose_not(m,n,k) ==> Stat1: (m in Za) & (n in Za) & (k in n) & ((m ¥PLUS k) notin (m ¥PLUS n))
--
-- For suppose that $n$, $m$, $k$ constitute a counterexample to our theorem.
-- Since the set $Za$ of integers is an ordinal, its members $n$ and $k$ are both ordinals and subsets of $Za$.
-- $n$ is plainly different from $k$, and equal to its own cardinality
--
    junk-->T206 ==> Ord(Za)
    (Za,n)-->T12 ==> Ord(n)
    Use_def(Ord) ==> Stat2: (FORALL n in Za | n ¥incin Za) & (FORALL k in n | k ¥incin n)
    (n,k)-->Stat2 ==> Stat3: (n ¥incin Za) & (k ¥incin n)
    n-->T207 ==> Stat4: n = #n
    ELEM ==> k /= n
    ELEM ==> Stat5: #n ¥incin Za
--
-- Since $k$ is a subset of $n$, the set-theoretic facts stated just below are immediate.
-- It follows from this that $#(n - k)$ is an integer no larger than $#n$.
-- Moreover $k$ is a cardinal, and therefore is its own cardinality.
--
    ELEM ==> (n = (n - k) + k) & ((n - k) * k = 0) & (n incs (n - k))
    k-->T207 ==> k = #k
    (n-k,n)-->T170 ==> (#n incs #(n - k))
    (n - k)-->T156 ==> Card(#(n - k)) & Ord(#(n - k))
    n-->T156 ==> Card(#n) & Ord(#n)
    (#n,#(n - k))-->T34 ==> Stat6: ((#(n - k) in #n)) or ((#(n - k) = #n))
    (Stat6,Stat5,Stat1,Stat4*)ELEM ==> #(n - k) in Za
--
-- It follows easily using Theorem 222 that $n = (#(n - k) ¥PLUS k)$,
-- and so by what has been stated above, and a little algebra, it follows that
-- $(m ¥PLUS k) notin ((m ¥PLUS k) ¥PLUS #(n - k))$. But the set $n - k$ is nonempty,
-- and so by Theorem 284 the second of these sets is strictly larger than the first,
-- a contradiction which proves our assertion.
--
    (n - k,k)-->T222 ==> (#(n - k) ¥PLUS #k) = #((n - k) + k)
    ELEM ==> (n - k) + k = n
    EQUAL ==> #n = (#(n - k) ¥PLUS #k)
    (Stat3,Stat4,Stat1*)ELEM ==> k in Za
    EQUAL ==> Stat7: #n = (#(n - k) ¥PLUS k)
    (Stat4,Stat7*)ELEM ==> n = (#(n - k) ¥PLUS k)
    EQUAL ==> (m ¥PLUS k) notin (m ¥PLUS (#(n - k) ¥PLUS k))
    ALGEBRA ==> ((m ¥PLUS (#(n - k) ¥PLUS k)) = ((m ¥PLUS k) ¥PLUS #(n - k))) & ((m ¥PLUS k) in Za)
    ELEM ==> (m ¥PLUS k) notin ((m ¥PLUS k) ¥PLUS #(n - k))
    (n - k)-->T285 ==> #(n - k) /= 0
    (m ¥PLUS k,#(n - k))-->T284 ==> false; Discharge ==> QED
--
Theorem 287: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (K in N)) ¥imp (M ¥PLUS K in M ¥PLUS N). Proof:
    Suppose_not(m,n,k) ==> Stat1: (m in Za) & (n in Za) & (k in n) & ((m ¥PLUS k) notin (m ¥PLUS n))
--
-- For suppose that $n$, $m$, $k$ constitute a counterexample to our theorem.
-- Since the set $Za$ of integers is an ordinal, its members $n$ and $k$ are both ordinals and
-- subsets of $Za$.
-- $n$ is plainly different from $k$, and equal to its own cardinality
--
    T206(*) ==> Stat2: Ord(Za)
    (Za,n)-->T12(Stat1*) ==> Ord(n)
    Use_def(Ord)(Stat2) ==> Stat3: (FORALL n in Za | n ¥incin Za) & (FORALL k in n | k ¥incin n)
    (n,k)-->Stat3(Stat1,Stat1*) ==> Stat4: (n ¥incin Za) & (k ¥incin n) & (k in Za)
    n-->T207(Stat1,Stat4*) ==> Stat5: (n = #n) & (#n ¥incin Za)
--
-- Since $k$ is a subset of $n$, the set-theoretic facts stated just below are immediate.
-- It follows from this that $#(n - k)$ is an integer no larger than $#n$.
-- Moreover $k$ is a cardinal, and therefore is its own cardinality.
--
    (Stat4*)ELEM ==> (n = (n - k) + k) & ((n - k) * k = 0) & (n incs (n - k))
    k-->T207(Stat1,Stat4*) ==> Stat6: k = #k
    (n-k,n)-->T170(*) ==> Stat7: (#n incs #(n - k))
    (n - k)-->T156(*) ==> Card(#(n - k)) & Ord(#(n - k))
    n-->T156(*) ==> Card(#n) & Ord(#n)
    (#n,#(n - k))-->T34(Stat7*) ==> Stat8: (#(n - k) in #n) or (#(n - k) = #n)
    (Stat8,Stat5,Stat1*)ELEM ==> Stat9: #(n - k) in Za
--
-- It follows easily using Theorem 222 that $n = (#(n - k) ¥PLUS k)$,
-- and so by what has been stated above, and a little algebra, it follows that
-- $(m ¥PLUS k) notin ((m ¥PLUS k) ¥PLUS #(n - k))$. But the set $n - k$ is nonempty,
-- and so by Theorem 284 the second of these sets is strictly larger than the first,
-- a contradiction which proves our assertion.
--
    (n - k,k)-->T222(*) ==> Stat10: (#(n - k) ¥PLUS #k) = #((n - k) + k)
    (Stat4,Stat4*)ELEM ==> Stat11: (n - k) + k = n
    ALGEBRA(Stat9,Stat4,Stat1) ==> Stat12: ((m ¥PLUS (#(n - k) ¥PLUS k)) = ((m ¥PLUS k) ¥PLUS #(n - k))) & ((m ¥PLUS k) in Za)
    EQUAL ==> Stat13: (m ¥PLUS k) notin ((m ¥PLUS k) ¥PLUS #(n - k))
    (n - k)-->T285(Stat1,Stat4*) ==> Stat14: #(n - k) /= 0
    (m ¥PLUS k,#(n - k))-->T284 ==> false; Discharge ==> QED
--
-- Sometimes it is more convenient to use the following trivial corollary of Theorem 287.
--
Theorem 288: [Strict monotonicity of addition, 2] ((M in Za) & (N in Za) & (K in N)) ¥imp (K ¥PLUS M in N ¥PLUS M). Proof:
	Suppose_not(m,n,k) ==> AUTO
	(k,m)-->T252 ==> AUTO
	(n,m)-->T252 ==> AUTO
	(m,n,k)-->T287 ==> AUTO
	Discharge ==> QED
--
-- Next we show that for integers (though not for more general cardinals) cancellation of the common second
-- argument of an equality between sums is allowed.
--
Theorem 289: [Cancellation] ((M in Za) & (N in Za) & (K in Za) & (M ¥PLUS K = N ¥PLUS K)) ¥imp (M = N). Proof+:
Suppose_not(m,n,k) ==> AUTO
--
-- Suppose that  $n$, $m$, $k$ are a counterexample to our assertion.
-- Since the integers $m$ and $n$ are obviously ordinals,
-- they are either equal, or one of them is smaller than the other.
--
	(n,m)-->T31 ==> (n in m) or (n = m) or (m in n)
--
-- But since addition is strictly monotone in its second argument by Theorem 286,
-- and commutative by Theorem 252, it is impossible that either $m$ or $n$ should be smaller
-- than the other, so our result follows.
--
	(m,k)-->T252 ==> m ¥PLUS k = k ¥PLUS m
	(n,k)-->T252 ==> AUTO
    Suppose ==> n in m
	(k,m,n)-->T286 ==> false; Discharge ==> AUTO
    Suppose ==> m in n
	(k,n,m)-->T286 ==> false; Discharge ==> AUTO
    Discharge ==> QED
--
-- Our next theorem asserts that cardinal addition is monotone increasing
-- (but not necessarily strictly monotone) in its first argument.
--
Theorem 290: [Monotonicity of addition] (M ¥incin N) ¥imp ((M ¥PLUS K) ¥incin (N ¥PLUS K)). Proof:
    Suppose_not(m,n,k) ==> (m ¥incin n) & (not ((m ¥PLUS k) ¥incin (n ¥PLUS k)))
--
-- Indeed, the set monotonicity principle and the monotonicity of cardinality (Theorem 170)
-- together rule out the existence of a counterexample $n$, $m$, $k$ to our assertion.
--
    Use_def(¥PLUS) ==> not (#({[x,0]: x in m} + {[x,1]: x in k}) ¥incin #({[x,0]: x in n} + {[x,1]: x in k}))
    Set_monot ==> {[x,0]: x in m} ¥incin {[x,0]: x in n}
    ELEM ==> ({[x,0]: x in m} + {[x,1]: x in k}) ¥incin ({[x,0]: x in n} + {[x,1]: x in k})
    ({[x,0]: x in m} + {[x,1]: x in k},{[x,0]: x in n} + {[x,1]: x in k})-->T170 ==> false; Discharge ==> QED
--
-- Next we show, using the monotonicity of addition, that for cardinals $m ¥PLUS n$ is never smaller than $n$.
--
Theorem 291: [Monotonicity of addition, 2] Card(M) ¥imp ((M ¥incin (I ¥PLUS M)) & (M ¥incin (M ¥PLUS I))). Proof:
Suppose_not(m,i) ==> AUTO
	m-->T164 ==> m = #m
	m-->T247 ==> AUTO
	(#m,0)-->T252 ==> AUTO
	EQUAL ==> (0 ¥PLUS m) = m
	(m,i)-->T252 ==> AUTO
(0,i,m)-->T290 ==> false; Discharge ==> QED
--
-- In particular, from the monotonicity of addition it follows that for unsigned integers $m ¥PLUS n$ is never smaller than $n$.
--
Theorem 292: [Monotonicity of addition, 3] (M in Za) ¥imp ((M ¥incin (I ¥PLUS M)) & (M ¥incin (M ¥PLUS I)) & ((M ¥PLUS I) notin M) & ((I ¥PLUS M) notin M)). Proof+:
Suppose_not(m,i) ==> AUTO
(m,i)-->T291 ==> false; Discharge ==> QED
--
-- The following easy result asserts that cardinal multiplication is monotone increasing
-- (but not necessarily strictly monotone) in its first argument.
--
Theorem 293: [Monotonicity of multiplication] (M ¥incin N) ¥imp ((M ¥TIMES K) ¥incin (N ¥TIMES K)). Proof:
Suppose_not(m,n,k) ==> AUTO
--
-- For the set monotonicity principle and the monotonicity of cardinality (Theorem 170)
-- together rule out the existence of a counterexample $n$, $m$, $k$ to our assertion.
--
    Use_def(¥TIMES) ==> not(#(m ¥PROD k) ¥incin #(n ¥PROD k))
    Use_def(¥PROD) ==> not (#{[x,y]: x in m, y in k} ¥incin #{[x,y]: x in n, y in k})
    Set_monot ==> {[x,y]: x in m, y in k} ¥incin {[x,y]: x in n, y in k}
    ({[x,y]: x in m, y in k},{[x,y]: x in n, y in k})-->T170 ==> false; Discharge ==> QED
--
-- The following corollary gives the strict version of the preceding result, in case the sets involved are integers.
--
Theorem 294: [Strict monotonicity of integer multiplication] ((M in N) & (N in Za) & (K in Za) & (K /= 0))
	¥imp ((M ¥TIMES K) in (N ¥TIMES K)). Proof+:
Suppose_not(m,n,k) ==> AUTO
--
-- First we can write $n ¥PROD k$  as the disjoint union $(m ¥PROD k) + ((n - m) ¥PROD k)$,
-- and since the second term in this union is noempty, $m ¥PROD k$ is a proper subset of $n ¥PROD k$.
-- Since all these sets are clearly finite, it follows by Theorem 194 that  $#(m ¥PROD k)$ is smaller than
-- $#(m ¥PROD k)$. By definition of "$¥TIMES$", this is our assertion.
--
	(n,m)-->T13 ==> Stat0a: (m ¥incin n)
	ELEM ==> Stat0: n - m /= 0
	Use_def(¥TIMES) ==> not (#(m ¥PROD k) in #(n ¥PROD k))
	(m,k,n - m)-->T255(Stat0a,Stat0a*) ==> Stat1a: ((m + (n - m)) ¥PROD k = (m ¥PROD k) + ((n - m) ¥PROD k)) &
			((m ¥PROD k) * ((n - m) ¥PROD k) = (m * (n - m)) ¥PROD k) &
			(n = m + (n - m)) & (m * (n - m) = 0)
	EQUAL(Stat1a) ==> Stat1: (n ¥PROD k = (m ¥PROD k) + ((n - m) ¥PROD k)) & ((m ¥PROD k) * ((n - m) ¥PROD k) = 0 ¥PROD k)
	k-->T139 ==> Stat2: (m ¥PROD k) * ((n - m) ¥PROD k) = 0
	(k,n - m)-->T250 ==> #((n - m) ¥PROD k) incs #(n - m)
	(n - m)-->T162(Stat0,Stat0*) ==> #(n - m) /= 0
	ELEM ==> Stat2a: #((n - m) ¥PROD k) /= 0
	((n - m) ¥PROD k)-->T162(Stat2a*) ==> Stat3: ((n - m) ¥PROD k) /= 0
	(Stat1,Stat2,Stat3)ELEM ==> ((m ¥PROD k) ¥incin (n ¥PROD k)) & ((m ¥PROD k) /= (n ¥PROD k))
	(n,k)-->T262 ==> Finite(n ¥PROD k)
	(n ¥PROD k,m ¥PROD k)-->T194 ==> #(m ¥PROD k) in #(n ¥PROD k)
	Discharge ==> QED
--
--
--
Theorem 295: [The sum of non-negative integers is at least as big at each addend] ((X in Za) & (Y in Za)) ¥imp ((X ¥PLUS Y) notin Y). Proof:
    Suppose_not(x,y) ==> AUTO
--
-- Reasoning by contradiction, and assuming that $x,y$ are a counterexample
-- to the assertion which we want to prove...
--
        y-->T254 ==> (0 ¥PLUS y) = y
        (x,y)-->T252 ==> (x ¥PLUS y) = (y ¥PLUS x)
--
-- if we assume that $x=0$,...
--
        Suppose ==> x = 0
            EQUAL ==> (x ¥PLUS y) = y
--
-- we have a conflict with the hypothesis $(x ¥PLUS y) in y$.
--
        Discharge ==> x /= 0
--
-- On the other hand, since the fact $x /= 0$ enables us to exploit
-- Theorem 284, we have again a conflict with the hypothesis that
-- $(x ¥PLUS y) in y$.
--
        (y,x)-->T284 ==> y in (y ¥PLUS x)
    Discharge ==> QED
--
-- We now show that arithmetic addition of integers is strictly monotone
-- in its first argument.
--
Theorem 296: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (K in Za)) ¥imp
			(((M ¥PLUS K) ¥incin (N ¥PLUS K)) ¥eq (M ¥incin N)). Proof+:
Suppose_not(m,n,k) ==> AUTO
--
-- For suppose that $m$, $n$, $k$ constitute a counterexample to our theorem.
-- Since we know that addition is non-strictly monotone, it must be that $(m ¥PLUS k) ¥incin (n ¥PLUS k)$,
-- but that $m$ is not a subest of $n$.
--
    (m,n,k)-->T290 ==> ((m ¥PLUS k) ¥incin (n ¥PLUS k)) & (not(m ¥incin n))
--
-- But since all the quantities involved are integers, and therefore both cardinals and ordinals,
-- $n$ must be smaller than $n$, and so a contradiction results immediately from Theorem 286 and
-- the commutativity of addition (Theorem 252), thereby proving the present theorem.
--
	ALGEBRA ==> (m ¥PLUS k in Za) & (n ¥PLUS k in Za)
    (m,n)-->T35 ==> n in m
    (k,m,n)-->T286 ==> (k ¥PLUS n) in (k ¥PLUS m)
	(k,n)-->T252 ==> AUTO
	(k,m)-->T252 ==> AUTO
Discharge ==> QED
--
-- The following gives yet another version of Theorem 296.
--
Theorem 297: [Strict monotonicity of addition] ((M in Za) & (N in M) & (K in Za)) ¥imp ((N ¥PLUS K) in (M ¥PLUS K)). Proof+:
Suppose_not(m,n,k) ==> AUTO
    (Za,m)-->T13 ==> n in Za
    ALGEBRA ==> (m ¥PLUS k in Za) & (n ¥PLUS k in Za)
    (m ¥PLUS k,n ¥PLUS k)-->T35 ==> (m ¥PLUS k) ¥incin (n ¥PLUS k)
    (m,n,k)-->T296 ==> m ¥incin n
Discharge ==> QED
--
-- Our next lemma tells us that subtracting anything from an integer gives an integer.
--
Theorem 298: [Subtraction Lemma] (N in Za) ¥imp ((N ¥MINUS M) in Za). Proof+:
Suppose_not(n,m) ==> AUTO
	Use_def(¥MINUS) ==> (#(n - m) notin Za)
	ELEM ==> n incs (n - m)
	(n - m)-->T156 ==> Card(#(n - m))
	(n - m)-->T193 ==> Finite(#(n - m))
	(#(n - m))-->T206 ==> false; Discharge ==> QED
--
Theorem 299: [Strict monotonicity of subtraction] ((N in Za) & (M in Za) & (K in N) & (M incs N)) ¥imp
		((M ¥MINUS N) in (M ¥MINUS K)). Proof+:
Suppose_not(n,m,k) ==> AUTO
--
-- For let $n$, $m$, $k$ be a counterexample to our assertion. It then follows
-- by definition that $#(m - n) notin #(m - k)$, so that since all the integers involved must be ordinals
-- $k in n$ implies that $k$ is a proper subset of $n$ by Theorem 34.
--
    Use_def(¥MINUS) ==> #(m - n) notin #(m - k)
	(n,k)-->T34(*) ==> (k ¥incin n) & (k /= n)
--
-- Hence $m - n$ is a proper subset of $m - k$, and since $m$ and thus $m - k$
--
	(m,m - k)-->T189(*) ==> Finite(m - k) & ((m - n) ¥incin (m - k)) & ((m - n) /= (m - k))
(m - k,m - n)-->T194(*) ==> false; Discharge ==> QED
--
Theorem 300: [Monotonicity of subtraction] (K incs M) ¥imp ((K ¥MINUS N) incs (M ¥MINUS N)). Proof:
	Suppose_not(k,m,n) ==> AUTO
	Use_def(¥MINUS) ==> not(#(k - n) incs #(m - n))
	(m - n,k - n)-->T170 ==> false; Discharge ==> QED
--
Theorem 301: [Monotonicity of subtraction, 2] (M incs N) ¥imp ((K ¥MINUS N) incs (K ¥MINUS M)). Proof:
	Suppose_not(m,n,k) ==> AUTO
	Use_def(¥MINUS) ==> not(#(k - n) incs #(k - m))
	(k - m,k - n)-->T170 ==> false; Discharge ==> QED
--
Theorem 302: [Strict monotonicity of subtraction, 2] ((N in Za) & (M in Za) & (K in M) & (K incs N)) ¥imp
		((K ¥MINUS N) in (M ¥MINUS N)). Proof+:
Suppose_not(n,m,k) ==> AUTO
	m-->T164(*) ==> m = #m
	ELEM ==> k in Za
	k-->T164 ==> k = #k
	ALGEBRA ==> ((k ¥MINUS n) in Za) & ((m ¥MINUS n) in Za)
	(m,k)-->T13(*) ==> k ¥incin m
	(m,k,n)-->T300(*) ==> (k ¥MINUS n) ¥incin (m ¥MINUS n)
	(m ¥MINUS n,k ¥MINUS n)-->T34(*) ==> (k ¥MINUS n) = (m ¥MINUS n)
	EQUAL ==> (k ¥MINUS n) ¥PLUS n = (m ¥MINUS n) ¥PLUS n
	(n,k)-->T272(*) ==> (k ¥MINUS n) ¥PLUS n = #k
	(n,m)-->T272(*) ==> (m ¥MINUS n) ¥PLUS n = #m
	Discharge ==> QED
--
-- For let $n$, $m$, $k$ be a counterexample to our assertion. It then follows
--
-- The next theorem tells us that two successive subtractions are equivalent to subtraction of a sum,
-- at least in the positive integer case which it covers.
--
Theorem 303: [Addition-subtraction commutativity] ((M in Za) & (N in Za) & (K in Za) & (N incs M) & ((N ¥MINUS M) incs K)) ¥imp
	((N incs (M ¥PLUS K)) & (N ¥MINUS (M ¥PLUS K) = (N ¥MINUS M) ¥MINUS K)). Proof:
Suppose_not(m,n,k) ==> AUTO
--
-- For consider a potential counterexample $n,m,k$ to our assertion. Plainly $n ¥MINUS m$ and
-- $((n ¥MINUS m) ¥MINUS k)$ are integers, and so all the quantities we consider are cardinals.
--
	ALGEBRA ==> ((n ¥MINUS m) in Za) & (((n ¥MINUS m) ¥MINUS k) in Za)
	n-->T207(*) ==> n = #n
	m-->T207(*) ==> m = #m
	k-->T207(*) ==> k = #k
	(n ¥MINUS m)-->T207(*) ==> n ¥MINUS m = #(n ¥MINUS m)
--
-- Theorem 271 used twice, plus a bit of algebra, tells us that
-- $n = ((n ¥MINUS m) ¥MINUS k) ¥PLUS (k ¥PLUS m)$, and so,
-- by the monotonicity of addition, $n$ must include $m ¥PLUS k$.
--
	(m,n)-->T271(*) ==> #n = #m ¥PLUS (n ¥MINUS m)
    EQUAL ==> n = m ¥PLUS (n ¥MINUS m)
    ALGEBRA ==> n = (n ¥MINUS m) ¥PLUS m
	(k,n ¥MINUS m)-->T271(*) ==> #(n ¥MINUS m) = #k ¥PLUS ((n ¥MINUS m) ¥MINUS k)
    EQUAL ==> (n ¥MINUS m) = k ¥PLUS ((n ¥MINUS m) ¥MINUS k)
    ALGEBRA ==> (n ¥MINUS m) = ((n ¥MINUS m) ¥MINUS k) ¥PLUS k
    EQUAL ==> n = (((n ¥MINUS m) ¥MINUS k) ¥PLUS k) ¥PLUS m
    ALGEBRA ==> n = ((n ¥MINUS m) ¥MINUS k) ¥PLUS (k ¥PLUS m)
    ELEM ==> ((n ¥MINUS m) ¥MINUS k) incs 0
	ALGEBRA ==> Stat1: (0 in Za) & ((m ¥PLUS k) in Za) & ((k ¥PLUS m) in Za) &
		(((n ¥MINUS m) ¥MINUS k) in Za) &
		(n ¥MINUS (m ¥PLUS k) in Za) & ((n ¥MINUS m) ¥MINUS k in Za)
	(0,(n ¥MINUS m) ¥MINUS k,(k ¥PLUS m))-->T296(*) ==> n incs (0 ¥PLUS (k ¥PLUS m))
    ALGEBRA ==> (0 ¥PLUS (k ¥PLUS m)) = (m ¥PLUS k)
    ELEM ==> n incs (m ¥PLUS k)
	(m ¥PLUS k)-->T207(Stat1*) ==> (m ¥PLUS k) = #(m ¥PLUS k)
--
-- Therefore, using Theorem 271 once more, we see that
-- $n = (n ¥MINUS (m ¥PLUS k)) ¥PLUS (k ¥PLUS m)$ also.
-- Theorem 289 now lets us cancel $k ¥PLUS m$ from these two expressions for $n$,
-- thereby obtaining te formula asserted by the present theorem.
--
	(m ¥PLUS k,n)-->T271(*) ==> n = #(m ¥PLUS k) ¥PLUS (n ¥MINUS (m ¥PLUS k))
    EQUAL ==> n = (m ¥PLUS k) ¥PLUS (n ¥MINUS (m ¥PLUS k))
    ALGEBRA ==> n = (n ¥MINUS (m ¥PLUS k)) ¥PLUS (k ¥PLUS m)
(n ¥MINUS (m ¥PLUS k),(n ¥MINUS m) ¥MINUS k,k ¥PLUS m)-->T289(*) ==> false; Discharge ==> QED
--
--
Theorem 304: [Subtraction reverses addition] ((M in Za) & (N in Za)) ¥imp ((M ¥PLUS N) ¥MINUS N = M). Proof:
    Suppose_not(m,n) ==> (m in Za) & (n in Za) & ((m ¥PLUS n) ¥MINUS n /= m)
--
-- For suppose that $m$, $n$ is a counterexample to our assertion. $m ¥PLUS n$ and
-- $((m ¥PLUS n) ¥MINUS n)$, and $m ¥PLUS n$ are easily seen to be integers.
-- Since addition is monotone and $0 ¥PLUS n = n$, we have $n ¥incin (m ¥PLUS n)$.
--
    ALGEBRA ==> m ¥PLUS n in Za
    (m ¥PLUS n,n)-->T283 ==> ((m ¥PLUS n) ¥MINUS n) in Za
    (n,m)-->T292 ==> n ¥incin (m ¥PLUS n)
--
-- The subtraction lemma (Theorem 271) now tells us that $#(m ¥PLUS n) = #n ¥PLUS ((m ¥PLUS n) ¥MINUS n)$,
-- and since $n$ and $(m ¥PLUS n)$ are cardinals, we get $m ¥PLUS n = n ¥PLUS ((m ¥PLUS n) ¥MINUS n)$
-- = $((m ¥PLUS n) ¥MINUS n) ¥PLUS n$, from which $(m ¥PLUS n) ¥MINUS n = m$ follows by cancellation,
-- proving our theorem.
--
    (n,m ¥PLUS n)-->T271 ==> #(m ¥PLUS n) = #n ¥PLUS ((m ¥PLUS n) ¥MINUS n)
    n-->T207 ==> n = #n
    (m ¥PLUS n)-->T207 ==> (m ¥PLUS n) = #(m ¥PLUS n)
    EQUAL ==> #(m ¥PLUS n) = n ¥PLUS ((m ¥PLUS n) ¥MINUS n)
    EQUAL ==> (m ¥PLUS n) = n ¥PLUS ((m ¥PLUS n) ¥MINUS n)
    ALGEBRA ==> m ¥PLUS n = ((m ¥PLUS n) ¥MINUS n) ¥PLUS n
    (m,(m ¥PLUS n) ¥MINUS n,n)-->T289 ==> false; Discharge ==> QED
--
--
--
Theorem 304a: [Over finite sets, difference corresponds to subtraction] (Finite(N) & (M ¥incin N)) ¥imp (#N ¥MINUS #M = #(N - M)). Proof:
Suppose_not(n0,m0) ==> AUTO
	ELEM ==> Finite(#(n0 - m0)) & Finite(#m0)
	m0-->T156(*) ==> Card(#m0)
	(n0 - m0)-->T156(*) ==> Card(#(n0 - m0))
	(#(n0 - m0))-->T206(*) ==> #(n0 - m0) in Za
	(#m0)-->T206(*) ==> #m0 in Za
	(m0,n0)-->T272 ==> #n0 = (n0 ¥MINUS m0) ¥PLUS m0
	Use_def(¥MINUS) ==> (n0 ¥MINUS m0) = #(n0 - m0)
	(#(n0 - m0),m0)-->T226 ==> AUTO
	EQUAL ==> #n0 ¥MINUS #m0 = (#(n0 - m0) ¥PLUS #m0) ¥MINUS #m0
	(#(n0 - m0),#m0)-->T304(*) ==> false
	Discharge ==> QED
	
--
-- Our next, entirely elementary, lemma simply tells us that the cardinality of any singleton is 1.
--
Theorem 305: [Singletons have one element] #{S} = {0}. Proof:
    Suppose_not(s) ==> #{s} /= {0}
--
-- For {0}, as the sucessor of 0, is clearly a cardinal, and so our assertion is
-- equivalent to #{s} /= #{0}.
--
    T211 ==> Card(1)
    Use_def(next) ==> next(0) = {0}
    Use_def(1) ==> 1 = next(0)
    Use_def(next) ==> 1 = 0 + {0}
    ELEM ==> 1 = {0}
    EQUAL ==> Card({0})
    {0}-->T164 ==> #{0} = {0}
--
-- But the map {[s,0]} evidently sends {s} to {0} and is 1-1,
-- our assertion is immediate from Theorem 157.
--
    Use_def(domain) ==> Stat1: domain({[s,0]}) = {car(x): x in {[s,0]}}
    SIMPLF ==> {car(x): x in {[s,0]}} = {car([s,0])}
    ELEM ==> {car([s,0])} = {s}
    (Stat1*)ELEM ==> domain({[s,0]}) = {s}
    Use_def(range) ==> Stat2: range({[s,0]}) = {cdr(x): x in {[s,0]}}
    SIMPLF(Stat2*) ==> Stat3: range({[s,0]}) = {cdr([s,0])}
    (Stat3)ELEM ==> range({[s,0]}) = {0}
    TELEM ==> one_1_map({[s,0]})
    {[s,0]}-->T157 ==> #domain({[s,0]}) = #range({[s,0]})
    EQUAL ==> #{s} = #{0}
    Discharge ==> QED
--
--
--
Theorem 305a: [Over finite sets, difference corresponds to subtraction, 2] (Finite(N) & (M in N)) ¥imp (#N ¥MINUS 1 = #(N - {M})). Proof:
Suppose_not(n0,m0) ==> AUTO
	TELEM ==> #{m0} = 1
	(n0,{m0})-->T304a ==> #n0 ¥MINUS #{m0} = #(n0 - {m0})
	EQUAL ==> false
	Discharge ==> QED
--
-- Our next, entirely elementary, lemma simply tells us that the cardinality of any
-- subset of a singleton is either 0 or 1.
--
Theorem 306: ({X} incs Y) ¥imp (#Y in 2). Proof:
Suppose_not(x0,y0) ==> AUTO
	TELEM ==> (2 = {0,1}) & (#{x0} = 1)
	Suppose ==> y0 = 0
		y0-->T162(*) ==> false
	Discharge ==> (y0 = {x0}) & (#y0 /= 1)
	EQUAL ==> false
	Discharge ==> QED
--
-- The following lemma characterizes sets of cardinality 1 as being
-- those sets $x$ which are formed by their own $arb(x)$ alone.
--
Theorem 307: (#X = 1) ¥eq (X = {arb(X)}). Proof:
Suppose_not(x0) ==> AUTO
--
-- For, assuming the contrary, we derive a contradiction
-- by arguing as follows. Recall the definition of the
-- number 1 and the fact that all singletons have cardinality 1.
--
	TELEM ==> 1 = {0}
	(arb(x0))-->T305 ==> #{arb(x0)} = {0}
--
-- We readily see that the failing implication must be
--	$(#X = 1) ¥imp (X = {arb(X)})$.
--
	Suppose ==> (x0 = {arb(x0)}) & (#x0 /= 1)
		EQUAL ==> false
	Discharge ==> (#x0 = {0}) & (x0 /= {arb(x0)})
--
-- However, we know that a set $x0$ of non-null cardinality
-- must be non-null, and therefore meets the condition
--	$arb(x0) in x0$.
-- In the case at hand, since we are assuming that $x0$ has finite
-- cardinality (specifically, 1), it follows that $x0$ is finite:
-- therefore, if the inclusion $x0 incs {arb(x0)}$ could be strict
-- then the cardinality $#x0$ would exceed 1.
--
	0-->T201 ==> Finite({0})
	EQUAL ==> Finite(#x0)
	x0-->T193 ==> Finite(x0)
	x0-->T162 ==> arb(x0) in x0
	(x0,{arb(x0)})-->T235 ==> false
	Discharge ==> QED
--
-- Our next theorem combines preceding results to show that if $m$ and $n$ are integers,
-- $n$ being nonzero, then $m$ can be written as a sum $n = q ¥TIMES n ¥PLUS r$, where $q$ is the
-- integer quotient of $m$ by $n$, and $r$ is a remainder less than $n$.
--
Theorem 308: [Integer division with remainder] ((M in Za) & (N in Za) & (N /= 0)) ¥imp
	(((M ¥OVER N) in Za) & (M incs ((M ¥OVER N) ¥TIMES N)) & ((M ¥MOD N) in N)). Proof+:
    Suppose_not(m,n) ==> Stat1: (m in Za) & (n IN Za) & (n /= 0) &
	(not(((m ¥OVER n) in Za) & (m incs ((m ¥OVER n) ¥TIMES n)) & ((m ¥MOD n) in n)))
--
-- For suppose that our theorem has a counterexample $m$, $n$.  Consider the set $s$ of all integers
-- of the form $m ¥MINUS (p ¥TIMES n)$, where $p$ ranges over all integers such that $(p ¥TIMES n)$
-- is no larger than $n$. This set cannot be empty, since by setting $p = 0$ we see that
 -- $m$ must belong to it.
--
	n-->T207(*) ==> n = #n
	m-->T207(*) ==> Stat2: m = #m
    Suppose ==> Stat3: {m ¥MINUS (p ¥TIMES n): p in Za | m incs (p ¥TIMES n)} = 0
		ALGEBRA ==> (0 in Za) & (0 ¥TIMES n = 0)
    0-->Stat3(Stat3*) ==> m /= m ¥MINUS (0 ¥TIMES n)
    EQUAL ==> m /= m ¥MINUS 0
		m-->T268(*) ==> m ¥MINUS 0 = m
    Discharge ==> {m ¥MINUS (p ¥TIMES n): p in Za | m incs (p ¥TIMES n)} /= 0
--
-- Let $r = q ¥TIMES n$ be the smallest integer in the set $s$, so that by the axiom of choice
-- $r$ belongs to and is disjoint from $s$. q and r are plainly integers.
--
    Loc_def ==> r = arb({m ¥MINUS (p ¥TIMES n): p in Za | m incs (p ¥TIMES n)})
    {m ¥MINUS (q ¥TIMES n): q in Za | m incs (q ¥TIMES n)}-->T0 ==>
	Stat4: (r in {m ¥MINUS (p ¥TIMES n): p in Za | m incs (p ¥TIMES n)}) &
	(r * {m ¥MINUS (p ¥TIMES n): p in Za | m incs (p ¥TIMES n)} = 0)
    q-->Stat4 ==> Stat5: (r = m ¥MINUS (q ¥TIMES n)) & (q in Za) & (m incs (q ¥TIMES n))
	q-->T207(*) ==> Stat6: q = #q
	ALGEBRA ==> ((q ¥TIMES n) in Za) & (r in Za)
--
-- If $r$ is not smaller than $n$, it follows by Theorem 303 that $m$ is at least as large as $(q ¥TIMES n) ¥PLUS n$,
-- and that $m ¥MINUS ((q ¥TIMES n) ¥PLUS n) = (m ¥MINUS (q ¥TIMES n)) ¥MINUS n$. It follows, using a little algebra,
-- that $m$ is at least as large as $((q ¥PLUS 1) ¥TIMES n)$, so $(m ¥MINUS ((q ¥PLUS 1) ¥TIMES n))$
-- must belong to the set $s$ considered above. Since $r = arb(s)$, it follows that
-- $(m ¥MINUS ((q ¥PLUS 1) ¥TIMES n)) = r ¥MINUS n$ cannot be a member of $r$, contradicting Theorem 284. Hence
-- we must have $r in n$.
--
	r-->T207 ==> r = #r
    Suppose ==> r incs n
    EQUAL ==> (m ¥MINUS (q ¥TIMES n)) incs n
		(q ¥TIMES n,m,n)-->T303(*) ==> (m incs ((q ¥TIMES n) ¥PLUS n)) &
    								(m ¥MINUS ((q ¥TIMES n) ¥PLUS n) = (m ¥MINUS (q ¥TIMES n)) ¥MINUS n)
	ALGEBRA ==> (q ¥TIMES n) ¥PLUS n = ((q ¥PLUS 1) ¥TIMES n)
	EQUAL ==> m incs ((q ¥PLUS 1) ¥TIMES n)
	ALGEBRA ==> (q ¥PLUS 1) in Za
		Suppose ==> Stat7: (m ¥MINUS ((q ¥PLUS 1) ¥TIMES n)) notin
				{m ¥MINUS (p ¥TIMES n): p in Za | m incs (p ¥TIMES n)}
			(q ¥PLUS 1)-->Stat7 ==> not(((m ¥MINUS ((q ¥PLUS 1) ¥TIMES n)) =
				(m ¥MINUS ((q ¥PLUS 1) ¥TIMES n))) &
						((q ¥PLUS 1) in Za) & (m incs ((q ¥PLUS 1) ¥TIMES n)))
		Discharge ==> (m ¥MINUS ((q ¥PLUS 1) ¥TIMES n)) in
			{m ¥MINUS (p ¥TIMES n): p in Za | m incs (p ¥TIMES n)}
	ELEM ==> (m ¥MINUS ((q ¥PLUS 1) ¥TIMES n)) notin r
	EQUAL ==> ((m ¥MINUS (q ¥TIMES n)) ¥MINUS n) notin r
	EQUAL ==> Stat8: (r ¥MINUS n) notin r
		(n,r)-->T271(*) ==> #r = #n ¥PLUS (r ¥MINUS n)
	EQUAL ==> r = n ¥PLUS (r ¥MINUS n)
	ALGEBRA ==> r = (r ¥MINUS n) ¥PLUS n
		(r,n)-->T283(*) ==> r ¥MINUS n in Za
		(r ¥MINUS n,n)-->T284(*) ==> Stat9: (r ¥MINUS n) in r
	(Stat8,Stat9)Discharge ==> Stat9a: not(r incs n)
	ELEM ==> Ord(n) & Ord(r)
	(n,r)-->T35(Stat9a*) ==> Stat10: r in n
--
-- Our next aim is to show that $q$ = $m ¥OVER n$ = $Un({k in Za | (k ¥TIMES n) ¥incin m})$. To this end we
-- first note that $q in {k in Za | (k ¥TIMES n) ¥incin m}$, and therefore every member of $q$ belongs to
-- $Un({k in Za | (k ¥TIMES n) ¥incin m})$, so that $q$ is included in this set.
--
	Suppose ==> Stat11: q notin {k in Za | (k ¥TIMES n) ¥incin m}
	()-->Stat11 ==> false; Discharge ==> q in {k in Za | (k ¥TIMES n) ¥incin m}
	Suppose ==> Stat12: not (Un({k in Za | (k ¥TIMES n) ¥incin m}) incs q)
	c-->Stat12 ==> (c in q) & (c notin Un({k in Za | (k ¥TIMES n) ¥incin m}))
	Use_def(Un) ==> Stat13: c notin {v: u in {k in Za | (k ¥TIMES n) ¥incin m}, v in u}
	SIMPLF ==> {v: u in {k in Za | (k ¥TIMES n) ¥incin m}, v in u} = {v: k in Za , v in k | (k ¥TIMES n) ¥incin m}
	(Stat13)ELEM ==> Stat14: c notin {v: k in Za , v in k | (k ¥TIMES n) ¥incin m}
	(q,c)-->Stat14 ==> false; Discharge ==> Un({k in Za | (k ¥TIMES n) ¥incin m}) incs q
--
-- Next suppose that $Un({k in Za | (k ¥TIMES n) ¥incin m})$ is not included in $q$, so that
--
	Suppose ==> Stat15: not (Un({k in Za | (k ¥TIMES n) ¥incin m})) ¥incin q
	d-->Stat15 ==> (d in Un({k in Za | (k ¥TIMES n) ¥incin m})) & (d notin q)
	Use_def(Un) ==> d in {v: u in {k in Za | (k ¥TIMES n) ¥incin m}, v in u}
	SIMPLF ==> Stat16: d in {v: k in Za , v in k | (k ¥TIMES n) ¥incin m}
	(k1,v1)-->Stat16 ==> Stat17: (v1 notin q) & (k1 in Za) & (v1 in k1) & ((k1 ¥TIMES n) ¥incin m)
		(k1,v1)-->T13(*) ==> Stat19: k1 incs v1
		(q,v1)-->T31(*) ==> (q in v1) or (q = v1)
		(Stat17*)ELEM ==> q in k1
		(q,k1,n)-->T294(*) ==> (q ¥TIMES n) in (k1 ¥TIMES n)
	ALGEBRA ==> k1 ¥TIMES n in Za
		(k1 ¥TIMES n,m,q ¥TIMES n)-->T299(*) ==> Stat20: m ¥MINUS (k1 ¥TIMES n) in m ¥MINUS (q ¥TIMES n)
	(Stat5,Stat20)ELEM ==> Stat21: m ¥MINUS (k1 ¥TIMES n) in r
	Suppose ==> Stat22: m ¥MINUS (k1 ¥TIMES n) notin {m ¥MINUS (p ¥TIMES n): p in Za | m incs (p ¥TIMES n)}
	k1-->Stat22 ==> false; Discharge ==> Stat23: m ¥MINUS (k1 ¥TIMES n) in {m ¥MINUS (p ¥TIMES n): p in Za | m incs (p ¥TIMES n)}
--
-- This contradiction proves that $q$ = $Un({k in Za | (k ¥TIMES n) ¥incin m})$ as asserted,
-- and then by definition $q$ = $m ¥OVER n$ and $m ¥MOD n = r$
--
	(Stat4,Stat23,Stat21)Discharge ==> q = Un({k in Za | (k ¥TIMES n) ¥incin m})
	Use_def(¥OVER) ==> Stat24: q = m ¥OVER n
	EQUAL(Stat5) ==> Stat25: (m ¥OVER n in Za) & (m incs ((m ¥OVER n) ¥TIMES n))
	EQUAL(Stat5,Stat24) ==> (r = m ¥MINUS ((m ¥OVER n) ¥TIMES n))
	Use_def(¥MOD) ==> Stat26: m ¥MOD n = r
	EQUAL(Stat10,Stat26) ==> Stat27: (m ¥MOD n) in n
    (Stat1,Stat25,Stat27)Discharge ==> QED
--
-- Our next theorem states and generalizes the fact that if the product
-- of two cardinal numbers is zero, one of them must be zero.
--
Theorem 309: [If an integer product is zero, one of its factors is 0] (N ¥TIMES M = 0) ¥eq (N = 0 or M = 0). Proof:
    Suppose_not(n,m) ==> (((n ¥TIMES m = 0) & (n /= 0) & (m /= 0)) or
    						((n = 0 or m = 0) & (not (n ¥TIMES m = 0))))
    (n,m)-->T230 ==> (n ¥TIMES m) = (#n ¥TIMES #m)
	EQUAL ==> (((#n ¥TIMES #m = 0) & (n /= 0) & (m /= 0)) or
    						((n = 0 or m = 0) & (not (#n ¥TIMES #m = 0))))--
-- For let $n$ and $m$ form a counterexample to our assertion, and first suppose that
-- $#n ¥TIMES #m is 0$, but neither $n$ nor $m$ is $0$, so that these sets contain singletons
-- ${c}$ and ${d}$ respectively. Then by Theorem 170 and Theorem 305, ${0}$ is a subset of both $#n$ and $#m$.
--
    Suppose ==> (#n ¥TIMES #m = 0) & Stat1: (n /= 0) & Stat2: (m /= 0)
    c-->Stat1 ==> {c} ¥incin n
    d-->Stat2 ==> {d} ¥incin m
    ({c},n)-->T170 ==> #{c} ¥incin #n
    ({d},m)-->T170 ==> #{d} ¥incin #m
    d-->T305 ==> Stat3: {0} ¥incin #m
    c-->T305 ==> Stat4: {0} ¥incin #n
--
-- It follows easily that $[0,0]$ is a member of $(#n ¥PROD #m)$, which must therefore
-- have cardinality at least $1$. This contradiction shows that if our theorem is false,
-- one of $m$ and $n$ must be $0$, while $#n ¥TIMES #m$ is nonzero.
--
    Suppose ==> [0,0] notin #n ¥PROD #m
    Use_def(¥PROD) ==> Stat5: [0,0] notin {[x,y]: x in #n, y in #m}
    (0,0)-->Stat5 ==> Stat6: not(([0,0] = [0,0]) & (0 in #n) & (0 in #m))
    (Stat3,Stat4,Stat6)Discharge ==> [0,0] in #n ¥PROD #m
    ELEM ==> {[0,0]} ¥incin (#n ¥PROD #m)
    Set_monot ==> #{[0,0]} ¥incin #(#n ¥PROD #m)
    ([0,0])-->T305 ==> {0} ¥incin #(#n ¥PROD #m)
    Use_def(¥TIMES) ==> {0} ¥incin (#n ¥TIMES #m)
    Discharge ==> (n = 0 or m = 0) & (#n ¥TIMES #m /= 0)
--
-- But now our conclusion follows immediately from the fact that $0 ¥TIMES m = #(0 ¥PROD #m)$
-- and $m ¥TIMES 0$ are both $0$.
--
    T188 ==> Card(0)
    0-->T164 ==> #0 = 0
    Suppose ==> n = 0
    EQUAL ==> #n = #0
    EQUAL ==> 0 ¥TIMES #m /= 0
    (#m)-->T246 ==> false; Discharge ==> m = 0
    EQUAL ==> #m = #0
    EQUAL ==> not (#n ¥TIMES #0 = 0)
    (n,0)-->T230 ==> not (n ¥TIMES 0 = 0)
    n-->T245 ==> false; Discharge ==> QED
--
-- The following very easy result tells us that arithmetic subtraction
-- is monotone increasing in its first parameter.
--
Theorem 310: [Subtraction monotonicity lemma] (N incs M) ¥imp ((N ¥MINUS K) incs (M ¥MINUS K)). Proof:
    Suppose_not(n,m,k) ==> (n incs m) & (not((n ¥MINUS k) incs (m ¥MINUS k)))
--
-- For otherwise, by definition of subtraction and the monotonicity of cardinality
-- we would have $not (n - k incs m - k)$, which is impossible.
--
    Use_def(¥MINUS) ==> not(#(n - k) incs #(m - k))
    (m - k,n - k)-->T170 ==> not (n - k incs m - k)
    Discharge ==> QED
--
-- Next we show that if $m$ is a subset of $m$ and $n$ is finite, the cardinality of
-- the difference set $n - m$ is the cardinality of the difference of the cardinalities $#n$ and $#m$.
--
Theorem 311: [Cardinality of set difference] (Finite(N) & (N incs M)) ¥imp (#(N - M) = #(#N - #M)). Proof:
    Suppose_not(n,m) ==> Finite(n) & (n incs m) & (#(n - m) /= #(#n - #m))
--
-- For let $n$, $m$ be a counterexample. Since $n incs m$, we must have $#n incs #m$.
-- Our aim is to prove that $#(n - m) ¥PLUS #m /= #(#n - #m) ¥PLUS #m$ and then use
-- cancellation to obtain the stated conclusion of our theorem.
-- We begin by using Theorem 271 twice to derive $#m ¥PLUS #(#n - #m) = #m ¥PLUS (n ¥MINUS m)$.
--
	(m,n)-->T170 ==> #n incs #m
	Use_def(¥MINUS) ==> #(n - m) = n ¥MINUS m
	(m,n)-->T271 ==> #n = #m ¥PLUS (n ¥MINUS m)
	EQUAL ==> #n = #m ¥PLUS #(n - m)
	Use_def(¥MINUS) ==> #(#n - #m) = #n ¥MINUS #m
	(#m,#n)-->T271 ==> ##n = ##m ¥PLUS (#n ¥MINUS #m)
	EQUAL ==> ##n = ##m ¥PLUS #(#n - #m)
	n-->T166 ==> ##n = #n
	m-->T166 ==> ##m = #m
--
-- But since all the cardinalities involved in the equation mentioned above are integers,
-- the rules of algebra apply and make it clear that the rule of cancellation applies also.
-- Thus our conclusion follows.
--
	EQUAL ==> #n = #m ¥PLUS #(#n - #m)
	n-->T193 ==> Finite(#n)
	(n,n - m)-->T189 ==> Finite(n - m) & Finite(m)
	(#n,#n - #m)-->T189 ==> Finite(#n - #m)
	(n - m)-->T193 ==> Finite(#(n - m))
	(#n - #m)-->T193 ==> Finite(#(#n - #m))
	(n - m)-->T156 ==> Card(#(n - m))
 	m-->T156 ==> Card(#m)
 	(#n - #m)-->T156 ==> Card(#(#n - #m))
	(#m)-->T206 ==> #m in Za
 	(#(n - m))-->T206 ==> #(n - m) in Za
 	(#(#n - #m))-->T206 ==> #(#n - #m) in Za
	ALGEBRA ==> ((#m ¥PLUS #(n - m) = #(n - m) ¥PLUS #m)) & ((#m ¥PLUS #(#n - #m) = #(#n - #m) ¥PLUS #m))
	ELEM ==> Stat1: #(n - m) ¥PLUS #m = #(#n - #m) ¥PLUS #m
	(Stat1*)ELEM ==> (n incs n - m) & (#n incs #n - #m)
   	(#(n - m),#(#n - #m),#m)-->T289 ==> false; Discharge ==> QED
--
--
-- The following theorem states the fact that integer addition is strictly monotone in its first argument.
--
Theorem 312: [Strong monotonicity of integer addition] ((N in Za) & (M in Za) & (K in Za)) ¥imp ((N incs M) ¥eq ((N ¥PLUS K) incs (M ¥PLUS K))). Proof:
    Suppose_not(n,m,k) ==> (n in Za) & (m in Za) & (k in Za) & (not((n incs m) ¥eq ((n ¥PLUS k) incs (m ¥PLUS k))))
--
-- Suppose that $n$, $m$, $k$ are a counterexample to our assertion. If $n incs m$
-- our conclusion follows immediately from the definition of addition and the principle of set monotonicity.
--
    Suppose ==> (n incs m) & (not((n ¥PLUS k) incs (m ¥PLUS k)))
    Use_def(¥PLUS) ==> not(#({[x,0]: x in n} + {[x,1]: x in k}) incs #({[x,0]: x in m} + {[x,1]: x in k}))
    ({[x,0]: x in m} + {[x,1]: x in k},{[x,0]: x in n} + {[x,1]: x in k})-->T170 ==>
	not(({[x,0]: x in n} + {[x,1]: x in k}) incs ({[x,0]: x in m} + {[x,1]: x in k}))
    Set_monot ==> {[x,0]: x in n} incs {[x,0]: x in m}
    Discharge ==> (not(n incs m)) & ((n ¥PLUS k) incs (m ¥PLUS k))
--
-- Thus we must have $(n ¥PLUS k) incs (m ¥PLUS k)$ but $not (n incs m)$, which since
-- addition is (nonstrictly) monotone is impossible by Theorem 304.
--
    ((n ¥PLUS k),(m ¥PLUS k),k)-->T310 ==> ((n ¥PLUS k) ¥MINUS k) incs ((m ¥PLUS k) ¥MINUS k)
    (n,k)-->T304 ==> n incs ((m ¥PLUS k) ¥MINUS k)
    (m,k)-->T304 ==> false; Discharge ==> QED
--
-- Our next, very easy result states the inverse relationship between arithmetic addition and
-- subtraction in a very general but slightly unusual way.
--
Theorem 313: [Addition reverses subtraction] (N incs M) ¥imp (#N = #M ¥PLUS #(N - M)). Proof:
    Suppose_not(n,m) ==> (n incs m) & (#n /= #m ¥PLUS #(n - m))
--
-- For if not we must have #n /= #m ¥PLUS #(n - m), and so using the definition of subtraction
-- we find a contradiction With Theorem 271.
--
    (m,n)-->T271 ==> #n = #m ¥PLUS (n ¥MINUS m)
    Use_def(¥MINUS) ==> (n ¥MINUS m) = #(n - m)
    EQUAL ==> #(n ¥MINUS m) = ##(n - m)
    (n - m)-->T166 ==> #(n ¥MINUS m) = #(n - m)
    EQUAL ==> false; Discharge ==> QED
--
-- Our next result states an elementary arithmetic relationship between integer subtraction and addition,
-- but only in the case in which all the quantities involved are non-negative.
--
Theorem 314: [Addition-subtraction commutativity, 2] ((N in Za) & (M in Za) & (K in Za) & (N incs M)) ¥imp ((N ¥PLUS K) ¥MINUS (M ¥PLUS K) = N ¥MINUS M). Proof:
    Suppose_not(n,m,k) ==> (n in Za) & (m in Za) & (k in Za) & (n incs m) & ((n ¥PLUS k) ¥MINUS (m ¥PLUS k) /= n ¥MINUS m)
--
-- For suppose that $n$, $m$, $k$ are a couterexample to our assertion.
-- Since all the quantities involved are integers, we can reassociate to write
-- $(n ¥MINUS m) ¥PLUS (m ¥PLUS k)$ as $((n ¥MINUS m) ¥PLUS m) ¥PLUS k$,
-- and then use Theorem 272 to reduce this last quantity to $n ¥PLUS k$.
--
	(n,k)-->T283 ==> (n ¥PLUS k) in Za
 	(m,k)-->T283 ==> (m ¥PLUS k) in Za
 	(n,m)-->T283 ==> (n ¥MINUS m) in Za
 	(n ¥PLUS k,m ¥PLUS k)-->T283 ==> ((n ¥PLUS k) ¥MINUS (m ¥PLUS k)) in Za
 	ALGEBRA ==> (n ¥MINUS m) ¥PLUS (m ¥PLUS k) = ((n ¥MINUS m) ¥PLUS m) ¥PLUS k
    n-->T207 ==> n = #n
    (n ¥PLUS k)-->T207 ==> (n ¥PLUS k) = #(n ¥PLUS k)
 	(m,n)-->T272 ==> (n ¥MINUS m) ¥PLUS m = n
	EQUAL ==> (n ¥MINUS m) ¥PLUS (m ¥PLUS k) = (n ¥PLUS k)
	(m,n,k)-->T290 ==> (n ¥PLUS k) incs (m ¥PLUS k)
--
-- Now, subtracting $m ¥PLUS k$ from $n ¥PLUS k$ and then immediately adding it back, we find that
--
-- 	$((n ¥MINUS m) ¥PLUS (m ¥PLUS k) ¥MINUS (m ¥PLUS k)) ¥PLUS (m ¥PLUS k) = (n ¥PLUS k)$
--
-- so that our conclusion follows immediately from Theorem 289.
--
	(m ¥PLUS k,n ¥PLUS k)-->T272 ==> ((n ¥PLUS k) ¥MINUS (m ¥PLUS k)) ¥PLUS (m ¥PLUS k) = (n ¥PLUS k)
	((n ¥PLUS k) ¥MINUS (m ¥PLUS k),n ¥MINUS m,m ¥PLUS k)-->T289 ==> false; Discharge ==> QED
--
-- Next we restate Theorem 271 into form useful independent of which of
-- the two sets $n$ and $m$ has the larger cardinality.
--
Theorem 315: [Addition-subtraction lemma] ((N in Za) & (M in Za)) ¥imp (N = (M ¥PLUS (N ¥MINUS M)) or N = (M ¥MINUS (M ¥MINUS N))). Proof+:
    Suppose_not(n,m) ==> AUTO
--
-- Since one of the two ordinals n and m must include the other,
-- our conclusion follows immediately by two applications of Theorem 271 and one
-- of Theorem 304.
--
    n-->T207 ==> n = #n
    m-->T207 ==> m = #m
    (n,m)-->T29 ==> (n ¥incin m) or (m ¥incin n)
    Suppose ==> m ¥incin n
    (m,n)-->T271 ==> n = (#m ¥PLUS (n ¥MINUS m))
    EQUAL ==> false; Discharge ==> n ¥incin m
    (n,m)-->T271 ==> m = (#n ¥PLUS (m ¥MINUS n))
    EQUAL ==> m = (n ¥PLUS (m ¥MINUS n))
    ALGEBRA ==> (m ¥MINUS n) in Za
    (n,m ¥MINUS n)-->T304 ==> n = (n ¥PLUS (m ¥MINUS n)) ¥MINUS (m ¥MINUS n)
    EQUAL ==> false; Discharge ==> QED
---
--- ================ Additional theorems concerning unsigned integers =====================
--
-- Our next theorem states that the arithmetic increment of any set $n$ by $1$,
-- is the cardinality of the immediate successor of $n$.
--
Theorem 316: [The successor integer as a sum] (N ¥PLUS 1) = #next(N). Proof:
--
-- For, if not, we could take an $n$ whose unitary increment $n ¥PLUS 1$
-- differs from the cardinality $#next(n)$ of its immediate successor.
--
    Suppose_not(n) ==> Stat1: (n ¥PLUS 1) /= #next(n)
--
-- But on the other hand, it follows from the theorems
-- $N ¥PLUS M = N ¥PLUS #M$ and $#{M}={0}$, exploiting the definitions
-- of $1$ and $next$ and elementary reasoning, that
-- $n ¥PLUS {n} = n ¥PLUS #{n}$ = $n ¥PLUS 1$.
--
	(n,{n})-->T226 ==> Stat2: (n ¥PLUS {n}) = (n ¥PLUS #{n})
	n-->T305 ==> Stat3: #{n} = {0}
	Use_def(1) ==> 1 = next(0)
	Use_def(next) ==> Stat4: 1 = 0 + {0}
	(Stat3,Stat4)ELEM ==> Stat5: (n * {n} = 0) & (#{n} = 1)
	Use_def(next) ==> Stat6: #next(n) = #(n + {n})
--
-- Since $n$ and ${n}$ are disjoint, we also have $n ¥PLUS {n} = #next(n)$.
--
    (n,{n})-->T220 ==> Stat7: (n ¥PLUS {n}) = #(n + {n})
--
-- This leads to a contradiction which proves our assertion.
--
    EQUAL(Stat6,Stat7,Stat2,Stat5) ==> Stat8: #next(n) = (n ¥PLUS 1)
    (Stat8,Stat1)Discharge ==> QED
--
-- An immediate corollary of Theorem 316 is that the increment by $1$
-- of any unsigned integer $N$, and the immediate successor of $N$, are the same:
--
Theorem 317: [The successor integer as a sum, 2] (N in Za) ¥imp ((next(N) in Za) & ((N ¥PLUS 1) = next(N))). Proof:
-- For, if not, we could take an unsigned integer n whose unitary
-- increment $n ¥PLUS 1$ differs from its immediate successor $next(n)$.
    Suppose_not(n) ==> Stat1: (n in Za) & ((next(N) notin Za) or ((n ¥PLUS 1) /= next(n)))
--
-- However, the unsigned integers are precisely the finite cardinals; so $n$ must be a finite cardinal.
--
	n-->T206 ==> Finite(n) & Card(n)
--
-- Therefore $next(n)$ is a finite cardinal, and accordingly it equals its
-- own cardinality. By Theorem abc, this leads us to a contradiction
-- which proves our theorem.
--
	Use_def(Card) ==> Ord(n)
	n-->T32 ==> Ord(next(n))
	n-->T200 ==> Finite(next(n))
	(next(n))-->T205 ==> Card(next(n))
	(next(n))-->T206 ==> Stat2: next(n) in Za
	(next(n))-->T164 ==> Stat3: next(n) = #next(n)
	n-->T316 ==> Stat4: (n ¥PLUS 1) = #next(n)
    (Stat1,Stat3,Stat4,Stat2)Discharge ==> QED
--
-- The following useful combinatorial lemma is dear to Alberto Policriti
--
Theorem 318: [To witness that $n$ sets are different, fewer than $n$ elements suffice] (Finite(F) & (F /= 0)) ¥imp (EXISTS d ¥incin Un(F) | (#d in #F) & (FORALL w in F, y in F | (w * d = y * d) ¥imp (w = y))). Proof:
Suppose_not(f) ==> Finite(f) & (f /= 0) & (not(EXISTS d ¥incin Un(f) | (#d in #f) & (FORALL w in f, y in f | (w * d = y * d) ¥imp (w = y))))
--
-- For, assuming the contrary, we would have an inclusion-minimal $f0$ contradicting the claim.
--
	APPLY(m1_thryvar:f0) finite_induction(n->f,P(x)->((x /= 0) & (not(EXISTS d ¥incin Un(x) | (#d in #x) & (FORALL w in x, y in x | (w * d = y * d) ¥imp (w = y)))))) ==>
		Stat1: (not(EXISTS d ¥incin Un(f0) | (#d in #f0) & (FORALL w in f0, y in f0 | (w * d = y * d) ¥imp (w = y)))) & (f0 ¥incin f) & (f0 /= 0) &
		Stat2: (FORALL k ¥incin f0 | ((k /= f0) ¥imp (not ((k /= 0) & (not(EXISTS d ¥incin Un(k) | (#d in #k) & (FORALL w in k, y in k | (w * d = y * d) ¥imp (w = y))))))))
	(f,f0)-->T189(*) ==> Stat3: Finite(f0)
--
-- Such an $f0$ cannot be a singleton, because the claim vacuously holds for singletons.
--
	Suppose ==> Stat4: f0 = {arb(f0)}
		0-->Stat1(Stat1,Stat1*) ==> (#0 notin #f0) or (not(FORALL w in f0, y in f0 | (w * 0 = y * 0) ¥imp (w = y)))
		(arb(f0))-->T305(Stat4*) ==> #{arb(f0)} = {0}
		0-->T162(Stat4*) ==> #0 = 0
		EQUAL(Stat4) ==> #f0 = {0}
		(Stat4*)ELEM ==> Stat5: (not(FORALL w in f0, y in f0 | (w * 0 = y * 0) ¥imp (w = y)))
		(w0,y0)-->Stat5(Stat4*) ==> false
	Discharge ==> AUTO
--
-- But then the minimality assumption yields that the claim holds, for some $d = d0$, when
-- $F = f0 - {arb(f0)}$.
--
	(f0 - {arb(f0)})-->Stat2(Stat1) ==> Stat6: (EXISTS d ¥incin Un(f0 - {arb(f0)}) | (#d in #(f0 - {arb(f0)})) & (FORALL w in (f0 - {arb(f0)}), y in (f0 - {arb(f0)}) | (w * d = y * d) ¥imp (w = y)))
	d0-->Stat6(Stat6*) ==> Stat7: (FORALL w in (f0 - {arb(f0)}), y in (f0 - {arb(f0)}) | (w * d0 = y * d0) ¥imp (w = y)) & (d0 ¥incin Un(f0 - {arb(f0)})) & (#d0 in #(f0 - {arb(f0)}))
--
-- Observe that $arb(f0)$ is indiscernible, relative to $d0$, from some element $w1$ of $f0 - {arb(f0)}$.
--
	f0-->T109(Stat1*) ==> Un(f0) = (arb(f0) + Un(f0 - {arb(f0)}))
	Suppose ==> Stat8: {v in (f0 - {arb(f0)}) | v * d0 = arb(f0) * d0} = 0
		(f0 - {arb(f0)},f0)-->T170(Stat7*) ==> #(f0 - {arb(f0)}) ¥incin #f0
		d0-->Stat1(Stat7*) ==> Stat9: not(FORALL w in f0, y in f0 | (w * d0 = y * d0) ¥imp (w = y))
		(w,y)-->Stat9(Stat9*) ==> (w in f0) & (y in f0) & (w /= y) & (w * d0 = y * d0)
		(w,y)-->Stat7(Stat9*) ==> not((w /= arb(f0)) & (y /= arb(f0)))
		Suppose ==> w = arb(f0)
			y-->Stat8(Stat9*) ==> false
		Discharge ==> AUTO
		(Stat9*)ELEM ==> w * d0 = arb(f0) * d0
		w-->Stat8(Stat9*) ==> false
	Discharge ==> AUTO
	(Stat7)ELEM ==> Stat10: arb({v in (f0 - {arb(f0)}) | v * d0 = arb(f0) * d0}) in {v: v in (f0 - {arb(f0)}) | v * d0 = arb(f0) * d0}
	w1-->Stat10(Stat10*) ==> Stat11: (w1 /= arb(f0)) & (w1 in f0) & (w1 * d0 = arb(f0) * d0)
--
-- After picking a $c$ belonging to only one of $w1,arb(f0)$, we
-- consider the set $d0 + {c}$. Our goal becomes to derive a
-- contradiction by showing that the latter set duly differentiates any
-- two elements of $f0$ and meets the desired cardinality limitation.
--
	c-->Stat11(Stat11*) ==> Stat12: ((c in w1) ¥eq (c notin arb(f0))) & (c notin d0)
	f0-->T274(Stat11*) ==> Stat13: (FORALL x in f0 | x ¥incin Un(f0))
	w1-->Stat13(Stat11*) ==> w1 ¥incin Un(f0)
	(Stat7*)ELEM ==> Stat14: ((w1 * (d0 + {c})) /= (arb(f0) * (d0 + {c}))) & ((d0 + {c}) ¥incin Un(f0))
	(d0 + {c})-->Stat1(Stat14*) ==> not((#(d0 + {c}) in #f0) & (FORALL w in f0, y in f0 | (w * (d0 + {c}) = y * (d0 + {c})) ¥imp (w = y)))
--
-- If two elements $w2,y2$ of $f0$, although distinct, are
-- indiscernible from one another relative to the set $d0 + {c}$,
-- either of them must be $arb(f0)$.
-- The other one cannot be $w1$, as can be seen from Stat15
-- therefore it is some $w3 in f0 - {arb(f0),w1}$, and since
-- $w3$ is discernible from $w1$ relative to $d0$, and $w1$ is
-- indiscernible from $arb(f0)$ relative to $d0$, $w3$ is
-- discernible from $arb(f0)$ relative to $d0$ (and hence also
-- relative to $d0 + {c}$. This contradiction indicates
-- that $d0 + {c}$ does not meet the desired cardinality
-- limitation $#(d0 + {c}) in #f0$.
--
	Suppose ==> Stat16: not((FORALL w in f0, y in f0 | (w * (d0 + {c}) = y * (d0 + {c})) ¥imp (w = y)))
		(w2,y2)-->Stat16(Stat16*) ==> Stat17: (w2 in f0) & (y2 in f0) & (w2 * (d0 + {c}) = y2 * (d0 + {c})) & (w2 /= y2)
		(w2,y2)-->Stat7(Stat17*) ==> (w2 = arb(f0)) or (y2 = arb(f0))
		Suppose ==> Stat18: w2 = arb(f0)
--??			EQUAL(Stat14,Stat17,Stat18) ==> Stat19: y2 /= w1
			(Stat14,Stat17,Stat18*)ELEM ==> Stat19: y2 /= w1
			EQUAL(Stat17,Stat18) ==> Stat20: y2 /= arb(f0)
			(w1,y2)-->Stat7(Stat11,Stat17,Stat19,Stat20*) ==> Stat21: w1 * d0 /= y2 * d0
		(Stat11,Stat18,Stat21,Stat17*)Discharge ==> AUTO
		(Stat17*)ELEM ==> Stat22: y2 = arb(f0)
		(Stat14,Stat17,Stat22*)ELEM ==> Stat23: w2 /= w1
		EQUAL(Stat17,Stat22) ==> Stat24: w2 /= arb(f0)
		(w1,w2)-->Stat7(Stat11,Stat17,Stat23,Stat24) ==> Stat25: w1 * d0 /= w2 * d0
	(Stat11,Stat22,Stat25,Stat17*)Discharge ==> AUTO
	(Stat14*)ELEM ==> Stat26: #(d0 + {c}) notin #f0
--
-- However this is untenable, as we know that $#d0 in #(f0 - {arb(f0)})$,
-- and we can easily prove that $#d0$ is the immediate predecessor
-- of $#(d0 + {c})$ and that $#(f0 - {arb(f0)})$ precedes $#f0$.
--
	(f0 - {arb(f0)})-->T156(Stat26*) ==> Card(#(f0 - {arb(f0)}))
	f0-->T156(Stat26*) ==> Card(#f0)
	Use_def(Card) ==> Stat27: Ord(#(f0 - {arb(f0)})) & Ord(#f0)
	Suppose ==> #(d0 + {c}) /= next(#d0)
		Suppose ==> #d0 notin Za
			(f0,f0 - {arb(f0)})-->T189(Stat3,Stat3) ==> Finite(#(f0 - {arb(f0)}))
			(#(f0 - {arb(f0)}))-->T207 ==> AUTO
			(#(f0 - {arb(f0)}),#d0)-->T196(Stat7*) ==> Finite(#d0)
			d0-->T156(Stat27*) ==> Card(#d0)
			(#d0)-->T206(Stat27*) ==> false
		Discharge ==> AUTO
		(d0,{c})-->T222(Stat12,Stat12*) ==> #(d0 + {c}) = #d0 ¥PLUS #{c}
		(#d0)-->T317(Stat26*) ==> #d0 ¥PLUS 1 = next(#d0)
		c-->T305(Stat26*) ==> #{c} = {0}
		TELEM ==> {0} = 1
		EQUAL(Stat26) ==> false
	Discharge ==> AUTO
	(f0,f0 - {arb(f0)})-->T194(Stat3,Stat1) ==> Stat28: #(f0 - {arb(f0)}) in #f0
	(#(f0 - {arb(f0)}),#d0)-->T37(Stat7*) ==> (#(d0 + {c}) ¥incin #(f0 - {arb(f0)})) & (#(d0 + {c}) /= #(f0 - {arb(f0)}))
	Use_def(Card(#(d0 + {c}))) ==> AUTO
	(d0 + {c})-->T156(Stat28*) ==> Stat29: Ord(#(d0 + {c}))
	(#(f0 - {arb(f0)}),#(d0 + {c}))-->T34(Stat27*) ==> Stat30: #(d0 + {c}) in #(f0 - {arb(f0)})
	(#f0,#(f0 - {arb(f0)}))-->T13(Stat27,Stat28,Stat26,Stat30*) ==> false
	Discharge ==> QED
--
-- A compact restatement of the preceding combinatorial lemma reads as follows:
--
Theorem 319: [To witness that $n$ sets are different, fewer than $n$ elements suffice, 2] (Finite(F) & (F /= 0)) ¥imp ({d ¥incin Un(F) | (#d in #F) & (#{w * d : w in F} = #F)} /= 0). Proof:
Suppose_not(f0) ==> AUTO
	f0-->T318 ==> Stat1: (EXISTS d ¥incin Un(f0) | (#d in #f0) & (FORALL w in f0, y in f0 | (w * d = y * d) ¥imp (w = y)))
	d0-->Stat1(Stat1*) ==> Stat2: (FORALL w in f0, y in f0 | (w * d0 = y * d0) ¥imp (w = y)) & (d0 ¥incin Un(f0)) & (#d0 in #f0)
	ELEM ==> Stat3: {d ¥incin Un(f0) | (#d in #f0) & (#{w * d: w in f0} = #f0)} = 0
	d0-->Stat3(Stat2*) ==> #{w * d0: w in f0} /= #f0
	TELEM ==> Stat4: Svm({[w,w * d0]: w in f0}) & (domain({[w,w * d0]: w in f0}) = f0) & (range({[w,w * d0]: w in f0}) = {w * d0: w in f0})
--??	Use_def(one_1_map({[w,w * d0]: w in f0})) ==> AUTO
--??	Use_def(one_1_map)(Stat4*) ==> one_1_map({[w,w * d0]: w in f0}) ¥eq (FORALL x in {[w,w * d0]: w in f0}, y in {[w,w * d0]: w in f0} | (cdr(x) = cdr(y)) ¥imp (x = y))
	Use_def(one_1_map)(Stat4*) ==> (FORALL x in {[w,w * d0]: w in f0}, y in {[w,w * d0]: w in f0} | (cdr(x) = cdr(y)) ¥imp (x = y)) ¥imp one_1_map({[w,w * d0]: w in f0})
	Suppose ==> #range({[w,w * d0]: w in f0}) = #domain({[w,w * d0]: w in f0})
	EQUAL(Stat3) ==> false; Discharge ==> AUTO
	({[w,w * d0]: w in f0})-->T157(Stat4) ==> Stat5: not(FORALL x in {[w,w * d0]: w in f0}, y in {[w,w * d0]: w in f0} | (cdr(x) = cdr(y)) ¥imp (x = y))
	(p,q)-->Stat5(Stat5*) ==> Stat6: (p in {[w,w * d0]: w in f0}) & (q in {[w,w * d0]: w in f0}) & (cdr(p) = cdr(q)) & (p /= q)
	(w0,y0)-->Stat6(Stat6*) ==> (p = [w0,w0 * d0]) & (w0 in f0) & (q = [y0,y0 * d0]) & (y0 in f0)
	TELEM ==> (cdr([w0,w0 * d0]) = w0 * d0) & (cdr([y0,y0 * d0]) = y0 * d0)
	EQUAL(Stat6) ==>  Stat7: w0 * d0 = y0 * d0
	(w0,y0)-->Stat2(Stat6*) ==> w0 = y0
	EQUAL(Stat6) ==> false
	Discharge ==> QED
--
-- Next we prove that the union-set of any finite set of
-- unsigned integers is an unsigned integer (actually, a member of $M$ unless $M$ is 0),...
--
Theorem 320: [The union set of a finite collection of integers is an integer] ((M ¥incin Za) & Finite(M)) ¥imp (((M /= 0) ¥imp (Un(M) in M)) & (Un(M) in Za)). Proof+:
--
-- Assume that $n$ is a counterexample to our assertion. Then if the first clause of our assertion is violated,
-- it is violated by some inclusion-minimal $m ¥incin n$.
--
    Suppose_not(n) ==> Stat1: (n ¥incin Za) & Finite(n) & (((n /= 0) & (Un(n) notin n)) or (Un(n) notin Za))
	Suppose ==> (n /= 0) & (Un(n) notin n)
	APPLY(m1_thryvar:m) finite_induction(n->n,P(y)->((y/=0) & (Un(y) notin y))) ==>
		Stat2: ((m ¥incin n) & (m /= 0) & (Un(m) notin m) &
			 (FORALL k ¥incin m | ((k /= m) ¥imp (not((k /= 0) & (Un(k) notin k))))))
--
-- Since $m$ is nonempty, $arb(m)$ is a member of $m$, and also $Un(m) = arb(m) + Un(m - {arb(m)})$ by Theorem 109.
-- Since $Un(m) notin m$, it follows that m cannot be a singleton, and so it must have some second integer member $c$.
--
	(Stat2)ELEM ==> Stat3: (FORALL k ¥incin m | ((k /= m) ¥imp (not((k /= 0) & (Un(k) notin k))))) & (m = {arb(m)} + (m - {arb(m)}))
	m-->T109 ==> Stat4: (Un(0) = 0) & (Un(m) = (arb(m) + Un(m - {arb(m)})))
	Suppose ==> Stat5: (m - {arb(m)}) = 0
	EQUAL(Stat5,Stat4) ==> Stat6: Un(m - {arb(m)}) = 0
		(Stat6,Stat4,Stat3,Stat2*)Discharge ==> Stat7: (m - {arb(m)}) /= 0
		c-->Stat7(Stat7*) ==> Stat8: c in (m - {arb(m)})
	(Stat2,Stat8,Stat1)ELEM ==> Stat9: (c in Za) & (arb(m) in Za) & (c /= arb(m)) & (c notin arb(m))
--
-- Since $c$ is not smaller than $arb(m)$, $arb(m)$ must be a member of $c$,
-- and hence a member of  a member of $m - {arb(m)}$, i.e. a member of $Un(m - {arb(m)})$.
--
		(c,arb(m))-->T31(Stat9*) ==> Stat11: arb(m) in c
	Suppose ==> arb(m) notin Un(m - {arb(m)})
	Use_def(Un) ==> Stat12: arb(m) notin {x: y in (m - {arb(m)}), x in y}
			(c,arb(m))-->Stat12(Stat12*) ==> Stat13: not((c in (m - {arb(c)})) & (arb(m) in c))
		(Stat11,Stat8,Stat13*)Discharge ==> Stat14: arb(m) in Un(m - {arb(m)})
--
-- Since $m - {arb(m)}$ is a non-empty subset of $m$, It follows by Stat15 2 that
-- $Un(m - {arb(m)}) in (m - {arb(m)})$, and so is an ordinal, whose member $arb(m)$ must therefore be a subset of it.
-- Thus, by statement 4, we have $Un(m) = Un(m - {arb(m)})$.
--
	(m - {arb(m)})-->Stat3(Stat8*) ==> Stat16: Un(m - {arb(m)}) in (m - {arb(m)})
	(Un(m - {arb(m)}),arb(m))-->T13 ==> Stat18: arb(m) ¥incin Un(m - {arb(m)})
	(Stat4,Stat18*)ELEM ==> Stat19: Un(m) = Un(m - {arb(m)})
--
-- But this contradicts Stat15 2. Therefore our intial suppositon must be false,
-- i.e. either $n$ is 0 or $Un(n) in n$. If $Un(n) in n$ the assertion of our theorem
-- is clearly satisfied, so only the case $n = 0$ need be considered. But in this case our assertion is obvious.
-- Hence our theorem is valid in all cases.
--
	(Stat19,Stat16,Stat2*)Discharge ==> Stat20: (n = 0) or (Un(n) in n)
    Suppose ==> (n = 0) & (Un(n) notin Za)
		T109(*) ==> Un(0) = 0
	EQUAL==> false; Discharge ==> Stat22: not((n = 0) & (Un(n) notin Za))
    (Stat22,Stat20,Stat1)Discharge ==> QED
--
-- It follows easily from the preceding result the union-set of any unsigned
-- integer $m$ is an unsigned integer (in fact, it is always the predecessor of $m$):
--
Theorem 321: [The union set of a set of integers is the least upper bound of its elements] (M in Za) ¥imp
	(((Un(M) in Za) & (Un(M) ¥incin M)) & ((M /= 0) ¥imp (Un(M) in M))). Proof+:
--
-- Assume that $m$ is a counterexample to our statement, and recall
-- that the unsigned integers are simply the finite cardinals.
-- It follows that $m$ is a finite ordinal included in $Za$, and then
-- (by excluding the trivial case $m = 0$) we get
-- a contradiction with prior lemmas.
--
    Suppose_not(m) ==> Stat1: (m in Za) & (not((Un(m) ¥incin m) & (Un(m) in Za) & ((m /= 0) ¥imp  (Un(m) in m))))
	T206(*) ==> Ord(Za)
	(Za,m)-->T13(*) ==> Stat2: m ¥incin Za
	m-->T320(*) ==> Stat3: (Un(m) in Za) & ((m /= 0) ¥imp (Un(m) in m))
	(Stat3,Stat1*)ELEM ==> Stat4: not(Un(m) ¥incin m)
	Suppose ==> m = 0
	T109 ==> Stat5: Un(0) = 0
	EQUAL ==> Stat6: Un(m) = 0
	(Stat4,Stat6*)Discharge ==> Stat7: m /= 0
	(Stat7,Stat3,Stat2*)ELEM ==> (Un(m) in m) & (Un(m) in Za)
	(m,Un(m))-->T13(*) ==> Stat8: Un(m) ¥incin m
    (Stat8,Stat4)Discharge ==> QED
--
-- Next we prove that for any non-zero unsigned
-- integer $m$, $Un(m)$ is the immediate predecessor of $m$:
--
Theorem 322: [Every nonzero integer has a predecessor] ((M in Za) & (M /= 0)) ¥imp (M = (Un(M) ¥PLUS 1)). Proof+:
    Suppose_not(m) ==> Stat1: (m in Za) & (m /= 0) & (m /= (Un(m) ¥PLUS 1))
--
-- For let $m$ be a counterexample to our assertion. $Un(m)$ is an integer less than $m$
-- by Theorem 321, and $Un(m) ¥PLUS 1$ is the sucessor $next(Un(m))$ of $Un(m)$.
-- Thus $Un(m) + {Un(m)}$ must be a subset of $m$, so if our theorem is false it cannot be a
-- superset of $m$.
--
	m-->T321(*) ==> Un(m) in m
	(m,Un(m))-->T13(*) ==> Un(m) ¥incin m
	(Un(m))-->T317(*) ==> (Un(m) ¥PLUS 1) = next(Un(m))
	Use_def(next(Un(m))) ==> AUTO
	ELEM ==> Stat5: not(m ¥incin (Un(m) + {Un(m)}))
--
-- But in this case there must exist and integer $c$ less than $m$ but not in  $Un(m) + {Un(m)}$.
-- Theorem 274 tells us that such a c must be a subset of $Un(m)$,and hence either a member of  $Un(m)$.
-- However both these cases are clearly impossible, so our theorem is proved.
--
	c-->Stat5 ==> Stat6: (c in m) & (c notin (Un(m) + {Un(m)}))
	m-->T274 ==> Stat7: (FORALL x in m | x ¥incin Un(m))
	c-->Stat7(Stat6) ==> c ¥incin Un(m)
    (Un(m),c)-->T34 ==> Stat8: (c in Un(m)) or (c = Un(m))
    (Stat8,Stat6)Discharge ==> QED
--
-- Our next theorem states that the sum of any two integers $n$ and $c$ is the set-theoretic union of
-- $n$ with the set of sums of $n$ with the members of $c$.
--
Theorem 323: [The sum of integers as the union of smaller sums] ((X in Za) & (Y in Za)) ¥imp ((X ¥PLUS Y) = X + {(X ¥PLUS u): u in Y}). Proof+:
    Suppose_not(n,c) ==> (n in Za) & (c in Za) & Stat1: ((n ¥PLUS c) /= (n + {(n ¥PLUS u): u in c}))
--
-- For let $n$, $c$ be a counterexample to our theorem. It is easily seen that $c$ cannot be $0$.
-- There must be an element $d$ which is in one but not both of the sets
-- appearing in the inequality seen above.
--
        d-->Stat1 ==> Stat1a: not((d in n ¥PLUS c) ¥eq (d in n + {(n ¥PLUS u): u in c}))
        Suppose ==> c = 0
            Suppose ==> Stat2: {(n ¥PLUS u): u in 0} /= 0
            a-->Stat2 ==> false; Discharge ==> {(n ¥PLUS u): u in 0} = 0
            EQUAL ==> (n ¥PLUS 0) /= (n + 0)
        n-->T254(*) ==> false; Discharge ==> c /= 0
--
        T206 ==> Ord(Za)
        (Za,c)-->T13 ==> c ¥incin Za
        ALGEBRA ==> n ¥PLUS c in Za
        (Za,n ¥PLUS c)-->T13 ==> (n ¥PLUS c) ¥incin Za
--
-- All of our quantities are integers, and clearly $n ¥PLUS c$ is greater than $n$.
-- First suppose that $d$ is in the second of these sets but not in the first,
-- so that $d notin n ¥PLUS c$.
-- Then either $d in n$, or there exists an $e$ in $c$ such that $d = n ¥PLUS e$.
-- The first of these cases is impossible, since it would imply $d in n ¥PLUS c$.
-- But in the second case it is clear that  $d = n ¥PLUS e$ is less than, hence a member of,
-- $n ¥PLUS c$, a contradiction ruling out this case. Hence we can be sure that
-- $d$ is in the first of our sets but not in the second.
--
        (n,c)-->T284 ==> n in (n ¥PLUS c)
        (n ¥PLUS c,n)-->T34 ==> n ¥incin (n ¥PLUS c)
        Suppose ==> Stat3: d in {(n ¥PLUS u): u in c}
            e-->Stat3 ==> (e in c) & (e in Za) & (d = n ¥PLUS e)
        (n,c,e)-->T286 ==> false; Discharge ==> Stat4: (d notin {(n ¥PLUS u): u in c}) & (d in n ¥PLUS c) & (d in Za) & (n in Za)
--
-- Since we can now be sure that $d notin n$, we have $d = (d ¥MINUS n) ¥PLUS n$.
-- $d ¥MINUS n$ is less than $c$ since $d$ is less than $n ¥PLUS c$. Hence
--
        d-->T207 ==> d = #d
        (n,d)-->T35(Stat1a) ==> d incs n
        (n,d)-->T272 ==> d = (d ¥MINUS n) ¥PLUS n
        (d,n)-->T283 ==> (d ¥MINUS n) in Za
--
-- If we suppose that $(d ¥MINUS n) notin c$, then...
--
        Suppose ==> (d ¥MINUS n) notin c
            (c,d ¥MINUS n)-->T35 ==> (d ¥MINUS n) incs c
            (c,d ¥MINUS n,n)-->T290 ==> ((d ¥MINUS n) ¥PLUS n) incs (c ¥PLUS n)
            EQUAL ==> d incs (c ¥PLUS n)
--
-- ... ALGEBRA gives us $d incs (n ¥PLUS c)$, leading to a contradiction
-- in this case, because we already know that $d in (n ¥PLUS c)$.
--
        ALGEBRA ==> false; Discharge ==>  (d ¥MINUS n) in c
--
-- However, $(d ¥MINUS n) in c$  cannot hold either.
-- From this contradiction we get the desired conclusion.
--
        (d ¥MINUS n)-->Stat4 ==> n ¥PLUS (d ¥MINUS n) /= d
    ALGEBRA ==> false; Discharge ==> QED
--
-- Our next result expresses the sum of any two integers $x$, $y$ as the union of x with
-- the set of all the members of $y$ with x. This is very similar to the preceding result,
-- but reverses the sum which appears inside the setformer in the conclusion of the theorem.
--
Theorem 324: [The sum of integers as the union of smaller sums, 2] ((X in Za) & (Y in Za)) ¥imp ((X ¥PLUS Y) = X + {(u ¥PLUS X): u in Y}). Proof:
  	Suppose_not(x,y) ==> (x in Za) & (y in Za) & ((x ¥PLUS y) /= (x + {(u ¥PLUS x): u in y}))
--
-- Suppose that $x$, $y$ constitute a counterexample to our theorem,
-- and apply the preceding Theorem to $x$, $y$. Since it is easily seen that
-- ${(x ¥PLUS u): u in y} = {(u ¥PLUS x): u in y}$, our assertion follows immediately.
--
    (x,y)-->T323 ==> (x ¥PLUS y) = x + {(x ¥PLUS u): u in y}
    Suppose ==> Stat1: {(x ¥PLUS u): u in y} /= {(u ¥PLUS x): u in y}
    c-->Stat1 ==> (c in y) & ((x ¥PLUS c) /= (c ¥PLUS x))
    T206 ==> Ord(Za)
    (Za,y)-->T13 ==> c in Za
    ALGEBRA ==> false; Discharge ==> {(x ¥PLUS u): u in y} = {(u ¥PLUS x): u in y}
  	EQUAL ==> false; Discharge ==> QED
--
-- Next we prove a property of the integer subtraction operator very close
-- to that given by Theorem 272, namely $n = m ¥PLUS (n ¥MINUS m)$ if $m$ is no larger than $n$.
--
Theorem 325: [Subtraction reverses addition] ((X in Za) & (Y in Za) & (Y ¥incin X)) ¥imp (X = Y ¥PLUS (X ¥MINUS Y)). Proof+:
    Suppose_not(n,m) ==>  AUTO
--
-- For all our quantities are integers, so the conclusion of Theorem 272
-- is equivalent to that of the present theorem.
--
	T206 ==> Ord(Za)
	(Za,n)-->T13 ==> n ¥incin Za
	n-->T207 ==> n = #n
	(m,n)-->T272 ==> #n = (n ¥MINUS m) ¥PLUS m
    ALGEBRA ==> false; Discharge ==> QED
--
Theorem 326: [Subtraction monotonicity lemma, 2] ((X in Za) & (Y in Za) & (U in (X ¥PLUS Y)) & (Y /= 0)) ¥imp ((U ¥MINUS X) in Y). Proof+:
Suppose_not(x,y,u) ==> AUTO
	(x,y)-->T283 ==> (x ¥PLUS y) in Za
	(x ¥PLUS y)-->T206 ==> Ord(Za) & Finite(x ¥PLUS y)
	ELEM ==> Ord(x) & Ord(x ¥PLUS y)
	(x ¥PLUS y,u)-->T12 ==> Ord(u)
	(u,x ¥PLUS y)-->T35 ==> Stat1: (x ¥PLUS y) incs u
	(x ¥PLUS y,u,x)-->T310(Stat1*) ==> Stat2: ((x ¥PLUS y) ¥MINUS x) incs (u ¥MINUS x)
	(x,y)-->T252(Stat2*) ==> (x ¥PLUS y) = (y ¥PLUS x)
	(y,x)-->T304 ==> ((y ¥PLUS x) ¥MINUS x) = y
	EQUAL(Stat2) ==> y incs (u ¥MINUS x)
--
	(u,x ¥PLUS y)-->T197 ==> Finite(u)
	u-->T205 ==> Card(u) & (u in Za)
	(u,x)-->T283 ==> (u ¥MINUS x) in Za
	ELEM ==> ((u ¥MINUS x) notin y) & (y in Za) & (x in Za)
	(y,u ¥MINUS x)-->T35(Stat2*) ==> y = (u ¥MINUS x)
	EQUAL ==> u in (x ¥PLUS (u ¥MINUS x))
	(u,x)-->T325 ==> x ¥nincin u
	(x,u)-->T35 ==> u in x
	(x,u)-->T270 ==> 0 notin y
	T188 ==> Ord(0)
(y,0)-->T35 ==> false; Discharge ==> QED
--
-- The following in-recursive formula gives an alternative characterization of signed integer subtraction:
--
Theorem 327: [The integer difference as  a set of smaller differences] ((N in Za) & (M in Za)) ¥imp ((N ¥MINUS M) = {k ¥MINUS M: k in N | M ¥incin k}). Proof+:
    Suppose_not(n,m) ==> (n in Za) & (m in Za) & Stat1: ((n ¥MINUS m) /= {k ¥MINUS m: k in n | m ¥incin k})
--
-- For let $n$, $m$ be a counterexample to our theorem. Since
-- $n, m, n ¥MINUS m$ are unsigned integers, hence ordinals,
-- there must exist an $a$ belonging to just one of $n ¥MINUS m$
-- and ${k ¥MINUS m: k in n | (m in k) or (m = k)}$.
--
	ALGEBRA ==> (n ¥MINUS m) in Za
	T206 ==> Ord(Za)
	ELEM ==> Ord(n ¥MINUS m) & Ord(n) & Ord(m)
	a-->Stat1 ==> (a in (n ¥MINUS m)) ¥eq (a notin {k ¥MINUS m: k in n | m ¥incin k})
	Suppose ==> Stat2: (a in {k ¥MINUS m: k in n | m ¥incin k})
--
-- If $a$ belongs to ${k ¥MINUS m: k in n | (m in k) or (m = k)}$, then $a$
-- equals $k ¥MINUS m$ for some $k in n$ such that $m$ does not exceed $k$.
-- By monotonicity of integer subtraction $k ¥MINUS m$ is no greater than,
-- and hence equal to, $n ¥MINUS m$. Thus $m in n$ and $k = n$, contradicting $k in n$.
--
		k-->Stat2 ==> ((k ¥MINUS m) notin (n ¥MINUS m)) & (k in n) & (m ¥incin k)
		(Za,n)-->T13 ==> k in Za
		(n,k)-->T13 ==> n incs k
		(n,k,m)-->T310 ==> (n ¥MINUS m) incs (k ¥MINUS m)
		ALGEBRA ==> Ord(k ¥MINUS m)
		(n ¥MINUS m,k ¥MINUS m)-->T34 ==> k ¥MINUS m = n ¥MINUS m
		(k,m)-->T325 ==> k = m ¥PLUS (k ¥MINUS m)
		(n,m)-->T325 ==> n = m ¥PLUS (n ¥MINUS m)
	EQUAL ==> false; Discharge ==> Stat3: (a notin {k ¥MINUS m: k in n | m ¥incin k})
--
-- But in this case we have $a in (n ¥MINUS m)$, so by strict monotonicity of addition
-- $(a ¥PLUS m) in ((n ¥MINUS m) ¥PLUS m)$, i.e. $(a ¥PLUS m) in n$, and therefore taking
-- $k = (a ¥PLUS m)$ in Stat3 we have a contradiction which proves our theorem.
--
 	ELEM ==> (a in (n ¥MINUS m))
 	(n,m)-->T283 ==> (n ¥MINUS m) in Za
 	(Za,n ¥MINUS m)-->T13 ==> a in Za
 	Use_def(¥MINUS) ==> #(n - m) /= 0
 	(n - m)-->T162 ==> n - m /= 0
 	ELEM ==> not(m incs n)
 	(n,m)-->T29 ==> n incs m
 	(m,n)-->T272 ==> #n = (n ¥MINUS m) ¥PLUS m
 	n-->T207 ==> n = (n ¥MINUS m) ¥PLUS m
 	(n ¥MINUS m,a,m)-->T297 ==> (a ¥PLUS m) in ((n ¥MINUS m) ¥PLUS m)
 	ELEM ==> (a ¥PLUS m) in n
 	(a,m)-->T304 ==> a = (a ¥PLUS m) ¥MINUS m
 	ELEM ==> 0 ¥incin a
	(m,a)-->T292 ==> m ¥incin (a ¥PLUS m)
 	(a ¥PLUS m)-->Stat3 ==> false; Discharge ==> QED
--
-- It is sometimes useful to restate the preceding theorem in the following modified form:
--
Theorem 328: [The integer difference as a set of smaller differences] ((N in Za) & (M in Za)) ¥imp ((N ¥MINUS M) = {k in Za | (k ¥PLUS M) in N}). Proof:
Suppose_not(n,m) ==> AUTO
	T206 ==> Ord(Za)
	(Za,n)-->T13 ==> n ¥incin Za
	(n,m)-->T327 ==> Stat1: {k ¥MINUS m: k in n | m ¥incin k} /= {k in Za | (k ¥PLUS m) in n}
	c-->Stat1 ==> not((c in {k ¥MINUS m: k in n | m ¥incin k}) ¥eq (c in {k in Za | (k ¥PLUS m) in n}))
	Suppose ==> Stat2: (c in {k ¥MINUS m: k in n | m ¥incin k}) & Stat3: (c notin {k in Za | (k ¥PLUS m) in n})
		k1-->Stat2 ==> (c = k1 ¥MINUS m) & (k1 in n) & (m ¥incin k1)
		k1-->T206 ==> (k1 in Za) & Card(k1)
		k1-->T164 ==> k1 = #k1
		ALGEBRA ==> (k1 ¥MINUS m) in Za
		()-->Stat3 ==> not ((c in Za) & ((c ¥PLUS m) in n))
		EQUAL ==> not (((k1 ¥MINUS m) in Za) & (((k1 ¥MINUS m) ¥PLUS m) in n))
		ELEM ==> ((k1 ¥MINUS m) ¥PLUS m) notin n
	(m,k1)-->T272 ==> false; Discharge ==> Stat4: (c in {k in Za | (k ¥PLUS m) in n}) & Stat5: (c notin {k ¥MINUS m: k in n | m ¥incin k})
	()-->Stat4(Stat4*) ==> (c in Za) & ((c ¥PLUS m) in n)
	(c ¥PLUS m)-->Stat5(Stat4*) ==> (c /= ((c ¥PLUS m) ¥MINUS m)) or (m ¥nincin (c ¥PLUS m))
	(m,c)-->T292 ==> c /= ((c ¥PLUS m) ¥MINUS m)
(c,m)-->T304 ==> false; Discharge ==> QED
--
-- Our next goal is to show that every subset of the set $Za$ of unsigned integers
-- which is closed with respect to predecessor formation either belongs to $Za$
-- or coincides with $Za$. As a preliminary lemma, we show that for any
-- set $x$ closed with respect to predecessor formation, if an element $j$ of $Za$
-- does not belong to $x$, then no integer $h$ greater than $j$ belongs to $x$.
--
Theorem 329: ((J in Za - X) & (FORALL i | (next(i) in X) ¥imp (i in X))) ¥imp
		({h in Za | (h notin J) & (h in X)} = 0). Proof+:
    Suppose_not(j,x) ==> (j in Za - x) & ({h in Za | (h notin j) & (h in x)} /= 0) &
		Stat1: (FORALL i | (next(i) in x) ¥imp (i in x))
--
-- For, suppose that $x,j$ contradict the statement just made and let
-- $h$ be the first integer which is not smaller than $j$ and belongs to $Za$.
--
        Loc_def ==> h = arb({h in Za | (h notin j) & (h in x)})
        ELEM ==> (j in Za) &
		(h * {h in Za | (h notin j) & (h in x)} = 0) &
		Stat2: (h in {h in Za | (h notin j) & (h in x)})
        ()-->Stat2 ==> (h in Za) & (h notin j) & (h in x)
        T206 ==> Ord(Za)
--
-- By T31, either $j,h$ coincide or one of $j,h$ belongs to the other. We must
-- exclude the case $j=h$, because $h$ belongs to $j$ and $j$ does not; moreover
-- we know that $h notin j$. Hence $j in h$ and $h$ has the form $next(k)$ for
-- some unsigned integer $k$.
--
        (j,h)-->T31 ==> j in h
        T211 ==> Ord(0) & Card(1)
        ALGEBRA ==> (h ¥MINUS 1) in Za
        Use_def(Card) ==> Ord(1)
        Suppose ==> h /= next(h ¥MINUS 1)
            (h,0)-->T31 ==> 0 in h
            Use_def(1) ==> 1 = next(0)
	    Use_def(next) ==> 1 ¥incin h
            (1,h)-->T272 ==> #h = ((h ¥MINUS 1) ¥PLUS 1)
            h-->T207 ==> h = ((h ¥MINUS 1) ¥PLUS 1)
        (h ¥MINUS 1)-->T317 ==> false; Discharge ==> AUTO
--
-- It turns out that the immediate predecessor of $h$ belongs to $h$ as well as
-- to the set ${h in Za | (h notin j) & (h in x)}$. However, this contradicts
-- the minimality criterion by which $h$ was selected by means of the $arb$ operator.
-- Indeed, we derive $next(h ¥MINUS 1) ¥incin j$, which is incompatible with
-- the earlier proved facts $j in h$, $h = next(h ¥MINUS 1)$.
--
        (h ¥MINUS 1)-->Stat1 ==> (h ¥MINUS 1) in x
        Use_def(next) ==> Stat3: (h ¥MINUS 1) notin {h in Za | (h notin j) & (h in x)}
        ()-->Stat3 ==> (h ¥MINUS 1) in j
        (j,h ¥MINUS 1)-->T13 ==> ((h ¥MINUS 1) * {h ¥MINUS 1}) ¥incin j
--
-- This contradiction leads to the desired conclusion.
--
    Use_def(next) ==> false; Discharge ==> QED
--
-- Now we can easily draw the corollary we were aiming at.
--
Theorem 330: ((X ¥incin Za) & (FORALL i | (next(i) in X) ¥imp (i in X))) ¥eq (X in next(Za)). Proof:
    Suppose_not(x) ==> ((x ¥incin Za) & (FORALL i | (next(i) in x) ¥imp (i in x))) ¥eq (x notin next(Za))
--
-- Implication in one direction is trivial; for the converse...
--
        T206 ==> Ord(Za)
        Suppose ==> (not((x ¥incin Za) & (FORALL i | (next(i) in x) ¥imp (i in x)))) & (x in next(Za))
            Use_def(next) ==> (x in Za) or (x = Za)
            (Za,x)-->T13 ==> x ¥incin Za
            ELEM ==> Stat1: not(FORALL i | (next(i) in x) ¥imp (i in x))
            Suppose ==> not(Ord(x))
                Suppose ==> x = Za
                EQUAL ==> false; Discharge ==> x in Za
            (Za, x)-->T12 ==> false; Discharge ==> Ord(x)
            i-->Stat1 ==> (next(i) in x) & (i notin x)
            (x, next(i))-->T13 ==> next(i) ¥incin x
        Use_def(next) ==> false; Discharge ==> (x ¥incin Za)  & (x notin next(Za)) & (FORALL i | (next(i) in x) ¥imp (i in x))
--
-- ... reasoning by contradiction, suppose that $x$ is included in the set $Za$ of all unsigned
-- integers and does not belong to $next(Za)$, i.e., $x$ differs from $Za$ and does not
-- belong to $Za$. Consider a minimally chosen element $j$ of $(Za-j)$. Clearly,
-- $j$ must differ from $x$. However, the preceding lemma makes it impossible
-- to find an element of $x$ which does not belong to $j$. On the other hand, insofar
-- an an element of the ordinal $Za$, $j$ must be a subset of $Za$; hence, any element
-- $h$ of $j$ not belonging to $x$ must be an element of $Za$ too, violating the supposed
-- minimality of $j$. Thus we are led to the contradiction $j/=x$, $j=x$, which proves
-- our statement.
--
        Loc_def ==> j = arb(Za - x)
        Use_def(next) ==> (j in (Za - x)) & (j * ((Za - x)) = 0) & Stat2: (x /= j)
        h-->Stat2 ==> (h in x) ¥eq (h notin j)
        Suppose ==> (h notin j) & (h in x)
            Suppose ==> Stat3: h notin {h in Za | (h notin j) & (h in x)}
            ()-->Stat3 ==> false; Discharge ==> h in {h in Za | (h notin j) & (h in x)}
        (j,x)-->T329 ==> false; Discharge ==> (h in j) & (h notin x)
    (Za,j)-->T13 ==> false; Discharge ==> QED
--
--
--
Theorem 331: (({X,Y} ¥incin next(Za)) & (#X in next(Y))) ¥imp (((X = Y) & (Y = Za)) or (X in (next(Y) * Za))). Proof+:
Suppose_not(x,y) ==> AUTO
        T209(*) ==> Card(Za)
        Use_def(Card)(*) ==> Ord(Za) --? Why does this not follow from the preceding step by proof-by-structure?
--
-- Therefore $x$, which belongs to the ordinal $next(Za)$, is an ordinal.
--
        (next(Za), x)-->T12(*) ==> Ord(x)
        x-->T330(*) ==> x ¥incin Za
        (Za, x)-->T27(*) ==> (x = Za) or (x = arb(Za - x))
        Suppose ==> (not Card(x))
            Suppose ==> x = Za
            EQUAL ==> false; Discharge ==> x in Za
        x-->T206(*) ==> false; Discharge ==> AUTO
	x-->T164(*) ==> x = #x
        EQUAL ==> x in next(y)
--
-- Observe that $x notin Za$ since $x in next(y)$ and $x notin (next(y) * Za)$;
-- therefore $x = Za$ (since $x in next(Za)$) and $y /= Za$ (since $(x /= y) or (y /= Za)$);
-- and hence $y in Za$ (since $y in next(Za)$). But this conflicts with the fact that
-- $x in next(y)$ (indeed, $Za notin next(U)$ for any unsigned integer $U$).
--
	Use_def(next) ==> false; Discharge ==> QED
--
-- We now show that every finite set of unsigned integers has an upper bound.
--
THEORY unsigned_integer_bynd(Q1(x))
    Finite({x in Za | Q1(x)})
END unsigned_integer_bynd
--
ENTER_THEORY unsigned_integer_bynd
--
Def 00q: [Upper bound of integer set] bynd_thryvar := next(Un({x in Za | Q1(x)}))
--
Theorem unsigned_integer_bynd.0: [Every finite set of unsigned integers has an upper bound]
		(bynd_thryvar in Za) & (FORALL i in Za | (Q1(i) ¥imp (i in bynd_thryvar))). Proof+:
    Suppose_not ==> (bynd_thryvar notin Za) or (not (FORALL i in Za | (Q1(i) ¥imp (i in bynd_thryvar))))
--
-- For it is clear that ${x in Za | Q1(x)}$ is a finite set of integers, and so by Theorem 317
-- and Theorem 320 $next(Un({x in Za | Q1(x)}))$ is an integer.
--
    Suppose ==> Stat1: not ({x in Za | Q1(x)} ¥incin Za)
    	k-->Stat1 ==> (k notin Za) & Stat2: (k in {x in Za | Q1(x)})
    	()-->Stat2 ==> false
    Discharge ==> {x in Za | Q1(x)} ¥incin Za
    Assump ==> Finite({x in Za | Q1(x)})
    ({x in Za | Q1(x)})-->T320 ==> Un({x in Za | Q1(x)}) in Za
	(Un({x in Za | Q1(x)}))-->T317 ==> next(Un({x in Za | Q1(x)})) in Za
	Use_def(bynd_thryvar) ==> Stat3: not (FORALL i in Za | (Q1(i) ¥imp (i in bynd_thryvar)))
	i-->Stat3 ==> (i in Za) & Q1(i) & (i notin bynd_thryvar)
--
-- But by definition Un({x in Za | Q1(x)}) includes the element i of {x in Za | Q1(x)}, and so
-- i in next(Un({x in Za | Q1(x)})) by Theorem 206, a contradiction which proves our assertion.
--
	T206 ==> Ord(Za)
	(Za,Un({x in Za | Q1(x)}))-->T12 ==> Ord(Un({x in Za | Q1(x)}))
	Suppose ==> Stat4: (i notin next(Un({x in Za | Q1(x)})))
		(Un({x in Za | Q1(x)}),i)-->T36 ==> Stat5: not(i ¥incin Un({x in Za | Q1(x)}))
		j-->Stat5 ==> (j in i) & (j notin Un({x in Za | Q1(x)}))
		Use_def(Un) ==> Stat6: j notin {u: v in {x in Za | Q1(x)},u in v}
		(i,j)-->Stat6 ==> not((j = j) & (i in {x in Za | Q1(x)}) & (j in i))
		ELEM ==> Stat7: i notin {x in Za | Q1(x)}
		i-->Stat7 ==> false
	Discharge ==> i in next(Un({x in Za | Q1(x)}))
    Use_def(bynd_thryvar) ==> false; Discharge ==> QED
--
-- The following subsidiary lemma captures a few useful auxiliary properties of the upper bound $bynd_thryvar$.
--
Theorem unsigned_integer_bynd.1: [Every finite set of unsigned integers has an upper bound] (bynd_thryvar in Za) &
	 (Za incs bynd_thryvar) & Ord(bynd_thryvar) & (FORALL i in Za | (Q1(i) ¥imp (i in bynd_thryvar))) & (not Finite(Za - bynd_thryvar)). Proof:
Suppose_not ==> not((bynd_thryvar in Za) &
	 (Za incs bynd_thryvar) & Ord(bynd_thryvar) & (FORALL i in Za | (Q1(i) ¥imp (i in bynd_thryvar))) & (not Finite(Za - bynd_thryvar)))
    Tunsigned_integer_bynd.0 ==> (bynd_thryvar in Za) & (not((Za incs bynd_thryvar) & Ord(bynd_thryvar) & (not Finite(Za - bynd_thryvar))))
    bynd_thryvar-->T206 ==> Ord(Za)
    (Za,bynd_thryvar)-->T13 ==> (bynd_thryvar ¥incin Za)
    (Za,bynd_thryvar)-->T12 ==> Finite(Za - bynd_thryvar)
bynd_thryvar-->T237(*) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY unsigned_integer_bynd
--
--THEORY unsigned_integer_bynd(Q1(x))
--	Finite({x in Za | Q1(x)})
--==>(bynd_thryvar)
--	(bynd_thryvar in Za) &
--		(Za incs bynd_thryvar) & Ord(bynd_thryvar) & (FORALL i in Za | (Q1(i) ¥imp (i in bynd_thryvar))) & (not Finite(Za - bynd_thryvar))
--END unsigned_integer_bynd
--
THEORY cauchyseq_lemma(n0,R(i,j))
    n0 in Za
    (not Finite({i * j : i in Za, j in Za | R(i,j)}))
END cauchyseq_lemma
--
ENTER_THEORY cauchyseq_lemma
--
Theorem cauchyseq_lemma.1: (not Finite({i * j : i in (Za - n0), j in (Za - n0) | R(i,j)})). Proof+:
    Suppose_not ==> AUTO
	Assump ==> Stat0: (n0 in Za) & (not Finite({i * j : i in Za, j in Za | R(i,j)}))
	ELEM ==> Finite(n0)
--
-- For since $n0$ is finite, ${i * j : i in Za, j in Za | R(i,j)} - n0$ must be infinite by assumption.
--
	Suppose ==> Finite({i * j : i in Za, j in Za | R(i,j)} - n0)
            ({i * j : i in Za, j in Za | R(i,j)} - n0,n0)-->T236 ==> Finite(({i * j : i in Za, j in Za | R(i,j)} - n0) + n0)
        	ELEM ==> ({i * j : i in Za, j in Za | R(i,j)} - n0) + n0 incs {i * j : i in Za, j in Za | R(i,j)}
        	(({i * j : i in Za, j in Za | R(i,j)} - n0) + n0,{i * j : i in Za, j in Za | R(i,j)})-->T189 ==> false
    Discharge ==> not(Finite({i * j : i in Za, j in Za | R(i,j)} - n0))
--
-- But it is easily seen that ${i * j : i in Za, j in Za | R(i,j)} - n0$ is a subset of ${i * j : i in (Za - n0), j in (Za - n0) | R(i,j)}$,
-- and so this latter set must also be must be infinite, proving the present Lemma.
--
    Suppose ==> Stat1: not(({i * j : i in Za, j in Za | R(i,j)} - n0) ¥incin {i * j : i in Za - n0, j in Za - n0 | R(i,j)})
        k-->Stat1(Stat1*) ==> Stat2: (k in {i * j : i in Za, j in Za | R(i,j)}) & (k notin n0) & Stat3: (k notin {i * j : i in Za - n0, j in Za - n0 | R(i,j)})
        (i0,j0)-->Stat2 ==> Stat4: (i0 in Za) & (j0 in Za) & R(i0,j0) & (k = i0 * j0)
        (i0,j0)-->Stat3 ==> not((i0 in Za - n0) & (j0 in Za - n0) & R(i0,j0) & (k = i0 * j0))
        (Stat4)ELEM ==> (i0 in n0) or (j0 in n0)
	(i0,j0)-->T28(Stat0,Stat4) ==> Ord(i0 * j0) & Ord(n0)
		EQUAL ==> Ord(k)
        (n0,k)-->T35 ==> n0 ¥incin k
--
-- Since ELEM(Stat4*) yields $(i0 in i0 * j0) or (j0 in i0 * j0)$,
-- we get a contradiction enabling us to discharge our temporary assumptions.
--
	(Stat4*)Discharge ==> ({i * j : i in Za, j in Za | R(i,j)} - n0) ¥incin {i * j : i in Za - n0, j in Za - n0 | R(i,j)}
	({i * j : i in Za - n0, j in Za - n0 | R(i,j)},{i * j : i in Za, j in Za | R(i,j)} - n0)-->T189 ==> false
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY cauchyseq_lemma
--
--THEORY cauchyseq_lemma(n0,R(i,j))
--    n0 in Za
--    (not Finite({i * j | i in Za, j in Za | R(i,j)}))
--==>
--    (not Finite({i * j | i in (Za - n0), j in (Za - n0) | R(i,j)}))
--END cauchyseq_lemma
--
-- By Theorem 29, the set of integers, like any other ordinal, is closed under union and intersection.
--
--
Theorem 332: [Ordinal member maximum and minimum] (Ord(U) & (S in U) & (T in U)) ¥imp
		((S + T in U) & (S * T in U)). Proof+:
Suppose_not(u,s,t) ==> AUTO
--
-- If a counterexample $u,s,t$ existed, then $s,t$ would both be ordinals, and hence one would include the
-- other. Therefore ${s + t, s * t} = {s,t}$, conflicting with $u incs {s,t} & u ¥nincs {s + t, s * t}$.
--
(s,t)-->T29 ==> false; Discharge ==> QED
--
Theorem 333: [Integer member maximum and minimum] ((S in Za) & (T in Za)) ¥imp ((S + T in Za) & (S * T in Za)). Proof+:
Suppose_not(s,t) ==> AUTO
    T206 ==> Ord(Za)
    (Za,s,t)-->T332 ==> false; Discharge ==> QED
--
-- We are now in position to prove the following small theory, which gives us a kind of converse of cauchyseq_lemma.1.
--
THEORY cauchyseq_lemma2(R(i,j))
    Finite({i * j : i in Za, j in Za | R(i,j)})
END cauchyseq_lemma2
--
ENTER_THEORY cauchyseq_lemma2
--
--
Theorem cauchyseq_lemma2.1: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i incs k) & (j incs k)) ¥imp (not (R(i,j))))). Proof:
    Suppose_not ==> Stat1: AUTO
--
-- Indeed, it is easily seen that ${x in Za | x in {i * j : i in Za, j in Za | R(i,j)}} = {i * j: i in Za, j in Za | R(i,j)}$
--
    Suppose ==> Stat2: {x in Za | x in {i * j : i in Za, j in Za | R(i,j)}} /= {i * j: i in Za, j in Za | R(i,j)}
    y-->Stat2 ==> ((y in {x in Za | x in {i * j : i in Za, j in Za | R(i,j)}}) & (y notin {i * j: i in Za, j in Za | R(i,j)})) or ((y notin {x in Za | x in {i * j: i in Za, j in Za | R(i,j)}}) & (y in {i * j: i in Za, j in Za | R(i,j)}))
    Suppose ==> Stat3: (y in {x in Za | x in {i * j: i in Za, j in Za | R(i,j)}}) & (y notin {i * j: i in Za, j in Za | R(i,j)})
	()-->Stat3 ==> false; Discharge ==> Stat4: (y notin {x in Za | x in {i * j : i in Za, j in Za | R(i,j)}}) & Stat5: (y in {i * j: i in Za, j in Za | R(i,j)})
	y-->Stat4 ==> not(y in Za)
	(i0,j0)-->Stat5 ==> (i0 in Za) & (j0 in Za) & (y = i0 * j0)
	(i0,j0)-->T333 ==> false
	Discharge ==> {x in Za | x in {i * j : i in Za, j in Za | R(i,j)}} = {i * j: i in Za, j in Za | R(i,j)}
    Assump ==> Finite({i * j : i in Za, j in Za | R(i,j)})
--
-- and so ${x in Za | x in {i * j : i in Za, j in Za | R(i,j)}}$ is finite by assumption. Thus we can apply
-- unsigned_integer_bynd to find an integer k such that R(i,j) is false i,j is any pair of integers both larger than k
--
    EQUAL ==> Finite({x in Za | x in {i * j : i in Za, j in Za | R(i,j)}})
	APPLY(bynd_thryvar:k) unsigned_integer_bynd(Q1(x)->(x in {i * j : i in Za, j in Za | R(i,j)})) ==>
	(k in Za) & Stat6: (FORALL n in Za | ((n in {i * j: i in Za, j in Za | R(i,j)}) ¥imp (n in k)))
    k-->Stat1 ==> Stat7: not (FORALL i in Za, j in Za | ((i incs k) & (j incs k)) ¥imp (not (R(i,j))))
    (i,j)-->Stat7 ==> Stat8: (i in Za) & (j in Za) & (not((i incs k) & (j incs k)) ¥imp (not (R(i,j))))
    (Stat8)ELEM ==> Stat9: (i in Za) & (j in Za) & (i incs k) & (j incs k) & R(i,j)
--
--
--
    (i,j)-->T333 ==> Stat10: i * j in Za
    (i * j)-->Stat6 ==> (i * j in {i * j : i in Za, j in Za | R(i,j)}) ¥imp (i * j in k)
    Suppose ==> Stat11: i * j notin {i * j : i in Za, j in Za | R(i,j)}
    (i,j)-->Stat11 ==> false; Discharge ==> Stat12: i * j in k
    (Stat9,Stat12)ELEM ==> false; Discharge ==> QED
--
--
ENTER_THEORY Set_theory
--
-- Next we give an elementary lemma which characterizes a case in which a subset of an intger must be the entire integer.
--
Theorem 334: ((N in Za) & (S ¥incin N) & (#S = N)) ¥imp (S = N). Proof+:
Suppose_not(n,s) ==> AUTO
	n-->T164 ==> n = #n
	(n,s)-->T194 ==> false; Discharge ==> QED
--
-- ************************************************************************************************
-- 			Section 7a: Some elementary results concerning finite sequences
-- ************************************************************************************************
--
-- In this section we develop various elementary properties of finite sequences (of arbitrary elements),
-- constructs useful in a variety of analytic and combinatorial situations. and their conjuctions.
--
Def 24a: [Finite sequences] Fin_seqs(S) := {f ¥incin (Za ¥PROD S) | Svm(f) & (domain(f) in Za)}
Def 24b: [Sequence concatenation] concat(F,G) := {[n,if n in domain(F) then F~[n] else G~[n ¥MINUS domain(F)] end if]: n in domain(F) ¥PLUS domain(G)}
Def 24c: [Subsequences] Subseqs(F) := {F @ h: h ¥incin (Za ¥PROD Za) | Svm(h) & (FORALL i | (next(i) in domain(h)) ¥imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)]))))}
Def 24d: [Shift operation for sequences] Shift(M) := {[i, M ¥PLUS i]: i in Za}
Def 24e: [Shifted sequence] shifted_seq(F,M) := F @ Shift(M)
--
-- We begin the present collection of lemmas by noting the entirely elementary fact that every element
-- of a finite sequence of elements of a set $s$ is a pair whose first component is an integer
-- and whose second component belongs to $s$.
--
Theorem 335: [Finite sequences are single-valued maps with integer domains] (F in Fin_seqs(S)) ¥eq (Svm(F) & (domain(F) in Za) & (range(F) ¥incin S)). Proof:
	Suppose_not(f,s) ==> AUTO
	Suppose ==> (not(Svm(f) & (domain(f) in Za) & (range(f) ¥incin s))) &  (f in Fin_seqs(s))
		Use_def(Fin_seqs) ==> Stat1: f in {f ¥incin (Za ¥PROD S) | Svm(f) & (domain(f) in Za)}
		()-->Stat1 ==> (f ¥incin (Za ¥PROD s)) & (not(range(f) ¥incin s))
		(f,Za ¥PROD s)-->T65 ==> not(range(Za ¥PROD s) ¥incin s)
		Use_def(range) ==> not({cdr(x): x in Za ¥PROD s} ¥incin s)
		Use_def(¥PROD) ==> not({cdr(x): x in {[n,v]: n in Za, v in s}} ¥incin s)
		SIMPLF ==> Stat2: not({cdr([n,v]): n in Za, v in s} ¥incin s)
		y-->Stat2 ==> (y notin s) & Stat3: (y in {cdr([n,v]): n in Za, v in s})
	(n,v)-->Stat3 ==> false;  Discharge ==> (Svm(f) & (domain(f) in Za) & (range(f) ¥incin s)) & (not(f in Fin_seqs(s)))
	Use_def(Fin_seqs) ==> Stat4: f notin {g ¥incin (Za ¥PROD S) | Svm(g) & (domain(g) in Za)}
    g-->Stat4 ==> not(f ¥incin (Za ¥PROD S))
    Use_def(¥PROD) ==> Stat5: not(f ¥incin ({[n,v]: n in Za, v in s}))
    c-->Stat5 ==> Stat6: (c in f) & Stat7: (c notin {[n,v]: n in Za, v in s})
    Use_def(Svm) ==> Is_map(f)
    Use_def(Is_map) ==> Stat8: c in {[car(x),cdr(x)]: x in f}
    x-->Stat8 ==> (x in f) & (c = [car(x),cdr(x)])
    (car(x),cdr(x))-->Stat7 ==> not((car(x) in Za) & (cdr(x) in s))
    Use_def(domain) ==>  domain(f) = {car(x): x in f}
    Use_def(range) ==> range(f) = {cdr(x): x in f}
    Suppose ==> Stat9: cdr(x) notin {cdr(x): x in f}
	x-->Stat9 ==> false; Discharge ==> cdr(x) in s
	T206 ==> Ord(Za)
	(Za,domain(f))-->T13 ==> domain(f) ¥incin Za
	Suppose ==> Stat10: car(x) notin {car(x): x in f}
	x-->Stat10 ==> false; Discharge ==> car(x) in Za
    Discharge ==> QED
--
-- Next we note that the domain of a finite sequence $f$ is just $#f$.
-- The proof of this and various associated facts is direct and elementary.
--
Theorem 336: [Other properties of finite sequences] (F in Fin_seqs(S)) ¥imp ((domain(F) = #domain(F)) & (domain(F) = #F) & (#F in Za) & Finite(F)). Proof+:
Suppose_not(f,s) ==> AUTO
	(f,s)-->T335 ==> Svm(f) & (domain(f) in Za)
--
-- Hence, $Card(domain(f))$ and $Finite(domain(f))$.
--
    (domain(f))-->T164 ==> domain(f) = #domain(f)
    f-->T174 ==> #domain(f) = #f
    EQUAL ==> Finite(#f)
    f-->T193 ==> false; Discharge ==> QED
--
-- The following simple reformulations of the condition for function equality
-- will be quite useful in some of the elementary proofs given later.
--
Theorem 337: [Two single-valued functions with common domain are equal if all their values are equal] (Svm(F) & Svm(G) & (domain(F) = S) & (domain(G) = S) & (FORALL n0 in S | F~[n0] = G~[n0])) ¥imp (F = G). Proof:
	Suppose_not(f,g,s) ==> Svm(f) & Svm(g) & (domain(f) = s) & (domain(g) = s) & (f /= g) & Stat1: (FORALL n in s | f~[n] = g~[n])
	Suppose ==> s = 0
		f-->T24 ==> f = 0
	g-->T24 ==> false; Discharge ==> s /= 0
	f-->T72 ==> f = {[x,f~[x]]: x in domain(f)}
	g-->T72 ==> g = {[x,g~[x]]: x in domain(g)}
	EQUAL ==> f = {[x,f~[x]]: x in s}
	EQUAL ==> Stat2: {[x,f~[x]]: x in s} /= {[x,g~[x]]: x in s}
	x-->Stat2 ==> (x in s) & ([x,f~[x]] /= [x,g~[x]])
	ELEM ==> f~[x] /= g~[x]
	x-->Stat1 ==> false; Discharge ==> QED
--
--
--
Theorem 338: [Two functions from a collection of single-valued functions with common domain are equal if all their values are equal] ((S /= 0) & (FORALL h in Mapset | ((domain(h) = S) & Svm(h)))) ¥imp ((FORALL n in S | ((F in Mapset) & (G in Mapset) & (F~[n] = G~[n]))) ¥imp (F = G)). Proof:
	Suppose_not(s,mapset,f,g) ==> Stat1: (s /= 0) & Stat2: (FORALL h in mapset | ((domain(h) = s) & Svm(h))) & Stat3: (FORALL n in s | ((f in Mapset) & (g in Mapset) & (f~[n] = g~[n]))) & (f /= g)
	n-->Stat1 ==> n in s
	n-->Stat3 ==> (f in Mapset) & (g in Mapset)
	f-->Stat2 ==> (domain(f) = s) & Svm(f)
	g-->Stat2 ==> (domain(g) = s) & Svm(g)
	Suppose ==> Stat4: not (FORALL n in s | f~[n] = g~[n])
		k-->Stat4 ==> (k in s) & (f~[k] /= g~[k])
	k-->Stat3 ==> false; Discharge ==> (FORALL n in s | f~[n] = g~[n])
	(f,g,s)-->T337 ==> false; Discharge ==> QED
--
-- 'Shift' is obviously a single-valued function.
--
Theorem 339: [The shift-map of an integer is single-valued and maps Za into Za] ((M in Za) & (N in Za)) ¥imp (Svm(Shift(M)) & (domain(Shift(M)) = Za) & (range(Shift(M)) ¥incin Za) & (Shift(M)~[N] = M ¥PLUS N)). Proof:
	Suppose_not(m,n) ==> AUTO
	APPLY() Must_be_svm(b(x)->m ¥PLUS x,s->Za,u->n) ==> (n in Za) ¥imp ({[i,m ¥PLUS i]: i in Za}~[n] = (m ¥PLUS n))
	Use_def(Shift) ==> Stat1: not({m ¥PLUS i: i in Za} ¥incin Za)
	j-->Stat1 ==> (j notin Za) & Stat2: (j in {m ¥PLUS i: i in Za})
  	i-->Stat2 ==> (j = m ¥PLUS i) & (i in Za)
	(m,i)-->T283 ==> false; Discharge ==> QED
--
-- Ths composition of two shift-maps yields a shift-map whose shift-number
-- is the sum of the shift-numbers of the operand maps.
--
Theorem 340: [Composition of shift-maps yields a shift-map] ((M in Za) & (N in Za)) ¥imp (Shift(M) @ Shift(N) = Shift(M ¥PLUS N)). Proof:
    Suppose_not(m,n) ==> AUTO
	(m,n)-->T283 ==> (m ¥PLUS n in Za)
	(m ¥PLUS n,n)-->T339 ==> Svm(Shift(m ¥PLUS n)) & (domain(Shift(m ¥PLUS n)) = Za)
 	(n,n)-->T339 ==> Svm(Shift(n)) & (domain(Shift(n)) = Za) & (range(Shift(n)) ¥incin Za)
 	(m,n)-->T339 ==> Svm(Shift(m)) & (domain(Shift(m)) = Za)
 	(Shift(m),Shift(n))-->T128 ==> Svm(Shift(m) @ Shift(n))
	(Shift(m),Shift(n))-->T95 ==> domain(Shift(m) @ Shift(n)) = Za
    (Shift(m) @ Shift(n),Shift(m ¥PLUS n),Za)-->T337 ==> AUTO
    ELEM ==> Stat1: not (FORALL k in Za | ((Shift(m) @ Shift(n))~[k]) = (Shift(m ¥PLUS n)~[k]))
    k-->Stat1 ==> (k in Za) & ((Shift(m) @ Shift(n))~[k] /= (Shift(m ¥PLUS n)~[k]))
	(n,k)-->T339 ==> (Shift(n)~[k]) = (n ¥PLUS k)
	(n,k)-->T283 ==> (n ¥PLUS k in Za)
	(m ¥PLUS n,k)-->T339 ==> Shift(m ¥PLUS n)~[k] = ((m ¥PLUS n) ¥PLUS k)
	(m,Shift(n)~[k])-->T339 ==> (Shift(m)~[Shift(n)~[k]]) = (m ¥PLUS (Shift(n)~[k]))
	(Shift(m),Shift(n),k)-->T129 ==> ((Shift(m) @ Shift(n))~[k]) = (Shift(m)~[Shift(n)~[k]])
	EQUAL ==> m ¥PLUS (Shift(n)~[k]) = m ¥PLUS (n ¥PLUS k)
	ELEM ==> (m ¥PLUS n) ¥PLUS k /= m ¥PLUS (n ¥PLUS k)
(m,n,k)-->T258 ==> false; Discharge ==> QED
--
--
Theorem 341: [Double shifting can be emulated by a single shift] ((M in Za) & (N in Za)) ¥imp (shifted_seq(shifted_seq(F,M),N) = shifted_seq(F,M ¥PLUS N)). Proof:
Suppose_not(m,n,f) ==> AUTO
	Use_def(shifted_seq) ==> ((f @ Shift(m)) @ Shift(n)) /= (f @ Shift(m ¥PLUS n))
	(f,Shift(m),Shift(n))-->T66 ==>  (f @ (Shift(m) @ Shift(n))) /= (f @ Shift(m ¥PLUS n))
	(m,n)-->T340 ==> (Shift(m) @ Shift(n)) = Shift(m ¥PLUS n)
	EQUAL ==> false; Discharge ==> QED
--
Theorem 342: [Shift(0) is the identity map on Za] (Shift(0) = {[n,n]: n in Za}) & ((Is_map(F) & (domain(F) ¥incin Za)) ¥imp (F @ Shift(0) = F)). Proof:
	Suppose_not(f) ==> AUTO
	Suppose ==> Shift(0) /= {[n,n]: n in Za}
		Use_def(Shift) ==> Stat1: {[n,0 ¥PLUS n]: n in Za} /= {[n,n]: n in Za}
		n-->Stat1 ==> (n in Za) & ([n,0 ¥PLUS n] /= [n,n])
		ELEM ==> 0 ¥PLUS n /= n
	n-->T254 ==> false; Discharge ==> (Shift(0) = {[n,n]: n in Za}) & (domain(f) ¥incin Za) & (f @ Shift(0) /= f)
	Use_def(ident) ==> Shift(0) = ident(Za)
	f-->T67 ==> f = (f ¥ON domain(f))
	(f,Za)-->T116 ==> f @ ident(Za) = (f ¥ON Za)
	EQUAL ==> f @ Shift(0) = ((f ¥ON domain(f)) ¥ON Za)
	(f,domain(f),Za)-->T69 ==> f @ Shift(0) = (f ¥ON (domain(f) * Za))
	ELEM ==> domain(f) * Za = domain(f)
	EQUAL ==> false; Discharge ==> QED
--
-- The following easy corollary is sometimes useful.
--
Theorem 343: [Shift-by-0 is the identity map on sequences] (Is_map(F) & (domain(F) ¥incin Za)) ¥imp (shifted_seq(F,0) = F). Proof:
    Suppose_not(f) ==> AUTO
    f-->T342 ==> AUTO
    ELEM ==> shifted_seq(f,0) /= f
    Use_def(shifted_seq) ==> false; Discharge ==> QED

--
-- The following alternative characterization of the left-shift operator can be useful,
-- e.g., in the proof of Theorem 350 below.
--
Theorem 344: [Form of a shifted sequence] ((M in Za) & (domain(F) ¥incin Za)) ¥imp (shifted_seq(F,M) = {[car(x) ¥MINUS M,cdr(x)]: x in F | car(x) incs M}). Proof:
    Suppose_not(m,f) ==> Stat1: (m in Za) & (domain(f) ¥incin Za) & (shifted_seq(f,m) /= {[car(x) ¥MINUS m,cdr(x)]: x in f | car(x) incs m})
	Use_def(shifted_seq) ==> (f @ Shift(m)) /= {[car(x) ¥MINUS m,cdr(x)]: x in f | car(x) incs m}
	Use_def(Shift) ==> (f @ {[i, m ¥PLUS i]: i in Za}) /= {[car(x) ¥MINUS m,cdr(x)]: x in f | car(x) incs m}
	Use_def(@) ==> {[car(p),cdr(q)]: p in {[i, m ¥PLUS i]: i in Za}, q in f | cdr(p) = car(q)} /= {[car(x) ¥MINUS m,cdr(x)]: x in f | car(x) incs m}
	SIMPLF ==> Stat2: {[car([i, m ¥PLUS i]),cdr(q)]: i in Za, q in f | cdr([i, m ¥PLUS i]) = car(q)} /= {[car(x) ¥MINUS m,cdr(x)]: x in f | car(x) incs m}
	c-->Stat2 ==> (c in {[car([i, m ¥PLUS i]),cdr(q)]: i in Za, q in f | cdr([i, m ¥PLUS i]) = car(q)}) ¥eq (c notin {[car(x) ¥MINUS m,cdr(x)]: x in f | car(x) incs m})
	Suppose ==> Stat3: (c in {[car([i, m ¥PLUS i]),cdr(q)]: i in Za, q in f | cdr([i, m ¥PLUS i]) = car(q)}) & (c notin {[car(x) ¥MINUS m,cdr(x)]: x in f | car(x) incs m})
		(i,q,q)-->Stat3(Stat3) ==> (c = [i,cdr(q)]) & (i in Za) & ((m ¥PLUS i) = car(q)) & ((c /= [car(q) ¥MINUS m,cdr(q)]) or (not(car(q) incs m)))
		ALGEBRA ==> ((m ¥PLUS i) in Za) & (((m ¥PLUS i) ¥MINUS m) = ((i ¥PLUS m) ¥MINUS m))
		(i,m)-->T304(Stat1*) ==> ((i ¥PLUS m) ¥MINUS m) = i
		EQUAL(Stat3) ==> (car(q) in Za) & (not(car(q) incs m))
		TELEM ==> 0 ¥incin i
		(m,i)-->T292 ==> m ¥incin (m ¥PLUS i)
        EQUAL ==> false; Discharge ==> Stat4: (c in {[car(x) ¥MINUS m,cdr(x)]: x in f | car(x) incs m}) &  (c notin {[car([i, m ¥PLUS i]),cdr(q)]: i in Za, q in f | cdr([i, m ¥PLUS i]) = car(q)})
        (x,car(x) ¥MINUS m,x)-->Stat4(Stat4) ==> (c = [car(x) ¥MINUS m,cdr(x)]) & (x in f) & (car(x) incs m) & (((car(x) ¥MINUS m) notin Za) or ((m ¥PLUS (car(x) ¥MINUS m)) /= car(x)))
        (x,f)-->T60 ==> car(x) in domain(f)
        ELEM ==> car(x) in Za
        ALGEBRA ==> (car(x) ¥MINUS m) in Za
    	(car(x),m)-->T325 ==> (m ¥PLUS (car(x) ¥MINUS m)) = car(x)
        (Stat4*)ELEM ==> (m ¥PLUS (car(x) ¥MINUS m)) /= car(x)
    	Discharge ==> QED
--
-- The following lemmas will be used just below to show that the concatenation of two
-- finite sequences is also a finite sequence. Among other facts, we show that
-- the left-shift operator defined above always produces a single-valued map.
--
Theorem 345: [Properties of finite and shifted finite sequences] ((F in Fin_seqs(S)) & (G in Fin_seqs(S))) ¥imp
				(Svm({[car(x) ¥PLUS #F, cdr(x)]: x in G})
					& (domain(F) * domain({[car(x) ¥PLUS #F, cdr(x)]: x in G}) = 0)). Proof+:
Suppose_not(f,s,g) ==> AUTO
   	Use_def(Fin_seqs) ==> Stat1: (f in {h: h ¥incin (Za ¥PROD S) | Svm(h) & (domain(h) in Za)}) &
   							Stat2: (g in {h: h ¥incin (Za ¥PROD S) | Svm(h) & (domain(h) in Za)})
   	h0-->Stat1 ==> (h0 ¥incin (Za ¥PROD S)) & (h0 = f) & Svm(h0) & (domain(h0) in Za)
   	h2-->Stat2 ==> (h2 ¥incin (Za ¥PROD S)) & (h2 = g) & Svm(h2) & (domain(h2) in Za)
   	EQUAL ==> (f ¥incin (Za ¥PROD S)) & Svm(f) & (domain(f) in Za)
   	EQUAL ==> (g ¥incin (Za ¥PROD S)) & Svm(g) & (domain(g) in Za)
  	f-->T336 ==> Stat3: (domain(f) = #f) & (#f in Za)
   	Suppose ==> not Svm({[car(x) ¥PLUS #f, cdr(x)]: x in g})
    APPLY(x3_thryvar:c,y3_thryvar:d) Svm_test(a(x)->(car(x) ¥PLUS #f),b(x)->cdr(x),s->g) ==>
    		((c in g) & (d in g) & (((car(c) ¥PLUS #f) = (car(d) ¥PLUS #f)) & (cdr(c) /= cdr(d))))
    				or Svm({[car(x) ¥PLUS #f, cdr(x)]: x in g})
	ELEM ==> (c in (Za ¥PROD s)) & (d in (Za ¥PROD s))
--
-- Hence, $car(c) in Za$ and $car(d) in Za$.
--
	(c,Za,s)-->T140 ==> AUTO
	(d,Za,s)-->T140 ==> AUTO
	Use_def(Svm) ==> Stat4: (FORALL x in g, y in g | (car(x) = car(y)) ¥imp (x = y))
	(c,d)-->Stat4 ==> Stat5: (car(c) = car(d)) ¥imp (c = d)
	(car(c),car(d),#f)-->T289(Stat3*) ==> Stat6: c = d
	Discharge ==> Stat7: domain(f) * domain({[car(x) ¥PLUS #f, cdr(x)]: x in g}) /= 0
--
--
--
	T336 ==> #f * domain({[car(x) ¥PLUS #f, cdr(x)]: x in g}) /= 0
    Use_def(domain) ==> domain({[car(x) ¥PLUS #f, cdr(x)]: x in g}) = {car(y): y in {[car(x) ¥PLUS #f, cdr(x)]: x in g}}
	SIMPLF ==> Stat8: #f * {car([car(x) ¥PLUS #f, cdr(x)]):  x in g} /= 0
	c1-->Stat8 ==> Stat9: (c1 in #f) & Stat10: (c1 in {car([car(x) ¥PLUS #f, cdr(x)]):  x in g})
	y-->Stat10 ==> Stat11: (y in g) & (c1 = car([car(y) ¥PLUS #f, cdr(y)]))
	(Stat11)ELEM ==> Stat12: c1 = car(y) ¥PLUS #f
	(#f,car(y))-->T292(Stat3,Stat12*) ==> #f ¥incin (car(y) ¥PLUS #f)
	(Stat9)Discharge ==> QED
--
Theorem 346: ((F in Fin_seqs(S)) & (M in Za)) ¥imp (((F ¥ON M) in Fin_seqs(S)) & (shifted_seq(F,M) in Fin_seqs(S)) & (domain(shifted_seq(F,M)) = (#F ¥MINUS M))). Proof+:
    Suppose_not(f,s,m) ==> Stat1: (f in Fin_seqs(s)) & (m in Za) & (((f ¥ON m) notin Fin_seqs(s)) or (shifted_seq(f,m) notin Fin_seqs(s)) or (domain(shifted_seq(f,m)) /= (#f ¥MINUS m)))
    f-->T335 ==> Stat2: Svm(f) & (domain(f) in Za) & (range(f) ¥incin s)
    Use_def(shifted_seq) ==> ((f ¥ON m) notin Fin_seqs(s)) or ((f @ Shift(m)) notin Fin_seqs(s)) or (domain(f @ Shift(m)) /= (#f ¥MINUS m))
    (m,m)-->T339 ==> Svm(Shift(m)) & (domain(Shift(m)) = Za) & (range(Shift(m)) ¥incin Za)
    (f,Shift(m))-->T95 ==> range(f @ Shift(m)) = range(f ¥ON range(Shift(m)))
    (f,range(Shift(m)))-->T80 ==> range(f @ Shift(m)) ¥incin s
    (f,Shift(m))-->T128 ==> Svm(f @ Shift(m))
    Use_def(domain) ==> domain(f @ Shift(m)) = {car(x): x in (f @ Shift(m))}
    Use_def(@) ==> domain(f @ Shift(m)) = {car(x): x in {[car(y),cdr(u)]: y in Shift(m), u in f | cdr(y) = car(u)}}
    SIMPLF ==> domain(f @ Shift(m)) = {car([car(y),cdr(u)]): y in Shift(m), u in f | cdr(y) = car(u)}
    Suppose ==> Stat3: {car([car(y),cdr(u)]): y in Shift(m), u in f | cdr(y) = car(u)} /= {car(y): y in Shift(m), u in f | cdr(y) = car(u)}
    (y1,u1)-->Stat3 ==> false; Discharge ==> domain(f @ Shift(m)) = {car(y): y in Shift(m), u in f | cdr(y) = car(u)}
    Use_def(Shift) ==> {car(y): y in Shift(m), u in f | cdr(y) = car(u)} = {car(y): y in {[i, m ¥PLUS i]: i in Za}, u in f | cdr(y) = car(u)}
    ELEM ==> domain(f @ Shift(m)) = {car(y): y in {[i, m ¥PLUS i]: i in Za}, u in f | cdr(y) = car(u)}
    SIMPLF ==> domain(f @ Shift(m)) = {car([i, m ¥PLUS i]): i in Za, u in f | cdr([i, m ¥PLUS i]) = car(u)}
	Suppose ==> Stat4: {car([i, m ¥PLUS i]): i in Za, u in f | cdr([i, m ¥PLUS i]) = car(u)} /= {i: i in Za, u in f | cdr([i, m ¥PLUS i]) = car(u)}
    (y2,u2)-->Stat4 ==> false; Discharge ==> domain(f @ Shift(m)) = {i: i in Za, u in f | cdr([i, m ¥PLUS i]) = car(u)}
	Suppose ==> Stat5: {i: i in Za, u in f | cdr([i, m ¥PLUS i]) = car(u)} /= {i: i in Za, u in f | m ¥PLUS i = car(u)}
    (y3,u3)-->Stat5 ==> false; Discharge ==> domain(f @ Shift(m)) = {i: i in Za, u in f | m ¥PLUS i = car(u)}
    Suppose ==> {i: i in Za, u in f | m ¥PLUS i = car(u)} /= {i: i in Za, v in domain(f) | m ¥PLUS i = v}
	    Use_def(domain) ==> {i: i in Za, u in f | m ¥PLUS i = car(u)} /= {i: i in Za, v in {car(u): u in f} | m ¥PLUS i = v}
    SIMPLF ==> false; Discharge ==> domain(f @ Shift(m)) = {i: i in Za, v in domain(f) | m ¥PLUS i = v}
    Suppose ==> Stat6: {i: i in Za, v in domain(f) | m ¥PLUS i = v} /= {i: i in Za | (m ¥PLUS i) in domain(f)}
		c-->Stat6 ==> not ((c in {i: i in Za, v in domain(f) | m ¥PLUS i = v}) ¥eq (c in {i: i in Za | (m ¥PLUS i) in domain(f)}))
    Suppose ==> Stat7: (c in {i: i in Za, v in domain(f) | m ¥PLUS i = v}) & Stat8: (c notin {i: i in Za | (m ¥PLUS i) in domain(f)})
		(i,v)-->Stat7 ==> (c = i) & (i in Za) & (v in domain(f)) & (m ¥PLUS i = v)
		i-->Stat8 ==> not((c = i) & (i in Za) & ((m ¥PLUS i)  in domain(f)))
	Discharge ==> Stat9: (c notin {i: i in Za, v in domain(f) | (m ¥PLUS i) = v}) & Stat10: (c in {i: i in Za | (m ¥PLUS i) in domain(f)})
		i1-->Stat10 ==> (c = i1) & (i1 in Za) & ((m ¥PLUS i1) in domain(f))
	(i1,m ¥PLUS i1)-->Stat9 ==> false; Discharge ==> Stat11: domain(f @ Shift(m)) = {i: i in Za | (m ¥PLUS i) in domain(f)}
	SIMPLF ==> Stat12: {i: i in Za | (m ¥PLUS i) in domain(f)} = {i in Za | (m ¥PLUS i) in domain(f)}
	Suppose ==> Stat13: {i: i in Za | (m ¥PLUS i) in domain(f)} /= {i: i in Za | (i ¥PLUS m) in domain(f)}
		c2-->Stat13 ==> (c2 in Za) & ((m ¥PLUS c2) /= (c2 ¥PLUS m))
	(m,c2)-->T252 ==> false; Discharge ==> Stat14: {i in Za | (m ¥PLUS i) in domain(f)} = {i in Za | (i ¥PLUS m) in domain(f)}
    (domain(f),m)-->T328(Stat11,Stat2,Stat1,Stat12,Stat14) ==> domain(f @ Shift(m)) = domain(f) ¥MINUS m
    f-->T336 ==> domain(f) = #f
    EQUAL ==> ((f ¥ON m) notin Fin_seqs(s)) or ((f @ Shift(m)) notin Fin_seqs(s))
    Suppose ==> (f @ Shift(m)) notin Fin_seqs(s)
    (f @ Shift(m))-->T335 ==> (domain(f) ¥MINUS m) notin Za
    (domain(f),m)-->T283 ==> false; Discharge ==> (f ¥ON m) notin Fin_seqs(s)
    Use_def(Fin_seqs) ==> Stat15: (f ¥ON m) notin {g ¥incin (Za ¥PROD s) | Svm(g) & (domain(g) in Za)}
    (m,domain(f))-->T29(Stat1,Stat2*) ==> (m ¥incin domain(f)) or (domain(f) ¥incin m)
    Suppose ==> (domain(f) * m) = domain(f)
	(f,m)-->T68(Stat15*) ==> (f ¥ON (domain(f) * m)) = (f ¥ON m)
	f-->T67(Stat15*) ==> (f ¥ON domain(f)) = f
    EQUAL(Stat1) ==> false; Discharge ==> not(domain(f) ¥incin m)
    (f,m)-->T94(Stat1*) ==> domain(f ¥ON m) in Za
    (f,m)-->T57(Stat2*) ==> Svm(f ¥ON m)
    (f ¥ON m)-->Stat15(Stat15*) ==> (f ¥ON m) ¥nincin (Za ¥PROD s)
    Use_def(Svm)(Stat15*) ==> Is_map(f ¥ON m)
    T206(Stat15*) ==> Ord(Za)
    (Za,domain(f ¥ON m))-->T13(Stat15*) ==> domain(f ¥ON m) ¥incin Za
    (f,m)-->T80(Stat2*) ==> range(f ¥ON m) ¥incin s
    (f ¥ON m,Za,s)-->T141(Stat15*) ==> false; Discharge ==> QED
--
-- We start with a preliminary lemma which shows that the concatenation of two finite sequences if is a finite sequence,
-- and which gives additional details concering the domin and range of the concatenation.
--
Theorem 347: [Concatenation of finite sequences] ((F in Fin_seqs(S)) & (G in Fin_seqs(S))) ¥imp
			((concat(F,G) in Fin_seqs(S)) & (domain(concat(F,G)) = domain(F) ¥PLUS domain(G)) & (range(concat(F,G)) = range(F) + range(G))) & ((U in domain(F) ¥PLUS domain(G)) ¥imp (concat(F,G)~[U] = if U in domain(F) then F~[U] else G~[U ¥MINUS domain(F)] end if)). Proof+:
Suppose_not(f,s1,g,u) ==> AUTO
	Use_def(concat) ==> concat(f,g) = {[n,if n in domain(f) then f~[n] else g~[n ¥MINUS domain(f)] end if]: n in domain(f) ¥PLUS domain(g)}
	APPLY() Must_be_svm(b(x)->if x in domain(f) then f~[x] else g~[x ¥MINUS domain(f)] end if,s->domain(f) ¥PLUS domain(g),u->u) ==> Svm({[x,if x in domain(f) then f~[x] else g~[x ¥MINUS domain(f)] end if]: x in domain(f) ¥PLUS domain(g)}) & (domain({[x,if x in domain(f) then f~[x] else g~[x ¥MINUS domain(f)] end if]: x in domain(f) ¥PLUS domain(g)}) = domain(f) ¥PLUS domain(g)) & (range({[x,if x in domain(f) then f~[x] else g~[x ¥MINUS domain(f)] end if]: x in domain(f) ¥PLUS domain(g)}) = {if x in domain(f) then f~[x] else g~[x ¥MINUS domain(f)] end if: x in domain(f) ¥PLUS domain(g)}) & ((u in domain(f) ¥PLUS domain(g)) ¥imp ({[x,if x in domain(f) then f~[x] else g~[x ¥MINUS domain(f)] end if]: x in domain(f) ¥PLUS domain(g)}~[u] = if u in domain(f) then f~[u] else g~[u ¥MINUS domain(f)] end if))
	EQUAL ==> Stat2: Svm(concat(f,g)) & (domain(concat(f,g)) = domain(f) ¥PLUS domain(g)) & (range(concat(f,g)) = {if x in domain(f) then f~[x] else g~[x ¥MINUS domain(f)] end if: x in domain(f) ¥PLUS domain(g)}) & ((u in domain(f) ¥PLUS domain(g)) ¥imp (concat(f,g)~[u] = if u in domain(f) then f~[u] else g~[u ¥MINUS domain(f)] end if))
	(f,s1)-->T335 ==> Stat3: Svm(f) & (domain(f) in Za) & (range(f) ¥incin s1)
	(g,s1)-->T335 ==> Stat4: Svm(g) & (domain(g) in Za) & (range(g) ¥incin s1)
	ALGEBRA ==> Stat5: ((domain(g) ¥PLUS domain(f)) = (domain(f) ¥PLUS domain(g))) &
		((domain(f) ¥PLUS domain(g)) in Za)
--
-- What is missing from the above conclusions is the fact that range(concat(f,g)) = range(f) + range(f)),
-- and we now establish this further fact, We begin by showing that the first of these two sets is included in the second
--
	Suppose ==> Stat7: not(range(concat(f,g)) ¥incin (range(f) + range(g)))
		c-->Stat7 ==> Stat8: (c in {if x in domain(f) then f~[x] else g~[x ¥MINUS domain(f)] end if: x in (domain(f) ¥PLUS domain(g))}) & (c notin (range(f) + range(g)))
		x-->Stat8 ==> (x in (domain(f) ¥PLUS domain(g))) & (c = if x in domain(f) then f~[x] else g~[x ¥MINUS domain(f)] end if)
		(domain(f) ¥PLUS domain(g),x)-->T12 ==> Ord(x)
		Suppose ==> x in domain(f)
		x-->T75 ==> false; Discharge ==> x notin domain(f)
		(domain(f),x)-->T35 ==> x incs domain(f)
		ELEM ==> g~[x ¥MINUS domain(f)] notin range(g)
		(domain(g),domain(f))-->T304 ==> (domain(g) ¥PLUS domain(f)) ¥MINUS domain(f) = domain(g)
		EQUAL ==> (domain(f) ¥PLUS domain(g)) ¥MINUS domain(f) = domain(g)
--
-- It follows by strict monotonicity of subtraction that x ¥MINUS domain(f) is a member of domain(g)
--
		(domain(f),domain(f) ¥PLUS domain(g),x)-->T302 ==> (x ¥MINUS domain(f)) in domain(g)
--
-- But then c = g~[x ¥MINUS domain(f)] plainly belongs to range(g), a contradiction which proves our assertion
--
	(x ¥MINUS domain(f),g)-->T75 ==> false; Discharge ==> range(concat(f,g)) ¥incin (range(f) + range(g))
--
-- Next we show that range(concat(f,g)) incs (range(f) + range(g)), from which our theorem is immediate.
--
	ELEM ==> range(concat(f,g)) = {if x in domain(f) then f~[x] else g~[x ¥MINUS domain(f)] end if: x in domain(f) ¥PLUS domain(g)}
	f-->T73 ==> range(f) = {f~[x]: x in domain(f)}
	g-->T73 ==> range(g) = {g~[x]: x in domain(g)}
	Suppose ==> Stat9: not(range(concat(f,g)) incs range(f))
		c1-->Stat9 ==> Stat10: (c1 in {f~[x]: x in domain(f)}) & Stat11: (c1 notin {if x in domain(f) then f~[x] else g~[x ¥MINUS domain(f)] end if: x in domain(f) ¥PLUS domain(g)})
		x1-->Stat10 ==> (c1 = f~[x1]) & (x1 in domain(f))
	x1-->Stat11 ==> not(x1 in domain(f) ¥PLUS domain(g))
	(domain(f),domain(f),domain(g),0)-->T219 ==> (domain(f) ¥PLUS 0) ¥incin (domain(f) ¥PLUS domain(g))
	(domain(f))-->T254 ==> domain(f) ¥PLUS 0 = domain(f);
	Discharge ==> range(concat(f,g)) incs range(f)
	Suppose ==> Stat12: not(range(concat(f,g)) incs range(g))
		c2-->Stat12 ==> Stat13: (c2 in {g~[x]: x in domain(g)}) & Stat14: (c2 notin {if x in domain(f) then f~[x] else g~[x ¥MINUS domain(f)] end if: x in domain(f) ¥PLUS domain(g)})
		x2-->Stat13 ==> (c2 = g~[x2]) & (x2 in domain(g))
		T206 ==> Ord(Za)
		(Za,domain(g))-->T13 ==> x2 in Za
		(domain(f),domain(g),x2)-->T288 ==> Stat15: (x2 ¥PLUS domain(f)) in (domain(g) ¥PLUS domain(f))
		(x2,domain(f))-->T304 ==> (x2 ¥PLUS domain(f)) ¥MINUS domain(f) = x2
		EQUAL ==> g~[(x2 ¥PLUS domain(f)) ¥MINUS domain(f)] = g~[x2]
		(x2,0,domain(f),domain(f))-->T219 ==> (x2 ¥PLUS domain(f)) incs (0 ¥PLUS domain(f))
		(domain(f))-->T254 ==> Stat16: (x2 ¥PLUS domain(f)) incs domain(f)
		ELEM ==> Stat17: (x2 ¥PLUS domain(f)) notin domain(f)
		(x2 ¥PLUS domain(f))-->Stat14 ==> Stat18: not((c2 = if (x2 ¥PLUS domain(f)) in domain(f) then f~[(x2 ¥PLUS domain(f))] else g~[(x2 ¥PLUS domain(f)) ¥MINUS domain(f)] end if) & ((x2 ¥PLUS domain(f)) in (domain(f) ¥PLUS domain(g))))
		(Stat17,Stat18,Stat16,Stat5,Stat15)ELEM ==> not(c2 = (g~[(x2 ¥PLUS domain(f)) ¥MINUS domain(f)]))
	EQUAL ==> false; Discharge ==> Stat19: range(concat(f,g)) = (range(f) + range(g))
	(Stat2,Stat5,Stat19,Stat3,Stat4)ELEM ==> Svm(concat(f,g)) & (range(concat(f,g)) ¥incin s1) & (domain(concat(f,g)) in Za)
	(concat(f,g),s1)-->T335 ==> concat(f,g) in Fin_seqs(s1)
	Discharge ==> QED
--
--
--
Theorem 348: [$0$ is bilateral unit for sequence concatenation] (F in Fin_seqs(S)) ¥imp ((concat(F,0) = F) & (concat(0,F) = F)). Proof:
Suppose_not(f,s) ==> AUTO
    (f,s)-->T335 ==> Svm(f) & (domain(f) in Za)
    f-->T72 ==> f = {[n,f~[n]]: n in domain(f)}
    T59 ==> domain(0) = 0
    (domain(f))-->T254 ==> ((domain(f) ¥PLUS 0) = domain(f)) & ((0 ¥PLUS domain(f)) = domain(f))
    Suppose ==> concat(f,0) /= f
	Use_def(concat) ==> concat(f,0) = {[n,if n in domain(f) then f~[n] else 0~[n ¥MINUS domain(f)] end if]: n in domain(f) ¥PLUS domain(0)}
	EQUAL ==> Stat1: {[n,if n in domain(f) then f~[n] else 0~[n ¥MINUS domain(f)] end if]: n in domain(f)} /= {[n,f~[n]]: n in domain(f)}
    n-->Stat1(Stat1) ==> false; Discharge ==> concat(0,f) /= f
    Use_def(concat) ==> concat(0,f) = {[n,if n in domain(0) then 0~[n] else f~[n ¥MINUS domain(0)] end if]: n in domain(0) ¥PLUS domain(f)}
    n-->T268 ==> (n ¥MINUS 0) = #n
    EQUAL ==> Stat2: {[n,if n in 0 then 0~[n] else f~[#n] end if]: n in domain(f)} /= {[n,f~[n]]: n in domain(f)}
    m-->Stat2(Stat2) ==> (m in domain(f)) & ((f~[#m]) /= (f~[m]))
    T206 ==> Ord(Za)
    (Za,domain(f))-->T13 ==> m in Za
    m-->T207 ==> (#m) = m
EQUAL ==> false; Discharge ==> QED
--
--
--
Theorem 349: [Associativity of sequence concatenation] ((F in Fin_seqs(S)) & (G in Fin_seqs(S)) & (H in Fin_seqs(S))) ¥imp (concat(F,concat(G,H)) = concat(concat(F,G),H)). Proof+:
Suppose_not(f,s,g,h) ==> AUTO
    ELEM ==> Stat1: (f in Fin_seqs(s)) & (g in Fin_seqs(s)) & (h in Fin_seqs(s))
    (f,s,g)-->T347 ==> Stat2: (concat(f,g) in Fin_seqs(s)) & (domain(concat(f,g)) = domain(f) ¥PLUS domain(g))
    (g,s,h)-->T347 ==> Stat3: (concat(g,h) in Fin_seqs(s)) & (domain(concat(g,h)) = domain(g) ¥PLUS domain(h))
    (f,s,concat(g,h))-->T347 ==> (concat(f,concat(g,h)) in Fin_seqs(s)) & (domain(concat(f,concat(g,h))) = domain(f) ¥PLUS domain(concat(g,h)))
    (concat(f,g),s,h)-->T347 ==> (concat(concat(f,g),h) in Fin_seqs(s)) & (domain(concat(concat(f,g),h)) = domain(concat(f,g)) ¥PLUS domain(h))
    EQUAL ==> (domain(concat(f,concat(g,h))) = (domain(f) ¥PLUS (domain(g) ¥PLUS domain(h)))) & (domain(concat(concat(f,g),h)) = (domain(f) ¥PLUS domain(g)) ¥PLUS domain(h))
    (concat(f,concat(g,h)),s)-->T335 ==> Svm(concat(f,concat(g,h)))
    (concat(concat(f,g),h),s)-->T335 ==> Svm(concat(concat(f,g),h))
    (domain(f),domain(g),domain(h))-->T258 ==> Stat4: (domain(f) ¥PLUS (domain(g) ¥PLUS domain(h))) = (domain(f) ¥PLUS domain(g)) ¥PLUS domain(h)
    (concat(f,concat(g,h)),concat(concat(f,g),h),domain(concat(f,concat(g,h))))-->T337 ==> not (FORALL j in domain(concat(f,concat(g,h))) | concat(f,concat(g,h))~[j] = concat(concat(f,g),h)~[j])
    EQUAL ==> Stat5: not (FORALL j in (domain(f) ¥PLUS (domain(g) ¥PLUS domain(h))) | concat(f,concat(g,h))~[j] = concat(concat(f,g),h)~[j])
    j-->Stat5 ==> Stat6: (j in (domain(f) ¥PLUS (domain(g) ¥PLUS domain(h)))) & (concat(f,concat(g,h))~[j] /= concat(concat(f,g),h)~[j])
--
-- Now we know that the single-valued maps $concat(f,concat(g,h))$ and $concat(concat(f,g),h)$ have the same domain,
-- and have only to prove that they have equal vaues at each point $j$ of that domain. Formulae for those values are easily derived.
--
    (f,s,g,j)-->T347(Stat5*)  ==> Stat7: (j in (domain(f) ¥PLUS domain(g))) ¥imp (concat(f,g)~[j] = if j in domain(f) then f~[j] else g~[j ¥MINUS domain(f)] end if)
    (concat(f,g),s,h,j)-->T347(Stat7*) ==> Stat8: (j in (domain(concat(f,g)) ¥PLUS domain(h))) ¥imp (concat(concat(f,g),h)~[j] = if j in domain(concat(f,g)) then concat(f,g)~[j] else h~[j ¥MINUS domain(concat(f,g))] end if)
    EQUAL(Stat2,Stat7,Stat8) ==> Stat9: (j in (domain(f) ¥PLUS (domain(g)) ¥PLUS domain(h))) ¥imp (concat(concat(f,g),h)~[j] = if j in (domain(f) ¥PLUS domain(g)) then if j in domain(f) then f~[j] else g~[j ¥MINUS domain(f)] end if else h~[j ¥MINUS (domain(f) ¥PLUS domain(g))] end if)
    (Stat6,Stat9,Stat4*)ELEM ==> (concat(concat(f,g),h)~[j]) = if j in (domain(f) ¥PLUS domain(g)) then if j in domain(f) then f~[j] else g~[j ¥MINUS domain(f)] end if else h~[j ¥MINUS (domain(f) ¥PLUS domain(g))] end if
    (f,s,concat(g,h),j)-->T347(Stat9*) ==> Stat10: (j in (domain(f) ¥PLUS (domain(concat(g,h))))) ¥imp (concat(f,concat(g,h))~[j] = if j in domain(f) then f~[j] else concat(g,h)~[j ¥MINUS domain(f)] end if)
    EQUAL(Stat10,Stat3) ==> (j in (domain(f) ¥PLUS (domain(g) ¥PLUS domain(h)))) ¥imp (concat(f,concat(g,h))~[j] = if j in domain(f) then f~[j] else concat(g,h)~[j ¥MINUS domain(f)] end if)
    (Stat6*)ELEM ==> Stat11: if j in (domain(f) ¥PLUS domain(g)) then if j in domain(f) then f~[j] else g~[j ¥MINUS domain(f)] end if else h~[j ¥MINUS (domain(f) ¥PLUS domain(g))] end if /= if j in domain(f) then f~[j] else concat(g,h)~[j ¥MINUS domain(f)] end if
    (f,s)-->T336(Stat1,Stat1*) ==> Stat12: domain(f) in Za
    (g,s)-->T336(Stat1,Stat1*) ==> Stat13: domain(g) in Za
    (h,s)-->T336(Stat1,Stat1*) ==> domain(h) in Za
    ALGEBRA(Stat13*) ==> ((domain(g) ¥PLUS domain(h)) in Za) & (0 in Za)
    Suppose ==> ((domain(f) ¥PLUS (domain(g) ¥PLUS domain(h))) ¥MINUS domain(f)) /= (domain(g) ¥PLUS domain(h))
	(domain(f),domain(g) ¥PLUS domain(h))-->T252(Stat10*) ==> (domain(f) ¥PLUS (domain(g) ¥PLUS domain(h))) = ((domain(g) ¥PLUS domain(h)) ¥PLUS domain(f))
	EQUAL(Stat10*) ==> (((domain(g) ¥PLUS domain(h)) ¥PLUS domain(f)) ¥MINUS domain(f)) /= (domain(g) ¥PLUS domain(h))
    (domain(g) ¥PLUS domain(h),domain(f))-->T304(Stat10*) ==> false; Discharge ==> ((domain(f) ¥PLUS (domain(g) ¥PLUS domain(h))) ¥MINUS domain(f)) = (domain(g) ¥PLUS domain(h))
    Suppose ==> domain(g) = 0
	(g,s)-->T335 ==> Svm(g)
	g-->T72(Stat11*) ==> g = {[x,g~[x]]: x in domain(g)}
	Set_monot ==> {[x,g~[x]]: x in 0} = {x: x in 0}
	SIMPLF(Stat11) ==> {[x,g~[x]]: x in 0} = 0
	EQUAL(Stat11) ==> g = 0
	h-->T348 ==> concat(0,h) = h
	f-->T348 ==> concat(f,0) = f
    EQUAL ==> false; Discharge ==> domain(g) /= 0
    Suppose ==> (domain(g) ¥PLUS domain(h)) = 0
		(domain(g),domain(h))-->T252(Stat11*) ==> (domain(h) ¥PLUS domain(g)) = 0
    (domain(h),domain(g))-->T284(Stat11*) ==> false; Discharge ==> (domain(g) ¥PLUS domain(h)) /= 0
    (domain(f),domain(g) ¥PLUS domain(h),j)-->T326(Stat6*) ==> Stat14: (j ¥MINUS domain(f)) in (domain(g) ¥PLUS domain(h))
    (g,s,h,j ¥MINUS domain(f))-->T347(Stat1,Stat14*) ==> Stat15: concat(g,h)~[j ¥MINUS domain(f)] = if (j ¥MINUS domain(f)) in domain(g) then g~[j ¥MINUS domain(f)] else h~[(j ¥MINUS domain(f)) ¥MINUS domain(g)] end if
    EQUAL(Stat15,Stat11) ==> if j in (domain(f) ¥PLUS domain(g)) then if j in domain(f) then f~[j] else g~[j ¥MINUS domain(f)] end if else h~[j ¥MINUS (domain(f) ¥PLUS domain(g))] end if /= if j in domain(f) then f~[j] else if (j ¥MINUS domain(f)) in domain(g) then g~[j ¥MINUS domain(f)] else h~[(j ¥MINUS domain(f)) ¥MINUS domain(g)] end if end if
    Suppose ==> not((j in domain(f)) ¥imp (j in (domain(f) ¥PLUS domain(g))))
	(domain(f))-->T254(Stat11*) ==> (0 ¥PLUS domain(f)) = domain(f)
	(domain(g),domain(f))-->T252(Stat15*) ==> (domain(g) ¥PLUS domain(f)) = (domain(f) ¥PLUS domain(g))
    (0,domain(g),domain(f))-->T296(Stat11*) ==> false; Discharge ==> AUTO
    Suppose ==> (j notin Za) or (not Ord(j))
	j-->T207(Stat14*) ==> j notin Za
	T206(Stat14*) ==> Ord(Za)
	(domain(f),domain(g) ¥PLUS domain(h))-->T283(Stat11) ==> (domain(f) ¥PLUS (domain(g) ¥PLUS domain(h))) in Za
	(Za,domain(f) ¥PLUS (domain(g) ¥PLUS domain(h)))-->T13(Stat6*) ==> (not Ord(domain(f) ¥PLUS (domain(g) ¥PLUS domain(h))))
    (domain(f),domain(g) ¥PLUS domain(h))-->T283(Stat11*) ==> false; Discharge ==> AUTO
    Suppose ==> Stat16: not((j in (domain(f) ¥PLUS domain(g))) ¥eq ((j ¥MINUS domain(f)) in domain(g)))
	Suppose ==> j in (domain(f) ¥PLUS domain(g))
	(domain(f),domain(g),j)-->T326(Stat11*) ==> false; Discharge ==> Stat17: j notin (domain(f) ¥PLUS domain(g))
	ALGEBRA(Stat11*) ==> (domain(f) ¥PLUS domain(g)) in Za
	(domain(f) ¥PLUS domain(g),j)-->T35(Stat15) ==> j incs (domain(f) ¥PLUS domain(g))
	(j,domain(f) ¥PLUS domain(g),domain(f))-->T310(Stat15*) ==> (j ¥MINUS domain(f)) incs ((domain(f) ¥PLUS domain(g)) ¥MINUS domain(f))
	(domain(f),domain(g))-->T252(Stat15*) ==> (domain(f) ¥PLUS domain(g)) = (domain(g) ¥PLUS domain(f))
	EQUAL(Stat15) ==> Stat18: (j ¥MINUS domain(f)) incs ((domain(g) ¥PLUS domain(f)) ¥MINUS domain(f))
    (domain(g),domain(f))-->T304(Stat12,Stat13,Stat18,Stat16,Stat17*) ==> false; Discharge ==> (not(j in domain(f))) ¥imp ((j in (domain(f) ¥PLUS domain(g))) ¥eq ((j ¥MINUS domain(f)) in domain(g)))
    TELEM ==> ((not(j in domain(f))) & (j in (domain(f) ¥PLUS domain(g)))) ¥imp ((g~[j ¥MINUS domain(f)]) = (g~[j ¥MINUS domain(f)]))
    Suppose ==> not(((not(j in domain(f))) & (not(j in (domain(f) ¥PLUS domain(g))))) ¥imp ((h~[j ¥MINUS (domain(f) ¥PLUS domain(g))]) = (h~[(j ¥MINUS domain(f)) ¥MINUS domain(g)])))
	(domain(f),j)-->T35(Stat11*) ==> j incs domain(f)
	(j,domain(f))-->T283(Stat11*) ==> ((j ¥MINUS domain(f)) in Za) & ((j ¥MINUS domain(f)) notin domain(g))
	(domain(g),j ¥MINUS domain(f))-->T35(Stat13) ==> (j ¥MINUS domain(f)) incs domain(g)
        (domain(f),j,domain(g))-->T303(Stat11*) ==> (j ¥MINUS (domain(f) ¥PLUS domain(g))) = ((j ¥MINUS domain(f)) ¥MINUS domain(g))
    EQUAL(Stat15) ==> false; Discharge ==> AUTO
    APPLY() if_then_else2(q->(j in domain(f)),p->(j in (domain(f) ¥PLUS domain(g))),a->(f~[j]),b->(g~[j ¥MINUS domain(f)]),c->(h~[j ¥MINUS (domain(f) ¥PLUS domain(g))]),pp->((j ¥MINUS domain(f)) in domain(g)),ap->(f~[j]),bp->(g~[j ¥MINUS domain(f)]),cp->(h~[(j ¥MINUS domain(f)) ¥MINUS domain(g)])) ==>
	if j in (domain(f) ¥PLUS domain(g)) then if j in domain(f) then f~[j] else g~[j ¥MINUS domain(f)] end if else h~[j ¥MINUS (domain(f) ¥PLUS domain(g))] end if = if j in domain(f) then f~[j] else if (j ¥MINUS domain(f)) in domain(g) then g~[j ¥MINUS domain(f)] else h~[(j ¥MINUS domain(f)) ¥MINUS domain(g)] end if end if
(Stat15*)Discharge ==> QED
--
Theorem 350: [Concatenation of shifted sequences] ((F in Fin_seqs(S)) & (M in domain(F))) ¥imp ((shifted_seq(F,M) in Fin_seqs(S)) & (F = concat((F ¥ON M), shifted_seq(F,M)))). Proof:
    Suppose_not(f,s,m) ==> AUTO
--
-- For, assuming the triple $f,s,m$ to be a counterexample to our theorem,
-- we reach a contradiction leading to the desired conclusion arguing as follows.
-- We begin by observing that $m$ is an unsigned integer insofar as an element of
-- the domain of $f$; hence, by the earlier Theorem 345, $shifted_seq(f,m)$
-- is a single-valued-map. Hence, if we assume that $shifted_seq(f,m) notin Fin_seqs(s)$,
-- the reason can either be that $shifted_seq(f,m)$ is not included in $Za ¥PROD s$ or that
-- its domain is not an insigned integer.
--
	(f,s)-->T336 ==> (#f in Za) & (domain(f)=#f)
	(f,s)-->T335 ==> Stat1: Svm(f) & (range(f) ¥incin s)
	Use_def(Svm) ==> Is_map(f)
	T206 ==> Ord(Za)
	(Za,domain(f))-->T12 ==> Ord(domain(f))
	(Za,domain(f))-->T13 ==> (domain(f) ¥incin Za) & (m in Za)
	(domain(f),m)-->T13 ==> domain(f) incs m
	(m,f)-->T344 ==> Stat2: shifted_seq(f,m) = {[car(x) ¥MINUS m,cdr(x)]: x in f | car(x) incs m}
	(f,s,m)-->T346 ==> Stat3: shifted_seq(f,m) in Fin_seqs(s)
	ELEM ==> Stat4: f /= concat((f ¥ON m), shifted_seq(f,m))
--
-- Now assume that the two sides of the inequality
--	$f /= concat((f ¥ON m), shifted_seq(f,m))$
-- just obtained have different domains. We reach a contradiction
-- arguing as follows.
--
	(f,s,m)-->T346 ==> Stat5: ((f ¥ON m) in Fin_seqs(s)) &
		(shifted_seq(f,m) in Fin_seqs(s)) &
		(domain(shifted_seq(f,m)) = (#f ¥MINUS m))
	(f,m)-->T94 ==> Stat6: domain(f ¥ON m) = m
	Suppose ==> domain(f) /= domain(concat((f ¥ON m), shifted_seq(f,m)))
		(f ¥ON m,s,shifted_seq(f,m))-->T347 ==> domain(f) /= (domain(f ¥ON m) ¥PLUS domain(shifted_seq(f,m)))
		(m,#f)-->T272 ==> ((#f ¥MINUS m) ¥PLUS m) = #f
		(#f ¥MINUS m,m)-->T252 ==> ((#f ¥MINUS m) ¥PLUS m) = (m ¥PLUS (#f ¥MINUS m))
	EQUAL ==> false; Discharge ==> Stat7: domain(f) = domain(concat((f ¥ON m), shifted_seq(f,m)))
--
-- Since $f$ and $concat((f ¥ON m), shifted_seq(f,m))$ are single-valued
-- maps and, as just observed, they have the same domain, they can only differ if
-- they send some element $n0$ of their common domain to different images.
--
	Suppose ==> Stat8: (FORALL n0 in domain(f) | (f~[n0]) = (concat((f ¥ON m), shifted_seq(f,m))~[n0]))
		(f ¥ON m,s,shifted_seq(f,m))-->T347(Stat5,Stat5*) ==> Stat9: concat((f ¥ON m), shifted_seq(f,m)) in Fin_seqs(s)
		(concat((f ¥ON m), shifted_seq(f,m)))-->T335(Stat9*) ==> Stat10: Svm(concat((f ¥ON m), shifted_seq(f,m)))
	(f,concat((f ¥ON m),shifted_seq(f,m)),domain(f))-->T337(Stat7,Stat1,Stat10,Stat4,Stat8*) ==> false; Discharge ==> Stat11: not(FORALL n0 in domain(f) | (f~[n0]) = (concat((f ¥ON m), shifted_seq(f,m))~[n0]))
	n0-->Stat11(Stat11*) ==> Stat12: (n0 in domain(f)) & ((f~[n0]) /= (concat((f ¥ON m), shifted_seq(f,m))~[n0]))
	Use_def(concat)(Stat11*) ==> concat((f ¥ON m), shifted_seq(f,m)) = {[n,if n in domain(f ¥ON m) then (f ¥ON m)~[n] else (shifted_seq(f,m)~[n ¥MINUS domain(f ¥ON m)]) end if]: n in domain(f ¥ON m) ¥PLUS domain(shifted_seq(f,m))}
	APPLY() Must_be_svm(b(n)->if n in domain(f ¥ON m) then (f ¥ON m)~[n] else (shifted_seq(f,m)~[n ¥MINUS domain(f ¥ON m)]) end if,s->(domain(f ¥ON m) ¥PLUS domain(shifted_seq(f,m))),u->n0) ==>
		(domain({[n,if n in domain(f ¥ON m) then (f ¥ON m)~[n] else (shifted_seq(f,m)~[n ¥MINUS domain(f ¥ON m)]) end if]: n in (domain(f ¥ON m) ¥PLUS domain(shifted_seq(f,m)))}) = (domain(f ¥ON m) ¥PLUS domain(shifted_seq(f,m)))) &
		(n0 in (domain(f ¥ON m) ¥PLUS domain(shifted_seq(f,m)))) ¥imp (({[n,if n in domain(f ¥ON m) then (f ¥ON m)~[n] else (shifted_seq(f,m)~[n ¥MINUS domain(f ¥ON m)]) end if]: n in (domain(f ¥ON m) ¥PLUS domain(shifted_seq(f,m)))}~[n0]) = if n0 in domain(f ¥ON m) then (f ¥ON m)~[n0] else (shifted_seq(f,m)~[n0 ¥MINUS domain(f ¥ON m)]) end if)
	EQUAL(Stat11) ==> ((concat((f ¥ON m), shifted_seq(f,m))~[n0]) = (({[n,if n in domain(f ¥ON m) then (f ¥ON m)~[n] else (shifted_seq(f,m)~[n ¥MINUS domain(f ¥ON m)]) end if]: n in domain(f ¥ON m) ¥PLUS domain(shifted_seq(f,m))})~[n0])) &
		(domain(concat((f ¥ON m), shifted_seq(f,m))) = (domain(f ¥ON m) ¥PLUS domain(shifted_seq(f,m))))
	(Stat7*)ELEM ==> Stat13: (f~[n0]) /= if n0 in domain(f ¥ON m) then (f ¥ON m)~[n0] else (shifted_seq(f,m)~[n0 ¥MINUS domain(f ¥ON m)]) end if
	EQUAL(Stat6,Stat13) ==> Stat14: (f~[n0]) /= if n0 in m then (f ¥ON m)~[n0] else (shifted_seq(f,m)~[n0 ¥MINUS m]) end if
--
-- Suppose first that $n0 in m$. Then, since $n0 in domain(f)$, we get
-- $(f~[n0]) = ((f ¥ON m)~[n0])$, which leads to a contradiction.
-- Therefore, $n0 notin m$ and $(f~[n0]) /= (shifted_seq(f,m)~[n0 ¥MINUS m])$.
--
	Suppose ==> Stat15: n0 in m
		(f,m)-->T94(Stat12,Stat15*) ==> n0 in domain(f ¥ON m)
	(f,m,n0)-->T125(Stat14*) ==> false; Discharge ==> Stat16: n0 notin m
	(Stat14*)ELEM ==> Stat17: (f~[n0]) /= (shifted_seq(f,m)~[n0 ¥MINUS m])
--
-- However, since $f$ and $shifted_seq(f,m)$ are single-valued maps, and plainly
-- $[n0,(f~[n0])] in f$ and $[n0 ¥MINUS m,(f~[n0])] in shifted_seq(f,m)$
-- both hold (to see this more easily, we will designate $[n0,(f~[n0])]$ as $p$),
-- we reach the sought contradiction.
--
	Use_def(domain)(Stat12*) ==> Stat18: n0 in {car(p): p in f}
	p-->Stat18(Stat18*) ==> Stat19: (n0 = car(p)) & (p in f)
	(f,p)-->T74(Stat1,Stat19*) ==> Stat20: (f~[car(p)]) = cdr(p)
	(Za,m)-->T12(Stat1*) ==> Ord(m)
	(domain(f),car(p))-->T12(Stat1*) ==> Ord(car(p))
	(m,car(p))-->T35(Stat16*) ==> Stat21: car(p) incs m
	Suppose ==> Stat22: [car(p) ¥MINUS m, cdr(p)] notin {[car(x) ¥MINUS m,cdr(x)]: x in f | car(x) incs m}
	p-->Stat22(Stat19,Stat21*) ==> false; Discharge ==> Stat23: [car(p) ¥MINUS m, cdr(p)] in {[car(x) ¥MINUS m,cdr(x)]: x in f | car(x) incs m}
	(shifted_seq(f,m),s)-->T335(Stat3,Stat23,Stat2*) ==> Stat24: Svm(shifted_seq(f,m)) & ([car(p) ¥MINUS m, cdr(p)] in shifted_seq(f,m))
	(shifted_seq(f,m),[car(p) ¥MINUS m, cdr(p)])-->T74(Stat24*) ==> (shifted_seq(f,m)~[car(p) ¥MINUS m]) = cdr(p)
    EQUAL(Stat17) ==> false; Discharge ==> QED
--
--
THEORY subseq(g,f)		 [Subsequence of a finite or denumerable sequence]
    Svm(f) & (domain(f) in next(Za))
    g in Subseqs(f)
END subseq;
--
ENTER_THEORY subseq
--
Def subseq.0: [Subsequence generator] h_thryvar := {p in arb({ h ¥incin (Za ¥PROD Za) | (g = (f @ h)) & Svm(h) & (FORALL i | (next(i) in domain(h)) ¥imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) }) | cdr(p) in domain(f)}
--
Theorem subseq.1: (g = (f @ h_thryvar)) & one_1_map(h_thryvar) & (domain(h_thryvar) in next(Za)) & (range(h_thryvar) ¥incin domain(f)) &
	(FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) ¥imp ((h_thryvar~[i]) in (h_thryvar~[j]))). Proof:
    Suppose_not ==> Stat1: (g /= (f @ h_thryvar)) or (not one_1_map(h_thryvar)) or (domain(h_thryvar) notin next(Za)) or (not(range(h_thryvar) ¥incin domain(f))) or (not(FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) ¥imp ((h_thryvar~[i]) in (h_thryvar~[j]))))
--
-- We start with expanding the definition of 'Subseqs', which requires $g$ to be of the form $f @ h$,
-- with $h$ meeting various conditions which, however, do not include the condition that the components
-- of $h$ belong to $domain(f)$. Starting with the specific $h$ from which $h_thryvar$ has been obtained
-- by simply putting $h_thryvar = {p in h | cdr(p) in domain(f)}$, we must check that $h_thryvar$ is a
-- (finite or infinite) sequence enjoying the same properties as $h$, plus the additional one that its
-- components belong to the domain of $f$.
--
        Assump ==> Svm(f) & (domain(f) in next(Za)) & (g in Subseqs(f))
        (domain(f))-->T330 ==> domain(f) ¥incin Za
        Use_def(Subseqs) ==> Stat2: (g in { f @ h: h ¥incin (Za ¥PROD Za) | Svm(h) & (FORALL i | (next(i) in domain(h)) ¥imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) })
        Loc_def ==> h0 = arb({ h ¥incin (Za ¥PROD Za) | (g = (f @ h)) & Svm(h) & (FORALL i | (next(i) in domain(h)) ¥imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) })
        Suppose ==> Stat3: 0 = { h ¥incin (Za ¥PROD Za) | (g = (f @ h)) & Svm(h) & (FORALL i | (next(i) in domain(h)) ¥imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) }
            h1-->Stat2 ==> (h1 ¥incin (Za ¥PROD Za)) & (g = (f @ h1)) & Svm(h1) & (FORALL i | (next(i) in domain(h1)) ¥imp ((i in domain(h1)) & ((h1~[i]) in (h1~[next(i)]))))
        h1-->Stat3 ==> false; Discharge ==> Stat4: h0 in { h ¥incin (Za ¥PROD Za) | (g = (f @ h)) & Svm(h) & (FORALL i | (next(i) in domain(h)) ¥imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) }
        ()-->Stat4 ==> (g = (f @ h0)) & (h0 ¥incin (Za ¥PROD Za)) & Svm(h0) & Stat5: (FORALL i | (next(i) in domain(h0)) ¥imp ((i in domain(h0)) & ((h0~[i]) in (h0~[next(i)]))))
        (h0, Za, Za)-->T141 ==> domain(h0) ¥incin Za
        Use_def(h_thryvar) ==> h_thryvar = {p in arb({ h ¥incin (Za ¥PROD Za) | (g = (f @ h)) & Svm(h) & (FORALL i | (next(i) in domain(h)) ¥imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) }) | cdr(p) in domain(f)}
        EQUAL ==> h_thryvar = {p in h0 | cdr(p) in domain(f)}
        Suppose ==> Stat6: not(h_thryvar ¥incin h0)
            c-->Stat6 ==> (c notin h0) & Stat7: (c in {p in h0 | cdr(p) in domain(f)})
        ()-->Stat7(Stat6) ==> false; Discharge ==> h_thryvar ¥incin h0
        (h_thryvar,h0)-->T65 ==> (domain(h_thryvar) ¥incin domain(h0)) & (domain(h_thryvar) ¥incin Za)
        (h_thryvar,h0)-->T53 ==> Stat8: Svm(h_thryvar)
        Use_def(Svm) ==> Is_map(h_thryvar)
        Suppose ==> Stat9: not(range(h_thryvar) ¥incin domain(f))
            d-->Stat9 ==> (d notin domain(f)) & (d in range(h_thryvar))
            EQUAL ==> d in range({p in h0 | cdr(p) in domain(f)})
            Use_def(range) ==> d in {cdr(p): p in {p in h0 | cdr(p) in domain(f)}}
            SIMPLF ==> Stat10: d in {cdr(p): p in h0 | cdr(p) in domain(f)}
        q1-->Stat10(Stat9) ==> false; Discharge ==> range(h_thryvar) ¥incin domain(f)
        Suppose ==> (f @ h0) /= (f @ h_thryvar)
            Use_def(@) ==> {[car(x),cdr(y)]: x in h0, y in f | cdr(x) = car(y)} /= {[car(x),cdr(y)]: x in h_thryvar, y in f | cdr(x) = car(y)}
            Set_monot ==> {[car(x),cdr(y)]: x in h_thryvar, y in f | cdr(x) = car(y)} ¥incin {[car(x),cdr(y)]: x in h0, y in f | cdr(x) = car(y)}
            ELEM ==> Stat11: not({[car(x),cdr(y)]: x in h0, y in f | cdr(x) = car(y)} ¥incin {[car(x),cdr(y)]: x in h_thryvar, y in f | cdr(x) = car(y)})
            e-->Stat11 ==> Stat12: (e in {[car(x),cdr(y)]: x in h0, y in f | cdr(x) = car(y)}) & (e notin {[car(x),cdr(y)]: x in h_thryvar, y in f | cdr(x) = car(y)})
            (x0,y0,x0,y0)-->Stat12 ==> (e = [car(x0),cdr(y0)]) & (x0 in h0) & (y0 in f) & (cdr(x0) = car(y0)) & Stat13: (x0 notin {p in h0 | cdr(p) in domain(f)})
            ()-->Stat13(Stat12*) ==> cdr(x0) notin domain(f)
            Use_def(domain) ==> Stat14: cdr(x0) notin {car(y): y in f}
        y0-->Stat14(Stat12*) ==> false; Discharge ==> ((f @ h_thryvar) = (f @ h0)) & (g = (f @ h_thryvar))
        T206 ==> Ord(Za)
        Za-->T32 ==> Ord(next(Za))
        (next(Za), domain(f))-->T12 ==> Ord(domain(f))
        Suppose ==> Stat15: not(FORALL i | (next(i) in domain(h_thryvar)) ¥imp ((i in domain(h_thryvar)) & ((h_thryvar~[i]) in (h_thryvar~[next(i)]))))
            iq-->Stat15(Stat15) ==> (next(iq) in domain(h_thryvar)) & ((iq notin domain(h_thryvar)) or ((h_thryvar~[iq]) notin (h_thryvar~[next(iq)])))
            iq-->Stat5(Stat2) ==> (next(iq) in domain(h0)) & (iq in domain(h0)) & ((h0~[iq]) in (h0~[next(iq)]))
            (h_thryvar,next(iq))-->T77(Stat2*) ==> [next(iq),h_thryvar~[next(iq)]] in h0
            (h0,[next(iq),h_thryvar~[next(iq)]])-->T74(Stat2) ==> (h0~[car([next(iq),h_thryvar~[next(iq)]])]) = cdr([next(iq),h_thryvar~[next(iq)]])
            TELEM ==> (car([next(iq),h_thryvar~[next(iq)]]) = next(iq)) & (cdr([next(iq),h_thryvar~[next(iq)]]) = (h_thryvar~[next(iq)]))
            EQUAL(Stat15) ==> (h0~[next(iq)]) = (h_thryvar~[next(iq)])
            (h_thryvar,next(iq))-->T77(Stat8) ==> [next(iq),h_thryvar~[next(iq)]] in h_thryvar
            ([next(iq),h_thryvar~[next(iq)]], h_thryvar)-->T61(Stat8) ==> (h_thryvar~[next(iq)]) in domain(f)
            (domain(f), h_thryvar~[next(iq)])-->T13(Stat8*) ==> (h0~[iq]) in domain(f)
            Use_def(Svm) ==> Is_map(h0)
            (h0,iq)-->T77(Stat2*) ==> [iq,h0~[iq]] in h0
            Suppose ==> [iq,h0~[iq]] notin h_thryvar
                EQUAL ==> Stat16: [iq,h0~[iq]] notin {p in h0 | cdr(p) in domain(f)}
            ()-->Stat16(Stat15*) ==> false; Discharge ==> [iq,h0~[iq]] in h_thryvar
            (h_thryvar, [iq,h0~[iq]])-->T74(Stat2*) ==> (h_thryvar~[car([iq,h0~[iq]])]) = cdr([iq,h0~[iq]])
            TELEM ==> (car([iq,h0~[iq]]) = iq) & (cdr([iq,h0~[iq]]) = (h0~[iq]))
            EQUAL(Stat15*) ==> (h_thryvar~[iq]) = (h0~[iq])
            (Stat15*)ELEM ==> iq notin domain(h_thryvar)
        ([iq,h0~[iq]],h_thryvar)-->T60(Stat15*) ==> false; Discharge ==> Stat17: (FORALL i | (next(i) in domain(h_thryvar)) ¥imp ((i in domain(h_thryvar)) & ((h_thryvar~[i]) in (h_thryvar~[next(i)]))))
--
        (h_thryvar, Za, domain(f))-->T141 ==> (range(h_thryvar) ¥incin domain(f))
        (f,h_thryvar)-->T95 ==> (domain(f @ h_thryvar) = domain(h_thryvar)) & (range(f @ h_thryvar) = range(f ¥ON range(h_thryvar)))
        (f, h_thryvar)-->T128 ==> Svm(f @ h_thryvar)
--
-- Observe that $f$ and $h_thryvar$ have ordinal numbers not exceeding $Za$ as their domains.
-- This is obvious (as has been proved above, en passant) for $f$, which either equals $Za$ or belongs to it.
-- Concerning $h_thryvar$ (and hence $g$, which has the same domain as $h_thryvar$),
-- what claimed follows from the earlier Theorem 330, because its domain is closed relative
-- to predecessor formation.
--
        Suppose ==> not(Ord(domain(h_thryvar)) & (domain(h_thryvar) in next(Za)))
            Suppose ==> Stat18: not(FORALL i | (next(i) in domain(h_thryvar)) ¥imp (i in domain(h_thryvar)))
                ip-->Stat18 ==> (next(ip) in domain(h_thryvar)) & (ip notin domain(h_thryvar))
            ip-->Stat17 ==> false; Discharge ==> (FORALL i | (next(i) in domain(h_thryvar)) ¥imp (i in domain(h_thryvar)))
            (domain(h_thryvar))-->T330 ==> domain(h_thryvar) in next(Za)
        (next(Za), domain(h_thryvar))-->T12 ==> false; Discharge ==> Ord(domain(h_thryvar)) & (domain(h_thryvar) in next(Za))
--
-- We will now see that $h_thryvar$ is a strictly increasing function, from which
-- its one-one-ness will follow.
--
        Suppose ==> Stat19: not(FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) ¥imp ((h_thryvar~[i]) in (h_thryvar~[j])))
--
-- Indeed, assuming the contrary, we could choose unsigned integers $i1,j2$ such that $i1$ precedes $j2$
-- and $(h_thryvar~[i1]) notin (h_thryvar~[j2])$. Moreover, we can find the smallest $j1$ such that $i1$
-- precedes $j1$ and $(h_thryvar~[i1]) notin (h_thryvar~[j1])$. Notice that $j1$ cannot be the immediate
-- successor of $i1$.
--
            (i1,j2)-->Stat19 ==> (i1 in domain(h_thryvar)) & (j2 in domain(h_thryvar)) & (i1 in j2) & ((h_thryvar~[i1]) notin (h_thryvar~[j2]))
            Loc_def ==> j1 = arb({j in domain(h_thryvar) | (i1 in j) & ((h_thryvar~[i1]) notin (h_thryvar~[j]))})
            Suppose ==> Stat20: {j in domain(h_thryvar) | (i1 in j) & ((h_thryvar~[i1]) notin (h_thryvar~[j]))} = 0
            j2-->Stat20 ==> false; Discharge ==> Stat21: (j1 in {j in domain(h_thryvar) | (i1 in j) & ((h_thryvar~[i1]) notin (h_thryvar~[j]))}) & ((j1 * {j in domain(h_thryvar) | (i1 in j) & ((h_thryvar~[i1]) notin (h_thryvar~[j]))}) = 0)
            ()-->Stat21 ==> (j1 in domain(h_thryvar)) & (i1 in j1) & ((h_thryvar~[i1]) notin (h_thryvar~[j1]))
            Suppose ==> j1 = next(i1)
                EQUAL(Stat19) ==> ((h_thryvar~[i1]) notin (h_thryvar~[next(i1)])) & (next(i1) in domain(h_thryvar))
            i1-->Stat17(Stat19*) ==> false; Discharge ==> j1 /= next(i1)
--
-- From the fact $h_thryvar~[i1] in h_thryvar~[j1 ¥MINUS 1]$ (due to the minimality
-- in the choice of $j1$) and the fact $h_thryvar~[j1 ¥MINUS 1] in h_thryvar~[j1]$
-- (due to an assumed property of $h_thryvar$, whose domain is closed relative to
-- predecessor extraction), it follows that $(h_thryvar~[i1]) in (h_thryvar~[j1])$, contrary
-- to a fact just established. Thanks to this contradiction, we can discharge
-- our temporary assumption concluding that $h_thryvar$ fails to be one-one.
--
            T211(Stat19*) ==> (1 in Za) & Ord(0)
            (j1,1)-->T283(Stat2*) ==> (j1 ¥MINUS 1) in Za
            (Za, j1)-->T12(Stat2*) ==> Ord(j1)
            Suppose ==> j1 /= next(j1 ¥MINUS 1)
                (j1,0)-->T31(Stat21*) ==> 0 in j1
                Use_def(1) ==> 1 = next(0)
                Use_def(next) ==> 1 ¥incin j1
                (1,j1)-->T272(Stat21*) ==> #j1 = ((j1 ¥MINUS 1) ¥PLUS 1)
                j1-->T207(Stat2*) ==> j1 = ((j1 ¥MINUS 1) ¥PLUS 1)
            (j1 ¥MINUS 1)-->T317(Stat21*) ==> false; Discharge ==> j1 = next(j1 ¥MINUS 1)
            Use_def(next) ==> (j1 ¥MINUS 1) in j1
            EQUAL(Stat21*) ==> next(j1 ¥MINUS 1) in domain(h_thryvar)
            (j1 ¥MINUS 1)-->Stat17(Stat21*) ==> ((j1 ¥MINUS 1) in domain(h_thryvar)) & ((h_thryvar~[j1 ¥MINUS 1]) in (h_thryvar~[next(j1 ¥MINUS 1)]))
            EQUAL(Stat21) ==> (h_thryvar~[j1 ¥MINUS 1]) in (h_thryvar~[j1])
            Suppose ==> Stat22: (h_thryvar~[i1]) notin (h_thryvar~[j1 ¥MINUS 1])
                EQUAL(Stat21*) ==> i1 in next(j1 ¥MINUS 1)
                Use_def(next) ==> i1 in ((j1 ¥MINUS 1) + {j1 ¥MINUS 1})
                Suppose ==> i1 = (j1 ¥MINUS 1)
                EQUAL(Stat21) ==> false; Discharge ==> i1 in (j1 ¥MINUS 1)
                Suppose ==> Stat23: (j1 ¥MINUS 1) notin {j in domain(h_thryvar) | (i1 in j) & ((h_thryvar~[i1]) notin (h_thryvar~[j]))}
                ()-->Stat23(Stat21*) ==> false; Discharge ==> (j1 ¥MINUS 1) in {j in domain(h_thryvar) | (i1 in j) & ((h_thryvar~[i1]) notin (h_thryvar~[j]))}
            (Stat21*)Discharge ==> (h_thryvar~[i1]) in (h_thryvar~[j1 ¥MINUS 1])
            (j1,h_thryvar)-->T71(Stat1*) ==> (h_thryvar~[j1]) in Za
            (Za, h_thryvar~[j1])-->T12(Stat8*) ==> Ord(h_thryvar~[j1])
        (h_thryvar~[j1], h_thryvar~[j1 ¥MINUS 1])-->T13(Stat21*) ==> false; Discharge ==> (not one_1_map(h_thryvar)) & Stat24: (FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) ¥imp ((h_thryvar~[i]) in (h_thryvar~[j])))
--
-- To now see that $h_thryvar$ is a one-one function, contradicting the conclusion just reached and thus
-- leading to the desired overall conclusion, we can exploit the strict monotonicity of $h_thryvar$.
--
--
-- In the first place, if we assume that $h_thryvar$ is not one-one, then we must admit the
-- existence of distinct pairs $p,q$ in $h_thryvar$ sharing the same second component.
--
        Use_def(one_1_map) ==> Stat25: not(FORALL x in h_thryvar, y in h_thryvar | (cdr(x) = cdr(y)) ¥imp (x = y))
        (p,q)-->Stat25 ==> (p in h_thryvar) & (q in h_thryvar) & (cdr(p) = cdr(q)) & (p /= q)
        (h_thryvar,p)-->T51 ==> p = [car(p),cdr(p)]
        (h_thryvar,q)-->T51 ==> q = [car(q),cdr(q)]
        (p,h_thryvar)-->T60 ==> car(p) in Za
        (q,h_thryvar)-->T60 ==> car(q) in Za
        (Za,car(p))-->T12 ==> Ord(car(p))
        (Za,car(q))-->T12 ==> Ord(car(q))
        (car(p),car(q))-->T31(Stat25) ==> Stat26: (car(p) in car(q)) or (car(q) in car(p))
        (Stat25*)ELEM ==> (p in h_thryvar) & (q in h_thryvar) & (cdr(p) = cdr(q))
--
-- Let $p0,p1$ be such pairs $p,q$ ordered so that
-- the first component of $p0$ precedes the first component of $p1$.
-- Then $cdr(p0)$ must precede $cdr(p1)$, which leads to a contradiction.
--
        Loc_def ==> p0 = if (car(p) in car(q)) then p else q end if
        Loc_def ==> p1 = if (car(p) in car(q)) then q else p end if
        (p0, h_thryvar)-->T60(Stat26*) ==> car(p0) in domain(h_thryvar)
        (p1, h_thryvar)-->T60(Stat26*) ==> car(p1) in domain(h_thryvar)
        Suppose ==> not((car(p0) in car(p1)) & (cdr(p0) notin cdr(p1)))
            Suppose ==> car(p) in car(q)
                (Stat26*)ELEM ==> (p0 = p) & (p1 = q) & (cdr(p) notin cdr(q))
            EQUAL(Stat26*) ==> false; Discharge ==> car(q) in car(p)
            (Stat26*)ELEM ==> (p0 = q) & (p1 = p) & (cdr(q) notin cdr(p))
        EQUAL(Stat26*) ==> false; Discharge ==> Stat27: (car(p0) in car(p1)) & (cdr(p0) notin cdr(p1))
        (h_thryvar, p0)-->T74(Stat8*) ==> (h_thryvar~[car(p0)]) = cdr(p0)
        (h_thryvar, p1)-->T74(Stat8*) ==> (h_thryvar~[car(p1)]) = cdr(p1)
        EQUAL(Stat27) ==> (h_thryvar~[car(p0)]) notin (h_thryvar~[car(p1)])
    (car(p0),car(p1))-->Stat24 ==> false; Discharge ==> QED
--
Theorem subseq.2: {i in domain(h_thryvar) | i ¥nincin (h_thryvar~[i])} = 0. Proof:
    Suppose_not ==> Stat1: {i in domain(h_thryvar) | (i ¥nincin (h_thryvar~[i]))} /= 0
        Loc_def ==> i0 = arb({i in domain(h_thryvar) | (i ¥nincin (h_thryvar~[i]))})
        ELEM ==> Stat2: ((i0 * {i in domain(h_thryvar) | (i ¥nincin (h_thryvar~[i]))}) = 0) & Stat3: (i0 in {i in domain(h_thryvar) | (i ¥nincin (h_thryvar~[i]))})
        ()-->Stat3 ==> (i0 in domain(h_thryvar)) & (i0 ¥nincin (h_thryvar~[i0]))
        Assump ==> domain(f) in next(Za)
        (domain(f))-->T330 ==> domain(f) ¥incin Za
        Tsubseq.1 ==> (domain(h_thryvar) in next(Za)) & (range(h_thryvar) ¥incin Za) &
		Stat4: (FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) ¥imp ((h_thryvar~[i]) in (h_thryvar~[j])))
        (domain(h_thryvar))-->T330 ==> domain(h_thryvar) ¥incin Za
        T206 ==> Ord(Za)
        ELEM ==> (i0 in Za) & (i0 /= 0)
        T211(Stat2*) ==> (1 in Za) & Ord(0)
        (i0, 1)-->T283(Stat2*) ==> (i0 ¥MINUS 1) in Za
        (Za, i0)-->T12(Stat2*) ==> Ord(i0)
        Suppose ==> i0 /= next(i0 ¥MINUS 1)
            (i0,0)-->T31(Stat2*) ==> 0 in i0
            Use_def(1) ==> 1 = next(0)
            Use_def(next) ==> 1 ¥incin i0
            (1,i0)-->T272(Stat2*) ==> #i0 = ((i0 ¥MINUS 1) ¥PLUS 1)
            i0-->T207(Stat2*) ==> i0 = ((i0 ¥MINUS 1) ¥PLUS 1)
        (i0 ¥MINUS 1)-->T317(Stat2*) ==> false; Discharge ==> i0 = next(i0 ¥MINUS 1)
        Use_def(next) ==> i0 = ((i0 ¥MINUS 1) + {i0 ¥MINUS 1})
        Za-->T32 ==> Ord(next(Za))
        (next(Za), domain(h_thryvar))-->T12 ==> Ord(domain(h_thryvar))
        (domain(h_thryvar), i0)-->T13 ==> (i0 ¥MINUS 1) in domain(h_thryvar)
        (i0 ¥MINUS 1, i0)-->Stat4 ==> (h_thryvar~[i0 ¥MINUS 1]) in (h_thryvar~[i0])
        Suppose ==> ((i0 ¥MINUS 1) ¥nincin (h_thryvar~[i0 ¥MINUS 1]))
            Suppose ==> Stat5: not((i0 ¥MINUS 1) in {i in domain(h_thryvar) | (i ¥nincin (h_thryvar~[i]))})
            ()-->Stat5 ==> false; Discharge ==> (i0 ¥MINUS 1) in {i in domain(h_thryvar) | (i ¥nincin (h_thryvar~[i]))}
        Discharge ==> (i0 ¥MINUS 1) ¥incin (h_thryvar~[i0 ¥MINUS 1])
        (i0, h_thryvar)-->T71 ==> (h_thryvar~[i0]) in Za
        (Za, h_thryvar~[i0])-->T12 ==> Ord(h_thryvar~[i0])
        (h_thryvar~[i0], h_thryvar~[i0 ¥MINUS 1])-->T13 ==> ((i0 ¥MINUS 1) ¥incin (h_thryvar~[i0])) & ((i0 ¥MINUS 1) /= (h_thryvar~[i0]))
        (h_thryvar~[i0], i0 ¥MINUS 1)-->T13 ==> (i0 ¥MINUS 1) ¥incin (h_thryvar~[i0])
        (i0, i0 ¥MINUS 1)-->T12 ==> Ord(i0 ¥MINUS 1)
        (h_thryvar~[i0], i0 ¥MINUS 1)-->T34 ==> (i0 ¥MINUS 1) in (h_thryvar~[i0])
     Use_def(next) ==> false; Discharge ==> QED
--
-- Our next theorem states that any subsequence $g$ of a (finite or infinite) sequence $f$
-- of elements of a set $s$ is also a sequence of elements of $s$, having a
-- (finite or infinite) length not exceeding the length of $f$.
--
Theorem subseq.3: Svm(g) & (g ¥incin (domain(f) ¥PROD range(f))) & (domain(g) in (next(Za) * next(domain(f)))). Proof:
    Suppose_not ==> (not Svm(g)) or (not(g ¥incin (domain(f) ¥PROD range(f)))) or (domain(g) notin (next(Za) * next(domain(f))))
	Assump ==> Svm(f) & (domain(f) in next(Za))
        Tsubseq.1 ==> (g = (f @ h_thryvar)) & one_1_map(h_thryvar) & (domain(h_thryvar) in next(Za)) & (range(h_thryvar) ¥incin domain(f))
        T206 ==> Ord(Za)
        Za-->T32 ==> Ord(next(Za))
        (next(Za), domain(f))-->T12 ==> Ord(domain(f))
        Use_def(one_1_map) ==> Stat1: Svm(h_thryvar)
        (f,h_thryvar)-->T95 ==> (domain(f @ h_thryvar) = domain(h_thryvar)) & (range(f @ h_thryvar) = range(f ¥ON range(h_thryvar)))
        (f, h_thryvar)-->T128 ==> Svm(f @ h_thryvar)
        (f, range(h_thryvar))-->T80 ==> range(f @ h_thryvar) ¥incin range(f)
        EQUAL ==> Svm(g) & (domain(g) = domain(h_thryvar)) & (range(g) ¥incin range(f))
--
-- This is, in detail, how we derive from the one-oneness of $h_thryvar$ the fact that
-- $domain(g)$ cannot be a larger ordinal than $domain(f)$. Then only the second alternative
-- of the or-statement in the Suppose_not statement,
-- namely $not(g ¥incin (domain(f) ¥PROD range(f)))$, survives.
--
        h_thryvar-->T157 ==> #range(h_thryvar) = #domain(h_thryvar)
        (domain(f), range(h_thryvar))-->T169 ==> #domain(h_thryvar) ¥incin domain(f)
        (domain(h_thryvar))-->T147 ==> Ord(#domain(h_thryvar))
        (domain(f), #domain(h_thryvar))-->T34 ==> (#domain(h_thryvar) in domain(f)) or (#domain(h_thryvar) = domain(f))
        Use_def(next) ==> #domain(h_thryvar) in next(domain(f))
        (domain(h_thryvar), domain(f))-->T331 ==> ((domain(h_thryvar) = domain(f)) & (domain(f) = Za)) or (domain(h_thryvar) in (next(domain(f)) * Za))
--
        Suppose ==> domain(g) notin next(domain(f))
            (Stat1)ELEM ==> domain(h_thryvar) = domain(f)
            Use_def(next) ==> domain(f) in next(domain(f))
        (Stat1)Discharge ==> (not(g ¥incin (domain(f) ¥PROD range(f))))
--
-- However, $not(g ¥incin (domain(f) ¥PROD range(f)))$ amounts to one of the three possibilities
-- $not(Is_map(g))$, $not(domain(g) ¥incin domain(f))$, or $not(range(g) ¥incin range(f))$, the third
-- of which has already been eliminated. The first possibility must be discarded too, because
-- $g$ is known to be a single-valued map.
--
-- The possibility $not(domain(g) ¥incin domain(f))$ would yield that
-- $domain(f)$ precedes $domain(g)$ in the standard order of ordinals, but
-- this conflicts with the fact, just derived above, that $domain(g) in next(domain(f))$.
--
        Use_def(Svm) ==> Is_map(g)
        (g, domain(f), range(f))-->T141 ==> not(domain(g) ¥incin domain(f))
        (domain(f))-->T32 ==> Ord(next(domain(f)))
        (next(domain(f)), domain(g))-->T13 ==> domain(g) ¥incin next(domain(f))
        Use_def(next) ==> domain(f) in domain(g)
    Use_def(next) ==> false; Discharge ==> QED
--
Theorem subseq.4: (domain(h_thryvar) /= Za) ¥imp Finite(g). Proof:
    Suppose_not ==> (domain(h_thryvar) /= Za) & (not Finite(g))
        Tsubseq.1 ==> (g = (f @ h_thryvar)) & one_1_map(h_thryvar) & (domain(h_thryvar) in next(Za)) & (range(h_thryvar) ¥incin domain(f))
        (domain(g))-->T206 ==> Ord(Za) & (not Finite(Za)) & ((domain(g) in Za) ¥imp Finite(domain(g)))
        Assump ==> Svm(f) & (domain(f) in next(Za))
        (domain(f))-->T330 ==> domain(f) ¥incin Za
        Use_def(next) ==> domain(h_thryvar) in Za
        (Za,domain(h_thryvar))-->T13 ==> (domain(h_thryvar) ¥incin Za) & (range(h_thryvar) ¥incin Za)
        (f,h_thryvar)-->T95 ==> domain(f @ h_thryvar) = domain(h_thryvar)
        Use_def(next) ==> Stat1: domain(h_thryvar) in Za
        (f,h_thryvar)-->T55 ==> Is_map(f @ h_thryvar)
        Use_def(one_1_map) ==> Svm(h_thryvar)
        (f, h_thryvar)-->T128 ==> Svm(f @ h_thryvar)
        EQUAL ==> (domain(g) in Za) & (Is_map(g)) & Svm(g)
        g-->T192 ==> Finite(range(g))
        (domain(g),range(g))-->T262 ==> Finite(domain(g) ¥PROD range(g))
        (g,domain(g),range(g))-->T141(Stat1) ==> g ¥incin (domain(g) ¥PROD range(g))
    (domain(g) ¥PROD range(g), g)-->T189 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY subseq
--
--THEORY subseq(g,f)		 [Subsequence of a finite or denumerable sequence]
--	Svm(f) & (domain(f) in next(Za))
--	g in Subseqs(f)
--==>(h_thryvar)
--	(g = (f @ h_thryvar)) & one_1_map(h_thryvar) & (domain(h_thryvar) in next(Za)) & (range(h_thryvar) ¥incin domain(f))
--	(FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) ¥imp ((h_thryvar~[i]) in (h_thryvar~[j])))
--	({i in domain(h_thryvar) | (i ¥nincin (h_thryvar~[i]))} = 0)
--	Svm(g) & (g ¥incin (domain(f) ¥PROD range(f))) & (domain(g) in (next(Za) * next(domain(f))))
--	((domain(h_thryvar) /= Za) ¥imp Finite(g))
--END subseq;
--
--
--
--
-- Our next theorem states that every subsequence of a finite sequence $f$
-- of elements of a set $s$ is an alike sequence, whose length does not exceed the length of $f$.
--
Theorem 351: ((F in Fin_seqs(S)) & (G in Subseqs(F))) ¥imp ((G in Fin_seqs(S)) & (domain(G) in next(domain(F)))). Proof:
    Suppose_not(f,s,g) ==> (f in Fin_seqs(s)) & (g in Subseqs(f)) & ((g notin Fin_seqs(s)) or (domain(g) notin next(domain(f))))
--
-- For, assuming by contradiction that $f,s,g$ are a counterexample, from the THEORY subseq
-- we get that $g$ is a function included in $domain(f) ¥PROD s$,
-- having as its domain an ordinal not exceeding either $Za$ or $domain(f)$. It turns out
-- readily that $g$ is included in $Za ¥PROD s$; hence, in order that $g$ does not belong
-- to $Fin_seqs(s)$, its domain must equal $Za$.
--
        Use_def(Fin_seqs) ==> Stat1: f in {f ¥incin (Za ¥PROD s) | Svm(f) & (domain(f) in Za)}
        ()-->Stat1 ==> (f ¥incin (Za ¥PROD s)) & Svm(f) & (domain(f) in Za)
        Use_def(next) ==> domain(f) in next(Za)
        APPLY(h_thryvar:h) subseq(g->g,f->f) ==>
		(g ¥incin (domain(f) ¥PROD range(f))) & Svm(g) & (domain(g) in (next(Za) * next(domain(f))))
        (f,Za,s)-->T141 ==> (domain(f) ¥incin Za) & (range(f) ¥incin s)
        (domain(f), Za, range(f), s)-->T256 ==> g ¥incin (Za ¥PROD s)
        (domain(f))-->T206 ==> Ord(Za) & Card(domain(f)) & Finite(domain(f))
        Za-->T32 ==> Ord(next(Za))
        Suppose ==> Za = domain(g)
--
-- However, if we assume that $domain(g) = Za$, then...
--
            Use_def(Card) ==> Ord(domain(f))
            (domain(f))-->T32 ==> Ord(next(domain(f)))
            (domain(f))-->T200 ==> Finite(next(domain(f)))
            (next(domain(f)))-->T205 ==> Card(next(domain(f)))
--
-- ...we get that $next(domain(f)) in domain(g)$, conflicting with $domain(g) in next(domain(f))$.
--
        (next(domain(f)))-->T206 ==> false; Discharge ==> Za /= domain(g)
        Use_def(next) ==> domain(g) in Za
        Use_def(Fin_seqs) ==> Stat2: g notin {f ¥incin (Za ¥PROD S) | Svm(f) & (domain(f) in Za)}
--
-- We have reached a contradiction showing that the statement of this lemma is true.
--
    ()-->Stat2 ==> false; Discharge ==> QED
--
--
-- Our next theorem states that every shifted sequence is a subsequence of the original sequence.
--
Theorem 352: (M in Za) ¥imp (shifted_seq(F,M) in Subseqs(F)). Proof:
    Suppose_not(m,f) ==> Stat1: (m in Za) & (shifted_seq(f,m) notin Subseqs(f))
    Use_def(shifted_seq) ==> (f @ Shift(m)) notin Subseqs(f)
--
-- For, assuming that the contrary is true for $m,f$ and exploiting the definition of 'Subseqs',
-- we get that $Shift(m)$ is not a function, or it is not includedin $(Za ¥PROD Za)$, or
-- its domain is not closed relative to predecessor extraction, or it is not increasing.
--
        Use_def(Subseqs) ==> Stat2: (f @ Shift(m)) notin {f @ h: h ¥incin (Za ¥PROD Za) | Svm(h) & (FORALL i | (next(i) in domain(h)) ¥imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) }
        (Shift(m))-->Stat2 ==> (not(Shift(m) ¥incin (Za ¥PROD Za))) or (not Svm(Shift(m))) or (not (FORALL i | (next(i) in domain(Shift(m))) ¥imp ((i in domain(Shift(m))) & (((Shift(m))~[i]) in ((Shift(m))~[next(i)])))))
        Use_def(Shift) ==> Shift(m) = {[i, m ¥PLUS i]: i in Za}
--
-- The first two possibilities are discarded quite straightforwardly.
--
        Suppose ==> Stat3: not({[i, m ¥PLUS i]: i in Za} ¥incin (Za ¥PROD Za))
            c-->Stat3 ==> Stat4: (c in {[i, m ¥PLUS i]: i in Za}) & (c notin (Za ¥PROD Za))
            ir-->Stat4 ==> (ir in Za) & ([ir, m ¥PLUS ir] notin (Za ¥PROD Za))
            ALGEBRA ==> (m ¥PLUS ir) in Za
            Use_def(¥PROD) ==> Stat5: [ir, m ¥PLUS ir] notin {[i,j]: i in Za, j in Za}
        (ir, m ¥PLUS ir)-->Stat5 ==> false; Discharge ==> Shift(m) ¥incin (Za ¥PROD Za)
        (m,m)-->T339 ==> Stat6: Svm(Shift(m)) & Stat7: (not (FORALL i | (next(i) in domain(Shift(m))) ¥imp ((i in domain(Shift(m))) & (((Shift(m))~[i]) in ((Shift(m))~[next(i)])))))
--
-- The third possibility is also discarded easily, so only the fourth one must be considered.
--
        i-->Stat7 ==> (next(i) in domain(Shift(m))) & ((i notin domain(Shift(m))) or (((Shift(m))~[i]) notin ((Shift(m))~[next(i)])))
        ELEM ==> domain({[i, m ¥PLUS i]: i in Za}) = Za
        EQUAL ==> domain(Shift(m)) = domain({[i, m ¥PLUS i]: i in Za})
        ELEM ==> next(i) in Za
        T206 ==> Ord(Za)
        (Za,next(i))-->T13 ==> next(i) ¥incin Za
        Use_def(next) ==> Stat8: (i in Za) & (((Shift(m))~[i]) notin ((Shift(m))~[next(i)]))
--
-- By eliminating the fourth possibility, we get a contradiction proving the statement of the present theorem.
--
        Suppose ==> Stat9: [i, m ¥PLUS i] notin {[i, m ¥PLUS i]: i in Za}
        i-->Stat9 ==> false; Discharge ==> Stat10: [i, m ¥PLUS i] in Shift(m)
        (Shift(m), [i, m ¥PLUS i])-->T74(Stat6,Stat10*) ==> ((Shift(m))~[car([i, m ¥PLUS i])]) = cdr([i, m ¥PLUS i])
        Suppose ==> Stat11: [next(i), m ¥PLUS next(i)] notin {[j, m ¥PLUS j]: j in Za}
        (next(i))-->Stat11 ==> false; Discharge ==> Stat12: [next(i), m ¥PLUS next(i)] in Shift(m)
        (Shift(m), [next(i), m ¥PLUS next(i)])-->T74(Stat6,Stat12*) ==> ((Shift(m))~[car([next(i), m ¥PLUS next(i)])]) = cdr([next(i), m ¥PLUS next(i)])
        TELEM ==> (car([i, m ¥PLUS i]) = i) & (cdr([i, m ¥PLUS i]) = (m ¥PLUS i)) & (car([next(i), m ¥PLUS next(i)]) = next(i)) & (cdr([next(i), m ¥PLUS next(i)]) = (m ¥PLUS next(i)))
        i-->T317(Stat8,Stat8) ==> (i ¥PLUS 1) = next(i)
        ALGEBRA ==> Stat13: ((m ¥PLUS i) in Za) & ((m ¥PLUS (i ¥PLUS 1)) = ((m ¥PLUS i) ¥PLUS 1))
        (m ¥PLUS i)-->T317(Stat13) ==> ((m ¥PLUS i) ¥PLUS 1) = next(m ¥PLUS i)
        EQUAL(Stat8*) ==> (m ¥PLUS i) notin next(m ¥PLUS i)
    Use_def(next) ==> false; Discharge ==> QED
--
--
-- In the special case of a finite sequence $f$, the preceding theorem specializes into one stating
-- that every sequence obtained by shifting $f$ is a (finite) subsequence of $f$.
--
Theorem 353: ((F in Fin_seqs(S)) & (M in Za)) ¥imp ((shifted_seq(F,M) in Fin_seqs(S)) & (domain(shifted_seq(F,M)) in next(domain(F)))). Proof:
    Suppose_not(f,s,m) ==> (f in Fin_seqs(s)) & (m in Za) & ((shifted_seq(f,m) notin Fin_seqs(s)) or (domain(shifted_seq(f,m)) notin next(domain(f))))
        (m,f)-->T352 ==> shifted_seq(f,m) in Subseqs(f)
        Use_def(shifted_seq) ==> ((f @ Shift(m)) in Subseqs(f)) & (((f @ Shift(m)) notin Fin_seqs(s)) or (domain(f @ Shift(m)) notin next(domain(f))))
        (f, s, f @ Shift(m))-->T351 ==> domain(f @ Shift(m)) notin next(domain(f))
        Use_def(Fin_seqs) ==> Stat1: f in {f ¥incin (Za ¥PROD s) | Svm(f) & (domain(f) in Za)}
        ()-->Stat1 ==> (f ¥incin (Za ¥PROD s)) & Svm(f) & (domain(f) in Za)
        Use_def(next) ==> domain(f) in next(Za)
        APPLY(h_thryvar:h) subseq(g->(f @ Shift(m)),f->f) ==>
		domain(f @ Shift(m)) in (next(Za) * next(domain(f)))
    Discharge ==> QED
--
Theorem 354: ((domain(F) = Za) & (M in Za)) ¥imp (domain(shifted_seq(F,M)) = Za). Proof:
    Suppose_not(f,m) ==> (domain(f) = Za) & (m in Za) & (domain(shifted_seq(f,m)) /= Za)
        (m,f)-->T352 ==> shifted_seq(f,m) in Subseqs(f)
        Use_def(shifted_seq) ==> ((f @ Shift(m)) in Subseqs(f)) & (domain(f @ Shift(m)) /= Za)
        Use_def(Shift) ==> (domain(Shift(m)) = Za) & (range(Shift(m)) = { m ¥PLUS i : i in Za })
        Suppose ==> not(range(Shift(m)) ¥incin Za)
            Use_def(Shift) ==> Stat1: not({ m ¥PLUS i : i in Za } ¥incin Za)
            e-->Stat1 ==>  (e notin Za) & Stat2: (e in { m ¥PLUS i : i in Za })
            i0-->Stat2 ==> (i0 in Za) & ((m ¥PLUS i0) notin Za)
        (m,i0)-->T283 ==> false; Discharge ==> range(Shift(m)) ¥incin domain(f)
    (f,Shift(m))-->T95 ==> false; Discharge ==> QED
--
--
-- ************************************************************************************************
--			Section 8: The cardinal product theorem (a digression)
-- ************************************************************************************************
--
-- Next we start to prepare for proof of the cardinal product theorem (Theorem 195 below), which asserts
-- that the product of two infinite cardinals is always the larger of the two. This proof
-- uses properties of the product ordering of the Cartesian product of two ordinals which the following
-- theory begins to lay out.
--
THEORY ordval_fcn(s,f(x))		 [Elementary properties of ordinal-valued functions]
    (s /= 0) & (FORALL x in s | Ord(f(x)))
END ordval_fcn;
--
ENTER_THEORY ordval_fcn
--
Def 00a: [Points at which f attains its minimum] rng_thryvar := {x: x in s | f(x) = arb({f(u): u in s})}
--
-- The first result we prove within the present theory is that the ordinal-valued function $f$
-- assumed by the theory always attains its minimum value $arb({f(u): u in s})$.
--
Theorem ordval_fcn1: [An ordinal-valued function attains its minimum]
    (rng_thryvar /= 0) & (FORALL x in rng_thryvar, y in s | f(x) ¥incin f(y)) &
    	(rng_thryvar = {x: x in s | f(x) = arb({f(u): u in s})}). Proof:
    Suppose_not ==> rng_thryvar = 0 or
			(not (FORALL x in rng_thryvar, y in s | f(x) ¥incin f(y))) or
				rng_thryvar /= {x: x in s | f(x) = arb({f(u): u in s})}
--
-- Assume the contrary. Since ${f(u): u in s}$ is clearly nonempty, $arb({f(y): y in s}) in {f(u): u in s}$
-- by the axiom of choice. Hence $arb({f(y): y in s})$ can be written as $f(d)$ with $d in s$,
-- and then it is clear by definition that $d in rng_thryvar$ so that $rng_thryvar /= 0$,
-- and hence only the second clause of out theorem can be false, i.e there must exist
-- $x in rng_thryvar$, $y in s$ such that $f(y)$ is less than $f(x)$.
--
	Use_def(rng_thryvar) ==> rng_thryvar = {x: x in s | f(x) = arb({f(u): u in s})}
    Assump ==> Stat1: (s /= 0) & Stat2: (FORALL x in s | Ord(f(x)))
    cp-->Stat1 ==> cp in s
    Suppose ==> Stat3: f(cp) notin {f(u): u in s}
    cp-->Stat3 ==> false; Discharge ==> {f(u): u in s} /= 0
    {f(y): y in s}-->T0 ==> Stat4: (arb({f(y): y in s}) in {f(u): u in s}) &
    			(arb({f(y): y in s}) * {f(u): u in s} = 0)
    d-->Stat4 ==> (d in s) & (arb({f(y): y in s}) = f(d))
    Suppose ==> d notin rng_thryvar
    Use_def(rng_thryvar) ==> Stat5: d notin {x: x in s | f(x) = arb({f(u): u in s})}
    d-->Stat5 ==> false; Discharge ==> Stat6: not(FORALL x in rng_thryvar, y in s | f(x) ¥incin f(y))
    (x,y)-->Stat6 ==> Stat7: (x in rng_thryvar) & (y in s) & (not(f(x) ¥incin f(y)))
--
-- $rng_thryvar$ is clearly a subset of $s$, while $f(x) = arb({f(u): u in s})$ and $f(y)$ are both ordinals.
--
    Suppose ==> Stat8: not(s incs rng_thryvar)
    c-->Stat8 ==> (c notin s) & (c in rng_thryvar)
    Use_def(rng_thryvar) ==> Stat9: c in {x in s | f(x) = arb({f(u): u in s})}
    ()-->Stat9 ==> false; Discharge ==> s incs rng_thryvar
    x-->Stat2 ==> Ord(f(x))
    y-->Stat2 ==> Ord(f(y))
    (f(x),f(y))-->T35 ==> f(y) in f(x)
    Use_def(rng_thryvar) ==> Stat10: x in {v: v in s | f(v) = arb({f(u): u in s})}
    v-->Stat10 ==> (x = v) & (f(v) = arb({f(u): u in s}))
    EQUAL ==> f(x) = arb({f(u): u in s})
--
-- But $f(y)$ is clearly in ${f(u): u in s}$, and since this violates
-- the disjointness clause of the axiom of choice as appled above,
-- have a contradiction which completes our proof.
--
    Suppose ==> Stat11: f(y) notin {f(u): u in s}
    y-->Stat11 ==> false; Discharge ==> f(y) in {f(u): u in s}
    Discharge ==> QED
--
-- It is also obvious that the set $rng_thryvar$ on which $f(x)$ attains its minimum value is
-- a subset of $s$.
--
Theorem ordval_fcn2: rng_thryvar ¥incin s. Proof:
	Suppose_not ==> not(rng_thryvar ¥incin s)
    Use_def(rng_thryvar) ==> rng_thryvar = {x: x in s | f(x) = arb({f(y): y in s})}
    Set_monot ==> {x: x in s | f(x) = arb({f(y): y in s})} ¥incin {x: x in s}
    ELEM ==> rng_thryvar ¥incin {x: x in s}
    SIMPLF ==> {x: x in s} = s
    Discharge ==> QED
--
-- Finally it is clear that any $y in s$ at which the minimum of $f$ is attained
-- belongs to the set $rng_thryvar$.
--
Theorem ordval_fcn3: (FORALL x in rng_thryvar, y in s | (f(x) = f(y)) ¥imp (y in rng_thryvar)). Proof:
    Suppose_not ==> Stat1: not (FORALL x in rng_thryvar, y in s | (f(x) = f(y)) ¥imp (y in rng_thryvar))
	(x,y)-->Stat1 ==> (x in rng_thryvar) & (y in s) & (f(x) = f(y)) & (y notin rng_thryvar)
	Use_def(rng_thryvar) ==> Stat2: x in {x in s | f(x) = arb({f(u): u in s})}
	()-->Stat2 ==> f(x) = arb({f(u): u in s})
	ELEM ==> f(y) = arb({f(u): u in s})
	Suppose ==> Stat3: y notin {x: x in s | f(x) = arb({f(u): u in s})}
	y-->Stat3 ==> false; Discharge ==> y in {x: x in s | f(x) = arb({f(u): u in s})}
	Use_def(rng_thryvar) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY ordval_fcn
--
--THEORY ordval_fcn(s,f);		 [Elementary functions of ordinal-valued functions]
--    (s /= 0) & (FORALL x in s | Ord(f(x)))
--==>(rng_thryvar)
--    (rng_thryvar = {x: x in s | f(x) = arb({f(y): y in s})}) & (rng /= 0) &
--    			(FORALL x in rng_thryvar, y in s | f(x) ¥incin f(y))
--    (rng ¥incin s)
--END ordval_fcn;
--
-- ----------------------------------------------------------------------------------------------
-- ----------------------------------------------------------------------------------------------
-- Our next theory concerns binary relations $R$ which are well-founded on a given domain $s$.
-- This means that $R$ is irreflexive on $s$, and that each non-null subset $t$ of this
-- domain has a 'minimal' element,i.e. an element not greater than any other element
-- of $t$ in the ordering defined by $R$.
-- We will show that any such relation can be extended into one  which is isomorphic to the
-- membership relator on an ordinal in 1-1 ordered correspondence with the set $s$.
-- ----------------------------------------------------------------------------------------------
-- ----------------------------------------------------------------------------------------------
--
THEORY well_founded_set(s,arg1_bef_arg2(x,y))
    (FORALL t | ((t ¥incin s) & (t /= 0)) ¥imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
END well_founded_set;
--
ENTER_THEORY well_founded_set
--
-- ----------------------------------------------------------------------------------------------
-- Our first theorem shows that the relation is antisymmetric, and hence irreflexive.
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.0:
    ((X in s) & (Y in s)) ¥imp ((not(arg1_bef_arg2(X,Y) & arg1_bef_arg2(Y,X))) & (not arg1_bef_arg2(X,X))). Proof:
--
-- We proceed by contradiction. Suppose that our theorem is false, and let $x$, $y$ be a counterexample.
--
    Suppose_not(x,y) ==> (x in s) & (y in s) &  ((arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x)) or arg1_bef_arg2(x,x))
    ELEM ==> ({x,y} ¥incin s) & ({x,y} /= 0) & ({x} ¥incin s) & ({x} /= 0)
--
-- Suppose first that the pair $x,y$ violates antisymmetry, so that $x$ precedes $y$ and $y$ precedes $x$.
-- Any minimal element $u$ of the doubleton ${x,y}$ must be either $x$ or $y$; but if it is $x$ this
-- conflicts with the fact that $y$ precedes $x$; and symmetrically if the minimal element is $y$.
--
	 Suppose ==> arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x)
	 Assump ==> Stat1: (FORALL t | ((t ¥incin s) & (t /= 0)) ¥imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
	 ({x,y})-->Stat1 ==> Stat2: (EXISTS w in {x,y} | (FORALL v in {x,y} | (not arg1_bef_arg2(v,w))))
	 u-->Stat2 ==> (u in {x,y}) & Stat3: (FORALL v in {x,y} | (not arg1_bef_arg2(v,u)))
	 x-->Stat3 ==> (x in {x,y}) ¥imp (not arg1_bef_arg2(x,u))
	 y-->Stat3 ==> (y in {x,y}) ¥imp (not arg1_bef_arg2(y,u))
	 ELEM ==> ((u = y) & (not arg1_bef_arg2(x,u))) or ((u = x) & (not arg1_bef_arg2(y,u)))
	 Suppose ==> (u = y) & (not arg1_bef_arg2(x,u))
	 EQUAL ==> false; Discharge ==> (u = x) & (not arg1_bef_arg2(y,u))
	 EQUAL ==> false; Discharge ==> arg1_bef_arg2(x,x)
--
-- Similarly the minimal element of the singleton ${x}$ must be $x$, so $x$ cannot
-- precede $x$, completing our proof.
--
	({x})-->Stat1 ==> Stat4: (EXISTS w in {x} | (FORALL v in {x} | (not arg1_bef_arg2(v,w))))
	u2-->Stat4 ==> Stat5: (u2 in {x}) & (FORALL v in {x} | (not arg1_bef_arg2(v,u2)))
	u2-->Stat5 ==>  (u2 in {x}) &  ((u2 in {x}) ¥imp (not arg1_bef_arg2(u2,u2)))
	ELEM ==> (u2 = x) & (not arg1_bef_arg2(u2,u2))
    EQUAL ==> false; Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- By assumption, we can define a selector '$Minrel1_thryvar$' which
-- picks a minimal element from each non-null subset of the domain $s$.
-- ----------------------------------------------------------------------------------------------
--
Def 10000: [?] Minrel1_thryvar(T) := if (T ¥incin s) & (T /= 0) then
	arb({m: m in T | (FORALL y in T | (not arg1_bef_arg2(y,m)))}) else s end if
--
-- The following statement merely captures the definition of $Minrel1_thryvar$ as a theorem for use outside the present theory.
--
Theorem well_founded_set.00: Minrel1_thryvar(T) = if (T ¥incin s) & (T /= 0) then
	arb({m: m in T | (FORALL y in T | (not arg1_bef_arg2(y,m)))}) else s end if. Proof:
	Suppose_not(t) ==> not(Minrel1_thryvar(T) = if (t ¥incin s) & (t /= 0) then
	arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) else s end if)
	Use_def(Minrel1_thryvar) ==> false; Discharge ==> QED
--
Theorem well_founded_set.0a:
  ((T ¥incin s) & (T /= 0)) ¥imp ((Minrel1_thryvar(T) in T) & (FORALL y in T | (not arg1_bef_arg2(y,Minrel1_thryvar(T))))). Proof:
--
-- Proceeding by contradiction, assume that there is a non-null subset $t$ of the domain $s$
-- of our relation for which the operator $Minrel1_thryvar$ just introduced fails to
-- select a minimal element from $t$.
--
    Suppose_not(t) ==> (t ¥incin s) & (t /= 0) &
    	(not((Minrel1_thryvar(t) in t) & (FORALL y in t | (not arg1_bef_arg2(y,Minrel1_thryvar(t))))))
	Assump ==> Stat1: (FORALL t | ((t ¥incin s) & (t /= 0)) ¥imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
	t-->Stat1 ==> Stat2: (EXISTS x in t | (FORALL y in t | (not arg1_bef_arg2(y,x))))
	m-->Stat2 ==> (m in t) & (FORALL y in t | (not arg1_bef_arg2(y,m)))
--
-- This conflicts with the fact that by assumption the set of minimal elements of $t$ cannot be empty,
-- and so the present lemma follows.
--
	Suppose ==> Stat3: {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))} = 0
	m-->Stat3 ==> false; Discharge ==>  arb({m: m in t |
	(FORALL y in t | (not arg1_bef_arg2(y,m)))}) in {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}
	Use_def(Minrel1_thryvar) ==> Minrel1_thryvar(t) = arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))})
	EQUAL ==> Stat4: Minrel1_thryvar(t) in {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}
	(mp)-->Stat4 ==> (mp = Minrel1_thryvar(t)) & (Minrel1_thryvar(t) in t) & (FORALL y in t | (not arg1_bef_arg2(y,mp)))
        EQUAL ==> (FORALL y in t | (not arg1_bef_arg2(y,Minrel1_thryvar(t))))
	Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Next we prove the elementary fact that $Minrel1_thryvar(t)$ cannot be less than $Minrel1_thryvar(r)$ if
-- $t$ and $s$ are both  non-null subsets of $s$ and $t$ is a subset of $r$:
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.0b: [Monotonicity of $Minrel1_thryvar$]
    ((R ¥incin s) & (T ¥incin R) & (T /= 0)) ¥imp (not(arg1_bef_arg2(Minrel1_thryvar(T),Minrel1_thryvar(R)))). Proof:
--
-- Assuming the contrary, it follows that a minimal element of the subset $t$
-- of the set $r$ would precede some minimal element of $r$:
--
    Suppose_not(r,t) ==> (r ¥incin s) & (t ¥incin r) & (t /= 0) & (arg1_bef_arg2(Minrel1_thryvar(t),Minrel1_thryvar(r)))
    ELEM ==> (r /= 0) & (t ¥incin s)
--
-- now use the preceding theorem twice, to derive a contradiction from the fact that
-- $Minrel1_thryvar(t)$ comes before  $Minrel1_thryvar(r)$
--
    t-->Twell_founded_set.0a ==> (Minrel1_thryvar(t) in t)
    r-->Twell_founded_set.0a ==> (Minrel1_thryvar(r) in r) &
    		Stat1: (FORALL y in r | (not arg1_bef_arg2(y,Minrel1_thryvar(r))))
    ELEM ==> Minrel1_thryvar(t) in r
    (Minrel1_thryvar(t))-->Stat1 ==> not(arg1_bef_arg2(Minrel1_thryvar(t),Minrel1_thryvar(r)))
    Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- The fact that for any non-null subset $t$ of $s$, $Minrel1_thryvar(t)$ belongs to $t$ is
-- an even more elementary consequence of the one assumption of the present theory.
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.0c: ((S incs T) & (T /= 0)) ¥imp (Minrel1_thryvar(T) in T). Proof:
    Suppose_not(t) ==> (s incs t) & (t /= 0) & (Minrel1_thryvar(t) notin t)
    Use_def(Minrel1_thryvar) ==> Minrel1_thryvar(t) = arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))})
	Assump ==> Stat1: (FORALL t | ((t ¥incin s) & (t /= 0)) ¥imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
    t-->Stat1 ==> Stat2: (EXISTS x in t | (FORALL y in t | (not arg1_bef_arg2(y,x))))
    x-->Stat2 ==> Stat3: (x in t) & (FORALL y in t | (not arg1_bef_arg2(y,x)))
    Suppose ==>  Stat4: {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))} = 0
    x-->Stat4 ==> false; Discharge ==> {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))} /= 0
    {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}-->T0 ==>
    	arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) in
    			{m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}
    EQUAL ==> Stat5: Minrel1_thryvar(t) in {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}
    m-->Stat5 ==> (Minrel1_thryvar(t) = m) & (m in t)
    Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- We now use the $Minrel1_thryvar$ selector to define a function
-- from ordinals into, and eventually onto, our ordered set $s$,
-- and prove a first elementary property of this function.
-- ----------------------------------------------------------------------------------------------
--
Def 00b: [The enumeration defined by a well-founded ordering relationship] ordenm_thryvar(X) := Minrel1_thryvar(s - {ordenm_thryvar(y): y in X})
--
-- The following statement captures the definition of ordenm_thryvar as a theorem for use outside the present theory.
--
Theorem well_founded_set.1a: ordenm_thryvar(X) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in X}). Proof:
	Suppose_not(x) ==> ordenm_thryvar(x) /= Minrel1_thryvar(s - {ordenm_thryvar(y): y in x})
	Use_def(ordenm_thryvar) ==> ordenm_thryvar(x) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in x})
	Discharge ==> QED
--
Theorem well_founded_set.1:
  (not(s ¥incin {ordenm_thryvar(y): y in X})) ¥imp ((ordenm_thryvar(X) in (s - {ordenm_thryvar(y): y in X}))
		& (FORALL y in (s - {ordenm_thryvar(y): y in X}) | not(arg1_bef_arg2(y,ordenm_thryvar(X))))). Proof:
    Suppose_not(x) ==> (not (s ¥incin {ordenm_thryvar(y): y in x})) &
    		(not ((ordenm_thryvar(x) in (s - {ordenm_thryvar(y): y in x}))
	 & (FORALL y in (s - {ordenm_thryvar(y): y in x}) | not(arg1_bef_arg2(y,ordenm_thryvar(x))))))
--
-- The proof, which is by contradiction,  just uses the definition of 'ordenm_thryvar'
-- and Lemma well_founded_set.0a.
--
	ELEM ==> ((s - {ordenm_thryvar(y): y in x}) ¥incin s) & ((s - {ordenm_thryvar(y): y in x}) /= 0)
--
-- For since $t = s - {ordenm_thryvar(y): y in x}$ is a non-null subset of $s$,
-- $Minrel1_thryvar(t) = ordenm_thryvar(x)$ is a minimal element of $t$, which is what we assert.
--
	(s - {ordenm_thryvar(y): y in x})-->Twell_founded_set.0a ==>
	 (Minrel1_thryvar(s - {ordenm_thryvar(y): y in x}) in (s - {ordenm_thryvar(y): y in x}))
	 & (FORALL y in (s - {ordenm_thryvar(y): y in x}) |
	 		not(arg1_bef_arg2(y,Minrel1_thryvar(s - {ordenm_thryvar(y): y in x}))))
    Use_def(ordenm_thryvar) ==> ordenm_thryvar(x) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in X})
    EQUAL ==> (ordenm_thryvar(x) in (s - {ordenm_thryvar(y): y in x}))
	 & (FORALL y in (s - {ordenm_thryvar(y): y in x}) | not(arg1_bef_arg2(y,ordenm_thryvar(x))))
    Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Next we show that $ordenm_thryvar(x) = s$ only if $s ¥incin {ordenm_thryvar(y): y in X}$
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.2: (s ¥incin {ordenm_thryvar(y): y in X}) ¥eq (ordenm_thryvar(X) = s). Proof:
--
-- For assume the contrary, and first consider the case in which s ¥incin {ordenm_thryvar(y): y in x}
--
    Suppose_not(x) ==> not((s ¥incin {ordenm_thryvar(y): y in x}) ¥eq (ordenm_thryvar(x) = s))
	Use_def(ordenm_thryvar) ==> ordenm_thryvar(x) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in x})
    Suppose ==> (s ¥incin {ordenm_thryvar(y): y in x}) & (ordenm_thryvar(x) /= s)
--
-- In this case, the definitions of the operators involved lead to an immediate contradiction,
-- ruling it out, and so leave only the case $ordenm_thryvar(x) = s$ to be considered.
--
	ELEM ==> Minrel1_thryvar(s - {ordenm_thryvar(y): y in x}) /= s
	Use_def(Minrel1_thryvar) ==> (s - {ordenm_thryvar(y): y in x }) /= 0
	Discharge ==> ((s - {ordenm_thryvar(y): y in x}) /= 0) & (ordenm_thryvar(x) = s)
--
-- but then $s = Minrel1_thryvar(s - {ordenm_thryvar(y): y in x})$ by definition of $ordenm_thryvar$, and so must
-- belong to $s - {ordenm_thryvar(y): y in x}$
--
	ELEM ==> s = Minrel1_thryvar(s - {ordenm_thryvar(y): y in x})
	ELEM ==> ((s - {ordenm_thryvar(y): y in x}) ¥incin s) & (s /= 0)
	(s,s - {ordenm_thryvar(y): y in x})-->Twell_founded_set.0c ==>
	Minrel1_thryvar(s - {ordenm_thryvar(y): y in x}) in s - {ordenm_thryvar(y): y in x}
   Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Our next result shows that the image, via the enumerator, of any $x$
-- is either $s$ or an element of $s$:
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.3: (ordenm_thryvar(X) /= s) ¥imp (ordenm_thryvar(X) in s). Proof:
--
-- Suppose $x$ is a counterexample.
-- Then Theorem well_founded_set.2 tells us that some element of $s$ is
-- not the image, via the enumerator '$ordenm_thryvar$', of any element of $x$.
--
    Suppose_not(x) ==> (ordenm_thryvar(x) /= s) & (ordenm_thryvar(x) notin s)
	(s,x)-->Twell_founded_set.2 ==> not(s ¥incin {ordenm_thryvar(y): y in x})
--
-- Thus, by Theorem well_founded_set.1, $ordenm_thryvar(x)$ belongs to $s$,
-- a contradiction which proves our statement.
--
	(s,x)-->Twell_founded_set.1 ==> ordenm_thryvar(x) in (s - {ordenm_thryvar(y): y in x})
    Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Now we show that ordenm_thryvar, restricted to ordinals,
-- is a monotone mapping into the ordered set s:
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.5: [Ordinal enumeration is monotone on ordinals]
 (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V))) ¥imp (U in V). Proof:
--
-- For if the ordinals $o1$, $o2$ are a counterexample to the asserted statement...
--
    Suppose_not(o1,o2) ==>
	 Ord(o1) & Ord(o2) & (ordenm_thryvar(o1) /= s) & arg1_bef_arg2(ordenm_thryvar(o1),ordenm_thryvar(o2)) & (not(o1 in o2))
--
--	..then it follows from Theorem well_founded_set.2 that the images, via the enumerator,
--  of the elements of $o1$ fail to exhaust the elements of $s$:
--
	(s,o1)-->Twell_founded_set.2 ==> (not(s ¥incin {ordenm_thryvar(y): y in o1}))
--
-- A contradiction will now be derived from the assumption that $o1$ does not
-- precede o2. Since ordinals $o1$, $o2$ can always be compared,
-- this assumption implies that $o2$ either precedes $o1$ or is equal to it.
--
	(o1,o2)-->T31 ==> (o2 in o1) or (o1 = o2)
--
-- But since, for ordinals, membership implies inclusion, Theorem well_ordered_set_0b
-- shows that  the $o1$-th element of $s$ cannot precede the $o2$-th element of s.
-- This contradiction proves our theorem.
--
	(o1,o2)-->T34 ==> (o2 in o1) ¥imp (o2 ¥incin o1)
	ELEM ==> o2 ¥incin o1
	Set_monot ==> (s - {ordenm_thryvar(y): y in o1}) ¥incin (s - {ordenm_thryvar(y): y in o2})
	ELEM ==> ((s - {ordenm_thryvar(y): y in o1}) /= 0) & ((s - {ordenm_thryvar(y): y in o2}) ¥incin s)
	(s - {ordenm_thryvar(y): y in o2},s,s - {ordenm_thryvar(y): y in o1})-->Twell_founded_set.0b ==>
	 (not arg1_bef_arg2(Minrel1_thryvar(s - {ordenm_thryvar(y): y in o1}),Minrel1_thryvar(s - {ordenm_thryvar(y): y in o2})))
    Use_def(ordenm_thryvar) ==> ordenm_thryvar(o2) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in o2})
    Use_def(ordenm_thryvar) ==> ordenm_thryvar(o1) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in o1})
    EQUAL ==> false; Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Next we show that the enumerator, restricted to any ordinal $v$, enumerates a
-- superset of the 'segment' of $s$ consisting of all elements of $s$ which precede the $v$-th:
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.6: {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} ¥incin {ordenm_thryvar(x): x in V}. Proof:
--
-- Proceed by contradiction, and let $v$ be a counterexample, so that there is
-- some element $b$ of $s$ such that $arg1_bef_arg2(b,ordenm_thryvar(v))$ which
-- differs from the image $ordenm_thryvar(x)$ of any $x in v$.
--
    Suppose_not(v) ==> Stat1: not ({u: u in s |  arg1_bef_arg2(u,ordenm_thryvar(v))} ¥incin {ordenm_thryvar(u): u in v})
	b-->Stat1 ==> Stat2: (b in {u: u in s |  arg1_bef_arg2(u,ordenm_thryvar(v))}) &
				Stat3: (b notin {ordenm_thryvar(u): u in v})
	bp-->Stat2 ==> (b = bp) & (b in s) & arg1_bef_arg2(bp,ordenm_thryvar(v))
        EQUAL ==> arg1_bef_arg2(b,ordenm_thryvar(v))
--
-- By Theorem well_founded_set.1, no element of $s - {ordenm_thryvar(y): y in v}$ can precede ordenm_thryvar(v).
-- In particular, $b$ cannot precede $ordenm_thryvar(v)$. This contradiction proves our theorem.
--
	ELEM ==> (b in (s - {ordenm_thryvar(u): u in v})) & (not (s ¥incin {ordenm_thryvar(u): u in v}))
	(s,v)-->Twell_founded_set.1 ==>
	Stat4: (FORALL y in (s - {ordenm_thryvar(y): y in v}) | (not arg1_bef_arg2(y,ordenm_thryvar(v))))
	b-->Stat4 ==> (not arg1_bef_arg2(b,ordenm_thryvar(v)))
    Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Our next theorem asserts that distinct ordinals whose images under the enumerator
-- differ from (and hence belong to) $s$, have different images.
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.7: [Well-ordering is initially 1-1]
	 (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s) & (U /= V)) ¥imp (ordenm_thryvar(U) /= ordenm_thryvar(V)). Proof:
    Suppose_not(o1,o2) ==>
	 Ord(o1) & Ord(o2) & (ordenm_thryvar(o1) /= s) & (ordenm_thryvar(o2) /= s) & (o1 /= o2) & (ordenm_thryvar(o1) = ordenm_thryvar(o2))
--
-- Proceed by contradiction, and let the ordinals $o1$, $o2$ be a counterexample.
-- It follows by theorems well_founded_set.1 and well_founded_set.2
-- that the image of $o1$ (resp. $o2$) lies outside ${ordenm_thryvar(y): y in o1}$
-- (resp. ${ordenm_thryvar(y): y in o2}$).
--
	(s,o1)-->Twell_founded_set.2 ==> not(s ¥incin {ordenm_thryvar(y): y in o1})
	(s,o2)-->Twell_founded_set.2 ==> not(s ¥incin {ordenm_thryvar(y): y in o2})
	(s,o1)-->Twell_founded_set.1 ==> ordenm_thryvar(o1) in (s - {ordenm_thryvar(y): y in o1})
	(s,o2)-->Twell_founded_set.1 ==> ordenm_thryvar(o2) in (s - {ordenm_thryvar(y): y in o2})
--
-- Given two distinct ordinals, one always precedes the other: assume first that $o1$ belongs to $o2$.
-- Then obviously the image of $o1$ is image of an element of $o2$, a contradiction.
--
	(o1,o2)-->T31 ==> (o1 in o2) or (o2 in o1)
	Suppose ==> o1 in o2
	Suppose ==> Stat1: ordenm_thryvar(o1) notin {ordenm_thryvar(y): y in o2}
	o1-->Stat1 ==> false; Discharge ==> ordenm_thryvar(o1) in {ordenm_thryvar(y): y in o2}
    Discharge ==> o2 in o1
--
-- A similar contradiction results if $o2$ belongs to $o1$. This shows that our
-- original assumption is false, and so completes our proof.
--
    Suppose ==> Stat2: ordenm_thryvar(o2) notin {ordenm_thryvar(y): y in o1}
    o2-->Stat2 ==> false; Discharge ==> ordenm_thryvar(o2) in {ordenm_thryvar(y): y in o1}
    Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- The following theorem asserts that for every $s$ there is an ordinal $o$ such that the restriction
-- to $o$ of the enumerator is a 1-1 map from $s$ onto $s$.
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.8:
    (EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))). Proof:
--
-- Proceeding by contradiction, assume the theorem to be false.
--
    Suppose_not ==>
    	Stat1: not(EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
				& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))
--
-- We first show that there is at least one ordinal in $next(#pow(s))$ whose image under
-- the enumerator is all of $s$. For assume the contrary.  The cardinality of $pow(s)$
-- is an ordinal which must be different from $#s$. Hence by Theorem well_founded_set.2
-- the set ${ordenm_thryvar(y): y in #pow(s)}$ of images of elements of $#pow(s)$ cannot include $s$.
--
    (pow(s))-->T156 ==> Card(#pow(s)) & Ord(#pow(s))
    (#pow(s))-->T32 ==> Ord(next(#pow(s)))
    Suppose ==> Stat2: not(EXISTS o in next(#pow(s)) | (Ord(o) & (ordenm_thryvar(o) = s)))
    Use_def(next) ==> next(#pow(s)) = #pow(s) + {#pow(s)}
    ELEM ==> #pow(s) in next(#pow(s))
    (#pow(s))-->Stat2 ==> ordenm_thryvar(#pow(s)) /= s
     (s,#pow(s))-->Twell_founded_set.2 ==> not(s ¥incin {ordenm_thryvar(y): y in #pow(s)})
--
-- But ${ordenm_thryvar(y): y in #pow(s)}$ must be included in $s$, for otherwise some element $ordenm_thryvar(b)$,
-- with $b in #pow(s)$ would lie outside $s$, whereas by definition $ordenm_thryvar(b)$
-- must belong to $s$.
--
    Suppose ==> Stat3: not ({ordenm_thryvar(o): o in #pow(s)} ¥incin s)
    b1-->Stat3 ==> (b1 notin s) & Stat4: (b1 in {ordenm_thryvar(o): o in #pow(s)})
    b-->Stat4 ==> (b in #pow(s)) & (ordenm_thryvar(b) notin s)
    (next(#pow(s)),b)-->T12 ==> Ord(b)
    (next(#pow(s)),b)-->T13 ==> b ¥incin #pow(s)
    Set_monot ==> (s - {ordenm_thryvar(y): y in #pow(s)}) ¥incin (s - {ordenm_thryvar(y): y in b})
    ELEM ==>  not(s ¥incin {ordenm_thryvar(y): y in b})
    (s,b)-->Twell_founded_set.1 ==> ordenm_thryvar(b) in (s - {ordenm_thryvar(y): y in b})
    Discharge ==> {ordenm_thryvar(o): o in #pow(s)} ¥incin s
--
-- We can use our general 'fcn_symbol' theory to form a single-valued map $f$
-- which pairs each element of $#pow(s)$ to its image under the enumerator.
-- The following properties of this map result automatically:
--
	Loc_def ==> f = {[x,ordenm_thryvar(x)]: x in #pow(s)}
    APPLY(x9_thryvar:d1,y9_thryvar:d2) fcn_symbol(f(x)->ordenm_thryvar(x),g->f,s->#pow(s)) ==>
		Svm(f) & (domain(f) = #pow(s)) & (range(f) = {ordenm_thryvar(x): x in #pow(s)}) &
	 (((d1 in #pow(s)) & (d2 in #pow(s)) & (ordenm_thryvar(d1) = ordenm_thryvar(d2)) & (d1 /= d2)) or one_1_map(f))
--
-- But then the distinct elements $d1$, $d2$ cannot have the same image under the map $f$.
-- Indeed, since $d1$ and $d2$ belong to the ordinal $#pow(s)$,
-- they are ordinals included in $#pow(s)$; which by set monotonicity tells us that
-- neither ${ordenm_thryvar(y): y in d1}$ nor ${ordenm_thryvar(y): y in d2}$ can include $s$.
--
    Suppose ==> (d1 in #pow(s)) & (d2 in #pow(s)) & (ordenm_thryvar(d1) = ordenm_thryvar(d2)) & (d1 /= d2)
    (#pow(s),d1)-->T12 ==> Ord(d1)
    (#pow(s),d2)-->T12 ==> Ord(d2)
    (#pow(s),d1)-->T13 ==> d1 ¥incin #pow(s)
    (#pow(s),d2)-->T13 ==> d2 ¥incin #pow(s)
    Set_monot ==> {ordenm_thryvar(y): y in d1} ¥incin {ordenm_thryvar(y): y in #pow(s)}
    Set_monot ==> {ordenm_thryvar(y): y in d2} ¥incin {ordenm_thryvar(y): y in #pow(s)}
    ELEM ==> not (s ¥incin {ordenm_thryvar(y): y in d1}) & (not (s ¥incin {ordenm_thryvar(y): y in d2}))
--
-- But now Theorem well_founded_set.2 and Theorem well_founded_set.7 tell us that
-- $ordenm_thryvar(d1)$ and $ordenm_thryvar(d1)$ must be different, a contradiction which shows $f$ is one-one.
--
   (s,d1)-->Twell_founded_set.2 ==> ordenm_thryvar(d1) /= s
   (s,d2)-->Twell_founded_set.2 ==> ordenm_thryvar(d2) /= s
   (d1,d2)-->Twell_founded_set.7 ==> false; Discharge ==> one_1_map(f)
--
-- Since the domain and range of the 1-1 mapping $f$ have the same cardinality but are
-- $next(#pow(s))$ and a subset of $s$ respectively, it follows that $next(#pow(s))$
-- is less than or equal to the cardinality of $s$, violating Cantor's theorem. This refutes
-- our assumption that there is no ordinal in  $next(#pow(s))$ whose image under the enumerator is $s$.
--
    f-->T157 ==> #range(f) = #domain(f)
    EQUAL ==> #range(f) = ##pow(s)
    EQUAL ==> #{ordenm_thryvar(x): x in #pow(s)} = ##pow(s)
    (pow(s))-->T166 ==> #{ordenm_thryvar(x): x in #pow(s)} = #pow(s)
    ({ordenm_thryvar(x): x in #pow(s)},s)-->T170 ==> #pow(s) ¥incin #s
    s-->T265 ==> #s in #pow(s)
    Discharge ==> Stat5: (EXISTS o in next(#pow(s)) | Ord(o) & (ordenm_thryvar(o) = s))
--
-- Having now established that there is an ordinal in  $next(#pow(s))$ whose image under the enumerator is $s$,
-- we give the smallest such ordinal the name $o$.
--
    o1-->Stat5 ==> (o1 in next(#pow(s))) & Ord(o1) & (ordenm_thryvar(o1) = s)
    APPLY(mt1_thryvar:o) transfinite_induction(n->o1,p(x)->((x in next(#pow(s))) & Ord(x) & (ordenm_thryvar(x) = s))) ==>
		Stat6: (FORALL x | (o in next(#pow(s))) & Ord(o) & (ordenm_thryvar(o) = s) &
			((x in o) ¥imp (not((x in next(#pow(s))) & Ord(x) & (ordenm_thryvar(x) = s)))))
--
-- It follows from our initial hypothesis that either there is some element of $o in next(#pow(s))$
-- whose image is $s$, or the set of images of the elements of $o$ is different from $s$,
-- or the restriction of the enumerator to $o$ fails to be 1-1.
-- We consider these three possibilities in turn.
--
	a0-->Stat6 ==> (o in next(#pow(s))) & Ord(o) & (ordenm_thryvar(o) = s)
    o-->Stat1 ==> (s /= {ordenm_thryvar(x): x in o}) or (not(FORALL x in o | (ordenm_thryvar(x) /= s)))
								 or (not one_1_map({[x,ordenm_thryvar(x)]: x in o}))
--
-- Case 1. Suppose that there is some element $x$ of $o$ whose image under the enumerator is $s$.
-- Since $x$ must be an ordinal, this conflicts with the assumed minimality of $o$,
-- and so disposes of Case 1.
--
    Suppose ==> Stat7: not (FORALL x in o | ordenm_thryvar(x) /= s)
    (#pow(s))-->T32 ==> Ord(next(#pow(s)))
    x-->Stat7 ==> (x in o) & (ordenm_thryvar(x) = s)
    (next(#pow(s)),o)-->T13 ==> o ¥incin next(#pow(s))
    ELEM ==> x in next(#pow(s))
    (o,x)-->T12 ==> Ord(x)
    x-->Stat6 ==> false; Discharge ==> Stat8: (FORALL x in o | ordenm_thryvar(x) /= s)
--
-- Theorem well_founded_set.3 now tells us ${ordenm_thryvar(y): y in o}$ must be a subset of $s$;
--
    Suppose ==> Stat9: not({ordenm_thryvar(y): y in o} ¥incin s)
    c-->Stat9 ==> Stat10: (c in {ordenm_thryvar(y): y in o}) & (c notin s)
    y-->Stat10 ==> (y in o) & (ordenm_thryvar(y) notin s)
    y-->Stat8 ==> ordenm_thryvar(y) /= s
    y-->Twell_founded_set.3 ==> ordenm_thryvar(y) in s
    Discharge ==> {ordenm_thryvar(y): y in o} ¥incin s
--
-- Case 2. Now suppose that ${ordenm_thryvar(y): y in o}$
-- is a proper subset of $s$. Then Theorem well_founded_set.2 tells us that
-- $ordenm_thryvar(o)$ is a member of $s$ and so is different from $s$, ruling out this case.
--
    Suppose ==> s /= {ordenm_thryvar(y): y in o}
    ELEM ==> not(s ¥incin {ordenm_thryvar(y): y in o})
    (s,o)-->Twell_founded_set.2 ==> ordenm_thryvar(o) /= s
    Discharge ==> not one_1_map({[x,ordenm_thryvar(x)]: x in o})
--
-- Case 3. Finally, suppose that the restriction $h$ of the enumerator to $o$ is not 1-1,
-- and let $u,v$ be different elements of $o$ which have the same image under the map $h$.
-- Then $u$ and $v$ belong to $o$ and so must both be ordinals.
-- Moreover, since they belong to $o$ and $ordenm_thryvar(x) /= s$ for every element $x$ of $o$,
-- $ordenm_thryvar(u)$ and $ordenm_thryvar(v)$ both differ from $s$. Hence by well_founded_set.7
-- $ordenm_thryvar(u) /= ordenm_thryvar(v)$. This contradiction shows that $h$ is one-one, eliminating
-- the last of our three cases and so proving our theorem.
--
	Loc_def ==> h = {[x,ordenm_thryvar(x)]: x in o}
    APPLY(x9_thryvar:u,y9_thryvar:v) fcn_symbol(f(x)->ordenm_thryvar(x),g->h,s->o) ==>
		Svm(h) & (domain(h) = o) & (range(h) = {ordenm_thryvar(x): x in o}) &
	 		(((u in o) & (v in o) & (ordenm_thryvar(u) = ordenm_thryvar(v)) & (u /= v)) or one_1_map(h))
    Suppose ==> Stat11: (u in o) & (v in o) & (ordenm_thryvar(u) = ordenm_thryvar(v)) & (u /= v)
    (o,u)-->T12 ==> Ord(u)
    (o,v)-->T12 ==> Ord(v)
    u-->Stat8 ==> ordenm_thryvar(u) /= s
    v-->Stat8 ==> ordenm_thryvar(v) /= s
    (u,v)-->Twell_founded_set.7 ==> one_1_map({[x,ordenm_thryvar(x)]: x in o})
    Discharge ==> one_1_map(h)
    EQUAL ==> false; Discharge ==> QED
--
-- We can now make the following definition, convenient for subsequent application.
--
Def well_founded_set.b: [?] ord_thryvar := arb({o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))})
--
-- This last definition lets us reformulate the preceding theorem as follows.
--
Theorem well_founded_set.9:
    (ord_thryvar in next(#pow(s))) & Ord(ord_thryvar) & (s = {ordenm_thryvar(x): x in ord_thryvar})
			& (FORALL x in ord_thryvar | (ordenm_thryvar(x) /= s)) &
				one_1_map({[x,ordenm_thryvar(x)]: x in ord_thryvar}). Proof:
	Suppose_not ==> not((ord_thryvar in next(#pow(s))) & Ord(ord_thryvar) & (s = {ordenm_thryvar(x): x in ord_thryvar})
			& (FORALL x in ord_thryvar | (ordenm_thryvar(x) /= s)) &
				one_1_map({[x,ordenm_thryvar(x)]: x in ord_thryvar}))
	Twell_founded_set.8 ==> Stat1: (EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))
	o-->Stat1 ==> (o in next(#pow(s))) & Ord(o) & (s = {ordenm_thryvar(x): x in o})
			& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})
	Suppose ==> Stat2: o notin {o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))}
	o-->Stat2 ==> false; Discharge ==> o in {o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))}
	ELEM ==> 0 /= {o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))}
	({o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o}) & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))})-->T0 ==>
		arb({o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))}) in
			 	{o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))}
	Use_def(ord_thryvar) ==> Stat3: ord_thryvar in {o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))}
	()-->Stat3 ==> false; Discharge ==> QED
--
-- The results just proved can be summarized as follows:
--
ENTER_THEORY Set_theory
--
--DISPLAY well_founded_set
--
--THEORY well_founded_set(s,arg1_bef_arg2(y,x));
--    (FORALL t ¥incin s | ((t /= 0) ¥imp (EXISTS x in t | (FORALL y in t | (not arg1_bef_arg2(y,x))))))
--==>(Minrel1_thryvar,ordenm_thryvar,ord_thryvar)
--    (FORALL x in s, y in s | ((arg1_bef_arg2(x,y) ¥imp (not arg1_bef_arg2(y,x))) & (not arg1_bef_arg2(x,x))))
--    (FORALL x in OM | (not(s ¥incin {ordenm_thryvar(y): y in X})) ¥imp ((ordenm_thryvar(X) in (s - {ordenm_thryvar(y): y in X}))
--	 			& (FORALL y in (s - {ordenm_thryvar(y): y in X}) | not(arg1_bef_arg2(y,ordenm_thryvar(X))))))
--    (FORALL x in OM | (s ¥incin {ordenm_thryvar(y): y in X}) ¥eq (ordenm_thryvar(X) = s))
--    (FORALL x in OM | (ordenm_thryvar(X) /= s) ¥imp (ordenm_thryvar(X) in s))
--    (FORALL u in OM, v in OM | (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & --arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V)) ¥imp (U in V)))
--    (FORALL v in OM | {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} ¥incin {ordenm_thryvar(x): x in V})
--    (FORALL u in OM, v in OM | (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s) & (U /= V)) ¥imp (ordenm_thryvar(U) /= ordenm_thryvar(V)))
--    (ord_thryvar in next(#pow(s))) & Ord(o) & (s = {ordenm_thryvar(x): x in ord_thryvar})
--			 & (FORALL x in ord_thryvar | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in ord_thryvar})
--    (FORALL t in OM | Minrel1_thryvar(t) = if (t ¥incin s) & (t /= 0) then
--		arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) else s end if)
--END well_founded_set;
--
-- ----------------------------------------------------------------------------------------------
-- ----------------------------------------------------------------------------------------------
-- Our next theory, which extends the previous,  concerns binary relations
-- which strictly well-order a given domain $s$.
-- This means that the relation is transitive linear (sometimes called 'trichotomic')
-- and irreflexive on $s$, and that each non-null subset $t$ of this domain
-- has an element which precedes every other element of $t$ in the ordering.
-- We show that any such relation is order-isomorphic to the membership
-- relator on an ordinal in 1-1 ordered correspondence with the set.
--
THEORY well_ordered_set(s,arg1_bef_arg2(x,y))
    (FORALL x in s | (not arg1_bef_arg2(x,x)))
	(FORALL x in s, y in s, wz in s | ((arg1_bef_arg2(x,y) & arg1_bef_arg2(y,wz)) ¥imp arg1_bef_arg2(x,wz)))
	(FORALL t ¥incin s | ((t /= 0) ¥imp (EXISTS x in t | (FORALL y in t | (arg1_bef_arg2(x,y) or (x = y))))))
END well_ordered_set;
--
ENTER_THEORY well_ordered_set
--
-- ----------------------------------------------------------------------------------------------
-- Trichotomy, which does not appear as an explicit theory assumption, will now be derived from
-- the assumption concerning minima; moreover, we will show that
-- each non-null set $t$ of the ordered domain has a minimal element,
-- that is an element which does not follow any other element of $t$ in the ordering.
-- ----------------------------------------------------------------------------------------------
--
Theorem well_ordered_set.0: ((X in s) & (Y in s)) ¥imp (arg1_bef_arg2(X,Y) or arg1_bef_arg2(Y,X) or (X = Y)). Proof:
--
-- We proceed by contradiction. Suppose that our theorem is false, and let $x$, $y$, and $t$ be a counterexample.
--
    Suppose_not(x,y) ==> (x in s) & (y in s) & (not arg1_bef_arg2(x,y)) and (not arg1_bef_arg2(y,x)) and (x /= y)
--
-- If the asserted trichotomy does not hold, there must exist elements $x$, $y$ of $s$ which cannot be compared.
-- But these would form a doubleton without minimum, contradicting one of our assumptions.
--
	 Assump ==> Stat1: (FORALL t ¥incin s | ((t /= 0) ¥imp
								(EXISTS u in t | (FORALL v in t | (arg1_bef_arg2(u,v) or (u = v))))))
	 ELEM ==> ({x,y} ¥incin s) & ({x,y} /= 0)
	 ({x,y})-->Stat1 ==>
	 		Stat2: (EXISTS x1 in {x,y} | (FORALL y1 in {x,y} | (arg1_bef_arg2(x1,y1) or (x1 = y1))))
	 u-->Stat2 ==> (u in {x,y}) & Stat3: (FORALL v in {x,y} | (arg1_bef_arg2(u,v) or (u = v)))
	 ELEM ==> ((u = x) or (u = y)) & (x in {x,y}) & (y in {x,y})
	 Suppose ==> u = x
	y-->Stat3 ==> arg1_bef_arg2(u,y) or (u = y)
	EQUAL ==> false; Discharge ==> u = y
	 x-->Stat3 ==> arg1_bef_arg2(u,x) or (u = x)
	EQUAL ==> false; Discharge ==> QED
--
Theorem well_ordered_set.0a: ((T ¥incin s) & (T /= 0)) ¥imp (EXISTS x in T | (FORALL y in T | (not arg1_bef_arg2(y,x)))). Proof:
	Suppose_not(t) ==> (t ¥incin s) & (t /= 0) & Stat1: (not (EXISTS x in t | (FORALL y in t | (not arg1_bef_arg2(y,x)))))
--
-- Assuming the contrary, there must exist a non-null subset $t$ of $s$ each of whose
-- elements has at least one predecessor. On the other hand,
-- we know that $t$ has an element $v$ which precedes every other element of $t$: this element
-- cannot have any predecessors, else the irreflexivity of the ordering relation would be violated.
--
	Assump ==> Stat2: (FORALL t ¥incin s |
					((t /= 0) ¥imp (EXISTS x in t | (FORALL y in t | (arg1_bef_arg2(x,y) or (x = y))))))
	t-->Stat2 ==> Stat3: (EXISTS x in t | (FORALL y in t | (arg1_bef_arg2(x,y) or (x = y))))
	v-->Stat3 ==> (v in t) & Stat4: (FORALL y in t | (arg1_bef_arg2(v,y) or (v = y)))
	v-->Stat1 ==> Stat5: not (FORALL y in t | (not arg1_bef_arg2(y,v)))
	w-->Stat5 ==> (w in t) & arg1_bef_arg2(w,v)
	w-->Stat4 ==> arg1_bef_arg2(v,w) or (v = w)
	ELEM ==> (v in s) & (w in s)
	Assump ==> Stat6: (FORALL x in s | (not arg1_bef_arg2(x,x)))
	v-->Stat6 ==> not arg1_bef_arg2(v,v)
	Suppose ==> v = w
	EQUAL ==> false; Discharge ==> arg1_bef_arg2(v,w)
	Assump ==> Stat7: (FORALL x in s, y in s, wz in s |
					((arg1_bef_arg2(x,y) & arg1_bef_arg2(y,wz)) ¥imp arg1_bef_arg2(x,wz)))
	(v,w,v)-->Stat7 ==> false; Discharge ==> QED
--
-- We can now import all theorems of the theory well_founded_set into the present theory.
--
	APPLY(Minrel1_thryvar:Minrel2_thryvar,ordenm_thryvar:ordenm_thryvar)
			well_founded_set(s->s,arg1_bef_arg2(x,y)->arg1_bef_arg2(x,y)) ==>
Theorem well_ordered_set.100:
	(FORALL x,y | ((x in s) & (y in s)) ¥imp ((not (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x))) & (not arg1_bef_arg2(x,x)))) &
	(FORALL x | (not(s ¥incin {ordenm_thryvar(y): y in x})) ¥imp ((ordenm_thryvar(x) in (s - {ordenm_thryvar(y): y in x})) &
			(FORALL y in (s - {ordenm_thryvar(y): y in x}) | not(arg1_bef_arg2(y,ordenm_thryvar(x)))))) &
	(FORALL x | (s ¥incin {ordenm_thryvar(y): y in x}) ¥eq (ordenm_thryvar(x) = s)) &
	(FORALL x | (ordenm_thryvar(x) /= s) ¥imp (ordenm_thryvar(x) in s)) &
	(FORALL u, v | (Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) & arg1_bef_arg2(ordenm_thryvar(u),ordenm_thryvar(v))) ¥imp (u in v)) &
	(FORALL v | {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(v))} ¥incin {ordenm_thryvar(x): x in v}) &
	(FORALL u, v | (Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) & (ordenm_thryvar(v) /= s) & (u /= v)) ¥imp
			(ordenm_thryvar(u) /= ordenm_thryvar(v))) &
	(EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))) &
	(FORALL x | ordenm_thryvar(x) = Minrel2_thryvar(s - {ordenm_thryvar(y): y in x})) &
	(FORALL t | Minrel2_thryvar(t) = if (t ¥incin s) & (t /= 0) then
				arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) else s end if)
--
Theorem well_ordered_set.10:  ((X in s) & (Y in s)) ¥imp
		 	((arg1_bef_arg2(X,Y) ¥imp (not arg1_bef_arg2(Y,X))) &
		 		(not arg1_bef_arg2(X,X))). Proof:
	Suppose_not(x,y) ==> ((x in s) & (y in s))  &
		 	(not ((arg1_bef_arg2(x,y) ¥imp (not arg1_bef_arg2(y,x))) &
		 		(not arg1_bef_arg2(x,x))))
    Twell_ordered_set.100 ==> Stat1: (FORALL x,y | ((x in s) & (y in s)) ¥imp
    			((not (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x))) & (not arg1_bef_arg2(x,x))))
    (x,y)-->Stat1 ==> ((x in s) & (y in s)) ¥imp
		 	((arg1_bef_arg2(x,y) ¥imp (not arg1_bef_arg2(y,x))) &
		 		(not arg1_bef_arg2(x,x)))
	Discharge ==> QED
--
Theorem well_ordered_set.1:  (not(s ¥incin {ordenm_thryvar(y): y in X})) ¥imp
	((ordenm_thryvar(X) in (s - {ordenm_thryvar(y): y in X})) &
		(FORALL y in (s - {ordenm_thryvar(y): y in X}) | not(arg1_bef_arg2(y,ordenm_thryvar(X))))). Proof:
 	Suppose_not(x) ==> (not(not(s ¥incin {ordenm_thryvar(y): y in X})) ¥imp
	((ordenm_thryvar(x) in (s - {ordenm_thryvar(y): y in x})) &
		(FORALL y in (s - {ordenm_thryvar(y): y in x}) | not(arg1_bef_arg2(y,ordenm_thryvar(x))))))
    Twell_ordered_set.100 ==> Stat1: (FORALL x | (not(s ¥incin {ordenm_thryvar(y): y in X})) ¥imp
    		((ordenm_thryvar(X) in (s - {ordenm_thryvar(y): y in X})) &
	 	(FORALL y in (s - {ordenm_thryvar(y): y in X}) | not(arg1_bef_arg2(y,ordenm_thryvar(X))))))
    x-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.2:  ((s ¥incin {ordenm_thryvar(y): y in X}) ¥eq (ordenm_thryvar(X) = s)). Proof:
  	Suppose_not(x) ==> not((s ¥incin {ordenm_thryvar(y): y in x}) ¥eq (ordenm_thryvar(x) = s))
    Twell_ordered_set.100 ==> Stat1: (FORALL x | (s ¥incin {ordenm_thryvar(y): y in X}) ¥eq (ordenm_thryvar(X) = s))
    x-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.3:  ((ordenm_thryvar(X) /= s) ¥imp (ordenm_thryvar(X) in s)). Proof:
 	Suppose_not(x) ==> not((ordenm_thryvar(x) /= s) ¥imp (ordenm_thryvar(x) in s))
    Twell_ordered_set.100 ==> Stat1: (FORALL x | (ordenm_thryvar(X) /= s) ¥imp (ordenm_thryvar(X) in s))
    x-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.5a:
	(Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V))) ¥imp (U in V). Proof:
 	Suppose_not(u,v) ==>
 		not((Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) & arg1_bef_arg2(ordenm_thryvar(u),ordenm_thryvar(v))) ¥imp (u in v))
    Twell_ordered_set.100 ==> Stat1: (FORALL u, v | (Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) &
			arg1_bef_arg2(ordenm_thryvar(u),ordenm_thryvar(v))) ¥imp (u in v))
    (u,v)-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.6a: ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} ¥incin {ordenm_thryvar(x): x in V}). Proof:
  	Suppose_not(v) ==>  not({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(v))} ¥incin {ordenm_thryvar(x): x in v})
    Twell_ordered_set.100 ==> Stat1: (FORALL v | {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} ¥incin {ordenm_thryvar(x): x in V})
    v-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.7:  ((Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) &
	(ordenm_thryvar(V) /= s) & (U /= V)) ¥imp (ordenm_thryvar(U) /= ordenm_thryvar(V))). Proof:
 	Suppose_not(u,v) ==>  not((Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) &
	(ordenm_thryvar(v) /= s) & (u /= v)) ¥imp (ordenm_thryvar(u) /= ordenm_thryvar(v)))
    Twell_ordered_set.100 ==> Stat1: (FORALL u, v | (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s) & (U /= V)) ¥imp (ordenm_thryvar(U) /= ordenm_thryvar(V)))
   (u,v)-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.8:  (EXISTS o | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))). Proof:
 	Suppose_not ==>  Stat1: not(EXISTS o | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))
    Twell_ordered_set.100 ==> Stat2: (EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))
	o1-->Stat2 ==> (Ord(o1) & (s = {ordenm_thryvar(x): x in o1})
			 & (FORALL x in o1 | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o1}))
    o1-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.8a: ordenm_thryvar(X) = Minrel2_thryvar(s - {ordenm_thryvar(y): y in X}). Proof:
	Suppose_not(x) ==> ordenm_thryvar(x) /= Minrel2_thryvar(s - {ordenm_thryvar(y): y in x})
	Twell_ordered_set.100 ==> Stat1: (FORALL x | ordenm_thryvar(x) = Minrel2_thryvar(s - {ordenm_thryvar(y): y in x}))
	x-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.8b: Minrel2_thryvar(T) = if (T ¥incin s) & (T /= 0) then
		arb({m: m in T | (FORALL y in T | (not arg1_bef_arg2(y,m)))}) else s end if. Proof:
	Suppose_not(t) ==> Minrel2_thryvar(t) /= if (t ¥incin s) & (t /= 0) then
			arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) else s end if
	Twell_ordered_set.100 ==> Stat1: (FORALL t | Minrel2_thryvar(t) = if (t ¥incin s) & (t /= 0) then
		arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) else s end if)
	t-->Stat1 ==> false; Discharge ==> QED
--
-- This mechanical transition being accomplished, our next theorem tells us that the enumerator,
-- restricted to ordinals, conforms to the linear ordering of $s$:
--
Theorem well_ordered_set.5: [Any well-ordering is isomorphic to an ordinal enumeration]
 (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s)) ¥imp (arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V)) ¥eq (U in V)). Proof:
--
-- For if the ordinals $o1$, $o2$ are a counterexample to the asserted statement...
--
    Suppose_not(o1,o2) ==>
	Ord(o1) & Ord(o2) & (ordenm_thryvar(o1) /= s) & (ordenm_thryvar(o2) /= s) & (not(arg1_bef_arg2(ordenm_thryvar(o1),ordenm_thryvar(o2)) ¥eq (o1 in o2)))
--
-- ...then it follows from well_ordered_set.5a that the negated equivalence
-- is satisfied with its left-hand side false and its right-hand side true
--
	Suppose ==> arg1_bef_arg2(ordenm_thryvar(o1),ordenm_thryvar(o2)) & (o1 notin o2)
	(o1,o2)-->Twell_ordered_set.5a ==> false; Discharge ==> (not arg1_bef_arg2(ordenm_thryvar(o1),ordenm_thryvar(o2))) & (o1 in o2)
--
-- However, since the images of $o1$ an $o2$ via the enumerator $ordenm_thryvar$ both
-- belong to $s$, trichotomy implies that $ordenm_thryvar(o1)$ and $ordenm_thryvar(o2)$ can be compared.
	o1-->Twell_ordered_set.3 ==> ordenm_thryvar(o1) in s
	o2-->Twell_ordered_set.3 ==> ordenm_thryvar(o2) in s
	(ordenm_thryvar(o1),s,ordenm_thryvar(o2))-->Twell_ordered_set.0 ==>
	arg1_bef_arg2(ordenm_thryvar(o2),ordenm_thryvar(o1)) or (ordenm_thryvar(o1) = ordenm_thryvar(o2))
-- Neither ordenm_thryvar(o1) = ordenm_thryvar(o2) nor the only residual alternative can hold, though;
	(o1,o2)-->Twell_ordered_set.7 ==> arg1_bef_arg2(ordenm_thryvar(o2),ordenm_thryvar(o1))
-- and hence we are led to the desired contradiction.
    (o2,o1)-->Twell_ordered_set.5a ==> false; Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Next we show that the enumerator '$ordenm_thryvar$', restricted to an ordinal $v$
-- for which $ordenm_thryvar(v)$ belongs to $s$, enumerates the segment of $s$ consisting
-- of all elements which precede the $v$-th:
-- ----------------------------------------------------------------------------------------------
--
Theorem well_ordered_set.6: (Ord(V) & (ordenm_thryvar(V) /= s)) ¥imp ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} = {ordenm_thryvar(x): x in V}). Proof:
    Suppose_not(o) ==> (Ord(o) & (ordenm_thryvar(o) /= s) & ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(o))} /= {ordenm_thryvar(u): u in o}))
--
-- Proceed by contradiction, and use transfinite induction to find the least ordinal $o$
-- for which our assertion is false.
--
    (s,o)-->Twell_ordered_set.6a ==> not({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(o))} incs {ordenm_thryvar(u): u in o})
    APPLY(mt1_thryvar:o1) transfinite_induction(n->o,P(x)->(Ord(x) & (ordenm_thryvar(x) /= s) & (not({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(x))} incs {ordenm_thryvar(u): u in x})))) ==>
	Stat1:	(FORALL x | Ord(o1) & (ordenm_thryvar(o1) /= s) & (not({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(o1))} incs {ordenm_thryvar(u): u in o1})) &
	((x in o1) ¥imp (not(Ord(x) & (ordenm_thryvar(x) /= s) & (not({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(x))} incs {ordenm_thryvar(u): u in x}))))))
   0-->Stat1 ==> Ord(o1) & (ordenm_thryvar(o1) /= s) & Stat2: (not({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(o1))} incs {ordenm_thryvar(u): u in o1}))
--
-- Then since $ordenm_thryvar(o1)$ belongs to $s$, the range of $ordenm_thryvar$ on $o1$ is a proper subset of $s$;
-- and then by definition $ordenm_thryvar(o1)$ must be the least element of $s$ not in this range.
--
    (s,o1)-->Twell_ordered_set.2 ==> (not(s ¥incin {ordenm_thryvar(y): y in o1}))
    (s,o1)-->Twell_ordered_set.1 ==> (ordenm_thryvar(o1) in (s - {ordenm_thryvar(y): y in o1})) &
	 Stat3: (FORALL y in (s - {ordenm_thryvar(y): y in o1}) | not(arg1_bef_arg2(y,ordenm_thryvar(o1))))
--
-- First suppose that there is an $o2 in o1$ such that $ordenm_thryvar(o2)$ does not precede $ordenm_thryvar(o1)$.
-- Then plainly $o2$ is an ordinal and a proper subset of $o1$.
--
    c-->Stat2 ==> Stat4: (c in {ordenm_thryvar(o2): o2 in o1}) & Stat5: (c notin {u: u in s |  arg1_bef_arg2(u,ordenm_thryvar(o1))})
    o2-->Stat4 ==> (c = ordenm_thryvar(o2)) & (o2 in o1)
    (o1,o2)-->T12 ==> Ord(o2)
    (o1,o2)-->T13 ==> o2 ¥incin o1
--
-- Then it follows, since the range of $ordenm_thryvar$ on $o1$ is a proper subset of $s$,
-- that if we remove all images of elements of $o2$ from $s$, a nonempty set $r$  will remain.
-- Then the image of $u$ will be the least elements of $r$.
-- By its minimality, the image of $o1$ must precede the image of $u$,
-- which leads to a contradiction.
--
	Set_monot ==> {ordenm_thryvar(y): y in o1} incs {ordenm_thryvar(y): y in o2}
    ELEM ==> (not(s ¥incin {ordenm_thryvar(y): y in o1})) & ((s - {ordenm_thryvar(y): y in o2}) /= 0)
    o2-->Twell_ordered_set.8a ==> ordenm_thryvar(o2) = Minrel2_thryvar(s - {ordenm_thryvar(y): y in o2})
    (s,o2)-->Twell_ordered_set.1 ==> ordenm_thryvar(o2) in s
    (ordenm_thryvar(o2))-->Stat5 ==> not(arg1_bef_arg2(ordenm_thryvar(o2),ordenm_thryvar(o1)))
--
-- On the other hand, if all images of elements of $o1$ precede the image of $o1$,
-- our initial assumption implies that some predecessor $b$ of the image of $o1$ in $s$
-- is not the image of an element of $o1$.
--
    (o2,o1)-->Twell_ordered_set.5 ==> false; Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Our next theorem combines the preceding results to prove that when the image of an
-- ordinal under the enumerator differs from (and hence belongs to) $s$, the restriction $g$ of
-- 'ordenm_thryvar' to $v$ is a 1-1 map whose range consists of all predecessors in $s$ of the image of $v$.
-- ----------------------------------------------------------------------------------------------
--
Theorem well_ordered_set.9: (Ord(V) & (ordenm_thryvar(V) /= s)) ¥imp
  ( one_1_map({[x,ordenm_thryvar(x)]: x in V})
   & (domain({[x,ordenm_thryvar(x)]: x in V}) = V)
   & (range({[x,ordenm_thryvar(x)]: x in V}) = {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))})
   & ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} = {ordenm_thryvar(x): x in V})). Proof:
--
-- For consider a counterexample $v$. Using '$fcn_symbol$', we see that
-- $g = {[x,ordenm_thryvar(x)]: x in v}$ is single-valued and has domain $v$. Moreover, if $g$ is not 1-1,
-- there are distinct elements $x$, $y$ of $v$ such that $ordenm_thryvar(x) = ordenm_thryvar(y)$.
--
    Suppose_not(v) ==> Ord(v) & (ordenm_thryvar(v) /= s) & (not(one_1_map({[x,ordenm_thryvar(x)]: x in v}) &
	(domain({[x,ordenm_thryvar(x)]: x in v}) = v) &
	(range({[x,ordenm_thryvar(x)]: x in v}) = {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(v))}) &
	({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(v))} = {ordenm_thryvar(x): x in v})))
	Loc_def ==> g = {[x,ordenm_thryvar(x)]: x in v}
    APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(f(x)->ordenm_thryvar(x),g->g,s->v) ==>
		Svm(g) & (range(g) = {ordenm_thryvar(x): x in v}) & (domain(g) = v) &
	 	(((x in v) & (y in v) & (ordenm_thryvar(x) = ordenm_thryvar(y)) & (x /= y)) or one_1_map(g))
    EQUAL ==> (range({[x,ordenm_thryvar(x)]: x in v}) = {ordenm_thryvar(x): x in v}) & (domain({[x,ordenm_thryvar(x)]: x in v}) = v)
--
-- But the final conjunct in this last formula leads to the following contradiction:
-- since $x$ and $y$ belong to the ordinal $v$ they are ordinals included in $v$.
-- But since $ordenm_thryvar(v) /= s$, Theorem well_ordered_set.2 tells us that
-- $s$ is not included in ${ordenm_thryvar(u): u in v}$.
--
    Suppose ==> (x in v) & (y in v) & (ordenm_thryvar(x) = ordenm_thryvar(y)) & (x /= y)
    (v,x)-->T12 ==> Ord(x)
    (v,y)-->T12 ==> Ord(y)
    (v,x)-->T13 ==> x ¥incin v
    (v,y)-->T13 ==> y ¥incin v
    (s,v)-->Twell_ordered_set.2 ==> not(s ¥incin {ordenm_thryvar(u): u in v})
--
-- It follows that the images under $g$ of $x$ and $y$ both belong to $s$,
-- and then by well_ordered_set.7 they are
-- the same. This  contradiction shows that $g$ is one-one.
--
	Set_monot ==> {ordenm_thryvar(u): u in v} incs {ordenm_thryvar(u): u in x}
	Set_monot ==> {ordenm_thryvar(u): u in v} incs {ordenm_thryvar(u): u in y}
    ELEM ==> (not (s ¥incin {ordenm_thryvar(u): u in x})) & (not (s ¥incin {ordenm_thryvar(u): u in y}))
    (s,x)-->Twell_ordered_set.2 ==> ordenm_thryvar(x) /= s
    (s,y)-->Twell_ordered_set.2 ==> ordenm_thryvar(y) /= s
    (x,y)-->Twell_ordered_set.7 ==> false; Discharge ==> one_1_map(g)
    EQUAL ==> one_1_map({[x,ordenm_thryvar(x)]: x in v})
--
-- We still must prove that $g$ has the stated range,
-- but this is immediate from Theorem well_ordered_set.6,
-- completing the proof of the present theorem.
--
    v-->Twell_ordered_set.6 ==> false; Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- ----------------------------------------------------------------------------------------------
--
-- The results just proved can be summarized as follows:
--
ENTER_THEORY Set_theory
--
--DISPLAY well_ordered_set
--
--THEORY well_ordered_set(s,arg1_bef_arg2(y,x));
--    (FORALL x in s | (not arg1_bef_arg2(x,x))) &
--    (FORALL x in s, y in s, z in s | ((arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) ¥imp arg1_bef_arg2(x,z))) &
--	 (FORALL t ¥incin s | ((t /= 0) ¥imp (EXISTS x in t, y in t | arg1_bef_arg2(x,y) or x = y)))
--==>(ordenm_thryvar)
--    (FORALL x in s, y in s | (arg1_bef_arg2(x,y) or arg1_bef_arg2(y,x) or x = y))
--    (s ¥incin {ordenm_thryvar(y): y in X}) ¥eq (ordenm_thryvar(X) = s)
--    (ordenm_thryvar(X) /= s) ¥imp (ordenm_thryvar(X) in s)
--	 [ny well-ordering is isomorphic to an ordinal enumeration]
--    (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s)) ¥imp (arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V)) ¥eq (U in V))
--    (Ord(V) & (ordenm_thryvar(V) /= s)) ¥imp ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} = {ordenm_thryvar(x): x in V})
--    (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s) & (U /= V)) ¥imp (ordenm_thryvar(U) /= ordenm_thryvar(V))
--    (EXISTS o | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
--					 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))
--    (Ord(V) & (ordenm_thryvar(V) /= s)) ¥imp
--	 ( one_1_map({[x,ordenm_thryvar(x)]: x in V})
--	 & (domain({[x,ordenm_thryvar(x)]: x in V}) = V)
--	 & (range({[x,ordenm_thryvar(x)]: x in V}) = {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))})
--	 & {u: u in s |  arg1_bef_arg2(u,ordenm_thryvar(V))} = {ordenm_thryvar(x): x in V})
--END well_ordered_set;
--
--
--
THEORY inh_well_founded_set(s,arg1_bef_arg2(Y,X),sp,displace(X))
	(FORALL t | ((t ¥incin s) & (t /= 0)) ¥imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
	(FORALL x | (x in sp) ¥imp (displace(x) in s))
END inh_well_founded_set;
--
ENTER_THEORY inh_well_founded_set
--
Theorem inh_well_founded_set1: ((T ¥incin sp) & (T /= 0)) ¥imp (EXISTS w in T | (FORALL v in T | (not arg1_bef_arg2(displace(v),displace(w))))). Proof:
Suppose_not(t0) ==> (t0 ¥incin sp) & (t0 /= 0) & Stat1: (not(EXISTS w in t0 | (FORALL v in t0 | (not arg1_bef_arg2(displace(v),displace(w))))))
	Suppose ==> Stat2: {displace(x): x in t0} ¥nincin s
		c-->Stat2(Stat2*) ==> Stat3: (c in {displace(x): x in t0}) & (c notin s)
		cp-->Stat3(*) ==> (c = displace(cp)) & (cp in sp)
		Assump ==> Stat4: (FORALL x | (x in sp) ¥imp (displace(x) in s))
	cp-->Stat4(Stat3*) ==> false; Discharge ==> AUTO
	Suppose ==> Stat5: {displace(x): x in t0} = 0
		(Stat5*)ELEM ==> Stat6: displace(arb(t0)) notin {displace(x): x in t0}
		(arb(t0))-->Stat6(Stat6*) ==> arb(t0) notin t0
	Discharge ==> AUTO
	Assump ==> Stat7: (FORALL t | ((t ¥incin s) & (t /= 0)) ¥imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
	{displace(x): x in t0}-->Stat7(*) ==> Stat8: (EXISTS w in {displace(x): x in t0} | (FORALL v in {displace(x): x in t0} | (not arg1_bef_arg2(v,w))))
	w-->Stat8(Stat8*) ==> Stat9: (w in {displace(x): x in t0}) & Stat10: (FORALL v in {displace(x): x in t0} | (not arg1_bef_arg2(v,w)))
	w0-->Stat9(Stat9*) ==> (w0 in t0) & (w = displace(w0))
	w0-->Stat1(Stat9*) ==> Stat11: not(FORALL v in t0 | (not arg1_bef_arg2(displace(v),displace(w0))))
	v0-->Stat11(Stat11*) ==> (v0 in t0) & arg1_bef_arg2(displace(v0),displace(w0))
	(displace(v0))-->Stat10(Stat11*) ==> (displace(v0) in {displace(x): x in t0}) ¥imp (not arg1_bef_arg2(displace(v0),w))
	EQUAL(Stat9) ==> Stat12: ((displace(v0) in {displace(x): x in t0}) ¥imp (not arg1_bef_arg2(displace(v0),displace(w0))))
	(Stat11*)ELEM ==> Stat13: displace(v0) notin {displace(x): x in t0}
	v0-->Stat13(Stat11*) ==> false
	Discharge ==> QED
--
-- The results just proved can be summarized as follows:
--
ENTER_THEORY Set_theory
--
--DISPLAY inh_well_founded_set
--
--THEORY inh_well_founded_set(s,arg1_bef_arg2(Y,X),sp,displace(X))
--	(FORALL t | ((t ¥incin s) & (t /= 0)) ¥imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
--	(FORALL x | (x in sp) ¥imp (displace(x) in s))
--==>
--	(FORALL t | ((t ¥incin sp) & (t /= 0)) ¥imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2_thryvar(displace(v),displace(w))))))
--END inh_well_founded_set;
--
--
-- Next, in more direct preparation for the proof of the cardinal product theorem at which we aim,
-- we prove various properties of a modified lexicographic ordering of the Cartesian product set $s$ of
-- two ordinals. Our key goal is to show that s is well-ordered by this ordering.
--
THEORY product_order(o1,o2)
    Ord(o1) & Ord(o2)
END product_order;
--
ENTER_THEORY product_order
--
-- The following definition introduces the ordering that we will use: one pair $[x,y]$ of ordinals
-- is less than another pair $[u,v]$ iff either the maximum of $x$ and $y$ is less than the maximum of $u, v$,
-- or if these maxima are equal and $x$ is less than $u$, or if the maxima are equal,
-- $x = u$, and $y$ is less than $v$.
--
Def product_order_c: [Lexicographic ordering of a Cartesian product set] Ord1p2_thryvar(X,Y) := ((car(X) + cdr(X) in car(Y) + cdr(Y)) or
	 ((car(X) + cdr(X) = car(Y) + cdr(Y)) & (car(X) in car(Y))) or
	 ((car(X) + cdr(X) = car(Y) + cdr(Y)) & (car(X) = car(Y)) & (cdr(X) in cdr(Y))))
--
-- We first note, in the three following Lemmas, that for all pairs $[x,y]$ in the Cartesian
-- product of our two ordinals, $x$, $y$, the minimum and the maximum of $x$ and $y$ are ordinals.
-- Our first results are trivial consequences of the fact that any member of an ordinal is also an ordinal.
--
Theorem product_order_1: [The first component of any member of a Cartesian product of ordinals is an ordinal] (X in o1 ¥PROD o2) ¥imp Ord(car(X)). Proof:
    Suppose_not(x) ==> (x in o1 ¥PROD o2) & (not Ord(car(x)))
    Use_def(¥PROD) ==> Stat1: x in {[u,v]: u in o1, v in o2}
    (a,b)-->Stat1 ==> (x = [a,b]) & (a in o1) & (b in o2)
    Assump ==> Ord(o1) & Ord(o2)
    (o1,a)-->T12 ==> Ord(a)
    ELEM ==> car(x) = a
    EQUAL ==> false; Discharge ==> QED
--
Theorem product_order_2: [The second component of any member of a Cartesian product of ordinals is an ordinal] (X in o1 ¥PROD o2) ¥imp Ord(cdr(X)). Proof:
    Suppose_not(x) ==> (x in o1 ¥PROD o2) & (not Ord(cdr(x)))
    Use_def(¥PROD) ==> Stat1: x in {[u,v]: u in o1, v in o2}
    (a,b)-->Stat1 ==> (x = [a,b]) & (a in o1) & (b in o2)
    Assump ==> Ord(o1) & Ord(o2)
    (o2,b)-->T12 ==> Ord(b)
    ELEM ==> cdr(x) = b
   	EQUAL ==> false; Discharge ==> QED
--
-- Now we note a trivial consequence of the fact that the maximum of two ordinals is an ordinal.
--
Theorem product_order_3: [The maximum of the components of any member of a Cartesian product of ordinals is an ordinal] (X in o1 ¥PROD o2) ¥imp Ord(car(X) + cdr(X)). Proof:
    Suppose_not(x) ==> (x in o1 ¥PROD o2) & (not Ord(car(x) + cdr(x)))
    Use_def(¥PROD) ==> Stat1: x in {[u,v]: u in o1, v in o2}
    (a,b)-->Stat1 ==> (x = [a,b]) & (a in o1) & (b in o2)
    Assump ==> Ord(o1) & Ord(o2)
    (o1,a)-->T12 ==> Ord(a)
    (o2,b)-->T12 ==> Ord(b)
    (a,b)-->T30 ==> Ord(a + b)
    ELEM ==> car(x) + cdr(x) = a + b
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the binary relationship $Ord1p2_thryvar$ defined above has the properties
-- required of a linear ordering. The following theorem asserts that any two distinct elements
-- of our Cartesian product set are related by this ordering, and product_order_5 tells us
-- that this ordering is transitive.
--
Theorem product_order_4: ((X in o1 ¥PROD o2) & (Y in o1 ¥PROD o2)) ¥imp
	((Ord1p2_thryvar(X,Y) or Ord1p2_thryvar(Y,X) or X = Y) & (not Ord1p2_thryvar(X,X))). Proof:
    Suppose_not(x,y) ==> Stat1: (x in o1 ¥PROD o2) & (y in o1 ¥PROD o2) &
							(not(Ord1p2_thryvar(x,y) or Ord1p2_thryvar(y,x) or x = y) or Ord1p2_thryvar(x,x))
--
-- For let $x$, $o1$, $o2$, $y$ be a counterexample to our assertion, and use the definitions of the
-- ordering operations involved to translate the negative of our assertion into the
-- following statements:
--
    Use_def(Ord1p2_thryvar)(Stat2*) ==> Stat2: Ord1p2_thryvar(x,x) ¥eq ((car(x) + cdr(x) in car(x) + cdr(x)) or
	 ((car(x) + cdr(x) = car(y) + cdr(x)) & (car(x) in car(x))) or
	 ((car(x) + cdr(x) = car(x) + cdr(x)) & (car(x) = car(x)) & (cdr(x) in cdr(x))))
    Use_def(Ord1p2_thryvar)(Stat3*) ==> Stat3: Ord1p2_thryvar(x,y) ¥eq ((car(x) + cdr(x) in car(y) + cdr(y)) or
	 ((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) in car(y))) or
	 ((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) = car(y)) & (cdr(x) in cdr(y))))
    Use_def(Ord1p2_thryvar)(Stat4*) ==> Stat4: Ord1p2_thryvar(y,x) ¥eq ((car(y) + cdr(y) in car(x) + cdr(x)) or
	 ((car(y) + cdr(y) = car(x) + cdr(x)) & (car(y) in car(x))) or
	 ((car(y) + cdr(y) = car(x) + cdr(x)) & (car(y) = car(x)) & (cdr(y) in cdr(x))))
--
-- Use the fact that $x$ and $y$ are members of the Cartesian product set o1 ¥PROD o2 to translate
-- the first of these statements into assertions about the components $a$, $b$, $c$, $d$ of $x$ and $y$,
-- as follows:
--
    Use_def(¥PROD)(Stat1,Stat1*) ==> Stat5: (x in {[x1,y1]: x1 in o1, y1 in o2}) & (y in {[x1,y1]: x1 in o1, y1 in o2})
    (a,b,c,d)-->Stat5(Stat5*) ==> Stat6: (x = [a,b]) & (a in o1) & (b in o2) & (y = [c,d]) & (c in o1) & (d in o2)
    (Stat6)ELEM ==> Stat7: (car(x) = a) & (cdr(x) = b)
    (Stat6,Stat6)ELEM ==> Stat8: (car(y) = c) & (cdr(y) = d)
    (Stat7,Stat2*)ELEM ==> Stat9: Ord1p2_thryvar(x,x) ¥eq ((a + b in a + b) or ((a + b = a + b) & (a in a)) or
	 ((a + b = a + b) & (a = a) & (b in b)))
--
-- Since the right-hand side of the resulting assertion is obviously impossible,
-- it follows that $Ord1p2_thryvar(x,x)$ must be false, so that we need only consider the
-- first clause of our assertion.
--
    (Stat9*)ELEM ==> Stat10: not Ord1p2_thryvar(x,x)
    (Stat10,Stat1*)ELEM ==> Stat11: not(Ord1p2_thryvar(x,y) or Ord1p2_thryvar(y,x) or x = y)
--
-- This translates easily into the statement about $a$, $b$, $c$, and $d$ seen below.
--
    (Stat7,Stat8,Stat3*)ELEM ==> Stat12: Ord1p2_thryvar(x,y) ¥eq ((a + b in c + d) or ((a + b = c + d) & (a in c)) or
	 ((a + b = c + d) & (a = c) & (b in d)))
    (Stat7,Stat8,Stat4*)ELEM ==> Stat13: Ord1p2_thryvar(y,x) ¥eq ((c + d in a + b) or ((c + d = a + b) & (c in a)) or
	 ((c + d = a + b) & (c = a) & (d in b)))
    (Stat11,Stat12,Stat13,Stat6*)ELEM ==> Stat14: not(((a + b in c + d) or ((a + b = c + d) & (a in c)) or
	 ((a + b = c + d) & (a = c) & (b in d))) or ((c + d in a + b) or ((c + d = a + b) & (c in a)) or
	 ((c + d = a + b) & (c = a) & (d in b))) or ([a,b] = [c,d]))
--
-- But now, since $a$, $b$, $c$, and $d$ are all ordinals (so that $a + b$ and $c + d$ are ordinals also),
-- it follows that $a + b = c + d$, so that statement 50 reduces to the simpler form seen as statement 53 below.
--
    Assump ==> Stat15: Ord(o1) & Ord(o2)
    (o1,a)-->T12(Stat15,Stat6*) ==> Stat16: Ord(a)
    (o2,b)-->T12(Stat15,Stat6*) ==> Stat17: Ord(b)
    (a,b)-->T30(Stat16,Stat17*) ==> Stat18: Ord(a + b)
    (o1,c)-->T12(Stat15,Stat6*) ==> Stat19: Ord(c)
    (o2,d)-->T12(Stat15,Stat6*) ==> Stat20: Ord(d)
    (c,d)-->T30(Stat19,Stat20*) ==> Stat21: Ord(c + d)
    (Stat14,Stat14*)ELEM ==> Stat22: not((a + b in c + d) or (c + d in a + b))
    (a + b,c + d)-->T31(Stat22,Stat18,Stat21) ==> Stat23: a + b = c + d
    (Stat14,Stat23*)ELEM ==> Stat24: not((a in c) or ((a = c) & (b in d)) or
	 (c in a) or ((c = a) & (d in b)) or ([a,b] = [c,d]))
--
-- Repeating this same argument for the pair $a$, $c$ of ordinals, we find that $a = c$,
-- so that statement 53 reduces to statement 55 as seen below.
--
    (a,c)-->T31(Stat24,Stat16,Stat19*) ==> Stat25: a = c
    (Stat25,Stat24*)ELEM ==> Stat26: not((b in d) or (d in b) or ([a,b] = [c,d]))
--
-- Repeating this same argument once more for $b$, $d$ , we find that $b = d$,
-- which implies $[a,b] = [c,d]$, and so proves our theorem.
--
    (b,d)-->T31(Stat26,Stat17,Stat20*) ==> Stat27: b = d
    (Stat25,Stat26,Stat27)Discharge ==> QED
--
--  Next we show that the binary relationship Ord1p2_thryvar has the transitivity property required of an ordering.
--
Theorem product_order_5: ((X in o1 ¥PROD o2) & (Y in o1 ¥PROD o2) & (Z in o1 ¥PROD o2) &
		Ord1p2_thryvar(X,Y) & Ord1p2_thryvar(Y,Z)) ¥imp Ord1p2_thryvar(X,Z). Proof:
    Suppose_not(x,y,wz) ==> Stat1: (x in (o1 ¥PROD o2)) & (y in (o1 ¥PROD o2)) & (wz in (o1 ¥PROD o2)) &
			Ord1p2_thryvar(x,y) & Ord1p2_thryvar(y,wz) & (not(Ord1p2_thryvar(x,wz)))
--
-- For let $x = [a,b]$, $y = [c,d]$, $wz = [e,f]$ be a counterexample. Since all the quantities $a,b,c,d,e,f$,
-- and also $a + b$, $c + d$, $e + f$ are ordinals, they are all comparable both by membership and inclusion.
-- Since the ordering of pairs like [a.b] by Ord1p2_thryvar is first of all by membership, and hence inclusion, of a + b,
-- We must have $(a + b) ¥incin (c + d)$, $(c + d) ¥incin (e + f)$, but since $Ord1p2_thryvar(x,z)$ is false,
-- $(e + f)$ cannot be a proper superset of $(a + b)$; hence all the sets $(a + b)$, $(c + d)$, $(e + f)$
-- must be equal.
--
	(x,o1,o2,wz)-->Tproduct_order_4 ==> Ord1p2_thryvar(wz,x) or wz = x
    Use_def(Ord1p2_thryvar)(Stat1,Stat1*) ==> Stat2: ((car(x) + cdr(x) in car(y) + cdr(y)) or
	 ((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) in car(y))) or
	 ((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) = car(y)) & (cdr(x) in cdr(y))))
    Use_def(Ord1p2_thryvar)(Stat1,Stat1*) ==> Stat3: ((car(y) + cdr(y) in car(wz) + cdr(wz)) or
	 ((car(y) + cdr(y) = car(wz) + cdr(wz)) & (car(y) in car(wz))) or
	 ((car(y) + cdr(y) = car(wz) + cdr(wz)) & (car(y) = car(wz)) & (cdr(y) in cdr(wz))))
    Use_def(Ord1p2_thryvar)(Stat1,Stat1*) ==> Stat4: ((car(wz) + cdr(wz) in car(x) + cdr(x)) or
	 ((car(wz) + cdr(wz) = car(x) + cdr(x)) & (car(wz) in car(x))) or
	 ((car(wz) + cdr(wz) = car(x) + cdr(x)) & (car(wz) = car(x)) & (cdr(wz) in cdr(x)))) or wz = x
    Use_def(¥PROD)(Stat1,Stat1*) ==>
	Stat5: (x in {[x1,y1]: x1 in o1, y1 in o2}) & (y in {[x1,y1]: x1 in o1, y1 in o2}) &
				(wz in {[x,y]: x in o1, y in o2})
--??    (a,b,c,d,e,f)-->Stat5(Stat5*) ==>
--	Stat6: (x = [a,b]) & (a in o1) & (b in o2) & (y = [c,d]) & (c in o1) & (d in o2) &
--					(wz = [e,f]) & (e in o1) & (f in o2)
    (a,b,c,d,e,f)-->Stat5 ==>
	Stat6: (x = [a,b]) & (a in o1) & (b in o2) & (y = [c,d]) & (c in o1) & (d in o2) &
					(wz = [e,f]) & (e in o1) & (f in o2)
	ELEM ==> (car([a,b]) = a) & (cdr([a,b]) = b) & (car([c,d]) = c) & (cdr([c,d]) = d) & (car([e,f]) = e) & (cdr([e,f]) = f)
	EQUAL(Stat6) ==> Stat7: (car(x) = a) & (cdr(x) = b) & (car(y) = c) & (cdr(y) = d) & (car(wz) = e) & (cdr(wz) = f)
    EQUAL(Stat7,Stat2) ==> Stat8: ((a + b in c + d) or ((a + b = c + d) & (a in c)) or ((a + b = c + d) & ((a = c) & (b in d))))
    EQUAL(Stat7,Stat3) ==> Stat9: ((c + d in e + f) or ((c + d = e + f) & (c in e)) or ((c + d = e + f) & (c = e) & (d in f)))
    EQUAL(Stat6,Stat7,Stat4) ==> Stat10: ((e + f in a + b) or ((e + f = a + b) & (e in a)) or ((e + f = a + b) & (e = a) & (f in b))) or [e,f] = [a,b]
	(Stat10)ELEM ==> Stat11: (e + f in a + b) or (e + f = a + b)
    Assump ==> Stat12: Ord(o1) & Ord(o2)
    (o1,a)-->T12(Stat12,Stat6*) ==> Ord(a)
    (o2,b)-->T12(Stat12,Stat6*) ==> Ord(b)
    (o1,c)-->T12(Stat12,Stat6*) ==> Ord(c)
    (o2,d)-->T12(Stat12,Stat6*) ==> Ord(d)
    (o1,e)-->T12(Stat12,Stat6*) ==> Ord(e)
    (o2,f)-->T12(Stat12,Stat6*) ==> Ord(f)
    (Stat12*)ELEM ==> Stat13: Ord(a) & Ord(b) & Ord(c) & Ord(d) & Ord(e) & Ord(f)
    (a,b)-->T29(Stat13*) ==> (a ¥incin b or b ¥incin a)
    (c,d)-->T29(Stat13*) ==> (c ¥incin d or d ¥incin c)
    (e,f)-->T29(Stat13*) ==> (e ¥incin f or f ¥incin e)
    (a,e)-->T31(Stat13*) ==> (a in e or e in a or a = e)
    (b,f)-->T31(Stat13*) ==> (b in f or f in b or b = f)
    (a,b)-->T30(Stat13*) ==> Stat14: Ord(a + b)
    (c,d)-->T30(Stat13*) ==> Ord(c + d)
    (e,f)-->T30(Stat13*) ==> Ord(e + f)
    (Stat14*)ELEM ==> Stat15: Ord(a + b) & Ord(c + d) & Ord(e + f)
    (c + d,a + b)-->T34(Stat13*) ==> Stat16: (a + b in c + d) ¥imp ((a + b) ¥incin (c + d))
    (e + f,c + d)-->T34(Stat13*) ==> Stat17: (c + d in e + f) ¥imp ((c + d) ¥incin (e + f))
    (a + b,e + f)-->T34(Stat13*) ==> Stat18: (e + f in a + b) ¥imp ((e + f) ¥incin (a + b))
--
-- The known product-order relationships between $[a,b]$, $[c,d]$, and $[e,f]$ translate into
-- the following membership and equality statements.
--
    (Stat10)ELEM ==> Stat19: (e + f in a + b) or ((e + f = a + b) & (e in a)) or
    					((e + f = a + b) & (e = a) & (f in b)) or ((e = a) & (f = b))
--
-- The known ordering of these same pairs implies the following inclusions, from which the equality of all
-- three union sets follows. This in turn implies the membership relations, and hence the inclusions, seen below.
--
    (Stat8,Stat16*)ELEM ==> Stat20: ((a + b) ¥incin (c + d))
    (Stat9,Stat17*)ELEM ==> Stat21: ((c + d) ¥incin (e + f))
    (Stat11,Stat18*)ELEM ==> Stat22: ((e + f) ¥incin (a + b))
    (Stat22,Stat20,Stat21,Stat8,Stat9*)ELEM ==> Stat23: (a + b = c + d) & (c + d = e + f) &
    					((a in c) or ((a = c) & (b in d))) & ((c in e) or ((c = e) & (d in f)))
    (c,a)-->T34(Stat13,Stat23*) ==> Stat24: c incs a
    (e,c)-->T34(Stat13,Stat23*) ==> Stat25: e incs c
    (a,e)-->T34(Stat19,Stat13,Stat23*) ==> Stat26: a incs e
--
-- But then clearly the sets $a$, $c$, and $e$ are all equal, so we must have $(b in d) & (d in f) & (b notin f)$,
-- which contradicts the fact that, for ordinals, the membership relationship is transitive.
--
    (Stat19,Stat23,Stat24,Stat25,Stat26*)ELEM ==> Stat27: (a = c) & (c = e) & (b in d) & (d in f) & (b notin f)
    (f,d)-->T34(Stat19*) ==> f incs d
    (Stat27*)Discharge ==> QED
--
-- Our next theorem states that $Ord1p2_thryvar$ has the well-ordering property:
-- any subset of our Cartesian product set contains an element minimal in the ordering $Ord1p2_thryvar$.
--
Theorem product_order_6: ((T ¥incin (o1 ¥PROD o2)) & (T /= 0)) ¥imp
	(EXISTS x in T | (FORALL y in t | (Ord1p2_thryvar(x,y) or (x = y)))). Proof:
    Suppose_not(t) ==> Stat1: (t ¥incin (o1 ¥PROD o2)) & (t /= 0) & Stat2: (not(EXISTS x in t | (FORALL y in t | (Ord1p2_thryvar(x,y) or (x = y)))))
--
-- For in the contrary case some Cartesian product $o1 ¥PROD o2$ of two ordinals has a subset $t$ having no minimal element.
-- Plainly, $car(x) + cdr(x)$ is an ordinal for every $x$ in $t$. Thus the set $rel_1$ of elements of $t$ on which
-- $car(x) + cdr(x)$ takes on its minimum value is nonempty.
--
    Assump ==> Ord(o1) & Ord(o2)
    Suppose ==> Stat3: not(FORALL x in t | (Ord(car(x) + cdr(x))))
    a-->Stat3 ==> (a in t) & (not Ord(car(a) + cdr(a)))
    ELEM ==> a in (o1 ¥PROD o2)
    Use_def(¥PROD) ==> Stat4: a in {[x,y]: x in o1, y in o2}
    (b,c)-->Stat4 ==> (a = [b,c]) & (b in o1) & (c in o2)
    ELEM ==> car(a) + cdr(a) = b + c
    EQUAL ==> not Ord(b + c)
    (o1,b)-->T12 ==> Ord(b)
    (o2,c)-->T12 ==> Ord(c)
    (b,c)-->T30 ==> false; Discharge ==> (FORALL x in t | Ord(car(x) + cdr(x)))
    APPLY(rng_thryvar:rel_1) ordval_fcn(s->t,f(x)->car(x) + cdr(x)) ==>
		Stat5: (rel_1 /= 0) & (rel_1 ¥incin t) &
			(rel_1 = {x: x in t | car(x) + cdr(x) = arb({car(y) + cdr(y): y in t})}) &
				Stat6: (FORALL x in rel_1, y in t | (car(x) + cdr(x)) ¥incin (car(y) + cdr(y)))
--
-- Since the function $x->car(x)$ is also ordinal-valued, $rel_1$ admits a nonempty subset
-- $rel_2$ on which this function takes on its minimum value.
--
    Suppose ==> Stat7: not(FORALL x in rel_1 | Ord(car(x)))
    d-->Stat7 ==> (d in rel_1) & (not Ord(car(d)))
    ELEM ==> d in (o1 ¥PROD o2)
    Use_def(¥PROD) ==> Stat8: d in {[x,y]: x in o1, y in o2}
    (b2,c2)-->Stat8 ==> (d = [b2,c2]) & (b2 in o1)
    ELEM ==> car(d) = b2
    EQUAL ==> not Ord(b2)
    Assump ==> Ord(o1) & Ord(o2)
    (o1,b2)-->T12 ==> false; Discharge ==> (FORALL x in rel_1 | Ord(car(x)))
    APPLY(rng_thryvar:rel_2) ordval_fcn(s->rel_1,f(x)->car(x)) ==>
		Stat9: (rel_2 /= 0) & (rel_2 ¥incin rel_1) & (rel_2 = {x: x in rel_1 | car(x) = arb({car(u): u in rel_1})}) &
			Stat10: (FORALL x in rel_2, y in rel_1 | car(x) ¥incin car(y))
--
-- Similarly, since the function $x->cdr(x)$ is also ordinal-valued, $rel_2$ admits
-- a nonempty subset $rel_3$ on which this function takes on its minimum value.
--
    Suppose ==> Stat11: not(FORALL x in rel_2 | Ord(cdr(x)))
    e-->Stat11 ==> (e in rel_2) & (not Ord(cdr(e)))
    ELEM ==> e in (o1 ¥PROD o2)
    Use_def(¥PROD) ==> Stat12: e in {[x,y]: x in o1, y in o2}
    (b3,c3)-->Stat12 ==> (e = [b3,c3]) & (c3 in o2)
    ELEM ==> cdr(e) = c3
    EQUAL ==> not Ord(c3)
    (o2,c3)-->T12 ==> false; Discharge ==> (FORALL x in rel_2 | Ord(cdr(x)))
    APPLY(rng_thryvar:rel_3) ordval_fcn(s->rel_2,f(x)->cdr(x)) ==>
		Stat13: (rel_3 /= 0) & (rel_3 ¥incin rel_2) &
			Stat14: (FORALL x in rel_3, y in rel_2 | cdr(x) ¥incin cdr(y))
--
-- But it is easily seen that any element of the set $rel3$ is minimal over $t$ in the product order $Ord1p2_thryvar$.
--
    x-->Stat13 ==> Stat15: (x in rel_3) & (x in rel_2) & (x in rel_1)
    (Stat15,Stat5)ELEM ==> Stat16: x in {u: u in t | car(u) + cdr(u) = arb({car(v) + cdr(v): v in t})}
	(Stat15,Stat9)ELEM ==> Stat17: x in {v: v in rel_1 | car(v) = arb({car(u): u in rel_1})}
    x2-->Stat16 ==> Stat18: (x = x2) & (car(x2) + cdr(x2) = arb({car(y) + cdr(y): y in t}))
    EQUAL ==> Stat19: car(x) + cdr(x) = arb({car(y) + cdr(y): y in t})
    x3-->Stat17 ==> Stat20: (x = x3) & (car(x3) = arb({car(y): y in rel_1}))
    EQUAL ==> Stat21: car(x) = arb({car(y): y in rel_1})
    Suppose ==> Stat22: not(FORALL y in t | (Ord1p2_thryvar(x,y) or (x = y)))
    y-->Stat22 ==> Stat23: (y in t) & (not(Ord1p2_thryvar(x,y) or x = y))
    Use_def(Ord1p2_thryvar) ==> Stat24: not(car(x) + cdr(x) in car(y) + cdr(y) or
	 ((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) in car(y))) or
	 ((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) = car(y)) & (cdr(x) in cdr(y))) or x = y)
    (Stat1,Stat23,Stat15,Stat5)ELEM ==> (x in (o1 ¥PROD o2)) & (y in (o1 ¥PROD o2))
    Use_def(¥PROD) ==> Stat25: (x in {[u,v]: u in o1, v in o2}) & (y in {[u,v]: u in o1, v in o2})
    (u1,v1,u2,v2)-->Stat25 ==> Stat26: (x = [u1,v1]) & (u1 in o1) & (v1 in o2) & (y = [u2,v2]) &
    					(u2 in o1) & (v2 in o2)
    (Stat26)ELEM ==> Stat27: (car(x) = u1)
    (Stat26,Stat26)ELEM ==> Stat28: (cdr(x) = v1)
    (Stat26,Stat26)ELEM ==> Stat29: (car(y) = u2)
    (Stat26,Stat26)ELEM ==> Stat30: (cdr(y) = v2)
    (Stat26*)ELEM ==> Stat31: (x = [u1,v1]) & (y = [u2,v2])
	EQUAL ==> Stat32: not(u1 + v1 in u2 + v2 or ((u1 + v1 = u2 + v2) & (u1 in u2)) or
	 ((u1 + v1 = u2 + v2) & (u1 = u2) & (v1 in v2)) or [u1,v1] = [u2,v2])
	(x,y)-->Stat6 ==> (car(x) + cdr(x)) ¥incin (car(y) + cdr(y))
	EQUAL ==> Stat33: (u1 + v1) ¥incin (u2 + v2)
	(Stat32)ELEM ==> Stat34: not(u1 + v1 in u2 + v2)
--
-- By Stat25 all of $u1,v1,u2,v2$ are ordinals, and therefore
-- $u1 + v1$ and $u2 + v2$ are also ordinals.
--
    (o1,u1)-->T12 ==> Stat35: Ord(u1)
    (o2,v1)-->T12 ==> Stat36: Ord(v1)
    (o1,u2)-->T12 ==> Stat37: Ord(u2)
    (o2,v2)-->T12 ==> Stat38: Ord(v2)
    (u1,v1)-->T30 ==> Stat39: Ord(u1 + v1)
    (u2,v2)-->T30 ==> Stat40: Ord(u2 + v2)
--
-- It therefore follows by Stat41 and Stat42 and by Theorem 35 that $(u1 + v1) = (u2 + v2)$,
-- so that $y$, like $x$, must be a member of the subset $rel_1$ of $t$.
--
	(u2 + v2,u1 + v1)-->T35(Stat39,Stat40,Stat34) ==> Stat41: u1 + v1 incs u2 + v2
	(Stat41,Stat33)ELEM ==> Stat43: u2 + v2 = u1 + v1
	EQUAL(Stat43,Stat27,Stat28,Stat29,Stat30) ==> Stat42: car(y) + cdr(y) = car(x) + cdr(x)
	Suppose ==> Stat44: y notin rel_1
	(Stat5,Stat44)ELEM ==> Stat45: y notin {x: x in t | car(x) + cdr(x) = arb({car(u) + cdr(u): u in t})}
	y-->Stat45 ==> Stat46: car(y) + cdr(y) /= arb({car(x) + cdr(x): x in t})
	(Stat42,Stat46,Stat19)Discharge ==> y in rel_1
	(Stat32,Stat43)ELEM ==> Stat47: not((u1 in u2) or ((u1 = u2) & (v1 in v2)) or [u1,v1] = [u2,v2])
	(u2,u1)-->T35(Stat47,Stat35,Stat37) ==> Stat48: u1 incs u2
	(x,y)-->Stat10 ==> car(x) ¥incin car(y)
	EQUAL ==> u1 ¥incin u2
	(Stat48)ELEM ==> Stat49: u1 = u2
	EQUAL(Stat49,Stat27,Stat28,Stat29,Stat30) ==> Stat50: car(y) = car(x)
	Suppose ==> Stat51: y notin rel_2
	EQUAL(Stat51,Stat9) ==> Stat52: y notin {x: x in rel_1 | car(x) = arb({car(u): u in rel_1})}
	y-->Stat52 ==> Stat53: car(y) /= arb({car(x): x in rel_1})
	(Stat21,Stat50,Stat53)Discharge ==> y in rel_2
	(x,y)-->Stat14 ==> Stat54: cdr(x) ¥incin cdr(y)
	EQUAL(Stat54,Stat27,Stat28,Stat29,Stat30) ==> Stat55: v1 ¥incin v2
	(Stat49,Stat47)ELEM ==> Stat56: v1 notin v2
	(v2,v1)-->T35(Stat56,Stat36,Stat38) ==> Stat57: v1 incs v2
	(Stat55,Stat57)ELEM ==> Stat58: v1 = v2
	(Stat47,Stat58,Stat49)Discharge ==> Stat59: (FORALL y in t | (Ord1p2_thryvar(x,y) or (x = y)))
	x-->Stat2(Stat15,Stat13,Stat9,Stat5,Stat59) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The results just established can be summarized as follows.
--
--DISPLAY product_order
--
--THEORY product_order(o1,o2)	 [The product-ordering of two ordinals is a well-ordering]
--    Ord(o1) & Ord(o2)
--==>(Ord1p2_thryvar)
--    (FORALL x in o1 ¥PROD o2 | Ord(car(x)))
--    (FORALL x in o1 ¥PROD o2 | Ord(cdr(x)))
--    (FORALL x in o1 ¥PROD o2 | Ord(car(x) + cdr(x)))
--    Ord1p2_thryvar(X,Y) ¥eq ((car(X) + cdr(X) in car(Y) + cdr(Y)) or
--		((car(X) + cdr(X) = car(Y) + cdr(Y)) & (car(X) in car(Y))) or
--		((car(X) + cdr(X) = car(Y) + cdr(Y)) & (car(X) = car(Y)) & (cdr(X) in cdr(Y))))
--    (FORALL x in o1 ¥PROD o2, y in o1 ¥PROD o2 |
--    		(Ord1p2_thryvar(x,y) or Ord1p2_thryvar(y,x) or x = y) & (not Ord1p2_thryvar(x,x)))
--    (FORALL x in o1 ¥PROD o2, y in o1 ¥PROD o2 |
--    		(FORALL z in o1 ¥PROD o2 | ((Ord1p2_thryvar(x,y) & (Ord1p2_thryvar(y,z)) ¥imp Ord1p2_thryvar(x,z)))))
--    ((T ¥incin (o1 ¥PROD o2)) & (T /= 0)) ¥imp
--    		(EXISTS x in T, y in t | (Ord1p2_thryvar(x,y) or x = y))
--END product_order;
--
-- Next we show that the addition of any single element to an infinite set
-- does not change its cardinality.
--
Theorem 355: ['One-more' lemma] (not Finite(S)) ¥imp (#S = #(S + {C})). Proof:
    Suppose_not(s,c) ==> (not Finite(s)) & (#s /= #(s + {c}))
--
-- For suppose that $s$, $c$ is a counterexample to our assertion.
-- Since $s$ is infinite, it is the single-valued image of a proper subset of itself, whose domain therefore omits
-- some element $b$ of $s$. The mapping ${[b,c]}$ defined only on $b$ which maps $b$ to $c$ is plainly single-valued, and since
-- $b notin s$, $f + {[b,c]}$ is a single-valued mapping of a subset of $s$ onto $#(s + {c})$. Thus $#domain(f + {[b,c]})$
-- is not greater than $#s$, while $#range(f + {[b,c]})$ is $#(s + {c})$. Hence by Theorem 171  $#(s + {c})$ is no more than $#s$,
-- proving our assertion.
--
    s-->T195 ==> Stat1: (EXISTS f in OM | (Svm(f) & (range(f) = s) & (domain(f) ¥incin s) & (s /= domain(f))))
    f-->Stat1 ==> Svm(f) & (range(f) = s) & (domain(f) ¥incin s) & Stat2: (not(s ¥incin domain(f)))
    b-->Stat2 ==> ({b} ¥incin s) & ({b} * domain(f) = 0)
    ELEM ==> Svm({[b,c]}) & (range({[b,c]}) = {c}) & (domain({[b,c]}) = {b})
    (f,{[b,c]})-->T87 ==> Svm(f + {[b,c]})
    (f,{[b,c]})-->T78 ==> domain(f + {[b,c]}) ¥incin s
    (f,{[b,c]})-->T79 ==> range(f + {[b,c]}) = s + {c}
    Set_monot ==> Stat3: #domain(f + {[b,c]}) ¥incin #s
    (f + {[b,c]})-->T171 ==> #range(f + {[b,c]}) ¥incin #domain(f + {[b,c]})
    EQUAL ==> Stat4: #(s + {c}) ¥incin #domain(f + {[b,c]})
    (Stat3,Stat4)ELEM ==> Stat5: #(s + {c}) ¥incin #s
    (Stat5*)ELEM ==> s ¥incin (s + {c})
    (s,s + {c})-->T170 ==> false; Discharge ==> QED
--
-- Using Theorem 355, it is easy to prove inductively that the addition of
-- finitely many elements to an infinite set $s$ never changes the cardinality of $s$.
--
Theorem 356: ['Few-more' lemma] ((not Finite(S)) & Finite(T)) ¥imp (#S = #(S + T)). Proof:
    Suppose_not(s,t) ==> (not Finite(s)) & Finite(t) & (#s /= #(s + t))
--
-- For if $s$, $t$ are a counterexample to our assertion, it follows
-- by the principle of finite induction proved earlier that there is a smallest
-- finite x for which there exists an infinite v for which $#v /= #(v + x)$
--
	Suppose ==> Stat1: not (EXISTS u | ((not Finite(u)) & (#u /= #(u + t))))
	s-->Stat1 ==> false;  Discharge ==> (EXISTS u | ((not Finite(u)) & (#u /= #(u + t))))
	APPLY(m1_thryvar:x) finite_induction(n->t,P(x)->(EXISTS u | ((not Finite(u)) & (#u /= #(u + x))))) ==>
		(x ¥incin t) & Stat2: (EXISTS u | ((not Finite(u)) & (#u /= #(u + x)))) &
			Stat3: (FORALL y ¥incin x | ((y /= x) ¥imp (not ((EXISTS u | ((not Finite(u)) & (#u /= #(u + y))))))))
	v-->Stat2 ==> (not Finite(v)) & (#v /= #(v + x))
--
-- Since x plainly cannot be empty, it must have some element $c$.
-- Then $#(v + (x - {c})) = #v$ by the minimality of $x$, and so $#(v + (x - {c})) + {c} = #v$
-- by the preceding theorem, completing our proof.
--
	Suppose ==> x = 0
		TELEM ==> v = v + 0
	EQUAL ==> false; Discharge ==> Stat4: x /= 0
	c-->Stat4 ==> c in x
	(x - {c})-->Stat3 ==> Stat5: not (EXISTS u | ((not Finite(u)) & (#u /= #(u + (x - {c})))))
	v-->Stat5 ==> #v = #(v + (x - {c}))
	(v + (x - {c}),v)-->T189 ==> not Finite(v + (x - {c}))
	(v + (x - {c}),c)-->T355 ==> #(v + (x - {c}) + {c}) = #v
	ELEM ==> v + (x - {c}) + {c} = v + x
	EQUAL ==> false; Discharge ==> QED
--
Theorem 357: [Any infinite cardinal is a limit ordinal] ((not Finite(S)) & (X in #S)) ¥imp (X + {X} in #S). Proof:
	Suppose_not(s,x) ==> (not Finite(s)) & (x in #s) & ((x + {x}) notin #s)
--
-- For let $s$, $x$ be a counterexample to our assertion, so $(x + {x}) notin #s$.
-- Plainly both $#s$ and its member $x$ are ordinals, while $#s$ must be infinite.
-- If $x$ is finite, so is its ordinal successor $x + {x}$, and therefore $x + {x}$
-- must be a member of the infinite ordinal $#s$ by Theorem 197, ruling out this
-- possibility.
--
	s-->T156 ==> Card(#s) & Ord(#s)
	(#s,x)-->T12 ==> Ord(x)
	x-->T32 ==> Ord(next(x))
	Use_def(next) ==> Ord(x + {x})
	Suppose ==> Finite(x)
	x-->T199 ==> Finite(x + {x})
--
-- Hence $x$ is infinite, implying $#(x + {x}) = #x$ by the One-more lemma.
-- Since by assumption x is less than, i.e. a proper subset of, $#s$,
-- and since $#x$ is no more than $x$ by Theorem 169, it follows that $#x = #(x + {x})$ is also
-- a proper subset of $#s$. But if $(x + {x}) notin #s$, then $#s ¥incin (x + {x})$ by Theorem 35,
-- in which case it follows that $##s ¥incin #(x + {x})$, so $#s ¥incin #(x + {x})$
-- giving the contradiction $#s = #(x + {x})$, and so proving the present corollary.
--
	(#s,x + {x})-->T197 ==> false; Discharge ==> not Finite(x)
	(#s,x)-->T34 ==> Stat1: (x ¥incin #s) & (x /= #s)
	(x,x)-->T169 ==> #x ¥incin x
	(x,x)-->T355 ==> #(x + {x}) = #x
	(Stat1*)ELEM ==> (#(x + {x}) ¥incin #s) & (#(x + {x}) /= #s)
	(#s,(x + {x}))-->T35 ==> #s ¥incin (x + {x})
	(#s,(x + {x}))-->T170 ==> ##s ¥incin #(x + {x})
	s-->T166 ==> false; Discharge ==> QED
--
-- Our next main aim is to prove the cardinal Division-by-2 Lemma which appears as Theorem 362 below.
-- Since this result lies a bit deeper than most of the theorems proved up to the present point, we
-- give an informal outline of its proof before entering upon its formal details.
-- The theorem asserts that for every infinite set $s$, $#s = #(s ¥PROD {0,1})$. If this is false,
-- then $#s /= #(s ¥PROD {0,1})$ = $(s ¥TIMES {0,1}) = (#s ¥TIMES {0,1})$ = $#(#s ¥PROD {0,1})$,
-- so our assertion is also false for the infinite cardinal $#s$, and hence for some infinite ordinal.
-- It follows by the axiom of choice that our assertion is also false for some smallest infinite ordinal $s1$.
-- $s1$ must be a cardinal, since otherwise $#s1 in s1$, but also $s1 in #(s1 ¥PROD {0,1})$ = $#(#s1 ¥PROD {0,1})$,
-- so we would have $#s1 in #(#s1 ¥PROD {0,1})$ also, contradicting the minimality of $s1$.
--
-- Order $s1 ¥PROD {0,1}$ by the product ordering described above. The theory we have just established
-- tells us that this is a well-ordering, so that by our previous theory of well-orderings
-- there exists a 1-1 map $f$ from some ordinal $o$ onto $s1 ¥PROD {0,1}$ which is monotone increasing if $o$
-- is given its standard ordering and $s1 ¥PROD {0,1}$ is given its product ordering.
--
-- If $o1$ is a finite  member of the ordinal $o$, then obviously $#o1$ is a member of the infinite cardinal $s1$.
-- If $o1$ is an infinite  member of the ordinal $o$, then it is a proper subset of $o$;
-- so $range(f ¥ON o1)$ is a proper subset $t$ of $s1 ¥PROD {0,1}$.
-- If $[n,0] in range(f ¥ON o1)$ and $m in n$, then $[m,k]$ is less than $[n,0]$ for each $k = 0,1$.
-- Hence there must exist some $[n,0] in s1 ¥PROD {0,1}$ such that $[n,0] notin range(f ¥ON o1)$,
-- since otherwise $range(f ¥ON o1)$ would be all of $s1 ¥PROD {0,1}$ rather than a proper subset.
-- It follows that for every $[m,k] in t$, $m$ is a member of $n$.
-- That is, $range(f ¥ON o1)$ is a subset of $n ¥PROD {0,1}$, and so it follows
-- from the minimality of $s1$ that $#t ¥incin #(n ¥PROD {0,1})$ = $n$ in $s1$. Hence $#o1$ is a member of $s1$
-- for each $o1$ in $o$, proving that $#o ¥incin s1$ in this case also. Since $o$ is in $1-1$ correspondence with
-- $s1 ¥PROD {0,1}$ it follows that $#(s1 ¥PROD {0,1}) ¥incin s1$, contrary to our assumption.
-- This contradiction proves our desired theorem.
--
-- To keep its details under control, we precede the formal proof of Theorem 362 with several lemmas,
-- as suggested by the preceding discussion. Our first lemma asserts that if $s$ and $t$ are ordinals,
-- $s$ being infinite, and if no member of $t$ has a cardinality larger than $#s$,
-- then $t$ has a cardinality no larger than $#s$.
--
Theorem 358: [If ordinal $S$ dominates the members of an ordinal $T$, $#S$ is no less than $#T$] (Ord(S) & Ord(T) & (not Finite(S)) & (FORALL u in T | #u in #S)) ¥imp (#T ¥incin #S). Proof:
	Suppose_not(s,t) ==> Ord(s) & Ord(t) & (not Finite(s)) &
				Stat1: (FORALL x in t | #x in #s) & Stat2: (not(#t ¥incin #s))
	s-->T156 ==> Ord(#s)
	t-->T156 ==> Ord(#t)
	(#t,#s)-->T35 ==> #s in #t
	(t,t)-->T169 ==> #t ¥incin t
	(#s)-->Stat1 ==> ##s in #s
	s-->T166 ==> false; Discharge ==> QED
--
-- We will also find the following elementary property of Cartesian product useful.
--
Theorem 359: [The cardinality of a non-null Cartesian product is at least the cardinality of its first factor] (T /= 0) ¥imp (#S ¥incin #(S ¥PROD T)). Proof:
	Suppose_not(t,s) ==> Stat1: (t /= 0) & (not(#s ¥incin #(s ¥PROD t)))
	c-->Stat1 ==> c in t
	(s,s,{c},t)-->T256 ==> (s ¥PROD {c}) ¥incin (s ¥PROD t)
	(s ¥PROD {c},s ¥PROD t)-->T170 ==> #(s ¥PROD {c}) ¥incin #(s ¥PROD t)
	(s,c)-->T224 ==> false; Discharge ==> QED
--
-- Our next theorem, which simply combines results available through the product_order
-- and well_ordered_set theories developed above, tells us that the Cartesian product $o1 ¥PROD o2$ of
-- any two ordinals is order-isomorphic to a third ordinal o via a 1-1 map that is strictly monotone
-- relative to the product order of $o1 ¥PROD o2$.
--
Theorem 360: (Ord(O1) & Ord(O2)) ¥imp
	(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (O1 ¥PROD O2)) &
	(FORALL x in domain(f), y in domain(f) | (x in y) ¥eq
 (((car(f~[x]) + cdr(f~[x])) in (car(f~[y]) + cdr(f~[y]))) or
 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) in car(f~[y]))) or
 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) = car(f~[y])) & (cdr(f~[x]) in cdr(f~[y])))))). Proof:
--
-- For suppose the contrary,
--
	Suppose_not(o1,o2) ==> Ord(o1) & Ord(o2) &
	Stat1: (not (EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (o1 ¥PROD o2)) &
	(FORALL x in domain(f), y in domain(f) | (x in y) ¥eq
 (((car(f~[x]) + cdr(f~[x])) in (car(f~[y]) + cdr(f~[y]))) or
 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) in car(f~[y]))) or
 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) = car(f~[y])) & (cdr(f~[x]) in cdr(f~[y])))))))
--
-- And consider the product ordering of $o1 ¥PROD o2$, which is a well-ordering.
--
 	APPLY (Ord1p2_thryvar:prod_order) product_order(o1->o1,o2->o2) ==>
		Stat2: (FORALL x, y | prod_order(x,y) ¥eq (car(x) + cdr(x) in car(y) + cdr(y) or
			((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) in car(y))) or
				((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) = car(y)) & (cdr(x) in cdr(y))))) &
			Stat3: (FORALL x, y | ((x in o1 ¥PROD o2) & (y in o1 ¥PROD o2)) ¥imp
				((prod_order(x,y) or prod_order(y,x) or (x = y)) & (not prod_order(x,x)))) &
			Stat4: (FORALL x, y, z | ((x in o1 ¥PROD o2) & (y in o1 ¥PROD o2) & (z in o1 ¥PROD o2) & prod_order(x,y) & prod_order(y,z)) ¥imp prod_order(x,z)) &
			Stat5: (FORALL t | ((t ¥incin (o1 ¥PROD o2)) & (t /= 0)) ¥imp
				(EXISTS x in t| (FORALL y in t | (prod_order(x,y) or (x = y)))))
--
-- Adjust unrestricted quantifiers to the syntax used in the hypotheses of the THEORY well_ordered_set.
--
    Suppose ==> Stat6: not(FORALL x in (o1 ¥PROD o2) | (not prod_order(x,x)))
        x0-->Stat6 ==> (x0 in (o1 ¥PROD o2)) & prod_order(x0,x0)
    (x0,x0)-->Stat3 ==> false; Discharge ==> (FORALL x in (o1 ¥PROD o2) | (not prod_order(x,x)))
--
    Suppose ==> Stat7: not(FORALL x in (o1 ¥PROD o2), y in (o1 ¥PROD o2), z in (o1 ¥PROD o2) | (prod_order(x,y) & prod_order(y,z)) ¥imp prod_order(x,z))
        (x1,y1,z1)-->Stat7 ==> (x1 in (o1 ¥PROD o2)) & (y1 in (o1 ¥PROD o2)) & (z1 in (o1 ¥PROD o2)) & prod_order(x1,y1) & prod_order(y1,z1) & (not prod_order(x1,z1))
    (x1,y1,z1)-->Stat4 ==> false; Discharge ==> (FORALL x in (o1 ¥PROD o2), y in (o1 ¥PROD o2), z in (o1 ¥PROD o2) | (prod_order(x,y) & prod_order(y,z)) ¥imp prod_order(x,z))
--
    Suppose ==> Stat8: (not(FORALL t ¥incin (o1 ¥PROD o2) | (t /= 0) ¥imp
				(EXISTS x in t| (FORALL y in t | (prod_order(x,y) or (x = y))))))
        t0-->Stat8 ==> (t0 ¥incin (o1 ¥PROD o2)) & (t0 /= 0) & (not(EXISTS x in t0| (FORALL y in t0 | (prod_order(x,y) or (x = y)))))
    t0-->Stat5 ==> false; Discharge ==> (FORALL t ¥incin (o1 ¥PROD o2) | (t /= 0) ¥imp
				(EXISTS x in t| (FORALL y in t | (prod_order(x,y) or (x = y)))))
--
-- It follows by the theory of well-ordered sets developed above that there exists an ordinal $o$
-- and a function $orden(x)$ such that $f = {[x,orden(x)]: x in o}$ is a 1-1 mapping of $o$ onto $o1 ¥PROD o2$,
-- which puts the ordering of $o$ by membership into isomorphism with the product-ordering of $o1 ¥PROD o2$.
--
	APPLY (ordenm_thryvar:orden) well_ordered_set(s->o1 ¥PROD o2,arg1_bef_arg2(x,y)->prod_order(x,y)) ==>
		Stat9: (FORALL u, v | (Ord(u) & Ord(v) & (orden(u) /= o1 ¥PROD o2) & (orden(v) /= o1 ¥PROD o2)) ¥imp
			 (prod_order(orden(u),orden(v)) ¥eq (u in v))) &
		Stat10: (EXISTS o | (Ord(o) & (o1 ¥PROD o2 = {orden(x): x in o}) &
					 (FORALL x in o | (orden(x) /= o1 ¥PROD o2)) & one_1_map({[x,orden(x)]: x in o})))
	o-->Stat10 ==> Ord(o) & (o1 ¥PROD o2 = {orden(x): x in o})
					 & Stat11: (FORALL x in o | (orden(x) /= o1 ¥PROD o2)) & one_1_map({[x,orden(x)]: x in o})
 	Loc_def ==> f = {[x,orden(x)]: x in o}
 	APPLY() fcn_symbol(f(x)->orden(x),g->f,s->o) ==>  (domain(f) = o) & (range(f) = {orden(x): x in o}) &
 			Stat12: (FORALL x | (x in o) ¥imp (f~[x] = orden(x)))
 	EQUAL ==> (domain(f) = o) & Ord(domain(f)) & (range(f) = (o1 ¥PROD o2)) & one_1_map(f)
 	Suppose ==> Stat13: not(FORALL x in domain(f), y in domain(f) | (x in y) ¥eq prod_order(orden(x),orden(y)))
 	(x,y)-->Stat13 ==> (x in o) & (y in o) & (not((x in y) ¥eq prod_order(orden(x),orden(y))))
 	x-->Stat11 ==> orden(x) /= o1 ¥PROD o2
 	y-->Stat11 ==> orden(y) /= o1 ¥PROD o2
 	(o,x)-->T12 ==> Ord(x)
 	(o,y)-->T12 ==> Ord(y)
 	(x,y)-->Stat9 ==> false; Discharge ==>
 		Stat14: (FORALL x in domain(f), y in domain(f) | (x in y) ¥eq prod_order(orden(x),orden(y)))
--
-- But it is now obvious that (x in y) has the explicit form asserted in our theorem, completing the present proof.
--
	f-->Stat1 ==> Stat15: not (FORALL x in domain(f), y in domain(f) | (x in y) ¥eq
 (((car(f~[x]) + cdr(f~[x])) in (car(f~[y]) + cdr(f~[y]))) or
 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) in car(f~[y]))) or
 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) = car(f~[y])) & (cdr(f~[x]) in cdr(f~[y])))))
	(x2,y2)-->Stat15 ==> (x2 in domain(f)) & (y2 in domain(f)) &
	(not((x2 in y2) ¥eq (((car(f~[x2]) + cdr(f~[x2])) in (car(f~[y2]) + cdr(f~[y2]))) or
 	(((car(f~[x2]) + cdr(f~[x2])) = (car(f~[y2]) + cdr(f~[y2]))) & (car(f~[x2]) in car(f~[y2]))) or
 	(((car(f~[x2]) + cdr(f~[x2])) = (car(f~[y2]) + cdr(f~[y2]))) & (car(f~[x2]) = car(f~[y2])) & (cdr(f~[x2]) in cdr(f~[y2]))))))
	(x2,y2)-->Stat14 ==> (x2 in y2) ¥eq prod_order(orden(x2),orden(y2))
	(orden(x2),orden(y2))-->Stat2 ==> prod_order(orden(x2),orden(y2)) ¥eq
	(car(orden(x2)) + cdr(orden(x2)) in car(orden(y2)) + cdr(orden(y2)) or
	((car(orden(x2)) + cdr(orden(x2)) = car(orden(y2)) + cdr(orden(y2))) & (car(orden(x2)) in car(orden(y2)))) or
	((car(orden(x2)) + cdr(orden(x2)) = car(orden(y2)) + cdr(orden(y2))) & (car(orden(x2)) = car(orden(y2))) &
		(cdr(orden(x2)) in cdr(orden(y2)))))
	x2-->Stat12 ==> f~[x2] = orden(x2)
	y2-->Stat12 ==> f~[y2] = orden(y2)
	EQUAL ==> false; Discharge ==> QED
--
-- The following extension of Theorem 360 gives us the subsequently needed property of the map $f$ whose existence
-- is asserted by Theorem 360: that the range of the restriction of $f$ to any element of its domain
-- is contained in $y ¥PROD y$ for some $y$ less than the maximum of $o1$ and $o2$.
--
Theorem 361: (Card(O1) & Card(O2) & (not Finite(O1 + O2))) ¥imp
	(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (O1 ¥PROD O2)) &
		(FORALL x in domain(f) | (EXISTS y in (O1 + O2) | range(f ¥ON x) ¥incin (y ¥PROD y)))). Proof:
	Suppose_not(o1,o2) ==> Card(o1) & Card(o2) & (not Finite(o1 + o2)) &
	  Stat1: (not (EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (o1 ¥PROD o2)) &
		(FORALL x in domain(f) | (EXISTS y in (o1 + o2) | range(f ¥ON x) ¥incin (y ¥PROD y)))))
--
-- For suppose not. Take $f$ to be the mapping whose existence is given by the preceding theorem, and
-- let $w$ be an element of its domain which contradicts our present assertion.
--
	Use_def(Card) ==> Ord(o1) & Ord(o2)
	(o1,o2)-->T360 ==> Stat2: (EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (o1 ¥PROD o2)) &
		(FORALL x in domain(f), y in domain(f) | (x in y) ¥eq
 			(((car(f~[x]) + cdr(f~[x])) in (car(f~[y]) + cdr(f~[y]))) or
 				(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) in car(f~[y]))) or
 					(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) &
 						(car(f~[x]) = car(f~[y])) & (cdr(f~[x]) in cdr(f~[y]))))))
	f-->Stat2 ==> Stat3: one_1_map(f) & Ord(domain(f)) & (range(f) = (o1 ¥PROD o2)) &
		Stat4: (FORALL x in domain(f), y in domain(f) | (x in y) ¥eq
 			(((car(f~[x]) + cdr(f~[x])) in (car(f~[y]) + cdr(f~[y]))) or
 				(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) in car(f~[y]))) or
 					(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) &
 						(car(f~[x]) = car(f~[y])) & (cdr(f~[x]) in cdr(f~[y])))))
	f-->Stat1 ==> Stat5: not(FORALL x in domain(f) | (EXISTS y in (o1 + o2) | range(f ¥ON x) ¥incin (y ¥PROD y)))
	w-->Stat5 ==> (w in domain(f)) & Stat6: (not(EXISTS y in (o1 + o2) | range(f ¥ON w) ¥incin (y ¥PROD y)))
--
-- Since $w$ is a member of $domain(f)$ it is a proper subset of $domain(f)$. Hence the image of
-- $w$ by $f$ is a proper subset of $o1 ¥PROD o2$. i.e. there exists some element $b = [c,d]$ in $o1 ¥PROD o2$
-- which does not belong to $range(f ¥ON w)$. Write $[c,d]$ as $[c,d] = cdr(e)$ where $e in f$.
--
	Use_def(range) ==> range(f ¥ON w) = {cdr(x): x in f ¥ON w}
	Use_def(¥ON) ==> range(f ¥ON w) = {cdr(x): x in {p in f | car(p) in w}}
	SIMPLF ==>  range(f ¥ON w) = {cdr(p): p in f | car(p) in w}
	(domain(f),w)-->T12 ==> Ord(w)
	(domain(f),w)-->T34 ==> (w ¥incin domain(f)) & Stat7: (w /= domain(f))
	(f,w)-->T98 ==> (range(f ¥ON w) ¥incin range(f)) & Stat8: (range(f ¥ON w) /= range(f))
	b-->Stat8 ==> (b in range(f)) & (b notin range(f ¥ON w))
	Use_def(range) ==> Stat9: b in {cdr(x): x in f}
	e-->Stat9 ==> Stat10: (e in f) & (b = cdr(e))
	ELEM ==> b in o1 ¥PROD o2
	Use_def(¥PROD) ==> Stat11: b in {[x,y]: x in o1,y in o2}
	(c,d)-->Stat11 ==> Stat12: (c in o1) & (d in o2) & (b = [c,d])
	(o1,c)-->T12 ==> Ord(c)
	(o2,d)-->T12 ==> Ord(d)
	(c,d)-->T30 ==> Stat13: Ord(c + d)
--
-- We shall now show that there can exist no $[c1,d1]$ in $range(f ¥ON w)$ such that $c1$ or $d1$
-- is greater than $c + d$. For otherwise there would be an $x in f$ with $car(x) in w$ such that
-- $cdr(x) = [c1,d1]$ where $c1 + d1$ is greater than $c + d$, and so, since $f$ is an order-preserving
-- map of $domain(f)$ onto $o1 ¥PROD o2$, we would have $car(e) in w$, contradicting  $b notin range(f ¥ON w)$.
--
	Use_def(one_1_map) ==> Svm(f)
	Suppose ==> Stat14: not(FORALL x in f | ((car(x) in w) ¥imp (((c + d) notin car(cdr(x))) & ((c + d) notin cdr(cdr(x))))))
	x-->Stat14(Stat14*) ==> Stat15: (x in f) & (car(x) in w) & ((c + d) in car(cdr(x)) or (c + d) in cdr(cdr(x)))
	e-->T60 ==> car(e) in domain(f)
	x-->T60 ==> car(x) in domain(f)
	(Stat15)ELEM ==> Stat16: (c + d) in car(cdr(x)) + cdr(cdr(x))
	(Stat16,Stat10,Stat12)ELEM ==> car(cdr(e)) + cdr(cdr(e)) in car(cdr(x)) + cdr(cdr(x))
	(f,e)-->T74 ==> cdr(e) = f~[car(e)]
	(f,x)-->T74 ==> cdr(x) = f~[car(x)]
	EQUAL ==> car(f~[car(e)]) + cdr(f~[car(e)]) in car(f~[car(x)]) + cdr(f~[car(x)])
	Suppose ==> car(x) = car(e)
	EQUAL ==> false; Discharge ==> car(x) /= car(e)
	(car(e),car(x))-->Stat4 ==> not(car(x) in car(e))
	(domain(f),car(e))-->T12 ==> Ord(car(e))
	(domain(f),car(x))-->T12 ==> Ord(car(x))
	(car(e),car(x))-->T31 ==> car(e) in car(x)
	(w,car(x))-->T13 ==> car(x) ¥incin w
	ELEM ==> car(e) in w
	Suppose ==> cdr(e) notin range(f ¥ON w)
	ELEM ==> Stat17: cdr(e) notin {cdr(p): p in f | car(p) in w}
	e-->Stat17 ==> false; Discharge ==> cdr(e) in range(f ¥ON w)
	Discharge ==> Stat18: (FORALL x in f | ((car(x) in w) ¥imp (((c + d) notin car(cdr(x))) & ((c + d) notin cdr(cdr(x))))))
--
-- It follows that $range(f ¥ON w)$ is included in $next(c + d) ¥PROD next(c + d)$.
--
	Suppose ==> Stat19: not(range(f ¥ON w) ¥incin (next(c + d) ¥PROD next(c + d)))
	u-->Stat19 ==> (u in range(f ¥ON w)) & (u notin (next(c + d) ¥PROD next(c + d)))
	Use_def(¥PROD) ==> Stat20: u notin {[x,y]: x in next(c + d), y in next(c + d)}
	ELEM ==> Stat21: u in {cdr(p): p in f | car(p) in w}
	p-->Stat21 ==> Stat22: (p in f) & (u = cdr(p)) & (car(p) in w)
	p-->Stat18 ==> Stat23: ((c + d) notin car(cdr(p))) & ((c + d) notin cdr(cdr(p)))
	(p,f)-->T61 ==> Stat24: cdr(p) in range(f)
	(Stat24,Stat3)ELEM ==> cdr(p) in o1 ¥PROD o2
	Use_def(¥PROD) ==> Stat25: cdr(p) in {[x,y]: x in o1,y in o2}
	(c2,d2)-->Stat25 ==> Stat26: (c2 in o1) & (d2 in o2) & (cdr(p) = [c2,d2])
	(Stat23,Stat26)ELEM ==> ((c + d) notin c2) & ((c + d) notin d2)
	(o1,c2)-->T12 ==> Ord(c2)
	(o2,d2)-->T12 ==> Ord(d2)
	(c2,c + d)-->T31 ==> Stat27: c2 in (c + d) or c2 = (c + d)
	(d2,c + d)-->T31 ==> d2 in (c + d) or d2 = (c + d)
	(Stat27)ELEM ==> (c2 in (c + d) + {c + d}) & (d2 in (c + d) + {c + d})
	Use_def(next) ==> Stat28: (c2 in next(c + d)) & (d2 in next(c + d))
	(c2,d2)-->Stat20(Stat28) ==> Stat29: u /= [c2,d2]
	(Stat29,Stat22,Stat26)ELEM ==> false
	Discharge ==>  Stat30: range(f ¥ON w) ¥incin (next(c + d) ¥PROD next(c + d))
	(o1 + o2,o1)-->T189 ==> not Finite(o1 + o2)
	(o1,o2)-->T29 ==> Stat31: (o1 ¥incin o2) or (o2 ¥incin o1)
	(Stat31)ELEM ==> Stat32: o1 + o2 = o1 or o1 + o2 = o2
	(c,d)-->T29 ==> Stat33: (c ¥incin d) or (d ¥incin c)
	(Stat33)ELEM ==> Stat34: c + d = c or c + d = d
	(Stat32,Stat34,Stat12)ELEM ==> Stat35: c + d in o1 + o2
--
-- It is easily seen that $o1 + o2$, which is one of $o1$ and $o2$, must be a cardinal.
--
	Suppose ==> not Card(o1 + o2)
	Suppose ==> o1 + o2 = o1
	EQUAL ==> false; Discharge ==> o1 + o2 = o2
	EQUAL ==> false; Discharge ==> Card(o1 + o2)
	Use_def(Card) ==> Ord(o1 + o2)
	(c + d)-->T32 ==> Ord(next(c + d))
	Suppose ==> next(c + d) notin o1 + o2
--
-- But since $o1$ and $o2$ are cardinals, we have $next(c + d) in o1 + o2$,
-- so that we can take $y = next(c + d)$ as the element
-- whose existence is asserted by our theorem.
--
	(o1 + o2,next(c + d))-->T35 ==> Stat36: next(c + d) incs o1 + o2
	(next(c + d),o1 + o2)-->T189 ==> not Finite(next(c + d))
	(c + d)-->T200 ==> not Finite(c + d)
	Use_def(next) ==> next(c + d) = (c + d) + {c + d}
	EQUAL ==> #next(c + d) = #((c + d) + {c + d})
	(o1 + o2,next(c + d))-->T170(Stat36) ==> Stat37: #next(c + d) incs #(o1 + o2)
	(c + d,c + d)-->T355 ==> #next(c + d) = #(c + d)
	(Stat37)ELEM ==> Stat38: #(c + d) incs #(o1 + o2)
	(c + d,c + d)-->T169(Stat38,Stat13) ==> (c + d) incs #(o1 + o2)
	(o1 + o2)-->T164 ==> Stat39: (c + d) incs (o1 + o2)
	(Stat39,Stat35)Discharge ==> Stat40: next(c + d) in o1 + o2
	(next(c + d))-->Stat6(Stat40,Stat30) ==> false; Discharge ==> QED
--
-- The following theorem, whose proof we have already described, asserts that any infinite set
-- can be divided in half, and is in fact in 1-1 correspondence with $s ¥PROD {0,1}$.
--
Theorem 362: [Cardinal Doubling Theorem] (not Finite(S)) ¥imp (#(S ¥PROD {0,1}) = #S). Proof:
    Suppose_not(s) ==> (not Finite(s)) & (#(s ¥PROD {0,1}) /= #s)
--
-- If we suppose the contrary, then clearly $s$ is an infinite set and $#(s ¥PROD {0,1}) /= #s$.
-- Since $#(s ¥PROD {0,1})$ is obviously at least as large as $#(s ¥PROD {0}) = #s$, $#(s ¥PROD {0,1})$
-- must be larger than $#s$, so that $#s in #(s ¥PROD {0,1})$. I.e. there exists an infinite ordinal
-- such that x is less than  $#(x ¥PROD {0,1})$, and so by the principle of transfinite induction
-- there exists a least such x.
--
    Use_def(¥TIMES) ==> (s ¥TIMES {0,1}) /= #s
    ({0,1},s)-->T253 ==> ({0,1} ¥TIMES s) /= #s
    ({0,1},s)-->T231 ==> ({0,1} ¥TIMES #s) /= #s
    ({0,1},#s)-->T253 ==> (#s ¥TIMES {0,1}) /= #s
    Use_def(¥TIMES) ==> #(#s ¥PROD {0,1}) /= #s
    ELEM ==> ({0,1} /= 0) & ({0,1} = 2)
    T212 ==> {0,1} in Za
    T209 ==> Card(Za)
    Use_def(Card) ==> Ord(Za)
    (Za,{0,1})-->T12 ==> Ord({0,1})
    (0,1)-->T202 ==> Finite({0,1})
    ({0,1})-->T205 ==> Card({0,1})
    ({0,1},#s)-->T359 ==> ##s ¥incin #(#s ¥PROD {0,1})
    s-->T166 ==> (##s ¥incin #(#s ¥PROD {0,1})) & (#(#s ¥PROD {0,1}) /= ##s)
    (#s)-->T156 ==> Ord(##s)
    (#s ¥PROD {0,1})-->T156 ==> Ord(#(#s ¥PROD {0,1}))
    (#(#s ¥PROD {0,1}),##s)-->T34 ==> ##s in #(#s ¥PROD {0,1})
    s-->T193 ==> not Finite(#s)
    s-->T156 ==> Card(#s) & Ord(#s)
    ELEM ==> Ord(#s) & (not Finite(#s)) & (##s in #(#s ¥PROD {0,1}))
	APPLY(mt1_thryvar:x2) transfinite_induction(n ->#s,P(y)->Ord(y) & (not Finite(y)) & (#y in #(y ¥PROD {0,1})))==>
		Stat1: (FORALL k | (Ord(x2) & (not Finite(x2)) & (#x2 in #(x2 ¥PROD {0,1}))) &
			((k in x2) ¥imp (not (Ord(k) & (not Finite(k)) & (#k in #(k ¥PROD {0,1}))))))
--
-- it is easy to see that the minimality of $x2$ implies that $x2 = #x2$, i.e. that the ordinal $x2$ is a cardinal.
--
	a-->Stat1 ==> Stat2: Ord(x2) & (not Finite(x2)) & (#x2 in #(x2 ¥PROD {0,1}))
	x2-->T148 ==> x2 notin #x2
	x2-->T147 ==> Ord(#x2)
	x2-->T193 ==> not Finite(#x2)
	(#x2,x2)-->T35 ==> x2 incs #x2
	Suppose ==> x2 /= #x2
	(x2,#x2)-->T34 ==> #x2 in x2
	#x2-->Stat1 ==> ##x2 notin #(#x2 ¥PROD {0,1})
	x2-->T166 ==> ##x2 = #x2
	(x2,{0,1})-->T234 ==> false; Discharge ==> Stat3: x2 = #x2
	x2-->T156 ==> Card(#x2)
	EQUAL ==> Card(x2)
	({0,1},x2)-->T189 ==> not(x2 ¥incin {0,1})
	({0,1},x2)-->T29 ==> x2 incs {0,1}
	ELEM ==> Stat4: x2 = x2 + {0,1}
	EQUAL ==> not Finite(x2 + {0,1})
--
-- Since $x2$ and ${0,1}$ are both cardinals, we can apply Theorem 361 to put $x2 ¥PROD {0,1}$ into a 1-1 monotone
-- correspondence $f$ with some ordinal $o = domain(f)$.
--
	(x2,{0,1})-->T361 ==>
		Stat5: (EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (x2 ¥PROD {0,1})) &
		(FORALL x in domain(f) | (EXISTS y in (x2 + {0,1}) | range(f ¥ON x) ¥incin (y ¥PROD y))))
	f-->Stat5 ==> Stat6: one_1_map(f) & Ord(domain(f)) & (range(f) = (x2 ¥PROD {0,1})) &
			Stat7: (FORALL x in domain(f) | (EXISTS y in (x2 + {0,1}) | range(f ¥ON x) ¥incin (y ¥PROD y)))
	(f,x2)-->T80 ==> Stat8: range(f ¥ON x2) ¥incin (x2 ¥PROD {0,1})
--
-- Our next aim is to show that $#domain(f)$ is no more than $x2$. This will follow
-- from the fact that for each $x$ in $domain(f)$, $#x$ is less than $x2$.
--
	Suppose ==> not(#domain(f) ¥incin x2)
	(domain(f))-->T156 ==> Ord(#domain(f))
	(#domain(f),x2)-->T35 ==> Stat9: x2 in #domain(f)
	(domain(f),domain(f))-->T169(Stat6,Stat9*) ==> x2 in domain(f)
	x2-->Stat7 ==> Stat10: (EXISTS y in (x2 + {0,1}) | range(f ¥ON x2) ¥incin (y ¥PROD y))
	y-->Stat10(Stat4,Stat10) ==> Stat11: (y in x2) & (range(f ¥ON x2) ¥incin (y ¥PROD y))
	(Stat11,Stat8)ELEM ==> range(f ¥ON x2) ¥incin ((y ¥PROD y) * (x2 ¥PROD {0,1}))
	(y,y,x2,{0,1})-->T257 ==> Stat12: range(f ¥ON x2) ¥incin ((y * x2) ¥PROD (y * {0,1}))
	(y * x2,y,y * {0,1},{0,1})-->T256(Stat12) ==> range(f ¥ON x2) ¥incin (y ¥PROD {0,1})
	(x2,y)-->T12 ==> Stat13: Ord(y)
	(domain(f),x2)-->T13 ==> x2 ¥incin domain(f)
	(f,x2)-->T94 ==> domain(f ¥ON x2) = x2
	EQUAL ==> not Finite(domain(f ¥ON x2))
	(f,x2)-->T58 ==> one_1_map(f ¥ON x2)
	(f ¥ON x2)-->T191 ==> not Finite(range(f ¥ON x2))
	(y ¥PROD {0,1},range(f ¥ON x2))-->T189 ==> not Finite(y ¥PROD {0,1})
	(y,{0,1})-->T262 ==> not Finite(y)
	y-->Stat1 ==> #y notin #(y ¥PROD {0,1})
	y-->T156 ==> Ord(#y)
	(y ¥PROD {0,1})-->T156 ==> Ord(#(y ¥PROD {0,1}))
	(#(y ¥PROD {0,1}),#y)-->T35 ==> #(y ¥PROD {0,1}) ¥incin #y
	({0,1},y)-->T250 ==> #y = #(y ¥PROD {0,1})
	(range(f ¥ON x2),y ¥PROD {0,1})-->T170 ==> #range(f ¥ON x2) ¥incin #y
	(f ¥ON x2)-->T157 ==> #domain(f ¥ON x2) ¥incin #y
--
-- And now we have a contradiction with the fact that $y in x2$, thereby proving our theorem.
--
	EQUAL ==> Stat14: x2 ¥incin #y
	(y,y)-->T169(Stat13,Stat14*) ==> x2 ¥incin y
	Discharge ==> #domain(f) ¥incin x2
	f-->T157 ==> #domain(f) = #range(f)
	EQUAL ==> #(x2 ¥PROD {0,1}) ¥incin x2
	Discharge ==> QED
--
-- Our next theorem states that if one of the two sets $s$, $t$ in a union is infinite, the
-- the cardinal sum of the two sets is the union (i.e. maximum) m of the cardinalities $#s$, $#t$.
--
Theorem 363: [The sum of two infinite quantities is their maximum] (not Finite(S)) ¥imp ((S ¥PLUS T) = #S + #T). Proof:
Suppose_not(s,t) ==> (not Finite(s)) & ((s ¥PLUS t) /= #s + #t)
--
-- For let $s$, $t$ be a counterexample to our assertion, so that either $s ¥PLUS t$ or $#(s + t)$
-- differs from the larger of $#s$ and $#t$.
-- One of the two cardinals $#s$, $#t$ must be a subset of the other. If $#s$ is a subset of $#t$,
-- then both these cardinals are infinite, and the maximum $#s + #t$ is $#t$, so $#s ¥PLUS #t /= #t$.
-- Plainly $#s ¥PLUS #t$ is no less than $0 ¥PLUS #t = #t$, so $#s ¥PLUS #t$ must be greater than $#t$.
--
	(s,t)-->T221 ==> (#s ¥PLUS #t) /= #s + #t
	s-->T156 ==> Ord(#s) & Card(#s)
	t-->T156 ==> Ord(#t) & Card(#t)
	(#s,#t)-->T29 ==> (#s ¥incin #t) or (#t ¥incin #s)
	Suppose ==> #s ¥incin #t
	ELEM ==> ((#s ¥PLUS #t) /= #t)
	(#t,#s)-->T189 ==> not Finite(#t)
	(#t,#s)-->T291 ==> #t ¥incin (#s ¥PLUS #t)
--
-- But by monotonicity $#s ¥PLUS #t$ is no greater than $#t ¥PLUS #t$, which by Theorem 362 is $#t$.
-- This contradiction rules out the possibility that $#t incs #s$.
-- Thus it follows that $#s$ must be the larger of $#t$ and $#s$.
--
	Set_monot ==> {[x,0]: x in #s} ¥incin {[x,0]: x in #t}
	ELEM ==> ({[x,0]: x in #s} + {[x,1]: x in #t}) ¥incin ({[x,0]: x in #t} + {[x,1]: x in #t})
	ELEM ==> ({0} + {1}) = {0,1}
	Set_monot ==> {[x,y]: x in #t, y in {0}} + {[x,y]: x in #t, y in {1}} = {[x,y]: x in #t, y in ({0} + {1})}
	SIMPLF ==> {[x,y]: x in #t, y in {0}} + {[x,y]: x in #t, y in {1}} = {[x,0]: x in #t} + {[x,1]: x in #t}
	EQUAL ==> {[x,0]: x in #t} + {[x,1]: x in #t} = {[x,y]: x in #t, y in {0,1}}
	Use_def(¥PROD) ==> ({[x,0]: x in #s} + {[x,1]: x in #t}) ¥incin (#t ¥PROD {0,1})
	({[x,0]: x in #s} + {[x,1]: x in #t},#t ¥PROD {0,1})-->T170 ==>
		#({[x,0]: x in #s} + {[x,1]: x in #t}) ¥incin #(#t ¥PROD {0,1})
	Use_def(¥PLUS) ==> (#s ¥PLUS #t) ¥incin #(#t ¥PROD {0,1})
	#t-->T362 ==> (#s ¥PLUS #t) ¥incin ##t
	#t-->T164 ==> (#s ¥PLUS #t) ¥incin #t
	Discharge ==> (#t ¥incin #s) & ((#s ¥PLUS #t) /= #s)
--
-- Arguing in the same way once more, it follows that $#s ¥PLUS #t$ must be $#s$,
-- and hence must be the maximum $#s + #t$ in this case also. Thus our theorem is verified in all cases.
--
	Set_monot ==> {[x,1]: x in #t} ¥incin {[x,1]: x in #s}
	ELEM ==> ({[x,0]: x in #s} + {[x,1]: x in #t}) ¥incin ({[x,0]: x in #s} + {[x,1]: x in #s})
	ELEM ==> ({0} + {1}) = {0,1}
	Set_monot ==> {[x,y]: x in #s, y in {0}} + {[x,y]: x in #s, y in {1}} = {[x,y]: x in #s, y in ({0} + {1})}
	SIMPLF ==> {[x,y]: x in #s, y in {0}} + {[x,y]: x in #s, y in {1}} = {[x,0]: x in #s} + {[x,1]: x in #s}
	EQUAL ==> {[x,0]: x in #s} + {[x,1]: x in #s} = {[x,y]: x in #s, y in {0,1}}
	Use_def(¥PROD) ==> ({[x,0]: x in #s} + {[x,1]: x in #t}) ¥incin (#s ¥PROD {0,1})
	({[x,0]: x in #s} + {[x,1]: x in #t},#s ¥PROD {0,1})-->T170 ==>
		#({[x,0]: x in #s} + {[x,1]: x in #t}) ¥incin #(#s ¥PROD {0,1})
	Use_def(¥PLUS) ==> (#s ¥PLUS #t) ¥incin #(#s ¥PROD {0,1})
	#s-->T362 ==> (#s ¥PLUS #t) ¥incin ##s
	#t-->T164 ==> (#s ¥PLUS #t) ¥incin #s
--
-- The possibility that $(s ¥PLUS t) /= #s + #t$ now having been ruled out,
-- it follows that $#(s + t) /= #s + #t$. However, Theorem 222 tells us that $#(s + t) = #s ¥PLUS #(t - s)$.
-- Since $(s ¥PLUS t) = (#s ¥PLUS #t)$ = $#s + #t$ also by Theorem 221,
--
(#s,#t)-->T291 ==> #s ¥incin (#s ¥PLUS #t); Discharge ==> QED
--
-- We can also prove that if one of the two sets $s$, $t$ in a union is infinite, the
-- cardinality of $s + t$ is the union (i.e. maximum) of the cardinalities $#s, #t$.
--
Theorem 364: [The cardinality of the union of two infinite quantities is the cardinality of the larger] (not Finite(S)) ¥imp (#(S + T) = #S + #T). Proof:
	Suppose_not(s,t) ==> (not Finite(s)) & (#(s + t) /= #s + #t)
--
-- For one of the two ordinals $#s$, $#t$ must be included in the other.
-- If $#t$ is included in $#s$, we would have $#(s + t) /= #s$ and so
-- $#s in #(s + t)$, contradicting the fact that $#(s + t)$ can be no larger than $#(s ¥PLUS s) = #s$
-- by the preceding results.
--
	t-->T156 ==> Ord(#t)
	s-->T156 ==> Ord(#s)
    (#s,#t)-->T29 ==> (#s ¥incin #t) or (#t ¥incin #s)
    s-->T193 ==> not Finite(#s)
    Suppose ==> #t ¥incin #s
    ELEM ==> #(s + t) /= #s
    (t - s,t)-->T170 ==> #(t - s) ¥incin #s
    (s,t - s)-->T222 ==> #(s + (t - s)) = #s ¥PLUS #(t - s)
    ELEM ==> s + (t - s) = s + t
    EQUAL ==> #(s + t) = #s ¥PLUS #(t - s)
    (#s,#(t - s))-->T363 ==> #(s + t) = ##s + ##(t - s)
    s-->T166 ==> #(s + t) = #s + ##(t - s)
   	(t - s)-->T166 ==> #(s + t) = #s
    Discharge ==> #s ¥incin #t
--
-- But by symmetry we can we argue in exactly the same way with $s$ and $t$ reversed,
-- excluding this case also and so proving our theorem.
--
    (#t,#s)-->T189 ==> not Finite(#t)
    ELEM ==> #(s + t) /= #t
    (s - t,s)-->T170 ==> #(s - t) ¥incin #t
    (t,s - t)-->T222 ==> #(t + (s - t)) = #t ¥PLUS #(s - t)
    ELEM ==> t + (s - t) = s + t
    EQUAL ==> #(s + t) = #t ¥PLUS #(s - t)
    (#t,#(s - t))-->T363 ==> #(s + t) = ##t + ##(s - t)
    t-->T166 ==> #(s + t) = #t + ##(s - t)
   	(s - t)-->T166 ==> #(s + t) = #t
    Discharge ==> QED
--
-- We are now ready to prove the Cardinal Square Theorem, but again
-- give an informal outline of its proof before entering upon its formal details.
-- The theorem asserts that for every infinite set s, $#s = #(s ¥PROD s)$. If this is false,
-- then $#s /= #(s ¥PROD s)$ = $(s ¥TIMES s) = (#s ¥TIMES #s)$ = $#(#s ¥PROD #s)$,
-- so our assertion is also false for the infinite cardinal $#s$, and hence for some infinite ordinal.
-- It follows by the axiom of choice that our assertion is also false for some smallest infinite ordinal $s1$.
-- s1 must be a cardinal, since otherwise $#s1 in s1$, but also $s1 in #(s1 ¥PROD s1)$ = $#(#s1 ¥PROD #s1)$,
-- so we would have $#s1 in #(#s1 ¥PROD #s1)$ also, contradicting the minimality of s1.
--
-- Order $s1 ¥PROD s1$ by the product ordering described above. The theory we have just established
-- tells us that this is a well-ordering, so that by our previous theory of well-orderings
-- there exists a 1-1 map $f$ from some ordinal $o$ onto $s1 ¥PROD s1$ which is monotone increasing if $o$
-- is given its standard ordering and $s1 ¥PROD s1$ is given its product ordering.
--
-- If $o1$ is a finite  member of the ordinal $o$, then obviously $#o1$ is a member of the infinite cardinal $s1$.
-- If $o1$ is an infinite  member of the ordinal $o$, then it is a proper subset of $o$;
-- so $range(f ¥ON o1)$ is a proper subset $t$ of $s1 ¥PROD s1$.
-- As in the proof of Theorem 362 we show that there exists an $n$ in $s1$ such that
-- $range(f ¥ON o1)$ is a subset of $n ¥PROD n$, and so it follows
-- from the minimality of $s1$ that $#t ¥incin #(n ¥PROD n)$ = $n in s1$. Hence $#o1$ is a member of $s1$
-- for each $o1 in o$, proving that $#o ¥incin s1$ in this case also. Since $o$ is in 1-1 correspondence with
-- $s1 ¥PROD s1$ it follows that $#(s1 ¥PROD s1) ¥incin s1$, contrary to our assumption.
-- This contradiction proves our desired theorem.
--
Theorem 365: [Cardinal Square Theorem] (not Finite(S)) ¥imp (#(S ¥PROD S) = #S). Proof:
    Suppose_not(s) ==> (not Finite(s)) & (#(s ¥PROD s) /= #s)
--
-- If we suppose the contrary, then clearly $s$ is an infinite set and $#(s ¥PROD s) /= #s$.
-- Since $#(s ¥PROD s)$ is obviously at least as large as $#(s ¥PROD {0}) = #s$, $#(s ¥PROD s)$
-- must be larger than $#s$, so that $#s in #(s ¥PROD s)$. I.e. there exists an infinite ordinal
-- such that $x$ is less than  $#(x ¥PROD x)$, and so by the principle of transfinite induction
-- there exists a least such $x$.
--
    Use_def(¥TIMES) ==> (s ¥TIMES s) /= #s
    (s,s)-->T230 ==> (#s ¥TIMES #s) /= #s
    Use_def(¥TIMES) ==> #(#s ¥PROD #s) /= #s
    T188 ==> Finite(0)
    Suppose ==> s = 0
    EQUAL ==> false; Discharge ==> s /= 0
    s-->T162 ==> #s /= 0
    (#s,#s)-->T359 ==> #s ¥incin #(#s ¥PROD #s)
    (#s)-->T156 ==> Ord(#s)
    (#s ¥PROD #s)-->T156 ==> Ord(#(#s ¥PROD #s))
    (#(#s ¥PROD #s),#s)-->T34 ==> #s in #(#s ¥PROD #s)
    s-->T193 ==> not Finite(#s)
    s-->T156 ==> Card(#s) & Ord(#s)
	APPLY(mt1_thryvar:x2) transfinite_induction(n ->#s,P(y)->Ord(y) & (not Finite(y)) & (#y in #(y ¥PROD y)))==>
		Stat1: (FORALL k | (Ord(x2) & (not Finite(x2)) & (#x2 in #(x2 ¥PROD x2))) &
		 ((k in x2) ¥imp (not (Ord(k) & (not Finite(k)) & (#k in #(k ¥PROD k))))))
	a-->Stat1 ==> Stat2: Ord(x2) & (not Finite(x2)) & (#x2 in #(x2 ¥PROD x2))
--
-- it is easy to see that the minimality of $x2$ implies that $x2 = #x2$, i.e. that the ordinal $x2$ is a cardinal.
--
	x2-->T148 ==> x2 notin #x2
	x2-->T147 ==> Ord(#x2)
	x2-->T193 ==> not Finite(#x2)
	(#x2,x2)-->T35 ==> x2 incs #x2
	Suppose ==> x2 /= #x2
	(x2,#x2)-->T34 ==> #x2 in x2
	(#x2)-->Stat1 ==> ##x2 notin #(#x2 ¥PROD #x2)
	x2-->T166 ==> ##x2 = #x2
	(x2,x2)-->T232 ==> false; Discharge ==> Stat3: x2 = #x2
	(x2)-->T156 ==> Card(#x2)
	EQUAL ==> Card(x2)
	TELEM ==> x2 = x2 + x2
	EQUAL ==> not Finite(x2 + x2)
--
-- Since $x2$ is a cardinal, we can apply Theorem 361 to put $x2 ¥PROD x2$ into a 1-1 monotone
-- correspondence $f$ with some ordinal $o = domain(f)$.
--
	(x2,x2)-->T361 ==>
		Stat4: (EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (x2 ¥PROD x2)) &
		(FORALL x in domain(f) | (EXISTS y in (x2 + x2) | range(f ¥ON x) ¥incin (y ¥PROD y))))
	f-->Stat4() ==> Stat5: one_1_map(f) & Ord(domain(f)) & (range(f) = (x2 ¥PROD x2)) &
			Stat6: (FORALL x in domain(f) | (EXISTS y in (x2 + x2) | range(f ¥ON x) ¥incin (y ¥PROD y)))
	(f,x2)-->T80 ==> Stat7: range(f ¥ON x2) ¥incin (x2 ¥PROD x2)
--
-- Our next aim is to show that $#domain(f)$ is no more than $x2$. This will follow
-- from the fact that for each $x$ in $domain(f)$, $#x$ is less than $x2$.
--
	Suppose ==> not(#domain(f) ¥incin x2)
	(domain(f))-->T156() ==> Ord(#domain(f))
	(#domain(f),x2)-->T35 ==> x2 in #domain(f)
	(domain(f),domain(f))-->T169(Stat2) ==> Stat8: x2 in domain(f)
	x2-->Stat6(Stat8) ==> Stat9: (EXISTS y in (x2 + x2) | range(f ¥ON x2) ¥incin (y ¥PROD y))
	y-->Stat9(Stat9) ==> Stat10: (y in x2) & (range(f ¥ON x2) ¥incin (y ¥PROD y))
	(Stat10,Stat7*)ELEM ==> Stat11: range(f ¥ON x2) ¥incin ((y ¥PROD y) * (x2 ¥PROD x2))
	(y,y,x2,x2)-->T257(Stat11) ==> range(f ¥ON x2) ¥incin ((y * x2) ¥PROD (y * x2))
	(y * x2,y,y * x2,x2)-->T256 ==> range(f ¥ON x2) ¥incin (y ¥PROD y)
	(x2,y)-->T12 ==> Stat12: Ord(y)
	(domain(f),x2)-->T13 ==> x2 ¥incin domain(f)
	(f,x2)-->T94 ==> domain(f ¥ON x2) = x2
	EQUAL ==> not Finite(domain(f ¥ON x2))
	(f,x2)-->T58 ==> one_1_map(f ¥ON x2)
	(f ¥ON x2)-->T191 ==> not Finite(range(f ¥ON x2))
	(y ¥PROD y,range(f ¥ON x2))-->T189 ==> not Finite(y ¥PROD y)
	(y,y)-->T262 ==> not Finite(y)
	Suppose ==> y = 0
	EQUAL ==> not Finite(0)
	T188 ==> false; Discharge ==> y /= 0
	y-->Stat1 ==> #y notin #(y ¥PROD y)
	y-->T156 ==> Ord(#y)
	(y ¥PROD y)-->T156 ==> Ord(#(y ¥PROD y))
	(#(y ¥PROD y),#y)-->T35 ==> #(y ¥PROD y) ¥incin #y
	(y,y)-->T250 ==> #y = #(y ¥PROD y)
	(range(f ¥ON x2),y ¥PROD y)-->T170 ==> #range(f ¥ON x2) ¥incin #y
	(f ¥ON x2)-->T157 ==> #domain(f ¥ON x2) ¥incin #y
--
-- And now we have a contradiction with the fact that $y in x2$, thereby proving our theorem.
--
	EQUAL ==> Stat13: x2 ¥incin #y
	(y,y)-->T169(Stat12,Stat13*) ==> x2 ¥incin y
	Discharge ==> #domain(f) ¥incin x2
	f-->T157 ==> #domain(f) = #range(f)
	EQUAL ==> #(x2 ¥PROD x2) ¥incin x2
	Discharge ==> QED
--
-- ************************************************************************************************
--							Section 9: The signed integers
-- ************************************************************************************************
--
-- After the preceding digression to prove the Cardinal Product theorem, we now return to our main task:
-- developing the standard foundations of analysis. Our first step is to define signed integers
-- and prove their properties. Signed integers and the arithmetic operations on them are defined as follows.
-- Note that we choose to define a signed integer as a pair $[x,y]$ of ordinary integers,
-- one or both of which is always zero. The idea is that $[x,0]$ represents the positive integer $x$, while
-- $[0,x]$ represents the negative integer $-x$.
--
Def 26: [The signed Integers] Si := {[x,y]: x in Za, y in Za | x = 0 or y = 0}
Def 27: [Signed Integer Reduction to Normal Form]
    Red(P) := [car(P) ¥MINUS (car(P) * cdr(P)),cdr(P) ¥MINUS (car(P) * cdr(P))]
Def 28: [Signed addition]
    Def(MM ¥S_PLUS NN) := Red([car(MM) ¥PLUS car(NN),cdr(MM) ¥PLUS cdr(NN)])
Def 28a: [Absolute value of a signed integer] S_ABS(M) := [car(M) + cdr(M),0]
Def 28b: [Negative of a signed integer] S_Rev(M) := [cdr(M),car(M)]
Def 29: [Signed Product] Def(MM ¥S_TIMES NN) :=
	Red([(car(MM) ¥TIMES car(NN)) ¥PLUS (cdr(MM) ¥TIMES cdr(NN)),(car(MM) ¥TIMES cdr(NN)) ¥PLUS (car(NN) ¥TIMES cdr(MM))])
Def 32: [Signed Difference] Def(N ¥S_MINUS M) := Red([cdr(M) ¥PLUS car(N),car(M) ¥PLUS cdr(N)])
Def 33: [Sign of a signed integer] is_nonneg(x) := car(x) incs cdr(x)
--
-- Our first result concerning the small family of operations just introduced is that
-- the reduction $Red([m,n])$ of any pair of positive integers is a signed integer, and that
-- $m * n$ is always $0$.
--
Theorem 366: [Reduced form of an integer pair] ((M in Za) & (N in Za)) ¥imp ((Red([M,N]) in Si) & (M * N in Za)). Proof:
    Suppose_not(m,n) ==> (m in Za) & (n in Za) & (Red([m,n]) notin Si or (m * n notin Za))
--
-- For suppose that there is a counterexample $m$, $n$ to our assertion. $m$ and $n$
-- are plainly finite ordinals, and so their intersection is also a finite ordinal
-- and therefore an integer. Hence the differences $m ¥MINUS (m * n)$ and $n ¥MINUS (m * n)$
-- are integers also.
--
	m-->T206 ==> Card(m) & Finite(m)
	n-->T206 ==> Card(n) & Finite(n)
    Use_def(Card) ==> Ord(m) & Ord(n)
    (m,n)-->T28 ==> Ord(m * n)
    (m,m * n)-->T189 ==> Finite(m * n)
    (m * n)-->T205 ==> Card(m * n)
    (m * n)-->T206 ==> m * n in Za
    (m,m * n)-->T283 ==> (m ¥MINUS (m * n)) in Za
    (n,m * n)-->T283 ==> (n ¥MINUS (m * n)) in Za
--
-- Since we have seen that $m * n$ is an integer, only the second conclusion of our theorem
-- can fail. But one of $m$ and $n$ must be no larger than the other, and if, e.g. this is $m$ we have
-- $m * n = m$ and so $Red([m,n]) = m ¥MINUS m$ by definition, implying $Red([m,n]) = 0$ and so
-- proving that $Red([m,n]) in Si$. The proof in case $n$ is no larger than $m$ is equally trivial.
--
    (m,n)-->T29 ==> (m ¥incin n) or (n ¥incin m)
    ELEM ==> (m * n = m or m * n = n) & (Red([m,n]) notin Si)
    Use_def(Red) ==> [m ¥MINUS (m * n),n ¥MINUS (m * n)] notin Si
    Use_def(Si) ==> Stat1: [m ¥MINUS (m * n),n ¥MINUS (m * n)] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
    (m ¥MINUS (m * n),n ¥MINUS (m * n))-->Stat1 ==> (m ¥MINUS (m * n) /= 0) & (n ¥MINUS (m * n) /= 0)
    Suppose ==> m * n = m
    EQUAL ==> (m ¥MINUS m) /= 0
    m-->T267 ==> false; Discharge ==> m * n = n
    EQUAL ==> (n ¥MINUS n) /= 0
    n-->T267 ==> false; Discharge ==> QED
--
-- Next we note an entirely trivial consequence of our definition of signed integers: if $n$ is
-- and unsigned integer, then $[n,0]$ (the signed version of $n$) and $[0,n]$ (corresponding to $n$)
-- are signed integers.
--
Theorem 367: [Embedding of integers in the signed integers] (N in Za) ¥imp (([N,0] in Si) & ([0,N] in Si)). Proof:
	Suppose_not(n) ==> (n in Za) & (([n,0] notin Si) or ([0,n] notin Si))
	T211 ==> 0 in Za
	Use_def(Si) ==> Si = {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	Suppose ==> Stat1: [n,0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(n,0)-->Stat1 ==> false; Discharge ==> Stat2: [0,n] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(0,n)-->Stat2 ==> false; Discharge ==> QED
--
-- It is also trivial that $[0,0]$ (the signed $0$), $[0,1]$ (the signed $1$), and  $[0,1]$ (corresponding to $-1$)
-- are all signed integers.
--
Theorem 368: [Basic properties of the signed integers 0,1, and -1] ([0,0] in Si) & ([1,0] in Si) & ([0,1] in Si) & ([1,0] /= [0,0]) & ([0,1] /= [0,0]) & ([1,0] /= [0,1]). Proof:
	Suppose_not ==> not(([0,0] in Si) & ([1,0] in Si) & ([0,1] in Si) & ([1,0] /= [0,0]) & ([0,1] /= [0,0]) & ([1,0] /= [0,1]))
    T212 ==> not(([0,0] in Si) & ([1,0] in Si) & ([0,1] in Si))
	T211 ==> (0 in Za) & (1 in Za)
	1-->T367 ==> [0,0] notin Si
	0-->T367 ==> false; Discharge ==> QED
--
-- Next we note various elementary facts concerning signed integers: they are always pairs of unsigned integers,
-- one of which is zero; signed integers are invariant under the reduction operator $Red$;
-- and the minimum  of the two components of a signed integer is always $0$.
--
Theorem 369: [The signed integers as integer pairs with one component equal to 0] (N in Si) ¥imp ((N = [car(N),cdr(N)]) & (car(N) = 0 or cdr(N) = 0) & (car(N) in Za) & (cdr(N) in Za) &
			(Red(N) = N) & (car(N) * cdr(N) = 0)). Proof:
    Suppose_not(n) ==>
	Stat1: (n in Si) & ((n /= [car(n),cdr(n)]) or ((car(n) /= 0) & (cdr(n) /= 0)) or (car(n) notin Za) or (cdr(n) notin Za) or
					(Red(n) /= n) or (car(n) * cdr(n) /= 0))
--
-- Since $n$ is a signed integer, it has the form$ n = [i,j]$ where either $i$ or $j$ is $0$. Hence
-- our assertion can only be false if $Red(n) /= n$. But by definition $Red(n) = [i ¥MINUS (i * j),j ¥MINUS (i * j)]$,
-- so our assertion follows immediately from Theorem 207 and Theorem 268.
--
    Use_def(Si) ==> Stat2: n in {[x,y]: x in Za, y in Za | x = 0 or y = 0}
    (i,j)-->Stat2 ==> Stat3: (n = [i,j]) & (i in Za) & (j in Za) & (i = 0 or j = 0)
    ELEM ==> Stat4: i * j = 0
    (Stat3)ELEM ==> Stat5: ((car(n) = 0) or (cdr(n) = 0)) & (car(n) in Za) & (cdr(n) in Za) &
					(car(n) * cdr(n) = 0)
    (Stat3,Stat4)ELEM ==> Stat6: n = [car(n),cdr(n)]
    (Stat1,Stat5,Stat6*)ELEM ==> Stat7: Red(n) /= n
    Use_def(Red) ==> Stat8: Red([i,j]) = [i ¥MINUS (i * j),j ¥MINUS (i * j)]
    EQUAL ==> Red([i,j]) = Red(n)
    EQUAL ==> i ¥MINUS (i * j) = i ¥MINUS 0
    EQUAL ==> j ¥MINUS (i * j) = j ¥MINUS 0
    i-->T268 ==> i ¥MINUS 0 = #i
    j-->T268 ==> j ¥MINUS 0 = #j
    (Stat8)ELEM ==> Stat9: Red(n) = [#i,#j]
    i-->T207 ==> i = #i
    j-->T207 ==> j = #j
    (Stat9)ELEM ==> Stat10: Red(n) = [i,j]
    (Stat3,Stat7,Stat10*)Discharge ==> QED
--
-- The following variant form of the preceding theorem is often a bit more useful.
--
Theorem 370: [Signed integers as integer pairs, 2] (N in Si) ¥imp ((N = [car(N),0] or N = [0,cdr(N)]) & (car(N) = 0 or cdr(N) = 0) &
				(car(N) in Za) & (cdr(N) in Za) & (Red(N) = N) & (car(N) * cdr(N) = 0)). Proof:
    Suppose_not(n) ==>
	Stat1: (n in Si) & (not((n = [car(n),0] or n = [0,cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za) &
					(Red(n) = n) & (car(n) * cdr(n) = 0)))
	n-->T369 ==> (n = [car(n),cdr(n)]) & (not(n = [car(n),0] or n = [0,cdr(n)])) & (car(n) = 0 or cdr(n) = 0)
    Suppose ==> car(n) = 0
    Discharge ==> cdr(n) = 0
    Discharge ==> QED
--
-- The following theorem states that the set of signed integers is closed under addition and multiplication.
--
Theorem 371: ((N in Si) & (M in Si)) ¥imp ((N ¥S_PLUS M in Si) & (N ¥S_TIMES M in Si)). Proof:
--
-- The proof is elementary. We just use the definitions of the operators involved and the information
-- concerning the form of signed integers provided by Theorem 369.
--
	Suppose_not(n,m) ==> (n in Si) & (m in Si) & (not((n ¥S_PLUS m in Si) & (n ¥S_TIMES m in Si)))
     n-->T369 ==> (car(n) in Za) & (cdr(n) in Za)
    m-->T369 ==> (car(m) in Za) & (cdr(m) in Za)
    Use_def(¥S_PLUS) ==> n ¥S_PLUS m = Red([car(n) ¥PLUS car(m),cdr(n) ¥PLUS cdr(m)])
	ALGEBRA ==> (car(n) ¥PLUS car(m) in Za) & (cdr(n) ¥PLUS cdr(m) in Za)
	(car(n) ¥PLUS car(m),cdr(n) ¥PLUS cdr(m))-->T366 ==> n ¥S_PLUS m in Si
    Use_def(¥S_TIMES) ==> n ¥S_TIMES m =
	Red([(car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m)),(car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n))])
    ALGEBRA ==> ((car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m)) in Za) &
	((car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n)) in Za)
    ((car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m)),(car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n)))-->T366 ==> false; Discharge ==> QED
--
-- Our next theorem asserts that the negative $S_Rev(n)$ of a signed integer, and the difference
-- $n ¥S_MINUS m$ of two signed integers, are always signed integers.
--
Theorem 372: [Sign reversal and subtraction for signed integers] ((N in Si) & (M in Si)) ¥imp ((S_Rev(M) in Si) & (N ¥S_MINUS M in Si)). Proof:
 	Suppose_not(n,m) ==> (n in Si) & (m in Si) & (not((S_Rev(m) in Si) & (n ¥S_MINUS m in Si)))
--
-- For a signed integer $n$ is simply a pair $[a,b]$ of ordinary integers one of which is zero,
-- so plainly its reverse $[b,a]$ has the same property.
--
 	n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
	m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
	Use_def(S_Rev) ==> S_Rev(m) = [cdr(m),car(m)]
	ELEM ==> (car([cdr(m),car(m)]) = cdr(m)) & (cdr([cdr(m),car(m)]) = car(m))
	EQUAL ==> (car(S_Rev(m)) = cdr(m)) & (cdr(S_Rev(m)) = car(m))
	Suppose ==> S_Rev(m) notin Si
	Use_def(Si) ==> Stat1: S_Rev(m) notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(cdr(m), car(m))-->Stat1 ==> false; Discharge ==> S_Rev(m) in Si
	ELEM ==> (n ¥S_MINUS m) notin Si
--
-- Moreover the difference of two signed integers is by definition the reduction of a
-- pair of unsigned integers, and so is a signed integer by definition.
--
	Use_def(¥S_MINUS) ==> Red([cdr(m) ¥PLUS car(n),car(m) ¥PLUS cdr(n)]) notin Si
	ALGEBRA ==> ((cdr(m) ¥PLUS car(n)) in Za) & ((car(m) ¥PLUS cdr(n)) in Za)
	(cdr(m) ¥PLUS car(n),car(m) ¥PLUS cdr(n))-->T366 ==> false; Discharge ==> QED
--
-- Our next lemma states the elementary fact that any pair $[n,n]$ of unsigned integers
-- reduces to the pair [0,0].
--
Theorem 373: [Reduction of an integer pair $(n,n)$ always gives the signed 0 value] (N in Za) ¥imp (Red([N,N]) = [0,0]). Proof:
	Suppose_not(n) ==> (n in Za) & (Red([n,n]) /= [0,0])
    Use_def(Red) ==> Red([n,n]) = [n ¥MINUS (n * n),n ¥MINUS (n * n)]
    ELEM ==> n * n = n
    EQUAL ==> Red([n,n]) = [n ¥MINUS n,n ¥MINUS n]
    n-->T267 ==> false; Discharge ==> QED
--
-- The following theorem, which generalizes the Lemma just noted, states that the value to which
-- any pair $[j,k]$ of integers reduces is unchanged if a common integer $m$ is added to both $i$ and $j$.
--
Theorem 374: [Reduction removes any common value added to the components of an integer pair] ((J in Za) & (K in Za) & (M in Za)) ¥imp (Red([J ¥PLUS M,K ¥PLUS M]) = Red([J,K])). Proof+:
Suppose_not(j,k,m) ==> AUTO
--
-- Suppose that $j,k,m$ form a counterexample to our theorem. Of the two integers $j$, $k$ one is smaller.
-- Suppose for the moment that this is $j$, so that $j$ is a subset of $k$.
-- It follows that $j * k = j$, so by definition of the reduction operator, $Red([j,k]) = [0,k ¥MINUS j]$.
--
    Use_def(Red) ==> Red([j ¥PLUS m,k ¥PLUS m]) =
	[(j ¥PLUS m) ¥MINUS ((j ¥PLUS m) * (k ¥PLUS m)),
	(k ¥PLUS m) ¥MINUS ((j ¥PLUS m) * (k ¥PLUS m))]
    Use_def(Red) ==> Red([j,k]) = [j ¥MINUS (j * k),k ¥MINUS (j * k)]
    (j,k)-->T29 ==> (j ¥incin k) or (k ¥incin j)
    Suppose ==> j ¥incin k
    ELEM ==> j * k = j
    EQUAL ==> Stat1: Red([j,k]) = [j ¥MINUS j,k ¥MINUS j]
    j-->T267(Stat1) ==> Red([j,k]) = [0,k ¥MINUS j]
--
-- By the monotonicity of addition, $j ¥PLUS m$ is no greater than $k ¥PLUS m$,
-- so it follows by the same argument as above that $Red([j ¥PLUS m,k ¥PLUS m]) = [0,(k ¥PLUS m) ¥MINUS (j ¥PLUS m)]$.
-- Using Theorem 267 we now see that $Red([j ¥PLUS m,k ¥PLUS m]) = Red([j,k])$,
-- a contradiction which excludes the possibility that $j$ is less than $k$.
--
    (j,k,m)-->T290 ==> (j ¥PLUS m) ¥incin (k ¥PLUS m)
    ELEM ==> (j ¥PLUS m) * (k ¥PLUS m) = j ¥PLUS m
    EQUAL ==> Stat2: Red([j ¥PLUS m,k ¥PLUS m]) =
	[(j ¥PLUS m) ¥MINUS (j ¥PLUS m),(k ¥PLUS m) ¥MINUS (j ¥PLUS m)]
    (j ¥PLUS m)-->T267(Stat2) ==> (j ¥PLUS m) ¥MINUS (j ¥PLUS m) = 0
    (Stat2)ELEM ==> Red([j ¥PLUS m,k ¥PLUS m]) = [0,(k ¥PLUS m) ¥MINUS (j ¥PLUS m)]
    (k,j,m)-->T314 ==> (k ¥PLUS m) ¥MINUS (j ¥PLUS m) = k ¥MINUS j
    EQUAL ==> false; Discharge ==> k ¥incin j
--
-- It follows that $k$ is less than $j$. But in this case an argument exactly symmetric to that
-- just given leads to a contradiction, which proves our theorem.
--
    ELEM ==> j * k = k
    EQUAL ==> Red([j,k]) = [j ¥MINUS k,k ¥MINUS k]
    k-->T267 ==> k ¥MINUS k = 0
    EQUAL ==> Red([j,k]) = [j ¥MINUS k,0]
    (k,j,m)-->T290 ==> (k ¥PLUS m) ¥incin (j ¥PLUS m)
    ELEM ==> (k ¥PLUS m) * (j ¥PLUS m) = k ¥PLUS m
    Use_def(Red) ==> Red([j ¥PLUS m,k ¥PLUS m]) =
    	[(j ¥PLUS m) ¥MINUS (car([j ¥PLUS m,k ¥PLUS m]) * cdr([j ¥PLUS m,k ¥PLUS m])),
    					(k ¥PLUS m) ¥MINUS (car([j ¥PLUS m,k ¥PLUS m]) * cdr([j ¥PLUS m,k ¥PLUS m]))]
    ELEM ==> car([j ¥PLUS m,k ¥PLUS m]) * cdr([j ¥PLUS m,k ¥PLUS m]) = k ¥PLUS m
    EQUAL ==> Red([j ¥PLUS m,k ¥PLUS m]) =
	[(j ¥PLUS m) ¥MINUS (k ¥PLUS m),(k ¥PLUS m) ¥MINUS (k ¥PLUS m)]
    (k ¥PLUS m)-->T267 ==> (k ¥PLUS m) ¥MINUS (k ¥PLUS m) = 0
    EQUAL ==> Red([j ¥PLUS m,k ¥PLUS m]) = [(j ¥PLUS m) ¥MINUS (k ¥PLUS m),0]
    (j,k,m)-->T314 ==> ((j ¥PLUS m) ¥MINUS (k ¥PLUS m)) = (j ¥MINUS k)
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the intersection of two unsigned integers, being
-- the smaller of the two, is an unsigned integer.
--
Theorem 375: [The intersection of two unsigned integers is the smaller of the two] ((N in Za) & (M in Za)) ¥imp (((N * M) in Za) & ((N * M) in {N,M}) & ((N ¥MINUS (N * M)) in Za) & ((M ¥MINUS (N * M)) in Za)). Proof+:
Suppose_not(n,m) ==> AUTO
	(n,m)-->T29 ==> (n * m in Za) & ((n * m = n) or (n * m = m))
	(n,n * m)-->T283 ==> (n ¥MINUS (n * m)) in Za
	(m,n * m)-->T283 ==> (m ¥MINUS (n * m)) in Za
	Discharge ==> QED
--
-- Next we show that the signed integer sum of any two pairs of integers is the sum of the
-- first with the reduction of the second.
--
Theorem 376: [The signed sum of two integer pairs is the sum of the first with the reduced form of the second] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) ¥imp ([J,K] ¥S_PLUS [N,M] = [J,K] ¥S_PLUS Red([N,M])). Proof:
    Suppose_not(j,k,n,m) ==> AUTO
--
-- For suppose that there is a counterexample $j,k,n,m$ to our assertion. Of the two integers $n$, $m$,
-- one is smaller, so that $n * m$ is an integer in any case.
--
    n-->T207 ==> n = #n
    m-->T207 ==> m = #m
    (n,m)-->T375(*) ==> ((n * m) in Za) & (((n * m) = n) or ((n * m) = m)) & ((n ¥MINUS (n * m)) in Za) & ((m ¥MINUS (n * m)) in Za)
--
-- Use of the definitions of the $¥S_PLUS$ and $Red$ operators converts
-- the negative of our theorem into the inequality just below.
--
    Use_def(¥S_PLUS) ==>
		Red([j ¥PLUS n,k ¥PLUS m]) /= Red([j ¥PLUS car(Red([n,m])),k ¥PLUS cdr(Red([n,m]))])
    Use_def(Red) ==> Stat1: Red([n,m]) = [n ¥MINUS (n * m),m ¥MINUS (n * m)]
    (Stat1)ELEM ==> (n incs n * m) & (m incs n * m) &
    		(car(Red([n,m])) = n ¥MINUS (n * m)) & (cdr(Red([n,m])) = m ¥MINUS (n * m))
	EQUAL ==>  Red([j ¥PLUS n,k ¥PLUS m]) /= Red([j ¥PLUS (n ¥MINUS (n * m)),(k ¥PLUS (m ¥MINUS (n * m)))])
--
-- But we can add $n * m$ to both components of the pair seen on the right-hand side of this last inequality
-- without changing its reduction, and so after a bit more algebraic manipulation derive a contradiction
-- which proves the present theorem.
--
	ALGEBRA ==> (j ¥PLUS (n ¥MINUS (n * m)) in Za) & (k ¥PLUS (m ¥MINUS (n * m)) in Za)
	(j ¥PLUS (n ¥MINUS (n * m)),k ¥PLUS (m ¥MINUS (n * m)),(n * m))-->T374 ==>
		Red([j ¥PLUS (n ¥MINUS (n * m)),k ¥PLUS (m ¥MINUS (n * m))]) =
			Red([(j ¥PLUS (n ¥MINUS (n * m))) ¥PLUS (n * m),(k ¥PLUS (m ¥MINUS (n * m))) ¥PLUS (n * m)])
	ALGEBRA ==> Red([j ¥PLUS (n ¥MINUS (n * m)),(k ¥PLUS (m ¥MINUS (n * m)))]) =
		Red([j ¥PLUS ((n ¥MINUS (n * m)) ¥PLUS (n * m)),k ¥PLUS ((m ¥MINUS (n * m)) ¥PLUS (n * m))])
	(n*m,n)-->T272 ==> (n ¥MINUS (n * m)) ¥PLUS (n * m) = n
	(n*m,m)-->T272 ==> (m ¥MINUS (n * m)) ¥PLUS (n * m) = m
    EQUAL ==> false; Discharge ==> QED
--
-- The following elementary corollary to the theorem just proved  tells us that addition of any pair $p$
-- of integers to a signed integer $x$ produces the same result as addition of the reduced form of $p$ to $x$.
--
Theorem 377: [The sum of a signed integer and an integer pair remains the same if the pair is reduced] ((K in Si) & (N in Za) & (M in Za)) ¥imp (K ¥S_PLUS [N,M] = K ¥S_PLUS Red([N,M])). Proof:
	Suppose_not(k,n,m) ==> AUTO
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) = 0 or cdr(k) = 0) & (car(k) in Za) & (cdr(k) in Za) & (Red(k) =k)
    (car(k),cdr(k),n,m)-->T376 ==>
    	[car(k),cdr(k)] ¥S_PLUS [n,m] = [car(k),cdr(k)] ¥S_PLUS Red([n,m])
    EQUAL ==> false; Discharge ==> QED
--
-- The following 'multiplication' analog to Theorem 377 states that multiplication of  a signed integer $k$
-- by any pair $p$ of integers produces the same result as multiplication of $k$ by the reduced form of $p$.
--
Theorem 378: [The product of a signed integer and an integer pair remains the same if the pair is reduced] ((K in Si) & (N in Za) & (M in Za)) ¥imp (K ¥S_TIMES [N,M] = K ¥S_TIMES Red([N,M])). Proof:
    Suppose_not(k,n,m) ==> (k in Si) & (n in Za) & (m in Za) & (k ¥S_TIMES [n,m] /= k ¥S_TIMES Red([n,m]))
--
-- For suppose that $k = [cak,cdk]$, $n$, $m$ comprise a counterexample to our theorem, where plainly all of
-- $cak$, $cdk$, $n$, $m$ must be integers, and so must all the other quantities formed from them in the argument which follows.
-- Since $n * m$ is the minimum of $n$ and $m$ and so is no more than either, we have $(n ¥MINUS (n * m)) ¥PLUS (n * m) = n$,
-- and $(m ¥MINUS (n * m)) ¥PLUS (n * m) = m$, by theorems on unsigned integer subtractioand addition proved earlier.
--
    k-->T369 ==> Stat1: (k = [car(k),cdr(k)]) & (car(k) = 0 or cdr(k) = 0) & (car(k) in Za) & (cdr(k) in Za) & (Red(k) = k)
    (n,m)-->T375(*) ==> ((n * m) in Za) & ((n ¥MINUS (n * m)) in Za) & ((m ¥MINUS (n * m)) in Za)
    n-->T207 ==> (n = #n)
    m-->T207 ==> (m = #m)
    (n * m)-->T207 ==> (n * m) = #(n * m)
    (n * m,n)-->T271 ==> #(n * m) ¥PLUS (n ¥MINUS (n * m)) = #n
    (n * m,m)-->T271 ==> #(n * m) ¥PLUS (m ¥MINUS (n * m)) = #m
    EQUAL ==> (n * m) ¥PLUS (n ¥MINUS (n * m)) = n
    EQUAL ==> (n * m) ¥PLUS (m ¥MINUS (n * m)) = m
    (n ¥MINUS (n * m),n * m)-->T252 ==> Stat2: (n ¥MINUS (n * m)) ¥PLUS (n * m) = n
    (m ¥MINUS (n * m),n * m)-->T252 ==> Stat3: (m ¥MINUS (n * m)) ¥PLUS (n * m) = m
--
-- Using the definitions of signed integer multiplication and of reduction we can expand
-- the negative of our theorem into the inequality between reductions seen below.
--
    Use_def(¥S_TIMES) ==>
		Red([(car(k) ¥TIMES n) ¥PLUS (cdr(k) ¥TIMES m),(car(k) ¥TIMES m) ¥PLUS (n ¥TIMES cdr(k))]) /=
			Red([(car(k) ¥TIMES car(Red([n,m]))) ¥PLUS (cdr(k) ¥TIMES cdr(Red([n,m]))),
				(car(k) ¥TIMES cdr(Red([n,m]))) ¥PLUS (car(Red([n,m])) ¥TIMES cdr(k))])
    Loc_def ==> Stat4: cak = car(k)
    Loc_def ==> Stat5: cdk = cdr(k)
    (Stat1,Stat4,Stat5)ELEM ==> (k = [cak,cdk]) & (cak in Za) & (cdk in Za)
    Use_def(Red) ==> Stat6: Red([n,m]) = [n ¥MINUS (n * m),m ¥MINUS (n * m)]
    EQUAL ==> Red([(cak ¥TIMES n) ¥PLUS (cdk ¥TIMES m),(cak ¥TIMES m) ¥PLUS (n ¥TIMES cdk)]) /=
				Red([(cak ¥TIMES car(Red([n,m]))) ¥PLUS (cdk ¥TIMES cdr(Red([n,m]))),
					(cak ¥TIMES cdr(Red([n,m]))) ¥PLUS (car(Red([n,m])) ¥TIMES cdk)])
    (Stat6)ELEM ==> (n incs (n * m)) & (m incs (n * m)) &
    		(car(Red([n,m])) = n ¥MINUS (n * m)) & (cdr(Red([n,m])) = m ¥MINUS (n * m))
    EQUAL ==> Red([(cak ¥TIMES n) ¥PLUS (cdk ¥TIMES m),(cak ¥TIMES m) ¥PLUS (n ¥TIMES cdk)]) /=
				Red([(cak ¥TIMES (n ¥MINUS (n * m))) ¥PLUS (cdk ¥TIMES (m ¥MINUS (n * m))),
    				(cak ¥TIMES (m ¥MINUS (n * m))) ¥PLUS ((n ¥MINUS (n * m)) ¥TIMES cdk)])
	ALGEBRA ==> (cak ¥TIMES (n ¥MINUS (n * m))) ¥PLUS (cdk ¥TIMES (m ¥MINUS (n * m))) in Za
	ALGEBRA ==> (cak ¥TIMES (m ¥MINUS (n * m))) ¥PLUS ((n ¥MINUS (n * m)) ¥TIMES cdk) in Za
	ALGEBRA ==> (cak ¥TIMES (n * m)) ¥PLUS (cdk ¥TIMES (n * m)) in Za
--
-- But now adding the quantity $((cak ¥TIMES (n * m)) ¥PLUS (cdk ¥TIMES (n * m)))$ to both components
-- of the right hand side of this last inequality allows us to reduce it, via a series of elementary algebraic
-- transformations, to $Red([(cak ¥TIMES n) ¥PLUS (cdk ¥TIMES m),(cak ¥TIMES m) ¥PLUS (cdk ¥TIMES n)])$,
--
   ((cak ¥TIMES (n ¥MINUS (n * m))) ¥PLUS (cdk ¥TIMES (m ¥MINUS (n * m))),(cak ¥TIMES (m ¥MINUS (n * m))) ¥PLUS ((n ¥MINUS (n * m)) ¥TIMES cdk),(cak ¥TIMES (n * m)) ¥PLUS (cdk ¥TIMES (n * m)))-->T374 ==>
		Red([(cak ¥TIMES (n ¥MINUS (n * m))) ¥PLUS (cdk ¥TIMES (m ¥MINUS (n * m))),
			(cak ¥TIMES (m ¥MINUS (n * m))) ¥PLUS ((n ¥MINUS (n * m)) ¥TIMES cdk)]) =
				Red([((cak ¥TIMES (n ¥MINUS (n * m))) ¥PLUS (cdk ¥TIMES (m ¥MINUS (n * m))))
					¥PLUS ((cak ¥TIMES (n * m)) ¥PLUS (cdk ¥TIMES (n * m))),
					(cak ¥TIMES (m ¥MINUS (n * m))) ¥PLUS ((n ¥MINUS (n * m)) ¥TIMES cdk)
						¥PLUS ((cak ¥TIMES (n * m)) ¥PLUS (cdk ¥TIMES (n * m)))])
    ALGEBRA ==> ((cak ¥TIMES (n ¥MINUS (n * m))) ¥PLUS (cdk ¥TIMES (m ¥MINUS (n * m))))
					¥PLUS ((cak ¥TIMES (n * m)) ¥PLUS (cdk ¥TIMES (n * m))) =
						((cak ¥TIMES (n ¥MINUS (n * m))) ¥PLUS (cdk ¥TIMES (m ¥MINUS (n * m))))
							¥PLUS (cak ¥TIMES (n * m)) ¥PLUS (cdk ¥TIMES (n * m))
    ALGEBRA ==> (cak ¥TIMES (m ¥MINUS (n * m))) ¥PLUS ((n ¥MINUS (n * m)) ¥TIMES cdk)
					¥PLUS ((cak ¥TIMES (n * m)) ¥PLUS (cdk ¥TIMES (n * m))) =
						(cak ¥TIMES (m ¥MINUS (n * m))) ¥PLUS ((n ¥MINUS (n * m)) ¥TIMES cdk)
							¥PLUS (cak ¥TIMES (n * m)) ¥PLUS (cdk ¥TIMES (n * m))
    EQUAL ==> Red([(cak ¥TIMES (n ¥MINUS (n * m))) ¥PLUS (cdk ¥TIMES (m ¥MINUS (n * m))),
				(cak ¥TIMES (m ¥MINUS (n * m))) ¥PLUS ((n ¥MINUS (n * m)) ¥TIMES cdk)]) =
					Red([((cak ¥TIMES (n ¥MINUS (n * m))) ¥PLUS (cdk ¥TIMES (m ¥MINUS (n * m))))
						¥PLUS (cak ¥TIMES (n * m)) ¥PLUS (cdk ¥TIMES (n * m)),
							(cak ¥TIMES (m ¥MINUS (n * m))) ¥PLUS ((n ¥MINUS (n * m)) ¥TIMES cdk)
								¥PLUS (cak ¥TIMES (n * m)) ¥PLUS (cdk ¥TIMES (n * m))])
    ALGEBRA ==> Stat7: Red([(cak ¥TIMES (n ¥MINUS (n * m))) ¥PLUS (cdk ¥TIMES (m ¥MINUS (n * m))),
		(cak ¥TIMES (m ¥MINUS (n * m))) ¥PLUS ((n ¥MINUS (n * m)) ¥TIMES cdk)]) =
			Red([(cak ¥TIMES ((n ¥MINUS (n * m)) ¥PLUS (n * m))) ¥PLUS (cdk ¥TIMES ((m ¥MINUS (n * m)) ¥PLUS (n * m))),
				(cak ¥TIMES ((m ¥MINUS (n * m)) ¥PLUS (n * m))) ¥PLUS (cdk ¥TIMES ((n ¥MINUS (n * m)) ¥PLUS (n * m)))])
    EQUAL(Stat2,Stat3,Stat7) ==> Red([(cak ¥TIMES (n ¥MINUS (n * m))) ¥PLUS (cdk ¥TIMES (m ¥MINUS (n * m))),
		(cak ¥TIMES (m ¥MINUS (n * m))) ¥PLUS ((n ¥MINUS (n * m)) ¥TIMES cdk)]) =
				Red([(cak ¥TIMES n) ¥PLUS (cdk ¥TIMES m),(cak ¥TIMES m) ¥PLUS (cdk ¥TIMES n)])
--
-- and now a contraction results immediately by one final algebraic step, completing the proof of the present theorem.
--
   ALGEBRA ==> Red([(cak ¥TIMES n) ¥PLUS (cdk ¥TIMES m),(cak ¥TIMES m) ¥PLUS (cdk ¥TIMES n)]) =
   				Red([(cak ¥TIMES n) ¥PLUS (cdk ¥TIMES m),(cak ¥TIMES m) ¥PLUS (n ¥TIMES cdk)])
   Discharge ==> QED
--
-- The two following elementary lemmas prepare for proof of the commutativity
-- of signed integer addition. We first prove commutativity for
-- the sum of a signed integer with an arbitrary pair of unsigned
-- integers.
--
Theorem 379: [Commutativity lemma for signed integers] ((K in Si) & (N in Za) & (M in Za)) ¥imp (K ¥S_PLUS [N,M] = [N,M] ¥S_PLUS K). Proof:
  	Suppose_not(k,n,m) ==> AUTO
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) = 0 or cdr(k) = 0) & (car(k) in Za) & (cdr(k) in Za)
    Use_def(¥S_PLUS) ==> Red([car(k) ¥PLUS car([n,m]),cdr(k) ¥PLUS cdr([n,m])]) /=
    						Red([car([n,m]) ¥PLUS car(k),cdr([n,m]) ¥PLUS cdr(k)])
    ELEM ==> Red([car(k) ¥PLUS n,cdr(k) ¥PLUS m]) /= Red([n ¥PLUS car(k),m ¥PLUS cdr(k)])
    ALGEBRA ==> false; Discharge ==> QED
--
-- Next we prove commutativity for the sum of two pairs of unsigned integers.
--
Theorem 380: [Commutativity lemma for signed integers, 2] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) ¥imp ([J,K] ¥S_PLUS [N,M] = [N,M] ¥S_PLUS [J,K]). Proof:
 	Suppose_not(j,k,n,m) ==> AUTO
    Use_def(¥S_PLUS) ==> Red([car([j,k]) ¥PLUS car([n,m]),cdr([j,k]) ¥PLUS cdr([n,m])]) /=
    						Red([car([n,m]) ¥PLUS car([j,k]),cdr([n,m]) ¥PLUS cdr([j,k])])
    ELEM ==> Red([j ¥PLUS n,k ¥PLUS m]) /= Red([n ¥PLUS j,m ¥PLUS k])
    ALGEBRA ==> false; Discharge ==> QED
--
-- Using the lemmas just proved, we can show immediately that signed integer addition is
-- commutative.
--
Theorem 381: [Commutative law for signed integer addition] ((N in Si) & (M in Si)) ¥imp (N ¥S_PLUS M = M ¥S_PLUS N). Proof:
  	Suppose_not(n,m) ==> AUTO
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
    (n,car(m),cdr(m))-->T379 ==> n ¥S_PLUS [car(m),cdr(m)] = [car(m),cdr(m)] ¥S_PLUS n
    EQUAL ==> false; Discharge ==> QED
--
-- Using commutativity we can prove the following occasionally useful variants of Theorem 376,
-- the first stating that the sum of two pairs of unsigned integers is the sum of the reduction of the first pair
-- with the second pair, while the next states that the same sum is is the sum of the first pair
-- with the reduction of the second pair. Both proofs are elementary applicaions of fromulae already established.
--
Theorem 382: [The sum of two integer pairs remains the same if the first is reduced] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) ¥imp ([J,K] ¥S_PLUS [N,M] = Red([J,K]) ¥S_PLUS [N,M]). Proof:
 	Suppose_not(j,k,n,m) ==> AUTO
    (j,k,n,m)-->T380 ==> [j,k] ¥S_PLUS [n,m] = [n,m] ¥S_PLUS [j,k]
    (j,k)-->T366 ==> Red([j,k]) in Si
    (Red([j,k]),n,m)-->T379 ==> (Red([j,k]) ¥S_PLUS [n,m]) = ([n,m] ¥S_PLUS Red([j,k]))
    (n,m,j,k)-->T376 ==> false; Discharge ==> QED
--
-- It is equally easy to show that the sum of two pairs of unsigned integers is the sum of their reductions.
--
Theorem 383: [The sum of two integer pairs remains the same if both are reduced] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) ¥imp ([J,K] ¥S_PLUS [N,M] = Red([J,K]) ¥S_PLUS Red([N,M])). Proof:
	Suppose_not(j,k,n,m) ==> AUTO
    (j,k)-->T366 ==> Red([j,k]) in Si
    (j,k,n,m)-->T382 ==> [j,k] ¥S_PLUS [n,m] = Red([j,k]) ¥S_PLUS [n,m]
    (Red([j,k]),n,m)-->T377 ==> false; Discharge ==> QED
--
-- Our next result gives the commutative law for signed integer multiplication.
--
Theorem 384: [Commutative law for signed integer multiplication] ((N in Si) & (M in Si)) ¥imp (N ¥S_TIMES M = M ¥S_TIMES N). Proof:
  	Suppose_not(n,m) ==> AUTO
--
-- The proof results immediately by definition of the operators involved and by use of the elementary
-- algebraic properties of unsigned integers.
--
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
    ALGEBRA ==> (car(m) ¥TIMES car(n)) ¥PLUS (cdr(m) ¥TIMES cdr(n)) = (car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m)) &
			(car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n)) = (car(m) ¥TIMES cdr(n)) ¥PLUS (car(n) ¥TIMES cdr(m))
    Use_def(¥S_TIMES) ==> Red([(car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m)),
    	(car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n))]) /=
    			Red([(car(m) ¥TIMES car(n)) ¥PLUS (cdr(m) ¥TIMES cdr(n)),
    			(car(m) ¥TIMES cdr(n)) ¥PLUS (car(n) ¥TIMES cdr(m))])
    EQUAL ==> false; Discharge ==> QED
--
-- Our next goal is to prove the associative laws of signed integers. We begin by proving the associative law for signed integer addition.
--
Theorem 385: [Associative law for signed integer addition] ((K in Si) & (N in Si) & (M in Si)) ¥imp (N ¥S_PLUS (M ¥S_PLUS K) = (N ¥S_PLUS M) ¥S_PLUS K). Proof:
--
-- Supposing that $k$, $n$, $m$ form a counterexample to our assertion, we begin by expanding
-- the inner '$¥S_PLUS$' operators using their definition, and then using Theorem 359 to
-- eliminate the unnecessary reduction operators '$Red$' that appear.
--
	Suppose_not(k,n,m) ==> AUTO
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) = 0 or cdr(k) = 0) & (car(k) in Za) & (cdr(k) in Za)
    (n,m)-->T371 ==> n ¥S_PLUS m in Si
    (k,n ¥S_PLUS m)-->T381 ==> (n ¥S_PLUS m) ¥S_PLUS k = k ¥S_PLUS (n ¥S_PLUS m)
    Use_def(¥S_PLUS) ==> n ¥S_PLUS (m ¥S_PLUS k) = n ¥S_PLUS Red([car(m) ¥PLUS car(k),cdr(m) ¥PLUS cdr(k)])
    Use_def(¥S_PLUS) ==> k ¥S_PLUS (n ¥S_PLUS m) = k ¥S_PLUS Red([car(n) ¥PLUS car(m),cdr(n) ¥PLUS cdr(m)])
    ALGEBRA ==> (car(m) ¥PLUS car(k) in Za) & (cdr(m) ¥PLUS cdr(k) in Za)
    (n,car(m) ¥PLUS car(k),cdr(m) ¥PLUS cdr(k))-->T377 ==>
	(n ¥S_PLUS Red([car(m) ¥PLUS car(k),cdr(m) ¥PLUS cdr(k)])) = n ¥S_PLUS [car(m) ¥PLUS car(k),cdr(m) ¥PLUS cdr(k)]
	ALGEBRA ==> (car(n) ¥PLUS car(m) in Za) & (cdr(n) ¥PLUS cdr(m) in Za)
    (k,car(n) ¥PLUS car(m),cdr(n) ¥PLUS cdr(m))-->T377 ==>
	(k ¥S_PLUS Red([car(n) ¥PLUS car(m),cdr(n) ¥PLUS cdr(m)])) = k ¥S_PLUS [car(n) ¥PLUS car(m),cdr(n) ¥PLUS cdr(m)]
--
-- Next we expand the outer '$¥S_PLUS$' operators using their definition, and note that
-- by the known algebraic properties of positive integer addition it follows that the
-- two resulting expressions are equal, a contradiction which proves our theorem.
--
    Use_def(¥S_PLUS) ==>
	n ¥S_PLUS [car(m) ¥PLUS car(k),cdr(m) ¥PLUS cdr(k)] =
				Red([car(n) ¥PLUS (car(m) ¥PLUS car(k)),cdr(n) ¥PLUS (cdr(m) ¥PLUS cdr(k))])
    Use_def(¥S_PLUS) ==>
				k ¥S_PLUS [car(n) ¥PLUS car(m),cdr(n) ¥PLUS cdr(m)] =
	Red([car(k) ¥PLUS (car(n) ¥PLUS car(m)),cdr(k) ¥PLUS (cdr(n) ¥PLUS cdr(m))])
    ALGEBRA ==> Red([car(n) ¥PLUS (car(m) ¥PLUS car(k)),cdr(n) ¥PLUS (cdr(m) ¥PLUS cdr(k))]) =
	Red([car(k) ¥PLUS (car(n) ¥PLUS car(m)),cdr(k) ¥PLUS (cdr(n) ¥PLUS cdr(m))])
    Discharge ==> QED
--
-- Our next theorem gives the distributive law for (signed) integer multiplication over addition.
--
Theorem 386: [Distributive law for signed integers]
    ((K in Si) & (N in Si) & (M in Si)) ¥imp (N ¥S_TIMES (M ¥S_PLUS K) = (N ¥S_TIMES M) ¥S_PLUS (N ¥S_TIMES K)). Proof:
--
-- As in all the proofs of the present group, we begin by expanding the operators involved
-- into their definitions, and removing all the redundant reduction operators '$Red$' that appear.
-- This is first done for the left-hand side of our assertion.
--
	Suppose_not(k,n,m) ==> AUTO
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) = 0 or cdr(k) = 0) & (car(k) in Za) & (cdr(k) in Za)
    (m,k)-->T371 ==> m ¥S_PLUS k in Si
    (n,m)-->T371 ==> n ¥S_TIMES m in Si
    (n,k)-->T371 ==> n ¥S_TIMES k in Si
    ALGEBRA ==> (car(m) ¥PLUS car(k) in Za) & (cdr(m) ¥PLUS cdr(k) in Za)
    Use_def(¥S_PLUS) ==> n ¥S_TIMES (m ¥S_PLUS k) = n ¥S_TIMES Red([car(m) ¥PLUS car(k),cdr(m) ¥PLUS cdr(k)])
    (n,car(m) ¥PLUS car(k),cdr(m) ¥PLUS cdr(k))-->T378 ==>
	n ¥S_TIMES (m ¥S_PLUS k) = n ¥S_TIMES [car(m) ¥PLUS car(k),cdr(m) ¥PLUS cdr(k)]
    Use_def(¥S_TIMES) ==> n ¥S_TIMES (m ¥S_PLUS k) =
	Red([(car(n) ¥TIMES (car(m) ¥PLUS car(k))) ¥PLUS (cdr(n) ¥TIMES (cdr(m) ¥PLUS cdr(k))),
				(car(n) ¥TIMES (cdr(m) ¥PLUS cdr(k))) ¥PLUS ((car(m) ¥PLUS car(k)) ¥TIMES cdr(n))])
--
-- Next we expand and simplify the right-hand side of our assertion in the same way.
--
    Use_def(¥S_TIMES) ==> (n ¥S_TIMES m) ¥S_PLUS (n ¥S_TIMES k) =
    Red([(car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m)),(car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n))]) ¥S_PLUS
	Red([(car(n) ¥TIMES car(k)) ¥PLUS (cdr(n) ¥TIMES cdr(k)),(car(n) ¥TIMES cdr(k)) ¥PLUS (car(k) ¥TIMES cdr(n))])
    ALGEBRA ==> ((car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m)) in Za) & ((car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n)) in Za) &
		((car(n) ¥TIMES car(k)) ¥PLUS (cdr(n) ¥TIMES cdr(k)) in Za) & ((car(n) ¥TIMES cdr(k)) ¥PLUS (car(k) ¥TIMES cdr(n)) in Za)
			((car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m)),(car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n)), (car(n) ¥TIMES car(k)) ¥PLUS (cdr(n) ¥TIMES cdr(k)),(car(n) ¥TIMES cdr(k)) ¥PLUS (car(k) ¥TIMES cdr(n)))-->T383 ==>
    Stat1: (n ¥S_TIMES m) ¥S_PLUS (n ¥S_TIMES k) =
		([(car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m)),(car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n))]) ¥S_PLUS
			([(car(n) ¥TIMES car(k)) ¥PLUS (cdr(n) ¥TIMES cdr(k)),(car(n) ¥TIMES cdr(k)) ¥PLUS (car(k) ¥TIMES cdr(n))])
--
-- We complete our expansion of the left side of our assertion by expanding the central
-- signed addition operator which appears in it.
--
    Use_def(¥S_PLUS) ==> Stat2: ([(car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m)),(car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n))]) ¥S_PLUS
		([(car(n) ¥TIMES car(k)) ¥PLUS (cdr(n) ¥TIMES cdr(k)),(car(n) ¥TIMES cdr(k)) ¥PLUS (car(k) ¥TIMES cdr(n))]) =
			Red([((car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m))) ¥PLUS ((car(n) ¥TIMES car(k)) ¥PLUS (cdr(n) ¥TIMES cdr(k))),
    			((car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n))) ¥PLUS ((car(n) ¥TIMES cdr(k)) ¥PLUS (car(k) ¥TIMES cdr(n)))])
    (Stat1,Stat2*)ELEM ==> (n ¥S_TIMES m) ¥S_PLUS (n ¥S_TIMES k) =
		Red([((car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m))) ¥PLUS ((car(n) ¥TIMES car(k)) ¥PLUS (cdr(n) ¥TIMES cdr(k))),
    		((car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n))) ¥PLUS ((car(n) ¥TIMES cdr(k)) ¥PLUS (car(k) ¥TIMES cdr(n)))])
--
-- Now rearraangement of thems using the algebraic properties of signed integers brings us to the desired result.
--
    ALGEBRA ==> (n ¥S_TIMES m) ¥S_PLUS (n ¥S_TIMES k) =
		Red([(car(n) ¥TIMES (car(m) ¥PLUS car(k))) ¥PLUS (cdr(n) ¥TIMES (cdr(m) ¥PLUS cdr(k))),
			(car(n) ¥TIMES (cdr(m) ¥PLUS cdr(k))) ¥PLUS ((car(m) ¥PLUS car(k)) ¥TIMES cdr(n))])
    Discharge ==> QED
--
-- The following easy lemma shows that pairs of the form $[n,0]$ are invariant under the reduction operator 'Red'.
--
Theorem 387: [Reduction of a pair $(N,0)$ gives $(N,0)$] (N in Za) ¥imp (Red([N,0]) = [N,0]). Proof:
--
-- The result follows trivially from the definition of reduction, since for all such pairs
-- the minimum of the two components is clearly 0.
--
Suppose_not(n) ==> AUTO
    Use_def(Red) ==> Red([n,0]) = [n ¥MINUS (n * 0),0 ¥MINUS (n * 0)]
    TELEM ==> n * 0 = 0
    EQUAL ==> Stat1: Red([n,0]) = [n ¥MINUS 0,0 ¥MINUS 0]
    n-->T268(Stat1) ==> Red([n,0]) = [#n,0 ¥MINUS 0]
    n-->T207 ==> n = #n
    EQUAL ==> Red([n,0]) = [n,0 ¥MINUS 0]
    0-->T268() ==> (0 ¥MINUS 0) = #0
    T188 ==> Card(0)
    0-->T164() ==> 0 = #0
    EQUAL ==> false; Discharge ==> QED
--
-- Our next result tells us that the embedding $n->[n,0]$ of integers into signed integers is an algebraic isomorphism.
--
Theorem 388: [Embedding of Integers in Signed Integers]
     ((N in Za) & (M in Za)) ¥imp (([N ¥PLUS M,0] = [N,0] ¥S_PLUS [M,0] & [N ¥TIMES M,0] = [N,0] ¥S_TIMES [M,0]) &
				((N incs M) ¥imp ([N,0] ¥S_MINUS [M,0] = [N ¥MINUS M,0]))). Proof:
    Suppose_not(n,m) ==>
	(n in Za) & (m in Za) & (([n ¥PLUS m,0] /= [n,0] ¥S_PLUS [m,0]) or ([n ¥TIMES m,0] /= [n,0] ¥S_TIMES [m,0]) or
				((n incs m) & ([n,0] ¥S_MINUS [m,0] /= [n ¥MINUS m,0])))
--
-- For signed addition and multiplication,our assertion follows immediately from their definitions.
--
    Use_def(¥S_PLUS) ==> [n,0] ¥S_PLUS [m,0] = Red([n ¥PLUS m,0 ¥PLUS 0])
    ALGEBRA ==> ([n,0] ¥S_PLUS [m,0] = Red([n ¥PLUS m,0])) & (n ¥PLUS m in Za)
    (n ¥PLUS m)-->T387 ==> [n,0] ¥S_PLUS [m,0] = [n ¥PLUS m,0]
    Use_def(¥S_TIMES) ==> [n,0] ¥S_TIMES [m,0] = Red([(n ¥TIMES m) ¥PLUS (0 ¥TIMES 0),(n ¥TIMES 0) ¥PLUS (m ¥TIMES 0)])
    ALGEBRA ==> ((n ¥TIMES m) ¥PLUS (0 ¥TIMES 0) = n ¥TIMES m) & ((n ¥TIMES 0) ¥PLUS (m ¥TIMES 0) = 0) & (n ¥TIMES m in Za)
    EQUAL ==> [n,0] ¥S_TIMES [m,0] = Red([n ¥TIMES m,0])
    (n ¥TIMES m)-->T387 ==> [n ¥TIMES m,0] = [n,0] ¥S_TIMES [m,0]
--
-- Thus only the final clause of our theorem can be false. But in this case
-- our assertion follows immediately from the definition and fact that
-- the unsigned integer difference $m ¥MINUS m$ is zero.
--
    ELEM ==> (n incs m) & ([n,0] ¥S_MINUS [m,0] /= [n ¥MINUS m,0])
    Use_def(¥S_MINUS) ==> [n,0] ¥S_MINUS [m,0] = Red([0 ¥PLUS n,m ¥PLUS 0])
    ALGEBRA ==> (0 ¥PLUS n = n) & (m ¥PLUS 0 = m)
    EQUAL ==> [n ¥MINUS m,0] /= Red([n,m])
    Use_def(Red) ==> [n ¥MINUS m,0] /= [n ¥MINUS (n * m),m ¥MINUS (n * m)]
    ELEM ==> n * m = m
    EQUAL ==> Stat1: [n ¥MINUS m,0] /= [n ¥MINUS m,m ¥MINUS m]
    (Stat1)ELEM ==> m ¥MINUS m /= 0
    m-->T267 ==> false; Discharge ==> QED
--
-- The trivial lemma which now follows states that sign-reversal for signed integers
-- corresponds to interchange of their unsigned integer components.
--
Theorem 389: [Sign-reversal of signed integers] ((N in Za) & (M in Za)) ¥imp (S_Rev(Red([M,N])) = Red([N,M])). Proof:
    Suppose_not(n,m) ==> (n in Za) & (m in Za) & (S_Rev(Red([m,n])) /= Red([n,m]))
    Use_def(Red) ==> S_Rev([m ¥MINUS m * n,n ¥MINUS m * n]) /= [n ¥MINUS m * n,m ¥MINUS m * n]
    Use_def(S_Rev) ==> false; Discharge ==> QED
--
-- Next we show that the negative of the product of two signed integers
-- is the product of the first by the negative of the second.
--
Theorem 390: [$n*-m=-(n*m)$ for signed integers] ((N in Si) & (M in Si)) ¥imp (N ¥S_TIMES S_Rev(M) = S_Rev(N ¥S_TIMES M)). Proof:
    Suppose_not(n,m) ==>
	(n in Si) & (m in Si) & ((n ¥S_TIMES S_Rev(m)) /= S_Rev(n ¥S_TIMES m))
--
-- For let $n$, $m$ form a counterexample to our assertion, and use the definitions
-- of the operators involved to express $n ¥S_TIMES S_Rev(m)$ as the reduction of a
-- pair formed algebraically from the components of $n$ and $m$.
--
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) in Za) & (cdr(n) in Za)
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) in Za) & (cdr(m) in Za)
    Use_def(¥S_TIMES) ==> n ¥S_TIMES S_Rev(m) =
    		Red([(car(n) ¥TIMES car(S_Rev(m))) ¥PLUS (cdr(n) ¥TIMES cdr(S_Rev(m))),
				(car(n) ¥TIMES cdr(S_Rev(m))) ¥PLUS (car(S_Rev(m)) ¥TIMES cdr(n))])
    Use_def(S_Rev) ==> Stat1: S_Rev(m) = [cdr(m),car(m)]
    (Stat1)ELEM ==> car(S_Rev(m)) = cdr(m)
    (Stat1,Stat1)ELEM ==> cdr(S_Rev(m)) = car(m)
    EQUAL ==> n ¥S_TIMES S_Rev(m) = Red([(car(n) ¥TIMES cdr(m)) ¥PLUS (cdr(n) ¥TIMES car(m)),
											(car(n) ¥TIMES car(m)) ¥PLUS (cdr(m) ¥TIMES cdr(n))])
--
-- Now use these definitions once more to express $S_Rev(n ¥S_TIMES m)$ in the same way.
-- Then a final bit of algebra on the positive-integer components of the two resulting pairs
-- shows that they are equal, ad so proves our theorem.
--
    Use_def(¥S_TIMES) ==> S_Rev(n ¥S_TIMES m) = S_Rev(Red([(car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m)),
								(car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n))]))
    ALGEBRA ==> ((car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m)) in Za) &
								((car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n)) in Za)
    ((car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n)),(car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m)))-->T389 ==>
	S_Rev(n ¥S_TIMES m) = Red([(car(n) ¥TIMES cdr(m)) ¥PLUS (car(m) ¥TIMES cdr(n)),
										(car(n) ¥TIMES car(m)) ¥PLUS (cdr(n) ¥TIMES cdr(m))])
    ALGEBRA ==> false; Discharge ==> QED
--
-- Our next theorem asserts that the reverse of any signed integer $n$ is also a signed integer,
-- and that the sum of n and its reverse is zero.
--
Theorem 391: [Basic properties of the signed negative] (N in Si) ¥imp ((S_Rev(N) in Si) & (S_Rev(N) ¥S_PLUS N = [0,0]) & (S_Rev(S_Rev(N)) = N)). Proof:
    Suppose_not(n) ==> Stat1: (n in Si) & ((S_Rev(n) notin Si) or (S_Rev(n) ¥S_PLUS n /= [0,0]) or (S_Rev(S_Rev(n)) /= n))
--
-- That $S_Rev(n)$ is a signed integer follows trivially fro its definition.
--
    n-->T369 ==> Stat2: (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    ALGEBRA ==> (car(n) ¥PLUS cdr(n)) in Za
    Use_def(S_Rev) ==> Stat3: S_Rev(n) = [cdr(n),car(n)]
    (Stat3)ELEM ==> (car(S_Rev(n)) = cdr(n)) & (cdr(S_Rev(n)) = car(n))
    Suppose ==> S_Rev(n) notin Si
    Use_def(Si) ==> Stat4: [cdr(n),car(n)] notin {[x,y]: x in Za, y in Za | ((x = 0) or (y = 0))}
    (cdr(n),car(n))-->Stat4 ==> false; Discharge ==> Stat5: S_Rev(n) in Si
--
-- Moreover, $S_Rev(n) ¥S_PLUS n$ is $Red([car(n) ¥PLUS cdr(n),car(n) ¥PLUS cdr(n)])$, and so
-- reduces to $[0,0]$, completing our proof
--
    EQUAL ==> Stat6: S_Rev(S_Rev(n)) = S_Rev([cdr(n),car(n)])
    Use_def(S_Rev) ==> Stat7: S_Rev([cdr(n),car(n)]) = [cdr([cdr(n),car(n)]),car([cdr(n),car(n)])]
    (Stat7)ELEM ==> Stat8: S_Rev([cdr(n),car(n)]) = [car(n),cdr(n)]
    (Stat5,Stat6,Stat8,Stat2*)ELEM ==> Stat9: (S_Rev(n) in Si) & (S_Rev(S_Rev(n)) = n)
    (Stat1,Stat5,Stat9*)ELEM ==> Stat10: S_Rev(n) ¥S_PLUS n /= [0,0]
    Use_def(¥S_PLUS) ==> S_Rev(n) ¥S_PLUS n = Red([car(S_Rev(n)) ¥PLUS car(n),cdr(S_Rev(n)) ¥PLUS cdr(n)])
    EQUAL ==> S_Rev(n) ¥S_PLUS n = Red([cdr(n) ¥PLUS car(n),car(n) ¥PLUS cdr(n)])
    ALGEBRA ==> Stat11: S_Rev(n) ¥S_PLUS n = Red([car(n) ¥PLUS cdr(n),car(n) ¥PLUS cdr(n)])
    (car(n) ¥PLUS cdr(n))-->T373(*) ==> Stat12: Red([car(n) ¥PLUS cdr(n),car(n) ¥PLUS cdr(n)]) = [0,0]
    (Stat10,Stat11,Stat12*)Discharge ==> QED
--
-- Using commutativity, it is trivial to generalize Theorem 390 by showing that
-- the negative of the product of two signed integers
-- is the product of either by the negative of the other.
--
Theorem 392: [Inversion lemma] ((N in Si) & (M in Si)) ¥imp
		((S_Rev(N ¥S_TIMES M) = S_Rev(N) ¥S_TIMES M) & (S_Rev(N ¥S_TIMES M) = N ¥S_TIMES S_Rev(M))). Proof:
    Suppose_not(n,m) ==> (n in Si) & (m in Si) &
		((S_Rev(n ¥S_TIMES m) /= S_Rev(n) ¥S_TIMES m) or (S_Rev(n ¥S_TIMES m) /= n ¥S_TIMES S_Rev(m)))
    (n,m)-->T390 ==> S_Rev(n ¥S_TIMES m) /= S_Rev(n) ¥S_TIMES m
    (m,n)-->T390 ==> S_Rev(m ¥S_TIMES n) = m ¥S_TIMES S_Rev(n)
    (m,n)-->T384 ==> n ¥S_TIMES m = m ¥S_TIMES n
    EQUAL ==> S_Rev(n ¥S_TIMES m) = m ¥S_TIMES S_Rev(n)
    n-->T391 ==> S_Rev(n) in Si
    (m,S_Rev(n))-->T384 ==> false; Discharge ==> QED
--
-- Next we not that for any signed integer $n$ the 'double negative'
-- $S_Rev(S_Rev(n))$ is $n$. The proof follows from the fact that
-- a double reversal of any pair yields the original pair.
--
Theorem 393: [Inversion lemma II] (N in Si) ¥imp (S_Rev(S_Rev(N)) = N). Proof:
	Suppose_not(n) ==> (n in Si) & (S_Rev(S_Rev(n)) /= n)
	n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
	Use_def(S_Rev) ==> Stat1: S_Rev(n) = [cdr(n),car(n)]
	EQUAL ==> S_Rev([cdr(n),car(n)]) /= n
	Use_def(S_Rev) ==> [cdr([cdr(n),car(n)]),car([cdr(n),car(n)])] /= n
	Discharge ==> QED
--
-- Our next aim is to prove the associative law for signed integer multiplication.
-- We approach this via a sequence of steps: first the case of three non-negative signed integers is considered;
-- next the case of one general signed integer and two non-negative signed integers; next the case
-- one two signed integers and one non-negative signed integer; and then finally the general case.
--
-- Our first lemma states the associativity rule for multiplication of three non-negative signed integers.
--
Theorem 394: [Associativity lemma]
 	((N in Za) & (M in Za) & (K in Za)) ¥imp ([N,0] ¥S_TIMES ([M,0] ¥S_TIMES [K,0]) = ([N,0] ¥S_TIMES [M,0]) ¥S_TIMES [K,0]). Proof:
    Suppose_not(n,m,k) ==> (n in Za) & (m in Za) & (k in Za) & ([n,0] ¥S_TIMES ([m,0] ¥S_TIMES [k,0]) /= ([n,0] ¥S_TIMES [m,0]) ¥S_TIMES [k,0])
--
-- In this case the proof follows directly from the definition of signed integer multiplication and the
-- associative law of unsigned integer multiplication.
--
    (m,k)-->T388 ==> [m,0] ¥S_TIMES [k,0] = [m ¥TIMES k,0]
    (n,m)-->T388 ==> [n,0] ¥S_TIMES [m,0] = [n ¥TIMES m,0]
    ALGEBRA ==> (m ¥TIMES k in Za) & (n ¥TIMES m in Za)
    EQUAL ==> (([n,0] ¥S_TIMES ([m,0] ¥S_TIMES [k,0])) = ([n,0] ¥S_TIMES [m ¥TIMES k,0])) &
	((([n,0] ¥S_TIMES [m,0]) ¥S_TIMES [k,0]) = ([n ¥TIMES m,0] ¥S_TIMES [k,0]))
    (n ¥TIMES m,k)-->T388 ==> (([n,0] ¥S_TIMES [m,0]) ¥S_TIMES [k,0]) = [(n ¥TIMES m) ¥TIMES k,0]
    (n,m ¥TIMES k)-->T388 ==> ([n,0] ¥S_TIMES ([m,0] ¥S_TIMES [k,0])) = [n ¥TIMES (m ¥TIMES k),0]
    ALGEBRA ==> n ¥TIMES (m ¥TIMES k) = (n ¥TIMES m) ¥TIMES k
    Discharge ==> QED
--
-- Next we prove the associativity rule for multiplication of two non-negative signed integers and one general
-- signed integer.
--
Theorem 395: [Associativity lemma]
    ((K in Si) & (N in Za) & (M in Za)) ¥imp ([N,0] ¥S_TIMES ([M,0] ¥S_TIMES K) = ([N,0] ¥S_TIMES [M,0]) ¥S_TIMES K). Proof:
    Suppose_not(k,n,m) ==>
	(k in Si) & (n in Za) & (m in Za) & ([n,0] ¥S_TIMES ([m,0] ¥S_TIMES k) /= ([n,0] ¥S_TIMES [m,0]) ¥S_TIMES k)
--
-- Consider a counterexample $k,n,m$. The case in which $k = [car(k),0]$ is nonnegative is covered by
-- Theorem 394, so we have only to consider the case in which $k = [0,cdr(k)]$ is negative, and thus
-- $S_Rev(k) = [cdr(k),0]$ is non-negative.
--
    k-->T369 ==> (k = [car(k),0] or k = [0,cdr(k)]) & (car(k) in Za) & (cdr(k) in Za)
    Suppose ==> k = [car(k),0]
    EQUAL ==> [n,0] ¥S_TIMES ([m,0] ¥S_TIMES [car(k),0]) /= ([n,0] ¥S_TIMES [m,0]) ¥S_TIMES [car(k),0]
    (n,m,car(k))-->T394 ==> false; Discharge ==> k = [0,cdr(k)]
    Use_def(S_Rev) ==> S_Rev(k) = [cdr(k),0]
    T211 ==> 0 in Za
    Suppose ==> [n,0] notin Si
    Use_def(Si) ==> Stat1: [n,0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(n,0)-->Stat1 ==> false; Discharge ==> [n,0] in Si
    Suppose ==> [m,0] notin Si
    Use_def(Si) ==> Stat2: [m,0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(m,0)-->Stat2 ==> false; Discharge ==> [m,0] in Si
    Suppose ==> S_Rev(k) notin Si
    Use_def(Si) ==> Stat3: [cdr(k),0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(cdr(k),0)-->Stat3 ==> false; Discharge ==> S_Rev(k) in Si
    ([n,0],[m,0])-->T371 ==> ([n,0] ¥S_TIMES [m,0]) in Si
    ([m,0],k)-->T371 ==> ([m,0] ¥S_TIMES k) in Si
--
-- In this case associativity applies to the product $[n,0] ¥S_TIMES ([m,0] ¥S_TIMES S_Rev(k))$,
-- and so several uses of Theorem 392 and of the associative law for unsigned integers
-- brings us to the desired result.
--
    (n,m,cdr(k))-->T394 ==> ([n,0] ¥S_TIMES ([m,0] ¥S_TIMES [cdr(k),0])) = (([n,0] ¥S_TIMES [m,0]) ¥S_TIMES [cdr(k),0])
    EQUAL ==> ([n,0] ¥S_TIMES ([m,0] ¥S_TIMES S_Rev(k))) = (([n,0] ¥S_TIMES [m,0]) ¥S_TIMES S_Rev(k))
    ([n,0] ¥S_TIMES [m,0],k)-->T392 ==>
	([n,0] ¥S_TIMES [m,0]) ¥S_TIMES S_Rev(k) = S_Rev(([n,0] ¥S_TIMES [m,0]) ¥S_TIMES k)
    ([m,0],k)-->T392 ==> ([m,0] ¥S_TIMES S_Rev(k)) = S_Rev([m,0] ¥S_TIMES k)
    ([n,0],[m,0] ¥S_TIMES k)-->T392 ==> [n,0] ¥S_TIMES S_Rev([m,0] ¥S_TIMES k) = S_Rev([n,0] ¥S_TIMES ([m,0] ¥S_TIMES k))
    EQUAL ==> S_Rev(S_Rev([n,0] ¥S_TIMES ([m,0] ¥S_TIMES k))) = S_Rev(S_Rev(([n,0] ¥S_TIMES [m,0]) ¥S_TIMES k))
    ([n,0],[m,0] ¥S_TIMES k)-->T371 ==> [n,0] ¥S_TIMES ([m,0] ¥S_TIMES k) in Si
    ([n,0] ¥S_TIMES [m,0],k)-->T371 ==> ([n,0] ¥S_TIMES [m,0]) ¥S_TIMES k in Si
    ([n,0] ¥S_TIMES ([m,0] ¥S_TIMES k))-->T391 ==>
	S_Rev(S_Rev([n,0] ¥S_TIMES ([m,0] ¥S_TIMES k))) = [n,0] ¥S_TIMES ([m,0] ¥S_TIMES k)
    (([n,0] ¥S_TIMES [m,0]) ¥S_TIMES k)-->T391 ==> false; Discharge ==> QED
--
-- Next we prove the associativity rule for multiplication of a non-negative signed integer and two general
-- signed integers.
--
Theorem 396: [Associativity lemma II]
    ((K in Si) & (N in Za) & (M in Si)) ¥imp ([N,0] ¥S_TIMES (M ¥S_TIMES K) = ([N,0] ¥S_TIMES M) ¥S_TIMES K). Proof:
    Suppose_not(k,n,m) ==>
	(k in Si) & (n in Za) & (m in Si) & (([n,0] ¥S_TIMES (m ¥S_TIMES k) /= ([n,0] ¥S_TIMES m) ¥S_TIMES k))
--
-- Consider a counterexample k,n,m. The case in which $m = [car(m),0]$ is nonnegative is covered by
-- Theorem 394, so we have only to consider the case in which $m = [0,cdr(m)]$ is negative, and thus
-- $S_Rev(m) = [cdr(m),0]$ is non-negative.
--
    T211 ==> 0 in Za
    m-->T369 ==> (m = [car(m),0] or m = [0,cdr(m)]) & (car(m) in Za) & (cdr(m) in Za)
    Suppose ==> m = [car(m),0]
    EQUAL ==> [n,0] ¥S_TIMES ([car(m),0] ¥S_TIMES k) /= ([n,0] ¥S_TIMES [car(m),0]) ¥S_TIMES k
    (k,n,car(m))-->T395 ==> false; Discharge ==> m = [0,cdr(m)]
    Use_def(S_Rev) ==> S_Rev(m) = [cdr(m),0]
    Suppose ==> [n,0] notin Si
    Use_def(Si) ==> Stat1: [n,0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(n,0)-->Stat1 ==> false; Discharge ==> [n,0] in Si
    Suppose ==> S_Rev(m) notin Si
    Use_def(Si) ==> Stat2: [cdr(m),0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(cdr(m),0)-->Stat2 ==> false; Discharge ==> S_Rev(m) in Si
    ([n,0],m)-->T371 ==> [n,0] ¥S_TIMES m in Si
    (m,k)-->T371 ==> m ¥S_TIMES k in Si
--
-- In this case associativity applies to the product $[N,0] ¥S_TIMES ([cdr(m),0] ¥S_TIMES k)$,
-- leading directly via  manipulation of the reversal operator $S_Rev$ to the formula we need.
--
    (k,n,cdr(m))-->T395 ==> ([n,0] ¥S_TIMES ([cdr(m),0] ¥S_TIMES k)) = (([n,0] ¥S_TIMES [cdr(m),0]) ¥S_TIMES k)
    EQUAL ==> ([n,0] ¥S_TIMES (S_Rev(m) ¥S_TIMES k)) = (([n,0] ¥S_TIMES S_Rev(m)) ¥S_TIMES k)
    ([n,0],m)-->T392 ==> [n,0] ¥S_TIMES S_Rev(m) = S_Rev([n,0] ¥S_TIMES m)
    (m,k)-->T392 ==> S_Rev(m) ¥S_TIMES k = S_Rev(m ¥S_TIMES k)
    EQUAL ==> S_Rev([n,0] ¥S_TIMES m) ¥S_TIMES k = [n,0] ¥S_TIMES S_Rev(m ¥S_TIMES k)
    ([n,0] ¥S_TIMES m,k)-->T392 ==> S_Rev([n,0] ¥S_TIMES m) ¥S_TIMES k = S_Rev(([n,0] ¥S_TIMES m) ¥S_TIMES k)
    ([n,0],m ¥S_TIMES k)-->T392 ==> [n,0] ¥S_TIMES S_Rev(m ¥S_TIMES k) = S_Rev([n,0] ¥S_TIMES (m ¥S_TIMES k))
    EQUAL ==> S_Rev(S_Rev([n,0] ¥S_TIMES (m ¥S_TIMES k))) = S_Rev(S_Rev(([n,0] ¥S_TIMES m) ¥S_TIMES k))
    ([n,0],m ¥S_TIMES k)-->T371 ==> [n,0] ¥S_TIMES (m ¥S_TIMES k) in Si
    ([n,0] ¥S_TIMES m,k)-->T371 ==> ([n,0] ¥S_TIMES m) ¥S_TIMES k in Si
    ([n,0] ¥S_TIMES (m ¥S_TIMES k))-->T391 ==>
	S_Rev(S_Rev([n,0] ¥S_TIMES (m ¥S_TIMES k))) = [n,0] ¥S_TIMES (m ¥S_TIMES k)
    (([n,0] ¥S_TIMES m) ¥S_TIMES k)-->T391 ==> false; Discharge ==> QED
--
-- Finally we prove the associativity rule for multiplication of signed integers in the general case.
--
Theorem 397: [Associative law] ((K in Si) & (N in Si) & (M in Si)) ¥imp (N ¥S_TIMES (M ¥S_TIMES K) = (N ¥S_TIMES M) ¥S_TIMES K). Proof:
	Suppose_not(k,n,m) ==>
     (k in Si) & (n in Si) & (m in Si) & (n ¥S_TIMES (m ¥S_TIMES k) /= (n ¥S_TIMES m) ¥S_TIMES k)
--
-- Consider a counterexample $k,n,m$. The case in which $n = [car(n),0]$ is nonnegative is covered by
-- Theorem 394, so we have only to consider the case in which $n = [0,cdr(n)]$ is negative, and thus
-- $S_Rev(n) = [cdr(n),0]$ is non-negative.
--
    n-->T369 ==> (n = [car(n),0] or n = [0,cdr(n)]) & (car(n) in Za) & (cdr(n) in Za)
    T211 ==> 0 in Za
    Suppose ==> n = [car(n),0]
    EQUAL ==> [car(n),0] ¥S_TIMES (m ¥S_TIMES k) /= ([car(n),0] ¥S_TIMES m) ¥S_TIMES k
    (k,car(n),m)-->T396 ==> false; Discharge ==> n = [0,cdr(n)]
    Use_def(S_Rev) ==> S_Rev(n) = [cdr(n),0]
    Suppose ==> S_Rev(n) notin Si
    Use_def(Si) ==> Stat1: [cdr(n),0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(cdr(n),0)-->Stat1 ==> false; Discharge ==> S_Rev(n) in Si
--
-- But in this case the preceding theorem tells us that associativity applies to the product
-- $S_Rev(n) ¥S_TIMES (m ¥S_TIMES k)$, and so we can derive the required conclusion
-- by an easy manipulation of the reversal operator $S_Rev$.
--
    (n,m)-->T371 ==> n ¥S_TIMES m in Si
    (m,k)-->T371 ==> m ¥S_TIMES k in Si
    (k,cdr(n),m)-->T396 ==> [cdr(n),0] ¥S_TIMES (m ¥S_TIMES k) = ([cdr(n),0] ¥S_TIMES m) ¥S_TIMES k
    EQUAL ==> S_Rev(n) ¥S_TIMES (m ¥S_TIMES k) = (S_Rev(n) ¥S_TIMES m) ¥S_TIMES k
    (n,m ¥S_TIMES k)-->T392 ==> S_Rev(n) ¥S_TIMES (m ¥S_TIMES k) = S_Rev(n ¥S_TIMES (m ¥S_TIMES k))
    (n,m)-->T392 ==> S_Rev(n) ¥S_TIMES m = S_Rev(n ¥S_TIMES m)
    EQUAL ==> S_Rev(n ¥S_TIMES m) ¥S_TIMES k = S_Rev(n ¥S_TIMES (m ¥S_TIMES k))
    (n ¥S_TIMES m,k)-->T392 ==> S_Rev(n ¥S_TIMES m) ¥S_TIMES k = S_Rev((n ¥S_TIMES m) ¥S_TIMES k)
    (n,m ¥S_TIMES k)-->T392 ==> n ¥S_TIMES S_Rev(m ¥S_TIMES k) = S_Rev(n ¥S_TIMES (m ¥S_TIMES k))
    EQUAL ==> S_Rev(S_Rev(n ¥S_TIMES (m ¥S_TIMES k))) = S_Rev(S_Rev((n ¥S_TIMES m) ¥S_TIMES k))
    (n,m ¥S_TIMES k)-->T371 ==> n ¥S_TIMES (m ¥S_TIMES k) in Si
    (n ¥S_TIMES m,k)-->T371 ==> (n ¥S_TIMES m) ¥S_TIMES k in Si
    (n ¥S_TIMES (m ¥S_TIMES k))-->T391 ==>
	S_Rev(S_Rev(n ¥S_TIMES (m ¥S_TIMES k))) = n ¥S_TIMES (m ¥S_TIMES k)
    ((n ¥S_TIMES m) ¥S_TIMES k)-->T391 ==> false; Discharge ==> QED
--
-- Next we prove that subtraction of one signed integer from another
-- is equivalent to addition of the negative of the first to the second.
--
Theorem 398: [Subtraction is addition of the negative] ((N in Si) & (M in Si)) ¥imp ((N ¥S_MINUS M) = (N ¥S_PLUS S_Rev(M))). Proof:
    Suppose_not(n,m) ==> (n in Si) & (m in Si) & ((n ¥S_MINUS m) /= (n ¥S_PLUS S_Rev(m)))
--
-- The proof results easily by expanding the definitions of the operators involved and a bit of unsigned integer arithmetic.
--
    Use_def(Si) ==> Stat1: m in {[x,y]: x in Za, y in Za | ((x = 0) or (y = 0))}
    (m1,m2)-->Stat1 ==> (m = [m1,m2]) & (m1 in Za) & (m2 in Za)
    ELEM ==> (m = [car(m),cdr(m)]) & (car(m) in Za) & (cdr(m) in Za)
    Use_def(Si) ==> Stat2: n in {[x,y]: x in Za, y in Za | ((x = 0) or (y = 0))}
    (n1,n2)-->Stat2 ==> Stat3: (n = [n1,n2]) & (n1 in Za) & (n2 in Za)
    (Stat3)ELEM ==> (n = [car(n),cdr(n)]) & (car(n) in Za) & (cdr(n) in Za)
    Use_def(¥S_MINUS) ==> n ¥S_MINUS m = Red([cdr(m) ¥PLUS car(n),car(m) ¥PLUS cdr(n)])
    Use_def(S_Rev) ==> Stat4: S_Rev(m) = [cdr(m),car(m)]
    (Stat4)ELEM ==> (car(S_Rev(m)) = cdr(m)) & (cdr(S_Rev(m)) = car(m))
    Use_def(¥S_PLUS) ==> n ¥S_PLUS S_Rev(m) = Red([car(n) ¥PLUS car(S_Rev(m)),cdr(n) ¥PLUS cdr(S_Rev(m))])
    EQUAL ==> n ¥S_PLUS S_Rev(m) = Red([car(n) ¥PLUS cdr(m),cdr(n) ¥PLUS car(m)])
    ALGEBRA ==> ((cdr(m) ¥PLUS car(n)) = (car(n) ¥PLUS cdr(m))) & ((car(m) ¥PLUS cdr(n)) = (cdr(n) ¥PLUS car(m)))
    EQUAL ==> false; Discharge ==> QED
--
-- The following theorem tells us that for signed integers subtraction is always the reverse of addition.
-- It is this generalization of the corresponding but more restricted rule for unsigned integers that
-- justifies the introduction of the signed integers.
--
Theorem 399: [Subtraction reverses signed integer addition] ((N in Si) & (M in Si)) ¥imp (N = M ¥S_PLUS (N ¥S_MINUS M)). Proof:
    Suppose_not(n,m) ==> (n in Si) & (m in Si) & (n /= m ¥S_PLUS (n ¥S_MINUS m))
--
-- By expanding the definitions of the operators involved, a bit of unsigned integer arithmetic,
-- and elimination of superfluous reduction operators, we can readily reduce the negative of our assertion
-- to the inequality seen below.
--
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    ELEM ==> car(n) * cdr(n) = 0
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
    Use_def(¥S_MINUS) ==> n /= m ¥S_PLUS Red([cdr(m) ¥PLUS car(n),car(m) ¥PLUS cdr(n)])
    ALGEBRA ==> (cdr(m) ¥PLUS car(n) in Za) & (car(m) ¥PLUS cdr(n) in Za) & (car(m) ¥PLUS cdr(m) in Za)
    (m,cdr(m) ¥PLUS car(n),car(m) ¥PLUS cdr(n))-->T377 ==>
    	m ¥S_PLUS Red([cdr(m) ¥PLUS car(n),car(m) ¥PLUS cdr(n)]) = m ¥S_PLUS [cdr(m) ¥PLUS car(n),car(m) ¥PLUS cdr(n)]
    Use_def(¥S_PLUS) ==> m ¥S_PLUS [cdr(m) ¥PLUS car(n),car(m) ¥PLUS cdr(n)] =
     							Red([car(m) ¥PLUS car([cdr(m) ¥PLUS car(n),car(m) ¥PLUS cdr(n)]),
     								cdr(m) ¥PLUS cdr([cdr(m) ¥PLUS car(n),car(m) ¥PLUS cdr(n)])])
    ELEM ==> car([cdr(m) ¥PLUS car(n),car(m) ¥PLUS cdr(n)]) = cdr(m) ¥PLUS car(n)
    ELEM ==> cdr([cdr(m) ¥PLUS car(n),car(m) ¥PLUS cdr(n)]) = car(m) ¥PLUS cdr(n)
    EQUAL ==> m ¥S_PLUS [cdr(m) ¥PLUS car(n),car(m) ¥PLUS cdr(n)] =
     							Red([car(m) ¥PLUS (cdr(m) ¥PLUS car(n)),cdr(m) ¥PLUS (car(m) ¥PLUS cdr(n))])
    ELEM ==> n /= Red([car(m) ¥PLUS (cdr(m) ¥PLUS car(n)),cdr(m) ¥PLUS (car(m) ¥PLUS cdr(n))])
--
-- But since the same quantity $car(m) ¥PLUS cdr(m)$ is added to both components
-- of the pair appearing on the right of this last equality, it reduces readily to the
-- contradictory form $n /= [car(n),cdr(n)]$, thereby proving our assertion.
--
    ALGEBRA ==> n /= Red([car(n) ¥PLUS (car(m) ¥PLUS cdr(m)),cdr(n) ¥PLUS (car(m) ¥PLUS cdr(m))])
    (car(n),cdr(n),car(m) ¥PLUS cdr(m))-->T374 ==> n /= Red([car(n),cdr(n)])
    Use_def(Red) ==> n /= [car(n) ¥MINUS (car(n) * cdr(n)),cdr(n) ¥MINUS (car(n) * cdr(n))]
    EQUAL ==> n /= [car(n) ¥MINUS 0,cdr(n) ¥MINUS 0]
    (car(n))-->T268 ==> car(n) ¥MINUS 0 = #car(n)
    (cdr(n))-->T268 ==> cdr(n) ¥MINUS 0 = #cdr(n)
    (car(n))-->T206 ==> Card(car(n))
    (cdr(n))-->T206 ==> Card(cdr(n))
    (car(n))-->T164 ==> car(n) ¥MINUS 0 = car(n)
    (cdr(n))-->T164 ==> cdr(n) ¥MINUS 0 = cdr(n)
    EQUAL ==> false; Discharge ==> QED
--
-- Next we prove that the negative of $m ¥S_PLUS n$ is the sum of $S_Rev(n)$ and $S_Rev(m)$.
--
Theorem 400: [The negative of a sum is the sum of the negatives] ((N in Si) & (M in Si)) ¥imp (S_Rev(N ¥S_PLUS M) = S_Rev(N) ¥S_PLUS S_Rev(M)). Proof:
    Suppose_not(n,m) ==> (n in Si) & (m in Si) & (S_Rev(n ¥S_PLUS m) /= S_Rev(n) ¥S_PLUS S_Rev(m))
--
--
--
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    Use_def(S_Rev) ==> Stat1: S_Rev(n) = [cdr(n),car(n)]
	(Stat1)ELEM ==> car(S_Rev(n)) = cdr(n)
        (Stat1,Stat1)ELEM ==> cdr(S_Rev(n)) = car(n)
    Use_def(S_Rev) ==> Stat2: S_Rev(m) = [cdr(m),car(m)]
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
	(Stat2,Stat2)ELEM ==> car(S_Rev(m)) = cdr(m)
	(Stat2,Stat2)ELEM ==> cdr(S_Rev(m)) = car(m)
--
    Use_def(¥S_PLUS) ==> n ¥S_PLUS m = Red([car(n) ¥PLUS car(m),cdr(n) ¥PLUS cdr(m)])
	Use_def(¥S_PLUS) ==> S_Rev(n) ¥S_PLUS S_Rev(m) = Red([car(S_Rev(n)) ¥PLUS car(S_Rev(m)),cdr(S_Rev(n)) ¥PLUS cdr(S_Rev(m))])
	EQUAL ==> S_Rev(n) ¥S_PLUS S_Rev(m) = Red([cdr(n) ¥PLUS cdr(m),car(n) ¥PLUS car(m)])
	EQUAL ==> S_Rev(N ¥S_PLUS M) = S_Rev(Red([car(n) ¥PLUS car(m),cdr(n) ¥PLUS cdr(m)]))
	ALGEBRA ==> (car(n) ¥PLUS car(m) in Za) & (cdr(n) ¥PLUS cdr(m) in Za)
	(cdr(n) ¥PLUS cdr(m),car(n) ¥PLUS car(m))-->T389 ==> false; Discharge ==> QED
--
-- We now go on to establish multiplication rules for the signed integer constants zero and one,
-- proving that zero times anything is zero, while one times any signed integer $n$ is $n$.
-- Moreover the product of the reverse $[0,1]$ of $[1,0]$ by itself is $[1,0]$.
--
Theorem 401: [Basic properties of the signed integers 0 and 1] (([0,1] ¥S_TIMES [0,1]) = [1,0]) & ((X in Si) ¥imp ((([1,0] ¥S_TIMES X) = X) & (([0,0] ¥S_TIMES X) = [0,0]))). Proof:
    Suppose_not(x) ==> (([0,1] ¥S_TIMES [0,1]) /= [1,0]) or ((x in Si) & ((([1,0] ¥S_TIMES x) /= x) or
    						(([0,0] ¥S_TIMES x) /= [0,0])))
--
--
--
    Use_def(¥S_TIMES) ==> ([0,1] ¥S_TIMES [0,1]) =
    						Red([(car([0,1]) ¥TIMES car([0,1])) ¥PLUS (cdr([0,1]) ¥TIMES cdr([0,1])),
    								(car([0,1]) ¥TIMES cdr([0,1])) ¥PLUS (car([0,1]) ¥TIMES cdr([0,1]))])
    ELEM ==> (car([0,1]) = 0) & (cdr([0,1]) = 1) & (1 * 0 = 0)
    T211 ==> Stat1: (1 in Za) & (0 in Za)
    EQUAL ==> ([0,1] ¥S_TIMES [0,1]) = Red([(0 ¥TIMES 0) ¥PLUS (1 ¥TIMES 1),(0 ¥TIMES 1) ¥PLUS (0 ¥TIMES 1)])
    ALGEBRA ==> (([0,1] ¥S_TIMES [0,1]) = Red([1,0]))
    T211 ==> Card(1)
    T211 ==> Card(0)
    1-->T164 ==> Stat2: 1 = #1
    0-->T164 ==> 0 = #0
    Use_def(Red) ==> ([0,1] ¥S_TIMES [0,1]) = [1 ¥MINUS (1 * 0),0 ¥MINUS (1 * 0)]
    EQUAL ==> Stat3: ([0,1] ¥S_TIMES [0,1]) = [1 ¥MINUS 0,0 ¥MINUS 0]
    1-->T268(Stat3,Stat2) ==> ([0,1] ¥S_TIMES [0,1]) = [1,0 ¥MINUS 0]
    0-->T268 ==> 0 ¥MINUS 0 = #0
    EQUAL ==> Stat4: (x in Si) & ((([1,0] ¥S_TIMES x) /= x) or (([0,0] ¥S_TIMES x) /= [0,0]))
    Use_def(¥S_TIMES) ==> ([0,0] ¥S_TIMES x) = Red([(car([0,0]) ¥TIMES car(x)) ¥PLUS (cdr([0,0]) ¥TIMES cdr(x)),
    					(car([0,0]) ¥TIMES cdr(x)) ¥PLUS (car(x) ¥TIMES cdr([0,0]))])
    TELEM ==> (car([0,0]) = 0) & (cdr([0,0]) = 0) & (car([1,0]) = 1) & (cdr([1,0]) = 0)
    EQUAL ==> ([0,0] ¥S_TIMES x) =
    	Red([(0 ¥TIMES car(x)) ¥PLUS (0 ¥TIMES cdr(x)),(0 ¥TIMES cdr(x)) ¥PLUS (car(x) ¥TIMES 0)])
    Use_def(Si) ==> Stat5: x in {[u,y]: u in Za, y in Za | u = 0 or y = 0}
    (u,y)-->Stat5 ==> Stat6: (x = [u,y]) & (u in Za) & (y in Za) & (u = 0 or y = 0)
    (Stat6*)ELEM ==> Stat7: x = [u,y]
    (Stat7)ELEM ==> Stat8: (car(x) = u) & (cdr(x) = y) & (x = [car(x),cdr(x)])
    (Stat6,Stat8*)ELEM ==> Stat9: (car(x) in Za) & (cdr(x) in Za) & (car(x) * cdr(x) = 0)
    (car(x))-->T207(Stat9*) ==> car(x) = #car(x)
    (cdr(x))-->T207(Stat9*) ==> cdr(x) = #cdr(x)
    ALGEBRA ==> Stat10: ([0,0] ¥S_TIMES x) = Red([0,0])
 	0-->T373(Stat10,Stat1) ==> Stat11: ([0,0] ¥S_TIMES x) = [0,0]
    Use_def(¥S_TIMES) ==> ([1,0] ¥S_TIMES x) = Red([(car([1,0]) ¥TIMES car(x)) ¥PLUS (cdr([1,0]) ¥TIMES cdr(x)),
    					(car([1,0]) ¥TIMES cdr(x)) ¥PLUS (car(x) ¥TIMES cdr([1,0]))])
 	EQUAL ==> ([1,0] ¥S_TIMES x) =
    	Red([(1 ¥TIMES car(x)) ¥PLUS (0 ¥TIMES cdr(x)),(1 ¥TIMES cdr(x)) ¥PLUS (car(x) ¥TIMES 0)])
    ALGEBRA ==> ([1,0] ¥S_TIMES x) = Red([car(x),cdr(x)])
 	EQUAL ==> Stat12: ([1,0] ¥S_TIMES x) = Red(x)
 	Use_def(Red) ==> Red(x) = [car(x) ¥MINUS (car(x) * cdr(x)),cdr(x) ¥MINUS (car(x) * cdr(x))]
 	EQUAL ==> Stat13: Red(x) = [car(x) ¥MINUS 0,cdr(x) ¥MINUS 0]
    (car(x))-->T268 ==> car(x) ¥MINUS 0 = #car(x)
    (cdr(x))-->T268 ==> cdr(x) ¥MINUS 0 = #cdr(x)
 	EQUAL ==> Stat14: Red(x) = [car(x),cdr(x)]
 	(Stat12,Stat14,Stat8,Stat9*)ELEM ==> Stat15: ([1,0] ¥S_TIMES x) = x
    (Stat4,Stat15,Stat11*)Discharge ==> QED
--
-- It follows trially from the preceding theorem that the product
-- of any signed integer $n$ by one is $n$.
--
Theorem 402: [1 is the multiplicative unit for signed integers] (K in Si) ¥imp (K ¥S_TIMES [1,0] = K). Proof:
    Suppose_not(k) ==> (k in Si) & (k ¥S_TIMES [1,0] /= k)
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) in Za) & (cdr(k) in Za) & (car(k) = 0 or cdr(k) = 0)
    T211 ==> (1 in Za) & (0 in Za)
    Use_def(¥S_TIMES) ==> (k ¥S_TIMES [1,0]) = Red([(car(k) ¥TIMES car([1,0])) ¥PLUS (cdr(k) ¥TIMES cdr([1,0])),
			(car(k) ¥TIMES cdr([1,0])) ¥PLUS (car([1,0]) ¥TIMES cdr(k))])
    ELEM ==> (car([1,0]) = 1) & (cdr([1,0]) = 0) & (1 * 0 = 0)
    EQUAL ==> (k ¥S_TIMES [1,0]) = Red([(car(k) ¥TIMES 1) ¥PLUS (cdr(k) ¥TIMES 0),(car(k) ¥TIMES 0) ¥PLUS (1 ¥TIMES cdr(k))])
    ALGEBRA ==> k ¥S_TIMES [1,0] = Red([car(k),cdr(k)])
    Use_def(Red) ==> k ¥S_TIMES [1,0] = [car(k) ¥MINUS (car(k) * cdr(k)),cdr(k) ¥MINUS (car(k) * cdr(k))]
    ELEM ==> car(k) * cdr(k) = 0
    EQUAL ==> k ¥S_TIMES [1,0] = [car(k) ¥MINUS 0,cdr(k) ¥MINUS 0]
    (car(k))-->T268 ==> car(k) ¥MINUS 0 = #car(k)
    (cdr(k))-->T268 ==> cdr(k) ¥MINUS 0 = #cdr(k)
    (car(k))-->T207 ==> car(k) = #car(k)
    (cdr(k))-->T207 ==> cdr(k) = #cdr(k)
    EQUAL ==> false; Discharge ==> QED
--
--
--
Theorem 403: [The negative of a signed integer is its product by -1] ((K in Si) & (M in Si)) ¥imp (K ¥S_MINUS M = K ¥S_PLUS (M ¥S_TIMES [0,1])). Proof:
    Suppose_not(k,m) ==> (k in Si) & (m in Si) & (k ¥S_MINUS m /= k ¥S_PLUS (m ¥S_TIMES [0,1]))
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) in Za) & (cdr(k) in Za) & (car(k) = 0 or cdr(k) = 0) & (Red(k) = k)
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) in Za) & (cdr(m) in Za) & (car(m) = 0 or cdr(m) = 0) & (Red(m) = m)
    Use_def(¥S_TIMES) ==>
	 m ¥S_TIMES [0,1] = Red([(car(m) ¥TIMES car([0,1])) ¥PLUS (cdr(m) ¥TIMES cdr([0,1])),(car(m) ¥TIMES cdr([0,1])) ¥PLUS (car([0,1]) ¥TIMES cdr(m))])
    ELEM ==> (car([0,1]) = 0) & (cdr([0,1]) = 1)
    EQUAL ==>
	m ¥S_TIMES [0,1] = Red([(car(m) ¥TIMES 0) ¥PLUS (cdr(m) ¥TIMES 1),(car(m) ¥TIMES 1) ¥PLUS (0 ¥TIMES cdr(m))])
    ALGEBRA ==> m ¥S_TIMES [0,1] = Red([cdr(m),car(m)])
    Use_def(¥S_MINUS) ==> k ¥S_MINUS m = Red([cdr(m) ¥PLUS car(k),car(m) ¥PLUS cdr(k)])
    EQUAL ==> k ¥S_PLUS (m ¥S_TIMES [0,1]) = k ¥S_PLUS Red([cdr(m),car(m)])
    (k,cdr(m),car(m))-->T377 ==> k ¥S_PLUS (m ¥S_TIMES [0,1]) = k ¥S_PLUS [cdr(m),car(m)]
    Use_def(¥S_PLUS) ==> k ¥S_PLUS (m ¥S_TIMES [0,1]) = Red([car(k) ¥PLUS cdr(m),cdr(k) ¥PLUS car(m)])
    ELEM ==> Red([cdr(m) ¥PLUS car(k),car(m) ¥PLUS cdr(k)]) /= Red([car(k) ¥PLUS cdr(m),cdr(k) ¥PLUS car(m)])
    ALGEBRA ==> false; Discharge ==> QED
--
-- Next we note that for any singed integer $k$, $k ¥S_MINUS k$ is zero.
-- The proof results trivially from the definition of the operators involved.
--
Theorem 404: [A signed integer minus itself gives 0] (K in Si) ¥imp (K ¥S_MINUS K = [0,0]). Proof:
    Suppose_not(k) ==> (k in Si) & (k ¥S_MINUS k /= [0,0])
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) in Za) & (cdr(k) in Za) & (car(k) = 0 or cdr(k) = 0) & (Red(k) = k)
    Use_def(¥S_MINUS) ==> k ¥S_MINUS k = Red([cdr(k) ¥PLUS car(k),car(k) ¥PLUS cdr(k)])
    ALGEBRA ==> Red([car(k) ¥PLUS cdr(k),car(k) ¥PLUS cdr(k)]) /= [0,0]
    ALGEBRA ==> car(k) ¥PLUS cdr(k) in Za
    (car(k) ¥PLUS cdr(k))-->T373 ==> false; Discharge ==> QED
--
-- It follows equally trivially that the sum of any signed integer $k$ and zero is $k$.
--
Theorem 405: [0 is the right additive identity for signed integers] (K in Si) ¥imp (K ¥S_PLUS [0,0] = K). Proof:
    Suppose_not(k) ==> (k in Si) & (k ¥S_PLUS [0,0] /= k)
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) in Za) & (cdr(k) in Za) & (Red(k) = k)
    Use_def(¥S_PLUS) ==> k ¥S_PLUS [0,0] = Red([car(k) ¥PLUS 0,cdr(k) ¥PLUS 0])
    ALGEBRA ==> k ¥S_PLUS [0,0] = Red([car(k),cdr(k)])
    EQUAL ==> false; Discharge ==> QED
--
-- And so it follows equally trivially by commutativity that the sum of zero and any signed integer $k$ is $k$.
--
Theorem 406: [0 is the left additive identity for signed integers] (K in Si) ¥imp ([0,0] ¥S_PLUS K = K). Proof:
    Suppose_not(k) ==> (k in Si) & ([0,0] ¥S_PLUS k /= k)
    T368 ==> [0,0] in Si
    ([0,0],k)-->T381 ==> [0,0] ¥S_PLUS k = k ¥S_PLUS [0,0]
    k-->T405 ==> k ¥S_PLUS [0,0] = k
    Discharge ==> QED
--
-- The following easy theorem gives the very important cancellation rule for signed integer multiplication:
-- if the product of two signed integers is zero, one of them must be zero. This fact
-- is central to the discussion of rational numbers which follows subsequently.
--
Theorem 407: [$Si$ is an Integral Domain]
	((N in Si) & (M in Si) & ((M ¥S_TIMES N) = [0,0])) ¥imp ((M = [0,0]) or (N = [0,0])). Proof:
    Suppose_not(n,m) ==> Stat1: (n in Si) & (m in Si) & (m ¥S_TIMES n = [0,0]) & (m /= [0,0]) & (n /= [0,0])
--
--
--
    m-->T369 ==> Stat2: (m = [car(m),cdr(m)]) & ((car(m) = 0) or (cdr(m) = 0)) & (car(m) in Za) & (cdr(m) in Za)
    n-->T369 ==> Stat3: (n = [car(n),cdr(n)]) & ((car(n) = 0) or (cdr(n) = 0)) & (car(n) in Za) & (cdr(n) in Za)
    Use_def(¥S_TIMES) ==> Stat4: Red([(car(m) ¥TIMES car(n)) ¥PLUS (cdr(m) ¥TIMES cdr(n)),
							(car(m) ¥TIMES cdr(n)) ¥PLUS (car(n) ¥TIMES cdr(m))]) = [0,0]
    Suppose ==> Stat5: (car(n) = 0) & (cdr(n) = 0)
    EQUAL(Stat1,Stat3,Stat5) ==> false; Discharge ==> Stat6: (not(car(n) = 0)) or (not(cdr(n) = 0))
    (Stat6)ELEM ==> (car(n) /= 0) or (cdr(n) /= 0)
    Suppose ==> Stat7: (car(m) = 0) & (cdr(m) = 0)
    EQUAL(Stat1,Stat2,Stat7) ==> false; Discharge ==> Stat8: (not(car(m) = 0)) or (not(cdr(m) = 0))
    (Stat8)ELEM ==> (car(m) /= 0) or (cdr(m) /= 0)
    Suppose ==> Stat9: car(n) /= 0
    (Stat3)ELEM ==> cdr(n) = 0
    EQUAL ==> Red([(car(m) ¥TIMES car(n)) ¥PLUS (cdr(m) ¥TIMES 0),
							(car(m) ¥TIMES 0) ¥PLUS (car(n) ¥TIMES cdr(m))]) = [0,0]
    ALGEBRA ==> Stat10: [0,0] = Red([car(m) ¥TIMES car(n),car(n) ¥TIMES cdr(m)])
    Use_def(Red) ==> Red([car(m) ¥TIMES car(n),car(n) ¥TIMES cdr(m)]) =
    	[(car(m) ¥TIMES car(n)) ¥MINUS (((car(m) ¥TIMES car(n))) * (car(n) ¥TIMES cdr(m))),
    		(car(n) ¥TIMES cdr(m)) ¥MINUS (((car(m) ¥TIMES car(n))) * (car(n) ¥TIMES cdr(m)))]
   (car(n))-->T245 ==> Stat11: car(n) ¥TIMES 0 = 0
    Suppose ==> Stat12: ((car(m) ¥TIMES car(n))) * (car(n) ¥TIMES cdr(m)) /= 0
    (Stat12)ELEM ==> (car(n) ¥TIMES cdr(m) /= 0) & (car(m) ¥TIMES car(n) /= 0)
    Suppose ==> cdr(m) = 0
    EQUAL ==> false; Discharge ==> car(m) = 0
    EQUAL ==> 0 ¥TIMES car(n) /= 0
    (0,car(n))-->T253 ==> Stat13: car(n) ¥TIMES 0 /= 0
    (Stat11,Stat13)Discharge ==> ((car(m) ¥TIMES car(n))) * (car(n) ¥TIMES cdr(m)) = 0
    EQUAL ==> Red([car(m) ¥TIMES car(n),car(n) ¥TIMES cdr(m)]) =
    	[(car(m) ¥TIMES car(n)) ¥MINUS 0,(car(n) ¥TIMES cdr(m)) ¥MINUS 0]
    (car(m) ¥TIMES car(n))-->T268 ==> (car(m) ¥TIMES car(n)) ¥MINUS 0 = #(car(m) ¥TIMES car(n))
    (car(n) ¥TIMES cdr(m))-->T268 ==> (car(n) ¥TIMES cdr(m)) ¥MINUS 0 = #(car(n) ¥TIMES cdr(m))
    EQUAL ==> Stat14:  Red([car(m) ¥TIMES car(n),car(n) ¥TIMES cdr(m)]) =
    							[#(car(m) ¥TIMES car(n)),#(car(n) ¥TIMES cdr(m))]
    (Stat14,Stat10)ELEM ==> Stat15: [#(car(m) ¥TIMES car(n)),#(car(n) ¥TIMES cdr(m))] = [0,0]
    (Stat15)ELEM ==> (#(car(m) ¥TIMES car(n)) = 0) & (#(car(n) ¥TIMES cdr(m)) = 0)
    (car(m) ¥TIMES car(n))-->T162 ==> Stat16: car(m) ¥TIMES car(n) = 0
    (car(n) ¥TIMES cdr(m))-->T162 ==> Stat17: car(n) ¥TIMES cdr(m) = 0
    (car(m),car(n))-->T309(Stat16,Stat9) ==> car(m) = 0
    (car(n),cdr(m))-->T309(Stat17,Stat9) ==> cdr(m) = 0
    Discharge ==> Stat18: (car(n) = 0) & (cdr(n) /= 0)
    EQUAL ==>  Red([(car(m) ¥TIMES 0) ¥PLUS (cdr(m) ¥TIMES cdr(n)),
							(car(m) ¥TIMES cdr(n)) ¥PLUS (0 ¥TIMES cdr(m))]) = [0,0]
    ALGEBRA ==> Stat19: [0,0] = Red([cdr(m) ¥TIMES cdr(n),car(m) ¥TIMES cdr(n)])
    Use_def(Red) ==> Red([cdr(m) ¥TIMES cdr(n),car(m) ¥TIMES cdr(n)]) =
    	[(cdr(m) ¥TIMES cdr(n)) ¥MINUS (((cdr(m) ¥TIMES cdr(n))) * (car(m) ¥TIMES cdr(n))),
    		(car(m) ¥TIMES cdr(n)) ¥MINUS (((cdr(m) ¥TIMES cdr(n))) * (car(m) ¥TIMES cdr(n)))]
    (cdr(n))-->T245 ==> Stat20: cdr(n) ¥TIMES 0 = 0
    (cdr(n),0)-->T253(Stat20) ==> Stat21: 0 ¥TIMES cdr(n) = 0
    Suppose ==> Stat22: (cdr(m) ¥TIMES cdr(n)) * (car(m) ¥TIMES cdr(n)) /= 0
    (Stat22)ELEM ==> (cdr(m) ¥TIMES cdr(n) /= 0) & (car(m) ¥TIMES cdr(n) /= 0)
    Suppose ==> cdr(m) = 0
    EQUAL ==> false; Discharge ==> car(m) = 0
    EQUAL ==> 0 ¥TIMES cdr(n) /= 0
    (0,cdr(n))-->T253 ==> Stat23: cdr(n) ¥TIMES 0 /= 0
    (Stat20,Stat23)Discharge ==> (cdr(m) ¥TIMES cdr(n)) * (car(m) ¥TIMES cdr(n)) = 0
    EQUAL ==> Red([cdr(m) ¥TIMES cdr(n),car(m) ¥TIMES cdr(n)]) =
    	[(cdr(m) ¥TIMES cdr(n)) ¥MINUS 0,(car(m) ¥TIMES cdr(n)) ¥MINUS 0]
    (cdr(m) ¥TIMES cdr(n))-->T268 ==> (cdr(m) ¥TIMES cdr(n)) ¥MINUS 0 = #(cdr(m) ¥TIMES cdr(n))
    (car(m) ¥TIMES cdr(n))-->T268 ==> (car(m) ¥TIMES cdr(n)) ¥MINUS 0 = #(car(m) ¥TIMES cdr(n))
    EQUAL ==> Stat24:  Red([cdr(m) ¥TIMES cdr(n),car(m) ¥TIMES cdr(n)]) =
    							[#(cdr(m) ¥TIMES cdr(n)),#(car(m) ¥TIMES cdr(n))]
    (Stat24,Stat19)ELEM ==> Stat25: [#(cdr(m) ¥TIMES cdr(n)),#(car(m) ¥TIMES cdr(n))] = [0,0]
    (Stat25)ELEM ==> (#(cdr(m) ¥TIMES cdr(n)) = 0) & (#(car(m) ¥TIMES cdr(n)) = 0)
    (cdr(m) ¥TIMES cdr(n))-->T162 ==> Stat26: cdr(m) ¥TIMES cdr(n) = 0
    (car(m) ¥TIMES cdr(n))-->T162 ==> Stat27: car(m) ¥TIMES cdr(n) = 0
    (car(m),cdr(n))-->T309(Stat27,Stat18) ==> car(m) = 0
    (cdr(m),cdr(n))-->T309(Stat26,Stat18) ==> cdr(m) = 0
    Discharge ==> QED

--
-- Next we prove the distributivity of multiplication over subtraction.
--

Theorem 408: [Distributivity of multiplication over subtraction]
    ((N in Si) & (M in Si) & (K in Si)) ¥imp ((m ¥S_TIMES n) ¥S_MINUS (k ¥S_TIMES n) = (m ¥S_MINUS k) ¥S_TIMES n). Proof:
    Suppose_not(n,m,k) ==> (n in Si) & (m in Si) & (k in Si) & ((m ¥S_TIMES n) ¥S_MINUS (k ¥S_TIMES n) /= (m ¥S_MINUS k) ¥S_TIMES n)
--
-- For suppose that signed integers $n$, $m$, $k$ are a counterexample to our assertion. Using Theorem 371, Theorem 372, Theorem 392,
-- and Theorem 398 we can rewrite the negative of our assertion (in a form using $¥S_PLUS$ instead of $¥S_MINUS$) as
--
--		$((m ¥S_TIMES n) ¥S_PLUS (S_Rev(k) ¥S_TIMES n) /= (m ¥S_PLUS S_Rev(k)) ¥S_TIMES n)$
--
	(m,n)-->T371 ==> (m ¥S_TIMES n) in Si
	(k,n)-->T371 ==> (k ¥S_TIMES n) in Si
    (m ¥S_TIMES n,k ¥S_TIMES n)-->T398 ==> (m ¥S_TIMES n) ¥S_MINUS (k ¥S_TIMES n) = (m ¥S_TIMES n) ¥S_PLUS S_Rev(k ¥S_TIMES n)
    (m,k)-->T398 ==> (m ¥S_MINUS k) = (m ¥S_PLUS S_Rev(k))
    (k,n)-->T392 ==> S_Rev(k ¥S_TIMES n) = S_Rev(k) ¥S_TIMES n
    EQUAL ==> ((m ¥S_TIMES n) ¥S_PLUS (S_Rev(k) ¥S_TIMES n) /= (m ¥S_PLUS S_Rev(k)) ¥S_TIMES n)
--
-- Then, using the commutativity of the '$¥S_TIMES$' operator, we can rewrite the above inequality as
--
--		$((n ¥S_TIMES m) ¥S_PLUS (n ¥S_TIMES S_Rev(k)) /= n ¥S_TIMES (m ¥S_PLUS S_Rev(k)))$
--
-- which stands in contradiction to the distributivity rule for signed integer addition,
-- and so proves our theorem.
--
    k-->T391 ==> S_Rev(k) in Si
	(m,S_Rev(k))-->T371 ==> (m ¥S_PLUS S_Rev(k)) in Si
	(m,n)-->T384 ==> m ¥S_TIMES n = n ¥S_TIMES m
	(S_Rev(k),n)-->T384 ==> S_Rev(k) ¥S_TIMES n = n ¥S_TIMES S_Rev(k)
 	(m ¥S_PLUS S_Rev(k),n)-->T384 ==> (m ¥S_PLUS S_Rev(k)) ¥S_TIMES n = n ¥S_TIMES (m ¥S_PLUS S_Rev(k))
 	EQUAL ==> ((n ¥S_TIMES m) ¥S_PLUS (n ¥S_TIMES S_Rev(k))) /= (n ¥S_TIMES (m ¥S_PLUS S_Rev(k)))
 	(S_Rev(k),n)-->T384 ==> S_Rev(k) ¥S_TIMES n = n ¥S_TIMES S_Rev(k)
    (S_Rev(k),n,m)-->T386 ==> false; Discharge ==> QED
--
-- Our next theorem states the principle of cancellation for the ring of signed integers.
-- The proof is straightforward and algebraic: from $m ¥S_TIMES n = k ¥S_TIMES n$ deduce $(m ¥S_MINUS k) ¥S_TIMES n = 0$,
-- and then apply Theorem 407.
--
Theorem 409: [$Si$ multiplicative cancellation]
	((N in Si) & (M in Si) & (K in Si) & (M ¥S_TIMES N = K ¥S_TIMES N) & (N /= [0,0])) ¥imp (M = K). Proof:
    Suppose_not(n,m,k) ==> (n in Si) & (m in Si) & (k in Si) & (m ¥S_TIMES n = k ¥S_TIMES n) & (n /= [0,0]) & (m /= k)
    EQUAL ==> (m ¥S_TIMES n) ¥S_MINUS (k ¥S_TIMES n) = (k ¥S_TIMES n) ¥S_MINUS (k ¥S_TIMES n)
    (k,n)-->T371 ==> (k ¥S_TIMES n) in Si
    (k ¥S_TIMES n)-->T404 ==> (m ¥S_TIMES n) ¥S_MINUS (k ¥S_TIMES n) = [0,0]
    (m,k)-->T372 ==> (m ¥S_MINUS k) in Si
    (n,m,k)-->T408 ==> (m ¥S_MINUS k) ¥S_TIMES n = [0,0]
    (n,m ¥S_MINUS k)-->T407 ==> (m ¥S_MINUS k) = [0,0]
    EQUAL ==> k ¥S_PLUS (m ¥S_MINUS k) = k ¥S_PLUS [0,0]
    (m,k)-->T399 ==> m = k ¥S_PLUS [0,0]
    k-->T405 ==> false; Discharge ==> QED
--
-- Next we prove that the product of any signed integer $n$ by my minus 0ne is the reverse of $n$.
--
Theorem 410: [Multiplication by -1] (N in Si) ¥imp (S_Rev(N) = [0,1] ¥S_TIMES N). Proof:
    Suppose_not(n) ==> (n in Si) & (S_Rev(n) /= [0,1] ¥S_TIMES n)
--
--
--
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    Use_def(¥S_TIMES) ==>
    	S_Rev(n) /= Red([(car([0,1]) ¥TIMES car(n)) ¥PLUS (cdr([0,1]) ¥TIMES cdr(n)),
    							(car([0,1]) ¥TIMES cdr(n)) ¥PLUS (car(n) ¥TIMES cdr([0,1]))])
    ELEM ==> (car([0,1]) = 0) & (cdr([0,1]) = 1)
    EQUAL ==> S_Rev(n) /= Red([(0 ¥TIMES car(n)) ¥PLUS (1 ¥TIMES cdr(n)),
    							(0 ¥TIMES cdr(n)) ¥PLUS (car(n) ¥TIMES 1)])
    ALGEBRA ==> S_Rev(n) /= Red([cdr(n),car(n)])
    Use_def(Red) ==> Red([cdr(n),car(n)]) = [cdr(n) ¥MINUS (cdr(n) * car(n)),car(n) ¥MINUS (cdr(n) * car(n))]
    ELEM ==> (cdr(n) * car(n)) = 0
    EQUAL ==> Red([cdr(n),car(n)]) = [cdr(n) ¥MINUS 0,car(n) ¥MINUS 0]
    (cdr(n))-->T268 ==> (cdr(n) ¥MINUS 0) = #cdr(n)
    (car(n))-->T268 ==> (car(n) ¥MINUS 0) = #car(n)
    (cdr(n))-->T206 ==> Card(cdr(n))
    (car(n))-->T206 ==> Card(car(n))
    (cdr(n))-->T164 ==> #cdr(n) = cdr(n)
    (car(n))-->T164 ==> #car(n) = car(n)
    EQUAL ==> Red([cdr(n),car(n)]) = [cdr(n),car(n)]
    Use_def(S_Rev) ==> S_Rev(n) = [cdr(n),car(n)]
    Discharge ==> QED
--
-- ************************************************************************************************
--			Section 10: Mathematical induction for integers; the general summation operator
-- ************************************************************************************************
--
-- We now develop the standard theory of mathematical induction (for integers), which tells us that
-- if there exists an integer $n$ having some property $P(n)$, there exists a smallest integer $m$ having the property $P(m)$.
--
THEORY mathematical_induction(n,P(x))
    (n in Za) & P(n)
END mathematical_induction;
--
ENTER_THEORY mathematical_induction
--
-- We begin with two small 'glue' theorems, the first of which merely restates the assumptionof the present theory, therby making it
-- available to the theorem-level APPLY inference which follows.
--
Theorem mathematical_induction00: [Basic assumption for proofs by mathematical induction] (n in Za) & P(n). Proof:
	Suppose_not ==> not((n in Za) & P(n))
    Assump ==> (n in Za) & P(n)
    Discharge ==> QED
--
-- Next we APPLY transfinite_induction, to get a conclusion close to that which we desire.
--
   APPLY(mt1_thryvar:m2_thryvar) transfinite_induction(n->n,P(x)->((x in Za) & P(x))) ==>
    	Theorem mathematical_induction0: [The minimum integer having a given property, preliminary version] (FORALL k | ((m2_thryvar in Za) & P(m2_thryvar)) & ((k in m2_thryvar) ¥imp (not ((k in Za) & P(k)))))

--
-- The following result, which is the sole externally useful theorem of the present theory, shows that the quantity $m2_thryvar$
-- supplied by applying standard transfinite induction to the predicate $(n in Za) & P(n)$ has the minimality property we desire.
--
Theorem mathematical_induction1: [The minimum integer having a given property] (m2_thryvar in Za) & P(m2_thryvar) & (FORALL k in m2_thryvar | not P(k)). Proof:
	Suppose_not ==> Stat1: not((m2_thryvar in Za) & P(m2_thryvar) & (FORALL k in m2_thryvar | not P(k)))
--
-- Unwrap part of quantified statement which is not affected by the quantifier:
--
  	Tmathematical_induction0 ==> Stat2: (FORALL k | ((m2_thryvar in Za) & P(m2_thryvar)) & ((k in m2_thryvar) ¥imp (not ((k in Za) & P(k)))))
    0-->Stat2 ==> (m2_thryvar in Za) & P(m2_thryvar)
--
--
-- For if not there would be some member $m$ of $m2_thryvar$ having the property $P(m)$,
-- and since this $m$ would necessarily be an integer we have a contradiction which proves our assertion.
--
    ELEM ==> Stat3: not (FORALL n in m2_thryvar | not P(n))
    m-->Stat3 ==> (m in m2_thryvar) & P(m)
    m-->Stat2 ==> m notin Za
    junk-->T206 ==> Ord(Za)
    (Za,m2_thryvar)-->T12 ==> Ord(m2_thryvar)
    (m2_thryvar,m)-->T12 ==> Ord(m)
    (Za,m)-->T35 ==> Za ¥incin m
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY mathematical_induction
--
--THEORY mathematical_induction(n,P(x))
--    n in Za
--    P(n)
--==>(m2_thryvar)
--    (m2_thryvar in Za) & P(m2_thryvar) & (FORALL n in m2_thryvar | not P(n))
--END mathematical_induction;
--
--
-- One sometimes needs to give proofs by 'double induction', which use the fact that
-- if there exist any $n$ and $k$ satisfying a 2-variable predicate $R(n,k)$, then
-- there exist $m$ and $j$ satisfying this same predicate, which are minimal in the sense that
-- $R(k,i)$ must be false for any $k$ less than $m$ and any $i$ at all, while $R(m,i)$
-- must also be false for any $i$ less than $j$. We give theories capable of supplying
-- this fact in two variants: the first in which $n$ and $k$ are general sets, the second in which
-- all the quantities involved are integers.
--
--
THEORY double_transfinite_induction(n,k,R(x,y))
    R(n,k)
END double_transfinite_induction;
--
ENTER_THEORY double_transfinite_induction
--
Theorem double_transfinite_induction.0: [Basic assumption for proofs by double transfinite induction] (EXISTS i | R(n,i)). Proof:
    Suppose_not ==> Stat1: not(EXISTS i | R(n,i))
        Assump ==> R(n,k)
    k-->Stat1 ==> false; Discharge ==> QED
--
APPLY(mt1_thryvar:m3_thryvar) transfinite_induction(n->n, P(x)->(EXISTS i | R(x,i))) ==>
	Theorem double_transfinite_induction.1: [Minimum first element in a double transfinite induction] (FORALL k | ((EXISTS i | R(m3_thryvar,i)) & ((k in m3_thryvar) ¥imp (not (EXISTS i | R(k,i))))))
--
Theorem double_transfinite_induction.2: [Existence of a second element corresponding to the minimum first element] (EXISTS i | R(m3_thryvar,i)). Proof:
    Suppose_not ==> Stat1: (not (EXISTS i | R(m3_thryvar,i)))
        Tdouble_transfinite_induction.1 ==> Stat2: (FORALL k | ((EXISTS i | R(m3_thryvar,i)) & ((k in m3_thryvar) ¥imp (not (EXISTS i | R(k,i))))))
        0-->Stat2 ==> Stat3: (EXISTS i | R(m3_thryvar,i))
    (Stat1,Stat3)Discharge ==> QED
--
APPLY(v1_thryvar:ei1) Skolem() ==>
	Theorem double_transfinite_induction.3: [Minimum second element in a double transfinite induction] R(m3_thryvar,ei1)
--
APPLY(mt1_thryvar:j1_thryvar) transfinite_induction(n->ei1,P(x)->R(m3_thryvar,x)) ==>
	Theorem double_transfinite_induction.4: [Minimal element properties in a double transfinite induction] (FORALL k | R(m3_thryvar,j1_thryvar) & ((k in j1_thryvar) ¥imp (not R(m3_thryvar,k))))
--
--
-- As an obvious corollary of the statements proved by the preceding two
-- applications of transfinite induction, we get the following statement,
-- which will be externalized by the present THEORY.
--
Theorem double_transfinite_induction.5: [Minimal element properties in a double transfinite induction, 2] R(m3_thryvar,j1_thryvar) & ((K in m3_thryvar) ¥imp (not R(K,I))) & ((I in j1_thryvar) ¥imp (not R(m3_thryvar,I))). Proof:
    Suppose_not(i) ==> (not R(m3_thryvar,j1_thryvar)) or ((k in m3_thryvar) & R(k,i)) or ((i in j1_thryvar) & R(m3_thryvar,i))
        Suppose ==> Stat1: (k in m3_thryvar) & R(k,i)
            Tdouble_transfinite_induction.1 ==> Stat2: (FORALL k | (EXISTS i | R(m3_thryvar,i)) & ((k in m3_thryvar) ¥imp (not (EXISTS i | R(k,i)))))
            k-->Stat2 ==> Stat3: (not(EXISTS i | R(k,i)))
        i-->Stat3 ==> false; Discharge ==> (not R(m3_thryvar,j1_thryvar)) or ((i in j1_thryvar) & R(m3_thryvar,i))
        Tdouble_transfinite_induction.4 ==> Stat4: (FORALL i | R(m3_thryvar,j1_thryvar) & ((i in j1_thryvar) ¥imp (not R(m3_thryvar,i))))
    i-->Stat4 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY double_transfinite_induction
--
--
--THEORY double_transfinite_induction(R(x,y));
--    (EXISTS n, k | R(n,k))
--==>(m3_thryvar,j1_thryvar)
--    R(m3_thryvar,j1_thryvar) & (FORALL k in m3_thryvar, i in OM | not R(k,i)) & (FORALL i in j1_thryvar | not R(m3_thryvar,i))
--END double_transfinite_induction;
--
--
--
-- The following simple variant of the preceding theory tells us that
-- if there exist any integers $n$ and $k$ satisfying a 2-variable predicate $R(n,k)$, then
-- there exist integers  $m$ and $j$ satisyfing this same predicate, which are minimal in the sense that
-- $R(k,i)$ must be false for any integer $k$ less than $m$ and any integer $i$ at all, while $R(m,i)$
-- must also be false for any integer $i$ less than $j$.
--
THEORY double_mathematical_induction(n,k,R(x,y))
    (n in Za) & (k in Za) & R(n,k)
END double_mathematical_induction;
--
ENTER_THEORY double_mathematical_induction
--
Theorem double_mathematical_induction.0: [Basic assumption for double integer induction] (EXISTS i | (i in Za) & R(n,i)). Proof:
    Suppose_not ==> Stat1: not(EXISTS i | (i in Za) & R(n,i))
        Assump ==> (k in Za) & R(n,k)
    k-->Stat1 ==> false; Discharge ==> QED
--
APPLY(m2_thryvar:mm_thryvar) mathematical_induction(n->n, P(x)->(EXISTS i | (i in Za) & R(x,i))) ==>
	Theorem double_mathematical_induction.1: [Minimum first element for a double integer induction] (mm_thryvar in Za) & (EXISTS i | (i in Za) & R(mm_thryvar,i)) & (FORALL k in mm_thryvar | not (EXISTS i | (i in Za) & R(k,i)))
--
Theorem double_mathematical_induction.2: (EXISTS i | (i in Za) & R(mm_thryvar,i)). Proof:
    Suppose_not ==> Stat1: (not (EXISTS i | (i in Za) & R(mm_thryvar,i)))
        Tdouble_mathematical_induction.1 ==> Stat2: (FORALL k | (mm_thryvar in Za) & (EXISTS i | (i in Za) & R(mm_thryvar,i)) & ((k in mm_thryvar) ¥imp (not (EXISTS i | (i in Za) & R(k,i)))))
        0-->Stat2 ==> Stat3: (EXISTS i | (i in Za) & R(mm_thryvar,i))
   (Stat1,Stat3)Discharge ==> QED
--
APPLY(v1_thryvar:ei2) Skolem() ==>
	Theorem double_mathematical_induction.3: (ei2 in Za) & R(mm_thryvar,ei2)
--
APPLY(m2_thryvar:j2_thryvar) mathematical_induction(n->ei2, P(x)->R(mm_thryvar,x)) ==>
	Theorem double_mathematical_induction.4:  (FORALL i | (j2_thryvar in Za) & R(mm_thryvar,j2_thryvar) &
			((i in j2_thryvar) ¥imp (not ((i in Za) & R(mm_thryvar,i)))))
--
-- As a straightforward corollary of the statements proved by the preceding two
-- applications of mathematical induction, we get the following statement,
-- which will be externalized by the present THEORY.
--
Theorem double_mathematical_induction.5: (mm_thryvar in Za) & (j2_thryvar in Za) & R(mm_thryvar,j2_thryvar) & (((K in mm_thryvar) & (I in Za)) ¥imp (not R(K,I))) & ((I in j2_thryvar) ¥imp (not R(mm_thryvar,I))). Proof:
    Suppose_not(i) ==> (mm_thryvar notin Za) or (j2_thryvar notin Za) or (not R(mm_thryvar,j2_thryvar)) or ((k in mm_thryvar) & (i in Za) & R(k,i)) or ((i in j2_thryvar) & R(mm_thryvar,i))
        Suppose ==> (mm_thryvar notin Za) or ((k in mm_thryvar) & (i in Za) & R(k,i))
            Tdouble_mathematical_induction.1 ==> (mm_thryvar in Za) & (EXISTS i | (i in Za) & R(mm_thryvar,i)) & Stat1: (FORALL k in mm_thryvar | not (EXISTS i | (i in Za) & R(k,i)))
            k-->Stat1 ==> Stat2: (not (EXISTS i | (i in Za) & R(k,i)))
        i-->Stat2 ==> false; Discharge ==> (j2_thryvar notin Za) or (not R(mm_thryvar,j2_thryvar)) or ((i in j2_thryvar) & R(mm_thryvar,i))
        Tdouble_mathematical_induction.4 ==> Stat3: (FORALL i | (j2_thryvar in Za) & R(mm_thryvar,j2_thryvar) & ((i in j2_thryvar) ¥imp (not((i in Za) &  R(mm_thryvar,i)))))
    i-->Stat3 ==> (i in j2_thryvar) & (j2_thryvar in Za) & (i notin Za)
    junk-->T206 ==> Ord(Za)
    (Za,j2_thryvar)-->T12 ==> Ord(j2_thryvar)
    (j2_thryvar,i)-->T12 ==> Ord(i)
    (Za,i)-->T35 ==> Za ¥incin i
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY double_mathematical_induction
--
--THEORY double_mathematical_induction(n,k,R(x,y));
--    (n in Za) & (k in Za) & R(n,k)
--==>(mm_thryvar,j2_thryvar)
--    (FORALL k, i | (mm_thryvar in Za) & (j2_thryvar in Za) & R(mm_thryvar,j2_thryvar) &
--	(((k in mm_thryvar) & (i in Za)) ¥imp (not R(k,i))) & ((i in j2_thryvar) ¥imp (not R(mm_thryvar,i))))
--END double_mathematical_induction;
--
--
--
-- The following mini-theory shows that any infinite increasing sequence all of whose images are
-- circumscribed by a finite set has two consecutive equal components.
--
THEORY confinedIncrSeq(e(x),s0)
	Finite(s0)
	(FORALL i in Za | e(i) ¥incin (e(next(i)) * s0))
END confinedIncrSeq
--
Def 10070: [position of first repetition in confined increasing sequence] m5_thryvar := arb({i in Za | e(next(i)) ¥incin e(i)})
--
ENTER_THEORY confinedIncrSeq
--
Theorem confinedIncrSeq1: [global increase of a stepwise increasing sequence] ((I in J) & (J in Za)) ¥imp (e(I) ¥incin e(J)). Proof:
Suppose_not(i0,j0) ==> AUTO
	T206(*) ==> Stat1: Ord(Za)
	(Za,j0)-->T13(*) ==> (i0 in Za) & (j0 in Za) & (e(i0) ¥nincin e(j0))
--?	APPLY(mm_thryvar:i1,j2_thryvar:i2) double_mathematical_induction(n->i0,k->j0,R(x,y)->((x in y) & (e(x) ¥nincin e(y)))) ==>
--?		Stat2: (FORALL k, i | (i1 in Za) & (i2 in Za) & ((i1 in i2) & (e(i1) ¥nincin e(i2))) & (((k in i1) & (i in Za)) ¥imp (not ((k in i) & (e(k) ¥nincin e(i))))) & ((i in i2) ¥imp (not ((i1 in i) & (e(i1) ¥nincin e(i))))))
--	(0,0)-->Stat2(Stat2*) ==> Stat3: (i1 in Za) & (i2 in Za) & (i1 in i2) & (e(i1) ¥nincin e(i2))
--	Suppose ==> Stat4: not(FORALL i in i2 | not((i1 in i) & (e(i1) ¥nincin e(i))))
--		i4-->Stat4(Stat4*) ==> Stat5: (i4 in i2) & (i1 in i4) & (e(i1) ¥nincin e(i4))
--	(0,i4)-->Stat2(Stat5*) ==> false; Discharge ==> Stat6: (FORALL i in i2 | not((i1 in i) & (e(i1) ¥nincin e(i))))
	APPLY(mm_thryvar:i1,j2_thryvar:i2) double_mathematical_induction(n->i0,k->j0,R(x,y)->((x in y) & (e(x) ¥nincin e(y)))) ==>
		Stat7: (i1 in Za) & Stat6: (FORALL i | (i2 in Za) & ((i1 in i2) & (e(i1) ¥nincin e(i2))) &
				((i in i2) ¥imp (not((i in Za) & ((i1 in i) & (e(i1) ¥nincin e(i)))))))
	0-->Stat6(Stat7*) ==> Stat3: (i1 in Za) & (i2 in Za) & (i1 in i2) & (e(i1) ¥nincin e(i2))
	Loc_def ==> i3 = Un(i2)
	i2-->T321(Stat3*) ==> Stat8: i3 in Za
	i3-->T317(Stat8*) ==> (i3 ¥PLUS 1) = next(i3)
	EQUAL(Stat3) ==> (Un(i2) ¥PLUS 1) = next(i3)
	i2-->T322(Stat3*) ==> Stat9: i2 = next(i3)
	(Za,i3)-->T12(Stat1,Stat8*) ==> Stat10: Ord(i3)
	(i3,i1)-->T36(Stat3*) ==> (i1 ¥incin i3) & Ord(i1)
	Assump ==> Stat11: (FORALL i in Za | e(i) ¥incin (e(next(i)) * s0))
	Suppose ==> i1 = i3
		EQUAL(Stat3) ==> e(i1) ¥nincin e(next(i1))
	i1-->Stat11(Stat3*) ==> false; Discharge ==> i1 /= i3
	(i3,i1)-->T34(Stat10*) ==> Stat12: i1 in i3
	Use_def(next)(Stat9*) ==> i3 in i2
	i3-->Stat6(Stat8*) ==> Stat13: e(i1) ¥incin e(i3)
	i3-->Stat11(Stat8,Stat8*) ==> e(i3) ¥incin e(next(i3))
	EQUAL(Stat9) ==> Stat14: e(i3) ¥incin e(i2)
(Stat13,Stat14,Stat3*)Discharge ==> QED
--
Theorem confinedIncrSeq2: [position of first repetition in confined increasing sequence] (m5_thryvar in Za) & (e(next(m5_thryvar)) = e(m5_thryvar)) & ((m5_thryvar * {i in Za | e(next(i)) ¥incin e(i)}) = 0). Proof:
Suppose_not ==> AUTO
--
-- Assuming the contrary, observe in the first place that the set
--	{i in Za | e(next(i)) ¥incin e(i)}
-- cannot be empty.
--
	Assump ==> Stat1: (FORALL i in Za | e(i) ¥incin (e(next(i)) * s0))
	Suppose ==> {i in Za | e(next(i)) ¥incin e(i)} /= 0
		Use_def(m5_thryvar) ==> m5_thryvar = arb({i in Za | e(next(i)) ¥incin e(i)})
		({i in Za | e(next(i)) ¥incin e(i)})-->T0(*) ==> Stat2: (m5_thryvar in {i in Za | e(next(i)) ¥incin e(i)}) & ((m5_thryvar * {i in Za | e(next(i)) ¥incin e(i)}) = 0)
		m5_thryvar-->Stat2(*) ==> Stat3: (m5_thryvar in Za) & (e(m5_thryvar) ¥nincin e(next(m5_thryvar)))
	m5_thryvar-->Stat1(Stat3*) ==> false; Discharge ==> Stat4: {i in Za | e(next(i)) ¥incin e(i)} = 0
--
-- Otherwise stated, there is an element in $e(next(i)) - e(i)$, for every $i$ in $Za$.
--
	Suppose ==> Stat5: not(FORALL i in Za | arb(e(next(i)) - e(i)) in (e(next(i)) - e(i)))
		i1-->Stat5(Stat5*) ==> (i1 in Za) & (arb(e(next(i1)) - e(i1)) notin (e(next(i1)) - e(i1)))
		(e(next(i1)) - e(i1))-->T0(Stat5*) ==> e(next(i1)) ¥incin e(i1)
	i1-->Stat4(Stat4*) ==> false; Discharge ==> Stat6: (FORALL i in Za | arb(e(next(i)) - e(i)) in (e(next(i)) - e(i)))
--
-- We will show that the mapping which sends every integer $i$ into $arb(e(next(i)) - e(i))$ is
-- one-one. However, since its domain $Za$ is infinite, and all of its images belong to $s0$,
-- this leads to a contradiction, from which the desired statement ensues.
--
	Suppose ==> Stat7: not(range({[i,arb(e(next(i)) - e(i))]: i in Za }) ¥incin s0)
		TELEM ==> range({[i,arb(e(next(i)) - e(i))]: i in Za }) = {arb(e(next(i)) - e(i)): i in Za }
		(Stat7*)ELEM ==> Stat8: not({arb(e(next(i)) - e(i)): i in Za} ¥incin s0)
		c-->Stat8(Stat8*) ==> Stat9: (c in {arb(e(next(i)) - e(i)): i in Za}) & (c notin s0)
		i0-->Stat9(Stat9*) ==> (i0 in Za) & (arb(e(next(i0)) - e(i0)) notin s0)
		i0-->Stat6(Stat6*) ==> arb(e(next(i0)) - e(i0)) in (e(next(i0)) - e(i0))
		i0-->T210(Stat9*) ==> next(i0) in Za
	(next(i0))-->Stat1(Stat9*) ==> false; Discharge ==> Stat10: range({[i,arb(e(next(i)) - e(i))]: i in Za }) ¥incin s0
	Suppose ==> one_1_map({[i,arb(e(next(i)) - e(i))]: i in Za})
		T206(Stat10*) ==> (not Finite(Za))
		TELEM ==> domain({[i,arb(e(next(i)) - e(i))]: i in Za }) = Za
		({[i,arb(e(next(i)) - e(i))]: i in Za})-->T191(Stat10*) ==> (not Finite(range({[i,arb(e(next(i)) - e(i))]: i in Za})))
		Assump ==> Finite(s0)
	(s0,range({[i,arb(e(next(i)) - e(i))]: i in Za}))-->T189(Stat10*) ==> false; Discharge ==> Stat11: (not one_1_map({[i,arb(e(next(i)) - e(i))]: i in Za}))
--
-- Denying that the mapping which sends every integer $i$ into $arb(e(next(i)) - e(i))$ is
-- one-one would, in fact, amount to denying that it inverse is single-valued.
-- Let $i2,i3$ be integers which witness this fact.
--
	Use_def(one_1_map)(Stat11) ==> Stat12: not(FORALL x in {[i,arb(e(next(i)) - e(i))]: i in Za}, y in {[i,arb(e(next(i)) - e(i))]: i in Za} | (cdr(x) = cdr(y)) ¥imp (x = y))
	(p,q)-->Stat12(Stat12*) ==> Stat13: (p in {[i,arb(e(next(i)) - e(i))]: i in Za}) & (q in {[i,arb(e(next(i)) - e(i))]: i in Za}) & (cdr(p) = cdr(q)) & (p /= q)
	(i2,i3)-->Stat13(Stat13*) ==> Stat14: (p = [i2,arb(e(next(i2)) - e(i2))]) & (i2 in Za) & (q = [i3,arb(e(next(i3)) - e(i3))]) & (i3 in Za)
	EQUAL(Stat13) ==> Stat15: (cdr([i2,arb(e(next(i2)) - e(i2))]) = cdr([i3,arb(e(next(i3)) - e(i3))]))
	(Stat15)ELEM ==> Stat16: arb(e(next(i2)) - e(i2)) = arb(e(next(i3)) - e(i3))
	EQUAL(Stat13) ==> Stat17: [i2,arb(e(next(i2)) - e(i2))] /= [i3,arb(e(next(i3)) - e(i3))]
	(Stat16)ELEM ==> Stat18: i2 /= i3
--
-- Either $i2 in i3$ or $i3 in i2$, because $i2,i3$ are ordinals. In the former case
-- $next(i2) in i3$ or $next(i2) = i3$, and hence $e(next(i2)) ¥incin e(i3)$ by the
-- preceding Theorem confinedIncrSeq2. But then it is impossible that $arb(e(next(i2)) - e(i2))$
-- belongs to $e(next(i3)) - e(i3)$, and we face a contradiction.
--
	T206(Stat18*) ==> Ord(Za)
	(Za,i2)-->T12(Stat14*) ==> Ord(i2)
	(Za,i3)-->T12(Stat14*) ==> Ord(i3)
	i3-->Stat6(Stat14*) ==> Stat19: arb(e(next(i3)) - e(i3)) in (e(next(i3)) - e(i3))
	i2-->Stat6(Stat14*) ==> Stat20: arb(e(next(i2)) - e(i2)) in (e(next(i2)) - e(i2))
	Suppose ==> i2 in i3
		(i3,i2)-->T37(Stat18*) ==> next(i2) ¥incin i3
		i2-->T210(Stat14,Stat14*) ==> next(i2) in Za
		(Za,next(i2))-->T12(Stat18*) ==> Ord(next(i2))
		(i3,next(i2))-->T34(Stat18*) ==> (next(i2) in i3) or (next(i2) = i3)
		Suppose ==> Stat21: e(next(i2)) ¥nincin e(i3)
			Suppose ==> next(i2) = i3
				EQUAL(Stat21) ==> e(next(i2)) = e(i3)
			(Stat21*)Discharge ==> next(i2) in i3
		(next(i2),i3)-->TconfinedIncrSeq1(Stat13*) ==> false; Discharge ==> Stat22: e(next(i2)) ¥incin e(i3)
	(Stat16,Stat19,Stat20,Stat22*)Discharge ==> i2 notin i3
	(i2,i3)-->T31(Stat18*) ==> i3 in i2
--
-- Analogously we get a contradiction if we suppose that $i3 in i2$.
-- This last contradiction leads to the desired conclusion.
--
	(i2,i3)-->T37(Stat18*) ==> next(i3) ¥incin i2
	i3-->T210(Stat14,Stat14*) ==> next(i3) in Za
	(Za,next(i3))-->T12(Stat18*) ==> Ord(next(i3))
	(i2,next(i3))-->T34(Stat18*) ==> (next(i3) in i2) or (next(i3) = i2)
	Suppose ==> Stat23: e(next(i3)) ¥nincin e(i2)
		Suppose ==> next(i3) = i2
			EQUAL(Stat23) ==> e(next(i3)) = e(i2)
		(Stat23*)Discharge ==> next(i3) in i2
	(next(i3),i2)-->TconfinedIncrSeq1(Stat13*) ==> false; Discharge ==> Stat24: e(next(i3)) ¥incin e(i2)
(Stat16,Stat19,Stat20,Stat24*)Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY confinedIncrSeq
--
--THEORY confinedIncrSeq(e(x),s0)
--	Finite(s0)
--	(FORALL i in Za | e(i) ¥incin (e(next(i)) * s0))
--==>(m5_thryvar)
--	(FORALL i, j | ((i in j) & (j in Za)) ¥imp (e(i) ¥incin e(j)))
--	(m5_thryvar in Za) & (e(next(m5_thryvar)) = e(m5_thryvar)) & ((m5_thryvar * {i in Za | e(next(i)) ¥incin e(i)}) = 0)
--END confinedIncrSeq
--
--
-- Next we prove a general version of the principle that recursive definitions of functions $h$
-- over any well-founded set are valid if the definition of $h(x)$ involves only values $y$ which
-- precede $y$ in the well-founded relation of the set. Given a well-ordering relationship $arg1_bef_arg2$,
-- and given any functions $f(x)$, $g4(x,y,u,v)$, and $P(x,y,u)$ our aim is to prove that therese exists a function
-- $h$ which satisfies the identity
--	$(FORALL x in s, t in OM | h3_thryvar(x,s,t) = f({g4(h3_thryvar(y,s,t),y,x,t): y in s | arg1_bef_arg2(y,x) & P(h3_thryvar(y,s,t),s,y,x,t)},s,x,t))$.
--
-- This is not an immediate consequence of our principle of recursive definition, which insists on using the membership relator in place of the
-- general well-foundedness relator $arg1_bef_arg2$ which we now consider. We therefore proceed by introducng an enumerator which relates
-- $arg1_bef_arg2$ closely enough to memebership for our principle of recursive definition to be used.
--
THEORY wellfounded_recursive_fcn(s,arg1_bef_arg2(y,x),f3(b,x,t),g4(a,y,x,t),P4(a,y,x,t))
	(FORALL t | ((t ¥incin s) & (t /= 0) ¥imp (EXISTS x in t | (FORALL y in t | not(arg1_bef_arg2(y,x))))))
END wellfounded_recursive_fcn;
--
ENTER_THEORY wellfounded_recursive_fcn
--
--
-- We begin by importing a theorem of the theory well_founded_set into the present theory.
--
	APPLY(Minrel1_thryvar:Minrel3_thryvar,ordenm_thryvar:orden,ord_thryvar:o1)
			well_founded_set(s->s,arg1_bef_arg2(x,y)->arg1_bef_arg2(x,y)) ==>
Theorem wellfounded_recursive_fcn.100: (FORALL u, v | (Ord(u) & Ord(v) & (orden(u) /= s) &
				arg1_bef_arg2(orden(u),orden(v))) ¥imp (u in v)) &
		(EXISTS o in next(#pow(s)) | (Ord(o) & (s = {orden(x): x in o}) &
			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o})))
--
-- To draw the conclusion seen a bit below we must simplify the quantifier which appears in the preceding statement.
--
Theorem wellfounded_recursive_fcn.100a: (EXISTS o | (Ord(o) & (s = {orden(x): x in o}) &
			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o}))). Proof:
	Suppose_not ==> Stat1: not (EXISTS o | (Ord(o) & (s = {orden(x): x in o}) &
			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o})))
	Twellfounded_recursive_fcn.100 ==> Stat2: (EXISTS o in next(#pow(s)) | (Ord(o) & (s = {orden(x): x in o}) &
			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o})))
	o-->Stat2 ==> Ord(o) & (s = {orden(x): x in o}) &
			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o})
	o-->Stat1 ==> false; Discharge ==> QED
--
-- We can now introduce a specific constant o by Skolemizing the existential statement seen just above.
--
APPLY(v1_thryvar:o2) Skolem() ==>
Theorem wellfounded_recursive_fcn.101: (Ord(o2) & (s = {orden(x): x in o2}) &
			(FORALL x in o2 | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o2}))
--
-- We also introduce an indexing function which will turn out to be the inverse of this
-- one-to-one mapping and to assign consecutive ordinals to the elements of $s$.
--
Def 00r: [Ordinal index defined by the standard enumeration of sets] index(X) := arb({j: j in o2 | orden(j) = X})
--
-- The desired function $h$ is not directly definable by a recursive rule based on the well-founded relation.
-- On the other hand, we can define an auxiliary function $hh$ by means of a recursive rule based
-- on membership; and then define $h$ in terms of $hh$ and the indexing function.
--
Def 00s: [?] hh(X,T) := f3({g4(hh(j,T),orden(j),orden(X),T): j in X | arg1_bef_arg2(orden(j),orden(X)) &
								 P4(hh(j,T),orden(j),orden(X),T)}, orden(X), T)
--
Def 00t: [?] wfh2_thryvar(V,T) := hh(index(V), T)
--
-- We first prove that the 'index' function defined above assigns an ordinal preceding $o2$ to every
-- element of $s$ and is a partial inverse of the enumerator $orden$.
--
Theorem wellfounded_recursive_fcn.1: (V in s) ¥imp ((index(V) in o2) & Ord(index(V)) & (orden(index(V)) = V)). Proof:
    Suppose_not(v) ==> (v in s) & ((index(v) notin o2) or (not Ord(index(v))) or (orden(index(v)) /= v))
--
-- For if $v$ is a counterexample to our theorem, it must be the image under the
-- $orden$ of some element $x in o2$. hence the set ${j: j in o2 | orden(j) = v}$ cannot
-- be empty, and so the index of $v$ must belong to this set.
--
	Twellfounded_recursive_fcn.101 ==> Ord(o2) & (s = {orden(x): x in o2})
	EQUAL ==> Stat1: v in {orden(x): x in o2}
	x-->Stat1 ==> (v = orden(x)) & (x in o2)
	Suppose ==> Stat2: {j: j in o2 | orden(j) = v} = 0
	x-->Stat2 ==> false; Discharge ==> arb({j: j in o2 | orden(j) = v}) in {j: j in o2 | orden(j) = v}
	Use_def(index) ==> Stat3: index(v) in {j: j in o2 | orden(j) = v}
--
-- $index(v)$ must therefore be an element $j$ of $o2$ whose image under $orden$ is $v$.
-- By our initial assumption this implies, that it cannot be an ordinal. Since $o2$ is an ordinal,
-- so that its elements are also ordinals, this leads to an immediate ontradiction.
--
    j-->Stat3 ==> Stat4: (index(v) = j) & (j in o2) & (orden(j) = v)
    EQUAL ==> orden(index(v)) = v
    (o2,index(v))-->T12 ==> false; Discharge ==> QED
--
-- Next we prove that for every element $v$ of the set $s$ of the well-founded relation is defined, the subset
-- ${j: j in index(v) | arg1_bef_arg2(orden(j),v)}$ can be written as ${index(w): w in s | arg1_bef_arg2(w,v)}$.
--
Theorem wellfounded_recursive_fcn.2: (V in s) ¥imp ({j: j in index(V) | arg1_bef_arg2(orden(j),V)} = {index(w): w in s | arg1_bef_arg2(w,V)}). Proof:
    Suppose_not(v) ==> (v in s) & Stat1: ({j: j in index(v) | arg1_bef_arg2(orden(j),v)} /= {index(w): w in s | arg1_bef_arg2(w,v)})
-- Suppose that $v$ is a counterexample $v$ to our assertion, and let $c$ be an element which belongs to one of
-- these two sets but not the other.
-- If $c$ belongs to ${index(w): w in s | arg1_bef_arg2(w,v)}$, then $c$ is the index of
-- some $w in s$, in which case the preceding Theorem tells us that
-- $v$ and $w$ have indices which are ordinals whose images under the enumerator
-- $enum$ are $v$ and $w$ respectively. Theorem wellfounded_recursive_fcn.100 then tells us that the index of $w$
-- precedes that of $v$ in the standard ordering of ordinals, which leads easily to a contradiction also
-- in this case.
--
	v-->Twellfounded_recursive_fcn.1 ==> (index(v) in o2) & Ord(index(v)) & (orden(index(v)) = v)
	c-->Stat1 ==> (c in {j: j in index(v) | arg1_bef_arg2(orden(j),v)}) ¥eq (c notin {index(w): w in s | arg1_bef_arg2(w,v)})
	Suppose ==> Stat2: (c in {index(w): w in s | arg1_bef_arg2(w,v)}) & (c notin {j: j in index(v) | arg1_bef_arg2(orden(j),v)})
	(w,index(w))-->Stat2 ==> (c = index(w)) & (w in s) & arg1_bef_arg2(w,v) & ((index(w) notin index(v)) or (not arg1_bef_arg2(orden(index(w)),v)))
	w-->Twellfounded_recursive_fcn.1 ==> Ord(index(w)) & (orden(index(w)) = w)
	EQUAL ==> arg1_bef_arg2(orden(index(w)),v) & arg1_bef_arg2(orden(index(w)),orden(index(v)))
	Twellfounded_recursive_fcn.100 ==> Stat3: (FORALL u, v | (Ord(u) & Ord(v) & (orden(u) /= s) &
				arg1_bef_arg2(orden(u),orden(v))) ¥imp (u in v))
	(index(w),index(v))-->Stat3 ==> false;
	Discharge ==> Stat4: (c in {j: j in index(v) | arg1_bef_arg2(orden(j),v)}) & (c notin {index(w): w in s | arg1_bef_arg2(w,v)})
--
-- Hence $c$ must belong to ${j: j in index(v) | arg1_bef_arg2(orden(j),v)}$;
-- and thus $orden(c)$ must precede $v$ in our well-founded relation. Moreover, it is readily
-- seen that $c$ belongs to $o2$ and that $orden(c) in s$.
--
	(j,orden(c))-->Stat4 ==> (c=j) & (c in index(v)) & arg1_bef_arg2(orden(j),v) &
		((c /= index(orden(c))) or (orden(c) notin s) or (not arg1_bef_arg2(orden(c),v)))
	EQUAL ==> arg1_bef_arg2(orden(c),v)
	Twellfounded_recursive_fcn.101 ==> Ord(o2) & (s = {orden(x): x in o2}) & one_1_map({[x,orden(x)]: x in o2})
	(o2,index(v))-->T13 ==> c in o2
	Suppose ==> orden(c) notin s
	EQUAL ==> Stat5: orden(c) notin {orden(x): x in o2}
	c-->Stat5 ==> false; Discharge ==> (orden(c) in s) & (c /= index(orden(c)))
--
-- Using Theorem wellfounded_recursive_fcn.1 again, we find that the index $i$ of $orden(c)$
-- belongs to $o2$ and has $orden(i)=orden(c)$. Since $orden$ is one-to-one over $s$, we get
-- a contradiction in this case too, proving our theorem.
--
	(orden(c))-->Twellfounded_recursive_fcn.1 ==> (index(orden(c)) in o2) & (orden(index(orden(c))) = orden(c))
	Suppose ==> Stat6: [c,orden(c)] notin {[x,orden(x)]: x in o2}
	c-->Stat6 ==> false; Discharge ==> [c,orden(c)] in {[x,orden(x)]: x in o2}
	Suppose ==> Stat7: [index(orden(c)),orden(index(orden(c)))] notin {[x,orden(x)]: x in o2}
	(index(orden(c)))-->Stat7 ==> false; Discharge ==> [index(orden(c)),orden(index(orden(c)))] in {[x,orden(x)]: x in o2}
	Use_def(one_1_map) ==> Stat8: (FORALL x in {[x,orden(x)]: x in o2}, y in {[x,orden(x)]: x in o2} | (cdr(x) = cdr(y)) ¥imp (x = y))
    ([index(orden(c)),orden(index(orden(c)))],[c,orden(c)])-->Stat8 ==> false; Discharge ==> QED
--
-- Now we show that the function $h$, although defined indirectly in the manner seen above,
-- nevertheless satisfies the recursive relationship that we have defined.
--
--
Theorem wellfounded_recursive_fcn.3: (X in s) ¥imp (wfh2_thryvar(X,T) = f3({g4(wfh2_thryvar(y,T),y,X,T): y in s | arg1_bef_arg2(y,X) & P4(wfh2_thryvar(y,T),y,X,T)},X,T)). Proof:
    Suppose_not(v,t) ==> (v in s) & (wfh2_thryvar(v,t) /= f3({g4(wfh2_thryvar(y,t),y,v,t): y in s | arg1_bef_arg2(y,v) & P4(wfh2_thryvar(y,t),y,v,t)},v,t))
--
-- For suppose that some $v$ in the domain $s$ of the well_founded relation
-- $h$ fails to satisfy this recursion. Expand the definition of $h$
-- and then simplify the resulting expression, using Theorems wellfounded_recursive_fcn.1 and 2 in the following way to derive a contradiction.
--
	Use_def(wfh2_thryvar) ==> wfh2_thryvar(v,t) = hh(index(v), t)
	Use_def(hh) ==> hh(index(v), t) = f3({g4(hh(j,t),orden(j),orden(index(v)),t): j in index(v) | arg1_bef_arg2(orden(j),orden(index(v))) & P4(hh(j,t),orden(j),orden(index(v)),t)}, orden(index(v)), t)
	v-->Twellfounded_recursive_fcn.1 ==> orden(index(v)) = v
	EQUAL ==> wfh2_thryvar(v, t) = f3({g4(hh(j,t),orden(j),v,t): j in index(v) | arg1_bef_arg2(orden(j),v) & P4(hh(j,t),orden(j),v,t)}, v, t)
	Suppose ==> {g4(hh(j,t),orden(j),v,t): j in index(v) | arg1_bef_arg2(orden(j),v) & P4(hh(j,t),orden(j),v,t)} /=
		{g4(hh(j,t),orden(j),v,t): j in {j: j in index(v) | arg1_bef_arg2(orden(j),v)} | P4(hh(j,t),orden(j),v,t)}
	SIMPLF ==> false;  Discharge ==> {g4(hh(j,t),orden(j),v,t): j in index(v) | arg1_bef_arg2(orden(j),v) & P4(hh(j,t),orden(j),v,t)} =
		{g4(hh(j,t),orden(j),v,t): j in {j: j in index(v) | arg1_bef_arg2(orden(j),v)} | P4(hh(j,t),orden(j),v,t)}
	v-->Twellfounded_recursive_fcn.2 ==> {j: j in index(v) | arg1_bef_arg2(orden(j),v)} = {index(y): y in s | arg1_bef_arg2(y,v)}
	EQUAL ==> {g4(hh(j,t),orden(j),v,t): j in {j: j in index(v) | arg1_bef_arg2(orden(j),v)} | P4(hh(j,t),orden(j),v,t)} =
		{g4(hh(j,t),orden(j),v,t): j in {index(y): y in s | arg1_bef_arg2(y,v)} | P4(hh(j,t),orden(j),v,t)}
	SIMPLF ==> {g4(hh(j,t),orden(j),v,t): j in {index(y): y in s | arg1_bef_arg2(y,v)} | P4(hh(j,t),orden(j),v,t)} =
		{g4(hh(index(y),t),orden(index(y)),v,t): y in s | arg1_bef_arg2(y,v) & P4(hh(index(y),t),orden(index(y)),v,t)}
	Suppose ==> Stat1: {g4(hh(index(y),t),orden(index(y)),v,t): y in s | arg1_bef_arg2(y,v) & P4(hh(index(y),t),orden(index(y)),v,t)} /=
		{g4(wfh2_thryvar(y,t),y,v,t): y in s | arg1_bef_arg2(y,v) & P4(wfh2_thryvar(y,t),y,v,t)}
	    w-->Stat1 ==> (w in s) &  ((g4(hh(index(w),t),orden(index(w)),v,t) /= g4(wfh2_thryvar(w,t),w,v,t)) or not(P4(hh(index(w),t),orden(index(w)),v,t)) ¥eq P4(wfh2_thryvar(w,t),w,v,t))
	    Use_def(wfh2_thryvar) ==> wfh2_thryvar(w,t) = hh(index(w), t)
	    w-->Twellfounded_recursive_fcn.1 ==> orden(index(w)) = w
	EQUAL ==> false; Discharge ==> {g4(hh(index(y),t),orden(index(y)),v,t): y in s | arg1_bef_arg2(y,v) & P4(hh(index(y),t),orden(index(y)),v,t)} =
		{g4(wfh2_thryvar(y,t),y,v,t): y in s | arg1_bef_arg2(y,v) & P4(wfh2_thryvar(y,t),y,v,t)}
	EQUAL ==> wfh2_thryvar(v, t) = f3({g4(wfh2_thryvar(y,t),y,v,t): y in s | arg1_bef_arg2(y,v) & P4(wfh2_thryvar(y,t),y,v,t)}, v, t)
    Discharge ==> QED
--
APPLY(wfh2_thryvar:rk_thryvar) wellfounded_recursive_fcn(s->s,arg1_bef_arg2(y,x)->arg1_bef_arg2(y,x),f3(b,x,t)->Un(b),g4(a,y,x,t)->next(a),P4(a,y,x,t)->([y,x] in t)) ==>
	Theorem wellfounded_recursive_fcn.4: (FORALL x, t | (x in s) ¥imp (rk_thryvar(x,t) = Un({next(rk_thryvar(y,t)): y in s | arg1_bef_arg2(y,x) & ([y,x] in t)})))
--
ENTER_THEORY Set_theory
--
-- The theory just derived can be summarized as follows.
--
--DISPLAY wellfounded_recursive_fcn
--
--THEORY wellfounded_recursive_fcn(s,arg1_bef_arg2(y,x),f3(b,x,t),g4(a,y,x,t),P4(a,y,x,t))
--	(FORALL t ¥incin s | ((t /= 0) ¥imp (EXISTS x in t | (FORALL y in t | not(arg1_bef_arg2(y,x))))))
--==>(wfh2_thryvar,rk_thryvar)
--	(FORALL x, t | (x in s) ¥imp (wfh2_thryvar(x,t) = f3({g4(wfh2_thryvar(y,t),y,x,t): y in s | arg1_bef_arg2(y,x) & P4(wfh2_thryvar(y,t),y,x,t)},x,t)))
--	(FORALL x, t | (x in s) ¥imp (rk_thryvar(x,t) = Un({next(rk_thryvar(y,t)): y in s | arg1_bef_arg2(y,x) & ([y,x] in t)})))
--END wellfounded_recursive_fcn;
--
-- The following theorem states that inclusion is a well-founded relation on each
-- family of finite sets.
--
Theorem 411: [well-foundedness of inclusion between finite sets] ((FORALL v in X | Finite(v)) & (U ¥incin X) & (U /= 0)) ¥imp
		(EXISTS w in U | (FORALL y in U | not((y ¥incin w) & (y /= w)))). Proof:
    Suppose_not(x,u) ==> Stat1: (u ¥incin x) & (u /= 0) &
		Stat2: (not(EXISTS w in u | (FORALL y in u | not((y ¥incin w) & (y /= w))))) &
		Stat3: (FORALL v in x | Finite(v))
--
-- For, assuming the contrary, there must exist a finite non-null set $u$ none of
-- whose elements is inclusion minimal. Apply the theory of finite induction to $arb(u)$,
-- thereby obtaining a set $m$ having strict subset $k$ belonging to $u$ but which is such that no
-- strict subset of any such k belongs to $u$. Consideration of $m$ and such a $k$
-- leads immediatiately to a contradiction which proves our theorem.
--
    Suppose ==> Stat4: not(EXISTS y in u | (y ¥incin arb(u)) & (y /= arb(u)))
        (arb(u),y0)-->Stat2 ==> Stat5: not(FORALL y in u | not((y ¥incin arb(u)) & (y /= arb(u))))
	    y0-->Stat5 ==> (y0 in u) & (y0 ¥incin arb(u)) & (y0 /= arb(u))
	y0-->Stat4 ==> false; Discharge ==> (EXISTS y in u | (y ¥incin arb(u)) & (y /= arb(u)))
	(arb(u))-->Stat3 ==> Finite(arb(u))
	APPLY(m1_thryvar:m) finite_induction(n->arb(u), P(x)->(EXISTS y in u | (y ¥incin x) & (y /= x))) ==>
		Stat6: (EXISTS y in u | (y ¥incin m) & (y /= m)) &
			Stat7: (FORALL k ¥incin m | (k /= m) ¥imp (not(EXISTS y in u | (y ¥incin k) & (y /= k))))
	k-->Stat6 ==> Stat8: (k in u) & (k ¥incin m) & (k /= m)
	k-->Stat7 ==> Stat9: not(EXISTS y in u | (y ¥incin k) & (y /= k))
    k-->Stat2 ==> Stat10: not(FORALL y in u | not((y ¥incin k) & (y /= k)))
    y1-->Stat10 ==> (y1 in u) & (y1 ¥incin k) & (y1 /= k)
    y1-->Stat9 ==> false; Discharge ==> QED
--
-- Our main aim in the theorems which now follow is to prove that every one of a wide class of recursions
-- specifies a function  defined everywhere over the integers, or more generally
-- over various families of finite sets. As a first step in this direction,
-- we consider a pair of functions $h_q$ and $h_r$, both of which satisfy the same recursive
-- relationship on their domains $d$, which are assumed to be such that every subset of a member of
-- of $d$ is finite and belongs to $d$. (For example, $d$ might be ${x: x ¥incin s | Finite(x)}$).
-- We show that $h_q$ and $h_r$ necessarily agree on the intersection of their domains,
-- and so have a common single-valued extension.
--
THEORY finite_recursion_coherence(q,r,h_q(x,t),h_r(x,t),f3(b,x,t),g4(a,y,x,t),P4(a,y,x,t))
	(FORALL x in q, y ¥incin x | Finite(x) & (y in q))
	(FORALL x in r, y ¥incin x | Finite(x) & (y in r))
	(FORALL x in q, t | h_q(x,t) = f3({g4(h_q(y,t),y,x,t): y in q | (y ¥incin x) & (y /= x) & P4(h_q(y,t),y,x,t)},x,t))
	(FORALL x in r, t | h_r(x,t) = f3({g4(h_r(y,t),y,x,t): y in r | (y ¥incin x) & (y /= x) & P4(h_r(y,t),y,x,t)},x,t))
END finite_recursion_coherence;

ENTER_THEORY finite_recursion_coherence

Theorem finite_recursion_coherence.1: ((X in q) & (X in r)) ¥imp (h_q(X,T) = h_r(X,T)). Proof:
    Suppose_not(x,t) ==> (x in q) & (x in r) & (h_q(x,t) /= h_r(x,t))
--
-- For suppose that $m$, $q$, $r$, and $t$ form a counterexample to our assertion, where by the principle of finite
-- induction we can assume that no proper subset of $m$ is also a counterexample.
--
	Assump ==> Stat1: (FORALL x in q, y ¥incin x | Finite(x) & (y in q))
	(x,x)-->Stat1 ==> Finite(x)
	APPLY(m1_thryvar:m) finite_induction(n->x, P(v)->(h_q(v,t) /= h_r(v,t))) ==>
		(m ¥incin x) & (h_q(m,t) /= h_r(m,t)) & Stat2: (FORALL k ¥incin m | ((k /= m) ¥imp (not (h_q(k,t) /= h_r(k,t)))))
	(x,m)-->Stat1 ==> m in q
	Assump ==> Stat3: (FORALL x in r, y ¥incin x | Finite(x) & (y in r))
	(x,m)-->Stat3 ==> m in r
--
-- Since $h_q(m,t)$ and $h_r(m,t)$ difer, the recursive expressions for these quantities must also differ,
-- and so there must exist a $c$ belonging to one, but not the other, of of the two sets displayed below.
--
	Assump ==> Stat4: (FORALL x in q, t | h_q(x,t) = f3({g4(h_q(y,t),y,x,t): y in q | (y ¥incin x) & (y /= x) & P4(h_q(y,t),y,x,t)},x,t))
	(m,t)-->Stat4 ==> h_q(m,t) = f3({g4(h_q(y,t),y,m,t): y in q | (y ¥incin m) & (y /= m) & P4(h_q(y,t),y,m,t)},m,t)
	Assump ==> Stat5: (FORALL x in r, t | h_r(x,t) = f3({g4(h_r(y,t),y,x,t): y in r | (y ¥incin x) & (y /= x) & P4(h_r(y,t),y,x,t)},x,t))
	(m,t)-->Stat5 ==> h_r(m,t) = f3({g4(h_r(y,t),y,m,t): y in r | (y ¥incin m) & (y /= m) & P4(h_r(y,t),y,m,t)},m,t)
	EQUAL ==> f3({g4(h_q(y,t),y,m,t): y in q | (y ¥incin m) & (y /= m) &
					P4(h_q(y,t),y,m,t)},m,t) /= f3({g4(h_r(y,t),y,m,t): y in r | (y ¥incin m) & (y /= m) & P4(h_r(y,t),y,m,t)},m,t)
	Suppose ==> {g4(h_q(y,t),y,m,t): y in q | (y ¥incin m) & (y /= m) & P4(h_q(y,t),y,m,t)} =
		{g4(h_r(y,t),y,m,t): y in r | (y ¥incin m) & (y /= m) & P4(h_r(y,t),y,m,t)}
	EQUAL ==> false; Discharge ==> Stat6: {g4(h_q(y,t),y,m,t): y in q | (y ¥incin m) & (y /= m) & P4(h_q(y,t),y,m,t)} /=
		{g4(h_r(y,t),y,m,t): y in r | (y ¥incin m) & (y /= m) & P4(h_r(y,t),y,m,t)}
	c-->Stat6 ==> (c in {g4(h_q(y,t),y,m,t): y in q | (y ¥incin m) & (y /= m) & P4(h_q(y,t),y,m,t)}) ¥eq
				(c notin {g4(h_r(y,t),y,m,t): y in r | (y ¥incin m) & (y /= m) & P4(h_r(y,t),y,m,t)})
--
-- Suppose that $c$ belongs to the first, but not the second, of these sets. Then $m$ must have a proper subset $k$
-- for which $h_q(k,t)$ and $h_q(k,t)$ differ, which is impossible by the minimality of $m$
--
	Suppose ==> Stat7: (c in {g4(h_q(y,t),y,m,t): y in q | (y ¥incin m) & (y /= m) & P4(h_q(y,t),y,m,t)}) &
		(c notin {g4(h_r(y,t),y,m,t): y in r | (y ¥incin m) & (y /= m) & P4(h_r(y,t),y,m,t)})
	(k,k)-->Stat7 ==> (k in q) & (k ¥incin m) & (k /= m) & P4(h_q(k,t),k,m,t) &
							((g4(h_q(k,t),k,m,t) /= g4(h_r(k,t),k,m,t)) or (k notin r) or (not(P4(h_r(k,t),k,m,t))))
	(m,k)-->Stat3 ==> k in r
	k-->Stat2 ==> h_q(k,t) = h_r(k,t)
	EQUAL ==> (g4(h_q(k,t),k,m,t) = g4(h_r(k,t),k,m,t)) & P4(h_r(k,t),k,m,t)
	Discharge ==> Stat8: (c in {g4(h_r(y,t),y,m,t): y in r | (y ¥incin m) & (y /= m) & P4(h_r(y,t),y,m,t)}) &
		(c notin {g4(h_q(y,t),y,m,t): y in q | (y ¥incin m) & (y /= m) & P4(h_q(y,t),y,m,t)})
--
-- But exactly the same argument applies if $c$ belongs to the second, but not the first, of these sets,
-- and so our theorem is proved.
--
	(kp,kp)-->Stat8 ==> Stat9: (kp in r) & (kp ¥incin m) & (kp /= m) & P4(h_r(kp,t),kp,m,t) &
		((g4(h_r(kp,t),kp,m,t) /= g4(h_q(kp,t),kp,m,t)) or (kp notin q) or (not(P4(h_q(kp,t),kp,m,t))))
	(m,kp)-->Stat1 ==> kp in q
	kp-->Stat2 ==> h_q(kp,t) = h_r(kp,t)
	EQUAL ==> (g4(h_q(kp,t),kp,m,t) = g4(h_r(kp,t),kp,m,t)) & P4(h_q(kp,t),kp,m,t)
    (Stat9)Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The theory just established can be summarized as follows.
--
--DISPLAY finite_recursion_coherence
--
--THEORY finite_recursion_coherence(q,r,h_q(x,t),h_r(x,t),f3(b,x,t),g4(a,y,x,t),P4(a,y,x,t))
--	(FORALL x in q, y ¥incin x | Finite(x) & (y in q))
--	(FORALL x in r, y ¥incin x | Finite(x) & (y in r))
--	(FORALL x in q, t | h_q(x,t) = f3({g4(h_q(y,t),y,x,t): y in q | (y ¥incin x) & (y /= x) & P4(h_q(y,t),y,x,t)},x,t))
--	(FORALL x in r, t | h_r(x,t) = f3({g4(h_r(y,t),y,x,t): y in r | (y ¥incin x) & (y /= x) & P4(h_r(y,t),y,x,t)},x,t))
--==>
--	(FORALL x, t | ((x in q) & (x in r)) ¥imp (h_q(x,t) = h_r(x,t)))
--END finite_recursion_coherence;
--
-- In further preparation for the theory of recursive function defined over finite sets,
-- we show that any relation devoid of cycles, when restricted to a finite set, turns
-- out to be well-founded over such domain. To make matters simple (since defining acyclic
-- relations would be a relatively complicated matter, we assume the relation to be
-- transitive (this covers, for example, the significant case of strict inclusion).
--
THEORY fin_well_founded(s,arg1_bef_arg2(y,x))
    (FORALL x,y,wz | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,wz)) ¥imp arg1_bef_arg2(x,wz))
    (FORALL x | not(arg1_bef_arg2(x,x)))
    Finite(s)
END fin_well_founded;
--
ENTER_THEORY fin_well_founded
--
Theorem fin_well_founded.1: ((V ¥incin s) & (V /= 0)) ¥imp (EXISTS m in V | (FORALL y in V | not(arg1_bef_arg2(y,m)))). Proof:
    Suppose_not(v) ==>  (v ¥incin s) & (v /= 0) & (not(EXISTS m in v | (FORALL y in v | not(arg1_bef_arg2(y,m)))))
--
-- Assuming by contradiction that the relation $arg1_bef_arg2$ is not well-founded on the finite set $s$,
-- there would be a non-null subset $v$ of $s$ which has no minimal element. By application of the
-- THEORY finite_induction, we can choose a smallest subset $w$ of $s$ which has no minimal element.
--
        Assump ==> Finite(s)
        Assump ==> Stat1: (FORALL x | not(arg1_bef_arg2(x,x)))
        (s,v)-->T189 ==> Finite(v)
        APPLY(m1_thryvar:w) finite_induction(n->v,P(x)->((x /= 0) & (not(EXISTS m in x | (FORALL y in x | not(arg1_bef_arg2(y,m))))))) ==>
	      (w ¥incin v) & (w /= 0) & Stat2: (not(EXISTS m in w | (FORALL y in w | not(arg1_bef_arg2(y,m))))) &
	  Stat3: (FORALL k ¥incin w | (k /= w) ¥imp (not((k /= 0) & (not(EXISTS m in k | (FORALL y in k | not(arg1_bef_arg2(y,m))))))))
        (arb(w))-->Stat1 ==> (not(arg1_bef_arg2(arb(w),arb(w))))
--
-- Clearly, $w$ cannot be a singleton (else $arb(w)$ would be its minimum). We can hence
-- find a minimal element $m$ in $w - {arb(w)}$.
--
        Suppose ==> w = {arb(w)}
            (arb(w))-->Stat2 ==> Stat4: (not(FORALL y in w | not(arg1_bef_arg2(y,arb(w)))))
            y-->Stat4 ==> (y in w) & arg1_bef_arg2(y,arb(w))
            ELEM ==> y = arb(w)
        EQUAL ==> false; Discharge ==> ((w - {arb(w)}) ¥incin w) & (w - {arb(w)} /= w) & (w - {arb(w)} /= 0)
        (w - {arb(w)})-->Stat3 ==> Stat5: (EXISTS m in (w - {arb(w)}) | (FORALL y in (w - {arb(w)}) | not(arg1_bef_arg2(y,m))))
        m-->Stat5 ==> (m in (w - {arb(w)})) & (m in (w - {arb(w)})) & Stat6: (FORALL y in (w - {arb(w)}) | not(arg1_bef_arg2(y,m)))
        m-->Stat2 ==> Stat7: (not(FORALL y in w | not(arg1_bef_arg2(y,m))))
--
-- If $arb(w)$ did not precede $m$ in the relation $arg1_bef_arg2$, then it would
-- readily follow that $m$ would  be minimal in $w$; to avoid this contradiction,
-- we must assume that $arb(w)$ precedes $m$.
--
        Suppose ==> (not(arg1_bef_arg2(arb(w),m)))
            yp-->Stat7 ==> (yp in w) & arg1_bef_arg2(yp,m)
            Suppose ==> yp = arb(w)
            EQUAL ==> false; Discharge ==> yp /= arb(w)
        yp-->Stat6 ==> false; Discharge ==> arg1_bef_arg2(arb(w),m)
--
-- Then $x$ cannot precede $arb(w)$ in the relation $arg1_bef_arg2$, for any $w in w$
-- (else we would have $x /= arb(w)$ and $x$ before $m$ in the relation $arg1_bef_arg2$).
-- Consequently, $arb(w)$ is a minimal element of $w$; this new contradiction enables us to
-- conclude with the desired statement.
--
        (arb(w))-->Stat2 ==> Stat8: (not(FORALL y in w | not(arg1_bef_arg2(y,arb(w)))))
        yq-->Stat8 ==> (yq in w) & arg1_bef_arg2(yq,arb(w))
        Assump ==> Stat9: (FORALL x, y, wz | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,wz)) ¥imp arg1_bef_arg2(x,wz))
        (yq,arb(w),m)-->Stat9 ==> arg1_bef_arg2(yq,m)
        Suppose ==> arb(w) = yq
        EQUAL ==> false; Discharge ==> yq in (w - {arb(w)})
    yq-->Stat6 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The theory just established can be summarized as follows.
--
--DISPLAY fin_well_founded
--
--THEORY fin_well_founded(s,arg1_bef_arg2(x,y))
--    (FORALL x,y,z | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) ¥imp arg1_bef_arg2(x,z))
--    (FORALL x | not(arg1_bef_arg2(x,x)))
--    Finite(s)
--==>
--    ((V ¥incin s) & (V /= 0)) ¥imp (EXISTS m in V | (FORALL x in V | not(arg1_bef_arg2(x,m))))
--END fin_well_founded;
--
--
-- Our next aim is to prove that any recursion which determines a value $h2(s,t)$ dependent on two parameters,
-- the first of these being a finite set, in terms of the values $h2(sp,t)$ for which $sp$ is a proper subset of $s$,
-- actually defines a function $h2(s,t)$ single-valued for all finite $s$ and all $t$. We state this result by defining
-- an auxiliary theory whose first theorem, seen just below, has a form allowing immediate Skolemization.
-- By Skolemizing this we will derive a second result in the convenient form desired.
--
THEORY finite_recursive_fcn(f3(b,x,t),g4(a,y,x,t),P4(a,y,x,t))
END finite_recursive_fcn;
--
--
ENTER_THEORY finite_recursive_fcn
--
-- We now show that the finite subsets of any set $s$ are well-ordered by strict inclusion.
--
Theorem finite_recursive_fcn.0: ((T ¥incin {y: y ¥incin S | Finite(y)}) & (T /= 0)) ¥imp (EXISTS x in T | (FORALL y in T | not((y ¥incin x) & (y /= x)))). Proof:
--
-- As a matter of fact, if we consider any non-null subset $t$ of the
-- family of all finite subsets of $s$, and then take an element $r$ of $t$,
-- then the set $mm$ of all minorants of $r$ in $t$ turns out to be finite
-- (inasmuch as a subset of $pow(r)$, which is finite). Hence it will have an
-- inclusion-minimal element $m$, which will also be minimal in $t$.
--
    Suppose_not(t,s) ==> Stat1: (t /= 0) & (t ¥incin {y: y ¥incin s | Finite(y)}) & Stat2: (not(EXISTS x in t | (FORALL y in t | not((y ¥incin x) & (y /= x)))))
        r-->Stat1 ==> (r in t) & Stat3: (r in {y: y ¥incin s | Finite(y)})
        a-->Stat3 ==> (r = a) & Finite(a)
        EQUAL ==> Finite(r)
        Loc_def ==> mm = {y: y in t | (y ¥incin r) & (y /= r)}
        Suppose ==> Stat4: (not(mm ¥incin pow(r)))
            c-->Stat4 ==> (c in mm) & (c notin pow(r))
            Use_def(pow) ==> Stat5: ((c in {y: y in t | (y ¥incin r) & (y /= r)}) & (c notin {x: x ¥incin r}))
        (yp,yp)-->Stat5 ==> false; Discharge ==> mm ¥incin pow(r)
        r-->T264 ==> Finite(pow(r))
        (pow(r),mm)-->T189 ==> Finite(mm)
        r-->T264 ==> Finite(pow(r))
        (pow(r),mm)-->T189 ==> Finite(mm)
        Suppose ==> Stat6: ({y: y in t | (y ¥incin r) & (y /= r)} = 0)
            r-->Stat2 ==> Stat7: (not(FORALL y in t | not((y ¥incin r) & (y /= r))))
            y-->Stat7 ==> (y in t) & (y ¥incin r) & (y /= r)
        y-->Stat6 ==> false; Discharge ==> mm /= 0
        Suppose ==> Stat8: (not(FORALL x | not((x ¥incin x) & (x /= x))))
        xp-->Stat8 ==> false; Discharge ==> (FORALL x | not((x ¥incin x) & (x /= x)))
        Suppose ==> Stat9: (not(FORALL xx,yy,wz | (((xx ¥incin yy) & (xx /= yy)) & ((yy ¥incin wz) & (yy /= wz))) ¥imp ((xx ¥incin wz) & (xx /= wz))))
        (xx,yy,wz)-->Stat9(*) ==> false; Discharge ==> (FORALL xx,yy,wz | (((xx ¥incin yy) & (xx /= yy)) & ((yy ¥incin wz) & (yy /= wz))) ¥imp ((xx ¥incin wz) & (xx /= wz)))
        APPLY() fin_well_founded(s->(pow(r)),arg1_bef_arg2(y,x)->((y ¥incin x) & (y /= x))) ==>
		Stat10: (FORALL v | ((v ¥incin pow(r)) & (v /= 0)) ¥imp (EXISTS m in v | (FORALL x in v | not((x ¥incin m) & (x /= m)))))
        mm-->Stat10(Stat1*) ==> Stat11: (EXISTS m in mm | (FORALL x in mm | not((x ¥incin m) & (x /= m))))
        m-->Stat11(Stat1*) ==> Stat12: (m in {y: y in t | (y ¥incin r) & (y /= r)}) & Stat13: (FORALL x in mm | not((x ¥incin m) & (x /= m)))
        yq-->Stat12(Stat1*) ==> (m in t) & (m ¥incin r) & (m /= r)
        m-->Stat2(Stat1*) ==> Stat14: (not(FORALL y in t | not((y ¥incin m) & (y /= m))))
        u-->Stat14(Stat1*) ==> (u in t) & (u ¥incin m) & (u /= m)
        Suppose ==> Stat15: u notin {y: y in t | (y ¥incin r) & (y /= r)}
        u-->Stat15(Stat1*) ==> false; Discharge ==> u in mm
    u-->Stat13(Stat1*) ==> false; Discharge ==> QED
--
Theorem finite_recursive_fcn.1: (FORALL s,t | (EXISTS h | (FORALL x | ((x ¥incin s) & Finite(x)) ¥imp
			(h~[x] = f3({g4(h~[y],y,x,t): y ¥incin x | (y /= x) & P4(h~[y],y,x,t)},x,t))))). Proof:
    Suppose_not ==> Stat1: not (FORALL s,t | (EXISTS h | (FORALL x | ((x ¥incin s) & Finite(x)) ¥imp
			(h~[x] = f3({g4(h~[y],y,x,t): y ¥incin x | (y /= x) & P4(h~[y],y,x,t)},x,t)))))
--
-- For if we let $s$, $t$ be a counterexample to our assertion and apply our wellfounded_recursive_fcn THEORY,
-- a contradiction results easily. Indeed, the wellfounded_recursive_fcn THEORY defined previously
-- gives us a function $hh$ satisfying the recursive relationship seen just below.
--
	    (s,t)-->Stat1 ==> Stat2: not (EXISTS h | (FORALL x | ((x ¥incin s) & Finite(x)) ¥imp
										(h~[x] = f3({g4(h~[y],y,x,t): y ¥incin x | (y /= x) & P4(h~[y],y,x,t)},x,t))))
        Suppose ==> Stat3: (not(FORALL t | ((t ¥incin {y: y ¥incin s | Finite(y)}) & (t /= 0)) ¥imp (EXISTS x in t | (FORALL y in t | not((y ¥incin x) & (y /= x))))))
            d-->Stat3 ==> ((d ¥incin {y: y ¥incin s | Finite(y)}) & (d /= 0)) & (not(EXISTS x in d | (FORALL y in d | not((y ¥incin x) & (y /= x)))))
        (d,s)-->Tfinite_recursive_fcn.0 ==> false; Discharge ==> (FORALL t | ((t ¥incin {y: y ¥incin s | Finite(y)}) & (t /= 0)) ¥imp (EXISTS x in t | (FORALL y in t | not((y ¥incin x) & (y /= x)))))
	    APPLY(wfh2_thryvar:hh) wellfounded_recursive_fcn(s->{y: y ¥incin s | Finite(y)}, arg1_bef_arg2(y,x)->((y ¥incin x) & (y /= x)), f3(b,x,t)->f3(b,x,t), g4(a,y,x,t)->g4(a,y,x,t), P4(a,y,x,t)->P4(a,y,x,t)) ==>
				Stat4: (FORALL x, t | (x in {y: y ¥incin s | Finite(y)}) ¥imp
					(hh(x,t) = f3({g4(hh(y,t),y,x,t): y in {y: y ¥incin s | Finite(y)} | (y ¥incin x) & (y /= x) & P4(hh(y,t),y,x,t)},x,t)))
--
-- But this recursive relationship can be rewritten in the simplified form seen in the following. For were this not the case,
-- the two sets seen below would necessarily differ.
--
        Suppose ==> Stat5: not (FORALL x, t | (x in {y: y ¥incin s | Finite(y)}) ¥imp
				(hh(x,t) = f3({g4(hh(y,t),y,x,t): y ¥incin x | (y /= x) & P4(hh(y,t),y,x,t)},x,t)))
	        (xp,tp)-->Stat5 ==> Stat6: (xp in {y: y ¥incin s | Finite(y)}) & (hh(xp,tp) /= f3({g4(hh(y,tp),y,xp,tp): y ¥incin xp | (y /= xp) & P4(hh(y,tp),y,xp,tp)},xp,tp))
	        x-->Stat6 ==> (x=xp) & (xp ¥incin s) & Finite(x)
            EQUAL ==> Finite(xp)
	        (x,t)-->Stat4 ==> hh(x,t) = f3({g4(hh(y,t),y,x,t): y in {y: y ¥incin s | Finite(y)} | (y ¥incin x) & (y /= x) & P4(hh(y,t),y,x,t)},x,t)
	        Suppose ==> {g4(hh(y,t),y,x,t): y ¥incin x | (y /= x) & P4(hh(y,t),y,x,t)} =
					{g4(hh(y,t),y,x,t): y in {y: y ¥incin s | Finite(y)} | (y ¥incin x) & (y /= x) & P4(hh(y,t),y,x,t)}
	        EQUAL ==> false; Discharge ==> Stat7: {g4(hh(y,t),y,x,t): y ¥incin x | (y /= x) & P4(hh(y,t),y,x,t)} /=
					{g4(hh(y,t),y,x,t): y in {y: y ¥incin s | Finite(y)} | (y ¥incin x) & (y /= x) & P4(hh(y,t),y,x,t)}
--
-- And it is easily seen that these two sets must be equal.
--
	        c-->Stat7 ==> (c in {g4(hh(y,t),y,x,t): y ¥incin x | (y /= x) & P4(hh(y,t),y,x,t)}) ¥eq
						(c notin {g4(hh(y,t),y,x,t): y in {y: y ¥incin s | Finite(y)} | (y ¥incin x) & (y /= x) & P4(hh(y,t),y,x,t)})
	        Suppose ==> Stat8: (c in {g4(hh(y,t),y,x,t): y ¥incin x | (y /= x) & P4(hh(y,t),y,x,t)}) &
					Stat9: (c notin {g4(hh(y,t),y,x,t): y in {y: y ¥incin s | Finite(y)} | (y ¥incin x) & (y /= x) & P4(hh(y,t),y,x,t)})
	            y-->Stat8 ==> (c = g4(hh(y,t),y,x,t)) & (y ¥incin x) & (y /= x) & P4(hh(y,t),y,x,t)
	            y-->Stat9 ==> Stat10: y notin {y: y ¥incin s | Finite(y)}
                (x,y)-->T189 ==> Finite(y)
	        y-->Stat10 ==> false; Discharge ==> Stat11: (c notin {g4(hh(y,t),y,x,t): y ¥incin x | (y /= x) & P4(hh(y,t),y,x,t)}) &
					Stat12: (c in {g4(hh(y,t),y,x,t): y in {y: y ¥incin s  | Finite(y)} | (y ¥incin x) & (y /= x) & P4(hh(y,t),y,x,t)})
                yp-->Stat12 ==> (c = g4(hh(yp,t),yp,x,t)) & (yp ¥incin x) & (yp /= x) & P4(hh(yp,t),yp,x,t) & (yp in {y: y ¥incin s  | Finite(y)})
        yp-->Stat11 ==> false; Discharge ==> Stat13: (FORALL x, t | (x in {y: y ¥incin s | Finite(y)}) ¥imp
				(hh(x,t) = f3({g4(hh(y,t),y,x,t): y ¥incin x | (y /= x) & P4(hh(y,t),y,x,t)},x,t)))
--
-- Holding $t$ fixed, we can now view $hh(x,t)$ as a map $h2$ satisfying $h2~[x] = if x in {y: y ¥incin s} then hh(x,t) else 0 end if$
-- for all $x$.
--
	    Loc_def ==> h2 = {[x,hh(x,t)]: x in {y: y ¥incin s | Finite(y)}}
	    APPLY() fcn_symbol(f(x)->hh(x,t),g->h2,s->{y: y ¥incin s | Finite(y)}) ==>
			Svm(h2) & Stat14: (FORALL x | h2~[x] = if x in {y: y ¥incin s | Finite(y)} then hh(x,t) else 0 end if)
        SIMPLF ==> (h2 = {[x,hh(x,t)]: x ¥incin s | Finite(x)})
--
-- But now $h2$ is easily seen to satify the recursive relationship seen below, and so can serve as the $h$ whose existence our theorem asserts.
--
        Suppose ==> Stat15: not(FORALL x | ((x ¥incin s) & Finite(x)) ¥imp
										(h2~[x] = f3({g4(h2~[y],y,x,t): y ¥incin x | (y /= x) & P4(h2~[y],y,x,t)},x,t)))
            x2-->Stat15 ==> (x2 ¥incin s) & Finite(x2) & (h2~[x2] /= f3({g4(h2~[y],y,x2,t): y ¥incin x2 | (y /= x2) & P4(h2~[y],y,x2,t)},x2,t))
            x2-->Stat14 ==> h2~[x2] = if x2 in {y: y ¥incin s | Finite(y)} then hh(x2,t) else 0 end if
            Suppose ==> Stat16: not (x2 in {y: y ¥incin s | Finite(y)})
            x2-->Stat16 ==> false; Discharge ==> x2 in {y: y ¥incin s | Finite(y)}
	        ELEM ==> h2~[x2] = hh(x2,t)
            (x2,t)-->Stat13 ==> hh(x2,t) = f3({g4(hh(y,t),y,x2,t): y ¥incin x2 | (y /= x2) & P4(hh(y,t),y,x2,t)},x2,t)
            ELEM ==> f3({g4(h2~[y],y,x2,t): y ¥incin x2 | (y /= x2) & P4(h2~[y],y,x2,t)},x2,t) /= f3({g4(hh(y,t),y,x2,t): y ¥incin x2 | (y /= x2) & P4(hh(y,t),y,x2,t)},x2,t)
            Suppose ==> {g4(h2~[y],y,x2,t): y ¥incin x2 | (y /= x2) & P4(h2~[y],y,x2,t)} = {g4(hh(y,t),y,x2,t): y ¥incin x2 | (y /= x2) & P4(hh(y,t),y,x2,t)}
            EQUAL ==> false; Discharge ==> Stat17: {g4(h2~[y],y,x2,t): y ¥incin x2 | (y /= x2) & P4(h2~[y],y,x2,t)} /= {g4(hh(y,t),y,x2,t): y ¥incin x2 | (y /= x2) & P4(hh(y,t),y,x2,t)}
            dp-->Stat17 ==> (dp ¥incin x2) & (g4(h2~[dp],dp,x2,t) /= g4(hh(dp,t),dp,x2,t) or ((dp /= x2) & P4(h2~[dp],dp,x2,t) & (not ((dp /= x2) & P4(hh(dp,t),dp,x2,t)))) or
					((not (((dp /= x2) & P4(h2~[dp],dp,x2,t)))) & (dp /= x2) & P4(hh(dp,t),dp,x2,t)))
            ELEM ==> g4(h2~[dp],dp,x2,t) /= g4(hh(dp,t),dp,x2,t) or (not (P4(hh(dp,t),dp,x2,t) ¥eq P4(h2~[dp],dp,x2,t)))
	        Suppose ==> h2~[dp] = hh(dp,t)
	        EQUAL ==> false; Discharge ==> h2~[dp] /= hh(dp,t)
	        dp-->Stat14 ==> h2~[dp] = if dp in {y: y ¥incin s | Finite(y)} then hh(dp,t) else 0 end if
	        Suppose ==> Stat18: dp notin {y: y ¥incin s | Finite(y)}
                (x2,dp)-->T189 ==> Finite(dp)
            dp-->Stat18 ==> false; Discharge ==> dp in {y: y ¥incin s | Finite(y)}
        Discharge ==> (FORALL x | ((x ¥incin s) & Finite(x)) ¥imp
										(h2~[x] = f3({g4(h2~[y],y,x,t): y ¥incin x | (y /= x) & P4(h2~[y],y,x,t)},x,t)))
    h2-->Stat2 ==> false; Discharge ==> QED
--
--	We now define an auxiliary function $hsko(s,t)$ by Skolemizing the preceding theorem.
-- The formal definition is as follows.
--
APPLY(v1_thryvar:hsko) Skolem() ==>
    Theorem finite_recursive_fcn.a: (FORALL s,t | (FORALL x | ((x ¥incin s) & Finite(x)) ¥imp
			(hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y ¥incin x | (y /= x) & P4(hsko(s,t)~[y],y,x,t)},x,t))))
--
-- The following theorem simply transforms the preceding into a more readily usable form.
--
Theorem finite_recursive_fcn.2: (FORALL x | ((x ¥incin S) & Finite(x)) ¥imp
			(hsko(S,T)~[x] = f3({g4(hsko(S,T)~[y],y,x,T): y ¥incin x | (y /= x) & P4(hsko(S,T)~[y],y,x,T)},x,T))). Proof:
	Suppose_not(s,t) ==> not (FORALL x | ((x ¥incin s) & Finite(x)) ¥imp
			(hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y ¥incin x | (y /= x) & P4(hsko(s,t)~[y],y,x,t)},x,t)))
	Tfinite_recursive_fcn.a ==> Stat1: (FORALL s,t | (FORALL x | ((x ¥incin s) & Finite(x)) ¥imp
			(hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y ¥incin x | (y /= x) & P4(hsko(s,t)~[y],y,x,t)},x,t))))
	(s,t)-->Stat1 ==> false; Discharge ==> QED
--
-- The function $h_thryvar$ at which the present theory aims is defined as follows in terms of $hsko$.
--
Def finite_recursive_fcn.b: [?] rech2_thryvar(u,v) := hsko(u,v)~[u]
--
-- Our next theorem states the property of $h_thryvar$ at which we aim.
--
Theorem finite_recursive_fcn.3: Finite(S) ¥imp (rech2_thryvar(S,T) = f3({g4(rech2_thryvar(y,T),y,S,T): y ¥incin S | (y /= S) & P4(rech2_thryvar(y,T),y,S,T)},S,T)). Proof:
    Suppose_not(s,t) ==> Finite(s) & (rech2_thryvar(s,t) /= f3({g4(rech2_thryvar(y,t),y,s,t): y ¥incin s | (y /= s) & P4(rech2_thryvar(y,t),y,s,t)},s,t))
--
--
--
	Use_def(rech2_thryvar) ==> hsko(s,t)~[s] /= f3({g4(hsko(y,t)~[y],y,s,t): y ¥incin s | (y /= s) & P4(hsko(y,t)~[y],y,s,t)},s,t)
	Tfinite_recursive_fcn.2 ==> Stat1: (FORALL x | ((x ¥incin s) & Finite(x)) ¥imp
			(hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y ¥incin x | (y /= x) & P4(hsko(s,t)~[y],y,x,t)},x,t)))
	s-->Stat1 ==> hsko(s,t)~[s] = f3({g4(hsko(s,t)~[y],y,s,t): y ¥incin s | (y /= s) & P4(hsko(s,t)~[y],y,s,t)},s,t)
	Suppose ==> {g4(hsko(s,t)~[y],y,s,t): y ¥incin s | (y /= s) & P4(hsko(s,t)~[y],y,s,t)} =
					{g4(hsko(y,t)~[y],y,s,t): y ¥incin s | (y /= s) & P4(hsko(y,t)~[y],y,s,t)}
	EQUAL ==> false; Discharge ==> Stat2: {g4(hsko(s,t)~[y],y,s,t): y ¥incin s | (y /= s) & P4(hsko(s,t)~[y],y,s,t)} /=
					{g4(hsko(y,t)~[y],y,s,t): y ¥incin s | (y /= s) & P4(hsko(y,t)~[y],y,s,t)}
	c-->Stat2 ==> (c ¥incin s) &  ((g4(hsko(s,t)~[c],c,s,t) /= g4(hsko(c,t)~[c],c,s,t)) or ((c /= s) & P4(hsko(s,t)~[c],c,s,t) & (not((c /= s) &
				P4(hsko(c,t)~[c],c,s,t)))) or
							 ((not ((c /= s) & P4(hsko(s,t)~[c],c,s,t))) & (c /= s) & P4(hsko(c,t)~[c],c,s,t)))
	(s,c)-->T189 ==> Finite(c)
	ELEM ==> ((g4(hsko(s,t)~[c],c,s,t) /= g4(hsko(c,t)~[c],c,s,t)) or (not (P4(hsko(s,t)~[c],c,s,t) ¥eq P4(hsko(c,t)~[c],c,s,t))))
	Suppose ==> hsko(c,t)~[c] = hsko(s,t)~[c]
	EQUAL ==> false; Discharge ==> hsko(c,t)~[c] /= hsko(s,t)~[c]
--
-- Next we show that the pair $hsko(c,t)~[y]$ and $hsko(s,t)~[y]$ of functions have the four properties needed to allow
-- application of the finite_recursion_coherence THEORY derived above. This is done for each of the four necessary statements
-- in turn by showing that the opposite supposition leads to a contradiction.
--
	Suppose ==> Stat3: not (FORALL x in pow(c), y ¥incin x | Finite(x) & (y in pow(c)))
	(a2,b2)-->Stat3 ==> (a2 in pow(c)) & (b2 ¥incin a2) & ((not Finite(a2)) or (b2 notin pow(c)))
	Use_def(pow) ==> Stat4: (a2 in {x: x ¥incin c})
	a2p-->Stat4 ==> a2 ¥incin c
	(c,a2)-->T189 ==> b2 notin pow(c)
	Use_def(pow) ==> Stat5: b2 notin {x: x ¥incin c}
	b2-->Stat5 ==> false; Discharge ==> (FORALL x in pow(c), y ¥incin x | Finite(x) & (y in pow(c)))
--
-- Next we consider the second of the four necessary properties.
--
	Suppose ==> Stat6: not (FORALL x in pow(s), y ¥incin x | Finite(x) & (y in pow(s)))
	(a,b)-->Stat6 ==> (a in pow(s)) & (b ¥incin a) & ((not Finite(a)) or (b notin pow(s)))
	Use_def(pow) ==> Stat7: (a in {x: x ¥incin s})
	ap-->Stat7 ==> a ¥incin s
	(s,a)-->T189 ==> b notin pow(s)
	Use_def(pow) ==> Stat8: b notin {x: x ¥incin s}
	b-->Stat8 ==> false; Discharge ==> (FORALL x in pow(s), y ¥incin x | Finite(x) & (y in pow(s)))
--
-- Having now established the first two of the four necessary properties we consider the third.
--
	Suppose ==> Stat9: not (FORALL x in pow(c), t | hsko(c,t)~[x] = f3({g4(hsko(c,t)~[y],y,x,t): y in pow(c) | (y ¥incin x) & (y /= x) &
					P4(hsko(c,t)~[y],y,x,t)},x,t))
	(a3,tq)-->Stat9(Stat9) ==> (a3 in pow(c)) &
				(hsko(c,tq)~[a3] /= f3({g4(hsko(c,tq)~[y],y,a3,tq): y in pow(c) | (y ¥incin a3) & (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)},a3,tq))
	Use_def(pow) ==> Stat10: a3 in {x: x ¥incin c}
	d3-->Stat10 ==> a3 ¥incin c
	(c,a3)-->T189 ==> Finite(a3)
	(c,tq)-->Tfinite_recursive_fcn.2 ==> Stat11: (FORALL x | ((x ¥incin c) & Finite(x)) ¥imp
			(hsko(c,tq)~[x] = f3({g4(hsko(c,tq)~[y],y,x,tq): y ¥incin x | (y /= x) & P4(hsko(c,tq)~[y],y,x,tq)},x,tq)))
	a3-->Stat11 ==> hsko(c,tq)~[a3] = f3({g4(hsko(c,tq)~[y],y,a3,tq): y ¥incin a3 | (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)},a3,tq)
	Suppose ==> {g4(hsko(c,tq)~[y],y,a3,tq): y in pow(c) | (y ¥incin a3) & (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)} =
					{g4(hsko(c,tq)~[y],y,a3,tq): y ¥incin a3 | (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)}
	EQUAL ==> false; Discharge ==> Stat12: {g4(hsko(c,tq)~[y],y,a3,tq): y in pow(c) | (y ¥incin a3) & (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)} /=
					{g4(hsko(c,tq)~[y],y,a3,tq): y ¥incin a3 | (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)}
	c2-->Stat12 ==> (c2 in {g4(hsko(c,tq)~[y],y,a3,tq): y in pow(c) | (y ¥incin a3) & (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)}) ¥eq
						(c2 notin {g4(hsko(c,tq)~[y],y,a3,tq): y ¥incin a3 | (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)})
	Suppose ==> Stat13: (c2 in {g4(hsko(c,tq)~[y],y,a3,tq): y in pow(c) | (y ¥incin a3) & (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)}) &
						Stat14: (c2 notin {g4(hsko(c,tq)~[y],y,a3,tq): y ¥incin a3 | (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)})
	d2-->Stat13 ==> (d2 in pow(c)) & (c2 = g4(hsko(c,tq)~[d2],d2,a3,tq)) & (d2 ¥incin a3) & (d2 /= a3) & P4(hsko(c,tq)~[d2],d2,a3,tq)
	d2-->Stat14 ==> false; Discharge ==> Stat15: (c2 notin {g4(hsko(c,tq)~[y],y,a3,tq): y in pow(c) | (y ¥incin a3) & (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)}) &
						Stat16: (c2 in {g4(hsko(c,tq)~[y],y,a3,tq): y ¥incin a3 | (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)})
	c3-->Stat16 ==> (c3 ¥incin a3) & (c2 = g4(hsko(c,tq)~[c3],c3,a3,tq)) & (c3 /= a3) & P4(hsko(c,tq)~[c3],c3,a3,tq)
	c3-->Stat15 ==> c3 notin pow(c)
	Use_def(pow) ==> Stat17: c3 notin {x: x ¥incin c}
	c3-->Stat17 ==> false; Discharge ==> (FORALL x in pow(c), t | hsko(c,t)~[x] = f3({g4(hsko(c,t)~[y],y,x,t): y in pow(c) | (y ¥incin x) & (y /= x) &
					P4(hsko(c,t)~[y],y,x,t)},x,t))
--
-- Having now established the first three of the four necessary properties it only remains to consider the fourth and last.
-- This can be handled in a manner almost identical to that of the third case considered above.
--
	Suppose ==> Stat18: not (FORALL x in pow(s), t | hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y in pow(s) | (y ¥incin x) & (y /= x) &
							P4(hsko(s,t)~[y],y,x,t)},x,t))
	(a4,tp)-->Stat18(Stat18) ==> (a4 in pow(s)) & (hsko(s,tp)~[a4] /= f3({g4(hsko(s,tp)~[y],y,a4,tp): y in pow(s) | (y ¥incin a4) & (y /= a4) &
							P4(hsko(s,tp)~[y],y,a4,tp)},a4,tp))
	Use_def(pow) ==> Stat19: a4 in {x: x ¥incin s}
	d4-->Stat19 ==> Stat20: a4 ¥incin s
	(s,a4)-->T189 ==> Finite(a4)
	(s,tp)-->Tfinite_recursive_fcn.2 ==> Stat21: (FORALL x | ((x ¥incin s) & Finite(x)) ¥imp
			(hsko(s,tp)~[x] = f3({g4(hsko(s,tp)~[y],y,x,tp): y ¥incin x | (y /= x) & P4(hsko(s,tp)~[y],y,x,tp)},x,tp)))
	a4-->Stat21(Stat20) ==> hsko(s,tp)~[a4] = f3({g4(hsko(s,tp)~[y],y,a4,tp): y ¥incin a4 | (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)},a4,tp)
	Suppose ==> {g4(hsko(s,tp)~[y],y,a4,tp): y in pow(s) | (y ¥incin a4) & (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)} =
					{g4(hsko(s,tp)~[y],y,a4,tp): y ¥incin a4 | (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)}
	EQUAL ==> false; Discharge ==> Stat22: {g4(hsko(s,tp)~[y],y,a4,tp): y in pow(s) | (y ¥incin a4) & (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)} /=
					{g4(hsko(s,tp)~[y],y,a4,tp): y ¥incin a4 | (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)}
	c4-->Stat22 ==> (c4 in {g4(hsko(s,tp)~[y],y,a4,tp): y in pow(s) | (y ¥incin a4) & (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)}) ¥eq
						(c4 notin {g4(hsko(s,tp)~[y],y,a4,tp): y ¥incin a4 | (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)})
	Suppose ==> Stat23: (c4 in {g4(hsko(s,tp)~[y],y,a4,tp): y in pow(s) | (y ¥incin a4) & (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)}) &
						Stat24: (c4 notin {g4(hsko(s,tp)~[y],y,a4,tp): y ¥incin a4 | (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)})
	d5-->Stat23 ==> Stat25: (d5 in pow(s)) & (d5 ¥incin a4) & (c4 = g4(hsko(s,tp)~[d5],d5,a4,tp)) & (d5 /= a4) & P4(hsko(s,tp)~[d5],d5,a4,tp)
	d5-->Stat24(Stat25) ==> false; Discharge ==>
			Stat26: (c4 notin {g4(hsko(s,tp)~[y],y,a4,tp): y in pow(s) | (y ¥incin a4) & (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)}) &
						Stat27: (c4 in {g4(hsko(s,tp)~[y],y,a4,tp): y ¥incin a4 | (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)})
	d6-->Stat27 ==> (d6 ¥incin a4) & (c4 = g4(hsko(s,tp)~[d6],d6,a4,tp)) & (d6 /= a4) & P4(hsko(s,tp)~[d6],d6,a4,tp)
	d6-->Stat26 ==> (d6 notin pow(s))
	Use_def(pow) ==> Stat28: d6 notin {x: x ¥incin s}
	d6-->Stat28 ==> false; Discharge ==>
		(FORALL x in pow(s), t | hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y in pow(s) | (y ¥incin x) & (y /= x) &
							P4(hsko(s,t)~[y],y,x,t)},x,t))
--
-- We now have everything needed to apply the finite_recursion_coherence THEORY developed above.
-- This gives a direct contradiction with the inequality $hsko(c,t)~[c] /= hsko(s,t)~[c]$ proved earlier, and so
-- completes the proof of the present theorem.
--
	APPLY() finite_recursion_coherence(q->pow(c),r->pow(s),h_q(x,t)->hsko(c,t)~[x],h_r(x,t)->hsko(s,t)~[x],f3(b,x,t)->f3(b,x,t),g4(a,y,x,t)->g4(a,y,x,t),P4(a,y,x,t)->P4(a,y,x,t)) ==>
			Stat29: (FORALL x, t | ((x in pow(c)) & (x in pow(s))) ¥imp (hsko(c,t)~[x] = hsko(s,t)~[x]))
	Suppose ==> c notin pow(s)
	Use_def(pow) ==> Stat30: c notin {x: x ¥incin s}
	c-->Stat30 ==> false; Discharge ==> c in pow(s)
	Suppose ==> c notin pow(c)
	Use_def(pow) ==> Stat31: c notin {x: x ¥incin c}
	c-->Stat31 ==> false; Discharge ==> c in pow(c)
	(c,t)-->Stat29 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- DISPLAY finite_recursive_fcn
--
-- THEORY finite_recursive_fcn(f3(b,x,t),g4(a,y,x,t),P4(a,y,x,t))
--
--	(FORALL s, t | Finite(s) ¥imp (rech2_thryvar(s,t) = f3({g4(rech2_thryvar(y,t),y,s,t): y ¥incin s |
--		(y /= s) & P4(rech2_thryvar(y,t),y,s,t)},s,t)))
--
-- END finite_recursive_fcn;
--
-- We will now derive a variant recursive function definition method which is simpler (but more limited)
-- than that which our prior finite_recursive_fcn THEORY affords. This applies to cases in which the value $f(s)$
-- can be defined in terms of  $f(sl(s))$ alone, for some strict subset $sl(s)$ (most typically
-- $s - {arb(s)}$). For this, we simply specialize the THEORY finite_recursive_fcn.
--
THEORY finite_tailrecursive_fcn(f(t),g3(a,x,t),sl(x))
	(FORALL x | (sl(x) ¥incin x) & ((x /= 0) ¥imp (sl(x) /= x)))
END finite_tailrecursive_fcn;
--
ENTER_THEORY finite_tailrecursive_fcn
--
	APPLY(rech2_thryvar:trech2_thryvar) finite_recursive_fcn(f3(b,x,t)->(if b = 0 then f(t) else arb(b) end if), g4(a,y,x,t)->g3(a,x,t), P4(a,y,x,t)->(y = sl(x))) ==>
Theorem finite_tailrecursive_fcn.0: (FORALL s,t | Finite(s) ¥imp (trech2_thryvar(s,t) =
		if      ({g3(trech2_thryvar(y,t),s,t): y ¥incin s | (y /= s) & (y = sl(s))} = 0) then f(t)
		else arb({g3(trech2_thryvar(y,t),s,t): y ¥incin s | (y /= s) & (y = sl(s))}) end if))
--
-- The clumsy recursive relationship appearing in this last Theorem can be simplified by noting that the condition
-- ${g3(trech2_thryvar(y,T),S,T): y ¥incin S | (y /= S) & (y = sel(S))} = 0$ is equivalent to $S = 0$,
-- and that when $S /= 0$ ${g3(trech2_thryvar(y,T),S,T): y ¥incin S | (y /= S) & (y = sel(S))}$
-- is just ${g3(trech2_thryvar(sel(S),T),S,T)}$. The proof which follows does this.
--
Theorem finite_tailrecursive_fcn.1: Finite(S) ¥imp (trech2_thryvar(S,T) = if (S = 0) then f(T) else g3(trech2_thryvar(sl(S), T), S,T) end if). Proof:
    Suppose_not(s,t) ==> Finite(s) & (trech2_thryvar(s,t) /= if s = 0 then f(t) else g3(trech2_thryvar(sl(s), t), s,t) end if)
	Tfinite_tailrecursive_fcn.0 ==> Stat1: (FORALL s,t | Finite(s) ¥imp (trech2_thryvar(s,t) =
		if ({g3(trech2_thryvar(y,t),s,t): y ¥incin s | (y /= s) & (y = sl(s))} = 0) then f(t)
			else arb({g3(trech2_thryvar(y,t),s,t): y ¥incin s | (y /= s) & (y = sl(s))}) end if))
	(s,t)-->Stat1 ==>
			trech2_thryvar(s,t) = if {g3(trech2_thryvar(y,t),s,t): y ¥incin s | (y /= s) & (y = sl(s))} = 0 then f(t)
					else arb({g3(trech2_thryvar(y,t),s,t): y ¥incin s | (y /= s) & (y = sl(s))}) end if
	Suppose ==> s = 0
	ELEM ==> Stat2: {g3(trech2_thryvar(y,t),s,t): y ¥incin s | (y /= s) & (y = sl(s))} /= 0
	c-->Stat2 ==> false; Discharge ==> s /= 0
        Assump ==> Stat3: (FORALL x | (sl(x) ¥incin x) & ((x /= 0) ¥imp (sl(x) /= x)))
	s-->Stat3 ==> (sl(s) ¥incin s) & (sl(s) /= s)
	Suppose ==> Stat4: {g3(trech2_thryvar(y,t),s,t): y ¥incin s | (y /= s) & (y = sl(s))} = 0
	(sl(s))-->Stat4 ==> false; Discharge ==> (trech2_thryvar(s,t) /= g3(trech2_thryvar(sl(s), t), s,t)) &
			Stat5: (trech2_thryvar(s,t) in {g3(trech2_thryvar(y,t),s,t): y ¥incin s | (y /= s) & (y = sl(s))})
	y-->Stat5 ==> (y = sl(s)) & (trech2_thryvar(s,t) = g3(trech2_thryvar(y,t),s,t))
    EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY finite_tailrecursive_fcn
--
--THEORY finite_tailrecursive_fcn(f(t),g3(a,x,t),sl(x))
--	(FORALL x | (sl(x) ¥incin x) & ((x /= 0) ¥imp (sl(x) /= x)))
--==>(trech2_thryvar)
--	(FORALL s, t | Finite(s) ¥imp (trech2_thryvar(s,t) = if (s = 0) then f(t) else g3(trech2_thryvar(sl(s), t), s,t) end if))
--END finite_tailrecursive_fcn;
--
-- We will now derive a variant recursive function definition method which is simpler (but more limited)
-- than that which our prior finite_recursive_fcn THEORY affords. This applies to cases in which the value $f(s)$
-- can be defined in terms of  $f(s - {arb(s)})$ alone. For this, we simply specialize the THEORY finite_recursive_fcn.
--
THEORY finite_tailrecursive_fcn1(f(t),g3(a,x,t))
END finite_tailrecursive_fcn1;
--
ENTER_THEORY finite_tailrecursive_fcn1
--
Theorem finite_tailrecursive_fcn1.0: ((X - {arb(X)}) ¥incin X) & ((X /= 0) ¥imp ((X - {arb(X)}) /= X)). Proof:
    Suppose_not(x) ==> (not(((x - {arb(x)}) ¥incin x) & ((x /= 0) ¥imp ((x - {arb(x)}) /= x))))
    Discharge ==> QED
--
	APPLY(trech2_thryvar:trech_thryvar) finite_tailrecursive_fcn(f(t)->f(t), g3(a,x,t)->g3(a,x,t), sl(x)->(x - {arb(x)})) ==>
Theorem finite_tailrecursive_fcn1.1: (FORALL s,t | Finite(s) ¥imp (trech_thryvar(s,t) =
		if (s = 0) then f(t)
		else g3(trech_thryvar(s - {arb(s)}, t), s,t) end if))
--
ENTER_THEORY Set_theory
--
--DISPLAY finite_tailrecursive_fcn1
--
--THEORY finite_tailrecursive_fcn1(f(t),g3(a,x,t));
--==>(trech_thryvar)
--    (FORALL s, t | Finite(s) ¥imp (trech_thryvar(s,t) = if (s = 0) then f(t) else g3(trech_thryvar(s - {arb(s)}, t), s,t) end if))
--END finite_tailrecursive_fcn1;
--
-- Our next variant recursive function definition scheme is even simpler, but applies only when the
-- function being defined is monadic, rather than dyadic as above. To derive it we simply specialize the preceding theory.
--
THEORY finite_tailrecursive_fcn2(f0,g2(a,x))
END finite_tailrecursive_fcn2;
--
ENTER_THEORY finite_tailrecursive_fcn2
--
	APPLY(trech_thryvar:h) finite_tailrecursive_fcn1(f(t)->f0,g3(a,x,t)->g2(a,x)) ==>
Theorem finite_tailrecursive_fcn2.0: (FORALL s,t | Finite(s) ¥imp (h(s,t) = if s = 0 then f0 else g2(h(s - {arb(s)},t),s) end if))
--
Def 00f: [?] h1_thryvar(S) := h(S,0)
--
Theorem finite_tailrecursive_fcn2.1: Finite(S) ¥imp (h1_thryvar(S) = if S = 0 then f0 else g2(h1_thryvar(S - {arb(S)}),S) end if). Proof:
    Suppose_not(s) ==> Finite(s) & (h1_thryvar(s) /= if s = 0 then f0 else g2(h1_thryvar(s - {arb(s)}),s) end if)
    Tfinite_tailrecursive_fcn2.0 ==> Stat1: (FORALL s,t | Finite(s) ¥imp (h(s,t) = if s = 0 then f0 else g2(h(s - {arb(s)},t),s) end if))
	(s,0)-->Stat1 ==> h(s,0) = if s = 0 then f0 else g2(h(s - {arb(s)},0),s) end if
Use_def(h1_thryvar) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY finite_tailrecursive_fcn2
--
--THEORY finite_tailrecursive_fcn2(f0,g2(a,x))
--==>(h1_thryvar)
--    (FORALL s | Finite(s) ¥imp (h1_thryvar(s) = if s = 0 then f0 else g2(h1_thryvar(s - {arb(s)}),s) end if))
--END finite_tailrecursive_fcn2;
--
-- Our next aim is to introduce the very important and often used 'theory of sigma', which
-- shows that for any commutative operation $¥PLUZ$ defined on a set $s$ and having
-- the algebraic properties of addition, there exists a summation operator $sigma$,
-- defined for all finite, single-valued mappings $g$ having values in $s$, which represents the repeated sum
-- customarily written using an informal 'three dots' notation as $g(x1) ¥PLUZ g(x2) ¥PLUZ ... ¥PLUZ g(xn)$.
-- This summation operator sends the empty mapping into the additive zero element of the underlying domain $s$
-- and maps any singleton ${[x,y]}$ with $y in s$  into $y$. The sigma operator is additive over
-- pairs of mappings having disjoint domains, and, more generally, if $g$ is
-- decomposed in any way into a collection of disjoint parts $gj$, then
-- $sigma(g)$ is the sum of all the values $sigma(gj)$, where $gj$ runs over all the
-- parts into which $g$ has been decomposed.

--
-- This theory will be used to define sums of finite sequences of elements of many kinds, e.g.
-- integers, signed integers, rational, real and complex numbers, functions whose values are
-- integers, signed integers, rational, real or complex numbers, etc. It can also be used to
-- define extended product operators $PI(g)$ of the kind which would ordinarily be written less formally as
-- $g(x1) ¥TIMES g(x2) ¥TIMES ... ¥TIMES g(xn)$ etc.
--
THEORY sigma_theory(s,pluz(x,y),e)
    e in s
    (FORALL x | (x in s) ¥imp (pluz(x,e) = x))
    (FORALL x,y | ((x in s) & (y in s)) ¥imp (pluz(x,y) = pluz(y,x)))
    (FORALL x,y | ((x in s) & (y in s)) ¥imp (pluz(x,y) in s))
    (FORALL x,y,z | ((x in s) & (y in s) & (z in s)) ¥imp (pluz(pluz(x,y),z) = pluz(x,pluz(y,z))))
END sigma_theory;
--
ENTER_THEORY sigma_theory
--
-- Our first step is to define the $sigma$ operation by applying our recursive definition
-- schema to the conditional expression appearing in the following formula.
--
APPLY(h1_thryvar:sigma_thryvar) finite_tailrecursive_fcn2(f0->e,g2(y,x)->pluz(y,cdr(arb(x)))) ==>
    Theorem sigma_theory0: [Recursive formula for generalized sum] (FORALL x | Finite(x) ¥imp (sigma_thryvar(x) = if x = 0 then e else pluz(sigma_thryvar(x - {arb(x)}),cdr(arb(x))) end if))
--
-- Next we begin the sequence of proofs belonging to the present theory by showing that,
-- when applied to the null set, the sigma-operation associated with the generic addition
-- operator $¥PLUZ$ yields the additive zero element of the underlying domain $s$.
--
Theorem sigma_theory1: [Summation of null map is zero] sigma_thryvar(0) = e. Proof:
    Suppose_not ==> sigma_thryvar(0) /= e
    T188 ==> Finite(0)
    Tsigma_theory0 ==> Stat1: (FORALL x | Finite(x) ¥imp (sigma_thryvar(x) = if x = 0 then e else pluz(sigma_thryvar(x - {arb(x)}),cdr(arb(x))) end if))
    0-->Stat1 ==> false; Discharge ==> QED
--
-- Next we show that when applied to any singleton set ${[v,y]}$ with $y$ in the domain $s$
-- underlying $¥PLUZ$ the sigma-operation simply yields $y$:
--
Theorem sigma_theory2: [Summation of singleton map is range element] (cdr(X) in s) ¥imp (sigma_thryvar({X}) = cdr(X)). Proof:
    Suppose_not(x) ==> (cdr(x) in s) & (sigma_thryvar({x}) /= cdr(x))
--
-- This follows immediately by defintion of the function $sigma_thryvar$ and from the fact that the
-- costant $e$ appearing in the preceding heorm is the additive zero element of the underlying domain $s$.
--
    x-->T201 ==> Finite({x})
    Tsigma_theory0 ==> Stat1: (FORALL x | Finite(x) ¥imp (sigma_thryvar(x) = if x = 0 then e else pluz(sigma_thryvar(x - {arb(x)}),cdr(arb(x))) end if))
    ({x})-->Stat1 ==> sigma_thryvar({x}) = pluz(sigma_thryvar({x} - {arb({x})}),cdr(arb({x})))
    TELEM ==> ({x} - {arb({x})} = 0) & (arb({x}) = x)
    Tsigma_theory1 ==> sigma_thryvar(0) = e
    EQUAL ==> sigma_thryvar({x}) = pluz(e,cdr(x))
    Assump ==> (e in s) & Stat2: (FORALL x | (x in s) ¥imp (pluz(x,e) = x)) & Stat3: (FORALL x, y | ((x in s) & (y in s)) ¥imp (pluz(x,y) = pluz(y,x)))
    (e,cdr(x))-->Stat3 ==> sigma_thryvar({x}) = pluz(cdr(x),e)
    (cdr(x))-->Stat2 ==> false; Discharge ==> QED
--
-- Our next lemm tells us that when applied to a finite map $F$ whose range
-- is included in the domain $s$ underlying $¥PLUZ$,
-- the sigma-operation yields an element of $s$:
--
Theorem sigma_theory3: [Sum value belongs to closed range of map] (Finite(F) & (range(F) ¥incin s)) ¥imp (sigma_thryvar(F) in s). Proof:
    Suppose_not(f1) ==> Finite(f1) & (range(f1) ¥incin s) & (sigma_thryvar(f1) notin s)
--
-- For, assuming the contrary, there would be a map $f$ contradicting the statement which we want to prove
-- which was also inclusion-minimal. By an earlier theorem, such an $f$ would be non-null.
--
    APPLY(m1_thryvar:f) finite_induction(n->f1,P(x)->(range(x) ¥incin s) & (sigma_thryvar(x) notin s)) ==>
	 (f ¥incin f1) & (range(f) ¥incin s) & (sigma_thryvar(f) notin s) &
	Stat1: (FORALL g ¥incin f | ((g /= f) ¥imp (not((range(g) ¥incin s) & (sigma_thryvar(g) notin s)))))
    (f1,f)-->T189 ==> Finite(f)
    Suppose ==> f = 0
    Tsigma_theory1 ==> sigma_thryvar(0) = e
    Assump ==> e in s
    EQUAL ==> false; Discharge ==> (f incs f - {arb(f)}) & (f - {arb(f)} /= f) & (arb(f) in f)
--
-- But then removal of $arb(f)$ from $f$ would produce a map strictly included in $f$ whose
-- sigma-image would not belong to $s$, a contradiction which proves the desired statement.
--
    (f - {arb(f)})-->Stat1 ==> not((range(f - {arb(f)}) ¥incin s) & (sigma_thryvar(f - {arb(f)}) notin s))
    Use_def(range) ==> (range(f - {arb(f)}) = {cdr(x): x in f - {arb(f)}}) & (range(f) = {cdr(x): x in f})
    Set_monot ==> {cdr(x): x in f - {arb(f)}} ¥incin {cdr(x): x in f}
    ELEM ==> sigma_thryvar(f - {arb(f)}) in s
    Tsigma_theory0 ==> Stat2: (FORALL x | Finite(x) ¥imp (sigma_thryvar(x) = if x = 0 then e else pluz(sigma_thryvar(x - {arb(x)}),cdr(arb(x))) end if))
    f-->Stat2 ==> sigma_thryvar(f) = pluz(sigma_thryvar(f - {arb(f)}),cdr(arb(f)))
    Suppose ==> Stat3: cdr(arb(f)) notin {cdr(x): x in f}
    (arb(f))-->Stat3 ==> false; Discharge ==> cdr(arb(f)) in s
    Assump ==> Stat4: (FORALL x,y | ((x in s) & (y in s)) ¥imp (pluz(x,y) in s))
    (sigma_thryvar(f - {arb(f)}),cdr(arb(f)))-->Stat4 ==> false; Discharge ==> QED
--
-- The following theorem shows that in the recursive definition of $sigma_thryvar(f)$
-- (where $f$ is a finite non-null map whose range is included in the domain underlying $¥PLUZ$),
-- any element $c$ of $f$ can take the place of $arb(f)$.
--
Theorem sigma_theory4: [Removal of single element from domain of a sum] ((C in F) &
	Finite(F) & (range(F) ¥incin s)) ¥imp (sigma_thryvar(F) = pluz(sigma_thryvar(F - {C}),cdr(C))). Proof:
Suppose_not(c1,f1) ==> AUTO
--
-- For, assuming the contrary, there would exist an inclusion-minimal map $f$
-- contradicting our assertion, so that $f$ would have an element $c$ such that
-- $sigma_thryvar(f) /= sigma_thryvar(f - {c}) ¥PLUZ cdr(c)$, whereas
-- $sigma_thryvar(f) = sigma_thryvar(f - {arb(f)}) ¥PLUZ cdr(arb(f))$ by definition.
--
	Suppose ==> Stat1: not(EXISTS c in f1 | sigma_thryvar(f1) /= pluz(sigma_thryvar(f1 - {c}),cdr(c)))
	c1-->Stat1 ==> false; Discharge ==>
		Finite(f1) & (range(f1) ¥incin s) & (EXISTS c in f1 | sigma_thryvar(f1) /= pluz(sigma_thryvar(f1 - {c}),cdr(c)))
	APPLY(m1_thryvar:f) finite_induction (n->f1,P(x)->(range(x) ¥incin s) & (EXISTS c in x | sigma_thryvar(x) /= pluz(sigma_thryvar(x - {c}),cdr(c)))) ==>
		Stat2: (f ¥incin f1) & (range(f) ¥incin s) &
		Stat3: (EXISTS c in f | sigma_thryvar(f) /= pluz(sigma_thryvar(f - {c}),cdr(c))) &
		Stat4: (FORALL g ¥incin f | ((g /= f) ¥imp (not((range(g) ¥incin s)) &
		(EXISTS d in g | sigma_thryvar(g) /= pluz(sigma_thryvar(g - {d}),cdr(d))))))
	(f1,f)-->T189 ==> Finite(f)
	c-->Stat3 ==> Stat5: (c in f) & (sigma_thryvar(f) /= pluz(sigma_thryvar(f - {c}),cdr(c)))
	Tsigma_theory0 ==> Stat6: (FORALL x | Finite(x) ¥imp (sigma_thryvar(x) = if x = 0 then e else pluz(sigma_thryvar(x - {arb(x)}),cdr(arb(x))) end if))
	f-->Stat6 ==> sigma_thryvar(f) = pluz(sigma_thryvar(f - {arb(f)}),cdr(arb(f)))
--
-- Given the counterexample that we have assumed, it is clear that $f$ includes ${c}$ strictly.
-- Moreover, the assumed minimality of $f$ implies that any element of $f - {arb(f)}$,
-- in particular $c$, can be used to calculate $sigma_thryvar(f - {c})$.
--
	Suppose ==> arb(f) = c
	EQUAL ==> false; Discharge ==> Stat7: (arb(f) /= c)
	(Stat5,Stat7)ELEM ==> Stat8: ((f - {c}) /= 0) & ((f - {arb(f)}) ¥incin f) & ((f - {arb(f)}) /= f) & (c in (f - {arb(f)}))
	(f - {arb(f)},f)-->T65(Stat2,Stat2*) ==> range(f - {arb(f)}) ¥incin s
	(f - {arb(f)})-->Stat4(Stat8*) ==> Stat9: not(EXISTS c in f - {arb(f)} |
		sigma_thryvar(f - {arb(f)}) /= pluz(sigma_thryvar(f - {arb(f)} - {c}),cdr(c)))
	c-->Stat9(Stat8,Stat8*) ==> sigma_thryvar(f - {arb(f)}) = pluz(sigma_thryvar(f - {arb(f)} - {c}),cdr(c))
--
-- Using the minimality of $f$ once more we can derive the following expression for $sigma_thryvar(f - {c})$.
--
	(Stat5,Stat7)ELEM ==> Stat10: ((f - {c}) ¥incin f) & (f - {c} /= f) & (arb(f) in f - {c})
	(f - {c},f)-->T65(Stat2,Stat2*) ==> (range(f - {c}) ¥incin range(f)) & (range(f - {c}) ¥incin s)
	(f - {c})-->Stat4(Stat10*) ==>
			Stat11: not(EXISTS d in f - {c} | sigma_thryvar(f - {c}) /= pluz(sigma_thryvar(f - {c} - {d}),cdr(d)))
	(arb(f))-->Stat11(Stat10,Stat10*) ==> sigma_thryvar(f - {c}) = pluz(sigma_thryvar(f - {arb(f)} - {c}),cdr(arb(f)))
--
-- Using the commutativity and associativity of $¥PLUZ$ we can now derive an easy contradiction
-- which completes our proof.
--
	(c,f)-->T61(Stat5,Stat2*) ==> Stat12: cdr(c) in s
	(arb(f),f)-->T61(Stat10,Stat2*) ==> cdr(arb(f)) in s
	(f,f - {arb(f)} - {c})-->T189(Stat2*) ==> Finite(f - {arb(f)} - {c})
	(f - {arb(f)} - {c},f)-->T65(Stat2*) ==> range(f - {arb(f)} - {c}) ¥incin s
	(f - {arb(f)} - {c})-->Tsigma_theory3(Stat12*) ==> sigma_thryvar(f - {arb(f)} - {c}) in s
	Assump ==> Stat13: (FORALL x,y,z | ((x in s) & (y in s) & (z in s)) ¥imp (pluz(pluz(x,y),z) = pluz(x,pluz(y,z))))
	(sigma_thryvar(f - {arb(f)} - {c}), cdr(arb(f)), cdr(c))-->Stat13(Stat11*) ==>
		pluz(pluz( sigma_thryvar(f - {arb(f)} - {c}), cdr(arb(f)) ), cdr(c)) =
			pluz(sigma_thryvar(f - {arb(f)} - {c}), pluz( cdr(arb(f)), cdr(c) ))
	Assump ==> Stat14: (FORALL x,y | ((x in s) & (y in s)) ¥imp  (pluz(x,y) = pluz(y,x)))
	(cdr(arb(f)), cdr(c))-->Stat14(Stat12*) ==> pluz(cdr(arb(f)),cdr(c)) = pluz(cdr(c),cdr(arb(f)))
	(sigma_thryvar(f - {arb(f)} - {c}), cdr(c), cdr(arb(f)))-->Stat13(Stat11*) ==>
					pluz(sigma_thryvar(f - {arb(f)} - {c}), pluz(cdr(c), cdr(arb(f))) ) =
						pluz(pluz(sigma_thryvar(f - {arb(f)} - {c}), cdr(c) ), cdr(arb(f)))
EQUAL(Stat5) ==> false; Discharge ==> QED
--
-- Next we show that if map $f$ like that considered in the previous theorems is divided into two disjoint parts
-- $f1$ and $f2$, we have $sigma_thryvar(f) = sigma_thryvar(f1) ¥PLUZ sigma_thryvar(f2)$.
--
Theorem sigma_theory5: [The generalized sum of a union map is a sum of sums] (Finite(F) & Is_map(F) & (range(F) ¥incin s)) ¥imp
	(sigma_thryvar(F) = pluz(sigma_thryvar(F ¥ON (domain(F) * T)), sigma_thryvar(F ¥ON (domain(F) - T)))). Proof:
Suppose_not(f1,t1) ==> AUTO
--
-- Assuming that there exists a counterexample to our thorem, we can choose an
-- inclusion-minimal map $f$ that contradicts it, along with a set $t$ for which
-- $sigma_thryvar(f) /= sigma_thryvar(f ¥ON (domain(f) * t)) ¥PLUZ sigma_thryvar(f ¥ON (domain(f) - t))$.
--
	Suppose ==> Stat1: (FORALL t | sigma_thryvar(f1) = pluz(sigma_thryvar(f1 ¥ON (domain(f1) * t)), sigma_thryvar(f1 ¥ON (domain(f1) - t))))
	t1-->Stat1 ==> false; Discharge ==> (not(FORALL t | sigma_thryvar(f1) =
			pluz(sigma_thryvar(f1 ¥ON (domain(f1) * t)), sigma_thryvar(f1 ¥ON (domain(f1) - t)))))
	APPLY(m1_thryvar:f) finite_induction (n->f1,P(x)->(range(x) ¥incin s) & Is_map(x) & (not(FORALL t | sigma_thryvar(x) = pluz(sigma_thryvar(x ¥ON (domain(x) * t)), sigma_thryvar(x ¥ON (domain(x) - t)))))) ==>
		Stat2: (f ¥incin f1) & (range(f) ¥incin s) & Is_map(f) &
		Stat3: (not(FORALL t | sigma_thryvar(f) =
			pluz(sigma_thryvar(f ¥ON (domain(f) * t)), sigma_thryvar(f ¥ON (domain(f) - t))))) &
		Stat4: (FORALL g ¥incin f | ((g /= f) ¥imp (not((range(g) ¥incin s)) & Is_map(g) &
			(not(FORALL t | sigma_thryvar(g) = pluz(sigma_thryvar(g ¥ON (domain(g) * t)), sigma_thryvar(g ¥ON (domain(g) - t))))))))
	(f1,f)-->T189(*) ==> Stat5: Finite(f)
	t-->Stat3(Stat2*) ==> sigma_thryvar(f) /= pluz(sigma_thryvar(f ¥ON (domain(f) * t)), sigma_thryvar(f ¥ON (domain(f) - t)))
--
-- Next we can decompose $f$ as the disjoint union of $f ¥ON (domain(f) * t)$ with $f ¥ON (domain(f) - t)$.
--
    TELEM ==> domain(f) = (domain(f) * t) + (domain(f) - t)
    EQUAL ==> f ¥ON domain(f) = f ¥ON ((domain(f) * t) + (domain(f) - t))
    (f,domain(f) * t,domain(f) - t)-->T63 ==>
    			f ¥ON domain(f) = (f ¥ON (domain(f) * t)) + (f ¥ON (domain(f) - t))
    (f,t)-->T68(*) ==> f ¥ON (domain(f) * t) = f ¥ON t
    f-->T67 ==> f = (f ¥ON t) + (f ¥ON (domain(f) - t))
--
-- It follows from the following assumptions and instances of theorems of the present theory...
--
    Assump ==> Stat6: e in s
    Assump ==> Stat7: (FORALL x | (x in s) ¥imp (pluz(x,e) = x))
    Assump ==> Stat8: (FORALL x,y | ((x in s) & (y in s)) ¥imp (pluz(x, y) = pluz(y, x)))
    Tsigma_theory1 ==> sigma_thryvar(0) = e
    (f,(domain(f) - t))-->T52(*) ==> (f ¥ON (domain(f) - t)) ¥incin f
    (f,f ¥ON (domain(f) - t))-->T189(Stat5*) ==> Finite(f ¥ON (domain(f) - t))
    (f,(domain(f) - t))-->T80(Stat2,Stat2*) ==> range(f ¥ON (domain(f) - t)) ¥incin s
    (f ¥ON (domain(f) - t))-->Tsigma_theory3 ==> Stat9: sigma_thryvar(f ¥ON (domain(f) - t)) in s
--
-- ... that $t$ must intersect the domain of $f$; more specifically, $f ¥ON t$ cannot be null.
--
    Suppose ==> f ¥ON t = 0
    (Stat2)ELEM ==> f = f ¥ON (domain(f) - t)
    EQUAL(Stat2) ==> sigma_thryvar(f) = sigma_thryvar(f ¥ON (domain(f) - t))
    (sigma_thryvar(f ¥ON (domain(f) - t)))-->Stat7 ==> sigma_thryvar(f) = pluz(sigma_thryvar(f ¥ON (domain(f) - t)), e)
    EQUAL(Stat2) ==> sigma_thryvar(f) /= pluz(e, sigma_thryvar(f ¥ON (domain(f) - t)))
    (e,sigma_thryvar(f ¥ON (domain(f) - t)))-->Stat8 ==> false; Discharge ==> Stat10: f ¥ON t /= 0
--
-- Hence we can pick an element $c$ from the restricted map $f ¥ON (domain(f) * t)$,
-- which must satisfy $domain(f - {c}) - t = domain(f) - t$.
--
    c-->Stat10(Stat2) ==> Stat11: c in (f ¥ON (domain(f) * t))
    Use_def(¥ON) ==> Stat12: c in {x in f | car(x) in (domain(f) * t)}
    ()-->Stat12(Stat12) ==> Stat13: car(c) in (domain(f) * t)
    (f-{c},t)-->T68(*) ==>  ((f-{c}) ¥ON (domain(f-{c}) * t)) = ((f-{c}) ¥ON t)
    Suppose ==> Stat14: domain(f - {c}) - t /= domain(f) - t
	(f - {c},f)-->T65(Stat14*) ==> Stat15: not(domain(f - {c}) - t incs domain(f) - t)
	b-->Stat15(Stat15*) ==> (b in domain(f) - t) & (b notin domain(f - {c}))
	Use_def(domain) ==> (b in {car(x): x in f} - t) & (b notin domain(f - {c}))
	(Stat2)ELEM ==> Stat16: b in {car(x): x in f}
	b1-->Stat16(Stat16) ==> (b = car(b1)) & (b1 in f)
	Use_def(domain) ==> Stat17: (b notin {car(x): x in f - {c}})
	b1-->Stat17(Stat15) ==> b1 notin f - {c}
    (Stat2)Discharge ==> Stat18: domain(f - {c}) - t = domain(f) - t
--
-- It easily follows that $(f ¥ON (domain(f) - t)) = ((f-{c}) ¥ON (domain(f) - t))$; for, ...
--
--
    (f-{c},{c},(domain(f) - t))-->T64 ==> ((f-{c}+{c}) ¥ON (domain(f) - t)) =
    	((f - {c}) ¥ON (domain(f) - t)) + ({c} ¥ON (domain(f) - t))
    (Stat2)ELEM ==> f = f - {c} + {c}
    EQUAL(Stat18) ==> f ¥ON (domain(f) - t) = ((f - {c}) ¥ON (domain(f - {c}) - t)) + ({c} ¥ON (domain(f) - t))
--
-- ...assuming that ${c} ¥ON (domain(f) - t) /= 0$ would contradict the
-- fact, already established,  that $car(c) in t$.
--
    Suppose ==> Stat19: {c} ¥ON (domain(f) - t) /= 0
	a-->Stat19 ==> a in ({c} ¥ON (domain(f) - t))
	Use_def(¥ON) ==> Stat20: a in {p in {c} | car(p) in domain(f)-t}
	()-->Stat20 ==> (a in {c}) & (car(a) in domain(f)-t)
    (Stat12)Discharge ==> Stat21: f ¥ON (domain(f) - t) = (f - {c}) ¥ON (domain(f - {c}) - t)
--
-- It is also easy to sharpen the preceding observation into the equality
--	$(f ¥ON (domain(f) - t)) = ((f - {c}) ¥ON (domain(f) - t))$.
--
    Suppose ==> Stat22: (f ¥ON (domain(f) - t)) /= ((f - {c}) ¥ON (domain(f) - t))
    Use_def(¥ON)(Stat22*) ==> (f ¥ON (domain(f) - t) = {x in f | car(x) in domain(f) - t}) &
	((f - {c}) ¥ON (domain(f) - t) = {x in (f - {c}) | car(x) in domain(f) - t})
    TELEM ==> f = (f - {c}) + (f - (f - {c}))
    (f - {c},f - (f - {c}),domain(f) - t)-->T64(Stat23*) ==>
    	Stat23: ((f - {c}) + (f - (f - {c})) ¥ON (domain(f) - t)) incs ((f - {c}) ¥ON (domain(f) - t))
    EQUAL(Stat22) ==> (f ¥ON (domain(f) - t)) incs ((f - {c}) ¥ON (domain(f) - t))
    (Stat22)ELEM ==> not ((f ¥ON (domain(f) - t)) ¥incin ((f - {c}) ¥ON (domain(f) - t)))
    d-->Stat22(Stat22) ==> Stat24: (d in {x in f | car(x) in domain(f) - t}) &
		Stat25: (d notin {x in f - {c} | car(x) in domain(f) - t})
    d-->Stat24(Stat24*) ==> (d in f) & (car(d) in domain(f) - t) & (d notin (f - {c}))
    (Stat2*)Discharge ==> Stat26: (f ¥ON (domain(f) - t)) = ((f - {c}) ¥ON (domain(f) - t))
--
-- The assumed minimality of $f$ now leads to the equality
--	$sigma_thryvar(f - {c}) = sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) * t)) ¥PLUZ sigma_thryvar(f ¥ON (domain(f) - t))$,
--
    Suppose ==> sigma_thryvar(f - {c}) /=
    	pluz(sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) * t)), sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) - t)))
	(Stat18)ELEM ==> (f - {c} ¥incin f) & (f - {c} /= f)
	(f - {c},f)-->T52(Stat2,Stat2*) ==> Is_map(f - {c})
	(f - {c},f)-->T65(Stat2,Stat2*) ==> range(f - {c}) ¥incin s
	(f, f-{c})-->T189(Stat5*) ==> Finite(f-{c})
	(f - {c})-->Stat4(Stat26*) ==> Stat27: (FORALL t | sigma_thryvar(f - {c}) =
		pluz(sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) * t)), sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) - t))))
    t-->Stat27(Stat26) ==> false; Discharge ==> Stat28: sigma_thryvar(f - {c}) =
    	pluz(sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) * t)), sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) - t)))
--
--  whence, thanks to the assumptions and earlier theorems of the present theory, ...
--
    (c,f)-->Tsigma_theory4 ==> sigma_thryvar(f) = pluz(sigma_thryvar(f - {c}), cdr(c))
    EQUAL(Stat18) ==> sigma_thryvar(f) = pluz(pluz(sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) * t)), sigma_thryvar(f ¥ON (domain(f) - t))), cdr(c))
    Assump ==> Stat29: (FORALL x,y | ((x in s) & (y in s)) ¥imp (pluz(x,y) in s))
    Assump ==> Stat30: (FORALL x, y, z | ((x in s) & (y in s) & (z in s)) ¥imp (pluz(pluz(x,y),z) = pluz(x,pluz(y,z))))
--
    (f,(domain(f) - t))-->T48(Stat28) ==> (f ¥ON (domain(f) - t)) ¥incin  f
    (f,(f ¥ON (domain(f) - t)))-->T189 ==> Finite(f ¥ON (domain(f) - t))
    ((f ¥ON (domain(f) - t)),f)-->T65 ==> range(f ¥ON (domain(f) - t)) ¥incin s
--
    ((f - {c}), (domain(f - {c}) * t) )-->T48 ==> ((f - {c}) ¥ON (domain(f - {c}) * t)) ¥incin  f
    (f,((f - {c}) ¥ON (domain(f - {c}) * t)))-->T189 ==> Finite((f - {c}) ¥ON (domain(f - {c}) * t))
    (((f - {c}) ¥ON (domain(f - {c}) * t)),f)-->T65 ==> range((f - {c}) ¥ON (domain(f - {c}) * t)) ¥incin s
    ((f - {c}) ¥ON (domain(f - {c}) * t))-->Tsigma_theory3 ==> sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) * t)) in s
--
-- ... we find that
--	$sigma_thryvar(f) = (sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) * t)) ¥PLUZ cdr(c)) ¥PLUZ sigma_thryvar(f ¥ON (domain(f) - t))$
--
    Suppose ==> Stat31: cdr(c) notin s
	(Stat2,Stat31*)ELEM ==> cdr(c) notin range(f)
	Use_def(range)(Stat31*) ==> Stat32: cdr(c) notin {cdr(x): x in f}
	c-->Stat32(Stat32) ==> c notin f
    (f,dom(f)*t)-->T48(*) ==> false; Discharge ==> Stat33: cdr(c) in s
    (sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) * t)),sigma_thryvar(f ¥ON (domain(f) - t)),cdr(c))-->Stat30(*) ==>
		sigma_thryvar(f) =
			pluz(sigma_thryvar((f - {c}) ¥ON (domain(f - {c})) * t), pluz(sigma_thryvar(f ¥ON (domain(f) - t)), cdr(c)))
    (sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) * t)),cdr(c),sigma_thryvar(f ¥ON (domain(f) - t)))-->Stat30(*) ==>
	 	pluz(sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) * t)), pluz(cdr(c), sigma_thryvar(f ¥ON (domain(f) - t)))) =
	 		pluz(pluz(sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) * t)), cdr(c)), sigma_thryvar(f ¥ON (domain(f) - t)))
    (sigma_thryvar(f ¥ON (domain(f) - t)), cdr(c))-->Stat8(Stat33,Stat9*) ==> pluz(sigma_thryvar(f ¥ON (domain(f) - t)), cdr(c)) =
    	pluz(cdr(c), sigma_thryvar(f ¥ON (domain(f) - t)))
    EQUAL(Stat2) ==> sigma_thryvar(f) =
    	pluz(pluz(sigma_thryvar((f - {c}) ¥ON (domain(f - {c}) * t)), cdr(c)), sigma_thryvar(f ¥ON (domain(f) - t)))
--
-- Addition of the first two terms on the right-hand side of this equality is easily seen to
-- yield $sigma_thryvar(f ¥ON (domain(f) * t))$; thus, by using Theorem $sigma_theory4$ we get
-- a contradiction which proves the present theorem.
--
    ({c},f-{c},t)-->T64(Stat34*) ==> Stat34: (f-{c}+{c}) ¥ON t = ((f-{c}) ¥ON t) + ({c} ¥ON t)
    EQUAL(Stat2) ==> (f ¥ON t) = ((f-{c}) ¥ON t) + ({c} ¥ON t)
    Suppose ==> Stat35: ({c} ¥ON t) /= {c}
	({c},t)-->T48(Stat35*) ==> Stat36: c notin {c} ¥ON t
	Use_def(¥ON)(Stat36*) ==> Stat37: c notin {x in {c} | car(x) in t}
    c-->Stat37(Stat13,Stat13*) ==> false; Discharge ==> f ¥ON (domain(f) * t) = ((f-{c}) ¥ON (domain(f-{c}) * t)) + {c}
    (f-{c},domain(f-{c}) * t)-->T48(*) ==> f ¥ON (domain(f) * t) - {c} = ((f-{c}) ¥ON (domain(f-{c}) * t))
    EQUAL(Stat30) ==> sigma_thryvar(f ¥ON (domain(f) * t) - {c}) = sigma_thryvar((f-{c}) ¥ON (domain(f-{c}) * t))
--
    (f,(domain(f) * t))-->T48(*) ==> Stat38: (f ¥ON (domain(f) * t)) ¥incin f
    (f,f ¥ON (domain(f) * t))-->T189(Stat38,Stat5*) ==> Stat39: Finite(f ¥ON (domain(f) * t))
    (f ¥ON (domain(f) * t),f)-->T65(Stat38,Stat2*) ==> Stat40: range(f ¥ON (domain(f) * t)) ¥incin s
    (c,f ¥ON (domain(f) * t))-->Tsigma_theory4(Stat11,Stat39,Stat40*) ==>
    	sigma_thryvar(f ¥ON (domain(f) * t)) = pluz(sigma_thryvar(f ¥ON (domain(f) * t) - {c}), cdr(c))
EQUAL(Stat2*) ==> false; Discharge ==> QED
--
-- Our next theorem shows that if a map $f$ with values in s  is
-- decomposed in any way into a collection of disjoint parts $fj$, then
-- $sigma(f)$ is the sum of all the values $sigma(fj)$, where $fj$ runs over all the
-- parts into which $f$ has been decomposed. To state this result formally, we make use of
-- an auxiliary single-valued mapping $g$ having the same domain as f, and decompose
-- the domain of f into the collection of sets $g ¥INV_IM {y}$, where $y$ varies
-- over the range of $g$.
--
Theorem sigma_theory6: [Rearrangement-of-sums theorem]
    (Finite(F) & Svm(F) & Svm(G) & (domain(F) = domain(G)) & (range(F) ¥incin s)) ¥imp
	(sigma_thryvar(F) = sigma_thryvar({[y,sigma_thryvar(F ¥ON (G ¥INV_IM {y}))]: y in range(G)})). Proof:
--
-- Assuming by contradiction the statement to be false, we could take
-- a counterexample $f,g$ with $f$ incusion-minimal.
--
    Suppose_not(f1,g1) ==> Stat1: Finite(f1) & Svm(f1) & Svm(g1) & (domain(f1) = domain(g1)) & (range(f1) ¥incin s) &
	  (sigma_thryvar(f1) /= sigma_thryvar({[y,sigma_thryvar(f1 ¥ON (g1 ¥INV_IM {y}))]: y in range(g1)}))
    Suppose ==> Stat2: not((EXISTS g | Svm(g) & (domain(f1) = domain(g)) & (sigma_thryvar(f1) /= sigma_thryvar({[y,sigma_thryvar(f1 ¥ON (g ¥INV_IM {y}))]: y in range(g)}))))
    g1-->Stat2 ==> false; Discharge ==> (EXISTS g | Svm(g) & (domain(f1) = domain(g)) & (sigma_thryvar(f1) /= sigma_thryvar({[y,sigma_thryvar(f1 ¥ON (g ¥INV_IM {y}))]: y in range(g)})))
    APPLY(m1_thryvar:f) finite_induction(n->f1,P(x)->(Svm(x) & (range(x) ¥incin s) & (EXISTS g | Svm(g) & (domain(x) = domain(g)) & (sigma_thryvar(x) /= sigma_thryvar({[y,sigma_thryvar(x ¥ON (g ¥INV_IM {y}))]: y in range(g)}))))) ==>
	Stat3:(f ¥incin f1) & Svm(f) & (range(f) ¥incin s) &
	Stat4: (EXISTS g | Svm(g) & (domain(f) = domain(g)) & (sigma_thryvar(f) /= sigma_thryvar({[y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))]: y in range(g)}))) &
	Stat5: (FORALL h ¥incin f | (h /= f) ¥imp (not(Svm(h) & (range(h) ¥incin s) & (EXISTS k | Svm(k) & (domain(h) = domain(k)) & (sigma_thryvar(h) /= sigma_thryvar({[v,sigma_thryvar(h ¥ON (k ¥INV_IM {v}))]: v in range(k)}))))))
--
    (f1,f)-->T189 ==> Finite(f)
    g-->Stat4 ==> Stat6: Svm(g) & (domain(f) = domain(g)) & (sigma_thryvar(f) /= sigma_thryvar({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}))
--
-- Note that $range(g)$ cannot be null, else $domain(f)=domain(g)$ would be null too,
-- which would quickly lead us to a contradiction.
--
    Suppose ==> range(g) = 0
	g-->T86 ==> Stat7: domain(f) = 0
	APPLY() setformer0(e(x)->car(x),s->f,P(x)->false) ==> (f /= 0) ¥imp ({car(x): x in f} /= 0)
	Use_def(domain) ==> Stat8: (f /= 0) ¥imp (domain(f) /= 0)
	(Stat7,Stat8)ELEM ==> f = 0
	Suppose ==> Stat9: {[y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))]: y in range(g)} /= 0
	d-->Stat9 ==> false; Discharge ==> {[y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))]: y in range(g)} = 0
    EQUAL ==> false; Discharge ==> Stat10: range(g) /= 0
--
-- Hence we can pick a $y$ from $range(g)$, and decompose the domain of $f$ as disjoint union
--	$domain(f)=(g ¥INV_IM {y})+(g ¥INV_IM (range(g)-{y}))$,
-- where $g ¥INV_IM {8y}/=0$. By Theorem sigma_theory5, we will have
--	$sigma_thryvar(f) = sigma_thryvar(f ¥ON (g ¥INV_IM {y})) ¥PLUZ sigma_thryvar(g ¥INV_IM (range(g)-{y}))$.
--
    y-->Stat10 ==> y in range(g)
    (y,g)-->T179 ==> Stat11: (g ¥INV_IM {y}) /= 0
    (g,{y})-->T177 ==> domain(f) = ((g ¥INV_IM {y}) + (g ¥INV_IM (range(g) - {y})))
    ({y},range(g)-{y},g)-->T178 ==> ((g ¥INV_IM {y}) * (g ¥INV_IM (range(g) - {y}))) = 0
    Use_def(Svm) ==> Stat12: Is_map(f) & (range(f) ¥incin s) & Finite(f)
    (f,s,g ¥INV_IM {y})-->Tsigma_theory5(Stat12) ==> sigma_thryvar(f) = pluz(sigma_thryvar(f ¥ON (domain(f) * (g ¥INV_IM {y}))), sigma_thryvar(f ¥ON (domain(f) - (g ¥INV_IM {y}))))
    (Stat11)ELEM ==> (domain(f) * (g ¥INV_IM {y}) = g ¥INV_IM {y}) & (domain(f) - (g ¥INV_IM {y})) = g ¥INV_IM (range(g)-{y})
    EQUAL ==> Stat13: sigma_thryvar(f) = pluz(sigma_thryvar(f ¥ON (g ¥INV_IM {y})), sigma_thryvar(f ¥ON (g ¥INV_IM (range(g)-{y}))))
--
-- Before we can exploit the assumed minimality of $f$, we must show that the restriction
-- of $f$ to $g ¥INV_IM (range(g)-{y})$ is strictly included in $f$.
--
    Suppose ==> not((f ¥ON (g ¥INV_IM (range(g) - {y})) ¥incin f) & (f /= f ¥ON (g ¥INV_IM (range(g) - {y}))))
      x-->Stat11 ==> (x in (g ¥INV_IM {y}))
      Suppose ==> [x,f~[x]] notin f
        f-->T72 ==> Stat14: [x,f~[x]] notin {[xx,f~[xx]]: xx in domain(f)}
        (g,{x})-->T177 ==> x in domain(f)
      x-->Stat14 ==> false; Discharge ==> [x,f~[x]] in f
      (f,domain(f) - (g ¥INV_IM {y}))-->T48 ==> f ¥ON (domain(f) - (g ¥INV_IM {y})) ¥incin f
      (f,domain(f) - (g ¥INV_IM {y}))-->T57 ==> Svm(f ¥ON (domain(f) - (g ¥INV_IM {y})))
      EQUAL ==> Svm(f ¥ON (g ¥INV_IM (range(g)-{y})))
      (f ¥ON (domain(f) - (g ¥INV_IM {y})))-->T72 ==> Stat15: {[xx,(f ¥ON (domain(f) - (g ¥INV_IM {y})))~[xx]]: xx in domain(f ¥ON (domain(f) - (g ¥INV_IM {y})))} = f ¥ON (domain(f) - (g ¥INV_IM {y}))
      (f,domain(f) - (g ¥INV_IM {y}))-->T94 ==> x notin domain(f ¥ON (domain(f) - (g ¥INV_IM {y})))
      Suppose ==> [x,f~[x]] in (f ¥ON (domain(f) - (g ¥INV_IM {y})))
        EQUAL ==> Stat16: [x,f~[x]] in {[xx,(f ¥ON (domain(f) - (g ¥INV_IM {y})))~[xx]]: xx in domain(f ¥ON (domain(f) - (g ¥INV_IM {y})))}
        xp-->Stat16 ==> Stat17:  (x = xp) & (xp in domain(f ¥ON (domain(f) - (g ¥INV_IM {y}))))
      EQUAL ==> false; Discharge ==> f /= f ¥ON (domain(f) - (g ¥INV_IM {y}))
   EQUAL ==> false; Discharge ==> Stat18: (f ¥ON (g ¥INV_IM (range(g) - {y})) ¥incin f) & (f /= f ¥ON (g ¥INV_IM (range(g)-{y})))
--
-- Simplification of the expression for $sigma_thryvar(f ¥ON (g ¥INV_IM (range(g) - {y})))$
-- which results from this remark leads us to the equality
--
--	$sigma_thryvar(f ¥ON (g ¥INV_IM (range(g) - {y}))) = sigma_thryvar({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}})$.
--
   Suppose ==> Stat19: sigma_thryvar(f ¥ON (g ¥INV_IM (range(g) - {y}))) /= sigma_thryvar({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}})
        Suppose ==>  not(range(f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥incin s)
            (f,g ¥INV_IM (range(g) - {y}))-->T48() ==> f ¥ON (g ¥INV_IM (range(g) - {y})) ¥incin f
        (f ¥ON (g ¥INV_IM (range(g) - {y})),f)-->T65(Stat3) ==> false; Discharge ==> range(f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥incin s
        (f ¥ON (g ¥INV_IM (range(g) - {y})))-->Stat5(Stat18) ==>  (not(Svm(f ¥ON (g ¥INV_IM (range(g) - {y}))))) or
		(not(EXISTS k | Svm(k) & (domain(f ¥ON (g ¥INV_IM (range(g) - {y}))) = domain(k)) & (sigma_thryvar(f ¥ON (g ¥INV_IM (range(g) - {y}))) /= sigma_thryvar({[v,sigma_thryvar((f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥ON (k ¥INV_IM {v}))]: v in range(k)}))))
        (f, (g ¥INV_IM (range(g) - {y})))-->T48 ==> f ¥ON (g ¥INV_IM (range(g) - {y})) ¥incin f
        (f ¥ON (g ¥INV_IM (range(g) - {y})))-->T53 ==>
		 Stat20: not(EXISTS k | Svm(k) & (domain(f ¥ON (g ¥INV_IM (range(g) - {y}))) = domain(k)) & (sigma_thryvar(f ¥ON (g ¥INV_IM (range(g) - {y}))) /= sigma_thryvar({[v,sigma_thryvar((f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥ON (k ¥INV_IM {v}))]: v in range(k)})))
        (g, (g ¥INV_IM (range(g) - {y})))-->T48 ==> g ¥ON (g ¥INV_IM (range(g) - {y})) ¥incin g
        (g, (g ¥INV_IM (range(g) - {y})))-->T57 ==> Svm(g ¥ON (g ¥INV_IM (range(g) - {y})))
        (f,(g ¥INV_IM (range(g) - {y})))-->T94 ==> domain(f ¥ON (g ¥INV_IM (range(g) - {y}))) = domain(f) * (g ¥INV_IM (range(g) - {y}))
        (g,(g ¥INV_IM (range(g) - {y})))-->T94 ==> domain(f ¥ON (g ¥INV_IM (range(g) - {y}))) = domain(g ¥ON (g ¥INV_IM (range(g) - {y})))
        (g ¥ON (g ¥INV_IM (range(g) - {y})))-->Stat20 ==> sigma_thryvar(f ¥ON (g ¥INV_IM (range(g) - {y}))) = sigma_thryvar({[v,sigma_thryvar((f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥ON ((g ¥ON (g ¥INV_IM (range(g) - {y}))) ¥INV_IM {v}))]: v in range(g ¥ON (g ¥INV_IM (range(g) - {y})))})
        (g, (range(g) - {y}))-->T184 ==> range(g ¥ON (g ¥INV_IM (range(g) - {y}))) = range(g) - {y}
        EQUAL ==> Stat21: sigma_thryvar(f ¥ON (g ¥INV_IM (range(g) - {y}))) = sigma_thryvar({[v,sigma_thryvar((f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥ON ((g ¥ON (g ¥INV_IM (range(g) - {y}))) ¥INV_IM {v}))]: v in range(g) - {y}})
        Suppose ==> Stat22: (not(FORALL v in (range(g) - {y}) | (f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥ON ((g ¥ON (g ¥INV_IM (range(g) - {y}))) ¥INV_IM {v}) = f ¥ON (g ¥INV_IM {v})))
            Loc_def ==> ry = range(g) - {y}
            Loc_def ==> gry = g ¥INV_IM ry
            Loc_def ==> gory = g ¥ON gry
            EQUAL ==> Stat23: (not(FORALL v in ry | (f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥ON (gory ¥INV_IM {v}) = f ¥ON (g ¥INV_IM {v})))
            vp-->Stat23 ==> ({vp} ¥incin ry) & ((f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥ON (gory ¥INV_IM {vp}) /= f ¥ON (g ¥INV_IM {vp}))
            Loc_def ==> wp = {vp}
            EQUAL ==> (f ¥ON (g ¥INV_IM ry)) ¥ON (gory ¥INV_IM wp) /= f ¥ON (g ¥INV_IM wp)
            (wp, ry, g)-->T186(Stat23) ==> (g ¥INV_IM wp) = (g ¥INV_IM ry) * (g ¥INV_IM wp)
            Suppose ==> (f ¥ON (g ¥INV_IM ry)) ¥ON (g ¥INV_IM wp) /= f ¥ON (g ¥INV_IM wp)
                (f, (g ¥INV_IM ry), (g ¥INV_IM wp))-->T187 ==> (f ¥ON (g ¥INV_IM ry)) ¥ON (g ¥INV_IM wp) = f ¥ON ((g ¥INV_IM ry) * (g ¥INV_IM wp))
            EQUAL ==> false; Discharge ==>  (f ¥ON (g ¥INV_IM ry)) ¥ON (g ¥INV_IM wp) = f ¥ON (g ¥INV_IM wp)
            Suppose ==> gory ¥INV_IM wp = g ¥INV_IM wp
                EQUAL ==> (f ¥ON (g ¥INV_IM ry)) ¥ON (gory ¥INV_IM wp) = (f ¥ON (g ¥INV_IM ry)) ¥ON (g ¥INV_IM wp)
            EQUAL ==> false; Discharge ==> gory ¥INV_IM wp /= g ¥INV_IM wp
            (g, ry, wp)-->T185 ==> ((g ¥ON (g ¥INV_IM ry)) ¥INV_IM wp) = (g ¥INV_IM wp)
            EQUAL ==> gory ¥INV_IM wp = g ¥INV_IM wp
        ELEM ==> false; Discharge ==> Stat24: (FORALL v in (range(g) - {y}) | (f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥ON ((g ¥ON (g ¥INV_IM (range(g) - {y}))) ¥INV_IM {v}) = f ¥ON (g ¥INV_IM {v}))
        Suppose ==> Stat25: {[v,sigma_thryvar((f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥ON ((g ¥ON (g ¥INV_IM (range(g) - {y}))) ¥INV_IM {v}))]: v in range(g) - {y}} /= {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}}
            vq-->Stat25 ==> (vq in range(g) - {y}) &  (sigma_thryvar((f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥ON ((g ¥ON (g ¥INV_IM (range(g) - {y}))) ¥INV_IM {vq})) /= sigma_thryvar(f ¥ON (g ¥INV_IM {vq})))
            vq-->Stat24 ==> (f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥ON ((g ¥ON (g ¥INV_IM (range(g) - {y}))) ¥INV_IM {vq}) = f ¥ON (g ¥INV_IM {vq})
        EQUAL ==> false; Discharge ==> Stat26: {[v,sigma_thryvar((f ¥ON (g ¥INV_IM (range(g) - {y}))) ¥ON ((g ¥ON (g ¥INV_IM (range(g) - {y}))) ¥INV_IM {v}))]: v in range(g) - {y}} = {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}}
        EQUAL(Stat26,Stat21) ==> Stat27: sigma_thryvar(f ¥ON (g ¥INV_IM (range(g) - {y}))) = sigma_thryvar({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}})
        (Stat27,Stat19)ELEM ==>  false; Discharge ==> Stat28: sigma_thryvar(f ¥ON (g ¥INV_IM (range(g) - {y}))) = sigma_thryvar({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}})
--
-- Next we ascertain all conditions needed for instantiation of
-- the variables of Theorem sigma_theory4 to $[y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))]$
-- and to ${[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}$ respectively.
--
   Suppose ==> {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}} + {[y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))]} /= {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}
        Set_monot ==> {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}} ¥incin {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}
        Suppose ==> Stat29: [y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))] notin {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}
        y-->Stat29 ==> false; Discharge ==> Stat30: not({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}} + {[y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))]}
        	incs {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)})
        a-->Stat30 ==> Stat31: (a in {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}) &
		(a notin {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}}) &
		(a /= [y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))])
        (u,u)-->Stat31 ==> Stat32: (a = [u,sigma_thryvar(f ¥ON (g ¥INV_IM {u}))]) & (u in range(g)) & (u notin range(g) - {y}) & (a /= [y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))])
    (Stat32)ELEM ==> (u=y) & (sigma_thryvar(f ¥ON (g ¥INV_IM {u})) /= sigma_thryvar(f ¥ON (g ¥INV_IM {y})))
    EQUAL ==> false; Discharge ==> Stat33: {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}} + {[y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))]}
        = {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}
--
-- One of the conditions needed for the application of Theorem sigma_theory4 is proved
-- as follows, exploiting the known fact that a single-valued map is finite if and only
-- if its domain is finite.
--
    Suppose ==> not(Finite({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}))
        g-->T174 ==> #g = #domain(g)
        f-->T174 ==> #f = #domain(f)
        f-->T193 ==> Finite(#f)
        EQUAL ==> Finite(#domain(g))
        ELEM ==> Svm({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}) &
		domain({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}) = range(g)
        (domain(g))-->T193 ==> Finite(domain(g))
        g-->T192 ==> Finite(range(g))
        EQUAL ==> Finite(domain({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}))
        (domain({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}))-->T193 ==>
		Finite(#domain({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}))
        ({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)})-->T174 ==> #domain({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}) =
		#{[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}
        EQUAL ==> Finite(#{[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)})
    ({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)})-->T193 ==> false; Discharge ==>
		Stat34: Finite({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)})
--
--
--
--
    Suppose ==> Stat35: not(range({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}) ¥incin s)
        (Stat35)ELEM ==> Stat36: not({sigma_thryvar(f ¥ON (g ¥INV_IM {v})): v in range(g)} ¥incin s)
        b-->Stat36() ==> Stat37: (b in {sigma_thryvar(f ¥ON (g ¥INV_IM {v})): v in range(g)}) & (b notin s)
        w-->Stat37() ==> (b = sigma_thryvar(f ¥ON (g ¥INV_IM {w}))) & (w in range(g))
        (f, (g ¥INV_IM {w}))-->T48 ==> f ¥ON (g ¥INV_IM {w}) ¥incin f
        (f ¥ON (g ¥INV_IM {w}),f)-->T53 ==> Svm(f ¥ON (g ¥INV_IM {w}))
        (f, f ¥ON (g ¥INV_IM {w}))-->T189 ==> Finite(f ¥ON (g ¥INV_IM {w}))
        (f ¥ON (g ¥INV_IM {w}),f)-->T65 ==> range(f ¥ON (g ¥INV_IM {w})) ¥incin range(f)
    (f ¥ON (g ¥INV_IM {w}))-->Tsigma_theory3(Stat1*) ==> false; Discharge ==> Stat38: range({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}) ¥incin s
    ([y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))], {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)})-->Tsigma_theory4(Stat33,Stat34,Stat38) ==>
		sigma_thryvar({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}) = pluz(sigma_thryvar({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)} - {[y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))]}), sigma_thryvar(f ¥ON (g ¥INV_IM {y})))
    Suppose ==> Stat39: [y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))] in {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}}
        v-->Stat39 ==> Stat40: (v /= y) & ([y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))] = [v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))])
    (Stat40)Discharge ==> Stat41: [y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))] notin {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}}
    (Stat33,Stat41)ELEM ==> ([y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))] in {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}) &
	({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)} - {[y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))]} =
	 {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}})
    EQUAL ==> Stat42: sigma_thryvar({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}) = pluz(sigma_thryvar({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}}), sigma_thryvar(f ¥ON (g ¥INV_IM {y})))
--
-- Before we can exploit commutativity, we must check that the two addends
-- on the left-hand side of the equality just obtained belong to $s$.
-- Thanks to the Theorem sigma_theory_3, it suffices to show that both of
-- them are finite and have range contained in $s$.
--
    (f, (g ¥INV_IM {y}))-->T48 ==> f ¥ON (g ¥INV_IM {y}) ¥incin f
    (f, f ¥ON (g ¥INV_IM {y}))-->T189 ==> Finite(f ¥ON (g ¥INV_IM {y}))
    (f ¥ON (g ¥INV_IM {y}),f)-->T65 ==> range(f ¥ON (g ¥INV_IM {y})) ¥incin range(f)
    (f ¥ON (g ¥INV_IM {y}))-->Tsigma_theory3 ==> Stat43: sigma_thryvar(f ¥ON (g ¥INV_IM {y})) in s
    Set_monot ==> {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}} ¥incin {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}
    ({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)}, {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}})-->T189 ==>
		Finite({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}})
    ({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}}, {[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g)})-->T65 ==> range({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}}) ¥incin s
    ({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}})-->Tsigma_theory3 ==> Stat44: sigma_thryvar({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}}) in s
    Assump ==> Stat45: (FORALL t, z | ((t in s) & (z in s)) ¥imp (pluz(t,z) = pluz(z,t)))
    (sigma_thryvar(f ¥ON (g ¥INV_IM {y})), sigma_thryvar({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}}))-->Stat45 ==>
		Stat46: pluz(sigma_thryvar(f ¥ON (g ¥INV_IM {y})), sigma_thryvar({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}})) =
			pluz(sigma_thryvar({[v,sigma_thryvar(f ¥ON (g ¥INV_IM {v}))]: v in range(g) - {y}}), sigma_thryvar(f ¥ON (g ¥INV_IM {y})))
    EQUAL(Stat46,Stat42,Stat13,Stat28,Stat6) ==> false; Discharge ==> QED
--
-- The following theorem is a specialized variant of the rearrangement-of-sums theorem,
-- providing essentially the same conclusion as that given by the rearrangement-of-sums theorem,
-- but from hypotheses that are sometimes more convenient.
--
Theorem sigma_theory7: [Sum permutation theorem]
    (Finite(F) & Svm(F) & one_1_map(G) & (domain(F) = domain(G)) & (range(F) ¥incin s)) ¥imp
					(sigma_thryvar(F) = sigma_thryvar({[y,F~[inv(G)~[y]]]: y in range(G)})). Proof:
    Suppose_not(f,g) ==> Finite(f) & Svm(f) & one_1_map(g) &
    	(domain(f) = domain(g)) & (range(f) ¥incin s) &
	  			(sigma_thryvar(f) /= sigma_thryvar({[y,f~[inv(g)~[y]]]: y in range(g)}))
--
-- For suppose that $f$ and $g$ furnish a counterexample to our assertion.
--
    Use_def(one_1_map) ==> Svm(g)
    Suppose ==> {[y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))]: y in range(g)} = {[y,f~[inv(g)~[y]]]: y in range(g)}
	EQUAL ==> sigma_thryvar({[y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))]: y in range(g)}) =
					 sigma_thryvar({[y,f~[inv(g)~[y]]]: y in range(g)})
    (f,g)-->Tsigma_theory6 ==> false; Discharge ==>
    	Stat1: {[y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))]: y in range(g)} /= {[y,f~[inv(g)~[y]]]: y in range(g)}
    y-->Stat1 ==> (y in range(g)) & (sigma_thryvar(f ¥ON (g ¥INV_IM {y})) /= f~[inv(g)~[y]])
    (g,y)-->T182 ==> g ¥INV_IM {y} = {inv(g)~[y]}
    g-->T99 ==> (range(g) = domain(inv(g))) & (domain(g) = range(inv(g)))
    (y,inv(g))-->T71 ==> inv(g)~[y] in domain(f)
    Use_def(Svm) ==> Is_map(f)
    (f,inv(g)~[y])-->T77 ==> [inv(g)~[y],f~[inv(g)~[y]]] in f
    Suppose ==> f ¥ON {inv(g)~[y]} /= {[inv(g)~[y],f~[inv(g)~[y]]]}
	Use_def(¥ON) ==> {p: p in f | car(p) in {inv(g)~[y]}} /= {[inv(g)~[y],f~[inv(g)~[y]]]}
    Suppose ==> Stat2: [inv(g)~[y],f~[inv(g)~[y]]] notin {p: p in f | car(p) in {inv(g)~[y]}}
    TELEM ==> car([inv(g)~[y],f~[inv(g)~[y]]]) = inv(g)~[y]
    ([inv(g)~[y],f~[inv(g)~[y]]])-->Stat2 ==> false; Discharge ==>
    			Stat3: not({p: p in f | car(p) in {inv(g)~[y]}} ¥incin {[inv(g)~[y],f~[inv(g)~[y]]]})
    q-->Stat3 ==> Stat4: (q in {p: p in f | car(p) in {inv(g)~[y]}}) & (q /= [inv(g)~[y],f~[inv(g)~[y]]])
    p-->Stat4 ==> (p in f) & (car(p) = inv(g)~[y]) & (p /= [inv(g)~[y],f~[inv(g)~[y]]])
    Use_def(Svm) ==> Stat5: (FORALL x in f, y in f | (car(x) = car(y)) ¥imp (x = y))
    (p,[inv(g)~[y],f~[inv(g)~[y]]])-->Stat5 ==> false; Discharge ==>
    		f ¥ON {inv(g)~[y]} = {[inv(g)~[y],f~[inv(g)~[y]]]}
    Suppose ==> cdr([inv(g)~[y],f~[inv(g)~[y]]]) notin s
	ELEM ==> f~[inv(g)~[y]] notin s
    (inv(g)~[y],f)-->T71 ==> false; Discharge ==> cdr([inv(g)~[y],f~[inv(g)~[y]]]) in s
    ([inv(g)~[y],f~[inv(g)~[y]]])-->Tsigma_theory2 ==>
    			sigma_thryvar({[inv(g)~[y],f~[inv(g)~[y]]]}) = f~[inv(g)~[y]]
    EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY sigma_theory
--
--THEORY sigma_theory(s,x ¥PLUZ y,e)  [Contains some elementary lemmas about single-valued functions]
--    e in s
--    (FORALL x in s | (x ¥PLUZ e = x))
--    (FORALL x in s, y in s | (x ¥PLUZ y = y ¥PLUZ x))
--    (FORALL x in s, y in s | x ¥PLUZ y in s)
--    (FORALL x in s, y in s, z in s | (x ¥PLUZ y) ¥PLUZ z = x ¥PLUZ (y ¥PLUZ z))
--==> (sigma_thryvar)
--    (sigma_thryvar(0) = e)
--    (FORALL x | (cdr(x) in s) ¥imp (sigma_thryvar({x}) = cdr(x)))
--    (FORALL f | (Finite(f) & (range(f) ¥incin s)) ¥imp (sigma_thryvar(f) in s))
--    (FORALL c, f | ((c in f) & Finite(f) & (range(f) ¥incin s)) ¥imp (sigma_thryvar(f) = sigma_thryvar(f - {c}) ¥PLUZ cdr(c)))
--    (FORALL f, t | (Finite(f) & Is_map(f) & (range(f) ¥incin s)) ¥imp (sigma_thryvar(f) = (sigma_thryvar(f ¥ON (domain(f) * t)) ¥PLUZ sigma_thryvar(f ¥ON (domain(f) - t)))))
--    (FORALL f in OM, g | (Finite(f) & Svm(f) & Svm(g) & (domain(f) = domain(g)) & (range(f) ¥incin s)) ¥imp (sigma_thryvar(f) = sigma_thryvar({[y,sigma_thryvar(f ¥ON (g ¥INV_IM {y}))]: y in range(g)})))
--    (FORALL f in OM, g | (Finite(f) & Svm(f) & one_1_map(g) & (domain(f) = domain(g)) & (range(f) ¥incin s)) ¥imp (sigma_thryvar(f) = sigma_thryvar({[y,f~[inv(g)~[y]]]: y in range(g)})))
--END sigma_theory;
--
-- ************************************************************************************************
--		Section 11: Equivalence relationships and Classes; Linear orderings
-- ************************************************************************************************
--
-- Next we introduce another tool used constantly, the theory of equivalence classes,
-- which tells us that a two-variable predicate $R(x,y)$ on a set $s$ can be represented in the form
-- $f(x) = f(y)$ using a one-variable auxiliary function $f$ if and only if $P$ is transitive and reflexive.
-- Since it is obvious that any relationship of the form $f(x) = f(y)$ must be transitive and reflexive,
-- we need only consider the converse. To construct the mapping $f$, we decompose the domain of $P$
-- into 'equivalence classes', namely the collection of all sets each containing all elements $x$ such that
-- $R(x,y)$ holds for a given $y$, and then simply map each $x$ into the equivalence class to which it belongs.
--
THEORY equivalence_classes(R(x,y),s) [Theory of equivalence classes]
    (FORALL x in s,y in s | (R(x,y) ¥eq R(y,x)) & R(x,x))
    (FORALL x in s,y in s,z in s | ((R(x,y) & R(y,z)) ¥imp R(x,z)))
END equivalence_classes;
--
ENTER_THEORY equivalence_classes
--
-- The formal definitions of the notions described just above are as follows.
-- The first definition is that of the equivalence class to which a given element of $s$ belongs,
-- and the second is that of the collection of all equivalence classes.
--
    Def equivalence_classes.0a: [The equivalence class of an element $X$] f1_thryvar(x) := {z in s | R(x,z)}
    Def equivalence_classes.0b: [The set of all equivalence classes formed by partitioning] Eqc_thryvar := {f1_thryvar(x): x in s}
--
-- We now show that, as promised, the transitive relationship $R(x,y)$ is equivalent to $f1_thryvar(x) = f1_thryvar(y)$.
--
Theorem equivalence_classes1: [Elements are equivalent if and only if their equivalence classes are equal] ((X in s) & (Y in s)) ¥imp (R(X,Y) ¥eq (f1_thryvar(X) = f1_thryvar(Y))). Proof:
    Suppose_not(x,y) ==> (x in s) & (y in s) & (not(R(x,y) ¥eq (f1_thryvar(x) = f1_thryvar(y))))
--
-- For if $R(x,y)$ is true, then since $P$ is a transitive relation any w satisfying $R(x,w)$
-- must also satisfy $R(x,w)$ and so by definition we must have $f1_thryvar(x) = f1_thryvar(y)$.
--
    Suppose ==> R(x,y) & (f1_thryvar(x) /= f1_thryvar(y))
    Use_def(f1_thryvar) ==> Stat1: {z in s | R(x,z)} /= {z in s | R(y,z)}
    c-->Stat1 ==> (c in s) & ((R(x,c) & (not R(y,c))) or ((not R(x,c)) & R(y,c)))
    Assump ==> Stat2: (FORALL u in s, v in s | (R(u,v) ¥eq R(v,u)) & R(u,u))
    Assump ==> Stat3: (FORALL u in s,v in s,w in s | ((R(u,v) & R(v,w)) ¥imp R(u,w)))
    Suppose ==> R(x,c) & (not R(y,c))
    (x,y)-->Stat2 ==> R(y,x)
    (y,x,c)-->Stat3 ==> false; Discharge ==> (not R(x,c)) & R(y,c)
    (x,y,c)-->Stat3 ==> false; Discharge ==> (not R(x,y)) & (f1_thryvar(x) = f1_thryvar(y))
--
-- Conversely if $f1_thryvar(x) = f1_thryvar(y)$ is true, then since $x$ plainly belongs to
-- $f1_thryvar(x)$, it must also belong to $f1_thryvar(y)$, and so by definition we must have
-- $R(x,y)$, thereby completing the proof of our theorem.
--
    Use_def(f1_thryvar) ==> {z in s | R(x,z)} = {z in s | R(y,z)}
    Suppose ==> Stat4: y notin {z in s | R(y,z)}
    ()-->Stat4 ==> not R(y,y)
    (y,y)-->Stat2 ==> false; Discharge ==> Stat5: y in {z in s | R(x,z)}
    ()-->Stat5 ==> false; Discharge ==> QED
--
-- Next we prove the elementary facts that $f1_thryvar$ maps elements of $s$ into elements of the
-- equivalence class set $Eqc_thryvar$, and that for each equivalence class $y$, $arb(y)$ is
-- a member of $s$ whose equivalence class is $y$.
--
Theorem equivalence_classes2:  [The equivalence class of any element is an equivalence class] (X in s) ¥imp (f1_thryvar(X) in Eqc_thryvar). Proof:
    Suppose_not(x) ==> (x in s) & (f1_thryvar(x) notin Eqc_thryvar)
--
--
--
    Use_def(Eqc_thryvar) ==> (x in s) & Stat1: (f1_thryvar(x) notin {f1_thryvar(x): x in s})
	x-->Stat1 ==> false; Discharge ==> QED
--
Theorem equivalence_classes2b: [Any element of an equivalence class can represent the class] ((X in Eqc_thryvar) ¥imp ((arb(X) in s) & (f1_thryvar(arb(X)) = X))). Proof:
	Suppose_not(y) ==> (y in Eqc_thryvar) & ((arb(y) notin s) or f1_thryvar(arb(y)) /= y)
	Use_def(Eqc_thryvar) ==> Stat1: y in {f1_thryvar(x): x in s}
    c-->Stat1 ==> (y = f1_thryvar(c)) & (c in s)
    Use_def(f1_thryvar) ==> f1_thryvar(c) = {wz in s | R(c,wz)}
    Suppose ==> c notin f1_thryvar(c)
    ELEM ==> Stat2: c notin {wz in s | R(c,wz)}
    Assump ==> Stat3: (FORALL x in s,y in s | (R(x,y) ¥eq R(y,x)) & R(x,x)) &
    				Stat4: (FORALL x in s,y in s,z in s | ((R(x,y) & R(y,z)) ¥imp R(x,z)))
    c-->Stat2 ==> not R(c,c)
    (c,c)-->Stat3 ==> false; Discharge ==> c in f1_thryvar(c)
    ELEM ==> f1_thryvar(c) /= 0
    (f1_thryvar(c))-->T0 ==> arb(f1_thryvar(c)) in f1_thryvar(c)
    Use_def(f1_thryvar) ==> arb(f1_thryvar(c)) in {wz in s | R(c,wz)}
    EQUAL ==> Stat5: arb(y) in {wz in s | R(c,wz)}
    ()-->Stat5 ==> (arb(y) in s) & R(c,arb(y))
    ELEM ==> f1_thryvar(arb(y)) /= f1_thryvar(c)
    Use_def(f1_thryvar) ==> Stat6: {wz in s | R(arb(y),wz)} /= {wz in s | R(c,wz)}
    d-->Stat6 ==> (d in s) & ((R(arb(y),d) & (not R(c,d))) or (not(R(arb(y),d)) & R(c,d)))
    Suppose ==> R(arb(y),d) & (not R(c,d))
	(c,arb(y),d)-->Stat4 ==> false; Discharge ==> (not R(arb(y),d)) & R(c,d)
	(arb(y),c)-->Stat3 ==> R(arb(y),c)
    (arb(y),c,d)-->Stat4 ==> false; Discharge ==> QED

-- Our next, quite trivial result rounds out the previous theorem by proving that $arb(f1_thryvar(x))$
-- is equivalent to $x$ for any $x in s$.
--
Theorem equivalence_classes3: [Any two elements of an equivalence class are equivalent] (X in s) ¥imp R(x,arb(f1_thryvar(x))). Proof:
    Suppose_not(u) ==> (u in s) & (not R(u,arb(f1_thryvar(u))))
    u-->Tequivalence_classes2 ==> f1_thryvar(u) in Eqc_thryvar
    (f1_thryvar(u))-->Tequivalence_classes2b ==>
    	(arb(f1_thryvar(u)) in s) & (f1_thryvar(arb(f1_thryvar(u))) = f1_thryvar(u))
    (u,s,arb(f1_thryvar(u)))-->Tequivalence_classes1 ==> R(u,arb(f1_thryvar(u)))
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY equivalence_classes
--
--THEORY equivalence_classes(R(x,y),s) [Theory of equivalence classes]
--    (FORALL x in s, y in s | (R(x,y) ¥eq R(y,x)) & R(x,x))
--    (FORALL x in s, y in s, z in s | ((R(x,y) & R(y,z)) ¥imp R(x,z)))
--==>(f1_thryvar,Eqc_thryvar)
--    (FORALL x in s | f1_thryvar(x) in Eqc_thryvar) & (FORALL y in Eqc_thryvar | (arb(y) in s) & (f1_thryvar(arb(y)) = y))
--    (FORALL x in s, y in s | R(x,y) ¥eq (f1_thryvar(x) = f1_thryvar(y)))
--    (FORALL x in s | R(x,arb(f1_thryvar(x))))
--END equivalence_classes;
--
-- Next we introduce another tool used constantly, the theory of strict linear orderings.
-- This tells us that any transitive and irreflexive two-argument ordering predicate
-- on a set $s$ induces various other useful
-- predicates and operations, including a maximum operation over every finite subset of $s$.
--
THEORY linear_order(s0,arg1_bef_arg2(X,Y))
    (FORALL x in  s0, y in s0, z in s0 | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) ¥imp arg1_bef_arg2(x,z))
    (FORALL x in s0 | not(arg1_bef_arg2(x,x)))
    (FORALL x in  s0, y in s0 | arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x))
END linear_order
--
ENTER_THEORY linear_order
--
Def 10030: [Less-than-or-equal comparison] Def(X ¥le_thryvar Y) := (arg1_bef_arg2(X,Y) or (X = Y))
--
-- The following easy theorem shows that, like the 'strict' order relationship $arg1_bef_arg2$
-- originally given, the 'less-than-or-equal' relation which $arg1_bef_arg2$ defines is transitive.
--
Theorem linear_order_1: (({U,V,W} ¥incin s0) & (U ¥le_thryvar V) & (V ¥le_thryvar W)) ¥imp (U ¥le_thryvar W). Proof:
    Suppose_not(x,y,z) ==> ({x,y,z} ¥incin s0) & (x ¥le_thryvar y) & (y ¥le_thryvar z) & (not (x ¥le_thryvar z))
        Use_def(¥le_thryvar) ==> (arg1_bef_arg2(x,y) or (x = y)) & (arg1_bef_arg2(y,z) or (y = z)) & (not(arg1_bef_arg2(x,z) or (x = z)))
        Suppose ==> (x = y) & (y = z)
        Discharge ==> (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) or (arg1_bef_arg2(x,y) & (y = z)) or ((x = y) & arg1_bef_arg2(y,z))
        Suppose ==> arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)
            Assump ==> Stat1: (FORALL x in  s0, y in s0, z in s0 | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) ¥imp arg1_bef_arg2(x,z))
        (x,y,z)-->Stat1 ==> false; Discharge ==> (arg1_bef_arg2(x,y) & (y = z)) or ((x = y) & arg1_bef_arg2(y,z))
        Suppose ==> arg1_bef_arg2(x,y) & (y = z)
        EQUAL ==> false; Discharge ==> ((x = y) & arg1_bef_arg2(y,z))
    EQUAL ==> false; Discharge ==> QED
--
-- The irreflexivity property of the strict order $arg1_bef_arg2$ implies the
-- following property of its associated 'less-than-or-equal' relation.
--
Theorem linear_order_2: (({U,V} ¥incin s0) & (U ¥le_thryvar V) & (V ¥le_thryvar U)) ¥imp (U = V). Proof:
    Suppose_not(x,y) ==> ({x,y} ¥incin s0) & (x ¥le_thryvar y) & (y ¥le_thryvar x) & (x /= y)
        Use_def(¥le_thryvar) ==> arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x)
        Assump ==> Stat1: (FORALL x in  s0, y in s0, z in s0 | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) ¥imp arg1_bef_arg2(x,z))
        (x,y,x)-->Stat1 ==> arg1_bef_arg2(x,x)
        Assump ==> Stat2: (FORALL x in s0 | not(arg1_bef_arg2(x,x)))
    x-->Stat2 ==> false; Discharge ==> QED
--
-- The following operation $smaller_thryvar$ extends the choice of the smaller element of a pair to the universe
-- of all sets by taking $s0$ itself as the value of smallest element for pairs one of whose elements is not in s0.
--
Def 10031: [Choice of the smaller] smaller_thryvar(X,Y) := if ((X notin s0) & (Y notin s0)) then s0 elseif (X notin s0) then Y elseif (Y notin s0) then X elseif arg1_bef_arg2(X,Y) then X else Y end if
--
-- The operation which chooses the smaller of its two arguments is commutative:
--
Theorem linear_order_3: smaller_thryvar(X,Y) = smaller_thryvar(Y,X). Proof:
Suppose_not(x,y) ==> Stat1: smaller_thryvar(x,y) /= smaller_thryvar(y,x)
	Suppose ==> not((x in s0) & (y in s0))
	Use_def(smaller_thryvar) ==> false; Discharge ==> Stat2: (x in s0) & (y in s0)
	Assump ==> Stat3: (FORALL x in  s0, y in s0 | arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x))
	(x,y)-->Stat3(Stat2*) ==> arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x)
	Suppose ==> Stat4: arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x)
		Assump ==> Stat5: (FORALL x in  s0, y in s0, z in s0 | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) ¥imp arg1_bef_arg2(x,z))
		(x,y,x)-->Stat5(Stat2,Stat4*) ==> Stat6: arg1_bef_arg2(x,x)
		Assump ==> Stat7: (FORALL x in s0 | not(arg1_bef_arg2(x,x)))
	x-->Stat7(Stat2,Stat4,Stat6*) ==> false; Discharge ==> Stat8: not(arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x))
	Suppose ==> Stat9: x = y
	EQUAL(Stat1,Stat9*) ==> false; Discharge ==> Stat10: arg1_bef_arg2(x,y) or arg1_bef_arg2(y,x)
	Suppose ==> Stat11: arg1_bef_arg2(x,y)
	Use_def(smaller_thryvar) ==> false; Discharge ==> Stat12: arg1_bef_arg2(y,x)
Use_def(smaller_thryvar) ==> false; Discharge ==> QED
--
-- Our assumptions concerning the strict order $arg1_bef_arg2$ also imply the
-- following familiar property of the associated 'less-than-or-equal' relation, i.e.
-- given any two elements of the domain $s0$, at least one one must be no larger than the other.
--
Theorem linear_order_4: ({U,V} ¥incin s0) ¥imp ((U ¥le_thryvar V) or (V ¥le_thryvar U)). Proof:
    Suppose_not(x,y) ==> ({x,y} ¥incin s0) & (not (x ¥le_thryvar y)) & (not (y ¥le_thryvar x))
        Use_def(¥le_thryvar) ==> (x /= y) & (not arg1_bef_arg2(x,y)) & (not arg1_bef_arg2(y,x))
        Assump ==> Stat1: (FORALL x in  s0, y in s0 | arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x))
    (x,y)-->Stat1 ==> false; Discharge ==> QED
--
-- The following theorem extends this last assertion to three elements:
-- of any three elements in $s0$, one is smallest.
--
Theorem linear_order_5: ({U,V,W} ¥incin s0) ¥imp (((U ¥le_thryvar V) & (U ¥le_thryvar W)) or
	((V ¥le_thryvar U) & (V ¥le_thryvar W)) or ((W ¥le_thryvar U) & (W ¥le_thryvar V))). Proof:
    Suppose_not(x,y,z) ==> Stat1: ({x,y,z} ¥incin s0) & (not ((x ¥le_thryvar y) & (x ¥le_thryvar z))) &
		(not ((y ¥le_thryvar x) & (y ¥le_thryvar z))) & (not ((z ¥le_thryvar x) & (z ¥le_thryvar y)))
        (x,y)-->Tlinear_order_4 ==> (x ¥le_thryvar y) or (y ¥le_thryvar x)
        (y,z)-->Tlinear_order_4 ==> (y ¥le_thryvar z) or (z ¥le_thryvar y)
        (x,z)-->Tlinear_order_4 ==> (x ¥le_thryvar z) or (z ¥le_thryvar x)
        Suppose ==> Stat2: (x ¥le_thryvar y) & (y ¥le_thryvar z)
        (x,y,z)-->Tlinear_order_1(Stat1,Stat2) ==> false; Discharge ==> (y ¥le_thryvar x) & (z ¥le_thryvar y)
    (z,y,x)-->Tlinear_order_1 ==> false; Discharge ==> QED
--
-- Every two-element subset of $s0$ is closed with respect to the operation which
-- chooses the smaller of its two arguments:
--
Theorem linear_order_6: ({X,Y} ¥incin s0) ¥imp (smaller_thryvar(X,Y) in {X,Y}). Proof:
    Suppose_not(x,y) ==> ({x,y} ¥incin s0) & (smaller_thryvar(x,y) notin {x,y})
    Use_def(smaller_thryvar) ==> smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if
    Discharge ==> QED
--
-- When $x,y$ are elements of $s0$ such that $x$ is
-- less than or equal to $y$, is $x$, the smaller is $x$:
--
Theorem linear_order_7: (({X,Y} ¥incin s0) & (arg1_bef_arg2(X,Y) or (X = Y))) ¥imp ((smaller_thryvar(X,Y) = X) & (smaller_thryvar(Y,X) = X)). Proof:
    Suppose_not(x,y) ==> ({x,y} ¥incin s0) & (arg1_bef_arg2(x,y) or (x = y)) & ((smaller_thryvar(x,y) /= x) or (smaller_thryvar(y,x) /= x))
        (x,y)-->Tlinear_order_3 ==> Stat1: (x in s0) & (y in s0) & (smaller_thryvar(x,y) /= x)
        Suppose ==> arg1_bef_arg2(x,y)
        Use_def(smaller_thryvar) ==> smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if
        (Stat1)Discharge ==> x = y
    (x,y)-->Tlinear_order_6(Stat1) ==> false; Discharge ==> QED
--
-- The set $s0$, which we have taken as the conventional minimum, acts as
-- the unit element of the operation which chooses the smaller of its two
-- arguments:
--
Theorem linear_order_8: (X in next(s0)) ¥imp (smaller_thryvar(X,s0) = X). Proof:
    Suppose_not(x) ==> AUTO
	Suppose ==> x in s0
	Use_def(smaller_thryvar) ==> false; Discharge ==> x notin s0
	Use_def(next) ==> Stat1: (x = s0) & (smaller_thryvar(x,s0) /= x)
    Use_def(smaller_thryvar)(Stat1*) ==> false; Discharge ==> QED
--
-- The operation which chooses the smaller of its two arguments is associative:
--
Theorem linear_order_9: smaller_thryvar(X,smaller_thryvar(Y,W)) = smaller_thryvar(smaller_thryvar(X,Y),W). Proof:
    Suppose_not(x,y,w) ==> smaller_thryvar(x,smaller_thryvar(y,w)) /= smaller_thryvar(smaller_thryvar(x,y),w)
--
-- For it is easily seen that all three elements $x,y,w$ of a counterexample belong to $s0$;...
--
        Suppose ==> (x notin s0) & (y notin s0) & (w notin s0)
            TELEM ==> s0 notin s0
            Use_def(smaller_thryvar) ==> smaller_thryvar(y,w) = s0
            Use_def(smaller_thryvar) ==> smaller_thryvar(x,y) = s0
            Use_def(smaller_thryvar) ==> smaller_thryvar(x,s0) = s0
            Use_def(smaller_thryvar) ==> smaller_thryvar(s0,w) = s0
        EQUAL ==> false; Discharge ==> Stat1: (x in s0) or (y in s0) or (w in s0)
        Suppose ==> Stat2: (x notin s0) & (w notin s0)
            (Stat1*)ELEM ==> (y in s0)
            Use_def(smaller_thryvar) ==> (smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if) &
		(smaller_thryvar(y,w) = if ((y notin s0) & (w notin s0)) then s0 elseif (y notin s0) then w elseif (w notin s0) then y elseif arg1_bef_arg2(y,w) then y else w end if)
            (Stat2*)ELEM ==> (smaller_thryvar(x,y) = y) & (smaller_thryvar(y,w) = y)
        EQUAL ==> false; Discharge ==> Stat3: (x in s0) or (w in s0)
        Suppose ==> Stat4: (y notin s0) & (w notin s0)
            (Stat3*)ELEM ==> Stat5: (x in s0) & (s0 notin s0)
            Use_def(smaller_thryvar) ==> (smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if) &
		(smaller_thryvar(x,w) = if ((x notin s0) & (w notin s0)) then s0 elseif (x notin s0) then w elseif (w notin s0) then x elseif arg1_bef_arg2(x,w) then x else w end if)
            (Stat4*)ELEM ==> (smaller_thryvar(x,y) = x) & (smaller_thryvar(x,w) = x)
            Use_def(smaller_thryvar) ==> Stat6: (smaller_thryvar(x,s0) = if ((x notin s0) & (s0 notin s0)) then s0 elseif (x notin s0) then s0 elseif (s0 notin s0) then x elseif arg1_bef_arg2(x,s0) then x else s0 end if)
            (Stat5,Stat6*)ELEM ==> (smaller_thryvar(x,s0) = x)
            Use_def(smaller_thryvar) ==> smaller_thryvar(y,w) = s0
        EQUAL ==> false; Discharge ==> Stat7: (y in s0) or (w in s0)
        Suppose ==> Stat8: (x notin s0) & (y notin s0)
            (Stat7*)ELEM ==> Stat9: (w in s0) & (s0 notin s0)
            Use_def(smaller_thryvar) ==> (smaller_thryvar(y,w) = if ((y notin s0) & (w notin s0)) then s0 elseif (y notin s0) then w elseif (w notin s0) then y elseif arg1_bef_arg2(y,w) then y else w end if) &
		(smaller_thryvar(x,w) = if ((x notin s0) & (w notin s0)) then s0 elseif (x notin s0) then w elseif (w notin s0) then x elseif arg1_bef_arg2(x,w) then x else w end if)
            (Stat8*)ELEM ==> (smaller_thryvar(y,w) = w) & (smaller_thryvar(x,w) = w)
            Use_def(smaller_thryvar) ==> Stat10: (smaller_thryvar(s0,w) = if ((s0 notin s0) & (w notin s0)) then s0 elseif (s0 notin s0) then w elseif (w notin s0) then s0 elseif arg1_bef_arg2(s0,w) then s0 else w end if)
            (Stat9,Stat10*)ELEM ==> (smaller_thryvar(s0,w) = w)
            Use_def(smaller_thryvar) ==> smaller_thryvar(x,y) = s0
        EQUAL ==> false; Discharge ==> Stat11: (x in s0) or (y in s0)
        Suppose ==> Stat12: w notin s0
            (Stat3,Stat7,Stat12*)ELEM ==> (x in s0) & (y in s0)
            Use_def(smaller_thryvar) ==> (smaller_thryvar(y,w) = if ((y notin s0) & (w notin s0)) then s0 elseif (y notin s0) then w elseif (w notin s0) then y elseif arg1_bef_arg2(y,w) then y else w end if) &
		(smaller_thryvar(smaller_thryvar(x,y),w) = if ((smaller_thryvar(x,y) notin s0) & (w notin s0)) then s0 elseif (smaller_thryvar(x,y) notin s0) then w elseif (w notin s0) then smaller_thryvar(x,y) elseif arg1_bef_arg2(smaller_thryvar(x,y),w) then smaller_thryvar(x,y) else w end if)
            (x,y)-->Tlinear_order_6(Stat12*) ==> smaller_thryvar(x,y) in s0
            (Stat12*)ELEM ==> (smaller_thryvar(smaller_thryvar(x,y),w) = smaller_thryvar(x,y)) &
		(smaller_thryvar(y,w) = y)
        EQUAL ==> false; Discharge ==> Stat13: w in s0
        Suppose ==> Stat14: x notin s0
            (Stat3,Stat11,Stat14*)ELEM ==> (y in s0) & (w in s0)
            Use_def(smaller_thryvar) ==> (smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if) &
		(smaller_thryvar(x,smaller_thryvar(y,w)) = if ((x notin s0) & (smaller_thryvar(y,w) notin s0)) then s0 elseif (x notin s0) then smaller_thryvar(y,w) elseif (smaller_thryvar(y,w) notin s0) then x elseif arg1_bef_arg2(x,smaller_thryvar(y,w)) then x else smaller_thryvar(y,w) end if)
            (y,w)-->Tlinear_order_6(Stat14*) ==> smaller_thryvar(y,w) in s0
            (Stat14*)ELEM ==> (smaller_thryvar(x,smaller_thryvar(y,w)) = smaller_thryvar(y,w)) &
		(smaller_thryvar(x,y) = y)
        EQUAL ==> false; Discharge ==> Stat15: x in s0
        Suppose ==> Stat16: y notin s0
            (Stat11,Stat7,Stat16*)ELEM ==> (x in s0) & (w in s0)
            Use_def(smaller_thryvar) ==> (smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if) &
		(smaller_thryvar(y,w) = if ((y notin s0) & (w notin s0)) then s0 elseif (y notin s0) then w elseif (w notin s0) then y elseif arg1_bef_arg2(y,w) then y else w end if)
            (Stat16*)ELEM ==> (smaller_thryvar(x,y) = x) & (smaller_thryvar(y,w) = w)
        EQUAL ==> false; Discharge ==> Stat17: y in s0
--        (Stat13,Stat15,Stat17*)ELEM ==> Stat18: (x in s0) & (y in s0) & (w in s0)
--
-- ... but then we easily reach a contradiction no matter which of the three is smallest,
-- thereby deriving our desired conclusion.
--
        (x,y,w)-->Tlinear_order_5(Stat13,Stat15,Stat17*) ==> ((x ¥le_thryvar y) & (x ¥le_thryvar w)) or
		((y ¥le_thryvar x) & (y ¥le_thryvar w)) or ((w ¥le_thryvar x) & (w ¥le_thryvar y))
        Suppose ==> (x ¥le_thryvar y) & (x ¥le_thryvar w)
            Use_def(¥le_thryvar) ==> Stat19: (arg1_bef_arg2(x,y) or (x = y))
            Use_def(¥le_thryvar) ==> Stat20: (arg1_bef_arg2(x,w) or (x = w))
            (x,y)-->Tlinear_order_7(Stat15,Stat17,Stat19*) ==> smaller_thryvar(x,y) = x
            (x,w)-->Tlinear_order_7(Stat15,Stat13,Stat20*) ==> smaller_thryvar(x,w) = x
            (y,w)-->Tlinear_order_6(Stat17,Stat13*) ==> smaller_thryvar(y,w) in {y,w}
            Suppose ==> smaller_thryvar(y,w) = y
            EQUAL ==> false; Discharge ==> smaller_thryvar(y,w) = w
        EQUAL ==> false; Discharge ==> ((y ¥le_thryvar x) & (y ¥le_thryvar w)) or ((w ¥le_thryvar x) & (w ¥le_thryvar y))
        Suppose ==> (y ¥le_thryvar x) & (y ¥le_thryvar w)
            Use_def(¥le_thryvar) ==> Stat21: (arg1_bef_arg2(y,x) or (y = x))
            Use_def(¥le_thryvar) ==> Stat22: (arg1_bef_arg2(y,w) or (y = w))
            (y,x)-->Tlinear_order_7(Stat15,Stat17,Stat21*) ==> smaller_thryvar(x,y) = y
            (y,w)-->Tlinear_order_7(Stat17,Stat13,Stat22*) ==> smaller_thryvar(y,w) = y
        EQUAL ==> false; Discharge ==> (w ¥le_thryvar x) & (w ¥le_thryvar y)
        Use_def(¥le_thryvar) ==> Stat23: (arg1_bef_arg2(w,x) or (w = x))
        Use_def(¥le_thryvar) ==> Stat24: (arg1_bef_arg2(w,y) or (w = y))
        (w,y)-->Tlinear_order_7(Stat17,Stat13,Stat24*) ==> smaller_thryvar(y,w) = w
        (w,x)-->Tlinear_order_7(Stat15,Stat13,Stat23*) ==> smaller_thryvar(x,w) = w
        (x,y)-->Tlinear_order_6(Stat17,Stat15*) ==> smaller_thryvar(x,y) in {x,y}
        Suppose ==> smaller_thryvar(x,y) = x
        EQUAL ==> false; Discharge ==> smaller_thryvar(x,y) = y
    EQUAL ==> false; Discharge ==> QED
--
-- The set $s0 + {s0}$ is closed with respect to the operation which
-- chooses the smaller of its two arguments:
--
Theorem linear_order_10: ((X in next(s0)) & (Y in next(s0))) ¥imp (smaller_thryvar(X,Y) in next(s0)). Proof:
    Suppose_not(x,y) ==> AUTO
	Use_def(next) ==> (x in (s0 + {s0})) & (y in (s0 + {s0})) & (smaller_thryvar(x,y) notin (s0 + {s0}))
        Suppose ==> (x = s0) or (y = s0)
        Use_def(smaller_thryvar) ==> false; Discharge ==> (x in s0) & (y in s0)
    (x,y)-->Tlinear_order_6 ==> false; Discharge ==> QED
--
--
--
Theorem linear_order_11: (s0 in next(s0)) & (FORALL x,y,z | ((x in next(s0)) & (y in next(s0)) & (z in next(s0))) ¥imp (smaller_thryvar(x,smaller_thryvar(y,z)) = smaller_thryvar(smaller_thryvar(x,y),z))) &
	(FORALL x,y | ((x in next(s0)) & (y in next(s0))) ¥imp (smaller_thryvar(x,y) = smaller_thryvar(y,x))). Proof:
Suppose_not ==> AUTO
	Use_def(next) ==> s0 in next(s0)
	Suppose ==> Stat1: not(FORALL x,y | ((x in next(s0)) & (y in next(s0))) ¥imp (smaller_thryvar(x,y) = smaller_thryvar(y,x)))
		(x0,y0)-->Stat1(Stat1*) ==> smaller_thryvar(x0,y0) /= smaller_thryvar(y0,x0)
	(x0,y0)-->Tlinear_order_3 ==> false; Discharge ==> Stat2: not(FORALL x,y,z | ((x in next(s0)) & (y in next(s0)) & (z in next(s0))) ¥imp (smaller_thryvar(x,smaller_thryvar(y,z)) = smaller_thryvar(smaller_thryvar(x,y),z)))
	(x,y,w)-->Stat2 ==> smaller_thryvar(x,smaller_thryvar(y,w)) /= smaller_thryvar(smaller_thryvar(x,y),w)
(x,y,w)-->Tlinear_order_9 ==> false; Discharge ==> QED
--
-- We have now derived all that is necessary to apply our general 'theory of Sigma' to the binary operation $smaller_thryvar$.
-- Doing so, we can conclude immediately that the $smaller_thryvar$ operation extends to an operator $min_over_thryvar$
-- defined on all finite mappings with values in the linearly ordered set $next(s0)$, and that this
-- operation maps every subset of $s0$ into an element of $s0$.
--
APPLY(sigma_thryvar:min_over_thryvar) sigma_theory(s->next(s0),pluz(i,j)->smaller_thryvar(i,j),e->s0) ==>
Theorem linear_order_12: (FORALL f | (Finite(f) & (range(f) ¥incin next(s0))) ¥imp (min_over_thryvar(f) in next(s0))) &
	(FORALL x | (cdr(x) in next(s0)) ¥imp (min_over_thryvar({x}) = cdr(x))) &
	(FORALL f,t | (Finite(f) & Is_map(f) & (range(f) ¥incin next(s0))) ¥imp (min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f ¥ON (domain(f) * t)),min_over_thryvar(f ¥ON (domain(f) - t))))) &
	(FORALL c,f | ((c in f) & Finite(f) & (range(f) ¥incin next(s0))) ¥imp (min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f - {c}),cdr(c))))
--
Theorem linear_order_13: (Svm(F) & (range(F) ¥incin s0) & Finite(F)) ¥imp
	(((P in F) ¥imp (min_over_thryvar({P}) = (F~[car(P)]))) &
	 (min_over_thryvar(F) = smaller_thryvar(min_over_thryvar(F ¥ON (domain(F) * A)),min_over_thryvar(F ¥ON (domain(F) - A))))). Proof:
Suppose_not(f,p,a) ==> AUTO
	Use_def(next) ==> Stat1: Svm(f) & (range(f) ¥incin next(s0)) & Finite(f)
	Tlinear_order_12 ==> Stat2: (FORALL x | (cdr(x) in next(s0)) ¥imp (min_over_thryvar({x}) = cdr(x))) &
		Stat3: (FORALL f,a | (Finite(f) & Is_map(f) & (range(f) ¥incin next(s0))) ¥imp (min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f ¥ON (domain(f) * a)),min_over_thryvar(f ¥ON (domain(f) - a)))))
	Use_def(Svm) ==> Is_map(f)
	Suppose ==> Stat4: not((p in f) ¥imp (min_over_thryvar({p}) = (f~[car(p)])))
		(p,f)-->T61(Stat4,Stat1*) ==> cdr(p) in next(s0)
		p-->Stat2(Stat4*) ==> min_over_thryvar({p}) = cdr(p)
		(f,p)-->T74(Stat1,Stat4*) ==> cdr(p) = (f~[car(p)])
	(Stat4*)Discharge ==> min_over_thryvar(f) /= smaller_thryvar(min_over_thryvar(f ¥ON (domain(f) * a)),min_over_thryvar(f ¥ON (domain(f) - a)))
(f,a)-->Stat3(Stat1*) ==> false; Discharge ==> QED
--
-- We can sharpen the preceding theorem by asserting that for each non-null finite mapping $f$ to which
-- it applies, $min_over_thryvar$ is actually a member of $range(f)$.
--
Theorem linear_order_14: (Svm(F) & (range(F) ¥incin s0) & Finite(F) & (F /= 0)) ¥imp
	(min_over_thryvar(F) in range(F)). Proof:
Suppose_not(f1) ==> AUTO
--
-- Reasoning by contradiction, let us assume that a
-- counterexample $f$ to the statement of this theorem exists.
-- Without loss of generality, we may assume that $f$
-- is inclusion-minimal among the counterexamples.
--
        APPLY(m1_thryvar:f) finite_induction(n->f1,P(f)->(Svm(f) & (range(f) ¥incin s0) & Finite(f) & (f /= 0) & (min_over_thryvar(f) notin range(f)))) ==>
                Stat1: (Svm(f) & (range(f) ¥incin s0) & Finite(f) & (f /= 0) & (min_over_thryvar(f) notin range(f))) &
		Stat2: (FORALL k ¥incin f | (k /= f) ¥imp (not(Svm(k) & (range(k) ¥incin s0) & Finite(k) & (k /= 0) & (min_over_thryvar(k) notin range(k)))))
	(arb(f),f)-->T61(Stat1) ==> Stat3: (arb(f) in f) & (cdr(arb(f)) in range(f))
	(f,arb(f))-->T74(Stat1*) ==> (f~[car(arb(f))]) in range(f)
--
-- By recourse to the Theorem linear_order_13, we easily discard the possibility that
-- $f$ is singleton; but then, if we remove from $f$ its element $arb(f)$, we get a
-- mapping whose $min_over_thryvar$ is, by the assumed minimality of $min_over_thryvar$,
-- a member of $range(f)$. For  $f$, the operation $min_over_thryvar$ yields the value
--	$smaller_thryvar(min_over_thryvar(f - arb(f)),cdr(arb(f)))$
-- which, being the smaller of two members of $range(f)$, will coincide with one of the two,
-- and hence must belong to $range(f)$ in its turn. This conflicts with the initial hypothesis,
-- a contradiction which leads us to the desired conclusion.
--
	Suppose ==> f = {arb(f)}
--?		(f,arb(f))-->Tlinear_order_13(Stat1*) ==> min_over_thryvar({arb(f)}) = (f~[car(arb(f))])
		(f,s0,arb(f))-->Tlinear_order_13(Stat1*) ==> min_over_thryvar({arb(f)}) = (f~[car(arb(f))])
	EQUAL(Stat1) ==> false; Discharge ==> (f - {arb(f)}) /= 0
	Use_def(next)(Stat1*) ==> range(f) ¥incin next(s0)
	Tlinear_order_12(Stat1*) ==> Stat4: (FORALL c,f | ((c in f) & Finite(f) & (range(f) ¥incin next(s0))) ¥imp (min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f - {c}),cdr(c))))
	(arb(f),f)-->Stat4(Stat1*) ==> Stat5: min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f - {arb(f)}),cdr(arb(f)))
	(f - {arb(f)})-->Stat2(Stat1*) ==> Stat6: not(Svm(f - {arb(f)}) & (range(f - {arb(f)}) ¥incin s0) & Finite(f - {arb(f)}) & (min_over_thryvar(f - {arb(f)}) notin range(f - {arb(f)})))
	(f - {arb(f)},f)-->T53(Stat1,Stat6*) ==> Stat7: not((range(f - {arb(f)}) ¥incin s0) & Finite(f - {arb(f)}) & (min_over_thryvar(f - {arb(f)}) notin range(f - {arb(f)})))
	(f - {arb(f)},f)-->T65(Stat1,Stat7*) ==> Stat8: range(f - {arb(f)}) ¥incin range(f)
	(f,f - {arb(f)})-->T189(Stat1,Stat7,Stat8*) ==> Stat9: min_over_thryvar(f - {arb(f)}) in range(f)
(min_over_thryvar(f - {arb(f)}),cdr(arb(f)))-->Tlinear_order_6(Stat9,Stat1,Stat5,Stat3*) ==> false; Discharge ==> QED
--
Theorem linear_order_15: ({X,Y} ¥incin s0) ¥imp ((smaller_thryvar(X,Y) = X) ¥eq (arg1_bef_arg2(X,Y) or (X = Y))). Proof:
    Suppose_not(x,y) ==> ({x,y} ¥incin s0) & ((smaller_thryvar(x,y) /= x) ¥eq (arg1_bef_arg2(x,y) or (x = y)))
        Suppose ==> arg1_bef_arg2(x,y) or (x = y)
        (x,y)-->Tlinear_order_7 ==> false; Discharge ==> smaller_thryvar(x,y) = x
    Use_def(smaller_thryvar) ==> false; Discharge ==> QED
--
-- The following definition of the upper bounds of a set $t$
-- takes into account only the part of $t$ which consists of elements of
-- the domain $s0$ underlying the present theory.
--
Def 10033: [Upper bounds] ubs_thryvar(T) := {x in s0 | (FORALL y in (T * s0) | smaller_thryvar(y,x) = y)}
--
-- The maximum of a set $t$ is the upper bound of $t$ ---if any--- which
-- belongs to $t$. If there is no such element, we conventionally take
-- the domain $s0$ underlying the present theory as the maximum.
--
Def 10034: [Maximum of a set] max_thryvar(T) := arb({s0} + (T * ubs_thryvar(T)))
--
-- In a way similar to the maximum, we conventionally take the least upper
-- bound of a set $t$, when none proper exists, to be $s0$.
--
Def 10035: [Least upper bound of a set] lub_thryvar(T) := arb({s0} + {x in ubs_thryvar(T) | ubs_thryvar(T) ¥incin ubs_thryvar({x})})
--
-- It readily follows from the definitions that the upper bounds of $0$
-- form the entire $s0$ (which also equals the conventional maximum of $0$).
--
Theorem linear_order_16: (ubs_thryvar(0) = s0) & (max_thryvar(0) = s0). Proof:
    Suppose_not ==> (ubs_thryvar(0) /= s0) or (max_thryvar(0) /= s0)
        Use_def(max_thryvar) ==> Stat1: ubs_thryvar(0) /= s0
        c-->Stat1 ==> (c in ubs_thryvar(0)) ¥eq (c notin s0)
        Use_def(ubs_thryvar) ==> (c in {x in s0 | (FORALL y in (0 * s0) | smaller_thryvar(y,x) = y)}) ¥eq (c notin s0)
        Suppose ==> Stat2: c in {x in s0 | (FORALL y in (0 * s0) | smaller_thryvar(y,x) = y)}
        ()-->Stat2 ==> false; Discharge ==> Stat3: (c notin {x in s0 | (FORALL y in (0 * s0) | smaller_thryvar(y,x) = y)})
        ()-->Stat3 ==> Stat4: not(FORALL y in (0 * s0) | smaller_thryvar(y,c) = y)
    y-->Stat4 ==> false; Discharge ==> QED
--
-- As defined above, the set of upper bounds and the maximum of any set $t$
-- do not depend on those elements of $t$ which lie outside $s0$.
--
Theorem linear_order_17: (ubs_thryvar(T) ¥incin s0) & (ubs_thryvar(T) = ubs_thryvar(T * s0)) & (max_thryvar(T) = max_thryvar(T * s0)). Proof:
    Suppose_not(t) ==> (not(ubs_thryvar(t) ¥incin s0)) or (ubs_thryvar(t) /= ubs_thryvar(t * s0)) or (max_thryvar(t) /= max_thryvar(t * s0))
        Use_def(ubs_thryvar) ==> ubs_thryvar(t) = {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)}
        Suppose ==> Stat1: not({x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)} ¥incin s0)
        c-->Stat1 ==> (c notin s0) & Stat2: (c in {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)})
        ()-->Stat2 ==> false; Discharge ==> Stat3: (ubs_thryvar(t) ¥incin s0) & ((ubs_thryvar(t) /= ubs_thryvar(t * s0)) or (max_thryvar(t) /= max_thryvar(t * s0)))
        Suppose ==> Stat4: ubs_thryvar(t) /= ubs_thryvar(t * s0)
            Use_def(ubs_thryvar) ==> {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)} /= {x in s0 | (FORALL y in ((t * s0) * s0) | smaller_thryvar(y,x) = y)}
            TELEM ==> t * s0 = (t * s0) * s0
        EQUAL(Stat4) ==> false; Discharge ==> Stat5: (ubs_thryvar(t) = ubs_thryvar(t * s0)) & (max_thryvar(t) /= max_thryvar(t * s0))
        Use_def(max_thryvar)(Stat3,Stat5) ==> (arb({s0} + (t * ubs_thryvar(t))) /= arb({s0} + ((t * s0) * ubs_thryvar(t * s0)))) & (t * ubs_thryvar(t)) = ((t * s0) * ubs_thryvar(t * s0))
    EQUAL(Stat5) ==> false; Discharge ==> QED
--
-- Every non-null finite subset $t$ of $s0$ is endowed with maximum.
-- Such maximum belongs to $t$ and exceeds every other element of $t$.
--
Theorem linear_order_18: (Finite(T) & (X in T) & (T ¥incin s0)) ¥imp ((max_thryvar(T) in T) & ((X = max_thryvar(T)) or (arg1_bef_arg2(X,max_thryvar(T))))). Proof:
    Suppose_not(t0,x0) ==> Stat1: Finite(t0) & (x0 in t0) & (t0 ¥incin s0) & (not((max_thryvar(t0) in t0) & ((x0 = max_thryvar(t0)) or (arg1_bef_arg2(x0,max_thryvar(t0))))))
--
-- For, if not, then we could take an inclusion-minimal $t$ for which
-- an $x1$ exists violating the statement.
--
        Suppose ==> Stat2: (FORALL x in t0 | (max_thryvar(t0) in t0) & ((x = max_thryvar(t0)) or arg1_bef_arg2(x,max_thryvar(t0))))
        x0-->Stat2 ==> false; Discharge ==> not(FORALL x in t0 | (max_thryvar(t0) in t0) & ((x = max_thryvar(t0)) or arg1_bef_arg2(x,max_thryvar(t0))))
        APPLY(m1_thryvar:t) finite_induction(n->t0,P(k)->(not(FORALL x in k | (max_thryvar(k) in k) & ((x = max_thryvar(k)) or arg1_bef_arg2(x,max_thryvar(k)))))) ==>
		(t ¥incin t0) &
                Stat3: (not(FORALL x in t | (max_thryvar(t) in t) & ((x = max_thryvar(t)) or arg1_bef_arg2(x,max_thryvar(t))))) &
		Stat4: (FORALL k ¥incin t | ((k /= t) ¥imp (FORALL x in k | (max_thryvar(k) in k) & ((x = max_thryvar(k)) or arg1_bef_arg2(x,max_thryvar(k))))))
        x1-->Stat3 ==> (x1 in t) & ((max_thryvar(t) notin t) or ((x1 /= max_thryvar(t)) and (not arg1_bef_arg2(x1,max_thryvar(t)))))
        ELEM ==> Stat5: (t ¥incin s0) & (x1 in t) & (x1 /= max_thryvar(t)) & ((max_thryvar(t) notin t) or (not arg1_bef_arg2(x1,max_thryvar(t))))
        (t - {x1})-->Stat4(Stat5) ==> Stat6: (FORALL x in (t - {x1}) | (max_thryvar(t - {x1}) in (t - {x1})) & ((x = max_thryvar(t - {x1})) or arg1_bef_arg2(x,max_thryvar(t - {x1}))))
--
-- Observe that $x1$ cannot be the sole member of $t$. This entails that
-- the maximum of $t - {x1}$ belongs to $t - {x1}$ and exceeds any
-- element $y$ of $t - {x1}$.
--
        Suppose ==> t = {x1}
            Suppose ==> x1 notin ubs_thryvar(t)
                Use_def(ubs_thryvar) ==> Stat7: x1 notin {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)}
                ()-->Stat7(Stat5) ==> Stat8: not(FORALL y in (t * s0) | smaller_thryvar(y,x1) = y)
                y1-->Stat8(Stat5) ==> Stat9: (y1 = x1) & (not(smaller_thryvar(y1,x1) = y1))
                EQUAL(Stat8) ==> Stat10: not(smaller_thryvar(x1,x1) = x1)
            (x1,x1)-->Tlinear_order_6(Stat5,Stat10) ==> false; Discharge ==> {x1} = (t * ubs_thryvar(t))
            Use_def(max_thryvar) ==> max_thryvar(t) = arb({s0} + (t * ubs_thryvar(t)))
            (Stat6)ELEM ==> Stat11: max_thryvar(t) = arb({s0,x1})
        (Stat11,Stat5)Discharge ==> Stat12: (t - {x1}) /= 0
        c-->Stat12(Stat12) ==> Stat13: c in (t - {x1})
        c-->Stat6(Stat13) ==> Stat14: max_thryvar(t - {x1}) in (t - {x1})
        Use_def(max_thryvar) ==> Stat15: max_thryvar(t - {x1}) = arb({s0} + ((t - {x1}) * ubs_thryvar(t - {x1})))
        (Stat5,Stat14,Stat15)ELEM ==> max_thryvar(t - {x1}) in ubs_thryvar(t - {x1})
        Use_def(ubs_thryvar) ==> Stat16: max_thryvar(t - {x1}) in {x in s0 | (FORALL y in ((t - {x1}) * s0) | smaller_thryvar(y,x) = y)}
        ()-->Stat16(Stat16) ==> Stat17: (FORALL y in ((t - {x1}) * s0) | smaller_thryvar(y,max_thryvar(t - {x1})) = y)
--
-- In view of thrichotomy, we need to consider only two cases:
-- either $arg1_bef_arg2(x1,max_thryvar(t))$ or $arg1_bef_arg2(max_thryvar(t),x1)$.
--
        Assump ==> Stat18: (FORALL x in  s0, y in s0 | arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x))
        (x1,max_thryvar(t - {x1}))-->Stat18(Stat5,Stat14) ==> arg1_bef_arg2(x1,max_thryvar(t - {x1})) or arg1_bef_arg2(max_thryvar(t - {x1}),x1)
        Use_def(max_thryvar) ==> Stat19: max_thryvar(t) = arb({s0} + (t * ubs_thryvar(t)))
--
-- Assuming that $x1$ is smaller than the maximum of $t - {x1}$, we derive
-- that this maximum is also the maximum of $t$, which leads to a contradiction.
--
        Suppose ==> Stat20: arg1_bef_arg2(x1,max_thryvar(t - {x1}))
            Suppose ==> Stat21: not(FORALL y in (t * s0) | smaller_thryvar(y,max_thryvar(t - {x1})) = y)
                y2-->Stat21(Stat21) ==> Stat22: (y2 in (t * s0)) & (smaller_thryvar(y2,max_thryvar(t - {x1})) /= y2)
                Suppose ==> y2 in t - {x1}
                y2-->Stat17(Stat17) ==> false; Discharge ==> y2 = x1
                EQUAL(Stat22) ==> Stat23: smaller_thryvar(x1,max_thryvar(t - {x1})) /= x1
                Use_def(smaller_thryvar) ==> Stat24: smaller_thryvar(x1,max_thryvar(t - {x1})) = if (x1 notin s0) & (max_thryvar(t - {x1}) notin s0) then s0
                        elseif (x1 notin s0) then max_thryvar(t - {x1})
 			elseif (max_thryvar(t - {x1}) notin s0) then x1
       			elseif arg1_bef_arg2(x1,max_thryvar(t - {x1})) then x1 else max_thryvar(t - {x1}) end if
            (Stat24,Stat5,Stat14,Stat20,Stat23)Discharge ==> Stat25: (FORALL y in (t * s0) | smaller_thryvar(y,max_thryvar(t - {x1})) = y)
            Suppose ==> Stat26: max_thryvar(t) /= max_thryvar(t - {x1})
                Suppose ==> Stat27: max_thryvar(t - {x1}) notin (t * ubs_thryvar(t))
                    (Stat27,Stat14)ELEM ==> max_thryvar(t - {x1}) notin ubs_thryvar(t)
                    Use_def(ubs_thryvar) ==> Stat28: max_thryvar(t - {x1}) notin {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)}
                ()-->Stat28(Stat14,Stat5,Stat25) ==> false; Discharge ==> Stat29: max_thryvar(t - {x1}) in (t * ubs_thryvar(t))
                Suppose ==> Stat30: max_thryvar(t) = s0
                    (Stat5,Stat19,Stat30)ELEM ==> max_thryvar(t - {x1}) notin (t * ubs_thryvar(t))
                (Stat29)Discharge ==> max_thryvar(t) /= s0
                (Stat19)ELEM ==> Stat31: max_thryvar(t) in (t * ubs_thryvar(t))
                Use_def(ubs_thryvar) ==> Stat32: max_thryvar(t) in {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)}
                ()-->Stat32(Stat32) ==> Stat33: (FORALL y in (t * s0) | smaller_thryvar(y,max_thryvar(t)) = y)
                (max_thryvar(t - {x1}))-->Stat33(Stat33,Stat14,Stat5) ==> smaller_thryvar(max_thryvar(t - {x1}),max_thryvar(t)) = max_thryvar(t - {x1})
                (max_thryvar(t))-->Stat25(Stat31,Stat5) ==> smaller_thryvar(max_thryvar(t),max_thryvar(t - {x1})) = max_thryvar(t)
            (max_thryvar(t - {x1}),max_thryvar(t))-->Tlinear_order_3(Stat26) ==> false; Discharge ==> Stat34: max_thryvar(t) = max_thryvar(t - {x1})
            EQUAL ==> Stat35: arg1_bef_arg2(x1,max_thryvar(t))
        (Stat34,Stat35,Stat14,Stat5)Discharge ==> Stat36: arg1_bef_arg2(max_thryvar(t - {x1}),x1)
--
-- Hence the maximum of $t - {x1}$ must be smaller than $x1$,
-- and therefore $x1$ turns out to be the maximum of $t$. But this leads to a contradiction too;
-- hence we conclude that the desired statement holds.
--
        Suppose ==> Stat37: not(FORALL y in (t * s0) | smaller_thryvar(y,x1) = y)
            y3-->Stat37(Stat37) ==> Stat38: (y3 in t) & (smaller_thryvar(y3,x1) /= y3)
            (y3,x1)-->Tlinear_order_6(Stat38,Stat5) ==> smaller_thryvar(y3,x1) = x1
            EQUAL(Stat38) ==> x1 /= y3
            Suppose ==> Stat39: y3 in t - {x1}
                y3-->Stat17 ==> Stat40: smaller_thryvar(y3,max_thryvar(t - {x1})) = y3
                Use_def(¥le_thryvar) ==> Stat41: (max_thryvar(t - {x1}) ¥le_thryvar x1)
                Use_def(smaller_thryvar) ==> Stat42: smaller_thryvar(y3,max_thryvar(t - {x1})) = if ((y3 notin s0) & (max_thryvar(t - {x1}) notin s0)) then s0
			elseif (y3 notin s0) then max_thryvar(t - {x1})
			elseif (max_thryvar(t - {x1}) notin s0) then y3 elseif
			arg1_bef_arg2(y3,max_thryvar(t - {x1})) then y3 else max_thryvar(t - {x1}) end if
                (Stat42,Stat39,Stat5,Stat14,Stat40)ELEM ==> arg1_bef_arg2(y3,max_thryvar(t - {x1})) or (y3 = max_thryvar(t - {x1}))
                Use_def(¥le_thryvar) ==> Stat43: (y3 ¥le_thryvar max_thryvar(t - {x1}))
                (y3,max_thryvar(t - {x1}),x1)-->Tlinear_order_1(Stat41,Stat43,Stat39,Stat5,Stat14) ==> (y3 ¥le_thryvar x1)
                Use_def(¥le_thryvar) ==> Stat44: arg1_bef_arg2(y3,x1)
                Use_def(smaller_thryvar) ==> Stat45: smaller_thryvar(y3,x1) = if ((y3 notin s0) & (x1 notin s0)) then s0
			elseif (y3 notin s0) then x1 elseif (x1 notin s0) then y3 elseif
			arg1_bef_arg2(y3,x1) then y3 else x1 end if
            (Stat45,Stat39,Stat5,Stat44,Stat38)Discharge ==> y3 = x1
        (Stat38)Discharge ==> Stat46: (FORALL y in (t * s0) | smaller_thryvar(y,x1) = y)
        Suppose ==> Stat47: max_thryvar(t) /= x1
            Suppose ==> Stat48: x1 notin (t * ubs_thryvar(t))
                (Stat48,Stat5)ELEM ==> x1 notin ubs_thryvar(t)
                Use_def(ubs_thryvar) ==> Stat49: x1 notin {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)}
            ()-->Stat49(Stat5,Stat46) ==> false; Discharge ==> Stat50: x1 in (t * ubs_thryvar(t))
            Suppose ==> Stat51: max_thryvar(t) = s0
                (Stat5,Stat19,Stat51)ELEM ==> x1 notin (t * ubs_thryvar(t))
            (Stat50)Discharge ==> max_thryvar(t) /= s0
            (Stat19)ELEM ==> Stat52: max_thryvar(t) in (t * ubs_thryvar(t))
            Use_def(ubs_thryvar) ==> Stat53: max_thryvar(t) in {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)}
            ()-->Stat32(Stat53) ==> Stat54: (FORALL y in (t * s0) | smaller_thryvar(y,max_thryvar(t)) = y)
            (x1)-->Stat54(Stat54,Stat5) ==> smaller_thryvar(x1,max_thryvar(t)) = x1
            (max_thryvar(t))-->Stat46(Stat52,Stat5) ==> smaller_thryvar(max_thryvar(t),x1) = max_thryvar(t)
        (x1,max_thryvar(t))-->Tlinear_order_3(Stat47) ==> false; Discharge ==> Stat55: max_thryvar(t) = x1
        EQUAL ==> Stat56: arg1_bef_arg2(x1,max_thryvar(t))
    (Stat55,Stat56,Stat5)Discharge ==> QED
--
Def 10036: [strict order comparison in reverse] arg1_aft_arg2(X,Y) := arg1_bef_arg2(Y,X)
--
Theorem linear_order_19: (FORALL x in  s0, y in s0, z in s0 | (arg1_aft_arg2(x,y) & arg1_aft_arg2(y,z)) ¥imp arg1_aft_arg2(x,z)) &
    (FORALL x in s0 | not(arg1_aft_arg2(x,x))) &
    (FORALL x in  s0, y in s0 | arg1_aft_arg2(x,y) or (x = y) or arg1_aft_arg2(y,x)). Proof:
Suppose_not ==> AUTO
	Assump ==> Stat1: (FORALL x in  s0, y in s0, z in s0 | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) ¥imp arg1_bef_arg2(x,z)) &
		Stat2: (FORALL x in s0 | not(arg1_bef_arg2(x,x))) &
		Stat3: (FORALL x in  s0, y in s0 | arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x))
	Suppose ==> Stat4: not(FORALL x in s0, y in s0, z in s0 | (arg1_aft_arg2(x,y) & arg1_aft_arg2(y,z)) ¥imp arg1_aft_arg2(x,z))
		(x1,y1,z1)-->Stat4(Stat4*) ==> (x1 in s0) & (y1 in s0) & (z1 in s0) & arg1_aft_arg2(x1,y1) & arg1_aft_arg2(y1,z1) & (not arg1_aft_arg2(x1,z1))
		Use_def(arg1_aft_arg2)(Stat4*) ==> arg1_bef_arg2(y1,x1) & arg1_bef_arg2(z1,y1) & (not arg1_bef_arg2(z1,x1))
	(z1,y1,x1)-->Stat1(Stat4*) ==> false; Discharge ==> (FORALL x in  s0, y in s0, z in s0 | (arg1_aft_arg2(x,y) & arg1_aft_arg2(y,z)) ¥imp arg1_aft_arg2(x,z))
	Suppose ==> Stat5: not(FORALL x in s0 | not(arg1_aft_arg2(x,x)))
		x2-->Stat5(Stat5*) ==> (x2 in s0) & arg1_aft_arg2(x2,x2)
		Use_def(arg1_aft_arg2)(Stat5*) ==> arg1_bef_arg2(x2,x2)
	x2-->Stat2(Stat5*) ==> false; Discharge ==> Stat6: not(FORALL x in  s0, y in s0 | arg1_aft_arg2(x,y) or (x = y) or arg1_aft_arg2(y,x))
	(x3,y3)-->Stat6(Stat6*) ==> (x3 in s0) & (y3 in s0) & (not(arg1_aft_arg2(x3,y3) or (x3 = y3) or arg1_aft_arg2(y3,x3)))
	Use_def(arg1_aft_arg2)(Stat6*) ==> (not(arg1_bef_arg2(y3,x3) or (x3 = y3) or arg1_bef_arg2(x3,y3)))
(y3,x3)-->Stat3(Stat6*) ==> false; Discharge ==> QED
--
APPLY(¥le_thryvar:¥ge_thryvar,smaller_thryvar:larger_thryvar,min_over_thryvar:max_over_thryvar,ubs_thryvar:lbs_thryvar,max_thryvar:min_thryvar,lub_thryvar:glb_thryvar) linear_order(s0->s0, arg1_bef_arg2(X,Y)->arg1_aft_arg2(X,Y)) ==>
Theorem linear_order_20: --? (FORALL x, y | (x ¥ge_thryvar y) ¥eq (arg1_aft_arg2(x,y) or (x = y))) &
	(FORALL x, y | larger_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_aft_arg2(x,y) then x else y end if) &
	(FORALL x, y | larger_thryvar(x,y) = larger_thryvar(y,x)) &
	(FORALL x, y | ({x,y} ¥incin s0) ¥imp (larger_thryvar(x,y) in {x,y})) &
	(FORALL x | (x in next(s0)) ¥imp (larger_thryvar(x,s0) = x)) &
	(FORALL x, y, z | larger_thryvar(x,larger_thryvar(y,z)) = larger_thryvar(larger_thryvar(x,y),z)) &
	(FORALL x, y | ((x in next(s0)) & (y in next(s0))) ¥imp (larger_thryvar(x,y) in next(s0))) &
	(FORALL f,p,a | (Svm(f) & (range(f) ¥incin s0) & Finite(f)) ¥imp
		(((p in f) ¥imp (max_over_thryvar({p}) = (f~[car(p)]))) &
		(max_over_thryvar(f) = larger_thryvar(max_over_thryvar(f ¥ON (domain(f) * a)),max_over_thryvar(f ¥ON (domain(f) - a)))))) &
	(FORALL f | (Svm(f) & (range(f) ¥incin s0) & Finite(f) & (f /= 0)) ¥imp (max_over_thryvar(f) in range(f))) &
	(FORALL x, y | ({x,y} ¥incin s0) ¥imp ((larger_thryvar(x,y) = x) ¥eq (arg1_aft_arg2(x,y) or (x = y)))) &
	(FORALL t | lbs_thryvar(t) = {x in s0 | (FORALL y in (t * s0) | larger_thryvar(y,x) = y)}) &
	(FORALL t | min_thryvar(t) = arb({s0} + (t * lbs_thryvar(t)))) &
	(FORALL t | glb_thryvar(t) = arb({s0} + {x in lbs_thryvar(t) | lbs_thryvar(t) ¥incin lbs_thryvar({x})})) &
	(lbs_thryvar(0) = s0) & (min_thryvar(0) = s0) &
	(FORALL t | (lbs_thryvar(t) ¥incin s0) & (lbs_thryvar(t) = lbs_thryvar(t * s0)) & (min_thryvar(t) = min_thryvar(t * s0))) &
	(FORALL t, x | (Finite(t) & (x in t) & (t ¥incin s0)) ¥imp ((min_thryvar(t) in t) & ((x = min_thryvar(t)) or (arg1_aft_arg2(x,min_thryvar(t))))))
--
ENTER_THEORY Set_theory
--
--DISPLAY linear_order
--
--THEORY linear_order(s0,arg1_bef_arg2(X,Y))
--    (FORALL x in s0, y in s0, z in s0 | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) ¥imp arg1_bef_arg2(x,z))
--    (FORALL x in s0 | not(arg1_bef_arg2(x,x)))
--    (FORALL x in s0, y in s0 | arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x))
--==>(le_thryvar,smaller_thryvar,ubs_thryvar,max_thryvar,lub_thryvar)
--    (FORALL x, y | ((x ¥le_thryvar y) ¥eq (arg1_bef_arg2(x,y)) or (x = y)))
--    (FORALL x, y | smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if)
--    (FORALL u, v, w | (({u,v,w} ¥incin s0) & (u ¥le_thryvar v) & (v ¥le_thryvar w)) ¥imp (u ¥le_thryvar w))
--    (FORALL u, v | (({u,v} ¥incin s0) & (u ¥le_thryvar v) & (v ¥le_thryvar u)) ¥imp (u = v))
--    (FORALL u, v | ({u,v} ¥incin s0) ¥imp ((u ¥le_thryvar v) or (v ¥le_thryvar u)))
--    (FORALL u, v, w | ({u,v,w} ¥incin s0) ¥imp (((u ¥le_thryvar v) & (u ¥le_thryvar w)) or ((v ¥le_thryvar u) & (v ¥le_thryvar w)) or ((w ¥le_thryvar u) & (w ¥le_thryvar v))))
--    (FORALL x, y | smaller_thryvar(x,y) = smaller_thryvar(y,x))
--    (FORALL x | (smaller_thryvar(x,s0) = s0) & (smaller_thryvar(s0,x) = s0))
--    (FORALL x, y | ({x,y} ¥incin s0) ¥imp (smaller_thryvar(x,y) in {x,y}))
--    (FORALL x, y | (({x,y} ¥incin s0) & (arg1_bef_arg2(x,y) or (x = y))) ¥imp ((smaller_thryvar(x,y) = x) & (smaller_thryvar(y,x) = x)))
--    (FORALL x, y | ({x,y} ¥incin s0) ¥imp ((smaller_thryvar(x,y) = x) ¥eq (arg1_bef_arg2(x,y) or (x = y))))
--    (FORALL x, y, z | smaller_thryvar(x,smaller_thryvar(y,z)) = smaller_thryvar(smaller_thryvar(x,y),z))
--    (FORALL x in (s0 + {s0}), y in (s0 + {s0}) | smaller_thryvar(x,y) in (s0 + {s0}))
--    (FORALL t | ubs_thryvar(t) = {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)})
--    (FORALL t | max_thryvar(t) = arb({s0} + (t * ubs_thryvar(t))))
--    (FORALL t | lub_thryvar(t) = arb({s0} + {x in ubs_thryvar(t) | ubs_thryvar(t) ¥incin ubs_thryvar({x})}))
--    (ubs_thryvar(0) = s0) & (max_thryvar(0) = s0)
--    (FORALL t | (ubs_thryvar(t) ¥incin s0) & (ubs_thryvar(t) = ubs_thryvar(t * s0)) & (max_thryvar(t) = max_thryvar(t * s0)))
--    (FORALL t, x | (Finite(t) & (x in t) & (t ¥incin s0)) ¥imp ((max_thryvar(t) in t) & ((x = max_thryvar(t)) or (arg1_bef_arg2(x,max_thryvar(t))))))
--END linear_order
-- ************************************************************************************************
--							Section 12: Various other inductive principles
-- ************************************************************************************************
--
-- For subsequent use, we reformulate a few special cases of the principle of transfinite definition as THEORYs
-- that can be applied internally within the proofs of theorems.
--
THEORY transfinite_definition_0_params(g(x),h1(x))
END transfinite_definition_0_params;
--
ENTER_THEORY transfinite_definition_0_params
--
Def transfinite_definition_0_params.0a: [Function defined by a 1-parameter transfinite recursion] f_thryvar(X) := g({h1(f_thryvar(t)): t in X})
--
Theorem transfinite_definition_0_params1: [One-parameter transfinite recursive function definition] f_thryvar(X) = g({h1(f_thryvar(t)): t in X}). Proof:
	Suppose_not(x) ==> f_thryvar(x) /= g({h1(f_thryvar(t)): t in x})
	Use_def(f_thryvar) ==> f_thryvar(x) = g({h1(f_thryvar(t)): t in x})
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY transfinite_definition_0_params
--
--THEORY transfinite_definition_0_params(g(x),h1(x))
--==>(f_thryvar)
--	(FORALL x | f_thryvar(x) = g({h1(f_thryvar(t)): t in x}))
--END transfinite_definition_0_params;
--
THEORY transfinite_definition_1_params(g2(x,a),h(x,a))
END transfinite_definition_1_params;
--
ENTER_THEORY transfinite_definition_1_params
--
Def transfinite_definition_1_params.0a: [Function defined by a transfinite recursion with supplementary parameter] f2_thryvar(X,A) := g2({h(f2_thryvar(t,A),A): t in X},A)
--
Theorem transfinite_definition_1_params1: [Recursive transfinite function definition with auxilliary parameter] f2_thryvar(X,A) = g2({h(f2_thryvar(t,A),A): t in X},A). Proof:
	Suppose_not(x,a) ==> f2_thryvar(x,a) /= g2({h(f2_thryvar(t,a),a): t in x},a)
	Use_def(f2_thryvar) ==> f2_thryvar(x,a) = g2({h(f2_thryvar(t,a),a): t in x},a)
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY transfinite_definition_1_params
--
--THEORY transfinite_definition_1_params(g2(x,a),h(x,a))
--==>(f2_thryvar)
--	(FORALL x,a | f2_thryvar(x,a) = g2({h(f2_thryvar(t),a): t in x},a))
--END transfinite_definition_1_params;
--
--
-- Our next proof establishes a first, purely set-theoretic form of the well-known Zorn's Lemma.
-- We prove that if $t$ is any collection of sets such that every subfamily of $t$
-- linearly ordered by inclusion admits an upper bound in $t$, then $t$ has an element maximal for inclusion,
-- i.e. not properly included in any other element of $t$.
--
Theorem 412: [Zorn's lemma] (FORALL x ¥incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp (EXISTS w in T | (FORALL y in x | w incs y))))
		 ¥imp (EXISTS y in T | (FORALL x in T | not ((x incs y) & (x /= y)))). Proof:
	Suppose_not(t) ==> Stat1: (FORALL x ¥incin t | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp (EXISTS w in t | (FORALL y in x | w incs y))))
			& Stat2: (not (EXISTS y in t | (FORALL x in t | not ((x incs y) & (x /= y)))))
--
-- For supposing the contrary, we can define a mapping of $t$ into $t$ which sends each element of $t$ into a strictly larger element,
-- and also a mapping of every subset of $t$ linearly ordered by inclusion into an upper bound for it in $t$.
--
	Loc_def ==> larger = {[x,arb({y in t | ((y incs x) & (y /= x))})]: x in t}
	APPLY() fcn_symbol(f(x)->arb({y in t | ((y incs x) & (y /= x))}),g->larger,s->t) ==>
		Svm(larger) & Stat3: (FORALL x | larger~[x] = if x in t then arb({y in t | ((y incs x) & (y /= x))}) else 0 end if)
	Loc_def ==> upper_bound = {[x,arb({y in t | (FORALL u in x | y incs u)})]: x in pow(t)}
	APPLY() fcn_symbol(f(x)->arb({y in t | (FORALL u in x | y incs u)}),g->upper_bound,s->pow(t)) ==>
		Svm(upper_bound) & Stat4: (FORALL x | upper_bound~[x] = if x in pow(t) then arb({y in t | (FORALL u in x | y incs u)}) else 0 end if)
	Loc_def ==> s = Un(t)
--
-- Now we use the functions 'upper_bound' and 'larger' to introduce the following (recursively defined) function,
-- which we will then show maps each ordinal into $t$, and is strictly monotone increasing.
--
	APPLY(f_thryvar:Zo) transfinite_definition_0_params(g(x)->larger~[upper_bound~[x]],h1(x)->x) ==>
		Stat5: (FORALL x | Zo(x) = larger~[upper_bound~[{Zo(y): y in x}]])
	Suppose ==> Stat6: (EXISTS x | Ord(x) & (Zo(x) notin t or (EXISTS u in x | not((Zo(x) incs Zo(u)) & (Zo(x) /= Zo(u))))))
--
-- For if there exists some counterexample to this last assertion, then by transfinite induction
-- there exists a smallest such counterexample $c$.
--
	d-->Stat6 ==>                                      Ord(d) & ((Zo(d) notin t) or (EXISTS u in d | not((Zo(d) incs Zo(u)) & (Zo(d) /= Zo(u)))))
	APPLY(mt1_thryvar:c) transfinite_induction(n->d,P(x)->(Ord(x) & ((Zo(x) notin t) or (EXISTS u in x | not((Zo(x) incs Zo(u)) & (Zo(x) /= Zo(u))))))) ==>
	       Stat7: (FORALL x      |                     (Ord(c) & ((Zo(c) notin t) or (EXISTS u in c | not((Zo(c) incs Zo(u)) & (Zo(c) /= Zo(u)))))) &
		                      ((x in c) ¥imp    (not(Ord(x) & ((Zo(x) notin t) or (EXISTS u in x | not((Zo(x) incs Zo(u)) & (Zo(x) /= Zo(u)))))))))
	0-->Stat7 ==> (Ord(c) & ((Zo(c) notin t) or (EXISTS u in c | not((Zo(c) incs Zo(u)) & (Zo(c) /= Zo(u))))))
        Suppose ==> Stat8: not(FORALL x in c | not (Ord(x) & ((Zo(x) notin t) or (EXISTS u in x | not((Zo(x) incs Zo(u)) & (Zo(x) /= Zo(u)))))))
            x0-->Stat8 ==> (x0 in c) & Ord(x0) & ((Zo(x0) notin t) or (EXISTS u in x0 | not((Zo(x0) incs Zo(u)) & (Zo(x0) /= Zo(u)))))
	x0-->Stat7 ==> false; Discharge ==> Stat9: (FORALL x in c | not (Ord(x) & ((Zo(x) notin t) or (EXISTS u in x | not((Zo(x) incs Zo(u)) & (Zo(x) /= Zo(u)))))))
--
-- For this minimal counterexample $c$, the set ${Zo(y): y in c}$ must be a collection of subsets of $t$
-- and must be linearly ordered by inclusion.
--
	Suppose ==> Stat10: not (t incs {Zo(y): y in c})
	x1-->Stat10 ==> Stat11: (x1 in {Zo(y): y in c}) & (x1 notin t)
	y1-->Stat11 ==> (y1 in c) & (x1 = Zo(y1))
	y1-->Stat9 ==> not(Ord(y1) & (Zo(y1) notin t))
	(c,y1)-->T12 ==> Ord(y1)
	(Stat11)Discharge ==> t incs {Zo(y): y in c}
	Suppose ==> Stat12: not(FORALL u in {Zo(y): y in c},v in {Zo(y): y in c} | (u incs v or v incs u))
	(a,b)-->Stat12 ==> Stat13: (a in {Zo(y): y in c}) & (b in {Zo(y): y in c}) & (not(a incs b or b incs a))
	(o1,o2)-->Stat13 ==> Stat14: (o1 in c) & (o2 in c) & (not (Zo(o1) incs Zo(o2) or Zo(o2) incs Zo(o1)))
	(c,o1)-->T12 ==> Ord(o1)
	(c,o2)-->T12 ==> Ord(o2)
	o1-->Stat9 ==> Stat15: not(EXISTS u in o1 | not((Zo(o1) incs Zo(u)) & (Zo(o1) /= Zo(u))))
	o2-->Stat9 ==> Stat16: not(EXISTS u in o2 | not((Zo(o2) incs Zo(u)) & (Zo(o2) /= Zo(u))))
	(o1,o2)-->T31 ==> o1 in o2 or o2 in o1 or o1 = o2
	Suppose ==> o1 = o2
	EQUAL ==> Zo(o1) = Zo(o2)
	(Stat14)Discharge ==> o1 in o2 or o2 in o1
	Suppose ==> o2 in o1
	o2-->Stat15 ==> false; Discharge ==> o1 in o2
	o1-->Stat16 ==> false; Discharge ==> (FORALL u in {Zo(y): y in c},v in {Zo(y): y in c} | (u incs v or v incs u))
--
-- Thus, by definition, ${Zo(y): y in c}$ must have an upper bound $cb$ which is a subset of $t$, and therefore
-- by the axiom of choice $upper_bound~[{Zo(z1): z1 in c}]$ must belong to $t$ and include every element of ${Zo(y): y in c}$.
--
	({Zo(z1): z1 in c})-->Stat1 ==> Stat17: (EXISTS w in t | (FORALL y in {Zo(z1): z1 in c} | w incs y))
	cb-->Stat17 ==>(cb in t) & (FORALL y in {Zo(z1): z1 in c} | cb incs y)
	({Zo(z1): z1 in c})-->Stat4 ==> upper_bound~[{Zo(z1): z1 in c}] =
			if {Zo(z1): z1 in c} in pow(t) then arb({y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)}) else 0 end if
	Suppose ==> {Zo(z1): z1 in c} notin pow(t)
	Use_def(pow) ==> Stat18: {Zo(z1): z1 in c} notin {x: x ¥incin t}
	({Zo(z1): z1 in c})-->Stat18 ==> false; Discharge ==>
			upper_bound~[{Zo(z1): z1 in c}] = arb({y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)})
	Suppose ==> Stat19: {y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)} = 0
	cb-->Stat19 ==> false; Discharge ==> {y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)} /= 0
	({y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)})-->T0 ==>
		arb({y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)}) in {y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)}
	(Stat17)ELEM ==> Stat20: upper_bound~[{Zo(z1): z1 in c}] in {y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)}
	()-->Stat20 ==> (upper_bound~[{Zo(z1): z1 in c}] in t) &
					Stat21: (FORALL u in {Zo(z1): z1 in c} | upper_bound~[{Zo(z1): z1 in c}] incs u)
--
-- It follows by a second use of the axiom of choice that $larger~[upper_bound~[{Zo(z1): z1 in c}]] = Zo(c)$ is an element of $t$
-- properly including every element of ${Zo(y): y in c}$. This refutes our earlier supposition, and so
-- lets us conclude that $Zo$ sends ordinals into $t$ and is strictly monotone increasing.
--
	(upper_bound~[{Zo(z1): z1 in c}])-->Stat3 ==> larger~[upper_bound~[{Zo(z1): z1 in c}]] = arb({y in t |
						((y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}]))})
	(upper_bound~[{Zo(z1): z1 in c}])-->Stat2 ==> Stat22: not (FORALL x in t |
						not ((x incs upper_bound~[{Zo(z1): z1 in c}]) & (x /= upper_bound~[{Zo(z1): z1 in c}])))
	cu-->Stat22 ==> (cu in t) & (cu incs upper_bound~[{Zo(z1): z1 in c}]) & (cu /= upper_bound~[{Zo(z1): z1 in c}])
	Suppose ==> Stat23: {y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])} = 0
	cu-->Stat23 ==> false; Discharge ==> {y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])} /= 0
	({y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])})-->T0 ==>
		arb({y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])}) in
			{y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])}
	(Stat20)ELEM ==> larger~[upper_bound~[{Zo(z1): z1 in c}]] in {y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])}
	c-->Stat5 ==> Stat24: Zo(c) in {y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])}
	()-->Stat24 ==> (Zo(c) in t) &  (Zo(c) incs upper_bound~[{Zo(z1): z1 in c}]) & (Zo(c) /= upper_bound~[{Zo(z1): z1 in c}])
	ELEM ==> Stat25: (EXISTS u in c | not((Zo(c) incs Zo(u)) & (Zo(c) /= Zo(u))))
	cv-->Stat25 ==> (cv in c) & (not((Zo(c) incs Zo(cv)) & (Zo(c) /= Zo(cv))))
	(Stat22)ELEM ==> not(upper_bound~[{Zo(z1): z1 in c}] incs Zo(cv))
	(Zo(cv))-->Stat21 ==> Stat26: Zo(cv) notin {Zo(z1): z1 in c}
	cv-->Stat26 ==> false; Discharge ==>
			Stat27: not(EXISTS x | Ord(x) & (Zo(x) notin t or (EXISTS u in x | not((Zo(x) incs Zo(u)) & (Zo(x) /= Zo(u))))))
--
-- Thus $Zo$ is a 1-1 map of all ordinals into the set $t$, a thing impossible.
-- The easiest way of seeing this is to consider the restriction of $Zo$ to an ordinal
-- greater than the cardinality of $t$, for example to $#pow(t)$; this can certainly have no
-- 1-1 map into $t$, giving a contradiction which proves our assertion.
--
	t-->T265 ==> #t in #pow(t)
	t-->T147 ==> Ord(#t)
	(pow(t))-->T147 ==> Ord(#pow(t))
	APPLY(x9_thryvar:o3,y9_thryvar:o4) fcn_symbol(g->{[x,Zo(x)]: x in #pow(t)},f(x)->Zo(x),s->#pow(t)) ==>
	 	(domain({[x,Zo(x)]: x in #pow(t)}) = #pow(t)) & (range({[x,Zo(x)]: x in #pow(t)}) = {Zo(x): x in #pow(t)}) &
	 	(((o3 in #pow(t)) & (o4 in #pow(t)) & (Zo(o3) = Zo(o4)) & (o3 /= o4)) or one_1_map({[x,Zo(x)]: x in #pow(t)}))
	Suppose ==> not one_1_map({[x,Zo(x)]: x in #pow(t)})
	ELEM ==> (o3 in #pow(t)) & (o4 in #pow(t)) & (Zo(o3) = Zo(o4)) & (o3 /= o4)
	(#pow(t),o3)-->T12 ==> Ord(o3)
	(#pow(t),o4)-->T12 ==> Ord(o4)
	(o3,o4)-->T31 ==> o3 in o4 or o4 in o3
	Suppose ==> o3 in o4
	o4-->Stat27 ==> Stat28: not (EXISTS u in o4 | not((Zo(o4) incs Zo(u)) & (Zo(o4) /= Zo(u))))
	o3-->Stat28 ==> false; Discharge ==> o4 in o3
	o3-->Stat27 ==> Stat29: not (EXISTS u in o3 | not((Zo(o3) incs Zo(u)) & (Zo(o3) /= Zo(u))))
	o4-->Stat29 ==> false; Discharge ==> one_1_map({[x,Zo(x)]: x in #pow(t)})
	Suppose ==> not (t incs range({[x,Zo(x)]: x in #pow(t)}))
	ELEM ==> Stat30: not (t incs {Zo(x): x in #pow(t)})
	e-->Stat30 ==> Stat31: (e in {Zo(x): x in #pow(t)}) & (e notin t)
	e2-->Stat31 ==> (e2 in #pow(t)) & (e = Zo(e2))
	(#pow(t),e2)-->T12 ==> Ord(e2)
	e2-->Stat27 ==> false; Discharge ==> t incs range({[x,Zo(x)]: x in #pow(t)})
	(range({[x,Zo(x)]: x in #pow(t)}),t)-->T170 ==> #t incs #range({[x,Zo(x)]: x in #pow(t)})
	({[x,Zo(x)]: x in #pow(t)})-->T157 ==> #t incs #domain({[x,Zo(x)]: x in #pow(t)})
    EQUAL ==> #t incs ##pow(t)
    (pow(t))-->T166 ==> false; Discharge ==> QED
--
--
-- The following corollary of the preceding theorem shows that if $s$ is any member of a family $t$ of sets
-- sets satisfying the hypotheses of that theorem, then $s$ is contained in an element of $t$ maximal in $t$.
--
Theorem 413: [Zorn's lemma generalized form] (FORALL x ¥incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp (EXISTS w in T | (FORALL y in x | w incs y))))
		 ¥imp (FORALL u in T | (EXISTS y in T | (y incs u) & (FORALL x in T | not ((x incs y) & (x /= y))))). Proof:
	Suppose_not(t) ==> Stat1: (FORALL x ¥incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp
				(EXISTS w in T | (FORALL y in x | w incs y)))) &
						Stat2: (not (FORALL u in t | (EXISTS y in t | (y incs u) & (FORALL x in t | not ((x incs y) & (x /= y))))))
--
-- For suppose that $u in t$ contradicts the conclusion of our theorem, and consider the subset $tt$ of all elements of $t$
-- which contain $u$. It is clear that every collection of subsets of $tt$ linearly ordered by inclusion has an upper bound in $tt$,
-- and so by the preceding theorem $tt$ contains an element $ma$ maximal for inclusions among all the sets in $tt$.
--
	u-->Stat2 ==> (u in t) & Stat3: (not (EXISTS y in t | (y incs u) & (FORALL x in t | not ((x incs y) & (x /= y)))))
	Loc_def ==> tt = {x in t | x incs u}
	Suppose ==> Stat4: not(t incs tt)
	c-->Stat4 ==> (c notin t) & Stat5: (c in {x in t | x incs u})
	()-->Stat5 ==> false; Discharge ==> t incs tt
	Suppose ==> Stat6: not(FORALL x ¥incin tt | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp (EXISTS w in tt | (FORALL y in x | w incs y))))
	d-->Stat6 ==> (d ¥incin tt) & (FORALL u in d,v in d | (u incs v or v incs u)) & Stat7: (not(EXISTS w in tt | (FORALL y in d | w incs y)))
	d-->Stat1 ==> Stat8: (EXISTS w in t | (FORALL y in d | w incs y))
	wd-->Stat8 ==> (wd in t) & Stat9: (FORALL y in d | wd incs y)
--
-- Since $u in tt$, $d$ cannot be null, from which it is easily seen that $wd$ must contain $u$, and so $wd in tt$,
-- Thu it follows by The0rem 332a that $tt$ has an element $wa$ maximal (for inclusion) in
--
	Suppose ==> u notin tt
	ELEM ==> Stat10: u notin {x in t | x incs u}
	()-->Stat10 ==> false; Discharge ==> u in tt
	Suppose ==> d = 0
	u-->Stat7 ==> Stat11: not (FORALL y in d | u incs y)
	a-->Stat11 ==> false; Discharge ==> Stat12: d /= 0
	b-->Stat12 ==> b in d
	b-->Stat9 ==> wd incs b
	ELEM ==> Stat13: b in {x in t | x incs u}
	()-->Stat13 ==> wd incs u
	Suppose ==> wd notin tt
	ELEM ==> Stat14: wd notin {x in t | x incs u}
	()-->Stat14 ==> false; Discharge ==> wd in tt
	wd-->Stat7 ==> false; Discharge ==>
		(FORALL x ¥incin tt | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp (EXISTS w in tt | (FORALL y in x | w incs y))))
	tt-->T412 ==> Stat15: (EXISTS y in tt | (FORALL x in tt | not ((x incs y) & (x /= y))))
	ma-->Stat15 ==> (ma in tt) & Stat16: (FORALL x in tt | not ((x incs ma) & (x /= ma)))
--
-- But it is easily seen that $ma$ is maximal in the whole collection $t$, and so our theorem is proved.
--
	ma-->Stat3 ==> not ((ma incs u) & (FORALL x in t | not ((x incs ma) & (x /= ma))))
	ELEM ==> Stat17: ma in {x in t | x incs u}
	()-->Stat17 ==> ma incs u
	ELEM ==> Stat18: not (FORALL x in t | not ((x incs ma) & (x /= ma)))
	e-->Stat18 ==> (e in t) & (e incs ma) & (e /= ma)
	ELEM ==> e incs u
	Suppose ==> e notin tt
	ELEM ==> Stat19: e notin {x in t | x incs u}
	()-->Stat19 ==> false; Discharge ==> e in tt
    e-->Stat16 ==> false; Discharge ==> QED
--
-- Next we note a special case common in applications of Theorem 413, namely that in which the union of any
-- linearly ordered collection of elements of $t$ is a subset of $t$.
--
Theorem 414: [Zorn's lemma for union-closed collections] (FORALL x ¥incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp (Un(x) in T)))
		 ¥imp (FORALL u in T | (EXISTS y in T | (y incs u) & (FORALL x in T | not ((x incs y) & (x /= y))))). Proof:
	Suppose_not(t) ==> Stat1: (FORALL x ¥incin t | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp (Un(x) in t))) &
 			(not (FORALL u in t | (EXISTS y in t | (y incs u) & (FORALL x in t | not ((x incs y) & (x /= y))))))
--
-- For given any subcollection of $t$ linearly ordered by inclusion, $Un(t)$ plainly includes all the sets in $t$,
-- and so our present assertion follows immediately from the preceding theorem.
--
	T413 ==> Stat2: not (FORALL x ¥incin t | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp (EXISTS w in t | (FORALL y in x | w incs y))))
	a-->Stat2 ==> (a ¥incin t) & (FORALL u in a,v in a | (u incs v or v incs u)) & Stat3: (not (EXISTS w in t | (FORALL y in a | w incs y)))
	a-->Stat1 ==> Un(a) in t
	(Un(a))-->Stat3 ==> Stat4: not(FORALL y in a | Un(a) incs y)
	b-->Stat4 ==> (b in a) & Stat5: (not(Un(a) incs b))
	c-->Stat5 ==> (c in b) & (c notin Un(a))
	Use_def(Un) ==> Stat6: c notin {y: x in a,y in x}
	(b,c)-->Stat6 ==> false; Discharge ==> QED
--
-- We shall now show how Theorem 414 can be used to construct a so-called 'ultrafilter' containing any given
-- set theoretic 'filter'. The definitions involved are as follows. A collection $t$ of subsets of a set $s$
-- is called a 'filter' in $s$ if (a) $0 notin t$; (b) $t$  any superset of any member of $t$ belongs to $t$;
-- (c) any  intersection of two elements of $t$ belongs to $t$. A filter in $s$ is called an 'ultrafilter' in $s$
-- if for any subset $u$ of $s$, either $u$ or $s - u$ belongs to $t$. The formal definitions are as follows:
--
Def 332a: [The predicate '$T$ is a filter on the set $S$] Filter(T,S) := (T ¥incin pow(S)) & (0 notin T) & (FORALL x in T, y in T | x * y in T) & (FORALL x in T, y ¥incin S | ((y incs x) ¥imp (y in T)))
Def 332b: [The predicate '$T$ is an ultrafilter on the set $S$] Ultrafilter(T,S) := Filter(T,S) & (FORALL y ¥incin S | (y in T or S - y in T))
--
--
-- It is easily seen that the union $Un(C)$ of any linearly ordered collection $C$ of filters in a set $S$ is also a filter in $S$.
-- Indeed, (a) since $0$ is not in any element of $C$ it is not in $Un(C)$; (b) If $x$ is a superset of an element $y$ of $Un(C)$,
-- then since $y$ must belong to some member $t$ of $C$, $x$ must also belong to $t$ and hence to $Un(C)$;
-- (c) given any two elements $A$ and $B$ of $Un(C)$, $A$ (resp. $B$) must belong to some element (i.e. filter) $FA$ (resp. $FB$) of $C$,
-- But then, since the elements of $C$ are linearly ordered by inclusion, one of the two filters $FA$ and $FB$, say $FA$, but included the other.
-- Hence $A$ and $B$ are both members of $FA$
--
-- It follows using Theorem 414 that every filter is contained in a maximal filter. But it is easily seen that a filter $t$ in $s$ is maximal
-- (among all filters in $s$) if and only if it is an ultrafilter in $s$. For if $t$ is an ultrafilter it cannot be enlarged
-- by adding any subset $x$ of $s$ not already in $t$, since $s - x$ must already belong to $t$, and thus addition of
-- $x$ would force $x * (s - x)$ = $0$ to belong to the resulting filter, which is impossible by definition of a filter.
-- Conversely, if neither $x$ nor $s - x$ belong to $t$ we can extend $t$ to the larger filter $tp$ consisting of all subsets of $s$
-- which include a set of the form $f * x$, where $f$ belongs to $t$. Indeed, it is clear that the family $tp$ of sets defined
-- in this way is closed under intersection, and that it includes any superset o any of its sets. Hence to show that $tp$ is a filter
-- we have only to show that no set of the form $f * x$ can be null. But if $f * x$ were null, we would have $(s - x) incs f$, so
-- $(s - x)$ would be a member of $t$, contrary to assumption.
--
-- The formal versions of the preceding informal arguments are as follows.
--
Theorem 415: ((FORALL t in TP | Filter(t,S)) & (FORALL u in TP, v in TP | (u incs v or v incs u))) ¥imp  Filter(Un(TP),S). Proof:
	Suppose_not(tp,s) ==> Stat1: (FORALL t in tp | Filter(t,s)) & Stat2: (FORALL u in tp, v in tp | (u incs v or v incs u)) &
							(not Filter(Un(tp),s))
	Use_def(Filter) ==> not ((Un(tp) ¥incin pow(s)) & (0 notin Un(tp)) & (FORALL x in Un(tp), y in Un(tp) | x * y in Un(tp)) &
							(FORALL x in Un(tp), y ¥incin s | ((y incs x) ¥imp (y in Un(tp)))))
	Suppose ==> Stat3: not (Un(tp) ¥incin pow(s))
	a-->Stat3 ==> (a in Un(tp)) & (a notin pow(s))
	Use_def(Un) ==> Stat4: a in {x: y in tp, x in y}
	Use_def(pow) ==> a notin {x: x ¥incin s}
	(b,c)-->Stat4 ==> (b in tp) & (c in b) & (a = c)
	b-->Stat1 ==> Filter(b,s)
	Use_def(Filter) ==> b ¥incin pow(s)
	Discharge ==> Un(tp) ¥incin pow(s)
	Suppose ==> 0 in Un(tp)
	Use_def(Un) ==> Stat5: 0 in {x: y in tp, x in y}
	(b2,c2)-->Stat5 ==> (b2 in tp) & (0 in b2)
	b2-->Stat1 ==> Filter(b2,s)
	Use_def(Filter) ==> false; Discharge ==> 0 notin Un(tp)
	Suppose ==> Stat6: not (FORALL x in Un(tp), y ¥incin s | ((y incs x) ¥imp (y in Un(tp))))
	(b3,c3)-->Stat6 ==> (b3 in Un(tp)) & (c3 ¥incin s) & (c3 incs b3) & (c3 notin Un(tp))
	Use_def(Un) ==> Stat7: b3 in {x: y in tp, x in y}
	(b4,c4)-->Stat7 ==> (b4 in tp) & (b3 in b4)
	b4-->Stat1 ==> Filter(b4,s)
	Use_def(Filter) ==> Stat8: (FORALL x in b4, y ¥incin s | ((y incs x) ¥imp (y in b4)))
	(b3,c3)-->Stat8 ==> c3 in b4
	Use_def(Un) ==> Stat9: c3 notin {x: y in tp, x in y}
	(b4,c3)-->Stat9 ==> false; Discharge ==> Stat10: not (FORALL x in Un(tp), y in Un(tp) | x * y in Un(tp))
--
-- Thus only the third clause in the definition of 'Filter' could be false for $tp$.
-- But since the elements of $tp$ are linearly ordered by inclusion it is
-- easily seen that this clause must also be true, so $tp$ must be a filter, as asserted.
--
 	(a2,a3)-->Stat10 ==> (a2 in Un(tp)) & (a3 in Un(tp)) & (a2 * a3 notin Un(tp))
 	Use_def(Un) ==> Stat11: (a2 in {x: y in tp, x in y}) & (a3 in {x: y in tp, x in y})
 	(b5,c5,b6,c6)-->Stat11 ==> (b5 in tp) & (a2 in b5) & (b6 in tp) & (a3 in b6)
 	(b5,b6)-->Stat2 ==> b5 incs b6 or b6 incs b5
 	Suppose ==> b5 incs b6
 	ELEM ==> a3 in b5
 	b5-->Stat1 ==> Filter(b5,s)
 	Use_def(Filter) ==> Stat12: (FORALL x in b5, y in b5 | x * y in b5)
 	(a2,a3)-->Stat12 ==> a2 * a3 in b5
 	Use_def(Un) ==> Stat13: a2 * a3 notin {x: y in tp, x in y}
 	(b5,a2 * a3)-->Stat13 ==> false; Discharge ==> b6 incs b5
 	ELEM ==> a2 in b6
 	b6-->Stat1 ==> Filter(b6,s)
 	Use_def(Filter) ==> Stat14: (FORALL x in b6, y in b6 | x * y in b6)
 	(a2,a3)-->Stat14 ==> a2 * a3 in b6
 	Use_def(Un) ==> Stat15: a2 * a3 notin {x: y in tp, x in y}
 	(b6,a2 * a3)-->Stat15 ==> false; Discharge ==> QED
--
-- Next we prove the lemma, anticipated above, that a filter is maximal if and only if it is an ultrafilter.
--
Theorem 416: (S /= 0) ¥imp ((Filter(T,S) & (FORALL x ¥incin pow(S) | ((x incs T) & Filter(x,S)) ¥imp (x = T))) ¥eq Ultrafilter(T,S)). Proof:
	Suppose_not(s,t) ==> (s /= 0) & (not((Filter(t,s) & (FORALL x ¥incin pow(s) | ((x incs t) & Filter(x,s)) ¥imp (x = t))) ¥eq Ultrafilter(t,s)))
--
-- For it is easily seen that an ultrafilter must be a maximal filter.
--
	Suppose ==> Ultrafilter(t,s) & (not(Filter(t,s) & (FORALL x ¥incin pow(s) | ((x incs t) & Filter(x,s)) ¥imp (x = t))))
	Use_def(Ultrafilter) ==> Stat1: not (FORALL x ¥incin pow(s) | ((x incs t) & Filter(x,s)) ¥imp (x = t))
	t2-->Stat1 ==> (t2 ¥incin pow(s)) & (t2 incs t) & Filter(t2,s) & (t2 /= t)
	ELEM ==> Stat2: not(t incs t2)
	a-->Stat2 ==> (a in t2) and (a notin t)
	Use_def(Filter) ==> t2 ¥incin pow(s)
	ELEM ==> a in pow(s)
	Use_def(pow) ==> Stat3: a in {x: x ¥incin s}
	cp-->Stat3 ==> a ¥incin s
	Use_def(Ultrafilter) ==> Stat4: (FORALL y ¥incin s | (y in t or s - y in t))
	a-->Stat4 ==> s - a in t2
	Use_def(Filter) ==> (0 notin t2) & Stat5: (FORALL x in t2, y in t2 | x * y in t2)
	(a,s - a)-->Stat5 ==> false;  Discharge ==> (not Ultrafilter(t,s)) & Filter(t,s) &
			Stat6: (FORALL x ¥incin pow(s) | ((x incs t) & Filter(x,s)) ¥imp (x = t))
--
-- Thus if our theorem is false $t$ must be a maximal filter but not an ultrafilter.
--
	Use_def(Ultrafilter) ==> Stat7: not(FORALL y ¥incin s | (y in t or s - y in t))
	c-->Stat7 ==> (c ¥incin s) & (c notin t) & (s - c notin t)
	Loc_def ==> t3 = {x: x ¥incin s | (EXISTS y  in t| x incs y * c)}
	Suppose ==> not Filter(t3,s)
	Use_def(Filter) ==> not((t3 ¥incin pow(s)) & (0 notin t3) & (FORALL x in t3, y in t3 | x * y in t3) &
			(FORALL x in t3, y ¥incin s | ((y incs x) ¥imp (y in t3))))
	Suppose ==> Stat8: not (t3 ¥incin pow(s))
	b-->Stat8 ==> Stat9: (b in {x: x ¥incin s | (EXISTS y  in t| x incs y * c)}) & (b notin pow(s))
	b2-->Stat9 ==> b ¥incin s
	Use_def(pow) ==> Stat10: b notin {x: x ¥incin s}
	b-->Stat10 ==> false; Discharge ==> t3 ¥incin pow(s)
	Suppose ==> Stat11: not (FORALL x in t3, y ¥incin s | ((y incs x) ¥imp (y in t3)))
	(b3,c3)-->Stat11 ==> Stat12: (b3 in {x: x ¥incin s | (EXISTS y  in t | x incs y * c)}) & (c3 ¥incin s) &
			(c3 incs b3) & Stat13: (c3 notin {x: x ¥incin s | (EXISTS y  in t | x incs y * c)})
	b4-->Stat12 ==> (b4 ¥incin s) & (EXISTS y in t | b4 incs y * c) & (b3 = b4)
	EQUAL ==> (b3 ¥incin s) & Stat14: (EXISTS y in t | b3 incs y * c)
	c4-->Stat14 ==> (c4 in t) & (b3 incs c4 * c)
	c3-->Stat13 ==> Stat15: not (EXISTS y in t | c3 incs y * c)
	c4-->Stat15 ==> false; Discharge ==> (FORALL x in t3, y ¥incin s | ((y incs x) ¥imp (y in t3)))
	Suppose ==> Stat16: not (FORALL x in t3, y in t3 | x * y in t3)
	(b5,c5)-->Stat16 ==> Stat17: (b5 in {x: x ¥incin s | (EXISTS y in t | x incs y * c)}) &
			Stat18: (c5 in {x: x ¥incin s | (EXISTS y in t | x incs y * c)}) &
			Stat19: (not (b5 * c5 in {x: x ¥incin s | (EXISTS y in t | x incs y * c)}))
	b6-->Stat17 ==> (b6 ¥incin s) & Stat20: (EXISTS y in t | b6 incs y * c) & (b5 = b6)
	EQUAL ==> (b5 ¥incin s) & (EXISTS y in t | b5 incs y * c)
	c6-->Stat18 ==> (c6 ¥incin s) & Stat21: (EXISTS y in t | c6 incs y * c) & (c5 = c6)
	EQUAL ==> (c5 ¥incin s) & (EXISTS y in t | c5 incs y * c)
	d6-->Stat20 ==> (d6 in t) & (b5 incs d6 * c)
	e6-->Stat21 ==> (e6 in t) & (c5 incs e6 * c)
	ELEM ==> b5 * c5 incs (d6 * e6) * c
	Use_def(Filter) ==> Stat22: (FORALL x in t, y in t | x * y in t)
	(d6,e6)-->Stat22 ==> d6 * e6 in t
	(b5 * c5)-->Stat19 ==> Stat23: not (EXISTS y in t | b5 * c5 incs y * c)
	(d6 * e6)-->Stat23 ==> false; Discharge ==> Stat24: 0 in {x: x ¥incin s | (EXISTS y in t | x incs y * c)}
	x-->Stat24 ==> Stat25: (EXISTS y in t | x incs y * c) & (x = 0)
	y-->Stat25 ==> (y in t) & (y * c = 0)
	Use_def(Filter) ==> (t ¥incin pow(s)) & Stat26: (FORALL x in t, y ¥incin s | ((y incs x) ¥imp (y in t)))
	ELEM ==> y in pow(s)
	Use_def(pow) ==> Stat27: y in {x: x ¥incin s}
	yy-->Stat27 ==> y ¥incin s
	ELEM ==> y ¥incin (s - c)
	(y,s - c)-->Stat26 ==> false; Discharge ==> Filter(t3,s)
--
    Use_def(Filter) ==> Stat28: (t ¥incin pow(s)) & (0 notin t) &
		Stat29: (FORALL x in t, y in t | (x * y) in t) &
		Stat30: (FORALL x in t, y ¥incin s | (y incs x) ¥imp (y in t))
    Suppose ==> not(t3 ¥incin pow(s))
	EQUAL ==> Stat31: not({x: x ¥incin s | (EXISTS y in t | x incs (y * c))} ¥incin pow(s))
	x0-->Stat31 ==> (x0 notin pow(s)) & Stat32: (x0 in {x ¥incin s | (EXISTS y in t | x incs (y * c))})
	()-->Stat32 ==> x0 ¥incin s
	Use_def(pow) ==> Stat33: (x0 notin {x: x ¥incin s})
    x0-->Stat33 ==> false; Discharge ==> t3 ¥incin pow(s)
--
-- Aiming now at showing that $t3$ strictly includes $t$, let us check first that $t /= 0$.
-- The proof of this fact is that otherwise it would be included in ${s}$,
-- which is a filter on $s$ since $s /= 0$.
--
    Suppose ==> t = 0
        Suppose ==> not({s} ¥incin pow(s))
            Use_def(pow) ==> Stat34: (s notin {x: x ¥incin s})
        s-->Stat34 ==> false; Discharge ==> {s} ¥incin pow(s)
        Suppose ==> not(Filter({s},s))
            Use_def(Filter) ==> not((FORALL x in {s}, y in {s} | (x * y) in {s}) & (FORALL x in {s}, y ¥incin s | (y incs x) ¥imp (y in {s})))
            Suppose ==> Stat35: not(FORALL x in {s}, y in {s} | (x * y) in {s})
             (x5,x6)-->Stat35(Stat35) ==> false; Discharge ==> Stat36: not(FORALL x in {s}, y ¥incin s | (y incs x) ¥imp (y in {s}))
        (x7,x8)-->Stat36 ==> false; Discharge ==> Filter({s},s)
    ({s})-->Stat6 ==> false; Discharge ==> t /= 0
    Suppose ==> Stat37: c notin {x ¥incin s | (EXISTS y in t | x incs (y * c))}
        ()-->Stat37 ==> Stat38: (not(EXISTS y in t | c incs (y * c)))
    (arb(t))-->Stat38 ==> false; Discharge ==> t /= t3
    Suppose ==> Stat39: not(t3 incs t)
        d-->Stat39 ==> (d in t) & Stat40: (not(d in {x ¥incin s | (EXISTS y in t | x incs (y * c))}))
        ()-->Stat40 ==> (not (d ¥incin s)) or (not(EXISTS y in t | d incs (y * c)))
        Use_def(Filter) ==> d in pow(s)
        Use_def(pow) ==> Stat41: d in {x: x ¥incin s}
        x9-->Stat41 ==> Stat42: (not(EXISTS y in t | d incs (y * c)))
    d-->Stat42 ==> false; Discharge ==> t3 incs t
	t3-->Stat6 ==> false; Discharge ==> QED
--
-- Since Theorem 415 tells us that the hypothesis of Theorem 414 is valid for the set of filters in a set $s$,
-- the following conclusion results immediately.
--
Theorem 417: [Every filter on a set $S$ can be extended to an ultrafilter on $S$] (Filter(T,S) & (S /= 0)) ¥imp (EXISTS u | ((u incs T) & Ultrafilter(u,S))). Proof:
	Suppose_not(t,s) ==> (s /= 0) & Filter(t,s) & Stat1: (not (EXISTS u | ((u incs t) & Ultrafilter(u,s))))
--
-- For let $t$, $s$ be a counterexample to our assertion, and consider the collection $filters_in_s$
-- of all filters in $s$. Since it is easily seen that $filters_in_s$ satisfies the hypothesis of Theorem 414,
-- it follows that $t$ is contained in some maximal filter.
--
	Loc_def ==> filters_in_s = {f ¥incin pow(s) | Filter(f,s)}
	Suppose ==> Stat2: not (FORALL x ¥incin filters_in_s | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp (Un(x) in filters_in_s)))
	x1-->Stat2 ==> (x1 ¥incin filters_in_s) & (FORALL u in x1, v in x1 | (u incs v or v incs u)) & (Un(x1) notin filters_in_s)
	ELEM ==> Stat3: (x1 ¥incin {f ¥incin pow(s) | Filter(f,s)}) & Stat4: (Un(x1) notin {f ¥incin pow(s) | Filter(f,s)})
	Suppose ==> Stat5: not (FORALL y in x1 |  Filter(y,s))
	y1-->Stat5 ==> (y1 in x1) & (not Filter(y1,s))
	ELEM ==> Stat6: y1 in {f ¥incin pow(s) | Filter(f,s)}
	()-->Stat6 ==> false; Discharge ==> (FORALL y in x1 |  Filter(y,s))
	x1-->T415 ==> Filter(Un(x1),s)
	()-->Stat4 ==> Stat7: not(Un(x1) ¥incin pow(s))
	c-->Stat7 ==> (c in Un(x1)) & (c notin pow(s))
	Use_def(Un) ==> Stat8: c in {x: y in x1,x in y}
	(y2,c2)-->Stat8 ==> (y2 in x1) & (c2 in y2)  & (c2 = c)
	ELEM ==> Stat9: (y2 in {f ¥incin pow(s) | Filter(f,s)}) & (c in y2)
	()-->Stat9 ==> Filter(y2,s)
	Use_def(Filter) ==> false; Discharge ==>
		(FORALL x ¥incin filters_in_s | ((FORALL u in x,v in x | (u incs v or v incs u)) ¥imp (Un(x) in filters_in_s)))
	filters_in_s-->T414 ==> Stat10: (FORALL u in filters_in_s | (EXISTS y in filters_in_s |
			(y incs u) & (FORALL x in filters_in_s | not ((x incs y) & (x /= y)))))
	Suppose ==> t notin filters_in_s
	ELEM ==> Stat11: t notin {f ¥incin pow(s) | Filter(f,s)}
	()-->Stat11 ==> Stat12: not (t ¥incin pow(s))
	Use_def(Filter) ==> false; Discharge ==> t in filters_in_s
	t-->Stat10 ==> Stat13: (EXISTS y in filters_in_s | (y incs t) & (FORALL x in filters_in_s | not ((x incs y) & (x /= y))))
	tm-->Stat13 ==> Stat14: (tm in filters_in_s) & (tm incs t) & Stat15: (FORALL x in filters_in_s | not ((x incs tm) & (x /= tm)))
--
-- But it follows using Theorem 416 that $tm$ must be an ultrafilter, and so our theorem is proved.
--
	Suppose ==> Stat16: not (FORALL x ¥incin pow(s) | ((x incs tm) & Filter(x,s)) ¥imp (x = tm))
	t2-->Stat16 ==> (t2 ¥incin pow(s)) & (t2 incs tm) & Filter(t2,s) & (t2 /= tm)
	t2-->Stat15 ==> Stat17: t2 notin {f ¥incin pow(s) | Filter(f,s)}
	t2-->Stat17 ==> false; Discharge ==> (FORALL x ¥incin pow(s) | ((x incs tm) & Filter(x,s)) ¥imp (x = tm))
	EQUAL ==> Stat18: tm in {f ¥incin pow(s) | Filter(f,s)}
	()-->Stat18 ==> Filter(tm,s)
	(s,tm)-->T416 ==> Stat19: Ultrafilter(tm,s)
	tm-->Stat1(Stat14,Stat19) ==> false; Discharge ==> QED
--
-- ************************************************************************************************
--							Section 13: Formal fractions and rational numbers
-- ************************************************************************************************
--
-- We have seen above that the signed integers is a collection of quantities into which the unsigned
-- integers can be embedded in a manner preserving all the basic algebraic operations on unsigned integers.
-- In this sense, the unsigned integers are an 'extension' of the unsigned integers.
-- This is the first of several extensions, each of which  serves to simplify some aspect
-- of the collection of numbers being extended. As previously noted, extension of the unsigned integers
-- to the signed integers serves to simplify the properties of subtraction. Three extensions subsequent to this
-- respectively introduce (i) the rational numbers, thereby simplifying division; (ii) the real numbers,
-- thereby ensuring that every polynomial which takes on both positive and negative values
-- also takes on the zero value; (iii) the complex numbers, thereby ensuring that every polynomial
-- other than a simple constant has at least one zero. We shall see that these extended families of numbers
-- have many deep properties other than the basic properties noted.
--
-- Of these extensions it is the introduction of real numbers which will involve the deepest construction.
--
-- In the present section we begin to walk the path outlined above by introducing the rational numbers.
-- This is done in two steps. First we introduce the formal fractions and the elementary algebraic
-- operations on them. Formal fractions are simply ordered pairs of signed integers $[m,n]$, $m$ being the fraction's
-- 'numerator' and $n$ its denominator. Then an eqivalence relation beween fractions is introduced.
-- This amounts to the fractions becoming identical when each is reduced to 'lowest terms' by division of
-- its nuerator and denoinator by thier greatest common factor, but is more conveniently expressed
-- by the condition that
--
Def 35: [The set of formal fractions] Fr := {[x,y]: x in Si, y in Si | y /= [0,0]}
Def 36: [Equivalence of formal fractions] Same_frac(P,Q) := car(P) ¥S_TIMES cdr(Q) = cdr(P) ¥S_TIMES car(Q)
Def 36a: [Nonnegative fraction] Fr_is_nonneg(X) := is_nonneg(car(X) ¥S_TIMES cdr(X))
--
-- Our next few results show that the binary predicate '$Same_frac$' is an equivalence relation.
-- We begin by showing that '$Same_frac$' is symmetric and transitive. The proof simply uses the definition
-- to our expand our assertion into simple algebraic relationships for signed integers,
-- which then follow by elementary algebraic manipulation.
--
Theorem 418: [Equivalence of fractions is reflexive and symmetric] (FORALL x in Fr,y in Fr | (Same_frac(x,y) ¥eq Same_frac(y,x)) & Same_frac(x,x)). Proof:
    Suppose_not ==> Stat1: not (FORALL x in Fr,Y in Fr | (Same_frac(x,y) ¥eq Same_frac(y,x)) & Same_frac(x,x))
    (x,y)-->Stat1 ==> (x in Fr) & (y in Fr) & (not(Same_frac(x,y) ¥eq Same_frac(y,x)) or (not Same_frac(x,x)))
    Use_def(Fr) ==> Stat2: (x in {[u,v]: u in Si, v in Si | v /= [0,0]}) & (y in {[u,v]: u in Si, v in Si | v /= [0,0]})
    (a,b,c,d)-->Stat2 ==> Stat3: (x = [a,b]) & (a in Si) & (b in Si) & (y = [c,d]) & (c in Si) & (d in Si)
    (Stat3)ELEM ==> (car(x) = a) & (cdr(x) = b)
    (Stat3,Stat3)ELEM ==> (car(y) = c) & (cdr(y) = d)
    Suppose ==> not Same_frac(x,x)
    Use_def(Same_frac) ==> (car(x) ¥S_TIMES cdr(x)) /= (cdr(x) ¥S_TIMES car(x))
    (car(x),cdr(x))-->T384(Stat1*) ==> false; Discharge ==> not(Same_frac(x,y) ¥eq Same_frac(y,x))
    Suppose ==> Same_frac(x,y) & (not Same_frac(y,x))
    Use_def(Same_frac) ==> ((car(x) ¥S_TIMES cdr(y)) = (cdr(x) ¥S_TIMES car(y))) &
    							((car(y) ¥S_TIMES cdr(x)) /= (cdr(y) ¥S_TIMES car(x)))
    EQUAL ==> (a ¥S_TIMES d = b ¥S_TIMES c) & (c ¥S_TIMES b /= d ¥S_TIMES a)
    ALGEBRA ==> false; Discharge ==> (not Same_frac(x,y)) & Same_frac(y,x)
    Use_def(Same_frac) ==> ((car(x) ¥S_TIMES cdr(y)) /= (cdr(x) ¥S_TIMES car(y))) &
    							((car(y) ¥S_TIMES cdr(x)) = (cdr(y) ¥S_TIMES car(x)))
    EQUAL ==> (a ¥S_TIMES d /= b ¥S_TIMES c) & (c ¥S_TIMES b = d ¥S_TIMES a)
    ALGEBRA ==> false; Discharge ==> QED
--
Theorem 419: [Equivalence of fractions is transitive] (FORALL x in Fr, y in Fr, wz in Fr | (Same_frac(x,y) & Same_frac(y,wz)) ¥imp Same_frac(x,wz)). Proof:
    Suppose_not ==> Stat1: not (FORALL x in Fr, y in Fr, wz in Fr | (Same_frac(x,y) & Same_frac(y,wz)) ¥imp Same_frac(x,wz))
    (x,y,wz)-->Stat1 ==> (x in Fr) & (y in Fr) & (wz in Fr) & Same_frac(x,y) & Same_frac(y,wz) & (not Same_frac(x,wz))
    Use_def(Fr) ==> Stat2: (x in {[u,v]: u in Si, v in Si | v /= [0,0]}) &
	Stat3:(y in {[u,v]: u in Si, v in Si | v /= [0,0]}) & Stat4:(wz in {[u,v]: u in Si, v in Si | v /= [0,0]})
    (a,b)-->Stat2 ==> Stat5: (x = [a,b]) & (a in Si) & (b in Si)
    (Stat5)ELEM ==> (car(x) = a) & (cdr(x) = b)
    (c,d)-->Stat3 ==> Stat6: (y = [c,d]) & (c in Si) & (d in Si) & (d /= [0,0])
    (Stat6)ELEM ==> (car(y) = c) & (cdr(y) = d)
    (e,f)-->Stat4 ==> Stat7: (wz = [e,f]) & (e in Si) & (f in Si)
    (Stat7)ELEM ==> (car(wz) = e) & (cdr(wz) = f)
    Use_def(Same_frac) ==> ((car(x) ¥S_TIMES cdr(y)) = (cdr(x) ¥S_TIMES car(y))) &
    	((car(y) ¥S_TIMES cdr(wz)) = (cdr(y) ¥S_TIMES car(wz))) & ((car(x) ¥S_TIMES cdr(wz)) /= (cdr(x) ¥S_TIMES car(wz)))
    EQUAL ==> (a ¥S_TIMES d = b ¥S_TIMES c) & (c ¥S_TIMES f = d ¥S_TIMES e) & (a ¥S_TIMES f /= b ¥S_TIMES e)
    EQUAL ==> (a ¥S_TIMES d) ¥S_TIMES f = (b ¥S_TIMES c) ¥S_TIMES f
    ALGEBRA(Stat5,Stat6,Stat7) ==> ((a ¥S_TIMES d) ¥S_TIMES f = (a ¥S_TIMES f) ¥S_TIMES d) &
    									((b ¥S_TIMES c) ¥S_TIMES f = b ¥S_TIMES (c ¥S_TIMES f))
    EQUAL ==> (a ¥S_TIMES d) ¥S_TIMES f = b ¥S_TIMES (d ¥S_TIMES e)
    ALGEBRA ==> (a ¥S_TIMES f) ¥S_TIMES d = b ¥S_TIMES (d ¥S_TIMES e)
    ALGEBRA ==> b ¥S_TIMES (d ¥S_TIMES e) = (b ¥S_TIMES e) ¥S_TIMES d
    ALGEBRA ==> ((a ¥S_TIMES f) in Si) & ((b ¥S_TIMES e) in Si)
    ELEM ==> (a ¥S_TIMES f) ¥S_TIMES d = (b ¥S_TIMES e) ¥S_TIMES d
    (d,a ¥S_TIMES f,b ¥S_TIMES e)-->T409 ==> false; Discharge ==> QED
--
-- Now that we know that '$Same_frac$' is an equivalence relationship, we can apply the
-- equivalence_classes theory to it, to derive
--
APPLY(Eqc_thryvar:Ra,f1_thryvar:Fr_to_Ra) equivalence_classes(R(x,y)->Same_frac(x,y),s->Fr) ==>
    Theorem 420: [Fractions are equivalent if and only if the rational numbers they define are equal] (FORALL x, y | ((x in Fr) & (y in Fr)) ¥imp ((Same_frac(x,y) ¥eq (Fr_to_Ra(x) = Fr_to_Ra(y))))) &
    (FORALL x  | (x in Ra) ¥imp ((arb(x) in Fr) & (Fr_to_Ra(arb(x)) = x))) &
    (FORALL x | (x in Fr) ¥imp (Fr_to_Ra(x) in Ra)) &
    (FORALL x | (x in Fr) ¥imp Same_frac(x,arb(Fr_to_Ra(x))))
--
--			[Note: $Ra$ is the set of rational numbers.]
--
Theorem 421: [Every fraction is equivalent to every member of its rational number class] (X in Fr) ¥imp ((Fr_to_Ra(X) in Ra) & Same_frac(X,arb(Fr_to_Ra(X)))). Proof:
	Suppose_not(x) ==>  (x in Fr) & ((Fr_to_Ra(x) notin Ra) or (not(Same_frac(x,arb(Fr_to_Ra(x))))))
	T420 ==> Stat1: (FORALL x |  (x in Fr) ¥imp (Fr_to_Ra(x) in Ra)) & (FORALL x | (x in Fr) ¥imp (Same_frac(x,arb(Fr_to_Ra(x)))))
	(x,x)-->Stat1 ==> false; Discharge ==> QED
--
Theorem 422: [Alternate version of Theorem 420] ((X in Fr) & (Y in Fr)) ¥imp (Same_frac(X,Y) ¥eq (Fr_to_Ra(X) = Fr_to_Ra(Y))). Proof:
	Suppose_not(x,y) ==> (x in Fr) & (y in Fr) & (not(Same_frac(x,y) ¥eq (Fr_to_Ra(x) = Fr_to_Ra(y))))
	T420 ==> Stat1: (FORALL x, y | (x in Fr) & (y in Fr) ¥imp (Same_frac(x,y) ¥eq (Fr_to_Ra(x) = Fr_to_Ra(y))))
	(x,y)-->Stat1 ==> false; Discharge ==> QED
--
Theorem 423: [Alternate version of Theorem 421] (Y in Ra) ¥imp ((arb(Y) in Fr) & (Fr_to_Ra(arb(Y)) = Y)). Proof:
	Suppose_not(y) ==> (y in Ra) & ((arb(y) notin Fr) or (Fr_to_Ra(arb(y)) /= y))
	T420 ==> Stat1: (FORALL y | (y in Ra) ¥imp ((arb(y) in Fr) & (Fr_to_Ra(arb(y)) = y)))
	y-->Stat1 ==> false; Discharge ==> QED
--
Def 37: [The zero rational] Ra_0 := Fr_to_Ra([[0,0],[1,0]])
Def 37a: [The unit rational] Ra_1 := Fr_to_Ra([[1,0],[1,0]])
Def 38: [Rational Sum] Def(x ¥Ra_PLUS y) :=
    Fr_to_Ra([(car(arb(x)) ¥S_TIMES cdr(arb(y))) ¥S_PLUS (car(arb(y)) ¥S_TIMES cdr(arb(x))),
				cdr(arb(x)) ¥S_TIMES cdr(arb(y))])
Def 39: [Rational product]
    Def(x ¥Ra_TIMES y) := Fr_to_Ra([car(arb(x)) ¥S_TIMES car(arb(y)),cdr(arb(x)) ¥S_TIMES cdr(arb(y))])
Def 40: [Rational reciprocal] Recip(x) := Fr_to_Ra([cdr(arb(x)),car(arb(x))])
Def 41: [Rational quotient] Def(x ¥Ra_OVER y) := x ¥Ra_TIMES Recip(y)
Def 42: [Rational negative]
    Ra_Rev(x) := Fr_to_Ra([S_Rev(car(arb(x))),cdr(arb(x))])
Def 43: [Nonnegative Rational] Ra_is_nonneg(X) := is_nonneg(car(arb(X)) ¥S_TIMES cdr(arb(X)))
Def 44: [Rational Subtraction] Def(x ¥Ra_MINUS y) := x ¥Ra_PLUS Ra_Rev(y)
--
THEORY Ordered_add(g,e,pluz(x,y),minz(x,y),rvz(x),nneg(x))
	(e in g) & (FORALL x in g | (pluz(x,e) = x) & (pluz(x,rvz(x)) = e) & (rvz(x) in g))
	(FORALL x in g, y in g | (pluz(x,y) in g) & (pluz(x,y) = pluz(y,x)) & (pluz(x,rvz(y)) = minz(x,y)))
	(FORALL x in g, y in g, z in g | pluz(pluz(x,y),z) = pluz(x,pluz(y,z)))
	(FORALL x in g, y in g | ((nneg(x) & nneg(y)) ¥imp (nneg(pluz(x,y)))))
	(FORALL x in g | (nneg(x) or nneg(rvz(x))) & ((nneg(x) & nneg(rvz(x))) ¥imp (x = e)))
END Ordered_add;
--
ENTER_THEORY Ordered_add [Note that no theorems need to be proved since a decision algorithm is available]
    Def 00j: [Generic 'greater or equal' comparison] GE_thryvar(X,Y) := nneg(pluz(X,rvz(Y)))
    Def 00k: [Generic 'less or equal' comparison] LE_thryvar(X,Y) := GE_thryvar(Y,X)
    Def 00m: [Generic 'greater than' comparison] GT_thryvar(X,Y) := (GE_thryvar(X,Y) & (X /= Y))
    Def 00n: [Generic 'less than' comparison] LT_thryvar(X,Y) := GT_thryvar(Y,X)
--
Theorem Ordered_add.0: [Echo of relator definitions] (GE_thryvar(X,Y) ¥eq nneg(pluz(X,rvz(Y)))) &
	(LE_thryvar(X,Y) ¥eq GE_thryvar(Y,X)) &
	(GT_thryvar(X,Y) ¥eq (GE_thryvar(X,Y) & (X /= Y))) &
	(LT_thryvar(X,Y) ¥eq GT_thryvar(Y,X)). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(GE_thryvar) ==> GE_thryvar(x,y) ¥eq nneg(pluz(x,rvz(y)))
	Use_def(LE_thryvar) ==> LE_thryvar(x,y) ¥eq GE_thryvar(y,x)
	Use_def(GT_thryvar) ==> GT_thryvar(x,y) ¥eq (GE_thryvar(x,y) & (x /= y))
	Use_def(LT_thryvar) ==> LT_thryvar(x,y) ¥eq GT_thryvar(y,x)
Discharge ==> QED
--
--
Theorem Ordered_add.1: [Interface to Otter-based THEORY of orderedGroups] (LE_thryvar(X,Y) ¥eq nneg(pluz(Y,rvz(X)))) &
	(((X in g) & (Y in g)) ¥imp (GT_thryvar(X,Y) ¥eq (nneg(pluz(X,rvz(Y))) & (X /= Y)))) &
	(((X in g) & (Y in g)) ¥imp (GT_thryvar(X,Y) ¥eq (nneg(minz(X,Y)) & (X /= Y)))). Proof:
    Suppose_not(x,y) ==> (LE_thryvar(x,y) ¥eq (not nneg(pluz(y,rvz(x))))) or
		((x in g) & (y in g) & ((GT_thryvar(x,y) ¥eq ((not nneg(pluz(x,rvz(y)))) or (x = y))))) or
		((x in g) & (y in g) & ((GT_thryvar(x,y) ¥eq ((not nneg(minz(x,y))) or (x = y)))))
        Suppose ==> LE_thryvar(x,y) ¥eq (not nneg(pluz(y,rvz(x))))
            Use_def(LE_thryvar) ==> LE_thryvar(x,y) ¥eq GE_thryvar(y,x)
            Use_def(GE_thryvar) ==> GE_thryvar(y,x) ¥eq nneg(pluz(y,rvz(x)))
        EQUAL ==> false; Discharge ==>
		((x in g) & (y in g) & ((GT_thryvar(x,y) ¥eq ((not nneg(pluz(x,rvz(y)))) or (x = y))))) or
		((x in g) & (y in g) & ((GT_thryvar(x,y) ¥eq ((not nneg(minz(x,y))) or (x = y)))))
        Assump ==> Stat1: (FORALL x in g, y in g | (pluz(x,y) in g) & (pluz(x,y) = pluz(y,x)) & (pluz(x,rvz(y)) = minz(x,y)))
        (x,y)-->Stat1 ==> pluz(x,rvz(y)) = minz(x,y)
        EQUAL ==> ((x in g) & (y in g) & ((GT_thryvar(x,y) ¥eq ((not nneg(pluz(x,rvz(y)))) or (x = y)))))
        Use_def(GT_thryvar) ==> ((x in g) & (y in g) & (((GE_thryvar(x,y) & (x /= y)) ¥eq ((not nneg(pluz(x,rvz(y)))) or (x = y)))))
    Use_def(GE_thryvar) ==> false; Discharge ==> QED
--
Theorem Ordered_add.2: [The ordering by $GE_thryvar$ is a linear ordering] ((X in g) & (Y in g) & ((X = Y) or (not GE_thryvar(X,Y)))) ¥imp GE_thryvar(Y,X). Proof:
    Suppose_not(cp,c) ==> Stat1: (c in g) & (cp in g) & (not GE_thryvar(c,cp)) & ((c = cp) or (not GE_thryvar(cp,c)))
        Use_def(GE_thryvar) ==> (not nneg(pluz(c,rvz(cp)))) & ((c = cp) or (not nneg(pluz(cp,rvz(c)))))
        Assump ==> (e in g) & Stat2: (FORALL x in g | (pluz(x,e) = x) & (pluz(x,rvz(x)) = e) & (rvz(x) in g))
        Assump ==> Stat3: (FORALL x in g, y in g | (pluz(x,y) in g) & (pluz(x,y) = pluz(y,x)) & (pluz(x,rvz(y)) = minz(x,y)))
        Suppose ==> Stat4: not(FORALL x in g | pluz(e,x) = x)
            x-->Stat4 ==> (x in g) & (pluz(e,x) /= x)
            (x,e)-->Stat3 ==> pluz(x,e) /= x
        x-->Stat2 ==> false; Discharge ==> Stat5: (FORALL x in g | pluz(e,x) = x)
        Assump ==> Stat6: (FORALL x in g | (nneg(x) or nneg(rvz(x))) & ((nneg(x) & nneg(rvz(x))) ¥imp (x = e)))
        Suppose ==> c = cp
            EQUAL ==> (not nneg(pluz(c,rvz(c))))
            c-->Stat2 ==> pluz(c,rvz(c)) = e
            EQUAL ==> (not nneg(e))
            e-->Stat2 ==> rvz(e) in g
            (rvz(e))-->Stat5 ==> pluz(e,rvz(e)) = rvz(e)
            e-->Stat2 ==> pluz(e,rvz(e)) = e
            EQUAL ==> rvz(e) = e
            e-->Stat6 ==> nneg(e) or nneg(rvz(e))
        EQUAL ==> false; Discharge ==> (not nneg(pluz(cp,rvz(c))))
        c-->Stat2 ==> Stat7: rvz(c) in g
        cp-->Stat2 ==> Stat8: rvz(cp) in g
        (c,rvz(cp))-->Stat3 ==> pluz(c,rvz(cp)) in g
        (cp,rvz(c))-->Stat3 ==> pluz(cp,rvz(c)) in g
        (pluz(c,rvz(cp)))-->Stat6 ==> Stat9: nneg(rvz(pluz(c,rvz(cp))))
        (pluz(cp,rvz(c)))-->Stat6 ==> nneg(rvz(pluz(cp,rvz(c))))
        (pluz(c,rvz(cp)))-->Stat2 ==> rvz(pluz(c,rvz(cp))) in g
        (pluz(cp,rvz(c)))-->Stat2 ==> rvz(pluz(cp,rvz(c))) in g
        Assump ==> Stat10: (FORALL x in g, y in g | ((nneg(x) & nneg(y)) ¥imp (nneg(pluz(x,y)))))
        (rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c))))-->Stat10(Stat9) ==> nneg(pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c)))))
        (rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c))))-->Stat3(Stat9) ==> pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c)))) in g
        (cp,rvz(c))-->Stat3(Stat1,Stat7) ==> pluz(cp,rvz(c)) = pluz(rvz(c),cp)
        (c,rvz(cp))-->Stat3(Stat1,Stat8) ==> pluz(c,rvz(cp)) = pluz(rvz(cp),c)
        EQUAL ==> nneg(rvz(pluz(rvz(cp),c))) & (not nneg(pluz(rvz(c),cp))) & (rvz(pluz(rvz(cp),c)) in g)
        (rvz(pluz(rvz(cp),c)),pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c)))))-->Stat10 ==> nneg(pluz(rvz(pluz(rvz(cp),c)),pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c))))))
        Assump ==> Stat11: (FORALL x in g, y in g, z in g | pluz(pluz(x,y),z) = pluz(x,pluz(y,z)))
        Suppose ==> pluz(rvz(pluz(rvz(cp),c)),pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c))))) /= pluz(rvz(c),cp)
            Suppose ==> Stat12: not(FORALL x in g, y in g | pluz(rvz(x),pluz(x,y)) = y)
                (x1,y1)-->Stat12 ==> (x1 in g) & (y1 in g) & (pluz(rvz(x1),pluz(x1,y1)) /= y1)
                x1-->Stat2 ==> rvz(x1) in g
                (rvz(x1),x1,y1)-->Stat11(Stat12) ==> pluz(rvz(x1),pluz(x1,y1)) = pluz(pluz(rvz(x1),x1),y1)
                (rvz(x1),x1)-->Stat3 ==> pluz(rvz(x1),x1) = pluz(x1,rvz(x1))
                x1-->Stat2 ==>  pluz(x1,rvz(x1)) = e
                y1-->Stat5 ==> pluz(e,y1) = y1
            EQUAL(Stat12) ==> false; Discharge ==> Stat13: (FORALL x in g, y in g | pluz(rvz(x),pluz(x,y)) = y)
            Suppose ==> Stat14: not(FORALL x in g, y in g | rvz(pluz(x,rvz(y))) = pluz(y,rvz(x)))
                (x2,y2)-->Stat14 ==> (x2 in g) & (y2 in g) & (rvz(pluz(x2,rvz(y2))) /= pluz(y2,rvz(x2)))
                Suppose ==> Stat15: not(FORALL x in g | rvz(rvz(x)) = x)
                    x3-->Stat15 ==> (x3 in g) & (rvz(rvz(x3)) /= x3)
                    x3-->Stat2 ==> (rvz(x3) in g) & (pluz(x3,rvz(x3)) = e)
                    (rvz(x3),x3)-->Stat3 ==> pluz(rvz(x3),x3) = pluz(x3,rvz(x3))
                    (rvz(x3),x3)-->Stat13 ==> pluz(rvz(rvz(x3)),pluz(rvz(x3),x3)) = x3
                    (rvz(x3))-->Stat2 ==> rvz(rvz(x3)) in g
                    (rvz(rvz(x3)))-->Stat2 ==> pluz(rvz(rvz(x3)),e) = rvz(rvz(x3))
                EQUAL(Stat15) ==> false; Discharge ==> Stat16: (FORALL x in g | rvz(rvz(x)) = x)
                Suppose ==> Stat17: not(FORALL x in g, y in g | pluz(rvz(x),pluz(y,x)) = y)
                    (x4,y4)-->Stat17 ==> (x4 in g) & (y4 in g) & (pluz(rvz(x4),pluz(y4,x4)) /= y4)
                    (x4,y4)-->Stat3 ==> pluz(y4,x4) = pluz(x4,y4)
                    (x4,y4)-->Stat13 ==> pluz(rvz(x4),pluz(x4,y4)) = y4
                EQUAL(Stat17) ==> false; Discharge ==> Stat18: (FORALL x in g, y in g | pluz(rvz(x),pluz(y,x)) = y)
                Suppose ==> Stat19: not(FORALL x in g, y in g | pluz(rvz(pluz(x,y)),x) = rvz(y))
                    (x5,y5)-->Stat19 ==> (x5 in g) & (y5 in g) & (pluz(rvz(pluz(x5,y5)),x5) /= rvz(y5))
	            (x5,y5)-->Stat3 ==> pluz(x5,y5) in g
                    (pluz(x5,y5))-->Stat2 ==> rvz(pluz(x5,y5)) in g
                    y5-->Stat2 ==> rvz(y5) in g
                    (pluz(x5,y5),rvz(y5))-->Stat18 ==> pluz(rvz(pluz(x5,y5)),pluz(rvz(y5),pluz(x5,y5))) = rvz(y5)
                    (y5,x5)-->Stat18 ==> pluz(rvz(y5),pluz(x5,y5)) = x5
                EQUAL(Stat19) ==> false; Discharge ==> Stat20: (FORALL x in g, y in g | pluz(rvz(pluz(x,y)),x) = rvz(y))
                Suppose ==> Stat21: not(FORALL x in g, y in g | rvz(pluz(x,y)) = pluz(rvz(x),rvz(y)) )
                    (x6,y6)-->Stat21 ==> (x6 in g) & (y6 in g) & (rvz(pluz(x6,y6)) /= pluz(rvz(x6),rvz(y6)))
	            (x6,y6)-->Stat3 ==> pluz(x6,y6) in g
                    y6-->Stat2 ==> rvz(y6) in g
                    (rvz(y6),pluz(x6,y6))-->Stat20 ==> pluz(rvz(pluz(rvz(y6),pluz(x6,y6))),rvz(y6)) = rvz(pluz(x6,y6))
                    (y6,x6)-->Stat18 ==> pluz(rvz(y6),pluz(x6,y6)) = x6
                EQUAL(Stat21) ==> false; Discharge ==> Stat22: (FORALL x in g, y in g | rvz(pluz(x,y)) = pluz(rvz(x),rvz(y)))
                y2-->Stat2 ==> rvz(y2) in g
                (x2,rvz(y2))-->Stat22 ==> rvz(pluz(x2,rvz(y2))) = pluz(rvz(x2),rvz(rvz(y2)))
                y2-->Stat16 ==> rvz(rvz(y2)) = y2
                x2-->Stat2 ==> rvz(x2) in g
                (rvz(x2),y2)-->Stat3 ==> pluz(rvz(x2),y2) = pluz(y2,rvz(x2))
            EQUAL(Stat14) ==> false; Discharge ==> Stat23: (FORALL x in g, y in g | rvz(pluz(x,rvz(y))) = pluz(y,rvz(x)))
            (c,cp)-->Stat23 ==> Stat24: rvz(pluz(c,rvz(cp))) = pluz(cp,rvz(c))
            Suppose ==> Stat25: pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c)))) /= e
                (cp,c)-->Stat23 ==> rvz(pluz(cp,rvz(c))) = pluz(c,rvz(cp))
                (cp,rvz(c),pluz(c,rvz(cp)))-->Stat11 ==> pluz(pluz(cp,rvz(c)),pluz(c,rvz(cp))) = pluz(cp,pluz(rvz(c),pluz(c,rvz(cp))))
                (c,rvz(cp))-->Stat13 ==> pluz(rvz(c),pluz(c,rvz(cp))) = rvz(cp)
                cp-->Stat2 ==> pluz(cp,rvz(cp)) = e
            EQUAL(Stat24) ==> false; Discharge ==> Stat26: pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c)))) = e
            (c,rvz(cp))-->Stat3 ==> pluz(c,rvz(cp)) = pluz(rvz(cp),c)
            (cp,rvz(c))-->Stat3 ==> pluz(cp,rvz(c)) = pluz(rvz(c),cp)
            (c,rvz(cp))-->Stat23 ==> rvz(pluz(c,rvz(cp))) = pluz(cp,rvz(c))
            (pluz(rvz(c),cp))-->Stat2 ==> pluz(pluz(rvz(c),cp),e) = pluz(rvz(c),cp)
        EQUAL(Stat11) ==> false; Discharge ==> pluz(rvz(pluz(rvz(cp),c)),pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c))))) = pluz(rvz(c),cp)
    EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Ordered_add
--
--THEORY Ordered_add(g,e,pluz(i,j),minz(i,j),rvz(i),nneg(j));
--    (e in g) & (FORALL x in g | (pluz(x,e) = x) & (pluz(x,rvz(x)) = e) & (rvz(x) in g))
--    (FORALL x in g, y in g | (pluz(x,y) in g) & (pluz(x,y) = pluz(y,x)) & (pluz(x,rvz(y)) = minz(x,y)))
--    (FORALL x in g, y in g, z in g | pluz(pluz(x,y),z) = pluz(x,pluz(y,z)))
--    (FORALL x in g, y in g | (nneg(x) & nneg(y)) ¥imp nneg(pluz(x,y)))
--    (FORALL x in g | (nneg(x) or nneg(rvz(x))) & ((nneg(x) & nneg(rvz(x))) ¥imp (x = e)))
--==>(GE_thryvar,LE_thryvar,GT_thryvar,LT_thryvar)
--    (FORALL x,y | GE_thryvar(x,y) ¥eq nneg(x ¥pluz rvz(y)))
--    (FORALL x,y | LE_thryva(x,y) ¥eq GE_thryvar(y,x))
--    (FORALL x,y | GT_thryvar(x,y) ¥eq (GE_thryvar(x,y) & (x /= y)))
--    (FORALL x,y | LT_thryvar(x,y) ¥eq GT_thryvar(y,x))
--    (FORALL x,y | (LE_thryvar(x,y) ¥eq nneg(y ¥pluz rvz(x))))
--    (FORALL x,y | ((x in g) & (y in g)) ¥imp (GT_thryvar(x,y) ¥eq (nneg(x ¥pluz rvz(y)) & (x /= y))))
--    (FORALL x,y | ((x in g) & (y in g)) ¥imp (GT_thryvar(x,y) ¥eq (nneg(x ¥minz y) & (x /= y))))
--    (FORALL x,y | ((x in g) & (y in g) & ((x = y) or (not GE_thryvar(x,y)))) ¥imp GE_thryvar(y,x))
--END Ordered_add;
--
Theorem 424: [If a signed integer and its additive inverse are both nonnegative, the signed integer is zero] (X in Si) ¥imp ((is_nonneg(X) or is_nonneg(S_Rev(X))) & ((is_nonneg(X) & is_nonneg(S_Rev(X))) ¥imp (X = [0,0]))). Proof:
	Suppose_not(x) ==> Stat1: (x in Si) &
	((not(is_nonneg(x) or is_nonneg(S_Rev(x)))) or ((is_nonneg(x) & is_nonneg(S_Rev(x))) & (x /= [0,0])))
    x-->T369 ==> Stat2: (x = [car(x),cdr(x)]) & (car(x) = 0 or cdr(x) = 0) & (car(x) in Za) & (cdr(x) in Za)
    Use_def(is_nonneg) ==> Stat3: (is_nonneg(x) ¥eq (car(x) incs cdr(x))) &
    							(is_nonneg(S_Rev(x)) ¥eq (car(S_Rev(x)) incs cdr(S_Rev(x))))
	Use_def(S_Rev) ==> Stat4: S_Rev(x) = [cdr(x),car(x)]
	(Stat4)ELEM ==> (car(S_Rev(x)) = cdr(x)) & (cdr(S_Rev(x)) = car(x))
	(Stat2*)ELEM ==> Stat5: is_nonneg(x) or is_nonneg(S_Rev(x))
    (Stat1,Stat5*)ELEM ==> is_nonneg(x) & is_nonneg(S_Rev(x)) & (x /= [0,0])
    ELEM ==> Stat6: car(x) = cdr(x)
    (Stat2,Stat6)ELEM ==> (car(x) = 0) & (cdr(x) = 0)
    EQUAL ==> false; Discharge ==> QED
--
Theorem 425: [The sum of two non-negative signed integers is non-negative] (((X in Si) & (Y in Si) & is_nonneg(X) & is_nonneg(Y))) ¥imp (is_nonneg(X ¥S_PLUS Y) & is_nonneg(X ¥S_TIMES Y)). Proof:
	Suppose_not(x,y) ==> (x in Si) & (y in Si) & is_nonneg(x) & is_nonneg(y) &
			(not(is_nonneg(x ¥S_PLUS y) & is_nonneg(x ¥S_TIMES y)))
    x-->T369 ==> Stat1: (x = [car(x),cdr(x)]) & (car(x) = 0 or cdr(x) = 0) & (car(x) in Za) & (cdr(x) in Za)
    y-->T369 ==> Stat2: (y = [car(y),cdr(y)]) & (car(y) = 0 or cdr(y) = 0) & (car(y) in Za) & (cdr(y) in Za)
    Use_def(is_nonneg) ==> Stat3: (car(x) incs cdr(x)) & (car(y) incs cdr(y))
    (Stat1,Stat2,Stat3*)ELEM ==> Stat4: (cdr(x) = 0) & (cdr(y) = 0)
    EQUAL ==> Stat5: (x = [car(x),0]) & (y = [car(y),0])
    Use_def(¥S_PLUS) ==> x ¥S_PLUS y = Red([car(x) ¥PLUS car(y),cdr(x) ¥PLUS cdr(y)])
    EQUAL ==> x ¥S_PLUS y = Red([car(x) ¥PLUS car(y),0 ¥PLUS 0])
    ALGEBRA ==> (0 ¥PLUS 0 = 0) & (car(x) ¥PLUS car(y) in Za)
    EQUAL ==> x ¥S_PLUS y = Red([car(x) ¥PLUS car(y),0])
    (car(x) ¥PLUS car(y))-->T387 ==> Stat6: x ¥S_PLUS y = [car(x) ¥PLUS car(y),0]
    (Stat6)ELEM ==> car(x ¥S_PLUS y) incs cdr(x ¥S_PLUS y)
    Use_def(is_nonneg) ==> is_nonneg(x ¥S_PLUS y)
    Use_def(¥S_TIMES) ==>
	x ¥S_TIMES y = Red([(car(x) ¥TIMES car(y)) ¥PLUS (cdr(x) ¥TIMES cdr(y)),(car(x) ¥TIMES cdr(y)) ¥PLUS (car(y) ¥TIMES cdr(x))])
    EQUAL ==>x ¥S_TIMES y = Red([(car(x) ¥TIMES car(y)) ¥PLUS (0 ¥TIMES 0),(car(x) ¥TIMES 0) ¥PLUS (car(y) ¥TIMES 0)])
    ALGEBRA ==> (((car(x) ¥TIMES car(y)) ¥PLUS (0 ¥TIMES 0)) = (car(x) ¥TIMES car(y))) &
    					((car(x) ¥TIMES 0) ¥PLUS (car(y) ¥TIMES 0) = 0) & ((car(x) ¥TIMES car(y)) in Za)
    EQUAL ==> (x ¥S_TIMES y = Red([car(x) ¥TIMES car(y),0]))
    (car(x) ¥TIMES car(y))-->T387 ==> Stat7: x ¥S_TIMES y = [car(x) ¥TIMES car(y),0]
    (Stat7)ELEM ==> car(x ¥S_TIMES y) incs cdr(x ¥S_TIMES y)
    Use_def(is_nonneg) ==> is_nonneg(x ¥S_TIMES y)
    Discharge ==> QED
--
-- The following compound of earlier theorems is derived
-- uniquely as a trigger for the THEORY Ordered_add.
--
Theorem 426: ([0,0] in Si) & (FORALL x in Si | ((x ¥S_PLUS [0,0]) = x) & ((x ¥S_PLUS S_Rev(x)) = [0,0]) & (S_Rev(x) in Si)) &
	(FORALL x in Si, y in Si | ((x ¥S_PLUS y) in Si) & ((x ¥S_PLUS y) = (y ¥S_PLUS x)) & ((x ¥S_PLUS S_Rev(y)) = (x ¥S_MINUS y))) &
	(FORALL x in Si, y in Si, z in Si | ((x ¥S_PLUS y) ¥S_PLUS z) = (x ¥S_PLUS (y ¥S_PLUS z))) &
	(FORALL x in Si, y in Si | (is_nonneg(x) & is_nonneg(y)) ¥imp is_nonneg(x ¥S_PLUS y)) &
	(FORALL x in Si | (is_nonneg(x) or is_nonneg(S_Rev(x))) & ((is_nonneg(x) & is_nonneg(S_Rev(x))) ¥imp (x = [0,0]))). Proof:
Suppose_not ==> AUTO
	T368 ==> [0,0] in Si
	Suppose ==> Stat1: not(FORALL x in Si | ((x ¥S_PLUS [0,0]) = x) & ((x ¥S_PLUS S_Rev(x)) = [0,0]) & (S_Rev(x) in Si))
		x1-->Stat1(Stat1*) ==> (x1 in Si) & (((x1 ¥S_PLUS [0,0]) /= x1) or ((x1 ¥S_PLUS S_Rev(x1)) /= [0,0]) or (S_Rev(x1) notin Si))
		x1-->T405(Stat1*) ==> (x1 ¥S_PLUS [0,0]) = x1
		x1-->T391(Stat1*) ==> (S_Rev(x1) in Si) & ((S_Rev(x1) ¥S_PLUS x1) = [0,0])
	(x1,S_Rev(x1))-->T381(Stat1*) ==> false; Discharge ==> (FORALL x in Si | ((x ¥S_PLUS [0,0]) = x) & ((x ¥S_PLUS S_Rev(x)) = [0,0]) & (S_Rev(x) in Si))
	Suppose ==> Stat2: not(FORALL x in Si, y in Si | ((x ¥S_PLUS y) in Si) & ((x ¥S_PLUS y) = (y ¥S_PLUS x)) & ((x ¥S_PLUS S_Rev(y)) = (x ¥S_MINUS y)))
		(x2,y2)-->Stat2(Stat2*) ==> (x2 in Si) & (y2 in Si) & (((x2 ¥S_PLUS y2) notin Si) or ((x2 ¥S_PLUS y2) /= (y2 ¥S_PLUS x2)) or ((x2 ¥S_PLUS S_Rev(y2)) /= (x2 ¥S_MINUS y2)))
		(x2,y2)-->T371(Stat2*) ==> (x2 ¥S_PLUS y2) in Si
		(x2,y2)-->T381(Stat2*) ==> (x2 ¥S_PLUS y2) = (y2 ¥S_PLUS x2)
	(x2,y2)-->T398(Stat2*) ==> false; Discharge ==> (FORALL x in Si, y in Si | ((x ¥S_PLUS y) in Si) & ((x ¥S_PLUS y) = (y ¥S_PLUS x)) & ((x ¥S_PLUS S_Rev(y)) = (x ¥S_MINUS y)))
	Suppose ==> Stat3: not(FORALL x in Si, y in Si, z in Si | ((x ¥S_PLUS y) ¥S_PLUS z) = (x ¥S_PLUS (y ¥S_PLUS z)))
		(x3,y3,z3)-->Stat3(Stat3*) ==> (x3 in Si) & (y3 in Si) & (z3 in Si) & (((x3 ¥S_PLUS y3) ¥S_PLUS z3) /= (x3 ¥S_PLUS (y3 ¥S_PLUS z3)))
	(z3,x3,y3)-->T385(Stat3*) ==> false; Discharge ==> (FORALL x in Si, y in Si, z in Si | ((x ¥S_PLUS y) ¥S_PLUS z) = (x ¥S_PLUS (y ¥S_PLUS z)))
	Suppose ==> Stat4: not(FORALL x in Si, y in Si | (is_nonneg(x) & is_nonneg(y)) ¥imp is_nonneg(x ¥S_PLUS y))
		(x4,y4)-->Stat4(Stat4*) ==> (x4 in Si) & (y4 in Si) & is_nonneg(x4) & is_nonneg(y4) & (not is_nonneg(x4 ¥S_PLUS y4))
	(x4,y4)-->T425(Stat4*) ==> false; Discharge ==> Stat5: not(FORALL x in Si | (is_nonneg(x) or is_nonneg(S_Rev(x))) & ((is_nonneg(x) & is_nonneg(S_Rev(x))) ¥imp (x = [0,0])))
	x5-->Stat5(Stat5*) ==> (x5 in Si) & ((not(is_nonneg(x5) or is_nonneg(S_Rev(x5)))) or (not((is_nonneg(x5) & is_nonneg(S_Rev(x5))) ¥imp (x5 = [0,0]))))
x5-->T424(Stat5*) ==> false; Discharge ==> QED
--
APPLY(GE_thryvar:S_GE,LE_thryvar:S_LE,GT_thryvar:S_GT,LT_thryvar:S_LT) Ordered_add(g->Si,e->[0,0],pluz(i,j)->(i ¥S_PLUS j),minz(i,j)->(i ¥S_MINUS j),rvz(i)->S_Rev(i),nneg(j)->is_nonneg(j)) ==>
Theorem 427: [The ordering of two signed integers is defined by the sign of their differences] (FORALL x, y | (S_GE(x,y) ¥eq is_nonneg(x ¥S_PLUS S_Rev(y))) & (S_LE(x,y) ¥eq S_GE(y,x)) &
	(S_GT(x,y) ¥eq (S_GE(x,y) & (x /= y))) & (S_LT(x,y) ¥eq S_GT(y,x)))
--
    Def 00o: Def(X ¥S_GE Y) := S_GE(X,Y)
    Def 00p: Def(X ¥S_LE Y) := S_LE(X,Y)
    Def 00u: Def(X ¥S_GT Y) := S_GT(X,Y)
    Def 00v: Def(X ¥S_LT Y) := S_LT(X,Y)
--
Theorem 428: [The ordering of two signed integers is defined by the sign of their differences] ((X ¥S_GE Y) ¥eq is_nonneg(X ¥S_PLUS S_Rev(Y))) & ((X ¥S_LE Y) ¥eq (Y ¥S_GE X)) &
	((X ¥S_GT Y) ¥eq ((X ¥S_GE Y) & (X /= Y))) & ((X ¥S_LT Y) ¥eq (Y ¥S_GT X)). Proof:
Suppose_not(x,y) ==> AUTO
	T427 ==> (FORALL x, y | (S_GE(x,y) ¥eq is_nonneg(x ¥S_PLUS S_Rev(y))) &
		(S_LE(x,y) ¥eq S_GE(y,x)) &
		(S_GT(x,y) ¥eq (S_GE(x,y) & (x /= y))) & (S_LT(x,y) ¥eq S_GT(y,x)))
	Use_def(¥S_GE) ==> ((x ¥S_GE y) ¥eq S_GE(x,y)) & ((y ¥S_GE x) ¥eq S_GE(y,x))
	Use_def(¥S_LE) ==> (x ¥S_LE y) ¥eq S_LE(x,y)
	Use_def(¥S_GT) ==> ((x ¥S_GT y) ¥eq S_GT(x,y)) & ((y ¥S_GT x) ¥eq S_GT(y,x))
	Use_def(¥S_LT) ==> (x ¥S_LT y) ¥eq S_LT(x,y)
	EQUAL ==> Stat1: (FORALL x, y | ((x ¥S_GE y) ¥eq is_nonneg(x ¥S_PLUS S_Rev(y))) & ((x ¥S_LE y) ¥eq (y ¥S_GE x)) &
	((x ¥S_GT y) ¥eq ((x ¥S_GE y) & (x /= y))) & ((x ¥S_LT y) ¥eq (y ¥S_GT x)))
(x,y)-->Stat1(*) ==> false; Discharge ==> QED
--
Theorem 429: [The square of any signed integer is non-negative] (X in Si) ¥imp is_nonneg(X ¥S_TIMES X). Proof:
    Suppose_not(x) ==> (x in Si) & (not is_nonneg(x ¥S_TIMES x))
    Suppose ==> is_nonneg(x)
    (x,x)-->T425 ==> false; Discharge ==> not is_nonneg(x)
    x-->T424 ==> is_nonneg(S_Rev(x))
    x-->T391 ==> S_Rev(x) in Si
    (S_Rev(x),S_Rev(x))-->T425 ==> is_nonneg(S_Rev(x) ¥S_TIMES S_Rev(x))
    ALGEBRA ==> S_Rev(x) ¥S_TIMES S_Rev(x) = x ¥S_TIMES x
    EQUAL ==> false; Discharge ==> QED
--
Theorem 430: [The product of signed integers $x,y$ of which $x$ is positive is non-negative iff $y$ is non-negative] ((X in Si) & (Y in Si) & (X /= [0,0]) & is_nonneg(X)) ¥imp (is_nonneg(X ¥S_TIMES Y) ¥eq is_nonneg(Y)). Proof:
    Suppose_not(x,y) ==> (x in Si) & (y in Si) & (x /= [0,0]) & is_nonneg(x) & (not (is_nonneg(x ¥S_TIMES y) ¥eq is_nonneg(y)))
    Suppose ==> is_nonneg(y)
    (x,y)-->T425 ==> false; Discharge ==> (not is_nonneg(y)) & is_nonneg(x ¥S_TIMES y)
    y-->T424 ==> is_nonneg(S_Rev(y))
    y-->T391 ==> S_Rev(y) in Si
    (x,S_Rev(y))-->T425 ==> is_nonneg(x ¥S_TIMES S_Rev(y))
    ALGEBRA ==> ((x ¥S_TIMES S_Rev(y)) = S_Rev(x ¥S_TIMES y)) & (x ¥S_TIMES y in Si)
    EQUAL ==> is_nonneg(S_Rev(x ¥S_TIMES y))
    (x ¥S_TIMES y)-->T424 ==> x ¥S_TIMES y = [0,0]
    (y,x)-->T407 ==> Stat1: y = [0,0]
    Use_def(is_nonneg) ==> not(car(y) incs cdr(y))
    (Stat1)Discharge ==> QED
--
Theorem 431: [Fractions are pairs of signed integers with non-zero denominator] (X in Fr) ¥eq ((X = [car(X),cdr(X)]) & (car(X) in Si) & (cdr(X) in Si) & (cdr(X) /= [0,0])). Proof:
    Suppose_not(x) ==> not((x in Fr) ¥eq ((x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) &
    						(cdr(x) /= [0,0])))
    Suppose ==> Stat1: (x in Fr) &
    		(not((x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])))
    Use_def(Fr) ==> Stat2: x in {[u,y]: u in Si, y in Si | y /= [0,0]}
    (u,y)-->Stat2 ==> Stat3: (x = [u,y]) & (u in Si) & (y in Si) & (y /= [0,0])
    (Stat3*)ELEM ==> Stat4: x = [u,y]
    (Stat4)ELEM ==> Stat5: (x = [car(x),cdr(x)]) & (car(x) = u) & (cdr(x) = y)
    (Stat3,Stat5*)ELEM ==> Stat6: (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])
    (Stat1,Stat5,Stat6*)Discharge ==> (x = [car(x),cdr(x)]) & (car(x) in Si) &
    	(cdr(x) in Si) & (cdr(x) /= [0,0]) & (not(x in Fr))
    Use_def(Fr) ==> Stat7: x notin {[u,y]: u in Si, y in Si | y /= [0,0]}
    (car(x),cdr(x))-->Stat7 ==> not((x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0]))
    Discharge ==> QED
--
Theorem 432: [Fractions are pairs of signed integers with non-zero denominator, 2] ((X in Si) & (Y in Si)) ¥imp (([X,Y] in Fr) ¥eq (Y /= [0,0])). Proof:
Suppose_not(x0,y0) ==> AUTO
	(x0,y0)-->T9(Stat1*) ==> Stat1: (car([x0,y0]) = x0) & (cdr([x0,y0]) = y0)
	Suppose ==> [x0,y0] in Fr
	([x0,y0])-->T431(*) ==> false; Discharge ==> [x0,y0] notin Fr
	(x0,y0)-->T10(Stat2*) ==> Stat2: [x0,y0] = [car([x0,y0]),cdr([x0,y0])]
([x0,y0])-->T431(*) ==> false; Discharge ==> QED
--
Theorem 433: [Rational numbers are classes of pairs of signed integers] (N in Ra) ¥imp ((arb(N) in Fr) & (arb(N) = [car(arb(N)),cdr(arb(N))]) & (car(arb(N)) in Si) &
				(cdr(arb(N)) in Si) & (cdr(arb(N)) /= [0,0])). Proof:
    Suppose_not(n) ==>
	(n in Ra) & (not((arb(n) in Fr) & (arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])))
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    (arb(n))-->T431 ==> false; Discharge ==> QED
--
-- Next, as a preliminary toward consideration of the properties of products of rational numbers,
-- we prove that if two pairs $x$, $y$ and $w$, $wz$ of formal fractions are given, with $Same_frac(x,y)$
-- and similarly for $x$, $y$, then the formal product of $x$ by $w$ represents the same
-- rational number as the formal product of $y$ by $wz$.
--
Theorem 434: [Fractions are equivalent if their cross-products are equal] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) ¥imp
    Same_frac([(car(X) ¥S_TIMES cdr(W)) ¥S_PLUS (car(W) ¥S_TIMES cdr(X)),cdr(X) ¥S_TIMES cdr(W)],
	[(car(Y) ¥S_TIMES cdr(Z)) ¥S_PLUS (car(Z) ¥S_TIMES cdr(Y)),cdr(Y) ¥S_TIMES cdr(Z)]). Proof:
	Suppose_not(x,y,w,wz) ==> (x in Fr) & (y in Fr) & Same_frac(x,y) & (w in Fr) & (wz in Fr) & Same_frac(w,wz) &
	(not Same_frac([(car(x) ¥S_TIMES cdr(w)) ¥S_PLUS (car(w) ¥S_TIMES cdr(x)),cdr(x) ¥S_TIMES cdr(w)],
	[(car(y) ¥S_TIMES cdr(wz)) ¥S_PLUS (car(wz) ¥S_TIMES cdr(y)),cdr(y) ¥S_TIMES cdr(wz)]))
    x-->T431 ==> (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si)
    y-->T431 ==> (y = [car(y),cdr(y)]) & (car(y) in Si) & (cdr(y) in Si)
    w-->T431 ==> (w = [car(w),cdr(w)]) & (car(w) in Si) & (cdr(w) in Si)
    wz-->T431 ==> (wz = [car(wz),cdr(wz)]) & (car(wz) in Si) & (cdr(wz) in Si)
    Use_def(Same_frac) ==>
	(car(x) ¥S_TIMES cdr(y) = cdr(x) ¥S_TIMES car(y)) & (car(w) ¥S_TIMES cdr(wz) = cdr(w) ¥S_TIMES car(wz))
    Loc_def ==> Stat1: prod1 = [(car(x) ¥S_TIMES cdr(w)) ¥S_PLUS (car(w) ¥S_TIMES cdr(x)),cdr(x) ¥S_TIMES cdr(w)]
    (Stat1)ELEM ==> Stat2: car(prod1) = (car(x) ¥S_TIMES cdr(w)) ¥S_PLUS (car(w) ¥S_TIMES cdr(x))
    (Stat1)ELEM ==> Stat3: cdr(prod1) = cdr(x) ¥S_TIMES cdr(w)
    Loc_def ==> Stat4: prod2 = [(car(y) ¥S_TIMES cdr(wz)) ¥S_PLUS (car(wz) ¥S_TIMES cdr(y)),cdr(y) ¥S_TIMES cdr(wz)]
    (Stat4)ELEM ==> Stat5: car(prod2) = (car(y) ¥S_TIMES cdr(wz)) ¥S_PLUS (car(wz) ¥S_TIMES cdr(y))
    (Stat4)ELEM ==> Stat6: cdr(prod2) = cdr(y) ¥S_TIMES cdr(wz)
    EQUAL ==> not Same_frac(prod1,prod2)
    Use_def(Same_frac) ==> Stat7: car(prod1) ¥S_TIMES cdr(prod2) /= cdr(prod1) ¥S_TIMES car(prod2)
    EQUAL(Stat2,Stat3,Stat5,Stat6,Stat7) ==>
    	((car(x) ¥S_TIMES cdr(w)) ¥S_PLUS (car(w) ¥S_TIMES cdr(x))) ¥S_TIMES (cdr(y) ¥S_TIMES cdr(wz)) /=
	(cdr(x) ¥S_TIMES cdr(w)) ¥S_TIMES ((car(y) ¥S_TIMES cdr(wz)) ¥S_PLUS (car(wz) ¥S_TIMES cdr(y)))
--
-- To conclude our proof we simply apply the distributive law for signed integers
-- to the left and right hand sides of the last inequality seen above,
--
    ALGEBRA ==> ((cdr(x) ¥S_TIMES cdr(w)) ¥S_TIMES ((car(y) ¥S_TIMES cdr(wz)) ¥S_PLUS (car(wz) ¥S_TIMES cdr(y)))) =
	((cdr(x) ¥S_TIMES car(y)) ¥S_TIMES (cdr(w) ¥S_TIMES cdr(wz))) ¥S_PLUS
		((cdr(w) ¥S_TIMES car(wz)) ¥S_TIMES (cdr(y) ¥S_TIMES cdr(x)))
    ALGEBRA ==> ((car(x) ¥S_TIMES cdr(w)) ¥S_PLUS (car(w) ¥S_TIMES cdr(x))) ¥S_TIMES (cdr(y) ¥S_TIMES cdr(wz)) =
	((car(x) ¥S_TIMES cdr(y)) ¥S_TIMES (cdr(w) ¥S_TIMES cdr(wz))) ¥S_PLUS
		((car(w) ¥S_TIMES cdr(wz)) ¥S_TIMES (cdr(y) ¥S_TIMES cdr(x)))
    EQUAL ==> false; Discharge ==> QED
--
-- The following corollary restates the preceding lemma in an obvious way.
--
Theorem 435: [If two pair of fractions are equivalent, their formal sums are also equivalent] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) ¥imp
	(Fr_to_Ra([(car(X) ¥S_TIMES cdr(W)) ¥S_PLUS (car(W) ¥S_TIMES cdr(X)),cdr(X) ¥S_TIMES cdr(W)]) =
	Fr_to_Ra([(car(Y) ¥S_TIMES cdr(Z)) ¥S_PLUS (car(Z) ¥S_TIMES cdr(Y)),cdr(Y) ¥S_TIMES cdr(Z)])). Proof:
	Suppose_not(x,y,w,wz) ==> (x in Fr) & (y in Fr) & Same_frac(x,y) & (w in Fr) & (wz in Fr) & Same_frac(w,wz) &
	(Fr_to_Ra([(car(x) ¥S_TIMES cdr(w)) ¥S_PLUS (car(w) ¥S_TIMES cdr(x)),cdr(x) ¥S_TIMES cdr(w)]) /=
   			Fr_to_Ra([(car(y) ¥S_TIMES cdr(wz)) ¥S_PLUS (car(wz) ¥S_TIMES cdr(y)),cdr(y) ¥S_TIMES cdr(wz)]))
    x-->T431 ==> Stat1: (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])
    w-->T431 ==> (w = [car(w),cdr(w)]) & (car(w) in Si) & (cdr(w) in Si) & (cdr(w) /= [0,0])
    (cdr(w),cdr(x))-->T407(Stat1*) ==> cdr(x) ¥S_TIMES cdr(w) /= [0,0]
    y-->T431 ==> Stat2: (y = [car(y),cdr(y)]) & (car(y) in Si) & (cdr(y) in Si) & (cdr(y) /= [0,0])
    wz-->T431 ==> (wz = [car(wz),cdr(wz)]) & (car(wz) in Si) & (cdr(wz) in Si) & (cdr(wz) /= [0,0])
     (cdr(wz),cdr(y))-->T407(Stat2*) ==> cdr(y) ¥S_TIMES cdr(wz) /= [0,0]
   	ALGEBRA ==> (car(x) ¥S_TIMES cdr(w)) ¥S_PLUS (car(w) ¥S_TIMES cdr(x)) in Si
    	ALGEBRA ==> (cdr(x) ¥S_TIMES cdr(w)) in Si
   	ALGEBRA ==> (car(y) ¥S_TIMES cdr(wz)) ¥S_PLUS (car(wz) ¥S_TIMES cdr(y)) in Si
   	ALGEBRA ==> (cdr(y) ¥S_TIMES cdr(wz)) in Si
  	((car(x) ¥S_TIMES cdr(w)) ¥S_PLUS (car(w) ¥S_TIMES cdr(x)),cdr(x) ¥S_TIMES cdr(w))-->T432(*) ==>
   			[(car(x) ¥S_TIMES cdr(w)) ¥S_PLUS (car(w) ¥S_TIMES cdr(x)),cdr(x) ¥S_TIMES cdr(w)] in Fr
   	((car(y) ¥S_TIMES cdr(wz)) ¥S_PLUS (car(wz) ¥S_TIMES cdr(y)),cdr(y) ¥S_TIMES cdr(wz))-->T432(*) ==>
   		[(car(y) ¥S_TIMES cdr(wz)) ¥S_PLUS (car(wz) ¥S_TIMES cdr(y)),cdr(y) ¥S_TIMES cdr(wz)] in Fr
	(x,y,w,wz)-->T434 ==> Same_frac([(car(x) ¥S_TIMES cdr(w)) ¥S_PLUS (car(w) ¥S_TIMES cdr(x)),cdr(x) ¥S_TIMES cdr(w)],
			 [(car(y) ¥S_TIMES cdr(wz)) ¥S_PLUS (car(wz) ¥S_TIMES cdr(y)),cdr(y) ¥S_TIMES cdr(wz)])
	([(car(x) ¥S_TIMES cdr(w)) ¥S_PLUS (car(w) ¥S_TIMES cdr(x)),cdr(x) ¥S_TIMES cdr(w)],[(car(y) ¥S_TIMES cdr(wz)) ¥S_PLUS (car(wz) ¥S_TIMES cdr(y)),cdr(y) ¥S_TIMES cdr(wz)])-->T422 ==> false
   Discharge ==> QED
--
Theorem 436: [If two pairs of fractions are equivalent, their formal products are also equivalent] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) ¥imp
    Same_frac([car(X) ¥S_TIMES car(W),cdr(X) ¥S_TIMES cdr(W)],[car(Y) ¥S_TIMES car(Z),cdr(Y) ¥S_TIMES cdr(Z)]). Proof:
    Suppose_not(x,y,w,wz) ==> (x in Fr) & (y in Fr) & Same_frac(x,y) & (w in Fr) & (wz in Fr) & Same_frac(w,wz) &
	(not Same_frac([car(x) ¥S_TIMES car(w),cdr(x) ¥S_TIMES cdr(w)],[car(y) ¥S_TIMES car(wz),cdr(y) ¥S_TIMES cdr(wz)]))
    x-->T431 ==> (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si)
    y-->T431 ==> (y = [car(y),cdr(y)]) & (car(y) in Si) & (cdr(y) in Si)
    w-->T431 ==> (w = [car(w),cdr(w)]) & (car(w) in Si) & (cdr(w) in Si)
    wz-->T431 ==> (wz = [car(wz),cdr(wz)]) & (car(wz) in Si) & (cdr(wz) in Si)
    Use_def(Same_frac) ==> (car(x) ¥S_TIMES cdr(y) = cdr(x) ¥S_TIMES car(y)) &
    							(car(w) ¥S_TIMES cdr(wz) = cdr(w) ¥S_TIMES car(wz))
    Use_def(Same_frac) ==> Stat1:  (car([car(x) ¥S_TIMES car(w),cdr(x) ¥S_TIMES cdr(w)])) ¥S_TIMES
    							(cdr([car(y) ¥S_TIMES car(wz),cdr(y) ¥S_TIMES cdr(wz)])) /=
					(cdr([car(x) ¥S_TIMES car(w),cdr(x) ¥S_TIMES cdr(w)])) ¥S_TIMES
						(car([car(y) ¥S_TIMES car(wz),cdr(y) ¥S_TIMES cdr(wz)]))
    ELEM ==> car([car(x) ¥S_TIMES car(w),cdr(x) ¥S_TIMES cdr(w)]) = car(x) ¥S_TIMES car(w)
    ELEM ==> cdr([car(x) ¥S_TIMES car(w),cdr(x) ¥S_TIMES cdr(w)]) = cdr(x) ¥S_TIMES cdr(w)
    ELEM ==> car([car(y) ¥S_TIMES car(wz),cdr(y) ¥S_TIMES cdr(wz)]) = car(y) ¥S_TIMES car(wz)
    ELEM ==> cdr([car(y) ¥S_TIMES car(wz),cdr(y) ¥S_TIMES cdr(wz)]) = cdr(y) ¥S_TIMES cdr(wz)
    EQUAL(Stat1) ==> (car(x) ¥S_TIMES car(w)) ¥S_TIMES (cdr(y) ¥S_TIMES cdr(wz)) /=
			 (cdr(x) ¥S_TIMES cdr(w)) ¥S_TIMES (car(y) ¥S_TIMES car(wz))
    ALGEBRA ==> (car(x) ¥S_TIMES car(w)) ¥S_TIMES (cdr(y) ¥S_TIMES cdr(wz)) =
		(car(x) ¥S_TIMES cdr(y)) ¥S_TIMES (car(w) ¥S_TIMES cdr(wz))
    ALGEBRA ==> (cdr(x) ¥S_TIMES cdr(w)) ¥S_TIMES (car(y) ¥S_TIMES car(wz)) =
		(cdr(x) ¥S_TIMES car(y)) ¥S_TIMES (cdr(w) ¥S_TIMES car(wz))
    ELEM ==> (car(x) ¥S_TIMES cdr(y)) ¥S_TIMES (car(w) ¥S_TIMES cdr(wz)) /=
    			(cdr(x) ¥S_TIMES car(y)) ¥S_TIMES (cdr(w) ¥S_TIMES car(wz))
    EQUAL ==> false; Discharge ==> QED
--
-- The following corollary restates the preceding lemma in an obvious way.
--
Theorem 437: [If two pairs of fractions are equivalent, their formal sums define the same rational number] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) ¥imp
	(Fr_to_Ra([car(X) ¥S_TIMES car(W),cdr(X) ¥S_TIMES cdr(W)]) = Fr_to_Ra([car(Y) ¥S_TIMES car(Z),cdr(Y) ¥S_TIMES cdr(Z)])). Proof:
	Suppose_not(x,y,w,wz) ==> (x in Fr) & (y in Fr) & Same_frac(x,y) & (w in Fr) & (wz in Fr) & Same_frac(w,wz) &
	(Fr_to_Ra([car(x) ¥S_TIMES car(w),cdr(x) ¥S_TIMES cdr(w)]) /= Fr_to_Ra([car(y) ¥S_TIMES car(wz),cdr(y) ¥S_TIMES cdr(wz)]))
    x-->T431 ==> Stat1: (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])
    w-->T431 ==> (w = [car(w),cdr(w)]) & (car(w) in Si) & (cdr(w) in Si) & (cdr(w) /= [0,0])
    (cdr(w),cdr(x))-->T407(Stat1*) ==> cdr(x) ¥S_TIMES cdr(w) /= [0,0]
    y-->T431 ==> Stat2: (y = [car(y),cdr(y)]) & (car(y) in Si) & (cdr(y) in Si) & (cdr(y) /= [0,0])
    wz-->T431 ==> (wz = [car(wz),cdr(wz)]) & (car(wz) in Si) & (cdr(wz) in Si) & (cdr(wz) /= [0,0])
     (cdr(wz),cdr(y))-->T407(Stat2*) ==> cdr(y) ¥S_TIMES cdr(wz) /= [0,0]
   	ALGEBRA ==> (car(x) ¥S_TIMES car(w)) in Si
    ALGEBRA ==> (cdr(x) ¥S_TIMES cdr(w)) in Si
   	ALGEBRA ==> (car(y) ¥S_TIMES car(wz)) in Si
   	ALGEBRA ==> (cdr(y) ¥S_TIMES cdr(wz)) in Si
  	(car(x) ¥S_TIMES car(w),cdr(x) ¥S_TIMES cdr(w))-->T432(*) ==>
   			[car(x) ¥S_TIMES car(w),cdr(x) ¥S_TIMES cdr(w)] in Fr
   	(car(y) ¥S_TIMES car(wz),cdr(y) ¥S_TIMES cdr(wz))-->T432(*) ==>
   			[car(y) ¥S_TIMES car(wz),cdr(y) ¥S_TIMES cdr(wz)] in Fr
	(x,y,w,wz)-->T436 ==> Same_frac([car(x) ¥S_TIMES car(w),cdr(x) ¥S_TIMES cdr(w)],[car(y) ¥S_TIMES car(wz),cdr(y) ¥S_TIMES cdr(wz)])
	([car(x) ¥S_TIMES car(w),cdr(x) ¥S_TIMES cdr(w)],[car(y) ¥S_TIMES car(wz),cdr(y) ¥S_TIMES cdr(wz)])-->T422 ==> false
   	Discharge ==> QED
--
-- Our next lemma gives a variant of the formula for the sum of two rationals; this will be useful later.
--
Theorem 438: [The sum of a rational number and a formal fraction can be expressed as a sum of formal fractions] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) ¥imp (X ¥Ra_PLUS Fr_to_Ra([Y,Z]) =
    Fr_to_Ra([(car(arb(X)) ¥S_TIMES Z) ¥S_PLUS (cdr(arb(X)) ¥S_TIMES Y),(cdr(arb(X)) ¥S_TIMES Z)])). Proof:
    Suppose_not(x,y,wz) ==> (x in Ra) & (y in Si) & (wz in Si) & (wz /= [0,0]) & (x ¥Ra_PLUS Fr_to_Ra([y,wz]) /=
	Fr_to_Ra([(car(arb(x)) ¥S_TIMES wz) ¥S_PLUS (cdr(arb(x)) ¥S_TIMES y),cdr(arb(x)) ¥S_TIMES wz]))
--
-- For let $x,y,wz$ be a counterexample to our assertion. Since $x$ is  rational, both $arb(x)$ and $[y,wz]$ are fractions.
-- By Theorem 431, $[y,wz]$ is a fraction equivalent to the standard representative, $arb(Fr_to_Ra([y,wz]))$,
-- of its equivalence class.
--
	x-->T423 ==> Stat1: arb(x) in Fr
    (arb(x))-->T431 ==> (arb(x) = [car(arb(x)),cdr(arb(x))]) &
    						(car(arb(x)) in Si) & (cdr(arb(x)) in Si) & (cdr(arb(x)) /= [0,0])
    (y,wz)-->T432(*) ==> [y,wz] in Fr
    ([y,wz])-->T421 ==> Fr_to_Ra([y,wz]) in Ra
    (Fr_to_Ra([y,wz]))-->T433 ==> arb(Fr_to_Ra([y,wz])) in Fr
    ([y,wz])-->T421 ==> Same_frac([y,wz],arb(Fr_to_Ra([y,wz])))
    T418 ==> Stat2: (FORALL v in Fr, w in Fr | (Same_frac(v,w) ¥eq Same_frac(w,v)) & Same_frac(v,v))
    (arb(x),arb(x))-->Stat2(Stat1,Stat1) ==> Same_frac(arb(x),arb(x))
--
-- Using Theorem 435, we can therefore replace $arb(Fr_to_Ra([y,wz])$ by $[y,wz]$ in
-- the standard expression for the rational product seen below.
--
    Use_def(¥Ra_PLUS) ==> x ¥Ra_PLUS Fr_to_Ra([y,wz]) =
	Fr_to_Ra([(car(arb(x)) ¥S_TIMES cdr(arb(Fr_to_Ra([y,wz])))) ¥S_PLUS (car(arb(Fr_to_Ra([y,wz]))) ¥S_TIMES cdr(arb(x))),
				cdr(arb(x)) ¥S_TIMES cdr(arb(Fr_to_Ra([y,wz])))])
    (arb(x),arb(x),[y,wz],arb(Fr_to_Ra([y,wz])))-->T435 ==> Fr_to_Ra([(car(arb(x)) ¥S_TIMES cdr(arb(Fr_to_Ra([y,wz]))))
    			¥S_PLUS (car(arb(Fr_to_Ra([y,wz]))) ¥S_TIMES cdr(arb(x))),
				cdr(arb(x)) ¥S_TIMES cdr(arb(Fr_to_Ra([y,wz])))]) =
			Fr_to_Ra([(car(arb(x)) ¥S_TIMES cdr([y,wz])) ¥S_PLUS (car([y,wz]) ¥S_TIMES cdr(arb(x))),
				cdr(arb(x)) ¥S_TIMES cdr([y,wz])])
    ELEM ==> (cdr([y,wz]) = wz) & (car([y,wz]) = y)
    EQUAL ==> x ¥Ra_PLUS Fr_to_Ra([y,wz]) =
	 Fr_to_Ra([(car(arb(x)) ¥S_TIMES wz) ¥S_PLUS (y ¥S_TIMES cdr(arb(x))), cdr(arb(x)) ¥S_TIMES wz])
    ALGEBRA ==> y ¥S_TIMES cdr(arb(x)) = cdr(arb(x)) ¥S_TIMES y;
    EQUAL ==> false; Discharge ==> QED
--
Theorem 439: [The product of a rational number and a formal fraction can be expressed as a product of formal fractions] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) ¥imp (X ¥Ra_TIMES Fr_to_Ra([Y,Z]) =
			Fr_to_Ra([car(arb(X)) ¥S_TIMES Y,cdr(arb(X)) ¥S_TIMES Z])). Proof:
    Suppose_not(x,y,wz) ==> (x in Ra) & (y in Si) & (wz in Si) & (wz /= [0,0]) &
    	((x ¥Ra_TIMES Fr_to_Ra([y,wz])) /=  Fr_to_Ra([car(arb(x)) ¥S_TIMES y,cdr(arb(x)) ¥S_TIMES wz]))
    x-->T433 ==> (arb(x) = [car(arb(x)),cdr(arb(x))]) & (car(arb(x)) in Si) & (cdr(arb(x)) in Si) &( cdr(arb(x)) /= [0,0])
    (y,wz)-->T432(*) ==> [y,wz] in Fr
    ([y,wz])-->T421 ==> Fr_to_Ra([y,wz]) in Ra
    (Fr_to_Ra([y,wz]))-->T423 ==> arb(Fr_to_Ra([y,wz])) in Fr
    ([y,wz])-->T421 ==> Same_frac([y,wz],arb(Fr_to_Ra([y,wz])))
    x-->T423 ==> Stat1: arb(x) in Fr
    T418 ==> Stat2: (FORALL v in Fr, w in Fr | (Same_frac(v,w) ¥eq Same_frac(w,v)) & Same_frac(v,v))
    (arb(x),arb(x))-->Stat2(Stat1) ==> Same_frac(arb(x),arb(x))
    Use_def(¥Ra_TIMES) ==> x ¥Ra_TIMES Fr_to_Ra([y,wz]) =
	Fr_to_Ra([car(arb(x)) ¥S_TIMES car(arb(Fr_to_Ra([y,wz]))), cdr(arb(x)) ¥S_TIMES cdr(arb(Fr_to_Ra([y,wz])))])
    (arb(x),arb(x),[y,wz],arb(Fr_to_Ra([y,wz])))-->T437 ==> x ¥Ra_TIMES Fr_to_Ra([y,wz]) =
			 Fr_to_Ra([car(arb(x)) ¥S_TIMES car([y,wz]), cdr(arb(x)) ¥S_TIMES cdr([y,wz])])
    ELEM ==> (car([y,wz]) = y) & (cdr([y,wz]) = wz)
    EQUAL ==> x ¥Ra_TIMES Fr_to_Ra([y,wz]) =
			Fr_to_Ra([car(arb(x)) ¥S_TIMES y, cdr(arb(x)) ¥S_TIMES wz])
    Discharge ==> QED
--
Theorem 440: [Reversing both the numerator and denominator of a formal fraction does not change the rational it represents] (X in Fr) ¥imp Same_frac(X,[S_Rev(car(X)),S_Rev(cdr(X))]). Proof:
    Suppose_not(x) ==> (x in Fr) & (not Same_frac(x,[S_Rev(car(x)),S_Rev(cdr(x))]))
    x-->T431 ==> (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])
    Use_def(Same_frac) ==> Stat1: car(x) ¥S_TIMES cdr([S_Rev(car(x)),S_Rev(cdr(x))]) /=
    							cdr(x) ¥S_TIMES car([S_Rev(car(x)),S_Rev(cdr(x))])
    (car(x),cdr(x))-->T390 ==> car(x) ¥S_TIMES S_Rev(cdr(x)) = S_Rev(car(x) ¥S_TIMES cdr(x))
    (cdr(x),car(x))-->T390 ==> cdr(x) ¥S_TIMES S_Rev(car(x)) = S_Rev(cdr(x) ¥S_TIMES car(x))
    (Stat1)ELEM ==> S_Rev(car(x) ¥S_TIMES cdr(x)) /= S_Rev(cdr(x) ¥S_TIMES car(x))
    ALGEBRA ==> false; Discharge ==> QED
--
-- Next we show that if two fractions, both with positive denominators, are equivalent,
-- then one is has a non-negative numerator if and only if the other does. This lemma
-- prepares for the proof of the more general statement given by Theorem 444 below.
--
Theorem 441: [?] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & is_nonneg(cdr(X)) & is_nonneg(cdr(Y))) ¥imp
	((is_nonneg(car(X)) or car(X) = [0,0]) ¥eq (is_nonneg(car(Y)) or car(Y) = [0,0])). Proof:
    Suppose_not(x,y) ==> Stat1: (x in Fr) & (y in Fr) & Same_frac(x,y) & is_nonneg(cdr(x)) & is_nonneg(cdr(y)) &
	(not ((is_nonneg(car(x)) or car(x) = [0,0]) ¥eq (is_nonneg(car(y)) or car(y) = [0,0])))
--
-- For consider a counterexample x,y. It is easily seen that if one of the fractions is zero so is the other.
-- Hence we have only to consider the case in which one of the  fractions, say x, has a positive numerator and the
-- other has a negative numerator.
--
    x-->T431 ==> (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])
    y-->T431 ==> (y = [car(y),cdr(y)]) & (car(y) in Si) & (cdr(y) in Si) & (cdr(y) /= [0,0])
    Use_def(Same_frac) ==> Stat2: car(x) ¥S_TIMES cdr(y) = cdr(x) ¥S_TIMES car(y)
    Suppose ==> car(x) = [0,0]
    EQUAL ==> [0,0] ¥S_TIMES cdr(y) = cdr(x) ¥S_TIMES car(y)
    (cdr(y))-->T401 ==> cdr(x) ¥S_TIMES car(y) = [0,0]
    (car(y),cdr(x))-->T407(Stat1*) ==> car(y) = [0,0]
    Discharge ==> Stat3: car(x) /= [0,0]
    Suppose ==> car(y) = [0,0]
    EQUAL ==> car(x) ¥S_TIMES cdr(y) = cdr(x) ¥S_TIMES [0,0]
    ALGEBRA ==> car(x) ¥S_TIMES cdr(y) = [0,0] ¥S_TIMES cdr(x)
    (cdr(x))-->T401 ==> car(x) ¥S_TIMES cdr(y) = [0,0]
    (cdr(y),car(x))-->T407(Stat1*) ==> car(x) = [0,0]
    Discharge ==> Stat4: car(y) /= [0,0]
    (Stat1,Stat3,Stat4)ELEM ==> not (is_nonneg(car(x)) ¥eq is_nonneg(car(y)))
    ALGEBRA ==> (cdr(x) ¥S_TIMES car(y) in Si) & (car(x) ¥S_TIMES cdr(y) in Si)
--
-- In this case, Theorem 424 tells us that S_Rev(car(y)) must be non-negative.
-- A bit of algebra now shows that both car(x) ¥S_TIMES cdr(y) and S_Rev(car(x) ¥S_TIMES cdr(y))
-- must be non-negative. Hence car(x) ¥S_TIMES cdr(y) must be zero,
-- and therefore car(x) must also be zero by Theorem 407.
--
    Suppose ==> Stat5: is_nonneg(car(x))
    ELEM ==> not is_nonneg(car(y))
    (car(x),cdr(y))-->T425 ==> is_nonneg(car(x) ¥S_TIMES cdr(y))
    (car(y))-->T424 ==> is_nonneg(S_Rev(car(y)))
    (car(y))-->T391 ==> S_Rev(car(y)) in Si
    (cdr(x),S_Rev(car(y)))-->T425 ==> is_nonneg(cdr(x) ¥S_TIMES S_Rev(car(y)))
    ALGEBRA ==> Stat6: is_nonneg(S_Rev(cdr(x) ¥S_TIMES car(y)))
    EQUAL(Stat2,Stat6) ==> is_nonneg(S_Rev(car(x) ¥S_TIMES cdr(y)))
    (car(x) ¥S_TIMES cdr(y))-->T424 ==> car(x) ¥S_TIMES cdr(y) = [0,0]
    (cdr(y),car(x))-->T407(Stat1*) ==> false; Discharge ==> Stat7: (not is_nonneg(car(x))) & is_nonneg(car(y))
    (cdr(x),car(y))-->T425 ==> is_nonneg(cdr(x) ¥S_TIMES car(y))
    (car(x))-->T424 ==> is_nonneg(S_Rev(car(x)))
    (car(x))-->T391 ==> S_Rev(car(x)) in Si
    (cdr(y),S_Rev(car(x)))-->T425 ==> is_nonneg(cdr(y) ¥S_TIMES S_Rev(car(x)))
    ALGEBRA ==> Stat8: is_nonneg(S_Rev(car(x) ¥S_TIMES cdr(y)))
    EQUAL(Stat2,Stat8) ==> is_nonneg(S_Rev(cdr(x) ¥S_TIMES car(y)))
    (cdr(x) ¥S_TIMES car(y))-->T424 ==> cdr(x) ¥S_TIMES car(y) = [0,0]
    (car(y),cdr(x))-->T407(Stat1*) ==> false; Discharge ==> QED
--
-- The following theorem generalizes the preceding result by showing that if one of two equivalent
-- fractions is non-negative, so is the other.
--
Theorem 442: [The sign of the product of the numerator and denominator of a fraction defines the sign of the rational number which it represents]
    ((X in Fr) & (Y in Fr) & Same_frac(X,Y)) ¥imp (is_nonneg(car(X) ¥S_TIMES cdr(X)) ¥eq is_nonneg(car(Y) ¥S_TIMES cdr(Y))).   Proof:
	Suppose_not(x,y) ==> Stat1: (x in Fr) & (y in Fr) & Same_frac(x,y) &
	(not (is_nonneg(car(x) ¥S_TIMES cdr(x)) ¥eq is_nonneg(car(y) ¥S_TIMES cdr(y))))
    x-->T431 ==> (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])
    y-->T431 ==> (y = [car(y),cdr(y)]) & (car(y) in Si) & (cdr(y) in Si) & (cdr(y) /= [0,0])
    Loc_def ==> ax = car(x)
    Loc_def ==> dx = cdr(x)
    Loc_def ==> ay = car(y)
    Loc_def ==> dy = cdr(y)
    EQUAL ==> (dx /= [0,0]) & (dy /= [0,0])
    Use_def(Same_frac) ==> car(x) ¥S_TIMES cdr(y) = cdr(x) ¥S_TIMES car(y)
    EQUAL ==> ax ¥S_TIMES dy = dx ¥S_TIMES ay
    EQUAL ==> Stat2: (ax in Si) & (dx in Si) & (ay in Si) & (dy in Si)
    EQUAL ==> (ax ¥S_TIMES dy) ¥S_TIMES (dx ¥S_TIMES dy) = (dx ¥S_TIMES ay) ¥S_TIMES (dx ¥S_TIMES dy)
    EQUAL ==> not (is_nonneg(ax ¥S_TIMES dx) ¥eq is_nonneg(ay ¥S_TIMES dy))
    ALGEBRA(Stat2) ==> (dy ¥S_TIMES dy) ¥S_TIMES (ax ¥S_TIMES dx) = (dx ¥S_TIMES dx) ¥S_TIMES (ay ¥S_TIMES dy)
    EQUAL ==> is_nonneg((dy ¥S_TIMES dy) ¥S_TIMES (ax ¥S_TIMES dx)) ¥eq is_nonneg((dx ¥S_TIMES dx) ¥S_TIMES (ay ¥S_TIMES dy))
    dx-->T429 ==> is_nonneg(dx ¥S_TIMES dx)
    dy-->T429 ==> is_nonneg(dy ¥S_TIMES dy)
    (dx,dx)-->T407(Stat1*) ==> dx ¥S_TIMES dx /= [0,0]
    (dy,dy)-->T407(Stat1*) ==> dy ¥S_TIMES dy /= [0,0]
    ALGEBRA ==> (dx ¥S_TIMES dx in Si) & (ay ¥S_TIMES dy in Si)
    ALGEBRA ==> (dy ¥S_TIMES dy in Si) & (ax ¥S_TIMES dx in Si)
    (dy ¥S_TIMES dy,ax ¥S_TIMES dx)-->T430 ==>
	is_nonneg((dy ¥S_TIMES dy) ¥S_TIMES (ax ¥S_TIMES dx)) ¥eq is_nonneg(ax ¥S_TIMES dx)
    (dx ¥S_TIMES dx,ay ¥S_TIMES dy)-->T430 ==>
	is_nonneg((dx ¥S_TIMES dx) ¥S_TIMES (ay ¥S_TIMES dy)) ¥eq is_nonneg(ay ¥S_TIMES dy)
    Discharge ==> QED
--
Theorem 443: [?] (X in Fr) ¥imp (Fr_is_nonneg(X) ¥eq Fr_is_nonneg([S_Rev(car(X)),S_Rev(cdr(X))])). Proof:
    Suppose_not(n) ==> Stat1: (n in Fr) & (not(Fr_is_nonneg(n) ¥eq Fr_is_nonneg([S_Rev(car(n)),S_Rev(cdr(n))])))
    n-->T431 ==> (n = [car(n),cdr(n)]) & (car(n) in Si) & (cdr(n) in Si) & (cdr(n) /= [0,0])
    Use_def(Fr_is_nonneg) ==> Stat2: Fr_is_nonneg(n) ¥eq is_nonneg(car(n) ¥S_TIMES cdr(n))
    Use_def(Fr_is_nonneg) ==> Stat3: Fr_is_nonneg([S_Rev(car(n)),S_Rev(cdr(n))]) ¥eq
    		is_nonneg(car([S_Rev(car(n)),S_Rev(cdr(n))]) ¥S_TIMES cdr([S_Rev(car(n)),S_Rev(cdr(n))]))
    (Stat1,Stat2,Stat3*)ELEM ==>
    	not((is_nonneg(car([S_Rev(car(n)),S_Rev(cdr(n))]) ¥S_TIMES cdr([S_Rev(car(n)),S_Rev(cdr(n))]))) ¥eq
    							(is_nonneg(car(n) ¥S_TIMES cdr(n))))
    (car(n))-->T391 ==> S_Rev(car(n)) in Si
    (cdr(n))-->T391 ==> S_Rev(cdr(n)) in Si
 	ELEM ==> car([S_Rev(car(n)),S_Rev(cdr(n))]) = S_Rev(car(n))
  	ELEM ==> cdr([S_Rev(car(n)),S_Rev(cdr(n))]) = S_Rev(cdr(n))
  	EQUAL ==> Stat4: not(is_nonneg(S_Rev(car(n)) ¥S_TIMES S_Rev(cdr(n))) ¥eq (is_nonneg(car(n) ¥S_TIMES cdr(n))))
    ALGEBRA ==> S_Rev(car(n)) ¥S_TIMES S_Rev(cdr(n)) = car(n) ¥S_TIMES cdr(n)
    EQUAL(Stat4) ==> false; Discharge ==> QED
--
-- Next we show that if two fractions, both with positive denominators, are equivalent,
-- then one has a non-negative numerator if and only if the other does.
--
Theorem 444: [?] ((X in Fr) & (Y in Fr) & Same_frac(X,Y)) ¥imp (Fr_is_nonneg(X) ¥eq Fr_is_nonneg(Y)). Proof:
    Suppose_not(n,m) ==> Stat1: (n in Fr) & (m in Fr) & Same_frac(n,m) & (not(Fr_is_nonneg(n) ¥eq Fr_is_nonneg(m)))
    n-->T431 ==> (n = [car(n),cdr(n)]) & (car(n) in Si) & (cdr(n) in Si) & (cdr(n) /= [0,0])
    m-->T431 ==> (m = [car(m),cdr(m)]) & (car(m) in Si) & (cdr(m) in Si) & (cdr(m) /= [0,0])
    Use_def(Fr_is_nonneg) ==> (not (is_nonneg(car(n) ¥S_TIMES cdr(n)) ¥eq is_nonneg(car(m) ¥S_TIMES cdr(m))))
    Use_def(Same_frac) ==> car(n) ¥S_TIMES cdr(m) = cdr(n) ¥S_TIMES car(m)
	EQUAL ==> (car(n) ¥S_TIMES cdr(m)) ¥S_TIMES (cdr(n) ¥S_TIMES cdr(m))  =
		(cdr(n) ¥S_TIMES car(m)) ¥S_TIMES (cdr(n) ¥S_TIMES cdr(m))
	ALGEBRA ==> Stat2: (car(n) ¥S_TIMES cdr(n) in Si) & (car(m) ¥S_TIMES cdr(m) in Si)
	ALGEBRA ==> Stat3: (cdr(n) ¥S_TIMES cdr(n) in Si) & (cdr(m) ¥S_TIMES cdr(m) in Si)
	ALGEBRA ==> (cdr(m) ¥S_TIMES cdr(m)) ¥S_TIMES (car(n) ¥S_TIMES cdr(n)) =
			(cdr(n) ¥S_TIMES cdr(n)) ¥S_TIMES (car(m) ¥S_TIMES cdr(m))
	(cdr(n))-->T429 ==> Stat4: is_nonneg(cdr(n) ¥S_TIMES cdr(n))
	(cdr(m))-->T429 ==> Stat5: is_nonneg(cdr(m) ¥S_TIMES cdr(m))
	(cdr(n),cdr(n))-->T407(Stat1*) ==> Stat6: cdr(n) ¥S_TIMES cdr(n) /= [0,0]
	(cdr(m),cdr(m))-->T407(Stat1*) ==> Stat7: cdr(m) ¥S_TIMES cdr(m) /= [0,0]
	(cdr(m) ¥S_TIMES cdr(m),car(n) ¥S_TIMES cdr(n))-->T430(Stat2,Stat3,Stat5,Stat7) ==>
	is_nonneg((cdr(m) ¥S_TIMES cdr(m)) ¥S_TIMES (car(n) ¥S_TIMES cdr(n))) ¥eq is_nonneg(car(n) ¥S_TIMES cdr(n))
	(cdr(n) ¥S_TIMES cdr(n),car(m) ¥S_TIMES cdr(m))-->T430(Stat2,Stat3,Stat4,Stat6) ==>
	is_nonneg((cdr(n) ¥S_TIMES cdr(n)) ¥S_TIMES (car(m) ¥S_TIMES cdr(m))) ¥eq is_nonneg(car(m) ¥S_TIMES cdr(m))
	EQUAL ==> false; Discharge ==> QED
--
-- Now we are in position to begin consideration of the algebra of rational numbers.
-- As a first result  of this kind we prove the commutative law for rational numbers.
--
Theorem 445: [Commutativity of rational addition] ((N in Ra) & (M in Ra)) ¥imp
	((N ¥Ra_PLUS M in Ra) & (N ¥Ra_PLUS M = M ¥Ra_PLUS N)). Proof:
    Suppose_not(n,m) ==> (n in Ra) & (m in Ra) & ((n ¥Ra_PLUS m notin Ra) or (n ¥Ra_PLUS m /= m ¥Ra_PLUS n))
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(n))-->T431 ==>
	Stat1: (arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
    (arb(m))-->T431 ==>
	Stat2: (arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
	Suppose ==> Stat3: n ¥Ra_PLUS m notin Ra
	Use_def(¥Ra_PLUS) ==> Fr_to_Ra([(car(arb(n)) ¥S_TIMES cdr(arb(m))) ¥S_PLUS (car(arb(m)) ¥S_TIMES cdr(arb(n))),
				cdr(arb(n)) ¥S_TIMES cdr(arb(m))]) notin Ra
    T420 ==> Stat4: (FORALL x | (x in Fr) ¥imp (Fr_to_Ra(x) in Ra))
    ([(car(arb(n)) ¥S_TIMES cdr(arb(m))) ¥S_PLUS (car(arb(m)) ¥S_TIMES cdr(arb(n))),cdr(arb(n)) ¥S_TIMES cdr(arb(m))])-->Stat4(Stat3) ==>
	[(car(arb(n)) ¥S_TIMES cdr(arb(m))) ¥S_PLUS (car(arb(m)) ¥S_TIMES cdr(arb(n))),
				cdr(arb(n)) ¥S_TIMES cdr(arb(m))] notin Fr
    ALGEBRA ==> (car(arb(n)) ¥S_TIMES cdr(arb(m))) ¥S_PLUS (car(arb(m)) ¥S_TIMES cdr(arb(n))) in Si
    ALGEBRA ==> cdr(arb(n)) ¥S_TIMES cdr(arb(m)) in Si
    (cdr(arb(m)),cdr(arb(n)))-->T407(Stat1,Stat2*) ==> cdr(arb(n)) ¥S_TIMES cdr(arb(m)) /= [0,0]
    ([(car(arb(n)) ¥S_TIMES cdr(arb(m))) ¥S_PLUS (car(arb(m)) ¥S_TIMES cdr(arb(n))),cdr(arb(n)) ¥S_TIMES cdr(arb(m))])-->T431 ==> false; Discharge ==> (n ¥Ra_PLUS m /= m ¥Ra_PLUS n)
    Use_def(¥Ra_PLUS) ==> Fr_to_Ra([(car(arb(m)) ¥S_TIMES cdr(arb(n))) ¥S_PLUS (car(arb(n)) ¥S_TIMES cdr(arb(m))),
				cdr(arb(m)) ¥S_TIMES cdr(arb(n))]) /=
	Fr_to_Ra([(car(arb(n)) ¥S_TIMES cdr(arb(m))) ¥S_PLUS (car(arb(m)) ¥S_TIMES cdr(arb(n))),
				cdr(arb(n)) ¥S_TIMES cdr(arb(m))])
    ALGEBRA ==> false; Discharge ==> QED
--
-- The following corollary of Theorem 438 expresses the sum of two rationals,
-- one of them derived explicitly from a fraction, in a form that is sometimes convenient.
--
Theorem 446: [?] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) ¥imp (Fr_to_Ra([Y,Z]) ¥Ra_PLUS X =
    Fr_to_Ra([(car(arb(X)) ¥S_TIMES Z) ¥S_PLUS (cdr(arb(X)) ¥S_TIMES Y),(cdr(arb(X)) ¥S_TIMES Z)])). Proof:
    Suppose_not(x,y,z) ==> AUTO
    (x,y,z)-->T438 ==> Fr_to_Ra([y,z]) ¥Ra_PLUS x /= x ¥Ra_PLUS Fr_to_Ra([y,z])
    (y,z)-->T432(*) ==> [y,z] in Fr
    ([y,z])-->T421 ==> Fr_to_Ra([y,z]) in Ra
    (x,Fr_to_Ra([y,z]))-->T445 ==> false; Discharge ==> QED
--
-- Next we express the sum of two rationals, both derived explicitly from a fraction, in a convenient form.
--
Theorem 447: [?] ((X in Si) & (Y in Si) & (Z in Si) & (W in Si) & (Y /= [0,0]) & (W /= [0,0])) ¥imp
  (Fr_to_Ra([X,Y]) ¥Ra_PLUS Fr_to_Ra([Z,W]) = Fr_to_Ra([(X ¥S_TIMES W) ¥S_PLUS (Z ¥S_TIMES Y),Y ¥S_TIMES W])). Proof:
    Suppose_not(x,y,wz,w) ==> (x in Si) & (y in Si) & (wz in Si) & (w in Si) & (y /= [0,0]) & (w /= [0,0]) &
	(Fr_to_Ra([x,y]) ¥Ra_PLUS Fr_to_Ra([wz,w]) /=
			Fr_to_Ra([(x ¥S_TIMES w) ¥S_PLUS (wz ¥S_TIMES y),y ¥S_TIMES w]))
    (x,y)-->T432(*) ==> [x,y] in Fr
    ([x,y])-->T421 ==> Fr_to_Ra([x,y]) in Ra
    (Fr_to_Ra([x,y]))-->T433 ==> arb(Fr_to_Ra([x,y])) in Fr
    (arb(Fr_to_Ra([x,y])))-->T431 ==> cdr(arb(Fr_to_Ra([x,y]))) in Si
    ([x,y])-->T421 ==> Same_frac([x,y],arb(Fr_to_Ra([x,y])))
	(Fr_to_Ra([x,y]),wz,w)-->T438 ==> (Fr_to_Ra([x,y]) ¥Ra_PLUS Fr_to_Ra([wz,w])) =
    		Fr_to_Ra([(car(arb(Fr_to_Ra([x,y]))) ¥S_TIMES w) ¥S_PLUS (cdr(arb(Fr_to_Ra([x,y]))) ¥S_TIMES wz),
    										cdr(arb(Fr_to_Ra([x,y]))) ¥S_TIMES w])
    (wz,w)-->T432(*) ==> Stat1: [wz,w] in Fr
    T418 ==> Stat2: (FORALL v in Fr, u in Fr | (Same_frac(v,u) ¥eq Same_frac(u,v)) & Same_frac(v,v))
      ([wz,w],[wz,w])-->Stat2 ==> Same_frac([wz,w],[wz,w])
 	([x,y],arb(Fr_to_Ra([x,y])),[wz,w],[wz,w])-->T435 ==>
	Fr_to_Ra([(car([x,y]) ¥S_TIMES cdr([wz,w])) ¥S_PLUS (car([wz,w]) ¥S_TIMES cdr([x,y])),
				cdr([x,y]) ¥S_TIMES cdr([wz,w])]) =
	Fr_to_Ra([(car(arb(Fr_to_Ra([x,y]))) ¥S_TIMES cdr([wz,w])) ¥S_PLUS (car([wz,w]) ¥S_TIMES cdr(arb(Fr_to_Ra([x,y])))),
	cdr(arb(Fr_to_Ra([x,y]))) ¥S_TIMES cdr([wz,w])])
	 ELEM ==> (car([x,y]) = x) & (cdr([x,y]) = y) & (car([wz,w]) = wz) & (cdr([wz,w]) = w)
	 (wz,cdr(arb(Fr_to_Ra([x,y]))))-->T384 ==>
	 		(wz ¥S_TIMES cdr(arb(Fr_to_Ra([x,y])))) = (cdr(arb(Fr_to_Ra([x,y]))) ¥S_TIMES wz)
	 EQUAL ==> Fr_to_Ra([(x ¥S_TIMES w) ¥S_PLUS (wz ¥S_TIMES y),y ¥S_TIMES w]) =
	Fr_to_Ra([(car(arb(Fr_to_Ra([x,y]))) ¥S_TIMES w) ¥S_PLUS (cdr(arb(Fr_to_Ra([x,y]))) ¥S_TIMES wz),
	cdr(arb(Fr_to_Ra([x,y]))) ¥S_TIMES w])
     Discharge ==> QED
--
-- The proof that rational multiplication is commutative is also elementary and algebraic.
--
Theorem 448: [Commutativity of rational multiplication] ((N in Ra) & (M in Ra)) ¥imp
		((N ¥Ra_TIMES M in Ra) & (N ¥Ra_TIMES M = M ¥Ra_TIMES N)). Proof:
    Suppose_not(n,m) ==> (n in Ra) & (m in Ra) & ((n ¥Ra_TIMES m notin Ra) or n ¥Ra_TIMES m /= m ¥Ra_TIMES n)
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(n))-->T431 ==>
	Stat1: (arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
    (arb(m))-->T431 ==>
	Stat2: (arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
	Suppose ==> Stat3: (n ¥Ra_TIMES m) notin Ra
	Use_def(¥Ra_TIMES) ==> Fr_to_Ra([car(arb(n)) ¥S_TIMES car(arb(m)),cdr(arb(n)) ¥S_TIMES cdr(arb(m))]) notin Ra
    T420 ==> Stat4: (FORALL x | (x in Fr) ¥imp (Fr_to_Ra(x) in Ra))
    ([car(arb(n)) ¥S_TIMES car(arb(m)),cdr(arb(n)) ¥S_TIMES cdr(arb(m))])-->Stat4(Stat3) ==>
	[car(arb(n)) ¥S_TIMES car(arb(m)),cdr(arb(n)) ¥S_TIMES cdr(arb(m))] notin Fr
    ALGEBRA ==> car(arb(n)) ¥S_TIMES car(arb(m)) in Si
    ALGEBRA ==> cdr(arb(n)) ¥S_TIMES cdr(arb(m)) in Si
    (cdr(arb(m)),cdr(arb(n)))-->T407(Stat1,Stat2*) ==> cdr(arb(n)) ¥S_TIMES cdr(arb(m)) /= [0,0]
    ([car(arb(n)) ¥S_TIMES car(arb(m)),cdr(arb(n)) ¥S_TIMES cdr(arb(m))])-->T431 ==> false; Discharge ==> (n ¥Ra_TIMES m /= m ¥Ra_TIMES n)
    Use_def(¥Ra_TIMES) ==> Fr_to_Ra([car(arb(m)) ¥S_TIMES car(arb(n)),cdr(arb(m)) ¥S_TIMES cdr(arb(n))]) /=
	Fr_to_Ra([car(arb(n)) ¥S_TIMES car(arb(m)),cdr(arb(n)) ¥S_TIMES cdr(arb(m))])
    ALGEBRA ==> false; Discharge ==> QED
--
Theorem 449: [?] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) ¥imp
	((Fr_to_Ra([Y,Z]) ¥Ra_TIMES X) =
			Fr_to_Ra([car(arb(X)) ¥S_TIMES Y,cdr(arb(X)) ¥S_TIMES Z])). Proof:
    Suppose_not(x,y,wz) ==> (x in Ra) & (y in Si) & (wz in Si) & (wz /= [0,0]) &
    			((Fr_to_Ra([y,wz]) ¥Ra_TIMES x) /=
	 				Fr_to_Ra([car(arb(x)) ¥S_TIMES y,cdr(arb(x)) ¥S_TIMES wz]))
    (x,y,wz)-->T439 ==> (x ¥Ra_TIMES Fr_to_Ra([y,wz])) = Fr_to_Ra([car(arb(x)) ¥S_TIMES y,cdr(arb(x)) ¥S_TIMES wz])
    (y,wz)-->T432(*) ==> [y,wz] in Fr
    ([y,wz])-->T421 ==> Fr_to_Ra([y,wz]) in Ra
    (x,Fr_to_Ra([y,wz]))-->T448 ==> false; Discharge ==> QED
--
-- Next we prove the associative law for rational addition.
--
Theorem 450: [Associative law for rational addition] ((K in Ra) & (N in Ra) & (M in Ra)) ¥imp (N ¥Ra_PLUS (M ¥Ra_PLUS K) = (N ¥Ra_PLUS M) ¥Ra_PLUS K). Proof:
    Suppose_not(k,n,m) ==> Stat1: (k in Ra) & (n in Ra) & (m in Ra) & (n ¥Ra_PLUS (m ¥Ra_PLUS k) /= (n ¥Ra_PLUS m) ¥Ra_PLUS k)
--
-- For let $k,n,m$ be a counterexample to our assertion, so that $arb(k) = [ak,dk]$, $arb(n) = [an,dn]$, $arb(m) = [am,dm]$
-- are fractions with signed integer numerators and denominators.
--
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    Loc_def ==> arn = arb(n)
    EQUAL ==> (arn in Fr) & (Fr_to_Ra(arn) = n)
    Loc_def ==> an = car(arn)
    Loc_def ==> dn = cdr(arn)
    (arn)-->T431 ==> (arn = [car(arn),cdr(arn)]) & (car(arn) in Si) & (cdr(arn) in Si) & (cdr(arn) /= [0,0])
    EQUAL ==> Stat2: (arn = [an,dn]) & (an in Si) & (dn in Si) & (dn /= [0,0])
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    Loc_def ==> arm = arb(m)
  	EQUAL ==> (arm in Fr) & (Fr_to_Ra(arm) = m)
    Loc_def ==> am = car(arm)
    Loc_def ==> dm = cdr(arm)
    (arm)-->T431 ==> (arm = [car(arm),cdr(arm)]) & (car(arm) in Si) & (cdr(arm) in Si) & (cdr(arm) /= [0,0])
    EQUAL ==> Stat3: (arm = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    k-->T423 ==> (arb(k) in Fr) & (Fr_to_Ra(arb(k)) = k)
    Loc_def ==> ark = arb(k)
    EQUAL ==> (ark in Fr) & (Fr_to_Ra(ark) = k)
    Loc_def ==> ak = car(ark)
    Loc_def ==> dk = cdr(ark)
    (ark)-->T431 ==> (ark = [car(ark),cdr(ark)]) & (car(ark) in Si) & (cdr(ark) in Si) & (cdr(ark) /= [0,0])
    EQUAL ==> Stat4: (ark = [ak,dk]) & (ak in Si) & (dk in Si) & (dk /= [0,0])
    (dk,dm)-->T407(Stat4,Stat3*) ==> dm ¥S_TIMES dk /= [0,0]
--
-- By definition of rational addition, $Fr_to_Ra([(am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm),dm ¥S_TIMES dk]) = m + k$
-- and $Fr_to_Ra([(an ¥S_TIMES dm) ¥S_PLUS (am ¥S_TIMES dn),dn ¥S_TIMES dm]) = n + m$, so that the negative
-- of our associative law can be written in the manner seen below.
--
    Use_def(¥Ra_PLUS) ==> m ¥Ra_PLUS k =
    	Fr_to_Ra([(car(arb(m)) ¥S_TIMES cdr(arb(k))) ¥S_PLUS (car(arb(k)) ¥S_TIMES cdr(arb(m))),
    				cdr(arb(m)) ¥S_TIMES cdr(arb(k))])
    EQUAL ==> m ¥Ra_PLUS k = Fr_to_Ra([(am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm),dm ¥S_TIMES dk])
    Use_def(¥Ra_PLUS)(Stat2) ==> n ¥Ra_PLUS m =
    	Fr_to_Ra([(car(arb(n)) ¥S_TIMES cdr(arb(m))) ¥S_PLUS (car(arb(m)) ¥S_TIMES cdr(arb(n))),
    				cdr(arb(n)) ¥S_TIMES cdr(arb(m))])
    EQUAL ==> n ¥Ra_PLUS m = Fr_to_Ra([(an ¥S_TIMES dm) ¥S_PLUS (am ¥S_TIMES dn),dn ¥S_TIMES dm])
    EQUAL ==> n ¥Ra_PLUS Fr_to_Ra([(am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm),dm ¥S_TIMES dk]) /=
					Fr_to_Ra([(an ¥S_TIMES dm) ¥S_PLUS (am ¥S_TIMES dn),dn ¥S_TIMES dm]) ¥Ra_PLUS k
    ALGEBRA ==> Stat5: ((am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm) in Si) & ((dm ¥S_TIMES dk) in Si) &
	((an ¥S_TIMES dm) ¥S_PLUS (am ¥S_TIMES dn) in Si) & ((dn ¥S_TIMES dm) in Si)
   (dm,dk)-->T407 ==> Stat6: dm ¥S_TIMES dk /= [0,0]
    (n,(am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm),dm ¥S_TIMES dk)-->T438(Stat1,Stat5,Stat6) ==>
	Fr_to_Ra([(car(arb(n)) ¥S_TIMES (dm ¥S_TIMES dk)) ¥S_PLUS
	(cdr(arb(n)) ¥S_TIMES ((am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm))), cdr(arb(n)) ¥S_TIMES (dm ¥S_TIMES dk)])
			= (n ¥Ra_PLUS Fr_to_Ra([(am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm),dm ¥S_TIMES dk]))
    EQUAL ==>  Fr_to_Ra([(an ¥S_TIMES (dm ¥S_TIMES dk)) ¥S_PLUS
	(dn ¥S_TIMES ((am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm))), dn ¥S_TIMES (dm ¥S_TIMES dk)])
			= n ¥Ra_PLUS (m ¥Ra_PLUS k)
   (dm,dn)-->T407(Stat2,Stat3*) ==> Stat7: dn ¥S_TIMES dm /= [0,0]
 	(k,(an ¥S_TIMES dm) ¥S_PLUS (am ¥S_TIMES dn),dn ¥S_TIMES dm)-->T446(Stat1,Stat5,Stat7) ==>
	Fr_to_Ra([(an ¥S_TIMES dm) ¥S_PLUS (am ¥S_TIMES dn),dn ¥S_TIMES dm]) ¥Ra_PLUS k =
    		Fr_to_Ra([(car(arb(k)) ¥S_TIMES (dn ¥S_TIMES dm)) ¥S_PLUS (cdr(arb(k)) ¥S_TIMES
    			((an ¥S_TIMES dm) ¥S_PLUS (am ¥S_TIMES dn))),(cdr(arb(k)) ¥S_TIMES (dn ¥S_TIMES dm))])
    EQUAL ==> (n ¥Ra_PLUS m) ¥Ra_PLUS k =
    		Fr_to_Ra([(ak ¥S_TIMES (dn ¥S_TIMES dm)) ¥S_PLUS
    			(dk ¥S_TIMES ((an ¥S_TIMES dm) ¥S_PLUS (am ¥S_TIMES dn))),(dk ¥S_TIMES (dn ¥S_TIMES dm))])
    ELEM ==> Fr_to_Ra([(an ¥S_TIMES (dm ¥S_TIMES dk)) ¥S_PLUS
	(dn ¥S_TIMES ((am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm))), dn ¥S_TIMES (dm ¥S_TIMES dk)]) /=
    	Fr_to_Ra([(ak ¥S_TIMES (dn ¥S_TIMES dm)) ¥S_PLUS
    			(dk ¥S_TIMES ((an ¥S_TIMES dm) ¥S_PLUS (am ¥S_TIMES dn))),(dk ¥S_TIMES (dn ¥S_TIMES dm))])
    ALGEBRA ==> false; Discharge ==> QED
--
Theorem 451: [The zero rational is the identity for rational addition] (Ra_0 in Ra) & (Ra_1 in Ra) & ((M in Ra) ¥imp (M = M ¥Ra_PLUS Ra_0)). Proof:
    Suppose_not(m) ==> Stat1: (Ra_0 notin Ra) or (Ra_1 notin Ra) or ((m in Ra) & (m /= m ¥Ra_PLUS Ra_0))
    T368 ==> Stat2: ([0,0] in Si) & ([1,0] in Si)
    T212 ==> Stat3: 1 /= 0
    (Stat2)ELEM ==> ([[0,0],[1,0]] = [car([[0,0],[1,0]]),cdr([[0,0],[1,0]])]) &
    		(car([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) /= [0,0])
    ([0,0],[1,0])-->T432(*) ==> [[0,0],[1,0]] in Fr
    ([[0,0],[1,0]])-->T421 ==> Fr_to_Ra([[0,0],[1,0]]) in Ra
    Use_def(Ra_0) ==> Stat4: Ra_0 in Ra
    (Stat2)ELEM ==> ([[1,0],[1,0]] = [car([[1,0],[1,0]]),cdr([[1,0],[1,0]])]) &
    		(car([[1,0],[1,0]]) in Si) & (cdr([[1,0],[1,0]]) in Si) & (cdr([[1,0],[1,0]]) /= [0,0])
    ([1,0],[1,0])-->T432(*) ==> [[1,0],[1,0]] in Fr
    ([[1,0],[1,0]])-->T421 ==> Fr_to_Ra([[1,0],[1,0]]) in Ra
    Use_def(Ra_1) ==> Stat5: Ra_1 in Ra
    (Stat1,Stat4,Stat5*)ELEM ==> (m in Ra) & (m /= m ¥Ra_PLUS Ra_0)
    m-->T423 ==> Stat6: (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(m))-->T431(Stat2*) ==> Stat7: (arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    Loc_def ==> Stat8: arm = arb(m)
    EQUAL ==> Stat9: (arm in Fr) & (Fr_to_Ra(arm) = m)
    Loc_def ==> am = car(arm)
    Loc_def ==> dm = cdr(arm)
    EQUAL ==> (arm = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    Use_def(Ra_0) ==> m /= m ¥Ra_PLUS Fr_to_Ra([[0,0],[1,0]])
    Use_def(¥Ra_PLUS) ==> m /=
	Fr_to_Ra([(car(arb(m)) ¥S_TIMES cdr(arb(Fr_to_Ra([[0,0],[1,0]])))) ¥S_PLUS
			(car(arb(Fr_to_Ra([[0,0],[1,0]]))) ¥S_TIMES cdr(arb(m))),
				cdr(arb(m)) ¥S_TIMES cdr(arb(Fr_to_Ra([[0,0],[1,0]])))])
    ELEM ==> Stat10: (car([[0,0],[1,0]]) = [0,0]) & (cdr([[0,0],[1,0]]) = [1,0])
    (Fr_to_Ra([[0,0],[1,0]]))-->T423 ==> arb(Fr_to_Ra([[0,0],[1,0]])) in Fr
    [[0,0],[1,0]]-->T421 ==> Same_frac([[0,0],[1,0]],arb(Fr_to_Ra([[0,0],[1,0]])))
    T418 ==> Stat11: (FORALL v in Fr, w in Fr | (Same_frac(v,w) ¥eq Same_frac(w,v)) & Same_frac(v,v))
    (arb(m),arb(m))-->Stat11(Stat8,Stat9) ==> Same_frac(arb(m),arb(m))
    (arb(m),arb(m),[[0,0],[1,0]],arb(Fr_to_Ra([[0,0],[1,0]])))-->T435 ==> Stat12:
	 m /= Fr_to_Ra([(car(arb(m)) ¥S_TIMES cdr([[0,0],[1,0]])) ¥S_PLUS (car([[0,0],[1,0]]) ¥S_TIMES cdr(arb(m))),
	 								 cdr(arb(m)) ¥S_TIMES cdr([[0,0],[1,0]])])
    EQUAL(Stat12,Stat10) ==>
    	m /= Fr_to_Ra([(car(arb(m)) ¥S_TIMES [1,0]) ¥S_PLUS ([0,0] ¥S_TIMES cdr(arb(m))), cdr(arb(m)) ¥S_TIMES [1,0]])
    (car(arb(m)))-->T401 ==> [1,0] ¥S_TIMES car(arb(m)) = car(arb(m))
    (cdr(arb(m)))-->T401 ==> Stat13: [1,0] ¥S_TIMES cdr(arb(m)) = cdr(arb(m))
    (cdr(arb(m)))-->T401 ==> [0,0] ¥S_TIMES cdr(arb(m)) = [0,0]
    (car(arb(m)))-->T405 ==> (car(arb(m)) ¥S_PLUS [0,0]) = car(arb(m))
    ALGEBRA(Stat13,Stat2,Stat7) ==> cdr(arb(m)) ¥S_TIMES [1,0] = cdr(arb(m))
    ALGEBRA ==> (car(arb(m)) ¥S_TIMES [1,0]) ¥S_PLUS ([0,0] ¥S_TIMES cdr(arb(m))) = car(arb(m))
    EQUAL ==> Stat14: m /= Fr_to_Ra([car(arb(m)),cdr(arb(m))])
    EQUAL(Stat6,Stat7,Stat14) ==> false; Discharge ==> QED
--
-- Next we prove that the rational version of the algebraic law 'x + (-x) = 0'.
--
Theorem 452: [The sum of a rational number and its additive inverse is zero] (M in Ra) ¥imp ((Ra_Rev(M) in Ra) & ((M ¥Ra_PLUS Ra_Rev(M)) = Ra_0)). Proof:
    Suppose_not(m) ==> (m in Ra) & ((Ra_Rev(m) notin Ra) or (m ¥Ra_PLUS Ra_Rev(m)) /= Ra_0)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(m))-->T431 ==>
	(arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    Loc_def ==> am = car(arb(m))
    Loc_def ==> dm = cdr(arb(m))
    EQUAL ==> Stat1: (arb(m) = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    (dm,dm)-->T407(Stat1*) ==> dm ¥S_TIMES dm /= [0,0]
    T368 ==> Stat2: ([0,0] in Si) & ([1,0] in Si)
    ALGEBRA ==> dm ¥S_TIMES dm in Si
    ([0,0],dm ¥S_TIMES dm)-->T432(Stat1*) ==> Stat3: [[0,0],dm ¥S_TIMES dm] in Fr
    am-->T391 ==> S_Rev(am) in Si
    Suppose ==> Ra_Rev(m) notin Ra
    Use_def(Ra_Rev) ==> Stat4: Fr_to_Ra([S_Rev(car(arb(m))),cdr(arb(m))]) notin Ra
    T420 ==> Stat5: (FORALL x | (x in Fr) ¥imp (Fr_to_Ra(x) in Ra))
    ([S_Rev(car(arb(m))),cdr(arb(m))])-->Stat5(Stat4) ==> [S_Rev(car(arb(m))),cdr(arb(m))] notin Fr
    EQUAL ==> [S_Rev(am),dm] notin Fr
    ([S_Rev(am),dm])-->T431 ==> false; Discharge ==> (m ¥Ra_PLUS Ra_Rev(m)) /= Ra_0
--
--
--
    Use_def(Ra_Rev) ==> m ¥Ra_PLUS Fr_to_Ra([S_Rev(car(arb(m))),cdr(arb(m))]) /= Ra_0
    EQUAL ==> m ¥Ra_PLUS Fr_to_Ra([S_Rev(am),dm]) /= Ra_0
    (m,S_Rev(am),dm)-->T438 ==>
    	Fr_to_Ra([(car(arb(m)) ¥S_TIMES dm) ¥S_PLUS (cdr(arb(m)) ¥S_TIMES S_Rev(am)),cdr(arb(m)) ¥S_TIMES dm]) /= Ra_0
    EQUAL ==> Ra_0 /= Fr_to_Ra([(am ¥S_TIMES dm) ¥S_PLUS (dm ¥S_TIMES S_Rev(am)),dm ¥S_TIMES dm])
    ALGEBRA ==> (am ¥S_TIMES dm) ¥S_PLUS (dm ¥S_TIMES S_Rev(am)) = (am ¥S_TIMES dm) ¥S_MINUS (am ¥S_TIMES dm)
    ALGEBRA ==> am ¥S_TIMES dm in Si
    (am ¥S_TIMES dm)-->T404 ==> (am ¥S_TIMES dm) ¥S_PLUS (dm ¥S_TIMES S_Rev(am)) = [0,0]
    EQUAL ==> Ra_0 /= Fr_to_Ra([[0,0],dm ¥S_TIMES dm])
    Use_def(Ra_0) ==> Stat6: Fr_to_Ra([[0,0],[1,0]]) /= Fr_to_Ra([[0,0],dm ¥S_TIMES dm])
    ELEM ==> Stat7: (car([[0,0],[1,0]]) = [0,0]) & (cdr([[0,0],[1,0]]) = [1,0])
    T212 ==> Stat8: 1 /= 0
    (Stat7,Stat8,Stat2)ELEM ==> ([[0,0],[1,0]] = [car([[0,0],[1,0]]),cdr([[0,0],[1,0]])]) &
    		(car([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) /= [0,0])
    ([0,0],[1,0])-->T432(*) ==> Stat9: [[0,0],[1,0]] in Fr
    ([[0,0],[1,0]],[[0,0],dm ¥S_TIMES dm])-->T422(Stat9,Stat3,Stat6) ==>
    		not(Same_frac([[0,0],[1,0]],[[0,0],dm ¥S_TIMES dm]))
    Use_def(Same_frac) ==> Stat10: [0,0] ¥S_TIMES (dm ¥S_TIMES dm) /= [1,0] ¥S_TIMES [0,0]
    (dm ¥S_TIMES dm)-->T401 ==> [0,0] ¥S_TIMES (dm ¥S_TIMES dm) = [0,0]
    (Stat10)ELEM ==> Stat11: [0,0] /= [1,0] ¥S_TIMES [0,0]
    ([1,0])-->T401 ==> [0,0] ¥S_TIMES [1,0] = [0,0]
    ALGEBRA(Stat11,Stat2) ==> [0,0] ¥S_TIMES [1,0] = [1,0] ¥S_TIMES [0,0]
    (Stat11)Discharge ==> QED
--
-- Sometimes the folllowing variant of Theorem 452 is more convenient.
--
Theorem 453: [The sum of a rational number and its additive inverse is zero, 2] (M in Ra) ¥imp ((Ra_Rev(M) in Ra) & ((Ra_Rev(M) ¥Ra_PLUS M) = Ra_0)). Proof:
	Suppose_not(m) ==> AUTO
	(m)-->T452 ==> AUTO
	(m,Ra_Rev(m))-->T445 ==> false; Discharge ==> QED
--
-- We also need to know that the difference of rationals is rational.
--
Theorem 454: [The difference of two rationals is rational] ((N in Ra) & (M in Ra)) ¥imp ((N ¥Ra_MINUS M) in Ra). Proof:
	Suppose_not(n,m) ==> AUTO
	Use_def(¥Ra_MINUS) ==> not((n ¥Ra_PLUS Ra_Rev(m)) in Ra)
	m-->T453 ==> Ra_Rev(m) in Ra
	(n,Ra_Rev(m))-->T445 ==> false; Discharge ==> QED
--
-- The following elementary generalization of the preceding theorem gives the
-- rational case of the inverse relationship between addition and subtraction.
--
Theorem 455: [Rational subtraction is equivalent to addition of the rational negative] ((N in Ra) & (M in Ra)) ¥imp (N = M ¥Ra_PLUS (N ¥Ra_MINUS M)). Proof:
    Suppose_not(n,m) ==> (n in Ra) & (m in Ra) & (n /= m ¥Ra_PLUS (n ¥Ra_MINUS m))
    Use_def(¥Ra_MINUS) ==> n /= m ¥Ra_PLUS (n ¥Ra_PLUS Ra_Rev(m))
    m-->T452 ==> Ra_Rev(m) in Ra
    (n,Ra_Rev(m))-->T445 ==> n ¥Ra_PLUS Ra_Rev(m) = Ra_Rev(m) ¥Ra_PLUS n
    EQUAL ==> n /= m ¥Ra_PLUS (Ra_Rev(m) ¥Ra_PLUS n)
    (n,m,Ra_Rev(m))-->T450 ==> n /= (m ¥Ra_PLUS Ra_Rev(m)) ¥Ra_PLUS n
    m-->T452 ==> m ¥Ra_PLUS Ra_Rev(m) = Ra_0
    EQUAL ==> n /= Ra_0 ¥Ra_PLUS n
    T451 ==> Ra_0 in Ra
    n-->T451 ==> n ¥Ra_PLUS Ra_0 = n
    (n,Ra_0)-->T445 ==> false; Discharge ==> QED
--
-- Our next theorem states the associative law for rational multiplication.
--
Theorem 456: [Associative law for rational multiplication] ((K in Ra) & (N in Ra) & (M in Ra)) ¥imp (N ¥Ra_TIMES (M ¥Ra_TIMES K) = (N ¥Ra_TIMES M) ¥Ra_TIMES K). Proof:
    Suppose_not(k,n,m) ==> Stat1: (k in Ra) & (n in Ra) & (m in Ra) & (n ¥Ra_TIMES (m ¥Ra_TIMES k) /= (n ¥Ra_TIMES m) ¥Ra_TIMES k)
	(n,m)-->T448 ==> (n ¥Ra_TIMES m) in Ra
    (n ¥Ra_TIMES m,k)-->T448 ==> n ¥Ra_TIMES (m ¥Ra_TIMES k) /= k ¥Ra_TIMES (n ¥Ra_TIMES m)
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    k-->T423 ==> (arb(k) in Fr) & (Fr_to_Ra(arb(k)) = k)
    (arb(n))-->T431 ==>
	(arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
    (arb(m))-->T431 ==>
	(arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    (arb(k))-->T431 ==>
	(arb(k) = [car(arb(k)),cdr(arb(k))]) & (car(arb(k)) in Si) & (cdr(arb(k)) in Si) & (cdr(arb(k)) /= [0,0])
    Loc_def ==> an = car(arb(n))
    Loc_def ==> am = car(arb(m))
    Loc_def ==> ak = car(arb(k))
    Loc_def ==> dn = cdr(arb(n))
    Loc_def ==> dm = cdr(arb(m))
    Loc_def ==> dk = cdr(arb(k))
    EQUAL ==> Stat2: (arb(n) = [an,dn]) & (an in Si) & (dn in Si) & (dn /= [0,0])
    EQUAL ==> Stat3: (arb(m) = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    EQUAL ==> Stat4: (arb(k) = [ak,dk]) & (ak in Si) & (dk in Si) & (dk /= [0,0])
    Use_def(¥Ra_TIMES) ==> n ¥Ra_TIMES Fr_to_Ra([car(arb(m)) ¥S_TIMES car(arb(k)),cdr(arb(m)) ¥S_TIMES cdr(arb(k))]) /=
    							k ¥Ra_TIMES Fr_to_Ra([car(arb(n)) ¥S_TIMES car(arb(m)),cdr(arb(n)) ¥S_TIMES cdr(arb(m))])
    EQUAL ==> n ¥Ra_TIMES Fr_to_Ra([am ¥S_TIMES ak,dm ¥S_TIMES dk]) /= k ¥Ra_TIMES Fr_to_Ra([an ¥S_TIMES am,dn ¥S_TIMES dm])
    (dk,dm)-->T407(Stat3,Stat4*) ==> Stat5: dm ¥S_TIMES dk /= [0,0]
    (dm,dn)-->T407(Stat3,Stat2*) ==> Stat6: dn ¥S_TIMES dm /= [0,0]
    ALGEBRA ==> Stat7: (an ¥S_TIMES am in Si) & (dn ¥S_TIMES dm in Si) & (am ¥S_TIMES ak in Si) & (dm ¥S_TIMES dk in Si)
    ([am ¥S_TIMES ak,dm ¥S_TIMES dk])-->T431(Stat7,Stat5) ==> [am ¥S_TIMES ak,dm ¥S_TIMES dk] in Fr
    ([an ¥S_TIMES am,dn ¥S_TIMES dm])-->T431(Stat7,Stat6) ==> [an ¥S_TIMES am,dn ¥S_TIMES dm] in Fr
    (n,am ¥S_TIMES ak,dm ¥S_TIMES dk)-->T439(Stat7,Stat5,Stat1,Stat2,Stat3,Stat4) ==>
    			n ¥Ra_TIMES Fr_to_Ra([am ¥S_TIMES ak,dm ¥S_TIMES dk]) =
		Fr_to_Ra([car(arb(n)) ¥S_TIMES (am ¥S_TIMES ak),cdr(arb(n)) ¥S_TIMES (dm ¥S_TIMES dk)])
   	EQUAL ==> n ¥Ra_TIMES Fr_to_Ra([am ¥S_TIMES ak,dm ¥S_TIMES dk]) =
		Fr_to_Ra([an ¥S_TIMES (am ¥S_TIMES ak),dn ¥S_TIMES (dm ¥S_TIMES dk)])
    (k,an ¥S_TIMES am,dn ¥S_TIMES dm)-->T439(Stat7,Stat6,Stat1,Stat2,Stat3,Stat4) ==>
    			k ¥Ra_TIMES Fr_to_Ra([an ¥S_TIMES am,dn ¥S_TIMES dm]) =
		Fr_to_Ra([car(arb(k)) ¥S_TIMES (an ¥S_TIMES am),cdr(arb(k)) ¥S_TIMES (dn ¥S_TIMES dm)])
    EQUAL ==> k ¥Ra_TIMES Fr_to_Ra([an ¥S_TIMES am,dn ¥S_TIMES dm]) =
		Fr_to_Ra([ak ¥S_TIMES (an ¥S_TIMES am),dk ¥S_TIMES (dn ¥S_TIMES dm)])
    ALGEBRA ==> false; Discharge ==> QED
--
-- Next we prove that a rational number remains unchanged if its numerator and denominator are multiplied
-- by a common integer.
--
Theorem 457: [Muliplication of numerator and denominator by a common nonzero function does not change the rational number it represents]
    ((K in Si) & (N in Si) & (M in Si) & (K /= [0,0]) & (M /= [0,0])) ¥imp (Fr_to_Ra([N,M]) = Fr_to_Ra([K ¥S_TIMES N,K ¥S_TIMES M])).  Proof:
	Suppose_not(k,n,m) ==> (k in Si) & (n in Si) & (m in Si) & (k /= [0,0]) & (m /= [0,0]) &
			(Fr_to_Ra([n,m]) /= Fr_to_Ra([k ¥S_TIMES n,k ¥S_TIMES m]))
    (n,m)-->T432(*) ==> [n,m] in Fr
    ALGEBRA ==> (k ¥S_TIMES n in Si) & (k ¥S_TIMES m in Si)
    (m,k)-->T407 ==> k ¥S_TIMES m /= [0,0]
    (k ¥S_TIMES n,k ¥S_TIMES m)-->T432(*) ==> [k ¥S_TIMES n,k ¥S_TIMES m] in Fr
    ([n,m],[k ¥S_TIMES n,k ¥S_TIMES m])-->T422 ==> not Same_frac([n,m],[k ¥S_TIMES n,k ¥S_TIMES m])
    Use_def(Same_frac) ==> n ¥S_TIMES (k ¥S_TIMES m) /= m ¥S_TIMES (k ¥S_TIMES n)
    ALGEBRA ==> false; Discharge ==> QED
--
-- The following theorem states the distributive law for rational numbers.
--
Theorem 458: [Distributive law for rationals] ((K in Ra) & (N in Ra) & (M in Ra)) ¥imp (N ¥Ra_TIMES (M ¥Ra_PLUS K) = (N ¥Ra_TIMES M) ¥Ra_PLUS (N ¥Ra_TIMES K)). Proof:
    Suppose_not(k,n,m) ==> Stat1: (k in Ra) & (n in Ra) & (m in Ra) &
    	(n ¥Ra_TIMES (m ¥Ra_PLUS k) /= (n ¥Ra_TIMES m) ¥Ra_PLUS (n ¥Ra_TIMES k))
--
-- Supposing the contrary, consider the fractions defining each of our three rational numbers.
--
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    k-->T423 ==> (arb(k) in Fr) & (Fr_to_Ra(arb(k)) = k)
    (arb(n))-->T431 ==>
	Stat2: (arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
    (arb(m))-->T431 ==>
	Stat3: (arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    (arb(k))-->T431 ==>
	Stat4: (arb(k) = [car(arb(k)),cdr(arb(k))]) & (car(arb(k)) in Si) & (cdr(arb(k)) in Si) & (cdr(arb(k)) /= [0,0])
--
-- To keep our notation under control, it is convenient to introduce abbreviations for
-- the numerators and denominators of these fractions.
--
    Loc_def ==> Stat5: an = car(arb(n))
    Loc_def ==> Stat6: am = car(arb(m))
    Loc_def ==> Stat7: ak = car(arb(k))
    Loc_def ==> Stat8: dn = cdr(arb(n))
    Loc_def ==> Stat9: dm = cdr(arb(m))
    Loc_def ==> Stat10: dk = cdr(arb(k))
    EQUAL ==> Stat11: (arb(n) = [an,dn]) & (an in Si) & (dn in Si) & (dn /= [0,0])
    EQUAL ==> Stat12: (arb(m) = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    EQUAL ==> Stat13: (arb(k) = [ak,dk]) & (ak in Si) & (dk in Si) & (dk /= [0,0])
--
-- It is obvious that the various products entering into the definition of the
-- product and sum rationals that will concern us are all signed integers.
-- Thus we can express all these product and sum rationals in terms of their defining fractions.
--
    ALGEBRA ==> Stat14: (an ¥S_TIMES am in Si) & (an ¥S_TIMES ak in Si) & ((am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm) in Si)
	& (dn ¥S_TIMES dm in Si) & (dn ¥S_TIMES dk in Si) & (dm ¥S_TIMES dk in Si)
    (dm,dn)-->T407(Stat11*) ==> Stat15: dn ¥S_TIMES dm /= [0,0]
    (dk,dn)-->T407(Stat11*) ==> Stat16: dn ¥S_TIMES dk /= [0,0]
    (dk,dm)-->T407(Stat11*) ==> Stat17: dm ¥S_TIMES dk /= [0,0]
    Use_def(¥Ra_PLUS) ==> Stat18: m ¥Ra_PLUS k =
    	Fr_to_Ra([(car(arb(m)) ¥S_TIMES cdr(arb(k))) ¥S_PLUS (car(arb(k)) ¥S_TIMES cdr(arb(m))),
    				cdr(arb(m)) ¥S_TIMES cdr(arb(k))])
    Use_def(¥Ra_TIMES) ==> Stat19: n ¥Ra_TIMES m = Fr_to_Ra([car(arb(n)) ¥S_TIMES car(arb(m)),
    							cdr(arb(n)) ¥S_TIMES cdr(arb(m))])
    Use_def(¥Ra_TIMES) ==> Stat20: n ¥Ra_TIMES k = Fr_to_Ra([car(arb(n)) ¥S_TIMES car(arb(k)),
    							cdr(arb(n)) ¥S_TIMES cdr(arb(k))])
    EQUAL ==> m ¥Ra_PLUS k = Fr_to_Ra([(am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm),dm ¥S_TIMES dk])
    EQUAL ==> n ¥Ra_TIMES m = Fr_to_Ra([an ¥S_TIMES am,dn ¥S_TIMES dm])
    EQUAL ==> n ¥Ra_TIMES k = Fr_to_Ra([an ¥S_TIMES ak,dn ¥S_TIMES dk])
    EQUAL ==> Stat21: n ¥Ra_TIMES (m ¥Ra_PLUS k) =
    	n ¥Ra_TIMES Fr_to_Ra([(am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm),dm ¥S_TIMES dk])
    ALGEBRA ==> Stat22: (am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm) in Si
    (n,(am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm),dm ¥S_TIMES dk)-->T439(Stat1,Stat21,Stat22,Stat14,Stat17) ==>
    	Stat23: n ¥Ra_TIMES (m ¥Ra_PLUS k) =
	Fr_to_Ra([car(arb(n)) ¥S_TIMES ((am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm)),cdr(arb(n)) ¥S_TIMES (dm ¥S_TIMES dk)])
    EQUAL(Stat23,Stat5,Stat8) ==> n ¥Ra_TIMES (m ¥Ra_PLUS k) =
	Fr_to_Ra([an ¥S_TIMES ((am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm)),dn ¥S_TIMES (dm ¥S_TIMES dk)])
    (an ¥S_TIMES am,dn ¥S_TIMES dm,an ¥S_TIMES ak,dn ¥S_TIMES dk)-->T447(Stat14,Stat15,Stat16,Stat17) ==>
    	Fr_to_Ra([an ¥S_TIMES am,dn ¥S_TIMES dm]) ¥Ra_PLUS Fr_to_Ra([an ¥S_TIMES ak,dn ¥S_TIMES dk]) =
	Fr_to_Ra([((an ¥S_TIMES am) ¥S_TIMES (dn ¥S_TIMES dk)) ¥S_PLUS ((an ¥S_TIMES ak) ¥S_TIMES (dn ¥S_TIMES dm)),
	((dn ¥S_TIMES dm) ¥S_TIMES (dn ¥S_TIMES dk))])
    EQUAL ==> (n ¥Ra_TIMES m) ¥Ra_PLUS (n ¥Ra_TIMES k) =
	Fr_to_Ra([((an ¥S_TIMES am) ¥S_TIMES (dn ¥S_TIMES dk)) ¥S_PLUS ((an ¥S_TIMES ak) ¥S_TIMES (dn ¥S_TIMES dm)),
	((dn ¥S_TIMES dm) ¥S_TIMES (dn ¥S_TIMES dk))])
    ALGEBRA(Stat11*) ==> (n ¥Ra_TIMES m) ¥Ra_PLUS (n ¥Ra_TIMES k) =
	Fr_to_Ra([dn ¥S_TIMES (an ¥S_TIMES ((am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm))),
				dn ¥S_TIMES (dn ¥S_TIMES (dm ¥S_TIMES dk))])
    Loc_def ==> Stat24: aa = (an ¥S_TIMES ((am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm)))
    Loc_def ==> Stat25: dd = (dn ¥S_TIMES (dm ¥S_TIMES dk))
--
-- This brings us to the following expressions for the quantities with which we are concerned,
-- which must be different if our theorem fails:
--
    EQUAL ==> Stat26: (n ¥Ra_TIMES m) ¥Ra_PLUS (n ¥Ra_TIMES k) = Fr_to_Ra([dn ¥S_TIMES aa, dn ¥S_TIMES dd])
    EQUAL ==> Stat27: n ¥Ra_TIMES (m ¥Ra_PLUS k) = Fr_to_Ra([aa,dd])
    Use_def(Same_frac) ==> Stat28: Same_frac([dn ¥S_TIMES aa, dn ¥S_TIMES dd],[aa,dd]) ¥eq
	(car([dn ¥S_TIMES aa, dn ¥S_TIMES dd]) ¥S_TIMES cdr([aa,dd]) =
		cdr([dn ¥S_TIMES aa, dn ¥S_TIMES dd]) ¥S_TIMES car([aa,dd]))
    (Stat28)ELEM ==> (car([dn ¥S_TIMES aa, dn ¥S_TIMES dd]) = dn ¥S_TIMES aa) &
    					(cdr([dn ¥S_TIMES aa, dn ¥S_TIMES dd]) = dn ¥S_TIMES dd)
    (Stat28)ELEM ==> (car([aa,dd]) = aa) & (cdr([aa,dd]) = dd)
    EQUAL(Stat28) ==> Stat29: Same_frac([dn ¥S_TIMES aa, dn ¥S_TIMES dd],[aa,dd]) ¥eq
	((dn ¥S_TIMES aa) ¥S_TIMES dd = (dn ¥S_TIMES dd) ¥S_TIMES aa)
    ALGEBRA(Stat11,Stat12,Stat13) ==> Stat30: ((an ¥S_TIMES ((am ¥S_TIMES dk) ¥S_PLUS (ak ¥S_TIMES dm))) in Si) &
    			 ((dn ¥S_TIMES (dm ¥S_TIMES dk)) in Si)
    (dm ¥S_TIMES dk,dn)-->T407(Stat11,Stat17,Stat14*) ==> Stat31: (dn ¥S_TIMES (dm ¥S_TIMES dk)) /= [0,0]
    EQUAL ==> Stat32: (aa in Si) & (dd in Si) & (dd /= [0,0])
    ALGEBRA(Stat11) ==> (dn ¥S_TIMES aa in Si) & (dn ¥S_TIMES dd in Si)
    (aa,dd)-->T432(Stat32,Stat32*) ==> Stat33: [aa,dd] in Fr
    ALGEBRA(Stat11) ==> (dn ¥S_TIMES aa) ¥S_TIMES dd = (dn ¥S_TIMES dd) ¥S_TIMES aa
    (dd,dn)-->T407(Stat11,Stat32*) ==> dn ¥S_TIMES dd /= [0,0]
    (dn ¥S_TIMES aa, dn ¥S_TIMES dd)-->T432(Stat32*) ==> Stat34: [dn ¥S_TIMES aa, dn ¥S_TIMES dd] in Fr
    (Stat29)ELEM ==> Stat35: Same_frac([dn ¥S_TIMES aa, dn ¥S_TIMES dd],[aa,dd])
    ([dn ¥S_TIMES aa, dn ¥S_TIMES dd],[aa,dd])-->T422(Stat1,Stat26,Stat27,Stat35,Stat33,Stat34) ==> false; Discharge ==> QED
--
-- The following result, which is only a slight variant of what has gone before,
-- rexpresses the condition that the rational number derived from a fraction
-- should be non-negative in terms of the fraction's numerator and denominator.
--
Theorem 459: [Expressing the sign of a rational in terms of the numerator and denominator of any representing fraction] ((X in Si) & (Y in Si) & (Y /= [0,0])) ¥imp (Ra_is_nonneg(Fr_to_Ra([X,Y])) ¥eq is_nonneg(X ¥S_TIMES Y)). Proof:
    Suppose_not(n,m) ==> (n in Si) & (m in Si) & (m /= [0,0]) & (not(Ra_is_nonneg(Fr_to_Ra([n,m])) ¥eq is_nonneg(n ¥S_TIMES m)))
    (n,m)-->T432(*) ==> [n,m] in Fr
    ([n,m])-->T421 ==> Fr_to_Ra([n,m]) in Ra
    (Fr_to_Ra([n,m]))-->T423 ==> arb(Fr_to_Ra([n,m])) in Fr
    ([n,m])-->T421 ==> Same_frac([n,m],arb(Fr_to_Ra([n,m])))
    ([n,m],arb(Fr_to_Ra([n,m])))-->T442 ==>
	is_nonneg(car(arb(Fr_to_Ra([n,m]))) ¥S_TIMES cdr(arb(Fr_to_Ra([n,m])))) ¥eq is_nonneg(car([n,m]) ¥S_TIMES cdr([n,m]))
    ELEM ==> (car([n,m]) = n) & (cdr([n,m]) = m)
    EQUAL ==> is_nonneg(car(arb(Fr_to_Ra([n,m]))) ¥S_TIMES cdr(arb(Fr_to_Ra([n,m])))) ¥eq is_nonneg(n ¥S_TIMES m)
    Use_def(Ra_is_nonneg) ==>
	Ra_is_nonneg(Fr_to_Ra([n,m])) ¥eq (is_nonneg(car(arb(Fr_to_Ra([n,m]))) ¥S_TIMES cdr(arb(Fr_to_Ra([n,m])))))
    Discharge ==> QED
--
-- Next we not that various utility constants are signed integers (or fractions): the zero and unity signed integers,
-- likewise the zero and unity fractions.
--
Theorem 460: [The unit and zero signed signed integers addition] ([1,0] in Si) & ([0,0] in Si) & ([1,0] /= [0,0]) & ([[0,0],[1,0]] in Fr) & ([[1,0],[1,0]] in Fr). Proof:
	Suppose_not ==> not( ([1,0] in Si) & ([0,0] in Si) & ([1,0] /= [0,0]) & ([[0,0],[1,0]] in Fr) & ([[1,0],[1,0]] in Fr))
	T212 ==> (0 in Za) & (1 in Za) & (0 /= 1)
	Suppose ==> [1,0] notin Si
	Use_def(Si) ==> Stat1: [1,0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(1,0)-->Stat1 ==> false; Discharge ==> [1,0] in Si
	Suppose ==> [0,0] notin Si
	Use_def(Si) ==> Stat2: [0,0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(0,0)-->Stat2 ==> false; Discharge ==> [0,0] in Si
	ELEM ==> [1,0] /= [0,0]
    ([0,0],[1,0])-->T432(*) ==> [[0,0],[1,0]] in Fr
    ([1,0],[1,0])-->T432(*) ==> [[1,0],[1,0]] in Fr
    Discharge ==> QED
--
-- Our next, quite elementary, result simply state that the unit rational number is the multiplicative unit for rationals.
--
Theorem 461: [The unit rational is the rational multiplicative identity] (M in Ra) ¥imp (M = M ¥Ra_TIMES Ra_1). Proof:
    Suppose_not(m) ==> (m in Ra) & (m /= m ¥Ra_TIMES Ra_1)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(m))-->T431 ==>
	(arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    Loc_def ==> am = car(arb(m))
    Loc_def ==> dm = cdr(arb(m))
    Use_def(Ra_1) ==> m /= m ¥Ra_TIMES Fr_to_Ra([[1,0],[1,0]])
    T460 ==> ([1,0] in Si) & ([1,0] /= [0,0])
    (m,[1,0],[1,0])-->T439 ==>  m /= Fr_to_Ra([car(arb(m)) ¥S_TIMES [1,0],cdr(arb(m)) ¥S_TIMES [1,0]])
    EQUAL ==> m /= Fr_to_Ra([am ¥S_TIMES [1,0],dm ¥S_TIMES [1,0]])
    am-->T402 ==> am ¥S_TIMES [1,0] = am
    dm-->T402 ==> dm ¥S_TIMES [1,0] = dm
    EQUAL ==> m /= Fr_to_Ra([am,dm])
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that if m is a nonzero rational, its reciprocal Recip(m) is also a rational,
-- and is the multiplicative inverse of m. This tells us that the rational numbers form an
-- algebraic 'field'.
--
Theorem 462: [Multiplication of a rational by its reciprocal gives 1] ((M in Ra) & (M /= Ra_0)) ¥imp ((Recip(M) in Ra) & (M ¥Ra_TIMES Recip(M) = Ra_1)). Proof:
    Suppose_not(m) ==> Stat1: (m in Ra) & (m /= Ra_0) & (Recip(m) notin Ra or m ¥Ra_TIMES Recip(m) /= Ra_1)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(m))-->T431 ==>
	(arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    Loc_def ==> am = car(arb(m))
    Loc_def ==> dm = cdr(arb(m))
    EQUAL ==> Stat2: (arb(m) = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    EQUAL ==> [am,dm] in Fr
    T460 ==> Stat3: ([1,0] in Si) & ([0,0] in Si) & ([1,0] /= [0,0]) & ([[0,0],[1,0]] in Fr) & ([[1,0],[1,0]] in Fr)
    Suppose ==> am = [0,0]
    EQUAL ==> am ¥S_TIMES [1,0] = [0,0] ¥S_TIMES [1,0]
    dm-->T401 ==> [0,0] ¥S_TIMES dm = [0,0]
    ([1,0])-->T401 ==> [0,0] ¥S_TIMES dm = [0,0]
    ALGEBRA ==> dm ¥S_TIMES [0,0] = [0,0]
    ELEM ==> (car([am,dm]) = am) & (cdr([am,dm]) = dm) & (car([[0,0],[1,0]]) = [0,0]) & (cdr([[0,0],[1,0]]) = [1,0])
    EQUAL ==> car([am,dm]) ¥S_TIMES cdr([[0,0],[1,0]]) = cdr([am,dm]) ¥S_TIMES car([[0,0],[1,0]])
    Use_def(Same_frac) ==> Same_frac([am,dm],[[0,0],[1,0]])
    ([am,dm],[[0,0],[1,0]])-->T422 ==> Fr_to_Ra([am,dm]) = Fr_to_Ra([[0,0],[1,0]])
    EQUAL ==> Fr_to_Ra([am,dm]) = m
    Use_def(Ra_0) ==> false; Discharge ==> Stat4: am /= [0,0]
    Use_def(Recip) ==> Recip(m) = Fr_to_Ra([cdr(arb(m)),car(arb(m))])
    (dm,am)-->T432(*) ==> [dm,am] in Fr
    ALGEBRA ==> (am ¥S_TIMES dm in Si) & (dm ¥S_TIMES am in Si)
	(am,dm)-->T407(Stat2,Stat4*) ==> dm ¥S_TIMES am /= [0,0]
    (am ¥S_TIMES dm,dm ¥S_TIMES am)-->T432(*) ==> Stat5: [am ¥S_TIMES dm,dm ¥S_TIMES am] in Fr
    EQUAL ==> Stat6: Recip(m) = Fr_to_Ra([dm,am])
    ([dm,am])-->T421 ==> Stat7: Recip(m) in Ra
    EQUAL(Stat7,Stat1,Stat6) ==> Stat8: (m ¥Ra_TIMES Fr_to_Ra([dm,am]) /= Ra_1)
    (m,dm,am)-->T439(Stat1,Stat8,Stat2,Stat4) ==> Fr_to_Ra([car(arb(m)) ¥S_TIMES dm,cdr(arb(m)) ¥S_TIMES am]) /= Ra_1
    EQUAL ==> Fr_to_Ra([am ¥S_TIMES dm,dm ¥S_TIMES am]) /= Ra_1
    Use_def(Ra_1) ==> Stat9: Fr_to_Ra([am ¥S_TIMES dm,dm ¥S_TIMES am]) /= Fr_to_Ra([[1,0],[1,0]])
    ([am ¥S_TIMES dm,dm ¥S_TIMES am],[[1,0],[1,0]])-->T422(Stat9,Stat3,Stat5) ==>
    		not Same_frac([am ¥S_TIMES dm,dm ¥S_TIMES am],[[1,0],[1,0]])
    Use_def(Same_frac) ==> Stat10: car([am ¥S_TIMES dm,dm ¥S_TIMES am]) ¥S_TIMES cdr([[1,0],[1,0]]) /=
    	cdr([am ¥S_TIMES dm,dm ¥S_TIMES am]) ¥S_TIMES car([[1,0],[1,0]])
    (Stat10)ELEM ==> (am ¥S_TIMES dm) ¥S_TIMES [1,0] /= (dm ¥S_TIMES am) ¥S_TIMES [1,0]
    ALGEBRA ==> false; Discharge ==> QED
--
-- The following corollary of Theorem 462 is of a merely technical nature.
--
Theorem 463: ((N in Ra) & (M in Ra) & (M /= Ra_0)) ¥imp (((N ¥Ra_TIMES (M ¥Ra_TIMES M)) ¥Ra_TIMES (Recip(M) ¥Ra_TIMES Recip(M))) = N). Proof:
    Suppose_not(n,m) ==> AUTO
        m-->T462 ==> (Recip(m) in Ra) & ((m ¥Ra_TIMES Recip(m)) = Ra_1)
        (m,m)-->T448 ==> (m ¥Ra_TIMES m) in Ra
        (Recip(m),Recip(m))-->T448 ==> (Recip(m) ¥Ra_TIMES Recip(m)) in Ra
        (Recip(m),m ¥Ra_TIMES m,Recip(m))-->T456 ==> ((m ¥Ra_TIMES m) ¥Ra_TIMES (Recip(m) ¥Ra_TIMES Recip(m))) = (((m ¥Ra_TIMES m) ¥Ra_TIMES Recip(m)) ¥Ra_TIMES Recip(m))
        (Recip(m) ¥Ra_TIMES Recip(m),n,m ¥Ra_TIMES m)-->T456 ==> (n ¥Ra_TIMES ((m ¥Ra_TIMES m) ¥Ra_TIMES (Recip(m) ¥Ra_TIMES Recip(m)))) = ((n ¥Ra_TIMES (m ¥Ra_TIMES m)) ¥Ra_TIMES (Recip(m) ¥Ra_TIMES Recip(m)))
        (Recip(m),m,m)-->T456 ==> (m ¥Ra_TIMES (m ¥Ra_TIMES Recip(m))) = ((m ¥Ra_TIMES m) ¥Ra_TIMES Recip(m))
        m-->T461 ==> (m = m ¥Ra_TIMES Ra_1)
        n-->T461 ==> (n = n ¥Ra_TIMES Ra_1)
    EQUAL ==> false; Discharge ==> QED
--
-- The following elementary extension of Theorem 462 gives
-- the inverse relationship between rational multiplication and division.
--
Theorem 464: [Rational division is multiplication by the reciprocal] ((N in Ra) & (M in Ra) & (M /= Ra_0)) ¥imp (N = M ¥Ra_TIMES (N ¥Ra_OVER M)). Proof:
    Suppose_not(n,m) ==> (n in Ra) & (m in Ra) & (m /= Ra_0) & (n /= m ¥Ra_TIMES (n ¥Ra_OVER m))
    m-->T462 ==> Recip(m) in Ra
    Use_def(¥Ra_OVER) ==> n ¥Ra_OVER m = n ¥Ra_TIMES Recip(m)
    EQUAL ==> n /= m ¥Ra_TIMES (n ¥Ra_TIMES Recip(m))
    (m,n ¥Ra_TIMES Recip(m))-->T448 ==> n /= m ¥Ra_TIMES (n ¥Ra_TIMES Recip(m))
    (n,Recip(m))-->T448 ==> n ¥Ra_TIMES Recip(m) = Recip(m) ¥Ra_TIMES n
    EQUAL ==> n /= m ¥Ra_TIMES (Recip(m) ¥Ra_TIMES n)
    (n,m,Recip(m))-->T456 ==> n /= (m ¥Ra_TIMES Recip(m)) ¥Ra_TIMES n
    m-->T462 ==> m ¥Ra_TIMES Recip(m) = Ra_1
    EQUAL ==> n /= Ra_1 ¥Ra_TIMES n
    T451 ==> Ra_1 in Ra
    (n,Ra_1)-->T448 ==> n /= n ¥Ra_TIMES Ra_1
    n-->T461 ==> false; Discharge ==> QED
--
Theorem 465: [0 and 1 have non-negative rationals] Ra_is_nonneg(Ra_0) & Ra_is_nonneg(Ra_1). Proof:
	Suppose_not ==> not (Ra_is_nonneg(Ra_0) & Ra_is_nonneg(Ra_1))
    T368 ==> Stat1: ([0,0] in Si) & ([1,0] in Si)
    T212 ==> Stat2: 1 /= 0
    (Stat1)ELEM ==> ([[0,0],[1,0]] = [car([[0,0],[1,0]]),cdr([[0,0],[1,0]])]) &
    		(car([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) /= [0,0])
    ([0,0],[1,0])-->T432(*) ==> [[0,0],[1,0]] in Fr
    ([1,0],[1,0])-->T432(*) ==> [[1,0],[1,0]] in Fr
	([[0,0],[1,0]])-->T421 ==> Fr_to_Ra([[0,0],[1,0]]) in Ra
	([[1,0],[1,0]])-->T421 ==> Fr_to_Ra([[1,0],[1,0]]) in Ra
	(Fr_to_Ra([[0,0],[1,0]]))-->T423 ==> arb(Fr_to_Ra([[0,0],[1,0]])) in Fr
	(Fr_to_Ra([[1,0],[1,0]]))-->T423 ==> arb(Fr_to_Ra([[1,0],[1,0]])) in Fr
	Use_def(Ra_0) ==> Ra_0 = Fr_to_Ra([[0,0],[1,0]])
	Use_def(Ra_1) ==> Ra_1 = Fr_to_Ra([[1,0],[1,0]])
	EQUAL ==> not (Ra_is_nonneg(Fr_to_Ra([[0,0],[1,0]])) & Ra_is_nonneg(Fr_to_Ra([[1,0],[1,0]])))
    T460 ==> ([0,0] in Si) & ([1,0] in Si) & ([1,0] /= [0,0])
    Use_def(Ra_is_nonneg) ==>
    	(Ra_is_nonneg(Fr_to_Ra([[0,0],[1,0]])) ¥eq
    		is_nonneg(car(arb(Fr_to_Ra([[0,0],[1,0]]))) ¥S_TIMES cdr(arb(Fr_to_Ra([[0,0],[1,0]]))))) &
	(Ra_is_nonneg(Fr_to_Ra([[1,0],[1,0]])) ¥eq
		is_nonneg(car(arb(Fr_to_Ra([[1,0],[1,0]]))) ¥S_TIMES cdr(arb(Fr_to_Ra([[1,0],[1,0]])))))
    ELEM ==> (car([[0,0],[1,0]]) = [0,0]) & (cdr([[0,0],[1,0]]) = [1,0])
    ELEM ==> (car([[1,0],[1,0]]) = [1,0]) & (cdr([[1,0],[1,0]]) = [1,0])
    ([[1,0],[1,0]])-->T421 ==> Same_frac([[1,0],[1,0]],arb(Fr_to_Ra([[1,0],[1,0]])))
    ([[0,0],[1,0]])-->T421 ==> Same_frac([[0,0],[1,0]],arb(Fr_to_Ra([[0,0],[1,0]])))
    ([[1,0],[1,0]],arb(Fr_to_Ra([[1,0],[1,0]])))-->T442 ==>
    	is_nonneg(car([[1,0],[1,0]]) ¥S_TIMES cdr([[1,0],[1,0]])) ¥eq
    			is_nonneg(car(arb(Fr_to_Ra([[1,0],[1,0]]))) ¥S_TIMES cdr(arb(Fr_to_Ra([[1,0],[1,0]]))))
    ([[0,0],[1,0]],arb(Fr_to_Ra([[0,0],[1,0]])))-->T442 ==>
    	is_nonneg(car([[0,0],[1,0]]) ¥S_TIMES cdr([[0,0],[1,0]])) ¥eq
    			is_nonneg(car(arb(Fr_to_Ra([[0,0],[1,0]]))) ¥S_TIMES cdr(arb(Fr_to_Ra([[0,0],[1,0]]))))
    EQUAL ==> (Ra_is_nonneg(Fr_to_Ra([[0,0],[1,0]])) ¥eq is_nonneg([0,0] ¥S_TIMES [1,0])) &
		(Ra_is_nonneg(Fr_to_Ra([[1,0],[1,0]])) ¥eq is_nonneg([1,0] ¥S_TIMES [1,0]))
    ([0,0])-->T402 ==> [0,0] ¥S_TIMES [1,0] = [0,0]
    ([1,0])-->T402 ==> [1,0] ¥S_TIMES [1,0] = [1,0]
    EQUAL ==> Ra_is_nonneg(Fr_to_Ra([[0,0],[1,0]])) ¥eq is_nonneg([0,0])
    EQUAL ==> Ra_is_nonneg(Fr_to_Ra([[1,0],[1,0]])) ¥eq is_nonneg([1,0])
    Use_def(is_nonneg) ==> Ra_is_nonneg(Fr_to_Ra([[0,0],[1,0]])) &  Ra_is_nonneg(Fr_to_Ra([[1,0],[1,0]]))
    Discharge ==> QED
--
-- Next we show that given a rational number $r$, either it or its reverse $Ra_Rev(r)$
-- must be non-negative, and that if both are non-negative $r$ must be zero.
-- This is the rational analog of Theorem 424 for signed integers.
--
Theorem 466: [One of a rational and its additive inverse is always non-negative, and both are non-negative only if the rational is zero] (X in Ra) ¥imp ((Ra_is_nonneg(X) or Ra_is_nonneg(Ra_Rev(X))) &
	((Ra_is_nonneg(X) & Ra_is_nonneg(Ra_Rev(X))) ¥imp (X = Ra_0))). Proof:
--
-- This is a duplicate of Theorem 466: one of the two should be suppressed!
--
	Suppose_not(n) ==> (n in Ra) & ((not (Ra_is_nonneg(n) or Ra_is_nonneg(Ra_Rev(n)))) or
				(Ra_is_nonneg(n) & Ra_is_nonneg(Ra_Rev(n)) & (n /= Ra_0)))
	Use_def(Ra_Rev) ==> Ra_Rev(n) = Fr_to_Ra([S_Rev(car(arb(n))),cdr(arb(n))])
	EQUAL ==> Ra_is_nonneg(Ra_Rev(n)) ¥eq Ra_is_nonneg(Fr_to_Ra([S_Rev(car(arb(n))),cdr(arb(n))]))
	n-->T423 ==> Stat1: (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
	(arb(n))-->T431 ==>
	(arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
    EQUAL ==> [car(arb(n)),cdr(arb(n))] in Fr
    (car(arb(n)))-->T391 ==> S_Rev(car(arb(n))) in Si
    (S_Rev(car(arb(n))),cdr(arb(n)))-->T459 ==>
    		Ra_is_nonneg(Ra_Rev(n)) ¥eq is_nonneg(S_Rev(car(arb(n))) ¥S_TIMES cdr(arb(n)))
	ELEM ==> (not (Ra_is_nonneg(n) or is_nonneg(S_Rev(car(arb(n))) ¥S_TIMES cdr(arb(n))))) or
				((Ra_is_nonneg(n) & is_nonneg(S_Rev(car(arb(n))) ¥S_TIMES cdr(arb(n)))) & (n /= Ra_0))
	Use_def(Ra_is_nonneg) ==> (not(is_nonneg(car(arb(n)) ¥S_TIMES cdr(arb(n))) or
					is_nonneg(S_Rev(car(arb(n))) ¥S_TIMES cdr(arb(n))))) or
			(is_nonneg(car(arb(n)) ¥S_TIMES cdr(arb(n))) &
					is_nonneg(S_Rev(car(arb(n))) ¥S_TIMES cdr(arb(n))) & (n /= Ra_0))
	ALGEBRA ==> S_Rev(car(arb(n))) ¥S_TIMES cdr(arb(n)) = S_Rev(car(arb(n)) ¥S_TIMES cdr(arb(n)))
	EQUAL ==> (not(is_nonneg(car(arb(n)) ¥S_TIMES cdr(arb(n))) or
					is_nonneg(S_Rev(car(arb(n)) ¥S_TIMES cdr(arb(n)))))) or
			(is_nonneg(car(arb(n)) ¥S_TIMES cdr(arb(n))) &
					is_nonneg(S_Rev(car(arb(n)) ¥S_TIMES cdr(arb(n)))) & (n /= Ra_0))
	ALGEBRA ==> car(arb(n)) ¥S_TIMES cdr(arb(n)) in Si
	(car(arb(n)) ¥S_TIMES cdr(arb(n)))-->T424 ==> Stat2: (car(arb(n)) ¥S_TIMES cdr(arb(n)) = [0,0]) & (n /= Ra_0)
	(cdr(arb(n)),car(arb(n)))-->T407 ==> car(arb(n)) = [0,0]
	Use_def(Ra_0) ==> Ra_0 = Fr_to_Ra([[0,0],[1,0]])
	Use_def(Same_frac) ==> Stat3: Same_frac([[0,0],[1,0]],[car(arb(n)),cdr(arb(n))]) ¥eq
			(car([[0,0],[1,0]]) ¥S_TIMES cdr([car(arb(n)),cdr(arb(n))]) =
						cdr([[0,0],[1,0]]) ¥S_TIMES car([car(arb(n)),cdr(arb(n))]))
	(Stat3)ELEM ==> Same_frac([[0,0],[1,0]],[car(arb(n)),cdr(arb(n))]) ¥eq
	([0,0] ¥S_TIMES cdr(arb(n)) = [1,0] ¥S_TIMES car(arb(n)))
	EQUAL ==> Stat4: Same_frac([[0,0],[1,0]],[car(arb(n)),cdr(arb(n))]) ¥eq
	([0,0] ¥S_TIMES cdr(arb(n)) = [1,0] ¥S_TIMES [0,0])
	(cdr(arb(n)))-->T401 ==> [0,0] ¥S_TIMES cdr(arb(n)) = [0,0]
	T368 ==> [0,0] in Si
	([0,0])-->T401 ==> [1,0] ¥S_TIMES [0,0] = [0,0]
	T368 ==> Stat5: ([0,0] in Si) & ([1,0] in Si)
    T212 ==> Stat6: 1 /= 0
    (Stat5)ELEM ==> ([[0,0],[1,0]] = [car([[0,0],[1,0]]),cdr([[0,0],[1,0]])]) &
    		(car([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) /= [0,0])
    ([0,0],[1,0])-->T432(*) ==> [[0,0],[1,0]] in Fr
	(Stat4)ELEM ==> Same_frac([[0,0],[1,0]],[car(arb(n)),cdr(arb(n))])
	([[0,0],[1,0]],[car(arb(n)),cdr(arb(n))])-->T422 ==>
			Fr_to_Ra([[0,0],[1,0]]) = Fr_to_Ra([car(arb(n)),cdr(arb(n))])
	EQUAL ==> Stat7: Ra_0 = Fr_to_Ra(arb(n))
	(Stat7,Stat2,Stat1)Discharge ==> QED
--
--
--
Theorem 467: [The unit rational is the identity for multiplication] (X in Ra) ¥imp (X = X ¥Ra_TIMES Ra_1). Proof:
    Suppose_not(n) ==> (n in Ra) & (n /= n ¥Ra_TIMES Ra_1)
    Use_def(Ra_1) ==> n /= n ¥Ra_TIMES Fr_to_Ra([[1,0],[1,0]])
    T368 ==> ([1,0] in Si) & ([1,0] /= [0,0])
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    (n,[1,0],[1,0])-->T439 ==> n ¥Ra_TIMES Fr_to_Ra([[1,0],[1,0]]) =
    			Fr_to_Ra([car(arb(n)) ¥S_TIMES [1,0],cdr(arb(n)) ¥S_TIMES [1,0]])
    (arb(n))-->T431 ==>
	(arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
 	(car(arb(n)))-->T402 ==> car(arb(n)) ¥S_TIMES [1,0] = car(arb(n))
 	(cdr(arb(n)))-->T402 ==> cdr(arb(n)) ¥S_TIMES [1,0] = cdr(arb(n))
 	EQUAL ==> n ¥Ra_TIMES Fr_to_Ra([[1,0],[1,0]]) = Fr_to_Ra([car(arb(n)),cdr(arb(n))])
 	EQUAL ==> false; Discharge ==> QED
--
-- Next we show that a rational number is zero if and only if the numerator of any one of
-- its expressions as a fraction is zero.
--
Theorem 468: [The zero rational is represented by any fraction whose numerator is 0] (X in Ra) ¥imp ((X = Ra_0) ¥eq (car(arb(X)) = [0,0])). Proof:
    Suppose_not(n) ==> (n in Ra) & (not((n = Ra_0) ¥eq (car(arb(n)) = [0,0])))
    Use_def(Ra_0) ==> Ra_0 = Fr_to_Ra([[0,0],[1,0]])
    T368 ==> Stat1: ([0,0] in Si) & ([1,0] in Si) & ([1,0] /= [0,0])
    ([0,0],[1,0])-->T432(*) ==> [[0,0],[1,0]] in Fr
	ELEM ==> (cdr([[0,0],[1,0]]) = [1,0]) & (car([[0,0],[1,0]]) = [0,0])
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    (arb(n))-->T431 ==>
	(arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
	Suppose ==> car(arb(n)) = [0,0]
	Suppose ==> not Same_frac(arb(n),[[0,0],[1,0]])
    Use_def(Same_frac) ==> cdr(arb(n)) ¥S_TIMES car([[0,0],[1,0]]) /= car(arb(n)) ¥S_TIMES cdr([[0,0],[1,0]])
	EQUAL ==> cdr(arb(n)) ¥S_TIMES [0,0] /= [0,0] ¥S_TIMES [1,0]
	ALGEBRA ==> [0,0] ¥S_TIMES cdr(arb(n)) /= [0,0] ¥S_TIMES [1,0]
	(cdr(arb(n)))-->T401 ==> [0,0] ¥S_TIMES cdr(arb(n)) = [0,0]
 	([1,0])-->T401 ==> false; Discharge ==> Same_frac(arb(n),[[0,0],[1,0]])
	(arb(n),[[0,0],[1,0]])-->T422 ==> Fr_to_Ra(arb(n)) = Fr_to_Ra([[0,0],[1,0]])
	EQUAL ==> false; Discharge ==> (car(arb(n)) /= [0,0]) & (n = Ra_0)
	ELEM ==> Fr_to_Ra(arb(n)) = Fr_to_Ra([[0,0],[1,0]])
	(arb(n),[[0,0],[1,0]])-->T422 ==> Same_frac(arb(n),[[0,0],[1,0]])
	Use_def(Same_frac) ==> car(arb(n)) ¥S_TIMES cdr([[0,0],[1,0]]) = cdr(arb(n)) ¥S_TIMES car([[0,0],[1,0]])
	EQUAL ==> car(arb(n)) ¥S_TIMES [1,0] = cdr(arb(n)) ¥S_TIMES [0,0]
	ALGEBRA ==> car(arb(n)) ¥S_TIMES [1,0] = [0,0] ¥S_TIMES cdr(arb(n))
	(cdr(arb(n)))-->T401 ==> car(arb(n)) ¥S_TIMES [1,0] = [0,0]
	ALGEBRA ==> [1,0] ¥S_TIMES car(arb(n)) = [0,0]
    (car(arb(n)))-->T401 ==> false; Discharge ==> QED
--
-- Our next theorem states that the product and sum of any two non-negative rational numbers
-- is non-negative.
--
Theorem 469: [The sum and product of two non-negative rationals is non-negative] ((X in Ra) & (Y in Ra) & Ra_is_nonneg(X) & Ra_is_nonneg(Y)) ¥imp
	(Ra_is_nonneg(X ¥Ra_PLUS Y) & Ra_is_nonneg(X ¥Ra_TIMES Y)). Proof:
    Suppose_not(n,m) ==> (n in Ra) & (m in Ra) & Ra_is_nonneg(n) & Ra_is_nonneg(m) &
	(not(Ra_is_nonneg(n ¥Ra_PLUS m) & Ra_is_nonneg(n ¥Ra_TIMES m)))
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(n))-->T431 ==>
	(arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
    (arb(m))-->T431 ==>
	(arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    Loc_def ==> an = car(arb(n))
    Loc_def ==> dn = cdr(arb(n))
    Loc_def ==> am = car(arb(m))
    Loc_def ==> dm = cdr(arb(m))
    EQUAL ==> Stat1: (arb(n) = [an,dn]) & (an in Si) & (dn in Si) & (dn /= [0,0])
    EQUAL ==> Stat2: (arb(m) = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    (dm,dn)-->T407(Stat1,Stat2*) ==> Stat3: dn ¥S_TIMES dm /= [0,0]
    Use_def(Ra_is_nonneg) ==> is_nonneg(car(arb(n)) ¥S_TIMES cdr(arb(n))) & is_nonneg(car(arb(m)) ¥S_TIMES cdr(arb(m)))
    EQUAL ==> Stat4: is_nonneg(an ¥S_TIMES dn) & is_nonneg(am ¥S_TIMES dm)
    ALGEBRA ==> Stat5: (an ¥S_TIMES am in Si) & (dn ¥S_TIMES dm in Si)
    ALGEBRA ==> Stat6: (an ¥S_TIMES dn in Si) & (am ¥S_TIMES dm in Si)
    Suppose ==> not Ra_is_nonneg(n ¥Ra_TIMES m)
    Use_def(¥Ra_TIMES) ==> not Ra_is_nonneg(Fr_to_Ra([car(arb(n)) ¥S_TIMES car(arb(m)),cdr(arb(n)) ¥S_TIMES cdr(arb(m))]))
    EQUAL ==> not Ra_is_nonneg(Fr_to_Ra([an ¥S_TIMES am, dn ¥S_TIMES dm]))
    (an ¥S_TIMES am, dn ¥S_TIMES dm)-->T459 ==> not is_nonneg((an ¥S_TIMES am) ¥S_TIMES (dn ¥S_TIMES dm))
    ALGEBRA ==> not is_nonneg((an ¥S_TIMES dn) ¥S_TIMES (am ¥S_TIMES dm))
    (an ¥S_TIMES dn,am ¥S_TIMES dm)-->T425 ==> false; Discharge ==> not Ra_is_nonneg(n ¥Ra_PLUS m)
    Use_def(¥Ra_PLUS) ==> not Ra_is_nonneg(Fr_to_Ra([(car(arb(n)) ¥S_TIMES cdr(arb(m))) ¥S_PLUS (car(arb(m)) ¥S_TIMES cdr(arb(n))),
    											cdr(arb(n)) ¥S_TIMES cdr(arb(m))]))
    EQUAL ==> Stat7: not Ra_is_nonneg(Fr_to_Ra([(an ¥S_TIMES dm) ¥S_PLUS (am ¥S_TIMES dn), dn ¥S_TIMES dm]))
    ALGEBRA ==> Stat8: (an ¥S_TIMES dm) ¥S_PLUS (am ¥S_TIMES dn) in Si
    ((an ¥S_TIMES dm) ¥S_PLUS (am ¥S_TIMES dn),dn ¥S_TIMES dm)-->T459(Stat7,Stat8,Stat5,Stat3) ==>
	not is_nonneg(((an ¥S_TIMES dm) ¥S_PLUS (am ¥S_TIMES dn)) ¥S_TIMES (dn ¥S_TIMES dm))
    ALGEBRA ==> not is_nonneg(((an ¥S_TIMES dn) ¥S_TIMES (dm ¥S_TIMES dm)) ¥S_PLUS ((am ¥S_TIMES dm) ¥S_TIMES (dn ¥S_TIMES dn)))
    dn-->T429 ==> Stat9: is_nonneg(dn ¥S_TIMES dn)
    dm-->T429 ==> Stat10: is_nonneg(dm ¥S_TIMES dm)
    ALGEBRA ==> Stat11: (dm ¥S_TIMES dm in Si) & (dn ¥S_TIMES dn in Si)
    (an ¥S_TIMES dn,dm ¥S_TIMES dm)-->T425(Stat5,Stat4,Stat9,Stat10,Stat6,Stat11) ==> Stat12: is_nonneg((an ¥S_TIMES dn) ¥S_TIMES (dm ¥S_TIMES dm))
    (am ¥S_TIMES dm,dn ¥S_TIMES dn)-->T425(Stat5,Stat4,Stat9,Stat10,Stat6,Stat11) ==> is_nonneg((am ¥S_TIMES dm) ¥S_TIMES (dn ¥S_TIMES dn))
    ALGEBRA ==> ((an ¥S_TIMES dn) ¥S_TIMES (dm ¥S_TIMES dm) in SI) & ((am ¥S_TIMES dm) ¥S_TIMES (dn ¥S_TIMES dn) in Si)
    ((an ¥S_TIMES dn) ¥S_TIMES (dm ¥S_TIMES dm),((am ¥S_TIMES dm) ¥S_TIMES (dn ¥S_TIMES dn)))-->T425(Stat12) ==>
	is_nonneg(((an ¥S_TIMES dn) ¥S_TIMES (dm ¥S_TIMES dm)) ¥S_PLUS ((am ¥S_TIMES dm) ¥S_TIMES (dn ¥S_TIMES dn)))
    Discharge ==> QED
--
-- We add various additional elementary properties of the ordering of rationals.
--

--
-- The following compound of earlier theorems is derived
-- uniquely as a trigger for the THEORY Ordered_add.
--
Theorem 470: (Ra_0 in Ra) &
	(FORALL x in Ra | ((x ¥Ra_PLUS Ra_0) = x) & ((x ¥Ra_PLUS Ra_Rev(x)) = Ra_0) & (Ra_Rev(x) in Ra))  &
	(FORALL x in Ra, y in Ra | ((x ¥Ra_PLUS y) in Ra) & ((x ¥Ra_PLUS y) = (y ¥Ra_PLUS x)) & ((x ¥Ra_PLUS Ra_Rev(y)) = (x ¥Ra_MINUS y))) &
	(FORALL x in Ra, y in Ra, z in Ra | ((x ¥Ra_PLUS y) ¥Ra_PLUS z) = (x ¥Ra_PLUS (y ¥Ra_PLUS z))) &
	(FORALL x in Ra, y in Ra | (Ra_is_nonneg(x) & Ra_is_nonneg(y)) ¥imp Ra_is_nonneg(x ¥Ra_PLUS y)) &
	(FORALL x in Ra | (Ra_is_nonneg(x) or Ra_is_nonneg(Ra_Rev(x))) & ((Ra_is_nonneg(x) & Ra_is_nonneg(Ra_Rev(x))) ¥imp (x = Ra_0))). Proof:
Suppose_not ==> AUTO
	ALGEBRA ==> Ra_0 in Ra
	Suppose ==> Stat1: not(FORALL x in Ra | ((x ¥Ra_PLUS Ra_0) = x) & ((x ¥Ra_PLUS Ra_Rev(x)) = Ra_0) & (Ra_Rev(x) in Ra))
		x1-->Stat1(Stat1*) ==> (x1 in Ra) & (not(((x1 ¥Ra_PLUS Ra_0) = x1) & ((x1 ¥Ra_PLUS Ra_Rev(x1)) = Ra_0) & (Ra_Rev(x1) in Ra)))
			ALGEBRA(Stat1) ==> ((x1 ¥Ra_PLUS Ra_0) = x1) & ((x1 ¥Ra_PLUS Ra_Rev(x1)) = Ra_0) & (Ra_Rev(x1) in Ra)
	(Stat1)Discharge ==> AUTO
	Suppose ==> Stat2: not(FORALL x in Ra, y in Ra | ((x ¥Ra_PLUS y) in Ra) & ((x ¥Ra_PLUS y) = (y ¥Ra_PLUS x)) & ((x ¥Ra_PLUS Ra_Rev(y)) = (x ¥Ra_MINUS y)))
		(x2,y2)-->Stat2(Stat2*) ==> (x2 in Ra) & (y2 in Ra) & (not(((x2 ¥Ra_PLUS y2) in Ra) & ((x2 ¥Ra_PLUS y2) = (y2 ¥Ra_PLUS x2)) & ((x2 ¥Ra_PLUS Ra_Rev(y2)) = (x2 ¥Ra_MINUS y2))))
			ALGEBRA(Stat2) ==> ((x2 ¥Ra_PLUS y2) in Ra) & ((x2 ¥Ra_PLUS y2) = (y2 ¥Ra_PLUS x2)) & ((x2 ¥Ra_PLUS Ra_Rev(y2)) = (x2 ¥Ra_MINUS y2))
	(Stat2)Discharge ==> AUTO
	Suppose ==> Stat3: not(FORALL x in Ra, y in Ra, z in Ra | ((x ¥Ra_PLUS y) ¥Ra_PLUS z) = (x ¥Ra_PLUS (y ¥Ra_PLUS z)))
		(x3,y3,z3)-->Stat3(Stat3*) ==> (x3 in Ra) & (y3 in Ra) & (z3 in Ra) & (((x3 ¥Ra_PLUS y3) ¥Ra_PLUS z3) /= (x3 ¥Ra_PLUS (y3 ¥Ra_PLUS z3)))
	ALGEBRA(Stat3) ==> false; (Stat3)Discharge ==> AUTO
	Suppose ==> Stat4: not(FORALL x in Ra, y in Ra | (Ra_is_nonneg(x) & Ra_is_nonneg(y)) ¥imp Ra_is_nonneg(x ¥Ra_PLUS y))
		(x4,y4)-->Stat4(Stat4*) ==> (x4 in Ra) & (y4 in Ra) & (not((Ra_is_nonneg(x4) & Ra_is_nonneg(y4)) ¥imp Ra_is_nonneg(x4 ¥Ra_PLUS y4)))
	(x4,y4)-->T469(Stat4*) ==> false; Discharge ==> Stat5: not(FORALL x in Ra | (Ra_is_nonneg(x) or Ra_is_nonneg(Ra_Rev(x))) & ((Ra_is_nonneg(x) & Ra_is_nonneg(Ra_Rev(x))) ¥imp (x = Ra_0)))
	x5-->Stat5(Stat5*) ==> (x5 in Ra) & (not((Ra_is_nonneg(x5) or Ra_is_nonneg(Ra_Rev(x5))) & ((Ra_is_nonneg(x5) & Ra_is_nonneg(Ra_Rev(x5))) ¥imp (x5 = Ra_0))))
	x5-->T466(Stat5*) ==> false; Discharge ==> QED
--
--
--
APPLY(GE_thryvar:Ra_GE,LE_thryvar:Ra_LE,GT_thryvar:Ra_GT,LT_thryvar:Ra_LT) Ordered_add(g->Ra,e->Ra_0,pluz(i,j)->(i ¥Ra_PLUS j),minz(i,j)->(i ¥Ra_MINUS j),rvz(i)->Ra_Rev(i),nneg(j)->Ra_is_nonneg(j)) ==>
Theorem 471: [The ordering of two rationals is defined by the sign of their differences, 0] (FORALL x, y | (Ra_GE(x,y) ¥eq Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y))) & (Ra_LE(x,y) ¥eq Ra_GE(y,x)) &
	(Ra_GT(x,y) ¥eq (Ra_GE(x,y) & (x /= y))) & (Ra_LT(x,y) ¥eq Ra_GT(y,x))) &
	(FORALL x, y | (Ra_LE(x,y) ¥eq Ra_is_nonneg((y ¥Ra_PLUS Ra_Rev(x)))) &
		(((x in Ra) & (y in Ra)) ¥imp (Ra_GT(x,y) ¥eq (Ra_is_nonneg((x ¥Ra_PLUS Ra_Rev(y))) & (x /= y)))) &
		(((x in Ra) & (y in Ra)) ¥imp (Ra_GT(x,y) ¥eq (Ra_is_nonneg((x ¥Ra_MINUS y)) & (x /= y))))) &
	(FORALL x, y | ((x in Ra) & (y in Ra) & ((x = y) or (not Ra_GE(x,y)))) ¥imp Ra_GE(y,x))
--
    Def 000o: Def(X ¥Ra_GE Y) := Ra_GE(X,Y)
    Def 000p: Def(X ¥Ra_LE Y) := Ra_LE(X,Y)
    Def 000q: Def(X ¥Ra_GT Y) := Ra_GT(X,Y)
    Def 000r: Def(X ¥Ra_LT Y) := Ra_LT(X,Y)

Theorem 472: [The ordering of two rationals is defined by the sign of their differences] (FORALL x,y | ((x ¥Ra_GE y) ¥eq Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y)))) &
	(FORALL x,y | (x ¥Ra_LE y) ¥eq (y ¥Ra_GE x)) &
	(FORALL x,y | ((x ¥Ra_GT y) ¥eq ((x ¥Ra_GE y) & (x /= y)))) &
	(FORALL x,y | ((x ¥Ra_LT y) ¥eq (y ¥Ra_GT x)))  &
    (FORALL x,y | ((x ¥Ra_LE y) ¥eq Ra_is_nonneg(y ¥Ra_PLUS Ra_Rev(x)))) &
	(FORALL x,y | (((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_GT y) ¥eq (Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y)) & (x /= y))))) &
	(FORALL x,y | (((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_GT y) ¥eq (Ra_is_nonneg(x ¥Ra_MINUS y) & (x /= y))))) &
    (FORALL x,y | (((x in Ra) & (y in Ra) & ((x = y) or (not(x ¥Ra_GE y)))) ¥imp (y ¥Ra_GE x))). Proof:
Suppose_not ==> AUTO
	T471 ==> Stat1: (FORALL x, y | (Ra_GE(x,y) ¥eq Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y))) &
		(Ra_LE(x,y) ¥eq Ra_GE(y,x)) &
		(Ra_GT(x,y) ¥eq (Ra_GE(x,y) & (x /= y))) &
		(Ra_LT(x,y) ¥eq Ra_GT(y,x))) &
		Stat2:	(FORALL x, y | ((x in Ra) & (y in Ra) & ((x = y) or (not Ra_GE(x,y)))) ¥imp Ra_GE(y,x)) &
		Stat3: (FORALL x, y | (Ra_LE(x,y) ¥eq Ra_is_nonneg((y ¥Ra_PLUS Ra_Rev(x)))) &
		(((x in Ra) & (y in Ra)) ¥imp (Ra_GT(x,y) ¥eq (Ra_is_nonneg((x ¥Ra_PLUS Ra_Rev(y))) & (x /= y)))) &
		(((x in Ra) & (y in Ra)) ¥imp (Ra_GT(x,y) ¥eq (Ra_is_nonneg((x ¥Ra_MINUS y)) & (x /= y)))))
	Suppose ==> Stat4: not(FORALL x,y | ((x ¥Ra_GE y) ¥eq Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y))))
		(x1,y1)-->Stat4(Stat4*) ==> (x1 ¥Ra_GE y1) ¥neq Ra_is_nonneg(x1 ¥Ra_PLUS Ra_Rev(y1))
		Use_def(¥Ra_GE) ==> Ra_GE(x1,y1) ¥neq Ra_is_nonneg(x1 ¥Ra_PLUS Ra_Rev(y1))
	(x1,y1)-->Stat1(Stat4*) ==> false; Discharge ==> AUTO
	Suppose ==> Stat5: not(FORALL x,y | (x ¥Ra_LE y) ¥eq (y ¥Ra_GE x))
		(x2,y2)-->Stat5(Stat5*) ==> AUTO
		Use_def(¥Ra_LE) ==> (x2 ¥Ra_LE y2) ¥eq Ra_LE(x2,y2)
		Use_def(¥Ra_GE) ==> (y2 ¥Ra_GE x2) ¥eq Ra_GE(y2,x2)
	(x2,y2)-->Stat1(Stat5*) ==> false; Discharge ==> AUTO
	Suppose ==> Stat6: not(FORALL x,y | ((x ¥Ra_GT y) ¥eq ((x ¥Ra_GE y) & (x /= y))))
		(x3,y3)-->Stat6(Stat6*) ==> AUTO
		Use_def(¥Ra_GT) ==> (x3 ¥Ra_GT y3) ¥eq RA_GT(x3,y3)
		Use_def(¥Ra_GE) ==> (x3 ¥Ra_GE y3) ¥eq Ra_GE(x3,y3)
	(x3,y3)-->Stat1(Stat6*) ==> false; Discharge ==> AUTO
	Suppose ==> Stat7: not(FORALL x,y | ((x ¥Ra_LT y) ¥eq (y ¥Ra_GT x)))
		(x4,y4)-->Stat7(Stat7*) ==> AUTO
		(x4,y4)-->Stat1(Stat1,Stat1*) ==> Ra_LT(x4,y4) ¥eq Ra_GT(y4,x4)
		Use_def(¥Ra_LT) ==> (x4 ¥Ra_LT y4) ¥eq Ra_LT(x4,y4)
		Use_def(¥Ra_GT) ==> (y4 ¥Ra_GT x4) ¥eq RA_GT(y4,x4)
	(Stat7*)Discharge ==> AUTO
	Suppose ==> Stat8: not(FORALL x,y | (((x in Ra) & (y in Ra) & ((x = y) or (not(x ¥Ra_GE y)))) ¥imp (y ¥Ra_GE x)))
		(x5,y5)-->Stat8(Stat8*) ==> AUTO
		(x5,y5)-->Stat2(Stat1,Stat1*) ==> ((x5 in Ra) & (y5 in Ra) & ((x5 = y5) or (not Ra_GE(x5,y5)))) ¥imp Ra_GE(y5,x5)
		Use_def(¥Ra_GE) ==> ((x5 ¥Ra_GE y5) ¥eq Ra_GE(x5,y5)) & ((y5 ¥Ra_GE x5) ¥eq Ra_GE(y5,x5))
	(Stat8*)Discharge ==> AUTO
	Suppose ==> Stat9: not(FORALL x,y | ((x ¥Ra_LE y) ¥eq Ra_is_nonneg(y ¥Ra_PLUS Ra_Rev(x))))
		(x6,y6)-->Stat9(Stat9*) ==> AUTO
		(x6,y6)-->Stat3(Stat1,Stat1*) ==> Ra_LE(x6,y6) ¥eq Ra_is_nonneg((y6 ¥Ra_PLUS Ra_Rev(x6)))
		Use_def(¥Ra_LE) ==> (x6 ¥Ra_LE y6) ¥eq Ra_LE(x6,y6)
	(Stat9*)Discharge ==> AUTO
	Suppose ==> Stat10: not(FORALL x,y | (((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_GT y) ¥eq (Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y)) & (x /= y)))))
		(x7,y7)-->Stat10(Stat10*) ==> AUTO
		(x7,y7)-->Stat3(Stat1,Stat1*) ==> (((x7 in Ra) & (y7 in Ra)) ¥imp (Ra_GT(x7,y7) ¥eq (Ra_is_nonneg((x7 ¥Ra_PLUS Ra_Rev(y7))) & (x7 /= y7))))
		Use_def(¥Ra_GT) ==> (x7 ¥Ra_GT y7) ¥eq Ra_GT(x7,y7)
	(Stat10*)Discharge ==> Stat11: not(FORALL x,y | (((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_GT y) ¥eq (Ra_is_nonneg(x ¥Ra_MINUS y) & (x /= y)))))
	(x8,y8)-->Stat11(Stat11*) ==> AUTO
	(x8,y8)-->Stat3(Stat1,Stat1*) ==> (((x8 in Ra) & (y8 in Ra)) ¥imp (Ra_GT(x8,y8) ¥eq (Ra_is_nonneg((x8 ¥Ra_MINUS y8)) & (x8 /= y8))))
	Use_def(¥Ra_GT) ==> (x8 ¥Ra_GT y8) ¥eq Ra_GT(x8,y8)
(Stat11*)Discharge ==> QED
--
Theorem 473: [Various basic properties of rational comparison] ((X ¥Ra_GE Y) ¥eq Ra_is_nonneg(X ¥Ra_PLUS Ra_Rev(Y))) &
	((X ¥Ra_LE Y) ¥eq (Y ¥Ra_GE X)) &
	((X ¥Ra_GT Y) ¥eq ((X ¥Ra_GE Y) & (X /= Y))) &
	((X ¥Ra_LT Y) ¥eq (Y ¥Ra_GT X))  &
	((X ¥Ra_LE Y) ¥eq Ra_is_nonneg(Y ¥Ra_PLUS Ra_Rev(X))) &
	(((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_GT Y) ¥eq (Ra_is_nonneg(X ¥Ra_PLUS Ra_Rev(Y)) & (X /= Y)))) &
	(((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_GT Y) ¥eq (Ra_is_nonneg(X ¥Ra_MINUS Y) & (X /= Y)))) &
	(((X in Ra) & (Y in Ra) & ((X = Y) or (not(X ¥Ra_GE Y)))) ¥imp (Y ¥Ra_GE X)). Proof:
    Suppose_not(x,y) ==> not(((x ¥Ra_GE y) ¥eq Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y))) &
	((x ¥Ra_LE y) ¥eq (y ¥Ra_GE x)) &
	((x ¥Ra_GT y) ¥eq ((x ¥Ra_GE y) & (x /= y))) &
	((x ¥Ra_LT y) ¥eq (y ¥Ra_GT x))  &
	((x ¥Ra_LE y) ¥eq Ra_is_nonneg(y ¥Ra_PLUS Ra_Rev(x))) &
	(((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_GT y) ¥eq (Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y)) & (x /= y)))) &
	(((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_GT y) ¥eq (Ra_is_nonneg(x ¥Ra_MINUS y) & (x /= y)))) &
	(((x in Ra) & (y in Ra) & ((x = y) or (not(x ¥Ra_GE y)))) ¥imp (y ¥Ra_GE x)))
        Suppose ==> not(((x ¥Ra_GE y) ¥eq Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y))))
            T472 ==> Stat1: (FORALL x,y | ((x ¥Ra_GE y) ¥eq Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y))))
        (x,y)-->Stat1 ==> false; Discharge ==> ((x ¥Ra_GE y) ¥eq Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y)))
        Suppose ==> not(((x ¥Ra_LE y) ¥eq (y ¥Ra_GE x)))
            T472 ==> Stat2: (FORALL x,y | ((x ¥Ra_LE y) ¥eq (y ¥Ra_GE x)))
        (x,y)-->Stat2 ==> false; Discharge ==> ((x ¥Ra_LE y) ¥eq (y ¥Ra_GE x))
        Suppose ==> not((x ¥Ra_GT y) ¥eq ((x ¥Ra_GE y) & (x /= y)))
            T472 ==> Stat3: (FORALL x,y | ((x ¥Ra_GT y) ¥eq ((x ¥Ra_GE y) & (x /= y))))
        (x,y)-->Stat3 ==> false; Discharge ==> ((x ¥Ra_GT y) ¥eq ((x ¥Ra_GE y) & (x /= y)))
        Suppose ==> not((x ¥Ra_LT y) ¥eq (y ¥Ra_GT x))
            T472 ==> Stat4: (FORALL x,y | ((x ¥Ra_LT y) ¥eq (y ¥Ra_GT x)))
        (x,y)-->Stat4 ==> false; Discharge ==> ((x ¥Ra_LT y) ¥eq (y ¥Ra_GT x))
        Suppose ==> not((x ¥Ra_LE y) ¥eq Ra_is_nonneg(y ¥Ra_PLUS Ra_Rev(x)))
            T472 ==> Stat5: (FORALL x,y | ((x ¥Ra_LE y) ¥eq Ra_is_nonneg(y ¥Ra_PLUS Ra_Rev(x))))
        (x,y)-->Stat5 ==> false; Discharge ==> ((x ¥Ra_LE y) ¥eq Ra_is_nonneg(y ¥Ra_PLUS Ra_Rev(x)))
        Suppose ==> not(((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_GT y) ¥eq (Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y)) & (x /= y))))
            T472 ==> Stat6: (FORALL x,y | (((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_GT y) ¥eq (Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y)) & (x /= y)))))
        (x,y)-->Stat6 ==> false; Discharge ==> (((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_GT y) ¥eq (Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y)) & (x /= y))))
        Suppose ==> not(((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_GT y) ¥eq (Ra_is_nonneg(x ¥Ra_MINUS y) & (x /= y))))
            T472 ==> Stat7: (FORALL x,y | (((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_GT y) ¥eq (Ra_is_nonneg(x ¥Ra_MINUS y) & (x /= y)))))
        (x,y)-->Stat7 ==> false; Discharge ==> not(((X in Ra) & (Y in Ra) & ((X = Y) or (not(X ¥Ra_GE Y)))) ¥imp (Y ¥Ra_GE X))
        T472 ==> Stat8: (FORALL x,y | (((x in Ra) & (y in Ra) & ((x = y) or (not(x ¥Ra_GE y)))) ¥imp (y ¥Ra_GE x)))
    (x,y)-->Stat8 ==> false; Discharge ==> QED
--
-- The following easy lemmas add more elementary properties of inequality to the preceding.
--
Theorem 474: [Greater_than_equal is greater-than and equal] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_GE Y) ¥eq ((X ¥Ra_GT Y) or (X = Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	(y,x)-->T473 ==> (x = y) ¥imp (x ¥Ra_GE y)
	(x,y)-->T473 ==> (x ¥Ra_GT y or x = y) ¥eq (x ¥Ra_GE y or x = y)
	Discharge ==> QED
--
Theorem 475: [Less_than_equal is less-than and equal] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_LE Y) ¥eq ((X ¥Ra_LT Y) or (X = Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T473 ==> ((y ¥Ra_GE x) ¥eq (x ¥Ra_LE y)) & ((y ¥Ra_GT x) ¥eq (x ¥Ra_LT y))
	(y,x)-->T474 ==> false; Discharge ==> QED
--
Theorem 476: [The rationals are a linearly ordered set] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_GT Y) or (X = Y) or (Y ¥Ra_GT X)). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T473 ==> x ¥Ra_GE y or y ¥Ra_GE x
	(y,x)-->T474 ==> (y ¥Ra_GE x) ¥eq (y ¥Ra_GT x or X = Y)
	(x,y)-->T474 ==> false; Discharge ==> QED
--
Theorem 477: [The rationals are a linearly ordered set, 2] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_LT Y) or (X = Y) or (Y ¥Ra_LT X)). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T473 ==> (y ¥Ra_GT x) ¥eq (x ¥Ra_LT y)
	(y,x)-->T473 ==> (x ¥Ra_GT y) ¥eq (y ¥Ra_LT x)
	(y,x)-->T476 ==> false; Discharge ==> QED
--
Theorem 478: [The rationals are a linearly ordered set,3] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_GT Y) or (Y ¥Ra_GE X)). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T476 ==> AUTO
	(y,x)-->T474 ==> false; Discharge ==> QED
--
Theorem 479: [The rationals are a linearly ordered set,4] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_LT Y) or (Y ¥Ra_LE X)). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T477 ==> AUTO
	(y,x)-->T475 ==> false; Discharge ==> QED
--
Theorem 480: [Transitivity of ordering] ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_GE Y) & (Y ¥Ra_GE Z)) ¥imp (X ¥Ra_GE Z)). Proof:
	Suppose_not(x,y,z) ==> (x in Ra) & (y in Ra) & (z in Ra) & (x ¥Ra_GE y) & (y ¥Ra_GE z) & (not(x ¥Ra_GE z))
	(x,y)-->T473 ==> (x ¥Ra_GE y) ¥eq Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y))
	(y,z)-->T473 ==> (y ¥Ra_GE z) ¥eq Ra_is_nonneg(y ¥Ra_PLUS Ra_Rev(z))
	(x,z)-->T473 ==> (x ¥Ra_GE z) ¥eq Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(z))
	ALGEBRA ==> ((x ¥Ra_PLUS Ra_Rev(y)) in Ra) & ((y ¥Ra_PLUS Ra_Rev(z)) in Ra) & ((x ¥Ra_PLUS Ra_Rev(z)) in Ra)
	ALGEBRA ==> (x ¥Ra_PLUS Ra_Rev(y)) ¥Ra_PLUS (y ¥Ra_PLUS Ra_Rev(z)) = (x ¥Ra_PLUS Ra_Rev(z)) ¥Ra_PLUS (y ¥Ra_PLUS Ra_Rev(y))
	y-->T452 ==> y ¥Ra_PLUS Ra_Rev(y) = Ra_0
	EQUAL ==> (x ¥Ra_PLUS Ra_Rev(y)) ¥Ra_PLUS (y ¥Ra_PLUS Ra_Rev(z)) = (x ¥Ra_PLUS Ra_Rev(z)) ¥Ra_PLUS Ra_0
	ALGEBRA ==> (x ¥Ra_PLUS Ra_Rev(y)) ¥Ra_PLUS (y ¥Ra_PLUS Ra_Rev(z)) = (x ¥Ra_PLUS Ra_Rev(z))
	(x ¥Ra_PLUS Ra_Rev(y),y ¥Ra_PLUS Ra_Rev(z))-->T469 ==> Ra_is_nonneg((x ¥Ra_PLUS Ra_Rev(y)) ¥Ra_PLUS (y ¥Ra_PLUS Ra_Rev(z)))
	EQUAL ==> Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(z))
	Discharge ==> QED
--
-- Our next lemma simply states that the zero rational is its own negative
-- and that the unit rational is  positive.
--
Theorem 481: [Properties of the rational zero and unit] (Ra_Rev(Ra_0) = Ra_0) & (Ra_1 /= Ra_0) & (Ra_1 ¥Ra_GT Ra_0). Proof:
	Suppose_not ==> Stat1: (Ra_Rev(Ra_0) /= Ra_0) or (Ra_1 = Ra_0) or (not (Ra_1 ¥Ra_GT Ra_0))
--
-- The first part of this assertion has the following elementary algebraic proof.
--
	T451 ==> (Ra_0 in Ra) & (Ra_1 in Ra)
	Ra_0-->T452 ==> (Ra_0 ¥Ra_PLUS Ra_Rev(Ra_0) = Ra_0) & (Ra_Rev(Ra_0) in Ra)
	(Ra_Rev(Ra_0))-->T451 ==> Ra_Rev(Ra_0) ¥Ra_PLUS Ra_0 = Ra_Rev(Ra_0)
	(Ra_0,Ra_Rev(Ra_0))-->T445 ==> Stat2: Ra_0 = Ra_Rev(Ra_0)
--
-- Similarly, to prove that $Ra_1 /= Ra_0$, we have only to use the definitions of the
-- quantities and operators involved, and do a bit of algebra.
--
	Suppose ==> Ra_1 = Ra_0
	Use_def(Ra_1) ==> Fr_to_Ra([[1,0],[1,0]]) = Ra_0
	Use_def(Ra_0) ==> Fr_to_Ra([[1,0],[1,0]]) = Fr_to_Ra([[0,0],[1,0]])
	T368 ==> Stat3: ([0,0] in Si) & ([1,0] in Si) & ([1,0] /= [0,0])
	(Stat3)ELEM ==> (car([[1,0],[1,0]]) in Si) & (cdr([[1,0],[1,0]]) in Si) & (cdr([[1,0],[1,0]]) /= [0,0])
    ([1,0],[1,0])-->T432(*) ==> [[1,0],[1,0]] in Fr
	(Stat3)ELEM ==> (car([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) /= [0,0])
    ([0,0],[1,0])-->T432(*) ==> [[0,0],[1,0]] in Fr
	([[1,0],[1,0]],[[0,0],[1,0]])-->T422 ==> Same_frac([[1,0],[1,0]],[[0,0],[1,0]])
	Use_def(Same_frac) ==> car([[1,0],[1,0]]) ¥S_TIMES cdr([[0,0],[1,0]]) = cdr([[1,0],[1,0]]) ¥S_TIMES car([[0,0],[1,0]])
	TELEM ==> (car([[1,0],[1,0]]) = [1,0]) & (cdr([[1,0],[1,0]]) = [1,0])
	TELEM ==> (car([[0,0],[1,0]]) = [0,0]) & (cdr([[0,0],[1,0]]) = [1,0])
	EQUAL ==> [1,0] ¥S_TIMES [1,0] = [1,0] ¥S_TIMES [0,0]
	([1,0])-->T402 ==> [1,0] = [1,0] ¥S_TIMES [0,0]
	([0,0])-->T401 ==> [1,0] = [0,0]
	T368 ==> false; Discharge ==> Stat4: Ra_1 /= Ra_0
--
--
--
    (Ra_1,Ra_0)-->T473 ==> (Ra_1 ¥Ra_GT Ra_0) ¥eq (Ra_is_nonneg(Ra_1 ¥Ra_PLUS Ra_Rev(Ra_0)) & (Ra_1 /= Ra_0))
    EQUAL ==> (Ra_1 ¥Ra_GT Ra_0) ¥eq (Ra_is_nonneg(Ra_1 ¥Ra_PLUS Ra_0) & (Ra_1 /= Ra_0))
    Ra_1-->T451 ==> Ra_1 ¥Ra_PLUS Ra_0 = Ra_1
    EQUAL ==> (Ra_1 ¥Ra_GT Ra_0) ¥eq (Ra_is_nonneg(Ra_1) & (Ra_1 /= Ra_0))
    ALGEBRA ==> Stat5: ((Ra_1 ¥Ra_GT Ra_0) ¥eq (Ra_is_nonneg(Ra_1) & (Ra_1 /= Ra_0)))
    T465 ==> Stat6: Ra_is_nonneg(Ra_1)
    (Stat2,Stat4,Stat5,Stat6,Stat1*)Discharge ==> QED
--
-- Alternate characterization of non-negativity for rationals.
--
Theorem 482: [Alternate characterization of non-negativity for rationals] (X in Ra) ¥imp ((Ra_is_nonneg(X) ¥eq (X ¥Ra_GE Ra_0)) & ((X ¥Ra_GT Ra_0) ¥imp Ra_is_nonneg(X))). Proof:
Suppose_not(x) ==> AUTO
	Suppose ==> Stat1: Ra_is_nonneg(x) ¥eq (not(x ¥Ra_GE Ra_0))
		(x,Ra_0)-->T473(Stat1*) ==> Ra_is_nonneg(x) ¥eq (not Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(Ra_0)))
		()-->T481 ==> AUTO
		x-->T451(*) ==> x = (x ¥Ra_PLUS Ra_0)
		EQUAL(Stat1) ==> Stat2: Ra_is_nonneg(x) ¥eq (not Ra_is_nonneg(x))
	(Stat2*)ELEM ==> false; Discharge ==> Stat3: (Ra_is_nonneg(x) ¥eq (x ¥Ra_GE Ra_0)) & (x ¥Ra_GT Ra_0) & (not Ra_is_nonneg(x))
(x,Ra_0)-->T473(Stat3*) ==> false; Discharge ==> QED
--
-- Our next two theorems give the distributive law for subtraction, first in its simplest form, and then generally.
-- We begin with two preliminary lemmas, which give the corresponding rule for fractions.
--
Theorem 483: [Reversing the numerators of two equivalent rational fractions leaves them equivalent] ((X in Si) & (Y in Si) & (XP in Si) & (YP in Si) & Same_frac([X,Y],[XP,YP])) ¥imp
	Same_frac([S_Rev(X),Y],[S_Rev(XP),YP]). Proof:
	Suppose_not(m,n,mp,np) ==> (m in Si) & (n in Si) & (mp in Si) & (np in Si) & Same_frac([m,n],[mp,np]) &
						(not Same_frac([S_Rev(m),n],[S_Rev(mp),np]))
	Use_def(Same_frac) ==> (car([m,n]) ¥S_TIMES cdr([mp,np]) = cdr([m,n]) ¥S_TIMES car([mp,np])) &
	(not(car([S_Rev(m),n]) ¥S_TIMES cdr([S_Rev(mp),np]) = cdr([S_Rev(m),n]) ¥S_TIMES car([S_Rev(mp),np])))
	ELEM ==> (car([m,n]) = m) & (cdr([m,n]) = n) & (car([mp,np]) = mp) & (cdr([mp,np]) = np)
	ELEM ==> (car([S_Rev(m),n]) = S_Rev(m)) & (cdr([S_Rev(m),n]) = n) &
		(car([S_Rev(mp),np]) = S_Rev(mp)) & (cdr([S_Rev(mp),np]) = np)
	EQUAL ==> ((m ¥S_TIMES np) = (n ¥S_TIMES mp)) & (not((S_Rev(m) ¥S_TIMES np) = (n ¥S_TIMES S_Rev(mp))))
	m-->T391 ==> S_Rev(m) in Si
    ALGEBRA ==> (S_Rev(m) ¥S_TIMES np) = (np ¥S_TIMES S_Rev(m))
    (np,m)-->T390 ==> (np ¥S_TIMES S_Rev(m)) = S_Rev(np ¥S_TIMES m)
    (n,mp)-->T390 ==> (n ¥S_TIMES S_Rev(mp)) = S_Rev(n ¥S_TIMES mp)
    ALGEBRA ==> false; Discharge ==> QED

Theorem 484: [Alternate form of Theorem 483] ((X in Si) & (Y in Si) & (Y /= [0,0])) ¥imp (Ra_Rev(Fr_to_Ra([X,Y])) = Fr_to_Ra([S_Rev(X),Y])). Proof:
	Suppose_not(m,n) ==> ((m in Si) & (n in Si) & (n /= [0,0])) & (Ra_Rev(Fr_to_Ra([m,n])) /= Fr_to_Ra([S_Rev(m),n]))
	Use_def(Ra_Rev) ==> Ra_Rev(Fr_to_Ra([m,n]))  = Fr_to_Ra([S_Rev(car(arb(Fr_to_Ra([m,n])))),cdr(arb(Fr_to_Ra([m,n])))])
	(m,n)-->T432(*) ==> [m,n] in Fr
	m-->T391 ==> S_Rev(m) in Si
	(S_Rev(m),n)-->T432(*) ==> [S_Rev(m),n] in Fr
	([m,n])-->T421 ==> (Fr_to_Ra([m,n]) in Ra) & Same_frac([m,n],arb(Fr_to_Ra([m,n])))
	(Fr_to_Ra([m,n]))-->T423 ==> arb(Fr_to_Ra([m,n])) in Fr
	(arb(Fr_to_Ra([m,n])))-->T431 ==> (arb(Fr_to_Ra([m,n])) = [car(arb(Fr_to_Ra([m,n]))),cdr(arb(Fr_to_Ra([m,n])))]) &
	(car(arb(Fr_to_Ra([m,n]))) in Si) & (cdr(arb(Fr_to_Ra([m,n]))) in Si) & (cdr(arb(Fr_to_Ra([m,n]))) /= [0,0])
	(car(arb(Fr_to_Ra([m,n]))))-->T391 ==> S_Rev(car(arb(Fr_to_Ra([m,n])))) in Si
	(S_Rev(car(arb(Fr_to_Ra([m,n])))),cdr(arb(Fr_to_Ra([m,n]))))-->T432(*) ==>
	[S_Rev(car(arb(Fr_to_Ra([m,n])))),cdr(arb(Fr_to_Ra([m,n])))] in Fr
	EQUAL ==> Same_frac([m,n],[car(arb(Fr_to_Ra([m,n]))),cdr(arb(Fr_to_Ra([m,n])))])
	EQUAL ==> [car(arb(Fr_to_Ra([m,n]))),cdr(arb(Fr_to_Ra([m,n])))]  in Fr
	(m,n,car(arb(Fr_to_Ra([m,n]))),cdr(arb(Fr_to_Ra([m,n]))))-->T483 ==>
	Same_frac([S_Rev(m),n],[S_Rev(car(arb(Fr_to_Ra([m,n])))),cdr(arb(Fr_to_Ra([m,n])))])
	([S_Rev(m),n],[S_Rev(car(arb(Fr_to_Ra([m,n])))),cdr(arb(Fr_to_Ra([m,n])))])-->T422 ==> false; Discharge ==> QED

Theorem 485: [First law of signs for rational multiplication] ((X in Ra) & (Y in Ra)) ¥imp ((X ¥Ra_TIMES Ra_Rev(Y)) = Ra_Rev(X ¥Ra_TIMES Y)). Proof:
	Suppose_not(m,n) ==> Stat1: (m in Ra) & (n in Ra) & (m ¥Ra_TIMES Ra_Rev(n) /= Ra_Rev(m ¥Ra_TIMES n))
	n-->T423 ==> (n = Fr_to_Ra(arb(n))) & (arb(n) in Fr)
	(arb(n))-->T431 ==> (arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) &
				(cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
	m-->T423 ==> (m = Fr_to_Ra(arb(m))) & (arb(m) in Fr)
	(arb(m))-->T431 ==> (arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) &
				(cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
	Use_def(Ra_Rev) ==> m ¥Ra_TIMES Ra_Rev(n) = m ¥Ra_TIMES Fr_to_Ra([S_Rev(car(arb(n))),cdr(arb(n))])
	(car(arb(n)))-->T391 ==> S_Rev(car(arb(n))) in Si
	(m,S_Rev(car(arb(n))),cdr(arb(n)))-->T439 ==> m ¥Ra_TIMES Fr_to_Ra([S_Rev(car(arb(n))),cdr(arb(n))]) =
	Fr_to_Ra([car(arb(m)) ¥S_TIMES S_Rev(car(arb(n))),cdr(arb(m)) ¥S_TIMES cdr(arb(n))])
	(car(arb(m)),car(arb(n)))-->T390 ==> car(arb(m)) ¥S_TIMES S_Rev(car(arb(n))) = S_Rev(car(arb(m)) ¥S_TIMES car(arb(n)))
	EQUAL ==> m ¥Ra_TIMES Fr_to_Ra([S_Rev(car(arb(n))),cdr(arb(n))]) =
	Fr_to_Ra([S_Rev(car(arb(m)) ¥S_TIMES car(arb(n))),cdr(arb(m)) ¥S_TIMES cdr(arb(n))])
	ALGEBRA ==> (car(arb(m)) ¥S_TIMES car(arb(n)) in Si) & (cdr(arb(m)) ¥S_TIMES cdr(arb(n)) in Si)
	(cdr(arb(n)),cdr(arb(m)))-->T407(Stat1*) ==> cdr(arb(m)) ¥S_TIMES cdr(arb(n)) /= [0,0]
	(car(arb(m)) ¥S_TIMES car(arb(n)),cdr(arb(m)) ¥S_TIMES cdr(arb(n)))-->T484 ==>
	m ¥Ra_TIMES Fr_to_Ra([S_Rev(car(arb(n))),cdr(arb(n))]) =
		Ra_Rev(Fr_to_Ra([car(arb(m)) ¥S_TIMES car(arb(n)),cdr(arb(m)) ¥S_TIMES cdr(arb(n))]))
	Use_def(¥Ra_TIMES) ==> m ¥Ra_TIMES n = Fr_to_Ra([car(arb(m)) ¥S_TIMES car(arb(n)),cdr(arb(m)) ¥S_TIMES cdr(arb(n))])
	EQUAL ==> false; Discharge ==> QED
--
Theorem 486: [The reverse of a rational $X$ is the reverse of 1, times $X$] (X in Ra) ¥imp (Ra_Rev(X) = (Ra_Rev(Ra_1) ¥Ra_TIMES X)). Proof:
Suppose_not(m) ==>AUTO
	m-->T461 ==> m = (m ¥Ra_TIMES Ra_1)
	T451 ==> Ra_1 in Ra
	Ra_1-->T452 ==> Ra_Rev(Ra_1) in Ra
	(m,Ra_1)-->T485 ==> (m ¥Ra_TIMES Ra_Rev(Ra_1)) = Ra_Rev(m ¥Ra_TIMES Ra_1)
	(m,Ra_Rev(Ra_1))-->T448 ==> (m ¥Ra_TIMES Ra_Rev(Ra_1)) = (Ra_Rev(Ra_1) ¥Ra_TIMES m)
EQUAL ==> false; Discharge ==> QED
--
Theorem 487: ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp ((X ¥Ra_TIMES (Y ¥Ra_MINUS Z)) = (X ¥Ra_TIMES Y) ¥Ra_MINUS (X ¥Ra_TIMES Z)). Proof:
	Suppose_not(m,n,k) ==> (m in Ra) & (n in Ra) & (k in Ra) &
	((m ¥Ra_TIMES (n ¥Ra_MINUS k)) /= (m ¥Ra_TIMES n) ¥Ra_MINUS (m ¥Ra_TIMES k))
	Use_def(¥Ra_MINUS) ==> ((m ¥Ra_TIMES (n ¥Ra_PLUS Ra_Rev(k))) /= (m ¥Ra_TIMES n) ¥Ra_PLUS Ra_Rev(m ¥Ra_TIMES k))
	k-->T452 ==> Ra_Rev(k) in Ra
	(Ra_Rev(k),m,n)-->T458 ==>
	((m ¥Ra_TIMES n) ¥Ra_PLUS Ra_Rev(m ¥Ra_TIMES k)) /= ((m ¥Ra_TIMES n) ¥Ra_PLUS (m ¥Ra_TIMES Ra_Rev(k)))
	(m,k)-->T485 ==> Ra_Rev(m ¥Ra_TIMES k) = (m ¥Ra_TIMES Ra_Rev(k))
	EQUAL ==> false; Discharge ==> QED
--
-- Now we prove that multiplication of two rationals $m$, $n$ satisfying $m ¥Ra_GT n$ by a common
-- strictly positive fraction produces two products satisfying the same condition.
--
Theorem 488: [Strict monotonicity of rational multiplication over 1st argument] ((X in Ra) & (Y in Ra) & (X1 in Ra) & (X ¥Ra_GT Y) & (X1 ¥Ra_GT Ra_0)) ¥imp ((X ¥Ra_TIMES X1) ¥Ra_GT (Y ¥Ra_TIMES X1)). Proof:
    Suppose_not(m,n,k) ==>
    (m in Ra) & (n in Ra) & (k in Ra) & (m ¥Ra_GT n) & (k ¥Ra_GT Ra_0) & (not((m ¥Ra_TIMES k) ¥Ra_GT (n ¥Ra_TIMES k)))
    (m,n)-->T473 ==> Ra_is_nonneg(m ¥Ra_MINUS n) & (m /= n)
    T451 ==> Ra_0 in Ra
    (k,Ra_0)-->T473 ==> Ra_is_nonneg(k ¥Ra_MINUS Ra_0) & (k /= Ra_0)
    Use_def(¥Ra_MINUS) ==> Ra_is_nonneg(m ¥Ra_PLUS Ra_Rev(n)) & Ra_is_nonneg(k ¥Ra_PLUS Ra_Rev(Ra_0))
    (m,k)-->T448 ==> (m ¥Ra_TIMES k) in Ra
    (n,k)-->T448 ==> (n ¥Ra_TIMES k) in Ra
    (m ¥Ra_TIMES k,n ¥Ra_TIMES k)-->T473 ==> not(Ra_is_nonneg((m ¥Ra_TIMES k) ¥Ra_MINUS (n ¥Ra_TIMES k)) & (m ¥Ra_TIMES k /= n ¥Ra_TIMES k))
    Use_def(¥Ra_MINUS) ==> not(Ra_is_nonneg((m ¥Ra_TIMES k) ¥Ra_PLUS Ra_Rev(n ¥Ra_TIMES k)) & (m ¥Ra_TIMES k /= n ¥Ra_TIMES k))
    T481 ==> Ra_Rev(Ra_0) = Ra_0
    EQUAL ==> Ra_is_nonneg(k ¥Ra_PLUS Ra_0)
    k-->T451 ==> k ¥Ra_PLUS Ra_0 = k
    EQUAL ==> Ra_is_nonneg(k)
    n-->T452 ==> Ra_Rev(n) in Ra
    (m,Ra_Rev(n))-->T445 ==> m ¥Ra_PLUS Ra_Rev(n) in Ra
    (k,m ¥Ra_PLUS Ra_Rev(n))-->T469 ==> Ra_is_nonneg(k ¥Ra_TIMES (m ¥Ra_PLUS Ra_Rev(n)))
    (Ra_Rev(n),k,m)-->T458 ==> k ¥Ra_TIMES (m ¥Ra_PLUS Ra_Rev(n)) = (k ¥Ra_TIMES m) ¥Ra_PLUS (k ¥Ra_TIMES Ra_Rev(n))
    (k,n)-->T485 ==> (k ¥Ra_TIMES Ra_Rev(n)) = Ra_Rev(k ¥Ra_TIMES n)
    EQUAL ==> Ra_is_nonneg((k ¥Ra_TIMES m) ¥Ra_PLUS Ra_Rev(k ¥Ra_TIMES n))
    (k,m)-->T448 ==> k ¥Ra_TIMES m = m ¥Ra_TIMES k
    (k,n)-->T448 ==> k ¥Ra_TIMES n = n ¥Ra_TIMES k
    EQUAL ==> Ra_is_nonneg((m ¥Ra_TIMES k) ¥Ra_PLUS Ra_Rev(n ¥Ra_TIMES k))
    ELEM ==> m ¥Ra_TIMES k = n ¥Ra_TIMES k
    EQUAL ==> (m ¥Ra_TIMES k) ¥Ra_TIMES Recip(k) = (n ¥Ra_TIMES k) ¥Ra_TIMES Recip(k)
    k-->T462 ==> (Recip(k) in Ra) & (k ¥Ra_TIMES Recip(k) = Ra_1)
    (Recip(k),m,k)-->T456 ==> (m ¥Ra_TIMES k) ¥Ra_TIMES Recip(k) = m ¥Ra_TIMES (k ¥Ra_TIMES Recip(k))
    (Recip(k),n,k)-->T456 ==> (n ¥Ra_TIMES k) ¥Ra_TIMES Recip(k) = n ¥Ra_TIMES (k ¥Ra_TIMES Recip(k))
    EQUAL ==> m ¥Ra_TIMES (k ¥Ra_TIMES Recip(k)) = n ¥Ra_TIMES (k ¥Ra_TIMES Recip(k))
    EQUAL ==> m ¥Ra_TIMES Ra_1 = n ¥Ra_TIMES Ra_1
    m-->T461 ==> m = m ¥Ra_TIMES Ra_1
    n-->T461 ==> n = n ¥Ra_TIMES Ra_1
   EQUAL ==> false; Discharge ==> QED
--
-- The following lemma states that the product of any rational by zero is zero.
--
Theorem 489: (X in Ra) ¥imp (X ¥Ra_TIMES Ra_0 = Ra_0). Proof:
	Suppose_not(m) ==> (m in Ra) & (m ¥Ra_TIMES Ra_0 /= Ra_0)
	T481 ==> Ra_Rev(Ra_0) = Ra_0
	T451 ==> Ra_0 in Ra
	(m,Ra_0)-->T448 ==> m ¥Ra_TIMES Ra_0 in Ra
	(m,Ra_0)-->T485 ==> m ¥Ra_TIMES Ra_Rev(Ra_0) = Ra_Rev(m ¥Ra_TIMES Ra_0)
	(m ¥Ra_TIMES Ra_0)-->T466 ==> (Ra_is_nonneg(m ¥Ra_TIMES Ra_0) or Ra_is_nonneg(Ra_Rev(m ¥Ra_TIMES Ra_0))) &
	((Ra_is_nonneg(m ¥Ra_TIMES Ra_0) & Ra_is_nonneg(Ra_Rev(m ¥Ra_TIMES Ra_0))) ¥imp (m ¥Ra_TIMES Ra_0 = Ra_0))
	EQUAL ==> false; Discharge ==> QED
--
-- It follows easily from Theorem 488 and Theorem 489 that
-- the product of positive rationals is positive.
--
Theorem 490: ((X in Ra) & (Y in Ra) & (X ¥Ra_GT Ra_0) & (Y ¥Ra_GT Ra_0)) ¥imp ((X ¥Ra_TIMES Y) ¥Ra_GT Ra_0). Proof:
Suppose_not(x,y) ==> AUTO
	T451 ==> Ra_0 in Ra
	(x,Ra_0,y)-->T488 ==> (x ¥Ra_TIMES y) ¥Ra_GT (Ra_0 ¥Ra_TIMES y)
	y-->T489 ==> y ¥Ra_TIMES Ra_0 = Ra_0
	(Ra_0,y)-->T448 ==> Ra_0 ¥Ra_TIMES y = Ra_0
EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the reciprocal of a positive rational is positive.
--
Theorem 491: ((X in Ra) & (X ¥Ra_GT Ra_0)) ¥imp (Recip(X) ¥Ra_GT Ra_0). Proof:
    Suppose_not(m) ==> (m in Ra) & (m ¥Ra_GT Ra_0) & (not Recip(m) ¥Ra_GT Ra_0)
    (m,Ra_0)-->T473 ==> Ra_is_nonneg(m ¥Ra_PLUS Ra_Rev(Ra_0)) & (m /= Ra_0)
    m-->T462 ==> (Recip(m) in Ra) & (m ¥Ra_TIMES Recip(m) = Ra_1)
    (Recip(m))-->T452 ==> Ra_Rev(Recip(m)) in Ra
    (Recip(m),Ra_0)-->T473 ==> (not Ra_is_nonneg(Recip(m) ¥Ra_PLUS Ra_Rev(Ra_0)) or Recip(m) = Ra_0)
    T481 ==> Ra_Rev(Ra_0) = Ra_0
    EQUAL ==> Ra_is_nonneg(m ¥Ra_PLUS Ra_0) & (m /= Ra_0) &
    			(not Ra_is_nonneg(Recip(m) ¥Ra_PLUS Ra_0) or Recip(m) = Ra_0)
    (m)-->T451 ==> Stat1: (Ra_1 in Ra) & (m ¥Ra_PLUS Ra_0 = m)
    (Recip(m))-->T451 ==> Recip(m) ¥Ra_PLUS Ra_0 = Recip(m)
    EQUAL ==> Ra_is_nonneg(m) & (m /= Ra_0) & (not Ra_is_nonneg(Recip(m)) or Recip(m) = Ra_0)
    T481 ==> Stat2: Ra_1 /= Ra_0
    Suppose ==> Recip(m) = Ra_0
    EQUAL ==> m ¥Ra_TIMES Ra_0 = Ra_1
    m-->T489 ==> false; Discharge ==> not Ra_is_nonneg(Recip(m))
    (Recip(m))-->T466 ==> Ra_is_nonneg(Ra_Rev(Recip(m)))
    (m,Ra_Rev(Recip(m)))-->T469 ==> Ra_is_nonneg(m ¥Ra_TIMES Ra_Rev(Recip(m)))
    (m,Recip(m))-->T485 ==> m ¥Ra_TIMES Ra_Rev(Recip(m)) = Ra_Rev(m ¥Ra_TIMES Recip(m))
    m-->T462 ==> m ¥Ra_TIMES Recip(m) = Ra_1
    EQUAL ==> Stat3: Ra_is_nonneg(Ra_Rev(Ra_1))
    T465 ==> Stat4: Ra_is_nonneg(Ra_1)
    Ra_1-->T466(Stat1,Stat2,Stat3,Stat4) ==> false; Discharge ==> QED
--
-- It is important to know that sign reversal commutes with rational addition.
--
Theorem 492: ((X in Ra) & (Y in Ra)) ¥imp (Ra_Rev(X ¥Ra_PLUS Y) = (Ra_Rev(X) ¥Ra_PLUS Ra_Rev(Y))). Proof:
	Suppose_not(m,n) ==> (m in Ra) & (n in Ra) & (Ra_Rev(m ¥Ra_PLUS n) /= (Ra_Rev(m) ¥Ra_PLUS Ra_Rev(n)))
	ALGEBRA ==> m ¥Ra_PLUS n in Ra
	n-->T452 ==> Ra_Rev(n) in Ra
	m-->T452 ==> Ra_Rev(m) in Ra
	(m ¥Ra_PLUS n)-->T452 ==> Ra_Rev(m ¥Ra_PLUS n) in Ra
	Loc_def ==> rm = Ra_Rev(m)
	Loc_def ==> rn = Ra_Rev(n)
	Loc_def ==> rmpn = Ra_Rev(m ¥Ra_PLUS n)
	EQUAL ==> (rm in Ra) & (rn in Ra) & (rmpn in Ra)
	EQUAL ==> rmpn /= rm ¥Ra_PLUS rn
	m-->T452 ==> (m ¥Ra_PLUS Ra_Rev(m)) = Ra_0
	n-->T452 ==> (n ¥Ra_PLUS Ra_Rev(n)) = Ra_0
	(m ¥Ra_PLUS n)-->T452 ==> ((m ¥Ra_PLUS n) ¥Ra_PLUS Ra_Rev(m ¥Ra_PLUS n)) = Ra_0
	EQUAL ==> (m ¥Ra_PLUS rm) = Ra_0
	EQUAL ==> (n ¥Ra_PLUS rn) = Ra_0
	EQUAL ==> ((m ¥Ra_PLUS n) ¥Ra_PLUS rmpn) = Ra_0
	ALGEBRA ==> (rn ¥Ra_PLUS rm) ¥Ra_PLUS ((m ¥Ra_PLUS n) ¥Ra_PLUS rmpn) = ((n ¥Ra_PLUS rn) ¥Ra_PLUS (m ¥Ra_PLUS rm)) ¥Ra_PLUS rmpn
	EQUAL ==> (rn ¥Ra_PLUS rm) ¥Ra_PLUS Ra_0 = (Ra_0 ¥Ra_PLUS Ra_0) ¥Ra_PLUS rmpn
	ALGEBRA ==> (rm ¥Ra_PLUS rn) = rmpn
	EQUAL ==> false; Discharge ==> QED
--
-- Our next three lemmas assert the monotonicity and strict monotonicity of rational addition.
-- We prove monotonicity first.
--
Theorem 493: [Monotonicity of rational addition] ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X ¥Ra_GE Y) &
	 (XP ¥Ra_GE YP)) ¥imp ((X ¥Ra_PLUS XP) ¥Ra_GE (Y ¥Ra_PLUS YP)). Proof:
	Suppose_not(m,n,mp,np) ==> (m in Ra) & (n in Ra) & (mp in Ra) & (np in Ra) & (m ¥Ra_GE n) &
	((mp ¥Ra_GE np) & (not((m ¥Ra_PLUS mp) ¥Ra_GE (n ¥Ra_PLUS np))))
	ALGEBRA ==> (Ra_Rev(n) in Ra) & (Ra_Rev(np) in Ra) & (m ¥Ra_PLUS Ra_Rev(n) in Ra) & (mp ¥Ra_PLUS Ra_Rev(np) in Ra)
	(m,n)-->T473 ==> Ra_is_nonneg(m ¥Ra_PLUS Ra_Rev(n))
	(mp,np)-->T473 ==> Ra_is_nonneg(mp ¥Ra_PLUS Ra_Rev(np))
	(m ¥Ra_PLUS mp,n ¥Ra_PLUS np)-->T473 ==> not Ra_is_nonneg((m ¥Ra_PLUS mp) ¥Ra_PLUS Ra_Rev(n ¥Ra_PLUS np))
	Loc_def ==> rn = Ra_Rev(n)
	Loc_def ==> rnp = Ra_Rev(np)
    EQUAL ==> (rn in Ra) & (rnp in Ra) & (m ¥Ra_PLUS rn in Ra) & (mp ¥Ra_PLUS rnp in Ra) & Ra_is_nonneg(m ¥Ra_PLUS rn) & Ra_is_nonneg(mp ¥Ra_PLUS rnp)
	(n,np)-->T492 ==> (Ra_Rev(n) ¥Ra_PLUS Ra_Rev(np)) = Ra_Rev(n ¥Ra_PLUS np)
	EQUAL ==> ((rn ¥Ra_PLUS rnp) = Ra_Rev(n ¥Ra_PLUS np)) & (not Ra_is_nonneg((m ¥Ra_PLUS mp) ¥Ra_PLUS (rn ¥Ra_PLUS rnp)))
	(m ¥Ra_PLUS rn,mp ¥Ra_PLUS rnp)-->T469 ==> Ra_is_nonneg((m ¥Ra_PLUS rn) ¥Ra_PLUS (mp ¥Ra_PLUS rnp))
	ALGEBRA ==> ((m ¥Ra_PLUS rn) ¥Ra_PLUS (mp ¥Ra_PLUS rnp)) = ((m ¥Ra_PLUS mp) ¥Ra_PLUS (rn ¥Ra_PLUS rnp))
	EQUAL ==> false; Discharge ==> QED
--
-- Next we prove the familiar facts that the reverse of the reverse of a rational $n$ is $n$,
-- and that the reciprocal of the reciprocal of non-zero rational $n$ is $n$.
--
Theorem 494: (X in Ra) ¥imp (Ra_Rev(Ra_Rev(X)) = X). Proof:
	Suppose_not(m) ==> (m in Ra) & (Ra_Rev(Ra_Rev(m)) /= m)
	m-->T452 ==> (Ra_Rev(m) in Ra) & (m ¥Ra_PLUS Ra_Rev(m) = Ra_0)
	(Ra_Rev(m))-->T452 ==> (Ra_Rev(Ra_Rev(m)) in Ra) & (Ra_Rev(m) ¥Ra_PLUS Ra_Rev(Ra_Rev(m)) = Ra_0)
	EQUAL ==> (m ¥Ra_PLUS Ra_Rev(m)) ¥Ra_PLUS Ra_Rev(Ra_Rev(m)) = Ra_0 ¥Ra_PLUS Ra_Rev(Ra_Rev(m))
	T451 ==> Ra_0 in Ra
	(Ra_0,Ra_Rev(Ra_Rev(m)))-->T445 ==> Ra_0 ¥Ra_PLUS Ra_Rev(Ra_Rev(m)) = Ra_Rev(Ra_Rev(m)) ¥Ra_PLUS Ra_0
	(Ra_Rev(Ra_Rev(m)))-->T451 ==> (m ¥Ra_PLUS Ra_Rev(m)) ¥Ra_PLUS Ra_Rev(Ra_Rev(m)) = Ra_Rev(Ra_Rev(m))
	(Ra_Rev(Ra_Rev(m)),m,Ra_Rev(m))-->T450 ==> m ¥Ra_PLUS (Ra_Rev(m) ¥Ra_PLUS Ra_Rev(Ra_Rev(m))) = Ra_Rev(Ra_Rev(m))
	EQUAL ==> m ¥Ra_PLUS Ra_0 = Ra_Rev(Ra_Rev(m))
	m-->T451 ==> false; Discharge ==> QED
--
-- The following elementary consequence of Theorem OM is sometimes more convenient.
--
Theorem 495: ((X in Ra) & (Y in Ra)) ¥imp (((X ¥Ra_GE Y) or (Y ¥Ra_GE X)) &
	(((X ¥Ra_GE Y) & (Y ¥Ra_GE X)) ¥imp (X = Y))). Proof:
	Suppose_not(m,n) ==> (m in Ra) & (n in Ra) & ((not((m ¥Ra_GE n) or (n ¥Ra_GE m))) or
	(((m ¥Ra_GE n) & (n ¥Ra_GE m)) & (m /= n)))
	(m,n)-->T473 ==> (m ¥Ra_GE n) ¥eq Ra_is_nonneg(m ¥Ra_PLUS Ra_Rev(n))
	(n,m)-->T473 ==> (n ¥Ra_GE m) ¥eq Ra_is_nonneg(n ¥Ra_PLUS Ra_Rev(m))
	n-->T452 ==> Ra_Rev(n) in Ra
	m-->T452 ==> Ra_Rev(m) in Ra
	(m,Ra_Rev(n))-->T492 ==> Ra_Rev(m ¥Ra_PLUS Ra_Rev(n)) = Ra_Rev(m) ¥Ra_PLUS Ra_Rev(Ra_Rev(n))
	n-->T494 ==> Ra_Rev(Ra_Rev(n)) = n
	EQUAL ==> Ra_Rev(m ¥Ra_PLUS Ra_Rev(n)) = Ra_Rev(m) ¥Ra_PLUS n
	(Ra_Rev(m),n)-->T445 ==> Ra_Rev(m) ¥Ra_PLUS n = n ¥Ra_PLUS Ra_Rev(m)
	EQUAL ==> (n ¥Ra_GE m) ¥eq Ra_is_nonneg(Ra_Rev(m ¥Ra_PLUS Ra_Rev(n)))
	ELEM ==> (not(Ra_is_nonneg(m ¥Ra_PLUS Ra_Rev(n)) or Ra_is_nonneg(Ra_Rev(m ¥Ra_PLUS Ra_Rev(n))))) or
	(Ra_is_nonneg(m ¥Ra_PLUS Ra_Rev(n)) & Ra_is_nonneg(Ra_Rev(m ¥Ra_PLUS Ra_Rev(n))) & (m /= n))
	ALGEBRA ==> m ¥Ra_PLUS Ra_Rev(n) in Ra
	(m ¥Ra_PLUS Ra_Rev(n))-->T466 ==> Stat1: (m ¥Ra_PLUS Ra_Rev(n) = Ra_0) & (m /= n)
	(m,Ra_Rev(n))-->T445 ==> m ¥Ra_PLUS Ra_Rev(n) = Ra_Rev(n) ¥Ra_PLUS m
	EQUAL ==> n ¥Ra_PLUS (Ra_Rev(n) ¥Ra_PLUS m) = n ¥Ra_PLUS Ra_0
	n-->T451 ==> n ¥Ra_PLUS Ra_0 = n
	(Stat1)ELEM ==> n ¥Ra_PLUS (Ra_Rev(n) ¥Ra_PLUS m) = n
	(m,n,Ra_Rev(n))-->T450 ==> (n ¥Ra_PLUS Ra_Rev(n)) ¥Ra_PLUS m = n
	n-->T452 ==> n ¥Ra_PLUS Ra_Rev(n) = Ra_0
	EQUAL ==> Ra_0 ¥Ra_PLUS m = n
	ALGEBRA ==> false; Discharge ==> QED
--
-- Theorem 495 allows us to prove various other elementary but useful results concerning the ordering of rationals.
--
Theorem 496: [Transitivity of ordering, strict case]  ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_GE Y) & (Y ¥Ra_GT Z)) ¥imp (X ¥Ra_GT Z)). Proof:
	Suppose_not(x,y,z) ==> AUTO
	(y,z)-->T473 ==> (y ¥Ra_GE z) & (y /= z)
	(x,y,z)-->T480 ==> x ¥Ra_GE z
	(x,z)-->T473 ==> x = z
	EQUAL ==> (z ¥Ra_GE y) & (y ¥Ra_GT z)
	(y,z)-->T473 ==> y ¥Ra_GE z
	(y,z)-->T495 ==> y = z
	(y,z)-->T473 ==> false; Discharge ==> QED
--
Theorem 497: [Transitivity of ordering, strict case 2] ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_GT Y) & (Y ¥Ra_GE Z)) ¥imp (X ¥Ra_GT Z)). Proof:
	Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T473 ==> (x ¥Ra_GE y) & (x /= y)
	(x,y,z)-->T480 ==> x ¥Ra_GE z
	(x,z)-->T473 ==> x = z
	EQUAL ==> (z ¥Ra_GT y) & (y ¥Ra_GE z)
	(z,y)-->T473 ==> z ¥Ra_GE y
	(y,z)-->T495 ==> y = z
	(z,y)-->T473 ==> false; Discharge ==> QED
--
Theorem 498: [Transitivity of ordering, strict case 3]  ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_GT Y) & (Y ¥Ra_GT Z)) ¥imp (X ¥Ra_GT Z)). Proof:
	Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T473 ==> (x ¥Ra_GE y)
	(x,y,z)-->T496 ==> false; Discharge ==> QED
--
Theorem 499:  [Transitivity of ordering by 'less than'] ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_LE Y) & (Y ¥Ra_LT Z)) ¥imp (X ¥Ra_LT Z)). Proof:
	Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T473 ==> (y ¥Ra_GE x) ¥eq (x ¥Ra_LE y)
	(y,z)-->T473 ==> (z ¥Ra_GT y) ¥eq (y ¥Ra_LT z)
	(x,z)-->T473 ==> (z ¥Ra_GT x) ¥eq (x ¥Ra_LT z)
	(z,y,x)-->T497 ==> false;	Discharge ==> QED
--
Theorem 500: [Transitivity of ordering by 'less than', 2] ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_LT Y) & (Y ¥Ra_LE Z)) ¥imp (X ¥Ra_LT Z)). Proof:
	Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T473 ==> (y ¥Ra_GT x) ¥eq (x ¥Ra_LT y)
	(y,z)-->T473 ==> (z ¥Ra_GE y) ¥eq (y ¥Ra_LE z)
	(x,z)-->T473 ==> (z ¥Ra_GT x) ¥eq (x ¥Ra_LT z)
	(z,y,x)-->T496 ==> false;	Discharge ==> QED
--
Theorem 501: [Transitivity of ordering by 'less than', 3] ((X in Ra) & (Y in Ra) & (Z in Ra)) ¥imp (((X ¥Ra_LT Y) & (Y ¥Ra_LT Z)) ¥imp (X ¥Ra_LT Z)). Proof:
	Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T475 ==> (x ¥Ra_LE y)
	(x,y,z)-->T499 ==> false; Discharge ==> QED

-- Next we prove that rational reversal is a monotone decreasing function.
--
Theorem 502: ((X in Ra) & (Y in Ra) & (X ¥Ra_GE Y)) ¥imp (Ra_Rev(Y) ¥Ra_GE Ra_Rev(X)). Proof:
	Suppose_not(m,n) ==> (m in Ra) & (n in Ra) & (m ¥Ra_GE n) & (not(Ra_Rev(n) ¥Ra_GE Ra_Rev(m)))
	n-->T452 ==> Ra_Rev(n) in Ra
	m-->T452 ==> Ra_Rev(m) in Ra
	(Ra_Rev(n),Ra_Rev(m))-->T495 ==> Ra_Rev(m) ¥Ra_GE Ra_Rev(n)
	(m,n)-->T473 ==> Ra_is_nonneg(m ¥Ra_PLUS Ra_Rev(n))
	(Ra_Rev(n),Ra_Rev(m))-->T473 ==> not Ra_is_nonneg(Ra_Rev(n) ¥Ra_PLUS Ra_Rev(Ra_Rev(m)))
	m-->T494 ==> Ra_Rev(Ra_Rev(m)) = m
	EQUAL ==> not Ra_is_nonneg(Ra_Rev(n) ¥Ra_PLUS m)
	(Ra_Rev(n),m)-->T445 ==> Ra_Rev(n) ¥Ra_PLUS m = m ¥Ra_PLUS Ra_Rev(n)
	EQUAL ==> false; Discharge ==> QED
--
-- An equally familiar fact is that the reverse of $y$ is smaller than the
-- reverse of $x$ when $x,y$ are rational numbers and $x$ is smaller than $y$.
--
Theorem 503: ((X in Ra) & (Y in Ra) & (X ¥Ra_GT Y)) ¥imp (Ra_Rev(Y) ¥Ra_GT Ra_Rev(X)). Proof:
    Suppose_not(x,y) ==> (x in Ra) & (y in Ra) & (x ¥Ra_GT y) & (not(Ra_Rev(y) ¥Ra_GT Ra_Rev(x)))
        (x,y)-->T473 ==> Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(y)) & (x /= y)
        (Ra_Rev(y),Ra_Rev(x))-->T473 ==> (not Ra_is_nonneg(Ra_Rev(y) ¥Ra_PLUS Ra_Rev(Ra_Rev(x)))) or (Ra_Rev(y) = Ra_Rev(x))
        x-->T494 ==> Ra_Rev(Ra_Rev(x)) = x
        y-->T494 ==> Ra_Rev(Ra_Rev(y)) = y
        y-->T452 ==> Ra_Rev(y) in Ra
        (x,Ra_Rev(y))-->T445 ==> (x ¥Ra_PLUS Ra_Rev(y)) = (Ra_Rev(y) ¥Ra_PLUS x)
        EQUAL ==> Ra_is_nonneg(Ra_Rev(y) ¥Ra_PLUS Ra_Rev(Ra_Rev(x)))
        ELEM ==> Ra_Rev(y) = Ra_Rev(x)
    EQUAL ==> false; Discharge ==> QED
--
-- We now combine the preceding lemmas to prove strict monotonicity of rational addition.
--
Theorem 504: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X ¥Ra_GE Y) &
	 (XP ¥Ra_GT YP)) ¥imp ((X ¥Ra_PLUS XP) ¥Ra_GT (Y ¥Ra_PLUS YP)). Proof:
	Suppose_not(m,n,mp,np) ==> (m in Ra) & (n in Ra) & (mp in Ra) & (np in Ra) & (m ¥Ra_GE n) &
	((mp ¥Ra_GT np) & (not((m ¥Ra_PLUS mp) ¥Ra_GT (n ¥Ra_PLUS np))))
--
-- Suppose that $m$, $n$, $mp$, and $np$ form a counterexample to our theorem.
-- Since addition is known to be monotone, we have at least $(m ¥Ra_PLUS mp) ¥Ra_GE (n ¥Ra_PLUS np)$,
-- and since the corresponding strict inequality is false we must have $(m ¥Ra_PLUS mp) = (n ¥Ra_PLUS np)$,
-- so that $(np ¥Ra_PLUS n) ¥Ra_GE (mp ¥Ra_PLUS m)$ is also true.
--
	(mp,np)-->T473 ==> mp ¥Ra_GE np
	(m,n,mp,np)-->T493 ==> (m ¥Ra_PLUS mp) ¥Ra_GE (n ¥Ra_PLUS np)
	(m ¥Ra_PLUS mp,n ¥Ra_PLUS np)-->T473 ==> m ¥Ra_PLUS mp = n ¥Ra_PLUS np
        ALGEBRA ==> (n ¥Ra_PLUS np) ¥Ra_GE (m ¥Ra_PLUS mp)
	ALGEBRA ==> (np ¥Ra_PLUS n) ¥Ra_GE (mp ¥Ra_PLUS m)
--
-- By Theorem 502, we have $Ra_Rev(n) ¥Ra_GE Ra_Rev(m)$, and then adding these
-- last two inequalities and reassociating we find that $np ¥Ra_GE mp$, so that $np = mp$,
-- contradicting $mp ¥Ra_GT np$ an so proving our theorem.
--
	(m,n)-->T502 ==> Ra_Rev(n) ¥Ra_GE Ra_Rev(m)
	n-->T452 ==> (Ra_Rev(n) in Ra) & (n ¥Ra_PLUS Ra_Rev(n) = Ra_0)
	m-->T452 ==> (Ra_Rev(m) in Ra) & (m ¥Ra_PLUS Ra_Rev(m) = Ra_0)
	ALGEBRA ==> (mp ¥Ra_PLUS m in Ra) & (np ¥Ra_PLUS n in Ra)
	(np ¥Ra_PLUS n,mp ¥Ra_PLUS m,Ra_Rev(n),Ra_Rev(m))-->T493 ==>
	((np ¥Ra_PLUS n) ¥Ra_PLUS Ra_Rev(n)) ¥Ra_GE ((mp ¥Ra_PLUS m) ¥Ra_PLUS Ra_Rev(m))
	(Ra_Rev(n),np,n)-->T450 ==> ((np ¥Ra_PLUS n) ¥Ra_PLUS Ra_Rev(n)) = (np ¥Ra_PLUS (n ¥Ra_PLUS Ra_Rev(n)))
	(Ra_Rev(m),mp,m)-->T450 ==> ((mp ¥Ra_PLUS m) ¥Ra_PLUS Ra_Rev(m)) = (mp ¥Ra_PLUS (m ¥Ra_PLUS Ra_Rev(m)))
	EQUAL ==> (np ¥Ra_PLUS Ra_0) ¥Ra_GE (mp ¥Ra_PLUS Ra_0)
	np-->T451 ==> np ¥Ra_PLUS Ra_0 = np
	mp-->T451 ==> mp ¥Ra_PLUS Ra_0 = mp
	EQUAL ==> np ¥Ra_GE mp
	(mp,np)-->T495 ==> mp = np
	(mp,np)-->T473 ==> false; Discharge ==> QED
--
--
-- The following slight variant of Theorem 504 is sometimes more convenient.
--
Theorem 505: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X ¥Ra_GT Y) &
	 (XP ¥Ra_GE YP)) ¥imp ((X ¥Ra_PLUS XP) ¥Ra_GT (Y ¥Ra_PLUS YP)). Proof:
	 Suppose_not(m,n,mp,np) ==> AUTO
	 (mp,np,m,n)-->T504 ==> AUTO
	 (m,mp)-->T445 ==> m ¥Ra_PLUS mp = mp ¥Ra_PLUS m
	 (n,np)-->T445 ==> n ¥Ra_PLUS np = np ¥Ra_PLUS n
	 EQUAL ==> false; Discharge ==> QED
--
Theorem 506: ((X in Ra) & (X /= Ra_0)) ¥imp ((Recip(X) /= Ra_0) & Recip(Recip(X)) = X). Proof:
	Suppose_not(m) ==> (m in Ra) & (m /= Ra_0) & (Recip(m) = Ra_0 or Recip(Recip(m)) /= m)
	m-->T462 ==> (Recip(m) in Ra) & (m ¥Ra_TIMES Recip(m) = Ra_1)
	Suppose ==> Recip(m) = Ra_0
	EQUAL ==> (m ¥Ra_TIMES Ra_0 = Ra_1)
	m-->T489 ==> Ra_0 = Ra_1
	T481 ==> false; Discharge ==> (Recip(m) /= Ra_0)
	(Recip(m))-->T462 ==> (Recip(Recip(m)) in Ra) & (Recip(m) ¥Ra_TIMES Recip(Recip(m)) = Ra_1)
	EQUAL ==> (m ¥Ra_TIMES Recip(m)) ¥Ra_TIMES Recip(Recip(m)) = Ra_1 ¥Ra_TIMES Recip(Recip(m))
	T451 ==> Ra_1 in Ra
	(Ra_1,Recip(Recip(m)))-->T448 ==> (Ra_1 ¥Ra_TIMES Recip(Recip(m)) = Recip(Recip(m)) ¥Ra_TIMES Ra_1)
	(Recip(Recip(m)))-->T461 ==> Recip(Recip(m)) ¥Ra_TIMES Ra_1 = Recip(Recip(m))
	ELEM ==> (m ¥Ra_TIMES Recip(m)) ¥Ra_TIMES Recip(Recip(m)) = Recip(Recip(m))
	(Recip(Recip(m)),m,Recip(m))-->T456 ==> m ¥Ra_TIMES (Recip(m) ¥Ra_TIMES Recip(Recip(m))) = Recip(Recip(m))
	EQUAL ==> m ¥Ra_TIMES Ra_1 = Recip(Recip(m))
	m-->T461 ==> false; Discharge ==> QED
--
Theorem 507: ([2,0] in Si) & (is_nonneg([2,0])) & is_nonneg([1,0]) & (Fr_to_Ra([[1,0],[2,0]]) in Ra) &
		(Fr_to_Ra([[1,0],[2,0]]) ¥Ra_GT Ra_0). Proof:
    Suppose_not ==> Stat1: ([2,0] notin Si) or (not is_nonneg([2,0])) or (not is_nonneg([1,0])) or
		(Fr_to_Ra([[1,0],[2,0]]) notin Ra) or (not (Fr_to_Ra([[1,0],[2,0]]) ¥Ra_GT Ra_0))
-- or (not (((X ¥Ra_GT Ra_0) ¥Ra_TIMES Fr_to_Ra([[1,0],[2,0]])) ¥Ra_GT Ra_0))
        T460 ==> ([1,0] in Si)
        Use_def(is_nonneg) ==> is_nonneg([1,0])
        ([1,0],[1,0])-->T425 ==> is_nonneg([1,0] ¥S_PLUS [1,0])
        Use_def(¥S_PLUS) ==> ([1,0] ¥S_PLUS [1,0]) = Red([car([1,0]) ¥PLUS car([1,0]),cdr([1,0]) ¥PLUS cdr([1,0])])
        T211 ==> (0 in Za) & (1 in Za) & (2 in Za) & Card(0) & Card(1)
        0-->T164 ==> 0 = #0
        1-->T164 ==> 1 = #1
        0-->T247 ==> #0 ¥PLUS 0 = 0
        1-->T317 ==> 1 ¥PLUS 1 = next(1)
        Use_def(2) ==> (1 ¥PLUS 1 = 2)
        T212 ==> Stat2: (1 /= 0) & (2 /= 0)
        (Stat2)ELEM ==> Stat3: (car([1,0]) = 1) & (cdr([1,0]) = 0) & ([2,0] /= [0,0]) & ([1,0] /= [0,0])
        2-->T387 ==> Red([2,0]) = [2,0]
        EQUAL ==> [1,0] ¥S_PLUS [1,0] = [2,0]
        0-->T367 ==> Stat4: [0,0] in Si
        1-->T367 ==> Stat5: [1,0] in Si
        2-->T367 ==> Stat6: [2,0] in Si
        EQUAL ==> is_nonneg([2,0]) & (not (Fr_to_Ra([[1,0],[2,0]]) ¥Ra_GT Ra_0))
        T451 ==> Ra_0 in Ra
        TELEM ==> [[1,0],[2,0]] in Fr
        ([[1,0],[2,0]])-->T421 ==> Fr_to_Ra([[1,0],[2,0]]) in Ra
        (Fr_to_Ra([[1,0],[2,0]]), Ra_0)-->T473 ==> (not Ra_is_nonneg(Fr_to_Ra([[1,0],[2,0]]) ¥Ra_MINUS Ra_0)) or (Fr_to_Ra([[1,0],[2,0]]) = Ra_0)
        ([[1,0],[2,0]])-->T431(Stat3,Stat5,Stat6*) ==> [[1,0],[2,0]] in Fr
        Suppose ==> Fr_to_Ra([[1,0],[2,0]]) notin Ra
        ([[1,0],[2,0]])-->T421(Stat1*) ==> false; Discharge ==> Fr_to_Ra([[1,0],[2,0]]) in Ra
        Suppose ==> not Ra_is_nonneg(Fr_to_Ra([[1,0],[2,0]]) ¥Ra_MINUS Ra_0)
            Use_def(¥Ra_MINUS) ==> not Ra_is_nonneg(Fr_to_Ra([[1,0],[2,0]]) ¥Ra_PLUS Ra_Rev(Ra_0))
            T481 ==> Ra_Rev(Ra_0) = Ra_0
            (Fr_to_Ra([[1,0],[2,0]]))-->T451(*) ==> Fr_to_Ra([[1,0],[2,0]]) ¥Ra_PLUS Ra_0 = Fr_to_Ra([[1,0],[2,0]])
            EQUAL ==> not Ra_is_nonneg(Fr_to_Ra([[1,0],[2,0]]))
            ([1,0],[2,0])-->T425(Stat1*) ==> is_nonneg([1,0] ¥S_TIMES [2,0])
        ([1,0],[2,0])-->T459(Stat1*) ==> false; Discharge ==> Fr_to_Ra([[1,0],[2,0]]) = Ra_0
        Use_def(Ra_0) ==> Fr_to_Ra([[1,0],[2,0]]) = Fr_to_Ra([[0,0],[1,0]])
        T420 ==> Stat7: (FORALL x, y | ((x in Fr) & (y in Fr)) ¥imp ((Same_frac(x,y) ¥eq (Fr_to_Ra(x) = Fr_to_Ra(y)))))
        ([[0,0],[1,0]])-->T431(Stat3,Stat4,Stat5*) ==> [[0,0],[1,0]] in Fr
        ([[1,0],[2,0]],[[0,0],[1,0]])-->Stat7(Stat6*) ==> Same_frac([[1,0],[2,0]],[[0,0],[1,0]])
        Use_def(Same_frac) ==> Stat8: car([[1,0],[2,0]]) ¥S_TIMES cdr([[0,0],[1,0]]) = cdr([[1,0],[2,0]]) ¥S_TIMES car([[0,0],[1,0]])
        TELEM ==> (car([[1,0],[2,0]]) = [1,0]) & (cdr([[0,0],[1,0]]) = [1,0]) & (cdr([[1,0],[2,0]]) = [2,0]) & (car([[0,0],[1,0]]) = [0,0])
        EQUAL(Stat8) ==> Stat9: [1,0] ¥S_TIMES [1,0] = [2,0] ¥S_TIMES [0,0]
        ([1,0])-->T401(Stat5,Stat5) ==> Stat10: [1,0] ¥S_TIMES [1,0] = [1,0]
        ([2,0])-->T401(Stat6,Stat6) ==> Stat11: [0,0] ¥S_TIMES [2,0] = [0,0]
        ([0,0],[2,0])-->T384(Stat4,Stat6) ==> Stat12: [0,0] ¥S_TIMES [2,0] = [2,0] ¥S_TIMES [0,0]
    (Stat9,Stat10,Stat11,Stat12,Stat3*)Discharge ==> QED
--
-- The following lemmas supply the evident facts that the strict and nonstrict rational comparisons
-- are both transitive relationships. We begin with the nonstrict version.
--
Theorem 508: [Transitivity of ordering by 'greater than'] ((X in Ra) & (Y in Ra) & (Z in Ra) &
	(X ¥Ra_GE Y) & (Y ¥Ra_GE Z)) ¥imp (X ¥Ra_GE Z). Proof:
	Suppose_not(m,n,j) ==> (m in Ra) & (n in Ra) & (j in Ra) & (m ¥Ra_GE n) & (n ¥Ra_GE j) & (not (m ¥Ra_GE j))
	(m,n)-->T473 ==> Ra_is_nonneg(m ¥Ra_PLUS Ra_Rev(n))
	(n,j)-->T473 ==> Ra_is_nonneg(n ¥Ra_PLUS Ra_Rev(j))
	(m,j)-->T473 ==> not Ra_is_nonneg(m ¥Ra_PLUS Ra_Rev(j))
	m-->T452 ==> (Ra_Rev(m) in Ra)
	n-->T452 ==> (Ra_Rev(n) in Ra)
	j-->T452 ==> (Ra_Rev(j) in Ra)
	ALGEBRA ==> (m ¥Ra_PLUS Ra_Rev(n) in Ra) & (n ¥Ra_PLUS Ra_Rev(j) in Ra)
	(m ¥Ra_PLUS Ra_Rev(n),n ¥Ra_PLUS Ra_Rev(j))-->T469 ==>
	Ra_is_nonneg((m ¥Ra_PLUS Ra_Rev(n)) ¥Ra_PLUS (n ¥Ra_PLUS Ra_Rev(j)))
	(n ¥Ra_PLUS Ra_Rev(j),m,Ra_Rev(n))-->T450 ==>
	m ¥Ra_PLUS (Ra_Rev(n) ¥Ra_PLUS (n ¥Ra_PLUS Ra_Rev(j))) = (m ¥Ra_PLUS Ra_Rev(n)) ¥Ra_PLUS (n ¥Ra_PLUS Ra_Rev(j))
	(Ra_Rev(j),Ra_Rev(n),n)-->T450 ==> (Ra_Rev(n) ¥Ra_PLUS n) ¥Ra_PLUS Ra_Rev(j) = Ra_Rev(n) ¥Ra_PLUS (n ¥Ra_PLUS Ra_Rev(j))
	(Ra_Rev(n),n)-->T445 ==> Ra_Rev(n) ¥Ra_PLUS n = n ¥Ra_PLUS Ra_Rev(n)
	EQUAL ==> Ra_is_nonneg(m ¥Ra_PLUS ((n ¥Ra_PLUS Ra_Rev(n)) ¥Ra_PLUS Ra_Rev(j)))
	n-->T452 ==> n ¥Ra_PLUS Ra_Rev(n) = Ra_0
	EQUAL ==> Ra_is_nonneg(m ¥Ra_PLUS (Ra_0 ¥Ra_PLUS Ra_Rev(j)))
	T451 ==> Ra_0 in Ra
	(Ra_0,Ra_Rev(j))-->T445 ==> Ra_0 ¥Ra_PLUS Ra_Rev(j) = Ra_Rev(j) ¥Ra_PLUS Ra_0
	(Ra_Rev(j))-->T451 ==> Ra_Rev(j) ¥Ra_PLUS Ra_0 = Ra_Rev(j)
	EQUAL ==> false; Discharge ==> QED
--
-- The preceding lemma can be used to prove the following 'strict' version of itself.
--
Theorem 509: [Transitivity of ordering, strict case] ((X in Ra) & (Y in Ra) & (Z in Ra) &
	(X ¥Ra_GT Y) & (Y ¥Ra_GE Z)) ¥imp (X ¥Ra_GT Z). Proof:
	Suppose_not(m,n,j) ==> (m in Ra) & (n in Ra) & (j in Ra) & (m ¥Ra_GT n) & (n ¥Ra_GE j) & (not (m ¥Ra_GT j))
	(m,n)-->T473 ==> m ¥Ra_GE n
	(m,n,j)-->T508 ==> m ¥Ra_GE j
	(m,j)-->T473 ==> m = j
	EQUAL ==> j ¥Ra_GT n
	(j,n)-->T473 ==> j ¥Ra_GE n
	(n,j)-->T495 ==> n = j
	(j,n)-->T473 ==> false; Discharge ==> QED
--
-- It is sometimes convenient to use the following slight variant of the preceding lemma.
--
Theorem 510: [Transitivity of ordering, strict case 2] ((X in Ra) & (Y in Ra) & (Z in Ra) &
	(X ¥Ra_GE Y) & (Y ¥Ra_GT Z)) ¥imp (X ¥Ra_GT Z). Proof:
	Suppose_not(m,n,j) ==> (m in Ra) & (n in Ra) & (j in Ra) & (m ¥Ra_GE n) & (n ¥Ra_GT j) & (not (m ¥Ra_GT j))
	(n,j)-->T473 ==> n ¥Ra_GE j
	(m,n,j)-->T508 ==> m ¥Ra_GE j
	(m,j)-->T473 ==> m = j
	EQUAL ==> j ¥Ra_GE n
	(n,j)-->T473 ==> n ¥Ra_GE j
	(n,j)-->T495 ==> n = j
	(n,j)-->T473 ==> false; Discharge ==> QED
--
Theorem 511: ((X in Ra) & (Y in Ra) & (Z in Ra) & (X ¥Ra_GT Y) & (Y ¥Ra_GT Z)) ¥imp (X ¥Ra_GT Z). Proof:
    Suppose_not(x,y,w) ==> (x in Ra) & (y in Ra) & (w in Ra) & (x ¥Ra_GT y) & (y ¥Ra_GT w) & (not(x ¥Ra_GT w))
        (y,w)-->T473 ==> y ¥Ra_GE w
    (x,y,w)-->T509 ==> false; Discharge ==> QED
--
-- The properties of $¥Ra_GT$ are mirrored by properties of $¥Ra_LT$ and hence
-- enable us to exploit, in connection with $Ra$, the theory of linear orderings.
--
Theorem 512: (FORALL x in Ra, y in Ra, z in Ra | ((x ¥Ra_LT y) & (y ¥Ra_LT z)) ¥imp (x ¥Ra_LT z)). Proof:
    Suppose_not ==> Stat1: not(FORALL x in Ra, y in Ra, z in Ra | ((x ¥Ra_LT y) & (y ¥Ra_LT z)) ¥imp (x ¥Ra_LT z))
        (x,y,w)-->Stat1 ==> (x in Ra) & (y in Ra) & (w in Ra) & (x ¥Ra_LT y) & (y ¥Ra_LT w) & (not (x ¥Ra_LT w))
        (x,y)-->T473 ==> y ¥Ra_GT x
        (y,w)-->T473 ==> w ¥Ra_GT y
        (w,y)-->T473 ==> w ¥Ra_GE y
        (w,y,x)-->T510 ==> w ¥Ra_GT x
    (x,w)-->T473 ==> false; Discharge ==> QED
--
Theorem 513: (FORALL x in Ra | not(x ¥Ra_LT x)). Proof:
    Suppose_not ==> Stat1: not(FORALL x in Ra | not(x ¥Ra_LT x))
        x-->Stat1 ==> (x in Ra) & (x ¥Ra_LT x)
    (x,x)-->T473 ==> false; Discharge ==> QED
--
Theorem 514: (FORALL x in Ra, y in Ra | (x ¥Ra_LT y) or (x = y) or (y ¥Ra_LT x)). Proof:
    Suppose_not ==> Stat1: not(FORALL x in Ra, y in Ra | (x ¥Ra_LT y) or (x = y) or (y ¥Ra_LT x))
        (x,y)-->Stat1 ==> (x in Ra) & (y in Ra) & (not((x ¥Ra_LT y) or (x = y) or (y ¥Ra_LT x)))
        (y,x)-->T495 ==> (y ¥Ra_GE x) or (x ¥Ra_GE y)
        Suppose ==> y ¥Ra_GE x
            (y,x)-->T473 ==> y ¥Ra_GT x
            (x,y)-->T473 ==> false; Discharge ==> (x ¥Ra_GE y) & (x /= y)
        (x,y)-->T473 ==> (x ¥Ra_GT y)
    (y,x)-->T473 ==> false; Discharge ==> QED
--
APPLY(smaller_thryvar:smaller_Ra,ubs_thryvar:ubs_Ra,min_over_thryvar:min_over_Ra,max_thryvar:max_Ra,lub_thryvar:lub_Ra) linear_order(s0->Ra, arg1_bef_arg2(X,Y)->(X ¥Ra_LT Y)) ==>
Theorem 515: (FORALL x, y | smaller_Ra(x,y) = if ((x notin Ra) & (y notin Ra)) then Ra elseif (x notin Ra) then y elseif (y notin Ra) then x elseif (x ¥Ra_LT y) then x else y end if) &
	(FORALL x, y | smaller_Ra(x,y) = smaller_Ra(y,x)) &
	(FORALL x, y | ({x,y} ¥incin Ra) ¥imp (smaller_Ra(x,y) in {x,y})) &
	(FORALL x | (x in next(Ra)) ¥imp (smaller_Ra(x,Ra) = x)) &
	(FORALL x, y, z | smaller_Ra(x,smaller_Ra(y,z)) = smaller_Ra(smaller_Ra(x,y),z)) &
	(FORALL x, y | ((x in next(Ra)) & (y in next(Ra))) ¥imp (smaller_Ra(x,y) in next(Ra))) &
	(FORALL f,p,a | (Svm(f) & (range(f) ¥incin Ra) & Finite(f)) ¥imp
		(((p in f) ¥imp (min_over_Ra({p}) = (f~[car(p)]))) &
		(min_over_Ra(f) = smaller_Ra(min_over_Ra(f ¥ON (domain(f) * a)),min_over_Ra(f ¥ON (domain(f) - a)))))) &
	(FORALL f | (Svm(f) & (range(f) ¥incin Ra) & Finite(f) & (f /= 0)) ¥imp (min_over_Ra(f) in range(f))) &
	(FORALL x, y | ({x,y} ¥incin Ra) ¥imp ((smaller_Ra(x,y) = x) ¥eq ((x ¥Ra_LT y) or (x = y)))) &
	(FORALL t | ubs_Ra(t) = {x in Ra | (FORALL y in (t * Ra) | smaller_Ra(y,x) = y)}) &
	(FORALL t | max_Ra(t) = arb({Ra} + (t * ubs_Ra(t)))) &
	(FORALL t | lub_Ra(t) = arb({Ra} + {x in ubs_Ra(t) | ubs_Ra(t) ¥incin ubs_Ra({x})})) &
	(ubs_Ra(0) = Ra) & (max_Ra(0) = Ra) &
	(FORALL t | (ubs_Ra(t) ¥incin Ra) & (ubs_Ra(t) = ubs_Ra(t * Ra)) & (max_Ra(t) = max_Ra(t * Ra))) &
	(FORALL t, x | (Finite(t) & (x in t) & (t ¥incin Ra)) ¥imp ((max_Ra(t) in t) & ((x = max_Ra(t)) or ((x ¥Ra_LT max_Ra(t))))))
--
-- For positive rationals, multiplication is also monotone and strictly monotone.
-- We prove the nonstrict version of this assertion first.
--
Theorem 516: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X ¥Ra_GE Y) & (Y ¥Ra_GE Ra_0) &
	 (YP ¥Ra_GE Ra_0) & (XP ¥Ra_GE YP)) ¥imp ((X ¥Ra_TIMES XP) ¥Ra_GE (Y ¥Ra_TIMES YP)). Proof:
	Suppose_not(m,n,mp,np) ==> (m in Ra) & (n in Ra) & (mp in Ra) & (np in Ra) & (m ¥Ra_GE n) & (mp ¥Ra_GE np) &
	(n ¥Ra_GE Ra_0) & (np ¥Ra_GE Ra_0) & (not((m ¥Ra_TIMES mp) ¥Ra_GE (n ¥Ra_TIMES np)))
	(m,n)-->T473 ==> Ra_is_nonneg(m ¥Ra_PLUS Ra_Rev(n))
	(mp,np)-->T473 ==> Ra_is_nonneg(mp ¥Ra_PLUS Ra_Rev(np))
	(m ¥Ra_TIMES mp,n ¥Ra_TIMES np)-->T473 ==> not Ra_is_nonneg((m ¥Ra_TIMES mp) ¥Ra_PLUS Ra_Rev(n ¥Ra_TIMES np))
	(np,n)-->T448 ==> n ¥Ra_TIMES np = np ¥Ra_TIMES n
	(np,n)-->T485 ==> np ¥Ra_TIMES Ra_Rev(n) = Ra_Rev(np ¥Ra_TIMES n)
	T451 ==> Ra_0 in Ra
	(np,Ra_0)-->T473 ==> np ¥Ra_GE Ra_0
	(m,n,Ra_0)-->T508 ==> m ¥Ra_GE Ra_0
	(m,Ra_0)-->T473 ==> m ¥Ra_GE Ra_0
	(m,Ra_0)-->T473 ==> Ra_is_nonneg(m ¥Ra_PLUS Ra_Rev(Ra_0))
	(np,Ra_0)-->T473 ==> Ra_is_nonneg(np ¥Ra_PLUS Ra_Rev(Ra_0))
	T481 ==> Ra_Rev(Ra_0) = Ra_0
	EQUAL ==> Ra_is_nonneg(m ¥Ra_PLUS Ra_0) & Ra_is_nonneg(np ¥Ra_PLUS Ra_0)
	ALGEBRA ==> Ra_is_nonneg(m) & Ra_is_nonneg(np)
	n-->T452 ==> Ra_Rev(n) in Ra
	np-->T452 ==> (Ra_Rev(np) in Ra) & (np ¥Ra_PLUS Ra_Rev(np) = Ra_0)
	Loc_def ==> rn = Ra_Rev(n)
	Loc_def ==> rnp = Ra_Rev(np)
	EQUAL ==> Ra_is_nonneg(m ¥Ra_PLUS rn) & Ra_is_nonneg(mp ¥Ra_PLUS rnp) & (rn in Ra) & (rnp in Ra)
	EQUAL ==> (np ¥Ra_PLUS rnp = Ra_0) & (not Ra_is_nonneg((m ¥Ra_TIMES mp) ¥Ra_PLUS (np ¥Ra_TIMES rn)))
	ALGEBRA ==> (m ¥Ra_PLUS rn in Ra) & (mp ¥Ra_PLUS rnp in Ra) &
	(m ¥Ra_TIMES (mp ¥Ra_PLUS rnp) in Ra) & (np ¥Ra_TIMES (m ¥Ra_PLUS rn) in Ra)
	(m,mp ¥Ra_PLUS rnp)-->T469 ==> Ra_is_nonneg(m ¥Ra_TIMES (mp ¥Ra_PLUS rnp))
	(np,m ¥Ra_PLUS rn)-->T469 ==> Ra_is_nonneg(np ¥Ra_TIMES (m ¥Ra_PLUS rn))
	(m ¥Ra_TIMES (mp ¥Ra_PLUS rnp),np ¥Ra_TIMES (m ¥Ra_PLUS rn))-->T469 ==>
	Ra_is_nonneg((m ¥Ra_TIMES (mp ¥Ra_PLUS rnp)) ¥Ra_PLUS (np ¥Ra_TIMES (m ¥Ra_PLUS rn)))
	ALGEBRA ==> Ra_is_nonneg(((m ¥Ra_TIMES mp) ¥Ra_PLUS (np ¥Ra_TIMES rn)) ¥Ra_PLUS ((m ¥Ra_TIMES (np ¥Ra_PLUS rnp))))
	EQUAL ==> Ra_is_nonneg(((m ¥Ra_TIMES mp) ¥Ra_PLUS (np ¥Ra_TIMES rn)) ¥Ra_PLUS ((m ¥Ra_TIMES Ra_0)))
	ALGEBRA ==> Ra_is_nonneg((m ¥Ra_TIMES mp) ¥Ra_PLUS (np ¥Ra_TIMES rn))
	EQUAL ==> false; Discharge ==> QED
--
-- The following lemma is the 'strict' variant of the preceding.
--
Theorem 517: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X ¥Ra_GT Y) & (Y ¥Ra_GT Ra_0) &
	 (YP ¥Ra_GT Ra_0) & (XP ¥Ra_GE YP)) ¥imp ((X ¥Ra_TIMES XP) ¥Ra_GT (Y ¥Ra_TIMES YP)). Proof:
	Suppose_not(m,n,mp,np) ==> (m in Ra) & (n in Ra) & (mp in Ra) & (np in Ra) & (m ¥Ra_GT n) & (mp ¥Ra_GE np) &
	(n ¥Ra_GT Ra_0) & (np ¥Ra_GT Ra_0) & (not((m ¥Ra_TIMES mp) ¥Ra_GT (n ¥Ra_TIMES np)))
	n-->T452 ==> (Ra_Rev(n) in Ra) & (n ¥Ra_PLUS Ra_Rev(n) = Ra_0)
	T451 ==> Ra_0 in Ra
	EQUAL ==> m ¥Ra_PLUS (n ¥Ra_PLUS Ra_Rev(n)) = m ¥Ra_PLUS Ra_0
	m-->T451 ==> m ¥Ra_PLUS (n ¥Ra_PLUS Ra_Rev(n)) = m
	(m,n)-->T473 ==> (m ¥Ra_GE n) & (m /= n)
	(n,Ra_0)-->T473 ==> (n ¥Ra_GE Ra_0) & (n /= Ra_0)
	(np,Ra_0)-->T473 ==> (np ¥Ra_GE Ra_0) & (np /= Ra_0)
	(m,n)-->T473 ==> Ra_is_nonneg(m ¥Ra_PLUS Ra_Rev(n))
	(mp,np,Ra_0)-->T510 ==> mp ¥Ra_GT Ra_0
	(mp,Ra_0)-->T473 ==> (mp ¥Ra_GE Ra_0) & (mp /= Ra_0)
	(mp,Ra_0)-->T473 ==> Ra_is_nonneg(mp ¥Ra_PLUS Ra_Rev(Ra_0))
	T481 ==> Ra_Rev(Ra_0) = Ra_0
	EQUAL ==> Ra_is_nonneg(mp ¥Ra_PLUS Ra_0)
	ALGEBRA ==> Ra_is_nonneg(mp)
	Loc_def ==> rn = Ra_Rev(n)
	EQUAL ==> Stat1: (m ¥Ra_PLUS (n ¥Ra_PLUS rn) = m) & Ra_is_nonneg(m ¥Ra_PLUS rn) & (rn in Ra)
	EQUAL ==> n ¥Ra_PLUS rn = Ra_0
	ALGEBRA ==> (m ¥Ra_PLUS rn in Ra) & (n ¥Ra_PLUS rn in Ra)
	(mp,m ¥Ra_PLUS rn)-->T469 ==> Ra_is_nonneg(mp ¥Ra_TIMES (m ¥Ra_PLUS rn))
	ALGEBRA ==> mp ¥Ra_TIMES (m ¥Ra_PLUS rn) = (mp ¥Ra_TIMES (m ¥Ra_PLUS rn)) ¥Ra_PLUS Ra_0
	EQUAL(Stat1) ==> (mp ¥Ra_TIMES m) = (mp ¥Ra_TIMES (m ¥Ra_PLUS (n ¥Ra_PLUS rn)))
	ALGEBRA ==> (m ¥Ra_PLUS (n ¥Ra_PLUS rn)) = (n ¥Ra_PLUS (m ¥Ra_PLUS rn))
	EQUAL(Stat1) ==> (mp ¥Ra_TIMES m) = (mp ¥Ra_TIMES (n ¥Ra_PLUS (m ¥Ra_PLUS rn)))
	(m ¥Ra_PLUS rn,mp,n)-->T458 ==> (mp ¥Ra_TIMES (n ¥Ra_PLUS (m ¥Ra_PLUS rn))) =
					((mp ¥Ra_TIMES n) ¥Ra_PLUS (mp ¥Ra_TIMES (m ¥Ra_PLUS rn)))
	ALGEBRA ==> m ¥Ra_PLUS rn in Ra
	ALGEBRA ==> ((mp ¥Ra_TIMES n) in Ra) & ((np ¥Ra_TIMES n) in Ra) & ((mp ¥Ra_TIMES (m ¥Ra_PLUS rn)) in Ra)
	n-->T452 ==> Stat2: n ¥Ra_PLUS Ra_Rev(n) = Ra_0
	T465 ==> Stat3: Ra_is_nonneg(Ra_0)
	EQUAL(Stat2) ==> Ra_is_nonneg(n ¥Ra_PLUS Ra_Rev(n))
	(n,n)-->T473 ==> n ¥Ra_GE n
	Ra_0-->T452 ==> Stat4: Ra_0 ¥Ra_PLUS Ra_Rev(Ra_0) = Ra_0
	EQUAL(Stat4,Stat3) ==> Ra_is_nonneg(Ra_0 ¥Ra_PLUS Ra_Rev(Ra_0))
	(Ra_0,Ra_0)-->T473 ==> Ra_0 ¥Ra_GE Ra_0
	(mp,np,n,n)-->T516 ==> (mp ¥Ra_TIMES n) ¥Ra_GE (np ¥Ra_TIMES n)
	ALGEBRA ==> Ra_is_nonneg((m ¥Ra_PLUS rn) ¥Ra_PLUS Ra_0)
	EQUAL ==> Ra_is_nonneg((m ¥Ra_PLUS rn) ¥Ra_PLUS Ra_Rev(Ra_0))
	(m ¥Ra_PLUS rn,Ra_0)-->T473 ==> (m ¥Ra_PLUS rn) ¥Ra_GE Ra_0
	(mp,Ra_0,m ¥Ra_PLUS rn,Ra_0)-->T516 ==> (mp ¥Ra_TIMES (m ¥Ra_PLUS rn)) ¥Ra_GE (Ra_0 ¥Ra_TIMES Ra_0)
	Ra_0-->T489 ==> Ra_0 ¥Ra_TIMES Ra_0 = Ra_0
	EQUAL ==> (mp ¥Ra_TIMES (m ¥Ra_PLUS rn)) ¥Ra_GE Ra_0
	Suppose ==> Stat5: m ¥Ra_PLUS rn = Ra_0
	EQUAL(Stat5) ==> (m ¥Ra_PLUS rn) ¥Ra_PLUS n = Ra_0 ¥Ra_PLUS n
	ALGEBRA ==> m ¥Ra_PLUS (n ¥Ra_PLUS rn) = n
	EQUAL ==> m ¥Ra_PLUS Ra_0 = n
	ALGEBRA ==> false; Discharge ==> m ¥Ra_PLUS rn /= Ra_0
	Suppose ==> (mp ¥Ra_TIMES (m ¥Ra_PLUS rn)) = Ra_0
	EQUAL ==> Stat6: (mp ¥Ra_TIMES (m ¥Ra_PLUS rn)) ¥Ra_TIMES Recip(m ¥Ra_PLUS rn) = Ra_0 ¥Ra_TIMES Recip(m ¥Ra_PLUS rn)
	(m ¥Ra_PLUS rn)-->T462 ==> (Recip(m ¥Ra_PLUS rn) in Ra) & ((m ¥Ra_PLUS rn) ¥Ra_TIMES Recip(m ¥Ra_PLUS rn) = Ra_1)
	ALGEBRA ==> mp ¥Ra_TIMES ((m ¥Ra_PLUS rn) ¥Ra_TIMES Recip(m ¥Ra_PLUS rn)) = Ra_0
	EQUAL ==> mp ¥Ra_TIMES Ra_1 = Ra_0
	ALGEBRA ==> false; Discharge ==> (mp ¥Ra_TIMES (m ¥Ra_PLUS rn)) /= Ra_0
	(mp ¥Ra_TIMES (m ¥Ra_PLUS rn),Ra_0)-->T473 ==> (mp ¥Ra_TIMES (m ¥Ra_PLUS rn)) ¥Ra_GT Ra_0
	(mp ¥Ra_TIMES n,np ¥Ra_TIMES n,mp ¥Ra_TIMES (m ¥Ra_PLUS rn),Ra_0)-->T504 ==>
	((mp ¥Ra_TIMES n) ¥Ra_PLUS (mp ¥Ra_TIMES (m ¥Ra_PLUS rn))) ¥Ra_GT ((np ¥Ra_TIMES n) ¥Ra_PLUS Ra_0)
	ALGEBRA ==> (mp ¥Ra_TIMES (n ¥Ra_PLUS (m ¥Ra_PLUS rn))) ¥Ra_GT (np ¥Ra_TIMES n)
	EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the mapping of a positive rational to its reciprocal is
-- strictly monotone decreasing.
--
Theorem 518: [The rational reciprocal is monotone decreasing for positive rationals] ((X in Ra) & (Y in Ra) & (X ¥Ra_GT Y) & (Y ¥Ra_GT Ra_0)) ¥imp (Recip(Y) ¥Ra_GT Recip(X)). Proof:
	Suppose_not(m,n) ==> (m in Ra) & (n in Ra) & (m ¥Ra_GT n) & (n ¥Ra_GT Ra_0) & (not(Recip(n) ¥Ra_GT Recip(m)))
	(m,n)-->T473 ==> m ¥Ra_GE n
	T451 ==> Ra_0 in Ra
	(m,n,Ra_0)-->T510 ==> m ¥Ra_GT Ra_0
	(n,Ra_0)-->T473 ==> (n ¥Ra_GE Ra_0) & (n /= Ra_0)
	(m,Ra_0)-->T473 ==> (m ¥Ra_GE Ra_0) & (m /= Ra_0)
	m-->T462 ==> Recip(m) in Ra
	n-->T462 ==> Recip(n) in Ra
	(Recip(n),Recip(m))-->T473 ==> (not (Recip(n) ¥Ra_GE Recip(m))) or (Recip(n) = Recip(m))
	Suppose ==> Recip(n) = Recip(m)
	EQUAL ==> Recip(Recip(n)) = Recip(Recip(m))
	m-->T506 ==> Recip(Recip(m)) = m
	n-->T506 ==> Recip(Recip(n)) = n
	ELEM ==> m = n
	(m,n)-->T473 ==> false; Discharge ==> not (Recip(n) ¥Ra_GE Recip(m))
	(Recip(n),Recip(m))-->T495 ==> Recip(m) ¥Ra_GE Recip(n)
	n-->T491 ==> Recip(n) ¥Ra_GT Ra_0
	(m,n,Recip(m),Recip(n))-->T517 ==> ((m ¥Ra_TIMES Recip(m)) ¥Ra_GT (n ¥Ra_TIMES Recip(n)))
	m-->T462 ==> m ¥Ra_TIMES Recip(m) = Ra_1
	n-->T462 ==> n ¥Ra_TIMES Recip(n) = Ra_1
	EQUAL ==> Ra_1 ¥Ra_GT Ra_1
	(Ra_1,Ra_1)-->T473 ==> false; Discharge ==> QED
--
-- The following result gives us a fact about rationals that will be significant
-- when we come to use them for defining real numbers: between any two distinct
-- rational numbers there exists a third (their average) which lies between the larger
-- and the smaller of the two.
--
Theorem 519: [The average of two rational numbers lies between them] ((X in Ra) & (Y in Ra) & (X ¥Ra_GT Y)) ¥imp
	((X ¥Ra_GT ((X ¥Ra_PLUS Y) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1))) & (((X ¥Ra_PLUS Y) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_GT Y)). Proof:
    Suppose_not(m,n) ==> (m in Ra) & (n in Ra) & (m ¥Ra_GT n) &
	(not ((m ¥Ra_GT ((m ¥Ra_PLUS n) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1))) & (((m ¥Ra_PLUS n) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_GT n)))
 	(m,m)-->T473 ==> m ¥Ra_GE m
 	(n,n)-->T473 ==> n ¥Ra_GE n
    (n,n,m,n)-->T504 ==> ((n ¥Ra_PLUS m) ¥Ra_GT (n ¥Ra_PLUS n))
    (m,m,m,n)-->T504 ==> ((m ¥Ra_PLUS m) ¥Ra_GT (m ¥Ra_PLUS n))
    T451 ==> Ra_1 in Ra
    ALGEBRA ==> (m ¥Ra_PLUS n) ¥Ra_GT (n ¥Ra_TIMES (Ra_1 ¥Ra_PLUS Ra_1))
    ALGEBRA ==> (m ¥Ra_TIMES (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_GT (m ¥Ra_PLUS n)
    ALGEBRA ==> (Ra_1 in Ra) & (Ra_0 in Ra) & (Ra_1 ¥Ra_PLUS Ra_1 in Ra)
    ALGEBRA ==> (m ¥Ra_TIMES (Ra_1 ¥Ra_PLUS Ra_1)) in Ra
    ALGEBRA ==> (m ¥Ra_PLUS n in Ra) & (n ¥Ra_TIMES (Ra_1 ¥Ra_PLUS Ra_1) in Ra)
    ALGEBRA ==> (n ¥Ra_TIMES Ra_1 = n) & (m ¥Ra_TIMES Ra_1 = m)
    T481 ==> Ra_1 ¥Ra_GT Ra_0
    (Ra_1,Ra_0)-->T473 ==> Ra_1 ¥Ra_GE Ra_0
    (Ra_1,Ra_0,Ra_1,Ra_0)-->T504 ==> (Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_GT (Ra_0 ¥Ra_PLUS Ra_0)
    ALGEBRA ==> (Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_GT Ra_0
    (Ra_1 ¥Ra_PLUS Ra_1,Ra_0)-->T473 ==> (Ra_1 ¥Ra_PLUS Ra_1) /= Ra_0
    (Ra_1 ¥Ra_PLUS Ra_1)-->T462 ==> Recip(Ra_1 ¥Ra_PLUS Ra_1) in Ra
    (Ra_1 ¥Ra_PLUS Ra_1)-->T491 ==> Recip(Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_GT Ra_0
    (m ¥Ra_PLUS n,n ¥Ra_TIMES (Ra_1 ¥Ra_PLUS Ra_1),Recip(Ra_1 ¥Ra_PLUS Ra_1))-->T488 ==>
	((m ¥Ra_PLUS n) ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_GT
	((n ¥Ra_TIMES (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1))
    ALGEBRA ==>  ((m ¥Ra_PLUS n) ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_GT
    				(n ¥Ra_TIMES ((Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1)))
    (Ra_1 ¥Ra_PLUS Ra_1)-->T462 ==> (Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1) = Ra_1
    EQUAL ==> ((m ¥Ra_PLUS n) ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_GT n
    Use_def(¥Ra_OVER) ==> ((m ¥Ra_PLUS n) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_GT n
    (m ¥Ra_TIMES (Ra_1 ¥Ra_PLUS Ra_1),m ¥Ra_PLUS n,Recip(Ra_1 ¥Ra_PLUS Ra_1))-->T488 ==>
	((m ¥Ra_TIMES (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_GT
	((m ¥Ra_PLUS n) ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1))
    ALGEBRA ==> (m ¥Ra_TIMES ((Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1))) ¥Ra_GT
	((m ¥Ra_PLUS n) ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1))
    EQUAL ==> m ¥Ra_GT ((m ¥Ra_PLUS n) ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1))
    Use_def(¥Ra_OVER) ==> m ¥Ra_GT ((m ¥Ra_PLUS n) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1))
    Discharge ==> QED
--
Theorem 520: [Properties of the rational number 2] ((Ra_1 ¥Ra_PLUS Ra_1) in Ra) & ((Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_GT Ra_0) &
                (Recip(Ra_1 ¥Ra_PLUS Ra_1) in Ra) &
		((X in Ra) ¥imp ((X ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) in Ra)). Proof:
    Suppose_not(x) ==> ((Ra_1 ¥Ra_PLUS Ra_1) notin Ra) or (not((Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_GT Ra_0)) or
		(Recip(Ra_1 ¥Ra_PLUS Ra_1) notin Ra) or
		((x in Ra) & ((x ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) notin Ra))
        Ra_0-->T451 ==> (Ra_0 in Ra) & (Ra_1 in Ra) & (Ra_0 = (Ra_0 ¥Ra_PLUS Ra_0))
        (Ra_1,Ra_1)-->T445 ==> Stat1: (Ra_1 ¥Ra_PLUS Ra_1) in Ra
        T481 ==> Ra_1 ¥Ra_GT Ra_0
        (Ra_1,Ra_0)-->T473 ==> Ra_1 ¥Ra_GE Ra_0
        (Ra_1,Ra_0,Ra_1,Ra_0)-->T504 ==> Stat2: (Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_GT (Ra_0 ¥Ra_PLUS Ra_0)
        Ra_0-->T451 ==> Ra_0 = (Ra_0 ¥Ra_PLUS Ra_0)
        EQUAL(Stat2) ==> (Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_GT Ra_0
        (Ra_1 ¥Ra_PLUS Ra_1, Ra_0)-->T473 ==> Stat3: (Ra_1 ¥Ra_PLUS Ra_1) /= Ra_0
        (Ra_1 ¥Ra_PLUS Ra_1)-->T462(Stat1,Stat3) ==> Recip(Ra_1 ¥Ra_PLUS Ra_1) in Ra
        ELEM ==> ((x in Ra) & ((x ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) notin Ra))
        Use_def(¥Ra_OVER) ==> (x ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1)) notin Ra
    (x,Recip(Ra_1 ¥Ra_PLUS Ra_1))-->T448 ==> false; Discharge ==> QED
--
-- The next theorem asserts that every rational number $x$ can be obtained as the sum of
-- its half plus its half. Its proof derives this general statement from the specific
-- case when $x=1$.
--
Theorem 521: [Any rational number can be divided into two equal halves] (X in Ra) ¥imp (X = ((X ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_PLUS (X ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)))). Proof:
    Suppose_not(x) ==> (x in Ra) & (x /= ((x ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_PLUS (x ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1))))
        T520 ==> ((Ra_1 ¥Ra_PLUS Ra_1) in Ra) & ((Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_GT Ra_0) & (Recip(Ra_1 ¥Ra_PLUS Ra_1) in Ra)
        Suppose ==> Ra_1 /= (Recip(Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_PLUS Recip(Ra_1 ¥Ra_PLUS Ra_1))
            (Ra_1 ¥Ra_PLUS Ra_1, Ra_0)-->T473 ==> (Ra_1 ¥Ra_PLUS Ra_1) /= Ra_0
            (Ra_1 ¥Ra_PLUS Ra_1)-->T462 ==> Ra_1 = ((Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1))
            T451 ==> Ra_1 in Ra
            ((Ra_1 ¥Ra_PLUS Ra_1), Recip(Ra_1 ¥Ra_PLUS Ra_1))-->T448 ==> ((Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1)) = (Recip(Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_TIMES (Ra_1 ¥Ra_PLUS Ra_1))
            (Ra_1, Recip(Ra_1 ¥Ra_PLUS Ra_1), Ra_1)-->T458 ==> (Recip(Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_TIMES (Ra_1 ¥Ra_PLUS Ra_1)) =
		((Recip(Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_TIMES Ra_1) ¥Ra_PLUS (Recip(Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_TIMES Ra_1))
            (Recip(Ra_1 ¥Ra_PLUS Ra_1))-->T461 ==> (Recip(Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_TIMES Ra_1) = Recip(Ra_1 ¥Ra_PLUS Ra_1)
        EQUAL ==> false; Discharge ==> Ra_1 = (Recip(Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_PLUS Recip(Ra_1 ¥Ra_PLUS Ra_1))
        Use_def(¥Ra_OVER) ==> ((x ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_PLUS (x ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1))) = ((x ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_PLUS (x ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1)))
        (Recip(Ra_1 ¥Ra_PLUS Ra_1),x,Recip(Ra_1 ¥Ra_PLUS Ra_1))-->T458 ==> ((x ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_PLUS (x ¥Ra_TIMES Recip(Ra_1 ¥Ra_PLUS Ra_1))) =
		(x ¥Ra_TIMES (Recip(Ra_1 ¥Ra_PLUS Ra_1) ¥Ra_PLUS Recip(Ra_1 ¥Ra_PLUS Ra_1)))
        x-->T461 ==> (x ¥Ra_TIMES Ra_1) = x
    EQUAL ==> false; Discharge ==> QED
--
-- The following theorem shows that every positive rational number exceeds the sum of two
-- smaller, positive and distinct rational numbers.
--
Theorem 522: [Every positive rational exceeds the sum of two smaller positive rationals] ((X in Ra) & (X ¥Ra_GT Ra_0)) ¥imp (EXISTS e in Ra, e0 in Ra | (X ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e ¥Ra_GT Ra_0) & (X ¥Ra_GT (e ¥Ra_PLUS e0))). Proof:
    Suppose_not(x) ==> ((x in Ra) & (x ¥Ra_GT Ra_0)) & Stat1: (not(EXISTS e in Ra, e0 in Ra | (x ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e ¥Ra_GT Ra_0) & (x ¥Ra_GT (e ¥Ra_PLUS e0))))
--
-- For, if there could be a counterexample $x$, then we could take $e$ to be one half
-- of $x$ and $e0$ to be a half of $e$; and with these values, exploiting previously
-- proved lemmas, we would easily come to a contradiction.
--
        Loc_def ==> e = (x ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1))
        x-->T451 ==> (Ra_0 in Ra) & (x = (x ¥Ra_PLUS Ra_0))
        (x,Ra_0)-->T519 ==> (x ¥Ra_GT ((x ¥Ra_PLUS Ra_0) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1))) & (((x ¥Ra_PLUS Ra_0) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_GT Ra_0)
        x-->T520 ==> (x ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) in Ra
        EQUAL ==> (x ¥Ra_GT e) & (e ¥Ra_GT Ra_0) & (e in Ra)
        (e,e)-->T473 ==> e ¥Ra_GE e
        (e,Ra_0)-->T473 ==> e ¥Ra_GE Ra_0
        Loc_def ==> e0 = (e ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1))
        e-->T451 ==> e = (e ¥Ra_PLUS Ra_0)
        (e,Ra_0)-->T519 ==> (e ¥Ra_GT ((e ¥Ra_PLUS Ra_0) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1))) & (((e ¥Ra_PLUS Ra_0) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_GT Ra_0)
        e-->T520 ==> (e ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) in Ra
        EQUAL ==> (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e0 in Ra)
        x-->T521 ==> x = ((x ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_PLUS (x ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)))
        EQUAL ==> x = (e ¥Ra_PLUS e)
        (e,e,e,e0)-->T504 ==> (e ¥Ra_PLUS e) ¥Ra_GT (e ¥Ra_PLUS e0)
        EQUAL ==> x ¥Ra_GT (e ¥Ra_PLUS e0)
        (e,Ra_0,e0,Ra_0)-->T504 ==> (e ¥Ra_PLUS e0) ¥Ra_GT (Ra_0 ¥Ra_PLUS Ra_0)
        Ra_0-->T451 ==> Ra_0 = (Ra_0 ¥Ra_PLUS Ra_0)
        EQUAL ==> (e ¥Ra_PLUS e0) ¥Ra_GT Ra_0
    (e,e0)-->Stat1 ==> false; Discharge ==> QED
--
-- As a corallary it follows that any positive rational is larger than some other positive rational.
--
Theorem 523: [Every positive rational exceeds some smaller positive rational] ((X in Ra) & (X ¥Ra_GT Ra_0)) ¥imp (EXISTS e in Ra | (X ¥Ra_GT e) & (e ¥Ra_GT Ra_0)). Proof:
	Suppose_not(x) ==> (x in Ra) & (x ¥Ra_GT Ra_0) & Stat1: (not(EXISTS e in Ra | (x ¥Ra_GT e) & (e ¥Ra_GT Ra_0)))
	x-->T522 ==> Stat2: (EXISTS e in Ra, e0 in Ra | (x ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e ¥Ra_GT Ra_0) & (x ¥Ra_GT (e ¥Ra_PLUS e0)))
	(e,e0)-->Stat2 ==> (e in Ra) & (e0 in Ra) & (x ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0)
	(x,e,e0)-->T511 ==> x ¥Ra_GT e0
	e0-->Stat1 ==> false; Discharge ==> QED
--
-- It is also useful to know that the square of any rational number is non-negative.
--
Theorem 524: [the squares of rational numbers are non-negative] (X in Ra) ¥imp ((X ¥Ra_TIMES X) ¥Ra_GE Ra_0). Proof:
	Suppose_not(n) ==> (n in Ra) & (not((n ¥Ra_TIMES n) ¥Ra_GE Ra_0))
	(n ¥Ra_TIMES n,Ra_0)-->T473 ==> not Ra_is_nonneg((n ¥Ra_TIMES n) ¥Ra_PLUS Ra_Rev(Ra_0))
	T481 ==> Ra_Rev(Ra_0) = Ra_0
	EQUAL ==> not Ra_is_nonneg((n ¥Ra_TIMES n) ¥Ra_PLUS Ra_0)
	ALGEBRA ==> not Ra_is_nonneg(n ¥Ra_TIMES n)
	n-->T452 ==> Ra_Rev(n) in Ra
	n-->T466 ==> Ra_is_nonneg(n) or Ra_is_nonneg(Ra_Rev(n))
	Suppose ==> Ra_is_nonneg(n)
	(n,n)-->T469 ==> false; Discharge ==> Ra_is_nonneg(Ra_Rev(n))
	(Ra_Rev(n),Ra_Rev(n))-->T469 ==> Ra_is_nonneg(Ra_Rev(n) ¥Ra_TIMES Ra_Rev(n))
	(Ra_Rev(n),n)-->T485 ==> Ra_Rev(n) ¥Ra_TIMES Ra_Rev(n) = Ra_Rev(Ra_Rev(n) ¥Ra_TIMES n)
	(Ra_Rev(n),n)-->T448 ==> Ra_Rev(n) ¥Ra_TIMES n = n ¥Ra_TIMES Ra_Rev(n)
	(n,n)-->T485 ==> Ra_Rev(n ¥Ra_TIMES n) = n ¥Ra_TIMES Ra_Rev(n)
	EQUAL ==> Ra_Rev(n) ¥Ra_TIMES Ra_Rev(n) = Ra_Rev(Ra_Rev(n ¥Ra_TIMES n))
	ALGEBRA ==> (n ¥Ra_TIMES n) in Ra
	(n ¥Ra_TIMES n)-->T494 ==> Ra_Rev(Ra_Rev(n ¥Ra_TIMES n)) = n ¥Ra_TIMES n
	EQUAL ==> false; Discharge ==> QED
--
APPLY_otter(abs_thryvar:Ra_ABS) orderedGroups(In_domain(x)->(x in Ra), pluz(x,y)->(x ¥Ra_PLUS y), e->Ra_0, rvz(x)->Ra_Rev(x), nneg(x)->Ra_is_nonneg(x), leq(x,y)->(x ¥Ra_LE y)) ==>
Theorem 525: [rational numbers meet facts known about ordered groups in general] (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_PLUS y) = (x ¥Ra_PLUS z)) ¥imp (y = z))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_Rev(x ¥Ra_PLUS Ra_Rev(y)) = (y ¥Ra_PLUS Ra_Rev(x)))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_LE y) or (y ¥Ra_LE x))) &
	(FORALL x | (x in Ra) ¥imp (x ¥Ra_LE x)) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_LE y) & (y ¥Ra_LE z)) ¥imp (x ¥Ra_LE z))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_LE y) & (x /= y) & (y ¥Ra_LE z)) ¥imp (x /= z))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_LE y) & (y ¥Ra_LE z) & (y /= z)) ¥imp (x /= z))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp ((x ¥Ra_LE y) ¥imp ((x ¥Ra_PLUS z) ¥Ra_LE (y ¥Ra_PLUS z)))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_PLUS z) = (y ¥Ra_PLUS z)) ¥imp (x = y))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_LE y) & (x /= y)) ¥imp ((x ¥Ra_PLUS z) /= (y ¥Ra_PLUS z)))) &
	(FORALL x | (x in Ra) ¥imp (Ra_ABS(x ¥Ra_PLUS Ra_Rev(x)) = Ra_0)) &
	(FORALL x | (x in Ra) ¥imp (x ¥Ra_LE Ra_ABS(x))) &
	(FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_ABS(x)) = Ra_ABS(x))) &
	(FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0))) &
	(FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_PLUS y) ¥Ra_LE (Ra_ABS(x) ¥Ra_PLUS Ra_ABS(y)))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp ((Ra_ABS(x ¥Ra_PLUS Ra_Rev(y)) ¥Ra_LE z) ¥imp (y ¥Ra_LE (x ¥Ra_PLUS z)))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_ABS(x ¥Ra_PLUS y) ¥Ra_LE (Ra_ABS(x) ¥Ra_PLUS Ra_ABS(y)))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp ((not(Ra_is_nonneg(x))) ¥imp ((x ¥Ra_LE Ra_ABS(y)) & (x /= Ra_ABS(y))))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (Ra_ABS((x ¥Ra_PLUS Ra_Rev(z))) ¥Ra_LE (Ra_ABS(x ¥Ra_PLUS Ra_Rev(y)) ¥Ra_PLUS Ra_ABS(y ¥Ra_PLUS Ra_Rev(z))))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_is_nonneg(y) ¥imp ((x ¥Ra_PLUS Ra_Rev(y)) ¥Ra_LE (x ¥Ra_PLUS y)))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_ABS(Ra_ABS(x) ¥Ra_PLUS Ra_Rev(Ra_ABS(y))) ¥Ra_LE Ra_ABS(x ¥Ra_PLUS Ra_Rev(y)))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_ABS(x) ¥Ra_PLUS Ra_Rev(Ra_ABS(Ra_ABS(y) ¥Ra_PLUS Ra_Rev(Ra_ABS(x)))) ¥Ra_LE Ra_ABS(y)))
--
--Def 45a: [Absolute value of a rational number] Ra_ABS(X) := if Ra_is_nonneg(X) then X else Ra_Rev(X) end if
--
--
Theorem 526: ((X in Ra) & (Y in Ra) & (not(X ¥Ra_LE Y))) ¥imp (X ¥Ra_GT Y). Proof:
    Suppose_not(x,y) ==> AUTO
	T525 ==> Stat1: (FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp ((x ¥Ra_LE y) or (y ¥Ra_LE x))) &
		Stat2: 	(FORALL x | (x in Ra) ¥imp (x ¥Ra_LE x))
	(x,y)-->Stat1(*) ==> Stat3: y ¥Ra_LE x
	(y,x)-->T473(Stat3,Stat3*) ==> Stat4: x ¥Ra_GE y
	x-->Stat2(*) ==> Stat5: x ¥Ra_LE x
	Suppose ==> x = y
	EQUAL ==> false; Discharge ==> Stat6: x /= y
	(x,x)-->T473(Stat5,Stat5*) ==> x ¥Ra_GE x
    (x,y)-->T473(*) ==> false; Discharge ==> QED

--
-- It is useful to keep at hand the facts that the absolute value
-- of a rational number is a rational number and that the absolute
-- value of the product of two rational numbers equals the product
-- of the absolute values of the operands.
--
Theorem 527: [The absolute value of a rational $x$ is a non-negative rational no smaller than $x$] (X in Ra) ¥imp ((Ra_ABS(X) in Ra) & (Ra_ABS(X) ¥Ra_GE Ra_0) & (Ra_ABS(X) ¥Ra_GE X)). Proof:
    Suppose_not(x) ==> (x in Ra) & ((Ra_ABS(x) notin Ra) or (not(Ra_ABS(x) ¥Ra_GE Ra_0)) or (not(Ra_ABS(x) ¥Ra_GE x)))
	T525 ==> Stat1: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
	x-->Stat1 ==> Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if
	Suppose ==> Ra_ABS(x) notin Ra
	x-->T452 ==> false; Discharge ==> (Ra_ABS(x) in Ra) & ((not(Ra_ABS(x) ¥Ra_GE Ra_0)) or (not(Ra_ABS(x) ¥Ra_GE x)))
	(Ra_ABS(x))-->T451 ==> (Ra_ABS(x) = Ra_ABS(x) ¥Ra_PLUS Ra_0) & (Ra_0 in Ra)
	T481 ==> Ra_Rev(Ra_0) = Ra_0
	Suppose ==> Ra_is_nonneg(x)
		ELEM ==> Ra_ABS(x) = x
		EQUAL ==> (not(x ¥Ra_GE Ra_0)) or (not(x ¥Ra_GE x))
		(x,x)-->T474 ==> not(x ¥Ra_GE Ra_0)
		(x,Ra_0)-->T473 ==> not Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(Ra_0))
		EQUAL ==> not Ra_is_nonneg(x ¥Ra_PLUS Ra_0)
		x-->T451 ==> x ¥Ra_PLUS Ra_0 = x
	EQUAL ==> false; Discharge ==> (not(Ra_is_nonneg(x))) & (Ra_ABS(x) = Ra_Rev(x))
	x-->T466 ==> Ra_is_nonneg(Ra_Rev(x))
	Suppose ==> not(Ra_ABS(x) ¥Ra_GE x)
		EQUAL ==> not(Ra_Rev(x) ¥Ra_GE x)
		x-->T452 ==> Ra_Rev(x) in Ra
		(Ra_Rev(x),x)-->T473 ==> not Ra_is_nonneg(Ra_Rev(x) ¥Ra_PLUS Ra_Rev(x))
	(Ra_Rev(x),Ra_Rev(x))-->T469 ==> false; Discharge ==> Ra_ABS(x) ¥Ra_GE x
	EQUAL ==> Ra_Rev(x) ¥Ra_GE x
	x-->T466 ==> Ra_is_nonneg(Ra_Rev(x))
	EQUAL ==> Ra_is_nonneg(Ra_ABS(x) ¥Ra_PLUS Ra_Rev(Ra_0))
    (Ra_ABS(x), Ra_0)-->T473 ==> false; Discharge ==> QED
--
--Theorem myTempTheorem3: [just for debugging purposes] (X in Ra) ¥imp (Ra_ABS(X) in Ra). Proof:
--	Suppose_not(x) ==> AUTO
--	x-->T432==> false; Discharge ==> QED
--
Theorem 528: [The absolute value of a non-negative rational $x$ is $x$] (X in Ra) ¥imp ((X ¥Ra_GE Ra_0) ¥eq (Ra_ABS(X) = X)). Proof:
Suppose_not(x) ==> AUTO
	(x,Ra_0)-->T473 ==> (x ¥Ra_GE Ra_0) ¥eq Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(Ra_0))
	x-->T451 ==> (Ra_0 in Ra) & (x = (x ¥Ra_PLUS Ra_0))
	T481 ==> Ra_Rev(Ra_0) = Ra_0
	EQUAL ==> (x ¥Ra_GE Ra_0) ¥eq Ra_is_nonneg(x)
	T525 ==> Stat1: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
	Suppose ==> Ra_is_nonneg(x)
	x-->Stat1(*) ==> false; Discharge ==> (not Ra_is_nonneg(x)) & (Ra_ABS(x) = x)
	x-->Stat1(Stat1*) ==> x = Ra_Rev(x)
	EQUAL(Stat1) ==> (not Ra_is_nonneg(Ra_Rev(x)))
x-->T466(*) ==> false; Discharge ==> QED
--
Theorem 529: [The absolute value of a rational $x$ greater than $Ra_0$ is $x$] ((X in Ra) & (X ¥Ra_GT Ra_0)) ¥imp (Ra_ABS(X) = X). Proof:
Suppose_not(x) ==> AUTO
	(x,Ra_0)-->T473 ==> x ¥Ra_GE Ra_0
x-->T528 ==> false; Discharge ==> QED
--
Theorem 530: [The absolute value of a rational product is the product of the absolute values] ((X in Ra) & (Y in Ra)) ¥imp (Ra_ABS(X ¥Ra_TIMES Y) = (Ra_ABS(X) ¥Ra_TIMES Ra_ABS(Y))). Proof:
    Suppose_not(x,y) ==> (x in Ra) & (y in Ra) & (Ra_ABS(x ¥Ra_TIMES y) /= (Ra_ABS(x) ¥Ra_TIMES Ra_ABS(y)))
--
-- For, assuming $x,y$ to be a counterexample to the desired statement,
-- we will reach a contradiction in each one of the possible cases, which are:
-- $x=Ra_0$ or $y=Ra_0$; $x$ and $y$ both positive; one of $x,y$ positive, the other
-- one negative; both of $x$ and $y$ negative.
--
-- We begin by collecting various elementary algebraic
-- consequences of our hypothesis.
--
        ALGEBRA ==> ((x ¥Ra_TIMES y) in Ra) & (Ra_0 in Ra)
        x-->T452 ==> Ra_Rev(x) in Ra
        y-->T452 ==> Ra_Rev(y) in Ra
        x-->T527 ==> Ra_ABS(x) in Ra
        y-->T527 ==> Ra_ABS(y) in Ra
        (x,y)-->T448 ==> (x ¥Ra_TIMES y) = (y ¥Ra_TIMES x)
        x-->T451 ==> x = x ¥Ra_PLUS Ra_0
        y-->T451 ==> y = y ¥Ra_PLUS Ra_0
        (Ra_Rev(x))-->T451 ==> Ra_Rev(x) = Ra_Rev(x) ¥Ra_PLUS Ra_0
        (Ra_Rev(y))-->T451 ==> Ra_Rev(y) = Ra_Rev(y) ¥Ra_PLUS Ra_0
        T481 ==> Ra_Rev(Ra_0) = Ra_0
        (x ¥Ra_TIMES y)-->T452 ==> Ra_Rev(x ¥Ra_TIMES y) in Ra
        (Ra_Rev(x ¥Ra_TIMES y))-->T451 ==> Ra_Rev(x ¥Ra_TIMES y) ¥Ra_PLUS Ra_0 = Ra_Rev(x ¥Ra_TIMES y)
        (Ra_Rev(x ¥Ra_TIMES y),Ra_0)-->T445 ==> Stat1: Ra_0 ¥Ra_PLUS Ra_Rev(x ¥Ra_TIMES y) = Ra_Rev(x ¥Ra_TIMES y)
        (x,y)-->T485 ==> (x ¥Ra_TIMES Ra_Rev(y)) = Ra_Rev(x ¥Ra_TIMES y)
        (y,x)-->T485 ==> (y ¥Ra_TIMES Ra_Rev(x)) = Ra_Rev(y ¥Ra_TIMES x)
        (y,Ra_Rev(x))-->T448 ==> (y ¥Ra_TIMES Ra_Rev(x)) = (Ra_Rev(x) ¥Ra_TIMES y)
        T525 ==> Stat2: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &
		   Stat3: (FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0))) &
		   Stat4: (FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
--
-- The case when either $x$ or $y$ is zero readily leads to a contradiction,
-- because one of $Ra_ABS(x),Ra_ABS(y)$ is zero in this case, and hence
-- the product of $x,y$, its absolute value, and the product of
-- $Ra_ABS(x),Ra_ABS(y)$ coincide.
--
        Suppose ==> (x = Ra_0) or (y = Ra_0)
            x-->T489 ==> (x ¥Ra_TIMES Ra_0) = Ra_0
            y-->T489 ==> (y ¥Ra_TIMES Ra_0) = Ra_0
            Suppose ==> ((x ¥Ra_TIMES y) /= Ra_0) or ((Ra_ABS(x) ¥Ra_TIMES Ra_ABS(y)) /= Ra_0)
                Suppose ==> x = Ra_0
                    x-->Stat3 ==> Ra_ABS(x) = Ra_0
                    (Ra_ABS(y))-->T489 ==> (Ra_ABS(y) ¥Ra_TIMES Ra_0) = Ra_0
                    (Ra_ABS(y),Ra_0)-->T448 ==> (Ra_ABS(y) ¥Ra_TIMES Ra_0) = (Ra_0 ¥Ra_TIMES Ra_ABS(y))
                EQUAL ==> false; Discharge ==> y = Ra_0
                y-->Stat3 ==> Ra_ABS(y) = Ra_0
                (Ra_ABS(x))-->T489 ==> (Ra_ABS(x) ¥Ra_TIMES Ra_0) = Ra_0
            EQUAL ==> false; Discharge ==> ((x ¥Ra_TIMES y) = Ra_0) & ((Ra_ABS(x) ¥Ra_TIMES Ra_ABS(y)) = Ra_0)
        (x ¥Ra_TIMES y)-->Stat3 ==> false; Discharge ==> (x /= Ra_0) & (y /= Ra_0)
--
-- The case when $x$ and $y$ are positive is settled with equal ease, because
-- in this case the absolute value of $x ¥Ra_TIMES y$, coinciding with
-- $x ¥Ra_TIMES y$, equals the product of $x$ and $y$, which
-- in their turn are the absolute values of $x$ and $y$.
--
        Suppose ==> (Ra_0 ¥Ra_LT x) & (Ra_0 ¥Ra_LT y)
            (Ra_0,x)-->T473 ==> x ¥Ra_GT Ra_0
            (x,Ra_0)-->T473 ==> Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(Ra_0))
            EQUAL ==> Ra_is_nonneg(x)
--
            (Ra_0,y)-->T473 ==> y ¥Ra_GT Ra_0
            (y,Ra_0)-->T473 ==> Ra_is_nonneg(y ¥Ra_PLUS Ra_Rev(Ra_0))
            EQUAL ==> Ra_is_nonneg(y)
--
            (x,y)-->T469 ==> Ra_is_nonneg(x ¥Ra_TIMES y)
            x-->Stat2 ==> Ra_ABS(x) = x
            y-->Stat2 ==> Ra_ABS(y) = y
            (x ¥Ra_TIMES y)-->Stat2 ==> Ra_ABS(x ¥Ra_TIMES y) = (x ¥Ra_TIMES y)
        EQUAL ==> false; Discharge ==> not((Ra_0 ¥Ra_LT x) & (Ra_0 ¥Ra_LT y))
--
-- The case when $x$ is positive and $y$ is negative is but slightly
-- more complicated. The product of $x$ and $y$ is negative, and hence
-- the absolute value of this product is the reverse of it. This equals
-- the product of $x$ with the reverse of $y$, which turns out to be
-- the product of the absolute values of $x$ and $y$.
--
        Suppose ==> (Ra_0 ¥Ra_LT x) & (y ¥Ra_LT Ra_0)
            (Ra_0,x)-->T473 ==> x ¥Ra_GT Ra_0
            (x,Ra_0)-->T473 ==> Ra_is_nonneg(x ¥Ra_PLUS Ra_Rev(Ra_0))
            EQUAL ==> Ra_is_nonneg(x)
            x-->Stat2 ==> Ra_ABS(x) = x
--
            (y,Ra_0)-->T473 ==> Ra_0 ¥Ra_GT y
            (Ra_0,y)-->T473 ==> Ra_is_nonneg(Ra_0 ¥Ra_PLUS Ra_Rev(y))
            (Ra_0,Ra_Rev(y))-->T445 ==> Ra_0 ¥Ra_PLUS Ra_Rev(y) = Ra_Rev(y)
            EQUAL ==> Ra_is_nonneg(Ra_Rev(y))
            y-->Stat4 ==> Ra_ABS(Ra_Rev(y)) = Ra_ABS(y)
            (Ra_Rev(y))-->Stat2 ==> Ra_ABS(y) = Ra_Rev(y)
--
            EQUAL ==> Ra_Rev(x ¥Ra_TIMES y) = Ra_ABS(x) ¥Ra_TIMES Ra_ABS(y)
--
            Suppose ==> Ra_is_nonneg(x ¥Ra_TIMES y)
--
-- Under this assumption, since $y ¥Ra_LT Ra_0$ yields $Ra_Rev(y) ¥Ra_GT Ra_0$
-- and moreover $x$ is positive, the product $x ¥Ra_TIMES Ra_Rev(y)$ would turn
-- out to be positive too; and consequently $Ra_Rev(x ¥Ra_TIMES Ra_Rev(y))$,
-- which equals $x ¥Ra_TIMES y$, would be negative.
--
                (y,Ra_0)-->T473 ==> Ra_0 ¥Ra_GT y
                (Ra_0,y)-->T503 ==> Ra_Rev(y) ¥Ra_GT Ra_Rev(Ra_0)
                EQUAL ==> Ra_Rev(y) ¥Ra_GT Ra_0
                (x,Ra_0,Ra_Rev(y))-->T488 ==> (x ¥Ra_TIMES Ra_Rev(y)) ¥Ra_GT (Ra_0 ¥Ra_TIMES Ra_Rev(y))
                ALGEBRA ==> ((x ¥Ra_TIMES Ra_Rev(y)) in Ra) & ((Ra_0 ¥Ra_TIMES Ra_Rev(y)) in Ra)
                (x ¥Ra_TIMES Ra_Rev(y),Ra_0 ¥Ra_TIMES Ra_Rev(y))-->T503 ==> Ra_Rev(Ra_0 ¥Ra_TIMES Ra_Rev(y)) ¥Ra_GT Ra_Rev(x ¥Ra_TIMES Ra_Rev(y))
                (Ra_Rev(y))-->T489 ==> (Ra_Rev(y) ¥Ra_TIMES Ra_0) = Ra_0
                (Ra_Rev(y),Ra_0)-->T448 ==> (Ra_Rev(y) ¥Ra_TIMES Ra_0) = (Ra_0 ¥Ra_TIMES Ra_Rev(y))
                (x ¥Ra_TIMES y)-->T494 ==> Ra_Rev(Ra_Rev(x ¥Ra_TIMES y)) = x ¥Ra_TIMES y
                EQUAL ==> (x ¥Ra_TIMES Ra_Rev(y)) ¥Ra_GT Ra_0
                (x ¥Ra_TIMES Ra_Rev(y),Ra_0)-->T503 ==> Ra_Rev(Ra_0) ¥Ra_GT Ra_Rev(x ¥Ra_TIMES Ra_Rev(y))
                (x,y)-->T485 ==> x ¥Ra_TIMES Ra_Rev(y) = Ra_Rev(x ¥Ra_TIMES y)
                EQUAL ==> Ra_0 ¥Ra_GT (x ¥Ra_TIMES y)
                (Ra_0,x ¥Ra_TIMES y)-->T473 ==> Stat5: Ra_is_nonneg(Ra_0 ¥Ra_PLUS Ra_Rev(x ¥Ra_TIMES y))
                EQUAL(Stat1,Stat5) ==>  Ra_is_nonneg(Ra_Rev(x ¥Ra_TIMES y))
                (x ¥Ra_TIMES y)-->T466 ==> x ¥Ra_TIMES y = Ra_0
            (Ra_0,x ¥Ra_TIMES y)-->T473 ==> false; Discharge ==> not Ra_is_nonneg(x ¥Ra_TIMES y)
            (x ¥Ra_TIMES y)-->Stat2 ==> Ra_ABS(x ¥Ra_TIMES y) = Ra_Rev(x ¥Ra_TIMES y)
        EQUAL ==> false; Discharge ==> (not((Ra_0 ¥Ra_LT x) & (y ¥Ra_LT Ra_0)))
--
-- The case when $y$ is positive and $x$ is negative is
-- entirely analogous to the one just discussed.
--
        Suppose ==> (x ¥Ra_LT Ra_0) & (Ra_0 ¥Ra_LT y)
            (Ra_0,y)-->T473 ==> y ¥Ra_GT Ra_0
            (y,Ra_0)-->T473 ==> Ra_is_nonneg(y ¥Ra_PLUS Ra_Rev(Ra_0))
            EQUAL ==> Ra_is_nonneg(y)
            y-->Stat2 ==> Ra_ABS(y) = y
--
            (x,Ra_0)-->T473 ==> Ra_0 ¥Ra_GT x
            (Ra_0,x)-->T473 ==> Ra_is_nonneg(Ra_0 ¥Ra_PLUS Ra_Rev(x))
            (Ra_0,Ra_Rev(x))-->T445 ==> Ra_0 ¥Ra_PLUS Ra_Rev(x) = Ra_Rev(x)
            EQUAL ==> Ra_is_nonneg(Ra_Rev(x))
            x-->Stat4 ==> Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)
            (Ra_Rev(x))-->Stat2 ==> Ra_ABS(x) = Ra_Rev(x)
--
            EQUAL ==> Ra_Rev(x ¥Ra_TIMES y) = Ra_ABS(x) ¥Ra_TIMES Ra_ABS(y)
--
            Suppose ==> Ra_is_nonneg(x ¥Ra_TIMES y)
--
-- Under this assumption, since $x ¥Ra_LT Ra_0$ yields $Ra_Rev(x) ¥Ra_GT Ra_0$
-- and moreover $y$ is positive, the product $Ra_Rev(x) ¥Ra_TIMES y$ would turn
-- out to be positive too; and consequently $Ra_Rev(Ra_Rev(x) ¥Ra_TIMES y)$,
-- which equals $x ¥Ra_TIMES y$, would be negative.
--
                (x,Ra_0)-->T473 ==> Ra_0 ¥Ra_GT x
                (Ra_0,x)-->T503 ==> Ra_Rev(x) ¥Ra_GT Ra_Rev(Ra_0)
                EQUAL ==> Ra_Rev(x) ¥Ra_GT Ra_0
                (Ra_Rev(x),Ra_0,y)-->T488 ==> (Ra_Rev(x) ¥Ra_TIMES y) ¥Ra_GT (Ra_0 ¥Ra_TIMES y)
                ALGEBRA ==> ((Ra_Rev(x) ¥Ra_TIMES y) in Ra) & ((Ra_0 ¥Ra_TIMES y) in Ra)
                (Ra_Rev(x) ¥Ra_TIMES y,Ra_0 ¥Ra_TIMES y)-->T503 ==> Ra_Rev(Ra_0 ¥Ra_TIMES y) ¥Ra_GT Ra_Rev(Ra_Rev(x) ¥Ra_TIMES y)
                y-->T489 ==> (y ¥Ra_TIMES Ra_0) = Ra_0
                (y,Ra_0)-->T448 ==> (y ¥Ra_TIMES Ra_0) = (Ra_0 ¥Ra_TIMES y)
                (x ¥Ra_TIMES y)-->T494 ==> Ra_Rev(Ra_Rev(x ¥Ra_TIMES y)) = x ¥Ra_TIMES y
                EQUAL ==> (Ra_Rev(x) ¥Ra_TIMES y) ¥Ra_GT Ra_0
                (Ra_Rev(x) ¥Ra_TIMES y,Ra_0)-->T503 ==> Ra_Rev(Ra_0) ¥Ra_GT Ra_Rev(Ra_Rev(x) ¥Ra_TIMES y)
                (y,x)-->T485 ==> y ¥Ra_TIMES Ra_Rev(x) = Ra_Rev(y ¥Ra_TIMES x)
                (Ra_Rev(x),y)-->T448 ==> Ra_Rev(x) ¥Ra_TIMES y = y ¥Ra_TIMES Ra_Rev(x)
                EQUAL ==> Ra_0 ¥Ra_GT (x ¥Ra_TIMES y)
                (Ra_0,x ¥Ra_TIMES y)-->T473 ==> Stat6: Ra_is_nonneg(Ra_0 ¥Ra_PLUS Ra_Rev(x ¥Ra_TIMES y))
                EQUAL(Stat1,Stat6) ==>  Ra_is_nonneg(Ra_Rev(x ¥Ra_TIMES y))
                (x ¥Ra_TIMES y)-->T466 ==> x ¥Ra_TIMES y = Ra_0
            (Ra_0,x ¥Ra_TIMES y)-->T473 ==> false; Discharge ==> not Ra_is_nonneg(x ¥Ra_TIMES y)
            (x ¥Ra_TIMES y)-->Stat2 ==> Ra_ABS(x ¥Ra_TIMES y) = Ra_Rev(x ¥Ra_TIMES y)
        EQUAL ==> false; Discharge ==> (not((x ¥Ra_LT Ra_0) & (Ra_0 ¥Ra_LT y)))
--
-- The only remaining case is the one in which $x,y$ are negative.
-- In this case the absolute value of $x ¥Ra_TIMES y$ coincides with
-- $x ¥Ra_TIMES y$ and equals the product of the reverses of $x$ and $y$, which
-- in their turn are the absolute values of $x$ and $y$.
--
        T514 ==> Stat7: (FORALL x in Ra, y in Ra | (x ¥Ra_LT y) or (x = y) or (y ¥Ra_LT x))
        (x,Ra_0)-->Stat7 ==> (x = Ra_0) or (x ¥Ra_LT Ra_0) or (Ra_0 ¥Ra_LT x)
        (y,Ra_0)-->Stat7 ==> (y = Ra_0) or (y ¥Ra_LT Ra_0) or (Ra_0 ¥Ra_LT y)
        ELEM ==> (x ¥Ra_LT Ra_0) & (y ¥Ra_LT Ra_0)
--
        (x,Ra_0)-->T473 ==> Ra_0 ¥Ra_GT x
        (Ra_0,x)-->T473 ==> Ra_is_nonneg(Ra_0 ¥Ra_PLUS Ra_Rev(x))
        (Ra_0,Ra_Rev(x))-->T445 ==> Ra_0 ¥Ra_PLUS Ra_Rev(x) = Ra_Rev(x)
        EQUAL ==> Ra_is_nonneg(Ra_Rev(x))
        x-->Stat4 ==> Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)
        (Ra_Rev(x))-->Stat2 ==> Ra_ABS(x) = Ra_Rev(x)
--
        (y,Ra_0)-->T473 ==> Ra_0 ¥Ra_GT y
        (Ra_0,y)-->T473 ==> Ra_is_nonneg(Ra_0 ¥Ra_PLUS Ra_Rev(y))
        (Ra_0,Ra_Rev(y))-->T445 ==> Ra_0 ¥Ra_PLUS Ra_Rev(y) = Ra_Rev(y)
        EQUAL ==> Ra_is_nonneg(Ra_Rev(y))
        y-->Stat4 ==> Ra_ABS(Ra_Rev(y)) = Ra_ABS(y)
        (Ra_Rev(y))-->Stat2 ==> Ra_ABS(y) = Ra_Rev(y)
--
        (Ra_Rev(x),y)-->T485 ==> Ra_Rev(x) ¥Ra_TIMES Ra_Rev(y) = Ra_Rev(Ra_Rev(x) ¥Ra_TIMES y)
        (Ra_Rev(x),y)-->T448 ==> (Ra_Rev(x) ¥Ra_TIMES y) = (y ¥Ra_TIMES Ra_Rev(x))
        (y,x)-->T485 ==> (y ¥Ra_TIMES Ra_Rev(x)) = Ra_Rev(y ¥Ra_TIMES x)
        (x ¥Ra_TIMES y)-->T494 ==> Ra_Rev(Ra_Rev(x ¥Ra_TIMES y)) = x ¥Ra_TIMES y
--
-- This yields the conclusion
--	$x ¥Ra_TIMES y = Ra_ABS(x) ¥Ra_TIMES Ra_ABS(y)$,
-- leading to a contradiction. Since all possible cases have
-- been analyzed and then discarded, this terminates our proof.
--
    EQUAL ==> false; Discharge ==> QED
--
-- Our next theorem shows that the only divisor of zero, over the rationals, is zero.
--
Theorem 531: [If the product of two rationals is 0, one of them is 0] ((X in Ra) & (Y in Ra)) ¥imp (((X ¥Ra_TIMES Y) = Ra_0) ¥eq ((X = Ra_0) or (Y = Ra_0))). Proof:
    Suppose_not(x,y) ==> Stat1: (x in Ra) & (y in Ra) & (((x ¥Ra_TIMES y) /= Ra_0) ¥eq ((x = Ra_0) or (y = Ra_0)))
        ALGEBRA ==> Stat2: ((x ¥Ra_TIMES Ra_0) in Ra) & ((x ¥Ra_TIMES Ra_0) = Ra_0) & ((Ra_0 ¥Ra_TIMES y) = Ra_0)
        Suppose ==> (x = Ra_0)
            EQUAL ==> (x ¥Ra_TIMES y) = Ra_0
        Discharge ==> (x /= Ra_0)
        Suppose ==> (y = Ra_0)
            EQUAL ==> (x ¥Ra_TIMES y) = Ra_0
        Discharge ==> Stat3: (y /= Ra_0) &  ((x ¥Ra_TIMES y) = Ra_0)
        T525 ==> Stat4:	(FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0)))
        x-->T527(Stat1,Stat1) ==> (Ra_ABS(x) in Ra) & (Ra_ABS(x) ¥Ra_GE Ra_0)
        y-->T527 ==> (Ra_ABS(y) in Ra) & (Ra_ABS(y) ¥Ra_GE Ra_0)
        x-->Stat4 ==> Ra_ABS(x) /= Ra_0
        y-->Stat4 ==> Ra_ABS(y) /= Ra_0
        (Ra_ABS(x),Ra_0)-->T473 ==> (Ra_ABS(x) ¥Ra_GT Ra_0)
        (Ra_ABS(y),Ra_0)-->T473 ==> (Ra_ABS(y) ¥Ra_GT Ra_0)
        (Ra_ABS(x),Ra_0,Ra_ABS(y))-->T488 ==> (Ra_ABS(x) ¥Ra_TIMES Ra_ABS(y)) ¥Ra_GT (Ra_0 ¥Ra_TIMES Ra_ABS(y))
        ALGEBRA ==> ((Ra_ABS(x) ¥Ra_TIMES Ra_ABS(y)) in Ra) & ((Ra_0 ¥Ra_TIMES Ra_ABS(y)) = Ra_0)
        EQUAL ==> (Ra_ABS(x) ¥Ra_TIMES Ra_ABS(y)) ¥Ra_GT Ra_0
        (x ¥Ra_TIMES y)-->Stat4(Stat3,Stat2) ==> Stat5: Ra_ABS(x ¥Ra_TIMES y) = Ra_0
        (x,y)-->T530(Stat1,Stat5) ==> (Ra_ABS(x) ¥Ra_TIMES Ra_ABS(y)) = Ra_0
    (Ra_ABS(x) ¥Ra_TIMES Ra_ABS(y),Ra_0)-->T473 ==> false; Discharge ==> QED
--
-- The following theorem shows that the products $X ¥Ra_TIMES Y$,  $X ¥Ra_TIMES Za$
-- are equal only if either $X=Ra_0$ or $Y=Za$.
--
Theorem 532: [Cancellation rule for rational multiplication] ((X in Ra) & (Y in Ra) & (U in Ra) & (X /= Ra_0) & ((X ¥Ra_TIMES Y) = (X ¥Ra_TIMES U))) ¥imp (Y = U). Proof:
    Suppose_not(x,y,z) ==> (x in Ra) & (y in Ra) & (z in Ra) & (x /= Ra_0) & ((x ¥Ra_TIMES y) = (x ¥Ra_TIMES z)) & (y /= z)
        x-->T462 ==> (Recip(x) in Ra) & ((x ¥Ra_TIMES Recip(x)) = Ra_1)
        T451 ==> Ra_1 in Ra
        y-->T461 ==> ((y ¥Ra_TIMES Ra_1) = y)
        z-->T461 ==> ((z ¥Ra_TIMES Ra_1) = z)
        (y, Ra_1)-->T448 ==> ((y ¥Ra_TIMES Ra_1) = (Ra_1 ¥Ra_TIMES y))
        (z, Ra_1)-->T448 ==> ((z ¥Ra_TIMES Ra_1) = (Ra_1 ¥Ra_TIMES z))
        (x,Recip(x))-->T448 ==> ((x ¥Ra_TIMES Recip(x)) = (Recip(x) ¥Ra_TIMES x))
        (y,Recip(x),x)-->T456 ==> ((Recip(x) ¥Ra_TIMES (x ¥Ra_TIMES y)) = ((Recip(x) ¥Ra_TIMES x) ¥Ra_TIMES y))
        (z,Recip(x),x)-->T456 ==> ((Recip(x) ¥Ra_TIMES (x ¥Ra_TIMES z)) = ((Recip(x) ¥Ra_TIMES x) ¥Ra_TIMES z))
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that over rational numbers the reciprocal of a product equals the product of reciprocals.
--
Theorem 533: [The reciprocal of a rational product is the product of the reciprocals] ((X in Ra) & (Y in Ra) & (X /= Ra_0) & (Y /= Ra_0)) ¥imp (Recip(X ¥Ra_TIMES Y) = (Recip(X) ¥Ra_TIMES Recip(Y))). Proof:
    Suppose_not(x,y) ==> (x in Ra) & (y in Ra) & (x /= Ra_0) & (y /= Ra_0) & (Recip(x ¥Ra_TIMES y) /= (Recip(x) ¥Ra_TIMES Recip(y)))
        ALGEBRA ==> ((x ¥Ra_TIMES y) in Ra) & (Ra_1 in Ra)
        x-->T462 ==> (Recip(x) in Ra) & ((x ¥Ra_TIMES Recip(x)) = Ra_1)
        y-->T462 ==> (Recip(y) in Ra) & ((y ¥Ra_TIMES Recip(y)) = Ra_1)
        (x,y)-->T531 ==> (X ¥Ra_TIMES Y) /= Ra_0
        (x ¥Ra_TIMES y)-->T462 ==> (Recip(x ¥Ra_TIMES y) in Ra) & (((x ¥Ra_TIMES y) ¥Ra_TIMES Recip(x ¥Ra_TIMES y)) = Ra_1)
        ALGEBRA ==> (Recip(x) ¥Ra_TIMES Recip(y)) in Ra
--
-- We first prove that if both sides of the identity we are aiming at are multiplied by $(x ¥Ra_TIMES y)$,
-- then we get an identity.
--
        ALGEBRA ==> (((x ¥Ra_TIMES y) ¥Ra_TIMES (Recip(x) ¥Ra_TIMES Recip(y))) = ((x ¥Ra_TIMES Recip(x)) ¥Ra_TIMES (y ¥Ra_TIMES Recip(y)))) & (Ra_1 ¥Ra_TIMES Ra_1 = Ra_1) & ((Recip(x ¥Ra_TIMES y) ¥Ra_TIMES Ra_1) = Recip(x ¥Ra_TIMES y))
--
-- Both sides of this first intermediate identity can now be multiplied by $Recip(x ¥Ra_TIMES y)$.
-- This leads to a second intermediate identity.
--
        EQUAL ==> Recip(x ¥Ra_TIMES y) ¥Ra_TIMES ((x ¥Ra_TIMES y) ¥Ra_TIMES (Recip(x) ¥Ra_TIMES Recip(y))) = Recip(x ¥Ra_TIMES y)
        ALGEBRA ==> (Recip(x ¥Ra_TIMES y) ¥Ra_TIMES ((x ¥Ra_TIMES y) ¥Ra_TIMES (Recip(x) ¥Ra_TIMES Recip(y))) = (Recip(x ¥Ra_TIMES y) ¥Ra_TIMES (x ¥Ra_TIMES y)) ¥Ra_TIMES (Recip(x) ¥Ra_TIMES Recip(y))) & ((Recip(x ¥Ra_TIMES y) ¥Ra_TIMES (x ¥Ra_TIMES y)) = ((x ¥Ra_TIMES y) ¥Ra_TIMES Recip(x ¥Ra_TIMES y))) & ((Ra_1 ¥Ra_TIMES (Recip(x) ¥Ra_TIMES Recip(y))) = (Recip(x) ¥Ra_TIMES Recip(y)))
--
-- The left-hand side of the second intermediate identity is readily proved to equal
-- the left-hand side of the desired identity. The other side was already syntactically
-- identical to the right-hand side of the desired equality. This leads to the desired conclusion.
--
        EQUAL ==> (Recip(x) ¥Ra_TIMES Recip(y)) = Recip(x ¥Ra_TIMES y)
    Discharge ==> QED
--
Theorem 534: [Formula for the sum of two rational quotients] ((X in Ra) & (Y in Ra) & (U in Ra) & (V in Ra) & (X /= Ra_0) & (Y /= Ra_0)) ¥imp (((U ¥Ra_OVER X) ¥Ra_PLUS (V ¥Ra_OVER Y)) = (((Y ¥Ra_TIMES U) ¥Ra_PLUS (X ¥Ra_TIMES V)) ¥Ra_OVER (X ¥Ra_TIMES Y))). Proof:
    Suppose_not(x,y,u,v) ==> ((x in Ra) & (y in Ra) & (u in Ra) & (v in Ra) & (x /= Ra_0) & (y /= Ra_0)) & (((u ¥Ra_OVER x) ¥Ra_PLUS (v ¥Ra_OVER y)) /= (((y ¥Ra_TIMES u) ¥Ra_PLUS (x ¥Ra_TIMES v)) ¥Ra_OVER (x ¥Ra_TIMES y)))
--
-- For, if not, then we could find rational numbers $x,y,u,v$ constituting a counterexample.
-- Putting $u_o_x = (u ¥Ra_OVER x)$ and $v_o_y = (v ¥Ra_OVER y)$ for brevity, we have
--		$(x ¥Ra_TIMES y) ¥Ra_TIMES (u_o_x ¥Ra_PLUS v_o_y) = ((x ¥Ra_TIMES y) ¥Ra_TIMES u_o_x) ¥Ra_PLUS ((x ¥Ra_TIMES y) ¥Ra_TIMES v_o_y)$
-- by distributivity.
--
        x-->T462 ==> (Recip(x) in Ra) & ((x ¥Ra_TIMES Recip(x)) = Ra_1)
        y-->T462 ==> (Recip(y) in Ra) & ((y ¥Ra_TIMES Recip(y)) = Ra_1)
        ALGEBRA ==> ((u ¥Ra_TIMES Recip(x)) in Ra) &  ((x ¥Ra_TIMES y) in Ra) & ((x ¥Ra_TIMES v) in Ra) & ((y ¥Ra_TIMES u) in Ra) & ((((y ¥Ra_TIMES u) ¥Ra_PLUS (x ¥Ra_TIMES v))) in Ra)
        (v,Recip(y))-->T448 ==> (v ¥Ra_TIMES Recip(y)) in Ra
        Use_def(¥Ra_OVER) ==> (u ¥Ra_OVER x = u ¥Ra_TIMES Recip(x)) & (v ¥Ra_OVER y = v ¥Ra_TIMES Recip(y))
        Loc_def ==> u_o_x = u ¥Ra_OVER x
        Loc_def ==> v_o_y = v ¥Ra_OVER y
        EQUAL ==> (u_o_x in Ra) & (v_o_y in Ra)
        ALGEBRA ==> (((x ¥Ra_TIMES y) ¥Ra_TIMES (u_o_x ¥Ra_PLUS v_o_y)) = ((x ¥Ra_TIMES y) ¥Ra_TIMES u_o_x) ¥Ra_PLUS ((x ¥Ra_TIMES y) ¥Ra_TIMES v_o_y))
--
-- It follows that
--		$Recip(x ¥Ra_TIMES y) ¥Ra_TIMES ((x ¥Ra_TIMES y) ¥Ra_TIMES (u_o_v ¥Ra_PLUS v_o_y)) = Recip(x ¥Ra_TIMES y) ¥Ra_TIMES ((x ¥Ra_TIMES y) ¥Ra_TIMES u_o_x) ¥Ra_PLUS ((x ¥Ra_TIMES y) ¥Ra_TIMES v_o_y)$,
-- where the left-hand side simplifies into $((x ¥Ra_TIMES y) ¥Ra_TIMES (u_o_v ¥Ra_PLUS v_o_y))$ and the right-hand side into
--		$Recip(x ¥Ra_TIMES y) ¥Ra_TIMES ((y ¥Ra_TIMES u) ¥Ra_PLUS (x ¥Ra_TIMES v))$.
--
        (x,y)-->T531 ==> (x ¥Ra_TIMES y) /= Ra_0
        (x ¥Ra_TIMES y)-->T462 ==> (Recip(x ¥Ra_TIMES y) in Ra) & (((x ¥Ra_TIMES y) ¥Ra_TIMES Recip(x ¥Ra_TIMES y)) = Ra_1)
        ALGEBRA ==> ((Recip(x ¥Ra_TIMES y) ¥Ra_TIMES (x ¥Ra_TIMES y)) in Ra) & ((Recip(x ¥Ra_TIMES y) ¥Ra_TIMES (x ¥Ra_TIMES y)) = Ra_1)  & ((u_o_x ¥Ra_PLUS v_o_y) in Ra)
        ALGEBRA ==> ((Recip(x ¥Ra_TIMES y) ¥Ra_TIMES ((x ¥Ra_TIMES y) ¥Ra_TIMES (u_o_x ¥Ra_PLUS v_o_y))) = ((Recip(x ¥Ra_TIMES y) ¥Ra_TIMES (x ¥Ra_TIMES y)) ¥Ra_TIMES (u_o_x ¥Ra_PLUS v_o_y))) & ((Ra_1 ¥Ra_TIMES (u_o_x ¥Ra_PLUS v_o_y)) = (u_o_x ¥Ra_PLUS v_o_y))
        EQUAL ==> (Recip(x ¥Ra_TIMES y) ¥Ra_TIMES ((x ¥Ra_TIMES y) ¥Ra_TIMES (u_o_x ¥Ra_PLUS v_o_y))) = (u_o_x ¥Ra_PLUS v_o_y)
        ALGEBRA ==> (((x ¥Ra_TIMES y) ¥Ra_TIMES (u ¥Ra_TIMES Recip(x))) = ((x ¥Ra_TIMES Recip(x)) ¥Ra_TIMES (y ¥Ra_TIMES u))) & (((x ¥Ra_TIMES y) ¥Ra_TIMES (v ¥Ra_TIMES Recip(y))) = ((y ¥Ra_TIMES Recip(y)) ¥Ra_TIMES (x ¥Ra_TIMES v))) & ((Ra_1 ¥Ra_TIMES (y ¥Ra_TIMES u)) = (y ¥Ra_TIMES u)) & ((Ra_1 ¥Ra_TIMES (x ¥Ra_TIMES v)) = (x ¥Ra_TIMES v))
--        EQUAL ==> (((x ¥Ra_TIMES y) ¥Ra_TIMES (u ¥Ra_TIMES Recip(x))) ¥Ra_PLUS ((x ¥Ra_TIMES y) ¥Ra_TIMES (v ¥Ra_TIMES Recip(y)))) = ((y ¥Ra_TIMES u) ¥Ra_PLUS (x ¥Ra_TIMES v))
--        EQUAL ==> (((x ¥Ra_TIMES y) ¥Ra_TIMES u_o_x) ¥Ra_PLUS ((x ¥Ra_TIMES y) ¥Ra_TIMES v_o_y)) = ((y ¥Ra_TIMES u) ¥Ra_PLUS (x ¥Ra_TIMES v))
        EQUAL ==> (u_o_x ¥Ra_PLUS v_o_y) = (Recip(x ¥Ra_TIMES y) ¥Ra_TIMES ((y ¥Ra_TIMES u) ¥Ra_PLUS (x ¥Ra_TIMES v)))
        ALGEBRA ==> (Recip(x ¥Ra_TIMES y) ¥Ra_TIMES ((y ¥Ra_TIMES u) ¥Ra_PLUS (x ¥Ra_TIMES v))) = (((y ¥Ra_TIMES u) ¥Ra_PLUS (x ¥Ra_TIMES v)) ¥Ra_TIMES Recip(x ¥Ra_TIMES y))
--
-- In view of the definition of the rational-reciprocal operation, this leads to a contradiction,
-- proving our theorem.
--
        Use_def(¥Ra_OVER) ==> (u_o_x ¥Ra_PLUS v_o_y) = (((y ¥Ra_TIMES u) ¥Ra_PLUS (x ¥Ra_TIMES v)) ¥Ra_OVER (x ¥Ra_TIMES y))
    EQUAL ==> false; Discharge ==> QED
--
-- Here is an obvious corollary of the preceding theorem: the difference of reciprocals of two rational numbers
-- equals the difference of the operands divided by their product.
--
Theorem 535: ((X in Ra) & (Y in Ra) & (X /= Ra_0) & (Y /= Ra_0)) ¥imp ((Recip(X) ¥Ra_MINUS Recip(Y)) = ((Y ¥Ra_MINUS X) ¥Ra_OVER (X ¥Ra_TIMES Y))). Proof:
    Suppose_not(x,y) ==> (x in Ra) & (y in Ra) & (x /= Ra_0) & (y /= Ra_0) & ((Recip(x) ¥Ra_MINUS Recip(y)) /= ((y ¥Ra_MINUS x) ¥Ra_OVER (x ¥Ra_TIMES y)))
        Use_def(¥Ra_MINUS) ==> ((Recip(x) ¥Ra_MINUS Recip(y)) = (Recip(x) ¥Ra_PLUS Ra_Rev(Recip(y)))) & ((y ¥Ra_MINUS x) = (y ¥Ra_PLUS Ra_Rev(x)))
        x-->T462 ==> (Recip(x) in Ra)
        Suppose ==> (Ra_1 ¥Ra_OVER x) /= Recip(x)
            Use_def(¥Ra_OVER) ==> (Ra_1 ¥Ra_TIMES Recip(x)) /= Recip(x)
        ALGEBRA ==> false; Discharge ==> (Ra_1 ¥Ra_OVER x) = Recip(x)
        y-->T462 ==> (Recip(y) in Ra)
        Suppose ==> (Ra_1 ¥Ra_OVER y) /= Recip(y)
            Use_def(¥Ra_OVER) ==> (Ra_1 ¥Ra_TIMES Recip(y)) /= Recip(y)
        ALGEBRA ==> false; Discharge ==> (Ra_1 ¥Ra_OVER y) = Recip(y)
        ALGEBRA ==> (Ra_1 in Ra) & ((y ¥Ra_TIMES Ra_1) = y) & ((x ¥Ra_TIMES Ra_1) = x) &  (Recip(y) = (Recip(y) ¥Ra_TIMES Ra_1))
        Ra_1-->T452 ==> (Ra_Rev(Ra_1) in Ra)
        (Ra_Rev(Ra_1),Recip(y))-->T448 ==> ((Ra_Rev(Ra_1) ¥Ra_TIMES Recip(y)) in Ra) & ((Recip(y) ¥Ra_TIMES Ra_Rev(Ra_1)) = (Ra_Rev(Ra_1) ¥Ra_TIMES Recip(y)))
        Ra_1-->T494 ==> (Ra_Rev(Ra_Rev(Ra_1)) = Ra_1)
        EQUAL ==> (Recip(y) = (Recip(y) ¥Ra_TIMES Ra_Rev(Ra_Rev(Ra_1))))
        (Recip(y),Ra_Rev(Ra_1))-->T485 ==> Recip(y) = Ra_Rev(Recip(y) ¥Ra_TIMES Ra_Rev(Ra_1))
        EQUAL ==> Ra_Rev(Recip(y)) = Ra_Rev(Ra_Rev(Ra_Rev(Ra_1) ¥Ra_TIMES Recip(y)))
        (Ra_Rev(Ra_1) ¥Ra_TIMES Recip(y))-->T494 ==> Ra_Rev(Recip(y)) = (Ra_Rev(Ra_1) ¥Ra_TIMES Recip(y))
        Use_def(¥Ra_OVER) ==> Ra_Rev(Recip(y)) = (Ra_Rev(Ra_1) ¥Ra_OVER y)
        EQUAL ==> (Recip(x) ¥Ra_MINUS Recip(y)) = ((Ra_1 ¥Ra_OVER x) ¥Ra_PLUS (Ra_Rev(Ra_1) ¥Ra_OVER y))
        (x,y,Ra_1,Ra_Rev(Ra_1))-->T534 ==> (Recip(x) ¥Ra_MINUS Recip(y)) = (((y ¥Ra_TIMES Ra_1) ¥Ra_PLUS (x ¥Ra_TIMES Ra_Rev(Ra_1))) ¥Ra_OVER (x ¥Ra_TIMES y))
        (x,Ra_1)-->T485 ==> (x ¥Ra_TIMES Ra_Rev(Ra_1)) = Ra_Rev(x ¥Ra_TIMES Ra_1)
        EQUAL ==> (Recip(x) ¥Ra_MINUS Recip(y)) = ((y ¥Ra_PLUS Ra_Rev(x)) ¥Ra_OVER (x ¥Ra_TIMES y))
    EQUAL ==> false; Discharge ==> QED
--
-- Let us also show that the absolute value of the reciprocal equals the reciprocal of the absolute value.
--
Theorem 536: [The absolute value of the reciprocal equals the reciprocal of the absolute value] ((X in Ra) & (X /= Ra_0)) ¥imp (Ra_ABS(Recip(X)) = Recip(Ra_ABS(X))). Proof:
    Suppose_not(x) ==> (x in Ra) & (x /= Ra_0) & (Ra_ABS(Recip(x)) /= Recip(Ra_ABS(x)))
        x-->T462 ==> (Recip(x) in Ra) & ((x ¥Ra_TIMES Recip(x)) = Ra_1)
        x-->T527 ==> Ra_ABS(x) in Ra
        (x,Recip(x))-->T530 ==> (Ra_ABS(x) ¥Ra_TIMES Ra_ABS(Recip(x))) = Ra_ABS(x ¥Ra_TIMES Recip(x))
        T465 ==> Ra_is_nonneg(Ra_1)
        T525 ==> Stat1: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &
			Stat2: (FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0)))
        Ra_1-->Stat1 ==> Ra_ABS(Ra_1) = Ra_1
        x-->Stat2 ==> Ra_ABS(x) /= Ra_0
        (Ra_ABS(x))-->T462 ==> (Recip(Ra_ABS(x)) in Ra) & ((Ra_ABS(x) ¥Ra_TIMES Recip(Ra_ABS(x))) = Ra_1)
        (Recip(Ra_ABS(x)))-->T461 ==> (Recip(Ra_ABS(x)) ¥RA_TIMES Ra_1) = Recip(Ra_ABS(x))
        EQUAL ==> (Recip(Ra_ABS(x)) ¥RA_TIMES (Ra_ABS(x) ¥Ra_TIMES Ra_ABS(Recip(x)))) = Recip(Ra_ABS(x))
        (Recip(x))-->T527 ==> Ra_ABS(Recip(x)) in Ra
        (Ra_ABS(Recip(x)),Recip(Ra_ABS(x)),Ra_ABS(x))-->T456 ==> ((Recip(Ra_ABS(x)) ¥RA_TIMES Ra_ABS(x)) ¥Ra_TIMES Ra_ABS(Recip(x))) = Recip(Ra_ABS(x))
        (Recip(Ra_ABS(x)),Ra_ABS(x))-->T448 ==> ((Recip(Ra_ABS(x)) ¥RA_TIMES Ra_ABS(x)) in Ra) & ((Recip(Ra_ABS(x)) ¥RA_TIMES Ra_ABS(x)) = Ra_1)
        (Recip(Ra_ABS(x)) ¥RA_TIMES Ra_ABS(x),Ra_ABS(Recip(x)))-->T448 ==> (Ra_ABS(Recip(x)) ¥Ra_TIMES (Recip(Ra_ABS(x)) ¥RA_TIMES Ra_ABS(x))) = Recip(Ra_ABS(x))
        EQUAL ==> (Ra_ABS(Recip(x)) ¥Ra_TIMES Ra_1) = Recip(Ra_ABS(x))
    (Ra_ABS(Recip(x)))-->T461 ==> false; Discharge ==> QED
--
--
Theorem 537: ((X in Ra) & (Y in Ra)) ¥imp (Ra_ABS(X ¥Ra_MINUS Y) = Ra_ABS(Y ¥Ra_MINUS X)). Proof:
Suppose_not(x,y) ==> AUTO
	T525 ==> Stat1: (FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x))) &
		Stat2: (FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_Rev(x ¥Ra_PLUS Ra_Rev(y)) = (y ¥Ra_PLUS Ra_Rev(x))))
	Use_def(¥Ra_MINUS) ==> Stat3: Ra_ABS(x ¥Ra_PLUS Ra_Rev(y)) /= Ra_ABS(y ¥Ra_PLUS Ra_Rev(x))
        y-->T452 ==> Ra_Rev(y) in Ra
	(x,Ra_Rev(y))-->T445 ==> Stat4: (x ¥Ra_PLUS Ra_Rev(y)) in Ra
	(x ¥Ra_PLUS Ra_Rev(y))-->Stat1(Stat4*) ==> Ra_ABS(Ra_Rev(x ¥Ra_PLUS Ra_Rev(y))) = Ra_ABS(x ¥Ra_PLUS Ra_Rev(y))
        (x,y)-->Stat2 ==> Ra_Rev(x ¥Ra_PLUS Ra_Rev(y)) = (y ¥Ra_PLUS Ra_Rev(x))
EQUAL(Stat3) ==> false; Discharge ==> QED
--
Theorem 538: ((X in Ra) & (Y in Ra) & (A in Ra) & (B in Ra) & (Ra_ABS(X) ¥Ra_GT A) & (Ra_ABS(Y) ¥Ra_GT B) & (A ¥Ra_GT Ra_0) & (B ¥Ra_GT Ra_0)) ¥imp (Ra_ABS(Recip(X) ¥Ra_MINUS Recip(Y)) ¥Ra_LE (Ra_ABS(X ¥Ra_MINUS Y) ¥Ra_TIMES (Recip(A) ¥Ra_TIMES Recip(B)))). Proof:
Suppose_not(x,y,a,b) ==> Stat1: (x in Ra) & (y in Ra) & (a in Ra) & (b in Ra) & (Ra_ABS(x) ¥Ra_GT a) & (Ra_ABS(y) ¥Ra_GT b) & (a ¥Ra_GT Ra_0) & (b ¥Ra_GT Ra_0) & (not(Ra_ABS(Recip(x) ¥Ra_MINUS Recip(y)) ¥Ra_LE (Ra_ABS(x ¥Ra_MINUS y) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b)))))
	T525 ==> Stat2: (FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0)))
        T451 ==> Ra_0 in Ra
	x-->T527 ==> Stat3: Ra_ABS(x) in Ra
	y-->T527 ==> Stat4: Ra_ABS(y) in Ra
	(Ra_ABS(x),a,Ra_0)-->T511 ==> Stat5: Ra_ABS(x) ¥Ra_GT Ra_0
	(Ra_ABS(y),b,Ra_0)-->T511 ==> Stat6: Ra_ABS(y) ¥Ra_GT Ra_0
--
--	Use_def(¥Ra_GT)(Stat1,Stat5*) ==> Stat7: (Ra_ABS(x) /= Ra_0) & (Ra_ABS(y) /= Ra_0) & (a /= Ra_0) & (b /= Ra_0)
(Ra_ABS(x),Ra_0)-->T473(Stat5,Stat5*) ==> Stat7: Ra_ABS(x) /= Ra_0
(Ra_ABS(y),Ra_0)-->T473(Stat6,Stat6*) ==> Stat8: Ra_ABS(y) /= Ra_0
(a,Ra_0)-->T473(Stat1,Stat1*) ==> Stat9: a /= Ra_0
(b,Ra_0)-->T473(Stat1,Stat1*) ==> Stat10: b /= Ra_0
	Suppose ==> (x = Ra_0) or (y = Ra_0)
		x-->Stat2(*) ==> x /= Ra_0
		y-->Stat2(*) ==> y /= Ra_0
	Discharge ==> Stat11: (x /= Ra_0) & (y /= Ra_0)
	(Ra_ABS(x),a)-->T518(Stat1,Stat5,Stat3*) ==> Stat12: Recip(a) ¥Ra_GT Recip(Ra_ABS(x))
	(Ra_ABS(y),b)-->T518(Stat1,Stat6,Stat4*) ==> Recip(b) ¥Ra_GT Recip(Ra_ABS(y))
	a-->T462(Stat9,Stat1*) ==> Recip(a) in Ra
	b-->T462(Stat10,Stat1*) ==> Recip(b) in Ra
	(Recip(a),Recip(b))-->T448(Stat12*) ==> (Recip(a) ¥Ra_TIMES Recip(b)) in Ra
	(Ra_ABS(x))-->T462(Stat7,Stat3*) ==> Recip(Ra_ABS(x)) in Ra
	(Ra_ABS(y))-->T462(Stat8,Stat4*) ==> Recip(Ra_ABS(y)) in Ra
	(Recip(b),Recip(Ra_ABS(y)))-->T473(Stat6*) ==> Recip(b) ¥Ra_GE Recip(Ra_ABS(y))
        (Ra_ABS(x))-->T491(Stat3,Stat5*) ==> Recip(Ra_ABS(x)) ¥Ra_GT Ra_0
        (Ra_ABS(y))-->T491(Stat4,Stat6*) ==> Recip(Ra_ABS(y)) ¥Ra_GT Ra_0
	(Recip(a),Recip(Ra_ABS(x)),Recip(b),Recip(Ra_ABS(y)))-->T517(Stat12*) ==> (Recip(a) ¥Ra_TIMES Recip(b)) ¥Ra_GT (Recip(Ra_ABS(x)) ¥Ra_TIMES Recip(Ra_ABS(y)))
	(Ra_ABS(x),Ra_ABS(y))-->T533(Stat7,Stat8,Stat3,Stat4*) ==> Stat13: (Recip(Ra_ABS(x)) ¥Ra_TIMES Recip(Ra_ABS(y))) = Recip(Ra_ABS(x) ¥Ra_TIMES Ra_ABS(y))
	(x,y)-->T530(Stat1,Stat1*) ==> (Ra_ABS(x ¥Ra_TIMES y) = (Ra_ABS(x) ¥Ra_TIMES Ra_ABS(y)))
	EQUAL(Stat5) ==> (Recip(a) ¥Ra_TIMES Recip(b)) ¥Ra_GT Recip(Ra_ABS(x ¥Ra_TIMES y))
	((Recip(a) ¥Ra_TIMES Recip(b)),Recip(Ra_ABS(x ¥Ra_TIMES y)))-->T473(Stat13*) ==> (Recip(a) ¥Ra_TIMES Recip(b)) ¥Ra_GE Recip(Ra_ABS(x ¥Ra_TIMES y))
	ALGEBRA(Stat1,Stat1) ==> Stat14: ((x ¥Ra_MINUS y) in Ra) & ((x ¥Ra_TIMES y) in Ra)
 	(x ¥Ra_MINUS y)-->T527(Stat14*) ==> (Ra_ABS(x ¥Ra_MINUS y) in Ra) & (Ra_ABS(x ¥Ra_MINUS y) ¥Ra_GE Ra_0)
	(Ra_ABS(x ¥Ra_MINUS y),Ra_ABS(x ¥Ra_MINUS y))-->T473(Stat14*) ==> Ra_ABS(x ¥Ra_MINUS y) ¥Ra_GE Ra_ABS(x ¥Ra_MINUS y)
	(x ¥Ra_TIMES y)-->T527(Stat14*) ==> Stat15: (Ra_ABS(x ¥Ra_TIMES y) in Ra) & (Ra_ABS(x ¥Ra_TIMES y) ¥Ra_GE Ra_0)
--	Use_def(¥Ra_GT)(Stat5,Stat6*) ==> (Ra_ABS(x) /= Ra_0) & (Ra_ABS(y) /= Ra_0)
	(Ra_ABS(x),Ra_0)-->T473(Stat5,Stat5*) ==> Ra_ABS(x) /= Ra_0
	(Ra_ABS(y),Ra_0)-->T473(Stat6,Stat6*) ==> Ra_ABS(y) /= Ra_0
	(Ra_ABS(x),Ra_ABS(y))-->T531(Stat3*) ==> Ra_ABS(x ¥Ra_TIMES y) /= Ra_0
	(Ra_ABS(x ¥Ra_TIMES y),Ra_0)-->T473(Stat15*) ==> Ra_ABS(x ¥Ra_TIMES y) ¥Ra_GT Ra_0
	(Ra_ABS(x ¥Ra_TIMES y))-->T491(Stat15*) ==> Recip(Ra_ABS(x ¥Ra_TIMES y)) ¥Ra_GT Ra_0
	(Recip(Ra_ABS(x ¥Ra_TIMES y)),Ra_0)-->T473(Stat15*) ==> Recip(Ra_ABS(x ¥Ra_TIMES y)) ¥Ra_GE Ra_0
	(Ra_ABS(x ¥Ra_TIMES y))-->T462(Stat15*) ==> Recip(Ra_ABS(x ¥Ra_TIMES y)) in Ra
	(Ra_ABS(x ¥Ra_MINUS y),Ra_ABS(x ¥Ra_MINUS y),Recip(a) ¥Ra_TIMES Recip(b),Recip(Ra_ABS(x ¥Ra_TIMES y)))-->T516(Stat12*) ==> ((Ra_ABS(x ¥Ra_MINUS y)) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))) ¥Ra_GE
((Ra_ABS(x ¥Ra_MINUS y)) ¥Ra_TIMES Recip(Ra_ABS(x ¥Ra_TIMES y)))
	(x ¥Ra_TIMES y)-->Stat2(Stat14*) ==> (x ¥Ra_TIMES y) /= Ra_0
	(x ¥Ra_TIMES y)-->T536(Stat14*) ==> Recip(Ra_ABS(x ¥Ra_TIMES y)) = Ra_ABS(Recip(x ¥Ra_TIMES y))
	(x ¥Ra_TIMES y)-->T462(Stat14*) ==> Recip(x ¥Ra_TIMES y) in Ra
	(x ¥Ra_MINUS y,Recip(x ¥Ra_TIMES y))-->T530(Stat14*) ==> (Ra_ABS(x ¥Ra_MINUS y) ¥Ra_TIMES Ra_ABS(Recip(x ¥Ra_TIMES y))) = Ra_ABS((x ¥Ra_MINUS y) ¥Ra_TIMES Recip(x ¥Ra_TIMES y))
	EQUAL(Stat14) ==> Stat16: ((Ra_ABS(x ¥Ra_MINUS y)) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))) ¥Ra_GE Ra_ABS((x ¥Ra_MINUS y) ¥Ra_TIMES Recip(x ¥Ra_TIMES y))
	Use_def(¥Ra_OVER)(Stat16*) ==> ((Ra_ABS(x ¥Ra_MINUS y)) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))) ¥Ra_GE Ra_ABS((x ¥Ra_MINUS y) ¥Ra_OVER (x ¥Ra_TIMES y))
	y-->T462(Stat1,Stat11*) ==> Stat17: Recip(y) in Ra
	x-->T462(Stat1,Stat11*) ==> Stat18: Recip(x) in Ra
	(y,x)-->T535(Stat1,Stat11*) ==> (Recip(y) ¥Ra_MINUS Recip(x)) = ((x ¥Ra_MINUS y) ¥Ra_OVER (y ¥Ra_TIMES x))
        ALGEBRA(Stat1,Stat17,Stat18*) ==> Stat19: ((y ¥Ra_TIMES x) = (x ¥Ra_TIMES y)) & ((Recip(y) ¥Ra_MINUS Recip(x)) in Ra)
        EQUAL(Stat11) ==> Stat20: ((Ra_ABS(x ¥Ra_MINUS y)) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))) ¥Ra_GE Ra_ABS(Recip(y) ¥Ra_MINUS Recip(x))
        (Ra_ABS(Recip(y) ¥Ra_MINUS Recip(x)),((Ra_ABS(x ¥Ra_MINUS y)) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))))-->T473(Stat20*) ==> Stat21: Ra_ABS(Recip(y) ¥Ra_MINUS Recip(x)) ¥Ra_LE ((Ra_ABS(x ¥Ra_MINUS y)) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b)))
--
-- Since the absolute value of a difference equals the absolute value of the difference
-- with arguments interchanged, we can discharge the pending assumption and so complete
-- the present proof.
--
	(Recip(x),Recip(y))-->T537(Stat17,Stat18*) ==> Stat22: Ra_ABS(Recip(x) ¥Ra_MINUS Recip(y)) = Ra_ABS(Recip(y) ¥Ra_MINUS Recip(x))
EQUAL(Stat21,Stat22,Stat1) ==> false; Discharge ==> QED
--
--
-- ************************************************************************************************
--								Section 14: Real numbers
-- ************************************************************************************************
--
Def 46: [The set of rational sequences] RaSeq := {f: f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}
Def 47: [The constant 0 rational sequence] Ra0Seq := Za ¥PROD {Ra_0}
Def 48: [The constant 1 rational sequence] Ra1Seq := Za ¥PROD {Ra_1}
Def 49: [Pointwise sum of rational sequences] Def(X ¥Ras_PLUS Y) := {[car(p),cdr(p) ¥Ra_PLUS (Y~[car(p)])]: p in X}
Def 50: [Pointwise additive inverse of rational sequence] Ras_Rev(X) := {[car(p),Ra_Rev(cdr(p))]: p in X}
Def 51: [Pointwise absolute value of rational sequence] Ras_ABS(X) := {[car(p),Ra_ABS(cdr(p))]: p in X}
Def 52: [Pointwise difference of rational sequences] Def(X ¥Ras_MINUS Y) := X ¥Ras_PLUS Ras_Rev(Y)
Def 53: [Product of rational sequences] Def(X ¥Ras_TIMES Y) := {[car(p),cdr(p) ¥Ra_TIMES (Y~[car(p)])]: p in X}
-- Def 54: [Pointwise reciprocal of rational sequence] Ras_Recip(X) := {[#{j: j in i | (X~[j]) /= Ra_0}, Recip(X~[i])]: i in Za | (X~[i]) /= Ra_0}
Def 54: [Pointwise reciprocal of rational sequence] Ras_Recip(X) := shifted_seq({[i, Recip(X~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (X~[i]) /= Ra_0)}))
Def 55: [Pointwise quotient of rational sequences] Def(X ¥Ras_OVER Y) := X ¥Ras_TIMES Ras_Recip(Y)
Def 56: [Rational Cauchy sequences] RaCauchy := {f: f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
Def 57: [Equivalence of rational sequences] Ra_eqseq(F,G) := (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in domain(F) | Ra_ABS((F~[x]) ¥Ra_MINUS (G~[x])) ¥Ra_GT eps}))
--
-- It is obvious that every Rational Cauchy sequence is a rational sequence
--
Theorem 539: [Every Rational Cauchy sequence is a rational sequence] RaCauchy ¥incin RaSeq. Proof:
Suppose_not ==> Stat1: not(RaCauchy ¥incin RaSeq)
	f-->Stat1 ==> (f in RaCauchy) & (f notin RaSeq)
	Use_def(RaCauchy) ==> Stat2: f in {g in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps }))}
()-->Stat2 ==> f in RaSeq; Discharge ==> QED
--
-- Moreover, the range of a rational sequence is plainly included in the set of rationals;
-- its domain is the set of integers, and each of its image elements is a rational.
--
Theorem 540: [The range of a rational sequence is included in the set of rationals] (F in RaSeq) ¥imp ((domain(F) = Za) & Svm(F) & (range(F) ¥incin Ra) & ((X in Za) ¥imp (F~[X] in Ra))). Proof:
Suppose_not(f,x) ==> AUTO
	Use_def(RaSeq) ==> Stat1: f in {g ¥incin (Za ¥PROD Ra) | (domain(g) = Za) & Svm(g)}
	()-->Stat1 ==> (f ¥incin (Za ¥PROD Ra)) & Svm(f) & (domain(f) = Za)
	(f,Za,Ra)-->T141 ==> (range(f) ¥incin Ra) & (x in Za) & (f~[x] notin Ra)
--
-- For, assuming $f,x$ to be a counterexample, we are led to a contradiction as follows.
-- From Theorem 141, we immediately get that the only conclusion of the theorem's assertion
-- which can be false is the implication $((x in Za) ¥imp (f~[x] in Ra))$.
-- However, the only remaining possibility is discarded immediately thanks to Theorem 71.
--
(x,f)-->T71(*) ==> false; Discharge ==> QED
--
--
--
Theorem 541: [Reformulation of condition for sequence equivalence] ({F,G} ¥incin RaSeq) ¥imp (Ra_eqseq(F,G) ¥eq (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in Za | Ra_ABS((F~[x]) ¥Ra_MINUS (G~[x])) ¥Ra_GT eps}))). Proof:
Suppose_not(f,g) ==> AUTO
	Use_def(Ra_eqseq) ==> Ra_eqseq(f,g) ¥eq (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in domain(f) | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps}))
	f-->T540 ==> domain(f) = Za
EQUAL ==> false; Discharge ==> QED
--

Theorem 542: [Condition for rational sequence equality] (FORALL n in Za | ((F in RaSeq) & (G in RaSeq) & (F~[n] = G~[n]))) ¥imp (F = G). Proof:
Suppose_not(f,g) ==> AUTO
	T212(*) ==> Za /= 0
	Suppose ==> Stat1: not(FORALL h in RaSeq | ((domain(h) = Za) & Svm(h)))
		h--> Stat1 ==> (h in RaSeq) & (not((domain(h) = Za) & Svm(h)))
		Use_def(RaSeq) ==> Stat2: h in {f: f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}
		f1-->Stat2 ==> (h = f1) & (domain(f1) = Za) & Svm(f1)
	EQUAL ==> false; Discharge ==> (FORALL h in RaSeq | ((domain(h) = Za) & Svm(h)))
(Za,RaSeq)-->T338(*) ==> false; Discharge ==> QED
--
--
THEORY pointwiseU(fp,h,d,r,uop(X))
	Svm(fp) & (domain(fp) = d) & (range(fp) ¥incin r)
	(FORALL x in r | uop(x) in r)
	h = {[car(p),uop(cdr(p))]: p in fp}
END pointwiseU
--
ENTER_THEORY pointwiseU
--
Theorem pointwiseU.1: h = {[u,uop(fp~[u])]: u in d}. Proof:
    Suppose_not ==> h /= {[u,uop(fp~[u])]: u in d}
	Assump ==> h = {[car(p),uop(cdr(p))]: p in fp}
	ELEM ==> {[car(p),uop(cdr(p))]: p in fp} /= {[u,uop(fp~[u])]: u in d}
	Assump ==> Svm(fp) & (domain(fp) = d) & (range(fp) ¥incin r)
	fp-->T72 ==> fp = {[w,fp~[w]]: w in domain(fp)}
	EQUAL ==> {[car(p),uop(cdr(p))]: p in fp} = {[car(p),uop(cdr(p))]: p in {[w,fp~[w]]: w in d}}
	SIMPLF ==> Stat1: {[car([w,fp~[w]]),uop(cdr([w,fp~[w]]))]: w in d} /= {[u,uop(fp~[u])]: u in d}
	c-->Stat1 ==> (c in {[car([w,fp~[w]]),uop(cdr([w,fp~[w]]))]: w in d}) ¥eq (c notin {[u,uop(fp~[u])]: u in d})
	Suppose ==> Stat2: (c in {[car([w,fp~[w]]),uop(cdr([w,fp~[w]]))]: w in d}) & (c notin {[u,uop(fp~[u])]: u in d})
	(w,w)-->Stat2(Stat2) ==> false; Discharge ==> Stat3: (c in {[u,uop(fp~[u])]: u in d}) & (c notin {[car([w,fp~[w]]),uop(cdr([w,fp~[w]]))]: w in d})
    (u,u)-->Stat3(Stat3) ==> fail; Discharge ==> QED
--
Theorem pointwiseU.2: Svm(h) & (domain(h) = d) & (range(h) ¥incin r). Proof:
    Suppose_not ==> (not Svm(h)) or (domain(h) /= d) or (not(range(h) ¥incin r))
	TpointwiseU.1 ==> h = {[u,uop(fp~[u])]: u in d}
	APPLY() fcn_symbol(f(u)->uop(fp~[u]), g->h, s->d) ==> (domain(h) = d) & (range(h) = {uop(fp~[u]): u in d}) & Svm(h)
	ELEM ==> Stat1: not({uop(fp~[u]): u in d} ¥incin r)
	c-->Stat1 ==> Stat2: (c in {uop(fp~[u]): u in d}) & (c notin r)
	x-->Stat2 ==> (x in d) & (c = uop(fp~[x]))
	Assump ==> Svm(fp) & (domain(fp) = d) & (range(fp) ¥incin r)
	fp-->T72 ==> fp = {[w,fp~[w]]: w in domain(fp)}
	TELEM ==> range({[w,fp~[w]]: w in domain(fp)}) = {fp~[w]: w in domain(fp)}
	EQUAL ==> range(fp) = {fp~[w]: w in domain(fp)}
	EQUAL ==> Stat3: range(fp) = {fp~[w]: w in d}
	Suppose ==> Stat4: fp~[x] notin range(fp)
		(Stat3,Stat4)ELEM ==> Stat5: fp~[x] notin {fp~[w]: w in d}
	x-->Stat5 ==> false; Discharge ==> fp~[x] in r
	Assump ==> Stat6: (FORALL x in r | uop(x) in r)
    (fp~[x])-->Stat6 ==> false; Discharge ==> QED
--
Theorem pointwiseU.3: (FORALL x in d | h~[x] = uop(fp~[x])). Proof:
	Suppose_not ==> Stat1: AUTO
	x-->Stat1 ==> (x in d) & (h~[x] /= uop(fp~[x]))
	TpointwiseU.1 ==> h = {[u,uop(fp~[u])]: u in d}
	APPLY() fcn_symbol(f(x)->uop(fp~[x]),g->h,s->d) ==> Stat2: (FORALL x | h~[x] = if x in d then uop(fp~[x]) else 0 end if)
	x-->Stat2 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY pointwiseU
--
--THEORY pointwiseU(fp,h,d,r,uop(X))
--	Svm(fp) & (domain(fp) = d) & (range(fp) ¥incin r)
--	(FORALL x in r, y in r | bop(x,y) in r)
--	h = {[car(p),uop(cdr(p))]: p in fp}
--==>
--	h = {[u,uop(fp~[u])]: u in d}
--	Svm(h) & (domain(h) = d) & (range(h) ¥incin r)
--  (FORALL x in d | h~[x] = uop(fp~[x]))
--END pointwiseU
--
--
THEORY pointwise(fq,fp,h,d,r,bop(X,Y))
	Svm(fq) & (domain(fq) = d) & (range(fq) ¥incin r)
	Svm(fp) & (domain(fp) = d) & (range(fp) ¥incin r)
	(FORALL x in r, y in r | bop(x,y) in r)
	h = {[car(p),bop(cdr(p),fp~[car(p)])]: p in fq}
END pointwise
--
ENTER_THEORY pointwise
--
Theorem pointwise.1: h = {[u,bop(fq~[u],fp~[u])]: u in d}. Proof:
    Suppose_not ==> h /= {[u,bop(fq~[u],fp~[u])]: u in d}
        Assump ==> h = {[car(p),bop(cdr(p),fp~[car(p)])]: p in fq}
        ELEM ==> {[car(p),bop(cdr(p),fp~[car(p)])]: p in fq} /= {[u,bop(fq~[u],fp~[u])]: u in d}
        Assump ==> Svm(fq) & (domain(fq) = d) & (range(fq) ¥incin r)
        fq-->T72 ==> fq = {[w,fq~[w]]: w in domain(fq)}
        EQUAL ==> {[car(p),bop(cdr(p),fp~[car(p)])]: p in fq} = {[car(p),bop(cdr(p),fp~[car(p)])]: p in {[w,fq~[w]]: w in d}}
        SIMPLF ==> Stat1: {[car([w,fq~[w]]),bop(cdr([w,fq~[w]]),fp~[car([w,fq~[w]])])]: w in d} /= {[u,bop(fq~[u],fp~[u])]: u in d}
        c-->Stat1 ==> (c in {[car([w,fq~[w]]),bop(cdr([w,fq~[w]]),fp~[car([w,fq~[w]])])]: w in d}) ¥eq (c notin {[u,bop(fq~[u],fp~[u])]: u in d})
        Suppose ==> Stat2: (c in {[car([w,fq~[w]]),bop(cdr([w,fq~[w]]),fp~[car([w,fq~[w]])])]: w in d}) & (c notin {[u,bop(fq~[u],fp~[u])]: u in d})
        (w,w)-->Stat2(Stat2) ==> false; Discharge ==> Stat3: (c in {[u,bop(fq~[u],fp~[u])]: u in d}) & (c notin {[car([w,fq~[w]]),bop(cdr([w,fq~[w]]),fp~[car([w,fq~[w]])])]: w in d})
    (u,u)-->Stat3(Stat3) ==> fail; Discharge ==> QED
--
Theorem pointwise.2: Svm(h) & (domain(h) = d) & (range(h) ¥incin r). Proof:
    Suppose_not ==> (not Svm(h)) or (domain(h) /= d) or (not(range(h) ¥incin r))
        Tpointwise.1 ==> h = {[u,bop(fq~[u],fp~[u])]: u in d}
        APPLY() fcn_symbol(f(u)->bop(fq~[u],fp~[u]), g->h, s->d) ==> (domain(h) = d) & (range(h) = {bop(fq~[u],fp~[u]): u in d}) & Svm(h)
        ELEM ==> Stat1: not({bop(fq~[u],fp~[u]): u in d} ¥incin r)
        c-->Stat1 ==> Stat2: (c in {bop(fq~[u],fp~[u]): u in d}) & (c notin r)
        x-->Stat2 ==> (x in d) & (c = bop(fq~[x],fp~[x]))
        Assump ==> Svm(fq) & (domain(fq) = d) & (range(fq) ¥incin r)
        Assump ==> Svm(fp) & (domain(fp) = d) & (range(fp) ¥incin r)
        fq-->T72 ==> fq = {[w,fq~[w]]: w in domain(fq)}
        TELEM ==> range({[w,fq~[w]]: w in domain(fq)}) = {fq~[w]: w in domain(fq)}
        EQUAL ==> range(fq) = {fq~[w]: w in domain(fq)}
        fp-->T72 ==> fp = {[w,fp~[w]]: w in domain(fp)}
        TELEM ==> range({[w,fp~[w]]: w in domain(fp)}) = {fp~[w]: w in domain(fp)}
        EQUAL ==> range(fp) = {fp~[w]: w in domain(fp)}
        EQUAL ==> Stat3: range(fq) = {fq~[w]: w in d}
        EQUAL ==> Stat4: range(fp) = {fp~[w]: w in d}
        Suppose ==> Stat5: fq~[x] notin range(fq)
            (Stat3,Stat5)ELEM ==> Stat6: fq~[x] notin {fq~[w]: w in d}
        x-->Stat6 ==> false; Discharge ==> fq~[x] in r
        Suppose ==> Stat7: fp~[x] notin range(fp)
            (Stat4,Stat7)ELEM ==> Stat8: fp~[x] notin {fp~[w]: w in d}
        x-->Stat8 ==> false; Discharge ==> fp~[x] in r
        Assump ==> Stat9: (FORALL x in r, y in r | bop(x,y) in r)
    (fq~[x],fp~[x])-->Stat9 ==> false; Discharge ==> QED
--
Theorem pointwise.3: (FORALL x in d | h~[x] = bop(fq~[x],fp~[x])). Proof:
	Suppose_not ==> Stat1: AUTO
	x-->Stat1 ==> (x in d) & (h~[x] /= bop(fq~[x],fp~[x]))
	Tpointwise.1 ==> h = {[u,bop(fq~[u],fp~[u])]: u in d}
	APPLY() fcn_symbol(f(x)->bop(fq~[x],fp~[x]),g->h,s->d) ==> Stat2: (FORALL x | h~[x] = if x in d then bop(fq~[x],fp~[x]) else 0 end if)
	x-->Stat2 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY pointwise
--
--THEORY pointwise(f,fp,h,d,r,bop(X,Y))
--	Svm(f) & (domain(f) = d) & (range(f) ¥incin r)
--	Svm(fp) & (domain(fp) = d) & (range(fp) ¥incin r)
--	(FORALL x in r, y in r | bop(x,y) in r)
--	h = {[car(p),bop(cdr(p),fp~[car(p)])]: p in f}
--==>
--	h = {[u,bop(f~[u],fp~[u])]: u in d}
--	Svm(h) & (domain(h) = d) & (range(h) ¥incin r)
--  (FORALL x in d | h~[x] = bop(f~[x],fp~[x]))
--END pointwise
--
-- We begin by proving that every constant sequence whose image belongs
-- to the rationals is a Cauchy sequence.
--
Theorem 543: (X in Ra) ¥imp ((Za ¥PROD {X}) in RaCauchy). Proof:
Suppose_not(x2) ==> (x2 in Ra) & ((Za ¥PROD {x2}) notin RaCauchy)
	Use_def(RaCauchy) ==> Stat1: (Za ¥PROD {x2}) notin {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
	Use_def(¥PROD) ==> Za ¥PROD {x2} = {[yy,x]: yy in Za, x in {x2}}
	SIMPLF ==> (Za ¥PROD {x2}) = {[yy,x2]: yy in Za}
	APPLY() fcn_symbol(f(yy)->x2, g->(Za ¥PROD {x2}), s->Za) ==> (domain(Za ¥PROD {x2}) = Za) & Svm(Za ¥PROD {x2})
			& Stat2: (FORALL yy | ((Za ¥PROD {x2})~[yy]) = if yy in Za then x2 else 0 end if)
	Suppose ==> (Za ¥PROD {x2}) notin RaSeq
		(Za,Za,{x2},Ra)-->T256 ==> (Za ¥PROD {x2}) ¥incin (Za ¥PROD Ra)
		Use_def(RaSeq) ==>  Stat3: (Za ¥PROD {x2}) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}
	()-->Stat3 ==> false; Discharge ==> (Za ¥PROD {x2}) in RaSeq
	()-->Stat1 ==> Stat4: (not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
	Finite({ i * j : i in Za, j in Za | Ra_ABS(((Za ¥PROD {x2})~[i]) ¥Ra_MINUS ((Za ¥PROD {x2})~[j])) ¥Ra_GT eps })))
	eps-->Stat4 ==> (eps in Ra) & (eps ¥Ra_GT Ra_0) & (not Finite({ i * j : i in Za, j in Za | Ra_ABS(((Za ¥PROD {x2})~[i]) ¥Ra_MINUS ((Za ¥PROD {x2})~[j])) ¥Ra_GT eps }))
	T188 ==> Finite(0)
	EQUAL ==> Stat5: 0 /= { i * j : i in Za, j in Za | Ra_ABS(((Za ¥PROD {x2})~[i]) ¥Ra_MINUS ((Za ¥PROD {x2})~[j])) ¥Ra_GT eps }
	(i,j)-->Stat5 ==> Stat6: (i in Za) & (j in Za) & (Ra_ABS(((Za ¥PROD {x2})~[i]) ¥Ra_MINUS ((Za ¥PROD {x2})~[j])) ¥Ra_GT eps)
	i-->Stat2 ==> ((Za ¥PROD {x2})~[i]) = x2
	j-->Stat2 ==> ((Za ¥PROD {x2})~[j]) = x2
	ALGEBRA ==> ((x2 ¥Ra_MINUS x2) = Ra_0) & (Ra_0 in Ra)
	T465 ==> Ra_is_nonneg(Ra_0)
	T525 ==> Stat7: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
	Ra_0-->Stat7 ==> Ra_ABS(Ra_0) = Ra_0
	EQUAL(Stat6) ==> Ra_0 ¥Ra_GT eps
	(Ra_0,eps)-->T473 ==> (Ra_0 ¥Ra_GE eps) & (Ra_0 /= eps)
	(eps,Ra_0)-->T473 ==> eps ¥Ra_GE Ra_0
(eps,Ra_0)-->T495 ==> false; Discharge ==> QED
--
--
--
Theorem 544: (X in Ra) ¥imp (Ras_ABS(Za ¥PROD {X}) = (Za ¥PROD {Ra_ABS(X)})). Proof:
Suppose_not(y0) ==> AUTO
	y0-->T543(*) ==> Stat1: Ras_ABS(Za ¥PROD {y0}) /= (Za ¥PROD {Ra_ABS(y0)})
	Use_def(¥PROD)(Stat1*) ==> Ras_ABS(Za ¥PROD {y0}) /= {[x,y]: x in Za, y in {Ra_ABS(y0)}}
	SIMPLF(Stat1*) ==> Ras_ABS(Za ¥PROD {y0}) /= {[x,Ra_ABS(y0)]: x in Za}
	Use_def(Ras_ABS)(Stat1*) ==> Stat2: {[x,Ra_ABS(y0)]: x in Za} /= {[car(p),Ra_ABS(cdr(p))]: p in (Za ¥PROD {y0})}
	c-->Stat2(Stat2*) ==> (c in {[x,Ra_ABS(y0)]: x in Za}) ¥eq (c notin {[car(p),Ra_ABS(cdr(p))]: p in (Za ¥PROD {y0})})
	Suppose ==> Stat3: (c in {[x,Ra_ABS(y0)]: x in Za}) & (c notin {[car(p),Ra_ABS(cdr(p))]: p in (Za ¥PROD {y0})})
		(k,[k,y0])-->Stat3(Stat3*) ==> (k in Za) & (([k,Ra_ABS(y0)] /= [car([k,y0]),Ra_ABS(cdr([k,y0]))]) or ([k,y0] notin (Za ¥PROD {y0})))
		(k,y0)-->T9(*) ==> (car([k,y0]) = k) & (cdr([k,y0]) = y0)
		EQUAL(Stat3) ==> Stat4: ([k,Ra_ABS(y0)] /= [k,Ra_ABS(y0)]) or ([k,y0] notin (Za ¥PROD {y0}))
		(Stat4*)ELEM ==> Stat5: [k,y0] notin (Za ¥PROD {y0})
		Use_def(¥PROD)(Stat5*) ==> Stat6: [k,y0] notin {[x,y]: x in Za, y in {y0}}
	(k,y0)-->Stat6(Stat3*) ==> false; Discharge ==> Stat7: (c in {[car(p),Ra_ABS(cdr(p))]: p in (Za ¥PROD {y0})}) & (c notin {[x,Ra_ABS(y0)]: x in Za})
	(q,car(q))-->Stat7(Stat7*) ==> Stat8: (q in (Za ¥PROD {y0})) & (([car(q),Ra_ABS(cdr(q))] /= [car(q),Ra_ABS(y0)]) or (car(q) notin Za))
	Use_def(¥PROD)(Stat8*) ==> Stat9: q in {[x,y]: x in Za, y in {y0}}
	SIMPLF(Stat9*) ==> Stat10: q in {[x,y0]: x in Za}
	h-->Stat10(Stat10*) ==> (h in Za) & (q = [h,y0])
	(h,y0)-->T9(*) ==> (car([h,y0]) = h) & (cdr([h,y0]) = y0)
	EQUAL(Stat8) ==> ([h,Ra_ABS(y0)] /= [h,Ra_ABS(y0)]) or (h notin Za)
(Stat10*)Discharge ==> QED
--
-- As a corollary of Theorem 543, the sequence which has constant value $Ra_0$,
-- and the one which has constant value $Ra_1$, are Cauchy sequences.
--
Theorem 545: {Ra0Seq,Ra1Seq} ¥incin RaCauchy. Proof:
Suppose_not ==> AUTO
	Use_def(Ra0Seq) ==> Ra0Seq = (Za ¥PROD {Ra_0})
	Use_def(Ra1Seq) ==> Ra1Seq = (Za ¥PROD {Ra_1})
	ALGEBRA ==> (Ra_0 in Ra) & (Ra_1 in Ra)
	Ra_0-->T543(*) ==> (Za ¥PROD {Ra_0}) in RaCauchy
Ra_1-->T543(*) ==> false; Discharge ==> QED
--
-- Every sequence of rational numbers is equivalent to itself:
--
Theorem 546: (F in RaSeq) ¥imp ((domain(F) = Za) & Svm(F) & (range(F) ¥incin Ra) & Ra_eqseq(F,F)). Proof:
Suppose_not(f) ==> AUTO
	(f,0)-->T540(*) ==> (range(f) ¥incin Ra) & (not Ra_eqseq(f,f))
	Use_def(Ra_eqseq) ==> Stat1: (not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
	Finite({x : x in domain(f) | Ra_ABS((f~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps})))
	e-->Stat1 ==> (e in Ra) & (e ¥Ra_GT Ra_0) & (not Finite({x : x in domain(f) | Ra_ABS((f~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT e}))
	TELEM ==> Finite(0)
	(Stat1)ELEM ==> Stat2: {x : x in domain(f) | Ra_ABS((f~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT e} /= 0
	x-->Stat2 ==> (x in domain(f)) & (Ra_ABS((f~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT e)
	(Ra_ABS((f~[x]) ¥Ra_MINUS (f~[x])),e)-->T473 ==> Ra_ABS((f~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GE e
	(x,f)-->T71 ==> Stat3: (f~[x]) in Ra
	ALGEBRA(Stat3) ==> Stat4: (((f~[x]) ¥Ra_MINUS (f~[x])) = Ra_0) & (Ra_0 in Ra)
	T465 ==> Ra_is_nonneg(Ra_0)
	EQUAL(Stat4) ==> Ra_is_nonneg((f~[x]) ¥Ra_MINUS (f~[x]))
	T525 ==> Stat5: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
	((f~[x]) ¥Ra_MINUS (f~[x]))-->Stat5 ==> Ra_ABS((f~[x]) ¥Ra_MINUS (f~[x])) = Ra_0
	(Ra_ABS((f~[x]) ¥Ra_MINUS (f~[x])), e, Ra_0)-->T510 ==> Ra_ABS((f~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT Ra_0
-- 	Use_def(¥Ra_GT) ==> false; Discharge ==> QED
(Ra_ABS((f~[x]) ¥Ra_MINUS (f~[x])),Ra_0)-->T473 ==> false; Discharge ==> QED
--
Theorem 547: ((F in RaSeq) & (N in Za) & (I in Za)) ¥imp ((shifted_seq(F,N)~[I]) = (F~[N ¥PLUS I])). Proof:
Suppose_not(h,n,i) ==> AUTO
	h-->T546(*) ==> (domain(h) = Za) & Svm(h) & (range(h) ¥incin Ra)
	Use_def(shifted_seq)(*) ==> Stat1: ((h @ Shift(n))~[i]) /= (h~[n ¥PLUS i])
	(n,i)-->T339(*) ==> Svm(Shift(n)) & (domain(Shift(n)) = Za) & (range(Shift(n)) ¥incin Za) & ((Shift(n)~[i]) = (n ¥PLUS i))
	(h,Shift(n),i)-->T129(*) ==> ((h @ Shift(n))~[i]) = (h~[Shift(n)~[i]])
EQUAL(Stat1) ==> false; Discharge ==> QED
--
-- The image of any unsigned integer via $Ras0Seq$ is $Ra_0$;
-- the image of any unsigned integer via $Ras1Seq$ is $Ra_1$.
--
Theorem 548: (U in Za) ¥imp (((Ra0Seq~[U]) = Ra_0) & ((Ra1Seq~[U]) = Ra_1)). Proof:
Suppose_not(u) ==> AUTO
	T545(*) ==> (Ra0Seq in RaCauchy) & (Ra1Seq in RaCauchy)
	T539(*) ==> Stat1: (Ra0Seq in RaSeq) & (Ra1Seq in RaSeq)
	Use_def(Ra0Seq) ==> Stat2: Ra0Seq = (Za ¥PROD {Ra_0})
	Use_def(Ra1Seq) ==> Ra1Seq = (Za ¥PROD {Ra_1})
	Use_def(¥PROD)(Stat2) ==> (Ra0Seq = {[x,y]: x in Za, y in {Ra_0}}) & (Ra1Seq = {[x,y]: x in Za, y in {Ra_1}})
	Suppose ==> Stat3: [u,Ra_0] notin {[x,y]: x in Za, y in {Ra_0}}
	(u,Ra_0)-->Stat3(*) ==> false; Discharge ==> Stat4: [u,Ra_0] in Ra0Seq
	Suppose ==> Stat5: [u,Ra_1] notin {[x,y]: x in Za, y in {Ra_1}}
	(u,Ra_1)-->Stat5(*) ==> false; Discharge ==> Stat6: [u,Ra_1] in Ra1Seq
	Ra0Seq-->T546(Stat1,Stat1*) ==> Stat7: Svm(Ra0Seq)
	Ra1Seq-->T546(Stat1,Stat1*) ==> Stat8: Svm(Ra1Seq)
	(Ra0Seq,[u,Ra_0])-->T74(Stat4,Stat7*) ==> (Ra0Seq~[car([u,Ra_0])]) = cdr([u,Ra_0])
	(Ra1Seq,[u,Ra_1])-->T74(Stat6,Stat8*) ==> (Ra1Seq~[car([u,Ra_1])]) = cdr([u,Ra_1])
	(u,Ra_0)-->T9(Stat9*) ==> Stat9: (car([u,Ra_0]) = u) & (cdr([u,Ra_0]) = Ra_0)
	(u,Ra_0)-->T9(Stat10*) ==> Stat10: (car([u,Ra_1]) = u) & (cdr([u,Ra_1]) = Ra_1)
EQUAL ==> false; Discharge ==> QED
--
-- More generally, in the case of a rational Cauchy sequence $f$,
-- every infinite subsequence $g$ of $f$ is a rational Cauchy sequence equivalent to $f$.
--
Theorem 549: ((F in RaCauchy) & (G in Subseqs(F)) & (not Finite(G))) ¥imp ((G in RaCauchy) & Ra_eqseq(F,G)). Proof+:
Suppose_not(f,g) ==> AUTO
		Use_def(RaCauchy) ==> Stat1: f in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
		()-->Stat1(Stat1*) ==> (f in RaSeq) &
			Stat2: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))
		Use_def(RaSeq) ==> Stat3: f in {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}
		()-->Stat3(Stat3*) ==> (f ¥incin (Za ¥PROD Ra)) & (domain(f) = Za) & Svm(f)
		Use_def(next(Za)) ==> AUTO
		APPLY(h_thryvar:h) subseq(g->g,f->f) ==> Stat4:
			(g = (f @ h)) & one_1_map(h) & (domain(h) in next(Za)) & (range(h) ¥incin domain(f)) &
			(g ¥incin (domain(f) ¥PROD range(f))) & Svm(g) & (domain(g) in (next(Za) * next(domain(f)))) &
			({i in domain(h) | (i ¥nincin (h~[i]))} = 0) &
			Stat5: (FORALL i in domain(h), j in domain(h) | (i in j) ¥imp ((h~[i]) in (h~[j])))
		Use_def(one_1_map) ==> Svm(h)
		(f,Za,Ra)-->T141(*) ==> (domain(f) ¥incin Za) & (range(f) ¥incin Ra)
		(domain(f), Za, range(f), Ra)-->T256(*) ==> g ¥incin (Za ¥PROD Ra)
		Suppose ==> (domain(g) /= Za) or (domain(h) /= Za)
			(f,h)-->T95(*) ==> domain(f @ h) = domain(h)
			EQUAL ==> (domain(g) in next(Za)) & (domain(g) = domain(h))
			Use_def(next) ==> domain(g) in Za
			g-->T174(*) ==> (#domain(g) = #g) & Finite(#domain(g))
			EQUAL ==> Finite(#g)
		g-->T193(*) ==> false; Discharge ==> Stat6: (domain(g) = Za) & (domain(h) = Za)
		Suppose ==> g notin RaCauchy
			Use_def(RaCauchy) ==> Stat7: g notin {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
					Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
		()-->Stat7(*) ==> (g notin RaSeq) or (not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
				Finite({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps })))
		Suppose ==> g notin RaSeq
			Use_def(RaSeq) ==> Stat8: g notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}
			()-->Stat8(*) ==> false; Discharge ==> Stat9: (not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
				Finite({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps })))
            eps0-->Stat9(*) ==> (eps0 in Ra) & (eps0 ¥Ra_GT Ra_0) & (not Finite({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 }))
            eps0-->Stat2(*) ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps0 })
            (h, { i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 })-->T58(*) ==> one_1_map(h ¥ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 }))
            Suppose ==> domain(h ¥ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 })) /= { i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 }
                (h, { i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 })-->T94 ==> Stat10: not({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 } ¥incin Za)
                c-->Stat10 ==> Stat11: (c in { i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 }) & (c notin Za)
                (ip, jp)-->Stat11(Stat11*) ==> (ip in Za) & (jp in Za) & ((ip * jp) notin Za)
            (ip,jp)-->T366(*) ==> false; Discharge ==> domain(h ¥ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 })) = { i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 }
            Suppose ==> Stat12: not(range(h ¥ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 })) ¥incin { i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps0 })
                d-->Stat12(Stat12*) ==> (d in range(h ¥ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 }))) & (d notin { i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps0 })
                (h, { i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 })-->T123(*) ==> Stat13: d in ({h~[x]: x in domain(h) | x in { i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 }})
                iq-->Stat13(Stat6*) ==> Stat14: (iq in Za) & (iq in { i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 }) & ((h~[iq]) notin { i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps0 })
                (i0, j0, h~[i0], h~[j0])-->Stat14(Stat14*) ==> Stat15: (i0 in Za) & (j0 in Za) & (iq = (i0 * j0)) & (Ra_ABS((g~[i0]) ¥Ra_MINUS (g~[j0])) ¥Ra_GT eps0) & (((h~[iq]) /= (h~[i0]) * (h~[j0])) or ((h~[i0]) notin Za) or ((h~[j0]) notin Za) or (not(Ra_ABS((f~[h~[i0]]) ¥Ra_MINUS (f~[h~[j0]])) ¥Ra_GT eps0)))
                (f,h,i0)-->T129(*) ==> ((f @ h)~[i0]) = (f~[h~[i0]])
                (f,h,j0)-->T129(*) ==> ((f @ h)~[j0]) = (f~[h~[j0]])
                EQUAL ==> Ra_ABS((f~[h~[i0]]) ¥Ra_MINUS (f~[h~[j0]])) ¥Ra_GT eps0
                (i0, h)-->T71(Stat3*) ==> (h~[i0]) in Za
                (j0, h)-->T71(Stat3*) ==> (h~[j0]) in Za
                EQUAL ==> (h~[i0 * j0]) /= (h~[i0]) * (h~[j0])
                T206(*) ==> Ord(Za)
                Suppose ==> i0 = j0
                    (Stat14*)ELEM ==> (i0 * j0) = i0
                EQUAL ==> false; Discharge ==> i0 /= j0
                (i0, j0)-->T31(Stat14*) ==> (i0 in j0) or (j0 in i0)
                Suppose ==> Stat16: i0 in j0
                    (j0, i0)-->T13(Stat14*) ==> (i0 * j0) = i0
                    (i0, j0)-->Stat5(Stat6,Stat15,Stat16*) ==> (h~[i0]) in (h~[j0])
--??                    (i0, j0)-->Stat5(Stat6*) ==> (h~[i0]) in (h~[j0])
                    (h~[j0], h~[i0])-->T13(Stat14*) ==> ((h~[i0]) * (h~[j0])) = (h~[i0])
                EQUAL ==> false; Discharge ==> Stat17: j0 in i0
                (i0, j0)-->T13(Stat14*) ==> (i0 * j0) = j0
                (j0, i0)-->Stat5(Stat6,Stat15,Stat17*) ==> (h~[j0]) in (h~[i0])
                (h~[i0], h~[j0])-->T13(Stat14*) ==> ((h~[i0]) * (h~[j0])) = (h~[j0])
            EQUAL ==> false; Discharge ==> range(h ¥ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 })) ¥incin { i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps0 }
            ({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps0 }, range(h ¥ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 })))-->T189(*) ==> Finite(range(h ¥ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 })))
            (h ¥ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 }))-->T191(*) ==> Finite(domain(h ¥ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps0 })))
        EQUAL ==> false; Discharge ==> not Ra_eqseq(f,g)
        Use_def(Ra_eqseq) ==> Stat18: not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in domain(f) | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps}))
        eps1-->Stat18(Stat18*) ==> (eps1 in Ra) & (eps1 ¥Ra_GT Ra_0) & (not Finite({x in domain(f) | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1}))
        Suppose ==> Finite({x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (f~[h~[x]])) ¥Ra_GT eps1})
            EQUAL ==> Stat19: {x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (f~[h~[x]])) ¥Ra_GT eps1} /= {x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS ((f @ h)~[x])) ¥Ra_GT eps1}
            xp-->Stat19(Stat19*) ==> (xp in Za) & (not((Ra_ABS((f~[xp]) ¥Ra_MINUS (f~[h~[xp]])) ¥Ra_GT eps1) ¥eq (Ra_ABS((f~[xp]) ¥Ra_MINUS ((f @ h)~[xp])) ¥Ra_GT eps1)))
            (f,h,xp)-->T129(*) ==>  ((f @ h)~[xp]) = (f~[h~ [xp]])
        EQUAL ==> false; Discharge ==> not Finite({x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (f~[h~[x]])) ¥Ra_GT eps1})
        eps1-->Stat2(*) ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps1 })
        ({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps1 }, {x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (f~[h~[x]])) ¥Ra_GT eps1})-->T189(*) ==> Stat20: not ({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps1 } incs {x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (f~[h~[x]])) ¥Ra_GT eps1})
        i1-->Stat20(*) ==> Stat21: (i1 in {x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (f~[h~[x]])) ¥Ra_GT eps1}) & (i1 notin { i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps1 })
        (i1, h~[i1])-->Stat21(Stat3*) ==> Stat22: (i1 in Za) & (((i1 * (h~[i1])) /= i1) or ((h~[i1]) notin Za))
        (i1, h)-->T71(Stat3*) ==> Stat23: (i1 * (h~[i1])) /= i1
        (Stat4*)ELEM ==> Stat24: i1 notin {i in domain(h) | i ¥nincin (h~[i])}
()-->Stat24(Stat6,Stat23,Stat22*) ==> false; Discharge ==> QED
--
-- It follows immediately from Theorem 539 and Theorem 540 that every Cauchy sequence,
-- applied to an element of $Za$, returns an element of $Ra$.
--
Theorem 550: (F in RaCauchy) ¥imp ((H in Za) ¥imp (F~[H] in Ra)). Proof:
Suppose_not(f,h) ==> AUTO
    T539(*) ==> f in RaSeq
(f,h)-->T540 ==> false; Discharge ==> QED
--
-- For every Cauchy sequence $f$, there is a subscript $k$ past which the
-- distance between any two images $f~[i],f~[j]$ is no larger than any fixed
-- positive rational.
--
Theorem 551: ((Eps in Ra) & (Eps ¥Ra_GT Ra_0) & (F in RaCauchy)) ¥imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (not (Ra_ABS((F~[i]) ¥Ra_MINUS (F~[j]))) ¥Ra_GT Eps))). Proof+:
Suppose_not(eps,f) ==> AUTO
	Use_def(RaCauchy) ==> Stat1: (f in {g: g in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps }))}) &
		(eps in Ra) & (eps ¥Ra_GT Ra_0) &
		Stat2: (not(EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (not (Ra_ABS((F~[i]) ¥Ra_MINUS (F~[j]))) ¥Ra_GT eps))))
	g-->Stat1(Stat1*) ==> (f = g) & (g in RaSeq) & (FORALL eps1 in Ra | (eps1 ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j])) ¥Ra_GT eps1 }))
	EQUAL ==> Stat3: (FORALL eps1 in Ra | (eps1 ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps1 }))
	eps-->Stat3(Stat1*) ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps })
	APPLY() cauchyseq_lemma2(R(i,j)->(Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps)) ==>
		Stat4: (EXISTS k in Za | (FORALL i in Za, j in Za | (((i incs k) & (j incs k)) ¥imp (not(Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps)))))
	k-->Stat4(Stat4*) ==> (k in Za) & Stat5: (FORALL i in Za, j in Za | ((i incs k) & (j incs k)) ¥imp (not(Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps)))
	k-->Stat2(Stat4*) ==> Stat6: not (FORALL i in Za, j in Za | (((i notin k) & (j notin k)) ¥imp (not (Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j]))) ¥Ra_GT eps)))
	(i,j)-->Stat6(Stat6*) ==> Stat7: (i in Za) & (j in Za) & (i notin k) & (j notin k) & (Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps)
	(i,j)-->Stat5(Stat3*) ==> ((i incs k) & (j incs k)) ¥imp (not(Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps))
	(Stat7*)ELEM ==> (not((i incs k) & (j incs k)))
	T206(*) ==> Ord(Za) & Ord(i) & Ord(j) & Ord(k)
	(k,i)-->T35(*) ==> (i incs k)
	(k,j)-->T35(*) ==> false; Discharge ==> QED
--
-- It is easily seen that the preceding assertion can be reformulated to assert that
-- there is a subscript $k$ past which the
-- distance between any two images $f~[i],f~[j]$ is smaller than any fixed
-- positive rational.
--
 Theorem 552: ((Eps in Ra) & (Eps ¥Ra_GT Ra_0) & (F in RaCauchy)) ¥imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (Eps ¥Ra_GT (Ra_ABS((F~[i]) ¥Ra_MINUS (F~[j])))) )). Proof:
    Suppose_not(eps,f) ==> (f in RaCauchy) & (eps in Ra) & (eps ¥Ra_GT Ra_0) & Stat1: (not(EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (eps ¥Ra_GT (Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])))) )))
    eps-->T523 ==> Stat2: (EXISTS eps0 in Ra | ((eps ¥Ra_GT eps0) & (eps0 ¥Ra_GT Ra_0)))
    eps0-->Stat2 ==> (eps0 in Ra) & (eps ¥Ra_GT eps0) & (eps0 ¥Ra_GT Ra_0)
    (eps0,f)-->T551 ==> Stat3: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (not (Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps0))))
    k-->Stat3 ==> (k in Za) & Stat4: (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (not (Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps0)))
    k-->Stat1 ==> Stat5: not(FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (eps ¥Ra_GT (Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])))))
--
-- Thus we have a positive $eps0$ smaller than $eps$, and a $k$ such that $Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j]))$ is no larger than $eps0$
-- if $i$ and $j$ are both larger than $k$.
--
    (i,j)-->Stat5 ==> (i in Za) & (j in Za) & (i notin k) & (j notin k) & (not(eps ¥Ra_GT (Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])))))
    (i,j)-->Stat4 ==> not(Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps0)
    T539(*) ==> f in RaSeq
    (f,i)-->T540 ==> f~[i] in Ra
    (f,j)-->T540 ==> f~[j] in Ra
	ALGEBRA ==> (f~[i]) ¥Ra_MINUS (f~[j]) in Ra
	((f~[i]) ¥Ra_MINUS (f~[j]))-->T527 ==> Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) in Ra
    (Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])),eps0)-->T476 ==> (eps0 ¥Ra_GT Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j]))) or (eps0 = Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])))
	(eps0,Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])))-->T474 ==> eps0 ¥Ra_GE (Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])))
	(eps,eps0,Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])))-->T497 ==> eps ¥Ra_GT Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j]))
	Discharge ==> QED
--
-- In preparation for proving that the relation $Ra_eqseq(F,G)$ between rational sequences
-- is an equivalence relation, we now establish the following assertion, involving a hybrid
-- of transitivity and symmetry:
--
Theorem 553: (({F,G,H} ¥incin RaSeq) & Ra_eqseq(F,G) & Ra_eqseq(G,H)) ¥imp Ra_eqseq(H,F). Proof:
Suppose_not(f,g,k) ==> AUTO
--
-- For, assuming $f,g,k$ to be a counterexample to our
-- conclusion, we can derive a contradiction from the fact that the set
--	${x : x in domain(k) | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps}$
-- can be infinite for some positive value of $eps$, unlike the corresponding
-- sets which have $f,g$ and $g,k$ in place of $k,f$ respectively.
--
	Use_def(Ra_eqseq) ==> (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in domain(f) | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps})) &
		(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in domain(g) | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps})) &
		(not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({x : x in domain(k) | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps})))
--
-- Noting that $f,g,k$ have $Za$ as their common domain,
-- and have all of their images in $Ra$, we can restate
-- our hypothesis more simply.
--
	f-->T546 ==> (domain(f) = Za) & Svm(f)
	g-->T546 ==> (domain(g) = Za) & Svm(g)
	k-->T546 ==> (domain(k) = Za) & Svm(k)
	EQUAL ==> Stat1: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps})) &
		Stat2: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps})) &
		Stat3: (not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({x : x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps})))
--
-- Let $eps0$ be a positive value for $eps$ which makes the set
-- indicated above infinite; moreover, let $eps1,eps2$ be smaller
-- positive values whose addition is smaller than $eps0$ (e.g.,
-- one could take $eps1=eps2$ to be one half or one third of $eps0$).
-- We have assumed the finiteness of the two sets
--	${x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1}$,
--	${x : x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2}$.
--
	eps0-->Stat3 ==> (eps0 in Ra) & (eps0 ¥Ra_GT Ra_0) &
		(not Finite({x : x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0}))
	eps0-->T522 ==> Stat4: (EXISTS e in Ra, e0 in Ra | (eps0 ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e ¥Ra_GT Ra_0) & (eps0 ¥Ra_GT (e ¥Ra_PLUS e0)))
	(eps1,eps2)-->Stat4 ==> (eps1 in Ra) & (eps2 in Ra) & (eps0 ¥Ra_GT eps1) & (eps1 ¥Ra_GT eps2) & (eps2 ¥Ra_GT Ra_0) & (eps1 ¥Ra_GT Ra_0) & (eps0 ¥Ra_GT (eps1 ¥Ra_PLUS eps2))
	eps1-->Stat1 ==> Finite({x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1})
	eps2-->Stat2 ==> Finite({x : x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2})
--
-- Due to the inequality
--	$Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_LE (Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_PLUS Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])))$,
-- it turns out that the set
--	${x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0}$
-- is included in the union of the two sets
--	${x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1}$,
--	${x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2}$,
-- both of which must be finite, in consequence of the assumptions made.
--
	Suppose ==> Stat5: not({x : x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0} ¥incin ({x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1} + {x : x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2}))
            x-->Stat5 ==> Stat6: (x in {x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0}) & Stat7: (x notin {x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1}) & Stat8: (x notin {x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2})
            ()-->Stat6 ==> (x in Za) & (Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0)
        	(f,x)-->T540 ==> f~[x] in Ra
        	(g,x)-->T540 ==> g~[x] in Ra
        	(k,x)-->T540 ==> k~[x] in Ra
            ()-->Stat7 ==> not(Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1)
            ()-->Stat8 ==> not(Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2)
            ALGEBRA ==> (((f~[x]) ¥Ra_MINUS (g~[x])) in Ra) & (((g~[x]) ¥Ra_MINUS (k~[x])) in Ra) & (((f~[x]) ¥Ra_MINUS (k~[x])) in Ra) & (((k~[x]) ¥Ra_MINUS (f~[x])) in Ra) & ((eps1 ¥Ra_PLUS eps2) in Ra)
            ((f~[x]) ¥Ra_MINUS (g~[x]))-->T527 ==> Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) in Ra
            ((g~[x]) ¥Ra_MINUS (k~[x]))-->T527 ==> Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) in Ra
            ((k~[x]) ¥Ra_MINUS (f~[x]))-->T527 ==> Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) in Ra
            ALGEBRA ==> (Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_PLUS Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x]))) in Ra
            (Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])), eps1)-->T473 ==> (eps1 ¥Ra_GE Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])))
            (Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])), eps2)-->T473 ==> (eps2 ¥Ra_GE Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])))
            T525 ==> Stat9: (FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (Ra_ABS((x ¥Ra_PLUS Ra_Rev(z))) ¥Ra_LE (Ra_ABS(x ¥Ra_PLUS Ra_Rev(y)) ¥Ra_PLUS Ra_ABS(y ¥Ra_PLUS Ra_Rev(z))))) &
			Stat10: (FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_Rev(x ¥Ra_PLUS Ra_Rev(y)) = (y ¥Ra_PLUS Ra_Rev(x)))) &
			Stat11: (FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
            (f~[x], g~[x], k~[x])-->Stat9 ==> Ra_ABS((f~[x]) ¥Ra_PLUS Ra_Rev(k~[x])) ¥Ra_LE (Ra_ABS((f~[x]) ¥Ra_PLUS Ra_Rev(g~[x])) ¥Ra_PLUS Ra_ABS((g~[x]) ¥Ra_PLUS Ra_Rev(k~[x])))
            (f~[x], k~[x])-->Stat10 ==> Ra_Rev((f~[x]) ¥Ra_PLUS Ra_Rev(k~[x])) = ((k~[x]) ¥Ra_PLUS Ra_Rev(f~[x]))
            Use_def(¥Ra_MINUS) ==> ((f~[x]) ¥Ra_PLUS Ra_Rev(k~[x])) in Ra
            ((f~[x]) ¥Ra_PLUS Ra_Rev(k~[x]))-->Stat11 ==> Ra_ABS(Ra_Rev((f~[x]) ¥Ra_PLUS Ra_Rev(k~[x]))) = Ra_ABS((f~[x]) ¥Ra_PLUS Ra_Rev(k~[x]))
            Use_def(¥Ra_MINUS) ==> (((f~[x]) ¥Ra_PLUS Ra_Rev(k~[x])) = ((f~[x]) ¥Ra_MINUS (k~[x]))) & (((f~[x]) ¥Ra_PLUS Ra_Rev(g~[x])) = ((f~[x]) ¥Ra_MINUS (g~[x]))) & (((g~[x]) ¥Ra_PLUS Ra_Rev(k~[x])) = ((g~[x]) ¥Ra_MINUS (k~[x]))) & (((k~[x]) ¥Ra_PLUS Ra_Rev(f~[x])) = ((k~[x]) ¥Ra_MINUS (f~[x])))
            EQUAL ==> Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_LE (Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_PLUS Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])))
            (Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])), Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_PLUS Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])))-->T473 ==> (Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_PLUS Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x]))) ¥Ra_GE Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x]))
            (eps1, Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])), eps2, Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])))-->T493 ==> (eps1 ¥Ra_PLUS eps2) ¥Ra_GE (Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_PLUS Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])))
            (eps1 ¥Ra_PLUS eps2, Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_PLUS Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])), Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])))-->T508 ==> (eps1 ¥Ra_PLUS eps2) ¥Ra_GE (Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])))
            (eps0, eps1 ¥Ra_PLUS eps2, Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])))-->T509 ==> eps0 ¥Ra_GT (Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])))
            (Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])), eps0)-->T473 ==> (Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GE eps0)
            (eps0, Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])), eps0)-->T509 ==> eps0 ¥Ra_GT eps0
	(eps0,eps0)-->T473 ==> false; Discharge ==> {x : x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0} ¥incin ({x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1} + {x : x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2})
	TELEM ==> Svm({x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1}) &
		(range({x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1}) = {x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1}) & (domain({x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1}) = {x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1}) &
		Svm({x : x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2}) & (range({x : x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2}) = {x : x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2}) & (domain({x : x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2}) = {x : x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2})
	({x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1})-->T192 ==> Finite({x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1})
	({x : x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2})-->T192 ==> Finite({x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2})
--
-- Accordingly, since the sets
--	${x : x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0}$,
--	${x : x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0}$
-- have the same cardinality, they must both be finite, which contradicts
-- our assumption that the former of them is infinite. This contradiction
-- leads to the desired conclusion.
--
	({x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1}, {x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2})-->T236 ==> Finite({x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1} + {x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2})
	({x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps1} + {x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (k~[x])) ¥Ra_GT eps2}, {x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0})-->T189 ==> Finite({x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0})
	TELEM ==> Svm({x : x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0}) & (domain({x : x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0}) = {x : x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0}) & (range({x : x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0}) = {x : x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0})
	({x : x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0})-->T192 ==> Finite({x : x in Za | Ra_ABS((k~[x]) ¥Ra_MINUS (f~[x])) ¥Ra_GT eps0})
Discharge ==> QED
--
-- To prepare for showing that the set of rational Cauchy sequences is closed
-- under the pointwise algebraic operations introduced above, we prove that
-- these operations map rational sequences to rational sequences.
--
Theorem 554: ({F,G} ¥incin RaSeq) ¥imp
	(((F ¥Ras_PLUS G) in RaSeq) &
		(Ras_ABS(G) in RaSeq) &
		(Ras_Rev(G) in RaSeq) &
		((F ¥Ras_TIMES G) in RaSeq) &
		((F ¥Ras_PLUS G) = {[u,((F~[u]) ¥Ra_PLUS  (G~[u]))]: u in Za}) &
		(Ras_ABS(G) = {[u,Ra_ABS(G~[u])]: u in Za}) &
		(Ras_Rev(G) = {[u,Ra_Rev(G~[u])]: u in Za}) &
		((F ¥Ras_TIMES G) = {[u,((F~[u]) ¥Ra_TIMES (G~[u]))]: u in Za})). Proof:
Suppose_not(fq,fp) ==> AUTO
--
-- Reasoning by contradiction, assume that $fq,fp$ form a counterexample
-- to the desired statement.
--
        fq-->T546(*) ==> Stat1: (domain(fq) = Za) & Svm(fq) & (range(fq) ¥incin Ra)
        fp-->T546(*) ==> Stat2: (domain(fp) = Za) & Svm(fp) & (range(fp) ¥incin Ra)
        Use_def(¥Ras_PLUS) ==> (fq ¥Ras_PLUS  fp) = {[car(p),cdr(p) ¥Ra_PLUS  (fp~[car(p)])]: p in fq}
        Use_def(Ras_ABS(fp)) ==> AUTO
        Use_def(Ras_Rev(fp)) ==> AUTO
        Use_def(¥Ras_TIMES) ==> (fq ¥Ras_TIMES fp) = {[car(p),cdr(p) ¥Ra_TIMES (fp~[car(p)])]: p in fq}
--
-- After unfolding the definitions which are directly involved,
-- we recall that $Ra$ is closed under addition, multiplication, sign inversion,
-- and absolute value operation. This allows us to invoke the THEORY 'pointwise'
-- ('pointwiseU' in the monadic case) for each one of these four operations,
-- thereby leading to the desired contradiction.
--
        Suppose ==> Stat3: not(FORALL x in Ra, y in Ra | (x ¥Ra_PLUS y) in Ra)
            (x1,y1)-->Stat3 ==> Stat4: (x1 in Ra) & (y1 in Ra) & ((x1 ¥Ra_PLUS y1) notin Ra)
        ALGEBRA(Stat4) ==> (x1 ¥Ra_PLUS y1) in Ra; Discharge ==> AUTO
        Suppose ==> Stat5: not(FORALL x in Ra, y in Ra | (x ¥Ra_TIMES y) in Ra)
            (x2,y2)-->Stat5 ==> Stat6: (x2 in Ra) & (y2 in Ra) & ((x2 ¥Ra_TIMES y2) notin Ra)
        ALGEBRA(Stat6) ==> (x2 ¥Ra_TIMES y2) in Ra; Discharge ==> AUTO
        Suppose ==> Stat7: not(FORALL x in Ra | Ra_ABS(x) in Ra)
            x3-->Stat7 ==> (x3 in Ra) & (Ra_ABS(x3) notin Ra)
        x3-->T527 ==> false; Discharge ==> AUTO
        Suppose ==> Stat8: not(FORALL x in Ra | Ra_Rev(x) in Ra)
            x4-->Stat8 ==> Stat9: (x4 in Ra) & (Ra_Rev(x4) notin Ra)
        ALGEBRA(Stat9) ==> Ra_Rev(x4) in Ra; Discharge ==> AUTO
        APPLY() pointwise(fq->fq,fp->fp,h->(fq ¥Ras_PLUS fp),d->Za,r->Ra,bop(x,y)->(x ¥Ra_PLUS y)) ==>
	Stat10:	((fq ¥Ras_PLUS  fp) = {[u,((fq~[u]) ¥Ra_PLUS  (fp~[u]))]: u in Za}) &
                Svm(fq ¥Ras_PLUS  fp) & (domain(fq ¥Ras_PLUS  fp) = Za) & (range(fq ¥Ras_PLUS fp) ¥incin Ra)
        APPLY() pointwise(fq->fq,fp->fp,h->(fq ¥Ras_TIMES fp),d->Za,r->Ra,bop(x,y)->(x ¥Ra_TIMES y)) ==>
	Stat11:	((fq ¥Ras_TIMES fp) = {[u,((fq~[u]) ¥Ra_TIMES (fp~[u]))]: u in Za}) &
                Svm(fq ¥Ras_TIMES fp) & (domain(fq ¥Ras_TIMES fp) = Za) & (range(fq ¥Ras_TIMES fp) ¥incin Ra)
        APPLY() pointwiseU(fp->fp,h->Ras_ABS(fp),d->Za,r->Ra,uop(x)->Ra_ABS(x)) ==>
	Stat12:	(Ras_ABS(fp) = {[u,Ra_ABS(fp~[u])]: u in Za}) &
                Svm(Ras_ABS(fp)) & (domain(Ras_ABS(fp)) = Za) & (range(Ras_ABS(fp)) ¥incin Ra)
        APPLY() pointwiseU(fp->fp,h->Ras_Rev(fp),d->Za,r->Ra,uop(x)->Ra_Rev(x)) ==>
	Stat13:	(Ras_Rev(fp) = {[u,Ra_Rev(fp~[u])]: u in Za}) &
                Svm(Ras_Rev(fp)) & (domain(Ras_Rev(fp)) = Za) & (range(Ras_Rev(fp)) ¥incin Ra)
        Use_def(RaSeq) ==> ((fq ¥Ras_PLUS  fp) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}) or
                           ((fq ¥Ras_TIMES fp) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}) or
                           (Ras_ABS(fp) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}) or
                           (Ras_Rev(fp) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)})
        Suppose ==> Stat14: Ras_ABS(fp) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}
            Use_def(Svm(Ras_ABS(fp))) ==> AUTO
            (Ras_ABS(fp),Za,Ra)-->T141(Stat12*) ==> Ras_ABS(fp) ¥incin (Za ¥PROD Ra)
        ()-->Stat14(Stat12*) ==> false; Discharge ==> ((fq ¥Ras_PLUS fp) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}) or
                                ((fq ¥Ras_TIMES fp) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}) or
                                (Ras_Rev(fp) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)})
        Suppose ==> Stat15: ((fq ¥Ras_TIMES fp) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)})
            Use_def(Svm(fq ¥Ras_TIMES fp)) ==> AUTO
            (fq ¥Ras_TIMES fp,Za,Ra)-->T141(Stat11*) ==> (fq ¥Ras_TIMES fp) ¥incin (Za ¥PROD Ra)
        ()-->Stat15(Stat11*) ==> false; Discharge ==> ((fq ¥Ras_PLUS fp) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}) or
                                (Ras_Rev(fp) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)})
        Suppose ==> Stat16: ((fq ¥Ras_PLUS fp) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)})
            Use_def(Svm(fq ¥Ras_PLUS fp)) ==> AUTO
            (fq ¥Ras_PLUS fp,Za,Ra)-->T141(Stat10*) ==> (fq ¥Ras_PLUS fp) ¥incin (Za ¥PROD Ra)
        ()-->Stat16(Stat10*) ==> false; Discharge ==> Stat17: Ras_Rev(fp) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}
        Use_def(Svm(Ras_Rev(fp))) ==> AUTO
        (Ras_Rev(fp),Za,Ra)-->T141(Stat13*) ==> Ras_Rev(fp) ¥incin (Za ¥PROD Ra)
()-->Stat17(Stat13*) ==> false; Discharge ==> QED
--
-- It will often be convenient to use the following simplified (and partly repeated) consequences of the preceding result.
--
Theorem 555: (({F1,G1} ¥incin RaSeq) & (N in Za)) ¥imp ((F1~[N] in Ra) & (G1~[N] in Ra) &
		((F1 ¥Ras_PLUS G1 in RaSeq) & ((F1 ¥Ras_PLUS G1)~[N] = (F1~[N]) ¥Ra_PLUS (G1~[N]))) &
		(((Ras_ABS(G1) in RaSeq) & (Ras_ABS(G1)~[N] = Ra_ABS(G1~[N])))) &
		(((Ras_Rev(G1) in RaSeq) & (Ras_Rev(G1)~[N] = Ra_Rev(G1~[N])))) &
		(((F1 ¥Ras_TIMES G1 in RaSeq) & (F1 ¥Ras_TIMES G1)~[N] = ((F1~[N]) ¥Ra_TIMES (G1~[N]))))). Proof:
Suppose_not(f1,g1,n) ==> AUTO
	ELEM ==> Stat1: n in Za
	(f1,n)-->T540(*) ==> (f1~[n]) in Ra
	(g1,n)-->T540(*) ==> (g1~[n]) in Ra
	(f1,g1)-->T554(*) ==> ((f1 ¥Ras_PLUS g1) in RaSeq) & (Ras_ABS(g1) in RaSeq) &
		(Ras_Rev(g1) in RaSeq) & ((f1 ¥Ras_TIMES g1) in RaSeq) &
		 ((f1 ¥Ras_PLUS g1) = {[n,((f1~[n]) ¥Ra_PLUS  (g1~[n]))]: n in Za}) &
		(Ras_ABS(g1) = {[n,Ra_ABS(g1~[n])]: n in Za}) &
		(Ras_Rev(g1) = {[n,Ra_Rev(g1~[n])]: n in Za}) &
		((f1 ¥Ras_TIMES g1) = {[n,((f1~[n]) ¥Ra_TIMES (g1~[n]))]: n in Za})
	APPLY() fcn_symbol(f(x)->((f1~[x]) ¥Ra_PLUS (g1~[x])),g->f1 ¥Ras_PLUS g1,s->Za) ==> Stat2: (FORALL x | (x in Za) ¥imp (((f1 ¥Ras_PLUS g1)~[x]) = ((f1~[x]) ¥Ra_PLUS (g1~[x]))))
	APPLY() fcn_symbol(f(x)->Ra_ABS(g1~[x]),g->Ras_ABS(g1),s->Za) ==> Stat3: (FORALL x | (x in Za) ¥imp ((Ras_ABS(g1)~[x]) = Ra_ABS(g1~[x])))
	APPLY() fcn_symbol(f(x)->Ra_Rev(g1~[x]),g->Ras_Rev(g1),s->Za) ==> Stat4: (FORALL x | (x in Za) ¥imp ((Ras_Rev(g1)~[x]) = Ra_Rev(g1~[x])))
	APPLY() fcn_symbol(f(x)->((f1~[x]) ¥Ra_TIMES (g1~[x])),g->f1 ¥Ras_TIMES g1,s->Za) ==> Stat5: (FORALL x | (x in Za) ¥imp (((f1 ¥Ras_TIMES g1)~[x]) = ((f1~[x]) ¥Ra_TIMES (g1~[x]))))
--
	n-->Stat2(Stat1,Stat1*) ==> ((f1 ¥Ras_PLUS g1)~[n]) = ((f1~[n]) ¥Ra_PLUS (g1~[n]))
	n-->Stat3(Stat1,Stat1*) ==> (Ras_ABS(g1)~[n]) = Ra_ABS(g1~[n])
	n-->Stat4(Stat1,Stat1*) ==> (Ras_Rev(g1)~[n]) = Ra_Rev(g1~[n])
	n-->Stat5(Stat1,Stat1*) ==> ((f1 ¥Ras_TIMES g1)~[n]) = ((f1~[n]) ¥Ra_TIMES (g1~[n]));
	Discharge ==> QED
--
-- We prove next that the set of rational Cauchy sequences is closed
-- under the pointwise algebraic operations introduced above.
--
Theorem 556: ({F,G} ¥incin RaCauchy) ¥imp
	(((F ¥Ras_PLUS G) in RaCauchy) & (Ras_ABS(F) in RaCauchy) & (Ras_Rev(F) in RaCauchy)). Proof:
Suppose_not(fq,fp) ==> AUTO
--
-- For suppose that $fq,fp$ form a counterexample to our assertion.
--
	Use_def(RaCauchy) ==> Stat1: (fq in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
			& Stat2: (fp in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
	()-->Stat1(Stat1*) ==> Stat3: (fq in RaSeq) & Stat4: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps }))
	()-->Stat2(Stat1*) ==> Stat5: (fp in RaSeq) & Stat6: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps }))
	(fq,fp)-->T554(Stat1*) ==> Stat7: ((fq ¥Ras_PLUS fp) in RaSeq)
	(fq,fq)-->T554(Stat1*) ==> Stat8: (Ras_ABS(fq) in RaSeq) & (Ras_Rev(fq) in RaSeq)
--
-- Using the definitions of the functions involved,
-- and since, by the preceding theorem, our pointwise operations of rational
-- sequences produce rational sequences, we can argue as follows:
--
	Suppose ==> (fq ¥Ras_PLUS fp) notin RaCauchy
--
-- Assuming that $fq ¥Ras_PLUS fp$ is not a Cauchy sequence (unlike
-- $fq$ and $fp$), there would exist a positive real $eps0$ for which
-- the set
--	${ i * j : i in Za, j in Za | Ra_ABS(((fq ¥Ras_PLUS fp)~[i]) ¥Ra_MINUS ((fq ¥Ras_PLUS fp)~[j])) ¥Ra_GT eps0 }$
-- is infinite, unlike the analogous sets which have $fq$ and $fp$, respectively,
-- in place of $fq ¥Ras_PLUS fp$, and positive rationals $eps1$ and $eps2$ smaller than
-- one half of $eps0$ in place of $eps0$.
--
            Use_def(RaCauchy) ==> Stat9: (fq ¥Ras_PLUS fp) notin {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
            ()-->Stat9 ==> Stat10: not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS(((fq ¥Ras_PLUS fp)~[i]) ¥Ra_MINUS ((fq ¥Ras_PLUS fp)~[j])) ¥Ra_GT eps }))
            eps0-->Stat10(Stat10) ==> Stat11: (eps0 in Ra) & (eps0 ¥Ra_GT Ra_0) & (not(
		Finite({ i * j : i in Za, j in Za | Ra_ABS(((fq ¥Ras_PLUS fp)~[i]) ¥Ra_MINUS ((fq ¥Ras_PLUS fp)~[j])) ¥Ra_GT eps0 })))
            eps0-->T522 ==> Stat12: (EXISTS e in Ra, e0 in Ra | (eps0 ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e ¥Ra_GT Ra_0) & (eps0 ¥Ra_GT (e ¥Ra_PLUS e0)))
            (eps1,eps2)-->Stat12 ==> Stat13: (eps1 in Ra) & (eps2 in Ra) & (eps2 ¥Ra_GT Ra_0) & (eps1 ¥Ra_GT Ra_0) & (eps0 ¥Ra_GT (eps1 ¥Ra_PLUS eps2))
            eps1-->Stat4 ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps1 })
            eps2-->Stat6 ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps2 })
--
-- However, this assumption would lead to conflict with the inequality (holding for all $i,j$)
--	$Ra_ABS((fq ¥Ras_PLUS fp)~[i] ¥Ra_MINUS (fq ¥Ras_PLUS fp)~[j]) ¥Ra_LE Ra_ABS((fq~[i] ¥Ra_MINUS fq~[j]) ¥Ras_PLUS (fp~[i] ¥Ra_MINUS fq~[j]))$.
--
            APPLY() setformer_meet_join(s->Za, t->Za, h(i,j)->(i*j), R(i,j)->(Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps1), Q(i,j)->(Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps2)) ==>
		{(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps1) or (Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps2)} = ({(i*j): i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps1 } + {(i*j): i in Za, j in Za | Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps2 })
            ({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps1 }, { i * j : i in Za, j in Za | Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps2 })-->T189 ==> Finite({(i*j): i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps1 } + {(i*j): i in Za, j in Za | Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps2 })
            EQUAL ==> Finite({(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps1) or (Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps2)})
            Suppose ==> Stat14: { i * j : i in Za, j in Za | Ra_ABS(((fq ¥Ras_PLUS fp)~[i]) ¥Ra_MINUS ((fq ¥Ras_PLUS fp)~[j])) ¥Ra_GT eps0 } ¥nincin {(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps1) or (Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps2)}
                (i0,j0)-->Stat14 ==> Stat15: (i0 in Za) & (j0 in Za) & (Ra_ABS(((fq ¥Ras_PLUS fp)~[i0]) ¥Ra_MINUS ((fq ¥Ras_PLUS fp)~[j0])) ¥Ra_GT eps0) & (not(Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_GT eps1)) & (not(Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_GT eps2))
		(fq,fp,i0)-->T555(Stat3,Stat5,Stat15*) ==> Stat16: (fq~[i0] in Ra) & (fp~[i0] in Ra) & (((fq ¥Ras_PLUS fp)~[i0]) = ((fq~[i0]) ¥Ra_PLUS (fp~[i0])))
		(fq,fp,j0)-->T555(Stat3,Stat5,Stat15*) ==> (fq~[j0] in Ra) & (fp~[j0] in Ra) & (((fq ¥Ras_PLUS fp)~[j0]) = ((fq~[j0]) ¥Ra_PLUS (fp~[j0])))
                EQUAL(Stat14) ==> Ra_ABS((((fq~[i0]) ¥Ra_PLUS (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_PLUS (fp~[j0])))) ¥Ra_GT eps0
                ALGEBRA(Stat16) ==> (((fq~[i0]) ¥Ra_MINUS (fq~[j0])) in Ra) &
			(((fp~[i0]) ¥Ra_MINUS (fp~[j0])) in Ra) &
			(((((fq~[i0]) ¥Ra_PLUS (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_PLUS (fp~[j0])))) = (((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))))
                ((fq~[i0]) ¥Ra_MINUS (fq~[j0]))-->T527 ==> Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) in Ra
                ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))-->T527(Stat14) ==> Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) in Ra
                (Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])), eps1)-->T473(Stat13*) ==> eps1 ¥Ra_GE Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))
                (Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])), eps2)-->T473(Stat13*) ==> eps2 ¥Ra_GE Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))
                ALGEBRA(Stat13,Stat13) ==> (eps1 ¥Ra_PLUS eps2) in Ra
		ALGEBRA(Stat16) ==> ((Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) in Ra) &
			((((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) in Ra)
                (((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0])))-->T527(Stat14) ==> Ra_ABS(((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) in Ra
                (eps1, Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])), eps2, Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])))-->T493(Stat13*) ==> (eps1 ¥Ra_PLUS eps2) ¥Ra_GE (Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])))
                T525(Stat14) ==> Stat17: (FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_ABS(x ¥Ra_PLUS y) ¥Ra_LE (Ra_ABS(x) ¥Ra_PLUS Ra_ABS(y))))
                ((fq~[i0]) ¥Ra_MINUS (fq~[j0]), (fp~[i0]) ¥Ra_MINUS (fp~[j0]))-->Stat17(Stat14) ==> Ra_ABS(((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_LE (Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])))
                (Ra_ABS(((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))), (Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))))-->T473(Stat14) ==> (Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_GE Ra_ABS(((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0])))
                (eps1 ¥Ra_PLUS eps2, (Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))), Ra_ABS(((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))))-->T508(Stat14) ==> (eps1 ¥Ra_PLUS eps2) ¥Ra_GE Ra_ABS(((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0])))
                EQUAL(Stat15) ==> Ra_ABS(((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_GT eps0
                ((Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))), Ra_ABS(((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))), eps0)-->T510(Stat11*) ==> ((Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])))) ¥Ra_GT eps0
                (eps1 ¥Ra_PLUS eps2, (Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))), eps0)-->T510(Stat11*) ==> (eps1 ¥Ra_PLUS eps2) ¥Ra_GT eps0
                (eps1 ¥Ra_PLUS eps2, eps0)-->T473(Stat11*) ==> (eps1 ¥Ra_PLUS eps2) ¥Ra_GE eps0
                (eps0, eps1 ¥Ra_PLUS eps2, eps0)-->T509(Stat11*) ==> eps0 ¥Ra_GT eps0
            (eps0,eps0)-->T473(Stat11*) ==> false; Discharge ==> AUTO
--
-- Since the inclusion just proves entails that the set on the left-hand side is finite,
-- we have reached a contradiction, proving that the pointwise sum of rational Cauchy sequences
-- is an alike sequence.
--
	({(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps1) or (Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps2)}, { i * j : i in Za, j in Za | Ra_ABS(((fq ¥Ras_PLUS fp)~[i]) ¥Ra_MINUS ((fq ¥Ras_PLUS fp)~[j])) ¥Ra_GT eps0 })-->T189(Stat11) ==> false; Discharge ==>
		(Ras_ABS(fq) notin RaCauchy) or (Ras_Rev(fq) notin RaCauchy)
--
-- Assuming next that $Ras_ABS(fq)$ is not a Cauchy sequence (unlike $fq$),
-- there would exist a positive real $eps3$ for which the set
--	${ i * j : i in Za, j in Za | Ra_ABS((Ras_ABS(fq)~[i]) ¥Ra_MINUS (Ras_ABS(fq)~[j])) ¥Ra_GT eps3 }$
-- is infinite, unlike the analogous set having $fq$ in place of $Ras_ABS(fq)$.
-- However, this would lead to a conflict with the inequality (holding for all $i,j$)
--	$Ra_ABS(Ras_ABS(fq)~[i] ¥Ra_MINUS Ras_ABS(fq)~[j]) ¥Ra_LE Ra_ABS(fq~[i] ¥Ra_MINUS fq~[j])$.
--
        Suppose ==> Ras_ABS(fq) notin RaCauchy
            Use_def(RaCauchy) ==> Stat18: Ras_ABS(fq) notin {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
            ()-->Stat18 ==> Stat19: not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((Ras_ABS(fq)~[i]) ¥Ra_MINUS (Ras_ABS(fq)~[j])) ¥Ra_GT eps }))
            eps3-->Stat19 ==> (eps3 in Ra) & (eps3 ¥Ra_GT Ra_0) & (not Finite({ i * j : i in Za, j in Za | Ra_ABS((Ras_ABS(fq)~[i]) ¥Ra_MINUS (Ras_ABS(fq)~[j])) ¥Ra_GT eps3 }))
            eps3-->Stat4 ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps3 })
--
-- Indeed, since
--	${ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps3 }$
-- is a superset of
--	${ i * j : i in Za, j in Za | Ra_ABS(Ra_ABS(fq~[i]) ¥Ra_MINUS Ra_ABS(fq~[j])) ¥Ra_GT eps3 }$,
-- the latter cannot be infinite when the former is finite.
--
            Suppose ==> Stat20: not({ i * j : i in Za, j in Za | Ra_ABS((Ras_ABS(fq)~[i]) ¥Ra_MINUS (Ras_ABS(fq)~[j])) ¥Ra_GT eps3 } ¥incin { i * j : i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps3 })
                (i1,j1)-->Stat20 ==> Stat21: (i1 in Za) & (j1 in Za) & (Ra_ABS((Ras_ABS(fq)~[i1]) ¥Ra_MINUS (Ras_ABS(fq)~[j1])) ¥Ra_GT eps3) & (not(Ra_ABS((fq~[i1]) ¥Ra_MINUS (fq~[j1])) ¥Ra_GT eps3))
		(fq,fq,i1)-->T555(Stat3,Stat21*) ==> ((Ras_ABS(fq)~[i1]) = Ra_ABS(fq~[i1])) & (fq~[i1] in Ra)
		(fq,fq,j1)-->T555(Stat3,Stat21*) ==> ((Ras_ABS(fq)~[j1]) = Ra_ABS(fq~[j1])) & (fq~[j1] in Ra)
		EQUAL(Stat21) ==> Ra_ABS(Ra_ABS(fq~[i1]) ¥Ra_MINUS Ra_ABS(fq~[j1])) ¥Ra_GT eps3
                (fq~[i1])-->T527 ==> Ra_ABS(fq~[i1]) in Ra
                (fq~[j1])-->T527 ==> Ra_ABS(fq~[j1]) in Ra
                ALGEBRA(Stat21) ==> (((fq~[i1]) ¥Ra_MINUS (fq~[j1])) in Ra) & ((Ra_ABS(fq~[i1]) ¥Ra_MINUS Ra_ABS(fq~[j1])) in Ra)
                ((fq~[i1]) ¥Ra_MINUS (fq~[j1]))-->T527 ==> Ra_ABS((fq~[i1]) ¥Ra_MINUS (fq~[j1])) in Ra
                (Ra_ABS(fq~[i1]) ¥Ra_MINUS Ra_ABS(fq~[j1]))-->T527 ==> Ra_ABS(Ra_ABS(fq~[i1]) ¥Ra_MINUS Ra_ABS(fq~[j1])) in Ra
                T525 ==> Stat22: (FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_ABS(Ra_ABS(x) ¥Ra_PLUS Ra_Rev(Ra_ABS(y))) ¥Ra_LE Ra_ABS(x ¥Ra_PLUS Ra_Rev(y))))
                (fq~[i1],fq~[j1])-->Stat22 ==>  (Ra_ABS(Ra_ABS(fq~[i1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(fq~[j1]))) ¥Ra_LE Ra_ABS((fq~[i1]) ¥Ra_PLUS Ra_Rev(fq~[j1])))
                Use_def(¥Ra_MINUS) ==> Ra_ABS(Ra_ABS(fq~[i1]) ¥Ra_MINUS Ra_ABS(fq~[j1])) ¥Ra_LE Ra_ABS((fq~[i1]) ¥Ra_MINUS (fq~[j1]))
                (Ra_ABS(Ra_ABS(fq~[i1]) ¥Ra_MINUS Ra_ABS(fq~[j1])), Ra_ABS((fq~[i1]) ¥Ra_MINUS (fq~[j1])))-->T473 ==> Ra_ABS((fq~[i1]) ¥Ra_MINUS (fq~[j1])) ¥Ra_GE Ra_ABS(Ra_ABS(fq~[i1]) ¥Ra_MINUS Ra_ABS(fq~[j1]))
            (Ra_ABS((fq~[i1]) ¥Ra_MINUS (fq~[j1])), Ra_ABS(Ra_ABS(fq~[i1]) ¥Ra_MINUS Ra_ABS(fq~[j1])), eps3)-->T510 ==> false; Discharge ==> { i * j : i in Za, j in Za | Ra_ABS((Ras_ABS(fq)~[i]) ¥Ra_MINUS (Ras_ABS(fq)~[j])) ¥Ra_GT eps3 } ¥incin { i * j : i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps3 }
        ({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps3 },  {i * j : i in Za, j in Za | Ra_ABS((Ras_ABS(fq)~[i]) ¥Ra_MINUS (Ras_ABS(fq)~[j])) ¥Ra_GT eps3 })-->T189 ==> false; Discharge ==> Ras_Rev(fq) notin RaCauchy
--
-- Third and last, let us assume that $Ras_Rev(fq)$ is not a Cauchy sequence
-- (unlike $fq$). Then there would exist a positive real $eps4$ for which the set
--	${ i * j : i in Za, j in Za | Ra_ABS(Ras_Rev(fq)~[i] ¥Ra_MINUS Ras_Rev(fq)~[j]) ¥Ra_GT eps4 }$
-- is infinite, unlike the analogous set having $fq$ in place of $Ras_Rev(fq)$.
-- However, this would lead to a conflict with the equality (holding for all $i,j$)
--	$Ra_ABS(Ras_Rev(fq)~[i] ¥Ra_MINUS Ras_Rev(fq)~[j]) = Ra_ABS(fq~[i] ¥Ra_MINUS fq~[j])$.
--
            Use_def(RaCauchy) ==> Stat23: Ras_Rev(fq) notin {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
            ()-->Stat23 ==> Stat24: not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((Ras_Rev(fq)~[i]) ¥Ra_MINUS (Ras_Rev(fq)~[j])) ¥Ra_GT eps }))
            eps4-->Stat24 ==> Stat25: (eps4 in Ra) & (eps4 ¥Ra_GT Ra_0) & (not Finite({ i * j : i in Za, j in Za | Ra_ABS((Ras_Rev(fq)~[i]) ¥Ra_MINUS (Ras_Rev(fq)~[j])) ¥Ra_GT eps4 }))
            eps4-->Stat4 ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps4 })
            EQUAL(Stat25) ==> Stat26: { i * j : i in Za, j in Za | Ra_ABS((Ras_Rev(fq)~[i]) ¥Ra_MINUS (Ras_Rev(fq)~[j])) ¥Ra_GT eps4 } /= { i * j : i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps4 }
            (i2,j2)-->Stat26 ==> Stat27: (i2 in Za) & (j2 in Za) & ((Ra_ABS((Ras_Rev(fq)~[i2]) ¥Ra_MINUS (Ras_Rev(fq)~[j2])) ¥Ra_GT eps4) ¥eq (not(Ra_ABS((fq~[i2]) ¥Ra_MINUS (fq~[j2])) ¥Ra_GT eps4)))
            (fq,fq,i2)-->T555(Stat3,Stat27*) ==> Stat28: ((Ras_Rev(fq)~[i2]) = Ra_Rev(fq~[i2])) & (fq~[i2] in Ra)
            (fq,fq,j2)-->T555(Stat3,Stat27*) ==> ((Ras_Rev(fq)~[j2]) = Ra_Rev(fq~[j2])) & (fq~[j2] in Ra)
            EQUAL(Stat26) ==> Stat29: ((Ra_ABS(Ra_Rev(fq~[i2]) ¥Ra_MINUS Ra_Rev(fq~[j2])) ¥Ra_GT eps4) ¥eq (not(Ra_ABS((fq~[i2]) ¥Ra_MINUS (fq~[j2])) ¥Ra_GT eps4)))
            Suppose ==> Ra_ABS(Ra_Rev(fq~[i2]) ¥Ra_MINUS Ra_Rev(fq~[j2])) /= Ra_ABS((fq~[i2]) ¥Ra_MINUS (fq~[j2]))
		ALGEBRA(Stat28) ==> (Ra_ABS(Ra_Rev(fq~[i2]) ¥Ra_MINUS Ra_Rev(fq~[j2])) = Ra_ABS(Ra_Rev(fq~[i2]) ¥Ra_PLUS Ra_Rev(Ra_Rev(fq~[j2])))) &
				(((fq~[j2]) ¥Ra_PLUS Ra_Rev(fq~[i2])) in Ra) &
				(((fq~[i2]) ¥Ra_PLUS Ra_Rev(fq~[j2])) = ((fq~[i2]) ¥Ra_MINUS (fq~[j2]))) &
				((Ra_Rev(fq~[i2]) ¥Ra_MINUS Ra_Rev(fq~[j2])) = ((fq~[j2]) ¥Ra_PLUS Ra_Rev(fq~[i2]))) &
				(Ra_Rev((fq~[j2]) ¥Ra_PLUS Ra_Rev(fq~[i2])) = ((fq~[i2]) ¥Ra_MINUS (fq~[j2])))
                T525 ==> Stat30: (FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
                ((fq~[j2]) ¥Ra_PLUS Ra_Rev(fq~[i2]))-->Stat30 ==> Ra_ABS(Ra_Rev((fq~[j2]) ¥Ra_PLUS Ra_Rev(fq~[i2]))) = Ra_ABS((fq~[j2]) ¥Ra_PLUS Ra_Rev(fq~[i2]))
            EQUAL(Stat29) ==> false; Discharge ==> Stat31: Ra_ABS(Ra_Rev(fq~[i2]) ¥Ra_MINUS Ra_Rev(fq~[j2])) = Ra_ABS((fq~[i2]) ¥Ra_MINUS (fq~[j2]))
            Suppose ==> Ra_ABS(Ra_Rev(fq~[i2]) ¥Ra_MINUS Ra_Rev(fq~[j2])) ¥Ra_GT eps4
                EQUAL(Stat31) ==> Ra_ABS((fq~[i2]) ¥Ra_MINUS (fq~[j2])) ¥Ra_GT eps4
            (Stat29)Discharge ==> not(Ra_ABS(Ra_Rev(fq~[i2]) ¥Ra_MINUS Ra_Rev(fq~[j2])) ¥Ra_GT eps4)
            EQUAL(Stat31) ==> not(Ra_ABS((fq~[i2]) ¥Ra_MINUS (fq~[j2])) ¥Ra_GT eps4)
    (Stat29)Discharge ==> QED
--
-- Every finite set of rationals has an upper bound.
--
Theorem 557: ((S ¥incin Ra) & Finite(S)) ¥imp (EXISTS u in Ra | (FORALL y in S | u ¥Ra_GE y)). Proof:
	Suppose_not(s) ==> Stat1: (s ¥incin Ra) & Finite(s) & Stat2: (not(EXISTS u in Ra | (FORALL y in s | u ¥Ra_GE y)))
--
-- For, assuming the contrary of our thesis to hold for a subset $s$ of $Ra$, it is trivial that
-- $s$ is non-void (because $Ra$ is non-void).
--
		Suppose ==> s = 0
			T451 ==> Ra_0 in Ra
			Ra_0--> Stat2 ==> Stat3: not(FORALL y in s | Ra_0 ¥Ra_GE y)
		y0-->Stat3 ==> false; Discharge ==> Stat4: s /= 0
		s-->T0(Stat4*) ==> arb(s) in s
--
-- But then, we can exploit one of the clauses of Theorem 515 to draw the desired contradiction.
--
		T515 ==> Stat5: (FORALL t, x | (Finite(t) & (x in t) & (t ¥incin Ra)) ¥imp ((max_Ra(t) in t) & ((x = max_Ra(t)) or (x ¥Ra_LT max_Ra(t)))))
		(s,arb(s))-->Stat5(Stat1*) ==> max_Ra(s) in Ra
		(max_Ra(s))-->Stat2(Stat5*) ==> Stat6: not(FORALL y in s | max_Ra(s) ¥Ra_GE y)
		y1-->Stat6(Stat6*) ==> (y1 in s) & (not(max_Ra(s) ¥Ra_GE y1))
		(s,y1)-->Stat5(Stat1*) ==> (y1 = max_Ra(s)) or (y1 ¥Ra_LT max_Ra(s))
		(y1,max_Ra(s))-->T473(Stat6*) ==> (y1 = max_Ra(s)) or (max_Ra(s) ¥Ra_GT y1)
	(max_Ra(s),y1)-->T474(Stat1*) ==> false; Discharge ==> QED
--
-- Theorem 557 has the following 'integer' analog, needed below.
--
Theorem 558: [Every finite set of integers has a strict upper bound] ((S ¥incin Za) & Finite(S)) ¥imp (EXISTS u in Za | (FORALL y in S | y in u)). Proof+:
--
--	For supposing that $s$ is a counterexample to the assertion we can easily see that all the members of $s$ must be
--	integers and $s$ itself is finite, from which it follows that $(Un(s) + {Un(s)}) in Za$.
--
Suppose_not(s) ==> (s ¥incin Za) & Finite(s) & Stat1: (not(EXISTS u in Za | (FORALL y in s | y in u)))
	Suppose ==> Stat2: not(FORALL x in s | Ord(x))
		x1-->Stat2 ==> (x1 in Za) & (not Ord(x1))
		ELEM ==> Ord(x1)
	Discharge ==> AUTO
	s-->T280 ==> Stat2a: Ord(Un(s))
	Suppose ==> Stat3: not(FORALL x in s | Finite(x))
		x2-->Stat3(Stat3*) ==> (x2 in s) & (not Finite(x2))
		x2-->T206 ==> false
	Discharge ==> (FORALL x in s | Finite(x))
	s-->T238 ==> Stat3a: Finite(Un(s))
	(Un(s),Un(s))-->T199(Stat3a*) ==> Finite(Un(s) + {Un(s)})
	(Un(s))-->T33(Stat2a*) ==> Ord(Un(s) + {Un(s)})
	(Stat3a*)ELEM ==> (Un(s) + {Un(s)}) in Za
--
--	Hence by our initial assumption there must exist a $y in s$ which is not in $Un(s) + {Un(s)}$.
--	On the other hand $y$ is included in $s$ by definition of union, and since $y$ is not a member of $Un(s)$, while both
--	$y$ and $Un(s)$ are ordinals, it follows that $Un(s)$ is included in $y$, so that $y = Un(s)$ and hence $y in {Un(s)}$,
--	a contradiction which proves our theorem.
--
	(Un(s) + {Un(s)})-->Stat1 ==> Stat4: not(FORALL y in s | y in Un(s) + {Un(s)})
 	y-->Stat4 ==> (y in s) & (not(y in Un(s) + {Un(s)})) & (y in Za) & Ord(y)
	s-->T274 ==> Stat5: (FORALL x in s | x ¥incin Un(s))
	y-->Stat5 ==> y ¥incin Un(s)
	(Un(s),y)-->T31(Stat2a*) ==> Un(s) in y
	(y,Un(s))-->T34 ==> false; Discharge ==> QED
--
-- Every rational Cauchy sequence has an upper bound.
--
Theorem 559: [Every rational Cauchy sequence has an upper bound] (F in RaCauchy) ¥imp (EXISTS x in Ra | (FORALL y in range(F) | y ¥Ra_LE x)). Proof+:
Suppose_not(f) ==> (f in RaCauchy) & Stat1: (not(EXISTS x in Ra | (FORALL y in range(f) | y ¥Ra_LE x) ))
--
-- For let $f$ be a counterexample to our assertion, i.e. a  Cauchy sequence having no upper bound.
-- Let $i0$ be an unsigned integer past which the distance between any two components of $f$ is
-- always smaller than $Ra_1$. Since $i0$ is a finite set and $f$ a single-valued map, the range
-- of $f$ on $i0$ must also be finite.
--
	T539(*) ==> Stat1a: f in RaSeq
	f-->T546 ==> Stat2: (domain(f) = Za) & Svm(f) & (range(f) ¥incin Ra)
	ALGEBRA ==> (Ra_1 in Ra) & (Ra_0 in Ra)
	T481 ==> Ra_1 ¥Ra_GT Ra_0
	(Ra_1,f)-->T552 ==> Stat3: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (Ra_1 ¥Ra_GT Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j]))) ))
	i0-->Stat3 ==> Stat3a: (i0 in Za) & Stat4: (FORALL i in Za, j in Za | ((i notin i0) & (j notin i0)) ¥imp (Ra_1 ¥Ra_GT Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j]))) )
	T206 ==> Ord(Za)
	(Za,i0)-->T13 ==> (i0 ¥incin Za) & Finite(i0)
	(f,i0)-->T80 ==> Stat5: range(f ¥ON i0) ¥incin Ra
	(f,i0)-->T57 ==> Svm(f ¥ON i0)
	(f,i0)-->T94 ==> Stat6: domain(f ¥ON i0) = i0
	EQUAL ==> Finite(domain(f ¥ON i0))
	(f ¥ON i0)-->T192 ==> Stat7: Finite(range(f ¥ON i0))
	(f,i0)-->T126 ==> Stat8: range(f ¥ON i0) = {f~[i]: i in domain(f ¥ON i0)}
	EQUAL(Stat6,Stat8) ==> Stat9: (range(f ¥ON i0) = {f~[i]: i in i0})
	EQUAL(Stat7,Stat5,Stat9) ==> Stat10: Finite({f~[i]: i in i0}) & ({f~[i]: i in i0} ¥incin Ra)
	(f,f,i0)-->T555(Stat1a,Stat3a*) ==> Stat10a: f~[i0] in Ra
	ALGEBRA(Stat10a) ==> Stat12: (Ra_Rev(f~[i0]) in Ra) & ((f~[i0] ¥Ra_PLUS Ra_1) in Ra) &
		((Ra_1 ¥Ra_PLUS (f~[i0])) in Ra) & (Ra_1 ¥Ra_PLUS (f~[i0]) = (f~[i0]) ¥Ra_PLUS Ra_1)
	(f~[i0] ¥Ra_PLUS Ra_1)-->T201(*) ==> Stat11: Finite({f~[i0] ¥Ra_PLUS Ra_1})
--
-- It is easily seen that $f~[i0] ¥Ra_PLUS Ra_1$ is an upper bound for the set $f~[j]$ of components of $f$ for which $j notin i0$.
-- Indeed, let $j$ be a counterexample to this assertion, i.e. $j notin i0$ and $not((f~[i0] ¥Ra_PLUS Ra_1) ¥Ra_GT f~[j])$.
-- But since $Ra_1 ¥Ra_GT ((f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0]))$ we must have $f~[i0] ¥Ra_PLUS Ra_1 ¥Ra_GT f~[j]$,
-- a contradiction proving our claim.
--
	Suppose ==> Stat13: (EXISTS j in Za | ((j notin i0) & (not(((f~[i0]) ¥Ra_PLUS Ra_1) ¥Ra_GT (f~[j])))))
		j-->Stat13 ==> Stat14: (j in Za) & (j notin i0) & Stat15: (not(((f~[i0]) ¥Ra_PLUS Ra_1) ¥Ra_GT (f~[j])))
		(j,i0)-->Stat4 ==> Ra_1 ¥Ra_GT Ra_ABS((f~[j]) ¥Ra_MINUS (f~[i0]))
		Use_def(¥Ra_MINUS) ==> Ra_1 ¥Ra_GT Ra_ABS((f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0]))
		j-->T71(Stat14,Stat2) ==> Stat16: f~[j] in Ra
		ALGEBRA(Stat10a,Stat16) ==> ((f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0])) in Ra
		((f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0]))-->T527 ==> Ra_ABS((f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0])) in Ra
		((f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0]))-->T527 ==> Ra_ABS((f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0])) ¥Ra_GE ((f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0]))
		(Ra_1,Ra_ABS((f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0])),((f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0])))-->T497 ==> Ra_1 ¥Ra_GT ((f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0]))
		(f~[i0],f~[i0])-->T474 ==> (f~[i0]) ¥Ra_GE (f~[i0])
		(Ra_1,(f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0]),f~[i0],f~[i0])-->T505 ==> (Ra_1 ¥Ra_PLUS (f~[i0])) ¥Ra_GT (((f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0])) ¥Ra_PLUS (f~[i0]))
		ALGEBRA(Stat10a,Stat16) ==> ((((f~[j]) ¥Ra_PLUS Ra_Rev(f~[i0])) ¥Ra_PLUS (f~[i0])) = ((f~[j]) ¥Ra_PLUS (Ra_Rev(f~[i0]) ¥Ra_PLUS (f~[i0])))) &
				(Ra_Rev(f~[i0]) ¥Ra_PLUS (f~[i0]) = Ra_0) &
				((f~[j]) ¥Ra_PLUS Ra_0 = (f~[j]))
	EQUAL(Stat12) ==> false; Discharge ==> Stat17: not (EXISTS j in Za | ((j notin i0) & (not(((f~[i0]) ¥Ra_PLUS Ra_1) ¥Ra_GT (f~[j])))))
--
-- By Theorem 557, the finite set
-- ${f~[i]: i in i0} + {f~[i0] ¥Ra_PLUS Ra_1}$ of rationals has an upper bound $r$.
--
	({f~[i]: i in i0},{f~[i0] ¥Ra_PLUS Ra_1})-->T236(Stat10,Stat11) ==> Finite({f~[i]: i in i0} + {f~[i0] ¥Ra_PLUS Ra_1})
	ELEM ==> ({f~[i]: i in i0} + {f~[i0] ¥Ra_PLUS Ra_1}) ¥incin Ra
	({f~[i]: i in i0} + {f~[i0] ¥Ra_PLUS Ra_1})-->T557 ==> Stat18: (EXISTS u in Ra | (FORALL y in ({f~[i]: i in i0} + {f~[i0] ¥Ra_PLUS Ra_1}) | u ¥Ra_GE y))
	r-->Stat18 ==> Stat19: (r in Ra) & Stat20: (FORALL y in ({f~[i]: i in i0} + {f~[i0] ¥Ra_PLUS Ra_1}) | r ¥Ra_GE y)
--
-- But it is easily seen that $r$ must also be an upper bound for the entire Cauchy sequence $f$,
-- proving our theorem.
--
	ELEM ==> (f~[i0] ¥Ra_PLUS Ra_1) in {f~[i0] ¥Ra_PLUS Ra_1}
	(f~[i0] ¥Ra_PLUS Ra_1)-->Stat20 ==> Stat21: r ¥Ra_GE (f~[i0] ¥Ra_PLUS Ra_1)
	f-->T73 ==> range(f) = {f~[v]: v in domain(f)}
	EQUAL ==> range(f) = {f~[v]: v in Za}
	r-->Stat1 ==> Stat22: (r in Ra) & (not (FORALL y in range(f) | y ¥Ra_LE r))
	EQUAL(Stat12) ==> not(FORALL y in {f~[v]: v in Za} | y ¥Ra_LE r)
	SIMPLF ==> Stat23: not (FORALL v in Za | f~[v] ¥Ra_LE r)
	k-->Stat23 ==> Stat24: (k in Za) & (not((f~[k]) ¥Ra_LE r))
	(f~[k],r)-->T473(Stat24) ==> Stat25: not(r ¥Ra_GE (f~[k]))
	k-->T71(Stat2,Stat24) ==> Stat26: ((f~[k]) in Ra) & Stat27: ((f~[k]) in range(f))
	(f~[k])-->Stat20 ==> Stat28: not((f~[k]) in {f~[i]: i in i0})
	k-->Stat28 ==> k notin i0
	k-->Stat17 ==> Stat29: ((f~[i0]) ¥Ra_PLUS Ra_1) ¥Ra_GT (f~[k])
	((f~[i0]) ¥Ra_PLUS Ra_1,f~[k])-->T474 ==> Stat30: ((f~[i0]) ¥Ra_PLUS Ra_1) ¥Ra_GE (f~[k])
	(r,(f~[i0]) ¥Ra_PLUS Ra_1,f~[k])-->T508(Stat22,Stat12,Stat26,Stat30,Stat21) ==> Stat31: r ¥Ra_GE (f~[k])
	(Stat25,Stat31*)Discharge ==> QED
--
-- As an immediate corollary, every Cauchy sequence has an upper bound
-- for the absolute values of its components.
--
Theorem 560: (F in RaCauchy) ¥imp (EXISTS x in Ra | (FORALL y in range(F) | Ra_ABS(y) ¥Ra_LT x )). Proof:
    Suppose_not(f) ==> (f in RaCauchy) & Stat1: (not(EXISTS x in Ra | (FORALL y in range(f) | Ra_ABS(y) ¥Ra_LT x) ))
        T539(*) ==> f in RaSeq
        f-->T546 ==> (domain(f) = Za) & Svm(f) & (range(f) ¥incin Ra)
        (f,f)-->T556 ==> Ras_ABS(f) in RaCauchy
        (f,f)-->T554 ==> Ras_ABS(f) = {[u, Ra_ABS(f~[u])]: u in Za}
        (Ras_ABS(f))-->T559 ==> Stat2: (EXISTS x in Ra | (FORALL y in range(Ras_ABS(f)) | y ¥Ra_LE x ))
        c-->Stat2 ==> (c in Ra) & Stat3: (FORALL y in range(Ras_ABS(f)) | y ¥Ra_LE c )
        ALGEBRA ==> (Ra_0 in Ra) & (Ra_1 in Ra) & ((c ¥Ra_PLUS Ra_1) in Ra)
        (c ¥Ra_PLUS Ra_1)-->Stat1 ==> Stat4: not(FORALL y in range(f) | Ra_ABS(y) ¥Ra_LT (c ¥Ra_PLUS Ra_1))
        d-->Stat4 ==> (d in range(f)) & (not(Ra_ABS(d) ¥Ra_LT (c ¥Ra_PLUS Ra_1)))
        Suppose ==> Ra_ABS(d) notin range(Ras_ABS(f))
            f-->T73 ==> Stat5: d in {f~[x]: x in domain(f)}
            a-->Stat5 ==> (d = f~[a]) & (a in Za)
            TELEM ==> range({[u, Ra_ABS(f~[u])]: u in Za}) = {Ra_ABS(f~[u]): u in Za}
            EQUAL ==> (range(Ras_ABS(f)) = {Ra_ABS(f~[u]): u in Za}) & (Ra_ABS(d) = Ra_ABS(f~[a]))
            ELEM ==> Stat6: Ra_ABS(d) notin {Ra_ABS(f~[u]): u in Za}
        a-->Stat6 ==> false; Discharge ==> Ra_ABS(d) in range(Ras_ABS(f))
        (Ra_ABS(d))-->Stat3 ==> Ra_ABS(d) ¥Ra_LE c
        (Ra_ABS(d),c)-->T473 ==> c ¥Ra_GE Ra_ABS(d)
        T481 ==> Ra_1 ¥Ra_GT Ra_0
        d-->T527 ==> Ra_ABS(d) in Ra
        (c,Ra_ABS(d),Ra_1,Ra_0)-->T504 ==> (c ¥Ra_PLUS Ra_1) ¥Ra_GT (Ra_ABS(d) ¥Ra_PLUS Ra_0)
        ALGEBRA ==> (Ra_ABS(d) ¥Ra_PLUS Ra_0) = Ra_ABS(d)
        EQUAL ==> (c ¥Ra_PLUS Ra_1) ¥Ra_GT Ra_ABS(d)
    (Ra_ABS(d),c ¥Ra_PLUS Ra_1)-->T473 ==> false; Discharge ==> QED
--
--
Theorem 561: ({F,G} ¥incin RaCauchy) ¥imp (((F ¥Ras_MINUS G) in RaCauchy) & ((F ¥Ras_TIMES G) in RaCauchy)). Proof:
Suppose_not(fq,fp) ==> AUTO
--
-- Reasoning by contradiction, assume that $fq,fp$ form a counterexample
-- to the desired statement. We readily discard the possibility that
-- $(fq ¥Ras_MINUS fp) notin RaCauchy$. Only the possibility that
-- $(fq ¥Ras_TIMES fp) notin RaCauchy$ must be analyzed in detail, and
-- we will reach a contradiction in this case also.
--
	Suppose ==> Stat1: (fq ¥Ras_MINUS fp) notin RaCauchy
		Use_def(¥Ras_MINUS)(Stat1*) ==> (fq ¥Ras_PLUS Ras_Rev(fp)) notin RaCauchy
		(fp,fp)-->T556(*) ==> Ras_Rev(fp) in RaCauchy
	(fq,Ras_Rev(fp))-->T556(*) ==> false; Discharge ==> Stat2: ({fp,fq} ¥incin RaCauchy) &
		((fq ¥Ras_TIMES fp) notin RaCauchy)
--
-- Assuming that $fq ¥Ras_TIMES fp$ is not a Cauchy sequence (unlike
-- $fq$ and $fp$), there would exist a positive real $eps0$ for which
-- the set
--	${ i * j : i in Za, j in Za | Ra_ABS(((fq ¥Ras_TIMES fp)~[i]) ¥Ra_MINUS ((fq ¥Ras_TIMES fp)~[j])) ¥Ra_GT eps0 }$
-- is infinite, unlike the analogous sets which have $fp$ and $fq$, respectively,
-- in place of $fq ¥Ras_TIMES fp$ and have, in place of $eps0$, positive rationals
-- $eps1$ and $eps2$ smaller than one half of $eps0 ¥Ra_OVER m$, where $m$ is chosen
-- to be larger than the absolute value of any component of $fq$ and of any component
-- of $fp$.
--
	Use_def(RaCauchy)(Stat2*) ==> Stat3: (fq ¥Ras_TIMES fp) notin {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
	  Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))} &
			Stat4: fq in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
	  Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))} &
			Stat5: fp in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
				Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
	()-->Stat4(Stat3*) ==> Stat6: (fq in RaSeq) & Stat7: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps }))
	()-->Stat5(Stat3*) ==> Stat8: (fp in RaSeq) & Stat9: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps }))
	fq-->T546(Stat6,Stat6*) ==> Stat10: (domain(fq) = Za) & Svm(fq) & (range(fq) ¥incin Ra)
	fp-->T546(Stat8,Stat8*) ==> Stat11: (domain(fp) = Za) & Svm(fp) & (range(fp) ¥incin Ra)
	(fq,fp)-->T554(Stat6*) ==> Stat12: ((fq ¥Ras_TIMES fp) in RaSeq) &
			Stat13: ((fq ¥Ras_TIMES fp) = {[u,((fq~[u]) ¥Ra_TIMES (fp~[u]))]: u in Za})
	()-->Stat3(Stat3*) ==> Stat14: not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS(((fq ¥Ras_TIMES fp)~[i]) ¥Ra_MINUS ((fq ¥Ras_TIMES fp)~[j])) ¥Ra_GT eps }))
	eps0-->Stat14(Stat14*) ==> Stat15: (eps0 in Ra) & (eps0 ¥Ra_GT Ra_0) & (not(
			Finite({ i * j : i in Za, j in Za | Ra_ABS(((fq ¥Ras_TIMES fp)~[i]) ¥Ra_MINUS ((fq ¥Ras_TIMES fp)~[j])) ¥Ra_GT eps0 })))
	fq-->T560(Stat2,Stat2*) ==> Stat16: (EXISTS x in Ra | (FORALL y in range(fq) | Ra_ABS(y) ¥Ra_LT x ))
	mq-->Stat16(Stat16*) ==> (mq in Ra) & Stat17: (FORALL y in range(fq) | Ra_ABS(y) ¥Ra_LT mq )
	fp-->T560(Stat2,Stat2*) ==> Stat18: (EXISTS x in Ra | (FORALL y in range(fp) | Ra_ABS(y) ¥Ra_LT x ))
	mp-->Stat18(Stat18*) ==> (mp in Ra) & Stat19: (FORALL y in range(fp) | Ra_ABS(y) ¥Ra_LT mp )
	Loc_def ==> m = if (mq ¥Ra_GT mp) then mq else mp end if
	(Stat16*)ELEM ==> Stat20: m in Ra
	Suppose ==> Stat21: not(FORALL y in range(fq) | Ra_ABS(y) ¥Ra_LT m)
		y1-->Stat21(Stat21*) ==> (y1 in range(fq)) & (not(Ra_ABS(y1) ¥Ra_LT m))
		y1-->Stat17(Stat16*) ==> Ra_ABS(y1) ¥Ra_LT mq
		Suppose ==> m = mq
		EQUAL(Stat21) ==> false; Discharge ==> m /= mq
		(Stat18)ELEM ==> not(mq ¥Ra_GT mp)
		(mq,mp)-->T473(Stat16*) ==> (mp ¥Ra_GE mq) & (m = mp)
		y1-->T527(Stat10*) ==> Ra_ABS(y1) in Ra
		(Ra_ABS(y1),mq)-->T473(Stat16*) ==> mq ¥Ra_GT Ra_ABS(y1)
		(mp,mq,Ra_ABS(y1))-->T510(Stat16*) ==> mp ¥Ra_GT Ra_ABS(y1)
		EQUAL(Stat21) ==> m ¥Ra_GT Ra_ABS(y1)
	(Ra_ABS(y1),m)-->T473(Stat20*) ==> false; Discharge ==> Stat22: (FORALL y in range(fq) | Ra_ABS(y) ¥Ra_LT m)
	Suppose ==> Stat23: not(FORALL y in range(fp) | Ra_ABS(y) ¥Ra_LT m)
		y2-->Stat23(Stat23*) ==> (y2 in range(fp)) &  (not(Ra_ABS(y2) ¥Ra_LT m))
		y2-->Stat19(Stat18*) ==> Ra_ABS(y2) ¥Ra_LT mp
		Suppose ==> m = mp
		EQUAL(Stat23) ==> false; Discharge ==> m /= mp
		ELEM ==> (mq ¥Ra_GT mp) & (m = mq)
		y2-->T527(Stat11*) ==> Ra_ABS(y2) in Ra
		(Ra_ABS(y2),mp)-->T473(Stat18*) ==> mp ¥Ra_GT Ra_ABS(y2)
		(mq,mp,Ra_ABS(y2))-->T511(Stat16*) ==> mq ¥Ra_GT Ra_ABS(y2)
		EQUAL(Stat23) ==> m ¥Ra_GT Ra_ABS(y2)
	(Ra_ABS(y2),m)-->T473(Stat20*) ==> false; Discharge ==> Stat24: (FORALL y in range(fp) | Ra_ABS(y) ¥Ra_LT m )
	ALGEBRA(Stat24) ==> (Ra_0 in Ra)
	Suppose ==> not(m ¥Ra_GT Ra_0)
		ALGEBRA(Stat10,Stat10) ==> Stat25: 0 in domain(fq)
		(0,fq)-->T71(Stat2,Stat10,Stat25*) ==> Stat26: (fq~[0]) in range(fq)
		(fq~[0])-->Stat22(Stat26*) ==> Ra_ABS(fq~[0]) ¥Ra_LT m
		(fq~[0])-->T527(Stat10,Stat26*) ==> (Ra_ABS(fq~[0]) ¥Ra_GE Ra_0) & (Ra_ABS(fq~[0]) in Ra)
		(Ra_ABS(fq~[0]), m)-->T473(Stat26*) ==> m ¥Ra_GT Ra_ABS(fq~[0])
	(m, Ra_ABS(fq~[0]), Ra_0)-->T509(Stat2*) ==> false; Discharge ==> AUTO
	(m, Ra_0)-->T473(Stat2*) ==> m /= Ra_0
	m-->T462(Stat20*) ==> Stat27: (Recip(m) in Ra) & ((m ¥Ra_TIMES Recip(m)) = Ra_1)
	ALGEBRA(Stat20,Stat15,Stat27) ==> (Ra_0 = (Ra_0 ¥Ra_PLUS Ra_0)) &
		((eps0 ¥Ra_TIMES Recip(m)) in Ra) &
		((Ra_0 ¥Ra_TIMES Recip(m)) = (Recip(m) ¥Ra_TIMES Ra_0))
	m-->T491(Stat2*) ==> Recip(m) ¥Ra_GT Ra_0
	(eps0, Ra_0, Recip(m))-->T488(Stat2*) ==> (eps0 ¥Ra_TIMES Recip(m)) ¥Ra_GT (Ra_0 ¥Ra_TIMES Recip(m))
	ALGEBRA(Stat27,Stat27*) ==> (Recip(m) ¥Ra_TIMES Ra_0) = Ra_0
	EQUAL(Stat2) ==> (eps0 ¥Ra_TIMES Recip(m)) ¥Ra_GT Ra_0
	(eps0 ¥Ra_TIMES Recip(m))-->T522(Stat2*) ==> Stat28: (EXISTS e in Ra, e0 in Ra | ((eps0 ¥Ra_TIMES Recip(m)) ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e ¥Ra_GT Ra_0) & ((eps0 ¥Ra_TIMES Recip(m)) ¥Ra_GT (e ¥Ra_PLUS e0)))
	(eps1,eps2)-->Stat28 ==> Stat29: (eps1 in Ra) & (eps2 in Ra) & (eps2 ¥Ra_GT Ra_0) & (eps1 ¥Ra_GT Ra_0) & ((eps0 ¥Ra_TIMES Recip(m)) ¥Ra_GT (eps1 ¥Ra_PLUS eps2))
	(eps1,Ra_0)-->T473(Stat2*) ==> (eps1 ¥Ra_GE Ra_0)
	(eps1,Ra_0,eps2,Ra_0)-->T504(Stat2*) ==> (eps1 ¥Ra_PLUS eps2) ¥Ra_GT (Ra_0 ¥Ra_PLUS Ra_0)
	EQUAL(Stat2) ==> (eps1 ¥Ra_PLUS eps2) ¥Ra_GT Ra_0
	m-->T491(Stat2*) ==> Recip(m) ¥Ra_GT Ra_0
	ALGEBRA(Stat29,Stat20,Stat15,Stat27) ==> ((eps1 ¥Ra_PLUS eps2) in Ra) &
		(((eps0 ¥Ra_TIMES Recip(m)) ¥Ra_TIMES m) = (eps0 ¥Ra_TIMES (m ¥Ra_TIMES Recip(m)))) &
		(((eps1 ¥Ra_PLUS eps2) ¥Ra_TIMES m) = (m ¥Ra_TIMES (eps1 ¥Ra_PLUS eps2))) &
		((eps0 ¥Ra_TIMES Ra_1) = eps0)
	(eps0 ¥Ra_TIMES Recip(m), eps1 ¥Ra_PLUS eps2, m)-->T488(Stat2*) ==> ((eps0 ¥Ra_TIMES Recip(m)) ¥Ra_TIMES m) ¥Ra_GT ((eps1 ¥Ra_PLUS eps2) ¥Ra_TIMES m)
	EQUAL(Stat2) ==> eps0 ¥Ra_GT (m ¥Ra_TIMES (eps1 ¥Ra_PLUS eps2))
--
	eps2-->Stat7 ==> Stat30: Finite({ (i * j) : i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps2 })
	eps1-->Stat9 ==> Stat31: Finite({ (i * j) : i in Za, j in Za | Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps1 })
--
-- However, this assumption would lead to a conflict with the inequality (holding for all $i,j in Za$)
--	$Ra_ABS((fq ¥Ras_TIMES fp)~[i] ¥Ra_MINUS (fq ¥Ras_TIMES fp)~[j]) ¥Ra_LE (m ¥Ra_TIMES Ra_ABS((fq~[i] ¥Ra_MINUS fq~[j]) ¥Ra_PLUS (fp~[i] ¥Ra_MINUS fp~[j])))$,
-- as we are about to show.
--
	APPLY() setformer_meet_join(s->Za, t->Za, h(i,j)->(i*j), R(i,j)->(Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps2), Q(i,j)->(Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps1)) ==>
			Stat32: {(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps2) or (Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps1)} = ({(i*j): i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps2 } + {(i*j): i in Za, j in Za | Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps1 })
	({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps2 }, { i * j : i in Za, j in Za | Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps1 })-->T236(Stat30,Stat31*) ==>
			Finite({(i*j): i in Za, j in Za | Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps2 } + {(i*j): i in Za, j in Za | Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps1 })
 	EQUAL(Stat32) ==> Finite({(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps2) or (Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps1)})
	Suppose ==> Stat33: not({(i * j): i in Za, j in Za | Ra_ABS(((fq ¥Ras_TIMES fp)~[i]) ¥Ra_MINUS ((fq ¥Ras_TIMES fp)~[j])) ¥Ra_GT eps0 } ¥incin {(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps2) or (Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps1)})
--
-- If we make the temporary assumption that
--	$not({(i * j): i in Za, j in Za | Ra_ABS(((fq ¥Ras_TIMES fp)~[i]) ¥Ra_MINUS ((fq ¥Ras_TIMES fp)~[j])) ¥Ra_GT eps0 } ¥incin {(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps2) or (Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps1)})$,
-- then, by proving the above-stated inequality, we reach a contradiction as follows.
-- In the first place, observe that if $i0,j0$ are unsigned integers for which $i0*j0$
-- belongs to the set appearing as left-hand side but does not belong to the right-hand side then
--	$Ra_ABS((((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0])))) ¥Ra_GT eps0$,
--	$(Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_LE eps1) & (Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_LE eps2)$.
--
		(i0,j0)-->Stat33 ==> Stat34: (i0 in Za) & (j0 in Za) & (Ra_ABS(((fq ¥Ras_TIMES fp)~[i0]) ¥Ra_MINUS ((fq ¥Ras_TIMES fp)~[j0])) ¥Ra_GT eps0) & (not(Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_GT eps2)) & (not(Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_GT eps1))
		APPLY() fcn_symbol(f(u)->((fq~[u]) ¥Ra_TIMES (fp~[u])), g->(fq ¥Ras_TIMES fp), s->Za) ==>
			Stat35: (FORALL x | ((fq ¥Ras_TIMES fp)~[x]) = if x in Za then ((fq~[x]) ¥Ra_TIMES (fp~[x])) else 0 end if)
		i0-->Stat35(Stat34*) ==> ((fq ¥Ras_TIMES fp)~[i0]) = ((fq~[i0]) ¥Ra_TIMES (fp~[i0]))
		j0-->Stat35(Stat34*) ==> ((fq ¥Ras_TIMES fp)~[j0]) = ((fq~[j0]) ¥Ra_TIMES (fp~[j0]))
		EQUAL(Stat33) ==> Stat36: Ra_ABS((((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0])))) ¥Ra_GT eps0
--
-- Secondly, we easily check that various quantities belong to $Ra$.
--
		Suppose ==> (fq~[i0]) notin range(fq)
			fq-->T73(Stat10*) ==> Stat37: (fq~[i0]) notin {(fq~[j]): j in domain(fq)}
		i0-->Stat37(Stat10,Stat34*) ==> false; Discharge ==> Stat38: (fq~[i0]) in range(fq)
		Suppose ==> (fp~[j0]) notin range(fp)
			fp-->T73(Stat11*) ==> Stat39: (fp~[j0]) notin {(fp~[j]): j in domain(fp)}
		j0-->Stat39(Stat11,Stat34*) ==> false; Discharge ==> Stat40: (fp~[j0]) in range(fp)
		(fq,fp,i0)-->T555(Stat6,Stat8,Stat34*) ==> Stat41: ((fq~[i0]) in Ra) & ((fp~[i0]) in Ra)
		(fq,fp,j0)-->T555(Stat6,Stat8,Stat34*) ==> Stat42: ((fq~[j0]) in Ra) & ((fp~[j0]) in Ra)
		(fq~[i0])-->T527(Stat41*) ==> Stat43: Ra_ABS(fq~[i0]) in Ra
		ALGEBRA(Stat41,Stat42) ==> Stat44: (((fq~[i0]) ¥Ra_MINUS (fq~[j0])) in Ra)
		((fq~[i0]) ¥Ra_MINUS (fq~[j0]))-->T527(Stat44*) ==> Stat45: (Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) in Ra) & (Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_GE Ra_0)
		(fp~[j0])-->T527(Stat41*) ==> Stat46: Ra_ABS(fp~[j0]) in Ra
		ALGEBRA(Stat42,Stat41) ==> Stat47: ((fp~[i0]) ¥Ra_MINUS (fp~[j0])) in Ra
		((fp~[i0]) ¥Ra_MINUS (fp~[j0]))-->T527(Stat41*) ==> Stat48: (Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) in Ra) & (Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_GE Ra_0)
		ALGEBRA(Stat20,Stat29) ==> (m ¥Ra_TIMES (eps1 ¥Ra_PLUS eps2)) in Ra
		ALGEBRA(Stat41,Stat42) ==> ((((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) in Ra) &
				(((fq~[i0]) ¥Ra_TIMES ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) in Ra) &
				(((fp~[j0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_MINUS (fq~[j0]))) in Ra)
		(((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0])))-->T527(Stat41*) ==> Ra_ABS(((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_PLUS ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) in Ra
		ALGEBRA(Stat48,Stat45,Stat46,Stat43) ==> ((Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))) in Ra) &
				((Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) in Ra) &
				((Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_PLUS Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))) in Ra) &
				(((Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))) in Ra)
		ALGEBRA(Stat41) ==> Stat49: ((Ra_Rev((fq~[i0]) ¥Ra_TIMES (fp~[j0])) in Ra) & ((((fq~[i0]) ¥Ra_TIMES (fp~[j0])) ¥Ra_PLUS Ra_Rev((fq~[i0]) ¥Ra_TIMES (fp~[j0]))) = Ra_0)) &
				((((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_PLUS (Ra_Rev((fq~[i0]) ¥Ra_TIMES (fp~[j0])) ¥Ra_PLUS ((fq~[i0]) ¥Ra_TIMES (fp~[j0])))) = ((((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_PLUS Ra_Rev((fq~[i0]) ¥Ra_TIMES (fp~[j0]))) ¥Ra_PLUS ((fq~[i0]) ¥Ra_TIMES (fp~[j0]))))
		ALGEBRA(Stat41,Stat42) ==> Stat50: (((fq~[j0]) ¥Ra_TIMES (fp~[j0])) = ((fp~[j0]) ¥Ra_TIMES (fq~[j0]))) &
				((((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_PLUS Ra_Rev((fq~[i0]) ¥Ra_TIMES (fp~[j0])) ¥Ra_PLUS ((fq~[i0]) ¥Ra_TIMES (fp~[j0]))) ¥Ra_PLUS Ra_Rev((fq~[j0]) ¥Ra_TIMES (fp~[j0])) = (((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_PLUS Ra_Rev((fq~[i0]) ¥Ra_TIMES (fp~[j0]))) ¥Ra_PLUS (((fq~[i0]) ¥Ra_TIMES (fp~[j0])) ¥Ra_PLUS Ra_Rev((fq~[j0]) ¥Ra_TIMES (fp~[j0])))) &
				(((fq~[i0]) ¥Ra_TIMES (fp~[i0])) in Ra) &
				(((fq~[i0]) ¥Ra_TIMES (fp~[j0])) in Ra)
--
-- By exploiting some of the above membership relations, we easily get
--	$(eps1 ¥Ra_PLUS eps2) ¥Ra_GE (Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_PLUS Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))$,
-- and hence
--	$eps0 ¥Ra_GT ((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))$.
--
		(Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])), eps1)-->T473(Stat29*) ==> eps1 ¥Ra_GE Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))
		(Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])), eps2)-->T473(Stat29*) ==> eps2 ¥Ra_GE Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))
		(eps1, Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])), eps2, Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))-->T493(Stat29*) ==> (eps1 ¥Ra_PLUS eps2) ¥Ra_GE (Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_PLUS Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))
		Suppose ==> Stat51: not((m ¥Ra_TIMES (eps1 ¥Ra_PLUS eps2)) ¥Ra_GE ((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))))
			ALGEBRA(Stat48,Stat45,Stat20) ==> (m ¥Ra_TIMES (Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_PLUS Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))) = ((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
			Suppose ==> (eps1 ¥Ra_PLUS eps2) = (Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_PLUS Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))
				EQUAL(Stat51*) ==> (m ¥Ra_TIMES (eps1 ¥Ra_PLUS eps2)) = ((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
			(((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))), (m ¥Ra_TIMES (eps1 ¥Ra_PLUS eps2)))-->T473(Stat41*) ==> false; Discharge ==> AUTO
			(eps1 ¥Ra_PLUS eps2, Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_PLUS Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))-->T473(Stat41*) ==> (eps1 ¥Ra_PLUS eps2) ¥Ra_GT (Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_PLUS Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))
			(eps1 ¥Ra_PLUS eps2, Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_PLUS Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])), m)-->T488(Stat18*) ==> ((eps1 ¥Ra_PLUS eps2) ¥Ra_TIMES m) ¥Ra_GT ((Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_PLUS Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))) ¥Ra_TIMES m)
			ALGEBRA(Stat20,Stat29) ==> (m ¥Ra_TIMES (eps1 ¥Ra_PLUS eps2)) = ((eps1 ¥Ra_PLUS eps2) ¥Ra_TIMES m)
			ALGEBRA(Stat20,Stat48,Stat45) ==> ((Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_PLUS Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))) ¥Ra_TIMES m) = (m ¥Ra_TIMES (Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_PLUS Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
			EQUAL(Stat51*) ==> (m ¥Ra_TIMES (eps1 ¥Ra_PLUS eps2)) ¥Ra_GT ((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
		((m ¥Ra_TIMES (eps1 ¥Ra_PLUS eps2)), ((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))))-->T473(Stat51*) ==> false; Discharge ==> AUTO
		(Stat28*)ELEM ==> (m ¥Ra_TIMES (eps1 ¥Ra_PLUS eps2)) ¥Ra_GE ((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
		ALGEBRA(Stat20,Stat48,Stat45) ==> Stat52: ((m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))) in Ra) &
				((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) in Ra) &
				(((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))) in Ra)
		(eps0, m ¥Ra_TIMES (eps1 ¥Ra_PLUS eps2), (m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))-->T509(Stat15*) ==> eps0 ¥Ra_GT ((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
		(eps0, (m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))-->T473(Stat42*) ==> Stat53: eps0 ¥Ra_GE ((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
--
-- As a consequence, $eps1 ¥Ra_PLUS eps2$ is greater than or equal to
--	$Ra_ABS(((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_MINUS (fp~[j0])))$,
-- because this quantity equals
--	$Ra_ABS(((fq~[i0]) ¥Ra_TIMES ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS ((fp~[j0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))$,
--
		(Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])), eps2)-->T473(Stat35*) ==> eps2 ¥Ra_GE Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))
		(Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])), eps1)-->T473(Stat35*) ==> eps1 ¥Ra_GE Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))
		(eps1, Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])), eps2, Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))-->T493(Stat35*) ==> Stat54: (eps1 ¥Ra_PLUS eps2) ¥Ra_GE (Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_PLUS Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))
		Suppose ==> Stat55: (((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0]))) /=
							(((fq~[i0]) ¥Ra_TIMES ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS ((fp~[j0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
			ALGEBRA(Stat41,Stat42) ==> ((fq~[i0]) ¥Ra_TIMES ((fp~[i0]) ¥Ra_MINUS (fp~[j0])) = ((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[i0]) ¥Ra_TIMES (fp~[j0]))) &
				((fp~[j0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_MINUS (fq~[j0])) = ((fq~[i0]) ¥Ra_TIMES (fp~[j0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0]))) &
				((((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[i0]) ¥Ra_TIMES (fp~[j0]))) = (((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_PLUS Ra_Rev((fq~[i0]) ¥Ra_TIMES (fp~[j0])))) &
				((((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_PLUS Ra_Rev((fq~[i0]) ¥Ra_TIMES (fp~[j0]))) ¥Ra_PLUS (((fq~[i0]) ¥Ra_TIMES (fp~[j0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0]))) = (((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_PLUS (Ra_Rev((fq~[i0]) ¥Ra_TIMES (fp~[j0])) ¥Ra_PLUS ((fq~[i0]) ¥Ra_TIMES (fp~[j0])))) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0]))) &
				((Ra_Rev((fq~[i0]) ¥Ra_TIMES (fp~[j0])) ¥Ra_PLUS ((fq~[i0]) ¥Ra_TIMES (fp~[j0]))) = Ra_0) &
				((((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_PLUS Ra_0) = ((fq~[i0]) ¥Ra_TIMES (fp~[i0])))
		EQUAL(Stat55) ==> false; Discharge ==> AUTO
		(Stat54*)ELEM ==> Stat56: (((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0]))) =
							(((fq~[i0]) ¥Ra_TIMES ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS ((fp~[j0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
		EQUAL(Stat56) ==> Ra_ABS(((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0]))) =
							Ra_ABS(((fq~[i0]) ¥Ra_TIMES ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS ((fp~[j0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
-- ..., in its turn
--	$Ra_ABS(((fq~[i0]) ¥Ra_TIMES ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS ((fp~[j0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))$
-- is smaller than or equal to
--	$((Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))$,
--
		T525(Stat57*) ==> Stat57: (FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_ABS(x ¥Ra_PLUS y) ¥Ra_LE (Ra_ABS(x) ¥Ra_PLUS Ra_ABS(y))))
		(((fq~[i0]) ¥Ra_TIMES ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))), ((fp~[j0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))-->Stat57(Stat35*) ==>
					Ra_ABS(((fq~[i0]) ¥Ra_TIMES ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS ((fp~[j0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_MINUS (fq~[j0])))) ¥Ra_LE (Ra_ABS((fq~[i0]) ¥Ra_TIMES ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS Ra_ABS((fp~[j0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
		(fq~[i0], (fp~[i0]) ¥Ra_MINUS (fp~[j0]))-->T530(Stat41,Stat47*) ==> Ra_ABS((fq~[i0]) ¥Ra_TIMES ((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) = (Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])))
		(fp~[j0], (fq~[i0]) ¥Ra_MINUS (fq~[j0]))-->T530(Stat42,Stat44*) ==> Ra_ABS((fp~[j0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_MINUS (fq~[j0]))) = (Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))
		EQUAL(Stat56) ==> Ra_ABS(((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0]))) ¥Ra_LE ((Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
		(Ra_ABS(((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0]))), ((Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))))-->T473(Stat35*) ==> ((Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))) ¥Ra_GE Ra_ABS(((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0])))
--
-- ... which in its turn is smaller than or equal to
--	$(m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))$,
--
		ALGEBRA(Stat20,Stat20) ==> Stat58: m ¥Ra_TIMES Ra_0 = Ra_0
		Suppose ==> not((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_GE (Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))))
			(fq~[i0])-->Stat22(Stat38,Stat38*) ==> Ra_ABS(fq~[i0]) ¥Ra_LT m
			(Ra_ABS(fq~[i0]),m)-->T473(Stat35*) ==> m ¥Ra_GT Ra_ABS(fq~[i0])
			Suppose ==> Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) ¥Ra_GT Ra_0
				(m, Ra_ABS(fq~[i0]), Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])))-->T488(Stat20*) ==> (m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_GT (Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])))
			(m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])), (Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))))-->T473(Stat52*) ==> false; Discharge ==> AUTO
			(Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])), Ra_0)-->T473(Stat35*) ==> Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])) = Ra_0
			ALGEBRA(Stat43,Stat43) ==> (Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_0) = Ra_0
			EQUAL(Stat58*) ==> (m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) = (Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])))
		((Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))), (m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))))-->T473(Stat35*) ==> false; Discharge ==> AUTO
		Suppose ==> not((m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))) ¥Ra_GE (Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
			(fp~[j0])-->Stat24(Stat40,Stat40*) ==> Ra_ABS(fp~[j0]) ¥Ra_LT m
			(Ra_ABS(fp~[j0]),m)-->T473(Stat35*) ==> m ¥Ra_GT Ra_ABS(fp~[j0])
			Suppose ==> Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) ¥Ra_GT Ra_0
				(m, Ra_ABS(fp~[j0]), Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))-->T488(Stat20*) ==> (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))) ¥Ra_GT (Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))
			(m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])), (Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))-->T473(Stat58*) ==> false; Discharge ==> AUTO
			(Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])), Ra_0)-->T473(Stat35*) ==> Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])) = Ra_0
			ALGEBRA(Stat46,Stat46) ==> (Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_0) = Ra_0
			EQUAL(Stat58*) ==> (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))) = (Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))
		((Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))), (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))-->T473(Stat35*) ==> false; Discharge ==> AUTO
		(m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])), Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0])), m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])), Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))-->T493(Stat20*) ==>
					((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))) ¥Ra_GE ((Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0]))))
--
-- ... hence, by exploiting the transitivity laws which the ordering of rationals obeys, we
-- get to the absurd conclusion that $eps0 ¥Ra_GT eps0$.
--
		ALGEBRA(Stat41,Stat42*) ==> (((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0]))) in Ra
		(((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0])))-->T527(Stat41*) ==> Stat59: Ra_ABS(((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0]))) in Ra
		(((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))), ((Ra_ABS(fq~[i0]) ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (Ra_ABS(fp~[j0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))), Ra_ABS(((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0]))))-->T508(Stat41*) ==> Stat60:
				((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))) ¥Ra_GE Ra_ABS(((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0])))
		(((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))), Ra_ABS(((fq~[i0]) ¥Ra_TIMES (fp~[i0])) ¥Ra_MINUS ((fq~[j0]) ¥Ra_TIMES (fp~[j0]))), eps0)-->T510(Stat15,Stat59,Stat52,Stat60,Stat36*) ==> Stat61:
				((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))) ¥Ra_GT eps0
		(eps0, ((m ¥Ra_TIMES Ra_ABS((fp~[i0]) ¥Ra_MINUS (fp~[j0]))) ¥Ra_PLUS (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fq~[j0])))), eps0)-->T510(Stat15,Stat52,Stat53,Stat61*) ==> eps0 ¥Ra_GT eps0
	(eps0,eps0)-->T473(Stat58*) ==> false; Discharge ==> AUTO
	(Stat32*)ELEM ==> { (i * j) : i in Za, j in Za | Ra_ABS(((fq ¥Ras_TIMES fp)~[i]) ¥Ra_MINUS ((fq ¥Ras_TIMES fp)~[j])) ¥Ra_GT eps0 } ¥incin {(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps2) or (Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps1)}
--
-- Since the inclusion just proved entails that the set on the left-hand side is finite,
-- we have reached the desired contradiction, proving the statement of the present theorem.
--
({(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) ¥Ra_MINUS (fq~[j])) ¥Ra_GT eps1) or (Ra_ABS((fp~[i]) ¥Ra_MINUS (fp~[j])) ¥Ra_GT eps2)}, { i * j : i in Za, j in Za | Ra_ABS(((fq ¥Ras_TIMES fp)~[i]) ¥Ra_MINUS ((fq ¥Ras_TIMES fp)~[j])) ¥Ra_GT eps0 })-->T189(Stat15) ==> false; Discharge ==> QED
--
-- Preliminary to showing that the reciprocal of any rational Cauchy sequence not equivalent to the zero sequence
-- is, in its turn, a rational Cauchy sequence, we prove that
-- for every rational Cauchy sequence $g$  which is not equivalent to the everywhere null sequence,
-- there is  a positive rational number $eps$ such that all but a finite number of components of $g$
-- have an absolute value exceeding $eps$.
--
Theorem 562: ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) ¥imp (EXISTS eps in Ra | (eps ¥Ra_GT Ra_0) & Finite({i in Za | eps ¥Ra_GE Ra_ABS(G~[i])})). Proof+:
Suppose_not(g) ==> (g in RaCauchy) & (not Ra_eqseq(g,Ra0Seq)) & Stat1: (not (EXISTS eps in Ra | (eps ¥Ra_GT Ra_0) & Finite({i in Za | eps ¥Ra_GE Ra_ABS(g~[i])})))
--
-- For, suppose the contrary, namely that $g$ is a rational Cauchy sequence which is not equivalent to the everywhere null sequence,
-- and that $g$ has, for every positive rational $eps$, an infinite number of components whose absolute value does not exceed $eps$.
-- We will reach a contradiction as follows.
--
-- Various obvious facts immediately follow from $g$ being a non-zero rational Cauchy sequence; in particular:
-- (1) there is a positive rational $eps0$ such that infinitely many components of $g$ have an absolute value larger than $eps0$,
-- and (2) there is an integer $k0$ such that the distance between any two components of $g$, beyond the $k0$-th component,
-- is smaller than $eps1$, where $eps1$ and $eps2$ are positive rationals whose sum is inferior to $eps0$.
--
	Use_def(Ra_eqseq) ==> Stat2: (not (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp Finite({x : x in domain(g) | Ra_ABS((g~[x]) ¥Ra_MINUS (Ra0Seq~[x])) ¥Ra_GT eps})))
	eps0-->Stat2 ==> Stat3: (eps0 in Ra) & (eps0 ¥Ra_GT Ra_0) & (not Finite({x : x in domain(g) | Ra_ABS((g~[x]) ¥Ra_MINUS (Ra0Seq~[x])) ¥Ra_GT eps0}))
	eps0-->T522 ==> Stat4: (EXISTS e in Ra, e0 in Ra | (eps0 ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e ¥Ra_GT Ra_0) & (eps0 ¥Ra_GT (e ¥Ra_PLUS e0)))
	(eps1,eps2)-->Stat4 ==> Stat5: (eps1 in Ra) & (eps2 in Ra) & (eps2 ¥Ra_GT Ra_0) & (eps1 ¥Ra_GT Ra_0) & (eps0 ¥Ra_GT (eps1 ¥Ra_PLUS eps2))
	(eps1,g)-->T552 ==> Stat6: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (eps1 ¥Ra_GT Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j]))) ))
	k0-->Stat6 ==> Stat6a: (k0 in Za) & Stat7: (FORALL i in Za, j in Za | ((i notin k0) & (j notin k0)) ¥imp (eps1 ¥Ra_GT Ra_ABS((g~[i]) ¥Ra_MINUS (g~[j]))) )
	Use_def(RaCauchy) ==> Stat8: g in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
	()-->Stat8 ==> Stat9: g in RaSeq
	g-->T546 ==> (domain(g) = Za) & (range(g) ¥incin Ra)
--
-- We then argue that for some integer $k1$ greater than or equal to $k0$,
-- the absolute value of the $k1$-th component of $g$ exceeds $eps0$.
--
	Suppose ==> Stat10: not(EXISTS k in (Za - k0) | Ra_ABS(g~[k]) ¥Ra_GT eps0)
	    Suppose ==> {x : x in domain(g) | Ra_ABS((g~[x]) ¥Ra_MINUS (Ra0Seq~[x])) ¥Ra_GT eps0} /= {x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0}
		EQUAL ==> Stat11: {x : x in Za | Ra_ABS((g~[x]) ¥Ra_MINUS (Ra0Seq~[x])) ¥Ra_GT eps0} /= {x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0}
		x0-->Stat11 ==> Stat11a: (x0 in Za) & ((Ra_ABS((g~[x0]) ¥Ra_MINUS (Ra0Seq~[x0])) ¥Ra_GT eps0) ¥eq (not(Ra_ABS(g~[x0]) ¥Ra_GT eps0)))
		x0-->T548(Stat11a*) ==> (Ra0Seq~[x0]) = Ra_0
		(g,x0)-->T540(Stat9,Stat11a*) ==> Stat10a: (g~[x0]) in Ra
		(g~[x0])-->T527(Stat10a*) ==> Ra_ABS(g~[x0]) in Ra
		ALGEBRA(Stat10a) ==> ((g~[x0]) ¥Ra_MINUS Ra_0) = (g~[x0])
	    EQUAL(Stat8) ==> false; Discharge ==> AUTO
	    TELEM ==> {x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0} = ({x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0} * k0) + ({x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0} - k0)
            EQUAL ==> Stat12: not Finite(({x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0} * k0) + ({x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0} - k0))
	    ({x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0},{x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0} * k0)-->T189 ==> Finite({x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0} * k0)
	    ({x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0} * k0,{x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0} - k0)-->T236(Stat12) ==> not Finite({x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0} - k0)
	    TELEM ==> Finite(0)
	    EQUAL ==>  Stat13: ({x : x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0} - k0) /= 0
	    kp-->Stat13(Stat13*) ==> (kp notin k0) & Stat14: (kp in {x: x in Za | Ra_ABS(g~[x]) ¥Ra_GT eps0})
	    xp-->Stat14 ==> (kp = xp) & (kp in Za) & (Ra_ABS(g~[xp]) ¥Ra_GT eps0)
	    EQUAL ==> Ra_ABS(g~[kp]) ¥Ra_GT eps0
	kp-->Stat10 ==> false; Discharge ==> Stat15: (EXISTS k in (Za - k0) | Ra_ABS(g~[k]) ¥Ra_GT eps0)
	k1-->Stat15 ==> Stat16: (k1 in (Za - k0)) & (Ra_ABS(g~[k1]) ¥Ra_GT eps0) & (k1 in Za)
--
-- If we now take an integer $k2$ greater than $k1$ where the absolute value of $g$ does not exceed $eps2$, ...
--
	eps2-->Stat1 ==> not Finite({i in Za | eps2 ¥Ra_GE Ra_ABS(g~[i])})
	T206 ==> Ord(Za)
	(Za,k1)-->T13(Stat16) ==> Za = k1 + (Za - k1)
	Suppose ==> Stat17: {i in Za | eps2 ¥Ra_GE Ra_ABS(g~[i])} /= ({i in k1 | eps2 ¥Ra_GE Ra_ABS(g~[i])} + {i in (Za - k1) | eps2 ¥Ra_GE Ra_ABS(g~[i])})
	    Set_monot ==> ({i in k1 | eps2 ¥Ra_GE Ra_ABS(g~[i])} ¥incin {i in Za | eps2 ¥Ra_GE Ra_ABS(g~[i])})
	    Set_monot ==> ({i in (Za - k1) | eps2 ¥Ra_GE Ra_ABS(g~[i])} ¥incin {i in Za | eps2 ¥Ra_GE Ra_ABS(g~[i])})
	    (Stat17)ELEM ==> Stat18: not({i in Za | eps2 ¥Ra_GE Ra_ABS(g~[i])} ¥incin ({i in k1 | eps2 ¥Ra_GE Ra_ABS(g~[i])} + {i in (Za - k1) | eps2 ¥Ra_GE Ra_ABS(g~[i])}))
	    iq-->Stat18(Stat18) ==> (not(iq in {i in k1 | eps2 ¥Ra_GE Ra_ABS(g~[i])} + {i in (Za - k1) | eps2 ¥Ra_GE Ra_ABS(g~[i])})) & Stat19: (iq in {i in Za | eps2 ¥Ra_GE Ra_ABS(g~[i])})
	    ()-->Stat19(Stat18*) ==> (iq in Za) & (eps2 ¥Ra_GE Ra_ABS(g~[iq])) & Stat20: (iq notin {i in k1 | eps2 ¥Ra_GE Ra_ABS(g~[i])}) & Stat21: (iq notin {i in (Za - k1) | eps2 ¥Ra_GE Ra_ABS(g~[i])})
	    iq-->Stat20(Stat18*) ==> iq notin k1
	iq-->Stat21(Stat18*) ==> false; Discharge ==> {i in Za | eps2 ¥Ra_GE Ra_ABS(g~[i])} = ({i in k1 | eps2 ¥Ra_GE Ra_ABS(g~[i])} + {i in (Za - k1) | eps2 ¥Ra_GE Ra_ABS(g~[i])})
	EQUAL ==> not Finite({i in k1 | eps2 ¥Ra_GE Ra_ABS(g~[i])} + {i in (Za - k1) | eps2 ¥Ra_GE Ra_ABS(g~[i])})
	Suppose ==> Stat22: not({i in k1 | eps2 ¥Ra_GE Ra_ABS(g~[i])} ¥incin k1)
	    Set_monot ==> {i: i in k1 | eps2 ¥Ra_GE Ra_ABS(g~[i])} ¥incin {i: i in k1}
	(Stat22)Discharge ==> AUTO
	(k1,{i in k1 | eps2 ¥Ra_GE Ra_ABS(g~[i])})-->T189(Stat16*) ==> Finite({i in k1 | eps2 ¥Ra_GE Ra_ABS(g~[i])})
	({i in k1 | eps2 ¥Ra_GE Ra_ABS(g~[i])},{i in (Za - k1) | eps2 ¥Ra_GE Ra_ABS(g~[i])})-->T236 ==> not Finite({i in (Za - k1) | eps2 ¥Ra_GE Ra_ABS (g~[i])})
	TELEM ==> Finite(0)
	EQUAL ==> Stat23: {i in (Za - k1) | eps2 ¥Ra_GE Ra_ABS(g~[i])} /= 0
	k2-->Stat23 ==> Stat24: (k2 in (Za - k1)) & (eps2 ¥Ra_GE Ra_ABS(g~[k2])) & (k2 in Za)
--
-- ...then the distance between $g~[k1]$ and $g~[k2]$ exceeds $eps1$, which is absurd.
-- This contradiction gives the desired conclusion.
--
	T525 ==> Stat25: (FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_LE y) & (y ¥Ra_LE z)) ¥imp (x ¥Ra_LE z))) &
				Stat26: (FORALL x | (x in Ra) ¥imp (x ¥Ra_LE Ra_ABS(x))) &
        	 Stat27: (FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_ABS(Ra_ABS(x) ¥Ra_PLUS Ra_Rev(Ra_ABS(y))) ¥Ra_LE Ra_ABS(x ¥Ra_PLUS Ra_Rev(y)))) &
				Stat28: (FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp ((x ¥Ra_LE y) ¥imp ((x ¥Ra_PLUS z) ¥Ra_LE (y ¥Ra_PLUS z)))) &
				Stat29: (FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) ¥imp (((x ¥Ra_LE y) & (x /= y)) ¥imp ((x ¥Ra_PLUS z) /= (y ¥Ra_PLUS z))))
	(g,k1)-->T540(Stat9,Stat16*) ==> Stat25a: (g~[k1]) in Ra
	(g~[k1])-->T527(Stat25a*) ==> Stat26a: Ra_ABS(g~[k1]) in Ra
	(g,k2)-->T540(Stat9,Stat24*) ==> Stat27a: (g~[k2]) in Ra
	(g~[k2])-->T527(Stat27a*) ==> Stat30: Ra_ABS(g~[k2]) in Ra
	ALGEBRA(Stat25a*) ==> Stat31: (((g~[k1]) ¥Ra_MINUS (g~[k2])) = ((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2]))) &
        	((Ra_ABS(g~[k1]) ¥Ra_MINUS Ra_ABS(g~[k2])) = (Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))) &
		(Ra_Rev(Ra_ABS(g~[k2])) in Ra) &
		((Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) in Ra)
	(g~[k1],g~[k2])-->Stat27 ==> Ra_ABS(Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) ¥Ra_LE Ra_ABS((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2]))
	(Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))-->Stat26 ==> Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])) ¥Ra_LE Ra_ABS(Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))
	(Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))-->T527 ==> Ra_ABS(Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) in Ra
	ALGEBRA(Stat25a,Stat27a) ==> ((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2])) in Ra
	((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2]))-->T527 ==> Stat33: Ra_ABS((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2])) in Ra
	(Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])),Ra_ABS(Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))),Ra_ABS((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2])))-->Stat25 ==> Stat34: (Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) ¥Ra_LE Ra_ABS((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2]))
--
--
--
	(Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])),Ra_ABS((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2])))-->T473(Stat34) ==> Ra_ABS((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2])) ¥Ra_GE (Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))
	ALGEBRA(Stat26a,Stat30) ==> (Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) = (Ra_Rev(Ra_ABS(g~[k2])) ¥Ra_PLUS Ra_ABS(g~[k1]))
	EQUAL(Stat33) ==> Ra_ABS((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2])) ¥Ra_GE (Ra_Rev(Ra_ABS(g~[k2])) ¥Ra_PLUS Ra_ABS(g~[k1]))
	(Ra_Rev(Ra_ABS(g~[k2])),Ra_Rev(Ra_ABS(g~[k2])))-->T495 ==> Ra_Rev(Ra_ABS(g~[k2])) ¥Ra_GE Ra_Rev(Ra_ABS(g~[k2]))
	(Ra_Rev(Ra_ABS(g~[k2])),Ra_Rev(Ra_ABS(g~[k2])),Ra_ABS(g~[k1]),eps0)-->T504 ==> (Ra_Rev(Ra_ABS(g~[k2])) ¥Ra_PLUS Ra_ABS(g~[k1])) ¥Ra_GT (Ra_Rev(Ra_ABS(g~[k2])) ¥Ra_PLUS eps0)
	ALGEBRA(Stat26a,Stat30) ==> Ra_Rev(Ra_ABS(g~[k2])) ¥Ra_PLUS Ra_ABS(g~[k1]) = Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))
	ALGEBRA(Stat30,Stat3) ==> Stat41: ((eps0 ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) in Ra) & (Ra_Rev(Ra_ABS(g~[k2])) ¥Ra_PLUS eps0 = eps0 ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))
	EQUAL(Stat33) ==> Stat35: (Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) ¥Ra_GT (eps0 ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))
	(eps2,Ra_ABS(g~[k2]))-->T502(Stat24,Stat5,Stat30*) ==> Stat36: Ra_Rev(Ra_ABS(g~[k2])) ¥Ra_GE Ra_Rev(eps2)
	(eps0,eps0)-->T495(Stat3,Stat3*) ==> Stat37: eps0 ¥Ra_GE eps0
	ALGEBRA(Stat5,Stat5) ==> Stat38: Ra_Rev(eps2) in Ra
	(eps0,eps0,Ra_Rev(Ra_ABS(g~[k2])),Ra_Rev(eps2))-->T493(Stat3,Stat36,Stat37,Stat38,Stat31) ==> Stat39: (eps0 ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) ¥Ra_GE (eps0 ¥Ra_PLUS Ra_Rev(eps2))
	ALGEBRA(Stat3,Stat5) ==> Stat40: (eps0 ¥Ra_PLUS Ra_Rev(eps2)) in Ra
	((Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))),(eps0 ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))),(eps0 ¥Ra_PLUS Ra_Rev(eps2)))-->T509(Stat35,Stat39,Stat31,Stat40,Stat41) ==>
				(Ra_ABS(g~[k1])¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) ¥Ra_GT (eps0 ¥Ra_PLUS Ra_Rev(eps2))
	(Ra_Rev(eps2),Ra_Rev(eps2))-->T495(Stat38,Stat38*) ==> Ra_Rev(eps2) ¥Ra_GE Ra_Rev(eps2)
	(eps0,eps1 ¥Ra_PLUS eps2)-->T473 ==> eps0 ¥Ra_GE (eps1 ¥Ra_PLUS eps2)
	ALGEBRA(Stat5,Stat5) ==> (((eps1 ¥Ra_PLUS eps2) ¥Ra_PLUS Ra_Rev(eps2)) = (eps1 ¥Ra_PLUS (eps2 ¥Ra_PLUS Ra_Rev(eps2)))) &
				((eps2 ¥Ra_PLUS Ra_Rev(eps2)) = Ra_0) & ((eps1 ¥Ra_PLUS Ra_0) = eps1) & ((eps1 ¥Ra_PLUS eps2) in Ra)
	(eps0,eps1 ¥Ra_PLUS eps2,Ra_Rev(eps2),Ra_Rev(eps2))-->T493 ==> (eps0 ¥Ra_PLUS Ra_Rev(eps2)) ¥Ra_GE ((eps1 ¥Ra_PLUS eps2) ¥Ra_PLUS Ra_Rev(eps2))
	EQUAL(Stat33) ==> (eps0 ¥Ra_PLUS Ra_Rev(eps2)) ¥Ra_GE eps1
	((Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))),(eps0 ¥Ra_PLUS Ra_Rev(eps2)),eps1)-->T509 ==> (Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) ¥Ra_GT eps1
	(Ra_ABS((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2])),Ra_ABS(g~[k1]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])),eps1)-->T510 ==> Stat42: Ra_ABS((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2])) ¥Ra_GT eps1
	Suppose ==> k2 in k0
	    (k0,k1)-->T35(Stat16,Stat6a*) ==> Stat42a: k0 ¥incin k1
	    (k1,k2)-->T35(Stat24,Stat16,Stat42a*) ==> k0 ¥incin k2
	(k0,k2)-->T35 ==> false; Discharge ==> Stat43: k2 notin k0
	(k1,k2)-->Stat7(Stat43,Stat16,Stat24*) ==> eps1 ¥Ra_GT Ra_ABS((g~[k1]) ¥Ra_MINUS (g~[k2]))
	(eps1,Ra_ABS((g~[k1]) ¥Ra_MINUS (g~[k2])))-->T473 ==> eps1 ¥Ra_GE Ra_ABS((g~[k1]) ¥Ra_MINUS (g~[k2]))
	Use_def(¥Ra_MINUS) ==> Stat44: eps1 ¥Ra_GE Ra_ABS((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2]))
	(eps1,Ra_ABS((g~[k1]) ¥Ra_PLUS Ra_Rev(g~[k2])),eps1)-->T510(Stat44,Stat42,Stat5,Stat33*) ==> eps1 ¥Ra_GT eps1
	(eps1,eps1)-->T473 ==> Stat45: eps1 ¥Ra_LT eps1
	T513 ==> Stat46: (FORALL x in Ra | not(x ¥Ra_LT x))
	eps1-->Stat46(Stat45,Stat5*) ==> false; Discharge ==> QED
--
-- An alternative way of stating Theorem 562 is to say that for every rational
-- Cauchy sequence $g$  which is not equivalent to the everywhere null sequence,
-- there exists a positive rational number $eps$ and an unsigned integer $n$
-- beyond which all the components $g~[i]$ of $g$ have an absolute value greater than $eps$.
--
Theorem 563: ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) ¥imp (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
		(FORALL i in (Za - n) | (Ra_ABS(G~[i]) ¥Ra_GT eps) & (Ra_ABS(G~[i]) ¥Ra_GT Ra_0)) & (Ra_ABS(G~[n]) ¥Ra_GT Ra_0)). Proof:
    Suppose_not(g) ==> (g in RaCauchy) & (not Ra_eqseq(g,Ra0Seq)) & Stat1: (not(EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) & (FORALL i in (Za - n) | (Ra_ABS(g~[i]) ¥Ra_GT eps) & (Ra_ABS(g~[i]) ¥Ra_GT Ra_0)) & (Ra_ABS(g~[n]) ¥Ra_GT Ra_0)))
        g-->T562 ==> Stat2: (EXISTS eps in Ra | (eps ¥Ra_GT Ra_0) & Finite({i in Za | eps ¥Ra_GE Ra_ABS(g~[i])}))
        a-->Stat2 ==> (a in Ra) & (a ¥Ra_GT Ra_0) & Finite({i in Za | a ¥Ra_GE Ra_ABS(g~[i])})
        Suppose ==> Stat3: not(EXISTS n in Za | (FORALL i in (Za - n) | (Ra_ABS(g~[i]) ¥Ra_GT a) & (Ra_ABS(g~[i]) ¥Ra_GT Ra_0)) & (Ra_ABS(g~[n]) ¥Ra_GT Ra_0))
            APPLY(bynd_thryvar:m) unsigned_integer_bynd(Q1(i)->(a ¥Ra_GE Ra_ABS(g~[i]))) ==>
				(m in Za) & (Za incs m) & Ord(m) & (not Finite (Za - m)) & Stat4: (FORALL i in Za | ((a ¥Ra_GE Ra_ABS(g~[i])) ¥imp (i in m)))
            Use_def(RaCauchy) ==> Stat5: g in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
            ()-->Stat5 ==> g in RaSeq
            g-->T546 ==> Stat6: (domain(g) = Za) & (range(g) ¥incin Ra)
            Suppose ==> Stat7: not(FORALL i in (Za - m) | Ra_ABS(g~[i]) ¥Ra_GT a)
                i0-->Stat7 ==> Stat8: (i0 in (Za - m)) & (not(Ra_ABS(g~[i0]) ¥Ra_GT a))
                (Ra_ABS(g~[i0]),a)-->T473 ==> not((Ra_ABS(g~[i0]) ¥Ra_GT a) & (Ra_ABS(g~[i0]) /= a))
                (i0,g)-->T71(Stat6,Stat8) ==> (g~[i0]) in Ra
                (g~[i0])-->T527 ==> Ra_ABS(g~[i0]) in Ra
                (Ra_ABS(g~[i0]),a)-->T473 ==> a ¥Ra_GE Ra_ABS(g~[i0])
            i0-->Stat4 ==> false; Discharge ==> Stat9: (FORALL i in (Za - m) | Ra_ABS(g~[i]) ¥Ra_GT a)
            Suppose ==> Stat10: not(FORALL i in (Za - m) | (Ra_ABS(g~[i]) ¥Ra_GT a) & (Ra_ABS(g~[i]) ¥Ra_GT Ra_0))
                i1-->Stat10 ==> Stat11: (i1 in (Za - m)) & (not((Ra_ABS(g~[i1]) ¥Ra_GT a) & (Ra_ABS(g~[i1]) ¥Ra_GT Ra_0)))
                i1-->Stat9 ==> (i1 in (Za - m)) & (Ra_ABS(g~[i1]) ¥Ra_GT a)
                (Ra_ABS(g~[i1]),a)-->T473 ==> (Ra_ABS(g~[i1]) ¥Ra_GE a)
                T451 ==> Ra_0 in Ra
                (i1,g)-->T71(Stat6,Stat11) ==> (g~[i1]) in Ra
                (g~[i1])-->T527 ==> Ra_ABS(g~[i1]) in Ra
            (Ra_ABS(g~[i1]),a,Ra_0)-->T510 ==> false; Discharge ==> Stat12: (FORALL i in (Za - m) | (Ra_ABS(g~[i]) ¥Ra_GT a) & (Ra_ABS(g~[i]) ¥Ra_GT Ra_0))
            m-->Stat12 ==> Ra_ABS(g~[m]) ¥Ra_GT Ra_0
        m-->Stat3 ==> false; Discharge ==> Stat13: (EXISTS n in Za | (FORALL i in (Za - n) | (Ra_ABS(g~[i]) ¥Ra_GT a) & (Ra_ABS(g~[i]) ¥Ra_GT Ra_0)) & (Ra_ABS(g~[n]) ¥Ra_GT Ra_0))
        n0-->Stat13 ==> (n0 in Za) & (FORALL i in (Za - n0) | (Ra_ABS(g~[i]) ¥Ra_GT a) & (Ra_ABS(g~[i]) ¥Ra_GT Ra_0)) & (Ra_ABS(g~[n0]) ¥Ra_GT Ra_0)
    (a,n0)-->Stat1 ==> false; Discharge ==> QED
--
-- It follows from Theorem 563 that for every rational
-- Cauchy sequence $h$  which is not equivalent to the everywhere null sequence,
-- there exists a positive rational number $eps$ and an unsigned integer $n$
-- beyond which:
-- (1) all the components $h~[i]$ of $h$ have an absolute value greater than $eps$;
-- (2) all the components $h~[j], h~[i]$ of $h$ differ by less than $eps$.
--
Theorem 564: ((H in RaCauchy) & (not Ra_eqseq(H,Ra0Seq))) ¥imp (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
	(FORALL i in (Za - n) | Ra_ABS(H~[i]) ¥Ra_GT eps) &
	(FORALL i in Za, j in Za | ((i notin n) & (j notin n)) ¥imp (eps ¥Ra_GT (Ra_ABS((H~[i]) ¥Ra_MINUS (H~[j])))))). Proof:
Suppose_not(h) ==> ((h in RaCauchy) & (not Ra_eqseq(h,Ra0Seq))) &
	Stat1: (not(EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
		(FORALL i in (Za - n) | Ra_ABS(h~[i]) ¥Ra_GT eps) &
		(FORALL i in Za, j in Za | ((i notin n) & (j notin n)) ¥imp (eps ¥Ra_GT (Ra_ABS((h~[i]) ¥Ra_MINUS (h~[j])))))))
--
-- Let the Cauchy sequence $h$ be a counterexample to our claim.
-- Then, by Theorem 563, there exists a positive rational $eps0$ and an integer $n0$
-- beyond which all the components $h~[i]$ of $h$ have an absolute value greater than $eps0$.
--
	h-->T563(*) ==> Stat2: (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
		(FORALL i in (Za - n) | (Ra_ABS(h~[i]) ¥Ra_GT eps) & (Ra_ABS(h~[i]) ¥Ra_GT Ra_0)) & (Ra_ABS(h~[n]) ¥Ra_GT Ra_0))
	(eps0,n0)-->Stat2(Stat2*) ==> Stat3: (eps0 in Ra) & (n0 in Za) & (eps0 ¥Ra_GT Ra_0) &
		Stat4: (FORALL i in (Za - n0) | (Ra_ABS(h~[i]) ¥Ra_GT eps0) & (Ra_ABS(h~[i]) ¥Ra_GT Ra_0)) & (Ra_ABS(h~[n0]) ¥Ra_GT Ra_0)
--
-- Moreover, exploiting Theorem 552 we can pick an integer $n1$ beyond which
-- all the components $h~[j], h~[i]$ of $h$ differ by less than $eps0$.
--
	(eps0,h)-->T552(*) ==> Stat5: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (eps0 ¥Ra_GT (Ra_ABS((h~[i]) ¥Ra_MINUS (h~[j])))) ))
	n1-->Stat5(Stat5*) ==> Stat6: (n1 in Za) & Stat7: (FORALL i in Za, j in Za | ((i notin n1) & (j notin n1)) ¥imp (eps0 ¥Ra_GT (Ra_ABS((h~[i]) ¥Ra_MINUS (h~[j])))) )
--
-- Hence, letting $n2$ be greater than the maximum of $n0$ and $n1$, it follows that both of
-- the preceding conditions are satisfied by all the components $h~[j], h~[i]$ of $h$ beyond $n2$.
--
	(n0,n1)-->T202(Stat6*) ==> Stat8: Finite({n0,n1})
	({n0,n1})-->T558(Stat3,Stat6,Stat8*) ==> Stat9: (EXISTS i in Za | (FORALL j in {n0,n1} | j in i))
	n2-->Stat9(Stat9*) ==> Stat10: (n2 in Za) & Stat11: (FORALL j in {n0,n1} | j in n2)
	n0-->Stat11(Stat10*) ==> Stat12: n0 in n2
	Suppose ==> Stat13: not(FORALL i in (Za - n2) | Ra_ABS(h~[i]) ¥Ra_GT eps0)
		i0-->Stat13(Stat13*) ==> Stat14: (i0 in (Za - n2)) & (not(Ra_ABS(h~[i0]) ¥Ra_GT eps0))
		(n2,n0,i0)-->T208(Stat10,Stat3,Stat12,Stat14) ==> Stat15: i0 notin n0
	i0-->Stat4(Stat15,Stat14*) ==> false; Discharge ==> Stat16: (FORALL i in (Za - n2) | Ra_ABS(h~[i]) ¥Ra_GT eps0)
	n1-->Stat11(Stat10,Stat10*) ==> Stat17: n1 in n2
	Suppose ==> Stat18: not(FORALL i in Za, j in Za | ((i notin n2) & (j notin n2)) ¥imp (eps0 ¥Ra_GT (Ra_ABS((h~[i]) ¥Ra_MINUS (h~[j])))) )
		(i1,i2)-->Stat18(Stat18*)==> Stat19: (i1 in Za) & (i2 in Za) & (i1 notin n2) & (i2 notin n2) & (not(eps0 ¥Ra_GT (Ra_ABS((h~[i1]) ¥Ra_MINUS (h~[i2])))))
		(n2,n1,i1)-->T208(Stat10,Stat6,Stat17,Stat19) ==> i1 notin n1
		(n2,n1,i2)-->T208(Stat10,Stat6,Stat17,Stat19) ==> i2 notin n1
	(i1,i2)-->Stat7(Stat19*) ==> false; Discharge ==> Stat20: (FORALL i in Za, j in Za | ((i notin n2) & (j notin n2)) ¥imp (eps0 ¥Ra_GT (Ra_ABS((h~[i]) ¥Ra_MINUS (h~[j])))) )
(eps0,n2)-->Stat1(Stat3,Stat10,Stat16,Stat20*) ==> false; Discharge ==> QED
--
-- Preliminary to showing that the reciprocal of any rational Cauchy sequence not equivalent to the zero sequence
-- is, in its turn, a rational Cauchy sequence, we prove that every  rational Cauchy sequence not equivalent to
-- the zero sequence has, from a certain point on, only non-zero components.
--
Theorem 565: ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) ¥imp ({h in Za | (FORALL i in (Za - h) | (G~[i]) /= Ra_0)} /= 0). Proof:
Suppose_not(g) ==> (g in RaCauchy) & (not Ra_eqseq(g,Ra0Seq)) & Stat1: ({h in Za | (FORALL i in (Za - h) | (g~[i]) /= Ra_0)} = 0)
	g-->T563 ==> Stat2: (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
			(FORALL i in (Za - n) | (Ra_ABS(g~[i]) ¥Ra_GT eps) & (Ra_ABS(g~[i]) ¥Ra_GT Ra_0)) & (Ra_ABS(g~[n]) ¥Ra_GT Ra_0))
	(a,n)-->Stat2 ==> Stat3: (FORALL i in (Za - n) | (Ra_ABS(g~[i]) ¥Ra_GT a) & (Ra_ABS(g~[i]) ¥Ra_GT Ra_0)) & (Ra_ABS(g~[n]) ¥Ra_GT Ra_0) & (a in Ra) & (n in Za) & (a ¥Ra_GT Ra_0)
	n-->Stat1 ==> Stat4: not(FORALL i in (Za - n) | (g~[i]) /= Ra_0)
	i0-->Stat4 ==> Stat5: (i0 in (Za - n)) & ((g~[i0]) = Ra_0)
	i0-->Stat3 ==> Ra_ABS(g~[i0]) ¥Ra_GT a
	Use_def(RaCauchy) ==> Stat6: g in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
	()-->Stat6 ==> g in RaSeq
	g-->T546 ==> Stat7: (domain(g) = Za) & (range(g) ¥incin Ra)
	(i0,g)-->T71(Stat7,Stat5*) ==> (g~[i0]) in Ra
	(g~[i0])-->T527 ==> Ra_ABS(g~[i0]) in Ra
	(a,Ra_0)-->T473(Stat3*) ==> a ¥Ra_GE Ra_0
	(Ra_ABS(g~[i0]),a,Ra_0)-->T509 ==> Ra_ABS(g~[i0]) ¥Ra_GT Ra_0
	(Ra_ABS(g~[i0]),Ra_0)-->T473 ==> Ra_ABS(g~[i0]) /= Ra_0
	T525 ==> Stat8: (FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0)))
(g~[i0])-->Stat8 ==> false; Discharge ==> QED
--
Theorem 566: ((F in RaSeq) & (M = arb({h in Za | (FORALL i in (Za - h) | (F~[i]) /= Ra_0)}))) ¥imp (Ras_Recip(F) = Ras_Recip(shifted_seq(F,M))). Proof+:
Suppose_not(f,m) ==> AUTO
--
-- Reasoning by contradiction, assume that $f$ is a counterexample.
--
	Use_def(Ras_Recip) ==> Stat1: (m = arb({h in Za | (FORALL i in (Za - h) | (f~[i]) /= Ra_0)})) &
		(shifted_seq({[i, Recip(f~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (f~[i]) /= Ra_0)})) /= shifted_seq({[i, Recip((shifted_seq(f,m))~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)})))
	f-->T546(*) ==> Stat2: (domain(f) = Za) & Svm(f) & (range(f) ¥incin Ra)
--
-- The integer $m = arb({h in Za | (FORALL i in (Za - h) | (f~[i]) /= Ra_0)})$ cannot be $0$
-- must belongs to the set ${h in Za | (FORALL i in (Za - h) | (f~[i]) /= Ra_0)}$.
--
	Use_def(Svm)(Stat2*) ==> Is_map(f)
	Suppose ==> m = 0
		f-->T343(Stat2*) ==> shifted_seq(f,0) = f
	EQUAL ==> false; Discharge ==> Stat3: m /= 0
	({h in Za | (FORALL i in (Za - h) | (f~[i]) /= Ra_0)})-->T0(Stat1,Stat3*) ==> Stat4: m in {h in Za | (FORALL i in (Za - h) | (f~[i]) /= Ra_0)}
	()-->Stat4(Stat4*) ==> Stat5: (m in Za) & Stat6: (FORALL i in (Za - m) | (f~[i]) /= Ra_0)
--
-- On the other hand, the analogous shift number $n$ required in the determination of the reciprocal of
-- $shifted_seq(f,m)$ must be $0$, since $0$ clearly belongs to the set
--	${h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)}$.
-- For, assuming the contrary, there would be an unsigned integer $i0$ for which $((shifted_seq(f,m))~[i0]) = Ra_0$.
-- However, $(shifted_seq(f,m))~[i0]$ has the same value as $f~[m ¥PLUS i0]$ and the latter cannot be $Ra_0$, because
-- $m ¥PLUS i0$ is not smaller than $m$. Therefore [...]
--
--
	Suppose ==> Stat7: arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)}) /= 0
		Loc_def ==> n = arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)})
		({h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)})-->T0(Stat7*) ==> Stat8: (n * {h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)} = 0) &
			Stat9: (n in {h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)})
		()-->Stat9 ==> n in Za
		T211 ==> 0 in Za
		Suppose ==> 0 in {h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)}
		(n,0)-->T31(Stat7*) ==> false; Discharge ==> Stat10: 0 notin {h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)}
		()-->Stat10(Stat8*) ==> Stat11: not(FORALL i in (Za - 0) | ((shifted_seq(f,m))~[i]) /= Ra_0)
		i0-->Stat11(Stat11*) ==> Stat12: (i0 in Za) & (((shifted_seq(f,m))~[i0]) = Ra_0)
		Use_def(shifted_seq)(Stat12*) ==> Stat13: ((f @ Shift(m))~[i0]) = Ra_0
		(m,i0)-->T339(Stat5,Stat12*) ==> Stat14: Svm(Shift(m)) & (domain(Shift(m)) = Za) & (range(Shift(m)) ¥incin Za) & ((Shift(m)~[i0])=(m ¥PLUS i0))
		(f,Shift(m),i0)-->T130(Stat2,Stat14,Stat12,Stat13*) ==> Ra_0 = f~[Shift(m)~[i0]]
		EQUAL(Stat14) ==> Stat15: Ra_0 = f~[m ¥PLUS i0]
		(m,i0)-->T292 ==> Stat16: (i0 ¥PLUS m) notin m
		ALGEBRA(Stat5,Stat12,Stat16) ==> Stat17: ((m ¥PLUS i0) notin m) & ((m ¥PLUS i0) in Za)
	(m ¥PLUS i0)-->Stat6(Stat17,Stat15*) ==> false; Discharge ==> Stat18: arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)}) = 0
	({[i, Recip((shifted_seq(f,m))~[i])]: i in Za})-->T343(Stat18*) ==> Stat19: shifted_seq({[i, Recip((shifted_seq(f,m))~[i])]: i in Za},0) = {[i, Recip((shifted_seq(f,m))~[i])]: i in Za}
	EQUAL(Stat1,Stat18,Stat19) ==> Stat20: shifted_seq({[i, Recip(f~[i])]: i in Za}, m) /= {[i, Recip((shifted_seq(f,m))~[i])]: i in Za}
--
-- We will refute the inequality just obtained, thereby being able to draw the desired conclusion.
-- We begin by observing that $shifted_seq({[i, Recip(f~[i])]: i in Za}, m)$ has the same domain as
-- ${[i, Recip((shifted_seq(f,m))~[i])]: i in Za}$, namely $Za$.
--
	({[i, Recip(f~[i])]: i in Za},m)-->T354(Stat5,Stat5*) ==> domain(shifted_seq({[i, Recip(f~[i])]: i in Za}, m)) = Za
	TELEM ==> (Za /= 0) & Svm({[i, Recip((shifted_seq(f,m))~[i])]: i in Za}) & (domain({[i, Recip((shifted_seq(f,m))~[i])]: i in Za}) = Za)
--
-- Then, picking an unsigned integer $n0$ where the left-hand side of the inequality Stat20
-- has a value differring from the value of the right-hand side, and simplifying the
-- expression of the right-hand value relative to $n0$, we get the inequality
--	$(shifted_seq({[i, Recip(f~[i])]: i in Za}, m)~[n0]) /= Recip((shifted_seq(f,m))~[n0])$.
-- Hence we get
--	$(shifted_seq({[i, Recip(f~[i])]: i in Za}, m)~[n0]) /= Recip(f~[m ¥PLUS n0])$.
--
        (m, {[i, Recip(f~[i])]: i in Za})-->T352(Stat5,Stat5*) ==> shifted_seq({[i, Recip(f~[i])]: i in Za}, m) in Subseqs({[i, Recip(f~[i])]: i in Za})
        TELEM ==> Stat21: Svm({[i, Recip(f~[i])]: i in Za}) & (domain({[i, Recip(f~[i])]: i in Za}) = Za)
        Use_def(next) ==> domain({[i, Recip(f~[i])]: i in Za}) in next(Za)
        APPLY(h_thryvar:h) subseq(g->shifted_seq({[i, Recip(f~[i])]: i in Za}, m),f->{[i, Recip(f~[i])]: i in Za}) ==> Svm(shifted_seq({[i, Recip(f~[i])]: i in Za}, m))
	(shifted_seq({[i, Recip(f~[i])]: i in Za}, m),{[i, Recip((shifted_seq(f,m))~[i])]: i in Za},Za)-->T337(Stat20*) ==> Stat22: not(FORALL i in Za | (shifted_seq({[i, Recip(f~[i])]: i in Za}, m)~[i]) = ({[i, Recip((shifted_seq(f,m))~[i])]: i in Za}~[i]))
	n0-->Stat22(Stat22*) ==> Stat23: (n0 in Za) & ((shifted_seq({[i, Recip(f~[i])]: i in Za}, m)~[n0]) /= ({[i,Recip((shifted_seq(f,m))~[i])]: i in Za}~[n0]))
	APPLY() Must_be_svm(b(i)->Recip((shifted_seq(f,m))~[i]),s->Za,u->n0) ==> (n0 in Za) ¥imp (({[i,Recip((shifted_seq(f,m))~[i])]: i in Za}~[n0]) = Recip((shifted_seq(f,m))~[n0]))
	Use_def(shifted_seq)(Stat23*) ==> Stat24: (({[i, Recip(f~[i])]: i in Za} @ Shift(m))~[n0]) /= Recip((f @ Shift(m))~[n0])
	(m,n0)-->T339(Stat5,Stat23*) ==> Stat25: Svm(Shift(m)) & (domain(Shift(m)) = Za) & (range(Shift(m)) ¥incin Za) & ((Shift(m)~[n0]) = (m ¥PLUS n0))
	(f,Shift(m),n0)-->T129(Stat2,Stat23,Stat25*) ==> ((f @ Shift(m))~[n0]) = (f~[Shift(m)~[n0]])
	EQUAL(Stat24) ==> Stat26: (({[i, Recip(f~[i])]: i in Za} @ Shift(m))~[n0]) /= Recip(f~[m ¥PLUS n0])
	({[i, Recip(f~[i])]: i in Za},Shift(m),n0)-->T129(Stat23,Stat25,Stat26*) ==> Stat27: ({[i, Recip(f~[i])]: i in Za}~[(Shift(m))~[n0]]) /= Recip(f~[m ¥PLUS n0])
	EQUAL(Stat27,Stat25) ==> Stat28: ({[i, Recip(f~[i])]: i in Za}~[m ¥PLUS n0]) /= Recip(f~[m ¥PLUS n0])
--
-- However, the left-hand side of the inequality so obtained can easily be reduced
-- to the same form as the right-hand side, which leads to the sought contradiction.
--
	APPLY() Must_be_svm(b(i)->Recip(f~[i]),s->Za,u->(m ¥PLUS n0)) ==> Stat29: ((m ¥PLUS n0) in Za) ¥imp (({[i, Recip(f~[i])]: i in Za}~[m ¥PLUS n0]) = Recip(f~[m ¥PLUS n0]))
(m,n0)-->T283(Stat5,Stat23,Stat29,Stat28*) ==> false; Discharge ==> QED
--
-- What follows generalizes the reflexivity property of $Ra_eqseq$ stated by Theorem 546.
--
Theorem 567: ((F in RaCauchy) & (M in Za)) ¥imp ((shifted_seq(F,M) in RaCauchy) & Ra_eqseq(F,shifted_seq(F,M))). Proof:
Suppose_not(f,m) ==> AUTO
--
-- Assume $f,m$ to be a counterexample to our statement.
-- To see that $shifted_seq(f,m)$ is infinite (which will allow us to exploit Theorem 354),
-- it suffices to show that its domain is $Za$. This yields that this subsequence of $f$
-- is a Cauchy sequence equivalent to $f$, proving the desired statement.
--
	T539(*) ==> Stat1: f in RaSeq
	f-->T546(Stat1*) ==> (domain(f) = Za) & (range(f) ¥incin Ra) & Svm(f)
	(f,m)-->T354(*) ==> Stat2: domain(shifted_seq(f,m)) = Za
	(shifted_seq(f,m))-->T172(Stat2*) ==> #domain(shifted_seq(f,m)) ¥incin #shifted_seq(f,m)
	T209(Stat2*) ==> Card(Za)
	Za-->T164(Stat2*) ==> Za = #Za
	T206(Stat2*) ==> (not Finite(Za))
	EQUAL(Stat2*) ==> (not Finite(#domain(shifted_seq(f,m))))
	(#shifted_seq(f,m),#domain(shifted_seq(f,m)))-->T189(Stat2*) ==> (not Finite(shifted_seq(f,m)))
	(m,f)-->T352(*) ==> shifted_seq(f,m) in Subseqs(f)
(f,shifted_seq(f,m))-->T549(*) ==> false; Discharge ==> QED
--
--
--
Theorem 568: ((F in RaCauchy) & (not Ra_eqseq(F,Ra0Seq))) ¥imp (EXISTS g in RaCauchy | Ra_eqseq(F,g) & (Ras_Recip(F) = Ras_Recip(g)) &
	(FORALL i in Za | ((g~[i]) /= Ra_0) & (Ras_Recip(g)~[i] = Recip(g~[i])))). Proof+:
Suppose_not(fp) ==> Stat1: (fp in RaCauchy) & (not Ra_eqseq(fp,Ra0Seq)) & Stat2: (not(EXISTS g in RaCauchy | Ra_eqseq(fp,g) & (Ras_Recip(fp) = Ras_Recip(g)) &
	(FORALL i in Za | ((g~[i]) /= Ra_0) & (Ras_Recip(g)~[i] = Recip(g~[i])))))
--
-- Reasoning by contradiction, assume that $fp$ is a Cauchy sequence, inequivalent
-- to the zero sequence, such that no Cauchy sequence $g$ equivalent to $fp$ and whose
-- reciprocal equals the reciprocal $Ras_Recip(fp)$ of $fp$ exists fulfilling
-- the condition $(FORALL i in Za | ((g~[i]) /= Ra_0) & (Ras_Recip(g)~[i] = Recip(g~[i])))$.
--
	Use_def(Ras_Recip) ==> Ras_Recip(fp) = shifted_seq({[i, Recip(fp~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (fp~[i]) /= Ra_0)}))
	Loc_def ==> Stat3: m0 = arb({h in Za | (FORALL i in (Za - h) | (fp~[i]) /= Ra_0)})
	EQUAL ==> Ras_Recip(fp) = shifted_seq({[i, Recip(fp~[i])]: i in Za}, m0)
--
-- We will show that if $shifted_seq(fp,m0)$ is taken as $g$ in Stat2, a contradiction
-- proving the desired statement arises.
-- Observe, in the first place, that the shift number $m0$ used in the definition of
-- $Recip(fp)$ belongs to $Za$; accordingly, $shifted_seq(fp,m0)$ is a subsequence
-- (not necessarily infinite, a priori) of the sequence $fp$.
--
	Suppose ==> Stat4: not((m0 in Za) & (FORALL i in (Za - m0) | (fp~[i]) /= Ra_0))
		fp-->T565(Stat1,Stat1*) ==> Stat5: {h in Za | (FORALL i in (Za - h) | (fp~[i]) /= Ra_0)} /= 0
		({h in Za | (FORALL i in (Za - h) | (fp~[i]) /= Ra_0)})-->T0(Stat3,Stat5*) ==> Stat6: (m0 in {h in Za | (FORALL i in (Za - h) | (fp~[i]) /= Ra_0)})
	()-->Stat6(Stat4*) ==> false; Discharge ==> Stat7: (m0 in Za) & Stat8: (FORALL i in (Za - m0) | (fp~[i]) /= Ra_0)
--
-- The preceding Theorem 566 and Theorem 567 yield that $shifted_seq(fp,m0)$ is a
-- Cauchy sequence equivalent to $fp$ and has the same reciprocal as $fp$.
--
	(fp,m0)-->T567(Stat1,Stat7*) ==>  Stat9: (shifted_seq(fp,m0) in RaCauchy) & (Ra_eqseq(fp,shifted_seq(fp,m0)))
	T539(Stat1,Stat1*) ==> Stat10: fp in RaSeq
	(fp,m0)-->T566(Stat10,Stat3*) ==> Stat11: Ras_Recip(fp) = Ras_Recip(shifted_seq(fp,m0))
--
-- At this point, all that remains to be proved is that each component of the sequence
-- $shifted_seq(fp,m0)$ is non-zero and each component of the reciprocal of this sequence
-- equals the reciprocal of the corresponding component of $shifted_seq(fp,m0)$.
--
--
-- To see that zero cannot be a component of $shifted_seq(fp,m)$, otherwise stated that
--	$((shifted_seq(fp,m0))~[i]) /= Ra_0$
-- for any $i in Za$, it suffices to exploit the definitions
-- of the reciprocal of a rational Cauchy sequence and of the $Shift$ sequence.
--
	Suppose ==> Stat12: not(FORALL i in Za | ((shifted_seq(fp,m0))~[i]) /= Ra_0)
		i2-->Stat12(Stat12*) ==> Stat13: (i2 in Za) & (((shifted_seq(fp,m0))~[i2]) = Ra_0)
		Use_def(shifted_seq)(Stat12*) ==> ((fp @ Shift(m0))~[i2]) = Ra_0
		fp-->T546(Stat10,Stat10*) ==> Stat14: (domain(fp) = Za) & (range(fp) ¥incin Ra) & Svm(fp)
		(m0,i2)-->T339(Stat7,Stat13*) ==> Svm(Shift(m0)) & (domain(Shift(m0)) = Za) & (range(Shift(m0)) ¥incin Za) & ((Shift(m0)~[i2])=(m0 ¥PLUS i2))
		(fp,Shift(m0),i2)-->T130(Stat13*) ==> Ra_0 = fp~[Shift(m0)~[i2]]
		EQUAL(Stat14) ==> Stat15: Ra_0 = fp~[m0 ¥PLUS i2]
		(m0,i2)-->T283(Stat7,Stat13*) ==> (m0 ¥PLUS i2) in Za
		(m0,i2)-->T292(Stat7,Stat7*) ==> (m0 ¥PLUS i2) notin m0
	(m0 ¥PLUS i2)-->Stat8(Stat15*) ==> false; Discharge ==> Stat16: (FORALL i in Za | ((shifted_seq(fp,m0))~[i]) /= Ra_0)
--
	Suppose ==> Stat17: not(FORALL i in Za | (((shifted_seq(fp,m0))~[i]) /= Ra_0) & ((Ras_Recip(shifted_seq(fp,m0))~[i]) = Recip(shifted_seq(fp,m0)~[i])))
		i0-->Stat17(Stat17*) ==> Stat18: (i0 in Za) & ((((shifted_seq(fp,m0))~[i0]) = Ra_0) or ((Ras_Recip(shifted_seq(fp,m0))~[i0]) /= Recip(shifted_seq(fp,m0)~[i0])))
		i0-->Stat16(Stat18*) ==> (Ras_Recip(shifted_seq(fp,m0))~[i0]) /= Recip(shifted_seq(fp,m0)~[i0])
--
-- Observe now that on the one hand
--	$arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)})$
-- must differ from $0$.
--
		Use_def(Ras_Recip)(Stat18*) ==> (shifted_seq({[i, Recip((shifted_seq(fp,m0))~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}))~[i0]) /= Recip(shifted_seq(fp,m0)~[i0])
		Suppose ==> arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}) = 0
			({[i, Recip((shifted_seq(fp,m0))~[i])]: i in Za})-->T343(Stat18*) ==> shifted_seq({[i, Recip((shifted_seq(fp,m0))~[i])]: i in Za}, 0) = {[i, Recip((shifted_seq(fp,m0))~[i])]: i in Za}
			EQUAL(Stat18) ==> (shifted_seq({[i, Recip((shifted_seq(fp,m0))~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}))~[i0]) = ({[i, Recip((shifted_seq(fp,m0))~[i])]: i in Za}~[i0])
			APPLY() Must_be_svm(b(i)->Recip((shifted_seq(fp,m0))~[i]),s->Za,u->i0) ==> (i0 in Za) ¥imp ({[i,Recip((shifted_seq(fp,m0))~[i])]: i in Za}~[i0] = Recip((shifted_seq(fp,m0))~[i0]))
		(Stat17*)ELEM ==> false; Discharge ==> Stat19: arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}) /= 0
--
-- But, on the other hand, if it differs from $0$, then $0$ cannot be a member of the
-- non-void set
--	${h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}$,...
--
		({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)})-->T0(Stat19*) ==> Stat20: (arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}) in {h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)})  & (arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}) * {h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)} = 0)
		()-->Stat20(Stat20*) ==> arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}) in Za
--		(arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}))-->T207(Stat20*) ==> Ord(arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}))
		T211 ==> Stat21: Ord(0) & (0 in Za)
		(arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}),0)-->T31(Stat19*) ==> Stat22: 0 notin {h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}
--
-- ... and hence there must exist a non-negative integer $i1$ such that the $i1$-th component
-- of $shifted_seq(fp,m0))~[i1])$ is zero,...
--
		()-->Stat22(Stat21*) ==> Stat23: not(FORALL i in (Za - 0) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)
		i1-->Stat23(Stat23*) ==> Stat24: (i1 in Za) & (((shifted_seq(fp,m0))~[i1]) = Ra_0)
--
-- ... a possibility which we have discarded already.
--
	i1-->Stat16(Stat24*) ==> false; Discharge ==> Stat25: (FORALL i in Za | (((shifted_seq(fp,m0))~[i]) /= Ra_0) & ((Ras_Recip(shifted_seq(fp,m0))~[i]) = Recip(shifted_seq(fp,m0)~[i])))
--
-- Having now proved that $g=shifted_seq(fp,m)$ enjoys all properties appearing in the
-- formula Stat2 stating that no sequence $g$ with those properties exists, we reach
-- by contradiction the desired conclusion.
--
(shifted_seq(fp,m0))-->Stat2(Stat9,Stat11,Stat25*) ==> false; Discharge ==> QED
--
--
--
Theorem 569: [The reciprocal of a non-null rational sequence is a rational sequence] ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) ¥imp (Ras_Recip(G) in RaSeq). Proof:
--??    Suppose_not(gp) ==> Stat1: AUTO
    Suppose_not(gp) ==> Stat1: (gp in RaCauchy) & (not Ra_eqseq(gp,Ra0Seq)) & (Ras_Recip(gp) notin RaSeq)
--
-- Reasoning by contradiction, assume that $gp$ is a Cauchy sequence, inequivalent to the zero sequence, and that
-- the reciprocal $Ras_Recip(gp)$ of $gp$ is not an infinite sequence of rational numbers.
--
        Use_def(Ras_Recip) ==> shifted_seq({[i, Recip(gp~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})) notin RaSeq
        Loc_def ==> Stat2: a0 = arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})
        EQUAL ==> shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) notin RaSeq
--
-- Observe, in the first place, that the shift number $a0$ used in the definition of
-- $Ras_Recip(gp)$ belongs to $Za$; accordingly, $Recip(gp)$ is a subsequence
-- (not necessarily infinite, a priori) of the sequence ${[i, Recip(gp~[i])]: i in Za}$.
--
        Suppose ==> Stat3: not((a0 in Za) & (FORALL i in (Za - a0) | (gp~[i]) /= Ra_0))
            gp-->T565(Stat1,Stat1*) ==> Stat4: {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)} /= 0
            ({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})-->T0(Stat2,Stat4*) ==> Stat5: (a0 in {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})
        ()-->Stat5(Stat3*) ==> false; Discharge ==> Stat6: (a0 in Za) & Stat7: (FORALL i in (Za - a0) | (gp~[i]) /= Ra_0)
--
        (a0, {[i, Recip(gp~[i])]: i in Za})-->T352(Stat6,Stat6*) ==> shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) in Subseqs({[i, Recip(gp~[i])]: i in Za})
--
-- Hence $Recip(gp)$ is a single-valued map whose domain and range are included
-- in the domain and range of ${[i, Recip(gp~[i])]: i in Za}$ (the former of which
-- is $Za$), respectively.
--
        TELEM ==> Stat8: Svm({[i, Recip(gp~[i])]: i in Za}) & (domain({[i, Recip(gp~[i])]: i in Za}) = Za)
        Use_def(next) ==> domain({[i, Recip(gp~[i])]: i in Za}) in next(Za)
        APPLY(h_thryvar:h) subseq(g->shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0),f->{[i, Recip(gp~[i])]: i in Za}) ==>
 		Stat9: Svm(shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)) & (shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) ¥incin (domain({[i, Recip(gp~[i])]: i in Za}) ¥PROD range({[i, Recip(gp~[i])]: i in Za})))
--
-- Moreover, the domain of $Recip(gp)$ is precisely $Za$; therefore our
-- initial hypothesis becomes that $Recip(gp)$ is not included in $Za ¥PROD Ra$,
-- while on the other hand it is included in $Za ¥PROD range({[i, Recip(gp~[i])]: i in Za})$.
--
        ({[i, Recip(gp~[i])]: i in Za},a0)-->T354(Stat8,Stat6*) ==> Stat10: domain(shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)) = Za
        Use_def(RaSeq) ==> Stat11: shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) notin {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}
        ()-->Stat11(Stat9*) ==> Stat12: shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) ¥nincin (Za ¥PROD Ra)
--
--
--
        Suppose ==> Stat13: shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) ¥nincin (Za ¥PROD {Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0})
            (shifted_seq({[i, Recip(gp~[i])]: i in Za},a0),domain({[i, Recip(gp~[i])]: i in Za}),range({[i, Recip(gp~[i])]: i in Za}))-->T141(Stat9,Stat9*) ==> Stat14: Is_map(shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0))
            (shifted_seq({[i, Recip(gp~[i])]: i in Za},a0),Za,{Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0})-->T141(Stat13,Stat10,Stat14*) ==> Stat15: not(range(shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)) ¥incin {Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0})
            d-->Stat15(Stat15*) ==> (d in range(shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0))) & Stat16: (d notin {Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0})
            Use_def(shifted_seq)(Stat15*) ==> d in range({[i, Recip(gp~[i])]: i in Za} @ Shift(a0))
            Use_def(Shift)(Stat15*) ==> d in range({[i, Recip(gp~[i])]: i in Za} @ {[i, a0 ¥PLUS i]: i in Za})
            Use_def(@)(Stat15*) ==> d in range({[car(x),cdr(y)]: x in {[i, a0 ¥PLUS i]: i in Za}, y in {[i, Recip(gp~[i])]: i in Za} | cdr(x) = car(y)})
            SIMPLF(Stat15*) ==> Stat17: d in range({[car([i, a0 ¥PLUS i]),cdr([j, Recip(gp~[j])])]: i in Za, j in Za | cdr([i, a0 ¥PLUS i]) = car([j, Recip(gp~[j])])})
            (Stat17)ELEM ==> Stat18: d in {Recip(gp~[j]): i in Za, j in Za | (a0 ¥PLUS i) = j}
            (i1,j1)-->Stat18(Stat18*) ==> Stat19: (i1 in Za) & (j1 in Za)  & (d = Recip(gp~[j1])) & ((a0 ¥PLUS i1) = j1)
            j1-->Stat16(Stat19*) ==> (gp~[j1]) = Ra_0
            EQUAL(Stat19) ==> Stat20: (gp~[a0 ¥PLUS i1]) = Ra_0
            Suppose ==> Stat21: (a0 ¥PLUS i1) notin (Za - a0)
                ALGEBRA(Stat6,Stat19,Stat21*) ==> Stat22: ((a0 ¥PLUS i1) in a0)  & ((a0 ¥PLUS 0) notin a0)
                Suppose ==> i1 = 0
                EQUAL(Stat19) ==> false; Discharge ==> Stat23: i1 /= 0
            (a0,i1)-->T284(Stat6,Stat19,Stat23,Stat22*) ==>  false; Discharge ==> Stat24: (a0 ¥PLUS i1) in (Za - a0)
        (a0 ¥PLUS i1)-->Stat7(Stat24,Stat20*) ==> false; Discharge ==> Stat25: shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) ¥incin (Za ¥PROD {Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0})
        Suppose ==> Stat26: not({Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0 } ¥incin Ra)
            r0-->Stat26 ==> (r0 notin Ra) & Stat27: (r0 in {Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0})
            i0-->Stat27 ==> Stat28: (i0 in Za) & (Recip(gp~[i0]) notin Ra) & ((gp~[i0]) /= Ra_0)
            (gp,i0)-->T550(Stat28,Stat1*) ==> (gp~[i0]) in Ra
        (gp~[i0])-->T462(Stat26) ==> false; Discharge ==> Stat29: {Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0} ¥incin Ra
    (Za,Za,{Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0},Ra)-->T256(Stat25,Stat29,Stat12*) ==> false; Discharge ==> QED
--
-- Next we prove that the reciprocal of any rational Cauchy sequence
-- not equivalent to the zero sequence is, in its turn, a rational Cauchy sequence.
--
Theorem 570: [Reciprocal and quotient of rational Cauchy sequences are, when defined, Cauchy sequences] (({F,G} ¥incin RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) ¥imp ((Ras_Recip(G) in RaCauchy) & ((F ¥Ras_OVER G) in RaCauchy)). Proof+:
Suppose_not(f,gq) ==> AUTO
--
-- Reasoning by contradiction, assume that $f,gq$ are Cauchy sequences, $gq$ is inequivalent to the zero sequence, and
-- either the reciprocal of $gq$ or the quotient of $f$ by $gq$ fails to be a Cauchy sequence. Of these alternatives,
-- the former prevails immediately, and we must therefore proceed assuming that $Recip(gq)$ is not a Cauchy sequence.
--
	Suppose ==> Ras_Recip(gq) in RaCauchy
		Use_def(¥Ras_OVER) ==> (f ¥Ras_TIMES Ras_Recip(gq)) notin RaCauchy
	(f, Ras_Recip(gq))-->T561 ==> false; Discharge ==> Stat1: (gq in RaCauchy) & (not Ra_eqseq(gq,Ra0Seq)) & (Ras_Recip(gq) notin RaCauchy)
--
-- Without loss of generality, we can assume that there is a rational
-- Cauchy sequence $gp$ whose reciprocal equals the sequence of the
-- reciprocals of the individual components of $gp$ and fails to be
-- a rational Cauchy sequence. Obviously such sequence $gp$ is not
-- equivalent to the everywhere null sequence.
--
	gq-->T568 ==> Stat2: (EXISTS g in RaCauchy | Ra_eqseq(gq,g) & (Ras_Recip(gq) = Ras_Recip(g)) &
		(FORALL i in Za | ((g~[i]) /= Ra_0) & (Ras_Recip(g)~[i] = Recip(g~[i]))))
	gp-->Stat2(Stat1*) ==> Stat3: (gp in RaCauchy) & Ra_eqseq(gq,gp) & (Ras_Recip(gp) notin RaCauchy) &
		Stat4: (FORALL i in Za | ((gp~[i]) /= Ra_0) & (Ras_Recip(gp)~[i] = Recip(gp~[i])))
	Suppose ==> Ra_eqseq(gp,Ra0Seq)
		T545(Stat3*) ==> Ra0Seq in RaCauchy
		T539(*) ==> (Ra0Seq in RaSeq) & (gq in RaSeq) & (gp in RaSeq)
		(gq,gp,Ra0Seq)-->T553(Stat3*) ==> Ra_eqseq(Ra0Seq,gq)
		Ra0Seq-->T546(Stat3*) ==> Ra_eqseq(Ra0Seq,Ra0Seq)
	(Ra0Seq,Ra0Seq,gq)-->T553(*) ==> false; Discharge ==> not(Ra_eqseq(gp,Ra0Seq))
--
-- Saying that $Ras_Recip(gp)$ is not a Cauchy sequence amounts to asserting that
-- either it is not an infinite sequence of rational numbers
-- or for some positive rational number $eps=eps0$ the set
--	${ i * j : i in Za, j in Za | Ra_ABS((shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)~[i]) ¥Ra_MINUS (shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)~[j])) ¥Ra_GT eps }$,
-- where $a0=arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})$, is infinite.
-- However, the former case must be excluded by Theorem T455a.
--
	Use_def(RaCauchy)(Stat3*) ==> Stat5: Ras_Recip(gp) notin {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
	gp-->T569(Stat3*) ==> (Ras_Recip(gp) in RaSeq)
	() --> Stat5(Stat5*) ==> (not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS(((Ras_Recip(gp))~[i]) ¥Ra_MINUS ((Ras_Recip(gp))~[j])) ¥Ra_GT eps })))
	Use_def(Ras_Recip)(Stat5*) ==> Stat6: (shifted_seq({[i, Recip(gp~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})) in RaSeq) & Stat7: (not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS((shifted_seq({[i, Recip(gp~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)}))~[i]) ¥Ra_MINUS (shifted_seq({[i, Recip(gp~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)}))~[j])) ¥Ra_GT eps })))
	Loc_def ==> Stat8: a0 = arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})
	EQUAL(Stat6) ==> Stat9: (not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS((shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)~[i]) ¥Ra_MINUS (shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)~[j])) ¥Ra_GT eps })))
--
-- After recalling a few basic facts which will be useful in the ongoing,
-- observe that the shift number $a0$ used in the definition of $Recip(gp)$
-- is 0 and hence it belongs to $Za$. This remark enables us to simplify
-- Stat9, referring it directly to the sequence
-- ${[i, Recip(gp~[i])]: i in Za}$ instead of to one of its shifted
-- subsequences.
--
	T451(Stat9*) ==> Stat10: Ra_0 in Ra
	T525(Stat9*) ==> Stat11: (FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0))) &
		Stat12:  (FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x))) &
		Stat13:  (FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_Rev(x ¥Ra_PLUS Ra_Rev(y)) = (y ¥Ra_PLUS Ra_Rev(x)))) &
		Stat14: (FORALL x | (x in Ra) ¥imp (x ¥Ra_LE x))
--
	Suppose ==> Stat15: not((a0 = 0) & (a0 in Za) & (FORALL i in (Za - a0) | (gp~[i]) /= Ra_0))
		T211(Stat15*) ==> Ord(0) & (0 in Za)
		Suppose ==> Stat16: 0 notin {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)}
			()-->Stat16(Stat15*) ==> Stat17: not(FORALL i in (Za - 0) | (gp~[i]) /= Ra_0)
			i5-->Stat17(Stat17*) ==> (i5 in Za) & ((gp~[i5]) = Ra_0)
		i5-->Stat4(Stat17*) ==> false; Discharge ==> Stat18: 0 in {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)}
		(Stat8,Stat18)ELEM ==> (0 notin a0) & Stat19: (a0 in {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})
		()-->Stat19(Stat18*) ==> (a0 in Za) & (FORALL i in (Za - a0) | (gp~[i]) /= Ra_0)
	(0,a0)-->T31(Stat15*) ==> false; Discharge ==> Stat20: (a0 = 0) & (a0 in Za) & Stat21: (FORALL i in (Za - a0) | (gp~[i]) /= Ra_0)
	Suppose ==> Stat22: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i]) ¥Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j])) ¥Ra_GT eps }))
		TELEM ==> Is_map({[i, Recip(gp~[i])]: i in Za}) & (domain({[i, Recip(gp~[i])]: i in Za}) = Za)
		({[i, Recip(gp~[i])]: i in Za})-->T343(Stat20*) ==> Stat23: shifted_seq({[i, Recip(gp~[i])]: i in Za},0) = {[i, Recip(gp~[i])]: i in Za}
	EQUAL(Stat23,Stat20,Stat22,Stat9) ==> false; Discharge ==> Stat24: (not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i]) ¥Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j])) ¥Ra_GT eps })))
--
-- Having already discarded the possibility that the reciprocal of $gp$ be not an infinite sequence of
-- rational numbers, we are left with the other alternative to consider. This will lead to a contradiction too.
-- Pick a positive rational number $a$ and a nonnegative integer $n0$ so that all components
-- of the sequence $Ra_ABS(gp~[i])$ are, from the $n0$-th on, greater than $a$. The reciprocal of $a$
-- and the square of this reciprocal clearly belong to $Ra$.
--
	eps0-->Stat24(Stat24,Stat24*) ==> Stat25: (eps0 in Ra) & (eps0 ¥Ra_GT Ra_0) & (not Finite({ i * j : i in Za, j in Za | Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i]) ¥Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j])) ¥Ra_GT eps0 }))
	gp-->T563 ==> Stat26: (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
		(FORALL i in (Za - n) | (Ra_ABS(gp~[i]) ¥Ra_GT eps) & (Ra_ABS(gp~[i]) ¥Ra_GT Ra_0)) & (Ra_ABS(gp~[n]) ¥Ra_GT Ra_0))
	(a,n0)-->Stat26 ==> Stat27: (a in Ra) & (a ¥Ra_GT Ra_0) & (n0 in Za) &
			Stat28: (FORALL i in (Za - n0) | (Ra_ABS(gp~[i]) ¥Ra_GT a) & (Ra_ABS(gp~[i]) ¥Ra_GT Ra_0))
	(a,Ra_0)-->T473(Stat10,Stat27) ==> Stat29: a /= Ra_0
	a-->T462(Stat27*) ==> Stat30: Recip(a) in Ra
	ALGEBRA(Stat27*) ==> Stat31: ((Recip(a) ¥Ra_TIMES Recip(a)) in Ra)
--
-- We begin here the main part of this proof by showing that
--	$Ra_ABS(Recip(gp~[i]) ¥Ra_MINUS Recip(gp~[j])) ¥Ra_LE ((Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j]))) ¥Ra_OVER (a ¥Ra_TIMES a))$
-- and
--	$({[i, Recip(gp~[i])]: i in Za}~[i]) = Recip(gp~[i])$,
--	$({[i, Recip(gp~[i])]: i in Za}~[j]) = Recip(gp~[j])$
-- hold for all $i,j in (Za - n0)$, which we now show in a few lines.
--
        Suppose ==> Stat32: not(FORALL i in (Za - n0), j in (Za - n0) | Ra_ABS(Recip(gp~[i]) ¥Ra_MINUS Recip(gp~[j])) ¥Ra_LE ((Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a))))
            (p,q)-->Stat32(Stat32*) ==> Stat33: (p in (Za - n0)) & (q in (Za - n0)) &  (not Ra_ABS(Recip(gp~[p]) ¥Ra_MINUS Recip(gp~[q])) ¥Ra_LE ((Ra_ABS((gp~[p]) ¥Ra_MINUS (gp~[q]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a))))
            (gp,p)-->T550(Stat33,Stat3*) ==> Stat34: (gp~[p]) in Ra
            (gp,q)-->T550(Stat33,Stat3*) ==> Stat35: (gp~[q]) in Ra
            p-->Stat28 ==> Stat36: Ra_ABS(gp~[p]) ¥Ra_GT a
            q-->Stat28 ==> Stat37: Ra_ABS(gp~[q]) ¥Ra_GT a
        (gp~[p],gp~[q],a,a)-->T538(Stat34,Stat35,Stat36,Stat37,Stat27,Stat33*) ==> false; Discharge ==> Stat38: (FORALL i in (Za - n0), j in (Za - n0) | Ra_ABS(Recip(gp~[i]) ¥Ra_MINUS Recip(gp~[j])) ¥Ra_LE ((Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a))))
--
-- Secondly, we show that the set of all intersections $i*j$ with $i,j in (Za-n0)$ such that
--	$Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a))$
-- is finite; since, moreover, this is a set of unsigned integers, it has an upper bound $u0$.
--
        Suppose ==> Stat39: (not Finite({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )}))
            Set_monot ==> {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )} ¥incin {i * j : i in Za, j in Za | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )}
            ({i * j : i in Za, j in Za | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )},{i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )})-->T189(Stat39) ==> (not Finite({i * j : i in Za, j in Za | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )}))
            Use_def(RaCauchy)(Stat3) ==> Stat40: gp in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
            ()-->Stat40(Stat40) ==> Stat41: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp Finite({ i * j : i in Za, j in Za | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT eps }))
            ALGEBRA ==> ((eps0 ¥Ra_TIMES (a ¥Ra_TIMES a)) in Ra) & (Ra_0 in Ra) & ((Ra_0 ¥Ra_TIMES a) = Ra_0) & ((a ¥Ra_TIMES a) in Ra) & ((Ra_0 ¥Ra_TIMES (a ¥Ra_TIMES a)) = Ra_0)
            (a,Ra_0,a)-->T488(Stat27) ==> (a ¥Ra_TIMES a) ¥Ra_GT (Ra_0 ¥Ra_TIMES a)
            EQUAL(Stat41) ==> (a ¥Ra_TIMES a) ¥Ra_GT Ra_0
            (eps0,Ra_0,a ¥Ra_TIMES a)-->T488(Stat25) ==> (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a)) ¥Ra_GT (Ra_0 ¥Ra_TIMES (a ¥Ra_TIMES a))
            EQUAL(Stat41) ==> (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a)) ¥Ra_GT Ra_0
        (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a))-->Stat41(Stat39*) ==> false; Discharge ==> Stat42: Finite({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )})
--
        Suppose ==> Stat43: not({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )} ¥incin Za)
            c2-->Stat43(Stat43) ==> (c2 notin Za) & Stat44: (c2 in {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )})
            (i2,j2)-->Stat44(Stat43) ==> (i2 in Za) & (j2 in Za) & ((i2 * j2) notin Za)
            T206 ==> Ord(Za)
        (i2,j2)-->T29(Stat43) ==> false; Discharge ==> Stat45: {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )} ¥incin Za
        Loc_def ==> Stat46: u0 = Un({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )})
--
-- The upper bound $u0$ is also the maximum of
--	${i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )}$,
-- provided this set is nonempty.
--
        ({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )})-->T320(Stat42) ==> Stat47: (u0 in Za) & (({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )} /= 0) ¥imp (u0 in {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a) )}))
--
-- Both $n0$ and $next(u0)$ are easily shown to belong to $Za$; therefore the
-- larger of them belongs to $Za$; hence, due to a peculiar property of Cauchy sequences
-- captured by the THEORY cauchyseq_lemma,
-- the set of all intersections $i*j$ with $i,j in (Za-(next(u0) + n0))$ such that
-- $Recip(gp~[i]) ¥Ra_MINUS Recip(gp~[j]) ¥Ra_GT eps0$ is infinite. From this set we can
-- pick an element $i3*j3$.
--
        Suppose ==> Stat48: n0 notin {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)}
            ()-->Stat48(Stat27*) ==> Stat49: (not(FORALL i in (Za - n0) | (gp~[i]) /= Ra_0))
            n1-->Stat49(Stat49) ==> Stat50: (n1 in (Za - n0)) & ((gp~[n1]) = Ra_0)
                (gp,n1)-->T550(Stat50,Stat3*) ==> (gp~[n1]) in Ra
                n1-->Stat28(Stat27,Stat50*) ==> Ra_ABS(gp~[n1]) ¥Ra_GT Ra_0
                (Ra_ABS(gp~[n1]),Ra_0)-->T473(Stat49*) ==> Ra_ABS(gp~[n1]) /= Ra_0
        (gp~[n1])-->Stat11(Stat49*) ==> false; Discharge ==> Stat51: n0 in {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)}
        (Stat20,Stat51*)ELEM ==> Stat52: n0 notin a0
--
        Suppose ==> next(u0) notin Za
            ALGEBRA(Stat52) ==> 1 in Za
            u0-->T317(Stat47*) ==> (u0 ¥PLUS 1) = next(u0)
        (u0,1)-->T283(Stat47*) ==> false; Discharge ==> Stat53: next(u0) in Za
        (Stat27,Stat27*)ELEM ==> n0 in Za
	(Stat53)ELEM ==> Ord(n0) & Ord(next(u0))
        Suppose ==> (next(u0) + n0) notin Za
        (next(u0),n0)-->T29(Stat47*) ==> false; Discharge ==> (next(u0) + n0) in Za
--
        APPLY() cauchyseq_lemma(n0->(next(u0)+n0),R(i,j)->(Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i]) ¥Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j])) ¥Ra_GT eps0)) ==>
			Stat55: not(Finite({ i * j : i in (Za - (next(u0)+n0)), j in (Za - (next(u0)+n0)) | Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i]) ¥Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j])) ¥Ra_GT eps0 }))
        T188(Stat55*) ==> Finite(0)
        EQUAL(Stat55) ==> Stat56: { i * j : i in (Za - (next(u0)+n0)), j in (Za - (next(u0)+n0)) | Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i]) ¥Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j])) ¥Ra_GT eps0 } /= 0
        (i3,j3)-->Stat56(Stat56*) ==> Stat57: (i3 in (Za - (next(u0)+n0))) & (j3 in (Za - (next(u0)+n0))) & (Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i3]) ¥Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j3])) ¥Ra_GT eps0)
--
-- Obviously, $i3$ and $j3$ belong to $Za - n0$.
-- (It will turn out later that they do not exceed $next(u0)$
-- and the smaller of them is at most $u0$.)
--
        (Stat57,Stat57*)ELEM ==> Stat58: (i3 in Za) & (j3 in Za) & (i3 notin n0) & (j3 notin n0) & (i3 notin next(u0)) & (j3 notin next(u0))
--
--
--
        Suppose ==> Stat59: Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a))
            Suppose ==> Stat60: (i3 * j3) notin {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a))}
            (i3,j3)-->Stat60(Stat58*) ==> false; Discharge ==> Stat61: (i3 * j3) in {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a))}
            ({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a))})-->T274(Stat61*) ==> Stat62: (FORALL x in {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a))} | x ¥incin Un({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) ¥Ra_MINUS (gp~[j])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a))}))
            (i3 * j3)-->Stat62(Stat61,Stat46*) ==> Stat63: (i3 * j3) ¥incin u0
--
            (Stat58)ELEM ==> Stat64: Ord(i3) & Ord(j3)
            (i3,j3)-->T29(Stat64*) ==> Stat66: ((i3 * j3) = i3) or ((j3 * i3) = j3)
--
            Suppose ==> (not(Ord(i3 * j3))) or ((i3 * j3) notin (Za - next(u0)))
                Suppose ==> (i3 * j3) = i3
                    (Stat58,Stat58*)ELEM ==> i3 in (Za - next(u0))
                EQUAL(Stat64) ==> false; Discharge ==> Stat67: (i3 * j3) /= i3
                (Stat66,Stat67*)ELEM ==> (i3 * j3) = j3
                (Stat58,Stat58*)ELEM ==> j3 in (Za - next(u0))
            EQUAL(Stat64) ==> false; Discharge ==> Stat68: Ord(i3 * j3) & ((i3 * j3) in (Za - next(u0)))
            Use_def(next)(Stat68) ==> (i3 * j3) in (Za - (u0+{u0}))
            (u0,i3 * j3)-->T31(Stat47*) ==> Stat69: (u0 in (i3 * j3)) 
        (Stat69,Stat63*)ELEM ==> false; Discharge ==> Stat70: not(Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3])) ¥Ra_GT (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a)))
--
--
--
        Suppose ==> Stat71: not(Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])) ¥Ra_GT eps0)
            TELEM ==> Stat72: Svm({[i, Recip(gp~[i])]: i in Za}) & (domain({[i, Recip(gp~[i])]: i in Za}) = Za)
            Suppose ==> Stat73: [i3,Recip(gp~[i3])] notin {[i,Recip(gp~[i])]: i in Za}
            i3-->Stat73(Stat58*) ==> false; Discharge ==> Stat74: [i3,Recip(gp~[i3])] in {[i,Recip(gp~[i])]: i in Za}
            Suppose ==> Stat75: [j3,Recip(gp~[j3])] notin {[i,Recip(gp~[i])]: i in Za}
            j3-->Stat75(Stat58*) ==> false; Discharge ==> [j3,Recip(gp~[j3])] in {[i,Recip(gp~[i])]: i in Za}
            ({[i,Recip(gp~[i])]: i in Za},[i3,Recip(gp~[i3])])-->T74(Stat74*) ==> ({[i,Recip(gp~[i])]: i in Za}~[car([i3,Recip(gp~[i3])])]) = cdr([i3,Recip(gp~[i3])])
            ({[i,Recip(gp~[i])]: i in Za},[j3,Recip(gp~[j3])])-->T74(Stat74*) ==> ({[i,Recip(gp~[i])]: i in Za}~[car([j3,Recip(gp~[j3])])]) = cdr([j3,Recip(gp~[j3])])
            TELEM ==> car([i3,Recip(gp~[i3])]) = i3
            TELEM ==> cdr([i3,Recip(gp~[i3])]) = Recip(gp~[i3])
            TELEM ==> car([j3,Recip(gp~[j3])]) = j3
            TELEM ==> cdr([j3,Recip(gp~[j3])]) = Recip(gp~[j3])
            EQUAL(Stat70) ==> Stat76: not(Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i3]) ¥Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j3])) ¥Ra_GT eps0)
        (Stat57,Stat76*)ELEM ==> false; Discharge ==> Stat77: Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])) ¥Ra_GT eps0
--
--
--
        (gp,j3)-->T550(Stat58,Stat3*) ==> Stat78: (gp~[j3]) in Ra
        (gp,i3)-->T550(Stat58,Stat3*) ==> Stat79: (gp~[i3]) in Ra
        Suppose ==> Stat80: Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])) notin Ra
            Suppose ==> Stat81: ((gp~[i3]) = Ra_0) or ((gp~[j3]) = Ra_0)
                i3-->Stat21(Stat20*) ==> (gp~[i3]) /= Ra_0
                j3-->Stat21(Stat20*) ==> (gp~[j3]) /= Ra_0
            (Stat81*)Discharge ==> Stat82: not(((gp~[i3]) = Ra_0) or ((gp~[j3]) = Ra_0))
            (gp~[j3])-->T462(Stat78,Stat82*) ==> Stat83: Recip(gp~[j3]) in Ra
            (gp~[i3])-->T462(Stat79,Stat82*) ==> Stat84: Recip(gp~[i3]) in Ra
            ALGEBRA(Stat83,Stat84) ==> Stat85: (Ra_Rev(Recip(gp~[j3])) in Ra) &
			((Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])) in Ra)
        (Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3]))-->T527(Stat85,Stat80*) ==> false; Discharge ==> Stat86: Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])) in Ra
--
        T513(Stat79*) ==> Stat87: (FORALL x in Ra | not(x ¥Ra_LT x))
        eps0-->Stat87(Stat25,Stat25*) ==> Stat88: not(eps0 ¥Ra_LT eps0)
        Suppose ==> Stat89: not(Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])) ¥Ra_LE eps0)
            (Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])),eps0)-->T526(Stat86,Stat25,Stat89*) ==> Stat90: Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])) ¥Ra_GT eps0
            (i3,j3)-->Stat38(Stat58*) ==> Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])) ¥Ra_LE ((Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a)))
            (Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])),((Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a))))-->T473(Stat86*) ==> Stat91: ((Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a))) ¥Ra_GE Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3]))
            ALGEBRA(Stat78,Stat79) ==> ((gp~[i3]) ¥Ra_MINUS (gp~[j3])) in Ra
            ((gp~[i3]) ¥Ra_MINUS (gp~[j3]))-->T527(Stat91*) ==> Stat92: (Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3])) in Ra) & (Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3])) ¥Ra_GE Ra_0)
            ALGEBRA(Stat92,Stat30) ==> Stat93: ((Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a))) in Ra
            (((Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a))),Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])),eps0)-->T510(Stat86,Stat93,Stat25,Stat90,Stat91*) ==> Stat94: ((Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a))) ¥Ra_GT eps0
            ALGEBRA(Stat25,Stat27,Stat30*) ==> Stat95: ((eps0 ¥Ra_TIMES (a ¥Ra_TIMES a)) in Ra) & (Ra_0 in Ra) & ((Ra_0 ¥Ra_TIMES Recip(a)) = Ra_0)
            (Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3])),eps0 ¥Ra_TIMES (a ¥Ra_TIMES a))-->T526(Stat70*) ==> Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3])) ¥Ra_LE (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a))
            a-->T491(Stat27*) ==> Stat96: Recip(a) ¥Ra_GT Ra_0
            (Recip(a),Ra_0,Recip(a))-->T488(Stat30,Stat95,Stat96*) ==> (Recip(a) ¥Ra_TIMES Recip(a)) ¥Ra_GT (Ra_0 ¥Ra_TIMES Recip(a))
            EQUAL(Stat95) ==> (Recip(a) ¥Ra_TIMES Recip(a)) ¥Ra_GT Ra_0
            (Recip(a) ¥Ra_TIMES Recip(a),Ra_0)-->T473(Stat96*) ==> Stat97: (Recip(a) ¥Ra_TIMES Recip(a)) ¥Ra_GE Ra_0
            (Recip(a) ¥Ra_TIMES Recip(a))-->Stat14(Stat31,Stat31*) ==> (Recip(a) ¥Ra_TIMES Recip(a)) ¥Ra_LE (Recip(a) ¥Ra_TIMES Recip(a))
            (Recip(a) ¥Ra_TIMES Recip(a),Recip(a) ¥Ra_TIMES Recip(a))-->T473(Stat97*) ==> Stat98: (Recip(a) ¥Ra_TIMES Recip(a)) ¥Ra_GE (Recip(a) ¥Ra_TIMES Recip(a))
            (Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3])),eps0 ¥Ra_TIMES (a ¥Ra_TIMES a))-->T473(Stat95*) ==> Stat99: (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a)) ¥Ra_GE Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3]))
            (eps0 ¥Ra_TIMES (a ¥Ra_TIMES a),Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3])),Recip(a) ¥Ra_TIMES Recip(a),Recip(a) ¥Ra_TIMES Recip(a))-->T516(Stat95,Stat92,Stat31,Stat99,Stat97,Stat98*) ==> ((eps0 ¥Ra_TIMES (a ¥Ra_TIMES a)) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a))) ¥Ra_GE (Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3])) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a)))
            (eps0,a)-->T463(Stat25,Stat27,Stat29*) ==> ((eps0 ¥Ra_TIMES (a ¥Ra_TIMES a)) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a))) = eps0
            EQUAL(Stat99*) ==> Stat100: eps0 ¥Ra_GE (Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3])) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a)))
            (eps0,Ra_ABS((gp~[i3]) ¥Ra_MINUS (gp~[j3])) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(a)),eps0)-->T510(Stat25,Stat93,Stat100,Stat94*) ==> Stat102: eps0 ¥Ra_GT eps0
        (eps0,eps0)-->T473(Stat102,Stat88*) ==> false; Discharge ==> Stat103: Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])) ¥Ra_LE eps0
        (Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])),eps0)-->T473(Stat103,Stat103*) ==> Stat104: eps0 ¥Ra_GE Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3]))
        (eps0,Ra_ABS(Recip(gp~[i3]) ¥Ra_MINUS Recip(gp~[j3])),eps0)-->T510(Stat25,Stat86,Stat77,Stat104*) ==> eps0 ¥Ra_GT eps0
--
    (eps0,eps0)-->T473(Stat88*) ==> false; Discharge ==> QED
--
-- Our next lemma states that if $f,fp$ and $g,gp$ are rational
-- sequences, with $f$ equivalent to $g$ and $fp$ equivalent to $gp$, then the pointwise
-- sum of $f$ and $fp$ is equivalent to the pointwise sum of $g$ and $gp$.
--
Theorem 571: (({F,G,Fp,Gp} ¥incin RaSeq) & Ra_eqseq(F,G) & Ra_eqseq(Fp,Gp)) ¥imp Ra_eqseq(F ¥Ras_PLUS Fp, G ¥Ras_PLUS Gp). Proof:
    Suppose_not(fq,gq,fp,gp) ==> ({fq,gq,fp,gp} ¥incin RaSeq) &
		Ra_eqseq(fq,gq) & Ra_eqseq(fp,gp) & (not Ra_eqseq(fq ¥Ras_PLUS fp, gq ¥Ras_PLUS gp))
--
-- Suppose that $fq,gq,fp,gp$ are a counterexample to our assertion. Then by definition of equivalence of rational
-- sequences, there exists  some positive rational number $eps0$ for which the set
--	${x : x in domain(fq ¥Ras_PLUS fp) | Ra_ABS(((fq ¥Ras_PLUS fp)~[x]) ¥Ra_MINUS ((gq ¥Ras_PLUS gp)~[x])) ¥Ra_GT eps0}$
-- is infinite. But $eps0$ can be writen as the sum $eps1,eps2$ of two smaller positive rationals,
-- and for these the two analogous sets formed using $fq,gq,eps1$ and $fp,gp,eps2$ respectively,
-- are finite.
--
	(fq,gq)-->T541 ==> Stat1: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp Finite({x : x in Za | Ra_ABS((fq~[x]) ¥Ra_MINUS (gq~[x])) ¥Ra_GT eps}))
	(fp,gp)-->T541 ==> Stat2: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp Finite({x : x in Za | Ra_ABS((fp~[x]) ¥Ra_MINUS (gp~[x])) ¥Ra_GT eps}))
	(fq,fp)-->T554 ==> (fq ¥Ras_PLUS fp) in RaSeq
	(gq,gp)-->T554 ==> (gq ¥Ras_PLUS gp) in RaSeq
	(fq ¥Ras_PLUS fp,gq ¥Ras_PLUS gp)-->T541 ==> Stat3: (not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
	Finite({x : x in Za | Ra_ABS(((fq ¥Ras_PLUS fp)~[x]) ¥Ra_MINUS ((gq ¥Ras_PLUS gp)~[x])) ¥Ra_GT eps})))
	eps0-->Stat3 ==> (eps0 in Ra) & (eps0 ¥Ra_GT Ra_0) & (not
	Finite({x : x in Za | Ra_ABS(((fq ¥Ras_PLUS fp)~[x]) ¥Ra_MINUS ((gq ¥Ras_PLUS gp)~[x])) ¥Ra_GT eps0}))
	eps0-->T522 ==> Stat4: (EXISTS e in Ra, e0 in Ra | (eps0 ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e ¥Ra_GT Ra_0) & (eps0 ¥Ra_GT (e ¥Ra_PLUS e0)))
	(eps1,eps2)-->Stat4 ==> (eps1 in Ra) & (eps2 in Ra) & (eps2 ¥Ra_GT Ra_0) & (eps1 ¥Ra_GT Ra_0) & (eps0 ¥Ra_GT (eps1 ¥Ra_PLUS eps2))
	eps1-->Stat1 ==> Finite({x : x in Za | Ra_ABS((fq~[x]) ¥Ra_MINUS (gq~[x])) ¥Ra_GT eps1})
	eps2-->Stat2 ==> Finite({x : x in Za | Ra_ABS((fp~[x]) ¥Ra_MINUS (gp~[x])) ¥Ra_GT eps2})
--
-- However, it is easily seen that the infinite set noted above is included in the union of the
-- two other sets, giving a contradiction which proves our theorem. Indeed, it follows that
-- there must exit an integer m such that $Ra_ABS(((fq~[m] ¥Ra_PLUS fp~[m]) ¥Ra_MINUS ((gq~[m] ¥Ra_PLUS gp~[m]))) ¥Ra_GT eps0$
-- while $Ra_ABS((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_LE eps1$ and $Ra_ABS((fp~[m]) ¥Ra_MINUS (gp~[m])) ¥Ra_LE eps2$,
--
    Suppose ==> Stat5: not({x : x in Za | Ra_ABS(((fq ¥Ras_PLUS fp)~[x]) ¥Ra_MINUS ((gq ¥Ras_PLUS gp)~[x])) ¥Ra_GT eps0} ¥incin ({x : x in Za | Ra_ABS((fq~[x]) ¥Ra_MINUS (gq~[x])) ¥Ra_GT eps1} + {x : x in Za | Ra_ABS((fp~[x]) ¥Ra_MINUS (gp~[x])) ¥Ra_GT eps2}))
	n--> Stat5 ==> Stat6: (n in {x : x in Za | Ra_ABS(((fq ¥Ras_PLUS fp)~[x]) ¥Ra_MINUS ((gq ¥Ras_PLUS gp)~[x])) ¥Ra_GT eps0}) &
					Stat7: (n notin {x : x in Za | Ra_ABS((fq~[x]) ¥Ra_MINUS (gq~[x])) ¥Ra_GT eps1}) &
					Stat8: (n notin {x : x in Za | Ra_ABS((fp~[x]) ¥Ra_MINUS (gp~[x])) ¥Ra_GT eps2})
	m-->Stat6 ==> (n = m) & (m in Za) & (Ra_ABS(((fq ¥Ras_PLUS fp)~[m]) ¥Ra_MINUS ((gq ¥Ras_PLUS gp)~[m])) ¥Ra_GT eps0)
	m-->Stat7 ==> not (Ra_ABS((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_GT eps1)
	m-->Stat8 ==> not (Ra_ABS((fp~[m]) ¥Ra_MINUS (gp~[m])) ¥Ra_GT eps2)
--
-- which is in contradiction with an elementary rational inequality.
--
	(fq,m)-->T540 ==> fq~[m] in Ra
	(gq,m)-->T540 ==> gq~[m] in Ra
	(fp,m)-->T540 ==> fp~[m] in Ra
	(gp,m)-->T540 ==> gp~[m] in Ra
	(fq,fp,m)-->T555 ==> (fq ¥Ras_PLUS fp)~[m] = ((fq~[m]) ¥Ra_PLUS (fp~[m]))
	(gq,gp,m)-->T555 ==> (gq ¥Ras_PLUS gp)~[m] = ((gq~[m]) ¥Ra_PLUS (gp~[m]))
	EQUAL ==> Stat9: Ra_ABS(((fq~[m]) ¥Ra_PLUS (fp~[m])) ¥Ra_MINUS ((gq~[m]) ¥Ra_PLUS (gp~[m]))) ¥Ra_GT eps0
	ALGEBRA ==> ((fq~[m]) ¥Ra_PLUS (fp~[m])) ¥Ra_MINUS ((gq~[m]) ¥Ra_PLUS (gp~[m])) = ((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS ((fp~[m]) ¥Ra_MINUS (gp~[m]))
	EQUAL ==> Ra_ABS(((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS ((fp~[m]) ¥Ra_MINUS (gp~[m]))) ¥Ra_GT eps0
	ALGEBRA ==> Stat10: (fq~[m]) ¥Ra_MINUS (gq~[m]) in Ra
	ALGEBRA ==> Stat11: (fp~[m]) ¥Ra_MINUS (gp~[m]) in Ra
	((fq~[m]) ¥Ra_MINUS (gq~[m]))-->T527 ==> Ra_ABS((fq~[m]) ¥Ra_MINUS (gq~[m])) in Ra
	((fp~[m]) ¥Ra_MINUS (gp~[m]))-->T527 ==> Ra_ABS((fp~[m]) ¥Ra_MINUS (gp~[m])) in Ra
	(Ra_ABS((fq~[m]) ¥Ra_MINUS (gq~[m])),eps1)-->T478 ==> eps1 ¥Ra_GE Ra_ABS((fq~[m]) ¥Ra_MINUS (gq~[m]))
	(Ra_ABS((fp~[m]) ¥Ra_MINUS (gp~[m])),eps2)-->T478 ==> eps2 ¥Ra_GE Ra_ABS((fp~[m]) ¥Ra_MINUS (gp~[m]))
	(eps1,Ra_ABS((fq~[m]) ¥Ra_MINUS (gq~[m])),eps2,Ra_ABS((fp~[m]) ¥Ra_MINUS (gp~[m])))-->T493 ==> Stat12: (eps1 ¥Ra_PLUS eps2) ¥Ra_GE (Ra_ABS((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS Ra_ABS((fp~[m]) ¥Ra_MINUS (gp~[m])))
	T525 ==> Stat13: (FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_ABS(x ¥Ra_PLUS y) ¥Ra_LE (Ra_ABS(x) ¥Ra_PLUS Ra_ABS(y))))
	((fq~[m]) ¥Ra_MINUS (gq~[m]),(fp~[m]) ¥Ra_MINUS (gp~[m]))-->Stat13(Stat10,Stat11) ==> Ra_ABS(((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS ((fp~[m]) ¥Ra_MINUS (gp~[m]))) ¥Ra_LE (Ra_ABS((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS Ra_ABS((fp~[m]) ¥Ra_MINUS (gp~[m])))
	(Ra_ABS(((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS ((fp~[m]) ¥Ra_MINUS (gp~[m]))),Ra_ABS((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS Ra_ABS((fp~[m]) ¥Ra_MINUS (gp~[m])))-->T473 ==> Stat14: (Ra_ABS((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS Ra_ABS((fp~[m]) ¥Ra_MINUS (gp~[m]))) ¥Ra_GE Ra_ABS(((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS ((fp~[m]) ¥Ra_MINUS (gp~[m])))
	ALGEBRA ==> Stat15: (eps1 ¥Ra_PLUS eps2 in Ra) & ((Ra_ABS((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS Ra_ABS((fp~[m]) ¥Ra_MINUS (gp~[m]))) in Ra)
	ALGEBRA ==> (((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS ((fp~[m]) ¥Ra_MINUS (gp~[m]))) in Ra
	ALGEBRA ==> Stat16: (Ra_ABS((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS Ra_ABS((fp~[m]) ¥Ra_MINUS (gp~[m]))) in Ra
	(((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS ((fp~[m]) ¥Ra_MINUS (gp~[m])))-->T527 ==> Stat17: Ra_ABS(((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS ((fp~[m]) ¥Ra_MINUS (gp~[m]))) in Ra
	(eps1 ¥Ra_PLUS eps2,Ra_ABS((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS Ra_ABS((fp~[m]) ¥Ra_MINUS (gp~[m])),Ra_ABS(((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS ((fp~[m]) ¥Ra_MINUS (gp~[m]))))-->T480(Stat14,Stat12,Stat17,Stat16,Stat15) ==> (eps1 ¥Ra_PLUS eps2) ¥Ra_GE Ra_ABS(((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS ((fp~[m]) ¥Ra_MINUS (gp~[m])))
	(eps1 ¥Ra_PLUS eps2,Ra_ABS(((fq~[m]) ¥Ra_MINUS (gq~[m])) ¥Ra_PLUS ((fp~[m]) ¥Ra_MINUS (gp~[m]))),eps0)-->T496 ==> Stat18: (eps1 ¥Ra_PLUS eps2) ¥Ra_GT eps0
	(eps0,eps1 ¥Ra_PLUS eps2,eps0)-->T498 ==> eps0 ¥Ra_GT eps0
	(eps0,eps0)-->T473 ==> false; Discharge ==> {x : x in Za | Ra_ABS(((fq ¥Ras_PLUS fp)~[x]) ¥Ra_MINUS ((gq ¥Ras_PLUS gp)~[x])) ¥Ra_GT eps0} ¥incin ({x : x in Za | Ra_ABS((fq~[x]) ¥Ra_MINUS (gq~[x])) ¥Ra_GT eps1} + {x : x in Za | Ra_ABS((fp~[x]) ¥Ra_MINUS (gp~[x])) ¥Ra_GT eps2})
	({x : x in Za | Ra_ABS((fq~[x]) ¥Ra_MINUS (gq~[x])) ¥Ra_GT eps1},{x : x in Za | Ra_ABS((fp~[x]) ¥Ra_MINUS (gp~[x])) ¥Ra_GT eps2})-->T236 ==> Finite({x : x in Za | Ra_ABS((fq~[x]) ¥Ra_MINUS (gq~[x])) ¥Ra_GT eps1} + {x : x in Za | Ra_ABS((fp~[x]) ¥Ra_MINUS (gp~[x])) ¥Ra_GT eps2})
	({x : x in Za | Ra_ABS((fq~[x]) ¥Ra_MINUS (gq~[x])) ¥Ra_GT eps1} + {x : x in Za | Ra_ABS((fp~[x]) ¥Ra_MINUS (gp~[x])) ¥Ra_GT eps2},{x : x in Za | Ra_ABS(((fq ¥Ras_PLUS fp)~[x]) ¥Ra_MINUS ((gq ¥Ras_PLUS gp)~[x])) ¥Ra_GT eps0})-->T189 ==> false
	Discharge ==> QED
--
-- A trivial corollary of the lemma stating that when $f,fp$ and $g,gp$ are rational
-- sequences with $f$ equivalent to $g$ and $fp$ equivalent to $gp$ then the pointwise
-- sum of $f$ and $fp$ is equivalent to the pointwise sum of $g$ and $gp$ is the
-- analogous lemma stating the same for rational Cauchy sequences.
--
Theorem 572: (({F,G,Fp,Gp} ¥incin RaCauchy) & Ra_eqseq(F,G) & Ra_eqseq(Fp,Gp)) ¥imp Ra_eqseq(F ¥Ras_PLUS Fp, G ¥Ras_PLUS Gp). Proof:
    Suppose_not(fq,gq,fp,gp) ==> ({fq,gq,fp,gp} ¥incin RaCauchy) &
		Ra_eqseq(fq,gq) & Ra_eqseq(fp,gp) & (not Ra_eqseq(fq ¥Ras_PLUS fp, gq ¥Ras_PLUS gp))
        Use_def(RaCauchy) ==> Stat1: (fq in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
                            & Stat2: (fp in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
                            & Stat3: (gq in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
                            & Stat4: (gp in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
       ()-->Stat1 ==> fq in RaSeq
       ()-->Stat2 ==> fp in RaSeq
       ()-->Stat3 ==> gq in RaSeq
       ()-->Stat4 ==> gp in RaSeq
    (fq,gq,fp,gp)-->T571 ==> false; Discharge ==> QED
--
-- Our next lemma states that when $f,fp$ and $g$ are rational Cauchy
-- sequences with $f$ equivalent to $fp$ then the pointwise
-- product of $f$ and $g$ is equivalent to the pointwise product of $fp$ and $g$.
--
Theorem 573: (({F,Fp,G} ¥incin RaCauchy) & Ra_eqseq(F,Fp)) ¥imp Ra_eqseq(F ¥Ras_TIMES G, Fp ¥Ras_TIMES G). Proof:
    Suppose_not(fq,fp,gp) ==> AUTO
--
-- For, suppose $fq,gq,gp$ to be a counterexample to our assertion.
-- The definition of equivalence between rational
-- sequences implies that for some positive rational number $eps=eps0$, the set
--	${x : x in domain(fq ¥Ras_TIMES gp) | Ra_ABS(((fq ¥Ras_TIMES gp)~[x]) ¥Ra_MINUS ((fp ¥Ras_TIMES gp)~[x])) ¥Ra_GT eps}$
-- is infinite, whereas the analogous set which has $fq,fp,(eps0 ¥Ra_OVER m)$
-- in place of $(fq ¥Ras_TIMES gp)$, $(fp ¥Ras_TIMES gp)$ is finite,
-- where $m$ $eps1$ is a number exceeding the absolute values
-- of all components of the sequence $gp$.
--
        Use_def(Ra_eqseq) ==> Stat1: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in domain(fq) | Ra_ABS((fq~[x]) ¥Ra_MINUS (fp~[x])) ¥Ra_GT eps})) &
		Stat2: (not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in domain(fq ¥Ras_TIMES gp) | Ra_ABS(((fq ¥Ras_TIMES gp)~[x]) ¥Ra_MINUS ((fp ¥Ras_TIMES gp)~[x])) ¥Ra_GT eps})))
        eps0-->Stat2 ==> Stat3: (eps0 in Ra) & (eps0 ¥Ra_GT Ra_0) & (not
		Finite({x : x in domain(fq ¥Ras_TIMES gp) | Ra_ABS(((fq ¥Ras_TIMES gp)~[x]) ¥Ra_MINUS ((fp ¥Ras_TIMES gp)~[x])) ¥Ra_GT eps0}))
        gp-->T560 ==> Stat4: (EXISTS x in Ra | (FORALL y in range(gp) | Ra_ABS(y) ¥Ra_LT x ))
        m-->Stat4(Stat4) ==> Stat5: (m in Ra) & Stat6: (FORALL y in range(gp) | Ra_ABS(y) ¥Ra_LT m)
        Use_def(RaCauchy) ==> Stat7: gp in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
        ()-->Stat7 ==> Stat8: gp in RaSeq
        gp-->T546 ==> Stat9: (domain(gp) = Za) & (range(gp) ¥incin Ra)
        T451 ==> Stat10: Ra_0 in Ra
        Suppose ==> not(m ¥Ra_GT Ra_0)
            T211 ==> 0 in domain(gp)
            (0,gp)-->T71 ==> (gp~[0]) in range(gp)
            (gp~[0])-->Stat6 ==> Ra_ABS(gp~[0]) ¥Ra_LT m
            (gp~[0])-->T527 ==> Ra_ABS(gp~[0]) ¥Ra_GE Ra_0
            (Ra_ABS(gp~[0]), m)-->T473 ==> m ¥Ra_GT Ra_ABS(gp~[0])
            (gp~[0])-->T527 ==> Ra_ABS(gp~[0]) in Ra
        (m, Ra_ABS(gp~[0]), Ra_0)-->T509 ==> false; Discharge ==> m ¥Ra_GT Ra_0
        (m, Ra_0)-->T473 ==> m /= Ra_0
        m-->T462 ==> Stat11: (Recip(m) in Ra) & ((m ¥Ra_TIMES Recip(m)) = Ra_1)
        m-->T491 ==> Recip(m) ¥Ra_GT Ra_0
        Suppose ==> not(Finite({x : x in domain(fq) | Ra_ABS((fq~[x]) ¥Ra_MINUS (fp~[x])) ¥Ra_GT (eps0 ¥Ra_TIMES Recip(m))}))
            (eps0, Ra_0, Recip(m))-->T488 ==> Stat12: (eps0 ¥Ra_TIMES Recip(m)) ¥Ra_GT (Ra_0 ¥Ra_TIMES Recip(m))
            (Ra_0, Recip(m))-->T448(Stat10) ==> (Ra_0 ¥Ra_TIMES Recip(m)) = (Recip(m) ¥Ra_TIMES Ra_0)
            (Recip(m))-->T489(Stat10) ==> (Recip(m) ¥Ra_TIMES Ra_0) = Ra_0
            EQUAL(Stat12) ==> (eps0 ¥Ra_TIMES Recip(m)) ¥Ra_GT Ra_0
            (eps0, Recip(m))-->T448(Stat1) ==> (eps0 ¥Ra_TIMES Recip(m)) in Ra
        (eps0 ¥Ra_TIMES Recip(m))-->Stat1 ==> false; Discharge ==> Finite({x : x in domain(fq) | Ra_ABS((fq~[x]) ¥Ra_MINUS (fp~[x])) ¥Ra_GT (eps0 ¥Ra_TIMES Recip(m))})
--
-- We will reach the desired contradiction, thus proving the present lemma, by showing that
-- the former of the two sets mentioned above is included in the latter. Hence, since the latter
-- is finite, the former cannot be infinite. Temporarily assuming that the inclusion does not hold,
-- we can find an unsigned integer $i0$ belonging to the former set but not belonging to the latter,
-- so that
--	$Ra_ABS(((fq ¥Ras_TIMES gp)~[i0]) ¥Ra_MINUS ((fp ¥Ras_TIMES gp)~[i0])) ¥Ra_GT eps0$,
--	$not Ra_ABS((fq~[i0]) ¥Ra_MINUS (fp~[i0])) ¥Ra_GT (eps0 ¥Ra_OVER Recip(m))$.
--
        Suppose ==> Stat13: not({x : x in domain(fq ¥Ras_TIMES gp) | Ra_ABS(((fq ¥Ras_TIMES gp)~[x]) ¥Ra_MINUS ((fp ¥Ras_TIMES gp)~[x])) ¥Ra_GT eps0} ¥incin {x : x in domain(fq) | Ra_ABS((fq~[x]) ¥Ra_MINUS (fp~[x])) ¥Ra_GT (eps0 ¥Ra_TIMES Recip(m))})
            Use_def(RaCauchy) ==> Stat14: (fq in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
		& Stat15: (fp in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
            ()-->Stat14 ==> Stat16: fq in RaSeq
            ()-->Stat15 ==> Stat17: fp in RaSeq
            (fq,gp)-->T554 ==> ((fq ¥Ras_TIMES gp) in RaSeq) & ((fq ¥Ras_TIMES gp) = {[u,((fq~[u]) ¥Ra_TIMES (gp~[u]))]: u in Za})
            (fp,gp)-->T554 ==> ((fp ¥Ras_TIMES gp) = {[u,((fp~[u]) ¥Ra_TIMES (gp~[u]))]: u in Za})
            fq-->T546 ==> domain(fq) = Za
            (fq ¥Ras_TIMES gp)-->T546 ==> domain(fq ¥Ras_TIMES gp) = Za
            EQUAL(Stat13) ==> Stat18: not({x : x in Za | Ra_ABS(((fq ¥Ras_TIMES gp)~[x]) ¥Ra_MINUS ((fp ¥Ras_TIMES gp)~[x])) ¥Ra_GT eps0} ¥incin {x : x in Za | Ra_ABS((fq~[x]) ¥Ra_MINUS (fp~[x])) ¥Ra_GT (eps0 ¥Ra_TIMES Recip(m))})
            i0-->Stat18 ==> Stat19: (i0 in Za) & (Ra_ABS(((fq ¥Ras_TIMES gp)~[i0]) ¥Ra_MINUS ((fp ¥Ras_TIMES gp)~[i0])) ¥Ra_GT eps0) &
			(not Ra_ABS((fq~[i0]) ¥Ra_MINUS (fp~[i0])) ¥Ra_GT (eps0 ¥Ra_TIMES Recip(m)))
            Use_def(¥Ra_MINUS) ==> (not Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])) ¥Ra_GT (eps0 ¥Ra_TIMES Recip(m)))
--
-- On the one hand, we observe that
--	$(eps0 ¥Ra_OVER Recip(m)) ¥Ra_GE Ra_ABS((fq~[i0]) ¥Ra_MINUS (fp~[i0]))$,
--
            (fq,fp,i0)-->T555(Stat16,Stat17,Stat19*) ==> Stat20: ((fq~[i0]) in Ra) & ((fp~[i0]) in Ra)
            ALGEBRA(Stat20) ==> (Ra_Rev(fp~[i0]) in Ra) &
		(((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])) in Ra)
            ((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))-->T527 ==> (Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])) in Ra) & (Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])) ¥Ra_GE Ra_0)
            (gp,i0)-->T540(Stat8,Stat19*) ==> Stat21: (gp~[i0]) in Ra
            (i0,gp)-->T71(Stat19,Stat9*) ==> (gp~[i0]) in range(gp)
            (gp~[i0])-->T527 ==> Stat22: Ra_ABS(gp~[i0]) in Ra
            ((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))-->T527 ==> Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])) in Ra
            ALGEBRA(Stat3,Stat11) ==> (eps0 ¥Ra_TIMES Recip(m)) in Ra
	    (Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])), eps0 ¥Ra_TIMES Recip(m))-->T473 ==> (eps0 ¥Ra_TIMES Recip(m)) ¥Ra_GE Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))
--
-- ... so that
--	$eps0 ¥Ra_GE (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fp~[i0])))$.
--
            (m, Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])))-->T448 ==> ((m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))) in Ra) & ((m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))) = (Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])) ¥Ra_TIMES m))
            Suppose ==> not(eps0 ¥Ra_GE (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))))
                ALGEBRA(Stat3,Stat5,Stat11) ==> (eps0 = eps0 ¥Ra_TIMES Ra_1) &
                		((m ¥Ra_TIMES Recip(m)) = (Recip(m) ¥Ra_TIMES m)) &
				((eps0 ¥Ra_TIMES (Recip(m) ¥Ra_TIMES m)) = ((eps0 ¥Ra_TIMES Recip(m)) ¥Ra_TIMES m))
                EQUAL(Stat10) ==> eps0 = ((eps0 ¥Ra_TIMES Recip(m)) ¥Ra_TIMES m)
                (eps0 ¥Ra_TIMES Recip(m), Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])))-->T473 ==> ((eps0 ¥Ra_TIMES Recip(m)) ¥Ra_GT Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))) or ((eps0 ¥Ra_TIMES Recip(m)) = Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])))
                Suppose ==> (eps0 ¥Ra_TIMES Recip(m)) = Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))
                    EQUAL ==> eps0 = (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])))
                (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])), eps0)-->T473 ==> false; Discharge ==> (eps0 ¥Ra_TIMES Recip(m)) ¥Ra_GT Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))
                (eps0 ¥Ra_TIMES Recip(m), Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])), m)-->T488(Stat4) ==> ((eps0 ¥Ra_TIMES Recip(m)) ¥Ra_TIMES m) ¥Ra_GT (Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])) ¥Ra_TIMES m)
                EQUAL ==> eps0 ¥Ra_GT (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])))
            (eps0, m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])))-->T473 ==> false; Discharge ==> eps0 ¥Ra_GE (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])))
--
-- On the other hand, we have that
--	$(Ra_ABS(gp~[i0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fp~[i0]))) ¥Ra_GT eps0$,
--
            APPLY() fcn_symbol(f(u)->((fq~[u]) ¥Ra_TIMES (gp~[u])), g->(fq ¥Ras_TIMES gp), s->Za) ==>
				Stat23: (FORALL x | ((fq ¥Ras_TIMES gp)~[x]) = if x in Za then ((fq~[x]) ¥Ra_TIMES (gp~[x])) else 0 end if)
            APPLY() fcn_symbol(f(u)->((fp~[u]) ¥Ra_TIMES (gp~[u])), g->(fp ¥Ras_TIMES gp), s->Za) ==>
				Stat24: (FORALL x | ((fp ¥Ras_TIMES gp)~[x]) = if x in Za then ((fp~[x]) ¥Ra_TIMES (gp~[x])) else 0 end if)
            Use_def(¥Ra_MINUS) ==> Stat25: Ra_ABS(((fq ¥Ras_TIMES gp)~[i0]) ¥Ra_PLUS Ra_Rev((fp ¥Ras_TIMES gp)~[i0])) ¥Ra_GT eps0
            i0-->Stat23(Stat19,Stat19) ==> ((fq ¥Ras_TIMES gp)~[i0]) = ((fq~[i0]) ¥Ra_TIMES (gp~[i0]))
            i0-->Stat24(Stat19,Stat19) ==> ((fp ¥Ras_TIMES gp)~[i0]) = ((fp~[i0]) ¥Ra_TIMES (gp~[i0]))
            ALGEBRA(Stat20,Stat21) ==> (((fq~[i0]) ¥Ra_TIMES (gp~[i0])) in Ra) & (((fq~[i0]) ¥Ra_TIMES (gp~[i0])) = ((gp~[i0]) ¥Ra_TIMES (fq~[i0]))) &
				(((fp~[i0]) ¥Ra_TIMES (gp~[i0])) in Ra) & (((fp~[i0]) ¥Ra_TIMES (gp~[i0])) = ((gp~[i0]) ¥Ra_TIMES (fp~[i0]))) &
				(Ra_Rev((gp~[i0]) ¥Ra_TIMES (fp~[i0])) = ((gp~[i0]) ¥Ra_TIMES Ra_Rev(fp~[i0]))) &
				((gp~[i0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])) = (((gp~[i0]) ¥Ra_TIMES (fq~[i0])) ¥Ra_PLUS ((gp~[i0]) ¥Ra_TIMES Ra_Rev(fp~[i0]))))
            (gp~[i0], (fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))-->T530 ==> Stat26: Ra_ABS((gp~[i0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))) = (Ra_ABS(gp~[i0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])))
            EQUAL(Stat25) ==> Ra_ABS((gp~[i0]) ¥Ra_TIMES ((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))) ¥Ra_GT eps0
            EQUAL(Stat26) ==> (Ra_ABS(gp~[i0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))) ¥Ra_GT eps0
--
-- ... and therefore that
--	$(m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_MINUS (fp~[i0]))) ¥Ra_GT eps0$.
--
            Suppose ==> not((m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))) ¥Ra_GT eps0)
                (gp~[i0])-->Stat6 ==> Ra_ABS(gp~[i0]) ¥Ra_LT m
                (Ra_ABS(gp~[i0]), m)-->T473 ==> m ¥Ra_GT Ra_ABS(gp~[i0])
                Suppose ==> not(Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])) ¥Ra_GT Ra_0)
                    (Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])), Ra_0)-->T473(Stat13) ==> Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])) = Ra_0
                    ALGEBRA(Stat22,Stat22) ==> (Ra_ABS(gp~[i0]) ¥Ra_TIMES Ra_0) = Ra_0
                    EQUAL(Stat26) ==> Ra_0 ¥Ra_GT eps0
                    (Ra_0,eps0,Ra_0)-->T511 ==> Ra_0 ¥Ra_GT Ra_0
                (Ra_0,Ra_0)-->T473 ==> false; Discharge ==> Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])) ¥Ra_GT Ra_0
                (m, Ra_ABS(gp~[i0]), Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])))-->T488(Stat4) ==> (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))) ¥Ra_GT (Ra_ABS(gp~[i0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])))
                (Ra_ABS(gp~[i0]), Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])))-->T448 ==> (Ra_ABS(gp~[i0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))) in Ra
            (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])), Ra_ABS(gp~[i0]) ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])), eps0)-->T511(Stat1) ==> false; Discharge ==> (m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0]))) ¥Ra_GT eps0
--
--
-- By exploiting one of the transitivity laws which the ordering of rational numbers obeys, we get that $eps0 ¥Ra_GT eps0$,
-- an absurdity showing that the desired inclusion between sets actually holds.
--
            (eps0, m ¥Ra_TIMES Ra_ABS((fq~[i0]) ¥Ra_PLUS Ra_Rev(fp~[i0])), eps0)-->T510 ==> eps0 ¥Ra_GT eps0
        (eps0, eps0)-->T473 ==> false; Discharge ==> {x : x in domain(fq) | Ra_ABS((fq~[x]) ¥Ra_MINUS (fp~[x])) ¥Ra_GT (eps0 ¥Ra_TIMES Recip(m))} incs {x : x in domain(fq ¥Ras_TIMES gp) | Ra_ABS(((fq ¥Ras_TIMES gp)~[x]) ¥Ra_MINUS ((fp ¥Ras_TIMES gp)~[x])) ¥Ra_GT eps0}
--
-- The desired conclusion now follows immediately.
--
    ({x : x in domain(fq) | Ra_ABS((fq~[x]) ¥Ra_MINUS (fp~[x])) ¥Ra_GT (eps0 ¥Ra_TIMES Recip(m))}, {x : x in domain(fq ¥Ras_TIMES gp) | Ra_ABS(((fq ¥Ras_TIMES gp)~[x]) ¥Ra_MINUS ((fp ¥Ras_TIMES gp)~[x])) ¥Ra_GT eps0})-->T189 ==> false; Discharge ==> QED
--
-- An easy corollary of the preceding lemma is the following:
-- When $fq,fp$ and $gq,gp$ are rational Cauchy sequences with $fq$
-- equivalent to $gq$ and $fp$ equivalent to $gp$,  the pointwise
-- product of $fq$ and $fp$ is equivalent to the pointwise product of $fp$ and $gp$.
--
Theorem 574: (({F,G,Fp,Gp} ¥incin RaCauchy) & Ra_eqseq(F,G) & Ra_eqseq(Fp,Gp)) ¥imp Ra_eqseq(F ¥Ras_TIMES Fp, G ¥Ras_TIMES Gp). Proof:
    Suppose_not(fq,gq,fp,gp) ==> ({fq,gq,fp,gp} ¥incin RaCauchy) &
		Ra_eqseq(fq,gq) & Ra_eqseq(fp,gp) & (not Ra_eqseq(fq ¥Ras_TIMES fp, gq ¥Ras_TIMES gp))
--
-- For, assuming $fq,gq,fp,gp$ to be a counterexample to the statement of this lemma, we reach
-- a contradiction by arguing as follows. If follows from the preceding lemma that
-- $gq ¥Ra_TIMES gp$ and $gp ¥Ra_TIMES fq$ are equivalent to
-- $fq ¥Ra_TIMES gp$ and to $fp ¥Ra_TIMES fq$, respectively.
--
        Use_def(RaCauchy) ==> Stat1: (fq in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
                            & Stat2: (fp in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
                            & Stat3: (gq in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
                            & Stat4: (gp in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
        ()-->Stat1 ==> fq in RaSeq
        ()-->Stat2 ==> fp in RaSeq
        ()-->Stat3 ==> gq in RaSeq
        ()-->Stat4 ==> gp in RaSeq
        gq-->T546 ==> Ra_eqseq(gq,gq)
        (fq, gq, gq)-->T553 ==> Ra_eqseq(gq,fq)
        gp-->T546 ==> Ra_eqseq(gp,gp)
        (fp, gp, gp)-->T553 ==> Ra_eqseq(gp,fp)
        (gq, fq, gp)-->T573 ==> Ra_eqseq(gq ¥Ras_TIMES gp, fq ¥Ras_TIMES gp)
        (gp, fp, fq)-->T573 ==> Ra_eqseq(gp ¥Ras_TIMES fq, fp ¥Ras_TIMES fq)
--
-- The sequence $gp ¥Ra_TIMES fq$ is easily shown to equal $fq ¥Ra_TIMES gp$,
-- and $fp ¥Ra_TIMES fq$ is likewise shown to equal $fq ¥Ra_TIMES fp$.
--
        (fq, gp)-->T554 ==> ((fq ¥Ras_TIMES gp) in RaSeq) & ((fq ¥Ras_TIMES gp) = {[u,((fq~[u]) ¥Ra_TIMES (gp~[u]))]: u in Za})
        (fp, fq)-->T554 ==> ((fp ¥Ras_TIMES fq) in RaSeq) & ((fp ¥Ras_TIMES fq) = {[u,((fp~[u]) ¥Ra_TIMES (fq~[u]))]: u in Za})
        (gq, gp)-->T554 ==> ((gq ¥Ras_TIMES gp) in RaSeq)
        (gp, fq)-->T554 ==> ((gp ¥Ras_TIMES fq) in RaSeq) & ((gp ¥Ras_TIMES fq) = {[u,((gp~[u]) ¥Ra_TIMES (fq~[u]))]: u in Za})
        (fq, fp)-->T554 ==> ((fq ¥Ras_TIMES fp) in RaSeq) & ((fq ¥Ras_TIMES fp) = {[u,((fq~[u]) ¥Ra_TIMES (fp~[u]))]: u in Za})
        fq-->T546 ==> Stat5: (domain(fq) = Za) & Svm(fq) & (range(fq) ¥incin Ra)
        fp-->T546 ==> Stat6: (domain(fp) = Za) & Svm(fp) & (range(fp) ¥incin Ra)
        gp-->T546 ==> Stat7: (domain(gp) = Za) & Svm(gp) & (range(gp) ¥incin Ra)
        Suppose ==> (fq ¥Ras_TIMES gp) /= (gp ¥Ras_TIMES fq)
            EQUAL ==> Stat8: {[u,((fq~[u]) ¥Ra_TIMES (gp~[u]))]: u in Za} /= {[u,((gp~[u]) ¥Ra_TIMES (fq~[u]))]: u in Za}
            u1-->Stat8 ==> Stat9: (u1 in Za) & (((fq~[u1]) ¥Ra_TIMES (gp~[u1])) /= ((gp~[u1]) ¥Ra_TIMES (fq~[u1])))
            (fq~[u1], gp~[u1])-->T448 ==> ((fq~[u1]) notin Ra) or ((gp~[u1]) notin Ra)
            Suppose ==> (fq~[u1]) notin Ra
                fq-->T73(Stat5) ==> Stat10: (fq~[u1]) notin {(fq~[j]): j in domain(fq)}
            u1-->Stat10(Stat5,Stat9) ==> false; Discharge ==> Stat11: (gp~[u1]) notin Ra
            gp-->T73(Stat7) ==> Stat12:  (gp~[u1]) notin {(gp~[j]): j in domain(gp)}
        u1-->Stat12(Stat7,Stat9) ==> false; Discharge ==> (fq ¥Ras_TIMES gp) = (gp ¥Ras_TIMES fq)
        Suppose ==> (fp ¥Ras_TIMES fq) /= (fq ¥Ras_TIMES fp)
            EQUAL ==> Stat13: {[u,((fp~[u]) ¥Ra_TIMES (fq~[u]))]: u in Za} /= {[u,((fq~[u]) ¥Ra_TIMES (fp~[u]))]: u in Za}
            u2-->Stat13 ==> Stat14: (u2 in Za) & (((fp~[u2]) ¥Ra_TIMES (fq~[u2])) /= ((fq~[u2]) ¥Ra_TIMES (fp~[u2])))
            (fp~[u2], fq~[u2])-->T448 ==> ((fp~[u2]) notin Ra) or ((fq~[u2]) notin Ra)
            Suppose ==> (fp~[u2]) notin Ra
                fp-->T73(Stat6) ==> Stat15: (fp~[u2]) notin {(fp~[j]): j in domain(fp)}
            u2-->Stat15(Stat6,Stat14) ==> false; Discharge ==> Stat16: (fq~[u2]) notin Ra
            fq-->T73(Stat5) ==> Stat17:  (fq~[u2]) notin {(fq~[j]): j in domain(fq)}
        u2-->Stat17(Stat5,Stat14) ==> false; Discharge ==> (fp ¥Ras_TIMES fq) = (fq ¥Ras_TIMES fp)
--
-- Therefore, by transitivity of the equivalence relation between rational sequences, we get
-- that $gq ¥Ra_TIMES gp$ and $fq ¥Ra_TIMES fp$, a contradiction leading to the desired conclusion.
--
        EQUAL ==> Ra_eqseq(gq ¥Ras_TIMES gp, gp ¥Ras_TIMES fq) & Ra_eqseq(gp ¥Ras_TIMES fq, fq ¥Ras_TIMES fp)
    (gq ¥Ras_TIMES gp, gp ¥Ras_TIMES fq, fq ¥Ras_TIMES fp)-->T553 ==> false; Discharge ==> QED
--
-- If two rational Cauchy sequences are equivalent, then their negatives are equivalent.
--
Theorem 575: (({F,G} ¥incin RaCauchy) & Ra_eqseq(F,G)) ¥imp Ra_eqseq(Ras_Rev(F),Ras_Rev(G)). Proof:
Suppose_not(f,g) ==> AUTO
	T539(*) ==> (f in RaSeq) & (g in RaSeq)
	(f,f)-->T554 ==> Ras_Rev(f) in RaSeq
	(g,g)-->T554 ==> Ras_Rev(g) in RaSeq
	(f,g)-->T541 ==> Stat1: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps}))
	(Ras_Rev(f),Ras_Rev(g))-->T541 ==> Stat2: not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in Za | Ra_ABS((Ras_Rev(f)~[x]) ¥Ra_MINUS (Ras_Rev(g)~[x])) ¥Ra_GT eps}))
	eps0-->Stat2 ==> Stat3: (eps0 in Ra) & (eps0 ¥Ra_GT Ra_0) & (not Finite({x : x in Za | Ra_ABS((Ras_Rev(f)~[x]) ¥Ra_MINUS (Ras_Rev(g)~[x])) ¥Ra_GT eps0}))
	eps0-->Stat1 ==> Stat4: Finite({x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps0})
	Suppose ==> Stat5: {x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps0} /= {x : x in Za | Ra_ABS((Ras_Rev(f)~[x]) ¥Ra_MINUS (Ras_Rev(g)~[x])) ¥Ra_GT eps0}
		x0-->Stat5 ==> Stat6: (x0 in Za) & ((Ra_ABS((f~[x0]) ¥Ra_MINUS (g~[x0])) ¥Ra_GT eps0) ¥eq (not(Ra_ABS((Ras_Rev(f)~[x0]) ¥Ra_MINUS (Ras_Rev(g)~[x0])) ¥Ra_GT eps0)))
		(f,x0)-->T550 ==> (f~[x0]) in Ra
		(g,g)-->T556 ==> Ras_Rev(g) in RaCauchy
		(g,g,x0)-->T555 ==> (Ras_Rev(g)~[x0]) = Ra_Rev(g~[x0])
		(f,f,x0)-->T555 ==> (Ras_Rev(f)~[x0]) = Ra_Rev(f~[x0])
		(Ras_Rev(g),x0)-->T550(Stat6) ==> Ra_Rev(g~[x0]) in Ra
		Suppose ==> Ra_ABS((f~[x0]) ¥Ra_MINUS (g~[x0])) = Ra_ABS(Ra_Rev(f~[x0]) ¥Ra_MINUS Ra_Rev(g~[x0]))
		EQUAL(Stat6) ==> false; Discharge ==> Stat7: Ra_ABS((f~[x0]) ¥Ra_MINUS (g~[x0])) /= Ra_ABS(Ra_Rev(f~[x0]) ¥Ra_MINUS Ra_Rev(g~[x0]))
		Use_def(¥Ra_MINUS)(Stat7) ==> Stat8: Ra_ABS((f~[x0]) ¥Ra_PLUS Ra_Rev(g~[x0])) /= Ra_ABS(Ra_Rev(f~[x0]) ¥Ra_PLUS Ra_Rev(Ra_Rev(g~[x0])))
		(f~[x0],Ra_Rev(g~[x0]))-->T445(Stat6*) ==> Stat9: ((f~[x0]) ¥Ra_PLUS Ra_Rev(g~[x0])) in Ra
		(f~[x0],Ra_Rev(g~[x0]))-->T492 ==> Ra_Rev((f~[x0]) ¥Ra_PLUS Ra_Rev(g~[x0])) = (Ra_Rev(f~[x0]) ¥Ra_PLUS Ra_Rev(Ra_Rev(g~[x0])))
		T525(Stat9*) ==> Stat10: (FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
		((f~[x0]) ¥Ra_PLUS Ra_Rev(g~[x0]))-->Stat10(Stat10,Stat9*) ==> Ra_ABS(Ra_Rev((f~[x0]) ¥Ra_PLUS Ra_Rev(g~[x0]))) = Ra_ABS((f~[x0]) ¥Ra_PLUS Ra_Rev(g~[x0]))
        EQUAL(Stat8) ==> false; Discharge ==> Stat11: {x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps0} = {x : x in Za | Ra_ABS((Ras_Rev(f)~[x]) ¥Ra_MINUS (Ras_Rev(g)~[x])) ¥Ra_GT eps0}
EQUAL(Stat11,Stat3,Stat4) ==> false; Discharge ==> QED
--
-- If two rational Cauchy sequences are equivalent, then their pointwise absolute values are equivalent.
--
Theorem 576: (({F,G} ¥incin RaCauchy) & Ra_eqseq(F,G)) ¥imp Ra_eqseq(Ras_ABS(F),Ras_ABS(G)). Proof:
Suppose_not(f,g) ==> AUTO
--
-- Reasoning by contradiction, let $f,g$ be a counterexample to the statement of this theorem.
-- Then we can take a positive rational number $eps0$ such that the set of subscripts
-- which index corresponding components of $Ras_ABS(f),Ras_ABS(g)$ differring by more than $eps0$
-- is infinite, whereas the analogous set of subscripts for $f,g$ is finite.
-- There is, hence, a nonnegative integer $n0$ belonging to the first but not the second
-- of these sets of subscripts.
--
	T539(*) ==> Stat1: (f in RaSeq) & (g in RaSeq)
	(f,f)-->T554(*) ==> Ras_ABS(f) in RaSeq
	(g,g)-->T554(*) ==> Ras_ABS(g) in RaSeq
	(f,g)-->T541(*) ==> Stat2: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp Finite({x : x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps}))
	(Ras_ABS(f),Ras_ABS(g))-->T541(*) ==> Stat3: not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp Finite({x : x in Za | Ra_ABS(((Ras_ABS(f))~[x]) ¥Ra_MINUS ((Ras_ABS(g))~[x])) ¥Ra_GT eps}))
	eps0-->Stat3 ==> Stat4: (eps0 in Ra) & (eps0 ¥Ra_GT Ra_0) & (not Finite({x: x in Za | Ra_ABS(((Ras_ABS(f))~[x]) ¥Ra_MINUS ((Ras_ABS(g))~[x])) ¥Ra_GT eps0}))
	eps0-->Stat2 ==> Finite({x: x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps0})
	({x: x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps0},{x: x in Za | Ra_ABS(((Ras_ABS(f))~[x]) ¥Ra_MINUS ((Ras_ABS(g))~[x])) ¥Ra_GT eps0})-->T189(Stat4*) ==> Stat5: not({x: x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps0} incs {x: x in Za | Ra_ABS(((Ras_ABS(f))~[x]) ¥Ra_MINUS ((Ras_ABS(g))~[x])) ¥Ra_GT eps0})
	n0-->Stat5(Stat5*) ==> Stat6: (n0 in Za) & (Ra_ABS(((Ras_ABS(f))~[n0]) ¥Ra_MINUS ((Ras_ABS(g))~[n0])) ¥Ra_GT eps0) & (not(Ra_ABS((f~[n0]) ¥Ra_MINUS (g~[n0])) ¥Ra_GT eps0))
--
-- Observe that distance between the $f$-image of $n0$ and the $g$-image of $n0$ is
-- greater than the distance between the $Ras_ABS(f)$-image of $n0$ and the
-- $Ras_ABS(g)$-image of $n0$.
--
	T525(Stat6*) ==> Stat7: (FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_ABS(Ra_ABS(x) ¥Ra_PLUS Ra_Rev(Ra_ABS(y))) ¥Ra_LE Ra_ABS(x ¥Ra_PLUS Ra_Rev(y))))
	(f,g,n0)-->T555(Stat1,Stat6*) ==> ((f~[n0]) in Ra) & ((g~[n0]) in Ra)
	(f~[n0],g~[n0])-->Stat7(Stat7*) ==> Stat8: Ra_ABS(Ra_ABS(f~[n0]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[n0]))) ¥Ra_LE Ra_ABS((f~[n0]) ¥Ra_PLUS Ra_Rev(g~[n0]))
	(Ra_ABS(Ra_ABS(f~[n0]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[n0]))),Ra_ABS((f~[n0]) ¥Ra_PLUS Ra_Rev(g~[n0])))-->T473(Stat8*) ==> Stat9: Ra_ABS((f~[n0]) ¥Ra_PLUS Ra_Rev(g~[n0])) ¥Ra_GE Ra_ABS(Ra_ABS(f~[n0]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[n0])))
	Use_def(¥Ra_MINUS)(Stat6,Stat6*) ==> Stat10: (Ra_ABS(((Ras_ABS(f))~[n0]) ¥Ra_PLUS Ra_Rev((Ras_ABS(g))~[n0])) ¥Ra_GT eps0) & (not(Ra_ABS((f~[n0]) ¥Ra_PLUS Ra_Rev(g~[n0])) ¥Ra_GT eps0))
--
-- By simplifying the first clause of Stat10, we obtain an inequality whose left-hand side
-- coincides with the right-hand side of the inequality Stat11
--
	Suppose ==> Stat12: Ra_ABS(((Ras_ABS(f))~[n0]) ¥Ra_PLUS Ra_Rev((Ras_ABS(g))~[n0])) /= Ra_ABS(Ra_ABS(f~[n0]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[n0])))
		(f,f,n0)-->T555(Stat1,Stat6*) ==> ((Ras_ABS(f))~[n0]) = Ra_ABS(f~[n0])
		(g,g,n0)-->T555(Stat1,Stat6*) ==> ((Ras_ABS(g))~[n0]) = Ra_ABS(g~[n0])
	EQUAL(Stat12) ==> false; Discharge ==> Stat13: Ra_ABS(((Ras_ABS(f))~[n0]) ¥Ra_PLUS Ra_Rev((Ras_ABS(g))~[n0])) = Ra_ABS(Ra_ABS(f~[n0]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[n0])))
	EQUAL(Stat10,Stat13) ==> Stat14: Ra_ABS(Ra_ABS(f~[n0]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[n0]))) ¥Ra_GT eps0
--
-- We must briefly digress here to show that both sides of the inequalities Stat9
-- and Stat14 lines designate real numbers, so that we can propagate inequalities by
-- exploiting Theorem 510, thus contradicting the second clause of Stat15
--
	(g~[n0])-->T452(Stat7*) ==> Ra_Rev(g~[n0]) in Ra
	(f~[n0],Ra_Rev(g~[n0]))-->T445(Stat7*) ==> ((f~[n0]) ¥Ra_PLUS Ra_Rev(g~[n0])) in Ra
	((f~[n0]) ¥Ra_PLUS Ra_Rev(g~[n0]))-->T527(Stat7*) ==> Stat16: Ra_ABS((f~[n0]) ¥Ra_PLUS Ra_Rev(g~[n0])) in Ra
	(f~[n0])-->T527(Stat7*) ==> Ra_ABS(f~[n0]) in Ra
	(g~[n0])-->T527(Stat7*) ==> Ra_ABS(g~[n0]) in Ra
	(Ra_ABS(g~[n0]))-->T452(Stat10*) ==> Ra_Rev(Ra_ABS(g~[n0])) in Ra
	(Ra_ABS(f~[n0]),Ra_Rev(Ra_ABS(g~[n0])))-->T445(Stat10*) ==> (Ra_ABS(f~[n0]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[n0]))) in Ra
	(Ra_ABS(f~[n0]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[n0])))-->T527(Stat10*) ==> Stat17: Ra_ABS(Ra_ABS(f~[n0]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[n0]))) in Ra
(Ra_ABS((f~[n0]) ¥Ra_PLUS Ra_Rev(g~[n0])),Ra_ABS(Ra_ABS(f~[n0]) ¥Ra_PLUS Ra_Rev(Ra_ABS(g~[n0]))),eps0)-->T510(Stat9,Stat14,Stat16,Stat17,Stat4,Stat10*) ==> false; Discharge ==> QED
--
-- We can also show that if two rational Cauchy sequences are equivalent, but not
-- equivalent to the zero rational sequence, then their reciprocals are equivalent.
--
Theorem 577: (({F,G} ¥incin RaCauchy) & Ra_eqseq(F,G) & (not(Ra_eqseq(F,Ra0Seq)))) ¥imp Ra_eqseq(Ras_Recip(F),Ras_Recip(G)). Proof:
Suppose_not(h,k) ==> AUTO
--
-- Reasoning by contradiction, assume that $f,g$ are a counterexample to
-- the statement of this theorem. Without loss of generality, we can assume that
-- no shift is needed in order to get $Recip(f)$ from $f$ or to get $Recip(g)$ from $g$.
-- Observe also that $g$ is not equivalent to the zero sequence.
--
    T545 ==> Ra0Seq in RaCauchy
    T539(*) ==> (h in RaSeq) & (k in RaSeq) & (Ra0Seq in RaSeq)
    Suppose ==> Ra_eqseq(k,Ra0Seq)
		(h,k,Ra0Seq)-->T553 ==> Ra_eqseq(Ra0Seq,h)
		h-->T546 ==> Ra_eqseq(h,h)
    (Ra0Seq,h,h)-->T553 ==> false; Discharge ==> (not(Ra_eqseq(k,Ra0Seq)))
    h-->T568 ==> Stat1: (EXISTS g in RaCauchy | Ra_eqseq(h,g) & (Ras_Recip(h) = Ras_Recip(g)) &
	(FORALL u in Za | ((g~[u]) /= Ra_0) & (Ras_Recip(g)~[u] = Recip(g~[u]))))
    k-->T568 ==> Stat2: (EXISTS g in RaCauchy | Ra_eqseq(k,g) & (Ras_Recip(k) = Ras_Recip(g)) &
	(FORALL u in Za | ((g~[u]) /= Ra_0) & (Ras_Recip(g)~[u] = Recip(g~[u]))))
    f-->Stat1 ==> Stat3: (f in RaCauchy) & Ra_eqseq(h,f) & (Ras_Recip(h) = Ras_Recip(f)) &
	Stat4: (FORALL u in Za | ((f~[u]) /= Ra_0) & (Ras_Recip(f)~[u] = Recip(f~[u])))
    g-->Stat2 ==> Stat5: (g in RaCauchy) & Ra_eqseq(k,g) & (Ras_Recip(k) = Ras_Recip(g)) &
	Stat6: (FORALL u in Za | ((g~[u]) /= Ra_0) & (Ras_Recip(g)~[u] = Recip(g~[u])))
    T539(*) ==> Stat7: (f in RaSeq) & (g in RaSeq)
    (h,k,g)-->T553 ==> Ra_eqseq(g,h)
    (g,h,f)-->T553 ==> Ra_eqseq(f,g)
    Ra0Seq-->T546 ==> Stat8: Ra_eqseq(Ra0Seq,Ra0Seq)
    Suppose ==> Stat9: Ra_eqseq(f,Ra0Seq)
	(h,f,Ra0Seq)-->T553 ==> Ra_eqseq(Ra0Seq,h)
    (Ra0Seq,Ra0Seq,h)-->T553 ==> false; Discharge ==> (not Ra_eqseq(f,Ra0Seq))
    Suppose ==> Ra_eqseq(g,Ra0Seq)
	(f,g,Ra0Seq)-->T553 ==> Ra_eqseq(Ra0Seq,f)
    (Ra0Seq,Ra0Seq,f)-->T553 ==> false; Discharge ==> (not Ra_eqseq(g,Ra0Seq))
    Suppose ==> Ra_eqseq(Ras_Recip(f),Ras_Recip(g))
    EQUAL ==> false; Discharge ==> Stat10: (({f,g} ¥incin RaCauchy) & Ra_eqseq(f,g) & (not(Ra_eqseq(f,Ra0Seq))) & (not(Ra_eqseq(g,Ra0Seq)))) & (not Ra_eqseq(Ras_Recip(f),Ras_Recip(g)))
--
-- It follows, from the inequivalence between $f$ and the zero sequence
-- and exploiting the transitivity of equivalence, that $g$ is not
-- equivalent to the zero sequence. Hence the reciprocals of $f,g$ are
-- defined and they are rational Cauchy sequences.
--
	Suppose ==> Ra_eqseq(g,Ra0Seq)
		(f,g,Ra0Seq)-->T553 ==> Ra_eqseq(Ra0Seq,f)
		f-->T546 ==> Ra_eqseq(f,f)
	(Ra0Seq,f,f)-->T553 ==> false; Discharge ==> (not(Ra_eqseq(g,Ra0Seq)))
	(f,f)-->T570 ==> Ras_Recip(f) in RaCauchy
	(g,g)-->T570 ==> Ras_Recip(g) in RaCauchy
	T539(Stat10*) ==> (Ras_Recip(f) in RaSeq) & (Ras_Recip(g) in RaSeq)
--
-- There is a threshold $n0$ past which all components of $f$ exceed a certain
-- positive rational number $a$. Likewise, there is a threshold $n1$ past which
-- all components of $g$ exceed a certain positive rational $b$. Accordingly, if
-- we take $n2$ to be the larger of $n0,n1$, past $n2$ every component of $f$
-- will be greater than $a$ and every component of $g$ will be greater than $b$.
--
	f-->T563 ==> Stat11: (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
		(FORALL i in (Za - n) | (Ra_ABS(f~[i]) ¥Ra_GT eps) & (Ra_ABS(f~[i]) ¥Ra_GT Ra_0)) & (Ra_ABS(f~[n]) ¥Ra_GT Ra_0))
        (a,n0)-->Stat11(Stat11*) ==> Stat12: (a in Ra) & (n0 in Za) & (a ¥Ra_GT Ra_0) &
		Stat13: (FORALL i in (Za - n0) | (Ra_ABS(f~[i]) ¥Ra_GT a) & (Ra_ABS(f~[i]) ¥Ra_GT Ra_0))
	g-->T563 ==> Stat14: (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
		(FORALL i in (Za - n) | (Ra_ABS(g~[i]) ¥Ra_GT eps) & (Ra_ABS(g~[i]) ¥Ra_GT Ra_0)) & (Ra_ABS(g~[n]) ¥Ra_GT Ra_0))
        (b,n1)-->Stat14(Stat14*) ==> Stat15: (b in Ra) & (n1 in Za) & (b ¥Ra_GT Ra_0) &
		Stat16: (FORALL i in (Za - n1) | (Ra_ABS(g~[i]) ¥Ra_GT b) & (Ra_ABS(g~[i]) ¥Ra_GT Ra_0))
	Loc_def ==> Stat17: n2 = Un({n0,n1})
	Suppose ==> not( (n2 in Za) & (FORALL i in (Za - n2) |
			(Ra_ABS(f~[i]) ¥Ra_GT Ra_0) & (Ra_ABS(g~[i]) ¥Ra_GT Ra_0) &
			(Ra_ABS(f~[i]) ¥Ra_GT a) & (Ra_ABS(g~[i]) ¥Ra_GT b)) )
		(n0,n1)-->T202 ==> Stat18: Finite({n0,n1})
		({n0,n1})-->T320(Stat11*) ==> (n2 in Za) &
			Stat19: (not( (FORALL i in (Za - n2) |
				(Ra_ABS(f~[i]) ¥Ra_GT Ra_0) & (Ra_ABS(g~[i]) ¥Ra_GT Ra_0) &
				(Ra_ABS(f~[i]) ¥Ra_GT a) & (Ra_ABS(g~[i]) ¥Ra_GT b) )))
		i0-->Stat19(Stat18*) ==> Stat20: (i0 in (Za - n2)) &
			((not(Ra_ABS(f~[i0]) ¥Ra_GT Ra_0)) or (not(Ra_ABS(g~[i0]) ¥Ra_GT Ra_0)) or
			 (not(Ra_ABS(f~[i0]) ¥Ra_GT a)) or (not(Ra_ABS(g~[i0]) ¥Ra_GT b)) )
		({n0,n1})-->T274(Stat18*) ==> Stat21: (FORALL x in {n0,n1} | x ¥incin Un({n0,n1}))
		n0-->Stat21(Stat17,Stat20*) ==> i0 in (Za - n0)
		n1-->Stat21(Stat17,Stat20*) ==> i0 in (Za - n1)
		i0-->Stat13(Stat20*) ==> (not(Ra_ABS(g~[i0]) ¥Ra_GT Ra_0)) or (not(Ra_ABS(g~[i0]) ¥Ra_GT b))
	i0-->Stat16(Stat20*) ==> false; Discharge ==> Stat22: (n2 in Za) &
		Stat23: (FORALL i in (Za - n2) |
			(Ra_ABS(f~[i]) ¥Ra_GT Ra_0) & (Ra_ABS(g~[i]) ¥Ra_GT Ra_0) &
			(Ra_ABS(f~[i]) ¥Ra_GT a) & (Ra_ABS(g~[i]) ¥Ra_GT b))
--
-- Since we have assumed that $Ras_Recip(f)$ is not equivalent to $Ras_Recip(g)$,
-- there must exist a positive rational $eps0$ such that the set of the indices
-- of the components of $Ras_Recip(f)$ whose distance from the corresponding
-- components of $Ras_Recip(g)$ exceeds $eps0$ is infinite. On the other hand,
-- since we have assumed that $f$ is equivalent to $g$, the set of the indices
-- of the components of $f$ whose distance from the corresponding components
-- of $g$ exceeds $eps0 ¥Ra_TIMES (b ¥Ra_TIMES a)$ is finite.
--
	(Ras_Recip(f),Ras_Recip(g))-->T541 ==> Stat24: not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps}))
	eps0-->Stat24 ==> Stat25: (eps0 in Ra) & (eps0 ¥Ra_GT Ra_0) & (not Finite({x : x in Za | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0}))
	(b,a)-->T448(Stat12,Stat15*) ==> Stat26: (b ¥Ra_TIMES a) in Ra
	(b,a)-->T490(Stat12,Stat15*) ==> Stat27: (b ¥Ra_TIMES a) ¥Ra_GT Ra_0
	(eps0,b ¥Ra_TIMES a)-->T448(Stat25*) ==> Stat28: (eps0 ¥Ra_TIMES (b ¥Ra_TIMES a)) in Ra
	(eps0,b ¥Ra_TIMES a)-->T490(Stat25*) ==> (eps0 ¥Ra_TIMES (b ¥Ra_TIMES a)) ¥Ra_GT Ra_0
	(f,g)-->T541 ==> Stat29: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x: x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT eps}))
	(eps0 ¥Ra_TIMES (b ¥Ra_TIMES a))-->Stat29(Stat28*) ==>
		Stat30: Finite({x: x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT (eps0 ¥Ra_TIMES (b ¥Ra_TIMES a))})
--
-- Of course, since $n2$ is finite, also the set of the indices of
-- components of $Ras_Recip(f)$, from the $n2$ on, whose distance from the
-- corresponding components of $Ras_Recip(g)$ exceeds $eps0$ is infinite.
-- (However, below we will show that this set includes the set of the indices
-- of the components of $f$ whose distance from the corresponding components
-- of $g$ exceeds $eps0 ¥Ra_TIMES (b ¥Ra_TIMES a)$ is finite, thus getting
-- the desired contradiction.)
--
	Suppose ==> Stat31: Finite({x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0})
		Suppose ==> Stat32: not({x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0} incs ({x : x in Za | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0} - n2))
			c-->Stat32(Stat32*) ==> Stat33: (c notin {x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0}) & (c notin n2) & Stat34: (c in {x in Za | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0})
			()-->Stat34 ==> (c in Za) & (Ra_ABS((Ras_Recip(f)~[c]) ¥Ra_MINUS (Ras_Recip(g)~[c])) ¥Ra_GT eps0)
		c-->Stat33(Stat33*) ==> false; Discharge ==> {x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0} incs ({x : x in Za | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0} - n2)
		({x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0},{x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0} - n2)-->T189(Stat31*) ==> Stat35: Finite({x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0} - n2)
		n2-->T206(Stat22,Stat22*) ==> Finite(n2)
		({x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0} - n2,n2)-->T236(Stat35*) ==> Stat36: Finite(({x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0} - n2) + n2)
	(({x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0} - n2) + n2,{x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0})-->T189(Stat36,Stat25*) ==> false; Discharge ==> Stat37: (not Finite({x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0}))
--
-- The following obvious remarks and technical lemma derived from Theorem 525
-- will be useful in the ongoing:
--
	a-->T491(Stat12,Stat12*) ==> Recip(a) ¥Ra_GT Ra_0
	b-->T491(Stat15,Stat15*) ==> Recip(b) ¥Ra_GT Ra_0
	(a,Ra_0)-->T473(Stat12,Stat12*) ==> Stat38: a /= Ra_0
	(b,Ra_0)-->T473(Stat15,Stat15*) ==> Stat39: b /= Ra_0
	a-->T462(Stat12,Stat38*) ==> Stat40: (Recip(a) in Ra) & ((a ¥Ra_TIMES Recip(a)) = Ra_1)
	b-->T462(Stat15,Stat39*) ==> Stat41: (Recip(b) in Ra) & ((b ¥Ra_TIMES Recip(b)) = Ra_1)
        (Recip(a),Recip(b))-->T448(Stat40,Stat41*) ==> Stat42: (Recip(a) ¥Ra_TIMES Recip(b)) in Ra
--
	T525(Stat41*) ==> Stat43: (FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0))) &
		Stat44:  (FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x))) &
		Stat45:  (FORALL x,y | ((x in Ra) & (y in Ra)) ¥imp (Ra_Rev(x ¥Ra_PLUS Ra_Rev(y)) = (y ¥Ra_PLUS Ra_Rev(x)))) &
		Stat46: (FORALL x | (x in Ra) ¥imp (x ¥Ra_LE x))
--
-- We now develop the core of this proof, by showing that the inequality
--	$Ra_ABS(Recip(f~[i]) ¥Ra_MINUS Recip(g~[i])) ¥Ra_LE ((Ra_ABS((f~[i]) ¥Ra_MINUS (g~[i]))) ¥Ra_OVER (a ¥Ra_TIMES b))$
-- holds for all $i in (Za - n2)$.
--
        Suppose ==> Stat47: not(FORALL i in (Za - n2) | Ra_ABS(Recip(f~[i]) ¥Ra_MINUS Recip(g~[i])) ¥Ra_LE ((Ra_ABS((f~[i]) ¥Ra_MINUS (g~[i]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))))
            p-->Stat47(Stat47*) ==> Stat48: (p in (Za - n2)) &  (not Ra_ABS(Recip(f~[p]) ¥Ra_MINUS Recip(g~[p])) ¥Ra_LE ((Ra_ABS((f~[p]) ¥Ra_MINUS (g~[p]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))))
            (f,g,p)-->T555(Stat48,Stat7*) ==> Stat49: ((f~[p]) in Ra) & ((g~[p]) in Ra)
            p-->Stat23(Stat48*) ==> Stat50: (Ra_ABS(f~[p]) ¥Ra_GT a) & (Ra_ABS(g~[p]) ¥Ra_GT b)
        (f~[p],g~[p],a,b)-->T538(Stat49,Stat12,Stat15,Stat50,Stat48*) ==> false; Discharge ==> Stat51: (FORALL i in (Za - n2) | Ra_ABS(Recip(f~[i]) ¥Ra_MINUS Recip(g~[i])) ¥Ra_LE ((Ra_ABS((f~[i]) ¥Ra_MINUS (g~[i]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))))
--
-- As announced above, we aim at completing the proof of this theorem by showing that the
-- infinite set
--	${x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0}$
-- is included in
--	${x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT (eps0 ¥Ra_TIMES (b ¥Ra_TIMES a))}$,
-- a fact conflicting with the finiteness of the latter, proved above.
--
	Suppose ==> Stat52: not({x: x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT (eps0 ¥Ra_TIMES (b ¥Ra_TIMES a))} incs {x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0})
--
-- Assuming temporarily that the announced inclusion did not hold, we could pick an integer $i2$
-- belonging to the latter set but not belonging to the former. This majorant of $n2$ would meet
-- the inequality of Stat53 This readily yields that the rational number
--	$((Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b)))$
-- is greater than $eps0$; hence
--	$(((Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b)))) ¥Ra_TIMES (a ¥Ra_TIMES b)$
-- is greater than $eps0 ¥Ra_TIMES (a ¥Ra_TIMES b)$.
--
		i1-->Stat52(Stat52*) ==> Stat54: (i1 in {x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0}) & (i1 notin {x: x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT (eps0 ¥Ra_TIMES (b ¥Ra_TIMES a))})
		(i2,i2)-->Stat54(Stat54*) ==> Stat55: (i2 in Za) & (i2 notin n2) & (Ra_ABS((Ras_Recip(f)~[i2]) ¥Ra_MINUS (Ras_Recip(g)~[i2])) ¥Ra_GT eps0) & (not (Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) ¥Ra_GT (eps0 ¥Ra_TIMES (b ¥Ra_TIMES a))))
		i2-->Stat51(Stat55*) ==> Stat56: Ra_ABS(Recip(f~[i2]) ¥Ra_MINUS Recip(g~[i2])) ¥Ra_LE ((Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b)))
--
		(Ra_ABS(Recip(f~[i2]) ¥Ra_MINUS Recip(g~[i2])),((Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))))-->T473(Stat56,Stat56*) ==>
			Stat57: ((Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))) ¥Ra_GE Ra_ABS(Recip(f~[i2]) ¥Ra_MINUS Recip(g~[i2]))
		(g,f,i2)-->T555(Stat55,Stat7*) ==> Stat58: ((g~[i2]) in Ra) & ((f~[i2]) in Ra)
		(g~[i2])-->T452(Stat58,Stat58*) ==> Ra_Rev(g~[i2]) in Ra
		(f~[i2],Ra_Rev(g~[i2]))-->T445(Stat58*) ==> ((f~[i2]) ¥Ra_PLUS Ra_Rev(g~[i2])) in Ra
		Use_def(¥Ra_MINUS)(Stat58*) ==> Stat59: ((f~[i2]) ¥Ra_MINUS (g~[i2])) in Ra
		((f~[i2]) ¥Ra_MINUS (g~[i2]))-->T527(Stat59*) ==> Stat60: Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) in Ra
		(Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])),Recip(a) ¥Ra_TIMES Recip(b))-->T448(Stat60,Stat42*) ==> Stat61: Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b)) in Ra
		i2-->Stat23(Stat55,Stat55*) ==> (Ra_ABS(f~[i2]) ¥Ra_GT Ra_0) & (Ra_ABS(g~[i2]) ¥Ra_GT Ra_0)
		(Ra_ABS(f~[i2]),Ra_0)-->T473(Stat61*) ==> Ra_ABS(f~[i2]) /= Ra_0
		(Ra_ABS(g~[i2]),Ra_0)-->T473(Stat61*) ==> Ra_ABS(g~[i2]) /= Ra_0
		(g~[i2])-->Stat43(Stat58*) ==> Stat62: (g~[i2]) /= Ra_0
		(f~[i2])-->Stat43(Stat58*) ==> Stat63: (f~[i2]) /= Ra_0
		(g~[i2])-->T462(Stat58*) ==> Stat64: Recip(g~[i2]) in Ra
		(f~[i2])-->T462(Stat58*) ==> Stat65: Recip(f~[i2]) in Ra
		(Recip(g~[i2]))-->T452(Stat61*) ==> Ra_Rev(Recip(g~[i2])) in Ra
		(Recip(f~[i2]),Ra_Rev(Recip(g~[i2])))-->T445(Stat61*) ==> Stat66: (Recip(f~[i2]) ¥Ra_PLUS Ra_Rev(Recip(g~[i2]))) in Ra
		(Recip(f~[i2]) ¥Ra_PLUS Ra_Rev(Recip(g~[i2])))-->T527(Stat66*) ==> Stat67: Ra_ABS(Recip(f~[i2]) ¥Ra_PLUS Ra_Rev(Recip(g~[i2]))) in Ra
		ALGEBRA(Stat64,Stat65,Stat67) ==> Ra_ABS(Recip(f~[i2]) ¥Ra_MINUS Recip(g~[i2])) in Ra
		i2-->Stat4(Stat10,Stat55,Stat63*) ==> (Ras_Recip(f)~[i2]) = Recip(f~[i2])
		i2-->Stat6(Stat10,Stat55,Stat62*) ==> (Ras_Recip(g)~[i2]) = Recip(g~[i2])
		EQUAL(Stat57) ==> Stat68: (((Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2]))) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))) ¥Ra_GE Ra_ABS((Ras_Recip(f)~[i2]) ¥Ra_MINUS (Ras_Recip(g)~[i2]))) &
			(Ra_ABS((Ras_Recip(f)~[i2]) ¥Ra_MINUS (Ras_Recip(g)~[i2])) in Ra)
		(Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b)),Ra_ABS((Ras_Recip(f)~[i2]) ¥Ra_MINUS (Ras_Recip(g)~[i2])),eps0)-->T510(Stat68,Stat61,Stat25,Stat55*) ==>
			Stat69: (Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))) ¥Ra_GT eps0
--
		(b ¥Ra_TIMES a,b ¥Ra_TIMES a)-->T495(Stat26*) ==> Stat70: (b ¥Ra_TIMES a) ¥Ra_GE (b ¥Ra_TIMES a)
		(Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b)),eps0,b ¥Ra_TIMES a,b ¥Ra_TIMES a)-->T517(Stat61,Stat25,Stat69,Stat26,Stat27,Stat70*) ==> Stat71: ((Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))) ¥Ra_TIMES (b ¥Ra_TIMES a)) ¥Ra_GT (eps0 ¥Ra_TIMES (b ¥Ra_TIMES a))
--
-- Notice, however, that $Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2]))$ equals
--	$(Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))) ¥Ra_TIMES (b ¥Ra_TIMES a)$.
--
		Suppose ==> Stat72: Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) /= (Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))) ¥Ra_TIMES (b ¥Ra_TIMES a)
			(b ¥Ra_TIMES a,Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])),Recip(a) ¥Ra_TIMES Recip(b))-->T456(Stat60,Stat42,Stat26*) ==> Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) ¥Ra_TIMES ((Recip(a) ¥Ra_TIMES Recip(b)) ¥Ra_TIMES (b ¥Ra_TIMES a)) = (Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))) ¥Ra_TIMES (b ¥Ra_TIMES a)
			(b ¥Ra_TIMES a,Recip(a),Recip(b))-->T456(Stat26,Stat40,Stat41*) ==> (Recip(a) ¥Ra_TIMES (Recip(b) ¥Ra_TIMES (b ¥Ra_TIMES a))) = ((Recip(a) ¥Ra_TIMES Recip(b)) ¥Ra_TIMES (b ¥Ra_TIMES a))
			(a,Recip(b),b)-->T456(Stat41,Stat12,Stat15*) ==> (Recip(b) ¥Ra_TIMES (b ¥Ra_TIMES a)) = ((Recip(b) ¥Ra_TIMES b) ¥Ra_TIMES a)
			(Recip(b),b)-->T448(Stat15,Stat41*) ==> (Recip(b) ¥Ra_TIMES b) = Ra_1
			(Recip(a),a)-->T448(Stat12,Stat40*) ==> (Recip(a) ¥Ra_TIMES a) = Ra_1
			a-->T461(Stat12*) ==> a = (a ¥Ra_TIMES Ra_1)
			T451(Stat72*) ==> Stat73: Ra_1 in Ra
			(a,Ra_1)-->T448(Stat12,Stat73*) ==> (a ¥Ra_TIMES Ra_1) = (Ra_1 ¥Ra_TIMES a)
			(Recip(a) ¥Ra_TIMES Recip(b))-->T461(Stat42*) ==> (Recip(a) ¥Ra_TIMES Recip(b)) = ((Recip(a) ¥Ra_TIMES Recip(b)) ¥Ra_TIMES Ra_1)
			(Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])))-->T461(Stat60*) ==> (Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2]))) = ((Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2]))) ¥Ra_TIMES Ra_1)
		EQUAL(Stat72) ==> false; Discharge ==> Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) = (Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) ¥Ra_TIMES (Recip(a) ¥Ra_TIMES Recip(b))) ¥Ra_TIMES (b ¥Ra_TIMES a)
		EQUAL(Stat71) ==> Stat74: Ra_ABS((f~[i2]) ¥Ra_MINUS (g~[i2])) ¥Ra_GT (eps0 ¥Ra_TIMES (b ¥Ra_TIMES a))
--
-- This leads to the desired contradiction, proving the present theorem.
--
	(Stat74,Stat55*)Discharge ==> Stat75: {x: x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT (eps0 ¥Ra_TIMES (b ¥Ra_TIMES a))} incs {x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0}
--
({x: x in Za | Ra_ABS((f~[x]) ¥Ra_MINUS (g~[x])) ¥Ra_GT (eps0 ¥Ra_TIMES (b ¥Ra_TIMES a))},{x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) ¥Ra_MINUS (Ras_Recip(g)~[x])) ¥Ra_GT eps0})-->T189(Stat75,Stat37,Stat30*) ==> false; Discharge ==> QED
--
-- Proof of the algebraic rules for the operations on rational sequences introduced above
-- will rest on the fact that two rational sequences are equal if and only if they have
-- the same value for each integer, and on the rules
-- for calculating the values at each integer of
--
--
--
-- Next we prove that the algebraic operations on rational sequences introduced above obey the
-- normal commutative, distributive, etc., algebraic laws. Our first two results state
-- the commutative laws for addition and multiplication respectively. These results follow trivially
-- from the pointwise definitions of the operations $¥Ras_PLUS$ and $¥Ras_TIMES$.
--
Theorem 578: ({F,G} ¥incin RaSeq) ¥imp (F ¥Ras_PLUS G = G ¥Ras_PLUS F). Proof:
    Suppose_not(f,g) ==> AUTO
	(f ¥Ras_PLUS g,g ¥Ras_PLUS f)-->T542 ==> Stat1: AUTO
	n-->Stat1 ==> AUTO
    (f,g)-->T555 ==> (f ¥Ras_PLUS g in RaSeq) & (f~[n] in Ra) & (g~[n] in Ra) & ((f ¥Ras_PLUS g)~[n] = (f~[n]) ¥Ra_PLUS (g~[n]))
    (g,f)-->T555 ==> (g ¥Ras_PLUS f in RaSeq) & ((g ¥Ras_PLUS f)~[n] = (g~[n]) ¥Ra_PLUS (f~[n]))
    (f~[n],g~[n])-->T445 ==> false; Discharge ==> QED
--
Theorem 579: ({F,G} ¥incin RaSeq) ¥imp (F ¥Ras_TIMES G = G ¥Ras_TIMES F). Proof:
    Suppose_not(f,g) ==> AUTO
	(f ¥Ras_TIMES g,g ¥Ras_TIMES f)-->T542 ==> Stat1: AUTO
	n-->Stat1 ==> AUTO
    (f,g)-->T555 ==> (f ¥Ras_TIMES g in RaSeq) & (f~[n] in Ra) & (g~[n] in Ra) & ((f ¥Ras_TIMES g)~[n] = (f~[n]) ¥Ra_TIMES (g~[n]))
    (g,f)-->T555 ==> (g ¥Ras_TIMES f in RaSeq) & ((g ¥Ras_TIMES f)~[n] = (g~[n]) ¥Ra_TIMES (f~[n]))
    (f~[n],g~[n])-->T448 ==> false; Discharge ==> QED
--
-- It is equally easy to prove the associative laws for addition and multiplication
-- of rational sequences. Once more, these results follow trivially
-- from the pointwise definitions of the operations $¥Ras_PLUS$ and $¥Ras_TIMES$.
--
Theorem 580: ({F,G,H} ¥incin RaSeq) ¥imp
	((F ¥Ras_PLUS G) ¥Ras_PLUS H = F ¥Ras_PLUS (G ¥Ras_PLUS H)). Proof:
--
-- For let f,g,h be a counterexample, and consider the values at a generic integer n of all the function compositions which appear.
-- By Theorem 338 the function values ((f ¥Ras_PLUS h) ¥Ras_PLUS h)~[n] and (f ¥Ras_PLUS (h ¥Ras_PLUS h))~[n] must be distinct at n,
--
    Suppose_not(f,g,h) ==> AUTO
	((f ¥Ras_PLUS g) ¥Ras_PLUS h,(f ¥Ras_PLUS (g ¥Ras_PLUS h)))-->T542 ==> Stat1: AUTO
	n-->Stat1 ==> AUTO
	(f,g,n)-->T555 ==> ((f ¥Ras_PLUS g) in RaSeq) & (f~[n] in Ra) & (g~[n] in Ra) & ((f ¥Ras_PLUS g)~[n] = (f~[n]) ¥Ra_PLUS (g~[n]))
	(g,h,n)-->T555 ==> ((g ¥Ras_PLUS h) in RaSeq) & (g~[n] in Ra) & (h~[n] in Ra) & ((g ¥Ras_PLUS h)~[n] = (g~[n]) ¥Ra_PLUS (h~[n]))
	(f ¥Ras_PLUS g,h,n)-->T555 ==> (((f ¥Ras_PLUS g) ¥Ras_PLUS h) in RaSeq) & (((f ¥Ras_PLUS g) ¥Ras_PLUS h)~[n] = ((f ¥Ras_PLUS g)~[n]) ¥Ra_PLUS (h~[n]))
	(f,g ¥Ras_PLUS h,n)-->T555 ==> ((f ¥Ras_PLUS (g ¥Ras_PLUS h)) in RaSeq) & ((f ¥Ras_PLUS (g ¥Ras_PLUS h))~[n] = ((f~[n]) ¥Ra_PLUS ((g ¥Ras_PLUS h)~[n])))
--
-- which is easily seen to be impossible if we express these function values in terms of f~[n],g~[n], and h~[n],
-- a contradiction which proves our theorem.
--
	EQUAL ==> ((f~[n]) ¥Ra_PLUS (g~[n])) ¥Ra_PLUS (h~[n]) = ((f ¥Ras_PLUS g) ¥Ras_PLUS h)~[n]
	EQUAL ==> (f~[n]) ¥Ra_PLUS ((g~[n]) ¥Ra_PLUS (h~[n])) = (f ¥Ras_PLUS (g ¥Ras_PLUS h))~[n]
	ELEM ==> ((f~[n]) ¥Ra_PLUS (g~[n])) ¥Ra_PLUS (h~[n]) /= (f~[n]) ¥Ra_PLUS ((g~[n]) ¥Ra_PLUS (h~[n]))
    (h~[n],f~[n],g~[n])-->T450 ==> false; Discharge ==> QED
--
Theorem 581: ({F,G,H} ¥incin RaSeq) ¥imp
	((F ¥Ras_TIMES G) ¥Ras_TIMES H = F ¥Ras_TIMES (G ¥Ras_TIMES H)). Proof:
    Suppose_not(fp,gp,hp) ==> ({fp,gp,hp} ¥incin RaSeq) &  ((fp ¥Ras_TIMES gp) ¥Ras_TIMES hp /= fp ¥Ras_TIMES (gp ¥Ras_TIMES hp))
        (fp,gp)-->T554 ==> ((fp ¥Ras_TIMES gp) in RaSeq) & ((fp ¥Ras_TIMES gp) = {[u,((fp~[u]) ¥Ra_TIMES (gp~[u]))]: u in Za})
        (gp,hp)-->T554 ==> ((gp ¥Ras_TIMES hp) in RaSeq) & ((gp ¥Ras_TIMES hp) = {[u,((gp~[u]) ¥Ra_TIMES (hp~[u]))]: u in Za})
        (fp ¥Ras_TIMES gp, hp)-->T554 ==> ((fp ¥Ras_TIMES gp) ¥Ras_TIMES hp) = {[u,(((fp ¥Ras_TIMES gp)~[u]) ¥Ra_TIMES (hp~[u]))]: u in Za}
        (fp, gp ¥Ras_TIMES hp)-->T554 ==> (fp ¥Ras_TIMES (gp ¥Ras_TIMES hp)) = {[u,((fp~[u]) ¥Ra_TIMES ((gp ¥Ras_TIMES hp)~[u]))]: u in Za}
        EQUAL ==> Stat1: {[u,(((fp ¥Ras_TIMES gp)~[u]) ¥Ra_TIMES (hp~[u]))]: u in Za} /= {[u,((fp~[u]) ¥Ra_TIMES ((gp ¥Ras_TIMES hp)~[u]))]: u in Za}
        i-->Stat1 ==> (i in Za) & ((((fp ¥Ras_TIMES gp)~[i]) ¥Ra_TIMES (hp~[i])) /= ((fp~[i]) ¥Ra_TIMES ((gp ¥Ras_TIMES hp)~[i])))
        APPLY() fcn_symbol(f(u)->((fp~[u]) ¥Ra_TIMES (gp~[u])), g->(fp ¥Ras_TIMES gp), s->Za) ==>
				Stat2: (FORALL x | ((fp ¥Ras_TIMES gp)~[x]) = if x in Za then ((fp~[x]) ¥Ra_TIMES (gp~[x])) else 0 end if)
        APPLY() fcn_symbol(f(u)->((gp~[u]) ¥Ra_TIMES (hp~[u])), g->(gp ¥Ras_TIMES hp), s->Za) ==>
				Stat3: (FORALL x | ((gp ¥Ras_TIMES hp)~[x]) = if x in Za then ((gp~[x]) ¥Ra_TIMES (hp~[x])) else 0 end if)
        i-->Stat2 ==> ((fp ¥Ras_TIMES gp)~[i]) = ((fp~[i]) ¥Ra_TIMES (gp~[i]))
        i-->Stat3 ==> ((gp ¥Ras_TIMES hp)~[i]) = ((gp~[i]) ¥Ra_TIMES (hp~[i]))
        EQUAL ==> (((fp~[i]) ¥Ra_TIMES (gp~[i])) ¥Ra_TIMES (hp~[i])) /= ((fp~[i]) ¥Ra_TIMES ((gp~[i]) ¥Ra_TIMES (hp~[i])))
        ELEM ==>  (fp in RaSeq) & (gp in RaSeq) &(hp in RaSeq)
        (fp,i)-->T540 ==> (fp~[i]) in Ra
        (gp,i)-->T540 ==> (gp~[i]) in Ra
        (hp,i)-->T540 ==> (hp~[i]) in Ra
    (hp~[i], fp~[i], gp~[i])-->T456 ==> false; Discharge ==> QED
--
Theorem 582: [Double-inversion law for rational sequences] (X in RaSeq) ¥imp (Ras_Rev(Ras_Rev(X))=X). Proof:
    Suppose_not(h) ==>AUTO
        (h,h)-->T554 ==> Ras_Rev(h) in RaSeq
        (h,Ras_Rev(h))-->T554 ==> Ras_Rev(Ras_Rev(h)) in RaSeq
        h-->T546 ==> Svm(h) & (domain(h) = Za)
        (Ras_Rev(Ras_Rev(h)))-->T546 ==> Svm(Ras_Rev(Ras_Rev(h))) & (domain(Ras_Rev(Ras_Rev(h))) = Za)
        h-->T72 ==> h = {[i,h~[i]]: i in domain(h)}
        (Ras_Rev(Ras_Rev(h)))-->T72 ==> (Ras_Rev(Ras_Rev(h))) = {[i,(Ras_Rev(Ras_Rev(h)))~[i]]: i in domain(Ras_Rev(Ras_Rev(h)))}
        Suppose ==> {[i,h~[i]]: i in Za} = {[i,(Ras_Rev(Ras_Rev(h)))~[i]]: i in Za}
        EQUAL ==> false; Discharge ==> Stat1: {[i,h~[i]]: i in Za} /= {[i,(Ras_Rev(Ras_Rev(h)))~[i]]: i in Za}
        i-->Stat1(Stat1) ==> Stat2: (i in Za) & ((h~[i]) /= ((Ras_Rev(Ras_Rev(h)))~[i]))
        (h,h,i)-->T555 ==> ((Ras_Rev(h))~[i]) = Ra_Rev(h~[i])
        (h,Ras_Rev(h),i)-->T555 ==> ((Ras_Rev(Ras_Rev(h)))~[i]) = Ra_Rev((Ras_Rev(h))~[i])
        Suppose ==> (h~[i]) = Ra_Rev(Ra_Rev(h~[i]))
        EQUAL(Stat2) ==> false; Discharge ==> Stat3: (h~[i]) /= Ra_Rev(Ra_Rev(h~[i]))
        (h,i)-->T540 ==> (h~[i]) in Ra
    (h~[i])-->T494(Stat3*) ==>false; Discharge ==> QED
--
Theorem 583: [Distributive law for multiplication of rational sequences] ({X,Y,V} ¥incin RaSeq) ¥imp ((X ¥Ras_TIMES (Y ¥Ras_PLUS V)) = ((X ¥Ras_TIMES Y) ¥Ras_PLUS (X ¥Ras_TIMES V))). Proof:
    Suppose_not(h,k,v) ==>AUTO
        (h,k)-->T554 ==> (h ¥Ras_TIMES k) in RaSeq
        (h,v)-->T554 ==> (h ¥Ras_TIMES v) in RaSeq
        (k,v)-->T554 ==> (k ¥Ras_PLUS v) in RaSeq
        (h,k ¥Ras_PLUS v)-->T554 ==> (h ¥Ras_TIMES (k ¥Ras_PLUS v)) in RaSeq
        (h ¥Ras_TIMES k,h ¥Ras_TIMES v)-->T554 ==> ((h ¥Ras_TIMES k) ¥Ras_PLUS (h ¥Ras_TIMES v)) in RaSeq
        h-->T546 ==> Svm(h) & (domain(h) = Za)
        k-->T546 ==> Svm(k) & (domain(k) = Za)
        v-->T546 ==> Svm(v) & (domain(v) = Za)
        (h ¥Ras_TIMES (k ¥Ras_PLUS v))-->T546 ==> Svm(h ¥Ras_TIMES (k ¥Ras_PLUS v)) & (domain(h ¥Ras_TIMES (k ¥Ras_PLUS v)) = Za)
        ((h ¥Ras_TIMES k) ¥Ras_PLUS (h ¥Ras_TIMES v))-->T546 ==> Svm((h ¥Ras_TIMES k) ¥Ras_PLUS (h ¥Ras_TIMES v)) & (domain((h ¥Ras_TIMES k) ¥Ras_PLUS (h ¥Ras_TIMES v)) = Za)
        (h ¥Ras_TIMES (k ¥Ras_PLUS v))-->T72 ==> (h ¥Ras_TIMES (k ¥Ras_PLUS v)) = {[i,(h ¥Ras_TIMES (k ¥Ras_PLUS v))~[i]]: i in domain(h ¥Ras_TIMES (k ¥Ras_PLUS v))}
        ((h ¥Ras_TIMES k) ¥Ras_PLUS (h ¥Ras_TIMES v))-->T72 ==> ((h ¥Ras_TIMES k) ¥Ras_PLUS (h ¥Ras_TIMES v)) = {[i,((h ¥Ras_TIMES k) ¥Ras_PLUS (h ¥Ras_TIMES v))~[i]]: i in domain((h ¥Ras_TIMES k) ¥Ras_PLUS (h ¥Ras_TIMES v))}
        Suppose ==> {[i,(h ¥Ras_TIMES (k ¥Ras_PLUS v))~[i]]: i in Za} = {[i,((h ¥Ras_TIMES k) ¥Ras_PLUS (h ¥Ras_TIMES v))~[i]]: i in Za}
        EQUAL ==> false; Discharge ==> Stat1: {[i,(h ¥Ras_TIMES (k ¥Ras_PLUS v))~[i]]: i in Za} /= {[i,((h ¥Ras_TIMES k) ¥Ras_PLUS (h ¥Ras_TIMES v))~[i]]: i in Za}
        i-->Stat1(Stat1) ==> Stat2: (i in Za) & (((h ¥Ras_TIMES (k ¥Ras_PLUS v))~[i]) /= (((h ¥Ras_TIMES k) ¥Ras_PLUS (h ¥Ras_TIMES v))~[i]))
        (h,k ¥Ras_PLUS v,i)-->T555 ==> ((h ¥Ras_TIMES (k ¥Ras_PLUS v))~[i]) = ((h~[i]) ¥Ra_TIMES ((k ¥Ras_PLUS v)~[i]))
        (k,v,i)-->T555 ==> ((k ¥Ras_PLUS v)~[i]) = ((k~[i]) ¥Ra_PLUS (v~[i]))
        (h ¥Ras_TIMES k,h ¥Ras_TIMES v,i)-->T555 ==> (((h ¥Ras_TIMES k) ¥Ras_PLUS (h ¥Ras_TIMES v))~[i]) = (((h ¥Ras_TIMES k)~[i]) ¥Ra_PLUS ((h ¥Ras_TIMES v)~[i]))
        (h,k,i)-->T555 ==> ((h ¥Ras_TIMES k)~[i]) = ((h~[i]) ¥Ra_TIMES (k~[i]))
        (h,v,i)-->T555 ==> ((h ¥Ras_TIMES v)~[i]) = ((h~[i]) ¥Ra_TIMES (v~[i]))
        Suppose ==> (((h~[i]) ¥Ra_TIMES (k~[i])) ¥Ra_PLUS ((h~[i]) ¥Ra_TIMES (v~[i]))) = ((h~[i]) ¥Ra_TIMES ((k~[i]) ¥Ra_PLUS (v~[i])))
        EQUAL(Stat2) ==> false; Discharge ==> Stat3: (((h~[i]) ¥Ra_TIMES (k~[i])) ¥Ra_PLUS ((h~[i]) ¥Ra_TIMES (v~[i]))) /= ((h~[i]) ¥Ra_TIMES ((k~[i]) ¥Ra_PLUS (v~[i])))
        (h,i)-->T540 ==> (h~[i]) in Ra
        (k,i)-->T540 ==> (k~[i]) in Ra
        (v,i)-->T540 ==> (v~[i]) in Ra
    (v~[i],h~[i],k~[i])-->T458(Stat3*) ==>false; Discharge ==> QED
--
Theorem 584: [Law of signs for multiplication of rational sequences] ({X,Y} ¥incin RaSeq) ¥imp ((X ¥Ras_TIMES Ras_Rev(Y)) = Ras_Rev(X ¥Ras_TIMES Y)). Proof:
    Suppose_not(h,k) ==>AUTO
        (k,k)-->T554 ==> Ras_Rev(k) in RaSeq
        (h,Ras_Rev(k))-->T554 ==> (h ¥Ras_TIMES Ras_Rev(k)) in RaSeq
        (h,k)-->T554 ==> (h ¥Ras_TIMES k) in RaSeq
        (h,h ¥Ras_TIMES k)-->T554 ==> Ras_Rev(h ¥Ras_TIMES k) in RaSeq
        (h ¥Ras_TIMES Ras_Rev(k))-->T546 ==> Svm(h ¥Ras_TIMES Ras_Rev(k)) & (domain(h ¥Ras_TIMES Ras_Rev(k)) = Za)
        (Ras_Rev(h ¥Ras_TIMES k))-->T546 ==> Svm(Ras_Rev(h ¥Ras_TIMES k)) & (domain(Ras_Rev(h ¥Ras_TIMES k)) = Za)
        (h ¥Ras_TIMES Ras_Rev(k))-->T72 ==> (h ¥Ras_TIMES Ras_Rev(k)) = {[i,(h ¥Ras_TIMES Ras_Rev(k))~[i]]: i in domain(h ¥Ras_TIMES Ras_Rev(k))}
        (Ras_Rev(h ¥Ras_TIMES k))-->T72 ==> (Ras_Rev(h ¥Ras_TIMES k)) = {[i,(Ras_Rev(h ¥Ras_TIMES k))~[i]]: i in domain(Ras_Rev(h ¥Ras_TIMES k))}
        Suppose ==> {[i,(h ¥Ras_TIMES Ras_Rev(k))~[i]]: i in Za} = {[i,(Ras_Rev(h ¥Ras_TIMES k))~[i]]: i in Za}
        EQUAL ==> false; Discharge ==> Stat1: {[i,(h ¥Ras_TIMES Ras_Rev(k))~[i]]: i in Za} /= {[i,(Ras_Rev(h ¥Ras_TIMES k))~[i]]: i in Za}
        i-->Stat1(Stat1) ==> Stat2: (i in Za) & (((h ¥Ras_TIMES Ras_Rev(k))~[i]) /= ((Ras_Rev(h ¥Ras_TIMES k))~[i]))
        (h,Ras_Rev(k),i)-->T555 ==> ((h ¥Ras_TIMES Ras_Rev(k))~[i]) = ((h~[i]) ¥Ra_TIMES ((Ras_Rev(k))~[i]))
        (h,k,i)-->T555 ==> ((Ras_Rev(k))~[i]) = Ra_Rev(k~[i])
        (h,h ¥Ras_TIMES k,i)-->T555 ==> ((Ras_Rev(h ¥Ras_TIMES k))~[i]) = Ra_Rev((h ¥Ras_TIMES k)~[i])
        (h,k,i)-->T555 ==> ((h ¥Ras_TIMES k)~[i]) = ((h~[i]) ¥Ra_TIMES (k~[i]))
        EQUAL(Stat2) ==> Stat3: ((h~[i]) ¥Ra_TIMES Ra_Rev(k~[i])) /= Ra_Rev((h~[i]) ¥Ra_TIMES (k~[i]))
        (h,i)-->T540 ==> (h~[i]) in Ra
        (k,i)-->T540 ==> (k~[i]) in Ra
    (h~[i],k~[i])-->T485(Stat3*) ==>false; Discharge ==> QED
--
Theorem 585: [Law of signs for multiplication of rational sequences, 2] ({X,Y} ¥incin RaSeq) ¥imp (((Ras_Rev(X) ¥Ras_TIMES Y) = Ras_Rev(X ¥Ras_TIMES Y)) & ((Ras_Rev(X) ¥Ras_TIMES Ras_Rev(Y)) = (X ¥Ras_TIMES Y))). Proof:
    Suppose_not(x,y) ==>AUTO
        (x,x)-->T554 ==> Ras_Rev(x) in RaSeq
        Suppose ==> (Ras_Rev(x) ¥Ras_TIMES y) /= Ras_Rev(x ¥Ras_TIMES y)
            (Ras_Rev(x),y)-->T579 ==> (Ras_Rev(x) ¥Ras_TIMES y) = (y ¥Ras_TIMES Ras_Rev(x))
            (y,x)-->T584 ==> (Ras_Rev(x) ¥Ras_TIMES y) = Ras_Rev(y ¥Ras_TIMES x)
            (y,x)-->T579 ==> (x ¥Ras_TIMES y) = (y ¥Ras_TIMES x)
        EQUAL ==> false; Discharge ==> ((Ras_Rev(x) ¥Ras_TIMES y) = Ras_Rev(x ¥Ras_TIMES y)) & ((Ras_Rev(x) ¥Ras_TIMES Ras_Rev(y)) /= (x ¥Ras_TIMES y))
        (y,y)-->T554 ==> Ras_Rev(y) in RaSeq
        (Ras_Rev(x),y)-->T584 ==> (Ras_Rev(x) ¥Ras_TIMES Ras_Rev(y)) = Ras_Rev(Ras_Rev(x) ¥Ras_TIMES y)
        EQUAL ==> (Ras_Rev(x) ¥Ras_TIMES Ras_Rev(y)) = Ras_Rev(Ras_Rev(x ¥Ras_TIMES y))
        (x,y)-->T554 ==> (x ¥Ras_TIMES y) in RaSeq
    (x ¥Ras_TIMES y)-->T582 ==> false; Discharge ==> QED
--
Theorem 586: [Any rational sequence times 0 is 0] (X in RaSeq) ¥imp ((X ¥Ras_TIMES Ra0Seq) = Ra0Seq). Proof:
Suppose_not(h) ==> AUTO
	T545(*) ==> Ra0Seq in RaCauchy
	T539(*) ==> Stat1: Ra0Seq in RaSeq
	(h,Ra0Seq)-->T554(*) ==> Stat2: ((h ¥Ras_TIMES Ra0Seq) in RaSeq) & ((h ¥Ras_TIMES Ra0Seq) = {[i,(h~[i]) ¥Ra_TIMES (Ra0Seq~[i])]: i in Za})
	(h ¥Ras_TIMES Ra0Seq,Ra0Seq)-->T542(*) ==> Stat3: not(FORALL n in Za | (((h ¥Ras_TIMES Ra0Seq) in RaSeq) & (Ra0Seq in RaSeq) & (((h ¥Ras_TIMES Ra0Seq)~[n]) = (Ra0Seq~[n]))))
	n0-->Stat3(Stat2,Stat1*) ==> Stat4: (n0 in Za) & (((h ¥Ras_TIMES Ra0Seq)~[n0]) /= (Ra0Seq~[n0]))
	EQUAL(Stat4,Stat2) ==> ({[i,(h~[i]) ¥Ra_TIMES (Ra0Seq~[i])]: i in Za}~[n0]) /= (Ra0Seq~[n0])
	APPLY() Must_be_svm(b(i)->(h~[i]) ¥Ra_TIMES (Ra0Seq~[i]),s->Za,u->n0) ==> (n0 in Za) ¥imp (({[i,(h~[i]) ¥Ra_TIMES (Ra0Seq~[i])]: i in Za}~[n0]) = ((h~[n0]) ¥Ra_TIMES (Ra0Seq~[n0])))
        n0-->T548(Stat4,Stat4*) ==> Stat5: (Ra0Seq~[n0]) = Ra_0
	EQUAL(Stat5) ==> ((h~[n0]) ¥Ra_TIMES (Ra0Seq~[n0])) = ((h~[n0]) ¥Ra_TIMES Ra_0)
	(h,n0)-->T540(*) ==> (h~[n0]) in Ra
(h~[n0])-->T489(Stat4*) ==> false; Discharge ==> QED
--
Theorem 587: [0 is a right additive identity for rational sequences] (X in RaSeq) ¥imp (X ¥Ras_PLUS Ra0Seq = X). Proof:
Suppose_not(h) ==> AUTO
	T545(*) ==> Ra0Seq in RaCauchy
	T539(*) ==> Stat1: (Ra0Seq in RaSeq) & (h in RaSeq)
	(h,Ra0Seq)-->T554(*) ==> Stat2: ((h ¥Ras_PLUS Ra0Seq) in RaSeq) & ((h ¥Ras_PLUS Ra0Seq)  = {[i,(h~[i]) ¥Ra_PLUS (Ra0Seq~[i])]: i in Za})
	(h ¥Ras_PLUS Ra0Seq,h)-->T542(*) ==> Stat3: not(FORALL n in Za | (((h ¥Ras_PLUS Ra0Seq) in RaSeq) & (h in RaSeq) & (((h ¥Ras_PLUS Ra0Seq)~[n]) = (h~[n]))))
	n0-->Stat3(*) ==> Stat4: (n0 in Za) & (((h ¥Ras_PLUS Ra0Seq)~[n0]) /= (h~[n0]))
	EQUAL(Stat4,Stat2) ==> ({[i,(h~[i]) ¥Ra_PLUS (Ra0Seq~[i])]: i in Za}~[n0]) /= (h~[n0])
	APPLY() Must_be_svm(b(i)->(h~[i]) ¥Ra_PLUS (Ra0Seq~[i]),s->Za,u->n0) ==> (n0 in Za) ¥imp (({[i,(h~[i]) ¥Ra_PLUS (Ra0Seq~[i])]: i in Za}~[n0]) = ((h~[n0]) ¥Ra_PLUS (Ra0Seq~[n0])))
        n0-->T548(Stat4,Stat4*) ==> Stat5: (Ra0Seq~[n0]) = Ra_0
	EQUAL(Stat5) ==> ((h~[n0]) ¥Ra_PLUS (Ra0Seq~[n0])) = ((h~[n0]) ¥Ra_PLUS Ra_0)
	(h,n0)-->T540(*) ==> (h~[n0]) in Ra
(h~[n0])-->T451(Stat4*) ==> false; Discharge ==> QED
--
Theorem 588: [1 is a left multiplicative identity for rational sequences] (X in RaSeq) ¥imp (X ¥Ras_TIMES Ra1Seq = X). Proof:
Suppose_not(h) ==> AUTO
	T545(*) ==> Ra1Seq in RaCauchy
	T539(*) ==> Stat1: Ra1Seq in RaSeq
	(h,Ra1Seq)-->T554(*) ==> Stat2: ((h ¥Ras_TIMES Ra1Seq) in RaSeq) & ((h ¥Ras_TIMES Ra1Seq) = {[i,(h~[i]) ¥Ra_TIMES (Ra1Seq~[i])]: i in Za})
	(h ¥Ras_TIMES Ra1Seq,h)-->T542(*) ==> Stat3: not(FORALL n in Za | (((h ¥Ras_TIMES Ra1Seq) in RaSeq) & (h in RaSeq) & (((h ¥Ras_TIMES Ra1Seq)~[n]) = (h~[n]))))
	n0-->Stat3(*) ==> Stat4: (n0 in Za) & (((h ¥Ras_TIMES Ra1Seq)~[n0]) /= (h~[n0]))
	EQUAL(Stat4,Stat2) ==> ({[i,(h~[i]) ¥Ra_TIMES (Ra1Seq~[i])]: i in Za}~[n0]) /= (h~[n0])
	APPLY() Must_be_svm(b(i)->(h~[i]) ¥Ra_TIMES (Ra1Seq~[i]),s->Za,u->n0) ==> (n0 in Za) ¥imp (({[i,(h~[i]) ¥Ra_TIMES (Ra1Seq~[i])]: i in Za}~[n0]) = ((h~[n0]) ¥Ra_TIMES (Ra1Seq~[n0])))
        n0-->T548(Stat4,Stat4*) ==> Stat5: (Ra1Seq~[n0]) = Ra_1
	EQUAL(Stat5) ==> ((h~[n0]) ¥Ra_TIMES (Ra1Seq~[n0])) = ((h~[n0]) ¥Ra_TIMES Ra_1)
	(h,n0)-->T540(*) ==> (h~[n0]) in Ra
(h~[n0])-->T461(Stat4*) ==> false; Discharge ==> QED
--
Theorem 589: [0 is right subtractive identity for rational sequence subtraction] (X in RaSeq) ¥imp (X ¥Ras_MINUS Ra0Seq = X). Proof:
Suppose_not(h) ==> AUTO
	Use_def(¥Ras_MINUS) ==> Stat1: (h ¥Ras_PLUS Ras_Rev(Ra0Seq)) /= h
	T545(*) ==> Ra0Seq in RaCauchy
	T539(*) ==> Stat2: Ra0Seq in RaSeq
	(Ra0Seq,Ra0Seq)-->T554(*) ==> Stat3: (Ras_Rev(Ra0Seq) in RaSeq) & (Ras_Rev(Ra0Seq) = {[i,Ra_Rev(Ra0Seq~[i])]: i in Za})
	(h,Ras_Rev(Ra0Seq))-->T554(*) ==> Stat4: ((h ¥Ras_PLUS Ras_Rev(Ra0Seq)) in RaSeq) & ((h ¥Ras_PLUS Ras_Rev(Ra0Seq)) = {[i,(h~[i]) ¥Ra_PLUS ((Ras_Rev(Ra0Seq))~[i])]: i in Za})
	(h ¥Ras_PLUS Ras_Rev(Ra0Seq),h)-->T542(Stat1,Stat1*) ==> Stat5: not(FORALL n in Za | ((h ¥Ras_PLUS Ras_Rev(Ra0Seq)) in RaSeq) & (h in RaSeq) & (((h ¥Ras_PLUS Ras_Rev(Ra0Seq))~[n]) = (h~[n])))
	n0-->Stat5(*) ==> Stat6: (n0 in Za) & (((h ¥Ras_PLUS Ras_Rev(Ra0Seq))~[n0]) /= (h~[n0]))
	EQUAL(Stat6,Stat4,Stat3) ==> ({[i,(h~[i]) ¥Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[i])]: i in Za}~[n0]) /= (h~[n0])
	APPLY() Must_be_svm(b(i)->(h~[i]) ¥Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[i]),s->Za,u->n0) ==> (n0 in Za) ¥imp (({[i,(h~[i]) ¥Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[i])]: i in Za}~[n0]) = ((h~[n0]) ¥Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[n0])))
	APPLY() Must_be_svm(b(i)->Ra_Rev(Ra0Seq~[i]),s->Za,u->n0) ==> (n0 in Za) ¥imp (({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[n0]) = Ra_Rev(Ra0Seq~[n0]))
        n0-->T548(Stat6*) ==> Stat7: ((Ra0Seq~[n0]) = Ra_0) & (({[i,(h~[i]) ¥Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[i])]: i in Za}~[n0]) = ((h~[n0]) ¥Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[n0]))) & (({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[n0]) = Ra_Rev(Ra0Seq~[n0]))
        T481 ==> Ra_Rev(Ra_0) = Ra_0
	EQUAL(Stat7) ==> ({[i,(h~[i]) ¥Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[i])]: i in Za}~[n0]) = ((h~[n0]) ¥Ra_PLUS Ra_0)
	(h,n0)-->T540 ==> (h~[n0]) in Ra
(h~[n0])-->T451(Stat6*) ==> false; Discharge ==> QED
--
Theorem 590: [Basic properties of the signed negative for rational sequences] (X in RaSeq) ¥imp ((Ras_Rev(X) in RaSeq) & ((Ras_Rev(X) ¥Ras_PLUS X) = Ra0Seq) & (Ras_Rev(Ras_Rev(X)) = X)). Proof:
Suppose_not(h) ==> AUTO
	(h,h)-->T554 ==> ((Ras_Rev(h) ¥Ras_PLUS h) /= Ra0Seq) or (Ras_Rev(Ras_Rev(h)) /= h)
	Suppose ==> Stat1: (h in RaSeq) & ((Ras_Rev(h) ¥Ras_PLUS h) /= Ra0Seq)
		T545(Stat1*) ==> Ra0Seq in RaCauchy
		T539(Stat1*) ==> Ra0Seq in RaSeq
		(h,h)-->T554(Stat1*) ==> Ras_Rev(h) in RaSeq
		(Ras_Rev(h),h)-->T554(Stat1*) ==> (Ras_Rev(h) ¥Ras_PLUS h) in RaSeq
		(Ras_Rev(h) ¥Ras_PLUS h,Ra0Seq)-->T542(Stat1,Stat1*) ==> Stat2: not(FORALL n in Za | ((Ras_Rev(h) ¥Ras_PLUS h) in RaSeq) & (Ra0Seq in RaSeq) & (((Ras_Rev(h) ¥Ras_PLUS h)~[n]) = (Ra0Seq~[n])))
		n0-->Stat2(Stat1*) ==> (n0 in Za) & (((Ras_Rev(h) ¥Ras_PLUS h)~[n0]) /= (Ra0Seq~[n0]))
		(Ras_Rev(h),h,n0)-->T555(Stat1*) ==> ((Ras_Rev(h) ¥Ras_PLUS h)~[n0]) = ((Ras_Rev(h)~[n0]) ¥Ra_PLUS (h~[n0]))
		(h,h,n0)-->T555(Stat1*) ==> (Ras_Rev(h)~[n0]) = Ra_Rev(h~[n0])
		n0-->T548(Stat1*) ==> (Ra0Seq~[n0]) = Ra_0
		EQUAL(Stat1*) ==> (Ra_Rev(h~[n0]) ¥Ra_PLUS (h~[n0])) /= Ra_0
		(h,n0)-->T540(Stat1*) ==> (h~[n0]) in Ra
		(h~[n0])-->T452(Stat1*) ==> (Ra_Rev(h~[n0]) in Ra) & (((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[n0])) = Ra_0)
	(h~[n0],Ra_Rev(h~[n0]))-->T445(Stat1*) ==> false; Discharge ==> Stat3: (h in RaSeq) & (Ras_Rev(Ras_Rev(h)) /= h)
	(h,h)-->T554(Stat3*) ==> Ras_Rev(h) in RaSeq
	(h,Ras_Rev(h))-->T554(Stat3*) ==> Ras_Rev(Ras_Rev(h)) in RaSeq
	(Ras_Rev(Ras_Rev(h)),h)-->T542(Stat3,Stat3*) ==> Stat4: not(FORALL n in Za | (Ras_Rev(Ras_Rev(h)) in RaSeq) & (h in RaSeq) & ((Ras_Rev(Ras_Rev(h))~[n]) = (h~[n])))
	n1-->Stat4(Stat3*) ==> (n1 in Za) & ((Ras_Rev(Ras_Rev(h))~[n1]) /= (h~[n1]))
	(h,Ras_Rev(h),n1)-->T555(Stat3*) ==> (Ras_Rev(Ras_Rev(h))~[n1]) = Ra_Rev((Ras_Rev(h))~[n1])
	(h,h,n1)-->T555(Stat3*) ==> (Ras_Rev(h)~[n1]) = Ra_Rev(h~[n1])
	EQUAL(Stat4*) ==> Ra_Rev(Ra_Rev(h~[n1])) /= (h~[n1])
	(h,n1)-->T540(Stat3*) ==> (h~[n1]) in Ra
(h~[n1])-->T494(Stat4*) ==> false; Discharge ==> QED
--
--
Theorem 591: [Reciprocal sequence principle] ((X in RaCauchy) & (not Ra_eqseq(X,Ra0Seq))) ¥imp Ra_eqseq(X ¥Ras_TIMES Ras_Recip(X),Ra1Seq). Proof:
Suppose_not(f) ==>AUTO
--
-- Reasoning by contradiction, assume that a counterexample exists. We can, without loss of
-- generality, assume that the counterexample to the desired statement is a rational Cauchy
-- sequence $g$ whose reciprocal owns, as components, the reciprocals of the components of $g$.
--
	f-->T568 ==> Stat1: (EXISTS g in RaCauchy | Ra_eqseq(f,g) & (Ras_Recip(f) = Ras_Recip(g)) & (FORALL u in Za | ((g~[u]) /= Ra_0) & ((Ras_Recip(g)~[u]) = Recip(g~[u]))))
	g-->Stat1 ==> Stat2: (g in RaCauchy) & Ra_eqseq(f,g) & (Ras_Recip(f) = Ras_Recip(g)) & Stat3: (FORALL u in Za | ((g~[u]) /= Ra_0) & ((Ras_Recip(g)~[u]) = Recip(g~[u])))
	T545(Stat2*) ==> (Ra0Seq in RaCauchy) & (Ra1Seq in RaCauchy)
	T539(*) ==> Stat4: (g in RaSeq) & (f in RaSeq) & (Ra0Seq in RaSeq) & (Ra1Seq in RaSeq)
	Suppose ==> Ra_eqseq(g,Ra0Seq)
		Ra0Seq-->T546(Stat4,Stat4*) ==> Ra_eqseq(Ra0Seq,Ra0Seq)
		(g,Ra0Seq,Ra0Seq)-->T553(Stat2*) ==> Ra_eqseq(Ra0Seq,g)
		f-->T546(Stat2*) ==> Ra_eqseq(f,f)
		(f,f,g)-->T553(Stat2*) ==> Ra_eqseq(g,f)
	(Ra0Seq,g,f)-->T553(*) ==> false; Discharge ==> not(Ra_eqseq(g,Ra0Seq))
	(g,g)-->T570(Stat2*) ==> Ras_Recip(g) in RaCauchy
	T539(Stat2*) ==> Stat5: Ras_Recip(g) in RaSeq
	(g,Ras_Recip(g))-->T554(Stat2*) ==> Stat6: ((g ¥Ras_TIMES Ras_Recip(g)) in RaSeq) &
		((g ¥Ras_TIMES Ras_Recip(g)) = {[i,((g~[i]) ¥Ra_TIMES ((Ras_Recip(g))~[i]))]: i in Za})
	Ra1Seq-->T546(Stat4,Stat4*) ==> Stat7: Ra_eqseq(Ra1Seq,Ra1Seq)
	Suppose ==> Stat8: Ra_eqseq(g ¥Ras_TIMES Ras_Recip(g),Ra1Seq)
		(f,f)-->T570(*) ==> Ras_Recip(f) in RaCauchy
		(Ras_Recip(g))-->T546(Stat5,Stat5*) ==> Ra_eqseq(Ras_Recip(g),Ras_Recip(g))
		EQUAL(Stat2) ==> Stat9: Ra_eqseq(Ras_Recip(f),Ras_Recip(g)) & (Ras_Recip(f) in RaSeq)
		(f,g,Ras_Recip(f),Ras_Recip(g))-->T574(*) ==> Ra_eqseq(f ¥Ras_TIMES Ras_Recip(f), g ¥Ras_TIMES Ras_Recip(g))
		(f,Ras_Recip(f))-->T554(Stat4,Stat9*) ==> (f ¥Ras_TIMES Ras_Recip(f)) in RaSeq
		(f ¥Ras_TIMES Ras_Recip(f),g ¥Ras_TIMES Ras_Recip(g),Ra1Seq)-->T553(Stat4*) ==> Ra_eqseq(Ra1Seq,f ¥Ras_TIMES Ras_Recip(f))
	(Ra1Seq,Ra1Seq,f ¥Ras_TIMES Ras_Recip(f))-->T553(*) ==> false; Discharge ==> Stat10: not(Ra_eqseq(g ¥Ras_TIMES Ras_Recip(g),Ra1Seq))
--
-- Since $g ¥Ras_TIMES Ras_Recip(g)$ is not equivalent to $Ra1Seq$, by reflexivity of
-- equivalence these sequences must differ from one another, and hence they must differ
-- in the $n0$-th component for some unsigned integer $n0$.
--
	Suppose ==> Stat11: (g ¥Ras_TIMES Ras_Recip(g)) = Ra1Seq
	EQUAL(Stat7,Stat10,Stat11) ==> false; Discharge ==> Stat12: (g ¥Ras_TIMES Ras_Recip(g)) /= Ra1Seq
	(g ¥Ras_TIMES Ras_Recip(g),Ra1Seq)-->T542(Stat12*) ==> Stat13: not(FORALL n in Za | (((g ¥Ras_TIMES Ras_Recip(g)) in RaSeq) & (Ra1Seq in RaSeq) & (((g ¥Ras_TIMES Ras_Recip(g))~[n]) = (Ra1Seq~[n]))))
	n0-->Stat13(Stat6,Stat4*) ==> Stat14: (n0 in Za) & (((g ¥Ras_TIMES Ras_Recip(g))~[n0]) /= (Ra1Seq~[n0]))
--
	EQUAL(Stat14,Stat6) ==> (({[i,((g~[i]) ¥Ra_TIMES ((Ras_Recip(g))~[i]))]: i in Za}~[n0]) /= (Ra1Seq~[n0]))
	APPLY() Must_be_svm(b(i)->((g~[i]) ¥Ra_TIMES ((Ras_Recip(g))~[i])),s->Za,u->n0) ==> (n0 in Za) ¥imp (({[i,((g~[i]) ¥Ra_TIMES ((Ras_Recip(g))~[i]))]: i in Za}~[n0]) = ((g~[n0]) ¥Ra_TIMES ((Ras_Recip(g))~[n0])))
        n0-->T548(Stat14,Stat14*) ==> (Ra1Seq~[n0]) = Ra_1
	(Stat14*)ELEM ==> Stat15: ((g~[n0]) ¥Ra_TIMES ((Ras_Recip(g))~[n0])) /= Ra_1
--
	(g,n0)-->T540(Stat14,Stat4*) ==> Stat16: (g~[n0]) in Ra
	n0-->Stat3(Stat14,Stat14*) ==> Stat17: ((g~[n0]) /= Ra_0) & ((Ras_Recip(g)~[n0]) = Recip(g~[n0]))
	EQUAL(Stat15,Stat17) ==> ((g~[n0]) ¥Ra_TIMES Recip(g~[n0])) /= Ra_1
(g~[n0])-->T462(Stat16*) ==> false; Discharge ==> QED
--
--
Theorem 592: [The negative of a sum of rational sequences is the sum of the negatives] ((X in RaSeq) & (Y in RaSeq)) ¥imp (Ras_Rev(X ¥Ras_PLUS Y) = Ras_Rev(X) ¥Ras_PLUS Ras_Rev(Y)). Proof:
Suppose_not(h,k) ==>AUTO
	(h,k)-->T554 ==> ((h ¥Ras_PLUS k) in RaSeq) & (Ras_Rev(k) in RaSeq)
	(h,h)-->T554 ==> Ras_Rev(h) in RaSeq
	(Ras_Rev(h),Ras_Rev(k))-->T554 ==> (Ras_Rev(h) ¥Ras_PLUS Ras_Rev(k)) in RaSeq
	(h,h ¥Ras_PLUS k)-->T554 ==> Ras_Rev(h ¥Ras_PLUS k) in RaSeq
	(Ras_Rev(h ¥Ras_PLUS k))-->T546 ==> Svm(Ras_Rev(h ¥Ras_PLUS k)) & (domain(Ras_Rev(h ¥Ras_PLUS k)) = Za)
	(Ras_Rev(h) ¥Ras_PLUS Ras_Rev(k))-->T546 ==> Svm(Ras_Rev(h) ¥Ras_PLUS Ras_Rev(k)) & (domain(Ras_Rev(h) ¥Ras_PLUS Ras_Rev(k)) = Za)
	(Ras_Rev(h ¥Ras_PLUS k))-->T72(*) ==> Ras_Rev(h ¥Ras_PLUS k) = {[i,Ras_Rev(h ¥Ras_PLUS k)~[i]]: i in domain(Ras_Rev(h ¥Ras_PLUS k))}
	(Ras_Rev(h) ¥Ras_PLUS Ras_Rev(k))-->T72(*) ==> (Ras_Rev(h) ¥Ras_PLUS Ras_Rev(k)) = {[i,(Ras_Rev(h) ¥Ras_PLUS Ras_Rev(k))~[i]]: i in domain(Ras_Rev(h) ¥Ras_PLUS Ras_Rev(k))}
	Suppose ==> {[i,Ras_Rev(h ¥Ras_PLUS k)~[i]]: i in Za} = {[i,(Ras_Rev(h) ¥Ras_PLUS Ras_Rev(k))~[i]]: i in Za}
	EQUAL ==> false; Discharge ==> Stat1: {[i,Ras_Rev(h ¥Ras_PLUS k)~[i]]: i in Za} /= {[i,(Ras_Rev(h) ¥Ras_PLUS Ras_Rev(k))~[i]]: i in Za}
	i-->Stat1(Stat1) ==> Stat2: (i in Za) & ((Ras_Rev(h ¥Ras_PLUS k)~[i]) /= ((Ras_Rev(h) ¥Ras_PLUS Ras_Rev(k))~[i]))
        (h,h ¥Ras_PLUS k,i)-->T555 ==> (Ras_Rev(h ¥Ras_PLUS k)~[i]) = Ra_Rev((h ¥Ras_PLUS k)~[i])
	(h,k,i)-->T555 ==> ((h ¥Ras_PLUS k)~[i]) = ((h~[i]) ¥Ra_PLUS (k~[i]))
	(Ras_Rev(h),Ras_Rev(k),i)-->T555 ==> ((Ras_Rev(h) ¥Ras_PLUS Ras_Rev(k))~[i]) = ((Ras_Rev(h)~[i]) ¥Ra_PLUS (Ras_Rev(k)~[i]))
	(h,h,i)-->T555 ==> (Ras_Rev(h)~[i]) = Ra_Rev(h~[i])
	(k,k,i)-->T555 ==> (Ras_Rev(k)~[i]) = Ra_Rev(k~[i])
	EQUAL ==> Ra_Rev((h ¥Ras_PLUS k)~[i]) = Ra_Rev((h~[i]) ¥Ra_PLUS (k~[i]))
	EQUAL ==> ((Ras_Rev(h)~[i]) ¥Ra_PLUS (Ras_Rev(k)~[i])) = (Ra_Rev(h~[i]) ¥Ra_PLUS Ra_Rev(k~[i]))
	(h,i)-->T540 ==> (h~[i]) in Ra
	(k,i)-->T540 ==> (k~[i]) in Ra
	(h~[i])-->T452 ==> Ra_Rev(h~[i]) in Ra
(h~[i],k~[i])-->T492(Stat2*) ==> false; Discharge ==> QED
--
Theorem 593: [A rational sequence minus itself gives 0] (X in RaSeq) ¥imp ((X ¥Ras_MINUS X) = Ra0Seq). Proof:
Suppose_not(h) ==>AUTO
	T545(*) ==> Ra0Seq in RaCauchy
	T539(*) ==> Ra0Seq in RaSeq
	(h,h)-->T554 ==> Ras_Rev(h) in RaSeq
	(h,Ras_Rev(h))-->T554 ==> (h ¥Ras_PLUS Ras_Rev(h)) in RaSeq
        Use_def(¥Ras_MINUS) ==> ((h ¥Ras_PLUS Ras_Rev(h)) /= Ra0Seq)
	Ra0Seq-->T546 ==> Svm(Ra0Seq) & (domain(Ra0Seq) = Za)
	(h ¥Ras_PLUS Ras_Rev(h))-->T546 ==> Svm(h ¥Ras_PLUS Ras_Rev(h)) & (domain(h ¥Ras_PLUS Ras_Rev(h)) = Za)
	Ra0Seq-->T72 ==> Ra0Seq = {[i,Ra0Seq~[i]]: i in domain(Ra0Seq)}
	(h ¥Ras_PLUS Ras_Rev(h))-->T72(*) ==> (h ¥Ras_PLUS Ras_Rev(h)) = {[i,(h ¥Ras_PLUS Ras_Rev(h))~[i]]: i in domain(h ¥Ras_PLUS Ras_Rev(h))}
	Suppose ==> {[i,Ra0Seq~[i]]: i in Za} = {[i,(h ¥Ras_PLUS Ras_Rev(h))~[i]]: i in Za}
	EQUAL ==> false; Discharge ==> Stat1: {[i,Ra0Seq~[i]]: i in Za} /= {[i,(h ¥Ras_PLUS Ras_Rev(h))~[i]]: i in Za}
	i-->Stat1(Stat1) ==>  Stat2: (i in Za) & ((Ra0Seq~[i]) /= ((h ¥Ras_PLUS Ras_Rev(h))~[i]))
	(h,Ras_Rev(h),i)-->T555 ==> ((h ¥Ras_PLUS Ras_Rev(h))~[i]) = ((h~[i]) ¥Ra_PLUS (Ras_Rev(h)~[i]))
	(h,h,i)-->T555 ==> (Ras_Rev(h)~[i]) = Ra_Rev(h~[i])
	i-->T548 ==> (Ra0Seq~[i]) = Ra_0
	EQUAL ==> ((h~[i]) ¥Ra_PLUS (Ras_Rev(h)~[i])) = ((h~[i]) ¥Ra_PLUS Ra_Rev(h~[i]))
	(h,i)-->T540 ==> (h~[i]) in Ra
(h~[i])-->T452(Stat2*) ==> false; Discharge ==> QED
--
Theorem 594: [Multiplication by $Ras_Rev(Ra1Seq)$] (X in RaSeq) ¥imp (Ras_Rev(X) = (Ras_Rev(Ra1Seq) ¥Ras_TIMES X)). Proof:
Suppose_not(h) ==>AUTO
	T545(*) ==> Ra1Seq in RaCauchy
	T539(*) ==> Ra1Seq in RaSeq
	(Ra1Seq,Ra1Seq)-->T554 ==> Ras_Rev(Ra1Seq) in RaSeq
	(h,h)-->T554 ==> Ras_Rev(h) in RaSeq
	(Ras_Rev(Ra1Seq),h)-->T554 ==> (Ras_Rev(Ra1Seq) ¥Ras_TIMES h) in RaSeq
	(Ras_Rev(h))-->T546 ==> Svm(Ras_Rev(h)) & (domain(Ras_Rev(h)) = Za)
	(Ras_Rev(Ra1Seq) ¥Ras_TIMES h)-->T546 ==> Svm(Ras_Rev(Ra1Seq) ¥Ras_TIMES h) & (domain(Ras_Rev(Ra1Seq) ¥Ras_TIMES h) = Za)
	(Ras_Rev(h))-->T72 ==> Ras_Rev(h) = {[i,Ras_Rev(h)~[i]]: i in domain(Ras_Rev(h))}
	(Ras_Rev(Ra1Seq) ¥Ras_TIMES h)-->T72(*) ==> (Ras_Rev(Ra1Seq) ¥Ras_TIMES h) = {[i,(Ras_Rev(Ra1Seq) ¥Ras_TIMES h)~[i]]: i in domain(Ras_Rev(Ra1Seq) ¥Ras_TIMES h)}
	Suppose ==> {[i,Ras_Rev(h)~[i]]: i in Za} = {[i,(Ras_Rev(Ra1Seq) ¥Ras_TIMES h)~[i]]: i in Za}
	EQUAL ==> false; Discharge ==> Stat1: {[i,Ras_Rev(h)~[i]]: i in Za} /= {[i,(Ras_Rev(Ra1Seq) ¥Ras_TIMES h)~[i]]: i in Za}
	i-->Stat1(Stat1) ==>  Stat2: (i in Za) & ((Ras_Rev(h)~[i]) /= ((Ras_Rev(Ra1Seq) ¥Ras_TIMES h)~[i]))
	(Ras_Rev(Ra1Seq),h,i)-->T555 ==> ((Ras_Rev(Ra1Seq) ¥Ras_TIMES h)~[i]) = ((Ras_Rev(Ra1Seq)~[i]) ¥Ra_TIMES (h~[i]))
        (h,h,i)-->T555 ==> (Ras_Rev(h)~[i]) = Ra_Rev(h~[i])
        (h,Ra1Seq,i)-->T555 ==> (Ras_Rev(Ra1Seq)~[i]) = Ra_Rev(Ra1Seq~[i])
	i-->T548 ==> (Ra1Seq~[i]) = Ra_1
	EQUAL ==> ((Ras_Rev(Ra1Seq)~[i]) ¥Ra_TIMES (h~[i])) = (Ra_Rev(Ra_1) ¥Ra_TIMES (h~[i]))
	(h,i)-->T540 ==> (h~[i]) in Ra
(h~[i])-->T486 ==> false; Discharge ==> QED
--
Theorem 595: [The zero sequence is its own negative] Ras_Rev(Ra0Seq) = Ra0Seq. Proof:
Suppose_not ==> AUTO
	T545(*) ==> Ra0Seq in RaCauchy
	T539(*) ==> Stat1: Ra0Seq in RaSeq
	(Ra0Seq,Ra0Seq)-->T554(*) ==> Stat2: (Ras_Rev(Ra0Seq) in RaSeq) &
		(Ras_Rev(Ra0Seq) = {[i,Ra_Rev(Ra0Seq~[i])]: i in Za})
	(Ras_Rev(Ra0Seq),Ra0Seq)-->T542(*) ==> Stat3: not(FORALL n in Za | (((Ras_Rev(Ra0Seq)) in RaSeq) & (Ra0Seq in RaSeq) & (((Ras_Rev(Ra0Seq))~[n]) = (Ra0Seq~[n]))))
	n0-->Stat3(*) ==> Stat4: (n0 in Za) & (((Ras_Rev(Ra0Seq))~[n0]) /= (Ra0Seq~[n0]))
	EQUAL(Stat4,Stat2) ==> ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[n0]) /= (Ra0Seq~[n0])
	APPLY() Must_be_svm(b(i)->Ra_Rev(Ra0Seq~[i]),s->Za,u->n0) ==> (n0 in Za) ¥imp (({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[n0]) = (Ra_Rev(Ra0Seq~[n0])))
        n0-->T548(Stat4,Stat4*) ==> Stat5: (Ra0Seq~[n0]) = Ra_0
	T481(Stat5*) ==> Ra_Rev(Ra_0) = Ra_0
	EQUAL(Stat5) ==> Ra_Rev(Ra0Seq~[n0]) = Ra_0
(Stat4*)Discharge ==> QED
--
Theorem 596: [The zero/unit sequence is its own absolute value] (Ras_ABS(Ra0Seq) = Ra0Seq) & (Ras_ABS(Ra1Seq) = Ra1Seq). Proof:
Suppose_not ==> AUTO
	()-->T545 ==> AUTO
	()-->T539 ==> AUTO
	(Ra0Seq,Ra0Seq)-->T554(*) ==> Stat1: (Ras_ABS(Ra0Seq) in RaSeq) &
		(Ras_ABS(Ra0Seq) = {[i,Ra_ABS(Ra0Seq~[i])]: i in Za})
	(Ra1Seq,Ra1Seq)-->T554(*) ==> Stat2: (Ras_ABS(Ra1Seq) in RaSeq) &
		(Ras_ABS(Ra1Seq) = {[i,Ra_ABS(Ra1Seq~[i])]: i in Za})
	T525(Stat3*) ==> Stat3: (FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0))) &
        	Stat4: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
--
-- Rejection of the assertion, which consists of two alternative cases,
-- proceeds quite similarly in either case.
--
	Suppose ==> Ras_ABS(Ra0Seq) /= Ra0Seq
		(Ras_ABS(Ra0Seq),Ra0Seq)-->T542(*) ==> Stat5: not(FORALL n in Za | (((Ras_ABS(Ra0Seq)) in RaSeq) & (Ra0Seq in RaSeq) & (((Ras_ABS(Ra0Seq))~[n]) = (Ra0Seq~[n]))))
		n0-->Stat5(*) ==> Stat6: (n0 in Za) & (((Ras_ABS(Ra0Seq))~[n0]) /= (Ra0Seq~[n0]))
		EQUAL(Stat6,Stat1) ==> ({[i,Ra_ABS(Ra0Seq~[i])]: i in Za}~[n0]) /= (Ra0Seq~[n0])
		APPLY() Must_be_svm(b(i)->Ra_ABS(Ra0Seq~[i]),s->Za,u->n0) ==> (n0 in Za) ¥imp (({[i,Ra_ABS(Ra0Seq~[i])]: i in Za}~[n0]) = (Ra_ABS(Ra0Seq~[n0])))
		n0-->T548(Stat6,Stat6*) ==> Stat7: (Ra0Seq~[n0]) = Ra_0
		T451(Stat7*) ==> Ra_0 in Ra
		Ra_0-->Stat3(Stat6*) ==> Ra_ABS(Ra_0) = Ra_0
		EQUAL(Stat7) ==> Ra_ABS(Ra0Seq~[n0]) = Ra_0
	(Stat6*)Discharge ==> Ras_ABS(Ra1Seq) /= Ra1Seq
--
--
	(Ras_ABS(Ra1Seq),Ra1Seq)-->T542(*) ==> Stat8: not(FORALL n in Za | (((Ras_ABS(Ra1Seq)) in RaSeq) & (Ra1Seq in RaSeq) & (((Ras_ABS(Ra1Seq))~[n]) = (Ra1Seq~[n]))))
	n1-->Stat8(*) ==> Stat9: (n1 in Za) & (((Ras_ABS(Ra1Seq))~[n1]) /= (Ra1Seq~[n1]))
	EQUAL(Stat9,Stat2) ==> ({[i,Ra_ABS(Ra1Seq~[i])]: i in Za}~[n1]) /= (Ra1Seq~[n1])
	APPLY() Must_be_svm(b(i)->Ra_ABS(Ra1Seq~[i]),s->Za,u->n1) ==> (n1 in Za) ¥imp (({[i,Ra_ABS(Ra1Seq~[i])]: i in Za}~[n1]) = (Ra_ABS(Ra1Seq~[n1])))
        n1-->T548(Stat9,Stat9*) ==> Stat10: (Ra1Seq~[n1]) = Ra_1
        T465(Stat10*) ==> Ra_is_nonneg(Ra_1)
        Ra_1-->Stat4(Stat10*) ==> Ra_ABS(Ra_1) = Ra_1
	EQUAL(Stat10) ==> Ra_ABS(Ra1Seq~[n1]) = Ra_1
(Stat9*)Discharge ==> QED
--
Theorem 597: [?] ((H in RaCauchy) & Ra_eqseq(H,Ra0Seq)) ¥imp (Ra_eqseq(Ras_ABS(H),Ra0Seq) & (Ra_eqseq(Ras_Rev(H),Ra0Seq))). Proof:
Suppose_not(h) ==> AUTO
	T545(*) ==> Ra0Seq in RaCauchy
	Suppose ==> Stat1: (not Ra_eqseq(Ras_Rev(h),Ra0Seq))
		(h,Ra0Seq)-->T575(*) ==> Ra_eqseq(Ras_Rev(h),Ras_Rev(Ra0Seq))
		T595 ==> Ras_Rev(Ra0Seq) = Ra0Seq
	EQUAL(Stat1) ==> false; Discharge ==> Stat2: (not Ra_eqseq(Ras_ABS(h),Ra0Seq))
	(h,Ra0Seq)-->T576(*) ==> Ra_eqseq(Ras_ABS(h),Ras_ABS(Ra0Seq))
	T596 ==> Ras_ABS(Ra0Seq) = Ra0Seq
EQUAL(Stat2) ==> false; Discharge ==> QED
--
Theorem 598: [All terms of a Cauchy sequence not equivalent to zero have the same sign and have an absolute value bounded below beyond a certain point] ((F in RaCauchy) &
	(not Ra_eqseq(F,Ra0Seq))) ¥imp (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) & (FORALL i in (Za - n) | (Ra_ABS(F~[i]) ¥Ra_GT eps) &
	(Ra_ABS(F~[i]) = if ((F~[n]) ¥Ra_GE Ra_0) then (F~[i]) else Ra_Rev(F~[i]) end if) )). Proof:
Suppose_not(h) ==> ((h in RaCauchy) & (not Ra_eqseq(h,Ra0Seq))) & Stat1: (not(EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) & (FORALL i in (Za - n) | (Ra_ABS(h~[i]) ¥Ra_GT eps) &
		(Ra_ABS(h~[i]) = if ((h~[n]) ¥Ra_GE Ra_0) then (h~[i]) else Ra_Rev(h~[i]) end if) )))
	T539(*) ==> Stat2: h in RaSeq
--
-- Let the Cauchy sequence $h$ be a counterexample to our claim.
-- Then it is easily seen that $h$ cannot be equivalent to $Ra0Seq$; hence,
-- by Theorem 564, there exists a positive rational $eps0$ and an integer $n0$
-- beyond which all the components $h~[i]$ of $h$ have an absolute value greater than $eps0$
-- and all the components $h~[j], h~[i]$ of $h$ differ by less than $eps0$.
--
	h-->T564(*) ==> Stat3: (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
		(FORALL i in (Za - n) | Ra_ABS(h~[i]) ¥Ra_GT eps) &
		(FORALL i in Za, j in Za | ((i notin n) & (j notin n)) ¥imp (eps ¥Ra_GT (Ra_ABS((h~[i]) ¥Ra_MINUS (h~[j])))) ))
	(eps0,n0)-->Stat3(Stat3*) ==> Stat4: (eps0 in Ra) & (n0 in Za) & (eps0 ¥Ra_GT Ra_0) &
		Stat5: (FORALL i in (Za - n0) | Ra_ABS(h~[i]) ¥Ra_GT eps0) &
		Stat6: (FORALL i in Za, j in Za | ((i notin n0) & (j notin n0)) ¥imp (eps0 ¥Ra_GT (Ra_ABS((h~[i]) ¥Ra_MINUS (h~[j])))) )
--
-- Our initial hypothesis now yields the existence of a component, say the $i1$-th,
-- beyond the $n0$-th component, whose absolute value does not comply in sign with
-- the $n0$-th component.
--
	(eps0,n0)-->Stat1(Stat4*) ==> Stat7: not(FORALL i in (Za - n0) | (Ra_ABS(h~[i]) ¥Ra_GT eps0) &
		(Ra_ABS(h~[i]) = if ((h~[n0]) ¥Ra_GE Ra_0) then (h~[i]) else Ra_Rev(h~[i]) end if) )
	i1-->Stat7(Stat7*) ==> Stat8: (i1 in (Za - n0)) & (not(Ra_ABS(h~[i1]) ¥Ra_GT eps0) or (Ra_ABS(h~[i1]) /= if ((h~[n0]) ¥Ra_GE Ra_0) then (h~[i1]) else Ra_Rev(h~[i1]) end if))
	i1-->Stat5(Stat8*) ==> Stat9: (Ra_ABS(h~[i1]) ¥Ra_GT eps0) & (Ra_ABS(h~[i1]) /= if ((h~[n0]) ¥Ra_GE Ra_0) then (h~[i1]) else Ra_Rev(h~[i1]) end if)
--
-- Either $h~[n0]$ is positive, or it is negative. In the first case...
--
	n0-->Stat5(Stat4*) ==> Stat10: Ra_ABS(h~[n0]) ¥Ra_GT eps0
	(h,n0)-->T540(Stat2,Stat4*) ==> Stat11: (h~[n0]) in Ra
	(h~[n0])-->T527(Stat11*) ==> Stat12: (Ra_ABS(h~[n0]) in Ra) & (Ra_ABS(h~[n0]) ¥Ra_GE Ra_0)
	(h~[n0])-->T451(Stat11,Stat11*) ==> Stat13: Ra_0 in Ra
	(Ra_ABS(h~[n0]),eps0,Ra_0)-->T498(Stat12,Stat4,Stat13,Stat10*) ==> Ra_ABS(h~[n0]) ¥Ra_GT Ra_0
	(Ra_ABS(h~[n0]),Ra_0)-->T473(Stat13*) ==> Stat14: Ra_ABS(h~[n0]) /= Ra_0
	T525(Stat13*) ==> Stat15: (FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0)))
	(h~[n0])-->Stat15(Stat11,Stat14*) ==> Stat16: (h~[n0]) /= Ra_0
	(h~[n0],Ra_0)-->T476(Stat11,Stat13,Stat16*) ==> ((h~[n0]) ¥Ra_GT Ra_0) or (Ra_0 ¥Ra_GT (h~[n0]))
	(h,i1)-->T540(Stat2,Stat8*) ==> Stat17: (h~[i1]) in Ra
	(h~[i1])-->T452(Stat17*) ==> Stat18: Ra_Rev(h~[i1]) in Ra
	T481(Stat18*) ==> Stat19: Ra_Rev(Ra_0) = Ra_0
	(eps0,eps0)-->T473(Stat19*) ==> Stat20: not(eps0 ¥Ra_GT eps0)
	eps0-->T451(Stat4,Stat4*) ==> Stat21: eps0 = (eps0 ¥Ra_PLUS Ra_0)
	Suppose ==> (h~[n0]) ¥Ra_GT Ra_0
--
-- ... we reach a contradiction as follows. Observe that $Ra_ABS(h~[n0])$ equals $h~[n0]$, and
-- Stat9 yields that $Ra_ABS(h~[i1]) /= (h~[i1])$ in this case, and hence $h~[i1]$ is negative.
-- However, this conflicts with the fact that the distance between $h~[n0]$, which is bigger
-- than $eps0$, and $h~[i1]$ is smaller than $eps0$.
--
		(h~[n0],Ra_0)-->T473(Stat16*) ==> Stat22: (h~[n0]) ¥Ra_GE Ra_0
		(h~[n0])-->T529(Stat11*) ==> Stat23: Ra_ABS(h~[n0]) = (h~[n0])
		(Stat22,Stat9*)ELEM ==> Stat24: Ra_ABS(h~[i1]) /= (h~[i1])
		(h~[i1])-->T528(Stat24,Stat17*) ==> Stat25: not((h~[i1]) ¥Ra_GE Ra_0)
		(Ra_0,h~[i1])-->T478(Stat13,Stat17,Stat25*) ==> Stat26: Ra_0 ¥Ra_GT (h~[i1])
		(Ra_0,h~[i1])-->T503(Stat26,Stat13,Stat17*) ==> Stat27: Ra_Rev(h~[i1]) ¥Ra_GT Ra_Rev(Ra_0)
		EQUAL(Stat27,Stat19) ==> Stat28: Ra_Rev(h~[i1]) ¥Ra_GT Ra_0
		EQUAL(Stat23,Stat10) ==> Stat29: (h~[n0]) ¥Ra_GT eps0
		(h~[n0],eps0)-->T473(Stat29*) ==> Stat30: (h~[n0]) ¥Ra_GE eps0
		(h~[n0],eps0,Ra_Rev(h~[i1]),Ra_0)-->T504(Stat11,Stat4,Stat18,Stat13,Stat30,Stat28*) ==>
			Stat31: ((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1])) ¥Ra_GT (eps0 ¥Ra_PLUS Ra_0)
		EQUAL(Stat31,Stat21) ==> Stat32: ((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1])) ¥Ra_GT eps0
		(h~[n0],Ra_Rev(h~[i1]))-->T445(Stat11,Stat18*) ==> Stat33: ((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1])) in Ra
		((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1]),eps0,Ra_0)-->T498(Stat32,Stat33,Stat4,Stat13*) ==> ((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1])) ¥Ra_GT Ra_0
		((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1]))-->T529(Stat33*) ==> Ra_ABS((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1])) = ((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1]))
		Use_def(¥Ra_MINUS) ==> (h~[n0]) ¥Ra_MINUS (h~[i1]) = (h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1])
		EQUAL(Stat32) ==> Stat34: (Ra_ABS((h~[n0]) ¥Ra_MINUS (h~[i1])) in Ra) & (Ra_ABS((h~[n0]) ¥Ra_MINUS (h~[i1])) ¥Ra_GT eps0)
		(n0,i1)-->Stat6(Stat4,Stat8*) ==> Stat35: eps0 ¥Ra_GT Ra_ABS((h~[n0]) ¥Ra_MINUS (h~[i1]))
	(eps0,Ra_ABS((h~[n0]) ¥Ra_MINUS (h~[i1])),eps0)-->T498(Stat4,Stat34,Stat35,Stat20*) ==> false; Discharge ==> Stat36: Ra_0 ¥Ra_GT (h~[n0])
--
-- Hence $h~[n0]$ is negative; but then we reach again a contradiction,
-- leading to the desired overall conclusion, as follows. Observe that $Ra_ABS(h~[n0])$ equals
-- $Ra_Rev(h~[n0])$, and Stat9 yields that $Ra_ABS(h~[i1]) /= Ra_Rev(h~[i1])$ in this case,
-- and hence $h~[i1]$ is positive. However, this conflicts with the fact that the distance
-- between $h~[n0]$, which is smaller than $eps0$, and $h~[i1]$ is smaller than $eps0$.
--
	T525(Stat36*) ==> Stat37: (FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
	(h~[n0])-->Stat37(Stat11,Stat11*) ==> Stat38: Ra_ABS(Ra_Rev(h~[n0])) = Ra_ABS(h~[n0])
	(Ra_0,h~[n0])-->T503(Stat36,Stat11,Stat13*) ==> Stat39: Ra_Rev(h~[n0]) ¥Ra_GT Ra_Rev(Ra_0)
	EQUAL(Stat39,Stat19) ==> Stat40: Ra_Rev(h~[n0]) ¥Ra_GT Ra_0
	(h~[n0])-->T452(Stat11,Stat11*) ==> Stat41: Ra_Rev(h~[n0]) in Ra
	(Ra_Rev(h~[n0]))-->T529(Stat38*) ==> Ra_ABS(h~[n0]) = Ra_Rev(h~[n0])
	Suppose ==> Stat42: (h~[n0]) ¥Ra_GE Ra_0
		(Ra_0,h~[n0],Ra_0)-->T497(Stat13,Stat11,Stat36,Stat42*) ==> Ra_0 ¥Ra_GT Ra_0
--	Use_def(¥Ra_GT)(Stat42*) ==> false; Discharge ==> Stat43: not((h~[n0]) ¥Ra_GE Ra_0)
	(Ra_0,Ra_0)-->T473(Stat42*) ==> false; Discharge ==> Stat43: not((h~[n0]) ¥Ra_GE Ra_0)
	(Stat9,Stat43*)ELEM ==> Stat44: Ra_ABS(h~[i1]) /= Ra_Rev(h~[i1])
	(h~[i1])-->Stat37(Stat17,Stat17*) ==> Stat45: Ra_ABS(Ra_Rev(h~[i1])) = Ra_ABS(h~[i1])
	(Ra_Rev(h~[i1]))-->T528(Stat44,Stat45,Stat18*) ==> Stat46: not(Ra_Rev(h~[i1]) ¥Ra_GE Ra_0)
	(Ra_0,Ra_Rev(h~[i1]))-->T478(Stat13,Stat18,Stat46*) ==> Stat47: Ra_0 ¥Ra_GT Ra_Rev(h~[i1])
	(Ra_0,Ra_Rev(h~[i1]))-->T503(Stat13,Stat18,Stat47*) ==> Stat48: Ra_Rev(Ra_Rev(h~[i1])) ¥Ra_GT Ra_Rev(Ra_0)
	(h~[i1])-->T494(Stat17*) ==> Stat49: Ra_Rev(Ra_Rev(h~[i1])) = h~[i1]
	EQUAL(Stat48,Stat49,Stat19) ==> Stat50: (h~[i1]) ¥Ra_GT Ra_0
	(h~[i1])-->T529(Stat17,Stat50*) ==> Stat51: Ra_ABS(h~[i1]) = (h~[i1])
	EQUAL(Stat9,Stat51) ==> Stat52: (h~[i1]) ¥Ra_GT eps0
	(h~[n0])-->T452(Stat17*) ==> Stat53: Ra_Rev(h~[n0]) in Ra
	(Ra_Rev(h~[n0]),Ra_0)-->T473(Stat40*) ==> Stat54: Ra_Rev(h~[n0]) ¥Ra_GE Ra_0
	(h~[i1],eps0,Ra_Rev(h~[n0]),Ra_0)-->T505(Stat17,Stat4,Stat41,Stat13,Stat52,Stat54*) ==> Stat55: (h~[i1] ¥Ra_PLUS Ra_Rev(h~[n0])) ¥Ra_GT (eps0 ¥Ra_PLUS Ra_0)
	EQUAL(Stat55,Stat21) ==> Stat56: ((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0])) ¥Ra_GT eps0
	(h~[i1],Ra_Rev(h~[n0]))-->T445(Stat17,Stat41*) ==> Stat57: ((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0])) in Ra
	((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0]),eps0,Ra_0)-->T498(Stat57,Stat4,Stat13,Stat56*) ==> ((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0])) ¥Ra_GT Ra_0
	((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0]))-->T529(Stat57*) ==> Ra_ABS((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0])) = ((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0]))
	Use_def(¥Ra_MINUS) ==> Stat58: Ra_ABS((h~[i1]) ¥Ra_MINUS (h~[n0])) = Ra_ABS((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0]))
	EQUAL(Stat56) ==> Stat59: (Ra_ABS((h~[i1]) ¥Ra_MINUS (h~[n0])) ¥Ra_GT eps0) & (Ra_ABS((h~[i1]) ¥Ra_MINUS (h~[n0])) in Ra)
	(i1,n0)-->Stat6(Stat8,Stat4*) ==> Stat60: eps0 ¥Ra_GT Ra_ABS((h~[i1]) ¥Ra_MINUS (h~[n0]))
(eps0,Ra_ABS((h~[i1]) ¥Ra_MINUS (h~[n0])),eps0)-->T498(Stat59,Stat60,Stat4,Stat20*) ==> false; Discharge ==> QED
--
Theorem 599: [All terms of a Cauchy sequence not equivalent to zero have the same sign beyond a certain point] ((F in RaCauchy) &
	(not Ra_eqseq(F,Ra0Seq))) ¥imp (EXISTS n in Za | shifted_seq(Ras_ABS(F),n) =
	if ((F~[n]) ¥Ra_GE Ra_0) then shifted_seq(F,n) else shifted_seq(Ras_Rev(F),n) end if). Proof:
Suppose_not(h) ==> Stat1: ((h in RaCauchy) & (not Ra_eqseq(h,Ra0Seq))) & Stat2: (not(EXISTS n in Za | shifted_seq(Ras_ABS(h),n) =
	if ((h~[n]) ¥Ra_GE Ra_0) then shifted_seq(h,n) else shifted_seq(Ras_Rev(h),n) end if))
	T539(*) ==> Stat3: h in RaSeq
--
-- Let the Cauchy sequence $h$ be a counterexample to our claim.
-- Then it is easily seen that $h$ cannot be equivalent to $Ra0Seq$; hence,
-- by Theorem 564, there exists a positive rational $eps0$ and an integer $n0$
-- beyond which all the components $h~[i]$ of $h$ have an absolute value greater than $eps0$
-- and all the components $h~[j], h~[i]$ of $h$ differ by less than $eps0$.
--
	h-->T564(*) ==> Stat4: (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
		(FORALL i in (Za - n) | Ra_ABS(h~[i]) ¥Ra_GT eps) &
		(FORALL i in Za, j in Za | ((i notin n) & (j notin n)) ¥imp (eps ¥Ra_GT (Ra_ABS((h~[i]) ¥Ra_MINUS (h~[j])))) ))
	(eps0,n0)-->Stat4(Stat4*) ==> Stat5: (eps0 in Ra) & (n0 in Za) & (eps0 ¥Ra_GT Ra_0) &
		Stat6: (FORALL i in (Za - n0) | Ra_ABS(h~[i]) ¥Ra_GT eps0) &
		Stat7: (FORALL i in Za, j in Za | ((i notin n0) & (j notin n0)) ¥imp (eps0 ¥Ra_GT (Ra_ABS((h~[i]) ¥Ra_MINUS (h~[j])))) )
--
-- Our initial hypothesis now yields the existence of a component, say the $i1$-th,
-- beyond the $n0$-th component, whose absolute value does not comply in sign with
-- the $n0$-th component.
--
	n0-->Stat2(Stat5*) ==> Stat8: shifted_seq(Ras_ABS(h),n0) /=
		if ((h~[n0]) ¥Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if
	(h,n0)-->T567(Stat1,Stat5*) ==> shifted_seq(h,n0) in RaCauchy
	(h,h)-->T556(Stat1,Stat1*) ==> Stat9: (Ras_Rev(h) in RaCauchy) & (Ras_ABS(h) in RaCauchy)
	(Ras_Rev(h),n0)-->T567(Stat9,Stat5*) ==> shifted_seq(Ras_Rev(h),n0) in RaCauchy
	(Ras_ABS(h),n0)-->T567(Stat9,Stat5*) ==> shifted_seq(Ras_ABS(h),n0) in RaCauchy
	T539(Stat8*) ==> Stat10: (shifted_seq(h,n0) in RaSeq) & (shifted_seq(Ras_Rev(h),n0) in RaSeq) &
		(shifted_seq(Ras_ABS(h),n0) in RaSeq) &
		((if ((h~[n0]) ¥Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if) in RaSeq)
	(shifted_seq(Ras_ABS(h),n0),if ((h~[n0]) ¥Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if)-->T542(Stat10,Stat8*) ==>
		Stat11: not(FORALL i in Za | ((shifted_seq(Ras_ABS(h),n0) in RaSeq) & ((if ((h~[n0]) ¥Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if) in RaSeq) & (((shifted_seq(Ras_ABS(h),n0))~[i]) = ((if ((h~[n0]) ¥Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if)~[i]))))
	i0-->Stat11(Stat10*) ==> Stat12: (i0 in Za) & (((shifted_seq(Ras_ABS(h),n0))~[i0]) /= (if ((h~[n0]) ¥Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if)~[i0])
	Loc_def ==> Stat13: i1 = (n0 ¥PLUS i0)
	(n0,i0)-->T283(Stat5,Stat12*) ==> (n0 ¥PLUS i0) in Za
	(n0,i0)-->T292(Stat5*) ==> (n0 ¥PLUS i0) notin n0
	(Stat13*)ELEM ==> Stat14: i1 in (Za - n0)
	i1-->Stat6(Stat14*) ==> Stat15: Ra_ABS(h~[i1]) ¥Ra_GT eps0
	Suppose ==> Stat16: Ra_ABS(h~[i1]) = if ((h~[n0]) ¥Ra_GE Ra_0) then (h~[i1]) else Ra_Rev(h~[i1]) end if
		APPLY() if_then_else(p->((h~[n0]) ¥Ra_GE Ra_0),a->shifted_seq(h,n0),b->shifted_seq(Ras_Rev(h),n0),f(x)->(x~[i0])) ==> Stat17:
			((if ((h~[n0]) ¥Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if)~[i0]) = (if ((h~[n0]) ¥Ra_GE Ra_0) then ((shifted_seq(h,n0))~[i0]) else ((shifted_seq(Ras_Rev(h),n0))~[i0]) end if)
		(h,n0,i0)-->T547(Stat3,Stat12,Stat5*) ==> ((shifted_seq(h,n0))~[i0]) = (h~[n0 ¥PLUS i0])
		T539(Stat9*) ==> Stat18: (Ras_Rev(h) in RaSeq) & (Ras_ABS(h) in RaSeq)
		(Ras_Rev(h),n0,i0)-->T547(Stat18,Stat9,Stat12,Stat5*) ==> ((shifted_seq(Ras_Rev(h),n0))~[i0]) = ((Ras_Rev(h))~[n0 ¥PLUS i0])
		(Ras_ABS(h),n0,i0)-->T547(Stat18,Stat9,Stat12,Stat5*) ==> ((shifted_seq(Ras_ABS(h),n0))~[i0]) = ((Ras_ABS(h))~[n0 ¥PLUS i0])
		EQUAL(Stat12) ==> Stat19: ((Ras_ABS(h))~[i1]) /= (if ((h~[n0]) ¥Ra_GE Ra_0) then (h~[i1]) else ((Ras_Rev(h))~[i1]) end if)
		(h,h,i1)-->T555(Stat3,Stat14*) ==> Stat20: (((Ras_ABS(h))~[i1]) = Ra_ABS(h~[i1])) & (((Ras_Rev(h))~[i1]) = Ra_Rev(h~[i1]))
	(Stat19,Stat20,Stat16*)ELEM ==> false; Discharge ==> Stat21: Ra_ABS(h~[i1]) /= if ((h~[n0]) ¥Ra_GE Ra_0) then (h~[i1]) else Ra_Rev(h~[i1]) end if
--
-- Either $h~[n0]$ is positive, or it is negative. In the first case...
--
	n0-->Stat6(Stat5*) ==> Stat22: Ra_ABS(h~[n0]) ¥Ra_GT eps0
	(h,n0)-->T540(Stat3,Stat5*) ==> Stat23: (h~[n0]) in Ra
	(h~[n0])-->T527(Stat23*) ==> Stat24: (Ra_ABS(h~[n0]) in Ra) & (Ra_ABS(h~[n0]) ¥Ra_GE Ra_0)
	(h~[n0])-->T451(Stat23,Stat23*) ==> Stat25: Ra_0 in Ra
	(Ra_ABS(h~[n0]),eps0,Ra_0)-->T498(Stat24,Stat5,Stat25,Stat22*) ==> Ra_ABS(h~[n0]) ¥Ra_GT Ra_0
	(Ra_ABS(h~[n0]),Ra_0)-->T473(Stat25*) ==> Stat26: Ra_ABS(h~[n0]) /= Ra_0
	T525(Stat25*) ==> Stat27: (FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0)))
	(h~[n0])-->Stat27(Stat23,Stat26*) ==> Stat28: (h~[n0]) /= Ra_0
	(h~[n0],Ra_0)-->T476(Stat23,Stat25,Stat28*) ==> ((h~[n0]) ¥Ra_GT Ra_0) or (Ra_0 ¥Ra_GT (h~[n0]))
	(h,i1)-->T540(Stat3,Stat14*) ==> Stat29: (h~[i1]) in Ra
	(h~[i1])-->T452(Stat29*) ==> Stat30: Ra_Rev(h~[i1]) in Ra
	T481(Stat30*) ==> Stat31: Ra_Rev(Ra_0) = Ra_0
	(eps0,eps0)-->T473(Stat31*) ==> Stat32: not(eps0 ¥Ra_GT eps0)
	eps0-->T451(Stat5,Stat5*) ==> Stat33: eps0 = (eps0 ¥Ra_PLUS Ra_0)
	Suppose ==> (h~[n0]) ¥Ra_GT Ra_0
--
-- ... we reach a contradiction as follows. Observe that $Ra_ABS(h~[n0])$ equals $h~[n0]$, and
-- Stat21 yields that $Ra_ABS(h~[i1]) /= (h~[i1])$ in this case, and hence $h~[i1]$ is negative.
-- However, this conflicts with the fact that the distance between $h~[n0]$, which is bigger
-- than $eps0$, and $h~[i1]$ is smaller than $eps0$.
--
		(h~[n0],Ra_0)-->T473(Stat28*) ==> Stat34: (h~[n0]) ¥Ra_GE Ra_0
		(h~[n0])-->T529(Stat23*) ==> Stat35: Ra_ABS(h~[n0]) = (h~[n0])
		(Stat34,Stat21*)ELEM ==> Stat36: Ra_ABS(h~[i1]) /= (h~[i1])
		(h~[i1])-->T528(Stat36,Stat29*) ==> Stat37: not((h~[i1]) ¥Ra_GE Ra_0)
		(Ra_0,h~[i1])-->T478(Stat25,Stat29,Stat37*) ==> Stat38: Ra_0 ¥Ra_GT (h~[i1])
		(Ra_0,h~[i1])-->T503(Stat38,Stat25,Stat29*) ==> Stat39: Ra_Rev(h~[i1]) ¥Ra_GT Ra_Rev(Ra_0)
		EQUAL(Stat39,Stat31) ==> Stat40: Ra_Rev(h~[i1]) ¥Ra_GT Ra_0
		EQUAL(Stat35,Stat22) ==> Stat41: (h~[n0]) ¥Ra_GT eps0
		(h~[n0],eps0)-->T473(Stat41*) ==> Stat42: (h~[n0]) ¥Ra_GE eps0
		(h~[n0],eps0,Ra_Rev(h~[i1]),Ra_0)-->T504(Stat23,Stat5,Stat30,Stat25,Stat42,Stat40*) ==>
			Stat43: ((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1])) ¥Ra_GT (eps0 ¥Ra_PLUS Ra_0)
		EQUAL(Stat43,Stat33) ==> Stat44: ((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1])) ¥Ra_GT eps0
		(h~[n0],Ra_Rev(h~[i1]))-->T445(Stat23,Stat30*) ==> Stat45: ((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1])) in Ra
		((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1]),eps0,Ra_0)-->T498(Stat44,Stat45,Stat5,Stat25*) ==> ((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1])) ¥Ra_GT Ra_0
		((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1]))-->T529(Stat45*) ==> Ra_ABS((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1])) = ((h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1]))
		Use_def(¥Ra_MINUS) ==> (h~[n0]) ¥Ra_MINUS (h~[i1]) = (h~[n0]) ¥Ra_PLUS Ra_Rev(h~[i1])
		EQUAL(Stat44) ==> Stat46: (Ra_ABS((h~[n0]) ¥Ra_MINUS (h~[i1])) in Ra) & (Ra_ABS((h~[n0]) ¥Ra_MINUS (h~[i1])) ¥Ra_GT eps0)
		(n0,i1)-->Stat7(Stat5,Stat14*) ==> Stat47: eps0 ¥Ra_GT Ra_ABS((h~[n0]) ¥Ra_MINUS (h~[i1]))
	(eps0,Ra_ABS((h~[n0]) ¥Ra_MINUS (h~[i1])),eps0)-->T498(Stat5,Stat46,Stat47,Stat32*) ==> false; Discharge ==> Stat48: Ra_0 ¥Ra_GT (h~[n0])
--
-- Hence $h~[n0]$ is negative; but then we reach again a contradiction,
-- leading to the desired overall conclusion, as follows. Observe that $Ra_ABS(h~[n0])$ equals
-- $Ra_Rev(h~[n0])$, and Stat21 yields that $Ra_ABS(h~[i1]) /= Ra_Rev(h~[i1])$ in this case,
-- and hence $h~[i1]$ is positive. However, this conflicts with the fact that the distance
-- between $h~[n0]$, which is smaller than $eps0$, and $h~[i1]$ is smaller than $eps0$.
--
	T525(Stat48*) ==> Stat49: (FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
	(h~[n0])-->Stat49(Stat23,Stat23*) ==> Stat50: Ra_ABS(Ra_Rev(h~[n0])) = Ra_ABS(h~[n0])
	(Ra_0,h~[n0])-->T503(Stat48,Stat23,Stat25*) ==> Stat51: Ra_Rev(h~[n0]) ¥Ra_GT Ra_Rev(Ra_0)
	EQUAL(Stat51,Stat31) ==> Stat52: Ra_Rev(h~[n0]) ¥Ra_GT Ra_0
	(h~[n0])-->T452(Stat23,Stat23*) ==> Stat53: Ra_Rev(h~[n0]) in Ra
	(Ra_Rev(h~[n0]))-->T529(Stat50*) ==> Ra_ABS(h~[n0]) = Ra_Rev(h~[n0])
	Suppose ==> Stat54: (h~[n0]) ¥Ra_GE Ra_0
		(Ra_0,h~[n0],Ra_0)-->T497(Stat25,Stat23,Stat48,Stat54*) ==> Ra_0 ¥Ra_GT Ra_0
--	Use_def(¥Ra_GT)(Stat54*) ==> false; Discharge ==> Stat55: not((h~[n0]) ¥Ra_GE Ra_0)
	(Ra_0,Ra_0)-->T473(Stat54*) ==> false; Discharge ==> Stat55: not((h~[n0]) ¥Ra_GE Ra_0)
	(Stat21,Stat55*)ELEM ==> Stat56: Ra_ABS(h~[i1]) /= Ra_Rev(h~[i1])
	(h~[i1])-->Stat49(Stat29,Stat29*) ==> Stat57: Ra_ABS(Ra_Rev(h~[i1])) = Ra_ABS(h~[i1])
	(Ra_Rev(h~[i1]))-->T528(Stat56,Stat57,Stat30*) ==> Stat58: not(Ra_Rev(h~[i1]) ¥Ra_GE Ra_0)
	(Ra_0,Ra_Rev(h~[i1]))-->T478(Stat25,Stat30,Stat58*) ==> Stat59: Ra_0 ¥Ra_GT Ra_Rev(h~[i1])
	(Ra_0,Ra_Rev(h~[i1]))-->T503(Stat25,Stat30,Stat59*) ==> Stat60: Ra_Rev(Ra_Rev(h~[i1])) ¥Ra_GT Ra_Rev(Ra_0)
	(h~[i1])-->T494(Stat29*) ==> Stat61: Ra_Rev(Ra_Rev(h~[i1])) = h~[i1]
	EQUAL(Stat60,Stat61,Stat31) ==> Stat62: (h~[i1]) ¥Ra_GT Ra_0
	(h~[i1])-->T529(Stat29,Stat62*) ==> Stat63: Ra_ABS(h~[i1]) = (h~[i1])
	EQUAL(Stat15,Stat63) ==> Stat64: (h~[i1]) ¥Ra_GT eps0
	(h~[n0])-->T452(Stat29*) ==> Stat65: Ra_Rev(h~[n0]) in Ra
	(Ra_Rev(h~[n0]),Ra_0)-->T473(Stat52*) ==> Stat66: Ra_Rev(h~[n0]) ¥Ra_GE Ra_0
	(h~[i1],eps0,Ra_Rev(h~[n0]),Ra_0)-->T505(Stat29,Stat5,Stat53,Stat25,Stat64,Stat66*) ==> Stat67: (h~[i1] ¥Ra_PLUS Ra_Rev(h~[n0])) ¥Ra_GT (eps0 ¥Ra_PLUS Ra_0)
	EQUAL(Stat67,Stat33) ==> Stat68: ((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0])) ¥Ra_GT eps0
	(h~[i1],Ra_Rev(h~[n0]))-->T445(Stat29,Stat53*) ==> Stat69: ((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0])) in Ra
	((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0]),eps0,Ra_0)-->T498(Stat69,Stat5,Stat25,Stat68*) ==> ((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0])) ¥Ra_GT Ra_0
	((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0]))-->T529(Stat69*) ==> Ra_ABS((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0])) = ((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0]))
	Use_def(¥Ra_MINUS) ==> Stat70: Ra_ABS((h~[i1]) ¥Ra_MINUS (h~[n0])) = Ra_ABS((h~[i1]) ¥Ra_PLUS Ra_Rev(h~[n0]))
	EQUAL(Stat68) ==> Stat71: (Ra_ABS((h~[i1]) ¥Ra_MINUS (h~[n0])) ¥Ra_GT eps0) & (Ra_ABS((h~[i1]) ¥Ra_MINUS (h~[n0])) in Ra)
	(i1,n0)-->Stat7(Stat14,Stat5*) ==> Stat72: eps0 ¥Ra_GT Ra_ABS((h~[i1]) ¥Ra_MINUS (h~[n0]))
(eps0,Ra_ABS((h~[i1]) ¥Ra_MINUS (h~[n0])),eps0)-->T498(Stat71,Stat72,Stat5,Stat32*) ==> false; Discharge ==> QED
--
--
--
Theorem 600: [A rational Cauchy sequence is equivalent to zero iff both it and its additive inverse are equivalent to its absolute value] (F in RaCauchy) ¥imp (Ra_eqseq(F,Ra0Seq) ¥eq (Ra_eqseq(Ras_ABS(F),F) & Ra_eqseq(Ras_ABS(F),Ras_Rev(F)))). Proof:
Suppose_not(h) ==> AUTO
--
-- Let the Cauchy sequence $h$ be a counterexample to our claim, so that
-- $h$ and its pointwise negative and its pointwise absolute values are
-- sequences of rational numbers.
--
	T545(*) ==> Stat1: (Ra0Seq in RaCauchy) & (h in RaCauchy)
	(h,h)-->T556(Stat1*) ==> Stat2: (Ras_ABS(h) in RaCauchy) & (Ras_Rev(h) in RaCauchy)
	T539(Stat1*) ==> Stat3: (Ras_ABS(h) in RaSeq) & (Ras_Rev(h) in RaSeq) & (Ra0Seq in RaSeq) & (h in RaSeq)
	h-->T546(Stat3*) ==> Stat4: (domain(h) = Za) & Svm(h) & (range(h) ¥incin Ra) & Ra_eqseq(h,h)
--
-- Then it is easily seen that $h$ cannot be equivalent to $Ra0Seq$.
--
	Suppose ==> Ra_eqseq(h,Ra0Seq)
		ELEM ==> Stat5: not((Ra_eqseq(Ras_ABS(h),h) & Ra_eqseq(Ras_ABS(h),Ras_Rev(h))))
		h-->T597(*) ==> Ra_eqseq(Ras_ABS(h),Ra0Seq) & Ra_eqseq(Ras_Rev(h),Ra0Seq)
		Ra0Seq-->T546(*) ==> Ra_eqseq(Ra0Seq,Ra0Seq)
		(h,Ra0Seq,Ra0Seq)-->T553(*) ==> Ra_eqseq(Ra0Seq,h)
		(Ras_ABS(h),Ra0Seq,h)-->T553(*) ==> Stat6: Ra_eqseq(h,Ras_ABS(h))
		(h,h,Ras_ABS(h))-->T553(Stat3,Stat4,Stat6,Stat5*) ==> (not Ra_eqseq(Ras_ABS(h),Ras_Rev(h)))
		(Ras_ABS(h),Ra0Seq,Ra0Seq)-->T553(Stat1*) ==> Ra_eqseq(Ra0Seq,Ras_ABS(h))
	(Ras_Rev(h),Ra0Seq,Ras_ABS(h))-->T553(Stat1*) ==> false; Discharge ==> Stat7: (h in RaCauchy) & (not Ra_eqseq(h,Ra0Seq)) & Ra_eqseq(Ras_ABS(h),h) & Ra_eqseq(Ras_ABS(h),Ras_Rev(h))
--
-- Hence it must be the reverse implication which fails.
-- By Theorem 564 there exists a positive rational $eps0$ and an integer $n0$
-- beyond which all the components $h~[i]$ of $h$ have an absolute value greater than $eps0$
-- and all the components $h~[j], h~[i]$ of $h$ differ by less than $eps0$.
-- By the transitivity of equivalence between
-- infinite rational sequences, we have that $shifted_seq(Ras_Rev(h),n0)$ and $shifted_seq(h,n0)$
-- are equivalent; therefore the set of subscripts for which the distance between the
-- corresponding components of these two sequences exceeds $eps0 ¥Ra_PLUS eps0$ is finite.
--
	h-->T564(*) ==> Stat8: (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
		(FORALL i in (Za - n) | Ra_ABS(h~[i]) ¥Ra_GT eps) &
		(FORALL i in Za, j in Za | ((i notin n) & (j notin n)) ¥imp (eps ¥Ra_GT (Ra_ABS((h~[i]) ¥Ra_MINUS (h~[j])))) ))
	(eps0,n0)-->Stat8(Stat8*) ==> Stat9: (eps0 in Ra) & (n0 in Za) & (eps0 ¥Ra_GT Ra_0) &
		Stat10: (FORALL i in (Za - n0) | Ra_ABS(h~[i]) ¥Ra_GT eps0)
	(h,n0)-->T567(Stat1,Stat9*) ==> Stat11: (shifted_seq(h,n0) in RaCauchy) & Ra_eqseq(h,shifted_seq(h,n0))
	(Ras_Rev(h),n0)-->T567(Stat2,Stat9*) ==> Stat12: (shifted_seq(Ras_Rev(h),n0) in RaCauchy) & Ra_eqseq(Ras_Rev(h),shifted_seq(Ras_Rev(h),n0))
	T539(Stat7*) ==> Stat13: (shifted_seq(h,n0) in RaSeq) & (shifted_seq(Ras_Rev(h),n0) in RaSeq)
	(Ras_ABS(h),h,shifted_seq(h,n0))-->T553(Stat7,Stat11,Stat3,Stat13*) ==> Stat14: Ra_eqseq(shifted_seq(h,n0),Ras_ABS(h))
	(Ras_ABS(h),Ras_Rev(h),shifted_seq(Ras_Rev(h),n0))-->T553(Stat7,Stat12,Stat3,Stat13*) ==> Stat15: Ra_eqseq(shifted_seq(Ras_Rev(h),n0),Ras_ABS(h))
	(Ras_ABS(h))-->T546(Stat3*) ==> Stat16: Ra_eqseq(Ras_ABS(h),Ras_ABS(h))
	(shifted_seq(Ras_Rev(h),n0),Ras_ABS(h),Ras_ABS(h))-->T553(Stat15,Stat16,Stat13,Stat3*) ==> Stat17: Ra_eqseq(Ras_ABS(h),shifted_seq(Ras_Rev(h),n0))
	(shifted_seq(h,n0),Ras_ABS(h),shifted_seq(Ras_Rev(h),n0))-->T553(Stat14,Stat17,Stat13,Stat3*) ==> Stat18: Ra_eqseq(shifted_seq(Ras_Rev(h),n0),shifted_seq(h,n0))
	(shifted_seq(Ras_Rev(h),n0),shifted_seq(h,n0))-->T541(Stat13,Stat18*) ==> Stat19: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp Finite({x : x in Za | Ra_ABS(((shifted_seq(Ras_Rev(h),n0))~[x]) ¥Ra_MINUS ((shifted_seq(h,n0))~[x])) ¥Ra_GT eps}))
	Ra_0-->T451(Stat18*) ==> Stat20: (Ra_0 in Ra) & (Ra_0 = (Ra_0 ¥Ra_PLUS Ra_0))
	(eps0,eps0)-->T445(Stat9,Stat9*)==> Stat21: (eps0 ¥Ra_PLUS eps0) in Ra
	(eps0,Ra_0)-->T473(Stat9,Stat9*) ==> Stat22: eps0 ¥Ra_GE Ra_0
	(eps0,Ra_0,eps0,Ra_0)-->T504(Stat9,Stat20,Stat22*) ==> (eps0 ¥Ra_PLUS eps0) ¥Ra_GT (Ra_0 ¥Ra_PLUS Ra_0)
	EQUAL(Stat20*) ==> Stat23: (eps0 ¥Ra_PLUS eps0) ¥Ra_GT Ra_0
	(eps0 ¥Ra_PLUS eps0)-->Stat19(Stat21,Stat23*) ==> Finite({x : x in Za | Ra_ABS(((shifted_seq(Ras_Rev(h),n0))~[x]) ¥Ra_MINUS ((shifted_seq(h,n0))~[x])) ¥Ra_GT (eps0 ¥Ra_PLUS eps0)})
--
-- However, it is easy to see that $(shifted_seq(h,n0))~[i]$ and
-- $(shifted_seq(Ras_Rev(h),n0))~[i]$ have, for all $i in Za$, opposite signs and the same
-- absolute value, so that one of the two equals $Ra_ABS((shifted_seq(h,n0))~[i])$ and the other
-- equals the negative of this value; accordingly, the distance between them is twice
-- $Ra_ABS((shifted_seq(h,n0))~[i])$, a value exceeding $eps0 ¥Ra_PLUS eps0$. Hence the set
--	${x : x in Za | Ra_ABS(((shifted_seq(Ras_Rev(h),n0))~[x]) ¥Ra_MINUS ((shifted_seq(h,n0))~[x])) ¥Ra_GT (eps0 ¥Ra_PLUS eps0)}$,
-- which includes $Za$, cannot be finite, a contradiction leading to the desired overall
-- conclusion of this proof.
--
	Suppose ==> Stat24: not({i: i in Za | true} ¥incin {i : i in Za | Ra_ABS(((shifted_seq(Ras_Rev(h),n0))~[i]) ¥Ra_MINUS ((shifted_seq(h,n0))~[i])) ¥Ra_GT (eps0 ¥Ra_PLUS eps0)})
		i1-->Stat24(Stat24*) ==> Stat25: (i1 in Za) & (not (Ra_ABS(((shifted_seq(Ras_Rev(h),n0))~[i1]) ¥Ra_MINUS ((shifted_seq(h,n0))~[i1])) ¥Ra_GT (eps0 ¥Ra_PLUS eps0)))
		Use_def(shifted_seq)(Stat24*) ==> (not (Ra_ABS(((Ras_Rev(h) @ Shift(n0))~[i1]) ¥Ra_MINUS ((h @ Shift(n0))~[i1])) ¥Ra_GT (eps0 ¥Ra_PLUS eps0)))
		(n0,i1)-->T339(Stat9,Stat25*) ==> Stat26: Svm(Shift(n0)) & (domain(Shift(n0)) = Za) & (range(Shift(n0)) ¥incin Za) & ((Shift(n0)~[i1]) = (n0 ¥PLUS i1))
		(h,Shift(n0),i1)-->T129(Stat4,Stat26,Stat25*) ==> ((h @ Shift(n0))~[i1]) = (h~[Shift(n0)~[i1]])
		(Ras_Rev(h))-->T546(Stat3,Stat3*) ==> Stat27: (domain(Ras_Rev(h)) = Za) & Svm(Ras_Rev(h)) & (range(Ras_Rev(h)) ¥incin Ra) & Ra_eqseq(Ras_Rev(h),Ras_Rev(h))
		(Ras_Rev(h),Shift(n0),i1)-->T129(Stat27,Stat26,Stat25*) ==> ((Ras_Rev(h) @ Shift(n0))~[i1]) = (Ras_Rev(h)~[Shift(n0)~[i1]])
		(n0,i1)-->T283(Stat9,Stat25*) ==> Stat28: (n0 ¥PLUS i1) in Za
		(h,h,n0 ¥PLUS i1)-->T555(Stat3,Stat28*) ==> (Ras_Rev(h)~[n0 ¥PLUS i1]) = Ra_Rev(h~[n0 ¥PLUS i1])
		EQUAL(Stat25*) ==> Stat29: (not (Ra_ABS(Ra_Rev(h~[n0 ¥PLUS i1]) ¥Ra_MINUS (h~[n0 ¥PLUS i1])) ¥Ra_GT (eps0 ¥Ra_PLUS eps0)))
		(h,n0 ¥PLUS i1)-->T540(Stat3,Stat28*) ==> Stat30: (h~[n0 ¥PLUS i1]) in Ra
		(h~[n0 ¥PLUS i1])-->T452(Stat29*) ==> Stat31: Ra_Rev(h~[n0 ¥PLUS i1]) in Ra
		T525(Stat29*) ==> Stat32: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
--
-- Entering into greater detail, let us observe that for each $i1 in Za$
--	$Ra_ABS(Ra_Rev(h~[n0 ¥PLUS i1]) ¥Ra_MINUS (h~[n0 ¥PLUS i1]))$
-- equals the absolute value of twice $Ra_ABS(h~[n0 ¥PLUS i1])$, independently of
-- whether $Ra_ABS(h~[n0 ¥PLUS i1])$ equals $h~[n0 ¥PLUS i1]$ or it equals
-- the opposite of $h~[n0 ¥PLUS i1]$. Since $Ra_ABS(h~[n0 ¥PLUS i1])$ is nonnegative,
-- the same holds for its double, and therefore the absolute value of twice
-- $Ra_ABS(h~[n0 ¥PLUS i1])$ equals twice $Ra_ABS(h~[n0 ¥PLUS i1])$. This value
-- must be more than twice bigger than $eps0$.
--
		Suppose ==> Ra_ABS(Ra_Rev(h~[n0 ¥PLUS i1]) ¥Ra_MINUS (h~[n0 ¥PLUS i1])) /= Ra_ABS(Ra_ABS(h~[n0 ¥PLUS i1]) ¥Ra_PLUS Ra_ABS(h~[n0 ¥PLUS i1]))
			(h~[n0 ¥PLUS i1])-->Stat32(Stat32,Stat32*) ==> (Ra_ABS(h~[n0 ¥PLUS i1]) = (h~[n0 ¥PLUS i1])) or (Ra_ABS(h~[n0 ¥PLUS i1]) = Ra_Rev(h~[n0 ¥PLUS i1]))
			Suppose ==> Ra_ABS(h~[n0 ¥PLUS i1]) = (h~[n0 ¥PLUS i1])
				(h~[n0 ¥PLUS i1],Ra_Rev(h~[n0 ¥PLUS i1]))-->T537(Stat30,Stat31*) ==>
					Ra_ABS(Ra_Rev(h~[n0 ¥PLUS i1]) ¥Ra_MINUS (h~[n0 ¥PLUS i1])) = Ra_ABS((h~[n0 ¥PLUS i1]) ¥Ra_MINUS Ra_Rev(h~[n0 ¥PLUS i1]))
				Use_def(¥Ra_MINUS)(Stat32*) ==> Ra_ABS((h~[n0 ¥PLUS i1]) ¥Ra_MINUS Ra_Rev(h~[n0 ¥PLUS i1])) = Ra_ABS((h~[n0 ¥PLUS i1]) ¥Ra_PLUS Ra_Rev(Ra_Rev(h~[n0 ¥PLUS i1])))
				(h~[n0 ¥PLUS i1])-->T494(Stat30,Stat30*) ==> Ra_Rev(Ra_Rev(h~[n0 ¥PLUS i1])) = (h~[n0 ¥PLUS i1])
			EQUAL(Stat32*) ==> false; Discharge ==> Ra_ABS(h~[n0 ¥PLUS i1]) = Ra_Rev(h~[n0 ¥PLUS i1])
			Use_def(¥Ra_MINUS)(Stat32*) ==> (Ra_Rev(h~[n0 ¥PLUS i1]) ¥Ra_MINUS (h~[n0 ¥PLUS i1])) = (Ra_Rev(h~[n0 ¥PLUS i1]) ¥Ra_PLUS Ra_Rev(h~[n0 ¥PLUS i1]))
		EQUAL(Stat32*) ==> false; Discharge ==> Ra_ABS(Ra_Rev(h~[n0 ¥PLUS i1]) ¥Ra_MINUS (h~[n0 ¥PLUS i1])) = Ra_ABS(Ra_ABS(h~[n0 ¥PLUS i1]) ¥Ra_PLUS Ra_ABS(h~[n0 ¥PLUS i1]))
		(h~[n0 ¥PLUS i1])-->T527(Stat30,Stat30*) ==> Stat33: (Ra_ABS(h~[n0 ¥PLUS i1]) in Ra) & (Ra_ABS(h~[n0 ¥PLUS i1]) ¥Ra_GE Ra_0)
		(Ra_ABS(h~[n0 ¥PLUS i1]),Ra_0,Ra_ABS(h~[n0 ¥PLUS i1]),Ra_0)-->T493(Stat33,Stat20*) ==> Stat34: (Ra_ABS(h~[n0 ¥PLUS i1]) ¥Ra_PLUS Ra_ABS(h~[n0 ¥PLUS i1])) ¥Ra_GE (Ra_0 ¥Ra_PLUS Ra_0)
		EQUAL(Stat20,Stat34*) ==> (Ra_ABS(h~[n0 ¥PLUS i1]) ¥Ra_PLUS Ra_ABS(h~[n0 ¥PLUS i1])) ¥Ra_GE Ra_0
		(Ra_ABS(h~[n0 ¥PLUS i1]),Ra_ABS(h~[n0 ¥PLUS i1]))-->T445(Stat33*) ==> (Ra_ABS(h~[n0 ¥PLUS i1]) ¥Ra_PLUS Ra_ABS(h~[n0 ¥PLUS i1])) in Ra
		(Ra_ABS(h~[n0 ¥PLUS i1]) ¥Ra_PLUS Ra_ABS(h~[n0 ¥PLUS i1]))-->T528(Stat34*) ==> Ra_ABS(Ra_ABS(h~[n0 ¥PLUS i1]) ¥Ra_PLUS Ra_ABS(h~[n0 ¥PLUS i1])) = (Ra_ABS(h~[n0 ¥PLUS i1]) ¥Ra_PLUS Ra_ABS(h~[n0 ¥PLUS i1]))
		EQUAL(Stat29*) ==> Stat35: (not ((Ra_ABS(h~[n0 ¥PLUS i1]) ¥Ra_PLUS Ra_ABS(h~[n0 ¥PLUS i1])) ¥Ra_GT (eps0 ¥Ra_PLUS eps0)))
		(n0,i1)-->T292(Stat9*) ==> Stat36: (n0 ¥PLUS i1) notin n0
		(n0 ¥PLUS i1)-->Stat10(Stat28,Stat36*) ==> Stat37: Ra_ABS(h~[n0 ¥PLUS i1]) ¥Ra_GT eps0
		(Ra_ABS(h~[n0 ¥PLUS i1]),eps0)-->T473(Stat37*) ==> Stat38: Ra_ABS(h~[n0 ¥PLUS i1]) ¥Ra_GE eps0
	(Ra_ABS(h~[n0 ¥PLUS i1]),eps0,Ra_ABS(h~[n0 ¥PLUS i1]),eps0)-->T504(Stat37,Stat38,Stat9,Stat35,Stat33*) ==> false; Discharge ==> AUTO
	T206(Stat23*) ==> (not Finite(Za))
	({i : i in Za | Ra_ABS(((shifted_seq(Ras_Rev(h),n0))~[i]) ¥Ra_MINUS ((shifted_seq(h,n0))~[i])) ¥Ra_GT (eps0 ¥Ra_PLUS eps0)},Za)-->T189(Stat23*) ==> false; Discharge ==> QED
--
--
--
Theorem 601: [One of a Cauchy sequence and its additive inverse is always equivalent to a non-negative sequence] ((F in RaCauchy) & (not Ra_eqseq(F,Ra0Seq))) ¥imp
	(EXISTS n in Za | ((shifted_seq(Ras_ABS(F),n) = shifted_seq(F,n)) & Ra_eqseq(Ras_ABS(F),F)) or
			((shifted_seq(Ras_ABS(F),n) = shifted_seq(Ras_Rev(F),n)) & Ra_eqseq(Ras_ABS(F),Ras_Rev(F)))). Proof:
Suppose_not(h) ==> AUTO
--
-- Let the Cauchy sequence $h$ be a counterexample to our claim, so that
-- $h$ and its pointwise negative and its pointwise absolute values are
-- sequences of rational numbers.
--
	(h,h)-->T556(*) ==> Stat1: (h in RaCauchy) & (Ras_ABS(h) in RaCauchy) & (Ras_Rev(h) in RaCauchy)
	T539(*) ==> Stat2: (Ras_ABS(h) in RaSeq) & (Ras_Rev(h) in RaSeq) & (h in RaSeq)
	h-->T546(Stat2*) ==> Stat3: (domain(h) = Za) & Svm(h) & (range(h) ¥incin Ra) & Ra_eqseq(h,h)
	(Ras_Rev(h))-->T546(Stat2,Stat2*) ==> Stat4: (domain(Ras_Rev(h)) = Za) & Svm(Ras_Rev(h)) & (range(Ras_Rev(h)) ¥incin Ra) & Ra_eqseq(Ras_Rev(h),Ras_Rev(h))
	ELEM ==> Stat5: (not(EXISTS n in Za | ((shifted_seq(Ras_ABS(h),n) = shifted_seq(h,n)) & Ra_eqseq(Ras_ABS(h),h)) or
			((shifted_seq(Ras_ABS(h),n) = shifted_seq(Ras_Rev(h),n)) & Ra_eqseq(Ras_ABS(h),Ras_Rev(h)))))
--
-- By Theorem 599, for a suitably chosen unsigned integer $n1$ we have either
--	$shifted_seq(Ras_ABS(F),n1) = shifted_seq(F,n1)$,
-- hence $Ra_eqseq(shifted_seq(Ras_ABS(F),n1),shifted_seq(F,n1))$,
-- or
--	$shifted_seq(Ras_ABS(F),n1) = shifted_seq(Ras_Rev(F),n1)$,
-- and hence $Ra_eqseq(shifted_seq(Ras_ABS(F),n1),shifted_seq(Ras_Rev(F),n1))$.
--
	h-->T599(*) ==> Stat6:  (EXISTS n in Za | shifted_seq(Ras_ABS(h),n) =
			if ((h~[n]) ¥Ra_GE Ra_0) then shifted_seq(h,n) else shifted_seq(Ras_Rev(h),n) end if)
	n1-->Stat6(Stat6*) ==> Stat7: (n1 in Za) & ((shifted_seq(Ras_ABS(h),n1) = shifted_seq(h,n1)) or
			(shifted_seq(Ras_ABS(h),n1) = shifted_seq(Ras_Rev(h),n1)))
	(h,n1)-->T567(Stat7,Stat1*) ==> Stat8:
			(shifted_seq(h,n1) in RaCauchy) & Ra_eqseq(h,shifted_seq(h,n1))
	(Ras_ABS(h),n1)-->T567(Stat7,Stat1*) ==> Stat9:
			(shifted_seq(Ras_ABS(h),n1) in RaCauchy) & Ra_eqseq(Ras_ABS(h),shifted_seq(Ras_ABS(h),n1))
	T539(Stat8*) ==> Stat10: (shifted_seq(h,n1) in RaSeq) & (shifted_seq(Ras_ABS(h),n1) in RaSeq)
	(shifted_seq(Ras_ABS(h),n1))-->T546(Stat10*) ==> Stat11: Ra_eqseq(shifted_seq(Ras_ABS(h),n1),shifted_seq(Ras_ABS(h),n1))
--
-- It is easily seen that $Ra_eqseq(Ras_ABS(h),h)$ in the first of these cases,
-- and $Ra_eqseq(Ras_ABS(h),Ras_Rev(h))$ in the second,
-- a contradiction proving the first claim of our theorem.
--
	Suppose ==> shifted_seq(Ras_ABS(h),n1) = shifted_seq(h,n1)
		EQUAL(Stat11*) ==> Stat12: Ra_eqseq(shifted_seq(h,n1),shifted_seq(Ras_ABS(h),n1))
		(h,shifted_seq(h,n1),shifted_seq(Ras_ABS(h),n1))-->T553(Stat8,Stat12,Stat2,Stat10*) ==> Stat13: Ra_eqseq(shifted_seq(Ras_ABS(h),n1),h)
		(Ras_ABS(h),shifted_seq(Ras_ABS(h),n1),h)-->T553(Stat9,Stat13,Stat10,Stat2*) ==> Stat14: Ra_eqseq(h,Ras_ABS(h))
		(h,h,Ras_ABS(h))-->T553(Stat3,Stat14,Stat2,Stat5*) ==> Ra_eqseq(Ras_ABS(h),h)
	n1-->Stat5(Stat7*) ==> false; Discharge ==> shifted_seq(Ras_ABS(h),n1) = shifted_seq(Ras_Rev(h),n1)
	EQUAL(Stat11*) ==> Stat15: Ra_eqseq(shifted_seq(Ras_Rev(h),n1),shifted_seq(Ras_ABS(h),n1))
	(Ras_Rev(h),n1)-->T567(Stat7,Stat1*) ==> Stat16:
		(shifted_seq(Ras_Rev(h),n1) in RaCauchy) & Ra_eqseq(Ras_Rev(h),shifted_seq(Ras_Rev(h),n1))
	T539(Stat16*) ==> Stat17: shifted_seq(Ras_Rev(h),n1) in RaSeq
	(Ras_Rev(h),shifted_seq(Ras_Rev(h),n1),shifted_seq(Ras_ABS(h),n1))-->T553(Stat16,Stat15,Stat2,Stat17,Stat10*) ==>
		Stat18: Ra_eqseq(shifted_seq(Ras_ABS(h),n1),Ras_Rev(h))
	(Ras_ABS(h),shifted_seq(Ras_ABS(h),n1),Ras_Rev(h))-->T553(Stat9,Stat18,Stat10,Stat2*) ==> Stat19: Ra_eqseq(Ras_Rev(h),Ras_ABS(h))
	(Ras_Rev(h),Ras_Rev(h),Ras_ABS(h))-->T553(Stat4,Stat19,Stat2,Stat5*) ==> Ra_eqseq(Ras_ABS(h),Ras_Rev(h))
	n1-->Stat5(Stat7*) ==> false; Discharge ==> QED
--
--
--
Theorem 602: [One of a Cauchy sequence $F$ and its additive inverse is always equivalent to a non-negative sequence, and both are equivalent to non-negative sequences only if $F$ is equivalent to zero] (F in RaCauchy) ¥imp ((Ra_eqseq(Ras_ABS(F),F) or Ra_eqseq(Ras_ABS(F),Ras_Rev(F))) & (((Ra_eqseq(Ras_ABS(F),F) & Ra_eqseq(Ras_ABS(F),Ras_Rev(F)))) ¥imp Ra_eqseq(F,Ra0Seq))). Proof:
Suppose_not(h) ==> AUTO
--
-- Let the Cauchy sequence $h$ be a counterexample to our claim, so that
-- $h$ and its pointwise negative and its pointwise absolute values are
-- sequences of rational numbers. Thanks to Theorem 600, we know that it
-- is our first assertion that fails. But then, by Theorem 601, we get a contradiction.
--
	(h,h)-->T556(*) ==> Stat1: (Ras_ABS(h) in RaCauchy) & (Ras_Rev(h) in RaCauchy)
	T539(*) ==> Stat2: (Ras_ABS(h) in RaSeq) & (Ras_Rev(h) in RaSeq) & (h in RaSeq)
	h-->T546(Stat2*) ==> Stat3: (domain(h) = Za) & Svm(h) & (range(h) ¥incin Ra) & Ra_eqseq(h,h)
	(Ras_Rev(h))-->T546(Stat2,Stat2*) ==> Stat4: (domain(Ras_Rev(h)) = Za) & Svm(Ras_Rev(h)) & (range(Ras_Rev(h)) ¥incin Ra) & Ra_eqseq(Ras_Rev(h),Ras_Rev(h))
	h-->T600(*) ==> Stat5: (not(Ra_eqseq(Ras_ABS(h),h) or Ra_eqseq(Ras_ABS(h),Ras_Rev(h)))) & (h in RaCauchy) & (not Ra_eqseq(h,Ra0Seq))
	h-->T601(Stat5*) ==> Stat6: (EXISTS n in Za | ((shifted_seq(Ras_ABS(h),n) = shifted_seq(h,n)) & Ra_eqseq(Ras_ABS(h),h)) or
			((shifted_seq(Ras_ABS(h),n) = shifted_seq(Ras_Rev(h),n)) & Ra_eqseq(Ras_ABS(h),Ras_Rev(h))))
	n-->Stat6(Stat5*) ==> false; Discharge ==> QED
--
--
--
Theorem 603: [The unit Cauchy sequences $Ra0Seq,Ra1Seq$ differ from one another] (not Ra_eqseq(Ra0Seq,Ra1Seq)). Proof:
Suppose_not ==> AUTO
	T545(Stat1*) ==> Stat1: {Ra0Seq,Ra1Seq} ¥incin RaCauchy
	T539(Stat1*) ==> (Ra0Seq in RaSeq) & (Ra1Seq in RaSeq)
	(Ra0Seq,Ra1Seq)-->T541(*) ==> Stat2: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in Za | Ra_ABS((Ra0Seq~[x]) ¥Ra_MINUS (Ra1Seq~[x])) ¥Ra_GT eps}))
	Ra_1-->T451 ==> (Ra_1 in Ra) & (Ra_0 in Ra) & (Ra_1 = (Ra_1 ¥Ra_PLUS Ra_0))
	T481 ==> (Ra_1 ¥Ra_GT Ra_0) & (Ra_Rev(Ra_0) = Ra_0) & (Ra_1 = (Ra_1 ¥Ra_PLUS Ra_0))
	Ra_1-->T522 ==> Stat3: (EXISTS e in Ra, e0 in Ra | (Ra_1 ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e ¥Ra_GT Ra_0) & (Ra_1 ¥Ra_GT (e ¥Ra_PLUS e0)))
	(eps0,e0)-->Stat3 ==> (eps0 in Ra) & (Ra_1 ¥Ra_GT eps0) & (eps0 ¥Ra_GT Ra_0)
	eps0-->Stat2(Stat2*) ==> Stat4: Finite({x : x in Za | Ra_ABS((Ra0Seq~[x]) ¥Ra_MINUS (Ra1Seq~[x])) ¥Ra_GT eps0})
	T206(Stat4) ==> not Finite({x : x in Za})
	EQUAL(Stat4) ==> Stat5: {x : x in Za | Ra_ABS((Ra0Seq~[x]) ¥Ra_MINUS (Ra1Seq~[x])) ¥Ra_GT eps0} /= {x : x in Za}
	x-->Stat5(Stat5*) ==> (x in Za) & (not(Ra_ABS((Ra0Seq~[x]) ¥Ra_MINUS (Ra1Seq~[x])) ¥Ra_GT eps0))
	x-->T548 ==> ((Ra0Seq~[x]) = Ra_0) & ((Ra1Seq~[x]) = Ra_1)
	(Ra_0,Ra_1)-->T537(Stat2*) ==> Ra_ABS(Ra_0 ¥Ra_MINUS Ra_1) = Ra_ABS(Ra_1 ¥Ra_MINUS Ra_0)
	EQUAL(Stat5) ==> not(Ra_ABS(Ra_1 ¥Ra_MINUS Ra_0) ¥Ra_GT eps0)
	Use_def(¥Ra_MINUS) ==> not(Ra_ABS(Ra_1 ¥Ra_PLUS Ra_Rev(Ra_0)) ¥Ra_GT eps0)
        T465(Stat6) ==> Stat6: Ra_is_nonneg(Ra_1)
        T525(Stat6) ==> Stat7: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
        Ra_1-->Stat7 ==> Ra_ABS(Ra_1) = Ra_1
	EQUAL(Stat2) ==> not(Ra_1 ¥Ra_GT eps0)
(Stat3*)Discharge ==> QED
--
--
--
Theorem 604: [A rational sequence F and its additive inverse have the same absolute value] (F in RaSeq) ¥imp (Ras_ABS(Ras_Rev(F)) = Ras_ABS(F)). Proof:
	Suppose_not(f) ==>AUTO
	(Ras_ABS(Ras_Rev(f)),Ras_ABS(f))-->T542 ==> Stat1: AUTO
	n-->Stat1 ==> AUTO
    (f,f,n)-->T555 ==> (Ras_Rev(f) in RaSeq) & (Ras_ABS(f) in RaSeq) & (f~[n] in Ra) & (Ras_Rev(f)~[n] = Ra_Rev(f~[n])) & (Ras_ABS(f)~[n] = Ra_ABS(f~[n]))
    (Ras_Rev(f),Ras_Rev(f),n)-->T555 ==> (Ras_ABS(Ras_Rev(f)) in RaSeq) & (Ras_ABS(Ras_Rev(f))~[n] = Ra_ABS(Ras_Rev(f)~[n]))
    EQUAL ==> Ra_ABS(Ra_Rev(f~[n])) /= Ra_ABS(f~[n])
    T525 ==> Stat2: (FORALL x | (x in Ra) ¥imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
	(f~[n])-->Stat2 ==> false; Discharge ==> QED
--
--
-- It is easily seen that the zero and unit rational sequences play their proper algebraic roles.
--
Theorem 605: (F in RaSeq) ¥imp (((F ¥Ras_PLUS Ra0Seq) = F) & ((F ¥Ras_TIMES Ra1Seq) = F)). Proof:
    Suppose_not(f) ==> Stat1: (f in RaSeq) & (((f ¥Ras_PLUS Ra0Seq) /= f) or ((f ¥Ras_TIMES Ra1Seq) /= f))
--
-- Indeed, if we assume the contrary, either the zero rational sequence does not behave
-- as additive unit element among rational sequences, or the unit rational does not
-- behave as multiplicative unit element. Either alternative will lead to a contradiction,
-- and the two proofs will closely resemble each other.
--
	Use_def(RaSeq) ==> Stat2: f in {f ¥incin (Za ¥PROD Ra) | (domain(f) = Za) & Svm(f)}
	()-->Stat2 ==> (domain(f) = Za) & Svm(f)
	f-->T72 ==> f = {[i,f~[i]]: i in domain(f)}
	T545 ==> {Ra0Seq,Ra1Seq} ¥incin RaCauchy
	T539(*) ==> (Ra0Seq in RaSeq) & (Ra1Seq in RaSeq)
--
-- Assume first that $Ra0Seq$ does not behave as additive unit element.
--
        Suppose ==> Stat3: (f ¥Ras_PLUS Ra0Seq) /= f
--
-- By the pointwise definition of $¥Ras_PLUS$, the sequence $f ¥Ras_PLUS Ra0Seq$ associates
-- the rational value $(f~[u]) ¥Ra_PLUS (Ra0Seq~[u])$ with each unsigned integer $u$.
--
            (f,Ra0Seq)-->T554 ==> (f ¥Ras_PLUS Ra0Seq) = {[u,((f~[u]) ¥Ra_PLUS (Ra0Seq~[u]))]: u in Za}
--
-- On the other hand, $Ra0Seq~[u]$ has value $Ra_0$ for all unsigned integers $u$; therefore,
-- since $Ra_0$ behaves as additive unit element among rational numbers, $(f~[u]) ¥Ra_PLUS (Ra0Seq~[u])$
-- always carries the value $f~[u]$. Accordingly the sequence $f ¥Ras_PLUS Ra0Seq$, whose values coincide
-- with those of $f$ over the common domain $Za$, must coincide with $f$.
--
            d-->Stat3 ==> (d in {[u,((f~[u]) ¥Ra_PLUS (Ra0Seq~[u]))]: u in Za}) ¥eq (d notin f)
            Suppose ==> Stat4: (d notin {[i,f~[i]]: i in domain(f)}) & Stat5: (d in {[u,((f~[u]) ¥Ra_PLUS (Ra0Seq~[u]))]: u in Za})
                i0-->Stat5 ==> Stat6: (i0 in Za) & (d = [i0,((f~[i0]) ¥Ra_PLUS (Ra0Seq~[i0]))])
                i0-->T548 ==> (Ra0Seq~[i0]) = Ra_0
                (f,i0)-->T540(Stat1,Stat6*) ==> (f~[i0]) in Ra
                (f~[i0])-->T451 ==> ((f~[i0]) ¥Ra_PLUS Ra_0) = (f~[i0])
                EQUAL ==> d = [i0,f~[i0]]
            i0-->Stat4 ==> false; Discharge ==> Stat7: (d in {[i,f~[i]]: i in domain(f)}) & (d notin {[u,((f~[u]) ¥Ra_PLUS (Ra0Seq~[u]))]: u in Za})
            (i1,i1)-->Stat7 ==> Stat8: (d = [i1,f~[i1]]) & (i1 in Za) & (d /= [i1,((f~[i1]) ¥Ra_PLUS (Ra0Seq~[i1]))])
            i1-->T548 ==> (Ra0Seq~[i1]) = Ra_0
            (f,i1)-->T540(Stat1,Stat8*) ==> (f~[i1]) in Ra
            (f~[i1])-->T451 ==> ((f~[i1]) ¥Ra_PLUS Ra_0) = (f~[i1])
        EQUAL ==> false; Discharge ==> Stat9: (f ¥Ras_TIMES Ra1Seq) /= f
--
-- We have drawn a contradiction from the assumption that $Ra0Seq$ does not behave as additive unit element;
-- hence we must now reason under the assumption that $Ra1Seq$ does not behave as additive unit element.
-- By the pointwise definition of $¥Ras_TIMES$, the sequence $f ¥Ras_TIMES Ra1Seq$ associates
-- the rational value $(f~[u]) ¥Ra_TIMES (Ra0Seq~[u])$ with each unsigned integer $u$.
--
        (f,Ra1Seq)-->T554 ==> (f ¥Ras_TIMES Ra1Seq) = {[u,((f~[u]) ¥Ra_TIMES (Ra1Seq~[u]))]: u in Za}
        Use_def(Ra1Seq) ==> Ra1Seq = Za ¥PROD {Ra_1}
        Use_def(¥PROD) ==> Ra1Seq = {[x,y]: x in Za, y in {Ra_1}}
        Suppose ==> Stat10: {[x,y]: x in Za, y in {Ra_1}} /= {[x,Ra_1]: x in Za}
            cp-->Stat10 ==> (cp in {[x,y]: x in Za, y in {Ra_1}}) ¥eq (cp notin {[x,Ra_1]: x in Za})
            Suppose ==> Stat11: (cp in {[x,y]: x in Za, y in {Ra_1}}) & (cp notin {[x,Ra_1]: x in Za})
            (x2,y2,x2)-->Stat11 ==> false; Discharge ==> Stat12: (cp in {[x,Ra_1]: x in Za}) & (cp notin {[x,y]: x in Za, y in {Ra_1}})
        (x3,x3,Ra_1)-->Stat12 ==> false; Discharge ==> Ra1Seq = {[x,Ra_1]: x in Za}
--
-- On the other hand, $Ra1Seq~[u]$ has value $Ra_1$ for all unsigned integers $u$; therefore,
-- since $Ra_1$ behaves as multiplicative unit element among rational numbers, $(f~[u]) ¥Ra_TIMES (Ra1Seq~[u])$
-- always carries the value $f~[u]$. Accordingly the sequence $f ¥Ras_TIMES Ra1Seq$, whose values coincide
-- with those of $f$ over the common domain $Za$, must coincide with $f$.
--
        APPLY() fcn_symbol(f(u)->Ra_1, g->Ra1Seq, s->Za) ==>
				Stat13: (FORALL x | (Ra1Seq~[x]) = if x in Za then Ra_1 else 0 end if)
        dp-->Stat9 ==> (dp in {[u,((f~[u]) ¥Ra_TIMES (Ra1Seq~[u]))]: u in Za}) ¥eq (dp notin f)
        Suppose ==> Stat14: (dp notin {[i,f~[i]]: i in domain(f)}) & Stat15: (dp in {[u,((f~[u]) ¥Ra_TIMES (Ra1Seq~[u]))]: u in Za})
            i2-->Stat15 ==> (i2 in Za) & (dp = [i2,((f~[i2]) ¥Ra_TIMES (Ra1Seq~[i2]))])
            i2-->Stat13 ==> (Ra1Seq~[i2]) = Ra_1
            (f,i2)-->T540 ==> (f~[i2]) in Ra
            (f~[i2])-->T461 ==> ((f~[i2]) ¥Ra_TIMES Ra_1) = (f~[i2])
            EQUAL ==> dp = [i2,f~[i2]]
        i2-->Stat14 ==> false; Discharge ==> Stat16: (dp in {[i,f~[i]]: i in domain(f)}) & (dp notin {[u,((f~[u]) ¥Ra_TIMES (Ra1Seq~[u]))]: u in Za})
        (i3,i3)-->Stat16 ==> (dp = [i3,f~[i3]]) & (i3 in Za) & (dp /= [i3,((f~[i3]) ¥Ra_TIMES (Ra1Seq~[i3]))])
        i3-->Stat13 ==> (Ra1Seq~[i3]) = Ra_1
        (f,i3)-->T540 ==> (f~[i3]) in Ra
        (f~[i3])-->T461 ==> ((f~[i3]) ¥Ra_TIMES Ra_1) = (f~[i3])
    EQUAL ==> false; Discharge ==> QED
--
-- We are now ready to state the properties of the relation $Ra_eqseq(F,G)$
-- between rational Cauchy sequences in such a way that we can
-- apply the THEORY equivalence_classes
--
Theorem 606: (FORALL f in RaCauchy, g in RaCauchy | (Ra_eqseq(f,g) ¥eq Ra_eqseq(g,f)) & Ra_eqseq(f,f)). Proof:
    Suppose_not ==> Stat1: not(FORALL f in RaCauchy, g in RaCauchy | (Ra_eqseq(f,g) ¥eq Ra_eqseq(g,f)) & Ra_eqseq(f,f))
        (f,g)-->Stat1 ==> (f in RaCauchy) & (g in RaCauchy) & ((Ra_eqseq(f,g) ¥eq (not Ra_eqseq(g,f))) or (not Ra_eqseq(f,f)))
        Suppose ==> (f notin RaSeq) or (g notin RaSeq) or (not Ra_eqseq(f,f)) or (not Ra_eqseq(g,g))
            Use_def(RaCauchy) ==> Stat2: (f in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}) &
		Stat3: (g in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
            ()-->Stat3 ==> g in RaSeq
            ()-->Stat2 ==> f in RaSeq
            f-->T546 ==> not Ra_eqseq(g,g)
        g-->T546 ==> false; Discharge ==> (f in RaSeq) & (g in RaSeq) & Ra_eqseq(f,f) & Ra_eqseq(g,g) & (Ra_eqseq(f,g) ¥eq (not Ra_eqseq(g,f)))
        (f,f,g)-->T553 ==> Ra_eqseq(g,f)
    (g,g,f)-->T553 ==> false; Discharge ==> QED
--
-- The following lemma reformulates Theorem 606 in a form that is often easier to use.
--
Theorem 607: ((F in RaCauchy) & (G in RaCauchy)) ¥imp ((Ra_eqseq(F,G) ¥eq Ra_eqseq(G,F)) & Ra_eqseq(F,F)). Proof:
	Suppose_not(f,g) ==> AUTO
	T606 ==> Stat1: AUTO
	(f,g)-->Stat1 ==> false; Discharge ==> QED
--
Theorem 608: (FORALL f in RaCauchy, g in RaCauchy, h in RaCauchy | (Ra_eqseq(f,g) & Ra_eqseq(g,h)) ¥imp Ra_eqseq(f,h)). Proof:
    Suppose_not ==> Stat1: not(FORALL f in RaCauchy, g in RaCauchy, h in RaCauchy | (Ra_eqseq(f,g) & Ra_eqseq(g,h)) ¥imp Ra_eqseq(f,h))
        (f,g,h)-->Stat1 ==> (f in RaCauchy) & (g in RaCauchy) & (h in RaCauchy) & Ra_eqseq(f,g) & Ra_eqseq(g,h) & (not Ra_eqseq(f,h))
        Suppose ==> (f notin RaSeq) or (g notin RaSeq) or (h notin RaSeq)
            Use_def(RaCauchy) ==> Stat2: (f in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}) &
		Stat3: (g in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}) &
		Stat4: (h in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))})
            ()-->Stat4 ==> h in RaSeq
            ()-->Stat3 ==> g in RaSeq
        ()-->Stat2 ==> false; Discharge ==> (f in RaSeq) & (g in RaSeq) & (h in RaSeq)
        (f,g,h)-->T553 ==> Ra_eqseq(h,f)
        h-->T546 ==> Ra_eqseq(h,h)
    (h,h,f)-->T553 ==> false; Discharge ==> QED
--
-- Now that we know that '$Ra_eqseq$' is an equivalence relationship, we can apply the
-- equivalence_classes theory to it, to derive
--
APPLY(Eqc_thryvar:Re,f1_thryvar:Cauchy_to_Re) equivalence_classes(R(x,y)->Ra_eqseq(x,y),s->RaCauchy) ==>
    Theorem 609: (FORALL x, y | ((x in RaCauchy) & (y in RaCauchy)) ¥imp ((Ra_eqseq(x,y) ¥eq (Cauchy_to_Re(x) = Cauchy_to_Re(y))))) &
    (FORALL x | (x in Re) ¥imp ((arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x))) &
    (FORALL x | (x in RaCauchy) ¥imp (Cauchy_to_Re(x) in Re)) &
    (FORALL x | (x in RaCauchy) ¥imp Ra_eqseq(x,arb(Cauchy_to_Re(x))))
--
-- To ease its application, it is convenient to rewrite the preceding result as the two following statements.
--
Theorem 610: ((X in RaCauchy) & (Y in RaCauchy)) ¥imp ((Ra_eqseq(X,Y) ¥eq (Cauchy_to_Re(X) = Cauchy_to_Re(Y))) & (Cauchy_to_Re(X) in Re) & Ra_eqseq(X,arb(Cauchy_to_Re(X)))). Proof:
	Suppose_not(x,y) ==> AUTO
	T609 ==> Stat1: (FORALL x, y | ((x in RaCauchy) & (y in RaCauchy)) ¥imp ((Ra_eqseq(x,y) ¥eq (Cauchy_to_Re(x) = Cauchy_to_Re(y))))) &
    Stat2: (FORALL x | (x in Re) ¥imp ((arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x))) &
    Stat3: (FORALL x | (x in RaCauchy) ¥imp (Cauchy_to_Re(x) in Re)) &
    Stat4: (FORALL x | (x in RaCauchy) ¥imp Ra_eqseq(x,arb(Cauchy_to_Re(x))))
	(x,y)-->Stat1 ==> ((x in RaCauchy) & (y in RaCauchy)) ¥imp ((Ra_eqseq(x,y) ¥eq (Cauchy_to_Re(x) = Cauchy_to_Re(y))))
	x-->Stat3 ==> (x in RaCauchy) ¥imp (Cauchy_to_Re(x) in Re)
	x-->Stat4 ==> false; Discharge ==> QED
--
Theorem 611: (X in Re) ¥imp ((arb(X) in RaCauchy) & (arb(X) in RaSeq) & (Cauchy_to_Re(arb(X)) = X)). Proof:
	Suppose_not(x) ==> AUTO
	T609 ==> Stat1: (FORALL x, y | ((x in RaCauchy) & (y in RaCauchy)) ¥imp ((Ra_eqseq(x,y) ¥eq (Cauchy_to_Re(x) = Cauchy_to_Re(y))))) &
    Stat2: (FORALL x | (x in Re) ¥imp ((arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x))) &
    Stat3: (FORALL x | (x in RaCauchy) ¥imp (Cauchy_to_Re(x) in Re)) &
    Stat4: (FORALL x | (x in RaCauchy) ¥imp Ra_eqseq(x,arb(Cauchy_to_Re(x))))
	x-->Stat2 ==> (arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x)
	T539(*) ==> arb(x) in RaSeq
	Discharge ==> QED
--
Def 58: [The zero real] R_0 := Cauchy_to_Re(Ra0Seq)
Def 58a: [The unit real] R_1 := Cauchy_to_Re(Ra1Seq)
Def 59: [Real Sum] Def(X ¥R_PLUS Y) := Cauchy_to_Re(arb(X) ¥Ras_PLUS arb(Y))
Def 60: [Real Negative] R_Rev(X) := Cauchy_to_Re(Ras_Rev(arb(X)))
Def 61: [Real Subtraction] Def(X ¥R_MINUS Y) := Cauchy_to_Re(arb(X) ¥Ras_MINUS arb(Y))
--Def 62: [Absolute value, i.e. the larger of $X$ and $R_Rev(X)$] abs(X) := Cauchy_to_Re(Ras_ABS(arb(X)))
Def 63: [Real Multiplication] Def(X ¥R_TIMES Y) := Cauchy_to_Re(arb(X) ¥Ras_TIMES arb(Y))
Def 64: [Real Reciprocal] R_Recip(X) := Cauchy_to_Re(Ras_Recip(arb(X)))
Def 65: [Real Quotient] Def(X ¥R_OVER Y) := X ¥R_TIMES R_Recip(Y)
--
Def 66: [Non-negative Real] R_is_nonneg(X) := (Cauchy_to_Re(Ras_ABS(arb(X))) = X)
Def 67: [Real Comparison] Def(X ¥R_GT Y) := R_is_nonneg(X ¥R_MINUS Y) & (X /= Y)
Def 68: [Real Comparison] Def(X ¥R_GE Y) := R_is_nonneg(X ¥R_MINUS Y)
Def 67a: [Real Comparison] Def(X ¥R_LT Y) := R_is_nonneg(Y ¥R_MINUS X) & (X /= Y)
Def 68a: [Real Comparison] Def(X ¥R_LE Y) := R_is_nonneg(Y ¥R_MINUS X)
--
Theorem 612: (R_0 in Re) & (R_1 in Re). Proof:
    Suppose_not ==> (R_0 notin Re) or (R_1 notin Re)
        T545 ==> (Ra0Seq in RaCauchy) & (Ra1Seq in RaCauchy)
        (Ra0Seq,Ra0Seq)-->T610 ==> Cauchy_to_Re(Ra0Seq) in Re
        (Ra1Seq,Ra1Seq)-->T610 ==> Cauchy_to_Re(Ra1Seq) in Re
        Use_def(R_0) ==> R_1 notin Re
    Use_def(R_1) ==> false; Discharge ==> QED
--
Theorem 613: ({X,Y} ¥incin Re) ¥imp (((X ¥R_PLUS Y) in Re) & (R_Rev(X) in Re)). Proof:
    Suppose_not(x,y) ==> ({x,y} ¥incin Re) & (((x ¥R_PLUS y) notin Re) or (R_Rev(x) notin Re))
        x-->T611(*) ==> arb(x) in RaCauchy
        y-->T611(*) ==> arb(y) in RaCauchy
        (arb(x),arb(y))-->T556(*) ==> ((arb(x) ¥Ras_PLUS arb(y)) in RaCauchy) & (Ras_ABS(arb(x)) in RaCauchy) & (Ras_Rev(arb(x)) in RaCauchy)
        (arb(x) ¥Ras_PLUS arb(y),arb(x) ¥Ras_PLUS arb(y))-->T610(*) ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)) in Re
        Use_def(¥R_PLUS) ==> Stat1: R_Rev(x) notin Re
        (Ras_Rev(arb(x)),Ras_Rev(arb(x)))-->T610(*) ==> Cauchy_to_Re(Ras_Rev(arb(x))) in Re
    Use_def(R_Rev) ==> false; Discharge ==> QED
--
Theorem 614: ({X,Y} ¥incin Re) ¥imp (((X ¥R_MINUS Y) in Re) & ((X ¥R_TIMES Y) in Re)). Proof:
    Suppose_not(x,y) ==> ({x,y} ¥incin Re) & (((x ¥R_MINUS y) notin Re) or ((x ¥R_TIMES y) notin Re))
        x-->T611 ==> arb(x) in RaCauchy
        y-->T611 ==> arb(y) in RaCauchy
        (arb(x),arb(y))-->T561 ==> ((arb(x) ¥Ras_MINUS arb(y)) in RaCauchy) & ((arb(x) ¥Ras_TIMES arb(y)) in RaCauchy)
        (arb(x) ¥Ras_MINUS arb(y),arb(x) ¥Ras_TIMES arb(y))-->T610 ==> Cauchy_to_Re(arb(x) ¥Ras_MINUS arb(y)) in Re
        Use_def(¥R_MINUS) ==> (x ¥R_TIMES y) notin Re
        (arb(x) ¥Ras_TIMES arb(y),arb(x) ¥Ras_TIMES arb(y))-->T610 ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)) in Re
    Use_def(¥R_TIMES) ==> false; Discharge ==> QED
--
-- It is now easy to prove the commutative and associative laws for real addition.
--
Theorem 615: [Commutative law for real addition] ({X,Y} ¥incin Re) ¥imp ((X ¥R_PLUS Y) = (Y ¥R_PLUS X)). Proof:
    Suppose_not(x,y) ==> ({x,y} ¥incin Re) & ((x ¥R_PLUS y) /= (y ¥R_PLUS x))
--
-- For let x,y,v be a counterexample to our assertion, and let arb(x) and arb(y) be Cauchy sequences belonging
-- to these equivalence classes (of Cauchy sequences). Then our assertion follows immediately from Theorem 578.
--
       x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq)
       y-->T611 ==> (arb(y) in RaCauchy) & (arb(y) in RaSeq)
       (arb(x),arb(y))-->T578 ==> Stat1: (arb(x) ¥Ras_PLUS arb(y)) = (arb(y) ¥Ras_PLUS arb(x))
       Use_def(¥R_PLUS) ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)) /= Cauchy_to_Re(arb(y) ¥Ras_PLUS arb(x))
       EQUAL(Stat1) ==> false; Discharge ==> QED
--
-- The following elementary lemma makes subsequent proof of the associative law for real addition easy.
--
Theorem 616: [Elementary algebraic lemma for real addition] ((X in RaCauchy) & (Y in RaCauchy)) ¥imp (Cauchy_to_Re(X ¥Ras_PLUS Y) = (Cauchy_to_Re(X) ¥R_PLUS Cauchy_to_Re(Y))). Proof:
    Suppose_not(x,y) ==> (x in RaCauchy) & (y in RaCauchy) & (Cauchy_to_Re(x ¥Ras_PLUS y) /= (Cauchy_to_Re(x) ¥R_PLUS Cauchy_to_Re(y)))
    T539(*) ==> (x in RaSeq) & (y in RaSeq)
	Use_def(¥R_PLUS) ==> Cauchy_to_Re(arb(Cauchy_to_Re(x)) ¥Ras_PLUS arb(Cauchy_to_Re(y))) /= Cauchy_to_Re(x ¥Ras_PLUS y)
	(x,x)-->T610 ==> Ra_eqseq(x,arb(Cauchy_to_Re(x))) & (Cauchy_to_Re(x) in Re)
	(y,y)-->T610 ==> Ra_eqseq(y,arb(Cauchy_to_Re(y))) & (Cauchy_to_Re(y) in Re)
	(x,y)-->T556 ==> (x ¥Ras_PLUS y) in RaCauchy
	(Cauchy_to_Re(x))-->T611 ==> (arb(Cauchy_to_Re(x)) in RaCauchy) & (arb(Cauchy_to_Re(x)) in RaSeq)
	(Cauchy_to_Re(y))-->T611 ==> (arb(Cauchy_to_Re(y)) in RaCauchy) & (arb(Cauchy_to_Re(y)) in RaSeq)
	(x,arb(Cauchy_to_Re(x)),y,arb(Cauchy_to_Re(y)))-->T571 ==> Ra_eqseq(x ¥Ras_PLUS y,arb(Cauchy_to_Re(x)) ¥Ras_PLUS arb(Cauchy_to_Re(y)))
	(arb(Cauchy_to_Re(x)),arb(Cauchy_to_Re(y)))-->T556 ==> (arb(Cauchy_to_Re(x)) ¥Ras_PLUS arb(Cauchy_to_Re(y))) in RaCauchy
	(x ¥Ras_PLUS y,arb(Cauchy_to_Re(x)) ¥Ras_PLUS arb(Cauchy_to_Re(y)))-->T610 ==> false; Discharge ==> QED

Theorem 617: [Associative law for real addition] ({X,Y,V} ¥incin Re) ¥imp ((X ¥R_PLUS (Y ¥R_PLUS V)) = ((X ¥R_PLUS Y) ¥R_PLUS V)). Proof:
    Suppose_not(x,y,v) ==> ({x,y,v} ¥incin Re) & ((x ¥R_PLUS (y ¥R_PLUS v)) /= ((x ¥R_PLUS y) ¥R_PLUS v))
--
-- For let x,y,v be a counterexample to our assertion, so arb(x), arb(y), and arb(v) are Cauchy sequences belonging
-- to these equivalence classes (of Cauchy sequences). By Theorem 580, pointwise addition of these rational sequences is associative
--
	x-->T611(*) ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	y-->T611(*) ==> (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
	v-->T611(*) ==> (arb(v) in RaCauchy) & (arb(v) in RaSeq) & (Cauchy_to_Re(arb(v)) = v)
	(arb(x),arb(y),arb(v))-->T580(*) ==> ((arb(x) ¥Ras_PLUS (arb(y) ¥Ras_PLUS arb(v))) = ((arb(x) ¥Ras_PLUS arb(y)) ¥Ras_PLUS arb(v)))
	(arb(y),arb(v))-->T556(*) ==> (arb(y) ¥Ras_PLUS arb(v)) in RaCauchy
	(arb(x),arb(y))-->T556(*) ==> (arb(x) ¥Ras_PLUS arb(y)) in RaCauchy
--
-- But in the case before us equivalence classes of sums are by definition sums of equivalence classes,
-- so our theorem follows routinely.
--
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS (arb(y) ¥Ras_PLUS arb(v))) = Cauchy_to_Re((arb(x) ¥Ras_PLUS arb(y)) ¥Ras_PLUS arb(v))
	(arb(x),arb(y) ¥Ras_PLUS arb(v))-->T616 ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS (arb(y) ¥Ras_PLUS arb(v))) = (Cauchy_to_Re(arb(x)) ¥R_PLUS Cauchy_to_Re(arb(y) ¥Ras_PLUS arb(v)))
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS (arb(y) ¥Ras_PLUS arb(v))) = (x ¥R_PLUS Cauchy_to_Re(arb(y) ¥Ras_PLUS arb(v)))
	(arb(y),arb(v))-->T616 ==> Cauchy_to_Re(arb(y) ¥Ras_PLUS arb(v)) = (Cauchy_to_Re(arb(y)) ¥R_PLUS Cauchy_to_Re(arb(v)))
	EQUAL ==> Cauchy_to_Re(arb(y) ¥Ras_PLUS arb(v)) = (y ¥R_PLUS v)
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS (arb(y) ¥Ras_PLUS arb(v))) = x ¥R_PLUS (y ¥R_PLUS v)
	(arb(x) ¥Ras_PLUS arb(y),arb(v))-->T616 ==> Cauchy_to_Re((arb(x) ¥Ras_PLUS arb(y)) ¥Ras_PLUS arb(v)) = Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)) ¥R_PLUS Cauchy_to_Re(arb(v))
	EQUAL ==> Cauchy_to_Re((arb(x) ¥Ras_PLUS arb(y)) ¥Ras_PLUS arb(v)) = Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)) ¥R_PLUS v
	(arb(x),arb(y))-->T616 ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)) = (Cauchy_to_Re(arb(x)) ¥R_PLUS Cauchy_to_Re(arb(y)))
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)) = (x ¥R_PLUS y)
	EQUAL ==> false; Discharge ==> QED
--
-- Next we prove the corresponding propositions for real multiplication.
--
Theorem 618: [Commutative law for real multiplication] ({X,Y} ¥incin Re) ¥imp ((X ¥R_TIMES Y) = (Y ¥R_TIMES X)). Proof:
Suppose_not(x,y) ==> ({x,y} ¥incin Re) & ((x ¥R_TIMES y) /= (y ¥R_TIMES x))
--
-- For let x,y,v be a counterexample to our assertion, and let arb(x) and arb(y) be Cauchy sequences belonging
-- to these equivalence classes (of Cauchy sequences). Then our assertion follows immediately from Theorem 578.
--
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq)
	y-->T611 ==> (arb(y) in RaCauchy) & (arb(y) in RaSeq)
	(arb(x),arb(y))-->T579 ==> Stat1: (arb(x) ¥Ras_TIMES arb(y)) = (arb(y) ¥Ras_TIMES arb(x))
	Use_def(¥R_TIMES) ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)) /= Cauchy_to_Re(arb(y) ¥Ras_TIMES arb(x))
EQUAL(Stat1) ==> false; Discharge ==> QED
--
Theorem 619: [Elementary algebraic lemma for real multiplication] ((X in RaCauchy) & (Y in RaCauchy)) ¥imp (Cauchy_to_Re(X ¥Ras_TIMES Y) = (Cauchy_to_Re(X) ¥R_TIMES Cauchy_to_Re(Y))). Proof:
    Suppose_not(x,y) ==> (x in RaCauchy) & (y in RaCauchy) & (Cauchy_to_Re(x ¥Ras_TIMES y) /= (Cauchy_to_Re(x) ¥R_TIMES Cauchy_to_Re(y)))
    T539(*) ==> (x in RaSeq) & (y in RaSeq)
	Use_def(¥R_TIMES) ==> Cauchy_to_Re(arb(Cauchy_to_Re(x)) ¥Ras_TIMES arb(Cauchy_to_Re(y))) /= Cauchy_to_Re(x ¥Ras_TIMES y)
	(x,x)-->T610 ==> Ra_eqseq(x,arb(Cauchy_to_Re(x))) & (Cauchy_to_Re(x) in Re)
	(y,y)-->T610 ==> Ra_eqseq(y,arb(Cauchy_to_Re(y))) & (Cauchy_to_Re(y) in Re)
	(x,y)-->T561 ==> (x ¥Ras_TIMES y) in RaCauchy
	(Cauchy_to_Re(x))-->T611 ==> (arb(Cauchy_to_Re(x)) in RaCauchy) & (arb(Cauchy_to_Re(x)) in RaSeq)
	(Cauchy_to_Re(y))-->T611 ==> (arb(Cauchy_to_Re(y)) in RaCauchy) & (arb(Cauchy_to_Re(y)) in RaSeq)
	(x,arb(Cauchy_to_Re(x)),y,arb(Cauchy_to_Re(y)))-->T574 ==> Ra_eqseq(x ¥Ras_TIMES y,arb(Cauchy_to_Re(x)) ¥Ras_TIMES arb(Cauchy_to_Re(y)))
	(arb(Cauchy_to_Re(x)),arb(Cauchy_to_Re(y)))-->T561 ==> (arb(Cauchy_to_Re(x)) ¥Ras_TIMES arb(Cauchy_to_Re(y))) in RaCauchy
	(x ¥Ras_TIMES y,arb(Cauchy_to_Re(x)) ¥Ras_TIMES arb(Cauchy_to_Re(y)))-->T610 ==> false; Discharge ==> QED

Theorem 620: [Associative law for real multiplication] ({X,Y,V} ¥incin Re) ¥imp ((X ¥R_TIMES (Y ¥R_TIMES V)) = ((X ¥R_TIMES Y) ¥R_TIMES V)). Proof:
    Suppose_not(x,y,v) ==> (x in Re) & (y in Re) & (v in Re) & ((x ¥R_TIMES (y ¥R_TIMES v)) /= ((x ¥R_TIMES y) ¥R_TIMES v))
--
-- For let x,y,v be a counterexample to our assertion, and let arb(x), arb(y), and arb(v) be Cauchy sequences belonging
-- to these equivalence classes (of Cauchy sequences). By theorem 580, pointwise addition of these rational sequences is associative.
--
	x-->T611 ==> Stat1: (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	y-->T611 ==> Stat2: (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
	v-->T611 ==> Stat3: (arb(v) in RaCauchy) & (arb(v) in RaSeq) & (Cauchy_to_Re(arb(v)) = v)
	(arb(x),arb(y),arb(v))-->T581(Stat1) ==> ((arb(x) ¥Ras_TIMES (arb(y) ¥Ras_TIMES arb(v))) = ((arb(x) ¥Ras_TIMES arb(y)) ¥Ras_TIMES arb(v)))
	(arb(y),arb(v))-->T561(Stat1) ==> (arb(y) ¥Ras_TIMES arb(v)) in RaCauchy
	(arb(x),arb(y))-->T561 ==> (arb(x) ¥Ras_TIMES arb(y)) in RaCauchy
--
-- But in the case before us equivalence classes of products are by definition products of equivalence classes,
-- so our theorem follows routinely.
--
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES (arb(y) ¥Ras_TIMES arb(v))) = Cauchy_to_Re((arb(x) ¥Ras_TIMES arb(y)) ¥Ras_TIMES arb(v))
	(arb(x),arb(y) ¥Ras_TIMES arb(v))-->T619 ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES (arb(y) ¥Ras_TIMES arb(v))) = (Cauchy_to_Re(arb(x)) ¥R_TIMES Cauchy_to_Re(arb(y) ¥Ras_TIMES arb(v)))
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES (arb(y) ¥Ras_TIMES arb(v))) = (x ¥R_TIMES Cauchy_to_Re(arb(y) ¥Ras_TIMES arb(v)))
	(arb(y),arb(v))-->T619 ==> Cauchy_to_Re(arb(y) ¥Ras_TIMES arb(v)) = (Cauchy_to_Re(arb(y)) ¥R_TIMES Cauchy_to_Re(arb(v)))
	EQUAL ==> Cauchy_to_Re(arb(y) ¥Ras_TIMES arb(v)) = (y ¥R_TIMES v)
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES (arb(y) ¥Ras_TIMES arb(v))) = x ¥R_TIMES (y ¥R_TIMES v)
	(arb(x) ¥Ras_TIMES arb(y),arb(v))-->T619 ==> Cauchy_to_Re((arb(x) ¥Ras_TIMES arb(y)) ¥Ras_TIMES arb(v)) = Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)) ¥R_TIMES Cauchy_to_Re(arb(v))
	EQUAL ==> Cauchy_to_Re((arb(x) ¥Ras_TIMES arb(y)) ¥Ras_TIMES arb(v)) = Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)) ¥R_TIMES v
	(arb(x),arb(y))-->T619 ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)) = (Cauchy_to_Re(arb(x)) ¥R_TIMES Cauchy_to_Re(arb(y)))
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)) = (x ¥R_TIMES y)
	EQUAL ==> false; Discharge ==> QED
--
Theorem 621: [Distributive law for real multiplication] ({X,Y,V} ¥incin Re) ¥imp ((X ¥R_TIMES (Y ¥R_PLUS V)) = ((X ¥R_TIMES Y) ¥R_PLUS (X ¥R_TIMES V))). Proof:
	Suppose_not(x,y,v) ==> (x in Re) & (y in Re) & (v in Re) & (x ¥R_TIMES (y ¥R_PLUS v) /= (x ¥R_TIMES y) ¥R_PLUS (x ¥R_TIMES v))
--
-- For let x,y,v be a counterexample to our assertion, and let arb(x), arb(y), and arb(v) be Cauchy sequences belonging
-- to these equivalence classes (of Cauchy sequences). By theorem 583, pointwise addition of these rational sequences is associative.
--
	x-->T611 ==> Stat1: (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	y-->T611 ==> Stat2: (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
	v-->T611 ==> Stat3: (arb(v) in RaCauchy) & (arb(v) in RaSeq) & (Cauchy_to_Re(arb(v)) = v)
	(arb(x),arb(y),arb(v))-->T583(Stat1) ==> (arb(x) ¥Ras_TIMES (arb(y) ¥Ras_PLUS arb(v))) = ((arb(x) ¥Ras_TIMES arb(y)) ¥Ras_PLUS (arb(x) ¥Ras_TIMES arb(v)))
	(arb(y),arb(v))-->T556(Stat1) ==> (arb(y) ¥Ras_PLUS arb(v)) in RaCauchy
	(arb(x),arb(y))-->T561 ==> (arb(x) ¥Ras_TIMES arb(y)) in RaCauchy
	(arb(x),arb(v))-->T561 ==> (arb(x) ¥Ras_TIMES arb(v)) in RaCauchy
--
-- But in the case before us equivalence classes of sums are by definition sums of equivalence classes,
-- and similarly for products, so our theorem follows routinely.
--
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES (arb(y) ¥Ras_PLUS arb(v))) = Cauchy_to_Re((arb(x) ¥Ras_TIMES arb(y)) ¥Ras_PLUS (arb(x) ¥Ras_TIMES arb(v)))
	(arb(x),arb(y) ¥Ras_PLUS arb(v))-->T619 ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES (arb(y) ¥Ras_PLUS arb(v))) = (Cauchy_to_Re(arb(x)) ¥R_TIMES Cauchy_to_Re(arb(y) ¥Ras_PLUS arb(v)))
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES (arb(y) ¥Ras_PLUS arb(v))) = (x ¥R_TIMES Cauchy_to_Re(arb(y) ¥Ras_PLUS arb(v)))
	(arb(y),arb(v))-->T616 ==> Cauchy_to_Re(arb(y) ¥Ras_PLUS arb(v)) = (Cauchy_to_Re(arb(y)) ¥R_PLUS Cauchy_to_Re(arb(v)))
	EQUAL ==> Cauchy_to_Re(arb(y) ¥Ras_PLUS arb(v)) = (y ¥R_PLUS v)
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES (arb(y) ¥Ras_PLUS arb(v))) = x ¥R_TIMES (y ¥R_PLUS v)
	(arb(x) ¥Ras_TIMES arb(y),arb(x) ¥Ras_TIMES arb(v))-->T616 ==> Cauchy_to_Re((arb(x) ¥Ras_TIMES arb(y)) ¥Ras_PLUS (arb(x) ¥Ras_TIMES arb(v))) = Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)) ¥R_PLUS Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(v))
	(arb(x),arb(y))-->T619 ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)) = Cauchy_to_Re(arb(x)) ¥R_TIMES Cauchy_to_Re(arb(y))
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)) = x ¥R_TIMES y
	(arb(x),arb(v))-->T619 ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(v)) = Cauchy_to_Re(arb(x)) ¥R_TIMES Cauchy_to_Re(arb(v))
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(v)) = x ¥R_TIMES v
	EQUAL ==> false; Discharge ==> QED
--
Theorem 622: [Lemma for law of signs] (X in RaCauchy) ¥imp (Cauchy_to_Re(Ras_Rev(X)) = R_Rev(Cauchy_to_Re(X))). Proof:
	Suppose_not(x) ==> AUTO
	Use_def(R_Rev) ==> R_Rev(Cauchy_to_Re(x)) = Cauchy_to_Re(Ras_Rev(arb(Cauchy_to_Re(x))))
	(x,x)-->T610 ==> Ra_eqseq(x,arb(Cauchy_to_Re(x))) &  (Cauchy_to_Re(x) in Re)
	(Cauchy_to_Re(x))-->T611 ==> arb(Cauchy_to_Re(x)) in RaCauchy
	(x,arb(Cauchy_to_Re(x)))-->T575 ==> Ra_eqseq(Ras_Rev(x),Ras_Rev(arb(Cauchy_to_Re(x))))
	(x,x)-->T556 ==> Ras_Rev(x) in RaCauchy
	(arb(Cauchy_to_Re(x)),x)-->T556 ==> Ras_Rev(arb(Cauchy_to_Re(x))) in RaCauchy
	(Ras_Rev(x),Ras_Rev(arb(Cauchy_to_Re(x))))-->T610 ==> Cauchy_to_Re(Ras_Rev(x)) = Cauchy_to_Re(Ras_Rev(arb(Cauchy_to_Re(x))))
	Discharge ==> QED
--
Theorem 623: [Law of signs for real multiplication] ({X,Y} ¥incin Re) ¥imp (((X ¥R_TIMES R_Rev(Y)) = R_Rev(X ¥R_TIMES Y)) & ((R_Rev(X) ¥R_TIMES Y) = R_Rev(X ¥R_TIMES Y)) & ((R_Rev(X) ¥R_TIMES R_Rev(Y)) = (X ¥R_TIMES Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	x-->T611 ==> Stat1: (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	y-->T611 ==> Stat2: (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
	(arb(x),arb(y))-->T584 ==> ((arb(x) ¥Ras_TIMES Ras_Rev(arb(y))) = Ras_Rev(arb(x) ¥Ras_TIMES arb(y)))
        (arb(x),arb(y))-->T585 ==> ((Ras_Rev(arb(x)) ¥Ras_TIMES arb(y)) = Ras_Rev(arb(x) ¥Ras_TIMES arb(y))) & ((Ras_Rev(arb(x)) ¥Ras_TIMES Ras_Rev(arb(y))) = (arb(x) ¥Ras_TIMES arb(y)))
	EQUAL ==> (Cauchy_to_Re(arb(x) ¥Ras_TIMES Ras_Rev(arb(y))) = Cauchy_to_Re(Ras_Rev(arb(x) ¥Ras_TIMES arb(y)))) & (Cauchy_to_Re(Ras_Rev(arb(x)) ¥Ras_TIMES arb(y)) = Cauchy_to_Re(Ras_Rev(arb(x) ¥Ras_TIMES arb(y)))) & (Cauchy_to_Re(Ras_Rev(arb(x)) ¥Ras_TIMES Ras_Rev(arb(y))) = Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)))
	(arb(x),arb(x))-->T556 ==> Ras_Rev(arb(x)) in RaCauchy
	(arb(y),arb(y))-->T556 ==> Ras_Rev(arb(y)) in RaCauchy
	(arb(x),arb(y))-->T561 ==> (arb(x) ¥Ras_TIMES arb(y)) in RaCauchy
	(Ras_Rev(arb(x)),Ras_Rev(arb(y)))-->T619 ==> Cauchy_to_Re(Ras_Rev(arb(x)) ¥Ras_TIMES Ras_Rev(arb(y))) = Cauchy_to_Re(Ras_Rev(arb(x))) ¥R_TIMES Cauchy_to_Re(Ras_Rev(arb(y)))
	(arb(x),arb(y))-->T619 ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)) = Cauchy_to_Re(arb(x)) ¥R_TIMES Cauchy_to_Re(arb(y))
	(arb(x),Ras_Rev(arb(y)))-->T619 ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES Ras_Rev(arb(y))) = Cauchy_to_Re(arb(x)) ¥R_TIMES Cauchy_to_Re(Ras_Rev(arb(y)))
	(Ras_Rev(arb(x)),arb(y))-->T619 ==> Cauchy_to_Re(Ras_Rev(arb(x)) ¥Ras_TIMES arb(y)) = Cauchy_to_Re(Ras_Rev(arb(x))) ¥R_TIMES Cauchy_to_Re(arb(y))
	Use_def(R_Rev) ==> Cauchy_to_Re(Ras_Rev(arb(x))) = R_Rev(x)
	Use_def(R_Rev) ==> Cauchy_to_Re(Ras_Rev(arb(y))) = R_Rev(y)
	(arb(x) ¥Ras_TIMES arb(y))-->T622 ==> Cauchy_to_Re(Ras_Rev(arb(x) ¥Ras_TIMES arb(y))) = R_Rev(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)))
	EQUAL ==> Cauchy_to_Re(Ras_Rev(arb(x)) ¥Ras_TIMES arb(y)) = R_Rev(x) ¥R_TIMES y
	EQUAL ==> Cauchy_to_Re(arb(x)) ¥R_TIMES Cauchy_to_Re(arb(y)) = x ¥R_TIMES y
	EQUAL ==> R_Rev(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y))) = R_Rev(x ¥R_TIMES y)
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES Ras_Rev(arb(y))) = x ¥R_TIMES R_Rev(y)
	EQUAL ==> Cauchy_to_Re(Ras_Rev(arb(x)) ¥Ras_TIMES Ras_Rev(arb(y))) = R_Rev(x) ¥R_TIMES R_Rev(y)
	Discharge ==> QED
--
--
-- Next follow a list of theorems giving various elementary properties of real additon, multiplication, and subtraction.
-- In many cases these follow from corresponding algebraic properties of rational Cauchy sequences.
-- The style of proof used is often that already seen in our last few proof.s
--
Theorem 624: [Any real times 0 is 0] (X in Re) ¥imp ((X ¥R_TIMES R_0) = R_0). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	(arb(x))-->T586 ==> (arb(x) ¥Ras_TIMES Ra0Seq) = Ra0Seq
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES Ra0Seq) = Cauchy_to_Re(Ra0Seq)
	T545 ==> Ra0Seq in RaCauchy
	(arb(x),Ra0Seq)-->T619 ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES Ra0Seq) = Cauchy_to_Re(arb(x)) ¥R_TIMES Cauchy_to_Re(Ra0Seq)
	EQUAL ==> x ¥R_TIMES Cauchy_to_Re(Ra0Seq) = Cauchy_to_Re(Ra0Seq)
	Use_def(R_0) ==> (x ¥R_TIMES R_0) = R_0
	Discharge ==> QED
--
Theorem 625: [0 times any real is 0] (X in Re) ¥imp (R_0 ¥R_TIMES X = R_0). Proof:
	Suppose_not(x) ==> AUTO
	T612 ==> R_0 in Re
	(x,R_0)-->T618 ==> R_0 ¥R_TIMES x = x ¥R_TIMES R_0
	x-->T624 ==> false; Discharge ==> QED
--
Theorem 626: [0 is a right and left additive identity for reals] (X in Re) ¥imp ((X ¥R_PLUS R_0 = X) & (R_0 ¥R_PLUS X = X)). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	(arb(x))-->T605 ==> (arb(x) ¥Ras_PLUS Ra0Seq) = arb(x)
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS Ra0Seq) = Cauchy_to_Re(arb(x))
	T545 ==> Ra0Seq in RaCauchy
	(arb(x),Ra0Seq)-->T616 ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS Ra0Seq) = Cauchy_to_Re(arb(x)) ¥R_PLUS Cauchy_to_Re(Ra0Seq)
	EQUAL ==> Cauchy_to_Re(arb(x)) ¥R_PLUS Cauchy_to_Re(Ra0Seq) = x ¥R_PLUS Cauchy_to_Re(Ra0Seq)
	Use_def(R_0) ==> x ¥R_PLUS R_0 = x
	T612 ==> R_0 in Re
	(x,R_0)-->T615 ==> false;  Discharge ==> QED
--
Theorem 627: [1 is a right multiplicative identity for reals] (X in Re) ¥imp (X ¥R_TIMES R_1 = X). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	(arb(x))-->T605 ==> (arb(x) ¥Ras_TIMES Ra1Seq) = arb(x)
	EQUAL ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES Ra1Seq) = Cauchy_to_Re(arb(x))
	T545 ==> Ra1Seq in RaCauchy
	(arb(x),Ra1Seq)-->T619 ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES Ra1Seq) = Cauchy_to_Re(arb(x)) ¥R_TIMES Cauchy_to_Re(Ra1Seq)
	EQUAL ==>Cauchy_to_Re(arb(x) ¥Ras_TIMES Ra1Seq) = x ¥R_TIMES Cauchy_to_Re(Ra1Seq)
	Use_def(R_1) ==> x ¥R_TIMES R_1 = x
	T612 ==> R_1 in Re
	(x,R_1)-->T615 ==> false;  Discharge ==> QED
--
Theorem 628: [1 is a left multiplicative identity for reals] (X in Re) ¥imp (R_1 ¥R_TIMES X = X). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	T612 ==> R_1 in Re
	(x,R_1)-->T618 ==> R_1 ¥R_TIMES x = x ¥R_TIMES R_1
	x-->T627 ==> false; Discharge ==> QED
--
Theorem 629: [The zero real is its own negative] R_Rev(R_0) = R_0. Proof:
	Suppose_not ==> AUTO
	T595 ==> AUTO
	Use_def(R_0) ==> R_Rev(Cauchy_to_Re(Ra0Seq)) /= Cauchy_to_Re(Ra0Seq)
	Use_def(R_Rev) ==> Cauchy_to_Re(Ras_Rev(arb(Cauchy_to_Re(Ra0Seq)))) /= Cauchy_to_Re(Ra0Seq)
	T545 ==> Ra0Seq in RaCauchy
	(Ra0Seq,Ra0Seq)-->T610 ==> Ra_eqseq(Ra0Seq,arb(Cauchy_to_Re(Ra0Seq))) & (Cauchy_to_Re(Ra0Seq) in Re)
	(Cauchy_to_Re(Ra0Seq))-->T611 ==> arb(Cauchy_to_Re(Ra0Seq)) in RaCauchy
	(arb(Cauchy_to_Re(Ra0Seq)),Ra0Seq)-->T607 ==> Ra_eqseq(arb(Cauchy_to_Re(Ra0Seq)),Ra0Seq)
	(arb(Cauchy_to_Re(Ra0Seq)),arb(Cauchy_to_Re(Ra0Seq)))-->T556 ==> Ras_Rev(arb(Cauchy_to_Re(Ra0Seq))) in RaCauchy
	(Ras_Rev(arb(Cauchy_to_Re(Ra0Seq))),Ra0Seq)-->T610 ==>
			not Ra_eqseq(Ras_Rev(arb(Cauchy_to_Re(Ra0Seq))),Ra0Seq)
	(arb(Cauchy_to_Re(Ra0Seq)),Ra0Seq)-->T575 ==> Ra_eqseq(Ras_Rev(arb(Cauchy_to_Re(Ra0Seq))),Ras_Rev(Ra0Seq))
	T595 ==> Ras_Rev(Ra0Seq) = Ra0Seq
	EQUAL ==> Ra_eqseq(Ras_Rev(arb(Cauchy_to_Re(Ra0Seq))),Ra0Seq)
	Discharge ==> QED
--
Theorem 630: [0 is right identity for real subtraction] (X in Re) ¥imp (X ¥R_MINUS R_0 = X). Proof:
	Suppose_not(x) ==> AUTO
	Use_def(¥R_MINUS) ==> Cauchy_to_Re(arb(x) ¥Ras_MINUS arb(R_0)) /= x
	Use_def(¥Ras_MINUS) ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS Ras_Rev(arb(R_0))) /= x
	T612 ==> R_0 in Re
	R_0-->T611 ==> (arb(R_0)in RaCauchy)  & (Cauchy_to_Re(arb(R_0)) = R_0)
	x-->T611 ==> (arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x)
	(arb(R_0),arb(R_0))-->T556 ==> Ras_Rev(arb(R_0)) in RaCauchy
	(arb(x),Ras_Rev(arb(R_0)))-->T616 ==> Cauchy_to_Re(arb(x)) ¥R_PLUS Cauchy_to_Re(Ras_Rev(arb(R_0))) /= x
	Use_def(R_Rev) ==> Cauchy_to_Re(Ras_Rev(arb(R_0))) = R_Rev(R_0)
	T629 ==> Cauchy_to_Re(Ras_Rev(arb(R_0))) = R_0
	EQUAL ==> Cauchy_to_Re(arb(x)) ¥R_PLUS R_0 /= x
	EQUAL ==> x ¥R_PLUS R_0 /= x
	x-->T626 ==> false; Discharge ==> QED
--
Theorem 631: [Real subtraction principle] (X in Re) ¥imp (X ¥R_MINUS X = R_0). Proof:
	Suppose_not(x) ==> AUTO
	Use_def(¥R_MINUS) ==> Cauchy_to_Re(arb(x) ¥Ras_MINUS arb(x)) /= R_0
	Use_def(¥Ras_MINUS) ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS Ras_Rev(arb(x))) /= R_0
	x-->T611 ==> arb(x) in RaCauchy
	T539(*) ==> arb(x) in RaSeq
	(arb(x))-->T590 ==> Ras_Rev(arb(x)) ¥Ras_PLUS arb(x) = Ra0Seq
	EQUAL ==> Cauchy_to_Re(Ras_Rev(arb(x)) ¥Ras_PLUS arb(x)) = Cauchy_to_Re(Ra0Seq)
	Use_def(R_0) ==> Cauchy_to_Re(Ras_Rev(arb(x)) ¥Ras_PLUS arb(x)) = R_0
	(arb(x),arb(x))-->T556 ==> Ras_Rev(arb(x)) in RaCauchy
	(Ras_Rev(arb(x)),arb(x))-->T616 ==> Cauchy_to_Re(Ras_Rev(arb(x))) ¥R_PLUS Cauchy_to_Re(arb(x)) = R_0
	(arb(x),Ras_Rev(arb(x)))-->T616 ==> Cauchy_to_Re(arb(x)) ¥R_PLUS Cauchy_to_Re(Ras_Rev(arb(x))) /= R_0
	(arb(x),arb(x))-->T610 ==> Cauchy_to_Re(arb(x)) in Re
	(Ras_Rev(arb(x)),arb(x))-->T610 ==> Cauchy_to_Re(Ras_Rev(arb(x))) in Re
	(Cauchy_to_Re(arb(x)),Cauchy_to_Re(Ras_Rev(arb(x))))-->T615 ==> false; Discharge ==> QED
--
Theorem 632: [Basic properties of the signed negative for reals] (X in Re) ¥imp ((R_Rev(X) in Re) & ((R_Rev(X) ¥R_PLUS X) = R_0)). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	Use_def(R_Rev) ==> R_Rev(x) = Cauchy_to_Re(Ras_Rev(arb(x)))
	(arb(x),arb(x))-->T556 ==> Ras_Rev(arb(x)) in RaCauchy
	(Ras_Rev(arb(x)),arb(x))-->T610 ==> R_Rev(x) in Re
	(arb(x))-->T590 ==> Ras_Rev(arb(x)) ¥Ras_PLUS arb(x) = Ra0Seq
	EQUAL ==> Cauchy_to_Re(Ras_Rev(arb(x)) ¥Ras_PLUS arb(x)) = Cauchy_to_Re(Ra0Seq)
	Use_def(R_0) ==> Cauchy_to_Re(Ras_Rev(arb(x)) ¥Ras_PLUS arb(x)) = R_0
	(Ras_Rev(arb(x)),arb(x))-->T616 ==> Cauchy_to_Re(Ras_Rev(arb(x))) ¥R_PLUS Cauchy_to_Re(arb(x)) = R_0
	EQUAL ==> (R_Rev(x) ¥R_PLUS x) = R_0
	Discharge ==> QED
--
Theorem 633: [Basic properties of the signed negative for reals, 2] (X in Re) ¥imp (R_Rev(R_Rev(X)) = X). Proof:
Suppose_not(x) ==> AUTO
	x-->T632(*) ==> R_Rev(x) in Re
	(R_Rev(x))-->T632(*) ==> R_Rev(R_Rev(x)) in Re
	(R_Rev(R_Rev(x)),R_Rev(x),x)-->T617(*) ==> ((R_Rev(R_Rev(x)) ¥R_PLUS R_Rev(x)) ¥R_PLUS x) = (R_Rev(R_Rev(x)) ¥R_PLUS (R_Rev(x) ¥R_PLUS x))
	x-->T632(*) ==> (R_Rev(x) ¥R_PLUS x) = R_0
	(R_Rev(x))-->T632(*) ==> (R_Rev(R_Rev(x)) ¥R_PLUS R_Rev(x)) = R_0
	EQUAL ==> (R_0 ¥R_PLUS x) = (R_Rev(R_Rev(x)) ¥R_PLUS R_0)
	x-->T626(*) ==> x = (R_Rev(R_Rev(x)) ¥R_PLUS R_0)
	(R_Rev(R_Rev(x)))-->T626(*) ==> R_Rev(R_Rev(x)) = (R_Rev(R_Rev(x)) ¥R_PLUS R_0)
Discharge ==> QED
--
Theorem 634: [Real additive Cancellation] ((X in Re) & (Y in Re) & (V in Re) & (X ¥R_PLUS V = Y ¥R_PLUS V)) ¥imp (X = Y). Proof:
	Suppose_not(x,y,v) ==> (x in Re) & (y in Re) & (v in Re) & (x ¥R_PLUS v = y ¥R_PLUS v) & (x /= y)
	(x,v)-->T613 ==> x ¥R_PLUS v in Re
	(y,v)-->T613 ==> y ¥R_PLUS v in Re
	EQUAL ==> ((x ¥R_PLUS v) ¥R_PLUS R_Rev(v)) = ((y ¥R_PLUS v) ¥R_PLUS R_Rev(v))
	(v,v)-->T613 ==> R_Rev(v) in Re
	v-->T632 ==> (R_Rev(v) ¥R_PLUS v) = R_0
	(v,R_Rev(v))-->T615 ==> (v ¥R_PLUS R_Rev(v)) = R_0
	(x,v,R_Rev(v))-->T617 ==> ((x ¥R_PLUS v) ¥R_PLUS R_Rev(v)) = (x ¥R_PLUS (v ¥R_PLUS R_Rev(v)))
	(y,v,R_Rev(v))-->T617 ==> ((y ¥R_PLUS v) ¥R_PLUS R_Rev(v)) = (y ¥R_PLUS (v ¥R_PLUS R_Rev(v)))
	EQUAL ==> (x ¥R_PLUS R_0) = (y ¥R_PLUS R_0)
	x-->T626 ==> x ¥R_PLUS R_0 = x
	y-->T626 ==> false; Discharge ==> QED
--
Theorem 635: [Real subtraction is addition of the negative] ((X in Re) & (Y in Re)) ¥imp ((X ¥R_MINUS Y) = (X ¥R_PLUS R_Rev(Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	y-->T611 ==> (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
	Use_def(¥R_MINUS) ==> x ¥R_MINUS y = Cauchy_to_Re(arb(x) ¥Ras_MINUS arb(y))
	Use_def(¥Ras_MINUS) ==> arb(x) ¥Ras_MINUS arb(y) = arb(x) ¥Ras_PLUS Ras_Rev(arb(y))
	EQUAL ==> x ¥R_MINUS y = Cauchy_to_Re(arb(x) ¥Ras_PLUS Ras_Rev(arb(y)))
	(arb(y),arb(y))-->T556 ==> Ras_Rev(arb(y)) in RaCauchy
	(arb(x),Ras_Rev(arb(y)))-->T616 ==> x ¥R_MINUS y = Cauchy_to_Re(arb(x)) ¥R_PLUS Cauchy_to_Re(Ras_Rev(arb(y)))
	EQUAL ==> x ¥R_MINUS y = x ¥R_PLUS Cauchy_to_Re(Ras_Rev(arb(y)))
	Use_def(R_Rev) ==> R_Rev(y) = Cauchy_to_Re(Ras_Rev(arb(y)))
	EQUAL ==> false; Discharge ==> QED
--
Theorem 636: [The sum of a real number and its additive inverse is zero] (X in Re) ¥imp ((R_Rev(X) in Re) & ((X ¥R_PLUS R_Rev(X)) = R_0)). Proof:
Suppose_not(x) ==> AUTO
	(x,x)-->T613(*) ==> (x ¥R_PLUS R_Rev(x)) /= R_0
	(x,x)-->T635 ==> AUTO
x-->T631(*) ==> false; Discharge ==> QED
--
Theorem 637: [The negative of a real $x$ is zero iff $x$ is zero] (X in Re) ¥imp ((R_Rev(X) = R_0) ¥eq (X = R_0)). Proof:
Suppose_not(x) ==> AUTO
	Suppose ==> x = R_0
		()-->T629 ==> AUTO
	EQUAL ==> false; Discharge ==> (x /= R_0) & (R_Rev(X) = R_0)
	x-->T636(*) ==> (x ¥R_PLUS R_Rev(x)) = R_0
	x-->T626(*) ==> (x ¥R_PLUS R_0) = x
EQUAL ==> false; Discharge ==> QED
--
Theorem 638: [The negative of a real sum is the sum of the negatives] ((X in Re) & (Y in Re)) ¥imp (R_Rev(X ¥R_PLUS Y) = R_Rev(X) ¥R_PLUS R_Rev(Y)). Proof:
	Suppose_not(x,y) ==> AUTO
	x-->T613 ==> R_Rev(x) in Re
	y-->T613 ==> R_Rev(y) in Re
	(R_Rev(x),R_Rev(y))-->T613 ==> R_Rev(x) ¥R_PLUS R_Rev(y) in Re
	(x,y)-->T613 ==> x ¥R_PLUS y in Re
	(x ¥R_PLUS y)-->T613 ==> R_Rev(x ¥R_PLUS y) in Re
	(R_Rev(x ¥R_PLUS y),(R_Rev(x) ¥R_PLUS R_Rev(y)),y)-->T634 ==> R_Rev(x ¥R_PLUS y) ¥R_PLUS y /= (R_Rev(x) ¥R_PLUS R_Rev(y)) ¥R_PLUS y
	(R_Rev(x),R_Rev(y),y)-->T617 ==> (R_Rev(x) ¥R_PLUS R_Rev(y)) ¥R_PLUS y = R_Rev(x) ¥R_PLUS (R_Rev(y) ¥R_PLUS y)
	y-->T632 ==> R_Rev(y) ¥R_PLUS y = R_0
	EQUAL ==> (R_Rev(x) ¥R_PLUS R_Rev(y)) ¥R_PLUS y = R_Rev(x) ¥R_PLUS R_0
	(R_Rev(x))-->T626 ==> R_Rev(x) ¥R_PLUS R_0 = R_Rev(x)
	EQUAL ==> (R_Rev(x) ¥R_PLUS R_Rev(y)) ¥R_PLUS y = R_Rev(x)
	EQUAL ==> ((R_Rev(x) ¥R_PLUS R_Rev(y)) ¥R_PLUS y) ¥R_PLUS x = R_Rev(x) ¥R_PLUS x
	x-->T632 ==> ((R_Rev(x) ¥R_PLUS R_Rev(y)) ¥R_PLUS y) ¥R_PLUS x = R_0
	(R_Rev(x),R_Rev(y))-->T613 ==> (R_Rev(x) ¥R_PLUS R_Rev(y)) in Re
	(R_Rev(x) ¥R_PLUS R_Rev(y),y,x)-->T617 ==> ((R_Rev(x) ¥R_PLUS R_Rev(y)) ¥R_PLUS y) ¥R_PLUS x = (R_Rev(x) ¥R_PLUS R_Rev(y)) ¥R_PLUS (y ¥R_PLUS x)
	(x,y)-->T615 ==> y ¥R_PLUS x = x ¥R_PLUS y
	EQUAL ==> (R_Rev(x) ¥R_PLUS R_Rev(y)) ¥R_PLUS (x ¥R_PLUS y) = R_0
	y-->T632 ==> R_Rev(y) ¥R_PLUS y = R_0
	(x,y)-->T613 ==> (x ¥R_PLUS y) in Re
	(x ¥R_PLUS y)-->T632 ==> R_Rev(x ¥R_PLUS y) ¥R_PLUS (x ¥R_PLUS y) = R_0
	(R_Rev(x ¥R_PLUS y),R_Rev(x) ¥R_PLUS R_Rev(y),x ¥R_PLUS y)-->T634 ==> false; Discharge ==> QED
--
Theorem 639: [Real addition-subtraction commutativity] ((X in Re) & (Y in Re) & (V in Re)) ¥imp (X ¥R_MINUS (Y ¥R_PLUS V) = (X ¥R_MINUS Y) ¥R_MINUS V). Proof:
	Suppose_not(x,y,v) ==> AUTO
	(y,v)-->T613 ==> y ¥R_PLUS v in Re
	(x,y)-->T614 ==> x ¥R_MINUS y in Re
	(x,y ¥R_PLUS v)-->T635 ==> (x ¥R_MINUS (y ¥R_PLUS v)) = (x ¥R_PLUS R_Rev(y ¥R_PLUS v))
	(x ¥R_MINUS y,v)-->T635 ==> ((x ¥R_MINUS y) ¥R_MINUS v) = ((x ¥R_MINUS y) ¥R_PLUS R_Rev(v))
	(x,y)-->T635 ==>x ¥R_MINUS y = x ¥R_PLUS R_Rev(y)
	EQUAL ==> (x ¥R_PLUS R_Rev(y ¥R_PLUS v)) /= ((x ¥R_PLUS R_Rev(y)) ¥R_PLUS R_Rev(v))
	y-->T613 ==> R_Rev(y) in Re
	v-->T613 ==> R_Rev(v) in Re
	(x,R_Rev(y),R_Rev(v))-->T617 ==> (x ¥R_PLUS R_Rev(y ¥R_PLUS v)) /= (x ¥R_PLUS (R_Rev(y) ¥R_PLUS R_Rev(v)))
	(y,v)-->T638 ==> R_Rev(y ¥R_PLUS v) = R_Rev(y) ¥R_PLUS R_Rev(v)
	EQUAL ==> false; Discharge ==> QED
--
Theorem 640: [Real subtraction reverses addition] ((X in Re) & (Y in Re)) ¥imp ((X ¥R_PLUS Y) ¥R_MINUS Y = X). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T613 ==> x ¥R_PLUS y in Re
	(x ¥R_PLUS y,y)-->T635 ==> (x ¥R_PLUS y) ¥R_MINUS y = (x ¥R_PLUS y) ¥R_PLUS R_Rev(y)
	y-->T613 ==> R_Rev(y) in Re
	(x,y,R_Rev(y))-->T617 ==> (x ¥R_PLUS y) ¥R_MINUS y = x ¥R_PLUS (y ¥R_PLUS R_Rev(y))
	y-->T632 ==> R_Rev(y) ¥R_PLUS y = R_0
	(y,R_Rev(y))-->T615 ==> y ¥R_PLUS R_Rev(y) = R_0
	EQUAL ==> (x ¥R_PLUS y) ¥R_MINUS y = x ¥R_PLUS R_0
	x-->T626 ==> false; Discharge ==> QED
--
Theorem 641: [Real subtraction reverses  addition, 2] ((X in Re) & (Y in Re)) ¥imp (X = (Y ¥R_PLUS (X ¥R_MINUS Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T635 ==> x ¥R_MINUS y = x ¥R_PLUS R_Rev(y)
	y-->T613 ==> R_Rev(y) in Re
	(x,R_Rev(y))-->T615 ==> x ¥R_MINUS y = R_Rev(y) ¥R_PLUS x
	EQUAL ==> y ¥R_PLUS (x ¥R_MINUS y) = y ¥R_PLUS (R_Rev(y) ¥R_PLUS x)
	(y,R_Rev(y),x)-->T617 ==> y ¥R_PLUS (x ¥R_MINUS y) = (y ¥R_PLUS R_Rev(y)) ¥R_PLUS x
	y-->T632 ==> R_Rev(y) ¥R_PLUS y = R_0
	(y,R_Rev(y))-->T615 ==> y ¥R_PLUS R_Rev(y) = R_0
	EQUAL ==> y ¥R_PLUS (x ¥R_MINUS y) = R_0 ¥R_PLUS x
	x-->T626 ==> false; Discharge ==> QED
--
Theorem 642: [Multiplication by $R_Rev(R_1)$] (X in Re) ¥imp (R_Rev(X) = R_Rev(R_1) ¥R_TIMES X). Proof:
	Suppose_not(x) ==> AUTO
	T612 ==> R_1 in Re
	(R_1,R_1)-->T613 ==> R_Rev(R_1) in Re
	(x,x)-->T613 ==> R_Rev(x) in Re
	(x,R_Rev(R_1))-->T614 ==> x ¥R_TIMES R_Rev(R_1) in Re
	(x,R_Rev(R_1))-->T618 ==> R_Rev(x) /= x ¥R_TIMES R_Rev(R_1)
	(R_Rev(x),x ¥R_TIMES R_Rev(R_1),x)-->T634 ==> R_Rev(x) ¥R_PLUS x /= (x ¥R_TIMES R_Rev(R_1)) ¥R_PLUS x
	x-->T632 ==> R_0 /= (x ¥R_TIMES R_Rev(R_1)) ¥R_PLUS x
	x-->T627 ==> x = x ¥R_TIMES R_1
	EQUAL ==> R_0 /= (x ¥R_TIMES R_Rev(R_1)) ¥R_PLUS (x ¥R_TIMES R_1)
	(x,R_Rev(R_1),R_1)-->T621 ==> R_0 /= (x ¥R_TIMES (R_Rev(R_1) ¥R_PLUS R_1))
	R_1-->T632 ==> R_Rev(R_1) ¥R_PLUS R_1 = R_0
	EQUAL ==> R_0 /= x ¥R_TIMES R_0
	x-->T624 ==> false; Discharge ==> QED
--
Theorem 643: [Distributivity of multiplication over subtraction] ((X in Re) & (Y in Re) & (V in Re)) ¥imp ((X ¥R_TIMES (Y ¥R_MINUS V)) = ((X ¥R_TIMES Y) ¥R_MINUS (X ¥R_TIMES V))). Proof:
	Suppose_not(x,y,v) ==> AUTO
	(x,y)-->T614 ==> (x ¥R_TIMES y) in Re
	(x,v)-->T614 ==> (x ¥R_TIMES v) in Re
	(x ¥R_TIMES v,x ¥R_TIMES v)-->T613 ==> R_Rev(x ¥R_TIMES v) in Re
	(v,v)-->T613 ==> R_Rev(v) in Re
	(y,v)-->T614 ==> (y ¥R_MINUS v) in Re
	(x,y ¥R_MINUS v)-->T614 ==> x ¥R_TIMES (y ¥R_MINUS v) in Re
	(x ¥R_TIMES y,x ¥R_TIMES v)-->T614 ==> (x ¥R_TIMES y) ¥R_MINUS (x ¥R_TIMES v) in Re
	(x ¥R_TIMES (y ¥R_MINUS v),(x ¥R_TIMES y) ¥R_MINUS (x ¥R_TIMES v),x ¥R_TIMES v)-->T634 ==> (x ¥R_TIMES (y ¥R_MINUS v)) ¥R_PLUS (x ¥R_TIMES v) /= ((x ¥R_TIMES y) ¥R_MINUS (x ¥R_TIMES v)) ¥R_PLUS (x ¥R_TIMES v)
	(x,y ¥R_MINUS v,v)-->T621 ==> (x ¥R_TIMES ((y ¥R_MINUS v) ¥R_PLUS v)) /= ((x ¥R_TIMES y) ¥R_MINUS (x ¥R_TIMES v)) ¥R_PLUS (x ¥R_TIMES v)
	(x ¥R_TIMES y,x ¥R_TIMES v)-->T635 ==> (x ¥R_TIMES y) ¥R_MINUS (x ¥R_TIMES v) = (x ¥R_TIMES y) ¥R_PLUS R_Rev(x ¥R_TIMES v)
	EQUAL ==> (x ¥R_TIMES ((y ¥R_MINUS v) ¥R_PLUS v)) /= ((x ¥R_TIMES y) ¥R_PLUS R_Rev(x ¥R_TIMES v)) ¥R_PLUS (x ¥R_TIMES v)
	(x ¥R_TIMES y,R_Rev(x ¥R_TIMES v),x ¥R_TIMES v)-->T617 ==> (x ¥R_TIMES ((y ¥R_MINUS v) ¥R_PLUS v)) /= (x ¥R_TIMES y) ¥R_PLUS (R_Rev(x ¥R_TIMES v) ¥R_PLUS (x ¥R_TIMES v))
	(x ¥R_TIMES v)-->T632 ==> R_Rev(x ¥R_TIMES v) ¥R_PLUS (x ¥R_TIMES v) = R_0
	EQUAL ==>  (x ¥R_TIMES ((y ¥R_MINUS v) ¥R_PLUS v)) /= (x ¥R_TIMES y) ¥R_PLUS R_0
	(x ¥R_TIMES y)-->T626 ==> (x ¥R_TIMES y) ¥R_PLUS R_0 = (x ¥R_TIMES y)
	ELEM ==> (x ¥R_TIMES ((y ¥R_MINUS v) ¥R_PLUS v)) /= (x ¥R_TIMES y)
	(y,v)-->T635 ==> y ¥R_MINUS v = y ¥R_PLUS R_Rev(v)
	EQUAL ==> (x ¥R_TIMES ((y ¥R_PLUS R_Rev(v)) ¥R_PLUS v)) /= (x ¥R_TIMES y)
	(y,R_Rev(v),v)-->T617 ==> ((y ¥R_PLUS R_Rev(v)) ¥R_PLUS v) = y ¥R_PLUS (R_Rev(v) ¥R_PLUS v)
	v-->T632 ==> R_Rev(v) ¥R_PLUS v = R_0
	EQUAL ==> (x ¥R_TIMES (y ¥R_PLUS R_0)) /= (x ¥R_TIMES y)
	y-->T626 ==> y ¥R_PLUS R_0 = y
	EQUAL ==> false; Discharge ==> QED
--
Theorem 644: [Additive inverse of real difference] ((X in Re) & (Y in Re)) ¥imp (R_Rev(X ¥R_MINUS Y) = (Y ¥R_MINUS X)). Proof:
Suppose_not(x,y) ==> AUTO
--
-- Assuming the negative of the statement to hold for $x$ and $y$,
-- we reach a contradiction as follows. Theorem 614
-- ensures us that the difference $x ¥R_MINUS y$ belongs to $Re$.
--
	(x,y)-->T614 ==> AUTO
--
-- Moreover, thanks to Theorem 642,
-- each term of the form $R_Rev(z)$, with $z in Re$, can be
-- rewritten as $R_Rev(R_1) ¥R_TIMES z$.
--
	x-->T642 ==> AUTO
	y-->T642 ==> AUTO
	(x ¥R_MINUS y)-->T642(*) ==> Stat1: (R_Rev(x ¥R_MINUS y) = (R_Rev(R_1) ¥R_TIMES (x ¥R_MINUS y))) &
		(R_Rev(x) = (R_Rev(R_1) ¥R_TIMES x)) & (R_Rev(y) = (R_Rev(R_1) ¥R_TIMES y))
--
-- After noticing that  $R_Rev(R_1),R_Rev(x),R_Rev(y)$ belong to $Re$,
-- we can distribute $R_Rev(R_1)$ over the difference $x ¥R_MINUS y$,
-- thus obtaining for $R_Rev(x ¥R_MINUS y)$ the expression
--	$(R_Rev(R_1) ¥R_TIMES x) ¥R_MINUS (R_Rev(R_1) ¥R_TIMES y)$,
-- also writable as $R_Rev(x) ¥R_MINUS R_Rev(y)$, .
-- Moreover, note that $R_Rev(R_Rev(y))=y$ by Theorem 633.
--
	()-->T612 ==> AUTO
	(R_1,R_1)-->T613 ==> AUTO
	(R_Rev(R_1),x,y)-->T643(*) ==> Stat2: R_Rev(x ¥R_MINUS y) = ((R_Rev(R_1) ¥R_TIMES x) ¥R_MINUS (R_Rev(R_1) ¥R_TIMES y))
	(x,x)-->T613 ==> AUTO
	(y,y)-->T613 ==> AUTO
	y-->T633(*) ==> (R_Rev(R_Rev(y)) = y) & (R_Rev(x) in Re) & (R_Rev(y) in Re)
--
-- Hence, if we re-express difference $R_Rev(x) ¥R_MINUS R_Rev(y)$
-- in terms of addition and additive inverse operation,
-- then by means of the commutativity of addition we get the desired contradiction.
--
	(R_Rev(x),R_Rev(y))-->T635(Stat2*) ==> (R_Rev(x) ¥R_MINUS R_Rev(y)) = (R_Rev(x) ¥R_PLUS R_Rev(R_Rev(y)))
	(R_Rev(x),y)-->T615(*) ==> (R_Rev(x) ¥R_PLUS y) = (y ¥R_PLUS R_Rev(x))
	EQUAL(Stat1) ==> R_Rev(x ¥R_MINUS y) = (y ¥R_PLUS R_Rev(x))
(y,x)-->T635(*) ==> false; Discharge ==> QED
--
Theorem 645: [Real reciprocal principle] ((X in Re) & (X /= R_0)) ¥imp (X ¥R_TIMES R_Recip(X) = R_1). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	T545(*) ==> (Ra0Seq in RaCauchy) & (Ra1Seq in RaCauchy)
	Suppose ==> Ra_eqseq(arb(x),Ra0Seq)
	(arb(x),Ra0Seq)-->T610 ==> x = Cauchy_to_Re(Ra0Seq)
	Use_def(R_0) ==> false
	Discharge ==> not Ra_eqseq(arb(x),Ra0Seq)
	(arb(x),arb(x))-->T570 ==> Ras_Recip(arb(x)) in RaCauchy
	(arb(x),Ras_Recip(arb(x)))-->T561 ==> arb(x) ¥Ras_TIMES Ras_Recip(arb(x)) in RaCauchy
	(arb(x))-->T591 ==> Ra_eqseq(arb(x) ¥Ras_TIMES Ras_Recip(arb(x)),Ra1Seq)
	(arb(x) ¥Ras_TIMES Ras_Recip(arb(x)),Ra1Seq)-->T610 ==> Cauchy_to_Re(arb(x) ¥Ras_TIMES Ras_Recip(arb(x))) = Cauchy_to_Re(Ra1Seq)
	(arb(x),Ras_Recip(arb(x)))-->T619 ==> Cauchy_to_Re(arb(x)) ¥R_TIMES Cauchy_to_Re(Ras_Recip(arb(x))) = Cauchy_to_Re(Ra1Seq)
	Use_def(R_Recip) ==> Cauchy_to_Re(arb(x)) ¥R_TIMES R_Recip(x) = Cauchy_to_Re(Ra1Seq)
	Use_def(R_1) ==> Cauchy_to_Re(arb(x)) ¥R_TIMES R_Recip(x) = R_1
	EQUAL ==> false; Discharge ==> QED
--
Theorem 646: [Real division principle] ((X in Re) & (X /= R_0)) ¥imp (X ¥R_OVER X = R_1). Proof:
	Suppose_not(x) ==> AUTO
	Use_def(¥R_OVER) ==> x ¥R_TIMES R_Recip(x) /= R_1
	x-->T645 ==> false; Discharge ==> QED
--
Theorem 647: [Basic properties of the reciprocal for reals] ((X in Re) & (X /= R_0)) ¥imp ((R_Recip(X) in Re) & (R_Recip(X) /= R_0) & ((R_Recip(X) ¥R_TIMES X) = R_1)). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	T545(*) ==> (Ra0Seq in RaCauchy) & (Ra1Seq in RaCauchy)
	Suppose ==> Ra_eqseq(arb(x),Ra0Seq)
	(arb(x),Ra0Seq)-->T610 ==> x = Cauchy_to_Re(Ra0Seq)
	Use_def(R_0) ==> false; Discharge ==> not Ra_eqseq(arb(x),Ra0Seq)
	Use_def(R_Recip) ==> R_Recip(x) = Cauchy_to_Re(Ras_Recip(arb(x)))
	(arb(x),arb(x))-->T570 ==> Ras_Recip(arb(x)) in RaCauchy
	(Ras_Recip(arb(x)),arb(x))-->T610 ==> R_Recip(x) in Re
	Suppose ==> (R_Recip(x) ¥R_TIMES x) /= R_1
		x-->T645 ==> (x ¥R_TIMES R_Recip(x)) = R_1
		(x,R_Recip(x))-->T618 ==> (x ¥R_TIMES R_Recip(x)) = (R_Recip(x) ¥R_TIMES x)
	EQUAL ==> false; Discharge ==> R_Recip(x) = R_0
	Use_def(R_Recip) ==> Cauchy_to_Re(Ras_Recip(arb(x))) = R_0
	Use_def(R_0) ==> Cauchy_to_Re(Ras_Recip(arb(x))) = Cauchy_to_Re(Ra0Seq)
	(Ras_Recip(arb(x)),Ra0Seq)-->T610 ==> Ra_eqseq(Ras_Recip(arb(x)),Ra0Seq)
	(arb(x))-->T546 ==> Ra_eqseq(arb(x),arb(x))
	(arb(x),arb(x),Ras_Recip(arb(x)),Ra0Seq)-->T574 ==> Ra_eqseq(arb(x) ¥Ras_TIMES Ras_Recip(arb(x)),arb(x) ¥Ras_TIMES Ra0Seq)
	(arb(x))-->T586 ==> (arb(x) ¥Ras_TIMES Ra0Seq) = Ra0Seq
	EQUAL ==> Ra_eqseq(arb(x) ¥Ras_TIMES Ras_Recip(arb(x)),Ra0Seq)
	(arb(x))-->T591 ==> Ra_eqseq(arb(x) ¥Ras_TIMES Ras_Recip(arb(x)),Ra1Seq)
	T539(*) ==> (Ra1Seq in RaSeq) & (Ras_Recip(arb(x)) in RaSeq) & (Ra0Seq in RaSeq)
	Ra1Seq-->T546 ==> Ra_eqseq(Ra1Seq,Ra1Seq)
	(arb(x),Ras_Recip(arb(x)))-->T554 ==> (arb(x) ¥Ras_TIMES Ras_Recip(arb(x))) in RaSeq
	(arb(x) ¥Ras_TIMES Ras_Recip(arb(x)),Ra1Seq,Ra1Seq)-->T553 ==> Ra_eqseq(Ra1Seq,arb(x) ¥Ras_TIMES Ras_Recip(arb(x)))
	(Ra1Seq,arb(x) ¥Ras_TIMES Ras_Recip(arb(x)),Ra0Seq)-->T553 ==> Ra_eqseq(Ra0Seq,Ra1Seq)
	T603 ==> false; Discharge ==> QED
--
Theorem 648: [Basic properties of the reciprocal for reals, 2] ((X in Re) & (X /= R_0)) ¥imp (R_Recip(R_Recip(X)) = X). Proof:
	Suppose_not(x) ==> AUTO
	x-->T647 ==> (R_Recip(x) in Re) & (R_Recip(x) /= R_0)
	(R_Recip(x))-->T647 ==> R_Recip(R_Recip(x)) in Re
	(R_Recip(R_Recip(x)),R_Recip(x),x)-->T620 ==> (R_Recip(R_Recip(x)) ¥R_TIMES R_Recip(x)) ¥R_TIMES x = R_Recip(R_Recip(x)) ¥R_TIMES (R_Recip(x) ¥R_TIMES x)
	x-->T647 ==> R_Recip(x) ¥R_TIMES x = R_1
	(R_Recip(x))-->T647 ==> R_Recip(R_Recip(x)) ¥R_TIMES R_Recip(x) = R_1
	EQUAL ==> R_1 ¥R_TIMES x = R_Recip(R_Recip(x)) ¥R_TIMES R_1
	x-->T628 ==> x = R_Recip(R_Recip(x)) ¥R_TIMES R_1
	(R_Recip(R_Recip(x)))-->T627 ==> R_Recip(R_Recip(x)) = R_Recip(R_Recip(x)) ¥R_TIMES R_1
	Discharge ==> QED
--
Theorem 649: [Reverse of real reciprocal] ((X in Re) & (X /= R_0)) ¥imp (R_Recip(R_Rev(X)) = R_Rev(R_Recip(X))). Proof:
Suppose_not(x) ==> AUTO
--
-- We will reduce the expression $(R_Rev(x) ¥R_TIMES R_Recip(R_Rev(x))) ¥R_TIMES R_Rev(R_Recip(x))$
-- to $R_Rev(R_Recip(x))$ on the one hand, and to $R_Recip(R_Recip(x))$ on the other.
--
	(x,x)-->T613(*) ==> Stat1: R_Rev(x) in Re
	Suppose ==> R_Rev(x) = R_0
		x-->T626(*) ==> (x ¥R_PLUS R_0) = x
		x-->T636(*) ==> (x ¥R_PLUS R_Rev(x)) = R_0
	EQUAL ==> false; Discharge ==> R_Rev(x) /= R_0
	(R_Rev(x))-->T647(*) ==> Stat2: (R_Recip(R_Rev(x)) in Re) & (R_Recip(R_Rev(x)) /= R_0)
	(R_Rev(x))-->T645(*) ==> Stat3: (R_Rev(x) ¥R_TIMES R_Recip(R_Rev(x))) = R_1
	x-->T647(*) ==> R_Recip(x) in Re
	(R_Recip(x),R_Recip(x))-->T613(*) ==> R_Rev(R_Recip(x)) in Re
	(R_Rev(R_Recip(x)))-->T628(*) ==> (R_1 ¥R_TIMES R_Rev(R_Recip(x))) = R_Rev(R_Recip(x))
	EQUAL(Stat3) ==> (R_Rev(x) ¥R_TIMES R_Recip(R_Rev(x))) ¥R_TIMES R_Rev(R_Recip(x)) = R_Rev(R_Recip(x))
--
	(R_Rev(x),R_Recip(R_Rev(x)))-->T618(*) ==> Stat4: (R_Rev(x) ¥R_TIMES R_Recip(R_Rev(x))) = (R_Recip(R_Rev(x)) ¥R_TIMES R_Rev(x))
	(R_Recip(R_Rev(x)),R_Rev(x))-->T614(Stat1,Stat2*) ==> (R_Recip(R_Rev(x)) ¥R_TIMES R_Rev(x)) in Re
	(R_Recip(R_Rev(x)) ¥R_TIMES R_Rev(x),R_Recip(x))-->T623(*) ==> ((R_Recip(R_Rev(x)) ¥R_TIMES R_Rev(x)) ¥R_TIMES R_Rev(R_Recip(x))) = R_Rev((R_Recip(R_Rev(x)) ¥R_TIMES R_Rev(x)) ¥R_TIMES R_Recip(x))
	(R_Recip(R_Rev(x)),R_Rev(x),R_Recip(x))-->T620(*) ==> ((R_Recip(R_Rev(x)) ¥R_TIMES R_Rev(x)) ¥R_TIMES R_Recip(x)) = (R_Recip(R_Rev(x)) ¥R_TIMES (R_Rev(x) ¥R_TIMES R_Recip(x)))
	(x,R_Recip(x))-->T623(*) ==> (R_Rev(x) ¥R_TIMES R_Recip(x)) = R_Rev(x ¥R_TIMES R_Recip(x))
	x-->T645(*) ==> (x ¥R_TIMES R_Recip(x)) = R_1
	T612(*) ==> R_1 in Re
	(R_Recip(R_Rev(x)),R_1)-->T623(*) ==> (R_Recip(R_Rev(x)) ¥R_TIMES R_Rev(R_1)) = R_Rev(R_Recip(R_Rev(x)) ¥R_TIMES R_1)
	(R_Recip(R_Rev(x)))-->T627(*) ==> (R_Recip(R_Rev(x)) ¥R_TIMES R_1) = R_Recip(R_Rev(x))
	(R_Recip(R_Rev(x)))-->T633(*) ==> R_Rev(R_Rev(R_Recip(R_Rev(x)))) = R_Recip(R_Rev(x))
	EQUAL(Stat4) ==> (R_Rev(x) ¥R_TIMES R_Recip(R_Rev(x))) ¥R_TIMES R_Rev(R_Recip(x)) = R_Recip(R_Rev(x))
Discharge ==> QED
--
Theorem 650: [Real multiplicative Cancellation] ((X in Re) & (Y in Re) & (V in Re) & (X ¥R_TIMES V = Y ¥R_TIMES V) & (V /= R_0)) ¥imp (X = Y). Proof:
	Suppose_not(x,y,v) ==> (x in Re) & (y in Re) & (v in Re) & (x ¥R_TIMES v = y ¥R_TIMES v) & (v /= R_0) & (x /= y)
	(x,v)-->T614 ==> x ¥R_TIMES v in Re
	(y,v)-->T614 ==> y ¥R_TIMES v in Re
	EQUAL ==> ((x ¥R_TIMES v) ¥R_TIMES R_Recip(v)) = ((y ¥R_TIMES v) ¥R_TIMES R_Recip(v))
	v-->T647 ==> (R_Recip(v) in Re) & (R_Recip(v) /= R_0) & (R_Recip(v) ¥R_TIMES v = R_1)
	(v,R_Recip(v))-->T618 ==> (v ¥R_TIMES R_Recip(v)) = R_1
	(x,v,R_Recip(v))-->T620 ==> ((x ¥R_TIMES v) ¥R_TIMES R_Recip(v)) = (x ¥R_TIMES (v ¥R_TIMES R_Recip(v)))
	(y,v,R_Recip(v))-->T620 ==> ((y ¥R_TIMES v) ¥R_TIMES R_Recip(v)) = (y ¥R_TIMES (v ¥R_TIMES R_Recip(v)))
	EQUAL ==> (x ¥R_TIMES R_1) = (y ¥R_TIMES R_1)
	x-->T627 ==> x ¥R_TIMES R_1 = x
	y-->T627 ==> false; Discharge ==> QED
--
Theorem 651: [Reals are closed under division] ((X in Re) & (Y in Re) & (Y /= R_0)) ¥imp ((X ¥R_OVER Y in Re) & ((X /= R_0) ¥imp ((X ¥R_OVER Y /= R_0) & (X ¥R_TIMES Y /= R_0)))). Proof:
	Suppose_not(x,y) ==> AUTO
	y-->T647 ==> (R_Recip(y) in Re) & (R_Recip(y) /= R_0)
	T612 ==> R_0 in Re
	Suppose ==> x ¥R_OVER y notin Re
	Use_def(¥R_OVER) ==> x ¥R_TIMES R_Recip(y) notin Re
	(x,R_Recip(y))-->T614 ==> false; Discharge ==> (x /= R_0) & ((x ¥R_OVER y = R_0) or (x ¥R_TIMES y = R_0))
	Suppose ==> x ¥R_OVER y = R_0
	Use_def(¥R_OVER) ==> x ¥R_TIMES R_Recip(y) = R_0
	(R_Recip(y))-->T625 ==> R_0 ¥R_TIMES R_Recip(y) = R_0
	(x,R_0,R_Recip(y))-->T650 ==> false; Discharge ==> x ¥R_TIMES y = R_0
	y-->T625 ==> R_0 ¥R_TIMES y = R_0
	(x,R_0,y)-->T650 ==> false; Discharge ==> QED
--
Theorem 652: [Real division is multiplication by the reciprocal] ((X in Re) & (Y in Re) & (Y /= R_0)) ¥imp ((X ¥R_OVER Y) = (X ¥R_TIMES R_Recip(Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	Use_def(¥R_OVER) ==> false; Discharge ==> QED
--
Theorem 653: [The reciprocal of a real product is the product of the reciprocals] ((X in Re) & (Y in Re) & (X /= R_0) & (Y /= R_0)) ¥imp ((X ¥R_TIMES Y /= R_0) & R_Recip(X ¥R_TIMES Y) = R_Recip(X) ¥R_TIMES R_Recip(Y)). Proof:
	Suppose_not(x,y) ==> AUTO
	x-->T647 ==> (R_Recip(x) in Re) & (R_Recip(x) /= R_0)
	y-->T647 ==> (R_Recip(y) in Re) & (R_Recip(y) /= R_0)
	(R_Recip(x),R_Recip(y))-->T614 ==> R_Recip(x) ¥R_TIMES R_Recip(y) in Re
	(x,y)-->T614 ==> x ¥R_TIMES y in Re
	Suppose ==> x ¥R_TIMES y = R_0
		y-->T625 ==> R_0 ¥R_TIMES y = R_0
		T625 ==> R_0 in Re
		(x,R_0,y)-->T650 ==> false; Discharge ==> x ¥R_TIMES y /= R_0
	(x ¥R_TIMES y)-->T647 ==> R_Recip(x ¥R_TIMES y) in Re
	(R_Recip(x ¥R_TIMES y),(R_Recip(x) ¥R_TIMES R_Recip(y)),y)-->T650 ==> R_Recip(x ¥R_TIMES y) ¥R_TIMES y /= (R_Recip(x) ¥R_TIMES R_Recip(y)) ¥R_TIMES y
	(R_Recip(x),R_Recip(y),y)-->T620 ==> (R_Recip(x) ¥R_TIMES R_Recip(y)) ¥R_TIMES y = R_Recip(x) ¥R_TIMES (R_Recip(y) ¥R_TIMES y)
	y-->T647 ==> R_Recip(y) ¥R_TIMES y = R_1
	EQUAL ==> (R_Recip(x) ¥R_TIMES R_Recip(y)) ¥R_TIMES y = R_Recip(x) ¥R_TIMES R_1
	(R_Recip(x))-->T627 ==> R_Recip(x) ¥R_TIMES R_1 = R_Recip(x)
	EQUAL ==> (R_Recip(x) ¥R_TIMES R_Recip(y)) ¥R_TIMES y = R_Recip(x)
	EQUAL ==> ((R_Recip(x) ¥R_TIMES R_Recip(y)) ¥R_TIMES y) ¥R_TIMES x = R_Recip(x) ¥R_TIMES x
	x-->T647 ==> ((R_Recip(x) ¥R_TIMES R_Recip(y)) ¥R_TIMES y) ¥R_TIMES x = R_1
	(R_Recip(x),R_Recip(y))-->T613 ==> (R_Recip(x) ¥R_TIMES R_Recip(y)) in Re
	(R_Recip(x) ¥R_TIMES R_Recip(y),y,x)-->T620 ==> ((R_Recip(x) ¥R_TIMES R_Recip(y)) ¥R_TIMES y) ¥R_TIMES x = (R_Recip(x) ¥R_TIMES R_Recip(y)) ¥R_TIMES (y ¥R_TIMES x)
	(x,y)-->T618 ==> y ¥R_TIMES x = x ¥R_TIMES y
	EQUAL ==> (R_Recip(x) ¥R_TIMES R_Recip(y)) ¥R_TIMES (x ¥R_TIMES y) = R_1
	y-->T632 ==> R_Recip(y) ¥R_TIMES y = R_1
	(x,y)-->T613 ==> (x ¥R_TIMES y) in Re
	(x ¥R_TIMES y)-->T647 ==> R_Recip(x ¥R_TIMES y) ¥R_TIMES (x ¥R_TIMES y) = R_1
	(R_Recip(x ¥R_TIMES y),R_Recip(x) ¥R_TIMES R_Recip(y),x ¥R_TIMES y)-->T650 ==> false; Discharge ==> QED
--
Theorem 654: [Real multiplication-division commutativity] ((X in Re) & (Y in Re) & (Y /= R_0) & (V in Re) & (V /= R_0)) ¥imp (X ¥R_OVER (Y ¥R_TIMES V) = (X ¥R_OVER Y) ¥R_OVER V). Proof:
	Suppose_not(x,y,v) ==> AUTO
	(x,y)-->T651 ==> x ¥R_OVER y in Re
	(y,v)-->T651 ==> y ¥R_TIMES v /= R_0
	(y,v)-->T614 ==> y ¥R_TIMES v in Re
	(x,y ¥R_TIMES v)-->T652 ==> (x ¥R_OVER (y ¥R_TIMES v)) = (x ¥R_TIMES R_Recip(y ¥R_TIMES v))
	(x ¥R_OVER y,v)-->T652 ==> ((x ¥R_OVER y) ¥R_OVER v) = ((x ¥R_OVER y) ¥R_TIMES R_Recip(v))
	(x,y)-->T652 ==>x ¥R_OVER y = x ¥R_TIMES R_Recip(y)
	EQUAL ==> (x ¥R_TIMES R_Recip(y ¥R_TIMES v)) /= ((x ¥R_TIMES R_Recip(y)) ¥R_TIMES R_Recip(v))
	y-->T647 ==> R_Recip(y) in Re
	v-->T647 ==> R_Recip(v) in Re
	(x,R_Recip(y),R_Recip(v))-->T620 ==> (x ¥R_TIMES R_Recip(y ¥R_TIMES v)) /= (x ¥R_TIMES (R_Recip(y) ¥R_TIMES R_Recip(v)))
	(y ¥R_TIMES v)-->T647 ==> R_Recip(y ¥R_TIMES v) in Re
	(R_Recip(y),R_Recip(v))-->T614 ==> R_Recip(y) ¥R_TIMES R_Recip(v) in Re
	(x,R_Recip(y ¥R_TIMES v))-->T618 ==> x ¥R_TIMES R_Recip(y ¥R_TIMES v) = R_Recip(y ¥R_TIMES v) ¥R_TIMES x
	(x,R_Recip(y) ¥R_TIMES R_Recip(v))-->T618 ==> x ¥R_TIMES (R_Recip(y) ¥R_TIMES R_Recip(v)) = (R_Recip(y) ¥R_TIMES R_Recip(v)) ¥R_TIMES x
	(x,R_Recip(y),R_Recip(v))-->T620 ==> (x ¥R_TIMES R_Recip(y ¥R_TIMES v)) /= (x ¥R_TIMES (R_Recip(y) ¥R_TIMES R_Recip(v)))
	ELEM ==> (R_Recip(y) ¥R_TIMES R_Recip(v)) ¥R_TIMES x /= R_Recip(y ¥R_TIMES v) ¥R_TIMES x
	Suppose ==> R_Recip(y ¥R_TIMES v) = R_Recip(y) ¥R_TIMES R_Recip(v)
	EQUAL ==> false; Discharge ==> R_Recip(y ¥R_TIMES v) /= R_Recip(y) ¥R_TIMES R_Recip(v)
	(y,v)-->T653 ==> false; Discharge ==> QED
--
Theorem 655: [A real divided by itself gives 1] ((X in Re) & (X /= R_0)) ¥imp (X ¥R_OVER X = R_1). Proof:
	Suppose_not(x) ==> AUTO
	Use_def(¥R_OVER) ==> x ¥R_TIMES R_Recip(x) /= R_1
	x-->T645 ==> false; Discharge ==> QED
--
Theorem 656: [Real reciprocal as a quotient] ((X in Re) & (X /= R_0)) ¥imp (R_Recip(X) = R_1 ¥R_OVER X). Proof:
	Suppose_not(x) ==> AUTO
	Use_def(¥R_OVER) ==> R_1 ¥R_OVER x = R_1 ¥R_TIMES R_Recip(x)
	x-->T647 ==> R_Recip(x) in Re
	(R_Recip(X))-->T628 ==> false; Discharge ==> QED
--
Theorem 657: [Distributivity of division over addition] ((X in Re) & (Y in Re) & (V in Re) & (V /= R_0)) ¥imp ((X ¥R_PLUS Y) ¥R_OVER V = ((X ¥R_OVER V) ¥R_PLUS (Y ¥R_OVER V))). Proof:
	Suppose_not(x,y,v) ==> AUTO
	Use_def(¥R_OVER) ==> ((x ¥R_PLUS y) ¥R_TIMES R_Recip(v)) /= ((x ¥R_TIMES R_Recip(v)) ¥R_PLUS (y ¥R_TIMES R_Recip(v)))
	v-->T647 ==> R_Recip(v) in Re
	(x,y)-->T613 ==> x ¥R_PLUS y in Re
	(x,R_Recip(v))-->T618 ==> x ¥R_TIMES R_Recip(v) = R_Recip(v) ¥R_TIMES x
	(y,R_Recip(v))-->T618 ==> y ¥R_TIMES R_Recip(v) = R_Recip(v) ¥R_TIMES y
	(x ¥R_PLUS y,R_Recip(v))-->T618 ==> ((x ¥R_PLUS y) ¥R_TIMES R_Recip(v)) = (R_Recip(v) ¥R_TIMES (x ¥R_PLUS y))
	EQUAL ==> ((x ¥R_TIMES R_Recip(v)) ¥R_PLUS (y ¥R_TIMES R_Recip(v))) = ((R_Recip(v) ¥R_TIMES x) ¥R_PLUS (R_Recip(v) ¥R_TIMES y))
	EQUAL ==> (R_Recip(v) ¥R_TIMES (x ¥R_PLUS y)) /= ((R_Recip(v) ¥R_TIMES x) ¥R_PLUS (R_Recip(v) ¥R_TIMES y))
	(R_Recip(v),x,y)-->T621 ==> false; Discharge ==> QED
--
Theorem 658: [Real division reverses multiplication] ((X in Re) & (Y in Re) & (Y /= R_0)) ¥imp ((X ¥R_TIMES Y) ¥R_OVER Y = X). Proof:
	Suppose_not(x,y) ==> AUTO
	Use_def(¥R_OVER) ==> (x ¥R_TIMES y) ¥R_TIMES R_Recip(y) /= x
	y-->T647 ==> R_Recip(y) in Re
	(x,y,R_Recip(y))-->T620 ==> x ¥R_TIMES (y ¥R_TIMES R_Recip(y)) /= x
	y-->T645 ==> y ¥R_TIMES R_Recip(y) = R_1
	EQUAL ==> x ¥R_TIMES R_1 /= x
	x-->T627 ==> false; Discharge ==> QED
--
Theorem 659: [Real division reverses multiplication,2] ((X in Re) & (Y in Re) & (Y /= R_0)) ¥imp (X = (Y ¥R_TIMES (X ¥R_OVER Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	Use_def(¥R_OVER) ==> (y ¥R_TIMES (x ¥R_TIMES R_Recip(y))) /= x
	y-->T647 ==> R_Recip(y) in Re
	(x,R_Recip(y))-->T618 ==> x ¥R_TIMES R_Recip(y) = R_Recip(y) ¥R_TIMES x
	EQUAL ==> (y ¥R_TIMES (R_Recip(y) ¥R_TIMES x)) /= x
	(y,R_Recip(y),x)-->T620 ==> (y ¥R_TIMES R_Recip(y)) ¥R_TIMES x /= x
	y-->T645 ==> y ¥R_TIMES R_Recip(y) = R_1
	EQUAL ==> R_1 ¥R_TIMES x /= x
	x-->T628 ==> false; Discharge ==> QED
--
Theorem 660: [Distributivity of division over subtraction] ((X in Re) & (Y in Re) & (V in Re) & (V /= R_0)) ¥imp (((X ¥R_MINUS Y) ¥R_OVER V) = ((X ¥R_OVER V) ¥R_MINUS (Y ¥R_OVER V))). Proof:
	Suppose_not(x,y,v) ==> AUTO
	Use_def(¥R_OVER) ==> ((x ¥R_MINUS y) ¥R_TIMES R_Recip(v)) /= ((x ¥R_TIMES R_Recip(v)) ¥R_MINUS (y ¥R_TIMES R_Recip(v)))
	v-->T647 ==> R_Recip(v) in Re
	(x,y)-->T614 ==> x ¥R_MINUS y in Re
	(x,R_Recip(v))-->T618 ==> x ¥R_TIMES R_Recip(v) = R_Recip(v) ¥R_TIMES x
	(y,R_Recip(v))-->T618 ==> y ¥R_TIMES R_Recip(v) = R_Recip(v) ¥R_TIMES y
	(x ¥R_MINUS y,R_Recip(v))-->T618 ==> ((x ¥R_MINUS y) ¥R_TIMES R_Recip(v)) = (R_Recip(v) ¥R_TIMES (x ¥R_MINUS y))
	EQUAL ==> ((x ¥R_TIMES R_Recip(v)) ¥R_MINUS (y ¥R_TIMES R_Recip(v))) = ((R_Recip(v) ¥R_TIMES x) ¥R_MINUS (R_Recip(v) ¥R_TIMES y))
	EQUAL ==> (R_Recip(v) ¥R_TIMES (x ¥R_MINUS y)) /= ((R_Recip(v) ¥R_TIMES x) ¥R_MINUS (R_Recip(v) ¥R_TIMES y))
	(R_Recip(v),x,y)-->T643 ==> false; Discharge ==> QED
--
Theorem 661: (X in Re) ¥imp ((R_Rev(X) = Cauchy_to_Re(arb(R_Rev(X)))) & Ra_eqseq(Ras_ABS(arb(X)),arb(Cauchy_to_Re(Ras_ABS(arb(X)))))). Proof:
Suppose_not(x) ==> AUTO
--
-- In spite of their different syntactic look, the two conclusions of this theorem
-- are obtained by the same formal mechanism. Indeed, both $Ras_Rev(p)$ and $Ras_ABS(p)$
-- are rational Cauchy sequences when $p$ is a rational Cauchy sequence, hence in
-- particular when $p=arb(x)$ for some real number $x$.
-- Therefore, thanks to Theorem 611, if the operation $Cauchy_to_Re(y)$ is applied
-- to either $Ras_Rev(arb(x))$ or $Ras_ABS(arb(x))$, we get the same result as we would
-- obtain by applying the operation $Cauchy_to_Re(arb(Cauchy_to_Re(y)))$ to the
-- same operand.
--
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	(R_Rev(x))-->T611(*) ==> Stat1: (not Ra_eqseq(Ras_ABS(arb(x)),arb(Cauchy_to_Re(Ras_ABS(arb(x))))))
	x-->T611(*) ==> arb(x) in RaCauchy
	(arb(x),arb(x))-->T556(Stat1*) ==> Stat2: Ras_ABS(arb(x)) in RaCauchy
	(Ras_ABS(arb(x)),Ras_ABS(arb(x)))-->T610(Stat2*) ==> Cauchy_to_Re(Ras_ABS(arb(x))) in Re
	(Cauchy_to_Re(Ras_ABS(arb(x))))-->T611(Stat2*) ==> arb(Cauchy_to_Re(Ras_ABS(arb(x)))) in RaCauchy
	(Ras_ABS(arb(x)),arb(Cauchy_to_Re(Ras_ABS(arb(x)))))-->T610(Stat1*) ==> Cauchy_to_Re(Ras_ABS(arb(x))) /= Cauchy_to_Re(arb(Cauchy_to_Re(Ras_ABS(arb(x)))))
(Cauchy_to_Re(Ras_ABS(arb(x))))-->T611(Stat2*) ==> false; Discharge ==> QED
--
Theorem 662: ((X in Re) & (Y in Re)) ¥imp Ra_eqseq((arb(X) ¥Ras_PLUS arb(Y)),arb(Cauchy_to_Re(arb(X) ¥Ras_PLUS arb(Y)))). Proof:
Suppose_not(x,y) ==> AUTO
	ELEM ==> Stat1: (not Ra_eqseq(arb(x) ¥Ras_PLUS arb(y),arb(Cauchy_to_Re((arb(x) ¥Ras_PLUS arb(y))))))
	x-->T611(*) ==> arb(x) in RaCauchy
	y-->T611(*) ==> arb(y) in RaCauchy
	(arb(x),arb(y))-->T556(Stat1*) ==> Stat2: (arb(x) ¥Ras_PLUS arb(y)) in RaCauchy
	(arb(x) ¥Ras_PLUS arb(y),arb(x) ¥Ras_PLUS arb(y))-->T610(Stat2*) ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)) in Re
	(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)))-->T611(Stat2*) ==> arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y))) in RaCauchy
	(arb(x) ¥Ras_PLUS arb(y),arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y))))-->T610(Stat1*) ==> Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)) /= Cauchy_to_Re(arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y))))
(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)))-->T611(Stat2*) ==> false; Discharge ==> QED
--
-- Our next group of theorems, all elementary, deal with real comparisons and a few elementary real inequalities.
--
Theorem 663: [Any real $x$ or its reverse is non-negative, and if both are non-negative, then $x = 0$] (X in Re) ¥imp ((R_is_nonneg(X) or R_is_nonneg(R_Rev(X))) & ((R_is_nonneg(X) & R_is_nonneg(R_Rev(X))) ¥imp (X = R_0))). Proof:
Suppose_not(x) ==> AUTO
	ELEM ==> Stat1: not((R_is_nonneg(x) or R_is_nonneg(R_Rev(x))) & ((R_is_nonneg(X) & R_is_nonneg(R_Rev(X))) ¥imp (X = R_0)))
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	(arb(x))-->T602 ==> ((Ra_eqseq(Ras_ABS(arb(x)),arb(x)) or Ra_eqseq(Ras_ABS(arb(x)),Ras_Rev(arb(x))))) & (((Ra_eqseq(Ras_ABS(arb(x)),arb(x)) & Ra_eqseq(Ras_ABS(arb(x)),Ras_Rev(arb(x))))) ¥imp Ra_eqseq(arb(x),Ra0Seq))
	(arb(x))-->T604 ==> Ras_ABS(Ras_Rev(arb(x))) = Ras_ABS(arb(x))
	EQUAL ==> ((Ra_eqseq(Ras_ABS(arb(x)),arb(x)) or Ra_eqseq(Ras_ABS(Ras_Rev(arb(x))),Ras_Rev(arb(x))))) & (((Ra_eqseq(Ras_ABS(arb(x)),arb(x)) & Ra_eqseq(Ras_ABS(Ras_Rev(arb(x))),Ras_Rev(arb(x))))) ¥imp Ra_eqseq(arb(x),Ra0Seq))
	(arb(x),arb(x))-->T556(*) ==> Stat2: (Ras_ABS(arb(x)) in RaCauchy) & (Ras_Rev(arb(x)) in RaCauchy)
	(Ras_Rev(arb(x)))-->T556(*) ==> Ras_ABS(Ras_Rev(arb(x))) in RaCauchy
	(Ras_ABS(arb(x)),arb(x))-->T610(*) ==> Ra_eqseq(Ras_ABS(arb(x)),arb(x)) ¥eq (Cauchy_to_Re(Ras_ABS(arb(x))) = Cauchy_to_Re(arb(x)))
	(Ras_ABS(Ras_Rev(arb(x))),Ras_Rev(arb(x)))-->T610(*) ==> Ra_eqseq(Ras_ABS(Ras_Rev(arb(x))),Ras_Rev(arb(x))) ¥eq (Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x)))) = Cauchy_to_Re(Ras_Rev(arb(x))))
	T545 ==> Ra0Seq in RaCauchy
	(arb(x),Ra0Seq)-->T610(*) ==> Ra_eqseq(arb(x),Ra0Seq) ¥eq (x = Cauchy_to_Re(Ra0Seq))
	Use_def(R_0) ==> Ra_eqseq(arb(x),Ra0Seq) ¥eq (x = R_0)
	ELEM ==> ((Cauchy_to_Re(Ras_ABS(arb(x))) = x) or (Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x)))) = Cauchy_to_Re(Ras_Rev(arb(x))))) & (((Cauchy_to_Re(Ras_ABS(arb(x))) = x) & (Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x)))) = Cauchy_to_Re(Ras_Rev(arb(x))))) ¥imp Ra_eqseq(arb(x),Ra0Seq))
	Use_def(R_Rev) ==> R_Rev(x) = Cauchy_to_Re(Ras_Rev(arb(x)))
	EQUAL ==> Stat3: ((Cauchy_to_Re(Ras_ABS(arb(x))) = x) or (Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x)))) = R_Rev(x))) & (((Cauchy_to_Re(Ras_ABS(arb(x))) = x) & (Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x)))) = R_Rev(x))) ¥imp (x = R_0))
	Suppose ==> Cauchy_to_Re(Ras_ABS(arb(R_Rev(x)))) /= Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x))))
		(x,x)-->T613(*) ==> R_Rev(x) in Re
		(R_Rev(x))-->T611(Stat3*) ==> arb(R_Rev(x)) in RaCauchy
		(arb(R_Rev(x)),arb(R_Rev(x)))-->T556(Stat3*) ==> Ras_ABS(arb(R_Rev(x))) in RaCauchy
		(Ras_Rev(arb(x)),Ras_Rev(arb(x)))-->T556(Stat2,Stat2*) ==> Ras_ABS(Ras_Rev(arb(x))) in RaCauchy
		(Ras_ABS(arb(R_Rev(x))),Ras_ABS(Ras_Rev(arb(x))))-->T610(Stat3*) ==> (not Ra_eqseq(Ras_ABS(arb(R_Rev(x))),Ras_ABS(Ras_Rev(arb(x)))))
		(arb(R_Rev(x)),Ras_Rev(arb(x)))-->T576(Stat2*) ==> (not Ra_eqseq(arb(R_Rev(x)),Ras_Rev(arb(x))))
		(arb(R_Rev(x)),Ras_Rev(arb(x)))-->T610(Stat2*) ==> Stat4: Cauchy_to_Re(arb(R_Rev(x))) /= Cauchy_to_Re(Ras_Rev(arb(x)))
		x-->T661(*) ==> Cauchy_to_Re(arb(R_Rev(x))) = R_Rev(x)
	Use_def(R_Rev)(Stat4*) ==> false; Discharge ==> Stat5: Cauchy_to_Re(Ras_ABS(arb(R_Rev(x)))) = Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x))))
--
-- The sought contradiction now follows, from the very definition of the non-negativity predicate.
--
--??Use_def(R_is_nonneg)(Stat5*) ==> false; Discharge ==> QED
	Use_def(R_is_nonneg) ==> Stat6: (R_is_nonneg(x) ¥eq (Cauchy_to_Re(Ras_ABS(arb(x))) = x)) & (R_is_nonneg(R_Rev(x)) ¥eq (Cauchy_to_Re(Ras_ABS(arb(R_Rev(x)))) = R_Rev(x)))
(Stat3,Stat5,Stat6,Stat1*)Discharge ==> QED
--
Theorem 664: [Each non-negative rational Cauchy sequences is equivalent to its own absolute value] (X in Re) ¥imp (R_is_nonneg(X) ¥eq Ra_eqseq(arb(X),Ras_ABS(arb(X)))). Proof:
Suppose_not(x0) ==> AUTO
	Use_def(R_is_nonneg)(*) ==> Stat1: (x0 in Re) & ((Cauchy_to_Re(Ras_ABS(arb(x0))) = x0) ¥neq Ra_eqseq(arb(x0),Ras_ABS(arb(x0))))
	x0-->T611(*) ==> Stat2: (arb(x0) in RaCauchy) & (Cauchy_to_Re(arb(x0)) = x0)
	(arb(x0),arb(x0))-->T556(Stat2*) ==> Ras_ABS(arb(x0)) in RaCauchy
(arb(x0),Ras_ABS(arb(x0)))-->T610(*) ==> false; Discharge ==> QED
--
Theorem 665: [The sum of two non-negative rational Cauchy sequences is equivalent to its own absolute value] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) ¥imp Ra_eqseq(arb(X) ¥Ras_PLUS arb(Y),Ras_ABS(arb(X) ¥Ras_PLUS arb(Y))). Proof+:
Suppose_not(x0,y0) ==> AUTO
--
-- Reasoning by contradiction, we assume that $x0,y0$ are a counterexample
-- to the assertion of this theorem.
--
	x0-->T611(*) ==> Stat1: arb(x0) in RaCauchy
	y0-->T611(*) ==> Stat2: arb(y0) in RaCauchy
	(arb(x0),arb(y0))-->T556(Stat1*) ==> Stat3: ((arb(x0) ¥Ras_PLUS arb(y0)) in RaCauchy) & (Ras_ABS(arb(x0)) in RaCauchy)
	(arb(x0) ¥Ras_PLUS arb(y0),arb(x0) ¥Ras_PLUS arb(y0))-->T556(Stat3*) ==> Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)) in RaCauchy
	()-->T545 ==> AUTO
	T539(Stat1*) ==> Stat4: {Ra0Seq,arb(x0),arb(y0),arb(x0) ¥Ras_PLUS arb(y0),Ras_ABS(arb(x0)),Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0))} ¥incin RaSeq
--
-- One trivial case can be discarded immediately: in a counterample $x0,y0$ to the assertion of this
-- theorem, the rational Cauchy sequence $arb(y0)$ cannot be equivalent to $Ra0Seq$.
--
	Suppose ==> Ra_eqseq(arb(y0),Ra0Seq)
		(arb(x0),arb(x0))-->T607(Stat1*) ==> Ra_eqseq(arb(x0),arb(x0))
		(arb(x0),arb(x0),arb(y0),Ra0Seq)-->T572(Stat1*) ==> Stat5: Ra_eqseq(arb(x0) ¥Ras_PLUS arb(y0),arb(x0) ¥Ras_PLUS Ra0Seq)
		(arb(x0))-->T605(Stat4,Stat4*) ==> Stat6: (arb(x0) ¥Ras_PLUS Ra0Seq) = arb(x0)
		EQUAL(Stat5) ==> Stat7: Ra_eqseq(arb(x0) ¥Ras_PLUS arb(y0),arb(x0))
		x0-->T664(*) ==> Ra_eqseq(arb(x0),Ras_ABS(arb(x0)))
		(arb(x0) ¥Ras_PLUS arb(y0),arb(x0),Ras_ABS(arb(x0)))-->T553(Stat4*) ==> Ra_eqseq(Ras_ABS(arb(x0)),arb(x0) ¥Ras_PLUS arb(y0))
		(arb(x0) ¥Ras_PLUS arb(y0),arb(x0) ¥Ras_PLUS Ra0Seq)-->T576(Stat3,Stat5,Stat1,Stat6*) ==> Ra_eqseq(Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)),Ras_ABS(arb(x0) ¥Ras_PLUS Ra0Seq))
		EQUAL(Stat5) ==> Stat8: Ra_eqseq(Ras_ABS(arb(x0) ¥Ras_PLUS Ra0Seq),arb(x0) ¥Ras_PLUS arb(y0)) &
			(Ras_ABS(arb(x0) ¥Ras_PLUS Ra0Seq) = Ras_ABS(arb(x0)))
		(Stat3,Stat8*)ELEM ==> Ras_ABS(arb(x0) ¥Ras_PLUS Ra0Seq) in RaCauchy
	(Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)),Ras_ABS(arb(x0) ¥Ras_PLUS Ra0Seq),arb(x0) ¥Ras_PLUS arb(y0))-->T553(*) ==> false; Discharge ==> Stat9: (not Ra_eqseq(arb(y0),Ra0Seq))
--
-- Another trivial case can be discarded arguing in an entirely analogous fashion:
-- in a counterample $x0,y0$ to the assertion of this theorem, the rational Cauchy sequence
-- $arb(x0)$ cannot be equivalent to $Ra0Seq$.
--
	(arb(y0),arb(y0))-->T556(Stat2*) ==> Stat10: Ras_ABS(arb(y0)) in RaCauchy
	T539(Stat10*) ==> Stat11: Ras_ABS(arb(y0)) in RaSeq
	Suppose ==> Ra_eqseq(arb(x0),Ra0Seq)
		(arb(y0),arb(y0))-->T607(Stat1*) ==> Ra_eqseq(arb(y0),arb(y0))
		(arb(x0),Ra0Seq,arb(y0),arb(y0))-->T572(Stat1*) ==> Stat12: Ra_eqseq(arb(x0) ¥Ras_PLUS arb(y0),Ra0Seq ¥Ras_PLUS arb(y0))
		(Ra0Seq,arb(y0))-->T578(Stat4,Stat4*) ==> Stat13: (Ra0Seq ¥Ras_PLUS arb(y0)) = (arb(y0) ¥Ras_PLUS Ra0Seq)
		(arb(y0))-->T605(Stat4,Stat4*) ==> Stat14: (arb(y0) ¥Ras_PLUS Ra0Seq) = arb(y0)
		EQUAL(Stat12) ==> Stat15: Ra_eqseq(arb(x0) ¥Ras_PLUS arb(y0),arb(y0))
		y0-->T664(*) ==> Ra_eqseq(arb(y0),Ras_ABS(arb(y0)))
		(arb(x0) ¥Ras_PLUS arb(y0),arb(y0),Ras_ABS(arb(y0)))-->T553(Stat4*) ==> Ra_eqseq(Ras_ABS(arb(y0)),arb(x0) ¥Ras_PLUS arb(y0))
		(arb(x0) ¥Ras_PLUS arb(y0),Ra0Seq ¥Ras_PLUS arb(y0))-->T576(Stat3,Stat13,Stat14,Stat2,Stat12*) ==> Ra_eqseq(Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)),Ras_ABS(Ra0Seq ¥Ras_PLUS arb(y0)))
		EQUAL(Stat12) ==> Stat16: Ra_eqseq(Ras_ABS(Ra0Seq ¥Ras_PLUS arb(y0)),arb(x0) ¥Ras_PLUS arb(y0)) &
			(Ras_ABS(Ra0Seq ¥Ras_PLUS arb(y0)) = Ras_ABS(arb(y0)))
		(Stat10*)ELEM ==> Ras_ABS(Ra0Seq ¥Ras_PLUS arb(y0)) in RaCauchy
	(Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)),Ras_ABS(Ra0Seq ¥Ras_PLUS arb(y0)),arb(x0) ¥Ras_PLUS arb(y0))-->T553(*) ==> false; Discharge ==> Stat17: (not Ra_eqseq(arb(x0),Ra0Seq))
--
-- Knowing that neither of $arb(x0),arb(y0)$ can be equivalent to $Ra0Seq$, we can now
-- exploit Theorem 598 to pick positive real numbers $eps0,eps1$ and unsigned integers
-- $n0,n1$ so that all components of $arb(x0)$ which lie beyond the $n0$-th component
-- have an absolute value greater than $eps0$ and they all have the same sign; and, likewise,
-- all components of $arb(y0)$ which lie beyond the $n1$-th component
-- have an absolute value greater than $eps1$ and they all have the same sign.
--
	(arb(x0))-->T598(Stat1,Stat17*) ==> Stat18: (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
			(FORALL i in (Za - n) | (Ra_ABS((arb(x0))~[i]) ¥Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n]) ¥Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) ))
	(eps0,n0)-->Stat18(Stat18*) ==> (eps0 in Ra) & (n0 in Za) & (eps0 ¥Ra_GT Ra_0) &
			Stat19: (FORALL i in (Za - n0) | (Ra_ABS((arb(x0))~[i]) ¥Ra_GT eps0) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n0]) ¥Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) )
	(arb(y0))-->T598(Stat2,Stat9*) ==> Stat20: (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
			(FORALL i in (Za - n) | (Ra_ABS((arb(y0))~[i]) ¥Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n]) ¥Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) ))
	(eps1,n1)-->Stat20(Stat20*) ==> (eps1 in Ra) & (n1 in Za) & (eps1 ¥Ra_GT Ra_0) &
			Stat21: (FORALL i in (Za - n1) | (Ra_ABS((arb(y0))~[i]) ¥Ra_GT eps1) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n1]) ¥Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) )
--
-- Indicating by $n$ the greater of $n0,n1$ and by $eps$ the smaller of
-- $eps0,eps1$, we hence have that all components of $arb(x0)$ which lie beyond the
-- $n$-th component have an absolute value greater than $eps$ and they all have
-- the same sign; and, likewise, all components of $arb(y0)$ which lie beyond the
-- $n$-th component have an absolute value greater than $eps$ and they all have
-- the same sign.
--
	Loc_def ==> Stat22: n = Un({n0,n1})
	(n0,n1)-->T202(Stat22*) ==> Finite({n0,n1})
	({n0,n1})-->T320(Stat18*) ==> Un({n0,n1}) in Za
	(n0,n1)-->T106(Stat22*) ==> Stat23: (n0 ¥incin n) & (n1 ¥incin n)
	EQUAL(Stat22) ==> Stat24: n in Za
	n-->T237(Stat24*) ==> Stat25: (not Finite(Za - n))
	Loc_def ==> Stat26: eps = if eps1 ¥Ra_GT eps0 then eps0 else eps1 end if
	Suppose ==> not((eps in Ra) & (eps ¥Ra_GT Ra_0))
		Suppose ==> eps1 ¥Ra_GT eps0
			(Stat26*)ELEM ==> eps = eps0
		EQUAL(Stat18*) ==> false; Discharge ==> not(eps1 ¥Ra_GT eps0)
		(Stat26*)ELEM ==> eps = eps1
	EQUAL(Stat20*) ==> false; Discharge ==> Stat27: (eps in Ra) & (eps ¥Ra_GT Ra_0)
	Ra_0-->T451(Stat27*) ==> Stat28: Ra_0 in Ra
	Suppose ==> Stat29: not(FORALL i in (Za - n) | (Ra_ABS((arb(x0))~[i]) ¥Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n0]) ¥Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) )
		i0-->Stat29(Stat22*) ==> (i0 in (Za - n0)) & (not((Ra_ABS((arb(x0))~[i0]) ¥Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i0]) = if (((arb(x0))~[n0]) ¥Ra_GE Ra_0) then ((arb(x0))~[i0]) else Ra_Rev((arb(x0))~[i0]) end if)))
		i0-->Stat19(Stat29*) ==> Stat30: (Ra_ABS((arb(x0))~[i0]) ¥Ra_GT eps0) & (not(Ra_ABS((arb(x0))~[i0]) ¥Ra_GT eps))
		Suppose ==> eps1 ¥Ra_GT eps0
			(Stat26*)ELEM ==> eps = eps0
		EQUAL(Stat30*) ==> false; Discharge ==> (not(eps1 ¥Ra_GT eps0)) & (eps = eps1)
		EQUAL(Stat30*) ==> (not(Ra_ABS((arb(x0))~[i0]) ¥Ra_GT eps1))
		(arb(x0),i0)-->T540(Stat4*) ==> ((arb(x0))~[i0]) in Ra
		((arb(x0))~[i0])-->T527(Stat30*) ==> Ra_ABS((arb(x0))~[i0]) in Ra
		(eps1,eps0)-->T478(Stat18*) ==> eps0 ¥Ra_GE eps1
	(Ra_ABS((arb(x0))~[i0]),eps0,eps1)-->T509(Stat18*) ==> false; Discharge ==> Stat31: (FORALL i in (Za - n) | (Ra_ABS((arb(x0))~[i]) ¥Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n0]) ¥Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) )
	Suppose ==> Stat32: not(FORALL i in (Za - n) | (Ra_ABS((arb(y0))~[i]) ¥Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n1]) ¥Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) )
		i1-->Stat32(Stat23,Stat23*) ==> (i1 in (Za - n1)) & (not((Ra_ABS((arb(y0))~[i1]) ¥Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i1]) = if (((arb(y0))~[n1]) ¥Ra_GE Ra_0) then ((arb(y0))~[i1]) else Ra_Rev((arb(y0))~[i1]) end if)))
		i1-->Stat21(Stat32*) ==> Stat33: (Ra_ABS((arb(y0))~[i1]) ¥Ra_GT eps1) & (not(Ra_ABS((arb(y0))~[i1]) ¥Ra_GT eps))
		Suppose ==> not(eps1 ¥Ra_GT eps0)
			(Stat26*)ELEM ==> eps = eps1
		EQUAL(Stat33*) ==> false; Discharge ==> (eps1 ¥Ra_GT eps0) & (eps = eps0)
		EQUAL(Stat33*) ==> (not(Ra_ABS((arb(y0))~[i1]) ¥Ra_GT eps0))
		(arb(y0),i1)-->T540(Stat4*) ==> ((arb(y0))~[i1]) in Ra
		((arb(y0))~[i1])-->T527(Stat33*) ==> Ra_ABS((arb(y0))~[i1]) in Ra
	(Ra_ABS((arb(y0))~[i1]),eps1,eps0)-->T511(Stat18*) ==> false; Discharge ==> Stat34: (FORALL i in (Za - n) | (Ra_ABS((arb(y0))~[i]) ¥Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n1]) ¥Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) )
--
-- Note that in both cases "the same sign" actually means "positive sign",
-- as a consequence of $arb(x0)$ and $arb(y0)$ being non-negative.
--
	Use_def(R_is_nonneg)(*) ==> Stat35: (Cauchy_to_Re(Ras_ABS(arb(x0))) = x0) & (Cauchy_to_Re(Ras_ABS(arb(y0))) = y0)
	T525 ==> Stat36: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &
			Stat37: 	(FORALL x | (x in Ra) ¥imp (x ¥Ra_LE x))
	Suppose ==> Stat38: not(((eps ¥Ra_PLUS eps) in Ra) & ((eps ¥Ra_PLUS eps) ¥Ra_GT eps))
		(eps,eps)-->T445(Stat27,Stat27*) ==> (eps ¥Ra_PLUS eps) in Ra
		eps-->Stat37(Stat27,Stat27*) ==> eps ¥Ra_LE eps
		(eps,eps)-->T473(Stat38*) ==> eps ¥Ra_GE eps
		(eps,eps,eps,Ra_0)-->T504(Stat27*) ==> (eps ¥Ra_PLUS eps) ¥Ra_GT (eps ¥Ra_PLUS Ra_0)
		eps-->T451(Stat27*) ==> (eps ¥Ra_PLUS Ra_0) = eps
	EQUAL(Stat38) ==> false; Discharge ==> Stat39: ((eps ¥Ra_PLUS eps) in Ra) & ((eps ¥Ra_PLUS eps) ¥Ra_GT eps)
--
	Suppose ==> Stat40: not(((arb(x0))~[n0]) ¥Ra_GE Ra_0)
--
-- On the one hand, in fact, as far as $(arb(x0))~[n0]$ is concerned, if we assume that the sign
-- is negative then, by expanding the definition of $R_is_nonneg(x0)$ in the initial
-- definition, we get the equivalence of $Ras_ABS(arb(x0))$ with $arb(x0)$,
-- and hence the finiteness of the set
--	${x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps}$.
--
		x0-->T611(*) ==> Stat41: Cauchy_to_Re(Ras_ABS(arb(x0))) = Cauchy_to_Re(arb(x0))
		(Ras_ABS(arb(x0)),arb(x0))-->T610(Stat1,Stat3,Stat41*) ==> Stat42: Ra_eqseq(Ras_ABS(arb(x0)),arb(x0))
		(Ras_ABS(arb(x0)),arb(x0))-->T541(Stat4,Stat42*) ==> Stat43: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps}))
		eps-->Stat43(Stat27,Stat27*) ==> Stat44: Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps})
--?		Set_monot(Stat44*) ==> {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps} ¥incin {x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps}
		Set_monot(Stat44) ==> {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps} ¥incin {x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps}
		({x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps},{x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps})-->T189(Stat43*) ==> Stat45: Finite({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps})
--
-- As a consequence, there is an $i2$ no smaller than $n$ in $Za$ satisfying
--	$not(Ra_ABS(((Ras_ABS(arb(x0)))~[i2]) ¥Ra_MINUS ((arb(x0))~[i2])) ¥Ra_GT eps)$.
-- By the above statement Stat31, such $i2$ must also satisfy the inequality
--	$(Ra_ABS((arb(x0))~[i2]) ¥Ra_GT eps) & (Ra_ABS((arb(x0))~[i2]) = Ra_Rev((arb(x0))~[i2]))$.
--
		Suppose ==> Stat46: (FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[i]) ¥Ra_MINUS ((arb(x0))~[i])) ¥Ra_GT eps)
			Suppose ==> Stat47: {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps} incs (Za - n)
			({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps},Za - n)-->T189(Stat47,Stat25,Stat45*) ==> false; Discharge ==> Stat48: not({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps} incs (Za - n))
			i4-->Stat48(Stat48*) ==> (i4 in (Za - n)) & Stat49: (i4 notin {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps})
			i4-->Stat46(Stat48*) ==> Ra_ABS(((Ras_ABS(arb(x0)))~[i4]) ¥Ra_MINUS ((arb(x0))~[i4])) ¥Ra_GT eps
		i4-->Stat49(Stat48*) ==> false; Discharge ==> Stat50: not(FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[i]) ¥Ra_MINUS ((arb(x0))~[i])) ¥Ra_GT eps)
		i2-->Stat50(Stat50*) ==> Stat51: (i2 in (Za - n)) & (not(Ra_ABS(((Ras_ABS(arb(x0)))~[i2]) ¥Ra_MINUS ((arb(x0))~[i2])) ¥Ra_GT eps))
		i2-->Stat31(Stat40*) ==> (Ra_ABS((arb(x0))~[i2]) ¥Ra_GT eps) & (Ra_ABS((arb(x0))~[i2]) = Ra_Rev((arb(x0))~[i2]))
--
-- Therefore, taking the definitions of $Ras_ARB(_)$ and of $_ ¥Ra_MINUS _$
-- into account, we get that
--	$not(Ra_Rev(Ra_ABS((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2])) ¥Ra_GT eps)$,
-- where $Ra_Rev((arb(x0))~[i2])$ exceeds the positive number $eps$.
--
		Use_def(¥Ra_MINUS)(Stat50*) ==> (((Ras_ABS(arb(x0)))~[i2]) ¥Ra_MINUS ((arb(x0))~[i2])) = (((Ras_ABS(arb(x0)))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2]))
		(arb(x0),arb(x0),i2)-->T555(Stat51,Stat4*) ==> ((Ras_ABS(arb(x0)))~[i2]) = Ra_ABS((arb(x0))~[i2])
		EQUAL(Stat51) ==> (Ra_Rev((arb(x0))~[i2]) ¥Ra_GT eps) & (not(Ra_ABS(Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2])) ¥Ra_GT eps))
		(arb(x0),i2)-->T540(Stat4,Stat51*) ==> ((arb(x0))~[i2]) in Ra
		((arb(x0))~[i2])-->T452(Stat51*) ==> Ra_Rev((arb(x0))~[i2]) in Ra
		(Ra_Rev((arb(x0))~[i2]),eps,Ra_0)-->T498(Stat27*) ==> Ra_Rev((arb(x0))~[i2]) ¥Ra_GT Ra_0
		(Ra_Rev((arb(x0))~[i2]))-->T482(Stat51*) ==> Ra_is_nonneg(Ra_Rev((arb(x0))~[i2]))
		(Ra_Rev((arb(x0))~[i2]),Ra_Rev((arb(x0))~[i2]))-->T469(Stat51*) ==> Ra_is_nonneg(Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2]))
		(Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2]))-->Stat36(Stat51) ==> Ra_ABS(Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2])) = (Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2]))
		EQUAL(Stat51) ==> Stat52: not(Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2]) ¥Ra_GT eps)
		(Ra_Rev((arb(x0))~[i2]),eps)-->T473(Stat51*) ==> Ra_Rev((arb(x0))~[i2]) ¥Ra_GE eps
		(Ra_Rev((arb(x0))~[i2]),eps,Ra_Rev((arb(x0))~[i2]),eps)-->T504(Stat27*) ==> Stat53: (Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2])) ¥Ra_GT (eps ¥Ra_PLUS eps)
		(Ra_Rev((arb(x0))~[i2]),Ra_Rev((arb(x0))~[i2]))-->T445(Stat51*) ==> Stat54: (Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2])) in Ra
	(Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2]),eps ¥Ra_PLUS eps,eps)-->T498(Stat27,Stat39,Stat54,Stat53,Stat52*) ==> false; Discharge ==> Stat55: ((arb(x0))~[n0]) ¥Ra_GE Ra_0
--
-- On the other hand, concerning $(arb(y0))~[n1]$, we can argue in an entirely
-- analogous fashion to draw a contradiction from the temporary assumption that
-- this quantity is negative.
--
	Suppose ==> Stat56: not(((arb(y0))~[n1]) ¥Ra_GE Ra_0)
		y0-->T611(*) ==> Stat57: Cauchy_to_Re(Ras_ABS(arb(y0))) = Cauchy_to_Re(arb(y0))
		(Ras_ABS(arb(y0)),arb(y0))-->T610(Stat2,Stat10,Stat57*) ==> Stat58:Ra_eqseq(Ras_ABS(arb(y0)),arb(y0))
		(Ras_ABS(arb(y0)),arb(y0))-->T541(Stat4,Stat11,Stat58*) ==> Stat59: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps}))
		eps-->Stat59(Stat27,Stat27*) ==> Stat60: Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps})
		Set_monot(Stat60) ==> {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps} ¥incin {x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps}
		({x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps},{x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps})-->T189(Stat60*) ==> Stat61: Finite({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps})
		Suppose ==> Stat62: (FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[i]) ¥Ra_MINUS ((arb(y0))~[i])) ¥Ra_GT eps)
			Suppose ==> Stat63: {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps} incs (Za - n)
			({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps},Za - n)-->T189(Stat63,Stat25,Stat61*) ==> false; Discharge ==> Stat64: not({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps} incs (Za - n))
			i5-->Stat64(Stat64*) ==> (i5 in (Za - n)) & Stat65: (i5 notin {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps})
			i5-->Stat62(Stat64*) ==> Ra_ABS(((Ras_ABS(arb(y0)))~[i5]) ¥Ra_MINUS ((arb(y0))~[i5])) ¥Ra_GT eps
		i5-->Stat65(Stat64*) ==> false; Discharge ==> Stat66: not(FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[i]) ¥Ra_MINUS ((arb(y0))~[i])) ¥Ra_GT eps)
		i3-->Stat66(Stat66*) ==> Stat67: (i3 in (Za - n)) & (not(Ra_ABS(((Ras_ABS(arb(y0)))~[i3]) ¥Ra_MINUS ((arb(y0))~[i3])) ¥Ra_GT eps))
		i3-->Stat34(Stat56*) ==> (Ra_ABS((arb(y0))~[i3]) ¥Ra_GT eps) & (Ra_ABS((arb(y0))~[i3]) = Ra_Rev((arb(y0))~[i3]))
		Use_def(¥Ra_MINUS)(Stat66*) ==> (((Ras_ABS(arb(y0)))~[i3]) ¥Ra_MINUS ((arb(y0))~[i3])) = (((Ras_ABS(arb(y0)))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3]))
		(arb(y0),arb(y0),i3)-->T555(Stat67,Stat4*) ==> ((Ras_ABS(arb(y0)))~[i3]) = Ra_ABS((arb(y0))~[i3])
		EQUAL(Stat67) ==> (Ra_Rev((arb(y0))~[i3]) ¥Ra_GT eps) & (not(Ra_ABS(Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3])) ¥Ra_GT eps))
		(arb(y0),i3)-->T540(Stat4,Stat67*) ==> ((arb(y0))~[i3]) in Ra
		((arb(y0))~[i3])-->T452(Stat67*) ==> Ra_Rev((arb(y0))~[i3]) in Ra
		(Ra_Rev((arb(y0))~[i3]),eps,Ra_0)-->T498(Stat27*) ==> Ra_Rev((arb(y0))~[i3]) ¥Ra_GT Ra_0
		(Ra_Rev((arb(y0))~[i3]))-->T482(Stat67*) ==> Ra_is_nonneg(Ra_Rev((arb(y0))~[i3]))
		(Ra_Rev((arb(y0))~[i3]),Ra_Rev((arb(y0))~[i3]))-->T469(Stat67*) ==> Ra_is_nonneg(Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3]))
		(Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3]))-->Stat36(Stat67*) ==> Ra_ABS(Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3])) = (Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3]))
		EQUAL(Stat67) ==> Stat68: not(Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3]) ¥Ra_GT eps)
		(Ra_Rev((arb(y0))~[i3]),eps)-->T473(Stat67*) ==> Ra_Rev((arb(y0))~[i3]) ¥Ra_GE eps
		(Ra_Rev((arb(y0))~[i3]),eps,Ra_Rev((arb(y0))~[i3]),eps)-->T504(Stat27*) ==> Stat69: (Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3])) ¥Ra_GT (eps ¥Ra_PLUS eps)
		(Ra_Rev((arb(y0))~[i3]),Ra_Rev((arb(y0))~[i3]))-->T445(Stat67*) ==> Stat70: (Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3])) in Ra
	(Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3]),eps ¥Ra_PLUS eps,eps)-->T498(Stat39,Stat27,Stat70,Stat69,Stat68*) ==> false; Discharge ==> Stat71: ((arb(y0))~[n1]) ¥Ra_GE Ra_0
--
-- Now, thanks to Theorem 541, we can reformulate the condition for sequence
-- inequivalence which is part of our initial hypothesis as the condition that the set
--	${i : i in Za | Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i])) ¥Ra_GT eps3}$
-- is infinite for a suitable positive rational number $eps3$.
--
	(arb(x0) ¥Ras_PLUS arb(y0),Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))-->T541(*) ==> Stat72: not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({i : i in Za | Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i])) ¥Ra_GT eps}))
	eps3-->Stat72(Stat72*) ==> Stat73: (eps3 in Ra) & (eps3 ¥Ra_GT Ra_0) &
		(not Finite({i : i in Za | Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i])) ¥Ra_GT eps3}))
--
-- However, it is easy to see that the quantity
--	$Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[x]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0))~[x]))$
-- is null for every integer $i$ greater than or equal to $n$, and hence the set under
-- examination must be a subset of $n$ which is finite. Hence it will be finite in its
-- turn, which leads to a contradiction proving the desired assertion.
--
	(n,{i : i in Za | Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i])) ¥Ra_GT eps3})-->T189(Stat24,Stat73*) ==> Stat74: not(n incs {i : i in Za | Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i])) ¥Ra_GT eps3})
	i6-->Stat74(Stat74*) ==> Stat75: (i6 in {i in Za | Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i])) ¥Ra_GT eps3}) & (i6 notin n)
	()-->Stat76(Stat75*) ==> Stat76: (i6 in (Za - n)) & (Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6])) ¥Ra_GT eps3)
	Suppose ==> ((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) = ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6])
		(arb(x0) ¥Ras_PLUS arb(y0),i6)-->T540(Stat4,Stat76*) ==> ((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) in Ra
		(arb(x0) ¥Ras_PLUS arb(y0),arb(x0) ¥Ras_PLUS arb(y0))-->T554(Stat4,Stat4*) ==> (Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0))) in RaSeq
		(Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)),i6)-->T540(Stat76*) ==> ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6]) in Ra
		((arb(x0) ¥Ras_PLUS arb(y0))~[i6],(Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6])-->T454(Stat76*) ==> (((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6])) in Ra
		(((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6]))-->T527(Stat76*) ==> Stat77: Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6])) in Ra
		(Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6])),eps3,Ra_0)-->T498(Stat76,Stat73,Stat77,Stat28*) ==> Stat78: Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6])) ¥Ra_GT Ra_0
		(Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6])),Ra_0)-->T473(Stat78,Stat28*) ==> Stat79: Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6])) /= Ra_0
		((arb(x0) ¥Ras_PLUS arb(y0))~[i6])-->T452(Stat76*) ==> ((((arb(x0) ¥Ras_PLUS arb(y0))~[i6])) ¥Ra_PLUS Ra_Rev(((arb(x0) ¥Ras_PLUS arb(y0))~[i6]))) = Ra_0
        	T465(Stat79*) ==> Ra_is_nonneg(Ra_0)
	        T525(Stat79*) ==> Stat80: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
        	Ra_0-->Stat80(Stat79*) ==> Ra_ABS(Ra_0) = Ra_0
		EQUAL(Stat76) ==> Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) ¥Ra_PLUS Ra_Rev((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6])) = Ra_0
		Use_def(¥Ra_MINUS)(Stat79*) ==> Ra_ABS(((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6])) = Ra_0
	(Stat79*)ELEM ==> false; Discharge ==> Stat81: ((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) /= ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6])
	(arb(x0),arb(y0),i6)-->T555(Stat4,Stat76*) ==> ((arb(x0) ¥Ras_PLUS arb(y0))~[i6]) = (((arb(x0))~[i6]) ¥Ra_PLUS ((arb(y0))~[i6]))
	(arb(x0) ¥Ras_PLUS arb(y0),arb(x0) ¥Ras_PLUS arb(y0),i6)-->T555(Stat4,Stat76*) ==> ((Ras_ABS(arb(x0) ¥Ras_PLUS arb(y0)))~[i6]) = Ra_ABS((arb(x0) ¥Ras_PLUS arb(y0))~[i6])
	EQUAL(Stat81) ==> Stat82: (((arb(x0))~[i6]) ¥Ra_PLUS ((arb(y0))~[i6])) /= Ra_ABS(((arb(x0))~[i6]) ¥Ra_PLUS ((arb(y0))~[i6]))
--
--
--
	Suppose ==> not((((arb(x0))~[i6]) in Ra) & Ra_is_nonneg(((arb(x0))~[i6])))
		(arb(x0),i6)-->T540(Stat4,Stat76*) ==> ((arb(x0))~[i6]) in Ra
		i6-->Stat31(Stat76,Stat55*) ==> Ra_ABS((arb(x0))~[i6]) = ((arb(x0))~[i6])
		((arb(x0))~[i6])-->T528(Stat82*) ==> ((arb(x0))~[i6]) ¥Ra_GE Ra_0
	((arb(x0))~[i6])-->T482(Stat82*) ==> false; Discharge ==> (((arb(x0))~[i6]) in Ra) & Ra_is_nonneg(((arb(x0))~[i6]))
	Suppose ==> not((((arb(y0))~[i6]) in Ra) & Ra_is_nonneg(((arb(y0))~[i6])))
		(arb(y0),i6)-->T540(Stat4,Stat76*) ==> ((arb(y0))~[i6]) in Ra
		i6-->Stat34(Stat76,Stat71*) ==> Ra_ABS((arb(y0))~[i6]) = ((arb(y0))~[i6])
		((arb(y0))~[i6])-->T528(Stat82*) ==> ((arb(y0))~[i6]) ¥Ra_GE Ra_0
	((arb(y0))~[i6])-->T482(Stat82*) ==> false; Discharge ==> (((arb(y0))~[i6]) in Ra) & Ra_is_nonneg(((arb(y0))~[i6]))
	((arb(x0))~[i6],(arb(y0))~[i6])-->T469(Stat82*) ==> Stat83: Ra_is_nonneg(((arb(x0))~[i6]) ¥Ra_PLUS ((arb(y0))~[i6]))
	((arb(x0))~[i6],(arb(y0))~[i6])-->T445(Stat82*) ==> (((arb(x0))~[i6]) ¥Ra_PLUS ((arb(y0))~[i6])) in Ra
	(((arb(x0))~[i6]) ¥Ra_PLUS ((arb(y0))~[i6]))-->T482(Stat83*) ==> (((arb(x0))~[i6]) ¥Ra_PLUS ((arb(y0))~[i6])) ¥Ra_GE Ra_0
(((arb(x0))~[i6]) ¥Ra_PLUS ((arb(y0))~[i6]))-->T528(Stat82*) ==> false; Discharge ==> QED
--
Theorem 666: [The product of two non-negative rational Cauchy sequences is equivalent to its own absolute value] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) ¥imp Ra_eqseq(arb(X) ¥Ras_TIMES arb(Y),Ras_ABS(arb(X) ¥Ras_TIMES arb(Y))). Proof+:
Suppose_not(x0,y0) ==> AUTO
--
-- Reasoning by contradiction, we assume that $x0,y0$ are a counterexample
-- to the assertion of this theorem.
--
	x0-->T611(*) ==> Stat1: arb(x0) in RaCauchy
	y0-->T611(*) ==> Stat2: arb(y0) in RaCauchy
	(arb(x0),arb(y0))-->T556(Stat1*) ==> Stat3: Ras_ABS(arb(x0)) in RaCauchy
	(arb(x0),arb(y0))-->T561(Stat1*) ==> Stat4: (arb(x0) ¥Ras_TIMES arb(y0)) in RaCauchy
	(arb(x0) ¥Ras_TIMES arb(y0),arb(x0) ¥Ras_TIMES arb(y0))-->T556(Stat3*) ==> Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)) in RaCauchy
	()-->T545 ==> AUTO
	T539(Stat1*) ==> Stat5: {Ra0Seq,arb(x0),arb(y0),arb(x0) ¥Ras_TIMES arb(y0),Ras_ABS(arb(x0)),Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0))} ¥incin RaSeq
--
-- One trivial case can be discarded immediately: in a counterample $x0,y0$ to the assertion of this
-- theorem, the rational Cauchy sequence $arb(y0)$ cannot be equivalent to $Ra0Seq$.
--
	Suppose ==> Ra_eqseq(arb(x0) ¥Ras_TIMES arb(y0),Ra0Seq)
		()-->T596 ==> AUTO
		Ra0Seq-->T546(Stat5,Stat5*) ==> Ra_eqseq(Ra0Seq,Ra0Seq)
		EQUAL(Stat5) ==> Ra_eqseq(Ras_ABS(Ra0Seq),Ra0Seq)
		(arb(x0) ¥Ras_TIMES arb(y0))-->T597(Stat4*) ==> Ra_eqseq(Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)),Ra0Seq)
		(Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)),Ra0Seq,Ra0Seq)-->T553(Stat5*) ==> Ra_eqseq(Ra0Seq,Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))
		(arb(x0) ¥Ras_TIMES arb(y0),Ra0Seq,Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))-->T553(Stat5*) ==> Ra_eqseq(Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)),arb(x0) ¥Ras_TIMES arb(y0))
		(arb(x0) ¥Ras_TIMES arb(y0))-->T546(Stat5,Stat5*) ==> Ra_eqseq(arb(x0) ¥Ras_TIMES arb(y0),arb(x0) ¥Ras_TIMES arb(y0))
	(Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)),arb(x0) ¥Ras_TIMES arb(y0),arb(x0) ¥Ras_TIMES arb(y0))-->T553(*) ==> false; Discharge ==> (not Ra_eqseq(arb(x0) ¥Ras_TIMES arb(y0),Ra0Seq))
	Suppose ==> Ra_eqseq(arb(y0),Ra0Seq)
		(arb(x0),arb(x0))-->T607(Stat1*) ==> Ra_eqseq(arb(x0),arb(x0))
		(arb(x0),arb(x0),arb(y0),Ra0Seq)-->T574(Stat1*) ==> Ra_eqseq(arb(x0) ¥Ras_TIMES arb(y0),arb(x0) ¥Ras_TIMES Ra0Seq)
		(arb(x0))-->T586(Stat5,Stat5*) ==> (arb(x0) ¥Ras_TIMES Ra0Seq) = Ra0Seq
	EQUAL(Stat5) ==> false; Discharge ==>  Stat6: (not Ra_eqseq(arb(y0),Ra0Seq))
--
-- Another trivial case can be discarded arguing in an entirely analogous fashion:
-- in a counterample $x0,y0$ to the assertion of this theorem, the rational Cauchy sequence
-- $arb(x0)$ cannot be equivalent to $Ra0Seq$.
--
	(arb(y0),arb(y0))-->T556(Stat2*) ==> Stat7: Ras_ABS(arb(y0)) in RaCauchy
	T539(Stat7*) ==> Stat8: Ras_ABS(arb(y0)) in RaSeq
	Suppose ==> Ra_eqseq(arb(x0),Ra0Seq)
		(arb(y0),arb(y0))-->T607(Stat1*) ==> Ra_eqseq(arb(y0),arb(y0))
		(arb(x0),Ra0Seq,arb(y0),arb(y0))-->T574(Stat1*) ==> Ra_eqseq(arb(x0) ¥Ras_TIMES arb(y0),Ra0Seq ¥Ras_TIMES arb(y0))
		(arb(y0))-->T586(Stat5,Stat5*) ==> (arb(y0) ¥Ras_TIMES Ra0Seq) = Ra0Seq
		(arb(y0),Ra0Seq)-->T579(Stat5,Stat5*) ==> (arb(y0) ¥Ras_TIMES Ra0Seq) = (Ra0Seq ¥Ras_TIMES arb(y0))
	EQUAL(Stat5) ==> false; Discharge ==> Stat9: (not Ra_eqseq(arb(x0),Ra0Seq))
--
-- Knowing that neither of $arb(x0),arb(y0)$ can be equivalent to $Ra0Seq$, we can now
-- exploit Theorem 598 to pick positive real numbers $eps0,eps1$ and unsigned integers
-- $n0,n1$ so that all components of $arb(x0)$ which lie beyond the $n0$-th component
-- have an absolute value greater than $eps0$ and they all have the same sign; and, likewise,
-- all components of $arb(y0)$ which lie beyond the $n1$-th component
-- have an absolute value greater than $eps1$ and they all have the same sign.
--
	(arb(x0))-->T598(Stat1,Stat9*) ==> Stat10: (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
			(FORALL i in (Za - n) | (Ra_ABS((arb(x0))~[i]) ¥Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n]) ¥Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) ))
	(eps0,n0)-->Stat10(Stat10*) ==> (eps0 in Ra) & (n0 in Za) & (eps0 ¥Ra_GT Ra_0) &
			Stat11: (FORALL i in (Za - n0) | (Ra_ABS((arb(x0))~[i]) ¥Ra_GT eps0) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n0]) ¥Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) )
	(arb(y0))-->T598(Stat2,Stat6*) ==> Stat12: (EXISTS eps in Ra, n in Za | (eps ¥Ra_GT Ra_0) &
			(FORALL i in (Za - n) | (Ra_ABS((arb(y0))~[i]) ¥Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n]) ¥Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) ))
	(eps1,n1)-->Stat12(Stat12*) ==> (eps1 in Ra) & (n1 in Za) & (eps1 ¥Ra_GT Ra_0) &
			Stat13: (FORALL i in (Za - n1) | (Ra_ABS((arb(y0))~[i]) ¥Ra_GT eps1) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n1]) ¥Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) )
--
-- Indicating by $n$ the greater of $n0,n1$ and by $eps$ the smaller of
-- $eps0,eps1$, we hence have that all components of $arb(x0)$ which lie beyond the
-- $n$-th component have an absolute value greater than $eps$ and they all have
-- the same sign; and, likewise, all components of $arb(y0)$ which lie beyond the
-- $n$-th component have an absolute value greater than $eps$ and they all have
-- the same sign.
--
	Loc_def ==> Stat14: n = Un({n0,n1})
	(n0,n1)-->T202(Stat14*) ==> Finite({n0,n1})
	({n0,n1})-->T320(Stat10*) ==> Un({n0,n1}) in Za
	(n0,n1)-->T106(Stat14*) ==> Stat15: (n0 ¥incin n) & (n1 ¥incin n)
	EQUAL(Stat14) ==> Stat16: n in Za
	n-->T237(Stat16*) ==> Stat17: (not Finite(Za - n))
	Loc_def ==> Stat18: eps = if eps1 ¥Ra_GT eps0 then eps0 else eps1 end if
	Suppose ==> not((eps in Ra) & (eps ¥Ra_GT Ra_0))
		Suppose ==> eps1 ¥Ra_GT eps0
			(Stat18*)ELEM ==> eps = eps0
		EQUAL(Stat10*) ==> false; Discharge ==> not(eps1 ¥Ra_GT eps0)
		(Stat18*)ELEM ==> eps = eps1
	EQUAL(Stat12*) ==> false; Discharge ==> Stat19: (eps in Ra) & (eps ¥Ra_GT Ra_0)
	Ra_0-->T451(Stat19*) ==> Stat20: Ra_0 in Ra
	Suppose ==> Stat21: not(FORALL i in (Za - n) | (Ra_ABS((arb(x0))~[i]) ¥Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n0]) ¥Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) )
		i0-->Stat21(Stat14*) ==> (i0 in (Za - n0)) & (not((Ra_ABS((arb(x0))~[i0]) ¥Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i0]) = if (((arb(x0))~[n0]) ¥Ra_GE Ra_0) then ((arb(x0))~[i0]) else Ra_Rev((arb(x0))~[i0]) end if)))
		i0-->Stat11(Stat21*) ==> Stat22: (Ra_ABS((arb(x0))~[i0]) ¥Ra_GT eps0) & (not(Ra_ABS((arb(x0))~[i0]) ¥Ra_GT eps))
		Suppose ==> eps1 ¥Ra_GT eps0
			(Stat18*)ELEM ==> eps = eps0
		EQUAL(Stat22*) ==> false; Discharge ==> (not(eps1 ¥Ra_GT eps0)) & (eps = eps1)
		EQUAL(Stat22*) ==> (not(Ra_ABS((arb(x0))~[i0]) ¥Ra_GT eps1))
		(arb(x0),i0)-->T540(Stat5*) ==> ((arb(x0))~[i0]) in Ra
		((arb(x0))~[i0])-->T527(Stat22*) ==> Ra_ABS((arb(x0))~[i0]) in Ra
		(eps1,eps0)-->T478(Stat10*) ==> eps0 ¥Ra_GE eps1
	(Ra_ABS((arb(x0))~[i0]),eps0,eps1)-->T509(Stat10*) ==> false; Discharge ==> Stat23: (FORALL i in (Za - n) | (Ra_ABS((arb(x0))~[i]) ¥Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n0]) ¥Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) )
	Suppose ==> Stat24: not(FORALL i in (Za - n) | (Ra_ABS((arb(y0))~[i]) ¥Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n1]) ¥Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) )
		i1-->Stat24(Stat15,Stat15*) ==> (i1 in (Za - n1)) & (not((Ra_ABS((arb(y0))~[i1]) ¥Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i1]) = if (((arb(y0))~[n1]) ¥Ra_GE Ra_0) then ((arb(y0))~[i1]) else Ra_Rev((arb(y0))~[i1]) end if)))
		i1-->Stat13(Stat24*) ==> Stat25: (Ra_ABS((arb(y0))~[i1]) ¥Ra_GT eps1) & (not(Ra_ABS((arb(y0))~[i1]) ¥Ra_GT eps))
		Suppose ==> not(eps1 ¥Ra_GT eps0)
			(Stat18*)ELEM ==> eps = eps1
		EQUAL(Stat25*) ==> false; Discharge ==> (eps1 ¥Ra_GT eps0) & (eps = eps0)
		EQUAL(Stat25*) ==> (not(Ra_ABS((arb(y0))~[i1]) ¥Ra_GT eps0))
		(arb(y0),i1)-->T540(Stat5*) ==> ((arb(y0))~[i1]) in Ra
		((arb(y0))~[i1])-->T527(Stat25*) ==> Ra_ABS((arb(y0))~[i1]) in Ra
	(Ra_ABS((arb(y0))~[i1]),eps1,eps0)-->T511(Stat10*) ==> false; Discharge ==> Stat26: (FORALL i in (Za - n) | (Ra_ABS((arb(y0))~[i]) ¥Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n1]) ¥Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) )
--
-- Note that in both cases "the same sign" actually means "positive sign",
-- as a consequence of $arb(x0)$ and $arb(y0)$ being non-negative.
--
	Use_def(R_is_nonneg)(*) ==> Stat27: (Cauchy_to_Re(Ras_ABS(arb(x0))) = x0) & (Cauchy_to_Re(Ras_ABS(arb(y0))) = y0)
	T525 ==> Stat28: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &
			Stat29: 	(FORALL x | (x in Ra) ¥imp (x ¥Ra_LE x))
	Suppose ==> Stat30: not(((eps ¥Ra_PLUS eps) in Ra) & ((eps ¥Ra_PLUS eps) ¥Ra_GT eps))
		(eps,eps)-->T445(Stat19,Stat19*) ==> (eps ¥Ra_PLUS eps) in Ra
		eps-->Stat29(Stat19,Stat19*) ==> eps ¥Ra_LE eps
		(eps,eps)-->T473(Stat30*) ==> eps ¥Ra_GE eps
		(eps,eps,eps,Ra_0)-->T504(Stat19*) ==> (eps ¥Ra_PLUS eps) ¥Ra_GT (eps ¥Ra_PLUS Ra_0)
		eps-->T451(Stat19*) ==> (eps ¥Ra_PLUS Ra_0) = eps
	EQUAL(Stat30) ==> false; Discharge ==> Stat31: ((eps ¥Ra_PLUS eps) in Ra) & ((eps ¥Ra_PLUS eps) ¥Ra_GT eps)
--
	Suppose ==> Stat32: not(((arb(x0))~[n0]) ¥Ra_GE Ra_0)
--
-- On the one hand, in fact, as far as $(arb(x0))~[n0]$ is concerned, if we assume that the sign
-- is negative then, by expanding the definition of $R_is_nonneg(x0)$ in the initial
-- definition, we get the equivalence of $Ras_ABS(arb(x0))$ with $arb(x0)$,
-- and hence the finiteness of the set
--	${x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps}$.
--
		x0-->T611(*) ==> Stat33: Cauchy_to_Re(Ras_ABS(arb(x0))) = Cauchy_to_Re(arb(x0))
		(Ras_ABS(arb(x0)),arb(x0))-->T610(Stat1,Stat3,Stat33*) ==> Stat34: Ra_eqseq(Ras_ABS(arb(x0)),arb(x0))
		(Ras_ABS(arb(x0)),arb(x0))-->T541(Stat5,Stat34*) ==> Stat35: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps}))
		eps-->Stat35(Stat19,Stat19*) ==> Stat36: Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps})
		Set_monot(Stat36) ==> {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps} ¥incin {x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps}
		({x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps},{x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps})-->T189(Stat35*) ==> Stat37: Finite({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps})
--
-- As a consequence, there is an $i2$ no smaller than $n$ in $Za$ satisfying
--	$not(Ra_ABS(((Ras_ABS(arb(x0)))~[i2]) ¥Ra_MINUS ((arb(x0))~[i2])) ¥Ra_GT eps)$.
-- By the above statement Stat23, such $i2$ must also satisfy the inequality
--	$(Ra_ABS((arb(x0))~[i2]) ¥Ra_GT eps) & (Ra_ABS((arb(x0))~[i2]) = Ra_Rev((arb(x0))~[i2]))$.
--
		Suppose ==> Stat38: (FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[i]) ¥Ra_MINUS ((arb(x0))~[i])) ¥Ra_GT eps)
			Suppose ==> Stat39: {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps} incs (Za - n)
			({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps},Za - n)-->T189(Stat39,Stat17,Stat37*) ==> false; Discharge ==> Stat40: not({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps} incs (Za - n))
			i4-->Stat40(Stat40*) ==> (i4 in (Za - n)) & Stat41: (i4 notin {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) ¥Ra_MINUS ((arb(x0))~[x])) ¥Ra_GT eps})
			i4-->Stat38(Stat40*) ==> Ra_ABS(((Ras_ABS(arb(x0)))~[i4]) ¥Ra_MINUS ((arb(x0))~[i4])) ¥Ra_GT eps
		i4-->Stat41(Stat40*) ==> false; Discharge ==> Stat42: not(FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[i]) ¥Ra_MINUS ((arb(x0))~[i])) ¥Ra_GT eps)
		i2-->Stat42(Stat42*) ==> Stat43: (i2 in (Za - n)) & (not(Ra_ABS(((Ras_ABS(arb(x0)))~[i2]) ¥Ra_MINUS ((arb(x0))~[i2])) ¥Ra_GT eps))
		i2-->Stat23(Stat32*) ==> (Ra_ABS((arb(x0))~[i2]) ¥Ra_GT eps) & (Ra_ABS((arb(x0))~[i2]) = Ra_Rev((arb(x0))~[i2]))
--
-- Therefore, taking the definitions of $Ras_ARB(_)$ and of $_ ¥Ra_MINUS _$
-- into account, we get that
--	$not(Ra_Rev(Ra_ABS((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2])) ¥Ra_GT eps)$,
-- where $Ra_Rev((arb(x0))~[i2])$ exceeds the positive number $eps$.
--
		Use_def(¥Ra_MINUS)(Stat42*) ==> (((Ras_ABS(arb(x0)))~[i2]) ¥Ra_MINUS ((arb(x0))~[i2])) = (((Ras_ABS(arb(x0)))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2]))
		(arb(x0),arb(x0),i2)-->T555(Stat43,Stat5*) ==> ((Ras_ABS(arb(x0)))~[i2]) = Ra_ABS((arb(x0))~[i2])
		EQUAL(Stat43) ==> (Ra_Rev((arb(x0))~[i2]) ¥Ra_GT eps) & (not(Ra_ABS(Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2])) ¥Ra_GT eps))
		(arb(x0),i2)-->T540(Stat5,Stat43*) ==> ((arb(x0))~[i2]) in Ra
		((arb(x0))~[i2])-->T452(Stat43*) ==> Ra_Rev((arb(x0))~[i2]) in Ra
		(Ra_Rev((arb(x0))~[i2]),eps,Ra_0)-->T498(Stat19*) ==> Ra_Rev((arb(x0))~[i2]) ¥Ra_GT Ra_0
		(Ra_Rev((arb(x0))~[i2]))-->T482(Stat43*) ==> Ra_is_nonneg(Ra_Rev((arb(x0))~[i2]))
		(Ra_Rev((arb(x0))~[i2]),Ra_Rev((arb(x0))~[i2]))-->T469(Stat43*) ==> Ra_is_nonneg(Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2]))
		(Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2]))-->Stat28(Stat43) ==> Ra_ABS(Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2])) = (Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2]))
		EQUAL(Stat43) ==> Stat44: not(Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2]) ¥Ra_GT eps)
		(Ra_Rev((arb(x0))~[i2]),eps)-->T473(Stat43*) ==> Ra_Rev((arb(x0))~[i2]) ¥Ra_GE eps
		(Ra_Rev((arb(x0))~[i2]),eps,Ra_Rev((arb(x0))~[i2]),eps)-->T504(Stat19*) ==> Stat45: (Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2])) ¥Ra_GT (eps ¥Ra_PLUS eps)
		(Ra_Rev((arb(x0))~[i2]),Ra_Rev((arb(x0))~[i2]))-->T445(Stat43*) ==> Stat46: (Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2])) in Ra
	(Ra_Rev((arb(x0))~[i2]) ¥Ra_PLUS Ra_Rev((arb(x0))~[i2]),eps ¥Ra_PLUS eps,eps)-->T498(Stat19,Stat31,Stat46,Stat45,Stat44*) ==> false; Discharge ==> Stat47: ((arb(x0))~[n0]) ¥Ra_GE Ra_0
--
-- On the other hand, concerning $(arb(y0))~[n1]$, we can argue in an entirely
-- analogous fashion to draw a contradiction from the temporary assumption that
-- this quantity is negative.
--
	Suppose ==> Stat48: not(((arb(y0))~[n1]) ¥Ra_GE Ra_0)
		y0-->T611(*) ==> Stat49: Cauchy_to_Re(Ras_ABS(arb(y0))) = Cauchy_to_Re(arb(y0))
		(Ras_ABS(arb(y0)),arb(y0))-->T610(Stat2,Stat7,Stat49*) ==> Stat50:Ra_eqseq(Ras_ABS(arb(y0)),arb(y0))
		(Ras_ABS(arb(y0)),arb(y0))-->T541(Stat5,Stat8,Stat50*) ==> Stat51: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps}))
		eps-->Stat51(Stat19,Stat19*) ==> Stat52: Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps})
		Set_monot(Stat52) ==> {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps} ¥incin {x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps}
		({x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps},{x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps})-->T189(Stat52*) ==> Stat53: Finite({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps})
		Suppose ==> Stat54: (FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[i]) ¥Ra_MINUS ((arb(y0))~[i])) ¥Ra_GT eps)
			Suppose ==> Stat55: {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps} incs (Za - n)
			({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps},Za - n)-->T189(Stat55,Stat17,Stat53*) ==> false; Discharge ==> Stat56: not({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps} incs (Za - n))
			i5-->Stat56(Stat56*) ==> (i5 in (Za - n)) & Stat57: (i5 notin {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) ¥Ra_MINUS ((arb(y0))~[x])) ¥Ra_GT eps})
			i5-->Stat54(Stat56*) ==> Ra_ABS(((Ras_ABS(arb(y0)))~[i5]) ¥Ra_MINUS ((arb(y0))~[i5])) ¥Ra_GT eps
		i5-->Stat57(Stat56*) ==> false; Discharge ==> Stat58: not(FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[i]) ¥Ra_MINUS ((arb(y0))~[i])) ¥Ra_GT eps)
		i3-->Stat58(Stat58*) ==> Stat59: (i3 in (Za - n)) & (not(Ra_ABS(((Ras_ABS(arb(y0)))~[i3]) ¥Ra_MINUS ((arb(y0))~[i3])) ¥Ra_GT eps))
		i3-->Stat26(Stat48*) ==> (Ra_ABS((arb(y0))~[i3]) ¥Ra_GT eps) & (Ra_ABS((arb(y0))~[i3]) = Ra_Rev((arb(y0))~[i3]))
		Use_def(¥Ra_MINUS)(Stat58*) ==> (((Ras_ABS(arb(y0)))~[i3]) ¥Ra_MINUS ((arb(y0))~[i3])) = (((Ras_ABS(arb(y0)))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3]))
		(arb(y0),arb(y0),i3)-->T555(Stat59,Stat5*) ==> ((Ras_ABS(arb(y0)))~[i3]) = Ra_ABS((arb(y0))~[i3])
		EQUAL(Stat59) ==> (Ra_Rev((arb(y0))~[i3]) ¥Ra_GT eps) & (not(Ra_ABS(Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3])) ¥Ra_GT eps))
		(arb(y0),i3)-->T540(Stat5,Stat59*) ==> ((arb(y0))~[i3]) in Ra
		((arb(y0))~[i3])-->T452(Stat59*) ==> Ra_Rev((arb(y0))~[i3]) in Ra
		(Ra_Rev((arb(y0))~[i3]),eps,Ra_0)-->T498(Stat19*) ==> Ra_Rev((arb(y0))~[i3]) ¥Ra_GT Ra_0
		(Ra_Rev((arb(y0))~[i3]))-->T482(Stat59*) ==> Ra_is_nonneg(Ra_Rev((arb(y0))~[i3]))
		(Ra_Rev((arb(y0))~[i3]),Ra_Rev((arb(y0))~[i3]))-->T469(Stat59*) ==> Ra_is_nonneg(Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3]))
		(Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3]))-->Stat28(Stat59*) ==> Ra_ABS(Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3])) = (Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3]))
		EQUAL(Stat59) ==> Stat60: not(Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3]) ¥Ra_GT eps)
		(Ra_Rev((arb(y0))~[i3]),eps)-->T473(Stat59*) ==> Ra_Rev((arb(y0))~[i3]) ¥Ra_GE eps
		(Ra_Rev((arb(y0))~[i3]),eps,Ra_Rev((arb(y0))~[i3]),eps)-->T504(Stat19*) ==> Stat61: (Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3])) ¥Ra_GT (eps ¥Ra_PLUS eps)
		(Ra_Rev((arb(y0))~[i3]),Ra_Rev((arb(y0))~[i3]))-->T445(Stat59*) ==> Stat62: (Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3])) in Ra
	(Ra_Rev((arb(y0))~[i3]) ¥Ra_PLUS Ra_Rev((arb(y0))~[i3]),eps ¥Ra_PLUS eps,eps)-->T498(Stat31,Stat19,Stat62,Stat61,Stat60*) ==> false; Discharge ==> Stat63: ((arb(y0))~[n1]) ¥Ra_GE Ra_0
--
-- Now, thanks to Theorem 541, we can reformulate the condition for sequence
-- inequivalence which is part of our initial hypothesis as the condition that the set
--	${i : i in Za | Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i])) ¥Ra_GT eps3}$
-- is infinite for a suitable positive rational number $eps3$.
--
	(arb(x0) ¥Ras_TIMES arb(y0),Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))-->T541(*) ==> Stat64: not(FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({i : i in Za | Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i])) ¥Ra_GT eps}))
	eps3-->Stat64(Stat64*) ==> Stat65: (eps3 in Ra) & (eps3 ¥Ra_GT Ra_0) &
		(not Finite({i : i in Za | Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i])) ¥Ra_GT eps3}))
--
-- However, it is easy to see that the quantity
--	$Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[x]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0))~[x]))$
-- is null for every integer $i$ greater than or equal to $n$, and hence the set under
-- examination must be a subset of $n$ which is finite. Hence it will be finite in its
-- turn, which leads to a contradiction proving the desired assertion.
--
	(n,{i : i in Za | Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i])) ¥Ra_GT eps3})-->T189(Stat16,Stat65*) ==> Stat66: not(n incs {i : i in Za | Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i])) ¥Ra_GT eps3})
	i6-->Stat66(Stat66*) ==> Stat67: (i6 in {i in Za | Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i])) ¥Ra_GT eps3}) & (i6 notin n)
	()-->Stat68(Stat67*) ==> Stat68: (i6 in (Za - n)) & (Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6])) ¥Ra_GT eps3)
	Suppose ==> ((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) = ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6])
		(arb(x0) ¥Ras_TIMES arb(y0),i6)-->T540(Stat5,Stat68*) ==> ((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) in Ra
		(arb(x0) ¥Ras_TIMES arb(y0),arb(x0) ¥Ras_TIMES arb(y0))-->T554(Stat5,Stat5*) ==> (Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0))) in RaSeq
		(Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)),i6)-->T540(Stat68*) ==> ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6]) in Ra
		((arb(x0) ¥Ras_TIMES arb(y0))~[i6],(Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6])-->T454(Stat68*) ==> (((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6])) in Ra
		(((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6]))-->T527(Stat68*) ==> Stat69: Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6])) in Ra
		(Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6])),eps3,Ra_0)-->T498(Stat68,Stat65,Stat69,Stat20*) ==> Stat70: Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6])) ¥Ra_GT Ra_0
		(Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6])),Ra_0)-->T473(Stat70,Stat20*) ==> Stat71: Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6])) /= Ra_0
		((arb(x0) ¥Ras_TIMES arb(y0))~[i6])-->T452(Stat68*) ==> ((((arb(x0) ¥Ras_TIMES arb(y0))~[i6])) ¥Ra_PLUS Ra_Rev(((arb(x0) ¥Ras_TIMES arb(y0))~[i6]))) = Ra_0
        	T465(Stat71*) ==> Ra_is_nonneg(Ra_0)
	        T525(Stat71*) ==> Stat72: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
        	Ra_0-->Stat72(Stat71*) ==> Ra_ABS(Ra_0) = Ra_0
		EQUAL(Stat68) ==> Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) ¥Ra_PLUS Ra_Rev((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6])) = Ra_0
		Use_def(¥Ra_MINUS)(Stat71*) ==> Ra_ABS(((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) ¥Ra_MINUS ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6])) = Ra_0
	(Stat71*)ELEM ==> false; Discharge ==> Stat73: ((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) /= ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6])
	(arb(x0),arb(y0),i6)-->T555(Stat5,Stat68*) ==> ((arb(x0) ¥Ras_TIMES arb(y0))~[i6]) = (((arb(x0))~[i6]) ¥Ra_TIMES ((arb(y0))~[i6]))
	(arb(x0) ¥Ras_TIMES arb(y0),arb(x0) ¥Ras_TIMES arb(y0),i6)-->T555(Stat5,Stat68*) ==> ((Ras_ABS(arb(x0) ¥Ras_TIMES arb(y0)))~[i6]) = Ra_ABS((arb(x0) ¥Ras_TIMES arb(y0))~[i6])
	EQUAL(Stat73) ==> Stat74: (((arb(x0))~[i6]) ¥Ra_TIMES ((arb(y0))~[i6])) /= Ra_ABS(((arb(x0))~[i6]) ¥Ra_TIMES ((arb(y0))~[i6]))
--
--
--
	Suppose ==> not((((arb(x0))~[i6]) in Ra) & Ra_is_nonneg(((arb(x0))~[i6])))
		(arb(x0),i6)-->T540(Stat5,Stat68*) ==> ((arb(x0))~[i6]) in Ra
		i6-->Stat23(Stat68,Stat47*) ==> Ra_ABS((arb(x0))~[i6]) = ((arb(x0))~[i6])
		((arb(x0))~[i6])-->T528(Stat74*) ==> ((arb(x0))~[i6]) ¥Ra_GE Ra_0
	((arb(x0))~[i6])-->T482(Stat74*) ==> false; Discharge ==> (((arb(x0))~[i6]) in Ra) & Ra_is_nonneg(((arb(x0))~[i6]))
	Suppose ==> not((((arb(y0))~[i6]) in Ra) & Ra_is_nonneg(((arb(y0))~[i6])))
		(arb(y0),i6)-->T540(Stat5,Stat68*) ==> ((arb(y0))~[i6]) in Ra
		i6-->Stat26(Stat68,Stat63*) ==> Ra_ABS((arb(y0))~[i6]) = ((arb(y0))~[i6])
		((arb(y0))~[i6])-->T528(Stat74*) ==> ((arb(y0))~[i6]) ¥Ra_GE Ra_0
	((arb(y0))~[i6])-->T482(Stat74*) ==> false; Discharge ==> (((arb(y0))~[i6]) in Ra) & Ra_is_nonneg(((arb(y0))~[i6]))
	((arb(x0))~[i6],(arb(y0))~[i6])-->T469(Stat74*) ==> Stat75: Ra_is_nonneg(((arb(x0))~[i6]) ¥Ra_TIMES ((arb(y0))~[i6]))
	((arb(x0))~[i6],(arb(y0))~[i6])-->T448(Stat74*) ==> (((arb(x0))~[i6]) ¥Ra_TIMES ((arb(y0))~[i6])) in Ra
	(((arb(x0))~[i6]) ¥Ra_TIMES ((arb(y0))~[i6]))-->T482(Stat75*) ==> (((arb(x0))~[i6]) ¥Ra_TIMES ((arb(y0))~[i6])) ¥Ra_GE Ra_0
(((arb(x0))~[i6]) ¥Ra_TIMES ((arb(y0))~[i6]))-->T528(Stat74*) ==> false; Discharge ==> QED
--
Theorem 667: [The sum and product of two non-negative reals is non-negative] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) ¥imp (R_is_nonneg(X ¥R_PLUS Y) & R_is_nonneg(X ¥R_TIMES Y)). Proof:
Suppose_not(x,y) ==> AUTO
    x-->T611(*) ==> Stat1: (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
    y-->T611(*) ==> Stat2: (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
    Suppose ==> (not R_is_nonneg(x ¥R_PLUS y))
	Use_def(¥R_PLUS) ==> (not R_is_nonneg(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y))))
	Use_def(R_is_nonneg) ==> Stat3: (Cauchy_to_Re(Ras_ABS(arb(x))) = x) & (Cauchy_to_Re(Ras_ABS(arb(y))) = y) &
		(Cauchy_to_Re(Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y))))) /= Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)))
	(arb(x),arb(y))-->T556(Stat1,Stat2*) ==> (arb(x) ¥Ras_PLUS arb(y)) in RaCauchy
--
	(arb(x) ¥Ras_PLUS arb(y),arb(x) ¥Ras_PLUS arb(y))-->T610(Stat3*) ==> (Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)) in Re)  & (Ra_eqseq(arb(x) ¥Ras_PLUS arb(y),arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)))))
	(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)))-->T611(Stat3*) ==> arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y))) in RaCauchy
	(arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y))),arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y))))-->T556(Stat3*) ==> Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)))) in RaCauchy
	(Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)))),arb(x) ¥Ras_PLUS arb(y))-->T610(Stat3*) ==> (not Ra_eqseq(Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)))),arb(x) ¥Ras_PLUS arb(y)))
	Suppose ==> Ra_eqseq(Ras_ABS(arb(x) ¥Ras_PLUS arb(y)),Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)))))
		(arb(x) ¥Ras_PLUS arb(y),arb(x) ¥Ras_PLUS arb(y))-->T556(Stat3*) ==> Ras_ABS(arb(x) ¥Ras_PLUS arb(y)) in RaCauchy
		(x,y)-->T665(*) ==> Ra_eqseq(arb(x) ¥Ras_PLUS arb(y),Ras_ABS(arb(x) ¥Ras_PLUS arb(y)))
		T539(Stat3*) ==> ((arb(x) ¥Ras_PLUS arb(y)) in RaSeq) & ((Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y))))) in RaSeq) & (Ras_ABS(arb(x) ¥Ras_PLUS arb(y)) in RaSeq)
	(arb(x) ¥Ras_PLUS arb(y),Ras_ABS(arb(x) ¥Ras_PLUS arb(y)),Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)))))-->T553(Stat3*) ==> false; Discharge ==> (not Ra_eqseq(Ras_ABS(arb(x) ¥Ras_PLUS arb(y)),Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y))))))
	(arb(x) ¥Ras_PLUS arb(y),arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y))))-->T576(Stat3*) ==> (not Ra_eqseq(arb(x) ¥Ras_PLUS arb(y),arb(Cauchy_to_Re(arb(x) ¥Ras_PLUS arb(y)))))
    (x,y)-->T662(*) ==> false; Discharge ==> (not R_is_nonneg(x ¥R_TIMES y))
--
--
--
	Use_def(¥R_TIMES) ==> (not R_is_nonneg(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y))))
	Use_def(R_is_nonneg) ==> Stat4: (Cauchy_to_Re(Ras_ABS(arb(x))) = x) & (Cauchy_to_Re(Ras_ABS(arb(y))) = y) &
		(Cauchy_to_Re(Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y))))) /= Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)))
	x-->T611(*) ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	y-->T611(*) ==> (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
	(arb(x),arb(y))-->T561(Stat1,Stat2*) ==> (arb(x) ¥Ras_TIMES arb(y)) in RaCauchy
--
	(arb(x) ¥Ras_TIMES arb(y),arb(x) ¥Ras_TIMES arb(y))-->T610(Stat4*) ==> (Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)) in Re)  & (Ra_eqseq(arb(x) ¥Ras_TIMES arb(y),arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)))))
	(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)))-->T611(Stat4*) ==> arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y))) in RaCauchy
	(arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y))),arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y))))-->T556(Stat4*) ==> Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)))) in RaCauchy
	(Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)))),arb(x) ¥Ras_TIMES arb(y))-->T610(Stat4*) ==> (not Ra_eqseq(Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)))),arb(x) ¥Ras_TIMES arb(y)))
	Suppose ==> Ra_eqseq(Ras_ABS(arb(x) ¥Ras_TIMES arb(y)),Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)))))
		(arb(x) ¥Ras_TIMES arb(y),arb(x) ¥Ras_TIMES arb(y))-->T556(Stat4*) ==> Ras_ABS(arb(x) ¥Ras_TIMES arb(y)) in RaCauchy
		(x,y)-->T666(*) ==> Ra_eqseq(arb(x) ¥Ras_TIMES arb(y),Ras_ABS(arb(x) ¥Ras_TIMES arb(y)))
		T539(Stat4*) ==> ((arb(x) ¥Ras_TIMES arb(y)) in RaSeq) & ((Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y))))) in RaSeq) & (Ras_ABS(arb(x) ¥Ras_TIMES arb(y)) in RaSeq)
	(arb(x) ¥Ras_TIMES arb(y),Ras_ABS(arb(x) ¥Ras_TIMES arb(y)),Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)))))-->T553(Stat4*) ==> false; Discharge ==> (not Ra_eqseq(Ras_ABS(arb(x) ¥Ras_TIMES arb(y)),Ras_ABS(arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y))))))
	(arb(x) ¥Ras_TIMES arb(y),arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y))))-->T576(Stat4*) ==> (not Ra_eqseq(arb(x) ¥Ras_TIMES arb(y),arb(Cauchy_to_Re(arb(x) ¥Ras_TIMES arb(y)))))
(x,y)-->T662(*) ==> false; Discharge ==> QED
--
Theorem 668: [Transitivity of ordering] ((X in Re) & (Y in Re) & (Z in Re) & (X ¥R_GE Y) & (Y ¥R_GE Z)) ¥imp (X ¥R_GE Z). Proof:
	Suppose_not(x,y,z0) ==> AUTO
	Use_def(¥R_GE) ==> R_is_nonneg(x ¥R_MINUS y) & R_is_nonneg(y ¥R_MINUS z0) & (not R_is_nonneg(x ¥R_MINUS z0))
	(x,y)-->T635 ==> x ¥R_MINUS y = x ¥R_PLUS R_Rev(y)
	(y,z0)-->T635 ==> y ¥R_MINUS z0 = y ¥R_PLUS R_Rev(z0)
	(x,z0)-->T635 ==> x ¥R_MINUS z0 = x ¥R_PLUS R_Rev(z0)
	EQUAL ==> R_is_nonneg(x ¥R_PLUS R_Rev(y)) & R_is_nonneg(y ¥R_PLUS R_Rev(z0)) & (not R_is_nonneg(x ¥R_PLUS R_Rev(z0)))
	y-->T613 ==> R_Rev(y) in Re
	z0-->T613 ==> R_Rev(z0) in Re
	(x,R_Rev(y))-->T613 ==> x ¥R_PLUS R_Rev(y) in Re
	(y,R_Rev(z0))-->T613 ==> y ¥R_PLUS R_Rev(z0) in Re
	(x ¥R_PLUS R_Rev(y),y ¥R_PLUS R_Rev(z0))-->T667 ==> R_is_nonneg((x ¥R_PLUS R_Rev(y)) ¥R_PLUS (y ¥R_PLUS R_Rev(z0)))
	(x,R_Rev(y),y ¥R_PLUS R_Rev(z0))-->T617 ==> (x ¥R_PLUS R_Rev(y)) ¥R_PLUS (y ¥R_PLUS R_Rev(z0)) = x ¥R_PLUS (R_Rev(y) ¥R_PLUS (y ¥R_PLUS R_Rev(z0)))
	(R_Rev(y),y,R_Rev(z0))-->T617 ==> R_Rev(y) ¥R_PLUS (y ¥R_PLUS R_Rev(z0)) = (R_Rev(y) ¥R_PLUS y) ¥R_PLUS R_Rev(z0)
	EQUAL ==> (x ¥R_PLUS R_Rev(y)) ¥R_PLUS (y ¥R_PLUS R_Rev(z0)) = (x ¥R_PLUS ((R_Rev(y) ¥R_PLUS y) ¥R_PLUS R_Rev(z0)))
	y-->T632 ==> R_Rev(y) ¥R_PLUS y = R_0
	EQUAL ==> (x ¥R_PLUS R_Rev(y)) ¥R_PLUS (y ¥R_PLUS R_Rev(z0)) = (x ¥R_PLUS (R_0 ¥R_PLUS R_Rev(z0)))
	(R_Rev(z0))-->T626 ==> R_0 ¥R_PLUS R_Rev(z0) = R_Rev(z0)
	EQUAL ==> false; Discharge ==> QED
--
Theorem 669: [The reals are a linearly ordered set] ((X in Re) & (Y in Re)) ¥imp ((X ¥R_GT Y) or (X = Y) or (Y ¥R_GT X)). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(¥R_GT)(*) ==> (x /= y) & (not R_is_nonneg(x ¥R_MINUS y)) & (not R_is_nonneg(y ¥R_MINUS x))
	(x,y)-->T644(*) ==> R_Rev(x ¥R_MINUS y) = (y ¥R_MINUS x)
	EQUAL ==> (not R_is_nonneg(R_Rev(x ¥R_MINUS y)))
	(x,y)-->T614 ==> AUTO
(x ¥R_MINUS y)-->T663(*) ==> false; Discharge ==> QED
--
Theorem 670: [The reals are a linearly ordered set, 2] ((X in Re) & (Y in Re)) ¥imp ((X ¥R_LT Y) or (X = Y) or (Y ¥R_LT X)). Proof:
Suppose_not(x,y) ==> AUTO
	(y,x)-->T669(*) ==> (y ¥R_GT x) or (y = x) or (x ¥R_GT y)
	Use_def(¥R_GT)(*) ==> (R_is_nonneg(y ¥R_MINUS x) & (y /= x)) or (y = x) or (R_is_nonneg(x ¥R_MINUS y) & (x /= y))
Use_def(¥R_LT)(*) ==> false; Discharge ==> QED
--
Theorem 671: [0 and 1 are non-negative reals] R_is_nonneg(R_0) & R_is_nonneg(R_1). Proof:
Suppose_not ==> AUTO
	Use_def(R_is_nonneg) ==> Stat1: (Cauchy_to_Re(Ras_ABS(arb(R_0))) /= R_0) or (Cauchy_to_Re(Ras_ABS(arb(R_1))) /= R_1)
	()-->T545 ==> AUTO
	()-->T596 ==> AUTO
	Suppose ==> Stat2: Cauchy_to_Re(Ras_ABS(arb(R_0))) /= R_0
		Use_def(R_0)(Stat2*) ==> Cauchy_to_Re(Ras_ABS(arb(Cauchy_to_Re(Ra0Seq)))) /= Cauchy_to_Re(Ra0Seq)
		(Ra0Seq,Ra0Seq)-->T610(Stat1*) ==> Stat3: Ra_eqseq(Ra0Seq,arb(Cauchy_to_Re(Ra0Seq))) & (Cauchy_to_Re(Ra0Seq) in Re)
		(Cauchy_to_Re(Ra0Seq))-->T611(Stat3*) ==> arb(Cauchy_to_Re(Ra0Seq)) in RaCauchy
		(Ra0Seq,arb(Cauchy_to_Re(Ra0Seq)))-->T576(Stat1*) ==> Ra_eqseq(Ras_ABS(Ra0Seq),Ras_ABS(arb(Cauchy_to_Re(Ra0Seq))))
		EQUAL(Stat1) ==> Ra_eqseq(Ra0Seq,Ras_ABS(arb(Cauchy_to_Re(Ra0Seq))))
		(arb(Cauchy_to_Re(Ra0Seq)),Ra0Seq)-->T556(Stat1*) ==> Ras_ABS(arb(Cauchy_to_Re(Ra0Seq))) in RaCauchy
	(Ra0Seq,Ras_ABS(arb(Cauchy_to_Re(Ra0Seq))))-->T610(Stat1*) ==> false; Discharge ==> Stat4: Cauchy_to_Re(Ras_ABS(arb(R_1))) /= R_1
--
-- The rest of this proof is entirely analogous to the part of it which precedes.
--
	Use_def(R_1)(Stat4*) ==> Cauchy_to_Re(Ras_ABS(arb(Cauchy_to_Re(Ra1Seq)))) /= Cauchy_to_Re(Ra1Seq)
	(Ra1Seq,Ra1Seq)-->T610(Stat1*) ==> Stat5: Ra_eqseq(Ra1Seq,arb(Cauchy_to_Re(Ra1Seq))) & (Cauchy_to_Re(Ra1Seq) in Re)
	(Cauchy_to_Re(Ra1Seq))-->T611(Stat5*) ==> arb(Cauchy_to_Re(Ra1Seq)) in RaCauchy
	(Ra1Seq,arb(Cauchy_to_Re(Ra1Seq)))-->T576(Stat1*) ==> Ra_eqseq(Ras_ABS(Ra1Seq),Ras_ABS(arb(Cauchy_to_Re(Ra1Seq))))
	EQUAL(Stat1) ==> Ra_eqseq(Ra1Seq,Ras_ABS(arb(Cauchy_to_Re(Ra1Seq))))
	(arb(Cauchy_to_Re(Ra1Seq)),Ra1Seq)-->T556(Stat1*) ==> Ras_ABS(arb(Cauchy_to_Re(Ra1Seq))) in RaCauchy
(Ra1Seq,Ras_ABS(arb(Cauchy_to_Re(Ra1Seq))))-->T610(Stat1*) ==> false; Discharge ==> QED

--
Theorem 672: [The reals are a linearly ordered set, 3] ((X in Re) & (Y in Re)) ¥imp (((X ¥R_GE Y) or (Y ¥R_GE X)) & (((X ¥R_GE Y) & (Y ¥R_GE X)) ¥imp (X = Y))). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(¥R_GE)(*) ==> not(((R_is_nonneg(x ¥R_MINUS y) or R_is_nonneg(y ¥R_MINUS x)) & ((R_is_nonneg(x ¥R_MINUS y) & R_is_nonneg(y ¥R_MINUS x)) ¥imp (x = y))))
	(x,y)-->T669(*) ==> Stat1: (x ¥R_GT y) or (x = y) or (y ¥R_GT x)
	Use_def(¥R_GT)(Stat1*) ==> Stat2: (R_is_nonneg(x ¥R_MINUS y) & (x /= y)) or (x = y) or (R_is_nonneg(y ¥R_MINUS x) & (y /= x))
	Suppose ==> not(R_is_nonneg(x ¥R_MINUS y) or R_is_nonneg(y ¥R_MINUS x))
		(Stat2*)ELEM ==> x = y
		x-->T631(*) ==> (x ¥R_MINUS x) = R_0
		T671(*) ==> R_is_nonneg(R_0)
	EQUAL(Stat2) ==> false; Discharge ==> Stat3: R_is_nonneg(x ¥R_MINUS y) & R_is_nonneg(y ¥R_MINUS x) & (x /= y)
	(x,y)-->T644(*) ==> R_Rev(x ¥R_MINUS y) = (y ¥R_MINUS x)
	EQUAL(Stat3*) ==> R_is_nonneg(R_Rev(x ¥R_MINUS y))
	(x,y)-->T614(*) ==> (x ¥R_MINUS y) in Re
	(x ¥R_MINUS y)-->T663(Stat3*) ==> (x ¥R_MINUS y) = R_0
	(x,y)-->T641(*) ==> x = y ¥R_PLUS (x ¥R_MINUS y)
	y-->T626(*) ==> y ¥R_PLUS R_0 = y
EQUAL(Stat3) ==> false; Discharge ==> QED
--
Theorem 673: [The ordering of reals is defined by the sign of their differences] ((((X in Re) & (Y in Re)) ¥imp ((X ¥R_GE Y) ¥eq R_is_nonneg(X ¥R_PLUS R_Rev(Y))))) & ((X ¥R_LE Y) ¥eq (Y ¥R_GE X)) & ((X ¥R_GT Y) ¥eq ((X ¥R_GE Y) & (X /= Y))) & ((X ¥R_LT Y) ¥eq (Y ¥R_GT X)). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(¥R_LE) ==> (x ¥R_LE y) ¥eq R_is_nonneg(y ¥R_MINUS x)
--??	Use_def(y ¥R_GE x) ==> AUTO
	Use_def(¥R_GE) ==> Stat1: (x ¥R_LE y) ¥eq (y ¥R_GE x)
	Use_def(¥R_LT) ==> (x ¥R_LT y) ¥eq (R_is_nonneg(y ¥R_MINUS x) & (x /= y))
	Use_def(¥R_GT) ==> (y ¥R_GT x) ¥eq (R_is_nonneg(y ¥R_MINUS x) & (y /= x))
	Use_def(¥R_GE) ==> (x ¥R_GE y) ¥eq R_is_nonneg(x ¥R_MINUS y)
	Use_def(¥R_GT) ==> Stat2: (x in Re) & (y in Re) & (not((x ¥R_GE y) ¥eq R_is_nonneg(x ¥R_PLUS R_Rev(y))))
	(x,y)-->T635(Stat2*) ==> (x ¥R_MINUS y) = (x ¥R_PLUS R_Rev(y))
EQUAL ==> false; Discharge ==> QED
--
Theorem 674: [Various basic properties of real comparison, quantified form] (FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_GE y) ¥eq R_is_nonneg(x ¥R_PLUS R_Rev(y)))) & (FORALL x, y | ((x ¥R_LE y) ¥eq (y ¥R_GE x))) & (FORALL x, y | ((x ¥R_GT y) ¥eq ((x ¥R_GE y) & (x /= y)))) & (FORALL x, y | ((x ¥R_LT y) ¥eq (y ¥R_GT x))) & (FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_LE y) ¥eq (R_is_nonneg(y ¥R_PLUS R_Rev(x))))) & (FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_PLUS R_Rev(y)) & (x /= y)))) & (FORALL x, y | (((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_MINUS y) & (x /= y))))) & (FORALL x, y | ((x in Re) & (y in Re) & ((x = y) or (not(x ¥R_GE y)))) ¥imp (y ¥R_GE x)). Proof:
Suppose_not ==> AUTO
	Suppose ==> Stat1: not(FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_GE y) ¥eq R_is_nonneg(x ¥R_PLUS R_Rev(y))))
		(x1,y1)-->Stat1(Stat1*) ==> (x1 in Re) & (y1 in Re) & (not((x1 ¥R_GE y1) ¥eq R_is_nonneg(x1 ¥R_PLUS R_Rev(y1))))
	(x1,y1)-->T673(Stat1*) ==> false; Discharge ==> (FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_GE y) ¥eq R_is_nonneg(x ¥R_PLUS R_Rev(y))))
	Suppose ==> Stat2: not(FORALL x, y | (x ¥R_LE y) ¥eq (y ¥R_GE x))
		(x2,y2)-->Stat2(Stat2*) ==> not((x2 ¥R_LE y2) ¥eq (y2 ¥R_GE x2))
	(x2,y2)-->T673(Stat2*) ==> false; Discharge ==> (FORALL x, y | (x ¥R_LE y) ¥eq (y ¥R_GE x))
	Suppose ==> Stat3: not(FORALL x, y | (x ¥R_GT y) ¥eq ((x ¥R_GE y) & (x /= y)))
		(x3,y3)-->Stat3(Stat3*) ==> not((x3 ¥R_GT y3) ¥eq ((x3 ¥R_GE y3) & (x3 /= y3)))
	(x3,y3)-->T673(Stat3*) ==> false; Discharge ==> (FORALL x, y | (x ¥R_GT y) ¥eq ((x ¥R_GE y) & (x /= y)))
	Suppose ==> Stat4: not(FORALL x, y | (x ¥R_LT y) ¥eq (y ¥R_GT x))
		(x4,y4)-->Stat4(Stat4*) ==> not((x4 ¥R_LT y4) ¥eq (y4 ¥R_GT x4))
	(x4,y4)-->T673(Stat4*) ==> false; Discharge ==> (FORALL x, y | (x ¥R_LT y) ¥eq (y ¥R_GT x))
	Suppose ==> Stat5: not(FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_LE y) ¥eq (R_is_nonneg(y ¥R_PLUS R_Rev(x)))))
		(x5,y5)-->Stat5(Stat5*) ==> (x5 in Re) & (y5 in Re) & (not((x5 ¥R_LE y5) ¥eq (R_is_nonneg(y5 ¥R_PLUS R_Rev(x5)))))
		(x5,y5)-->T673(Stat5*) ==> (x5 ¥R_LE y5) ¥eq (y5 ¥R_GE x5)
	(y5,x5)-->T673(Stat5*) ==> false; Discharge ==> (FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_LE y) ¥eq (R_is_nonneg(y ¥R_PLUS R_Rev(x)))))
	Suppose ==> Stat6: not(FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_PLUS R_Rev(y)) & (x /= y))))
		(x6,y6)-->Stat6(Stat6*) ==> not(((x6 in Re) & (y6 in Re)) ¥imp ((x6 ¥R_GT y6) ¥eq (R_is_nonneg(x6 ¥R_PLUS R_Rev(y6)) & (x6 /= y6))))
		(x6,y6)-->T673(Stat6*) ==> (x6 ¥R_GT y6) ¥eq ((x6 ¥R_GE y6) & (x6 /= y6))
	(x6,y6)-->T673(Stat6*) ==> false; Discharge ==> Stat7: (FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_PLUS R_Rev(y)) & (x /= y))))
	Suppose ==> Stat8: not(FORALL x, y | (((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_MINUS y) & (x /= y)))))
		(x7,y7)-->Stat8(Stat8*) ==> not(((x7 in Re) & (y7 in Re)) ¥imp ((x7 ¥R_GT y7) ¥eq (R_is_nonneg(x7 ¥R_MINUS y7) & (x7 /= y7))))
		(x7,y7)-->T635(Stat8*) ==> (x7 ¥R_MINUS y7) = (x7 ¥R_PLUS R_Rev(y7))
		EQUAL(Stat8) ==> not(((x7 in Re) & (y7 in Re)) ¥imp ((x7 ¥R_GT y7) ¥eq (R_is_nonneg(x7 ¥R_PLUS R_Rev(y7)) & (x7 /= y7))))
	(x7,y7)-->Stat7(Stat8*) ==> false; Discharge ==> Stat9: not(FORALL x, y | ((x in Re) & (y in Re) & ((x = y) or (not(x ¥R_GE y)))) ¥imp (y ¥R_GE x))
	(x8,y8)-->Stat9(Stat9*) ==> ((x8 in Re) & (y8 in Re) & ((x8 = y8) or (not(x8 ¥R_GE y8)))) & (not(y8 ¥R_GE x8))
	(x8,y8)-->T672(Stat9*) ==> (x8 ¥R_GE y8) or (y8 ¥R_GE x8)
	Suppose ==> x8 = y8
	EQUAL(Stat9) ==> false; Discharge ==> x8 /= y8
(Stat9*)Discharge ==> QED
--
Theorem 675: [Various basic properties of real comparison] (((X in Re) & (Y in Re)) ¥imp ((X ¥R_GE Y) ¥eq R_is_nonneg(X ¥R_PLUS R_Rev(Y)))) & ((X ¥R_LE Y) ¥eq (Y ¥R_GE X)) & ((X ¥R_GT Y) ¥eq ((X ¥R_GE Y) & (X /= Y))) & ((X ¥R_LT Y) ¥eq (Y ¥R_GT X)) & (((X in Re) & (Y in Re)) ¥imp ((X ¥R_LE Y) ¥eq R_is_nonneg(Y ¥R_PLUS R_Rev(X)))) & (((X in Re) & (Y in Re)) ¥imp ((X ¥R_GT Y) ¥eq (R_is_nonneg(X ¥R_PLUS R_Rev(Y)) & (X /= Y)))) & (((X in Re) & (Y in Re)) ¥imp ((X ¥R_GT Y) ¥eq (R_is_nonneg(X ¥R_MINUS Y) & (X /= Y)))) & (((X in Re) & (Y in Re) & ((X = Y) or (not(X ¥R_GE Y)))) ¥imp (Y ¥R_GE X)). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T673(*) ==> not((((x in Re) & (y in Re)) ¥imp ((x ¥R_LE y) ¥eq R_is_nonneg(y ¥R_PLUS R_Rev(x)))) & (((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_PLUS R_Rev(y)) & (x /= y)))) & (((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_MINUS y) & (x /= y)))) & (((x in Re) & (y in Re) & ((x = y) or (not(x ¥R_GE y)))) ¥imp (y ¥R_GE x)))
	T674(*) ==> Stat1: (FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_LE y) ¥eq (R_is_nonneg(y ¥R_PLUS R_Rev(x))))) &
		Stat2: (FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_PLUS R_Rev(y)) & (x /= y)))) &
		Stat3: (FORALL x, y | (((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_MINUS y) & (x /= y))))) &
		Stat4: (FORALL x, y | ((x in Re) & (y in Re) & ((x = y) or (not(x ¥R_GE y)))) ¥imp (y ¥R_GE x))
	Suppose ==> Stat5: not(((x in Re) & (y in Re)) ¥imp ((x ¥R_LE y) ¥eq R_is_nonneg(y ¥R_PLUS R_Rev(x))))
	(x,y)-->Stat1(Stat5*) ==> false; Discharge ==> (((x in Re) & (y in Re)) ¥imp ((x ¥R_LE y) ¥eq R_is_nonneg(y ¥R_PLUS R_Rev(x))))
	Suppose ==> Stat6: not(((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_PLUS R_Rev(y)) & (x /= y))))
	(x,y)-->Stat2(Stat6*) ==> false; Discharge ==> (((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_PLUS R_Rev(y)) & (x /= y))))
	Suppose ==> Stat7: not(((x in Re) & (y in Re)) ¥imp ((x ¥R_GT y) ¥eq (R_is_nonneg(x ¥R_MINUS y) & (x /= y))))
	(x,y)-->Stat3(Stat7*) ==> false; Discharge ==> Stat8: not(((x in Re) & (y in Re) & ((x = y) or (not(x ¥R_GE y)))) ¥imp (y ¥R_GE x))
(x,y)-->Stat4(Stat8*) ==> false; Discharge ==> QED
--
Theorem 676: [Mutual exclusion of strict real comparators] ((X in Re) & (Y in Re) & (X ¥R_GT Y)) ¥imp (not(X ¥R_LT Y)). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T675(*) ==> (x ¥R_GE y) & (x /= y) & (y ¥R_GT x)
	(y,x)-->T675(*) ==> y ¥R_GE x
	(x,y)-->T672(*) ==> false
	Discharge ==> QED
--
Theorem 677: [Transitivity of ordering, strict case] ((X in Re) & (Y in Re) & (Z in Re) & (X ¥R_GT Y) & (Y ¥R_GE Z)) ¥imp (X ¥R_GT Z). Proof:
Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T673(*) ==> x ¥R_GE y
	(x,y,z)-->T668(*) ==> x ¥R_GE z
	(x,z)-->T673(*) ==> x = z
	EQUAL ==> y ¥R_GE x
	(x,y)-->T672(*) ==> x = y
	EQUAL ==> x ¥R_GT x
(x,x)-->T673(*) ==> false; Discharge ==> QED
--
Theorem 678: [Transitivity of ordering, strict case 2] ((X in Re) & (Y in Re) & (Z in Re) & (X ¥R_GE Y) & (Y ¥R_GT Z)) ¥imp (X ¥R_GT Z). Proof:
Suppose_not(x,y,z) ==> AUTO
	(y,z)-->T673(*) ==> y ¥R_GE z
	(x,y,z)-->T668(*) ==> x ¥R_GE z
	(x,z)-->T673(*) ==> x = z
	EQUAL ==> y ¥R_GE x
	(x,y)-->T672(*) ==> x = y
	EQUAL ==> x ¥R_GT x
(x,x)-->T673(*) ==> false; Discharge ==> QED
--
Theorem 679: [Transitivity of ordering,strict case 3] ((X in Re) & (Y in Re) & (Z in Re) & (X ¥R_GT Y) & (Y ¥R_GT Z)) ¥imp (X ¥R_GT Z). Proof:
Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T673(*) ==> x ¥R_GE y
(x,y,z)-->T678(*) ==> false; Discharge ==> QED
--
Theorem 680: [Greater_than_equal is greater-than and equal] ((X in Re) & (Y in Re)) ¥imp ((X ¥R_GE Y) ¥eq ((X ¥R_GT Y) or (X = Y))). Proof:
Suppose_not(x,y) ==> AUTO
	Suppose ==> x ¥R_GT y
	(x,y)-->T673(*) ==> false; Discharge ==> not(x ¥R_GT y)
	Suppose ==> x = y
		(x,x)-->T672(*) ==> x ¥R_GE x
	EQUAL ==> false; Discharge ==> (x /= y) & (x ¥R_GE y)
(x,y)-->T673(*) ==> false; Discharge ==> QED
--
Theorem 681: [Greater_than_equal is greater-than and equal] (X in Re) ¥imp ((X ¥R_GE R_0) ¥eq R_is_nonneg(X)). Proof:
Suppose_not(x) ==> AUTO
	T612(*) ==> R_0 in Re
	(x,R_0)-->T680(*) ==> (x ¥R_GE R_0) ¥eq ((x ¥R_GT R_0) or (x = R_0))
	(x,R_0)-->T675(*) ==> (x ¥R_GE R_0) ¥eq ((R_is_nonneg(x ¥R_MINUS R_0) & (x /= R_0)) or (x = R_0))
	x-->T630(*) ==> (x ¥R_MINUS R_0) = x
	EQUAL ==> (x ¥R_GE R_0) ¥eq ((R_is_nonneg(x) & (x /= R_0)) or (x = R_0))
	ELEM ==> Stat1: not(((R_is_nonneg(x) & (x /= R_0)) or (x = R_0)) ¥imp R_is_nonneg(x))
	Suppose ==> x = R_0
		()-->T671 ==> AUTO
	EQUAL(Stat1) ==> false; Discharge ==> x /= R_0
(Stat1*)Discharge ==> QED
--
Theorem 682: [Less_than_equal is less-than and equal] ((X in Re) & (Y in Re)) ¥imp ((X ¥R_LE Y) ¥eq ((X ¥R_LT Y) or (X = Y))). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T673(*) ==> ((x ¥R_LE y) ¥eq (y ¥R_GE x)) & ((x ¥R_LT y) ¥eq (y ¥R_GT x))
(y,x)-->T680(*) ==> false; Discharge ==> QED
--
Theorem 683: [Transitivity of ordering by 'less than'] ((X in Re) & (Y in Re) & (Z in Re)) ¥imp (((X ¥R_LE Y) & (Y ¥R_LT Z)) ¥imp (X ¥R_LT Z)). Proof:
Suppose_not(x,y,z) ==> AUTO
	(y,z)-->T673(*) ==> z ¥R_GT y
	(x,y)-->T673(*) ==> y ¥R_GE x
	(x,z)-->T673(*) ==> not(z ¥R_GT x)
(z,y,x)-->T677(*) ==> false; Discharge ==> QED
--
Theorem 684: [Transitivity of ordering by 'less than', 2] ((X in Re) & (Y in Re) & (Z in Re)) ¥imp (((X ¥R_LT Y) & (Y ¥R_LE Z)) ¥imp (X ¥R_LT Z)). Proof:
Suppose_not(x,y,z) ==> AUTO
	(y,z)-->T673(*) ==> z ¥R_GE y
	(x,y)-->T673(*) ==> y ¥R_GT x
	(x,z)-->T673(*) ==> not(z ¥R_GT x)
(z,y,x)-->T678(*) ==> false; Discharge ==> QED
--
Theorem 685: [Transitivity of ordering by 'less than', 3] ((X in Re) & (Y in Re) & (Z in Re)) ¥imp (((X ¥R_LT Y) & (Y ¥R_LT Z)) ¥imp (X ¥R_LT Z)). Proof:
Suppose_not(x,y,z) ==> AUTO
	(y,z)-->T673(*) ==> z ¥R_GT y
	(x,y)-->T673(*) ==> y ¥R_GT x
	(x,z)-->T673(*) ==> not(z ¥R_GT x)
(z,y,x)-->T679(*) ==> false; Discharge ==> QED
--
Theorem 686: [No real is less than itself] not(X ¥R_LT X). Proof:
Suppose_not(x) ==> AUTO
Use_def(¥R_LT) ==> false; Discharge ==> QED
--
-- The properties of $¥R_GT$ are mirrored by properties of $¥R_LT$ and hence
-- enable us to exploit, in connection with $Re$, the theory of linear orderings.
--
Theorem 687: (FORALL x in Re, y in Re, z in Re | ((x ¥R_LT y) & (y ¥R_LT z)) ¥imp (x ¥R_LT z)). Proof:
    Suppose_not ==> Stat1: not(FORALL x in Re, y in Re, z in Re | ((x ¥R_LT y) & (y ¥R_LT z)) ¥imp (x ¥R_LT z))
        (x,y,w)-->Stat1(*) ==> (x in Re) & (y in Re) & (w in Re) & (x ¥R_LT y) & (y ¥R_LT w) & (not (x ¥R_LT w))
        (x,y)-->T675(*) ==> y ¥R_GT x
        (y,w)-->T675(*) ==> w ¥R_GT y
        (w,y)-->T675(*) ==> w ¥R_GE y
        (w,y,x)-->T678(*) ==> w ¥R_GT x
    (x,w)-->T675 ==> false; Discharge ==> QED
--
Theorem 688: (FORALL x in Re | not(x ¥R_LT x)). Proof:
    Suppose_not ==> Stat1: not(FORALL x in Re | not(x ¥R_LT x))
        x-->Stat1(*) ==> (x in Re) & (x ¥R_LT x)
    x-->T686(*) ==> false; Discharge ==> QED
--
Theorem 689: (FORALL x in Re, y in Re | (x ¥R_LT y) or (x = y) or (y ¥R_LT x)). Proof:
    Suppose_not ==> Stat1: not(FORALL x in Re, y in Re | (x ¥R_LT y) or (x = y) or (y ¥R_LT x))
        (x,y)-->Stat1(*) ==> (x in Re) & (y in Re) & (not((x ¥R_LT y) or (x = y) or (y ¥R_LT x)))
        (y,x)-->T672(*) ==> (y ¥R_GE x) or (x ¥R_GE y)
        Suppose ==> y ¥R_GE x
            (y,x)-->T675(*) ==> y ¥R_GT x
            (x,y)-->T675(*) ==> false; Discharge ==> (x ¥R_GE y) & (x /= y)
        (x,y)-->T675(*) ==> (x ¥R_GT y)
    (y,x)-->T675(*) ==> false; Discharge ==> QED
--
APPLY(smaller_thryvar:smaller_Re,ubs_thryvar:ubs_Re,min_over_thryvar:min_over_Re,max_thryvar:max_Re,lub_thryvar:lub_Re) linear_order(s0->Re, arg1_bef_arg2(X,Y)->(X ¥R_LT Y)) ==>
Theorem 690: (FORALL x, y | smaller_Re(x,y) = if ((x notin Re) & (y notin Re)) then Re elseif (x notin Re) then y elseif (y notin Re) then x elseif (x ¥R_LT y) then x else y end if) &
	(FORALL x, y | smaller_Re(x,y) = smaller_Re(y,x)) &
	(FORALL x, y | ({x,y} ¥incin Re) ¥imp (smaller_Re(x,y) in {x,y})) &
	(FORALL x | (x in next(Re)) ¥imp (smaller_Re(x,Re) = x)) &
	(FORALL x, y, z | smaller_Re(x,smaller_Re(y,z)) = smaller_Re(smaller_Re(x,y),z)) &
	(FORALL x, y | ((x in next(Re)) & (y in next(Re))) ¥imp (smaller_Re(x,y) in next(Re))) &
	(FORALL f,p,a | (Svm(f) & (range(f) ¥incin Re) & Finite(f)) ¥imp
		(((p in f) ¥imp (min_over_Re({p}) = (f~[car(p)]))) &
		(min_over_Re(f) = smaller_Re(min_over_Re(f ¥ON (domain(f) * a)),min_over_Re(f ¥ON (domain(f) - a)))))) &
	(FORALL f | (Svm(f) & (range(f) ¥incin Re) & Finite(f) & (f /= 0)) ¥imp (min_over_Re(f) in range(f))) &
	(FORALL x, y | ({x,y} ¥incin Re) ¥imp ((smaller_Re(x,y) = x) ¥eq ((x ¥R_LT y) or (x = y)))) &
	(FORALL t | ubs_Re(t) = {x in Re | (FORALL y in (t * Re) | smaller_Re(y,x) = y)}) &
	(FORALL t | max_Re(t) = arb({Re} + (t * ubs_Re(t)))) &
	(FORALL t | lub_Re(t) = arb({Re} + {x in ubs_Re(t) | ubs_Re(t) ¥incin ubs_Re({x})})) &
	(ubs_Re(0) = Re) & (max_Re(0) = Re) &
	(FORALL t | (ubs_Re(t) ¥incin Re) & (ubs_Re(t) = ubs_Re(t * Re)) & (max_Re(t) = max_Re(t * Re))) &
	(FORALL t, x | (Finite(t) & (x in t) & (t ¥incin Re)) ¥imp ((max_Re(t) in t) & ((x = max_Re(t)) or ((x ¥R_LT max_Re(t))))))
--
Theorem 691: [Sign reversal inverts comparisons] ((X in Re) & (Y in Re) & (X ¥R_GE Y)) ¥imp (R_Rev(Y) ¥R_GE R_Rev(X)). Proof:
Suppose_not(x,y) ==> AUTO
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	(y,y)-->T613(*) ==> R_Rev(y) in Re
	(R_Rev(y),R_Rev(x))-->T675(*) ==> (not R_is_nonneg(R_Rev(y) ¥R_PLUS R_Rev(R_Rev(x))))
	x-->T633(*) ==> R_Rev(R_Rev(x)) = x
	EQUAL ==> (not R_is_nonneg(R_Rev(y) ¥R_PLUS x))
	(R_Rev(y),x)-->T613(*) ==> (R_Rev(y) ¥R_PLUS x) in Re
	(R_Rev(y) ¥R_PLUS x)-->T663(*) ==> R_is_nonneg(R_Rev(R_Rev(y) ¥R_PLUS x))
	(R_Rev(y),x)-->T638(*) ==> R_Rev(R_Rev(y) ¥R_PLUS x) = R_Rev(R_Rev(y)) ¥R_PLUS R_Rev(x)
	y-->T633(*) ==> R_Rev(R_Rev(y)) = y
	EQUAL ==> R_is_nonneg(y ¥R_PLUS R_Rev(x))
	(y,x)-->T675(*) ==> y ¥R_GE x
	(x,y)-->T672(*) ==> y = x
	(R_Rev(y),R_Rev(y))-->T672(*) ==> R_Rev(y) ¥R_GE R_Rev(y)
EQUAL ==> false; Discharge ==> QED
--
Theorem 692: [Sign reversal inverts comparisons,2] ((X in Re) & (Y in Re)) ¥imp (((X ¥R_GE Y) ¥eq (R_Rev(Y) ¥R_GE R_Rev(X))) & ((X ¥R_GT Y) ¥eq (R_Rev(Y) ¥R_GT R_Rev(X)))). Proof:
Suppose_not(x,y) ==> AUTO
	(y,y)-->T613(*) ==> R_Rev(y) in Re
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	x-->T633(*) ==> R_Rev(R_Rev(x)) = x
	y-->T633(*) ==> R_Rev(R_Rev(y)) = y
	Suppose ==> not((x ¥R_GE y) ¥eq (R_Rev(y) ¥R_GE R_Rev(x)))
		(x,y)-->T691(*) ==> (R_Rev(y) ¥R_GE R_Rev(x)) & (not(x ¥R_GE y))
		(R_Rev(y),R_Rev(x))-->T691(*) ==> R_Rev(R_Rev(x)) ¥R_GE R_Rev(R_Rev(y))
	EQUAL ==> false; Discharge ==> not((x ¥R_GT y) ¥eq (R_Rev(y) ¥R_GT R_Rev(x)))
	Suppose ==> (x ¥R_GT y) & (not(R_Rev(y) ¥R_GT R_Rev(x)))
		(x,y)-->T675(*) ==> (x ¥R_GE y) & (x /= y)
		(x,y)-->T691(*) ==> R_Rev(y) ¥R_GE R_Rev(x)
		(R_Rev(y),R_Rev(x))-->T675(*) ==> R_Rev(y) = R_Rev(x)
	EQUAL ==> false; Discharge ==> (R_Rev(y) ¥R_GT R_Rev(x)) & (not(x ¥R_GT y))
	(R_Rev(y),R_Rev(x))-->T675(*) ==> (R_Rev(y) ¥R_GE R_Rev(x)) & (R_Rev(y) /= R_Rev(x))
	(R_Rev(y),R_Rev(x))-->T691(*) ==> R_Rev(R_Rev(x)) ¥R_GE R_Rev(R_Rev(y))
	y-->T633(*) ==> R_Rev(R_Rev(y)) = y
	x-->T633(*) ==> R_Rev(R_Rev(x)) = x
	EQUAL ==> x ¥R_GE y
	(x,y)-->T675(*) ==> x = y
EQUAL ==> false; Discharge ==> QED
--
--
Theorem 693: [Properties of the real zero and unit] (R_Rev(R_0) = R_0) & (R_1 /= R_0) & (R_1 ¥R_GT R_0) & (R_Recip(R_1) = R_1). Proof:
Suppose_not ==> AUTO
	()-->T629 ==> AUTO
	()-->T612 ==> AUTO
	Suppose ==> R_1 = R_0
		Use_def(R_1) ==> Cauchy_to_Re(Ra1Seq) = R_0
		Use_def(R_0) ==> R_0 = Cauchy_to_Re(Ra0Seq)
		EQUAL ==> Cauchy_to_Re(Ra1Seq) = Cauchy_to_Re(Ra0Seq)
		()-->T545 ==> AUTO
		(Ra1Seq,Ra0Seq)-->T610(*) ==> Ra_eqseq(Ra1Seq,Ra0Seq)
		()-->T539 ==> AUTO
		Ra_1-->T451 ==> (Ra_0 in Ra) & (Ra_1 in Ra) & (Ra_1 = (Ra_1 ¥Ra_PLUS Ra_0))
		()-->T481 ==> AUTO
		(Ra1Seq,Ra0Seq)-->T541(*) ==> Stat1: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
			Finite({x : x in Za | Ra_ABS((Ra1Seq~[x]) ¥Ra_MINUS (Ra0Seq~[x])) ¥Ra_GT eps}))
		(Ra_1,Ra_0)-->T519(*) ==> (Ra_1 ¥Ra_GT ((Ra_1 ¥Ra_PLUS Ra_0) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1))) &
			(((Ra_1 ¥Ra_PLUS Ra_0) ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1)) ¥Ra_GT Ra_0)
		Loc_def ==> eps = (Ra_1 ¥Ra_OVER (Ra_1 ¥Ra_PLUS Ra_1))
		EQUAL ==> Stat2: (Ra_1 ¥Ra_GT eps) & (eps ¥Ra_GT Ra_0)
		Ra_1-->T520(*) ==> eps in Ra
		eps-->Stat1(*) ==> Finite({x : x in Za | Ra_ABS((Ra1Seq~[x]) ¥Ra_MINUS (Ra0Seq~[x])) ¥Ra_GT eps})
		0-->T206(*) ==> (not Finite(Za))
		({x : x in Za | Ra_ABS((Ra1Seq~[x]) ¥Ra_MINUS (Ra0Seq~[x])) ¥Ra_GT eps},Za)-->T189(Stat1*) ==> Stat3: not({x : x in Za | Ra_ABS((Ra1Seq~[x]) ¥Ra_MINUS (Ra0Seq~[x])) ¥Ra_GT eps} incs Za)
		i-->Stat3(Stat3*) ==> Stat4: (i notin {x : x in Za | Ra_ABS((Ra1Seq~[x]) ¥Ra_MINUS (Ra0Seq~[x])) ¥Ra_GT eps}) & (i in Za)
		i-->Stat4(Stat4*) ==> not(Ra_ABS((Ra1Seq~[i]) ¥Ra_MINUS (Ra0Seq~[i])) ¥Ra_GT eps)
		i-->T548(Stat4*) ==> ((Ra0Seq~[i]) = Ra_0) & ((Ra1Seq~[i]) = Ra_1)
		EQUAL(Stat4) ==> not(Ra_ABS(Ra_1 ¥Ra_MINUS Ra_0) ¥Ra_GT eps)
		Use_def(¥Ra_MINUS)(Stat4*) ==> not(Ra_ABS(Ra_1 ¥Ra_PLUS Ra_Rev(Ra_0)) ¥Ra_GT eps)
		EQUAL ==> Stat5: not(Ra_ABS(Ra_1) ¥Ra_GT eps)
	        T465(Stat6) ==> Stat6: Ra_is_nonneg(Ra_1)
        	T525(Stat6) ==> Stat7: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
        	Ra_1-->Stat7(Stat6*) ==> Stat8: Ra_ABS(Ra_1) = Ra_1
	EQUAL(Stat2,Stat5,Stat8) ==> false; Discharge ==> (R_1 /= R_0) & (not((R_1 ¥R_GT R_0) & (R_Recip(R_1) = R_1)))
	Suppose ==> (not (R_1 ¥R_GT R_0))
		(R_1,R_0)-->T675(*) ==> (not R_is_nonneg(R_1 ¥R_PLUS R_Rev(R_0)))
		R_1-->T626(*) ==> (R_1 ¥R_PLUS R_0) = R_1
		()-->T671 ==> AUTO
	EQUAL ==> false; Discharge ==> R_Recip(R_1) /= R_1
	R_1-->T645(*) ==> (R_1 ¥R_TIMES R_Recip(R_1)) = R_1
	R_1-->T647(*) ==> R_Recip(R_1) in Re
(R_Recip(R_1))-->T628(*) ==> false; Discharge ==> QED
--
Theorem 694: [Monotonicity of addition over 2nd argument] ((X in Re) & (XP in Re) & (YP in Re) & (XP ¥R_GE YP)) ¥imp ((X ¥R_PLUS XP) ¥R_GE (X ¥R_PLUS YP)). Proof:
Suppose_not(x,xp,yp) ==> AUTO
	Use_def(¥R_GE) ==> Stat1: (x in Re) & (xp in Re) & (yp in Re) & R_is_nonneg(xp ¥R_MINUS yp) & (not R_is_nonneg((x ¥R_PLUS xp) ¥R_MINUS (x ¥R_PLUS yp)))
	(x,xp)-->T615(Stat1,Stat1*) ==> Stat2: (x ¥R_PLUS xp) = (xp ¥R_PLUS x)
	(x,yp)-->T615(Stat1,Stat1*) ==> Stat3: (x ¥R_PLUS yp) = (yp ¥R_PLUS x)
	(xp,x)-->T613(Stat1,Stat1*) ==> Stat4: (xp ¥R_PLUS x) in Re
	(yp,x)-->T613(Stat1,Stat1*) ==> Stat5: ((yp ¥R_PLUS x) in Re) & (R_Rev(yp) in Re)
	(xp ¥R_PLUS x,yp ¥R_PLUS x)-->T635(Stat4*) ==> Stat6: ((xp ¥R_PLUS x) ¥R_MINUS (yp ¥R_PLUS x)) = ((xp ¥R_PLUS x) ¥R_PLUS R_Rev(yp ¥R_PLUS x))
	(yp ¥R_PLUS x,yp ¥R_PLUS x)-->T613(Stat5*) ==> Stat7: R_Rev(yp ¥R_PLUS x) in Re
	(xp,x,R_Rev(yp ¥R_PLUS x))-->T617(Stat1,Stat7*) ==> Stat8: ((xp ¥R_PLUS x) ¥R_PLUS R_Rev(yp ¥R_PLUS x)) = (xp ¥R_PLUS (x ¥R_PLUS R_Rev(yp ¥R_PLUS x)))
	(yp,x)-->T638(Stat1,Stat1*) ==> Stat9: R_Rev(yp ¥R_PLUS x) = R_Rev(yp) ¥R_PLUS R_Rev(x)
	(R_Rev(yp),x)-->T641(Stat1,Stat5*) ==> Stat10: (x ¥R_PLUS (R_Rev(yp) ¥R_MINUS x)) = R_Rev(yp)
	(xp,yp)-->T635(Stat1,Stat1*) ==> Stat11: (xp ¥R_MINUS yp) = (xp ¥R_PLUS R_Rev(yp))
EQUAL(Stat1,Stat2,Stat3,Stat6,Stat8,Stat9,Stat10,Stat11*) ==> false; Discharge ==> QED
--
Theorem 695: [Monotonicity of real addition] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X ¥R_GE Y) & (XP ¥R_GE YP)) ¥imp ((X ¥R_PLUS XP) ¥R_GE (Y ¥R_PLUS YP)). Proof:
Suppose_not(x,y,xp,yp) ==> AUTO
	(x,xp,yp)-->T694(*) ==> (x ¥R_PLUS xp) ¥R_GE (x ¥R_PLUS yp)
	(yp,x,y)-->T694(*) ==> (yp ¥R_PLUS x) ¥R_GE (yp ¥R_PLUS y)
	(yp,x)-->T615(*) ==> (yp ¥R_PLUS x) = (x ¥R_PLUS yp)
	(yp,y)-->T615(*) ==> (yp ¥R_PLUS y) = (y ¥R_PLUS yp)
	EQUAL ==> (x ¥R_PLUS yp) ¥R_GE (y ¥R_PLUS yp)
	(x,xp)-->T613(*) ==> (x ¥R_PLUS xp) in Re
	(x,yp)-->T613(*) ==> (x ¥R_PLUS yp) in Re
	(y,yp)-->T613(*) ==> (y ¥R_PLUS yp) in Re
(x ¥R_PLUS xp,x ¥R_PLUS yp,y ¥R_PLUS yp)-->T668(*) ==> false; Discharge ==> QED
--
Theorem 696: [Strict monotonicity of addition] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X ¥R_GE Y) & (XP ¥R_GT YP)) ¥imp ((X ¥R_PLUS XP) ¥R_GT (Y ¥R_PLUS YP)). Proof:
Suppose_not(x,y,xp,yp) ==> AUTO
--
-- Suppose that $x$, $y$, $xp$, and $yp$ form a counterexample to our theorem.
-- Since addition is known to be monotone, we have at least $(x ¥R_PLUS xp) ¥R_GE (y ¥R_PLUS yp)$,
-- and since the corresponding strict inequality is false we must have $(x ¥R_PLUS xp) = (x ¥R_PLUS xp)$,
-- so that $(xp ¥R_PLUS x) ¥Ra_GE (yp ¥R_PLUS y)$ is also true.
--
	(xp,yp)-->T675(*) ==> Stat1: (xp ¥R_GE yp) & (xp /= yp)
	(x,y,xp,yp)-->T695(*) ==> (x ¥R_PLUS xp) ¥R_GE (y ¥R_PLUS yp)
	(x ¥R_PLUS xp,y ¥R_PLUS yp)-->T675(*) ==> (x ¥R_PLUS xp) = (y ¥R_PLUS yp)
	(x,xp)-->T613(*) ==> Stat2: (x ¥R_PLUS xp) in Re
	(y,yp)-->T613(*) ==> (y ¥R_PLUS yp) in Re
	(y ¥R_PLUS yp,x ¥R_PLUS xp)-->T680(*) ==> (y ¥R_PLUS yp) ¥R_GE (x ¥R_PLUS xp)
	(x,xp)-->T615(*) ==> (x ¥R_PLUS xp) = (xp ¥R_PLUS x)
	(y,yp)-->T615(*) ==> (y ¥R_PLUS yp) = (yp ¥R_PLUS y)
        EQUAL(Stat2) ==> ((yp ¥R_PLUS y) ¥R_GE (xp ¥R_PLUS x)) & ((xp ¥R_PLUS x) in Re) & ((yp ¥R_PLUS y) in Re)
--
-- By Theorem 691, we have $R_Rev(y) ¥R_GE R_Rev(x)$, and then adding these
-- last two inequalities and reassociating we find that $yp ¥R_GE xp$, so that $yp = xp$,
-- contradicting $xp ¥R_GT yp$ an so proving our theorem.
--
	(x,y)-->T691(*) ==> R_Rev(y) ¥R_GE R_Rev(x)
	y-->T636(*) ==> (R_Rev(y) in Re) & ((y ¥R_PLUS R_Rev(y)) = R_0)
	x-->T636(*) ==> (R_Rev(x) in Re) & ((x ¥R_PLUS R_Rev(x)) = R_0)
	(yp ¥R_PLUS y,xp ¥R_PLUS x,R_Rev(y),R_Rev(x))-->T695(*) ==>
		((yp ¥R_PLUS y) ¥R_PLUS R_Rev(y)) ¥R_GE ((xp ¥R_PLUS x) ¥R_PLUS R_Rev(x))
	(yp,y,R_Rev(y))-->T617(*) ==> ((yp ¥R_PLUS y) ¥R_PLUS R_Rev(y)) = (yp ¥R_PLUS (y ¥R_PLUS R_Rev(y)))
	(xp,x,R_Rev(x))-->T617(*) ==> ((xp ¥R_PLUS x) ¥R_PLUS R_Rev(x)) = (xp ¥R_PLUS (x ¥R_PLUS R_Rev(x)))
	EQUAL ==> (yp ¥R_PLUS R_0) ¥R_GE (xp ¥R_PLUS R_0)
	yp-->T626(*) ==> (yp ¥R_PLUS R_0) = yp
	xp-->T626(*) ==> (xp ¥R_PLUS R_0) = xp
	EQUAL ==> yp ¥R_GE xp
(xp,yp)-->T672(*) ==> false; Discharge ==> QED
--
Theorem 697: [Strict monotonicity of addition] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X ¥R_GT Y) & (XP ¥R_GE YP)) ¥imp ((X ¥R_PLUS XP) ¥R_GT (Y ¥R_PLUS YP)). Proof:
Suppose_not(x,y,xp,yp) ==> AUTO
	(xp,yp,x,y)-->T696(*) ==> (xp ¥R_PLUS x) ¥R_GT (yp ¥R_PLUS y)
	ALGEBRA ==> ((xp ¥R_PLUS x) = (x ¥R_PLUS xp)) & ((yp ¥R_PLUS y) = (y ¥R_PLUS yp))
EQUAL ==> false; Discharge ==> QED
--
Theorem 698: [Strict monotonicity of addition, 2] ((X in Re) & (Y in Re) & (V in Re) & (X ¥R_GE Y)) ¥imp (((Y ¥R_PLUS V) ¥R_GE (X ¥R_PLUS V)) ¥eq (X = Y)). Proof:
Suppose_not(x,y,v) ==> AUTO
	(y,v)-->T613(*) ==> Stat1: (y ¥R_PLUS v) in Re
	(x,v)-->T613(*) ==> (x ¥R_PLUS v) in Re
	Suppose ==> x = y
		EQUAL ==> (y ¥R_PLUS v) = (x ¥R_PLUS v)
	(y ¥R_PLUS v,x ¥R_PLUS v)-->T680(*) ==> false; Discharge ==> x /= y
	(x,y)-->T680(*) ==> x ¥R_GT y
	(v,v)-->T680(*) ==> v ¥R_GE v
	(v,v,x,y)-->T696(*) ==> Stat2: (v ¥R_PLUS x) ¥R_GT (v ¥R_PLUS y)
	(v,x)-->T615(*) ==> (v ¥R_PLUS x) = (x ¥R_PLUS v)
	(v,y)-->T615(*) ==> (v ¥R_PLUS y) = (y ¥R_PLUS v)
	EQUAL(Stat2) ==> (x ¥R_PLUS v) ¥R_GT (y ¥R_PLUS v)
	(x ¥R_PLUS v,y ¥R_PLUS v)-->T673(Stat1*) ==> ((x ¥R_PLUS v) ¥R_GE (y ¥R_PLUS v)) & ((x ¥R_PLUS v) /= (y ¥R_PLUS v))
(x ¥R_PLUS v,y ¥R_PLUS v)-->T672(*) ==> false; Discharge ==> QED
--
Theorem 699: ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & (X ¥R_PLUS Y = R_0)) ¥imp ((X = R_0) & (Y = R_0)). Proof:
Suppose_not(x,y) ==> Stat1: (x in Re) & (y in Re) & R_is_nonneg(x) & R_is_nonneg(y) & (x ¥R_PLUS y = R_0) & ((x /= R_0) or (y /= R_0))
        x-->T681(*) ==> Stat2: x ¥R_GE R_0
        y-->T681(*) ==> Stat3: y ¥R_GE R_0
        T612(*) ==> Stat4: R_0 in Re
        R_0-->T626(Stat4*) ==> Stat5: R_0 ¥R_PLUS R_0 = R_0
        Suppose ==> Stat6: y /= R_0
                (y, R_0)-->T680(Stat1, Stat3, Stat4, Stat6*) ==> Stat7: y ¥R_GT R_0
                (x,R_0,y,R_0)-->T696(Stat1, Stat4, Stat2, Stat7*) ==> Stat8: (x ¥R_PLUS y) ¥R_GT (R_0 ¥R_PLUS R_0)
                EQUAL(Stat8, Stat5*) ==> (x ¥R_PLUS y) ¥R_GT R_0
        Use_def(¥R_GT) ==> false; Discharge ==> Stat9: x /= R_0
        (x, R_0)-->T680(Stat1, Stat2, Stat4, Stat9*) ==> Stat10: x ¥R_GT R_0
        (y,R_0,x,R_0)-->T696(Stat1, Stat4, Stat3, Stat10*) ==> Stat11: (y ¥R_PLUS x) ¥R_GT (R_0 ¥R_PLUS R_0)
        EQUAL(Stat11, Stat5*) ==> Stat12: (y ¥R_PLUS x) ¥R_GT R_0
        (y, x)-->T615(Stat1, Stat1*) ==> Stat13: (y ¥R_PLUS x) = (x ¥R_PLUS y)
        EQUAL(Stat12, Stat13*)  ==> Stat14: (x ¥R_PLUS y) ¥R_GT R_0
Use_def(¥R_GT)(Stat1, Stat14) ==> false; Discharge ==> QED
--
Theorem 700: [The product of two reals is 0 if and only if one of them is 0] ((X in Re) & (Y in Re)) ¥imp (((X ¥R_TIMES Y) = R_0) ¥eq ((X = R_0) or (Y = R_0))). Proof:
Suppose_not(x,y) ==> AUTO
	Suppose ==> x = R_0
		y-->T625(*) ==> (R_0 ¥R_TIMES y) = R_0
	EQUAL ==> false; Discharge ==> Stat1: x /= R_0
	Suppose ==> y = R_0
		x-->T624(*) ==> (x ¥R_TIMES R_0) = R_0
	EQUAL ==> false; Discharge ==> (y /= R_0) & ((x ¥R_TIMES y) = R_0)
	(x,y)-->T658(*) ==> ((x ¥R_TIMES y) ¥R_OVER y) = x
	y-->T647(*) ==> Stat2: R_Recip(y) in Re
	(R_Recip(y))-->T625(Stat2*) ==> (R_0 ¥R_TIMES R_Recip(y)) = R_0
	Use_def(¥R_OVER)(Stat2*) ==> (R_0 ¥R_OVER y) = R_0
EQUAL(Stat1) ==> false; Discharge ==> QED
--
Theorem 701: [Monotonicity of multiplication over 2nd argument] ((X in Re) & (XP in Re) & (YP in Re) & (X ¥R_GE R_0) & (XP ¥R_GE YP)) ¥imp ((X ¥R_TIMES XP) ¥R_GE (X ¥R_TIMES YP)). Proof:
Suppose_not(x,xp,yp) ==> AUTO
	(xp,yp)-->T614(*) ==> Stat1: (xp ¥R_MINUS yp) in Re
	(x,xp,yp)-->T643(*) ==> Stat2: (x ¥R_TIMES (xp ¥R_MINUS yp)) = ((x ¥R_TIMES xp) ¥R_MINUS (x ¥R_TIMES yp))
	Use_def(¥R_GE)(*) ==> Stat3: (x in Re) & R_is_nonneg(x ¥R_MINUS R_0) & R_is_nonneg(xp ¥R_MINUS yp) & (not R_is_nonneg((x ¥R_TIMES xp) ¥R_MINUS (x ¥R_TIMES yp)))
	x-->T630(Stat3,Stat3*) ==> (x ¥R_MINUS R_0) = x
	EQUAL(Stat2*) ==> Stat4: R_is_nonneg(x) & (not R_is_nonneg(x ¥R_TIMES (xp ¥R_MINUS yp)))
(x,xp ¥R_MINUS yp)-->T667(Stat1,Stat3,Stat4*) ==> false; Discharge ==> QED
--
Theorem 702: [Monotonicity of multiplication] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X ¥R_GE Y) & (Y ¥R_GE R_0) & (YP ¥R_GE R_0) & (XP ¥R_GE YP)) ¥imp ((X ¥R_TIMES XP) ¥R_GE (Y ¥R_TIMES YP)). Proof:
Suppose_not(x,y,xp,yp) ==> AUTO
	T612(*) ==> R_0 in Re
	(x,y,R_0)-->T668(*) ==> x ¥R_GE R_0
	(x,xp,yp)-->T701(*) ==> (x ¥R_TIMES xp) ¥R_GE (x ¥R_TIMES yp)
	(yp,x,y)-->T701(*) ==> (yp ¥R_TIMES x) ¥R_GE (yp ¥R_TIMES y)
	(yp,x)-->T618(*) ==> (yp ¥R_TIMES x) = (x ¥R_TIMES yp)
	(yp,y)-->T618(*) ==> (yp ¥R_TIMES y) = (y ¥R_TIMES yp)
	EQUAL ==> (x ¥R_TIMES yp) ¥R_GE (y ¥R_TIMES yp)
	(x,xp)-->T614(*) ==> (x ¥R_TIMES xp) in Re
	(x,yp)-->T614(*) ==> (x ¥R_TIMES yp) in Re
	(y,yp)-->T614(*) ==> (y ¥R_TIMES yp) in Re
(x ¥R_TIMES xp,x ¥R_TIMES yp,y ¥R_TIMES yp)-->T668(*) ==> false; Discharge ==> QED
--
Theorem 703: [Strict monotonicity of multiplication over 2nd argument] ((X in Re) & (XP in Re) & (YP in Re) & (X ¥R_GT R_0) & (XP ¥R_GT YP)) ¥imp ((X ¥R_TIMES XP) ¥R_GT (X ¥R_TIMES YP)). Proof:
Suppose_not(x,xp,yp) ==> AUTO
	(xp,yp)-->T673(*) ==> xp ¥R_GE yp
	(x,R_0)-->T673(*) ==> x ¥R_GE R_0
	(x,x)-->T672(*) ==> x ¥R_GE x
	(x,xp,yp)-->T701(*) ==> (x ¥R_TIMES xp) ¥R_GE (x ¥R_TIMES yp)
	(x ¥R_TIMES xp,x ¥R_TIMES yp)-->T673(*) ==> Stat1: (x ¥R_TIMES xp) = (x ¥R_TIMES yp)
	(xp,yp)-->T675(*) ==> R_is_nonneg(xp ¥R_MINUS yp) & (xp /= yp)
	(xp,yp)-->T641(*) ==> xp = (yp ¥R_PLUS (xp ¥R_MINUS yp))
	(xp,yp)-->T614(*) ==> (xp ¥R_MINUS yp) in Re
	(x,yp,xp ¥R_MINUS yp)-->T621(*) ==> (x ¥R_TIMES (yp ¥R_PLUS (xp ¥R_MINUS yp))) = ((x ¥R_TIMES yp) ¥R_PLUS (x ¥R_TIMES (xp ¥R_MINUS yp)))
	(x,yp)-->T614(*) ==> Stat2: (x ¥R_TIMES yp) in Re
	(x ¥R_TIMES yp)-->T626(*) ==> ((x ¥R_TIMES yp) ¥R_PLUS R_0) = (x ¥R_TIMES yp)
	EQUAL(Stat1) ==> ((x ¥R_TIMES yp) ¥R_PLUS R_0) = ((x ¥R_TIMES yp) ¥R_PLUS (x ¥R_TIMES (xp ¥R_MINUS yp)))
	(x,xp ¥R_MINUS yp)-->T614(*) ==> (x ¥R_TIMES (xp ¥R_MINUS yp)) in Re
	(x ¥R_TIMES yp,x ¥R_TIMES (xp ¥R_MINUS yp))-->T615(*) ==> ((x ¥R_TIMES yp) ¥R_PLUS (x ¥R_TIMES (xp ¥R_MINUS yp))) = ((x ¥R_TIMES (xp ¥R_MINUS yp)) ¥R_PLUS (x ¥R_TIMES yp))
	T612(*) ==> R_0 in Re
	(x ¥R_TIMES yp,R_0)-->T615(*) ==> ((x ¥R_TIMES yp) ¥R_PLUS R_0) = (R_0 ¥R_PLUS (x ¥R_TIMES yp))
	(R_0,x ¥R_TIMES (xp ¥R_MINUS yp),x ¥R_TIMES yp)-->T634(Stat2*) ==> (x ¥R_TIMES (xp ¥R_MINUS yp)) = R_0
	(x,R_0)-->T675(*) ==> x /= R_0
	(x,xp ¥R_MINUS yp)-->T700(*) ==> (xp ¥R_MINUS yp) = R_0
	yp-->T626(*) ==> yp ¥R_PLUS R_0 = yp
EQUAL(Stat1) ==> false; Discharge ==> QED
--
Theorem 704: [Strict monotonicity of multiplication] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X ¥R_GE Y) & (Y ¥R_GT R_0) & (YP ¥R_GT R_0) & (XP ¥R_GT YP)) ¥imp ((X ¥R_TIMES XP) ¥R_GT (Y ¥R_TIMES YP)). Proof:
Suppose_not(x,y,xp,yp) ==> AUTO
	T612(*) ==> R_0 in Re
	(x,y,R_0)-->T678(*) ==> x ¥R_GT R_0
	Suppose ==> x = y
		EQUAL ==> not((x ¥R_TIMES xp) ¥R_GT (x ¥R_TIMES yp))
	(x,xp,yp)-->T703(*) ==> false; Discharge ==> x /= y
	(x,y)-->T673(*) ==> x ¥R_GT y
	(x,y,R_0)-->T679(*) ==> x ¥R_GT R_0
	(xp,yp,R_0)-->T679(*) ==> xp ¥R_GT R_0
        (xp,x,y)-->T703(*) ==> Stat1: (xp ¥R_TIMES x) ¥R_GT (xp ¥R_TIMES y)
	(xp,x)-->T618(*) ==> (xp ¥R_TIMES x) = (x ¥R_TIMES xp)
	(xp,y)-->T618(*) ==> (xp ¥R_TIMES y) = (y ¥R_TIMES xp)
	EQUAL(Stat1) ==> (x ¥R_TIMES xp) ¥R_GT (y ¥R_TIMES xp)
	(y,xp,yp)-->T703(*) ==> (y ¥R_TIMES xp) ¥R_GT (y ¥R_TIMES yp)
	(x,xp)-->T614(*) ==> (x ¥R_TIMES xp) in Re
	(y,xp)-->T614(*) ==> (y ¥R_TIMES xp) in Re
	(y,yp)-->T614(*) ==> (y ¥R_TIMES yp) in Re
(x ¥R_TIMES xp,y ¥R_TIMES xp,y ¥R_TIMES yp)-->T679(*) ==> false; Discharge ==> QED
--
Theorem 705: [Multiplication by a positive real is strictly monotone] ((X in Re) & (Y in Re) & (Z in Re) & (X ¥R_GT Y) & (Z ¥R_GT R_0)) ¥imp ((X ¥R_TIMES Z) ¥R_GT (Y ¥R_TIMES Z)). Proof:
Suppose_not(x,y,v) ==> AUTO
	(v,v)-->T672(*) ==> v ¥R_GE v
	(v,R_0)-->T673(*) ==> (v ¥R_GE R_0) & (v /= R_0)
	Suppose ==> y ¥R_GT R_0
		(v,v,x,y)-->T704(*) ==> (v ¥R_TIMES x) ¥R_GT (v ¥R_TIMES y)
		(v,x)-->T618(*) ==> (v ¥R_TIMES x) = (x ¥R_TIMES v)
		(v,y)-->T618(*) ==> (v ¥R_TIMES y) = (y ¥R_TIMES v)
	EQUAL ==> false; Discharge ==> not(y ¥R_GT R_0)
	()-->T612 ==> AUTO
	(y,R_0)-->T669(*) ==> (y = R_0) or (R_0 ¥R_GT y)
	(x,v)-->T614(*) ==> (x ¥R_TIMES v) in Re
	v-->T625(*) ==> (R_0 ¥R_TIMES v) = R_0
	Suppose ==> y = R_0
		EQUAL ==> Stat1: (x ¥R_GT R_0) & (not((x ¥R_TIMES v) ¥R_GT R_0))
		(x,R_0)-->T673(Stat1*) ==> (x ¥R_GE R_0) & (x /= R_0)
		(R_0,R_0)-->T672(*) ==> R_0 ¥R_GE R_0
		(x,R_0,v,R_0)-->T702(*) ==> (x ¥R_TIMES v) ¥R_GE (R_0 ¥R_TIMES R_0)
		R_0-->T625(*) ==> (R_0 ¥R_TIMES R_0) = R_0
		EQUAL ==> (x ¥R_TIMES v) ¥R_GE R_0
		(x ¥R_TIMES v,R_0)-->T680(*) ==> (x ¥R_TIMES v) = R_0
	(x,v)-->T653(*) ==> false; Discharge ==> (y /= R_0) & (R_0 ¥R_GT y)
	(x,y)-->T692(*) ==> R_Rev(y) ¥R_GT R_Rev(x)
	(R_Rev(y),R_Rev(x))-->T673(*) ==> R_Rev(y) ¥R_GE R_Rev(x)
	(y,y)-->T613(*) ==> R_Rev(y) in Re
	(R_0,y)-->T692(*) ==> R_Rev(y) ¥R_GT R_Rev(R_0)
	()-->T693 ==> AUTO
	EQUAL ==> R_Rev(y) ¥R_GT R_0
	(R_Rev(y),R_0)-->T673(*) ==> R_Rev(y) ¥R_GE R_0
	(R_0,R_0)-->T672(*) ==> R_0 ¥R_GE R_0
	(y,v)-->T614(*) ==> (y ¥R_TIMES v) in Re
	Suppose ==> x = R_0
		v-->T624(*) ==> (v ¥R_TIMES R_0) = R_0
		(v,v,R_Rev(y),R_0)-->T702(*) ==> (v ¥R_TIMES R_Rev(y)) ¥R_GE (v ¥R_TIMES R_0)
		(v,y)-->T623(*) ==> (v ¥R_TIMES R_Rev(y)) = R_Rev(v ¥R_TIMES y)
		(v,x)-->T623(*) ==> (v ¥R_TIMES R_Rev(x)) = R_Rev(v ¥R_TIMES x)
		(v,y)-->T618(*) ==> (v ¥R_TIMES y) = (y ¥R_TIMES v)
		(v,x)-->T618(*) ==> (v ¥R_TIMES x) = (x ¥R_TIMES v)
		EQUAL ==> (R_Rev(y ¥R_TIMES v) ¥R_GE R_Rev(R_0)) & (not(R_0 ¥R_GT (y ¥R_TIMES v)))
		(R_0,y ¥R_TIMES v)-->T692(*) ==> R_0 ¥R_GE (y ¥R_TIMES v)
		(R_0,y ¥R_TIMES v)-->T680(*) ==> R_0 = (y ¥R_TIMES v)
	(y,v)-->T700(*) ==> false; Discharge ==> x /= R_0
	(x,R_0)-->T669(*) ==> (x ¥R_GT R_0) or (R_0 ¥R_GT x)
	(y,v)-->T623(*) ==> (R_Rev(y) ¥R_TIMES v) = R_Rev(y ¥R_TIMES v)
	Suppose ==> x ¥R_GT R_0
		(x,R_0)-->T673(*) ==> (x ¥R_GE R_0) & (x /= R_0)
		(x,R_0,v,v)-->T702(*) ==> (x ¥R_TIMES v) ¥R_GE (R_0 ¥R_TIMES v)
		EQUAL ==> (x ¥R_TIMES v) ¥R_GE R_0
		(x,v)-->T700(*) ==> (x ¥R_TIMES v) /= R_0
		(x ¥R_TIMES v,R_0)-->T680(*) ==> (x ¥R_TIMES v) ¥R_GT R_0
		(R_Rev(y),R_0,v,v)-->T702(*) ==> (R_Rev(y) ¥R_TIMES v) ¥R_GE (R_0 ¥R_TIMES v)
		EQUAL ==> R_Rev(y ¥R_TIMES v) ¥R_GE R_Rev(R_0)
		(R_0,y ¥R_TIMES v)-->T692(*) ==> R_0 ¥R_GE (y ¥R_TIMES v)
	(x ¥R_TIMES v,R_0,y ¥R_TIMES v)-->T677(*) ==> false; Discharge ==> R_0 ¥R_GT x
	(R_0,x)-->T692(*) ==> R_Rev(x) ¥R_GT R_Rev(R_0)
	EQUAL ==> R_Rev(x) ¥R_GT R_0
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	(v,v,R_Rev(y),R_Rev(x))-->T704(*) ==> (v ¥R_TIMES R_Rev(y)) ¥R_GT (v ¥R_TIMES R_Rev(x))
	(v,R_Rev(y))-->T618(*) ==> (v ¥R_TIMES R_Rev(y)) = (R_Rev(y) ¥R_TIMES v)
	(v,R_Rev(x))-->T618(*) ==> (v ¥R_TIMES R_Rev(x)) = (R_Rev(x) ¥R_TIMES v)
	(x,v)-->T623(*) ==> (R_Rev(x) ¥R_TIMES v) = R_Rev(x ¥R_TIMES v)
	EQUAL ==> R_Rev(y ¥R_TIMES v) ¥R_GT R_Rev(x ¥R_TIMES v)
(x ¥R_TIMES v,y ¥R_TIMES v)-->T692(*) ==> false; Discharge ==> QED
--
Theorem 706: [The product of reals $x,y$ of which $x$ is positive is non-negative iff $y$ is non-negative] ((X in Re) & (Y in Re) & (X /= R_0) & R_is_nonneg(X)) ¥imp (R_is_nonneg(X ¥R_TIMES Y) ¥eq R_is_nonneg(Y)). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T614(*) ==> Stat1: (x ¥R_TIMES y) in Re
	()-->T612 ==> AUTO
	()-->T671 ==> AUTO
	()-->T693 ==> AUTO
	Suppose ==> not(x ¥R_GT R_0)
		x-->T681(*) ==> x ¥R_GE R_0
	(x,R_0)-->T680(*) ==> false; Discharge ==> x ¥R_GT R_0
	Suppose ==> R_is_nonneg(y)
		y-->T681(*) ==> y ¥R_GE R_0
		(y,R_0)-->T680(*) ==> (y ¥R_GT R_0) or (y = R_0)
		Suppose ==> y = R_0
			x-->T624(*) ==> (x ¥R_TIMES R_0) = R_0
		EQUAL ==> false; Discharge ==> (y ¥R_GT R_0)
		(x,R_0,y)-->T705(*) ==> (x ¥R_TIMES y) ¥R_GT (R_0 ¥R_TIMES y)
		y-->T625(*) ==> (R_0 ¥R_TIMES y) = R_0
		EQUAL ==> (x ¥R_TIMES y) ¥R_GT R_0
		(x ¥R_TIMES y,R_0)-->T680(*) ==> (x ¥R_TIMES y) ¥R_GE R_0
	(x ¥R_TIMES y)-->T681(*) ==> false; Discharge ==> Stat2: (not R_is_nonneg(y)) & R_is_nonneg(x ¥R_TIMES y)
	y-->T663(*) ==> R_is_nonneg(R_Rev(y))
	(y,y)-->T613(*) ==> R_Rev(y) in Re
	(R_Rev(y))-->T681(Stat2*) ==> R_Rev(y) ¥R_GE R_0
	(R_Rev(y),R_0)-->T680(*) ==> (R_Rev(y) ¥R_GT R_0) or (R_Rev(y) = R_0)
	Suppose ==> R_Rev(y) = R_0
		y-->T633(*) ==> R_Rev(R_Rev(y)) = y
	EQUAL ==> false; Discharge ==> R_Rev(y) ¥R_GT R_0
	(x,R_0,R_Rev(y))-->T705(*) ==> Stat3: (x ¥R_TIMES R_Rev(y)) ¥R_GT (R_0 ¥R_TIMES R_Rev(y))
	(R_Rev(y))-->T625(*) ==> (R_0 ¥R_TIMES R_Rev(y)) = R_0
	EQUAL(Stat3) ==> (x ¥R_TIMES R_Rev(y)) ¥R_GT R_0
	(x,y)-->T623(*) ==> (x ¥R_TIMES R_Rev(y)) = R_Rev(x ¥R_TIMES y)
	EQUAL ==> R_Rev(x ¥R_TIMES y) ¥R_GT R_0
	(x ¥R_TIMES y,x ¥R_TIMES y)-->T613(Stat1,Stat1*) ==> Stat4: R_Rev(x ¥R_TIMES y) in Re
	(R_Rev(x ¥R_TIMES y),R_0)-->T680(*) ==> R_Rev(x ¥R_TIMES y) ¥R_GE R_0
	(R_Rev(x ¥R_TIMES y))-->T681(Stat4*) ==> Stat5: R_is_nonneg(R_Rev(x ¥R_TIMES y))
	(R_Rev(y))-->T681(Stat2*) ==> R_Rev(y) ¥R_GE R_0
	(x ¥R_TIMES y)-->T663(Stat1,Stat2,Stat5*) ==> (x ¥R_TIMES y) = R_0
	(x,R_0)-->T675(*) ==> x /= R_0
	(R_Rev(y),R_0)-->T675(*) ==> R_Rev(y) /= R_0
	Suppose ==> y = R_0
	EQUAL ==> false; Discharge ==> y /= R_0
(x,y)-->T700(*) ==> false; Discharge ==> QED
--
Theorem 707: [The product of nonnegative reals is non-negative] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) ¥imp R_is_nonneg(X ¥R_TIMES Y). Proof:
Suppose_not(x,y) ==> AUTO
	x-->T706(*) ==> x = R_0
	y-->T625(*) ==> (R_0 ¥R_TIMES y) = R_0
	EQUAL ==> (not R_is_nonneg(R_0))
T671 ==> false; Discharge ==> QED
--
Theorem 708: [Condition for positiveness of a product of reals] ((X in Re) & (Y in Re)) ¥imp (((X ¥R_TIMES Y) ¥R_GT R_0) ¥eq (((X ¥R_GT R_0) & (Y ¥R_GT R_0)) or ((R_0 ¥R_GT X) & (R_0 ¥R_GT Y)))). Proof:
Suppose_not(x,y) ==> AUTO
--
-- By the trichotomic property of the ordering relation on reals, there are
-- six cases to be considered, namely the combinations of one of the possibilities
-- $x = R_0,x ¥R_GT R_0,R_0 ¥R_GT x$ with one of the possibilities
-- $y = R_0,y ¥R_GT R_0,R_0 ¥R_GT y$. We will see that in none of the cases
-- the assertion of this theorem cannot be false.
--
	()-->T612 ==> AUTO
	(x,R_0)-->T669(*) ==> Stat1: (x = R_0) or (x ¥R_GT R_0) or (R_0 ¥R_GT x)
	(y,R_0)-->T669(*) ==> (y = R_0) or (y ¥R_GT R_0) or (R_0 ¥R_GT y)
	Suppose ==> x = R_0
		y-->T625(*) ==> (R_0 ¥R_TIMES y) = R_0
		EQUAL ==> (x ¥R_TIMES y) = R_0
		(x ¥R_TIMES y,R_0)-->T673(*) ==> not((x ¥R_TIMES y) ¥R_GT R_0)
		(x,R_0)-->T673(*) ==> not(x ¥R_GT R_0)
	(R_0,x)-->T673(*) ==> false; Discharge ==> x /= R_0
	Suppose ==> y = R_0
		x-->T624(*) ==> (x ¥R_TIMES R_0) = R_0
		EQUAL ==> (x ¥R_TIMES y) = R_0
		(x ¥R_TIMES y,R_0)-->T673(*) ==> not((x ¥R_TIMES y) ¥R_GT R_0)
		(y,R_0)-->T673(*) ==> not(y ¥R_GT R_0)
	(R_0,y)-->T673(*) ==> false; Discharge ==> y /= R_0
	(x,y)-->T614(*) ==> Stat2: (x ¥R_TIMES y) in Re
	(x,y)-->T700(*) ==> (x ¥R_TIMES y) /= R_0
	Suppose ==> (x ¥R_GT R_0) & (y ¥R_GT R_0)
		(x,R_0)-->T673(*) ==> x ¥R_GE R_0
		(y,R_0)-->T673(*) ==> y ¥R_GE R_0
		x-->T681(*) ==> R_is_nonneg(x)
		y-->T681(*) ==> R_is_nonneg(y)
		(x,y)-->T707(*) ==> R_is_nonneg(x ¥R_TIMES y)
		(x ¥R_TIMES y)-->T681(*) ==> (x ¥R_TIMES y) ¥R_GE R_0
	(x ¥R_TIMES y,R_0)-->T673(*) ==> false; Discharge ==> not((x ¥R_GT R_0) & (y ¥R_GT R_0))
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	(y,y)-->T613(*) ==> R_Rev(y) in Re
	Suppose ==> (not(x ¥R_GT R_0)) & (not(y ¥R_GT R_0))
		(x,R_0)-->T680(*) ==> not(x ¥R_GE R_0)
		(y,R_0)-->T680(*) ==> not(y ¥R_GE R_0)
		x-->T681(*) ==> (not R_is_nonneg(x))
		y-->T681(*) ==> (not R_is_nonneg(y))
		x-->T663(*) ==> R_is_nonneg(R_Rev(x))
		y-->T663(*) ==> R_is_nonneg(R_Rev(y))
		(R_Rev(x),R_Rev(y))-->T707(*) ==> R_is_nonneg(R_Rev(x) ¥R_TIMES R_Rev(y))
		(x,y)-->T623(*) ==> (R_Rev(x) ¥R_TIMES R_Rev(y)) = (x ¥R_TIMES y)
		EQUAL ==> R_is_nonneg(x ¥R_TIMES y)
		(x ¥R_TIMES y)-->T681(*) ==> (x ¥R_TIMES y) ¥R_GE R_0
	(x ¥R_TIMES y,R_0)-->T673(*) ==> false; Discharge ==> (x ¥R_GT R_0) or (y ¥R_GT R_0)
	Suppose ==> x ¥R_GT R_0
		(x,R_0)-->T680(*) ==> x ¥R_GE R_0
		x-->T681(*) ==> R_is_nonneg(x)
		(y,R_0)-->T680(*) ==> not(y ¥R_GE R_0)
		y-->T681(*) ==> not(R_is_nonneg(y))
		y-->T663(*) ==> R_is_nonneg(R_Rev(y))
		(x,R_Rev(y))-->T707(*) ==> R_is_nonneg(x ¥R_TIMES R_Rev(y))
		(x,y)-->T623(*) ==> (x ¥R_TIMES R_Rev(y)) = R_Rev(x ¥R_TIMES y)
		EQUAL ==> R_is_nonneg(R_Rev(x ¥R_TIMES y))
		(x ¥R_TIMES y)-->T663(*) ==> (not R_is_nonneg(x ¥R_TIMES y))
		(x ¥R_TIMES y)-->T681(*) ==> not((x ¥R_TIMES y) ¥R_GE R_0)
		(y,R_0)-->T673(*) ==> not(y ¥R_GT R_0)
		(x,R_0)-->T672(*) ==> not(R_0 ¥R_GE x)
		(R_0,x)-->T673(*) ==> not(R_0 ¥R_GT x)
	(x ¥R_TIMES y,R_0)-->T673(*) ==> false; Discharge ==> y ¥R_GT R_0
	(y,R_0)-->T680(*) ==> y ¥R_GE R_0
	y-->T681(*) ==> R_is_nonneg(y)
	(x,R_0)-->T680(*) ==> not(x ¥R_GE R_0)
	x-->T681(*) ==> (not R_is_nonneg(x))
	x-->T663(*) ==> R_is_nonneg(R_Rev(x))
	(R_Rev(x),y)-->T707(*) ==> R_is_nonneg(R_Rev(x) ¥R_TIMES y)
	(x,y)-->T623(*) ==> (R_Rev(x) ¥R_TIMES y) = R_Rev(x ¥R_TIMES y)
	EQUAL ==> R_is_nonneg(R_Rev(x ¥R_TIMES y))
	(x ¥R_TIMES y)-->T663(*) ==> (not R_is_nonneg(x ¥R_TIMES y))
	(x ¥R_TIMES y)-->T681(*) ==> not((x ¥R_TIMES y) ¥R_GE R_0)
	(x,R_0)-->T673(*) ==> not(x ¥R_GT R_0)
	(y,R_0)-->T672(*) ==> not(R_0 ¥R_GE y)
	(R_0,y)-->T673(*) ==> not(R_0 ¥R_GT y)
(x ¥R_TIMES y,R_0)-->T673(*) ==> false; Discharge ==> QED
--
Theorem 709: [The reciprocal of a positive real is positive] ((X in Re) & (X ¥R_GT R_0)) ¥imp (R_Recip(X) ¥R_GT R_0). Proof:
Suppose_not(x) ==> AUTO
	()-->T612 ==> AUTO
	(x,R_0)-->T675(*) ==> x /= R_0
	x-->T647(*) ==> (R_Recip(x) in Re) & (R_Recip(x) /= R_0) & ((R_Recip(x) ¥R_TIMES x) = R_1)
	(R_Recip(x),x)-->T618(*) ==> (R_Recip(x) ¥R_TIMES x) = (x ¥R_TIMES R_Recip(x))
	()-->T671 ==> AUTO
	EQUAL ==> R_is_nonneg(x ¥R_TIMES R_Recip(x))
	(x,R_0)-->T675(*) ==> x ¥R_GE R_0
	x-->T681(*) ==> R_is_nonneg(x)
	()-->T693(*) ==> AUTO
	(x,R_Recip(x))-->T706(*) ==> R_is_nonneg(R_Recip(x))
	(R_Recip(x))-->T681(*) ==> R_Recip(x) ¥R_GE R_0
	(R_Recip(x),R_0)-->T680(*) ==> R_Recip(x) = R_0
	EQUAL ==> (R_0 ¥R_TIMES x) = R_1
	x-->T625 ==> AUTO
()-->T693(*) ==> false; Discharge ==> QED
--
Theorem 710: [The sum of non-negative reals is at least as big at each addend] ((X in Re) & (Y in Re) & (X ¥R_GE R_0)) ¥imp ((X ¥R_PLUS Y) ¥R_GE Y). Proof:
Suppose_not(x,y) ==> AUTO
	(y,y)-->T672(*) ==> y ¥R_GE y
	()-->T612() ==> AUTO
	(x,R_0,y,y)-->T695(*) ==> (x ¥R_PLUS y) ¥R_GE (R_0 ¥R_PLUS y)
	y-->T626(*) ==> (R_0 ¥R_PLUS y) = y
EQUAL ==> false; Discharge ==> QED
--
Theorem 711: [The sum of non-negative reals is zero only if the addends are zero] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & (X ¥R_PLUS Y = R_0)) ¥imp ((X = R_0) & (Y = R_0)). Proof:
Suppose_not(x,y) ==> AUTO
	ALGEBRA ==> Stat1: ((y ¥R_PLUS x) = R_0) & ((x ¥R_PLUS y) = R_0) & (R_0 in Re) & (x in Re) & (y in Re)
	x-->T681(*) ==> Stat2: x ¥R_GE R_0
	(x,y)-->T710(*) ==> Stat3: (x ¥R_PLUS y) ¥R_GE y
	EQUAL(Stat1,Stat3) ==> Stat4: R_0 ¥R_GE y
	y-->T681(*) ==> Stat5: y ¥R_GE R_0
	(y,x)-->T710(*) ==> Stat6: (y ¥R_PLUS x) ¥R_GE x
	EQUAL(Stat1,Stat6) ==> Stat7: R_0 ¥R_GE x
	(x,R_0)-->T680(Stat2,Stat1*) ==> Stat8: (x ¥R_GT R_0) or (x = R_0)
	(y,R_0)-->T680(Stat5,Stat1*) ==> Stat9: (y ¥R_GT R_0) or (y = R_0)
	Suppose ==> x /= R_0
		(Stat8*)ELEM ==> Stat10: x ¥R_GT R_0
		(R_0,x,R_0)-->T678(Stat7,Stat10,Stat1*) ==> Stat11: R_0 ¥R_GT R_0
	(R_0,R_0)-->T673(Stat11*) ==> false; Discharge ==> y /= R_0
	(Stat9*)ELEM ==> Stat12: y ¥R_GT R_0
	(R_0,y,R_0)-->T678(Stat4,Stat12,Stat1*) ==> Stat13: R_0 ¥R_GT R_0
	(R_0,R_0)-->T673(Stat13*) ==> false
	Discharge ==> QED
--
Theorem 712: [The reciprocal is monotone decreasing for positive reals] ((X in Re) & (Y in Re) & (X ¥R_GT Y) & (Y ¥R_GT R_0)) ¥imp (R_Recip(Y) ¥R_GT R_Recip(X)). Proof:
Suppose_not(x,y) ==> AUTO
	T612(*) ==> Stat1: (R_0 in Re) & (R_1 in Re)
	(x,y,R_0)-->T679(*) ==> x ¥R_GT R_0
	(x,R_0)-->T675(*) ==> x /= R_0
	(y,R_0)-->T675(*) ==> y /= R_0
	Suppose ==> Stat2: R_Recip(x) = R_Recip(y)
		x-->T648(*) ==> R_Recip(R_Recip(x)) = x
		y-->T648(*) ==> R_Recip(R_Recip(y)) = y
		(x,y)-->T675(*) ==> x /= y
	EQUAL(Stat2) ==> false; Discharge ==> R_Recip(x) /= R_Recip(y)
	x-->T647(*) ==> Stat3: (R_Recip(x) in Re) & (R_Recip(x) /= R_0) & ((R_Recip(x) ¥R_TIMES x) = R_1)
	y-->T647(*) ==> (R_Recip(y) in Re) & (R_Recip(y) /= R_0) & ((R_Recip(y) ¥R_TIMES y) = R_1)
	Suppose ==> R_Recip(x) ¥R_GT R_Recip(y)
		(R_Recip(x),R_Recip(y))-->T675(Stat3*) ==> R_Recip(x) ¥R_GE R_Recip(y)
		y-->T709(*) ==> R_Recip(y) ¥R_GT R_0
		(R_Recip(x),R_Recip(y),x,y)-->T704(*) ==> (R_Recip(x) ¥R_TIMES x) ¥R_GT (R_Recip(y) ¥R_TIMES y)
		EQUAL(Stat3) ==> R_1 ¥R_GT R_1
	(R_1,R_1)-->T675(Stat1*) ==> false; Discharge ==> not(R_Recip(x) ¥R_GT R_Recip(y))
(R_Recip(x),R_Recip(y))-->T669(*) ==> false; Discharge ==> QED
--
Theorem 713: [Two non-null reals are equal iff their reciprocals are equal] ((X in Re) & (X /= R_0) & (Y in Re) & (Y /= R_0) & (R_Recip(X) = R_Recip(Y))) ¥imp (X = Y). Proof:
Suppose_not(x,y) ==> AUTO
	ELEM ==> R_Recip(x) = R_Recip(y)
	y-->T645(*) ==> (y ¥R_TIMES R_Recip(y)) = R_1
	EQUAL ==> (y ¥R_TIMES R_Recip(x)) = R_1
	x-->T645(*) ==> (x ¥R_TIMES R_Recip(x)) = R_1
	y-->T647(*) ==> (R_Recip(x) in Re) & (R_Recip(x) /= R_0)
(x,y,R_Recip(x))-->T650(*) ==> false; Discharge ==> QED
--
Theorem 714: [The square of any real is non-negative] (X in Re) ¥imp R_is_nonneg(X ¥R_TIMES X). Proof:
Suppose_not(x) ==> AUTO
	x-->T663(*) ==> R_is_nonneg(x) or R_is_nonneg(R_Rev(x))
	Suppose ==> R_is_nonneg(x)
	(x,x)-->T707(*) ==> false; Discharge ==> R_is_nonneg(R_Rev(x))
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	(R_Rev(x),R_Rev(x))-->T707(*) ==> R_is_nonneg(R_Rev(x) ¥R_TIMES R_Rev(x))
	(x,x)-->T623 ==> (R_Rev(x) ¥R_TIMES R_Rev(x)) = (x ¥R_TIMES x)
EQUAL ==> false; Discharge ==> QED
--
Theorem 715: [Monotonicity of squaring] ((X in Re) & (Y in Re) & (X ¥R_GE R_0) & (Y ¥R_GE R_0)) ¥imp ((X ¥R_GE Y) ¥eq ((X ¥R_TIMES X) ¥R_GE (Y ¥R_TIMES Y))). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y,x,y)-->T702(*) ==> Stat1: ((x ¥R_TIMES x) ¥R_GE (y ¥R_TIMES y)) & (not(x ¥R_GE y)) & (x in Re) & (y in Re) & (x ¥R_GE R_0) & (y ¥R_GE R_0)
	(y,y)-->T614(Stat1,Stat1*) ==> (y ¥R_TIMES y) in Re
	(y,y)-->T672(Stat1,Stat1*) ==> y ¥R_GE y
	x-->T624(Stat1,Stat1*) ==> (x ¥R_TIMES R_0) = R_0
	y-->T624(Stat1,Stat1*) ==> (y ¥R_TIMES R_0) = R_0
	T612(Stat2*) ==> Stat2: R_0 in Re
	(R_0,R_0)-->T672(Stat2*) ==> R_0 ¥R_GE R_0
	Suppose ==> x = R_0
		(y,R_0,y,R_0)-->T702(Stat1*) ==> (y ¥R_TIMES y) ¥R_GE (R_0 ¥R_TIMES R_0)
		EQUAL(Stat1) ==> (R_0 ¥R_GE (y ¥R_TIMES y)) & ((y ¥R_TIMES y) ¥R_GE R_0)
		(R_0,y ¥R_TIMES y)-->T675(Stat1*) ==> Stat3: (R_0 ¥R_GT (y ¥R_TIMES y)) or (R_0 = (y ¥R_TIMES y))
		Suppose ==> R_0 ¥R_GT (y ¥R_TIMES y)
			(R_0,y ¥R_TIMES y,R_0)-->T677(Stat1*) ==> R_0 ¥R_GT R_0
		(R_0,R_0)-->T673(Stat1*) ==> false; Discharge ==> Stat4: not(R_0 ¥R_GT (y ¥R_TIMES y))
		(y,y)-->T700(Stat1,Stat3,Stat4*) ==> y = R_0
	EQUAL(Stat1) ==> false; Discharge ==> Stat5: x /= R_0
	Suppose ==> y = R_0
	EQUAL(Stat1) ==> false; Discharge ==> Stat6: y /= R_0
	(x,x)-->T614(Stat1,Stat1*) ==> (x ¥R_TIMES x) in Re
	(x,x)-->T672(Stat1,Stat1*) ==> x ¥R_GE x
	(x,x,x,R_0)-->T702(Stat1*) ==> (x ¥R_TIMES x) ¥R_GE (x ¥R_TIMES R_0)
	(y,y,y,R_0)-->T702(Stat1*) ==> (y ¥R_TIMES y) ¥R_GE (y ¥R_TIMES R_0)
	EQUAL(Stat1) ==> ((x ¥R_TIMES x) ¥R_GE R_0) & ((y ¥R_TIMES y) ¥R_GE R_0)
	x-->T647(Stat1,Stat5*) ==> Stat7: (R_Recip(x) in Re) & (R_Recip(x) /= R_0) & ((R_Recip(x) ¥R_TIMES x) = R_1)
	y-->T647(Stat1,Stat6*) ==> Stat8: (R_Recip(y) in Re) & (R_Recip(y) /= R_0) & ((R_Recip(y) ¥R_TIMES y) = R_1)
	(x,R_0)-->T675(Stat1,Stat2,Stat5*) ==> Stat9: x ¥R_GT R_0
	(y,R_0)-->T675(Stat1,Stat2,Stat6*) ==> Stat10: y ¥R_GT R_0
	x-->T709(Stat1,Stat9*) ==> Stat11: R_Recip(x) ¥R_GT R_0
	y-->T709(Stat1,Stat10*) ==> Stat12: R_Recip(y) ¥R_GT R_0
	(R_Recip(x),R_0)-->T675(Stat11,Stat7,Stat2*) ==> R_Recip(x) ¥R_GE R_0
	(R_Recip(y),R_0)-->T675(Stat12,Stat8,Stat2*) ==> R_Recip(y) ¥R_GE R_0
	Suppose ==> Stat13: not(R_Recip(x) ¥R_GE R_Recip(y))
		(x,y)-->T672(Stat1,Stat1*) ==> Stat14: y ¥R_GE x
		Suppose ==> Stat15: y = x
			EQUAL(Stat15) ==> Stat16: R_Recip(x) = R_Recip(y)
		(R_Recip(x), R_Recip(y))-->T680(Stat7,Stat8,Stat16,Stat13*) ==> false; Discharge ==> Stat17: y /= x
		(y, x)-->T680(Stat1, Stat14, Stat17*) ==> Stat18: y ¥R_GT x
		(R_Recip(x), R_Recip(y))-->T672(Stat7, Stat8, Stat13*) ==> Stat19: R_Recip(y) ¥R_GE R_Recip(x)
		(R_Recip(y), R_Recip(x), y, x)-->T704(Stat1, Stat9, Stat7, Stat8, Stat11, Stat18, Stat19*) ==> Stat20: (R_Recip(y) ¥R_TIMES y) ¥R_GT (R_Recip(x) ¥R_TIMES x)
		EQUAL(Stat7, Stat8, Stat20*) ==> Stat21: R_1 ¥R_GT R_1
	Use_def(¥R_GT)(Stat21*)	==> false; Discharge ==> R_Recip(x) ¥R_GE R_Recip(y)
	(x ¥R_TIMES x,y ¥R_TIMES y,R_Recip(x),R_Recip(y))-->T702(Stat1*) ==> ((x ¥R_TIMES x) ¥R_TIMES R_Recip(x)) ¥R_GE ((y ¥R_TIMES y) ¥R_TIMES R_Recip(y))
	(x,x,R_Recip(x))-->T620(Stat1,Stat7*) ==> ((x ¥R_TIMES x) ¥R_TIMES R_Recip(x)) = (x ¥R_TIMES (x ¥R_TIMES R_Recip(x)))
	(y,y,R_Recip(y))-->T620(Stat1,Stat8*) ==> ((y ¥R_TIMES y) ¥R_TIMES R_Recip(y)) = (y ¥R_TIMES (y ¥R_TIMES R_Recip(y)))
	(x,R_Recip(x))-->T618(Stat1,Stat7*) ==> (x ¥R_TIMES R_Recip(x)) = (R_Recip(x) ¥R_TIMES x)
	(y,R_Recip(y))-->T618(Stat1,Stat8*) ==> (y ¥R_TIMES R_Recip(y)) = (R_Recip(y) ¥R_TIMES y)
	x-->T627(Stat1,Stat1*) ==> (x ¥R_TIMES R_1) = x
	y-->T627(Stat1,Stat1*) ==> (y ¥R_TIMES R_1) = y
EQUAL(Stat1) ==> false; Discharge ==> QED
--
Theorem 716: [Properties of the real number 2] ((R_1 ¥R_PLUS R_1) in Re) & ((R_1 ¥R_PLUS R_1) ¥R_GT R_0) & (R_Recip(R_1 ¥R_PLUS R_1) in Re) & (R_Recip(R_1 ¥R_PLUS R_1) /= R_0) & ((X in Re) ¥imp ((X ¥R_OVER (R_1 ¥R_PLUS R_1)) in Re)). Proof:
Suppose_not(x) ==> AUTO
--
-- Let us recall that $R_0,R_1$ belong to $Re$ and that twice $R_0$ is $R_0$.
-- Moreover, $R_0$ is self-negative and is smaller that $R_1$. Hence, by
-- the strict monotonicity of addition, twice $R_1$ exceeds $R_0$.
--
	()-->T693 ==> AUTO
	(R_1,R_0)-->T673(*) ==> R_1 ¥R_GE R_0
	()-->T612 ==> AUTO
	(R_0,R_0)-->T672(*) ==> R_0 ¥R_GE R_0
        (R_1,R_0,R_1,R_0)-->T696(*) ==> Stat1: (R_1 ¥R_PLUS R_1) ¥R_GT (R_0 ¥R_PLUS R_0)
	R_0-->T626 ==> (R_0 ¥R_PLUS R_0) = R_0
	EQUAL(Stat1) ==> Stat2: (R_1 ¥R_PLUS R_1) ¥R_GT R_0
--
-- It follows from the fact that $R_1 ¥R_PLUS R_1$ is non-zero that its reciprocal
-- belongs to $Re$ and is non-zero. Hence, the only way the assertion could
-- be false would be the existence of a real number $x$ exists whose quotient by
-- $R_1 ¥R_PLUS R_1$ does not belong to $Re$.
--
	(R_1 ¥R_PLUS R_1,R_0)-->T673(Stat2*) ==> (R_1 ¥R_PLUS R_1) /= R_0
	(R_1,R_1)-->T613(*) ==> (R_1 ¥R_PLUS R_1) in Re
	(R_1 ¥R_PLUS R_1)-->T647(*) ==> Stat3: (R_Recip(R_1 ¥R_PLUS R_1) in Re) & (x in Re) & ((x ¥R_OVER (R_1 ¥R_PLUS R_1)) notin Re)
	(x,R_Recip(R_1 ¥R_PLUS R_1))-->T614(Stat3*) ==> (x ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1)) in Re
Use_def(¥R_OVER)(Stat3*) ==> false; Discharge ==> QED
--
-- The following proof is entirely analogous to the proof of Theorem 521 concerning rationals.
--
Theorem 717: [Any real number can be divided into two equal halves] (X in Re) ¥imp (X = (X ¥R_OVER (R_1 ¥R_PLUS R_1)) ¥R_PLUS (X ¥R_OVER (R_1 ¥R_PLUS R_1))). Proof:
Suppose_not(x) ==> AUTO
	x-->T716(*) ==> ((R_1 ¥R_PLUS R_1) in Re) & ((R_1 ¥R_PLUS R_1) ¥R_GT R_0) & (R_Recip(R_1 ¥R_PLUS R_1) in Re) & (R_Recip(R_1 ¥R_PLUS R_1) /= R_0) & ((x in Re) ¥imp ((x ¥R_OVER (R_1 ¥R_PLUS R_1)) in Re))
	T612(*) ==> (R_0 in Re) & (R_1 in Re)
	(R_1 ¥R_PLUS R_1,R_0)-->T675(*) ==> (R_1 ¥R_PLUS R_1) /= R_0
	Suppose ==> R_1 /= (R_Recip(R_1 ¥R_PLUS R_1) ¥R_PLUS R_Recip(R_1 ¥R_PLUS R_1))
		(R_1 ¥R_PLUS R_1)-->T645(*) ==> R_1 = ((R_1 ¥R_PLUS R_1) ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1))
		((R_1 ¥R_PLUS R_1),R_Recip(R_1 ¥R_PLUS R_1))-->T618(*) ==> ((R_1 ¥R_PLUS R_1) ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1)) = (R_Recip(R_1 ¥R_PLUS R_1) ¥R_TIMES (R_1 ¥R_PLUS R_1))
		(R_Recip(R_1 ¥R_PLUS R_1),R_1,R_1)-->T621(*) ==> (R_Recip(R_1 ¥R_PLUS R_1) ¥R_TIMES (R_1 ¥R_PLUS R_1)) =
			((R_Recip(R_1 ¥R_PLUS R_1) ¥R_TIMES R_1) ¥R_PLUS (R_Recip(R_1 ¥R_PLUS R_1) ¥R_TIMES R_1))
		(R_Recip(R_1 ¥R_PLUS R_1))-->T627(*) ==> (R_Recip(R_1 ¥R_PLUS R_1) ¥R_TIMES R_1) = R_Recip(R_1 ¥R_PLUS R_1)
	EQUAL ==> false; Discharge ==> R_1 = (R_Recip(R_1 ¥R_PLUS R_1) ¥R_PLUS R_Recip(R_1 ¥R_PLUS R_1))
        (x,R_1 ¥R_PLUS R_1)-->T652(*) ==> (x ¥R_OVER (R_1 ¥R_PLUS R_1)) = (x ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1))
	EQUAL ==> ((x ¥R_OVER (R_1 ¥R_PLUS R_1)) ¥R_PLUS (x ¥R_OVER (R_1 ¥R_PLUS R_1))) = ((x ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1)) ¥R_PLUS (x ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1)))
        (x,R_Recip(R_1 ¥R_PLUS R_1),R_Recip(R_1 ¥R_PLUS R_1))-->T621(*) ==> ((x ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1)) ¥R_PLUS (x ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1))) =
		(x ¥R_TIMES (R_Recip(R_1 ¥R_PLUS R_1) ¥R_PLUS R_Recip(R_1 ¥R_PLUS R_1)))
        x-->T627(*) ==> (x ¥R_TIMES R_1) = x
    EQUAL ==> false; Discharge ==> QED
--
-- The following proof is closely analogous to the proof of Theorem 519 concerning rationals.
--
Theorem 718: [The average of two real numbers lies between them] ((X in Re) & (Y in Re) & (X ¥R_GT Y)) ¥imp ((X ¥R_GT ((X ¥R_PLUS Y) ¥R_OVER (R_1 ¥R_PLUS R_1))) & (((X ¥R_PLUS Y) ¥R_OVER (R_1 ¥R_PLUS R_1)) ¥R_GT Y)). Proof:
Suppose_not(m,n) ==> AUTO
	(m,m)-->T672(*) ==> m ¥R_GE m
	(n,n)-->T672(*) ==> n ¥R_GE n
	(n,n,m,n)-->T696(*) ==> (n ¥R_PLUS m) ¥R_GT (n ¥R_PLUS n)
	(m,m,m,n)-->T696(*) ==> (m ¥R_PLUS m) ¥R_GT (m ¥R_PLUS n)
	n-->T627(*) ==> (n ¥R_TIMES R_1) = n
	m-->T627(*) ==> (m ¥R_TIMES R_1) = m
	T612(*) ==> (R_0 in Re) & (R_1 in Re)
	(n,R_1,R_1)-->T621(*) ==> ((n ¥R_TIMES R_1) ¥R_PLUS (n ¥R_TIMES R_1)) = (n ¥R_TIMES (R_1 ¥R_PLUS R_1))
	(m,R_1,R_1)-->T621(*) ==> ((m ¥R_TIMES R_1) ¥R_PLUS (m ¥R_TIMES R_1)) = (m ¥R_TIMES (R_1 ¥R_PLUS R_1))
	(n,m)-->T615(*) ==> (n ¥R_PLUS m) = (m ¥R_PLUS n)
	(m,n)-->T613(*) ==> (m ¥R_PLUS n) in Re
	(m ¥R_PLUS n)-->T716(*) ==> ((R_1 ¥R_PLUS R_1) in Re) & ((R_1 ¥R_PLUS R_1) ¥R_GT R_0) & (R_Recip(R_1 ¥R_PLUS R_1) in Re)
	(R_1 ¥R_PLUS R_1,R_0)-->T673(*) ==> (R_1 ¥R_PLUS R_1) /= R_0
	(R_1 ¥R_PLUS R_1)-->T709(*) ==> R_Recip(R_1 ¥R_PLUS R_1) ¥R_GT R_0
	(R_Recip(R_1 ¥R_PLUS R_1),m ¥R_PLUS n)-->T618(*) ==> (R_Recip(R_1 ¥R_PLUS R_1) ¥R_TIMES (m ¥R_PLUS n)) = ((m ¥R_PLUS n) ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1))
	(R_1 ¥R_PLUS R_1)-->T645(*) ==> ((R_1 ¥R_PLUS R_1) ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1)) = R_1
	(m ¥R_PLUS n,R_1 ¥R_PLUS R_1)-->T652(*) ==> ((m ¥R_PLUS n) ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1)) = ((m ¥R_PLUS n) ¥R_OVER (R_1 ¥R_PLUS R_1))
	Suppose ==> not(((m ¥R_PLUS n) ¥R_OVER (R_1 ¥R_PLUS R_1)) ¥R_GT n)
		(n,R_1 ¥R_PLUS R_1)-->T614(*) ==> (n ¥R_TIMES (R_1 ¥R_PLUS R_1)) in Re
		EQUAL ==> (m ¥R_PLUS n) ¥R_GT (n ¥R_TIMES (R_1 ¥R_PLUS R_1))
		(R_Recip(R_1 ¥R_PLUS R_1),m ¥R_PLUS n,n ¥R_TIMES (R_1 ¥R_PLUS R_1))-->T703(*) ==>
			(R_Recip(R_1 ¥R_PLUS R_1) ¥R_TIMES (m ¥R_PLUS n)) ¥R_GT
			(R_Recip(R_1 ¥R_PLUS R_1) ¥R_TIMES (n ¥R_TIMES (R_1 ¥R_PLUS R_1)))
		(R_Recip(R_1 ¥R_PLUS R_1),n ¥R_TIMES (R_1 ¥R_PLUS R_1))-->T618(*) ==> (R_Recip(R_1 ¥R_PLUS R_1) ¥R_TIMES (n ¥R_TIMES (R_1 ¥R_PLUS R_1))) = ((n ¥R_TIMES (R_1 ¥R_PLUS R_1)) ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1))
		(n,R_1 ¥R_PLUS R_1,R_Recip(R_1 ¥R_PLUS R_1))-->T620(*) ==> ((n ¥R_TIMES (R_1 ¥R_PLUS R_1)) ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1)) = (n ¥R_TIMES ((R_1 ¥R_PLUS R_1) ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1)))
	EQUAL ==> false; Discharge ==> not(m ¥R_GT ((m ¥R_PLUS n) ¥R_OVER (R_1 ¥R_PLUS R_1)))
	(m,R_1 ¥R_PLUS R_1)-->T614(*) ==> (m ¥R_TIMES (R_1 ¥R_PLUS R_1)) in Re
	EQUAL ==> ((m ¥R_TIMES (R_1 ¥R_PLUS R_1)) ¥R_GT (m ¥R_PLUS n))
	(R_Recip(R_1 ¥R_PLUS R_1),m ¥R_TIMES (R_1 ¥R_PLUS R_1),m ¥R_PLUS n)-->T703(*) ==>
		(R_Recip(R_1 ¥R_PLUS R_1) ¥R_TIMES (m ¥R_TIMES (R_1 ¥R_PLUS R_1))) ¥R_GT
		(R_Recip(R_1 ¥R_PLUS R_1) ¥R_TIMES (m ¥R_PLUS n))
	(R_Recip(R_1 ¥R_PLUS R_1),m ¥R_TIMES (R_1 ¥R_PLUS R_1))-->T618(*) ==> (R_Recip(R_1 ¥R_PLUS R_1) ¥R_TIMES (m ¥R_TIMES (R_1 ¥R_PLUS R_1))) = ((m ¥R_TIMES (R_1 ¥R_PLUS R_1)) ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1))
	EQUAL ==> ((m ¥R_TIMES (R_1 ¥R_PLUS R_1)) ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1)) ¥R_GT
		((m ¥R_PLUS n) ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1))
	(m,R_1 ¥R_PLUS R_1,R_Recip(R_1 ¥R_PLUS R_1))-->T620(*) ==> ((m ¥R_TIMES (R_1 ¥R_PLUS R_1)) ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1)) = (m ¥R_TIMES ((R_1 ¥R_PLUS R_1) ¥R_TIMES R_Recip(R_1 ¥R_PLUS R_1)))
EQUAL ==> false; Discharge ==> QED
--
--
-- The following proof is entirely analogous to the proof of Theorem 522 concerning rationals.
--
Theorem 719: [Every positive real exceeds the sum of two smaller positive reals] ((X in Re) & (X ¥R_GT R_0)) ¥imp (EXISTS e in Re , e0 in Re | (X ¥R_GT e) & (e ¥R_GT e0) & (e0 ¥R_GT R_0) & (e ¥R_GT R_0) & (X ¥R_GT (e ¥R_PLUS e0))). Proof:
Suppose_not(x) ==> AUTO
--
-- For, if there could be a counterexample $x$, then we could take $e$ to be one half
-- of $x$ and $e0$ to be a half of $e$; and with these values, exploiting previously
-- proved lemmas, we would easily come to a contradiction.
--
	Loc_def ==> e = (x ¥R_OVER (R_1 ¥R_PLUS R_1))
	T612(*) ==> R_0 in Re
	x-->T626(*) ==> x = (x ¥R_PLUS R_0)
	(x,R_0)-->T718(*) ==> (x ¥R_GT ((x ¥R_PLUS R_0) ¥R_OVER (R_1 ¥R_PLUS R_1))) & (((x ¥R_PLUS R_0) ¥R_OVER (R_1 ¥R_PLUS R_1)) ¥R_GT R_0)
	x-->T716(*) ==> (x ¥R_OVER (R_1 ¥R_PLUS R_1)) in Re
	EQUAL ==> (x ¥R_GT e) & (e ¥R_GT R_0) & (e in Re)
	(e,e)-->T672(*) ==> e ¥R_GE e
	(e,R_0)-->T673(*) ==> e ¥R_GE R_0
	Loc_def ==> e0 = (e ¥R_OVER (R_1 ¥R_PLUS R_1))
	e-->T626(*) ==> e = (e ¥R_PLUS R_0)
	(e,R_0)-->T718(*) ==> (e ¥R_GT ((e ¥R_PLUS R_0) ¥R_OVER (R_1 ¥R_PLUS R_1))) & (((e ¥R_PLUS R_0) ¥R_OVER (R_1 ¥R_PLUS R_1)) ¥R_GT R_0)
	e-->T716(*) ==> (e ¥R_OVER (R_1 ¥R_PLUS R_1)) in Re
	EQUAL ==> (e ¥R_GT e0) & (e0 ¥R_GT R_0) & (e in Re)
	x-->T717(*) ==> x = ((x ¥R_OVER (R_1 ¥R_PLUS R_1)) ¥R_PLUS (x ¥R_OVER (R_1 ¥R_PLUS R_1)))
	EQUAL ==> x = (e ¥R_PLUS e)
        (e,e,e,e0)-->T696(*) ==> (e ¥R_PLUS e) ¥R_GT (e ¥R_PLUS e0)
	EQUAL ==> x ¥R_GT (e ¥R_PLUS e0)
	(e,R_0,e0,R_0)-->T696(*) ==> (e ¥R_PLUS e0) ¥R_GT (R_0 ¥R_PLUS R_0)
	R_0-->T626(*) ==> R_0 = (R_0 ¥R_PLUS R_0)
	EQUAL ==> (e ¥R_PLUS e0) ¥R_GT R_0
	ELEM ==> Stat1: (not(EXISTS e in Re, e0 in Re | (x ¥R_GT e) & (e ¥R_GT e0) & (e0 ¥R_GT R_0) & (e ¥R_GT R_0) & (x ¥R_GT (e ¥R_PLUS e0))))
(e,e0)-->Stat1(*) ==> false; Discharge ==> QED
--
-- The following proof is entirely analogous to the proof of Theorem 523 concerning rationals.
--
Theorem 720: [Every positive real exceeds some smaller positive real] ((X in Re) & (X ¥R_GT R_0)) ¥imp (EXISTS e in Re | (X ¥R_GT e) & (e ¥R_GT R_0)). Proof:
Suppose_not(x) ==> AUTO
	x-->T719(*) ==> Stat1: (EXISTS e in Re, e0 in Re | (x ¥R_GT e) & (e ¥R_GT e0) & (e0 ¥R_GT R_0) & (e ¥R_GT R_0) & (x ¥R_GT (e ¥R_PLUS e0)))
	(e,e0)-->Stat1(Stat1*) ==> (e in Re) & (e0 in Re) & (x ¥R_GT e) & (e ¥R_GT e0) & (e0 ¥R_GT R_0)
	(x,e,e0)-->T679(*) ==> x ¥R_GT e0
	ELEM ==> Stat2: (not(EXISTS e in Re | (x ¥R_GT e) & (e ¥R_GT R_0)))
e0-->Stat2(*) ==> false; Discharge ==> QED
--
Theorem 721: [Trigger for Otter theory 'orderedGroups'] (R_0 in Re) &
	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) in Re)) &
	(FORALL x | (x in Re) ¥imp (R_Rev(x) in Re)) &
	(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) ¥imp (((x ¥R_PLUS y) ¥R_PLUS z) = (x ¥R_PLUS (y ¥R_PLUS z)))) &
	(FORALL x | (x in Re) ¥imp ((x ¥R_PLUS R_0) = x)) &
	(FORALL x | (x in Re) ¥imp ((x ¥R_PLUS R_Rev(x)) = R_0)) &
	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) = (y ¥R_PLUS x))) &
	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((R_is_nonneg(x) & R_is_nonneg(y)) ¥imp R_is_nonneg(x ¥R_PLUS y))) &
	(FORALL x | (x in Re) ¥imp (R_is_nonneg(x) or R_is_nonneg(R_Rev(x)))) &
	(FORALL x | (x in Re) ¥imp ((R_is_nonneg(x) & R_is_nonneg(R_Rev(x))) ¥imp (x = R_0))) &
	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_LE y) ¥eq R_is_nonneg(y ¥R_PLUS R_Rev(x)))). Proof:
Suppose_not ==> AUTO
	()-->T612 ==> AUTO
	Suppose ==> Stat1: not(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) in Re))
		(x1,y1)-->Stat1(Stat1*) ==> (x1 in Re) & (y1 in Re) & ((x1 ¥R_PLUS y1) notin Re)
	(x1,y1)-->T613(Stat1*) ==> false; Discharge ==> (FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) in Re))
	Suppose ==> Stat2: not(FORALL x | (x in Re) ¥imp (R_Rev(x) in Re))
		x2-->Stat2(Stat2*) ==> (x2 in Re) & (R_Rev(x2) notin Re)
	(x2,x2)-->T613(Stat2*) ==> false; Discharge ==> (FORALL x | (x in Re) ¥imp (R_Rev(x) in Re))
	Suppose ==> Stat3: not(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) ¥imp (((x ¥R_PLUS y) ¥R_PLUS z) = (x ¥R_PLUS (y ¥R_PLUS z))))
		(x3,y3,z3)-->Stat3(Stat3*) ==> (x3 in Re) & (y3 in Re) & (z3 in Re) & (((x3 ¥R_PLUS y3) ¥R_PLUS z3) /= (x3 ¥R_PLUS (y3 ¥R_PLUS z3)))
	(x3,y3,z3)-->T617(Stat3*) ==> false; Discharge ==> (FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) ¥imp (((x ¥R_PLUS y) ¥R_PLUS z) = (x ¥R_PLUS (y ¥R_PLUS z))))
	Suppose ==> Stat4: not(FORALL x | (x in Re) ¥imp ((x ¥R_PLUS R_0) = x))
		x4-->Stat4(Stat4*) ==> (x4 in Re) & ((x4 ¥R_PLUS R_0) /= x4)
	x4-->T626(Stat4*) ==> false; Discharge ==> (FORALL x | (x in Re) ¥imp ((x ¥R_PLUS R_0) = x))
	Suppose ==> Stat5: not(FORALL x | (x in Re) ¥imp ((x ¥R_PLUS R_Rev(x)) = R_0))
		x5-->Stat5(Stat5*) ==> (x5 in Re) & ((x5 ¥R_PLUS R_Rev(x5)) /= R_0)
		(x5,x5)-->T635(Stat5*) ==> (x5 ¥R_MINUS x5) /= R_0
	x5-->T631(Stat5*) ==> false; Discharge ==> (FORALL x | (x in Re) ¥imp ((x ¥R_PLUS R_Rev(x)) = R_0))
	Suppose ==> Stat6: not(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) = (y ¥R_PLUS x)))
		(x6,y6)-->Stat6(Stat6*) ==> (x6 in Re) & (y6 in Re) & ((x6 ¥R_PLUS y6) /= (y6 ¥R_PLUS x6))
	(x6,y6)-->T615(Stat6*) ==> false; Discharge ==> (FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) = (y ¥R_PLUS x)))
	Suppose ==> Stat7: not(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((R_is_nonneg(x) & R_is_nonneg(y)) ¥imp R_is_nonneg(x ¥R_PLUS y)))
		(x7,y7)-->Stat7(Stat7*) ==> (x7 in Re) & (y7 in Re) & R_is_nonneg(x7) & R_is_nonneg(y7) & (not R_is_nonneg(x7 ¥R_PLUS y7))
	(x7,y7)-->T667(Stat7*) ==> false; Discharge ==> (FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((R_is_nonneg(x) & R_is_nonneg(y)) ¥imp R_is_nonneg(x ¥R_PLUS y)))
	Suppose ==> Stat8: not(FORALL x | (x in Re) ¥imp (R_is_nonneg(x) or R_is_nonneg(R_Rev(x))))
		x8-->Stat8(Stat8*) ==> (x8 in Re) & (not(R_is_nonneg(x8) or R_is_nonneg(R_Rev(x8))))
	x8-->T663(Stat8*) ==> false; Discharge ==> (FORALL x | (x in Re) ¥imp (R_is_nonneg(x) or R_is_nonneg(R_Rev(x))))
	Suppose ==> Stat9: not(FORALL x | (x in Re) ¥imp ((R_is_nonneg(x) & R_is_nonneg(R_Rev(x))) ¥imp (x = R_0)))
		x9-->Stat9(Stat9*) ==> (x9 in Re) & R_is_nonneg(x9) & R_is_nonneg(R_Rev(x9)) & (x9 /= R_0)
	x9-->T663(Stat9*) ==> false; Discharge ==> Stat10: not(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_LE y) ¥eq R_is_nonneg(y ¥R_PLUS R_Rev(x))))
	(x0,y0)-->Stat10(Stat10*) ==> (x0 in Re) & (y0 in Re) & (not((x0 ¥R_LE y0) ¥eq R_is_nonneg(y0 ¥R_PLUS R_Rev(x0))))
(x0,y0)-->T675(Stat10*) ==> false; Discharge ==> QED
--
APPLY_otter(abs_thryvar:abs) orderedGroups(In_domain(x)->(x in Re), pluz(x,y)->(x ¥R_PLUS y), e->R_0, rvz(x)->R_Rev(x), nneg(x)->R_is_nonneg(x), leq(x,y)->(x ¥R_LE y)) ==>
Theorem 722: [Basic properties of the absolute value function] (FORALL x | abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if) &
	(FORALL x | (x in Re) ¥imp (x ¥R_LE abs(x))) &
	(FORALL x | (x in Re) ¥imp (abs(abs(x)) = abs(x))) &
	(FORALL x | (x in Re) ¥imp ((abs(x) = R_0) ¥eq (x = R_0))) &
	(FORALL x | (x in Re) ¥imp (abs(R_Rev(x)) = abs(x))) &
	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) ¥R_LE (abs(x) ¥R_PLUS abs(y)))) &
	(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) ¥imp ((abs(x ¥R_PLUS R_Rev(y)) ¥R_LE z) ¥imp (y ¥R_LE (x ¥R_PLUS z)))) &
	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp (abs(x ¥R_PLUS y) ¥R_LE (abs(x) ¥R_PLUS abs(y)))) &
	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((not(R_is_nonneg(x))) ¥imp ((x ¥R_LE abs(y)) & (x /= abs(y))))) &
	(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) ¥imp (abs((x ¥R_PLUS R_Rev(z))) ¥R_LE (abs(x ¥R_PLUS R_Rev(y)) ¥R_PLUS abs(y ¥R_PLUS R_Rev(z))))) &
	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp (abs(abs(x) ¥R_PLUS R_Rev(abs(y))) ¥R_LE abs(x ¥R_PLUS R_Rev(y)))) &
	(FORALL x,y | ((x in Re) & (y in Re)) ¥imp (abs(x) ¥R_PLUS R_Rev(abs(abs(y) ¥R_PLUS R_Rev(abs(x)))) ¥R_LE abs(y)))
--
Theorem 723: [The absolute value of $x$ is a non-negative real no smaller than $x$] (X in Re) ¥imp ((abs(X) in Re) & (abs(X) ¥R_GE R_0) & (abs(X) ¥R_GE X) & (R_is_nonneg(abs(X)))). Proof:
Suppose_not(x) ==> AUTO
	T722(*) ==> Stat1: (FORALL x | abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if) & (x in Re)
	x-->Stat1(Stat1*) ==> abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if
	(x,x)-->T613(Stat1*) ==> R_Rev(x) in Re
	(Stat1*)ELEM ==> abs(x) in Re
	Suppose ==> Stat2: R_is_nonneg(x)
		x-->T681(Stat1*) ==> (x ¥R_GE R_0) & (abs(x) = x)
		(x,x)-->T672(Stat1*) ==> x ¥R_GE x
		EQUAL(Stat2) ==> (abs(x) ¥R_GE R_0) & (abs(x) ¥R_GE x) & R_is_nonneg(abs(x))
	Discharge ==> (not R_is_nonneg(x))
	x-->T663(Stat1*) ==> Stat3: R_is_nonneg(R_Rev(x)) & (abs(x) = R_Rev(x))
	EQUAL(Stat3) ==> R_is_nonneg(abs(x))
	(abs(x))-->T681(Stat1*) ==> abs(x) ¥R_GE R_0
	x-->T681(Stat1*) ==> not(x ¥R_GE R_0)
	T612(Stat3*) ==> R_0 in Re
	(x,R_0)-->T672(Stat1*) ==> R_0 ¥R_GE x
(abs(x),R_0,x)-->T668(*) ==> false; Discharge ==> QED
--
Theorem 724: [The absolute value of $x$ is whichever of $x$ and $-x$ is non-negative] (X in Re) ¥imp (abs(X) = if R_is_nonneg(X) then X else R_Rev(X) end if). Proof:
Suppose_not(x) ==> AUTO
	T722(*) ==> Stat1: (FORALL x | abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if) & (x in Re)
x-->Stat1(*) ==> false; Discharge ==> QED
--
Theorem 725: [The absolute value of $x$ is whichever of $x$ and $-x$ is non-negative, 2] (X in Re) ¥imp (abs(X) = if R_is_nonneg(R_Rev(X)) then R_Rev(X) else X end if). Proof:
Suppose_not(x) ==> AUTO
	Suppose ==> Stat1: x = R_0
		()-->T629(*) ==> AUTO
		()-->T671(*) ==> AUTO
		EQUAL(Stat1) ==> (R_Rev(x) = R_0) & R_is_nonneg(R_Rev(x))
		ELEM ==> abs(x) /= R_Rev(x)
		T722(*) ==> Stat2: (FORALL x | (x in Re) ¥imp ((abs(x) = R_0) ¥eq (x = R_0)))
		x-->Stat2(*) ==> abs(x) = R_0
	x-->Stat2(*) ==> false; Discharge ==> x /= R_0
	x-->T663(*) ==> R_is_nonneg(x) ¥neq R_is_nonneg(R_Rev(x))
	Suppose ==> (not R_is_nonneg(R_Rev(x)))
	x-->T724(*) ==> false; Discharge ==> R_is_nonneg(R_Rev(x))
x-->T724(*) ==> false; Discharge ==> QED
--
Theorem 726: [The absolute value of a real product is the product of absolute values] ((X in Re) & (Y in Re)) ¥imp (abs(X ¥R_TIMES Y) = (abs(X) ¥R_TIMES abs(Y))). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T614(*) ==> Stat1: (x ¥R_TIMES y) in Re
	Suppose ==> Stat2: (x = R_0) or (y = R_0)
		T722(*) ==> Stat3: (FORALL x | (x in Re) ¥imp ((abs(x) = R_0) ¥eq (x = R_0))) & (x in Re) & (y in Re)
		Suppose ==> not((abs(x) = R_0) or (abs(y) = R_0))
			Suppose ==> x = R_0
			x-->Stat3(Stat3*) ==> false; Discharge ==> y = R_0
		y-->Stat3(Stat3*) ==> false; Discharge ==> Stat4: (abs(x) = R_0) or (abs(y) = R_0)
		(x,y)-->T700(Stat2*) ==> (x ¥R_TIMES y) = R_0
		(x ¥R_TIMES y)-->Stat3(*) ==> Stat5: (abs(x) ¥R_TIMES abs(y)) /= R_0
		x-->T723(Stat3*) ==> abs(x) in Re
		y-->T723(Stat3*) ==> abs(y) in Re
	(abs(x),abs(y))-->T700(Stat4*) ==> false; Discharge ==> Stat6: (x /= R_0) & (y /= R_0) & (x in Re) & (y in Re)
	x-->T724(Stat6,Stat6*) ==> Stat7: abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if
	y-->T724(Stat6,Stat6*) ==> Stat8: abs(y) = if R_is_nonneg(y) then y else R_Rev(y) end if
	(x ¥R_TIMES y)-->T724(Stat1*) ==> Stat9: abs(x ¥R_TIMES y) = if R_is_nonneg(x ¥R_TIMES y) then (x ¥R_TIMES y) else R_Rev(x ¥R_TIMES y) end if
	x-->T642(Stat6,Stat6*) ==> R_Rev(x) = (R_Rev(R_1) ¥R_TIMES x)
	y-->T642(Stat6,Stat6*) ==> R_Rev(y) = (R_Rev(R_1) ¥R_TIMES y)
	(x ¥R_TIMES y)-->T642(Stat1,Stat1*) ==> R_Rev(x ¥R_TIMES y) = (R_Rev(R_1) ¥R_TIMES (x ¥R_TIMES y))
	(x,y)-->T623(Stat6,Stat6*) ==> Stat10: (((x ¥R_TIMES R_Rev(y)) = R_Rev(x ¥R_TIMES y)) & ((R_Rev(x) ¥R_TIMES y) = R_Rev(x ¥R_TIMES y)) & ((R_Rev(x) ¥R_TIMES R_Rev(y)) = (x ¥R_TIMES y)))
	(x,x)-->T613(Stat6,Stat6*) ==> R_Rev(x) in Re
	(y,y)-->T613(Stat6,Stat6*) ==> R_Rev(y) in Re
	Suppose ==> Stat11: R_is_nonneg(x) & R_is_nonneg(y)
		(x,y)-->T667(Stat6,Stat11*) ==> Stat12: R_is_nonneg(x ¥R_TIMES y)
		(Stat7,Stat8,Stat9,Stat11,Stat12*)ELEM ==> (abs(x) = x) & (abs(y) = y) & (abs(x ¥R_TIMES y) = (x ¥R_TIMES y))
	EQUAL ==> false; Discharge ==> not(R_is_nonneg(x) & R_is_nonneg(y))
	(x,y)-->T700(*) ==> Stat13: ((x ¥R_TIMES y) /= R_0) & (x in Re) & (y in Re)
	Suppose ==> Stat14: R_is_nonneg(x) & (not R_is_nonneg(y))
		y-->T663(Stat10*) ==> R_is_nonneg(R_Rev(y))
		(x,R_Rev(y))-->T667(Stat10*) ==> R_is_nonneg(x ¥R_TIMES R_Rev(y))
		EQUAL(Stat10) ==> R_is_nonneg(R_Rev(x ¥R_TIMES y))
		(x ¥R_TIMES y)-->T663(Stat1*) ==> abs(x ¥R_TIMES y) = R_Rev(x ¥R_TIMES y)
		(Stat7,Stat8,Stat9,Stat14*)ELEM ==> (abs(x) = x) & (abs(y) = R_Rev(y))
	EQUAL ==> false; Discharge ==> not(R_is_nonneg(x) & (not R_is_nonneg(y)))
	Suppose ==> Stat15: R_is_nonneg(y) & (not R_is_nonneg(x))
		x-->T663(Stat10*) ==> R_is_nonneg(R_Rev(x))
		(R_Rev(x),y)-->T667(Stat10*) ==> R_is_nonneg(R_Rev(x) ¥R_TIMES y)
		EQUAL(Stat10) ==> R_is_nonneg(R_Rev(x ¥R_TIMES y))
		(x ¥R_TIMES y)-->T663(Stat1*) ==> abs(x ¥R_TIMES y) = R_Rev(x ¥R_TIMES y)
		(Stat7,Stat8,Stat9,Stat15*)ELEM ==> (abs(x) = R_Rev(x)) & (abs(y) = y)
	EQUAL ==> false; Discharge ==> Stat16: (not R_is_nonneg(x)) & (not R_is_nonneg(y))
	x-->T663(Stat13*) ==> R_is_nonneg(R_Rev(x))
	y-->T663(Stat13*) ==> R_is_nonneg(R_Rev(y))
	(R_Rev(x),R_Rev(y))-->T667(Stat10*) ==> R_is_nonneg(R_Rev(x) ¥R_TIMES R_Rev(y))
	EQUAL(Stat10) ==> Stat17: R_is_nonneg(x ¥R_TIMES y)
	(Stat7,Stat8,Stat9,Stat16,Stat17*)ELEM ==> (abs(x) = R_Rev(x)) & (abs(y) = R_Rev(y)) & (abs(x ¥R_TIMES y) = (x ¥R_TIMES y))
EQUAL ==> false; Discharge ==> QED
--
--
--
Theorem 727: [$x$ and $-x$ have the same absolute value] (X in Re) ¥imp (abs(X) = abs(R_Rev(X))). Proof:
Suppose_not(x) ==> AUTO
	T722(*) ==> Stat1: (FORALL x | (x in Re) ¥imp (abs(R_Rev(x)) = abs(x)))
x-->Stat1(*) ==> false; Discharge ==> QED
--
--
--
--Theorem OM: [Another characterization of the absolute value of a real] (X in Re) ¥imp (abs(X) = Cauchy_to_Re(Ras_ABS(arb(X)))). Proof:
--Suppose_not(x) ==> AUTO
--	x-->T724(*) ==> abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if
--	Suppose ==> R_is_nonneg(x)
--		ELEM ==> abs(x) = x
--		EQUAL ==> x /= Cauchy_to_Re(Ras_ABS(arb(x)))
--		x-->T664(*) ==> Ra_eqseq(arb(x),Ras_ABS(arb(x)))
--		x-->T611(*) ==> (arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x)
--		(arb(x),arb(x))-->T556(*) ==> Ras_ABS(arb(x)) in RaCauchy
--	(arb(x),Ras_ABS(arb(x)))-->T610(*) ==> false; Discharge ==> (not R_is_nonneg(x)) & (abs(x) = R_Rev(x))
--	Use_def(R_is_nonneg)(*) ==> Stat1: (Cauchy_to_Re(Ras_ABS(arb(x))) /= x) & (R_Rev(x) /= Cauchy_to_Re(Ras_ABS(arb(X))))
--	Use_def(R_Rev)(Stat1*) ==> Cauchy_to_Re(Ras_ABS(arb(x))) /= Cauchy_to_Re(Ras_Rev(arb(x)))
--Tsomehow ==> false; Discharge ==> QED
--
--
--
Theorem 728: [Monotonicity of addition, 2] ((X in Re) & (Y in Re) & R_is_nonneg(R_Rev(Y))) ¥imp ((X ¥R_GT (X ¥R_PLUS Y)) or (X = (X ¥R_PLUS Y))). Proof:
Suppose_not(x,y) ==> AUTO
--
-- Assuming the contrary of the assertion to hold for $x,y$, we easily obtain $R_0 ¥R_GE y$
-- and hence, by <ddition, $(x ¥R_PLUS R_0) ¥R_GE (x ¥R_PLUS y)$
--
	(y,y)-->T613 ==> AUTO
	(R_Rev(y))-->T681(*) ==> R_Rev(y) ¥R_GE R_0
	()-->T612 ==> AUTO
	(R_Rev(y),R_0)-->T691(*) ==> Stat1: R_Rev(R_0) ¥R_GE R_Rev(R_Rev(y))
	()-->T629 ==> AUTO
	y-->T633(*) ==> R_Rev(R_Rev(y)) = y
	EQUAL(Stat1) ==> R_0 ¥R_GE y
	(x,x)-->T672(*) ==> x ¥R_GE x
	(x,x,R_0,y)-->T695(*) ==> (x ¥R_PLUS R_0) ¥R_GE (x ¥R_PLUS y)
--
-- Since $(x ¥R_PLUS R_0) = R_0$ and
-- $(x ¥R_GE (x ¥R_PLUS y)) ¥eq ((x ¥R_GT (x ¥R_PLUS y)) or (x = (x ¥R_PLUS y)))$,
-- we readily get into a contradiction, which gives us the desired conclusion.
--
	(x,y)-->T613 ==> AUTO
	(x,x ¥R_PLUS y)-->T680(*) ==> not(x ¥R_GE (x ¥R_PLUS y))
	x-->T626(*) ==> (x ¥R_PLUS R_0) = x
EQUAL ==> false; Discharge ==> QED
--
Theorem 729: ((X in Re) & (Y in Re) & R_is_nonneg(X) & (not R_is_nonneg(Y))) ¥imp
		((X ¥R_GE abs(X ¥R_PLUS Y)) or (R_Rev(Y) ¥R_GE abs(X ¥R_PLUS Y))). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T613(*) ==> Stat1: ((x ¥R_PLUS y) in Re) & (R_Rev(x) in Re)
	(y,y)-->T613(*) ==> Stat2: (R_Rev(y) in Re)
	(x ¥R_PLUS y)-->T723(*) ==> abs(x ¥R_PLUS y) in Re
	(x ¥R_PLUS y)-->T723(Stat1*) ==> (abs(x ¥R_PLUS y) in Re) & (abs(x ¥R_PLUS y) ¥R_GE R_0) & (abs(x ¥R_PLUS y) ¥R_GE (x ¥R_PLUS y))
	(x,abs(x ¥R_PLUS y))-->T680(*) ==> not((x ¥R_GT abs(x ¥R_PLUS y)) or (x = abs(x ¥R_PLUS y)) or (R_Rev(y) ¥R_GE abs(x ¥R_PLUS y)))
	(R_Rev(y),abs(x ¥R_PLUS y))-->T680(*) ==> Stat3: (x in Re) & (y in Re) & R_is_nonneg(x) & (not (R_is_nonneg(y))) &
		(not((x ¥R_GT abs(x ¥R_PLUS y)) or (x = abs(x ¥R_PLUS y)) or (R_Rev(y) ¥R_GT abs(x ¥R_PLUS y)) or (R_Rev(y) = abs(x ¥R_PLUS y))))
	y-->T663(*) ==> R_is_nonneg(R_Rev(y))
	y-->T725(*) ==> abs(y) = R_Rev(y)
	(x,y)-->T728(*) ==> (x ¥R_GT (x ¥R_PLUS y)) or (x = (x ¥R_PLUS y))
	x-->T633(*) ==> R_Rev(R_Rev(x)) = x
	EQUAL ==> R_is_nonneg(R_Rev(R_Rev(x)))
	x-->T724(*) ==> abs(x) = x
	(R_Rev(y),R_Rev(x))-->T728(*) ==> Stat4: (R_Rev(y) ¥R_GT (R_Rev(y) ¥R_PLUS R_Rev(x))) or (R_Rev(y) = (R_Rev(y) ¥R_PLUS R_Rev(x)))
	Suppose ==> Stat5: R_is_nonneg(x ¥R_PLUS y)
		(x ¥R_PLUS y)-->T724(Stat1,Stat5*) ==> abs(x ¥R_PLUS y) = x ¥R_PLUS y
		EQUAL ==> (x ¥R_GT abs(x ¥R_PLUS y)) or (x = abs(x ¥R_PLUS y))
	(x,abs(x ¥R_PLUS y))-->T680(*) ==> false; Discharge ==> Stat6: (not R_is_nonneg(x ¥R_PLUS y))
	(x ¥R_PLUS y)-->T663(Stat1*) ==> R_is_nonneg(R_Rev(x ¥R_PLUS y))
	(x ¥R_PLUS y)-->T725(*) ==> abs(x ¥R_PLUS y) = R_Rev(x ¥R_PLUS y)
	(x ¥R_PLUS y)-->T724(Stat1,Stat6*) ==> abs(x ¥R_PLUS y) = R_Rev(x ¥R_PLUS y)
	(x,y)-->T638(*) ==> abs(x ¥R_PLUS y) = (R_Rev(x) ¥R_PLUS R_Rev(y))
	(R_Rev(x),R_Rev(y))-->T615(*) ==> (R_Rev(x) ¥R_PLUS R_Rev(y)) = (R_Rev(y) ¥R_PLUS R_Rev(x))
	EQUAL(Stat4) ==> (R_Rev(y) ¥R_GT abs(x ¥R_PLUS y)) or (R_Rev(y) = abs(x ¥R_PLUS y))
(R_Rev(y),abs(x ¥R_PLUS y))-->T680(*)  ==> false; Discharge ==> QED
--
Theorem 730: ((X in Re) & (Y in Re)) ¥imp (((X ¥R_PLUS abs(Y)) ¥R_GE X)). Proof:
Suppose_not(x,y) ==> AUTO
	y-->T723(*) ==> Stat1: (abs(y) in Re) & R_is_nonneg(abs(y))
	(abs(y))-->T633(*) ==> R_Rev(R_Rev(abs(y))) = abs(y)
	(abs(y),abs(y))-->T613(*) ==> R_Rev(abs(y)) in Re
	EQUAL(Stat1) ==> R_is_nonneg(R_Rev(R_Rev(abs(y))))
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	(R_Rev(x),R_Rev(abs(y)))-->T728(*) ==> (R_Rev(x) ¥R_GT (R_Rev(x) ¥R_PLUS R_Rev(abs(y)))) or (R_Rev(x) = (R_Rev(x) ¥R_PLUS R_Rev(abs(y))))
	(R_Rev(x),R_Rev(abs(y)))-->T613(*) ==> (R_Rev(x) ¥R_PLUS R_Rev(abs(y))) in Re
	(R_Rev(x),R_Rev(x) ¥R_PLUS R_Rev(abs(y)))-->T680(*) ==> R_Rev(x) ¥R_GE (R_Rev(x) ¥R_PLUS R_Rev(abs(y)))
	(R_Rev(x),R_Rev(x) ¥R_PLUS R_Rev(abs(y)))-->T691(*) ==> Stat2: R_Rev(R_Rev(x) ¥R_PLUS R_Rev(abs(y))) ¥R_GE R_Rev(R_Rev(x))
	x-->T723(*) ==> abs(x) in Re
	(abs(x))-->T633(Stat2) ==> R_Rev(R_Rev(abs(x))) = abs(x)
	x-->T633(*) ==> R_Rev(R_Rev(x)) = x
	(R_Rev(x),R_Rev(abs(y)))-->T638(Stat1*) ==> R_Rev(R_Rev(x) ¥R_PLUS R_Rev(abs(y))) = (R_Rev(R_Rev(x)) ¥R_PLUS R_Rev(R_Rev(abs(y))))
EQUAL ==> false; Discharge ==> QED
--
Theorem 731: ((X in Re) & (Y in Re)) ¥imp (((abs(X) ¥R_PLUS abs(Y)) ¥R_GT abs(X ¥R_PLUS Y)) or ((abs(X) ¥R_PLUS abs(Y)) = abs(X ¥R_PLUS Y))). Proof:
Suppose_not(x,y) ==> AUTO
	T722(*) ==> Stat1: (FORALL x,y | ((x in Re) & (y in Re)) ¥imp (abs(x ¥R_PLUS y) ¥R_LE (abs(x) ¥R_PLUS abs(y))))
	(x,y)-->Stat1(*) ==> Stat2: (x in Re) & (y in Re) & (abs(x ¥R_PLUS y) ¥R_LE (abs(x) ¥R_PLUS abs(y)))
	(x,y)-->T613(Stat2*) ==> Stat3: (x ¥R_PLUS y) in Re
	(x ¥R_PLUS y)-->T723(Stat3*) ==> abs(x ¥R_PLUS y) in Re
	x-->T723(Stat2*) ==> abs(x) in Re
	y-->T723(Stat2*) ==> abs(y) in Re
	(abs(x),abs(y))-->T613(Stat3*) ==> (abs(x) ¥R_PLUS abs(y)) in Re
	(abs(x) ¥R_PLUS abs(y),abs(x ¥R_PLUS y))-->T680(*) ==> not((abs(x) ¥R_PLUS abs(y)) ¥R_GE abs(x ¥R_PLUS y))
(abs(x ¥R_PLUS y),abs(x) ¥R_PLUS abs(y))-->T673(Stat2*) ==> false; Discharge ==> QED
--
Theorem 732: [The absolute value of a real quotient is the quotient of absolute values]  ((X in Re) & (Y in Re) & (Y /= R_0)) ¥imp ((abs(X) ¥R_OVER abs(Y)) = abs(X ¥R_OVER Y)). Proof:
Suppose_not(x,y) ==> AUTO
--
-- Regarding the right-hand side of the supposed inequality, we easily reduce
-- it to the form $(abs(x) ¥R_TIMES abs(R_Recip(y)))$.
--
	(x,y)-->T652(*) ==> Stat1: ((x ¥R_OVER y) = (x ¥R_TIMES R_Recip(y))) & (x in Re) & (y in Re) & (y /= R_0)
	y-->T647(Stat1*) ==> Stat2: (R_Recip(y) in Re) & (R_Recip(y) /= R_0)
	(x,R_Recip(y))-->T726(Stat1*) ==> abs(x ¥R_TIMES R_Recip(y)) = (abs(x) ¥R_TIMES abs(R_Recip(y)))
	EQUAL ==> Stat3: (abs(x) ¥R_OVER abs(y)) /= (abs(x) ¥R_TIMES abs(R_Recip(y)))
--
-- By reducing the left-hand side of the supposed inequality to the same form
-- to which we have reduced the right-hand side,
-- we will reach a contradiction and hence the desired conclusion.
-- As a preliminary step, after observing that $abs(y) /= R_0$,
-- we reduce the left-hand side to a form where $R_Recip(abs(y))$
-- appears in place of $abs(R_Recip(y))$.
--
	y-->T723(Stat1,Stat1*) ==> Stat4: (abs(y) in Re) & (abs(y) ¥R_GE R_0) & (abs(y) ¥R_GE y) & R_is_nonneg(abs(y))
	Suppose ==> Stat5: abs(y) = R_0
		EQUAL(Stat3) ==> Stat6: R_0 ¥R_GE y
		T612(Stat7*) ==> Stat7: R_0 in Re
		(R_0,y)-->T673(Stat1,Stat6,Stat7*) ==> R_is_nonneg(R_0 ¥R_PLUS R_Rev(y))
		(y,y)-->T613(Stat1,Stat1*) ==> R_Rev(y) in Re
		(R_Rev(y))-->T626(Stat7*) ==> (R_0 ¥R_PLUS R_Rev(y)) = R_Rev(y)
		EQUAL(Stat7) ==> R_is_nonneg(R_Rev(y))
		y-->T725(Stat1,Stat5*) ==> R_0 = R_Rev(y)
		T693 ==> R_Rev(R_0) = R_0
		y-->T633(Stat1,Stat1*) ==> R_Rev(R_Rev(y)) = y
	EQUAL(Stat1) ==> false; Discharge ==> Stat8: abs(y) /= R_0
	x-->T723(Stat1,Stat1*) ==> abs(x) in Re
	(abs(x),abs(y))-->T652(Stat3*) ==> Stat9: (abs(x) ¥R_TIMES R_Recip(abs(y))) /= (abs(x) ¥R_TIMES abs(R_Recip(y)))
--
-- Then we show that $R_Recip(abs(y))$ and $abs(R_Recip(y))$ are,
-- as a matter of fact, the same number, thus reaching the expected contradiction.
-- This part of the proof splits into the case when $y$ is positive and the
-- case when $y$ is negative.
--
	Suppose ==> Stat10: R_Recip(abs(y)) /= abs(R_Recip(y))
		Suppose ==> Stat11: R_is_nonneg(y) & (not R_is_nonneg(R_Rev(y)))
			y-->T724(Stat1,Stat11*) ==> abs(y) = y
			y-->T630(Stat1,Stat1*) ==> (y ¥R_MINUS R_0) = y
			EQUAL(Stat9) ==> Stat12: (R_Recip(y) /= abs(R_Recip(y))) & R_is_nonneg(y ¥R_MINUS R_0)
			Use_def(¥R_GT)(Stat1,Stat12*) ==> Stat13: y ¥R_GT R_0
			y-->T709(Stat1,Stat13*) ==> R_Recip(y) ¥R_GT R_0
			Use_def(¥R_GT)(Stat13*) ==> R_is_nonneg(R_Recip(y) ¥R_MINUS R_0)
			(R_Recip(y))-->T630(Stat2,Stat2*) ==> (R_Recip(y) ¥R_MINUS R_0) = R_Recip(y)
			EQUAL(Stat13) ==> Stat14: R_is_nonneg(R_Recip(y))
			(R_Recip(y))-->T724(Stat2,Stat14*) ==> abs(R_Recip(y)) = R_Recip(y)
		EQUAL(Stat10) ==> false; Discharge ==> Stat15: not(R_is_nonneg(y) & (not R_is_nonneg(R_Rev(y))))
		y-->T663(Stat1,Stat15*) ==> Stat16: (not R_is_nonneg(y)) & R_is_nonneg(R_Rev(y))
		y-->T724(Stat1,Stat16*) ==> Stat17: abs(y) = R_Rev(y)
		(R_Rev(y))-->T630(Stat4,Stat17*) ==> (R_Rev(y) ¥R_MINUS R_0) = R_Rev(y)
		EQUAL(Stat10) ==> (R_Recip(R_Rev(y)) /= abs(R_Recip(y))) & R_is_nonneg(R_Rev(y) ¥R_MINUS R_0)
		Use_def(¥R_GT)(Stat8,Stat17*) ==> Stat18: R_Rev(y) ¥R_GT R_0
		(R_Rev(y))-->T709(Stat4,Stat17,Stat18*) ==> R_Recip(R_Rev(y)) ¥R_GT R_0
		Use_def(¥R_GT)(Stat13*) ==> Stat19: R_is_nonneg(R_Recip(R_Rev(y)) ¥R_MINUS R_0)
		(R_Rev(y))-->T647(Stat4,Stat17,Stat8*) ==> Stat20: (R_Recip(R_Rev(y)) in Re) & (R_Recip(R_Rev(y)) /= R_0)
		(R_Recip(R_Rev(y)))-->T630(Stat20,Stat20*) ==> (R_Recip(R_Rev(y)) ¥R_MINUS R_0) = R_Recip(R_Rev(y))
		EQUAL(Stat18) ==> Stat21: R_is_nonneg(R_Recip(R_Rev(y)))
		(R_Recip(R_Rev(y)))-->T724(Stat20,Stat21*) ==> abs(R_Recip(R_Rev(y))) = R_Recip(R_Rev(y))
		y-->T649(Stat1,Stat1*) ==> R_Recip(R_Rev(y)) = R_Rev(R_Recip(y))
		EQUAL(Stat10) ==> Stat22: abs(R_Rev(R_Recip(y))) /= abs(R_Recip(y))
	(R_Recip(y))-->T727(Stat2,Stat22*) ==> false; Discharge ==> R_Recip(abs(y)) = abs(R_Recip(y))
EQUAL(Stat9*) ==> false; Discharge ==> QED
--
-- The equivalent real of a rational number $r$
-- is the real number defined by the constant Cauchy
-- sequence all of whose values are $r$.
--
Def 69: [Embedding of rationals into reals] ReRa(X) := Cauchy_to_Re(Za ¥PROD {X})
--
-- In preparation for Theorem 736, we need the following two elementary lemmas.
--
Theorem 733: (X in Ra) ¥imp (Ra_is_nonneg(X) ¥eq Ra_eqseq(Za ¥PROD {Ra_ABS(X)},Za ¥PROD {X})). Proof:
Suppose_not(x0) ==> AUTO
	x0-->T452(*) ==> Ra_Rev(x0) in Ra
	T525(*) ==> Stat1: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &
		Stat2: (FORALL x | (x in Ra) ¥imp (Ra_ABS(x ¥Ra_PLUS Ra_Rev(x)) = Ra_0)) &
		Stat3: (FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0)))
	x0-->T543(*) ==> (Za ¥PROD {x0}) in RaCauchy
	(Ra_Rev(x0))-->T543(*) ==> (Za ¥PROD {Ra_Rev(x0)}) in RaCauchy
	T539(Stat1*) ==> ((Za ¥PROD {x0}) in RaSeq) & ((Za ¥PROD {Ra_Rev(x0)}) in RaSeq)
	Suppose ==> Ra_is_nonneg(x0) & (not Ra_eqseq(Za ¥PROD {Ra_ABS(x0)},Za ¥PROD {x0}))
		x0-->Stat1(Stat1) ==> Ra_ABS(x0) = x0
		EQUAL(Stat1) ==> (not Ra_eqseq(Za ¥PROD {x0}, Za ¥PROD {x0}))
	(Za ¥PROD {x0})-->T546(Stat1*) ==> false; Discharge ==> (not Ra_is_nonneg(x0)) & Ra_eqseq(Za ¥PROD {Ra_ABS(x0)},Za ¥PROD {x0})
	x0-->Stat1(Stat1*) ==> Ra_ABS(x0) = Ra_Rev(x0)
	EQUAL(Stat1) ==> Ra_eqseq(Za ¥PROD {Ra_Rev(x0)},Za ¥PROD {x0})
	(Za ¥PROD {Ra_Rev(x0)},Za ¥PROD {x0})-->T541(Stat1*) ==> Stat4: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp Finite({i: i in Za | Ra_ABS(((Za ¥PROD {Ra_Rev(x0)})~[i]) ¥Ra_MINUS ((Za ¥PROD {x0})~[i])) ¥Ra_GT eps}))
	(Ra_Rev(x0),x0)-->T454(*) ==> (Ra_Rev(x0) ¥Ra_MINUS x0) in Ra
	Suppose ==> (not((Ra_Rev(x0) ¥Ra_MINUS x0) ¥Ra_GT Ra_0))
		Use_def(¥Ra_MINUS)(Stat4*) ==> (not((Ra_Rev(x0) ¥Ra_PLUS Ra_Rev(x0)) ¥Ra_GT Ra_0))
		x0-->T451(*) ==> (Ra_0 in Ra) & (x0 = (x0 ¥Ra_PLUS Ra_0))
		Suppose ==> Ra_Rev(x0) = Ra_0
			x0-->Stat2(*) ==> Ra_ABS(x0 ¥Ra_PLUS Ra_Rev(x0)) = Ra_0
			(x0,Ra_Rev(x0))-->T445(*) ==> (x0 ¥Ra_PLUS Ra_Rev(x0)) in Ra
			(x0 ¥Ra_PLUS Ra_Rev(x0))-->Stat3(*) ==> (x0 ¥Ra_PLUS Ra_Rev(x0)) = Ra_0
			EQUAL(Stat4) ==> x0 = Ra_0
			T465(*) ==> Ra_is_nonneg(Ra_0)
		EQUAL(Stat1) ==> false; Discharge ==> Ra_Rev(x0) /= Ra_0
		x0-->T466(*) ==> Ra_is_nonneg(Ra_Rev(x0))
		(Ra_Rev(x0))-->T482(*) ==> Ra_Rev(x0) ¥Ra_GE Ra_0
		(Ra_Rev(x0),Ra_0)-->T473(*) ==> Ra_Rev(x0) ¥Ra_GT Ra_0
		(Ra_Rev(x0),Ra_0,Ra_Rev(x0),Ra_0)-->T505(*) ==> (Ra_Rev(x0) ¥Ra_PLUS Ra_Rev(x0)) ¥Ra_GT (Ra_0 ¥Ra_PLUS Ra_0)
		Ra_0-->T451(*) ==> Ra_0 = (Ra_0 ¥Ra_PLUS Ra_0)
	EQUAL(Stat4) ==> false; Discharge ==> (Ra_Rev(x0) ¥Ra_MINUS x0) ¥Ra_GT Ra_0
	(Ra_Rev(x0) ¥Ra_MINUS x0)-->T522(*) ==> Stat5: (EXISTS e in Ra, e0 in Ra | ((Ra_Rev(x0) ¥Ra_MINUS x0) ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e ¥Ra_GT Ra_0) & ((Ra_Rev(x0) ¥Ra_MINUS x0) ¥Ra_GT (e ¥Ra_PLUS e0)))
	(e,e0)-->Stat5(Stat5*) ==> (e in Ra) & (e ¥Ra_GT Ra_0) & ((Ra_Rev(x0) ¥Ra_MINUS x0) ¥Ra_GT e)
	Suppose ==> Za = {i: i in Za | Ra_ABS(((Za ¥PROD {Ra_Rev(x0)})~[i]) ¥Ra_MINUS ((Za ¥PROD {x0})~[i])) ¥Ra_GT e}
		e-->Stat4(Stat4*) ==> Finite({i: i in Za | Ra_ABS(((Za ¥PROD {Ra_Rev(x0)})~[i]) ¥Ra_MINUS ((Za ¥PROD {x0})~[i])) ¥Ra_GT e})
		EQUAL(Stat5*) ==> Finite(Za)
	0-->T206(Stat5*) ==> false; Discharge ==> Stat6: Za /= {i: i in Za | Ra_ABS(((Za ¥PROD {Ra_Rev(x0)})~[i]) ¥Ra_MINUS ((Za ¥PROD {x0})~[i])) ¥Ra_GT e}
	SIMPLF(Stat6*) ==> Stat7: {i: i in Za} /=  {i: i in Za | Ra_ABS(((Za ¥PROD {Ra_Rev(x0)})~[i]) ¥Ra_MINUS ((Za ¥PROD {x0})~[i])) ¥Ra_GT e}
	i0-->Stat7(Stat7*) ==> Stat8: (i0 in Za) & (not(Ra_ABS(((Za ¥PROD {Ra_Rev(x0)})~[i0]) ¥Ra_MINUS ((Za ¥PROD {x0})~[i0])) ¥Ra_GT e))
	Suppose ==> (((Za ¥PROD {Ra_Rev(x0)})~[i0]) = Ra_Rev(x0)) & (((Za ¥PROD {x0})~[i0]) = x0)
		(Ra_Rev(x0) ¥Ra_MINUS x0)-->T529(Stat4*) ==> Ra_ABS(Ra_Rev(x0) ¥Ra_MINUS x0) = (Ra_Rev(x0) ¥Ra_MINUS x0)
	EQUAL(Stat5) ==> false; Discharge ==> (not((((Za ¥PROD {Ra_Rev(x0)})~[i0]) = Ra_Rev(x0)) & (((Za ¥PROD {x0})~[i0]) = x0)))
	Suppose ==> Stat9: ((Za ¥PROD {Ra_Rev(x0)})~[i0]) /= Ra_Rev(x0)
		Use_def(¥PROD)(Stat9*) ==> (Za ¥PROD {Ra_Rev(x0)}) = {[x,y]: x in Za, y in {Ra_Rev(x0)}}
		SIMPLF(Stat9*) ==> (Za ¥PROD {Ra_Rev(x0)}) = {[x,Ra_Rev(x0)]: x in Za}
		APPLY() fcn_symbol(f(yy)->Ra_Rev(x0), g->(Za ¥PROD {Ra_Rev(x0)}), s->Za) ==> (domain(Za ¥PROD {Ra_Rev(x0)}) = Za) & Svm(Za ¥PROD {Ra_Rev(x0)})
			& Stat10: (FORALL yy | ((Za ¥PROD {Ra_Rev(x0)})~[yy]) = if yy in Za then Ra_Rev(x0) else 0 end if)
	i0-->Stat10(Stat8) ==> false; Discharge ==> Stat11: ((Za ¥PROD {x0})~[i0]) /= x0
	Use_def(¥PROD)(Stat11*) ==> (Za ¥PROD {x0}) = {[x,y]: x in Za, y in {x0}}
	SIMPLF(Stat11*) ==> (Za ¥PROD {x0}) = {[x,x0]: x in Za}
	APPLY() fcn_symbol(f(yy)->x0, g->(Za ¥PROD {x0}), s->Za) ==> (domain(Za ¥PROD {x0}) = Za) & Svm(Za ¥PROD {x0})
		& Stat12: (FORALL yy | ((Za ¥PROD {x0})~[yy]) = if yy in Za then x0 else 0 end if)
i0-->Stat12(Stat8) ==> false; Discharge ==> QED
--
--
--
Theorem 734: (X in Ra) ¥imp (R_is_nonneg(Cauchy_to_Re(Za ¥PROD {X})) ¥eq (ReRa(Ra_ABS(X)) = ReRa(X))). Proof:
Suppose_not(y0) ==> AUTO
	T608(Stat1*) ==> Stat1: (FORALL f in RaCauchy, g in RaCauchy, h in RaCauchy | (Ra_eqseq(f,g) & Ra_eqseq(g,h)) ¥imp Ra_eqseq(f,h))
	y0-->T544(*) ==> Stat2: Ras_ABS(Za ¥PROD {y0}) = (Za ¥PROD {Ra_ABS(y0)})
	Use_def(ReRa) ==> Stat3: (y0 in Ra) & (not(R_is_nonneg(Cauchy_to_Re(Za ¥PROD {y0})) ¥eq (Cauchy_to_Re(Za ¥PROD {Ra_ABS(y0)}) = Cauchy_to_Re(Za ¥PROD {y0}))))
	y0-->T527(Stat3*) ==> Ra_ABS(y0) in Ra
	y0-->T543(Stat3*) ==> Stat4: (Za ¥PROD {y0}) in RaCauchy
	(Ra_ABS(y0))-->T543(Stat3*) ==> (Za ¥PROD {Ra_ABS(y0)}) in RaCauchy
	(Za ¥PROD {y0},Za ¥PROD {y0})-->T610(Stat3*) ==> (Cauchy_to_Re(Za ¥PROD {y0}) in Re) &
		Ra_eqseq(Za ¥PROD {y0},arb(Cauchy_to_Re(Za ¥PROD {y0})))
	(Za ¥PROD {Ra_ABS(y0)},Za ¥PROD {y0})-->T610(Stat3*) ==> (Cauchy_to_Re(Za ¥PROD {Ra_ABS(y0)}) in Re) &
		Ra_eqseq(Za ¥PROD {Ra_ABS(y0)},arb(Cauchy_to_Re(Za ¥PROD {Ra_ABS(y0)}))) &
		((Cauchy_to_Re(Za ¥PROD {Ra_ABS(y0)}) = Cauchy_to_Re(Za ¥PROD {y0})) ¥eq (Ra_eqseq(Za ¥PROD {Ra_ABS(y0)},Za ¥PROD {y0})))
	(Cauchy_to_Re(Za ¥PROD {y0}))-->T664(Stat3*) ==> R_is_nonneg(Cauchy_to_Re(Za ¥PROD {y0})) ¥eq Ra_eqseq(arb(Cauchy_to_Re(Za ¥PROD {y0})),Ras_ABS(arb(Cauchy_to_Re(Za ¥PROD {y0}))))
	(Cauchy_to_Re(Za ¥PROD {y0}))-->T611(Stat3*) ==> Stat5: arb(Cauchy_to_Re(Za ¥PROD {y0})) in RaCauchy
	(arb(Cauchy_to_Re(Za ¥PROD {y0})),arb(Cauchy_to_Re(Za ¥PROD {y0})))-->T556(Stat5,Stat5*) ==> Ras_ABS(arb(Cauchy_to_Re(Za ¥PROD {y0}))) in RaCauchy
	(Za ¥PROD {y0},Za ¥PROD {y0})-->T556(Stat4,Stat4*) ==> Ras_ABS(Za ¥PROD {y0}) in RaCauchy
	(Za ¥PROD {y0},arb(Cauchy_to_Re(Za ¥PROD {y0})))-->T576(Stat3*) ==> Stat6: Ra_eqseq(Ras_ABS(Za ¥PROD {y0}),Ras_ABS(arb(Cauchy_to_Re(Za ¥PROD {y0}))))
	Suppose ==> R_is_nonneg(Cauchy_to_Re(Za ¥PROD {y0}))
		(Stat3*)ELEM ==> Ra_eqseq(arb(Cauchy_to_Re(Za ¥PROD {y0})),Ras_ABS(arb(Cauchy_to_Re(Za ¥PROD {y0})))) &
				(not Ra_eqseq(Za ¥PROD {Ra_ABS(y0)},Za ¥PROD {y0}))
		(Za ¥PROD {y0},arb(Cauchy_to_Re(Za ¥PROD {y0})),Ras_ABS(arb(Cauchy_to_Re(Za ¥PROD {y0}))))-->Stat1(Stat3*) ==> Ra_eqseq(Za ¥PROD {y0},Ras_ABS(arb(Cauchy_to_Re(Za ¥PROD {y0}))))
		(Ras_ABS(Za ¥PROD {y0}),Ras_ABS(arb(Cauchy_to_Re(Za ¥PROD {y0}))))-->T607(Stat3*) ==> Ra_eqseq(Ras_ABS(arb(Cauchy_to_Re(Za ¥PROD {y0}))),Ras_ABS(Za ¥PROD {y0}))
		(Za ¥PROD {y0},Ras_ABS(arb(Cauchy_to_Re(Za ¥PROD {y0}))),Ras_ABS(Za ¥PROD {y0}))-->Stat1(Stat3*) ==> Ra_eqseq(Za ¥PROD {y0},Ras_ABS(Za ¥PROD {y0}))
		(Za ¥PROD {y0},Ras_ABS(Za ¥PROD {y0}))-->T607(Stat3*) ==> Ra_eqseq(Ras_ABS(Za ¥PROD {y0}),Za ¥PROD {y0})
	EQUAL(Stat2) ==> false; Discharge ==> (not R_is_nonneg(Cauchy_to_Re(Za ¥PROD {y0})))
	(Stat3*)ELEM ==> Stat7: (not Ra_eqseq(arb(Cauchy_to_Re(Za ¥PROD {y0})),Ras_ABS(arb(Cauchy_to_Re(Za ¥PROD {y0}))))) &
		Ra_eqseq(Za ¥PROD {Ra_ABS(y0)},Za ¥PROD {y0})
	EQUAL(Stat2,Stat6) ==> Ra_eqseq(Za ¥PROD {Ra_ABS(y0)},Ras_ABS(arb(Cauchy_to_Re(Za ¥PROD {y0}))))
	(Za ¥PROD {Ra_ABS(y0)},Za ¥PROD {y0})-->T607(Stat3*) ==> Ra_eqseq(Za ¥PROD {y0},Za ¥PROD {Ra_ABS(y0)})
	(Za ¥PROD {y0},arb(Cauchy_to_Re(Za ¥PROD {y0})))-->T607(Stat3*) ==> Ra_eqseq(arb(Cauchy_to_Re(Za ¥PROD {y0})),Za ¥PROD {y0})
	(arb(Cauchy_to_Re(Za ¥PROD {y0})),Za ¥PROD {y0},Za ¥PROD {Ra_ABS(y0)})-->Stat1(Stat3*) ==> Ra_eqseq(arb(Cauchy_to_Re(Za ¥PROD {y0})),Za ¥PROD {Ra_ABS(y0)})
(arb(Cauchy_to_Re(Za ¥PROD {y0})),Za ¥PROD {Ra_ABS(y0)},Ras_ABS(arb(Cauchy_to_Re(Za ¥PROD {y0}))))-->Stat1(Stat3*) ==> false; Discharge ==> QED
--
-- The following two elementary theorems simply notes that the embedding of rationals into reals
-- defined by the function ReRa just introduced is an isomorphism in all respects.
--
Theorem 735: [The embedding of rationals into reals preserves all elementary algebraic operations, 1]  (Y in Ra) ¥imp ((ReRa(Y) in Re) &
	(ReRa(Ra_Rev(Y)) = R_Rev(ReRa(Y))) &
	(R_is_nonneg(ReRa(Y)) ¥eq Ra_is_nonneg(Y)) &
	(ReRa(Ra_ABS(Y)) = abs(ReRa(Y)))). Proof:
Suppose_not(y0) ==> AUTO
	Use_def(ReRa)(*) ==> Stat1: (ReRa(y0) = Cauchy_to_Re(Za ¥PROD {y0})) & (y0 in Ra)
	y0-->T543(*) ==> Stat2: (Za ¥PROD {y0}) in RaCauchy
	(Za ¥PROD {y0},Za ¥PROD {y0})-->T610(Stat1*) ==> Stat3: ReRa(y0) in Re
	Suppose ==> ReRa(Ra_Rev(y0)) /= R_Rev(ReRa(y0))
		(Za ¥PROD {y0})-->T622(*) ==> Cauchy_to_Re(Ras_Rev(Za ¥PROD {y0})) = R_Rev(Cauchy_to_Re(Za ¥PROD {y0}))
		Use_def(ReRa(Ra_Rev(y0))) ==> AUTO
		Use_def(Ras_Rev(Za ¥PROD {y0})) ==> AUTO
		Suppose ==> (Za ¥PROD {Ra_Rev(y0)}) = {[car(p),Ra_Rev(cdr(p))]: p in (Za ¥PROD {y0})}
		EQUAL ==> false; Discharge ==> Stat4: (Za ¥PROD {Ra_Rev(y0)}) /= {[car(p),Ra_Rev(cdr(p))]: p in (Za ¥PROD {y0})}
		p1-->Stat4(Stat4*) ==> (p1 in (Za ¥PROD {Ra_Rev(y0)})) ¥eq (p1 notin {[car(p),Ra_Rev(cdr(p))]: p in (Za ¥PROD {y0})})
		Use_def(¥PROD) ==> (Za ¥PROD {Ra_Rev(y0)}) = {[x,y]: x in Za, y in {Ra_Rev(y0)}}
		SIMPLF(Stat4*) ==> (p1 in {[x,Ra_Rev(y0)]: x in Za}) ¥eq (p1 notin {[car(p),Ra_Rev(cdr(p))]: p in (Za ¥PROD {y0})})
		Suppose ==> Stat5: (p1 in {[x,Ra_Rev(y0)]: x in Za}) & (p1 notin {[car(p),Ra_Rev(cdr(p))]: p in (Za ¥PROD {y0})})
			(x1,[x1,y0])-->Stat5(Stat5*) ==> (x1 in Za) & (p1 = [x1,Ra_Rev(y0)]) & ((p1 /= [car([x1,y0]),Ra_Rev(cdr([x1,y0]))]) or ([x1,y0] notin (Za ¥PROD {y0})))
			(x1,y0)-->T9 ==> AUTO
			EQUAL(Stat5) ==> (p1 = [car([x1,y0]),Ra_Rev(cdr([x1,y0]))])
			Use_def(¥PROD)(Stat5*) ==> Stat6: [x1,y0] notin {[x,y]: x in Za, y in {y0}}
		(x1,y0)-->Stat6(Stat5*) ==> false; Discharge ==> Stat7: (p1 in {[car(p),Ra_Rev(cdr(p))]: p in (Za ¥PROD {y0})}) & (p1 notin {[x,Ra_Rev(y0)]: x in Za})
		(p2,car(p2))-->Stat7(Stat7*) ==> Stat8: (p1 = [car(p2),Ra_Rev(cdr(p2))]) & (p2 in (Za ¥PROD {y0})) & ((p1 /= [car(p2),Ra_Rev(y0)]) or (car(p2) notin Za))
		Use_def(¥PROD)(Stat8*) ==> Stat9: p2 in {[x,y]: x in Za, y in {y0}}
		(x2,y2)-->Stat9(Stat8*) ==> Stat10: (x2 in Za) & (y2 = y0) & (p2 = [x2,y2]) & (([car(p2),Ra_Rev(cdr(p2))] /= [car(p2),Ra_Rev(y0)]) or (car(p2) notin Za))
		(x2,y2)-->T9 ==> AUTO
		EQUAL(Stat10) ==> Stat11: (car(p2) = x2) & (cdr(p2) = y0)
		(Stat10*)ELEM ==> [car(p2),Ra_Rev(cdr(p2))] /= [car(p2),Ra_Rev(y0)]
	EQUAL(Stat11) ==> false; Discharge ==> Stat12: ReRa(Ra_Rev(y0)) = R_Rev(ReRa(y0))
	Suppose ==> Stat13: not(R_is_nonneg(Cauchy_to_Re(Za ¥PROD {y0})) ¥eq Ra_is_nonneg(y0))
		y0-->T734(Stat13,Stat1*) ==> Stat14: (not((ReRa(Ra_ABS(y0)) = ReRa(y0)) ¥eq Ra_is_nonneg(y0)))
		y0-->T733(Stat14,Stat13,Stat1*) ==> Stat15: (not((ReRa(Ra_ABS(y0)) = ReRa(y0)) ¥eq Ra_eqseq(Za ¥PROD {Ra_ABS(y0)},Za ¥PROD {y0})))
		Use_def(ReRa)(Stat15*) ==> Stat16: (not((Cauchy_to_Re(Za ¥PROD {Ra_ABS(y0)}) = Cauchy_to_Re(Za ¥PROD {y0})) ¥eq Ra_eqseq(Za ¥PROD {Ra_ABS(y0)},Za ¥PROD {y0})))
		y0-->T527(Stat1*) ==> Stat17: Ra_ABS(y0) in Ra
		(Ra_ABS(y0))-->T543(Stat17*) ==> Stat18: (Za ¥PROD {Ra_ABS(y0)}) in RaCauchy
	(Za ¥PROD {Ra_ABS(y0)},Za ¥PROD {y0})-->T610(Stat18,Stat2,Stat16*) ==> false; Discharge ==> Stat19: R_is_nonneg(Cauchy_to_Re(Za ¥PROD {y0})) ¥eq Ra_is_nonneg(y0)
	Use_def(ReRa)(Stat19*) ==> R_is_nonneg(ReRa(y0)) ¥eq Ra_is_nonneg(y0)
	ELEM ==> ReRa(Ra_ABS(y0)) /= abs(ReRa(y0))
	Suppose ==> Stat20: Cauchy_to_Re(Ras_ABS(Za ¥PROD {y0})) /= abs(Cauchy_to_Re(Za ¥PROD {y0}))
		(Cauchy_to_Re(Za ¥PROD {y0}))-->T724(Stat1,Stat3*) ==> abs(Cauchy_to_Re(Za ¥PROD {y0})) =
			if R_is_nonneg(Cauchy_to_Re(Za ¥PROD {y0})) then Cauchy_to_Re(Za ¥PROD {y0}) else R_Rev(Cauchy_to_Re(Za ¥PROD {y0})) end if
		T525(*) ==> Stat21: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
		y0-->Stat21(Stat21*) ==> Ra_ABS(y0) = if Ra_is_nonneg(y0) then y0 else Ra_Rev(y0) end if
		APPLY() if_then_else(p->Ra_is_nonneg(y0),a->y0,b->Ra_Rev(y0),f(x)->Cauchy_to_Re(Za ¥PROD {x})) ==>
			Cauchy_to_Re(Za ¥PROD {if Ra_is_nonneg(y0) then y0 else Ra_Rev(y0) end if}) = if Ra_is_nonneg(y0) then Cauchy_to_Re(Za ¥PROD {y0}) else Cauchy_to_Re(Za ¥PROD {Ra_Rev(y0)}) end if
		Use_def(ReRa)(Stat12,Stat12*) ==> R_Rev(Cauchy_to_Re(Za ¥PROD {y0})) = Cauchy_to_Re(Za ¥PROD {Ra_Rev(y0)})
		y0-->T544(Stat1,Stat1*) ==> Ras_ABS(Za ¥PROD {y0}) = (Za ¥PROD {Ra_ABS(y0)})
		EQUAL(Stat20) ==> Stat22: if Ra_is_nonneg(y0) then Cauchy_to_Re(Za ¥PROD {y0}) else Cauchy_to_Re(Za ¥PROD {Ra_Rev(y0)}) end if /= if R_is_nonneg(Cauchy_to_Re(Za ¥PROD {y0})) then Cauchy_to_Re(Za ¥PROD {y0}) else Cauchy_to_Re(Za ¥PROD {Ra_Rev(y0)}) end if
	(Stat22,Stat19)ELEM ==> false; Discharge ==> Cauchy_to_Re(Ras_ABS(Za ¥PROD {y0})) = abs(Cauchy_to_Re(Za ¥PROD {y0}))
	Use_def(ReRa(Ra_ABS(y0))) ==> AUTO
	Use_def(Ras_ABS(Za ¥PROD {y0})) ==> AUTO
	Suppose ==> (Za ¥PROD {Ra_ABS(y0)}) = {[car(p),Ra_ABS(cdr(p))]: p in (Za ¥PROD {y0})}
	EQUAL ==> false; Discharge ==> Stat23: (Za ¥PROD {Ra_ABS(y0)}) /= {[car(p),Ra_ABS(cdr(p))]: p in (Za ¥PROD {y0})}
	p8-->Stat23(Stat23*) ==> (p8 in (Za ¥PROD {Ra_ABS(y0)})) ¥eq (p8 notin {[car(p),Ra_ABS(cdr(p))]: p in (Za ¥PROD {y0})})
	Use_def(¥PROD) ==> (Za ¥PROD {Ra_ABS(y0)}) = {[x,y]: x in Za, y in {Ra_ABS(y0)}}
	SIMPLF(Stat23*) ==> (p8 in {[x,Ra_ABS(y0)]: x in Za}) ¥eq (p8 notin {[car(p),Ra_ABS(cdr(p))]: p in (Za ¥PROD {y0})})
	Suppose ==> Stat24: (p8 in {[x,Ra_ABS(y0)]: x in Za}) & (p8 notin {[car(p),Ra_ABS(cdr(p))]: p in (Za ¥PROD {y0})})
		(x8,[x8,y0])-->Stat24(Stat24*) ==> (x8 in Za) & (p8 = [x8,Ra_ABS(y0)]) & ((p8 /= [car([x8,y0]),Ra_ABS(cdr([x8,y0]))]) or ([x8,y0] notin (Za ¥PROD {y0})))
		(x8,y0)-->T9 ==> AUTO
		EQUAL(Stat24) ==> (p8 = [car([x8,y0]),Ra_ABS(cdr([x8,y0]))])
		Use_def(¥PROD)(Stat24*) ==> Stat25: [x8,y0] notin {[x,y]: x in Za, y in {y0}}
	(x8,y0)-->Stat25(Stat24*) ==> false; Discharge ==> Stat26: (p8 in {[car(p),Ra_ABS(cdr(p))]: p in (Za ¥PROD {y0})}) & (p8 notin {[x,Ra_ABS(y0)]: x in Za})
	(p9,car(p9))-->Stat26(Stat26*) ==> Stat27: (p8 = [car(p9),Ra_ABS(cdr(p9))]) & (p9 in (Za ¥PROD {y0})) & ((p8 /= [car(p9),Ra_ABS(y0)]) or (car(p9) notin Za))
	Use_def(¥PROD)(Stat27*) ==> Stat28: p9 in {[x,y]: x in Za, y in {y0}}
	(x9,y9)-->Stat28(Stat27*) ==> Stat29: (x9 in Za) & (y9 = y0) & (p9 = [x9,y9]) & (([car(p9),Ra_ABS(cdr(p9))] /= [car(p9),Ra_ABS(y0)]) or (car(p9) notin Za))
	(x9,y9)-->T9 ==> AUTO
	EQUAL(Stat29) ==> Stat30: (car(p9) = x9) & (cdr(p9) = y0)
	(Stat29*)ELEM ==> [car(p9),Ra_ABS(cdr(p9))] /= [car(p9),Ra_ABS(y0)]
EQUAL(Stat30) ==> false; Discharge ==> QED

--
Theorem 736: [The embedding of rationals into reals preserves all elementary algebraic operations, 2]  ((X in Ra) & (Y in Ra)) ¥imp ((ReRa(X) in Re) & (ReRa(Y) in Re) &
	(ReRa(X ¥Ra_PLUS Y) = ReRa(X) ¥R_PLUS ReRa(Y)) &
	(ReRa(X ¥Ra_TIMES Y) = ReRa(X) ¥R_TIMES ReRa(Y))). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def(ReRa)(*) ==> Stat1: (ReRa(x0) = Cauchy_to_Re(Za ¥PROD {x0})) & (ReRa(y0) = Cauchy_to_Re(Za ¥PROD {y0})) & (y0 in Ra)
	x0-->T543(*) ==> (Za ¥PROD {x0}) in RaCauchy
	y0-->T543(*) ==> Stat2: (Za ¥PROD {y0}) in RaCauchy
	(Za ¥PROD {x0},Za ¥PROD {x0})-->T610(Stat1*) ==> ReRa(x0) in Re
	y0-->T735(Stat1*) ==> Stat3: (ReRa(y0) in Re) & (ReRa(Ra_Rev(y0)) = R_Rev(ReRa(y0)))
	Suppose ==> Stat4: ReRa(x0 ¥Ra_PLUS y0) /= (ReRa(x0) ¥R_PLUS ReRa(y0))
		Use_def(ReRa)(*) ==> ReRa(x0 ¥Ra_PLUS y0) = Cauchy_to_Re(Za ¥PROD {x0 ¥Ra_PLUS y0})
		(Za ¥PROD {x0},Za ¥PROD {y0})-->T616(Stat1*) ==> Cauchy_to_Re((Za ¥PROD {x0}) ¥Ras_PLUS (Za ¥PROD {y0})) = (Cauchy_to_Re(Za ¥PROD {x0}) ¥R_PLUS Cauchy_to_Re(Za ¥PROD {y0}))
		EQUAL(Stat1) ==> Cauchy_to_Re(Za ¥PROD {x0 ¥Ra_PLUS y0}) /= Cauchy_to_Re((Za ¥PROD {x0}) ¥Ras_PLUS (Za ¥PROD {y0}))
		Suppose ==> (Za ¥PROD {x0 ¥Ra_PLUS y0}) = ((Za ¥PROD {x0}) ¥Ras_PLUS (Za ¥PROD {y0}))
		EQUAL(Stat4*) ==> false; Discharge ==> (Za ¥PROD {x0 ¥Ra_PLUS y0}) /= ((Za ¥PROD {x0}) ¥Ras_PLUS (Za ¥PROD {y0}))
		Use_def(¥Ras_PLUS)(Stat4*) ==> Stat5: (Za ¥PROD {x0 ¥Ra_PLUS y0}) /= {[car(p),cdr(p) ¥Ra_PLUS ((Za ¥PROD {y0})~[car(p)])]: p in (Za ¥PROD {x0})}
		p3-->Stat5(Stat5*) ==> (p3 in (Za ¥PROD {x0 ¥Ra_PLUS y0})) ¥eq (p3 notin {[car(p),cdr(p) ¥Ra_PLUS ((Za ¥PROD {y0})~[car(p)])]: p in (Za ¥PROD {x0})})
		Use_def(¥PROD) ==> (Za ¥PROD {x0 ¥Ra_PLUS y0}) = {[x,y]: x in Za, y in {x0 ¥Ra_PLUS y0}}
		SIMPLF(Stat5*) ==> (p3 in {[x,x0 ¥Ra_PLUS y0]: x in Za}) ¥eq (p3 notin {[car(p),cdr(p) ¥Ra_PLUS ((Za ¥PROD {y0})~[car(p)])]: p in (Za ¥PROD {x0})})
		Suppose ==> Stat6: (p3 in {[x,x0 ¥Ra_PLUS y0]: x in Za}) & (p3 notin {[car(p),cdr(p) ¥Ra_PLUS ((Za ¥PROD {y0})~[car(p)])]: p in (Za ¥PROD {x0})})
			(x3,[x3,x0])-->Stat6(Stat6*) ==> (x3 in Za) & (p3 = [x3,x0 ¥Ra_PLUS y0]) & ((p3 /= [car([x3,x0]),cdr([x3,x0]) ¥Ra_PLUS ((Za ¥PROD {y0})~[car([x3,x0])])]) or ([x3,x0] notin (Za ¥PROD {x0})))
			(x3,x0)-->T9 ==> AUTO
			(x3,Za,y0)-->T142(Stat6*) ==> ((Za ¥PROD {y0})~[x3]) = y0
			EQUAL(Stat6) ==> ((Za ¥PROD {y0})~[car([x3,x0])]) = y0
			EQUAL(Stat6) ==> (p3 = [car([x3,x0]),cdr([x3,x0]) ¥Ra_PLUS ((Za ¥PROD {y0})~[car([x3,x0])])])
			Use_def(¥PROD)(Stat6*) ==> Stat7: [x3,x0] notin {[x,y]: x in Za, y in {x0}}
		(x3,x0)-->Stat7(Stat6*) ==> false; Discharge ==> Stat8: (p3 in {[car(p),cdr(p) ¥Ra_PLUS ((Za ¥PROD {y0})~[car(p)])]: p in (Za ¥PROD {x0})}) & (p3 notin {[x,x0 ¥Ra_PLUS y0]: x in Za})
		(p4,car(p4))-->Stat8(Stat8*) ==> Stat9: (p3 = [car(p4),cdr(p4) ¥Ra_PLUS ((Za ¥PROD {y0})~[car(p4)])]) & (p4 in (Za ¥PROD {x0})) & ((p3 /= [car(p4),x0 ¥Ra_PLUS y0]) or (car(p4) notin Za))
		Use_def(¥PROD)(Stat9*) ==> Stat10: p4 in {[x,y]: x in Za, y in {x0}}
		(x4,y4)-->Stat10(Stat9*) ==> Stat11: (x4 in Za) & (y4 = x0) & (p4 = [x4,y4]) & (([car(p4),cdr(p4) ¥Ra_PLUS ((Za ¥PROD {y0})~[car(p4)])] /= [car(p4),x0 ¥Ra_PLUS y0]) or (car(p4) notin Za))
		(x4,y4)-->T9 ==> AUTO
		EQUAL(Stat11) ==> Stat12: (car(p4) = x4) & (cdr(p4) = y4)
		(Stat11*)ELEM ==> [car(p4),cdr(p4) ¥Ra_PLUS ((Za ¥PROD {y0})~[car(p4)])] /= [car(p4),x0 ¥Ra_PLUS y0]
		(car(p4),Za,y0)-->T142(Stat11*) ==> ((Za ¥PROD {y0})~[car(p4)]) = y0
	EQUAL(Stat11) ==> false; Discharge ==> Stat13: ReRa(x0 ¥Ra_TIMES y0) /= (ReRa(x0) ¥R_TIMES ReRa(y0))
	Use_def(ReRa)(*) ==> ReRa(x0 ¥Ra_TIMES y0) = Cauchy_to_Re(Za ¥PROD {x0 ¥Ra_TIMES y0})
	(Za ¥PROD {x0},Za ¥PROD {y0})-->T619(Stat1*) ==> Cauchy_to_Re((Za ¥PROD {x0}) ¥Ras_TIMES (Za ¥PROD {y0})) = (Cauchy_to_Re(Za ¥PROD {x0}) ¥R_TIMES Cauchy_to_Re(Za ¥PROD {y0}))
	EQUAL ==> Cauchy_to_Re(Za ¥PROD {x0 ¥Ra_TIMES y0}) /= Cauchy_to_Re((Za ¥PROD {x0}) ¥Ras_TIMES (Za ¥PROD {y0}))
	Suppose ==> (Za ¥PROD {x0 ¥Ra_TIMES y0}) = ((Za ¥PROD {x0}) ¥Ras_TIMES (Za ¥PROD {y0}))
	EQUAL(Stat13*) ==> false; Discharge ==> (Za ¥PROD {x0 ¥Ra_TIMES y0}) /= ((Za ¥PROD {x0}) ¥Ras_TIMES (Za ¥PROD {y0}))
	Use_def(¥Ras_TIMES)(Stat13*) ==> Stat14: (Za ¥PROD {x0 ¥Ra_TIMES y0}) /= {[car(p),cdr(p) ¥Ra_TIMES ((Za ¥PROD {y0})~[car(p)])]: p in (Za ¥PROD {x0})}
	p6-->Stat14(Stat14*) ==> (p6 in (Za ¥PROD {x0 ¥Ra_TIMES y0})) ¥eq (p6 notin {[car(p),cdr(p) ¥Ra_TIMES ((Za ¥PROD {y0})~[car(p)])]: p in (Za ¥PROD {x0})})
	Use_def(¥PROD) ==> (Za ¥PROD {x0 ¥Ra_TIMES y0}) = {[x,y]: x in Za, y in {x0 ¥Ra_TIMES y0}}
	SIMPLF(Stat14*) ==> (p6 in {[x,x0 ¥Ra_TIMES y0]: x in Za}) ¥eq (p6 notin {[car(p),cdr(p) ¥Ra_TIMES ((Za ¥PROD {y0})~[car(p)])]: p in (Za ¥PROD {x0})})
	Suppose ==> Stat15: (p6 in {[x,x0 ¥Ra_TIMES y0]: x in Za}) & (p6 notin {[car(p),cdr(p) ¥Ra_TIMES ((Za ¥PROD {y0})~[car(p)])]: p in (Za ¥PROD {x0})})
		(x6,[x6,x0])-->Stat15(Stat15*) ==> (x6 in Za) & (p6 = [x6,x0 ¥Ra_TIMES y0]) & ((p6 /= [car([x6,x0]),cdr([x6,x0]) ¥Ra_TIMES ((Za ¥PROD {y0})~[car([x6,x0])])]) or ([x6,x0] notin (Za ¥PROD {x0})))
		(x6,x0)-->T9 ==> AUTO
		(x6,Za,y0)-->T142(Stat15*) ==> ((Za ¥PROD {y0})~[x6]) = y0
		EQUAL(Stat15) ==> ((Za ¥PROD {y0})~[car([x6,x0])]) = y0
		EQUAL(Stat15) ==> (p6 = [car([x6,x0]),cdr([x6,x0]) ¥Ra_TIMES ((Za ¥PROD {y0})~[car([x6,x0])])])
		Use_def(¥PROD)(Stat15*) ==> Stat16: [x6,x0] notin {[x,y]: x in Za, y in {x0}}
	(x6,x0)-->Stat16(Stat15*) ==> false; Discharge ==> Stat17: (p6 in {[car(p),cdr(p) ¥Ra_TIMES ((Za ¥PROD {y0})~[car(p)])]: p in (Za ¥PROD {x0})}) & (p6 notin {[x,x0 ¥Ra_TIMES y0]: x in Za})
	(p7,car(p7))-->Stat17(Stat17*) ==> Stat18: (p6 = [car(p7),cdr(p7) ¥Ra_TIMES ((Za ¥PROD {y0})~[car(p7)])]) & (p7 in (Za ¥PROD {x0})) & ((p6 /= [car(p7),x0 ¥Ra_TIMES y0]) or (car(p7) notin Za))
	Use_def(¥PROD)(Stat18*) ==> Stat19: p7 in {[x,y]: x in Za, y in {x0}}
	(x7,y7)-->Stat19(Stat18*) ==> Stat20: (x7 in Za) & (y7 = x0) & (p7 = [x7,y7]) & (([car(p7),cdr(p7) ¥Ra_TIMES ((Za ¥PROD {y0})~[car(p7)])] /= [car(p7),x0 ¥Ra_TIMES y0]) or (car(p7) notin Za))
	(x7,y7)-->T9 ==> AUTO
	EQUAL(Stat20) ==> Stat21: (car(p7) = x7) & (cdr(p7) = y7)
	(Stat20*)ELEM ==> [car(p7),cdr(p7) ¥Ra_TIMES ((Za ¥PROD {y0})~[car(p7)])] /= [car(p7),x0 ¥Ra_TIMES y0]
	(car(p7),Za,y0)-->T142(Stat20*) ==> ((Za ¥PROD {y0})~[car(p7)]) = y0
EQUAL(Stat20) ==> false; Discharge ==> QED
--
Theorem 737: [The embedding of rationals into reals preserves all elementary algebraic operations, 3]  ((X in Ra) & (Y in Ra)) ¥imp
			(ReRa(X ¥Ra_MINUS Y) = (ReRa(X) ¥R_MINUS ReRa(Y))). Proof:
Suppose_not(x0,y0) ==> AUTO
	y0-->T735(*) ==> Stat1: (ReRa(y0) in Re) & (R_Rev(ReRa(y0)) = ReRa(Ra_Rev(y0)))
	y0-->T452(*) ==> Ra_Rev(y0) in Ra
	(x0,Ra_Rev(y0))-->T736(*) ==> (ReRa(x0) in Re) & (ReRa(x0) ¥R_PLUS ReRa(Ra_Rev(y0)) = ReRa(x0 ¥Ra_PLUS Ra_Rev(y0)))
	(ReRa(x0),ReRa(y0))-->T635(Stat1*) ==> (ReRa(x0) ¥R_MINUS ReRa(y0)) = (ReRa(x0) ¥R_PLUS R_Rev(ReRa(y0)))
	Use_def(¥Ra_MINUS)(*) ==> (x0 ¥Ra_MINUS y0) = (x0 ¥Ra_PLUS Ra_Rev(y0))
EQUAL ==> false; Discharge ==> QED
--
Theorem 738: [The embedding of rationals into reals is 1-1]  ((X in Ra) & (Y in Ra)) ¥imp ((ReRa(X) = ReRa(Y)) ¥eq (X = Y)). Proof:
Suppose_not(v,y) ==> AUTO
	Suppose ==> (v = y) & (ReRa(v) /= ReRa(y))
	EQUAL ==> false; Discharge ==> (ReRa(v) = ReRa(y)) & (v /= y)
	Use_def(ReRa) ==> Stat1: (Cauchy_to_Re(Za ¥PROD {v}) = Cauchy_to_Re(Za ¥PROD {y})) & (v in Ra) & (y in Ra) & (v /= y)
	v-->T543(Stat1*) ==> (Za ¥PROD {v}) in RaCauchy
	y-->T543(Stat1*) ==> (Za ¥PROD {y}) in RaCauchy
	(Za ¥PROD {v},Za ¥PROD {y})-->T610(Stat1*) ==> Ra_eqseq(Za ¥PROD {v},Za ¥PROD {y})
	T539(Stat1*) ==> {Za ¥PROD {v},Za ¥PROD {y}} ¥incin RaSeq
	(Za ¥PROD {v},Za ¥PROD {y})-->T541(Stat1*) ==> Stat2: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({u: u in Za | Ra_ABS(((Za ¥PROD {v})~[u]) ¥Ra_MINUS ((Za ¥PROD {y})~[u])) ¥Ra_GT eps}))
	(v,y)-->T454(Stat1*) ==> (v ¥Ra_MINUS y) in Ra
 	(v ¥Ra_MINUS y)-->T527(Stat1*) ==> (Ra_ABS(v ¥Ra_MINUS y) in Ra) & (Ra_ABS(v ¥Ra_MINUS y) ¥Ra_GE Ra_0)
	y-->T451(Stat1*) ==> (Ra_0 in Ra) & (y = (y ¥Ra_PLUS Ra_0))
	Suppose ==> not(Ra_ABS(v ¥Ra_MINUS y) ¥Ra_GT Ra_0)
		(Ra_ABS(v ¥Ra_MINUS y),Ra_0)-->T473(Stat2*) ==> Ra_ABS(v ¥Ra_MINUS y) = Ra_0
		T525(Stat3*) ==> Stat3: (FORALL x | (x in Ra) ¥imp ((Ra_ABS(x) = Ra_0) ¥eq (x = Ra_0)))
		(v ¥Ra_MINUS y)-->Stat3(Stat2*) ==> (v ¥Ra_MINUS y) = Ra_0
		EQUAL(Stat2) ==> (y ¥Ra_PLUS (v ¥Ra_MINUS y)) = y
	(v,y)-->T455(Stat1*) ==> false; Discharge ==> Ra_ABS(v ¥Ra_MINUS y) ¥Ra_GT Ra_0
	(Ra_ABS(v ¥Ra_MINUS y))-->T522(Stat2*) ==> Stat4: (EXISTS e in Ra, e0 in Ra | (Ra_ABS(v ¥Ra_MINUS y) ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e ¥Ra_GT Ra_0) & (Ra_ABS(v ¥Ra_MINUS y) ¥Ra_GT (e ¥Ra_PLUS e0)))
	(e,e0)-->Stat4(Stat4*) ==> (e in Ra) & (Ra_ABS(v ¥Ra_MINUS y) ¥Ra_GT e) & (e ¥Ra_GT Ra_0)
	Suppose ==> Stat5: {u: u in Za | Ra_ABS(((Za ¥PROD {v})~[u]) ¥Ra_MINUS ((Za ¥PROD {y})~[u])) ¥Ra_GT e} = Za
		e-->Stat2(Stat2*) ==> Finite({u: u in Za | Ra_ABS(((Za ¥PROD {v})~[u]) ¥Ra_MINUS ((Za ¥PROD {y})~[u])) ¥Ra_GT e})
		0-->T206(*) ==> (not Finite(Za))
	EQUAL(Stat5) ==> false; Discharge ==> Stat6: {u in Za | Ra_ABS(((Za ¥PROD {v})~[u]) ¥Ra_MINUS ((Za ¥PROD {y})~[u])) ¥Ra_GT e} /= Za
	u-->Stat6(Stat6*) ==> (u in {u in Za | Ra_ABS(((Za ¥PROD {v})~[u]) ¥Ra_MINUS ((Za ¥PROD {y})~[u])) ¥Ra_GT e}) ¥neq (u in Za)
	Suppose ==> Stat7: u in {u in Za | Ra_ABS(((Za ¥PROD {v})~[u]) ¥Ra_MINUS ((Za ¥PROD {y})~[u])) ¥Ra_GT e}
	()-->Stat7(Stat6*) ==> false; Discharge ==> Stat8: (u notin {u in Za | Ra_ABS(((Za ¥PROD {v})~[u]) ¥Ra_MINUS ((Za ¥PROD {y})~[u])) ¥Ra_GT e}) & (u in Za)
	u-->Stat8(Stat8*) ==> not(Ra_ABS(((Za ¥PROD {v})~[u]) ¥Ra_MINUS ((Za ¥PROD {y})~[u])) ¥Ra_GT e)
	(u,Za,v)-->T142(Stat8*) ==> ((Za ¥PROD {v})~[u]) = v
	(u,Za,y)-->T142(Stat8*) ==> ((Za ¥PROD {y})~[u]) = y
EQUAL(Stat4) ==> false; Discharge ==> QED
--
Theorem 739: [The embedding of rationals into reals preserves 0 and 1]  (ReRa(Ra_0) = R_0) & (ReRa(Ra_1) = R_1). Proof:
Suppose_not ==> AUTO
	Use_def(ReRa(Ra_0)) ==> AUTO
--?	Use_def(Ra0Seq) ==> AUTO
--?	Use_def(R_0) ==> AUTO
	Use_def(Ra0Seq) ==> Ra0Seq = Za ¥PROD {Ra_0}
	Use_def(R_0) ==> R_0 = Cauchy_to_Re(Ra0Seq)
	Use_def(ReRa(Ra_1)) ==> AUTO
	Use_def(Ra1Seq) ==> Ra1Seq = Za ¥PROD {Ra_1}
	Use_def(R_1) ==> R_1 = Cauchy_to_Re(Ra1Seq)
EQUAL ==> false; Discharge ==> QED
--
-- The statement concerning isomorphism given above applies to division also, except
-- that in this case we should avoid dividing by 0.
--
Theorem 740: [The embedding of rationals into reals preserves quotients by nonzero quantities]  ((X in Ra) & (Y in Ra) & (Y /= Ra_0)) ¥imp
			((R_Recip(ReRa(Y)) = ReRa(Recip(Y))) &
			((ReRa(X) ¥R_OVER ReRa(Y)) = ReRa(X ¥Ra_OVER Y))). Proof:
Suppose_not(x0,y0) ==> AUTO
	y0-->T462(*) ==> (Recip(y0) in Ra) & ((y0 ¥Ra_TIMES Recip(y0)) = Ra_1)
	Suppose ==> R_Recip(ReRa(y0)) /= ReRa(Recip(y0))
		(y0,Recip(y0))-->T736(*) ==> (ReRa(y0) in Re) & (ReRa(Recip(y0)) in Re) & (ReRa(y0 ¥Ra_TIMES Recip(y0)) = (ReRa(y0) ¥R_TIMES ReRa(Recip(y0))))
		T739(*) ==> ReRa(Ra_1) = R_1
		EQUAL ==> (ReRa(y0) ¥R_TIMES ReRa(Recip(y0))) = R_1
--
-- The inequality $ReRa(y0) /= R_0$ follows from the one-one-ness of $ReRa$ and from
-- the facts $(y0 /= R_0) & (R_0=ReRa(Ra_0))$.
--
		Suppose ==> ReRa(y0) = R_0
			Ra_0-->T451(Stat1*) ==> Stat1: Ra_0 in Ra
			T739(Stat1*) ==> ReRa(Ra_0) = R_0
		(y0,Ra_0)-->T738(*) ==> false; Discharge ==> ReRa(y0) /= R_0
		(ReRa(y0))-->T647(*) ==> (R_Recip(ReRa(y0)) in Re) & ((R_Recip(ReRa(y0)) ¥R_TIMES ReRa(y0)) = R_1)
		(R_Recip(ReRa(y0)),ReRa(y0),ReRa(Recip(y0)))-->T620(*) ==> (R_Recip(ReRa(y0)) ¥R_TIMES (ReRa(y0) ¥R_TIMES ReRa(Recip(y0)))) = ((R_Recip(ReRa(y0)) ¥R_TIMES ReRa(y0)) ¥R_TIMES ReRa(Recip(y0)))
		EQUAL ==> (R_Recip(ReRa(y0)) ¥R_TIMES R_1) = (R_1 ¥R_TIMES ReRa(Recip(y0)))
		(R_Recip(ReRa(y0)))-->T627(*) ==> (R_Recip(ReRa(y0)) ¥R_TIMES R_1) = R_Recip(ReRa(y0))
		(ReRa(Recip(y0)))-->T628(*) ==> (R_1 ¥R_TIMES ReRa(Recip(y0))) = ReRa(Recip(y0))
	EQUAL ==> false; Discharge ==> Stat2: R_Recip(ReRa(y0)) = ReRa(Recip(y0))
	ELEM ==> Stat3: (ReRa(x0) ¥R_OVER ReRa(y0)) /= ReRa(x0 ¥Ra_OVER y0)
	Use_def(¥Ra_OVER)(Stat3*) ==> Stat4: (ReRa(x0) ¥R_OVER ReRa(y0)) /= ReRa(x0 ¥Ra_TIMES Recip(y0))
	Use_def(¥R_OVER)(Stat4*) ==> (ReRa(x0) ¥R_TIMES R_Recip(ReRa(y0))) /= ReRa(x0 ¥Ra_TIMES Recip(y0))
	EQUAL(Stat2) ==> (ReRa(x0) ¥R_TIMES ReRa(Recip(y0))) /= ReRa(x0 ¥Ra_TIMES Recip(y0))
(x0,Recip(y0))-->T736(*) ==> false; Discharge ==> QED
--
-- Moreover the embedding of rationals into reals defined by ReRa preserves all ordering relationships.
--
Theorem 741: [The embedding of rationals into reals preserves ordering]  ((X in Ra) & (Y in Ra)) ¥imp (((ReRa(X) ¥R_GE ReRa(Y)) ¥eq (X ¥Ra_GE Y)) &
		((ReRa(X) ¥R_GT ReRa(Y)) ¥eq (X ¥Ra_GT Y)) &
		((ReRa(Y) ¥R_LE ReRa(X)) ¥eq (Y ¥Ra_LE X)) &
		((ReRa(Y) ¥R_LT ReRa(X)) ¥eq (Y ¥Ra_LT X))). Proof:
Suppose_not(x0,y0) ==> AUTO
	(x0,y0)-->T736(*) ==> (ReRa(x0) in Re) & (ReRa(y0) in Re)
	Suppose ==> (not((ReRa(x0) ¥R_GE ReRa(y0)) ¥eq (x0 ¥Ra_GE y0)))
		(x0,y0)-->T473(*) ==> Stat1: (not((ReRa(x0) ¥R_GE ReRa(y0)) ¥eq Ra_is_nonneg(x0 ¥Ra_PLUS Ra_Rev(y0))))
		Use_def(¥Ra_MINUS)(Stat1*) ==> Stat2: (not((ReRa(x0) ¥R_GE ReRa(y0)) ¥eq Ra_is_nonneg(x0 ¥Ra_MINUS y0)))
		Use_def(¥R_GE)(Stat2*) ==> (not(R_is_nonneg(ReRa(x0) ¥R_MINUS ReRa(y0)) ¥eq Ra_is_nonneg(x0 ¥Ra_MINUS y0)))
		(x0,y0)-->T737(*) ==> (ReRa(x0) ¥R_MINUS ReRa(y0)) = ReRa(x0 ¥Ra_MINUS y0)
		EQUAL(Stat2) ==> (not(R_is_nonneg(ReRa(x0 ¥Ra_MINUS y0)) ¥eq Ra_is_nonneg(x0 ¥Ra_MINUS y0)))
		(x0,y0)-->T454(*) ==> (x0 ¥Ra_MINUS y0) in Ra
	(x0 ¥Ra_MINUS y0)-->T735(Stat2*) ==> false; Discharge ==> (ReRa(x0) ¥R_GE ReRa(y0)) ¥eq (x0 ¥Ra_GE y0)
	Suppose ==> (not((ReRa(x0) ¥R_GT ReRa(y0)) ¥eq (x0 ¥Ra_GT y0)))
		(x0,y0)-->T473(*) ==> (not((ReRa(x0) ¥R_GT ReRa(y0)) ¥eq ((ReRa(x0) ¥R_GE ReRa(y0)) & (x0 /= y0))))
		(x0,y0)-->T738(*) ==> (not((ReRa(x0) ¥R_GT ReRa(y0)) ¥eq ((ReRa(x0) ¥R_GE ReRa(y0)) & (ReRa(x0) /= ReRa(y0)))))
	(ReRa(x0),ReRa(y0))-->T673(*) ==> false; Discharge ==> (ReRa(x0) ¥R_GT ReRa(y0)) ¥eq (x0 ¥Ra_GT y0)
	Suppose ==> Stat3: (not((ReRa(y0) ¥R_LE ReRa(x0)) ¥eq (y0 ¥Ra_LE x0)))
		(y0,x0)-->T473(Stat3*) ==> (not((ReRa(y0) ¥R_LE ReRa(x0)) ¥eq (x0 ¥Ra_GE y0)))
	(ReRa(y0),ReRa(x0))-->T673(*) ==> false; Discharge ==> (not((ReRa(y0) ¥R_LT ReRa(x0)) ¥eq (y0 ¥Ra_LT x0)))
	(y0,x0)-->T473(*) ==> (not((ReRa(y0) ¥R_LT ReRa(x0)) ¥eq (x0 ¥Ra_GT y0)))
(ReRa(y0),ReRa(x0))-->T673(*) ==> false; Discharge ==> QED
--
Theorem 742: [The images of rationals via the embedding form a dense subset of the reals, 1] ((X in Re) & (Eps in Ra) & (Eps ¥Ra_GT Ra_0)) ¥imp (EXISTS y in Ra | Finite({m in Za | Ra_ABS(((arb(X))~[m]) ¥Ra_MINUS y) ¥Ra_GE Eps}) ). Proof+:
Suppose_not(x0,eps0) ==> Stat1: (not (EXISTS y in Ra | Finite({m in Za | Ra_ABS(((arb(x0))~[m]) ¥Ra_MINUS y) ¥Ra_GE eps0}) )) & (x0 in Re) & (eps0 in Ra) & (eps0 ¥Ra_GT Ra_0)
--
-- Reasoning by contradiction, assume that $x0,eps0$ are a counterexample to
-- the statement of this theorem. Moreover, let $eps$ be a rational number below $eps0$.
--
	eps0-->T522(Stat1*) ==> Stat2: (EXISTS e in Ra, e0 in Ra | (eps0 ¥Ra_GT e) & (e ¥Ra_GT e0) & (e0 ¥Ra_GT Ra_0) & (e ¥Ra_GT Ra_0) & (eps0 ¥Ra_GT (e ¥Ra_PLUS e0)))
	(eps,e0)-->Stat2(Stat2*) ==> Stat3: (eps in Ra) & (eps0 ¥Ra_GT eps) & (eps ¥Ra_GT Ra_0)
--
-- Since $arb(x0)$ is a rational Cauchy sequence, the distance between two
-- of its components, beyond a certain subscript value $m0$, does not exceed $eps$.
-- To get such an $m0$, it suffices to observe that $Za$, unlike the set
-- ${ i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) ¥Ra_MINUS ((arb(x0))~[j])) ¥Ra_GT eps }$,
-- is infinite, so that $Za$ must have a member $m0$ which does not belong to the latter set.
--
	x0-->T611(Stat1*) ==> Stat4: arb(x0) in RaCauchy
	Use_def(RaCauchy)(Stat4*) ==> Stat5: arb(x0) in {f in RaSeq | (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) ¥Ra_MINUS (f~[j])) ¥Ra_GT eps }))}
	()-->Stat5(Stat5*) ==> Stat6: (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) ¥Ra_MINUS ((arb(x0))~[j])) ¥Ra_GT eps })) &
		(arb(x0) in RaSeq)
	eps-->Stat6(Stat3,Stat3*) ==> Stat7: Finite({ i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) ¥Ra_MINUS ((arb(x0))~[j])) ¥Ra_GT eps })
	0-->T206(Stat7*) ==> (not Finite(Za))
        EQUAL(Stat7)==> Stat8: Za /= { i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) ¥Ra_MINUS ((arb(x0))~[j])) ¥Ra_GT eps }
	Suppose ==> Stat9: not({ i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) ¥Ra_MINUS ((arb(x0))~[j])) ¥Ra_GT eps } ¥incin Za)
		k-->Stat9(Stat9*) ==> (k notin Za) & Stat10: (k in { i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) ¥Ra_MINUS ((arb(x0))~[j])) ¥Ra_GT eps })
		(i0,j0)-->Stat10(Stat9*) ==> (i0 in Za) & (j0 in Za) & ((i0 * j0) notin Za)
	(i0,j0)-->T333(Stat9*) ==> false; Discharge ==> { i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) ¥Ra_MINUS ((arb(x0))~[j])) ¥Ra_GT eps } ¥incin Za
	(Stat8*)ELEM ==> Stat11: not({ i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) ¥Ra_MINUS ((arb(x0))~[j])) ¥Ra_GT eps } incs Za)
	m0-->Stat11(Stat11*) ==> Stat12: (m0 in Za) & Stat13: (m0 notin { i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) ¥Ra_MINUS ((arb(x0))~[j])) ¥Ra_GT eps })
--
-- The distance between two components, beyond $m0$, is therefore smaller than $eps0$;
-- because $eps$ is smaller than $eps0$.
-- This leads to a contradiction: indeed, if we take $y0 = ((arb(x0))~[m0])$ then
-- $y0$ contradicts Stat14 This proves the desired conclusion.
--
	Loc_def ==> Stat15: y0 = ((arb(x0))~[m0])
	(arb(x0),m0)-->T540(Stat6,Stat12,Stat15*) ==> Stat16: y0 in Ra
	y0-->Stat1(Stat16*) ==> (not Finite({m in Za | Ra_ABS(((arb(x0))~[m]) ¥Ra_MINUS y0) ¥Ra_GE eps0}) )
	m0-->T210(Stat12,Stat12*) ==> next(m0) in Za
	(next(m0),{m in Za | Ra_ABS(((arb(x0))~[m]) ¥Ra_MINUS y0) ¥Ra_GE eps0})-->T189(Stat16*) ==> Stat17: (not(next(m0) incs {m in Za | Ra_ABS(((arb(x0))~[m]) ¥Ra_MINUS y0) ¥Ra_GE eps0}))
	m1-->Stat17(Stat17*) ==> Stat18: (m1 in {m in Za | Ra_ABS(((arb(x0))~[m]) ¥Ra_MINUS y0) ¥Ra_GE eps0}) &
		(m1 notin next(m0))
	()-->Stat18(Stat18*) ==> Stat19: (m1 in Za) & (Ra_ABS(((arb(x0))~[m1]) ¥Ra_MINUS y0) ¥Ra_GE eps0)
	Use_def(next)(Stat18,Stat18*) ==> m1 notin (m0 + {m0})
	(m0,m1)-->T31(Stat12*) ==> m0 in m1
	(m1,m0)-->T13(Stat19*) ==> Stat20: m0 ¥incin m1
	(m1,m0)-->Stat13(Stat12,Stat19,Stat20*) ==> (not(Ra_ABS(((arb(x0))~[m1]) ¥Ra_MINUS ((arb(x0))~[m0])) ¥Ra_GT eps))
	EQUAL(Stat15) ==> Stat21: (not(Ra_ABS(((arb(x0))~[m1]) ¥Ra_MINUS y0) ¥Ra_GT eps))
	(arb(x0),m1)-->T540(Stat6,Stat19*) ==> ((arb(x0))~[m1]) in Ra
	((arb(x0))~[m1],y0)-->T454(Stat16*) ==> Stat22: (((arb(x0))~[m1]) ¥Ra_MINUS y0) in Ra
	(((arb(x0))~[m1]) ¥Ra_MINUS y0)-->T527(Stat22*) ==> Stat23: Ra_ABS(((arb(x0))~[m1]) ¥Ra_MINUS y0) in Ra
	(Ra_ABS(((arb(x0))~[m1]) ¥Ra_MINUS y0),eps)-->T478(Stat23,Stat3,Stat21*) ==> Stat24: eps ¥Ra_GE Ra_ABS(((arb(x0))~[m1]) ¥Ra_MINUS y0)
	(eps0,eps,Ra_ABS(((arb(x0))~[m1]) ¥Ra_MINUS y0))-->T497(Stat3,Stat1,Stat23,Stat24*) ==> Stat25: eps0 ¥Ra_GT Ra_ABS(((arb(x0))~[m1]) ¥Ra_MINUS y0)
	(eps0,Ra_ABS(((arb(x0))~[m1]) ¥Ra_MINUS y0),eps0)-->T497(Stat1,Stat23,Stat19,Stat25*) ==> Stat26: eps0 ¥Ra_GT eps0
(eps0,eps0)-->T473(Stat26*) ==> false; Discharge ==> QED
--
--Theorem OM: [The images of rationals via the embedding form a dense subset of the reals, 2] ((X in Re) & (Eps in Re) & (Eps ¥R_GT R_0)) ¥imp (EXISTS y in Ra | Eps ¥R_GT abs(X ¥R_MINUS ReRa(y))). Proof:
--Suppose_not(x0,eps) ==> Stat1: (not (EXISTS y in Ra | eps ¥R_GT abs(x0 ¥R_MINUS ReRa(y)))) & (x0 in Re) & (eps in Re) & (eps ¥R_GT R_0)
--Tsomehow ==> false; Discharge ==> QED
--
-- There is also an elementary 'natural' embedding of signed integers into rationals
-- which preserves all operations other than division.
--
Def 70: [Embedding of signed integers into rationals] RaSi(X) := Fr_to_Ra([X,[1,0]])
--
Theorem 743: [The embedding of signed integers into rationals preserves all elementary algebraic operations, 1]  (X in Si) ¥imp ((RaSi(X) in Ra) &
	(Ra_is_nonneg(RaSi(X)) ¥eq is_nonneg(X)) & (RaSi(S_Rev(X)) = Ra_Rev(RaSi(X))) & (RaSi(S_ABS(X)) = Ra_ABS(RaSi(X)))). Proof:
Suppose_not(x0) ==> AUTO
	Use_def(RaSi(x0)) ==> AUTO
	T368(*) ==> Stat1: ([1,0] in Si) & ([1,0] /= [0,0]) & ((Ra_is_nonneg(RaSi(x0)) ¥neq is_nonneg(x0)) or (RaSi(x0) notin Ra) or (RaSi(S_Rev(x0)) /= Ra_Rev(RaSi(x0))) or (RaSi(S_ABS(x0)) /= Ra_ABS(RaSi(x0))))
	Suppose ==> RaSi(x0) notin Ra
		EQUAL ==> Stat2: Fr_to_Ra([x0,[1,0]]) notin Ra
		([x0,[1,0]])-->T421(Stat2*) ==> Stat3: [x0,[1,0]] notin Fr
	(x0,[1,0])-->T432(*) ==> false; Discharge ==> RaSi(x0) in Ra
	Suppose ==> Fr_to_Ra([S_Rev(x0),[1,0]]) /= Ra_Rev(Fr_to_Ra([x0,[1,0]]))
	(x0,[1,0])-->T484(*) ==> false; Discharge ==> Stat4: Fr_to_Ra([S_Rev(x0),[1,0]]) = Ra_Rev(Fr_to_Ra([x0,[1,0]]))
	Use_def(RaSi(S_Rev(x0))) ==> AUTO
	EQUAL ==> RaSi(S_Rev(x0)) = Ra_Rev(RaSi(x0))
	(x0,[1,0])-->T459(*) ==> Ra_is_nonneg(Fr_to_Ra([x0,[1,0]])) ¥eq is_nonneg(x0 ¥S_TIMES [1,0])
	x0-->T402(*) ==> (x0 ¥S_TIMES [1,0]) = x0
	EQUAL ==> Ra_is_nonneg(RaSi(x0)) ¥eq is_nonneg(x0)
	(Stat1*)ELEM ==> RaSi(S_ABS(x0)) /= Ra_ABS(RaSi(x0))
	Use_def(RaSi(S_ABS(x0))) ==> AUTO
	EQUAL ==> Stat5: Fr_to_Ra([S_ABS(x0),[1,0]]) /= Ra_ABS(Fr_to_Ra([x0,[1,0]]))
	Use_def(S_ABS)(Stat5*) ==> Fr_to_Ra([[car(x0)+cdr(x0),0],[1,0]]) /= Ra_ABS(Fr_to_Ra([x0,[1,0]]))
	T525(Stat6*) ==> Stat6: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
	(Fr_to_Ra([x0,[1,0]]))-->Stat6(Stat6*) ==> Ra_ABS(Fr_to_Ra([x0,[1,0]])) = if Ra_is_nonneg(Fr_to_Ra([x0,[1,0]])) then Fr_to_Ra([x0,[1,0]]) else Ra_Rev(Fr_to_Ra([x0,[1,0]])) end if
	EQUAL(Stat4) ==> Stat7: Fr_to_Ra([[car(x0)+cdr(x0),0],[1,0]]) /= if is_nonneg(x0) then Fr_to_Ra([x0,[1,0]]) else Ra_Rev(Fr_to_Ra([x0,[1,0]])) end if
	Use_def(is_nonneg(x0)) ==> AUTO
	Use_def(S_Rev(x0)) ==> AUTO
	EQUAL(Stat4) ==> Stat8: Fr_to_Ra([[car(x0)+cdr(x0),0],[1,0]]) /= if (car(x0) incs cdr(x0)) then Fr_to_Ra([x0,[1,0]]) else Fr_to_Ra([[cdr(x0),car(x0)],[1,0]]) end if
	x0-->T369(*) ==> x0 = [car(x0),cdr(x0)]
	x0-->T369(*) ==> Stat9: (car(x0) = 0) or (cdr(x0) = 0)
	Suppose ==> Stat10: cdr(x0) = 0
		(Stat10*)ELEM ==> (car(x0) + cdr(x0)) = car(x0)
		(Stat10*)ELEM ==> Stat11: car(x0) incs cdr(x0)
		EQUAL(Stat8) ==> Fr_to_Ra([x0,[1,0]]) /= if (car(x0) incs cdr(x0)) then Fr_to_Ra([x0,[1,0]]) else Fr_to_Ra([[cdr(x0),car(x0)],[1,0]]) end if
	(Stat11)ELEM ==> false; Discharge ==> Stat12: cdr(x0) /= 0
	(Stat9*)ELEM ==> car(x0) = 0
	(Stat9,Stat12*)ELEM ==> (car(x0) + cdr(x0)) = cdr(x0)
	(Stat9,Stat12*)ELEM ==> (not(car(x0) incs cdr(x0)))
EQUAL(Stat8) ==> false; Discharge ==> QED
--
Theorem 744: [The embedding of signed integers into rationals preserves all elementary algebraic operations, 2]  ((X in Si) & (Y in Si)) ¥imp ((RaSi(X) in Ra) & (RaSi(Y) in Ra) &
	(RaSi(X ¥S_PLUS Y) = RaSi(X) ¥Ra_PLUS RaSi(Y)) &
	(RaSi(X ¥S_TIMES Y) = RaSi(X) ¥Ra_TIMES RaSi(Y))). Proof:
Suppose_not(x0,y0) ==> AUTO
	x0-->T743(*) ==> Stat1: (RaSi(x0) in Ra) & (x0 in Si)
	y0-->T743(*) ==> Stat2: (RaSi(y0) in Ra) & (y0 in Si)
	ELEM ==> Stat3: (RaSi(x0 ¥S_PLUS y0) /= RaSi(x0) ¥Ra_PLUS RaSi(y0)) or (RaSi(x0 ¥S_TIMES y0) /= RaSi(x0) ¥Ra_TIMES RaSi(y0))
	T368(Stat4*) ==> Stat4: ([1,0] in Si) & ([1,0] /= [0,0])
	Use_def(RaSi)(Stat1*) ==> Stat5: (Fr_to_Ra([x0,[1,0]]) in Ra) & (Fr_to_Ra([y0,[1,0]]) in Ra)
	(x0,[1,0])-->T432(Stat1,Stat4*) ==> Stat6: [x0,[1,0]] in Fr
	T418(Stat7*) ==> Stat7: (FORALL x in Fr,y in Fr | (Same_frac(x,y) ¥eq Same_frac(y,x)) & Same_frac(x,x))
	(Fr_to_Ra([x0,[1,0]]))-->T423(Stat4*) ==> Stat8: arb(Fr_to_Ra([x0,[1,0]])) in Fr
	(arb(Fr_to_Ra([x0,[1,0]])))-->T431(Stat8*) ==> Stat9: (car(arb(Fr_to_Ra([x0,[1,0]]))) in Si) & (cdr(arb(Fr_to_Ra([x0,[1,0]]))) in Si)
	Suppose ==> Stat10: RaSi(x0 ¥S_PLUS y0) /= (RaSi(x0) ¥Ra_PLUS RaSi(y0))
		Use_def(RaSi)(Stat10*) ==> Fr_to_Ra([x0 ¥S_PLUS y0,[1,0]]) /= (Fr_to_Ra([x0,[1,0]]) ¥Ra_PLUS Fr_to_Ra([y0,[1,0]]))
		(Fr_to_Ra([x0,[1,0]]),y0,[1,0])-->T438(Stat2*) ==> Stat11: Fr_to_Ra([x0 ¥S_PLUS y0,[1,0]]) /=
			Fr_to_Ra([(car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES [1,0]) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0),(cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES [1,0])])
		(car(arb(Fr_to_Ra([x0,[1,0]]))))-->T402(Stat8*) ==> (car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES [1,0]) = car(arb(Fr_to_Ra([x0,[1,0]])))
		(cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T402(Stat8*) ==> (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES [1,0]) = cdr(arb(Fr_to_Ra([x0,[1,0]])))
		EQUAL(Stat10) ==> Fr_to_Ra([x0 ¥S_PLUS y0,[1,0]]) /=
			Fr_to_Ra([car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))])
		(cdr(arb(Fr_to_Ra([x0,[1,0]]))),y0)-->T371(Stat2*) ==> Stat12: (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0) in Si
		(car(arb(Fr_to_Ra([x0,[1,0]]))),cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0)-->T371(Stat8*) ==> (car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0)) in Si
		(Fr_to_Ra([x0,[1,0]]))-->T423(Stat5,Stat5*) ==> Stat13: arb(Fr_to_Ra([x0,[1,0]])) in Fr
		(arb(Fr_to_Ra([x0,[1,0]])))-->T431(Stat13*) ==> cdr(arb(Fr_to_Ra([x0,[1,0]]))) /= [0,0]
		(car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T432(Stat8*) ==> [car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))] in Fr
		(x0,y0)-->T371(Stat1,Stat2*) ==> Stat14: (x0 ¥S_PLUS y0) in Si
		(x0 ¥S_PLUS y0,[1,0])-->T432(Stat14,Stat4*) ==> [x0 ¥S_PLUS y0,[1,0]] in Fr
		([car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))],[x0 ¥S_PLUS y0,[1,0]])-->T422(Stat11*) ==>
			(not(Same_frac([car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))],[x0 ¥S_PLUS y0,[1,0]])))
--
-- We have just restated the inequality assumed temporarily as inequivalence between two fractions.
-- However, Theorem 421 gives us the equivalence between the fractions $[x0,[1,0]]$ and $arb(Fr_to_Ra([x0,[1,0]]))$,
-- whence a contradiction easily follows by a merely algebraic argument.
--
		([x0,[1,0]])-->T421(Stat6,Stat6*) ==> Same_frac([x0,[1,0]],arb(Fr_to_Ra([x0,[1,0]])))
		([x0,[1,0]],arb(Fr_to_Ra([x0,[1,0]])))-->Stat7(Stat6*) ==> Stat15: Same_frac(arb(Fr_to_Ra([x0,[1,0]])),[x0,[1,0]])
		Use_def(Same_frac)(Stat15*) ==> ((car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES cdr([x0,[1,0]])) = (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES car([x0,[1,0]]))) &
			((car([car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))]) ¥S_TIMES cdr([x0 ¥S_PLUS y0,[1,0]])) /= (cdr([car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))]) ¥S_TIMES car([x0 ¥S_PLUS y0,[1,0]])))
		(x0,[1,0])-->T9(Stat15*) ==> (car([x0,[1,0]]) = x0) & (cdr([x0,[1,0]]) = [1,0])
		EQUAL(Stat8) ==> car(arb(Fr_to_Ra([x0,[1,0]]))) = (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES x0)
		(car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T9(Stat16*) ==> Stat16: (car([car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))]) = car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0)) & (cdr([car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))]) = cdr(arb(Fr_to_Ra([x0,[1,0]]))))
		(x0 ¥S_PLUS y0,[1,0])-->T9(Stat17*) ==> Stat17: (car([x0 ¥S_PLUS y0,[1,0]]) = (x0 ¥S_PLUS y0)) & (cdr([x0 ¥S_PLUS y0,[1,0]]) = [1,0])
		(car(arb(Fr_to_Ra([x0,[1,0]]))),cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0)-->T371(Stat12,Stat9*) ==> (car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0)) in Si
		(car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0))-->T402(Stat17*) ==> ((car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0)) ¥S_TIMES [1,0]) = (car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0))
		EQUAL(Stat15) ==> Stat18: ((cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES x0) ¥S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0)) /= (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES (x0 ¥S_PLUS y0))
	(y0,cdr(arb(Fr_to_Ra([x0,[1,0]]))),x0)-->T386(Stat1,Stat2,Stat9,Stat18*) ==> false; Discharge ==> RaSi(x0 ¥S_PLUS y0) = (RaSi(x0) ¥Ra_PLUS RaSi(y0))
	(Stat3*)ELEM ==> Stat19: RaSi(x0 ¥S_TIMES y0) /= (RaSi(x0) ¥Ra_TIMES RaSi(y0))
	Use_def(RaSi)(Stat19*) ==> Fr_to_Ra([x0 ¥S_TIMES y0,[1,0]]) /= (Fr_to_Ra([x0,[1,0]]) ¥Ra_TIMES Fr_to_Ra([y0,[1,0]]))
	(Fr_to_Ra([x0,[1,0]]),y0,[1,0])-->T439(Stat2*) ==> Stat20: Fr_to_Ra([x0 ¥S_TIMES y0,[1,0]]) /=
		Fr_to_Ra([car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES [1,0]])
	(cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T402(Stat9,Stat9*) ==> (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES [1,0]) = cdr(arb(Fr_to_Ra([x0,[1,0]])))
	EQUAL(Stat20) ==> Stat21: Fr_to_Ra([x0 ¥S_TIMES y0,[1,0]]) /=
		Fr_to_Ra([car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))])
	([x0,[1,0]])-->T421(Stat6,Stat6*) ==> Stat22: Same_frac([x0,[1,0]],arb(Fr_to_Ra([x0,[1,0]])))
	(y0,[1,0])-->T432(Stat2,Stat4*) ==> Stat23: [y0,[1,0]] in Fr
	([y0,[1,0]],[y0,[1,0]])-->Stat7(Stat7*) ==> Stat24: Same_frac([y0,[1,0]],[y0,[1,0]])
	([x0,[1,0]],arb(Fr_to_Ra([x0,[1,0]])),[y0,[1,0]],[y0,[1,0]])-->T436(Stat6,Stat23,Stat8,Stat22,Stat24*) ==> Same_frac([car([x0,[1,0]]) ¥S_TIMES car([y0,[1,0]]),cdr([x0,[1,0]]) ¥S_TIMES cdr([y0,[1,0]])],[car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES car([y0,[1,0]]),cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES cdr([y0,[1,0]])])
	(x0,[1,0])-->T9(Stat25*) ==> Stat25: (car([x0,[1,0]]) = x0) & (cdr([x0,[1,0]]) = [1,0])
	(y0,[1,0])-->T9(Stat26*) ==> Stat26: (car([y0,[1,0]]) = y0) & (cdr([y0,[1,0]]) = [1,0])
	(cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T402(Stat9,Stat9*) ==> (cdr(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES [1,0]) = cdr(arb(Fr_to_Ra([x0,[1,0]])))
	([1,0])-->T402(Stat4,Stat4*) ==> ([1,0] ¥S_TIMES [1,0]) = [1,0]
	EQUAL(Stat24) ==> Same_frac([x0 ¥S_TIMES y0,[1,0]],[car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))])
	(x0,y0)-->T371(Stat1,Stat2*) ==> Stat27: (x0 ¥S_TIMES y0) in Si
	(x0 ¥S_TIMES y0,[1,0])-->T432(Stat27,Stat4*) ==> Stat28: [x0 ¥S_TIMES y0,[1,0]] in Fr
	(car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T10(Stat29*) ==> Stat29: [car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))] = [car([car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))]),cdr([car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))])]
	(Fr_to_Ra([x0,[1,0]]))-->T423(Stat5,Stat5*) ==> Stat30: arb(Fr_to_Ra([x0,[1,0]])) in Fr
	(arb(Fr_to_Ra([x0,[1,0]])))-->T431(Stat30*) ==> Stat31: (car(arb(Fr_to_Ra([x0,[1,0]]))) in Si) & (cdr(arb(Fr_to_Ra([x0,[1,0]]))) in Si)
	(car(arb(Fr_to_Ra([x0,[1,0]]))),y0)-->T371(Stat31,Stat2*) ==> Stat32: (car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0) in Si
	(Fr_to_Ra([x0,[1,0]]))-->T423(Stat5,Stat5*) ==> Stat33: arb(Fr_to_Ra([x0,[1,0]])) in Fr
	(arb(Fr_to_Ra([x0,[1,0]])))-->T431(Stat33*) ==> Stat34: cdr(arb(Fr_to_Ra([x0,[1,0]]))) /= [0,0]
	(car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T432(Stat31,Stat32,Stat34*) ==> [car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))] in Fr
([x0 ¥S_TIMES y0,[1,0]],[car(arb(Fr_to_Ra([x0,[1,0]]))) ¥S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))])-->T422(Stat21*) ==> false; Discharge ==> QED
--
Theorem 745: [The embedding of signed integers into rationals preserves all elementary algebraic operations, 3]  ((X in Si) & (Y in Si)) ¥imp
	(RaSi(X ¥S_MINUS Y) = RaSi(X) ¥Ra_MINUS RaSi(Y)). Proof:
Suppose_not(x0,y0) ==> AUTO
	y0-->T743(*) ==> (RaSi(y0) in Ra) & (RaSi(S_Rev(y0)) = Ra_Rev(RaSi(y0)))
	(x0,y0)-->T398(*) ==> (x0 ¥S_MINUS y0) = (x0 ¥S_PLUS S_Rev(y0))
	y0-->T391(*) ==> S_Rev(y0) in Si
	(x0,S_Rev(y0))-->T744(*) ==> RaSi(x0 ¥S_PLUS S_Rev(y0)) = (RaSi(x0) ¥Ra_PLUS RaSi(S_Rev(y0)))
	EQUAL ==> RaSi(x0 ¥S_MINUS y0) = (RaSi(x0) ¥Ra_PLUS Ra_Rev(RaSi(y0)))
--?	Use_def(¥Ra_MINUS)(*) ==> (RaSi(X) ¥Ra_MINUS RaSi(Y)) = (RaSi(x0) ¥Ra_PLUS Ra_Rev(RaSi(y0)))
	Use_def(¥Ra_MINUS)(*) ==> (RaSi(x0) ¥Ra_MINUS RaSi(y0)) = (RaSi(x0) ¥Ra_PLUS Ra_Rev(RaSi(y0)))
EQUAL ==> false; Discharge ==> QED
--
Theorem 746: [The embedding of signed integers into rationals is 1-1]  ((X in Si) & (Y in Si)) ¥imp ((RaSi(X) = RaSi(Y)) ¥eq (X = Y)). Proof:
Suppose_not(x,y) ==> AUTO
	Suppose ==> x = y
	EQUAL ==> false; Discharge ==> Stat1: (x in Si) & (y in Si) & (x /= y) & (RaSi(x) = RaSi(y))
	Use_def(RaSi)(Stat1*) ==> Stat2: (x in Si) & (y in Si) & (Fr_to_Ra([x,[1,0]]) = Fr_to_Ra([y,[1,0]])) & (x /= y)
	T420(Stat2*) ==> Stat3: (FORALL u, v | ((u in Fr) & (v in Fr)) ¥imp ((Same_frac(u,v) ¥eq (Fr_to_Ra(u) = Fr_to_Ra(v)))))
	T211(Stat3*) ==> (1 in Za)
        1-->T367(Stat3*) ==> [1,0] in Si
	TELEM ==> [1,0] /= [0,0]
	Suppose ==> Stat4: [x,[1,0]] notin {[u,v]: u in Si, v in Si | v /= [0,0]}
	(x,[1,0])-->Stat4(Stat2*) ==> false; Discharge ==> [x,[1,0]] in {[u,v]: u in Si, v in Si | v /= [0,0]}
	Suppose ==> Stat5: [y,[1,0]] notin {[u,v]: u in Si, v in Si | v /= [0,0]}
	(y,[1,0])-->Stat5(Stat2*) ==> false; Discharge ==> [y,[1,0]] in {[u,v]: u in Si, v in Si | v /= [0,0]}
	Use_def(Fr)(Stat1*) ==> Fr = {[u,v]: u in Si, v in Si | v /= [0,0]}
	EQUAL(Stat1) ==> ([x,[1,0]] in Fr) & ([y,[1,0]] in Fr)
	([x,[1,0]],[y,[1,0]])-->Stat3(Stat2*) ==> Stat6: Same_frac([x,[1,0]],[y,[1,0]])
	Use_def(Same_frac)(Stat6*) ==> car([x,[1,0]]) ¥S_TIMES cdr([y,[1,0]]) = cdr([x,[1,0]]) ¥S_TIMES car([y,[1,0]])
	TELEM ==> car([x,[1,0]]) = x
	TELEM ==> cdr([x,[1,0]]) = [1,0]
	TELEM ==> car([y,[1,0]]) = y
	TELEM ==> cdr([y,[1,0]]) = [1,0]
	x-->T402(Stat2,Stat2*) ==> (x ¥S_TIMES [1,0]) = x
	y-->T401(Stat2,Stat2*) ==> ([1,0] ¥S_TIMES y) = y
EQUAL(Stat2) ==> false; Discharge ==> QED
--
Theorem 747: [The embedding of signed integers into rationals preserves 0 and 1]  RaSi([0,0]) = Ra_0 & RaSi([1,0]) = Ra_1. Proof:
Suppose_not ==> AUTO
	Use_def(RaSi)(*) ==> Stat1: not((Fr_to_Ra([[0,0],[1,0]]) = Ra_0) & (Fr_to_Ra([[1,0],[1,0]]) = Ra_1))
	Use_def(Ra_0)(Stat1*) ==> Stat2: Fr_to_Ra([[1,0],[1,0]]) /= Ra_1
Use_def(Ra_1)(Stat2*) ==> false; Discharge ==> QED
--
Theorem 748: [The embedding of signed integers into rationals preserves ordering]  ((X in Si) & (Y in Si)) ¥imp (((RaSi(X) ¥Ra_GE RaSi(Y)) ¥eq (X ¥S_GE Y)) &
			((RaSi(X) ¥Ra_GT RaSi(Y)) ¥eq (X ¥S_GT Y)) &
			((RaSi(Y) ¥Ra_LE RaSi(X)) ¥eq (Y ¥S_LE X)) &
			((RaSi(Y) ¥Ra_LT RaSi(X)) ¥eq (Y ¥S_LT X))). Proof:
Suppose_not(x0,y0) ==> AUTO
	(x0,y0)-->T428(*) ==> Stat1: ((x0 ¥S_GE y0) ¥eq is_nonneg(x0 ¥S_PLUS S_Rev(y0))) &
		((x0 ¥S_GT y0) ¥eq ((x0 ¥S_GE y0) & (x0 /= y0))) & (x0 in Si) & (y0 in Si)
	(x0,y0)-->T744(*) ==> (RaSi(x0) in Ra) & (RaSi(y0) in Ra)
	(RaSi(x0),RaSi(y0))-->T473(Stat1*) ==> ((RaSi(x0) ¥Ra_GE RaSi(y0)) ¥eq Ra_is_nonneg(RaSi(x0) ¥Ra_PLUS Ra_Rev(RaSi(y0)))) &
		((RaSi(x0) ¥Ra_GT RaSi(y0)) ¥eq ((RaSi(x0) ¥Ra_GE RaSi(y0)) & (RaSi(x0) /= RaSi(y0))))
	Suppose ==> not((RaSi(x0) ¥Ra_GE RaSi(y0)) ¥eq (x0 ¥S_GE y0))
		(Stat1*)ELEM ==> not(Ra_is_nonneg(RaSi(x0) ¥Ra_PLUS Ra_Rev(RaSi(y0))) ¥eq is_nonneg(x0 ¥S_PLUS S_Rev(y0)))
		y0-->T743(Stat1,Stat1*) ==> RaSi(S_Rev(y0)) = Ra_Rev(RaSi(y0))
		(y0,y0)-->T372(Stat1,Stat1*) ==> Stat2: S_Rev(y0) in Si
		(x0,S_Rev(y0))-->T744(Stat1,Stat2*) ==> RaSi(x0 ¥S_PLUS S_Rev(y0)) = (RaSi(x0) ¥Ra_PLUS RaSi(S_Rev(y0)))
		EQUAL(Stat1) ==> Stat3: not(Ra_is_nonneg(RaSi(x0 ¥S_PLUS S_Rev(y0))) ¥eq is_nonneg(x0 ¥S_PLUS S_Rev(y0)))
		(x0,S_Rev(y0))-->T371(Stat1,Stat2*) ==> (x0 ¥S_PLUS S_Rev(y0)) in Si
	(x0 ¥S_PLUS S_Rev(y0))-->T743(Stat3*) ==> false; Discharge ==> Stat4: (RaSi(x0) ¥Ra_GE RaSi(y0)) ¥eq (x0 ¥S_GE y0)
	(x0,y0)-->T746(Stat1,Stat1*) ==> (x0 = y0) ¥eq (RaSi(x0) = RaSi(y0))
	(Stat1*)ELEM ==> ((RaSi(x0) ¥Ra_GT RaSi(y0)) ¥eq (x0 ¥S_GT y0)) & (x0 in Si) & (y0 in Si)
	(y0,x0)-->T428(Stat1*) ==> ((y0 ¥S_LE x0) ¥eq (x0 ¥S_GE y0)) &
		((y0 ¥S_LT x0) ¥eq (x0 ¥S_GT y0))
	(RaSi(y0),RaSi(x0))-->T473(Stat1*) ==> ((RaSi(y0) ¥Ra_LE RaSi(x0)) ¥eq (RaSi(x0) ¥Ra_GE RaSi(y0))) &
		((RaSi(y0) ¥Ra_LT RaSi(x0)) ¥eq (RaSi(x0) ¥Ra_GT RaSi(y0)))
ELEM ==> false; Discharge ==> QED
--
-- Finally the 'natural' embedding of integers into signed integers
-- preserves all operations other than division and subtraction.
--
Def 71: [Embedding of integers into signed integers] SiZa(X) := [X,0]
--
Theorem 749: [The embedding of integers into signed integers preserves all elementary algebraic operations on integers]  ((X in Za) & (Y in Za)) ¥imp ((SiZa(X) in Si) & (SiZa(Y) in Si) &
	(SiZa(X ¥PLUS Y) = SiZa(X) ¥S_PLUS SiZa(Y)) &
	(SiZa(X ¥TIMES Y) = SiZa(X) ¥S_TIMES SiZa(Y))). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(SiZa)(*) ==> Stat1: (x in Za) & (y in Za) & (not(([x,0] in Si) & ([y,0] in Si) &
		([x ¥PLUS y,0] = ([x,0] ¥S_PLUS [y,0])) &
		([x ¥TIMES y,0] = ([x,0] ¥S_TIMES [y,0]))))
	x-->T367(Stat1*) ==> [x,0] in Si
	y-->T367(Stat1*) ==> ([x ¥PLUS y,0] /= ([x,0] ¥S_PLUS [y,0])) or ([x ¥TIMES y,0] /= ([x,0] ¥S_TIMES [y,0]))
(x,y)-->T388(Stat1*) ==> false; Discharge ==> QED
--
Theorem 750: [The embedding of integers into signed integers is 1-1]  ((X in Za) & (Y in Za) & (SiZa(X) = SiZa(Y))) ¥imp (X = Y). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(SiZa)(*) ==> Stat1: ([x,0] = [y,0]) & (x /= y)
(Stat1*)Discharge ==> QED
--
Theorem 751: [The embedding of integers into signed integers preserves 0 and 1]  (SiZa(0) = [0,0]) & (SiZa(1) = [1,0]). Proof:
Suppose_not ==> AUTO
Use_def(SiZa)(*) ==> false; Discharge ==> QED
--
Theorem 752: [The embedding of integers into signed integers preserves ordering]  ((X in Za) & (Y in Za)) ¥imp (((SiZa(X) ¥S_GE SiZa(Y)) ¥eq (X incs Y)) &
			((SiZa(X) ¥S_GT SiZa(Y)) ¥eq (Y in X)) &
			((SiZa(Y) ¥S_LE SiZa(X)) ¥eq (Y ¥incin X)) &
			((SiZa(Y) ¥S_LT SiZa(X)) ¥eq (Y in X))). Proof+:
Suppose_not(x,y) ==> AUTO
	T427(*) ==> Stat1: (FORALL x, y | (S_GE(x,y) ¥eq is_nonneg(x ¥S_PLUS S_Rev(y))) &
		(S_LE(x,y) ¥eq S_GE(y,x)) & (S_GT(x,y) ¥eq (S_GE(x,y) & (x /= y))) & (S_LT(x,y) ¥eq S_GT(y,x)))
	(SiZa(x),SiZa(y))-->Stat1(*) ==> (S_GE(SiZa(x),SiZa(y)) ¥eq is_nonneg(SiZa(x) ¥S_PLUS S_Rev(SiZa(y)))) &
		(S_LE(SiZa(x),SiZa(y)) ¥eq S_GE(SiZa(y),SiZa(x))) & (S_GT(SiZa(x),SiZa(y)) ¥eq (S_GE(SiZa(x),SiZa(y)) & (SiZa(x) /= SiZa(y)))) & (S_LT(SiZa(x),SiZa(y)) ¥eq S_GT(SiZa(y),SiZa(x)))
	(SiZa(y),SiZa(x))-->Stat1(*) ==>
		(S_LE(SiZa(y),SiZa(x)) ¥eq S_GE(SiZa(x),SiZa(y))) & (S_GT(SiZa(y),SiZa(x)) ¥eq (S_GE(SiZa(y),SiZa(x)) & (SiZa(y) /= SiZa(x)))) & (S_LT(SiZa(y),SiZa(x)) ¥eq S_GT(SiZa(x),SiZa(y)))
	Suppose ==> (SiZa(x) ¥S_GE SiZa(y)) ¥neq (x incs y)
		Use_def(¥S_GE)(*) ==> Stat2: is_nonneg(SiZa(x) ¥S_PLUS S_Rev(SiZa(y))) ¥neq (x incs y)
		Use_def(SiZa)(Stat2*) ==> is_nonneg([x,0] ¥S_PLUS S_Rev([y,0])) ¥neq (x incs y)
		Use_def(S_Rev)(Stat2*) ==> is_nonneg([x,0] ¥S_PLUS [cdr([y,0]),car([y,0])]) ¥neq (x incs y)
		TELEM ==> car([y,0]) = y
		TELEM ==> cdr([y,0]) = 0
		EQUAL(Stat2) ==> Stat3: is_nonneg([x,0] ¥S_PLUS [0,y]) ¥neq (x incs y)
		Use_def(¥S_PLUS)(Stat3*) ==> is_nonneg(Red([car([x,0]) ¥PLUS car([0,y]),cdr([x,0]) ¥PLUS cdr([0,y])])) ¥neq (x incs y)
		TELEM ==> car([x,0]) = x
		TELEM ==> car([0,y]) = 0
		TELEM ==> cdr([x,0]) = 0
		TELEM ==> cdr([0,y]) = y
		ELEM ==> Stat4: (x in Za) & (y in Za)
		ALGEBRA(Stat4) ==> ((x ¥PLUS 0) = x) & ((0 ¥PLUS y) = y)
		EQUAL(Stat3) ==> Stat5: is_nonneg(Red([x,y])) ¥neq (x incs y)
		Use_def(Red)(Stat5*) ==> is_nonneg([car([x,y]) ¥MINUS (car([x,y]) * cdr([x,y])),cdr([x,y]) ¥MINUS (car([x,y]) * cdr([x,y]))]) ¥neq (x incs y)
		TELEM ==> car([x,y]) = x
		TELEM ==> cdr([x,y]) = y
		EQUAL(Stat5) ==> Stat6: is_nonneg([x ¥MINUS (x * y),y ¥MINUS (x * y)]) ¥neq (x incs y)
		Use_def(is_nonneg)(Stat6*) ==> (car([x ¥MINUS (x * y),y ¥MINUS (x * y)]) incs cdr([x ¥MINUS (x * y),y ¥MINUS (x * y)])) ¥neq (x incs y)
		(x ¥MINUS (x * y),y ¥MINUS (x * y))-->T9(*) ==> (car([x ¥MINUS (x * y),y ¥MINUS (x * y)]) = x ¥MINUS (x * y)) &
				(cdr([x ¥MINUS (x * y),y ¥MINUS (x * y)]) = y ¥MINUS (x * y))
		EQUAL(Stat6) ==> ((x ¥MINUS (x * y)) incs (y ¥MINUS (x * y))) ¥neq (x incs y)
		(x,y)-->T375(*) ==> Stat7: ((x * y) in Za) & ((x ¥MINUS (x * y)) in Za) & ((y ¥MINUS (x * y)) in Za)
		(x,x*y)-->T325(*) ==> x = ((x*y) ¥PLUS (x ¥MINUS (x*y)))
		(y,x*y)-->T325(*) ==> y = ((x*y) ¥PLUS (y ¥MINUS (x*y)))
		ALGEBRA(Stat4,Stat7) ==> (((x*y) ¥PLUS (x ¥MINUS (x*y))) = ((x ¥MINUS (x*y)) ¥PLUS (x*y))) &
				(((x*y) ¥PLUS (y ¥MINUS (x*y))) = ((y ¥MINUS (x*y)) ¥PLUS (x*y)))
	(y ¥MINUS (x*y),x ¥MINUS (x*y),x*y)-->T296(Stat6*) ==> false; Discharge ==> (SiZa(x) ¥S_GE SiZa(y)) ¥eq (x incs y)
	Suppose ==> (SiZa(x) ¥S_GT SiZa(y)) ¥neq (y in x)
		Use_def(¥S_GT)(*) ==> (S_GE(SiZa(x),SiZa(y)) & (SiZa(x) /= SiZa(y))) ¥neq (y in x)
		Suppose ==> (SiZa(x) /= SiZa(y)) ¥neq (x /= y)
			(x,y)-->T750(*) ==> (SiZa(x) /= SiZa(y)) & (x = y)
		EQUAL ==> false; Discharge ==> (SiZa(x) /= SiZa(y)) ¥eq (x /= y)
		EQUAL ==> (S_GE(SiZa(x),SiZa(y)) & (x /= y)) ¥neq (y in x)
		Use_def(¥S_GE)(*) ==> ((x incs y) & (x /= y)) ¥neq (y in x)
	(x,y)-->T34(*) ==> false; Discharge ==> (SiZa(x) ¥S_GT SiZa(y)) ¥eq (y in x)
	Suppose ==> (SiZa(y) ¥S_LE SiZa(x)) ¥neq (y ¥incin x)
		Use_def(¥S_LE)(*) ==> S_GE(SiZa(x),SiZa(y)) ¥neq (y ¥incin x)
	Use_def(¥S_GE)(*) ==> false; Discharge ==> (SiZa(y) ¥S_LT SiZa(x)) ¥neq (y in x)
	Use_def(¥S_LT)(*) ==> S_GT(SiZa(x),SiZa(y)) ¥neq (y in x)
Use_def(¥S_GT)(*) ==> false; Discharge ==> QED
--
-- The definitions for rational sequences and rational Cauchy sequences given previously
-- extend readily to the real case.
--
Def 72: [The set of real sequences] ReSeq := {f: f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)}
--
Def 73: [Real Cauchy sequences] ReCauchy := {f: f in ReSeq | (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({i * j : i in Za, j in Za | abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps}))}
--
-- The definitions for pointwise sequence sums given for rational sequences extend with equal ease to the real case.
--
Def 74: [Sum of real functions] Def(X ¥Res_PLUS Y) := {[car(p),cdr(p) ¥R_PLUS (Y~[car(p)])]: p in X}
Def 75: [Additive inverse of real function] Res_Rev(X) := {[car(p),R_Rev(cdr(p))]: p in X}
Def 76: [Absolute values of real function] Res_ABS(X) := {[car(p),abs(cdr(p))]: p in X}
Def 77: [Difference of real functions] Def(X ¥Res_MINUS Y) := X ¥Res_PLUS Res_Rev(Y)
Def 78: [Product of real functions] Def(X ¥Res_TIMES Y) := {[car(p),cdr(p) ¥R_TIMES (Y~[car(p)])]: p in X}
Def 78a: [Quotient of real functions] Def(X ¥Res_OVER Y) := {[car(p),cdr(p) ¥R_OVER (Y~[car(p)])]: p in X | Y~[car(p)] /= R_0}
--
-- Next we state and prove various elementary properties of the absolute values of real numbers,
-- deriving them from the corresponding properties of rationals and of rational sequences.
--
Theorem 753: [Elementary properties of the real absolute value]  ((X in Re) & (Y in Re)) ¥imp ((abs(X) in Re) & (abs(Y) in Re) &
			(abs(X ¥R_TIMES Y) = (abs(X) ¥R_TIMES abs(Y))) & ((abs(X) ¥R_PLUS abs(Y)) ¥R_GE abs(X ¥R_PLUS Y) & (abs(R_Rev(X)) = abs(X)))). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T726(*) ==> abs(x ¥R_TIMES y) = (abs(x) ¥R_TIMES abs(y))
	x-->T727(*) ==> abs(R_Rev(x)) = abs(x)
	x-->T723(*) ==> Stat1: abs(x) in Re
	y-->T723(*) ==> Stat2: abs(y) in Re
	(x,y)-->T731(*) ==> (((abs(x) ¥R_PLUS abs(y)) ¥R_GT abs(x ¥R_PLUS y)) or ((abs(x) ¥R_PLUS abs(y)) = abs(x ¥R_PLUS y)))
	ELEM ==> Stat3: (x in Re) & (y in Re)
	ALGEBRA(Stat3) ==> (x ¥R_PLUS y) in Re
	ALGEBRA(Stat1,Stat2) ==> Stat4: (abs(x) ¥R_PLUS abs(y)) in Re
	(x ¥R_PLUS y)-->T723(Stat3*) ==> abs(x ¥R_PLUS y) in Re
(abs(x) ¥R_PLUS abs(y),abs(x ¥R_PLUS y))-->T680(*) ==> false; Discharge ==> QED
--
-- It is obvious that every real Cauchy sequence is a real sequence
--
Theorem 754: [Every real Cauchy sequence is a real sequence] ReCauchy ¥incin ReSeq. Proof:
Suppose_not ==> Stat1: ReCauchy ¥nincin ReSeq
	g-->Stat1(Stat1*) ==> Stat2: (g in ReCauchy) & (g notin ReSeq)
	Use_def(ReCauchy) ==> Stat3: g in {f in ReSeq | (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({i * j : i in Za, j in Za | abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps}))}
()-->Stat3(Stat2*) ==> false; Discharge ==> QED
--
-- Moreover, the range of a real sequence is plainly included in the set of reals;
-- its domain is the set of integers, and each of its image elements is a real.
--
Theorem 755: [The range of a real sequence is included in the set of reals] (F in ReSeq) ¥imp ((domain(F) = Za) & Svm(F) & (range(F) ¥incin Re) & ((X in Za) ¥imp (F~[X] in Re))). Proof:
Suppose_not(f,x) ==> AUTO
	Use_def(ReSeq) ==> Stat1: f in {g ¥incin (Za ¥PROD Re) | (domain(g) = Za) & Svm(g)}
	()-->Stat1 ==> AUTO
	(f,Za,Re)-->T141 ==> AUTO
--
-- For, assuming $f,x$ to be a counterexample, we are led to a contradiction as follows.
-- From Theorem 141, we immediately get that the only conclusion of the theorem's assertion
-- which can be false is the implication $((x in Za) ¥imp (f~[x] in Re))$.
-- However, the only remaining possibility is discarded immediately thanks to Theorem 71.
--
(x,f)-->T71(*) ==> false; Discharge ==> QED
--
-- The following theorem about real Cauchy sequences is closely analogous
-- to Theorem 554 about rational Cauchy sequences.
--
Theorem 756: ({F,G} ¥incin ReSeq) ¥imp
	(((F ¥Res_PLUS G) in ReSeq) &
		(Res_ABS(G) in ReSeq) &
		(Res_Rev(G) in ReSeq) &
		((F ¥Res_TIMES G) in ReSeq) &
		((F ¥Res_PLUS G) = {[u,((F~[u]) ¥R_PLUS  (G~[u]))]: u in Za}) &
		(Res_ABS(G) = {[u,abs(G~[u])]: u in Za}) &
		(Res_Rev(G) = {[u,R_Rev(G~[u])]: u in Za}) &
		((F ¥Res_TIMES G) = {[u,((F~[u]) ¥R_TIMES (G~[u]))]: u in Za})). Proof:
Suppose_not(f0,g0) ==> AUTO
--
-- Reasoning by contradiction, assume that $f0,g0$ form a counterexample
-- to the desired statement.
--
	f0-->T755(*) ==> Stat1: (domain(f0) = Za) & Svm(f0) & (range(f0) ¥incin Re)
	g0-->T755(*) ==> Stat2: (domain(g0) = Za) & Svm(g0) & (range(g0) ¥incin Re)
	Use_def(¥Res_PLUS) ==> (f0 ¥Res_PLUS g0) = {[car(p),cdr(p) ¥R_PLUS (g0~[car(p)])]: p in f0}
	Use_def(Res_ABS) ==> Res_ABS(g0) = {[car(p),abs(cdr(p))]: p in g0}
	Use_def(Res_Rev) ==> Res_Rev(g0) = {[car(p),R_Rev(cdr(p))]: p in g0}
	Use_def(¥Res_TIMES) ==> (f0 ¥Res_TIMES g0) = {[car(p),cdr(p) ¥R_TIMES (g0~[car(p)])]: p in f0}
--
-- After unfolding the definitions which are directly involved,
-- we recall that $Re$ is closed under addition, multiplication, sign inversion,
-- and absolute value operation. This allows us to invoke the THEORY 'pointwise'
-- ('pointwiseU' in the monadic case) for each one of these four operations,
-- thereby leading to the desired contradiction.
--
	Suppose ==> Stat3: not(FORALL x in Re, y in Re | (x ¥R_PLUS y) in Re)
		(x1,y1)-->Stat3 ==> Stat4: (x1 in Re) & (y1 in Re) & ((x1 ¥R_PLUS y1) notin Re)
	ALGEBRA(Stat4) ==> (x1 ¥R_PLUS y1) in Re; Discharge ==> AUTO
	Suppose ==> Stat5: not(FORALL x in Re, y in Re | (x ¥R_TIMES y) in Re)
		(x2,y2)-->Stat5 ==> Stat6: (x2 in Re) & (y2 in Re) & ((x2 ¥R_TIMES y2) notin Re)
	ALGEBRA(Stat6) ==> (x2 ¥R_TIMES y2) in Re; Discharge ==> AUTO
	Suppose ==> Stat7: not(FORALL x in Re | abs(x) in Re)
		x3-->Stat7 ==> (x3 in Re) & (abs(x3) notin Re)
	x3-->T723 ==> false; Discharge ==> AUTO
	Suppose ==> Stat8: not(FORALL x in Re | R_Rev(x) in Re)
		x4-->Stat8 ==> Stat9: (x4 in Re) & (R_Rev(x4) notin Re)
	ALGEBRA(Stat9) ==> R_Rev(x4) in Re; Discharge ==> AUTO
	APPLY() pointwise(fq->f0,fp->g0,h->(f0 ¥Res_PLUS g0),d->Za,r->Re,bop(x,y)->(x ¥R_PLUS y)) ==>
	Stat10:	((f0 ¥Res_PLUS g0) = {[u,((f0~[u]) ¥R_PLUS (g0~[u]))]: u in Za}) &
		Svm(f0 ¥Res_PLUS g0) & (domain(f0 ¥Res_PLUS g0) = Za) & (range(f0 ¥Res_PLUS g0) ¥incin Re)
	APPLY() pointwise(fq->f0,fp->g0,h->(f0 ¥Res_TIMES g0),d->Za,r->Re,bop(x,y)->(x ¥R_TIMES y)) ==>
	Stat11:	((f0 ¥Res_TIMES g0) = {[u,((f0~[u]) ¥R_TIMES (g0~[u]))]: u in Za}) &
		Svm(f0 ¥Res_TIMES g0) & (domain(f0 ¥Res_TIMES g0) = Za) & (range(f0 ¥Res_TIMES g0) ¥incin Re)
	APPLY() pointwiseU(fp->g0,h->Res_ABS(g0),d->Za,r->Re,uop(x)->abs(x)) ==>
	Stat12:	(Res_ABS(g0) = {[u,abs(g0~[u])]: u in Za}) &
		Svm(Res_ABS(g0)) & (domain(Res_ABS(g0)) = Za) & (range(Res_ABS(g0)) ¥incin Re)
	APPLY() pointwiseU(fp->g0,h->Res_Rev(g0),d->Za,r->Re,uop(x)->R_Rev(x)) ==>
	Stat13:	(Res_Rev(g0) = {[u,R_Rev(g0~[u])]: u in Za}) &
		Svm(Res_Rev(g0)) & (domain(Res_Rev(g0)) = Za) & (range(Res_Rev(g0)) ¥incin Re)
	Use_def(ReSeq) ==> ((f0 ¥Res_PLUS g0) notin {f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)}) or
			((f0 ¥Res_TIMES g0) notin {f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)}) or
			(Res_ABS(g0) notin {f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)}) or
			(Res_Rev(g0) notin {f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)})
	Suppose ==> Stat14: Res_ABS(g0) notin {f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)}
		Use_def(Svm(Res_ABS(g0))) ==> AUTO
		(Res_ABS(g0),Za,Re)-->T141(Stat12*) ==> Res_ABS(g0) ¥incin (Za ¥PROD Re)
	()-->Stat14(Stat12*) ==> false; Discharge ==> ((f0 ¥Res_PLUS g0) notin {f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)}) or
			((f0 ¥Res_TIMES g0) notin {f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)}) or
			(Res_Rev(g0) notin {f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)})
	Suppose ==> Stat15: ((f0 ¥Res_TIMES g0) notin {f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)})
		Use_def(Svm(f0 ¥Res_TIMES g0)) ==> AUTO
		(f0 ¥Res_TIMES g0,Za,Re)-->T141(Stat11*) ==> (f0 ¥Res_TIMES g0) ¥incin (Za ¥PROD Re)
	()-->Stat15(Stat11*) ==> false; Discharge ==> ((f0 ¥Res_PLUS g0) notin {f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)}) or
			(Res_Rev(g0) notin {f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)})
	Suppose ==> Stat16: ((f0 ¥Res_PLUS g0) notin {f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)})
		Use_def(Svm(f0 ¥Res_PLUS g0)) ==> AUTO
		(f0 ¥Res_PLUS g0,Za,Re)-->T141(Stat10*) ==> (f0 ¥Res_PLUS g0) ¥incin (Za ¥PROD Re)
	()-->Stat16(Stat10*) ==> false; Discharge ==> Stat17: Res_Rev(g0) notin {f ¥incin (Za ¥PROD Re) | (domain(f) = Za) & Svm(f)}
	Use_def(Svm(Res_Rev(g0))) ==> AUTO
	(Res_Rev(g0),Za,Re)-->T141(Stat13*) ==> Res_Rev(g0) ¥incin (Za ¥PROD Re)
	()-->Stat17(Stat13*) ==> false; Discharge ==> QED
--
--
-- It will often be convenient to use the following simplified (and partly repeated) consequences of the preceding result.
--
Theorem 757: (({F1,G1} ¥incin ReSeq) & (N in Za)) ¥imp ((F1~[N] in Re) & (G1~[N] in Re) &
		((F1 ¥Res_PLUS G1 in ReSeq) & ((F1 ¥Res_PLUS G1)~[N] = (F1~[N]) ¥R_PLUS (G1~[N]))) &
		(((Res_ABS(G1) in ReSeq) & (Res_ABS(G1)~[N] = abs(G1~[N])))) &
		(((Res_Rev(G1) in ReSeq) & (Res_Rev(G1)~[N] = R_Rev(G1~[N])))) &
		(((F1 ¥Res_TIMES G1 in ReSeq) & (F1 ¥Res_TIMES G1)~[N] = ((F1~[N]) ¥R_TIMES (G1~[N]))))). Proof:
Suppose_not(f1,g1,n) ==> AUTO
	ELEM ==> Stat1: n in Za
	(f1,n)-->T755(*) ==> (f1~[n]) in Re
	(g1,n)-->T755(*) ==> (g1~[n]) in Re
	(f1,g1)-->T756(*) ==> ((f1 ¥Res_PLUS g1) in ReSeq) & (Res_ABS(g1) in ReSeq) &
		(Res_Rev(g1) in ReSeq) & ((f1 ¥Res_TIMES g1) in ReSeq) &
		 ((f1 ¥Res_PLUS g1) = {[n,((f1~[n]) ¥R_PLUS  (g1~[n]))]: n in Za}) &
		(Res_ABS(g1) = {[n,abs(g1~[n])]: n in Za}) &
		(Res_Rev(g1) = {[n,R_Rev(g1~[n])]: n in Za}) &
		((f1 ¥Res_TIMES g1) = {[n,((f1~[n]) ¥R_TIMES (g1~[n]))]: n in Za})
	APPLY() fcn_symbol(f(x)->((f1~[x]) ¥R_PLUS (g1~[x])),g->f1 ¥Res_PLUS g1,s->Za) ==> Stat2: (FORALL x | (x in Za) ¥imp (((f1 ¥Res_PLUS g1)~[x]) = ((f1~[x]) ¥R_PLUS (g1~[x]))))
	APPLY() fcn_symbol(f(x)->abs(g1~[x]),g->Res_ABS(g1),s->Za) ==> Stat3: (FORALL x | (x in Za) ¥imp ((Res_ABS(g1)~[x]) = abs(g1~[x])))
	APPLY() fcn_symbol(f(x)->R_Rev(g1~[x]),g->Res_Rev(g1),s->Za) ==> Stat4: (FORALL x | (x in Za) ¥imp ((Res_Rev(g1)~[x]) = R_Rev(g1~[x])))
	APPLY() fcn_symbol(f(x)->((f1~[x]) ¥R_TIMES (g1~[x])),g->f1 ¥Res_TIMES g1,s->Za) ==> Stat5: (FORALL x | (x in Za) ¥imp (((f1 ¥Res_TIMES g1)~[x]) = ((f1~[x]) ¥R_TIMES (g1~[x]))))
--
	n-->Stat2(Stat1,Stat1*) ==> ((f1 ¥Res_PLUS g1)~[n]) = ((f1~[n]) ¥R_PLUS (g1~[n]))
	n-->Stat3(Stat1,Stat1*) ==> (Res_ABS(g1)~[n]) = abs(g1~[n])
	n-->Stat4(Stat1,Stat1*) ==> (Res_Rev(g1)~[n]) = R_Rev(g1~[n])
	n-->Stat5(Stat1,Stat1*) ==> ((f1 ¥Res_TIMES g1)~[n]) = ((f1~[n]) ¥R_TIMES (g1~[n]))
	Discharge ==> QED
--
-- We prove next that the set of real Cauchy sequences is closed
-- under the pointwise algebraic operations introduced above.
--
Theorem 758: ({F,G} ¥incin ReCauchy) ¥imp
	(((F ¥Res_PLUS G) in ReCauchy) & (Res_ABS(F) in ReCauchy) & (Res_Rev(F) in ReCauchy)). Proof:
Suppose_not(fq,fp) ==> AUTO
--
-- For suppose that $fq,fp$ form a counterexample to our assertion.
--
	Use_def(ReCauchy) ==> Stat1: (fq in {f in ReSeq | (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({ i * j : i in Za, j in Za | abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps }))})
			& Stat2: (fp in {f in ReSeq | (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({ i * j : i in Za, j in Za | abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps }))})
	()-->Stat1(Stat1*) ==> Stat3: (fq in ReSeq) & Stat4: (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({ i * j : i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps }))
	()-->Stat2(Stat1*) ==> Stat5: (fp in ReSeq) & Stat6: (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({ i * j : i in Za, j in Za | abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps }))
	(fq,fp)-->T756(Stat1*) ==> Stat7: ((fq ¥Res_PLUS fp) in ReSeq)
	(fq,fq)-->T756(Stat1*) ==> Stat8: (Res_ABS(fq) in ReSeq) & (Res_Rev(fq) in ReSeq)
--
-- Using the definitions of the functions involved,
-- and since, by the preceding theorem, our pointwise operations of real
-- sequences produce real sequences, we can argue as follows:
--
	Suppose ==> (fq ¥Res_PLUS fp) notin ReCauchy
--
-- Assuming that $fq ¥Res_PLUS fp$ is not a Cauchy sequence (unlike
-- $fq$ and $fp$), there would exist a positive real $eps0$ for which
-- the set
--	${ i * j : i in Za, j in Za | abs(((fq ¥Res_PLUS fp)~[i]) ¥R_MINUS ((fq ¥Res_PLUS fp)~[j])) ¥R_GT eps0 }$
-- is infinite, unlike the analogous sets which have $fq$ and $fp$, respectively,
-- in place of $fq ¥Res_PLUS fp$, and positive rationals $eps1$ and $eps2$ smaller than
-- one half of $eps0$ in place of $eps0$.
--
            Use_def(ReCauchy) ==> Stat9: (fq ¥Res_PLUS fp) notin {f in ReSeq | (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({ i * j : i in Za, j in Za | abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps }))}
            ()-->Stat9 ==> Stat10: not(FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({ i * j : i in Za, j in Za | abs(((fq ¥Res_PLUS fp)~[i]) ¥R_MINUS ((fq ¥Res_PLUS fp)~[j])) ¥R_GT eps }))
            eps0-->Stat10(Stat10) ==> Stat11: (eps0 in Re) & (eps0 ¥R_GT R_0) & (not(
		Finite({ i * j : i in Za, j in Za | abs(((fq ¥Res_PLUS fp)~[i]) ¥R_MINUS ((fq ¥Res_PLUS fp)~[j])) ¥R_GT eps0 })))
            eps0-->T719 ==> Stat12: (EXISTS e in Re, e0 in Re | (eps0 ¥R_GT e) & (e ¥R_GT e0) & (e0 ¥R_GT R_0) & (e ¥R_GT R_0) & (eps0 ¥R_GT (e ¥R_PLUS e0)))
            (eps1,eps2)-->Stat12 ==> Stat13: (eps1 in Re) & (eps2 in Re) & (eps2 ¥R_GT R_0) & (eps1 ¥R_GT R_0) & (eps0 ¥R_GT (eps1 ¥R_PLUS eps2))
            eps1-->Stat4 ==> Finite({ i * j : i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps1 })
            eps2-->Stat6 ==> Finite({ i * j : i in Za, j in Za | abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps2 })
--
-- However, this assumption would lead to conflict with the inequality (holding for all $i,j$)
--	$abs((fq ¥Res_PLUS fp)~[i] ¥R_MINUS (fq ¥Res_PLUS fp)~[j]) ¥R_LE abs((fq~[i] ¥R_MINUS fq~[j]) ¥Res_PLUS (fp~[i] ¥R_MINUS fq~[j]))$.
--
            APPLY() setformer_meet_join(s->Za, t->Za, h(i,j)->(i*j), R(i,j)->(abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps1), Q(i,j)->(abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps2)) ==>
		{(i*j): i in Za, j in Za | (abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps1) or (abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps2)} = ({(i*j): i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps1 } + {(i*j): i in Za, j in Za | abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps2 })
            ({ i * j : i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps1 }, { i * j : i in Za, j in Za | abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps2 })-->T189 ==> Finite({(i*j): i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps1 } + {(i*j): i in Za, j in Za | abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps2 })
            EQUAL ==> Finite({(i*j): i in Za, j in Za | (abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps1) or (abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps2)})
            Suppose ==> Stat14: { i * j : i in Za, j in Za | abs(((fq ¥Res_PLUS fp)~[i]) ¥R_MINUS ((fq ¥Res_PLUS fp)~[j])) ¥R_GT eps0 } ¥nincin {(i*j): i in Za, j in Za | (abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps1) or (abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps2)}
                (i0,j0)-->Stat14 ==> Stat15: (i0 in Za) & (j0 in Za) & (abs(((fq ¥Res_PLUS fp)~[i0]) ¥R_MINUS ((fq ¥Res_PLUS fp)~[j0])) ¥R_GT eps0) & (not(abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_GT eps1)) & (not(abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_GT eps2))
		(fq,fp,i0)-->T757(Stat3,Stat5,Stat15*) ==> Stat16: (fq~[i0] in Re) & (fp~[i0] in Re) & (((fq ¥Res_PLUS fp)~[i0]) = ((fq~[i0]) ¥R_PLUS (fp~[i0])))
		(fq,fp,j0)-->T757(Stat3,Stat5,Stat15*) ==> (fq~[j0] in Re) & (fp~[j0] in Re) & (((fq ¥Res_PLUS fp)~[j0]) = ((fq~[j0]) ¥R_PLUS (fp~[j0])))
                EQUAL(Stat14) ==> abs((((fq~[i0]) ¥R_PLUS (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_PLUS (fp~[j0])))) ¥R_GT eps0
                ALGEBRA(Stat16) ==> (((fq~[i0]) ¥R_MINUS (fq~[j0])) in Re) &
			(((fp~[i0]) ¥R_MINUS (fp~[j0])) in Re) &
			(((((fq~[i0]) ¥R_PLUS (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_PLUS (fp~[j0])))) = (((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0]))))
                ((fq~[i0]) ¥R_MINUS (fq~[j0]))-->T723 ==> abs((fq~[i0]) ¥R_MINUS (fq~[j0])) in Re
                ((fp~[i0]) ¥R_MINUS (fp~[j0]))-->T723(Stat14) ==> abs((fp~[i0]) ¥R_MINUS (fp~[j0])) in Re
                (abs((fq~[i0]) ¥R_MINUS (fq~[j0])), eps1)-->T675(Stat13*) ==> eps1 ¥R_GE abs((fq~[i0]) ¥R_MINUS (fq~[j0]))
                (abs((fp~[i0]) ¥R_MINUS (fp~[j0])), eps2)-->T675(Stat13*) ==> eps2 ¥R_GE abs((fp~[i0]) ¥R_MINUS (fp~[j0]))
                ALGEBRA(Stat13,Stat13) ==> (eps1 ¥R_PLUS eps2) in Re
		ALGEBRA(Stat16) ==> ((abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) in Re) &
			((((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0]))) in Re)
                (((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0])))-->T723(Stat14) ==> abs(((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0]))) in Re
                (eps1, abs((fq~[i0]) ¥R_MINUS (fq~[j0])), eps2, abs((fp~[i0]) ¥R_MINUS (fp~[j0])))-->T695(Stat13*) ==> (eps1 ¥R_PLUS eps2) ¥R_GE (abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS abs((fp~[i0]) ¥R_MINUS (fp~[j0])))
                T722(Stat14) ==> Stat17: (FORALL x,y | ((x in Re) & (y in Re)) ¥imp (abs(x ¥R_PLUS y) ¥R_LE (abs(x) ¥R_PLUS abs(y))))
                ((fq~[i0]) ¥R_MINUS (fq~[j0]), (fp~[i0]) ¥R_MINUS (fp~[j0]))-->Stat17(Stat14) ==> abs(((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_LE (abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS abs((fp~[i0]) ¥R_MINUS (fp~[j0])))
                (abs(((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0]))), (abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS abs((fp~[i0]) ¥R_MINUS (fp~[j0]))))-->T675(Stat14) ==> (abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_GE abs(((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0])))
                (eps1 ¥R_PLUS eps2, (abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS abs((fp~[i0]) ¥R_MINUS (fp~[j0]))), abs(((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0]))))-->T668(Stat14) ==> (eps1 ¥R_PLUS eps2) ¥R_GE abs(((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0])))
                EQUAL(Stat15) ==> abs(((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_GT eps0
                ((abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS abs((fp~[i0]) ¥R_MINUS (fp~[j0]))), abs(((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0]))), eps0)-->T678(Stat11*) ==> ((abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS abs((fp~[i0]) ¥R_MINUS (fp~[j0])))) ¥R_GT eps0
                (eps1 ¥R_PLUS eps2, (abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS abs((fp~[i0]) ¥R_MINUS (fp~[j0]))), eps0)-->T678(Stat11*) ==> (eps1 ¥R_PLUS eps2) ¥R_GT eps0
                (eps1 ¥R_PLUS eps2, eps0)-->T675(Stat11*) ==> (eps1 ¥R_PLUS eps2) ¥R_GE eps0
                (eps0, eps1 ¥R_PLUS eps2, eps0)-->T677(Stat11*) ==> eps0 ¥R_GT eps0
            (eps0,eps0)-->T675(Stat11*) ==> false; Discharge ==> AUTO
--
-- Since the inclusion just proves entails that the set on the left-hand side is finite,
-- we have reached a contradiction, proving that the pointwise sum of real Cauchy sequences
-- is an alike sequence.
--
	({(i*j): i in Za, j in Za | (abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps1) or (abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps2)}, { i * j : i in Za, j in Za | abs(((fq ¥Res_PLUS fp)~[i]) ¥R_MINUS ((fq ¥Res_PLUS fp)~[j])) ¥R_GT eps0 })-->T189(Stat11) ==> false; Discharge ==>
		(Res_ABS(fq) notin ReCauchy) or (Res_Rev(fq) notin ReCauchy)
--
-- Assuming next that $Res_ABS(fq)$ is not a Cauchy sequence (unlike $fq$),
-- there would exist a positive real $eps3$ for which the set
--	${ i * j : i in Za, j in Za | abs((Res_ABS(fq)~[i]) ¥R_MINUS (Res_ABS(fq)~[j])) ¥R_GT eps3 }$
-- is infinite, unlike the analogous set having $fq$ in place of $Res_ABS(fq)$.
-- However, this would lead to a conflict with the inequality (holding for all $i,j$)
--	$abs(Res_ABS(fq)~[i] ¥R_MINUS Res_ABS(fq)~[j]) ¥R_LE abs(fq~[i] ¥Re_MINUS fq~[j])$.
--
        Suppose ==> Res_ABS(fq) notin ReCauchy
            Use_def(ReCauchy) ==> Stat18: Res_ABS(fq) notin {f in ReSeq | (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({ i * j : i in Za, j in Za | abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps }))}
            ()-->Stat18 ==> Stat19: not(FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({ i * j : i in Za, j in Za | abs((Res_ABS(fq)~[i]) ¥R_MINUS (Res_ABS(fq)~[j])) ¥R_GT eps }))
            eps3-->Stat19 ==> (eps3 in Re) & (eps3 ¥R_GT R_0) & (not Finite({ i * j : i in Za, j in Za | abs((Res_ABS(fq)~[i]) ¥R_MINUS (Res_ABS(fq)~[j])) ¥R_GT eps3 }))
            eps3-->Stat4 ==> Finite({ i * j : i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps3 })
--
-- Indeed, since
--	${ i * j : i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps3 }$
-- is a superset of
--	${ i * j : i in Za, j in Za | abs(abs(fq~[i]) ¥R_MINUS abs(fq~[j])) ¥R_GT eps3 }$,
-- the latter cannot be infinite when the former is finite.
--
            Suppose ==> Stat20: not({ i * j : i in Za, j in Za | abs((Res_ABS(fq)~[i]) ¥R_MINUS (Res_ABS(fq)~[j])) ¥R_GT eps3 } ¥incin { i * j : i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps3 })
                (i1,j1)-->Stat20 ==> Stat21: (i1 in Za) & (j1 in Za) & (abs((Res_ABS(fq)~[i1]) ¥R_MINUS (Res_ABS(fq)~[j1])) ¥R_GT eps3) & (not(abs((fq~[i1]) ¥R_MINUS (fq~[j1])) ¥R_GT eps3))
		(fq,fq,i1)-->T757(Stat3,Stat21*) ==> ((Res_ABS(fq)~[i1]) = abs(fq~[i1])) & (fq~[i1] in Re)
		(fq,fq,j1)-->T757(Stat3,Stat21*) ==> ((Res_ABS(fq)~[j1]) = abs(fq~[j1])) & (fq~[j1] in Re)
		EQUAL(Stat21) ==> abs(abs(fq~[i1]) ¥R_MINUS abs(fq~[j1])) ¥R_GT eps3
                (fq~[i1])-->T723 ==> abs(fq~[i1]) in Re
                (fq~[j1])-->T723 ==> abs(fq~[j1]) in Re
                ALGEBRA(Stat21) ==> (((fq~[i1]) ¥R_MINUS (fq~[j1])) in Re) & ((abs(fq~[i1]) ¥R_MINUS abs(fq~[j1])) in Re)
                ((fq~[i1]) ¥R_MINUS (fq~[j1]))-->T723 ==> abs((fq~[i1]) ¥R_MINUS (fq~[j1])) in Re
                (abs(fq~[i1]) ¥R_MINUS abs(fq~[j1]))-->T723 ==> abs(abs(fq~[i1]) ¥R_MINUS abs(fq~[j1])) in Re
                T722 ==> Stat22: (FORALL x,y | ((x in Re) & (y in Re)) ¥imp (abs(abs(x) ¥R_PLUS R_Rev(abs(y))) ¥R_LE abs(x ¥R_PLUS R_Rev(y))))
                (fq~[i1],fq~[j1])-->Stat22 ==> (abs(abs(fq~[i1]) ¥R_PLUS R_Rev(abs(fq~[j1]))) ¥R_LE abs((fq~[i1]) ¥R_PLUS R_Rev(fq~[j1])))
		(abs(fq~[i1]),abs(fq~[j1]))-->T635(Stat21*) ==> abs(fq~[i1]) ¥R_MINUS abs(fq~[j1]) = abs(fq~[i1]) ¥R_PLUS R_Rev(abs(fq~[j1]))
		(fq~[i1],fq~[j1])-->T635(Stat20*) ==> (fq~[i1]) ¥R_MINUS (fq~[j1]) = (fq~[i1]) ¥R_PLUS R_Rev(fq~[j1])
                EQUAL(Stat22) ==> abs(abs(fq~[i1]) ¥R_MINUS abs(fq~[j1])) ¥R_LE abs((fq~[i1]) ¥R_MINUS (fq~[j1]))
                (abs(abs(fq~[i1]) ¥R_MINUS abs(fq~[j1])), abs((fq~[i1]) ¥R_MINUS (fq~[j1])))-->T675 ==> abs((fq~[i1]) ¥R_MINUS (fq~[j1])) ¥R_GE abs(abs(fq~[i1]) ¥R_MINUS abs(fq~[j1]))
            (abs((fq~[i1]) ¥R_MINUS (fq~[j1])), abs(abs(fq~[i1]) ¥R_MINUS abs(fq~[j1])), eps3)-->T678 ==> false; Discharge ==> { i * j : i in Za, j in Za | abs((Res_ABS(fq)~[i]) ¥R_MINUS (Res_ABS(fq)~[j])) ¥R_GT eps3 } ¥incin { i * j : i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps3 }
        ({ i * j : i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps3 },  {i * j : i in Za, j in Za | abs((Res_ABS(fq)~[i]) ¥R_MINUS (Res_ABS(fq)~[j])) ¥R_GT eps3 })-->T189 ==> false; Discharge ==> Res_Rev(fq) notin ReCauchy
--
-- Third and last, let us assume that $Res_Rev(fq)$ is not a Cauchy sequence
-- (unlike $fq$). Then there would exist a positive real $eps4$ for which the set
--	${ i * j : i in Za, j in Za | abs(Res_Rev(fq)~[i] ¥R_MINUS Res_Rev(fq)~[j]) ¥R_GT eps4 }$
-- is infinite, unlike the analogous set having $fq$ in place of $Res_Rev(fq)$.
-- However, this would lead to a conflict with the equality (holding for all $i,j$)
--	$abs(Res_Rev(fq)~[i] ¥R_MINUS Res_Rev(fq)~[j]) = abs(fq~[i] ¥R_MINUS fq~[j])$.
--
            Use_def(ReCauchy) ==> Stat23: Res_Rev(fq) notin {f in ReSeq | (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({ i * j : i in Za, j in Za | abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps }))}
            ()-->Stat23 ==> Stat24: not(FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({ i * j : i in Za, j in Za | abs((Res_Rev(fq)~[i]) ¥R_MINUS (Res_Rev(fq)~[j])) ¥R_GT eps }))
            eps4-->Stat24 ==> Stat25: (eps4 in Re) & (eps4 ¥R_GT R_0) & (not Finite({ i * j : i in Za, j in Za | abs((Res_Rev(fq)~[i]) ¥R_MINUS (Res_Rev(fq)~[j])) ¥R_GT eps4 }))
            eps4-->Stat4 ==> Finite({ i * j : i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps4 })
            EQUAL(Stat25) ==> Stat26: { i * j : i in Za, j in Za | abs((Res_Rev(fq)~[i]) ¥R_MINUS (Res_Rev(fq)~[j])) ¥R_GT eps4 } /= { i * j : i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps4 }
            (i2,j2)-->Stat26 ==> Stat27: (i2 in Za) & (j2 in Za) & ((abs((Res_Rev(fq)~[i2]) ¥R_MINUS (Res_Rev(fq)~[j2])) ¥R_GT eps4) ¥eq (not(abs((fq~[i2]) ¥R_MINUS (fq~[j2])) ¥R_GT eps4)))
            (fq,fq,i2)-->T757(Stat3,Stat27*) ==> Stat28: ((Res_Rev(fq)~[i2]) = R_Rev(fq~[i2])) & (fq~[i2] in Re)
            (fq,fq,j2)-->T757(Stat3,Stat27*) ==> ((Res_Rev(fq)~[j2]) = R_Rev(fq~[j2])) & (fq~[j2] in Re)
            EQUAL(Stat26) ==> Stat29: ((abs(R_Rev(fq~[i2]) ¥R_MINUS R_Rev(fq~[j2])) ¥R_GT eps4) ¥eq (not(abs((fq~[i2]) ¥R_MINUS (fq~[j2])) ¥R_GT eps4)))
            Suppose ==> abs(R_Rev(fq~[i2]) ¥R_MINUS R_Rev(fq~[j2])) /= abs((fq~[i2]) ¥R_MINUS (fq~[j2]))
		ALGEBRA(Stat28) ==> (abs(R_Rev(fq~[i2]) ¥R_MINUS R_Rev(fq~[j2])) = abs(R_Rev(fq~[i2]) ¥R_PLUS R_Rev(R_Rev(fq~[j2])))) &
				(((fq~[j2]) ¥R_PLUS R_Rev(fq~[i2])) in Re) &
				(((fq~[i2]) ¥R_PLUS R_Rev(fq~[j2])) = ((fq~[i2]) ¥R_MINUS (fq~[j2]))) &
				((R_Rev(fq~[i2]) ¥R_MINUS R_Rev(fq~[j2])) = ((fq~[j2]) ¥R_PLUS R_Rev(fq~[i2]))) &
				(R_Rev((fq~[j2]) ¥R_PLUS R_Rev(fq~[i2])) = ((fq~[i2]) ¥R_MINUS (fq~[j2])))
                T722 ==> Stat30: (FORALL x | (x in Re) ¥imp (abs(R_Rev(x)) = abs(x)))
                ((fq~[j2]) ¥R_PLUS R_Rev(fq~[i2]))-->Stat30 ==> abs(R_Rev((fq~[j2]) ¥R_PLUS R_Rev(fq~[i2]))) = abs((fq~[j2]) ¥R_PLUS R_Rev(fq~[i2]))
            EQUAL(Stat29) ==> false; Discharge ==> Stat31: abs(R_Rev(fq~[i2]) ¥R_MINUS R_Rev(fq~[j2])) = abs((fq~[i2]) ¥R_MINUS (fq~[j2]))
            Suppose ==> abs(R_Rev(fq~[i2]) ¥R_MINUS R_Rev(fq~[j2])) ¥R_GT eps4
                EQUAL(Stat31) ==> abs((fq~[i2]) ¥R_MINUS (fq~[j2])) ¥R_GT eps4
            (Stat29)Discharge ==> not(abs(R_Rev(fq~[i2]) ¥R_MINUS R_Rev(fq~[j2])) ¥R_GT eps4)
            EQUAL(Stat31) ==> not(abs((fq~[i2]) ¥R_MINUS (fq~[j2])) ¥R_GT eps4)
    (Stat29)Discharge ==> QED
--
-- For every Cauchy sequence $f$, there is a subscript $k$ past which the
-- distance between any two images $f~[i],f~[j]$ is no larger than any fixed
-- positive rational.
--
Theorem 759: ((Eps in Re) & (Eps ¥R_GT R_0) & (F in ReCauchy)) ¥imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (not (abs((F~[i]) ¥R_MINUS (F~[j]))) ¥R_GT Eps))). Proof+:
Suppose_not(eps,f) ==> AUTO
	Use_def(ReCauchy) ==> Stat1: (f in {g: g in ReSeq | (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({ i * j : i in Za, j in Za | abs((g~[i]) ¥R_MINUS (g~[j])) ¥R_GT eps }))}) &
		(eps in Re) & (eps ¥R_GT R_0) &
		Stat2: (not(EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (not (abs((F~[i]) ¥R_MINUS (F~[j]))) ¥R_GT eps))))
	g-->Stat1(Stat1*) ==> (f = g) & (g in ReSeq) & (FORALL eps1 in Re | (eps1 ¥R_GT R_0) ¥imp
		Finite({ i * j : i in Za, j in Za | abs((g~[i]) ¥R_MINUS (g~[j])) ¥R_GT eps1 }))
	EQUAL ==> Stat3: (FORALL eps1 in Re | (eps1 ¥R_GT R_0) ¥imp
		Finite({ i * j : i in Za, j in Za | abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps1 }))
	eps-->Stat3(Stat1*) ==> Finite({ i * j : i in Za, j in Za | abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps })
	APPLY() cauchyseq_lemma2(R(i,j)->(abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps)) ==>
		Stat4: (EXISTS k in Za | (FORALL i in Za, j in Za | (((i incs k) & (j incs k)) ¥imp (not(abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps)))))
	k-->Stat4(Stat4*) ==> (k in Za) & Stat5: (FORALL i in Za, j in Za | ((i incs k) & (j incs k)) ¥imp (not(abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps)))
	k-->Stat2(Stat4*) ==> Stat6: not (FORALL i in Za, j in Za | (((i notin k) & (j notin k)) ¥imp (not (abs((f~[i]) ¥R_MINUS (f~[j]))) ¥R_GT eps)))
	(i,j)-->Stat6(Stat6*) ==> Stat7: (i in Za) & (j in Za) & (i notin k) & (j notin k) & (abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps)
	(i,j)-->Stat5(Stat3*) ==> ((i incs k) & (j incs k)) ¥imp (not(abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps))
	(Stat7*)ELEM ==> (not((i incs k) & (j incs k)))
	T206(*) ==> Ord(Za) & Ord(i) & Ord(j) & Ord(k)
	(k,i)-->T35(*) ==> (i incs k)
	(k,j)-->T35(*) ==> false; Discharge ==> QED
--
-- It is easily seen that the preceding assertion can be reformulated to assert that
-- there is a subscript $k$ past which the
-- distance between any two images $f~[i],f~[j]$ is smaller than any fixed
-- positive rational.
--
Theorem 760: ((Eps in Re) & (Eps ¥R_GT R_0) & (F in ReCauchy)) ¥imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (Eps ¥R_GT (abs((F~[i]) ¥R_MINUS (F~[j])))) )). Proof:
Suppose_not(eps,f) ==> (f in ReCauchy) & (eps in Re) & (eps ¥R_GT R_0) & Stat1: (not(EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (eps ¥R_GT (abs((f~[i]) ¥R_MINUS (f~[j])))) )))
	eps-->T720 ==> Stat2: (EXISTS eps0 in Re | ((eps ¥R_GT eps0) & (eps0 ¥R_GT R_0)))
	eps0-->Stat2 ==> (eps0 in Re) & (eps ¥R_GT eps0) & (eps0 ¥R_GT R_0)
	(eps0,f)-->T759 ==> Stat3: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (not (abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps0))))
	k-->Stat3 ==> (k in Za) & Stat4: (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (not (abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps0)))
	k-->Stat1 ==> Stat5: not(FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (eps ¥R_GT (abs((f~[i]) ¥R_MINUS (f~[j])))))
--
-- Thus we have a positive $eps0$ smaller than $eps$, and a $k$ such that $abs((f~[i]) ¥R_MINUS (f~[j]))$ is no larger than $eps0$
-- if $i$ and $j$ are both larger than $k$.
--
	(i,j)-->Stat5 ==> (i in Za) & (j in Za) & (i notin k) & (j notin k) & (not(eps ¥R_GT (abs((f~[i]) ¥R_MINUS (f~[j])))))
	(i,j)-->Stat4 ==> not(abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps0)
	T754(*) ==> f in ReSeq
	(f,i)-->T755 ==> f~[i] in Re
	(f,j)-->T755 ==> f~[j] in Re
	ALGEBRA ==> (f~[i]) ¥R_MINUS (f~[j]) in Re
	((f~[i]) ¥R_MINUS (f~[j]))-->T723 ==> abs((f~[i]) ¥R_MINUS (f~[j])) in Re
	(abs((f~[i]) ¥R_MINUS (f~[j])),eps0)-->T669 ==> (eps0 ¥R_GT abs((f~[i]) ¥R_MINUS (f~[j]))) or (eps0 = abs((f~[i]) ¥R_MINUS (f~[j])))
	(eps0,abs((f~[i]) ¥R_MINUS (f~[j])))-->T680 ==> eps0 ¥R_GE (abs((f~[i]) ¥R_MINUS (f~[j])))
	(eps,eps0,abs((f~[i]) ¥R_MINUS (f~[j])))-->T677 ==> eps ¥R_GT abs((f~[i]) ¥R_MINUS (f~[j]))
	Discharge ==> QED
--
-- Every finite set of reals has an upper bound.
--
Theorem 761: ((S ¥incin Re) & Finite(S)) ¥imp (EXISTS u in Re | (FORALL y in S | u ¥R_GE y)). Proof:
	Suppose_not(s) ==> Stat1: (s ¥incin Re) & Finite(s) & Stat2: (not(EXISTS u in Re | (FORALL y in s | u ¥R_GE y)))
--
-- For, assuming the contrary of our thesis to hold for a subset $s$ of $Re$, it is trivial that
-- $s$ is non-void (because $Re$ is non-void).
--
		Suppose ==> s = 0
			ALGEBRA ==> R_0 in Re
			R_0--> Stat2 ==> Stat3: not(FORALL y in s | R_0 ¥R_GE y)
		y0-->Stat3 ==> false; Discharge ==> Stat4: s /= 0
		s-->T0(Stat4*) ==> arb(s) in s
--
-- But then, we can exploit one of the clauses of Theorem 690 to draw the desired contradiction.
--
		T690 ==> Stat5: (FORALL t, x | (Finite(t) & (x in t) & (t ¥incin Re)) ¥imp ((max_Re(t) in t) & ((x = max_Re(t)) or (x ¥R_LT max_Re(t)))))
		(s,arb(s))-->Stat5(Stat1*) ==> max_Re(s) in Re
		(max_Re(s))-->Stat2(Stat5*) ==> Stat6: not(FORALL y in s | max_Re(s) ¥R_GE y)
		y1-->Stat6(Stat6*) ==> (y1 in s) & (not(max_Re(s) ¥R_GE y1))
		(s,y1)-->Stat5(Stat1*) ==> (y1 = max_Re(s)) or (y1 ¥R_LT max_Re(s))
		(y1,max_Re(s))-->T675(Stat6*) ==> (y1 = max_Re(s)) or (max_Re(s) ¥R_GT y1)
	(max_Re(s),y1)-->T680(Stat1*) ==> false; Discharge ==> QED
--
-- Every real Cauchy sequence has an upper bound.
--
Theorem 762: [Every real Cauchy sequence has an upper bound] (F in ReCauchy) ¥imp (EXISTS x in Re | (FORALL y in range(F) | y ¥R_LE x)). Proof+:
Suppose_not(f) ==> (f in ReCauchy) & Stat1: (not(EXISTS x in Re | (FORALL y in range(f) | y ¥R_LE x) ))
--
-- For let $f$ be a counterexample to our assertion, i.e. a  Cauchy sequence having no upper bound.
-- Let $i0$ be an unsigned integer past which the distance between any two components of $f$ is
-- always smaller than $R_1$. Since $i0$ is a finite set and $f$ a single-valued map, the range
-- of $f$ on $i0$ must also be finite.
--
	T754(*) ==> Stat1a: f in ReSeq
	f-->T755 ==> Stat2: (domain(f) = Za) & Svm(f) & (range(f) ¥incin Re)
	ALGEBRA ==> (R_1 in Re) & (R_0 in Re)
	T693 ==> R_1 ¥R_GT R_0
	(R_1,f)-->T760 ==> Stat3: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) ¥imp (R_1 ¥R_GT abs((f~[i]) ¥R_MINUS (f~[j]))) ))
	i0-->Stat3 ==> Stat3a: (i0 in Za) & Stat4: (FORALL i in Za, j in Za | ((i notin i0) & (j notin i0)) ¥imp (R_1 ¥R_GT abs((f~[i]) ¥R_MINUS (f~[j]))) )
	T206 ==> Ord(Za)
	(Za,i0)-->T13 ==> (i0 ¥incin Za) & Finite(i0)
	(f,i0)-->T80 ==> Stat5: range(f ¥ON i0) ¥incin Re
	(f,i0)-->T57 ==> Svm(f ¥ON i0)
	(f,i0)-->T94 ==> Stat6: domain(f ¥ON i0) = i0
	EQUAL ==> Finite(domain(f ¥ON i0))
	(f ¥ON i0)-->T192 ==> Stat7: Finite(range(f ¥ON i0))
	(f,i0)-->T126 ==> Stat8: range(f ¥ON i0) = {f~[i]: i in domain(f ¥ON i0)}
	EQUAL(Stat6,Stat8) ==> Stat9: (range(f ¥ON i0) = {f~[i]: i in i0})
	EQUAL(Stat7,Stat5,Stat9) ==> Stat10: Finite({f~[i]: i in i0}) & ({f~[i]: i in i0} ¥incin Re)
	(f,f,i0)-->T757(Stat1a,Stat3a*) ==> Stat10a: f~[i0] in Re
	ALGEBRA(Stat10a) ==> Stat12: (R_Rev(f~[i0]) in Re) & ((f~[i0] ¥R_PLUS R_1) in Re) &
		((R_1 ¥R_PLUS (f~[i0])) in Re) & (R_1 ¥R_PLUS (f~[i0]) = (f~[i0]) ¥R_PLUS R_1)
	(f~[i0] ¥R_PLUS R_1)-->T201(*) ==> Stat11: Finite({f~[i0] ¥R_PLUS R_1})
--
-- It is easily seen that $f~[i0] ¥R_PLUS R_1$ is an upper bound for the set $f~[j]$ of components of $f$ for which $j notin i0$.
-- Indeed, let $j$ be a counterexample to this assertion, i.e. $j notin i0$ and $not((f~[i0] ¥R_PLUS R_1) ¥R_GT f~[j])$.
-- But since $R_1 ¥R_GT ((f~[j]) ¥R_PLUS R_Rev(f~[i0]))$ we must have $f~[i0] ¥R_PLUS R_1 ¥R_GT f~[j]$,
-- a contradiction proving our claim.
--
	Suppose ==> Stat13: (EXISTS j in Za | ((j notin i0) & (not(((f~[i0]) ¥R_PLUS R_1) ¥R_GT (f~[j])))))
		j-->Stat13 ==> Stat14: (j in Za) & (j notin i0) & Stat15: (not(((f~[i0]) ¥R_PLUS R_1) ¥R_GT (f~[j])))
		(j,i0)-->Stat4 ==> R_1 ¥R_GT abs((f~[j]) ¥R_MINUS (f~[i0]))
		j-->T71(Stat14,Stat2) ==> Stat16: f~[j] in Re
		ALGEBRA(Stat10a,Stat16) ==> ((f~[j]) ¥R_PLUS R_Rev(f~[i0])) in Re
		(f~[j],f~[i0])-->T635(Stat10a,Stat16*) ==> ((f~[j]) ¥R_MINUS (f~[i0])) = ((f~[j]) ¥R_PLUS R_Rev(f~[i0]))
		EQUAL(Stat14) ==> R_1 ¥R_GT abs((f~[j]) ¥R_PLUS R_Rev(f~[i0]))
		((f~[j]) ¥R_PLUS R_Rev(f~[i0]))-->T723 ==> abs((f~[j]) ¥R_PLUS R_Rev(f~[i0])) in Re
		((f~[j]) ¥R_PLUS R_Rev(f~[i0]))-->T723 ==> abs((f~[j]) ¥R_PLUS R_Rev(f~[i0])) ¥R_GE ((f~[j]) ¥R_PLUS R_Rev(f~[i0]))
		(R_1,abs((f~[j]) ¥R_PLUS R_Rev(f~[i0])),((f~[j]) ¥R_PLUS R_Rev(f~[i0])))-->T677 ==> R_1 ¥R_GT ((f~[j]) ¥R_PLUS R_Rev(f~[i0]))
		(f~[i0],f~[i0])-->T680 ==> (f~[i0]) ¥R_GE (f~[i0])
		(R_1,(f~[j]) ¥R_PLUS R_Rev(f~[i0]),f~[i0],f~[i0])-->T697 ==> (R_1 ¥R_PLUS (f~[i0])) ¥R_GT (((f~[j]) ¥R_PLUS R_Rev(f~[i0])) ¥R_PLUS (f~[i0]))
		ALGEBRA(Stat10a,Stat16) ==> ((((f~[j]) ¥R_PLUS R_Rev(f~[i0])) ¥R_PLUS (f~[i0])) = ((f~[j]) ¥R_PLUS (R_Rev(f~[i0]) ¥R_PLUS (f~[i0])))) &
			(R_Rev(f~[i0]) ¥R_PLUS (f~[i0]) = R_0) & ((f~[j]) ¥R_PLUS R_0 = (f~[j]))
	EQUAL(Stat12) ==> false; Discharge ==> Stat17: not (EXISTS j in Za | ((j notin i0) & (not(((f~[i0]) ¥R_PLUS R_1) ¥R_GT (f~[j])))))
--
-- By Theorem 761, the finite set
-- ${f~[i]: i in i0} + {f~[i0] ¥R_PLUS R_1}$ of reals has an upper bound $r$.
--
	({f~[i]: i in i0},{f~[i0] ¥R_PLUS R_1})-->T236(Stat10,Stat11) ==> Finite({f~[i]: i in i0} + {f~[i0] ¥R_PLUS R_1})
	ELEM ==> ({f~[i]: i in i0} + {f~[i0] ¥R_PLUS R_1}) ¥incin Re
	({f~[i]: i in i0} + {f~[i0] ¥R_PLUS R_1})-->T761 ==> Stat18: (EXISTS u in Re | (FORALL y in ({f~[i]: i in i0} + {f~[i0] ¥R_PLUS R_1}) | u ¥R_GE y))
	r-->Stat18 ==> Stat19: (r in Re) & Stat20: (FORALL y in ({f~[i]: i in i0} + {f~[i0] ¥R_PLUS R_1}) | r ¥R_GE y)
--
-- But it is easily seen that $r$ must also be an upper bound for the entire Cauchy sequence $f$,
-- proving our theorem.
--
	ELEM ==> (f~[i0] ¥R_PLUS R_1) in {f~[i0] ¥R_PLUS R_1}
	(f~[i0] ¥R_PLUS R_1)-->Stat20 ==> Stat21: r ¥R_GE (f~[i0] ¥R_PLUS R_1)
	f-->T73 ==> range(f) = {f~[v]: v in domain(f)}
	EQUAL ==> range(f) = {f~[v]: v in Za}
	r-->Stat1 ==> Stat22: (r in Re) & (not (FORALL y in range(f) | y ¥R_LE r))
	EQUAL(Stat12) ==> not(FORALL y in {f~[v]: v in Za} | y ¥R_LE r)
	SIMPLF ==> Stat23: not (FORALL v in Za | f~[v] ¥R_LE r)
	k-->Stat23 ==> Stat24: (k in Za) & (not((f~[k]) ¥R_LE r))
	(f~[k],r)-->T675(Stat24) ==> Stat25: not(r ¥R_GE (f~[k]))
	k-->T71(Stat2,Stat24) ==> Stat26: ((f~[k]) in Re) & Stat27: ((f~[k]) in range(f))
	(f~[k])-->Stat20 ==> Stat28: not((f~[k]) in {f~[i]: i in i0})
	k-->Stat28 ==> k notin i0
	k-->Stat17 ==> Stat29: ((f~[i0]) ¥R_PLUS R_1) ¥R_GT (f~[k])
	((f~[i0]) ¥R_PLUS R_1,f~[k])-->T680 ==> Stat30: ((f~[i0]) ¥R_PLUS R_1) ¥R_GE (f~[k])
	(r,(f~[i0]) ¥R_PLUS R_1,f~[k])-->T668(Stat22,Stat12,Stat26,Stat30,Stat21) ==> Stat31: r ¥R_GE (f~[k])
	(Stat25,Stat31*)Discharge ==> QED
--
-- As an immediate corollary, every Cauchy sequence has an upper bound
-- for the absolute values of its components.
--
Theorem 763: (F in ReCauchy) ¥imp (EXISTS x in Re | (FORALL y in range(F) | abs(y) ¥R_LT x )). Proof:
    Suppose_not(f) ==> (f in ReCauchy) & Stat1: (not(EXISTS x in Re | (FORALL y in range(f) | abs(y) ¥R_LT x) ))
        T754(*) ==> f in ReSeq
        f-->T755 ==> (domain(f) = Za) & Svm(f) & (range(f) ¥incin Re)
        (f,f)-->T758 ==> Res_ABS(f) in ReCauchy
        (f,f)-->T756 ==> Res_ABS(f) = {[u, abs(f~[u])]: u in Za}
        (Res_ABS(f))-->T762 ==> Stat2: (EXISTS x in Re | (FORALL y in range(Res_ABS(f)) | y ¥R_LE x ))
        c-->Stat2 ==> (c in Re) & Stat3: (FORALL y in range(Res_ABS(f)) | y ¥R_LE c )
        ALGEBRA ==> (R_0 in Re) & (R_1 in Re) & ((c ¥R_PLUS R_1) in Re)
        (c ¥R_PLUS R_1)-->Stat1 ==> Stat4: not(FORALL y in range(f) | abs(y) ¥R_LT (c ¥R_PLUS R_1))
        d-->Stat4 ==> (d in range(f)) & (not(abs(d) ¥R_LT (c ¥R_PLUS R_1)))
        Suppose ==> abs(d) notin range(Res_ABS(f))
            f-->T73 ==> Stat5: d in {f~[x]: x in domain(f)}
            a-->Stat5 ==> (d = f~[a]) & (a in Za)
            TELEM ==> range({[u, abs(f~[u])]: u in Za}) = {abs(f~[u]): u in Za}
            EQUAL ==> (range(Res_ABS(f)) = {abs(f~[u]): u in Za}) & (abs(d) = abs(f~[a]))
            ELEM ==> Stat6: abs(d) notin {abs(f~[u]): u in Za}
        a-->Stat6 ==> false; Discharge ==> abs(d) in range(Res_ABS(f))
        (abs(d))-->Stat3 ==> abs(d) ¥R_LE c
        (abs(d),c)-->T675 ==> c ¥R_GE abs(d)
        T693 ==> R_1 ¥R_GT R_0
        d-->T723 ==> abs(d) in Re
        (c,abs(d),R_1,R_0)-->T696 ==> (c ¥R_PLUS R_1) ¥R_GT (abs(d) ¥R_PLUS R_0)
        ALGEBRA ==> (abs(d) ¥R_PLUS R_0) = abs(d)
        EQUAL ==> (c ¥R_PLUS R_1) ¥R_GT abs(d)
    (abs(d),c ¥R_PLUS R_1)-->T675 ==> false; Discharge ==> QED
--
--
--
Theorem 764: ({F,G} ¥incin ReCauchy) ¥imp (((F ¥Res_MINUS G) in ReCauchy) & ((F ¥Res_TIMES G) in ReCauchy)). Proof:
Suppose_not(fq,fp) ==> AUTO
--
-- Reasoning by contradiction, assume that $fq,fp$ form a counterexample
-- to the desired statement. We readily discard the possibility that
-- $(fq ¥Res_MINUS fp) notin ReCauchy$. Only the possibility that
-- $(fq ¥Res_TIMES fp) notin ReCauchy$ must be analyzed in detail, and
-- we will reach a contradiction in this case also.
--
	Suppose ==> Stat1: (fq ¥Res_MINUS fp) notin ReCauchy
		Use_def(¥Res_MINUS)(Stat1*) ==> (fq ¥Res_PLUS Res_Rev(fp)) notin ReCauchy
		(fp,fp)-->T758(*) ==> Res_Rev(fp) in ReCauchy
	(fq,Res_Rev(fp))-->T758(*) ==> false; Discharge ==> Stat2: ({fp,fq} ¥incin ReCauchy) &
		((fq ¥Res_TIMES fp) notin ReCauchy)
--
-- Assuming that $fq ¥Res_TIMES fp$ is not a Cauchy sequence (unlike
-- $fq$ and $fp$), there would exist a positive real $eps0$ for which
-- the set
--	${ i * j : i in Za, j in Za | abs(((fq ¥Res_TIMES fp)~[i]) ¥R_MINUS ((fq ¥Res_TIMES fp)~[j])) ¥R_GT eps0 }$
-- is infinite, unlike the analogous sets which have $fp$ and $fq$, respectively,
-- in place of $fq ¥Res_TIMES fp$ and have, in place of $eps0$, positive reals
-- $eps1$ and $eps2$ smaller than one half of $eps0 ¥R_OVER m$, where $m$ is chosen
-- to be larger than the absolute value of any component of $fq$ and of any component
-- of $fp$.
--
	Use_def(ReCauchy)(Stat2*) ==> Stat3: (fq ¥Res_TIMES fp) notin {f in ReSeq | (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
	  Finite({ i * j : i in Za, j in Za | abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps }))} &
			Stat4: fq in {f in ReSeq | (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
	  Finite({ i * j : i in Za, j in Za | abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps }))} &
			Stat5: fp in {f in ReSeq | (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
				Finite({ i * j : i in Za, j in Za | abs((f~[i]) ¥R_MINUS (f~[j])) ¥R_GT eps }))}
	()-->Stat4(Stat3*) ==> Stat6: (fq in ReSeq) & Stat7: (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
			Finite({ i * j : i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps }))
	()-->Stat5(Stat3*) ==> Stat8: (fp in ReSeq) & Stat9: (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
			Finite({ i * j : i in Za, j in Za | abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps }))
	fq-->T755(Stat6,Stat6*) ==> Stat10: (domain(fq) = Za) & Svm(fq) & (range(fq) ¥incin Re)
	fp-->T755(Stat8,Stat8*) ==> Stat11: (domain(fp) = Za) & Svm(fp) & (range(fp) ¥incin Re)
	(fq,fp)-->T756(Stat6*) ==> Stat12: ((fq ¥Res_TIMES fp) in ReSeq) &
			Stat13: ((fq ¥Res_TIMES fp) = {[u,((fq~[u]) ¥R_TIMES (fp~[u]))]: u in Za})
	()-->Stat3(Stat3*) ==> Stat14: not(FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
			Finite({ i * j : i in Za, j in Za | abs(((fq ¥Res_TIMES fp)~[i]) ¥R_MINUS ((fq ¥Res_TIMES fp)~[j])) ¥R_GT eps }))
	eps0-->Stat14(Stat14*) ==> Stat15: (eps0 in Re) & (eps0 ¥R_GT R_0) & (not(
			Finite({ i * j : i in Za, j in Za | abs(((fq ¥Res_TIMES fp)~[i]) ¥R_MINUS ((fq ¥Res_TIMES fp)~[j])) ¥R_GT eps0 })))
	fq-->T763(Stat2,Stat2*) ==> Stat16: (EXISTS x in Re | (FORALL y in range(fq) | abs(y) ¥R_LT x ))
	mq-->Stat16(Stat16*) ==> (mq in Re) & Stat17: (FORALL y in range(fq) | abs(y) ¥R_LT mq )
	fp-->T763(Stat2,Stat2*) ==> Stat18: (EXISTS x in Re | (FORALL y in range(fp) | abs(y) ¥R_LT x ))
	mp-->Stat18(Stat18*) ==> (mp in Re) & Stat19: (FORALL y in range(fp) | abs(y) ¥R_LT mp )
	Loc_def ==> m = if (mq ¥R_GT mp) then mq else mp end if
	(Stat16*)ELEM ==> Stat20: m in Re
	Suppose ==> Stat21: not(FORALL y in range(fq) | abs(y) ¥R_LT m)
		y1-->Stat21(Stat21*) ==> (y1 in range(fq)) & (not(abs(y1) ¥R_LT m))
		y1-->Stat17(Stat16*) ==> abs(y1) ¥R_LT mq
		Suppose ==> m = mq
		EQUAL(Stat21) ==> false; Discharge ==> m /= mq
		(Stat18)ELEM ==> not(mq ¥R_GT mp)
		(mq,mp)-->T675(Stat16*) ==> (mp ¥R_GE mq) & (m = mp)
		y1-->T723(Stat10*) ==> abs(y1) in Re
		(abs(y1),mq)-->T675(Stat16*) ==> mq ¥R_GT abs(y1)
		(mp,mq,abs(y1))-->T678(Stat16*) ==> mp ¥R_GT abs(y1)
		EQUAL(Stat21) ==> m ¥R_GT abs(y1)
	(abs(y1),m)-->T675(Stat20*) ==> false; Discharge ==> Stat22: (FORALL y in range(fq) | abs(y) ¥R_LT m)
	Suppose ==> Stat23: not(FORALL y in range(fp) | abs(y) ¥R_LT m)
		y2-->Stat23(Stat23*) ==> (y2 in range(fp)) &  (not(abs(y2) ¥R_LT m))
		y2-->Stat19(Stat18*) ==> abs(y2) ¥R_LT mp
		Suppose ==> m = mp
		EQUAL(Stat23) ==> false; Discharge ==> m /= mp
		ELEM ==> (mq ¥R_GT mp) & (m = mq)
		y2-->T723(Stat11*) ==> abs(y2) in Re
		(abs(y2),mp)-->T675(Stat18*) ==> mp ¥R_GT abs(y2)
		(mq,mp,abs(y2))-->T679(Stat16*) ==> mq ¥R_GT abs(y2)
		EQUAL(Stat23) ==> m ¥R_GT abs(y2)
	(abs(y2),m)-->T675(Stat20*) ==> false; Discharge ==> Stat24: (FORALL y in range(fp) | abs(y) ¥R_LT m )
	ALGEBRA(Stat24) ==> (R_0 in Re)
	Suppose ==> not(m ¥R_GT R_0)
		ALGEBRA(Stat10,Stat10) ==> Stat25: 0 in domain(fq)
		(0,fq)-->T71(Stat2,Stat10,Stat25*) ==> Stat26: (fq~[0]) in range(fq)
		(fq~[0])-->Stat22(Stat26*) ==> abs(fq~[0]) ¥R_LT m
		(fq~[0])-->T723(Stat10,Stat26*) ==> (abs(fq~[0]) ¥R_GE R_0) & (abs(fq~[0]) in Re)
		(abs(fq~[0]), m)-->T675(Stat26*) ==> m ¥R_GT abs(fq~[0])
	(m, abs(fq~[0]), R_0)-->T677(Stat2*) ==> false; Discharge ==> AUTO
	(m, R_0)-->T675(Stat2*) ==> m /= R_0
	m-->T647(Stat2*) ==> Stat27: (R_Recip(m) in Re) & ((R_Recip(m) ¥R_TIMES m) = R_1)
	ALGEBRA(Stat20,Stat15,Stat27) ==> (R_0 = (R_0 ¥R_PLUS R_0)) &
		((eps0 ¥R_TIMES R_Recip(m)) in Re) &
		((R_0 ¥R_TIMES R_Recip(m)) = (R_Recip(m) ¥R_TIMES R_0)) &
		((R_Recip(m) ¥R_TIMES m) = (m ¥R_TIMES R_Recip(m)))
	m-->T709(Stat2*) ==> R_Recip(m) ¥R_GT R_0
	(eps0, R_0, R_Recip(m))-->T705(Stat2*) ==> (eps0 ¥R_TIMES R_Recip(m)) ¥R_GT (R_0 ¥R_TIMES R_Recip(m))
	ALGEBRA(Stat27) ==> (R_Recip(m) ¥R_TIMES R_0) = R_0
	EQUAL(Stat2) ==> (eps0 ¥R_TIMES R_Recip(m)) ¥R_GT R_0
	(eps0 ¥R_TIMES R_Recip(m))-->T719(Stat2*) ==> Stat28: (EXISTS e in Re, e0 in Re | ((eps0 ¥R_TIMES R_Recip(m)) ¥R_GT e) & (e ¥R_GT e0) & (e0 ¥R_GT R_0) & (e ¥R_GT R_0) & ((eps0 ¥R_TIMES R_Recip(m)) ¥R_GT (e ¥R_PLUS e0)))
	(eps1,eps2)-->Stat28 ==> Stat29: (eps1 in Re) & (eps2 in Re) & (eps2 ¥R_GT R_0) & (eps1 ¥R_GT R_0) & ((eps0 ¥R_TIMES R_Recip(m)) ¥R_GT (eps1 ¥R_PLUS eps2))
	(eps1,R_0)-->T675(Stat2*) ==> (eps1 ¥R_GE R_0)
	(eps1,R_0,eps2,R_0)-->T696(Stat2*) ==> (eps1 ¥R_PLUS eps2) ¥R_GT (R_0 ¥R_PLUS R_0)
	EQUAL(Stat2) ==> (eps1 ¥R_PLUS eps2) ¥R_GT R_0
	m-->T709(Stat2*) ==> R_Recip(m) ¥R_GT R_0
	ALGEBRA(Stat29,Stat20,Stat15,Stat27) ==> ((eps1 ¥R_PLUS eps2) in Re) &
		(((eps0 ¥R_TIMES R_Recip(m)) ¥R_TIMES m) = (eps0 ¥R_TIMES (m ¥R_TIMES R_Recip(m)))) &
		(((eps1 ¥R_PLUS eps2) ¥R_TIMES m) = (m ¥R_TIMES (eps1 ¥R_PLUS eps2))) &
		((eps0 ¥R_TIMES R_1) = eps0)
	(eps0 ¥R_TIMES R_Recip(m), eps1 ¥R_PLUS eps2, m)-->T705(Stat2*) ==> ((eps0 ¥R_TIMES R_Recip(m)) ¥R_TIMES m) ¥R_GT ((eps1 ¥R_PLUS eps2) ¥R_TIMES m)
	EQUAL(Stat2) ==> eps0 ¥R_GT (m ¥R_TIMES (eps1 ¥R_PLUS eps2))
--
	eps2-->Stat7 ==> Stat30: Finite({ (i * j) : i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps2 })
	eps1-->Stat9 ==> Stat31: Finite({ (i * j) : i in Za, j in Za | abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps1 })
--
-- However, this assumption would lead to a conflict with the inequality (holding for all $i,j in Za$)
--	$abs((fq ¥Res_TIMES fp)~[i] ¥R_MINUS (fq ¥Res_TIMES fp)~[j]) ¥R_LE (m ¥R_TIMES abs((fq~[i] ¥R_MINUS fq~[j]) ¥R_PLUS (fp~[i] ¥R_MINUS fp~[j])))$,
-- as we are about to show.
--
	APPLY() setformer_meet_join(s->Za, t->Za, h(i,j)->(i*j), R(i,j)->(abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps2), Q(i,j)->(abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps1)) ==>
			Stat32: {(i*j): i in Za, j in Za | (abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps2) or (abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps1)} = ({(i*j): i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps2 } + {(i*j): i in Za, j in Za | abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps1 })
	({ i * j : i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps2 }, { i * j : i in Za, j in Za | abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps1 })-->T236(Stat30,Stat31*) ==>
			Finite({(i*j): i in Za, j in Za | abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps2 } + {(i*j): i in Za, j in Za | abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps1 })
 	EQUAL(Stat32) ==> Finite({(i*j): i in Za, j in Za | (abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps2) or (abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps1)})
	Suppose ==> Stat33: not({(i * j): i in Za, j in Za | abs(((fq ¥Res_TIMES fp)~[i]) ¥R_MINUS ((fq ¥Res_TIMES fp)~[j])) ¥R_GT eps0 } ¥incin {(i*j): i in Za, j in Za | (abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps2) or (abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps1)})
--
-- If we make the temporary assumption that
--	$not({(i * j): i in Za, j in Za | abs(((fq ¥Res_TIMES fp)~[i]) ¥R_MINUS ((fq ¥Res_TIMES fp)~[j])) ¥R_GT eps0 } ¥incin {(i*j): i in Za, j in Za | (abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps2) or (abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps1)})$,
-- then, by proving the above-stated inequality, we reach a contradiction as follows.
-- In the first place, observe that if $i0,j0$ are unsigned integers for which $i0*j0$
-- belongs to the set appearing as left-hand side but does not belong to the right-hand side then
--	$abs((((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0])))) ¥R_GT eps0$,
--	$(abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_LE eps1) & (abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_LE eps2)$.
--
		(i0,j0)-->Stat33 ==> Stat34: (i0 in Za) & (j0 in Za) & (abs(((fq ¥Res_TIMES fp)~[i0]) ¥R_MINUS ((fq ¥Res_TIMES fp)~[j0])) ¥R_GT eps0) & (not(abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_GT eps2)) & (not(abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_GT eps1))
		APPLY() fcn_symbol(f(u)->((fq~[u]) ¥R_TIMES (fp~[u])), g->(fq ¥Res_TIMES fp), s->Za) ==>
			Stat35: (FORALL x | ((fq ¥Res_TIMES fp)~[x]) = if x in Za then ((fq~[x]) ¥R_TIMES (fp~[x])) else 0 end if)
		i0-->Stat35(Stat34*) ==> ((fq ¥Res_TIMES fp)~[i0]) = ((fq~[i0]) ¥R_TIMES (fp~[i0]))
		j0-->Stat35(Stat34*) ==> ((fq ¥Res_TIMES fp)~[j0]) = ((fq~[j0]) ¥R_TIMES (fp~[j0]))
		EQUAL(Stat33) ==> Stat36: abs((((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0])))) ¥R_GT eps0
--
-- Secondly, we easily check that various quantities belong to $Re$.
--
		Suppose ==> (fq~[i0]) notin range(fq)
			fq-->T73(Stat10*) ==> Stat37: (fq~[i0]) notin {(fq~[j]): j in domain(fq)}
		i0-->Stat37(Stat10,Stat34*) ==> false; Discharge ==> Stat38: (fq~[i0]) in range(fq)
		Suppose ==> (fp~[j0]) notin range(fp)
			fp-->T73(Stat11*) ==> Stat39: (fp~[j0]) notin {(fp~[j]): j in domain(fp)}
		j0-->Stat39(Stat11,Stat34*) ==> false; Discharge ==> Stat40: (fp~[j0]) in range(fp)
		(fq,fp,i0)-->T757(Stat6,Stat8,Stat34*) ==> Stat41: ((fq~[i0]) in Re) & ((fp~[i0]) in Re)
		(fq,fp,j0)-->T757(Stat6,Stat8,Stat34*) ==> Stat42: ((fq~[j0]) in Re) & ((fp~[j0]) in Re)
		(fq~[i0])-->T723(Stat41*) ==> Stat43: abs(fq~[i0]) in Re
		ALGEBRA(Stat41,Stat42) ==> Stat44: (((fq~[i0]) ¥R_MINUS (fq~[j0])) in Re)
		((fq~[i0]) ¥R_MINUS (fq~[j0]))-->T723(Stat44*) ==> Stat45: (abs((fq~[i0]) ¥R_MINUS (fq~[j0])) in Re) & (abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_GE R_0)
		(fp~[j0])-->T723(Stat41*) ==> Stat46: abs(fp~[j0]) in Re
		ALGEBRA(Stat42,Stat41) ==> Stat47: ((fp~[i0]) ¥R_MINUS (fp~[j0])) in Re
		((fp~[i0]) ¥R_MINUS (fp~[j0]))-->T723(Stat41*) ==> Stat48: (abs((fp~[i0]) ¥R_MINUS (fp~[j0])) in Re) & (abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_GE R_0)
		ALGEBRA(Stat20,Stat29) ==> (m ¥R_TIMES (eps1 ¥R_PLUS eps2)) in Re
		ALGEBRA(Stat41,Stat42) ==> ((((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0]))) in Re) &
				(((fq~[i0]) ¥R_TIMES ((fp~[i0]) ¥R_MINUS (fp~[j0]))) in Re) &
				(((fp~[j0]) ¥R_TIMES ((fq~[i0]) ¥R_MINUS (fq~[j0]))) in Re)
		(((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0])))-->T723(Stat41*) ==> abs(((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_PLUS ((fp~[i0]) ¥R_MINUS (fp~[j0]))) in Re
		ALGEBRA(Stat48,Stat45,Stat46,Stat43) ==> ((abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))) in Re) &
				((abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) in Re) &
				((abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_PLUS abs((fq~[i0]) ¥R_MINUS (fq~[j0]))) in Re) &
				(((abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))) in Re)
		ALGEBRA(Stat41) ==> Stat49: ((R_Rev((fq~[i0]) ¥R_TIMES (fp~[j0])) in Re) & ((((fq~[i0]) ¥R_TIMES (fp~[j0])) ¥R_PLUS R_Rev((fq~[i0]) ¥R_TIMES (fp~[j0]))) = R_0)) &
				((((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_PLUS (R_Rev((fq~[i0]) ¥R_TIMES (fp~[j0])) ¥R_PLUS ((fq~[i0]) ¥R_TIMES (fp~[j0])))) = ((((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_PLUS R_Rev((fq~[i0]) ¥R_TIMES (fp~[j0]))) ¥R_PLUS ((fq~[i0]) ¥R_TIMES (fp~[j0]))))
		ALGEBRA(Stat41,Stat42) ==> Stat50: (((fq~[j0]) ¥R_TIMES (fp~[j0])) = ((fp~[j0]) ¥R_TIMES (fq~[j0]))) &
				((((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_PLUS R_Rev((fq~[i0]) ¥R_TIMES (fp~[j0])) ¥R_PLUS ((fq~[i0]) ¥R_TIMES (fp~[j0]))) ¥R_PLUS R_Rev((fq~[j0]) ¥R_TIMES (fp~[j0])) = (((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_PLUS R_Rev((fq~[i0]) ¥R_TIMES (fp~[j0]))) ¥R_PLUS (((fq~[i0]) ¥R_TIMES (fp~[j0])) ¥R_PLUS R_Rev((fq~[j0]) ¥R_TIMES (fp~[j0])))) &
				(((fq~[i0]) ¥R_TIMES (fp~[i0])) in Re) &
				(((fq~[i0]) ¥R_TIMES (fp~[j0])) in Re)
--
-- By exploiting some of the above membership relations, we easily get
--	$(eps1 ¥R_PLUS eps2) ¥R_GE (abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_PLUS abs((fq~[i0]) ¥R_MINUS (fq~[j0])))$,
-- and hence
--	$eps0 ¥R_GT ((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))$.
--
		(abs((fp~[i0]) ¥R_MINUS (fp~[j0])), eps1)-->T675(Stat29*) ==> eps1 ¥R_GE abs((fp~[i0]) ¥R_MINUS (fp~[j0]))
		(abs((fq~[i0]) ¥R_MINUS (fq~[j0])), eps2)-->T675(Stat29*) ==> eps2 ¥R_GE abs((fq~[i0]) ¥R_MINUS (fq~[j0]))
		(eps1, abs((fp~[i0]) ¥R_MINUS (fp~[j0])), eps2, abs((fq~[i0]) ¥R_MINUS (fq~[j0])))-->T695(Stat29*) ==> (eps1 ¥R_PLUS eps2) ¥R_GE (abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_PLUS abs((fq~[i0]) ¥R_MINUS (fq~[j0])))
		Suppose ==> Stat51: not((m ¥R_TIMES (eps1 ¥R_PLUS eps2)) ¥R_GE ((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))))
			ALGEBRA(Stat48,Stat45,Stat20) ==> (m ¥R_TIMES (abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_PLUS abs((fq~[i0]) ¥R_MINUS (fq~[j0])))) = ((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))
			Suppose ==> (eps1 ¥R_PLUS eps2) = (abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_PLUS abs((fq~[i0]) ¥R_MINUS (fq~[j0])))
				EQUAL(Stat51*) ==> (m ¥R_TIMES (eps1 ¥R_PLUS eps2)) = ((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))
			(((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))), (m ¥R_TIMES (eps1 ¥R_PLUS eps2)))-->T675(Stat41*) ==> false; Discharge ==> AUTO
			(eps1 ¥R_PLUS eps2, abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_PLUS abs((fq~[i0]) ¥R_MINUS (fq~[j0])))-->T675(Stat41*) ==> (eps1 ¥R_PLUS eps2) ¥R_GT (abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_PLUS abs((fq~[i0]) ¥R_MINUS (fq~[j0])))
			(eps1 ¥R_PLUS eps2, abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_PLUS abs((fq~[i0]) ¥R_MINUS (fq~[j0])), m)-->T705(Stat18*) ==> ((eps1 ¥R_PLUS eps2) ¥R_TIMES m) ¥R_GT ((abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_PLUS abs((fq~[i0]) ¥R_MINUS (fq~[j0]))) ¥R_TIMES m)
			ALGEBRA(Stat20,Stat29) ==> (m ¥R_TIMES (eps1 ¥R_PLUS eps2)) = ((eps1 ¥R_PLUS eps2) ¥R_TIMES m)
			ALGEBRA(Stat20,Stat48,Stat45) ==> ((abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_PLUS abs((fq~[i0]) ¥R_MINUS (fq~[j0]))) ¥R_TIMES m) = (m ¥R_TIMES (abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_PLUS abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))
			EQUAL(Stat51*) ==> (m ¥R_TIMES (eps1 ¥R_PLUS eps2)) ¥R_GT ((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))
		((m ¥R_TIMES (eps1 ¥R_PLUS eps2)), ((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))))-->T675(Stat51*) ==> false; Discharge ==> AUTO
		(Stat28*)ELEM ==> (m ¥R_TIMES (eps1 ¥R_PLUS eps2)) ¥R_GE ((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))
		ALGEBRA(Stat20,Stat48,Stat45) ==> Stat52: ((m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))) in Re) &
				((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) in Re) &
				(((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))) in Re)
		(eps0, m ¥R_TIMES (eps1 ¥R_PLUS eps2), (m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))-->T677(Stat15*) ==> eps0 ¥R_GT ((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))
		(eps0, (m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))-->T675(Stat42*) ==> Stat53: eps0 ¥R_GE ((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))
--
-- As a consequence, $eps1 ¥R_PLUS eps2$ is greater than or equal to
--	$abs(((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_MINUS (fp~[j0])))$,
-- because this quantity equals
--	$abs(((fq~[i0]) ¥R_TIMES ((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS ((fp~[j0]) ¥R_TIMES ((fq~[i0]) ¥R_MINUS (fq~[j0]))))$,
--
		(abs((fq~[i0]) ¥R_MINUS (fq~[j0])), eps2)-->T675(Stat35*) ==> eps2 ¥R_GE abs((fq~[i0]) ¥R_MINUS (fq~[j0]))
		(abs((fp~[i0]) ¥R_MINUS (fp~[j0])), eps1)-->T675(Stat35*) ==> eps1 ¥R_GE abs((fp~[i0]) ¥R_MINUS (fp~[j0]))
		(eps1, abs((fp~[i0]) ¥R_MINUS (fp~[j0])), eps2, abs((fq~[i0]) ¥R_MINUS (fq~[j0])))-->T695(Stat35*) ==> Stat54: (eps1 ¥R_PLUS eps2) ¥R_GE (abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_PLUS abs((fq~[i0]) ¥R_MINUS (fq~[j0])))
		Suppose ==> Stat55: (((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0]))) /=
							(((fq~[i0]) ¥R_TIMES ((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS ((fp~[j0]) ¥R_TIMES ((fq~[i0]) ¥R_MINUS (fq~[j0]))))
			ALGEBRA(Stat41,Stat42) ==> ((fq~[i0]) ¥R_TIMES ((fp~[i0]) ¥R_MINUS (fp~[j0])) = ((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[i0]) ¥R_TIMES (fp~[j0]))) &
				((fp~[j0]) ¥R_TIMES ((fq~[i0]) ¥R_MINUS (fq~[j0])) = ((fq~[i0]) ¥R_TIMES (fp~[j0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0]))) &
				((((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[i0]) ¥R_TIMES (fp~[j0]))) = (((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_PLUS R_Rev((fq~[i0]) ¥R_TIMES (fp~[j0])))) &
				((((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_PLUS R_Rev((fq~[i0]) ¥R_TIMES (fp~[j0]))) ¥R_PLUS (((fq~[i0]) ¥R_TIMES (fp~[j0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0]))) = (((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_PLUS (R_Rev((fq~[i0]) ¥R_TIMES (fp~[j0])) ¥R_PLUS ((fq~[i0]) ¥R_TIMES (fp~[j0])))) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0]))) &
				((R_Rev((fq~[i0]) ¥R_TIMES (fp~[j0])) ¥R_PLUS ((fq~[i0]) ¥R_TIMES (fp~[j0]))) = R_0) &
				((((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_PLUS R_0) = ((fq~[i0]) ¥R_TIMES (fp~[i0])))
		EQUAL(Stat55) ==> false; Discharge ==> AUTO
		(Stat54*)ELEM ==> Stat56: (((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0]))) =
							(((fq~[i0]) ¥R_TIMES ((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS ((fp~[j0]) ¥R_TIMES ((fq~[i0]) ¥R_MINUS (fq~[j0]))))
		EQUAL(Stat56) ==> abs(((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0]))) =
							abs(((fq~[i0]) ¥R_TIMES ((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS ((fp~[j0]) ¥R_TIMES ((fq~[i0]) ¥R_MINUS (fq~[j0]))))
-- ..., in its turn
--	$abs(((fq~[i0]) ¥R_TIMES ((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS ((fp~[j0]) ¥R_TIMES ((fq~[i0]) ¥R_MINUS (fq~[j0]))))$
-- is smaller than or equal to
--	$((abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))$,
--
		T722(Stat57*) ==> Stat57: (FORALL x,y | ((x in Re) & (y in Re)) ¥imp (abs(x ¥R_PLUS y) ¥R_LE (abs(x) ¥R_PLUS abs(y))))
		(((fq~[i0]) ¥R_TIMES ((fp~[i0]) ¥R_MINUS (fp~[j0]))), ((fp~[j0]) ¥R_TIMES ((fq~[i0]) ¥R_MINUS (fq~[j0]))))-->Stat57(Stat35*) ==>
					abs(((fq~[i0]) ¥R_TIMES ((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS ((fp~[j0]) ¥R_TIMES ((fq~[i0]) ¥R_MINUS (fq~[j0])))) ¥R_LE (abs((fq~[i0]) ¥R_TIMES ((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS abs((fp~[j0]) ¥R_TIMES ((fq~[i0]) ¥R_MINUS (fq~[j0]))))
		(fq~[i0], (fp~[i0]) ¥R_MINUS (fp~[j0]))-->T726(Stat41,Stat47*) ==> abs((fq~[i0]) ¥R_TIMES ((fp~[i0]) ¥R_MINUS (fp~[j0]))) = (abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0])))
		(fp~[j0], (fq~[i0]) ¥R_MINUS (fq~[j0]))-->T726(Stat42,Stat44*) ==> abs((fp~[j0]) ¥R_TIMES ((fq~[i0]) ¥R_MINUS (fq~[j0]))) = (abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))
		EQUAL(Stat56) ==> abs(((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0]))) ¥R_LE ((abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))
		(abs(((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0]))), ((abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))))-->T675(Stat35*) ==> ((abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))) ¥R_GE abs(((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0])))
--
-- ... which in its turn is smaller than or equal to
--	$(m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))$,
--
		ALGEBRA(Stat20,Stat20) ==> Stat58: m ¥R_TIMES R_0 = R_0
		Suppose ==> not((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_GE (abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))))
			(fq~[i0])-->Stat22(Stat38,Stat38*) ==> abs(fq~[i0]) ¥R_LT m
			(abs(fq~[i0]),m)-->T675(Stat35*) ==> m ¥R_GT abs(fq~[i0])
			Suppose ==> abs((fp~[i0]) ¥R_MINUS (fp~[j0])) ¥R_GT R_0
				(m, abs(fq~[i0]), abs((fp~[i0]) ¥R_MINUS (fp~[j0])))-->T705(Stat20*) ==> (m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_GT (abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0])))
			(m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0])), (abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))))-->T675(Stat52*) ==> false; Discharge ==> AUTO
			(abs((fp~[i0]) ¥R_MINUS (fp~[j0])), R_0)-->T675(Stat35*) ==> abs((fp~[i0]) ¥R_MINUS (fp~[j0])) = R_0
			ALGEBRA(Stat43,Stat43) ==> (abs(fq~[i0]) ¥R_TIMES R_0) = R_0
			EQUAL(Stat58*) ==> (m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) = (abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0])))
		((abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))), (m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))))-->T675(Stat35*) ==> false; Discharge ==> AUTO
		Suppose ==> not((m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))) ¥R_GE (abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))
			(fp~[j0])-->Stat24(Stat40,Stat40*) ==> abs(fp~[j0]) ¥R_LT m
			(abs(fp~[j0]),m)-->T675(Stat35*) ==> m ¥R_GT abs(fp~[j0])
			Suppose ==> abs((fq~[i0]) ¥R_MINUS (fq~[j0])) ¥R_GT R_0
				(m, abs(fp~[j0]), abs((fq~[i0]) ¥R_MINUS (fq~[j0])))-->T705(Stat20*) ==> (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))) ¥R_GT (abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))
			(m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])), (abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))-->T675(Stat58*) ==> false; Discharge ==> AUTO
			(abs((fq~[i0]) ¥R_MINUS (fq~[j0])), R_0)-->T675(Stat35*) ==> abs((fq~[i0]) ¥R_MINUS (fq~[j0])) = R_0
			ALGEBRA(Stat46,Stat46) ==> (abs(fp~[j0]) ¥R_TIMES R_0) = R_0
			EQUAL(Stat58*) ==> (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))) = (abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))
		((abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))), (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))-->T675(Stat35*) ==> false; Discharge ==> AUTO
		(m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0])), abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0])), m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])), abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))-->T695(Stat20*) ==>
					((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))) ¥R_GE ((abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0]))))
--
-- ... hence, by exploiting the transitivity laws which the ordering of reals obeys, we
-- get to the absurd conclusion that $eps0 ¥R_GT eps0$.
--
		ALGEBRA(Stat41,Stat42*) ==> (((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0]))) in Re
		(((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0])))-->T723(Stat41*) ==> Stat59: abs(((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0]))) in Re
		(((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))), ((abs(fq~[i0]) ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (abs(fp~[j0]) ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))), abs(((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0]))))-->T668(Stat41*) ==> Stat60:
				((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))) ¥R_GE abs(((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0])))
		(((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))), abs(((fq~[i0]) ¥R_TIMES (fp~[i0])) ¥R_MINUS ((fq~[j0]) ¥R_TIMES (fp~[j0]))), eps0)-->T678(Stat15,Stat59,Stat52,Stat60,Stat36*) ==> Stat61:
				((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))) ¥R_GT eps0
		(eps0, ((m ¥R_TIMES abs((fp~[i0]) ¥R_MINUS (fp~[j0]))) ¥R_PLUS (m ¥R_TIMES abs((fq~[i0]) ¥R_MINUS (fq~[j0])))), eps0)-->T678(Stat15,Stat52,Stat53,Stat61*) ==> eps0 ¥R_GT eps0
	(eps0,eps0)-->T675(Stat58*) ==> false; Discharge ==> AUTO
	(Stat32*)ELEM ==> { (i * j) : i in Za, j in Za | abs(((fq ¥Res_TIMES fp)~[i]) ¥R_MINUS ((fq ¥Res_TIMES fp)~[j])) ¥R_GT eps0 } ¥incin {(i*j): i in Za, j in Za | (abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps2) or (abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps1)}
--
-- Since the inclusion just proved entails that the set on the left-hand side is finite,
-- we have reached the desired contradiction, proving the statement of the present theorem.
--
({(i*j): i in Za, j in Za | (abs((fq~[i]) ¥R_MINUS (fq~[j])) ¥R_GT eps1) or (abs((fp~[i]) ¥R_MINUS (fp~[j])) ¥R_GT eps2)}, { i * j : i in Za, j in Za | abs(((fq ¥Res_TIMES fp)~[i]) ¥R_MINUS ((fq ¥Res_TIMES fp)~[j])) ¥R_GT eps0 })-->T189(Stat15) ==> false; Discharge ==> QED
--
--
--
-- A sequence $g$ of rational numbers is said to be an approximating sequence for a real number $r$
-- if $Cauchy_to_Re(g) = r$. $g$ is said to be an approximating sequence for a  real sequence $f$ if
-- for each positive real $eps$, the set of $n in domain(f)$ such that $abs(ReRa(g(n)) - f(n)) ¥R_GT eps$
-- is finite.
--
Def 79: [Approximating rational sequence for a real sequence] Ra_apseq(F,G) := (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
			Finite({x : x in domain(G) | (abs(ReRa(G~[x]) ¥R_MINUS (F~[x])) ¥R_GT eps)}))
--
Def 79a: Ra_approx(F) := arb({g in RaCauchy | Ra_apseq(F,g)})
--
-- The limit of a real Cauchy sequence is the real number defined by any of its approximating
-- rational sequences (all of which are the same).
--
Def 80:  [Limit of a real Cauchy sequence] limit(F) := Cauchy_to_Re(arb({g in RaCauchy | Ra_apseq(F,g)}))
--
Theorem 765: [Every real Cauchy sequence can be approximated by a rational sequence] (F in ReCauchy) ¥imp (0 /= {g in RaCauchy | Ra_apseq(F,g)}). Proof:
Suppose_not(f0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem 766: [Every real Cauchy sequence has a real limit] (F in ReCauchy) ¥imp ((Ra_approx(F) in RaCauchy) & (Ra_approx(F) in RaSeq) & Ra_apseq(F,Ra_approx(F)) & (limit(F) in Re)). Proof:
Suppose_not(f0) ==> AUTO
	Use_def(Ra_approx(f0)) ==> AUTO
	f0-->T765 ==> Stat1: Ra_approx(f0) in {g in RaCauchy | Ra_apseq(f0,g)}
	()-->Stat1(*) ==> Stat2: (Ra_approx(f0) in RaCauchy) & (not((Ra_approx(f0) in RaSeq) & (limit(f0) in Re)))
	T539(Stat2*) ==> Stat3: limit(f0) notin Re
	Use_def(limit(f0)) ==> AUTO
	Use_def(Ra_approx(f0)) ==> AUTO
	EQUAL(Stat3) ==> Cauchy_to_Re(Ra_approx(f0)) notin Re
(Ra_approx(f0),Ra_approx(f0))-->T610(Stat2*) ==> false; Discharge ==> QED
--
-- Our next theorem establishes the assertion concerning limits stated above, by showing that
-- if $F$ is a Cauchy sequence of reals, and $G$ is a sequence of rationals approximating $F$,
-- then $G$ is a Cauchy seqence of rationals, and $Cauchy_to_Re(G) = limit(F)$.
--
Theorem 767: [The limit of a real Cauchy sequence is the real defined by any of its rational approximations] ((F in ReCauchy) & (G in RaSeq) & Ra_apseq(F,G)) ¥imp ((G in RaCauchy) & (Cauchy_to_Re(G) = limit(F))). Proof:
Suppose_not(f0,g0) ==> AUTO
	Use_def(Ra_apseq) ==> Stat1: (FORALL eps in Re | (eps ¥R_GT R_0) ¥imp
		Finite({x : x in domain(g0) | (abs(ReRa(g0~[x]) ¥R_MINUS (f0~[x])) ¥R_GT eps)}))
	Suppose ==> g0 notin RaCauchy
	Tsomehow ==> false; Discharge ==> Stat2: (g0 in RaCauchy) & Ra_apseq(f0,g0)
	Use_def(limit)(*) ==> Cauchy_to_Re(g0) /= Cauchy_to_Re(arb({g in RaCauchy | Ra_apseq(f0,g)}))
	Loc_def ==> Stat3: g1 = arb({g in RaCauchy | Ra_apseq(f0,g)})
	Suppose ==> not(g1 in {g in RaCauchy | Ra_apseq(f0,g)})
		{g in RaCauchy | Ra_apseq(f0,g)}-->T0(Stat3*) ==> Stat4: g0 notin {g in RaCauchy | Ra_apseq(f0,g)}
	g0-->Stat4(Stat2,Stat2*) ==> false; Discharge ==> Stat5: g1 in {g in RaCauchy | Ra_apseq(f0,g)}
	()-->Stat5(Stat5*) ==> Stat6: (g1 in RaCauchy) & Ra_apseq(f0,g1)
	EQUAL(Stat2) ==> Cauchy_to_Re(g0) /= Cauchy_to_Re(g1)
	(g0,g1)-->T610(Stat2*) ==> (not Ra_eqseq(g0,g1)) & (Cauchy_to_Re(g0) in Re)
	T539(Stat2,Stat6*) ==> {g0,g1} ¥incin RaSeq
	(g0,g1)-->T541(Stat6*) ==> Stat7: (not (FORALL eps in Ra | (eps ¥Ra_GT Ra_0) ¥imp
		Finite({x : x in Za | Ra_ABS((g0~[x]) ¥Ra_MINUS (g1~[x])) ¥Ra_GT eps})))
	eps0-->Stat7(Stat7*) ==> (eps0 in Ra) & (eps0 ¥Ra_GT Ra_0) &
		(not Finite({x : x in Za | Ra_ABS((g0~[x]) ¥Ra_MINUS (g1~[x])) ¥Ra_GT eps0}))
Tsomehow ==> false; Discharge ==> QED
--
-- It is easily seen that the 'approximation' relationship we have introduced is
-- additive and multiplicative.
--
Theorem 768: [The elementary operations on reals map Cauchy sequences into Cauchy sequences] ((F in ReCauchy) & (G in ReCauchy) & (Fp in RaCauchy) & (Gp in RaCauchy) & Ra_apseq(F,Fp) & Ra_apseq(G,Gp)) ¥imp
			((((F ¥Res_PLUS G in ReCauchy) & Ra_apseq(F ¥Res_PLUS G,Fp ¥Ras_PLUS Gp))) &
			(((F ¥Res_MINUS G in ReCauchy) & Ra_apseq(F ¥Res_MINUS G,Fp ¥Ras_MINUS Gp))) &
			(((F ¥Res_TIMES G in ReCauchy) & Ra_apseq(F ¥Res_TIMES G,Fp ¥Ras_TIMES Gp)))). Proof:
Suppose_not(f0,g0,f1,g1) ==> AUTO
	(f0,g0)-->T758 ==> (f0 ¥Res_PLUS g0) in ReCauchy
	(f0,g0)-->T764 ==> ((f0 ¥Res_MINUS g0) in ReCauchy) & ((f0 ¥Res_TIMES g0) in ReCauchy)
Tsomehow ==> false; Discharge ==> QED
--
-- The results just proved can be read as asserting that the limit operation for real sequences
-- is additive and multiplicative.
--
Theorem 769: [The limit of a sum is the sum of limits] ((F in ReCauchy) & (G in ReCauchy)) ¥imp (limit(F ¥Res_PLUS G) = (limit(F) ¥R_PLUS limit(G))). Proof:
Suppose_not(f0,g0) ==> AUTO
	f0-->T766(*) ==> Ra_apseq(f0,Ra_approx(f0)) & (Ra_approx(f0) in RaCauchy)
	g0-->T766(*) ==> Ra_apseq(g0,Ra_approx(g0)) & (Ra_approx(g0) in RaCauchy)
	(f0,g0,Ra_approx(f0),Ra_approx(g0))-->T768(*) ==> ((f0 ¥Res_PLUS g0) in ReCauchy) & Ra_apseq(f0 ¥Res_PLUS g0,Ra_approx(f0) ¥Ras_PLUS Ra_approx(g0))
	T539(*) ==> {Ra_approx(f0),Ra_approx(g0)} ¥incin RaSeq
	(Ra_approx(f0),Ra_approx(g0))-->T554(*) ==> (Ra_approx(f0) ¥Ras_PLUS Ra_approx(g0)) in RaSeq
	(f0 ¥Res_PLUS g0,Ra_approx(f0) ¥Ras_PLUS Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0) ¥Ras_PLUS Ra_approx(g0)) = limit(f0 ¥Res_PLUS g0)
	(Ra_approx(f0),Ra_approx(g0))-->T616(*) ==> (Cauchy_to_Re(Ra_approx(f0)) ¥R_PLUS Cauchy_to_Re(Ra_approx(g0))) = limit(f0 ¥Res_PLUS g0)
	(f0,Ra_approx(f0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0)) = limit(f0)
	(g0,Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(g0)) = limit(g0)
EQUAL ==> false; Discharge ==> QED
--
Theorem 770: [The limit of a difference is the difference of limits] ((F in ReCauchy) & (G in ReCauchy)) ¥imp (limit(F ¥Res_MINUS G) = limit(F) ¥R_MINUS limit(G)). Proof:
Suppose_not(f0,g0) ==> AUTO
	f0-->T766(*) ==> Ra_apseq(f0,Ra_approx(f0)) & (Ra_approx(f0) in RaCauchy)
	g0-->T766(*) ==> Ra_apseq(g0,Ra_approx(g0)) & (Ra_approx(g0) in RaCauchy)
	(f0,g0,Ra_approx(f0),Ra_approx(g0))-->T768(*) ==> ((f0 ¥Res_MINUS g0) in ReCauchy) & Ra_apseq(f0 ¥Res_MINUS g0,Ra_approx(f0) ¥Ras_MINUS Ra_approx(g0))
	T539(*) ==> {Ra_approx(f0),Ra_approx(g0)} ¥incin RaSeq
	Suppose ==> (Ra_approx(f0) ¥Ras_MINUS Ra_approx(g0)) notin RaSeq
		Use_def(¥Ras_MINUS) ==> (Ra_approx(f0) ¥Ras_PLUS Ras_Rev(Ra_approx(g0))) notin RaSeq
		(Ra_approx(g0),Ra_approx(g0))-->T554(*) ==> Ras_Rev(Ra_approx(g0)) in RaSeq
	(Ra_approx(f0),Ras_Rev(Ra_approx(g0)))-->T554(*) ==> false; Discharge ==> (Ra_approx(f0) ¥Ras_MINUS Ra_approx(g0)) in RaSeq
	(f0 ¥Res_MINUS g0,Ra_approx(f0) ¥Ras_MINUS Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0) ¥Ras_MINUS Ra_approx(g0)) = limit(f0 ¥Res_MINUS g0)
	Suppose ==> Cauchy_to_Re(Ra_approx(f0) ¥Ras_MINUS Ra_approx(g0)) /= (Cauchy_to_Re(Ra_approx(f0)) ¥R_MINUS Cauchy_to_Re(Ra_approx(g0)))
		Use_def(¥Ras_MINUS)(*) ==> Cauchy_to_Re(Ra_approx(f0) ¥Ras_PLUS Ras_Rev(Ra_approx(g0))) /= (Cauchy_to_Re(Ra_approx(f0)) ¥R_MINUS Cauchy_to_Re(Ra_approx(g0)))
		(Ra_approx(g0),Ra_approx(g0))-->T556(*) ==> Ras_Rev(Ra_approx(g0)) in RaCauchy
		(Ra_approx(f0),Ras_Rev(Ra_approx(g0)))-->T616(*) ==> (Cauchy_to_Re(Ra_approx(f0)) ¥R_PLUS Cauchy_to_Re(Ras_Rev(Ra_approx(g0)))) /= (Cauchy_to_Re(Ra_approx(f0)) ¥R_MINUS Cauchy_to_Re(Ra_approx(g0)))
		(Ra_approx(g0))-->T622(*) ==> Cauchy_to_Re(Ras_Rev(Ra_approx(g0))) = R_Rev(Cauchy_to_Re(Ra_approx(g0)))
		(Ra_approx(f0),Ra_approx(f0))-->T610(*) ==> Cauchy_to_Re(Ra_approx(f0)) in Re
		(Ra_approx(g0),Ra_approx(g0))-->T610(*) ==> Cauchy_to_Re(Ra_approx(g0)) in Re
		(Cauchy_to_Re(Ra_approx(f0)),Cauchy_to_Re(Ra_approx(g0)))-->T635(*) ==> (Cauchy_to_Re(Ra_approx(f0)) ¥R_MINUS Cauchy_to_Re(Ra_approx(g0))) = (Cauchy_to_Re(Ra_approx(f0)) ¥R_PLUS R_Rev(Cauchy_to_Re(Ra_approx(g0))))
	EQUAL ==> false; Discharge ==> (Cauchy_to_Re(Ra_approx(f0)) ¥R_MINUS Cauchy_to_Re(Ra_approx(g0))) = limit(f0 ¥Res_MINUS g0)
	(f0,Ra_approx(f0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0)) = limit(f0)
	(g0,Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(g0)) = limit(g0)
EQUAL ==> false; Discharge ==> QED
--
Theorem 771: [The limit of a product is the product of limits] ((F in ReCauchy) & (G in ReCauchy)) ¥imp (limit(F ¥Res_TIMES G) = limit(F) ¥R_TIMES limit(G)).Proof:
Suppose_not(f0,g0) ==> AUTO
	f0-->T766(*) ==> Ra_apseq(f0,Ra_approx(f0)) & (Ra_approx(f0) in RaCauchy)
	g0-->T766(*) ==> Ra_apseq(g0,Ra_approx(g0)) & (Ra_approx(g0) in RaCauchy)
	(f0,g0,Ra_approx(f0),Ra_approx(g0))-->T768(*) ==> ((f0 ¥Res_TIMES g0) in ReCauchy) & Ra_apseq(f0 ¥Res_TIMES g0,Ra_approx(f0) ¥Ras_TIMES Ra_approx(g0))
	T539(*) ==> {Ra_approx(f0),Ra_approx(g0)} ¥incin RaSeq
	T211(*) ==> 0 in Za
	(Ra_approx(f0),Ra_approx(g0),0)-->T555(*) ==> (Ra_approx(f0) ¥Ras_TIMES Ra_approx(g0)) in RaSeq
	(f0 ¥Res_TIMES g0,Ra_approx(f0) ¥Ras_TIMES Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0) ¥Ras_TIMES Ra_approx(g0)) = limit(f0 ¥Res_TIMES g0)
	(Ra_approx(f0),Ra_approx(g0))-->T619(*) ==> (Cauchy_to_Re(Ra_approx(f0)) ¥R_TIMES Cauchy_to_Re(Ra_approx(g0))) = limit(f0 ¥Res_TIMES g0)
	(f0,Ra_approx(f0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0)) = limit(f0)
	(g0,Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(g0)) = limit(g0)
EQUAL ==> false; Discharge ==> QED
--
-- If we make an additional hypothesis forbidding division by zero, a theorem like those just
-- stated applies to division also.
--
Theorem 772: [The limit of a quotient is the quotient of limits, provided that the denominator limit  is non-zero] ((F in ReCauchy) & (G in ReCauchy) & (limit(G) /= R_0)) ¥imp (limit(F ¥Res_OVER G) = limit(F) ¥R_OVER limit(G)). Proof:
Suppose_not(f0,g0) ==> AUTO
	f0-->T766(*) ==> Ra_apseq(f0,Ra_approx(f0)) & (Ra_approx(f0) in RaCauchy)
	g0-->T766(*) ==> Ra_apseq(g0,Ra_approx(g0)) & (Ra_approx(g0) in RaCauchy)
--	(f0,g0,Ra_approx(f0),Ra_approx(g0))-->T768(*) ==> ((f0 ¥Res_TIMES g0) in ReCauchy) & Ra_apseq(f0 ¥Res_TIMES g0,Ra_approx(f0) ¥Ras_TIMES Ra_approx(g0))
--	T539(*) ==> {Ra_approx(f0),Ra_approx(g0)} ¥incin RaSeq
--	T211(*) ==> 0 in Za
--	(Ra_approx(f0),Ra_approx(g0),0)-->T555(*) ==> (Ra_approx(f0) ¥Ras_TIMES Ra_approx(g0)) in RaSeq
--	(f0 ¥Res_TIMES g0,Ra_approx(f0) ¥Ras_TIMES Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0) ¥Ras_TIMES Ra_approx(g0)) = limit(f0 ¥Res_TIMES g0)
--	(Ra_approx(f0),Ra_approx(g0))-->T619(*) ==> (Cauchy_to_Re(Ra_approx(f0)) ¥R_TIMES Cauchy_to_Re(Ra_approx(g0))) = limit(f0 ¥Res_TIMES g0)
--	(f0,Ra_approx(f0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0)) = limit(f0)
--	(g0,Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(g0)) = limit(g0)
-- EQUAL ==> false; Discharge ==>
Tsomehow ==> false; Discharge ==> QED
--
Theorem 773: [Any real $x$ is included between two rationals which can be arbitrarily close together] ((X in Re) & (EPS in Re) & (EPS ¥R_GT R_0)) ¥imp (EXISTS r1 in Ra, r2 in Ra | ((ReRa(r1) ¥R_GT X) & (X ¥R_GT ReRa(r2)) & (ReRa(r1 ¥Ra_MINUS r2) ¥R_LE EPS))). Proof:
Suppose_not(x0,eps0) ==> (x0 in Re) & (eps0 in Re) & (eps0 ¥R_GT R_0) & Stat1: (not(EXISTS r1 in Ra, r2 in Ra  | ((ReRa(r1) ¥R_GT x0) & (x0 ¥R_GT ReRa(r2)) & (ReRa(r1 ¥Ra_MINUS r2) ¥R_LE eps0))))
--
-- For suppose that the real numbers $x0$ and $eps0$ are counterexamples to our assertion.
-- It is clear that $eps0$ is nonzero, and so by Theorem 562 there is a positive rational $r$
-- such that all but a finite number of components of the Cauchy sequence $arb(eps)$
-- have an absolute value greater than $r$ for all but a finite number of elements.
--
	ALGEBRA ==> Ra_0 in Ra
	(eps0,R_0)-->T673(*) ==> Stat2: (eps0 ¥R_GE R_0) & (eps0 /= R_0)
	eps0-->T611(*) ==> (arb(eps0) in RaCauchy) & (Cauchy_to_Re(arb(eps0)) = eps0)
	Suppose ==> Ra_eqseq(arb(eps0),Ra0Seq)
		T545(Stat3*) ==> Stat3: Ra0Seq in RaCauchy
		(arb(eps0),Ra0Seq)-->T610(Stat2*) ==> eps0 = Cauchy_to_Re(Ra0Seq)
	Use_def(R_0)(Stat2*) ==> false; Discharge ==> (not Ra_eqseq(arb(eps0),Ra0Seq))
	(arb(eps0))-->T562(Stat2*) ==> (EXISTS r in Ra | (r ¥Ra_GT Ra_0) & Finite({i in Za | r ¥Ra_GE Ra_ABS((arb(eps0))~[i])}))
--
-- But since $arb(eps0)$ and $Ras_ABS(arb(eps0))$ are equivalent Cauchy sequences,
-- all but a finite number of the components of $arb(eps0)$ must be larger than $r/2$.
--
	(arb(eps0),arb(eps0))-->T556(Stat2*) ==> Ras_ABS(arb(eps0)) in RaCauchy
	T539(Stat2*) ==> Stat4: (arb(eps0) in RaSeq) & (Ras_ABS(arb(eps0)) in RaSeq)
	Suppose ==> not(Ra_eqseq(arb(eps0),Ras_ABS(arb(eps0))))
		(arb(eps0),Ras_ABS(arb(eps0)))-->T541(Stat4*) ==> not(FORALL e in Ra | (e ¥Ra_GT Ra_0) ¥imp Finite({x: x in Za | Ra_ABS(((arb(eps0))~[x]) ¥Ra_MINUS (Ras_ABS(arb(eps0))~[x])) ¥Ra_GT e}))
	Tsomehow ==> false; Discharge ==> AUTO
--
-- Since $arb(x0)$ is a Cauchy sequence, all its components $arb(x0)~[i]$ beyond a certain $arb(x0)~[j]$
-- must differ from $arb(x0)~[j]$ by less than $ReRa(r/8)$.
-- Thus the components of $arb(x0) ¥Ra_MINUS (Za ¥PROD {(arb(x0)~[j] ¥Ra_MINUS ReRa(r/8))})$ must be positive
-- beyond a certain point, while those of $arb(x0) ¥Ra_MINUS (Za ¥PROD {(arb(x0)~[j] ¥Ra_PLUS ReRa(r/8))})$
-- must be negative.
--

--
-- It follows that $x0 ¥R_GT ReRa(arb(x0)~[j] ¥Ra_MINUS ReRa(r/4))$ and $x0 ¥R_LT ReRa(arb(x0)~[j] ¥Ra_PLUS ReRa(r/4))$.
-- But since the two rationals $arb(x0)~[j] ¥Ra_MINUS ReRa(r/4)$ and $arb(x0)~[j] ¥Ra_PLUS ReRa(r/4)$ differ
-- by $r/2$, and $ReRa(r/4) ¥R_LE eps0$, we have contradicted Stat2 and thereby proved our theorem.
--
Tsomehow ==> false; Discharge ==> QED
--
Theorem 774: [For any real $x$, there exists a rational $r$ such that $r >= x$] (X in Re) ¥imp (EXISTS r in Ra | ReRa(r) ¥R_GT X). Proof:
	Suppose_not(x) ==> AUTO
-- For $R_1 ¥R_GT R_0$, and so by Theorem 773 there exists an $r1 in Ra$ such that $ReRa(r1) ¥R_GT x$,
-- proving our assertion
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 775: [Any rational $r$ is the quotient of two signed integers, of which the second is positive] (x in Ra) ¥imp (EXISTS m in Si, n in Si | ((n ¥S_GE [1,0]) & (x = RaSi(m) ¥Ra_OVER RaSi(n)))). Proof:
	Suppose_not(r) ==> AUTO
-- For by Theorem *** the fraction arb(r) is a pair [m,n] of signed integers with n /= [0,0].
-- If n ¥SI_GT [0,0] we must have n ¥SI_GE [1,0] and so our assertion is obvious, while if n ¥SI_LT [0,0]
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 776: [For any rational $r$, there exists an integer $n$ such that $n >= r$] (R in Ra) ¥imp (EXISTS n in Za | RaSi(SiZa(n)) ¥Ra_GE R). Proof:
	Suppose_not(r) ==> AUTO
-- For by Theorem 775 the r can be written as a pair [m,n] of signed integers, the second being positive.
-- Writing S_abs(m) as [k,0] where k in Za, it is easily seen that RaSi(SiZa(k)) ¥R_GE x
	r-->T775 ==> Stat1: (EXISTS m in Si, n in Si | ((n ¥S_GE [1,0]) & (r = RaSi(m) ¥Ra_OVER RaSi(n))))
	(m,n)-->Stat1 ==> (m in Si) & (n in Si) & (n ¥S_GE [1,0])  & (r = RaSi(m) ¥Ra_OVER RaSi(n))
--?	Discharge ==> RaSi(m) ¥Ra_GE RaSi([1,0])
	Tsomehow ==> false; Discharge ==> QED

Theorem 777: [For any real $x$, there exists an integer $n$ such that $n > x$] (X in Re) ¥imp (EXISTS n in Za | ReRa(RaSi(SiZa(n))) ¥R_GT X). Proof:
	Suppose_not(x) ==> AUTO
-- Indeed, by Theorem 774 there is a rational r such that ReRa(r) ¥R_GT x, and by Theorem 776 there is an integer
-- n such that RaSi(SiZa(n)) ¥R_GE r. Since it is then clear that ReRa(RaSi(SiZa(n))) ¥R_GT x, our theorem is proved.
	Tsomehow ==> false; Discharge ==> QED

Theorem 778: [For any real $x$ and $eps > 0$, there exists an integer $n$ such that $n ¥ eps > x$] ((X in Re) & (Eps in Re) & (Eps ¥R_GT R_0)) ¥imp (EXISTS n in Za | ((ReRa(RaSi(SiZa(n))) ¥R_TIMES Eps) ¥R_GT X)). Proof:
	Suppose_not(x,eps) ==> AUTO
-- Indeed, by Theorem 777 there is an integer $n$ greater than $x/eps$, from which it is easily seen that $(ReRa(RaSi(SiZa(n))) ¥R_TIMES e) ¥R_GT x$
	Tsomehow ==> false; Discharge ==> QED

Theorem 779: [For any real $x$ and $eps > 0$, there exists an integer $n$ such that $eps > x/n$] ((X in Re) & (Eps in Re) & (Eps ¥R_GT R_0)) ¥imp (EXISTS n in Za | (Eps ¥R_GT (X ¥R_OVER ReRa(RaSi(SiZa(n)))))). Proof:
	Suppose_not(x,eps) ==> AUTO
-- Indeed, by Theorem 778 there is an integer $n$ such that n ¥ eps > x, from which our assertion is immediate.
	Tsomehow ==> false; Discharge ==> QED

Theorem 780: [For any non-negative real $x$ and $eps > 0$, there exists an integer $n$ such that $n ¥R_TIMES eps > x$ and $(n - 1) ¥ eps <= x$] ((X in Re) & (Eps in Re) & (Eps ¥R_GT R_0)) ¥imp (EXISTS n in Za | (Eps ¥R_GT (X ¥R_OVER ReRa(RaSi(SiZa(n)))))). Proof:
	Suppose_not(x,eps) ==> AUTO
-- If $x$ is 0 we can take $n = 1$. In the contrary case $x$ is positive, and then $0 ¥R_TIMES x$ is
	Tsomehow ==> false; Discharge ==> QED

Theorem 781: [Every positive real is bounded below by a rational fraction of the form $1/n$]  ((X in Re) & (X ¥R_GT R_0)) ¥imp (EXISTS n in Za | (R_1 ¥R_OVER ReRa(RaSi(SiZa(n)))) ¥R_LT X). Proof:
	Suppose_not(x) ==> AUTO
-- For by Theorem 778 there exists an integer $n$ such that $R_1 ¥R_LT (x ¥R_TIMES ReRa(RaSi(SiZa(n))))$,
-- from which our assertion is immediate.
	Tsomehow ==> false; Discharge ==> QED

-- It is plain that every real number has the approximating rational sequence $arb(x)$.
-- The following elementary result extends this statement to real Cauchy sequences $g$
-- in general, by showing that every such sequence has at least one (indeed, many) approximating
-- rational Cauchy sequences.

Theorem 782: [Every real Cauchy sequence is approximated by a rational Cauchy sequence] (F in ReCauchy) ¥imp (EXISTS g in RaCauchy | Ra_apseq(F,g)). Proof:
	Suppose_not(f) ==> AUTO
--
-- It follows from Theorem 773 that for every component $f~[n]$ of our real Cauchy sequence,
-- there exists a rational $r$ such the $R_ABS(f~[n] ¥R_MINUS r) < 1/n$.
--
-- Skolemization of the assertion just proved gives us a sequence $g$ of rationals such that
-- $R_ABS(f~[n] ¥R_MINUS ReRa(g~[n])) < 1/n$
--
-- But then it is easily seen that $g$ is a rational Cauchy sequence which approximates $f$, proving our
-- theorem.
--
	Tsomehow ==> false; Discharge ==> QED

-- Any two approximating rational sequences for a given real Cauchy sequence are equivalent.

Theorem 783: [Any two approximating rational sequences for a given real Cauchy sequence are equivalent]  ((F in ReCauchy) & Ra_apseq(F,G) & Ra_apseq(F,GP)) ¥imp ((G in RaCauchy) & (GP in RaCauchy) & (Cauchy_to_Re(G) = Cauchy_to_Re(GP))). Proof:
	Suppose_not(f,g,gp) ==> AUTO
--
-- For it is easily seen that for each positive rational $eps$, there can be a most finitely many integers
-- $n$ for which $g~[n]$ differs from $gp~[n]$ by ore than $eps$, proving our assertion.
--
	Tsomehow ==> false; Discharge ==> QED

Theorem 784: [For any non-empty set $s$ of reals which is bounded above, and for any positive real $eps$, there exists an $u in s$ such that $u + eps$ is an upper bound of $s$] ((S ¥incin Re) & (S /= 0) & (Eps in Re) & (Eps ¥R_GT R_0) & (Y in Re) & (FORALL x in S | Y ¥R_GE x)) ¥imp (EXISTS u in S | (FORALL x in S | u ¥R_GE x)). Proof:
	Suppose_not(s,eps,y) ==> AUTO
--
-- We can prove this assertion as follows. Pick a positive integer $k$, consider it as a real number,
-- set $eps = 1/k$, some $v in s$, and consider the sequence $v + n * eps$ for all $n in Za$.
-- Since by Theorem 778 there exists an $n$ for which $(v + n * eps) ¥R_GE y$, there exists
-- some $n$ for which $v + n * eps$ is greater than all the elements of $s$, but $v + (n - 1) * eps$
-- is not such a strict upper bound, i.e. there exists a $w in s$
-- which is no smaller than $v + (n - 1) * eps$. This gives us a $w$ which belongs to $s$ for which
-- $w + 1/k$ is an upper bound for all of $s$.
--
	Tsomehow ==> false; Discharge ==> QED
--
-- The following theorem states a crucial completeness property of real numbers:
-- every non-empty set of such numbers  which is bounded above has a least upper bound.
--

Theorem 785: [Any bounded set of reals has a least upper bound] ((S ¥incin Re) & (S /= 0) & (EXISTS y in Re | (FORALL x in S | y ¥R_GE x))) ¥imp (EXISTS u in Re | ((FORALL x in S | u ¥R_GE x) & (FORALL v in Re | (v ¥R_LT u ¥imp (not (FORALL x in s | v ¥R_GE x)))))). Proof:
	Suppose_not(s) ==> AUTO
--
-- Our basic idea is to construct a Cauchy sequence of elements of $s$ which converges to
-- an upper bound of $s$.
-- For this, we Skolemize the preceding assertion, thereby obtaining a sequence $g~[k]$ of elements of
-- $s$ such that $g~[k] + 1/k$
-- is an upper bound for all the elements of $s$. It follows that $(g~[k] + 1/k) ¥R_GE g~[j]$ for all
-- positive integers $k$ and $j$,
-- and since $(g~[j] + 1/j) ¥R_GE g~[k]$, $g$ is clearly a Cauchy sequence.
--
-- Let $lm$ be the limit of this Cauchy sequence. It is easily seen that $lm$ is an upper bound for $s$.
-- But since lm can be no larger than any upper bound of $s$, it must be the least upper bound
-- whose existence our theorem asserts.
--
	Tsomehow ==> false; Discharge ==> QED

-- A real function is said to be continuous if it maps real Cauchy sequences into
-- real Cauchy sequences.

Def 81: [Real functions of a real variable continuous on a set S] Cf_RR(F,S) := ((domain(F) = S) & (range(F) ¥incin Re) & Svm(F) & Svm(F) &
				(FORALL G in ReCauchy | (((range(G) ¥incin S) & (limit(F) in S)) ¥imp (F @ G in ReCauchy))))

--
-- The important exponential function x ** n can be defined by applying the 'finite_tailrecursive_fcn1' THEORY discussed previously
--
APPLY(trech_thryvar:ToThe1) finite_tailrecursive_fcn1(f(t)->R_1,g3(a,x,t)->(a ¥R_TIMES t)) ==>
	Theorem 786: (FORALL s, t | Finite(s) ¥imp (ToThe1(s,t) = if (s = 0) then R_1 else (ToThe1(s - {arb(s)},t) ¥R_TIMES t) end if))
--
-- One easily proves that the function just introduced provides a real result when its second parameter is real and
-- its first parameter is a finite set, e.g. an unsigned integer. Moreover, what counts of its second parameter is only
-- its cardinality.
--
Theorem 787a: (Finite(S) & (T in Re)) ¥imp (ToThe1(S,T) in Re). Proof+:
Suppose_not(s1,t0) ==> AUTO
	T786 ==> Stat1: (FORALL s, t | Finite(s) ¥imp (ToThe1(s,t) = if (s = 0) then R_1 else (ToThe1(s - {arb(s)},t) ¥R_TIMES t) end if))
	APPLY(m1_thryvar:s0) finite_induction(n->s1,P(x)->(ToThe1(x,t0) notin Re)) ==>
		Stat2: (FORALL k ¥incin s0 | (k /= s0) ¥imp (not(ToThe1(k,t0) notin Re))) & (s0 ¥incin s1) & (ToThe1(s0,t0) notin Re)
	(s0,t0)-->Stat1(*) ==> ToThe1(s0,t0) = if (s0 = 0) then R_1 else (ToThe1(s0 - {arb(s0)},t0) ¥R_TIMES t0) end if
	Suppose ==> s0 = 0
		(Stat2*)ELEM ==> R_1 notin Re
		ALGEBRA ==> false
	(Stat2*)Discharge ==> AUTO
	(s0 - {arb(s0)},t0)-->Stat2(Stat2) ==> ToThe1(s0 - {arb(s0)},t0) in Re
	(Stat2*)ELEM ==> ToThe1(s0,t0) = ToThe1(s0 - {arb(s0)},t0) ¥R_TIMES t0
	ALGEBRA ==> false; Discharge ==> QED
--
Theorem 787b: Finite(S) ¥imp (ToThe1(S,T) = ToThe1(#S,T)). Proof+:
Suppose_not(s1,t0) ==> AUTO
	T786 ==> Stat1: (FORALL s, t | Finite(s) ¥imp (ToThe1(s,t) = if (s = 0) then R_1 else (ToThe1(s - {arb(s)},t) ¥R_TIMES t) end if))
	Loc_def ==> n1 = #s1
	Suppose ==> not(EXISTS s | (#s = n1) & (ToThe1(s,t0) /= ToThe1(n1,t0)))
		EQUAL ==> Stat2: not(EXISTS s | (#s = #s1) & (ToThe1(s,t0) /= ToThe1(#s1,t0)))
		s1-->Stat2(*) ==> false
	Discharge ==> (EXISTS s | (#s = n1) & (ToThe1(s,t0) /= ToThe1(n1,t0)))
	APPLY(m2_thryvar:n0) mathematical_induction(n->n1,P(x)->(EXISTS s | (#s = x) & (ToThe1(s,t0) /= ToThe1(x,t0)))) ==>
		Stat3: (FORALL k in n0 | not(EXISTS s | (#s = k) & (ToThe1(s,t0) /= ToThe1(k,t0)))) & (n0 in Za) & Stat4: (EXISTS s | (#s = n0) & (ToThe1(s,t0) /= ToThe1(n0,t0)))
	s0-->Stat4(Stat3*) ==> (#s0 = n0) & (ToThe1(s0,t0) /= ToThe1(n0,t0))
	s0-->T162 ==> AUTO
	Suppose ==> n0 = 0
		(Stat3*)ELEM ==> s0 = n0
		EQUAL ==> false
	Discharge ==> AUTO
	n0-->T164(Stat3) ==> Stat5: (arb(s0) in s0) & (arb(n0) in n0) & Finite(n0) & (n0 = #n0)
	EQUAL(Stat3) ==> Finite(#s0)
	(s0,t0)-->Stat1(Stat5*) ==> ToThe1(s0,t0) = ToThe1(s0 - {arb(s0)},t0) ¥R_TIMES t0
	(n0,t0)-->Stat1(Stat5*) ==> ToThe1(n0,t0) = ToThe1(n0 - {arb(n0)},t0) ¥R_TIMES t0
	Suppose ==> ToThe1(s0 - {arb(s0)},t0) = ToThe1(n0 - {arb(n0)},t0)
		EQUAL(Stat3) ==> false
	Discharge ==> AUTO
	(n0,arb(n0))-->T305a(Stat5*) ==> #(n0 - {arb(n0)}) = #n0 ¥MINUS 1
	(s0,arb(s0))-->T305a(Stat5*) ==> #(s0 - {arb(s0)}) = #s0 ¥MINUS 1
	EQUAL(Stat3) ==> (#(n0 - {arb(n0)}) = n0 ¥MINUS 1) & (#(s0 - {arb(s0)}) = n0 ¥MINUS 1)
	Suppose ==> n0 ¥MINUS 1 notin n0
		(1,n0)-->T29 ==> AUTO
		n0-->T268 ==> AUTO
		TELEM ==> (0 in 1) & (1 in Za) & (1 = {0})
		(1,n0,0)-->T299(Stat3*) ==> false
	Discharge ==> AUTO
	(n0 ¥MINUS 1)-->Stat3(Stat5*) ==> Stat6: not(EXISTS s | (#s = n0 ¥MINUS 1) & (ToThe1(s,t0) /= ToThe1(n0 ¥MINUS 1,t0)))
	(s0 - {arb(s0)})-->Stat6(Stat5*) ==> ToThe1(s0 - {arb(s0)},t0) = ToThe1(n0 ¥MINUS 1,t0)
--??	(n0 - {arb(n0)})-->Stat6(Stat5*) ==> ToThe1(n0 - {arb(n0)},t0) = ToThe1(n0 ¥MINUS 1,t0) -- Why's this step unnecessary?
	EQUAL(Stat3) ==> false	
	Discharge ==> QED
--
-- It is conventional and more convenient to represent the exponential function in infix form.
--
Def 81a: [Powers of a real number] Def(X ¥ToThe N) := ToThe1(N,X)
--
-- We can restate the immediately preceding Theorem 786 in the following familiar form.
--
--
Theorem 787: ((N in Za) & (X in Re)) ¥imp ((X ¥ToThe N) = if (N = 0) then R_1 else X ¥R_TIMES (X ¥ToThe (N ¥MINUS 1)) end if). Proof+:
Suppose_not(n1,x0) ==> AUTO
	TELEM ==> 1 in Za
	(n1,1)-->T283 ==> (n1 ¥MINUS 1) in Za
	(n1 ¥MINUS 1,x0)-->T787a(*) ==> ToThe1(n1 ¥MINUS 1, x0) in Re
	Use_def(¥ToThe) ==> ToThe1(n1,x0) /= if (n1 = 0) then R_1 else x0 ¥R_TIMES ToThe1(n1 ¥MINUS 1, x0) end if
	ALGEBRA ==> ToThe1(n1,x0) /= if (n1 = 0) then R_1 else ToThe1(n1 ¥MINUS 1, x0) ¥R_TIMES x0 end if
	APPLY(m2_thryvar:n0) mathematical_induction(n->n1,P(x)->(ToThe1(x,x0) /= if (x = 0) then R_1 else ToThe1(x ¥MINUS 1,x0) ¥R_TIMES x0 end if)) ==>
		Stat1: (FORALL k in n0 | not(ToThe1(k,x0) /= if (k = 0) then R_1 else ToThe1(k ¥MINUS 1,x0) ¥R_TIMES x0 end if)) & 
		(n0 in Za) & (ToThe1(n0,x0) /= if (n0 = 0) then R_1 else ToThe1(n0 ¥MINUS 1,x0) ¥R_TIMES x0 end if)
	T786 ==> Stat2: (FORALL s, t | Finite(s) ¥imp (ToThe1(s,t) = if (s = 0) then R_1 else (ToThe1(s - {arb(s)},t) ¥R_TIMES t) end if))
	n0-->T164(Stat1) ==> Finite(n0) & Finite(n0 - {arb(n0)}) & (n0 = #n0) & Finite(0)
	(n0,x0)-->Stat2(Stat2*) ==> ToThe1(n0,x0) = if (n0 = 0) then R_1 else (ToThe1(n0 - {arb(n0)},x0) ¥R_TIMES x0) end if
	Suppose ==> n0 = 0
	(Stat1*)Discharge ==> AUTO
	Suppose ==> Stat3: ToThe1(n0 - {arb(n0)},x0) = ToThe1(n0 ¥MINUS 1,x0)
		(Stat1*)ELEM ==> ToThe1(n0 - {arb(n0)},x0) ¥R_TIMES x0 /= ToThe1(n0 ¥MINUS 1,x0) ¥R_TIMES x0
		EQUAL(Stat3) ==> false
	Discharge ==> AUTO
	n0-->T0(Stat2*) ==> arb(n0) in n0
	Suppose ==> #(n0 - {arb(n0)}) = #n0 ¥MINUS 1
		(n0 - {arb(n0)},x0)-->T787b(Stat2*) ==> ToThe1(#(n0 - {arb(n0)}),x0) /= ToThe1(n0 ¥MINUS 1,x0)
		EQUAL(Stat2) ==> false
	Discharge ==> AUTO
	(n0,arb(n0))-->T305a(Stat2*) ==> false
	Discharge ==> QED
--
-- The usual recursive proofs can be used to establish the familiar properties of the exponential function.
--
Theorem 788: (X in Re) ¥imp ((X ¥ToThe 0 = R_1) & (X ¥ToThe 1 = X) & (((M in Za) & (N in Za)) ¥imp (X ¥ToThe (M ¥PLUS N) = (X ¥ToThe M) ¥R_TIMES (X ¥ToThe N)))). Proof:
Suppose_not(x0,m0,n0) ==> AUTO
	T786 ==> Stat1: (FORALL s, t | Finite(s) ¥imp (ToThe1(s,t) = if (s = 0) then R_1 else (ToThe1(s - {arb(s)},t) ¥R_TIMES t) end if))
	TELEM ==> Finite(0)
	(0,x0)-->Stat1(Stat1*) ==> ToThe1(0,x0) = R_1
	Use_def(¥ToThe) ==> Stat2: (x0 in Re) & (not((ToThe1(1,x0) = x0) & (((m0 in Za) & (n0 in Za)) ¥imp (ToThe1(m0 ¥PLUS n0,x0) = ToThe1(m0,x0) ¥R_TIMES ToThe1(n0,x0)))))
	Tsomehow ==> false; Discharge ==> QED
--
-- Another familiar property of the exponential function is as follows.
--
Theorem 789: ((X in Re) & (M in Za) & (N in Za)) ¥imp (((X ¥ToThe M) ¥ToThe N) = (X ¥ToThe (M ¥TIMES N))). Proof:
Suppose_not(x0,m0,n0) ==> AUTO
	Use_def(¥ToThe) ==> Stat1: (x0 in Re) & (m0 in Za) & (n0 in Za) & (ToThe1(n0,ToThe1(m0,x0)) /= ToThe1(m0 ¥TIMES n0,x0))
	Tsomehow ==> false; Discharge ==> QED
--
-- It is now easy to define general polynomial functions of a real variable. We begin by defining
-- the sum of a finite series of reals.
--
--APPLY(sigma_thryvar:R_SIGMA) sigma_theory(s->Re,pluz(x,y)->x ¥R_PLUS y,e->R_0) ==>
Theorem 790: (R_SIGMA(0) = R_0) &
	(FORALL x in OM | (cdr(x) in Re) ¥imp (R_SIGMA({x}) = cdr(x))) &
	(FORALL f in OM | (Finite(f) & (range(f) ¥incin Re)) ¥imp (R_SIGMA(f) in Re)) &
	(FORALL f in OM, c in f | (Finite(f) & (range(f) ¥incin Re)) ¥imp (R_SIGMA(f) = R_SIGMA(f - {c}) ¥R_PLUS cdr(c))) &
	(FORALL f in OM | (Finite(f) & Is_map(f) & (range(f) ¥incin Re)) ¥imp
	(FORALL t | R_SIGMA(f) = R_SIGMA(f ¥ON (domain(f) * t)) ¥R_PLUS R_SIGMA(f ¥ON (domain(f) - t)))) &
	(FORALL f in OM, g | (Finite(f) & Svm(f) & Svm(g) & (domain(f) = domain(g)) & (range(f) ¥incin Re)) ¥imp
		(R_SIGMA(f) = R_SIGMA({[y,R_SIGMA(f ¥ON (g ¥INV_IM {y}))]: y in range(g)}))) &
	(FORALL f in OM, g | (Finite(f) & Svm(f) & one_1_map(g) & (domain(f) = domain(g)) & (range(f) ¥incin Re)) ¥imp
		(R_SIGMA(f) = R_SIGMA({[y,f~[inv(g)~[y]]]: y in range(g)})))
--
-- To ease application of the preceding theorem we restate it in a less quantifier-ridden form.
--
Theorem 791: (R_SIGMA(0) = R_0) &
	((cdr(X) in Re) ¥imp (R_SIGMA({X}) = cdr(X))) &
	((Finite(F) & (range(F) ¥incin Re)) ¥imp (R_SIGMA(F) in Re)) &
	((Finite(F) & (range(F) ¥incin Re)) ¥imp (R_SIGMA(F) = R_SIGMA(F - {c}) ¥R_PLUS cdr(c))) &
	((Finite(F) & Is_map(F) & (range(F) ¥incin Re)) ¥imp
		R_SIGMA(F) = R_SIGMA(F ¥ON (domain(F) * T)) ¥R_PLUS R_SIGMA(F ¥ON (domain(F) - T))) &
	((Finite(F) & Svm(F) & Svm(G) & (domain(F) = domain(G)) & (range(F) ¥incin Re)) ¥imp
		(R_SIGMA(F) = R_SIGMA({[y,R_SIGMA(F ¥ON (G ¥INV_IM {y}))]: y in range(G)}))) &
	((Finite(F) & Svm(F) & one_1_map(G) & (domain(F) = domain(G)) & (range(F) ¥incin Re)) ¥imp
		(R_SIGMA(F) = R_SIGMA({[y,F~[inv(G)~[y]]]: y in range(G)}))). Proof:
	Suppose_not(x,f,c,t,g) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED

Def 81b: [Polynomial functions of a real variable] Polval(F,X) := R_SIGMA({F~[n] ¥R_TIMES (X ¥ToThe n): n in domain(F)})

Def 81g: [The real polynomial function corresponding to a formal polynomial] PolFcn(F) := {[x,Polval(F,x)]: x in Re}
--
-- Work with polynomials always involves consideration of polynomial functions along with the
-- corresponding formal operations on polymomials, wich are seen in the two following definitions.
--
Def 81c: [Formal sum of polynomials] Def(f ¥PolPlus g) := {(if n in domain(f) then f~[n] else R_0 end if) ¥R_PLUS (if n in domain(g) then g~[n] else R_0 end if): n in domain(f) + domain(g)}
--
Def 81d: [Formal difference of polynomials] Def(f ¥PolMinus g) := {if n in domain(f) then f~[n] else R_0 end if ¥R_PLUS if n in domain(g) then g~[n] else R_0 end if: n in domain(f) + domain(g)}
--
Def 81q: [Formal product of polynomials] Def(f ¥PolTimes g) := {if n in domain(f) then f~[n] else R_0 end if ¥R_PLUS if n in domain(g) then g~[n] else R_0 end if: n in domain(f) + domain(g)}
--
Def 81f: [Formal composition of polynomials ******** TO BE FILLED IN] Def(f ¥PolComp g) := {if n in domain(f) then f~[n] else R_0 end if ¥R_PLUS if n in domain(g) then g~[n] else R_0 end if: n in domain(f) + domain(g)}

Def 82: [Pointwise sum of Real Functions] Def(f ¥F_PLUS g) := {[x,f~[x] ¥R_PLUS g~[x]]: x in Re}
Def 82a: [Pointwise difference of Real Functions] Def(f ¥F_MINUS g) := {[x,f~[x] ¥R_MINUS g~[x]]: x in Re}
Def 83: [Pointwise product of Real Functions] Def(f ¥F_TIMES g) := {[x,f~[x] ¥R_TIMES g~[x]]: x in Re}
Def 83a: [Pointwise quotient of Real Functions] Def(f ¥F_OVER g) := {[x,f~[x] ¥R_OVER g~[x]]: x in Re | g~[x] /= R_0}
Def 85: [Constant zero function] RF_0 := {[x,R_0]: x in Re}
Def 85a: [Constant unit function] RF_1 := {[x,R_1]: x in Re}

--
-- The formal operations on polymials correspond to the actual operations on polynomial functions.
--
Theorem 792: ((F in Fin_Seqs(Re)) & (G in Fin_Seqs(Re)) & (X in Re)) ¥imp (((Polval(F,X) ¥R_PLUS Polval(G,X)) = Polval(F ¥PolPlus G,X)) & ((Polval(F,X) ¥R_MINUS Polval(G,X)) = Polval(F ¥PolMinus G,X)) & ((Polval(F,X) ¥R_TIMES Polval(G,X)) = Polval(F ¥PolTimes G,X))). Proof:
	Suppose_not(f,g,x) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
-- We can of course restate the preceding theorem in terms of the set of real functions and the pointwise operations on them.
--
Theorem 793: ((F in Fin_Seqs(Re)) & (G in Fin_Seqs(Re))) ¥imp (((PolFcn(F) ¥F_PLUS PolFcn(G)) = PolFcn(F ¥PolPlus G)) & ((PolFcn(F) ¥F_MINUS PolFcn(G)) = PolFcn(F ¥PolMinus G)) & ((PolFcn(F) ¥F_TIMES PolFcn(G)) = PolFcn(F ¥PolTimes G))). Proof:
	Suppose_not(f,g) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
-- If $f$ is a real continuous function on a set $S$, and $g$ is a real Cauchy sequence with values in $S$,
-- then the image $h$ of $g$ under $f$ satisfies $f(limit(g)) = limit(h)$.
--
Theorem 794: [Continuous functions map limits into limits] (Cf_RR(F,S) & (G in ReCauchy) & (range(G) ¥incin S)) ¥imp ((F @ G in ReCauchy) & (limit(F @ G) = F~[limit(G)])). Proof:
	Suppose_not(f,s,g) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 795: [The pointwise sum and product of two real continuous functions on two sets is continuous on their intersection] (Cf_RR(F,S) & Cf_RR(G,S2)) ¥imp (Cf_RR(F ¥Res_PLUS G,S * S2) & Cf_RR(F ¥Res_TIMES G,S * S2)). Proof:
	Suppose_not(f,s,g,s2) ==> AUTO
        APPLY() pointwise(fq->f,fp->g,h->(f ¥Res_PLUS g),d->Za,r->Re,bop(x,y)->(x ¥R_PLUS y)) ==>
		((f ¥Res_PLUS g) = {[u,((f~[u]) ¥R_PLUS (g~[u]))]: u in Za}) &
                Svm(f ¥Res_PLUS g) & (domain(f ¥Res_PLUS g) = Za) & (range(f ¥Res_PLUS g) ¥incin Re)
        APPLY() pointwise(fq->f,fp->g,h->(f ¥Res_TIMES g),d->Za,r->Re,bop(x,y)->(x ¥R_TIMES y)) ==>
		((fq ¥Res_TIMES fp) = {[u,((fq~[u]) ¥R_TIMES (fp~[u]))]: u in Za}) &
                Svm(f ¥Ras_TIMES g) & (domain(f ¥Res_TIMES g) = Za) & (range(f ¥Res_TIMES g) ¥incin Re)
        APPLY() pointwiseU(fp->g,h->Res_ABS(g),d->Za,r->Re,uop(x)->abs(x)) ==>
		(Res_ABS(g) = {[u,abs(g~[u])]: u in Za}) &
                Svm(Res_ABS(g)) & (domain(Res_ABS(g)) = Za) & (range(Res_ABS(g)) ¥incin Re)
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 796: [The quotient of two real continuous functions on two sets is continuous on the set of points in their intersection at which the denominator is nonzero] (Cf_RR(F,S) & Cf_RR(G,S2)) ¥imp Cf_RR(F ¥Res_OVER G,{x in S * S2 | G~[x] /= R_0}). Proof:
	Suppose_not(f,s,g,s2) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 797: [The composition of two real continuous functions is continuous.] (Cf_RR(F,S) & Cf_RR(G,T) & (range(G ¥ON T) ¥incin S)) ¥imp Cf_RR(F @ G,T). Proof:
	Suppose_not(f,s,g,t) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
-- Since applications of the general theorems proved in the present section will often refer to particular functions,
-- we give a few easy theorems which prove that a few basic kinds of functions are continuous.
--
Theorem 798: [Polynomial functions are continuous everywhere] (F in Fin_Seqs(Re)) ¥imp Cf_RR(PolFcn(F),Re). Proof:
	Suppose_not(f) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 799: [Polynomial quotients are continuous wherever their denominator is nonzero] ((F in Fin_Seqs(Re)) & (G in Fin_Seqs(Re))) ¥imp Cf_RR(F ¥F_OVER G,{x in Re | G~[x] /= R_0}). Proof:
	Suppose_not(f,g) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
-- Next we prove the basic fact that a real-valued function of a real variable continuous on the closed interval $[x,y]$
-- of real numbers which is negative at $x$ and positive at $y$ must be zero at some point $u$
-- between $x$ and $y$, i.e. $f(u) = 0$. It is to guarantee this basic property of the 'real continuum'
-- that the careful and elaborate construction of the real numbers as equivalence classes of Cauchy
-- sequences was devised (by Georg Cantor).
--
Theorem 800: [Crossing-completness principle for the real numbers] ((Cf_RR(F,I(X,Y)) & (X in Re) & (Y in Re) & (R_0 ¥R_GE (F~[X])) & (R_0 ¥R_LE (F~[Y])) & (X ¥R_LE Y)) ¥imp (EXISTS v | ((X ¥R_LE v) & (v ¥R_LE Y) & ((F~[v]) = R_0)))). Proof:
	Suppose_not(f,x,y) ==> AUTO
--
-- This theorem, like many of the other basic theorems of real analysis following below, will be
-- proved using the existence and properties of the least upper bound. Let s be the set of all
-- points $u in I(x,y)$ at which $f~[u]$ is non-negative, and let $w$ be the least upper bound of $s$.
--
-- Then since $w$ is the limit of a sequence of points in $s$, $f~[w]$ must be non-negative.
-- On the other hand $f~[w]$ cannot be strictly positive, since if it were it would be less than $y$,
-- and then since $f$ is continuous it would be non-negative on an entire interval containing $w$,
-- contradicting the fact that $w$ is an upper bound of $s$.
--
-- This contradiction proves our theorem.
--
	Tsomehow ==> false; Discharge ==> QED
--
-- Using Theorem 800 we show that every non-negative real number has a non-negative square root,
-- and then that this square root is unique, and that the square root function is monotone increasing.
-- The following simple theorems collect these elementary properties of the real square root.
--

--
-- Next we prove another of the basic theorems of real analysis: Every function continuous
-- on a bounded closed set of reals attains its maximum.
--
Theorem 801: (Cf_RR(F,S) & BoundedClosedRe(S)) ¥imp (EXISTS u in S | (FORALL v in S | F~[u] ¥R_GE F~[v])). Proof:
	Suppose_not(f,s) ==> AUTO
--
-- Again we use the properties of the least upper bound. First we prove that the function $f$ must be bounded above.
-- Indeed, suppose the contrary, and let $I(x,y)$ be a closed interval including $s$. Consider the set $t$ of points $w$
-- in this interval such that $f$ is bounded on $s * I(x,w)$, and let $u$ be the least upper bound of $t$. $u$ must belong to $s$,
-- since otherwise some interval $I(a,b)$ about $u$ would be disjoint from $s$, and then plainly $f$ would be bounded on $s * I(x,b)$,
-- contradicting the fact that $f$ must be unbounded on $s * I(x,c)$ for every $c$ larger than $u$, and so proving our claim.
--
-- Now that we know that the range of $f$ is bounded above, let $ub$ be its least upper bound, and consider the set $t$ of points $w$
-- in $I(x,y)$ such that all the values in $range(f ¥ON (s * I(x,t)))$ are less than $ub$. Let $t1$ be the least upper bound of these $t$.
-- If $f~[t1] ¥R_LT ub$, then $f$ is less than $ub$ on an interval about $t1$, contradicting the definition
-- of $t1$ as a least upper bound.
--
-- It follows that $f~[t1] = ub$, and since $ub$ is an upper bound for $range(f ¥ON s)$ our theorem is proved.
--
	Tsomehow ==> false; Discharge ==> QED
--
-- The fact that constant real functions are continuous is trivial.
--
-- It follows as a corollary that every function continuous
-- on a bounded closed set of reals attains its minimum.
--
Theorem 802: (Cf_RR(F,S) & BoundedClosedRe(S)) ¥imp (EXISTS u in I(X,Y) | (FORALL v in S | F~[u] ¥R_LE F~[v])). Proof:
	Suppose_not(f,s,x,y) ==> AUTO
-- To prove the present we have only to apply the preceding theorem to the reversal RF_0 ¥F_MINUS F of  F.
	Tsomehow ==> false; Discharge ==> QED
--
-- Together, the results just proved tell us that a function continuous on a closed interval
-- of reals maps this domain onto a second closed interval of reals.
--
Theorem 803: (Cf_RR(F,I(X,Y)) & (X in Re) & (Y in Re)) ¥imp (EXISTS u in I(X,Y), v in  I(X,Y) | range(F ¥ON I(X,Y)) = I(f~[u],f~[v])). Proof:
	Suppose_not(f,x,y) ==> AUTO
--
-- For let $m$ be the minimum and $M$ the maximum value of $f$. Then by Theorems 681a and b,
-- there exist points $x1$ and $y1$ in $I(x,y)$ such that $f~[x1]$ is the minimum and $f~[y1]$ the maximum
-- of $f$.
--
-- It follows that $range(f) ¥incin I(f~[x1],f~[y1])$. Hence if $range(f) /= I(f~[x1],f~[y1])$,
-- there must exist a $c$ in $I(f~[x1],f~[y1])$ which is not in $range(f)$. But then $f~[x1] ¥R_MINUS c$
-- is nonpositive and $f~[y1] ¥R_MINUS c$ is non-negative. But then, applying Theorem 800 to the
-- continuous function $f ¥F_MINUS (Re ¥PROD {c})$, it follows that there must exist a $u in I(x1,y1)$ such that
-- $(f~[u]) ¥R_MINUS c = R_0$, i.e. $(f~[u]) = c$, so that $c$ is in $range(f)$, a contradiction which proves our theorem.
--
Tsomehow ==> false; Discharge ==> QED
--
-- As the last in the present series of basic theorems of real analysis, we prove the Heine-Borel theorem:
-- Any covering of a bounded closed set by the interiors of a set $T$ of intervals is covered by a finite subset of the intervals in $T$.
--
Theorem 804: (BoundedClosedRe(S) & (S ¥incin Un({OI(car(ends),cdr(ends)): ends in T})) & (FORALL ends in T | ends in (Re ¥PROD Re))) ¥imp (EXISTS t1 | (t1 ¥incin T) & Finite(t1) & (S ¥incin Un({OI(car(ends),cdr(ends)): ends in t1}))). Proof:
	Suppose_not(s,t) ==> AUTO
--
-- We prove the present result, like those which have gone before it, by using the least upper bound principle.
-- Let $bl$ and $bu$ respectively be a lower and upper bounds for the set $s$, and consider the collection $v$ of all $c$ in $s$
-- such that $s * I(bl,c)$ is covered by the interiors of a finite subset of the intervals in $T$. Let $u$ be the
-- least upper bound of these $c$.
--
-- $u$ must belong to $s$, since otherwise $v$ would have a smaller upper bound. Nut the $s$ is contained
-- in the interior of some one of the intervals $I(a,b)$ of $T$, and $s * I(bl,a)$ is contained in the
-- union of the interiors of some finite subset $T1$ of $T$. It follows that all the points interior to
-- $I(a,b)$ must belong to $s$, contradicting the fact that $v$ is an upper bound of $s$.
--
-- This contradiction completes the proof of our theorem.
--
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 805: [Square of binomials] ((X in Re) & (Y in Re)) ¥imp ( ((X ¥R_PLUS Y) ¥R_TIMES (X ¥R_PLUS Y)) = ((X ¥R_TIMES X) ¥R_PLUS (Y ¥R_TIMES Y)) ¥R_PLUS ((X ¥R_TIMES Y) ¥R_PLUS (X ¥R_TIMES Y)) ). Proof:
Suppose_not(x,y) ==> AUTO
	ALGEBRA ==> (((x ¥R_PLUS y) ¥R_TIMES (x ¥R_PLUS y)) = (x ¥R_TIMES (x ¥R_PLUS y)) ¥R_PLUS (y ¥R_TIMES (x ¥R_PLUS y))) &
		((x ¥R_TIMES (x ¥R_PLUS y)) = ((x ¥R_TIMES x) ¥R_PLUS (x ¥R_TIMES y))) &
		((y ¥R_TIMES (x ¥R_PLUS y)) = ((y ¥R_TIMES y) ¥R_PLUS (x ¥R_TIMES y))) &
		(((x ¥R_TIMES x) ¥R_PLUS (x ¥R_TIMES y)) ¥R_PLUS ((y ¥R_TIMES y) ¥R_PLUS (x ¥R_TIMES y)) = ((x ¥R_TIMES x) ¥R_PLUS (y ¥R_TIMES y)) ¥R_PLUS ((x ¥R_TIMES y) ¥R_PLUS (x ¥R_TIMES y)))
	EQUAL ==> false; Discharge ==> QED
--
Theorem 806: [Square of binomials, 2] ((X in Re) & (Y in Re)) ¥imp ( ((X ¥R_MINUS Y) ¥R_TIMES (X ¥R_MINUS Y)) = ((X ¥R_TIMES X) ¥R_PLUS (Y ¥R_TIMES Y)) ¥R_MINUS ((X ¥R_TIMES Y) ¥R_PLUS (X ¥R_TIMES Y)) ). Proof:
Suppose_not(x,y) ==> AUTO
	(y,y)-->T613(*) ==> (R_Rev(y) in Re)
	(x,R_Rev(y))-->T805(*) ==> ((x ¥R_PLUS R_Rev(y)) ¥R_TIMES (x ¥R_PLUS R_Rev(y))) = ((x ¥R_TIMES x) ¥R_PLUS (R_Rev(y) ¥R_TIMES R_Rev(y))) ¥R_PLUS ((x ¥R_TIMES R_Rev(y)) ¥R_PLUS (x ¥R_TIMES R_Rev(y)))
	(x,y)-->T635(*) ==> ((x ¥R_MINUS y) = (x ¥R_PLUS R_Rev(y)))
	(y,y)-->T623(*) ==> (R_Rev(y) ¥R_TIMES R_Rev(y) = y ¥R_TIMES y)
	(x,y)-->T623(*) ==> (x ¥R_TIMES R_Rev(y)) = R_Rev(x ¥R_TIMES y)
--??	ALGEBRA ==> ((x ¥R_TIMES y) in Re) & ((x ¥R_TIMES x) in Re) & ((y ¥R_TIMES y) in Re)
	(x,y)-->T614(*) ==> (x ¥R_TIMES y) in Re
	(x ¥R_TIMES y,x ¥R_TIMES y)-->T638(*) ==> R_Rev(x ¥R_TIMES y) ¥R_PLUS R_Rev(x ¥R_TIMES y) = R_Rev((x ¥R_TIMES y) ¥R_PLUS (x ¥R_TIMES y))
	(x,x)-->T614(*) ==> (x ¥R_TIMES x) in Re
	(y,y)-->T614(*) ==> (y ¥R_TIMES y) in Re
	(x ¥R_TIMES x,y ¥R_TIMES y)-->T613(*) ==> ((x ¥R_TIMES x) ¥R_PLUS (y ¥R_TIMES y)) in Re
	(x ¥R_TIMES y,x ¥R_TIMES y)-->T613(*) ==> ((x ¥R_TIMES y) ¥R_PLUS (x ¥R_TIMES y)) in Re
	((x ¥R_TIMES x) ¥R_PLUS (y ¥R_TIMES y),(x ¥R_TIMES y) ¥R_PLUS (x ¥R_TIMES y))-->T635(*) ==> ((x ¥R_TIMES x) ¥R_PLUS (y ¥R_TIMES y)) ¥R_PLUS R_Rev((x ¥R_TIMES y) ¥R_PLUS (x ¥R_TIMES y)) = ((x ¥R_TIMES x) ¥R_PLUS (y ¥R_TIMES y)) ¥R_MINUS ((x ¥R_TIMES y) ¥R_PLUS (x ¥R_TIMES y))
	EQUAL ==> false; Discharge ==> QED
--
Theorem 807: [Noticeable product of binomials] ((X in Re) & (Y in Re)) ¥imp (((X ¥R_MINUS Y) ¥R_TIMES (X ¥R_PLUS Y)) = ((X ¥R_TIMES X) ¥R_MINUS (Y ¥R_TIMES Y))). Proof:
Suppose_not(x,y) ==> AUTO
	ALGEBRA ==> ((x ¥R_MINUS y) ¥R_TIMES (x ¥R_PLUS y)) = ((x ¥R_TIMES x) ¥R_MINUS (y ¥R_TIMES x)) ¥R_PLUS ((y ¥R_TIMES x) ¥R_MINUS (y ¥R_TIMES y))
	ALGEBRA ==> ((x ¥R_TIMES x) ¥R_MINUS (y ¥R_TIMES x)) ¥R_PLUS ((y ¥R_TIMES x) ¥R_MINUS (y ¥R_TIMES y)) = ((x ¥R_TIMES x) ¥R_PLUS ((y ¥R_TIMES x) ¥R_MINUS (y ¥R_TIMES x))) ¥R_MINUS (y ¥R_TIMES y)
	ALGEBRA ==> ((x ¥R_TIMES x) ¥R_PLUS ((y ¥R_TIMES x) ¥R_MINUS (y ¥R_TIMES x))) = (x ¥R_TIMES x)
	EQUAL ==> false; Discharge ==> QED
--
Theorem 808: [The square of the square root of any positive $x$ is $x$] ((X in Re) & (R_is_nonneg(X))) ¥imp ((sqrt(X) in Re) & (R_is_nonneg(sqrt(X))) & ((sqrt(X) ¥R_TIMES sqrt(X)) = X)). Proof:
Suppose_not(x) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 809: [The positive square root is unique] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & ((Y ¥R_TIMES Y) = X)) ¥imp (Y = sqrt(X)). Proof:
Suppose_not(x,y) ==> AUTO
	x-->T808(*) ==> Stat1: (sqrt(x) in Re) & R_is_nonneg(sqrt(x)) & ((sqrt(x) ¥R_TIMES sqrt(x)) = (y ¥R_TIMES y)) & (y in Re)
	ALGEBRA(Stat1) ==> (((y ¥R_TIMES y) ¥R_MINUS (y ¥R_TIMES y)) = R_0) &
		((sqrt(x) ¥R_MINUS y) in Re) &
		((sqrt(x) ¥R_PLUS y) in Re)
	EQUAL ==> ((sqrt(x) ¥R_TIMES sqrt(x)) ¥R_MINUS (y ¥R_TIMES y)) = R_0
	(sqrt(x),y)-->T807(*) ==> ((sqrt(x) ¥R_MINUS y) ¥R_TIMES (sqrt(x) ¥R_PLUS y)) = R_0
	(sqrt(x) ¥R_MINUS y,sqrt(x) ¥R_PLUS y)-->T700(*) ==> ((sqrt(x) ¥R_MINUS y) = R_0) or ((sqrt(x) ¥R_PLUS y) = R_0)
	Suppose ==> (sqrt(x) ¥R_MINUS y) = R_0
		ALGEBRA(Stat1,Stat1) ==> (R_0 ¥R_PLUS y = y) & ((sqrt(x) ¥R_MINUS y) ¥R_PLUS y = sqrt(x))
	EQUAL ==> false; Discharge ==> (sqrt(x) ¥R_PLUS y) = R_0
	(sqrt(x),y)-->T711(*) ==> sqrt(x) = y
	Discharge ==> QED
--
Theorem 810: [The square root is monotone increasing for positive numbers] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & (X ¥R_GT Y)) ¥imp (sqrt(X) ¥R_GT sqrt(Y)). Proof:
Suppose_not(x0,y0) ==> AUTO
	x0-->T808(*) ==> Stat1: (sqrt(x0) in Re) & R_is_nonneg(sqrt(x0)) & ((sqrt(x0) ¥R_TIMES sqrt(x0)) = x0)
	y0-->T808(*) ==> Stat2: (sqrt(y0) in Re) & R_is_nonneg(sqrt(y0)) & ((sqrt(y0) ¥R_TIMES sqrt(y0)) = y0)
	(sqrt(x0),sqrt(y0))-->T667(*) ==> R_is_nonneg(sqrt(x0) ¥R_PLUS sqrt(y0))
--
-- The two square roots can clearly not be equal, so one of the two must be greater.
-- Therefore their sum cannot be $R_0$, else both of them would equal $R_0$.
--
	Suppose ==> sqrt(x0) = sqrt(y0)
		EQUAL(Stat1) ==> x0 = y0
	Use_def(¥R_GT)(*) ==> false; Discharge ==> AUTO
	(sqrt(x0),sqrt(y0))-->T699(*) ==> (sqrt(x0) ¥R_PLUS sqrt(y0)) /= R_0
--
-- But $sqrt(y0)$ cannot be greater than $sqrt(x0)$, since if it were $y0$ would be greater than $x0$, contrary to assumption.
-- Thus $sqrt(x0)$ must be greater than $sqrt(y0)$, proving our theorem.
--
	Use_def(¥R_GT)(*) ==> Stat3: R_is_nonneg(x0 ¥R_MINUS y0) & (x0 /= y0) & (x0 in Re) & (y0 in Re)
	Suppose ==> x0 ¥R_MINUS y0 = R_0
		EQUAL(Stat3) ==> (x0 ¥R_MINUS y0) ¥R_PLUS y0 = R_0 ¥R_PLUS y0
	ALGEBRA(Stat3) ==> false; Discharge ==> AUTO
	(sqrt(x0),sqrt(y0))-->T807(*) ==> ((sqrt(x0) ¥R_MINUS sqrt(y0)) ¥R_TIMES (sqrt(x0) ¥R_PLUS sqrt(y0))) =
			((sqrt(x0) ¥R_TIMES sqrt(x0)) ¥R_MINUS (sqrt(y0) ¥R_TIMES sqrt(y0)))
	ALGEBRA(Stat1,Stat2) ==> ((sqrt(x0) ¥R_PLUS sqrt(y0)) ¥R_TIMES (sqrt(x0) ¥R_MINUS sqrt(y0))) = ((sqrt(x0) ¥R_MINUS sqrt(y0)) ¥R_TIMES (sqrt(x0) ¥R_PLUS sqrt(y0)))
	EQUAL(Stat1) ==> R_is_nonneg((sqrt(x0) ¥R_PLUS sqrt(y0)) ¥R_TIMES (sqrt(x0) ¥R_MINUS sqrt(y0))) &
		(((sqrt(x0) ¥R_PLUS sqrt(y0)) ¥R_TIMES (sqrt(x0) ¥R_MINUS sqrt(y0))) /= R_0)
	ALGEBRA(Stat1,Stat2) ==> ((sqrt(x0) ¥R_PLUS sqrt(y0)) in Re) & ((sqrt(x0) ¥R_MINUS sqrt(y0)) in Re)
	(sqrt(x0) ¥R_PLUS sqrt(y0),sqrt(x0) ¥R_MINUS sqrt(y0))-->T700(*) ==> ((sqrt(x0) ¥R_PLUS sqrt(y0)) /= R_0) & ((sqrt(x0) ¥R_MINUS sqrt(y0)) /= R_0)
	Use_def(¥R_GT)(*) ==> not(R_is_nonneg(sqrt(x0) ¥R_MINUS sqrt(y0)))
	(sqrt(x0) ¥R_PLUS sqrt(y0),sqrt(x0) ¥R_MINUS sqrt(y0))-->T706(*) ==> false; Discharge ==> QED
--
Theorem 811: [The square root of a product is the product of the square roots] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) ¥imp (sqrt(X ¥R_TIMES Y) = (sqrt(X) ¥R_TIMES sqrt(Y))). Proof:
Suppose_not(n,m) ==> AUTO
	n-->T808(*) ==> Stat1: (sqrt(n) in Re) & ((sqrt(n) ¥R_TIMES sqrt(n)) = n) & (R_is_nonneg(sqrt(n))) & (n in Re)
	m-->T808(*) ==> (sqrt(m) in Re) & ((sqrt(m) ¥R_TIMES sqrt(m)) = m) & (R_is_nonneg(sqrt(m))) & (m in Re)
	ALGEBRA(Stat1) ==> (((sqrt(n) ¥R_TIMES sqrt(m)) ¥R_TIMES (sqrt(n) ¥R_TIMES sqrt(m))) = ((sqrt(n) ¥R_TIMES sqrt(n)) ¥R_TIMES (sqrt(m) ¥R_TIMES sqrt(m)))) & ((n ¥R_TIMES m) in Re) & ((sqrt(n) ¥R_TIMES sqrt(m)) in Re)
	EQUAL(Stat1) ==> ((sqrt(n) ¥R_TIMES sqrt(m)) ¥R_TIMES (sqrt(n) ¥R_TIMES sqrt(m))) = (n ¥R_TIMES m)
	(sqrt(n),sqrt(m))-->T667(Stat1) ==> R_is_nonneg(sqrt(n) ¥R_TIMES sqrt(m))
	(n,m)-->T667(*) ==> R_is_nonneg(n ¥R_TIMES m)
	(n ¥R_TIMES m,sqrt(n) ¥R_TIMES sqrt(m))-->T809(*) ==> false; Discharge ==> QED
--
Theorem 812: [The square of the square root of any real $w=(x ¥R_TIMES x) ¥R_PLUS (y ¥R_TIMES y)$ is $w$] ((X in Re) & (Y in Re)) ¥imp (sqrt((X ¥R_TIMES X) ¥R_PLUS (Y ¥R_TIMES Y)) ¥R_TIMES sqrt((X ¥R_TIMES X) ¥R_PLUS (Y ¥R_TIMES Y)) = ((X ¥R_TIMES X) ¥R_PLUS (Y ¥R_TIMES Y))). Proof:
Suppose_not(x,y) ==> Stat1: (x in Re) & (y in Re) & (sqrt((x ¥R_TIMES x) ¥R_PLUS (y ¥R_TIMES y)) ¥R_TIMES sqrt((x ¥R_TIMES x) ¥R_PLUS (y ¥R_TIMES y)) /= ((x ¥R_TIMES x) ¥R_PLUS (y ¥R_TIMES y)))
	T721(*) ==> Stat2: (FORALL x,y | ((x in Re) & (y in Re)) ¥imp ((R_is_nonneg(x) & R_is_nonneg(y)) ¥imp R_is_nonneg(x ¥R_PLUS y)))
	x-->T714(Stat1,Stat1*) ==> Stat3: R_is_nonneg(x ¥R_TIMES x)
	y-->T714(Stat1,Stat1*) ==> Stat4: R_is_nonneg(y ¥R_TIMES y)
	ALGEBRA(Stat1,Stat1*) ==> Stat5: ((x ¥R_TIMES x) in Re) & ((y ¥R_TIMES y) in Re) & (((x ¥R_TIMES x) ¥R_PLUS (y ¥R_TIMES y)) in Re)
	(x ¥R_TIMES x,y ¥R_TIMES y)-->Stat2(Stat3,Stat4,Stat5*) ==> Stat6: R_is_nonneg((x ¥R_TIMES x) ¥R_PLUS (y ¥R_TIMES y))
	((x ¥R_TIMES x) ¥R_PLUS (y ¥R_TIMES y))-->T808(Stat1,Stat6,Stat5*) ==> false; Discharge ==> QED
--
-- ************************************************************************************************
--			Section 14a: basic theorems of the differential calculus of real functions
-- ************************************************************************************************

--
-- A real-valued function defined
--

Def 88: [Difference-and-diagonal trick for defining the derivative] DD(f,df) := {if x~[0] /= x~[1] then (f~[x~[0]] ¥R_MINUS f~[x~[1]]) ¥R_OVER (x~[0] ¥R_MINUS x~[1])
					else df~[x~[0]] end if: x in Euc(2)}
--
Def 89: [Derivative of function of a real variable] Der(f) := arb({df in Za | domain(f) = domain(df) &		-- FIX TEMP PATCH Za ********
		is_continuous_REnF(DD(f,df) ¥ON (domain(f) ¥PROD domain(f)),2)})
--
Theorem 813: ((N in Si) & (M in Si) & (M /= [0,0]) & is_nonneg(M)) ¥imp
	(EXISTS k in Si | is_nonneg(N ¥S_MINUS (k ¥S_TIMES M)) & is_nonneg(((k ¥S_PLUS [1,0])¥S_TIMES M)) ¥S_MINUS N). Proof:
    Suppose_not(n,m) ==> (n in Si) & (m in Si) & (m /= [0,0]) & is_nonneg(m) &
	(not(EXISTS k in Si | is_nonneg(n ¥S_MINUS (k ¥S_TIMES m)) & is_nonneg(((k ¥S_PLUS [1,0]) ¥S_TIMES m)) ¥S_MINUS n))
    THUS ==> false; Discharge ==> QED
--
--
Theorem 814: ((N in Re) & (M in Re)) ¥imp (((abs(N) ¥R_PLUS abs(M)) ¥R_GT abs(N ¥R_MINUS M)) or ((abs(N) ¥R_PLUS abs(M)) = abs(N ¥R_MINUS M))). Proof:
Suppose_not(n,m) ==> AUTO
	(n,m)-->T635(*) ==> (n ¥R_MINUS m) = (n ¥R_PLUS R_Rev(m))
	m-->T727(*) ==> abs(m) = abs(R_Rev(m))
	EQUAL ==> not(abs(n) ¥R_PLUS abs(R_Rev(m)) ¥R_GT abs(n ¥R_PLUS R_Rev(m)) or
			abs(n) ¥R_PLUS abs(R_Rev(m)) = abs(n ¥R_PLUS R_Rev(m)))
	ALGEBRA ==> R_Rev(m) in Re
    (n,R_Rev(m))-->T731(*) ==> false; Discharge ==> QED
--
-- ************************************************************************************************
--								Section 15: Complex numbers
-- ************************************************************************************************
--
Def 170: [The set of complex numbers] Cm := Re ¥PROD Re
Def 171: [Complex addition] Def(X ¥C_PLUS Y) := [car(X) ¥R_PLUS car(Y),cdr(X) ¥R_PLUS cdr(Y)]
Def 172: [Complex product]
    Def(X ¥C_TIMES Y) := [(car(X) ¥R_TIMES car(Y)) ¥R_MINUS (cdr(X) ¥R_TIMES cdr(Y)),
		(car(X) ¥R_TIMES cdr(Y)) ¥R_PLUS (cdr(X) ¥R_TIMES car(Y))]
Def 173: [The complex norm] C_abs(X) := sqrt((car(X) ¥R_TIMES car(X)) ¥R_PLUS (cdr(X) ¥R_TIMES cdr(X)))
Def 174: [The complex reciprocal]
    C_Recip(x) := [car(x) ¥R_OVER (C_abs(x) ¥R_TIMES C_abs(x)),R_Rev(cdr(x)) ¥R_OVER (C_abs(x) ¥R_TIMES C_abs(x))]
--
Def 175: [Complex Quotient] Def(X ¥C_OVER Y) := X ¥C_TIMES C_Recip(Y)
Def 176: [Complex negative] C_Rev(X) := [R_Rev(car(X)),R_Rev(cdr(X))]
Def 177: [Complex difference] Def(N ¥C_MINUS M) := N ¥C_PLUS C_Rev(M)
Def 178: [Complex zero] C_0 := [R_0,R_0]
Def 179: [Complex unity] C_1 := [R_1,R_0]
--
Theorem 815: ((X in Re) & (Y in Re)) ¥imp ([X,Y] in Cm). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def(Cm) ==> [x0,y0] notin (Re ¥PROD Re)
	Use_def(¥PROD) ==> Stat1: [x0,y0] notin {[x,y]: x in Re, y in Re}
(x0,y0)-->Stat1(*) ==> false; Discharge ==> QED
--
Theorem 816: (M in Cm) ¥eq ((M = [car(M),cdr(M)]) & (car(M) in Re) & (cdr(M) in Re)). Proof+:
Suppose_not(m) ==> AUTO
	Use_def(Cm) ==> Stat0: (Cm = (Re ¥PROD Re)) & (not((m in (Re ¥PROD Re)) ¥eq ((m = [car(m),cdr(m)]) & (car(m) in Re) & (cdr(m) in Re))))
	Suppose ==> Stat1: m in (Re ¥PROD Re)
		(m,Re,Re)-->T140(Stat1*) ==> (car(m) in Re) & (cdr(m) in Re)
		({m},Re,Re)-->T141(Stat1*) ==> Is_map({m})
	({m},m)-->T51(Stat0*) ==> false; Discharge ==> Stat2: (m = [car(m),cdr(m)]) & (car(m) in Re) & (cdr(m) in Re) & (m notin Cm)
(car(m),cdr(m))-->T815(Stat2*) ==> false; Discharge ==> QED
--
Theorem 817: (C_0 in Cm) & (C_1 in Cm). Proof:
Suppose_not ==> (C_0 notin Cm) or (C_1 notin Cm)
	Use_def(C_0) ==> C_0 = [R_0,R_0]
	Use_def(C_1) ==> C_1 = [R_1,R_0]
	T612 ==> (R_1 in Re) & (R_0 in Re)
	(R_0,R_0)-->T815 ==> C_0 in Cm
(R_1,R_0)-->T815 ==> false; Discharge ==> QED
--
Theorem 818: ((N in Cm) & (M in Cm)) ¥imp ((N ¥C_PLUS M in Cm) & (N ¥C_TIMES M in Cm)). Proof:
Suppose_not(n,m) ==> AUTO
    n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re)
    m-->T816(*) ==> Stat2: (car(m) in Re) & (cdr(m) in Re)
    Use_def(¥C_PLUS)(*) ==> Stat3: n ¥C_PLUS m = [car(n) ¥R_PLUS car(m),cdr(n) ¥R_PLUS cdr(m)]
    (car(n),car(m))-->T613(Stat1, Stat2*) ==> car(n) ¥R_PLUS car(m) in Re
    (cdr(n),cdr(m))-->T613(Stat1, Stat2*) ==> cdr(n) ¥R_PLUS cdr(m) in Re
    (car(n) ¥R_PLUS car(m), cdr(n) ¥R_PLUS cdr(m))-->T815(Stat3*) ==> n ¥C_PLUS m in Cm
--
    Use_def(¥C_TIMES) ==> Stat4: (n ¥C_TIMES m) =
        [(car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m)),
         (car(n) ¥R_TIMES cdr(m)) ¥R_PLUS  (cdr(n) ¥R_TIMES car(m))]
    (car(n), car(m))-->T614(Stat1, Stat2*) ==> Stat5: (car(n) ¥R_TIMES car(m)) in Re
    (cdr(n), cdr(m))-->T614(Stat1, Stat2*) ==> (cdr(n) ¥R_TIMES cdr(m)) in Re
    ((car(n) ¥R_TIMES car(m)), (cdr(n) ¥R_TIMES cdr(m)))-->T614(Stat5*) ==> (car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m)) in Re
    (car(n), cdr(m))-->T614(Stat1, Stat2*) ==> Stat6: (car(n) ¥R_TIMES cdr(m)) in Re
    (cdr(n), car(m))-->T614(Stat1, Stat2*) ==> (cdr(n) ¥R_TIMES car(m)) in Re
    (car(n) ¥R_TIMES cdr(m),  cdr(n) ¥R_TIMES car(m))-->T613(Stat6*) ==> (car(n) ¥R_TIMES cdr(m)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m)) in Re
((car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m)), (car(n) ¥R_TIMES cdr(m)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m)))-->T815(*) ==> false; Discharge ==> QED
--
Theorem 819: ((N in Cm) & (M in Cm)) ¥imp (N ¥C_PLUS M = M ¥C_PLUS N). Proof:
Suppose_not(n,m) ==> Stat1: (n in Cm) & (m in Cm) & ((n ¥C_PLUS m) /= (m ¥C_PLUS n))
    m-->T816(*) ==> (car(m) in Re) & (cdr(m) in Re) & (m = [car(m),cdr(m)])
    n-->T816(*) ==> (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
    Use_def(¥C_PLUS)(Stat1,Stat1*) ==> Stat2: [car(n) ¥R_PLUS car(m),cdr(n) ¥R_PLUS cdr(m)] /= [car(m) ¥R_PLUS car(n),cdr(m) ¥R_PLUS cdr(n)]
    (Stat2)ELEM ==> ((car(n) ¥R_PLUS car(m)) /= (car(m) ¥R_PLUS car(n))) or (cdr(n) ¥R_PLUS cdr(m) /= cdr(m) ¥R_PLUS cdr(n))
    (car(n),car(m))-->T615(*) ==> (car(n) ¥R_PLUS car(m)) = (car(m) ¥R_PLUS car(n))
(cdr(n),cdr(m))-->T615(*) ==> false; Discharge ==> QED
--
Theorem 820: (N in Cm) ¥imp ((N = N ¥C_PLUS C_0) & (N = C_0 ¥C_PLUS  N)). Proof:
Suppose_not(n) ==> AUTO
	T817(*) ==> C_0 in Cm
	(C_0,n)-->T819(*) ==> (C_0 ¥C_PLUS n) = (n ¥C_PLUS C_0)
	Suppose ==> n = (n ¥C_PLUS C_0)
		EQUAL ==> n = (C_0 ¥C_PLUS n)
	Discharge ==> Stat1: (n in Cm) & (n /= (n ¥C_PLUS C_0))
	Use_def(¥C_PLUS)(Stat1,Stat1*) ==> Stat2: n /= [car(n) ¥R_PLUS car(C_0),cdr(n) ¥R_PLUS cdr(C_0)]
	Use_def(C_0)(Stat2,Stat2*) ==> Stat3: n /= [car(n) ¥R_PLUS R_0,cdr(n) ¥R_PLUS R_0]
	n-->T816(Stat1,Stat1*) ==> Stat4: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
	(car(n))-->T626(Stat4,Stat4*) ==> (car(n) ¥R_PLUS R_0) = car(n)
	(cdr(n))-->T626(Stat4,Stat4*) ==> (cdr(n) ¥R_PLUS R_0) = cdr(n)
EQUAL(Stat3) ==> false; Discharge ==> QED
--
--
Theorem 821: (N in Cm) ¥imp ((C_Rev(N) in Cm) & (C_Rev(C_Rev(N)) = N)). Proof:
Suppose_not(n) ==> AUTO
--
-- For, assuming the contrary to hold for $n$, we readily discard the possibility
-- $C_Rev(n) notin Cm$ by exploiting the definition of $C_Rev(n)$ and the fact that
-- the set of reals is closed relative to the operation $R_Rev$.
--
	n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
	Use_def(C_Rev(n)) ==> AUTO
	(car(n), car(n))-->T613(Stat1,Stat1*) ==> (R_Rev(car(n)) in Re)
	(cdr(n), cdr(n))-->T613(Stat1,Stat1*) ==> (R_Rev(cdr(n)) in Re)
	(R_Rev(car(n)), R_Rev(cdr(n)))-->T815(*) ==> Stat2: C_Rev(C_Rev(n)) /= n
--
-- The other possibility, namely $C_Rev(C_Rev(n)) /= [car(n),cdr(n)]$,
-- is discharged with equal ease, thanks to the definition of $C_Rev(C_Rev(n))$
-- and to the identity $R_Rev(R_Rev(X)) = X$ holding for all reals $X$.
--
	Use_def(C_Rev)(Stat1,Stat2*) ==> Stat3: [R_Rev(R_Rev(car(n))),R_Rev(R_Rev(cdr(n)))] /= [car(n),cdr(n)]
	(car(n))-->T633(Stat1,Stat1*) ==> R_Rev(R_Rev(car(n))) = car(n)
	(cdr(n))-->T633(Stat1,Stat1*) ==> R_Rev(R_Rev(cdr(n))) = cdr(n)
EQUAL(Stat3) ==> false; Discharge ==> QED
--
Theorem 822: (N in Cm) ¥imp (C_Rev(N) ¥C_PLUS N = C_0). Proof:
Suppose_not(n) ==> AUTO
--
-- For, assuming the contrary to hold for $n$, we readily reach a contradiction
-- by exploiting the definitions of $C_Rev(n)$, $C_Rev(n) ¥C_PLUS n$, and $C_0$,
-- and the identity $R_Rev(X) ¥R_PLUS X = R_0$.
--
	n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re)
	Use_def(¥C_PLUS) ==> Stat2: [car(C_Rev(n)) ¥R_PLUS car(n), cdr(C_Rev(n)) ¥R_PLUS cdr(n)] /= C_0
	Use_def(C_Rev(n)) ==> AUTO
	(R_Rev(car(n)),R_Rev(cdr(n)))-->T9 ==> AUTO
	(car(n))-->T632(Stat1,Stat1*) ==> R_Rev(car(n)) ¥R_PLUS car(n) = R_0
	(cdr(n))-->T632(Stat1,Stat1*) ==> R_Rev(cdr(n)) ¥R_PLUS cdr(n) = R_0
	Use_def(C_0) ==> C_0 = [R_0,R_0]
EQUAL(Stat2) ==> false; Discharge ==> QED
--
Theorem 823: ((N in Cm) & (M in Cm)) ¥imp (N = M ¥C_PLUS (N ¥C_MINUS M)). Proof:
Suppose_not(n,m) ==> AUTO
--
-- Basic properties of $n, m, C_Rev(m)$:
--
    n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
    m-->T816(*) ==> Stat2: (car(m) in Re) & (cdr(m) in Re)
    (car(m))-->T632(Stat2*) ==> Stat3: R_Rev(car(m)) in Re
    (cdr(m))-->T632(Stat2*) ==> Stat4: R_Rev(cdr(m)) in Re
    m-->T821(*) ==> C_Rev(m) in Cm
    (C_Rev(m))-->T816(Stat3*) ==> (car(C_Rev(m)) in Re) & (cdr(C_Rev(m)) in Re)
    Use_def(C_Rev)(Stat5) ==> Stat5: (car(C_Rev(m)) = R_Rev(car(m))) &
		(cdr(C_Rev(m)) = R_Rev(cdr(m)))
--
-- We rewrite the negation of the desired conclusion by exploiting the definition of $¥C_MINUS$;...
--
    Use_def(¥C_PLUS)(Stat6) ==> Stat6: (car(n ¥C_PLUS C_Rev(m)) = car(n) ¥R_PLUS car(C_Rev(m))) &
		(cdr(n ¥C_PLUS C_Rev(m)) = cdr(n) ¥R_PLUS cdr(C_Rev(m)))
    Use_def(¥C_MINUS)(*) ==> n /= m ¥C_PLUS (n ¥C_PLUS C_Rev(m))
--
-- ... and then, by taking the commutative property of $¥R_PLUS$ into account,...
--
    (car(n), R_Rev(car(m)))-->T615(Stat1, Stat2, Stat3*) ==> car(n) ¥R_PLUS R_Rev(car(m)) = R_Rev(car(m)) ¥R_PLUS car(n)
    (cdr(n), R_Rev(cdr(m)))-->T615(Stat1,Stat2,Stat4*) ==> cdr(n) ¥R_PLUS R_Rev(cdr(m)) = R_Rev(cdr(m)) ¥R_PLUS cdr(n)
    Use_def(¥C_PLUS)(*) ==> Stat7:
	(m ¥C_PLUS (n ¥C_PLUS C_Rev(m)) =
                 [car(m) ¥R_PLUS car(n ¥C_PLUS C_Rev(m)), cdr(m) ¥R_PLUS cdr(n ¥C_PLUS C_Rev(m))])
--
-- ...as well as associativity of real addition, we can further rewrite it.
--
    (car(m), R_Rev(car(m)), car(n))-->T617(*) ==>
        car(m) ¥R_PLUS (R_Rev(car(m)) ¥R_PLUS car(n)) = (car(m) ¥R_PLUS R_Rev(car(m))) ¥R_PLUS car(n)
    (cdr(m), R_Rev(cdr(m)), cdr(n))-->T617(*) ==>
        cdr(m) ¥R_PLUS (R_Rev(cdr(m)) ¥R_PLUS cdr(n)) = (cdr(m) ¥R_PLUS R_Rev(cdr(m))) ¥R_PLUS cdr(n)
    EQUAL(Stat5) ==> n /=
        [(car(m) ¥R_PLUS R_Rev(car(m))) ¥R_PLUS car(n), (cdr(m) ¥R_PLUS R_Rev(cdr(m))) ¥R_PLUS cdr(n)]
--
-- However, the inequality which we have now reached conflicts with the algebra of reals,
-- which ensures equality of the two sides.
--
    (car(m), R_Rev(car(m)))-->T615(Stat1*) ==> car(m) ¥R_PLUS R_Rev(car(m)) = R_Rev(car(m)) ¥R_PLUS car(m)
    (cdr(m), R_Rev(cdr(m)))-->T615(Stat1*) ==> cdr(m) ¥R_PLUS R_Rev(cdr(m)) = R_Rev(cdr(m)) ¥R_PLUS cdr(m)
    (car(m))-->T632(Stat2, Stat2*) ==> R_Rev(car(m)) ¥R_PLUS car(m) = R_0
    (cdr(m))-->T632(Stat2, Stat2*) ==> R_Rev(cdr(m)) ¥R_PLUS cdr(m) = R_0
    (car(n))-->T626(Stat1, Stat1*) ==> R_0 ¥R_PLUS car(n) = car(n)
    (cdr(n))-->T626(Stat1, Stat1*) ==> R_0 ¥R_PLUS cdr(n) = cdr(n)
EQUAL(Stat1) ==> false; Discharge ==> QED
--
Theorem 824: ((N in Cm) & (M in Cm)) ¥imp (N ¥C_TIMES M = M ¥C_TIMES N). Proof:
Suppose_not(n,m) ==> AUTO
    n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
    m-->T816(*) ==> Stat2: (car(m) in Re) & (cdr(m) in Re) & (m = [car(m),cdr(m)])
    Use_def(¥C_TIMES)(*) ==> n ¥C_TIMES m = [(car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m)),(car(n) ¥R_TIMES cdr(m)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m))]
    Use_def(¥C_TIMES)(*) ==> m ¥C_TIMES n = [(car(m) ¥R_TIMES car(n)) ¥R_MINUS (cdr(m) ¥R_TIMES cdr(n)),(car(m) ¥R_TIMES cdr(n)) ¥R_PLUS (cdr(m) ¥R_TIMES car(n))]
    (car(n), car(m))-->T618(Stat1, Stat2*) ==> (car(n) ¥R_TIMES car(m)) = (car(m) ¥R_TIMES car(n))
    (cdr(n), cdr(m))-->T618(Stat1, Stat2*) ==> (cdr(n) ¥R_TIMES cdr(m)) = (cdr(m) ¥R_TIMES cdr(n))
    (car(n), cdr(m))-->T618(Stat1, Stat2*) ==> (car(n) ¥R_TIMES cdr(m)) = (cdr(m) ¥R_TIMES car(n))
    (cdr(n), car(m))-->T618(Stat1, Stat2*) ==> (cdr(n) ¥R_TIMES car(m)) = (car(m) ¥R_TIMES cdr(n))
    (cdr(m), car(n))-->T614(Stat1, Stat2*) ==> Stat3: (cdr(m) ¥R_TIMES car(n)) in Re
    (car(m), cdr(n))-->T614(Stat1, Stat2*) ==> Stat4: (car(m) ¥R_TIMES cdr(n)) in Re
    ((cdr(m) ¥R_TIMES car(n)), (car(m) ¥R_TIMES cdr(n)))-->T615(Stat3, Stat4*) ==> ((cdr(m) ¥R_TIMES car(n)) ¥R_PLUS (car(m) ¥R_TIMES cdr(n))) = ((car(m) ¥R_TIMES cdr(n)) ¥R_PLUS (cdr(m) ¥R_TIMES car(n)))
    EQUAL ==> false
Discharge ==> QED
--
Theorem 825: (N in Cm) ¥imp ((C_abs(N) in Re) & R_is_nonneg(C_abs(N))). Proof:
Suppose_not(n) ==> AUTO
	n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
	(car(n))-->T714(Stat1,Stat1*) ==> Stat2: R_is_nonneg(car(n) ¥R_TIMES car(n))
	(cdr(n))-->T714(Stat1,Stat1*) ==> R_is_nonneg(cdr(n) ¥R_TIMES cdr(n))
	ALGEBRA(Stat1) ==> Stat3: ((car(n) ¥R_TIMES car(n)) in Re) & ((cdr(n) ¥R_TIMES cdr(n)) in Re) &
		(((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n))) in Re)
	((car(n) ¥R_TIMES car(n)), (cdr(n) ¥R_TIMES cdr(n)))-->T667(Stat2*) ==> R_is_nonneg((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n)))
	((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n)))-->T808(Stat3*) ==> (sqrt((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n))) in Re) &
		(R_is_nonneg(sqrt((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n)))))
	Use_def(C_abs)(*) ==> false
	Discharge ==> QED
--
Theorem 826: (N in Cm) ¥imp (C_abs(N) = C_abs(C_Rev(N))). Proof:
Suppose_not(n) ==> AUTO
	n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
	n-->T821(*) ==> Stat2: C_Rev(n) in Cm
	(C_Rev(n))-->T816(Stat2*) ==> Stat3: (car(C_Rev(n)) in Re) & (cdr(C_Rev(n)) in Re) & (C_Rev(n) = [car(C_Rev(n)),cdr(C_Rev(n))])
	Use_def(C_Rev)(*) ==> C_Rev(n) = [R_Rev(car(n)),R_Rev(cdr(n))]
	(Stat3)ELEM ==> car(C_Rev(n)) = R_Rev(car(n)) & cdr(C_Rev(n)) = R_Rev(cdr(n))
	Use_def(C_abs)(*) ==> (C_abs(n) = sqrt((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n)))) &
		(C_abs(C_Rev(n)) = sqrt((car(C_Rev(n)) ¥R_TIMES car(C_Rev(n))) ¥R_PLUS (cdr(C_Rev(n)) ¥R_TIMES cdr(C_Rev(n)))))
	ALGEBRA(Stat1, Stat1) ==> ((R_Rev(car(n)) ¥R_TIMES R_Rev(car(n))) = (car(n) ¥R_TIMES car(n))) &
		((R_Rev(cdr(n)) ¥R_TIMES R_Rev(cdr(n))) = (cdr(n) ¥R_TIMES cdr(n)))
	EQUAL ==> false
	Discharge ==> QED
--
Theorem 827: ((N in Cm) & (M in Cm)) ¥imp
	(((C_abs(N) ¥R_PLUS C_abs(M)) ¥R_GT C_abs(N ¥C_PLUS M)) or (C_abs(N) ¥R_PLUS C_abs(M) = C_abs(N ¥C_PLUS M))). Proof:
Suppose_not(n,m) ==> Stat1: (n in Cm) & (m in Cm) &
	(not((C_abs(n) ¥R_PLUS C_abs(m) ¥R_GT C_abs(n ¥C_PLUS m)) or (C_abs(n) ¥R_PLUS C_abs(m) = C_abs(n ¥C_PLUS m))))
--
-- We rewrite the inequality by using the definitions of $C_abs, ¥C_PLUS$:
--
    n-->T816(*) ==> Stat2: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
    m-->T816(*) ==> Stat3: (car(m) in Re) & (cdr(m) in Re) & (m = [car(m),cdr(m)])
    (n, m)-->T818(*) ==> Stat4: (n ¥C_PLUS m) in Cm
    Use_def(C_abs)(*) ==> Stat5:
	(C_abs(n) = sqrt((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n)))) &
        (C_abs(m) = sqrt((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))))
--
    (n ¥C_PLUS m)-->T816(Stat4, Stat4*) ==> Stat6: (car(n ¥C_PLUS m) in Re) & (cdr(n ¥C_PLUS m) in Re) & (n ¥C_PLUS m = [car(n ¥C_PLUS m), cdr(n ¥C_PLUS m)])
    Use_def(¥C_PLUS)(Stat4, Stat4*) ==> Stat7: (car(n ¥C_PLUS m) = (car(n) ¥R_PLUS car(m))) & (cdr(n ¥C_PLUS m) = (cdr(n) ¥R_PLUS cdr(m)))
    Use_def(C_abs)(Stat4) ==> Stat8:
        C_abs(n ¥C_PLUS m) = sqrt((car(n ¥C_PLUS m) ¥R_TIMES car(n ¥C_PLUS m)) ¥R_PLUS
                    (cdr(n ¥C_PLUS m) ¥R_TIMES cdr(n ¥C_PLUS m)))
--
-- The right-hand side of the inequality which we have assumed true at the beginning
-- is positive if and only if $R_is_nonneg(C_abs(n ¥C_PLUS m))$,
-- viz. iff $C_abs(n ¥C_PLUS m) ¥R_GE R_0$.
--
    n-->T825(*) ==> Stat9: (C_abs(n) in Re) & R_is_nonneg(C_abs(n))
    m-->T825(*) ==> Stat10: (C_abs(m) in Re) & R_is_nonneg(C_abs(m))
    (n ¥C_PLUS m)-->T825(Stat4, Stat4*) ==> Stat11: (C_abs(n ¥C_PLUS m) in Re) & R_is_nonneg(C_abs(n ¥C_PLUS m))
    (C_abs(n ¥C_PLUS m))-->T681(Stat11, Stat11*) ==> Stat12: (C_abs(n ¥C_PLUS m) ¥R_GE R_0)
--
-- We will use the inequality in the $¥R_GE$ form:
--
    (C_abs(n), C_abs(m))-->T613(Stat9, Stat10*) ==> Stat13: (C_abs(n) ¥R_PLUS C_abs(m)) in Re
    (C_abs(n) ¥R_PLUS C_abs(m), C_abs(n ¥C_PLUS m))-->T680(Stat1, Stat11, Stat13*) ==> Stat14: not((C_abs(n) ¥R_PLUS C_abs(m)) ¥R_GE C_abs(n ¥C_PLUS m))
--
-- Now we can multiply the inequality by itself:
--
    (C_abs(n), C_abs(m))-->T667(Stat2, Stat3, Stat9, Stat10*) ==> Stat15: R_is_nonneg(C_abs(n) ¥R_PLUS C_abs(m))
    (C_abs(n) ¥R_PLUS C_abs(m))-->T681(Stat13, Stat15*) ==> Stat16: (C_abs(n) ¥R_PLUS C_abs(m)) ¥R_GE R_0
    (C_abs(n) ¥R_PLUS C_abs(m), C_abs(n ¥C_PLUS m))-->T715(Stat11, Stat12, Stat13,Stat14,Stat16*) ==> Stat17:
        not(((C_abs(n) ¥R_PLUS C_abs(m)) ¥R_TIMES (C_abs(n) ¥R_PLUS C_abs(m))) ¥R_GE (C_abs(n ¥C_PLUS m) ¥R_TIMES C_abs(n ¥C_PLUS m)))
--
-- Then we rewrite the right-hand side of the inequality above as follows:
--
    ALGEBRA(Stat2,Stat3) ==> Stat18:  ((car(n) ¥R_PLUS car(m)) in Re) &
		((cdr(n) ¥R_PLUS cdr(m)) in Re) &
		(((car(n) ¥R_PLUS car(m)) ¥R_TIMES (car(n) ¥R_PLUS car(m))) in Re) &
		(((cdr(n) ¥R_PLUS cdr(m)) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m))) in Re) &
		((((car(n) ¥R_PLUS car(m)) ¥R_TIMES (car(n) ¥R_PLUS car(m))) ¥R_PLUS ((cdr(n) ¥R_PLUS cdr(m)) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m)))) in Re)
--
    (car(n) ¥R_PLUS car(m))-->T714(Stat18*) ==> R_is_nonneg((car(n) ¥R_PLUS car(m)) ¥R_TIMES (car(n) ¥R_PLUS car(m)))
    (cdr(n) ¥R_PLUS cdr(m))-->T714(Stat18, Stat18*) ==> R_is_nonneg((cdr(n) ¥R_PLUS cdr(m)) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m)))
    ((car(n) ¥R_PLUS car(m)) ¥R_TIMES (car(n) ¥R_PLUS car(m)),(cdr(n) ¥R_PLUS cdr(m)) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m)))-->T667(Stat18*) ==>
        Stat19: R_is_nonneg(((car(n) ¥R_PLUS car(m)) ¥R_TIMES (car(n) ¥R_PLUS car(m))) ¥R_PLUS ((cdr(n) ¥R_PLUS cdr(m)) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m))))
--
    (((car(n) ¥R_PLUS car(m)) ¥R_TIMES (car(n) ¥R_PLUS car(m))) ¥R_PLUS ((cdr(n) ¥R_PLUS cdr(m)) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m))))-->T808(Stat18, Stat19*) ==> Stat20:
	sqrt(((car(n) ¥R_PLUS car(m)) ¥R_TIMES (car(n) ¥R_PLUS car(m))) ¥R_PLUS ((cdr(n) ¥R_PLUS cdr(m)) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m)))) ¥R_TIMES
	sqrt(((car(n) ¥R_PLUS car(m)) ¥R_TIMES (car(n) ¥R_PLUS car(m))) ¥R_PLUS ((cdr(n) ¥R_PLUS cdr(m)) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m)))) =
	    (((car(n) ¥R_PLUS car(m)) ¥R_TIMES (car(n) ¥R_PLUS car(m))) ¥R_PLUS ((cdr(n) ¥R_PLUS cdr(m)) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m))))
--
-- rewriting the first parenthesis
--
    ALGEBRA(Stat2,Stat3) ==> Stat21: ((car(n) ¥R_PLUS car(m)) ¥R_TIMES (car(n) ¥R_PLUS car(m)) = (car(n) ¥R_TIMES (car(n) ¥R_PLUS car(m))) ¥R_PLUS (car(m) ¥R_TIMES (car(n) ¥R_PLUS car(m)))) &
		(car(n) ¥R_TIMES (car(n) ¥R_PLUS car(m)) = (car(n) ¥R_TIMES car(n)) ¥R_PLUS (car(n) ¥R_TIMES car(m))) &
		(car(m) ¥R_TIMES (car(n) ¥R_PLUS car(m)) = (car(m) ¥R_TIMES car(n)) ¥R_PLUS (car(m) ¥R_TIMES car(m)))
--
-- rewriting the second parenthesis
--
    ALGEBRA(Stat2,Stat3) ==> Stat22: ((cdr(n) ¥R_PLUS cdr(m)) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m)) = (cdr(n) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m))) ¥R_PLUS (cdr(m) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m)))) &
		(cdr(n) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m)) = (cdr(n) ¥R_TIMES cdr(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(m))) &
		(cdr(m) ¥R_TIMES (cdr(n) ¥R_PLUS cdr(m)) = (cdr(m) ¥R_TIMES cdr(n)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m)))
    EQUAL(Stat21,Stat22,Stat8,Stat20,Stat7) ==> Stat23: (C_abs(n ¥C_PLUS m) ¥R_TIMES C_abs(n ¥C_PLUS m)) =
	(((car(n) ¥R_TIMES car(n)) ¥R_PLUS (car(n) ¥R_TIMES car(m))) ¥R_PLUS ((car(m) ¥R_TIMES car(n)) ¥R_PLUS (car(m) ¥R_TIMES car(m)))) ¥R_PLUS
        (((cdr(n) ¥R_TIMES cdr(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(m))) ¥R_PLUS ((cdr(m) ¥R_TIMES cdr(n)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))))

--
-- Then we rewrite the left-hand side of the inequality above as follows:
--
--
-- rewriting the first $sqrt$
    ALGEBRA(Stat2,Stat3) ==> Stat24: ((car(n) ¥R_TIMES car(n)) in Re) &
		((cdr(n) ¥R_TIMES cdr(n)) in Re) &
		(((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n))) in Re)
    (car(n))-->T714(Stat2, Stat2*) ==> Stat25:  R_is_nonneg(car(n) ¥R_TIMES car(n))
    (cdr(n))-->T714(Stat2, Stat2*) ==> Stat26: R_is_nonneg(cdr(n) ¥R_TIMES cdr(n))
    (car(n) ¥R_TIMES car(n), cdr(n) ¥R_TIMES cdr(n))-->T667(Stat24, Stat25, Stat26*) ==> Stat27: R_is_nonneg((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n)))
    ((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n)))-->T808(Stat24, Stat27*) ==> Stat28:
        (sqrt((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n))) ¥R_TIMES
         sqrt((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n))) =
            ((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n)))) &
        (sqrt((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n))) in Re)
--
-- rewriting the second $sqrt$
    ALGEBRA(Stat2,Stat3) ==> Stat29: ((car(m) ¥R_TIMES car(m)) in Re) &
		((cdr(m) ¥R_TIMES cdr(m)) in Re) &
		(((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))) in Re)
    (car(m))-->T714(Stat3, Stat3*) ==> Stat30:  R_is_nonneg(car(m) ¥R_TIMES car(m))
    (cdr(m))-->T714(Stat3, Stat3*) ==> Stat31: R_is_nonneg(cdr(m) ¥R_TIMES cdr(m))
    (car(m) ¥R_TIMES car(m), cdr(m) ¥R_TIMES cdr(m))-->T667(Stat29, Stat32, Stat30, Stat31*) ==> Stat33: R_is_nonneg((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m)))
    ((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m)))-->T808(Stat29, Stat33*) ==> Stat34:
        (sqrt((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))) ¥R_TIMES
        sqrt((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))) =
            ((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m)))) &
        (sqrt((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))) in Re)
--
-- It will ease our arguments having short aliases for $C_abs(n)$, $C_abs(m)$
-- available to us.
--
    Loc_def ==> Stat35: (C_abs_n = sqrt((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n)))) &
			(C_abs_m = sqrt((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))))
--
    EQUAL(Stat28,Stat34,Stat35) ==> Stat36: (C_abs_n in Re) & (C_abs_m in Re)
--
    ALGEBRA(Stat36) ==> Stat37:
        ((C_abs_n ¥R_PLUS C_abs_m) ¥R_TIMES (C_abs_n ¥R_PLUS C_abs_m) =
		(C_abs_n ¥R_TIMES (C_abs_n ¥R_PLUS C_abs_m)) ¥R_PLUS (C_abs_m ¥R_TIMES (C_abs_n ¥R_PLUS C_abs_m))) &
	(C_abs_n ¥R_TIMES (C_abs_n ¥R_PLUS C_abs_m) = (C_abs_n ¥R_TIMES C_abs_n) ¥R_PLUS (C_abs_n ¥R_TIMES C_abs_m)) &
	(C_abs_m ¥R_TIMES (C_abs_n ¥R_PLUS C_abs_m) = (C_abs_m ¥R_TIMES C_abs_n) ¥R_PLUS (C_abs_m ¥R_TIMES C_abs_m))
--
    EQUAL(Stat37,Stat5,Stat28,Stat34,Stat35) ==> Stat38: ((C_abs(n) ¥R_PLUS C_abs(m)) ¥R_TIMES (C_abs(n) ¥R_PLUS C_abs(m))) =
	(((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n))) ¥R_PLUS (C_abs_n ¥R_TIMES C_abs_m)) ¥R_PLUS
	((C_abs_m ¥R_TIMES C_abs_n) ¥R_PLUS ((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))))
--
    EQUAL(Stat38,Stat23,Stat17) ==> not(((((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n))) ¥R_PLUS (C_abs_n ¥R_TIMES C_abs_m)) ¥R_PLUS
		((C_abs_m ¥R_TIMES C_abs_n) ¥R_PLUS ((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))))) ¥R_GE
	((((car(n) ¥R_TIMES car(n)) ¥R_PLUS (car(n) ¥R_TIMES car(m))) ¥R_PLUS ((car(m) ¥R_TIMES car(n)) ¥R_PLUS (car(m) ¥R_TIMES car(m)))) ¥R_PLUS
        (((cdr(n) ¥R_TIMES cdr(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(m))) ¥R_PLUS ((cdr(m) ¥R_TIMES cdr(n)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))))))
--
Tsomehow ==> false; Discharge ==> QED
--
Theorem 828: ((N in Cm) & (M in Cm)) ¥imp
    (((C_abs(N) ¥R_PLUS C_abs(M)) ¥R_GT C_abs(N ¥C_MINUS M)) or (C_abs(N) ¥R_PLUS C_abs(M) = C_abs(N ¥C_MINUS M))). Proof:
Suppose_not(n,m) ==>
    (n in Cm) & (m in Cm) & (not((C_abs(n) ¥R_PLUS C_abs(m) ¥R_GT C_abs(n ¥C_MINUS m)) or (C_abs(n) ¥R_PLUS C_abs(m) = C_abs(n ¥C_MINUS m))))
    Use_def(¥C_MINUS)(*) ==> n ¥C_MINUS m = n ¥C_PLUS C_Rev(m)
    m-->T821(*) ==> C_Rev(m) in Cm
    m-->T826(*) ==> C_abs(C_Rev(m)) = C_abs(m)
    (n, C_Rev(m))-->T827 ==> (C_abs(n) ¥R_PLUS C_abs(C_Rev(m)) ¥R_GT C_abs(n ¥C_PLUS C_Rev(m))) or (C_abs(n) ¥R_PLUS C_abs(C_Rev(m)) = C_abs(n ¥C_PLUS C_Rev(m)))
EQUAL ==> false; Discharge ==> QED
--
Theorem 829: ((N in Cm) & (M in Cm)) ¥imp (C_abs(N) ¥R_TIMES C_abs(M) = C_abs(N ¥C_TIMES M)). Proof:
Suppose_not(n,m) ==> AUTO
--
-- Assuming the contrary of the claim, it follows from $n in Cm$, $m in Cm$ that
-- their components are reals, and that their product is a complex. By recalling
-- the definitions of $C_abs$, $¥C_TIMES$, and dropping the square roots (since their
-- arguments are easily recognized to be non-negative reals, we obtain an inequality
-- which will be refuted by merely algeraic arguments, referring to the reals.
--
	n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re)
	m-->T816(*) ==> Stat2: (car(m) in Re) & (cdr(m) in Re)
	(n,m)-->T818(*) ==> (n ¥C_TIMES m) in Cm
	Use_def(C_abs)(*) ==> Stat3: sqrt((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n))) ¥R_TIMES sqrt((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))) /=
		sqrt((car(n ¥C_TIMES m) ¥R_TIMES car(n ¥C_TIMES m)) ¥R_PLUS (cdr(n ¥C_TIMES m) ¥R_TIMES cdr(n ¥C_TIMES m)))
	Use_def(¥C_TIMES)(*) ==> Stat4: (n ¥C_TIMES m) = [(car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m)),
		(car(n) ¥R_TIMES cdr(m)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m))]
	(n ¥C_TIMES m)-->T816(Stat1*) ==> (car(n ¥C_TIMES m) in Re) & (cdr(n ¥C_TIMES m) in Re)
	ALGEBRA(Stat1,Stat2) ==> ((car(n) ¥R_TIMES car(n)) in Re) &
			((car(m) ¥R_TIMES car(m)) in Re) &
			((cdr(n) ¥R_TIMES cdr(n)) in Re) &
			((cdr(m) ¥R_TIMES cdr(m)) in Re) &
			((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n)) in Re) &
			((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m)) in Re)
	(car(n))-->T714(Stat1,Stat1*) ==> R_is_nonneg(car(n) ¥R_TIMES car(n))
	(cdr(n))-->T714(Stat1,Stat1*) ==> R_is_nonneg(cdr(n) ¥R_TIMES cdr(n))
	(car(m))-->T714(Stat2,Stat2*) ==> R_is_nonneg(car(m) ¥R_TIMES car(m))
	(cdr(m))-->T714(Stat2,Stat2*) ==> R_is_nonneg(cdr(m) ¥R_TIMES cdr(m))
	(car(n) ¥R_TIMES car(n),cdr(n) ¥R_TIMES cdr(n))-->T667(Stat3*) ==> R_is_nonneg((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n)))
	(car(m) ¥R_TIMES car(m),cdr(m) ¥R_TIMES cdr(m))-->T667(Stat3*) ==> R_is_nonneg((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m)))
	Suppose ==> Stat5: ((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n))) ¥R_TIMES ((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))) = ((car(n ¥C_TIMES m) ¥R_TIMES car(n ¥C_TIMES m)) ¥R_PLUS (cdr(n ¥C_TIMES m) ¥R_TIMES cdr(n ¥C_TIMES m)))
		((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n)),(car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m)))-->T811(Stat3*) ==> sqrt(((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n))) ¥R_TIMES ((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m)))) /= sqrt((car(n ¥C_TIMES m) ¥R_TIMES car(n ¥C_TIMES m)) ¥R_PLUS (cdr(n ¥C_TIMES m) ¥R_TIMES cdr(n ¥C_TIMES m)))
		EQUAL(Stat5) ==> false
	Discharge ==> AUTO
	TELEM ==> car([(car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m)),
		(car(n) ¥R_TIMES cdr(m)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m))]) = (car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m))
	TELEM ==> cdr([(car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m)),
		(car(n) ¥R_TIMES cdr(m)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m))]) = (car(n) ¥R_TIMES cdr(m)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m))
	EQUAL(Stat4) ==> Stat6: ((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n))) ¥R_TIMES ((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))) /= ((((car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m))) ¥R_TIMES ((car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m)))) ¥R_PLUS (((car(n) ¥R_TIMES cdr(m)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m))) ¥R_TIMES ((car(n) ¥R_TIMES cdr(m)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m)))))
	ALGEBRA(Stat1,Stat2) ==> (((car(n) ¥R_TIMES car(n)) ¥R_PLUS (cdr(n) ¥R_TIMES cdr(n))) ¥R_TIMES ((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))) =
		((car(n) ¥R_TIMES car(n)) ¥R_TIMES ((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m)))) ¥R_PLUS
		((cdr(n) ¥R_TIMES cdr(n)) ¥R_TIMES ((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m)))))  &
		((car(n) ¥R_TIMES car(n)) ¥R_TIMES ((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))) =
			((car(n) ¥R_TIMES car(n)) ¥R_TIMES (car(m) ¥R_TIMES car(m))) ¥R_PLUS ((car(n) ¥R_TIMES car(n)) ¥R_TIMES (cdr(m) ¥R_TIMES cdr(m)))) &
		((cdr(n) ¥R_TIMES cdr(n)) ¥R_TIMES ((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))) =
			((cdr(n) ¥R_TIMES cdr(n)) ¥R_TIMES (car(m) ¥R_TIMES car(m))) ¥R_PLUS ((cdr(n) ¥R_TIMES cdr(n)) ¥R_TIMES (cdr(m) ¥R_TIMES cdr(m))))
	EQUAL ==> Stat7: (((car(n) ¥R_TIMES car(n)) ¥R_TIMES (car(m) ¥R_TIMES car(m))) ¥R_PLUS ((car(n) ¥R_TIMES car(n)) ¥R_TIMES (cdr(m) ¥R_TIMES cdr(m)))) ¥R_PLUS (((cdr(n) ¥R_TIMES cdr(n)) ¥R_TIMES (car(m) ¥R_TIMES car(m))) ¥R_PLUS ((cdr(n) ¥R_TIMES cdr(n)) ¥R_TIMES (cdr(m) ¥R_TIMES cdr(m)))) /=
		((((car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m))) ¥R_TIMES ((car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m)))) ¥R_PLUS (((car(n) ¥R_TIMES cdr(m)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m))) ¥R_TIMES ((car(n) ¥R_TIMES cdr(m)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m)))))
	ALGEBRA(Stat1,Stat2) ==> Stat8: ((car(n) ¥R_TIMES car(m)) in Re) & ((cdr(n) ¥R_TIMES cdr(m)) in Re) & ((car(n) ¥R_TIMES cdr(m)) in Re) & ((cdr(n) ¥R_TIMES car(m)) in Re) & ((car(n) ¥R_TIMES car(m)) ¥R_TIMES (cdr(n) ¥R_TIMES cdr(m)) = (car(n) ¥R_TIMES cdr(m)) ¥R_TIMES (cdr(n) ¥R_TIMES car(m))) &
		(((((car(n) ¥R_TIMES car(m)) ¥R_TIMES (car(n) ¥R_TIMES car(m))) ¥R_PLUS ((cdr(n) ¥R_TIMES cdr(m)) ¥R_TIMES (cdr(n) ¥R_TIMES cdr(m)))) ¥R_MINUS (((car(n) ¥R_TIMES car(m)) ¥R_TIMES (cdr(n) ¥R_TIMES cdr(m))) ¥R_PLUS ((car(n) ¥R_TIMES car(m)) ¥R_TIMES (cdr(n) ¥R_TIMES cdr(m))))) ¥R_PLUS
		 ((((car(n) ¥R_TIMES cdr(m)) ¥R_TIMES (car(n) ¥R_TIMES cdr(m))) ¥R_PLUS ((cdr(n) ¥R_TIMES car(m)) ¥R_TIMES (cdr(n) ¥R_TIMES car(m)))) ¥R_PLUS  (((car(n) ¥R_TIMES cdr(m)) ¥R_TIMES (cdr(n) ¥R_TIMES car(m))) ¥R_PLUS ((car(n) ¥R_TIMES cdr(m)) ¥R_TIMES (cdr(n) ¥R_TIMES car(m))))) =
		 ((((car(n) ¥R_TIMES car(m)) ¥R_TIMES (car(n) ¥R_TIMES car(m))) ¥R_PLUS ((cdr(n) ¥R_TIMES cdr(m)) ¥R_TIMES (cdr(n) ¥R_TIMES cdr(m))))) ¥R_PLUS
		 ((((car(n) ¥R_TIMES cdr(m)) ¥R_TIMES (car(n) ¥R_TIMES cdr(m))) ¥R_PLUS ((cdr(n) ¥R_TIMES car(m)) ¥R_TIMES (cdr(n) ¥R_TIMES car(m))))))
	(car(n) ¥R_TIMES car(m),cdr(n) ¥R_TIMES cdr(m))-->T806(Stat8,Stat8*) ==> ((car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m))) ¥R_TIMES ((car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m))) = (((car(n) ¥R_TIMES car(m)) ¥R_TIMES (car(n) ¥R_TIMES car(m))) ¥R_PLUS ((cdr(n) ¥R_TIMES cdr(m)) ¥R_TIMES (cdr(n) ¥R_TIMES cdr(m)))) ¥R_MINUS (((car(n) ¥R_TIMES car(m)) ¥R_TIMES (cdr(n) ¥R_TIMES cdr(m))) ¥R_PLUS ((car(n) ¥R_TIMES car(m)) ¥R_TIMES (cdr(n) ¥R_TIMES cdr(m))))
	(car(n) ¥R_TIMES cdr(m),cdr(n) ¥R_TIMES car(m))-->T805(Stat8,Stat8*) ==> ((car(n) ¥R_TIMES cdr(m)) ¥R_PLUS  (cdr(n) ¥R_TIMES car(m))) ¥R_TIMES ((car(n) ¥R_TIMES cdr(m)) ¥R_PLUS  (cdr(n) ¥R_TIMES car(m))) = (((car(n) ¥R_TIMES cdr(m)) ¥R_TIMES (car(n) ¥R_TIMES cdr(m))) ¥R_PLUS ((cdr(n) ¥R_TIMES car(m)) ¥R_TIMES (cdr(n) ¥R_TIMES car(m)))) ¥R_PLUS  (((car(n) ¥R_TIMES cdr(m)) ¥R_TIMES (cdr(n) ¥R_TIMES car(m))) ¥R_PLUS ((car(n) ¥R_TIMES cdr(m)) ¥R_TIMES (cdr(n) ¥R_TIMES car(m))))
	EQUAL(Stat7) ==> Stat9: (((car(n) ¥R_TIMES car(n)) ¥R_TIMES (car(m) ¥R_TIMES car(m))) ¥R_PLUS
				 ((car(n) ¥R_TIMES car(n)) ¥R_TIMES (cdr(m) ¥R_TIMES cdr(m)))) ¥R_PLUS
				(((cdr(n) ¥R_TIMES cdr(n)) ¥R_TIMES (car(m) ¥R_TIMES car(m))) ¥R_PLUS
				 ((cdr(n) ¥R_TIMES cdr(n)) ¥R_TIMES (cdr(m) ¥R_TIMES cdr(m)))) /=
		((((car(n) ¥R_TIMES car(m)) ¥R_TIMES (car(n) ¥R_TIMES car(m))) ¥R_PLUS ((cdr(n) ¥R_TIMES cdr(m)) ¥R_TIMES (cdr(n) ¥R_TIMES cdr(m))))) ¥R_PLUS
		((((car(n) ¥R_TIMES cdr(m)) ¥R_TIMES (car(n) ¥R_TIMES cdr(m))) ¥R_PLUS ((cdr(n) ¥R_TIMES car(m)) ¥R_TIMES (cdr(n) ¥R_TIMES car(m)))))
ALGEBRA(Stat1,Stat2,Stat9) ==> false; Discharge ==> QED
--
Theorem 830: ((N in Cm) & (M in Cm) & (M /= C_0)) ¥imp (C_abs(N) ¥R_OVER C_abs(M) = C_abs(N ¥C_OVER M)). Proof:
    Suppose_not(n,m) ==> (n in Cm) & (m in Cm) & (m /= C_0) & (C_abs(n) ¥R_OVER C_abs(m) /= C_abs(n ¥C_OVER m))
    THUS ==> (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)]) & (car(m) in Re) & (cdr(m) in Re) & (m = [car(m),cdr(m)])
     TO_BE_CONTINUED ==> false; Discharge ==> QED
--
Theorem 831: ((K in Cm) & (N in Cm) & (M in Cm)) ¥imp (N ¥C_PLUS (M ¥C_PLUS K) = (N ¥C_PLUS M) ¥C_PLUS K). Proof:
Suppose_not(k,n,m) ==> Stat1: (k in Cm) & (n in Cm) & (m in Cm) & (n ¥C_PLUS (m ¥C_PLUS k) /= (n ¥C_PLUS m) ¥C_PLUS k)
	Use_def(¥C_PLUS)(*) ==> Stat2:
		(car(n ¥C_PLUS m) = (car(n) ¥R_PLUS car(m))) &
		(cdr(n ¥C_PLUS m) = (cdr(n) ¥R_PLUS cdr(m))) &
		(car(m ¥C_PLUS k) = (car(m) ¥R_PLUS car(k))) &
		(cdr(m ¥C_PLUS k) = (cdr(m) ¥R_PLUS cdr(k))) &
		(n ¥C_PLUS (m ¥C_PLUS k) = [car(n) ¥R_PLUS car(m ¥C_PLUS k),cdr(n) ¥R_PLUS cdr(m ¥C_PLUS k)]) &
		((n ¥C_PLUS m) ¥C_PLUS k = [car(n ¥C_PLUS m) ¥R_PLUS car(k),cdr(n ¥C_PLUS m) ¥R_PLUS cdr(k)])
	Loc_def ==> Stat3: an = car(n)
	Loc_def ==> Stat4: dn = cdr(n)
	Loc_def ==> Stat5: am = car(m)
	Loc_def ==> Stat6: dm = cdr(m)
	Loc_def ==> Stat7: ak = car(k)
	Loc_def ==> Stat8: dk = cdr(k)
	EQUAL(Stat1) ==> Stat9:
			[an ¥R_PLUS (am ¥R_PLUS ak), dn ¥R_PLUS (dm ¥R_PLUS dk)] /=
			[(an ¥R_PLUS am) ¥R_PLUS ak, (dn ¥R_PLUS dm) ¥R_PLUS dk]
	n-->T816(Stat1,Stat3,Stat4*) ==> (an in Re) & (dn in Re)
	m-->T816(Stat1,Stat5,Stat6*) ==> (am in Re) & (dm in Re)
	k-->T816(Stat1,Stat7,Stat8*) ==> (ak in Re) & (dk in Re)
ALGEBRA(Stat9*) ==> false; Discharge ==> QED
--
--
--
Theorem 832: ((K in Cm) & (N in Cm) & (M in Cm)) ¥imp ((N ¥C_TIMES (M ¥C_TIMES K)) = ((N ¥C_TIMES M) ¥C_TIMES K)). Proof:
Suppose_not(k,n,m) ==> Stat1: (k in Cm) & (n in Cm) & (m in Cm) & (n ¥C_TIMES (m ¥C_TIMES k) /= (n ¥C_TIMES m) ¥C_TIMES k)
	Use_def(¥C_TIMES)(*) ==> Stat2:
		(car(n ¥C_TIMES m) = (car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m))) &
		(cdr(n ¥C_TIMES m) = (car(n) ¥R_TIMES cdr(m)) ¥R_PLUS  (cdr(n) ¥R_TIMES car(m))) &
		(car(m ¥C_TIMES k) = (car(m) ¥R_TIMES car(k)) ¥R_MINUS (cdr(m) ¥R_TIMES cdr(k))) &
		(cdr(m ¥C_TIMES k) = (car(m) ¥R_TIMES cdr(k)) ¥R_PLUS  (cdr(m) ¥R_TIMES car(k))) &
		((n ¥C_TIMES (m ¥C_TIMES k)) = [(car(n) ¥R_TIMES car(m ¥C_TIMES k)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m ¥C_TIMES k)),
			(car(n) ¥R_TIMES cdr(m ¥C_TIMES k)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m ¥C_TIMES k))]) &
		(((n ¥C_TIMES m) ¥C_TIMES k) = [(car(n ¥C_TIMES m) ¥R_TIMES car(k)) ¥R_MINUS (cdr(n ¥C_TIMES m) ¥R_TIMES cdr(k)),
			(car(n ¥C_TIMES m) ¥R_TIMES cdr(k)) ¥R_PLUS (cdr(n ¥C_TIMES m) ¥R_TIMES car(k))])
	Loc_def ==> Stat3: ((an = car(n)) & (dn = cdr(n))) &
			((am = car(m)) & (dm = cdr(m))) &
			((ak = car(k)) & (dk = cdr(k)))
	EQUAL ==> Stat4:
			[(an ¥R_TIMES ((am ¥R_TIMES ak) ¥R_MINUS (dm ¥R_TIMES dk))) ¥R_MINUS (dn ¥R_TIMES ((am ¥R_TIMES dk) ¥R_PLUS  (dm ¥R_TIMES ak))),
			 (an ¥R_TIMES ((am ¥R_TIMES dk) ¥R_PLUS  (dm ¥R_TIMES ak))) ¥R_PLUS (dn ¥R_TIMES ((am ¥R_TIMES ak) ¥R_MINUS (dm ¥R_TIMES dk)))] /=
			[(((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_TIMES ak) ¥R_MINUS (((an ¥R_TIMES dm) ¥R_PLUS  (dn ¥R_TIMES am)) ¥R_TIMES dk),
			 (((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_TIMES dk) ¥R_PLUS  (((an ¥R_TIMES dm) ¥R_PLUS  (dn ¥R_TIMES am)) ¥R_TIMES ak)]
	(Stat4)ELEM ==> ((an ¥R_TIMES ((am ¥R_TIMES ak) ¥R_MINUS (dm ¥R_TIMES dk))) ¥R_MINUS (dn ¥R_TIMES ((am ¥R_TIMES dk) ¥R_PLUS  (dm ¥R_TIMES ak))) /= (((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_TIMES ak) ¥R_MINUS (((an ¥R_TIMES dm) ¥R_PLUS  (dn ¥R_TIMES am)) ¥R_TIMES dk)) or
		((an ¥R_TIMES ((am ¥R_TIMES dk) ¥R_PLUS  (dm ¥R_TIMES ak))) ¥R_PLUS (dn ¥R_TIMES ((am ¥R_TIMES ak) ¥R_MINUS (dm ¥R_TIMES dk))) /= (((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_TIMES dk) ¥R_PLUS  (((an ¥R_TIMES dm) ¥R_PLUS  (dn ¥R_TIMES am)) ¥R_TIMES ak))
	n-->T816(Stat1,Stat3*) ==> Stat5: (an in Re) & (dn in Re)
	m-->T816(Stat1,Stat3*) ==> Stat6: (am in Re) & (dm in Re)
	k-->T816(Stat1,Stat3,Stat5*) ==> Stat7: (ak in Re) & (dk in Re) & (an in Re) & (dn in Re)
	Suppose ==> Stat8: (an ¥R_TIMES ((am ¥R_TIMES ak) ¥R_MINUS (dm ¥R_TIMES dk))) ¥R_MINUS (dn ¥R_TIMES ((am ¥R_TIMES dk) ¥R_PLUS  (dm ¥R_TIMES ak))) /= (((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_TIMES ak) ¥R_MINUS (((an ¥R_TIMES dm) ¥R_PLUS  (dn ¥R_TIMES am)) ¥R_TIMES dk)
		ALGEBRA(Stat6,Stat7) ==> ((an ¥R_TIMES ((am ¥R_TIMES ak) ¥R_MINUS (dm ¥R_TIMES dk))) = (an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_MINUS (an ¥R_TIMES (dm ¥R_TIMES dk))) &
			((dn ¥R_TIMES ((am ¥R_TIMES dk) ¥R_PLUS  (dm ¥R_TIMES ak))) = (dn ¥R_TIMES (am ¥R_TIMES dk)) ¥R_PLUS  (dn ¥R_TIMES (dm ¥R_TIMES ak))) &
			(((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_MINUS (an ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_MINUS ((dn ¥R_TIMES (am ¥R_TIMES dk)) ¥R_PLUS (dn ¥R_TIMES (dm ¥R_TIMES ak))) = (((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_MINUS (an ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_MINUS (dn ¥R_TIMES (am ¥R_TIMES dk))) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_TIMES ak))) &
			((((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_MINUS (an ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_MINUS (dn ¥R_TIMES (am ¥R_TIMES dk))) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_TIMES ak)) = (((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_MINUS (an ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_MINUS (dn ¥R_TIMES (am ¥R_TIMES dk))) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES ak))) &
			((((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_MINUS (an ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_MINUS (dn ¥R_TIMES (am ¥R_TIMES dk))) = (((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_MINUS (an ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_PLUS R_Rev(dn ¥R_TIMES (am ¥R_TIMES dk)))) &
			((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_MINUS (an ¥R_TIMES (dm ¥R_TIMES dk)) = (an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_PLUS R_Rev(an ¥R_TIMES (dm ¥R_TIMES dk)))
		EQUAL(Stat8) ==> Stat9: (((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_PLUS R_Rev(an ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_PLUS R_Rev(dn ¥R_TIMES (am ¥R_TIMES dk))) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES ak)) /= (((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_TIMES ak) ¥R_MINUS (((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES dk)
		ALGEBRA(Stat6,Stat7) ==> ((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_PLUS (R_Rev(an ¥R_TIMES (dm ¥R_TIMES dk)) ¥R_PLUS R_Rev(dn ¥R_TIMES (am ¥R_TIMES dk))) = ((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_PLUS R_Rev(an ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_PLUS R_Rev(dn ¥R_TIMES (am ¥R_TIMES dk))) &
			(R_Rev((an ¥R_TIMES (dm ¥R_TIMES dk)) ¥R_PLUS (dn ¥R_TIMES (am ¥R_TIMES dk))) = R_Rev(an ¥R_TIMES (dm ¥R_TIMES dk)) ¥R_PLUS R_Rev(dn ¥R_TIMES (am ¥R_TIMES dk)))
		EQUAL(Stat9) ==> Stat10: ((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_PLUS R_Rev((an ¥R_TIMES (dm ¥R_TIMES dk)) ¥R_PLUS (dn ¥R_TIMES (am ¥R_TIMES dk)))) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES ak)) /= (((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_TIMES ak) ¥R_MINUS (((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES dk)
		ALGEBRA(Stat6,Stat7) ==> (an ¥R_TIMES (dm ¥R_TIMES dk) = (an ¥R_TIMES dm) ¥R_TIMES dk) &
			(dn ¥R_TIMES (am ¥R_TIMES dk) = (dn ¥R_TIMES am) ¥R_TIMES dk) &
			(dk ¥R_TIMES (an ¥R_TIMES dm) = (an ¥R_TIMES dm) ¥R_TIMES dk) &
			(dk ¥R_TIMES (dn ¥R_TIMES am) = (dn ¥R_TIMES am) ¥R_TIMES dk) &
			(dk ¥R_TIMES ((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) = (dk ¥R_TIMES (an ¥R_TIMES dm)) ¥R_PLUS (dk ¥R_TIMES (dn ¥R_TIMES am))) &
			(dk ¥R_TIMES ((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) = ((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES dk)
		EQUAL(Stat10) ==> Stat11: ((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_PLUS R_Rev(((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES dk)) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES ak)) /= (((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_TIMES ak) ¥R_MINUS (((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES dk)
		ALGEBRA(Stat6,Stat7) ==>
			(((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_PLUS R_Rev(((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES dk)) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES ak)) = (an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_PLUS (R_Rev(((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES dk) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES ak)))) &
			((R_Rev(((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES dk) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES ak))) = (R_Rev(dn ¥R_TIMES (dm ¥R_TIMES ak)) ¥R_PLUS R_Rev(((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES dk)))
		Loc_def ==> Stat12: (rdndmak = R_Rev(dn ¥R_TIMES (dm ¥R_TIMES ak))) &
			(rdd = R_Rev(((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES dk))
		ALGEBRA(Stat6,Stat7,Stat12) ==> Stat13: (rdndmak in Re) & (rdd in Re)
		ALGEBRA(Stat6,Stat7,Stat13) ==> (((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_PLUS rdndmak) ¥R_PLUS rdd = (an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_PLUS (rdndmak ¥R_PLUS rdd)) &
			(((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES ak))) = ((an ¥R_TIMES (am ¥R_TIMES ak)) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_TIMES ak)))) &
			(an ¥R_TIMES (am ¥R_TIMES ak) = (an ¥R_TIMES am) ¥R_TIMES ak) &
			(dn ¥R_TIMES (dm ¥R_TIMES ak) = (dn ¥R_TIMES dm) ¥R_TIMES ak) &
			(((an ¥R_TIMES am) ¥R_TIMES ak) ¥R_PLUS R_Rev((dn ¥R_TIMES dm) ¥R_TIMES ak) = ((an ¥R_TIMES am) ¥R_TIMES ak) ¥R_MINUS ((dn ¥R_TIMES dm) ¥R_TIMES ak)) &
			((ak ¥R_TIMES (an ¥R_TIMES am) = (an ¥R_TIMES am) ¥R_TIMES ak) & (ak ¥R_TIMES (dn ¥R_TIMES dm) = (dn ¥R_TIMES dm) ¥R_TIMES ak)) &
			(((ak ¥R_TIMES (an ¥R_TIMES am)) ¥R_MINUS (ak ¥R_TIMES (dn ¥R_TIMES dm))) ¥R_PLUS R_Rev(((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES dk) = ((ak ¥R_TIMES (an ¥R_TIMES am)) ¥R_MINUS (ak ¥R_TIMES (dn ¥R_TIMES dm))) ¥R_MINUS (((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES dk)) &
			(ak ¥R_TIMES ((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) = ((ak ¥R_TIMES (an ¥R_TIMES am)) ¥R_MINUS (ak ¥R_TIMES (dn ¥R_TIMES dm)))) &
			((ak ¥R_TIMES ((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm))) = (((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_TIMES ak))
	EQUAL(Stat11) ==> false; Discharge ==> Stat14: (an ¥R_TIMES ((am ¥R_TIMES dk) ¥R_PLUS  (dm ¥R_TIMES ak))) ¥R_PLUS (dn ¥R_TIMES ((am ¥R_TIMES ak) ¥R_MINUS (dm ¥R_TIMES dk))) /= (((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_TIMES dk) ¥R_PLUS (((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES ak)
--	Suppose ==> Stat15: (an ¥R_TIMES ((am ¥R_TIMES dk) ¥R_PLUS  (dm ¥R_TIMES ak))) ¥R_PLUS (dn ¥R_TIMES ((am ¥R_TIMES ak) ¥R_MINUS (dm ¥R_TIMES dk))) /= ((an ¥R_TIMES (am ¥R_TIMES dk)) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_PLUS ((an ¥R_TIMES (dm ¥R_TIMES ak)) ¥R_PLUS (dn ¥R_TIMES (am ¥R_TIMES ak)))
		ALGEBRA(Stat6,Stat7) ==> ((an ¥R_TIMES ((am ¥R_TIMES dk) ¥R_PLUS  (dm ¥R_TIMES ak))) = (an ¥R_TIMES (am ¥R_TIMES dk)) ¥R_PLUS  (an ¥R_TIMES (dm ¥R_TIMES ak))) &
			((dn ¥R_TIMES ((am ¥R_TIMES ak) ¥R_MINUS (dm ¥R_TIMES dk))) = (dn ¥R_TIMES (am ¥R_TIMES ak)) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_TIMES dk))) &
			((dn ¥R_TIMES (am ¥R_TIMES ak)) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_TIMES dk)) = (dn ¥R_TIMES (am ¥R_TIMES ak)) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES dk))) &
			((dn ¥R_TIMES (am ¥R_TIMES ak)) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES dk)) = R_Rev(dn ¥R_TIMES (dm ¥R_TIMES dk)) ¥R_PLUS (dn ¥R_TIMES (am ¥R_TIMES ak))) &
			((((an ¥R_TIMES (am ¥R_TIMES dk)) ¥R_PLUS (an ¥R_TIMES (dm ¥R_TIMES ak))) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_PLUS (dn ¥R_TIMES (am ¥R_TIMES ak)) = ((an ¥R_TIMES (am ¥R_TIMES dk)) ¥R_PLUS (an ¥R_TIMES (dm ¥R_TIMES ak))) ¥R_PLUS (R_Rev(dn ¥R_TIMES (dm ¥R_TIMES dk)) ¥R_PLUS (dn ¥R_TIMES (am ¥R_TIMES ak)))) &
			((((an ¥R_TIMES (am ¥R_TIMES dk)) ¥R_PLUS (an ¥R_TIMES (dm ¥R_TIMES ak))) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES dk))) = ((an ¥R_TIMES (am ¥R_TIMES dk)) ¥R_PLUS ((an ¥R_TIMES (dm ¥R_TIMES ak)) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES dk))))) &
			(((an ¥R_TIMES (dm ¥R_TIMES ak)) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES dk))) = (R_Rev(dn ¥R_TIMES (dm ¥R_TIMES dk)) ¥R_PLUS (an ¥R_TIMES (dm ¥R_TIMES ak)))) &
			((an ¥R_TIMES (am ¥R_TIMES dk)) ¥R_PLUS (R_Rev(dn ¥R_TIMES (dm ¥R_TIMES dk)) ¥R_PLUS (an ¥R_TIMES (dm ¥R_TIMES ak))) = ((an ¥R_TIMES (am ¥R_TIMES dk)) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_PLUS (an ¥R_TIMES (dm ¥R_TIMES ak))) &
			(((an ¥R_TIMES (am ¥R_TIMES dk)) ¥R_PLUS R_Rev(dn ¥R_TIMES (dm ¥R_TIMES dk))) = ((an ¥R_TIMES (am ¥R_TIMES dk)) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_TIMES dk)))) &
			((((an ¥R_TIMES (am ¥R_TIMES dk)) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_PLUS (an ¥R_TIMES (dm ¥R_TIMES ak))) ¥R_PLUS (dn ¥R_TIMES (am ¥R_TIMES ak)) = ((an ¥R_TIMES (am ¥R_TIMES dk)) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_PLUS ((an ¥R_TIMES (dm ¥R_TIMES ak)) ¥R_PLUS (dn ¥R_TIMES (am ¥R_TIMES ak))))
--	EQUAL(Stat15) ==> false; Discharge ==> Stat16: ((an ¥R_TIMES (am ¥R_TIMES dk)) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_TIMES dk))) ¥R_PLUS ((an ¥R_TIMES (dm ¥R_TIMES ak)) ¥R_PLUS (dn ¥R_TIMES (am ¥R_TIMES ak))) /= (((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_TIMES dk) ¥R_PLUS (((an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)) ¥R_TIMES ak)
	ALGEBRA(Stat6,Stat7) ==> ((an ¥R_TIMES (am ¥R_TIMES dk) = (an ¥R_TIMES am) ¥R_TIMES dk) &
		(dn ¥R_TIMES (dm ¥R_TIMES dk) = (dn ¥R_TIMES dm) ¥R_TIMES dk)) &
		(an ¥R_TIMES (dm ¥R_TIMES ak) = (an ¥R_TIMES dm) ¥R_TIMES ak) &
		(dn ¥R_TIMES (am ¥R_TIMES ak) = (dn ¥R_TIMES am) ¥R_TIMES ak) &
		(dk ¥R_TIMES (an ¥R_TIMES am) = (an ¥R_TIMES am) ¥R_TIMES dk) &
		(dk ¥R_TIMES (dn ¥R_TIMES dm) = (dn ¥R_TIMES dm) ¥R_TIMES dk) &
		(ak ¥R_TIMES (an ¥R_TIMES dm) = (an ¥R_TIMES dm) ¥R_TIMES ak) &
		(ak ¥R_TIMES (dn ¥R_TIMES am) = (dn ¥R_TIMES am) ¥R_TIMES ak) &
		(((dk ¥R_TIMES (an ¥R_TIMES am)) ¥R_MINUS (dk ¥R_TIMES (dn ¥R_TIMES dm))) = dk ¥R_TIMES ((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm))) &
		(((ak ¥R_TIMES (an ¥R_TIMES dm)) ¥R_PLUS  (ak ¥R_TIMES (dn ¥R_TIMES am))) = ak ¥R_TIMES ((an ¥R_TIMES dm) ¥R_PLUS  (dn ¥R_TIMES am))) &
		(dk ¥R_TIMES ((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) = ((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_TIMES dk) &
		(ak ¥R_TIMES ((an ¥R_TIMES dm) ¥R_PLUS  (dn ¥R_TIMES am)) = ((an ¥R_TIMES dm) ¥R_PLUS  (dn ¥R_TIMES am)) ¥R_TIMES ak)
EQUAL(Stat14) ==> false; Discharge ==> QED
--
--
--
Theorem 833: ((K in Cm) & (N in Cm) & (M in Cm)) ¥imp ((N ¥C_TIMES (M ¥C_PLUS K)) = ((N ¥C_TIMES M) ¥C_PLUS (N ¥C_TIMES K))). Proof:
Suppose_not(k,n,m) ==> AUTO
	ELEM ==> Stat1: (k in Cm) & (n in Cm) & (m in Cm)
	Use_def(¥C_PLUS)(*) ==> Stat2: (car(m ¥C_PLUS k) = (car(m) ¥R_PLUS car(k))) & (cdr(m ¥C_PLUS k) = (cdr(m) ¥R_PLUS cdr(k)))
	Use_def(¥C_TIMES)(Stat2*) ==> Stat3:
		((n ¥C_TIMES m) = [(car(n) ¥R_TIMES car(m)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m)), (car(n) ¥R_TIMES cdr(m)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m))]) &
		((n ¥C_TIMES k) = [(car(n) ¥R_TIMES car(k)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(k)), (car(n) ¥R_TIMES cdr(k)) ¥R_PLUS (cdr(n) ¥R_TIMES car(k))]) &
		((n ¥C_TIMES (m ¥C_PLUS k)) = [(car(n) ¥R_TIMES car(m ¥C_PLUS k)) ¥R_MINUS (cdr(n) ¥R_TIMES cdr(m ¥C_PLUS k)),
			(car(n) ¥R_TIMES cdr(m ¥C_PLUS k)) ¥R_PLUS (cdr(n) ¥R_TIMES car(m ¥C_PLUS k))])
	Loc_def ==> Stat4: (an = car(n)) & (((dn = cdr(n)) & (am = car(m))) & ((dm = cdr(m)) & (ak = car(k))) & (dk = cdr(k)))
	EQUAL ==> Stat5: [(an ¥R_TIMES (am ¥R_PLUS ak)) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_PLUS dk)),
				  (an ¥R_TIMES (dm ¥R_PLUS dk)) ¥R_PLUS (dn ¥R_TIMES (am ¥R_PLUS ak))] /=
		([(an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm), (an ¥R_TIMES dm) ¥R_PLUS (dn ¥R_TIMES am)] ¥C_PLUS
		 [(an ¥R_TIMES ak) ¥R_MINUS (dn ¥R_TIMES dk), (an ¥R_TIMES dk) ¥R_PLUS (dn ¥R_TIMES ak)])
	Use_def(¥C_PLUS)(Stat5*) ==> Stat6: [(an ¥R_TIMES (am ¥R_PLUS ak)) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_PLUS dk)),
					(an ¥R_TIMES (dm ¥R_PLUS dk)) ¥R_PLUS (dn ¥R_TIMES (am ¥R_PLUS ak))] /=
		[((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_PLUS ((an ¥R_TIMES ak) ¥R_MINUS (dn ¥R_TIMES dk)),
		 ((an ¥R_TIMES dm) ¥R_PLUS  (dn ¥R_TIMES am)) ¥R_PLUS ((an ¥R_TIMES dk) ¥R_PLUS  (dn ¥R_TIMES ak))]
	(Stat6)ELEM ==> Stat7: ((an ¥R_TIMES (am ¥R_PLUS ak)) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_PLUS dk)) /= ((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_PLUS ((an ¥R_TIMES ak) ¥R_MINUS (dn ¥R_TIMES dk))) or
		((an ¥R_TIMES (dm ¥R_PLUS dk)) ¥R_PLUS  (dn ¥R_TIMES (am ¥R_PLUS ak)) /= ((an ¥R_TIMES dm) ¥R_PLUS  (dn ¥R_TIMES am)) ¥R_PLUS ((an ¥R_TIMES dk) ¥R_PLUS  (dn ¥R_TIMES ak)))
	ELEM ==> (k in Cm) & (n in Cm) & (m in Cm)
	n-->T816(Stat1,Stat4*) ==> Stat8: (an in Re) & (dn in Re)
	m-->T816(Stat1,Stat4*) ==> (am in Re) & (dm in Re)
	k-->T816(Stat1,Stat4*) ==> (ak in Re) & (dk in Re)
	ALGEBRA(Stat8) ==> (an ¥R_TIMES (am ¥R_PLUS ak)) ¥R_MINUS (dn ¥R_TIMES (dm ¥R_PLUS dk)) = ((an ¥R_TIMES am) ¥R_MINUS (dn ¥R_TIMES dm)) ¥R_PLUS ((an ¥R_TIMES ak) ¥R_MINUS (dn ¥R_TIMES dk))
--	ALGEBRA(Stat8) ==> ((an ¥R_TIMES (dm ¥R_PLUS dk)) ¥R_PLUS  (dn ¥R_TIMES (am ¥R_PLUS ak)) = ((an ¥R_TIMES dm) ¥R_PLUS  (dn ¥R_TIMES am)) ¥R_PLUS ((an ¥R_TIMES dk) ¥R_PLUS  (dn ¥R_TIMES ak)))
ALGEBRA(Stat7*) ==> false; Discharge ==> QED
--
--
--
Theorem 834: (M in Cm) ¥imp ((M = (M ¥C_TIMES C_1)) & (M = (C_1 ¥C_TIMES M))). Proof:
Suppose_not(m) ==> AUTO
	T817(*) ==> C_1 in Cm
	(m,C_1)-->T824(*) ==> (C_1 ¥C_TIMES m) = (m ¥C_TIMES C_1)
	Suppose ==> m = (m ¥C_TIMES C_1)
		EQUAL ==> m = (C_1 ¥C_TIMES m)
	Discharge ==> Stat1: (m in Cm) & (m /= (m ¥C_TIMES C_1))
	m-->T816(Stat1*) ==> Stat2: (car(m) in Re) & (cdr(m) in Re) & (m = [car(m),cdr(m)])
	Use_def(¥C_TIMES)(Stat1*) ==> m /= [(car(m) ¥R_TIMES car(C_1)) ¥R_MINUS (cdr(m) ¥R_TIMES cdr(C_1)),
		(car(m) ¥R_TIMES cdr(C_1)) ¥R_PLUS (cdr(m) ¥R_TIMES car(C_1))]
	Use_def(C_1)(Stat1) ==> (car(C_1) = R_1) & (cdr(C_1) = R_0)
	ALGEBRA(Stat2) ==> ((car(m) ¥R_TIMES R_1) ¥R_MINUS (cdr(m) ¥R_TIMES R_0) = car(m)) & ((car(m) ¥R_TIMES R_0) ¥R_PLUS (cdr(m) ¥R_TIMES R_1) = cdr(m))
EQUAL(Stat2) ==> false; Discharge ==> QED

--
Theorem 835: ((M in Cm) & (M /= C_0)) ¥imp ((C_Recip(M) in Cm) & ((M ¥C_TIMES C_Recip(M)) = C_1)). Proof:
Suppose_not(m) ==> AUTO
	m-->T816(*) ==> Stat1: (car(m) in Re) & (cdr(m) in Re) & (m = [car(m),cdr(m)])
	Use_def(C_0) ==> (car(m) /= R_0) or (cdr(m) /= R_0)
	Use_def(C_abs) ==> Stat2: C_abs(m) = sqrt((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m)))
	Loc_def ==> Stat3: nrm = (car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m))
	(car(m))-->T714(Stat1, Stat1*) ==> Stat4: R_is_nonneg(car(m) ¥R_TIMES car(m))
	(cdr(m))-->T714(Stat1, Stat1*) ==> R_is_nonneg(cdr(m) ¥R_TIMES cdr(m))
	ALGEBRA(Stat1, Stat1) ==> ((car(m) ¥R_TIMES car(m)) in Re) & ((cdr(m) ¥R_TIMES cdr(m)) in Re)
	(car(m) ¥R_TIMES car(m), cdr(m) ¥R_TIMES cdr(m))-->T667(Stat4*) ==> Stat5: R_is_nonneg((car(m) ¥R_TIMES car(m)) ¥R_PLUS (cdr(m) ¥R_TIMES cdr(m)))
	ALGEBRA(Stat1,Stat3) ==> Stat6: nrm in Re
	EQUAL(Stat3, Stat5) ==> Stat7: R_is_nonneg(nrm)
	Suppose ==> nrm = R_0
		(car(m) ¥R_TIMES car(m), cdr(m) ¥R_TIMES cdr(m))-->T699(Stat3*) ==> ((car(m) ¥R_TIMES car(m)) = R_0) & ((cdr(m) ¥R_TIMES cdr(m)) = R_0)
		(car(m), car(m))-->T700(*) ==> car(m) = R_0
	(cdr(m), cdr(m))-->T700(*) ==> false; Discharge ==> Stat8: nrm /= R_0
	nrm-->T808 ==> Stat9: sqrt(nrm) ¥R_TIMES sqrt(nrm) = nrm
	EQUAL ==> Stat10: C_abs(m) ¥R_TIMES C_abs(m) = nrm
	Use_def(C_Recip(m)) ==> AUTO
	EQUAL ==> Stat11: C_Recip(m) = [(car(m) ¥R_OVER nrm), (R_Rev(cdr(m)) ¥R_OVER nrm)]
--
-- we now show that $C_Recip(m)$ in $Cm$
--
	(car(m), nrm)-->T651(Stat1, Stat6, Stat8*) ==> Stat12: (car(m) ¥R_OVER nrm) in Re
	(cdr(m), cdr(m))-->T613(Stat1, Stat1*) ==> Stat13: R_Rev(cdr(m)) in Re
	(R_Rev(cdr(m)), nrm)-->T651(Stat13, Stat6, Stat8*) ==> (R_Rev(cdr(m)) ¥R_OVER nrm) in Re
	(car(m) ¥R_OVER nrm, R_Rev(cdr(m)) ¥R_OVER nrm)-->T815(Stat10*) ==> Stat14: C_Recip(m) in Cm
--
-- we rewrite $m ¥C_TIMES C_Recip(m)$ in order to show that $m ¥C_TIMES C_Recip(m) = C_1$
--
	Use_def(¥C_TIMES) ==> m ¥C_TIMES C_Recip(m) =
		[((car(m) ¥R_TIMES car(C_Recip(m))) ¥R_MINUS (cdr(m) ¥R_TIMES cdr(C_Recip(m)))),
		 ((car(m) ¥R_TIMES cdr(C_Recip(m))) ¥R_PLUS (cdr(m) ¥R_TIMES car(C_Recip(m))))]
	(C_Recip(m))-->T816(Stat14, Stat14) ==> (car(C_Recip(m)) in Re) & (cdr(C_Recip(m)) in Re) & (C_Recip(m) = [car(C_Recip(m)),cdr(C_Recip(m))])
	(Stat11)ELEM ==> (car(C_Recip(m)) = (car(m) ¥R_OVER nrm)) & (cdr(C_Recip(m)) = (R_Rev(cdr(m)) ¥R_OVER nrm))
	EQUAL(Stat11) ==> m ¥C_TIMES C_Recip(m) =
		[((car(m) ¥R_TIMES (car(m) ¥R_OVER nrm)) ¥R_MINUS (cdr(m) ¥R_TIMES (R_Rev(cdr(m)) ¥R_OVER nrm))),
		 ((car(m) ¥R_TIMES (R_Rev(cdr(m)) ¥R_OVER nrm)) ¥R_PLUS (cdr(m) ¥R_TIMES (car(m) ¥R_OVER nrm)))]
	Use_def(¥R_OVER)(*) ==> M ¥C_TIMES C_Recip(M) =
		[(car(m) ¥R_TIMES (car(m) ¥R_TIMES R_Recip(nrm))) ¥R_MINUS (cdr(m) ¥R_TIMES (R_Rev(cdr(m)) ¥R_TIMES R_Recip(nrm))),
		 (car(m) ¥R_TIMES (R_Rev(cdr(m)) ¥R_TIMES R_Recip(nrm))) ¥R_PLUS (cdr(m) ¥R_TIMES (car(m) ¥R_TIMES R_Recip(nrm)))]
	(nrm)-->T647(Stat6, Stat8*) ==> Stat15: R_Recip(nrm) in Re
--
-- we now show that $car(m ¥C_TIMES C_Recip(m)) = R_1$
--
	ALGEBRA(Stat1,Stat1) ==> (cdr(m) ¥R_TIMES R_Rev(cdr(m)) = R_Rev(cdr(m) ¥R_TIMES cdr(m))) &
		(((car(m) ¥R_TIMES car(m)) ¥R_MINUS (cdr(m) ¥R_TIMES R_Rev(cdr(m)))) = (car(m) ¥R_TIMES car(m)) ¥R_PLUS R_Rev(cdr(m) ¥R_TIMES R_Rev(cdr(m)))) &
		(R_Rev(R_Rev(cdr(m) ¥R_TIMES cdr(m))) = (cdr(m) ¥R_TIMES cdr(m)))
	(nrm)-->T647(Stat6, Stat8*) ==> R_Recip(nrm) ¥R_TIMES nrm = R_1
--
-- we now show that $cdr(m ¥C_TIMES C_Recip(m)) = R_0$
--
	ALGEBRA(Stat1,Stat15) ==> (car(m) ¥R_TIMES (R_Rev(cdr(m)) ¥R_TIMES R_Recip(nrm)) = (car(m) ¥R_TIMES R_Rev(cdr(m))) ¥R_TIMES R_Recip(nrm)) &
		(R_Rev(car(m) ¥R_TIMES cdr(m)) ¥R_TIMES R_Recip(nrm) = R_Recip(nrm) ¥R_TIMES R_Rev(car(m) ¥R_TIMES cdr(m))) &
		((car(m) ¥R_TIMES cdr(m)) ¥R_TIMES R_Recip(nrm) = R_Recip(nrm) ¥R_TIMES (car(m) ¥R_TIMES cdr(m))) &
		((R_Recip(nrm) ¥R_TIMES R_Rev(car(m) ¥R_TIMES cdr(m))) ¥R_PLUS (R_Recip(nrm) ¥R_TIMES (car(m) ¥R_TIMES cdr(m))) = R_Recip(nrm) ¥R_TIMES (R_Rev(car(m) ¥R_TIMES cdr(m)) ¥R_PLUS (car(m) ¥R_TIMES cdr(m))))
	ALGEBRA(Stat1,Stat1) ==> (car(m) ¥R_TIMES R_Rev(cdr(m)) = R_Rev(car(m) ¥R_TIMES cdr(m))) &
		(cdr(m) ¥R_TIMES car(m) = car(m) ¥R_TIMES cdr(m)) &
		((car(m) ¥R_TIMES cdr(m)) ¥R_PLUS R_Rev(car(m) ¥R_TIMES cdr(m)) = R_0)
	ALGEBRA(Stat15,Stat15) ==> R_Recip(nrm) ¥R_TIMES R_0 = R_0
EQUAL ==> false; Discharge ==> QED
--
Theorem 836: ((N in Cm) & (M in Cm) & (M /= C_0)) ¥imp (N = M ¥C_TIMES (N ¥C_OVER M)). Proof:
Suppose_not(n,m) ==> AUTO
        Use_def(¥C_OVER)(*) ==> n /= m ¥C_TIMES (n ¥C_TIMES C_Recip(m))
        m-->T835(*) ==> Stat1: (C_Recip(m) in Cm) & (m ¥C_TIMES C_Recip(m) = C_1)
        (n, C_Recip(m))-->T824(*) ==> n ¥C_TIMES C_Recip(m) = C_Recip(m) ¥C_TIMES n
        (n,m, C_Recip(m))-->T832(*) ==> m ¥C_TIMES (C_Recip(m) ¥C_TIMES n) = (m ¥C_TIMES C_Recip(m)) ¥C_TIMES n
        EQUAL ==> n /= C_1 ¥C_TIMES n
        T817(*) ==> C_1 in Cm
        (C_1, n)-->T824(*) ==> C_1 ¥C_TIMES n = n ¥C_TIMES C_1
n-->T834(*) ==> false; Discharge ==>QED
--
Theorem 837: (R_0 in Re) & (FORALL x | (x in Re) ¥imp ((x ¥R_PLUS R_0) = x)) &
	(FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) = (y ¥R_PLUS x))) &
	(FORALL x, y | ((x in Re) & (y in Re)) ¥imp ((x ¥R_PLUS y) in Re)) &
	(FORALL x, y, z | ((x in Re) & (y in Re) & (z in Re)) ¥imp (((x ¥R_PLUS y) ¥R_PLUS z) = (x ¥R_PLUS (y ¥R_PLUS z)))). Proof:
Suppose_not ==> AUTO
    ALGEBRA ==> R_0 in Re
    Suppose ==> Stat1: not(FORALL x | (x in Re) ¥imp (x ¥R_PLUS R_0 = x))
		x1-->Stat1(Stat1*) ==> (x1 in Re) & (x1 ¥R_PLUS R_0 /= x1)
	ALGEBRA(Stat1) ==> false; Discharge ==> (FORALL x | (x in Re) ¥imp (x ¥R_PLUS R_0 = x))
	Suppose ==> Stat2: not(FORALL x, y | ((x in Re) & (y in Re)) ¥imp (x ¥R_PLUS y = y ¥R_PLUS x))
		(x2,y2)-->Stat2(Stat2*) ==> (x2 in Re) & (y2 in Re) & (x2 ¥R_PLUS y2 /= y2 ¥R_PLUS x2)
	ALGEBRA(Stat2) ==> false; Discharge ==> (FORALL x, y | ((x in Re) & (y in Re)) ¥imp (x ¥R_PLUS y = y ¥R_PLUS x))
	Suppose ==> Stat3: not(FORALL x, y | ((x in Re) & (y in Re)) ¥imp (x ¥R_PLUS y in Re))
		(x3,y3)-->Stat3(Stat3*) ==> (x3 in Re) & (y3 in Re) & (x3 ¥R_PLUS y3 notin Re)
	ALGEBRA(Stat3) ==> false; Discharge ==> Stat4: not(FORALL x, y, z | ((x in Re) & (y in Re) & (z in Re)) ¥imp ((x ¥R_PLUS y) ¥R_PLUS z = x ¥R_PLUS (y ¥R_PLUS z)))
	(x4,y4,z4)-->Stat4(Stat4*) ==> (x4 in Re) & (y4 in Re) & (z4 in Re) & ((x4 ¥R_PLUS y4) ¥R_PLUS z4 /= x4 ¥R_PLUS (y4 ¥R_PLUS z4))
ALGEBRA(Stat4) ==> false; Discharge ==> QED
--
-- [Sums for Real Maps with finite domains]
APPLY(sigma_thryvar:Sig) sigma_theory(s->Re,pluz(i,j)->(i ¥R_PLUS j),e->R_0) ==>
Theorem real_sigma0: (Sig(0) = R_0) &
    (FORALL x | (cdr(x) in Re) ¥imp (Sig({x}) = cdr(x))) &
	(FORALL f | (Finite(f) & (range(f) ¥incin Re)) ¥imp (Sig(f) in Re)) &
	(FORALL c,f | ((c in f) & Finite(f) & (range(f) ¥incin Re)) ¥imp (Sig(f) = Sig(f - {c}) ¥R_PLUS cdr(c))) &
	(FORALL f,t | (Finite(f) & Is_map(f) & (range(f) ¥incin Re)) ¥imp (Sig(f) = (Sig(f ¥ON (domain(f) * t)) ¥R_PLUS Sig(f ¥ON (domain(f) - t)))))
--
--
Theorem real_sigma: (Svm(F) & (range(F) ¥incin Re) & Finite(F)) ¥imp
	((Sig(F) in Re) & ((P in F) ¥imp (Sig({P}) = (F~[car(P)]))) &
	 (Sig(F) = (Sig(F ¥ON (domain(F) * A)) ¥R_PLUS Sig(F ¥ON (domain(F) - A))))). Proof:
Suppose_not(f,p,a) ==> AUTO
	ELEM ==> Stat1: Svm(f) & (range(f) ¥incin Re) & Finite(f)
	Treal_sigma0 ==> Stat2: (FORALL f | (Finite(f) & (range(f) ¥incin Re)) ¥imp (Sig(f) in Re)) &
		Stat3: (FORALL x | (cdr(x) in Re) ¥imp (Sig({x}) = cdr(x))) &
		Stat4: (FORALL f,a | (Finite(f) & Is_map(f) & (range(f) ¥incin Re)) ¥imp (Sig(f) = (Sig(f ¥ON (domain(f) * a)) ¥R_PLUS Sig(f ¥ON (domain(f) - a)))))
	f-->Stat2(Stat1*) ==> Sig(f) in Re
	Use_def(Svm) ==> Is_map(f)
	Suppose ==> Stat5: not((p in f) ¥imp (Sig({p}) = (f~[car(p)])))
		(p,f)-->T61(Stat5,Stat1*) ==> cdr(p) in Re
		p-->Stat3(Stat5*) ==> Sig({p}) = cdr(p)
		(f,p)-->T74(Stat1,Stat5*) ==> cdr(p) = (f~[car(p)])
	(Stat5*)Discharge ==> Sig(f) /= (Sig(f ¥ON (domain(f) * a)) ¥R_PLUS Sig(f ¥ON (domain(f) - a)))
(f,a)-->Stat4(Stat1*) ==> false; Discharge ==> QED
--
Def 80a: [Sums of absolutely convergent infinite series]
     Sig_inf(f) := Un({Sig(f ¥ON s): s ¥incin Domain(f) | Finite(s)})
--
Def 81h: [Real functions of a real variable]
    RF := {f ¥incin (Re ¥PROD Re) | Svm(f) & domain(f) = Re}
--
Def 84: [Pointwise LUB of a set of Real Functions] LUB(s) := {[x,Un({f~[x]: f in s})]: x in Re}
--
Theorem 838: (RF_0 in RF). Proof:
Suppose_not ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 839: (N in RF) ¥imp ((N ¥F_PLUS RF_0) = N). Proof:
Suppose_not(n) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 840: ((N in RF) & (M in RF)) ¥imp ((N ¥F_PLUS M) = (M ¥F_PLUS N)). Proof:
Suppose_not(n,m) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 841: ((N in RF) & (M in RF)) ¥imp ((N ¥F_PLUS M) in RF). Proof:
Suppose_not(n,m) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 842: ((N in RF) & (M in RF)) ¥imp (N ¥F_TIMES M = M ¥F_TIMES N). Proof:
Suppose_not(n,m) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 843: ((N in RF) & (M in RF) & (K in RF)) ¥imp (N ¥F_PLUS (M ¥F_PLUS K) = (N ¥F_PLUS M) ¥F_PLUS K). Proof:
Suppose_not(n,m,k) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 844: ((K in RF) & (N in RF) & (M in RF)) ¥imp (N ¥F_TIMES (M ¥F_TIMES K) = (N ¥F_TIMES M) ¥F_TIMES K). Proof:
Suppose_not(k,n,m) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 845: ((K in RF) & (N in RF) & (M in RF)) ¥imp (N ¥F_TIMES (M ¥F_PLUS K) = (N ¥F_TIMES M) ¥F_PLUS (N ¥F_TIMES K)). Proof:
Suppose_not(k,n,m) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
-- [Sums for series of real functions]
--
APPLY(sigma_thryvar:FSig) sigma_theory(s->RF,pluz(i,j)->(i ¥F_PLUS j),e->RF_0) ==>
Theorem real_function_sigma: (FSig(0) = RF_0) &
	(FORALL x | (cdr(x) in RF) ¥imp (FSig({x}) = cdr(x))) &
	(FORALL ser | (Finite(ser) & (range(ser) ¥incin RF)) ¥imp (FSig(ser) in RF)) &
	(FORALL ser, a | (Finite(ser) & Is_map(ser) & (range(ser) ¥incin RF)) ¥imp
			(FSig(ser) = (FSig(ser ¥ON (domain(ser) * a)) ¥F_PLUS FSig(ser ¥ON (domain(ser) - a))))) &
    (FORALL p, ser | ((p in ser) & Finite(ser) & (range(ser) ¥incin RF)) ¥imp
			(FSig(ser) = FSig(ser - {p}) ¥F_PLUS cdr(p)))
--
Def 86: [Pointwise sums of absolutely convergent infinite series of real functions] FSig_inf(ser) := LUB({Sig(ser ¥ON s): s ¥incin domain(ser) | Finite(s)})
--
-- [Product of a nonempty family of sets; Note - this is also the real greatest lower bound]
Def 87: [Greatest lower bound of a set of ordinals] GLB(s) := {x in arb(s) | (FORALL y in s | x in y)}
--
Def 88a: [Block function] Bl_f(a,b,c) := {[x,if a ¥incin x and x ¥incin b then c else R_0 end if]: x in Re}
--
Def 89a: [Block function integral] BFInt(f) := arb({c ¥R_TIMES (b ¥R_MINUS a): a in Re, b in Re, c in Re | Bl_f(a,b,c) = f})
--
Def 90: [Block functions] RBF := {Bl_f(a,b,c): a in Re, b in Re, c in Re}
--
Def 91: [Comparison of real functions] Def(f ¥RF_GT g) := (f /= g) & (FORALL x in Re | f~[x] incs g~[x])
--
Def 92: [Lebesgue Upper Integral of a Positive Function] ULeInt(f) :=
	GLB({Sig_inf({[n,BFInt(ser~[n])]: n in Za}): ser ¥incin (Za ¥PROD RBF) | Svm(ser) & (FSig_inf(ser) ¥RF_GT f)})
--
Def 93: [Positive Part of a real function] Pos_part(f) := {[x, if f~[x] incs R_0 then f~[x] else R_0 end if]: x in Re}
--
Def 94: [Pointwise additive inverse of a real function] RF_Rev(f) := {[x, R_Rev(f~[x])]: x in Re}
--
Def 95: [Lebesgue Integral of a real-valued function] Int(f) := ULeInt(Pos_part(f)) ¥R_MINUS ULeInt(Pos_part(RF_Rev(f)))
--
Def 96: [Continuous real function of a real variable] is_continuous_RF(f) := (f ¥incin (Re ¥PROD Re)) & Svm(f) &
    (FORALL x in domain(f), eps in Re | (EXISTS delt in Re, y in domain(f) | ((delt ¥R_GT 0) &
	(eps incs R_0 & eps /= R_0 & delt incs abs(x ¥R_MINUS y)) ¥imp (eps incs abs(f~[x] ¥R_MINUS f~[y])))))
--
Def 97: [Euclidean n-space] Euc(n) := {f ¥incin (n ¥PROD Re) | Svm(f) & domain(f) = n}
--
Def 98: [Euclidean norm] norm(f) := sqrt(FSig(f))
--
--Def 99: [Pointwise difference of Real Functions] Def(f ¥F_MINUS g) := {[x,f~[x] ¥R_MINUS g~[x]]: x in domain(f)}
--
Def 100: [Continuous function on Euclidean n-space] is_continuous_REnF(f,n) := (f ¥incin (Euc(n) ¥PROD Euc(n))) & Svm(f) &
    (FORALL x in domain(f), eps in Re | (EXISTS delt in Re | (FORALL y in domain(f) |
	(delt incs R_0 & delt /= R_0 &
	(eps incs R_0 & eps /= R_0 & delt incs norm(x ¥F_MINUS y)) ¥imp (eps incs abs(f~[x] ¥R_MINUS f~[y]))))))
--
Def 103: [Complex functions of a complex variable] CF := {f ¥incin (Cm ¥PROD Cm) | Svm(f) & domain(f) = Cm}
--
Def 104: [Complex Euclidean $n$-space] CEuc(n) := {f ¥incin (n ¥PROD Cm) | Svm(f) & domain(f) = n}
--
Def 105: [Difference-and-diagonal trick, complex case] CDD(f,df) := {if x~[0] /= x~[1] then (f~[x~[0]] ¥C_MINUS f~[x~[1]]) ¥C_OVER (x~[0] ¥C_MINUS x~[1])
					else df~[x~[0]] end if: x in CEuc(2)}
--
Def 106: [Continuous function of a complex variable] is_continuous_CF(f) := (f ¥incin (Cm ¥PROD Cm)) & Svm(f) &
    (FORALL x in domain(f), eps in Re | (EXISTS delt in Re | (FORALL y in domain(f) |
	(delt incs R_0 & delt /= R_0 &
	(eps incs R_0 & eps /= R_0 & delt incs norm(x ¥C_MINUS y)) ¥imp (eps incs norm(f~[x] ¥C_MINUS f~[y]))))))
--
Def 107: [Complex Euclidean norm] Cnorm(f) := sqrt(FSig({[m,C_abs(f~[m]) ¥R_TIMES C_abs(f~[m])]: m in domain(f)}))
--
Def 108: [Difference of Complex Functions] Def(f ¥CF_MINUS g) := {[x,f~[x] ¥C_MINUS g~[x]]: x in Cm}
--
Def 109: [Continuous function on Complex Euclidean n-space] is_continuous_CEnF(f,n) := (f ¥incin (CE(n) ¥PROD CE(n))) & Svm(f) &
 (FORALL x in domain(f), eps in Re | (EXISTS delt in Re | (FORALL y in domain(f) |
    (delt incs R_0 & delt /= R_0 &
     (eps incs R_0 & eps /= R_0 & delt incs Cnorm(x ¥CF_MINUS y)) ¥imp (eps incs Cnorm(f~[x] ¥CF_MINUS f~[y]))))))
--
Def 110: [Derivative of function of a complex variable] CDer(f) := arb({df in CF | domain(f) = domain(df) &
		is_continuous_CEnF(CDD(f,df) ¥ON (domain(f) ¥PROD domain(f)),2)})
--
Def 111: [Open set in the complex plane] is_open_C_set(s) := (s ¥incin Cm) &
		is_continuous_CF({[z,if z in s then [R_0,R_0] else [R_1,R_0] end if]: z in Cm})
--
Def 112: [Analytic function of a complex variable] is_analytic_CF(f) := is_continuous_CF(f) & is_open_C_set(domain(f)) & CDer(f) /= 0
--
Def 113: [Complex exponential function] C_exp_fcn := arb({f: f ¥incin (Cm ¥PROD Cm) | is_analytic_CF(f) & CDer(f) = f & f~[[R_0,R_0]] = [R_1,R_0]})
--
Def 114: [The constant $pi$] pi := arb({x in Re | x incs R_0 & x /= R_0 & C_exp_fcn([R_0,x]) = [R_1,R_0] &
		(FORALL y in Re | ((C_exp_fcn([R_0,y]) = [R_1,R_0]) ¥imp (y = x or R_0 incs y)))})
--
Def 115: [Continuous complex function on the reals] is_continuous_CoRF(f) := (f ¥incin (Re ¥PROD Cm)) & Svm(f) &
    (FORALL x in domain(f), eps in Re | (EXISTS delt in Re | (FORALL y in domain(f) | ((delt ¥R_GT 0) &
	(eps incs R_0 & eps /= R_0 & delt incs abs(x ¥R_MINUS y)) ¥imp (eps incs norm(f~[x] ¥C_MINUS f~[y]))))))
--
Def 116: [Difference-and-diagonal trick, real-to-complex case] CRDD(f,df) := {if x~[0] /= x~[1] then (f~[x~[0]] ¥C_MINUS f~[x~[1]]) ¥C_OVER (x~[0] ¥C_MINUS x~[1])
					else df~[x~[0]] end if: x in E(2)}
--
Def 117: [Continuous complex function on $E(n)$] is_continuous_CREnF(f,n) := (f ¥incin (E(n) ¥PROD Cm)) & Svm(f) &
 (FORALL x in domain(f), eps in Re | (EXISTS delt in Re | (FORALL y in domain(f) | ((delt ¥R_GT R_0) &
    ((eps ¥R_GT R_0) & (delt ¥R_GE norm(x ¥F_MINUS y))) ¥imp (eps ¥R_GE C_abs(f~[x] ¥CF_MINUS f~[y]))))))
--
Def 118: [Derivative of complex function of a real variable] CRDer(f) := arb({df in CF | domain(f) = domain(df) &
		is_continuous_CREnF(CRDD(f,df) ¥ON (domain(f) ¥PROD domain(f)),2)})
--
Def 119: [Real Interval] Interval(a,b) := {x in Re | a ¥incin x & x ¥incin b}
--
Def 120: [Continuously differentiable curve in the complex plane] is_CD_curv(f,a,b) :=
    is_continuous_CoRF(f) & (domain(f) = Interval(a,b)) & (0 /= CRDer(f)) & is_continuous_CoRF(CRDer(f))
--
Def 121: [Complex line integral] Line_Int(f,curv,a,b) :=
    [Int({[x,if x notin Interval(a,b) then R_0 else car(f~[curv~[x]] ¥C_TIMES CRDer(curv)~[x]) end if]:
							x in Re}),
    Int({[x,if x notin Interval(a,b) then R_0 else cdr(f~[curv~[x]] ¥C_TIMES CRDer(curv)~[x]) end if]:
							x in Re})]
Theorem 846: [Cauchy integral theorem]
    is_analytic_CF(F) ¥imp (EXISTS eps in Re | (eps ¥R_GT R_0) &
	 (FORALL crv1, crv2 | (is_CD_curv(crv1,R_0,R_1) & is_CD_curv(crv2,R_0,R_1) &
	 ((crv1~[R_0]) = (crv1~[R_1])) & ((crv2~[R_0]) = (crv2~[R_1])) &
	 (FORALL x in Interval(R_0,R_1) | eps ¥R_GE C_abs((crv1~[x]) ¥C_MINUS (crv2~[x]))))
	¥imp (Line_Int(F,crv1,R_0,R_1) = Line_Int(F,crv2,R_0,R_1)) )). Proof:
Suppose_not(f) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 847: [Cauchy integral formula]
    (is_analytic_CF(F) & (domain(F) incs {w in Cm | C_abs(w) ¥R_GE R_1})) ¥imp
	(FORALL w in Cm | (C_abs(w) ¥R_GT R_1) ¥imp ((F~[w]) = (Line_Int({[x,(F~[x]) ¥C_OVER (x ¥C_MINUS w)]: x in (Cm -{w})},
		{[x,C_exp_fcn([R_0,x])]: x in Re}, R_0, pi ¥R_PLUS pi) ¥C_OVER ([R_0,pi ¥R_PLUS pi])) )). Proof:
Suppose_not(f) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
--PAUSE HERE ------------
--
-- Beyond this point, the number of steps of definition needed to reach any concept, say,
-- of classical functional analysis can be estimated by counting the number of definitions
-- needed to reach the corresponding point in any standard reference on this subject, e.g. Dunford-Schwartz.
--
--BEGIN HERE ------------
--
--
-- ************************************************************************************************
--			Section 16: Rank, cumulative hierarchies, superstructures, hereditarily finite sets
-- ************************************************************************************************
--
Def 10090: [Rank of a set] rk(X) := Un({next(rk(y)): y in X})
--
--
Theorem 848: (S = 0) ¥eq (rk(S) = 0). Proof:
Suppose_not(s0) ==> AUTO
	Use_def(rk(0)) ==> AUTO
	Suppose ==> Stat1: {next(rk(y)): y in 0} /= 0
		c-->Stat1(Stat1*) ==> false
	Discharge ==> {next(rk(y)): y in 0} = 0
	T109 ==> Un(0) = 0
	EQUAL ==> rk(0) = 0
	Suppose ==> s0 = 0
		EQUAL ==> false
	Discharge ==> AUTO
	Use_def(rk(s0)) ==> AUTO
	ELEM ==> Stat2: (arb(s0) in s0) & (Un({next(rk(y)): y in s0}) = 0)
	Suppose ==> Stat3: {next(rk(y)): y in s0} /= 0
		({next(rk(y)): y in s0})-->T109(Stat2) ==> Stat4: 0 in {next(rk(y)): y in s0}
		y0-->Stat4(Stat4*) ==> 0 = next(rk(y0))
		Use_def(next(rk(y0))) ==> AUTO
	(Stat4*)Discharge ==> Stat5: {next(rk(y)): y in s0} = 0
	(arb(s0))-->Stat5(Stat2*) ==> false
	Discharge ==> QED
--
--
Theorem 849: rk({X}) = next(rk(X)). Proof:
Suppose_not(x0) ==> AUTO
	Use_def(rk({x0})) ==> AUTO
	SIMPLF ==> {next(rk(y)): y in {x0}} = {next(rk(x0))}
	(next(rk(x0)))-->T107 ==> AUTO
	EQUAL ==> false
	Discharge ==> QED
--
-- The following theorem will be generalized later into
--	$rk(Un(X)) = Un({rk(y): y in X})$.
--
Theorem 850: rk(X + Y) = rk(X) + rk(Y). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def(rk(x0 + y0)) ==> AUTO
	Use_def(rk(x0)) ==> AUTO
	Use_def(rk(y0)) ==> AUTO
	ELEM ==> Stat1: Un({next(rk(y)): y in x0 + y0}) /= Un({next(rk(y)): y in x0}) + Un({next(rk(y)): y in y0})
	Set_monot ==> {next(rk(y)): y in x0} ¥incin {next(rk(y)): y in x0 + y0}
	Set_monot ==> {next(rk(y)): y in y0} ¥incin {next(rk(y)): y in x0 + y0}
	({next(rk(y)): y in x0},{next(rk(y)): y in x0 + y0})-->T276 ==> AUTO
	({next(rk(y)): y in y0},{next(rk(y)): y in x0 + y0})-->T276(Stat1*) ==> Stat2: Un({next(rk(y)): y in x0 + y0}) ¥nincin (Un({next(rk(y)): y in x0}) + Un({next(rk(y)): y in y0}))
	({next(rk(y)): y in x0},{next(rk(y)): y in y0})-->T277(Stat2*) ==> Un({next(rk(y)): y in x0 + y0}) ¥nincin Un({next(rk(y)): y in x0} + {next(rk(y)): y in y0})
	({next(rk(y)): y in x0 + y0},{next(rk(y)): y in x0} + {next(rk(y)): y in y0})-->T276(Stat2*) ==> Stat3: {next(rk(y)): y in x0 + y0} ¥nincin ({next(rk(y)): y in x0} + {next(rk(y)): y in y0})
	x1-->Stat3(Stat3*) ==> Stat4:(x1 in {next(rk(y)): y in x0 + y0}) & (x1 notin {next(rk(y)): y in x0}) & (x1 notin {next(rk(y)): y in y0})
	(y1,y1,y1)-->Stat4(Stat4*) ==> false
	Discharge ==> QED
--
--
Theorem 851: rk({X,Y}) = next(rk(X)) + next(rk(Y)). Proof:
Suppose_not(x0,y0) ==> AUTO
	({x0},{y0})-->T850 ==> AUTO
	x0-->T849 ==> AUTO
	y0-->T849 ==> AUTO
	TELEM ==> {x0,y0} = {x0} + {y0}
	EQUAL ==> false
	Discharge ==> QED
--
--
Theorem 852: ((X ¥incin Y) ¥imp (rk(X) ¥incin rk(Y))) & ((X in Y) ¥imp (rk(X) in rk(Y))). Proof:
Suppose_not(x0,y0) ==> AUTO
	Suppose ==> Stat1: (x0 ¥incin y0) & (not(rk(x0) ¥incin rk(y0)))
		(Stat1*)ELEM ==> y0 = (x0 + (y0 - x0))
		(x0,y0 - x0)-->T850 ==> AUTO
		EQUAL(Stat1) ==> rk(y0) = rk(x0) + rk(y0 - x0)
	(Stat1*)Discharge ==> AUTO
	Suppose ==> Stat2: next(rk(x0)) notin {next(rk(y)): y in y0}
	x0-->Stat2(*) ==> false; Discharge ==> Stat3: next(rk(x0)) in {next(rk(y)): y in y0}
	({next(rk(y)): y in y0})-->T274(Stat3*) ==> Stat4: (FORALL x in {next(rk(y)): y in y0} | x ¥incin Un({next(rk(y)): y in y0}))
	(next(rk(x0)))-->Stat4(Stat3*) ==> next(rk(x0)) ¥incin Un({next(rk(y)): y in y0})
	Use_def(rk(y0)) ==> AUTO
	Use_def(next) ==> false
	Discharge ==> QED
--
--
Theorem 853: rk(Un(X)) = Un({rk(y): y in X}). Proof:
Suppose_not(x0) ==> AUTO
	Suppose ==> Un({rk(y): y in x0}) ¥nincin rk(Un(x0))
		({rk(y): y in x0},rk(Un(x0)))-->T274(*) ==> Stat1: not(FORALL x in {rk(y): y in x0} | x ¥incin rk(Un(x0)))
		SIMPLF ==> Stat2: not(FORALL y in x0 | rk(y) ¥incin rk(Un(x0)))
		y0-->Stat2(Stat2*) ==> (y0 in x0) & (rk(y0) ¥nincin rk(Un(x0)))
		x0-->T274(*) ==> Stat3: (FORALL x in x0 | x ¥incin Un(x0))
		y0-->Stat3(Stat2*) ==> y0 ¥incin Un(x0)
		(y0,Un(x0))-->T852(Stat2*) ==> false
	Discharge ==> Stat4: rk(Un(x0)) ¥nincin Un({rk(y): y in x0})
	c-->Stat4(Stat4*) ==> (c in rk(Un(x0))) & (c notin Un({rk(y): y in x0}))
	Use_def(rk(Un(x0))) ==> AUTO
	Use_def(Un(x0)) ==> AUTO
	EQUAL(Stat4) ==> c in Un({next(rk(y)): y in {u: v in x0, u in v}})
	SIMPLF ==> Stat5: c in Un({next(rk(y)): v in x0, y in v})
	Use_def(Un)(Stat5*) ==> c in {u: w in {next(rk(y)): v in x0, y in v}, u in w}
	SIMPLF(Stat5*) ==> Stat6: c in {u: v in x0, y in v, u in next(rk(y))}
	(v1,y1,u1)-->Stat6(Stat6*) ==> (v1 in x0) & (y1 in v1) & (c in next(rk(y1)))
	Use_def(Un({rk(y): y in x0})) ==> AUTO
	(Stat4*)ELEM ==> Stat7: c notin {u: v in {rk(y): y in x0}, u in v}
	SIMPLF(Stat7*) ==> Stat8: c notin {u: y in x0, u in rk(y)}
	(v1,c)-->Stat8(Stat6*) ==> c notin rk(v1)
	Use_def(rk(v1)) ==> AUTO
	(Stat8*)ELEM ==> Stat9: c notin Un({next(rk(w)): w in v1})
	Use_def(Un)(Stat9*) ==> Stat10: c notin {u: v in {next(rk(w)): w in v1}, u in v}
	SIMPLF(Stat10*) ==> Stat11: c notin {u: w in v1, u in next(rk(w))}
	(y1,c)-->Stat11(Stat6*) ==> false
	Discharge ==> QED
--
--
Theorem 854: [The values of the rank function are ordinals] Ord(rk(X)). Proof:
Suppose_not(c) ==> not Ord(rk(c))
	APPLY(mt1_thryvar:m) transfinite_induction(n->c,P(x)->(not Ord(rk(x)))) ==>
		Stat1: (FORALL k | (not Ord(rk(m))) & ((k in m) ¥imp Ord(rk(k))))
	Suppose ==> Stat2: not(FORALL v in {next(rk(i)): i in m} | Ord(v))
		v0-->Stat2(Stat2) ==> Stat3: (not Ord(v0)) & Stat4: (v0 in {next(rk(i)): i in m})
		i0-->Stat4(Stat3) ==> Stat5: (i0 in m) & (v0 = next(rk(i0)))
		i0-->Stat1(Stat5) ==> Stat6: Ord(rk(i0))
		(rk(i0))-->T32(Stat6) ==> Ord(next(rk(i0)))
	EQUAL(Stat3) ==> false; Discharge ==> Stat7: (FORALL v in {next(rk(i)): i in m} | Ord(v))
	({next(rk(i)): i in m})-->T280(Stat7) ==> Stat8: Ord(Un({next(rk(i)): i in m}))
	Use_def(rk) ==> rk(m) = Un({next(rk(i)): i in m})
	0-->Stat1 ==> (not Ord(rk(m)))
EQUAL(Stat8) ==> false; Discharge ==> QED
--
--
--
Theorem 855: rk([X,Y]) = next(next(next(rk(X)))) + next(next(next(next(rk(Y))))). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def([]) ==> Stat1: rk({{x0},{{x0},{{y0},y0}}}) /= next(next(next(rk(x0)))) + next(next(next(next(rk(y0)))))
	Suppose ==> Stat2: rk({{x0},{{x0},{{y0},y0}}}) /= next(rk({{x0},{{y0},y0}}))
		({x0},{{x0},{{y0},y0}})-->T851(Stat2*) ==> Stat3: next(rk({x0})) ¥nincin next(rk({{x0},{{y0},y0}}))
		({{x0}},{{x0},{{y0},y0}})-->T852(Stat3*) ==> rk({{x0}}) ¥incin rk({{x0},{{y0},y0}})
		({{x0}})-->T854(Stat3*) ==> Ord(rk({{x0}}))
		(rk({{x0}}),rk({x0}))-->T37 ==> AUTO
		({x0},{{x0}})-->T852(Stat2*) ==> Stat4: next(rk({x0})) ¥incin rk({{x0},{{y0},y0}})
		Use_def(next)(Stat3,Stat4*) ==> false
	Discharge ==> rk({{x0},{{x0},{{y0},y0}}}) = next(rk({{x0},{{y0},y0}}))
	({x0},{{y0},y0})-->T851(*) ==> rk({{x0},{{y0},y0}}) = next(rk({x0})) + next(rk({{y0},y0}))
	EQUAL(Stat1) ==> Stat5: next(next(rk({x0})) + next(rk({{y0},y0}))) /= next(next(next(rk(x0)))) + next(next(next(next(rk(y0)))))
	y0-->T849(*) ==> rk({y0}) = next(rk(y0))
	({y0},y0)-->T851(*) ==> rk({{y0},y0}) = next(rk({y0})) + next(rk(y0))
--??	Use_def(next)(*) ==> next(next(rk(y0))) + next(rk(y0)) = next(next(rk(y0)))
	Use_def(next(next(rk(y0)))) ==> AUTO
	(Stat5*)ELEM ==> next(next(rk(y0))) + next(rk(y0)) = next(next(rk(y0)))
	x0-->T849(Stat1*) ==> rk({x0}) = next(rk(x0))
	EQUAL(Stat5) ==> Stat6: next(next(next(rk(x0))) + next(next(next(rk(y0))))) /= next(next(next(rk(x0)))) + next(next(next(next(rk(y0)))))
	x0-->T854(Stat6*) ==> Ord(rk(x0))
	(rk(x0))-->T32(Stat6*) ==> Ord(next(rk(x0)))
	(next(rk(x0)))-->T32(Stat6*) ==> Stat7: Ord(next(next(rk(x0))))
	y0-->T854(Stat6*) ==> Ord(rk(y0))
	(rk(y0))-->T32(Stat6*) ==> Ord(next(rk(y0)))
	(next(rk(y0)))-->T32(Stat6*) ==> Ord(next(next(rk(y0))))
	(next(next(rk(y0))))-->T32(Stat6*) ==> Stat8: Ord(next(next(next(rk(y0)))))
	(next(next(rk(x0))),next(next(next(rk(y0)))))-->T29(Stat7,Stat8*) ==> (next(next(rk(x0))) ¥incin next(next(next(rk(y0))))) or (next(next(rk(x0))) incs next(next(next(rk(y0)))))
	Suppose ==> Stat9: next(next(rk(x0))) ¥incin next(next(next(rk(y0))))
		(Stat9*)ELEM ==> next(next(rk(x0))) + next(next(next(rk(y0)))) = next(next(next(rk(y0))))
		EQUAL(Stat9) ==> next(next(next(rk(x0))) + next(next(next(rk(y0))))) = next(next(next(next(rk(y0)))))
		(next(next(next(rk(y0)))),next(next(rk(x0))))-->T34(Stat7,Stat8,Stat9*) ==> (next(next(rk(x0))) in next(next(next(rk(y0))))) or (next(next(rk(x0))) = next(next(next(rk(y0)))))
		Suppose ==> next(next(rk(x0))) = next(next(next(rk(y0))))
			EQUAL(Stat9) ==> next(next(next(rk(x0)))) = next(next(next(rk(x0))) + next(next(next(rk(y0)))))
			(Stat6*)ELEM ==> false
		Discharge ==> AUTO
		(next(next(next(rk(y0)))),next(next(rk(x0))))-->T37(Stat8*) ==> next(next(next(rk(x0)))) ¥incin next(next(next(rk(y0))))
		Use_def(next(next(next(next(rk(y0)))))) ==> AUTO
		(Stat6*)ELEM ==> false
	Discharge ==> Stat10: next(next(rk(x0))) + next(next(next(rk(y0)))) = next(next(rk(x0)))
	EQUAL(Stat10) ==> Stat11: next(next(next(rk(x0))) + next(next(next(rk(y0))))) = next(next(next(rk(x0))))
	(next(next(rk(x0))),next(next(next(rk(y0)))))-->T34(Stat7*) ==> (next(next(next(rk(y0)))) in next(next(rk(x0)))) or (next(next(rk(x0))) = next(next(next(rk(y0)))))
	Suppose ==> next(next(rk(x0))) = next(next(next(rk(y0))))
		EQUAL(Stat10) ==> Stat12: next(next(next(next(rk(y0))))) = next(next(next(rk(x0))))
		(Stat6,Stat11,Stat12*)ELEM ==> false
	Discharge ==> AUTO
	Use_def(next(next(next(rk(x0))))) ==> AUTO
	(next(next(rk(x0))),next(next(next(rk(y0)))))-->T37(Stat7*) ==> Stat13: next(next(next(next(rk(y0))))) ¥incin next(next(next(rk(x0))))
	(Stat6,Stat11,Stat13*)ELEM ==> false
	Discharge ==> QED
--
Theorem 856: [Every ordinal equals its own rank] Ord(X) ¥imp (X = rk(X)). Proof:
Suppose_not(x) ==> Ord(x) & (x /= rk(x))
	APPLY(t_thryvar:m) ordinal_induction(o->x,P(i)->(i/=rk(i))) ==>
		Stat1: Ord(m) & (m /= rk(m)) & Stat2: (FORALL x in m | not(x /= rk(x)))
	Suppose ==> m /= Un({next(i): i in m})
		Suppose ==> Stat3: not(m incs Un({next(i): i in m}))
			({next(i): i in m},m)-->T274(Stat3) ==> Stat4: not(FORALL x in {next(i): i in m} | x ¥incin m)
			x1-->Stat4 ==> (not(x1 ¥incin m)) & Stat5: (x1 in {next(i): i in m})
			i1-->Stat5 ==> Stat6: (x1 = next(i1)) & (i1 in m) & (not(x1 ¥incin m))
		(m,i1)-->T37(Stat1,Stat6) ==> false; Discharge ==> Stat7: not(m ¥incin Un({next(i): i in m}))
		i2-->Stat7 ==> Stat8: (i2 in m) & (i2 notin Un({next(i): i in m}))
		Use_def(Un) ==> Stat9: i2 notin {x: y in {next(i): i in m}, x in y}
		Suppose ==> Stat10: next(i2) notin {next(i): i in m}
		i2-->Stat10(Stat8,Stat8) ==> false; Discharge ==> next(i2) in {next(i): i in m}
		Use_def(next) ==> i2 in next(i2)
	(next(i2),i2)-->Stat9(Stat9) ==> false; Discharge ==> Stat11: m = Un({next(i): i in m})
	Suppose ==> Stat12: {next(i): i in m} /= {next(rk(i)): i in m}
		i0-->Stat12(Stat12) ==> Stat13: (i0 in m) & (next(i0) /= next(rk(i0)))
		i0-->Stat2(Stat13) ==> i0 = rk(i0)
	EQUAL(Stat13) ==> false; Discharge ==> {next(i): i in m} = {next(rk(i)): i in m}
	EQUAL(Stat11) ==> m = Un({next(rk(i)): i in m})
	Use_def(rk) ==> rk(m) = Un({next(rk(i)): i in m})
(Stat1)ELEM ==> false; Discharge ==> QED
--
-- The following definition provides a mechanism enabling the construction of an infinite
-- sequence of singletons of strictly increasing ranks originating from any set fixed initially.
--
Def 995: [iterated singleton formation] snglIter(X,V) := if X = 0 then {V} else {snglIter(y,V): y in X | next(y) = X} end if
--
--
Theorem 857: [iterated singleton formation produces increasing ranks] (rk(V) in rk(snglIter(0,V))) &
	(((N in Za) & (M in Za) & (N in M)) ¥imp (rk(snglIter(N,V)) in rk(snglIter(M,V)))). Proof+:
Suppose_not(v0,n0,m1) ==> AUTO
--
-- The first part of the claim is obvious,...
--
	Suppose ==> rk(v0) notin rk(snglIter(0,v0))
		Use_def(snglIter) ==> snglIter(0,v0) = {v0}
		v0-->T849(*) ==> rk({v0}) = next(rk(v0))
		Use_def(next) ==> rk(v0) in rk({v0})
		EQUAL ==> false
	Discharge ==> Stat0: (n0 in Za) & (m1 in Za) & (n0 in m1) & (rk(snglIter(n0,v0)) notin rk(snglIter(m1,v0)))
--
-- ...hence, arguing by contradiction, we assume that a counterexample $v0,n0,m1$ to the second
-- part of the claim exists. Then we pick an $m0$ which is minimum in forming a counterexample
-- with those particular $v0,n0$.
--
	APPLY(m2_thryvar:m0) mathematical_induction(n->m1,P(x)->((n0 in x) & (rk(snglIter(n0,v0)) notin rk(snglIter(x,v0))))) ==>
		Stat1: (m0 in Za) & ((n0 in m0) & (rk(snglIter(n0,v0)) notin rk(snglIter(m0,v0)))) &
		Stat2: (FORALL n in m0 | not ((n0 in n) & (rk(snglIter(n0,v0)) notin rk(snglIter(n,v0)))))
--
-- It turns out readily that $rk(snglIter(Un(m0),v0)) in rk(snglIter(m0,v0))$ holds, since
-- $Un(m0)$ is the immediate predecessor of $m0$.
--
	m0-->T321(Stat1*) ==> Un(m0) in Za
	(Un(m0))-->T317(Stat1*) ==> (next(Un(m0)) in Za) & (Un(m0) ¥PLUS 1 = next(Un(m0)))
	m0-->T322(Stat1*) ==> Stat3: m0 = next(Un(m0))
	Use_def(next(Un(m0))) ==> AUTO
	Suppose ==> rk(snglIter(Un(m0),v0)) notin rk(snglIter(m0,v0))
		Use_def(snglIter)(Stat1*) ==> snglIter(m0,v0) = if m0 = 0 then {v0} else {snglIter(y,v0): y in m0 | next(y) = m0} end if
		(Stat1,Stat1*)ELEM ==> if m0 = 0 then {v0} else {snglIter(y,v0): y in m0 | next(y) = m0} end if = {snglIter(y,v0): y in m0 | next(y) = m0}
		(snglIter(Un(m0),v0),snglIter(m0,v0))-->T852(Stat1*) ==> Stat4: snglIter(Un(m0),v0) notin {snglIter(y,v0): y in m0 | next(y) = m0}
 		(Un(m0))-->Stat4(Stat3*) ==> false
	Discharge ==> AUTO
--
-- Therefore $rk(snglIter(Un(m0),v0)) in rk(snglIter(m0,v0))$ holds, which implies $n0 notin Un(m0)$,
-- else we would have $rk(snglIter(n0,v0)) in rk(snglIter(m0,v0))$.
--
	Suppose ==> Stat5: n0 in Un(m0)
		(Un(m0))-->Stat2(Stat3*) ==> rk(snglIter(n0,v0)) in rk(snglIter(Un(m0),v0))
		(snglIter(n0,v0))-->T854(Stat5*) ==> Ord(rk(snglIter(n0,v0)))
		(snglIter(m0,v0))-->T854(Stat5*) ==> Ord(rk(snglIter(m0,v0)))
		(rk(snglIter(n0,v0)),rk(snglIter(m0,v0)))-->T31(Stat1*) ==> false
	Discharge ==> n0 notin Un(m0)
--
	Suppose ==> n0 = Un(m0)
		EQUAL(Stat1) ==> rk(snglIter(Un(m0),v0)) notin rk(snglIter(m0,v0))
	(Stat3*)Discharge ==> AUTO
--
-- Since $n0$ and $Un(m0)$ are ordinals, they are comparable by membership:
-- the only possibility left, at this point, is that $Un(m0) in n0$, which conflicts
-- with the false that $m0$ is the immediate successor of $Un(m0)$, that $n0$
-- precedes it, and differs from $Un(m0)$.
--
	(n0,Un(m0))-->T31(Stat1*) ==> false
	Discharge ==> QED
--
Def 10091: [$X$-th level of the cumulative structure based on $B$] cumstr(B,X) := B + Un({pow(cumstr(B,y)): y in X})
Def 10092: [superstructure based on a set $B$ of 'urelements']
	supstr(B,S) := (S=cumstr(B,Za)) & (FORALL i in Za | (cumstr(B,next(i))-cumstr(B,i))*B=0)
--
Theorem 858: [the 0-th level of any cumulative structure equals the base] cumstr(B,0) = B. Proof:
Suppose_not(b0) ==> AUTO
	Use_def(cumstr(b0,0)) ==> AUTO
	Suppose ==> Stat1: {pow(cumstr(b0,y)): y in 0} /= 0
		e-->Stat1(Stat1*) ==> Stat2: e in {pow(cumstr(b0,y)): y in 0}
		y0-->Stat1(Stat2*) ==> false
	Discharge ==> {pow(cumstr(b0,y)): y in 0} = 0
	T109(*) ==> Un(0) = 0
	EQUAL ==> cumstr(b0,0) = b0 + 0
	Discharge ==> QED
--
-- The following theorem admits a generalization which we are not proving, namely:
--	$(B ¥incin C) ¥imp (cumstr(B,X) ¥incin cumstr(C,X + Y))$.
--
Theorem 859: [The constructor of the cumulative structure is monotone non-decreasing] cumstr(B,X) ¥incin cumstr(B,X + Y). Proof:
Suppose_not(b,x0,y0) ==> AUTO
	Use_def(cumstr(b,x0)) ==> AUTO
	Use_def(cumstr(b,x0 + y0)) ==> AUTO
	ELEM ==> Un({pow(cumstr(b,y)): y in x0}) ¥nincin Un({pow(cumstr(b,y)): y in x0 + y0})
	Set_monot ==> {pow(cumstr(b,y)): y in x0} ¥incin {pow(cumstr(b,y)): y in x0 + y0}
	({pow(cumstr(b,y)): y in x0},{pow(cumstr(b,y)): y in x0 + y0})-->T276 ==> false
	Discharge ==> QED
--
--
--
Theorem 860: [The constructor of the cumulative structure inserts 0 at all levels but the first] (0 notin B) ¥imp ((X /= 0) ¥eq (0 in cumstr(B,X))). Proof:
Suppose_not(b,x0) ==> AUTO
--
-- Reasoning by contradiction, let $b,x0$ be a counterexample, so that $0 notin b$ but the
-- biimplication $(x0 /= 0) ¥eq (0 in cumstr(b,x0))$ is false. Suppose first that
-- $x0 /= 0$ and $0 notin cumstr(b,x0)$.
--
	Suppose ==> x0 /= 0
--
-- In this case, by the definition of $cumstr(b,x0)$, we would have
-- $0 notin Un({pow(cumstr(b,y)): y in x0})$, which is absurd since
-- $pow(cumstr(b,arb(x0))) ¥incin Un({pow(cumstr(b,y)): y in x0})$ and
-- $0 in pow(V)$ holds for any set $V$.
--
		Loc_def ==> Stat1: a = arb(x0)
		x0-->T0(*) ==> a in x0
		Use_def(cumstr(b,x0)) ==> AUTO
		ELEM ==> Stat2: 0 notin Un({pow(cumstr(b,y)): y in x0})
		Suppose ==> Stat3: pow(cumstr(b,a)) ¥nincin Un({pow(cumstr(b,y)): y in x0})
			({pow(cumstr(b,y)): y in x0})-->T274(*) ==> Stat4: (FORALL x in {pow(cumstr(b,y)): y in x0} | x ¥incin Un({pow(cumstr(b,y)): y in x0}))
			(pow(cumstr(b,a)))-->Stat4(Stat3,Stat3*) ==> Stat5: pow(cumstr(b,a)) notin {pow(cumstr(b,y)): y in x0}
			a-->Stat5(Stat1*) ==> false
		Discharge ==> AUTO
		Use_def(pow(cumstr(b,a))) ==> AUTO
		(Stat2*)ELEM ==> Stat6: 0 notin {y: y ¥incin cumstr(b,a)}
	0-->Stat6(Stat6*) ==> false; Discharge ==> Stat7: (x0 = 0) & (0 in cumstr(b,x0))
--
-- A contradiction is readily obtained also under the opposite supposition
-- that $x0 = 0$ and $0 in cumstr(b,x0)$. This supposition would in fact
-- imply that $cumstr(b,x0) = b$, but we have assumed that $0 notin b$.
-- This contradiction leads us to the desired conclusion.
--
	b-->T858 ==> AUTO
	EQUAL ==> cumstr(b,x0) = 0
	(Stat7*)Discharge ==> QED
--
--
--
Theorem 861: [All subsets of each layer of a cumulative structure belong to its subsequent layers] ((Y in X) & (Z ¥incin cumstr(B,Y))) ¥imp (Z in cumstr(B,X)). Proof:
Suppose_not(y0,x0,z0,b0) ==> AUTO
	Use_def(cumstr(b0,x0)) ==> AUTO
	({pow(cumstr(b0,y)): y in x0})-->T274(*) ==> Stat1: (FORALL x in {pow(cumstr(b0,y)): y in x0} | x ¥incin Un({pow(cumstr(b0,y)): y in x0}))
	(pow(cumstr(b0,y0)))-->Stat1(*) ==> Stat2: (pow(cumstr(b0,y0)) notin {pow(cumstr(b0,y)): y in x0}) or (z0 notin pow(cumstr(b0,y0)))
	Use_def(pow(cumstr(b0,y0))) ==> AUTO
	y0-->Stat2(*) ==> Stat3: z0 notin {z: z ¥incin cumstr(b0,y0)}
	z0-->Stat3(*) ==> false
	Discharge ==> QED
--
--
Theorem 862: [Quasi-transitivity of the layers of a cumulative structure] Ord(X) ¥imp ((cumstr(B,X) - B) ¥incin pow(cumstr(B,X))). Proof:
Suppose_not(x0,b) ==> Stat1: ((cumstr(b,x0) - b) ¥nincin pow(cumstr(b,x0))) & Ord(x0)
--
-- For assuming that the claim fails to hold for $x0,b$, we pick a $y1$ belonging to
-- $(cumstr(b,x0) - b) ¥incin pow(cumstr(b,x0))$ and then find a contradiction arguing as follows.
--
	Use_def(cumstr(b,x0)) ==> AUTO
	y0-->Stat1(Stat1*) ==> Stat2: (y0 in Un({pow(cumstr(b,y)): y in x0})) & (y0 notin pow(cumstr(b,x0)))
	Use_def(Un)(Stat2*) ==> y0 in {u: v in {pow(cumstr(b,y)): y in x0}, u in v}
	SIMPLF ==> Stat3: y0 in {u: y in x0, u in pow(cumstr(b,y))}
	(y1,u1)-->Stat3(Stat3*) ==> (y1 in x0) & (y0 in pow(cumstr(b,y1)))
--
-- Since $x0$ is an ordinal, $y1 ¥incin x0$ follows from $y1 in x0$, and hence
-- $cumstr(b,y1) ¥incin cumstr(b,x0)$ by Theorem 859, and therefore
-- $pow(cumstr(b,y1)) ¥incin pow(cumstr(b,x0))$. But then $y0 in pow(cumstr(b,x0))$ follows
-- from $y0 in pow(cumstr(b,y1))$, which conflicts with the hypothesis with which our argument
-- by contradiction began.
--
	Suppose ==> Stat4: pow(cumstr(b,y1)) ¥nincin pow(cumstr(b,x0))
		c-->Stat4(Stat4*) ==> Stat5: (c in pow(cumstr(b,y1))) & (c notin pow(cumstr(b,x0)))
		Use_def(pow)(Stat5*) ==> Stat6: (c in {y: y ¥incin cumstr(b,y1)}) & (c notin {y: y ¥incin cumstr(b,x0)})
		(c1,c1)-->Stat6(Stat6*) ==> not(cumstr(b,y1) ¥incin cumstr(b,x0))
		(b,y1,x0 - y1)-->T859 ==> AUTO
		(x0,y1)-->T13(Stat1*) ==> x0 = y1 + (x0 - y1)
		EQUAL(Stat3) ==> false
	Discharge ==> AUTO
(Stat2*)Discharge ==> QED
--
Theorem 863: [Transitivity of each layer in the von Neumann hierarchy] Ord(X) ¥imp ((cumstr(0,X) ¥incin pow(cumstr(0,X))) & (Un(cumstr(0,X)) ¥incin cumstr(0,X))). Proof:
Suppose_not(x) ==> AUTO
	(x,0)-->T862(*) ==> (cumstr(0,x) ¥incin pow(cumstr(0,x))) & (Un(cumstr(0,x)) ¥nincin cumstr(0,x))
	(cumstr(0,x))-->T278(*) ==> false
	Discharge ==> QED
--
Theorem 864: [closedness under dyadic union of the cumulative hierarchy $cumstr(B,Za)$] ((S in cumstr(B,Za) - B) & (T in cumstr(B,Za) - B)) ¥imp ((S + T) in cumstr(B,Za)). Proof+:
Suppose_not(s0,b0,t0) ==> AUTO
--
-- Reasoning by contradiction, assume $s0,t0$ to be a counterexample, so that (by the definitions
-- of $cumstr$) $s0$ belongs to $pow(cumstr(b0,i0))$ and
-- $t0$ belongs to $pow(cumstr(b0,i1))$ for suitably chosen $i0 in Za$, $i1 in Za$.
--
	Use_def(cumstr(b0,Za)) ==> AUTO
	Use_def(Un({pow(cumstr(b0,y)): y in Za})) ==> AUTO
	SIMPLF ==> Un({pow(cumstr(b0,y)): y in Za}) = {u: y in Za, u in pow(cumstr(b0,y))}
	ELEM ==> Stat1: (s0 in {u: y in Za, u in pow(cumstr(b0,y))}) & Stat2: (t0 in {u: y in Za, u in pow(cumstr(b0,y))}) & ((s0 + t0) notin cumstr(b0,Za))
	(i0,u0,i1,u1)-->Stat1(Stat1*) ==> Stat3: (s0 in pow(cumstr(b0,i0))) & Stat4: (t0 in pow(cumstr(b0,i1))) & (i0 in Za) & (i1 in Za)
--
-- But then, $s0$ belongs to $cumstr(b0,next(i0))$ and
-- $t0$ belongs to $cumstr(b0,next(i1))$, and therefore
-- $s0 + t0$ is included in $cumstr(b0,next(i0 + i1))$.
--
	Suppose ==> s0 notin cumstr(b0,next(i0))
		Use_def(next(i0)) ==> AUTO
		Use_def(cumstr(b0,i0+{i0})) ==> AUTO
		EQUAL(Stat3) ==> s0 notin (b0 + Un({pow(cumstr(b0,j)): j in i0+{i0}}))
		Use_def(Un({pow(cumstr(b0,y)): y in i0+{i0}})) ==> AUTO
		SIMPLF(Stat3) ==> Un({pow(cumstr(b0,y)): y in i0+{i0}}) = {u: y in i0+{i0}, u in pow(cumstr(b0,y))}
		(Stat3*)ELEM ==> Stat5: s0 notin {u: y in i0+{i0}, u in pow(cumstr(b0,y))}
		(i0,s0)-->Stat5(Stat3,Stat3*) ==> false
	Discharge ==> AUTO
	Suppose ==> t0 notin cumstr(b0,next(i1))
		Use_def(next(i1)) ==> AUTO
		Use_def(cumstr(b0,i1+{i1})) ==> AUTO
		EQUAL(Stat3) ==> t0 notin (b0 + Un({pow(cumstr(b0,j)): j in i1+{i1}}))
		Use_def(Un({pow(cumstr(b0,y)): y in i1+{i1}})) ==> AUTO
		SIMPLF(Stat3) ==> Un({pow(cumstr(b0,y)): y in i1+{i1}}) = {u: y in i1+{i1}, u in pow(cumstr(b0,y))}
		(Stat3*)ELEM ==> Stat6: t0 notin {u: y in i1+{i1}, u in pow(cumstr(b0,y))}
		(i1,t0)-->Stat6(Stat3,Stat3*) ==> false
	Discharge ==> AUTO
	i0-->T210(Stat3,Stat3*) ==> next(i0) in Za
	i1-->T210(Stat3,Stat3*) ==> next(i1) in Za
	(next(i0),next(i1))-->T333(Stat3*) ==> Stat7: (next(i0) + next(i1)) in Za
	(b0,next(i0),next(i1))-->T859(Stat3*) ==> s0 in cumstr(b0,next(i0) + next(i1))
	(b0,next(i1),next(i0))-->T859(Stat3*) ==> (t0 in cumstr(b0,next(i1) + next(i0))) & (next(i1) + next(i0) = next(i0) + next(i1))
	EQUAL(Stat7) ==> t0 in cumstr(b0,next(i0) + next(i1))
	Use_def(Card(next(i0) + next(i1))) ==> AUTO
	Use_def(pow(cumstr(b0,next(i0) + next(i1)))) ==> AUTO
	(next(i0) + next(i1),b0)-->T862(*) ==> Stat8: (s0 in {y: y ¥incin cumstr(b0,next(i0) + next(i1))}) & (t0 in {y: y ¥incin cumstr(b0,next(i0) + next(i1))})
	(y0,y1)-->Stat8(Stat8*) ==> (s0 + t0) ¥incin cumstr(b0,next(i0) + next(i1))
	Suppose ==> Stat9: (s0 + t0) notin {y: y ¥incin cumstr(b0,next(i0) + next(i1))}
	(s0 + t0)-->Stat9(Stat8*) ==> false; Discharge ==> AUTO
	Use_def(pow(cumstr(b0,next(i0) + next(i1)))) ==> AUTO
	(Stat7*)ELEM ==> Stat10: (s0 + t0) in {y: y ¥incin (cumstr(b0,next(i0) + next(i1)))}
	y2-->Stat10(Stat10*) ==> (s0 + t0) ¥incin cumstr(b0,next(i0) + next(i1))
--
-- By Theorem 861, this implies that $pow(s0)$ belongs to $cumstr(b0,Za)$, which leads to
-- the desired contradiction.
--
	(next(i0) + next(i1),Za,s0 + t0,b0)-->T861(Stat7*) ==> Stat11: (s0 + t0) in cumstr(b0,Za)
	(Stat1,Stat11*)Discharge ==> QED
--
Theorem 865: [All sets of rank bounded by $X$ belong to $pow(cumstr(0,X))$] (rk(Y) ¥incin X) ¥imp (Y ¥incin cumstr(0,X)). Proof:
Suppose_not(v,u) ==> AUTO
	Suppose ==> Stat1: not(EXISTS v | (rk(v) ¥incin u) & (v ¥nincin cumstr(0,u)))
	v-->Stat1(*) ==> false; Discharge ==> (EXISTS v | (rk(v) ¥incin u) & (v ¥nincin cumstr(0,u)))
	APPLY(mt1_thryvar:m) transfinite_induction(n->u,P(x)->(EXISTS v | (rk(v) ¥incin x) & (v ¥nincin cumstr(0,x)))) ==>
		Stat2: (FORALL k | (EXISTS v | (rk(v) ¥incin m) & (v ¥nincin cumstr(0,m))) &
			((k in m) ¥imp (not(EXISTS v | (rk(v) ¥incin k) & (v ¥nincin cumstr(0,k))))))
	0-->Stat2(Stat2*) ==> Stat3: (EXISTS v | (rk(v) ¥incin m) & (v ¥nincin cumstr(0,m)))
	e-->Stat3(Stat3*) ==> Stat4: (rk(e) ¥incin m) & Stat5: (not(e ¥incin cumstr(0,m)))
	c-->Stat5(Stat4*) ==> Stat6: (c in e) & (c notin cumstr(0,m))
	(c,e)-->T852(Stat4*) ==> Stat7: rk(c) in m
	(rk(c))-->Stat2(Stat4*) ==> Stat8: not(EXISTS v | (rk(v) ¥incin rk(c)) & (v ¥nincin cumstr(0,rk(c))))
	c-->Stat8(Stat8*) ==> Stat9: c ¥incin cumstr(0,rk(c))
	Suppose ==> c notin pow(cumstr(0,rk(c)))
		Use_def(pow)(Stat9*) ==> Stat10: c notin {x: x ¥incin cumstr(0,rk(c))}
	c-->Stat10(Stat9*) ==> false; Discharge ==> Stat11: c in pow(cumstr(0,rk(c)))
	Use_def(cumstr(0,m)) ==> AUTO
	(Stat4*)ELEM ==> c notin Un({pow(cumstr(0,y)): y in m})
	({pow(cumstr(0,y)): y in m})-->T274(Stat12*) ==> Stat12: (FORALL x in {pow(cumstr(0,y)): y in m} | x ¥incin Un({pow(cumstr(0,y)): y in m}))
	Suppose ==> Stat13: pow(cumstr(0,rk(c))) notin {pow(cumstr(0,y)): y in m}
	(rk(c))-->Stat13(Stat7,Stat7*) ==> false; Discharge ==> pow(cumstr(0,rk(c))) in {pow(cumstr(0,y)): y in m}
(pow(cumstr(0,rk(c))))-->Stat12(Stat11*) ==> false; Discharge ==> QED
--
Theorem 866: [The sets of rank bounded by $X$ form $pow(cumstr(0,X))$] Ord(X) ¥imp ((rk(Y) ¥incin X) ¥eq (Y ¥incin cumstr(0,X))). Proof:
Suppose_not(u,v) ==> AUTO
	(v,u)-->T865(*) ==> Stat1: Ord(u) & (rk(v) ¥nincin u) & (v ¥incin cumstr(0,u))
	Suppose ==> Stat2: not(EXISTS v | (rk(v) ¥nincin u) & (v ¥incin cumstr(0,u)))
	v-->Stat2(*) ==> false; Discharge ==> (EXISTS v | (rk(v) ¥nincin u) & (v ¥incin cumstr(0,u)))
	APPLY(mt1_thryvar:m) transfinite_induction(n->u,P(x)->(Ord(x) & (EXISTS v | (rk(v) ¥nincin x) & (v ¥incin cumstr(0,x))))) ==>
		Stat3: (FORALL k | (Ord(m) & (EXISTS v | (rk(v) ¥nincin m) & (v ¥incin cumstr(0,m)))) &
			((k in m) ¥imp (not(Ord(k) & (EXISTS v | (rk(v) ¥nincin k) & (v ¥incin cumstr(0,k)))))))
	0-->Stat3(Stat3*) ==> Stat4: Ord(m) & (EXISTS v | (rk(v) ¥nincin m) & (v ¥incin cumstr(0,m)))
	e-->Stat4(Stat4*) ==> Stat5: (e ¥incin cumstr(0,m)) & (rk(e) ¥nincin m)
	e-->T854(Stat5*) ==> Ord(rk(e))
	(rk(e),m)-->T35(Stat4*) ==> Stat6: m in rk(e)
	Use_def(rk(e)) ==> AUTO
	(Stat6*)ELEM ==> Stat7: m in Un({next(rk(w)): w in e})
	Use_def(Un)(Stat7*) ==> m in {y: x in {next(rk(w)): w in e}, y in x}
	SIMPLF(Stat7*) ==> Stat8: m in {y: w in e, y in next(rk(w))}
	(d,y0)-->Stat8(Stat5*) ==> Stat9: (d in cumstr(0,m)) & (m in next(rk(d)))
	Use_def(cumstr(0,m)) ==> AUTO
	(Stat9*)ELEM ==> Stat10: d in Un({pow(cumstr(0,w)): w in m})
	Use_def(Un)(Stat10*) ==> d in {y: x in {pow(cumstr(0,w)): w in m}, y in x}
	SIMPLF(Stat10*) ==> Stat11: d in {y: w in m, y in pow(cumstr(0,w))}
	(c,y1)-->Stat11(Stat11*) ==> Stat12: (c in m) & (d in pow(cumstr(0,c)))
	Use_def(pow)(Stat12*) ==> Stat13: d in {x: x ¥incin cumstr(0,c)}
	d1-->Stat13(Stat13*) ==> d ¥incin cumstr(0,c)
	(m,c)-->T12(Stat4,Stat12*) ==> Ord(c)
	c-->Stat3(Stat12*) ==> Stat14: not(EXISTS v | (rk(v) ¥nincin c) & (v ¥incin cumstr(0,c)))
	d-->Stat14(Stat13*) ==> rk(d) ¥incin c
	d-->T854(Stat14*) ==> Ord(rk(d))
	(rk(d),m)-->T31(Stat4*) ==> Stat15: rk(d) in m
	(m,rk(d))-->T37(Stat4,Stat15*) ==> Stat16: next(rk(d)) ¥incin m
(Stat9,Stat16*)Discharge ==> QED
--
Theorem 867: [All sets of rank $X$ belong to $cumstr(0,next(X))-cumstr(0,X)$] (X = rk(Y)) ¥imp (Y in (cumstr(0,next(X)) - cumstr(0,X))). Proof:
Suppose_not(x0,y0) ==> AUTO
	y0-->T854(*) ==> Ord(rk(y0))
	EQUAL ==> Ord(x0)
--
-- For, if we assume the contrary to hold for $x0,y0$, then Theorem 866 implies
-- that $y0 ¥incin pow(cumstr(0,x0))$ and therefore $y0 in cumstr(0,next(x0))$,
-- $y0 in cumstr(0,x0)$.
--
	Suppose ==> Stat1: y0 notin cumstr(0,next(x0))
		Use_def(cumstr(0,next(x0))) ==> AUTO
		(Stat1*)ELEM ==> Stat2: y0 notin Un({pow(cumstr(0,y)): y in next(x0)})
		Suppose ==> Stat3: y0 notin pow(cumstr(0,x0))
			Use_def(pow)(Stat3*) ==> Stat4: y0 notin {x: x ¥incin cumstr(0,x0)}
			(x0,y0)-->T866(*) ==> y0 ¥incin cumstr(0,x0)
		y0-->Stat4(Stat4*) ==> false; Discharge ==> y0 in pow(cumstr(0,x0))
		Suppose ==> Stat5: pow(cumstr(0,x0)) notin {pow(cumstr(0,y)): y in next(x0)}
			Use_def(next(x0)) ==> AUTO
		x0-->Stat5(Stat5*) ==> false; Discharge ==> pow(cumstr(0,x0)) in {pow(cumstr(0,y)): y in next(x0)}
		{pow(cumstr(0,y)): y in next(x0)}-->T274(Stat6*) ==> Stat6: (FORALL x in {pow(cumstr(0,y)): y in next(x0)} | x ¥incin Un({pow(cumstr(0,y)): y in next(x0)}))
	(pow(cumstr(0,x0)))-->Stat6(Stat2*) ==> false; Discharge ==> Stat7: y0 in cumstr(0,x0)
	Use_def(cumstr(0,x0)) ==> AUTO
	(Stat7*)ELEM ==> Stat8: y0 in Un({pow(cumstr(0,v)): v in x0})
--
-- But then $rk(y0) ¥incin x1$, which leads to a contradiction whence the desired conclusion follows.
--
	Use_def(Un)(Stat8*) ==> Stat9: y0 in {x: y in {pow(cumstr(0,v)): v in x0}, x in y}
	(p,y1)-->Stat9(Stat9*) ==> Stat10: (p in {pow(cumstr(0,v)): v in x0}) & (y0 in p)
	x1-->Stat10(Stat10*) ==> Stat11: (x1 in x0) & (y0 in pow(cumstr(0,x1)))
	Use_def(pow)(Stat11*) ==> Stat12: y0 in {x: x ¥incin cumstr(0,x1)}
	y2-->Stat12(Stat12*) ==> y0 ¥incin cumstr(0,x1)
	(x0,x1)-->T12(*) ==> Ord(x1) & (rk(y0) = x0)
(x1,y0)-->T866(Stat11*) ==> false; Discharge ==> QED
--
Theorem 868: [The rank of sets in $cumstr(0,next(X))-cumstr(0,X)$ does not exceed $X$] (Ord(X) & (Y in (cumstr(0,next(X)) - cumstr(0,X)))) ¥imp (rk(Y) ¥incin X). Proof:
Suppose_not(x1,y1) ==> AUTO
	(x1,y1)-->T866(*) ==> y1 ¥nincin cumstr(0,x1)
	Use_def(cumstr(0,x1)) ==> AUTO
	Use_def(cumstr(0,next(x1))) ==> AUTO
	ELEM ==> (y1 in Un({pow(cumstr(0,w)): w in next(x1)})) & (y1 notin Un({pow(cumstr(0,w)): w in x1}))
	Use_def(Un)(*) ==> Stat1: (y1 in {x: y in {pow(cumstr(0,w)): w in next(x1)}, x in y}) & (y1 notin {x: y in {pow(cumstr(0,w)): w in x1}, x in y})
	(v1,y2,v1,y2)-->Stat1(Stat1*) ==> Stat2: (v1 in {pow(cumstr(0,w)): w in next(x1)}) & (v1 notin {pow(cumstr(0,w)): w in x1}) & (y1 in v1)
	Use_def(next(x1)) ==> AUTO
	(w1,w1)-->Stat2(Stat2*) ==> (v1 = pow(cumstr(0,w1))) & (w1 = x1)
	Use_def(pow(cumstr(0,x1))) ==> AUTO
	EQUAL(Stat2) ==> Stat3: y1 in {x: x ¥incin cumstr(0,x1)}
y3-->Stat3(*) ==> false; Discharge ==> QED
--
Theorem 869: [The sets of rank $X$ form $cumstr(0,next(X))-cumstr(0,X)$] Ord(X) ¥imp ((rk(Y) = X) ¥eq (Y in (cumstr(0,next(X)) - cumstr(0,X)))). Proof:
Suppose_not(x1,y1) ==> AUTO
--
-- Reasoning by contradiction, let $y1$ and $x1$ be a set and
-- an ordinal with $y1 in (cumstr(0,next(x1)) - cumstr(0,x1))$ but with
-- $x1 ¥nincin rk(y1)$.
--
	(x1,y1)-->T867(*) ==> Stat1: Ord(x1) & (y1 in (cumstr(0,next(x1)) - cumstr(0,x1))) & (rk(y1) /= x1)
	(x1,y1)-->T868(Stat1*) ==> Stat2: Ord(x1) & (y1 in (cumstr(0,next(x1)) - cumstr(0,x1))) & Stat3: (x1 ¥nincin rk(y1))
--
-- Let $y1 in (cumstr(0,next(x1)) - cumstr(0,x1))$ and $x1 ¥nincin rk(y1)$.
-- Hence we can pick an $x2$ belonging to $x1 - rk(y1)$.
-- Then we have $y2 notin cumstr(0,x2)$ for some $y2 in y1$, which hence satisfies $rk(y2) in rk(y1)$.
--
	x2-->Stat3(Stat2*) ==> Stat4: (x2 notin rk(y1)) & (x2 in x1)
	Use_def(cumstr(0,x1)) ==> AUTO
	Use_def(cumstr(0,next(x1))) ==> AUTO
	Use_def(Un({pow(cumstr(0,y)): y in x1})) ==> AUTO
	Use_def(Un({pow(cumstr(0,y)): y in next(x1)})) ==> AUTO
	(Stat2*)ELEM ==> Stat5: (y1 in {x: y in {pow(cumstr(0,y)): y in next(x1)}, x in y}) &
		Stat6: (y1 notin {x: y in {pow(cumstr(0,y)): y in x1}, x in y})
	Suppose ==> y1 in pow(cumstr(0,x2))
		(pow(cumstr(0,x2)),y1)-->Stat6(Stat5*) ==> Stat7: pow(cumstr(0,x2)) notin {pow(cumstr(0,y)): y in x1}
	x2-->Stat7(Stat4,Stat4*) ==> false; Discharge ==> AUTO
	Use_def(pow) ==> Stat8: y1 notin {x: x ¥incin cumstr(0,x2)}
	y1-->Stat8(Stat8*) ==> Stat9: y1 ¥nincin cumstr(0,x2)
	y2-->Stat9(Stat9*) ==> Stat10: (y2 in y1) & (y2 notin cumstr(0,x2))
--
-- We know that $y2$ belongs to $cumstr(0,next(rk(y2))) - cumstr(0,rk(y2))$.
-- Therefore, $rk(y2)$ is greater than or equal to $x2$, else by monotonicity $y2$ would
-- belong to $cumstr(0,x2)$.
--
	y2-->T854(Stat10*) ==> Ord(rk(y2))
	(rk(y2),y2)-->T867(Stat4*) ==> y2 in cumstr(0,next(rk(y2)))
	(x1,x2)-->T12(*) ==> Ord(x2)
	Suppose ==> rk(y2) ¥nincs x2
		(x2,rk(y2))-->T35(Stat10*) ==> rk(y2) in x2
		(x2,rk(y2))-->T37(Stat10*) ==> next(rk(y2))+(x2-next(rk(y2))) = x2
		(0,next(rk(y2)),x2-next(rk(y2)))-->T859(Stat10*) ==> y2 in cumstr(0,next(rk(y2))+(x2-next(rk(y2))))
	EQUAL(Stat9) ==> false; Discharge ==> rk(y2) incs x2
--
-- Since $y2 in y1$ implies $rk(y2) in rk(y1)$, we find that
-- $rk(y1)$ is greater than or equal to $x2$, contradicting Stat11
--
	y1-->T854(Stat10*) ==> Ord(rk(y1))
	(y2,y1)-->T852(Stat10,Stat10*) ==> rk(y2) in rk(y1)
	(rk(y1),rk(y2))-->T13(Stat10*) ==> rk(y1) incs x2
(rk(y1),x2)-->T35(Stat4*) ==> false; Discharge ==> QED
--
--
--
Theorem 870: [Sets whose rank belongs to an ordinal are those in its level] Ord(X) ¥imp ((rk(Y) in X) ¥eq (Y in cumstr(0,X))). Proof+:
Suppose_not(x0,y0) ==> AUTO
	Suppose ==> rk(y0) in x0
		(rk(y0),y0)-->T867(*) ==> y0 in cumstr(0,next(rk(y0)))
		(0,next(rk(y0)),x0)-->T859(*) ==> y0 in cumstr(0,next(rk(y0)) + x0)
		(x0,rk(y0))-->T37 ==> next(rk(y0)) + x0 = x0
		EQUAL ==> y0 in cumstr(0,x0)
	Discharge ==> AUTO
	Use_def(cumstr(0,x0)) ==> AUTO
	Use_def(Un({pow(cumstr(0,y)): y in x0})) ==> AUTO
	ELEM ==> Stat1: Ord(x0) & (y0 in {v: u in {pow(cumstr(0,y)): y in x0}, v in u}) & (rk(y0) notin x0)
	SIMPLF(Stat1) ==> Stat2: y0 in {v: y in x0, v in pow(cumstr(0,y))}
	(x1,v1)-->Stat2(Stat2*) ==> Stat3: (x1 in x0) & (y0 in pow(cumstr(0,x1)))
	Use_def(pow)(Stat3*) ==> Stat4: y0 in {y: y ¥incin cumstr(0,x1)}
	y1-->Stat4(Stat4*) ==> y0 ¥incin cumstr(0,x1)
	(x1,y0)-->T866(Stat1*) ==> (rk(y0) ¥incin x1) & (rk(y0) /= x0)
	(x0,x1)-->T13(Stat1*) ==> rk(y0) ¥incin x0
	y0-->T854(Stat4*) ==> Ord(rk(y0))
	(x0,rk(y0))-->T34(Stat1*) ==> false
	Discharge ==> QED
--
--
--
Theorem 871: Ord(X) ¥imp (rk(cumstr(0,X)) = X). Proof:
Suppose_not(x0) ==> AUTO
	Use_def(cumstr) ==> cumstr(0,next(x0)) = Un({pow(cumstr(0,y)): y in next(x0)})
	Use_def(Un({pow(cumstr(0,y)): y in next(x0)})) ==> AUTO
	(x0,cumstr(0,x0))-->T869(*) ==> Stat1: cumstr(0,x0) notin {u: v in {pow(cumstr(0,y)): y in next(x0)}, u in v}
	SIMPLF(Stat1) ==>  Stat2: cumstr(0,x0) notin {u: y in next(x0), u in pow(cumstr(0,y))}
	Use_def(next(x0)) ==> AUTO
	Use_def(pow(cumstr(0,x0))) ==> AUTO
	(x0,cumstr(0,x0))-->Stat2(Stat2*) ==> Stat3: cumstr(0,x0) notin {y: y ¥incin cumstr(0,x0)}
	(cumstr(0,x0))-->Stat3(Stat3*) ==> false
	Discharge ==> QED
--
--
--
Theorem 872: (Ord(X) & Ord(Y) & (X in Y) & (Z notin cumstr(0,Y))) ¥imp (X in rk(Z)). Proof:
Suppose_not(x0,y0,z0) ==> AUTO
	ELEM ==> Stat1: (y0 ¥nincin rk(z0)) & (z0 notin cumstr(0,y0))
	z0-->T854(*) ==> Stat2: Ord(rk(z0)) & Ord(y0)
	(y0,rk(z0))-->T29(Stat1*) ==> y0 = y0  + rk(z0)
	(0,rk(z0),y0)-->T859(Stat2*) ==> cumstr(0,rk(z0)) ¥incin cumstr(0,y0 + rk(z0))
	EQUAL(Stat2) ==> cumstr(0,rk(z0)) ¥incin cumstr(0,y0)
	(z0,rk(z0))-->T865(Stat2*) ==> z0 ¥incin cumstr(0,y0)
	(y0,z0)-->T866(Stat1*) ==> Stat3: (rk(z0) ¥incin y0) & (rk(z0) /= y0)
	(y0,rk(z0))-->T34(Stat2*) ==> rk(z0) in y0
	(y0,rk(z0))-->T37(Stat2*) ==> Stat4: next(rk(z0)) ¥incin y0
	(rk(z0),z0)-->T867(Stat2*) ==> z0 in cumstr(0,next(rk(z0)))
	(0,next(rk(z0)),y0)-->T859(Stat4*) ==> z0 in cumstr(0,next(rk(z0)) + y0)
	(Stat4,Stat4*)ELEM ==> next(rk(z0)) + y0 = y0
	EQUAL(Stat4) ==> Stat5: z0 in cumstr(0,y0)
	(Stat1,Stat5*)Discharge ==> QED
--
--
--
Theorem 873: (N in Za) ¥imp Finite(cumstr(0,N)). Proof+:
Suppose_not(n1) ==> AUTO
	APPLY(m2_thryvar:n0) mathematical_induction(n->n1,P(x)->(not Finite(cumstr(0,x)))) ==>
		Stat1: (FORALL n in n0 | not(not Finite(cumstr(0,n)))) & (n0 in Za) & (not Finite(cumstr(0,n0)))
	Use_def(cumstr(0,n0)) ==> AUTO
	ELEM ==> cumstr(0,n0) = Un({pow(cumstr(0,y)): y in n0})
	Suppose ==> Stat2: not(FORALL x in {pow(cumstr(0,y)): y in n0} | Finite(x))
		x0-->Stat2(Stat2*) ==> Stat3: (x0 in {pow(cumstr(0,y)): y in n0}) & (not Finite(x0))
		m0-->Stat3(Stat3*) ==> (m0 in n0) & (x0 = pow(cumstr(0,m0)))
		m0-->Stat1(Stat1*) ==> Finite(cumstr(0,m0))
		(cumstr(0,m0))-->T264(Stat3*) ==> Finite(pow(cumstr(0,m0)))
		EQUAL ==> false
	Discharge ==> AUTO
	Suppose ==> Stat4: (not Finite({pow(cumstr(0,y)): y in n0}))
		TELEM ==> (range({[y,pow(cumstr(0,y))]: y in n0}) = {pow(cumstr(0,y)): y in n0}) &
				(domain({[y,pow(cumstr(0,y))]: y in n0}) = n0) &
				Svm({[y,pow(cumstr(0,y))]: y in n0})
		(Stat1,Stat1*)ELEM ==> Finite(n0)
		EQUAL(Stat4) ==> Finite(domain({[y,pow(cumstr(0,y))]: y in n0}))
		({[y,pow(cumstr(0,y))]: y in n0})-->T192(Stat4*) ==> Finite(range({[y,pow(cumstr(0,y))]: y in n0}))
		EQUAL(Stat4) ==> false
	Discharge ==> AUTO
	({pow(cumstr(0,y)): y in n0})-->T238(Stat1*) ==> Finite(Un({pow(cumstr(0,y)): y in n0}))
	EQUAL(Stat1) ==> false
	Discharge ==> QED
--
--
--
Theorem 874: (W = cumstr(0,rk({snglIter(n,X): n in Za}))) ¥imp ((X ¥incin W) & (not Finite(W - X)) & (1 in rk(W))). Proof+:
Suppose_not(w0,x0) ==> AUTO
	Suppose ==> Stat1: (not(FORALL n in Za, m in Za | (rk(x0) in rk(snglIter(0,x0))) & ((n in m) ¥imp (rk(snglIter(n,x0)) in rk(snglIter(m,x0))))))
		(n0,m0)-->Stat1 ==> AUTO
		(x0,n0,m0)-->T857(Stat1*) ==> false
	Discharge ==> Stat2: (FORALL n in Za, m in Za | (rk(x0) in rk(snglIter(0,x0))) & ((n in m) ¥imp (rk(snglIter(n,x0)) in rk(snglIter(m,x0)))))
	T211(*) ==> 0 in Za
	(0,0)-->Stat2(Stat2*) ==> rk(x0) in rk(snglIter(0,x0))
	Suppose ==> Stat3: rk(snglIter(0,x0)) notin rk({snglIter(n,x0): n in Za})
		(snglIter(0,x0),{snglIter(n,x0): n in Za})-->T852(Stat3*) ==> Stat4: snglIter(0,x0) notin {snglIter(n,x0): n in Za}
		0-->Stat4(Stat2*) ==> false
	Discharge ==> rk(snglIter(0,x0)) in rk({snglIter(n,x0): n in Za})
	x0-->T854(Stat2*) ==> Ord(rk(x0))
	({snglIter(n,x0): n in Za})-->T854(Stat2*) ==> Ord(rk({snglIter(n,x0): n in Za}))
	Suppose ==> x0 ¥nincin w0
		(rk(x0),rk({snglIter(n,x0): n in Za}))-->T31(Stat2*) ==> rk(x0) in rk({snglIter(n,x0): n in Za})
		(rk({snglIter(n,x0): n in Za}),rk(x0))-->T13(Stat2*) ==> rk(x0) ¥incin rk({snglIter(n,x0): n in Za})
		(rk({snglIter(n,x0): n in Za}),x0)-->T866(*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat5: 1 notin rk(w0)
		Use_def(snglIter) ==> snglIter(0,x0) = {x0}
		x0-->T849(Stat5*) ==> rk({x0}) = next(rk(x0))
		EQUAL(Stat5) ==> rk(snglIter(0,x0)) = next(rk(x0))
		(rk({snglIter(n,x0): n in Za}))-->T871(Stat2*) ==> rk(cumstr(0,rk({snglIter(n,x0): n in Za}))) = rk({snglIter(n,x0): n in Za})
		EQUAL ==> rk(snglIter(0,x0)) in rk(w0)
		Use_def(next(rk(x0))) ==> AUTO
		(Stat5*)ELEM ==> Stat6: rk(x0) in rk(snglIter(0,x0))
		T211 ==> Ord(0) & Card(1)
		(snglIter(0,x0))-->T854(Stat5*) ==> Stat7: Ord(rk(snglIter(0,x0)))
		(0,rk(snglIter(0,x0)))-->T31(Stat6*) ==> 0 in rk(snglIter(0,x0))
		Use_def(Card) ==> Ord(1)
		TELEM ==> 1 = {0}
		(1,rk(snglIter(0,x0)))-->T31(Stat5*) ==> 1 in rk(snglIter(0,x0))
		w0-->T854(Stat7*) ==> Ord(rk(w0))
		(1,rk(w0))-->T31(Stat5*) ==> false
	Discharge ==> Stat8: Finite(w0 - x0)
	TELEM ==> Svm({[n,snglIter(n,x0)]: n in Za}) & (domain({[n,snglIter(n,x0)]: n in Za}) = Za) & (range({[n,snglIter(n,x0)]: n in Za}) = {snglIter(n,x0): n in Za})
	Suppose ==> (not one_1_map({[n,snglIter(n,x0)]: n in Za}))
		Use_def(one_1_map)(Stat8*) ==> Stat9: not(FORALL x in {[n,snglIter(n,x0)]: n in Za}, y in {[n,snglIter(n,x0)]: n in Za} | (cdr(x) = cdr(y)) ¥imp (x = y))
		(x2,y2)-->Stat9(Stat9*) ==> Stat10: (x2 in {[n,snglIter(n,x0)]: n in Za}) & (y2 in {[n,snglIter(n,x0)]: n in Za}) & (cdr(x2) = cdr(y2)) & (x2 /= y2)
		(n2,m2)-->Stat10(Stat10*) ==> (x2 = [n2,snglIter(n2,x0)]) & (n2 in Za) & (y2 = [m2,snglIter(m2,x0)]) & (m2 in Za)
		TELEM ==> (cdr([n2,snglIter(n2,x0)]) = snglIter(n2,x0)) & (cdr([m2,snglIter(m2,x0)]) = snglIter(m2,x0))
		EQUAL(Stat10) ==> rk(snglIter(n2,x0)) = rk(snglIter(m2,x0))
		EQUAL(Stat10) ==> Stat11: [n2,snglIter(n2,x0)] /= [m2,snglIter(n2,x0)]
		(Stat11)ELEM ==> n2 /= m2
		(n2,m2)-->T31(Stat10*) ==> (n2 in m2) or (m2 in n2)
		Suppose ==> n2 in m2
			(x0,n2,m2)-->T857(Stat10*) ==> false
		Discharge ==> AUTO
		(x0,m2,n2)-->T857(Stat10*) ==> false
	Discharge ==> AUTO
	EQUAL ==> Stat12: w0 = cumstr(0,rk({snglIter(n,x0): n in Za}))
	(w0 - x0,{snglIter(n,x0): n in Za})-->T189 ==> AUTO
	Suppose ==> {snglIter(n,x0): n in Za} ¥nincin (w0 - x0)
		({[n,snglIter(n,x0)]: n in Za})-->T854(*) ==> Ord(rk({snglIter(n,x0): n in Za}))
		(rk({snglIter(n,x0): n in Za}),{snglIter(n,x0): n in Za})-->T866(Stat12*) ==> Stat13: {snglIter(n,x0): n in Za} * x0 /= 0
		c-->Stat13(Stat13*) ==> Stat14: (c in {snglIter(n,x0): n in Za}) & (c in x0)
		n1-->Stat14(Stat14*) ==> (n1 in Za) & (snglIter(n1,x0) in x0)
		(snglIter(n1,x0),x0)-->T852(Stat14*) ==> rk(snglIter(n1,x0)) in rk(x0)
--
-- But on the other hand it turns out easily that if $n1=0$ then $rk(x0) in rk(snglIter(n1,x0))$ and,
-- if $n1/=0$, then $rk(x0) in rk(snglIter(0,x0))$ and $rk(snglIter(0,x0)) in rk(snglIter(n1,x0))$;
-- accordingly, a contradiciton ensues in either case, and therefore ${snglIter(n,x0): n in Za} ¥incin w0 - x0$.
--
		(x0,0,n1)-->T857 ==> AUTO
		Suppose ==> n1 = 0
			EQUAL(Stat14) ==> rk(snglIter(0,x0)) in rk(x0)
		(Stat14*)Discharge ==> AUTO
		T188(Stat14*) ==> Ord(0)
		(0,n1)-->T31(Stat14*) ==> 0 in n1
		T211(Stat14*) ==> rk(snglIter(0,x0)) in rk(snglIter(n1,x0))
	(Stat14*)Discharge ==> AUTO
	T206(Stat12*) ==> (not Finite(Za))
	({[n,snglIter(n,x0)]: n in Za})-->T191(Stat8*) ==> false
	Discharge ==> QED
--
-- Every set $b$ can be injected in a superstructure whose basis
-- is in one-to-one correspondence with $b$.
--
THEORY superstructure(b)
END superstructure
--
ENTER_THEORY superstructure
--
Def 10094: ur_thryvar := {{enum(x,Za+#b),Za+#b}: x in #b}
--
Theorem superstructure.0: (EXISTS f | one_1_map(f) & (range(f) = b) & (domain(f) = #b)). Proof:
    Suppose_not ==> Stat1: not(EXISTS f | (one_1_map(f) & (range(f) = b) & (domain(f) = #b)))
    b-->T147 ==> Stat2: (EXISTS f in OM | (one_1_map(f) & (range(f) = b) & (domain(f) = #b)))
    f-->Stat2(Stat2) ==> Stat3: one_1_map(f) & (range(f) = b) & (domain(f) = #b)
    f-->Stat1(Stat3) ==> false; Discharge ==> QED
--
APPLY(v1_thryvar:f) Skolem() ==>
Theorem superstructure.1: one_1_map(f) & (range(f) = b) & (domain(f) = #b)
--
Def 10095: bij_thryvar := {[x,{enum(inv(f)~[x],Za+#b),Za+#b}]: x in b}
Def 10096: sst_thryvar := cumstr(ur_thryvar,Za)
--
Theorem superstructure.2: one_1_map(bij_thryvar) & (domain(bij_thryvar)=b) & (range(bij_thryvar)=ur_thryvar). Proof:
    Suppose_not ==> AUTO
    Tsomehow ==> false; Discharge ==> QED
--
Theorem superstructure.3: supstr(ur_thryvar,sst_thryvar). Proof:
    Suppose_not ==> AUTO
    Tsomehow ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY superstructure
--
--THEORY superstructure(b)
--==>(sst_thryvar,ur_thryvar,bij_thryvar)
--	one_1_map(bij_thryvar) & (domain(bij_thryvar)=b) & (range(bij_thryvar)=ur_thryvar)
--	supstr(ur_thryvar,sst_thryvar)
--END superstructure
--
--
--
Def 10100: [hereditarily finite sets] Hfin := cumstr(0,Za)
--
Theorem 875: [the null set is hereditarily finite] 0 in Hfin. Proof:
Suppose_not ==> AUTO
	Use_def(Hfin) ==> Stat1: 0 notin cumstr(0,Za)
	(0,Za)-->T860(*) ==> Za = 0
	T212(*) ==> false
	Discharge ==> QED
--
Theorem 876: [transitivity of the collection of hereditarily finite sets] ((S in Hfin) & (X in S)) ¥imp (X in Hfin). Proof:
Suppose_not(s0,x0) ==> AUTO
	Use_def(Hfin) ==> Stat1: (s0 in cumstr(0,Za)) & (x0 in s0) & (x0 notin cumstr(0,Za))
	T206(*) ==> Ord(Za)
	Use_def(pow(cumstr(0,Za))) ==> AUTO
	Za-->T863(Stat1*) ==> Stat2: s0 in {y: y ¥incin cumstr(0,Za)}
	y0-->Stat2(Stat1,Stat1*) ==> false; Discharge ==> QED
--
Theorem 877: [extensionality of membership over the hereditarily finite sets] ((S in Hfin) & (T in Hfin) & (FORALL x | (x in Hfin) ¥imp ((x in S) ¥eq (x in T)))) ¥imp (S = T). Proof:
Suppose_not(s0,t0) ==> Stat1: (FORALL x | (x in Hfin) ¥imp ((x in s0) ¥eq (x in t0))) & (s0 in Hfin) & (t0 in Hfin) & Stat2: (s0 /= t0)
	c-->Stat2(*) ==> (c in s0) ¥neq (c in t0)
	Suppose ==> (not (c in Hfin))
		(s0,c)-->T876(*) ==> c notin s0
		(t0,c)-->T876(*) ==> false
	Discharge ==> AUTO
	c-->Stat1(*) ==> false
	Discharge ==> QED
--
--
--
Theorem 878: [closedness under powerset formation of the collection of hereditarily finite sets] (S in Hfin) ¥imp (pow(S) in Hfin). Proof:
Suppose_not(s0) ==> AUTO
--
-- Reasoning by contradiction, assume $s0$ to be a counterexample, so that (by the definitions
-- of $Hfin$ and of $cumstr$) $s0$ belongs to $pow(cumstr(0,i0))$ for some $i0 in Za$.
--
	Use_def(cumstr(0,Za)) ==> AUTO
	Use_def(Un({pow(cumstr(0,y)): y in Za})) ==> AUTO
	SIMPLF ==> Un({pow(cumstr(0,y)): y in Za}) = {u: y in Za, u in pow(cumstr(0,y))}
	Use_def(Hfin) ==> Stat1: (s0 in {u: y in Za, u in pow(cumstr(0,y))}) & (pow(s0) notin cumstr(0,Za))
	(i0,u0)-->Stat1(Stat1*) ==> Stat2: (s0 in pow(cumstr(0,i0))) & (i0 in Za)
--
-- But then, $s0$ belongs to $cumstr(0,next(i0))$ and therefore its
-- powerset $pow(s0)$ is included in $cumstr(0,next(i0))$.
--
	Suppose	==> Stat3: ({y: y ¥incin s0} ¥nincin {y: y ¥incin cumstr(0,i0)})
		Use_def(pow(cumstr(0,i0))) ==> AUTO
		e-->Stat3(Stat2*) ==> Stat4: (e in {y: y ¥incin s0}) & (s0 in {y: y ¥incin cumstr(0,i0)}) & (e notin {y: y ¥incin cumstr(0,i0)})
		(y0,y1,e)-->Stat4(Stat4*) ==> false
	Discharge ==> AUTO
	Use_def(pow)(Stat2*) ==> pow(s0) ¥incin pow(cumstr(0,i0))
	Suppose ==> Stat5: pow(cumstr(0,i0)) ¥nincin cumstr(0,next(i0))
		Use_def(next(i0)) ==> AUTO
		Use_def(cumstr(0,i0+{i0})) ==> AUTO
		EQUAL(Stat2) ==> pow(cumstr(0,i0)) ¥nincin (0 + Un({pow(cumstr(0,j)): j in i0+{i0}}))
		({pow(cumstr(0,j)): j in i0+{i0}})-->T274(*) ==> Stat6: (FORALL x in {pow(cumstr(0,j)): j in i0+{i0}} | x ¥incin Un({pow(cumstr(0,j)): j in i0+{i0}}))
		(pow(cumstr(0,i0)))-->Stat6(Stat5*) ==> Stat7: pow(cumstr(0,i0)) notin {pow(cumstr(0,j)): j in i0+{i0}}
		i0-->Stat7(Stat7*) ==> false
	Discharge ==> AUTO
--
-- By Theorem 861, this implies that $pow(s0)$ belongs to $cumstr(0,Za)$, which leads to
-- the desired contradiction.
--
	i0-->T210(Stat2,Stat2*) ==> next(i0) in Za
	(next(i0),Za,pow(s0),0)-->T861(Stat1*) ==> false
	Discharge ==> QED
--
--
--
Theorem 879: [closedness under singleton formation of the collection of hereditarily finite sets] (S in Hfin) ¥imp ({S} in Hfin). Proof:
Suppose_not(s0) ==> AUTO
--
-- Reasoning by contradiction, assume $s0$ to be a counterexample.
-- We already know that $(pow(pow(s0)) in Hfin)$ follows from $(pow(s0) in Hfin)$;
-- therefore we have a contradiction, because ${s0} in pow(pow(s0))$
-- and $Hfin$ is transitive.
--
	s0-->T878(*) ==> (pow(s0) in Hfin)
	(pow(s0))-->T878(*) ==> (pow(pow(s0)) in Hfin)
	(pow(pow(s0)),{s0})-->T876(*) ==> {s0} notin pow(pow(s0))
	Use_def(pow(s0)) ==> AUTO
	(s0,pow(s0))-->T214(*) ==> Stat1: s0 notin {y: y ¥incin s0}
	s0-->Stat1(Stat1*) ==> false
	Discharge ==> QED
--
--
--
-- As an immediate corollary of Theorem 864, we have that the hereditarily finite sets are closed under dyadic union.
--
Theorem 880: [closedness under dyadic union of the collection of hereditarily finite sets] ((S in Hfin) & (T in Hfin)) ¥imp ((S + T) in Hfin). Proof:
Suppose_not(s0,t0) ==> AUTO
	Use_def(Hfin) ==> Stat1: (s0 in cumstr(0,Za) - 0) & Stat2: (t0 in cumstr(0,Za) - 0) & ((s0 + t0) notin cumstr(0,Za))
	(s0,0,t0)-->T864(*) ==> false
	Discharge ==> QED
--
--
--
Theorem 881: [closedness under set difference of the collection of hereditarily finite sets] ((S in Hfin) & (T in Hfin)) ¥imp (((S - T) in Hfin) & ({S,T} in Hfin)). Proof:
Suppose_not(s0,t0) ==> AUTO
--
-- Reasoning by contradiction, assume $s0,t0$ to be a counterexample. We readily ascertain that ${s0,t0} in Hfin$,
-- thanks to the fact that $Hfin$ is closed relative to singleton formation and to dyadic union.
--
	s0-->T879(*) ==> {s0} in Hfin
	t0-->T879(*) ==> {t0} in Hfin
	({s0},{t0})-->T880(*) ==> ({s0} + {t0}) in Hfin
	TELEM ==> {s0}+{t0} = {s0,t0}
	EQUAL ==> {s0,t0} in Hfin
--
-- It remains to be shown that ${s0,t0} in Hfin$. By Theorem 880
-- $(s0 + t0) in Hfin$ holds, and hence (by the definitions of $Hfin$ and of $cumstr$) $s0+t0$ belongs to
-- $pow(cumstr(0,i0))$ for a suitably chosen $i0 in Za$.
--
	(s0,t0)-->T880(*) ==> (s0 + t0) in Hfin
	Use_def(cumstr(0,Za)) ==> AUTO
	Use_def(Un({pow(cumstr(0,y)): y in Za})) ==> AUTO
	SIMPLF ==> Un({pow(cumstr(0,y)): y in Za}) = {u: y in Za, u in pow(cumstr(0,y))}
	Use_def(Hfin) ==> Stat1: (s0+t0 in {u: y in Za, u in pow(cumstr(0,y))}) & ((s0 - t0) notin cumstr(0,Za))
	Use_def(pow(cumstr(0,i0))) ==> AUTO
	(i0,u0)-->Stat1(Stat1*) ==> Stat2: (s0+t0 in {y: y ¥incin cumstr(0,i0)}) & (i0 in Za)
--
-- But then, $s0 + t0$ and $s0 - t0$ are included in $cumstr(0,i0)$.
-- By Theorem 861, this implies that $s0-t0$ belongs to $cumstr(0,Za)$, which leads to
-- the desired contradiction.
--
	y0-->Stat2(Stat2*) ==> (s0 - t0) ¥incin cumstr(0,i0)
	(i0,Za,s0 - t0,0)-->T861(Stat1*) ==> false
	Discharge ==> QED
--
--
--
Theorem 882: [closedness under selection of the collection of hereditarily finite sets] (S in Hfin) ¥imp (arb(S) in Hfin). Proof:
Suppose_not(s0) ==> AUTO
	Suppose ==> arb(s0) = 0
		EQUAL ==> (not (0 in Hfin))
		T875 ==> false
	Discharge ==> arb(s0) in s0
	(s0,arb(s0))-->T876(*) ==> false
	Discharge ==> QED
--
--
--
Theorem 883: [all subsets of an hereditarily finite set are hereditarily finite] ((S in Hfin) & (T ¥incin S)) ¥imp (T in Hfin). Proof:
Suppose_not(s0,t0) ==> AUTO
--
-- Reasoning by contradiction, assume $s0,t0$ to be a counterexample, so that (by the definitions
-- of $Hfin$ and of $cumstr$) $s0$ belongs to $pow(cumstr(0,i0))$ for some $i0 in Za$.
--
	Use_def(cumstr(0,Za)) ==> AUTO
	Use_def(Un({pow(cumstr(0,y)): y in Za})) ==> AUTO
	SIMPLF ==> Un({pow(cumstr(0,y)): y in Za}) = {u: y in Za, u in pow(cumstr(0,y))}
	Use_def(Hfin) ==> Stat1: (s0 in {u: y in Za, u in pow(cumstr(0,y))}) & (t0 notin {u: y in Za, u in pow(cumstr(0,y))})
	(i0,u0,i0,t0)-->Stat1(Stat1*) ==> Stat2: (s0 in pow(cumstr(0,i0))) & (i0 in Za) & (t0 notin pow(cumstr(0,i0)))
--
-- This implies that $s0$ is a subset of $cumstr(0,i0)$, but then $t0$
-- is a subset of $cumstr(0,i0)$, too, which leads us to the desired contradiction.
--
	Use_def(pow)(Stat2,Stat2*) ==> Stat3: (s0 in {y: y ¥incin cumstr(0,i0)}) & (t0 notin {y: y ¥incin cumstr(0,i0)})
	(y0,t0)-->Stat3(*) ==> false
	Discharge ==> QED
--
--
--
Theorem 884: [alternative characterization of hereditarily finite sets] (S in Hfin) ¥eq (Finite(S) & ({u in S | not (u in Hfin)} = 0)). Proof:
Suppose_not(s0) ==> AUTO
	Suppose ==> s0 in Hfin
		Suppose ==> (not Finite(s0))
--
-- Reasoning by contradiction, assume $s0$ to be a counterexample, so that (by the definitions
-- of $Hfin$ and of $cumstr$) $s0$ belongs to $pow(cumstr(0,i0))$ for some $i0 in Za$.
--
			Use_def(cumstr(0,Za)) ==> AUTO
			Use_def(Un({pow(cumstr(0,y)): y in Za})) ==> AUTO
			SIMPLF ==> Un({pow(cumstr(0,y)): y in Za}) = {u: y in Za, u in pow(cumstr(0,y))}
			Use_def(Hfin) ==> Stat1: (s0 in {u: y in Za, u in pow(cumstr(0,y))})
			(i0,u0)-->Stat1(Stat1*) ==> Stat2: (s0 in pow(cumstr(0,i0))) & (i0 in Za)
--
-- Since $cumstr(0,i0)$ is finite by Theorem 873, so is every subset of its, and hence $s0$ is finite.
--
			i0-->T873(*) ==> Finite(cumstr(0,i0))
			Use_def(pow)(Stat2,Stat2*) ==> Stat3: s0 in {y: y ¥incin cumstr(0,i0)}
			y0-->Stat3(Stat3*) ==> s0 ¥incin cumstr(0,i0)
			(cumstr(0,i0),s0)-->T189(*) ==> false
		Discharge ==> Stat4: {u in s0 | not (u in Hfin)} /= 0
		c-->Stat4(Stat4*) ==> (c in s0) & (not (c in Hfin))
		(s0,c)-->T876(*) ==> false
	Discharge ==> Finite(s0) & ({u in s0 | not (u in Hfin)} = 0) & (not (s0 in Hfin))
	APPLY(m1_thryvar:s1) finite_induction(n->s0,P(x)->(({u in x | not (u in Hfin)} = 0) & (not (x in Hfin)))) ==>
		Stat5: (FORALL k ¥incin s1 | ((k /= s1) ¥imp (not (({u in k | not (u in Hfin)} = 0) & (not (k in Hfin)))))) & Stat6: ({u in s1 | not (u in Hfin)} = 0) & (s1 notin Hfin)
	T875(Stat5) ==> arb(s1) in s1
	Loc_def ==> a = arb(s1)
	(s1 - {a})-->Stat5(Stat5*) ==> (not (({u in (s1 - {a}) | not (u in Hfin)} = 0) & (not ((s1 - {a}) in Hfin))))
	Set_monot(Stat5*) ==> {u in (s1 - {a}) | not (u in Hfin)} ¥incin {u in s1 | not (u in Hfin)}
	(Stat5*)ELEM ==> ((s1 - {a}) in Hfin) & ((s1 - {a}) + {a} = s1)
	Suppose ==> (not (a in Hfin))
	a-->Stat6(Stat5*) ==> false; Discharge ==> AUTO
	a-->T879(Stat5*) ==> {a} in Hfin
	(s1 - {a},{a})-->T880(Stat5*) ==> ((s1 - {a}) + {a}) in Hfin
	EQUAL(Stat5) ==> false
	Discharge ==> QED
--
--
--
Theorem 885: [closedness under unionset of the collection of hereditarily finite sets] (S in Hfin) ¥imp (Un(S) in Hfin). Proof:
Suppose_not(s0) ==> AUTO
--
-- Assuming that $s0$ is hereditarily finite, we have by Theorem 884 that $s0$ is finite
-- and that every element of $s0$ has (by the very definition of $s0 in Hfin$) a finite rank.
-- By Theorem 853, the rank of the unionset $Un(s0)$ is the union of the ranks of the
-- elements of $s0$; hence, recalling that the union of any finite set of natural numbers
-- is a natural number, the rank of $Un(s0)$ is finite; this proves that $Un(s0)$ is
-- hereditarily finite.
--
	s0-->T884(*) ==> Stat1: ({x in s0 | not (x in Hfin)} = 0) & Finite(s0)
	Use_def(Hfin)(Stat1*) ==> Stat2: Un(s0) notin cumstr(0,Za)
	T206(Stat2*) ==> Ord(Za)
	s0-->T853 ==> AUTO
	(Za,Un(s0))-->T870(Stat2*) ==> Un({rk(y): y in s0}) notin Za
	({rk(y): y in s0})-->T320(Stat2*) ==> ({rk(y): y in s0} ¥nincin Za) or (not Finite({rk(y): y in s0}))
	Suppose ==> Stat3: {rk(y): y in s0} ¥nincin Za
		c-->Stat3(Stat3*) ==> Stat4: (c in {rk(y): y in s0}) & (c notin Za)
		y0-->Stat4(Stat4*) ==> (y0 in s0) & (rk(y0) notin Za)
		y0-->T854(Stat4*) ==> Ord(rk(y0))
		(rk(y0))-->T205 ==> AUTO
		(rk(y0))-->T206(Stat4*) ==> (not Finite(rk(y0)))
		(rk(y0))-->T206(Stat4*) ==> (rk(y0) notin Za)  & Ord(Za)
		(Za,y0)-->T870(Stat4*) ==> y0 notin cumstr(0,Za)
		Use_def(Hfin)(Stat4*) ==> (not (y0 in Hfin))
		y0-->Stat1(Stat4*) ==> false
	Discharge ==> Stat5: (not Finite({rk(y): y in s0}))
	TELEM ==> Svm({[y,rk(y)]: y in s0}) & (domain({[y,rk(y)]: y in s0}) = s0) & (range({[y,rk(y)]: y in s0}) = {rk(y): y in s0})
	EQUAL(Stat1) ==> (Finite(domain({[y,rk(y)]: y in s0}))) & (not Finite(range({[y,rk(y)]: y in s0})))
	({[y,rk(y)]: y in s0})-->T192(Stat5*) ==> false
	Discharge ==> QED
--
--
--
THEORY herfin_induction(s0,P(x))
	(s0 in Hfin)
	P(s0)
END herfin_induction
--
ENTER_THEORY herfin_induction
--
Theorem herfin_induction0: [finiteness ensues from hereditary finiteness] Finite(s0). Proof:
Suppose_not ==> AUTO
	Assump ==> (s0 in Hfin)
	s0-->T884(*) ==> false
	Discharge ==> QED
--
-- The following theorem shows that we can select inside the given $s0$ an element $x$ for which $P(x)$ holds,
-- none of whose strict subsets $y$ likewise meets $P(y)$.
--
APPLY(m1_thryvar:hf0_thryvar) finite_induction(n->s0,P(x)->P(x)) ==>
Theorem herfin_induction1: [inclusion-minimal hereditarily finite set satisfying $P$] (hf0_thryvar ¥incin s0) & P(hf0_thryvar) &
	(FORALL k ¥incin hf0_thryvar | (k /= hf0_thryvar) ¥imp (not P(k)))
--
-- The following theorem shows that we can find an hereditarily finite set $x$ for which $P(x)$ holds,
-- none of whose elements $y$ (or, more generally, no set having lower rank than $x$) likewise meets $P(y)$.
--
Theorem herfin_induction2: [rank-minimal hereditarily finite set satisfying $P$] (EXISTS x in cumstr(0,Za) | P(x) & (FORALL k | (rk(k) in rk(x)) ¥imp (not P(k)))). Proof:
Suppose_not ==> Stat1: not(EXISTS x in cumstr(0,Za) | P(x) & (FORALL k | (rk(k) in rk(x)) ¥imp (not P(k))))
--
-- It follows from the assumptions of this THEORY that the set ${n: n in Za, x in cumstr(0,n) | P(x)}$ is nonnull;
-- therefore $a := arb({n: n in Za, x ¥incin cumstr(0,n) | P(x)})$ belongs to this set. But then we can choose
-- $n0 in Za$, $x0 in cumstr(0,n0)$ so that $P(x0)$ holds. Plainly $x0 in cumstr(0,Z0)$ and no set $x$ having smaller
-- rank than $x0$ can meet $P(x)$.
--
	Suppose ==> Stat2: {n: n in Za, x ¥incin cumstr(0,n) | P(x)} = 0
		Assump ==> (s0 in Hfin)
		Use_def(Hfin) ==> s0 in cumstr(0,Za)
		Use_def(cumstr(0,Za)) ==> AUTO
		(Stat2*)ELEM ==> s0 in Un({pow(cumstr(0,n)): n in Za})
		Use_def(Un)(Stat2*) ==> s0 in {v: u in {pow(cumstr(0,n)): n in Za}, v in u}
		SIMPLF(Stat2*) ==> Stat3: s0 in {v: n in Za, v in pow(cumstr(0,n))}
		Use_def(pow(cumstr(0,m))) ==> AUTO
		(m,v0)-->Stat3(Stat3*) ==> Stat4: (s0 in {y: y ¥incin cumstr(0,m)}) & (m in Za)
		y0-->Stat4(Stat4*) ==> s0 ¥incin cumstr(0,m)
		Assump ==> P(s0)
		(m,s0)-->Stat2(Stat2*) ==> false
	Discharge ==> AUTO
	Loc_def ==> a = arb({n: n in Za, x ¥incin  cumstr(0,n) | P(x)})
	({n: n in Za, x ¥incin cumstr(0,n) | P(x)})-->T0(*) ==> Stat5: (a in {n: n in Za, x ¥incin  cumstr(0,n) | P(x)}) & (a * {n: n in Za, x ¥incin  cumstr(0,n) | P(x)} = 0)
	(n0,x0)-->Stat5(Stat5*) ==> (n0 in Za) & (x0 ¥incin cumstr(0,n0)) & P(x0) & (n0 * {n: n in Za, x ¥incin cumstr(0,n) | P(x)} = 0)
	(n0,Za,x0,0)-->T861(Stat5*) ==> x0 in cumstr(0,Za)
	x0-->Stat1(Stat5*) ==> Stat6: not(FORALL k | (rk(k) in rk(x0)) ¥imp (not P(k)))
	k0-->Stat6(Stat6*) ==> (rk(k0) in rk(x0)) & P(k0)
--
-- Indeed, if we assume that $P(k0)$ holds for some $k0$ having smaller rank than $x0$, then we are led to a contradiction as follows.
-- Since $rk(x0)$ differs from $0$, the same holds true for $x0$, and hence for $cumstr(0,n0)$, and hence for $n0$. Calling $m0$ the
-- immediate predecessor of $n0$, if follows from $x0 ¥incin cumstr(0,n0)$ that $rk(x0) ¥incin n0$; therefore $rk(k0) in n0$, and
-- hence $rk(k0) ¥incin m0$, $k0 ¥incin cumstr(0,m0)$, whence a contradiction readily follows.
--
	x0-->T848(Stat5*) ==> cumstr(0,n0) /= 0
	Suppose ==> n0 = 0
		0-->T858(Stat5*) ==> cumstr(0,0) = 0
		EQUAL(Stat6) ==> false
	Discharge ==> AUTO
	Loc_def ==> m0 = Un(n0)
	n0-->T321(Stat5*) ==> Stat7: (m0 notin {n: n in Za, x ¥incin cumstr(0,n) | P(x)}) & (m0 in Za) & (m0 ¥incin n0) & (m0 in n0)
	Suppose ==> k0 ¥nincin cumstr(0,m0)
		n0-->T322(Stat5*) ==> n0 = Un(n0) ¥PLUS 1
		m0-->T317 ==> m0 ¥PLUS 1 = next(m0)
		EQUAL(Stat6) ==> n0 = next(m0)
		T206(Stat7*) ==> Ord(Za)
		(Za,n0)-->T12(Stat5*) ==> Ord(n0)
		(Za,m0)-->T12(Stat7*) ==> Ord(m0)
		(n0,x0)-->T866(Stat5*) ==> rk(k0) in next(m0)
		(m0,rk(k0))-->T36(Stat7*) ==> rk(k0) ¥incin m0
		(m0,k0)-->T866(Stat7*) ==> false
	Discharge ==> AUTO
	(m0,k0)-->Stat7(Stat6*) ==> false
	Discharge ==> QED
--
--
-- The following theorem shows that we can find an hereditarily finite set $x$ for which $P(x)$ holds,
-- none of whose elements or strict subsets $y$ likewise meets $P(y)$.
--
Theorem herfin_induction3: [existence of membership/inclusion-minimal hereditarily finite set satisfying $P$] (EXISTS x | (x in Hfin) & P(x) & (FORALL k | ((k in x) or ((k ¥incin x) & (k /= x))) ¥imp (not P(k)))). Proof:
Suppose_not ==> Stat1: not(EXISTS x | (x in Hfin) & P(x) & (FORALL k | ((k in x) or ((k ¥incin x) & (k /= x))) ¥imp (not P(k))))
	Therfin_induction2(*) ==> Stat2: (EXISTS x in cumstr(0,Za) | P(x) & (FORALL k | (rk(k) in rk(x)) ¥imp (not P(k))))
	Use_def(Hfin) ==> (x0 in Hfin) ¥eq (x0 in cumstr(0,Za)) 
	x0-->Stat2(Stat2*) ==> Stat3: (FORALL k | (rk(k) in rk(x0)) ¥imp (not P(k))) & (x0 in Hfin) & P(x0)
	APPLY(hf0_thryvar:x1) herfin_induction(s0->x0,P(x)->P(x)) ==> Stat4: (FORALL k ¥incin x1 | (k /= x1) ¥imp (not P(k))) & (x1 ¥incin x0) & P(x1)
	Suppose ==> Stat5: not(FORALL k | ((k in x1) or ((k ¥incin x1) & (k /= x1))) ¥imp (not P(k)))
		x2-->Stat5(Stat5*) ==> ((x2 in x1) or ((x2 ¥incin x1) & (x2 /= x1))) & P(x2)
		Suppose ==> (x2 ¥incin x1) & (x2 /= x1)
		x2-->Stat4(Stat4*) ==> false; Discharge ==> AUTO
		(x2,x0)-->T852 ==> AUTO
		x2-->Stat3(Stat4*) ==> false
	Discharge ==> AUTO
	(x0,x1)-->T883(Stat3*) ==> x1 in Hfin
	x1-->Stat1(Stat4*) ==> false
	Discharge ==> QED
--
-- Here we assign a name to a membership/inclusion-minimal hereditarily finite set satisfying $P$.
--
APPLY(v1_thryvar:hf1_thryvar) Skolem() ==>
Theorem herfin_induction4: [membership/inclusion-minimal hereditarily finite set satisfying $P$] (hf1_thryvar in Hfin) & P(hf1_thryvar) & (FORALL k | ((k in hf1_thryvar) or ((k ¥incin hf1_thryvar) & (k /= hf1_thryvar))) ¥imp (not P(k)))
--
ENTER_THEORY Set_theory
--
--
--DISPLAY herfin_induction
--
--THEORY herfin_induction(s0,P(x))
--	(s0 in Hfin)
--	P(s0)
--==>(hf0_thryvar,hf1_thryvar)
-- (FORALL k ¥incin hf0_thryvar | (k /= hf0_thryvar) ¥imp (not P(k))) & (hf0_thryvar ¥incin s0) & P(hf0_thryvar)
-- (FORALL k | ((k in hf1_thryvar) or ((k ¥incin hf1_thryvar) & (k /= hf1_thryvar))) ¥imp (not P(k))) & (hf1_thryvar in Hfin) & P(hf1_thryvar)
-- (EXISTS x in cumstr(0,Za) | P(x) & (FORALL k | (rk(k) in rk(x)) ¥imp (not P(k))))
--END herfin_induction
--
--
--
--
Theorem 886: [alternative characterization of hereditarily finite sets, 2] (S in Hfin) ¥eq (Finite(Ult_membs(S))). Proof:
Suppose_not(s0) ==> AUTO
--
-- To prove the "if" part of the claim, assume that $Ult_membs(s0)$ is finite. Then
-- a set $sp$ exists which meets the conditions $Finite(Ult_membs(sp)) & (not (sp in Hfin))$
-- but none of whose members meets analogous conditions. Since $sp$ is included in $Ult_membs(sp)$,
-- it is finite; therefore, in view of Theorem 884, at least one of its members---call it $c$---must
-- fail to be hereditarily finite. Due to the minimality of $sp$, $Ult_membs(c)$ must be finite;
-- however, this conflicts with the monotonic law Theorem 23, ensuring that
-- $Ult_membs(c) ¥imp Ult_membs(sp)$.
--
	Suppose ==> Finite(Ult_membs(s0)) & (not (s0 in Hfin))
		APPLY(mt1_thryvar:sp) transfinite_induction(n->s0,P(x)->(Finite(Ult_membs(x)) & (not (x in Hfin)))) ==>
			Stat1: (FORALL k | (Finite(Ult_membs(sp)) & (not (sp in Hfin))) & ((k in sp) ¥imp (not (Finite(Ult_membs(k)) & (not (k in Hfin))))))
		0-->Stat1(Stat1*) ==> Finite(Ult_membs(sp)) & (not (sp in Hfin))
		(Ult_membs(sp),sp)-->T189 ==> AUTO
		sp-->T14(Stat1*) ==> (sp ¥incin Ult_membs(sp)) & Finite(sp)
		sp-->T884(Stat1*) ==> Stat2: {u in sp | not (u in Hfin)} /= 0
		c-->Stat2(Stat2*) ==> (c in sp) & (not (c in Hfin))
		(Ult_membs(sp),Ult_membs(c))-->T189 ==> AUTO
		(c,sp)-->T22(Stat1*) ==> Finite(Ult_membs(c))
		c-->Stat1(Stat2*) ==> false
	Discharge ==> (s0 in Hfin) & (not Finite(Ult_membs(s0)))
	APPLY(hf1_thryvar:s1) herfin_induction(s0->s0,P(x)->(not Finite(Ult_membs(x)))) ==>
		Stat3: (FORALL k | ((k in s1) or ((k ¥incin s1) & (k /= s1))) ¥imp (not (not Finite(Ult_membs(k))))) & (s1 in Hfin) & (not Finite(Ult_membs(s1)))
	Suppose ==> s1 = 0
		T188(Stat3*) ==> Ord(0) & Finite(0)
		0-->T17(Stat3*) ==> Ult_membs(0) = 0
		EQUAL(Stat3) ==> false
	Discharge ==> AUTO
	Loc_def ==> a = arb(s1)
	s1-->T0(Stat3*) ==> Stat4: a in s1
	Suppose ==> Stat5: s1 = {a}
		a-->T18(Stat5*) ==> Ult_membs({a}) = Ult_membs(a) + {a}
		a-->Stat3(Stat4*) ==> Finite(Ult_membs(a))
		(Ult_membs(a),a)-->T199(Stat5*) ==> Finite(Ult_membs(a) + {a})
		EQUAL(Stat3) ==> false
	Discharge ==> AUTO
	(s1,{a})-->T883(Stat3*) ==> ({a} in Hfin) & ({a} ¥incin s1) & ({a} /= s1)
	(s1,s1 - {a})-->T883(Stat3*) ==> ((s1 - {a}) in Hfin) & (s1 - {a} ¥incin s1) & (s1 - {a} /= s1)
	({a})-->Stat3(Stat4*) ==> Finite(Ult_membs({a}))
	(s1 - {a})-->Stat3(Stat4*) ==> Finite(Ult_membs(s1 - {a}))
	(Ult_membs({a}),Ult_membs(s1 - {a}))-->T236(Stat4*) ==> Finite(Ult_membs({a}) + Ult_membs(s1 - {a}))
	(Ult_membs({a}) + Ult_membs(s1 - {a}),Ult_membs(s1))-->T189(Stat3*) ==> Stat6: Ult_membs(s1) ¥nincin (Ult_membs({a}) + Ult_membs(s1 - {a}))
	e-->Stat6(Stat6*) ==> (e in Ult_membs(s1)) & (e notin Ult_membs({a})) & (e notin Ult_membs(s1 - {a}))
	s1-->T15 ==> AUTO
	{a}-->T15 ==> AUTO
	(s1 - {a})-->T15(Stat4*) ==> Stat7: (e in {v: x in s1, v in Ult_membs(x)}) & (e notin {v: x in {a}, v in Ult_membs(x)}) & (e notin {v: x in s1 - {a}, v in Ult_membs(x)})
	(x1,v1,x1,v1,x1,v1)-->Stat7(Stat7*) ==> false
	Discharge ==> QED
--
-- ************************************************************************************************
--			Section 17: Map calculus
-- ************************************************************************************************
--
THEORY based_maps(uu,rr)
	rr ¥incin pow(uu ¥PROD uu)
	ident(uu) in rr
	(FORALL q in rr | (Un(rr) - q) in rr)
	(FORALL q in rr | inv(q) in rr)
	(FORALL p in rr, q in rr | (p + q) in rr)
	(FORALL p in rr, q in rr | (q @ p) in rr)
END based_maps
--
ENTER_THEORY based_maps
--
Def based_maps.1: compl_thryvar(X) := (uu ¥PROD uu) - X
--
Def based_maps.2: ident_thryvar := ident(uu)
--
Theorem based_maps.1: ((X in rr) & (Y in rr)) ¥imp ((X + Y) = (Y + X)). Proof:
Suppose_not(x0,y0) ==> AUTO
	Discharge ==> QED
--
Theorem based_maps.2: ((X in rr) & (Y in rr) & (Z in rr)) ¥imp ((X + Y) + Z = X + (Y + Z)). Proof:
Suppose_not(x0,y0,z0) ==> AUTO
	Discharge ==> QED
--
Theorem based_maps.3: ((X in rr) & (Y in rr)) ¥imp (compl_thryvar(compl_thryvar(X + Y) + compl_thryvar(X + compl_thryvar(Y))) = X). Proof:
Suppose_not(x0,y0) ==> AUTO
	Assump ==> rr ¥incin pow(uu ¥PROD uu)
	Use_def(pow(uu ¥PROD uu)) ==> AUTO
	ELEM ==> Stat1: (x0 in {y: y ¥incin (uu ¥PROD uu)}) & (y0 in {y: y ¥incin (uu ¥PROD uu)})
	(xp,yp)--> Stat1(Stat1*) ==> Stat2: (x0 ¥incin (uu ¥PROD uu)) & (y0 ¥incin (uu ¥PROD uu))
	Use_def(compl_thryvar) ==> (uu ¥PROD uu) - (((uu ¥PROD uu) - (x0 + y0)) + ((uu ¥PROD uu) - (x0 + ((uu ¥PROD uu) - y0)))) /= x0
	(Stat2*)Discharge ==> QED
--
Theorem based_maps.4: ((X in rr) & (Y in rr) & (Z in rr)) ¥imp ((X @ Y) @ Z = X @ (Y @ Z)). Proof:
Suppose_not(x0,y0,z0) ==> AUTO
	(x0,y0,z0)-->T66 ==> AUTO
	Discharge ==> QED
--
Theorem based_maps.5: ((X in rr) & (Y in rr) & (Z in rr)) ¥imp (Z @ (X + Y) = (Z @ X) + (Z @ Y)). Proof:
Suppose_not(x0,y0,z0) ==> AUTO
	(z0,x0,y0)-->T137 ==> AUTO
	Discharge ==> QED
--
Theorem based_maps.6: (X in rr) ¥imp ((ident_thryvar @ X) = X). Proof:
Suppose_not(x0) ==> AUTO
	Use_def(ident_thryvar) ==> (ident(uu) @ x0) /= x0
	Assump ==> rr ¥incin pow(uu ¥PROD uu)
	Use_def(pow(uu ¥PROD uu)) ==> AUTO
	ELEM ==> Stat1: x0 in {y: y ¥incin (uu ¥PROD uu)}
	y0 --> Stat1(Stat1*) ==> x0 ¥incin (uu ¥PROD uu)
	(uu ¥PROD uu,uu,uu)-->T141(*) ==> Is_map(uu ¥PROD uu)
	(x0,uu ¥PROD uu)-->T52(*) ==> Is_map(x0)
	(uu,0,x0)-->T115(*) ==> range(x0) ¥nincin uu
	(x0,uu ¥PROD uu)-->T65(*) ==> range(x0) ¥incin range(uu ¥PROD uu)
	(uu ¥PROD uu,uu,uu)-->T141(*) ==> false
	Discharge ==> QED
--
Theorem based_maps.7: (X in rr) ¥imp (inv(inv(X)) = X). Proof:
Suppose_not(x0) ==> AUTO
	x0-->T100(*) ==> (not Is_map(x0))
	Assump ==> rr ¥incin pow(uu ¥PROD uu)
	Use_def(pow(uu ¥PROD uu)) ==> AUTO
	ELEM ==> Stat1: x0 in {y: y ¥incin (uu ¥PROD uu)}
	y0-->Stat1(Stat1*) ==> x0 ¥incin (uu ¥PROD uu)
 	(x0,uu,uu)-->T141(*) ==> false
	Discharge ==> QED
--
Theorem based_maps.8: ((X in rr) & (Y in rr)) ¥imp (inv(X + Y) = inv(X) + inv(Y)). Proof:
Suppose_not(x0,y0) ==> AUTO
	(x0,y0)-->T111(*) ==> false
	Discharge ==> QED
--
Theorem based_maps.9: ((X in rr) & (Y in rr)) ¥imp (inv(X @ Y) = inv(Y) @ inv(X)). Proof:
Suppose_not(x0,y0) ==> AUTO
	Assump ==> rr ¥incin pow(uu ¥PROD uu)
	Use_def(pow(uu ¥PROD uu)) ==> AUTO
	ELEM ==> Stat1: (x0 in {y: y ¥incin (uu ¥PROD uu)}) & (y0 in {y: y ¥incin (uu ¥PROD uu)})
	(xp,yp)--> Stat1(Stat1*) ==> Stat2: (x0 ¥incin (uu ¥PROD uu)) & (y0 ¥incin (uu ¥PROD uu))
	(uu ¥PROD uu,uu,uu)-->T141(Stat2*) ==> Is_map(uu ¥PROD uu)
	(x0,uu ¥PROD uu)-->T52(Stat2*) ==> Is_map(x0)
	(y0,uu ¥PROD uu)-->T52(Stat2*) ==> Is_map(y0)
	(x0,y0)-->T120(*) ==> false
	Discharge ==> QED
--
Theorem based_maps.10: ((X in rr) & (Y in rr)) ¥imp ((compl_thryvar(Y @ X) @ inv(X)) + compl_thryvar(Y) = compl_thryvar(Y)). Proof:
Suppose_not(x0,y0) ==> AUTO
	Assump ==> rr ¥incin pow(uu ¥PROD uu)
	Use_def(pow(uu ¥PROD uu)) ==> AUTO
	ELEM ==> Stat1: (x0 in {y: y ¥incin (uu ¥PROD uu)}) & (y0 in {y: y ¥incin (uu ¥PROD uu)})
	(xp,yp)--> Stat1(Stat1*) ==> Stat2: (x0 ¥incin (uu ¥PROD uu)) & (y0 ¥incin (uu ¥PROD uu))
--
	Use_def(compl_thryvar) ==> Stat3: (((uu ¥PROD uu) - (y0 @ x0)) @ inv(x0)) ¥nincin ((uu ¥PROD uu) - y0)
	v0-->Stat3(Stat3*) ==> Stat4: (v0 in (((uu ¥PROD uu) - (y0 @ x0)) @ inv(x0))) & (v0 notin ((uu ¥PROD uu) - y0))
	Use_def(@) ==> Stat5: v0 in {[car(p),cdr(q)]: p in inv(x0), q in ((uu ¥PROD uu) - (y0 @ x0)) | cdr(p) = car(q)}
	Use_def(inv(x0)) ==> AUTO
	Use_def(@) ==> (y0 @ x0) = {[car(r),cdr(s)]: r in x0, s in y0 | cdr(r) = car(s)}
	(p0,q0)-->Stat5(Stat4*) ==> Stat6: (p0 in {[cdr(v),car(v)]: v in x0}) & (q0 in ((uu ¥PROD uu) - {[car(r),cdr(s)]: r in x0, s in y0 | cdr(r) = car(s)})) & (cdr(p0) = car(q0)) & (v0 = [car(p0),cdr(q0)])
	w0-->Stat6(Stat6*) ==> Stat7: (q0 notin {[car(r),cdr(s)]: r in x0, s in y0 | cdr(r) = car(s)}) & (w0 in x0) & (p0 = [cdr(w0),car(w0)])
	(cdr(w0),cdr(v0))-->T9(Stat7*) ==> (car([cdr(w0),cdr(v0)]) = cdr(w0)) & (cdr([cdr(w0),cdr(v0)]) = cdr(v0))
	(w0,[cdr(w0),cdr(v0)])-->Stat7(Stat7*) ==> Stat8: (q0 /= [car(w0),cdr([cdr(w0),cdr(v0)])]) or ([cdr(w0),cdr(v0)] notin y0)
	(cdr(w0),car(w0))-->T9(Stat8*) ==> (car([cdr(w0),car(w0)]) = cdr(w0)) & (cdr([cdr(w0),car(w0)]) = car(w0))
	Suppose ==> q0 /= [car(w0),cdr([cdr(w0),cdr(v0)])]
		EQUAL(Stat6) ==> (q0 /= [car(w0),cdr(v0)]) & (cdr(p0) = car(w0)) & (cdr(p0) = car(q0))
		(uu ¥PROD uu,q0)-->T51(Stat6,Stat6*) ==> Is_map(uu ¥PROD uu) ¥imp (q0 = [car(q0),cdr(q0)])
		(uu ¥PROD uu,uu,uu)-->T141(Stat8*) ==> Stat9: ([car(q0),cdr(q0)] /= [car(w0),cdr(v0)]) & (car(q0) = car(w0))
		(Stat9)ELEM ==> cdr(q0) /= cdr(v0)
		(car(p0),cdr(q0))-->T9(Stat9*) ==> cdr([car(p0),cdr(q0)]) = cdr(q0)
		EQUAL(Stat6) ==> false
	Discharge ==> q0 = [car(w0),cdr([cdr(w0),cdr(v0)])]
	(Stat8*)ELEM ==> [cdr(w0),cdr(v0)] notin y0
	(car(w0),cdr([cdr(w0),cdr(v0)]))-->T9(Stat8*) ==> cdr([car(w0),cdr([cdr(w0),cdr(v0)])]) = cdr(v0)
--??	EQUAL(Stat7) ==> [car(p0),cdr(q0)] notin y0
	EQUAL(Stat7) ==> Stat10: (cdr(q0) = cdr(v0)) & (car(p0) = cdr(w0))
	EQUAL(Stat8) ==> Stat11: [car(p0),cdr(q0)] notin y0
	(Stat4,Stat6,Stat11*)ELEM ==> [car(p0),cdr(q0)] notin (uu ¥PROD uu)
	Use_def(¥PROD)(Stat11*) ==> Stat12: [car(p0),cdr(q0)] notin {[x,y]: x in uu, y in uu}
	(car(p0),cdr(q0))-->Stat12(Stat12*) ==> (car(p0) notin uu) or (cdr(q0) notin uu)
	(w0,uu,uu)-->T140(Stat2,Stat7,Stat10*) ==> car(p0) in uu
	(q0,uu,uu)-->T140(Stat6,Stat6*) ==> cdr(q0) in uu
	(Stat12*)Discharge ==> QED
--
--
ENTER_THEORY Set_theory
--
--DISPLAY based_maps
--
--THEORY based_maps(uu,rr)
--	rr ¥incin pow(uu ¥PROD uu)
--	ident(uu) in rr
--	(FORALL q in rr | (Un(rr) - q) in rr)
--	(FORALL q in rr | inv(q) in rr)
--	(FORALL p in rr, q in rr | (p + q) in rr)
--	(FORALL p in rr, q in rr | (q @ p) in rr)
--==>(compl_thryvar,ident_thryvar)
--	(FORALL x | compl_thryvar(x) = ((uu ¥PROD uu) - x))
--	(ident_thryvar = ident(uu))
--	(FORALL x, y | ((x in rr) & (y in rr)) ¥imp ((x + y) = (y + x)))
--	(FORALL x, y, z | ((x in rr) & (y in rr) & (z in rr)) ¥imp ((x + y) + z = x + (y + z)))
--	(FORALL x, y | ((x in rr) & (y in rr)) ¥imp (compl_thryvar(compl_thryvar(x + y) + compl_thryvar(x + compl_thryvar(y))) = x))
--	(FORALL x, y, z | ((x in rr) & (y in rr) & (z in rr)) ¥imp ((x @ y) @ z = x @ (y @ z)))
--	(FORALL x, y, z | ((x in rr) & (y in rr) & (z in rr)) ¥imp (z @ (x + y) = (z @ x) + (z @ y)))
--	(FORALL x | (x in rr) ¥imp ((ident_thryvar @ x) = x))
--	(FORALL x | (x in rr) ¥imp (inv(inv(x)) = x))
--	(FORALL x, y, z | ((x in rr) & (y in rr)) ¥imp (inv(x + y) = inv(x) + inv(y)))
--	(FORALL x, y | ((x in rr) & (y in rr)) ¥imp (inv(x @ y) = inv(y) @ inv(x)))
--	(FORALL x, y | ((x in rr) & (y in rr)) ¥imp ((compl_thryvar(y @ x) @ inv(x)) + compl_thryvar(y) = compl_thryvar(y)))
--END based_maps
--
--
-- ************************************************************************************************
--			Section 18: Finite state automata
-- ************************************************************************************************
--
--
-- Next we develop the theory of a
-- (nondeterministic and finite) Kleene automaton.
--
THEORY nfa(a,v,s,t,d)
--
-- A nondeterministic finite automaton is
-- characterized by its alphabet $a$,
-- its set $v$ of states, among which the start
-- states $s$ and the accepting states $t$,
-- and by its transition relation $d$.
-- As a convenient trick, the entire alphabet is used
-- as the label for free (or 'in-place') transitions.
--
	(a /= 0) & Finite(a)
	((s + t) ¥incin v) & Finite(v)
	d ¥incin ((v ¥PROD next(a)) ¥PROD v)
END nfa
--
ENTER_THEORY nfa
--
Theorem nfa1: [transition triples are finitely many] Finite(d). Proof:
Suppose_not ==> AUTO
--
-- For, assuming the contrary, since $d$ is a subset of the
-- Cartesian product of two finite sets (which is finite in its turn),
-- we get a contradiction.
--
	Assump ==> Stat1: Finite(a) & Finite(v)
	(a,a)-->T199(Stat1*) ==> Stat2: Finite(a + {a})
	Use_def(next(a)) ==> AUTO
	EQUAL(Stat2) ==> Finite(next(a))
	(v,next(a))-->T262(Stat1*) ==> Stat3: Finite(v ¥PROD next(a))
	(v ¥PROD next(a),v)-->T262(Stat1,Stat3*) ==> Stat4: Finite((v ¥PROD next(a)) ¥PROD v)
	Assump ==> d ¥incin ((v ¥PROD next(a)) ¥PROD v)
	((v ¥PROD next(a)) ¥PROD v,d)-->T189(Stat4*) ==> Finite(d)
    Discharge ==> QED
--
Def nfa1: [neighbors $p$ of a set $q$ of states] nfaNeighbor_thryvar(p,q) := (p incs q) & ({y: x in p, y in v - p | [[x,a],y] in d} = 0)
--
Def nfa2: [epsilon-closure of sets of states] nfaEps_thryvar := {[q,{z in v | (FORALL p ¥incin v | nfaNeighbor_thryvar(p,q) ¥imp (z in p))}]: q ¥incin v}
--
-- In the following definition it is understood that the first
-- argument will normally be a set $q$ of states coinciding with
-- its own epsilon-closure while the second argument will be a
-- character drawn from the alphabet $a$.
--
Def nfa3: [transition over a symbol of the alphabet] nfa1_thryvar(C,Q) := {z: y in Q, z in v | [[y,C],z] in d}
--
Theorem nfa2: [strict inclusion between strings is a well-founded relation] ((W ¥incin Fin_seqs(a)) & (W /= 0)) ¥imp (EXISTS m in W | (FORALL y in W | not((y ¥incin m) & (y /= m)))). Proof:
Suppose_not(w0) ==> AUTO
	(Fin_seqs(a),w0)-->T411(*) ==> Stat1: not(FORALL y in Fin_seqs(a) | Finite(y))
	y0-->Stat1(Stat1*) ==> Stat2: (y0 in Fin_seqs(a)) & (not Finite(y0))
	(y0,a)-->T336(Stat2*) ==> false
	Discharge ==> QED
--
APPLY(wfh2_thryvar:nfa_thryvar) wellfounded_recursive_fcn(s->Fin_seqs(a),
	arg1_bef_arg2(Y,X)->((Y ¥incin X) & (Y /= X)),
	f3(B,W,Q)->(nfaEps_thryvar~[if W=0 then Q else nfa1_thryvar(W~[#W ¥MINUS 1],arb(B)) end if]),
	g4(Qp,y,x,t)->Qp,P4(q,Wp,W,t)->(Wp=W ¥ON (#W ¥MINUS 1))) ==>
Theorem nfa3: [consumption of a string over the alphabet] (FORALL w,q | (w in Fin_seqs(a)) ¥imp
	(nfa_thryvar(w,q) = (nfaEps_thryvar~[if w=0 then q else nfa1_thryvar(w~[#w ¥MINUS 1],arb({nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp ¥incin w) & (wp /= w)) & (wp = w ¥ON (#w ¥MINUS 1))})) end if])))
--
-- We can simplify as follows the characterization just given of the transitions over strings:
--
Theorem nfa4: [consumption of a string over the alphabet, 2] (W in Fin_seqs(a)) ¥imp
	(nfa_thryvar(W,Q) = (nfaEps_thryvar~[if W = 0 then Q else nfa1_thryvar(W~[#W ¥MINUS 1],nfa_thryvar(W ¥ON (#W ¥MINUS 1),Q)) end if])). Proof:
Suppose_not(w,q) ==> AUTO
	Tnfa3(*) ==> Stat1: (FORALL w,q | (w in Fin_seqs(a)) ¥imp (nfa_thryvar(w,q) =
		(nfaEps_thryvar~[if w=0 then q else nfa1_thryvar(w~[#w ¥MINUS 1],arb({nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp ¥incin w) & (wp /= w)) & (wp = w ¥ON (#w ¥MINUS 1))})) end if])))
	(w,q)-->Stat1(*) ==> nfa_thryvar(w,q) =
		(nfaEps_thryvar~[if w=0 then q else nfa1_thryvar(w~[#w ¥MINUS 1],arb({nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp ¥incin w) & (wp /= w)) & (wp = w ¥ON (#w ¥MINUS 1))})) end if])
	Suppose ==> arb({nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp ¥incin w) & (wp /= w)) & (wp = w ¥ON (#w ¥MINUS 1))}) =
		nfa_thryvar(w ¥ON (#w ¥MINUS 1),q)
		EQUAL ==> false
	Discharge ==> AUTO
	Suppose ==> Stat2: #w = 0
		w-->T162(*) ==> w = 0
		(Stat2*)ELEM ==> if w = 0 then q else nfa1_thryvar(W~[#W ¥MINUS 1],nfa_thryvar(W ¥ON (#W ¥MINUS 1),Q)) end if = q
		(Stat2*)ELEM ==> if w=0 then q else nfa1_thryvar(w~[#w ¥MINUS 1],arb({nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp ¥incin w) & (wp /= w)) & (wp = w ¥ON (#w ¥MINUS 1))})) end if = q
		EQUAL ==> false
	Discharge ==> AUTO
	ELEM ==> Stat3: ({nfa_thryvar(w ¥ON (#w ¥MINUS 1),q)} /=
			{nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp ¥incin w) & (wp /= w)) & (wp = w ¥ON (#w ¥MINUS 1))}) &
			(w in Fin_seqs(a)) & (#w /= 0)
--
-- Pick a witness $q0$ of the above-derived set inequality, so that $q0$
-- belongs to one of the two members, but not to the other. Whether it belongs
-- to the left-hand member or to the right-hand one, we will reach a contradiction.
-- Therefore we can conclude that the desired conclusion holds.
--
	q0-->Stat3 ==> AUTO
	Suppose ==> q0 notin {nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp ¥incin w) & (wp /= w)) & (wp = w ¥ON (#w ¥MINUS 1))}
		(Stat3*)ELEM ==> Stat4: nfa_thryvar(w ¥ON (#w ¥MINUS 1),q) notin {nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp ¥incin w) & (wp /= w)) & (wp = w ¥ON (#w ¥MINUS 1))}
		(w,#w ¥MINUS 1)-->T48 ==> AUTO
		(w ¥ON (#w ¥MINUS 1))-->Stat4(Stat4*) ==> ((w ¥ON (#w ¥MINUS 1)) notin Fin_seqs(a)) or ((w ¥ON (#w ¥MINUS 1)) = w)
		(w,a)-->T336(Stat3*) ==> Stat5: (domain(w) = #w) & (#w in Za)
		Suppose ==> (w ¥ON (#w ¥MINUS 1)) = w
			(w,#w ¥MINUS 1)-->T94 ==> AUTO
			EQUAL(Stat5) ==> #w = #w * (#w ¥MINUS 1)
			(Stat5*)ELEM ==> #w ¥incin (#w ¥MINUS 1)
			ALGEBRA(Stat5) ==> (0 in Za) & (1 in Za)
			w-->T166(Stat5*) ==> ##w = #w
			w-->T156(Stat5*) ==> Ord(#w)
			T188(Stat5*) ==> Ord(0)
			(0,#w)-->T31(Stat3*) ==> Stat6: 0 in #w
			Use_def(next(0)) ==> AUTO
			Use_def(1)(Stat6*) ==> (1 = {0}) & (#w incs 1)
			(#w)-->T268(Stat5) ==> #w ¥MINUS 0 = #w
			(1,#w,0)-->T299(Stat5*) ==> false
		Discharge ==> AUTO
		ALGEBRA(Stat5) ==> (#w ¥MINUS 1) in Za
		(w,a,#w ¥MINUS 1)-->T346(Stat3*) ==> false
	Discharge ==> Stat7: (q0 in {nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp ¥incin w) & (wp /= w)) & (wp = w ¥ON (#w ¥MINUS 1))}) &
			(q0 /= nfa_thryvar(w ¥ON (#w ¥MINUS 1),q))
	wq-->Stat7(Stat7*) ==> (wq = w ¥ON (#w ¥MINUS 1)) & (q0 = nfa_thryvar(wq,q))
	EQUAL(Stat7) ==> false
	Discharge ==> QED
--
-- Observe that the consumption of a string over the alphabet leads from sets of states to sets of states:
--
Theorem nfa5: [consumption of a string leads to states] (W in Fin_seqs(a)) ¥imp (nfa_thryvar(W,Q) ¥incin v). Proof:
Suppose_not(w0,q0) ==> AUTO
--
-- Arguing by contradiction, assume that $w0,q0$ form a counterexample to the claim of this
-- theorem. Recall that $nfa_thryvar(W,Q)$ is, by Theorem nfa4, an $nfaEps_ythryvar$-image.
--
	(w0,a,q0)-->Tnfa4 ==> AUTO --??
	Suppose ==> if w0 = 0 then q0 else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),q0)) end if notin domain(nfaEps_thryvar)
	(if w0 = 0 then q0 else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),q0)) end if,nfaEps_thryvar)-->T124(*) ==> false; Discharge ==> AUTO
--
-- Therefore, $nfa_thryvar(W,Q)$ belongs to $range(nfaEps_ythryvar)$, which inspection of
-- the definition of $nfaEps_ythryvar$ readily reveals to be included in $pow(v)$.
--
	(if w0 = 0 then q0 else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),q0)) end if,nfaEps_thryvar)-->T71(*) ==> nfa_thryvar(w0,q0) in range(nfaEps_thryvar)
	Use_def(nfaEps_thryvar) ==> Stat1: nfa_thryvar(w0,q0) in {{z in v | (FORALL p ¥incin v | nfaNeighbor_thryvar(p,q) ¥imp (z in p))}: q ¥incin v}
	q1-->Stat1(*) ==> Stat2: {z in v | (FORALL p ¥incin v | nfaNeighbor_thryvar(p,q1) ¥imp (z in p))} ¥nincin v
	z-->Stat2(Stat2*) ==> Stat3: (z in {z in v | (FORALL p ¥incin v | nfaNeighbor_thryvar(p,q1) ¥imp (z in p))}) & (z notin v)
	()-->Stat3(Stat3*) ==> false
	Discharge ==> QED
--
Def nfa4: [regular language spanned by the automaton] nfaLang_thryvar := {w in Fin_seqs(a) | t * nfa_thryvar(w,s) /= 0}
--
-- In the special case in which the automaton is deterministic, in the
-- sense to be specified next, it becomes possible to characterize more
-- simply the transitions over strings and the language spanned by the
-- automaton. In this case, in fact, consumption of a string starting
-- with any specific state (typically the initial state) either
-- gets stuck in a state which, confronted with the scanned symbol,
-- does not enable transition, or leads to a single state.
--
Def nfa5: [characterization of determinism] Is_dfa_thryvar := (#s = 1) & Svm(d) & (domain(d) ¥incin (v ¥PROD a))
--
Theorem nfa6: [characterization of determinism, 1] ((#s = 1) & Svm(d) & (domain(d) ¥incin (v ¥PROD a))) ¥imp Is_dfa_thryvar. Proof:
Suppose_not ==> AUTO
	Use_def(Is_dfa_thryvar) ==> false
	Discharge ==> QED
--
Theorem nfa7: Is_dfa_thryvar ¥imp (nfaNeighbor_thryvar(P,Q) ¥eq (P incs Q)). Proof:
Suppose_not(p,q) ==> AUTO
	Use_def(nfaNeighbor_thryvar) ==> Stat1: {y: x in p, y in v - p | [[x,a],y] in d} /= 0
	(x0,y0)-->Stat1(Stat1*) ==> [[x0,a],y0] in d
	([x0,a],y)-->T9(Stat2*) ==> Stat2: car([[x0,a],y0]) = [x0,a]
	Use_def(Is_dfa_thryvar)(Stat2*) ==> domain(d) ¥incin (v ¥PROD a)
	([[x0,a],y0],d)-->T60(Stat1*) ==> Stat3: [x0,a] in (v ¥PROD a)
	(x0,a)-->T9(Stat4*) ==> Stat4: cdr([x0,a]) = a
	([x0,a],v,a)-->T140(Stat3*) ==> false
	Discharge ==> QED
--
Theorem nfa8: Is_dfa_thryvar ¥imp (((Q ¥incin v) ¥imp ((nfaEps_thryvar~[Q]) = Q)) & ((Q ¥nincin v) ¥imp ((nfaEps_thryvar~[Q]) = 0))). Proof:
Suppose_not(qp) ==> AUTO
	Suppose ==> nfaEps_thryvar /= {[q,q]: q ¥incin v}
		Use_def(nfaEps_thryvar) ==> Stat1: {[q,{z in v | (FORALL p ¥incin v | nfaNeighbor_thryvar(p,q) ¥imp (z in p))}]: q ¥incin v} /= {[q,q]: q ¥incin v}
		q0-->Stat1(Stat1*) ==> Stat2: (q0 ¥incin v) & ([q0,{z in v | (FORALL p ¥incin v | nfaNeighbor_thryvar(p,q0) ¥imp (z in p))}] /= [q0,q0])
		Suppose ==> {z in v | (FORALL p ¥incin v | nfaNeighbor_thryvar(p,q0) ¥imp (z in p))} = q0
			EQUAL(Stat2) ==> false
		Discharge ==> Stat3: {z in v | (FORALL p ¥incin v | nfaNeighbor_thryvar(p,q0) ¥imp (z in p))} /= q0
		y0-->Stat3(Stat3*) ==> (y0 in {z in v | (FORALL p ¥incin v | nfaNeighbor_thryvar(p,q0) ¥imp (z in p))}) ¥eq (y0 notin q0)
		Suppose ==> Stat4: y0 in {z in v | (FORALL p ¥incin v | nfaNeighbor_thryvar(p,q0) ¥imp (z in p))}
			()-->Stat4(Stat3*) ==> Stat5: (FORALL p ¥incin v | nfaNeighbor_thryvar(p,q0) ¥imp (y0 in p)) & (y0 notin q0)
			(q0,q0)-->Tnfa7(*) ==> Stat6: nfaNeighbor_thryvar(q0,q0)
			q0-->Stat5(Stat2,Stat5,Stat6*) ==> false
		Discharge ==> AUTO
		(Stat3*)ELEM ==> Stat7: (y0 notin {z in v | (FORALL p ¥incin v | nfaNeighbor_thryvar(p,q0) ¥imp (z in p))}) & (y0 in q0)
		y0-->Stat7(Stat7,Stat2*) ==> Stat8: not(FORALL p ¥incin v | nfaNeighbor_thryvar(p,q0) ¥imp (y0 in p))
		q1-->Stat8(Stat8*) ==> (nfaNeighbor_thryvar(q1,q0)) & (y0 notin q1)
		(q1,q0)-->Tnfa7(*) ==> q1 incs q0
	(Stat7*)Discharge ==> Stat9: nfaEps_thryvar = {[q,q]: q ¥incin v}
	TELEM ==> Is_map({[q,q]: q ¥incin v}) & (domain({[q,q]: q ¥incin v}) = {q: q ¥incin v})
	Suppose ==> Stat10: qp ¥nincin v
		Suppose ==> Stat11: qp in {q: q ¥incin v}
			q2-->Stat11(Stat10*) ==> false
		Discharge ==> qp notin {q: q ¥incin v}
		EQUAL(Stat9) ==> qp notin domain(nfaEps_thryvar)
		(qp,nfaEps_thryvar)-->T124(*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat12: qp notin {q: q ¥incin v}
		qp-->Stat12(Stat9*) ==> false
	Discharge ==> qp in {q: q ¥incin v}
	EQUAL(Stat9) ==> Stat13: Is_map(nfaEps_thryvar) & (qp in domain(nfaEps_thryvar))
	(nfaEps_thryvar,qp)-->T77(Stat9*) ==> Stat14: [qp,nfaEps_thryvar~[qp]] in {[q,q]: q ¥incin v}
	q3-->Stat14(*) ==> Stat15: ([qp,nfaEps_thryvar~[qp]] = [q3,q3]) & ((nfaEps_thryvar~[qp]) /= qp)
	(Stat15)ELEM ==> false
	Discharge ==> QED
--
Theorem nfa9: [characterization of determinism, 2] (Is_dfa_thryvar & (W in Fin_seqs(a))) ¥imp (#nfa_thryvar(W,{Y}) in 2). Proof:
Suppose_not(w,y0) ==> AUTO
--
-- Arguing by contradiction, assume that $w,y0$ form a counterexample to the claim of this
-- theorem. Since $w$ is finite, we can exploit finite induction to pick a $w0$ such that $w0,y0$
-- is a counterexample whose component $w0$ is inclusion-minimal.
--
	(w,a)-->T336(*) ==> Finite(w)
	APPLY(m1_thryvar:w0) finite_induction(n->w,P(X)->((X in Fin_seqs(a)) & (#nfa_thryvar(X,{y0}) notin 2))) ==>
		Stat1: ((w0 in Fin_seqs(a)) & (#nfa_thryvar(w0,{y0}) notin 2)) &
		(FORALL k ¥incin w0 | (k /= w0) ¥imp (not ((k in Fin_seqs(a)) & (#nfa_thryvar(k,{y0}) notin 2))))
--
-- By resorting to the standard characterization of the consumption of
-- a string by the automaton, we readily discard the possibility $w0=0$.
--
	(w0,a,{y0})-->Tnfa4(Stat1*) ==> nfa_thryvar(w0,{y0}) = (nfaEps_thryvar~[if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) end if]) --??
	TELEM ==> Stat2: (2 = {0,1}) & (1 = {0})
	Suppose ==> w0 = 0
		(Stat2*)ELEM ==> if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) end if = {y0}
--
-- (Even the case when $y0 notin v$ must be taken into account, and
-- causes a minor digression in this part of the proof.)
--
		({y0})-->Tnfa8(*) ==> ((y0 notin v) ¥imp ((nfaEps_thryvar~[{y0}]) = 0)) &
				((y0 in v) ¥imp ((nfaEps_thryvar~[{y0}]) = {y0}))
		Suppose ==> y0 notin v
			0-->T162(Stat2*) ==> (#0 = 0) & ((nfaEps_thryvar~[{y0}]) = 0)
			EQUAL(Stat1) ==> #nfa_thryvar(w0,{y0}) = 0
		(Stat1*)Discharge ==> AUTO
		y0-->T305(Stat2*) ==> (#{y0} = {0}) & ((nfaEps_thryvar~[{y0}]) = {y0})
		EQUAL(Stat1) ==> {0} notin {0,{0}}
	(Stat2*)Discharge ==> AUTO
--
-- But then, the induction hypothesis applies to $w0 ¥ON (#w0 ¥MINUS 1)$,
-- because this string is strictly included in $w0$.
--
	(Stat2*)ELEM ==> Stat3: if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) end if = nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))
	Use_def(nfa1_thryvar)(Stat3*) ==> if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) end if = {z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d}
	(w0,a)-->T336(Stat1,Stat1*) ==> (#w0 in Za) & (domain(w0) = #w0)
	Suppose ==> Stat4: (w0 ¥ON (#w0 ¥MINUS 1)) notin Fin_seqs(a)
		(w0,a,#w0 ¥MINUS 1)-->T346(Stat1,Stat4*) ==> (#w0 ¥MINUS 1) notin Za
		ALGEBRA(Stat3) ==> false
	Discharge ==> AUTO
	(w0,#w0 ¥MINUS 1)-->T48(Stat3*) ==> (w0 ¥ON (#w0 ¥MINUS 1)) ¥incin w0
	Suppose ==> w0 ¥ON (#w0 ¥MINUS 1) = w0
		(w0,#w0 ¥MINUS 1)-->T94(Stat3*) ==> domain(w0 ¥ON (#w0 ¥MINUS 1)) = domain(w0) * (#w0 ¥MINUS 1)
		EQUAL(Stat3) ==> Stat5: domain(w0) * (#w0 ¥MINUS 1) = #w0
		(#w0)-->T268(Stat5) ==> (#w0 ¥MINUS 1) incs (#w0 ¥MINUS 0)
		T211(Stat5*) ==> (0 in Za) & (1 in Za)
		w0-->T162(Stat2*) ==> #w0 /= 0
		w0-->T156(Stat5*) ==> Ord(#w0)
		T188(Stat5*) ==> Ord(0)
		(0,#w0)-->T31(Stat2*) ==> #w0 incs 1
		(1,#w0,0)-->T299(Stat2*) ==> false
	Discharge ==> AUTO
	(w0 ¥ON (#w0 ¥MINUS 1))-->Stat1(Stat2*) ==> Stat6: #nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}) in {0,1}
--
-- The case $nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}) = 0$ trivially leads to a contradiction, because in
-- this case no additional transition can take place after consumption of the initial part of the string.
--
	Suppose ==> #nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}) = 0
		(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))-->T162(Stat6*) ==> nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}) = 0
		Suppose ==> Stat7: {z: y in 0, z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d} /= 0
			(y1,z1)-->Stat7(Stat7*) ==> false
		Discharge ==> {z: y in 0, z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d} = 0
		EQUAL(Stat3) ==> if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) end if = 0
		Suppose ==> Stat8: 0 notin {q: q ¥incin v}
			0-->Stat8(Stat8*) ==> false
		Discharge ==> AUTO
		({[q,q]: q ¥incin v},0)-->T77(Stat2*) ==> Stat9: [0,{[q,q]: q ¥incin v}~[0]] in {[q,q]: q ¥incin v}
		q1-->Stat9(Stat9) ==> 0 = {[q,q]: q ¥incin v}~[0]
		EQUAL(Stat1) ==> false
	Discharge ==> Stat10: #nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}) = 1
	(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))-->T307(Stat10*) ==> Stat11: nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}) = {arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))}
	Suppose ==> Stat12: {z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d} ¥nincin {d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]}
		z0-->Stat12(Stat12*) ==> Stat13: (z0 in {z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d}) & (z0 /= d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]])
		(y2,z2)-->Stat13(Stat11*) ==> (y2 = arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))) & ([[y2,w0~[#w0 ¥MINUS 1]],z2] in d) & (z2 /= d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]])
		EQUAL(Stat13) ==> ([[y2,w0~[#w0 ¥MINUS 1]],z2] in d) & (z2 /= d~[[y2,w0~[#w0 ¥MINUS 1]]])
		Use_def(Is_dfa_thryvar)(*) ==> Svm(d)
		([y2,w0~[#w0 ¥MINUS 1]],z2)-->T9(Stat13*) ==> (car([[y2,w0~[#w0 ¥MINUS 1]],z2]) = [y2,w0~[#w0 ¥MINUS 1]]) &  (cdr([[y2,w0~[#w0 ¥MINUS 1]],z2]) = z2)
		(d,[[y2,w0~[#w0 ¥MINUS 1]],z2])-->T74(Stat13*) ==> (d~[car([[y2,w0~[#w0 ¥MINUS 1]],z2])]) = z2
		EQUAL(Stat13) ==> false
	Discharge ==> AUTO
	(d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]],{z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d})-->T306(Stat11*) ==> Stat14:
			#{z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d} in 2
	Suppose ==> Stat15: {z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d} ¥nincin v
		zp-->Stat15(Stat15*) ==> Stat16: (zp in {z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d}) & (zp notin v)
		(y3,z3)-->Stat16(Stat16*) ==> false
	Discharge ==> AUTO
	({z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d})-->Tnfa8(*) ==>
			(nfaEps_thryvar~[{z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d}]) = {z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d}
	EQUAL(Stat1) ==> false
	Discharge ==> QED
--
Theorem nfa10: [deterministic consumption of a string over the alphabet, 3] (Is_dfa_thryvar & (W in Fin_seqs(a)) & (Y in v)) ¥imp
	(nfa_thryvar(W,{Y}) = if W = 0 then {Y}
	elseif nfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y}) = 0 then 0
	elseif [arb(nfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y})),W~[#W ¥MINUS 1]] notin domain(d) then 0
	else {d~[[arb(nfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y})),W~[#W ¥MINUS 1]]]} end if). Proof:
Suppose_not(w0,y0) ==> AUTO
--
-- For, assuming the contrary, we reach a contradiction by arguing as follows.
--
	(w0,a,{y0})-->Tnfa4(*) ==> Stat1: (nfa_thryvar(w0,{y0}) = (nfaEps_thryvar~[if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) end if])) & Is_dfa_thryvar & (y0 in v) --??
--
-- As a preliminary, let us observe that the application of $nfaEps_thryvar$ can be simplified off
-- from the definition of $nfa_thryvar(w0,{y0})$ thanks to the determinism hypothesis.
--
	Suppose ==> (nfaEps_thryvar~[if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) end if]) /= if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) end if
		(if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) end if)-->Tnfa8(Stat1*) ==> if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) end if ¥nincin v
		Suppose ==> w0 = 0
		(Stat1*)ELEM ==> false; Discharge ==> AUTO
		(Stat1*)ELEM ==> nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) ¥nincin v
		Use_def(nfa1_thryvar) ==> Stat2: {z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d} ¥nincin v
		zp-->Stat2(Stat2*) ==> Stat3: (zp in {z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d}) & (zp notin v)
		(yq,zq)-->Stat3(Stat3*) ==> false
	Discharge ==> (nfaEps_thryvar~[if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) end if]) = if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) end if
--
-- One by one, we will examine all branches of the if_then_else expression appearing as right-hand side
-- of the inequality assumed initially, to see that each of them leads to a contradiction.
--
	Suppose ==> Stat4: w0 = 0
		ELEM ==> false
	Discharge ==> Stat5: w0 /= 0
	(Stat5*)ELEM ==> if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) end if = nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))
	EQUAL ==> Stat6: (nfa_thryvar(w0,{y0}) = nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))) &
		Is_dfa_thryvar & (y0 in v) & (w0 in Fin_seqs(a)) &
		(nfa_thryvar(w0,{y0}) /= if w0 = 0 then {y0}
	elseif nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}) = 0 then 0
	elseif [arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]] notin domain(d) then 0
	else {d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]} end if)
	Suppose ==> nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}) = 0
		(Stat5*)ELEM ==> nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) /= 0
		EQUAL(Stat6) ==> Stat7: nfa1_thryvar(w0~[#w0 ¥MINUS 1],0) /= 0
		Use_def(nfa1_thryvar(w0~[#w0 ¥MINUS 1],0)) ==> AUTO
		z0-->Stat7(Stat7*) ==> Stat8: z0 in {z: y in 0, z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d}
		z1-->Stat8(Stat8*) ==> false
	Discharge ==> AUTO
	Suppose ==> (w0 ¥ON (#w0 ¥MINUS 1)) notin Fin_seqs(a)
		(w0,a)-->T336(Stat6*) ==> (#w0 in Za) & (domain(w0) = #w0)
		(w0,a,#w0 ¥MINUS 1)-->T346(Stat6*) ==> (#w0 ¥MINUS 1) notin Za
		ALGEBRA(Stat6) ==> false
	Discharge ==> AUTO
	TELEM ==> 2 = {0,1}
	(w0 ¥ON (#w0 ¥MINUS 1),a,y0)-->Tnfa9(Stat6*) ==> Stat9: #nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}) in {0,1} --??
	(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))-->T307 ==> AUTO
	Suppose ==> Stat10: [arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]] notin domain(d)
		(Stat5*)ELEM ==> nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) /= 0
		Use_def(nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))) ==> AUTO
		EQUAL(Stat6) ==> Stat11: {z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d} /= 0
		(y3,z3)-->Stat11(Stat11*) ==> (y3 in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) & ([[y3,w0~[#w0 ¥MINUS 1]],z3] in d)
		(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))-->T162(Stat6*) ==> y3 = arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))
		EQUAL(Stat11) ==> [[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],z3] in d
		([arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],z3)-->T9(Stat11*) ==> car([[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],z3]) = [arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]
		([[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],z3],d)-->T60(Stat10*) ==> false
	Discharge ==> AUTO
	(Stat5*)ELEM ==> Stat12: nfa1_thryvar(w0~[#w0 ¥MINUS 1],nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})) /= {d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]}
	Use_def(nfa1_thryvar)(Stat12*) ==> {z: y in nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}), z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d} /= {d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]}
	(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))-->T162(Stat5*) ==> nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}) = {arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))}
	EQUAL ==> Stat13: {z: y in {arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0}))}, z in v | [[y,w0~[#w0 ¥MINUS 1]],z] in d} /= {d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]}
	SIMPLF(Stat13*) ==> {z in v | [[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],z] in d} /= {d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]}
	Use_def(Is_dfa_thryvar)(Stat6,Stat6*) ==> Svm(d)
	Use_def(Svm)(Stat13*) ==> Is_map(d)
	(d,[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]])-->T77(Stat9*) ==> [[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]] in d
	Suppose ==> Stat14: (d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]) notin {z in v | [[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],z] in d}
		Assump ==> d ¥incin ((v ¥PROD next(a)) ¥PROD v)
		([arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]])-->T9(Stat14*) ==> cdr([[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]]) = (d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]])
		([[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]],v ¥PROD next(a),v)-->T140(Stat13*) ==> (d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]) in v
		(d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]])-->Stat14(Stat13*) ==> false
	Discharge ==> AUTO
	(Stat13*)ELEM ==> Stat15: {z in v | [[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],z] in d} ¥nincin {d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]}
	z2-->Stat15(Stat15*) ==> Stat16: (z2 in {z in v | [[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],z] in d}) & (z2 /= (d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]))
	()-->Stat16(Stat16*) ==> (z2 in v) & ([[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],z2] in d)
	Use_def(Svm)(Stat13*) ==> Stat17: (FORALL x in d, y in d | (car(x) = car(y)) ¥imp (x = y))
	([arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]])-->T9(Stat17*) ==> car([[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]]) = [arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]
	([arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],z2)-->T9(Stat17*) ==> car([[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],z2]) = [arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]
	([[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]],[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],z2])-->Stat17(Stat13*) ==> Stat18: [[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]]=[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]],z2]
	(Stat18)ELEM ==> Stat19: (d~[[arb(nfa_thryvar(w0 ¥ON (#w0 ¥MINUS 1),{y0})),w0~[#w0 ¥MINUS 1]]]) = z2
	(Stat19,Stat16*)ELEM ==> false
	Discharge ==> QED
--
Theorem nfa11: [language accepted by a deterministic automaton] Is_dfa_thryvar ¥imp (nfaLang_thryvar = {z in Fin_seqs(a) | (#nfa_thryvar(z,s) = 1) & (nfa_thryvar(z,s) ¥incin t)}). Proof:
Suppose_not ==> AUTO
	Use_def(nfaLang_thryvar) ==> Stat1: {w: w in Fin_seqs(a) | t * nfa_thryvar(w,s) /= 0} /= {w: w in Fin_seqs(a) | (#nfa_thryvar(w,s) = 1) & (nfa_thryvar(w,s) ¥incin t)}
	w0-->Stat1(*) ==> Stat2: (w0 in Fin_seqs(a)) & ((t * nfa_thryvar(w0,s) /= 0) ¥neq ((#nfa_thryvar(w0,s) = 1) & (nfa_thryvar(w0,s) ¥incin t))) & Is_dfa_thryvar
	(w0,a,arb(s))-->Tnfa9(Stat2*) ==> Stat3: #nfa_thryvar(w0,{arb(s)}) in 2 --??
	Use_def(Is_dfa_thryvar)(Stat2*) ==> #s = 1
	s-->T307(Stat2*) ==> s = {arb(s)}
	TELEM ==> 2 = {0,1}
	EQUAL(Stat3) ==> Stat4: #nfa_thryvar(w0,s) in {0,1}
	Suppose ==> Stat5: #nfa_thryvar(w0,s) /= 1
		(nfa_thryvar(w0,s))-->T162(Stat4*) ==> Stat6: nfa_thryvar(w0,s) = 0
		(Stat2,Stat5,Stat6*)ELEM ==> false
	Discharge ==> Stat7: #nfa_thryvar(w0,s) = 1
	(nfa_thryvar(w0,s))-->T307(Stat4*) ==> Stat8: nfa_thryvar(w0,s) = {arb(nfa_thryvar(w0,s))}
	(Stat2,Stat7,Stat8*)ELEM ==> false
	Discharge ==> QED
--
-- In sight of a bootstrap of the current theory of a
-- non-deterministic finite state automaton, we characterize
-- the associated deterministic finite state automaton.
--
Def nfa6: [states of associated deterministic automaton] dfaStates_thryvar := {nfaEps_thryvar~[q]: q ¥incin v}
--
Def nfa7: [start states of associated deterministic automaton] dfaStart_thryvar := nfaEps_thryvar~[s]
--
Def nfa8: [accepting states of associated deterministic automaton] dfaAccept_thryvar := {q in dfaStates_thryvar | t * q /= 0}
--
Def nfa9: [transition function of associated deterministic automaton] dfaTrans_thryvar := {[[q,c],nfaEps_thryvar~[nfa1_thryvar(c,q)]]: q in dfaStates_thryvar, c in a}
--
-- The following theorem, preparatory to the self-application of this theory, does not include
-- the claims $a /= 0$ and $Finite(a)$, because these will be inherited assumptions.
--
Theorem nfa12: [preparation for self-application of this THEORY]
	(({dfaStart_thryvar} + dfaAccept_thryvar) ¥incin dfaStates_thryvar) & Finite(dfaStates_thryvar) &
	(dfaTrans_thryvar ¥incin ((dfaStates_thryvar ¥PROD next(a)) ¥PROD dfaStates_thryvar)) &
	Svm(dfaTrans_thryvar) & (domain(dfaTrans_thryvar) ¥incin (dfaStates_thryvar ¥PROD a)) &
	(range(dfaTrans_thryvar) ¥incin dfaStates_thryvar). Proof:
Suppose_not ==> AUTO
	Assump ==> Stat1: s ¥incin v
	Use_def(dfaStates_thryvar) ==> Stat3: dfaStates_thryvar = {nfaEps_thryvar~[q]: q ¥incin v}
	Suppose ==> dfaStart_thryvar notin dfaStates_thryvar
		Use_def(dfaStart_thryvar) ==> Stat4: nfaEps_thryvar~[s] notin {nfaEps_thryvar~[q]: q ¥incin v}
		s-->Stat4(Stat1*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat5: dfaAccept_thryvar ¥nincin dfaStates_thryvar
		Use_def(dfaAccept_thryvar) ==> Stat6: {q in dfaStates_thryvar | t * q /= 0} ¥nincin dfaStates_thryvar
		q1-->Stat6(Stat6*) ==> Stat7: (q1 in {q in dfaStates_thryvar | t * q /= 0}) & (q1 notin dfaStates_thryvar)
		()-->Stat7(Stat7*) ==> false
	Discharge ==> AUTO
	TELEM ==> Svm({[[q,c],nfaEps_thryvar~[nfa1_thryvar(c,q)]]: q in dfaStates_thryvar, c in a})
	TELEM ==> domain({[[q,c],nfaEps_thryvar~[nfa1_thryvar(c,q)]]: q in dfaStates_thryvar, c in a}) = {[q,c]: q in dfaStates_thryvar, c in a}
	TELEM ==> range({[[q,c],nfaEps_thryvar~[nfa1_thryvar(c,q)]]: q in dfaStates_thryvar, c in a}) = {nfaEps_thryvar~[nfa1_thryvar(c,q)]: q in dfaStates_thryvar, c in a}
	Use_def(dfaTrans_thryvar) ==> Stat8: Svm(dfaTrans_thryvar) & (domain(dfaTrans_thryvar) ¥incin {[q,c]: q in dfaStates_thryvar, c in a}) & (range(dfaTrans_thryvar) = {nfaEps_thryvar~[nfa1_thryvar(c,q)]: q in dfaStates_thryvar, c in a})
	Use_def(¥PROD) ==> domain(dfaTrans_thryvar) ¥incin (dfaStates_thryvar ¥PROD a)
	Suppose ==> range(dfaTrans_thryvar) ¥nincin dfaStates_thryvar
		EQUAL(Stat8) ==> Stat9: {nfaEps_thryvar~[nfa1_thryvar(c,q)]: q in dfaStates_thryvar, c in a} ¥nincin dfaStates_thryvar
		y2-->Stat9(Stat9*) ==> Stat10: (y2 in  {nfaEps_thryvar~[nfa1_thryvar(c,q)]: q in dfaStates_thryvar, c in a}) & (y2 notin dfaStates_thryvar)
--
--?? With context (Stat1*), the following step would fail:
--
		(q2,c2)-->Stat10(Stat10,Stat3*) ==> Stat11: (nfaEps_thryvar~[nfa1_thryvar(c2,q2)]) notin {nfaEps_thryvar~[q]: q ¥incin v}
		(nfa1_thryvar(c2,q2))-->Stat11(Stat11*) ==> Stat12: nfa1_thryvar(c2,q2) ¥nincin v
		Use_def(nfa1_thryvar)(Stat12*) ==> Stat13: {z: y in q2, z in v | [[y,c2],z] in d} ¥nincin v
		z2-->Stat13(Stat13*) ==> Stat14: (z2 in {z: y in q2, z in v | [[y,c2],z] in d}) & (z2 notin v)
		(y3,z3)-->Stat14(Stat14*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat15: dfaTrans_thryvar ¥nincin ((dfaStates_thryvar ¥PROD next(a)) ¥PROD dfaStates_thryvar)
		Use_def(Svm)(Stat8,Stat8*) ==> Is_map(dfaTrans_thryvar)
		Use_def(next)(Stat15*) ==> a ¥incin next(a)
		(dfaStates_thryvar,dfaStates_thryvar,a,next(a))-->T256(Stat8*) ==> domain(dfaTrans_thryvar) ¥incin (dfaStates_thryvar ¥PROD next(a))
		(dfaTrans_thryvar,dfaStates_thryvar ¥PROD next(a),dfaStates_thryvar)-->T141(Stat8*) ==> false
	Discharge ==> Stat16: (not Finite(dfaStates_thryvar))
	Assump ==> Finite(v)
	v-->T264(Stat16*) ==> Finite(pow(v))
	APPLY() finite_image(e(X)->(nfaEps_thryvar~[X]),s0->(pow(v))) ==> Finite({nfaEps_thryvar~[q]: q in pow(v)})
	Suppose ==> Stat17: {nfaEps_thryvar~[q]: q in pow(v)} /= {nfaEps_thryvar~[q]: q ¥incin v}
		q3-->Stat17(Stat17*) ==> (q3 in {nfaEps_thryvar~[q]: q in pow(v)}) ¥eq (q3 notin {nfaEps_thryvar~[q]: q ¥incin v})
		Use_def(pow)(Stat17*) ==> Stat18: pow(v) = {q: q ¥incin v}
		Suppose ==> Stat19: (q3 in {nfaEps_thryvar~[q]: q in pow(v)}) & (q3 notin {nfaEps_thryvar~[q]: q ¥incin v})
			(q4,q4)-->Stat19(Stat18*) ==> Stat20: (q4 in {q: q ¥incin v}) & (q4 ¥nincin v)
			q5-->Stat20(Stat20*) ==> false
		Discharge ==> AUTO
		(Stat17*)ELEM ==> Stat21: (q3 in {nfaEps_thryvar~[q]: q ¥incin v}) & (q3 notin {nfaEps_thryvar~[q]: q in pow(v)})
		(q6,q6)-->Stat21(Stat18*) ==> Stat22: (q6 notin {q: q ¥incin v}) & (q6 ¥incin v)
		q6-->Stat22(Stat22*) ==> false
	Discharge ==> {nfaEps_thryvar~[q]: q in pow(v)} = {nfaEps_thryvar~[q]: q ¥incin v}
	EQUAL(Stat3) ==> false
	Discharge ==> QED
--
APPLY(nfa_thryvar:dfa_thryvar,nfaLang_thryvar:dfaLang_thryvar,Is_dfa_thryvar:Js_dfa_thryvar) nfa(a->a,v->dfaStates_thryvar,s->{dfaStart_thryvar},t->dfaAccept_thryvar,d->dfaTrans_thryvar) ==>
Theorem nfa13: Finite(dfaTrans_thryvar) &
	(((#{dfaStart_thryvar} = 1) & Svm(dfaTrans_thryvar) & (domain(dfaTrans_thryvar) ¥incin (dfaStates_thryvar ¥PROD a))) ¥imp Js_dfa_thryvar) &
	(FORALL w, y | (Js_dfa_thryvar & (w in Fin_seqs(a))) ¥imp (#dfa_thryvar(w,{y}) in 2)) &
	(FORALL w, y | (Js_dfa_thryvar & (w in Fin_seqs(a)) & (y in dfaStates_thryvar)) ¥imp
		(dfa_thryvar(w,{y}) = if w = 0 then {y}
		elseif dfa_thryvar(w ¥ON (#w ¥MINUS 1),{y}) = 0 then 0
		elseif [arb(dfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y})),W~[#W ¥MINUS 1]] notin domain(dfaTrans_thryvar) then 0
		else {dfaTrans_thryvar~[[arb(dfa_thryvar(w ¥ON (#w ¥MINUS 1),{y})),w~[#w ¥MINUS 1]]]} end if)) &
	(Js_dfa_thryvar  ¥imp (dfaLang_thryvar =
		{z in Fin_seqs(a) | (#dfa_thryvar(z,{dfaStart_thryvar}) = 1) & (dfa_thryvar(z,{dfaStart_thryvar}) ¥incin dfaAccept_thryvar)}))
--
Theorem nfa14: Js_dfa_thryvar. Proof:
Suppose_not ==> AUTO
	Tnfa13(*) ==> Stat1: not((#{dfaStart_thryvar} = 1) & Svm(dfaTrans_thryvar) & (domain(dfaTrans_thryvar) ¥incin (dfaStates_thryvar ¥PROD a)))
	TELEM ==> 1 = {0}
	(dfaStart_thryvar)-->T305(Stat1*) ==> #{dfaStart_thryvar} = 1
	TELEM ==> Svm({[[q,c],nfaEps_thryvar(nfa1_thryvar(c,q))]: q in dfaStates_thryvar, c in a})
	Use_def(dfaTrans_thryvar) ==> Svm(dfaTrans_thryvar)
	TELEM ==> domain({[[q,c],nfaEps_thryvar(nfa1_thryvar(c,q))]: q in dfaStates_thryvar, c in a}) = {[q,c]: q in dfaStates_thryvar, c in a}
	Use_def(dfaTrans_thryvar) ==> domain(dfaTrans_thryvar) = {[q,c]: q in dfaStates_thryvar, c in a}
	Use_def(¥PROD) ==> domain(dfaTrans_thryvar) = dfaStates_thryvar ¥PROD a
	Discharge ==> QED
--
Theorem nfa15: (W in Fin_seqs(a)) ¥imp (#dfa_thryvar(W,{Y}) in 2). Proof:
Suppose_not(w,y) ==> AUTO
	Tnfa13(*) ==> Stat1: (FORALL w, y | (Js_dfa_thryvar & (w in Fin_seqs(a))) ¥imp (#dfa_thryvar(w,{y}) in 2))
	Tnfa14 ==> Js_dfa_thryvar
	(w,y)-->Stat1(*) ==> false
	Discharge ==> QED
--
--
Theorem nfa16: ((W in Fin_seqs(a)) & (Y in dfaStates_thryvar)) ¥imp (dfa_thryvar(W,{Y}) = if W = 0 then {Y}
		elseif dfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y}) = 0 then 0
		elseif [arb(dfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y})),W~[#W ¥MINUS 1]] notin domain(dfaTrans_thryvar) then 0
		else {dfaTrans_thryvar~[[arb(dfa_thryvar(W ¥ON (#W ¥MINUS 1),{Y})),W~[#W ¥MINUS 1]]]} end if). Proof:
Suppose_not(w,y) ==> AUTO
	Tnfa13(*) ==> Stat1: (FORALL w, y | (Js_dfa_thryvar & (w in Fin_seqs(a)) & (y in dfaStates_thryvar)) ¥imp
		(dfa_thryvar(w,{y}) = if w = 0 then {y}
		elseif dfa_thryvar(w ¥ON (#w ¥MINUS 1),{y}) = 0 then 0
		elseif [arb(dfa_thryvar(w ¥ON (#w ¥MINUS 1),{y})),w~[#w ¥MINUS 1]] notin domain(dfaTrans_thryvar) then 0
		else {dfaTrans_thryvar~[[arb(dfa_thryvar(w ¥ON (#w ¥MINUS 1),{y})),w~[#w ¥MINUS 1]]]} end if))
	Tnfa14 ==> Js_dfa_thryvar
	(w,y)-->Stat1(*) ==> false
	Discharge ==> QED
--
Theorem nfa17: dfaLang_thryvar = {z in Fin_seqs(a) | (#dfa_thryvar(z,{dfaStart_thryvar}) = 1) & (dfa_thryvar(z,{dfaStart_thryvar}) ¥incin dfaAccept_thryvar)}. Proof:
Suppose_not ==> AUTO
	Tnfa14 ==> Js_dfa_thryvar
	Tnfa13 ==> false
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- A nondeterministic finite automaton is
-- characterized by its alphabet $a$,
-- its set $v$ of states, among which the start
-- states $s$ and the accepting states $t$,
-- and by its transition relation $d$.
-- As a convenient trick, the entire alphabet is used
-- as the label for free (or 'in-place') transitions.
--
-- DISPLAY nfa
--
-- THEORY nfa(a,v,s,t,d)
--
--	(a /= 0) & Finite(a)
--	((s + t) ¥incin v) & Finite(v)
--	d ¥incin ((v ¥PROD next(a)) ¥PROD v)
-- ==>(nfaNeighbor_thryvar,nfaEps_thryvar,nfa1_thryvar,nfa_thryvar,nfaLang_thryvar,Is_dfa_thryvar,dfaStates_thryvar,dfaStart_thryvar,dfaAccept_thryvar,dfaTrans_thryvar,dfa_thryvar,dfaLang_thryvar)
--	Finite(d)
--	(FORALL p,q | nfaNeighbor_thryvar(p,q) ¥eq ((p incs q) & ({y: x in p, y in v - p | [[x,a],y] in d} = 0)))
--	(nfaEps_thryvar = {[q,{z in v | (FORALL p ¥incin v | nfaNeighbor_thryvar(p,q) ¥imp (z in p))}]: q ¥incin v})
--	(FORALL c,q | nfa1_thryvar(c,q) = {z: y in q, z in v | [[y,c],z] in d})
--	(FORALL w | ((w ¥incin Fin_seqs(a)) & (w /= 0)) ¥imp (EXISTS m in w | (FORALL y in w | not((y ¥incin m) & (y /= m)))))
--	(FORALL w | (w in Fin_seqs(a)) ¥imp (nfa_thryvar(w,q) = (nfaEps_thryvar~[if w = 0 then q else nfa1_thryvar(w~[#w ¥MINUS 1],nfa_thryvar(w ¥ON (#w ¥MINUS 1),q)) end if])))
--	(FORALL w, q | (w in Fin_seqs(a)) ¥imp (nfa_thryvar(w,q) ¥incin v))
--	(nfaLang_thryvar = {w in Fin_seqs(a) | t * nfa_thryvar(w,s) /= 0})
--	(Is_dfa_thryvar ¥eq ((#s = 1) & Svm(d) & (domain(d) ¥incin (v ¥PROD a))))
--	(FORALL p, q | Is_dfa_thryvar ¥imp (nfaNeighbor_thryvar(p,q) ¥eq (p incs q)))
--	(FORALL q | Is_dfa_thryvar ¥imp (((q ¥incin v) ¥imp ((nfaEps_thryvar~[q]) = q)) & ((q ¥nincin v) ¥imp ((nfaEps_thryvar~[q]) = 0))))
--	(FORALL w, y | (Is_dfa_thryvar & (w in Fin_seqs(a))) ¥imp (#nfa_thryvar(w,{y}) in 2))
--	Is_dfa_thryvar ¥imp (nfaLang_thryvar = {z in Fin_seqs(a) | (#nfa_thryvar(z,s) = 1) & (nfa_thryvar(z,s) ¥incin t)})
--	(dfaStates_thryvar = {nfaEps_thryvar~[q]: q ¥incin v})
--	(dfaStart_thryvar = (nfaEps_thryvar~[s]))
--	(dfaAccept_thryvar = {q in dfaStates_thryvar | t * q /= 0})
--	(dfaTrans_thryvar = {[[q,c],nfaEps_thryvar(nfa1_thryvar(c,q))]: q in dfaStates_thryvar, c in a})
--	Finite(dfaTrans_thryvar)
--	(FORALL w, y | (w in Fin_seqs(a)) ¥imp (#dfa_thryvar(w,{y}) in 2))
--	(FORALL w, y | ((w in Fin_seqs(a)) & (y in dfaStates_thryvar)) ¥imp (dfa_thryvar(w,{y}) = if w = 0 then {y} elseif dfa_thryvar(w ¥ON (#w ¥MINUS 1),{y}) = 0 then 0 elseif [arb(dfa_thryvar(w ¥ON (#w ¥MINUS 1),{y})),w~[#w ¥MINUS 1]] notin domain(dfaTrans_thryvar) then 0 else {dfaTrans_thryvar~[[arb(dfa_thryvar(w ¥ON (#w ¥MINUS 1),{y})),w~[#w ¥MINUS 1]]]} end if))
--	dfaLang_thryvar = {z in Fin_seqs(a) | (#dfa_thryvar(z,{dfaStart_thryvar}) = 1) & (dfa_thryvar(z,{dfaStart_thryvar}) ¥incin dfaAccept_thryvar)}
-- END nfa
--
-- ************************************************************************************************
--			Section 19: Mostowski collapse, infinite spirals
-- ************************************************************************************************
--
--
THEORY collapse(W(X))
END collapse
--
ENTER_THEORY collapse
--
Def collapse1: Mostowski_thryvar(X) := {Mostowski_thryvar(y): y in X | W(y)}
--
Theorem collapse1: (W(C) & W(D) & (D in C)) ¥imp (Mostowski_thryvar(D) in Mostowski_thryvar(C)). Proof:
Suppose_not(c,cp) ==> AUTO
	Use_def(Mostowski_thryvar(c)) ==> AUTO
	ELEM ==> Stat1: Mostowski_thryvar(cp) notin {Mostowski_thryvar(y): y in c | W(y)}
	cp-->Stat1(*) ==> false
	Discharge ==> QED
--
Theorem collapse2: ((FORALL c, cp | (W(c) & W(cp) & (Mostowski_thryvar(cp) = Mostowski_thryvar(c))) ¥imp (cp = c) ) &
		W(C) & W(D)) ¥imp ((Mostowski_thryvar(D) in Mostowski_thryvar(C)) ¥eq (D in C)). Proof:
Suppose_not(c0,d0) ==> AUTO
--
-- Reasoning by contradiction, we argue as follows. Suppose $c0,d0$ are
-- a counterexample to the claim of this theorem. Then, taking
-- Theorem collapse1 into account, we know that since the equivalence
--	$(Mostowski_thryvar(d0) in Mostowski_thryvar(c0)) ¥eq (d0 in c0)$
-- must be false, its direct implication that fails. And hence
--	$(Mostowski_thryvar(d0) in Mostowski_thryvar(c0)) & (d0 notin c0)$
--
	ELEM ==> Stat1: (FORALL c, cp | (W(c) & W(cp) & (Mostowski_thryvar(cp) = Mostowski_thryvar(c))) ¥imp (cp = c) )
	(c0,d0)-->Tcollapse1(*) ==> Stat2: W(c0) & W(d0) & (Mostowski_thryvar(d0) in Mostowski_thryvar(c0)) & (d0 notin c0)
--
-- By the definition of $Mostowski_thryvar(c0)$, some element $y0$ of
-- $c0$ must be such that $W(y0)$ and
-- $Mostowski_thryvar(d0) = Mostowski_thryvar(y0)$ both hold.
--
	Use_def(Mostowski_thryvar(c0)) ==> AUTO
	(Stat2*)ELEM ==> Stat3: Mostowski_thryvar(d0) in {Mostowski_thryvar(y): y in c0 | W(y)}
	y0-->Stat3(Stat3*) ==> (Mostowski_thryvar(d0) = Mostowski_thryvar(y0)) & (y0 in c0) & W(y0)
--
-- However, by the injectivity hypothesis, this implies that $y0=d0$,
-- conflicting with the supposed fact $d0 notin c0$.
--
	(d0,y0)-->Stat1(Stat2*) ==> false
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- DISPLAY collapse
--
-- THEORY collapse(W(X))
-- ==>(Mostowski_thryvar)
--	(FORALL c, cp | (W(c) & W(cp) & (cp in c)) ¥imp (Mostowski_thryvar(cp) in Mostowski_thryvar(c)))
--	(FORALL c, d | ((FORALL c, cp | (W(c) & W(cp) & (Mostowski_thryvar(cp) = Mostowski_thryvar(c))) ¥imp
--			(cp = c) ) &
--			W(c) & W(d)) ¥imp ((Mostowski_thryvar(d) in Mostowski_thryvar(c)) ¥eq (d in c)))
-- END collapse
--
--
--
THEORY mutual_climbing
END mutual_climbing
--
ENTER_THEORY mutual_climbing
--
Def 10011: om_thryvar(I) := [{cdr(om_thryvar(k)): k in I}, {car(om_thryvar(k)): k in I} + { {cdr(om_thryvar(k)): k in I} }]
Def 10012: om1_thryvar := {cdr(om_thryvar(k)): k in Za}
Def 10013: om2_thryvar := {car(om_thryvar(k)): k in Za}
--
Theorem mutual_climbing1: (Ord(I) & Ord(J)) ¥imp (car(om_thryvar(I)) /= cdr(om_thryvar(J))). Proof:
Suppose_not(i,j) ==> Stat1: Ord(i) & Ord(j) & (car(om_thryvar(i)) = cdr(om_thryvar(j)))
	TELEM ==> Stat2: true
	Use_def(om_thryvar)(Stat2,Stat2*) ==> Stat3: om_thryvar(j) = [{ cdr(om_thryvar(k)): k in j },
		({ car(om_thryvar(k)): k in j } + {{ cdr(om_thryvar(k)): k in j }})]
	Use_def(om_thryvar)(Stat2,Stat2*) ==> Stat4: om_thryvar(i) = [{ cdr(om_thryvar(k)): k in i },
		({ car(om_thryvar(k)): k in i } + {{ cdr(om_thryvar(k)): k in i }})]
	(Stat3,Stat3)ELEM ==> Stat5: (car(om_thryvar(j)) = { cdr(om_thryvar(k)): k in j })
	(Stat3,Stat3)ELEM ==> Stat6: (cdr(om_thryvar(j)) = ({ car(om_thryvar(k)): k in j } + {{ cdr(om_thryvar(k)): k in j }}))
	(Stat4,Stat4)ELEM ==> Stat7: car(om_thryvar(i)) = { cdr(om_thryvar(k)): k in i }
	(Stat1,Stat5,Stat6,Stat7*)ELEM ==> Stat8: (car(om_thryvar(i)) /= car(om_thryvar(j))) &
		Stat9: (car(om_thryvar(i)) notin { car(om_thryvar(k)): k in j }) &
		Stat10: (cdr(om_thryvar(j)) notin { cdr(om_thryvar(k)): k in i })
	Suppose ==> i = j
	EQUAL(Stat8*) ==> false; Discharge ==> Stat11: i /= j
	i-->Stat9(Stat8,Stat8*) ==> i notin j
	j-->Stat10(Stat8,Stat8*) ==> j notin i
	(Stat1,Stat1*)ELEM ==> Ord(i) & Ord(j)
(i,j)-->T31(Stat11*) ==> false; Discharge ==> QED
--
Theorem mutual_climbing2: (Ord(I) & Ord(J) & (I /= J)) ¥imp ((car(om_thryvar(I)) /= car(om_thryvar(J))) &
		(cdr(om_thryvar(I)) /= cdr(om_thryvar(J)))). Proof:
Suppose_not(i,j) ==> Stat1: Ord(i) & Ord(j) & (i /= j) & ((car(om_thryvar(i)) = car(om_thryvar(j))) or
		(cdr(om_thryvar(i)) = cdr(om_thryvar(j))))
--
-- Reasoning by contradiction, assume that $i,j$ are a counterexample
-- to the asserted statement.
--
	TELEM ==> Stat2: true
	Use_def(om_thryvar)(Stat2,Stat2*) ==> Stat3: om_thryvar(j) = [{ cdr(om_thryvar(k)): k in j },
		({ car(om_thryvar(k)): k in j } + {{ cdr(om_thryvar(k)): k in j }})]
	Use_def(om_thryvar)(Stat2,Stat2*) ==> Stat4: om_thryvar(i) = [{ cdr(om_thryvar(k)): k in i },
		({ car(om_thryvar(k)): k in i } + {{ cdr(om_thryvar(k)): k in i }})]
	(Stat3,Stat3)ELEM ==> Stat5: (car(om_thryvar(j)) = { cdr(om_thryvar(k)): k in j })
	(Stat3,Stat3)ELEM ==> Stat6: (cdr(om_thryvar(j)) = ({ car(om_thryvar(k)): k in j } + {{ cdr(om_thryvar(k)): k in j }}))
	(Stat4,Stat4)ELEM ==> Stat7: car(om_thryvar(i)) = { cdr(om_thryvar(k)): k in i }
	(Stat4,Stat4)ELEM ==> Stat8: (cdr(om_thryvar(i)) = ({ car(om_thryvar(k)): k in i } + {{ cdr(om_thryvar(k)): k in i }}))
	(Stat5,Stat6,Stat7,Stat8*)ELEM ==> Stat9: (car(om_thryvar(i)) in cdr(om_thryvar(i))) & (car(om_thryvar(j)) in cdr(om_thryvar(j)))
--
-- We can easily prove that $i notin j$.
--
	Suppose ==> Stat10: i in j
		Suppose ==> cdr(om_thryvar(i)) notin car(om_thryvar(j))
			EQUAL(Stat2*) ==> Stat11: cdr(om_thryvar(i)) notin { cdr(om_thryvar(k)): k in j }
		i-->Stat11(Stat10*) ==> false; Discharge ==> Stat12: cdr(om_thryvar(i)) in car(om_thryvar(j))
	(Stat9,Stat12,Stat1*)ELEM ==> false; Discharge ==> Stat13: i notin j
--
-- The proof that $j notin i$ is entirely analogous.
--
	Suppose ==> Stat14: j in i
		Suppose ==> cdr(om_thryvar(j)) notin car(om_thryvar(i))
			EQUAL(Stat2*) ==> Stat15: cdr(om_thryvar(j)) notin { cdr(om_thryvar(k)): k in i }
		j-->Stat15(Stat14*) ==> false; Discharge ==> Stat16: cdr(om_thryvar(j)) in car(om_thryvar(i))
	(Stat9,Stat16,Stat1*)ELEM ==> false; Discharge ==> j notin i
--
-- Since $i$ and $j$ are, by assumption, distinct ordinals,
-- one of the two should belong to the other. However,
-- both possibilities have been discarded already, which
-- leads to the desired contradiction.
--
	(Stat1,Stat1*)ELEM ==> Ord(i) & Ord(j) & (i /= j)
(i,j)-->T31(Stat13*) ==> false; Discharge ==> QED
--
Theorem mutual_climbing3: ((X in om1_thryvar) & (Y in om2_thryvar)) ¥imp ((X in Y) or (Y in X)). Proof+:
Suppose_not(x,y) ==> Stat1: (x in om1_thryvar) & (y in om2_thryvar) & (x notin y) & (y notin x)
 	Use_def(om1_thryvar)(Stat1*) ==> Stat2: x in {cdr(om_thryvar(k)): k in Za}
	Use_def(om2_thryvar)(Stat1*) ==> Stat3: y in {car(om_thryvar(k)): k in Za}
	k0-->Stat2(Stat2*) ==> Stat4: (x = cdr(om_thryvar(k0))) & (k0 in Za)
	k1-->Stat3(Stat3*) ==> Stat5: (y = car(om_thryvar(k1))) & (k1 in Za)
	Use_def(om_thryvar)(Stat3*) ==> Stat6: om_thryvar(k1) = [{cdr(om_thryvar(k)): k in k1}, {car(om_thryvar(k)): k in k1} + { {cdr(om_thryvar(k)): k in k1} }]
	(Stat6)ELEM ==> Stat7: car(om_thryvar(k1)) = {cdr(om_thryvar(k)): k in k1}
	Use_def(om_thryvar)(Stat3*) ==> Stat8: om_thryvar(k0) = [{cdr(om_thryvar(k)): k in k0}, {car(om_thryvar(k)): k in k0} + { {cdr(om_thryvar(k)): k in k0} }]
	(Stat8)ELEM ==> Stat9: cdr(om_thryvar(k0)) = {car(om_thryvar(k)): k in k0} + { {cdr(om_thryvar(k)): k in k0} }
	(Stat4,Stat5,Stat7,Stat9*)ELEM ==> Stat10: (x = {car(om_thryvar(k)): k in k0} + { {cdr(om_thryvar(k)): k in k0} }) &
	(y = {cdr(om_thryvar(k)): k in k1})
	Suppose ==> k0 = k1
		EQUAL(Stat10*) ==> Stat11: y = {cdr(om_thryvar(k)): k in k0}
	(Stat11,Stat10,Stat1*)ELEM ==> false; Discharge ==> Stat12: k0 /= k1
	Suppose ==> Stat13: k0 in k1
		(Stat1,Stat4,Stat10*)ELEM ==> Stat14: cdr(om_thryvar(k0)) notin {cdr(om_thryvar(k)): k in k1}
	k0-->Stat14(Stat13*) ==> false; Discharge ==> k0 notin k1
	Suppose ==> Stat15: k1 in k0
		(Stat1,Stat5,Stat10*)ELEM ==> Stat16: car(om_thryvar(k1)) notin {car(om_thryvar(k)): k in k0}
	k1-->Stat16(Stat15*) ==> false; Discharge ==> k1 notin k0
(k0,k1)-->T31(Stat3*) ==> false; Discharge ==> QED
--
Theorem mutual_climbing4: ((om1_thryvar * om2_thryvar) = 0) & (om1_thryvar /= om2_thryvar). Proof:
Suppose_not ==> AUTO
--
-- Reasoning by contradiction, assume that the negative of the assertion
-- of this theorem holds. We can discharge the negative of the first conjunct.
--
	Suppose ==> Stat1: (om1_thryvar * om2_thryvar) /= 0
		x-->Stat1(Stat1*) ==> (x in om1_thryvar) & (x in om2_thryvar)
	(x,x)-->Tmutual_climbing3(Stat1*) ==> false; Discharge ==> Stat2: ((om1_thryvar * om2_thryvar) = 0) & (om1_thryvar = om2_thryvar)
--
-- This yields that $om1_thryvar$ and $om2_thryvar$ are disjoint, but equal.
-- However, disjoint sets either of which is non-null, must differ; therefore,
-- if we prove $om2_thryvar /= 0$, a contradiction will ensue, as desired.
--
	Suppose ==> Stat3: om2_thryvar = 0
		Use_def(om2_thryvar)(Stat3*) ==> Stat4: {cdr(om_thryvar(k)): k in 0} notin {car(om_thryvar(k)): k in Za}
		T211(Stat4,Stat4*) ==> 0 in Za
		0-->Stat4(Stat4*) ==> Stat5: {cdr(om_thryvar(k)): k in 0} /= car(om_thryvar(0))
		Use_def(om_thryvar)(Stat3,Stat3*) ==> Stat6: om_thryvar(0) = [{cdr(om_thryvar(k)): k in 0}, {car(om_thryvar(k)): k in 0} + { {cdr(om_thryvar(k)): k in 0} }]
		(Stat6)ELEM ==> Stat7: car(om_thryvar(0)) = {cdr(om_thryvar(k)): k in 0}
	(Stat5,Stat7*)Discharge ==> om2_thryvar /= 0
(Stat2*)Discharge ==> QED
--
Theorem mutual_climbing5: (om1_thryvar notin om2_thryvar) & (om2_thryvar notin om1_thryvar). Proof+:
Suppose_not ==> AUTO
--
-- Reasoning by contradiction, assume the negative of the assertion at whose proof we are aiming.
-- Consider first the case $om1_thryvar in om2_thryvar$. A contradiction is reached as follows.
--
	Use_def(om1_thryvar)(*) ==> Stat1: om1_thryvar = {cdr(om_thryvar(k)): k in Za}
	Use_def(om2_thryvar)(*) ==> om2_thryvar = {car(om_thryvar(k)): k in Za}
	Suppose ==> om1_thryvar in om2_thryvar
		EQUAL(Stat1*) ==> Stat2: {cdr(om_thryvar(k)): k in Za} in {car(om_thryvar(k)): k in Za}
		k0-->Stat2(Stat2*) ==> Stat3: (k0 in Za) & ({cdr(om_thryvar(k)): k in Za} = car(om_thryvar(k0)))
		Use_def(om_thryvar)(Stat3*) ==> Stat4: om_thryvar(k0) = [{cdr(om_thryvar(k)): k in k0}, {car(om_thryvar(k)): k in k0} + { {cdr(om_thryvar(k)): k in k0} }]
		(Stat4)ELEM ==> car(om_thryvar(k0)) = {cdr(om_thryvar(k)): k in k0}
		(Stat3*)ELEM ==> Stat5: {cdr(om_thryvar(k)): k in Za} = {cdr(om_thryvar(k)): k in k0}
		k0-->T317(Stat3,Stat3*) ==> Stat6: next(k0) in Za
		Suppose ==> Stat7: cdr(om_thryvar(next(k0))) notin {cdr(om_thryvar(k)): k in Za}
		(next(k0))-->Stat7(Stat6) ==> false; Discharge ==> cdr(om_thryvar(next(k0))) in {cdr(om_thryvar(k)): k in Za}
		EQUAL(Stat5*) ==> Stat8: cdr(om_thryvar(next(k0))) in {cdr(om_thryvar(k)): k in k0}
		k1-->Stat8(Stat8*) ==> Stat9: (cdr(om_thryvar(next(k0))) = cdr(om_thryvar(k1))) & (k1 in k0)
		(k0,k1)-->T12(Stat3*) ==> Ord(k1)
		Use_def(next)(Stat9,Stat9*) ==> k1 /= next(k0)
	(next(k0),k1)-->Tmutual_climbing2(Stat3*) ==> false; Discharge ==> Stat10: om2_thryvar in om1_thryvar
--
-- Consider then the other case, namely $om2_thryvar in om1_thryvar$.
-- This can be treated in a way entirely analogous to the case considered above,
-- leading to a contradiction which proves the desired assertion.
--
	EQUAL(Stat1*) ==> Stat11: {car(om_thryvar(k)): k in Za} in {cdr(om_thryvar(k)): k in Za}
	k2-->Stat11(Stat11*) ==> Stat12: (k2 in Za) & ({car(om_thryvar(k)): k in Za} = cdr(om_thryvar(k2)))
	Use_def(om_thryvar)(Stat12*) ==> Stat13: om_thryvar(k2) = [{cdr(om_thryvar(k)): k in k2}, {car(om_thryvar(k)): k in k2} + { {cdr(om_thryvar(k)): k in k2} }]
	(Stat13)ELEM ==> cdr(om_thryvar(k2)) = {car(om_thryvar(k)): k in k2} + { {cdr(om_thryvar(k)): k in k2} }
	(Stat12*)ELEM ==> Stat14: {car(om_thryvar(k)): k in Za} = {car(om_thryvar(k)): k in k2} + { {cdr(om_thryvar(k)): k in k2} }
	k2-->T317(Stat12,Stat12*) ==> Stat15: next(k2) in Za
	Suppose ==> Stat16: car(om_thryvar(next(k2))) notin {car(om_thryvar(k)): k in Za}
	(next(k2))-->Stat16(Stat15) ==> false; Discharge ==> car(om_thryvar(next(k2))) in {car(om_thryvar(k)): k in Za}
	EQUAL(Stat14*) ==> Stat17: car(om_thryvar(next(k2))) in {car(om_thryvar(k)): k in k2} + { {cdr(om_thryvar(k)): k in k2} }
	Suppose ==> Stat18: car(om_thryvar(next(k2))) = {cdr(om_thryvar(k)): k in k2}
		Use_def(om_thryvar)(Stat17*) ==> Stat19: om_thryvar(next(k2)) = [{cdr(om_thryvar(k)): k in next(k2)}, {car(om_thryvar(k)): k in next(k2)} + { {cdr(om_thryvar(k)): k in next(k2)} }]
		(Stat19)ELEM ==> car(om_thryvar(next(k2))) = {cdr(om_thryvar(k)): k in next(k2)}
		Use_def(om_thryvar)(Stat17,Stat17*) ==> Stat20: om_thryvar(k2) = [{cdr(om_thryvar(k)): k in k2}, {car(om_thryvar(k)): k in k2} + { {cdr(om_thryvar(k)): k in k2} }]
		(Stat20)ELEM ==> Stat21: car(om_thryvar(k2)) = {cdr(om_thryvar(k)): k in k2}
		(Stat18*)ELEM ==> car(om_thryvar(next(k2))) = car(om_thryvar(k2))
		Use_def(next)(Stat18,Stat18) ==> next(k2) /= k2
	(next(k2),k2)-->Tmutual_climbing2(Stat12*) ==> false; Discharge ==> Stat22: car(om_thryvar(next(k2))) in {car(om_thryvar(k)): k in k2}
	k3-->Stat22(Stat22*) ==> Stat23: (car(om_thryvar(next(k2))) = car(om_thryvar(k3))) & (k3 in k2)
	(k2,k3)-->T12(Stat12*) ==> Ord(k3)
	Use_def(next)(Stat23,Stat23*) ==> k3 /= next(k2)
(next(k2),k3)-->Tmutual_climbing2(Stat15*) ==> false; Discharge ==> QED
--
Theorem mutual_climbing6: (Un(om1_thryvar) ¥incin om2_thryvar) & (Un(om2_thryvar) ¥incin om1_thryvar). Proof:
Suppose_not ==> AUTO
	Suppose ==> Stat1: not(Un(om1_thryvar) ¥incin om2_thryvar)
		c-->Stat1(Stat1*) ==> Stat2: (c in Un(om1_thryvar)) & (c notin om2_thryvar)
		Use_def(Un)(Stat2*) ==> Stat3: c in {x: y in om1_thryvar, x in y}
		(d,e)-->Stat3(Stat3*) ==> (d in om1_thryvar) & (c in d)
		Use_def(om1_thryvar)(*) ==> Stat4: d in {cdr(om_thryvar(k)): k in Za}
		k1-->Stat4(Stat4*) ==> (k1 in Za) & (d = cdr(om_thryvar(k1)))
		Use_def(om_thryvar)(Stat4*) ==> Stat5: om_thryvar(k1) = [{cdr(om_thryvar(k)): k in k1}, {car(om_thryvar(k)): k in k1} + { {cdr(om_thryvar(k)): k in k1} }]
		(Stat5)ELEM ==> cdr(om_thryvar(k1)) = {car(om_thryvar(k)): k in k1} + { {cdr(om_thryvar(k)): k in k1} }
		(Stat3*)ELEM ==> c in ({car(om_thryvar(k)): k in k1} + { {cdr(om_thryvar(k)): k in k1} })
		Use_def(om2_thryvar)(Stat2,Stat2*) ==> Stat6: c notin {car(om_thryvar(k)): k in Za}
		Suppose ==> Stat7: c in {car(om_thryvar(k)): k in k1}
			k2-->Stat7(Stat7*) ==> (k2 in k1) & (c = car(om_thryvar(k2)))
			T206(*) ==> Ord(Za)
			(Za,k1)-->T13(Stat4*) ==> k2 in Za
		k2-->Stat6(Stat7*) ==> false; Discharge ==> c notin {car(om_thryvar(k)): k in k1}
		(Stat5*)ELEM ==> c = {cdr(om_thryvar(k)): k in k1}
		Use_def(om_thryvar)(Stat7*) ==> Stat8: om_thryvar(k1) = [{cdr(om_thryvar(k)): k in k1}, {car(om_thryvar(k)): k in k1} + { {cdr(om_thryvar(k)): k in k1} }]
		(Stat8)ELEM ==> car(om_thryvar(k1)) = {cdr(om_thryvar(k)): k in k1}
	k1-->Stat6(Stat4*) ==> false; Discharge ==> Stat9: not(Un(om2_thryvar) ¥incin om1_thryvar)
	c1-->Stat9(Stat9*) ==> Stat10: (c1 in Un(om2_thryvar)) & (c1 notin om1_thryvar)
	Use_def(Un)(Stat10*) ==> Stat11: c1 in {x: y in om2_thryvar, x in y}
	(d1,e1)-->Stat11(Stat11*) ==> (d1 in om2_thryvar) & (c1 in d1)
	Use_def(om2_thryvar)(*) ==> Stat12: d1 in {car(om_thryvar(k)): k in Za}
	k3-->Stat12(Stat12*) ==> (k3 in Za) & (d1 = car(om_thryvar(k3)))
	Use_def(om_thryvar)(Stat4*) ==> Stat13: om_thryvar(k3) = [{cdr(om_thryvar(k)): k in k3}, {car(om_thryvar(k)): k in k3} + { {cdr(om_thryvar(k)): k in k3} }]
	(Stat13)ELEM ==> car(om_thryvar(k3)) = {cdr(om_thryvar(k)): k in k3}
	(Stat11*)ELEM ==> Stat14: c1 in {cdr(om_thryvar(k)): k in k3}
	Use_def(om1_thryvar)(Stat10,Stat10*) ==> Stat15: c1 notin {cdr(om_thryvar(k)): k in Za}
	k4-->Stat14(Stat14*) ==> (c1 = cdr(om_thryvar(k4))) & (k4 in k3)
	T206(*) ==> Ord(Za)
	(Za,k3)-->T13(Stat12*) ==> k4 in Za
k4-->Stat15(Stat15*) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY mutual_climbing
--
--THEORY mutual_climbing
--==>(om1_thryvar,om2_thryvar)
-- ((X in om1_thryvar) & (Y in om2_thryvar)) ¥imp ((X in Y) or (Y in X))
-- ((om1_thryvar * om2_thryvar) = 0) & (om1_thryvar /= om2_thryvar)
-- (om1_thryvar notin om2_thryvar) & (om2_thryvar notin om1_thryvar)
-- (Un(om1_thryvar) ¥incin om2_thryvar) & (Un(om2_thryvar) ¥incin om1_thryvar)
--END mutual_climbing
--
--
--
THEORY twin_infinities(om1,om2)
	(FORALL x in om1, y in om2 | (x in y) or (y in x))
	om1 /= om2
	(om1 notin om2) & (om2 notin om1)
	(Un(om1) ¥incin om2) & (Un(om2) ¥incin om1)
END twin_infinities
--
ENTER_THEORY twin_infinities
--
Theorem twin_infinities1: not(Finite(om1 + om2)). Proof:
Suppose_not ==> AUTO
	(om1 + om2)-->T244 ==> Stat1: (EXISTS v | Finite(om1 + om2) ¥imp ((((om1 + om2) = 0) or (v in (om1 + om2))) & ({y in ((om1 + om2)-{v}) | v in Ult_membs({y})} = 0)))
	v0-->Stat1(*) ==> (((om1 + om2) = 0) or (v0 in (om1 + om2))) & ({y in ((om1 + om2)-{v0}) | v0 in Ult_membs({y})} = 0)
	Assump ==> om1 /= om2
	(Stat1*)ELEM ==> Stat2: (v0 in (om1 + om2)) & ({y in ((om1 + om2)-{v0}) | v0 in Ult_membs({y})} = 0)
	Assump ==> Stat3: (FORALL x in om1, y in om2 | (x in y) or (y in x))
	Assump ==> (om1 notin om2) & (om2 notin om1)
	Assump ==> (Un(om1) ¥incin om2) & (Un(om2) ¥incin om1)
	Suppose ==> v0 in om1
		Suppose ==> Stat4: not(om2 ¥incin v0)
			v1-->Stat4(Stat4*) ==> (v1 in om2) & (v1 notin v0)
			(v0,v1)-->Stat3(Stat2*) ==> (v0 in v1) & Stat5: (v1 notin {y in ((om1 + om2)-{v0}) | v0 in Ult_membs({y})})
			()-->Stat5(Stat4*) ==> v0 notin Ult_membs({v1})
			v1-->T18(Stat4*) ==> v0 notin Ult_membs(v1)
		v1-->T14(Stat4*) ==> false; Discharge ==> om2 ¥incin v0
		(Stat3*)ELEM ==> Stat6: (om2 ¥incin v0) & Stat7: (v0 /= om2)
		c1-->Stat7(Stat6*) ==> (c1 in v0) & (c1 notin om2)
		om1-->T274 ==> Stat8: (FORALL x in om1 | x ¥incin Un(om1))
	v0-->Stat8(Stat3*) ==> false; Discharge ==> v0 notin om1
	(Stat2*)ELEM ==> v0 in om2
	Suppose ==> Stat9: not(om1 ¥incin v0)
		v2-->Stat9(Stat9*) ==> (v2 in om1) & (v2 notin v0)
		(v2,v0)-->Stat3(Stat2*) ==> (v0 in v2) & Stat10: (v2 notin {y in ((om1 + om2)-{v0}) | v0 in Ult_membs({y})})
		()-->Stat10(Stat9*) ==> v0 notin Ult_membs({v2})
		v2-->T18(Stat9*) ==> v0 notin Ult_membs(v2)
	v2-->T14(Stat9*) ==> false; Discharge ==> om1 ¥incin v0
	(Stat3*)ELEM ==> Stat11: (om1 ¥incin v0) & Stat12: (v0 /= om1)
	c2-->Stat12(Stat11*) ==> (c2 in v0) & (c2 notin om1)
	om2-->T274 ==> Stat13: (FORALL x in om2 | x ¥incin Un(om2))
v0-->Stat13(Stat3*) ==> false; Discharge ==> QED
--
Theorem twin_infinities2: not(Finite(om1) or Finite(om2)). Proof:
Suppose_not ==> AUTO
	Ttwin_infinities1 ==> Stat1: not(Finite(om1 + om2))
	(om1,om2)-->T236(Stat1*) ==> not(Finite(om1) & Finite(om2))
	Assump ==> Stat2: (Un(om1) ¥incin om2) & (Un(om2) ¥incin om1)
	Suppose ==> Stat3: Finite(om1)
		Suppose ==> Stat4: not(om2 ¥incin pow(om1))
			c2-->Stat4(Stat4*) ==> (c2 in om2) & (c2 notin pow(om1))
			Use_def(pow) ==> Stat5: c2 notin {x: x ¥incin om1}
			c2-->Stat5(Stat5*) ==> not(c2 ¥incin om1)
			om2-->T274(Stat4*) ==> Stat6: (FORALL x in om2 | x ¥incin Un(om2))
		c2-->Stat6(Stat2*) ==> false; Discharge ==> om2 ¥incin pow(om1)
		om1-->T264(Stat3*) ==> Finite(pow(om1))
	(pow(om1),om2)-->T189(Stat1*) ==> false; Discharge ==> Stat7: Finite(om2)
	Suppose ==> Stat8: not(om1 ¥incin pow(om2))
		c1-->Stat8(Stat8*) ==> (c1 in om1) & (c1 notin pow(om2))
		Use_def(pow) ==> Stat9: c1 notin {x: x ¥incin om2}
		c1-->Stat9(Stat9*) ==> not(c1 ¥incin om2)
		om1-->T274(Stat8*) ==> Stat10: (FORALL x in om1 | x ¥incin Un(om1))
	c1-->Stat10(Stat2*) ==> false; Discharge ==> om1 ¥incin pow(om2)
	om2-->T264(Stat7,Stat7*) ==> Finite(pow(om2))
(pow(om2),om1)-->T189(Stat1*) ==> false; Discharge ==> QED
--
Theorem twin_infinities3: (om1 * om2) = 0. Proof:
Suppose_not ==> Stat1: (om1 * om2) /= 0
--
-- Reasoning by contradiction, assume that the negative of the assertion
-- of this theorem holds. We can discharge the negative of the first conjunct.
--
	x-->Stat1(Stat1*) ==> (x in om1) & (x in om2)
	Assump ==> Stat2: (FORALL x in om1, y in om2 | (x in y) or (y in x))
(x,x)-->Stat2(Stat1*) ==> false; Discharge ==> QED
--
-- The following theorem could easily be deduced from the
-- fact, proved above, that $om1$ and $om2$ are infinite.
-- However, we opt for a direct proof.
--
Theorem twin_infinities4: (om1 /= 0) & (om2 /= 0). Proof:
Suppose_not ==> AUTO
	Assump ==> (om1 notin om2) & (om2 notin om1)
	Assump ==> Stat1: (Un(om1) ¥incin om2) & (Un(om2) ¥incin om1)
	Assump ==> Stat2: om1 /= om2
	c-->Stat2 ==> (c in om1) ¥eq (c notin om2)
	Suppose ==> c in om1
		om1-->T274(Stat2,Stat2*) ==> Stat3: (FORALL x in om1 | x ¥incin Un(om1))
		c-->Stat3(Stat1*) ==> c ¥incin om2
	ELEM ==> false; Discharge ==> c in om2
	om2-->T274(Stat2,Stat2*) ==> Stat4: (FORALL x in om2 | x ¥incin Un(om2))
	c-->Stat4(Stat1*) ==> c ¥incin om1
ELEM ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY twin_infinities
--
--THEORY twin_infinities(om1,om2)
--	(FORALL x in om1, y in om2 | ((x in om1) & (y in om2)) ¥imp ((x in y) or (y in x)))
--	om1 /= om2
--	(om1 notin om2) & (om2 notin om1)
--	(Un(om1) ¥incin om2) & (Un(om2) ¥incin om1)
--==>
--	not(Finite(om1) or Finite(om2))
--	(om1 * om2) = 0
--END twin_infinities
--
--PAUSE HERE ----------------------------------------------------------------------------------------------------
--
--BEGIN HERE ----------------------------------------------------------------------------------------------------
--
-- ************************************************************************************************
--			Section 20: Propositional satisfiability, Davis-Putnam satisfiability test, compactness
-- ************************************************************************************************
--
--
-- A toggling map is a single-valued map which is self-inverse and anti-diagonal.
--
Def 998: Is_tog(T) := Svm(T) & (inv(T) = T) & ({p in T | car(p) = cdr(p)} = 0)
--
Theorem 887: (Is_tog(T) & (X in domain(T))) ¥imp (((T~[X]) /= X) & ((T~[T~[X]]) = X)). Proof:
Suppose_not(t0,x0) ==> AUTO
	Use_def(Is_tog) ==> Stat1: ({p in t0 | car(p) = cdr(p)} = 0) & Svm(t0) & (inv(t0) = t0) & (x0 in domain(t0)) & (not(((t0~[x0]) /= x0) & ((t0~[t0~[x0]]) = x0)))
	Use_def(Svm(t0)) ==> AUTO
	(t0,x0)-->T77 ==> AUTO
	(t0,x0,t0~[x0])-->T90(Stat1*) ==> Stat2: ([x0,t0~[x0]] in t0) & ([t0~[x0],x0] in t0)
	Suppose ==> x0 = t0~[x0]
		EQUAL(Stat2) ==> Stat3: [x0,x0] in t0
		TELEM ==> (car([x0,x0]) = x0) & (cdr([x0,x0]) = x0)
		([x0,x0])-->Stat1(Stat3*) ==> false
	Discharge ==> Stat4: x0 /= t0~[t0~[x0]]
	(t0,[t0~[x0],x0])-->T74(Stat1,Stat2*) ==> (t0~[car([t0~[x0],x0])]) = cdr([t0~[x0],x0])
	TELEM ==> (car([t0~[x0],x0]) = t0~[x0]) & (cdr([t0~[x0],x0]) = x0)
	EQUAL(Stat4) ==> false
	Discharge ==> QED
--
-- Every infinite set supports a toggling map.
--
Theorem 888: (not Finite(S)) ¥imp (EXISTS f | Is_tog(f) & (domain(f) = S)). Proof:
Suppose_not(s0) ==> Stat1: (not (EXISTS t | Is_tog(t) & (domain(t) = s0))) & (not Finite(s0))
--
-- For, assume $s0$ to be a counterexample. Then a one-one correspondence
-- $f0$ between $s0 ¥PROD {0,1}$ and $s0$ can be found. We obtain from it the
-- map $t0$ which puts into mutual correspondence those pairs $[v,w]$ in $s0 ¥PROD s0$
-- which originate, as $f0$-images, from distinct pairs $[x,0],[x,1]$ in $s0 ¥PROD {0,1}$
-- which share the same first component. It will turn out that $t0$ is a toggling map
-- for $s0$, contrary to the initial assumption that such a map does not exist.
--
	s0-->T362(*) ==> #(s0 ¥PROD {0,1}) = #s0
	(s0,s0 ¥PROD {0,1})-->T158(*) ==> Stat2: (EXISTS f in OM | one_1_map(f) & (range(f) = s0) & (domain(f) = s0 ¥PROD {0,1}))
	f0-->Stat2(Stat2*) ==> one_1_map(f0) & (range(f0) = s0) & (domain(f0) = s0 ¥PROD {0,1})
	Loc_def ==> Stat3: t0 = {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}
	TELEM ==> Is_map({[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)})
--
-- In order to see that $s0$ is the domain of $t0$, we momentarily assume that a witness $y0$
-- of the difference between $s0$ and the set ${cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}$
-- exists.
--
	Suppose ==> Stat4: domain({[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) /= s0
		TELEM ==> domain({[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) =
			{cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}
		y0-->Stat4(Stat4*) ==> Stat5: (y0 in {cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) ¥neq (y0 in s0)
--
-- Suppose first that $y0$ belongs to $s0$, and let $[x0,b0]$ be the pair for which
-- $f0~[[x0,b0]] = y0$. Putting $b1=1 - b0$, we will have $[x0,b0]/=[x0,b1]$ and hence
-- $f0~[[x0,b0]] /= f0~[[x0,b1]]$ by one-one-ness. Therefore, $[[x0,b0],f0~[[x0,b0]]]$ and
-- $[[x0,b1],f0~[[x0,b1]]]$ are distinct pairs in $f0$ with $cdr([[x0,b0],f0~[[x0,b0]]])=y0$;
-- therefore $y0$ belongs to ${cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}$,
-- a contradiction.
--
		Use_def(one_1_map) ==> Stat6: (FORALL x in f0, y in f0 | (cdr(x) = cdr(y)) ¥imp (x = y)) & Svm(f0)
		Use_def(Svm)(Stat6*) ==> Stat7: (FORALL x in f0, y in f0 | (car(x) = car(y)) ¥imp (x = y)) & Is_map(f0)
		Suppose ==> y0 in s0
			f0-->T73(Stat2*) ==> Stat8: y0 in {f0~[x]: x in domain(f0)}
			p2-->Stat8(Stat2*) ==> (y0 = f0~[p2]) & (p2 in domain(f0)) & (p2 in s0 ¥PROD {0,1})
			Use_def(¥PROD)(Stat8*) ==> Stat9: p2 in {[x,y]: x in s0, y in {0,1}}
			(x0,b0)-->Stat9(Stat9*) ==> (x0 in s0) & (b0 in {0,1}) & (p2 = [x0,b0])
			TELEM ==> Stat10: 1 = {0}
			Loc_def ==> b1 = 1 - b0
			(Stat10*)ELEM ==> Stat11: (b1 /= b0) & (b1 in {0,1})
			(Stat11)ELEM ==> [x0,b0] /= [x0,b1]
			Suppose ==> [x0,b1] notin domain(f0)
				(Stat2*)ELEM ==> Stat12: [x0,b1] notin s0 ¥PROD {0,1}
				Use_def(¥PROD)(Stat12*) ==> Stat13: [x0,b1] notin {[x,y]: x in s0, y in {0,1}}
				(x0,b1)-->Stat13(Stat9*) ==> false
			Discharge ==> AUTO
			Suppose ==> [[x0,b0],f0~[[x0,b0]]] = [[x0,b1],f0~[[x0,b1]]]
				(f0,[x0,b0],[x0,b1])-->T127(Stat2*) ==> Stat14: f0~[[x0,b0]] /= f0~[[x0,b1]]
				TELEM ==> (cdr([[x0,b0],f0~[[x0,b0]]]) = f0~[[x0,b0]]) & (cdr([[x0,b1],f0~[[x0,b1]]]) = f0~[[x0,b1]])
				EQUAL(Stat11) ==> false
			Discharge ==> AUTO
			TELEM ==> cdr([[x0,b0],f0~[[x0,b0]]]) = f0~[[x0,b0]]
			EQUAL ==> ([x0,b0] in domain(f0)) & (y0 = cdr([[x0,b0],f0~[[x0,b0]]]))
			(f0,[x0,b0])-->T77(Stat7*) ==> [[x0,b0],f0~[[x0,b0]]] in f0
			(f0,[x0,b1])-->T77(Stat7*) ==> [[x0,b1],f0~[[x0,b1]]] in f0
			(Stat5*)ELEM ==> Stat15: y0 notin {cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}
			([[x0,b0],f0~[[x0,b0]]],[[x0,b1],f0~[[x0,b1]]])-->Stat15(Stat11*) ==> car(car([[x0,b0],f0~[[x0,b0]]])) /= car(car([[x0,b1],f0~[[x0,b1]]]))
			TELEM ==> (car(car([[x0,b0],f0~[[x0,b0]]])) = x0) & (car(car([[x0,b1],f0~[[x0,b1]]])) = x0)
		(Stat15*)Discharge ==> AUTO
--
-- To see that $y0$ cannot belong to ${cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}$
-- either, suppose that this is the case. But then $y0 = cdr(p0)$ holds for some $p0 in f0$, and therefore
-- $y0$ belongs to the range of $f0$, which is $s0$; again a contradiction.
--
		(Stat4*)ELEM ==> Stat16: y0 in {cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}
		(p0,q0)-->Stat16(Stat16*) ==> (p0 in f0) & (y0 = cdr(p0))
		(p0,f0)-->T61(Stat2*) ==> false
	Discharge ==> domain({[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) = s0
--
-- Next we check that the map $t0$ is single-valued.
--
	EQUAL ==> Stat17: Is_map(t0) & (domain(t0) = s0)
	t0-->Stat1(*) ==> (not Is_tog(t0))
	Use_def(Is_tog(t0)) ==> AUTO
	(Stat17*)ELEM ==> not(Svm(t0) & (inv(t0) = t0) & ({p in t0 | car(p) = cdr(p)} = 0))
	Suppose ==> not Svm(t0)
		Use_def(Svm)(Stat17*) ==> Stat18: not(FORALL x in t0, y in t0 | (car(x) = car(y)) ¥imp (x = y))
		(p3,q3)-->Stat18(Stat18*) ==> (p3 in t0) & (q3 in t0) & (car(p3) = car(q3)) & (p3 /= q3)
		EQUAL ==> Stat19: (p3 in {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) & (q3 in {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)})
		(p4,q4,p5,q5)-->Stat19(Stat19*) ==> Stat20: (p3 = [cdr(p4),cdr(q4)]) & (p4 in f0) & (q4 in f0) & (car(car(p4)) = car(car(q4))) & (p4 /= q4) &
			(q3 = [cdr(p5),cdr(q5)]) & (p5 in f0) & (q5 in f0) & (car(car(p5)) = car(car(q5))) & (p5 /= q5)
		TELEM ==> (car([cdr(p4),cdr(q4)]) = cdr(p4)) & (car([cdr(p5),cdr(q5)]) = cdr(p5))
		EQUAL(Stat18) ==> cdr(p4) = cdr(p5)
		(p4,p5)-->Stat6(Stat18*) ==> p4 = p5
		EQUAL(Stat18) ==> (car(car(q4)) = car(car(q5))) & (q4 /= q5)
		(q4,q5)-->Stat7(Stat18*) ==> car(q4) /= car(q5)
		(q4,p4)-->Stat7(Stat18*) ==> car(q4) /= car(p4)
		(p5,q5)-->Stat7(Stat18*) ==> car(p5) /= car(q5)
		(q5,f0)-->T60(Stat18*) ==> car(q5) in domain(f0)
		(q4,f0)-->T60(Stat18*) ==> car(q4) in domain(f0)
		(p5,f0)-->T60(Stat18*) ==> car(p5) in domain(f0)
		(Stat2*)ELEM ==> Stat21: (car(q5) in s0 ¥PROD {0,1}) & (car(q4) in s0 ¥PROD {0,1}) & (car(p5) in s0 ¥PROD {0,1})
		(s0 ¥PROD {0,1},s0,{0,1})-->T141(Stat21*) ==> Is_map(s0 ¥PROD {0,1})
		(s0 ¥PROD {0,1},car(q5))-->T76(Stat21*) ==> car(q5) = [car(car(q5)),cdr(car(q5))]
		(s0 ¥PROD {0,1},car(q4))-->T76(Stat21*) ==> car(q4) = [car(car(q4)),cdr(car(q4))]
		(s0 ¥PROD {0,1},car(p5))-->T76(Stat21*) ==> car(p5) = [car(car(p5)),cdr(car(p5))]
		Suppose ==> cdr(car(q4)) = cdr(car(q5))
			EQUAL(Stat20) ==> cdr(car(q4)) /= cdr(car(q5))
		Discharge==> Stat22: cdr(car(q4)) /= cdr(car(q5))
		Suppose ==> cdr(car(q4)) = cdr(car(p5))
			EQUAL(Stat20) ==> false
		Discharge==> AUTO
		Suppose ==> cdr(car(p5)) = cdr(car(q5))
			EQUAL(Stat20) ==> false
		Discharge==> AUTO
		(car(q5),s0,{0,1})-->T140(Stat21,Stat21*) ==> cdr(car(q5)) in {0,1}
		(car(q4),s0,{0,1})-->T140(Stat21,Stat21*) ==> cdr(car(q4)) in {0,1}
		(car(p5),s0,{0,1})-->T140(Stat21,Stat21*) ==> cdr(car(p5)) in {0,1}
	(Stat22*)Discharge ==> AUTO
--
-- Next we check that $t0$ is self-inverse. Assuming the contrary, there
-- would be a pair $w0$ belonging to one of $t0,inv(t0)$ but not to the other.
-- A contradiction arises readily whichever of the two is assumed.
--
	Suppose ==> Stat23: inv(t0) /= t0
		w0-->Stat23(Stat23*) ==> (w0 in inv(t0)) ¥eq (w0 notin t0)
		Use_def(inv(t0)) ==> AUTO
		EQUAL(Stat2) ==> inv(t0) = {[cdr(x),car(x)]: x in {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}}
		SIMPLF(Stat23*) ==> Stat24: inv(t0) = {[cdr([cdr(p),cdr(q)]),car([cdr(p),cdr(q)])]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}
		EQUAL(Stat2) ==> Stat25: (w0 in {[cdr([cdr(p),cdr(q)]),car([cdr(p),cdr(q)])]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) ¥eq (w0 notin {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)})
		Suppose ==> Stat26: (w0 in {[cdr([cdr(p),cdr(q)]),car([cdr(p),cdr(q)])]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) & (w0 notin {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)})
			(p6,q6,q6,p6)-->Stat26(Stat26*) ==> false
		Discharge ==> AUTO
		(Stat25*)ELEM ==> Stat27: (w0 in {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) & (w0 notin {[cdr([cdr(p),cdr(q)]),car([cdr(p),cdr(q)])]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)})
		(p7,q7,q7,p7)-->Stat27(Stat27*) ==> false
	Discharge ==> Stat28: {p in t0 | car(p) = cdr(p)} /= 0
--
-- To complete the proof that $t0$ is a toggling map, we must check that $t0$ is anti-diagonal.
-- Assuming the contrary, there would be a pair $w1$ in $t0$ with equal components.
--
	w1-->Stat28(Stat3,Stat3*) ==> Stat29: (w1 in {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) & (car(w1) = cdr(w1))
--
-- But then some pair $w1 in t0$ has coinciding components; however, this means that
-- distinct pairs in $f0$ have the same second component, contrary to the
-- one-one-ness of $f0$.
--
	(p1,q1)-->Stat29(Stat29*) ==> (p1 in f0) & (q1 in f0) & (w1 = [cdr(p1),cdr(q1)]) & (car(w1) = cdr(w1)) & (p1 /= q1)
	TELEM ==> (car([cdr(p1),cdr(q1)]) = cdr(p1)) & (cdr([cdr(p1),cdr(q1)]) = cdr(q1))
	EQUAL(Stat29) ==> cdr(p1) = cdr(q1)
	Use_def(one_1_map)(Stat2*) ==> Stat30: (FORALL x in f0, y in f0 | (cdr(x) = cdr(y)) ¥imp (x = y))
	(p1,q1)-->Stat30(Stat29*) ==> false
	Discharge ==> QED
--
THEORY globalizeMap(t)
	Svm(t) & (range(t) incs domain(t))
END globalizeMap
--
ENTER_THEORY globalizeMap
--
Theorem globalizeMap1: Finite(t) ¥imp ((range(t) = domain(t)) & (one_1_map(t))). Proof:
Suppose_not ==> AUTO
	Assump ==> Svm(t) & (range(t) incs domain(t))
	Suppose ==> range(t) /= domain(t)
		(domain(t),range(t))-->T170(*) ==> #domain(t) ¥incin #range(t)
		t-->T171(*) ==> #domain(t) = #range(t)
		APPLY() finite_image(e(x)->cdr(x),s0->t) ==> Stat1: Finite({cdr(x): x in t})
		Use_def(range)(Stat1*) ==> Finite(range(t))
		(range(t),domain(t))-->T194(*) ==> false
	Discharge ==>  Stat2: Svm(t) & Finite(t) & (range(t) = domain(t)) & (not one_1_map(t))
	Use_def(one_1_map)(Stat2*) ==> Stat3: not(FORALL x in t, y in t | (cdr(x) = cdr(y)) ¥imp (x = y))
	(v,w)-->Stat3(Stat3*) ==> Stat4: (v in t) & (w in t) & (cdr(v) = cdr(w)) & (v /= w)
--
-- Consider now the mapping $t - {v}$, whose single-valuedness and finiteness
-- are obvious.
--
	(t - {v},t)-->T53(Stat2,Stat2*) ==> Stat5: Svm(t - {v})
	(t,t - {v})-->T189(Stat2,Stat2*) ==> Finite(t - {v})
--
-- It is easily seen that $t - {v}$ has the same range as $t$,
-- and that its domain and range are the same set (so that $t - {v}$
-- is, like $t$, a permutation).
--
	Suppose ==> Stat6: range(t - {v}) /= range(t)
		(Stat4*)ELEM ==> Stat7: ((t - {v}) + {v}) = t
		(t - {v},{v})-->T79(Stat7*) ==> (range((t - {v}) + {v}) = (range(t - {v}) + range({v})))
		Use_def(range)(Stat8*) ==> Stat8: range({v}) = {cdr(x): x in {v}}
 		SIMPLF(Stat8) ==> range({v}) = {cdr(v)}
		Use_def(range)(Stat9*) ==> Stat9: range({w}) = {cdr(x): x in {w}}
		SIMPLF(Stat9) ==> Stat10: range({w}) = {cdr(w)}
		EQUAL(Stat4) ==> Stat11: range(t) = (range(t - {v}) + {cdr(w)})
	({w},t - {v})-->T65(Stat10,Stat11,Stat6,Stat4*) ==> false; Discharge ==> Stat12: range(t - {v}) = range(t)
	Suppose ==> Stat13: domain(t - {v}) /= range(t - {v})
		APPLY() finite_image(e(x)->cdr(x),s0->(t - {v})) ==>
			Stat14: Finite({cdr(x): x in (t - {v})})
		Use_def(range)(Stat14*) ==> Stat15: Finite(range(t - {v}))
		(t - {v},t)-->T65(Stat16*) ==> Stat16: domain(t - {v}) ¥incin domain(t)
		(range(t - {v}))-->T195(Stat15*) ==> Stat17: (not(EXISTS f in OM | (Svm(f) & (range(f) = range(t - {v})) & (domain(f) ¥incin range(t - {v})) & (range(t - {v}) /= domain(f)))))
	(t - {v})-->Stat17(Stat13,Stat16,Stat2,Stat12,Stat5*) ==> false; Discharge ==> Stat18: domain(t - {v}) = range(t - {v})
--
-- There is hence a pair in $t - {v}$ which shares the first component with $v$.
-- This implies that there are two pairs with the same first component in $t$,
-- which conflicts with the single-valuedness of $t$.
--
	Use_def(Svm)(Stat2,Stat2*) ==> Stat19: Is_map(t)
	Suppose ==> [car(v),(t - {v})~[car(v)]] notin (t - {v})
		Use_def(Svm)(Stat5,Stat5*) ==> Is_map(t - {v})
		(t - {v},car(v))-->T77(Stat19*) ==> Stat20: car(v) notin domain(t - {v})
		(Stat20,Stat18,Stat12,Stat2*)ELEM ==> car(v) notin domain(t)
		Use_def(domain)(Stat20*) ==> Stat21: car(v) notin {car(x): x in t}
	v-->Stat21(Stat4*) ==> false; Discharge ==> Stat22: [car(v),(t - {v})~[car(v)]] in (t - {v})
	(t,v)-->T76(Stat4,Stat19*) ==> (v = [car(v),cdr(v)]) & ([car(v),cdr(v)] in t)
	Use_def(Svm)(Stat2*) ==> Stat23: (FORALL x in t, y in t | (car(x) = car(y)) ¥imp (x = y))
	([car(v),cdr(v)],[car(v),(t - {v})~[car(v)]])-->Stat23(Stat22*) ==> Stat24: car([car(v),cdr(v)]) /= car([car(v),(t - {v})~[car(v)]])
--
-- This contradiction leads us to the desired result.
--
	(Stat24)Discharge ==> QED
Theorem globalizeMap2: (EXISTS o | Ord(o) & (1 in o) & (domain(t) ¥incin cumstr(0,o)) & (not Finite(cumstr(0,o) - domain(t)))). Proof:
Suppose_not ==> Stat1: not(EXISTS o | Ord(o) & (1 in o) & (domain(t) ¥incin cumstr(0,o)) & (not Finite(cumstr(0,o) - domain(t))))
	(cumstr(0,rk({snglIter(n,domain(t)): n in Za})),domain(t))-->T874(*) ==> (domain(t) ¥incin cumstr(0,rk({snglIter(n,domain(t)): n in Za}))) & (not Finite(cumstr(0,rk({snglIter(n,domain(t)): n in Za})) - domain(t))) & (1 in rk(cumstr(0,rk({snglIter(n,domain(t)): n in Za}))))
	({snglIter(n,domain(t)): n in Za})-->T854(*) ==> Ord(rk({snglIter(n,domain(t)): n in Za}))
	(rk({snglIter(n,domain(t)): n in Za}))-->T871(*) ==> rk(cumstr(0,rk({snglIter(n,domain(t)): n in Za}))) = rk({snglIter(n,domain(t)): n in Za})
	Loc_def ==> o = rk({snglIter(n,domain(t)): n in Za})
	EQUAL ==> Ord(o)
	o-->T856(*) ==> o = rk(o)
	EQUAL ==> (rk(cumstr(0,o)) = o) & (1 in o) & (domain(t) ¥incin cumstr(0,o)) & (not Finite(cumstr(0,o) - domain(t)))
	o-->Stat1(Stat1*) ==> false
	Discharge ==> QED
--
	APPLY(v1_thryvar:rk_thryvar) Skolem() ==>
Theorem globalizeMap3: Ord(rk_thryvar) & (1 in rk_thryvar) & (domain(t) ¥incin cumstr(0,rk_thryvar)) & (not Finite(cumstr(0,rk_thryvar) - domain(t)))
--
Theorem globalizeMap4: (EXISTS tp | Is_tog(tp) & (domain(tp) = cumstr(0,rk_thryvar) - domain(t))). Proof:
Suppose_not ==> AUTO
	TglobalizeMap3(*) ==> (not Finite(cumstr(0,rk_thryvar) - domain(t)))
	(cumstr(0,rk_thryvar) - domain(t))-->T888(*) ==> false
	Discharge ==> QED
--
	APPLY(v1_thryvar:tg_thryvar) Skolem() ==>
Theorem globalizeMap5:  Is_tog(tg_thryvar) & (domain(tg_thryvar) = cumstr(0,rk_thryvar) - domain(t))
--
--
--
Def globalizeMap0: [formal negative] togg_thryvar(X) := ((X - 1) + (1 - X))
--
--
--
Theorem globalizeMap6: [alternative characterization of formal negative, via toggling; symmetry and irreflexivity of toggling] ((((X - 1) = (Y - 1)) & ((X * 1) = (1 - Y))) ¥eq (Y = togg_thryvar(X))) & ((((X - 1) = (Y - 1)) & ((X * 1) = (1 - Y))) ¥imp ((((Y - 1) = (X - 1)) & ((Y * 1) = (1 - X))) & (X /= Y))). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(togg_thryvar(x)) ==> AUTO
	EQUAL ==> Stat1: not(((((x - 1) = (y - 1)) & ((x * 1) = (1 - y))) ¥eq (y = ((x - 1) + (1 - x)))) & ((((x - 1) = (y - 1)) & ((x * 1) = (1 - y))) ¥imp ((((y - 1) = (x - 1)) & ((y * 1) = (1 - x))) & (x /= y))))
	TELEM ==> 1 /= 0
	(Stat1*)ELEM ==> false; Discharge ==> QED
--
--
--
Theorem globalizeMap7: [double negation affirms] (togg_thryvar(togg_thryvar(X)) = X) & (togg_thryvar(X) /= X). Proof:
Suppose_not(x) ==> AUTO
	Use_def(togg_thryvar(x)) ==> AUTO
	TELEM ==> (1 /= 0)
	ELEM ==> togg_thryvar(togg_thryvar(x)) /= x
	Use_def(togg_thryvar(togg_thryvar(x))) ==> AUTO
	EQUAL ==> Stat1: ((((x - 1) + (1 - x)) - 1) + (1 - ((x - 1) + (1 - x)))) /= x
	(Stat1*)Discharge ==> QED
--
--
--
Theorem globalizeMap8: [negation of special sets] (togg_thryvar(0) = 1) & (togg_thryvar(1) = 0) & (togg_thryvar({{X,Y}}) = {0,{X,Y}}) & ((X /= 0) ¥imp (togg_thryvar({0,X}) = {X})). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(togg_thryvar(0)) ==> AUTO
	Use_def(togg_thryvar(1)) ==> AUTO
	TELEM ==> Stat1: 1 = {0}
	Suppose ==> (x /= 0) & (togg_thryvar({0,x}) /= {x})
	Use_def(togg_thryvar)(Stat1*) ==> false; Discharge ==> Stat2: togg_thryvar({{x,y}}) /= {0,{x,y}}
	Use_def(togg_thryvar)(Stat1*) ==> false; Discharge ==> QED
--
-- The following theorem shows that, beyond a very low threshold,
-- a specific toggling operator preserves rank.
--
Theorem globalizeMap9: [global toggling preserves rank] (1 in rk(X)) ¥imp (rk(X) = rk((X - 1) + (1 - X))). Proof:
Suppose_not(x0) ==> AUTO
	T211(*) ==> Card(1)
	Use_def(Card) ==> Ord(1)
	1-->T856(*) ==> Stat1: (1 = rk(1)) & (rk(1) in rk(x0))
	x0-->T854(Stat1*) ==> Ord(rk(x0))
	(rk(x0),rk(1))-->T13(Stat1*) ==> rk(1) ¥incin rk(x0)
	ELEM ==> rk(x0) /= rk((x0 - 1) + (1 - x0))
	Suppose ==> Stat2: 1 ¥incin x0
		(Stat2*)ELEM ==>  (1 + (x0 - 1) = x0) & ((x0 - 1) + (1 - x0) = x0 - 1)
		(1,x0-1)-->T850(*) ==> rk(1 + (x0 - 1)) = rk(1) + rk(x0 - 1)
		EQUAL(Stat2) ==> Stat3: rk(x0) = rk(1) + rk(x0 - 1)
		EQUAL ==> (rk(x0) /= rk(x0 - 1)) & Ord(rk(1))
		(Stat3*)ELEM ==> rk(1) ¥nincin rk(x0 - 1)
		(x0 - 1)-->T854(Stat1*) ==> Ord(rk(x0 - 1))
--
-- Of the two ordinals $rk(1),rk(x0 - 1)$ one must include the other,
-- but inclusion in one direction would imply $rk(x0) = rk(1)$ and hence
-- $rk(x0) in rk(1)$; inclusion in the opposite direction conflicts with
-- $rk(x0) /= rk(x0 - 1)$.
--
		(rk(1),rk(x0 - 1))-->T29(Stat1*) ==> false
	Discharge ==> Stat4: 1 ¥nincin x0
	TELEM ==> 1 = {0}
	(Stat4*)ELEM ==> ((x0 - 1) = x0) & ((1 - x0) = 1)
	EQUAL ==> rk(x0) /= rk(x0 + 1)
	(x0,1)-->T850(Stat4*) ==> rk(x0) /= rk(x0) + rk(1)
	(Stat1*)Discharge ==> QED
--
Def globalizeMap1: qtog_thryvar(X) := if X in domain(t) then (t~[X]) elseif X in cumstr(0,rk_thryvar) then (tg_thryvar~[X]) else ((X - 1) + (1 - X)) end if
--
Theorem globalizeMap10: (X in domain(t)) ¥imp (qtog_thryvar(X) = t~[X]). Proof:
Suppose_not(x0) ==> AUTO
	Use_def(qtog_thryvar) ==> false
	Discharge ==> QED
--
Theorem globalizeMap11: (X notin range(t)) ¥imp ((qtog_thryvar(X) /= X) & (qtog_thryvar(qtog_thryvar(X)) = X)). Proof:
Suppose_not(x0) ==> Stat1: (x0 notin range(t)) & (not((qtog_thryvar(x0) /= x0) & (qtog_thryvar(qtog_thryvar(x0)) = x0)))
	Assump ==> Stat2: Svm(t) & (range(t) incs domain(t))
	(Stat1*)ELEM ==> (not(x0 in domain(t)))
	Use_def(qtog_thryvar(x0)) ==> AUTO
	Suppose ==> x0 in cumstr(0,rk_thryvar)
		(Stat2*)ELEM ==> Stat3: qtog_thryvar(x0) = (tg_thryvar~[x0])
		Use_def(Is_tog(tg_thryvar)) ==> AUTO
		TglobalizeMap5(Stat2) ==> Stat4: (domain(tg_thryvar) = cumstr(0,rk_thryvar) - domain(t)) & (x0 in domain(tg_thryvar)) &
				Is_tog(tg_thryvar) & Svm(tg_thryvar) & (inv(tg_thryvar) = tg_thryvar)
		EQUAL(Stat2) ==> domain(inv(tg_thryvar)) = domain(tg_thryvar)
		Use_def(Svm(tg_thryvar)) ==> AUTO
		(tg_thryvar,x0,tg_thryvar~[x0])-->T90 ==> AUTO
		(tg_thryvar,x0)-->T77 ==> AUTO
		TELEM ==> car([tg_thryvar~[x0],x0]) = tg_thryvar~[x0]
		([tg_thryvar~[x0],x0],inv(tg_thryvar))-->T60(Stat2*) ==> Stat5: (tg_thryvar~[x0]) in domain(tg_thryvar)
		(Stat4,Stat5*)ELEM ==> Stat6: ((tg_thryvar~[x0]) in cumstr(0,rk_thryvar)) & (not((tg_thryvar~[x0]) in domain(t)))
		Use_def(qtog_thryvar(tg_thryvar~[x0])) ==> AUTO
		(Stat6*)ELEM ==> qtog_thryvar(tg_thryvar~[x0]) = (tg_thryvar~[tg_thryvar~[x0]])
		EQUAL(Stat2) ==> qtog_thryvar(qtog_thryvar(x0)) = (tg_thryvar~[tg_thryvar~[x0]])
		(tg_thryvar,x0)-->T887(Stat4*) ==> (tg_thryvar~[x0] /= x0) & (tg_thryvar~[tg_thryvar~[x0]] = x0)
		EQUAL(Stat3) ==> Stat7: (qtog_thryvar(x0) /= x0) & (qtog_thryvar(qtog_thryvar(x0)) = x0)
	(Stat1,Stat7*)Discharge ==> Stat8: x0 notin cumstr(0,rk_thryvar)
	ELEM ==> qtog_thryvar(x0) = (x0 - 1) + (1 - x0)
	TglobalizeMap3(Stat8*) ==> Stat9: Ord(rk_thryvar) & (1 in rk_thryvar)
	T211 ==> Ord(0) & Card(1)
	Use_def(Card) ==> Ord(1)
	(1,rk_thryvar,x0)-->T872(Stat8*) ==> 1 in rk(x0)
	x0-->TglobalizeMap9(Stat8*) ==> rk(x0) = rk((x0 - 1) + (1 - x0))
	Suppose ==> Stat10: ((x0 - 1) + (1 - x0)) in cumstr(0,rk_thryvar)
		(rk((x0 - 1) + (1 - x0)),(x0 - 1) + (1 - x0))-->T867(Stat10*) ==> ((x0 - 1) + (1 - x0)) in (cumstr(0,next(rk((x0 - 1) + (1 - x0)))) - cumstr(0,rk((x0 - 1) + (1 - x0))))
		EQUAL(Stat9) ==> ((x0 - 1) + (1 - x0)) in (cumstr(0,next(rk(x0))) - cumstr(0,rk(x0)))
		x0-->T854(Stat10*) ==> Ord(rk(x0))
		Suppose ==> not(cumstr(0,next(rk(x0))) ¥incin cumstr(0,rk_thryvar))
			(rk(x0))-->T32(Stat10*) ==> Ord(next(rk(x0)))
			(next(rk(x0)),rk_thryvar)-->T29(Stat9*) ==> (next(rk(x0)) ¥incin rk_thryvar) or (rk_thryvar ¥incin next(rk(x0)))
			Suppose ==> next(rk(x0)) ¥incin rk_thryvar
				(Stat10*)ELEM ==> rk_thryvar = next(rk(x0)) + rk_thryvar
				(0,next(rk(x0)),rk_thryvar)-->T859(Stat10*) ==> cumstr(0,next(rk(x0))) ¥incin cumstr(0,next(rk(x0)) + rk_thryvar)
				EQUAL(Stat10) ==> false
			Discharge ==> (rk_thryvar ¥incin next(rk(x0))) & (rk_thryvar /= next(rk(x0)))
			(next(rk(x0)),rk_thryvar)-->T34(Stat9*) ==> rk_thryvar in next(rk(x0))
			(rk(x0),rk_thryvar)-->T36(Stat10*) ==> Stat11: rk_thryvar ¥incin rk(x0)
			(0,rk_thryvar,rk(x0))-->T859(Stat11*) ==> cumstr(0,rk_thryvar) ¥incin cumstr(0,rk_thryvar + rk(x0))
			(Stat11*)ELEM ==> rk_thryvar + rk(x0) = rk(x0)
			EQUAL(Stat11) ==> cumstr(0,rk_thryvar) ¥incin cumstr(0,rk(x0))
			(Stat10*)ELEM ==> false
		Discharge ==> cumstr(0,next(rk(x0))) ¥incin cumstr(0,rk_thryvar)
		(rk(x0),x0)-->T867(Stat8*) ==> false
	Discharge ==> AUTO
	Suppose ==> ((x0 - 1) + (1 - x0)) in domain(t)
	TglobalizeMap3 ==> false; Discharge ==> AUTO
	Use_def(qtog_thryvar((x0 - 1) + (1 - x0))) ==> AUTO
	(Stat8*)ELEM ==> qtog_thryvar((x0 - 1) + (1 - x0)) = x0
	TELEM ==> Stat12: 1 /= 0
	(Stat12*)ELEM ==> ((x0 - 1) + (1 - x0)) /= x0
	EQUAL(Stat8) ==> (qtog_thryvar(qtog_thryvar(x0)) = x0) & (qtog_thryvar(x0) /= x0)
	(Stat1*)Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--
-- DISPLAY globalizeMap
--
-- THEORY globalizeMap(t)
--	Svm(t) & (range(t) incs domain(t))
-- ==>(togg_thryvar,qtog_thryvar)
--	Finite(t) ¥imp ((range(t) = domain(t)) & (one_1_map(t)))
--	(FORALL x | togg_thryvar(x) = ((x - 1) + (1 - x)))
--	(FORALL x, y | ((((x - 1) = (y - 1)) & ((x * 1) = (1 - y))) ¥eq (y = togg_thryvar(x))) & ((((x - 1) = (y - 1)) & ((x * 1) = (1 - y))) ¥imp ((((y - 1) = (x - 1)) & ((y * 1) = (1 - x))) & (x /= y))))
--	(FORALL x | (togg_thryvar(togg_thryvar(x)) = x) & (togg_thryvar(x) /= x))
--	(FORALL x,y | (togg_thryvar(0) = 1) & (togg_thryvar(1) = 0) & (togg_thryvar({{x,y}}) = {0,{x,y}}) & ((x /= 0) ¥imp (togg_thryvar({0,x}) = {x})))
--	(FORALL x | (1 in rk(x)) ¥imp (rk(x) = rk((x - 1) + (1 - x))))
--	(FORALL x | (x in domain(t)) ¥imp (qtog_thryvar(x) = t~[x]))
--	(FORALL x | (x notin range(t)) ¥imp ((qtog_thryvar(x) /= x) & (qtog_thryvar(qtog_thryvar(x)) = x)))
-- END globalizeMap
--
THEORY globalizeTog(t)
	Is_tog(t)
END globalizeTog
--
--
ENTER_THEORY globalizeTog
--
Theorem globalizeTog0: Svm(t) & (range(t) = domain(t)). Proof:
Suppose_not ==> AUTO
	Assump ==> Is_tog(t)
	Use_def(Is_tog) ==> Svm(t) & (inv(t) = t)
	EQUAL ==> domain(inv(t)) = domain(t)
	t-->T99(*) ==> false
	Discharge ==> QED
--
	APPLY(qtog_thryvar:tog_thryvar) globalizeMap(t->t) ==>
Theorem globalizeTog1: (FORALL x | (x in domain(t)) ¥imp (tog_thryvar(x) = t~[x])) &
	(FORALL x | (x notin range(t)) ¥imp ((tog_thryvar(x) /= x) & (tog_thryvar(tog_thryvar(x)) = x)))
--
Theorem globalizeTog2: (tog_thryvar(X) /= X) & (tog_thryvar(tog_thryvar(X)) = X). Proof:
Suppose_not(x0) ==> AUTO
	TglobalizeTog1 ==> Stat1: (FORALL x | (x in domain(t)) ¥imp (tog_thryvar(x) = t~[x])) &
		Stat2: (FORALL x | (x notin range(t)) ¥imp ((tog_thryvar(x) /= x) & (tog_thryvar(tog_thryvar(x)) = x)))
	TglobalizeTog0 ==> range(t) = domain(t)
	x0-->Stat2(*) ==> (x0 in domain(t)) & (not(tog_thryvar(x0) /= x0) & (tog_thryvar(tog_thryvar(x0)) = x0))
	x0-->Stat1(Stat1*) ==> tog_thryvar(x0) = t~[x0]
	(x0,t)-->T71(Stat1*) ==> (t~[x0]) in range(t)
	(t~[x0])-->Stat1(Stat1*) ==> tog_thryvar(t~[x0]) = t~[t~[x0]]
	Assump ==> Is_tog(t)
	(t,x0)-->T887(Stat1*) ==> ((t~[x0]) /= x0) & ((t~[t~[x0]]) = x0)
	EQUAL(Stat1) ==> (tog_thryvar(x0) /= x0) & (tog_thryvar(tog_thryvar(x0)) = x0)
	(Stat1*)Discharge ==> QED
--
-- DISPLAY globalizeTog
--
-- THEORY globalizeTog(t)
--	Is_tog(t)
-- ==>(tog_thryvar)
--	(FORALL x | (x in domain(t)) ¥imp (tog_thryvar(x) = t~[x]))
--	(FORALL x | (tog_thryvar(x) /= x) & (tog_thryvar(tog_thryvar(x)) = x))
-- END globalizeTog
--
--
--
Theorem 889: Svm(0) & (range(0) incs domain(0)). Proof:
Suppose_not ==> AUTO
T59 ==> false; Discharge ==> QED
--
	APPLY(togg_thryvar:togg) globalizeMap(t->0) ==>
Theorem 890: (FORALL x | togg(x) = ((x - 1) + (1 - x))) &
	(FORALL x | (togg(togg(x)) = x) & (togg(x) /= x)) &
	(FORALL x | (1 in rk(x)) ¥imp (rk(x) = rk((x - 1) + (1 - x)))) &
	(FORALL x, y | (togg(0) = 1) & (togg(1) = 0) & (togg({{x,y}}) = {0,{x,y}}) & ((x /= 0) ¥imp (togg({0,x}) = {x})))
--
Theorem 891: [specification of formal negative] togg(X) = ((X - 1) + (1 - X)). Proof:
Suppose_not(x) ==> AUTO
	T890(*) ==> Stat1: (FORALL x | togg(x) = ((x - 1) + (1 - x)))
	x-->Stat1(*) ==> false
	Discharge ==> QED
--
Theorem 892: [formal negative and affirmative have the same rank] (1 in rk(X)) ¥imp (rk(X) = rk((X - 1) + (1 - X))). Proof:
Suppose_not(x) ==> AUTO
	T890(*) ==> Stat1: (FORALL x | (1 in rk(x)) ¥imp (rk(x) = rk((x - 1) + (1 - x))))
	x-->Stat1(*) ==> false
	Discharge ==> QED
--
Theorem 893: [double negation affirms] (togg(togg(X)) = X) & (togg(X) /= X). Proof:
Suppose_not(x) ==> AUTO
	T890(*) ==> Stat1: (FORALL x | (togg(togg(x)) = x) & (togg(x) /= x))
	x-->Stat1(*) ==> false
	Discharge ==> QED
--
--
--
Theorem 894: [negation of special sets] (togg(0) = 1) & (togg(1) = 0) & (togg({{X,Y}}) = {0,{X,Y}}) & ((X /= 0) ¥imp (togg({0,X}) = {X})). Proof:
Suppose_not(x,y) ==> AUTO
	T890(*) ==> Stat1: (FORALL x, y | (togg(0) = 1) & (togg(1) = 0) & (togg({{x,y}}) = {0,{x,y}}) & ((x /= 0) ¥imp (togg({0,x}) = {x})))
	(x,y)-->Stat1(*) ==> false
	Discharge ==> QED
--
--
--
Def 15003: [literals associated with any set $C$, viewed as an alphabet] signedSymbs(C) := {b + {{g}} : b ¥incin 1, g in C}
--
Def 15004: [atomic symbol underlying a literal] atm(X) := arb(arb(X - 1))
--
--
--
Theorem 895: [unsigned symbol retrieval from literal] (B ¥incin 1) ¥imp (atm(B + {{G}}) = G). Proof:
Suppose_not(b,g) ==> AUTO
	Use_def(atm)(*) ==> Stat1: (arb(arb((b + {{g}}) - 1)) /= g) & (b ¥incin 1)
	TELEM ==> 1 = {0}
	(Stat1*)ELEM ==> Stat2: (b = 0) or (b = {0})
	Suppose ==> Stat3: ((b + {{g}}) - {0}) /= {{g}}
		(Stat2*)ELEM ==> b = {0}
		EQUAL(Stat3) ==> Stat4: (({0} + {{g}}) - {0}) /= {{g}}
	(Stat4*)Discharge ==> ((b + {{g}}) - {0}) = {{g}}
	EQUAL(Stat1) ==> Stat5: arb(arb({{g}})) /= g
	(Stat5)Discharge ==> QED
--
--
--
Theorem 896:  [sign removal from literal] (atm(togg(X)) = atm(X)) & ((X in signedSymbs(C)) ¥imp (atm(X) in C)). Proof:
Suppose_not(x,c) ==> AUTO
	Suppose ==> atm(togg(x)) /= atm(x)
		Use_def(atm)(*) ==> arb(arb(togg(x) - 1)) /= arb(arb(x - 1))
		x-->T891(*) ==> togg(x) = ((x-1)+(1-x))
		EQUAL ==> arb(arb(((x-1)+(1-x)) - 1)) /= arb(arb(x - 1))
		TELEM ==> (((x-1)+(1-x)) - 1) = x - 1
	EQUAL ==> false; Discharge ==> (x in signedSymbs(c)) & (atm(x) notin c)
	Use_def(signedSymbs)(*) ==> Stat1: x in {b + {{g}} : b ¥incin 1, g in c}
	(b,g)-->Stat1(Stat1*) ==> Stat2: (b ¥incin 1) & (g in c) & (x = b + {{g}})
	EQUAL ==> atm(b + {{g}}) notin c
	(b,g)-->T895(Stat2*) ==> false
	Discharge ==> QED
--
--
--
Theorem 897: [equal literals share the same atom] (((B + {H}) = (D + {K})) & (B in {0,{0}}) & (K /= 0)) ¥imp (H = K). Proof:
Suppose_not(b,h,d,k) ==> AUTO
	Discharge ==> QED
--
--
--
Theorem 898: [literals associated with a singleton alphabet] (signedSymbs(0) = 0) & (signedSymbs({G}) = {{{G}},togg({{G}})}). Proof:
Suppose_not(gp) ==> AUTO
	Suppose ==> Stat1: signedSymbs(0) /= 0
		Use_def(signedSymbs)(Stat1*) ==> Stat2: {b + {{g}} : b ¥incin 1, g in 0} /= 0
	(b0,g0)-->Stat2(Stat2*) ==> false; Discharge ==> Stat3: signedSymbs({gp}) /= {{{gp}},togg({{gp}})}
	(gp,gp)-->T894(Stat3*) ==> togg({{gp,gp}}) = {0,{gp,gp}}
	TELEM ==> {gp,gp} = {gp}
	EQUAL ==> togg({{gp}}) = {0,{gp}}
	EQUAL(Stat3) ==> signedSymbs({gp}) /= {{{gp}},{0,{gp}}}
	Use_def(signedSymbs) ==> Stat4: {b + {{g}} : b ¥incin 1, g in {gp}} /= {{{gp}},{0,{gp}}}
	c-->Stat4(Stat4*) ==> (c in {b + {{g}} : b ¥incin 1, g in {gp}}) ¥eq (c notin {{{gp}},{0,{gp}}})
	TELEM ==> 1 = {0}
	EQUAL(Stat4) ==> Stat5: (c in {b + {{g}} : b ¥incin {0}, g in {gp}}) ¥eq (c notin {{{gp}},{0,{gp}}})
	Suppose ==> Stat6: c in {b + {{g}} : b ¥incin {0}, g in {gp}}
		(b,g)-->Stat6(Stat5*) ==> (c = b + {{g}}) & (b in {0,{0}}) & (g = gp) & (c notin {{{gp}},{0,{gp}}})
		Suppose ==> b = 0
		(Stat6*)Discharge ==> b /= 0
	(Stat6*)Discharge ==> (c in {{{gp}},{0,{gp}}}) & Stat7: (c notin {b + {{g}} : b ¥incin {0}, g in {gp}})
	Suppose ==> Stat8: c = {{gp}}
	(0,gp)-->Stat7(Stat8*) ==> false; Discharge ==> Stat9: c = {0,{gp}}
	({0},gp)-->Stat7(Stat9*) ==> false
	Discharge ==> QED
--
--
--
Theorem 899: [literals over disjoint alphabets] ((C * D) = 0) ¥imp (((signedSymbs(C) * signedSymbs(D)) = 0) & ((signedSymbs(C) + signedSymbs(D)) = signedSymbs(C + D))). Proof:
Suppose_not(c,d) ==> AUTO
    	Suppose ==> (signedSymbs(c) * signedSymbs(d)) /= 0
		Use_def(signedSymbs)(*) ==> Stat1: (({b + {{g}} : b ¥incin 1, g in c} * {b + {{g}} : b ¥incin 1, g in d}) /= 0) & ((c * d) = 0)
		h-->Stat1(Stat1*) ==> Stat2: (h in {b + {{g}} : b ¥incin 1, g in c}) & (h in {b + {{g}} : b ¥incin 1, g in d})
		TELEM ==> 1 = {0}
		(b,g,bp,gp)-->Stat2(Stat2*) ==> Stat3: ((b + {{g}}) = (bp + {{gp}})) & (b in {0,{0}}) & (g in c) & (gp in d)
--
-- However, this yields that $g = gp$, contradicting the disjointness of $c,d$.
--
	(b,{g},bp,{gp})-->T897(Stat1*) ==> false; Discharge ==> Stat4: (signedSymbs(c) + signedSymbs(d)) /= signedSymbs(c + d)
	Use_def(signedSymbs)(Stat4*) ==> Stat5: (({b + {{g}} : b ¥incin 1, g in c} + {b + {{g}} : b ¥incin 1, g in d}) /= {b + {{g}} : b ¥incin 1, g in (c + d)}) & ((c * d) = 0)
	e-->Stat5(Stat5*) ==> Stat6: ((e in {b + {{g}} : b ¥incin 1, g in c}) or (e in {b + {{g}} : b ¥incin 1, g in d})) ¥eq (e notin {b + {{g}} : b ¥incin 1, g in (c + d)})
        Suppose ==> Stat7: e in {b + {{g}} : b ¥incin 1, g in c}
		(b1,g1)-->Stat7(Stat6*) ==> Stat8: (b1 ¥incin 1) & (g1 in c) & Stat9: ((b1 + {{g1}}) notin {b + {{g}} : b ¥incin 1, g in (c + d)})
	(b1,g1)-->Stat9(Stat8*) ==> false; Discharge ==> Stat10: e notin {b + {{g}} : b ¥incin 1, g in c}
        Suppose ==> Stat11: e in {b + {{g}} : b ¥incin 1, g in d}
		(b2,g2)-->Stat11(Stat5*) ==> Stat12: (b2 ¥incin 1) & (g2 in d) & Stat13: ((b2 + {{g2}}) notin {b + {{g}} : b ¥incin 1, g in (c + d)})
	(b2,g2)-->Stat13(Stat12*) ==> false; Discharge ==> e notin {b + {{g}} : b ¥incin 1, g in d}
	(Stat5*)ELEM ==> Stat14: (e in {b + {{g}} : b ¥incin 1, g in (c + d)})
	(b3,g3)-->Stat14(Stat10*) ==> Stat15: (b3 ¥incin 1) & (g3 in (c + d)) & Stat16: ((b3 + {{g3}}) notin {b + {{g}} : b ¥incin 1, g in c}) & Stat17: (b3 + {{g3}} notin {b + {{g}} : b ¥incin 1, g in d})
	Suppose ==> g3 in c
	(b3,g3)-->Stat16(Stat15*) ==> false; Discharge ==> g3 in d
	(b3,g3)-->Stat17(Stat15*) ==> false
	Discharge ==> QED
--
--
--
Theorem 900: [decomposition of the set of all literals over a nonnull set] (C /= 0) ¥imp (signedSymbs(C) = {{{arb(C)}},togg({{arb(C)}})} + signedSymbs(C - {arb(C)})). Proof:
Suppose_not(c) ==> AUTO
	c-->T0(*) ==> c = ({arb(c)} + (c - {arb(c)}))
	({arb(c)},c - {arb(c)})-->T899(*) ==> (signedSymbs({arb(c)}) + signedSymbs(c - {arb(c)})) = signedSymbs({arb(c)} + (c - {arb(c)}))
	(arb(c))-->T898(*) ==> signedSymbs({arb(c)}) = {{{arb(C)}},togg({{arb(C)}})}
	EQUAL ==> false
	Discharge ==> QED
--
--
--
THEORY signedSymbols(atms)
--
-- This theory receives a set $atms$ of which it will univocally convert
-- every element $x$ into a positive literal by the affirmation operation
-- $aff_thryvar(x)$ and into a negative literal by the negation operation
-- $neg_thryvar(aff_thryvar(x))$, where $neg_thryvar$ is a Galois correspondence.
-- For a finite set $atms$, positive integer encodings and their negatives
-- would suffice, but a more general approach will be taken here, and
-- $aff_thryvar,neg_thryvar$ will be defined globally. Along with the functions
-- $aff_thryvar,neg_thryvar$, this theory returns a collection $lits_thryvar$ of
-- positive and negative literals including all the affirmed and negated images
-- of the "symbols" in $atms$. Moreover, it returns a designation $false_thryvar$
-- for falsehood such that the pair $false_thryvar,neg_thryvar(false_thryvar)$
-- of complementary truth values does not intersect $lits_thryvar$. All literals,
-- as well as the logical constants, will share the same rank exceeding
-- the ordinal $Za$.
--
END signedSymbols
--
ENTER_THEORY signedSymbols
--
Def signedSymbols1: aff_thryvar(X) := {{X,atms + Za}}
--
Def signedSymbols2: neg_thryvar(X) := togg(X)
--
Def signedSymbols3: lits_thryvar := {b + {{x,atms + Za}}: b ¥incin 1, x in atms}
--
Def signedSymbols4: false_thryvar := {{atms + Za}}
--
--
--
Theorem signedSymbols1: [affirmation is one-one] (X /= Y) ¥imp (aff_thryvar(x) /= aff_thryvar(y)). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(aff_thryvar) ==> Stat1: (x /= y) & ({{x,atms + Za}} = {{y,atms + Za}})
	(Stat1*)Discharge ==> QED
--
Theorem signedSymbols2: [negation is a Galois correspondence] (neg_thryvar(neg_thryvar(X)) = X) & (neg_thryvar(X) /= X). Proof:
Suppose_not(x) ==> AUTO
	Use_def(neg_thryvar) ==> Stat1: not((togg(togg(x)) = x) & (togg(x) /= x))
	x-->T893(Stat1*) ==> false; Discharge ==> QED
--
Theorem signedSymbols3: [positive and negative literals do not intersect] aff_thryvar(X) /= neg_thryvar(aff_thryvar(Y)). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(aff_thryvar(x)) ==> AUTO
	Use_def(aff_thryvar(y)) ==> AUTO
	Use_def(neg_thryvar({{y, atms + Za}})) ==> AUTO
	(y,atms + Za)-->T894 ==> togg({{y, atms + Za}}) = {0,{y, atms + Za}}
	EQUAL ==> {{x,atms + Za}} = {0,{y, atms + Za}}
	TELEM ==> 0 /= {x, atms + Za}
	Discharge ==> QED
--
Theorem signedSymbols4: [affirmation of an atom produced a literal] {aff_thryvar(x): x in atms} ¥incin lits_thryvar. Proof:
Suppose_not ==> Stat1: not ({aff_thryvar(x): x in atms} ¥incin lits_thryvar)
	h-->Stat1 ==> Stat2: (h in {aff_thryvar(x): x in atms}) & (h notin lits_thryvar)
	x-->Stat2 ==> Stat3: (x in atms) & (aff_thryvar(x) notin lits_thryvar)
	Use_def(aff_thryvar) ==> aff_thryvar(x) = {{x, atms + Za}}
	Use_def(lits_thryvar) ==> Stat4: {{x, atms + Za}} notin {b + {{x, atms + Za}}: b ¥incin 1, x in atms}
	(0,x)-->Stat4 ==> false
	Discharge ==> QED
--
Theorem signedSymbols5: [literals are closed under negation] {neg_thryvar(x): x in lits_thryvar} = lits_thryvar. Proof:
Suppose_not ==> AUTO
	Suppose ==> Stat1: {neg_thryvar(x): x in lits_thryvar} ¥nincin lits_thryvar
		n-->Stat1(Stat1*) ==> Stat2: (n in {neg_thryvar(x): x in lits_thryvar}) & (n notin lits_thryvar)
		h-->Stat2(Stat2*) ==> Stat3: (h in lits_thryvar) & (neg_thryvar(h) notin lits_thryvar)
		Use_def(lits_thryvar)(*) ==> Stat4: h in {b + {{x, atms + Za}}: b ¥incin 1, x in atms} &
			Stat5: neg_thryvar(h) notin {b + {{x, atms + Za}}: b ¥incin 1, x in atms}
		(b,x)-->Stat4(Stat4*) ==> Stat6: (x in atms) & (b ¥incin 1) & (h = b + {{x, atms + Za}})
--
-- For some reason, the following Suppose did not work, and I had to resort to a direct argument
--
--??		Suppose ==> {{x, atms + Za}} - 1 /= {{x, atms + Za}}
--			TELEM ==> 1 = {0}
--			EQUAL(Stat6) ==> Stat7: {{x, atms + Za}} - {0} /= {{x, atms + Za}}
--			(Stat7*)ELEM ==> 0 = {x, atms + Za}
--		Discharge ==> AUTO
		TELEM ==> Stat7: 1 = {0}
		TELEM ==> 0 /= {x, atms + Za}
		(Stat7*)ELEM ==> {{x, atms + Za}} - 1 = {{x, atms + Za}}
		h-->T891(*) ==> togg(h) = ((h-1)+(1-h))
		Use_def(neg_thryvar) ==> neg_thryvar(h) = (1 - b) + {{x, atms + Za}}
		(1 - b, x)-->Stat5(Stat6*) ==> false
	Discharge ==> Stat8: ({neg_thryvar(x): x in lits_thryvar} ¥incin lits_thryvar) &
			Stat9: (lits_thryvar ¥nincin {neg_thryvar(x): x in lits_thryvar})
	c-->Stat9(Stat8*) ==> Stat10: (c in lits_thryvar) & (c notin {neg_thryvar(x): x in lits_thryvar})
		c-->TsignedSymbols2(Stat10*) ==> Stat11: neg_thryvar(neg_thryvar(c)) notin {neg_thryvar(x): x in lits_thryvar}
		(neg_thryvar(c))-->Stat11(Stat8*) ==> Stat12: neg_thryvar(c) notin {neg_thryvar(x): x in lits_thryvar}
		c-->Stat12(Stat10*) ==> false
	Discharge ==> QED
--
Theorem signedSymbols6: false_thryvar notin lits_thryvar. Proof:
Suppose_not ==> AUTO
	Use_def(false_thryvar) ==> {{atms + Za}} in lits_thryvar
	Use_def(lits_thryvar) ==> Stat1: {{atms + Za}} in {b + {{x, atms + Za}}: b ¥incin 1, x in atms}
	TELEM ==> 1 = {0}
	(b,x)-->Stat1(Stat1*) ==> Stat2: ({{atms + Za}} = b + {{x, atms + Za}}) & (b ¥incin {0}) & (x in atms)
	Suppose ==> b = {0}
		(Stat2*)ELEM ==> Stat3: 0 in {{atms + Za}}
	(Stat3*)Discharge ==> AUTO
	(Stat2*)Discharge ==> QED
--
Theorem signedSymbols7: {rk(x): x in lits_thryvar} ¥incin {rk(false_thryvar)}. Proof:
Suppose_not ==> Stat1: {rk(x): x in lits_thryvar} ¥nincin {rk(false_thryvar)}
	({atms + Za})-->T849(*) ==> Stat2: rk({{atms + Za}}) = next(rk({atms + Za}))
	Use_def(false_thryvar) ==> false_thryvar = {{atms + Za}}
	EQUAL(Stat2) ==> rk(false_thryvar) = next(rk({atms + Za}))
	Suppose ==> rk({0,{atms + Za}}) /= next(rk({atms + Za}))
		(0,{atms + Za})-->T851(Stat2*) ==> Stat3: rk({0,{atms + Za}}) = next(rk(0)) + next(rk({atms + Za}))
		0-->T848 ==> rk(0) = 0
		Use_def(1) ==> 1 = next(0)
		EQUAL(Stat3) ==> Stat4: rk({0,{atms + Za}}) = 1 + next(rk({atms + Za}))
		({atms + Za})-->T854 ==> AUTO
		(rk({atms + Za}))-->T32(Stat3*) ==> Ord(next(rk({atms + Za})))
		T211 ==> Card(1)
		Use_def(Card) ==> Ord(1)
		Use_def(next) ==> next(rk({atms + Za})) /= 0
		TELEM ==> 1 = {0}
		(1,next(rk({atms + Za})))-->T29(Stat4*) ==> rk({0,{atms + Za}}) = next(rk({atms + Za}))
	Discharge ==> Stat5: rk({0,{atms + Za}}) = next(rk({atms + Za}))
	r0-->Stat1(Stat1*) ==> Stat6: (r0 in {rk(x): x in lits_thryvar}) & (r0 /= rk(false_thryvar))
	x0-->Stat6(Stat6*) ==> Stat7: (x0 in lits_thryvar) & (rk(x0) /= rk(false_thryvar))
	Use_def(lits_thryvar)(Stat7*) ==> Stat8: x0 in {b + {{x,atms + Za}}: b ¥incin 1, x in atms}
	TELEM ==> 1 = {0}
	(b1,x1)-->Stat8(Stat8*) ==> (b1 in {0,{0}}) & (x1 in atms) & (x0 = b1 + {{x1,atms + Za}})
	(b1,{{x1,atms + Za}})-->T850(Stat8*) ==> rk(b1 + {{x1,atms + Za}}) = rk(b1) + rk({{x1,atms + Za}})
	({x1,atms + Za})-->T849(Stat8*) ==> rk({{x1,atms + Za}}) = next(rk({x1,atms + Za}))
	(x1,atms + Za)-->T851(Stat8*) ==> Stat9: rk({x1,atms + Za}) = next(rk(x1)) + next(rk(atms + Za))
	(x1,atms + Za)-->T852(Stat8*) ==> rk(x1) in rk(atms + Za)
--
-- Since, by Theorem 854, $rk(x1)$ and $rk(atms + Za)$ are ordinals,
-- and the former belongs to the latter,
-- $next(rk(x1))$ is included in $rk(atms + Za)$.
--
	(atms + Za)-->T854 ==> AUTO
	Use_def(next(rk(atms + Za))) ==> AUTO
	(rk(atms + Za),rk(x1))-->T37(Stat9*) ==> rk({x1,atms + Za}) = next(rk(atms + Za))
	(atms + Za)-->T849(Stat9*) ==> rk({atms + Za}) = next(rk(atms + Za))
	EQUAL(Stat8) ==> rk(x0) = rk(b1) + next(rk({atms + Za}))
	Suppose ==> b1 = 0
		b1-->T848(*) ==> false
	Discharge ==> b1 = {0}
	EQUAL(Stat2) ==> rk(x0) = rk({0}) + rk({{atms + Za}})
	({0},{{atms + Za}})-->T850(Stat9*) ==> rk({0} + {{atms + Za}}) = rk({0}) + rk({{atms + Za}})
	TELEM ==> {0} + {{atms + Za}} = {0,{atms + Za}}
	EQUAL(Stat5) ==> rk(x0) = next(rk({atms + Za}))
	Discharge ==> QED
--
--Theorem signedSymbols7a: (X in lits_thryvar + {neg_thryvar(false_thryvar)}) ¥imp (rk(X) = rk(false_thryvar)). Proof:
--Suppose_not(x0) ==> AUTO
--	({atms + Za})-->T849(*) ==> Stat1: rk({{atms + Za}}) = next(rk({atms + Za}))
--	Use_def(false_thryvar) ==> false_thryvar = {{atms + Za}}
--	EQUAL(Stat1) ==> rk(false_thryvar) = next(rk({atms + Za}))
--	Suppose ==> rk({0,{atms + Za}}) /= next(rk({atms + Za}))
--		(0,{atms + Za})-->T851(Stat1*) ==> Stat2: rk({0,{atms + Za}}) = next(rk(0)) + next(rk({atms + Za}))
--		0-->T848 ==> rk(0) = 0
--		Use_def(1) ==> 1 = next(0)
--		EQUAL(Stat2) ==> Stat3: rk({0,{atms + Za}}) = 1 + next(rk({atms + Za}))
--		({atms + Za})-->T854 ==> AUTO
--		(rk({atms + Za}))-->T32(Stat2*) ==> Ord(next(rk({atms + Za})))
--		T211 ==> Card(1)
--		Use_def(Card) ==> Ord(1)
--		Use_def(next) ==> next(rk({atms + Za})) /= 0
--		TELEM ==> 1 = {0}
--		(1,next(rk({atms + Za})))-->T29(Stat3*) ==> rk({0,{atms + Za}}) = next(rk({atms + Za}))
--	Discharge ==> Stat4: rk({0,{atms + Za}}) = next(rk({atms + Za}))
--	Suppose ==> x0 = neg_thryvar(false_thryvar)
--		Use_def(neg_thryvar) ==> neg_thryvar(false_thryvar) = togg(false_thryvar)
--		(atms + Za,atms + Za)-->T894(Stat1*) ==> Stat5: togg({{atms + Za,atms + Za}}) = {0,{atms + Za,atms + Za}}
--		TELEM ==> {atms + Za,atms + Za} = {atms + Za}
--		EQUAL(Stat5) ==> togg({{atms + Za}}) = {0,{atms + Za}}
--		EQUAL(Stat1) ==> rk(x0) = rk({0,{atms + Za}})
--		EQUAL(Stat4) ==> rk(x0) = next(rk({atms + Za}))
--	Discharge ==> x0 in lits_thryvar
--	Use_def(lits_thryvar) ==> Stat6: x0 in {b + {{x,atms + Za}}: b ¥incin 1, x in atms}
--	TELEM ==> 1 = {0}
--	(b1,x1)-->Stat6(Stat6*) ==> (b1 in {0,{0}}) & (x1 in atms) & (x0 = b1 + {{x1,atms + Za}})
--	(b1,{{x1,atms + Za}})-->T850(Stat6*) ==> rk(b1 + {{x1,atms + Za}}) = rk(b1) + rk({{x1,atms + Za}})
--	({x1,atms + Za})-->T849(Stat6*) ==> rk({{x1,atms + Za}}) = next(rk({x1,atms + Za}))
--	(x1,atms + Za)-->T851(Stat6*) ==> Stat7: rk({x1,atms + Za}) = next(rk(x1)) + next(rk(atms + Za))
--	(x1,atms + Za)-->T852(Stat6*) ==> rk(x1) in rk(atms + Za)
--
-- -- Since, by Theorem 854, $rk(x1)$ and $rk(atms + Za)$ are ordinals,
-- -- and the former belongs to the latter,
-- -- $next(rk(x1))$ is included in $rk(atms + Za)$.
--
--	(atms + Za)-->T854 ==> AUTO
--	Use_def(next(rk(atms + Za))) ==> AUTO
--	(rk(atms + Za),rk(x1))-->T37(Stat7*) ==> rk({x1,atms + Za}) = next(rk(atms + Za))
--	(atms + Za)-->T849(Stat7*) ==> rk({atms + Za}) = next(rk(atms + Za))
--	EQUAL(Stat6) ==> rk(x0) = rk(b1) + next(rk({atms + Za}))
--	Suppose ==> b1 = 0
--		b1-->T848(*) ==> false
--	Discharge ==> b1 = {0}
--	EQUAL(Stat1) ==> rk(x0) = rk({0}) + rk({{atms + Za}})
--	({0},{{atms + Za}})-->T850(Stat7*) ==> rk({0} + {{atms + Za}}) = rk({0}) + rk({{atms + Za}})
--	TELEM ==> {0} + {{atms + Za}} = {0,{atms + Za}}
--	EQUAL(Stat4) ==> rk(x0) = next(rk({atms + Za}))
--	Discharge ==> QED
--
--
Theorem signedSymbols8: (N in next(Za)) ¥imp (N in rk(false_thryvar)). Proof:
Suppose_not(n0) ==> AUTO
--
-- For, assuming $n0$ to be a counterexample, by taking into account the definition
-- of $rk(false_thryvar)$, we would have $n0 in next(Za)$ and $n0 notin next(next(rk(atms) + Za))$.
-- But then, $rk(atms) + Za$ would be an ordinal not smaller than $Za$, and therefore
-- $next(rk(atms) + Za)$ would be an ordinal not smaller than $next(Za)$, and therefore
-- the ordinal $n0$ would belong to $next(rk(atms) + Za)$ and to $next(next(rk(atms) + Za))$.
-- The resulting contradiction proves the desired claim.
--
	Use_def(false_thryvar) ==> n0 notin rk({{atms + Za}})
	({atms + Za})-->T849 ==> AUTO
	(atms + Za)-->T849 ==> AUTO
	(atms,Za)-->T850 ==> AUTO
	Za-->T856 ==> AUTO
	T206(*) ==> Stat1: Ord(Za) & (Za = rk(Za)) & (n0 in next(Za))
	EQUAL ==> Stat2: n0 notin next(next(rk(atms) + Za))
	atms-->T854 ==> AUTO
	(rk(atms),Za)-->T30 ==> AUTO
	(rk(atms) + Za)-->T32(Stat1*) ==> Stat3: Ord(next(rk(atms) + Za))
	(Za,n0)-->T36(Stat1,Stat1*) ==> Stat4: (n0 ¥incin (rk(atms) + Za)) & Ord(n0)
	Use_def(next)(Stat4*) ==> n0 ¥incin next(rk(atms) + Za)
	(next(rk(atms) + Za),n0)-->T36(Stat3*) ==> Stat5: n0 in next(next(rk(atms) + Za))
	(Stat2,Stat5*)Discharge ==> QED
--
Theorem signedSymbols9: (rk(X) notin rk(false_thryvar)) ¥imp (rk(neg_thryvar(X)) = rk(X)). Proof:
Suppose_not(x0) ==> (rk(x0) notin rk(false_thryvar)) & (rk(neg_thryvar(x0)) /= rk(x0))
	x0-->T891 ==> AUTO
	Use_def(neg_thryvar(x0)) ==> AUTO
	EQUAL ==> Stat1: (rk(x0) notin rk(false_thryvar)) & (rk((x0 - 1) + (1 - x0)) /= rk(x0))
	x0-->T892(Stat1*) ==> Stat2: 1 notin rk(x0)
	1-->TsignedSymbols8 ==> AUTO
	TELEM ==> 1 in Za
	Use_def(next)(Stat2*) ==> 1 in rk(false_thryvar)
--
-- Now, since $rk(x0)$ and $rk(false_thryvar)$ are ordinals, by
-- Theorem 854, and since the former is not smaller than the latter,
-- the latter is included in the former, which implies $1 in rk(x0)$,
-- a contradiction.
--
	x0-->T854 ==> AUTO
	false_thryvar-->T854 ==> AUTO
	(rk(false_thryvar),rk(x0))-->T35(Stat1*) ==> false
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- DISPLAY signedSymbols
--
-- THEORY signedSymbols(atms)
--
-- ==> (aff_thryvar, neg_thryvar, lits_thryvar, false_thryvar)
--
--	(FORALL x, y | (x /= y) ¥imp (aff_thryvar(x) /= aff_thryvar(y)))
--
--	(FORALL x | (neg_thryvar(neg_thryvar(x)) = x) & (neg_thryvar(x) /= x))
--
--	(FORALL x, y | aff_thryvar(x) /= neg_thryvar(aff_thryvar(y)))
--
--	{aff_thryvar(x): x in atms} ¥incin lits_thryvar
--
--	{neg_thryvar(x): x in lits_thryvar} = lits_thryvar
--
--	false_thryvar notin lits_thryvar
--
--	{rk(x): x in lits_thryvar} ¥incin {rk(false_thryvar)}
--
--	(FORALL n | (n in next(Za)) ¥imp (n in rk(false_thryvar)))
--
--	(FORALL x | (rk(x) notin rk(false_thryvar)) ¥imp (rk(neg_thryvar(x)) = rk(x)))
--
-- END signedSymbols
--
--
THEORY cnfModels(tog(X))
--
-- This theory receives a global Galois correspondence $tog(x)$, and will
-- introduce corresponding notions of models and satisfiability of propositional
-- conjunctive normal forms. Moreover it proves various lemmas enabling
-- reduction of an instance of the satifiability/modeling problem for
-- conjunctive normal forms to a simpler instance of the same problem.
-- These correspond to the tautology elimination rule, and to the unit literal
-- rule, pure literal rule, and splitting rule of the classical Davis-Putnam
-- algorithm.
--
	(FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
--
END cnfModels
--
--
ENTER_THEORY cnfModels
--
Def cnfModels1: [model of a conjunctive normal form, represented as a set of sets of literals]
	Has_cnfModel_thryvar(S,M) := ({h in M | tog(h) in M} = 0) & ({c in S | (M * c) = 0} = 0)
--
Def cnfModels2: [satisfiability of a conjunctive normal form, represented as a set of sets of literals]
	Is_cnfSat_thryvar(S) := (EXISTS m | Has_cnfModel_thryvar(S,m))
--
--
--
Theorem cnfModels0: [assumption concerning tog] (tog(tog(X)) = X) & (tog(X) /= X). Proof:
Suppose_not(x) ==> AUTO
	Assump ==> Stat1: (FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
	x-->Stat1 ==> false; Discharge ==> QED
--
--
--
Theorem cnfModels1: [property of the models of $0$] Has_cnfModel_thryvar(0,M) ¥eq ({h in M | tog(h) in M} = 0). Proof:
Suppose_not(m0) ==> AUTO
	Use_def(Has_cnfModel_thryvar)(*) ==> Stat1: {c in 0 | (m0 * c) = 0} /= 0
	c-->Stat1(Stat1*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels2: [blatant truth, manifest absurdity] Has_cnfModel_thryvar(0,0) & Is_cnfSat_thryvar(0) & ((0 in S) ¥imp (not(Is_cnfSat_thryvar(S)))). Proof:
Suppose_not(s) ==> AUTO
	Suppose ==> Stat1: not(Has_cnfModel_thryvar(0,0))
		0-->TcnfModels1(Stat1*) ==> Stat2: {h in 0 | tog(h) in 0} /= 0
	h0-->Stat2(Stat2*) ==> false; Discharge ==> Stat3: Has_cnfModel_thryvar(0,0)
	Suppose ==> not(Is_cnfSat_thryvar(0))
		Use_def(Is_cnfSat_thryvar)(*) ==> Stat4: (not(EXISTS m | Has_cnfModel_thryvar(0,m)))
	0-->Stat4(Stat3*) ==> false; Discharge ==> Stat5: (0 in s) & (Is_cnfSat_thryvar(s))
	Use_def(Is_cnfSat_thryvar)(Stat5*) ==> Stat6: (EXISTS m | Has_cnfModel_thryvar(s,m))
	m-->Stat6(Stat6*) ==> Stat7: Has_cnfModel_thryvar(s,m)
	Use_def(Has_cnfModel_thryvar)(Stat7*) ==> Stat8: {c in s | (m * c) = 0} = 0
	0-->Stat8(Stat5,Stat5*) ==> false
	Discharge ==> QED
--
-- Although not obviously true, like $0$, any set $s$ which contains no pair of
-- complementary literals is trivially satisfiable.
--
Theorem cnfModels3: [plain satisfiability] (({h in Un(S) | tog(h) in Un(S)} = 0) & (0 notin S)) ¥imp (Has_cnfModel_thryvar(S,Un(S)) & Is_cnfSat_thryvar(S)). Proof:
Suppose_not(s) ==> AUTO
--
-- For, assuming $s$ to contradict this assertion, we readily get that $Un(s)$ is not
-- a model of $s$; but then, $Un(s)$ must fail to intersect some $c$ belonging to $s$.
--
	Suppose ==> Has_cnfModel_thryvar(s,Un(s))
		Use_def(Is_cnfSat_thryvar) ==> Stat1: not(EXISTS m | Has_cnfModel_thryvar(s,m))
		(Un(s))-->Stat1 ==> false
	Discharge ==> AUTO
	Use_def(Has_cnfModel_thryvar) ==> Stat2: {c in s | (Un(s) * c) = 0} /= 0
	Use_def(Un(s)) ==> AUTO
	c-->Stat2 ==> Stat3: (arb(c) notin {h: d in s, h in d}) & (c in s) & (arb(c) in c)
--
-- Since such a $c$ cannot be $0$, any of its elements belongs to $Un(s)$, and we
-- get a contradiction which proves the desired statement.
--
	(c,arb(c))-->Stat3(Stat3*) ==> false
	Discharge ==> QED
--
-- As a consequence of the preceding theorem any set $s$ which consists of its singletons
-- none of which has its complement in $s$ is satisfiable.
--
Theorem cnfModels4: [plain satisfiability, 2] ({u: u in S, h in u | (u = {h}) & ({h,tog(h)} * Un(S - {u}) = 0)} incs S) ¥imp (Has_cnfModel_thryvar(S,Un(S)) & Is_cnfSat_thryvar(S)). Proof:
Suppose_not(s) ==> AUTO
--
-- For, assuming $s$ to contradict this assertion, we easily get that $s$ meets the hypotheses of
-- the preceding theorem. From this we derive a contradiction giving the desired conclusion.
--
	Suppose ==> 0 in s
		ELEM ==> Stat1: 0 in {u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)}
		(u,h)-->Stat1 ==> false
	Discharge ==> 0 notin s
	s-->TcnfModels3 ==> Stat2: {h in Un(s) | tog(h) in Un(s)} /= 0
	Use_def(Un(s)) ==> AUTO
	h0-->Stat2(Stat2*) ==> Stat3: (h0 in {k: c in s, k in c}) & (tog(h0) in {k: c in s, k in c})
	(c0,k0,c1,k1)-->Stat3(Stat3*) ==> Stat4: (c0 in s) & (h0 in c0) & (c1 in s) & (tog(h0) in c1)
	ELEM ==> Stat5: (c0 in {u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)}) &
		(c1 in {u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)})
	(u0,h2,u1,h1)-->Stat5(Stat4*) ==> Stat6: (h0 = h2) & (u0 = {h0}) & (u0 in s) &
		({tog(h0)} in s) & (tog(h2) notin Un(s - {u0}))
	EQUAL(Stat6) ==> Stat7: tog(h0) notin Un(s - {u0})
	(tog(h0),s - {u0})-->T105(Stat7*) ==> Stat8: {c in (s - {u0}) | tog(h0) in c} = 0
	({tog(h0)})-->Stat8(Stat6,Stat6*) ==> Stat9: {tog(h0)} = {h0}
	h0-->TcnfModels0(Stat9*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels5: [cnf model subsumption] ((T ¥incin S) & Has_cnfModel_thryvar(S,M)) ¥imp Has_cnfModel_thryvar(T,M). Proof:
Suppose_not(t,s,m) ==> AUTO
	Use_def(Has_cnfModel_thryvar)(*) ==> Stat1: (t ¥incin s) & ({h in m | tog(h) in m} = 0) & ({c in s | (m * c) = 0} = 0) & ({c in t | (m * c) = 0} /= 0)
	Set_monot ==> {c in t | (m * c) = 0} ¥incin {c in s | (m * c) = 0}
	(Stat1*)Discharge ==> QED
--
--
--
Theorem cnfModels6: [cnf model subsumption,2] ((T ¥incin S) & Is_cnfSat_thryvar(S)) ¥imp Is_cnfSat_thryvar(T). Proof:
Suppose_not(t,s) ==> AUTO
	Use_def(Is_cnfSat_thryvar)(*) ==> Stat1: (EXISTS m | Has_cnfModel_thryvar(s,m)) &
			Stat2: (not (EXISTS m | Has_cnfModel_thryvar(t,m)))
	m-->Stat1 ==> AUTO
	(t,s,m)-->TcnfModels5 ==> AUTO
	m-->Stat2 ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels7: [shrinking of cnf_model] Has_cnfModel_thryvar(S,M) ¥imp Has_cnfModel_thryvar(S, M * Un(S)). Proof:
Suppose_not(s,m) ==> AUTO
	Use_def(Has_cnfModel_thryvar)(*) ==> ({h in m | tog(h) in m} = 0) & ({c in s | (m * c) = 0} = 0) & (({h in (m * Un(s)) | tog(h) in (m * Un(s))} /= 0) or ({c in s | ((m * Un(s)) * c) = 0} /= 0))
	Use_def(Un)(*) ==> Stat1: ({h in m | tog(h) in m} = 0) & Stat2: ({c in s | (m * c) = 0} = 0) & (({h in (m * {h: c in s, h in c}) | tog(h) in (m * {h: c in s, h in c})} /= 0) or ({c in s | ((m * {h: c in s, h in c}) * c) = 0} /= 0))
	Suppose ==> Stat3: {h in (m * {h: c in s, h in c}) | tog(h) in (m * {h: c in s, h in c})} /= 0
		k-->Stat3(Stat3*) ==> Stat4: (k in m) & (tog(k) in m)
	k-->Stat1(Stat4*) ==> false; Discharge ==> Stat5: {c in s | ((m * {h: c in s, h in c}) * c) = 0} /= 0
	d-->Stat5(Stat5*) ==> Stat6: (d in s) & Stat7: (((m * {h: c in s, h in c}) * d) = 0)
	d-->Stat2(Stat6*) ==> Stat8: (m * d) /= 0
	q-->Stat8(Stat8*) ==> q in (m * d)
	Suppose ==> Stat9: q notin {h: c in s, h in c}
	(d,q)-->Stat9(Stat6*) ==> false; Discharge ==> q in {h: c in s, h in c}
	(Stat6*)Discharge ==> QED
--
--
--
Theorem cnfModels8: [broadening of cnf-model] (Has_cnfModel_thryvar(S,M) & ({h in (N - M) | tog(h) in N} = 0) & (M ¥incin N)) ¥imp Has_cnfModel_thryvar(S,N). Proof:
Suppose_not(s,m,n) ==> AUTO
	Use_def(Has_cnfModel_thryvar) ==> Stat1: ({h in m | tog(h) in m} = 0) & Stat2: ({c in s | (m * c) = 0} = 0) & (m ¥incin n) & (({h in n | tog(h) in n} /= 0) or ({c in s | (n * c) = 0} /= 0)) &  Stat3: ({h in (n - m) | tog(h) in n} = 0)
	Suppose ==> Stat4: {h in n | tog(h) in n} /= 0
		k-->Stat4(Stat4*) ==> Stat5: (k in n) & (tog(k) in n)
		Suppose ==> k in (n - m)
		k-->Stat3(Stat5*) ==> false; Discharge ==> k in (n * m )
		k-->Stat1(Stat5*) ==> Stat6: tog(k) in (n - m)
		(tog(k))-->Stat3(Stat6*) ==> Stat7: tog(tog(k)) notin n
	k-->TcnfModels0(Stat5,Stat7*) ==> false; Discharge ==> Stat8: {c in s | (n * c) = 0} /= 0
	c-->Stat8(Stat1,Stat1*) ==> Stat9: (c in s) & ((m * c) = 0)
	c-->Stat2(Stat9*) ==> false
	Discharge ==> QED
--
-- Our next theorem state that if $m$ is a model for some CNF-formula $S$, and
-- if $m1$ results from $m$ by addition of new non-complementary literals, then
-- $m1$ is a model for the null set of clauses.
--
Theorem cnfModels9: [extensibility of models] Has_cnfModel_thryvar(S,M) ¥imp
	Has_cnfModel_thryvar(0, M + {arb({k,tog(k)}): c in T, k in (c - M) | tog(k) in (c - M)}). Proof:
Suppose_not(s,m,t) ==> AUTO
	Loc_def ==> Stat1: m0 = {arb({k,tog(k)}): c in t, k in (c - m) | tog(k) in (c - m)}
	Use_def(Has_cnfModel_thryvar) ==> Stat2: {h in m | tog(h) in m} = 0
	EQUAL ==> (not Has_cnfModel_thryvar(0, m + m0))
	(m + m0)-->TcnfModels1 ==> Stat3: {h in (m + m0) | tog(h) in (m + m0)} /= 0
	h0-->Stat3(Stat3*) ==> (h0 in m + m0) & (tog(h0) in m + m0)
--
-- Since $h0,tog(h0)$ do not belong together to $m$, one of the two belongs to the set
--	${arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}$,
-- while its complement either belongs to this same set or belongs to $m$.
-- All three possibilities will be discarded, one by one, in what follows.
--
	h0-->Stat2(*) ==> (h0 notin m) or (tog(h0) notin m)
	h0-->TcnfModels0 ==> Stat4: (tog(tog(h0)) = h0)  & (tog(h0) /= h0)
	Suppose ==> Stat5: (tog(h0) in m) & Stat6: (h0 in {arb({k,tog(k)}): c in t, k in (c - m) | tog(k) in (c - m)})
		(c0,k0)-->Stat6(Stat5) ==> ((h0 = k0) or (h0 =tog(k0))) & (k0 notin m)  & (tog(k0) notin m)
		Suppose ==> h0 = k0
			EQUAL(Stat4) ==> false
		Discharge ==> h0 = tog(k0)
		EQUAL(Stat4) ==> tog(h0) = tog(tog(k0))
		k0-->TcnfModels0 ==> false
	Discharge ==> AUTO
	Suppose ==> Stat7: (h0 in m) & Stat8: (tog(h0) in {arb({k,tog(k)}): c in t, k in (c - m) | tog(k) in (c - m)})
		(c1,k1)-->Stat8(Stat7) ==> ((tog(h0) = k1) or (tog(h0) = tog(k1))) & (k1 notin m) & (tog(k1) notin m)
		Suppose ==> tog(h0) = k1
			EQUAL(Stat4) ==> false
		Discharge ==> tog(h0) = tog(k1)
		EQUAL(Stat4) ==> tog(tog(h0)) = tog(tog(k1))
		k1-->TcnfModels0 ==> false
	Discharge ==> AUTO
	(Stat1*)ELEM ==> Stat9: (h0 in {arb({k,tog(k)}): c in t, k in (c - m) | tog(k) in (c - m)}) &
		(tog(h0) in {arb({k,tog(k)}): c in t, k in (c - m) | tog(k) in (c - m)})
	(c2,k2,c3,k3)-->Stat9(Stat9*) ==> Stat10: (h0 = arb({k2,tog(k2)})) & (tog(h0) = arb({k3,tog(k3)}))
	({k2, tog(k2)})-->T0(Stat10*) ==> Stat11: (h0 = k2) or (h0 = tog(k2))
	({k3, tog(k3)})-->T0(Stat10*) ==> (tog(h0) = k3) or (tog(h0) = tog(k3))
--
-- We will arrive at a contradiction by showing that $h0 = tog(h0)$
-- because ${k2, tog(k2)} = {k3, tog(k3)}$.
--
-- Firstly, let us show that ${k2, tog(k2)} * {k3, tog(k3)} /= 0$.
--
		Suppose ==> Stat12: {k2, tog(k2)} * {k3, tog(k3)} = 0
			Suppose ==> h0 = k2
				EQUAL(Stat12) ==> tog(h0) = tog(k2)
			(Stat11*)Discharge ==> AUTO
			(Stat11*)ELEM ==> h0 = tog(k2)
			EQUAL(Stat12) ==> tog(h0) = tog(tog(k2))
		k2-->TcnfModels0(Stat11*) ==> false; Discharge ==> Stat13: {k2, tog(k2)} * {k3, tog(k3)} /= 0
--
-- Now we can show that ${k2, tog(k2)} = {k3, tog(k3)}$.
--
		Suppose ==> Stat14: {k2, tog(k2)} /= {k3, tog(k3)}
			Loc_def ==> hh = arb({k2, tog(k2)} * {k3, tog(k3)})
			({k2, tog(k2)} * {k3, tog(k3)})-->T0(Stat13*) ==> Stat15: (hh in {k2, tog(k2)}) & (hh in {k3, tog(k3)})
			Suppose ==> (hh = k2) & (hh = k3)
				EQUAL(Stat15) ==> tog(k2) = tog(k3)
			(Stat14*)Discharge ==> AUTO
			Suppose ==> Stat16: (hh = tog(k2)) & (hh = tog(k3))
				k2-->TcnfModels0(Stat16*) ==> AUTO
				k3-->TcnfModels0(Stat16*) ==> AUTO
				EQUAL(Stat16) ==> k2 = k3
			(Stat14*)Discharge ==> AUTO
 			Suppose ==> Stat17: (hh = k2) & (hh = tog(k3))
				k3-->TcnfModels0(Stat17*) ==> AUTO
				EQUAL(Stat17) ==> tog(k2) = k3
			(Stat14*)Discharge ==> AUTO
			Suppose ==> Stat18: (hh = k3) & (hh = tog(k2))
				k2-->TcnfModels0(Stat18*) ==> AUTO
				EQUAL(Stat18) ==> tog(k3) = k2
			(Stat14*)Discharge ==> AUTO
		(Stat15*)Discharge ==> Stat19: {k2, tog(k2)} = {k3, tog(k3)}
		(Stat4,Stat10,Stat19*)Discharge ==> QED
--
-- The following theorem states that if a CNF-formula $S$ admitting a model $M$ is
-- enriched with a set of tautological clauses, then the resulting conjunction
-- $S1$ has a superset $M1$ of $M$ as a model, where each literal in $M1 - M$
-- belongs, together with its complement, to some tautological clause of $S1 - S$.
--
Theorem cnfModels10: [tautology withdrawal rule] Has_cnfModel_thryvar(S,M) ¥imp
	Has_cnfModel_thryvar(S + {c: c in T, h in c | tog(h) in c},
		M + {arb({h,tog(h)}): c in T, h in (c - M) | tog(h) in (c - M)}). Proof:
Suppose_not(s,m,t) ==> AUTO
--
-- Reasoning by contradiction, assume that $s,m,t$ are a counterexample,
-- so that $m$ is a model for $s$ but its extension
--	$m1 = m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}$
-- fails to be a model for
--	$s1 = s + {c: c in t, h in c | tog(h) in c}$.
-- Then either there are complementary literals $h1,tog(h1)$ in $m1$, or there is
-- some clause in $s1$ which does not intersect $m1$. We readily eliminate the former case,
-- thanks to Theorem cnfModels9.
--
	(s,m,t)-->TcnfModels9 ==> AUTO
	Use_def(Has_cnfModel_thryvar(s + {c: c in t, h in c | tog(h) in c}, m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)})) ==> AUTO
	(m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)})-->TcnfModels1(*) ==> Stat1:
		{c in (s + {c: c in t, h in c | tog(h) in c}) | ((m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}) * c) = 0} /= 0
--
-- We must now analyze the case, ${c in s1 | m1 * c = 0} /= 0$,
-- when some clause $cc$ in $s1$ does not intersect $m1$. We will see that this
-- case leads to a contradiction too.
--
	cc-->Stat1(Stat1*) ==> Stat2: ((cc in s) or (cc in {c: c in t, h in c | tog(h) in c})) &
		(((m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}) * cc) = 0)
--
-- Note that such a clause $cc$ cannot belong to $s$; in fact, assuming the
-- contrary, since $cc * m1 = 0$ and $m1 incs m$, we would obtain $cc * m1 = 0$,
-- conflicting with $m$ being a model of $s$.
--
	Use_def(Has_cnfModel_thryvar) ==> Stat3: {c in s | (m * c) = 0} = 0
	cc-->Stat3(Stat2*) ==> cc notin s
--
-- Therefore $cc$ is a tautological clause in $t$, within which
-- we can find complementary literals $hx,tog(hk)$.
-- Neither $hx in m$ nor $tog(hx) in m$ can hold; else we would have
--	$cc * {hx,tog(hx)} * m /= 0$.
--
	(Stat2*)ELEM ==> Stat4: cc in {c: c in t, h in c | tog(h) in c}
	(cx, hx)-->Stat4(Stat2*) ==> Stat5: (cc in t) & (hx in cc) & (tog(hx) in cc) &
		({hx,tog(hx)} * m = 0)
--
-- We will show that
--	${hx,tog(hx)} * {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)} /= 0$,
-- contrary to Stat6
--
	(Stat2,Stat5*)ELEM ==> Stat7: (hx notin {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}) &
		Stat8: (tog(hx) notin {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)})
	(hx)-->TcnfModels0(Stat7*) ==> Stat9: tog(tog(hx)) = hx
	(cc, hx)-->Stat7(Stat4*) ==> Stat10: hx /= arb({hx,tog(hx)})
	(cc, tog(hx))-->Stat8(Stat4*) ==> tog(hx) /= arb({tog(hx),tog(tog(hx))})
	(Stat9)Discharge ==> QED
--
--
--
Theorem cnfModels11: [preliminary to splitting rule] (Has_cnfModel_thryvar(S,M) & (not Has_cnfModel_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}, M + {H}))) ¥imp (tog(H) in M). Proof:
Suppose_not(s,m,hh) ==> AUTO
--
-- For, assuming the contrary of the desired conclusion to hold for $s,m,hh$,
-- we will find that there is a clause $c1 in s$ which is not modeled by $m$,
-- a contradiction which proves the theorem.
--
	Use_def(Has_cnfModel_thryvar) ==> Stat1: ({h in m | tog(h) in m} = 0) &
			Stat2: ({c in s | (m * c) = 0} = 0) &
			(not (({h in (m + {hh})| tog(h) in (m + {hh})} = 0) &
			     ({c in ({c - {tog(hh)}: c in s | hh notin c} + {{hh}}) | ((m + {hh}) * c) = 0} = 0))) &
			(tog(hh) notin m)
--
-- Since we are assuming that $m + {hh}$ does not model the conjunctive normal form
--	${h in (m + {hh}) | tog(h) in (m + {hh})}$,
-- either it contains complementary literals $h0,tog(h0)$, or it does not intersect
-- some clause $c0$ belonging to this set. We rule out the first possibility...
--
	Suppose ==> Stat3: {h in (m + {hh}) | tog(h) in (m + {hh})} /= 0
		h0-->Stat3(Stat3*) ==> Stat4: (h0 in (m + {hh})) & (tog(h0) in (m + {hh}))
--
-- ...by observing that of these two complementary literals one must equal $hh$ whereas,
--  since the two differ, the other (which cannot be $tog(hh)$) must belong to $m$.
--
		h0-->Stat1(Stat3*) ==> (h0 = hh) or (tog(h0) = hh)
		h0-->TcnfModels0(Stat4*) ==> (tog(tog(h0)) = h0) & (tog(h0) /= h0)
		Suppose ==> Stat5: (h0 in m) & (tog(h0) = hh)
			EQUAL(Stat1) ==> false
		Discharge ==> h0 = hh
		EQUAL(Stat1) ==> false
	Discharge ==> Stat6: {c in ({c - {tog(hh)}: c in s | hh notin c} + {{hh}}) | ((m + {hh}) * c) = 0} /= 0
--
-- To rule out the other possibility, we observe that since $m + {hh}$
-- and $c0 = c1 - {tog(hh)}$, where $c1$ belongs to $s$ do not intersect,
-- $m$ does not intersect a clause of $s$, the contradiction announced above.
--
	c0-->Stat6(Stat6*) ==> Stat7: (c0 in {c - {tog(hh)}: c in s | hh notin c}) & ((m + {hh}) * c0 = 0)
	c1-->Stat7(Stat1*) ==> Stat8: (c1 in s) & (c1 * m = 0)
	c1-->Stat2(Stat8*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels12: [splitting rule] Has_cnfModel_thryvar(S,M) ¥imp (Has_cnfModel_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}, M + {H}) or Has_cnfModel_thryvar({{tog(H)}} + {c - {H}: c in S | tog(H) notin c}, M + {tog(H)})). Proof:
Suppose_not(s,m,h) ==> AUTO
--
-- Reasoning by contradiction, suppose that $s,m,h$ form a counterexample to the theorem's
-- assertion. It follows from Theorem cnfModels11 that the complementary literals $h,tog(h)$
-- belong together to $m$, which is incompatible with the fact that $m$ is a model.
--
	Suppose ==> tog(h) notin m
	(s,m,h)-->TcnfModels11(*) ==> false; Discharge ==> AUTO
	h-->TcnfModels0(*) ==> tog(tog(h)) = h
	EQUAL ==> (not Has_cnfModel_thryvar({c - {tog(tog(h))}: c in s | tog(h) notin c} + {{tog(h)}}, m + {tog(h)}))
	Suppose ==> h notin m
	(s,m,tog(h))-->TcnfModels11(*) ==> false; Discharge ==> AUTO
	Use_def(Has_cnfModel_thryvar) ==> Stat1: {h in m | tog(h) in m} = 0
	h-->Stat1(*) ==> false; Discharge ==> QED
--
--
--
Theorem cnfModels13: [splitting rule, 2] Has_cnfModel_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}, M) ¥imp Has_cnfModel_thryvar(S,M). Proof:
Suppose_not(h0,s,m) ==> AUTO
	Use_def(Has_cnfModel_thryvar)(*) ==> ({h in m | tog(h) in m} = 0) &
		Stat1: ({c in ({{h0}} + {c - {tog(h0)}: c in s | h0 notin c}) | (m * c) = 0} = 0) &
		Stat2: ({c in s | (m * c) = 0} /= 0)
	c1-->Stat2(*) ==> (c1 in s) & ((m * c1) = 0)
	Suppose ==> h0 in c1
		({h0})-->Stat1(*) ==> m * {h0} /= 0
	Discharge ==> h0 notin c1
	Suppose ==> Stat3: (c1 - {tog(h0)}) notin {c - {tog(h0)}: c in s | h0 notin c}
		(c1)-->Stat3(*) ==> false
	Discharge ==> AUTO
	(c1 - {tog(h0)})-->Stat1(*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels14: [preliminary to splitting rule, 2] Is_cnfSat_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}) ¥imp Is_cnfSat_thryvar(S). Proof:
Suppose_not(hh,s) ==> AUTO
	Use_def(Is_cnfSat_thryvar) ==> Stat1: (not (EXISTS m | Has_cnfModel_thryvar(s,m))) & Stat2: (EXISTS m | Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c} + {{hh}}, m))

	m2-->Stat2(Stat1*) ==> Stat3: Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c} + {{hh}}, m2)
	Use_def(Has_cnfModel_thryvar) ==> Stat4: {h in m2 | tog(h) in m2} = 0
--
-- we build a new set $m3$ such that $tog(hh) notin m3$ and hence $m3$ can be broadened by adding $hh$
--
	Loc_def ==> m3 = m2 * {h: c in {c - {tog(hh)}: c in s | hh notin c}, h in c}

	({c - {tog(hh)}: c in s | hh notin c}, {c - {tog(hh)}: c in s | hh notin c} + {{hh}}, m2)-->TcnfModels5(Stat3*) ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m2)
	({c - {tog(hh)}: c in s | hh notin c}, m2)-->TcnfModels7(Stat4*) ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m2 * Un({c - {tog(hh)}: c in s | hh notin c}))
	Use_def(Un)(Stat4*) ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m2 * {h: c in {c - {tog(hh)}: c in s | hh notin c}, h in c})
	EQUAL(Stat4) ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m3)

--
-- indeed, $tog(hh) notin m3$
--
	Suppose ==> tog(hh) in m3
		(Stat4*)ELEM ==> Stat5: tog(hh) in {h: c in {c - {tog(hh)}: c in s | hh notin c}, h in c}
		(cc2, hh2) -->Stat5(Stat5*) ==> Stat6: (cc2 in {c - {tog(hh)}: c in s | hh notin c}) & (tog(hh) in cc2)
		(cc3)-->Stat6(Stat6*) ==> false
	Discharge ==> AUTO
--
-- we use $m3 + {hh}$ to create a counterexample
--
	(m3 + {hh})-->Stat1(Stat1,Stat1*) ==> (not Has_cnfModel_thryvar(s,m3 + {hh}))
--
-- we have $Has_cnfModel_thryvar(0,m3 + {hh})$
--
	Suppose ==> Stat7: {h in (m3 + {hh}) | tog(h) in (m3 + {hh})} /= 0
		h0-->Stat7(Stat7*) ==> (h0 in (m3 + {hh})) & (tog(h0) in (m3 + {hh}))
		(Stat4*)ELEM ==> Stat8: (h0 in (m2 + {hh})) & (tog(h0) in (m2 + {hh}))

		(h0)-->Stat4(Stat7) ==> (h0 = hh) or (tog(h0) = hh)
		h0-->TcnfModels0(Stat8*) ==> (tog(tog(h0)) = h0) & (tog(h0) /= h0)
		Suppose ==> Stat9: (h0 in m2) & (tog(h0) = hh)
			EQUAL(Stat4) ==> false
		Discharge ==> (h0 = hh) & (tog(h0) in m3)
		EQUAL(Stat4) ==> false

	Discharge ==> AUTO
--
-- it remains that
--
	Use_def(Has_cnfModel_thryvar) ==> Stat10: ({c in s | ((m3 + {hh}) * c) = 0} /= 0)
--
-- by rewriting $Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m3)$, we have
--
	Use_def(Has_cnfModel_thryvar) ==> Stat11: ({c in {k - {tog(hh)}: k in s | hh notin k} | (m3 * c) = 0} = 0)
--
-- we now choose a $d in s$
--
	d-->Stat10(Stat10*) ==> Stat12: (d notin {c in {k - {tog(hh)}: k in s | hh notin k} | (m3 * c) = 0}) & (d in s) & (((m3 + {hh}) * d) = 0)
	d-->Stat12(Stat12*) ==> Stat13: d notin {k - {tog(hh)}: k in s | hh notin k}
	d-->Stat13(Stat12*) ==> (tog(hh) in d) & (hh notin d)
--
-- it remains to consider $tog(hh) in d$
-- but $(d - {tog(hh)})$ does not intersects $m3$ and hence the contradiction
--
	Suppose ==> Stat14: (d - {tog(hh)}) notin {k - {tog(hh)}: k in s | hh notin k}
		d-->Stat14(Stat12*) ==> false
	Discharge ==> AUTO
--
-- since $m3 * (d - tog(hh)) = 0$, we have
--
	(d - {tog(hh)})-->Stat11(Stat11*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels15: [splitting rule, 2] Is_cnfSat_thryvar(S) ¥eq (Is_cnfSat_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}) or Is_cnfSat_thryvar({{tog(H)}} + {c - {H}: c in S | tog(H) notin c})). Proof:
Suppose_not(s,h0) ==> AUTO
	Suppose ==> Is_cnfSat_thryvar(s) & (not (Is_cnfSat_thryvar({{h0}} + {c - {tog(h0)}: c in s | h0 notin c}) or Is_cnfSat_thryvar({{tog(h0)}} + {c - {h0}: c in s | tog(h0) notin c})))
		Use_def(Is_cnfSat_thryvar)(*) ==>
			Stat1: (EXISTS m | Has_cnfModel_thryvar(s,m)) &
			Stat2: (not (EXISTS m | Has_cnfModel_thryvar({{h0}} + {c - {tog(h0)}: c in s | h0 notin c}, m))) &
			Stat3: (not (EXISTS m | Has_cnfModel_thryvar({{tog(h0)}} + {c - {h0}: c in s | tog(h0) notin c}, m)))
		m1-->Stat1(Stat1*) ==> Stat4: Has_cnfModel_thryvar(s,m1)
		(s,m1,h0)-->TcnfModels12(Stat4*) ==> Has_cnfModel_thryvar({{h0}} + {c - {tog(h0)}: c in s | h0 notin c}, m1 + {h0}) or Has_cnfModel_thryvar({{tog(h0)}} + {c - {h0}: c in s | tog(h0) notin c}, m1 + {tog(h0)})
		Suppose ==> Stat5: Has_cnfModel_thryvar({{h0}} + {c - {tog(h0)}: c in s | h0 notin c}, m1 + {h0})
			(m1 + {h0})-->Stat2(Stat5*) ==> false
		Discharge ==> Stat6: Has_cnfModel_thryvar({{tog(h0)}} + {c - {h0}: c in s | tog(h0) notin c}, m1 + {tog(h0)})
		(m1 + {tog(h0)})-->Stat3(Stat6*) ==> false
	Discharge ==> AUTO
	Suppose ==> Is_cnfSat_thryvar({{h0}} + {c - {tog(h0)}: c in S | h0 notin c})
		(h0, s)-->TcnfModels14(*) ==> false
	Discharge ==> AUTO
	h0-->TcnfModels0(*) ==> tog(tog(h0)) = h0
	EQUAL ==> Is_cnfSat_thryvar({{tog(h0)}} + {c - {tog(tog(h0))}: c in s | tog(h0) notin c})
	(tog(h0), s)-->TcnfModels14(*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels16: [pure literal rule, 2] (tog(H) notin Un(S)) ¥imp (Is_cnfSat_thryvar(S) ¥eq Is_cnfSat_thryvar({{H}} + {c in S | H notin c})). Proof:
Suppose_not(h0,s) ==> AUTO
--
-- Assume $h0,s$ to be a couterexample.
--
	(tog(h0),s)-->T105(*) ==> Stat1: {v in s | tog(h0) in v} = 0
	Use_def(Is_cnfSat_thryvar(s)) ==> AUTO
	Use_def(Is_cnfSat_thryvar({{h0}} + {c in s | h0 notin c})) ==> AUTO
	Suppose ==> Stat2: (EXISTS m | Has_cnfModel_thryvar({{h0}} + {d in s | h0 notin d}, m)) &
		(not(EXISTS m | Has_cnfModel_thryvar(s, m)))
--
-- The possibility that a model of ${{h0}} + {d in s | h0 notin d}$ be not a model
-- of $s$ will be discarded easily. In fact, it will satisfy all clauses in $s$
-- to which $h0$ belongs, as well as all other clauses in $s$.
--
		(m0,m0)-->Stat2(Stat2*) ==> Stat3: Has_cnfModel_thryvar({{h0}} + {d in s | h0 notin d}, m0) &
				(not Has_cnfModel_thryvar(s,m0))
		Use_def(Has_cnfModel_thryvar)(Stat3*) ==> Stat4: ({c in ({{h0}} + {d in s | h0 notin d}) | m0 * c = 0 } = 0) &
				({c in s | m0 * c = 0 } /= 0)
		({h0},c0)-->Stat4(Stat4*) ==> (h0 in m0) & (c0 in s) & (m0 * c0 = 0)
		c0-->Stat4(Stat4*) ==> Stat5: c0 notin {d in s | h0 notin d}
		c0-->Stat5(Stat4*) ==> false
	Discharge ==> Stat6: (EXISTS m | Has_cnfModel_thryvar(s, m)) &
		(not(EXISTS m | Has_cnfModel_thryvar({{h0}} + {d in s | h0 notin d}, m)))
--
-- The possibility that $s$ has a model $m1$ must be discarded also, by means of the following
-- more elaborate argument. If we replace $tog(h0)$ by $h0$ within $m1$,
-- we will get another model of $s$, which will model ${{h0}} + {d in s | h0 notin d}$ too.
--
	(m1,(m1 - {tog(h0)}) + {h0})-->Stat6(Stat6*) ==> Stat7: Has_cnfModel_thryvar(s, m1) &
		(not Has_cnfModel_thryvar({{h0}} + {d in s | h0 notin d}, (m1 - {tog(h0)}) + {h0}))
	Use_def(Has_cnfModel_thryvar)(Stat7*) ==> Stat8: ({k in m1 | tog(k) in m1} = 0) &
			Stat9: ({c in s | m1 * c = 0 } = 0) &
		(not(({k in ((m1 - {tog(h0)}) + {h0}) | tog(k) in ((m1 - {tog(h0)}) + {h0})} = 0) &
			({c in ({{h0}} + {d in s | h0 notin d}) | ((m1 - {tog(h0)}) + {h0}) * c = 0 } = 0)))
	Suppose ==> Stat10: {k in ((m1 - {tog(h0)}) + {h0}) | tog(k) in ((m1 - {tog(h0)}) + {h0})} /= 0
		h1-->Stat10(Stat10*) ==> Stat11: (h1 in ((m1 - {tog(h0)}) + {h0})) &
			(tog(h1) in ((m1 - {tog(h0)}) + {h0}))
		h0-->TcnfModels0(Stat12*) ==> Stat12: (tog(tog(h0)) = h0) & (tog(h0) /= h0)
		Suppose ==> h1 = h0
			EQUAL(Stat12) ==> tog(h1) = tog(h0)
		(Stat11*)Discharge ==> AUTO
		Suppose ==> tog(h1) = h0
			h1-->TcnfModels0(Stat12) ==> tog(tog(h1)) = h1
			EQUAL(Stat12) ==> tog(h0) = h1
		(Stat11*)Discharge ==> (h1 in m1) & (tog(h1) in m1)
		h1-->Stat8(Stat12*) ==> false
	Discharge ==> Stat13: {c in ({{h0}} + {d in s | h0 notin d}) | ((m1 - {tog(h0)}) + {h0}) * c = 0 } /= 0
		c1-->Stat13(Stat13*) ==> Stat14: (c1 in {d in s | h0 notin d}) & (((m1 - {tog(h0)}) + {h0}) * c1 = 0)
	d1-->Stat14(Stat14*) ==> (c1 in s) & ((m1 - {tog(h0)}) * c1 = 0)
	c1-->Stat1(Stat14*) ==> m1 * c1 = 0
	c1-->Stat9(Stat14*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels17: [unit literal rule, 0] (({H} in S) & Has_cnfModel_thryvar(S,M)) ¥imp ((H in M) & (tog(H) notin M)). Proof:
Suppose_not(h0,s0,m0) ==> AUTO
	Use_def(Has_cnfModel_thryvar) ==> Stat1: ({c in s0 | (m0 * c) = 0} = 0) & Stat2: ({h in m0 | tog(h) in m0} = 0)
	({h0},h0)-->Stat1(*) ==> false
	Discharge ==> QED
--
Def cnfModels3: [finite satisfiability of a set of conjunctive normal forms, each represented as a set of sets of literals]
	Is_cnfFinSat_thryvar(P) := (FORALL f ¥incin P | Finite(f) ¥imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))
--
-- A finitely satisfiable set can be extended into a finitely satisfiable set by addition
-- of one of the two opposites $x,tog(x)$.
--
Theorem cnfModels18: Is_cnfFinSat_thryvar(P) ¥imp Is_cnfFinSat_thryvar(P + {{{X}}}) or Is_cnfFinSat_thryvar(P + {{{tog(X)}}}). Proof:
Suppose_not(p0,x0) ==> AUTO
--
-- Arguing by contradiction, let $p0,x0$ be a counterexample to the claim,
-- so that unsatisfiable finite subsets $f0,f1$ of $p0 + {{{x0}}}$ and
-- $p0 + {{{tog(x0)}}}$, respectively, can be found. This means that
-- no model can satisfy all sets in $f0$ simultaneously
-- or can satisfy all sets in $f1$ simultaneously.
--
	Use_def(Is_cnfFinSat_thryvar) ==> Stat1: (not(FORALL f ¥incin (p0 + {{{x0     }}}) | Finite(f) ¥imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))) &
		                                 (not(FORALL f ¥incin (p0 + {{{tog(x0)}}}) | Finite(f) ¥imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m)))))
	(f0,f1)-->Stat1 ==> Stat2:
		(f0 ¥incin (p0 + {{{x0     }}})) & Finite(f0) & Stat3: (not(EXISTS m | (FORALL s in f0 | Has_cnfModel_thryvar(s,m)))) &
		(f1 ¥incin (p0 + {{{tog(x0)}}})) & Finite(f1) & Stat4: (not(EXISTS m | (FORALL s in f1 | Has_cnfModel_thryvar(s,m))))
--
-- Consider the set $f2 = (f0 - {{{x0}}}) + (f1 - {{{tog(x0)}}})$, which is finite
-- and included in $p0$ and therefore satisfiable (because $p0$ is finitely satisfiable).
--
	Loc_def ==> Stat5: f2 = (f0 - {{{x0}}}) + (f1 - {{{tog(x0)}}})
	(Stat2*)ELEM ==> p0 incs f2
	Suppose ==> (not Finite(f2))
		(f0,f0 - {{{x0}}})-->T189(Stat2,Stat2*) ==> Finite(f0 - {{{x0}}})
		(f1,f1 - {{{tog(x0)}}})-->T189(Stat2,Stat2*) ==> Finite(f1 - {{{tog(x0)}}})
		(f0 - {{{x0}}},f1 - {{{tog(x0)}}})-->T236(Stat5*) ==> Finite((f0 - {{{x0}}}) + (f1 - {{{tog(x0)}}}))
		EQUAL(Stat5) ==> false
	Discharge ==> AUTO
	Use_def(Is_cnfFinSat_thryvar) ==> Stat6: (FORALL f ¥incin p0 | Finite(f) ¥imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))
	f2-->Stat6(Stat5*) ==> Stat7: (EXISTS m | (FORALL s in f2 | Has_cnfModel_thryvar(s,m)))
--
-- If $m1$ is a model which satisfies all sets of sets in $f2$ simultaneously,
-- we can obtain a new model $m2$ by inserting $x0$ into it, unless $m1$
-- has $tog(x0)$ as a member, in which case we put $m2=m1$. It is easy to see
-- that $m2$ is a model of $f2$ which pronounces about the truth-value of $x0$.
--
	m1-->Stat7(Stat7*) ==> Stat8: (FORALL s in f2 | Has_cnfModel_thryvar(s,m1))
	Loc_def ==> Stat9: m2 = if tog(x0) notin m1 then m1 + {x0} else m1 end if
	Suppose ==> Stat10: not(FORALL s in f2 | Has_cnfModel_thryvar(s,m2))
		s-->Stat10(Stat10*) ==> (s in f2) & (not Has_cnfModel_thryvar(s,m2))
		s-->Stat8(Stat9*) ==> Has_cnfModel_thryvar(s,m1)
		(s,m1,m2)-->TcnfModels8(Stat9*) ==> Stat11: {h in m2 - m1 | tog(h) in m2} /= 0
		h-->Stat11(Stat11*) ==> Stat12: (h in m2 - m1) & (tog(h) in m2)
		x0-->TcnfModels0(Stat9,Stat12*) ==> Stat13: (h = x0) & (tog(x0) /= x0)
		EQUAL(Stat12) ==> Stat14: (x0 in m2 - m1) & (tog(x0) in m2)
	(Stat9,Stat13,Stat14*)Discharge ==> AUTO
	Use_def(Has_cnfModel_thryvar)(Stat9*) ==> Stat15: (FORALL s in f2 | ({h in m2 | tog(h) in m2} = 0) & ({c in s | (m2 * c) = 0} = 0))
	(Stat9,Stat9*)ELEM ==> (tog(x0) in m2) or (x0 in m2)
--
-- Observe that $f2$ cannot be empty, else $f0$ would be satisfiable.
-- As an immediate consequence, there no complementary pair appears in $m2$.
--
	Suppose ==> Stat16: f2 = 0
		Suppose ==> 0 = f0
			0-->Stat3(Stat16*) ==> not(FORALL s in f0 | Has_cnfModel_thryvar(s,0))
			EQUAL(Stat16) ==> Stat17: not(FORALL s in 0 | Has_cnfModel_thryvar(s,0))
			s4-->Stat17(Stat17*) ==> false
		Discharge ==> Stat18: 0 /= f0
		({x0})-->Stat3(Stat16*) ==> Stat19: not(FORALL s in f0 | Has_cnfModel_thryvar(s,{x0}))
		(Stat5,Stat16,Stat18*)ELEM ==> {{{x0}}} = f0
		t0-->Stat19(Stat19*) ==> (t0 = {{x0}}) & (not Has_cnfModel_thryvar(t0,{x0}))
		EQUAL(Stat19) ==> Stat20: (not Has_cnfModel_thryvar({{x0}},{x0}))
		Use_def(Has_cnfModel_thryvar)(Stat20*) ==> not(({h in {x0} | tog(h) in {x0}} = 0) & ({c in {{x0}} | ({x0} * c) = 0} = 0))
		Suppose ==> Stat21: {h in {x0} | tog(h) in {x0}} /= 0
			h1-->Stat21(Stat21*) ==> h1 = tog(h1)
			h1-->TcnfModels0(Stat21*) ==> false
		Discharge ==> AUTO
		(Stat19*)ELEM ==> Stat22: {c in {{x0}} | ({x0} * c) = 0} /= 0
		c5-->Stat22(Stat22*) ==> false
	Discharge ==> AUTO
	(arb(f2))-->Stat15(Stat15) ==> Stat23: {h in m2 | tog(h) in m2} = 0
--
-- Considering the two cases when $tog(x0) in m2$ and when $x0 in m2$ separately,
-- we will reach a contradiction in either case, thus reaching the conclusion
-- of the theorem. Assume the former case first. Since $m2$ models all sets
-- in $f2$, the only set in $f1$ which can be false in $m2$ is ${{tog(x0)}}$,
-- which is impossible since $tog(x0)$ belongs to $m2$.
--
	Suppose ==> tog(x0) in m2
		Suppose ==> Stat24: not(FORALL s in (f1 - {{{tog(x0)}}}) | {c in s | m2 * c = 0} = 0)
			s2-->Stat24(Stat5,Stat5*) ==> Stat25: ({c in s2 | m2 * c = 0} /= 0) & (s2 in f2)
			c2-->Stat25(Stat25*) ==> Stat26: (c2 in s2) & (m2 * c2 = 0)
			s2-->Stat15(Stat24*) ==> Stat27: c2 notin {c in s2 | m2 * c = 0}
			c2-->Stat27(Stat26*) ==> false
		Discharge ==> Stat28: (FORALL s in (f1 - {{{tog(x0)}}}) | {c in s | m2 * c = 0} = 0)
		m2-->Stat4(Stat2,Stat2*) ==> Stat29: not(FORALL s in f1 | Has_cnfModel_thryvar(s,m2))
		s1-->Stat29(Stat29*) ==> Stat30: (s1 in f1) & (not(Has_cnfModel_thryvar(s1,m2)))
		Use_def(Has_cnfModel_thryvar)(Stat30,Stat23*) ==> Stat31: {c in s1 | m2 * c = 0} /= 0
		s1-->Stat28(Stat30*) ==> s1 = {{tog(x0)}}
		c0-->Stat31(Stat23*) ==> false
	Discharge ==> AUTO
--
-- Likewise, we derive a contradiction from $x0 in m2$, because in this case
-- ${{x0}}$ would be the only candidate set for falsifiability by $m2$ within $f0$.
--
	(Stat15*)ELEM ==> x0 in m2
	Suppose ==> Stat32: not(FORALL s in (f0 - {{{x0}}}) | {c in s | m2 * c = 0} = 0)
		s3-->Stat32(Stat5,Stat5*) ==> Stat33: ({c in s3 | m2 * c = 0} /= 0) & (s3 in f2)
		c3-->Stat33(Stat33*) ==> Stat34: (c3 in s3) & (m2 * c3 = 0)
		s3-->Stat15(Stat32*) ==> Stat35: c3 notin {c in s3 | m2 * c = 0}
		c3-->Stat35(Stat34*) ==> false
	Discharge ==> Stat36: (FORALL s in (f0 - {{{x0}}}) | {c in s | m2 * c = 0} = 0)
	m2-->Stat3(Stat2,Stat2*) ==> Stat37: not(FORALL s in f0 | Has_cnfModel_thryvar(s,m2))
	s0-->Stat37(Stat37*) ==> Stat38: (s0 in f0) & (not(Has_cnfModel_thryvar(s0,m2)))
	Use_def(Has_cnfModel_thryvar)(Stat38,Stat23*) ==> Stat39: {c in s0 | m2 * c = 0} /= 0
	s0-->Stat36(Stat38*) ==> s0 = {{x0}}
	c6-->Stat39(Stat23*) ==> false
	Discharge ==> QED
--
-- Every finitely satisfiable set of sets of finite clauses admits a model
-- which satisfies all of its members simultaneously.
--
Theorem cnfModels19: [compactness of classical propositional logic] (Is_cnfFinSat_thryvar(P) & (FORALL s in P, c in s | Finite(c))) ¥imp (EXISTS m | (FORALL s in P | Has_cnfModel_thryvar(s,m))). Proof:
Suppose_not(p0) ==> Is_cnfFinSat_thryvar(p0) & Stat1: (FORALL s in p0, c in s | Finite(c)) & Stat2: (not (EXISTS m | (FORALL s in p0 | Has_cnfModel_thryvar(s,m))))
--
-- Compactness: If $P$ is a finitely satisfiable set such that
--	$(FORALL s in P, c in s | Finite(c))$,
-- then $P$ is satisfiable.
--
-- Finite satisfiability is intended in the sense that for every finite subset $f$ of $P$ there exists a set $m_f$
-- such that both of the sets ${x in m_f | tog(x) in m_f}, {c: s in f, c in s | m_f * c = 0}$ equal the null set $0$.
--
-- Satisfiability is meant in the sense that there exists a set $m$
-- such that both of the sets ${x in m | tog(x) in m}, {c: s in P, c in s | m * c = 0}$ equal $0$.
--
-- As for $tog$, it is a function defined for all sets, such that
--	$(FORALL x | (tog(x) /= x) & (tog(tog(x)) = x))$.
--
-- Since $tog$ is global, it is not necessary to fix before the compactness theorem is stated
-- what is meant by literals: it will be convenient to define at the outset of its proof the
-- following set of so-called "literals":
--	$L = {x: s in P, c in s, y in c, x in {y, tog(y)}}$.
--
-- The Zorn lemma will be applied to the family $Sigma$ (partially ordered by set inclusion) formed
-- by those subsets $Q$ of $pow(pow(L))$ such that:
--	(1)	$Q$ includes $P$ as a subset;
--	(2)	$Q$ is finitely satisfiable.
--
-- We must show that every subchain $K$ of $Sigma$ has an upper bound in $Sigma$. If $K = 0$,
-- such an upper bound is $P$ (which, trivially, belongs to $Sigma$).
--
-- If $K$ is a non-void subchain of $Sigma$, it will suffice to show that $Un(K)$ belongs to $Sigma$.
-- It is obvious that $Un(K)$ includes $P$. As regards the finite satisfiability of $Un(K)$,
-- arguing by contradiction let us assume that $f$ is a finite subsets, not satisfiable,
-- of $Un(K)$. Since Theorem 239 guarantees the existence of a $Q0$ including $f$ in $K$,
-- the finite satisfiability of $Q0$, inscribed within the very definition of $Sigma$,
-- would be contradicted.
--
-- By the Zorn lemma, $Sigma$ has maximal elements: let $Q1$ be one of them. Then Theorem cnfModels18
-- ensures that, for every $x in L$, either ${{x}}$ or ${{tog(x)}}$ must belong to $Q1$
-- (the cannot belong together to $Q1$, else the finite satisfiability of $Q1$ would be violated).
-- Let us form the set $m = {x in L | {{x}} in Q1}$ and verify that it intersects every $c$
-- belonging to any $s$ belonging to $P$, which will demonstrate the compactness theorem,
-- since $m$ is a model of $P$. Suppose, arguing by contradiction, that $s1 in P$ and $c1 in s1$
-- are such that $m * c1 = 0$. Since $c1$ is finite, the set
--	${{{x}}: x in L | tog(x) in c1} + {s1}$
-- turns out to be a finite unsatisfiable subset of $Q1$. Here is the contradiction we were
-- aiming at.
--
	Loc_def ==> Stat3: lits = {x: s in p0, c in s, y in c, x in {y,tog(y)}}
	Loc_def ==> Stat4: sigm = {q ¥incin pow(pow(lits)) | (p0 ¥incin q) & Is_cnfFinSat_thryvar(q)}
	Suppose ==> p0 notin sigm
		EQUAL ==> Stat5: p0 notin {q ¥incin pow(pow(lits)) | (p0 ¥incin q) & Is_cnfFinSat_thryvar(q)}
		p0-->Stat5(*) ==> Stat6: p0 ¥nincin pow(pow(lits))
		Use_def(pow(pow(lits))) ==> AUTO
		s0-->Stat6(Stat6*) ==> Stat7: (s0 notin {s: s ¥incin pow(lits)}) & (s0 in p0)
		Use_def(pow(lits)) ==> AUTO
		s0-->Stat7(Stat7*) ==> Stat8: s0 ¥nincin {c: c ¥incin lits}
		c0-->Stat8(Stat8*) ==> Stat9: (c0 notin {c: c ¥incin lits}) & (c0 in s0)
		c0-->Stat9(Stat9*) ==> Stat10: c0 ¥nincin lits
		y0-->Stat10(Stat3,Stat3*) ==> Stat11: (y0 notin {x: s in p0, c in s, y in c, x in {y,tog(y)}}) & (y0 in c0)
		(s0,c0,y0,y0)-->Stat11(Stat7*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat12: not(FORALL x ¥incin sigm | ((FORALL u in x, v in x | ((u incs v) or (v incs u))) ¥imp (EXISTS w in sigm | (FORALL y in x | w incs y))))
		g0-->Stat12(Stat12*) ==> Stat13: (not(EXISTS w in sigm | (FORALL y in g0 | w incs y))) & (FORALL u in g0, v in g0 | ((u incs v) or (v incs u))) & (g0 ¥incin sigm)
		Suppose ==> g0 = 0
			p0-->Stat13(Stat4*) ==> Stat14: not(FORALL y in g0 | p0 incs y)
			y1-->Stat14(Stat13*) ==> false
		Discharge ==> AUTO
		Loc_def ==> a0 = arb(g0)
		g0-->T0(Stat13*) ==> Stat15: (a0 in g0) & (a0 in sigm)
		(Stat4,Stat15*)ELEM ==> Stat16: a0 in {q ¥incin pow(pow(lits)) | (p0 ¥incin q) & Is_cnfFinSat_thryvar(q)}
		g0-->T274(Stat16*) ==> Stat17: (FORALL x in g0 | x ¥incin Un(g0))
		Suppose ==> Un(g0) in sigm
			(Un(g0))-->Stat13(Stat17*) ==> Stat18: not(FORALL y in g0 | Un(g0) incs y)
			y2-->Stat18 ==> AUTO
			y2-->Stat17(Stat18*) ==> false
		Discharge ==> AUTO
		(Stat4*)ELEM ==> Stat19: Un(g0) notin {q ¥incin pow(pow(lits)) | (p0 ¥incin q) & Is_cnfFinSat_thryvar(q)}
		a0-->Stat17 ==> AUTO
		()-->Stat16(Stat15*) ==> p0 ¥incin Un(g0)
		(Un(g0))-->Stat19(Stat19*) ==> Stat20: ((Un(g0) ¥nincin pow(pow(lits))) or (not Is_cnfFinSat_thryvar(Un(g0))))
		Suppose ==> Un(g0) ¥nincin pow(pow(lits))
			(g0,pow(pow(lits)))-->T274(Stat20*) ==> Stat21: not(FORALL x in g0 | x ¥incin pow(pow(lits)))
			q2-->Stat21(Stat13,Stat4*) ==> Stat22: (q2 in {q ¥incin pow(pow(lits)) | (p0 ¥incin q) & Is_cnfFinSat_thryvar(q)}) & (q2 ¥nincin pow(pow(lits)))
			()-->Stat22(Stat22*) ==> false
		Discharge ==> AUTO
		(Stat20*)ELEM ==> (not Is_cnfFinSat_thryvar(Un(g0)))
		Use_def(Is_cnfFinSat_thryvar)(Stat20*) ==> Stat23: not(FORALL f ¥incin Un(g0) | Finite(f) ¥imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))
		f0-->Stat23(Stat23*) ==> (f0 ¥incin Un(g0)) & Finite(f0) & (not(EXISTS m | (FORALL s in f0 | Has_cnfModel_thryvar(s,m))))
		(g0,f0)-->T239(Stat13*) ==> Stat24: (EXISTS z in g0 | z incs f0)
		q0-->Stat24(Stat13,Stat4*) ==> Stat25: (q0 in {q ¥incin pow(pow(lits)) | (p0 ¥incin q) & Is_cnfFinSat_thryvar(q)}) & (q0 incs f0)
		Use_def(Is_cnfFinSat_thryvar(q0)) ==> AUTO
		()-->Stat25(Stat25*) ==> Stat26: (FORALL f ¥incin q0 | Finite(f) ¥imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))
		f0-->Stat26(Stat23*) ==> false
	Discharge ==> AUTO
	sigm-->T412(*) ==> Stat27: (EXISTS y in sigm | (FORALL x in sigm | not ((x incs y) & (x /= y))))
	q1-->Stat27(Stat27*) ==> Stat28: (FORALL x in sigm | not ((x incs q1) & (x /= q1))) & (q1 in sigm)
	Suppose ==> Stat29: not(FORALL x in lits | ({{x}} in q1) or ({{tog(x)}} in q1))
		x1-->Stat29(Stat29*) ==> Stat30: (x1 in lits) & ({{x1}} notin q1) & ({{tog(x1)}} notin q1)
--
-- Suppose that $({{x1}} notin q1) & ({{tog(x1)}} notin q1)$. Then the sets $(q1 + {{x1}})$ and $(q1 + {{{tog(x1)}}})$,
-- which are greater than $q1$ w.r.t. inclusion, will be finitely satisfiable by Theorem cnfModels18.
-- This contradicts the maximality of $q1$
--
		(Stat28,Stat4*)ELEM ==> Stat31: q1 in {q ¥incin pow(pow(lits)) | (p0 ¥incin q) & Is_cnfFinSat_thryvar(q)}
		()-->Stat31(Stat31*) ==> (q1 ¥incin pow(pow(lits))) & (p0 ¥incin q1) & Is_cnfFinSat_thryvar(q1)
		(q1,x1)-->TcnfModels18(Stat31*) ==> Is_cnfFinSat_thryvar(q1 + {{{x1}}}) or Is_cnfFinSat_thryvar(q1 + {{{tog(x1)}}})
--
-- In the following we show that indeed both $(q1 + {{x1}})$ and $(q1 + {{{tog(x1)}}})$ belong to $sigm$
--
		(Stat31*)ELEM ==> Stat32: (p0 ¥incin (q1 + {{{x1}}})) & (p0 ¥incin (q1 + {{{tog(x1)}}}))
--
		(x1,lits)-->T214(Stat30,Stat30*) ==> {x1} in pow(lits)
		({x1},pow(lits))-->T214(Stat32*) ==> {{{x1}}} ¥incin pow(pow(lits))
--
		Suppose ==> Stat33: tog(x1) notin lits
			EQUAL(Stat33, Stat3) ==> Stat34: tog(x1) notin {x: s in p0, c in s, y in c, x in {y,tog(y)}}
			EQUAL(Stat30, Stat3) ==> Stat35: x1 in {x: s in p0, c in s, y in c, x in {y,tog(y)}}
			(s3,c3,y3,x3)-->Stat35(Stat35*) ==> Stat36: (s3 in p0) & (c3 in s3) & (y3 in c3) & (x1 in {y3, tog(y3)})
			(Stat36)ELEM ==> (x1 = y3) or (x1 = tog(y3))
			Suppose ==> x1 = y3
				EQUAL(Stat36) ==> tog(x1) in {y3, tog(y3)}
				(s3,c3,y3,tog(x1))-->Stat34(Stat35*) ==> false
			Discharge ==> AUTO
			(Stat36*)ELEM ==> Stat37: x1 = tog(y3)
			Assump ==> Stat38: (FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
			(y3)-->Stat38(Stat38*) ==> tog(tog(y3)) = y3
			EQUAL(Stat37) ==> tog(x1) in {y3, tog(y3)}
			(s3,c3,y3,tog(x1))-->Stat34(Stat35*) ==> false
		Discharge ==> AUTO
--
		(tog(x1),lits)-->T214(Stat32*) ==> {tog(x1)} in pow(lits)
		({tog(x1)},pow(lits))-->T214(Stat32*) ==> {{{tog(x1)}}} ¥incin pow(pow(lits))
--
		(Stat29*)ELEM ==> Stat39: ((q1 + {{{x1}}}) ¥incin pow(pow(lits))) & ((q1 + {{{tog(x1)}}}) ¥incin pow(pow(lits)))
--
-- Suppose now that $Is_cnfFinSat_thryvar(q1 + {{{x1}}})$.
-- As $q1 + {{{x1}}} incs q1$ we arrive at a contradiction regarding the maximality of $q1$.
--
		Suppose ==> Is_cnfFinSat_thryvar(q1 + {{{x1}}})
			(Stat30*)ELEM ==> q1 + {{{x1}}} /= q1
			Suppose ==> Stat40: (q1 + {{{x1}}}) notin sigm
				EQUAL(Stat40, Stat4) ==> Stat41: (q1 + {{{x1}}}) notin {q ¥incin pow(pow(lits)) | (p0 ¥incin q) & Is_cnfFinSat_thryvar(q)}
				(q1 + {{{x1}}})-->Stat41(Stat29) ==> false
			Discharge ==> AUTO
			(q1 + {{{x1}}})-->Stat28(Stat39) ==> false
		Discharge ==> AUTO
--
-- In an analogous manner we treat the case $Is_cnfFinSat_thryvar(q1 + {{{tog(x1)}}})$.
--
		(Stat30*)ELEM ==> q1 + {{{tog(x1)}}} /= q1
		Suppose ==> Stat42: (q1 + {{{tog(x1)}}}) notin sigm
			EQUAL(Stat42, Stat4) ==> Stat43: (q1 + {{{tog(x1)}}}) notin {q ¥incin pow(pow(lits)) | (p0 ¥incin q) & Is_cnfFinSat_thryvar(q)}
			(q1 + {{{tog(x1)}}})-->Stat43(Stat29) ==> false
		Discharge ==> AUTO
		(q1 + {{{tog(x1)}}})-->Stat28(Stat39) ==> false
	Discharge ==> Stat44: (FORALL x in lits | ({{x}} in q1) or ({{tog(x)}} in q1))
--
--
--
-- redundant
	(Stat28,Stat4*)ELEM ==> Stat45: q1 in {q ¥incin pow(pow(lits)) | (p0 ¥incin q) & Is_cnfFinSat_thryvar(q)}
	Use_def(Is_cnfFinSat_thryvar(q1)) ==> AUTO
	()-->Stat45(Stat45*) ==> (q1 ¥incin pow(pow(lits))) & (p0 ¥incin q1) & Stat46: (FORALL f ¥incin q1 | Finite(f) ¥imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))
-- /redundant
--
	Loc_def ==> Stat47: m0 = {x in lits | {{x}} in q1}
	Suppose ==> Stat48: not (FORALL s in p0 | Has_cnfModel_thryvar(s,m0))
		(s1)-->Stat48(Stat48*) ==> (s1 in p0) & (not Has_cnfModel_thryvar(s1,m0))
-- from $s1 in p0$ and $p0 ¥incin q1$ we have $s1 in q1$
		(Stat45*)ELEM ==> Stat49: s1 in q1
		Use_def(Has_cnfModel_thryvar)(Stat48*) ==> ({h in m0 | tog(h) in m0} /= 0) or ({c in s1 | (m0 * c) = 0} /= 0)
		Suppose ==> Stat50: ({h in m0 | tog(h) in m0} /= 0)
			(h1)-->Stat50(Stat50*) ==> (h1 in m0) & (tog(h1) in m0)
			EQUAL(Stat47) ==> Stat51: (h1 in {x in lits | {{x}} in q1}) & Stat52: (tog(h1) in {x in lits | {{x}} in q1})
			()-->Stat51(Stat51*) ==> (h1 in lits) & ({{h1}} in q1)
			()-->Stat52(Stat51*) ==> (tog(h1) in lits) & ({{tog(h1)}} in q1)
--
--
--
			({{h1}}, {{tog(h1)}})-->T202 ==> Finite({{{h1}}, {{tog(h1)}}})
			(Stat51)ELEM ==> {{{h1}}, {{tog(h1)}}} ¥incin q1
			({{{h1}}, {{tog(h1)}}})-->Stat46(Stat48) ==> Stat53: (EXISTS m | (FORALL s in {{{h1}}, {{tog(h1)}}} | Has_cnfModel_thryvar(s,m)))
			(m1)-->Stat53(Stat53*) ==> Stat54: (FORALL s in {{{h1}}, {{tog(h1)}}} | Has_cnfModel_thryvar(s,m1))
			({{h1}})-->Stat54(Stat54*) ==> Has_cnfModel_thryvar({{h1}},m1)
			({{tog(h1)}})-->Stat54(Stat54*) ==> Has_cnfModel_thryvar({{tog(h1)}},m1)
			Use_def(Has_cnfModel_thryvar)(Stat54*) ==> Stat55: ({h in m1 | tog(h) in m1} = 0) & Stat56: ({c in {{h1}} | (m1 * c) = 0} = 0) & Stat57: ({c in {{tog(h1)}} | (m1 * c) = 0} = 0)
			({h1})-->Stat56(Stat55*) ==> h1 in m1
			({tog(h1)})-->Stat57(Stat55*) ==> tog(h1) in m1
			(h1)-->Stat55(Stat55*) ==> false
		Discharge ==> Stat58: {c in s1 | (m0 * c) = 0} /= 0
--
-- It remains to be seen that $({c in s1 | (m0 * c) = 0} /= 0)$. It this were not the case,
-- then we could pick a $c1 in s1$ not intersecting $m0$. Since $c1$ is finite, so is
-- ${{{x}}: x in lits | tog(x) in c1} + {s1}$, which is a subset of $p0$; but this would be
-- a finite unsatisfiable set of $p0$, which conflicts with the assumtion that $q1$ is
-- finitely satisfiable. This contradiction, allowing us to discharge the pending supposition,
-- readily leads us to the desired conclusion.
--
		(c1)-->Stat58(Stat58*) ==> (c1 in s1) & ((m0 * c1) = 0)
		(s1, c1)-->Stat1(Stat48*) ==> Finite(c1)
		TELEM ==> Svm({[x,{{tog(x)}}]: x in c1}) & (range({[x,{{tog(x)}}]: x in c1}) = {{{tog(x)}}: x in c1}) & (domain({[x,{{tog(x)}}]: x in c1}) = c1)
		EQUAL(Stat58) ==> Finite(domain({[x,{{tog(x)}}]: x in c1}))
		({[x,{{tog(x)}}]: x in c1})-->T192(Stat58*) ==> Finite(range({[x,{{tog(x)}}]: x in c1}))
		({{{tog(x)}}: x in c1},s1)-->T199 ==> AUTO
		EQUAL(Stat58) ==> Stat59: Finite({{{tog(x)}}: x in c1} + {s1})
		Suppose ==> Stat60: ({{{tog(x)}}: x in c1} + {s1}) ¥nincin q1
			s4-->Stat60(Stat49,Stat49*) ==> Stat61: (s4 in {{{tog(x)}}: x in c1}) & (s4 notin q1)
			x4-->Stat61(Stat58*) ==> Stat62: (x4 in c1) & ({{tog(x4)}} notin q1) & (x4 notin m0)
			Suppose ==> Stat63: x4 notin {x: s in p0, c in s, y in c, x in {y,tog(y)}}
				(s1,c1,x4,x4)-->Stat63(Stat48*) ==> false
			Discharge ==> Stat64: x4 in {x: s in p0, c in s, y in c, x in {y,tog(y)}}
			EQUAL(Stat3,Stat64,Stat62,Stat47) ==> Stat65: (x4 notin {x in lits | {{x}} in q1}) & (x4 in lits)
			x4-->Stat44(Stat65,Stat62*) ==> {{x4}} in q1
			x4-->Stat65(Stat65*) ==> false
		Discharge ==> AUTO
		({{{tog(x)}}: x in c1} + {s1})-->Stat46(Stat59*) ==> Stat66: (EXISTS m | (FORALL s in ({{{tog(x)}}: x in c1} + {s1}) | Has_cnfModel_thryvar(s,m)))
		m2-->Stat66(Stat66*) ==> Stat67: (FORALL s in ({{{tog(x)}}: x in c1} + {s1}) | Has_cnfModel_thryvar(s,m2))
		Use_def(Has_cnfModel_thryvar(s1,m2)) ==> AUTO
		s1-->Stat67(Stat67*) ==> Stat68: ({c in s1 | (m2 * c) = 0} = 0) & Stat69: ({h in m2 | tog(h) in m2} = 0)
		c1-->Stat68(Stat58*) ==> Stat70: m2 * c1 /= 0
		h3-->Stat70(Stat70*) ==> (h3 in c1) & (h3 in m2)
		Suppose ==> Stat71: {{tog(h3)}} notin {{{tog(x)}}: x in c1}
			h3-->Stat71(Stat70*) ==> false
		Discharge ==> AUTO
		Use_def(Has_cnfModel_thryvar({{tog(h3)}},m2)) ==> AUTO
		({{tog(h3)}})-->Stat67(Stat70*) ==> Stat72: {c in {{tog(h3)}} | (m2 * c) = 0} = 0
		({tog(h3)})-->Stat72(Stat72*) ==> tog(h3) in m2
		h3-->Stat69(Stat70*) ==> false
	Discharge ==> AUTO
	(m0)-->Stat2(Stat47*) ==> false
Discharge ==> QED
--
-- OLD THEOREMS, TO BE ELIMINATED FROM THIS THEORY:
--
--
--
--
Theorem cnfModels20: [broadening of cnf-model, 2] (Has_cnfModel_thryvar(S,M) & (N incs M) & Has_cnfModel_thryvar(T,N)) ¥imp Has_cnfModel_thryvar(S,N). Proof:
Suppose_not(s,m,n,t) ==> AUTO
	Set_monot ==> {h in n | tog(h) in n} incs {h in (n - m) | tog(h) in n}
	Use_def(Has_cnfModel_thryvar) ==> {h in (n - m) | tog(h) in n} = 0
	(s,m,n)-->TcnfModels8(*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels21: [shrinking of cnf_model, 2] (Has_cnfModel_thryvar(S,M) & (H notin Un(S))) ¥imp (Has_cnfModel_thryvar(S, M - {H})). Proof:
Suppose_not(s,m,h0)==> AUTO
	(s,m)-->TcnfModels7(*) ==> Has_cnfModel_thryvar(s,m * Un(s))
	Use_def(Has_cnfModel_thryvar) ==> {h in m | tog(h) in m} = 0
	Set_monot ==> {h in m | tog(h) in m} incs {h in (m - {h0}) | tog(h) in (m - {h0})}
	ELEM ==> {h in (m - {h0}) | tog(h) in (m - {h0})} = 0
	(m - {h0})-->TcnfModels1(*) ==> Has_cnfModel_thryvar(0, m - {h0})
	(s,m * Un(s),m - {h0},0)-->TcnfModels20(*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels22: [broadening of cnf_model, 3] ({H,tog(H)} * M = 0) ¥imp (Has_cnfModel_thryvar(0,M) ¥eq Has_cnfModel_thryvar(0, M + {H})). Proof:
Suppose_not(hh,m) ==> AUTO
	Suppose ==> Stat1: Has_cnfModel_thryvar(0,m)
		Use_def(Has_cnfModel_thryvar) ==> ({h in m | tog(h) in m} = 0) & (not Has_cnfModel_thryvar(0,m+{hh}))
		(0,m,m+{hh})-->TcnfModels8(Stat1*) ==> Stat2: {h in ((m+{hh})-m) | tog(h) in (m + {hh})} /= 0
		c1-->Stat2(Stat2*) ==> (c1 = hh) & (tog(c1) in (m + {hh}))
		EQUAL(Stat2) ==> tog(hh) in (m + {hh})
		hh-->TcnfModels0(Stat2*) ==> tog(hh) /= hh
	Discharge ==> AUTO
--
-- Hence we have
--	$Has_cnfModel_thryvar(0,m+{hh}) & (not Has_cnfModel_thryvar(0,m))$,
-- but this will also lead to a contradiction.
--
	(m + {hh})-->TcnfModels1 ==> Stat3: {h in (m + {hh}) | tog(h) in (m + {hh})} = 0
	m-->TcnfModels1 ==> Stat4: {h in m | tog(h) in m} /= 0
	h1-->Stat4(Stat4) ==> (h1 in m) & (tog(h1) in m)
	h1-->Stat3(Stat4) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels23: [disjunctive tautology] {h in C | tog(h) in C} ¥incin {h in C | Has_cnfModel_thryvar({C},{h}) & Has_cnfModel_thryvar({C},{tog(h)})}. Proof:
Suppose_not(d) ==> Stat1: not({h in d | tog(h) in d} ¥incin {h in d | Has_cnfModel_thryvar({d},{h}) & Has_cnfModel_thryvar({d},{tog(h)})})
	k-->Stat1(Stat1*) ==> Stat2: (k in d) & (tog(k) in d) & ((not(Has_cnfModel_thryvar({d},{k}))) or (not(Has_cnfModel_thryvar({d},{tog(k)}))))
	Suppose ==> Stat3: not(Has_cnfModel_thryvar({d},{k}))
		Use_def(Has_cnfModel_thryvar)(Stat3*) ==> ({h in {k} | tog(h) in {k}} /= 0) or ({c in {d} | ({k} * c) = 0} /= 0)
		Suppose ==>  Stat4: {h in {k} | tog(h) in {k}} /= 0
			j-->Stat4(Stat4*) ==> Stat5: j = tog(j)
		j-->TcnfModels0(Stat4*) ==> false; Discharge ==> Stat6: {c in {d} | ({k} * c) = 0} /= 0
	c-->Stat6(Stat2,Stat2*) ==> false; Discharge ==> not(Has_cnfModel_thryvar({d},{tog(k)}))
	Use_def(Has_cnfModel_thryvar)(Stat3*) ==> ({h in {tog(k)} | tog(h) in {tog(k)}} /= 0) or ({c in {d} | ({tog(k)} * c) = 0} /= 0)
	Suppose ==> Stat7: {h in {tog(k)} | tog(h) in {tog(k)}} /= 0
		j1-->Stat7(Stat7*) ==> (j1 = tog(k)) & (tog(j1) = tog(k))
		EQUAL(Stat7) ==> Stat8: tog(k) = tog(tog(k))
	(tog(k))-->TcnfModels0(Stat8*) ==> false; Discharge ==> Stat9: {c in {d} | ({tog(k)} * c) = 0} /= 0
	c1-->Stat9(Stat2,Stat2*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels24: [disjunctive tautology, 2] ((H in C) & (tog(H) in C)) ¥imp (Has_cnfModel_thryvar({C},{H}) & Has_cnfModel_thryvar({C},{tog(H)})). Proof:
Suppose_not(k,d) ==> AUTO
	d-->TcnfModels23 ==> AUTO
	Suppose ==> Stat1: k notin {h in d | tog(h) in d}
	()-->Stat1(*) ==> false; Discharge ==> Stat2: k in {h in d | Has_cnfModel_thryvar({d},{h}) & Has_cnfModel_thryvar({d},{tog(h)})}
	()-->Stat2(*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels25: [tautology withdrawal rule, 2] ({c: c in S, h in c | tog(h) in c} incs T) ¥imp (Is_cnfSat_thryvar(S) ¥eq Is_cnfSat_thryvar(S - T)). Proof:
Suppose_not(s,t) ==> Stat1: ({c: c in S, h in c | tog(h) in c} incs T) & (not (Is_cnfSat_thryvar(S) ¥eq Is_cnfSat_thryvar(S - T)))
	Suppose ==> Is_cnfSat_thryvar(s) & (not Is_cnfSat_thryvar(s - t))
		Use_def(Is_cnfSat_thryvar) ==> Stat2: (EXISTS m | Has_cnfModel_thryvar(s,m)) & (not(EXISTS m | Has_cnfModel_thryvar(s - t,m)))
		(m,m)-->Stat2(Stat2*) ==> Has_cnfModel_thryvar(s,m) & (not Has_cnfModel_thryvar(s - t,m))
		Use_def(Has_cnfModel_thryvar) ==> Stat3: ({c in (s - t) | (m * c) = 0} /= 0) & ({c in s | (m * c) = 0} = 0)
--
-- we will now show that Has_cnfModel_thryvar(s - t, m), which comes to ${c in (s - t) | (m * c) = 0} = 0$
--
	(cc,cc)-->Stat3(Stat3*) ==> false; Discharge ==> Is_cnfSat_thryvar(s - t) & (not Is_cnfSat_thryvar(s))
--
	Use_def(Is_cnfSat_thryvar) ==> Stat4: (EXISTS m | Has_cnfModel_thryvar(s - t,m))
	(n)-->Stat4(Stat4*) ==> Has_cnfModel_thryvar(s - t,n)
--
-- we will use Theorem cnfModels15, by enriching $s - t$ with $t$
-- {arb({h,tog(h)}): c in T, h in (c - M) | tog(h) in (c - M)}
--
	(s - t, n, t)-->TcnfModels10(*) ==> Has_cnfModel_thryvar((s - t) + {c: c in t, h in c | tog(h) in c}, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)})

--
-- We will now show that ${c: c in t, h in c | tog(h) in c} = t$, and hence (since plainly $s incs t$ holds)
-- ...
--
	Suppose ==> Stat5: {c: c in t, h in c | tog(h) in c} /= t
--
-- For this to take place, we have a priori two possibilities, one of which gets immediately discarded.
-- On the other hand, if there could exist an $x in t$ such that $x notin {c: c in t, h in c | tog(h) in c}$,
-- then $x in {c: c in s, h in c | tog(h)}$ should hold; which would, however, lead to a contradiction.
-- We hence draw that ${c: c in t, h in c | tog(h) in c} = t$...
--
		x-->Stat5(Stat5*) ==> Stat6: (x in {c: c in t, h in c | tog(h) in c}) ¥eq (x notin t)
		Suppose ==> Stat7: x in {c: c in t, h in c | tog(h) in c}
		(c0,h0)-->Stat7(Stat6*) ==> false; Discharge ==> Stat8: (x in {c: c in s, h in c | tog(h) in c}) & (x notin {c: c in t, h in c | tog(h) in c})
	(c1,h1,c1,h1)-->Stat8(Stat6*) ==> false; Discharge ==> Stat9: {c: c in t, h in c | tog(h) in c} = t
--
-- ...and now that ${c: c in t, h in c | tog(h) in c} = t$, we can write
-- $Has_cnfModel_thryvar((s - t) + t, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)}) ¥eq Has_cnfModel_thryvar(s, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)})$.
--

	Use_def(Is_cnfSat_thryvar) ==> Stat10: not (EXISTS m | Has_cnfModel_thryvar(s,m))
	EQUAL(Stat9*) ==> Has_cnfModel_thryvar((s - t) + {c: c in t, h in c | tog(h) in c}, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)}) ¥eq
	Has_cnfModel_thryvar((s - t) + t, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)})
	Suppose ==> Stat11: not (s incs t)
		c2-->Stat11(Stat11*) ==> Stat12: (c2 in t) & (c2 notin s)
		(Stat1, Stat12*)ELEM ==> Stat13: c2 in {c: c in s, h in c | tog(h) in c}
		(c3, h3)-->Stat13(Stat12*) ==> false
	Discharge ==> Stat14: s incs t
	(Stat14*)ELEM ==> Stat15: (s - t) + t = s
	EQUAL(Stat15*) ==> Has_cnfModel_thryvar((s - t) + t, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)}) ¥eq
			Has_cnfModel_thryvar(s, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)})
			(n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)})-->Stat10(Stat9*) ==> not Has_cnfModel_thryvar(s, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)})
	Discharge ==> QED
--
--
--
Theorem cnfModels26: [pure literal rule] ((H in Un(S)) & (tog(H) notin Un(S)) & Has_cnfModel_thryvar(0,M) & (not(Has_cnfModel_thryvar({{H,tog(H)}},M)))) ¥imp (Has_cnfModel_thryvar(S, M + {H}) ¥eq Has_cnfModel_thryvar({c in S | H notin c}, M)). Proof:
Suppose_not(h0,s,m) ==> AUTO
--
-- Preamble making the negation of the desired conclusion more explicit.
--
	(h0,s)-->T105(*) ==> Stat1: {v in s | h0 in v} /= 0
	(tog(h0),s)-->T105(*) ==> Stat2: {d in s | tog(h0) in d} = 0
	cc-->Stat1(*) ==> Stat3: (h0 in cc) & (cc in s) &
	Stat4: ({d in s | tog(h0) in d} = 0) & Has_cnfModel_thryvar(0,m) & (not(Has_cnfModel_thryvar({{h0,tog(h0)}},m))) & (not (Has_cnfModel_thryvar(s, m + {h0}) ¥eq Has_cnfModel_thryvar({c in s | h0 notin c}, m)))
--
-- by rewriting $not(Has_cnfModel_thryvar({{H,tog(H)}},M))$, we have $(h0 notin m) & (tog(h0) notin m)$
--
	Use_def(Has_cnfModel_thryvar)(Stat3*) ==> Stat5: {c in {{h0, tog(h0)}} | (m * c) = 0} /= 0
	c0-->Stat5(Stat5*) ==> Stat6: (h0 notin m) & (tog(h0) notin m)
--
	Suppose ==> Has_cnfModel_thryvar(s, m + {h0})
		(s, m + {h0}, h0)-->TcnfModels12(Stat3*) ==> (Has_cnfModel_thryvar({c - {tog(h0)}: c in s | h0 notin c} + {{h0}}, m + {h0} + {h0}) or Has_cnfModel_thryvar({c - {h0}: c in S | tog(h0) notin c} + {{tog(h0)}}, m + {h0} + {tog(h0)}))
--
-- we rule out the second case, as $m + {h0} + {tog(h0)}$ cannot be a model
--
		Suppose ==> Stat7: Has_cnfModel_thryvar({c - {h0}: c in S | tog(h0) notin c} + {{tog(h0)}}, m + {h0} + {tog(h0)})
			Use_def(Has_cnfModel_thryvar)(Stat7*) ==> Stat8: {h in (m + {h0} + {tog(h0)}) | tog(h) in (m + {h0} + {tog(h0)})} = 0
			h0-->Stat8(Stat8*) ==> false
		Discharge ==> Stat9: Has_cnfModel_thryvar({c - {tog(h0)}: c in s | h0 notin c} + {{h0}}, m + {h0} + {h0})
--
		TELEM ==> m + {h0} + {h0} = m + {h0}
		EQUAL(Stat9*) ==> Stat10: Has_cnfModel_thryvar({c - {tog(h0)}: c in s | h0 notin c} + {{h0}}, m + {h0})

		({c - {tog(h0)}: c in s | h0 notin c}, {c - {tog(h0)}: c in s | h0 notin c} + {{h0}}, m + {h0})-->TcnfModels5(Stat10*) ==>
			Stat11: Has_cnfModel_thryvar({c - {tog(h0)}: c in s | h0 notin c}, m + {h0})

		Suppose ==> Stat12: ({c - {tog(h0)}: c in s | h0 notin c}) /= ({c: c in s | h0 notin c})
			c3-->Stat12(Stat12*) ==> Stat13: (c3 in s) & ((c3 -  {tog(h0)}) /= c3)
--
-- therefore $tog(h0) in c3$, and from the hypothesis we get a contradiction
--
			c3-->Stat4(Stat13*) ==> false
		Discharge ==> {c - {tog(h0)}: c in s | h0 notin c} = {c: c in s | h0 notin c}
		EQUAL ==> Has_cnfModel_thryvar({c: c in s | h0 notin c}, m + {h0})

		Suppose ==> Stat14: h0 in Un({c: c in s | h0 notin c})
			(h0,{c: c in s | h0 notin c})-->T105(Stat14*) ==> Stat15: {d in {c: c in s | h0 notin c} | h0 in d} /= 0
			c1-->Stat15(Stat15*) ==> Stat16: (c1 in {c: c in s | h0 notin c}) & (h0 in c1)
			(c2)-->Stat16(Stat16*) ==> false
		Discharge ==> AUTO
--
		({c: c in s | h0 notin c}, m + {h0}, h0)-->TcnfModels21(Stat11) ==> Stat17: Has_cnfModel_thryvar({c: c in s | h0 notin c}, (m + {h0}) - {h0})
-- $h0 notin m$ and hence
		ELEM ==> (m + {h0}) - {h0} = m
		EQUAL ==> false
	Discharge ==> Has_cnfModel_thryvar({c in s | h0 notin c}, m)

--
-- the reverse implication
--

	Use_def(Has_cnfModel_thryvar) ==> ({h in m | tog(h) in m} = 0) & Stat18: ({c in {c in s | h0 notin c} | (m * c) = 0} = 0)
	Use_def(Has_cnfModel_thryvar) ==> ({h in (m + {h0}) | tog(h) in (m + {h0})} /= 0) or ({c in s | ((m + {h0}) * c) = 0} /= 0)
--
-- we analyse the two cases
--
	Suppose ==> Stat19: ({h in (m + {h0}) | tog(h) in (m + {h0})} /= 0)
		h3-->Stat19(Stat19*) ==> (h3 in (m + {h0})) & (tog(h3) in (m + {h0}))
		Use_def(Has_cnfModel_thryvar) ==> Stat20: {h in m | tog(h) in m} = 0
		h3-->TcnfModels0(Stat20*) ==> Stat21: (tog(tog(h3)) = h3) & (tog(h3) /= h3)
--
-- since $h3$ and $tog(h3)$ cannot be both in $m$, we have the two cases,
-- which are quickly discharged by the fact that $(h0 notin m) & (tog(h0) notin m)$
--
		h3-->Stat20(Stat19*) ==> (h3 = h0) or (tog(h3) = h0)
		Suppose ==> Stat22: h3 = h0
			EQUAL ==> false
		Discharge ==> Stat23: tog(h3) = h0
		EQUAL ==> false
	Discharge ==> Stat24: ({c in s | ((m + {h0}) * c) = 0} /= 0)
--
-- it remains that
--
	c4-->Stat24(Stat24*) ==> (c4 in s) & Stat25: (((m + {h0}) * c4) = 0)
--
-- we will show that $c4 in {c in s | h0 notin c}$, and as $(m * c4) = 0$ we get a contradiction
--
	Suppose ==> Stat26: c4 notin {c in s | h0 notin c}
		c4-->Stat26(Stat24*) ==> false
	Discharge ==> AUTO
	c4-->Stat18(Stat24*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels27: [unit literal rule] (({H} in S) & Has_cnfModel_thryvar(0,M) & ({H,tog(H)} * M = 0)) ¥imp (Has_cnfModel_thryvar(S, M + {H}) ¥eq Has_cnfModel_thryvar({c - {tog(H)}: c in S | H notin c}, M)). Proof:
Suppose_not(hh,s,m) ==> AUTO
--
-- let's consider the reverse implication
--
	Suppose ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m)
		Use_def(Has_cnfModel_thryvar) ==> Stat1: ({h in m | tog(h) in m} = 0) & Stat2: ({c in {c - {tog(hh)}: c in s | hh notin c} | (m * c) = 0} = 0) &
			(({h in (m + {hh}) | tog(h) in (m + {hh})} /= 0) or ({c in s | ((m + {hh}) * c) = 0} /= 0))
--
-- suppose that $not Has_cnfModel_thryvar(0, m + {hh})$ by this contradicts $Stat3
--
		Suppose ==> Stat4: ({h in (m + {hh}) | tog(h) in (m + {hh})} /= 0)
			(m + {hh})-->TcnfModels1(Stat4*) ==> not Has_cnfModel_thryvar(0, m + {hh})
			(hh, m)-->TcnfModels22(*) ==> false
		Discharge ==> Stat5: {c in s | ((m + {hh}) * c) = 0} /= 0
		c0-->Stat5(Stat5*) ==> (c0 in s) & (((m + {hh}) * c0) = 0)
		ELEM ==> (hh notin c0) & ((m * (c0 - tog(hh))) = 0)
		Suppose ==> Stat6: (c0 - {tog(hh)}) notin {c - {tog(hh)}: c in s | hh notin c}
			c0-->Stat6(*) ==> false
		Discharge ==> (c0 - {tog(hh)}) in {c - {tog(hh)}: c in s | hh notin c}
		(c0 - {tog(hh)})-->Stat2(Stat5*) ==> false
	Discharge ==> Has_cnfModel_thryvar(s, m + {hh})
--
-- the remaining case
--
	Use_def(Has_cnfModel_thryvar) ==> Stat7: ({h in (m + {hh}) | tog(h) in (m + {hh})} = 0) & Stat8: ({c in s | ((m + {hh}) * c) = 0} = 0) &
		(({h in m | tog(h) in m} /= 0) or ({c in {c - {tog(hh)}: c in s | hh notin c} | (m * c) = 0} /= 0))
--
-- again $not Has_cnfModel_thryvar(0, m)$ leads to a contradiction
--
	Suppose ==> {h in m | tog(h) in m} /= 0
		m-->TcnfModels1(Stat7*) ==> not Has_cnfModel_thryvar(0, m)
		(hh, m)-->TcnfModels11(*) ==> false
	Discharge ==> Stat9: {c in {c - {tog(hh)}: c in s | hh notin c} | (m * c) = 0} /= 0
--
	c10-->Stat9(Stat9*) ==> Stat10: (c10 in {c - {tog(hh)}: c in s | hh notin c}) & ((m * c10) = 0)
	c1-->Stat10(Stat10*) ==> (c10 = c1 - {tog(hh)}) & (c1 in s) & (hh notin c1)
	Suppose ==> Stat11: (c1 * (m + {hh})) /= 0
		h0-->Stat11(Stat11*) ==> (h0 in c1) & (h0 in (m + {hh}))
--
-- by rewriting $not(Has_cnfModel_thryvar({{H,tog(H)}},M))$, we have $(hh notin m) & (tog(hh) notin m)$
--
		Use_def(Has_cnfModel_thryvar) ==> Stat12: {c in {{hh, tog(hh)}} | (m * c) = 0} /= 0
		c5-->Stat12(Stat12) ==> (c5 in {{hh, tog(hh)}}) & ((m * c5) = 0)
		ELEM ==> Stat13: m * {hh, tog(hh)} = 0
		Suppose ==> (hh in m) or (tog(hh) in m)
			(hh)-->Stat13(Stat13) ==> tog(hh) in m
			(tog(hh))-->Stat13(Stat13) ==> false
		Discharge ==> (hh notin m) & (tog(hh) notin m)
--
-- It elementarily follows from what precedes that $h0 in m$ and $h0 in c10$;
-- but this conflicts with the second part of Stat14
--
	(Stat10*)Discharge ==> (c1 * (m + {hh})) = 0
--
-- $c1$ generates the contradiction for Stat8
--
	c1-->Stat8(Stat10*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels28: [unit literal rule, 2] ({H} in S) ¥imp (Is_cnfSat_thryvar(S) ¥eq Is_cnfSat_thryvar({c - {tog(H)}: c in S | H notin c})). Proof:
Suppose_not(hh,s) ==> AUTO
	Suppose ==> Is_cnfSat_thryvar(s)
		Use_def(Is_cnfSat_thryvar) ==> Stat1: (EXISTS m | Has_cnfModel_thryvar(s,m)) & Stat2: (not (EXISTS m | Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c},m)))
		m-->Stat1(Stat1*) ==> Has_cnfModel_thryvar(s,m)
		Use_def(Has_cnfModel_thryvar)(*) ==> Stat3: ({h in m | tog(h) in m} = 0) & Stat4: ({c in s | (m * c) = 0} = 0)
--
-- we verify the hypothesis of Theorem cnfModels25 for $hh, s, m - {hh}$
--
-- firstly, $Has_cnfModel_thryvar(0, m - {hh})$
--
		Suppose ==> Stat5: not Has_cnfModel_thryvar(0, m - {hh})
			(m - {hh})-->TcnfModels1(Stat5*) ==> Stat6: {h in (m - {hh}) | tog(h) in (m - {hh})} /=0
			h1-->Stat6(Stat6) ==> Stat7: (h1 in (m - {hh})) & (tog(h1) in (m - {hh}))
			h1-->Stat3(Stat7) ==> false
		Discharge ==> Has_cnfModel_thryvar(0, m - {hh})
--
-- secondly, $not Has_cnfModel_thryvar({{hh, tog(hh)}}, m - {hh})$
--
		{hh}-->Stat4(*) ==> Stat8: hh in m
		hh-->Stat3(Stat8*) ==> tog(hh) notin m
		Suppose ==> Has_cnfModel_thryvar({{hh, tog(hh)}}, m - {hh})
			Use_def(Has_cnfModel_thryvar)(*) ==> Stat9: ({c in {{hh, tog(hh)}} | ((m - {hh}) * c) = 0} = 0)
			({hh, tog(hh)})-->Stat9(Stat8*) ==> false
		Discharge ==> not Has_cnfModel_thryvar({{hh, tog(hh)}}, m - {hh})
--
-- now we prepare to apply Theorem cnfModels25
--
		(Stat8, Stat8*)ELEM ==> Stat10: (m - {hh}) + {hh} = m
		EQUAL ==> Has_cnfModel_thryvar(s, (m - {hh}) + {hh})

		(hh, s, m - {hh})-->TcnfModels27 ==> Stat11: Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m - {hh})
		(m - {hh})-->Stat2(Stat11*) ==> false
	Discharge ==> Is_cnfSat_thryvar({c - {tog(hh)}: c in s | hh notin c})
--
-- the reverse implication
--
	Use_def(Is_cnfSat_thryvar) ==> Stat12: (EXISTS m | Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c},m)) & Stat13: (not (EXISTS m | Has_cnfModel_thryvar(s,m)))
	n-->Stat12(Stat12*) ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c},n)
	Suppose ==> Stat14: hh in Un({c - {tog(hh)}: c in s | hh notin c})
		Use_def(Un)(Stat14*) ==> Stat15: hh in {h: c in {c - {tog(hh)}: c in s | hh notin c}, h in c}
		(c2, h2)-->Stat15(Stat15*) ==> Stat16: (c2 in {c - {tog(hh)}: c in s | hh notin c}) & (hh in c2)
		(c3)-->Stat16(Stat16*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat17: tog(hh) in Un({c - {tog(hh)}: c in s | hh notin c})
		Use_def(Un)(Stat17*) ==> Stat18: tog(hh) in {h: c in {c - {tog(hh)}: c in s | hh notin c}, h in c}
		(c4, h4)-->Stat18(Stat18*) ==> Stat19: (c4 in {c - {tog(hh)}: c in s | hh notin c}) & (tog(hh) in c4)
		(c5)-->Stat19(Stat19*) ==> false
	Discharge ==> AUTO
	({c - {tog(hh)}: c in s | hh notin c}, n, hh)-->TcnfModels21 ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, n - {hh})
	({c - {tog(hh)}: c in s | hh notin c}, n - {hh}, tog(hh))-->TcnfModels21 ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, (n - {hh}) - {tog(hh)})

	Use_def(Has_cnfModel_thryvar)(*) ==> Stat20: ({h in ((n - {hh}) - {tog(hh)}) | tog(h) in ((n - {hh}) - {tog(hh)})} = 0) & Stat21: ({c in {c - {tog(hh)}: c in s | hh notin c} | (((n - {hh}) - {tog(hh)}) * c) = 0} = 0)
--
-- we verify the hypothesis of Theorem cnfModels25 for $hh, s, (n - {hh}) - {tog(hh)}$
--
-- firstly, $Has_cnfModel_thryvar(0, ((n - {hh}) - {tog(hh)}))$
--
	((n - {hh}) - {tog(hh)})-->TcnfModels1(Stat20*) ==> Has_cnfModel_thryvar(0, (n - {hh}) - {tog(hh)})
--
-- secondly, $not Has_cnfModel_thryvar({{hh, tog(hh)}}, (n - {hh}) - {tog(hh)})$
--
	Suppose ==> Has_cnfModel_thryvar({{hh, tog(hh)}}, (n - {hh}) - {tog(hh)})
		Use_def(Has_cnfModel_thryvar)(*) ==> Stat22: ({c in {{hh, tog(hh)}} | (((n - {hh}) - {tog(hh)}) * c) = 0} = 0)
		({hh, tog(hh)})-->Stat22(Stat22*) ==> false
	Discharge ==> not Has_cnfModel_thryvar({{hh, tog(hh)}}, (n - {hh}) - {tog(hh)})
--
-- we apply Theorem cnfModels25
--
	(hh, s, (n - {hh}) - {tog(hh)})-->TcnfModels27 ==> Stat23: Has_cnfModel_thryvar(s, ((n - {hh}) - {tog(hh)}) + {hh})
	(((n - {hh}) - {tog(hh)}) + {hh})-->Stat13(Stat23*) ==> false
	Discharge ==> QED
--
-- The following is a specialized variant of Theorem 279
--
Theorem cnfModels29: (Un(S) incs Un({c - {tog(H)}: c in S | H notin c})) & (H notin Un({c - {tog(H)}: c in S | H notin c})). Proof:
Suppose_not(s,h) ==> AUTO
	Suppose ==> Stat1: not(Un(s) incs Un({c - {tog(h)}: c in s | h notin c}))
		h0-->Stat1(Stat1*) ==> (h0 in Un({c - {tog(h)}: c in s | h notin c})) & (h0 notin Un(s))
		Use_def(Un) ==> Stat2: (h0 in {x: y in {c - {tog(h)}: c in s | h notin c}, x in y}) &
			Stat3: (h0 notin {x: y in s, x in y})
		(y,x)-->Stat2(Stat2*) ==> Stat4: (h0 in y) & Stat5: (y in {c - {tog(h)}: c in s | h notin c})
		c-->Stat5(Stat4*) ==> (c in s) & (y = c - {tog(h)})
		(c, h0)-->Stat3(Stat4*) ==> false
	Discharge ==> h in Un({c - {tog(h)}: c in s| h notin c})
	Use_def(Un) ==> Stat6: (h in {x: y in {c - {tog(h)}: c in s | h notin c}, x in y})
	(y1, x1)-->Stat6(Stat6*) ==> Stat7: (y1 in {c - {tog(h)}: c in s | h notin c}) & (h in y1)
	c1-->Stat7(Stat7*) ==> false
	Discharge ==> QED
--
-- Subsets of finitely satisfiable sets are finitely satisfiable.
--
Theorem cnfModels30: (Is_cnfFinSat_thryvar(P) & (P incs Q)) ¥imp Is_cnfFinSat_thryvar(Q). Proof:
Suppose_not(p0,q0) ==> AUTO
--
-- Arguing by contradiction, let $p0,q0$ be a counterexample to the claim.
--
	Use_def(Is_cnfFinSat_thryvar) ==> Stat1: (not(FORALL f ¥incin q0 | Finite(f) ¥imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))) &
		(FORALL f ¥incin p0 | Finite(f) ¥imp (EXISTS n | (FORALL s in f | Has_cnfModel_thryvar(s,n))))
--
-- Therefore, a finite subset $f0$ of $q0$ exists whose elements are not all simultaneously satisfiable;
-- but then, the very same $f0$ would also be a subset of $p0$ (since $p0 incs q0$),
-- contradicting the finite satisfiability of $q0$.
--
	(f0,f0)-->Stat1 ==> false
	Discharge ==> QED
--
--
--
ENTER_THEORY Set_theory
--
-- DISPLAY cnfModels
--
-- THEORY cnfModels(tog(x))
--
--
--	(FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
--
-- ==> (Has_cnfModel_thryvar, Is_cnfSat_thryvar, Is_cnfFinSat_thryvar)
--
--	(FORALL s, m | Has_cnfModel_thryvar(s,m) ¥eq (({h in m | tog(h) in m} = 0) & ({c in s | (m * c) = 0} = 0)))
--
--	(FORALL s | Is_cnfSat_thryvar(s) ¥eq (EXISTS m | Has_cnfModel_thryvar(s,m)))
--
--	(FORALL m | Has_cnfModel_thryvar(0,m) ¥eq ({h in m | tog(h) in m} = 0))
--
--	(FORALL s | Has_cnfModel_thryvar(0,0) & Is_cnfSat_thryvar(0) & ((0 in s) ¥imp (not(Is_cnfSat_thryvar(s)))))
--
--	(FORALL s | (({h in Un(s) | tog(h) in Un(s)} = 0) & (0 notin s)) ¥imp (Has_cnfModel_thryvar(s,Un(s)) & Is_cnfSat_thryvar(s)))
--
--	(FORALL s | ({u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)} incs s) ¥imp (Has_cnfModel_thryvar(s,Un(s)) & Is_cnfSat_thryvar(s)))
--
--	(FORALL t, s, m | ((t ¥incin s) & Has_cnfModel_thryvar(s,m)) ¥imp Has_cnfModel_thryvar(t,m))
--
--	(FORALL t, s | ((t ¥incin s) & Is_cnfSat_thryvar(s)) ¥imp Is_cnfSat_thryvar(t))
--
--	(FORALL s, m | Has_cnfModel_thryvar(s,m) ¥imp Has_cnfModel_thryvar(s, m * Un(s)))
--	(FORALL s, m, n | (Has_cnfModel_thryvar(s,m) &
--		({h in (n - m) | tog(h) in n} = 0) & (m ¥incin n)) ¥imp Has_cnfModel_thryvar(s,n))
--
--	(FORALL s, m, t | Has_cnfModel_thryvar(s,m) ¥imp Has_cnfModel_thryvar(0, m + {arb({k,tog(k)}): c in t, k in (c - m) | tog(k) in (c - m)}))
--
--	(FORALL s, m, t | Has_cnfModel_thryvar(s,m) ¥imp Has_cnfModel_thryvar(s + {c: c in t, h in c | tog(h) in c}, m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}))
--
--	(FORALL s, m, h | (Has_cnfModel_thryvar(s,m) & (not Has_cnfModel_thryvar({{h}} + {c - {tog(h)}: c in s | H notin c}, m + {h}))) ¥imp (tog(h) in m))
--
--	(FORALL s, m, h | Has_cnfModel_thryvar(s,m) ¥imp (Has_cnfModel_thryvar({{h}} + {c - {tog(h)}: c in s | H notin c}, m + {h}) or Has_cnfModel_thryvar({{tog(h)}} + {c - {h}: c in s | tog(h) notin c}, m + {tog(h)})))
--
--	(FORALL h, s, m | Has_cnfModel_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}, m) ¥imp Has_cnfModel_thryvar(s,m))
--
--	(FORALL h, s | Is_cnfSat_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}) ¥imp Is_cnfSat_thryvar(s))
--
--	(FORALL s, h | Is_cnfSat_thryvar(s) ¥eq (Is_cnfSat_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}) or Is_cnfSat_thryvar({{tog(h)}} + {c - {h}: c in S | tog(h) notin c})))
--
--	(FORALL h, s | (tog(h) notin Un(s)) ¥imp (Is_cnfSat_thryvar(s) ¥eq Is_cnfSat_thryvar({{h}} + {c in s | h notin c})))
--
--	(FORALL h, s, m | (({h} in s) & Has_cnfModel_thryvar(s,m)) ¥imp ((h in m) & (tog(h) notin m)))
--
--	(FORALL s, t | ({c: c in s, h in c | tog(h) in c} incs t) ¥imp (Is_cnfSat_thryvar(s) ¥eq Is_cnfSat_thryvar(s - t)))
--
--	(FORALL s, h | Is_cnfSat_thryvar(s) ¥eq (Is_cnfSat_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}) or Is_cnfSat_thryvar({{tog(h)}} + {c - {h}: c in s | tog(h) notin c})))
--
--	(FORALL h, s | ((h in Un(s)) & (tog(h) notin Un(s))) ¥imp (Is_cnfSat_thryvar(s) ¥eq Is_cnfSat_thryvar({c in s | h notin c})))
--
--	(FORALL h, c, s, m| ((h in c) & (c in s) & ({d in s | tog(h) in d} = 0) & Has_cnfModel_thryvar(0,m) & (not(Has_cnfModel_thryvar({{h,tog(h)}},m)))) ¥imp (Has_cnfModel_thryvar(s, m + {h}) ¥eq Has_cnfModel_thryvar({c in s | h notin c}, m)))
--
--	(FORALL h, c, s | ((h in c) & (c in s) & ({d in s | tog(h) in d} = 0)) ¥imp (Is_cnfSat_thryvar(s) ¥eq Is_cnfSat_thryvar({c in s | h notin c})))
--
--	(FORALL h, s, m| (({h} in s) & Has_cnfModel_thryvar(0,m) & ({h,tog(h)} * m = 0)) ¥imp (Has_cnfModel_thryvar(s, m + {h}) ¥eq Has_cnfModel_thryvar({c - {tog(h)}: c in s | h notin c}, m)))
--
--	(FORALL h, s | ({h} in s) ¥imp (Is_cnfSat_thryvar(s) ¥eq Is_cnfSat_thryvar({c - {tog(h)}: c in s | h notin c})))
--
--	(FORALL s, h | (Un(s) incs Un({c - {tog(h)}: c in s | h notin c})) & (h notin Un({c - {tog(h)}: c in s | h notin c})))
--
--	(FORALL s, m, n | (Has_cnfModel_thryvar(s,m) & ({h in (n - m) | tog(h) in n} = 0) & (m ¥incin n)) ¥imp Has_cnfModel_thryvar(s,n))
--
--	(FORALL s, m, n, t | (Has_cnfModel_thryvar(s,m) & (n incs m) & Has_cnfModel_thryvar(t,n)) ¥imp Has_cnfModel_thryvar(s,n))
--
--	(FORALL s, m, h | (Has_cnfModel_thryvar(s,m) & (h notin Un(s))) ¥imp (Has_cnfModel_thryvar(s, m - {h})))
--
--	(FORALL h, s, m | ((h in Un(s)) & (tog(h) notin Un(s)) & Has_cnfModel_thryvar(0,m) & (not(Has_cnfModel_thryvar({{h,tog(h)}},m)))) ¥imp (Has_cnfModel_thryvar(s, m + {h}) ¥eq Has_cnfModel_thryvar({c in s | H notin c}, m)))
--
--	(FORALL h, m | ({h,tog(h)} * m = 0) ¥imp (Has_cnfModel_thryvar(0,m) ¥eq Has_cnfModel_thryvar(0, m + {h})))
--
--	(FORALL c | {h in c | tog(h) in c} ¥incin {h in c | Has_cnfModel_thryvar({c},{h}) & Has_cnfModel_thryvar({c},{tog(h)})})
--
--	(FORALL h, c | ((h in c) & (tog(h) in c)) ¥imp (Has_cnfModel_thryvar({c},{h}) & Has_cnfModel_thryvar({c},{tog(h)})))
--
--	(FORALL p | Is_cnfFinSat_thryvar(p) ¥eq (FORALL f ¥incin P | Finite(f) ¥imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m)))))
--
--	(FORALL p, q | (Is_cnfFinSat_thryvar(p) & (p incs q)) ¥imp Is_cnfFinSat_thryvar(q))
--
--	(FORALL p, x | Is_cnfFinSat_thryvar(p) ¥imp Is_cnfFinSat_thryvar(p + {{{x}}}) or Is_cnfFinSat_thryvar(p + {{{tog(x)}}}))
--
--	(FORALL p |(Is_cnfFinSat_thryvar(p) & (FORALL s in p, c in s | Finite(c))) ¥imp (EXISTS m | (FORALL s in p | Has_cnfModel_thryvar(s,m))))
--
-- END cnfModels
--
--
--
THEORY davisPutnam(tog(X),lits,fail,sl(S))
--
-- This theory develops an "archetype" version of the Davis-Putnam algorithm
-- for propositional conjunctive normal forms constructed from a given
-- collection $lits$ of literals: this is done assuming that a global
-- Galois correspondence $tog(x)$ (modeling negation over $lits$) is given,
-- along with a function $sl(s)$ choosing from any non-trivial conjunctive
-- normal form $s$ a literal appearing in $s$. In terms of $sl$, a function
-- $dp_thryvar(s)$ will be recursively defined, returning a model for
-- any satisfiable conjunctive normal form $s$. A dummy value $fail$ is also
-- passed as a parameter, whose insertion into a model will render it
-- fictitious, to indicate unsatisfiability.
--
	(FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
--
	{tog(x): x in lits} = lits
--
	fail notin lits
--
	(FORALL s | ((s /= 0) & (0 notin s)) ¥imp (sl(s) in Un(s)))
--
END davisPutnam
--
ENTER_THEORY davisPutnam
--
-- We define a set of clauses to be a finite set of finite sets of literals:
-- each finite set of literals, called a "clause", will be treated as a disjunction;
-- and a set of sets of literals will be treated  as a conjunction of clauses.
-- Accordingly, the null set $0$ will represent falsehood when viewed as a clause,
-- whereas it will represent truth when viewed as a set of clauses.
--
Def davisPutnam0: clauSets_thryvar := { s ¥incin pow(lits) | Finite(Un(s)) }
--
--
--
Theorem davisPutnam0: (tog(tog(H)) = H) & (tog(H) /= H) &
((tog(H) notin Un(S)) ¥imp ({c in S | H notin c} = {c - {tog(H)}: c  in S | H notin c})). Proof:
Suppose_not(h,s) ==> AUTO
	Assump ==> Stat1: (FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
	h-->Stat1(*) ==> AUTO
	(tog(h),s)-->T105(*) ==> Stat2: (({c: c in s | h notin c} /= {c - {tog(h)}: c  in s | h notin c})) &
		({v in s | tog(h) in v} = 0)
	(c,c)-->Stat2(Stat2*) ==> false
	Discharge ==> QED
--
-- We begin by checking that the formal definition just given of the sets of clauses over
-- the given literals matches our intentions, as informally declared above. The two
-- following theorems show that any $S in clauSets$ is finite, as is any of its
-- members. Incidentally, we observe that neither $fail$ nor its complement
-- occurs in any $S in clauSets$.
--
Theorem davisPutnam1: (S in clauSets_thryvar) ¥imp (Finite(S) & Finite(Un(S)) &
		(Un(S) ¥incin lits) & (fail notin Un(S)) & (tog(fail) notin Un(S))). Proof:
Suppose_not(s) ==> AUTO
--
-- Assuming $s$ to be a counterexample to the claim...
--
	Use_def(clauSets_thryvar) ==> Stat1: s in { s ¥incin pow(lits) | Finite(Un(s)) }
	()-->Stat1(*) ==> Finite(Un(s))
	(s,s)-->T266(*) ==> Finite(s)
--
-- ...we readily discard the possibility that $s$ is infinite.
--
	Use_def(Un(s)) ==> AUTO
	Assump ==> Stat2: ({tog(x): x in lits} = lits) & (fail notin lits)
	Suppose ==> Stat3: Un(s) ¥nincin lits
		h0-->Stat3(Stat1*) ==> Stat4: (h0 in {h: c in s, h in c}) & (h0 notin lits)
		(c0,h1)-->Stat4(Stat4*) ==> (c0 in s) & (h0 in c0)
		Use_def(clauSets_thryvar) ==> Stat5: s in { s ¥incin pow(lits) | Finite(Un(s)) }
		Use_def(pow(lits)) ==> AUTO
		()-->Stat5(Stat4*) ==> Stat6: c0 in {x: x ¥incin lits}
		c1-->Stat6(Stat4*) ==> false
--
-- Since it is easily recognized that $Un(s) ¥incin lits$, we are left with
-- two possibilities: that $fail in Un(s)$, hence $fail notin lits$; or that
-- $tog(fail) in Un(s)$, hence $tog(fail) notin lits$. The first is untenable,
-- because it manifestly contradicts an assumption of the present THEORY;
-- hence we are left with the possibility $tog(fail) notin lits$.
--
	Discharge ==> Stat7: tog(fail) in {tog(x): x in lits}
	h2-->Stat7(Stat7*) ==> (tog(fail) = tog(h2)) & (h2 in lits)
	fail-->TdavisPutnam0(Stat7*) ==> tog(tog(fail)) = fail
	h2-->TdavisPutnam0(Stat7*) ==> tog(tog(h2)) = h2
--
-- However, this leads to a contradiction too, thanks to the other assumptions of
-- the present THEORY.
--
	EQUAL(Stat2) ==> false
	Discharge ==> QED
--
Theorem davisPutnam2: ((S in clauSets_thryvar) & (C in S)) ¥imp Finite(C). Proof:
Suppose_not(s,c) ==> AUTO
	Use_def(clauSets_thryvar) ==> Stat1: s in { s ¥incin pow(lits) | Finite(Un(s)) }
	()-->Stat1(Stat1*) ==> Finite(Un(s))
	s-->T274 ==> Stat2: (FORALL x in s | x ¥incin Un(s))
	c-->Stat2(*) ==> c ¥incin Un(s)
	(Un(s),c)-->T189(*) ==> false
	Discharge ==> QED
--
-- Observe that any subset of a set of clauses is a set of clauses:
--
Theorem davisPutnam3: ((S in clauSets_thryvar) & ((T ¥incin S) or (Un(T) ¥incin Un(S)))) ¥imp (T in clauSets_thryvar). Proof:
Suppose_not(s,t) ==> AUTO
--
-- Indeed, if $t$ is a subset of a set $s$ of clauses, its unionset
-- will be included in the unionset of $s$, which is finite, and hence
-- will be finite in its turn. Moreover $Un(t)$ will, like $Un(s)$, have
-- only literals as members. The alternative $Un(t) ¥incin Un(s)$ leads,
-- by a slightly more elaborate argument, to a similar contradiction.
--
	Suppose ==> Un(t) ¥nincin Un(s)
		(t,s)-->T276(*) ==> false
	Discharge ==> AUTO
	Use_def(clauSets_thryvar)(*) ==> Stat1: s in { s ¥incin pow(lits) | Finite(Un(s)) } &
		Stat2: (t notin { s ¥incin pow(lits) | Finite(Un(s)) })
	t-->Stat2 ==> AUTO
	(Un(s),Un(t))-->T189 ==> AUTO
	()-->Stat1(*) ==> Stat3: (Finite(Un(s))) & (s ¥incin pow(lits)) & Stat4: (t ¥nincin pow(lits))
	Use_def(pow(lits)) ==> AUTO
	c-->Stat4(Stat3*) ==> Stat5: (c notin {d: d ¥incin lits}) & (c in t)
	c-->Stat5(Stat5*) ==> Stat6: c ¥nincin lits
	h-->Stat6(Stat6*) ==> Stat7: (h in c) & (h notin lits)
	Use_def(Un(s)) ==> AUTO
	Suppose ==> h notin Un(s)
		Use_def(Un(t)) ==> AUTO
		ELEM ==> Stat8: h notin {x: d in t, x in d}
		(c,h)-->Stat8(Stat5,Stat7*) ==> false
	Discharge ==> Stat9: h in {x: d in s, x in d}
	(d,hp)-->Stat9(Stat3*) ==> Stat10: (d in {x: x ¥incin lits}) & (h in d)
	dp-->Stat10(Stat10,Stat7*) ==> false
	Discharge ==> QED
--
-- Then we import from the THEORY $cnfModel$ the notions concerning the satisfiability
-- of propositional formulae in conjunctive normal form (represented as sets of clauses).
-- Moreover, we import a batch of useful information about satisfiability and models.
--
APPLY(Has_cnfModel_thryvar:Has_dpModel_thryvar,Is_cnfSat_thryvar:Is_dpSat_thryvar) cnfModels(tog(X)->tog(X)) ==>
Theorem davisPutnam4:
	(FORALL s | Is_dpSat_thryvar(s) = (EXISTS m | Has_dpModel_thryvar(s,m))) &
	(FORALL s | Has_dpModel_thryvar(0,0) & Is_dpSat_thryvar(0) & ((0 in s) ¥imp (not(Is_dpSat_thryvar(s))))) &
	(FORALL s | ({u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)} incs s) ¥imp (Has_dpModel_thryvar(s,Un(s)) & Is_dpSat_thryvar(s))) &
	(FORALL s, h | Is_dpSat_thryvar(s) ¥eq
		(Is_dpSat_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}) or
			Is_dpSat_thryvar({{tog(h)}} + {c - {h}: c in s | tog(h) notin c}))) &
	(FORALL h, s | (tog(h) notin Un(s)) ¥imp
		(Is_dpSat_thryvar(s) ¥eq Is_dpSat_thryvar({{h}} + {c in s | h notin c}))) &
	(FORALL h, s, m | (({h} in s) & Has_dpModel_thryvar(s,m)) ¥imp ((h in m) & (tog(h) notin m))) &
	(FORALL h, s, m | Has_dpModel_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}, m) ¥imp
		Has_dpModel_thryvar(s,m)) &
	(FORALL s, m, t | Has_dpModel_thryvar(s,m) ¥imp Has_dpModel_thryvar(s + {c: c in t, h in c | tog(h) in c}, m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)})) &
	(FORALL t,s | ((t ¥incin s) & Is_dpSat_thryvar(s)) ¥imp Is_dpSat_thryvar(t))
--
Def davisPutnam1: settled_thryvar(S) := {u: u in S, h in u | (u = {h}) & ({h,tog(h)} * Un(S - {u}) = 0)}
--
Def davisPutnam2: pk_thryvar := {[x,sl(x - settled_thryvar(x))]: x in clauSets_thryvar}
--
-- In sight of defining the Davis-Putnam procedure recursively, we must single out
-- a well-founded relation over the family $clauSets$ of all sets of clauses.
-- A set of clauses is regarded as being "smaller" than another if its unsettled part
-- involves fewer literals than the unsettled part of the other. Our next theorem shows
-- that the relationship just introduced is indeed well-founded over the family $clauSets$
-- of sets of clauses.
--
Theorem davisPutnam5: ((G ¥incin clauSets_thryvar) & (G /= 0)) ¥imp
	(EXISTS m in G | (FORALL v in G | not((Un(v - settled_thryvar(v)) ¥incin Un(m - settled_thryvar(m))) &
				(Un(v - settled_thryvar(v)) /= Un(m - settled_thryvar(m)))))). Proof:
Suppose_not(g) ==> Stat1: (not (EXISTS m in g | (FORALL v in g |
			not((Un(v - settled_thryvar(v)) ¥incin Un(m - settled_thryvar(m))) &
				(Un(v - settled_thryvar(v)) /= Un(m - settled_thryvar(m))))))) &
			(g ¥incin clauSets_thryvar) & (g /= 0)
--
-- Assuming a counterexample $g$ to the claim to exist, we will reach a contradiction
-- by observing that every member of the set ${Un(xp): xp in clauSets_thryvar}$ is finite, and
-- hence strict inclusion is well-founded on this set, by Theorem 411. Moreover, it is clear
-- that $Un(x - settled_thryvar(x))$ is a member of this set for any $x in clauSets_thryvar$;
-- therefore the relation holding between any two members of $clauSets_thryvar$ when the
-- unionset of the (unsettled part of the) former is strictly included in the unionset of the
-- (unsettled part of the) latter is well-founded.
--
	Suppose ==> Stat2: not(FORALL x in {Un(xp): xp in clauSets_thryvar} | Finite(x))
		yq-->Stat2(Stat2*) ==> Stat3: (yq in {Un(xp): xp in clauSets_thryvar}) & (not Finite(yq))
		xq-->Stat3(Stat3*) ==> (yq = Un(xq)) & (xq in clauSets_thryvar) & (not Finite(yq))
		Use_def(clauSets_thryvar) ==> Stat4: xq in { s ¥incin pow(lits) | Finite(Un(s)) }
		()-->Stat4(Stat4*) ==> Finite(Un(xq))
	EQUAL ==> false; Discharge ==> AUTO
	Suppose ==> Stat5: not(FORALL t |
			((t ¥incin {Un(xp): xp in clauSets_thryvar}) & (t /= 0)) ¥imp
			(EXISTS w in t | (FORALL v in t | not((v ¥incin w) & (v /= w)))))
		u-->Stat5 ==> AUTO
	({Un(xp): xp in clauSets_thryvar},u)-->T411(*) ==> false; Discharge ==> AUTO
	Suppose ==> Stat6: not(FORALL x | (x in clauSets_thryvar) ¥imp (Un(x - settled_thryvar(x)) in {Un(xp): xp in clauSets_thryvar}))
		x-->Stat6(Stat6*) ==> Stat7: (Un(x - settled_thryvar(x)) notin
			{Un(xp): xp in clauSets_thryvar}) & (x in clauSets_thryvar)
		(x,x - settled_thryvar(x))-->TdavisPutnam3(Stat7*) ==>
			((x - settled_thryvar(x)) in clauSets_thryvar)
	(x - settled_thryvar(x))-->Stat7(Stat7*) ==> false; Discharge ==> AUTO
	APPLY() inh_well_founded_set(s->{Un(xp): xp in clauSets_thryvar},arg1_bef_arg2(Y,X)->((Y ¥incin X) & (Y /= X)),sp->clauSets_thryvar,displace(X)->Un(X - settled_thryvar(X))) ==>
		Stat8: (FORALL t | ((t ¥incin clauSets_thryvar) & (t /= 0)) ¥imp (EXISTS w in t | (FORALL v in t | not((Un(v - settled_thryvar(v)) ¥incin Un(w - settled_thryvar(w))) & (Un(v - settled_thryvar(v)) /= Un(w - settled_thryvar(w)))))))
	g-->Stat8(Stat1,Stat1*) ==> false
	Discharge ==> QED
--
-- In sight of invoking the THEORY $wellfounded_recursive_fcn$, we define
-- an operator $f3_dp_thryvar$ and a predicate $P3_dp_thryvar$, both ternary, which will play
-- the role of formal input parameters. The third argument of these is meant to designate a
-- "picking" function like the one just defined. As regards the operator $f3_dp_thryvar$, its
-- first and second argument generally designate a set $x$ of clauses and a doubleton
-- collection of models, one modeling $x + {{p~[x]}}$ and one modeling $x + {{tog(p~[x])}}$;
-- the pseudo-model ${fail}$ being used in place of either when a genuine model does not exists.
-- When $x$ is trivially satisfiable (e.g. null), as it coincides with its obvious part, then
-- $f3_dp_thryvar(x,_,_)$ supplies its model $Un(x)$;  when $x$ is manifestly false,
-- as flagged by the null clause present in it, $f3_dp_thryvar(x,_,_)$ returns ${fail}$;
-- when $x$ is neither trivially satisfiable nor manifestly false, $f3_dp_thryvar(x,m,p)$
-- draws a model of $x$ (if any) from $m$, giving priority to the model of $x + {{p~[x]}}$ if
-- this exist but picking the model of $x + {{tog(p~[x])}}$ when the former does not exist
-- (of course if neither has a model, $m={{fail}}$ will hold.
--
Def davisPutnam3: f3_dp_thryvar(X,M,P) := if 0 in X then {fail}
	elseif settled_thryvar(X) incs X then Un(X)
	else arb({ w in M | ((fail notin Un(M)) ¥imp ((P~[X]) in w)) &
                  ((fail in w) ¥imp (FORALL v in M | fail in v)) })
	end if
--
-- As regards the predicate $P3_dp_thryvar$, its first argument again designates a set
-- $x$ of clauses, and its second designates the set $y$ resulting from the simplification
-- of $x$ when either the literal $h$ or its complement $tog(h)$ is assumed to be true,
-- where $h$ is selected from $x$ by the picking function. It would be pointless to carry out
-- the simplification relative to $tog(h)$ when $h$ is a "pure" literal, namely one whose
-- complement does not occur in $x$: in this case the above-discussed operator $f3_dp_thryvar$
-- will receive a singleton, instead of a doubleton, set of models. There are situations
-- in which the picking function is not guaranteed to return anything significant, but they
-- cause no problem because in such cases the satisfiability check for $x$ is obvious and
-- can be performed directly the the operator $f3_dp_thryvar$ without reduction of $x$ to
-- a simpler $y$.
--
Def davisPutnam4: P3_dp_thryvar(X,Y,P) := ( ((tog(P~[X]) in Un(X)) &
		(Y = {{tog(P~[X])}} + {c - {P~[X]}: c in X | tog(P~[X]) notin c})) or
		(Y = {{P~[X]}} + {c - {tog(P~[X])}: c in X | (P~[X]) notin c}) )
--
APPLY(wfh2_thryvar:dp0_thryvar) wellfounded_recursive_fcn(s->clauSets_thryvar,
	arg1_bef_arg2(y,x)->((Un(y - settled_thryvar(y)) ¥incin Un(x - settled_thryvar(x))) &
		(Un(y - settled_thryvar(y)) /= Un(x - settled_thryvar(x)))),
	f3(b,x,p)->f3_dp_thryvar(x,b,p),
	g4(m,y,x,p)->m,
	P4(m,y,x,p)->P3_dp_thryvar(x,y,p)) ==>
Theorem davisPutnam6: (FORALL x, p | (x in clauSets_thryvar) ¥imp (dp0_thryvar(x,p) =
	f3_dp_thryvar(x,{dp0_thryvar(y,p): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) ¥incin Un(x - settled_thryvar(x))) &
		 (Un(y - settled_thryvar(y)) /= Un(x - settled_thryvar(x)))) &
		P3_dp_thryvar(x,y,p)},p)))
--
--
--
Theorem davisPutnam7: (X in clauSets_thryvar) ¥imp (#Un(X - settled_thryvar(X))  in Za). Proof:
Suppose_not(s) ==> AUTO
	Loc_def ==> Stat1: n = #Un(s - settled_thryvar(s))
	ELEM ==> n notin Za
	(Un(s - settled_thryvar(s)))-->T156(*) ==> Card(#Un(s - settled_thryvar(s)))
	(#Un(s - settled_thryvar(s)))-->T206(Stat1) ==> (not Finite(Un(s - settled_thryvar(s))))
	(s - settled_thryvar(s),s)-->T276(*) ==> Un(s) incs Un(s - settled_thryvar(s))
	(Un(s),Un(s - settled_thryvar(s)))-->T189(*) ==> (not Finite(Un(s)))
	Use_def(clauSets_thryvar) ==> Stat2: s in { s ¥incin pow(lits) | Finite(Un(s)) }
	()-->Stat2(*) ==> false
	Discharge ==> QED
--
--
--
Theorem davisPutnam8: ((X in clauSets_thryvar) & (H in Un(X - settled_thryvar(X))) & ((Y = {{H}} + {c - {tog(H)}: c in X | H notin c}))) ¥imp
	((Y in clauSets_thryvar) & (Un(Y - settled_thryvar(Y)) /= Un(X - settled_thryvar(X))) &
	(Un(Y - settled_thryvar(Y)) ¥incin Un(X - settled_thryvar(X)))). Proof:
Suppose_not(x0,h0,y0) ==> AUTO
--
	ELEM ==> Stat1: (y0 = {{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c})
	(x0 - settled_thryvar(x0), x0)-->T276(*) ==> Stat2: h0 in Un(x0)
	Suppose ==> Stat3: Un(y0) ¥nincin Un(x0)
		a-->Stat3(Stat3*) ==> (a in Un(y0)) & (a notin Un(x0))
		EQUAL ==> Stat4: (a in Un({{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c})) & (a notin Un(x0))
		Use_def(Un)(Stat4*) ==> Stat5: (a in {u: v in ({{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c}), u in v}) & Stat6: (a notin {u: v in x0, u in v})
		(v1,u1)-->Stat5(Stat5*) ==> Stat7: ((v1 = {h0}) or (v1 in {c - {tog(h0)}: c in x0 | h0 notin c})) & (a in v1)
--
-- Since $h0 in Un(x0)$, whereas $a notin Un(x0)$, we can discard the possibility $a = h0$,
-- $v1 = {h0}$.
--
		(Stat2*)ELEM ==> Stat8: v1 in {c - {tog(h0)}: c in x0 | h0 notin c}
		c-->Stat8(Stat7*) ==> Stat9: (c in x0) & (a in c)
		(c,a)-->Stat6(Stat9*) ==> false
	Discharge ==> AUTO
--
-- It readily follows, by virtue of Theorem davisPutnam3, that $y0$ in a set of clauses:
--
	(x0,y0)-->TdavisPutnam3(*) ==> Stat10: y0 in clauSets_thryvar
--
-- In order to see that $Un(y0 - settled(y0)) /= Un(x0 - settled(x0))$,
-- we will now show that a known member of $Un(x0 - settled(x0))$,
-- namely $h0$, does not belong to $Un(y0 - settled(y0))$.
--
	Use_def(Un(y0 - settled_thryvar(y0))) ==> AUTO
	Suppose ==> h0 in Un(y0 - settled_thryvar(y0))
		(Stat10*)ELEM ==> Stat11: h0 in {u: v in (y0 - settled_thryvar(y0)), u in v}
		(v2,u2)-->Stat11(Stat11*) ==> Stat12: (v2 in y0) & (v2 notin settled_thryvar(y0)) & (h0 in v2)
		EQUAL ==> v2 in ({{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c})
		Suppose ==> v2 /= {h0}
			(Stat12*)ELEM ==> Stat13: v2 in {c - {tog(h0)}: c in x0 | h0 notin c}
			c1-->Stat13(Stat12*) ==> false
		Discharge ==> AUTO
		Use_def(settled_thryvar(y0)) ==> AUTO
		(Stat12*)ELEM ==> Stat14: {h0} notin {u: u in y0, h in u | (u = {h}) & ({h,tog(h)} * Un(y0 - {u}) = 0)}
		({h0},h0)-->Stat14(*) ==> {h0,tog(h0)} * Un(y0 - {{h0}}) /= 0
		Suppose ==> y0 - {{h0}} /= {c - {tog(h0)}: c in x0 | h0 notin c}
			ELEM ==> Stat15: {h0} in {c - {tog(h0)}: c in x0 | h0 notin c}
			c3-->Stat15(Stat15*) ==> false
		Discharge ==> y0 - {{h0}} = {c - {tog(h0)}: c in x0 | h0 notin c}
		EQUAL(Stat14) ==> Stat16: {h0,tog(h0)} * Un({c - {tog(h0)}: c in x0 | h0 notin c}) /= 0
		Use_def(Un({c - {tog(h0)}: c in x0 | h0 notin c})) ==> AUTO
		h1-->Stat16(Stat16*) ==> Stat17: ((h1 = h0) or (h1 = tog(h0))) & (h1 in {u: v in {c - {tog(h0)}: c in x0 | h0 notin c}, u in v})
		SIMPLF(Stat17*) ==> Stat18: h1 in {u: c in x0, u in (c - {tog(h0)}) | h0 notin c}
		(c4,u4)-->Stat18(Stat17*) ==> false
--
-- Therefore, if any of the three claims of this theorem could be false, it would
-- be the third. To get the desired contradiction, we will hence seek one
-- ensuing from the negation of such claim, which is
--		$Un(y0 - settled(y0)) ¥nincin Un(x0 - settled(x0))$.
--
	Discharge ==> Stat19: (Un(y0 - settled_thryvar(y0)) ¥nincin Un(x0 - settled_thryvar(x0))) &
			(h0 notin Un(y0 - settled_thryvar(y0)))
	h5-->Stat19(Stat19*) ==> Stat20: (h5 in Un(y0 - settled_thryvar(y0))) &
			(h5 notin Un(x0 - settled_thryvar(x0)))
	Use_def(Un)(Stat20,Stat20*) ==> Stat21: (h5 in {u: v in (y0 - settled_thryvar(y0)), u in v}) &
			Stat22: (h5 notin {u: v in (x0 - settled_thryvar(x0)), u in v})
	(v5,u5)-->Stat21(Stat21,Stat1*) ==> Stat23: (v5 in y0) &
			(v5 in ({{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c})) &
			(v5 notin settled_thryvar(y0)) & (h5 in v5)
	(Stat19*)ELEM ==> (h5 /= h0) & (v5 /= {h0})
	(Stat23*)ELEM ==> Stat24: v5 in {c - {tog(h0)}: c in x0 | h0 notin c}
	c0-->Stat24(Stat23,Stat23*) ==> (v5 = c0 - {tog(h0)}) & (c0 in x0) & (h0 notin c0)
--
-- It follows from the above that $c0 in settled(x0)$. Hence $c0 = {h5}$, and
-- therefore $c0 - {tog(h0)} = c0$ because we know that this set has a member.
--
	Use_def(settled_thryvar(x0)) ==> AUTO
	(c0,h5)-->Stat22(Stat23*) ==> Stat25: c0 in {u: u in x0, h in u | (u = {h}) & ({h,tog(h)} * Un(x0 - {u}) = 0)}
	(u7,h7)-->Stat25(Stat23*) ==> (h5 = h7) & (c0 = u7) & (u7 in x0) & (h7 in u7) & (u7 = {h7}) & ({h7,tog(h7)} * Un(x0 - {u7}) = 0)
	EQUAL(Stat25) ==> Stat26: (c0 = {h5}) & (c0 in x0) & (h5 in c0) & ({h5,tog(h5)} * Un(x0 - {c0}) = 0)
	(Stat23*)ELEM ==> v5 = c0
--
-- Observe that $c0 - {tog(h0)} = c0$ belongs to $y0 - settled(y0)$.
-- However, this is easily shown to conflict with the fact that $c0 in settled(x0)$.
--
	Use_def(settled_thryvar) ==> settled_thryvar(y0) = {u: u in y0, h in u | (u = {h}) & ({h,tog(h)} * Un(y0 - {u}) = 0)}
	EQUAL(Stat10) ==> Stat27: c0 notin {u: u in y0, h in u | (u = {h}) & ({h,tog(h)} * Un(y0 - {u}) = 0)}
	(c0,h5)-->Stat27(Stat23*) ==> Stat28: {h5,tog(h5)} * Un(y0 - {c0}) /= 0
	h8-->Stat28(Stat25*) ==> Stat29: (h8 in {h5,tog(h5)}) & (h8 in Un(y0 - {c0})) & (h8 notin Un(x0 - {c0}))
	EQUAL(Stat1,Stat29) ==> Stat30: (h8 in Un(({{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c}) - {c0})) & (h8 notin Un(x0 - {c0}))
	Use_def(Un)(Stat30*) ==> Stat31: (h8 in {u: v in (({{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c}) - {c0}), u in v}) &
			Stat32: (h8 notin {u: v in (x0 - {c0}), u in v})
	(v8,u8)-->Stat31(Stat31*) ==> Stat33: ((v8 = {h0}) or (v8 in {c - {tog(h0)}: c in x0 | h0 notin c})) & (v8 /= c0) & (h8 in v8)
--
-- We can discard the possibility $v8 = {h0}$, because $h0$ belongs to some clause in $x0$
-- which cannot be $c0$.
--
	Suppose ==> v8 = {h0}
		(Stat29*)ELEM ==> h0 notin Un(x0 - {c0})
		(Stat2,Stat2*)ELEM ==> h0 in Un(x0)
		Use_def(Un)(Stat33*) ==> Stat34: (h0 in {u: v in x0, u in v}) &
				(h0 notin {u: v in (x0 - {c0}), u in v})
		(v9,u9,v9,h0)-->Stat34(Stat34*) ==> h0 in c0
	(Stat23*)Discharge ==> AUTO
--
-- The other possibility, $v8 in {c - {tog(h0)}: c in x0 | h0 notin c}$, is easily
-- discarded too, because it would imply that $v8$ (which is nonnull) results from the
-- difference $c0 - {tog(h0)}$, where $c0$ is singleton, and hence equality
-- between $v8$ and $c0$.
--
	(Stat33*)ELEM ==> Stat35: v8 in {c - {tog(h0)}: c in x0 | h0 notin c}
	c9-->Stat35(Stat35*) ==> Stat36: (v8 = c9 - {tog(h0)}) & (c9 in x0) & (h0 notin c9)
	(c9,h8)-->Stat32(Stat31*) ==> Stat37: c9 = c0
--
--
--
	(Stat26,Stat33,Stat36,Stat37*)Discharge ==> QED
--
--
--
Theorem davisPutnam9: ((S in clauSets_thryvar) & (0 notin S) &
		(S ¥nincin settled_thryvar(S))) ¥imp
		(((pk_thryvar~[S]) in Un(S - settled_thryvar(S))) &
		((pk_thryvar~[S]) /= fail) & (tog(pk_thryvar~[S]) /= fail) &
		((tog(pk_thryvar~[S]) in Un(S)) ¥imp
		(tog(pk_thryvar~[S]) in Un(S - settled_thryvar(S))))). Proof:
Suppose_not(s0) ==> AUTO
	ELEM ==> Stat1: s0 in clauSets_thryvar
	Suppose ==> Stat2: (pk_thryvar~[s0]) notin Un(s0 - settled_thryvar(s0))
		Use_def(pk_thryvar) ==> pk_thryvar = {[x,sl(x - settled_thryvar(x))]: x in clauSets_thryvar}
		(Stat2)ELEM ==> Svm({[x,sl(x - settled_thryvar(x))]: x in clauSets_thryvar})
		Suppose ==> Stat3: [s0,sl(s0 - settled_thryvar(s0))] notin {[x,sl(x - settled_thryvar(x))]: x in clauSets_thryvar}
		s0-->Stat3(Stat1,Stat1*) ==> false; Discharge ==> [s0,sl(s0 - settled_thryvar(s0))] in {[x,sl(x - settled_thryvar(x))]: x in clauSets_thryvar}
		EQUAL(Stat2) ==> Svm(pk_thryvar) & ([s0,sl(s0 - settled_thryvar(s0))] in pk_thryvar)
		(pk_thryvar,[s0,sl(s0 - settled_thryvar(s0))])-->T74(Stat2*) ==> (pk_thryvar~[car([s0,sl(s0 - settled_thryvar(s0))])]) = cdr([s0,sl(s0 - settled_thryvar(s0))])
 		(s0,sl(s0 - settled_thryvar(s0)))-->T9(*) ==> (car([s0,sl(s0 - settled_thryvar(s0))]) = s0) & (cdr([s0,sl(s0 - settled_thryvar(s0))]) = sl(s0 - settled_thryvar(s0)))
		EQUAL(Stat2) ==> (pk_thryvar~[s0]) = sl(s0 - settled_thryvar(s0))
		Assump ==> Stat4: (FORALL s | ((s /= 0) & (0 notin s)) ¥imp (sl(s) in Un(s)))
	(s0 - settled_thryvar(s0))-->Stat4(*) ==> false; Discharge ==> Stat5:
			((pk_thryvar~[s0]) in Un(s0 - settled_thryvar(s0)))
	(s0 - settled_thryvar(s0),s0)-->T276 ==> AUTO
	s0-->TdavisPutnam1(Stat1*) ==> ((pk_thryvar~[s0]) /= fail) & (tog(fail) /= (pk_thryvar~[s0]))
	(pk_thryvar~[s0])-->TdavisPutnam0(Stat5*) ==> tog(tog(pk_thryvar~[s0])) = (pk_thryvar~[s0])
	Suppose ==> tog(pk_thryvar~[s0]) = fail
		EQUAL(Stat5) ==> false
	Discharge ==> AUTO
	ELEM ==> (tog(pk_thryvar~[s0]) in Un(s0)) & (tog(pk_thryvar~[s0]) notin Un(s0 - settled_thryvar(s0)))
	Use_def(Un)(Stat5*) ==> Stat6: (tog(pk_thryvar~[s0]) in {h: c in s0, h in c}) &
		(tog(pk_thryvar~[s0]) notin {h: c in (s0 - settled_thryvar(s0)), h in c}) &
		((pk_thryvar~[s0]) in {h: c in (s0 - settled_thryvar(s0)), h in c})
	(c0,h0,c0,h0,c2,h2)-->Stat6(Stat6*) ==> Stat7: (tog(pk_thryvar~[s0]) in c0) & (c0 in settled_thryvar(s0)) &
		(c2 in s0) & ((pk_thryvar~[s0]) in c2)
	Use_def(settled_thryvar) ==> Stat8: c0 in {u: u in s0, h in u | (u = {h}) & ({h,tog(h)} * Un(s0 - {u}) = 0)}
	(u1,h1)-->Stat8(Stat7*) ==> (c0 = u1) & (c0 in s0) & (c0 = {h1}) & (h1 = tog(pk_thryvar~[s0])) & (tog(h1) notin Un(s0 - {u1}))
	EQUAL(Stat5) ==> Stat9: (c0 = {tog(pk_thryvar~[s0])}) & ((pk_thryvar~[s0]) notin Un(s0 - {c0}))
	(Stat5*)ELEM ==> c2 /= c0
	Use_def(Un)(Stat9*) ==> Stat10: (pk_thryvar~[s0]) notin {h: c in (s0 - {c0}), h in c}
	(c2,pk_thryvar~[s0])-->Stat10(Stat7*) ==> false
	Discharge ==> QED
--
Theorem davisPutnam10: ((S in clauSets_thryvar) & ((0 in S) or (S ¥incin settled_thryvar(S)) or (#Un(S - settled_thryvar(S)) = 0))) ¥imp
(if fail in dp0_thryvar(S,pk_thryvar) then (not Is_dpSat_thryvar(S)) else Has_dpModel_thryvar(S,dp0_thryvar(S,pk_thryvar)) end if). Proof:
Suppose_not(s0) ==> AUTO
	Loc_def ==> n0 = #Un(s0 - settled_thryvar(s0))
	ELEM ==> Stat1: (s0 in clauSets_thryvar) & (#Un(s0 - settled_thryvar(s0)) = n0) &
			(not if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if)
--
-- Let us recall how the value of $dp0_thryvar(s0,pk_thryvar)$ is determined:
--
	TdavisPutnam6 ==> Stat2: (FORALL x, p | (x in clauSets_thryvar) ¥imp (dp0_thryvar(x,p) =
		f3_dp_thryvar(x,{dp0_thryvar(y,p): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) ¥incin Un(x - settled_thryvar(x))) &
		 (Un(y - settled_thryvar(y)) /= Un(x - settled_thryvar(x)))) &
		P3_dp_thryvar(x,y,p)},p)))
	(s0,pk_thryvar)-->Stat2(Stat1*) ==> dp0_thryvar(s0,pk_thryvar) =
		f3_dp_thryvar(s0,{dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) ¥incin Un(s0 - settled_thryvar(s0))) &
		 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
		P3_dp_thryvar(s0,y,pk_thryvar)},pk_thryvar)
	Loc_def ==> Stat3: m0 = {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) ¥incin Un(s0 - settled_thryvar(s0))) &
		 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
		P3_dp_thryvar(s0,y,pk_thryvar)}
	EQUAL(Stat2) ==> dp0_thryvar(s0,pk_thryvar) = f3_dp_thryvar(s0,m0,pk_thryvar)
	Use_def(f3_dp_thryvar(s0,m0,pk_thryvar)) ==> AUTO
--
-- Recall also that $fail notin Un(s0)$:
--
	s0-->TdavisPutnam1(Stat1,Stat1*) ==> fail notin Un(s0)
--
-- It is quickly seen that $0 notin s0$ and that $s0 /= settled_thryvar(s0)$;
-- therefore $n0 /= 0$, which leads to a contradiction.
--
	Suppose ==> Stat4: 0 in s0
--		Then we have $dp0_thryvar(s0,pk_thryvar) = {fail}$
		(Stat3)ELEM ==> (if dp0_thryvar(s0,pk_thryvar) = {fail} then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if) ¥eq (not Is_dpSat_thryvar(s0))
		(Stat1*)ELEM ==> Is_dpSat_thryvar(s0)
		TdavisPutnam4 ==> Stat5: (FORALL s | Has_dpModel_thryvar(0,0) & Is_dpSat_thryvar(0) & ((0 in s) ¥imp (not(Is_dpSat_thryvar(s)))))
	s0-->Stat5(Stat4*) ==> false; Discharge ==> AUTO
	Suppose ==> Stat6: settled_thryvar(s0) incs s0
		(Stat3*)ELEM ==> dp0_thryvar(s0,pk_thryvar) = Un(s0)
		(Stat3)ELEM ==> (if dp0_thryvar(s0,pk_thryvar) = {fail} then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if) ¥eq Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
		(Stat1*)ELEM ==> (not Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)))
		EQUAL(Stat6) ==> (not Has_dpModel_thryvar(s0,Un(s0)))
		TdavisPutnam4 ==> Stat7: (FORALL s | ({u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)} incs s) ¥imp (Has_dpModel_thryvar(s,Un(s)) & Is_dpSat_thryvar(s)))
		s0-->Stat7(Stat6*) ==> not({u: u in s0, h in u | (u = {h}) & ({h,tog(h)} * Un(s0 - {u}) = 0)} incs s0)
	Use_def(settled_thryvar)(Stat7*) ==> false; Discharge ==> AUTO
	ELEM ==> Stat8: n0 = 0
	EQUAL(Stat1,Stat8) ==> #Un(s0 - settled_thryvar(s0)) = 0
	(Un(s0 - settled_thryvar(s0)))-->T162(Stat8*) ==> Un(s0 - settled_thryvar(s0)) = 0
	(s0 - settled_thryvar(s0))-->T275(Stat3*) ==> false
	Discharge ==> QED
--
Theorem davisPutnam11: (S in clauSets_thryvar) ¥imp
(if fail in dp0_thryvar(S,pk_thryvar) then (not Is_dpSat_thryvar(S)) else Has_dpModel_thryvar(S,dp0_thryvar(S,pk_thryvar)) end if). Proof:
Suppose_not(s) ==> AUTO
--
-- The assertion will be proved by mathematical induction on the number
--	$n = #Un(s - settled_thryvar(s))$.
-- If $n = 0$, then
--	$((s - settled_thryvar(s)) = 0) or ((s - settled_thryvar(s)) = {0})$.
-- If the former alternative holds, then the value returned by $dp0_thryvar$ will be
-- $Un(s)$, and actually we know by Theorem $davisPutnam3$ (recalling the definition
-- of $settled_thryvar$) that this is a correct answer, namely a model of $s$.
-- If the latter alternative holds, then $dp0_thryvar$ will return the answer
-- ${fail}$, which is again correct by Theorem $davisPutnam3$, since $0$ belongs to
-- $s$ in this case. If $0 in n$, then $pk_thryvar$ will pick a literal $h$ from one of
-- the clauses in $s - settled_thryvar(s)$, and one or two sets of clauses whose
-- unsettled part involves one or two fewer literals will be passed over to the recursive
-- treatment. Being smaller, these sets of clauses will satisfy the induction
-- hypothesis and we can exploit the splitting rule appearing within Theorem $davisPutnam3$
-- in order to perform the induction step.
--
	Loc_def ==> Stat1: n = #Un(s - settled_thryvar(s))
--
-- To enable the mathematical induction argument, we must first show that
-- $n$, as just defined, is an unsigned integer, and that there is a set
-- $s$ of clauses satisfying the relationship $Stat2 and contradicting the hypothesis
-- of the theorem (this follows readily from the Suppose_not line with which our
-- argument by contradiction has begun).
--
	s-->TdavisPutnam7(*) ==> n in Za
	Suppose ==> Stat3: (FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = n) ¥imp
			if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if)
		s-->Stat3 ==> false
	Discharge ==> AUTO
--
-- We now assume that $n0$ is the minimum cardinality for which a set $s0$ of clauses
-- exists having $#Un(s0 - settled_thryvar(s0))=n0$ and contradicting the assertion of the
-- present theorem.
--
	APPLY(m2_thryvar:n0) mathematical_induction(n->n,P(x)->(not(FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = x) ¥imp if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if))) ==>
		Stat4: (n0 in Za) & Stat5: (not(FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = n0) ¥imp
			if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if)) &
			(FORALL n in n0 | not(not(FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = n) ¥imp
			if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if)))
	s0-->Stat5(Stat4*) ==> Stat6: (s0 in clauSets_thryvar) & (#Un(s0 - settled_thryvar(s0)) = n0) &
			(not if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if) &
		Stat7: (FORALL n in n0 | FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = n) ¥imp
			if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if)
--
-- It is quickly seen that $0 notin s0$ and that $s0 /= settled_thryvar(s0)$; therefore
-- $n0 /= 0$ and the response $dp0_thryvar(s0,pk_thryvar)$ concerning $s0$ is determined by
-- use of $pk_thryvar$ to select a literal from $s0 - settled_thryvar(s0)$ and by means of
-- either the splitting rule or the pure literal rule, as recalled below.
--
	s0-->TdavisPutnam10(Stat6*) ==> Stat8: (not(0 in s0)) & (not(settled_thryvar(s0) incs s0)) & (n0 /= 0)
--
	s0-->TdavisPutnam9(Stat6*) ==> Stat9: ((pk_thryvar~[s0]) in Un(s0 - settled_thryvar(s0))) &
		((tog(pk_thryvar~[s0]) in Un(s0)) ¥imp (tog(pk_thryvar~[s0]) in Un(s0 - settled_thryvar(s0)))) &
		((pk_thryvar~[s0]) /= fail) & (tog(pk_thryvar~[s0]) /= fail)
--
	TdavisPutnam6 ==> Stat10: (FORALL x, p | (x in clauSets_thryvar) ¥imp (dp0_thryvar(x,p) =
		f3_dp_thryvar(x,{dp0_thryvar(y,p): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) ¥incin Un(x - settled_thryvar(x))) &
		 (Un(y - settled_thryvar(y)) /= Un(x - settled_thryvar(x)))) &
		P3_dp_thryvar(x,y,p)},p)))
--
	(s0,pk_thryvar)-->Stat10(Stat6*) ==> dp0_thryvar(s0,pk_thryvar) =
		f3_dp_thryvar(s0,{dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) ¥incin Un(s0 - settled_thryvar(s0))) &
		 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
		P3_dp_thryvar(s0,y,pk_thryvar)},pk_thryvar)
--
-- The collection $m0$ of models from which the model of $s0$ (if any) will be extracted
-- is constructed as follows:
--
	Loc_def ==> Stat11: m0 = {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) ¥incin Un(s0 - settled_thryvar(s0))) &
		 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
		P3_dp_thryvar(s0,y,pk_thryvar)}
--
	Use_def(f3_dp_thryvar)(Stat8,Stat8*) ==> f3_dp_thryvar(s0,m0,pk_thryvar) = arb({ w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) })
--
	EQUAL(Stat10) ==> Stat12: dp0_thryvar(s0,pk_thryvar) = arb({ w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) })
--
	(s0, s0 - settled_thryvar(s0))-->TdavisPutnam3(Stat6,Stat6*) ==> Stat13: (s0 - settled_thryvar(s0)) in clauSets_thryvar
	(s0 - settled_thryvar(s0))-->TdavisPutnam1(Stat13*) ==> Finite(Un(s0 - settled_thryvar(s0)))
--
-- Whichever of the splitting rule and the pure literal rule is applied, $s0$ gets
-- reduced, relative to the literal $pk_thryvar~[s0]$, to the following set
-- $s1$ whose models (if any) will also be models for $s0$:
--
	Loc_def ==> Stat14: (s1 = {{pk_thryvar~[s0]}} + {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c}) &
		(m1 = dp0_thryvar(s1,pk_thryvar))
--
-- This set $s1$ is "smaller" that $s0$, in the sense of having fewer unsettled literals;
-- therefore it meets the induction hypothesis:
--
	(s0,(pk_thryvar~[s0]),s1)-->TdavisPutnam8(Stat6, Stat9, Stat14*) ==>
			(s1 in clauSets_thryvar) &
			(Un(s1 - settled_thryvar(s1)) ¥incin Un(s0 - settled_thryvar(s0))) &
			(Un(s1 - settled_thryvar(s1)) /= Un(s0 - settled_thryvar(s0)))
	Suppose ==> (not if fail in m1 then (not Is_dpSat_thryvar(s1)) else Has_dpModel_thryvar(s1,dp0_thryvar(s1,pk_thryvar)) end if)
		(s1, s1 - settled_thryvar(s1))-->TdavisPutnam3(Stat14*) ==> (s1 - settled_thryvar(s1)) in clauSets_thryvar
		(s1 - settled_thryvar(s1))-->TdavisPutnam1(Stat14*) ==> Finite(Un(s1 - settled_thryvar(s1)))
		(Un(s0 - settled_thryvar(s0)),Un(s1 - settled_thryvar(s1)))-->T194(Stat6*) ==> #Un(s1 - settled_thryvar(s1)) in n0
		(#Un(s1 - settled_thryvar(s1)))-->Stat7(Stat14*) ==> Stat15: (FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = #Un(s1 - settled_thryvar(s1))) ¥imp
			if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if)
		s1-->Stat15(Stat14*) ==> false
	Discharge ==> AUTO
	(Stat14*)ELEM ==> Stat16: if fail in m1 then (not Is_dpSat_thryvar(s1)) else Has_dpModel_thryvar(s1,dp0_thryvar(s1,pk_thryvar)) end if
	EQUAL(Stat14) ==> Stat17: if fail in m1 then (not Is_dpSat_thryvar(s1)) else Has_dpModel_thryvar(s1,m1) end if
--
-- When $s0$ meets the condition for applying the splitting rule, $s2$ is obtained from $s0$
-- in a way analogous to $s1$, but reducing relative to $tog(pk_thryvar~[s0])$.
--
	(pk_thryvar~[s0])-->TdavisPutnam0(Stat18*) ==> Stat18: tog(tog(pk_thryvar~[s0])) = (pk_thryvar~[s0])
--
	Loc_def ==> Stat19: (s2 = {{tog(pk_thryvar~[s0])}} + {c - {pk_thryvar~[s0]}: c in s0 | tog(pk_thryvar~[s0]) notin c}) &
		(m2 = dp0_thryvar(s2,pk_thryvar))
	EQUAL(Stat18) ==> Stat20: s2 = {{tog(pk_thryvar~[s0])}} + {c - {tog(tog(pk_thryvar~[s0]))}: c in s0 | tog(pk_thryvar~[s0]) notin c}
--
	Suppose ==> not((tog(pk_thryvar~[s0]) in Un(s0)) ¥imp ((s2 in clauSets_thryvar) &
				(Un(s2 - settled_thryvar(s2)) ¥incin Un(s0 - settled_thryvar(s0))) &
				(Un(s2 - settled_thryvar(s2)) /= Un(s0 - settled_thryvar(s0))) &
				(if fail in m2 then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar)) end if)))
--
-- This set $s2$ is "smaller" that $s0$, in the sense of having fewer unsettled literals;
-- therefore it meets the induction hypothesis:
--
		s0-->TdavisPutnam9(Stat9*) ==> Stat21: tog(pk_thryvar~[s0]) in Un(s0 - settled_thryvar(s0))
		(s0,tog(pk_thryvar~[s0]),s2)-->TdavisPutnam8(Stat6, Stat9, Stat21, Stat20*) ==>
				(s2 in clauSets_thryvar) &
				(Un(s2 - settled_thryvar(s2)) ¥incin Un(s0 - settled_thryvar(s0))) &
				(Un(s2 - settled_thryvar(s2)) /= Un(s0 - settled_thryvar(s0)))
		(Stat19*)ELEM ==> (not if fail in dp0_thryvar(s2,pk_thryvar) then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar)) end if)
		(s2, s2 - settled_thryvar(s2))-->TdavisPutnam3(Stat19*) ==> (s2 - settled_thryvar(s2)) in clauSets_thryvar
		(s2 - settled_thryvar(s2))-->TdavisPutnam1(Stat19*) ==> Finite(Un(s2 - settled_thryvar(s2)))
		(Un(s0 - settled_thryvar(s0)),Un(s2 - settled_thryvar(s2)))-->T194(Stat6*) ==> #Un(s2 - settled_thryvar(s2)) in n0
		(#Un(s2 - settled_thryvar(s2)))-->Stat7(Stat19*) ==> Stat22: (FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = #Un(s2 - settled_thryvar(s2))) ¥imp
			if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if)
		s2-->Stat22(Stat19*) ==> false
	Discharge ==> AUTO
--
-- One sees that $m0 = {m1}$ or $m0 = {m1,m2}$ depending on whether the pure
-- literal rule or the splitting rule is exploited.
--
	Suppose ==> Stat23: m0 /= if (tog(pk_thryvar~[s0]) in Un(s0)) then {m1,m2} else {m1} end if
--
		EQUAL(Stat11,Stat23) ==> Stat24: {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
			((Un(y - settled_thryvar(y)) ¥incin Un(s0 - settled_thryvar(s0))) &
			 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
			P3_dp_thryvar(s0,y,pk_thryvar)}  /= if tog(pk_thryvar~[s0]) in Un(s0) then {m1,m2} else {m1} end if
--
-- Since $m1$ certainly belongs to the right-hand side of this inequality,
-- we want to establish that it also belongs to its left-hand side.
--
		Suppose ==> Stat25: m1 notin {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
				((Un(y - settled_thryvar(y)) ¥incin Un(s0 - settled_thryvar(s0))) &
				 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
				P3_dp_thryvar(s0,y,pk_thryvar)}
--
			Use_def(P3_dp_thryvar)(Stat13*) ==> P3_dp_thryvar(s0,s1,pk_thryvar)
			s1-->Stat25(Stat14*) ==> false
		Discharge ==> AUTO
--
		Suppose ==> Stat26: tog(pk_thryvar~[s0]) in Un(s0)
--
-- Since $m2$ certainly belongs to the right-hand side of the supposed equality,
-- we want to establish that it also belongs to its left-hand side...
--
			Suppose ==> Stat27: m2 notin {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
				((Un(y - settled_thryvar(y)) ¥incin Un(s0 - settled_thryvar(s0))) &
				 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
				P3_dp_thryvar(s0,y,pk_thryvar)}
--
				Use_def(P3_dp_thryvar)(Stat13*) ==> P3_dp_thryvar(s0,s2,pk_thryvar)
				s2-->Stat27(Stat19*) ==> false
			Discharge ==> AUTO
--
-- ...so that it is the left-hand side which is not included in the right-hand side.
--
			(Stat24*)ELEM ==> Stat28: {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
				((Un(y - settled_thryvar(y)) ¥incin Un(s0 - settled_thryvar(s0))) &
				 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
				P3_dp_thryvar(s0,y,pk_thryvar)} ¥nincin {m1,m2}
--
			m3-->Stat28(Stat28*) ==> Stat29: (m3 in {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
				((Un(y - settled_thryvar(y)) ¥incin Un(s0 - settled_thryvar(s0))) &
				 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
				P3_dp_thryvar(s0,y,pk_thryvar)}) & (m3 /= m1) & (m3 /= m2)
			s3-->Stat29(Stat14,Stat19*) ==> Stat30: P3_dp_thryvar(s0,s3,pk_thryvar) &
				(dp0_thryvar(s3,pk_thryvar) /= dp0_thryvar(s1,pk_thryvar)) &
				(dp0_thryvar(s3,pk_thryvar) /= dp0_thryvar(s2,pk_thryvar))
--
			Use_def(P3_dp_thryvar)(Stat30,Stat26*) ==> Stat31:
		(s3 = {{tog(pk_thryvar~[s0])}} + {c - {pk_thryvar~[s0]}: c in s0 | tog(pk_thryvar~[s0]) notin c}) or
		(s3 = {{pk_thryvar~[s0]}} + {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c})
--
			(Stat31,Stat14,Stat19*)ELEM ==> (s3 = s1) or (s3 = s2)
			Suppose ==> s3 = s1
				EQUAL(Stat30) ==> false
			Discharge ==> s3 = s2
			EQUAL(Stat30) ==> false
		Discharge ==> Stat32: not(tog(pk_thryvar~[s0]) in Un(s0))
		(Stat24*)ELEM ==> Stat33: {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
				((Un(y - settled_thryvar(y)) ¥incin Un(s0 - settled_thryvar(s0))) &
				 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
				P3_dp_thryvar(s0,y,pk_thryvar)} ¥nincin {m1}
		m4-->Stat33(Stat33*) ==> Stat34: (m4 in {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
				((Un(y - settled_thryvar(y)) ¥incin Un(s0 - settled_thryvar(s0))) &
				 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
				P3_dp_thryvar(s0,y,pk_thryvar)}) & (m4 /= m1)
		s4-->Stat34(Stat14,Stat14*) ==> Stat35: P3_dp_thryvar(s0,s4,pk_thryvar) &
				(dp0_thryvar(s4,pk_thryvar) /= dp0_thryvar(s1,pk_thryvar))
--
		Use_def(P3_dp_thryvar)(Stat35,Stat32,Stat14*) ==> s4 = s1
		EQUAL(Stat35) ==> false
--
	Discharge ==> Stat36: not(m0 /= if (tog(pk_thryvar~[s0]) in Un(s0)) then {m1,m2} else {m1} end if)
	(Stat36*)ELEM ==> Stat37: m0 = if (tog(pk_thryvar~[s0]) in Un(s0)) then {m1,m2} else {m1} end if
--
--
--
	TdavisPutnam4 ==>
Stat38:	(FORALL h, s | (tog(h) notin Un(s)) ¥imp
			(Is_dpSat_thryvar(s) ¥eq Is_dpSat_thryvar({{h}} + {c in s | h notin c}))) &
Stat39:	(FORALL s, h | Is_dpSat_thryvar(s) ¥eq
			(Is_dpSat_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}) or
			 Is_dpSat_thryvar({{tog(h)}} + {c - {h}: c in s | tog(h) notin c}))) &
Stat40:	(FORALL h, s, m | Has_dpModel_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}, m) ¥imp
			Has_dpModel_thryvar(s,m)) &
Stat41:	(FORALL h, s, m | (({h} in s) & Has_dpModel_thryvar(s,m)) ¥imp ((h in m) & (tog(h) notin m)))
--
-- We now begin to analyze the various possibilities arising:
--
	Suppose ==> not((m0 = {m1}) or (m0 = {m1,m2}))
		(Stat37)ELEM ==> false
	Discharge ==> AUTO
	(Stat38*)ELEM ==> Stat42: ((m0 = {m1}) or (m0 = {m1,m2})) & (m1 in m0)
--
-- The possibility that $fail notin m1$ gets easily discarded, arguing as follows:
--
	Suppose ==> not(fail in m1)
		(Stat42*)ELEM ==> if fail in m1 then (not Is_dpSat_thryvar(s1)) else Has_dpModel_thryvar(s1,dp0_thryvar(s1,pk_thryvar)) end if ¥eq Has_dpModel_thryvar(s1,dp0_thryvar(s1,pk_thryvar))
		(Stat14*)ELEM ==> Stat43: Has_dpModel_thryvar(s1,dp0_thryvar(s1,pk_thryvar))
		EQUAL(Stat14,Stat43) ==> Stat44:
			Has_dpModel_thryvar({{pk_thryvar~[s0]}} + {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c},m1)
		Suppose ==> Stat45: dp0_thryvar(s0,pk_thryvar) /= m1
			EQUAL(Stat12,Stat45) ==> arb({ w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) }) /= m1
			Suppose ==> Stat46: m1 notin { w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) }
				(pk_thryvar~[s0],{{pk_thryvar~[s0]}} + {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c},m1)-->Stat41(Stat44*) ==> (pk_thryvar~[s0]) in m1
				m1-->Stat46(Stat42*) ==> false
			Discharge ==> AUTO
			(Stat45)ELEM ==> Stat47: { w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) } ¥nincin {m1}
			w5-->Stat47(Stat47*) ==> Stat48: (w5 in { w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) }) & (w5 /= m1)
			Suppose ==> Stat49: not(tog(pk_thryvar~[s0]) in Un(s0))
				(Stat37,Stat49)ELEM ==> m0 = {m1}
				()-->Stat48(Stat48*) ==> false
			Discharge ==> AUTO
			Suppose ==> Stat50: (FORALL v in m0 | fail in v)
				m1-->Stat50(Stat42*) ==> false
			Discharge ==> AUTO
			()-->Stat48(Stat42*) ==> (m2 in m0) & ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in m2)) & (fail notin m2)
			(m1,m2)-->T106 ==> AUTO
			(m0,{m1,m2})-->T276(Stat42*) ==> Stat51: (pk_thryvar~[s0]) in m2
			(Stat19*)ELEM ==> Stat52: if fail in m2 then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar)) end if ¥eq Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar))
			(Stat19*)ELEM ==> Stat53: Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar))
			EQUAL(Stat19,Stat53) ==> Stat54:
					Has_dpModel_thryvar({{tog(pk_thryvar~[s0])}} + {c - {pk_thryvar~[s0]}: c in s0 | tog(pk_thryvar~[s0]) notin c},m2)
			(tog(pk_thryvar~[s0]),{{tog(pk_thryvar~[s0])}} + {c - {pk_thryvar~[s0]}: c in s0 | tog(pk_thryvar~[s0]) notin c},m2)-->Stat41(Stat19,Stat54,Stat18,Stat51*) ==> false
		Discharge ==> Stat55: dp0_thryvar(s0,pk_thryvar) = m1
--
		EQUAL(Stat44) ==> Has_dpModel_thryvar({{pk_thryvar~[s0]}} + {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c},dp0_thryvar(s0,pk_thryvar))
		(pk_thryvar~[s0],s0,dp0_thryvar(s0,pk_thryvar))-->Stat40(Stat55*) ==> Stat56: Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
		(Stat42*)ELEM ==> fail notin dp0_thryvar(s0,pk_thryvar)
		(Stat44)ELEM ==> Stat57: (not if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if) ¥eq (not Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)))
		(Stat6,Stat56,Stat57*)ELEM ==> false
	Discharge ==> AUTO
--
	(Stat42*)ELEM ==> Stat58: if fail in m1 then (not Is_dpSat_thryvar(s1)) else Has_dpModel_thryvar(s1,dp0_thryvar(s1,pk_thryvar)) end if ¥eq (not Is_dpSat_thryvar(s1))
	(Stat58,Stat16*)ELEM ==> Stat59: (not Is_dpSat_thryvar(s1))
--
-- Knowing now that $fail in m1$, we have two more cases to examine: the one
-- when the pure literal case applies to $pk_thryvar~[s0]$, and the one when
-- the splitting rule applies to it. Consider the pure literal case first.
--
	Suppose ==> Stat60: not(tog(pk_thryvar~[s0]) in Un(s0))
		(Stat37,Stat60*)ELEM ==> Stat61: m0 = {m1}
		(s0 - settled_thryvar(s0),s0)-->T276(Stat9,Stat9*) ==>
			(pk_thryvar~[s0]) in Un(s0)
		(pk_thryvar~[s0],s0)-->Stat38(Stat60,Stat60*) ==> Stat62:
			Is_dpSat_thryvar(s0) ¥eq Is_dpSat_thryvar({{pk_thryvar~[s0]}} + {c in s0 | (pk_thryvar~[s0]) notin c})
		(pk_thryvar~[s0],s0)-->TdavisPutnam0(Stat60*) ==> Stat63:
			{c in s0 | (pk_thryvar~[s0]) notin c} = {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c}
		EQUAL(Stat14,Stat58,Stat62,Stat63) ==> Stat64: (not Is_dpSat_thryvar(s0)) ¥eq (not Is_dpSat_thryvar(s1))
--
		Suppose ==> Stat65: dp0_thryvar(s0,pk_thryvar) /= m1
			EQUAL(Stat12,Stat61,Stat65) ==> arb({ w in {m1} | ((fail notin Un({m1})) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in {m1} | fail in v)) }) /= m1
			Suppose ==> Stat66: { w in {m1} | ((fail notin Un({m1})) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in {m1} | fail in v)) } ¥nincin {m1}
				w6-->Stat66(Stat66*) ==> Stat67: (w6 in { w in {m1} | ((fail notin Un({m1})) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in {m1} | fail in v)) }) & (w6 /= m1)
				()-->Stat67(Stat67*) ==> false
			Discharge ==> AUTO
			(Stat65)ELEM ==> Stat68: m1 notin { w in {m1} | ((fail notin Un({m1})) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in {m1} | fail in v)) }
			m1-->T107(Stat68*) ==> Un({m1}) = m1
			m1-->Stat68(Stat42*) ==> Stat69: not(FORALL v in {m1} | fail in v)
			m5-->Stat69(Stat42*) ==> false
		Discharge ==> Stat70: dp0_thryvar(s0,pk_thryvar) = m1
		EQUAL(Stat6,Stat70,Stat64) ==> Stat71: (not if fail in m1 then (not Is_dpSat_thryvar(s1)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if)
		(Stat42*)ELEM ==> false
--
-- Consider last the splitting rule when $fail in m1$.
--
	Discharge ==> tog(pk_thryvar~[s0]) in Un(s0)
	(Stat37*)ELEM ==> Stat72: (m0 = {m1,m2}) & (fail in m1)
	Suppose ==> fail notin Un(m0)
		(fail,m0)-->T105(Stat72*) ==> Stat73: m1 notin {c in m0 | fail in c}
		m1-->Stat73(Stat72*) ==> false
	Discharge ==> AUTO
--
	Suppose ==> Stat74: fail in m2
--
-- If $fail in m2$ too, then $fail in m0$, consistent with the fact that $s0$ is unsatisfiable,
-- but conflicting with the initial assumption Stat75
--
		(Stat74*)ELEM ==> if fail in m2 then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar)) end if ¥eq (not Is_dpSat_thryvar(s2))
--
-- Firstly, we have $not Is_dpSat_thryvar(s2)$:
--
		(Stat19*)ELEM ==> Stat76: (not Is_dpSat_thryvar(s2))
--
-- Moreover, by the splitting rule, we have $not Is_dpSat_thryvar(s0)$:
--
		(s0,pk_thryvar~[s0])-->Stat39(Stat76*) ==> Stat77: Is_dpSat_thryvar(s0) ¥eq
			(Is_dpSat_thryvar({{pk_thryvar~[s0]}} + {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c}) or
			 Is_dpSat_thryvar({{tog(pk_thryvar~[s0])}} + {c - {pk_thryvar~[s0]}: c in s0 | tog(pk_thryvar~[s0]) notin c}))
		EQUAL(Stat77,Stat14,Stat19) ==> Stat78: Is_dpSat_thryvar(s0) ¥eq
			(Is_dpSat_thryvar(s1) or Is_dpSat_thryvar(s2))
		(Stat59,Stat76,Stat78*)ELEM ==> Stat79: (not Is_dpSat_thryvar(s0))
--
-- Then we have $fail in dp0_thryvar(s0,pk_thryvar)$, since all potential elements
-- of the nonnull set $m$ for which $dp0_thryvar(s0,pk_thryvar) = arb(m)$ holds have
-- $fail$ as a member.
--
		Suppose ==> Stat80: m1 notin { w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) }
			m1-->Stat80(Stat72*) ==> Stat81: not(FORALL v in m0 | fail in v)
			w7-->Stat81(Stat72,Stat74*) ==> false
		Discharge ==> AUTO
		({ w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) })-->T0(Stat79*) ==>
			Stat82: arb({ w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) }) in { w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) }
		()-->Stat82(Stat72,Stat74*) ==> fail in arb({ w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) })
		EQUAL(Stat12) ==> Stat83: fail in dp0_thryvar(s0,pk_thryvar)
--
-- All of this enters into conflict with the induction hypothesis:
--
		(Stat83*)ELEM ==> Stat84: if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if ¥eq (not Is_dpSat_thryvar(s0))
		EQUAL(Stat6,Stat79,Stat84) ==> false
	Discharge ==> AUTO
--
-- If $fail notin m2$ too, then $m2 = m0$, consistent with the fact that $m2$ models $s2$ and
-- hence mdels $s2$, but conflicting with the initial assumption Stat75
--
	(Stat20*)ELEM ==> Stat85: if fail in m2 then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar)) end if
	EQUAL(Stat19,Stat85) ==> Stat86: if fail in m2 then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,m2) end if
	(Stat72*)ELEM ==> Stat87: if fail in m2 then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar)) end if ¥eq Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar))
	(tog(pk_thryvar~[s0]),s0,m2)-->Stat40(Stat72*) ==> Stat88:
			Has_dpModel_thryvar({{tog(pk_thryvar~[s0])}} + {c - {tog(tog(pk_thryvar~[s0]))}: c in s0 | tog(pk_thryvar~[s0]) notin c}, m2) ¥imp
			Has_dpModel_thryvar(s0,m2)
	EQUAL(Stat85,Stat87,Stat19,Stat20,Stat18) ==> Stat89: Has_dpModel_thryvar({{tog(pk_thryvar~[s0])}} + {c - {tog(tog(pk_thryvar~[s0]))}: c in s0 | tog(pk_thryvar~[s0]) notin c}, m2)
	(Stat88*)ELEM ==> Stat90: Has_dpModel_thryvar(s0,m2)
	Suppose ==> Stat91: m1 in { w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) }
		()-->Stat91(Stat72*) ==> Stat92: (FORALL v in m0 | fail in v)
			m2-->Stat92(Stat72*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat93: m2 notin { w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) }
		m2-->Stat93(Stat72*) ==> Stat94: (pk_thryvar~[s0]) in m2
		(tog(pk_thryvar~[s0]),{{tog(pk_thryvar~[s0])}} + {c - {tog(tog(pk_thryvar~[s0]))}: c in s0 | tog(pk_thryvar~[s0]) notin c}, m2)-->Stat41(Stat89,Stat18,Stat94*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat95: m2 /= arb({ w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) })
		({ w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) })-->T0(Stat90*) ==> Stat96:
			{ w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) } ¥nincin {m2}
		w9-->Stat96(Stat72*) ==> Stat97: (w9 in { w in m0 | ((fail notin Un(m0)) ¥imp ((pk_thryvar~[s0]) in w)) & ((fail in w) ¥imp (FORALL v in m0 | fail in v)) }) & (w9 /= m2)
		()-->Stat97(Stat72*) ==> false
	Discharge ==> AUTO
	EQUAL(Stat12) ==> Stat98: (m2 = dp0_thryvar(s0,pk_thryvar)) & (fail notin dp0_thryvar(s0,pk_thryvar))
	(Stat98*)ELEM ==> Stat99: if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if ¥eq Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
	EQUAL(Stat6,Stat98,Stat99,Stat90) ==> false
	Discharge ==> QED
--
-- Assuming that $M$ is a model for the non-tautological clauses in $S$ (or the pseudo-model if
-- $S$ is unsatisfiable), we can readjust it to the entire $S$ as follows:
--
Def davisPutnam5: modelTaut_thryvar(S,M) := if fail in M then {fail} else
			M + {arb({h,tog(h)}): c in S, h in (c - M) | tog(h) in (c - M)} end if
--
-- In particular, we can exploit the preceding construct to introduce an optimization to the
-- above-specified Davis-Putnam algorithm:
--
Def davisPutnam6: dp_thryvar(S) := modelTaut_thryvar(S,dp0_thryvar(S - {c: c in S, h in c | tog(h) in c},pk_thryvar))
--
--
--
Theorem davisPutnam12: (S in clauSets_thryvar) ¥imp (Is_dpSat_thryvar(S) ¥eq (fail notin dp_thryvar(S))). Proof:
Suppose_not(s) ==> AUTO
	Loc_def ==> Stat1: s0 = s - {c: c in s, h in c | tog(h) in c}
	(s,s0)-->TdavisPutnam3(*) ==> s0 in clauSets_thryvar
	Use_def(dp_thryvar(s)) ==> AUTO
	Use_def(modelTaut_thryvar(s, dp0_thryvar(s - {c: c in S, h in c | tog(h) in c},pk_thryvar))) ==> AUTO
	EQUAL ==> dp_thryvar(s) = if fail in dp0_thryvar(s0,pk_thryvar) then {fail}
					else (dp0_thryvar(s0,pk_thryvar) +
						{arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})
				end if
--
-- the direct implication
--
	Suppose ==> Stat2: (Is_dpSat_thryvar(s)) & (fail in dp_thryvar(s))
--
-- we have two cases: $({fail} = dp0_thryvar(s0,pk_thryvar)) or ({fail} = {arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})$
--
-- consider the first case
--
		Suppose ==> Stat3: fail in dp0_thryvar(s0,pk_thryvar)
			(Stat3)ELEM ==> if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if ¥eq (not Is_dpSat_thryvar(s0))
			(s0)-->TdavisPutnam11(*) ==> (not Is_dpSat_thryvar(s0))
			TdavisPutnam4(*) ==> Stat4: (FORALL t,s | ((t ¥incin s) & Is_dpSat_thryvar(s)) ¥imp Is_dpSat_thryvar(t))
			(s0, s)-->Stat4(*) ==> false
		Discharge ==> Stat5: fail in {arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))}
--
-- the second case
--
		(c1,h1)-->Stat5 ==> Stat6: (c1 in s) & (h1 in c1) & (fail = arb({h1,tog(h1)}))
--
-- we have $fail in {h1,tog(h1)}$ and hence $(fail = h1) or (fail = tog(h1))$
--
		Use_def(clauSets_thryvar) ==> Stat7: s in { s ¥incin pow(lits) | Finite(Un(s)) }
		()-->Stat7(Stat5*) ==> c1 in pow(lits)
		Use_def(pow) ==> Stat8: c1 in {x: x ¥incin lits}
		x1-->Stat8(Stat6,Stat6*) ==> Stat9: h1 in lits
--
-- as $c1 ¥incin lits$ and $h1 in c1$, we have $h1 in lists$ and we discard the case $fail = h1$
--
		Assump ==> fail notin lits
		(Stat5)ELEM ==> fail = tog(h1)
		Assump ==> Stat10: {tog(x): x in lits} = lits
		Suppose ==> Stat11: tog(h1) notin {tog(x): x in lits}
			h1-->Stat11(Stat9,Stat9*) ==> false
		Discharge ==> AUTO
		EQUAL(Stat5*) ==> false
	Discharge ==> Stat12: (not Is_dpSat_thryvar(s)) & (fail notin dp_thryvar(s))
--
-- the reverse implication
--
	TdavisPutnam4 ==> Stat13: (FORALL s | Is_dpSat_thryvar(s) = (EXISTS m | Has_dpModel_thryvar(s,m)))
	s-->Stat13(Stat13*) ==> Is_dpSat_thryvar(s) = (EXISTS m | Has_dpModel_thryvar(s,m))
	EQUAL(Stat12) ==> Stat14: not (EXISTS m | Has_dpModel_thryvar(s,m))
	(s0)-->TdavisPutnam11(Stat1*) ==> Stat15: if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else (Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))) end if
--
-- first case, ${fail} = dp0_thryvar(s0,pk_thryvar)$
--
	Suppose ==> Stat16: fail notin dp0_thryvar(s0,pk_thryvar)
--
-- we obtain that $dp0_thryvar(s0,pk_thryvar)$ is a model for $s0$, and therefore for $s$
--
		(Stat16)ELEM ==> if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else (Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))) end if ¥eq Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
		(Stat15)ELEM ==> Stat17: Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
		TdavisPutnam4(*) ==> Stat18: (FORALL s, m, t | Has_dpModel_thryvar(s,m) ¥imp Has_dpModel_thryvar(s + {c: c in t, h in c | tog(h) in c}, m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}))
--
-- we show that $s0 + {c: c in s, h in c | tog(h) in c} = s$ to be able to apply the above corollary
--
		Suppose ==> Stat19: not ({c: c in s, h in c | tog(h) in c} ¥incin s)
			(c2)-->Stat19(Stat19*) ==> Stat20: (c2 in {c: c in s, h in c | tog(h) in c}) & (c2 notin s)
			(c3,h3)-->Stat20(Stat20*) ==> false
		Discharge ==> Stat21: AUTO
		(Stat1, Stat21*)ELEM ==> Stat22: s0 + {c: c in s, h in c | tog(h) in c} = s

		(s0, dp0_thryvar(s0,pk_thryvar), s)-->Stat18(Stat18*) ==> Stat23: Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) ¥imp Has_dpModel_thryvar(s0 + {c: c in s, h in c | tog(h) in c}, dp0_thryvar(s0,pk_thryvar) + {arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})

		EQUAL(Stat17, Stat22, Stat23) ==> Stat24: Has_dpModel_thryvar(s, dp0_thryvar(s0,pk_thryvar) + {arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})
--
-- we have obtained a model for $s$, contradiction
--
		(dp0_thryvar(s0,pk_thryvar) + {arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})-->Stat14(Stat24*) ==> false
	Discharge ==> false
	Discharge ==> QED
--
--
--
Theorem davisPutnam13: (S in clauSets_thryvar) ¥imp
		(Is_dpSat_thryvar(S) ¥eq Has_dpModel_thryvar(S,dp_thryvar(S))). Proof:
Suppose_not(s) ==> AUTO
--
-- the reverse implication
--
	Suppose ==> Has_dpModel_thryvar(s,dp_thryvar(s)) & (not Is_dpSat_thryvar(s))
		TdavisPutnam4 ==> Stat1: (FORALL s | Is_dpSat_thryvar(s) = (EXISTS m | Has_dpModel_thryvar(s,m)))
		s-->Stat1(Stat1) ==> Is_dpSat_thryvar(s) = (EXISTS m | Has_dpModel_thryvar(s,m))
		EQUAL ==> Stat2: not (EXISTS m | Has_dpModel_thryvar(s,m))
		(dp_thryvar(s))-->Stat2(*) ==> false
	Discharge ==> Stat3: Is_dpSat_thryvar(s) & (not Has_dpModel_thryvar(s,dp_thryvar(s)))
--
-- the direct implication
--
	Loc_def ==> Stat4: s0 = s - {c: c in s, h in c | tog(h) in c}
	(s,s0)-->TdavisPutnam3(*) ==> Stat5: s0 in clauSets_thryvar
	s-->TdavisPutnam12(*) ==> Stat6: fail notin dp_thryvar(s)
	Use_def(dp_thryvar(s)) ==> AUTO
	Use_def(modelTaut_thryvar(s, dp0_thryvar(s - {c: c in S, h in c | tog(h) in c},pk_thryvar))) ==> AUTO
	EQUAL(Stat4) ==> Stat7: dp_thryvar(s) = if fail in dp0_thryvar(s0,pk_thryvar) then {fail}
					else (dp0_thryvar(s0,pk_thryvar) +
						{arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})
				end if
	(Stat6,Stat7)ELEM ==> Stat8: {fail} /= if fail in dp0_thryvar(s0,pk_thryvar) then {fail}
					else (dp0_thryvar(s0,pk_thryvar) +
						{arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})
				end if
	Suppose ==> Stat9: fail in dp0_thryvar(s0,pk_thryvar)
		(s0)-->TdavisPutnam11(*) ==> if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if
		(Stat9)ELEM ==> if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if ¥eq (not Is_dpSat_thryvar(s0))
		EQUAL(Stat9) ==> (not Is_dpSat_thryvar(s0))
		TdavisPutnam4(*) ==> Stat10: (FORALL t,s | ((t ¥incin s) & Is_dpSat_thryvar(s)) ¥imp Is_dpSat_thryvar(t))
		(s0, s)-->Stat10(Stat3*) ==> false
	Discharge ==> Stat11: fail notin dp0_thryvar(s0,pk_thryvar)
	(Stat7,Stat11)ELEM ==> Stat12: dp_thryvar(s) = (dp0_thryvar(s0,pk_thryvar) +
						{arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})
--
-- we can apply Theorem davisPutnam11 and arrive at a contradiction
--
	(s0)-->TdavisPutnam11(Stat4*) ==> if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if
	(Stat11)ELEM ==> (if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if) ¥eq Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
	(Stat11*)ELEM ==> Stat13: Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
	TdavisPutnam4(Stat13*) ==> Stat14: (FORALL s, m, t | Has_dpModel_thryvar(s,m) ¥imp Has_dpModel_thryvar(s + {c: c in t, h in c | tog(h) in c}, m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}))
--
-- we show that $s0 + {c: c in s, h in c | tog(h) in c} = s$ to be able to apply the above corollary
--
	Suppose ==> Stat15: not ({c: c in s, h in c | tog(h) in c} ¥incin s)
		(c1)-->Stat15(Stat15*) ==> Stat16: (c1 in {c: c in s, h in c | tog(h) in c}) & (c1 notin s)
		(c2,h2)-->Stat16(Stat16*) ==> false
	Discharge ==> Stat17: AUTO
	(Stat4, Stat17*)ELEM ==> Stat18: s0 + {c: c in s, h in c | tog(h) in c} = s
	(s0,dp0_thryvar(s0,pk_thryvar),s)-->Stat14(Stat13,Stat13*) ==> Stat19: Has_dpModel_thryvar(s0 + {c: c in s, h in c | tog(h) in c}, dp0_thryvar(s0,pk_thryvar) + {arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})
	EQUAL(Stat4, Stat19, Stat18, Stat12, Stat3) ==> false
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- DISPLAY davisPutnam
--
--
-- THEORY davisPutnam(tog(x),lits,fail,sl(x))
--
--	(FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
--
--	{tog(x): x in lits} = lits
--
--	fail notin lits
--
--	(FORALL s | ((s /= 0) & (0 notin s)) ¥imp (sl(s) in Un(s)))
--
-- ==> (clauSets_thryvar, Has_dpModel_thryvar, Is_dpSat_thryvar, dpModel_thryvar)
--
--	(FORALL s, m | Has_dpModel_thryvar(s,m) ¥eq ({h in m | tog(h) in m} = 0) & ({c in s | (m * c) = 0} = 0))
--
--	(FORALL s | Is_dpSat_thryvar(s) ¥eq (EXISTS m | Has_dpModel_thryvar(s,m)))
--
--	(FORALL s | clauSets_thryvar = { s ¥incin pow(lits) | Finite(Un(s)) })
--
--	(FORALL s | dp_thryvar(s) = dp_thryvar(s))
--
--	(FORALL s | (s in clauSets_thryvar) ¥imp (Is_dpSat_thryvar(s) ¥eq (fail notin dp_thryvar(s))))
--
--	(FORALL s | (s in clauSets_thryvar) ¥imp (Is_dpSat_thryvar(s) ¥eq Has_dpModel_thryvar(s,dpModel_thryvar(s))))
--
--END davisPutnam
--
--
--
--PAUSE HERE
--
--BEGIN HERE
--
-- ************************************************************************************************
--			Section 21: Simulations and bisimulations
-- ************************************************************************************************
--
-- Basic graph-related notions:
--
Def 10044: [permutation of a finite set] Is_perm(P) := Svm(P) & Finite(P) & (range(P) = domain(P))
--
Def 10045: [simple cyclic permutation] Scycle(C) := {p ¥incin C | (p /= 0) & Is_perm(p)} = {C}
--
Def 10046: [acyclicity property of a map] Acyclic(A) := {c ¥incin A | Is_perm(c)} = {0}
--
Def 10047: [cycle-free path connecting two nodes, or empty path] Straight(P,X,Y) := Scycle(P + {[Y,X]}) & ([Y,X] notin P)
--
Def 10047a: [prefix of cycle-free path] prefix(Q,Z) := {w: w in Q, p ¥incin ((Q - {w}) + {[arb(range(Q) - domain(Q)),cdr(w)]}) | Is_perm(p) & (Z in domain(p))}
--
Def 10047b: [prefixed simple path in a map] segm(N,P,S) := S + {[x,P~[x]]: i in N, x in (range(segm(i,P,S)) * domain(P))}
--
Def 10047c: [designated source in a map] start(P) := arb(domain(P) - range(P))
--
Def 10048: [restriction of a multi-valued map] on(R,N) := R * (N ¥PROD N)
--
Def 10049: [transitive closure of a map] transCl(R) := {[x,y]: q ¥incin R, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}
--
Def 10050: [transitive-reflexive closure of a map] trans_reflCl(R,N) := transCl(on(R,N)) + ident(N)
--
Def 10050a: [self-loops] selfLoops(R) := {p in R | p = [car(p),car(p)]}
--
-- Our first theorem shows that one of the clauses in the definition
-- of finite permutations could be weakened: namely, inclusion
-- of the domain in the range could supersede equality between
-- domain and range.
--
Theorem 901: (Svm(P) & Finite(P) & (range(P) incs domain(P))) ¥imp Is_perm(P). Proof:
Suppose_not(p) ==> AUTO
	Use_def(Is_perm) ==> range(p) /= domain(p)
	(domain(p),range(p))-->T170(*) ==> #domain(p) ¥incin #range(p)
	p-->T171(*) ==> #domain(p) = #range(p)
	APPLY() finite_image(e(x)->cdr(x),s0->p) ==>
		Stat1: Finite({cdr(x): x in p})
	Use_def(range)(Stat1*) ==> Finite(range(p))
(range(p),domain(p))-->T194(*) ==> false; Discharge ==> QED
--
Theorem 902: (Scycle(P) ¥imp ((P /= 0) & Is_perm(P) & Svm(P) & Finite(P))) & (Straight(P,X,Y) ¥imp (Svm(P) & Finite(P))). Proof:
Suppose_not(q,x0,y0) ==> AUTO
	Suppose ==> Scycle(q)
		Use_def(Scycle) ==> Stat1: q in {p ¥incin q | (p /= 0) & Is_perm(p)}
		()-->Stat1(Stat1*) ==> (q /= 0) & Is_perm(q)
	Use_def(Is_perm) ==> false; Discharge ==> Stat2: Straight(q,x0,y0) & (not (Svm(q) & Finite(q)))
	Use_def(Straight)(Stat2*) ==> Stat3: Scycle(q + {[y0,x0]})
	Use_def(Scycle)(Stat3*) ==> Stat4: (q + {[y0,x0]}) in {p ¥incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)}
	()-->Stat4(Stat4*) ==> Stat5: Is_perm(q + {[y0,x0]})
	Use_def(Is_perm)(Stat5*) ==> Svm(q + {[y0,x0]}) & Finite(q + {[y0,x0]})
	(q,q + {[y0,x0]})-->T53(*) ==> (not Finite(q))
(q + {[y0,x0]},q)-->T189(*) ==> false; Discharge ==> QED
--
-- Our next theorem is a special case of the one which follows it; nevertheless it is
-- included, because its proof introduces the main points of the other proof.
--
Theorem 903: (Is_perm(P) & (P /= 0)) ¥imp (EXISTS c ¥incin P | Scycle(c)). Proof:
Suppose_not(q) ==> AUTO
	ELEM ==> Stat1: not(EXISTS c ¥incin q | Scycle(c))
	Use_def(Is_perm)(*) ==> Finite(q)
	APPLY(m1_thryvar:m) finite_induction(n->q,P(x)->((x /= 0) & Is_perm(x))) ==>
		Stat2: (m ¥incin q) & ((m /= 0) & Is_perm(m)) & Stat3: (FORALL k ¥incin m | (k /= m) ¥imp (not((k /= 0) & Is_perm(k))))
	m-->Stat1(Stat2*) ==> Stat4: (not Scycle(m))
	Use_def(Scycle)(Stat4*) ==> {p ¥incin m | (p /= 0) & Is_perm(p)} /= {m}
	Suppose ==> Stat5: m notin {p ¥incin m | (p /= 0) & Is_perm(p)}
	m-->Stat5(Stat2*) ==> false; Discharge ==> Stat6: not({p ¥incin m | (p /= 0) & Is_perm(p)} ¥incin {m})
	k-->Stat6(Stat6*) ==> Stat7: (k in {p ¥incin m | (p /= 0) & Is_perm(p)}) & (k /= m)
	()-->Stat7(Stat7*) ==> (k ¥incin m) & (k /= 0) & Is_perm(k)
k-->Stat3(Stat2*) ==> false; Discharge ==> QED
--
--
--
Theorem 904: (Is_map(P) & Finite(P) & (range(P) ¥incin domain(P)) & (P /= 0)) ¥imp (EXISTS c ¥incin P | Scycle(c)). Proof:
Suppose_not(q) ==> AUTO
	ELEM ==> Stat1: not(EXISTS c ¥incin q | Scycle(c))
	APPLY(m1_thryvar:m) finite_induction(n->q,P(x)->((x /= 0) & (range(x) ¥incin domain(x)))) ==>
		Stat2: (m ¥incin q) & ((m /= 0) & (range(m) ¥incin domain(m))) & Stat3: (FORALL k ¥incin m | (k /= m) ¥imp (not((k /= 0) & (range(k) ¥incin domain(k)))))
	m-->Stat1(Stat2*) ==> Stat4: (not Scycle(m))
	Use_def(Scycle)(Stat4*) ==> {p ¥incin m | (p /= 0) & Is_perm(p)} /= {m}
	Suppose ==> Stat5: m notin {p ¥incin m | (p /= 0) & Is_perm(p)}
		m-->Stat5(Stat2,Stat2*) ==> (not Is_perm(m))
		Use_def(Is_perm)(Stat5*) ==> (not Svm(m)) or (not Finite(m)) or (range(m) /= domain(m))
		(q,m)-->T189(*) ==> Finite(m)
		(m,q)-->T52(*) ==> Stat6: Is_map(m)
		Suppose ==> (not Svm(m))
			Use_def(Svm)(Stat5*) ==> Stat7: not(FORALL x in m, y in m | (car(x) = car(y)) ¥imp (x = y))
			(x0,y0)-->Stat7(Stat7*) ==> (x0 in m) & (y0 in m) & (car(x0) = car(y0)) & (x0 /= y0)
			Suppose ==> range(m - {x0}) ¥nincin domain(m - {x0})
				(m - {x0},m)-->T65(Stat7*) ==> range(m) ¥nincin domain(m - {x0})
				(m - {x0},{x0})-->T78(Stat7*) ==> Stat8: ((domain(m - {x0}) + domain({x0})) = domain((m - {x0}) + {x0})) & (((m - {x0}) + {x0}) = m)
				EQUAL(Stat8) ==> (domain(m - {x0}) + domain({x0})) = domain(m)
				(Stat2*)ELEM ==> domain({x0}) ¥nincin domain(m - {x0})
				({y0},m - {x0})-->T65(Stat7*) ==> domain({x0}) ¥nincin domain({y0})
				(m,x0)-->T51(Stat5*) ==> x0 = [car(x0),cdr(x0)]
				(car(x0),cdr(x0))-->T114(Stat7*) ==> domain({[car(x0),cdr(x0)]}) = {car(x0)}
				EQUAL(Stat7) ==> {car(x0)} ¥nincin domain({y0})
				(m,y0)-->T51(Stat5*) ==> y0 = [car(y0),cdr(y0)]
				(car(y0),cdr(y0))-->T114(Stat7*) ==> domain({[car(y0),cdr(y0)]}) = {car(y0)}
				EQUAL(Stat7) ==> Stat9: {car(x0)} ¥nincin {car(x0)}
			(Stat9*)Discharge ==> range(m - {x0}) ¥incin domain(m - {x0})
			(m - {x0})-->Stat3(Stat7*) ==> (not Is_map(m - {x0}))
		(m - {x0},m)-->T52(Stat5*) ==> false; Discharge ==> Stat10: not(domain(m) ¥incin range(m))
		c-->Stat10(Stat10*) ==> (c in domain(m)) & (c notin range(m))
		Use_def(domain)(Stat10*) ==> Stat11: c in {car(x): x in m}
		x1-->Stat11(Stat11*) ==> Stat12: (c = car(x1)) & (x1 in m)
		(m - {x1})-->Stat3(Stat11*) ==> (m = {x1}) or (range(m - {x1}) ¥nincin domain(m - {x1}))
		(m,x1)-->T51(Stat12,Stat6*) ==> x1 = [car(x1),cdr(x1)]
		(car(x1),cdr(x1))-->T114(Stat12*) ==> (domain({[car(x1),cdr(x1)]}) = {car(x1)}) & (range({[car(x1),cdr(x1)]}) = {cdr(x1)})
		Suppose ==> m = {x1}
			EQUAL(Stat2) ==> Stat13: (not({car(x1)} ¥incin {cdr(x1)})) & ({cdr(x1)} ¥incin {car(x1)})
		(Stat13*)Discharge ==> range(m - {x1}) ¥nincin domain(m - {x1})
		(m - {x1},m)-->T65(Stat12*) ==> range(m) ¥nincin domain(m - {x1})
		(m - {x1},{x1})-->T78(Stat12*) ==> Stat14: ((domain(m - {x1}) + domain({x1})) = domain((m - {x1}) + {x1})) & (((m - {x1}) + {x1}) = m)
		EQUAL(Stat14) ==> (domain(m - {x1}) + domain({x1})) = domain(m)
		(Stat2*)ELEM ==> (domain({x1}) * range(m)) /= 0
		EQUAL(Stat12) ==> ({c} * range(m)) /= 0
	(Stat10*)Discharge ==> Stat15: not({p ¥incin m | (p /= 0) & Is_perm(p)} ¥incin {m})
	k-->Stat15(Stat15*) ==> Stat16: (k in {p ¥incin m | (p /= 0) & Is_perm(p)}) & (k /= m)
	()-->Stat16(Stat16*) ==> Stat17: (k ¥incin m) & (k /= 0) & Is_perm(k)
	k-->Stat3(Stat16*) ==> range(k) ¥nincin domain(k)
Use_def(Is_perm)(Stat17*) ==> false; Discharge ==> QED
--
-- Our next theorem shows that finite permutations enjoy one-one-ness.
--
Theorem 905: Is_perm(0) & (Is_perm(P) ¥imp one_1_map(P)). Proof:
Suppose_not(g) ==> AUTO
--
-- The first part of the statement is trivial.
--
	Suppose ==> Stat1: (not Is_perm(0))
		T59 ==> Svm(0) & (domain(0) = range(0))
		T188 ==> Finite(0)
	Use_def(Is_perm) ==> false; Discharge ==> Stat2: Is_perm(g) & (not one_1_map(g))
--
-- If a counterexample to the second part of the statement existed, then we could pick one, $g$, within which
-- we would find distinct pairs $v,w$ with the same first component.
--
	Use_def(Is_perm)(Stat2*) ==> Stat3: Svm(g) & Finite(g) & (range(g) = domain(g)) & (not one_1_map(g))
	Use_def(one_1_map)(Stat3*) ==> Stat4: not(FORALL x in g, y in g | (cdr(x) = cdr(y)) ¥imp (x = y))
	(v,w)-->Stat4(Stat4*) ==> Stat5: (v in g) & (w in g) & (cdr(v) = cdr(w)) & (v /= w)
--
-- Consider now the mapping $g - {v}$, whose single-valuedness and finiteness
-- are obvious.
--
	(g - {v},g)-->T53(Stat3,Stat3*) ==> Stat6: Svm(g - {v})
	(g,g - {v})-->T189(Stat3,Stat3*) ==> Finite(g - {v})
--
-- It is easily seen that $g - {v}$ has the same range as $g$,
-- and that its domain and range are the same set (so that $g - {v}$
-- is a permutation too).
--
	Suppose ==> Stat7: range(g - {v}) /= range(g)
		(Stat5*)ELEM ==> Stat8: ((g - {v}) + {v}) = g
		(g - {v},{v})-->T79(Stat8*) ==> (range((g - {v}) + {v}) = (range(g - {v}) + range({v})))
		Use_def(range)(Stat9*) ==> Stat9: range({v}) = {cdr(x): x in {v}}
 		SIMPLF(Stat9) ==> range({v}) = {cdr(v)}
		Use_def(range)(Stat10*) ==> Stat10: range({w}) = {cdr(x): x in {w}}
		SIMPLF(Stat10) ==> Stat11: range({w}) = {cdr(w)}
		EQUAL(Stat5) ==> Stat12: range(g) = (range(g - {v}) + {cdr(w)})
	({w},g - {v})-->T65(Stat11,Stat12,Stat7,Stat5*) ==> false; Discharge ==> Stat13: range(g - {v}) = range(g)
	Suppose ==> Stat14: domain(g - {v}) /= range(g - {v})
		APPLY() finite_image(e(x)->cdr(x),s0->(g - {v})) ==>
			Stat15: Finite({cdr(x): x in (g - {v})})
		Use_def(range)(Stat15*) ==> Stat16: Finite(range(g - {v}))
		(g - {v},g)-->T65(Stat17*) ==> Stat17: domain(g - {v}) ¥incin domain(g)
		(range(g - {v}))-->T195(Stat16*) ==> Stat18: (not(EXISTS f in OM | (Svm(f) & (range(f) = range(g - {v})) & (domain(f) ¥incin range(g - {v})) & (range(g - {v}) /= domain(f)))))
	(g - {v})-->Stat18(Stat14,Stat17,Stat3,Stat13,Stat6*) ==> false; Discharge ==> Stat19: domain(g - {v}) = range(g - {v})
--
-- There is hence a pair in $g - {v}$ which shares the first component with $v$.
-- This implies that there are two pairs with the same first component in $g$,
-- which conflicts with the single-valuedness of $g$.
--
	Use_def(Svm)(Stat3,Stat3*) ==> Stat20: Is_map(g)
	Suppose ==> [car(v),(g - {v})~[car(v)]] notin (g - {v})
		Use_def(Svm)(Stat6,Stat6*) ==> Is_map(g - {v})
		(g - {v},car(v))-->T77(Stat20*) ==> Stat21: car(v) notin domain(g - {v})
		(Stat21,Stat19,Stat13,Stat3*)ELEM ==> car(v) notin domain(g)
		Use_def(domain)(Stat21*) ==> Stat22: car(v) notin {car(x): x in g}
	v-->Stat22(Stat5*) ==> false; Discharge ==> Stat23: [car(v),(g - {v})~[car(v)]] in (g - {v})
	(g,v)-->T76(Stat5,Stat20*) ==> (v = [car(v),cdr(v)]) & ([car(v),cdr(v)] in g)
	Use_def(Svm)(Stat3*) ==> Stat24: (FORALL x in g, y in g | (car(x) = car(y)) ¥imp (x = y))
	([car(v),cdr(v)],[car(v),(g - {v})~[car(v)]])-->Stat24(Stat23*) ==> Stat25: car([car(v),cdr(v)]) /= car([car(v),(g - {v})~[car(v)]])
--
-- This contradiction leads us to the desired result.
--
(Stat25)Discharge ==> QED
--
-- The eight theorems which follow relate the notion of
-- acyclicity, just introduced, with the notions of
-- simple cycle, on the one hand, and of straigth path on
-- the other hand.
--
Theorem 906: Acyclic(A) ¥imp (not Scycle(A)). Proof:
Suppose_not(a) ==> AUTO
--
-- For, if we assume $a$ to contradict the statement, then by
-- making setformers explicit in the definitions of $Acyclic$ and of $Scycle$,
-- and observing that one is included in the other, we get $a=0$.
--
	Use_def(Scycle(a)) ==> AUTO
	Use_def(Acyclic(a)) ==> AUTO
	Set_monot ==> ({p ¥incin a | (p /= 0) & Is_perm(p)} ¥incin {p ¥incin a | Is_perm(p)})
--
-- But then, $0$ must belong to a set whose elements cannot be null:
-- a contradiction which gives is the desired result.
--
	ELEM ==> Stat1: 0 in {p ¥incin a | (p /= 0) & Is_perm(p)}
()-->Stat1(Stat1*) ==> false; Discharge ==> QED
--
Theorem 907: ((B incs A) & Acyclic(B)) ¥imp Acyclic(A). Proof:
Suppose_not(b,a) ==> Stat1: (b incs a) & Acyclic(b) & (not Acyclic(a))
	Use_def(Acyclic(b)) ==> AUTO
	Use_def(Acyclic(a)) ==> AUTO
	Set_monot ==> {p ¥incin a | Is_perm(p)} ¥incin {p ¥incin b | Is_perm(p)}
	ELEM ==> Stat2: {p ¥incin a | Is_perm(p)} = 0
	0-->Stat2 ==> (not Is_perm(0))
0-->T905(Stat2*) ==> false; Discharge ==> QED
--
Theorem 908: Acyclic(0) & Is_perm({[X,X]}) & Scycle({[X,X]}) & ((X /= Y) ¥eq Acyclic({[X,Y]})). Proof:
Suppose_not(u,v) ==> AUTO
	0-->T905 ==> Stat1: Is_perm(0)
	Suppose ==> not Acyclic(0)
		Use_def(Acyclic) ==> {p ¥incin 0 | Is_perm(p)} /= {0}
		Suppose ==> Stat2: 0 notin {p ¥incin 0 | Is_perm(p)}
		0-->Stat2(Stat1*) ==> false; Discharge ==> Stat3: not({p ¥incin 0 | Is_perm(p)} ¥incin {0})
		c-->Stat3 ==> Stat4: (c in {p ¥incin 0 | Is_perm(p)}) & (c /= 0)
	()-->Stat4(Stat4*) ==> false; Discharge ==> Acyclic(0)
	Suppose ==> Stat5: (not Is_perm({[u,u]}))
		(u,u)-->T91(Stat5*) ==> Svm({[u,u]})
		(Stat6*)ELEM ==> Stat6: domain({[u,u]}) = range({[u,u]})
		([u,u])-->T201(Stat6*)==> Finite({[u,u]})
	Use_def(Is_perm)(Stat5*) ==> false; Discharge ==> Stat7: Is_perm({[u,u]})
	Suppose ==> (not Scycle({[u,u]}))
		Use_def(Scycle) ==> {p ¥incin {[u,u]} | (p /= 0) & Is_perm(p)} /= {{[u,u]}}
		Suppose ==> Stat8: {[u,u]} notin {p ¥incin {[u,u]} | (p /= 0) & Is_perm(p)}
		({[u,u]})-->Stat8(Stat7*) ==> false; Discharge ==> Stat9: not({p ¥incin {[u,u]} | (p /= 0) & Is_perm(p)} ¥incin {{[u,u]}})
		p0-->Stat9(Stat9*) ==> Stat10: (p0 in {p ¥incin {[u,u]} | (p /= 0) & Is_perm(p)}) & (p0 /= {[u,u]})
	()-->Stat10(Stat10*) ==> false; Discharge ==> (u /= v) ¥neq Acyclic({[u,v]})
	Suppose ==> Stat11: (u /= v) & (not Acyclic({[u,v]}))
		Use_def(Acyclic)(Stat11*) ==> Stat12: {p ¥incin {[u,v]} | Is_perm(p)} /= {0}
		Suppose ==> Stat13: 0 notin {p ¥incin {[u,v]} | Is_perm(p)}
			0-->Stat13(Stat13*) ==> (not Is_perm(0))
		0-->T905(Stat13*) ==> false; Discharge ==> Stat14: not({p ¥incin {[u,v]} | Is_perm(p)} ¥incin {0})
		p-->Stat14(Stat14*) ==> Stat15: (p in {p ¥incin {[u,v]} | Is_perm(p)}) & (p /= 0)
		()-->Stat15(Stat15*) ==> (p = {[u,v]}) & Is_perm(p)
		EQUAL(Stat14) ==> Is_perm({[u,v]})
		Use_def(Is_perm)(Stat14*) ==> Stat16: range({[u,v]}) = domain({[u,v]})
	(u,v,u,v)-->T114(Stat16,Stat11*) ==> false; Discharge ==> Stat17: (u = v) & Acyclic({[u,v]})
	Use_def(Acyclic)(Stat17*) ==> {p ¥incin {[u,v]} | Is_perm(p)} = {0}
	EQUAL(Stat17) ==> Stat18: {p ¥incin {[u,u]} | Is_perm(p)} = {0}
	(Stat18*)ELEM ==> Stat19: {[u,u]} notin {p ¥incin {[u,u]} | Is_perm(p)}
({[u,u]})-->Stat19(Stat7*) ==> false; Discharge ==> QED
--
--
--
Theorem 909: Is_perm({[X,Y],[Y,X]}) & Scycle({[X,Y],[Y,X]}) & ((X /= Y) ¥imp Straight({[X,Y]},X,Y)). Proof:
Suppose_not(u,v) ==> AUTO
	Suppose ==> u = v
		EQUAL ==> Stat1: ([u,v] = [u,u]) & ([v,u] = [u,u])
		(Stat1*)ELEM ==> {[u,v],[v,u]} = {[u,u]}
		EQUAL ==> Stat2: not(Is_perm({[u,u]}) & Scycle({[u,u]}))
	(u,u)-->T908(Stat2*) ==> false; Discharge ==> Stat3: u /= v
	Suppose ==> (not Is_perm({[u,v],[v,u]}))
		Use_def(Is_perm)(Stat3*) ==> not(Svm({[u,v],[v,u]}) & Finite({[u,v],[v,u]}) & (range({[u,v],[v,u]}) = domain({[u,v],[v,u]})))
		([u,v],[v,u])-->T202(Stat3*) ==> Finite({[u,v],[v,u]})
		TELEM ==> (domain({[u,v],[v,u]}) = {u,v}) & (range({[u,v],[v,u]}) = {v,u})
		(Stat3*)ELEM ==> Stat4: (not Svm({[u,v],[v,u]}))
		(u,v,v,u)-->T92(Stat3,Stat4*) ==> false
	Discharge ==> Stat5: Is_perm({[u,v],[v,u]})
	Suppose ==> (not Scycle({[u,v],[v,u]}))
		Use_def(Scycle) ==> Stat6: {p ¥incin {[u,v],[v,u]} | (p /= 0) & Is_perm(p)} /= {{[u,v],[v,u]}}
		pp-->Stat6(Stat6*) ==> Stat7: (pp in {p ¥incin {[u,v],[v,u]} | (p /= 0) & Is_perm(p)}) ¥neq (pp in {{[u,v],[v,u]}})
		Suppose ==> Stat8: pp = {[u,v],[v,u]}
			EQUAL(Stat5) ==> Is_perm(pp)
			(Stat7*)ELEM ==> Stat9: (pp notin {p ¥incin {[u,v],[v,u]} | (p /= 0) & Is_perm(p)})
		pp-->Stat9(Stat8*) ==> false; Discharge ==> Stat10: (pp in {p ¥incin {[u,v],[v,u]} | (p /= 0) & Is_perm(p)}) & (pp /= {[u,v],[v,u]})
		()-->Stat10(Stat10*) ==> Stat11: ((pp = {[u,v]}) or (pp = {[v,u]})) & Is_perm(pp)
		Use_def(Is_perm)(Stat11*) ==> Stat12: domain(pp) = range(pp)
		Suppose ==> pp = {[u,v]}
			TELEM ==> (domain({[u,v]}) = {u}) & (range({[u,v]}) = {v})
			EQUAL(Stat12) ==> Stat13: (domain(pp) = {u}) & (range(pp) = {v})
		(Stat13,Stat12,Stat3*)Discharge ==> Stat14: pp = {[v,u]}
		TELEM ==> (domain({[v,u]}) = {v}) & (range({[v,u]}) = {u})
		EQUAL(Stat14) ==> Stat15: (domain(pp) = {v}) & (range(pp) = {u})
	(Stat15,Stat12,Stat3*)Discharge ==> Stat16: Scycle({[u,v],[v,u]}) & (u /= v) & (not Straight({[u,v]},u,v))
	Use_def(Straight)(Stat16*) ==> (not Scycle({[u,v]} + {[v,u]}))
	TELEM ==> ({[u,v]} + {[v,u]}) = {[u,v],[v,u]}
EQUAL(Stat16) ==> false; Discharge ==> QED
--
-- It is generally agreed that the empty path connects
-- any vertex with itself in any graph.
-- We show that this convention is captured by our
-- definition of the $Straight$ predicate.
--
Theorem 910: Straight(0,X,Y) ¥eq (Y = X). Proof:
Suppose_not(u,v) ==> AUTO
	Use_def(Straight) ==> Stat1: Scycle(0 + {[v,u]}) ¥eq (v /= u)
	TELEM ==> 0 + {[v,u]} = {[v,u]}
	EQUAL(Stat1) ==> Scycle({[v,u]}) ¥eq (v /= u)
	({[v,u]})-->T906 ==> AUTO
	(v,u)-->T908(Stat1*) ==> Stat2: (not Scycle({[v,u]})) & (v = u)
	EQUAL(Stat2) ==> (not Scycle({[u,u]}))
(u,u)-->T908(Stat2*) ==> false; Discharge ==> QED
--
Theorem 911: ((X /= Y) & (Y /= Z)) ¥imp ((X /= Z) ¥eq Acyclic({[X,Y],[Y,Z]})). Proof:
Suppose_not(x,y,z) ==> AUTO
	Suppose ==> Stat1: x = z
		(x,y)-->T909(Stat1*) ==> Scycle({[x,y],[y,x]})
		EQUAL(Stat1) ==> Scycle({[x,y],[y,z]})
	({[x,y],[y,z]})-->T906(*) ==> false; Discharge ==> Stat2: (x /= y) & (y /= z) & (x /= z) & (not Acyclic({[x,y],[y,z]}))
	Use_def(Acyclic) ==> {p ¥incin {[x,y],[y,z]} | Is_perm(p)} /= {0}
	0-->T905 ==> Stat3: Is_perm(0)
	Suppose ==> Stat4: 0 notin {p ¥incin {[x,y],[y,z]} | Is_perm(p)}
	0-->Stat4(Stat3*) ==> false; Discharge ==> Stat5: not({p ¥incin {[x,y],[y,z]} | Is_perm(p)} ¥incin {0})
	q-->Stat5(Stat5*) ==> Stat6: (q in {p ¥incin {[x,y],[y,z]} | Is_perm(p)}) & (q /= 0)
	()-->Stat6(Stat6*) ==> Stat7: ((q = {[x,y]}) or (q = {[y,z]}) or (q = {[x,y],[y,z]})) & Is_perm(q)
	Suppose ==> q = {[x,y]}
		(x,y)-->T908(Stat2,Stat2*) ==> Acyclic({[x,y]})
		Use_def(Acyclic) ==> Stat8: {[x,y]} notin {p ¥incin {[x,y]} | Is_perm(p)}
		EQUAL(Stat7) ==> Is_perm({[x,y]})
	({[x,y]})-->Stat8(Stat8*) ==> false; Discharge ==> q /= {[x,y]}
	Suppose ==> q = {[y,z]}
		(y,z)-->T908(Stat2,Stat2*) ==> Acyclic({[y,z]})
		Use_def(Acyclic) ==> Stat9: {[y,z]} notin {p ¥incin {[y,z]} | Is_perm(p)}
		EQUAL(Stat7) ==> Is_perm({[y,z]})
	({[y,z]})-->Stat9(Stat9*) ==> false; Discharge ==> q = {[x,y],[y,z]}
	EQUAL(Stat7) ==> Stat10: Is_perm({[x,y],[y,z]})
	Use_def(Is_perm)(Stat10*) ==> Stat11: domain({[x,y],[y,z]}) = range({[x,y],[y,z]})
	TELEM ==> Stat12: (domain({[x,y],[y,z]}) = {x,y}) & (range({[x,y],[y,z]}) = {y,z})
(Stat2,Stat11,Stat12*)Discharge ==> QED
--
-- It readily follows from the definitions of the 'Straight' and 'Scycle' predicates
-- that an acyclic path cannot include a non-void permutation.
--
Theorem 912: (Straight(Q,X,Y) & Is_perm(P) & (P /= 0)) ¥imp (P ¥nincin Q). Proof:
Suppose_not(q,x0,y0,p) ==> AUTO
	Use_def(Straight(q,x0,y0)) ==> AUTO
	Use_def(Scycle(q + {[y0,x0]})) ==> AUTO
	Suppose ==> Stat1: p notin {p ¥incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)}
	p-->Stat1(*) ==> false; Discharge ==> false
Discharge ==> QED
--
--
--
Theorem 913: Acyclic({[X,Y],[Y,Z]}) ¥imp Straight({[X,Y],[Y,Z]},X,Z). Proof:
Suppose_not(u,v,z) ==> AUTO
	Use_def(Straight) ==> Stat1: not(Scycle({[u,v],[v,z]} + {[z,u]}) & ([z,u] notin {[u,v],[v,z]}))
	Suppose ==> Stat2: [z,u] = [u,v]
		(Stat2)ELEM ==> u = v
		EQUAL ==> Stat3: Acyclic({[z,u],[u,z]})
		(z,u)-->T909(Stat3*) ==> Scycle({[z,u],[u,z]})
	({[z,u],[u,z]})-->T906(Stat3*) ==> false; Discharge ==> [z,u] /= [u,v]
	Suppose ==> Stat4: [z,u] = [v,z]
		(Stat4)ELEM ==> u = z
		EQUAL ==> Stat5: Acyclic({[z,v],[v,z]})
		(z,v)-->T909(Stat5*) ==> Scycle({[z,v],[v,z]})
	({[z,v],[v,z]})-->T906(Stat5*) ==> false; Discharge ==> [z,u] /= [v,z]
	(Stat1*)ELEM ==> Stat6: (not Scycle({[u,v],[v,z]} + {[z,u]})) & (({[u,v],[v,z]} + {[z,u]}) = {[u,v],[v,z],[z,u]})
	EQUAL(Stat6) ==> Stat7: (not Scycle({[u,v],[v,z],[z,u]}))
	Use_def(Scycle)(Stat7*) ==> Stat8: {p ¥incin {[u,v],[v,z],[z,u]} | (p /= 0) & Is_perm(p)} /= {{[u,v],[v,z],[z,u]}}
	p-->Stat8(Stat8*) ==> (p in {p ¥incin {[u,v],[v,z],[z,u]} | (p /= 0) & Is_perm(p)}) ¥neq (p = {[u,v],[v,z],[z,u]})
--
-- Let us observe that $u /= z$, $v /= z$, and $u /= v$.
--
	Suppose ==> Stat9: u = z
		EQUAL ==> Acyclic({[u,v],[v,u]})
		(u,v)-->T909(Stat9*) ==> Scycle({[u,v],[v,u]})
	({[u,v],[v,u]})-->T906(Stat9*) ==> false; Discharge ==> Stat10: u /= z
	Suppose ==> Stat11: v = z
		EQUAL ==> Acyclic({[u,v],[z,z]})
		Use_def(Acyclic)(Stat11*) ==> Stat12: {[z,z]} notin {c ¥incin {[u,v],[z,z]} | Is_perm(c)}
		(z,z)-->T908(Stat11*) ==> Is_perm({[z,z]})
	({[z,z]})-->Stat12(Stat12*) ==> false; Discharge ==> Stat13: v /= z
	Suppose ==> Stat14: u = v
		EQUAL ==> Acyclic({[u,u],[v,z]})
		Use_def(Acyclic)(Stat14*) ==> Stat15: {[u,u]} notin {c ¥incin {[u,u],[v,z]} | Is_perm(c)}
		(u,u)-->T908(Stat14*) ==> Is_perm({[u,u]})
	({[u,u]})-->Stat15(Stat15*) ==> false; Discharge ==> Stat16: u /= v
--
--
--
	Suppose ==> Stat17: {[u,v],[v,z],[z,u]} notin {p ¥incin {[u,v],[v,z],[z,u]} | (p /= 0) & Is_perm(p)}
		({[u,v],[v,z],[z,u]})-->Stat17(Stat17*) ==> (not Is_perm({[u,v],[v,z],[z,u]}))
		Use_def(Is_perm)(Stat17*) ==> not(Svm({[u,v],[v,z],[z,u]}) & Finite({[u,v],[v,z],[z,u]}) & (range({[u,v],[v,z],[z,u]}) = domain({[u,v],[v,z],[z,u]})))
		Suppose ==> Stat18: (not Finite({[u,v],[v,z],[z,u]}))
			EQUAL(Stat6) ==> (not Finite({[u,v],[v,z]} + {[z,u]}))
			({[u,v],[v,z]},[z,u])-->T199(Stat18*) ==> (not Finite({[u,v],[v,z]}))
		([u,v],[v,z])-->T202(Stat18*) ==> false; Discharge ==> Finite({[u,v],[v,z],[z,u]})
		Suppose ==> Stat19: range({[u,v],[v,z],[z,u]}) /= domain({[u,v],[v,z],[z,u]})
			TELEM ==> range({[u,v],[v,z],[z,u]}) = {u,v,z}
			TELEM ==> domain({[u,v],[v,z],[z,u]}) = {v,z,u}
		(Stat19*)Discharge ==> Stat20: (not Svm({[u,v],[v,z],[z,u]}))
		TELEM ==> Is_map({[u,v],[v,z],[z,u]})
		Use_def(Svm)(Stat20*) ==> Stat21: not(FORALL x in {[u,v],[v,z],[z,u]}, y in {[u,v],[v,z],[z,u]} | (car(x) = car(y)) ¥imp (x = y))
		(q,r)-->Stat21(Stat21*) ==> Stat22: (q in {[u,v],[v,z],[z,u]}) & (r in {[u,v],[v,z],[z,u]}) & (q /= r) & (car(q) = car(r))
		(Stat22,Stat22*)ELEM ==> Stat23: car(q) = car(r)
		(Stat22,Stat22*)ELEM ==> Stat24: (((q = [u,v]) & (r = [v,z])) or ((q = [u,v]) & (r = [z,u])) or ((q = [v,z]) & (r = [z,u])) or ((r = [u,v]) & (q = [v,z])) or ((r = [u,v]) & (q = [z,u])) or ((r = [v,z]) & (q = [z,u])))
		Suppose ==> Stat25: (q = [u,v]) & (r = [v,z])
			(Stat23,Stat25)ELEM ==> Stat26: u = v
		(Stat26,Stat16*)Discharge ==> not((q = [u,v]) & (r = [v,z]))
		Suppose ==> Stat27: (q = [u,v]) & (r = [z,u])
			(Stat23,Stat27,Stat10)ELEM ==> Stat28: u = z
		(Stat28,Stat10*)Discharge ==> not((q = [u,v]) & (r = [z,u]))
		Suppose ==> Stat29: (q = [v,z]) & (r = [z,u])
			(Stat23,Stat29)ELEM ==> Stat30: v = z
		(Stat30,Stat13*)Discharge ==> not((q = [v,z]) & (r = [z,u]))
		Suppose ==> Stat31: (r = [u,v]) & (q = [v,z])
			(Stat23,Stat31)ELEM ==> Stat32: u = v
		(Stat32,Stat16*)Discharge ==> not((r = [u,v]) & (q = [v,z]))
		Suppose ==> Stat33: (r = [u,v]) & (q = [z,u])
			(Stat23,Stat33)ELEM ==> Stat34: u = z
		(Stat34,Stat10*)Discharge ==> Stat35: (r = [v,z]) & (q = [z,u])
		(Stat23,Stat35)ELEM ==> Stat36: v = z
	(Stat36,Stat13*)Discharge ==> Stat37: (p in {p ¥incin {[u,v],[v,z],[z,u]} | (p /= 0) & Is_perm(p)}) & (p /= {[u,v],[v,z],[z,u]})
	()-->Stat37(Stat37*) ==> Stat38: (p ¥incin {[u,v],[v,z],[z,u]}) & (p /= 0) & Is_perm(p)
	Suppose ==> p ¥incin {[u,v],[v,z]}
		Use_def(Acyclic)(Stat38*) ==> Stat39: p notin {c ¥incin {[u,v],[v,z]} | Is_perm(c) }
	p-->Stat39(Stat38*) ==> false; Discharge ==> p ¥nincin {[u,v],[v,z]}
	(Stat37*)ELEM ==> (p = {[z,u]}) or (p = {[u,v],[z,u]}) or (p = {[v,z],[z,u]})
	Use_def(Is_perm)(Stat38,Stat38*) ==> Stat40: range(p) = domain(p)
	Suppose ==> p = {[z,u]}
		TELEM ==> (range({[z,u]}) = {u}) & (domain({[z,u]}) = {z})
		EQUAL(Stat40) ==> Stat41: {u} = {z}
		(Stat41*)ELEM ==> Stat42: u = z
	(Stat42,Stat10*)Discharge ==> p /= {[z,u]}
	Suppose ==> p = {[u,v],[z,u]}
		TELEM ==> (range({[u,v],[z,u]}) = {v,u}) & (domain({[u,v],[z,u]}) = {u,z})
		EQUAL(Stat40) ==> Stat43: {v,u} = {u,z}
		(Stat43*)ELEM ==> Stat44: v = z
	(Stat44,Stat13*)Discharge ==> p = {[v,z],[z,u]}
	TELEM ==> (range({[v,z],[z,u]}) = {z,u}) & (domain({[v,z],[z,u]}) = {v,z})
	EQUAL(Stat40) ==> Stat45: {z,u} = {v,z}
	(Stat45*)ELEM ==> Stat46: u = v
(Stat46,Stat16*)Discharge ==> QED
--
-- The following proof states that removal of an arc from a simple cycle yields
-- a straight path of known endpoints.
--
Theorem 914: (Scycle(C) & (X in domain(C))) ¥imp Straight(C - {[X,C~[X]]}, C~[X], X). Proof:
Suppose_not(k,x0) ==> AUTO
--
-- Reasoning by contradiction, suppose that $k$ is a simple cycle passing
-- through $x0$, namely a minimal permutation with $x0$ in its domain, and assume
-- that $k - {[x0,k~[x0]]}$ is not a simple path connecting $k~[x0]$ to $x0$.
--
	Use_def(Scycle) ==> Stat1: k in {p ¥incin k | (p /= 0) & Is_perm(p)}
	()-->Stat1(Stat1*) ==> Is_perm(k)
	Use_def(Is_perm) ==> Svm(k)
	Use_def(Svm) ==> Is_map(k)
	(k,x0)-->T77 ==> ((k - {[x0,k~[x0]]}) + {[x0,k~[x0]]}) = k
	Use_def(Straight) ==> not(Scycle((k - {[x0,k~[x0]]}) + {[x0,k~[x0]]}))
EQUAL ==> false; Discharge ==> QED
--
--
--
Theorem 915: (Straight(P,X,Y) & (P /= 0)) ¥imp ((X in (domain(P) - range(P))) & (Y in (range(P) - domain(P)))). Proof:
Suppose_not(q,x0,y0) ==> AUTO
--
-- Assuming that $q,x0,y0$ are a counterexample, we are led to a
-- contradiction arguing as follows. From the definitions
-- of the predicates $Straight$ and $Scycle$, it follows that
-- $q + {[y0,x0]}$ is a permutation, and hence has domain coinciding
-- with its range, whereas ${[y0,x0]}$ fails to be a permutation,
-- so that $x0$ and $y0$ must differ.
--
	Use_def(Straight) ==> Stat1: Scycle(q + {[y0,x0]}) & ([y0,x0] notin q)
	Use_def(Scycle)(Stat1*) ==> Stat2: ((q + {[y0,x0]}) in {p ¥incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)}) & Stat3: ({[y0,x0]} notin {p ¥incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)})
	()-->Stat2(Stat2*) ==> Stat4: Is_perm(q + {[y0,x0]})
	Use_def(Is_perm)(Stat4*) ==> Stat5: domain(q + {[y0,x0]}) = range(q + {[y0,x0]})
	TELEM ==> Stat6: (range({[y0,x0]}) = {x0}) & (domain({[y0,x0]}) = {y0})
	({[y0,x0]})-->Stat3(Stat2,Stat2*) ==> Stat7: (not Is_perm({[y0,x0]}))
	Suppose ==> x0 = y0
		(y0,x0)-->T91(Stat7*) ==> Svm({[y0,x0]})
		([y0,x0])-->T201(Stat7*) ==> Finite({[y0,x0]})
	Use_def(Is_perm)(Stat6*) ==> false; Discharge ==> Stat8: x0 /= y0
--
-- Since the $domain$ and $range$ operators are additive, we can decompose
-- $domain(q + {[y0,x0]})$ in the manner shown below:
--
	(q,{[y0,x0]})-->T78(Stat6,Stat6*) ==> Stat9: domain(q + {[y0,x0]}) = (domain(q) + {y0})
	(q,{[y0,x0]})-->T79(Stat6,Stat6*) ==> Stat10: range(q + {[y0,x0]}) = (range(q) + {x0})
--
-- It follows, if we assume that $x0 notin (domain(q) - range(q))$, that
-- $x0$ belongs to $range(q)$,...
--
	Suppose ==> Stat11: x0 notin (domain(q) - range(q))
		(Stat11,Stat5,Stat8,Stat9,Stat10*)ELEM ==> Stat12: x0 in range(q)
		Use_def(range)(Stat12,Stat12*) ==> Stat13: x0 in {cdr(x): x in q}
--
-- a fact which would conflict with the one-one-ness of $q + {[y0,x0]}$
-- (which, recall, is a permutation).
--
		(q + {[y0,x0]})-->T905(Stat4,Stat4*) ==> Stat14: one_1_map(q + {[y0,x0]})
		Use_def(one_1_map)(Stat14*) ==> Stat15: (FORALL x in (q + {[y0,x0]}), y in (q + {[y0,x0]}) | (cdr(x) = cdr(y)) ¥imp (x = y)) & (x0 = cdr([y0,x0]))
		w-->Stat13(Stat1,Stat1*) ==> (x0 = cdr(w)) & (w in q) & ([y0,x0] notin q)
	(w,[y0,x0])-->Stat15(Stat15*) ==> false; Discharge ==> Stat16: y0 notin (range(q) - domain(q))
--
-- Likewise, if we assume that $y0 notin (range(q) - domain(q))$, then
-- $y0$ must belong to $domain(q)$,...
--
	(Stat16,Stat5,Stat8,Stat9,Stat10*)ELEM ==> Stat17: y0 in domain(q)
	Use_def(domain)(Stat12,Stat12*) ==> Stat18: y0 in {car(x): x in q}
--
-- a fact which conflicting with the one-one-ness of $q + {[y0,x0]}$
-- (which, recall, is a permutation). Having reached
-- a contradiction in either case, we get the desired conclusion.
--
	Use_def(Is_perm)(Stat4,Stat4*) ==> Stat19: Svm(q + {[y0,x0]})
	Use_def(Svm)(Stat19*) ==> Stat20: (FORALL x in (q + {[y0,x0]}), y in (q + {[y0,x0]}) | (car(x) = car(y)) ¥imp (x = y)) & (y0 = car([y0,x0]))
	u-->Stat18(Stat1,Stat1*) ==> (y0 = car(u)) & (u in q) & ([y0,x0] notin q)
(u,[y0,x0])-->Stat20(Stat20*) ==> false; Discharge ==> QED
--
-- The following corollary of Theorem 915 sharpens it considerably.
--
Theorem 916: (Straight(P,X,Y) & (P /= 0)) ¥imp (({Y} = (range(P) - domain(P))) & ({X} = (domain(P) - range(P)))). Proof:
Suppose_not(q,x0,y0) ==> AUTO
	(q,x0,y0)-->T915 ==> Stat1: (y0 in (range(q) - domain(q))) & (x0 in (domain(q) - range(q)))
	Use_def(Straight) ==> Stat2: Scycle(q + {[y0,x0]}) & ([y0,x0] notin q)
	Use_def(Scycle) ==> Stat3: (q + {[y0,x0]}) in {p ¥incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)}
	()-->Stat3(Stat3*) ==> Stat4: Is_perm(q + {[y0,x0]})
	Use_def(Is_perm)(Stat3*) ==> Stat5: (range(q + {[y0,x0]}) = domain(q + {[y0,x0]}))
	(q + {[y0,x0]})-->T905(Stat4*) ==> Stat6: one_1_map(q + {[y0,x0]}) & (({[y0,x0]} + q) = (q + {[y0,x0]}))
	EQUAL(Stat6) ==> Stat7: one_1_map({[y0,x0]} + q)
	({[y0,x0]},q)-->T89(Stat7,Stat2*) ==> Stat8: (domain(q) = (domain({[y0,x0]} + q) - domain({[y0,x0]}))) & (range(q) = (range({[y0,x0]} + q) - range({[y0,x0]})))
	(y0,x0,y0,x0)-->T114(Stat9*) ==> Stat9: (domain({[y0,x0]}) = {y0}) & (range({[y0,x0]}) = {x0})
	EQUAL(Stat8,Stat9,Stat6) ==> Stat10: (domain(q) = (domain(q + {[y0,x0]}) - {y0})) & (range(q) = (range(q + {[y0,x0]}) - {x0}))
Discharge ==> QED
--
Theorem 917: Ord(N) ¥imp (segm(N,P,S) ¥incin segm(next(N),P,S)). Proof:
Suppose_not(n,p,s) ==> AUTO
	Use_def(segm(n,p,s)) ==> AUTO
	Use_def(segm(next(n),p,s)) ==> AUTO
	Use_def(next(n)) ==> AUTO
	EQUAL ==> segm(next(n),p,s) = (s + {[x,p~[x]]: i in (n + {n}), x in (range(segm(i,p,s)) * domain(p))})
	Set_monot ==> {[x,p~[x]]: i in n, x in (range(segm(i,p,s)) * domain(p))} ¥incin {[x,p~[x]]: i in (n + {n}), x in (range(segm(i,p,s)) * domain(p))}
Discharge ==> QED
--
Theorem 918: (Is_perm(C) & (S ¥incin C) & Ord(Y)) ¥imp (segm(Y,C,S) ¥incin C). Proof:
Suppose_not(c,s,y0) ==> AUTO
--
-- Assuming that $c,s,y0$ is a counterexample, we reach a
-- contradiction arguing as follows. We consider the first
-- ordinal $y1$, less than or equal to $y0$ which, like $y0$,
-- forms a  counterexample $c,s,y1$.
--
	ELEM ==> Stat1: s ¥incin c
	Suppose ==> Stat2: {y in next(y0) | not(segm(y,c,s) ¥incin c)} = 0
		Use_def(next) ==> y0 in next(y0)
	y0-->Stat2 ==> false; Discharge ==> Stat3: {y in next(y0) | not(segm(y,c,s) ¥incin c)} /= 0
	Loc_def ==> y1 = arb({y in next(y0) | not(segm(y,c,s) ¥incin c)})
	({y in next(y0) | not(segm(y,c,s) ¥incin c)})-->T0(Stat3*) ==> Stat4: (y1 in {y in next(y0) | not(segm(y,c,s) ¥incin c)}) & ((y1 * {y in next(y0) | not(segm(y,c,s) ¥incin c)}) = 0)
 	()-->Stat4(Stat4*) ==> (y1 in next(y0)) & Stat5: (not(segm(y1,c,s) ¥incin c))
--
-- It is plain that $segm(i,c,s) ¥incin c$ holds for all elements $i$ of $y1$.
-- Consequently $range(segm(i,c,s)) ¥incin range(c)$, for all $i in y1$,
-- where $range(c) = domain(c)$ holds by hypothesis.
--
	Suppose ==> Stat6: not(FORALL i in y1 | segm(i,c,s) ¥incin c)
		i0-->Stat6(Stat6*) ==> (i0 in y1) & (not(segm(i0,c,s) ¥incin c))
		y0-->T32(*) ==> Ord(next(y0))
		(next(y0),y1)-->T13(Stat4*) ==> i0 in next(y0)
		(Stat4*)ELEM ==> Stat7: i0 notin {y in next(y0) | not(segm(y,c,s) ¥incin c)}
	i0-->Stat7(Stat6*) ==> false; Discharge ==> Stat8: (FORALL i in y1 | segm(i,c,s) ¥incin c)
--
-- But then, if we designate by $a$ an element of $y1$ which does not belong to $c$,
-- such an $a$ should be of the form $[x1,c~[x1]]$ for some
-- $x1 in range(segm(i1,c,s))$, with $i1 in y1$. It follows from the above remarks
-- that $x1 in domain(c)$.

	a-->Stat5(Stat4,Stat4*) ==> Stat9: (a in segm(y1,c,s)) & (a notin c)
	Use_def(segm)(Stat10*) ==> Stat10: segm(y1,c,s) = (s + {[x,c~[x]]: i in y1, x in (range(segm(i,c,s)) * domain(c))})
	(Stat1,Stat9,Stat10*)ELEM ==> Stat11: a in {[x,c~[x]]: i in y1, x in (range(segm(i,c,s)) * domain(c))}
	(i1,x1)-->Stat11(Stat11*) ==> Stat12: (a = [x1,c~[x1]]) & (i1 in y1) & (x1 in range(segm(i1,c,s)))
	i1-->Stat8(Stat12*) ==> segm(i1,c,s) ¥incin c
	Use_def(Is_perm)(*) ==> Stat13: Svm(c) & (range(c) = domain(c))
	(segm(i1,c,s),c)-->T65(Stat12*) ==> x1 in domain(c)
--
-- This leads to the conclusion that $[x1,c~[x1]]$ belongs to $c$,
-- from which the desired contradiction follows immediately.
--
	Use_def(Svm)(Stat13*) ==> Is_map(c)
(c,x1)-->T77(Stat9*) ==> false; Discharge ==> QED
--
--Theorem OM: (Scycle(C) & (E in C)) ¥imp (EXISTS m in Za | Scycle(segm(m,C,{E})))
--Suppose_not(q,e) ==> AUTO
-- --
-- -- Reasoning by contradiction, suppose that $q,e$ is a counterexample.
-- --
--	ELEM ==> Stat1: not(EXISTS m in Za | Scycle(segm(m,q,{e})))
--	q-->T902(*) ==> Is_perm(q)
-- --
-- -- Now consider $segm(N,q,{e})$ with increasing integer values of $N$.
-- -- Since $c$ is a permutation, and hence a map, all of these segments
-- -- are included in $c$, as readily yielded by Theorem T10072.
-- -- Their size cannot increase forever, because they are confined in $q$,
-- -- which is finite. We can hence pick the first value $m$
-- -- for which $segm(next(m),q,{e}) = segm(m,q,{e})$.
-- --
--	Suppose ==> Stat2: not(FORALL i in Za | segm(i,q,{e}) ¥incin (segm(next(i),q,{e}) * q))
--		n0-->Stat2(Stat2*) ==> (n0 in Za) & (not segm(n0,q,{e}) ¥incin (segm(next(n0),q,{e}) * q))
--		n0-->T207(Stat2*) ==> Ord(n0)
--		(n0,q,{e})-->T917(Stat2*) ==> segm(n0,q,{e}) ¥incin segm(next(n0),q,{e})
--	(q,{e},n0)-->T918(*) ==> false; Discharge ==> Stat3: (FORALL i in Za | segm(i,q,{e}) ¥incin (segm(next(i),q,{e}) * q))
-- 	Use_def(Is_perm)(*) ==> Finite(q) & Svm(q)
--	APPLY(m5_thryvar:m) confinedIncrSeq(e(x)->segm(x,q,{e}),s0->q) ==>
--		Stat4: (FORALL i, j | ((i in j) & (j in Za)) ¥imp (segm(i,q,{e}) ¥incin segm(j,q,{e}))) &
--		(m in Za) & (segm(next(m),q,{e}) = segm(m,q,{e})) & ((m * {i in Za | segm(next(i),q,{e}) ¥incin segm(i,q,{e})}) = 0)
-- --
-- -- Since $segm(m,q,{e})$ is included in $q$, which is a finite map,
-- -- this segment is a finite map in its turn.
-- --
--	m-->T207(Stat4*) ==> Ord(m)
--	(q,{e},m)-->T918(*) ==> segm(m,q,{e}) ¥incin q
--	(segm(m,q,{e}),q)-->T53(Stat3*) ==> Svm(segm(m,q,{e}))
--	(q,segm(m,q,{e}))-->T189(Stat3*) ==> Finite(segm(m,q,{e}))
-- --
-- -- Moreover, $domain(segm(m,q,{e}))$ and $range(segm(m,q,{e}))$ cannot differ.
-- -- Therefore, $segm(m,q,{e})$ is a permutation.
-- --
--	Suppose ==> Stat5: (not Is_perm(segm(m,q,{e})))
--		(segm(m,q,{e}))-->T901(Stat4*) ==> Stat6: not(range(segm(m,q,{e})) incs domain(segm(m,q,{e})))
--		a-->Stat6(Stat6*) ==> (a in domain(segm(m,q,{e}))) & (a notin range(segm(m,q,{e})))
--		Use_def(segm(next(m),q,{e})) ==> AUTO
--	Tsomehow ==> false; Discharge ==> Is_perm(segm(m,q,{e}))
-- --
-- -- By applying the initial hypothesis, we hence get that $domain(segm(m,q,{e}))$
-- -- and $range(segm(m,q,{e}))$ must differ.
-- --
--	m-->Stat1(Stat4,Stat4*) ==> Stat7: (not Scycle(segm(m,q,{e})))
--	Use_def(segm(m,q,{e})) ==> AUTO
--	(Stat7*)ELEM ==> segm(m,q,{e}) /= 0
--	Use_def(Scycle)(Stat7*) ==> {p ¥incin segm(m,q,{e}) | (p /= 0) & Is_perm(p)} /= {segm(m,q,{e})}
-- --
--Tsomehow ==> false; Discharge ==>
--
--
--
Theorem 919: (Straight(Q,X,Y) & (Q /= 0)) ¥imp ([X,Q~[X]] in prefix(Q,Q~[X])). Proof:
Suppose_not(q,x0,y0) ==> AUTO
--
-- Assuming that $q,x0,y0$ are a counterexample to the statement
-- of this theorem, we easily get to the conclusion that either
-- $(q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})$
-- or $(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}$ fails to be a permutation.
--
	(q,x0,y0)-->T916(*) ==> Stat1: ({y0} = (range(q) - domain(q))) & (x0 in domain(q)) & (x0 notin range(q))
	(range(q) - domain(q))-->T0(Stat1*) ==> Stat2: arb(range(q) - domain(q)) = y0
	Use_def(prefix)(*) ==> ([x0,q~[x0]] notin {w: w in q, p ¥incin ((q - {w}) + {[arb(range(q) - domain(q)),cdr(w)]}) | Is_perm(p) & ((q~[x0]) in domain(p))}) & Straight(q,x0,y0) & (q /= 0)
	EQUAL(Stat2) ==> Stat3: ([x0,q~[x0]] notin {w: w in q, p ¥incin ((q - {w}) + {[y0,cdr(w)]}) | Is_perm(p) & ((q~[x0]) in domain(p))}) & Straight(q,x0,y0) & (q /= 0)
	([x0,q~[x0]],(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})-->Stat3(Stat3*) ==> Stat4: ([x0,q~[x0]] notin q) or (not(((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) ¥incin ((q - {[x0,q~[x0]]}) + {[y0,cdr([x0,q~[x0]])]}))) or (not Is_perm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or ((q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
	TELEM ==> cdr([x0,q~[x0]]) = (q~[x0])
	EQUAL(Stat4) ==> Stat5: ([x0,q~[x0]] notin q) or (not(((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) ¥incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))) or (not Is_perm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or ((q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
	(Stat3,Stat5*)ELEM ==> Stat6: Straight(q,x0,y0) & (q /= 0) & (([x0,q~[x0]] notin q) or (not Is_perm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or ((q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})))
	Use_def(Straight)(Stat6*) ==> Stat7: Scycle(q + {[y0,x0]}) & ([y0,x0] notin q)
	(q + {[y0,x0]},x0,y0)-->T902(Stat7*) ==> Stat8: Is_perm(q + {[y0,x0]}) & Svm(q + {[y0,x0]}) & Finite(q + {[y0,x0]})
	(q,q + {[y0,x0]})-->T53(Stat8*) ==> Svm(q)
	Use_def(Svm)(Stat7*) ==> Stat9: Is_map(q)
	(x0,q)-->T71(Stat1*) ==> Stat10: (q~[x0]) in range(q)
	(q,x0)-->T77(Stat9,Stat1,Stat6*) ==> Stat11: ({[x0,q~[x0]]} ¥incin q) & (q = ((q - {[x0,q~[x0]]}) + {[x0,q~[x0]]})) & ((not Is_perm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or ((q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})))
--
-- Suppose first that $(q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})$.
-- Then, since $x0 in domain(q0)$, we have $q~[x0] in range(q0)$
-- and $(q~[x0]) notin domain(q)$ and $(q~[x0]) /= y0$, which
-- conflicts with Theorem 916. We must hence discharge this
-- possibility.
--
	Suppose ==> Stat12: (q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})
		(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T78(Stat12*) ==> ((q~[x0]) notin domain(q - {[x0,q~[x0]]})) & ((q~[x0]) notin domain({[y0,q~[x0]]}))
		EQUAL(Stat11) ==> domain(q) = domain((q - {[x0,q~[x0]]}) + {[x0,q~[x0]]})
		(q - {[x0,q~[x0]]},{[x0,q~[x0]]})-->T78(Stat12*) ==> domain(q) = domain(q - {[x0,q~[x0]]}) + domain({[x0,q~[x0]]})
		(x0,q~[x0],x0,q~[x0])-->T114(Stat12*) ==> domain(q) = (domain(q - {[x0,q~[x0]]}) + {x0})
		Suppose ==> (q~[x0]) in domain(q)
			(Stat12*)ELEM ==> (q~[x0]) = x0
			EQUAL(Stat11) ==> Stat13: {[x0,x0]} ¥incin q
			(x0,x0)-->T908(Stat13) ==> Stat14: ({[x0,x0]} /= 0) & Is_perm({[x0,x0]})
		(q,x0,y0,{[x0,x0]})-->T912(Stat6,Stat14,Stat13*) ==> false; Discharge ==> (q~[x0]) notin domain(q)
		(y0,q~[x0],y0,q~[x0])-->T114(Stat12*) ==> (q~[x0]) /= y0
	(Stat1*)Discharge ==> Stat15: (not Is_perm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
--
-- We now must analyze the three cases into which
-- the assumption that $(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}$
-- is not a permutation breaks down.
-- We easily discharge the cases that this case be infinite
-- or be not a single-valued map.
--
	Use_def(Is_perm)(Stat15*) ==> (not Svm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or (not Finite((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or (range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) /= domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
	Suppose ==> Stat16: (not Finite((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
		(q + {[y0,x0]},q - {[x0,q~[x0]]})-->T189(Stat8,Stat8*) ==> Finite(q - {[x0,q~[x0]]})
	(q - {[x0,q~[x0]]},[y0,q~[x0]])-->T199(Stat16*) ==> false; Discharge ==> Finite((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})
	Suppose ==> Stat17: (not Svm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
		(q - {[x0,q~[x0]]},q + {[y0,x0]})-->T53(Stat8,Stat8*) ==> Stat18: Svm(q - {[x0,q~[x0]]})
		(q - {[x0,q~[x0]]},q)-->T65(Stat18,Stat1*) ==> y0 notin domain(q - {[x0,q~[x0]]})
		(y0,q~[x0])-->T91(Stat19*) ==> Stat19: Svm({[y0,q~[x0]]})
		(y0,q~[x0],y0,q~[x0])-->T114(Stat19*) ==> domain({[y0,q~[x0]]}) = {y0}
	(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T87(Stat17*) ==> false; Discharge ==> Stat20: range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) /= domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})
--
--
--
	Suppose ==> Stat21: ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) in {p ¥incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)}
	()-->Stat21(Stat15,Stat15*) ==> false; Discharge ==> ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) notin {p ¥incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)}
--
	(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T78(Stat20*) ==> range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) /= (domain(q - {[x0,q~[x0]]}) + domain({[y0,q~[x0]]}))
	(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T79(Stat20*) ==> Stat22: (range(q - {[x0,q~[x0]]}) + range({[y0,q~[x0]]})) /= (domain(q - {[x0,q~[x0]]}) + domain({[y0,q~[x0]]}))
	(y0,q~[x0],y0,q~[x0])-->T114(Stat22*) ==> Stat23: (range(q - {[x0,q~[x0]]}) + {q~[x0]}) /= (domain(q - {[x0,q~[x0]]}) + {y0})
	(q + {[y0,x0]})-->T905(Stat8,Stat8*) ==> Stat24: one_1_map(q + {[y0,x0]})
	Suppose ==> (range(q - {[x0,q~[x0]]}) /= (range(q + {[y0,x0]}) - range({[y0,x0],[x0,q~[x0]]}))) or (domain(q - {[x0,q~[x0]]}) /= (domain(q + {[y0,x0]}) - domain({[y0,x0],[x0,q~[x0]]})))
		(Stat7,Stat11*)ELEM ==> Stat25: ((q + {[y0,x0]}) = ({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))) &
			(((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}) = (q - {[x0,q~[x0]]}))
		EQUAL(Stat25,Stat25) ==> range((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}) = range(q - {[x0,q~[x0]]})
		EQUAL(Stat25,Stat25) ==> domain((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}) = domain(q - {[x0,q~[x0]]})
		EQUAL(Stat25,Stat25) ==> domain(q + {[y0,x0]}) = domain({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))
		EQUAL(Stat25,Stat25) ==> range(q + {[y0,x0]}) = range({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))
		EQUAL(Stat24) ==> one_1_map({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))
	({[y0,x0],[x0,q~[x0]]},(q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]})-->T89(Stat24*) ==> false; Discharge ==> Stat26: not((range(q - {[x0,q~[x0]]}) /= (range(q + {[y0,x0]}) - range({[y0,x0],[x0,q~[x0]]}))) or (domain(q - {[x0,q~[x0]]}) /= (domain(q + {[y0,x0]}) - domain({[y0,x0],[x0,q~[x0]]}))))
	Use_def(Is_perm)(Stat8,Stat8*) ==> Stat27: range(q + {[y0,x0]}) = domain(q + {[y0,x0]})
	(y0,x0,x0,(q~[x0]))-->T114(Stat26*) ==> (range(q - {[x0,q~[x0]]}) = (domain(q + {[y0,x0]}) - {x0,q~[x0]})) & (domain(q - {[x0,q~[x0]]}) = (domain(q + {[y0,x0]}) - {y0,x0}))
	(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T78(Stat26*) ==> domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) = (domain(q - {[x0,q~[x0]]}) + domain({[y0,q~[x0]]}))
	(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T79(Stat26*) ==> range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) = (range(q - {[x0,q~[x0]]}) + range({[y0,q~[x0]]}))
	(y0,q~[x0],y0,q~[x0])-->T114(Stat20*) ==> Stat28: ((domain(q + {[y0,x0]}) - {y0,x0}) + {y0}) /= ((domain(q + {[y0,x0]}) - {x0,q~[x0]}) + {q~[x0]})
	(q,q+{[y0,x0]})-->T65(Stat27,Stat10,Stat1*) ==> Stat29: ((q~[x0]) in domain(q + {[y0,x0]})) & (y0 in domain(q + {[y0,x0]}))
(Stat1,Stat10,Stat28,Stat29*)ELEM ==> false; Discharge ==> QED
--
--
--
Theorem 920: (Straight(Q,X,Y) & (Q /= 0)) ¥imp (EXISTS p ¥incin (Q - {[X,Q~[X]]}) | Straight(p, Q~[X], Y)). Proof:
Suppose_not(q,x0,y0) ==> AUTO
	ELEM ==> Stat1: not(EXISTS p ¥incin (q - {[x0,q~[x0]]}) | Straight(p, q~[x0], y0))
	(q,x0,y0)-->T919(*) ==> [x0,q~[x0]] in prefix(q,q~[x0])
	Use_def(prefix)(Stat1*) ==> [x0,q~[x0]] in {w: w in q, p ¥incin ((q - {w}) + {[arb(range(q) - domain(q)),cdr(w)]}) | Is_perm(p) & ((q~[x0]) in domain(p))}
	(q,x0,y0)-->T916(*) ==> {y0} = (range(q) - domain(q))
	(range(q) - domain(q))-->T0(Stat1*) ==> arb(range(q) - domain(q)) = y0
	EQUAL(Stat1) ==> Stat2: [x0,q~[x0]] in {w: w in q, p ¥incin ((q - {w}) + {[y0,cdr(w)]}) | Is_perm(p) & ((q~[x0]) in domain(p))}
	(w,p)-->Stat2(Stat2*) ==> ([x0,q~[x0]] = w) & (p ¥incin ((q - {w}) + {[y0,cdr(w)]})) & Is_perm(p) & ((q~[x0]) in domain(p))
	TELEM ==> cdr([x0,q~[x0]]) = (q~[x0])
	EQUAL(Stat2) ==> Stat3: p ¥incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})
	Suppose ==> p = 0
		EQUAL(Stat2) ==> (q~[x0]) in domain(0)
	T59(Stat3*) ==> false; Discharge ==> p /= 0
	p-->T903(Stat2*) ==> Stat4: (EXISTS c ¥incin p | Scycle(c))
	c-->Stat4(Stat3*) ==> (c ¥incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) & Scycle(c)
	c-->T902(Stat4*) ==> (c /= 0) & Is_perm(c)
	(q,x0,y0,c)-->T912(*) ==> c = ((c - {[y0,q~[x0]]}) + {[y0,q~[x0]]})
	EQUAL(Stat4) ==> Stat5: Scycle((c - {[y0,q~[x0]]}) + {[y0,q~[x0]]})
	Use_def(Straight)(Stat5*) ==> Straight(c - {[y0,q~[x0]]},q~[x0],y0)
(c - {[y0,q~[x0]]})-->Stat1(Stat4*) ==> false; Discharge ==> QED
--
--Suppose_not(q,x0,y0) ==> AUTO
--	ELEM ==> Stat0: not(EXISTS p ¥incin (q - {[x0,q~[x0]]}) | Straight(p, q~[x0], y0))
--	(q - {[x0,q~[x0]]})-->Stat0(Stat0*) ==> (not Straight(q - {[x0,q~[x0]]}, q~[x0], y0))
-- --
-- -- Reasoning by contradiction, suppose that $q$ is a simple path connecting
-- -- $x0$ to $y0$, namely a finite single-valued map devoid of cycles whose
-- -- domain and range differ by ${x0}$ and ${y0}$ respectively, and assume that
-- -- $p - {[x0,p~[x0]]}$ is not a path connecting $p~[x0]$ to $y0$.
-- --
--	Use_def(Straight) ==> Stat1: Scycle(q + {[y0,x0]}) & ([y0,x0] notin q) & (not(Scycle((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) & ([y0,q~[x0]] notin (q - {[x0,q~[x0]]}))))
--	(q + {[y0,x0]},x0,y0)-->T902 ==> Stat0a: Is_perm(q + {[y0,x0]}) & Svm(q + {[y0,x0]})
--	Use_def(Is_perm)(Stat1*) ==> Stat1a: range(q + {[y0,x0]}) = domain(q + {[y0,x0]})
--	Use_def(Scycle) ==> ({p ¥incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)} = {q + {[y0,x0]}}) & (({p ¥incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)} /= {(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}}) or ([y0,q~[x0]] in (q - {[x0,q~[x0]]})))
--	(q,x0,y0)-->T915(*) ==> Stat6: (y0 in range(q)) & (y0 notin domain(q)) & (x0 /= y0) & (x0 in (domain(q) - range(q)))
--	(q,q + {[y0,x0]})-->T53(Stat1*) ==> Svm(q)
--	Use_def(Svm)(Stat6*) ==> Is_map(q)
--	(q,x0)-->T77(Stat6*) ==> Stat2: [x0,q~[x0]] in q
--	Suppose ==> (q~[x0]) notin range(q)
--		q-->T73(Stat6*) ==> Stat2a: (q~[x0]) notin {q~[x]: x in domain(q)}
--	x0-->Stat2a(Stat6*) ==> false; Discharge ==> Stat3a: (q~[x0]) in range(q)
-- --
-- -- After having drawn from the hypothesis $Straight(q,x0,y0) & (q /= 0)$
-- -- that $q$ is a permutation, a cycle, and a single-valued map,
-- -- whose range comprises $q~[x0]$ as a member, we infer from
-- -- $not Straight(q - {[x0,q~[x0]]}, q~[x0], y0)$ and from
-- -- the observation that $[y0,q~[x0]] notin (q - {[x0,q~[x0]]})$...
-- --
--	Suppose ==> [y0,q~[x0]] in (q - {[x0,q~[x0]]})
--		Use_def(Svm) ==> Stat3: (FORALL x in q + {[y0,x0]}, y in q + {[y0,x0]} | (car(x) = car(y)) ¥imp (x = y))
--		TELEM ==> car([y0,q~[x0]]) = car([y0,x0])
--		([y0,q~[x0]],[y0,x0])-->Stat3(Stat2*) ==> Stat4: [y0,q~[x0]] = [y0,x0]
--		(Stat4)ELEM ==> (q~[x0]) = x0
--		(Stat6,Stat6)ELEM ==> (q + {[y0,x0]}) /= {[x0,x0]}
--		(Stat1a*)ELEM ==> Stat7: {[x0,x0]} notin {p ¥incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)}
--		(x0,y0)-->T908(Stat5*) ==> Stat5: Is_perm({[x0,x0]})
--		EQUAL(Stat2) ==> [x0,x0] in q
--	({[x0,x0]})-->Stat7(Stat5*) ==> false; Discharge ==> ([y0,q~[x0]] notin (q - {[x0,q~[x0]]})) & ({p ¥incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)} /= {(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}})
--
-- -- ...the fact that
-- -- $(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}$ has a strict
-- -- non-void subset $p$ which is a permutation.
-- --
--	Suppose ==> Stat8: ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) notin {p ¥incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)}
--		((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})-->Stat8(Stat8*) ==> (not Is_perm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
--		Use_def(Is_perm)(Stat8*) ==> Stat9: (not Svm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or (not Finite((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or (range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) /= domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
--		(q - {[x0,q~[x0]]},q + {[y0,x0]})-->T53(Stat1*) ==> Svm(q - {[x0,q~[x0]]})
--		(q - {[x0,q~[x0]]},q)-->T65(Stat6,Stat6*) ==> y0 notin domain(q - {[x0,q~[x0]]})
--		(y0,q~[x0])-->T91(Stat10) ==> Stat10: Svm({[y0,q~[x0]]})
--		(y0,q~[x0],y0,q~[x0])-->T114(Stat10) ==> domain({[y0,q~[x0]]}) = {y0}
--		(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T87(Stat9*) ==> Svm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})
--		Use_def(Is_perm)(Stat0a,Stat0a*) ==> Finite(q + {[y0,x0]})
--		(q + {[y0,x0]},q - {[x0,q~[x0]]})-->T189(Stat10*) ==> Finite(q - {[x0,q~[x0]]})
--		(q - {[x0,q~[x0]]},[y0,q~[x0]])-->T199(Stat9*) ==> Stat11: range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) /= domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})
--		(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T78(Stat11*) ==> range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) /= (domain(q - {[x0,q~[x0]]}) + domain({[y0,q~[x0]]}))
--		(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T79(Stat11*) ==> Stat12: (range(q - {[x0,q~[x0]]}) + range({[y0,q~[x0]]})) /= (domain(q - {[x0,q~[x0]]}) + domain({[y0,q~[x0]]}))
--		(y0,q~[x0],y0,q~[x0])-->T114(Stat12*) ==> Stat11a: (range(q - {[x0,q~[x0]]}) + {q~[x0]}) /= (domain(q - {[x0,q~[x0]]}) + {y0})
--		(q + {[y0,x0]})-->T905(Stat1*) ==> Stat12a: one_1_map(q + {[y0,x0]})
--		Suppose ==> (range(q - {[x0,q~[x0]]}) /= (range(q + {[y0,x0]}) - range({[y0,x0],[x0,q~[x0]]}))) or (domain(q - {[x0,q~[x0]]}) /= (domain(q + {[y0,x0]}) - domain({[y0,x0],[x0,q~[x0]]})))
--			(Stat1,Stat2*)ELEM ==> Stat13a: ((q + {[y0,x0]}) = ({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))) &
--				(((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}) = (q - {[x0,q~[x0]]}))
--			EQUAL(Stat13a,Stat13a) ==> range((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}) = range(q - {[x0,q~[x0]]})
--			EQUAL(Stat13a,Stat13a) ==> domain((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}) = domain(q - {[x0,q~[x0]]})
--			EQUAL(Stat13a,Stat13a) ==> domain(q + {[y0,x0]}) = domain({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))
--			EQUAL(Stat13a,Stat13a) ==> range(q + {[y0,x0]}) = range({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))
--			EQUAL(Stat12a) ==> one_1_map({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))
--		({[y0,x0],[x0,q~[x0]]},(q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]})-->T89(Stat12a*) ==> false; Discharge ==> Stat13: not((range(q - {[x0,q~[x0]]}) /= (range(q + {[y0,x0]}) - range({[y0,x0],[x0,q~[x0]]}))) or (domain(q - {[x0,q~[x0]]}) /= (domain(q + {[y0,x0]}) - domain({[y0,x0],[x0,q~[x0]]}))))
--		(y0,x0,x0,(q~[x0]))-->T114(Stat13,Stat1a*) ==> (range(q - {[x0,q~[x0]]}) = (domain(q + {[y0,x0]}) - {x0,q~[x0]})) & (domain(q - {[x0,q~[x0]]}) = (domain(q + {[y0,x0]}) - {y0,x0}))
--		(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T78(Stat13*) ==> domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) = (domain(q - {[x0,q~[x0]]}) + domain({[y0,q~[x0]]}))
--		(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T79(Stat13*) ==> range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) = (range(q - {[x0,q~[x0]]}) + range({[y0,q~[x0]]}))
--		(y0,q~[x0],y0,q~[x0])-->T114(Stat11*) ==> Stat15: ((domain(q + {[y0,x0]}) - {y0,x0}) + {y0}) /= ((domain(q + {[y0,x0]}) - {x0,q~[x0]}) + {q~[x0]})
--		(q,q+{[y0,x0]})-->T65(Stat1a,Stat3a,Stat6*) ==> Stat14: ((q~[x0]) in domain(q + {[y0,x0]})) & (y0 in domain(q + {[y0,x0]}))
--	(Stat6,Stat3a,Stat15,Stat14*)ELEM ==> false; Discharge ==> Stat20: not({p ¥incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)} ¥incin {(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}})
--	p-->Stat20(Stat20*) ==> Stat21: (p in {p ¥incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)}) & (p /= ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
--	()-->Stat21(Stat21*) ==> Stat21a: (p ¥incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) & (p /= 0) & Is_perm(p)
-- --
-- -- It follows from the definition of permutation that
-- -- such a set $p$ includes a simple cycle $c$, which
-- -- obviously is a non-void permutation.
-- --
--	p-->T903(Stat21a*) ==> Stat20a: (EXISTS c ¥incin p | Scycle(c))
--	c-->Stat20a(Stat21a*) ==> Stat22: (c ¥incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) & Scycle(c)
--	c-->T902(Stat22*) ==> (c /= 0) & Is_perm(c)
-- --
-- -- Notice that $c$ must have $[y0,q~[x0]]$ as a member; since otherwise
-- -- $c$ would be a permutation contained in the straight path $q$, which is
-- -- impossible.
-- --
--	Suppose ==> [y0,q~[x0]] notin c
--		(Stat22*)ELEM ==> c ¥incin (q - {[x0,q~[x0]]})
--		Use_def(Straight)(*) ==> Scycle(q + {[y0,x0]})
--		Use_def(Scycle)(Stat2*) ==> Stat22a: c notin {p ¥incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)}
--	c-->Stat22a(Stat22*) ==> false; Discharge ==> [y0,q~[x0]] in c
--	({[y0,q~[x0]]},c)-->T65(Stat22*) ==> domain({[y0,q~[x0]]}) ¥incin domain(c)
--	(y0,q~[x0],0,0)-->T114(Stat22*) ==> y0 in domain(c)
-- --
-- -- Thus it turns out that $c-{[y0,q~[x0]]}$ is a simple path
-- -- leading from $q~[x0]$ to $y0$ within $q - {[x0,q~[x0]]}$,
-- -- contrary to one of our initial assumptions. This
-- -- contradiction proves the desired statement.
-- --
--	(c,y0)-->T914(Stat22*) ==> Stat23: Straight(c - {[y0,c~[y0]]}, c~[y0], y0)
--	Suppose ==> (q~[x0]) /= (c~[y0])
--		c-->T902(Stat21a*) ==> Svm(c)
--		(c,[y0,q~[x0]])-->T74(Stat22*) ==> (c~[car([y0,q~[x0]])]) = cdr([y0,q~[x0]])
--		TELEM ==> car([y0,q~[x0]]) = y0
--		TELEM ==> cdr([y0,q~[x0]]) = q~[x0]
--	EQUAL(Stat23) ==> false; Discharge ==> (q~[x0]) = (c~[y0])
--	EQUAL(Stat23) ==> Straight(c - {[y0,q~[x0]]}, q~[x0], y0)
--(c - {[y0,q~[x0]]})-->Stat0(Stat22*) ==> false; Discharge ==> QED
--
Theorem 921: not(Acyclic(R) & Straight(P,Z,Y) & Straight(Q,Y,Z) & ((P + Q) ¥incin R) & ((P + Q) /= 0)). Proof:
Suppose_not(r0,q0,z0,y0,q1) ==> AUTO
--
-- Assuming that a counterexample $r0,q0,z0,y0,q1,x0$ can exist, we will reach a contradiction by
-- finding a cycle $s$ included in $q0+q1$ by means of the following construction.
--
-- We begin by noting that neither $q0$ nor $q1$ can be void.
	Suppose ==> q0 = 0
		EQUAL ==> Straight(0,z0,y0)
		(z0,y0)-->T910(*) ==> z0 = y0
	(q1,y0,z0)-->T915(*) ==> false; Discharge ==> q0 /= 0
	Suppose ==> q1 = 0
		EQUAL ==> Straight(0,y0,z0)
		(y0,z0)-->T910(*) ==> y0 = z0
	(q0,z0,y0)-->T915(*) ==> false; Discharge ==> q1 /= 0
--
-- Next we note that the set $q0 + q1$ meets the property of being a finite map whose
-- domain includes its range.
--
	(q0,z0,y0)-->T902(*) ==> Stat1: Svm(q0) & Finite(q0)
	(q1,y0,z0)-->T902(*) ==> Svm(q1) & Finite(q1)
	Use_def(Svm)(Stat1*) ==> Is_map(q0) & Is_map(q1)
	(q0,q1)-->T62(*) ==> Stat2: Is_map(q0 + q1) & ((q0 + q1) /= 0)
	(q0,q1)-->T236(Stat1*) ==> Finite(q0 + q1)
	Suppose ==> Stat3: range(q0 + q1) ¥nincin domain(q0 + q1)
		(q0,q1)-->T78(Stat3*) ==> domain(q0 + q1) = (domain(q0) + domain(q1))
		(q0,q1)-->T79(Stat3*) ==> range(q0 + q1) = (range(q0) + range(q1))
		(q0,z0,y0)-->T916(*) ==> ({y0} = (range(q0) - domain(q0))) & ({z0} = (domain(q0) - range(q0)))
		(q1,y0,z0)-->T916(*) ==> ({z0} = (range(q1) - domain(q1))) & ({y0} = (domain(q1) - range(q1)))
	Discharge ==> range(q0 + q1) ¥incin domain(q0 + q1)
--
-- Hence, by Theorem 904, the said map $q0+q1$ must include a cycle.
--
	(q0 + q1)-->T904(Stat2*) ==> Stat4: (EXISTS c ¥incin (q0 + q1) | Scycle(c))
--
-- Such a cycle $c$ must be included in $r0$, which contradicts the assumed acyclicity of $r0$,
-- and hence leads to the desired contradiction.
--
	c-->Stat4(*) ==> (c ¥incin r0) & Scycle(c)
	c-->T902(Stat4*) ==> (c /= 0) & Is_perm(c)
	Use_def(Acyclic)(*) ==> Stat5: c notin {c ¥incin r0 | Is_perm(c)}
c-->Stat5(Stat4*) ==> false; Discharge ==> QED
--
Theorem 922: (Acyclic(R) & Straight(P,Z,Y) & Straight(Q,X,Z) & ((P + Q) ¥incin R)) ¥imp (EXISTS s ¥incin (P + Q) | Straight(s,X,Y)). Proof:
Suppose_not(r0,q0,z0,y0,q1,x0) ==> AUTO
--
-- Assuming that a counterexample $r0,q0,z0,y0,q1,x0$ can exist, we will reach a contradiction by
-- finding a straight path $s$ leading from $x0$ to $y0$ by the following construction.
--
	ELEM ==> Stat1: not(EXISTS s ¥incin (q0 + q1) | Straight(s,x0,y0))
	Suppose ==> Stat2: q0 = 0
		EQUAL ==> Straight(0,z0,y0)
		(z0,y0)-->T910(Stat2*) ==> y0 = z0
		(Stat2,Stat2*)ELEM ==> q0 + q1 = q1
		EQUAL(Stat1) ==> Stat3: not(EXISTS s ¥incin q1 | Straight(s,x0,z0))
	q1-->Stat3(*) ==> false; Discharge ==> Stat4: q0 /= 0
	Suppose ==> Stat5: q1 = 0
		EQUAL ==> Straight(0,x0,z0)
		(x0,z0)-->T910(Stat5*) ==> z0 = x0
		(Stat5,Stat5*)ELEM ==> q0 + q1 = q0
		EQUAL(Stat1) ==> Stat6: not(EXISTS s ¥incin q0 | Straight(s,z0,y0))
	q0-->Stat6(*) ==> false; Discharge ==> Stat7: (q1 /= 0) & ((q0 + q1) ¥incin r0)
--
-- After the technical remark that neither $q0$ nor $q1$ can be null, we show that the set
-- $q0 + q1 + {[y0,x0]}$ meets the property of being a finite map whose domain includes
-- its range, so that by Theorem 904 this map must include a cycle.
--
	(q0,z0,y0)-->T902(*) ==> Stat8: Svm(q0) & Finite(q0)
	(q1,x0,z0)-->T902(*) ==> Svm(q1) & Finite(q1)
	Use_def(Svm)(Stat8*) ==> Is_map(q0) & Is_map(q1)
	(q0,q1)-->T62(Stat8*) ==> Is_map(q0 + q1)
	(q0,q1)-->T236(Stat8*) ==> Finite(q0 + q1)
 	TELEM ==> Is_map({[y0,x0]})
	(q0 + q1,{[y0,x0]})-->T62(Stat8*) ==> Stat9: Is_map((q0 + q1) + {[y0,x0]})
	(q0 + q1,[y0,x0])-->T199(Stat8*) ==> Finite((q0 + q1) + {[y0,x0]})
	Suppose ==> Stat10: range((q0 + q1) + {[y0,x0]}) ¥nincin domain((q0 + q1) + {[y0,x0]})
		(q0,q1)-->T78(Stat10*) ==> domain(q0 + q1) = (domain(q0) + domain(q1))
		(q0,q1)-->T79(Stat10*) ==> range(q0 + q1) = (range(q0) + range(q1))
		(y0,x0,0,0)-->T114(Stat10*) ==> (domain({[y0,x0]}) = {y0}) & (range({[y0,x0]}) = {x0})
		(q0 + q1,{[y0,x0]})-->T78(Stat10*) ==> domain((q0 + q1) + {[y0,x0]}) = (domain(q0) + domain(q1) + {y0})
		(q0 + q1,{[y0,x0]})-->T79(Stat10*) ==> range((q0 + q1) + {[y0,x0]}) = (range(q0) + range(q1) + {x0})
		(q0,z0,y0)-->T916(*) ==> ({y0} = (range(q0) - domain(q0))) & ({z0} = (domain(q0) - range(q0)))
		(q1,x0,z0)-->T916(*) ==> ({z0} = (range(q1) - domain(q1))) & ({x0} = (domain(q1) - range(q1)))
	Discharge ==> range((q0 + q1) + {[y0,x0]}) ¥incin domain((q0 + q1) + {[y0,x0]})
	((q0 + q1) + {[y0,x0]})-->T904(Stat9*) ==> Stat11: (EXISTS c ¥incin ((q0 + q1)  + {[y0,x0]}) | Scycle(c))
--
-- Such a cycle $c$ must own $[y0,x0]$ as an element, else the assumed acyclicity of $r0$ would
-- be contradicted.
--
	c-->Stat11(Stat11*) ==> (c ¥incin ((q0 + q1)  + {[y0,x0]})) & Scycle(c)
	c-->T902(Stat11*) ==> Stat12: (c /= 0) & Is_perm(c) & Svm(c)
	Suppose ==> [y0,x0] notin c
		(Stat7*)ELEM ==> c ¥incin r0
		Use_def(Acyclic)(*) ==> Stat13: c notin {c ¥incin r0 | Is_perm(c)}
	c-->Stat13(Stat7*) ==> false; Discharge ==> [y0,x0] in c
--
-- But then, removal of $[y0,x0]$ from $c$ will give us simple path leading
-- from $x0$ to $y0$, included in $q0+q1$. This conflicts with one of our initial
-- assumptions, and hence leads us to the sought conclusion.
--
	({[y0,x0]},c)-->T65(Stat11*) ==> domain({[y0,x0]}) ¥incin domain(c)
	(y0,x0,0,0)-->T114(Stat11*) ==> y0 in domain(c)
	(c,y0)-->T914(Stat11*) ==> Stat14: Straight(c - {[y0,c~[y0]]},c~[y0],y0)
	Suppose ==> (c~[y0]) /= x0
		(c,[y0,x0])-->T74(Stat11*) ==> (c~[car([y0,x0])]) = cdr([y0,x0])
		TELEM ==> car([y0,x0]) = y0
		TELEM ==> cdr([y0,x0]) = x0
	EQUAL(Stat14) ==> false; Discharge ==> (c~[y0]) = x0
	EQUAL(Stat14) ==> Straight(c - {[y0,x0]}, x0, y0)
(c - {[y0,x0]})-->Stat1(Stat11*) ==> false; Discharge ==> QED
--
-- Of the next three statements, the first is a special case of the second, and
-- the third provides a situation in which the second is applicable.
--
--Theorem 921: (Straight(P,Z,Y) & (X notin range(P)) & (X /= Z)) ¥imp Straight(P + {[X,Z]},X,Y)
--Suppose_not(q,z0,y0,x0) ==> AUTO
--Tsomehow ==> false; Discharge ==>
--Suppose_not(q,z0,y0,x0) ==> AUTO
--	Suppose ==> q = 0
--		ELEM ==> (q + {[x0,z0]}) = {[x0,z0]}
--		EQUAL ==> Stat90: Straight(0,z0,y0)
--		(z0,y0)-->T910(Stat90*) ==> z0 = y0
--		EQUAL ==> (not Straight({[x0,z0]},x0,z0))
--	(x0,z0)-->T909(*) ==> false; Discharge ==> q /= 0
--	Use_def(Straight) ==> Stat0: Scycle(q + {[y0,z0]}) & ([y0,z0] notin q) & (not(Scycle((q + {[x0,z0]}) + {[y0,x0]}) & ([y0,x0] notin (q + {[x0,z0]})))) & (x0 notin range(q)) & (x0 /= z0)
--	Suppose ==> [y0,x0] in (q + {[x0,z0]})
--		Suppose ==> Stat1: [y0,x0] = [x0,z0]
--			(Stat1)ELEM ==> x0 = z0
--		(Stat0*)Discharge ==> [y0,x0] /= [x0,z0]
--		(Stat0*)ELEM ==> Stat2: [y0,x0] in q
--		Use_def(range)(Stat0*) ==> Stat3: x0 notin {cdr(x): x in q}
--		([y0,x0])-->Stat3(Stat2*) ==> Stat4a: x0 /= cdr([y0,x0])
--	(Stat4a)Discharge ==> Stat4: (not Scycle((q + {[x0,z0]}) + {[y0,x0]}))
--	Use_def(Scycle)(Stat4*) ==> {p ¥incin ((q + {[x0,z0]}) + {[y0,x0]}) | (p /= 0) & Is_perm(p)} /= {(q + {[x0,z0]}) + {[y0,x0]}}
--	Suppose ==> Stat5: ((q + {[x0,z0]}) + {[y0,x0]}) notin {p ¥incin ((q + {[x0,z0]}) + {[y0,x0]}) | (p /= 0) & Is_perm(p)}
--		((q + {[x0,z0]}) + {[y0,x0]})-->Stat5(Stat5*) ==> Stat13: (not Is_perm((q + {[x0,z0]}) + {[y0,x0]}))
--		Use_def(Is_perm((q + {[x0,z0]}) + {[y0,x0]})) ==> AUTO
--		(q,{[x0,z0]})-->T78(Stat7*) ==> Stat7: domain(q + {[x0,z0]}) = (domain(q) + domain({[x0,z0]}))
--		(q,{[x0,z0]})-->T79(Stat8*) ==> Stat8: range(q + {[x0,z0]}) = (range(q) + range({[x0,z0]}))
--		(q + {[x0,z0]},{[y0,x0]})-->T78(Stat7*) ==> Stat9: domain((q + {[x0,z0]}) + {[y0,x0]}) = ((domain(q) + domain({[x0,z0]})) + domain({[y0,x0]}))
--		(q + {[x0,z0]},{[y0,x0]})-->T79(Stat8*) ==> Stat10: range((q + {[x0,z0]}) + {[y0,x0]}) = ((range(q) + range({[x0,z0]})) + range({[y0,x0]}))
--		(x0,z0,0,0)-->T114(Stat11*) ==> Stat11: (domain({[x0,z0]}) = {x0}) & (range({[x0,z0]}) = {z0})
--		(y0,x0,0,0)-->T114(Stat9*) ==> Stat12: (domain((q + {[x0,z0]}) + {[y0,x0]}) = ((domain(q) + {x0}) + {y0})) & (range((q + {[x0,z0]}) + {[y0,x0]}) = ((range(q) + {z0}) + {x0}))
--		(q,z0,y0)-->T916(*) ==> ({y0} = (range(q) - domain(q))) & ({z0} = (domain(q) - range(q)))
--		(Stat12*)ELEM ==> domain((q + {[x0,z0]}) + {[y0,x0]}) = range((q + {[x0,z0]}) + {[y0,x0]})
--		(q,z0,y0)-->T902(*) ==> Stat14: Svm(q) & Finite(q)
--		(q,[x0,z0])-->T199(Stat14*) ==> Finite(q + {[x0,z0]})
--		(q + {[x0,z0]},[y0,x0])-->T199 ==> Finite((q + {[x0,z0]}) + {[y0,x0]})
--		Use_def(Is_perm)(Stat13*) ==> Stat16a: (not Svm((q + {[x0,z0]}) + {[y0,x0]}))
--		(Stat0*)ELEM ==> Stat15: x0 notin domain(q)
--		(x0,z0)-->T91(Stat16*) ==> Stat16: Svm({[x0,z0]})
--		(x0,z0,0,0)-->T114(Stat16*) ==> Stat17: domain({[x0,z0]}) = {x0}
--		(q,{[x0,z0]})-->T87(Stat14*) ==> Svm(q + {[x0,z0]})
--		(q,{[x0,z0]})-->T78(Stat17*) ==> domain(q + {[x0,z0]}) = (domain(q) + {x0})
--		(Stat0*)ELEM ==> Stat18: y0 notin domain(q + {[x0,z0]})
--		(y0,x0)-->T91(Stat16*) ==> Stat19: Svm({[y0,x0]})
--		(y0,x0,0,0)-->T114(Stat19*) ==> domain({[y0,x0]}) = {y0}
--	(q + {[x0,z0]},{[y0,x0]})-->T87(Stat16a*) ==> false; Discharge ==> Stat30: not({p ¥incin ((q + {[x0,z0]}) + {[y0,x0]}) | (p /= 0) & Is_perm(p)} ¥incin {(q + {[x0,z0]}) + {[y0,x0]}})
--	p-->Stat30(Stat30*) ==> Stat31: (p in {p ¥incin ((q + {[x0,z0]}) + {[y0,x0]}) | (p /= 0) & Is_perm(p)}) & (p /= ((q + {[x0,z0]}) + {[y0,x0]}))
--	()-->Stat31(Stat31*) ==> (p ¥incin ((q + {[x0,z0]}) + {[y0,x0]})) & (p /= 0) & Is_perm(p)
--Tsomehow ==> false; Discharge ==>
--
--
--
--Theorem 922: (Straight(P,Z,Y) & Straight(Q,X,Z) & ((range(P) * domain(Q)) = 0)) ¥imp Straight(P + Q,X,Y)
--Suppose_not(q0,z0,y0,q1,x0) ==> AUTO
--Tsomehow ==> false; Discharge ==>
--
--
--
--Theorem OM: (Acyclic(R) & Straight(P,Z,Y) & Straight(Q,X,Z) & ((P + Q) ¥incin R)) ¥imp ((range(P) * domain(Q)) = 0)
--Suppose_not(r0,q0,z0,y0,q1,x0) ==> AUTO
--Tsomehow ==> false; Discharge ==>
--
--
--
Theorem 923: Is_map(on(R,V)) & (on(R,V) ¥incin R) & (Is_map(R) ¥imp (on(R + inv(R),V) = (on(R,V) + inv(on(R,V))))). Proof:
Suppose_not(r,v) ==> AUTO
	Use_def(on) ==> Stat1: not(Is_map(r * (v ¥PROD v)) & (Is_map(r) ¥imp (((r * (v ¥PROD v)) + (inv(r) * (v ¥PROD v))) = ((r * (v ¥PROD v)) + inv(r * (v ¥PROD v))))))
	(r * (v ¥PROD v),v,v)-->T141(Stat2*) ==> Stat2: Is_map(r * (v ¥PROD v))
	(Stat1*)ELEM ==> Stat3: Is_map(r) & Stat4: ((inv(r) * (v ¥PROD v)) /= inv(r * (v ¥PROD v)))
	c-->Stat4(Stat3*) ==> Stat5: (c in (inv(r) * (v ¥PROD v))) ¥neq (c in inv(r * (v ¥PROD v)))
	(inv(r) * (v ¥PROD v),v,v)-->T141(Stat6*) ==> Stat6: Is_map(inv(r) * (v ¥PROD v))
	(r * (v ¥PROD v))-->T99(Stat7*) ==> Stat7: Is_map(inv(r * (v ¥PROD v)))
	Suppose ==> Stat8: c /= [car(c),cdr(c)]
		Suppose ==> Stat9: c in (inv(r) * (v ¥PROD v))
		(inv(r) * (v ¥PROD v),c)-->T76(Stat6,Stat9,Stat8*) ==> false; Discharge ==> Stat10: c in inv(r * (v ¥PROD v))
	(inv(r * (v ¥PROD v)),c)-->T76(Stat7,Stat10,Stat8*) ==> false; Discharge ==> Stat11: c = [car(c),cdr(c)]
	EQUAL(Stat11,Stat5) ==> Stat12: ([car(c),cdr(c)] in (inv(r) * (v ¥PROD v))) ¥neq ([car(c),cdr(c)] in inv(r * (v ¥PROD v)))
	Suppose ==> [car(c),cdr(c)] in (inv(r) * (v ¥PROD v))
		EQUAL(Stat11) ==> Stat13: c in (inv(r) * (v ¥PROD v))
		(c,v,v)-->T140(Stat13*) ==> Stat14: (car(c) in v) & (cdr(c) in v)
		(Stat11*)ELEM ==> Stat15: [car(c),cdr(c)] notin inv(r * (v ¥PROD v))
		(r * (v ¥PROD v),cdr(c),car(c))-->T90(Stat15,Stat2*) ==> Stat16: [cdr(c),car(c)] notin (r * (v ¥PROD v))
		Suppose ==> [cdr(c),car(c)] notin (v ¥PROD v)
			Use_def(¥PROD)(Stat17*) ==> Stat17: [cdr(c),car(c)] notin {[x,y]: x in v, y in v}
		(cdr(c),car(c))-->Stat17(Stat14,Stat14*) ==> false; Discharge ==> Stat18: [cdr(c),car(c)] in (v ¥PROD v)
		(Stat16*)ELEM ==> Stat19: [cdr(c),car(c)] notin r
	(r,cdr(c),car(c))-->T90(Stat3,Stat19,Stat18,Stat11,Stat13*) ==> false; Discharge ==> Stat20: [car(c),cdr(c)] in inv(r * (v ¥PROD v))
	(r * (v ¥PROD v),cdr(c),car(c))-->T90(Stat2,Stat20*) ==> Stat21: [cdr(c),car(c)] in (r * (v ¥PROD v))
	(r,cdr(c),car(c))-->T90(Stat3,Stat21,Stat20,Stat12*) ==> Stat22: [car(c),cdr(c)] notin (v ¥PROD v)
	Use_def(¥PROD)(Stat21,Stat21*) ==> Stat23: [cdr(c),car(c)] in {[x,y]: x in v, y in v}
	(x,y)-->Stat23(Stat23*) ==> Stat24: ([cdr(c),car(c)] = [x,y]) & (x in v) & (y in v)
	(Stat24*)ELEM ==> Stat25: [cdr(c),car(c)] = [x,y]
	(Stat25)ELEM ==> (x = cdr(c)) & (y = car(c))
	EQUAL(Stat24) ==> Stat26: (car(c) in v) & (cdr(c) in v)
	Use_def(¥PROD)(Stat22,Stat22*) ==> Stat27: [car(c),cdr(c)] notin {[x,y]: x in v, y in v}
(car(c),cdr(c))-->Stat27(Stat21*) ==> false; Discharge ==> QED
--
--
--
Theorem 924: Is_map(transCl(R)) & Is_map(trans_reflCl(R,V)) & (trans_reflCl(R,V) ¥incin (V ¥PROD V)). Proof:
Suppose_not(r,v) ==> AUTO
	Suppose ==> Stat1: (not Is_map(transCl(r)))
	Use_def(transCl)(Stat1*) ==> false; Discharge ==> Is_map(transCl(r))
	Use_def(trans_reflCl)(Stat2*) ==> (not Is_map(transCl(on(r,v)) + ident(v))) or ((transCl(on(r,v)) + ident(v)) ¥nincin (v ¥PROD v))
	Suppose ==> Stat2: (not Is_map(transCl(on(r,v)) + ident(v)))
		(transCl(on(r,v)),ident(v))-->T62(*) ==> Stat3: (not Is_map(transCl(on(r,v)))) or (not Is_map(ident(v)))
		(v,0,0)-->T115(*) ==> one_1_map(ident(v))
		Use_def(one_1_map)(Stat3*) ==> Svm(ident(v))
		Use_def(Svm)(Stat3*) ==> Is_map(ident(v))
		(Stat3*)ELEM ==> Stat4: (not Is_map(transCl(on(r,v))))
	Use_def(transCl)(Stat4*) ==> false; Discharge ==> Stat5: (transCl(on(r,v)) + ident(v)) ¥nincin (v ¥PROD v)
	Suppose ==> Stat6: not({[x,x]: x in v} ¥incin {[x,y]: x in v, y in v})
		c-->Stat6(Stat6*) ==> Stat7: (c in {[x,x]: x in v}) & (c notin {[x,y]: x in v, y in v})
	(x,x,x)-->Stat7(Stat7*) ==> false; Discharge ==> Stat8: {[x,x]: x in v} ¥incin {[x,y]: x in v, y in v}
	Use_def(ident)(Stat8*) ==> ident(v) ¥incin {[x,y]: x in v, y in v}
	Use_def(¥PROD)(Stat8*) ==> Stat9: transCl(on(r,v)) ¥nincin (v ¥PROD v)
	Use_def(transCl)(Stat9*) ==> Stat10: not(({[x,y]: q ¥incin on(r,v), x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}) ¥incin (v ¥PROD v))
	d-->Stat10(Stat10*) ==> Stat11: (d in {[x,y]: q ¥incin on(r,v), x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}) & (d notin (v ¥PROD v))
	(q,x1,y1)-->Stat11(Stat11*) ==> Stat12: (d = [x1,y1]) & (q ¥incin on(r,v)) & (x1 in domain(q)) & (y1 in range(q))
	Use_def(on)(Stat12*) ==> q ¥incin (v ¥PROD v)
	(q,v,v)-->T141(Stat12*) ==> Stat13: (x1 in v) & (y1 in v) & (d = [x1,y1])
	(Stat13)ELEM ==> Stat14: (car(d) in v) & (cdr(d) in v)
	Use_def(¥PROD)(Stat11*) ==> Stat15: d notin {[x,y]: x in v, y in v}
	(Stat12*)ELEM ==> Stat16: d = [x1,y1]
	(Stat16)ELEM ==> d = [car(d),cdr(d)]
(car(d),cdr(d))-->Stat15(Stat14*) ==> false; Discharge ==> QED
--
--
--
Theorem 925: Is_map(R) ¥imp (R ¥incin transCl(R)). Proof:
Suppose_not(r) ==> AUTO
	Use_def(transCl) ==> Stat1: not(r ¥incin {[x,y]: q ¥incin r, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or((x /= y) & Straight(q,x,y))})
	c-->Stat1(Stat1*) ==> Stat2: (c notin {[x,y]: q ¥incin r, x in domain(q), y in range(q) |  ((x = y) & Scycle(q)) or((x /= y) & Straight(q,x,y))}) & (c in r)
	(r,c)-->T51 ==> c = [car(c),cdr(c)]
	({[car(c),cdr(c)]},car(c),cdr(c))-->Stat2(Stat2*) ==> Stat3: (car(c) notin domain({[car(c),cdr(c)]})) or (cdr(c) notin range({[car(c),cdr(c)]})) or (not(((car(c) = cdr(c)) & Scycle({[car(c),cdr(c)]})) or ((car(c) /= cdr(c)) & Straight({[car(c),cdr(c)]},car(c),cdr(c)))))
	(car(c),cdr(c),0,0)-->T114(Stat3*) ==> Stat4: not(((car(c) = cdr(c)) & Scycle({[car(c),cdr(c)]})) or ((car(c) /= cdr(c)) & Straight({[car(c),cdr(c)]},car(c),cdr(c))))
	(car(c),cdr(c))-->T909(Stat4) ==> car(c) = cdr(c)
	(Stat4*)ELEM ==> (not Scycle({[car(c),cdr(c)]}))
	EQUAL(Stat4) ==> Stat5: (not Scycle({[car(c),car(c)]}))
(car(c),0)-->T908(Stat5*) ==> false; Discharge ==> QED
--
--
--
Theorem 926: (R ¥incin S) ¥imp (transCl(R) ¥incin transCl(S)). Proof:
Suppose_not(r,s) ==> AUTO
	Set_monot ==> {[x,y]: q ¥incin r, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))} ¥incin {[x,y]: q ¥incin s, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}
Use_def(transCl) ==> false; Discharge ==> QED
--
--
--
Theorem 927: ((R ¥incin S) & (N ¥incin M)) ¥imp (trans_reflCl(R,N) ¥incin trans_reflCl(S,M)). Proof:
Suppose_not(r,s,n,m) ==> AUTO
	(n,m,n,m)-->T256 ==> (n ¥PROD n) ¥incin (m ¥PROD m)
	Use_def(on) ==> on(r,n) ¥incin on(s,m)
	(on(r,n),on(s,m))-->T926 ==> transCl(on(r,n)) ¥incin transCl(on(s,m))
	Set_monot ==> {[x,x]: x in n} ¥incin {[x,x]: x in m}
	Use_def(ident) ==> ident(n) ¥incin ident(m)
Use_def(trans_reflCl) ==> false; Discharge ==> QED
--
--
--
Theorem 928: (transCl(R) ¥incin (domain(R) ¥PROD range(R))) & (Finite(R) ¥imp Finite(transCl(R))). Proof:
Suppose_not(r) ==> AUTO
--
-- For, the transitive closure of $r$ is contained in the Cartesian product of
-- $domain(r)$ by $range(r)$,...
--
	Suppose ==> Stat1: not(transCl(R) ¥incin (domain(R) ¥PROD range(R)))
		d-->Stat1(Stat1*) ==> Stat2: (d in transCl(r)) & (d notin (domain(r) ¥PROD range(r)))
		Use_def(transCl)(Stat2*) ==> Stat3: d in {[x,y]: q ¥incin r, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}
		(q1,x1,y1)-->Stat3(Stat3*) ==> Stat4: (d = [x1,y1]) & (q1 ¥incin r) & (x1 in domain(q1)) & (y1 in range(q1))
		(q1,r)-->T65(Stat4*) ==> (x1 in domain(r)) & (y1 in range(r))
		Use_def(¥PROD)(Stat2,Stat2*) ==> Stat5: d notin {[x,y]: x in domain(r), y in range(r)}
	(x1,y1)-->Stat5(Stat4*) ==> false; Discharge ==> Stat6: (transCl(r) ¥incin (domain(r) ¥PROD range(r))) & Finite(r) & (not Finite(transCl(r)))
--
-- ... which is finite when $r$ is finite.
--
	APPLY() finite_image(e(x)->car(x),s0->r) ==> Finite({car(x): x in r})
	Use_def(domain)(*) ==> Stat7: Finite(domain(r))
	APPLY() finite_image(e(x)->cdr(x),s0->r) ==> Finite({cdr(x): x in r})
	Use_def(range)(*) ==> Finite(range(r))
	(domain(r),range(r))-->T262(Stat7*) ==> Stat8: Finite(domain(r) ¥PROD range(r))
(domain(r) ¥PROD range(r),transCl(r))-->T189(Stat6*) ==> false; Discharge ==> QED
--
--
--
Theorem 929: Acyclic(A) ¥imp (([X,X] notin transCl(A)) & (({[X,Y],[Y,Z]} ¥incin transCl(A)) ¥imp ([X,Z] in transCl(A)))). Proof:
Suppose_not(a,x0,y0,z0) ==> AUTO
	ELEM ==> Stat1: Acyclic(a)
	Suppose ==> [x0,x0] in transCl(a)
		Use_def(transCl) ==> Stat2: [x0,x0] in {[x,y]: q ¥incin a, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}
		(q1,x1,y1)-->Stat2(Stat2*) ==> Stat3: ([x0,x0] = [x1,y1]) & (q1 ¥incin a) & (((x1 = y1) & Scycle(q1)) or ((x1 /= y1) & Straight(q1,x1,y1)))
		(Stat3)ELEM ==> Scycle(q1)
		(q1,0,0)-->T902(Stat3*) ==> (q1 /= 0) & Is_perm(q1)
		Use_def(Acyclic)(Stat3*) ==> Stat4: q1 notin {c ¥incin a | Is_perm(c)}
	q1-->Stat4(Stat3*) ==> false; Discharge ==> Stat5: ({[x0,y0],[y0,z0]} ¥incin transCl(a)) & ([x0,z0] notin transCl(a))
	Suppose ==> Stat6: {[x,x]: q ¥incin a, x in domain(q) | Scycle(q)} /= 0
		(q3,x3)-->Stat6(Stat6*) ==> (q3 ¥incin a) & Scycle(q3)
		q3-->T906(Stat6*) ==> (not Acyclic(q3))
	(a,q3)-->T907(*) ==> false; Discharge ==> Stat7: {[x,x]: q ¥incin a, x in domain(q) | Scycle(q)} = 0
	Use_def(transCl) ==> Stat8: ([x0,y0] in {[x,y]: q ¥incin a, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}) & Stat9: ([y0,z0] in {[x,y]: q ¥incin a, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}) &
		Stat10: ([x0,z0] notin {[x,y]: q ¥incin a, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))})
	(q5,x5,y5)-->Stat8(Stat8,Stat8*) ==> Stat11: ([x0,y0] = [x5,y5]) & (q5 ¥incin a) & (x5 in domain(q5)) & (((x5 = y5) & Scycle(q5)) or ((x5 /= y5) & Straight(q5,x5,y5)))
	Suppose ==> x5 = y5
	(q5,x5)-->Stat7(Stat11*) ==> false; Discharge ==> Straight(q5,x5,y5)
	(Stat11*)ELEM ==> Stat12: [x0,y0] = [x5,y5]
	(Stat12)ELEM ==> (x0 = x5) & (y0 = y5)
	EQUAL(Stat11) ==> Stat13: (q5 ¥incin a) & Straight(q5,x0,y0)
	(q6,x6,y6)-->Stat9(Stat13,Stat13*) ==> Stat14: ([y0,z0] = [x6,y6]) & (q6 ¥incin a) & (x6 in domain(q6)) & (((x6 = y6) & Scycle(q6)) or ((x6 /= y6) & Straight(q6,x6,y6)))
	Suppose ==> x6 = y6
	(q6,x6)-->Stat7(Stat14*) ==> false; Discharge ==> Straight(q6,x6,y6)
	(Stat14*)ELEM ==> Stat15: [y0,z0] = [x6,y6]
	(Stat15)ELEM ==> (y0 = x6) & (z0 = y6)
	EQUAL(Stat14) ==> Stat16: (q6 ¥incin a) & Straight(q6,y0,z0)
	(a,q6,y0,z0,q5,x0)-->T922(Stat13,Stat16,Stat1*) ==> Stat17: (EXISTS s ¥incin (q6 + q5) | Straight(s,x0,z0))
	s-->Stat17(Stat13,Stat16*) ==> (s ¥incin a) & (Straight(s,x0,z0))
	Suppose ==> s = 0
		EQUAL(Stat17) ==> Straight(0,x0,z0)
		(x0,z0)-->T910(Stat5*) ==> x0 = z0
		EQUAL(Stat16) ==> Straight(q6,y0,x0)
		T59(Stat18*) ==> Stat18: domain(0) = 0
		Suppose ==> q5 = 0
			EQUAL(Stat11) ==> x5 in domain(0)
		(Stat18*)Discharge ==> q5 /= 0
		Suppose ==> q6 = 0
			EQUAL(Stat14) ==> x6 in domain(0)
		(Stat18*)Discharge ==> q6 /= 0
	(a,q5,x0,y0,q6)-->T921(Stat1*) ==> false; Discharge ==> s /= 0
	(s,x0,z0)-->T915(Stat17*) ==> (x0 in domain(s)) & (z0 in range(s)) & (x0 /= z0)
(s,x0,z0)-->Stat10(Stat17*) ==> false; Discharge ==> QED
--
Theorem 930: (Acyclic(F) & Finite(T) & (T /= 0)) ¥imp (EXISTS w in T | (FORALL v in T | [v,w] notin transCl(F))). Proof:
Suppose_not(f,t0) ==> AUTO
--
-- If a counterexample $f,t$ existed, we could take one in which $t$ is
-- inclusion-minimal.
--
	APPLY(m1_thryvar:t) finite_induction(n->t0,P(x)->((x /= 0) & (not(EXISTS w in x | (FORALL v in x | [v,w] notin transCl(f)))))) ==>
		Stat1: (t ¥incin t0) & (t /= 0) & Stat2: (not(EXISTS w in t | (FORALL v in t | [v,w] notin transCl(f)))) & Stat3: (FORALL k ¥incin t | ((k /= t) ¥imp (not ((k /= 0) & (not(EXISTS w in k | (FORALL v in k | [v,w] notin transCl(f))))))))
--
-- Such $t$ would have at least two elements. Therefore, if we remove one
-- element, the left-over must have a minimal element $w$ relative to $transCl(f)$.
--
	Suppose ==> Stat4: t = {arb(t)}
		(arb(t))-->Stat2(Stat4*) ==> Stat5: not(FORALL v in t | [v,arb(t)] notin transCl(f))
		v0-->Stat5(Stat4*) ==> (v0 = arb(t)) & ([v0,arb(t)] in transCl(f))
		EQUAL(Stat5) ==> [arb(t),arb(t)] in transCl(f)
	(f,arb(t),0,0)-->T929(*) ==> false; Discharge ==> (t - {arb(t)}) /= 0
	(t - {arb(t)})-->Stat3 ==> Stat6: (EXISTS w in (t - {arb(t)}) | (FORALL v in (t - {arb(t)}) | [v,w] notin transCl(f)))
	w-->Stat6(Stat6*) ==> Stat7: (w in (t - {arb(t)})) & Stat8: (FORALL v in (t - {arb(t)}) | [v,w] notin transCl(f))
	(Stat7)ELEM ==> arb(t) in t
--
-- Now compare $arb(t)$ and $w$. We must have $[arb(t),w] in transCl(f)$, for otherwise
-- $w$ would be minimal in $t$.
--
	Suppose ==> Stat9: [arb(t),w] notin transCl(f)
		w-->Stat2(Stat7*) ==> Stat10: not(FORALL v in t | [v,w] notin transCl(f))
		v1-->Stat10(Stat10*) ==> (v1 in t) & ([v1,w] in transCl(f))
		Suppose ==> v1 /= arb(t)
		v1-->Stat8(Stat10*) ==> false; Discharge ==> v1 = arb(t)
	EQUAL(Stat9) ==> false; Discharge ==> [arb(t),w] in transCl(f)
--
-- But then $arb(t)$ is minimal in $t$; for, if not, then either
-- $[w,arb(t)] in transCl(f)$ would hold, in which case ${w,arb(t)}$
-- woud be a cycle in $f$, or $[v,arb(t)] in transCl(f)$ would hold
-- for some $v in (t - {arb(t),w})$, in which case we would have
-- $[v,w] in transCl(f)$ by transitivity.
--
	(arb(t))-->Stat2(Stat1) ==> Stat11: not(FORALL v in t | [v,arb(t)] notin transCl(f))
	v-->Stat11(Stat11*) ==> (v in t) & ([v,arb(t)] in transCl(f))
	Suppose ==> v = arb(t)
		EQUAL(Stat11) ==> [arb(t),arb(t)] in transCl(f)
	(f,arb(t),0,0)-->T929(*) ==> false; Discharge ==> v /= arb(t)
	(Stat11*)ELEM ==> Stat12: v in (t - {arb(t)})
	v-->Stat8(Stat12*) ==> [v,w] notin transCl(f)
(f,v,arb(t),w)-->T929(*) ==> false; Discharge ==> QED
--
-- Every partitioning property $T$ can be converted into a unary predicate
-- $Is_tag$ suitable for being passed as third parameter to the following THEORY,
-- by means of the following construct $X_Tag$:
--
Def 10028a: [formal extension of tagging property] X_Tag(T,X) := T(X) or (X = {arb(X)})
--
-- The following THEORY starts with a graph whose vertices may even
-- form a proper class, each vertex bearing a unique tag, and proceeds
-- to construct a global equivalence relation.
--
THEORY taggedGraph(Is_vertex(V),Is_edge(E),Is_tag(X))
	(FORALL e | Is_edge(e) ¥imp ((e = [car(e),cdr(e)]) & Is_vertex(car(e)) & Is_vertex(cdr(e))))
	(FORALL v | (EXISTS y | Is_vertex(v) ¥imp (Is_tag(y) & (v in y))))
	(FORALL x,y | (Is_tag(x) & Is_tag(y) & (x /= y)) ¥imp ((x * y) = 0))
END taggedGraph
--
ENTER_THEORY taggedGraph
--
APPLY(v1_thryvar:tag1_thryvar) Skolem() ==>
Theorem taggedGraph0: [association of its tag to each vertex] (FORALL v | Is_vertex(v) ¥imp (Is_tag(tag1_thryvar(v)) & (v in tag1_thryvar(v))))
--
Def 10028: [block consisting of all vertices which bear the same tag] block_thryvar(V) :=
	if Is_vertex(V) then {w in tag1_thryvar(V) | Is_vertex(w)} else 0 end if
--
Def 10029: [equivalence between vertices which bear the same tag] SameTag_thryvar(V,W) :=
	block_thryvar(V) = block_thryvar(W)
--
-- The following two theorems prove the trivial fact that
-- the relation 'SameTag' just defined is an equivalence relation.
--
Theorem taggedGraph1: SameTag_thryvar(X,X). Proof:
Suppose_not(x) ==> AUTO
Use_def(SameTag_thryvar) ==> false; Discharge ==> QED
--
Theorem taggedGraph2: (SameTag_thryvar(X,Y) & SameTag_thryvar(Y,Z)) ¥imp SameTag_thryvar(Z,X). Proof:
Suppose_not(x,y,z) ==> AUTO
Use_def(SameTag_thryvar) ==> false; Discharge ==> QED
--
Theorem taggedGraph3: ((Q ¥incin (R + inv(R))) & Is_map(R) & (FORALL e in R | SameTag_thryvar(car(e),cdr(e))) & (X in domain(Q))) ¥imp SameTag_thryvar(X,(Q~[X])). Proof:
Suppose_not(q,r,x) ==> AUTO
	r-->T99 ==> Is_map(inv(r))
	(r,inv(r))-->T62 ==> Is_map(r + inv(r))
	(q,r + inv(r))-->T52 ==> Stat1: Is_map(q) & Is_map(r) & (not SameTag_thryvar(x,(q~[x]))) & Stat2: (FORALL e in r | SameTag_thryvar(car(e),cdr(e)))
--
-- Reasoning by contradiction, let us consider a counterexample
-- $q,r,x$.
--
	(q,x)-->T77 ==> Stat3: [x,q~[x]] in (r + inv(r))
	Suppose ==> [x,q~[x]] in r
		([x,q~[x]])-->Stat2(Stat3*) ==> SameTag_thryvar(car([x,q~[x]]),cdr([x,q~[x]]))
		TELEM ==> (car([x,q~[x]]) = x) & (cdr([x,q~[x]]) = (q~[x]))
	EQUAL ==> false; Discharge ==> [x,q~[x]] notin r
	(r,q~[x],x)-->T90(Stat1*) ==> [q~[x],x] in r
	TELEM ==> (car([q~[x],x]) = (q~[x])) & (cdr([q~[x],x]) = x)
	([q~[x],x])-->Stat2(Stat3*) ==> SameTag_thryvar(car([q~[x],x]),cdr([q~[x],x]))
	EQUAL(Stat3) ==> Stat4: SameTag_thryvar((q~[x]),x)
Use_def(SameTag_thryvar)(Stat1,Stat4*) ==> false; Discharge ==> QED
--
Theorem taggedGraph4: ((Q ¥incin (R + inv(R))) & Is_map(R) & (FORALL e in R | SameTag_thryvar(car(e),cdr(e))) & Straight(Q,X,Y)) ¥imp SameTag_thryvar(X,Y). Proof:
Suppose_not(q0,r,x0,y0) ==> AUTO
	(q0,x0,y0)-->T902 ==> Stat1: (q0 ¥incin (r + inv(r))) & Svm(q0) & Finite(q0)
	Use_def(Svm) ==> Is_map(q0)
	Suppose ==> Stat2: not(EXISTS u | Straight(q0,u,y0) & (not SameTag_thryvar(u,y0)))
	x0-->Stat2 ==> false; Discharge ==> (EXISTS w | Straight(q0,w,y0) & (not SameTag_thryvar(w,y0)))
--
-- Reasoning by contradiction, let us consider a counterexample
-- $q,r,w,y0$ such that no counterexample $qp,r,wp,y0$ exists which has
-- $qp$ strictly included in $q$.
--
	APPLY(m1_thryvar:q) finite_induction(n->q0,P(x)->(EXISTS u | Straight(x,u,y0) & (not SameTag_thryvar(u,y0)))) ==>
		Stat3: (q ¥incin q0) & Stat4: (EXISTS u | Straight(q,u,y0) & (not SameTag_thryvar(u,y0))) &
		Stat5: (FORALL qp ¥incin q | (qp /= q) ¥imp (not (EXISTS u | Straight(qp,u,y0) & (not SameTag_thryvar(u,y0)))))
	(q,q0)-->T52(Stat1*) ==> (q ¥incin (r + inv(r))) & Is_map(q)
	w-->Stat4(Stat3*) ==> Stat6: Straight(q,w,y0) & (not SameTag_thryvar(w,y0))
--
-- One readily sees that $q = 0$ cannot hold.
--
	Suppose ==> q = 0
		EQUAL(Stat6) ==> Straight(0,w,y0)
		(w,y0)-->T910(Stat6*) ==> w = y0
		EQUAL(Stat6) ==> (not SameTag_thryvar(w,w))
	w-->TtaggedGraph1(Stat6*) ==> false; Discharge ==> q /= 0
--
-- But then if we remove the initial edge from $q$ we get
-- a shorter path ending in $y0$, which shows that
-- $q~[w]$ has the same tag as $y0$. Moreover, by the
-- preceding Theorem taggedGraph3, $w$ and $q~[w]$ bear the
-- same tag. Hence, by transitivity, we get that $w$ and $y0$
-- bear the same tag, which conflicts with our initial hypothesis
-- and hence provides the desired conclusion.
--
	(q,w,y0)-->T920(Stat6*) ==> Stat7: (EXISTS qp ¥incin (q - {[w,q~[w]]}) | Straight(qp, q~[w], y0))
	qp-->Stat7(Stat7*) ==> (qp ¥incin (q - {[w,q~[w]]})) & Straight(qp, q~[w], y0)
	(q,w,y0)-->T915(Stat6*) ==> w in domain(q)
	(q,w)-->T77(Stat3*) ==> [w,q~[w]] in q
	qp-->Stat5(Stat3*) ==> Stat8: not(EXISTS u | Straight(qp,u,y0) & (not SameTag_thryvar(u,y0)))
	(q~[w])-->Stat8(Stat6*) ==> SameTag_thryvar((q~[w]),y0)
	(q,r,w)-->TtaggedGraph3(*) ==> SameTag_thryvar(w,(q~[w]))
	Use_def(SameTag_thryvar)(Stat8*) ==> SameTag_thryvar(w,y0)
(Stat6*)ELEM ==> false; Discharge ==> QED
--
Theorem taggedGraph5: (Is_map(R) & (FORALL e in R | SameTag_thryvar(car(e),cdr(e))) & ([X,Y] in trans_reflCl(R + inv(R),V))) ¥imp SameTag_thryvar(X,Y). Proof:
Suppose_not(r,x,y,v) ==> Stat1: ([x,y] in trans_reflCl(r + inv(r),v)) & (not SameTag_thryvar(x,y)) & Is_map(r) & Stat2: (FORALL e in r | SameTag_thryvar(car(e),cdr(e)))
	Use_def(trans_reflCl) ==> [x,y] in (transCl(on(r + inv(r),v)) + ident(v))
	Suppose ==> [x,y] in ident(v)
		Use_def(ident) ==> Stat3: [x,y] in {[w,w]: w in v}
		w-->Stat3(Stat3) ==> x = y
		x-->TtaggedGraph1(Stat1*) ==> SameTag_thryvar(x,x)
	EQUAL(Stat1*) ==> false; Discharge ==> Stat4: ([x,y] notin ident(v)) & ([x,y] in transCl(on(r + inv(r),v)))
	Use_def(transCl)(Stat4*) ==> Stat5: [x,y] in {[u,w]: q ¥incin on(r + inv(r),v), u in domain(q), w in range(q) | ((u = w) & Scycle(q)) or ((u /= w) & Straight(q,u,w))}
	(q,x0,y0)-->Stat5(Stat5*) ==> Stat6: ([x,y] = [x0,y0]) & (q ¥incin on(r + inv(r),v)) & (((x0 = y0) & Scycle(q)) or ((x0 /= y0) & Straight(q,x0,y0)))
	(Stat6*)ELEM ==> Stat7: [x,y] = [x0,y0]
	(Stat7)ELEM ==> (x = x0) & (y = y0)
	Suppose ==> x0 = y0
		EQUAL ==> not SameTag_thryvar(x,x)
	x-->TtaggedGraph1(Stat7*) ==> false; Discharge ==> Straight(q,x0,y0)
	(r,v)-->T923(Stat1,Stat1*) ==> (on(r + inv(r),v) = (on(r,v) + inv(on(r,v)))) & Is_map(on(r,v)) & (on(r,v) ¥incin r)
	EQUAL(Stat1) ==> (q ¥incin (on(r,v) + inv(on(r,v)))) & Straight(q,x,y) & (not SameTag_thryvar(x,y))
	Suppose ==> Stat8: not(FORALL e in on(r,v) | SameTag_thryvar(car(e),cdr(e)))
		e-->Stat8(Stat8*) ==> (e in on(r,v)) & (not SameTag_thryvar(car(e),cdr(e)))
	e-->Stat2(Stat7*) ==> false; Discharge ==> (FORALL e in on(r,v) | SameTag_thryvar(car(e),cdr(e)))
(q,on(r,v),x,y)-->TtaggedGraph4(Stat7*) ==> false; Discharge ==> QED
--
--DISPLAY taggedGraph
--
--THEORY taggedGraph(Is_vertex(V),Is_edge(E),Is_tag(X))
--	(FORALL e | Is_edge(e) ¥imp ((e = [car(e),cdr(e)]) & Is_vertex(car(e)) & Is_vertex(cdr(e))))
--	(FORALL v | (EXISTS y | Is_vertex(v) ¥imp (Is_tag(y) & (v in y))))
--	(FORALL x,y | (Is_tag(x) & Is_tag(y) & (x /= y)) ¥imp ((x * y) = 0))
--==>(tag1_thryvar,block_thryvar,SameTag_thryvar)
--	(FORALL v | Is_vertex(v) ¥imp (Is_tag(tag1_thryvar(v)) & (v in tag1_thryvar(v))))
--	(FORALL v | block_thryvar(v) = if Is_vertex(v) then {w in tag1_thryvar(v) | Is_vertex(w)} else 0 end if)
--	(FORALL v, w | SameTag_thryvar(v,w) ¥eq (block_thryvar(v) = block_thryvar(w)))
--	(FORALL x | SameTag_thryvar(x,x))
--	(FORALL x, y, z | (SameTag_thryvar(x,y) & SameTag_thryvar(y,z)) ¥imp SameTag_thryvar(z,x))
--	(FORALL q, r, x | ((q ¥incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & (x in domain(q))) ¥imp SameTag_thryvar(x,(q~[x])))
--	(FORALL q, r, x, y | ((q ¥incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & Straight(q,x,y)) ¥imp SameTag_thryvar(x,y))
--	(FORALL r, x, y, v | (Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & ([x,y] in trans_reflCl(r + inv(r),v))) ¥imp SameTag_thryvar(x,y))
--END taggedGraph
--
ENTER_THEORY Set_theory
--
--
--
THEORY acyclicFiniteGraph(vertices,edges)
	edges ¥incin (vertices ¥PROD vertices)
	Finite(edges)
	Acyclic(edges)
END acyclicFiniteGraph
--
ENTER_THEORY acyclicFiniteGraph
--
Theorem acyclicFiniteGraph1: (FORALL t | ((t ¥incin vertices) & (t /= 0)) ¥imp (EXISTS w in t | (FORALL v in t | not([v,w] in transCl(edges))))). Proof:
Suppose_not ==> Stat1: not(FORALL t | ((t ¥incin vertices) & (t /= 0)) ¥imp (EXISTS w in t | (FORALL v in t | not([v,w] in transCl(edges)))))
--
-- For, assume $t$ to be a non-empty set of vertices which is devoid of minimal elements w.r.t. the
-- transitive closure of the graph. Such set must be included in $range(edges)$, i.e., every one
-- of its elements must have an incident edge.
--
	Assump ==> Stat2: Acyclic(edges) & Finite(edges)
	t0-->Stat1(*) ==> Stat3: (t0 ¥incin vertices) & (t0 /= 0) & Stat4: (not(EXISTS w in t0 | (FORALL v in t0 | not([v,w] in transCl(edges)))))
	Suppose ==> Stat5: not(t0 ¥incin range(edges))
		c-->Stat5(Stat5*) ==> Stat6: (c in t0) & (c notin range(edges))
		c-->Stat4(Stat3*) ==> Stat7: not(FORALL v in t0 | not([v,c] in transCl(edges)))
		v0-->Stat7(Stat7*) ==> Stat8: (v0 in t0) & ([v0,c] in transCl(edges))
		edges-->T928(Stat8,Stat2*) ==> [v0,c] in (domain(edges) ¥PROD range(edges))
		({[v0,c]},domain(edges),range(edges))-->T141(Stat8*) ==> range({[v0,c]}) ¥incin range(edges)
	(v0,c,0,0)-->T114(Stat6*) ==> false; Discharge ==> Stat9: t0 ¥incin range(edges)
--
-- Accordingly, $t0$ must be finite.
--
	APPLY() finite_image(e(x)->cdr(x),s0->edges) ==> Finite({cdr(x): x in edges})
	Use_def(range)(*) ==> Finite(range(edges))
	(range(edges),t0)-->T189(Stat9*) ==> Finite(t0)
--
-- But then, by the Theorem 930 proved above, it must have a minimal element,
-- contrary to our initial hypothesis. This contradiction proves the desired statement.
--
	(edges,t0)-->T930(Stat2*) ==> Stat10: (EXISTS w in t0 | (FORALL v in t0 | [v,w] notin transCl(edges)))
	w0-->Stat10(Stat10*) ==> Stat11: (w0 in t0) & Stat12: (FORALL v in t0 | [v,w0] notin transCl(edges))
	w0-->Stat4(Stat11*) ==> Stat13: not(FORALL v in t0 | not([v,w0] in transCl(edges)))
	v1-->Stat13(Stat13*) ==> (v1 in t0) & ([v1,w0] in transCl(edges))
v1-->Stat12(Stat13*) ==> false; Discharge ==> QED
--
APPLY(rk_thryvar:rk2) wellfounded_recursive_fcn(s->vertices,arg1_bef_arg2(y,x)->([y,x] in transCl(edges)),f3(b,x,t)->0,g4(a,y,x,t)->0,P4(a,y,x,t)->(a = a)) ==>
	Theorem acyclicFiniteGraph2: (FORALL x, t | (x in vertices) ¥imp (rk2(x,t) = Un({next(rk2(y,t)): y in vertices | ([y,x] in transCl(edges)) & ([y,x] in t)})))
--
Def 10083: [height of vertex in finite acyclic graph] height_thryvar(X) := rk2(X,edges)
--
Theorem acyclicFiniteGraph3: (X in vertices) ¥imp (height_thryvar(X) = Un({next(height_thryvar(y)): y in vertices | [y,X] in edges})). Proof:
Suppose_not(x0) ==> AUTO
	TacyclicFiniteGraph2 ==> Stat1: (FORALL x, t | (x in vertices) ¥imp (rk2(x,t) = Un({next(rk2(y,t)): y in vertices | ([y,x] in transCl(edges)) & ([y,x] in t)})))
	(x0,edges)-->Stat1(*) ==> rk2(x0,edges) = Un({next(rk2(y,edges)): y in vertices | ([y,x0] in transCl(edges)) & ([y,x0] in edges)})
	Use_def(height_thryvar) ==> Stat2: Un({next(height_thryvar(y)): y in vertices | ([y,x0] in transCl(edges)) & ([y,x0] in edges)}) /= Un({next(height_thryvar(y)): y in vertices | [y,x0] in edges})
	Suppose ==> {next(height_thryvar(y)): y in vertices | ([y,x0] in transCl(edges)) & ([y,x0] in edges)} = {next(height_thryvar(y)): y in vertices | [y,x0] in edges}
	EQUAL(Stat2) ==> false; Discharge ==> Stat3: {next(height_thryvar(y)): y in vertices | ([y,x0] in transCl(edges)) & ([y,x0] in edges)} /= {next(height_thryvar(y)): y in vertices | [y,x0] in edges}
	y0-->Stat3(Stat3*) ==> Stat4: (([y0,x0] in transCl(edges)) & ([y0,x0] in edges)) ¥neq ([y0,x0] in edges)
	Assump ==> Stat5: edges ¥incin (vertices ¥PROD vertices)
	(edges,vertices,vertices)-->T141(Stat5*) ==> Is_map(edges)
edges-->T925(Stat4*) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY acyclicFiniteGraph
--
--THEORY acyclicFiniteGraph(vertices,edges)
--	edges ¥incin (vertices ¥PROD vertices)
--	Finite(edges)
--	Acyclic(edges)
--==>(height_thryvar)
--	(FORALL t | ((t ¥incin vertices) & (t /= 0)) ¥imp (EXISTS w in t | (FORALL v in t | not([v,w] in transCl(edges)))))
--	(FORALL x | (x in vertices) ¥imp (height_thryvar(x) = Un({next(height_thryvar(y)): y in vertices | [y,x] in edges})))
--END acyclicFiniteGraph
--
--
Def 10051: [transitivity of a multi-valued map] Transitive(R) := (R @ R) ¥incin R
--
Def 10052: [symmetricity of a multi-valued map] Symmetric(R) := inv(R) ¥incin R
--
Def 10053: [reflexivity of a multi-valued map on a set] Reflexive(R,N) := R incs ident(N)
--
Def 10054: [irreflexivity, aka strictness, of a multi-valued map] Strict(R,N) := (R * ident(N)) = 0
--
Def 10055: [asymmetricity of a multi-valued map] Asymmetric(R,N) := on((R * inv(R)),N) in {0,ident(N)}
--
Def 10056: [quasi-order, aka preorder, of a set] Is_qo(R,N) := Is_map(R) & Transitive(on(R,N)) & ((R * ident(N)) in {0,ident(N)})
--
Def 10057: [partial ordering of a set] Is_po(R,N) := Is_map(R) & Transitive(on(R,N)) & Asymmetric(R,N)
--
Def 10058: [stability of a partition w.r.t. a set] Stable(P,A) := (FORALL b in P | ((b * A) = 0) or (b ¥incin A))
--
--
THEORY labeledGraph(vertices,edges,tags)
	edges ¥incin (vertices ¥PROD vertices)
	vertices ¥incin Un(tags)
	(FORALL x in tags, y in tags | (x /= y) ¥imp ((x * y) = 0))
END labeledGraph
--
ENTER_THEORY labeledGraph
--
Theorem labeledGraph0: (E in edges) ¥imp ((E = [car(E),cdr(E)]) & (car(E) in vertices) & (cdr(E) in vertices)). Proof:
Suppose_not(e) ==> Stat1: (e in edges) & ((e /= [car(e),cdr(e)]) or (car(e) notin vertices) or (cdr(e) notin vertices))
	Assump ==> edges ¥incin (vertices ¥PROD vertices)
	Use_def(¥PROD) ==> Stat2: e in {[x,y]: x in vertices, y in vertices}
	(x1,y1)-->Stat2(Stat2*) ==> Stat3: (e = [x1,y1]) & (x1 in vertices) & (y1 in vertices)
	(Stat3)ELEM ==> (x1 = car(e)) & (y1 = cdr(e)) & (e = [car(e),cdr(e)])
(Stat1*)Discharge ==> QED
--
Theorem labeledGraph1: (EXISTS y | (V in vertices) ¥imp ((y in tags) & (V in y))). Proof:
Suppose_not(v) ==> Stat1: not(EXISTS y | (v in vertices) ¥imp ((y in tags) & (v in y)))
	Suppose ==> v notin vertices
	0-->Stat1 ==> false; Discharge ==> v in vertices
	Assump ==> vertices ¥incin Un(tags)
	Use_def(Un) ==> Stat2: v in {x: y in tags, x in y}
	(y,x)-->Stat2(Stat2*) ==> (y in tags) & (v in y)
y-->Stat1 ==> false; Discharge ==> QED
--
Theorem labeledGraph2: ((X in tags) & (Y in tags) & (X /= Y)) ¥imp ((X * Y) = 0). Proof:
Suppose_not(x,y) ==> AUTO
	Assump ==> Stat1: (FORALL x in tags, y in tags | (x /= y) ¥imp ((x * y) = 0))
(x,y)-->Stat1 ==> false; Discharge ==> QED
--
APPLY(tag1_thryvar:tag2_thryvar,block_thryvar:block_thryvar,SameTag_thryvar:SameTag_thryvar) taggedGraph(Is_vertex(V)->(V in vertices),Is_edge(E)->(E in edges),Is_tag(V)->(V in tags)) ==>
Theorem labeledGraph3: [properties of labeled graphs inherited from tagged graphs] (FORALL v | (v in vertices) ¥imp ((tag2_thryvar(v) in tags) & (v in tag2_thryvar(v)))) &
	(FORALL v | block_thryvar(v) = if v in vertices then {w in tag2_thryvar(v) | w in vertices} else 0 end if) &
	(FORALL v, w | SameTag_thryvar(v,w) ¥eq (block_thryvar(v) = block_thryvar(w))) &
	(FORALL v | SameTag_thryvar(v,v)) &
	(FORALL q, r, x | ((q ¥incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & (x in domain(q))) ¥imp SameTag_thryvar(x,(q~[x]))) &
	(FORALL q, r, x, y | ((q ¥incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & Straight(q,x,y)) ¥imp SameTag_thryvar(x,y)) &
	(FORALL r, x, y, v | (Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & ([x,y] in trans_reflCl(r + inv(r),v))) ¥imp SameTag_thryvar(x,y))
--
Def 10133: [set of all bisimulations over the labeled graph] bisim_thryvar := {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
--
Def 10134: [bisimilarity equivalence relation] bisimilar_thryvar := Un(bisim_thryvar)
--
Def 10135: [set of all simulations over the labeled graph] sim_thryvar := {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) }
--
Def 10136: [similarity equivalence relation] similar_thryvar := Un(sim_thryvar) * inv(Un(sim_thryvar))
--
Theorem labeledGraph4: (0 in bisim_thryvar) & (bisim_thryvar ¥incin sim_thryvar) & ((X in bisim_thryvar) ¥imp (X ¥incin (vertices ¥PROD vertices))). Proof:
Suppose_not(r) ==> AUTO
	Suppose ==> Stat1: 0 notin bisim_thryvar
		Use_def(bisim_thryvar)(Stat2,Stat2*) ==> Stat3: 0 notin {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
		()-->Stat3(Stat3*) ==> not(((edges @ inv(0)) = (inv(0) @ edges)) & ((edges @ 0) = (0 @ edges)))
		Use_def(inv)(Stat1,Stat1*) ==> Stat4: inv(0) = {[cdr(x),car(x)]: x in 0}
		(Stat4)ELEM ==> inv(0) = 0
		Use_def(@)(Stat1,Stat1*) ==> Stat5: ((edges @ 0) = {[car(x),cdr(y)]: x in 0, y in edges | cdr(x) = car(y)}) &
			((0 @ edges) = {[car(x),cdr(y)]: x in edges, y in 0 | cdr(x) = car(y)})
		Suppose ==> Stat6: {[car(x),cdr(y)]: x in 0, y in edges | cdr(x) = car(y)} /= 0
		(x1,y1)-->Stat6(Stat6*) ==> false; Discharge ==> {[car(x),cdr(y)]: x in 0, y in edges | cdr(x) = car(y)} = 0
		Suppose ==> Stat7: {[car(x),cdr(y)]: x in edges, y in 0 | cdr(x) = car(y)} /= 0
		(x2,y2)-->Stat7(Stat7*) ==> false; Discharge ==> {[car(x),cdr(y)]: x in edges, y in 0 | cdr(x) = car(y)} = 0
		(Stat5*)ELEM ==> ((edges @ 0) = 0) & ((0 @ edges) = 0)
	EQUAL(Stat3*) ==> false; Discharge ==> 0 in bisim_thryvar
	Suppose ==> Stat8: (r in bisim_thryvar) & Stat9: (not(r ¥incin (vertices ¥PROD vertices)))
		x-->Stat9(Stat8*) ==> (x in r) & (x notin (vertices ¥PROD vertices))
		Use_def(bisim_thryvar)(Stat8*) ==> Stat10: r in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
		()-->Stat10(Stat10*) ==> r ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}
		Set_monot(Stat10) ==> {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} ¥incin {[v,w]: v in vertices, w in vertices}
	Use_def(¥PROD)(Stat8*) ==> false; Discharge ==> Stat11: not(bisim_thryvar ¥incin sim_thryvar)
	b-->Stat11(Stat11*) ==> Stat2: (b in bisim_thryvar) & (b notin sim_thryvar)
	Use_def(sim_thryvar)(Stat12,Stat12*) ==> Stat13: b notin {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) }
	Use_def(bisim_thryvar)(Stat2,Stat2*) ==> Stat14: b in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
	()-->Stat14(Stat14*) ==> (b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & (((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)))
b-->Stat13(Stat13*) ==> false; Discharge ==> QED
--
--
Theorem labeledGraph5: (B in bisim_thryvar) ¥imp (B ¥incin bisimilar_thryvar). Proof:
Suppose_not(b) ==> AUTO
	Use_def(bisimilar_thryvar) ==> b ¥nincin Un(bisim_thryvar)
	(bisim_thryvar,0)-->T274 ==> Stat1: (FORALL x in bisim_thryvar | x ¥incin Un(bisim_thryvar))
b-->Stat1 ==> false; Discharge ==> QED
--
Theorem labeledGraph6: (B in bisim_thryvar) ¥imp (inv(B) in bisim_thryvar). Proof:
Suppose_not(b) ==> AUTO
	Use_def(bisim_thryvar) ==> Stat1: (b in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) &
		Stat2: (inv(b) notin {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
	()-->Stat1(Stat1*) ==> Stat3: (b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges))
	()-->Stat2(Stat3*) ==> Stat4: (not(inv(b) ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})) or ((edges @ inv(inv(b))) /= (inv(inv(b)) @ edges))
	Suppose ==> Stat5: (not(inv(b) ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}))
		c-->Stat5(Stat5*) ==> Stat6: (c in inv(b)) & (c notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		Use_def(inv)(Stat6*) ==> Stat7: c in {[cdr(x),car(x)]: x in b}
		x0-->Stat7(Stat7*) ==> Stat8: (x0 in b) & (c = [cdr(x0),car(x0)])
		EQUAL(Stat6*) ==> Stat9: [cdr(x0),car(x0)] notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}
		(cdr(x0),car(x0))-->Stat9(Stat9*) ==> Stat10: (cdr(x0) notin vertices) or (car(x0) notin vertices) or (not(SameTag_thryvar(cdr(x0),car(x0))))
		(Stat8,Stat3*)ELEM ==> Stat11: x0 in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}
		(v0,w0)-->Stat11(Stat11*) ==> Stat12: (x0 = [v0,w0]) &  (v0 in vertices) & (w0 in vertices) & SameTag_thryvar(v0,w0)
		(Stat10,Stat12)ELEM ==> (v0 = car(x0)) & (w0 = cdr(x0)) & (not(SameTag_thryvar(cdr(x0),car(x0))))
		EQUAL(Stat12) ==> Stat13: not(SameTag_thryvar(w0,v0))
		TlabeledGraph3 ==> Stat14: (FORALL v, w | SameTag_thryvar(v,w) ¥eq (block_thryvar(v) = block_thryvar(w)))
		(v0,w0)-->Stat14(Stat12,Stat12*) ==> block_thryvar(v0) = block_thryvar(w0)
	(w0,v0)-->Stat14(Stat13*) ==> false; Discharge ==> Stat15: (edges @ inv(inv(b))) /= (inv(inv(b)) @ edges)
	TELEM ==> Stat16: Is_map({[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
	(b,{[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})-->T52(Stat3,Stat16) ==> Is_map(b) & ((edges @ b) = (b @ edges))
	b-->T100(Stat16*) ==> b = inv(inv(b))
EQUAL(Stat15*) ==> false; Discharge ==> QED
--
Theorem labeledGraph7: bisimilar_thryvar ¥incin similar_thryvar. Proof:
Suppose_not ==> AUTO
	Use_def(bisimilar_thryvar) ==> not(Un(bisim_thryvar) ¥incin similar_thryvar)
	Use_def(similar_thryvar) ==> Stat1: not(Un(bisim_thryvar) ¥incin (Un(sim_thryvar) * inv(Un(sim_thryvar))))
	p-->Stat1(Stat1*) ==> (p in Un(bisim_thryvar)) & (p notin (Un(sim_thryvar) * inv(Un(sim_thryvar))))
	TlabeledGraph4(Stat1*) ==> Stat2: bisim_thryvar ¥incin sim_thryvar
	(bisim_thryvar,sim_thryvar)-->T276(Stat1*) ==> Stat3: (p in Un(sim_thryvar)) & (p notin inv(Un(sim_thryvar)))
	Use_def(Un)(Stat1*) ==> Stat4: p in {x: y in bisim_thryvar, x in y}
	(b,q)-->Stat4(Stat4*) ==> Stat5: (b in bisim_thryvar) & (p in b)
	b-->TlabeledGraph6(Stat5*) ==> Stat6: inv(b) in bisim_thryvar
	TlabeledGraph4(Stat6*) ==> inv(b) in sim_thryvar
	Use_def(bisim_thryvar)(Stat5,Stat5*) ==> Stat7: b in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
	()-->Stat7(Stat7,Stat5*) ==>Stat8: p in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}
	(v,w)-->Stat8(Stat8*) ==> Stat9: p = [v,w]
	Use_def(inv)(Stat3,Stat3*) ==> Stat10: p notin {[cdr(x),car(x)]: x in Un(sim_thryvar)}
	([w,v])-->Stat10(Stat9) ==> Stat11: [w,v] notin Un(sim_thryvar)
	(bisim_thryvar,sim_thryvar)-->T276(Stat2,Stat11*) ==> Stat12: [w,v] notin Un(bisim_thryvar)
	(bisim_thryvar,0)-->T274(Stat11*) ==> Stat13: (FORALL x in bisim_thryvar | x ¥incin Un(bisim_thryvar))
	(inv(b))-->Stat13(Stat6,Stat12*) ==> [w,v] notin inv(b)
	Use_def(inv)(Stat13*) ==> Stat14: [w,v] notin {[cdr(x),car(x)]: x in b}
p-->Stat14(Stat5,Stat9) ==> false; Discharge ==> QED
--
Theorem labeledGraph8: (B in sim_thryvar) ¥imp (trans_reflCl(B,vertices) in sim_thryvar). Proof:
Suppose_not(b0) ==> AUTO
	Use_def(sim_thryvar) ==> Stat1: (b0 in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) }) &
		Stat2: (trans_reflCl(b0,vertices) notin {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) })
	()-->Stat1(Stat1*) ==> Stat3: (b0 ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(b0)) = (inv(b0) @ edges))
	(trans_reflCl(b0,vertices))-->Stat2(Stat1,Stat1*) ==> (not(trans_reflCl(b0,vertices) ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})) or ((edges @ inv(trans_reflCl(b0,vertices))) /= (inv(trans_reflCl(b0,vertices)) @ edges))
	Suppose ==> Stat4: not(trans_reflCl(b0,vertices) ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		c-->Stat4(Stat4*) ==> (c in trans_reflCl(b0,vertices)) & (c notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		(b0,vertices)-->T924(Stat4*) ==> Is_map(trans_reflCl(b0,vertices))
		(trans_reflCl(b0,vertices),c)-->T51(Stat4*) ==> (c = [car(c),cdr(c)])
		EQUAL(Stat4) ==> Stat5: ([car(c),cdr(c)] in trans_reflCl(b0,vertices)) & Stat6: ([car(c),cdr(c)] notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		TlabeledGraph3(*) ==> Stat7: (FORALL r, x, y, v | (Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & ([x,y] in trans_reflCl(r + inv(r),v))) ¥imp SameTag_thryvar(x,y))
		(b0,b0 + inv(b0),vertices,vertices)-->T927(Stat4*) ==> [car(c),cdr(c)] in trans_reflCl(b0 + inv(b0),vertices)
		(b0,{[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})-->T52(Stat3,Stat3) ==> Is_map(b0)
		Suppose ==> Stat8: not(FORALL e in b0 | SameTag_thryvar(car(e),cdr(e)))
			e-->Stat8(Stat3*) ==> Stat9: (e in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & (not SameTag_thryvar(car(e),cdr(e)))
			(v,w)-->Stat9(Stat9*) ==> Stat10: (e = [v,w]) & SameTag_thryvar(v,w)
			(Stat10)ELEM ==> (v = car(e)) & (w = cdr(e))
		EQUAL(Stat9) ==> false; Discharge ==> (FORALL e in b0 | SameTag_thryvar(car(e),cdr(e)))
		(b0,car(c),cdr(c),vertices)-->Stat7(Stat7*) ==> Stat11: SameTag_thryvar(car(c),cdr(c))
		(b0,vertices)-->T924(Stat5*) ==> [car(c),cdr(c)] in (vertices ¥PROD vertices)
		({[car(c),cdr(c)]},vertices,vertices)-->T141(Stat11*) ==> (domain({[car(c),cdr(c)]}) ¥incin vertices) & (range({[car(c),cdr(c)]}) ¥incin vertices)
		(car(c),cdr(c))-->T114(Stat11*) ==> (car(c) in vertices) & (cdr(c) in vertices)
	(car(c),cdr(c))-->Stat6(Stat11*) ==> false; Discharge ==> (edges @ inv(trans_reflCl(b0,vertices))) /= (inv(trans_reflCl(b0,vertices)) @ edges)
	Use_def(trans_reflCl) ==> (edges @ inv(transCl(on(b0,vertices)) + ident(vertices))) /= (inv(transCl(on(b0,vertices)) + ident(vertices)) @ edges)
	Use_def(transCl) ==> Stat12: (edges @ inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices))) /= (inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges)
	Suppose ==> Stat13: ({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) /= ({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices))
		Set_monot(Stat13) ==> {[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} incs {[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}
		a-->Stat13(Stat13*) ==> Stat14: (a in {[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))}) & (a notin ({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices)))
		(q1,u1,v1)-->Stat14(Stat14*) ==> Stat15: (q1 ¥incin on(b0,vertices)) & (u1 in domain(q1)) & (v1 in range(q1)) & (((u1 = v1) & Scycle(q1)) or ((u1 /= v1) & Straight(q1,u1,v1))) & ([u1,v1] notin ident(vertices)) & Stat16: ([u1,v1] notin {[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)})
		(q1,u1,v1)-->Stat16(Stat15*) ==> (u1 = v1) & Scycle(q1) & ([u1,v1] notin ident(vertices))
		Use_def(on)(Stat15*) ==> q1 ¥incin (vertices ¥PROD vertices)
		(q1,vertices,vertices)-->T141(Stat15*) ==> Stat17: (u1 = v1) & (u1 in vertices)
		Use_def(ident)(Stat15*) ==> Stat18: [u1,v1] notin {[x,x]: x in vertices}
	u1-->Stat18(Stat17) ==> false; Discharge ==> ({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) = ({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices))
	EQUAL(Stat12) ==> Stat19: (edges @ inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices))) /= (inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices)) @ edges)
	Suppose ==> Stat20: inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices)) /= inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) + ident(vertices)
		({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)},ident(vertices))-->T106 ==> AUTO
		EQUAL(Stat20) ==> inv(Un({{[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)},ident(vertices)})) = inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices))
		({{[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)},ident(vertices)})-->T110(Stat20*) ==> inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices)) = Un({inv(f): f in {{[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)},ident(vertices)}})
		APPLY() unionset_commuter(e(f)->inv(f),s->{[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) ==>
			Stat21: (FORALL t | {inv(f): f in {{[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)},t}} = {inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}),inv(t)})
		(ident(vertices))-->Stat21(Stat21*) ==> {inv(f): f in {{[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)},ident(vertices)}} = {inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}),inv(ident(vertices))}
		vertices-->T115(Stat20*) ==> inv(ident(vertices)) = ident(vertices)
		(inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}),ident(vertices))-->T106 ==> AUTO
	EQUAL(Stat20) ==> false; Discharge ==> inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices)) = inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) + ident(vertices)
	(edges,inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}),ident(vertices))-->T137 ==> AUTO
	(inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}),ident(vertices),edges)-->T136 ==> AUTO
	Assump ==> Stat22: edges ¥incin (vertices ¥PROD vertices)
	(edges,vertices,vertices)-->T141(Stat22*) ==> Is_map(edges) & (domain(edges) ¥incin vertices) & (range(edges) ¥incin vertices)
	(vertices,0,edges)-->T115(Stat22*) ==> ((edges @ ident(vertices)) = edges) & ((ident(vertices) @ edges)= edges)
--??	EQUAL(Stat19) ==> Stat23: (edges @ inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)})) /= (inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) @ edges)
	EQUAL(Stat19) ==> Stat24: ((edges @ inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)})) + edges) /= ((inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) @ edges) + edges)
	(Stat24*)ELEM ==> Stat23: (edges @ inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)})) /= (inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) @ edges)
	d-->Stat23(Stat23*) ==> (d in (edges @ inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}))) ¥neq (d in (inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) @ edges))
	Suppose ==> Stat25: (d in (edges @ inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}))) & (d notin (inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) @ edges))
		Use_def(@)(Stat25*) ==> Stat26: (d in {[car(x),cdr(y)]: x in inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}), y in edges | cdr(x) = car(y)}) & Stat27: (d notin {[car(x),cdr(y)]: x in edges, y in inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) | cdr(x) = car(y)})
		(x0,y0)-->Stat26(Stat26*) ==> (d = [car(x0),cdr(y0)]) & (x0 in inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)})) & (y0 in edges)
	Tsomehow ==> false; Discharge ==> Stat28: (d in (inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) @ edges)) & (d notin (edges @ inv({[u,v]: q ¥incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)})))
Tsomehow ==> false; Discharge ==> QED
--
Theorem labeledGraph9: (B in bisim_thryvar) ¥imp (trans_reflCl(B + inv(B), vertices) in bisim_thryvar). Proof:
Suppose_not(b0) ==> AUTO
	Use_def(bisim_thryvar) ==> Stat1: (b0 in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) &
		Stat2: (trans_reflCl(b0 + inv(b0),vertices) notin {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
	()-->Stat1(Stat1*) ==> Stat3: (b0 ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(b0)) = (inv(b0) @ edges)) & ((edges @ b0) = (b0 @ edges))
	(trans_reflCl(b0 + inv(b0),vertices))-->Stat2(Stat1,Stat1*) ==> (not(trans_reflCl(b0 + inv(b0),vertices) ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})) or (not(((edges @ inv(trans_reflCl(b0 + inv(b0),vertices))) = (inv(trans_reflCl(b0 + inv(b0),vertices)) @ edges)) & ((edges @ (trans_reflCl(b0 + inv(b0),vertices))) = ((trans_reflCl(b0 + inv(b0),vertices)) @ edges))))
	Suppose ==> Stat4: not(trans_reflCl(b0 + inv(b0),vertices) ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		c-->Stat4(Stat4*) ==> (c in trans_reflCl(b0 + inv(b0),vertices)) & (c notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		(b0 + inv(b0),vertices)-->T924(Stat4*) ==> Is_map(trans_reflCl(b0 + inv(b0),vertices))
		(trans_reflCl(b0 + inv(b0),vertices),c)-->T51(Stat4*) ==> (c = [car(c),cdr(c)])
		EQUAL(Stat4) ==> Stat5: ([car(c),cdr(c)] in trans_reflCl(b0 + inv(b0),vertices)) & Stat6: ([car(c),cdr(c)] notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		TlabeledGraph3(*) ==> Stat7: (FORALL r, x, y, v | (Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & ([x,y] in trans_reflCl(r + inv(r),v))) ¥imp SameTag_thryvar(x,y))
		(b0,b0 + inv(b0),vertices,vertices)-->T927(Stat4*) ==> [car(c),cdr(c)] in trans_reflCl(b0 + inv(b0),vertices)
		(b0,{[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})-->T52(Stat3,Stat3) ==> Is_map(b0)
		Suppose ==> Stat8: not(FORALL e in b0 | SameTag_thryvar(car(e),cdr(e)))
			e-->Stat8(Stat3*) ==> Stat9: (e in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & (not SameTag_thryvar(car(e),cdr(e)))
			(v,w)-->Stat9(Stat9*) ==> Stat10: (e = [v,w]) & SameTag_thryvar(v,w)
			(Stat10)ELEM ==> (v = car(e)) & (w = cdr(e))
		EQUAL(Stat9) ==> false; Discharge ==> (FORALL e in b0 | SameTag_thryvar(car(e),cdr(e)))
		(b0,car(c),cdr(c),vertices)-->Stat7(Stat7*) ==> Stat11: SameTag_thryvar(car(c),cdr(c))
		(b0 + inv(b0),vertices)-->T924(Stat5*) ==> [car(c),cdr(c)] in (vertices ¥PROD vertices)
		({[car(c),cdr(c)]},vertices,vertices)-->T141(Stat11*) ==> (domain({[car(c),cdr(c)]}) ¥incin vertices) & (range({[car(c),cdr(c)]}) ¥incin vertices)
		(car(c),cdr(c))-->T114(Stat11*) ==> (car(c) in vertices) & (cdr(c) in vertices)
	(car(c),cdr(c))-->Stat6(Stat11*) ==> false; Discharge ==> not(((edges @ inv(trans_reflCl(b0 + inv(b0),vertices))) = (inv(trans_reflCl(b0 + inv(b0),vertices)) @ edges)) & ((edges @ (trans_reflCl(b0 + inv(b0),vertices))) = ((trans_reflCl(b0 + inv(b0),vertices)) @ edges)))
	Use_def(trans_reflCl) ==> not(((edges @ inv(transCl(on(b0 + inv(b0),vertices)) + ident(vertices))) = (inv(transCl(on(b0 + inv(b0),vertices)) + ident(vertices)) @ edges)) & ((edges @ (transCl(on(b0 + inv(b0),vertices)) + ident(vertices))) = ((transCl(on(b0 + inv(b0),vertices)) + ident(vertices)) @ edges)))
	Use_def(transCl) ==> Stat12: ((edges @ inv({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices))) /= (inv({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges)) or
		((edges @ ({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices))) /= (({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges))
	Suppose ==> Stat13: (edges @ inv({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices))) /= (inv({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges)
		d-->Stat13(Stat13*) ==> (d in (edges @ inv({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)))) ¥neq (d in (inv({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges))
		Suppose ==> Stat14: (d in (edges @ inv({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)))) & (d notin (inv({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges))
			Use_def(@)(Stat14*) ==> Stat15: (d in {[car(x),cdr(y)]: x in inv({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)), y in edges | cdr(x) = car(y)}) & Stat16: (d notin {[car(x),cdr(y)]: x in edges, y in inv({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) | cdr(x) = car(y)})
		Tsomehow ==> false; Discharge ==> Stat17: (d in (inv({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges)) & (d notin (edges @ inv({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices))))
	Tsomehow ==> false; Discharge ==> Stat18: (edges @ ({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices))) /= (({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges)
	d1-->Stat18(Stat18*) ==> (d1 in (edges @ ({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)))) ¥neq (d1 in (({[u,v]: q ¥incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges))
Tsomehow ==> false; Discharge ==> QED
--
Theorem labeledGraph10: ((R in sim_thryvar) & (S in sim_thryvar)) ¥imp ((R + S) in sim_thryvar). Proof:
Suppose_not(r,t) ==> AUTO
	Use_def(sim_thryvar) ==> Stat1: (r in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) }) &
		Stat2: (t in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) }) &
		Stat3: ((r + t) notin {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) })
	()-->Stat1(Stat1*) ==> Stat4: (r ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(r)) = (inv(r) @ edges))
	()-->Stat2(Stat1*) ==> Stat5: (t ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(t)) = (inv(t) @ edges))
	()-->Stat3(Stat1*) ==> Stat6: ((edges @ inv(r + t)) /= (inv(r + t) @ edges))
	({r,t})-->T110(Stat6*) ==> inv(Un({r,t})) = Un({inv(f): f in {r,t}})
	APPLY() unionset_commuter(e(x)->inv(x),s->r) ==>
		Stat7: (FORALL t | {inv(f): f in {r,t}} = {inv(r),inv(t)})
	t-->Stat7 ==> {inv(f): f in {r,t}} = {inv(r),inv(t)}
	(r,t)-->T106(Stat6*) ==> Un({r,t}) = (r + t)
	(inv(r),inv(t))-->T106(Stat6*) ==> Un({inv(r),inv(t)}) = (inv(r) + inv(t))
	EQUAL(Stat6) ==> Stat8: inv(r + t) = (inv(r) + inv(t))
	(edges,inv(r),inv(t))-->T137(Stat6*) ==> Stat9: (edges @ (inv(r) + inv(t))) = ((edges @ inv(r)) + (edges @ inv(t)))
	(inv(r),inv(t),edges)-->T136(Stat6*) ==> Stat10: ((inv(r) + inv(t)) @ edges) = ((inv(r) @ edges) + (inv(t) @ edges))
EQUAL(Stat9,Stat10,Stat4,Stat5,Stat8,Stat6*) ==> false; Discharge ==> QED
--
Theorem labeledGraph11: ((R in bisim_thryvar) & (S in bisim_thryvar)) ¥imp ((R + S) in bisim_thryvar). Proof:
Suppose_not(r,t) ==> AUTO
	Use_def(bisim_thryvar) ==> Stat1: (r in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) &
		Stat2: (t in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) &
		Stat3: ((r + t) notin {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
	()-->Stat1(Stat1*) ==> Stat4: (r ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(r)) = (inv(r) @ edges)) & ((edges @ r) = (r @ edges))
	()-->Stat2(Stat1*) ==> Stat5: (t ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(t)) = (inv(t) @ edges)) & ((edges @ t) = (t @ edges))
	()-->Stat3(Stat1*) ==> ((edges @ inv(r + t)) /= (inv(r + t) @ edges)) or ((edges @ (r + t)) /= ((r + t) @ edges))
	Suppose ==> Stat6: (edges @ inv(r + t)) /= (inv(r + t) @ edges)
		({r,t})-->T110(Stat6*) ==> inv(Un({r,t})) = Un({inv(f): f in {r,t}})
		APPLY() unionset_commuter(e(x)->inv(x),s->r) ==>
			Stat7: (FORALL t | {inv(f): f in {r,t}} = {inv(r),inv(t)})
		t-->Stat7 ==> {inv(f): f in {r,t}} = {inv(r),inv(t)}
		(r,t)-->T106(Stat6*) ==> Un({r,t}) = (r + t)
		(inv(r),inv(t))-->T106(Stat6*) ==> Un({inv(r),inv(t)}) = (inv(r) + inv(t))
		EQUAL(Stat6) ==> Stat8: inv(r + t) = (inv(r) + inv(t))
		(edges,inv(r),inv(t))-->T137(Stat6*) ==> Stat9: (edges @ (inv(r) + inv(t))) = ((edges @ inv(r)) + (edges @ inv(t)))
		(inv(r),inv(t),edges)-->T136(Stat6*) ==> Stat10: ((inv(r) + inv(t)) @ edges) = ((inv(r) @ edges) + (inv(t) @ edges))
	EQUAL(Stat9,Stat10,Stat4,Stat5,Stat8,Stat6*) ==> false; Discharge ==> Stat11: (edges @ (r + t)) /= ((r + t) @ edges)
	(edges,r,t)-->T137(Stat11*) ==> Stat12: (edges @ (r + t)) = ((edges @ r) + (edges @ t))
	(r,t,edges)-->T136(Stat11*) ==> Stat13: ((r + t) @ edges) = ((r @ edges) + (t @ edges))
EQUAL(Stat12,Stat13,Stat4,Stat5,Stat11*) ==> false; Discharge ==> QED
--
Theorem labeledGraph12: (R in bisim_thryvar) ¥imp (inv(R) in bisim_thryvar). Proof:
Suppose_not(r) ==> AUTO
	Use_def(bisim_thryvar) ==> Stat1: (r in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) &
		Stat2: (inv(r) notin {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
	()-->Stat1(Stat1*) ==> Stat3: (r ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(r)) = (inv(r) @ edges)) & ((edges @ r) = (r @ edges))
	()-->Stat2(Stat1*) ==> (not(inv(r) ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})) or ((edges @ inv(inv(r))) /= (inv(inv(r)) @ edges))
	Suppose ==> Stat4: (edges @ inv(inv(r))) /= (inv(inv(r)) @ edges)
		TELEM ==> Is_map({[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		(r,{[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})-->T52(Stat3*) ==> Is_map(r)
		r-->T100(Stat4*) ==> inv(inv(r)) = r
	EQUAL(Stat3*) ==> false; Discharge ==> Stat5: not(inv(r) ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
	p-->Stat5(Stat5*) ==> Stat6: (p in inv(r)) & Stat7: (p notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
	Use_def(inv)(Stat5*) ==> Stat8: p in {[cdr(x),car(x)]: x in r}
	x1-->Stat8(Stat8,Stat3*) ==> Stat9: (x1 in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & (p = [cdr(x1),car(x1)])
	(v1,w1)-->Stat9(Stat9*) ==> (x1 = [v1,w1]) & (v1 in vertices) & (w1 in vertices) & SameTag_thryvar(v1,w1)
	(Stat9*)ELEM ==> Stat10: (p = [cdr(x1),car(x1)]) & (x1 = [v1,w1])
	(Stat10)ELEM ==> p = [w1,v1]
	TlabeledGraph3(Stat10*) ==> Stat11: (FORALL v, w | SameTag_thryvar(v,w) ¥eq (block_thryvar(v) = block_thryvar(w)))
	(v1,w1)-->Stat11(Stat9*) ==> block_thryvar(v1) = block_thryvar(w1)
	(w1,v1)-->Stat11(Stat9*) ==> SameTag_thryvar(w1,v1)
(w1,v1)-->Stat7(Stat9*) ==> false; Discharge ==> QED
--
Theorem labeledGraph13: Transitive(bisimilar_thryvar) & Symmetric(bisimilar_thryvar) & Reflexive(bisimilar_thryvar,vertices). Proof:
Suppose_not ==> AUTO
	Suppose ==> not(Transitive(bisimilar_thryvar))
--
-- To see that $bisimilar_thryvar$ is a transitive relation,
-- we argue as follows. If it were not, then there would exist
-- bisimulations $b3$, $b4$ and pairs $x1=[v,xy],y1=[xy,w]$
-- of vertices with $x1 in b3$, $y1 in b4$ such that the pair
-- $r=[v,w]$ belongs to no bisimulations. It is easily
-- recognized that $v /= xy$ and $w /= xy$.
--
 		Use_def(Transitive) ==> Stat1: not((bisimilar_thryvar @ bisimilar_thryvar) ¥incin bisimilar_thryvar)
		r-->Stat1(Stat1*) ==> Stat2: (r in (bisimilar_thryvar @ bisimilar_thryvar)) & (r notin bisimilar_thryvar)
		Use_def(bisimilar_thryvar)(Stat2*) ==> Stat3: (r in (Un(bisim_thryvar) @ Un(bisim_thryvar))) & (r notin Un(bisim_thryvar))
		Use_def(@) ==> Stat4: r in {[car(x),cdr(y)]: x in Un(bisim_thryvar), y in Un(bisim_thryvar) | cdr(x) = car(y)}
		(x1,y1)-->Stat4(Stat4*) ==> Stat5: (r = [car(x1),cdr(y1)]) & (x1 in Un(bisim_thryvar)) & (y1 in Un(bisim_thryvar)) & (cdr(x1) = car(y1))
		Use_def(Un)(Stat3*) ==> Stat6: ([car(x1),cdr(y1)] notin {p: b in bisim_thryvar, p in b}) & Stat7: (x1 in {p: b in bisim_thryvar, p in b}) & Stat8: (y1 in {p: b in bisim_thryvar, p in b})
		(b3,p3)-->Stat7(Stat6*) ==> Stat9: (x1 in b3) & (b3 in bisim_thryvar)
		(b4,p4)-->Stat8(Stat6*) ==> Stat10: (y1 in b4) & (b4 in bisim_thryvar)
		b3-->TlabeledGraph4(Stat9,Stat9*) ==> Stat11: x1 in (vertices ¥PROD vertices)
		b4-->TlabeledGraph4(Stat10,Stat10*) ==> y1 in (vertices ¥PROD vertices)
		({x1,y1},vertices,vertices)-->T141(Stat11*) ==> Is_map({x1,y1}) & (domain({x1,y1}) ¥incin vertices) & (range({x1,y1}) ¥incin vertices)
		({x1,y1},x1)-->T51(Stat11*) ==> Stat12: x1 = [car(x1),cdr(x1)]
		({x1,y1},y1)-->T51(Stat11*) ==> Stat13: y1 = [car(y1),cdr(y1)]
		Suppose ==> car(y1) = cdr(y1)
			EQUAL(Stat4*) ==> Stat14: x1 notin {p: b in bisim_thryvar, p in b}
		(b3,x1)-->Stat14(Stat9*) ==> false; Discharge ==> Stat15: car(y1) /= cdr(y1)
		Suppose ==> car(x1) = cdr(x1)
			EQUAL(Stat4*) ==> Stat16: y1 notin {p: b in bisim_thryvar, p in b}
		(b4,y1)-->Stat16(Stat10*) ==> false; Discharge ==> Stat17: car(x1) /= cdr(x1)
--
-- Then, since the transitive-reflexive closure of $b3+b4$ is a bisimulation,
-- the pair $r = [car(x1),cdr(y1)]$ does not belong to such set.
--
		(b3,b4)-->TlabeledGraph11(Stat6*) ==> (b3 + b4) in bisim_thryvar
		(b3 + b4)-->TlabeledGraph9(Stat6*) ==> Stat18: trans_reflCl((b3 + b4) + inv(b3 + b4), vertices) in bisim_thryvar
		(trans_reflCl((b3 + b4) + inv(b3 + b4), vertices),[car(x1),cdr(y1)])-->Stat6(Stat6,Stat18*) ==> [car(x1),cdr(y1)] notin (trans_reflCl((b3 + b4) + inv(b3 + b4), vertices))
		Use_def(trans_reflCl)(Stat18*) ==> [car(x1),cdr(y1)] notin (transCl(on((b3 + b4) + inv(b3 + b4),vertices)) + ident(vertices))
		Use_def(transCl)(Stat18*) ==> Stat19: ([car(x1),cdr(y1)] notin {[x,y]: q ¥incin on((b3 + b4) + inv(b3 + b4),vertices), x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}) & ([car(x1),cdr(y1)] notin ident(vertices))
--
-- This implies, since $car(x1) in vertices$ and $cdr(y1) in vertices$,
-- that ${x1,y1}$ is neither a cycle nor a straight path leading from
-- $car(x1)$ to $cdr(y1)$. In brief, this path is not acyclic.
--
		Suppose ==> Stat20: car(x1) = cdr(y1)
			EQUAL(Stat20,Stat19) ==> [car(x1),car(x1)] notin ident(vertices)
			Use_def(ident)(Stat20*) ==> Stat21: [car(x1),car(x1)] notin {[x,x]: x in vertices}
			Suppose ==> Stat22: car(x1) notin domain({x1,y1})
				Use_def(domain)(Stat22*) ==> Stat23: car(x1) notin {car(x): x in {x1,y1}}
			x1-->Stat23(Stat23*) ==> false; Discharge ==> car(x1) in vertices
		(car(x1))-->Stat21(Stat21*) ==> false; Discharge ==> Stat24: car(x1) /= cdr(y1)
--
		({x1,y1},car(x1),cdr(y1))-->Stat19(Stat19*) ==> Stat25: (not({x1,y1} ¥incin on((b3 + b4) + inv(b3 + b4),vertices))) or (car(x1) notin domain({x1,y1})) or (cdr(y1) notin range({x1,y1})) or (not(((car(x1) = cdr(y1)) & Scycle({x1,y1})) or ((car(x1) /= cdr(y1)) & Straight({x1,y1},car(x1),cdr(y1)))))
		Suppose ==> car(x1) notin domain({x1,y1})
			Use_def(domain)(Stat19*) ==> Stat26: car(x1) notin {car(x): x in {x1,y1}}
		x1-->Stat26(Stat26*) ==> false; Discharge ==> car(x1) in domain({x1,y1})
		Suppose ==> cdr(y1) notin range({x1,y1})
			Use_def(range)(Stat19*) ==> Stat27: cdr(y1) notin {cdr(x): x in {x1,y1}}
		y1-->Stat27(Stat27*) ==> false; Discharge ==> cdr(y1) in range({x1,y1})
		Suppose ==> Stat28: not({x1,y1} ¥incin on((b3 + b4) + inv(b3 + b4),vertices))
			z-->Stat28(Stat28*) ==> (z in {x1,y1}) & (z notin on((b3 + b4) + inv(b3 + b4),vertices))
			Use_def(on)(Stat28*) ==> (z notin (b3 + b4) + inv(b3 + b4)) or (z notin (vertices ¥PROD vertices))
			(Stat6*)ELEM ==> z notin (vertices ¥PROD vertices)
			b3-->TlabeledGraph4(Stat9,Stat9*) ==> x1 in (vertices ¥PROD vertices)
		b4-->TlabeledGraph4(Stat10*) ==> false; Discharge ==> {x1,y1} ¥incin on((b3 + b4) + inv(b3 + b4),vertices)
		(Stat24*)ELEM ==> Stat29: (not Straight({x1,y1},car(x1),cdr(y1)))
--
-- However, the acyclicity of the said path follows readily from Theorem 911,
-- which leads to a contradiction proving that $bisimilar_thryvar$ is a
-- transitive relation. We are then left with the tasks of showing that
-- $bisimilar_thryvar$ is also symmetric and reflexive.
--
		EQUAL(Stat13,Stat12,Stat5,Stat29) ==> (not(Straight({[car(x1),cdr(x1)],[cdr(x1),cdr(y1)]},car(x1),cdr(y1))))
		(car(x1),cdr(x1),cdr(y1))-->T913(Stat25*) ==> Stat30: (not Acyclic({[car(x1),cdr(x1)],[cdr(x1),cdr(y1)]}))
--		Suppose ==> Stat20: car(x1) = cdr(y1)
--			EQUAL(Stat20,Stat19) ==> [car(x1),car(x1)] notin ident(vertices)
--			Use_def(ident)(Stat20*) ==> Stat21: [car(x1),car(x1)] notin {[x,x]: x in vertices}
--			Suppose ==> Stat22: car(x1) notin domain({x1,y1})
--				Use_def(domain)(Stat22*) ==> Stat23: car(x1) notin {car(x): x in {x1,y1}}
--			x1-->Stat23(Stat23*) ==> false; Discharge ==> car(x1) in vertices
--		(car(x1))-->Stat21(Stat21*) ==> false; Discharge ==> Stat24: car(x1) /= cdr(y1)
	(car(x1),cdr(x1),cdr(y1))-->T911(Stat15,Stat17,Stat5,Stat24,Stat30*) ==> false; Discharge ==> not(Symmetric(bisimilar_thryvar) & Reflexive(bisimilar_thryvar,vertices))
	Suppose ==> Stat31: not(Symmetric(bisimilar_thryvar))
		Use_def(Symmetric)(Stat31*) ==> Stat32: not(inv(bisimilar_thryvar) ¥incin bisimilar_thryvar)
		s-->Stat32(Stat32*) ==> Stat33: (s in inv(bisimilar_thryvar)) & (s notin bisimilar_thryvar)
		Use_def(bisimilar_thryvar)(Stat33*) ==> Stat34: (s in inv(Un(bisim_thryvar))) & (s notin Un(bisim_thryvar))
		Use_def(bisim_thryvar)(Stat34*) ==> Stat35: (s in inv(Un({b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }))) &
			Stat36: (s notin Un({b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }))
		Suppose ==> inv(Un({b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })) = Un({b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
		EQUAL(Stat35*) ==> false; Discharge ==> Stat37: inv(Un({b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })) /= Un({b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
		({b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })-->T110(Stat37*) ==> Stat38: Un({inv(b): b in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }}) /= Un({b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
		Suppose ==> {inv(b): b in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }} = {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
		EQUAL(Stat38) ==> false; Discharge ==> Stat39: {inv(b): b in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }} /= {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
		b1-->Stat39(Stat39*) ==> (b1 in {inv(b): b in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }}) ¥eq (b1 notin {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
		SIMPLF ==> (b1 in {inv(b): b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) ¥eq (b1 notin {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
		TELEM ==> Stat40: Is_map({[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		TlabeledGraph3(Stat40,Stat40*) ==> Stat41: (FORALL v, w | SameTag_thryvar(v,w) ¥eq (block_thryvar(v) = block_thryvar(w)))
		Suppose ==> Stat42: (b1 in {inv(b): b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) & Stat43: (b1 notin {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
			b2-->Stat42(Stat42*) ==> Stat44: (b1 = inv(b2)) & (b2 ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(b2)) = (inv(b2) @ edges)) & ((edges @ b2) = (b2 @ edges))
			(b2,{[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})-->T52(Stat40,Stat44*) ==> Is_map(b2)
			b2-->T100(Stat44*) ==> inv(inv(b2)) = b2
			()-->Stat43(Stat42*) ==> (not(b1 ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})) or ((edges @ inv(b1)) /= (inv(b1) @ edges)) or ((edges @ b1) /= (b1 @ edges))
			Suppose ==> (edges @ inv(b1)) /= (inv(b1) @ edges)
			EQUAL(Stat42*) ==> false; Discharge ==> (edges @ inv(b1)) = (inv(b1) @ edges)
			Suppose ==> (edges @ b1) /= (b1 @ edges)
			EQUAL(Stat42*) ==> false; Discharge ==> (edges @ b1) = (b1 @ edges)
			(Stat42*)ELEM ==> Stat45: not(b1 ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
			p-->Stat45(Stat45*) ==> Stat46: (p in b1) & Stat47: (p notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
			Use_def(inv)(Stat44,Stat46*) ==> Stat48: p in {[cdr(x),car(x)]: x in b2}
			xp-->Stat48(Stat44*) ==> Stat49: (p = [cdr(xp),car(xp)]) & Stat50: (xp in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
			(v1,w1)-->Stat50(Stat49*) ==> (xp = [v1,w1]) & (v1 in vertices) & (w1 in vertices) & SameTag_thryvar(v1,w1)
			(Stat49*)ELEM ==> Stat51: (p = [cdr(xp),car(xp)]) & (xp = [v1,w1])
			(Stat51)ELEM ==> p = [w1,v1]
			(w1,v1)-->Stat47(Stat46*) ==> not(SameTag_thryvar(w1,v1))
			(w1,v1)-->Stat41(Stat49*) ==> block_thryvar(v1) /= block_thryvar(w1)
		(v1,w1)-->Stat41(Stat49*) ==> false; Discharge ==> Stat52: (b1 in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) & Stat53: (b1 notin {inv(b): b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
		()-->Stat52(Stat52*) ==> Stat54: (b1 ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(b1)) = (inv(b1) @ edges)) & ((edges @ b1) = (b1 @ edges))
		(b1,{[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})-->T52(Stat40,Stat54*) ==> Is_map(b1)
		b1-->T100(Stat54*) ==> inv(inv(b1)) = b1
		(inv(b1))-->Stat53(Stat52*) ==> (not(inv(b1) ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})) or ((edges @ inv(inv(b1))) /= (inv(inv(b1)) @ edges))
		Suppose ==> (edges @ inv(inv(b1))) /= (inv(inv(b1)) @ edges)
		EQUAL(Stat54*) ==> false; Discharge ==> Stat55: not(inv(b1) ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		q-->Stat55(Stat55*) ==> Stat56: (q in inv(b1)) & Stat57: (q notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		Use_def(inv)(Stat56*) ==> Stat58: q in {[cdr(x),car(x)]: x in b1}
		x2-->Stat58(Stat54*) ==> Stat59: (q = [cdr(x2),car(x2)]) & Stat60: (x2 in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		(v2,w2)-->Stat60(Stat59*) ==> (x2 = [v2,w2]) & (v2 in vertices) & (w2 in vertices) & SameTag_thryvar(v2,w2)
		(Stat59*)ELEM ==> Stat61: (q = [cdr(x2),car(x2)]) & (x2 = [v2,w2])
		(Stat61)ELEM ==> q = [w2,v2]
		(w2,v2)-->Stat57(Stat56*) ==> not(SameTag_thryvar(w2,v2))
		(w2,v2)-->Stat41(Stat59*) ==> block_thryvar(v2) /= block_thryvar(w2)
	(v2,w2)-->Stat41(Stat59*) ==> false; Discharge ==> Stat62: not(Reflexive(bisimilar_thryvar,vertices))
	Use_def(Reflexive)(Stat62*) ==> Stat63: not(bisimilar_thryvar incs ident(vertices))
	t-->Stat63(Stat63*) ==> Stat64: (t in ident(vertices)) & (t notin bisimilar_thryvar)
	Use_def(ident)(Stat64*) ==> Stat65: t in {[x,x]: x in vertices}
	x0-->Stat65(Stat65*) ==> Stat66: (x0 in vertices) & (t = [x0,x0])
	TlabeledGraph4(Stat65*) ==> 0 in bisim_thryvar
	0-->TlabeledGraph9(Stat65*) ==> trans_reflCl(0 + inv(0), vertices) in bisim_thryvar
	Use_def(trans_reflCl)(Stat66*) ==> ident(vertices) ¥incin trans_reflCl(0 + inv(0), vertices)
	bisim_thryvar-->T274(Stat65*) ==> Stat67: (FORALL x in bisim_thryvar | x ¥incin Un(bisim_thryvar))
	(trans_reflCl(0 + inv(0),vertices))-->Stat67(Stat64*) ==> Stat68: [x0,x0] in Un(bisim_thryvar)
Use_def(bisimilar_thryvar)(Stat64,Stat66,Stat68*) ==> false; Discharge ==> QED
--
Theorem labeledGraph14: Transitive(similar_thryvar) & Symmetric(similar_thryvar) & Reflexive(similar_thryvar,vertices). Proof:
Suppose_not ==> AUTO
	Suppose ==> not(Transitive(similar_thryvar))
--
-- To see that $similar_thryvar$ is a transitive relation,
-- we argue as follows. If it were not, then there would exist
-- bisimulations $b3$, $b4$ and pairs $x1=[v,xy],y1=[xy,w]$
-- of vertices with $x0 in b3$, $y0 in b4$ such that the pair
-- $r=[v,w]$ belongs to no simulations. It is easily
-- recognized that $v /= xy$ and $w /= xy$.
--
		Use_def(Transitive) ==> Stat1: not((similar_thryvar @ similar_thryvar) ¥incin similar_thryvar)
		r-->Stat1(Stat1*) ==> Stat2: (r in (similar_thryvar @ similar_thryvar)) & (r notin similar_thryvar)
		Use_def(similar_thryvar)(Stat2*) ==> Stat3: (r in ((Un(sim_thryvar) * inv(Un(sim_thryvar))) @ (Un(sim_thryvar) * inv(Un(sim_thryvar))))) & (r notin (Un(sim_thryvar) * inv(Un(sim_thryvar))))
		Use_def(@) ==> Stat4: r in {[car(x),cdr(y)]: x in (Un(sim_thryvar) * inv(Un(sim_thryvar))), y in (Un(sim_thryvar) * inv(Un(sim_thryvar))) | cdr(x) = car(y)}
		(x0,y0)-->Stat4(Stat4*) ==> Stat5: (r = [car(x0),cdr(y0)]) & (x0 in (Un(sim_thryvar) * inv(Un(sim_thryvar)))) & (y0 in (Un(sim_thryvar) * inv(Un(sim_thryvar)))) & (cdr(x0) = car(y0))
		Use_def(Un)(Stat3*) ==> Stat6: ([car(x0),cdr(y0)] notin ({p: b in sim_thryvar, p in b} * inv({p: b in sim_thryvar, p in b}))) & Stat7: (x0 in ({p: b in sim_thryvar, p in b} * inv({p: b in sim_thryvar, p in b}))) & Stat8: (y0 in ({p: b in sim_thryvar, p in b} * inv({p: b in sim_thryvar, p in b})))
	Tsomehow ==> false; Discharge ==> not(Symmetric(similar_thryvar) & Reflexive(similar_thryvar,vertices))
	Suppose ==> Stat9: not(Symmetric(similar_thryvar))
		Use_def(Symmetric)(Stat9*) ==> Stat10: not(inv(similar_thryvar) ¥incin similar_thryvar)
		s-->Stat10(Stat10*) ==> Stat11: (s in inv(similar_thryvar)) & (s notin similar_thryvar)
		Use_def(inv)(Stat11*) ==> s in {[cdr(p),car(p)]: p in similar_thryvar}
		Use_def(similar_thryvar)(Stat11*) ==> Stat12: (s in {[cdr(p),car(p)]: p in (Un(sim_thryvar) * inv(Un(sim_thryvar)))}) & (s notin (Un(sim_thryvar) * inv(Un(sim_thryvar))))
		p-->Stat12(Stat12*) ==> (p in (Un(sim_thryvar) * inv(Un(sim_thryvar)))) & ([cdr(p),car(p)] notin (Un(sim_thryvar) * inv(Un(sim_thryvar))))
		sim_thryvar-->T110(Stat12*) ==> (p in (Un(sim_thryvar) * Un({inv(f): f in sim_thryvar}))) & ([cdr(p),car(p)] notin (Un(sim_thryvar) * Un({inv(f): f in sim_thryvar})))
		Use_def(Un)(Stat12*) ==> Stat13: (p in {x: y in sim_thryvar, x in y}) & (p in {x: y in {inv(f): f in sim_thryvar}, x in y}) & (([cdr(p),car(p)] notin {x: y in sim_thryvar, x in y}) or ([cdr(p),car(p)] notin {x: y in {inv(f): f in sim_thryvar}, x in y}))
		(r1,x1,t,x2)-->Stat13(Stat13*) ==> Stat14: (r1 in sim_thryvar) & (p in r1) & (p in t) & Stat15: (t in {inv(f): f in sim_thryvar})
		Suppose ==> Stat16: [cdr(p),car(p)] notin {x: y in sim_thryvar, x in y}
			r2-->Stat15(Stat14*) ==> Stat17: (r2 in sim_thryvar) & (t = inv(r2))
			Use_def(inv)(Stat14*) ==> Stat18: p in {[cdr(q),car(q)]: q in r2}
			q-->Stat18(Stat18) ==> ([cdr(p),car(p)] = [car(q),cdr(q)]) & (q in r2)
			Use_def(sim_thryvar)(Stat14*) ==> Stat19: r2 in {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) }
			()-->Stat19(Stat14*) ==> Stat20: q in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}
			(v,w)-->Stat20(Stat20) ==> q = [car(q),cdr(q)]
		(r2,q)-->Stat16(Stat17*) ==> false; Discharge ==> [cdr(p),car(p)] in {x: y in sim_thryvar, x in y}
		(Stat13*)ELEM ==> Stat21: [cdr(p),car(p)] notin {x: y in {inv(f): f in sim_thryvar}, x in y}
		SIMPLF(Stat21*) ==> Stat22: [cdr(p),car(p)] notin {x: f in sim_thryvar, x in inv(f)}
		(r1,[cdr(p),car(p)])-->Stat22(Stat14*) ==> [cdr(p),car(p)] notin inv(r1)
		Use_def(inv)(Stat22*) ==> Stat23: [cdr(p),car(p)] notin {[cdr(q),car(q)]: q in r1}
	p-->Stat23(Stat14*) ==> false; Discharge ==> Stat24: not(Reflexive(similar_thryvar,vertices))
	TlabeledGraph13(Stat24*) ==> Reflexive(bisimilar_thryvar,vertices)
	Use_def(Reflexive)(Stat24*) ==> Stat25: (not(similar_thryvar incs ident(vertices))) & (bisimilar_thryvar incs ident(vertices))
TlabeledGraph7(Stat25*) ==> false; Discharge ==> QED
--
--
--DISPLAY labeledGraph
--
--THEORY labeledGraph(vertices,edges,tags)
--	edges ¥incin (vertices ¥PROD vertices)
--	vertices ¥incin Un(tags)
--	(FORALL x in tags, y in tags | (x /= y) ¥imp ((x * y) = 0))
--==>(tag2_thryvar,block_thryvar,SameTag_thryvar,bisim_thryvar,bisimilar_thryvar,sim_thryvar,similar_thryvar)
--	(FORALL e | (e in edges) ¥imp ((e = [car(e),cdr(e)]) & (car(e) in vertices) & (cdr(e) in vertices)))
--	(FORALL v | (EXISTS y | (v in vertices) ¥imp ((y in tags) & (v in y))))
--	(FORALL x, y | ((x in tags) & (y in tags) & (x /= y)) ¥imp ((x * y) = 0))
--	(FORALL v | Is_vertex(v) ¥imp (Is_tag(tag2_thryvar(v)) & (v in tag2_thryvar(v))))
--	(FORALL v | block_thryvar(v) = if Is_vertex(v) then {w in tag2_thryvar(v) | Is_vertex(w)} else 0 end if)
--	(FORALL v, w | SameTag_thryvar(v,w) ¥eq (block_thryvar(v) = block_thryvar(w)))
--	(FORALL v | SameTag_thryvar(v,v))
--	(FORALL q, r, x | ((q ¥incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & (x in domain(q))) ¥imp SameTag_thryvar(x,(q~[x])))
--	(FORALL q, r, x, y | ((q ¥incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & Straight(q,x,y)) ¥imp SameTag_thryvar(x,y))
--	(FORALL r, x, y, v | (Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & ([x,y] in trans_reflCl(r + inv(r),v))) ¥imp SameTag_thryvar(x,y))
--	bisim_thryvar = {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
--	bisimilar_thryvar := Un(bisim_thryvar)
--	sim_thryvar := {b ¥incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) }
--	similar_thryvar := Un(sim_thryvar) * inv(Un(sim_thryvar))
--
--	(FORALL x | (0 in bisim_thryvar) & (bisim_thryvar ¥incin sim_thryvar) & ((x in bisim_thryvar) ¥imp (x ¥incin (vertices ¥PROD vertices))))
--	(FORALL b | (b in bisim_thryvar) ¥imp (b ¥incin bisimilar_thryvar))
--	(FORALL b | (b in bisim_thryvar) ¥imp (inv(b) in bisim_thryvar))
--	bisimilar_thryvar ¥incin similar_thryvar
--	(FORALL b | (b in sim_thryvar) ¥imp (trans_reflCl(b,vertices) in sim_thryvar))
--	(FORALL b | (b in bisim_thryvar) ¥imp (trans_reflCl(b + inv(b), vertices) in bisim_thryvar))
--	(FORALL r, s | ((r in sim_thryvar) & (s in sim_thryvar)) ¥imp ((r + s) in sim_thryvar))
--	(FORALL r, s | ((r in bisim_thryvar) & (s in bisim_thryvar)) ¥imp ((r + s) in bisim_thryvar))
--	(FORALL r | (r in bisim_thryvar) ¥imp (inv(r) in bisim_thryvar))
--	Transitive(bisimilar_thryvar) & Symmetric(bisimilar_thryvar) & Reflexive(bisimilar_thryvar,vertices)
--	Transitive(similar_thryvar) & Symmetric(similar_thryvar) & Reflexive(similar_thryvar,vertices)
--END labeledGraph
--
ENTER_THEORY Set_theory
--
--
--
--
Def 10061: [Map Image] Def(G ¥IM D) := {cdr(p): p in G | car(p) in D}
--
Theorem 931: [Domains and ranges of direct image] range(G)=(G ¥IM D) + (G ¥IM (domain(G)-D)). Proof:
Suppose_not(g,d) ==> AUTO
        Use_def(range(g)) ==> AUTO
        Use_def(¥IM) ==> Stat1: {cdr(p): p in g} /= {cdr(p): p in g | car(p) in d} + {cdr(p): p in g | car(p) in (domain(g)-d)}
        Set_monot ==> {cdr(p): p in g} incs ({cdr(p): p in g | car(p) in d} + {cdr(p): p in g | car(p) in (domain(g)-d)})
--
-- For, supposing the contrary of the desired statement, we reach a contradiction as follows.
-- Observe that the supposed inequality, can only be satisfied as the negated inclusion shown below,
-- because monotonicity insures us that ${cdr(p): p in g}$ includes both
-- ${cdr(p): p in g | car(p) in d}$
-- and ${cdr(p): p in g} incs {cdr(p): p in g | car(p) in (domain(g)-d)}$.
--
        (Stat1*)ELEM ==> Stat2: {cdr(p): p in g} ¥nincin
                        ({cdr(p): p in g | car(p) in d} + {cdr(p): p in g | car(p) in (domain(g)-d)})
--
-- But then we can pick an element $q$ in the right-hand side of this negated inclusion which
-- does not belong to the right-hand side...
--
        q-->Stat2(Stat2*) ==> Stat3: (q in {cdr(p): p in g}) &
                                Stat4: (q notin {cdr(p): p in g | car(p) in d}) &
                                        Stat5: (q notin {cdr(p): p in g | car(p) in (domain(g)-d)})
--
-- ...and then, by the suitable replacements within set-formers, and by resorting to
-- the definition of domain, we get a contradiction which concludes our proof.
--
        Use_def(domain(g)) ==> AUTO
        (p,p,p)-->Stat3(Stat3*) ==> Stat6: (p in g) & (car(p) notin d) & Stat7: (car(p) notin {car(p): p in g})
p-->Stat7(Stat6*) ==> false; Discharge ==> QED
--
Def 10069: [Injective map predicate] Inj(F) := (FORALL x in F, y in F | (cdr(x)=cdr(y)) ¥imp (x=y))
--
Theorem 932: [Domain decomposition of a map range] ((D*E=0) & Inj(G)) ¥imp ((G ¥IM D) * (G ¥IM E) = 0). Proof:
Suppose_not(d,e,g) ==> (d*e=0) & Inj(g) & ((g ¥IM d) * (g ¥IM e) /= 0)
	Use_def(Inj) ==> Stat1: (d*e=0) & (FORALL x in g, y in g | (cdr(x)=cdr(y)) ¥imp (x=y)) & ((g ¥IM d) * (g ¥IM e) /= 0)
	Use_def(¥IM) ==> Stat2: (d*e=0) &
			Stat3: (FORALL x in g, y in g | (cdr(x)=cdr(y)) ¥imp (x=y)) &
			Stat4: ({cdr(x): x in g | car(x) in d} * {cdr(y): y in g | car(y) in e} /= 0)
	q-->Stat4(Stat2*) ==> Stat5: (q in {cdr(x): x in g | car(x) in d}) & (q in {cdr(y): y in g | car(y) in e})
	(x0,y0)-->Stat5(Stat5*) ==> Stat6: (x0 in g) & (y0 in g) & (car(x0) in d) & (car(y0) in e) &
			(cdr(x0) = cdr(y0))
	(x0,y0)-->Stat3(Stat6,Stat6) ==> Stat7: car(x0) = car(y0)
(Stat2,Stat6,Stat7*)Discharge ==>QED
--
Theorem 933: [Direct image of a domain element] (X in domain(G)) ¥imp (G ¥IM {X} /=0). Proof:
Suppose_not(a,g) ==> AUTO
--
-- For, assuming the contrary would openly contradict the definitions.
--
        Use_def(domain(g)) ==> AUTO
        Use_def(¥IM) ==> Stat1: (a in {car(x): x in g}) & ({cdr(x): x in g | car(x) in {a}} = 0)
(x,x)-->Stat1 ==> false; Discharge ==>QED
--
Theorem 934: [Range of a restricted direct map] G ¥IM D = range(G ¥ON D). Proof:
Suppose_not(g,d) ==> AUTO
	Use_def(range(g ¥ON d)) ==> AUTO
	Use_def(¥ON) ==> (g ¥IM d) /= {cdr(x): x in {p in g | car(p) in d}}
	SIMPLF ==> (g ¥IM d) /= {cdr(p): p in g | car(p) in d}
Use_def(¥IM) ==> false; Discharge ==> QED
--
Theorem 935: [Monotonicity of direct image] (B ¥incin A) ¥imp ((G ¥IM B) ¥incin (G ¥IM A)). Proof:
Suppose_not(b,a,g) ==> AUTO
	Set_monot ==> {cdr(p): p in g | car(p) in b} ¥incin {cdr(p): p in g | car(p) in a}
Use_def(¥IM) ==> false; Discharge ==> QED
--
Def modal1: [single step in the evaluation of a modal proposition] m_value(Op,U,W,R) := if Op = 0 then U elseif Op = 1 then W - U else {x in W | U incs (R ¥IM {x})} end if
--
Def modal2: [recursive evaluation of modal proposition] m_eval(E,W,R,M) := if E in domain(M) then M~[E] else m_value(arb(E * cumstr(0,Za)),Un({m_eval(y,W,R,M): y in E | y notin cumstr(0,Za)}),W,R,M) end if
--

--
Def 16100: [intersection of a nonnull family of sets] int(X) := {u in arb(X) | (FORALL v in X | u in v)}
--
Def 16101: [property of being and odd ordinal] Odd(X) := (EXISTS v in X | (not Odd(v)) & (X = v + {v}))
--
Theorem 936: (0 in Za) &
	(FORALL x | (x in Za) ¥imp ((x ¥PLUS 0) = x)) &
	(FORALL x,y | ((x in Za) & (y in Za)) ¥imp ((x ¥PLUS y) = (y ¥PLUS x))) &
	(FORALL x,y | ((x in Za) & (y in Za)) ¥imp ((x ¥PLUS y) in Za)) &
	(FORALL x,y,z | ((x in Za) & (y in Za) & (z in Za)) ¥imp (((x ¥PLUS y) ¥PLUS z) = (x ¥PLUS (y ¥PLUS z)))). Proof:
Suppose_not ==> AUTO
	ALGEBRA ==> 0 in Za
	Suppose ==> Stat1: not(FORALL x | (x in Za) ¥imp ((x ¥PLUS 0) = x))
		x1-->Stat1(Stat1*) ==> (x1 in Za) & ((x1 ¥PLUS 0) /= x1)
	ALGEBRA(Stat1) ==> (x1 ¥PLUS 0) = x1; Discharge ==> AUTO
	Suppose ==> Stat2: not(FORALL x,y | ((x in Za) & (y in Za)) ¥imp ((x ¥PLUS y) = (y ¥PLUS x)))
		(x2,y2)-->Stat2(Stat2*) ==> (x2 in Za) & (y2 in Za) & ((x2 ¥PLUS y2) /= (y2 ¥PLUS x2))
	ALGEBRA(Stat2) ==> (x2 ¥PLUS y2) = (y2 ¥PLUS x2); Discharge ==> AUTO
	Suppose ==> Stat3: not(FORALL x,y | ((x in Za) & (y in Za)) ¥imp ((x ¥PLUS y) in Za))
		(x3,y3)-->Stat3(Stat3*) ==> (x3 in Za) & (y3 in Za) & ((x3 ¥PLUS y3) notin Za)
	ALGEBRA(Stat3) ==> (x3 ¥PLUS y3) in Za; Discharge ==> Stat4:
		not(FORALL x,y,z | ((x in Za) & (y in Za) & (z in Za)) ¥imp (((x ¥PLUS y) ¥PLUS z) = (x ¥PLUS (y ¥PLUS z))))
	(x4,y4,z4)-->Stat4(Stat4*) ==> (x4 in Za) & (y4 in Za) & (z4 in Za) & (((x4 ¥PLUS y4) ¥PLUS z4) /= (x4 ¥PLUS (y4 ¥PLUS z4)))
	ALGEBRA(Stat4) ==> ((x4 ¥PLUS y4) ¥PLUS z4) = (x4 ¥PLUS (y4 ¥PLUS z4)); Discharge ==> QED
--
APPLY(sigma_thryvar:sumZa) sigma_theory(s->Za,pluz(i,j)->(i ¥PLUS j),e->0) ==>
Theorem 937: (FORALL f | (Finite(f) & (range(f) ¥incin Za)) ¥imp (sumZa(f) in Za)) &
	(FORALL x | (cdr(x) in Za) ¥imp (sumZa({x}) = cdr(x))) &
	(FORALL f,t | (Finite(f) & Is_map(f) & (range(f) ¥incin Za)) ¥imp (sumZa(f) = (sumZa(f ¥ON (domain(f) * t)) ¥PLUS sumZa(f ¥ON (domain(f) - t))))) &
	(FORALL c,f | ((c in f) & Finite(f) & (range(f) ¥incin Za)) ¥imp (sumZa(f) = (sumZa(f - {c}) ¥PLUS cdr(c)))) &
	(FORALL f,g | (Finite(f) & Svm(f) & Svm(g) & (domain(f) = domain(g)) & (range(f) ¥incin Za)) ¥imp
		(sumZa(f) = sumZa({[y,sumZa(f ¥ON (g ¥INV_IM {y}))]: y in range(g)}))) &
	(FORALL f,g | (Finite(f) & Svm(f) & one_1_map(g) & (domain(f) = domain(g)) & (range(f) ¥incin Za)) ¥imp
		(sumZa(f) = sumZa({[y,f~[inv(g)~[y]]]: y in range(g)})))
--
Theorem 938: [basic inclusion-exclusion lemma for two sets] (Finite(X + Y) ¥imp (#(X + Y) = ((#X ¥PLUS #Y) ¥MINUS #(X * Y)))) &
	((#(X + Y) ¥PLUS #(X * Y)) = (#X ¥PLUS #Y)). Proof+:
Suppose_not(x0,y0) ==> AUTO
--
-- The second part of the assertion can be directly read off the Venn's diagram
-- of any two given sets $x0,y0$.
--
	(x0-y0,x0*y0)-->T222(*) ==> #(x0 - y0) ¥PLUS #(x0 * y0) = #((x0 - y0) + (x0 * y0))
	(y0-x0,x0*y0)-->T222(*) ==> #(y0 - x0) ¥PLUS #(x0 * y0) = #((y0 - x0) + (x0 * y0))
	((x0 - y0) + (x0 * y0),(y0 - x0))-->T222(*) ==> #((x0 - y0) + (x0 * y0)) ¥PLUS #(y0 - x0) = #(((x0 - y0) + (x0 * y0)) + (y0 - x0))
	TELEM ==> (x0 = (x0 - y0) + (x0 * y0)) & (y0 = (y0 - x0) + (x0 * y0)) & (x0 + y0 = ((x0 - y0) + (x0 * y0)) + (y0 - x0)) & (x0 + y0 = ((x0 - y0) + (x0 * y0)) + (y0 - x0))
	EQUAL ==> Stat1: ((#(x0 - y0) ¥PLUS #(x0 * y0)) ¥PLUS (#(y0 - x0) ¥PLUS #(x0 * y0))) = (#x0 ¥PLUS #y0)
	(#(x0 - y0) ¥PLUS #(x0 * y0),#(y0 - x0),#(x0 * y0))-->T258(Stat1*) ==> (((#(x0 - y0) ¥PLUS #(x0 * y0)) ¥PLUS #(y0 - x0)) ¥PLUS #(x0 * y0)) = (#x0 ¥PLUS #y0)
	EQUAL ==> Stat2: (#(x0 + y0) ¥PLUS #(x0 * y0)) = (#x0 ¥PLUS #y0)
--
-- Therefore, if a counterexample to the desired statement could exist, it would consist
-- of finite sets $x0,y0$ which do not satisfy the equality
--	$(#(x0 + y0) = ((#x0 ¥PLUS #y0) ¥MINUS #(x0 * y0))$.
-- However the latter equality follows from the former, in view of the fact that
-- finite cardinals are unsigned integers, and hence satisfy cancellation.
--
	ELEM ==> Stat3: Finite(#(x0 + y0)) & ((#(x0 + y0) /= ((#x0 ¥PLUS #y0) ¥MINUS #(x0 * y0))))
	(x0 + y0)-->T156(Stat3*) ==> #(x0 + y0) in Za
	(x0 + y0, x0 * y0)-->T189(Stat3,Stat3*) ==> Stat4: Finite(#(x0 * y0))
	(x0 * y0)-->T156(Stat4,Stat4*) ==> #(x0 * y0) in Za
	(#(x0 + y0),#(x0 * y0))-->T304(Stat3*) ==> Stat5: ((#(x0 + y0) ¥PLUS #(x0 * y0)) ¥MINUS #(x0 * y0)) = #(x0 + y0)
	EQUAL(Stat2,Stat3,Stat5) ==> false
	Discharge ==> QED
--
Theorem 939: [basic inclusion-exclusion lemma for tuples of finite sets] ((domain(A) in Za) & Svm(A) & Finite(Un(range(A)))) ¥imp
	(#Un(range(A)) = sumZa({[g,#int(A ¥IM g)]: g ¥incin domain(A) | Odd(#g)}) ¥MINUS sumZa({[g,#int(A ¥IM g)]: g ¥incin domain(A) | (g /= 0) & (not Odd(#g))})). Proof:
Suppose_not(ap) ==> AUTO
--
-- Reasoning by contradiction, assume that the tuple $ap$ is a counterexample to the theorem's claim.
-- Then we can choose a minimum-length tuple $aa$ contradicting the theorem's assertion.
--
	Suppose ==> Stat1: not(EXISTS a | (domain(a) = domain(ap)) & Finite(Un(range(a))) & (#Un(range(a)) /= sumZa({[g,#int(a ¥IM g)]: g ¥incin domain(ap) | Odd(#g)}) ¥MINUS sumZa({[g,#int(a ¥IM g)]: g ¥incin domain(ap) | (g /= 0) & (not Odd(#g))})))
	ap-->Stat1(*) ==> false; Discharge ==> AUTO
	APPLY(m2_thryvar:n) mathematical_induction(n->domain(ap),P(x)->(EXISTS a | (domain(a) = x) & Finite(Un(range(a))) & (#Un(range(a)) /= sumZa({[g,#int(a ¥IM g)]: g ¥incin x | Odd(#g)}) ¥MINUS sumZa({[g,#int(a ¥IM g)]: g ¥incin x | (g /= 0) & (not Odd(#g))})))) ==>
		Stat2: (n in Za) &
		Stat3: (EXISTS a | (domain(a) = n) & Finite(Un(range(a))) & (#Un(range(a)) /= sumZa({[g,#int(a ¥IM g)]: g ¥incin n | Odd(#g)}) ¥MINUS sumZa({[g,#int(a ¥IM g)]: g ¥incin n | (g /= 0) & (not Odd(#g))}))) &
		Stat4: (FORALL m in n | not(EXISTS a | (domain(a) = m) & Finite(Un(range(a))) & (#Un(range(a)) /= sumZa({[g,#int(a ¥IM g)]: g ¥incin m | Odd(#g)}) ¥MINUS sumZa({[g,#int(a ¥IM g)]: g ¥incin m | (g /= 0) & (not Odd(#g))}))))
	aa-->Stat3(Stat2*) ==> Stat5: (domain(aa) = n) & Finite(Un(range(aa))) & (#Un(range(aa)) /= sumZa({[g,#int(aa ¥IM g)]: g ¥incin n | Odd(#g)}) ¥MINUS sumZa({[g,#int(aa ¥IM g)]: g ¥incin n | (g /= 0) & (not Odd(#g))}))
--
-- Observe that $aa /= 0$, because $Un(0) = 0$ and the null set has neither odd-cardinality
-- subsets nor non-null subsets, and therefore both summations have value $0$ and their
-- difference is also 0. Therefore, in view of the minimality of $aa$, its proper
-- subtuple $aa ¥ON (n ¥MINUS 1)$ meets the theorem's assertion, and the same holds for
-- the tuple ${[i,(aa~[i]) * (aa~[n ¥MINUS 1])]: i in (n ¥MINUS 1)}$, whose length is $n ¥MINUS 1$.
--
	Tsomehow ==>Stat6: (domain(aa ¥ON (n ¥MINUS 1)) = (n ¥MINUS 1)) & ((n ¥MINUS 1) in n) &
		Finite(Un(range(aa ¥ON (n ¥MINUS 1))))
	(n ¥MINUS 1)-->Stat4(Stat6*) ==> Stat7: not(EXISTS a | (domain(a) = (n ¥MINUS 1)) & Finite(Un(range(a))) & (#Un(range(a)) /= sumZa({[g,#int(a ¥IM g)]: g ¥incin (n ¥MINUS 1) | Odd(#g)}) ¥MINUS sumZa({[g,#int(a ¥IM g)]: g ¥incin (n ¥MINUS 1) | (g /= 0) & (not Odd(#g))})))
	(aa ¥ON (n ¥MINUS 1))-->Stat7(Stat6*) ==> Stat8: #Un(range(aa ¥ON (n ¥MINUS 1))) = sumZa({[g,#int((aa ¥ON (n ¥MINUS 1)) ¥IM g)]: g ¥incin (n ¥MINUS 1) | Odd(#g)}) ¥MINUS sumZa({[g,#int((aa ¥ON (n ¥MINUS 1)) ¥IM g)]: g ¥incin (n ¥MINUS 1) | (g /= 0) & (not Odd(#g))})
	Tsomehow ==> (domain({[i,(aa~[i]) * (aa~[n ¥MINUS 1])]: i in (n ¥MINUS 1)}) = (n ¥MINUS 1)) & Finite(Un(range({[i,(aa~[i]) * (aa~[n ¥MINUS 1])]: i in (n ¥MINUS 1)})))
	({[i,(aa~[i]) * (aa~[n ¥MINUS 1])]: i in (n ¥MINUS 1)})-->Stat7(Stat7*) ==> #Un(range({[i,(aa~[i]) * (aa~[n ¥MINUS 1])]: i in (n ¥MINUS 1)})) = sumZa({[g,#int({[i,(aa~[i]) * (aa~[n ¥MINUS 1])]: i in (n ¥MINUS 1)} ¥IM g)]: g ¥incin (n ¥MINUS 1) | Odd(#g)}) ¥MINUS sumZa({[g,#int({[i,(aa~[i]) * (aa~[n ¥MINUS 1])]: i in (n ¥MINUS 1)} ¥IM g)]: g ¥incin (n ¥MINUS 1) | (g /= 0) & (not Odd(#g))})
--
-- Having isolated the final element $(aa~[n ¥MINUS 1])$ of the tuple $aa$ of finite sets,
-- we can split the unionset $Un(range(aa))$ as
--	$Un(range(aa)) = Un(range(aa ¥ON (n ¥MINUS 1))) + (aa~[n ¥MINUS 1])$,
-- and recall the basic inclusion-exclusion lemma for two sets to rewrite $#Un(range(aa))$ as follows:
--
	Tsomehow ==> Un(range(aa)) = Un(range(aa ¥ON (n ¥MINUS 1))) + (aa~[n ¥MINUS 1])
	EQUAL(Stat5) ==> Finite(Un(range(aa ¥ON (n ¥MINUS 1))) + (aa~[n ¥MINUS 1]))
	(Un(range(aa ¥ON (n ¥MINUS 1))),aa~[n ¥MINUS 1])-->T938(Stat8*) ==> #(Un(range(aa ¥ON (n ¥MINUS 1))) + (aa~[n ¥MINUS 1])) = (#Un(range(aa ¥ON (n ¥MINUS 1))) ¥PLUS #(aa~[n ¥MINUS 1])) ¥MINUS #(Un(range(aa ¥ON (n ¥MINUS 1))) * (aa~[n ¥MINUS 1]))
	EQUAL(Stat8) ==> #Un(range(aa)) = ((sumZa({[g,#int((aa ¥ON (n ¥MINUS 1)) ¥IM g)]: g ¥incin (n ¥MINUS 1) | Odd(#g)}) ¥MINUS sumZa({[g,#int((aa ¥ON (n ¥MINUS 1)) ¥IM g)]: g ¥incin (n ¥MINUS 1) | (g /= 0) & (not Odd(#g))})) ¥PLUS #(aa~[n ¥MINUS 1])) ¥MINUS #(Un(range(aa ¥ON (n ¥MINUS 1))) * (aa~[n ¥MINUS 1]))
--
-- Then we can distribute intersection over unionset, and rewrite:
--
	(range(aa ¥ON (n ¥MINUS 1)),aa~[n ¥MINUS 1])-->T99999(*) ==> Un(range(aa ¥ON (n ¥MINUS 1))) * (aa~[n ¥MINUS 1]) = Un({x * (aa~[n ¥MINUS 1]): x in range(aa ¥ON (n ¥MINUS 1))})
	Tsomehow ==> {x * (aa~[n ¥MINUS 1]): x in range(aa ¥ON (n ¥MINUS 1))} = range({[i,(aa~[i]) * (aa~[n ¥MINUS 1])]: i in (n ¥MINUS 1)})
	EQUAL(Stat8) ==> #Un(range(aa)) = ((sumZa({[g,#int((aa ¥ON (n ¥MINUS 1)) ¥IM g)]: g ¥incin (n ¥MINUS 1) | Odd(#g)}) ¥MINUS sumZa({[g,#int((aa ¥ON (n ¥MINUS 1)) ¥IM g)]: g ¥incin (n ¥MINUS 1) | (g /= 0) & (not Odd(#g))})) ¥PLUS #(aa~[n ¥MINUS 1])) ¥MINUS (sumZa({[g,#int({[i,(aa~[i]) * (aa~[n ¥MINUS 1])]: i in (n ¥MINUS 1)} ¥IM g)]: g ¥incin (n ¥MINUS 1) | Odd(#g)}) ¥MINUS sumZa({[g,#int({[i,(aa~[i]) * (aa~[n ¥MINUS 1])]: i in (n ¥MINUS 1)} ¥IM g)]: g ¥incin (n ¥MINUS 1) | (g /= 0) & (not Odd(#g))}))
--
-- etc.
--
Tsomehow ==> false; Discharge ==> QED
--
--
Theorem 940: [basic inclusion-exclusion lemma for finitely many finite sets] (Finite(F) & Finite(Un(F))) ¥imp
	(#Un(F) = sumZa({[g,#int(g)]: g ¥incin F | Odd(#g)}) ¥MINUS sumZa({[g,#int(g)]: g ¥incin F | (g /= 0) & (not Odd(#g))})). Proof:
Suppose_not(f0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
--
--
-- Consider real-valued functions f on a finite set S whose points p carry weights w(p)
-- (which can be positive or negative.) Let J(f) be the sum Sigma(f(p)w(p)). For any finite
-- tuple F of functions f, let MAX(F) and MIN(F) be respectively the pointwise maximum and
-- minimum over the f in F. Then
--
-- Theorem A: J(MAX(F)) = Sigma([J(MIN(G)): G incin F | G odd])  - Sigma([J(MIN(G)): G incin F | G even]).
--
-- Inclusion-exclusion for characteristic functions (and hence for sets) is the special case
-- of this in which the functions f are restricted to have values 0 and 1. But since the
-- functional J is obviously additive over functions, Theorem A follows immediately from
--
-- Theorem B: MAX(F) = Sigma([MIN(G): G incin F | G odd]) - Sigma([MIN(G): G incin F | G even]).
--
-- And since MAX, MIN, and Sigma (for functions) are all pointwise, Theorem B follows immediately from
--
-- Theorem C: MAX(F) = Sigma([MIN(G): G incin F | G odd]) - Sigma([MIN(G): G incin F | G even]),
--
-- where now F is simply a finite tuple of real values.
--
-- To prove Theorem C, proceed inductively. Arrange the values in F in order, with minimum m.
-- Divide the G incin F into those G having m as a member and those incin F - {m}. Then
-- Theorem C reduces to
--
-- Version D: MAX(F) = MAX(F - {m}) = #[m: G incin F - {m} | G even] - #[m: G incin F - {m} | G odd] +
-- Sigma([MIN(G): G incin F - {m} | G odd]) - Sigma([MIN(G): G incin F - {m} | G even])
--
-- (here the first 2 terms on the right simply recast SIGMA([MIN(G): G incin F | G odd & m in G]) and
-- SIGMA([MIN(G): G incin F | G even & m in G]) respectively. But now Version D
-- follows immediately by induction and the simple identity #[G incin F: G even] - #[G incin F: G odd] = 0,
-- which is just the Binomial identity Sigma(Combinations(#F,n)(-1)**n) = (1 - 1)**n = 0.
--
--
--
APPLY(h1_thryvar:oddity) finite_tailrecursive_fcn2(f0->R_0,g2(a,x)->if a /= R_1 then R_1 else R_Rev(R_1) end if) ==>
	Theorem 941: [oddity-characterizing assertion] (FORALL s | Finite(s) ¥imp (oddity(s) = if s = 0 then R_0 elseif oddity(s - {arb(s)}) /= R_1 then R_1 else R_Rev(R_1) end if))
--
Theorem 942: [basic inclusion-exclusion lemma for finite real-valued maps] (Svm(F) & (F /= 0) & (range(F) ¥incin Re)) ¥imp
	(max_over_Re(F) = sumRe({[g,min_over_Re(g)]: g ¥incin F | oddity(g) = R_1}) ¥R_MINUS sumRe({[g,min_over_Re(g)]: g ¥incin F | oddity(g) = R_Rev(R_1)})). Proof:
Suppose_not(f0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem 943: [basic inclusion-exclusion lemma for finite real-valued maps, 2] (Svm(F) & (F /= 0) & (range(F) ¥incin Re)) ¥imp
	(max_over_Re(F) = sumRe({[g,oddity(g) ¥R_TIMES min_over_Re(g)]: g ¥incin F | g /= 0})). Proof:
Suppose_not(f0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
--Theorem OM: [basic inclusion-exclusion lemma for finite real-valued maps, 2] (Svm(F) & (F /= 0) & (range(F) ¥incin Re)) ¥imp
--	(max_over_Re(F) = sumRe([oddity(g) ¥R_TIMES min_over_Re(g): g ¥incin F | g /= 0]))
--Suppose_not(f0) ==> AUTO
--Tsomehow ==> false; Discharge ==>
--
--
-- The following theorem shows that the powerset of a set $f$ can be decomposed
-- with respect to any member $p$ of $f$ into the form
--	$pow(f - {p}) + {g + {p}: g in pow(f - {p})}$.
--
Theorem 944: (P in F) ¥imp (pow(F) = {0,{P}} + {g ¥incin (F - {P}) | g /= 0} +
				{g + {P} : g ¥incin (F - {P}) | g /= 0}). Proof:
Suppose_not(p,f) ==> AUTO

	Use_def(pow) ==> Stat1: ({s: s ¥incin f} /= {0,{p}} + {g ¥incin (f-{p}) | g /= 0} + {g + {p}: g ¥incin (f - {p})| g /= 0}) & (p in f)

	x-->Stat1(Stat1*) ==> (x in {s: s ¥incin f}) ¥eq (x notin ({0,{p}} + {g ¥incin (f-{p}) | g /= 0} + {g + {p}: g ¥incin (f - {p})| g /= 0}))

	Suppose ==> Stat2: x notin {s: s ¥incin f}

--
-- On the one hand, if we assume that $x$ makes the left-hand side of the above logical
-- equivalence true, then it must make the right-hand side true also: however, being not
-- included in $f$, $x$ cannot equal $0$ or the singleton ${p}$; moreover, it cannot belong
-- to the set ${g : g ¥incin (f-{p}) | g /= 0}$. Therefore, it must belong to the set
-- ${g +{p}:g ¥incin (f-{p})| g /= 0}$.
--
		x-->Stat2(Stat1,Stat1*) ==> Stat3: (x ¥nincin f) & (x /= 0) & (x /= {p})

		Suppose ==> Stat4: x in {g ¥incin (f - {p}) | g /= 0}
			()-->Stat4(Stat3,Stat3*) ==> false
		Discharge ==> Stat5: (x in {g  + {p} : g ¥incin (f - {p}) | g /= 0}) & (p in f)

--
-- However, it is readily seen that this situation again conflicts with $x ¥nincin f$.
--

		x0-->Stat5(Stat3*) ==> false

	Discharge ==> Stat6: (x in {s: s ¥incin f}) &
			(x notin {g ¥incin (f - {p}) | g /= 0}) &
			(x notin {g + {p}:g ¥incin (f - {p})| g /= 0}) &
			(x /= 0) & (x /= {p})
--
-- On the other hand, assuming that both sides of the above logical equivalence are false
-- would likewise imply $x ¥nincin f$. Whichever of $p notin x$, $p in x$ holds,
-- we reach a contradiction: hence the initial assumption that a couterexample to the
-- desired conclusion exists is contradicted.
--

	(xp,xp,xp-{p})--> Stat6(Stat6*) ==> false

Discharge ==> QED
--
-- A simplified variant of the preceding theorem is as follows:
--
Theorem 945: (P in F) ¥imp (pow(F) = {g: g ¥incin (F - {P})} +
				{g + {P} : g ¥incin (F - {P})}). Proof:
Suppose_not(p,f) ==> AUTO
	(p,f)-->T944(*) ==> Stat1: not(({g: g ¥incin (f - {p})} = {0} + {g ¥incin (f - {p}) | g /= 0}) &
		({g + {p} : g ¥incin (f - {p})} = {{p}} + {g + {p} : g ¥incin (f - {p}) | g /= 0}))
	Suppose ==> {g: g ¥incin (f - {p})} /= {0} + {g ¥incin (f - {p}) | g /= 0}
		Set_monot ==> {g ¥incin (f - {p}) | g /= 0} ¥incin {g: g ¥incin (f - {p})}
		Suppose ==> Stat2: 0 notin {g: g ¥incin (f - {p})}
		0-->Stat2(Stat2*) ==> false; Discharge ==> Stat3: {g: g ¥incin (f - {p})} ¥nincin ({0} + {g ¥incin (f - {p}) | g /= 0})
		g0-->Stat3(Stat3*) ==> Stat4: (g0 in {g: g ¥incin (f - {p})}) & (g0 notin {g: g ¥incin (f - {p}) | g /= 0}) & (g0 /= 0)
	(g2,g0)-->Stat4(Stat4*) ==> false; Discharge ==> {g + {p} : g ¥incin (f - {p})} /= {{p}} + {g + {p} : g ¥incin (f - {p}) | g /= 0}
	Set_monot ==> {g + {p}: g ¥incin (f - {p}) | g /= 0} ¥incin {g + {p}: g ¥incin (f - {p})}
	Suppose ==> Stat5: {p} notin {g + {p}: g ¥incin (f - {p})}
	0-->Stat5(Stat5*) ==> false; Discharge ==> Stat6: {g + {p}: g ¥incin (f - {p})} ¥nincin ({{p}} + {g + {p}: g ¥incin (f - {p}) | g /= 0})
	g1-->Stat6(Stat6*) ==> Stat7: (g1 in {g + {p}: g ¥incin (f - {p})}) & (g1 notin {g + {p}: g ¥incin (f - {p}) | g /= 0}) & (g1 /= {p})
	(g3,g3)-->Stat7(Stat7*) ==> false
	Discharge ==> QED
--
--
--
Def 10060: [nodes of a map] nodes(G) := domain(G) + range(G)
Def 10062: [Roots of a map] roots(G) := domain(G) - range(G - ident(range(G)))
Def 10063: [Well-founded relation] Well_founded(G) := (FORALL d ¥incin nodes(G) | ((d - (G ¥IM d)) = 0) ¥imp (d = 0))
Def 10064: [Forest] Is_forest(F,R) := Well_founded(F) & (roots(F) = R * nodes(F)) & (FORALL p in F, q in F | (cdr(p) = cdr(q)) ¥imp (p = q)) & Is_map(F)
Def 10065: [Tree] Is_tree(T,R) := Is_forest(T,{R})
--
-- The definition of an 'almost-tree' differs from that of a tree
-- insofar as leaves (namely, nodes devoid of outcoming edges) may have
-- multiple immediate predecessors. By 'term' we mean an almost-tree
-- with a function labeling its nodes save possibly the ones which
-- have multiple immediate predecessors (or the root, when it is
-- the only node of the tree).
--
Def 10066: Almostree(T,R) := Well_founded(T) & ((domain(T) - range(T)) ¥incin {R}) & (FORALL p in T, q in T | (cdr(p) = cdr(q)) ¥imp ((p = q) or (cdr(p) notin domain(T)))) & Is_map(T)
Def 10067: Is_term(T,R,L) := Almostree(T,R) & Svm(L) & (domain(T) ¥incin domain(L)) & (({ cdr(p) : p in T, q in T | (p /= q) & (cdr(p) = cdr(q)) } * domain(L)) = 0)
Def 10068: leaves(T,R) := if (T = 0) then {R} else (range(T) - domain(T)) end if
--
--PAUSE HERE
--
-- ************************************************************************************************
--								Section 22: Applications of string rewriting
-- ************************************************************************************************
--
--BEGIN HERE
--
-- A finite sequence consisting of elements of $s$ can be reduced by
-- pruning a loop out of it.
--
Def 894: redexLoops(S) := {[f,concat(f ¥ON i,shifted_seq(f,j))]: f in Fin_seqs(S), j in #f, i in j | (f~[i]) = (f~[j])}
--
-- The equivalence relation between finite sequences over $s$ (whose meaning
-- is as explained above) is the smallest among all the equivalence relations which
-- contain all loop-redex pairs.
--
Def 891: eqRels(X) := {r ¥incin (X ¥PROD X) | (ident(X) ¥incin r) & ((r @ inv(r)) ¥incin r) }
--
Def 895: samePath(S) := {p in (Fin_seqs(S) ¥PROD Fin_seqs(S)) | 0 =
		{r in eqRels(Fin_seqs(S)) | (redexLoops(S) ¥incin r) & (p notin r)} }
--
-- By concatenating equivalent paths, one gets equivalent paths:
--
Theorem 946: ({[F,Fp],[G,Gp]} ¥incin samePath(S)) ¥imp ([concat(F,G),concat(Fp,Gp)] in samePath(S)). Proof:
Suppose_not(f0,fp,g0,gp,s0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem 947: (F in Fin_seqs(S) - {0}) ¥imp (Is_perm({[F~[i],F~[i ¥PLUS 1]]: i in #F ¥MINUS 1} + {[F~[#F ¥MINUS 1],F~[0]]}) ¥eq (0 = {p in redexLoops | car(p) = F})). Proof:
Suppose_not(f0,s0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
--PAUSE HERE
--BEGIN HERE
--
-- A finite sequence consisting of pairs $[b,e]$ with $b in s$ ($s$ being the set of generators)
-- and $e in Si$ ($e$ being the exponent to which $b$ is raised) can be reduced either by
-- elimination of a pair $[b,0]$ or by replacement of two consecutive pairs $[b,e],[b,ep]$ by
-- the single pair $[b, e ¥PLUS ep]$.
--
Def 890: redexWords(S) := {[f,g]: f in Fin_seqs(S ¥PROD Si), g in Fin_seqs(S ¥PROD Si), k in #f |
	(#f = #g ¥PLUS 1) & (f ¥ON k = g  ¥ON k) &
		if cdr(f~[k]) = [0,0] then shifted_seq(f,k ¥PLUS 1) = shifted_seq(g,k) else
		  ((k ¥PLUS 1) in #f) & (car(f~[k]) = car(f~[k ¥PLUS 1])) &
		  (shifted_seq(f,k ¥PLUS 2) = shifted_seq(g,k ¥PLUS 1)) &
		  (g~[k] = [car(f~[k]),cdr(f~[k]) ¥PLUS cdr(f~[k ¥PLUS 1])]) end if}
--
-- The equivalence relation between finite sequences over $s ¥PROD Si$ (whose meaning
-- is as explained above) is the smallest among all the equivalence relations which
-- contain all word-redex pairs.
--
Def 892: sameWord(S) := {p in (Fin_seqs(S ¥PROD Si) ¥PROD Fin_seqs(S ¥PROD Si)) | 0 =
		{r in eqRels(Fin_seqs(S ¥PROD Si)) | (redexWords(S) ¥incin r) & (p notin r)} }
--
-- By concatenating equivalent words, one gets equivalent words:
--
Theorem 948: ({[F,Fp],[G,Gp]} ¥incin sameWord(S)) ¥imp ([concat(F,G),concat(Fp,Gp)] in sameWord(S)). Proof:
Suppose_not(f0,fp,g0,gp,s0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
-- The support domain of the group originating from a set $s$ of free generators is
-- the quotient of $Fin_seqs(s ¥PROD Si)$ by the equivalence relation $sameWord(S)$;
-- Its multiplication operation is induced by concatenation of finite strings,
-- its unit is the equivalence class of the void string $0$, its inverse operation is induced
-- by the following string reversing operation:
--
Def 893: reverse(S) := {[f,{[#f ¥MINUS 1 ¥MINUS i,f~[i]]: i in #f}]: f in Fin_seqs(S ¥PROD Si)}
--
-- ... AFTER EXPANDING ALL TECHNICAL ASPECTS, WE WILL END UP WITH THE FOLLOWING THEORY:
--
-- DISPLAY freeGroup
--
-- THEORY freeGroup(s)
-- ==>(embed_thryvar,support_thryvar,times_thryvar,one_thryvar,inv_thryvar)
--	one_1_map(embed_thryvar) & (domain(embed_thryvar) = s) & (range(embed_thryvar) = support_thryvar)
--	one_thryvar in support_thryvar
--	(FORALL x in support_thryvar | (inv_thryvar(x) in support_thryvar) &
--		(times_thryvar(inv_thryvar(x),x) = one_thryvar) &
--		(times_thryvar(one_thryvar,x) = x))
--	(FORALL x in support_thryvar, y in support_thryvar | (times_thryvar(x,y) in support_thryvar))
--	(FORALL x in support_thryvar, y in support_thryvar, z in support_thryvar |
--		times_thryvar(times_thryvar(x,y),z) = times_thryvar(x,times_thryvar(y,z)))
-- END freeGroup
--
--PAUSE HERE
--BEGIN HERE
--
-- ************************************************************************************************
--								Section 23: Additional theorems under development
-- ************************************************************************************************
--
--
-- The following recursive definitions of a lexicographic order for hereditarily finite sets play a role in the
-- 'mirroring lemma' discussion preparatory to the proof of Goedel's theorem in the book associated with this
-- collection of formal proofs.
--
--	$Def xxx: [Lexicographic discriminant] discr(p,q) := {v in p | q incs {w in p | discr(v + w,v * w) * w /= 0}} - q$
--	$Def yyy: [Lexicographic ordering] Smaller(x,y) := discr(x + y, x * y) * y /= 0$
--
--
Def 10001: [Integer divisibility] divides(K,N) := (EXISTS j | N = K ¥TIMES j)
--
Def 10002: [Primality criterion for unsigned integers] Is_prime(P) := (1 in P) & (not(EXISTS k in P | (1 in k) & divides(k,P)))
--
Def 10003: [Smallest factor of an unsigned integer] smallest_factor(N) := arb({k in next(N) | (1 in k) & divides(k,N)})
--
Def 10004: [Increasing sequence of unsigned prime integers factors of an unsigned integer] standard_factorization(N) := concat({[0,smallest_factor(N)]}, arb({standard_factorization(m): m in N | m ¥TIMES smallest_factor(N) = N}))
--
Theorem 949: Ord(K) ¥imp divides(K,0). Proof:
    Suppose_not(k) ==> Ord(k) & (not(divides(k,0)))
        Use_def(divides) ==> Stat1: not(EXISTS j | 0 = k ¥TIMES j)
        k-->T245 ==> 0 = k ¥TIMES 0
    0-->Stat1 ==> false; Discharge ==> QED
--
Theorem 950: (Card(M) or (M in Za)) ¥imp (divides(1,M) & divides(M,M)). Proof:
    Suppose_not(m) ==> (Card(m) or (m in Za)) & ((not divides(1,m)) or (not divides(m,m)))
        m-->T206 ==> Card(m)
        m-->T164 ==> m = #m
        Suppose ==> (not divides(1,m))
            Use_def(divides) ==> Stat1: not(EXISTS j | m = 1 ¥TIMES j)
            m-->T248 ==> m = 1 ¥TIMES m
        m-->Stat1 ==> false; Discharge ==> (not divides(m,m))
        Use_def(divides) ==> Stat2: not(EXISTS j | m = m ¥TIMES j)
        m-->T249 ==> m = m ¥TIMES 1
    1-->Stat2 ==> false; Discharge ==> QED
--
Theorem 951: (divides(K,I) & divides(I,N)) ¥imp divides(K,N). Proof:
    Suppose_not(k,i,n) ==> divides(k,i) & divides(i,n) & (not divides(k,n))
        Use_def(divides) ==> Stat1: (EXISTS j | i = k ¥TIMES j) & Stat2: (EXISTS j | n = i ¥TIMES j) & Stat3: (not(EXISTS j | n = k ¥TIMES j))
        j-->Stat1 ==> i = k ¥TIMES j
        jp-->Stat2 ==> n = i ¥TIMES jp
        EQUAL ==> n = (k ¥TIMES j) ¥TIMES jp
        (k,j,jp)-->T259 ==> n = k ¥TIMES (j ¥TIMES jp)
    (j ¥TIMES jp)-->Stat3 ==> false; Discharge ==> QED
--
--Theorem OM: ((M /= 0) & (M in Za) & (D in Za) & divides(D,M)) ¥imp (D in next(M))
--    Suppose_not(m,d) ==> (m /= 0) & (m in Za) & (d in Za) & divides(d,m) & (d notin next(m))
--    TOBECOMPLETED ==> false; Discharge ==>
--
Theorem 952: ((M in Za) & (1 in M)) ¥imp (Is_prime(smallest_factor(M)) & divides(smallest_factor(M),M)). Proof:
    Suppose_not(m) ==> (m in Za) & (1 in m) & ((not(Is_prime(smallest_factor(m)))) or (not divides(smallest_factor(m),m)))
        Use_def(next) ==> m in next(m)
        m-->T950 ==> divides(m,m)
        Suppose ==> Stat1: {k : k in next(m) | (1 in k) & divides(k,m)} = 0
        m-->Stat1 ==> false; Discharge ==> (arb({k : k in next(m) | (1 in k) & divides(k,m)}) in {k: k in next(m) | (1 in k) & divides(k,m)}) & (arb({k : k in next(m) | (1 in k) & divides(k,m)}) * {k: k in next(m) | (1 in k) & divides(k,m)} = 0)
        Use_def(smallest_factor) ==> Stat2: (smallest_factor(m) in {k: k in next(m) | (1 in k) & divides(k,m)}) & (smallest_factor(m) * {k: k in next(m) | (1 in k) & divides(k,m)} = 0)
        k0-->Stat2 ==> (k0 = smallest_factor(m)) & (k0 in next(m)) & (1 in k0) & divides(k0,m)
        EQUAL ==> (smallest_factor(m) in next(m)) & (1 in smallest_factor(m)) & divides(smallest_factor(m),m)
        ELEM ==>  not(Is_prime(smallest_factor(m)))
        Use_def(Is_prime) ==> Stat3: (EXISTS k in smallest_factor(m) | (1 in k) & divides(k,smallest_factor(m)))
        k-->Stat3 ==> (k in smallest_factor(m)) & (1 in k) & divides(k,smallest_factor(m))
        (k,smallest_factor(m),m)-->T951 ==> divides(k,m)
        Suppose ==> Stat4: k notin {k: k in next(m) | (1 in k) & divides(k,m)}
            k-->Stat4 ==> k notin next(m)
            T206 ==> Ord(Za)
            (Za,m)-->T12 ==> Ord(m)
            m-->T32 ==> Ord(next(m))
        (next(m),smallest_factor(m))-->T13 ==> false; Discharge ==> k in {k: k in next(m) | (1 in k) & divides(k,m)}
    Discharge ==> QED
--
--Theorem OM: ((M in Za) & (not Is_prime(M))) ¥imp (standard_factorization(M) = concat({[0,smallest_factor(M)]}, standard_factorization(M ¥OVER smallest_factor(M))))
--    TOBECOMPLETED

--BEGIN HERE
--
Def 993: Is_oddPow(F) := Svm(F) & (range(F) ¥incin Re) & (FORALL p in domain(F), d in p | F~[p] = R_Rev(F~[p - {d}]))
--
Theorem 16500: (D in F) ¥imp (pow(F) = {g: g ¥incin (F - {D})} + {g + {D} : g ¥incin (F - {D})}). Proof:
Suppose_not(p,f) ==> AUTO
	Set_monot ==> {s: s ¥incin f} incs ({g : g ¥incin (f - {p})} + {g + {p}: g ¥incin (f - {p})})
	Set_monot ==> {g: g ¥incin (f-{p})} + {g + {p}: g ¥incin (f - {p})} incs {s: s ¥incin f}
	Use_def(pow) ==> false
	Discharge ==> QED
--
THEORY halvesPow(s0)
	Finite(s0) & (s0 /= 0)
END halvesPow
--
ENTER_THEORY halvesPow
--
--
--
Theorem halvesPow1: ((D in s0) & (domain(F) = pow(s0 - {D})) & Is_oddPow(F) & (G = F + {[q + {D},R_Rev(F~[q])]: q in pow(s0 - {D})})) ¥imp
		((domain(G) = pow(s0)) & Is_oddPow(G)). Proof:
Suppose_not(d0,f0,f1) ==> AUTO
--
-- Arguing by contradiction, assume that $d0,f0,f1$ form a counterexample to the claim of this theorem.
-- We readily find that $domain(f1) = pow(s0)$, and hence $not Is_oddPow(f1)$.
--
	(d0,s0)-->T16500 ==> pow(s0) = {g: g ¥incin (s0 - {d0})} + {g + {d0} : g ¥incin (s0 - {d0})}
	(f0,{[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})})-->T78(*) ==> domain(f0 + {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) = domain(f0) + domain({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})})
	TELEM ==> domain({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) = {q + {d0}: q in pow(s0 - {d0})}
	EQUAL ==> Stat2: domain(f1) = pow(s0 - {d0}) + {q + {d0}: q in pow(s0 - {d0})}
	Use_def(pow)(Stat2*) ==> Stat3: domain(f1) = {q: q ¥incin (s0 - {d0})} + {q + {d0}: q in {x: x ¥incin (s0 - {d0})}}
	SIMPLF(Stat3*) ==> Stat4: domain(f1) = {q: q ¥incin (s0 - {d0})} + {q + {d0}: q ¥incin (s0 - {d0})}
--
-- By the definition of $Is_oddPow$, either $range(f1) ¥nincin Re$ or $not Svm(f1)$ or
--	$not(FORALL p in domain(f1), d in p | f1~[p] = R_Rev(f1~[p - {d}]))$
-- holds. One by one, we will exclude all three possibilities.
--
	Suppose ==> range(f1) ¥nincin Re
		(f0,{[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})})-->T79(*) ==> range(f0 + {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) = range(f0) + range({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})})
		TELEM ==> range({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) = {R_Rev(f0~[q]): q in pow(s0 - {d0})}
		EQUAL ==> range(f1) = range(f0) + {R_Rev(f0~[q]): q in pow(s0 - {d0})}
		Use_def(Is_oddPow) ==> range(f0) ¥incin Re
		(Stat4*)ELEM ==> Stat14: {R_Rev(f0~[q]): q in pow(s0 - {d0})} ¥nincin Re
		r-->Stat14(Stat14*) ==> Stat15: (r in {R_Rev(f0~[q]): q in pow(s0 - {d0})}) & (r notin Re)
		q1-->Stat15(Stat15*) ==> (q1 in pow(s0 - {d0})) & (R_Rev(f0~[q1]) notin Re)
		(q1,f0)-->T71(*) ==> (f0~[q1]) in Re
		(f0~[q1],f0~[q1])-->T613(Stat15*) ==> false
	Discharge ==> AUTO
--
-- After easily discarding the possibility that $range(f1) ¥nincin Re$, we see that
-- $Svm(f1)$ because $f1 = f0 + {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}$, where
-- the union is made of two single-valued maps which have disjoint domains.
--
	Suppose ==> Stat22: (not Svm(f1))
		EQUAL ==> (not Svm(f0 + {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}))
		Suppose ==> Stat16: (not Svm({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}))
			TELEM ==> Is_map({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})})
			Use_def(Svm)(Stat16*) ==> Stat17: not(FORALL x in {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}, y in {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})} | (car(x) = car(y)) ¥imp (x = y))
			(x1,y1)-->Stat17(Stat17*) ==> Stat18: (x1 in {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) & (y1 in {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) & (car(x1) = car(y1)) & (x1 /= y1)
			(q8,q9)-->Stat18(Stat18*) ==> (x1 = [q8 + {d0},R_Rev(f0~[q8])]) & (y1 = [q9 + {d0},R_Rev(f0~[q9])]) & (car(x1) = car(y1)) & (x1 /= y1)
					& (q8 in pow(s0 - {d0})) & (q9 in pow(s0 - {d0}))
			TELEM ==> (car([q8 + {d0},R_Rev(f0~[q8])]) = q8 + {d0}) & (car([q9 + {d0},R_Rev(f0~[q9])]) = q9 + {d0})
			EQUAL(Stat18) ==> Stat19: (q8 + {d0} = q9 + {d0}) &  ([q8 + {d0},R_Rev(f0~[q8])] /= [q9 + {d0},R_Rev(f0~[q9])])
			(Stat19)ELEM ==> R_Rev(f0~[q8]) /= R_Rev(f0~[q9])
			Suppose ==> (d0 in q8) or (d0 in q9)
				Use_def(pow)(Stat18*) ==> Stat20: (q8 in {z: z ¥incin  (s0 - {d0})}) & (q9 in {w: w ¥incin  (s0 - {d0})})
				(w8,w9)-->Stat20(Stat19*) ==> false
			Discharge ==> AUTO
			(Stat19*)ELEM ==> q8 = q9
			EQUAL(Stat19) ==> false
		Discharge ==> AUTO
		Use_def(Is_oddPow) ==> Svm(f0)
		(f0,{[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})})-->T87(Stat22*) ==> Stat23: (domain(f0) * domain({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) /= 0)
		TELEM ==> domain({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) = {q + {d0}: q in pow(s0 - {d0})}
		q7-->Stat23(*) ==> Stat24: (q7 in {q + {d0}: q in pow(s0 - {d0})}) & (q7 in pow(s0 - {d0}))
		Use_def(pow(s0 - {d0})) ==> AUTO
		q6-->Stat24(Stat24*) ==> Stat25: (q7 in {w: w ¥incin (s0 - {d0})}) & (d0 in q7)
		w7-->Stat25(Stat25*) ==> false
	Discharge ==> AUTO
--
-- Therefore, the condition
--	$(p1 in domain(f1)) & (d1 in p1) & (f1~[p1] /= R_Rev(f1~[p1 - {d1}]))$
-- is met by suitable chosen $p1,d1$; and it is plain that $p1$
-- cannot belong to the domain $pow(s0 - {d0})$ of $f0$. Instead,
-- $p1$ will be of the form $q0 + {d0}$, where $q0 in pow(s0 - {d0})$.
--
	Use_def(Is_oddPow)(*) ==> Stat6: not(FORALL p in domain(f1), d in p | f1~[p] = R_Rev(f1~[p - {d}])) &
		(FORALL p in domain(f0), d in p | f0~[p] = R_Rev(f0~[p - {d}]))
	EQUAL ==> Stat7: (FORALL p in pow(s0 - {d0}), d in p | f0~[p] = R_Rev(f0~[p - {d}]))
	(p1,d1)-->Stat6(Stat4*) ==> ((p1 in {q: q ¥incin (s0 - {d0})}) or (p1 in {q + {d0}: q ¥incin (s0 - {d0})})) &
		(d1 in p1) & (f1~[p1] /= R_Rev(f1~[p1 - {d1}]))
	Suppose ==> Stat6a: p1 in {q: q ¥incin (s0 - {d0})}
		Use_def(pow)(Stat6a*) ==> p1 in pow(s0 - {d0})
		(p1,d1)-->Stat7(Stat6*) ==> f0~[p1] = R_Rev(f0~[p1 - {d1}])
		(f1,f0,p1)-->T131(*) ==> f1~[p1] = R_Rev(f0~[p1 - {d1}])
		Suppose ==> Stat7a: (p1 - {d1}) notin pow(s0 - {d0})
			Use_def(pow)(Stat7a*) ==> Stat8a: (p1 - {d1}) notin {w: w ¥incin (s0 - {d0})}
			(p1 - {d1})-->Stat8a(Stat8a*) ==> (p1 - {d1}) ¥nincin (s0 - {d0})
			(Stat8a*)ELEM ==> p1 ¥nincin (s0 - {d0})
			p2-->Stat6a(Stat7*) ==> false
		Discharge ==> (p1 - {d1}) in domain(f0)
		(f1,f0,p1 - {d1})-->T131(*) ==> f1~[p1 - {d1}] = f0~[p1 - {d1}]
		EQUAL(Stat6) ==> false
	Discharge ==> Stat8: p1 in {q + {d0}: q ¥incin (s0 - {d0})}
	q0-->Stat8(Stat8*) ==> Stat9: (p1 = q0 + {d0}) & (q0 ¥incin (s0 - {d0}))
	Suppose ==> Stat10a: q0 notin pow(s0 - {d0})
		Use_def(pow(s0 - {d0})) ==> AUTO
		(Stat10a*)ELEM ==> Stat12: q0 notin {x: x ¥incin (s0 - {d0})}
		q0-->Stat12(Stat9*) ==> false
	Discharge ==> Stat10: q0 in pow(s0 - {d0})
--
-- Observe that $f1~[p1 - {d1}] /= f0~[q0]$.
--
	Suppose ==> f1~[p1 - {d1}] = f0~[q0]
		Suppose ==> Stat11: [p1,R_Rev(f0~[q0])] notin {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}
			q0-->Stat11(Stat10*) ==> [p1,R_Rev(f0~[q0])] /= [q0 + {d0},R_Rev(f0~[q0])]
			TELEM ==> (p1 = q0 + {d0}) ¥imp ([p1,R_Rev(f0~[q0])] = [q0 + {d0},R_Rev(f0~[q0])])
		(Stat9*)Discharge ==> [p1,R_Rev(f0~[q0])] in f1
		(f1,[p1,R_Rev(f0~[q0])])-->T74(Stat4*) ==> (f1~[car([p1,R_Rev(f0~[q0])])]) = cdr([p1,R_Rev(f0~[q0])])
		(p1,R_Rev(f0~[q0]))-->T9(Stat10*) ==> (car([p1,R_Rev(f0~[q0])]) = p1) & (cdr([p1,R_Rev(f0~[q0])]) = R_Rev(f0~[q0]))
		EQUAL(Stat6) ==> false
	Discharge ==> Stat14a: f1~[p1 - {d1}] /= f0~[q0]
--
-- If $d0 = d1$, then $f1~[p1 - {d1}] = f0~[p1 - {d1}]$ and
-- $f1~[p1] = R_Rev(f0~[p1 - {d1}])$, so that
-- $f1~[p1] = R_Rev(f1~[p1 - {d1}])$. We get into a contradiction.
--
	Suppose ==> d1 = d0
		(Stat9*)ELEM ==> p1 - {d1} = q0
		(f1,f0,q0)-->T131(*) ==> f1~[q0] = f0~[q0]
		EQUAL(Stat14a) ==> false
	Discharge ==> AUTO
--
-- Therefore $d0 /= d1$ and
-- $f1~[p1 - {d1}] = R_Rev(f0~[p1 - {d0,d1}])$,
-- $f0~[p1 - {d0}] = R_Rev(f0~[p1 - {d0,d1}])$,
-- and hence $f1~[p1 - {d1}] = f0~[q0])$,
-- contradicting Stat14a and thus leading us to the desired conclusion.
--
	Suppose ==> Stat30a: not((p1 - {d0,d1} in pow(s0 - {d0})) & (p1 - {d0} in pow(s0 - {d0})))
		Use_def(pow(s0 - {d0})) ==> AUTO
		(Stat30a*)ELEM ==> Stat32: ((p1 - {d0,d1}) notin {x: x ¥incin (s0 - {d0})}) or ((p1 - {d0}) notin {y: y ¥incin (s0 - {d0})})
		(p1 - {d0,d1},p1 - {d0})-->Stat32(Stat9*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat31: [(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])] notin {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}
		(p1 - {d0,d1})-->Stat31(Stat14a*) ==> false
	Discharge ==> [(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])] in f1
	Suppose ==> f1~[(p1 - {d0,d1}) + {d0}] /= R_Rev(f0~[p1 - {d0,d1}])
		(f1,[(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])])-->T74(*) ==> f1~[car([(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])])] = cdr([(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])])
		((p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}]))-->T9(Stat14a*) ==> (car([(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])]) = (p1 - {d0,d1}) + {d0}) & (cdr([(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])]) = R_Rev(f0~[p1 - {d0,d1}]))
		EQUAL(Stat14a) ==> false
	Discharge ==> AUTO
	(Stat6*)ELEM ==> Stat33: ((p1 - {d0,d1}) + {d0} = p1 - {d1}) & (f1~[(p1 - {d0,d1}) + {d0}] = R_Rev(f0~[p1 - {d0,d1}])) & (q0 = p1 - {d0}) & (d1 in p1 - {d0}) & (p1 - {d0,d1} = (p1 - {d0}) - {d1})
	EQUAL(Stat14a,Stat33) ==> R_Rev(f0~[(p1 - {d0}) - {d1}]) /= f0~[p1 - {d0}]
	(p1 - {d0},d1)-->Stat7(Stat14a*) ==> false
	Discharge ==> QED
--
--
--
Theorem halvesPow2: ((domain(F) = pow(s0)) & Is_oddPow(F) & (R_0 notin range(F))) ¥imp
		(#{q: q ¥incin s0 | F~[q] ¥R_GT R_0} = #{q: q ¥incin s0 | F~[q] ¥R_LT R_0}). Proof:
Suppose_not(f0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
--
ENTER_THEORY Set_theory
--
--PAUSE HERE
--BEGIN HERE
--
Def 990: switch(P) := [cdr(P),car(P)]
--
Def 991: Is_odd(F) := Svm(F) & (range(F) ¥incin Re) & (FORALL p in domain(F) | F~[switch(p)] = R_Rev(F~[p]))
--
Def 992: Is_even(F) := Svm(F) & (range(F) ¥incin Re) & (FORALL p in domain(F) | F~[switch(p)] = F~[p])
--
THEORY halves(s0)
	Finite(s0)
END halves
--
ENTER_THEORY halves
--
Def halves1: wholeP_thryvar := (s0 ¥PROD s0) - ident(s0)
--
Theorem halves0: Is_map(wholeP_thryvar) & Finite(wholeP_thryvar). Proof:
Suppose_not ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Def halves2: halvesP_thryvar := {q ¥incin wholeP_thryvar | (FORALL p in wholeP_thryvar | (p in q) ¥eq (switch(p) notin q))}
--
Def halves3: oddFcn_thryvar := {f ¥incin (wholeP_thryvar ¥PROD Re) | Is_odd(f)}
--
Def halves4: evenFcn_thryvar := {f ¥incin (wholeP_thryvar ¥PROD Re) | Is_even(f)}
--
Def halves5: sgg_thryvar(H) := {[p, if p in H then R_1 else R_Rev(R_1) end if]: p in wholeP_thryvar}
--
Theorem halves1: (H in halvesP_thryvar) ¥imp (sgg_thryvar(H) in oddFcn_thryvar). Proof:
Suppose_not(h) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem halves2: (({H,G} ¥incin halvesP_thryvar) & (Q in wholeP_thryvar)) ¥imp ((sgg_thryvar(H)~[Q]) ¥R_OVER (sgg_thryvar(G)~[Q]) = (sgg_thryvar(H)~[Q]) ¥R_TIMES (sgg_thryvar(G)~[Q])). Proof:
Suppose_not(h,g,q) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem halves3: ({H,G} ¥incin halvesP_thryvar) ¥imp ({[p,(sgg_thryvar(H)~[p]) ¥R_OVER (sgg_thryvar(G)~[p])]: p in wholeP_thryvar} in evenFcn_thryvar). Proof:
Suppose_not(h,g) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Def halves6: Def(E ¥H_TIMES H) := R_PROD({[p,E~[p]]: p in H})
--
Theorem halves4: (({H,G} ¥incin halvesP_thryvar) & Is_even(E) & (domain(E) = wholeP_thryvar)) ¥imp (E ¥H_TIMES H = E ¥H_TIMES G). Proof:
Suppose_not(h,g,e) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Def halves7: sign_thryvar := {[[G,H],sgg_thryvar(H) ¥H_TIMES G]: G in halvesP_thryvar, H in halvesP_thryvar}
--
Theorem halves5: ({H,G} ¥incin halvesP_thryvar) ¥imp ((sign_thryvar~[[G,H]] in {R_1,R_Rev(R_1)}) & (sign_thryvar~[[G,H]] = R_1)). Proof:
Suppose_not(g,h) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Def halves8: Def(F ¥H_PROD H) := {[F~[car(p)],F~[cdr(p)]]: p in H}
-- 
Theorem halves6: (Is_perm(F) & (domain(F) = s0) & (H in halvesP_thryvar)) ¥imp ((F ¥H_PROD H) in halvesP_thryvar). Proof:
Suppose_not(f,h) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem halves7: (Is_perm(F) & (domain(F) = s0) & ({H,G} ¥incin halvesP_thryvar)) ¥imp (sign_thryvar~[[F ¥H_PROD G,F ¥H_PROD H]] = sign_thryvar~[[G,H]]). Proof:
Suppose_not(f,h,g) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Def halves9: sgn_thryvar := {[f,arb({sign_thryvar~[[f ¥H_PROD h,h]]: h in halvesP_thryvar})]: f ¥incin (s0 ¥PROD s0) | Is_perm(f) & (domain(f) = s0)}
--
Theorem halves8: (Is_perm(F) & (domain(F) = s0) & (H in halvesP_thryvar)) ¥imp ((sgn_thryvar~[F] in {R_1,R_Rev(R_1)}) & (sgn_thryvar~[F] = sign_thryvar~[[F ¥H_PROD H,H]])). Proof:
Suppose_not(f,h) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem halves9: (Is_perm(D) & Is_perm(F) & (domain(D) = s0) & (domain(F) = s0) & (H in halvesP_thryvar)) ¥imp (Is_perm(D @ F) & (domain(D @ F) = s0) & ((D @ F) ¥H_PROD H) = (D ¥H_PROD (F ¥H_PROD H))). Proof:
Suppose_not(d,f,h) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem halves10: (Is_perm(D) & Is_perm(F) & (domain(D) = s0) & (domain(F) = s0)) ¥imp (sgn_thryvar~[D @ F] = (sgn_thryvar~[D]) ¥R_TIMES (sgn_thryvar~[F])). Proof:
Suppose_not(d,f) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--PAUSE HERE ------------
