Fundamental axioms and methods of definition:
--
(1) Set Booleans and other decidable stuff, including Singleton: {x} and conditional expressions
'if e1 then a1 elseif e2 then a2... end if'
--
(2) Axiom of choice:  (S = 0 and arb(S) = 0) or (arb(S) in S & arb(S) * S = 0)
--
(3) Axiom of infinity: s_inf /= 0 and (FORALL x in s_inf | {x} in s_inf)
--
(4) Algebraic definition, in the ordinary way, including setformers
--
(5) Recursive definition of f(S,A1,...,An) using predefined h(S,A1,...,An) and g(S,A1,...,An)
--
	f(S,A1,..,An) = g({h(f(t,A1,...,An),A1,...,An): t in S},A1,...,An)
--
(6) Definition of groups of symbols by theory application.
--
    THEORY theory_name(list_of_assumed_symbols);
	assumptions...
    END theory_name;
--
    APPLY(new_symbol:defined_symbol_of_theory,...)
	theory_name(list_of_replacements_for_assumed_symbols)
--
    new_theory_name := Combine(theory_name(list_of_replacements_for_assumed_symbols),...)
--
    sets_of_groups := Combine_all(theory_name,s)
--
A remark concerning the 'Axiom of Replacement'. One formulation of this axiom is: if P(x,y) is a predicate such that (FORALL x in s, y, z | ((P(x,y) & P(x,z)) imp (y = z))) then there is a set t such that (FORALL y | (y in t eq (EXISTS x in s | P(x,y)))). This may be subsumed by the very general way in which we Skolemize and allow setformers to be written. I will try to think through this point.
--
-----------------------------------------------------------------------------
	Catalog of Theorems and Definitions

(1) Theorem 0: [Axiom of Choice] ((S = 0) & (arb(S) = 0)) or ((arb(S) in S) & (arb(S) * S = 0))<P>
(2) Theorem 00: [Axiom of Infinity] (s_inf /= 0) & (FORALL x in s_inf | {x} in s_inf)<P>
(3) Theorem 1: [Choice from singleton] arb({X}) = X<P>
(4) Theorem 2: [Choice from set of 2] (X in Y) imp (arb({Y,X}) = X)<P>
(5) Theorem 3: [Choice from pair] arb([X,Y]) = {X}<P>
(6) Theorem 4: [Choice from special set of 2] arb({X,{X,Y}}) = X<P>
(7) Theorem 5: [Choice from pair, 2] arb(arb([X,Y])) = X<P>
(8) Theorem 6: [cdr choice] arb(arb(arb([X,Y] - {arb([X,Y])}) - {arb([X,Y])})) = Y<P>
(9) Theorem 7: [car of pair] car([X,Y]) = X<P>
(10) Theorem 8: [cdr of pair] cdr([X,Y]) = Y<P>
(11) Theorem 9: [Ordered pair property] (car([X,Y]) = X) & (cdr([X,Y]) = Y)<P>
(12) Theorem 10: [Ordered pair property, 2] [X,Y] = [car([X,Y]),cdr([X,Y])]<P>
(13) Theorem 11: [Pair reconstruction lemma] (U = [A,B]) imp (U = [car(U),cdr(U)])<P>
(14) Theorem if_then_else.1: [commutativity property of if_then_else] f(if p then a else b end if) = if p then f(a) else f(b) end if<P>
(15) Theorem if_then_else2.1: [Conditioned interchange of nested occurrences of if_then_else] if p then if q then a else b end if else c end if = if q then ap else if pp then bp else cp end if end if<P>
(16) Theorem setformer.1: [Equality of setformers] ((x1_thryvar notin s) or ((e(x1_thryvar) = e0(x1_thryvar)) & (P(x1_thryvar) eq PP(x1_thryvar)))) imp							({e(x): x in s | P(x)} = {e0(x): x in s | PP(x)})<P>
(17) Theorem setformer01: [Empty setformer lemma] (s /= 0) imp ({e(x): x in s} /= 0)<P>
(18) Theorem setformer02: [Empty setformer lemma 2] ({x in s | P(x)} /= 0) imp ({e(x): x in s | P(x)} /= 0)<P>
(19)     Theorem setformer2_1: [Equality of mapformers] (((x2_thryvar notin s) or (y2_thryvar notin (f(x2_thryvar) + fp(x2_thryvar)))) or    	(((f(x2_thryvar) = fp(x2_thryvar)) & (e2(x2_thryvar,y2_thryvar) = ep2(x2_thryvar,y2_thryvar)) &    		(R(x2_thryvar,y2_thryvar) eq PQ(x2_thryvar,y2_thryvar))))) imp    			({e2(x,y): x in s, y in f(x) | R(x,y)} = {ep2(x,y): x in s, y in fp(x) | PQ(x,y)})<P>
(20) Theorem comprehension1: [Setformer existence] (X in tt_thryvar) eq ((X in s) & P(X))<P>
(21) Theorem comprehension2: [Setformer inclusion lemma] {x in s | P(x)} incin s<P>
(22) Theorem 12: [Members of ordinals are ordinals] (Ord(S) & (T in S)) imp Ord(T)<P>
(23) Theorem 13: [Ordinal membership implies inclusion] (Ord(S) & (T in S)) imp (T incin S)<P>
(24) Theorem ord_ind1: [Transfinite induction principle] Ord(t_thryvar) & P(t_thryvar) & (t_thryvar incin o) & (FORALL x in t_thryvar | not P(x))<P>
(25) Theorem 14: [Ultimate members lemma] S incin Ult_membs(S)<P>
(26) Theorem 15: [Ultimate members lemma 2] Ult_membs(S) = S + {v: x in S, v in Ult_membs(x)}<P>
(27) Theorem 16: [Key property of ultimate members set] ((X in S) & (Y in X)) imp (Y in Ult_membs(S))<P>
(28) Theorem 17: [An ordinal is its own set of ultimate members] (Ord(S)) imp (Ult_membs(S) = S)<P>
(29) Theorem 18: [Ultimate members of a singleton] Ult_membs({S}) = {S} + Ult_membs(S)<P>
(30) Theorem 19: [Ultimate members of an ordinal singleton] Ord(S) imp (Ult_membs({S}) = S + {S})<P>
(31) Theorem 20: [Ultimate members of the basic infinite set] (X in s_inf) imp (membs_x(S,{X}) = membs_x(S,X) + Un(membs_x(S,X)))<P>
(32) Theorem 21: [Ultimate members lemma 3] (S incin Ult_memb1(S)) & (((X in Ult_memb1(S)) & (Y in X)) imp (Y in Ult_memb1(S)))<P>
(33) Theorem transfinite_induction.1: [Transfinite membership induction] P(mt1_thryvar) & ((K in mt1_thryvar) imp (not P(K)))<P>
(34) Theorem 22: [Monotonicity of ultimate members set] (Y in Ult_membs(S)) imp (Ult_membs(Y) incin Ult_membs(S))<P>
(35) Theorem 23: [Members of ultimate members are also subsets] (Y in Ult_membs(S)) imp (Y incin Ult_membs(S))<P>
(36) Theorem transfinite_member_induction1: [Ultimate members and transfinite induction] P(mt2_thryvar) & (mt2_thryvar in Ult_membs({n})) & ((K in mt2_thryvar) imp (not P(K)))<P>
(37) Theorem 24: [Only the null set has a null domain] (S = 0) eq (domain(S) = 0)<P>
(38) Theorem 25: [Only the null set has a null range] (S = 0) eq (range(S) = 0)<P>
(39) Theorem 26: [Maps are mapformers] Is_map(F) eq (F incin {[car(x),cdr(x)]: x in F})<P>
(40) Theorem iz_map.1: [Mapformers are maps] Is_map({[a(x),b(x)]: x in s}) & (domain({[a(x),b(x)]: x in s}) = {a(x): x in s}) & (range({[a(x),b(x)]: x in s}) = {b(x): x in s})<P>
(41) Theorem iz_map_2.1: [Two-variable mapformers] Is_map({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)})<P>
(42) Theorem iz_map_3.1: [Three-variable mapformers] Is_map({[a3(x,y,yy),b3(x,y,yy)]: x in s, y in t, yy in u | P3(x,y,yy)})<P>
(43) Theorem Svm_test.1: [Single-valuedness test] ((x3_thryvar in s) & (y3_thryvar in s) & (a(x3_thryvar) = a(y3_thryvar)) & (b(x3_thryvar) /= b(y3_thryvar))) or				Svm({[a(x),b(x)]: x in s})<P>
(44) Theorem Svm_test_2.1: [Single-valuedness test, two-variable case] ((x4_thryvar in s) & (y4_thryvar in t) & (xp1_thryvar in s) & (yp1_thryvar in t) &	(a2(x4_thryvar,y4_thryvar) = a2(xp1_thryvar,yp1_thryvar)) & (b2(x4_thryvar,y4_thryvar) /= b2(xp1_thryvar,yp1_thryvar))) or	 		Svm({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)})<P>
(45) Theorem Svm_test_3.1: [Single-valuedness test, three-variable case] ((x5_thryvar in s) & (y5_thryvar in t) & (z1_thryvar in u) & (xp2_thryvar in s) & (yp2_thryvar in t) &	(zp1_thryvar in u) & P3(x5_thryvar,y5_thryvar,z1_thryvar) & P3(xp2_thryvar,yp2_thryvar,zp1_thryvar) &	(a3(x5_thryvar,y5_thryvar,z1_thryvar) = a3(xp2_thryvar,yp2_thryvar,zp1_thryvar))		& (b3(x5_thryvar,y5_thryvar,z1_thryvar) /= b3(xp2_thryvar,yp2_thryvar,zp1_thryvar))) or			Svm({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)})<P>
(46) Theorem one_1_test.1: [One-one map former test] ((x6_thryvar in s) & (y6_thryvar in s) & (((a(x6_thryvar) = a(y6_thryvar)) neq (b(x6_thryvar) = b(y6_thryvar))))) or			 one_1_map({[a(x),b(x)]: x in s})<P>
(47) Theorem one_1_test_2.1: [One-one map former test, two-variable case] ((x7_thryvar in s) & (y7_thryvar in t) & (x2_thryvar in s) & (y2_thryvar in t) &		(not((a2(x7_thryvar,y7_thryvar) = a2(x2_thryvar,y2_thryvar)) eq (b2(x7_thryvar,y7_thryvar) = b2(x2_thryvar,y2_thryvar))))) or			 one_1_map({[a2(x,y),b2(x,y)]: x in s, y in t})<P>
(48) Theorem one_1_test_3.1: [Single-valued map former, three-variable case] ((x8_thryvar in s) & (y8_thryvar in t) & (z2_thryvar in r) &                (xp3_thryvar in s) & (yp3_thryvar in t) & (zp2_thryvar in r) &                P3(x8_thryvar,y8_thryvar,z2_thryvar) & P3(xp3_thryvar,yp3_thryvar,zp2_thryvar) &		(((a3(x8_thryvar,y8_thryvar,z2_thryvar) /= a3(xp3_thryvar,yp3_thryvar,zp2_thryvar)) eq (b3(x8_thryvar,y8_thryvar,z2_thryvar) = b3(xp3_thryvar,yp3_thryvar,zp2_thryvar))))) or			 one_1_map({[a3(x,y,wz),b3(x,y,wz)]: x in s, y in t,wz in r | P3(x,y,wz)})<P>
(49) Theorem 27: [Ordinal comparison lemma] (Ord(S) & Ord(T) & (T incin S)) imp ((T = S) or (T = arb(S - T)))<P>
(50) Theorem 28: [Ordinal intersection] (Ord(S) & Ord(T)) imp Ord(S * T)<P>
(51) Theorem 29: [Second ordinal comparison lemma] (Ord(S) & Ord(T)) imp ((S incin T) or (T incin S))<P>
(52) Theorem 30: [Ordinal maximum and minimum] (Ord(S) & Ord(T)) imp (Ord(S + T) & Ord(S * T))<P>
(53) Theorem 31: [Ordinal membership comparison] (Ord(S) & Ord(T)) imp ((S in T) or (T in S) or (S = T))<P>
(54) Theorem 32: [Successor ordinal] Ord(S) imp Ord(next(S))<P>
(55) Theorem 33: [Successor ordinal 2] Ord(S) imp Ord(S + {S})<P>
(56) Theorem 34: [Third ordinal comparison lemma] (Ord(S) & Ord(T)) imp ((T incin S) eq ((T in S) or (T = S)))<P>
(57) Theorem 35: [Ordinal membership and comparison] (Ord(S) & Ord(T)) imp ((T notin S) eq (S incin T))<P>
(58) Theorem 36: [Membership in the successor of an ordinal $s$] Ord(S) imp ((T in next(S)) eq ((T incin S) & Ord(T)))<P>
(59) Theorem 37: [Membership of $s$ in an ordinal $t$ implies inclusion of $next(s)$ in $t$] (Ord(T) & (S in T)) imp (next(S) incin T)<P>
(60) Theorem 38: [The class of all sets is not a set] not(EXISTS x | (FORALL y | y in x))<P>
(61) Theorem 39: [There is no antinomic Russell's set] not(EXISTS x | (FORALL y | (y in x) eq (y notin y)))<P>
(62) Theorem 40: [The class of ordinals is not a set]    not (FORALL x | ((x in OS) eq Ord(x)))<P>
(63) Theorem 41: [Enumerability principle] ((Ord(X) & S in {enum(y,S): y in X})) imp (S incin {enum(y,S): y in X})<P>
(64) Theorem 42: [Enumeration membership lemma] (enum(X,S) = S) or (enum(X,S) in S)<P>
(65) Theorem 43: [Enumeration inclusion lemma] ((enum(X,S) = S) & (Y incs X)) imp (enum(Y,S) = S)<P>
(66) Theorem 44: [The enumeration of a set is 1-1]    (Ord(X) & Ord(W) & (X /= W)) imp	((S in {enum(u,S): u in X}) or (S in {enum(u,S): u in W}) or (enum(X,S) /= enum(W,S)))<P>
(67) Theorem 45: [Enumeration lemma] (EXISTS x | (Ord(x) & (S in {enum(y,S): y in x})))<P>
(68) Theorem 46: [Main enumeration theorem]    (EXISTS x | Ord(x) & (S = {enum(y,S): y in x}) &	(FORALL y in x, z0 in x | ((y /= z0) imp (enum(y,S) /= enum(z0,S)))))<P>
(68+) Theorem 47: [Enumeration single-valuedness principle] (FORALL s | (Ord(enum_Ord(s)) & (s = {enum(y,s): y in enum_Ord(s)}) &		(FORALL y in enum_Ord(s), z0 in enum_Ord(s) | ((y /= z0) imp (enum(y,s) /= enum(z0,s))))))<P>
(69) Theorem 48: [Map restriction lemma] (F ON A) incin F<P>
(70) Theorem 49: [Set intersection formula] S * T = {x in S | x in T}<P>
(71) Theorem 50: [Set difference formula] S - T = {x in S | x notin T}<P>
(72) Theorem 51: [Map members are pairs] (Is_map(F) imp ((X in F) imp (X = [car(X),cdr(X)]))) &		((FORALL x in F | x = [car(x),cdr(x)]) imp Is_map(F))<P>
(73) Theorem 52: [Map subsets are maps] (G incin F & Is_map(F)) imp Is_map(G)<P>
(74) Theorem 53: [Single-valued map subsets are single-valued] ((G incin F) & Svm(F)) imp Svm(G)<P>
(75) Theorem 54: [One-one map subsets are one-one] ((G incin F) & one_1_map(F)) imp one_1_map(G)<P>
(76) Theorem 55: [Map compositions are maps] Is_map(F @ G)<P>
(77) Theorem 56: [Map restrictions are maps] Is_map(F) imp Is_map(F ON S)<P>
(78) Theorem 57: [Restrictions of single-valed maps are single-valued] Svm(F) imp Svm(F ON S)<P>
(79) Theorem 58: [Restrictions of one-one maps are one-one] one_1_map(F) imp one_1_map(F ON S)<P>
(80) Theorem 59: [The null set as a map] Is_map(0) & Svm(0) & (one_1_map(0)) & (range(0) = 0) & (domain(0) = 0)<P>
(81) Theorem 60: [Domain membership lemma] (X in F) imp (car(X) in domain(F))<P>
(82) Theorem 61: [Range membership lemma] (X in F) imp (cdr(X) in range(F))<P>
(83) Theorem 62: [Map unions are maps] (Is_map(F) & Is_map(G)) imp Is_map(F + G)<P>
(84) Theorem 63: [Map restriction is additive] F ON (A + B) = (F ON A) + (F ON B)<P>
(85) Theorem 64: [Restriction of union maps] (F + G) ON A = (F ON A) + (G ON A)<P>
(86) Theorem 65: [Monotonicity of range and domain sets] (F incin G) imp ((range(F) incin range(G)) & (domain(F) incin domain(G)))<P>
(87) Theorem 66: [Associativity of map multiplication] F @ (G @ H) = (F @ G) @ H<P>
(88) Theorem 67: [Restriction of a map to its own domain] F ON domain(F) = F<P>
(89) Theorem 68: [Restriction to an intersection set] F ON (domain(F) * T) = F ON T<P>
(90) Theorem 69: [Double restriction] F ON (S * T) = (F ON S) ON T<P>
(91) Theorem 70: [Null restriction] F ON 0 = 0<P>
(92) Theorem 71: [Map image elements belong to the map range] (X in domain(F)) imp ((F~[X]) in range(F))<P>
(93) Theorem fcn_symbol.1: [Mapformer domain] domain(g) = s<P>
(94) Theorem fcn_symbol.2: [Image by a mapformer] (XX in s) imp (g~[XX] = f(XX))<P>
(95) Theorem fcn_symbol.2a: [Image by a mapformer, quantified form] (FORALL x in s | g~[x] = f(x))<P>
(96) Theorem fcn_symbol.3: [Elements not in a mapformer domain] (XX notin s) imp (g~[XX] = 0)<P>
(97) Theorem fcn_symbol.4: [Mapformer image in general] g~[XX] = if XX in s then f(XX) else 0 end if<P>
(98) Theorem fcn_symbol.4a: [Image by a mapformer, quantified form] (FORALL x | g~[x] = if x in s then f(x) else 0 end if)<P>
(99) Theorem fcn_symbol.5: [Range of a mapformer] range(g) = {f(xx) : xx in s}<P>
(100) Theorem fcn_symbol.6: [Mapformer one-to-oneness test] ((x9_thryvar in s) & (y9_thryvar in s) & (f(x9_thryvar) = f(y9_thryvar)) & (x9_thryvar /= y9_thryvar)) or					 one_1_map(g)<P>
(101)  Theorem fcn_symbol.7: [?] Svm(g)<P>
(102) Theorem 72: [Form of a single-valued map] Svm(F) eq (F = {[x,F~[x]]: x in domain(F)})<P>
(103) Theorem 73: [Form of a single-valued map range] Svm(F) imp (F = {[x,F~[x]]: x in domain(F)} & (range(F) = {F~[x]: x in domain(F)}))<P>
(104) Theorem 74: [Map image formula] (Svm(F) & (X in F)) imp (F~[car(X)] = cdr(X))<P>
(105)  Theorem 75: (X in domain(F)) imp (F~[X] in range(F))<P>
(106) Theorem 76: [Map members are pairs, 2] (Is_map(F) & (U in F)) imp (U = [car(U),cdr(U)])<P>
(107) Theorem 77: [Map domain member lemma] Is_map(F) imp ((X in domain(F)) eq ([X,F~[X]] in F))<P>
(108) Theorem Must_be_svm.1: [Single-valued map former] Svm({[x,b(x)]: x in s}) & (domain({[x,b(x)]: x in s}) = s) & (range({[x,b(x)]: x in s}) = {b(x): x in s}) & ((u in s) imp ({[x,b(x)]: x in s}~[u] = b(u)))<P>
(109) Theorem Must_be_svm_2.1: [Single-valued map former, two-variable case] Svm({[[x,y],b2(x,y)]: x in s, y in t | P2(x,y)})<P>
(110) Theorem 78: [Map domains are additive] domain(F + G) = domain(F) + domain(G)<P>
(111) Theorem 79: [Map ranges are additive] range(F + G) = range(F) + range(G)<P>
(112) Theorem 80: [Range of a restriction map] range(F ON S) incin range(F)<P>
(113) Theorem 81: [Range of restriction to a union] range(F ON (S + T)) = range(F ON S) + range(F ON T)<P>
(114) Theorem 82: [Restriction to a subset] (S incs T) imp (range(F ON S) incs range(F ON T))<P>
(115) Theorem 83: [One-one map-restriction to an intersection] one_1_map(F) imp (range(F ON (S * T)) = range(F ON S) * range(F ON T))<P>
(116) Theorem 84: [Restriction to the null set] ((F ON 0) = 0) & (range(F ON 0) = 0)<P>
(117) Theorem 85: [One-one map restriction to disjoint sets] (one_1_map(F) & (S * T = 0)) imp (range(F ON S) * range(F ON T) = 0)<P>
(118) Theorem 86: [Domain is null only when range is null] (domain(F) = 0) eq (range(F) = 0)<P>
(119) Theorem 87: [Union of single-valued maps] (Svm(F) & Svm(G) & (domain(F) * domain(G) = 0)) imp Svm(F + G)<P>
(120) Theorem 88: [Union of 1-1 maps]    (one_1_map(F) & one_1_map(G) & (range(F) * range(G) = 0) & (domain(F) * domain(G) = 0)) imp one_1_map(F + G)<P>
(121) Theorem 89: [Union of 1-1 maps, 2] (one_1_map(F + G) & ((G * F) = 0)) imp ((domain(G) = (domain(F + G) - domain(F))) & (range(G) = (range(F + G) - range(F))))<P>
(122) Theorem 90: [Members of the inverse map] Is_map(F) imp (([X,Y] in F) eq ([Y,X] in inv(F)))<P>
(123) Theorem 91: [Singletons as maps] Svm({[X,Y]}) & one_1_map({[X,Y]}) & (({[X,Y]}~[X]) = Y)<P>
(124) Theorem 92: [Doubletons as maps] Is_map({[X,Y],[Z,W]}) & (domain({[X,Y],[Z,W]}) = {X,Z}) & (range({[X,Y],[Z,W]}) = {Y,W}) &	((X /= Z) imp Svm({[X,Y],[Z,W]}))<P>
(125) Theorem 93: [Doubletons as maps, 2] (X /= Z) imp ({[X,Y],[Z,W]}~[X] = Y)<P>
(126) Theorem 94: [Domain of restriction] domain(F ON S) = domain(F) * S<P>
(127) Theorem 95: [Range and domain of map product] (range(F @ G) = range(F ON range(G))) & ((range(G) incin domain(F)) imp (domain(F @ G) = domain(G)))<P>
(128) Theorem 96: [Range and domain of map product, 2] (range(G) = domain(F)) imp ((range(F @ G) = range(F)) & (domain(F @ G) = domain(G)))<P>
(129) Theorem 97: [Range and domain of map product, 3] (range(G) incin domain(F)) imp ((range(F @ G) incin range(F)) & (domain(F @ G) = domain(G)))<P>
(130) Theorem 98: [Range of restriction of one-one map] (one_1_map(F) & (S incin domain(F)) & (S /= domain(F))) imp	((range(F ON S) incin range(F)) & (range(F ON S) /= range(F)))<P>
(131) Theorem 99: [Inverse map basic properties] Is_map(inv(F)) & range(inv(F)) = domain(F) & domain(inv(F)) = range(F)<P>
(132) Theorem 100: [Double inverse map] Is_map(F) imp (F = inv(inv(F)))<P>
(133) Theorem 101: [Inverse of a one-one map]    one_1_map(F) imp (one_1_map(inv(F)) & (F = inv(inv(F))) & (range(inv(F)) = domain(F)) & (domain(inv(F)) = range(F)))<P>
(134) Theorem 102: [Inverse image of an element] (one_1_map(F) & (X in domain(F))) imp (inv(F)~[F~[X]] = X)<P>
(135) Theorem 103: [Inverse image of an element's map image] one_1_map(F) imp	(((X in domain(F)) imp (inv(F)~[F~[X]] = X)) & ((X in range(F)) imp (F~[inv(F)~[X]] = X)))<P>
(136) Theorem setformer_unravel1: {x: y in {e(f): f in s}, x in g(y)} = {x: f in s, x in g(e(f))}<P>
(137) Theorem 104: [binary intersection distributes over monadic union]	Un(F) * X = Un({y * X : y in F})<P>
(138) Theorem 105: [membership in unionset] (X in Un(Y)) eq ({v in Y | X in v} /= 0)<P>
(139) Theorem 106: [Union set of a doubleton] Un({X,Y}) = (X + Y)<P>
(140) Theorem 107: [Union set of a singleton] Un({X}) = X<P>
(141) Theorem 108: [Recursive relationship for the union set] (Un(0) = 0) & ((X in M) imp (Un(M) = (X + Un(M - {X}))))<P>
(142) Theorem 109: [Recursive relationship for the union set, 2] (Un(0) = 0) & ((M /= 0) imp (Un(M) = (arb(M) + Un(M - {arb(M)}))))<P>
(143) Theorem unionset_commuter1: [Set separation and unionset formation commute] {e(x): x in Un(s)} = Un({{e(x): x in f}: f in s})<P>
(144) Theorem unionset_commuter2: [Set formation and set enumeration commute] {e(x): x in s} = Un({{e(x)}: x in s})<P>
(145) Theorem unionset_commuter3: [setformers whose iteration variable is bounded by 0 designate 0] {e(x): x in 0} = 0<P>
(146) Theorem unionset_commuter4: [setformers whose iteration variable is bounded by a doubleton designate doubletons] {e(x): x in {s,T}} = {e(s),e(T)}<P>
(147) Theorem unionset_commuter5: [setformers whose iteration variable is bounded by a singleton designate singletons] {e(x): x in {s}} = {e(s)}<P>
(148) Theorem unionset_commuter6: [split of setformer over union-bounded iterator] {e(x): x in (s + T)} = {e(x): x in s} + {e(x): x in T}<P>
(149) Theorem 110: [Map inversion and unionset formation commute] inv(Un(S)) = Un({inv(f): f in S})<P>
(150) Theorem 111: [Map inversion and the union operation commute] inv(X + Y) = inv(X) + inv(Y)<P>
(151) Theorem 112: [Range formation and unionset formation commute] range(Un(S)) = Un({range(f): f in S})<P>
(152) Theorem 113: [Domain formation and unionset formation commute] domain(Un(S)) = Un({domain(f): f in S})<P>
(153) Theorem 114: [Domain and range of singleton and doubleton maps] (domain({[X,Y]}) = {X}) & (range({[X,Y]}) = {Y}) & (domain({[X,Y],[U,V]}) = {X,U}) & (range({[X,Y],[U,V]}) = {Y,V})<P>
(154) Theorem 115: [Elementary properties of identity maps]	one_1_map(ident(S)) & (domain(ident(S)) = S) & (range(ident(S)) = S) & (inv(ident(S)) = ident(S)) &	 ((X in S) imp (ident(S)~[X] = X)) &	(Is_map(F) imp (((domain(F) incin S) imp (F @ ident(S) = F)) & ((range(F) incin S) imp (ident(S) @ F = F))))<P>
(155) Theorem 116: [Composition with an identity map is restriction] (Is_map(F)) imp (F @ ident(S) = F ON S)<P>
(156) Theorem 117: [Composition with the inverse map] Svm(F) imp (F @ inv(F) = ident(range(F)))<P>
(157) Theorem 118: [Inverses of one-one maps] one_1_map(F) imp (((F @ inv(F)) = ident(range(F))) & ((inv(F) @ F) = ident(domain(F))))<P>
(158) Theorem 119: [Product of inverses lemma]	(Is_map(F) & Is_map(G) & (domain(F) incin range(G)) & Svm(F @ G)) imp Svm(F)<P>
(159) Theorem 120: [Product of Inverses] (Is_map(F) & Is_map(G)) imp (inv(F @ G) = inv(G) @ inv(F))<P>
(160) Theorem 121: [One-one-ness and singlevaluedness] one_1_map(F) eq (Svm(F) & Svm(inv(F)))<P>
(161) Theorem 122: [An inverse pair of maps must be 1-1 and must be each other's inverses]    (Is_map(F) & Is_map(G) & (domain(F) = range(G)) & (range(F) = domain(G)) &	(F @ G = ident(range(F))) & (G @ F = ident(domain(F)))) imp (one_1_map(F) & (G = inv(F)))<P>
(162) Theorem 123: [Single-valued map restrictions as setformers] Svm(F) imp (((F ON S) = {[x,F~[x]]: x in domain(F) | x in S}) &	(domain(F ON S) = {x: x in domain(F) | x in S}) &	(range(F ON S) = {F~[x]: x in domain(F) | x in S}))<P>
(163) Theorem 124: [Image of a non-domain element] (X notin domain(F)) imp ((F~[X]) = 0)<P>
(164) Theorem 125: [Value of a restriction map] (F ON S)~[X] = if X in domain(F ON S) then F~[X] else 0 end if<P>
(165) Theorem 126: [Single-valued map restrictions as setformers, 2] Svm(F) imp (((F ON S) = {[x,F~[x]]: x in domain(F ON S)}) &	(range(F ON S) = {F~[x]: x in domain(F ON S)}))<P>
(166) Theorem 127: [Images under one-one maps] (one_1_map(F) & (X in domain(F)) & (Y in domain(F)) & (F~[X] = F~[Y])) imp (X = Y)<P>
(167) Theorem 128: [Composition of single-valued maps] (Svm(F) & Svm(G)) imp Svm(F @ G)<P>
(168) Theorem 129: [Images under single-valued map composition] (Svm(F) & Svm(G) & (X in domain(G)) & (range(G) incin domain(F))) imp ((F @ G)~[X] = F~[G~[X]])<P>
(169) Theorem 130: [Single-valued map ranges and domains as set formers] (Svm(F) & Svm(G) & (X in domain(G)) & (range(G) incin domain(F))) imp	(((F @ G)~[X] = F~[G~[X]]) & (F @ G = {[x,F~[G~[x]]]: x in domain(G)}) & (range(F @ G) = {F~[G~[x]]: x in domain(G)}))<P>
(170) Theorem 131: [Image under single-valued map] (Svm(F) & (G incin F) & (X in domain(G))) imp (F~[X]=G~[X])<P>
(171) Theorem 132: [Single-valued and one-one maps] Is_map(F) imp (one_1_map(F) eq one_1_map(inv(F)))<P>
(172) Theorem 133: [Composition of one-one maps] (one_1_map(F) & one_1_map(G)) imp one_1_map(F @ G)<P>
(173) Theorem 134: [Elements are defined uniquely by their one-one images] Svm(F) imp (one_1_map(F) eq	(FORALL x in domain(F), y in domain(F) | ((F~[x] = F~[y]) imp (x = y))))<P>
(174) Theorem 135: [A 1-1 map on a set $u$ induces a 1-1 map on the power set of $u$]    (one_1_map(F) & (S incin domain(F)) & (T incin domain(F)) & (S /= T)) imp    			(range(F ON S) /= range(F ON T))<P>
(175) Theorem 136: [Union of map composition] (F + FF) @ G = (F @ G) + (FF @ G)<P>
(176) Theorem 137: [Union of map composition, 2] G @ (F + FF) = (G @ F) + (G @ FF)<P>
(177) Theorem 138: [Single-valued maps have 1-1 partial inverses]    Svm(F) imp (EXISTS h | ((domain(h) = range(F)) & (range(h) incin domain(F)) & one_1_map(h)) &	(FORALL x in range(F) | (F~[h~[x]] = x)))<P>
(178) Theorem 139: [Cartesian product with a null set] (N PROD 0 = 0) & (0 PROD N = 0)<P>
(179) Theorem 140: [Members of Cartesian products] (X in (S PROD T)) imp ((car(X) in S) & (cdr(X) in T))<P>
(180) Theorem 141: [Subsets of Cartesian products] (Y incin (S PROD T)) eq (Is_map(Y) & (domain(Y) incin S) & (range(Y) incin T))<P>
(181) Theorem 142: [Image of Cartesian product by a singleton] (U in Z) imp (((Z PROD {V})~[U]) = V)<P>
(182) Theorem 143: [Cartesian product disjointness] (A * B = 0) imp ((X PROD A) * (Y PROD B) = 0)<P>
(183) Theorem 144: [Cartesian modified associativity] (F = {[[[x,y],z],[x,[y,z]]]: x in A, y in B, z in C}) imp	(one_1_map(F) & (domain(F) = ((A PROD B) PROD C)) & (range(F) = (A PROD (B PROD C))))<P>
(184) Theorem 145: [Cartesian modified commutativity] (F = {[[x,y],[y,x]]: x in A, y in B}) imp			(one_1_map(F) & (domain(F) = (A PROD B)) & (range(F) = (B PROD A)))<P>
(185) Theorem 146: [Enumeration of an ordinal] (Ord(S) & X in S) imp (enum(X,S) = X)<P>
(186) Theorem 147: [Cardinality lemma] Ord(#S) & (EXISTS f in OM | (one_1_map(f) & (range(f) = S) & (domain(f) = #S))) &	(not((EXISTS o in #S | (EXISTS g in OM | one_1_map(g) & (range(g) = S) & (domain(g) = o)))))<P>
(187) Theorem 148: [Cardinality minimum theorem] S notin #S<P>
(188) Theorem 149: ['arb' is monotone decreasing for non-empty sets of ordinals]    (Ord(R) & (R incs S) & (S incs T)) imp (arb(S) in arb(T) or arb(S) = arb(T) or T = 0)<P>
(189) Theorem 150: [Axiom of choice variant] ((S /= 0) & (FORALL x in S | Ord(x))) imp (FORALL x in S | x incs arb(S))<P>
(190) Theorem 151: [Lemma for ordinal enumeration]	(Ord(S) & (T incin S) & (X in S) & (Y in X)) imp (enum(Y,T) in enum(X,T) or enum(X,T) incs T)<P>
(191) Theorem 152: [Subsets of an ordinal enumerate at least as rapidly as the ordinal]	(Ord(S) & (T incin S) & (X in S)) imp (enum(X,T) incs X or enum(X,T) incs T)<P>
(192) Theorem 153: [Subset enumeration lemma] (Ord(S) & (T incin S)) imp ({enum(x,T): x in S} incs T)<P>
(193) Theorem 154: [Second subset enumeration lemma] (Ord(S) & (T incin S)) imp (EXISTS x incin S | (Ord(x) & (T = {enum(y,T): y in x}) &	(FORALL y in x, z in x | ((y /= z) imp (enum(y,T) /= enum(z,T))))))<P>
(194) Theorem 155: [Enumerability lemma] (Ord(S) & (T incin S)) imp	(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (domain(f) incin S) & (range(f) = T))<P>
(195) Theorem 156: [Cardinality theorem] Card(#S) & Ord(#S) & (EXISTS f in OM | one_1_map(f) & (range(f) = S) & (domain(f) = #S))<P>
(196) Theorem 157: [One-one maps are cardinality preserving] one_1_map(F) imp (#range(F) = #domain(F))<P>
(197) Theorem 158: [Equicardinality is equivalent to one-one correspondence] (EXISTS F in OM | (one_1_map(F) & (range(F) = S) & (domain(F) = T))) eq (#S = #T)<P>
(198) Theorem 159: [The enumerating ordinal of a set has the same cardinality as the set]    (EXISTS o | Ord(o) & (S = {enum(x,S): x in o}) & (#o = #S))<P>
(199) Theorem 160: [Associative Law for Cardinals] #((A PROD B) PROD C) = #(A PROD (B PROD C))<P>
(200) Theorem 161: [Commutative Law for Cardinals] #(A PROD B) = #(B PROD A)<P>
(201) Theorem 162: [Sets of cardinality 0 must be null] (#S = 0) eq (S = 0)<P>
(202) Theorem 163: [Non-null sets have cardinality greater than 0] (0 in #S) eq (S /= 0)<P>
(203) Theorem 164: [A cardinal is its own cardinality] Card(S) eq (S = #S)<P>
(204) Theorem 165: [Uniqueness of Cardinality]	(Card(C) & (EXISTS f in OM | (one_1_map(f) & (range(f) = S) & domain(f) = C))) imp (C = #S)<P>
(205) Theorem 166: [The cardinality operator is idempotent] #S = ##S<P>
(206) Theorem 167: [All cardinals are comparable] (#S in #T) or (#S = #T) or (#T in #S)<P>
(207) Theorem 168: [Cardinal comparison is transitive] ((#S in #T) & (#T in #R)) imp (#S in #R)<P>
(208) Theorem 169: [Subsets of an ordinal have a cardinality that is no larger than the ordinal]    (Ord(S) & (T incin S)) imp (#T incin S)<P>
(209) Theorem 170: [Subset cardinality theorem] (T incin S) imp (#T incin #S)<P>
(210) Theorem 171: [Single-valued mapping cannot increase cardinality] Svm(F) imp (#range(F) incin #domain(F))<P>
(211) Theorem 172: [The cardinality of a map is no smaller than the cardinality of its domain] #domain(F) incin #F<P>
(212) Theorem 173: [The cardinality of a map is no smaller than the cardinality of its range] #range(F) incin #F<P>
(213) Theorem 174: [The cardinality of a single-valued map equals the cardinality of its domain] Svm(F) imp (#domain(F) = #F)<P>
(214) Theorem 175: [Cardinality of restriction maps] (Svm(F) & (domain(F) incs A)) imp (#(F ON A) = #A)<P>
(215) Theorem fcn_symbol1: [Cardinality of mapformers and range formers] (#{[xx,f(xx)]: xx in s} = #s) & (#{f(xx): xx in s} incin #s)<P>
(216) Theorem 176: [Condition for existence of a single-valued map between two sets] (#S incs #T) eq (T = 0 or (EXISTS f in OM | Svm(f) & (domain(f) = S) & (range(f) = T)))<P>
(217) Theorem 177: [Domains and ranges of inverse] domain(G) = (G INV_IM R) + (G INV_IM (range(G) - R))<P>
(218) Theorem 178: [Range-decomposition of a map domain] ((S * R = 0) & Svm(G)) imp (((G INV_IM S) * (G INV_IM R)) = 0)<P>
(219) Theorem 179: [Inverse image of a range element] (Y in range(G)) imp ((G INV_IM {Y}) /= 0)<P>
(220) Theorem 180: [Range of a restricted inverse map] G INV_IM R = range(inv(G) ON R)<P>
(221) Theorem 181: [Single-valued inverse image as a setformer] Svm(inv(G)) imp (G INV_IM R = {inv(G)~[w]: w in (R * range(G))})<P>
(222) Theorem 182: [Inverse image of a range element] (one_1_map(G) & (Y in range(G))) imp (G INV_IM {Y} = {inv(G)~[Y]})<P>
(223) Theorem 183: [Range of a map restricted to an inverse image] range(G ON (G INV_IM R)) incs (range(G) * R)<P>
(224) Theorem 184: [Range of a single-valued map restricted to an inverse image] Svm(G) imp (range(G ON (G INV_IM A)) = range(G) * A)<P>
(225) Theorem 185: [Inverse images by a single-valued map] Svm(G) imp ((G ON (G INV_IM A)) INV_IM B = (G INV_IM A) * (G INV_IM B))<P>
(226) Theorem 186: [Monotonicity of inverse image] (B incin A) imp ((G INV_IM B) incin (G INV_IM A))<P>
(227) Theorem 187: [Successive map restrictions] (((F ON A) ON B) = (F ON (A * B)))<P>
(228) Theorem 188: [0 is a finite cardinal] Ord(0) & Finite(0) & Card(0)<P>
(229) Theorem 189: [A subset of a finite set is finite] (Finite(S) & (S incs T)) imp Finite(T)<P>
(230) Theorem 190: [One-one maps preserve finiteness] one_1_map(F) imp ((Finite(domain(F))) imp (Finite(range(F))))<P>
(231) Theorem 191: [One-one maps preserve finiteness, 2] one_1_map(F) imp (Finite(domain(F)) eq Finite(range(F)))<P>
(232) Theorem 192: [A single-valued map with finite domain has a finite range]	(Svm(F) & Finite(domain(F))) imp Finite(range(F))<P>
(233) Theorem finite_image.1: [Any image of a finite set is finite] Finite({e(x): x in s0})<P>
(234) Theorem 193: [A set is finite if and only if its cardinality is finite] Finite(S) eq Finite(#S)<P>
(235) Theorem 194: [Proper subsets of a finite set have fewer elements] (Finite(S) & (T incin S) & (T /= S)) imp (#T in #S)<P>
(236) Theorem 195: [A set is finite if and only if it is not the single-valued image of any of its finite subsets] Finite(S) eq	(not(EXISTS f in OM | (Svm(f) & (range(f) = S) & (domain(f) incin S) & (S /= domain(f)))))<P>
(237) Theorem 196: [Members of a finite ordinal are finite] (Ord(S) & Finite(S) & (T in S)) imp Finite(T)<P>
(238) Theorem 197: [Any infinite ordinal is larger than any finite ordinal]	(Ord(S) & Ord(T) & (not Finite(S)) & Finite(T)) imp (T in S)<P>
(239) Theorem 198: [Interchange lemma]    ((X in S) & (Y in S)) imp (EXISTS f | one_1_map(f) & (range(f) = S) & (domain(f) = S) & ((f~[X]) = Y) & ((f~[Y]) = X))<P>
(240) Theorem 199: [Adding one element to a finite set leaves it finite] Finite(S) eq Finite(S + {X})<P>
(241) Theorem 200: [Finiteness of successor set] Finite(S) imp Finite(next(S))<P>
(242) Theorem 201: [Singletons are finite] Finite({S})<P>
(243) Theorem 202: [Doubletons are finite] Finite({S,T})<P>
(244) Theorem 203: [The basic infinite set is not finite] not(Finite(s_inf))<P>
(245) Theorem 204: [Infinite cardinality theorem] not Finite(#s_inf)<P>
(246) Theorem 205: [All finite ordinals are cardinals] (Ord(X) & Finite(X)) imp Card(X)<P>
(247) Theorem setformer_meet_join.1: [Disjunction in a setformer] {h(u,v): u in s, v in t | R(u,v) or Q(u,v)} = ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)})<P>
(248) Theorem setformer_meet_join.2: [Conjunction in a setformer] {h(u,v): u in s, v in t | R(u,v) & Q(u,v)} incin ({h(u,v): u in s, v in t | R(u,v)} * {h(u,v): u in s, v in t | Q(u,v)})<P>
(249) Theorem setformer_meet_join.3: [Implication in a setformer] (FORALL u in s, v in t | Q(u,v) imp R(u,v)) imp ({h(u,v): u in s, v in t | Q(u,v)} incin {h(u,v): u in s, v in t | R(u,v)})<P>
(250) Theorem setformer_meet_join.4: [Setformer cardinality inclusion, two-variable case] #{[u,v]: u in s, v in t | R(u,v)} incs #{h(u,v): u in s, v in t | R(u,v)}<P>
(251) Theorem setformer_meet_join.5: [Setformer finiteness implication, two-variable case] Finite({[u,v]: u in s, v in t | R(u,v)}) imp Finite({h(u,v): u in s, v in t | R(u,v)})<P>
(252) Theorem 206: [The set of integers is an infinite ordinal consisting of all finite ordinals] Ord(Za) & (not Finite(Za)) & ((Card(X) & Finite(X)) eq (X in Za))<P>
(253) Theorem 207: [All integers are finite ordinals and cardinals] (X in Za) imp ((X = #X) & Card(X) & Ord(X) & Finite(X))<P>
(254) Theorem 208: [Transitivity of integer comparison] ((M in Za) & (N in Za) & (I in N)) imp ((M in N) or (I in M))<P>
(255) Theorem 209: [The set of integers is a Cardinal] Card(Za)<P>
(256) Theorem 210: [The successor of an integer is an integer] (I in Za) imp (Card(next(I)) & (next(I) in Za))<P>
(257) Theorem 211: [The first few integers are all cardinals] Ord(0) & (0 in Za) & (1 in Za) & (2 in Za) & (3 in Za) & Card(0) & Card(1) & Card(2) & Card(3)<P>
(258) Theorem 212: [The first few integers are all distinct] (0 in Za) & (1 in Za) & (2 in Za) & (3 in Za) & (1 /= 0) & (2 /= 0) & (3 /= 0) & (1 /= 2) & (1 /= 3) & (2 /= 3)<P>
(259) Theorem 213: [Powerset of the null set] pow(0) = {0}<P>
(260) Theorem 214: [Membership, singleton, and powerset] (X in L) eq ({X} in pow(L))<P>
(261) Theorem 215: [Singleton and powerset] ({0,X} incin pow(X)) & ((X = {Y}) imp (pow(X) = {0,X}))<P>
(262) Theorem 216: [Disjointness of simple Cartesian products] {[x,0]: x in N} * {[x,1]: x in M} = 0<P>
(263) Theorem 217: [First Disjoint sum lemma] ((N * M = 0) & (K * J = 0) & (#N = #K) & (#M = #J)) imp			(#(N + M) = #(K + J))<P>
(264) Theorem 218: [Cardinality of Cartesian product by a singleton] (#{[x,A]: x in M} = #M)<P>
(265) Theorem 219: [Monotonicity of arithmetic addition] ((N incs N1) and (M incs M1)) imp (N PLUS M incs N1 PLUS M1)<P>
(266) Theorem 220: [Disjoint sum lemma] (N * M = 0) imp (N PLUS M = #(N + M))<P>
(267) Theorem 221: [Arithmetic addition lemma] N PLUS M = #N PLUS #M<P>
(268) Theorem 222: [Second Disjoint sum lemma] (N * M = 0) imp (#N PLUS #M = #(N + M))<P>
(269) Theorem 223: [Cardinality of Cartesian product by a singleton, 2] #({C} PROD N) = #N<P>
(270) Theorem 224:  [Cardinality of Cartesian product by a singleton, 3] #(N PROD {C}) = #N<P>
(271) Theorem 225:  [Cardinality of a Cartesian product union] (A /= B) imp (#N PLUS #M = #((N PROD {A}) + (M PROD {B})))<P>
(272) Theorem 226: [Arithmetic addition lemma 2] N PLUS M = N PLUS #M<P>
(273) Theorem 227: [Arithmetic addition lemma 3] N PLUS M = #N PLUS M<P>
(274) Theorem 228: [Arithmetic associativity lemma] ((N * M = 0) & (N * K = 0) & (M * K = 0)) imp (((N PLUS M) PLUS K) = #((N + M) + K))<P>
(275) Theorem 229: [Arithmetic associativity lemma 2] ((N * M = 0) & (N * K = 0) & (M * K = 0)) imp ((N PLUS (M PLUS K)) = #(N + (M + K)))<P>
(276) Theorem 230: [Arithmetic multiplication lemma] (N TIMES M) = (#N TIMES #M)<P>
(277) Theorem 231: [Arithmetic multiplication lemma 2] N TIMES M = N TIMES #M<P>
(278) Theorem 232: [Arithmetic multiplication lemma 3] #(N PROD M) = #(#N PROD #M)<P>
(279) Theorem 233: [Arithmetic multiplication lemma 4] #(N PROD M) = #(N PROD #M)<P>
(280) Theorem 234: [Arithmetic multiplication lemma 5] #(N PROD M) = #(#N PROD M)<P>
(281) Theorem 235: [Strict monotonicity of finite cardinality] (Finite(N) & (M incin N) & (M /= N)) imp (#M in #N)<P>
(282) Theorem finite_induction1: [Induction principle for finite sets] (m1_thryvar incin n) & P(m1_thryvar) &			(FORALL k incin m1_thryvar | ((k /= m1_thryvar) imp (not P(k))))<P>
(283) Theorem 236: [The union of finite sets is finite] (Finite(N) & Finite(M)) eq Finite(N + M)<P>
(284) Theorem 237: [Removal of an initial segment from $Za$ yields an infinite set] (N in Za) imp (not Finite(Za - N))<P>
(285) Theorem 238: [The union of finitely many finite sets is finite] ((FORALL x in S | Finite(x)) & Finite(S)) imp Finite(Un(S))<P>
(286) Theorem 239: [Finite subsets of $Un(S)$ where $S$ is a nonvoid inclusion-chain] ((S /= 0) & (FORALL u in S, v in S | (u incs v) or (v incs u)) & Finite(Y) & (Un(S) incs Y)) imp (EXISTS z in S | z incs Y)<P>
(287) Theorem 240: [An arithmetic sum is finite if its two terms are finite] Finite(N PLUS M) eq Finite(N + M)<P>
(288) Theorem 241: [An arithmetic sum is finite if and only if both its terms are finite] (Finite(N) & Finite(M)) eq Finite(N PLUS M)<P>
(289) Theorem 242: [acyclicity of the closure of membership] X notin Ult_membs(X)<P>
(290) Theorem 243: [acyclicity of the closure of membership] ((X in Ult_membs({Y})) & (Y in Ult_membs({X}))) imp (X = Y)<P>
(291) Theorem 244: [existence of an $in$-maximal set in any finite set] (EXISTS v | Finite(F) imp (((F = 0) or (v in F)) & ({y in (F-{v}) | v in Ult_membs({y})} = 0)))<P>
(292) Theorem 245: [Anything times 0 is 0] (N TIMES 0) = 0<P>
(293) Theorem 246: [0 times anything is 0] (0 TIMES N) = 0<P>
(294) Theorem 247: [0 is a right additive identity] (#N PLUS 0) = #N<P>
(295) Theorem 248: [1 is a left multiplicative identity] (1 TIMES N) = #N<P>
(296) Theorem 249: [1 is a right multiplicative identity] (N TIMES 1) = #N<P>
(297) Theorem 250: [Monotonicity of multiplication] (M /= 0) imp (#(N PROD M) incs #N)<P>
(298) Theorem 251: [Distributivity lemma] (A /= B) imp (N PLUS M = #((N PROD {A}) + (M PROD {B})))<P>
(299) Theorem 252: [Commutative law for addition] (N PLUS M) = (M PLUS N)<P>
(300) Theorem 253: [Commutative law for multiplication] N TIMES M = M TIMES N<P>
(301) Theorem 254: [0 is bilateral additive identity] (X in Za) imp (((X PLUS 0) = X) & ((0 PLUS X) = X))<P>
(302) Theorem 255: [Rules for intersection and union of Cartesian products] ((A PROD X) * (B PROD X) = (A * B) PROD X) & ((A PROD X) + (B PROD X) = (A + B) PROD X) &	(((X PROD A) * (X PROD B)) = X PROD (A * B)) & (((X PROD A) + (X PROD B)) = X PROD (A + B))<P>
(303) Theorem 256: [Cartesian product monotonicity] ((A incin B) & (C incin D)) imp ((A PROD C) incin (B PROD D))<P>
(304) Theorem 257: [Intersection of Cartesian products] ((A PROD C) * (B PROD D) = (A * B) PROD (C * D))<P>
(305) Theorem 258: [Associativity of arithmetic addition] N PLUS (M PLUS K) = (N PLUS M) PLUS K<P>
(306) Theorem 259: [Associativity of arithmetic multiplication] N TIMES (M TIMES K) = (N TIMES M) TIMES K<P>
(307) Theorem 260: [Arithmetic distributive law] N TIMES (M PLUS K) = (N TIMES M) PLUS (N TIMES K)<P>
(308) Theorem 261: [The arithmetic product of two finite sets is finite] (Finite(N) & Finite(M)) imp Finite(N TIMES M)<P>
(309) Theorem 262: [The Cartesian product of two finite sets is finite] (Finite(N) & Finite(M)) imp Finite(N PROD M)<P>
(310) Theorem 263: [If the product of two nonzero terms is finite, so are the terms] ((Finite(N) & Finite(M)) or N = 0 or M = 0) eq Finite(N TIMES M)<P>
(311) Theorem 264: [A set is finite if and only if its powerset is finite] Finite(N) eq Finite(pow(N))<P>
(312) Theorem 265: [Cantor's Theorem] #N in #pow(N)<P>
(313) Theorem 266: (S incin pow(Un(S))) & ((Finite(Un(S)) & (X incin S)) imp Finite(X))<P>
(314) Theorem 267: [Arithmetic subtraction principle] N MINUS N = 0<P>
(315) Theorem 268: [0 is right identity for arithmetic subtraction] N MINUS 0 = #N<P>
(316) Theorem 269: [Disjoint additivity lemma] ((N * M = 0) & (N2 * M2 = 0) & (#N = #N2) & (#M = #M2)) imp (#(N + M) = #(N2 + M2))<P>
(317) Theorem 270: [Excess subtraction lemma] (Ord(Y) & (X in Y)) imp ((X MINUS Y) = 0)<P>
(318) Theorem 271: [Subtraction lemma] (M incin N) imp (#N = #M PLUS (N MINUS M))<P>
(319) Theorem 272: [Subtraction in the non-negative case] (M incin N) imp (#N = (N MINUS M) PLUS M)<P>
(320) Theorem 273: [Subtraction lemma 2] (#M in #N or #M = #N) imp (#N = #M PLUS (#N MINUS #M))<P>
(321) Theorem 274: [Union set as an upper bound] (FORALL x in S | x incin Un(S)) & ((FORALL x in S | x incin T) imp (Un(S) incin T))<P>
(322) Theorem 275: (Un(S) = 0) eq ((S = 0) or (S = {0}))<P>
(323) Theorem 276: [Monotonicity of the union-set operator] (S incin T) imp (Un(S) incin Un(T))<P>
(324) Theorem 277: [Binary and unary union operations commute] Un(X + Y) = Un(X) + Un(Y)<P>
(325) Theorem 278: [Equivalent characterizations of transitive sets] (S incin pow(S)) eq (Un(S) incin S)<P>
(326) Theorem 279: (Un(S) incs Un({c: c in S | H notin c})) & (H notin Un({c: c in S | H notin c}))<P>
(327) Theorem 280: [The union of a set of ordinals is an ordinal] (FORALL x in S | Ord(x)) imp Ord(Un(S))<P>
(328) Theorem 281: [Division monotonicity lemma] (M /= 0) imp ((N OVER M) incin N)<P>
(329) Theorem 282: [Extended division monotonicity lemma] ((M /= 0) & (N in Za)) imp (((N OVER M) in Za) & ((N OVER M) incin N))<P>
(330) Theorem 283: [Closure properties of arithmetic operators] ((N in Za) & (M in Za)) imp ((N PLUS M in Za) & (N TIMES M in Za) & (N MINUS M in Za))<P>
(331) Theorem 284: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (N /= 0)) imp (M in (M PLUS N))<P>
(332) Theorem 285: [Only the nullset has cardinality zero] (#N = 0) imp (N = 0)<P>
(333) Theorem 286: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (K in N)) imp (M PLUS K in M PLUS N)<P>
(334) Theorem 287: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (K in N)) imp (M PLUS K in M PLUS N)<P>
(335) Theorem 288: [Strict monotonicity of addition, 2] ((M in Za) & (N in Za) & (K in N)) imp (K PLUS M in N PLUS M)<P>
(336) Theorem 289: [Cancellation] ((M in Za) & (N in Za) & (K in Za) & (M PLUS K = N PLUS K)) imp (M = N)<P>
(337) Theorem 290: [Monotonicity of addition] (M incin N) imp ((M PLUS K) incin (N PLUS K))<P>
(338) Theorem 291: [Monotonicity of addition, 2] Card(M) imp ((M incin (I PLUS M)) & (M incin (M PLUS I)))<P>
(339) Theorem 292: [Monotonicity of addition, 3] (M in Za) imp ((M incin (I PLUS M)) & (M incin (M PLUS I)) & ((M PLUS I) notin M) & ((I PLUS M) notin M))<P>
(340) Theorem 293: [Monotonicity of multiplication] (M incin N) imp ((M TIMES K) incin (N TIMES K))<P>
(341) Theorem 294: [Strict monotonicity of integer multiplication] ((M in N) & (N in Za) & (K in Za) & (K /= 0))	imp ((M TIMES K) in (N TIMES K))<P>
(342) Theorem 295: [The sum of non-negative integers is at least as big at each addend] ((X in Za) & (Y in Za)) imp ((X PLUS Y) notin Y)<P>
(343) Theorem 296: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (K in Za)) imp			(((M PLUS K) incin (N PLUS K)) eq (M incin N))<P>
(344) Theorem 297: [Strict monotonicity of addition] ((M in Za) & (N in M) & (K in Za)) imp ((N PLUS K) in (M PLUS K))<P>
(345) Theorem 298: [Subtraction Lemma] (N in Za) imp ((N MINUS M) in Za)<P>
(346) Theorem 299: [Strict monotonicity of subtraction] ((N in Za) & (M in Za) & (K in N) & (M incs N)) imp		((M MINUS N) in (M MINUS K))<P>
(347) Theorem 300: [Monotonicity of subtraction] (K incs M) imp ((K MINUS N) incs (M MINUS N))<P>
(348) Theorem 301: [Monotonicity of subtraction, 2] (M incs N) imp ((K MINUS N) incs (K MINUS M))<P>
(349) Theorem 302: [Strict monotonicity of subtraction, 2] ((N in Za) & (M in Za) & (K in M) & (K incs N)) imp		((K MINUS N) in (M MINUS N))<P>
(350) Theorem 303: [Addition-subtraction commutativity] ((M in Za) & (N in Za) & (K in Za) & (N incs M) & ((N MINUS M) incs K)) imp	((N incs (M PLUS K)) & (N MINUS (M PLUS K) = (N MINUS M) MINUS K))<P>
(351) Theorem 304: [Subtraction reverses addition] ((M in Za) & (N in Za)) imp ((M PLUS N) MINUS N = M)<P>
(???) Theorem 304a: [Over finite sets, difference corresponds to subtraction] (Finite(N) & (M incin N)) imp (#N MINUS #M = #(N - M))<P>
(352) Theorem 305: [Singletons have one element] #{S} = {0}<P>
(353) Theorem 306: ({X} incs Y) imp (#Y in 2)<P>
(354) Theorem 307: (#X = 1) eq (X = {arb(X)})<P>
(???) Theorem 305a: [Over finite sets, difference corresponds to subtraction, 2] (Finite(N) & (M in N)) imp (#N MINUS 1 = #(N - {M}))<P>
(355) Theorem 308: [Integer division with remainder] ((M in Za) & (N in Za) & (N /= 0)) imp (((M OVER N) in Za) & (M incs ((M OVER N) TIMES N)) & ((M MOD N) in N))<P>
(356) Theorem 309: [If an integer product is zero, one of its factors is 0] (N TIMES M = 0) eq (N = 0 or M = 0)<P>
(357) Theorem 310: [Subtraction monotonicity lemma] (N incs M) imp ((N MINUS K) incs (M MINUS K))<P>
(358) Theorem 311: [Cardinality of set difference] (Finite(N) & (N incs M)) imp (#(N - M) = #(#N - #M))<P>
(359) Theorem 312: [Strong monotonicity of integer addition] ((N in Za) & (M in Za) & (K in Za)) imp ((N incs M) eq ((N PLUS K) incs (M PLUS K)))<P>
(360) Theorem 313: [Addition reverses subtraction] (N incs M) imp (#N = #M PLUS #(N - M))<P>
(361) Theorem 314: [Addition-subtraction commutativity, 2] ((N in Za) & (M in Za) & (K in Za) & (N incs M)) imp ((N PLUS K) MINUS (M PLUS K) = N MINUS M)<P>
(362) Theorem 315: [Addition-subtraction lemma] ((N in Za) & (M in Za)) imp (N = (M PLUS (N MINUS M)) or N = (M MINUS (M MINUS N)))<P>
(363) Theorem 316: [The successor integer as a sum] (N PLUS 1) = #next(N)<P>
(364) Theorem 317: [The successor integer as a sum, 2] (N in Za) imp ((next(N) in Za) & ((N PLUS 1) = next(N)))<P>
(365) Theorem 318: [To witness that $n$ sets are different, fewer than $n$ elements suffice] (Finite(F) & (F /= 0)) imp (EXISTS d incin Un(F) | (#d in #F) & (FORALL w in F, y in F | (w * d = y * d) imp (w = y)))<P>
(366) Theorem 319: [To witness that $n$ sets are different, fewer than $n$ elements suffice, 2] (Finite(F) & (F /= 0)) imp ({d incin Un(F) | (#d in #F) & (#{w * d : w in F} = #F)} /= 0)<P>
(367) Theorem 320: [The union set of a finite collection of integers is an integer] ((M incin Za) & Finite(M)) imp (((M /= 0) imp (Un(M) in M)) & (Un(M) in Za))<P>
(368) Theorem 321: [The union set of a set of integers is the least upper bound of its elements] (M in Za) imp	(((Un(M) in Za) & (Un(M) incin M)) & ((M /= 0) imp (Un(M) in M)))<P>
(369) Theorem 322: [Every nonzero integer has a predecessor] ((M in Za) & (M /= 0)) imp (M = (Un(M) PLUS 1))<P>
(370) Theorem 323: [The sum of integers as the union of smaller sums] ((X in Za) & (Y in Za)) imp ((X PLUS Y) = X + {(X PLUS u): u in Y})<P>
(371) Theorem 324: [The sum of integers as the union of smaller sums, 2] ((X in Za) & (Y in Za)) imp ((X PLUS Y) = X + {(u PLUS X): u in Y})<P>
(372) Theorem 325: [Subtraction reverses addition] ((X in Za) & (Y in Za) & (Y incin X)) imp (X = Y PLUS (X MINUS Y))<P>
(373) Theorem 326: [Subtraction monotonicity lemma, 2] ((X in Za) & (Y in Za) & (U in (X PLUS Y)) & (Y /= 0)) imp ((U MINUS X) in Y)<P>
(374) Theorem 327: [The integer difference as  a set of smaller differences] ((N in Za) & (M in Za)) imp ((N MINUS M) = {k MINUS M: k in N | M incin k})<P>
(375) Theorem 328: [The integer difference as a set of smaller differences] ((N in Za) & (M in Za)) imp ((N MINUS M) = {k in Za | (k PLUS M) in N})<P>
(376) Theorem 329: ((J in Za - X) & (FORALL i | (next(i) in X) imp (i in X))) imp		({h in Za | (h notin J) & (h in X)} = 0)<P>
(377) Theorem 330: ((X incin Za) & (FORALL i | (next(i) in X) imp (i in X))) eq (X in next(Za))<P>
(378) Theorem 331: (({X,Y} incin next(Za)) & (#X in next(Y))) imp (((X = Y) & (Y = Za)) or (X in (next(Y) * Za)))<P>
(379) Theorem unsigned_integer_bynd.0: [Every finite set of unsigned integers has an upper bound]		(bynd_thryvar in Za) & (FORALL i in Za | (Q1(i) imp (i in bynd_thryvar)))<P>
(380) Theorem unsigned_integer_bynd.1: [Every finite set of unsigned integers has an upper bound] (bynd_thryvar in Za) &	 (Za incs bynd_thryvar) & Ord(bynd_thryvar) & (FORALL i in Za | (Q1(i) imp (i in bynd_thryvar))) & (not Finite(Za - bynd_thryvar))<P>
(381) Theorem cauchyseq_lemma.1: (not Finite({i * j : i in (Za - n0), j in (Za - n0) | R(i,j)}))<P>
(382) Theorem 332: [Ordinal member maximum and minimum] (Ord(U) & (S in U) & (T in U)) imp		((S + T in U) & (S * T in U))<P>
(383) Theorem 333: [Integer member maximum and minimum] ((S in Za) & (T in Za)) imp ((S + T in Za) & (S * T in Za))<P>
(384) Theorem cauchyseq_lemma2.1: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i incs k) & (j incs k)) imp (not (R(i,j)))))<P>
(385) Theorem 334: ((N in Za) & (S incin N) & (#S = N)) imp (S = N)<P>
(386) Theorem 335: [Finite sequences are single-valued maps with integer domains] (F in Fin_seqs(S)) eq (Svm(F) & (domain(F) in Za) & (range(F) incin S))<P>
(387) Theorem 336: [Other properties of finite sequences] (F in Fin_seqs(S)) imp ((domain(F) = #domain(F)) & (domain(F) = #F) & (#F in Za) & Finite(F))<P>
(388) Theorem 337: [Two single-valued functions with common domain are equal if all their values are equal] (Svm(F) & Svm(G) & (domain(F) = S) & (domain(G) = S) & (FORALL n0 in S | F~[n0] = G~[n0])) imp (F = G)<P>
(389) Theorem 338: [Two functions from a collection of single-valued functions with common domain are equal if all their values are equal] ((S /= 0) & (FORALL h in Mapset | ((domain(h) = S) & Svm(h)))) imp ((FORALL n in S | ((F in Mapset) & (G in Mapset) & (F~[n] = G~[n]))) imp (F = G))<P>
(390) Theorem 339: [The shift-map of an integer is single-valued and maps Za into Za] ((M in Za) & (N in Za)) imp (Svm(Shift(M)) & (domain(Shift(M)) = Za) & (range(Shift(M)) incin Za) & (Shift(M)~[N] = M PLUS N))<P>
(391) Theorem 340: [Composition of shift-maps yields a shift-map] ((M in Za) & (N in Za)) imp (Shift(M) @ Shift(N) = Shift(M PLUS N))<P>
(392) Theorem 341: [Double shifting can be emulated by a single shift] ((M in Za) & (N in Za)) imp (shifted_seq(shifted_seq(F,M),N) = shifted_seq(F,M PLUS N))<P>
(393) Theorem 342: [Shift(0) is the identity map on Za] (Shift(0) = {[n,n]: n in Za}) & ((Is_map(F) & (domain(F) incin Za)) imp (F @ Shift(0) = F))<P>
(394) Theorem 343: [Shift-by-0 is the identity map on sequences] (Is_map(F) & (domain(F) incin Za)) imp (shifted_seq(F,0) = F)<P>
(395) Theorem 344: [Form of a shifted sequence] ((M in Za) & (domain(F) incin Za)) imp (shifted_seq(F,M) = {[car(x) MINUS M,cdr(x)]: x in F | car(x) incs M})<P>
(396) Theorem 345: [Properties of finite and shifted finite sequences] ((F in Fin_seqs(S)) & (G in Fin_seqs(S))) imp				(Svm({[car(x) PLUS #F, cdr(x)]: x in G})					& (domain(F) * domain({[car(x) PLUS #F, cdr(x)]: x in G}) = 0))<P>
(397) Theorem 346: ((F in Fin_seqs(S)) & (M in Za)) imp (((F ON M) in Fin_seqs(S)) & (shifted_seq(F,M) in Fin_seqs(S)) & (domain(shifted_seq(F,M)) = (#F MINUS M)))<P>
(398) Theorem 347: [Concatenation of finite sequences] ((F in Fin_seqs(S)) & (G in Fin_seqs(S))) imp			((concat(F,G) in Fin_seqs(S)) & (domain(concat(F,G)) = domain(F) PLUS domain(G)) & (range(concat(F,G)) = range(F) + range(G))) & ((U in domain(F) PLUS domain(G)) imp (concat(F,G)~[U] = if U in domain(F) then F~[U] else G~[U MINUS domain(F)] end if))<P>
(399) Theorem 348: [$0$ is bilateral unit for sequence concatenation] (F in Fin_seqs(S)) imp ((concat(F,0) = F) & (concat(0,F) = F))<P>
(400) Theorem 349: [Associativity of sequence concatenation] ((F in Fin_seqs(S)) & (G in Fin_seqs(S)) & (H in Fin_seqs(S))) imp (concat(F,concat(G,H)) = concat(concat(F,G),H))<P>
(401) Theorem 350: [Concatenation of shifted sequences] ((F in Fin_seqs(S)) & (M in domain(F))) imp ((shifted_seq(F,M) in Fin_seqs(S)) & (F = concat((F ON M), shifted_seq(F,M))))<P>
(402) Theorem subseq.1: (g = (f @ h_thryvar)) & one_1_map(h_thryvar) & (domain(h_thryvar) in next(Za)) & (range(h_thryvar) incin domain(f)) &	(FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) imp ((h_thryvar~[i]) in (h_thryvar~[j])))<P>
(403) Theorem subseq.2: {i in domain(h_thryvar) | i nincin (h_thryvar~[i])} = 0<P>
(404) Theorem subseq.3: Svm(g) & (g incin (domain(f) PROD range(f))) & (domain(g) in (next(Za) * next(domain(f))))<P>
(405) Theorem subseq.4: (domain(h_thryvar) /= Za) imp Finite(g)<P>
(406) Theorem 351: ((F in Fin_seqs(S)) & (G in Subseqs(F))) imp ((G in Fin_seqs(S)) & (domain(G) in next(domain(F))))<P>
(407) Theorem 352: (M in Za) imp (shifted_seq(F,M) in Subseqs(F))<P>
(408) Theorem 353: ((F in Fin_seqs(S)) & (M in Za)) imp ((shifted_seq(F,M) in Fin_seqs(S)) & (domain(shifted_seq(F,M)) in next(domain(F))))<P>
(409) Theorem 354: ((domain(F) = Za) & (M in Za)) imp (domain(shifted_seq(F,M)) = Za)<P>
(410) Theorem ordval_fcn1: [An ordinal-valued function attains its minimum]    (rng_thryvar /= 0) & (FORALL x in rng_thryvar, y in s | f(x) incin f(y)) &    	(rng_thryvar = {x: x in s | f(x) = arb({f(u): u in s})})<P>
(411) Theorem ordval_fcn2: rng_thryvar incin s<P>
(412) Theorem ordval_fcn3: (FORALL x in rng_thryvar, y in s | (f(x) = f(y)) imp (y in rng_thryvar))<P>
(413) Theorem well_founded_set.0:    ((X in s) & (Y in s)) imp ((not(arg1_bef_arg2(X,Y) & arg1_bef_arg2(Y,X))) & (not arg1_bef_arg2(X,X)))<P>
(414) Theorem well_founded_set.00: Minrel1_thryvar(T) = if (T incin s) & (T /= 0) then	arb({m: m in T | (FORALL y in T | (not arg1_bef_arg2(y,m)))}) else s end if<P>
(415) Theorem well_founded_set.0a:  ((T incin s) & (T /= 0)) imp ((Minrel1_thryvar(T) in T) & (FORALL y in T | (not arg1_bef_arg2(y,Minrel1_thryvar(T)))))<P>
(416) Theorem well_founded_set.0b: [Monotonicity of $Minrel1_thryvar$]    ((R incin s) & (T incin R) & (T /= 0)) imp (not(arg1_bef_arg2(Minrel1_thryvar(T),Minrel1_thryvar(R))))<P>
(417) Theorem well_founded_set.0c: ((S incs T) & (T /= 0)) imp (Minrel1_thryvar(T) in T)<P>
(418) Theorem well_founded_set.1a: ordenm_thryvar(X) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in X})<P>
(419) Theorem well_founded_set.1:  (not(s incin {ordenm_thryvar(y): y in X})) imp ((ordenm_thryvar(X) in (s - {ordenm_thryvar(y): y in X}))		& (FORALL y in (s - {ordenm_thryvar(y): y in X}) | not(arg1_bef_arg2(y,ordenm_thryvar(X)))))<P>
(420) Theorem well_founded_set.2: (s incin {ordenm_thryvar(y): y in X}) eq (ordenm_thryvar(X) = s)<P>
(421) Theorem well_founded_set.3: (ordenm_thryvar(X) /= s) imp (ordenm_thryvar(X) in s)<P>
(422) Theorem well_founded_set.5: [Ordinal enumeration is monotone on ordinals] (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V))) imp (U in V)<P>
(423) Theorem well_founded_set.6: {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} incin {ordenm_thryvar(x): x in V}<P>
(424) Theorem well_founded_set.7: [Well-ordering is initially 1-1]	 (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s) & (U /= V)) imp (ordenm_thryvar(U) /= ordenm_thryvar(V))<P>
(425) Theorem well_founded_set.8:    (EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})			& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))<P>
(426) Theorem well_founded_set.9:    (ord_thryvar in next(#pow(s))) & Ord(ord_thryvar) & (s = {ordenm_thryvar(x): x in ord_thryvar})			& (FORALL x in ord_thryvar | (ordenm_thryvar(x) /= s)) &				one_1_map({[x,ordenm_thryvar(x)]: x in ord_thryvar})<P>
(427) Theorem well_ordered_set.0: ((X in s) & (Y in s)) imp (arg1_bef_arg2(X,Y) or arg1_bef_arg2(Y,X) or (X = Y))<P>
(428) Theorem well_ordered_set.0a: ((T incin s) & (T /= 0)) imp (EXISTS x in T | (FORALL y in T | (not arg1_bef_arg2(y,x))))<P>
(429) Theorem well_ordered_set.100:	(FORALL x,y | ((x in s) & (y in s)) imp ((not (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x))) & (not arg1_bef_arg2(x,x)))) &	(FORALL x | (not(s incin {ordenm_thryvar(y): y in x})) imp ((ordenm_thryvar(x) in (s - {ordenm_thryvar(y): y in x})) &			(FORALL y in (s - {ordenm_thryvar(y): y in x}) | not(arg1_bef_arg2(y,ordenm_thryvar(x)))))) &	(FORALL x | (s incin {ordenm_thryvar(y): y in x}) eq (ordenm_thryvar(x) = s)) &	(FORALL x | (ordenm_thryvar(x) /= s) imp (ordenm_thryvar(x) in s)) &	(FORALL u, v | (Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) & arg1_bef_arg2(ordenm_thryvar(u),ordenm_thryvar(v))) imp (u in v)) &	(FORALL v | {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(v))} incin {ordenm_thryvar(x): x in v}) &	(FORALL u, v | (Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) & (ordenm_thryvar(v) /= s) & (u /= v)) imp			(ordenm_thryvar(u) /= ordenm_thryvar(v))) &	(EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})			 		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))) &	(FORALL x | ordenm_thryvar(x) = Minrel2_thryvar(s - {ordenm_thryvar(y): y in x})) &	(FORALL t | Minrel2_thryvar(t) = if (t incin s) & (t /= 0) then				arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) else s end if)<P>
(429+) Theorem well_ordered_set.10:  ((X in s) & (Y in s)) imp		 	((arg1_bef_arg2(X,Y) imp (not arg1_bef_arg2(Y,X))) &		 		(not arg1_bef_arg2(X,X)))<P>
(430) Theorem well_ordered_set.1:  (not(s incin {ordenm_thryvar(y): y in X})) imp	((ordenm_thryvar(X) in (s - {ordenm_thryvar(y): y in X})) &		(FORALL y in (s - {ordenm_thryvar(y): y in X}) | not(arg1_bef_arg2(y,ordenm_thryvar(X)))))<P>
(431) Theorem well_ordered_set.2:  ((s incin {ordenm_thryvar(y): y in X}) eq (ordenm_thryvar(X) = s))<P>
(432) Theorem well_ordered_set.3:  ((ordenm_thryvar(X) /= s) imp (ordenm_thryvar(X) in s))<P>
(433) Theorem well_ordered_set.5a:	(Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V))) imp (U in V)<P>
(434) Theorem well_ordered_set.6a: ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} incin {ordenm_thryvar(x): x in V})<P>
(435) Theorem well_ordered_set.7:  ((Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) &	(ordenm_thryvar(V) /= s) & (U /= V)) imp (ordenm_thryvar(U) /= ordenm_thryvar(V)))<P>
(436) Theorem well_ordered_set.8:  (EXISTS o | (Ord(o) & (s = {ordenm_thryvar(x): x in o})		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))<P>
(437) Theorem well_ordered_set.8a: ordenm_thryvar(X) = Minrel2_thryvar(s - {ordenm_thryvar(y): y in X})<P>
(438) Theorem well_ordered_set.8b: Minrel2_thryvar(T) = if (T incin s) & (T /= 0) then		arb({m: m in T | (FORALL y in T | (not arg1_bef_arg2(y,m)))}) else s end if<P>
(439) Theorem well_ordered_set.5: [Any well-ordering is isomorphic to an ordinal enumeration] (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s)) imp (arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V)) eq (U in V))<P>
(440) Theorem well_ordered_set.6: (Ord(V) & (ordenm_thryvar(V) /= s)) imp ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} = {ordenm_thryvar(x): x in V})<P>
(441) Theorem well_ordered_set.9: (Ord(V) & (ordenm_thryvar(V) /= s)) imp  ( one_1_map({[x,ordenm_thryvar(x)]: x in V})   & (domain({[x,ordenm_thryvar(x)]: x in V}) = V)   & (range({[x,ordenm_thryvar(x)]: x in V}) = {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))})   & ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} = {ordenm_thryvar(x): x in V}))<P>
(442) Theorem inh_well_founded_set1: ((T incin sp) & (T /= 0)) imp (EXISTS w in T | (FORALL v in T | (not arg1_bef_arg2(displace(v),displace(w)))))<P>
(443) Theorem product_order_1: [The first component of any member of a Cartesian product of ordinals is an ordinal] (X in o1 PROD o2) imp Ord(car(X))<P>
(444) Theorem product_order_2: [The second component of any member of a Cartesian product of ordinals is an ordinal] (X in o1 PROD o2) imp Ord(cdr(X))<P>
(445) Theorem product_order_3: [The maximum of the components of any member of a Cartesian product of ordinals is an ordinal] (X in o1 PROD o2) imp Ord(car(X) + cdr(X))<P>
(446) Theorem product_order_4: ((X in o1 PROD o2) & (Y in o1 PROD o2)) imp	((Ord1p2_thryvar(X,Y) or Ord1p2_thryvar(Y,X) or X = Y) & (not Ord1p2_thryvar(X,X)))<P>
(447) Theorem product_order_5: ((X in o1 PROD o2) & (Y in o1 PROD o2) & (Z in o1 PROD o2) &		Ord1p2_thryvar(X,Y) & Ord1p2_thryvar(Y,Z)) imp Ord1p2_thryvar(X,Z)<P>
(448) Theorem product_order_6: ((T incin (o1 PROD o2)) & (T /= 0)) imp	(EXISTS x in T | (FORALL y in t | (Ord1p2_thryvar(x,y) or (x = y))))<P>
(449) Theorem 355: ['One-more' lemma] (not Finite(S)) imp (#S = #(S + {C}))<P>
(450) Theorem 356: ['Few-more' lemma] ((not Finite(S)) & Finite(T)) imp (#S = #(S + T))<P>
(451) Theorem 357: [Any infinite cardinal is a limit ordinal] ((not Finite(S)) & (X in #S)) imp (X + {X} in #S)<P>
(452) Theorem 358: [If ordinal $S$ dominates the members of an ordinal $T$, $#S$ is no less than $#T$] (Ord(S) & Ord(T) & (not Finite(S)) & (FORALL u in T | #u in #S)) imp (#T incin #S)<P>
(453) Theorem 359: [The cardinality of a non-null Cartesian product is at least the cardinality of its first factor] (T /= 0) imp (#S incin #(S PROD T))<P>
(454) Theorem 360: (Ord(O1) & Ord(O2)) imp	(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (O1 PROD O2)) &	(FORALL x in domain(f), y in domain(f) | (x in y) eq (((car(f~[x]) + cdr(f~[x])) in (car(f~[y]) + cdr(f~[y]))) or 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) in car(f~[y]))) or 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) = car(f~[y])) & (cdr(f~[x]) in cdr(f~[y]))))))<P>
(455) Theorem 361: (Card(O1) & Card(O2) & (not Finite(O1 + O2))) imp	(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (O1 PROD O2)) &		(FORALL x in domain(f) | (EXISTS y in (O1 + O2) | range(f ON x) incin (y PROD y))))<P>
(456) Theorem 362: [Cardinal Doubling Theorem] (not Finite(S)) imp (#(S PROD {0,1}) = #S)<P>
(457) Theorem 363: [The sum of two infinite quantities is their maximum] (not Finite(S)) imp ((S PLUS T) = #S + #T)<P>
(458) Theorem 364: [The cardinality of the union of two infinite quantities is the cardinality of the larger] (not Finite(S)) imp (#(S + T) = #S + #T)<P>
(459) Theorem 365: [Cardinal Square Theorem] (not Finite(S)) imp (#(S PROD S) = #S)<P>
(460) Theorem 366: [Reduced form of an integer pair] ((M in Za) & (N in Za)) imp ((Red([M,N]) in Si) & (M * N in Za))<P>
(461) Theorem 367: [Embedding of integers in the signed integers] (N in Za) imp (([N,0] in Si) & ([0,N] in Si))<P>
(462) Theorem 368: [Basic properties of the signed integers 0,1, and -1] ([0,0] in Si) & ([1,0] in Si) & ([0,1] in Si) & ([1,0] /= [0,0]) & ([0,1] /= [0,0]) & ([1,0] /= [0,1])<P>
(463) Theorem 369: [The signed integers as integer pairs with one component equal to 0] (N in Si) imp ((N = [car(N),cdr(N)]) & (car(N) = 0 or cdr(N) = 0) & (car(N) in Za) & (cdr(N) in Za) &			(Red(N) = N) & (car(N) * cdr(N) = 0))<P>
(464) Theorem 370: [Signed integers as integer pairs, 2] (N in Si) imp ((N = [car(N),0] or N = [0,cdr(N)]) & (car(N) = 0 or cdr(N) = 0) &				(car(N) in Za) & (cdr(N) in Za) & (Red(N) = N) & (car(N) * cdr(N) = 0))<P>
(465) Theorem 371: ((N in Si) & (M in Si)) imp ((N S_PLUS M in Si) & (N S_TIMES M in Si))<P>
(466) Theorem 372: [Sign reversal and subtraction for signed integers] ((N in Si) & (M in Si)) imp ((S_Rev(M) in Si) & (N S_MINUS M in Si))<P>
(467) Theorem 373: [Reduction of an integer pair $(n,n)$ always gives the signed 0 value] (N in Za) imp (Red([N,N]) = [0,0])<P>
(468) Theorem 374: [Reduction removes any common value added to the components of an integer pair] ((J in Za) & (K in Za) & (M in Za)) imp (Red([J PLUS M,K PLUS M]) = Red([J,K]))<P>
(469) Theorem 375: [The intersection of two unsigned integers is the smaller of the two] ((N in Za) & (M in Za)) imp (((N * M) in Za) & ((N * M) in {N,M}) & ((N MINUS (N * M)) in Za) & ((M MINUS (N * M)) in Za))<P>
(470) Theorem 376: [The signed sum of two integer pairs is the sum of the first with the reduced form of the second] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) imp ([J,K] S_PLUS [N,M] = [J,K] S_PLUS Red([N,M]))<P>
(471) Theorem 377: [The sum of a signed integer and an integer pair remains the same if the pair is reduced] ((K in Si) & (N in Za) & (M in Za)) imp (K S_PLUS [N,M] = K S_PLUS Red([N,M]))<P>
(472) Theorem 378: [The product of a signed integer and an integer pair remains the same if the pair is reduced] ((K in Si) & (N in Za) & (M in Za)) imp (K S_TIMES [N,M] = K S_TIMES Red([N,M]))<P>
(473) Theorem 379: [Commutativity lemma for signed integers] ((K in Si) & (N in Za) & (M in Za)) imp (K S_PLUS [N,M] = [N,M] S_PLUS K)<P>
(474) Theorem 380: [Commutativity lemma for signed integers, 2] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) imp ([J,K] S_PLUS [N,M] = [N,M] S_PLUS [J,K])<P>
(475) Theorem 381: [Commutative law for signed integer addition] ((N in Si) & (M in Si)) imp (N S_PLUS M = M S_PLUS N)<P>
(476) Theorem 382: [The sum of two integer pairs remains the same if the first is reduced] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) imp ([J,K] S_PLUS [N,M] = Red([J,K]) S_PLUS [N,M])<P>
(477) Theorem 383: [The sum of two integer pairs remains the same if both are reduced] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) imp ([J,K] S_PLUS [N,M] = Red([J,K]) S_PLUS Red([N,M]))<P>
(478) Theorem 384: [Commutative law for signed integer multiplication] ((N in Si) & (M in Si)) imp (N S_TIMES M = M S_TIMES N)<P>
(479) Theorem 385: [Associative law for signed integer addition] ((K in Si) & (N in Si) & (M in Si)) imp (N S_PLUS (M S_PLUS K) = (N S_PLUS M) S_PLUS K)<P>
(480) Theorem 386: [Distributive law for signed integers]    ((K in Si) & (N in Si) & (M in Si)) imp (N S_TIMES (M S_PLUS K) = (N S_TIMES M) S_PLUS (N S_TIMES K))<P>
(481) Theorem 387: [Reduction of a pair $(N,0)$ gives $(N,0)$] (N in Za) imp (Red([N,0]) = [N,0])<P>
(482) Theorem 388: [Embedding of Integers in Signed Integers]     ((N in Za) & (M in Za)) imp (([N PLUS M,0] = [N,0] S_PLUS [M,0] & [N TIMES M,0] = [N,0] S_TIMES [M,0]) &				((N incs M) imp ([N,0] S_MINUS [M,0] = [N MINUS M,0])))<P>
(483) Theorem 389: [Sign-reversal of signed integers] ((N in Za) & (M in Za)) imp (S_Rev(Red([M,N])) = Red([N,M]))<P>
(484) Theorem 390: [$n*-m=-(n*m)$ for signed integers] ((N in Si) & (M in Si)) imp (N S_TIMES S_Rev(M) = S_Rev(N S_TIMES M))<P>
(485) Theorem 391: [Basic properties of the signed negative] (N in Si) imp ((S_Rev(N) in Si) & (S_Rev(N) S_PLUS N = [0,0]) & (S_Rev(S_Rev(N)) = N))<P>
(486) Theorem 392: [Inversion lemma] ((N in Si) & (M in Si)) imp		((S_Rev(N S_TIMES M) = S_Rev(N) S_TIMES M) & (S_Rev(N S_TIMES M) = N S_TIMES S_Rev(M)))<P>
(487) Theorem 393: [Inversion lemma II] (N in Si) imp (S_Rev(S_Rev(N)) = N)<P>
(488) Theorem 394: [Associativity lemma] 	((N in Za) & (M in Za) & (K in Za)) imp ([N,0] S_TIMES ([M,0] S_TIMES [K,0]) = ([N,0] S_TIMES [M,0]) S_TIMES [K,0])<P>
(489) Theorem 395: [Associativity lemma]    ((K in Si) & (N in Za) & (M in Za)) imp ([N,0] S_TIMES ([M,0] S_TIMES K) = ([N,0] S_TIMES [M,0]) S_TIMES K)<P>
(490) Theorem 396: [Associativity lemma II]    ((K in Si) & (N in Za) & (M in Si)) imp ([N,0] S_TIMES (M S_TIMES K) = ([N,0] S_TIMES M) S_TIMES K)<P>
(491) Theorem 397: [Associative law] ((K in Si) & (N in Si) & (M in Si)) imp (N S_TIMES (M S_TIMES K) = (N S_TIMES M) S_TIMES K)<P>
(492) Theorem 398: [Subtraction is addition of the negative] ((N in Si) & (M in Si)) imp ((N S_MINUS M) = (N S_PLUS S_Rev(M)))<P>
(493) Theorem 399: [Subtraction reverses signed integer addition] ((N in Si) & (M in Si)) imp (N = M S_PLUS (N S_MINUS M))<P>
(494) Theorem 400: [The negative of a sum is the sum of the negatives] ((N in Si) & (M in Si)) imp (S_Rev(N S_PLUS M) = S_Rev(N) S_PLUS S_Rev(M))<P>
(495) Theorem 401: [Basic properties of the signed integers 0 and 1] (([0,1] S_TIMES [0,1]) = [1,0]) & ((X in Si) imp ((([1,0] S_TIMES X) = X) & (([0,0] S_TIMES X) = [0,0])))<P>
(496) Theorem 402: [1 is the multiplicative unit for signed integers] (K in Si) imp (K S_TIMES [1,0] = K)<P>
(497) Theorem 403: [The negative of a signed integer is its product by -1] ((K in Si) & (M in Si)) imp (K S_MINUS M = K S_PLUS (M S_TIMES [0,1]))<P>
(498) Theorem 404: [A signed integer minus itself gives 0] (K in Si) imp (K S_MINUS K = [0,0])<P>
(499) Theorem 405: [0 is the right additive identity for signed integers] (K in Si) imp (K S_PLUS [0,0] = K)<P>
(500) Theorem 406: [0 is the left additive identity for signed integers] (K in Si) imp ([0,0] S_PLUS K = K)<P>
(501) Theorem 407: [$Si$ is an Integral Domain]	((N in Si) & (M in Si) & ((M S_TIMES N) = [0,0])) imp ((M = [0,0]) or (N = [0,0]))<P>
(502) Theorem 408: [Distributivity of multiplication over subtraction]    ((N in Si) & (M in Si) & (K in Si)) imp ((m S_TIMES n) S_MINUS (k S_TIMES n) = (m S_MINUS k) S_TIMES n)<P>
(503) Theorem 409: [$Si$ multiplicative cancellation]	((N in Si) & (M in Si) & (K in Si) & (M S_TIMES N = K S_TIMES N) & (N /= [0,0])) imp (M = K)<P>
(504) Theorem 410: [Multiplication by -1] (N in Si) imp (S_Rev(N) = [0,1] S_TIMES N)<P>
(505) Theorem mathematical_induction00: [Basic assumption for proofs by mathematical induction] (n in Za) & P(n)<P>
(506)     	Theorem mathematical_induction0: [The minimum integer having a given property, preliminary version] (FORALL k | ((m2_thryvar in Za) & P(m2_thryvar)) & ((k in m2_thryvar) imp (not ((k in Za) & P(k)))))<P>
(507) Theorem mathematical_induction1: [The minimum integer having a given property] (m2_thryvar in Za) & P(m2_thryvar) & (FORALL k in m2_thryvar | not P(k))<P>
(507+) Theorem double_transfinite_induction.0: [Basic assumption for proofs by double transfinite induction] (EXISTS i | R(n,i))<P>
(508) 	Theorem double_transfinite_induction.1: [Minimum first element in a double transfinite induction] (FORALL k | ((EXISTS i | R(m3_thryvar,i)) & ((k in m3_thryvar) imp (not (EXISTS i | R(k,i))))))<P>
(509) Theorem double_transfinite_induction.2: [Existence of a second element corresponding to the minimum first element] (EXISTS i | R(m3_thryvar,i))<P>
(510) 	Theorem double_transfinite_induction.3: [Minimum second element in a double transfinite induction] R(m3_thryvar,ei1)<P>
(510+) 	Theorem double_transfinite_induction.4: [Minimal element properties in a double transfinite induction] (FORALL k | R(m3_thryvar,j1_thryvar) & ((k in j1_thryvar) imp (not R(m3_thryvar,k))))<P>
(511) Theorem double_transfinite_induction.5: [Minimal element properties in a double transfinite induction, 2] R(m3_thryvar,j1_thryvar) & ((K in m3_thryvar) imp (not R(K,I))) & ((I in j1_thryvar) imp (not R(m3_thryvar,I)))<P>
(512) Theorem double_mathematical_induction.0: [Basic assumption for double integer induction] (EXISTS i | (i in Za) & R(n,i))<P>
(512+) 	Theorem double_mathematical_induction.1: [Minimum first element for a double integer induction] (mm_thryvar in Za) & (EXISTS i | (i in Za) & R(mm_thryvar,i)) & (FORALL k in mm_thryvar | not (EXISTS i | (i in Za) & R(k,i)))<P>
(513) Theorem double_mathematical_induction.2: (EXISTS i | (i in Za) & R(mm_thryvar,i))<P>
(513+) 	Theorem double_mathematical_induction.3: (ei2 in Za) & R(mm_thryvar,ei2)<P>
(514) 	Theorem double_mathematical_induction.4:  (FORALL i | (j2_thryvar in Za) & R(mm_thryvar,j2_thryvar) &			((i in j2_thryvar) imp (not ((i in Za) & R(mm_thryvar,i)))))<P>
(515) Theorem double_mathematical_induction.5: (mm_thryvar in Za) & (j2_thryvar in Za) & R(mm_thryvar,j2_thryvar) & (((K in mm_thryvar) & (I in Za)) imp (not R(K,I))) & ((I in j2_thryvar) imp (not R(mm_thryvar,I)))<P>
(516) Theorem confinedIncrSeq1: [global increase of a stepwise increasing sequence] ((I in J) & (J in Za)) imp (e(I) incin e(J))<P>
(516+) Theorem confinedIncrSeq2: [position of first repetition in confined increasing sequence] (m5_thryvar in Za) & (e(next(m5_thryvar)) = e(m5_thryvar)) & ((m5_thryvar * {i in Za | e(next(i)) incin e(i)}) = 0)<P>
(517) Theorem wellfounded_recursive_fcn.100: (FORALL u, v | (Ord(u) & Ord(v) & (orden(u) /= s) &				arg1_bef_arg2(orden(u),orden(v))) imp (u in v)) &		(EXISTS o in next(#pow(s)) | (Ord(o) & (s = {orden(x): x in o}) &			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o})))<P>
(518) Theorem wellfounded_recursive_fcn.100a: (EXISTS o | (Ord(o) & (s = {orden(x): x in o}) &			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o})))<P>
(518+) Theorem wellfounded_recursive_fcn.101: (Ord(o2) & (s = {orden(x): x in o2}) &			(FORALL x in o2 | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o2}))<P>
(519) Theorem wellfounded_recursive_fcn.1: (V in s) imp ((index(V) in o2) & Ord(index(V)) & (orden(index(V)) = V))<P>
(519+) Theorem wellfounded_recursive_fcn.2: (V in s) imp ({j: j in index(V) | arg1_bef_arg2(orden(j),V)} = {index(w): w in s | arg1_bef_arg2(w,V)})<P>
(520) Theorem wellfounded_recursive_fcn.3: (X in s) imp (wfh2_thryvar(X,T) = f3({g4(wfh2_thryvar(y,T),y,X,T): y in s | arg1_bef_arg2(y,X) & P4(wfh2_thryvar(y,T),y,X,T)},X,T))<P>
(521) 	Theorem wellfounded_recursive_fcn.4: (FORALL x, t | (x in s) imp (rk_thryvar(x,t) = Un({next(rk_thryvar(y,t)): y in s | arg1_bef_arg2(y,x) & ([y,x] in t)})))<P>
(522) Theorem 411: [well-foundedness of inclusion between finite sets] ((FORALL v in X | Finite(v)) & (U incin X) & (U /= 0)) imp		(EXISTS w in U | (FORALL y in U | not((y incin w) & (y /= w))))<P>
(523) Theorem finite_recursion_coherence.1: ((X in q) & (X in r)) imp (h_q(X,T) = h_r(X,T))<P>
(523+) Theorem fin_well_founded.1: ((V incin s) & (V /= 0)) imp (EXISTS m in V | (FORALL y in V | not(arg1_bef_arg2(y,m))))<P>
(524) Theorem finite_recursive_fcn.0: ((T incin {y: y incin S | Finite(y)}) & (T /= 0)) imp (EXISTS x in T | (FORALL y in T | not((y incin x) & (y /= x))))<P>
(525) Theorem finite_recursive_fcn.1: (FORALL s,t | (EXISTS h | (FORALL x | ((x incin s) & Finite(x)) imp			(h~[x] = f3({g4(h~[y],y,x,t): y incin x | (y /= x) & P4(h~[y],y,x,t)},x,t)))))<P>
(525+)     Theorem finite_recursive_fcn.a: (FORALL s,t | (FORALL x | ((x incin s) & Finite(x)) imp			(hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y incin x | (y /= x) & P4(hsko(s,t)~[y],y,x,t)},x,t))))<P>
(526) Theorem finite_recursive_fcn.2: (FORALL x | ((x incin S) & Finite(x)) imp			(hsko(S,T)~[x] = f3({g4(hsko(S,T)~[y],y,x,T): y incin x | (y /= x) & P4(hsko(S,T)~[y],y,x,T)},x,T)))<P>
(527) Theorem finite_recursive_fcn.3: Finite(S) imp (rech2_thryvar(S,T) = f3({g4(rech2_thryvar(y,T),y,S,T): y incin S | (y /= S) & P4(rech2_thryvar(y,T),y,S,T)},S,T))<P>
(528) Theorem finite_tailrecursive_fcn.0: (FORALL s,t | Finite(s) imp (trech2_thryvar(s,t) =		if      ({g3(trech2_thryvar(y,t),s,t): y incin s | (y /= s) & (y = sl(s))} = 0) then f(t)		else arb({g3(trech2_thryvar(y,t),s,t): y incin s | (y /= s) & (y = sl(s))}) end if))<P>
(529) Theorem finite_tailrecursive_fcn.1: Finite(S) imp (trech2_thryvar(S,T) = if (S = 0) then f(T) else g3(trech2_thryvar(sl(S), T), S,T) end if)<P>
(529+) Theorem finite_tailrecursive_fcn1.0: ((X - {arb(X)}) incin X) & ((X /= 0) imp ((X - {arb(X)}) /= X))<P>
(530) Theorem finite_tailrecursive_fcn1.1: (FORALL s,t | Finite(s) imp (trech_thryvar(s,t) =		if (s = 0) then f(t)		else g3(trech_thryvar(s - {arb(s)}, t), s,t) end if))<P>
(531) Theorem finite_tailrecursive_fcn2.0: (FORALL s,t | Finite(s) imp (h(s,t) = if s = 0 then f0 else g2(h(s - {arb(s)},t),s) end if))<P>
(532) Theorem finite_tailrecursive_fcn2.1: Finite(S) imp (h1_thryvar(S) = if S = 0 then f0 else g2(h1_thryvar(S - {arb(S)}),S) end if)<P>
(533)     Theorem sigma_theory0: [Recursive formula for generalized sum] (FORALL x | Finite(x) imp (sigma_thryvar(x) = if x = 0 then e else pluz(sigma_thryvar(x - {arb(x)}),cdr(arb(x))) end if))<P>
(534) Theorem sigma_theory1: [Summation of null map is zero] sigma_thryvar(0) = e<P>
(535) Theorem sigma_theory2: [Summation of singleton map is range element] (cdr(X) in s) imp (sigma_thryvar({X}) = cdr(X))<P>
(535+) Theorem sigma_theory3: [Sum value belongs to closed range of map] (Finite(F) & (range(F) incin s)) imp (sigma_thryvar(F) in s)<P>
(536) Theorem sigma_theory4: [Removal of single element from domain of a sum] ((C in F) &	Finite(F) & (range(F) incin s)) imp (sigma_thryvar(F) = pluz(sigma_thryvar(F - {C}),cdr(C)))<P>
(537) Theorem sigma_theory5: [The generalized sum of a union map is a sum of sums] (Finite(F) & Is_map(F) & (range(F) incin s)) imp	(sigma_thryvar(F) = pluz(sigma_thryvar(F ON (domain(F) * T)), sigma_thryvar(F ON (domain(F) - T))))<P>
(538) Theorem sigma_theory6: [Rearrangement-of-sums theorem]    (Finite(F) & Svm(F) & Svm(G) & (domain(F) = domain(G)) & (range(F) incin s)) imp	(sigma_thryvar(F) = sigma_thryvar({[y,sigma_thryvar(F ON (G INV_IM {y}))]: y in range(G)}))<P>
(538+) Theorem sigma_theory7: [Sum permutation theorem]    (Finite(F) & Svm(F) & one_1_map(G) & (domain(F) = domain(G)) & (range(F) incin s)) imp					(sigma_thryvar(F) = sigma_thryvar({[y,F~[inv(G)~[y]]]: y in range(G)}))<P>
(539) Theorem equivalence_classes1: [Elements are equivalent if and only if their equivalence classes are equal] ((X in s) & (Y in s)) imp (R(X,Y) eq (f1_thryvar(X) = f1_thryvar(Y)))<P>
(540) Theorem equivalence_classes2:  [The equivalence class of any element is an equivalence class] (X in s) imp (f1_thryvar(X) in Eqc_thryvar)<P>
(541) Theorem equivalence_classes2b: [Any element of an equivalence class can represent the class] ((X in Eqc_thryvar) imp ((arb(X) in s) & (f1_thryvar(arb(X)) = X)))<P>
(541+) Theorem equivalence_classes3: [Any two elements of an equivalence class are equivalent] (X in s) imp R(x,arb(f1_thryvar(x)))<P>
(542) Theorem linear_order_1: (({U,V,W} incin s0) & (U le_thryvar V) & (V le_thryvar W)) imp (U le_thryvar W)<P>
(542+) Theorem linear_order_2: (({U,V} incin s0) & (U le_thryvar V) & (V le_thryvar U)) imp (U = V)<P>
(543) Theorem linear_order_3: smaller_thryvar(X,Y) = smaller_thryvar(Y,X)<P>
(544) Theorem linear_order_4: ({U,V} incin s0) imp ((U le_thryvar V) or (V le_thryvar U))<P>
(544+) Theorem linear_order_5: ({U,V,W} incin s0) imp (((U le_thryvar V) & (U le_thryvar W)) or	((V le_thryvar U) & (V le_thryvar W)) or ((W le_thryvar U) & (W le_thryvar V)))<P>
(545) Theorem linear_order_6: ({X,Y} incin s0) imp (smaller_thryvar(X,Y) in {X,Y})<P>
(546) Theorem linear_order_7: (({X,Y} incin s0) & (arg1_bef_arg2(X,Y) or (X = Y))) imp ((smaller_thryvar(X,Y) = X) & (smaller_thryvar(Y,X) = X))<P>
(547) Theorem linear_order_8: (X in next(s0)) imp (smaller_thryvar(X,s0) = X)<P>
(548) Theorem linear_order_9: smaller_thryvar(X,smaller_thryvar(Y,W)) = smaller_thryvar(smaller_thryvar(X,Y),W)<P>
(549) Theorem linear_order_10: ((X in next(s0)) & (Y in next(s0))) imp (smaller_thryvar(X,Y) in next(s0))<P>
(550) Theorem linear_order_11: (s0 in next(s0)) & (FORALL x,y,z | ((x in next(s0)) & (y in next(s0)) & (z in next(s0))) imp (smaller_thryvar(x,smaller_thryvar(y,z)) = smaller_thryvar(smaller_thryvar(x,y),z))) &	(FORALL x,y | ((x in next(s0)) & (y in next(s0))) imp (smaller_thryvar(x,y) = smaller_thryvar(y,x)))<P>
(551) Theorem linear_order_12: (FORALL f | (Finite(f) & (range(f) incin next(s0))) imp (min_over_thryvar(f) in next(s0))) &	(FORALL x | (cdr(x) in next(s0)) imp (min_over_thryvar({x}) = cdr(x))) &	(FORALL f,t | (Finite(f) & Is_map(f) & (range(f) incin next(s0))) imp (min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f ON (domain(f) * t)),min_over_thryvar(f ON (domain(f) - t))))) &	(FORALL c,f | ((c in f) & Finite(f) & (range(f) incin next(s0))) imp (min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f - {c}),cdr(c))))<P>
(552) Theorem linear_order_13: (Svm(F) & (range(F) incin s0) & Finite(F)) imp	(((P in F) imp (min_over_thryvar({P}) = (F~[car(P)]))) &	 (min_over_thryvar(F) = smaller_thryvar(min_over_thryvar(F ON (domain(F) * A)),min_over_thryvar(F ON (domain(F) - A)))))<P>
(553) Theorem linear_order_14: (Svm(F) & (range(F) incin s0) & Finite(F) & (F /= 0)) imp	(min_over_thryvar(F) in range(F))<P>
(554) Theorem linear_order_15: ({X,Y} incin s0) imp ((smaller_thryvar(X,Y) = X) eq (arg1_bef_arg2(X,Y) or (X = Y)))<P>
(555) Theorem linear_order_16: (ubs_thryvar(0) = s0) & (max_thryvar(0) = s0)<P>
(556) Theorem linear_order_17: (ubs_thryvar(T) incin s0) & (ubs_thryvar(T) = ubs_thryvar(T * s0)) & (max_thryvar(T) = max_thryvar(T * s0))<P>
(557) Theorem linear_order_18: (Finite(T) & (X in T) & (T incin s0)) imp ((max_thryvar(T) in T) & ((X = max_thryvar(T)) or (arg1_bef_arg2(X,max_thryvar(T)))))<P>
(558) Theorem linear_order_19: (FORALL x in  s0, y in s0, z in s0 | (arg1_aft_arg2(x,y) & arg1_aft_arg2(y,z)) imp arg1_aft_arg2(x,z)) &    (FORALL x in s0 | not(arg1_aft_arg2(x,x))) &    (FORALL x in  s0, y in s0 | arg1_aft_arg2(x,y) or (x = y) or arg1_aft_arg2(y,x))<P>
(559) Theorem linear_order_20:	(FORALL x, y | larger_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_aft_arg2(x,y) then x else y end if) &	(FORALL x, y | larger_thryvar(x,y) = larger_thryvar(y,x)) &	(FORALL x, y | ({x,y} incin s0) imp (larger_thryvar(x,y) in {x,y})) &	(FORALL x | (x in next(s0)) imp (larger_thryvar(x,s0) = x)) &	(FORALL x, y, z | larger_thryvar(x,larger_thryvar(y,z)) = larger_thryvar(larger_thryvar(x,y),z)) &	(FORALL x, y | ((x in next(s0)) & (y in next(s0))) imp (larger_thryvar(x,y) in next(s0))) &	(FORALL f,p,a | (Svm(f) & (range(f) incin s0) & Finite(f)) imp		(((p in f) imp (max_over_thryvar({p}) = (f~[car(p)]))) &		(max_over_thryvar(f) = larger_thryvar(max_over_thryvar(f ON (domain(f) * a)),max_over_thryvar(f ON (domain(f) - a)))))) &	(FORALL f | (Svm(f) & (range(f) incin s0) & Finite(f) & (f /= 0)) imp (max_over_thryvar(f) in range(f))) &	(FORALL x, y | ({x,y} incin s0) imp ((larger_thryvar(x,y) = x) eq (arg1_aft_arg2(x,y) or (x = y)))) &	(FORALL t | lbs_thryvar(t) = {x in s0 | (FORALL y in (t * s0) | larger_thryvar(y,x) = y)}) &	(FORALL t | min_thryvar(t) = arb({s0} + (t * lbs_thryvar(t)))) &	(FORALL t | glb_thryvar(t) = arb({s0} + {x in lbs_thryvar(t) | lbs_thryvar(t) incin lbs_thryvar({x})})) &	(lbs_thryvar(0) = s0) & (min_thryvar(0) = s0) &	(FORALL t | (lbs_thryvar(t) incin s0) & (lbs_thryvar(t) = lbs_thryvar(t * s0)) & (min_thryvar(t) = min_thryvar(t * s0))) &	(FORALL t, x | (Finite(t) & (x in t) & (t incin s0)) imp ((min_thryvar(t) in t) & ((x = min_thryvar(t)) or (arg1_aft_arg2(x,min_thryvar(t))))))<P>
(560) Theorem transfinite_definition_0_params1: [One-parameter transfinite recursive function definition] f_thryvar(X) = g({h1(f_thryvar(t)): t in X})<P>
(561) Theorem transfinite_definition_1_params1: [Recursive transfinite function definition with auxilliary parameter] f2_thryvar(X,A) = g2({h(f2_thryvar(t,A),A): t in X},A)<P>
(562) Theorem 412: [Zorn's lemma] (FORALL x incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) imp (EXISTS w in T | (FORALL y in x | w incs y))))		 imp (EXISTS y in T | (FORALL x in T | not ((x incs y) & (x /= y))))<P>
(563) Theorem 413: [Zorn's lemma generalized form] (FORALL x incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) imp (EXISTS w in T | (FORALL y in x | w incs y))))		 imp (FORALL u in T | (EXISTS y in T | (y incs u) & (FORALL x in T | not ((x incs y) & (x /= y)))))<P>
(564) Theorem 414: [Zorn's lemma for union-closed collections] (FORALL x incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) imp (Un(x) in T)))		 imp (FORALL u in T | (EXISTS y in T | (y incs u) & (FORALL x in T | not ((x incs y) & (x /= y)))))<P>
(565) Theorem 415: ((FORALL t in TP | Filter(t,S)) & (FORALL u in TP, v in TP | (u incs v or v incs u))) imp  Filter(Un(TP),S)<P>
(566) Theorem 416: (S /= 0) imp ((Filter(T,S) & (FORALL x incin pow(S) | ((x incs T) & Filter(x,S)) imp (x = T))) eq Ultrafilter(T,S))<P>
(567) Theorem 417: [Every filter on a set $S$ can be extended to an ultrafilter on $S$] (Filter(T,S) & (S /= 0)) imp (EXISTS u | ((u incs T) & Ultrafilter(u,S)))<P>
(567+) Theorem 418: [Equivalence of fractions is reflexive and symmetric] (FORALL x in Fr,y in Fr | (Same_frac(x,y) eq Same_frac(y,x)) & Same_frac(x,x))<P>
(568) Theorem 419: [Equivalence of fractions is transitive] (FORALL x in Fr, y in Fr, wz in Fr | (Same_frac(x,y) & Same_frac(y,wz)) imp Same_frac(x,wz))<P>
(569)     Theorem 420: [Fractions are equivalent if and only if the rational numbers they define are equal] (FORALL x, y | ((x in Fr) & (y in Fr)) imp ((Same_frac(x,y) eq (Fr_to_Ra(x) = Fr_to_Ra(y))))) &    (FORALL x  | (x in Ra) imp ((arb(x) in Fr) & (Fr_to_Ra(arb(x)) = x))) &    (FORALL x | (x in Fr) imp (Fr_to_Ra(x) in Ra)) &    (FORALL x | (x in Fr) imp Same_frac(x,arb(Fr_to_Ra(x))))<P>
(570) Theorem 421: [Every fraction is equivalent to every member of its rational number class] (X in Fr) imp ((Fr_to_Ra(X) in Ra) & Same_frac(X,arb(Fr_to_Ra(X))))<P>
(571) Theorem 422: [Alternate version of Theorem 420] ((X in Fr) & (Y in Fr)) imp (Same_frac(X,Y) eq (Fr_to_Ra(X) = Fr_to_Ra(Y)))<P>
(572) Theorem 423: [Alternate version of Theorem 421] (Y in Ra) imp ((arb(Y) in Fr) & (Fr_to_Ra(arb(Y)) = Y))<P>
(573) Theorem Ordered_add.0: [Echo of relator definitions] (GE_thryvar(X,Y) eq nneg(pluz(X,rvz(Y)))) &	(LE_thryvar(X,Y) eq GE_thryvar(Y,X)) &	(GT_thryvar(X,Y) eq (GE_thryvar(X,Y) & (X /= Y))) &	(LT_thryvar(X,Y) eq GT_thryvar(Y,X))<P>
(574) Theorem Ordered_add.1: [Interface to Otter-based THEORY of orderedGroups] (LE_thryvar(X,Y) eq nneg(pluz(Y,rvz(X)))) &	(((X in g) & (Y in g)) imp (GT_thryvar(X,Y) eq (nneg(pluz(X,rvz(Y))) & (X /= Y)))) &	(((X in g) & (Y in g)) imp (GT_thryvar(X,Y) eq (nneg(minz(X,Y)) & (X /= Y))))<P>
(575) Theorem Ordered_add.2: [The ordering by $GE_thryvar$ is a linear ordering] ((X in g) & (Y in g) & ((X = Y) or (not GE_thryvar(X,Y)))) imp GE_thryvar(Y,X)<P>
(575+) Theorem 424: [If a signed integer and its additive inverse are both nonnegative, the signed integer is zero] (X in Si) imp ((is_nonneg(X) or is_nonneg(S_Rev(X))) & ((is_nonneg(X) & is_nonneg(S_Rev(X))) imp (X = [0,0])))<P>
(576) Theorem 425: [The sum of two non-negative signed integers is non-negative] (((X in Si) & (Y in Si) & is_nonneg(X) & is_nonneg(Y))) imp (is_nonneg(X S_PLUS Y) & is_nonneg(X S_TIMES Y))<P>
(577) Theorem 426: ([0,0] in Si) & (FORALL x in Si | ((x S_PLUS [0,0]) = x) & ((x S_PLUS S_Rev(x)) = [0,0]) & (S_Rev(x) in Si)) &	(FORALL x in Si, y in Si | ((x S_PLUS y) in Si) & ((x S_PLUS y) = (y S_PLUS x)) & ((x S_PLUS S_Rev(y)) = (x S_MINUS y))) &	(FORALL x in Si, y in Si, z in Si | ((x S_PLUS y) S_PLUS z) = (x S_PLUS (y S_PLUS z))) &	(FORALL x in Si, y in Si | (is_nonneg(x) & is_nonneg(y)) imp is_nonneg(x S_PLUS y)) &	(FORALL x in Si | (is_nonneg(x) or is_nonneg(S_Rev(x))) & ((is_nonneg(x) & is_nonneg(S_Rev(x))) imp (x = [0,0])))<P>
(578) Theorem 427: [The ordering of two signed integers is defined by the sign of their differences] (FORALL x, y | (S_GE(x,y) eq is_nonneg(x S_PLUS S_Rev(y))) & (S_LE(x,y) eq S_GE(y,x)) &	(S_GT(x,y) eq (S_GE(x,y) & (x /= y))) & (S_LT(x,y) eq S_GT(y,x)))<P>
(579) Theorem 428: [The ordering of two signed integers is defined by the sign of their differences] ((X S_GE Y) eq is_nonneg(X S_PLUS S_Rev(Y))) & ((X S_LE Y) eq (Y S_GE X)) &	((X S_GT Y) eq ((X S_GE Y) & (X /= Y))) & ((X S_LT Y) eq (Y S_GT X))<P>
(580) Theorem 429: [The square of any signed integer is non-negative] (X in Si) imp is_nonneg(X S_TIMES X)<P>
(581) Theorem 430: [The product of signed integers $x,y$ of which $x$ is positive is non-negative iff $y$ is non-negative] ((X in Si) & (Y in Si) & (X /= [0,0]) & is_nonneg(X)) imp (is_nonneg(X S_TIMES Y) eq is_nonneg(Y))<P>
(582) Theorem 431: [Fractions are pairs of signed integers with non-zero denominator] (X in Fr) eq ((X = [car(X),cdr(X)]) & (car(X) in Si) & (cdr(X) in Si) & (cdr(X) /= [0,0]))<P>
(583) Theorem 432: [Fractions are pairs of signed integers with non-zero denominator, 2] ((X in Si) & (Y in Si)) imp (([X,Y] in Fr) eq (Y /= [0,0]))<P>
(584) Theorem 433: [Rational numbers are classes of pairs of signed integers] (N in Ra) imp ((arb(N) in Fr) & (arb(N) = [car(arb(N)),cdr(arb(N))]) & (car(arb(N)) in Si) &				(cdr(arb(N)) in Si) & (cdr(arb(N)) /= [0,0]))<P>
(585) Theorem 434: [Fractions are equivalent if their cross-products are equal] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) imp    Same_frac([(car(X) S_TIMES cdr(W)) S_PLUS (car(W) S_TIMES cdr(X)),cdr(X) S_TIMES cdr(W)],	[(car(Y) S_TIMES cdr(Z)) S_PLUS (car(Z) S_TIMES cdr(Y)),cdr(Y) S_TIMES cdr(Z)])<P>
(586) Theorem 435: [If two pair of fractions are equivalent, their formal sums are also equivalent] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) imp	(Fr_to_Ra([(car(X) S_TIMES cdr(W)) S_PLUS (car(W) S_TIMES cdr(X)),cdr(X) S_TIMES cdr(W)]) =	Fr_to_Ra([(car(Y) S_TIMES cdr(Z)) S_PLUS (car(Z) S_TIMES cdr(Y)),cdr(Y) S_TIMES cdr(Z)]))<P>
(586+) Theorem 436: [If two pairs of fractions are equivalent, their formal products are also equivalent] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) imp    Same_frac([car(X) S_TIMES car(W),cdr(X) S_TIMES cdr(W)],[car(Y) S_TIMES car(Z),cdr(Y) S_TIMES cdr(Z)])<P>
(587) Theorem 437: [If two pairs of fractions are equivalent, their formal sums define the same rational number] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) imp	(Fr_to_Ra([car(X) S_TIMES car(W),cdr(X) S_TIMES cdr(W)]) = Fr_to_Ra([car(Y) S_TIMES car(Z),cdr(Y) S_TIMES cdr(Z)]))<P>
(588) Theorem 438: [The sum of a rational number and a formal fraction can be expressed as a sum of formal fractions] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) imp (X Ra_PLUS Fr_to_Ra([Y,Z]) =    Fr_to_Ra([(car(arb(X)) S_TIMES Z) S_PLUS (cdr(arb(X)) S_TIMES Y),(cdr(arb(X)) S_TIMES Z)]))<P>
(589) Theorem 439: [The product of a rational number and a formal fraction can be expressed as a product of formal fractions] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) imp (X Ra_TIMES Fr_to_Ra([Y,Z]) =			Fr_to_Ra([car(arb(X)) S_TIMES Y,cdr(arb(X)) S_TIMES Z]))<P>
(590) Theorem 440: [Reversing both the numerator and denominator of a formal fraction does not change the rational it represents] (X in Fr) imp Same_frac(X,[S_Rev(car(X)),S_Rev(cdr(X))])<P>
(591) Theorem 441: [?] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & is_nonneg(cdr(X)) & is_nonneg(cdr(Y))) imp	((is_nonneg(car(X)) or car(X) = [0,0]) eq (is_nonneg(car(Y)) or car(Y) = [0,0]))<P>
(592) Theorem 442: [The sign of the product of the numerator and denominator of a fraction defines the sign of the rational number which it represents]    ((X in Fr) & (Y in Fr) & Same_frac(X,Y)) imp (is_nonneg(car(X) S_TIMES cdr(X)) eq is_nonneg(car(Y) S_TIMES cdr(Y)))<P>
(593) Theorem 443: [?] (X in Fr) imp (Fr_is_nonneg(X) eq Fr_is_nonneg([S_Rev(car(X)),S_Rev(cdr(X))]))<P>
(594) Theorem 444: [?] ((X in Fr) & (Y in Fr) & Same_frac(X,Y)) imp (Fr_is_nonneg(X) eq Fr_is_nonneg(Y))<P>
(595) Theorem 445: [Commutativity of rational addition] ((N in Ra) & (M in Ra)) imp	((N Ra_PLUS M in Ra) & (N Ra_PLUS M = M Ra_PLUS N))<P>
(596) Theorem 446: [?] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) imp (Fr_to_Ra([Y,Z]) Ra_PLUS X =    Fr_to_Ra([(car(arb(X)) S_TIMES Z) S_PLUS (cdr(arb(X)) S_TIMES Y),(cdr(arb(X)) S_TIMES Z)]))<P>
(596+) Theorem 447: [?] ((X in Si) & (Y in Si) & (Z in Si) & (W in Si) & (Y /= [0,0]) & (W /= [0,0])) imp  (Fr_to_Ra([X,Y]) Ra_PLUS Fr_to_Ra([Z,W]) = Fr_to_Ra([(X S_TIMES W) S_PLUS (Z S_TIMES Y),Y S_TIMES W]))<P>
(597) Theorem 448: [Commutativity of rational multiplication] ((N in Ra) & (M in Ra)) imp		((N Ra_TIMES M in Ra) & (N Ra_TIMES M = M Ra_TIMES N))<P>
(598) Theorem 449: [?] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) imp	((Fr_to_Ra([Y,Z]) Ra_TIMES X) =			Fr_to_Ra([car(arb(X)) S_TIMES Y,cdr(arb(X)) S_TIMES Z]))<P>
(599) Theorem 450: [Associative law for rational addition] ((K in Ra) & (N in Ra) & (M in Ra)) imp (N Ra_PLUS (M Ra_PLUS K) = (N Ra_PLUS M) Ra_PLUS K)<P>
(600) Theorem 451: [The zero rational is the identity for rational addition] (Ra_0 in Ra) & (Ra_1 in Ra) & ((M in Ra) imp (M = M Ra_PLUS Ra_0))<P>
(601) Theorem 452: [The sum of a rational number and its additive inverse is zero] (M in Ra) imp ((Ra_Rev(M) in Ra) & ((M Ra_PLUS Ra_Rev(M)) = Ra_0))<P>
(602) Theorem 453: [The sum of a rational number and its additive inverse is zero, 2] (M in Ra) imp ((Ra_Rev(M) in Ra) & ((Ra_Rev(M) Ra_PLUS M) = Ra_0))<P>
(603) Theorem 454: [The difference of two rationals is rational] ((N in Ra) & (M in Ra)) imp ((N Ra_MINUS M) in Ra)<P>
(604) Theorem 455: [Rational subtraction is equivalent to addition of the rational negative] ((N in Ra) & (M in Ra)) imp (N = M Ra_PLUS (N Ra_MINUS M))<P>
(605) Theorem 456: [Associative law for rational multiplication] ((K in Ra) & (N in Ra) & (M in Ra)) imp (N Ra_TIMES (M Ra_TIMES K) = (N Ra_TIMES M) Ra_TIMES K)<P>
(606) Theorem 457: [Muliplication of numerator and denominator by a common nonzero function does not change the rational number it represents]    ((K in Si) & (N in Si) & (M in Si) & (K /= [0,0]) & (M /= [0,0])) imp (Fr_to_Ra([N,M]) = Fr_to_Ra([K S_TIMES N,K S_TIMES M]))<P>
(607) Theorem 458: [Distributive law for rationals] ((K in Ra) & (N in Ra) & (M in Ra)) imp (N Ra_TIMES (M Ra_PLUS K) = (N Ra_TIMES M) Ra_PLUS (N Ra_TIMES K))<P>
(608) Theorem 459: [Expressing the sign of a rational in terms of the numerator and denominator of any representing fraction] ((X in Si) & (Y in Si) & (Y /= [0,0])) imp (Ra_is_nonneg(Fr_to_Ra([X,Y])) eq is_nonneg(X S_TIMES Y))<P>
(609) Theorem 460: [The unit and zero signed signed integers addition] ([1,0] in Si) & ([0,0] in Si) & ([1,0] /= [0,0]) & ([[0,0],[1,0]] in Fr) & ([[1,0],[1,0]] in Fr)<P>
(610) Theorem 461: [The unit rational is the rational multiplicative identity] (M in Ra) imp (M = M Ra_TIMES Ra_1)<P>
(611) Theorem 462: [Multiplication of a rational by its reciprocal gives 1] ((M in Ra) & (M /= Ra_0)) imp ((Recip(M) in Ra) & (M Ra_TIMES Recip(M) = Ra_1))<P>
(612) Theorem 463: ((N in Ra) & (M in Ra) & (M /= Ra_0)) imp (((N Ra_TIMES (M Ra_TIMES M)) Ra_TIMES (Recip(M) Ra_TIMES Recip(M))) = N)<P>
(613) Theorem 464: [Rational division is multiplication by the reciprocal] ((N in Ra) & (M in Ra) & (M /= Ra_0)) imp (N = M Ra_TIMES (N Ra_OVER M))<P>
(614) Theorem 465: [0 and 1 have non-negative rationals] Ra_is_nonneg(Ra_0) & Ra_is_nonneg(Ra_1)<P>
(615) Theorem 466: [One of a rational and its additive inverse is always non-negative, and both are non-negative only if the rational is zero] (X in Ra) imp ((Ra_is_nonneg(X) or Ra_is_nonneg(Ra_Rev(X))) &	((Ra_is_nonneg(X) & Ra_is_nonneg(Ra_Rev(X))) imp (X = Ra_0)))<P>
(616) Theorem 467: [The unit rational is the identity for multiplication] (X in Ra) imp (X = X Ra_TIMES Ra_1)<P>
(617) Theorem 468: [The zero rational is represented by any fraction whose numerator is 0] (X in Ra) imp ((X = Ra_0) eq (car(arb(X)) = [0,0]))<P>
(618) Theorem 469: [The sum and product of two non-negative rationals is non-negative] ((X in Ra) & (Y in Ra) & Ra_is_nonneg(X) & Ra_is_nonneg(Y)) imp	(Ra_is_nonneg(X Ra_PLUS Y) & Ra_is_nonneg(X Ra_TIMES Y))<P>
(619) Theorem 470: (Ra_0 in Ra) &	(FORALL x in Ra | ((x Ra_PLUS Ra_0) = x) & ((x Ra_PLUS Ra_Rev(x)) = Ra_0) & (Ra_Rev(x) in Ra))  &	(FORALL x in Ra, y in Ra | ((x Ra_PLUS y) in Ra) & ((x Ra_PLUS y) = (y Ra_PLUS x)) & ((x Ra_PLUS Ra_Rev(y)) = (x Ra_MINUS y))) &	(FORALL x in Ra, y in Ra, z in Ra | ((x Ra_PLUS y) Ra_PLUS z) = (x Ra_PLUS (y Ra_PLUS z))) &	(FORALL x in Ra, y in Ra | (Ra_is_nonneg(x) & Ra_is_nonneg(y)) imp Ra_is_nonneg(x Ra_PLUS y)) &	(FORALL x in Ra | (Ra_is_nonneg(x) or Ra_is_nonneg(Ra_Rev(x))) & ((Ra_is_nonneg(x) & Ra_is_nonneg(Ra_Rev(x))) imp (x = Ra_0)))<P>
(620) Theorem 471: [The ordering of two rationals is defined by the sign of their differences, 0] (FORALL x, y | (Ra_GE(x,y) eq Ra_is_nonneg(x Ra_PLUS Ra_Rev(y))) & (Ra_LE(x,y) eq Ra_GE(y,x)) &	(Ra_GT(x,y) eq (Ra_GE(x,y) & (x /= y))) & (Ra_LT(x,y) eq Ra_GT(y,x))) &	(FORALL x, y | (Ra_LE(x,y) eq Ra_is_nonneg((y Ra_PLUS Ra_Rev(x)))) &		(((x in Ra) & (y in Ra)) imp (Ra_GT(x,y) eq (Ra_is_nonneg((x Ra_PLUS Ra_Rev(y))) & (x /= y)))) &		(((x in Ra) & (y in Ra)) imp (Ra_GT(x,y) eq (Ra_is_nonneg((x Ra_MINUS y)) & (x /= y))))) &	(FORALL x, y | ((x in Ra) & (y in Ra) & ((x = y) or (not Ra_GE(x,y)))) imp Ra_GE(y,x))<P>
(621) Theorem 472: [The ordering of two rationals is defined by the sign of their differences] (FORALL x,y | ((x Ra_GE y) eq Ra_is_nonneg(x Ra_PLUS Ra_Rev(y)))) &	(FORALL x,y | (x Ra_LE y) eq (y Ra_GE x)) &	(FORALL x,y | ((x Ra_GT y) eq ((x Ra_GE y) & (x /= y)))) &	(FORALL x,y | ((x Ra_LT y) eq (y Ra_GT x)))  &    (FORALL x,y | ((x Ra_LE y) eq Ra_is_nonneg(y Ra_PLUS Ra_Rev(x)))) &	(FORALL x,y | (((x in Ra) & (y in Ra)) imp ((x Ra_GT y) eq (Ra_is_nonneg(x Ra_PLUS Ra_Rev(y)) & (x /= y))))) &	(FORALL x,y | (((x in Ra) & (y in Ra)) imp ((x Ra_GT y) eq (Ra_is_nonneg(x Ra_MINUS y) & (x /= y))))) &    (FORALL x,y | (((x in Ra) & (y in Ra) & ((x = y) or (not(x Ra_GE y)))) imp (y Ra_GE x)))<P>
(622) Theorem 473: [Various basic properties of rational comparison] ((X Ra_GE Y) eq Ra_is_nonneg(X Ra_PLUS Ra_Rev(Y))) &	((X Ra_LE Y) eq (Y Ra_GE X)) &	((X Ra_GT Y) eq ((X Ra_GE Y) & (X /= Y))) &	((X Ra_LT Y) eq (Y Ra_GT X))  &	((X Ra_LE Y) eq Ra_is_nonneg(Y Ra_PLUS Ra_Rev(X))) &	(((X in Ra) & (Y in Ra)) imp ((X Ra_GT Y) eq (Ra_is_nonneg(X Ra_PLUS Ra_Rev(Y)) & (X /= Y)))) &	(((X in Ra) & (Y in Ra)) imp ((X Ra_GT Y) eq (Ra_is_nonneg(X Ra_MINUS Y) & (X /= Y)))) &	(((X in Ra) & (Y in Ra) & ((X = Y) or (not(X Ra_GE Y)))) imp (Y Ra_GE X))<P>
(623) Theorem 474: [Greater_than_equal is greater-than and equal] ((X in Ra) & (Y in Ra)) imp ((X Ra_GE Y) eq ((X Ra_GT Y) or (X = Y)))<P>
(624) Theorem 475: [Less_than_equal is less-than and equal] ((X in Ra) & (Y in Ra)) imp ((X Ra_LE Y) eq ((X Ra_LT Y) or (X = Y)))<P>
(625) Theorem 476: [The rationals are a linearly ordered set] ((X in Ra) & (Y in Ra)) imp ((X Ra_GT Y) or (X = Y) or (Y Ra_GT X))<P>
(626) Theorem 477: [The rationals are a linearly ordered set, 2] ((X in Ra) & (Y in Ra)) imp ((X Ra_LT Y) or (X = Y) or (Y Ra_LT X))<P>
(627) Theorem 478: [The rationals are a linearly ordered set,3] ((X in Ra) & (Y in Ra)) imp ((X Ra_GT Y) or (Y Ra_GE X))<P>
(628) Theorem 479: [The rationals are a linearly ordered set,4] ((X in Ra) & (Y in Ra)) imp ((X Ra_LT Y) or (Y Ra_LE X))<P>
(629) Theorem 480: [Transitivity of ordering] ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_GE Y) & (Y Ra_GE Z)) imp (X Ra_GE Z))<P>
(630) Theorem 481: [Properties of the rational zero and unit] (Ra_Rev(Ra_0) = Ra_0) & (Ra_1 /= Ra_0) & (Ra_1 Ra_GT Ra_0)<P>
(631) Theorem 482: [Alternate characterization of non-negativity for rationals] (X in Ra) imp ((Ra_is_nonneg(X) eq (X Ra_GE Ra_0)) & ((X Ra_GT Ra_0) imp Ra_is_nonneg(X)))<P>
(632) Theorem 483: [Reversing the numerators of two equivalent rational fractions leaves them equivalent] ((X in Si) & (Y in Si) & (XP in Si) & (YP in Si) & Same_frac([X,Y],[XP,YP])) imp	Same_frac([S_Rev(X),Y],[S_Rev(XP),YP])<P>
(633) Theorem 484: [Alternate form of Theorem 483] ((X in Si) & (Y in Si) & (Y /= [0,0])) imp (Ra_Rev(Fr_to_Ra([X,Y])) = Fr_to_Ra([S_Rev(X),Y]))<P>
(634) Theorem 485: [First law of signs for rational multiplication] ((X in Ra) & (Y in Ra)) imp ((X Ra_TIMES Ra_Rev(Y)) = Ra_Rev(X Ra_TIMES Y))<P>
(635) Theorem 486: [The reverse of a rational $X$ is the reverse of 1, times $X$] (X in Ra) imp (Ra_Rev(X) = (Ra_Rev(Ra_1) Ra_TIMES X))<P>
(636) Theorem 487: ((X in Ra) & (Y in Ra) & (Z in Ra)) imp ((X Ra_TIMES (Y Ra_MINUS Z)) = (X Ra_TIMES Y) Ra_MINUS (X Ra_TIMES Z))<P>
(637) Theorem 488: [Strict monotonicity of rational multiplication over 1st argument] ((X in Ra) & (Y in Ra) & (X1 in Ra) & (X Ra_GT Y) & (X1 Ra_GT Ra_0)) imp ((X Ra_TIMES X1) Ra_GT (Y Ra_TIMES X1))<P>
(638) Theorem 489: (X in Ra) imp (X Ra_TIMES Ra_0 = Ra_0)<P>
(639) Theorem 490: ((X in Ra) & (Y in Ra) & (X Ra_GT Ra_0) & (Y Ra_GT Ra_0)) imp ((X Ra_TIMES Y) Ra_GT Ra_0)<P>
(640) Theorem 491: ((X in Ra) & (X Ra_GT Ra_0)) imp (Recip(X) Ra_GT Ra_0)<P>
(640+) Theorem 492: ((X in Ra) & (Y in Ra)) imp (Ra_Rev(X Ra_PLUS Y) = (Ra_Rev(X) Ra_PLUS Ra_Rev(Y)))<P>
(641) Theorem 493: [Monotonicity of rational addition] ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X Ra_GE Y) &	 (XP Ra_GE YP)) imp ((X Ra_PLUS XP) Ra_GE (Y Ra_PLUS YP))<P>
(642) Theorem 494: (X in Ra) imp (Ra_Rev(Ra_Rev(X)) = X)<P>
(643) Theorem 495: ((X in Ra) & (Y in Ra)) imp (((X Ra_GE Y) or (Y Ra_GE X)) &	(((X Ra_GE Y) & (Y Ra_GE X)) imp (X = Y)))<P>
(644) Theorem 496: [Transitivity of ordering, strict case]  ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_GE Y) & (Y Ra_GT Z)) imp (X Ra_GT Z))<P>
(645) Theorem 497: [Transitivity of ordering, strict case 2] ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_GT Y) & (Y Ra_GE Z)) imp (X Ra_GT Z))<P>
(646) Theorem 498: [Transitivity of ordering, strict case 3]  ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_GT Y) & (Y Ra_GT Z)) imp (X Ra_GT Z))<P>
(647) Theorem 499:  [Transitivity of ordering by 'less than'] ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_LE Y) & (Y Ra_LT Z)) imp (X Ra_LT Z))<P>
(648) Theorem 500: [Transitivity of ordering by 'less than', 2] ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_LT Y) & (Y Ra_LE Z)) imp (X Ra_LT Z))<P>
(649) Theorem 501: [Transitivity of ordering by 'less than', 3] ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_LT Y) & (Y Ra_LT Z)) imp (X Ra_LT Z))<P>
(650) Theorem 502: ((X in Ra) & (Y in Ra) & (X Ra_GE Y)) imp (Ra_Rev(Y) Ra_GE Ra_Rev(X))<P>
(651) Theorem 503: ((X in Ra) & (Y in Ra) & (X Ra_GT Y)) imp (Ra_Rev(Y) Ra_GT Ra_Rev(X))<P>
(652) Theorem 504: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X Ra_GE Y) &	 (XP Ra_GT YP)) imp ((X Ra_PLUS XP) Ra_GT (Y Ra_PLUS YP))<P>
(653) Theorem 505: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X Ra_GT Y) &	 (XP Ra_GE YP)) imp ((X Ra_PLUS XP) Ra_GT (Y Ra_PLUS YP))<P>
(654) Theorem 506: ((X in Ra) & (X /= Ra_0)) imp ((Recip(X) /= Ra_0) & Recip(Recip(X)) = X)<P>
(655) Theorem 507: ([2,0] in Si) & (is_nonneg([2,0])) & is_nonneg([1,0]) & (Fr_to_Ra([[1,0],[2,0]]) in Ra) &		(Fr_to_Ra([[1,0],[2,0]]) Ra_GT Ra_0)<P>
(656) Theorem 508: [Transitivity of ordering by 'greater than'] ((X in Ra) & (Y in Ra) & (Z in Ra) &	(X Ra_GE Y) & (Y Ra_GE Z)) imp (X Ra_GE Z)<P>
(657) Theorem 509: [Transitivity of ordering, strict case] ((X in Ra) & (Y in Ra) & (Z in Ra) &	(X Ra_GT Y) & (Y Ra_GE Z)) imp (X Ra_GT Z)<P>
(658) Theorem 510: [Transitivity of ordering, strict case 2] ((X in Ra) & (Y in Ra) & (Z in Ra) &	(X Ra_GE Y) & (Y Ra_GT Z)) imp (X Ra_GT Z)<P>
(659) Theorem 511: ((X in Ra) & (Y in Ra) & (Z in Ra) & (X Ra_GT Y) & (Y Ra_GT Z)) imp (X Ra_GT Z)<P>
(660) Theorem 512: (FORALL x in Ra, y in Ra, z in Ra | ((x Ra_LT y) & (y Ra_LT z)) imp (x Ra_LT z))<P>
(661) Theorem 513: (FORALL x in Ra | not(x Ra_LT x))<P>
(662) Theorem 514: (FORALL x in Ra, y in Ra | (x Ra_LT y) or (x = y) or (y Ra_LT x))<P>
(663) Theorem 515: (FORALL x, y | smaller_Ra(x,y) = if ((x notin Ra) & (y notin Ra)) then Ra elseif (x notin Ra) then y elseif (y notin Ra) then x elseif (x Ra_LT y) then x else y end if) &	(FORALL x, y | smaller_Ra(x,y) = smaller_Ra(y,x)) &	(FORALL x, y | ({x,y} incin Ra) imp (smaller_Ra(x,y) in {x,y})) &	(FORALL x | (x in next(Ra)) imp (smaller_Ra(x,Ra) = x)) &	(FORALL x, y, z | smaller_Ra(x,smaller_Ra(y,z)) = smaller_Ra(smaller_Ra(x,y),z)) &	(FORALL x, y | ((x in next(Ra)) & (y in next(Ra))) imp (smaller_Ra(x,y) in next(Ra))) &	(FORALL f,p,a | (Svm(f) & (range(f) incin Ra) & Finite(f)) imp		(((p in f) imp (min_over_Ra({p}) = (f~[car(p)]))) &		(min_over_Ra(f) = smaller_Ra(min_over_Ra(f ON (domain(f) * a)),min_over_Ra(f ON (domain(f) - a)))))) &	(FORALL f | (Svm(f) & (range(f) incin Ra) & Finite(f) & (f /= 0)) imp (min_over_Ra(f) in range(f))) &	(FORALL x, y | ({x,y} incin Ra) imp ((smaller_Ra(x,y) = x) eq ((x Ra_LT y) or (x = y)))) &	(FORALL t | ubs_Ra(t) = {x in Ra | (FORALL y in (t * Ra) | smaller_Ra(y,x) = y)}) &	(FORALL t | max_Ra(t) = arb({Ra} + (t * ubs_Ra(t)))) &	(FORALL t | lub_Ra(t) = arb({Ra} + {x in ubs_Ra(t) | ubs_Ra(t) incin ubs_Ra({x})})) &	(ubs_Ra(0) = Ra) & (max_Ra(0) = Ra) &	(FORALL t | (ubs_Ra(t) incin Ra) & (ubs_Ra(t) = ubs_Ra(t * Ra)) & (max_Ra(t) = max_Ra(t * Ra))) &	(FORALL t, x | (Finite(t) & (x in t) & (t incin Ra)) imp ((max_Ra(t) in t) & ((x = max_Ra(t)) or ((x Ra_LT max_Ra(t))))))<P>
(664) Theorem 516: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X Ra_GE Y) & (Y Ra_GE Ra_0) &	 (YP Ra_GE Ra_0) & (XP Ra_GE YP)) imp ((X Ra_TIMES XP) Ra_GE (Y Ra_TIMES YP))<P>
(665) Theorem 517: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X Ra_GT Y) & (Y Ra_GT Ra_0) &	 (YP Ra_GT Ra_0) & (XP Ra_GE YP)) imp ((X Ra_TIMES XP) Ra_GT (Y Ra_TIMES YP))<P>
(666) Theorem 518: [The rational reciprocal is monotone decreasing for positive rationals] ((X in Ra) & (Y in Ra) & (X Ra_GT Y) & (Y Ra_GT Ra_0)) imp (Recip(Y) Ra_GT Recip(X))<P>
(667) Theorem 519: [The average of two rational numbers lies between them] ((X in Ra) & (Y in Ra) & (X Ra_GT Y)) imp	((X Ra_GT ((X Ra_PLUS Y) Ra_OVER (Ra_1 Ra_PLUS Ra_1))) & (((X Ra_PLUS Y) Ra_OVER (Ra_1 Ra_PLUS Ra_1)) Ra_GT Y))<P>
(668) Theorem 520: [Properties of the rational number 2] ((Ra_1 Ra_PLUS Ra_1) in Ra) & ((Ra_1 Ra_PLUS Ra_1) Ra_GT Ra_0) &                (Recip(Ra_1 Ra_PLUS Ra_1) in Ra) &		((X in Ra) imp ((X Ra_OVER (Ra_1 Ra_PLUS Ra_1)) in Ra))<P>
(669) Theorem 521: [Any rational number can be divided into two equal halves] (X in Ra) imp (X = ((X Ra_OVER (Ra_1 Ra_PLUS Ra_1)) Ra_PLUS (X Ra_OVER (Ra_1 Ra_PLUS Ra_1))))<P>
(670) Theorem 522: [Every positive rational exceeds the sum of two smaller positive rationals] ((X in Ra) & (X Ra_GT Ra_0)) imp (EXISTS e in Ra, e0 in Ra | (X Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e Ra_GT Ra_0) & (X Ra_GT (e Ra_PLUS e0)))<P>
(671) Theorem 523: [Every positive rational exceeds some smaller positive rational] ((X in Ra) & (X Ra_GT Ra_0)) imp (EXISTS e in Ra | (X Ra_GT e) & (e Ra_GT Ra_0))<P>
(672) Theorem 524: [the squares of rational numbers are non-negative] (X in Ra) imp ((X Ra_TIMES X) Ra_GE Ra_0)<P>
(673) Theorem 525: [rational numbers meet facts known about ordered groups in general] (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_PLUS y) = (x Ra_PLUS z)) imp (y = z))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_Rev(x Ra_PLUS Ra_Rev(y)) = (y Ra_PLUS Ra_Rev(x)))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) imp ((x Ra_LE y) or (y Ra_LE x))) &	(FORALL x | (x in Ra) imp (x Ra_LE x)) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_LE y) & (y Ra_LE z)) imp (x Ra_LE z))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_LE y) & (x /= y) & (y Ra_LE z)) imp (x /= z))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_LE y) & (y Ra_LE z) & (y /= z)) imp (x /= z))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp ((x Ra_LE y) imp ((x Ra_PLUS z) Ra_LE (y Ra_PLUS z)))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_PLUS z) = (y Ra_PLUS z)) imp (x = y))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_LE y) & (x /= y)) imp ((x Ra_PLUS z) /= (y Ra_PLUS z)))) &	(FORALL x | (x in Ra) imp (Ra_ABS(x Ra_PLUS Ra_Rev(x)) = Ra_0)) &	(FORALL x | (x in Ra) imp (x Ra_LE Ra_ABS(x))) &	(FORALL x | (x in Ra) imp (Ra_ABS(Ra_ABS(x)) = Ra_ABS(x))) &	(FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0))) &	(FORALL x | (x in Ra) imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) imp ((x Ra_PLUS y) Ra_LE (Ra_ABS(x) Ra_PLUS Ra_ABS(y)))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp ((Ra_ABS(x Ra_PLUS Ra_Rev(y)) Ra_LE z) imp (y Ra_LE (x Ra_PLUS z)))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_ABS(x Ra_PLUS y) Ra_LE (Ra_ABS(x) Ra_PLUS Ra_ABS(y)))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) imp ((not(Ra_is_nonneg(x))) imp ((x Ra_LE Ra_ABS(y)) & (x /= Ra_ABS(y))))) &	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (Ra_ABS((x Ra_PLUS Ra_Rev(z))) Ra_LE (Ra_ABS(x Ra_PLUS Ra_Rev(y)) Ra_PLUS Ra_ABS(y Ra_PLUS Ra_Rev(z))))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_is_nonneg(y) imp ((x Ra_PLUS Ra_Rev(y)) Ra_LE (x Ra_PLUS y)))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_ABS(Ra_ABS(x) Ra_PLUS Ra_Rev(Ra_ABS(y))) Ra_LE Ra_ABS(x Ra_PLUS Ra_Rev(y)))) &	(FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_ABS(x) Ra_PLUS Ra_Rev(Ra_ABS(Ra_ABS(y) Ra_PLUS Ra_Rev(Ra_ABS(x)))) Ra_LE Ra_ABS(y)))<P>
(674) Theorem 526: ((X in Ra) & (Y in Ra) & (not(X Ra_LE Y))) imp (X Ra_GT Y)<P>
(675) Theorem 527: [The absolute value of a rational $x$ is a non-negative rational no smaller than $x$] (X in Ra) imp ((Ra_ABS(X) in Ra) & (Ra_ABS(X) Ra_GE Ra_0) & (Ra_ABS(X) Ra_GE X))<P>
(676) Theorem 528: [The absolute value of a non-negative rational $x$ is $x$] (X in Ra) imp ((X Ra_GE Ra_0) eq (Ra_ABS(X) = X))<P>
(677) Theorem 529: [The absolute value of a rational $x$ greater than $Ra_0$ is $x$] ((X in Ra) & (X Ra_GT Ra_0)) imp (Ra_ABS(X) = X)<P>
(678) Theorem 530: [The absolute value of a rational product is the product of the absolute values] ((X in Ra) & (Y in Ra)) imp (Ra_ABS(X Ra_TIMES Y) = (Ra_ABS(X) Ra_TIMES Ra_ABS(Y)))<P>
(679) Theorem 531: [If the product of two rationals is 0, one of them is 0] ((X in Ra) & (Y in Ra)) imp (((X Ra_TIMES Y) = Ra_0) eq ((X = Ra_0) or (Y = Ra_0)))<P>
(680) Theorem 532: [Cancellation rule for rational multiplication] ((X in Ra) & (Y in Ra) & (U in Ra) & (X /= Ra_0) & ((X Ra_TIMES Y) = (X Ra_TIMES U))) imp (Y = U)<P>
(681) Theorem 533: [The reciprocal of a rational product is the product of the reciprocals] ((X in Ra) & (Y in Ra) & (X /= Ra_0) & (Y /= Ra_0)) imp (Recip(X Ra_TIMES Y) = (Recip(X) Ra_TIMES Recip(Y)))<P>
(682) Theorem 534: [Formula for the sum of two rational quotients] ((X in Ra) & (Y in Ra) & (U in Ra) & (V in Ra) & (X /= Ra_0) & (Y /= Ra_0)) imp (((U Ra_OVER X) Ra_PLUS (V Ra_OVER Y)) = (((Y Ra_TIMES U) Ra_PLUS (X Ra_TIMES V)) Ra_OVER (X Ra_TIMES Y)))<P>
(683) Theorem 535: ((X in Ra) & (Y in Ra) & (X /= Ra_0) & (Y /= Ra_0)) imp ((Recip(X) Ra_MINUS Recip(Y)) = ((Y Ra_MINUS X) Ra_OVER (X Ra_TIMES Y)))<P>
(684) Theorem 536: [The absolute value of the reciprocal equals the reciprocal of the absolute value] ((X in Ra) & (X /= Ra_0)) imp (Ra_ABS(Recip(X)) = Recip(Ra_ABS(X)))<P>
(684+) Theorem 537: ((X in Ra) & (Y in Ra)) imp (Ra_ABS(X Ra_MINUS Y) = Ra_ABS(Y Ra_MINUS X))<P>
(685) Theorem 538: ((X in Ra) & (Y in Ra) & (A in Ra) & (B in Ra) & (Ra_ABS(X) Ra_GT A) & (Ra_ABS(Y) Ra_GT B) & (A Ra_GT Ra_0) & (B Ra_GT Ra_0)) imp (Ra_ABS(Recip(X) Ra_MINUS Recip(Y)) Ra_LE (Ra_ABS(X Ra_MINUS Y) Ra_TIMES (Recip(A) Ra_TIMES Recip(B))))<P>
(686) Theorem 539: [Every Rational Cauchy sequence is a rational sequence] RaCauchy incin RaSeq<P>
(687) Theorem 540: [The range of a rational sequence is included in the set of rationals] (F in RaSeq) imp ((domain(F) = Za) & Svm(F) & (range(F) incin Ra) & ((X in Za) imp (F~[X] in Ra)))<P>
(688) Theorem 541: [Reformulation of condition for sequence equivalence] ({F,G} incin RaSeq) imp (Ra_eqseq(F,G) eq (FORALL eps in Ra | (eps Ra_GT Ra_0) imp		Finite({x : x in Za | Ra_ABS((F~[x]) Ra_MINUS (G~[x])) Ra_GT eps})))<P>
(689) Theorem 542: [Condition for rational sequence equality] (FORALL n in Za | ((F in RaSeq) & (G in RaSeq) & (F~[n] = G~[n]))) imp (F = G)<P>
(690) Theorem pointwiseU.1: h = {[u,uop(fp~[u])]: u in d}<P>
(691) Theorem pointwiseU.2: Svm(h) & (domain(h) = d) & (range(h) incin r)<P>
(692) Theorem pointwiseU.3: (FORALL x in d | h~[x] = uop(fp~[x]))<P>
(693) Theorem pointwise.1: h = {[u,bop(fq~[u],fp~[u])]: u in d}<P>
(694) Theorem pointwise.2: Svm(h) & (domain(h) = d) & (range(h) incin r)<P>
(694+) Theorem pointwise.3: (FORALL x in d | h~[x] = bop(fq~[x],fp~[x]))<P>
(695) Theorem 543: (X in Ra) imp ((Za PROD {X}) in RaCauchy)<P>
(696) Theorem 544: (X in Ra) imp (Ras_ABS(Za PROD {X}) = (Za PROD {Ra_ABS(X)}))<P>
(697) Theorem 545: {Ra0Seq,Ra1Seq} incin RaCauchy<P>
(698) Theorem 546: (F in RaSeq) imp ((domain(F) = Za) & Svm(F) & (range(F) incin Ra) & Ra_eqseq(F,F))<P>
(699) Theorem 547: ((F in RaSeq) & (N in Za) & (I in Za)) imp ((shifted_seq(F,N)~[I]) = (F~[N PLUS I]))<P>
(700) Theorem 548: (U in Za) imp (((Ra0Seq~[U]) = Ra_0) & ((Ra1Seq~[U]) = Ra_1))<P>
(701) Theorem 549: ((F in RaCauchy) & (G in Subseqs(F)) & (not Finite(G))) imp ((G in RaCauchy) & Ra_eqseq(F,G))<P>
(702) Theorem 550: (F in RaCauchy) imp ((H in Za) imp (F~[H] in Ra))<P>
(703) Theorem 551: ((Eps in Ra) & (Eps Ra_GT Ra_0) & (F in RaCauchy)) imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (not (Ra_ABS((F~[i]) Ra_MINUS (F~[j]))) Ra_GT Eps)))<P>
(704)  Theorem 552: ((Eps in Ra) & (Eps Ra_GT Ra_0) & (F in RaCauchy)) imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (Eps Ra_GT (Ra_ABS((F~[i]) Ra_MINUS (F~[j])))) ))<P>
(705) Theorem 553: (({F,G,H} incin RaSeq) & Ra_eqseq(F,G) & Ra_eqseq(G,H)) imp Ra_eqseq(H,F)<P>
(706) Theorem 554: ({F,G} incin RaSeq) imp	(((F Ras_PLUS G) in RaSeq) &		(Ras_ABS(G) in RaSeq) &		(Ras_Rev(G) in RaSeq) &		((F Ras_TIMES G) in RaSeq) &		((F Ras_PLUS G) = {[u,((F~[u]) Ra_PLUS  (G~[u]))]: u in Za}) &		(Ras_ABS(G) = {[u,Ra_ABS(G~[u])]: u in Za}) &		(Ras_Rev(G) = {[u,Ra_Rev(G~[u])]: u in Za}) &		((F Ras_TIMES G) = {[u,((F~[u]) Ra_TIMES (G~[u]))]: u in Za}))<P>
(707) Theorem 555: (({F1,G1} incin RaSeq) & (N in Za)) imp ((F1~[N] in Ra) & (G1~[N] in Ra) &		((F1 Ras_PLUS G1 in RaSeq) & ((F1 Ras_PLUS G1)~[N] = (F1~[N]) Ra_PLUS (G1~[N]))) &		(((Ras_ABS(G1) in RaSeq) & (Ras_ABS(G1)~[N] = Ra_ABS(G1~[N])))) &		(((Ras_Rev(G1) in RaSeq) & (Ras_Rev(G1)~[N] = Ra_Rev(G1~[N])))) &		(((F1 Ras_TIMES G1 in RaSeq) & (F1 Ras_TIMES G1)~[N] = ((F1~[N]) Ra_TIMES (G1~[N])))))<P>
(708) Theorem 556: ({F,G} incin RaCauchy) imp	(((F Ras_PLUS G) in RaCauchy) & (Ras_ABS(F) in RaCauchy) & (Ras_Rev(F) in RaCauchy))<P>
(709) Theorem 557: ((S incin Ra) & Finite(S)) imp (EXISTS u in Ra | (FORALL y in S | u Ra_GE y))<P>
(710) Theorem 558: [Every finite set of integers has a strict upper bound] ((S incin Za) & Finite(S)) imp (EXISTS u in Za | (FORALL y in S | y in u))<P>
(711) Theorem 559: [Every rational Cauchy sequence has an upper bound] (F in RaCauchy) imp (EXISTS x in Ra | (FORALL y in range(F) | y Ra_LE x))<P>
(712) Theorem 560: (F in RaCauchy) imp (EXISTS x in Ra | (FORALL y in range(F) | Ra_ABS(y) Ra_LT x ))<P>
(713) Theorem 561: ({F,G} incin RaCauchy) imp (((F Ras_MINUS G) in RaCauchy) & ((F Ras_TIMES G) in RaCauchy))<P>
(714) Theorem 562: ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) imp (EXISTS eps in Ra | (eps Ra_GT Ra_0) & Finite({i in Za | eps Ra_GE Ra_ABS(G~[i])}))<P>
(715) Theorem 563: ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) imp (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &		(FORALL i in (Za - n) | (Ra_ABS(G~[i]) Ra_GT eps) & (Ra_ABS(G~[i]) Ra_GT Ra_0)) & (Ra_ABS(G~[n]) Ra_GT Ra_0))<P>
(716) Theorem 564: ((H in RaCauchy) & (not Ra_eqseq(H,Ra0Seq))) imp (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &	(FORALL i in (Za - n) | Ra_ABS(H~[i]) Ra_GT eps) &	(FORALL i in Za, j in Za | ((i notin n) & (j notin n)) imp (eps Ra_GT (Ra_ABS((H~[i]) Ra_MINUS (H~[j]))))))<P>
(717) Theorem 565: ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) imp ({h in Za | (FORALL i in (Za - h) | (G~[i]) /= Ra_0)} /= 0)<P>
(718) Theorem 566: ((F in RaSeq) & (M = arb({h in Za | (FORALL i in (Za - h) | (F~[i]) /= Ra_0)}))) imp (Ras_Recip(F) = Ras_Recip(shifted_seq(F,M)))<P>
(719) Theorem 567: ((F in RaCauchy) & (M in Za)) imp ((shifted_seq(F,M) in RaCauchy) & Ra_eqseq(F,shifted_seq(F,M)))<P>
(720) Theorem 568: ((F in RaCauchy) & (not Ra_eqseq(F,Ra0Seq))) imp (EXISTS g in RaCauchy | Ra_eqseq(F,g) & (Ras_Recip(F) = Ras_Recip(g)) &	(FORALL i in Za | ((g~[i]) /= Ra_0) & (Ras_Recip(g)~[i] = Recip(g~[i]))))<P>
(721) Theorem 569: [The reciprocal of a non-null rational sequence is a rational sequence] ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) imp (Ras_Recip(G) in RaSeq)<P>
(722) Theorem 570: [Reciprocal and quotient of rational Cauchy sequences are, when defined, Cauchy sequences] (({F,G} incin RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) imp ((Ras_Recip(G) in RaCauchy) & ((F Ras_OVER G) in RaCauchy))<P>
(723) Theorem 571: (({F,G,Fp,Gp} incin RaSeq) & Ra_eqseq(F,G) & Ra_eqseq(Fp,Gp)) imp Ra_eqseq(F Ras_PLUS Fp, G Ras_PLUS Gp)<P>
(724) Theorem 572: (({F,G,Fp,Gp} incin RaCauchy) & Ra_eqseq(F,G) & Ra_eqseq(Fp,Gp)) imp Ra_eqseq(F Ras_PLUS Fp, G Ras_PLUS Gp)<P>
(725) Theorem 573: (({F,Fp,G} incin RaCauchy) & Ra_eqseq(F,Fp)) imp Ra_eqseq(F Ras_TIMES G, Fp Ras_TIMES G)<P>
(726) Theorem 574: (({F,G,Fp,Gp} incin RaCauchy) & Ra_eqseq(F,G) & Ra_eqseq(Fp,Gp)) imp Ra_eqseq(F Ras_TIMES Fp, G Ras_TIMES Gp)<P>
(727) Theorem 575: (({F,G} incin RaCauchy) & Ra_eqseq(F,G)) imp Ra_eqseq(Ras_Rev(F),Ras_Rev(G))<P>
(728) Theorem 576: (({F,G} incin RaCauchy) & Ra_eqseq(F,G)) imp Ra_eqseq(Ras_ABS(F),Ras_ABS(G))<P>
(729) Theorem 577: (({F,G} incin RaCauchy) & Ra_eqseq(F,G) & (not(Ra_eqseq(F,Ra0Seq)))) imp Ra_eqseq(Ras_Recip(F),Ras_Recip(G))<P>
(730) Theorem 578: ({F,G} incin RaSeq) imp (F Ras_PLUS G = G Ras_PLUS F)<P>
(731) Theorem 579: ({F,G} incin RaSeq) imp (F Ras_TIMES G = G Ras_TIMES F)<P>
(732) Theorem 580: ({F,G,H} incin RaSeq) imp	((F Ras_PLUS G) Ras_PLUS H = F Ras_PLUS (G Ras_PLUS H))<P>
(733) Theorem 581: ({F,G,H} incin RaSeq) imp	((F Ras_TIMES G) Ras_TIMES H = F Ras_TIMES (G Ras_TIMES H))<P>
(734) Theorem 582: [Double-inversion law for rational sequences] (X in RaSeq) imp (Ras_Rev(Ras_Rev(X))=X)<P>
(735) Theorem 583: [Distributive law for multiplication of rational sequences] ({X,Y,V} incin RaSeq) imp ((X Ras_TIMES (Y Ras_PLUS V)) = ((X Ras_TIMES Y) Ras_PLUS (X Ras_TIMES V)))<P>
(736) Theorem 584: [Law of signs for multiplication of rational sequences] ({X,Y} incin RaSeq) imp ((X Ras_TIMES Ras_Rev(Y)) = Ras_Rev(X Ras_TIMES Y))<P>
(737) Theorem 585: [Law of signs for multiplication of rational sequences, 2] ({X,Y} incin RaSeq) imp (((Ras_Rev(X) Ras_TIMES Y) = Ras_Rev(X Ras_TIMES Y)) & ((Ras_Rev(X) Ras_TIMES Ras_Rev(Y)) = (X Ras_TIMES Y)))<P>
(738) Theorem 586: [Any rational sequence times 0 is 0] (X in RaSeq) imp ((X Ras_TIMES Ra0Seq) = Ra0Seq)<P>
(739) Theorem 587: [0 is a right additive identity for rational sequences] (X in RaSeq) imp (X Ras_PLUS Ra0Seq = X)<P>
(740) Theorem 588: [1 is a left multiplicative identity for rational sequences] (X in RaSeq) imp (X Ras_TIMES Ra1Seq = X)<P>
(741) Theorem 589: [0 is right subtractive identity for rational sequence subtraction] (X in RaSeq) imp (X Ras_MINUS Ra0Seq = X)<P>
(742) Theorem 590: [Basic properties of the signed negative for rational sequences] (X in RaSeq) imp ((Ras_Rev(X) in RaSeq) & ((Ras_Rev(X) Ras_PLUS X) = Ra0Seq) & (Ras_Rev(Ras_Rev(X)) = X))<P>
(743) Theorem 591: [Reciprocal sequence principle] ((X in RaCauchy) & (not Ra_eqseq(X,Ra0Seq))) imp Ra_eqseq(X Ras_TIMES Ras_Recip(X),Ra1Seq)<P>
(744) Theorem 592: [The negative of a sum of rational sequences is the sum of the negatives] ((X in RaSeq) & (Y in RaSeq)) imp (Ras_Rev(X Ras_PLUS Y) = Ras_Rev(X) Ras_PLUS Ras_Rev(Y))<P>
(745) Theorem 593: [A rational sequence minus itself gives 0] (X in RaSeq) imp ((X Ras_MINUS X) = Ra0Seq)<P>
(746) Theorem 594: [Multiplication by $Ras_Rev(Ra1Seq)$] (X in RaSeq) imp (Ras_Rev(X) = (Ras_Rev(Ra1Seq) Ras_TIMES X))<P>
(747) Theorem 595: [The zero sequence is its own negative] Ras_Rev(Ra0Seq) = Ra0Seq<P>
(748) Theorem 596: [The zero/unit sequence is its own absolute value] (Ras_ABS(Ra0Seq) = Ra0Seq) & (Ras_ABS(Ra1Seq) = Ra1Seq)<P>
(749) Theorem 597: [?] ((H in RaCauchy) & Ra_eqseq(H,Ra0Seq)) imp (Ra_eqseq(Ras_ABS(H),Ra0Seq) & (Ra_eqseq(Ras_Rev(H),Ra0Seq)))<P>
(750) Theorem 598: [All terms of a Cauchy sequence not equivalent to zero have the same sign and have an absolute value bounded below beyond a certain point] ((F in RaCauchy) &	(not Ra_eqseq(F,Ra0Seq))) imp (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) & (FORALL i in (Za - n) | (Ra_ABS(F~[i]) Ra_GT eps) &	(Ra_ABS(F~[i]) = if ((F~[n]) Ra_GE Ra_0) then (F~[i]) else Ra_Rev(F~[i]) end if) ))<P>
(751) Theorem 599: [All terms of a Cauchy sequence not equivalent to zero have the same sign beyond a certain point] ((F in RaCauchy) &	(not Ra_eqseq(F,Ra0Seq))) imp (EXISTS n in Za | shifted_seq(Ras_ABS(F),n) =	if ((F~[n]) Ra_GE Ra_0) then shifted_seq(F,n) else shifted_seq(Ras_Rev(F),n) end if)<P>
(752) Theorem 600: [A rational Cauchy sequence is equivalent to zero iff both it and its additive inverse are equivalent to its absolute value] (F in RaCauchy) imp (Ra_eqseq(F,Ra0Seq) eq (Ra_eqseq(Ras_ABS(F),F) & Ra_eqseq(Ras_ABS(F),Ras_Rev(F))))<P>
(753) Theorem 601: [One of a Cauchy sequence and its additive inverse is always equivalent to a non-negative sequence] ((F in RaCauchy) & (not Ra_eqseq(F,Ra0Seq))) imp	(EXISTS n in Za | ((shifted_seq(Ras_ABS(F),n) = shifted_seq(F,n)) & Ra_eqseq(Ras_ABS(F),F)) or			((shifted_seq(Ras_ABS(F),n) = shifted_seq(Ras_Rev(F),n)) & Ra_eqseq(Ras_ABS(F),Ras_Rev(F))))<P>
(754) Theorem 602: [One of a Cauchy sequence $F$ and its additive inverse is always equivalent to a non-negative sequence, and both are equivalent to non-negative sequences only if $F$ is equivalent to zero] (F in RaCauchy) imp ((Ra_eqseq(Ras_ABS(F),F) or Ra_eqseq(Ras_ABS(F),Ras_Rev(F))) & (((Ra_eqseq(Ras_ABS(F),F) & Ra_eqseq(Ras_ABS(F),Ras_Rev(F)))) imp Ra_eqseq(F,Ra0Seq)))<P>
(755) Theorem 603: [The unit Cauchy sequences $Ra0Seq,Ra1Seq$ differ from one another] (not Ra_eqseq(Ra0Seq,Ra1Seq))<P>
(756) Theorem 604: [A rational sequence F and its additive inverse have the same absolute value] (F in RaSeq) imp (Ras_ABS(Ras_Rev(F)) = Ras_ABS(F))<P>
(757) Theorem 605: (F in RaSeq) imp (((F Ras_PLUS Ra0Seq) = F) & ((F Ras_TIMES Ra1Seq) = F))<P>
(758) Theorem 606: (FORALL f in RaCauchy, g in RaCauchy | (Ra_eqseq(f,g) eq Ra_eqseq(g,f)) & Ra_eqseq(f,f))<P>
(759) Theorem 607: ((F in RaCauchy) & (G in RaCauchy)) imp ((Ra_eqseq(F,G) eq Ra_eqseq(G,F)) & Ra_eqseq(F,F))<P>
(760) Theorem 608: (FORALL f in RaCauchy, g in RaCauchy, h in RaCauchy | (Ra_eqseq(f,g) & Ra_eqseq(g,h)) imp Ra_eqseq(f,h))<P>
(761)     Theorem 609: (FORALL x, y | ((x in RaCauchy) & (y in RaCauchy)) imp ((Ra_eqseq(x,y) eq (Cauchy_to_Re(x) = Cauchy_to_Re(y))))) &    (FORALL x | (x in Re) imp ((arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x))) &    (FORALL x | (x in RaCauchy) imp (Cauchy_to_Re(x) in Re)) &    (FORALL x | (x in RaCauchy) imp Ra_eqseq(x,arb(Cauchy_to_Re(x))))<P>
(762) Theorem 610: ((X in RaCauchy) & (Y in RaCauchy)) imp ((Ra_eqseq(X,Y) eq (Cauchy_to_Re(X) = Cauchy_to_Re(Y))) & (Cauchy_to_Re(X) in Re) & Ra_eqseq(X,arb(Cauchy_to_Re(X))))<P>
(763) Theorem 611: (X in Re) imp ((arb(X) in RaCauchy) & (arb(X) in RaSeq) & (Cauchy_to_Re(arb(X)) = X))<P>
(764) Theorem 612: (R_0 in Re) & (R_1 in Re)<P>
(765) Theorem 613: ({X,Y} incin Re) imp (((X R_PLUS Y) in Re) & (R_Rev(X) in Re))<P>
(766) Theorem 614: ({X,Y} incin Re) imp (((X R_MINUS Y) in Re) & ((X R_TIMES Y) in Re))<P>
(767) Theorem 615: [Commutative law for real addition] ({X,Y} incin Re) imp ((X R_PLUS Y) = (Y R_PLUS X))<P>
(768) Theorem 616: [Elementary algebraic lemma for real addition] ((X in RaCauchy) & (Y in RaCauchy)) imp (Cauchy_to_Re(X Ras_PLUS Y) = (Cauchy_to_Re(X) R_PLUS Cauchy_to_Re(Y)))<P>
(769) Theorem 617: [Associative law for real addition] ({X,Y,V} incin Re) imp ((X R_PLUS (Y R_PLUS V)) = ((X R_PLUS Y) R_PLUS V))<P>
(770) Theorem 618: [Commutative law for real multiplication] ({X,Y} incin Re) imp ((X R_TIMES Y) = (Y R_TIMES X))<P>
(771) Theorem 619: [Elementary algebraic lemma for real multiplication] ((X in RaCauchy) & (Y in RaCauchy)) imp (Cauchy_to_Re(X Ras_TIMES Y) = (Cauchy_to_Re(X) R_TIMES Cauchy_to_Re(Y)))<P>
(772) Theorem 620: [Associative law for real multiplication] ({X,Y,V} incin Re) imp ((X R_TIMES (Y R_TIMES V)) = ((X R_TIMES Y) R_TIMES V))<P>
(773) Theorem 621: [Distributive law for real multiplication] ({X,Y,V} incin Re) imp ((X R_TIMES (Y R_PLUS V)) = ((X R_TIMES Y) R_PLUS (X R_TIMES V)))<P>
(774) Theorem 622: [Lemma for law of signs] (X in RaCauchy) imp (Cauchy_to_Re(Ras_Rev(X)) = R_Rev(Cauchy_to_Re(X)))<P>
(775) Theorem 623: [Law of signs for real multiplication] ({X,Y} incin Re) imp (((X R_TIMES R_Rev(Y)) = R_Rev(X R_TIMES Y)) & ((R_Rev(X) R_TIMES Y) = R_Rev(X R_TIMES Y)) & ((R_Rev(X) R_TIMES R_Rev(Y)) = (X R_TIMES Y)))<P>
(776) Theorem 624: [Any real times 0 is 0] (X in Re) imp ((X R_TIMES R_0) = R_0)<P>
(777) Theorem 625: [0 times any real is 0] (X in Re) imp (R_0 R_TIMES X = R_0)<P>
(778) Theorem 626: [0 is a right and left additive identity for reals] (X in Re) imp ((X R_PLUS R_0 = X) & (R_0 R_PLUS X = X))<P>
(779) Theorem 627: [1 is a right multiplicative identity for reals] (X in Re) imp (X R_TIMES R_1 = X)<P>
(780) Theorem 628: [1 is a left multiplicative identity for reals] (X in Re) imp (R_1 R_TIMES X = X)<P>
(781) Theorem 629: [The zero real is its own negative] R_Rev(R_0) = R_0<P>
(782) Theorem 630: [0 is right identity for real subtraction] (X in Re) imp (X R_MINUS R_0 = X)<P>
(783) Theorem 631: [Real subtraction principle] (X in Re) imp (X R_MINUS X = R_0)<P>
(784) Theorem 632: [Basic properties of the signed negative for reals] (X in Re) imp ((R_Rev(X) in Re) & ((R_Rev(X) R_PLUS X) = R_0))<P>
(784+) Theorem 633: [Basic properties of the signed negative for reals, 2] (X in Re) imp (R_Rev(R_Rev(X)) = X)<P>
(785) Theorem 634: [Real additive Cancellation] ((X in Re) & (Y in Re) & (V in Re) & (X R_PLUS V = Y R_PLUS V)) imp (X = Y)<P>
(786) Theorem 635: [Real subtraction is addition of the negative] ((X in Re) & (Y in Re)) imp ((X R_MINUS Y) = (X R_PLUS R_Rev(Y)))<P>
(787) Theorem 636: [The sum of a real number and its additive inverse is zero] (X in Re) imp ((R_Rev(X) in Re) & ((X R_PLUS R_Rev(X)) = R_0))<P>
(788) Theorem 637: [The negative of a real $x$ is zero iff $x$ is zero] (X in Re) imp ((R_Rev(X) = R_0) eq (X = R_0))<P>
(789) Theorem 638: [The negative of a real sum is the sum of the negatives] ((X in Re) & (Y in Re)) imp (R_Rev(X R_PLUS Y) = R_Rev(X) R_PLUS R_Rev(Y))<P>
(790) Theorem 639: [Real addition-subtraction commutativity] ((X in Re) & (Y in Re) & (V in Re)) imp (X R_MINUS (Y R_PLUS V) = (X R_MINUS Y) R_MINUS V)<P>
(791) Theorem 640: [Real subtraction reverses addition] ((X in Re) & (Y in Re)) imp ((X R_PLUS Y) R_MINUS Y = X)<P>
(792) Theorem 641: [Real subtraction reverses  addition, 2] ((X in Re) & (Y in Re)) imp (X = (Y R_PLUS (X R_MINUS Y)))<P>
(793) Theorem 642: [Multiplication by $R_Rev(R_1)$] (X in Re) imp (R_Rev(X) = R_Rev(R_1) R_TIMES X)<P>
(794) Theorem 643: [Distributivity of multiplication over subtraction] ((X in Re) & (Y in Re) & (V in Re)) imp ((X R_TIMES (Y R_MINUS V)) = ((X R_TIMES Y) R_MINUS (X R_TIMES V)))<P>
(795) Theorem 644: [Additive inverse of real difference] ((X in Re) & (Y in Re)) imp (R_Rev(X R_MINUS Y) = (Y R_MINUS X))<P>
(796) Theorem 645: [Real reciprocal principle] ((X in Re) & (X /= R_0)) imp (X R_TIMES R_Recip(X) = R_1)<P>
(797) Theorem 646: [Real division principle] ((X in Re) & (X /= R_0)) imp (X R_OVER X = R_1)<P>
(798) Theorem 647: [Basic properties of the reciprocal for reals] ((X in Re) & (X /= R_0)) imp ((R_Recip(X) in Re) & (R_Recip(X) /= R_0) & ((R_Recip(X) R_TIMES X) = R_1))<P>
(799) Theorem 648: [Basic properties of the reciprocal for reals, 2] ((X in Re) & (X /= R_0)) imp (R_Recip(R_Recip(X)) = X)<P>
(800) Theorem 649: [Reverse of real reciprocal] ((X in Re) & (X /= R_0)) imp (R_Recip(R_Rev(X)) = R_Rev(R_Recip(X)))<P>
(801) Theorem 650: [Real multiplicative Cancellation] ((X in Re) & (Y in Re) & (V in Re) & (X R_TIMES V = Y R_TIMES V) & (V /= R_0)) imp (X = Y)<P>
(802) Theorem 651: [Reals are closed under division] ((X in Re) & (Y in Re) & (Y /= R_0)) imp ((X R_OVER Y in Re) & ((X /= R_0) imp ((X R_OVER Y /= R_0) & (X R_TIMES Y /= R_0))))<P>
(803) Theorem 652: [Real division is multiplication by the reciprocal] ((X in Re) & (Y in Re) & (Y /= R_0)) imp ((X R_OVER Y) = (X R_TIMES R_Recip(Y)))<P>
(804) Theorem 653: [The reciprocal of a real product is the product of the reciprocals] ((X in Re) & (Y in Re) & (X /= R_0) & (Y /= R_0)) imp ((X R_TIMES Y /= R_0) & R_Recip(X R_TIMES Y) = R_Recip(X) R_TIMES R_Recip(Y))<P>
(805) Theorem 654: [Real multiplication-division commutativity] ((X in Re) & (Y in Re) & (Y /= R_0) & (V in Re) & (V /= R_0)) imp (X R_OVER (Y R_TIMES V) = (X R_OVER Y) R_OVER V)<P>
(806) Theorem 655: [A real divided by itself gives 1] ((X in Re) & (X /= R_0)) imp (X R_OVER X = R_1)<P>
(807) Theorem 656: [Real reciprocal as a quotient] ((X in Re) & (X /= R_0)) imp (R_Recip(X) = R_1 R_OVER X)<P>
(808) Theorem 657: [Distributivity of division over addition] ((X in Re) & (Y in Re) & (V in Re) & (V /= R_0)) imp ((X R_PLUS Y) R_OVER V = ((X R_OVER V) R_PLUS (Y R_OVER V)))<P>
(809) Theorem 658: [Real division reverses multiplication] ((X in Re) & (Y in Re) & (Y /= R_0)) imp ((X R_TIMES Y) R_OVER Y = X)<P>
(810) Theorem 659: [Real division reverses multiplication,2] ((X in Re) & (Y in Re) & (Y /= R_0)) imp (X = (Y R_TIMES (X R_OVER Y)))<P>
(811) Theorem 660: [Distributivity of division over subtraction] ((X in Re) & (Y in Re) & (V in Re) & (V /= R_0)) imp (((X R_MINUS Y) R_OVER V) = ((X R_OVER V) R_MINUS (Y R_OVER V)))<P>
(812) Theorem 661: (X in Re) imp ((R_Rev(X) = Cauchy_to_Re(arb(R_Rev(X)))) & Ra_eqseq(Ras_ABS(arb(X)),arb(Cauchy_to_Re(Ras_ABS(arb(X))))))<P>
(813) Theorem 662: ((X in Re) & (Y in Re)) imp Ra_eqseq((arb(X) Ras_PLUS arb(Y)),arb(Cauchy_to_Re(arb(X) Ras_PLUS arb(Y))))<P>
(814) Theorem 663: [Any real $x$ or its reverse is non-negative, and if both are non-negative, then $x = 0$] (X in Re) imp ((R_is_nonneg(X) or R_is_nonneg(R_Rev(X))) & ((R_is_nonneg(X) & R_is_nonneg(R_Rev(X))) imp (X = R_0)))<P>
(815) Theorem 664: [Each non-negative rational Cauchy sequences is equivalent to its own absolute value] (X in Re) imp (R_is_nonneg(X) eq Ra_eqseq(arb(X),Ras_ABS(arb(X))))<P>
(816) Theorem 665: [The sum of two non-negative rational Cauchy sequences is equivalent to its own absolute value] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) imp Ra_eqseq(arb(X) Ras_PLUS arb(Y),Ras_ABS(arb(X) Ras_PLUS arb(Y)))<P>
(817) Theorem 666: [The product of two non-negative rational Cauchy sequences is equivalent to its own absolute value] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) imp Ra_eqseq(arb(X) Ras_TIMES arb(Y),Ras_ABS(arb(X) Ras_TIMES arb(Y)))<P>
(818) Theorem 667: [The sum and product of two non-negative reals is non-negative] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) imp (R_is_nonneg(X R_PLUS Y) & R_is_nonneg(X R_TIMES Y))<P>
(819) Theorem 668: [Transitivity of ordering] ((X in Re) & (Y in Re) & (Z in Re) & (X R_GE Y) & (Y R_GE Z)) imp (X R_GE Z)<P>
(820) Theorem 669: [The reals are a linearly ordered set] ((X in Re) & (Y in Re)) imp ((X R_GT Y) or (X = Y) or (Y R_GT X))<P>
(821) Theorem 670: [The reals are a linearly ordered set, 2] ((X in Re) & (Y in Re)) imp ((X R_LT Y) or (X = Y) or (Y R_LT X))<P>
(822) Theorem 671: [0 and 1 are non-negative reals] R_is_nonneg(R_0) & R_is_nonneg(R_1)<P>
(823) Theorem 672: [The reals are a linearly ordered set, 3] ((X in Re) & (Y in Re)) imp (((X R_GE Y) or (Y R_GE X)) & (((X R_GE Y) & (Y R_GE X)) imp (X = Y)))<P>
(824) Theorem 673: [The ordering of reals is defined by the sign of their differences] ((((X in Re) & (Y in Re)) imp ((X R_GE Y) eq R_is_nonneg(X R_PLUS R_Rev(Y))))) & ((X R_LE Y) eq (Y R_GE X)) & ((X R_GT Y) eq ((X R_GE Y) & (X /= Y))) & ((X R_LT Y) eq (Y R_GT X))<P>
(825) Theorem 674: [Various basic properties of real comparison, quantified form] (FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_GE y) eq R_is_nonneg(x R_PLUS R_Rev(y)))) & (FORALL x, y | ((x R_LE y) eq (y R_GE x))) & (FORALL x, y | ((x R_GT y) eq ((x R_GE y) & (x /= y)))) & (FORALL x, y | ((x R_LT y) eq (y R_GT x))) & (FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_LE y) eq (R_is_nonneg(y R_PLUS R_Rev(x))))) & (FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_PLUS R_Rev(y)) & (x /= y)))) & (FORALL x, y | (((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_MINUS y) & (x /= y))))) & (FORALL x, y | ((x in Re) & (y in Re) & ((x = y) or (not(x R_GE y)))) imp (y R_GE x))<P>
(826) Theorem 675: [Various basic properties of real comparison] (((X in Re) & (Y in Re)) imp ((X R_GE Y) eq R_is_nonneg(X R_PLUS R_Rev(Y)))) & ((X R_LE Y) eq (Y R_GE X)) & ((X R_GT Y) eq ((X R_GE Y) & (X /= Y))) & ((X R_LT Y) eq (Y R_GT X)) & (((X in Re) & (Y in Re)) imp ((X R_LE Y) eq R_is_nonneg(Y R_PLUS R_Rev(X)))) & (((X in Re) & (Y in Re)) imp ((X R_GT Y) eq (R_is_nonneg(X R_PLUS R_Rev(Y)) & (X /= Y)))) & (((X in Re) & (Y in Re)) imp ((X R_GT Y) eq (R_is_nonneg(X R_MINUS Y) & (X /= Y)))) & (((X in Re) & (Y in Re) & ((X = Y) or (not(X R_GE Y)))) imp (Y R_GE X))<P>
(827) Theorem 676: [Mutual exclusion of strict real comparators] ((X in Re) & (Y in Re) & (X R_GT Y)) imp (not(X R_LT Y))<P>
(828) Theorem 677: [Transitivity of ordering, strict case] ((X in Re) & (Y in Re) & (Z in Re) & (X R_GT Y) & (Y R_GE Z)) imp (X R_GT Z)<P>
(829) Theorem 678: [Transitivity of ordering, strict case 2] ((X in Re) & (Y in Re) & (Z in Re) & (X R_GE Y) & (Y R_GT Z)) imp (X R_GT Z)<P>
(830) Theorem 679: [Transitivity of ordering,strict case 3] ((X in Re) & (Y in Re) & (Z in Re) & (X R_GT Y) & (Y R_GT Z)) imp (X R_GT Z)<P>
(831) Theorem 680: [Greater_than_equal is greater-than and equal] ((X in Re) & (Y in Re)) imp ((X R_GE Y) eq ((X R_GT Y) or (X = Y)))<P>
(832) Theorem 681: [Greater_than_equal is greater-than and equal] (X in Re) imp ((X R_GE R_0) eq R_is_nonneg(X))<P>
(833) Theorem 682: [Less_than_equal is less-than and equal] ((X in Re) & (Y in Re)) imp ((X R_LE Y) eq ((X R_LT Y) or (X = Y)))<P>
(834) Theorem 683: [Transitivity of ordering by 'less than'] ((X in Re) & (Y in Re) & (Z in Re)) imp (((X R_LE Y) & (Y R_LT Z)) imp (X R_LT Z))<P>
(835) Theorem 684: [Transitivity of ordering by 'less than', 2] ((X in Re) & (Y in Re) & (Z in Re)) imp (((X R_LT Y) & (Y R_LE Z)) imp (X R_LT Z))<P>
(836) Theorem 685: [Transitivity of ordering by 'less than', 3] ((X in Re) & (Y in Re) & (Z in Re)) imp (((X R_LT Y) & (Y R_LT Z)) imp (X R_LT Z))<P>
(837) Theorem 686: [No real is less than itself] not(X R_LT X)<P>
(838) Theorem 687: (FORALL x in Re, y in Re, z in Re | ((x R_LT y) & (y R_LT z)) imp (x R_LT z))<P>
(839) Theorem 688: (FORALL x in Re | not(x R_LT x))<P>
(840) Theorem 689: (FORALL x in Re, y in Re | (x R_LT y) or (x = y) or (y R_LT x))<P>
(841) Theorem 690: (FORALL x, y | smaller_Re(x,y) = if ((x notin Re) & (y notin Re)) then Re elseif (x notin Re) then y elseif (y notin Re) then x elseif (x R_LT y) then x else y end if) &	(FORALL x, y | smaller_Re(x,y) = smaller_Re(y,x)) &	(FORALL x, y | ({x,y} incin Re) imp (smaller_Re(x,y) in {x,y})) &	(FORALL x | (x in next(Re)) imp (smaller_Re(x,Re) = x)) &	(FORALL x, y, z | smaller_Re(x,smaller_Re(y,z)) = smaller_Re(smaller_Re(x,y),z)) &	(FORALL x, y | ((x in next(Re)) & (y in next(Re))) imp (smaller_Re(x,y) in next(Re))) &	(FORALL f,p,a | (Svm(f) & (range(f) incin Re) & Finite(f)) imp		(((p in f) imp (min_over_Re({p}) = (f~[car(p)]))) &		(min_over_Re(f) = smaller_Re(min_over_Re(f ON (domain(f) * a)),min_over_Re(f ON (domain(f) - a)))))) &	(FORALL f | (Svm(f) & (range(f) incin Re) & Finite(f) & (f /= 0)) imp (min_over_Re(f) in range(f))) &	(FORALL x, y | ({x,y} incin Re) imp ((smaller_Re(x,y) = x) eq ((x R_LT y) or (x = y)))) &	(FORALL t | ubs_Re(t) = {x in Re | (FORALL y in (t * Re) | smaller_Re(y,x) = y)}) &	(FORALL t | max_Re(t) = arb({Re} + (t * ubs_Re(t)))) &	(FORALL t | lub_Re(t) = arb({Re} + {x in ubs_Re(t) | ubs_Re(t) incin ubs_Re({x})})) &	(ubs_Re(0) = Re) & (max_Re(0) = Re) &	(FORALL t | (ubs_Re(t) incin Re) & (ubs_Re(t) = ubs_Re(t * Re)) & (max_Re(t) = max_Re(t * Re))) &	(FORALL t, x | (Finite(t) & (x in t) & (t incin Re)) imp ((max_Re(t) in t) & ((x = max_Re(t)) or ((x R_LT max_Re(t))))))<P>
(842) Theorem 691: [Sign reversal inverts comparisons] ((X in Re) & (Y in Re) & (X R_GE Y)) imp (R_Rev(Y) R_GE R_Rev(X))<P>
(843) Theorem 692: [Sign reversal inverts comparisons,2] ((X in Re) & (Y in Re)) imp (((X R_GE Y) eq (R_Rev(Y) R_GE R_Rev(X))) & ((X R_GT Y) eq (R_Rev(Y) R_GT R_Rev(X))))<P>
(844) Theorem 693: [Properties of the real zero and unit] (R_Rev(R_0) = R_0) & (R_1 /= R_0) & (R_1 R_GT R_0) & (R_Recip(R_1) = R_1)<P>
(845) Theorem 694: [Monotonicity of addition over 2nd argument] ((X in Re) & (XP in Re) & (YP in Re) & (XP R_GE YP)) imp ((X R_PLUS XP) R_GE (X R_PLUS YP))<P>
(846) Theorem 695: [Monotonicity of real addition] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X R_GE Y) & (XP R_GE YP)) imp ((X R_PLUS XP) R_GE (Y R_PLUS YP))<P>
(847) Theorem 696: [Strict monotonicity of addition] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X R_GE Y) & (XP R_GT YP)) imp ((X R_PLUS XP) R_GT (Y R_PLUS YP))<P>
(848) Theorem 697: [Strict monotonicity of addition] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X R_GT Y) & (XP R_GE YP)) imp ((X R_PLUS XP) R_GT (Y R_PLUS YP))<P>
(849) Theorem 698: [Strict monotonicity of addition, 2] ((X in Re) & (Y in Re) & (V in Re) & (X R_GE Y)) imp (((Y R_PLUS V) R_GE (X R_PLUS V)) eq (X = Y))<P>
(850) Theorem 699: ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & (X R_PLUS Y = R_0)) imp ((X = R_0) & (Y = R_0))<P>
(851) Theorem 700: [The product of two reals is 0 if and only if one of them is 0] ((X in Re) & (Y in Re)) imp (((X R_TIMES Y) = R_0) eq ((X = R_0) or (Y = R_0)))<P>
(852) Theorem 701: [Monotonicity of multiplication over 2nd argument] ((X in Re) & (XP in Re) & (YP in Re) & (X R_GE R_0) & (XP R_GE YP)) imp ((X R_TIMES XP) R_GE (X R_TIMES YP))<P>
(853) Theorem 702: [Monotonicity of multiplication] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X R_GE Y) & (Y R_GE R_0) & (YP R_GE R_0) & (XP R_GE YP)) imp ((X R_TIMES XP) R_GE (Y R_TIMES YP))<P>
(854) Theorem 703: [Strict monotonicity of multiplication over 2nd argument] ((X in Re) & (XP in Re) & (YP in Re) & (X R_GT R_0) & (XP R_GT YP)) imp ((X R_TIMES XP) R_GT (X R_TIMES YP))<P>
(855) Theorem 704: [Strict monotonicity of multiplication] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X R_GE Y) & (Y R_GT R_0) & (YP R_GT R_0) & (XP R_GT YP)) imp ((X R_TIMES XP) R_GT (Y R_TIMES YP))<P>
(856) Theorem 705: [Multiplication by a positive real is strictly monotone] ((X in Re) & (Y in Re) & (Z in Re) & (X R_GT Y) & (Z R_GT R_0)) imp ((X R_TIMES Z) R_GT (Y R_TIMES Z))<P>
(857) Theorem 706: [The product of reals $x,y$ of which $x$ is positive is non-negative iff $y$ is non-negative] ((X in Re) & (Y in Re) & (X /= R_0) & R_is_nonneg(X)) imp (R_is_nonneg(X R_TIMES Y) eq R_is_nonneg(Y))<P>
(858) Theorem 707: [The product of nonnegative reals is non-negative] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) imp R_is_nonneg(X R_TIMES Y)<P>
(859) Theorem 708: [Condition for positiveness of a product of reals] ((X in Re) & (Y in Re)) imp (((X R_TIMES Y) R_GT R_0) eq (((X R_GT R_0) & (Y R_GT R_0)) or ((R_0 R_GT X) & (R_0 R_GT Y))))<P>
(860) Theorem 709: [The reciprocal of a positive real is positive] ((X in Re) & (X R_GT R_0)) imp (R_Recip(X) R_GT R_0)<P>
(861) Theorem 710: [The sum of non-negative reals is at least as big at each addend] ((X in Re) & (Y in Re) & (X R_GE R_0)) imp ((X R_PLUS Y) R_GE Y)<P>
(862) Theorem 711: [The sum of non-negative reals is zero only if the addends are zero] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & (X R_PLUS Y = R_0)) imp ((X = R_0) & (Y = R_0))<P>
(863) Theorem 712: [The reciprocal is monotone decreasing for positive reals] ((X in Re) & (Y in Re) & (X R_GT Y) & (Y R_GT R_0)) imp (R_Recip(Y) R_GT R_Recip(X))<P>
(864) Theorem 713: [Two non-null reals are equal iff their reciprocals are equal] ((X in Re) & (X /= R_0) & (Y in Re) & (Y /= R_0) & (R_Recip(X) = R_Recip(Y))) imp (X = Y)<P>
(865) Theorem 714: [The square of any real is non-negative] (X in Re) imp R_is_nonneg(X R_TIMES X)<P>
(865+) Theorem 715: [Monotonicity of squaring] ((X in Re) & (Y in Re) & (X R_GE R_0) & (Y R_GE R_0)) imp ((X R_GE Y) eq ((X R_TIMES X) R_GE (Y R_TIMES Y)))<P>
(866) Theorem 716: [Properties of the real number 2] ((R_1 R_PLUS R_1) in Re) & ((R_1 R_PLUS R_1) R_GT R_0) & (R_Recip(R_1 R_PLUS R_1) in Re) & (R_Recip(R_1 R_PLUS R_1) /= R_0) & ((X in Re) imp ((X R_OVER (R_1 R_PLUS R_1)) in Re))<P>
(867) Theorem 717: [Any real number can be divided into two equal halves] (X in Re) imp (X = (X R_OVER (R_1 R_PLUS R_1)) R_PLUS (X R_OVER (R_1 R_PLUS R_1)))<P>
(868) Theorem 718: [The average of two real numbers lies between them] ((X in Re) & (Y in Re) & (X R_GT Y)) imp ((X R_GT ((X R_PLUS Y) R_OVER (R_1 R_PLUS R_1))) & (((X R_PLUS Y) R_OVER (R_1 R_PLUS R_1)) R_GT Y))<P>
(869) Theorem 719: [Every positive real exceeds the sum of two smaller positive reals] ((X in Re) & (X R_GT R_0)) imp (EXISTS e in Re , e0 in Re | (X R_GT e) & (e R_GT e0) & (e0 R_GT R_0) & (e R_GT R_0) & (X R_GT (e R_PLUS e0)))<P>
(870) Theorem 720: [Every positive real exceeds some smaller positive real] ((X in Re) & (X R_GT R_0)) imp (EXISTS e in Re | (X R_GT e) & (e R_GT R_0))<P>
(871) Theorem 721: [Trigger for Otter theory 'orderedGroups'] (R_0 in Re) &	(FORALL x,y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) in Re)) &	(FORALL x | (x in Re) imp (R_Rev(x) in Re)) &	(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) imp (((x R_PLUS y) R_PLUS z) = (x R_PLUS (y R_PLUS z)))) &	(FORALL x | (x in Re) imp ((x R_PLUS R_0) = x)) &	(FORALL x | (x in Re) imp ((x R_PLUS R_Rev(x)) = R_0)) &	(FORALL x,y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) = (y R_PLUS x))) &	(FORALL x,y | ((x in Re) & (y in Re)) imp ((R_is_nonneg(x) & R_is_nonneg(y)) imp R_is_nonneg(x R_PLUS y))) &	(FORALL x | (x in Re) imp (R_is_nonneg(x) or R_is_nonneg(R_Rev(x)))) &	(FORALL x | (x in Re) imp ((R_is_nonneg(x) & R_is_nonneg(R_Rev(x))) imp (x = R_0))) &	(FORALL x,y | ((x in Re) & (y in Re)) imp ((x R_LE y) eq R_is_nonneg(y R_PLUS R_Rev(x))))<P>
(872) Theorem 722: [Basic properties of the absolute value function] (FORALL x | abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if) &	(FORALL x | (x in Re) imp (x R_LE abs(x))) &	(FORALL x | (x in Re) imp (abs(abs(x)) = abs(x))) &	(FORALL x | (x in Re) imp ((abs(x) = R_0) eq (x = R_0))) &	(FORALL x | (x in Re) imp (abs(R_Rev(x)) = abs(x))) &	(FORALL x,y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) R_LE (abs(x) R_PLUS abs(y)))) &	(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) imp ((abs(x R_PLUS R_Rev(y)) R_LE z) imp (y R_LE (x R_PLUS z)))) &	(FORALL x,y | ((x in Re) & (y in Re)) imp (abs(x R_PLUS y) R_LE (abs(x) R_PLUS abs(y)))) &	(FORALL x,y | ((x in Re) & (y in Re)) imp ((not(R_is_nonneg(x))) imp ((x R_LE abs(y)) & (x /= abs(y))))) &	(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) imp (abs((x R_PLUS R_Rev(z))) R_LE (abs(x R_PLUS R_Rev(y)) R_PLUS abs(y R_PLUS R_Rev(z))))) &	(FORALL x,y | ((x in Re) & (y in Re)) imp (abs(abs(x) R_PLUS R_Rev(abs(y))) R_LE abs(x R_PLUS R_Rev(y)))) &	(FORALL x,y | ((x in Re) & (y in Re)) imp (abs(x) R_PLUS R_Rev(abs(abs(y) R_PLUS R_Rev(abs(x)))) R_LE abs(y)))<P>
(873) Theorem 723: [The absolute value of $x$ is a non-negative real no smaller than $x$] (X in Re) imp ((abs(X) in Re) & (abs(X) R_GE R_0) & (abs(X) R_GE X) & (R_is_nonneg(abs(X))))<P>
(874) Theorem 724: [The absolute value of $x$ is whichever of $x$ and $-x$ is non-negative] (X in Re) imp (abs(X) = if R_is_nonneg(X) then X else R_Rev(X) end if)<P>
(875) Theorem 725: [The absolute value of $x$ is whichever of $x$ and $-x$ is non-negative, 2] (X in Re) imp (abs(X) = if R_is_nonneg(R_Rev(X)) then R_Rev(X) else X end if)<P>
(876) Theorem 726: [The absolute value of a real product is the product of absolute values] ((X in Re) & (Y in Re)) imp (abs(X R_TIMES Y) = (abs(X) R_TIMES abs(Y)))<P>
(877) Theorem 727: [$x$ and $-x$ have the same absolute value] (X in Re) imp (abs(X) = abs(R_Rev(X)))<P>
(878) Theorem 728: [Monotonicity of addition, 2] ((X in Re) & (Y in Re) & R_is_nonneg(R_Rev(Y))) imp ((X R_GT (X R_PLUS Y)) or (X = (X R_PLUS Y)))<P>
(879) Theorem 729: ((X in Re) & (Y in Re) & R_is_nonneg(X) & (not R_is_nonneg(Y))) imp		((X R_GE abs(X R_PLUS Y)) or (R_Rev(Y) R_GE abs(X R_PLUS Y)))<P>
(880) Theorem 730: ((X in Re) & (Y in Re)) imp (((X R_PLUS abs(Y)) R_GE X))<P>
(881) Theorem 731: ((X in Re) & (Y in Re)) imp (((abs(X) R_PLUS abs(Y)) R_GT abs(X R_PLUS Y)) or ((abs(X) R_PLUS abs(Y)) = abs(X R_PLUS Y)))<P>
(882) Theorem 732: [The absolute value of a real quotient is the quotient of absolute values]  ((X in Re) & (Y in Re) & (Y /= R_0)) imp ((abs(X) R_OVER abs(Y)) = abs(X R_OVER Y))<P>
(883) Theorem 733: (X in Ra) imp (Ra_is_nonneg(X) eq Ra_eqseq(Za PROD {Ra_ABS(X)},Za PROD {X}))<P>
(884) Theorem 734: (X in Ra) imp (R_is_nonneg(Cauchy_to_Re(Za PROD {X})) eq (ReRa(Ra_ABS(X)) = ReRa(X)))<P>
(885) Theorem 735: [The embedding of rationals into reals preserves all elementary algebraic operations, 1]  (Y in Ra) imp ((ReRa(Y) in Re) &	(ReRa(Ra_Rev(Y)) = R_Rev(ReRa(Y))) &	(R_is_nonneg(ReRa(Y)) eq Ra_is_nonneg(Y)) &	(ReRa(Ra_ABS(Y)) = abs(ReRa(Y))))<P>
(886) Theorem 736: [The embedding of rationals into reals preserves all elementary algebraic operations, 2]  ((X in Ra) & (Y in Ra)) imp ((ReRa(X) in Re) & (ReRa(Y) in Re) &	(ReRa(X Ra_PLUS Y) = ReRa(X) R_PLUS ReRa(Y)) &	(ReRa(X Ra_TIMES Y) = ReRa(X) R_TIMES ReRa(Y)))<P>
(887) Theorem 737: [The embedding of rationals into reals preserves all elementary algebraic operations, 3]  ((X in Ra) & (Y in Ra)) imp			(ReRa(X Ra_MINUS Y) = (ReRa(X) R_MINUS ReRa(Y)))<P>
(888) Theorem 738: [The embedding of rationals into reals is 1-1]  ((X in Ra) & (Y in Ra)) imp ((ReRa(X) = ReRa(Y)) eq (X = Y))<P>
(889) Theorem 739: [The embedding of rationals into reals preserves 0 and 1]  (ReRa(Ra_0) = R_0) & (ReRa(Ra_1) = R_1)<P>
(890) Theorem 740: [The embedding of rationals into reals preserves quotients by nonzero quantities]  ((X in Ra) & (Y in Ra) & (Y /= Ra_0)) imp			((R_Recip(ReRa(Y)) = ReRa(Recip(Y))) &			((ReRa(X) R_OVER ReRa(Y)) = ReRa(X Ra_OVER Y)))<P>
(891) Theorem 741: [The embedding of rationals into reals preserves ordering]  ((X in Ra) & (Y in Ra)) imp (((ReRa(X) R_GE ReRa(Y)) eq (X Ra_GE Y)) &		((ReRa(X) R_GT ReRa(Y)) eq (X Ra_GT Y)) &		((ReRa(Y) R_LE ReRa(X)) eq (Y Ra_LE X)) &		((ReRa(Y) R_LT ReRa(X)) eq (Y Ra_LT X)))<P>
(892) Theorem 742: [The images of rationals via the embedding form a dense subset of the reals, 1] ((X in Re) & (Eps in Ra) & (Eps Ra_GT Ra_0)) imp (EXISTS y in Ra | Finite({m in Za | Ra_ABS(((arb(X))~[m]) Ra_MINUS y) Ra_GE Eps}) )<P>
(893) Theorem 743: [The embedding of signed integers into rationals preserves all elementary algebraic operations, 1]  (X in Si) imp ((RaSi(X) in Ra) &	(Ra_is_nonneg(RaSi(X)) eq is_nonneg(X)) & (RaSi(S_Rev(X)) = Ra_Rev(RaSi(X))) & (RaSi(S_ABS(X)) = Ra_ABS(RaSi(X))))<P>
(894) Theorem 744: [The embedding of signed integers into rationals preserves all elementary algebraic operations, 2]  ((X in Si) & (Y in Si)) imp ((RaSi(X) in Ra) & (RaSi(Y) in Ra) &	(RaSi(X S_PLUS Y) = RaSi(X) Ra_PLUS RaSi(Y)) &	(RaSi(X S_TIMES Y) = RaSi(X) Ra_TIMES RaSi(Y)))<P>
(895) Theorem 745: [The embedding of signed integers into rationals preserves all elementary algebraic operations, 3]  ((X in Si) & (Y in Si)) imp	(RaSi(X S_MINUS Y) = RaSi(X) Ra_MINUS RaSi(Y))<P>
(896) Theorem 746: [The embedding of signed integers into rationals is 1-1]  ((X in Si) & (Y in Si)) imp ((RaSi(X) = RaSi(Y)) eq (X = Y))<P>
(897) Theorem 747: [The embedding of signed integers into rationals preserves 0 and 1]  RaSi([0,0]) = Ra_0 & RaSi([1,0]) = Ra_1<P>
(897+) Theorem 748: [The embedding of signed integers into rationals preserves ordering]  ((X in Si) & (Y in Si)) imp (((RaSi(X) Ra_GE RaSi(Y)) eq (X S_GE Y)) &			((RaSi(X) Ra_GT RaSi(Y)) eq (X S_GT Y)) &			((RaSi(Y) Ra_LE RaSi(X)) eq (Y S_LE X)) &			((RaSi(Y) Ra_LT RaSi(X)) eq (Y S_LT X)))<P>
(898) Theorem 749: [The embedding of integers into signed integers preserves all elementary algebraic operations on integers]  ((X in Za) & (Y in Za)) imp ((SiZa(X) in Si) & (SiZa(Y) in Si) &	(SiZa(X PLUS Y) = SiZa(X) S_PLUS SiZa(Y)) &	(SiZa(X TIMES Y) = SiZa(X) S_TIMES SiZa(Y)))<P>
(899) Theorem 750: [The embedding of integers into signed integers is 1-1]  ((X in Za) & (Y in Za) & (SiZa(X) = SiZa(Y))) imp (X = Y)<P>
(900) Theorem 751: [The embedding of integers into signed integers preserves 0 and 1]  (SiZa(0) = [0,0]) & (SiZa(1) = [1,0])<P>
(901) Theorem 752: [The embedding of integers into signed integers preserves ordering]  ((X in Za) & (Y in Za)) imp (((SiZa(X) S_GE SiZa(Y)) eq (X incs Y)) &			((SiZa(X) S_GT SiZa(Y)) eq (Y in X)) &			((SiZa(Y) S_LE SiZa(X)) eq (Y incin X)) &			((SiZa(Y) S_LT SiZa(X)) eq (Y in X)))<P>
(902) Theorem 753: [Elementary properties of the real absolute value]  ((X in Re) & (Y in Re)) imp ((abs(X) in Re) & (abs(Y) in Re) &			(abs(X R_TIMES Y) = (abs(X) R_TIMES abs(Y))) & ((abs(X) R_PLUS abs(Y)) R_GE abs(X R_PLUS Y) & (abs(R_Rev(X)) = abs(X))))<P>
(903) Theorem 754: [Every real Cauchy sequence is a real sequence] ReCauchy incin ReSeq<P>
(904) Theorem 755: [The range of a real sequence is included in the set of reals] (F in ReSeq) imp ((domain(F) = Za) & Svm(F) & (range(F) incin Re) & ((X in Za) imp (F~[X] in Re)))<P>
(905) Theorem 756: ({F,G} incin ReSeq) imp	(((F Res_PLUS G) in ReSeq) &		(Res_ABS(G) in ReSeq) &		(Res_Rev(G) in ReSeq) &		((F Res_TIMES G) in ReSeq) &		((F Res_PLUS G) = {[u,((F~[u]) R_PLUS  (G~[u]))]: u in Za}) &		(Res_ABS(G) = {[u,abs(G~[u])]: u in Za}) &		(Res_Rev(G) = {[u,R_Rev(G~[u])]: u in Za}) &		((F Res_TIMES G) = {[u,((F~[u]) R_TIMES (G~[u]))]: u in Za}))<P>
(906) Theorem 757: (({F1,G1} incin ReSeq) & (N in Za)) imp ((F1~[N] in Re) & (G1~[N] in Re) &		((F1 Res_PLUS G1 in ReSeq) & ((F1 Res_PLUS G1)~[N] = (F1~[N]) R_PLUS (G1~[N]))) &		(((Res_ABS(G1) in ReSeq) & (Res_ABS(G1)~[N] = abs(G1~[N])))) &		(((Res_Rev(G1) in ReSeq) & (Res_Rev(G1)~[N] = R_Rev(G1~[N])))) &		(((F1 Res_TIMES G1 in ReSeq) & (F1 Res_TIMES G1)~[N] = ((F1~[N]) R_TIMES (G1~[N])))))<P>
(907) Theorem 758: ({F,G} incin ReCauchy) imp	(((F Res_PLUS G) in ReCauchy) & (Res_ABS(F) in ReCauchy) & (Res_Rev(F) in ReCauchy))<P>
(908) Theorem 759: ((Eps in Re) & (Eps R_GT R_0) & (F in ReCauchy)) imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (not (abs((F~[i]) R_MINUS (F~[j]))) R_GT Eps)))<P>
(909) Theorem 760: ((Eps in Re) & (Eps R_GT R_0) & (F in ReCauchy)) imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (Eps R_GT (abs((F~[i]) R_MINUS (F~[j])))) ))<P>
(910) Theorem 761: ((S incin Re) & Finite(S)) imp (EXISTS u in Re | (FORALL y in S | u R_GE y))<P>
(911) Theorem 762: [Every real Cauchy sequence has an upper bound] (F in ReCauchy) imp (EXISTS x in Re | (FORALL y in range(F) | y R_LE x))<P>
(912) Theorem 763: (F in ReCauchy) imp (EXISTS x in Re | (FORALL y in range(F) | abs(y) R_LT x ))<P>
(913) Theorem 764: ({F,G} incin ReCauchy) imp (((F Res_MINUS G) in ReCauchy) & ((F Res_TIMES G) in ReCauchy))<P>
(914) Theorem 765: [Every real Cauchy sequence can be approximated by a rational sequence] (F in ReCauchy) imp (0 /= {g in RaCauchy | Ra_apseq(F,g)})<P>
(915) Theorem 766: [Every real Cauchy sequence has a real limit] (F in ReCauchy) imp ((Ra_approx(F) in RaCauchy) & (Ra_approx(F) in RaSeq) & Ra_apseq(F,Ra_approx(F)) & (limit(F) in Re))<P>
(916) Theorem 767: [The limit of a real Cauchy sequence is the real defined by any of its rational approximations] ((F in ReCauchy) & (G in RaSeq) & Ra_apseq(F,G)) imp ((G in RaCauchy) & (Cauchy_to_Re(G) = limit(F)))<P>
(917) Theorem 768: [The elementary operations on reals map Cauchy sequences into Cauchy sequences] ((F in ReCauchy) & (G in ReCauchy) & (Fp in RaCauchy) & (Gp in RaCauchy) & Ra_apseq(F,Fp) & Ra_apseq(G,Gp)) imp			((((F Res_PLUS G in ReCauchy) & Ra_apseq(F Res_PLUS G,Fp Ras_PLUS Gp))) &			(((F Res_MINUS G in ReCauchy) & Ra_apseq(F Res_MINUS G,Fp Ras_MINUS Gp))) &			(((F Res_TIMES G in ReCauchy) & Ra_apseq(F Res_TIMES G,Fp Ras_TIMES Gp))))<P>
(918) Theorem 769: [The limit of a sum is the sum of limits] ((F in ReCauchy) & (G in ReCauchy)) imp (limit(F Res_PLUS G) = (limit(F) R_PLUS limit(G)))<P>
(919) Theorem 770: [The limit of a difference is the difference of limits] ((F in ReCauchy) & (G in ReCauchy)) imp (limit(F Res_MINUS G) = limit(F) R_MINUS limit(G))<P>
(920) Theorem 771: [The limit of a product is the product of limits] ((F in ReCauchy) & (G in ReCauchy)) imp (limit(F Res_TIMES G) = limit(F) R_TIMES limit(G))<P>
(921) Theorem 772: [The limit of a quotient is the quotient of limits, provided that the denominator limit  is non-zero] ((F in ReCauchy) & (G in ReCauchy) & (limit(G) /= R_0)) imp (limit(F Res_OVER G) = limit(F) R_OVER limit(G))<P>
(922) Theorem 773: [Any real $x$ is included between two rationals which can be arbitrarily close together] ((X in Re) & (EPS in Re) & (EPS R_GT R_0)) imp (EXISTS r1 in Ra, r2 in Ra | ((ReRa(r1) R_GT X) & (X R_GT ReRa(r2)) & (ReRa(r1 Ra_MINUS r2) R_LE EPS)))<P>
(923) Theorem 774: [For any real $x$, there exists a rational $r$ such that $r >= x$] (X in Re) imp (EXISTS r in Ra | ReRa(r) R_GT X)<P>
(924) Theorem 775: [Any rational $r$ is the quotient of two signed integers, of which the second is positive] (x in Ra) imp (EXISTS m in Si, n in Si | ((n S_GE [1,0]) & (x = RaSi(m) Ra_OVER RaSi(n))))<P>
(925) Theorem 776: [For any rational $r$, there exists an integer $n$ such that $n >= r$] (R in Ra) imp (EXISTS n in Za | RaSi(SiZa(n)) Ra_GE R)<P>
(926) Theorem 777: [For any real $x$, there exists an integer $n$ such that $n > x$] (X in Re) imp (EXISTS n in Za | ReRa(RaSi(SiZa(n))) R_GT X)<P>
(927) Theorem 778: [For any real $x$ and $eps > 0$, there exists an integer $n$ such that $n  eps > x$] ((X in Re) & (Eps in Re) & (Eps R_GT R_0)) imp (EXISTS n in Za | ((ReRa(RaSi(SiZa(n))) R_TIMES Eps) R_GT X))<P>
(928) Theorem 779: [For any real $x$ and $eps > 0$, there exists an integer $n$ such that $eps > x/n$] ((X in Re) & (Eps in Re) & (Eps R_GT R_0)) imp (EXISTS n in Za | (Eps R_GT (X R_OVER ReRa(RaSi(SiZa(n))))))<P>
(929) Theorem 780: [For any non-negative real $x$ and $eps > 0$, there exists an integer $n$ such that $n R_TIMES eps > x$ and $(n - 1)  eps <= x$] ((X in Re) & (Eps in Re) & (Eps R_GT R_0)) imp (EXISTS n in Za | (Eps R_GT (X R_OVER ReRa(RaSi(SiZa(n))))))<P>
(930) Theorem 781: [Every positive real is bounded below by a rational fraction of the form $1/n$]  ((X in Re) & (X R_GT R_0)) imp (EXISTS n in Za | (R_1 R_OVER ReRa(RaSi(SiZa(n)))) R_LT X)<P>
(931) Theorem 782: [Every real Cauchy sequence is approximated by a rational Cauchy sequence] (F in ReCauchy) imp (EXISTS g in RaCauchy | Ra_apseq(F,g))<P>
(932) Theorem 783: [Any two approximating rational sequences for a given real Cauchy sequence are equivalent]  ((F in ReCauchy) & Ra_apseq(F,G) & Ra_apseq(F,GP)) imp ((G in RaCauchy) & (GP in RaCauchy) & (Cauchy_to_Re(G) = Cauchy_to_Re(GP)))<P>
(933) Theorem 784: [For any non-empty set $s$ of reals which is bounded above, and for any positive real $eps$, there exists an $u in s$ such that $u + eps$ is an upper bound of $s$] ((S incin Re) & (S /= 0) & (Eps in Re) & (Eps R_GT R_0) & (Y in Re) & (FORALL x in S | Y R_GE x)) imp (EXISTS u in S | (FORALL x in S | u R_GE x))<P>
(934) Theorem 785: [Any bounded set of reals has a least upper bound] ((S incin Re) & (S /= 0) & (EXISTS y in Re | (FORALL x in S | y R_GE x))) imp (EXISTS u in Re | ((FORALL x in S | u R_GE x) & (FORALL v in Re | (v R_LT u imp (not (FORALL x in s | v R_GE x))))))<P>
(935) 	Theorem 786: (FORALL s, t | Finite(s) imp (ToThe1(s,t) = if (s = 0) then R_1 else (ToThe1(s - {arb(s)},t) R_TIMES t) end if))<P>
(936) Theorem 787: ((N in Za) & (X in Re)) imp (X ToThe N = if (N = 0) then R_1 else X R_TIMES (X ToThe (N - 1)) end if)<P>
(937) Theorem 788: (X in Re) imp ((X ToThe 0 = R_0) & (X ToThe 1 = X) & (((M in Za) & (N in Za)) imp (X ToThe (M PLUS N) = (X ToThe M) R_TIMES (X ToThe N))))<P>
(938) Theorem 789: ((X in Re) & (M in Za) & (N in Za)) imp (((X ToThe M) ToThe N) = (X ToThe (M TIMES N)))<P>
(939) Theorem 790: (R_SIGMA(0) = R_0) &	(FORALL x in OM | (cdr(x) in Re) imp (R_SIGMA({x}) = cdr(x))) &	(FORALL f in OM | (Finite(f) & (range(f) incin Re)) imp (R_SIGMA(f) in Re)) &	(FORALL f in OM, c in f | (Finite(f) & (range(f) incin Re)) imp (R_SIGMA(f) = R_SIGMA(f - {c}) R_PLUS cdr(c))) &	(FORALL f in OM | (Finite(f) & Is_map(f) & (range(f) incin Re)) imp	(FORALL t | R_SIGMA(f) = R_SIGMA(f ON (domain(f) * t)) R_PLUS R_SIGMA(f ON (domain(f) - t)))) &	(FORALL f in OM, g | (Finite(f) & Svm(f) & Svm(g) & (domain(f) = domain(g)) & (range(f) incin Re)) imp		(R_SIGMA(f) = R_SIGMA({[y,R_SIGMA(f ON (g INV_IM {y}))]: y in range(g)}))) &	(FORALL f in OM, g | (Finite(f) & Svm(f) & one_1_map(g) & (domain(f) = domain(g)) & (range(f) incin Re)) imp		(R_SIGMA(f) = R_SIGMA({[y,f~[inv(g)~[y]]]: y in range(g)})))<P>
(940) Theorem 791: (R_SIGMA(0) = R_0) &	((cdr(X) in Re) imp (R_SIGMA({X}) = cdr(X))) &	((Finite(F) & (range(F) incin Re)) imp (R_SIGMA(F) in Re)) &	((Finite(F) & (range(F) incin Re)) imp (R_SIGMA(F) = R_SIGMA(F - {c}) R_PLUS cdr(c))) &	((Finite(F) & Is_map(F) & (range(F) incin Re)) imp		R_SIGMA(F) = R_SIGMA(F ON (domain(F) * T)) R_PLUS R_SIGMA(F ON (domain(F) - T))) &	((Finite(F) & Svm(F) & Svm(G) & (domain(F) = domain(G)) & (range(F) incin Re)) imp		(R_SIGMA(F) = R_SIGMA({[y,R_SIGMA(F ON (G INV_IM {y}))]: y in range(G)}))) &	((Finite(F) & Svm(F) & one_1_map(G) & (domain(F) = domain(G)) & (range(F) incin Re)) imp		(R_SIGMA(F) = R_SIGMA({[y,F~[inv(G)~[y]]]: y in range(G)})))<P>
(941) Theorem 792: ((F in Fin_Seqs(Re)) & (G in Fin_Seqs(Re)) & (X in Re)) imp (((Polval(F,X) R_PLUS Polval(G,X)) = Polval(F PolPlus G,X)) & ((Polval(F,X) R_MINUS Polval(G,X)) = Polval(F PolMinus G,X)) & ((Polval(F,X) R_TIMES Polval(G,X)) = Polval(F PolTimes G,X)))<P>
(942) Theorem 793: ((F in Fin_Seqs(Re)) & (G in Fin_Seqs(Re))) imp (((PolFcn(F) F_PLUS PolFcn(G)) = PolFcn(F PolPlus G)) & ((PolFcn(F) F_MINUS PolFcn(G)) = PolFcn(F PolMinus G)) & ((PolFcn(F) F_TIMES PolFcn(G)) = PolFcn(F PolTimes G)))<P>
(943) Theorem 794: [Continuous functions map limits into limits] (Cf_RR(F,S) & (G in ReCauchy) & (range(G) incin S)) imp ((F @ G in ReCauchy) & (limit(F @ G) = F~[limit(G)]))<P>
(944) Theorem 795: [The pointwise sum and product of two real continuous functions on two sets is continuous on their intersection] (Cf_RR(F,S) & Cf_RR(G,S2)) imp (Cf_RR(F Res_PLUS G,S * S2) & Cf_RR(F Res_TIMES G,S * S2))<P>
(945) Theorem 796: [The quotient of two real continuous functions on two sets is continuous on the set of points in their intersection at which the denominator is nonzero] (Cf_RR(F,S) & Cf_RR(G,S2)) imp Cf_RR(F Res_OVER G,{x in S * S2 | G~[x] /= R_0})<P>
(946) Theorem 797: [The composition of two real continuous functions is continuous.] (Cf_RR(F,S) & Cf_RR(G,T) & (range(G ON T) incin S)) imp Cf_RR(F @ G,T)<P>
(947) Theorem 798: [Polynomial functions are continuous everywhere] (F in Fin_Seqs(Re)) imp Cf_RR(PolFcn(F),Re)<P>
(948) Theorem 799: [Polynomial quotients are continuous wherever their denominator is nonzero] ((F in Fin_Seqs(Re)) & (G in Fin_Seqs(Re))) imp Cf_RR(F F_OVER G,{x in Re | G~[x] /= R_0})<P>
(949) Theorem 800: [Crossing-completness principle for the real numbers] ((Cf_RR(F,I(X,Y)) & (X in Re) & (Y in Re) & (R_0 R_GE F~[X]) & (R_0 R_LE F~[Y]) & (X R_LE Y)) imp (EXISTS v | ((X R_LE v) & (v R_LE Y) & (F~[v] = R_0))))<P>
(950) Theorem 801: (Cf_RR(F,S) & BoundedClosedRe(S)) imp (EXISTS u in S | (FORALL v in S | F~[u] R_GE F~[v]))<P>
(951) Theorem 802: (Cf_RR(F,S) & BoundedClosedRe(S)) imp (EXISTS u in I(X,Y) | (FORALL v in S | F~[u] R_LE F~[v]))<P>
(952) Theorem 803: (Cf_RR(F,I(X,Y)) & (X in Re) & (Y in Re)) imp (EXISTS u in I(X,Y), v in  I(X,Y) | range(F ON I(X,Y)) = I(f~[u],f~[v]))<P>
(953) Theorem 804: (BoundedClosedRe(S) & (S incin Un({OI(car(ends),cdr(ends)): ends in T})) & (FORALL ends in T | ends in (Re PROD Re))) imp (EXISTS t1 | (t1 incin T) & Finite(t1) & (S incin Un({OI(car(ends),cdr(ends)): ends in t1})))<P>
(954) Theorem 805: [Square of binomials] ((X in Re) & (Y in Re)) imp ( ((X R_PLUS Y) R_TIMES (X R_PLUS Y)) = ((X R_TIMES X) R_PLUS (Y R_TIMES Y)) R_PLUS ((X R_TIMES Y) R_PLUS (X R_TIMES Y)) )<P>
(955) Theorem 806: [Square of binomials, 2] ((X in Re) & (Y in Re)) imp ( ((X R_MINUS Y) R_TIMES (X R_MINUS Y)) = ((X R_TIMES X) R_PLUS (Y R_TIMES Y)) R_MINUS ((X R_TIMES Y) R_PLUS (X R_TIMES Y)) )<P>
(956) Theorem 807: [Noticeable product of binomials] ((X in Re) & (Y in Re)) imp (((X R_MINUS Y) R_TIMES (X R_PLUS Y)) = ((X R_TIMES X) R_MINUS (Y R_TIMES Y)))<P>
(957) Theorem 808: [The square of the square root of any positive $x$ is $x$] ((X in Re) & (R_is_nonneg(X))) imp ((sqrt(X) in Re) & (R_is_nonneg(sqrt(X))) & ((sqrt(X) R_TIMES sqrt(X)) = X))<P>
(958) Theorem 809: [The positive square root is unique] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & ((Y R_TIMES Y) = X)) imp (Y = sqrt(X))<P>
(959) Theorem 810: [The square root is monotone increasing for positive numbers] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & (X R_GT Y)) imp (sqrt(X) R_GT sqrt(Y))<P>
(960) Theorem 811: [The square root of a product is the product of the square roots] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) imp (sqrt(X R_TIMES Y) = (sqrt(X) R_TIMES sqrt(Y)))<P>
(961) Theorem 812: [The square of the square root of any real $w=(x R_TIMES x) R_PLUS (y R_TIMES y)$ is $w$] ((X in Re) & (Y in Re)) imp (sqrt((X R_TIMES X) R_PLUS (Y R_TIMES Y)) R_TIMES sqrt((X R_TIMES X) R_PLUS (Y R_TIMES Y)) = ((X R_TIMES X) R_PLUS (Y R_TIMES Y)))<P>
(961+) Theorem 813: ((N in Si) & (M in Si) & (M /= [0,0]) & is_nonneg(M)) imp	(EXISTS k in Si | is_nonneg(N S_MINUS (k S_TIMES M)) & is_nonneg(((k S_PLUS [1,0])S_TIMES M)) S_MINUS N)<P>
(962) Theorem 814: ((N in Re) & (M in Re)) imp (((abs(N) R_PLUS abs(M)) R_GT abs(N R_MINUS M)) or ((abs(N) R_PLUS abs(M)) = abs(N R_MINUS M)))<P>
(963) Theorem 815: ((X in Re) & (Y in Re)) imp ([X,Y] in Cm)<P>
(964) Theorem 816: (M in Cm) eq ((M = [car(M),cdr(M)]) & (car(M) in Re) & (cdr(M) in Re))<P>
(965) Theorem 817: (C_0 in Cm) & (C_1 in Cm)<P>
(966) Theorem 818: ((N in Cm) & (M in Cm)) imp ((N C_PLUS M in Cm) & (N C_TIMES M in Cm))<P>
(967) Theorem 819: ((N in Cm) & (M in Cm)) imp (N C_PLUS M = M C_PLUS N)<P>
(968) Theorem 820: (N in Cm) imp ((N = N C_PLUS C_0) & (N = C_0 C_PLUS  N))<P>
(969) Theorem 821: (N in Cm) imp ((C_Rev(N) in Cm) & (C_Rev(C_Rev(N)) = N))<P>
(970) Theorem 822: (N in Cm) imp (C_Rev(N) C_PLUS N = C_0)<P>
(971) Theorem 823: ((N in Cm) & (M in Cm)) imp (N = M C_PLUS (N C_MINUS M))<P>
(972) Theorem 824: ((N in Cm) & (M in Cm)) imp (N C_TIMES M = M C_TIMES N)<P>
(973) Theorem 825: (N in Cm) imp ((C_abs(N) in Re) & R_is_nonneg(C_abs(N)))<P>
(974) Theorem 826: (N in Cm) imp (C_abs(N) = C_abs(C_Rev(N)))<P>
(975) Theorem 827: ((N in Cm) & (M in Cm)) imp	(((C_abs(N) R_PLUS C_abs(M)) R_GT C_abs(N C_PLUS M)) or (C_abs(N) R_PLUS C_abs(M) = C_abs(N C_PLUS M)))<P>
(976) Theorem 828: ((N in Cm) & (M in Cm)) imp    (((C_abs(N) R_PLUS C_abs(M)) R_GT C_abs(N C_MINUS M)) or (C_abs(N) R_PLUS C_abs(M) = C_abs(N C_MINUS M)))<P>
(977) Theorem 829: ((N in Cm) & (M in Cm)) imp (C_abs(N) R_TIMES C_abs(M) = C_abs(N C_TIMES M))<P>
(978) Theorem 830: ((N in Cm) & (M in Cm) & (M /= C_0)) imp (C_abs(N) R_OVER C_abs(M) = C_abs(N C_OVER M))<P>
(979) Theorem 831: ((K in Cm) & (N in Cm) & (M in Cm)) imp (N C_PLUS (M C_PLUS K) = (N C_PLUS M) C_PLUS K)<P>
(980) Theorem 832: ((K in Cm) & (N in Cm) & (M in Cm)) imp ((N C_TIMES (M C_TIMES K)) = ((N C_TIMES M) C_TIMES K))<P>
(981) Theorem 833: ((K in Cm) & (N in Cm) & (M in Cm)) imp ((N C_TIMES (M C_PLUS K)) = ((N C_TIMES M) C_PLUS (N C_TIMES K)))<P>
(982) Theorem 834: (M in Cm) imp ((M = (M C_TIMES C_1)) & (M = (C_1 C_TIMES M)))<P>
(983) Theorem 835: ((M in Cm) & (M /= C_0)) imp ((C_Recip(M) in Cm) & ((M C_TIMES C_Recip(M)) = C_1))<P>
(984) Theorem 836: ((N in Cm) & (M in Cm) & (M /= C_0)) imp (N = M C_TIMES (N C_OVER M))<P>
(985) Theorem 837: (R_0 in Re) & (FORALL x | (x in Re) imp ((x R_PLUS R_0) = x)) &	(FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) = (y R_PLUS x))) &	(FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) in Re)) &	(FORALL x, y, z | ((x in Re) & (y in Re) & (z in Re)) imp (((x R_PLUS y) R_PLUS z) = (x R_PLUS (y R_PLUS z))))<P>
(986) Theorem real_sigma0: (Sig(0) = R_0) &    (FORALL x | (cdr(x) in Re) imp (Sig({x}) = cdr(x))) &	(FORALL f | (Finite(f) & (range(f) incin Re)) imp (Sig(f) in Re)) &	(FORALL c,f | ((c in f) & Finite(f) & (range(f) incin Re)) imp (Sig(f) = Sig(f - {c}) R_PLUS cdr(c))) &	(FORALL f,t | (Finite(f) & Is_map(f) & (range(f) incin Re)) imp (Sig(f) = (Sig(f ON (domain(f) * t)) R_PLUS Sig(f ON (domain(f) - t)))))<P>
(987) Theorem real_sigma: (Svm(F) & (range(F) incin Re) & Finite(F)) imp	((Sig(F) in Re) & ((P in F) imp (Sig({P}) = (F~[car(P)]))) &	 (Sig(F) = (Sig(F ON (domain(F) * A)) R_PLUS Sig(F ON (domain(F) - A)))))<P>
(988) Theorem 838: (RF_0 in RF)<P>
(989) Theorem 839: (N in RF) imp ((N F_PLUS RF_0) = N)<P>
(990) Theorem 840: ((N in RF) & (M in RF)) imp ((N F_PLUS M) = (M F_PLUS N))<P>
(991) Theorem 841: ((N in RF) & (M in RF)) imp ((N F_PLUS M) in RF)<P>
(992) Theorem 842: ((N in RF) & (M in RF)) imp (N F_TIMES M = M F_TIMES N)<P>
(993) Theorem 843: ((N in RF) & (M in RF) & (K in RF)) imp (N F_PLUS (M F_PLUS K) = (N F_PLUS M) F_PLUS K)<P>
(994) Theorem 844: ((K in RF) & (N in RF) & (M in RF)) imp (N F_TIMES (M F_TIMES K) = (N F_TIMES M) F_TIMES K)<P>
(995) Theorem 845: ((K in RF) & (N in RF) & (M in RF)) imp (N F_TIMES (M F_PLUS K) = (N F_TIMES M) F_PLUS (N F_TIMES K))<P>
(996) Theorem real_function_sigma: (FSig(0) = RF_0) &	(FORALL x | (cdr(x) in RF) imp (FSig({x}) = cdr(x))) &	(FORALL ser | (Finite(ser) & (range(ser) incin RF)) imp (FSig(ser) in RF)) &	(FORALL ser, a | (Finite(ser) & Is_map(ser) & (range(ser) incin RF)) imp			(FSig(ser) = (FSig(ser ON (domain(ser) * a)) F_PLUS FSig(ser ON (domain(ser) - a))))) &    (FORALL p, ser | ((p in ser) & Finite(ser) & (range(ser) incin RF)) imp			(FSig(ser) = FSig(ser - {p}) F_PLUS cdr(p)))<P>
(997) Theorem 846: [Cauchy integral theorem]    is_analytic_CF(F) imp (EXISTS eps in Re | (eps R_GT R_0) &	 (FORALL crv1, crv2 | (is_CD_curv(crv1,R_0,R_1) & is_CD_curv(crv2,R_0,R_1) &	 ((crv1~[R_0]) = (crv1~[R_1])) & ((crv2~[R_0]) = (crv2~[R_1])) &	 (FORALL x in Interval(R_0,R_1) | eps R_GE C_abs((crv1~[x]) C_MINUS (crv2~[x]))))	imp (Line_Int(F,crv1,R_0,R_1) = Line_Int(F,crv2,R_0,R_1)) ))<P>
(998) Theorem 847: [Cauchy integral formula]    (is_analytic_CF(F) & (domain(F) incs {w in Cm | C_abs(w) R_GE R_1})) imp	(FORALL w in Cm | (C_abs(w) R_GT R_1) imp ((F~[w]) = (Line_Int({[x,(F~[x]) C_OVER (x C_MINUS w)]: x in (Cm -{w})},		{[x,C_exp_fcn([R_0,x])]: x in Re}, R_0, pi R_PLUS pi) C_OVER ([R_0,pi R_PLUS pi])) ))<P>
(999) Theorem 848: (S = 0) eq (rk(S) = 0)<P>
(1000) Theorem 849: rk({X}) = next(rk(X))<P>
(1001) Theorem 850: rk(X + Y) = rk(X) + rk(Y)<P>
(1002) Theorem 851: rk({X,Y}) = next(rk(X)) + next(rk(Y))<P>
(1003) Theorem 852: ((X incin Y) imp (rk(X) incin rk(Y))) & ((X in Y) imp (rk(X) in rk(Y)))<P>
(1004) Theorem 853: rk(Un(X)) = Un({rk(y): y in X})<P>
(1005) Theorem 854: [The values of the rank function are ordinals] Ord(rk(X))<P>
(1006) Theorem 855: rk([X,Y]) = next(next(next(rk(X)))) + next(next(next(next(rk(Y)))))<P>
(1007) Theorem 856: [Every ordinal equals its own rank] Ord(X) imp (X = rk(X))<P>
(1008) Theorem 857: [iterated singleton formation produces increasing ranks] (rk(V) in rk(snglIter(0,V))) &	(((N in Za) & (M in Za) & (N in M)) imp (rk(snglIter(N,V)) in rk(snglIter(M,V))))<P>
(1009) Theorem 858: [the 0-th level of any cumulative structure equals the base] cumstr(B,0) = B<P>
(1010) Theorem 859: [The constructor of the cumulative structure is monotone non-decreasing] cumstr(B,X) incin cumstr(B,X + Y)<P>
(1011) Theorem 860: [The constructor of the cumulative structure inserts 0 at all levels but the first] (0 notin B) imp ((X /= 0) eq (0 in cumstr(B,X)))<P>
(1012) Theorem 861: [All subsets of each layer of a cumulative structure belong to its subsequent layers] ((Y in X) & (Z incin cumstr(B,Y))) imp (Z in cumstr(B,X))<P>
(1013) Theorem 862: [Quasi-transitivity of the layers of a cumulative structure] Ord(X) imp ((cumstr(B,X) - B) incin pow(cumstr(B,X)))<P>
(1013+) Theorem 863: [Transitivity of each layer in the von Neumann hierarchy] Ord(X) imp ((cumstr(0,X) incin pow(cumstr(0,X))) & (Un(cumstr(0,X)) incin cumstr(0,X)))<P>
(1014) Theorem 864: [closedness under dyadic union of the cumulative hierarchy $cumstr(B,Za)$] ((S in cumstr(B,Za) - B) & (T in cumstr(B,Za) - B)) imp ((S + T) in cumstr(B,Za))<P>
(1015) Theorem 865: [All sets of rank bounded by $X$ belong to $pow(cumstr(0,X))$] (rk(Y) incin X) imp (Y incin cumstr(0,X))<P>
(1016) Theorem 866: [The sets of rank bounded by $X$ form $pow(cumstr(0,X))$] Ord(X) imp ((rk(Y) incin X) eq (Y incin cumstr(0,X)))<P>
(1017) Theorem 867: [All sets of rank $X$ belong to $cumstr(0,next(X))-cumstr(0,X)$] (X = rk(Y)) imp (Y in (cumstr(0,next(X)) - cumstr(0,X)))<P>
(1018) Theorem 868: [The rank of sets in $cumstr(0,next(X))-cumstr(0,X)$ does not exceed $X$] (Ord(X) & (Y in (cumstr(0,next(X)) - cumstr(0,X)))) imp (rk(Y) incin X)<P>
(1019) Theorem 869: [The sets of rank $X$ form $cumstr(0,next(X))-cumstr(0,X)$] Ord(X) imp ((rk(Y) = X) eq (Y in (cumstr(0,next(X)) - cumstr(0,X))))<P>
(1020) Theorem 870: [Sets whose rank belongs to an ordinal are those in its level] Ord(X) imp ((rk(Y) in X) eq (Y in cumstr(0,X)))<P>
(1021) Theorem 871: Ord(X) imp (rk(cumstr(0,X)) = X)<P>
(1022) Theorem 872: (Ord(X) & Ord(Y) & (X in Y) & (Z notin cumstr(0,Y))) imp (X in rk(Z))<P>
(1023) Theorem 873: (N in Za) imp Finite(cumstr(0,N))<P>
(1023+) Theorem 874: (W = cumstr(0,rk({snglIter(n,X): n in Za}))) imp ((X incin W) & (not Finite(W - X)) & (1 in rk(W)))<P>
(1024) Theorem superstructure.0: (EXISTS f | one_1_map(f) & (range(f) = b) & (domain(f) = #b))<P>
(1025) Theorem superstructure.1: one_1_map(f) & (range(f) = b) & (domain(f) = #b)<P>
(1026) Theorem superstructure.2: one_1_map(bij_thryvar) & (domain(bij_thryvar)=b) & (range(bij_thryvar)=ur_thryvar)<P>
(1027) Theorem superstructure.3: supstr(ur_thryvar,sst_thryvar)<P>
(1028) Theorem 875: [the null set is hereditarily finite] 0 in HF<P>
(1029) Theorem 876: [transitivity of the collection of hereditarily finite sets] ((S in HF) & (X in S)) imp (X in HF)<P>
(1030) Theorem 877: [extensionality of membership over the hereditarily finite sets] ((S in HF) & (T in HF) & (FORALL x | (x in HF) imp ((x in S) eq (x in T)))) imp (S = T)<P>
(1031) Theorem 878: [closedness under powerset formation of the collection of hereditarily finite sets] (S in HF) imp (pow(S) in HF)<P>
(1032) Theorem 879: [closedness under singleton formation of the collection of hereditarily finite sets] (S in HF) imp ({S} in HF)<P>
(1033) Theorem 880: [closedness under dyadic union of the collection of hereditarily finite sets] ((S in HF) & (T in HF)) imp ((S + T) in HF)<P>
(1034) Theorem 881: [closedness under set difference of the collection of hereditarily finite sets] ((S in HF) & (T in HF)) imp (((S - T) in HF) & ({S,T} in HF))<P>
(1035) Theorem 882: [closedness under selection of the collection of hereditarily finite sets] (S in HF) imp (arb(S) in HF)<P>
(1036) Theorem 883: [all subsets of an hereditarily finite set are hereditarily finite] ((S in HF) & (T incin S)) imp (T in HF)<P>
(1037) Theorem 884: [alternative characterization of hereditarily finite sets] (S in HF) eq (Finite(S) & ({u in S | not (u in HF)} = 0))<P>
(1038) Theorem 885: [closedness under unionset of the collection of hereditarily finite sets] (S in HF) imp (Un(S) in HF)<P>
(1039) Theorem herfin_induction0: [finiteness ensues from hereditary finiteness] Finite(s0)<P>
(1040) Theorem herfin_induction1: [inclusion-minimal hereditarily finite set satisfying $P$] (hf0_thryvar incin s0) & P(hf0_thryvar) &	(FORALL k incin hf0_thryvar | (k /= hf0_thryvar) imp (not P(k)))<P>
(1041) Theorem herfin_induction2: [rank-minimal hereditarily finite set satisfying $P$] (EXISTS x in cumstr(0,Za) | P(x) & (FORALL k | (rk(k) in rk(x)) imp (not P(k))))<P>
(1042) Theorem herfin_induction3: [existence of membership/inclusion-minimal hereditarily finite set satisfying $P$] (EXISTS x | (x in HF) & P(x) & (FORALL k | ((k in x) or ((k incin x) & (k /= x))) imp (not P(k))))<P>
(1043) Theorem herfin_induction4: [membership/inclusion-minimal hereditarily finite set satisfying $P$] (hf1_thryvar in HF) & P(hf1_thryvar) & (FORALL k | ((k in hf1_thryvar) or ((k incin hf1_thryvar) & (k /= hf1_thryvar))) imp (not P(k)))<P>
(1044) Theorem 886: [alternative characterization of hereditarily finite sets, 2] (S in HF) eq (Finite(Ult_membs(S)))<P>
(1045) Theorem based_maps.1: ((X in rr) & (Y in rr)) imp ((X + Y) = (Y + X))<P>
(1046) Theorem based_maps.2: ((X in rr) & (Y in rr) & (Z in rr)) imp ((X + Y) + Z = X + (Y + Z))<P>
(1047) Theorem based_maps.3: ((X in rr) & (Y in rr)) imp (compl_thryvar(compl_thryvar(X + Y) + compl_thryvar(X + compl_thryvar(Y))) = X)<P>
(1048) Theorem based_maps.4: ((X in rr) & (Y in rr) & (Z in rr)) imp ((X @ Y) @ Z = X @ (Y @ Z))<P>
(1049) Theorem based_maps.5: ((X in rr) & (Y in rr) & (Z in rr)) imp (Z @ (X + Y) = (Z @ X) + (Z @ Y))<P>
(1050) Theorem based_maps.6: (X in rr) imp ((ident_thryvar @ X) = X)<P>
(1051) Theorem based_maps.7: (X in rr) imp (inv(inv(X)) = X)<P>
(1052) Theorem based_maps.8: ((X in rr) & (Y in rr)) imp (inv(X + Y) = inv(X) + inv(Y))<P>
(1053) Theorem based_maps.9: ((X in rr) & (Y in rr)) imp (inv(X @ Y) = inv(Y) @ inv(X))<P>
(1054) Theorem based_maps.10: ((X in rr) & (Y in rr)) imp ((compl_thryvar(Y @ X) @ inv(X)) + compl_thryvar(Y) = compl_thryvar(Y))<P>
(1054+) Theorem nfa1: [transition triples are finitely many] Finite(d)<P>
(1055) Theorem nfa2: [strict inclusion between strings is a well-founded relation] ((W incin Fin_seqs(a)) & (W /= 0)) imp (EXISTS m in W | (FORALL y in W | not((y incin m) & (y /= m))))<P>
(1056) Theorem nfa3: [consumption of a string over the alphabet] (FORALL w,q | (w in Fin_seqs(a)) imp	(nfa_thryvar(w,q) = (nfaEps_thryvar~[if w=0 then q else nfa1_thryvar(w~[#w MINUS 1],arb({nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp incin w) & (wp /= w)) & (wp = w ON (#w MINUS 1))})) end if])))<P>
(1057) Theorem nfa4: [consumption of a string over the alphabet, 2] (W in Fin_seqs(a)) imp	(nfa_thryvar(W,Q) = (nfaEps_thryvar~[if W = 0 then Q else nfa1_thryvar(W~[#W MINUS 1],nfa_thryvar(W ON (#W MINUS 1),Q)) end if]))<P>
(1058) Theorem nfa5: [consumption of a string leads to states] (W in Fin_seqs(a)) imp (nfa_thryvar(W,Q) incin v)<P>
(1059) Theorem nfa6: [characterization of determinism, 1] ((#s = 1) & Svm(d) & (domain(d) incin (v PROD a))) imp Is_dfa_thryvar<P>
(1060) Theorem nfa7: Is_dfa_thryvar imp (nfaNeighbor_thryvar(P,Q) eq (P incs Q))<P>
(1061) Theorem nfa8: Is_dfa_thryvar imp (((Q incin v) imp ((nfaEps_thryvar~[Q]) = Q)) & ((Q nincin v) imp ((nfaEps_thryvar~[Q]) = 0)))<P>
(1062) Theorem nfa9: [characterization of determinism, 2] (Is_dfa_thryvar & (W in Fin_seqs(a))) imp (#nfa_thryvar(W,{Y}) in 2)<P>
(1063) Theorem nfa10: [deterministic consumption of a string over the alphabet, 3] (Is_dfa_thryvar & (W in Fin_seqs(a)) & (Y in v)) imp	(nfa_thryvar(W,{Y}) = if W = 0 then {Y}	elseif nfa_thryvar(W ON (#W MINUS 1),{Y}) = 0 then 0	elseif [arb(nfa_thryvar(W ON (#W MINUS 1),{Y})),W~[#W MINUS 1]] notin domain(d) then 0	else {d~[[arb(nfa_thryvar(W ON (#W MINUS 1),{Y})),W~[#W MINUS 1]]]} end if)<P>
(1064) Theorem nfa11: [language accepted by a deterministic automaton] Is_dfa_thryvar imp (nfaLang_thryvar = {z in Fin_seqs(a) | (#nfa_thryvar(z,s) = 1) & (nfa_thryvar(z,s) incin t)})<P>
(1065) Theorem nfa12: [preparation for self-application of this THEORY]	(({dfaStart_thryvar} + dfaAccept_thryvar) incin dfaStates_thryvar) & Finite(dfaStates_thryvar) &	(dfaTrans_thryvar incin ((dfaStates_thryvar PROD next(a)) PROD dfaStates_thryvar)) &	Svm(dfaTrans_thryvar) & (domain(dfaTrans_thryvar) incin (dfaStates_thryvar PROD a)) &	(range(dfaTrans_thryvar) incin dfaStates_thryvar)<P>
(1066) Theorem nfa13: Finite(dfaTrans_thryvar) &	(((#{dfaStart_thryvar} = 1) & Svm(dfaTrans_thryvar) & (domain(dfaTrans_thryvar) incin (dfaStates_thryvar PROD a))) imp Js_dfa_thryvar) &	(FORALL w, y | (Js_dfa_thryvar & (w in Fin_seqs(a))) imp (#dfa_thryvar(w,{y}) in 2)) &	(FORALL w, y | (Js_dfa_thryvar & (w in Fin_seqs(a)) & (y in dfaStates_thryvar)) imp		(dfa_thryvar(w,{y}) = if w = 0 then {y}		elseif dfa_thryvar(w ON (#w MINUS 1),{y}) = 0 then 0		elseif [arb(dfa_thryvar(W ON (#W MINUS 1),{Y})),W~[#W MINUS 1]] notin domain(dfaTrans_thryvar) then 0		else {dfaTrans_thryvar~[[arb(dfa_thryvar(w ON (#w MINUS 1),{y})),w~[#w MINUS 1]]]} end if)) &	(Js_dfa_thryvar  imp (dfaLang_thryvar =		{z in Fin_seqs(a) | (#dfa_thryvar(z,{dfaStart_thryvar}) = 1) & (dfa_thryvar(z,{dfaStart_thryvar}) incin dfaAccept_thryvar)}))<P>
(1067) Theorem nfa14: Js_dfa_thryvar<P>
(1068) Theorem nfa15: (W in Fin_seqs(a)) imp (#dfa_thryvar(W,{Y}) in 2)<P>
(1069) Theorem nfa16: ((W in Fin_seqs(a)) & (Y in dfaStates_thryvar)) imp (dfa_thryvar(W,{Y}) = if W = 0 then {Y}		elseif dfa_thryvar(W ON (#W MINUS 1),{Y}) = 0 then 0		elseif [arb(dfa_thryvar(W ON (#W MINUS 1),{Y})),W~[#W MINUS 1]] notin domain(dfaTrans_thryvar) then 0		else {dfaTrans_thryvar~[[arb(dfa_thryvar(W ON (#W MINUS 1),{Y})),W~[#W MINUS 1]]]} end if)<P>
(1069+) Theorem nfa17: dfaLang_thryvar = {z in Fin_seqs(a) | (#dfa_thryvar(z,{dfaStart_thryvar}) = 1) & (dfa_thryvar(z,{dfaStart_thryvar}) incin dfaAccept_thryvar)}<P>
(1070) Theorem collapse1: (W(C) & W(D) & (D in C)) imp (Mostowski_thryvar(D) in Mostowski_thryvar(C))<P>
(1071) Theorem collapse2: ((FORALL c, cp | (W(c) & W(cp) & (Mostowski_thryvar(cp) = Mostowski_thryvar(c))) imp (cp = c) ) &		W(C) & W(D)) imp ((Mostowski_thryvar(D) in Mostowski_thryvar(C)) eq (D in C))<P>
(1072) Theorem mutual_climbing1: (Ord(I) & Ord(J)) imp (car(om_thryvar(I)) /= cdr(om_thryvar(J)))<P>
(1072+) Theorem mutual_climbing2: (Ord(I) & Ord(J) & (I /= J)) imp ((car(om_thryvar(I)) /= car(om_thryvar(J))) &		(cdr(om_thryvar(I)) /= cdr(om_thryvar(J))))<P>
(1073) Theorem mutual_climbing3: ((X in om1_thryvar) & (Y in om2_thryvar)) imp ((X in Y) or (Y in X))<P>
(1074) Theorem mutual_climbing4: ((om1_thryvar * om2_thryvar) = 0) & (om1_thryvar /= om2_thryvar)<P>
(1075) Theorem mutual_climbing5: (om1_thryvar notin om2_thryvar) & (om2_thryvar notin om1_thryvar)<P>
(1076) Theorem mutual_climbing6: (Un(om1_thryvar) incin om2_thryvar) & (Un(om2_thryvar) incin om1_thryvar)<P>
(1077) Theorem twin_infinities1: not(Finite(om1 + om2))<P>
(1078) Theorem twin_infinities2: not(Finite(om1) or Finite(om2))<P>
(1079) Theorem twin_infinities3: (om1 * om2) = 0<P>
(1080) Theorem twin_infinities4: (om1 /= 0) & (om2 /= 0)<P>
(1081) Theorem 887: (Is_tog(T) & (X in domain(T))) imp (((T~[X]) /= X) & ((T~[T~[X]]) = X))<P>
(1082) Theorem 888: (not Finite(S)) imp (EXISTS f | Is_tog(f) & (domain(f) = S))<P>
(1083) Theorem globalizeMap1: Finite(t) imp ((range(t) = domain(t)) & (one_1_map(t)))<P>
(1084) Theorem globalizeMap2: (EXISTS o | Ord(o) & (1 in o) & (domain(t) incin cumstr(0,o)) & (not Finite(cumstr(0,o) - domain(t))))<P>
(1085) Theorem globalizeMap3: Ord(rk_thryvar) & (1 in rk_thryvar) & (domain(t) incin cumstr(0,rk_thryvar)) & (not Finite(cumstr(0,rk_thryvar) - domain(t)))<P>
(1086) Theorem globalizeMap4: (EXISTS tp | Is_tog(tp) & (domain(tp) = cumstr(0,rk_thryvar) - domain(t)))<P>
(1086+) Theorem globalizeMap5:  Is_tog(tg_thryvar) & (domain(tg_thryvar) = cumstr(0,rk_thryvar) - domain(t))<P>
(1087) Theorem globalizeMap6: [alternative characterization of formal negative, via toggling; symmetry and irreflexivity of toggling] ((((X - 1) = (Y - 1)) & ((X * 1) = (1 - Y))) eq (Y = togg_thryvar(X))) & ((((X - 1) = (Y - 1)) & ((X * 1) = (1 - Y))) imp ((((Y - 1) = (X - 1)) & ((Y * 1) = (1 - X))) & (X /= Y)))<P>
(1088) Theorem globalizeMap7: [double negation affirms] (togg_thryvar(togg_thryvar(X)) = X) & (togg_thryvar(X) /= X)<P>
(1089) Theorem globalizeMap8: [negation of special sets] (togg_thryvar(0) = 1) & (togg_thryvar(1) = 0) & (togg_thryvar({{X,Y}}) = {0,{X,Y}}) & ((X /= 0) imp (togg_thryvar({0,X}) = {X}))<P>
(1090) Theorem globalizeMap9: [global toggling preserves rank] (1 in rk(X)) imp (rk(X) = rk((X - 1) + (1 - X)))<P>
(1091) Theorem globalizeMap10: (X in domain(t)) imp (qtog_thryvar(X) = t~[X])<P>
(1092) Theorem globalizeMap11: (X notin range(t)) imp ((qtog_thryvar(X) /= X) & (qtog_thryvar(qtog_thryvar(X)) = X))<P>
(1093) Theorem globalizeTog0: Svm(t) & (range(t) = domain(t))<P>
(1094) Theorem globalizeTog1: (FORALL x | (x in domain(t)) imp (tog_thryvar(x) = t~[x])) &	(FORALL x | (x notin range(t)) imp ((tog_thryvar(x) /= x) & (tog_thryvar(tog_thryvar(x)) = x)))<P>
(1095) Theorem globalizeTog2: (tog_thryvar(X) /= X) & (tog_thryvar(tog_thryvar(X)) = X)<P>
(1096) Theorem 889: Svm(0) & (range(0) incs domain(0))<P>
(1096+) Theorem 890: (FORALL x | togg(x) = ((x - 1) + (1 - x))) &	(FORALL x | (togg(togg(x)) = x) & (togg(x) /= x)) &	(FORALL x | (1 in rk(x)) imp (rk(x) = rk((x - 1) + (1 - x)))) &	(FORALL x, y | (togg(0) = 1) & (togg(1) = 0) & (togg({{x,y}}) = {0,{x,y}}) & ((x /= 0) imp (togg({0,x}) = {x})))<P>
(1097) Theorem 891: [specification of formal negative] togg(X) = ((X - 1) + (1 - X))<P>
(1098) Theorem 892: [formal negative and affirmative have the same rank] (1 in rk(X)) imp (rk(X) = rk((X - 1) + (1 - X)))<P>
(1099) Theorem 893: [double negation affirms] (togg(togg(X)) = X) & (togg(X) /= X)<P>
(1100) Theorem 894: [negation of special sets] (togg(0) = 1) & (togg(1) = 0) & (togg({{X,Y}}) = {0,{X,Y}}) & ((X /= 0) imp (togg({0,X}) = {X}))<P>
(1101) Theorem 895: [unsigned symbol retrieval from literal] (B incin 1) imp (atm(B + {{G}}) = G)<P>
(1102) Theorem 896:  [sign removal from literal] (atm(togg(X)) = atm(X)) & ((X in signedSymbs(C)) imp (atm(X) in C))<P>
(1103) Theorem 897: [equal literals share the same atom] (((B + {H}) = (D + {K})) & (B in {0,{0}}) & (K /= 0)) imp (H = K)<P>
(1104) Theorem 898: [literals associated with a singleton alphabet] (signedSymbs(0) = 0) & (signedSymbs({G}) = {{{G}},togg({{G}})})<P>
(1105) Theorem 899: [literals over disjoint alphabets] ((C * D) = 0) imp (((signedSymbs(C) * signedSymbs(D)) = 0) & ((signedSymbs(C) + signedSymbs(D)) = signedSymbs(C + D)))<P>
(1106) Theorem 900: [decomposition of the set of all literals over a nonnull set] (C /= 0) imp (signedSymbs(C) = {{{arb(C)}},togg({{arb(C)}})} + signedSymbs(C - {arb(C)}))<P>
(1107) Theorem signedSymbols1: [affirmation is one-one] (X /= Y) imp (aff_thryvar(x) /= aff_thryvar(y))<P>
(1108) Theorem signedSymbols2: [negation is a Galois correspondence] (neg_thryvar(neg_thryvar(X)) = X) & (neg_thryvar(X) /= X)<P>
(1109) Theorem signedSymbols3: [positive and negative literals do not intersect] aff_thryvar(X) /= neg_thryvar(aff_thryvar(Y))<P>
(1110) Theorem signedSymbols4: [affirmation of an atom produced a literal] {aff_thryvar(x): x in atms} incin lits_thryvar<P>
(1111) Theorem signedSymbols5: [literals are closed under negation] {neg_thryvar(x): x in lits_thryvar} = lits_thryvar<P>
(1112) Theorem signedSymbols6: false_thryvar notin lits_thryvar<P>
(1113) Theorem signedSymbols7: {rk(x): x in lits_thryvar} incin {rk(false_thryvar)}<P>
(1114) Theorem signedSymbols8: (N in next(Za)) imp (N in rk(false_thryvar))<P>
(1115) Theorem signedSymbols9: (rk(X) notin rk(false_thryvar)) imp (rk(neg_thryvar(X)) = rk(X))<P>
(1116) Theorem cnfModels0: [assumption concerning tog] (tog(tog(X)) = X) & (tog(X) /= X)<P>
(1117) Theorem cnfModels1: [property of the models of $0$] Has_cnfModel_thryvar(0,M) eq ({h in M | tog(h) in M} = 0)<P>
(1117+) Theorem cnfModels2: [blatant truth, manifest absurdity] Has_cnfModel_thryvar(0,0) & Is_cnfSat_thryvar(0) & ((0 in S) imp (not(Is_cnfSat_thryvar(S))))<P>
(1118) Theorem cnfModels3: [plain satisfiability] (({h in Un(S) | tog(h) in Un(S)} = 0) & (0 notin S)) imp (Has_cnfModel_thryvar(S,Un(S)) & Is_cnfSat_thryvar(S))<P>
(1119) Theorem cnfModels4: [plain satisfiability, 2] ({u: u in S, h in u | (u = {h}) & ({h,tog(h)} * Un(S - {u}) = 0)} incs S) imp (Has_cnfModel_thryvar(S,Un(S)) & Is_cnfSat_thryvar(S))<P>
(1119+) Theorem cnfModels5: [cnf model subsumption] ((T incin S) & Has_cnfModel_thryvar(S,M)) imp Has_cnfModel_thryvar(T,M)<P>
(1120) Theorem cnfModels6: [cnf model subsumption,2] ((T incin S) & Is_cnfSat_thryvar(S)) imp Is_cnfSat_thryvar(T)<P>
(1121) Theorem cnfModels7: [shrinking of cnf_model] Has_cnfModel_thryvar(S,M) imp Has_cnfModel_thryvar(S, M * Un(S))<P>
(1122) Theorem cnfModels8: [broadening of cnf-model] (Has_cnfModel_thryvar(S,M) & ({h in (N - M) | tog(h) in N} = 0) & (M incin N)) imp Has_cnfModel_thryvar(S,N)<P>
(1123) Theorem cnfModels9: [broadening of cnf-model, 2] (Has_cnfModel_thryvar(S,M) & (N incs M) & Has_cnfModel_thryvar(T,N)) imp Has_cnfModel_thryvar(S,N)<P>
(1124) Theorem cnfModels10: [shrinking of cnf_model, 2] (Has_cnfModel_thryvar(S,M) & (H notin Un(S))) imp (Has_cnfModel_thryvar(S, M - {H}))<P>
(1125) Theorem cnfModels11: [broadening of cnf_model, 3] ({H,tog(H)} * M = 0) imp (Has_cnfModel_thryvar(0,M) eq Has_cnfModel_thryvar(0, M + {H}))<P>
(1126) Theorem cnfModels12: [disjunctive tautology] {h in C | tog(h) in C} incin {h in C | Has_cnfModel_thryvar({C},{h}) & Has_cnfModel_thryvar({C},{tog(h)})}<P>
(1127) Theorem cnfModels13: [disjunctive tautology, 2] ((H in C) & (tog(H) in C)) imp (Has_cnfModel_thryvar({C},{H}) & Has_cnfModel_thryvar({C},{tog(H)}))<P>
(1127+) Theorem cnfModels14: [extensibility of models] Has_cnfModel_thryvar(S,M) imp	Has_cnfModel_thryvar(0, M + {arb({k,tog(k)}): c in T, k in (c - M) | tog(k) in (c - M)})<P>
(1128) Theorem cnfModels15: [tautology withdrawal rule] Has_cnfModel_thryvar(S,M) imp	Has_cnfModel_thryvar(S + {c: c in T, h in c | tog(h) in c},		M + {arb({h,tog(h)}): c in T, h in (c - M) | tog(h) in (c - M)})<P>
(1129) Theorem cnfModels16: [tautology withdrawal rule, 2] ({c: c in S, h in c | tog(h) in c} incs T) imp (Is_cnfSat_thryvar(S) eq Is_cnfSat_thryvar(S - T))<P>
(1130) Theorem cnfModels17: [preliminary to splitting rule] (Has_cnfModel_thryvar(S,M) & (not Has_cnfModel_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}, M + {H}))) imp (tog(H) in M)<P>
(1130+) Theorem cnfModels18: [splitting rule] Has_cnfModel_thryvar(S,M) imp (Has_cnfModel_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}, M + {H}) or Has_cnfModel_thryvar({{tog(H)}} + {c - {H}: c in S | tog(H) notin c}, M + {tog(H)}))<P>
(1131) Theorem cnfModels19: [splitting rule, 2] Has_cnfModel_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}, M) imp Has_cnfModel_thryvar(S,M)<P>
(1132) Theorem cnfModels20: [preliminary to splitting rule, 2] Is_cnfSat_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}) imp Is_cnfSat_thryvar(S)<P>
(1133) Theorem cnfModels21: [splitting rule, 2] Is_cnfSat_thryvar(S) eq (Is_cnfSat_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}) or Is_cnfSat_thryvar({{tog(H)}} + {c - {H}: c in S | tog(H) notin c}))<P>
(1134) Theorem cnfModels22: [pure literal rule] ((H in Un(S)) & (tog(H) notin Un(S)) & Has_cnfModel_thryvar(0,M) & (not(Has_cnfModel_thryvar({{H,tog(H)}},M)))) imp (Has_cnfModel_thryvar(S, M + {H}) eq Has_cnfModel_thryvar({c in S | H notin c}, M))<P>
(1135) Theorem cnfModels23: [pure literal rule, 2] (tog(H) notin Un(S)) imp (Is_cnfSat_thryvar(S) eq Is_cnfSat_thryvar({{H}} + {c in S | H notin c}))<P>
(1136) Theorem cnfModels24: [unit literal rule, 0] (({H} in S) & Has_cnfModel_thryvar(S,M)) imp ((H in M) & (tog(H) notin M))<P>
(1137) Theorem cnfModels25: [unit literal rule] (({H} in S) & Has_cnfModel_thryvar(0,M) & ({H,tog(H)} * M = 0)) imp (Has_cnfModel_thryvar(S, M + {H}) eq Has_cnfModel_thryvar({c - {tog(H)}: c in S | H notin c}, M))<P>
(1138) Theorem cnfModels26: [unit literal rule, 2] ({H} in S) imp (Is_cnfSat_thryvar(S) eq Is_cnfSat_thryvar({c - {tog(H)}: c in S | H notin c}))<P>
(1139) Theorem cnfModels27: (Un(S) incs Un({c - {tog(H)}: c in S | H notin c})) & (H notin Un({c - {tog(H)}: c in S | H notin c}))<P>
(1140) Theorem cnfModels28: (Is_cnfFinSat_thryvar(P) & (P incs Q)) imp Is_cnfFinSat_thryvar(Q)<P>
(1141) Theorem cnfModels29: Is_cnfFinSat_thryvar(P) imp Is_cnfFinSat_thryvar(P + {{{X}}}) or Is_cnfFinSat_thryvar(P + {{{tog(X)}}})<P>
(1142) Theorem cnfModels30: [compactness of classical propositional logic] (Is_cnfFinSat_thryvar(P) & (FORALL s in P, c in s | Finite(c))) imp (EXISTS m | (FORALL s in P | Has_cnfModel_thryvar(s,m)))<P>
(1143) Theorem davisPutnam0: (tog(tog(H)) = H) & (tog(H) /= H) &((tog(H) notin Un(S)) imp ({c in S | H notin c} = {c - {tog(H)}: c  in S | H notin c}))<P>
(1144) Theorem davisPutnam1: (S in clauSets_thryvar) imp (Finite(S) & Finite(Un(S)) &		(Un(S) incin lits) & (fail notin Un(S)) & (tog(fail) notin Un(S)))<P>
(1145) Theorem davisPutnam2: ((S in clauSets_thryvar) & (C in S)) imp Finite(C)<P>
(1146) Theorem davisPutnam3: ((S in clauSets_thryvar) & ((T incin S) or (Un(T) incin Un(S)))) imp (T in clauSets_thryvar)<P>
(1147) Theorem davisPutnam4:	(FORALL s | Is_dpSat_thryvar(s) = (EXISTS m | Has_dpModel_thryvar(s,m))) &	(FORALL s | Has_dpModel_thryvar(0,0) & Is_dpSat_thryvar(0) & ((0 in s) imp (not(Is_dpSat_thryvar(s))))) &	(FORALL s | ({u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)} incs s) imp (Has_dpModel_thryvar(s,Un(s)) & Is_dpSat_thryvar(s))) &	(FORALL s, h | Is_dpSat_thryvar(s) eq		(Is_dpSat_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}) or			Is_dpSat_thryvar({{tog(h)}} + {c - {h}: c in s | tog(h) notin c}))) &	(FORALL h, s | (tog(h) notin Un(s)) imp		(Is_dpSat_thryvar(s) eq Is_dpSat_thryvar({{h}} + {c in s | h notin c}))) &	(FORALL h, s, m | (({h} in s) & Has_dpModel_thryvar(s,m)) imp ((h in m) & (tog(h) notin m))) &	(FORALL h, s, m | Has_dpModel_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}, m) imp		Has_dpModel_thryvar(s,m)) &	(FORALL s, m, t | Has_dpModel_thryvar(s,m) imp Has_dpModel_thryvar(s + {c: c in t, h in c | tog(h) in c}, m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)})) &	(FORALL t,s | ((t incin s) & Is_dpSat_thryvar(s)) imp Is_dpSat_thryvar(t))<P>
(1148) Theorem davisPutnam5: ((G incin clauSets_thryvar) & (G /= 0)) imp	(EXISTS m in G | (FORALL v in G | not((Un(v - settled_thryvar(v)) incin Un(m - settled_thryvar(m))) &				(Un(v - settled_thryvar(v)) /= Un(m - settled_thryvar(m))))))<P>
(1149) Theorem davisPutnam6: (FORALL x, p | (x in clauSets_thryvar) imp (dp0_thryvar(x,p) =	f3_dp_thryvar(x,{dp0_thryvar(y,p): y in clauSets_thryvar |		((Un(y - settled_thryvar(y)) incin Un(x - settled_thryvar(x))) &		 (Un(y - settled_thryvar(y)) /= Un(x - settled_thryvar(x)))) &		P3_dp_thryvar(x,y,p)},p)))<P>
(1150) Theorem davisPutnam7: (X in clauSets_thryvar) imp (#Un(X - settled_thryvar(X))  in Za)<P>
(1151) Theorem davisPutnam8: ((X in clauSets_thryvar) & (H in Un(X - settled_thryvar(X))) & ((Y = {{H}} + {c - {tog(H)}: c in X | H notin c}))) imp	((Y in clauSets_thryvar) & (Un(Y - settled_thryvar(Y)) /= Un(X - settled_thryvar(X))) &	(Un(Y - settled_thryvar(Y)) incin Un(X - settled_thryvar(X))))<P>
(1152) Theorem davisPutnam9: ((S in clauSets_thryvar) & (0 notin S) &		(S nincin settled_thryvar(S))) imp		(((pk_thryvar~[S]) in Un(S - settled_thryvar(S))) &		((pk_thryvar~[S]) /= fail) & (tog(pk_thryvar~[S]) /= fail) &		((tog(pk_thryvar~[S]) in Un(S)) imp		(tog(pk_thryvar~[S]) in Un(S - settled_thryvar(S)))))<P>
(1153) Theorem davisPutnam10: ((S in clauSets_thryvar) & ((0 in S) or (S incin settled_thryvar(S)) or (#Un(S - settled_thryvar(S)) = 0))) imp(if fail in dp0_thryvar(S,pk_thryvar) then (not Is_dpSat_thryvar(S)) else Has_dpModel_thryvar(S,dp0_thryvar(S,pk_thryvar)) end if)<P>
(1154) Theorem davisPutnam11: (S in clauSets_thryvar) imp(if fail in dp0_thryvar(S,pk_thryvar) then (not Is_dpSat_thryvar(S)) else Has_dpModel_thryvar(S,dp0_thryvar(S,pk_thryvar)) end if)<P>
(1155) Theorem davisPutnam12: (S in clauSets_thryvar) imp (Is_dpSat_thryvar(S) eq (fail notin dp_thryvar(S)))<P>
(1156) Theorem davisPutnam13: (S in clauSets_thryvar) imp		(Is_dpSat_thryvar(S) eq Has_dpModel_thryvar(S,dp_thryvar(S)))<P>
(1157) Theorem 901: (Svm(P) & Finite(P) & (range(P) incs domain(P))) imp Is_perm(P)<P>
(1158) Theorem 902: (Scycle(P) imp ((P /= 0) & Is_perm(P) & Svm(P) & Finite(P))) & (Straight(P,X,Y) imp (Svm(P) & Finite(P)))<P>
(1159) Theorem 903: (Is_perm(P) & (P /= 0)) imp (EXISTS c incin P | Scycle(c))<P>
(1160) Theorem 904: (Is_map(P) & Finite(P) & (range(P) incin domain(P)) & (P /= 0)) imp (EXISTS c incin P | Scycle(c))<P>
(1161) Theorem 905: Is_perm(0) & (Is_perm(P) imp one_1_map(P))<P>
(1162) Theorem 906: Acyclic(A) imp (not Scycle(A))<P>
(1163) Theorem 907: ((B incs A) & Acyclic(B)) imp Acyclic(A)<P>
(1164) Theorem 908: Acyclic(0) & Is_perm({[X,X]}) & Scycle({[X,X]}) & ((X /= Y) eq Acyclic({[X,Y]}))<P>
(1165) Theorem 909: Is_perm({[X,Y],[Y,X]}) & Scycle({[X,Y],[Y,X]}) & ((X /= Y) imp Straight({[X,Y]},X,Y))<P>
(1166) Theorem 910: Straight(0,X,Y) eq (Y = X)<P>
(1167) Theorem 911: ((X /= Y) & (Y /= Z)) imp ((X /= Z) eq Acyclic({[X,Y],[Y,Z]}))<P>
(1168) Theorem 912: (Straight(Q,X,Y) & Is_perm(P) & (P /= 0)) imp (P nincin Q)<P>
(1169) Theorem 913: Acyclic({[X,Y],[Y,Z]}) imp Straight({[X,Y],[Y,Z]},X,Z)<P>
(1170) Theorem 914: (Scycle(C) & (X in domain(C))) imp Straight(C - {[X,C~[X]]}, C~[X], X)<P>
(1171) Theorem 915: (Straight(P,X,Y) & (P /= 0)) imp ((X in (domain(P) - range(P))) & (Y in (range(P) - domain(P))))<P>
(1172) Theorem 916: (Straight(P,X,Y) & (P /= 0)) imp (({Y} = (range(P) - domain(P))) & ({X} = (domain(P) - range(P))))<P>
(1173) Theorem 917: Ord(N) imp (segm(N,P,S) incin segm(next(N),P,S))<P>
(1174) Theorem 918: (Is_perm(C) & (S incin C) & Ord(Y)) imp (segm(Y,C,S) incin C)<P>
(1175) Theorem 919: (Straight(Q,X,Y) & (Q /= 0)) imp ([X,Q~[X]] in prefix(Q,Q~[X]))<P>
(1176) Theorem 920: (Straight(Q,X,Y) & (Q /= 0)) imp (EXISTS p incin (Q - {[X,Q~[X]]}) | Straight(p, Q~[X], Y))<P>
(1177) Theorem 921: not(Acyclic(R) & Straight(P,Z,Y) & Straight(Q,Y,Z) & ((P + Q) incin R) & ((P + Q) /= 0))<P>
(1178) Theorem 922: (Acyclic(R) & Straight(P,Z,Y) & Straight(Q,X,Z) & ((P + Q) incin R)) imp (EXISTS s incin (P + Q) | Straight(s,X,Y))<P>
(1179) Theorem 923: Is_map(on(R,V)) & (on(R,V) incin R) & (Is_map(R) imp (on(R + inv(R),V) = (on(R,V) + inv(on(R,V)))))<P>
(1180) Theorem 924: Is_map(transCl(R)) & Is_map(trans_reflCl(R,V)) & (trans_reflCl(R,V) incin (V PROD V))<P>
(1181) Theorem 925: Is_map(R) imp (R incin transCl(R))<P>
(1182) Theorem 926: (R incin S) imp (transCl(R) incin transCl(S))<P>
(1183) Theorem 927: ((R incin S) & (N incin M)) imp (trans_reflCl(R,N) incin trans_reflCl(S,M))<P>
(1184) Theorem 928: (transCl(R) incin (domain(R) PROD range(R))) & (Finite(R) imp Finite(transCl(R)))<P>
(1185) Theorem 929: Acyclic(A) imp (([X,X] notin transCl(A)) & (({[X,Y],[Y,Z]} incin transCl(A)) imp ([X,Z] in transCl(A))))<P>
(1185+) Theorem 930: (Acyclic(F) & Finite(T) & (T /= 0)) imp (EXISTS w in T | (FORALL v in T | [v,w] notin transCl(F)))<P>
(1186) Theorem taggedGraph0: [association of its tag to each vertex] (FORALL v | Is_vertex(v) imp (Is_tag(tag1_thryvar(v)) & (v in tag1_thryvar(v))))<P>
(1187) Theorem taggedGraph1: SameTag_thryvar(X,X)<P>
(1187+) Theorem taggedGraph2: (SameTag_thryvar(X,Y) & SameTag_thryvar(Y,Z)) imp SameTag_thryvar(Z,X)<P>
(1188) Theorem taggedGraph3: ((Q incin (R + inv(R))) & Is_map(R) & (FORALL e in R | SameTag_thryvar(car(e),cdr(e))) & (X in domain(Q))) imp SameTag_thryvar(X,(Q~[X]))<P>
(1189) Theorem taggedGraph4: ((Q incin (R + inv(R))) & Is_map(R) & (FORALL e in R | SameTag_thryvar(car(e),cdr(e))) & Straight(Q,X,Y)) imp SameTag_thryvar(X,Y)<P>
(1190) Theorem taggedGraph5: (Is_map(R) & (FORALL e in R | SameTag_thryvar(car(e),cdr(e))) & ([X,Y] in trans_reflCl(R + inv(R),V))) imp SameTag_thryvar(X,Y)<P>
(1191) Theorem acyclicFiniteGraph1: (FORALL t | ((t incin vertices) & (t /= 0)) imp (EXISTS w in t | (FORALL v in t | not([v,w] in transCl(edges)))))<P>
(1192) 	Theorem acyclicFiniteGraph2: (FORALL x, t | (x in vertices) imp (rk2(x,t) = Un({next(rk2(y,t)): y in vertices | ([y,x] in transCl(edges)) & ([y,x] in t)})))<P>
(1193) Theorem acyclicFiniteGraph3: (X in vertices) imp (height_thryvar(X) = Un({next(height_thryvar(y)): y in vertices | [y,X] in edges}))<P>
(1194) Theorem labeledGraph0: (E in edges) imp ((E = [car(E),cdr(E)]) & (car(E) in vertices) & (cdr(E) in vertices))<P>
(1195) Theorem labeledGraph1: (EXISTS y | (V in vertices) imp ((y in tags) & (V in y)))<P>
(1196) Theorem labeledGraph2: ((X in tags) & (Y in tags) & (X /= Y)) imp ((X * Y) = 0)<P>
(1197) Theorem labeledGraph3: [properties of labeled graphs inherited from tagged graphs] (FORALL v | (v in vertices) imp ((tag2_thryvar(v) in tags) & (v in tag2_thryvar(v)))) &	(FORALL v | block_thryvar(v) = if v in vertices then {w in tag2_thryvar(v) | w in vertices} else 0 end if) &	(FORALL v, w | SameTag_thryvar(v,w) eq (block_thryvar(v) = block_thryvar(w))) &	(FORALL v | SameTag_thryvar(v,v)) &	(FORALL q, r, x | ((q incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & (x in domain(q))) imp SameTag_thryvar(x,(q~[x]))) &	(FORALL q, r, x, y | ((q incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & Straight(q,x,y)) imp SameTag_thryvar(x,y)) &	(FORALL r, x, y, v | (Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & ([x,y] in trans_reflCl(r + inv(r),v))) imp SameTag_thryvar(x,y))<P>
(1198) Theorem labeledGraph4: (0 in bisim_thryvar) & (bisim_thryvar incin sim_thryvar) & ((X in bisim_thryvar) imp (X incin (vertices PROD vertices)))<P>
(1199) Theorem labeledGraph5: (B in bisim_thryvar) imp (B incin bisimilar_thryvar)<P>
(1200) Theorem labeledGraph6: (B in bisim_thryvar) imp (inv(B) in bisim_thryvar)<P>
(1201) Theorem labeledGraph7: bisimilar_thryvar incin similar_thryvar<P>
(1202) Theorem labeledGraph8: (B in sim_thryvar) imp (trans_reflCl(B,vertices) in sim_thryvar)<P>
(1203) Theorem labeledGraph9: (B in bisim_thryvar) imp (trans_reflCl(B + inv(B), vertices) in bisim_thryvar)<P>
(1204) Theorem labeledGraph10: ((R in sim_thryvar) & (S in sim_thryvar)) imp ((R + S) in sim_thryvar)<P>
(1205) Theorem labeledGraph11: ((R in bisim_thryvar) & (S in bisim_thryvar)) imp ((R + S) in bisim_thryvar)<P>
(1206) Theorem labeledGraph12: (R in bisim_thryvar) imp (inv(R) in bisim_thryvar)<P>
(1207) Theorem labeledGraph13: Transitive(bisimilar_thryvar) & Symmetric(bisimilar_thryvar) & Reflexive(bisimilar_thryvar,vertices)<P>
(1208) Theorem labeledGraph14: Transitive(similar_thryvar) & Symmetric(similar_thryvar) & Reflexive(similar_thryvar,vertices)<P>
(1209) Theorem 931: [Domains and ranges of direct image] range(G)=(G IM D) + (G IM (domain(G)-D))<P>
(1210) Theorem 932: [Domain decomposition of a map range] ((D*E=0) & Inj(G)) imp ((G IM D) * (G IM E) = 0)<P>
(1211) Theorem 933: [Direct image of a domain element] (X in domain(G)) imp (G IM {X} /=0)<P>
(1212) Theorem 934: [Range of a restricted direct map] G IM D = range(G ON D)<P>
(1213) Theorem 935: [Monotonicity of direct image] (B incin A) imp ((G IM B) incin (G IM A))<P>
(1214) Theorem 936: (0 in Za) &	(FORALL x | (x in Za) imp ((x PLUS 0) = x)) &	(FORALL x,y | ((x in Za) & (y in Za)) imp ((x PLUS y) = (y PLUS x))) &	(FORALL x,y | ((x in Za) & (y in Za)) imp ((x PLUS y) in Za)) &	(FORALL x,y,z | ((x in Za) & (y in Za) & (z in Za)) imp (((x PLUS y) PLUS z) = (x PLUS (y PLUS z))))<P>
(1215) Theorem 937: (FORALL f | (Finite(f) & (range(f) incin Za)) imp (sumZa(f) in Za)) &	(FORALL x | (cdr(x) in Za) imp (sumZa({x}) = cdr(x))) &	(FORALL f,t | (Finite(f) & Is_map(f) & (range(f) incin Za)) imp (sumZa(f) = (sumZa(f ON (domain(f) * t)) PLUS sumZa(f ON (domain(f) - t))))) &	(FORALL c,f | ((c in f) & Finite(f) & (range(f) incin Za)) imp (sumZa(f) = (sumZa(f - {c}) PLUS cdr(c)))) &	(FORALL f,g | (Finite(f) & Svm(f) & Svm(g) & (domain(f) = domain(g)) & (range(f) incin Za)) imp		(sumZa(f) = sumZa({[y,sumZa(f ON (g INV_IM {y}))]: y in range(g)}))) &	(FORALL f,g | (Finite(f) & Svm(f) & one_1_map(g) & (domain(f) = domain(g)) & (range(f) incin Za)) imp		(sumZa(f) = sumZa({[y,f~[inv(g)~[y]]]: y in range(g)})))<P>
(1216) Theorem 938: [basic inclusion-exclusion lemma for two sets] (Finite(X + Y) imp (#(X + Y) = ((#X PLUS #Y) MINUS #(X * Y)))) &	((#(X + Y) PLUS #(X * Y)) = (#X PLUS #Y))<P>
(1217) Theorem 939: [basic inclusion-exclusion lemma for tuples of finite sets] ((domain(A) in Za) & Svm(A) & Finite(Un(range(A)))) imp	(#Un(range(A)) = sumZa({[g,#int(A IM g)]: g incin domain(A) | Odd(#g)}) MINUS sumZa({[g,#int(A IM g)]: g incin domain(A) | (g /= 0) & (not Odd(#g))}))<P>
(1218) Theorem 940: [basic inclusion-exclusion lemma for finitely many finite sets] (Finite(F) & Finite(Un(F))) imp	(#Un(F) = sumZa({[g,#int(g)]: g incin F | Odd(#g)}) MINUS sumZa({[g,#int(g)]: g incin F | (g /= 0) & (not Odd(#g))}))<P>
(1219) 	Theorem 941: [oddity-characterizing assertion] (FORALL s | Finite(s) imp (oddity(s) = if s = 0 then R_0 elseif oddity(s - {arb(s)}) /= R_1 then R_1 else R_Rev(R_1) end if))<P>
(1220) Theorem 942: [basic inclusion-exclusion lemma for finite real-valued maps] (Svm(F) & (F /= 0) & (range(F) incin Re)) imp	(max_over_Re(F) = sumRe({[g,min_over_Re(g)]: g incin F | oddity(g) = R_1}) R_MINUS sumRe({[g,min_over_Re(g)]: g incin F | oddity(g) = R_Rev(R_1)}))<P>
(1221) Theorem 943: [basic inclusion-exclusion lemma for finite real-valued maps, 2] (Svm(F) & (F /= 0) & (range(F) incin Re)) imp	(max_over_Re(F) = sumRe({[g,oddity(g) R_TIMES min_over_Re(g)]: g incin F | g /= 0}))<P>
(1222) Theorem 944: (P in F) imp (pow(F) = {0,{P}} + {g incin (F - {P}) | g /= 0} +				{g + {P} : g incin (F - {P}) | g /= 0})<P>
(1223) Theorem 945: (P in F) imp (pow(F) = {g: g incin (F - {P})} +				{g + {P} : g incin (F - {P})})<P>
(1224) Theorem 946: ({[F,Fp],[G,Gp]} incin samePath(S)) imp ([concat(F,G),concat(Fp,Gp)] in samePath(S))<P>
(1225) Theorem 947: (F in Fin_seqs(S) - {0}) imp (Is_perm({[F~[i],F~[i PLUS 1]]: i in #F MINUS 1} + {[F~[#F MINUS 1],F~[0]]}) eq (0 = {p in redexLoops | car(p) = F}))<P>
(1225+) Theorem 948: ({[F,Fp],[G,Gp]} incin sameWord(S)) imp ([concat(F,G),concat(Fp,Gp)] in sameWord(S))<P>
(1226) Theorem 949: Ord(K) imp divides(K,0)<P>
(1227) Theorem 950: (Card(M) or (M in Za)) imp (divides(1,M) & divides(M,M))<P>
(1228) Theorem 951: (divides(K,I) & divides(I,N)) imp divides(K,N)<P>
(1229) Theorem 952: ((M in Za) & (1 in M)) imp (Is_prime(smallest_factor(M)) & divides(smallest_factor(M),M))<P>
(1230) Theorem 16500: (D in F) imp (pow(F) = {g: g incin (F - {D})} + {g + {D} : g incin (F - {D})})<P>
(1231) Theorem halvesPow1: ((D in s0) & (domain(F) = pow(s0 - {D})) & Is_oddPow(F) & (G = F + {[q + {D},R_Rev(F~[q])]: q in pow(s0 - {D})})) imp		((domain(G) = pow(s0)) & Is_oddPow(G))<P>
(1232) Theorem halvesPow2: ((domain(F) = pow(s0)) & Is_oddPow(F) & (R_0 notin range(F))) imp		(#{q: q incin s0 | F~[q] R_GT R_0} = #{q: q incin s0 | F~[q] R_LT R_0})<P>
(1232+) Theorem halves0: Is_map(wholeP_thryvar) & Finite(wholeP_thryvar)<P>
(1233) Theorem halves1: (H in halvesP_thryvar) imp (sgg_thryvar(H) in oddFcn_thryvar)<P>
(1234) Theorem halves2: (({H,G} incin halvesP_thryvar) & (Q in wholeP_thryvar)) imp ((sgg_thryvar(H)~[Q]) R_OVER (sgg_thryvar(G)~[Q]) = (sgg_thryvar(H)~[Q]) R_TIMES (sgg_thryvar(G)~[Q]))<P>
(1235) Theorem halves3: ({H,G} incin halvesP_thryvar) imp ({[p,(sgg_thryvar(H)~[p]) R_OVER (sgg_thryvar(G)~[p])]: p in wholeP_thryvar} in evenFcn_thryvar)<P>
(1236) Theorem halves4: (({H,G} incin halvesP_thryvar) & Is_even(E) & (domain(E) = wholeP_thryvar)) imp (E H_TIMES H = E H_TIMES G)<P>
(1237) Theorem halves5: ({H,G} incin halvesP_thryvar) imp ((sign_thryvar~[[G,H]] in {R_1,R_Rev(R_1)}) & (sign_thryvar~[[G,H]] = R_1))<P>
(1237+) Theorem halves6: (Is_perm(F) & (domain(F) = s0) & (H in halvesP_thryvar)) imp ((F H_PROD H) in halvesP_thryvar)<P>
(1238) Theorem halves7: (Is_perm(F) & (domain(F) = s0) & ({H,G} incin halvesP_thryvar)) imp (sign_thryvar~[[F H_PROD G,F H_PROD H]] = sign_thryvar~[[G,H]])<P>
(1239) Theorem halves8: (Is_perm(F) & (domain(F) = s0) & (H in halvesP_thryvar)) imp ((sgn_thryvar~[F] in {R_1,R_Rev(R_1)}) & (sgn_thryvar~[F] = sign_thryvar~[[F H_PROD H,H]]))<P>
(1240) Theorem halves9: (Is_perm(D) & Is_perm(F) & (domain(D) = s0) & (domain(F) = s0) & (H in halvesP_thryvar)) imp (Is_perm(D @ F) & (domain(D @ F) = s0) & ((D @ F) H_PROD H) = (D H_PROD (F H_PROD H)))<P>
(1241) Theorem halves10: (Is_perm(D) & Is_perm(F) & (domain(D) = s0) & (domain(F) = s0)) imp (sgn_thryvar~[D @ F] = (sgn_thryvar~[D]) R_TIMES (sgn_thryvar~[F]))<P>
--
--BEGIN HERE ----------------------------------------------------------------------------------------------------
--
-- ************************************************************************************************
--						The Formal Foundations of Mathematical Analysis
-- ************************************************************************************************
--
-- The text which follows is a mixture of formulae and comments, acceptable to the Referee proof verifier
-- and verified thereby, which gives a sequence of formal definitions and proofs covering the foundations of
-- mathematical analysis from its set theoretic roots. These definitions and proofs are expected to
-- extend in time to culminate in a proof of the Cauchy integral theorem of complex analysis.
--
-- The verifier uses an extended form of natural deduction, in which each inference
-- within a proof consists of a 'hint' part defining the inference primitive used to
-- derive a statement, followed (after an occurrence of the separator "$==>$") by
-- the statement itself. Just 18 inference primitives, are used, namely
-- \nextline \begin{tabular}{ll}
-- ELEM   	\nextitem		extended mlss inference \nextline
-- Suppose   	\nextitem	open natural deduction context \nextline
-- Suppose_not   	\nextitem	open proof-by-contradiction argument \nextline
-- Discharge  	\nextitem	close natural deduction context if current context is contradictory \nextline
-- Citation  	\nextitem	statement citation followed by extended mlss inference \nextline
-- Tcitation   	\nextitem	theorem citation followed by extended mlss inference \nextline
-- EQUAL   	\nextitem		use of equalities during blobbing, followed by extended mlss inference \nextline
-- ALGEBRA   	\nextitem	use of algebraic identities during blobbing, followed by extended mlss inference \nextline
-- SIMPLF   	\nextitem	simplify nested setformers \nextline
-- Set_monot   	\nextitem		handle quantifiers and exploit set-theoretic monotonicity relationships \nextline
-- Def    	\nextitem		make a (possibly recursive) definition \nextline
-- Use_def   	\nextitem	cite and use a definition \nextline
-- Loc_def   	\nextitem	make a local definition of some auxiliary constant \nextline
-- THEORY \nextitem	introduce a new named theory \nextline
-- ENTER_THEORY \nextitem	enter the context defined by a theory \nextline
-- Assump   	\nextitem	cite a theory assumption \nextline
-- APPLY   	\nextitem		apply a theory
-- QED \nextitem terminate the proof of a theorem
--\end{tabular}
-- The formal material presented falls into various sections, each roughly corresponding to some
-- recognized area of mathematics.
--
-- ************************************************************************************************
--			Section 1: Basic Operations of set theory and the theory of ordinals
-- ************************************************************************************************
--
-- Our first step is to recast the axioms of choice and of infinity, which are built-in
-- assumptions of set theory, as the two following small utility theorems.
--
Theorem 0: [Axiom of Choice] ((S = 0) & (arb(S) = 0)) or ((arb(S) in S) & (arb(S) * S = 0)). Proof:
Suppose_not(s) ==> AUTO
Assump ==> Stat1: (FORALL s in OM | (((s = 0) & (arb(s) = 0)) or ((arb(s) in s) & (arb(s) * s = 0))))
s-->Stat1 ==> false; Discharge ==> QED
--
-- The following theorem simply restates the axiom of infinity.
--
Theorem 00: [Axiom of Infinity] (s_inf /= 0) & (FORALL x in s_inf | {x} in s_inf). Proof:
Suppose_not ==> AUTO
Assump ==> (s_inf /= 0) & (FORALL x in s_inf | {x} in s_inf)
Discharge ==> QED
--
-- After this, we begin by making a trick, purely set-theoretic definition of the notion of ordered pair,
-- and proving a few simple lemmas which tell us how to extract the first and second components of a pair.
--
Def 1: [Ordered pair] Def([X,Y]) := {{X},{{X},{{Y},Y}}}
--
-- Our first result is a lemma stating a basic property of 'arb'.
-- Its proof is elementary.
--
Theorem 1: [Choice from singleton] arb({X}) = X. Proof:
Suppose_not(c) ==> AUTO
Discharge ==> QED
--
-- Next we give a lemma which prepares for definition of the first-component extractor
-- from an ordered pair. Its proof is elementary.
--
Theorem 2: [Choice from set of 2] (X in Y) imp (arb({Y,X}) = X). Proof:
Suppose_not(c,d) ==> AUTO
Discharge ==> QED
--
-- The following lemma also prepares for definition of the first-component extractor
-- from an ordered pair. Its proof is elementary.
--
Theorem 3: [Choice from pair] arb([X,Y]) = {X}. Proof:
Suppose_not(c,d) ==> AUTO
Use_def([]) ==> Stat1: arb({{c},{{c},{{d},d}}}) /= {c}
({c},{{c},{{d},d}})-->T2(Stat1*) ==> false; Discharge ==> QED
--
-- The following is a third lemma which prepares for definition of the first-component extractor
-- from an ordered pair. Its proof is elementary.
--
Theorem 4: [Choice from special set of 2] arb({X,{X,Y}}) = X. Proof:
Suppose_not(x,y) ==> AUTO
Discharge ==> QED
--
-- Finally, we give the formula for the first-component extractor
-- from an ordered pair, along with its proof, which remains elementary.
--
Theorem 5: [Choice from pair, 2] arb(arb([X,Y])) = X. Proof:
    Suppose_not(c,d) ==> arb(arb([c,d])) /= c
    Use_def([]) ==> Stat1: arb(arb({{c},{{c},{{d},d}}})) /= c
    ()ELEM ==> (arb({{c},{{c},{{d},d}}}) = {c}) & (arb({c}) = c)
    EQUAL(Stat1) ==> false; Discharge ==> QED
--
-- Next we give a lemma which prepares for definition of the second-component extractor
-- from an ordered pair. Its proof is elementary.
--
Theorem 6: [cdr choice] arb(arb(arb([X,Y] - {arb([X,Y])}) - {arb([X,Y])})) = Y. Proof:
    Suppose_not(c,d) ==> arb(arb(arb([c,d] - {arb([c,d])}) - {arb([c,d])})) /= d
    (c,d)-->T3 ==> arb([c,d]) = {c}
    EQUAL ==> arb(arb(arb([c,d] - {{c}}) - {{c}})) /= d
    Use_def([]) ==> arb(arb(arb({{c},{{c},{{d},d}}} - {{c}}) - {{c}})) /= d
--    Use_def([](c,d)->Stat1) ==> AUTO
    TELEM ==> arb({{c},{{c},{{d},d}}} - {{c}}) = {{c},{{d},d}}
    EQUAL ==> Stat2: arb(arb({{c},{{d},d}} - {{c}}))  /= d
    (Stat2)Discharge ==> QED
--
-- Now we can give formal definitions of both ordered-pair component extractor functions.
--
Def 2: [First component of ordered pair] car(X) := arb(arb(X))
Def 3: [Second component of ordered pair] cdr(X) := arb(arb(arb(X - {arb(X)}) - {arb(X)}))
--
-- The following basic property of the  first-component extractor function
-- is an elementary consequence of the preceding lemmas.
--
Theorem 7: [car of pair] car([X,Y]) = X. Proof:
	Suppose_not(x,y) ==> car([x,y]) /= x
	Use_def(car) ==> arb(arb([x,y])) /= x
	(x,y)-->T5 ==> false;  Discharge ==> QED
--
-- Similarly, the basic property of the second-component extractor function
-- is an elementary consequence of the preceding lemmas.
--
Theorem 8: [cdr of pair] cdr([X,Y]) = Y. Proof:
	Suppose_not(x,y) ==> cdr([x,y]) /= y
	Use_def(cdr) ==> arb(arb(arb([x,y] - {arb([x,y])}) - {arb([x,y])})) /= y
	(x,y)-->T6 ==> false;  Discharge ==> QED
--
-- The following basic relationship between ordered pair formation and component extraction
-- is also an elementary consequence of the preceding lemmas.
--
Theorem 9: [Ordered pair property] (car([X,Y]) = X) & (cdr([X,Y]) = Y). Proof:
Suppose_not(x,y) ==> AUTO
(x,y)-->T7 ==> AUTO
(x,y)-->T8 ==> AUTO
Discharge ==> QED
--
Theorem 10: [Ordered pair property, 2] [X,Y] = [car([X,Y]),cdr([X,Y])]. Proof:
Suppose_not(x,y) ==> AUTO
(x,y)-->T9 ==> AUTO
EQUAL ==> false; Discharge ==> QED
--
-- The fact that any pair is the pair of its first and second components is equally elementary.
--
Theorem 11: [Pair reconstruction lemma] (U = [A,B]) imp (U = [car(U),cdr(U)]). Proof:
Suppose_not(u,a,b) ==> AUTO
(a,b)-->T7 ==> AUTO
(a,b)-->T8 ==> AUTO
Discharge ==> QED
--
-- Next we introduce a first 'THEORY', which simply encapsulates the fact that
-- the 'if ... then ... else ... end if'
-- term constructor commutes with any monadic term constructor.
--
THEORY if_then_else(p,a,b,f(x)) [Elementary properties of if_then_else]
END if_then_else
--
ENTER_THEORY if_then_else
--
Theorem if_then_else.1: [commutativity property of if_then_else] f(if p then a else b end if) = if p then f(a) else f(b) end if. Proof:
Suppose_not ==> AUTO
	Suppose ==> p
		ELEM ==> (a = if p then a else b end if) & (f(a) = if p then f(a) else f(b) end if)
	EQUAL ==> false; Discharge ==> (b = if p then a else b end if) & (f(b) = if p then f(a) else f(b) end if)
EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY if_then_else
--
--THEORY if_then_else(p,a,b,f(x)) [Elementary properties of if_then_else]
--==>
--f(if p then a else b end if) = if p then f(a) else f(b) end if
--END if_then_else
--
-- Next we introduce a second 'THEORY', which regards nested occurrences
-- of the 'if ... then ... else ... end if'
-- term constructor.
--
THEORY if_then_else2(q,p,a,b,c,pp,ap,bp,cp) [Conditioned interchange of nested occurrences of if_then_else]
	(q imp (p & (a = ap)))
	(not q) imp (p eq pp)
	((not q) & p) imp (b = bp)
	((not q) & (not p)) imp (c = cp)
END if_then_else2
--
ENTER_THEORY if_then_else2
--
Theorem if_then_else2.1: [Conditioned interchange of nested occurrences of if_then_else] if p then if q then a else b end if else c end if = if q then ap else if pp then bp else cp end if end if. Proof:
Suppose_not ==> AUTO
	Suppose ==> q
		Assump ==> (q imp (p & (a = ap)))
	Discharge ==> (not q)
	Assump ==> (not q) imp (p eq pp)
	Suppose ==> p
		Assump ==> ((not q) & p) imp (b = bp)
 	Discharge ==> (not p)
	Assump ==> ((not q) & (not p)) imp (c = cp)
Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY if_then_else2
--
--THEORY if_then_else2(q,p,a,b,c,pp,ap,bp,cp) [Conditioned interchange of nested occurrences of if_then_else]
--	(q imp (p & (a = ap)))
--	(not q) imp (p eq pp)
--	((not q) & p) imp (b = bp)
--	((not q) & (not p)) imp (c = cp)
--==>
--	if p then if q then a else b end if else c end if = if q then ap else if pp then bp else cp end if end if
--END if_then_else2
--
-- Next we introduce a third 'THEORY', which simply encapsulates the fact that the value of
-- a set former is defined uniquely by the expression and predicate it contains.
--
THEORY setformer(e(x),ep1(x),s,p(x),pp1(x))	[Elementary properties of setformers]
END setformer;
--
ENTER_THEORY setformer
--
-- The following theorem results easily by use of our mechanism of
-- variable substitution into setformers known to be different.
--
Def setformer.0: [Witness to difference of two setformers] x1_thryvar := arb({x in s | (e(x) /= e0(x) or (not(P(x) eq PP(x))))})
--
Theorem setformer.1: [Equality of setformers] ((x1_thryvar notin s) or ((e(x1_thryvar) = e0(x1_thryvar)) & (P(x1_thryvar) eq PP(x1_thryvar)))) imp
							({e(x): x in s | P(x)} = {e0(x): x in s | PP(x)}). Proof:
    Suppose_not ==> ((x1_thryvar notin s) or ((e(x1_thryvar) = e0(x1_thryvar)) & (P(x1_thryvar) eq PP(x1_thryvar)))) &
    		Stat1: ({e(x): x in s | P(x)} /= {e0(x): x in s | PP(x)})
--
-- For let $s$ be a counterexample to our assertion, and let $c$ be some element of one of the sets
-- ${e(x): x in s | P(x)}$ and ${e0(x): x in s | PP(x)}$ but not the other.
-- Supposing that $c$ belongs to the first of these sets but not the second, a
-- contradiction results immediately from the axiom of choice, and similarly in
-- the symmetric case. So the negative of our assertion leads to a contradiction in every case,
-- proving the present theorem.
--
    c-->Stat1 ==> (c in s) & ((e(c) /= e0(c)) or ((P(c) and (not PP(c))) or ((not P(c)) and PP(c))))
    Suppose ==> Stat2: c notin {x in s | (e(x) /= e0(x) or (not(P(x) eq PP(x))))}
    c-->Stat2 ==> false; Discharge ==> {x in s | (e(x) /= e0(x) or (not(P(x) eq PP(x))))} /= 0
    {x in s | (e(x) /= e0(x) or (not(P(x) eq PP(x))))}-->T0 ==>
    	arb({x in s | (e(x) /= e0(x) or (not(P(x) eq PP(x))))}) in {x in s | (e(x) /= e0(x) or (not(P(x) eq PP(x))))}
    Use_def(x1_thryvar) ==> Stat3: x1_thryvar in {x in s | (e(x) /= e0(x) or (not(P(x) eq PP(x))))}
	()-->Stat3 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The following small utility theory describes a few elementary cases
-- in which we can be sure that a set is non-null
--
THEORY setformer0(e(x),s,P(x))	[More elementary properties of setformers]
END setformer0;
--
ENTER_THEORY setformer0
--
-- The following theorem results easily by use of our mechanism of
-- variable substitution into a setformer known to be non-null.
--
Theorem setformer01: [Empty setformer lemma] (s /= 0) imp ({e(x): x in s} /= 0). Proof:
    Suppose_not ==> Stat1: (s /= 0) & Stat2: ({e(x): x in s} = 0)
    c-->Stat1 ==> AUTO
    c-->Stat2 ==> AUTO
    Discharge ==> QED
--
-- The following theorem also results easily by use of our mechanism of
-- variable substitution into a setformer known to be non-null.
--
Theorem setformer02: [Empty setformer lemma 2] ({x in s | P(x)} /= 0) imp ({e(x): x in s | P(x)} /= 0). Proof:
    Suppose_not ==> Stat1: AUTO
    (c)-->Stat1 ==> AUTO
    ELEM ==> Stat2: e(c) notin {e(x): x in s | P(x)}
    c-->Stat2 ==> AUTO
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The following utility theory is the two-variable analog of the 'setformer'
-- theory given above. It encapsulates the fact that the value of
-- a two-variable set former is defined uniquely by the expression and predicate it contains.
--
THEORY setformer2(e2(x,y),ep2(x,y),f(x),fp(x),s,R(x,y),PQ(x,y))
END setformer2;
--
ENTER_THEORY setformer2
--
Def setformer2.0a: [Witness to difference of two setformers, two-variable case] xy1_thryvar := arb({[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))})
Def setformer2.0b: [First component of difference witness] x2_thryvar := car(xy1_thryvar)
Def setformer2.0c: [Second component of difference witness] y2_thryvar := cdr(xy1_thryvar)
--
-- The following theorem results easily along the same line of proof used in proving Theorem setformer.1.
--
    Theorem setformer2_1: [Equality of mapformers] (((x2_thryvar notin s) or (y2_thryvar notin (f(x2_thryvar) + fp(x2_thryvar)))) or
    	(((f(x2_thryvar) = fp(x2_thryvar)) & (e2(x2_thryvar,y2_thryvar) = ep2(x2_thryvar,y2_thryvar)) &
    		(R(x2_thryvar,y2_thryvar) eq PQ(x2_thryvar,y2_thryvar))))) imp
    			({e2(x,y): x in s, y in f(x) | R(x,y)} = {ep2(x,y): x in s, y in fp(x) | PQ(x,y)}). Proof:
--
-- For let $s$ be a counterexample to our assertion, and let $c$ be some element of one of the sets
-- ${e2(x,y): x in s, y in f(x) | R(x,y)}$ and ${ep2(x,y): x in s, y in fp(x) | PQ(x,y)}$ but not the other.
-- Supposing that $c$ belongs to the first of these sets but not the second, a
-- contradiction results easily from the axiom of choice.
--
    Suppose_not ==> (((x2_thryvar notin s) or (y2_thryvar notin (f(x2_thryvar) + fp(x2_thryvar)))) or
    	(((f(x2_thryvar) = fp(x2_thryvar)) & (e2(x2_thryvar,y2_thryvar) = ep2(x2_thryvar,y2_thryvar)) &
    		(R(x2_thryvar,y2_thryvar) eq PQ(x2_thryvar,y2_thryvar))))) &
    		Stat1: ({e2(x,y): x in s, y in f(x) | R(x,y)} /= {ep2(x,y): x in s, y in fp(x) | PQ(x,y)})
    c-->Stat1 ==> (c in {e2(x,y): x in s, y in f(x) | R(x,y)}) eq (c notin {ep2(x,y): x in s, y in fp(x) | PQ(x,y)})
    Suppose ==> Stat2: (c in {e2(x,y): x in s, y in f(x) | R(x,y)}) & (c notin {ep2(x,y): x in s, y in fp(x) | PQ(x,y)})
--
-- Indeed, there must exist $x$ and $y$ in $s$ and $f(x)$ respectively for which $c = e2(x,y)$
-- but for which one of the clauses of $(y in fp(x)) & PQ(x,y) & (c = ep2(x,y))$ is false.
--
    (x,y,x,y)-->Stat2 ==> (x in s) & (y in f(x)) & R(x,y) & (c = e2(x,y)) &
    							(not((x in s) & (y in fp(x)) & PQ(x,y) & (c = ep2(x,y))))
    Suppose ==> Stat3: [x,y] notin {[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))}
    (x,y)-->Stat3 ==> false; Discharge ==>
    	{[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))} /= 0
--
-- This is easily seen to imply that the set
--
--	${[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))}$
--
-- is non-null, so that by the axiom of choice $xy1_thryvar$ is a member of it.
-- But then the components $x2_thryvar$ and  $y2_thryvar$ of $xy1_thryvar$ plainly
-- violate the hypotheses of the present theorem, and so rule out our initial supposition.
--
    {[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))}-->T0 ==>
    	arb({[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))}) in
    		{[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))}
    Use_def(xy1_thryvar) ==>
    	Stat4: xy1_thryvar in {[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))}
    (x2,y2)-->Stat4 ==> (xy1_thryvar = [x2,y2]) & (x2 in s) & (y2 in (f(x2) + fp(x2))) &
    		((f(x2) /= fp(x2)) or e2(x2,y2) /= ep2(x2,y2) or (not(R(x2,y2) eq PQ(x2,y2))))
    ELEM ==> (x2 = car(xy1_thryvar)) & (y2 = cdr(xy1_thryvar))
    Use_def(x2_thryvar) ==> x2_thryvar = x2
    Use_def(y2_thryvar) ==> y2_thryvar = y2
    EQUAL ==> false; Discharge ==>
    	Stat5: (c in {ep2(x,y): x in s, y in fp(x) | PQ(x,y)}) & (c notin {e2(x,y): x in s, y in f(x) | R(x,y)})
--
-- The same argument can be given in the symmetric case,
-- and so the negative of our assertion leads to a contradiction in every case,
-- proving the present theorem.
--
   (xx,yy,xx,yy)-->Stat5 ==> (xx in s) & (yy in fp(xx)) & PQ(xx,yy) & (c = ep2(xx,yy)) &
    						(not((xx in s) & (yy in f(xx)) & R(xx,yy) & (c = e2(xx,yy))))
    Suppose ==> Stat6: [xx,yy] notin {[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))}
   	(xx,yy)-->Stat6 ==> false; Discharge ==>
    	{[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))} /= 0
    {[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))}-->T0 ==>
    	arb({[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))}) in
    		{[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))}
    Use_def(xy1_thryvar) ==>
    	Stat7: xy1_thryvar in {[x,y]: x in s, y in (f(x) + fp(x)) | ((f(x) /= fp(x)) or e2(x,y) /= ep2(x,y) or (not(R(x,y) eq PQ(x,y))))}
    (x3,y3)-->Stat4 ==> (xy1_thryvar = [x3,y3]) & (x3 in s) & (y3 in (f(x3) + fp(x3))) &
    		((f(x3) /= fp(x3)) or e2(x3,y3) /= ep2(x3,y3) or (not(R(x3,y3) eq PQ(x3,y3))))
    ELEM ==> (x3 = car(xy1_thryvar)) & (y3 = cdr(xy1_thryvar))
    Use_def(x2_thryvar) ==> x2_thryvar = x3
    Use_def(y2_thryvar) ==> y2_thryvar = y3
    EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The following utility theory encapsulates the fact that given any set and predicate $P(x)$,
-- one can always obtain a (generally smaller) set consisting of precisely
-- those entities which satisfy $P$.
--
THEORY comprehension(s,P(x))
END comprehension;
--
ENTER_THEORY comprehension
--
-- We begin by defining the element considered in the proof which follows.
--
Def 00g: [Set former] tt_thryvar := {x in s | P(x)}
--
Theorem comprehension1: [Setformer existence] (X in tt_thryvar) eq ((X in s) & P(X)). Proof:
    Suppose_not(x) ==> not(((x in S) & P(x)) eq (x in tt_thryvar))
--
-- For the contrary assumption would lead to the following contradiction:
--
	Use_def(tt_thryvar) ==> not(((x in s) & P(x)) eq (x in {u in s | P(u)}))
	Suppose ==> (x in s) & P(x) & Stat1: (x notin {u in s | P(u)})
	x-->Stat1 ==> false; Discharge ==> (not ((x in S) & P(x))) & Stat2: (x in {u in s | P(u)})
	()-->Stat2 ==> false; Discharge ==> QED
--
Theorem comprehension2: [Setformer inclusion lemma] {x in s | P(x)} incin s. Proof:
    Suppose_not ==> Stat1: not({x in s | P(x)} incin s)
        x-->Stat1 ==> Stat2: (x in {x in s | P(x)}) & (x notin s)
    ()-->Stat2 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The following summarizes what has just been proved.
--
--DISPLAY comprehension
--
--THEORY comprehension(s,P(x))
--==>(tt_thryvar)
--	 (X in tt_thryvar) eq ((X in s) & P(X))
--	 {x in s | P(x)} incin s
--END comprehension;
--
-- Our more serious work now begins with proofs of the basic properties
-- of ordinals. Our first step is to give von Neumann's
-- definition of ordinals: an ordinal is a set which is transitively closed
-- and totally ordered under membership.
--
Def 10: [Is-an-ordinal predicate] Ord(S) := (FORALL x in S | x incin S) & (FORALL x in S, y in S | (x in y or y in x or x = y))
--
-- Next we prove a first basic property of ordinals: any member of an ordinal is an ordinal.
--
Theorem 12: [Members of ordinals are ordinals] (Ord(S) & (T in S)) imp Ord(T). Proof:
    Suppose_not(s,t) ==> AUTO
--
-- We proceed by contradiction. If our theorem is false, there is an ordinal $s$
-- having a member $t$ which is not an ordinal.
--
    Use_def(Ord) ==>
	Stat1: not((FORALL x in t | x incin t) & (FORALL x in t, y in t | (x in y or y in x or x = y)))
--
-- Hence, by definition of ordinal, $t$ must either have a member $a$ not included in $t$,
-- or a pair $b, c$ of distinct members not related by membership.
--
    (a,b,c)-->Stat1 ==> AUTO
--
-- But since $s$ is an ordinal, it must include its member $t$, so that the second case is impossible.
--
    Use_def(Ord) ==>
	Stat2: (FORALL x in s | x incin s) & Stat3: (FORALL x in s, y in s | (x in y or y in x or x = y))
    t-->Stat2 ==> AUTO
    Suppose ==> (b in t) & (c in t) & (not(b in c or c in b or b = c))
    (b,c)-->Stat3 ==> AUTO
    Discharge ==> Stat4: (not(a incin t)) & (a in t)
--
-- Thus we need only consider the first case, in which $a$ is a member but not a subset of $t$.
-- In this case there plainly exists a $d$ in $a$ but not in $t$. Plainly $a$ is a member of $s$,
-- and thus a subset of $s$; so $d$ is also a member of $s$.
--
     (d)-->Stat4 ==> (d in a) & (not(d in t))
     a-->Stat2 ==> a incin s
     ELEM ==> d in s
--
-- By definition of ordinal, it follows that $d$ either equals $t$, is a member of $t$, or that
-- $t$ is a member of $d$. But all three of these cases are impossible, since any would imply the
-- existence of a membership cycle. This contradiction proves our theorem.
--
     (d,t)-->Stat3 ==> (d in t or t in d or t = d)
     (Stat4)Discharge ==> QED
--
-- The following property of ordinals follows directly from their definition.
--
Theorem 13: [Ordinal membership implies inclusion] (Ord(S) & (T in S)) imp (T incin S). Proof:
     Suppose_not(s,t) ==> Ord(s) & (t in s) & (not (t incin s))
     Use_def(Ord) ==> Stat1: (FORALL x in s | x incin s)
     t-->Stat1 ==> false; Discharge ==> QED
--
-- We continue by considering and proving various useful forms of the principle of transfinite
-- induction, formulating  these as a succession of utility theories. We begin with an induction
-- principle for ordinals. This tells us that if an ordinal has a certain property, it must
-- include some subset which is an ordinal with this same property, but which contains no member
-- that has the property in question. In fact, this subset can be defined as $arb(aux_set)$, where
--	$aux_set := {x incin o | Ord(x) & P(x)}$.
--
THEORY ordinal_induction(o,P(x))
    Ord(o) & P(o)
END ordinal_induction;
--
ENTER_THEORY ordinal_induction
--
-- We begin by defining the element considered in the proof which follows.
--
Def ordinal_induction.0: [Witness for ordinal induction arguments] t_thryvar := arb({x incin o | Ord(x) & P(x)})
--
Theorem ord_ind1: [Transfinite induction principle] Ord(t_thryvar) & P(t_thryvar) & (t_thryvar incin o) & (FORALL x in t_thryvar | not P(x)). Proof:
	Suppose_not ==>
	Stat1: not((FORALL x in t_thryvar | not P(x)) & Ord(t_thryvar) & P(t_thryvar) & (t_thryvar incin o))
	c-->Stat1 ==> AUTO
--
-- We proceed by contradiction, and begin by noting that the set $aux_set$
-- displayed above is not empty.  Indeed, $o$ is obviously a member of it.
--
    Suppose ==> Stat2: {x incin o | Ord(x) & P(x)} = 0
    ELEM ==> Stat3: o notin {x incin o | Ord(x) & P(x)}
    o-->Stat3 ==> AUTO
    Assump ==> Ord(o) & P(o)
    Discharge ==> {x incin o | Ord(x) & P(x)} /= 0
--
-- The axiom of choice now tells us that $t_thryvar$ as defined above must be a minimal element of $aux_set$,
-- and so must clearly satisfy $Ord(t_thryvar) & P(t_thryvar) & (t_thryvar incin o)$.
-- This rules out the first of the two cases listed above, leaving only the second.
--
	Use_def(t_thryvar) ==> t_thryvar = arb({x incin o | Ord(x) & P(x)})
    {x incin o | Ord(x) & P(x)}-->T0 ==>
	Stat4: (t_thryvar in {x incin o | Ord(x) & P(x)}) & (t_thryvar * {x incin o | Ord(x) & P(x)} = 0)
    t_thryvar-->Stat4 ==> AUTO
    ELEM ==> (c in t_thryvar) & P(c)
--
-- Since $t_thryvar$ is an ordinal, it must by definition include its member $c$,
-- which must therefore also be a subset of $o$ and an ordinal.
--
    (t_thryvar,c)-->T13 ==> c incin t_thryvar
    ELEM ==> c incin o
    (t_thryvar,c)-->T12 ==> Ord(c)
--
-- Thus $c$ has the properties required to make it an element of $aux_set$.
-- But this contradicts the minimality of $t_thryvar$, and so proves our theorem.
--
   Suppose ==> Stat5: c notin {x incin o | Ord(x) & P(x)}
   (c)-->Stat5 ==> false; Discharge ==> c in {x incin o | Ord(x) & P(x)}
   Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The following small THEORY summarizes what has just been proved.
--
--DISPLAY ordinal_induction
--
--THEORY ordinal_induction(o,P(x))
--    Ord(o) & P(o)
--==>(t_thryvar)
--    Ord(t_thryvar) & P(t_thryvar) & (t_thryvar incin o) & (FORALL x in t_thryvar | not P(x))
--END ordinal_induction;
--
-- ************************************************************************************************
--			Section 2: Other versions of the principle of transfinite induction
-- ************************************************************************************************
--
-- Next we consider and prove several other forms of the principle of transfinite
-- induction which are sometimes easier to use.
-- We aim to show that if a set has a specified property, it contains
-- a subset having this property, none of whose members have the property.
-- The following definition, of the set of all elements which are linked to
-- a set $s$ by a chain of memberships, and so are its 'ultimate members',
-- starts to prepare for this.
--
Def 35a: [Transitive membership closure of $S$] Ult_membs(S) := S + {y: u in {Ult_membs(x): x in S}, y in u}
--
-- Our goal is to prove that $Ult_membs(S)$ includes $S$, and that $Ult_membs(S)$ is
-- transitively closed under membership. The proof of this
-- second fact, which is given somewhat below,  will involve use of the axiom of infinity.
-- The first of these facts, captured in the following lemma, is an immediate
-- consequence of the definition of $Ult_membs$.
--
Theorem 14: [Ultimate members lemma] S incin Ult_membs(S). Proof:
    Suppose_not(s) ==> AUTO
    Use_def(Ult_membs) ==> Ult_membs(s) = s + {y: u in {Ult_membs(x): x in s}, y in u}
    Discharge ==> QED
--
-- Our next small lemma simply reformulates the definition of $Ult_membs$ as an identity.
--
Theorem 15: [Ultimate members lemma 2] Ult_membs(S) = S + {v: x in S, v in Ult_membs(x)}. Proof:
    Suppose_not(s) ==> AUTO
    Use_def(Ult_membs) ==> Ult_membs(s) = s + {v: u in {Ult_membs(x): x in s}, v in u}
    SIMPLF ==> false; Discharge ==> QED
--
-- It follows immediately from the definition of $Ult_membs$ that $Ult_membs$
-- includes all the members of its members.
--
Theorem 16: [Key property of ultimate members set] ((X in S) & (Y in X)) imp (Y in Ult_membs(S)). Proof:
    Suppose_not(x,s,y) ==> AUTO
    s-->T15 ==> Stat1: y notin {v: x in s, v in Ult_membs(x)}
    (x,y)-->Stat1 ==> y notin Ult_membs(x)
    x-->T15 ==> y notin x
    Discharge ==> QED
--
-- For the special case of an ordinal $s$ we can show, using the
-- principle of ordinal induction established above, that $Ult_membs(s) = s$.
--
Theorem 17: [An ordinal is its own set of ultimate members] (Ord(S)) imp (Ult_membs(S) = S). Proof:
--
-- We proceed by contradiction. If our theorem is false, there is an ordinal $s$
-- which is not identical to $Ult_membs(s)$, and so, by Theorem 14, is not included in $s$.
--
    Suppose_not(s) ==> AUTO
    s-->T14 ==> Ord(s) & (not(Ult_membs(s) incin s))
--
-- Thus the principle of ordinal induction tells us that $s$ contains
-- a minimal ordinal $t$ with this property.
--
    APPLY(t_thryvar:t) ordinal_induction(o->s,P(x)->not(Ult_membs(x) incin x)) ==>
		Stat1: Ord(t) & (not(Ult_membs(t) incin t)) & Stat2: (FORALL x in t | not(not(Ult_membs(x) incin x)))
	a0-->Stat1 ==> Ord(t) & Stat3: (not(Ult_membs(t) incin t))
--
-- It follows that $Ult_membs(t)$ has an element $c$ which does not belong to $t$.
-- By Theorem 15, $c$ must belong to ${v: x in t, v in Ult_membs(x)}$, and so
-- there must exist an $x in t$ such that $c in Ult_membs(x)$.
--
    c-->Stat3 ==> AUTO
    t-->T15 ==> Stat4: c in {v: x in t, v in Ult_membs(x)}
    (x,v)-->Stat4 ==> AUTO
--
-- By Stat2 above, $x$ must satisfy $Ult_membs(x) incin x$, so $c$ must belong to $x$.
--
    x-->Stat2 ==> (Ult_membs(x) incin x) & (c in x)
--
-- Since $t$ is an ordinal, its member $x$ must be included in it; so $c$ must be a member of $t$,
-- contrary to what has been proved above. This contradiction proves our theorem.
--
    (t,x)-->T13 ==> x incin t
    Discharge ==> QED
--
-- Our next small lemma expresses $Ult_membs({s})$ in terms of $Ult_membs(s)$.
--
Theorem 18: [Ultimate members of a singleton] Ult_membs({S}) = {S} + Ult_membs(S). Proof:
    Suppose_not(s) ==> Ult_membs({s}) /= {s} + Ult_membs(s)
    Use_def(Ult_membs) ==> Ult_membs({s}) = {s} + {y: u in {Ult_membs(x): x in {s}}, y in u}
    ELEM ==> {s} + {y: u in {Ult_membs(x): x in {s}}, y in u} /= {s} + Ult_membs(s)
--
-- If our theorem were false, we could use the definition of $Ult_membs$ to obtain the
-- set inequality displayed above, which simplifies to an impossibility:
--
    SIMPLF ==> {y: u in {Ult_membs(x): x in {s}}, y in u} = {y: x in {s}, y in Ult_membs(x)}
    SIMPLF ==> {y: x in {s}, y in Ult_membs(x)} = {y: y in Ult_membs(s)}
    SIMPLF ==> {y: y in Ult_membs(s)} = Ult_membs(s)
    Discharge ==> QED
--
-- We also note the following elementary consequence of Theorem 17 and Theorem 18,
-- which tells us that the set of ultimate members of a singleton
-- consisting of just one ordinal is its successor ordinal.
--
Theorem 19: [Ultimate members of an ordinal singleton] Ord(S) imp (Ult_membs({S}) = S + {S}). Proof:
    Suppose_not(s) ==> AUTO
    s-->T18 ==> AUTO
    s-->T17 ==> false; Discharge ==> QED
--
-- The 'union set' of a set $s$ is the union of all its members, or, equivalently,
-- the set of all members of members of $s$. For sets of ordinals, this is the least upper bound.
--
Def 25: [Union Set] Un(S) := {x: y in S, x in y}
--
-- Now we start to prepare more closely for the proof of a preliminary version of the principle
-- of transfinite induction by making a few auxiliary definitions.
-- First we introduce 'the set of all $x$ which are either members of $s$ or members of members of $s$:'
--
	Def 7g: [Set of members of members] membs2(S) := S + Un(S)
--
-- Next, using the axiom of infinity and the set $s_inf$ which it provides,
-- we extend this definition recursively.
--
	Def 7h: [Recursively defined iterated members] membs_x(S,X) := if X = arb(s_inf) then S else membs2(Un({membs_x(S,y): y in X})) end if
--
-- This lets us define a set including $s$ which we will show to be transitively closed under membership.
--
	Def 7i: [Ultimate members of a set, first definition] Ult_memb1(S) := Un({membs_x(S,x): x in s_inf})
--
-- First we need the following simple lemma:
--
Theorem 20: [Ultimate members of the basic infinite set] (X in s_inf) imp (membs_x(S,{X}) = membs_x(S,X) + Un(membs_x(S,X))). Proof:
	Suppose_not(x,s) ==> (x in s_inf) & (membs_x(s,{x}) /= membs_x(s,x) + Un(membs_x(s,x)))
--
-- Since $x in s_inf$, ${x} /= arb(s_inf)$,
-- and so $membs_x(s,{x}) = membs2(Un({membs_x(s,y): y in {x}}))$ by definition.
--
	ELEM ==> {x} /= arb(s_inf)
	Use_def(membs_x) ==> membs_x(s,{x}) = if {x} = arb(s_inf) then s else membs2(Un({membs_x(s,y): y in {x}})) end if
	ELEM ==> membs2(Un({membs_x(s,y): y in {x}})) /= membs_x(s,x) + Un(membs_x(s,x))
--
-- This inequality simplifies to $membs2(membs_x(s,x)) /= membs_x(s,x) + Un(membs_x(s,x))$,
-- which contradicts the definition of $membs2(membs_x(s,x))$, and so proves our lemma.
--
	SIMPLF ==> membs2(Un({membs_x(s,x)})) /= membs_x(s,x) + Un(membs_x(s,x))
	Use_def(Un) ==> membs2({u: y in {membs_x(s,x)}, u in y}) /= membs_x(s,x) + Un(membs_x(s,x))
	SIMPLF ==> {u: y in {membs_x(s,x)}, u in y} = {u: u in membs_x(s,x)}
	SIMPLF ==> {u: u in membs_x(s,x)} = membs_x(s,x)
	EQUAL ==> membs2(membs_x(s,x)) /= membs_x(s,x) + Un(membs_x(s,x))
	Use_def(membs2) ==> false; Discharge ==> QED
--
-- Now we can prove that, for any set $s$, $Ult_memb1(s)$ includes $s$ and is membership-transitive.
--
Theorem 21: [Ultimate members lemma 3] (S incin Ult_memb1(S)) & (((X in Ult_memb1(S)) & (Y in X)) imp (Y in Ult_memb1(S))). Proof:
--
-- We proceed by contradiction. Suppose that our theorem is false, and let $s$, $x$, and $y$ be a counterexample.
--
	Suppose_not(s,x,y) ==> ((not(s incin Ult_memb1(s))) or ((x in Ult_memb1(s)) & (y in x) & (y notin Ult_memb1(s))))
--
-- The first of these cases is impossible, since an $xx$ in $s$ but not in $Ult_memb1(s)$ could not be in any
-- of the sets $membs_x(s,v)$ where $v$ belongs to $s_inf$, contradicting the fact that $arb(s_inf)$ and ${arb(s_inf)}$
-- both belong to $s_inf$, while $membs_x(s,{arb(s_inf)}) incs membs_x(s,arb(s_inf))$ = $s$.
-- Hence we need only consider the second case.
--
	Suppose ==> Stat1: not(s incin Ult_memb1(s))
	xx-->Stat1 ==> (xx in s) & (xx notin Ult_memb1(s))
	Use_def(Ult_memb1) ==> xx notin Un({membs_x(s,v): v in s_inf})
	Use_def(Un) ==> xx notin {y: u in {membs_x(s,v): v in s_inf}, y in u}
	SIMPLF ==> Stat2: xx notin {y: v in s_inf, y in membs_x(s,v)}
	T00 ==> s_inf /= 0 and Stat3: (FORALL v in s_inf | {v} in s_inf)
	s_inf-->T0 ==> arb(s_inf) in s_inf
	(arb(s_inf))-->Stat3 ==> {arb(s_inf)} in s_inf
	({arb(s_inf)},xx)-->Stat2 ==> not(xx in membs_x(s,{arb(s_inf)}))
	(arb(s_inf),s)-->T20 ==> xx notin membs_x(s,arb(s_inf))
	Use_def(membs_x) ==> membs_x(s,arb(s_inf)) = s
	Discharge ==> Stat4: (x in Ult_memb1(s)) & (y in x) & (y notin Ult_memb1(s))
--
-- But in this case there must exist some $d$ in $s_inf$ such that $x$ in $membs_x(s,d)$,
-- and then $membs_x(s,{d}) = membs_x(s,d) + {w: v in membs_x(s,d), w in v}$ must have $y$ as a member.
-- Since ${d}$ is a member of $s_inf$, this contradicts the fact that $y notin Ult_memb1(s)$,
-- and so proves our theorem.
--
	Use_def(Ult_memb1) ==> x in Un({membs_x(s,v): v in s_inf})
	Use_def(Un) ==> x in {w: u in {membs_x(s,v): v in s_inf}, w in u}
	SIMPLF ==> Stat5: x in {w: v in s_inf, w in membs_x(s,v)}
	(d,w)-->Stat5 ==> (d in s_inf) & (x in membs_x(s,d))
	(d)-->Stat3 ==> {d} in s_inf
	Use_def(Ult_memb1) ==> y notin Un({membs_x(s,v): v in s_inf})
	Use_def(Un) ==> y notin {w: u in {membs_x(s,v): v in s_inf}, w in u}
	SIMPLF ==> Stat6: y notin {w: v in s_inf, w in membs_x(s,v)}
	({d},y)-->Stat6 ==> y notin membs_x(s,{d})
	(d,s)-->T20 ==> membs_x(s,{d}) = membs_x(s,d) + Un(membs_x(s,d))
	ELEM ==> y notin Un(membs_x(s,d))
	Use_def(Un) ==> Stat7: y notin {u: v in membs_x(s,d), u in v}
	(x,y)-->Stat7 ==> not((x in membs_x(s,d)) & (y in x))
	Discharge ==> QED
--
-- Next we state a preliminary form of the principle of transfinite induction,
-- which simply asserts that if there is any $n$ satisfying a predicate $P$, there is a minimal $m$ such that $P(m)$.
-- Since an 'arbitrary predicate' is involved, we formulate this as a theory providing just one theorem.
--
THEORY transfinite_induction(n,P(x))
    P(n)
END transfinite_induction;
--
ENTER_THEORY transfinite_induction
--
 	Def transfinite_induction.0: [Witness for transfinite induction argument] mt1_thryvar := arb({m: m in Ult_memb1({n}) | P(m)})
--
Theorem transfinite_induction.1: [Transfinite membership induction] P(mt1_thryvar) & ((K in mt1_thryvar) imp (not P(K))). Proof:
    Suppose_not(k) ==> (not P(mt1_thryvar)) or ((k in mt1_thryvar) & P(k))
--
-- Proceed by contradiction, first noting that ${m: m in Ult_memb1({n}) | P(m)}$ cannot be empty since
-- $n$ belongs to it.
--
    Suppose ==> Stat1: {m: m in Ult_memb1({n}) | P(m)} = 0
    ({n},junk,bunk)-->T21 ==> n in Ult_memb1({n})
    Assump ==> P(n)
    n-->Stat1 ==> false; Discharge ==> {m: m in Ult_memb1({n}) | P(m)} /= 0
--
-- The axiom of choice now tells us that there is a minimal element $mt1_thryvar$ of ${m: m in Ult_memb1({n}) | P(m)}$.
-- This necessarily satisfies $mt1_thryvar in Ult_memb1({n}) & P(mt1_thryvar)$.
--
    ({m: m in Ult_memb1({n}) | P(m)})-->T0 ==> (arb({m: m in Ult_memb1({n}) | P(m)}) in {m: m in Ult_memb1({n}) | P(m)}) &
	((arb({m: m in Ult_memb1({n}) | P(m)}) * {m: m in Ult_memb1({n}) | P(m)}) = 0)
    Use_def(mt1_thryvar) ==> Stat2: (mt1_thryvar in {u: u in Ult_memb1({n}) | P(u)}) & (mt1_thryvar * {u: u in Ult_memb1({n}) | P(u)} = 0)
    mt1_thryvar-->Stat2 ==> (mt1_thryvar in Ult_memb1({n})) & P(mt1_thryvar)
--
-- The negative of our theorem now tells us that there is a $k in mt1_thryvar$ such that $P(k)$; but
-- such a $k$ would clearly belong to ${u: Ult_memb1({n}) | P(u)}$, and so contradict the minimality of $mt1_thryvar$.
-- This contradiction proves our theorem.
	({n},mt1_thryvar,k)-->T21 ==> k in Ult_memb1({n})
	Suppose ==> Stat3: k notin {u: u in Ult_memb1({n}) | P(u)}
	k-->Stat3 ==> false; Discharge ==> k in {u: u in Ult_memb1({n}) | P(u)}
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- Now we have a preliminary form of the principle of transfinite induction,
-- which is given by the following theory:
--
--DISPLAY transfinite_induction
--
--THEORY transfinite_induction(n,P(x))
--    P(n)
--==>(mt1_thryvar)
--    (FORALL k | P(mt1_thryvar) & ((k in mt1_thryvar) imp (not P(k))))
--END transfinite_induction;
--
-- We go on to sharpen the preceding results by proving that the minimal element
-- whose existence is asserted in the preceding theory can actually be taken to be
-- an element of $Ult_membs({n})$. For this, a few preparatory results are needed.
-- The first of these applies $transfinite_induction$ to show that $Ult_membs(S)$ itself
-- is transitively closed under membership.
--
Theorem 22: [Monotonicity of ultimate members set] (Y in Ult_membs(S)) imp (Ult_membs(Y) incin Ult_membs(S)). Proof:
    Suppose_not(yy,s) ==> (yy in Ult_membs(s)) & (not(Ult_membs(yy) incin Ult_membs(s)))
--
-- We proceed by contradiction. If our theorem is false, there exist an $s$ and a $yy in Ult_membs(s)$
-- which contradict it, which therefore have the property stated above. But, by
-- $transfinite_induction$, this implies the existence of a minimal $t$ with the property
-- that there exists a $y in Ult_membs(t)$ such that $(not(Ult_membs(y) incin Ult_membs(t)))$.
-- Consider a $y$ related in this way to $t$.
--
    Suppose ==> Stat1: not(EXISTS y | (y in Ult_membs(s)) & (not(Ult_membs(y) incin Ult_membs(s))))
    yy-->Stat1 ==> false; Discharge ==> (EXISTS y | (y in Ult_membs(s)) & (not(Ult_membs(y) incin Ult_membs(s))))
    APPLY(mt1_thryvar:t) transfinite_induction(n->s,P(x)->(EXISTS y | (y in Ult_membs(x)) & (not(Ult_membs(y) incin Ult_membs(x))))) ==>
		Stat2: (FORALL x | (EXISTS y | (y in Ult_membs(t)) & (not(Ult_membs(y) incin Ult_membs(t)))) &
			((x in t) imp (not(EXISTS y | (y in Ult_membs(x)) & (not(Ult_membs(y) incin Ult_membs(x)))))))
	a0-->Stat2 ==> Stat3: (EXISTS y | (y in Ult_membs(t)) & (not(Ult_membs(y) incin Ult_membs(t))))
    y-->Stat3 ==> (y in Ult_membs(t)) & Stat4: (not(Ult_membs(y) incin Ult_membs(t)))
--
-- Plainly, there must exist a $c in Ult_membs(y)$ which is not in $Ult_membs(t)$.
-- Since $Ult_membs(t) incs {v: u in t, v in Ult_membs(u)}$ by Theorem 15,
-- it follows that c is not in this latter set either.
--
    t-->T15 ==> Ult_membs(t) = t + {v: u in t, v in Ult_membs(u)}
    c-->Stat4 ==> (c in Ult_membs(y)) & (c notin Ult_membs(t)) & Stat5: (c notin {v: u in t, v in Ult_membs(u)})
--
-- $y$ cannot be in $t$, since this would contradict Stat6
-- hence $y$ must be in ${v: u in t, v in Ult_membs(u)}$,
-- and so there must exist a $u in t$ such that $y in Ult_membs(u)$.
--
    Suppose ==> y in t
    (y,c)-->Stat5 ==> c notin Ult_membs(y)
    Discharge ==> Stat7: y in {v: u in t, v in Ult_membs(u)}
    (u,v)-->Stat7 ==> (u in t) & (y in Ult_membs(u))
--
-- But now, by the minimality of $t$, $Ult_membs(y)$ must be included in $Ult_membs(u)$,
-- and therefore $Ult_membs(u)$ cannot be included in $Ult_membs(t)$,
-- from which it follows that there must exist a $d in Ult_membs(u)$
-- which is not in ${v: w in t, v in Ult_membs(w)}$; hence, since $u in t$,
-- $d$ cannot be in $Ult_membs(u)$, contradicting its definition.
-- This contradiction proves our theorem.
--
    u-->Stat2 ==> Stat8: (not(EXISTS y | (y in Ult_membs(u)) & (not(Ult_membs(y) incin Ult_membs(u)))))
    y-->Stat8 ==> Ult_membs(y) incin Ult_membs(u)
    ELEM ==> Stat9: not(Ult_membs(u) incin Ult_membs(t))
    d-->Stat9 ==> (d in Ult_membs(u)) & Stat10: (d notin {v: w in t, v in Ult_membs(w)})
    (u,d)-->Stat10 ==> not(u in t & d in Ult_membs(u))
    Discharge ==> QED
--
-- Since we know by Theorem 15 that $s incin Ult_membs(s)$, it follows
-- immediately from the preceding theorem that $Ult_membs(s)$ includes every one of its members.
--
Theorem 23: [Members of ultimate members are also subsets] (Y in Ult_membs(S)) imp (Y incin Ult_membs(S)). Proof:
    Suppose_not(y,s) ==> (y in Ult_membs(s)) & (not (y incin Ult_membs(s)))
    (y,s)-->T22 ==> Ult_membs(y) incin Ult_membs(s)
    y-->T15 ==> false; Discharge ==> QED
--
-- The preceding results easily yield the fact, captured in the following theory,
-- that if there exists an $n$ with a given property $P$ then either $n$ (if it is minimal) or
-- some other minimal element of the set of ultimate members of $n$ has the property $P$.
--
THEORY transfinite_member_induction(n,P(x))
    P(n)
END transfinite_member_induction;
--
ENTER_THEORY transfinite_member_induction
--
-- To derive the result stated just below,  we first define
-- the minimal element that we want, whose properties
-- are then established in the theorem following the definition.
--
Def 00h: [Restricted witness for transfinite induction argument] mt2_thryvar := arb({k in Ult_membs({n}) | P(k)})
--
Theorem transfinite_member_induction1: [Ultimate members and transfinite induction] P(mt2_thryvar) & (mt2_thryvar in Ult_membs({n})) & ((K in mt2_thryvar) imp (not P(K))). Proof:
    Suppose_not(k) ==> Stat1: (not P(mt2_thryvar)) or (mt2_thryvar notin Ult_membs({n})) or ((k in mt2_thryvar) & P(k))
--
-- We proceed by contradiction. If our theorem is false, there exists a $k in m$ such that $P(k)$.
-- But, since $n$ is clearly a member of ${j: j in Ult_membs({n}) | P(j)}$, this set cannot be null, so
-- by the axiom of choice $mt2_thryvar$ must belong to it, but not intersect it.
--
    Suppose ==> Stat2: {j in Ult_membs({n}) | P(j)} = 0
    n-->T18(*) ==> Stat3: n in Ult_membs({n})
    Assump ==> P(n)
    n-->Stat2(Stat3*) ==> false; Discharge ==> Stat4: {j in Ult_membs({n}) | P(j)} /= 0
    Use_def(mt2_thryvar)(Stat4*) ==> mt2_thryvar = arb({k in Ult_membs({n}) | P(k)})
    {j in Ult_membs({n}) | P(j)}-->T0(Stat4*) ==>
	 Stat5: (mt2_thryvar in {j in Ult_membs({n}) | P(j)}) & (mt2_thryvar * {j in Ult_membs({n}) | P(j)} = 0)
    mt2_thryvar-->Stat5(Stat5*) ==> Stat6: (mt2_thryvar in Ult_membs({n})) & P(mt2_thryvar)
--
-- Thus $P(mt2_thryvar)$ and $(mt2_thryvar in Ult_membs({n}))$ are both true, so that $k in mt2_thryvar$ and $P(k)$ must both be true.
-- Since $Ult_membs(mt2_thryvar) incs mt2_thryvar$ by definition, $k$ must belong to $Ult_membs(mt2_thryvar)$, and hence to
-- $Ult_membs({n})$ by Theorem 23, which tells us that $Ult_membs(mt2_thryvar)$ is a subset of $Ult_membs({n})$
--
    (Stat1,Stat6*)ELEM ==> Stat7: (k in mt2_thryvar) & P(k)
    Suppose ==> k notin Ult_membs(mt2_thryvar)
    Use_def(Ult_membs) ==> Ult_membs(mt2_thryvar) = (mt2_thryvar + {w: u in {Ult_membs(v): v in mt2_thryvar}, w in u})
    (Stat7*)Discharge ==> k in Ult_membs(mt2_thryvar)
    (mt2_thryvar,{n})-->T23(Stat6,Stat7*) ==> Stat8: k in Ult_membs({n})
    Suppose ==> Stat9: k notin {j in Ult_membs({n}) | P(j)}
--
-- Hence $k$ belongs to ${j in Ult_membs({n}) | P(j)}$, a contradiction which proves our theorem.
--
    ()-->Stat9(Stat8,Stat7*) ==> false; Discharge ==> Stat10: k in {j in Ult_membs({n}) | P(j)}
    (Stat7,Stat10,Stat5*)Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- Formulated as a theory, the preceding result appears as follows.
--
--DISPLAY transfinite_member_induction
--
--THEORY transfinite_member_induction(n,P(x))
--    P(n)
--==>(mt2_thryvar)
--    (FORALL k | P(mt2_thryvar) & (mt2_thryvar in Ult_membs({n})) & ((k in mt2_thryvar) imp (not P(k))))
--END transfinite_member_induction;
--
THEORY_otter orderedGroups(In_domain(x),pluz(x,y),e,rvz(x),nneg(x),leq(x,y))
	In_domain(e)	 								-- closure axiom
	(FORALL x,y | (In_domain(x) & In_domain(y)) imp In_domain(pluz(x,y)))		-- closure axiom
	(FORALL x | In_domain(x) imp In_domain(rvz(x)))				-- closure axiom
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) imp (pluz(pluz(x,y),z) = pluz(x,pluz(y,z)))) -- associativity
	(FORALL x | In_domain(x) imp (pluz(x,e) = x))	 -- right unit
	(FORALL x | In_domain(x) imp (pluz(x,rvz(x)) = e))	 -- right inverse
	(FORALL x,y | (In_domain(x) & In_domain(y)) imp (pluz(x,y) = pluz(y,x)))	 -- commutativity
	(FORALL x,y | (In_domain(x) & In_domain(y)) imp ((nneg(x) & nneg(y)) imp nneg(pluz(x,y))))
	(FORALL x | In_domain(x) imp (nneg(x) or nneg(rvz(x))))
	(FORALL x | In_domain(x) imp ((nneg(x) & nneg(rvz(x))) imp (x = e)))
	(FORALL x,y | (In_domain(x) & In_domain(y)) imp (leq(x,y) = nneg(pluz(y,rvz(x)))))
	ExtDef abs_thryvar(x) := if nneg(x) then x else rvz(x) end if
==>
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) imp ((pluz(x,y) = pluz(x,z)) imp (y = z))) 	[A1] -- cancellation law
	(FORALL x,y | (In_domain(x) & In_domain(y)) imp (rvz(pluz(x,rvz(y))) = pluz(y,rvz(x))))	[B]
	(FORALL x,y | (In_domain(x) & In_domain(y)) imp (leq(x,y) or leq(y,x)))			[C] -- totality
	(FORALL x | In_domain(x) imp (leq(x,x))) 							[D] -- reflexivity
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) imp ((leq(x,y) & leq(y,z)) imp leq(x,z))) 	[E] -- transitivity
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) imp ((leq(x,y) & (x /= y) & leq(y,z)) imp (x /= z)))	[E1] -- transitivity
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) imp ((leq(x,y) & leq(y,z) & (y /= z)) imp (x /= z)))	[E2] -- transitivity
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) imp (leq(x,y) imp leq(pluz(x,z),pluz(y,z)))) 		[F] -- isotony
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) imp ((pluz(x,z) = pluz(y,z)) imp (x = y))) 		[A2] -- cancellation law
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) imp ((leq(x,y) & (x /= y)) imp (pluz(x,z) /= pluz(y,z)))) [F1] -- strictness of isotony
	(FORALL x | In_domain(x) imp (abs_thryvar(pluz(x,rvz(x))) = e)) 						[1]
	(FORALL x | In_domain(x) imp (leq(x,abs_thryvar(x))))							[2]
	(FORALL x | In_domain(x) imp (abs_thryvar(abs_thryvar(x)) = abs_thryvar(x)))					[3]
	(FORALL x | In_domain(x) imp ((abs_thryvar(x) = e) eq (x = e)))						[4]
	(FORALL x | In_domain(x) imp (abs_thryvar(rvz(x)) = abs_thryvar(x)))						[5]
	(FORALL x,y | (In_domain(x) & In_domain(y)) imp (leq(pluz(x,y),pluz(abs_thryvar(x),abs_thryvar(y)))))	[6]
	(FORALL x,y | (In_domain(x) & In_domain(y)) imp (leq(abs_thryvar(pluz(x,y)),pluz(abs_thryvar(x),abs_thryvar(y)))))	[7]
	(FORALL x,y | (In_domain(x) & In_domain(y)) imp ((not(nneg(x))) imp (leq(x,abs_thryvar(y)) & (x /= abs_thryvar(y)))))	[8]
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) imp (leq(abs_thryvar(pluz(x,rvz(y))),z) imp leq(y,pluz(x,z))))	[9]
--	$(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) imp (pluz(x,z) = pluz(pluz(x,rvz(y)),pluz(y,z))))$ [10a]
	(FORALL x,y,z | (In_domain(x) & In_domain(y) & In_domain(z)) imp (leq(abs_thryvar(pluz(x,rvz(z))),pluz(abs_thryvar(pluz(x,rvz(y))),abs_thryvar(pluz(y,rvz(z))))))) [10]   -- (proved sans axioms)
	(FORALL x,y | (In_domain(x) & In_domain(y)) imp (nneg(y) imp leq(pluz(x,rvz(y)),pluz(x,y))))		[11]
--	$(FORALL x,y | (In_domain(x) & In_domain(y)) imp ((nneg(x) & (not(nneg(y)))) imp leq(abs_thryvar(pluz(abs_thryvar(x),rvz(abs_thryvar(y)))),abs_thryvar(pluz(x,rvz(y))))))$	[12a]
--	$(FORALL x,y | (In_domain(x) & In_domain(y)) imp ((nneg(x) & nneg(y)) imp (abs_thryvar(pluz(abs_thryvar(x),rvz(abs_thryvar(y)))) = abs_thryvar(pluz(x,rvz(y))))))$ [12b]
--	$(FORALL x,y | (In_domain(x) & In_domain(y)) imp (((not(nneg(x))) & (not(nneg(y)))) imp (abs_thryvar(pluz(abs_thryvar(rvz(x)),rvz(abs_thryvar(rvz(y))))) = abs_thryvar(pluz(rvz(x),y)))))$	[12c]
	(FORALL x,y | (In_domain(x) & In_domain(y)) imp (leq(abs_thryvar(pluz(abs_thryvar(x),rvz(abs_thryvar(y)))),abs_thryvar(pluz(x,rvz(y))))))		[12]
	(FORALL x,y | (In_domain(x) & In_domain(y)) imp (leq(pluz(abs_thryvar(x),rvz(abs_thryvar(pluz(abs_thryvar(y),rvz(abs_thryvar(x)))))),abs_thryvar(y))))	[13]
END orderedGroups;
--
--
-- ************************************************************************************************
--			Section 3: Additional basic operations of set theory; properties of setformers
-- ************************************************************************************************
--
-- Next we define various familiar notions of set theory: (possibly multivalued) maps,
-- their ranges and domains, and the subclasses of single valued and 1-1 maps.
-- After giving these definitions we build up a few small utility theories which
-- ease subsequent work with these predicates.
--
Def 4: [Is-a-map predicate] Is_map(F) := F = {[car(x),cdr(x)]: x in F}
Def 5: [Map domain] domain(F) := {car(x): x in F}
Def 6: [Map range] range(F) := {cdr(x): x in F}
Def 7: [Single-valued map predicate] Svm(F) := Is_map(F) & (FORALL x in F, y in F | (car(x) = car(y)) imp (x = y))
Def 8: [One-one map predicate] one_1_map(F) := Svm(F) & (FORALL x in F, y in F | (cdr(x) = cdr(y)) imp (x = y))
--
-- A set has a null range or a null domain if and oly if it is null.
--
Theorem 24: [Only the null set has a null domain] (S = 0) eq (domain(S) = 0). Proof:
	Suppose_not(s) ==> AUTO
	Suppose ==> (s = 0) & (domain(s) /= 0)
	Use_def(domain) ==> Stat1: {car(x): x in s} /= 0
		c-->Stat1 ==> Stat2: c in {car(x): x in s}
	x-->Stat2 ==> false; Discharge ==> (domain(s) = 0) & Stat3: (s /= 0)
	x2-->Stat3 ==> x2 in s
	Use_def(domain) ==> Stat4: car(x2) notin {car(x): x in s}
	x2-->Stat4 ==> false; Discharge ==> QED
--
Theorem 25: [Only the null set has a null range] (S = 0) eq (range(S) = 0). Proof:
	Suppose_not(s) ==> AUTO
	Suppose ==> (s = 0) & (range(s) /= 0)
	Use_def(range) ==> Stat1: {cdr(x): x in s} /= 0
		c-->Stat1 ==> Stat2: c in {cdr(x): x in s}
	x-->Stat2 ==> false; Discharge ==> (range(s) = 0) & Stat3: (s /= 0)
	x2-->Stat3 ==> x2 in s
	Use_def(range) ==> Stat4: cdr(x2) notin {cdr(x): x in s}
	x2-->Stat4 ==> false; Discharge ==> QED

--
-- Our next elementary result states that a set $f$ is a map if and only if
-- every element in it is an ordered pair.
--
Theorem 26: [Maps are mapformers] Is_map(F) eq (F incin {[car(x),cdr(x)]: x in F}). Proof:
    Suppose_not(f) ==> not(Is_map(f) eq (f incin {[car(x),cdr(x)]: x in f}))
--
-- For if we suppose the contrary and use the definition of $Is_map$, we see that
-- some element $c notin f$ must have the form $c = [car(d),cdr(d)]$, where $d in f$ and
-- so in turn must have the form $d = [car(e),cdr(e)]$ with $e in f$, implying $d = e$ and so
-- leading to an immediate contradiction.
--
	Use_def(Is_map) ==> Stat1: (f incin {[car(x),cdr(x)]: x in f}) & Stat2: (f /= {[car(x),cdr(x)]: x in f})
	c-->Stat2(Stat1*) ==> Stat3: (c notin f) & Stat4: (c in {[car(x),cdr(x)]: x in f})
	d-->Stat4(Stat3*) ==> Stat5: (d in f) & (c = [car(d),cdr(d)])
	(Stat5,Stat1*)ELEM ==> Stat6: (d in {[car(x),cdr(x)]: x in f})
	e-->Stat6(Stat6) ==> Stat7: d = [car(d),cdr(d)]
    (Stat3,Stat5,Stat7*)Discharge ==> QED
--
-- The next small theory simply tells us that any setformer of the form ${[a(x),b(x)]: x in s}$
-- is a map. The proof of the one theorem it provides is an elementary consequence
-- of the definition of 'Is_map'
--
THEORY Iz_map(a(x),b(x),s)
END Iz_map;
--
ENTER_THEORY Iz_map
--
Theorem iz_map.1: [Mapformers are maps] Is_map({[a(x),b(x)]: x in s}) & (domain({[a(x),b(x)]: x in s}) = {a(x): x in s}) & (range({[a(x),b(x)]: x in s}) = {b(x): x in s}). Proof:
    Suppose_not ==> AUTO
    Use_def(domain) ==> domain({[a(x),b(x)]: x in s}) = {car(y): y in {[a(x),b(x)]: x in s}}
    SIMPLF ==> domain({[a(x),b(x)]: x in s}) = {car([a(x),b(x)]): x in s}
    Suppose ==> Stat1: {car([a(x),b(x)]): x in s} /= {a(x): x in s}
    c1-->Stat1 ==> false; Discharge ==> domain({[a(x),b(x)]: x in s}) = {a(x): x in s}
    Use_def(range) ==> range({[a(x),b(x)]: x in s}) = {cdr(y): y in {[a(x),b(x)]: x in s}}
    SIMPLF ==> range({[a(x),b(x)]: x in s}) = {cdr([a(x),b(x)]): x in s}
    Suppose ==> Stat2: {cdr([a(x),b(x)]): x in s} /= {b(x): x in s}
    c2-->Stat2 ==> false; Discharge ==> range({[a(x),b(x)]: x in s}) = {b(x): x in s}
    Use_def(Is_map) ==> {[a(x),b(x)]: x in s} /= {[car(x),cdr(x)]: x in {[a(x),b(x)]: x in s}}
    SIMPLF ==> Stat3: {[a(x),b(x)]: x in s} /= {[car([a(x),b(x)]),cdr([a(x),b(x)])]: x in s}
    c-->Stat3 ==> AUTO
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Iz_map
--
--THEORY Iz_map(a(x),b(x),s)
--==>
--    Is_map({[a(x),b(x)]: x in s}) & (domain({[a(x),b(x)]: x in s}) = {a(x): x in s}) & (range({[a(x),b(x)]: x in s}) = {b(x): x in s})
--END Iz_map;
--
-- The two small theories which follow extend 'Iz_map' to the 2- and 3-variable cases respectively.
--
THEORY Iz_map_2(a2(x,y),b2(x,y),s,t,P2(x,y))
END Iz_map_2;
--
ENTER_THEORY Iz_map_2
--
-- The proof of the one theorem of this theory is very close to, and just as elementary as,
-- the corresponding one-variable result.
--
Theorem iz_map_2.1: [Two-variable mapformers] Is_map({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}). Proof:
    Suppose_not ==> AUTO
    Use_def(Is_map) ==> {[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)} /= {[car(x),cdr(x)]: x in {[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}}
    SIMPLF ==> Stat1: {[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)} /= {[car([a2(x,y),b2(x,y)]),cdr([a2(x,y),b2(x,y)])]: x in s, y in t | P2(x,y)}
    (c,d)-->Stat1 ==> AUTO
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Iz_map_2
--
--THEORY Iz_map_2(a2(x,y),b2(x,y),s,t,P2(x,y))
--==>
--    Is_map({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)})
--END Iz_map_2;
--
THEORY Iz_map_3(a3(x,y,z),b3(x,y,z),s,t,u,P3(x,y,z))
END Iz_map_3;
--
ENTER_THEORY Iz_map_3
--
-- The proof of the one theorem of this theory is very close to, and just as elementary as,
-- the corresponding one-variable result.
--
Theorem iz_map_3.1: [Three-variable mapformers] Is_map({[a3(x,y,yy),b3(x,y,yy)]: x in s, y in t, yy in u | P3(x,y,yy)}). Proof:
    Suppose_not ==> AUTO
    Use_def(Is_map) ==> {[a3(x,y,yy),b3(x,y,yy)]: x in s, y in t, yy in u | P3(x,y,yy)} /= {[car(x),cdr(x)]: x in {[a3(x,y,yy),b3(x,y,yy)]: x in s, y in t, yy in u | P3(x,y,yy)}}
    SIMPLF ==> Stat1: {[a3(x,y,yy),b3(x,y,yy)]: x in s, y in t, yy in u | P3(x,y,yy)} /= {[car([a3(x,y,yy),b3(x,y,yy)]),cdr([a3(x,y,yy),b3(x,y,yy)])]: x in s, y in t, yy in u | P3(x,y,yy)}
    (c,d,dd)-->Stat1 ==> AUTO
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Iz_map_3
--
--THEORY Iz_map_3(a3(x,y,yy),b3(x,y,yy),s,t,u,P3(x,y,yy))
--==>
--    Is_map({[a3(x,y,yy),b3(x,y,yy)]: x in s, y in t, yy in u | P3(x,y,yy)})
--END Iz_map_3;
--
-- Our next utility theory tells us that a setformer of the form ${[a(x),b(x)]: x in s}$ is a single
-- valued map unless there are $x$ and $y$ in $s$ such that $a(x) = a(y)$ does not imply $b(x) = b(y)$,
-- and that ${[x,b(x)]: x in s}$ is always a single valued map.
--
THEORY Svm_test(a(x),b(x),s)
END Svm_test;
--
ENTER_THEORY Svm_test
--
Def Svm_test.0a: [Witness to non-singlevaluedness] xy2_thryvar := arb({[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))})
Def Svm_test.0b: [First component of witness to non-singlevaluedness] x3_thryvar := car(xy2_thryvar)
Def Svm_test.0c: [Second component of witness to non-singlevaluedness] y3_thryvar := cdr(xy2_thryvar)
--
Theorem Svm_test.1: [Single-valuedness test] ((x3_thryvar in s) & (y3_thryvar in s) & (a(x3_thryvar) = a(y3_thryvar)) & (b(x3_thryvar) /= b(y3_thryvar))) or
				Svm({[a(x),b(x)]: x in s}). Proof:
	Suppose_not ==> (not ((x3_thryvar in s) & (y3_thryvar in s) & (a(x3_thryvar) = a(y3_thryvar)) & (b(x3_thryvar) /= b(y3_thryvar)))) &
	(not Svm({[a(x),b(x)]: x in s}))
--
-- By definition, the contrary of our assertion can only be true if ${[a(x),b(x)]: x in s}$
-- is either not a map or fails the single-valuedness test. But the preceding theory $Iz_map$
-- tells us that the first case is impossible, and an elementary simplification shows
-- that the second case is impossible also.
--
	Use_def(Svm) ==> not(Is_map({[a(x),b(x)]: x in s})) or (not (FORALL u in {[a(x),b(x)]: x in s}, v in {[a(x),b(x)]: x in s} |
			(car(u) = car(v)) imp (u = v)))
	APPLY() Iz_map(a(x)->a(x),b(x)->b(x),s->s)	 ==> Is_map({[a(x),b(x)]: x in s})
	SIMPLF ==> Stat1: (not (FORALL x in s, y in s | (car([a(x),b(x)]) = car([a(y),b(y)]))
				imp ([a(x),b(x)] = [a(y),b(y)])))
	(x,y)-->Stat1 ==> (x in s) & (y in s) & (car([a(x),b(x)]) = car([a(y),b(y)])) & ([a(x),b(x)] /= [a(y),b(y)])
	Suppose ==> Stat2: {[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))} = 0
	(x,y)-->Stat2 ==> not((x in s) & (y in s) & (a(x) = a(y)) & (b(x) /= b(y)))
	Discharge ==> {[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))} /= 0
	({[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))})-->T0 ==>
	arb({[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))}) in {[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))}
	Use_def(xy2_thryvar) ==> Stat3: xy2_thryvar in {[x,y]: x in s, y in s | (a(x) = a(y)) & (b(x) /= b(y))}
	(xx,yy)-->Stat3 ==> Stat4: (xx in s) & (yy in s) & (xy2_thryvar = [xx,yy]) & (a(xx) = a(yy)) & (b(xx) /= b(yy))
	(Stat4)ELEM ==> (xx = car(xy2_thryvar)) & (yy = cdr(xy2_thryvar))
	Use_def(x3_thryvar) ==> x3_thryvar = car(xy2_thryvar)
	Use_def(y3_thryvar) ==> y3_thryvar = cdr(xy2_thryvar)
	EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Svm_test
--
--THEORY Svm_test(a,b,s)
--==>
--     ((x3_thryvar in s) & (y3_thryvar in s) & (a(x3_thryvar) = a(y3_thryvar)) & (b(x3_thryvar) /= b(y3_thryvar))) or
--				 Svm({[a(x),b(x)]: x in s})
--END Svm_test;
--
-- As in the case of $Iz_map$, we give the 2-variable and 3-variable versions of the preceding theory.
--
THEORY Svm_test_2(a2(x,y),b2(x,y),s,t,P2(x,y))
END Svm_test_2;
--
ENTER_THEORY Svm_test_2
--
Def Svm_test.2a: [Witness to non-singlevaluedness, two-variable case] xy3_thryvar := arb({[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t |
		P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))})
Def Svm_test.2b: [1,1 component of witness to non-singlevaluedness, two-variable case] x4_thryvar := car(car(xy3_thryvar))
Def Svm_test.2c: [1,2 component of witness to non-singlevaluedness, two-variable case] y4_thryvar := cdr(car(xy3_thryvar))
Def Svm_test.2d: [2,1 component of witness to non-singlevaluedness, two-variable case] xp1_thryvar := car(cdr(xy3_thryvar))
Def Svm_test.2h: [2,2 component of witness to non-singlevaluedness, two-variable case] yp1_thryvar := cdr(cdr(xy3_thryvar))
--
Theorem Svm_test_2.1: [Single-valuedness test, two-variable case] ((x4_thryvar in s) & (y4_thryvar in t) & (xp1_thryvar in s) & (yp1_thryvar in t) &
	(a2(x4_thryvar,y4_thryvar) = a2(xp1_thryvar,yp1_thryvar)) & (b2(x4_thryvar,y4_thryvar) /= b2(xp1_thryvar,yp1_thryvar))) or
	 		Svm({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}). Proof:
	Suppose_not ==> Stat1: (not((x4_thryvar in s) & (y4_thryvar in t) & (xp1_thryvar in s) & (yp1_thryvar in t) &
	(a2(x4_thryvar,y4_thryvar) = a2(xp1_thryvar,yp1_thryvar)) & (b2(x4_thryvar,y4_thryvar) /= b2(xp1_thryvar,yp1_thryvar)))) &
	(not Svm({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}))
--
-- By definition, the negative of our assertion can only be true if
--	 ${[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}$
-- is either not a map or fails the single-valuedness test. But $Iz_map_2$ tells us
-- that the first case is impossible, so that this set must fail the single-valuedness test.
--
	Use_def(Svm) ==> not(Is_map({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)})) or
	(not (FORALL u in {[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}, v in {[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)} |
			(car(u) = car(v)) imp (u = v)))
	APPLY() Iz_map_2(a2(x,y)->a2(x,y),b2(x,y)->b2(x,y),s->s,t->t,P2(x,y)->P2(x,y)) ==>
	Is_map({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)})
	ELEM ==> Stat2: not (FORALL u in {[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)}, v in {[a2(xx,yy),b2(xx,yy)]: xx in s, yy in t | P2(xx,yy)} |
			(car(u) = car(v)) imp (u = v))
--
-- Hence there must exist elements $x$, $y$, $xx$, $yy$ violating the single-valuedness condition,
-- and so implying that the set
--
--	 ${[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t | (P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp)))}$
--
-- is non-empty, which by the axiom of choice and definition of $xy3_thryvar$ implies that $xy3_thryvar$
--	belongs to this set.
--
	SIMPLF(Stat2) ==> Stat3: not (FORALL x in s, y in t, xx in s, yy in t |
	((P2(x,y) & P2(xx,yy)) imp ((car([a2(x,y),b2(x,y)]) = car([a2(xx,yy),b2(xx,yy)]))
				imp ([a2(x,y),b2(x,y)] = [a2(xx,yy),b2(xx,yy)]))))
	(x,y,xx,yy)-->Stat3 ==> (x in s) &  (y in t) & (xx in s) & (yy in t) & P2(x,y) & P2(xx,yy) &
					(a2(x,y) = a2(xx,yy)) & (b2(x,y) /= b2(xx,yy))
	Suppose ==> Stat4: {[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t |
		 P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))} = 0
	(x,y,xx,yy)-->Stat4 ==> false; Discharge ==>
	{[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t | P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))} /= 0
	({[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t | P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))})-->T0 ==>
  arb({[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t | P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))}) in
	{[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t | P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))}
	Use_def(xy3_thryvar) ==> Stat5: xy3_thryvar in
	{[[x,y],[xp,yp]]: x in s, y in t, xp in s, yp in t | P2(x,y) & P2(xp,yp) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))}
--
-- Hence there exist elements $x2$, $y2$, $xp2$, $yp2$ satisfying the condition seen just below, and it
-- is an elementary consequence of the definition of $x4_thryvar$, $y4_thryvar$,etc. that these must be
-- $x4_thryvar$, $y4_thryvar$, $xp1_thryvar$, $yp1_thryvar$, leading to an immediate contradiction with our
-- hypothesis, and so proving our theorem.
--
	(x2,y2,xp2,yp2)-->Stat5 ==> Stat6: (x2 in s) & (y2 in t) & (xp2 in s) & (yp2 in t) & P2(x2,y2) & P2(xp2,yp2) &
	(xy3_thryvar = [[x2,y2],[xp2,yp2]]) & (a2(x2,y2) = a2(xp2,yp2)) & (b2(x2,y2) /= b2(xp2,yp2))
	(Stat6)ELEM ==> (x2 = car(car(xy3_thryvar)))
	(Stat6)ELEM ==> (y2 = cdr(car(xy3_thryvar)))
	(Stat6)ELEM ==> (xp2 = car(cdr(xy3_thryvar)))
	(Stat6)ELEM ==> (yp2 = cdr(cdr(xy3_thryvar)))
	Use_def(x4_thryvar) ==> x4_thryvar = car(car(xy3_thryvar))
	Use_def(y4_thryvar) ==> y4_thryvar = cdr(car(xy3_thryvar))
	Use_def(xp1_thryvar) ==> xp1_thryvar = car(cdr(xy3_thryvar))
	Use_def(yp1_thryvar) ==> yp1_thryvar = cdr(cdr(xy3_thryvar))
	EQUAL(Stat6) ==> Stat7: (x4_thryvar in s) & (y4_thryvar in t) & (xp1_thryvar in s) & (yp1_thryvar in t) &
	P2(x4_thryvar,y4_thryvar) & P2(xp1_thryvar,yp1_thryvar) &
	(xy3_thryvar = [[x4_thryvar,y4_thryvar],[xp1_thryvar,yp1_thryvar]])
	& (a2(x4_thryvar,y4_thryvar) = a2(xp1_thryvar,yp1_thryvar)) & (b2(x4_thryvar,y4_thryvar) /= b2(xp1_thryvar,yp1_thryvar))
	(Stat7,Stat1*)Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Svm_test_2
--
--THEORY Svm_test_2(a2(x,y),b2(x,y),s,t,P2(x,y))
--==>
--	((x4_thryvar in s) & (y4_thryvar in t) & (xp1_thryvar in s) & (yp1_thryvar in t) &
--		(a2(x4_thryvar,y4_thryvar) = a2(xp1_thryvar,yp1_thryvar)) & (b2(x4_thryvar,y4_thryvar) /= b2(xp1_thryvar,yp1_thryvar))) or
--			Svm({[a2(x,y),b2(x,y)]: x in s, y in t | P2(x,y)})
--END Svm_test_2;
--
-- We will occasionally require the three-variable version of the single-valued map principle,
-- which is given by the following variant THEORY.
--
THEORY Svm_test_3(a3(x,y,z),b3(x,y,z),s,t,u,P3(x,y,z))
END Svm_test_3;
--
ENTER_THEORY Svm_test_3
--
Def Svm_test.3a: [Witness to non-singlevaluedness, three-variable case] xy4_thryvar := arb({[[x,[y,wz]],[xp,[yp,wzp]]]: x in s, y in t, wz in u, xp in s, yp in t, wzp in u |
	(a3(x,y,wz) = a3(xp,yp,wzp)) & (b3(x,y,wz) /= b3(xp,yp,wzp)) & P3(x,y,wz) & P3(xp,yp,wzp)})
Def Svm_test.3b: [1,1-component of witness to non-singlevaluedness, three-variable case] x5_thryvar := car(car(xy4_thryvar))
Def Svm_test.3c: [1,2,1-component of witness to non-singlevaluedness, three-variable case] y5_thryvar := car(cdr(car(xy4_thryvar)))
Def Svm_test.3e: [1,2,2-component of witness to non-singlevaluedness, three-variable case] z1_thryvar := cdr(cdr(car(xy4_thryvar)))
Def Svm_test.3d: [2,1-component of witness to non-singlevaluedness, three-variable case] xp2_thryvar := car(cdr(xy4_thryvar))
Def Svm_test.3h: [2,2,1-component of witness to non-singlevaluedness, three-variable case] yp2_thryvar := car(cdr(cdr(xy4_thryvar)))
Def Svm_test.3f: [2,2,2-component of witness to non-singlevaluedness, three-variable case] zp1_thryvar := cdr(cdr(cdr(xy4_thryvar)))
--
Theorem Svm_test_3.1: [Single-valuedness test, three-variable case] ((x5_thryvar in s) & (y5_thryvar in t) & (z1_thryvar in u) & (xp2_thryvar in s) & (yp2_thryvar in t) &
	(zp1_thryvar in u) & P3(x5_thryvar,y5_thryvar,z1_thryvar) & P3(xp2_thryvar,yp2_thryvar,zp1_thryvar) &
	(a3(x5_thryvar,y5_thryvar,z1_thryvar) = a3(xp2_thryvar,yp2_thryvar,zp1_thryvar))
		& (b3(x5_thryvar,y5_thryvar,z1_thryvar) /= b3(xp2_thryvar,yp2_thryvar,zp1_thryvar))) or
			Svm({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)}). Proof:
	Suppose_not ==>
	Stat1: (not((x5_thryvar in s) & (y5_thryvar in t) & (z1_thryvar in u) & (xp2_thryvar in s) & (yp2_thryvar in t) &
	(zp1_thryvar in u) & P3(x5_thryvar,y5_thryvar,z1_thryvar) & P3(xp2_thryvar,yp2_thryvar,zp1_thryvar)
	 & (a3(x5_thryvar,y5_thryvar,z1_thryvar) = a3(xp2_thryvar,yp2_thryvar,zp1_thryvar))
		& (b3(x5_thryvar,y5_thryvar,z1_thryvar) /= b3(xp2_thryvar,yp2_thryvar,zp1_thryvar)))) &
			(not Svm({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)}))
--
-- By definition, the negative of our assertion can only be true if
--	 ${[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)}$
-- is either not a map or fails the single-valuedness test. But Iz_map_3 tells us
-- that the first case is impossible, so that this set must fail the single-valuedness test.
--
--
	Use_def(Svm) ==> not(Is_map({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)})) or
	(not (FORALL z1 in {[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)},
	z2 in {[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)} |
			(car(z1) = car(z2)) imp (z1 = z2)))
	APPLY() Iz_map_3(a3(x,y,w)->a3(x,y,w),b3(x,y,w)->b3(x,y,w),s->s,t->t,u->u,P3(x,y,w)->P3(x,y,w))	 ==>
	Is_map({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)})
	ELEM ==> not (FORALL z1 in {[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)},
	z2 in {[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)} |
			(car(z1) = car(z2)) imp (z1 = z2))
	SIMPLF ==> Stat2:
	not (FORALL x in s, y in t, wz in u, xp in s, yp in t, wz0 in u |
	(P3(x,y,wz) & P3(xp,yp,wz0)) imp ((car([a3(x,y,wz),b3(x,y,wz)]) = car([a3(xp,yp,wz0),b3(xp,yp,wz0)]))
				imp ([a3(x,y,wz),b3(x,y,wz)] = [a3(xp,yp,wz0),b3(xp,yp,wz0)])))
--
-- Hence there must exist elements $x$, $y$, $wz$, $xp$, $yp$, $wz0$ violating the single-valuedness condition,
-- and so implying that the set
--
--	 ${[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u | ((a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0))} /= 0$
--
-- is non-empty, which by the axiom of choice and definition of $xy4_thryvar$ implies that $xy4_thryvar$
-- belongs to this set.
--
	(x,y,wz,xp,yp,wz0)-->Stat2 ==>
	Stat3: (x in s) &  (y in t) & (wz in u) & (xp in s) & (yp in t) & (wz0 in u) & P3(x,y,wz) & P3(xp,yp,wz0) &
			(car([a3(x,y,wz),b3(x,y,wz)]) = car([a3(xp,yp,wz0),b3(xp,yp,wz0)])) & (b3(x,y,wz) /= b3(xp,yp,wz0))
	(Stat3)ELEM ==> a3(x,y,wz) = a3(xp,yp,wz0)
	Suppose ==> Stat4: {[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u |
	(a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0)} = 0
	(x,y,wz,xp,yp,wz0)-->Stat4 ==> false; Discharge ==>
	{[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u |
	(a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0)} /= 0
	({[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u | (a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0)})-->T0 ==>
	arb({[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u |
	(a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0)}) in
	{[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u |
		(a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0)}
	Use_def(xy4_thryvar) ==> Stat5: xy4_thryvar in {[[x,[y,wz]],[xp,[yp,wz0]]]: x in s, y in t, wz in u, xp in s, yp in t, wz0 in u |
		(a3(x,y,wz) = a3(xp,yp,wz0)) & (b3(x,y,wz) /= b3(xp,yp,wz0)) & P3(x,y,wz) & P3(xp,yp,wz0)}
--
-- Hence there exist elements $x2$, $y2$, $z2$, $xp2$, $yp2$, $zp2$ satisfying the condition seen just below, and it
-- is an elementary consequence of the definition of $x5_thryvar$, $y5_thryvar$,etc. that these must be
-- $x5_thryvar$, $y5_thryvar$, $z1_thryvar$, $xp2_thryvar$, $yp2_thryvar$, $zp1_thryvar$, leading to an immediate contradiction with our
-- hypothesis, and so proving our theorem.
--
	(x2,y2,z2,xp2,yp2,zp2)-->Stat5 ==> Stat6: (x2 in s) & (y2 in t) & (z2 in u) & (xp2 in s) & (yp2 in t) & (zp2 in u)
			& P3(x2,y2,z2) & P3(xp2,yp2,zp2) & (xy4_thryvar = [[x2,[y2,z2]],[xp2,[yp2,zp2]]]) &
	(a3(x2,y2,z2) = a3(xp2,yp2,zp2)) & (b3(x2,y2,z2) /= b3(xp2,yp2,zp2))
	(Stat6)ELEM ==> x2 = car(car(xy4_thryvar))
	(Stat6)ELEM ==> y2 = car(cdr(car(xy4_thryvar)))
	(Stat6)ELEM ==> z2 = cdr(cdr(car(xy4_thryvar)))
	(Stat6)ELEM ==> xp2 = car(cdr(xy4_thryvar))
	(Stat6)ELEM ==> yp2 = car(cdr(cdr(xy4_thryvar)))
	(Stat6)ELEM ==> zp2 = cdr(cdr(cdr(xy4_thryvar)))
	Use_def(x5_thryvar) ==> x5_thryvar = car(car(xy4_thryvar))
	Use_def(y5_thryvar) ==> y5_thryvar = car(cdr(car(xy4_thryvar)))
	Use_def(z1_thryvar) ==> z1_thryvar = cdr(cdr(car(xy4_thryvar)))
	Use_def(xp2_thryvar) ==> xp2_thryvar = car(cdr(xy4_thryvar))
	Use_def(yp2_thryvar) ==> yp2_thryvar = car(cdr(cdr(xy4_thryvar)))
	Use_def(zp1_thryvar) ==> zp1_thryvar = cdr(cdr(cdr(xy4_thryvar)))
	EQUAL(Stat6) ==> Stat7: (x5_thryvar in s) & (y5_thryvar in t) & (z1_thryvar in u) &
			(xp2_thryvar in s) & (yp2_thryvar in t) & (zp1_thryvar in u)
			& P3(x5_thryvar,y5_thryvar,z1_thryvar) & P3(xp2_thryvar,yp2_thryvar,zp1_thryvar) &
	(xy4_thryvar = [[x5_thryvar,[y5_thryvar,z1_thryvar]],[xp2_thryvar,[yp2_thryvar,zp1_thryvar]]]) &
	(a3(x5_thryvar,y5_thryvar,z1_thryvar) = a3(xp2_thryvar,yp2_thryvar,zp1_thryvar)) &
		(b3(x5_thryvar,y5_thryvar,z1_thryvar) /= b3(xp2_thryvar,yp2_thryvar,zp1_thryvar))
	(Stat7,Stat1*)Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Svm_test_3
--
--THEORY Svm_test_3(a3(x,y,z),b3(x,y,z),s,t,u,P3(x,y,z))
--==>(x5_thryvar,y5_thryvar,z1_thryvar,xp2_thryvar,yp2_thryvar,zp1_thryvar)
--	((x5_thryvar in s) & (y5_thryvar in t) & (z1_thryvar in u) & (xp2_thryvar in s) & (yp2_thryvar in t) &
--			(zp1_thryvar in u) & P3(x5_thryvar,y5_thryvar,z1_thryvar) & P3(xp2_thryvar,yp2_thryvar,zp1_thryvar) &
--				(a3(x5_thryvar,y5_thryvar,z1_thryvar) = a3(xp2_thryvar,yp2_thryvar,z1_thryvar))
--					& (b3(x5_thryvar,y5_thryvar,z1_thryvar) /= b3(xp2_thryvar,yp2_thryvar,z1_thryvar))) or
--						Svm({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in u | P3(x,y,w)})
--END Svm_test_3;
--
-- The next mini-theory simply specializes $Svm_test$ to the form in which it is most commonly used.
-- The proof required is completely elementary.
-- The following final small theories in the present utility series adapt
-- $Svm_test$ and its multivariable analogs to the form more conveniently used in proving
-- that a map is 1-1. Once more the sole theorem provided has an easy proof.
--
THEORY one_1_test(a(x),b(x),s)
END one_1_test;
--
ENTER_THEORY one_1_test
--
Def one_1_test.0a: [Witness to non-one-oneness of a map] xy5_thryvar := arb({[x,y]: x in s, y in s | ((a(x) = a(y)) neq (b(x) = b(y)))})
Def one_1_test.0b: [First component of witness to map non-one-oneness] x6_thryvar := car(xy5_thryvar)
Def one_1_test.0c: [Second component of witness to map non-one-oneness] y6_thryvar := cdr(xy5_thryvar)
--
Theorem one_1_test.1: [One-one map former test] ((x6_thryvar in s) & (y6_thryvar in s) & (((a(x6_thryvar) = a(y6_thryvar)) neq (b(x6_thryvar) = b(y6_thryvar))))) or
			 one_1_map({[a(x),b(x)]: x in s}). Proof:
	Suppose_not ==> (not((x6_thryvar in s) & (y6_thryvar in s) & (((a(x6_thryvar) = a(y6_thryvar)) neq (b(x6_thryvar) = b(y6_thryvar)))))) &
				(not one_1_map({[a(u),b(u)]: u in s}))
--
-- For let $s$ be a counterexample to our assertion. Then the set
--
--		(*) 	${[x,y]: x in s, y in s | ((a(x) = a(y)) neq (b(x) = b(y)))}$
--
-- cannot be empty, since if it were ${[a(x),b(x)]: x in s}$ would necessarily be single valued,
-- in which case there would have to exist two elements $xx$, $yy$ of $s$ for which $((b(xx) = b(yy)) & (a(xx) /= a(yy)))$,
-- an impossibility given that the set (*) seen above is empty.
--
	Use_def(one_1_map) ==> Stat1: (not Svm({[a(u),b(u)]: u in s})) or
		(not (FORALL x in {[a(u),b(u)]: u in s}, y in {[a(v),b(v)]: v in s} | (cdr(x) = cdr(y)) imp (x = y)))
	Suppose ==> Stat2: {[x,y]: x in s, y in s | ((a(x) = a(y)) neq (b(x) = b(y)))} = 0
	Suppose ==> not Svm({[a(x),b(x)]: x in s})
	APPLY(x3_thryvar:x,y3_thryvar:y) Svm_test(a(x)->a(x),b(x)->b(x),s->s)	 ==>
		((x in s) & (y in s) & (a(x) = a(y)) & (b(x) /= b(y))) or Svm({[a(x),b(x)]: x in s})
	ELEM ==> (x in s) & (y in s) & (a(x) = a(y)) & (b(x) /= b(y))
	(x,y)-->Stat2 ==> (a(x) = a(y)) eq (b(x) = b(y))
	ELEM ==> false; Discharge ==> (not (FORALL x in {[a(u),b(u)]: u in s}, y in {[a(v),b(v)]: v in s} | (cdr(x) = cdr(y)) imp (x = y)))
	SIMPLF ==> Stat3: (not (FORALL u in s, v in s | (cdr([a(u),b(u)]) = cdr([a(v),b(v)])) imp ([a(u),b(u)] = [a(v),b(v)])))
	(xx,yy)-->Stat3 ==> (xx in s) & (yy in s) & (cdr([a(xx),b(xx)]) = cdr([a(yy),b(yy)])) & ([a(xx),b(xx)] /= [a(yy),b(yy)])
	ELEM ==> (xx in s) & (yy in s) & (b(xx) = b(yy)) & (a(xx) /= a(yy))
	(xx,yy)-->Stat2 ==> (a(xx) = a(yy)) eq (b(xx) = b(yy))
	ELEM ==> false; Discharge ==> {[x,y]: x in s, y in s | ((a(x) = a(y)) neq (b(x) = b(y)))} /= 0
--
-- It therefore follows by the axiom of choice that $xy5_thryvar$, as defined above, is an element of the set (*),
-- and thus its two components $x6_thryvar$ and $y6_thryvar$ stand in contradiction to the hypotheses of the
-- present theorem. This contradiction proves our assertion.
--
	({[x,y]: x in s, y in s | ((a(x) = a(y)) neq (b(x) = b(y)))})-->T0 ==>
	arb({[x,y]: x in s, y in s | ((a(x) = a(y)) neq (b(x) = b(y)))}) in
	{[x,y]: x in s, y in s | ((a(x) = a(y)) neq (b(x) = b(y)))}
	Use_def(xy5_thryvar) ==> Stat4: xy5_thryvar in {[x,y]: x in s, y in s | ((a(x) = a(y)) neq (b(x) = b(y)))}
	(x2,y2)-->Stat4 ==> (xy5_thryvar = [x2,y2]) & (x2 in s) & (y2 in s) & (((a(x2) = a(y2)) neq (b(x2) = b(y2))))
	ELEM ==> (car(xy5_thryvar) = x2) & (cdr(xy5_thryvar) = y2)
	Use_def(x6_thryvar) ==> x6_thryvar = car(xy5_thryvar)
	Use_def(y6_thryvar) ==> y6_thryvar = cdr(xy5_thryvar)
	EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The utility theory just developed can be summarized as follows.
--DISPLAY one_1_test
--
--THEORY one_1_test(a(x),b(x),s)
--==>(x6_thryvar,y6_thryvar)
--    ((x6_thryvar in s) & (y6_thryvar in s) & (not((a(x6_thryvar) = a(y6_thryvar)) eq (b(x6_thryvar) = b(y6_thryvar))))) or
--						 one_1_map({[a(x),b(x)]: x in s})
--END one_1_test;
--
THEORY one_1_test_2(a2(x,y),b2(x,y),s,t)
END one_1_test_2;
--
ENTER_THEORY one_1_test_2
--
-- Next we give the two variable analog of the THEORY given just above.
-- The proof of the one theorem it provides differs little from that seen above.
--
Def one_1_test_2.0a: [Witness to map non-one-oneness, two-variable case] xy6_thryvar :=
	arb({[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) eq (b2(x,y) = b2(x2,y2)))})
Def one_1_test_2.0b: [1,1-component of witness to map non-one-oneness, two-variable case] x7_thryvar := car(car(xy6_thryvar))
Def one_1_test_2.0c: [1-2-component of witness to map non-one-oneness, two-variable case] y7_thryvar := cdr(car(xy6_thryvar))
Def one_1_test_2.0d: [2,1-component of witness to map non-one-oneness, two-variable case] x2_thryvar := car(cdr(xy6_thryvar))
Def one_1_test_2.0h: [2,1-component of witness to map non-one-oneness, two-variable case] y2_thryvar := cdr(cdr(xy6_thryvar))
--
Theorem one_1_test_2.1: [One-one map former test, two-variable case] ((x7_thryvar in s) & (y7_thryvar in t) & (x2_thryvar in s) & (y2_thryvar in t) &
		(not((a2(x7_thryvar,y7_thryvar) = a2(x2_thryvar,y2_thryvar)) eq (b2(x7_thryvar,y7_thryvar) = b2(x2_thryvar,y2_thryvar))))) or
			 one_1_map({[a2(x,y),b2(x,y)]: x in s, y in t}). Proof:
	Suppose_not ==> (not((x7_thryvar in s) & (y7_thryvar in t) & (x2_thryvar in s) & (y2_thryvar in t) &
		(not((a2(x7_thryvar,y7_thryvar) = a2(x2_thryvar,y2_thryvar)) eq (b2(x7_thryvar,y7_thryvar) = b2(x2_thryvar,y2_thryvar)))))) &
			 (not one_1_map({[a2(x,y),b2(x,y)]: x in s, y in t}))
--
-- For let $s$ be a counterexample to our assertion. Then the set
--
--		(*) 	${[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) eq (b2(x,y) = b2(x2,y2)))}$
--
-- cannot be empty, since if it were ${[a(u,v),b2(u,v)]: u in s, v in t}$ would necessarily be single valued,
-- in which case there would have to exist elements $x$, $xp$ of $s$ and elements $y$, $yp$ of $t$ for which
-- $((a2(x,y) = a2(xp,yp)) eq (b2(x,y) = b2(xp,yp)))$, an impossibility given that the set (*) seen above is empty.
--
	Use_def(one_1_map) ==> Stat1: (not Svm({[a2(u,v),b2(u,v)]: u in s, v in t})) or
	(not (FORALL x in {[a2(u,v),b2(u,v)]: u in s,v in t}, y in {[a2(up,vp),b2(up,vp)]: up in s,vp in t} | (cdr(x) = cdr(y)) imp (x = y)))
	Suppose ==> Stat2: {[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) eq (b2(x,y) = b2(x2,y2)))} = 0
	Suppose ==> not Svm({[a2(u,v),b2(u,v)]: u in s, v in t})
	APPLY(x4_thryvar:x,y4_thryvar:y,xp1_thryvar:xp,yp1_thryvar:yp) Svm_test_2(a2(x,y)->a2(x,y),b2(x,y)->b2(x,y),s->s,t->t,P2(x,y)->true) ==>
	((x in s) & (y in t) & (xp in s) & (yp in t) & (a2(x,y) = a2(xp,yp)) & (b2(x,y) /= b2(xp,yp))) or Svm({[a2(u,v),b2(u,v)]: u in s, v in t | true})
	(x,y,xp,yp)-->Stat2 ==> (a2(x,y) = a2(xp,yp)) eq (b2(x,y) = b2(xp,yp))
	ELEM ==> false; Discharge ==>
	not (FORALL x in {[a2(u,v),b2(u,v)]: u in s,v in t}, y in {[a2(u,v),b2(u,v)]: u in s,v in t} | (cdr(x) = cdr(y)) imp (x = y))
	SIMPLF ==> Stat3: not (FORALL u in s, v in t, up in s, vp in t |
					(cdr([a2(u,v),b2(u,v)]) = cdr([a2(up,vp),b2(up,vp)])) imp ([a2(u,v),b2(u,v)] = [a2(up,vp),b2(up,vp)]))
	(xx,yy,xxp,yyp)-->Stat3 ==> (xx in s) & (yy in t) & (xxp in s) & (yyp in t) &
	(cdr([a2(xx,yy),b2(xx,yy)]) = cdr([a2(xxp,yyp),b2(xxp,yyp)])) & ([a2(xx,yy),b2(xx,yy)] /= [a2(xxp,yyp),b2(xxp,yyp)])
	(xx,yy,xxp,yyp)-->Stat2 ==> (a2(xx,yy) = a2(xxp,yyp)) eq (b2(xx,yy) = b2(xxp,yyp))
	ELEM ==> false; Discharge ==>
	{[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) eq (b2(x,y) = b2(x2,y2)))} /= 0
--
-- It therefore follows by the axiom of choice that $xy6_thryvar$, as defined above, is an element of the set (*),
-- and thus its subcomponents $x7_thryvar$, $y7_thryvar$, $x2_thryvar$, $y2_thryvar$ stand in contradiction
-- to the hypotheses of the present theorem. This contradiction proves our assertion.
--
	({[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) eq (b2(x,y) = b2(x2,y2)))})-->T0 ==>
	arb({[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) eq (b2(x,y) = b2(x2,y2)))}) in
	{[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) eq (b2(x,y) = b2(x2,y2)))}
	Use_def(xy6_thryvar) ==> Stat4:
	xy6_thryvar in {[[x,y],[x2,y2]]: x in s, y in t, x2 in s, y2 in t  | not((a2(x,y) = a2(x2,y2)) eq (b2(x,y) = b2(x2,y2)))}
	(x2,y2,xp2,yp2)-->Stat4 ==> (x2 in s) & (y2 in t) & (xp2 in s) & (yp2 in t) &
		(not((a2(x2,y2) = a2(xp2,yp2)) eq (b2(x2,y2) = b2(xp2,yp2)))) & (xy6_thryvar = [[x2,y2],[xp2,yp2]])
	ELEM ==> (car(car([[x2,y2],[xp2,yp2]])) = x2) & (cdr(car([[x2,y2],[xp2,yp2]])) = y2)
	ELEM ==> (car(cdr([[x2,y2],[xp2,yp2]])) = xp2) & (cdr(cdr([[x2,y2],[xp2,yp2]])) = yp2)
	EQUAL ==> (car(car(xy6_thryvar)) = x2) & (cdr(car(xy6_thryvar)) = y2)
	EQUAL ==> (car(cdr(xy6_thryvar)) = xp2) & (cdr(cdr(xy6_thryvar)) = yp2)
	Use_def(x7_thryvar) ==> x7_thryvar = car(car(xy6_thryvar))
	Use_def(y7_thryvar) ==> y7_thryvar = cdr(car(xy6_thryvar))
	Use_def(x2_thryvar) ==> x2_thryvar = car(cdr(xy6_thryvar))
	Use_def(y2_thryvar) ==> y2_thryvar = cdr(cdr(xy6_thryvar))
	(x2,y2,xp2,yp2)-->Stat2 ==> (a2(x2,y2) = a2(xp2,yp2)) eq (b2(x2,y2) = b2(xp2,yp2))
	EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The utility theory just developed can be summarized as follows.
--DISPLAY one_1_test_2
--
--THEORY one_1_test_2(a2(x,y),b2(x,y),s,t)
--==>(x7_thryvar,y7_thryvar,x2_thryvar,y2_thryvar)
--((x7_thryvar in s) & (y7_thryvar in t) & (x2_thryvar in s) & (y2_thryvar in t) &
--		(not((a2(x7_thryvar,y7_thryvar) = a2(x2_thryvar,y2_thryvar)) eq (b2(x7_thryvar,y7_thryvar) = b2(x2_thryvar,y2_thryvar))))) or
--			 one_1_map({[a2(x,y),b2(x,y)]: x in s, y in t})
--END one_1_test_2;
--
--
THEORY one_1_test_3(a3(x,y,wz),b3(x,y,wz),s,t,r,P3(x,y,wz))
END one_1_test_3;
--
ENTER_THEORY one_1_test_3
--
-- Next we give the three variable analog of the THEORY given just above.
-- The proof of the one theorem it provides differs little from that seen above.
--
Def one_1_test_3.0a: [Witness to map non one-ness, three-variable case] xyz_thryvar :=
	arb({[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a3(x2,y2,z2)) eq (b3(x,y,wz) = b3(x2,y2,z2)))})
Def one_1_test_3.0b: [1,1-component of witness to map non one-ness, three-variable case] x8_thryvar := car(car(xyz_thryvar))
Def one_1_test_3.0c: [1,2,1-component of witness to map non one-ness, three-variable case] y8_thryvar := car(cdr(car(xyz_thryvar)))
Def one_1_test_3.0e: [1,2,2-component of witness to map non one-ness, three-variable case] z2_thryvar := cdr(cdr(car(xyz_thryvar)))
Def one_1_test_3.0d: [2,1-component of witness to map non one-ness, three-variable case] xp3_thryvar := car(cdr(xyz_thryvar))
Def one_1_test_3.0h: [2,2,1-component of witness to map non one-ness, three-variable case] yp3_thryvar := car(cdr(cdr(xyz_thryvar)))
Def one_1_test_3.0f: [2,2,2-component of witness to map non one-ness, three-variable case] zp2_thryvar := cdr(cdr(cdr(xyz_thryvar)))
--
Theorem one_1_test_3.1: [Single-valued map former, three-variable case] ((x8_thryvar in s) & (y8_thryvar in t) & (z2_thryvar in r) &
                (xp3_thryvar in s) & (yp3_thryvar in t) & (zp2_thryvar in r) &
                P3(x8_thryvar,y8_thryvar,z2_thryvar) & P3(xp3_thryvar,yp3_thryvar,zp2_thryvar) &
		(((a3(x8_thryvar,y8_thryvar,z2_thryvar) /= a3(xp3_thryvar,yp3_thryvar,zp2_thryvar)) eq (b3(x8_thryvar,y8_thryvar,z2_thryvar) = b3(xp3_thryvar,yp3_thryvar,zp2_thryvar))))) or
			 one_1_map({[a3(x,y,wz),b3(x,y,wz)]: x in s, y in t,wz in r | P3(x,y,wz)}). Proof:
	Suppose_not ==> (not((x8_thryvar in s) & (y8_thryvar in t) & (z2_thryvar in r) &
                (xp3_thryvar in s) & (yp3_thryvar in t) & (zp2_thryvar in r) &
                P3(x8_thryvar,y8_thryvar,z2_thryvar) & P3(xp3_thryvar,yp3_thryvar,zp2_thryvar) &
		(((a3(x8_thryvar,y8_thryvar,z2_thryvar) /= a3(xp3_thryvar,yp3_thryvar,zp2_thryvar)) eq (b3(x8_thryvar,y8_thryvar,z2_thryvar) = b3(xp3_thryvar,yp3_thryvar,zp2_thryvar)))))) &
			 (not one_1_map({[a3(x,y,wz),b3(x,y,wz)]: x in s, y in t,wz in r | P3(x,y,wz)}))
--
-- For let $s$ be a counterexample to our assertion. Then the set
--
--		(*) 	${[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & (not((a(x,y) = a(x2,y2)) eq (b(x,y) = b(x2,y2))))}$
--
--
-- cannot be empty, since if it were ${[a3(u,v,w),b3(u,v,w)]: u in s, v in t, w in r | P3(u,v,w)}$ would
-- necessarily be single valued,
-- in which case there would have to exist elements $x$, $xp$ of $s$, elements $y$, $yp$ of $t$, and
-- elements $z$, $zp$ of $w$ for which $((a3(x,y,w) = a3(xp,yp,wp)) eq (b3(x,y,w) = b3(xp,yp,w)))$ and
-- $P3(x,y,wz)$, $P3(x2,y2,z2)$ an impossibility given that the set (*) seen above is empty.
--
	Use_def(one_1_map) ==> Stat1: (not Svm({[a3(u,v,w),b3(u,v,w)]: u in s, v in t, w in r | P3(u,v,w)})) or
		(not (FORALL x in {[a3(u,v,w),b3(u,v,w)]: u in s,v in t,w in r | P3(u,v,w)}, y in {[a3(up,vp,wp),b3(up,vp,wp)]: up in s,vp in t,wp in r | P3(up,vp,wp)} | (cdr(x) = cdr(y)) imp (x = y)))
	Suppose ==> Stat2: {[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r  | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a3(x2,y2,z2)) eq (b3(x,y,wz) = b3(x2,y2,z2)))} = 0
	Suppose ==> not Svm({[a3(u,v,w),b3(u,v,w)]: u in s, v in t, w in r | P3(u,v,w)})
	APPLY(x5_thryvar:x,y5_thryvar:y,z1_thryvar:z1,xp2_thryvar:xp,yp2_thryvar:yp,zp1_thryvar:zp) Svm_test_3(a3(x,y,wz)->a3(x,y,wz),b3(x,y,wz)->b3(x,y,wz),s->s,t->t,u->r,P3(x,y,wz)->P3(x,y,wz)) ==>
		((x in s) & (y in t) & (z1 in r) & (xp in s) & (yp in t) & (zp in r) & P3(x,y,z1) & P3(xp,yp,zp) &
		 (a3(x,y,z1) = a3(xp,yp,zp)) & (b3(x,y,z1) /= b3(xp,yp,zp))) or Svm({[a3(x,y,w),b3(x,y,w)]: x in s, y in t, w in r | P3(x,y,w)})
	(x,y,z1,xp,yp,zp)-->Stat2 ==> (a3(x,y,z1) = a3(xp,yp,zp)) eq (b3(x,y,z1) = b3(xp,yp,zp)) & P3(x,y,z1) & P3(xp,yp,zp)
	ELEM ==> false; Discharge ==> not (FORALL x in {[a3(u,v,w),b3(u,v,w)]: u in s,v in t,w in r | P3(u,v,w)}, y in {[a3(u,v,w),b3(u,v,w)]: u in s,v in t,w in r | P3(u,v,w)} | (cdr(x) = cdr(y)) imp (x = y))
	SIMPLF ==> Stat3: not(FORALL u in s, v in t, w in r, up in s, vp in t, wp in r | (P3(u,v,w) & P3(up,vp,wp)) imp ((cdr([a3(u,v,w),b3(u,v,w)]) = cdr([a3(up,vp,wp),b3(up,vp,wp)])) imp ([a3(u,v,w),b3(u,v,w)] = [a3(up,vp,wp),b3(up,vp,wp)])))
	(xx,yy,wz,xxp,yyp,wz0)-->Stat3 ==> (xx in s) & (yy in t) & (wz in r) & (xxp in s) & (yyp in t) & (wz0 in r) & P3(xx,yy,wz) & P3(xxp,yyp,wz0) &
		(cdr([a3(xx,yy,wz),b3(xx,yy,wz)]) = cdr([a3(xxp,yyp,wz0),b3(xxp,yyp,wz0)])) & ([a3(xx,yy,wz),b3(xx,yy,wz)] /= [a3(xxp,yyp,wz0),b3(xxp,yyp,wz0)])
	(xx,yy,wz,xxp,yyp,wz0)-->Stat2 ==> (a3(xx,yy,wz) = a3(xxp,yyp,wz0)) eq (b3(xx,yy,wz) = b3(xxp,yyp,wz0)) or (not(P3(xx,yy,wz))) or (not(P3(xxp,yyp,wz0)))
	ELEM ==> false; Discharge ==>
		{[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a3(x2,y2,z2)) eq (b3(x,y,wz) = b3(x2,y2,z2)))} /= 0
--
-- It therefore follows by the axiom of choice that $xy6_thryvar$, as defined above, is an element of the set (*),
-- and thus its subcomponents $x8_thryvar$, $y8_thryvar$, $xp3_thryvar$, $yp3_thryvar$ stand in contradiction
-- to the hypotheses of the present theorem. This contradiction proves our assertion.
--
	({[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a(x2,y2,z2)) eq (b3(x,y,wz) = b3(x2,y2,z2)))})-->T0 ==>
		arb({[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a3(x2,y2,z2)) eq (b3(x,y,wz) = b3(x2,y2,z2)))}) in
		    {[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a3(x2,y2,z2)) eq (b3(x,y,wz) = b3(x2,y2,z2)))}
	Use_def(xyz_thryvar) ==> Stat4:
	xyz_thryvar in {[[x,[y,wz]],[x2,[y2,z2]]]: x in s, y in t, wz in r, x2 in s, y2 in t, z2 in r | P3(x,y,wz) & P3(x2,y2,z2) & ((a3(x,y,wz) /= a3(x2,y2,z2)) eq (b3(x,y,wz) = b3(x2,y2,z2)))}
	(x2,y2,z2,xp2,yp2,zp2)-->Stat4 ==> (x2 in s) & (y2 in t) & (z2 in r) & (xp2 in s) & (yp2 in t) & (zp2 in r) &
		P3(x2,y2,z2) & P3(xp2,yp2,zp2) &
		((a3(x2,y2,z2) /= a3(xp2,yp2,zp2)) eq (b3(x2,y2,z2) = b3(xp2,yp2,zp2))) & (xyz_thryvar = [[x2,[y2,z2]],[xp2,[yp2,zp2]]])
	(x2,y2,z2,xp2,yp2,zp2)-->Stat2 ==> (a3(x2,y2,z2) = a3(xp2,yp2,zp2)) eq (b3(x2,y2,z2) = b3(xp2,yp2,zp2))
	ELEM ==> (car(car([[x2,[y2,z2]],[xp2,[yp2,zp2]]])) = x2) & (car(cdr(car([[x2,[y2,z2]],[xp2,[yp2,zp2]]]))) = y2) & (cdr(cdr(car([[x2,[y2,z2]],[xp2,[yp2,zp2]]]))) = z2)
	ELEM ==> (car(cdr([[x2,[y2,z2]],[xp2,[yp2,zp2]]])) = xp2) & (car(cdr(cdr([[x2,[y2,z2]],[xp2,[yp2,zp2]]]))) = yp2) & (cdr(cdr(cdr([[x2,[y2,z2]],[xp2,[yp2,zp2]]]))) = zp2)
	EQUAL ==> (car(car(xyz_thryvar)) = x2) & (car(cdr(car(xyz_thryvar))) = y2) & (cdr(cdr(car(xyz_thryvar))) = z2)
	EQUAL ==> (car(cdr(xyz_thryvar)) = xp2) & (car(cdr(cdr(xyz_thryvar))) = yp2) & (cdr(cdr(cdr(xyz_thryvar))) = zp2)
	Use_def(x8_thryvar) ==> x8_thryvar = car(car(xyz_thryvar))
	Use_def(y8_thryvar) ==> y8_thryvar = car(cdr(car(xyz_thryvar)))
	Use_def(z2_thryvar) ==> z2_thryvar = cdr(cdr(car(xyz_thryvar)))
	Use_def(xp3_thryvar) ==> xp3_thryvar = car(cdr(xyz_thryvar))
	Use_def(yp3_thryvar) ==> yp3_thryvar = car(cdr(cdr(xyz_thryvar)))
	Use_def(zp2_thryvar) ==> zp2_thryvar = cdr(cdr(cdr(xyz_thryvar)))
	EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The utility theory just developed can be summarized as follows.
--DISPLAY one_1_test_3
--
--THEORY one_1_test_3(a3(x,y,wz),b3(x,y,wz),s,t,r,P3(x,y,wz))
--==>(x8_thryvar,y8_thryvar,z2_thryvar,xp3_thryvar,yp3_thryvar,zp2_thryvar)
--((x8_thryvar in s) & (y8_thryvar in t) & (z2_thryvar in u) &
--                (xp3_thryvar in s) & (yp3_thryvar in t) & (zp2_thryvar in u) &
--                P3(x8_thryvar,y8_thryvar,z2_thryvar) & P3(xp3_thryvar,yp3_thryvar,zp2_thryvar) &
--		(not((a3(x8_thryvar,y8_thryvar,z2_thryvar) = a3(xp3_thryvar,yp3_thryvar,zp2_thryvar)) eq (b3(x8_thryvar,y8_thryvar,z2_thryvar) = b3(xp3_thryvar,yp3_thryvar,zp2_thryvar))))) or
--			 one_1_map({[a3(x,y,wz),b3(x,y,wz)]: x in s, y in t,wz in u})
--END one_1_test_3;
--
--
-- ************************************************************************************************
--						Section 4: The ordinal enumerability theorem
-- ************************************************************************************************
--
-- Now we begin more serious development of the theory of ordinals, along von Neumann's line.
-- Our first theorem uses induction to show that if one ordinal $t$ is included in another
-- ordinal $s$ but not equal to $s$, then $t$ must be a member of $s$, and in fact must be
-- the smallest element of $s - t$.
--
Theorem 27: [Ordinal comparison lemma] (Ord(S) & Ord(T) & (T incin S)) imp ((T = S) or (T = arb(S - T))). Proof:
    Suppose_not(s,t) ==> Ord(s) & Ord(t) & (t incin s) & (t /= s) & (t /= arb(s - t))
--
-- For if our assertion is false, $s$ must have a proper subset $t$,
-- in which case the axiom of choice tells us that $s - t$ has a minimal element $arb(s - t)$
-- disjoint from $s - t$. Plainly  $arb(s - t)$ is also a member of the superset $s$ of $s - t$.
--
    ELEM ==> (arb(s - t) in s) & (arb(s - t) * (s - t) = 0)
    Use_def(Ord) ==>
	Stat1: (FORALL x in s| x incin s) & Stat2: (FORALL x in s, y in s | (x in y or y in x or x = y))
--
-- But then, by definition of ordinal, $arb(s - t)$ must be a subset of $s * t$,
-- since it is disjoint from $s - t$. Therefore $arb(s - t)$ cannot include $t$, otherwise the initial
-- assumption  $t /= arb(s - t)$ would be contradicted.
--
    (arb(s - t))-->Stat1 ==> arb(s - t) incin s
    ELEM ==> (arb(s - t) incin s * t) & Stat3: (not(arb(s - t) incs t))
--
-- Since $arb(s - t)$ fails to include $t$, there must be some $b$ in $t$ but not in $arb(s - t)$.
-- By the definition of ordinals, this implies that $arb(s - t) = b or arb(s - t) in b$.
--
    (b)-->Stat3 ==> (b in t) & (not (b in arb(s - t)))
    (arb(s - t),b)-->Stat2 ==> (arb(s - t) in b or arb(s - t) = b)
	Use_def(Ord) ==>
	Stat4: (FORALL x in t| x incin t) & (FORALL x in t, y in t | (x in y or y in x or x = y))
--
-- Using the definition of ordinals once more, this time for $t$, we see that $b$ must be a subset of $t$,
-- which rules out both $arb(s - t) in b$ and $arb(s - t) = b$, because either of these would yield
-- $arb(s - t) in t$ which is impossible. We have contradicted our original assumption, and so proved our theorem.
--
	(b)-->Stat4 ==> b incin t
    Discharge ==> QED
--
-- Next we show that the intersection of any two ordinals is an ordinal.
-- (Indeed, as Theorem 29 shows, this intersection must be the smaller of the two ordinals.)
--
Theorem 28: [Ordinal intersection] (Ord(S) & Ord(T)) imp Ord(S * T). Proof:
    Suppose_not(s,t) ==> Ord(s) & Ord(t) & (not Ord(s * t))
--
-- For suppose the contrary. Then by definition of ordinals there must exist $a$, $b$, $c$
-- such that $a$ is a member of $s * t$ but not included in it, or $b$ and $c$ are both
-- members or $s * t$, but are unrelated by membership.
--
    Use_def(Ord) ==> Stat1: not(((FORALL x in s * t | x incin s * t)) &
	(FORALL x in s * t, y in s * t | (x in y or y in x or x = y)))
    (a,b,c)-->Stat1 ==> Stat2: ((a in s * t) & (not(a incin s * t))) or
		((b in s * t) & (c in s * t) & (not(b in c or c in b or c = b)))
--
-- However, since $s$ and $t$ are both ordinals the first case is clearly impossible,
-- so we need only consider the second case.
--
    Suppose ==> Stat3: (a in s * t) & (not(a incin s * t))
        Use_def(Ord) ==> Stat4: (FORALL x in s | x incin s) &
		Stat5: (FORALL x in s, y in s | (x in y or y in x or x = y))
        Use_def(Ord) ==> Stat6: (FORALL x in t | x incin t)
        a-->Stat4 ==> Stat7: (a in s) imp (a incin s)
        a-->Stat6 ==> Stat8: (a in t) imp (a incin t)
    (Stat3,Stat7,Stat8*)Discharge ==> Stat9: (b in s) & (c in s) & (not(b in c or c in b or c = b))
--
-- But using the definition of ordinal once more we see that this case is impossible also.
--
    (b,c)-->Stat5(Stat9,Stat9) ==> ((b in s) & (c in s)) imp (b in c or c in b or c = b)
    (Stat9)Discharge ==> QED
--
-- Now we prove the related but slightly less elementary result that
-- one of any pair of ordinals must include the other.
--
Theorem 29: [Second ordinal comparison lemma] (Ord(S) & Ord(T)) imp ((S incin T) or (T incin S)). Proof:
    Suppose_not(s,t) ==> Stat1: Ord(s) & Ord(t) & (not(s incin t)) & (not(t incin s))
--
-- For if not, neither of these ordinals is included in the other, so neither can equal
-- the intersection of the two, which is an ordinal by Theorem 28.
--
    (s,t)-->T28 ==> Ord(s * t)
--
-- It now follows, using Theorem 27 twice, that $s * t$ is equal to both $arb(s - (s * t))$ and $arb(t - (s * t))$,
-- and so, since neither of these sets is empty, is a member of both
-- $s - (s * t)$ and $t - (s * t)$, which is impossible since the intersection of these two sets is empty.
-- This contradiction proves our theorem.
--
    (s,s*t)-->T27(Stat1*) ==> s * t = arb(s - (s * t))
    (t,s*t)-->T27(Stat1*) ==> s * t = arb(t - (s * t))
    ELEM ==> s - (s * t) /= 0
    ELEM ==> t - (s * t) /= 0
    (s - (s * t))-->T0 ==> (((s - (s * t)) = 0) & (arb(s - (s * t)) = 0)) or
	((arb(s - (s * t)) in s - (s * t)) & (arb(s - (s * t)) * (s - (s * t)) = 0))
    ELEM ==> s * t in s
    (t - (s * t))-->T0 ==> (((t - (s * t)) = 0) & (arb(t - (s * t)) = 0)) or
	((arb(t - (s * t)) in t - (s * t)) & (arb(t - (s * t)) * (t - (s * t)) = 0))
    Discharge ==> QED
--
-- The following corollary to the preceding theorem asserts that the union of two ordinals is an ordinal
-- and that the intersection of two ordinals is an ordinal.
--
Theorem 30: [Ordinal maximum and minimum] (Ord(S) & Ord(T)) imp (Ord(S + T) & Ord(S * T)). Proof:
    Suppose_not(s,t) ==> Ord(s) & Ord(t) & (not (Ord(s + t) & Ord(s * t)))
    (s,t)-->T29 ==> (s incin t) or (t incin s)
    Suppose ==> s incin t
    ELEM ==> (s + t = t) & (s * t = s)
    EQUAL ==> false; Discharge ==> (s + t = s) & (s * t = t)
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the family of all ordinals (we will see shortly that this is not a set)
-- is linearly ordered by membership.
--
Theorem 31: [Ordinal membership comparison] (Ord(S) & Ord(T)) imp ((S in T) or (T in S) or (S = T)). Proof:
    Suppose_not(s,t) ==> Ord(s) & Ord(t) & (not(s in t or t in s or s = t))
--
-- For if we suppose the contrary, and note that by Theorem 29 one must include the other
-- but not be equal to it, it follows  (by the axiom of choice)
-- that one must be a member of the other, a contradiction which proves our theorem.
--
    (s,t)-->T29 ==> Stat1: (s incin t) or (t incin s)
    (s,t)-->T27 ==> (t incin s) imp (t = arb(s - t))
    (t,s)-->T27 ==> (s incin t) imp (s = arb(t - s))
    Discharge ==> QED
--
-- The successor of an ordinal has a simple and very general definition:
--
Def 11: [successor (defined for any set, including ordinals and integers)] next(s) := s + {s}
--
-- It is easy to show that this successor is an ordinal.
--
Theorem 32: [Successor ordinal] Ord(S) imp Ord(next(S)). Proof:
    Suppose_not(s) ==> AUTO
--
-- For if we suppose the contrary, and use the definition of ordinals,
-- we see that there must exist $a$, $b$, $c$
-- such that $a$ is a member of $s + {s}$ but not included in it, or $b$ and $c$ are both
-- members of $s + {s}$, but are unrelated by membership.
--
    Use_def(next) ==> Ord(s) & (not(Ord(s + {s})))
    Use_def(Ord) ==>
	Stat1: (not((FORALL x in (s + {s}) | x incin (s + {s})) &
	(FORALL x in (s + {s}), y in (s + {s}) | (x in y or y in x or x = y))))
    (a,b,c)-->Stat1 ==> AUTO
--    (a,b,c)-->Stat1 ==> ((a in s + {s}) & (not(a incin (s + {s})))) or
--	((b in s + {s}) & (c in s + {s}) & (not(b in c or c in b or b = c)))
--
-- Since the cases $a = s$, $b = s$, and $c = s$ are all impossible,
-- we must either have $a in s$ or $b in s$ and $c in s$.
--
    ELEM ==> ((a in s) & (not(a incin s))) or ((b in s) & (c in s) & (not(b in c or c in b or b = c)))
--
-- But both of these cases are impossible since $s$ is an ordinal, a contradiction proving our theorem.
--
    Use_def(Ord) ==>
	Stat2: (FORALL x in s | x incin s) & (FORALL x in s, y in s | (x in y or y in x or x = y))
    (a,b,c)-->Stat2 ==> AUTO
    Discharge ==> QED
--
-- Sometimes it is useful to have the preceding theorem in the following more direct form.
--
Theorem 33: [Successor ordinal 2] Ord(S) imp Ord(S + {S}). Proof:
    Suppose_not(s) ==> AUTO
    Use_def(next) ==> Ord(s) & (not(Ord(next(s))))
    s-->T32 ==> false; Discharge ==> QED
--
-- Our next theorem shows that for ordinals inclusion is equivalent to the disjunction of identity and membership.
--
Theorem 34: [Third ordinal comparison lemma] (Ord(S) & Ord(T)) imp ((T incin S) eq ((T in S) or (T = S))). Proof:
    Suppose_not(s,t) ==> AUTO
--
-- For in the contrary case there must exist two ordinals $s$ and $t$ such that either
-- $t$ is a member but not a subset of $s$, or $t$ is a subset of $s$ but neither a member of, or equal to, $s$;
--
    ELEM ==>  (((not(t incin s)) & (t in s)) or ((t incin s) & (not(t in s or t = s))))
--
-- but the first case is ruled out by definition of ordinal and the second case by Theorem 27,
-- proving our theorem.
--
    (s,t)-->T13 ==> (t incin s) & (t notin s) & (t /= s)
    (s,t)-->T27 ==> t = arb(s - t)
    Discharge ==> QED
--
-- It is sometimes convenient to use this theorem in the following modified form.
--
Theorem 35: [Ordinal membership and comparison] (Ord(S) & Ord(T)) imp ((T notin S) eq (S incin T)). Proof:
    Suppose_not(s,t) ==> Ord(s) & Ord(t) & (t notin s) & (not(s incin t))
--
-- Since $(t in s) & (s incin t)$ is impossible, a counterexample to our assertion must satisfy
-- $(t notin s) & (not(s incin t))$. But by Theorem 31 we then have $s incin t$,
-- a contradiction which proves the present corollary.
--
	(s,t)-->T31 ==> (s in t) or (s = t)
    (t,s)-->T34 ==> false; Discharge ==> QED
--
-- Our next lemma tells us that for ordinals membership in the successor of an ordinal s is equivalent to inclusion in $s$.
--
Theorem 36: [Membership in the successor of an ordinal $s$] Ord(S) imp ((T in next(S)) eq ((T incin S) & Ord(T))). Proof:
Suppose_not(s,t) ==> AUTO
	Use_def(next) ==> Stat1: Ord(s) & (not((t in (s + {s})) eq ((t incin s) & Ord(t))))
	Suppose ==>  Stat2: ((t in s) or (t = s)) & (not((t incin s) & Ord(t)))
		Suppose ==> Stat3: t = s
		EQUAL(Stat1,Stat3) ==> Stat4: false; (Stat4)Discharge ==> Stat5: t in s
		(s,t)-->T12(Stat1,Stat5) ==> Stat6: Ord(t)
	(s,t)-->T34(Stat1,Stat2,Stat5,Stat6) ==> Stat7: false; (Stat7)Discharge ==> Stat8: not(((t in s) or (t = s)) & (not((t incin s) & Ord(t))))
(s,t)-->T34(Stat1,Stat8) ==> Stat9: false; (Stat9)Discharge ==> QED
--
Theorem 37: [Membership of $s$ in an ordinal $t$ implies inclusion of $next(s)$ in $t$] (Ord(T) & (S in T)) imp (next(S) incin T). Proof+:
    Suppose_not(m,i) ==> Ord(m) & (i in m) & Stat1: (not(next(i) incin m))
        j-->Stat1 ==> (j in next(i)) & (j notin m)
        Use_def(next) ==> j in i
        (j,m)-->T34 ==> not(m incin j)
    (m,j)-->T35 ==> false; Discharge ==> QED
--
-- Now we start to prepare for proof of the basic ordinal enumerability theorem,
-- Theorem 46 below. Our first step is to prove that both the collection of all
-- sets and the collection of all ordinals are 'too large' to be sets.
-- The following theorem gives the first of these results.
--
Theorem 38: [The class of all sets is not a set] not(EXISTS x | (FORALL y | y in x)). Proof:
    Suppose_not ==> Stat1: (EXISTS x | (FORALL y | y in x))
    u-->Stat1 ==> Stat2: (FORALL y | (y in u))
--
-- For, in the contrary case, consider the set $u$ of all sets. This $u$ would be
-- a member of itself, whereas the axiom of choice forbids membership loops.
-- A derivation of this fact from 'first principles' would be:
-- \nextline
--    $({u})$-->T0 ==> $(arb({u}) in {u}) & (arb({u}) * {u}) = 0$ \nextline
--     ELEM ==> $(arb({u}) = u) & (u notin u)$ \nextline
--     $u$-->Stat2 ==> $false$; Discharge ==> QED \nextline
-- \nextline
-- In our inference environment, the following abridged proof suffices:
--
    u-->Stat2 ==> u in u
    Discharge ==> QED
--
Theorem 39: [There is no antinomic Russell's set] not(EXISTS x | (FORALL y | (y in x) eq (y notin y))). Proof:
    Suppose_not ==> Stat1: (EXISTS x | (FORALL y | (y in x) eq (y notin y)))
    a-->Stat1 ==> Stat2: (FORALL y | (y in a) eq (y notin y))
--
-- For in the contrary case consider the set $a$ of all sets which are not members of themselves.
-- Then $a$ cannot be a member of itself, or fail to be a member of itself.
-- This impossibility proves our theorem.
--
    a-->Stat2 ==> (a in a) eq (a notin a)
    Discharge ==> QED
--
-- Next we show that the class of ordinals is not a set
--
Theorem 40: [The class of ordinals is not a set]
    not (FORALL x | ((x in OS) eq Ord(x))). Proof+:
    Suppose_not(o) ==> Stat1: AUTO
--
-- For suppose the contrary, so that there is a set $o$ consisting of all ordinals.
-- But we can show that $o$ must be an ordinal. Indeed, if it were not,
-- then by the definition of ordinals there would exist $a$, $b$, $c$
-- such that either $a$ was a member but not a subset of $o$,
-- or $b$ and $c$ are two members of $o$ not related by membership.
--
    Suppose ==> not Ord(o)
    Use_def(Ord) ==> Stat2: not((FORALL x in o | x incin o) & (FORALL x in o, y in o | (x in y) or (y in x) or (x = y)))
    (a,b,c)-->Stat2 ==> ((a in o) & (not(a incin o))) or
		((b in o) & (c in o) & (not((b in c) or (c in b) or (b = c))))
--
-- In the  second of these cases $b$ and $c$ are both plainly ordinals.
-- so that this case is ruled out by Theorem 31. Hence only the first case need be considered.
--
    Suppose ==> (b in o) & (c in o) & (not((b in c) or (c in b) or (b = c)))
    b-->Stat1 ==> Ord(b)
    c-->Stat1 ==> Ord(c)
    (b,c)-->T31 ==> false; Discharge ==> Stat3: (a in o) & (not(a incin o))
--
-- In this case the set $a$, which must plainly be an ordinal,
-- must have a member $d$ which is not in $o$, and hence not an ordinal
-- by Stat1 above, which is impossible, so our theorem is proved.
--
    a-->Stat1 ==> Ord(a)
    (d)-->Stat3 ==> (d in a) & (d notin o)
    d-->Stat1 ==> false; Discharge ==> Ord(o)
    o-->Stat1 ==> false; Discharge ==> QED
--
-- We now give the following transfinite recursive definition, which introduces the
-- function that will be shown to put every set in 1-1 correspondence with some ordinal.
--
Def 9: [The enumeration of a set]
    enum(X,S) := if S incin {enum(y,S): y in X} then S else arb(S - {enum(y,S): y in X}) end if
--
-- To begin our work toward the culminating Theorem 46 seen below, we first show
-- that if a set $s$ is a member of $b := {enum(y,s): y in x}$ for some ordinal $x$,
-- so is every one of the members of $s$.
--
Theorem 41: [Enumerability principle] ((Ord(X) & S in {enum(y,S): y in X})) imp (S incin {enum(y,S): y in X}). Proof:
    Suppose_not(x,s) ==> Ord(x) & Stat1: (s in {enum(y,s): y in x}) & (not(s incin {enum(u,s): u in x}))
--
-- For suppose not. Then there is a $v$ in $x$ such that $s = enum(v,s)$, but $s$ cannot be a subset
-- of ${enum(u,s): u in v}$; so by definition of $enum$,
-- $enum(v,s) = arb(s - {enum(z,s): z in v})$, which is impossible, since it wold imply $s in s$.
--
    v-->Stat1 ==> (s = enum(v,s)) & (v in x)
    (x,v)-->T13 ==> v incin x
    Set_monot ==> {enum(u,s): u in x} incs {enum(u,s): u in v}
    ELEM ==> not(s incin {enum(z,s): z in v})
    Use_def(enum) ==> enum(v,s) = if s incin {enum(z,s): z in v} then s else arb(s - {enum(z,s): z in v}) end if
    ELEM ==> enum(v,s) = arb(s - {enum(z,s): z in v})
    Discharge ==> QED
--
-- It is also easy to show that for any $x$, $enum(x,s)$ is either $s$ or a member of $s$.
--
Theorem 42: [Enumeration membership lemma] (enum(X,S) = S) or (enum(X,S) in S). Proof:
    Suppose_not(x,s) ==> (enum(x,s) /= s) & (enum(x,s) notin s)
--
-- For in the contrary case, $s incin {enum(y,s): y in x}$ must be false, so $enum(x,s) in s$
-- must be true by definition of $enum$ and by the axiom of choice.
--
    Use_def(enum) ==> enum(x,s) = if s incin {enum(y,s): y in x} then s else arb(s - {enum(y,s): y in x}) end if
    ELEM ==> s - {enum(y,s): y in x} /= 0
    ELEM ==> enum(x,s) = arb(s - {enum(y,s): y in x})
    (s - {enum(y,s): y in x})-->T0 ==> arb(s - {enum(y,s): y in x}) in s - {enum(y,s): y in x}
    Discharge ==> QED
--
-- Next we show that if $enum(x,s)$ equals $s$ for any $x$, it also equals $s$ for any larger $y$:
--
Theorem 43: [Enumeration inclusion lemma] ((enum(X,S) = S) & (Y incs X)) imp (enum(Y,S) = S). Proof:
Suppose_not(x,s,w) ==> Stat1: (enum(x,s) = s) & (w incs x) & (enum(w,s) /= s)
--
-- For in the contrary case, we must have $s incin {enum(u,s): u in x}$ by definition of enum
-- and the axiom of choice.
--
Use_def(enum) ==> Stat2: enum(x,s) = if s incin {enum(u,s): u in x} then s else arb(s - {enum(u,s): u in x}) end if
Suppose ==> not (s incin {enum(u,s): u in x})
ELEM ==> Stat3: s - {enum(y,s): y in x} /= 0
(s - {enum(u,s): u in x})-->T0 ==> Stat4: arb(s - {enum(u): u in x}) in s - {enum(u,s): u in x}
Discharge ==> AUTO
--
-- Thus $s incin {enum(u,s): u in w}$ by set monotonicity, and so $enum(w,s) = s$,
-- a contradiction which proves our theorem.
--
Set_monot ==> {enum(u,s): u in x} incin {enum(u,s): u in w}
ELEM ==> s incin {enum(u,s): u in w}
Use_def(enum) ==> enum(w,s) = if s incin {enum(u,s): u in w} then s else arb(s - {enum(u,s): u in w}) end if
Discharge ==> QED
--
-- The following result tells us that, if we confine ourselves to the range of ordinals $x$ for which
-- $s notin {enum(u,s): u in x}$, the map $x$->$enum(x,s)$ is one-to-one:
--
Theorem 44: [The enumeration of a set is 1-1]
    (Ord(X) & Ord(W) & (X /= W)) imp
	((S in {enum(u,S): u in X}) or (S in {enum(u,S): u in W}) or (enum(X,S) /= enum(W,S))). Proof:
    Suppose_not(x,wz,s) ==>
	Ord(x) & Ord(wz) & (x /= wz) &
	Stat1: (s notin {enum(u,s): u in x}) & Stat2: (s notin {enum(u,s): u in wz}) & (enum(x,s) = enum(wz,s))
--
-- For if not, there are two distinct ordinals $x$ and $wz$ in the stated range
-- such that $enum(x,s) = enum(wz,s)$. Theorem 31 tells us that
-- one of the ordinals $x$ and $wz$ must be a member of the other. First suppose that $wz in x$,
-- so that, by Stat1, $enum(wz,s) /= s$, and therefore $enum(x,s) /= s$.
--
    (x,wz)-->T31 ==> (x in wz) or (wz in x)
    Suppose ==> wz in x
    wz-->Stat1 ==> enum(wz,s) /= s
--
-- Then it follows from the definition of $enum$ that $s$ cannot be a member of ${enum(u,s): u in x}$,
-- so that $enum(x,s) = arb(s - {enum(y,s): y in x})$, in which case the axiom of choice tells us that
-- $enum(x,s)$ is in $s - {enum(y,s): y in x}$. But then, since $enum(wz,s)$ is clearly
-- a member of ${enum(y,s): y in x}$, $enum(x,s)$ and $enum(wz,s)$ must be different, contrary to assumption.
--
    Use_def(enum) ==> enum(x,s) = if s incin {enum(u,s): u in x} then s else arb(s - {enum(y,s): y in x}) end if
    ELEM ==> (not(s incin {enum(u,s): u in x})) & (enum(x,s) = arb(s - {enum(y,s): y in x}))
    (s - {enum(u,s): u in x})-->T0 ==> arb(s - {enum(u,s): u in x}) in s - {enum(u,s): u in x}
    Suppose ==> Stat3: enum(wz,s) notin {enum(y,s): y in x}
    wz-->Stat3 ==> false; Discharge ==> enum(wz,s) in {enum(u,s): u in x}
    Discharge ==> x in wz
--
-- This leaves us with the case $x in wz$ to consider: this can be treated symmetrically,
-- and another contradiction derived, thereby proving the present theorem.
--
    x-->Stat2 ==> enum(x,s) /= s
    Use_def(enum) ==> enum(wz,s) = if s incin {enum(u,s): u in wz} then s else arb(s - {enum(y,s): y in wz}) end if
    ELEM ==> (not(s incin {enum(u,s): u in wz})) & (enum(wz,s) = arb(s - {enum(y,s): y in wz}))
    (s - {enum(u,s): u in wz})-->T0 ==> arb(s - {enum(u,s): u in wz}) in s - {enum(u,s): u in wz}
    Suppose ==> Stat4: enum(x,s) notin {enum(y,s): y in wz}
    x-->Stat4 ==> false; Discharge ==> enum(x,s) in {enum(u,s): u in wz}
    Discharge ==>     QED
--
-- Next we prove that, for each set $s$, there must exist some ordinal $x$ for which $s$
-- belongs to ${enum(y,s): y in x}$. This is done by showing that in the contrary case
-- the collection of all ordinals would be a set, which we have already shown to be false.
--
Theorem 45: [Enumeration lemma] (EXISTS x | (Ord(x) & (S in {enum(y,S): y in x}))). Proof:
    Suppose_not(s) ==> Stat1: not(EXISTS x | (Ord(x) & (s in {enum(u,S): u in x})))
--
-- We proceed by contradiction. If our theorem is false, there must exist a set $s$ such that
-- $s notin {enum(y,s): y in x}$ for every ordinal $x$. In this case, Theorem 44 tells us that
-- $enum(x,s) /= enum(y,s)$ for every distinct pair $x,y$ of ordinals.
--
    Suppose ==> Stat2:
	not((FORALL x, y | ((Ord(x) & Ord(y)) imp (((enum(x,s) in s) & (enum(y,s) in s) & (x /= y)) imp (enum(x,s) /= enum(y,s))))))
    (x,y)-->Stat2 ==> Ord(x) & Ord(y) & (enum(x,s) in s) & (enum(y,s) in s) & (x /= y) & (enum(x,s) = enum(y,s))
    x-->Stat1 ==> s notin {enum(u,s): u in x}
    y-->Stat1 ==> s notin {enum(u,s): u in y}
    (x,y,s)-->T44 ==> false
    Discharge ==> Stat3:
	(FORALL x, y | ((Ord(x) & Ord(y)) imp (((enum(x,s) in s) & (enum(y,s) in s) & (x /= y)) imp (enum(x,s) /= enum(y,s)))))
--
-- We shall now show that $s$ is not a subset of ${enum(y,s): y in o1}$ for any ordinal $o1$.
-- For if $s incin {enum(y,s): y in o1}$, then by definition of $enum$, $enum(o1,s) = s$, and hence
-- s in ${enum(x,s): s in next(o1)}$, contradicting Stat4 above.
-- It follows by a second use of the definition of $enum$ that $enum(o1,s) = arb(s - {{enum(y,s): y in o1}})$,
-- so that $enum(o1,s) in s$ for every ordinal $o1$.
--
	Suppose ==> Stat5: not(FORALL o1 | Ord(o1) imp (not(s incin {enum(y,s): y in o1})))
	o2-->Stat5 ==> Ord(o2) & (s incin {enum(y,s): y in o2})
	Use_def(enum) ==> enum(o2,s) = if s incin {enum(y,s): y in o2} then s else arb(s - {enum(y,s): y in o2}) end if
	ELEM ==> enum(o2,s) = s
	(next(o2))-->Stat1 ==> not(Ord(next(o2)) & (s in {enum(u,S): u in next(o2)}))
	o2-->T32 ==> Stat6: s notin {enum(u,S): u in next(o2)}
	o2-->Stat6 ==> o2 notin next(o2)
	Use_def(next) ==> false; Discharge ==> Stat7: (FORALL o1 | Ord(o1) imp (not(s incin {enum(y,s): y in o1})))
	Suppose ==> Stat8: not(FORALL o1 | Ord(o1) imp (enum(o1,s) in s))
	o3-->Stat8 ==> Ord(o3) & (not(enum(o3,s) in s))
	o3-->Stat7 ==> not(s incin {enum(y,s): y in o3})
	Use_def(enum) ==> enum(o3,s) = if s incin {enum(y,s): y in o3} then s else arb(s - {enum(y,s): y in o3}) end if
	ELEM ==> enum(o3,s) = arb(s - {enum(y,s): y in o3})
	(s - {enum(y,s): y in o3})-->T0 ==> false
	Discharge ==> Stat9: (FORALL o1 | Ord(o1) imp (enum(o1,s) in s))
--
-- Now consider the set $t$ of all $x in s$ having the form $enum(o,s)$ for some ordinal $o$, so that
-- for each $x in t$ there is an ordinal $o$ such that $x = enum(o,s)$.
--
    Loc_def ==> t = {x in s | (EXISTS o | Ord(o) & (enum(o,s) = x))}
    Suppose ==> Stat10: not (FORALL x | ((x in t) imp (EXISTS o | (Ord(o) & (enum(o,s) = x)))))
    a-->Stat10 ==> (a in t) & (not(EXISTS o | (Ord(o) & (enum(o,s) = a))))
    ELEM ==> Stat11: a in {x in s | (EXISTS o | Ord(o) & (enum(o,s) = x))}
    ()-->Stat11 ==> false; Discharge ==> Stat12: (FORALL x | ((x in t) imp (EXISTS o | Ord(o) & (enum(o,s) = x))))
    Suppose ==> Stat13: not(FORALL x | (EXISTS o | ((x in t) imp (Ord(o) & (enum(o,s) = x)))))
    xa-->Stat13 ==> Stat14: not(EXISTS o | ((xa in t) imp (Ord(o) & (enum(o,s) = xa))))
    xa-->Stat12 ==>  Stat15: (xa in t) imp (EXISTS o | Ord(o) & (enum(o,s) = xa))
    oa-->Stat14 ==> not((xa in t) imp (Ord(oa) & (enum(oa,s) = xa)))
    (Stat15)ELEM ==> (xa in t) & Stat16: (EXISTS o | Ord(o) & (enum(o,s) = xa))
    ob-->Stat16 ==> Ord(ob) & (enum(ob,s) = xa)
    ob-->Stat14 ==> false; Discharge ==> Stat17: (FORALL x | (EXISTS o | ((x in t) imp (Ord(o) & (enum(o,s) = x)))))
--
-- Skolemize this last statement, rewriting it in the following form:
--
    APPLY(v1_thryvar:ord_for) Skolem() ==> Stat18: (FORALL x | ((x in t) imp (Ord(ord_for(x)) & (enum(ord_for(x),s) = x))))
--
-- We will show that every ordinal belongs to the set ${ord_for(x): x in t}$. For suppose the contrary,
-- and consider an ordinal $o$ not in this set, which then plainly differs from $ord_for(enum(o,s))$;
--
    Suppose ==> Stat19: not(FORALL o in OM |(Ord(o) imp (o in {ord_for(x): x in t})))
    o-->Stat19 ==> Ord(o) & Stat20: (o notin {ord_for(x): x in t})
    o-->Stat3 ==> not (EXISTS y | (not ((Ord(o) & Ord(y)) imp (((((enum(o,s) in s) & (enum(y,s) in s)) & (o /= y))
								imp ((enum(o,s) /= enum(y,s))))))))
	o-->Stat9 ==> Stat21: enum(o,s) in s
	Suppose ==> enum(o,s) notin t
	ELEM ==> Stat22: enum(o,s) notin {x in s | (EXISTS oo | Ord(oo) & (enum(oo,s) = x))}
	()-->Stat22 ==> Stat23: not(EXISTS oo | Ord(oo) & (enum(oo,s) = enum(o,s)))
	o-->Stat23 ==> not (Ord(o) & (enum(o,s) = enum(o,s)))
	Discharge ==> enum(o,s) in t
    (enum(o,s))-->Stat20 ==> o /= ord_for(enum(o,s))
--
-- by definition of the set $t$, $enum(o,s)$ must belong to it, and hence to $s$.
--
    Suppose ==> enum(o,s) notin t
    ELEM ==> Stat24: enum(o,s) notin {x in s | (EXISTS o | (Ord(o) & (enum(o,s) = x)))}
    (enum(o,s))-->Stat24 ==> Stat25: not((enum(o,s) in s) & (EXISTS oo | (Ord(oo) & (enum(oo,s) = enum(o,s)))))
    (Stat21,Stat25*)ELEM ==> Stat26: not((EXISTS oo | (Ord(oo) & (enum(oo,s) = enum(o,s)))))
    o-->Stat26 ==> false; Discharge ==> enum(o,s) in t
    ELEM ==> Stat27: enum(o,s) in {x in s | (EXISTS o | Ord(o) & (enum(o,s) = x))}
    ()-->Stat27 ==> enum(o,s) in s
--
-- Since the definition of $ord_for$ implies the following formula,
-- the fact that $enum$ is one-to-one on ordinals (Stat3)
-- implies that $ord_for(enum(o,s)) = o$.
--
    (enum(o,s))-->Stat18 ==> Ord(ord_for(enum(o,s))) & (enum(ord_for(enum(o,s)),s) = enum(o,s))
    (ord_for(enum(o,s)),o)-->Stat3 ==> ord_for(enum(o,s)) = o
--
-- This contradiction shows that every ordinal belongs to the set ${ord_for(x): x in t}$,
-- contradicting the fact, proved as Theorem 40, that there can be no set to which all
-- ordinals belong. This final contradiction proves the present theorem.
--
    Discharge ==> Stat28: (FORALL o in OM | (Ord(o) imp (o in {ord_for(u): u in t})))
    Suppose ==> Stat29: not(FORALL o | (Ord(o) eq (o in {ord_for(x): x in t})))
    os-->Stat29 ==> not(Ord(os) eq (os in {ord_for(x): x in t}))
    os-->Stat28 ==> Stat30: (os in {ord_for(x): x in t}) & (not Ord(os))
    xx-->Stat30 ==> (xx in t) & (os = ord_for(xx))
    xx-->Stat18 ==> Ord(ord_for(xx))
    EQUAL ==> false;  Discharge ==> (FORALL o | (Ord(o) eq (o in {ord_for(u): u in t})))
    ({ord_for(x): x in t})-->T40 ==> false; Discharge ==> QED
--
-- We are now in position to prove the key fact that the function $enum(x,s)$ puts any
-- set $s$ in one-to-one correspondence with an ordinal.
-- The following theorem states this result formally.
--
Theorem 46: [Main enumeration theorem]
    (EXISTS x | Ord(x) & (S = {enum(y,S): y in x}) &
	(FORALL y in x, z0 in x | ((y /= z0) imp (enum(y,S) /= enum(z0,S))))). Proof+:
    Suppose_not(s) ==> Stat1: (not(EXISTS x | Ord(x) & (s = {enum(y,s): y in x}) &
	(FORALL y in x, z0 in x | ((y /= z0) imp ((enum(y,s) /= enum(z0,s)))))))
--
-- We proceed by contradiction. Suppose that our theorem is false, so that no ordinal having the properties
-- considered in the theorem exists. By Theorem 45, there exists an ordinal $x$ such that $s$ is in ${enum(y,s): y in x}$,
-- and hence an ordinal $y$ such that $s = enum(y,s)$.
--
    (s)-->T45 ==> Stat2: (EXISTS x | (Ord(x) & (s in {enum(y,s): y in x})))
    x-->Stat2 ==> Ord(x) & Stat3: (s in {enum(y,s): y in x})
    w-->Stat3 ==> (s = enum(w,s)) & (w in x)
--
-- By definition of $enum$, $enum(w,s)$ is a member of $s$ unless $s incin {enum(u,s): u in w}$ is true;
-- since $s = {enum(u,s): u in w}$ this is impossible, so we must have $s incin {enum(u,s): u in w}$.
--
    Use_def(enum) ==> Stat4: enum(w,s) = if s incin {enum(u,s): u in w} then s else arb(s - {enum(u,s): u in w}) end if
    Suppose ==> not(s incin {enum(u,s): u in w})
    (s - {enum(u,s): u in w})-->T0(Stat4*) ==> enum(w,s) in s - {enum(u,s): u in w}
    Discharge ==> s incin {enum(u,s): u in w}
--
-- The principle of transfinite induction now tells us that there exists
-- a minimal ordinal $b$ such that $s incin {enum(y,s): y in b}$. Since our theorem is false,
-- either $s$ must be different from ${enum(y,s): y in b}$, or the function
-- $enum(.,s)$ cannot be 1-1 on $b$.
--
    APPLY(mt1_thryvar:b) transfinite_induction(n->w,P(x)->(Ord(x) & (s incin {enum(u,s): u in x}))) ==>
		Stat5: (FORALL u | (Ord(b) & (s incin {enum(y,s): y in b})) &
					((u in b) imp (not (Ord(u)) & (s incin {enum(vv,s): vv in u}))))
	a0-->Stat5 ==> Ord(b) & (s incin {enum(y,s): y in b})
    b-->Stat1 ==> (s /= {enum(y,s): y in b}) or
    		not(FORALL y in b, z0 in b | ((y /= z0) imp (enum(y,s) /= enum(z0,s))))
--
-- First suppose that ${enum(y,s): y in b} /= s$, i.e. that the second of these sets
-- does not include the first, so that there is a $c$ in the first but not the second,
-- and so a $d in b$ such that $c = enum(d,s)$.
--
    Suppose ==> Stat6: not({enum(y,s): y in b} incin s)
    c-->Stat6 ==> Stat7: (c in {enum(y,s): y in b}) & (c notin s)
    d-->Stat7 ==> (c = enum(d,s)) & (d in b) & (c notin s)
--
-- Since $b$ is an ordinal, $d$ is also an ordinal, so Stat5 tells us
-- that $s$ is not a subset of ${enum(y,s): y in d}$, and thus by definition
-- $c = enum(d,s)$ must be a member of $s$, a contradiction which tells us that
-- ${enum(y,s): y in b}$ must be equal to $s$.
--
    d-->Stat5 ==> (not Ord(d)) or (not s incin {enum(y,s): y in d})
    (b,d)-->T12 ==> Stat8: (not s incin {enum(y,s): y in d}) & (s - {enum(y,s): y in d} /= 0)
    Use_def(enum) ==> enum(d,s) = if s incin {enum(u,s): u in d} then s else arb(s - {enum(u,s): u in d}) end if
    (s - {enum(u,s): u in d})-->T0(Stat8*) ==> enum(d,s) in s
    Discharge ==> s = {enum(y,s): y in b}
--
-- This leaves only the possibility that the function $enum(.,s)$ is not 1-1 on $b$,
-- in which case there must exist two distinct ordinals $v$ and $wp$, both in $b$, such that $enum(v,s) = enum(wp,s)$.
--
    ELEM ==> Stat9: not(FORALL y in b, wz in b | ((y /= wz) imp (enum(y,s) /= enum(wz,s))))
    (v,wp)-->Stat9 ==> (v in b) & (wp in b) & (v /= wp) & (enum(v,s) = enum(wp,s))
--
-- But, by Theorem 44, this can only happen if $s$ is in one of the sets
-- ${enum(y,s): y in v}$ and ${enum(y,s): y in wp}$. However, both of these possibilities
-- are ruled out by Stat5 if we take Theorem 41 into account.
-- So we have a contradiction proving our theorem.
--
    (v,wp,s)-->T44 ==> (s in {enum(y,s): y in v}) or (s in {enum(y,s): y in wp})
    v-->Stat5 ==> not (s incin {enum(x,s): x in v})
    wp-->Stat5 ==> not (s incin {enum(x,s): x in wp})
    (v,s)-->T41 ==> (s in {enum(y,s): y in v}) imp (s incin {enum(y,s): y in v})
    (wp,s)-->T41 ==> (s in {enum(y,s): y in wp}) imp (s incin {enum(y,s): y in wp})
    Discharge ==> QED
--
-- ************************************************************************************************
--						Section 5: Maps, map restrictions, and Cardinality
-- ************************************************************************************************
--
-- Our next main goal is to introduce the notion of cardinality and prove its properties.
-- In working with this notion we will find use for the familiar mathematical ideas appearing
-- in the following auxiliary definitions.
--
Def 12: [Map Restriction] Def(f ON a) := {p in f | car(p) in a}
Def 13: [Value of single-valued function] Def(f~[x]) := cdr(arb(f ON {x}))
--
Def 14: [Map Product] Def(F @ G) := {[car(x),cdr(y)]: x in G, y in F | cdr(x) = car(y)}
Def 14a: [Inverse Map] inv(F) := {[cdr(x),car(x)]: x in F}
Def 14b: [Identity Map on a set $S$] ident(S) := {[x,x]: x in S}
--
-- We define the notion of 'the enumerating ordinal of a set' by Skolemizing Theorem 46.
-- The formal definition is as follows.

APPLY(v1_thryvar:enum_Ord) Skolem() ==>
Theorem 47: [Enumeration single-valuedness principle] (FORALL s | (Ord(enum_Ord(s)) & (s = {enum(y,s): y in enum_Ord(s)}) &
		(FORALL y in enum_Ord(s), z0 in enum_Ord(s) | ((y /= z0) imp (enum(y,s) /= enum(z0,s))))))

--
-- Using the preceding definition, we can define the Cardinality $#s$ of a set $s$
-- as the smallest ordinal in one-one correspondence with $s$. (The existence of such an ordinal
-- follows from the fact that the set $next(enum_Ord(s))$ must contain at least one such.)
--
Def 15: [Cardinality]
    Def(#S) := arb({x: x in next(enum_Ord(S)) | (EXISTS f in OM | (one_1_map(f) & (domain(f) = x) & (range(f) = S)))})
--
-- An ordinal $c$ is said to be a cardinal if it cannot be seen as the range of any
-- single valued map on a smaller ordinal. We shall see below that this
-- is equivalent to the condition that $c$ cannot be put into
-- 1-1 correspondence with any smaller ordinal.
--
Def 16: [Is-a-cardinal predicate]
 Card(C) := Ord(C) &
	(FORALL y in C, f in OM | (not(domain(f) = y) or not(range(f) = C) or not(Svm(f))))
--
-- In preparation with our work with cardinals we prove various small
-- utility lemmas having to do with map restrictions, single-valued maps, 1-1 maps,
-- map products and inverses, identity maps, etc.
--
-- The first of these simply says that a restriction of a map $f$ is a subset of $f$,
-- a fact immediate if we use proof by monotonicity.
--
Theorem 48: [Map restriction lemma] (F ON A) incin F. Proof:
	Suppose_not(f,a) ==> not((f ON a) incin f)
	Use_def(ON) ==> not({p: p in f | car(p) in a} incin f)
    Set_monot ==> {p: p in f | car(p) in a} incin {p: p in f}
    Discharge ==> QED
--
-- Next we note the even more elementary fact that the intersection
-- of two sets can be written as a setformer.
--
Theorem 49: [Set intersection formula] S * T = {x in S | x in T}. Proof:
Suppose_not(s,t) ==> Stat1: s * t /= {x in s | x in t}
	c-->Stat1 ==> ((c in s * t) & (c notin {x in s | x in t})) or ((c notin s * t) & (c in {x in s | x in t}))
	Suppose ==>  Stat2: (c notin {x in s | x in t}) & (c in s * t)
	c-->Stat2 ==> false; Discharge ==> Stat3: (c in {x in s | x in t}) & (c notin s * t)
()-->Stat3 ==> false; Discharge ==> QED
--
-- The existence of a similar setformer defining the difference of two sets is equally elementary.
--
Theorem 50: [Set difference formula] S - T = {x in S | x notin T}. Proof:
Suppose_not(s,t) ==> Stat1: s - t /= {x in s | x notin t}
	c-->Stat1 ==> (((c in s - t) & (c notin {x in s | x notin t})) or ((c notin s - t) & (c in {x in s | x notin t})))
	Suppose ==>  Stat2: (c notin {x in s | x notin t}) & (c in s - t)
	c-->Stat2 ==> false; Discharge ==> (c notin s - t) & Stat3: (c in {x in s | x notin t})
()-->Stat3 ==> false; Discharge ==> QED
--
-- Our next utility lemma puts the definition of the $Is_map$ predicate
-- into a sightly more convenient form by showing that every element of a map $f$ is a pair,
-- and that every set all of whose elements are pairs must be a map.
--
Theorem 51: [Map members are pairs] (Is_map(F) imp ((X in F) imp (X = [car(X),cdr(X)]))) &
		((FORALL x in F | x = [car(x),cdr(x)]) imp Is_map(F)). Proof:
Suppose_not(f,x) ==>(Is_map(f) & (x in f) & (x /= [car(x),cdr(x)])) or
		(not((FORALL x in f | x = [car(x),cdr(x)]) imp Is_map(f)))
--
-- We must consider one of two contrary cases. Start with the first,
-- in which a map has an element which is not a pair.
-- This is impossible by definition; only the second case need be considered.
--
	Suppose ==> Stat1: Is_map(f) & (x in f) & (x /= [car(x),cdr(x)])
		Use_def(Is_map) ==> Stat2: x in {[car(y),cdr(y)]: y in f}
		c-->Stat2(Stat2*) ==> Stat3: x = [car(c),cdr(c)]
		(Stat3)ELEM ==> (car(x) = car(c))
		(Stat3)ELEM ==> (cdr(x) = cdr(c))
		EQUAL(Stat3) ==> x = [car(x),cdr(x)]
	(Stat1*)Discharge ==> Stat4: not(Is_map(f))
--
-- In this second case we have a set of pairs, which by definition
-- differs from the collection of all pairs in it, another impossibility.
-- So our theorem is proved.
--
	f-->T26(Stat4) ==> Stat5: not(f incin {[car(x),cdr(x)]: x in f}) & Stat6: (FORALL x in f | x = [car(x),cdr(x)])
	d-->Stat5(Stat5) ==> Stat7: (d in f) & Stat8: (d notin {[car(x),cdr(x)]: x in f})
	Suppose ==> Stat9: not(FORALL x in f | d /= [car(x),cdr(x)])
		dd-->Stat9(Stat9) ==> Stat10: (dd in f) & (d = [car(dd),cdr(dd)])
	dd-->Stat8(Stat10) ==> false; Discharge ==> Stat11: (FORALL x in f | d /= [car(x),cdr(x)])
	d-->Stat11(Stat7,Stat7) ==> Stat12: d /= [car(d),cdr(d)]
d-->Stat6(Stat7,Stat12) ==> false; Discharge ==> QED
--
-- As stated next, any subset of a map is a map.
-- Once more we have only to use the definition, and then monotonicity.
--
Theorem 52: [Map subsets are maps] (G incin F & Is_map(F)) imp Is_map(G). Proof:
    Suppose_not(g,f) ==> AUTO
    Suppose ==> Stat1: not(FORALL x in f | x = [car(x),cdr(x)])
    y-->Stat1 ==> AUTO
    (f,y)-->T51 ==> false; Discharge ==> AUTO
    (g,junk)-->T51 ==> (not(FORALL x in g | x = [car(x),cdr(x)]))
    Pred_monot ==> (FORALL x in f | x = [car(x),cdr(x)]) imp (FORALL x in g | x = [car(x),cdr(x)])
    Discharge ==> QED
--
-- Similarly, any subset of a single-valued map is a single-valued map.
-- Again, the proof is by monotonicity.
--
Theorem 53: [Single-valued map subsets are single-valued] ((G incin F) & Svm(F)) imp Svm(G). Proof:
    Suppose_not(g,f) ==> (g incin f) & Svm(f) & (not Svm(g))
    Use_def(Svm) ==> Is_map(f) & (FORALL x in f, y in f | ((car(x) = car(y)) imp (x = y))) &
	(not(Is_map(g) & (FORALL x in g, y in g | ((car(x) = car(y)) imp (x = y)))))
    (g,f)-->T52 ==> (not((FORALL x in g, y in g | ((car(x) = car(y)) imp (x = y)))))
    Pred_monot ==> ((FORALL x in f, y in f | ((car(x) = car(y)) imp (x = y)))) imp
	(FORALL x in g, y in g | ((car(x) = car(y)) imp (x = y)))
    Discharge ==> QED
--
-- Proof by monotonicity also suffices to show that any subset of a 1-1 map is also a 1-1 map.
--
Theorem 54: [One-one map subsets are one-one] ((G incin F) & one_1_map(F)) imp one_1_map(G). Proof:
Suppose_not(g,f) ==> (g incin f) & one_1_map(f) & (not one_1_map(g))
	Use_def(one_1_map) ==> Svm(f) & (FORALL x in f, y in f | ((cdr(x) = cdr(y)) imp (x = y))) &
		(not(Svm(g) & (FORALL x in g, y in g | ((cdr(x) = cdr(y)) imp (x = y)))))
	(g,f)-->T53 ==> (not(FORALL x in g, y in g | ((cdr(x) = cdr(y)) imp (x = y))))
	Pred_monot ==> (FORALL x in f, y in f | ((cdr(x) = cdr(y)) imp (x = y))) imp
		(FORALL x in g, y in g | ((cdr(x) = cdr(y)) imp (x = y)))
Discharge ==> QED
--
-- To show that a map product is always a map, we have only to expand the definition and simplify.
--
Theorem 55: [Map compositions are maps] Is_map(F @ G). Proof:
Suppose_not(f,g) ==> not Is_map(f @ g)
	Use_def(@) ==> not Is_map({[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)})
	Use_def(Is_map) ==> {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)} /=
		{[car(u),cdr(u)]: u in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}}
	SIMPLF ==> {[car(u),cdr(u)]: u in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}} =
		{[car([car(x),cdr(y)]),cdr([car(x),cdr(y)])]: x in g, y in f | cdr(x) = car(y)}
	Set_monot ==>  {[car([car(x),cdr(y)]),cdr([car(x),cdr(y)])]: x in g, y in f | cdr(x) = car(y)} =
		{[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}
Discharge ==> QED
--
-- The next three theorems are simple corollaries of Theorem 48 and of Theorem 52, Theorem 53, and Theorem 54 respectively.
--
Theorem 56: [Map restrictions are maps] Is_map(F) imp Is_map(F ON S). Proof:
    Suppose_not(f,s) ==> Is_map(f) & (not Is_map(f ON s))
    (f,s)-->T48 ==> (f ON s) incin f
    (f ON s,f)-->T52 ==> false; Discharge ==> QED
--
Theorem 57: [Restrictions of single-valed maps are single-valued] Svm(F) imp Svm(F ON S). Proof:
    Suppose_not(f,s) ==> Svm(f) & (not Svm(f ON s))
    (f,s)-->T48 ==> (f ON s) incin f
    (f ON s,f)-->T53 ==> false; Discharge ==> QED
--
Theorem 58: [Restrictions of one-one maps are one-one] one_1_map(F) imp one_1_map(F ON S). Proof:
    Suppose_not(f,s) ==> AUTO
    (f,s)-->T48 ==> (f ON s) incin f
    (f ON s,f)-->T54 ==> false; Discharge ==> QED
--
-- Next we note the elementary fact that the empty set is a single-valued map,
-- a 1-1 map, and that its domain and range are both the empty set.
--
Theorem 59: [The null set as a map] Is_map(0) & Svm(0) & (one_1_map(0)) & (range(0) = 0) & (domain(0) = 0). Proof:
    Suppose_not ==> AUTO
--
-- Indeed, all the facts follow immediately by application of our utility
-- $fcn_symbol$ THEORY to $0 = {[x,x]: x in 0}$.
--
    Use_def(Svm(0)) ==> AUTO
 --    Use_def(Svm) ==> Svm(0) eq (Is_map(0) &
 --			(FORALL x in 0, y in 0 | ((car(x) = car(y)) imp (x = y))))
    ELEM ==> not (Svm(0) & (one_1_map(0)) & (range(0) = 0) & (domain(0) = 0))
    Loc_def ==> g = {[x,x]: x in 0}
    APPLY(x9_thryvar:a,y9_thryvar:b) fcn_symbol(f(x)->x,g->g,s->0) ==>
		Svm(g) & (domain(g) = 0) & (range(g) = {x: x in 0}) & (((a in 0) & (b in 0)) or one_1_map(g))
    Suppose ==> Stat1: not(FORALL x in 0, y in 0 | ((x = x) imp (x = y)))
    c-->Stat1 ==> false; Discharge ==> one_1_map(g)
    Set_monot ==> {x: x in 0} = {[x,x]: x in 0}
    Set_monot ==> 0 = {x: x in 0}
    EQUAL ==> Svm(0) & (domain(0) = 0) & (range(0) = 0) & one_1_map(0)
    Discharge ==> QED
--
-- Next we state two entirely elementary facts concerning the range and domain of a map $f$:
-- for each $x in f$, $car(x)$ is in $domain(f)$ and $cdr(x)$ is in $range(f)$.
--
Theorem 60: [Domain membership lemma] (X in F) imp (car(X) in domain(F)). Proof:
    Suppose_not(c,f) ==> AUTO
    Use_def(domain) ==> Stat1: not car(c) in {car(x): x in f}
    c-->Stat1 ==> AUTO
    Discharge ==> QED
--
Theorem 61: [Range membership lemma] (X in F) imp (cdr(X) in range(F)). Proof:
    Suppose_not(c,f) ==> AUTO
    Use_def(range) ==> Stat1: not(cdr(c) in {cdr(x): x in f})
    c-->Stat1 ==> AUTO
    Discharge ==> QED
--
-- It is also an elementary consequence of the definition that the union of two maps is a map.
--
Theorem 62: [Map unions are maps] (Is_map(F) & Is_map(G)) imp Is_map(F + G). Proof:
    Suppose_not(f,g) ==> AUTO
    Use_def(Is_map) ==> (f = {[car(x),cdr(x)]: x in f}) & (g = {[car(x),cdr(x)]: x in g}) &
	(f + g /= {[car(x),cdr(x)]: x in f + g})
    Set_monot ==> {[car(x),cdr(x)]: x in f + g} = {[car(x),cdr(x)]: x in f} + {[car(x),cdr(x)]: x in g}
    Discharge ==> QED
--
-- Next we show that the map restriction operation is additive in its second argument.
-- Again, this is an entirely elementary consequence of the definition, by set monotonicity.
--
Theorem 63: [Map restriction is additive] F ON (A + B) = (F ON A) + (F ON B). Proof:
Suppose_not(f,a,b) ==> AUTO
	Use_def(ON) ==>
		{p in f | car(p) in a + b} /= {p in f | car(p) in a} + {p in f | car(p) in b}
	Set_monot ==> {p in f | car(p) in a + b} = {p in f | (car(p) in a) or (car(p) in b)}
	Set_monot ==> {p in f | (car(p) in a) or (car(p) in b)} = {p in f | car(p) in a} + {p in f | car(p) in b}
Discharge ==> QED
--
-- The map restriction operation is also additive in its first argument
-- the argument being similar and equally elementary.
--
Theorem 64: [Restriction of union maps] (F + G) ON A = (F ON A) + (G ON A). Proof:
Suppose_not(f,g,a) ==> ((f + g) ON a) /= (f ON a) + (g ON a)
	Use_def(ON) ==> {p in (f + g) | car(p) in a} /= {p in f | car(p) in a} + {p in g | car(p) in a}
	Set_monot ==> {p in (f + g) | car(p) in a} = {p in f | car(p) in a} + {p in g | car(p) in a}
Discharge ==> QED
--
-- The fact that the range and domain of a map $f$ are both monotone increasing functions of $f$
-- also follows immediately by set monotonicity.
--
Theorem 65: [Monotonicity of range and domain sets] (F incin G) imp ((range(F) incin range(G)) & (domain(F) incin domain(G))). Proof:
Suppose_not(f,g) ==> (f incin g) & (not((range(f) incin range(g)) & (domain(f) incin domain(g))))
	Suppose ==> not(range(f) incin range(g))
	Use_def(range) ==> not({cdr(x): x in f} incin {cdr(x): x in g})
	Set_monot ==> {cdr(x): x in f} incin {cdr(x): x in g}
	Discharge ==> not(domain(f) incin domain(g))
	Use_def(domain) ==> not({car(x): x in f} incin {car(x): x in g})
	Set_monot ==> {car(x): x in f} incin {car(x): x in g}
Discharge ==> QED
--
-- Our next theorem states the important but elementary fact that map composition is associative.
--
Theorem 66: [Associativity of map multiplication] F @ (G @ H) = (F @ G) @ H. Proof:
Suppose_not(f,g,h) ==> f @ (g @ h) /= (f @ g) @ h
	Use_def(@) ==> f @ (g @ h) = {[car(x),cdr(v)]: x in {[car(x),cdr(y)]: x in h, y in g | cdr(x) = car(y)}, v in f | cdr(x) = car(v)}
	Use_def(@) ==> (f @ g) @ h = {[car(x),cdr(y)]: x in h, y in {[car(y),cdr(v)]: y in g, v in f | cdr(y) = car(v)} | cdr(x) = car(y)}
	ELEM ==> {[car(x),cdr(v)]: x in {[car(x),cdr(y)]: x in h, y in g | cdr(x) = car(y)}, v in f | cdr(x) = car(v)} /=
		 {[car(x),cdr(y)]: x in h, y in {[car(y),cdr(v)]: y in g, v in f | cdr(y) = car(v)} | cdr(x) = car(y)}
--
-- For if not, simplification after using the definition of map composition
-- gives us the following inequality, and so the elementary inequality seen just below it.
-- But since this is impossible our lemma follows.
--
	SIMPLF ==> Stat1: {[car([car(x),cdr(y)]),cdr(v)]: x in h, y in g, v in f | (cdr(x) = car(y)) & (cdr([car(x),cdr(y)]) = car(v))} /=
			  {[car(x),cdr([car(y),cdr(v)])]: x in h, y in g , v in f | (cdr(y) = car(v)) & (cdr(x) = car([car(y),cdr(v)]))}
	(x,y,v)-->Stat1 ==> ([car([car(x),cdr(y)]),cdr(v)] /= [car(x),cdr([car(y),cdr(v)])]) or
	(not(((cdr(x) = car(y)) & (cdr([car(x),cdr(y)]) = car(v))) eq ((cdr(y) = car(v)) & (cdr(x) = car([car(y),cdr(v)])))))
Discharge ==> QED
--
-- Now we show that the restriction of a map $f$ to its own domain is simply $f$.
--
Theorem 67: [Restriction of a map to its own domain] F ON domain(F) = F. Proof:
    Suppose_not(f) ==> not((f ON domain(f)) = f)
--
-- For if not, it follows by Theorem 48 that there must be
-- some element $a in f$ which is not in ${p in f | car(p) in domain(f)}$,
-- which is clearly impossible by Theorem 60.
--
    (f,domain(f))-->T48 ==> (f ON domain(f)) incin f
    ELEM ==> not((f ON domain(f)) incs f)
    Use_def(ON) ==> Stat1: not({p in f | car(p) in domain(f)} incs f)
    (a)-->Stat1 ==> (a in f) & Stat2: (not(a in {p in f | car(p) in domain(f)}))
    (a)-->Stat2 ==> car(a) notin domain(f)
    (a,f)-->T60 ==> false; Discharge ==> QED
--
-- The following easy lemma generalizes the fact that the restriction of any map $f$
-- to its own domain is $f$ itself.
--
Theorem 68: [Restriction to an intersection set] F ON (domain(F) * T) = F ON T. Proof:
    Suppose_not(f,t) ==> f ON (domain(f) * t) /= f ON t
--
-- For if not, the additivity of map restriction would imply that
-- $f ON (t - domain(f)) /= 0$, which is easily seen to be imposible.
--
    TELEM ==> t = (domain(f) * t) + (t - domain(f))
    EQUAL ==> f ON t = f ON ((domain(f) * t) + (t - domain(f)))
    (f,(domain(f) * t), (t - domain(f)))-->T63 ==> f ON (t - domain(f)) /= 0
    Use_def(ON) ==> Stat1: {p in f | car(p) in (t - domain(f))} /= 0
    a-->Stat1 ==> (a in f) & (car(a) in (t - domain(f)))
    (a,f)-->T60 ==> false; Discharge ==> QED
--
-- The preceding lemma can be put more generally.
--
Theorem 69: [Double restriction] F ON (S * T) = (F ON S) ON T. Proof:
    Suppose_not(f,s,t) ==> f ON (s * t) /= (f ON s) ON t
	Use_def(ON) ==> f ON s = {q in f | car(q) in s}
 	Use_def(ON) ==> (f ON s) ON t = {p in {q in f | car(q) in s} | car(p) in t}
 	SIMPLF ==> (f ON s) ON t = {q in f | (car(q) in t) & (car(q) in s)}
 	Use_def(ON) ==> (f ON (s * t)) = {q in f | car(q) in s * t}
 	ELEM ==> not(({q in f | (car(q) in t) & (car(q) in s)} incin {q in f | car(q) in s * t}) & ({q in f | (car(q) in t) & (car(q) in s)} incs {q in f | car(q) in s * t}))
 	Suppose ==> Stat1: not({q in f | (car(q) in t) & (car(q) in s)} incin {q in f | car(q) in s * t})
 	c-->Stat1 ==> (c in f) & (car(c) in t) & (car(c) in s) & (car(c) notin s * t)
 	ELEM ==> false; Discharge ==> Stat2: not({q in f | (car(q) in t) & (car(q) in s)} incs {q in f | car(q) in s * t})
  	c1-->Stat1 ==> (c1 in f) & (not((car(c1) in t) & (car(c1) in s))) & (car(c1) in s * t)
  	Discharge ==> QED
--
-- The following triviality is sometimes useful.
Theorem 70: [Null restriction] F ON 0 = 0. Proof:
    Suppose_not(f) ==> AUTO
	Use_def(ON) ==> Stat1: {q in f | car(q) in 0} /= 0
	c-->Stat1 ==> false; Discharge ==> QED
--
-- The following theorem tells us that, as we have defined it,
-- the map value $f~[x]$ always belongs to the range of $f$,
-- provided that $x$ belongs to the domain of $f$;
-- this is true even if $f$ is not single-valued, or even if $f$ is not a map.
--
Theorem 71: [Map image elements belong to the map range] (X in domain(F)) imp ((F~[X]) in range(F)). Proof:
    Suppose_not(x,f) ==> (x in domain(f)) & (not((f~[x]) in range(f)))
--
-- For if not, then by definition there must be some $c in f$
-- such that $cdr(arb({p in f | car(p) in {car(c)}}))$ does not belong to ${cdr(y): y in f}$.
--
    Use_def(range) ==> not((f~[x]) in {cdr(y): y in f})
    Use_def(~) ==> not(cdr(arb(f ON {x})) in {cdr(y): y in f})
    Use_def(ON) ==> Stat1: cdr(arb({p in f | car(p) in {x}})) notin {cdr(y): y in f}
    Use_def(domain) ==> Stat2: x in {car(y): y in f}
    c-->Stat2 ==> (x = car(c)) & (c in f)
--
-- But $c$ clearly belongs to the set ${p in f | car(p) in {car(c)}}$,
-- which is therefore nonempty, from which it follows by the axiom of choice
-- that $arrb := arb({p in f | car(p) in {x}})$ belongs to this same set.
--
    Suppose ==> Stat3: not(c in {p in f | car(p) in {x}})
    Suppose ==> Stat4: not(FORALL p in f | ((car(p) in {x}) imp (p /= c)))
    q-->Stat4 ==> (q in f) & (car(q) in {x}) & (q = c)
    q-->Stat3 ==>  false; Discharge ==> Stat5: (FORALL p in f | ((car(p) in {x}) imp (p /= c)))
    c-->Stat5 ==> (car(c) in {x}) imp (c /= c)
    Discharge ==> c in {p in f | car(p) in {x}}
    ({p in f | car(p) in {x}})-->T0 ==> arb({p in f | car(p) in {x}}) in {p in f | car(p) in {x}}
--
-- Hence $arrb$ must belong to the larger set $f$. By Stat1, this implies
-- the impossible inequality seen below, proving our theorem.
--
    Set_monot ==> {p in f | car(p) in {x}} incin {p: p in f}
    ELEM ==> arb({p in f | car(p) in {x}}) in {p: p in f}
    SIMPLF ==> arb({p in f | car(p) in {x}}) in f
    (arb({p in f | car(p) in {x}}))-->Stat1 ==>
	cdr(arb({p in f | car(p) in {x}})) /= cdr(arb({p in f | car(p) in {x}}))
    Discharge ==> QED
--
-- It is convenient to summarize some of the key results derived above
-- in the following auxiliary THEORY, which specializes them and eases their use.
-- We focus on maps of the form ${[x,f(x)]: x in s}$, which are always single-valued.
--
THEORY fcn_symbol(f(x),g,s)  [Contains some elementary lemmas about single-valued functions]
     g = {[x,f(x)]: x in s}
END fcn_symbol;
--
ENTER_THEORY fcn_symbol

-- Note: till we return from 'fcn_symbol' to set theory, we are
--	reasoning within the theory, so $g = {[x,f(x)]: x in s}$ is available
--	as an axiom, and all theorems proved are added to the set
--	of conclusions of the theory, rather than to the set of conclusions
--	of the top-level set-theory.

--
-- First we show that the domain of $g$ is simply $s$.
--
Theorem fcn_symbol.1: [Mapformer domain] domain(g) = s. Proof:
    Suppose_not ==> domain(g) /= s
--
-- For in the contrary case we would have ${car(x): x in {[x,f(x)]: x in s}} /= s$
-- by definition, so there would exist an $x in s$ such that $car([x,f(x)]) /= x$,
-- which is impossible.
--
    Use_def(domain) ==> {car(x): x in g} /= s
    Assump ==> g = {[y,f(y)]: y in s}
    EQUAL ==> {car(x): x in g} = {car(x): x in {[y,f(y)]: y in s}}
    ELEM ==> {car(x): x in {[y,f(y)]: y in s}} /= s
	SIMPLF ==> {car([y,f(y)]): y in s} /= {x: x in s}
	Set_monot ==> {car([y,f(y)]): y in s} = {y: y in s}
    Discharge ==> QED
--
-- Next we show that $g~[x] = f(x)$ for any $x in s$.
--
Theorem fcn_symbol.2: [Image by a mapformer] (XX in s) imp (g~[XX] = f(XX)). Proof:
    Suppose_not(c) ==> (c in s) & (g~[c] /= f(c))
--
-- For suppose not, and let $c in s$ be a counterexample, so that by definition
-- of functional application (and map restriction) we would have
-- $cdr(arb({[x,f(x)]: x in s | car([x,f(x)]) in {c}})) /= f(c)$.
--
    Use_def(~) ==> cdr(arb(g ON {c})) /= f(c)
    Use_def(ON) ==> cdr(arb({p in g | car(p) in {c}})) /= f(c)
    Assump ==> g = {[x,f(x)]: x in s}
	EQUAL ==> cdr(arb({p in {[x,f(x)]: x in s} | car(p) in {c}})) /= f(c)
	SIMPLF ==> cdr(arb({[x,f(x)]: x in s | car([x,f(x)]) in {c}})) /= f(c)
--
-- We can simplify ${[x,f(x)]: x in s | car([x,f(x)]) in {c}}$ to ${[x,f(x)]: x in s | x in {c}}$,
-- for if these sets were different there would be a $d in s$ such that the conditions
-- $car([d,f(d)]) in {c}$ and $d in c$ were inequivalent, which is impossible.
--
	Suppose ==> Stat1: {[x,f(x)]: x in s | car([x,f(x)]) in {c}} /= {[x,f(x)]: x in s | x in {c}}
	d-->Stat1 ==> (d in s) & (not ((car([d,f(d)]) in {c}) eq (d in {c})))
	Discharge ==> {[x,f(x)]: x in s | car([x,f(x)]) in {c}} = {[x,f(x)]: x in s | x in {c}}
--
-- But ${[x,f(x)]: x in s | x in {c}}$ simplifies in two steps to ${[x,f(x)]: x in {c}}$,
-- which is the same as ${[c,f(c)]}$. Hence if our theorem is false we would have
-- $cdr(arb({[c,f(c)]})) /= f(c)$, a contradiction proving the theorem.
--
	Suppose ==> Stat2: {[x,f(x)]: x in s | x in {c}} /= {[x,f(x)]: x in {c}}
	e-->Stat2 ==> ((e in {[x,f(x)]: x in s | x in {c}}) & (e notin {[x,f(x)]: x in {c}})) or
		((e notin {[x,f(x)]: x in s | x in {c}}) & (e in {[x,f(x)]: x in {c}}))
	Suppose ==> Stat3: (e in {[x,f(x)]: x in s | x in {c}}) & Stat4: (e notin {[x,f(x)]: x in {c}})
	e1-->Stat3 ==> (e = [e1,f(e1)]) & (e1 in s) & (e1 in {c})
	e1-->Stat4 ==> false; Discharge ==> Stat5: (e notin {[x,f(x)]: x in s | x in {c}}) & Stat6: (e in {[x,f(x)]: x in {c}})
	e2-->Stat6 ==> (e = [e2,f(e2)]) & (e2 in {c})
	e2-->Stat5 ==> false; Discharge ==> {[x,f(x)]: x in s | x in {c}} = {[x,f(x)]: x in {c}}
	SIMPLF ==> {[x,f(x)]: x in {c}} = {[c,f(c)]}
	EQUAL ==> cdr(arb({[c,f(c)]})) /= f(c)
	Discharge ==> QED
--
-- We reformulate the preceding theorem in quantified form.
--
Theorem fcn_symbol.2a: [Image by a mapformer, quantified form] (FORALL x in s | g~[x] = f(x)). Proof:
	Suppose_not ==> Stat1: AUTO
	x-->Stat1 ==> (x in s) & (g~[x] /= f(x))
	x-->Tfcn_symbol.2 ==> false; Discharge ==> QED
--
-- Our next theorem rounds out the preceding result by showing that $g~[x] = 0$ for $x notin s$.
--
Theorem fcn_symbol.3: [Elements not in a mapformer domain] (XX notin s) imp (g~[XX] = 0). Proof:
    Suppose_not(c) ==> Stat1: ((c notin s) & g~[c] /= 0)
--
-- For suppose not, and let $c$ in $s$ be a counterexample. Then by definition
-- of functional application (and map restriction) the value
-- $arb({[x,f(x)]: x in s | car([x,f(x)]) in {c}})$ must be nonzero,
-- and then by the axiom of choice so is the set ${[x,f(x)]: x in s | car([x,f(x)]) in {c}}$.
--
    Use_def(~) ==> (c notin s) & cdr(arb(g ON {c})) /= 0
    Suppose ==>  arb(g ON {c}) = 0
        EQUAL ==> cdr(0) /= 0
        Use_def(cdr) ==> arb(arb(arb(0 - {arb(0)}) - {arb(0)})) /= 0
        TELEM ==> 0 - {arb(0)} = 0
        EQUAL ==> arb(arb(arb(0) - {arb(0)})) /= 0
        0-->T0(*) ==> arb(0) = 0
        TELEM ==> arb(0) - {arb(0)} = 0
        EQUAL ==> arb(arb(0)) /= 0
        EQUAL ==> arb(0) /= 0
    EQUAL ==> false; Discharge ==> arb(g ON {c}) /= 0
    Use_def(ON) ==> (g ON {c}) = {p in g | car(p) in {c}}
    EQUAL ==> arb({p in g | car(p) in {c}}) /= 0
    Assump ==> g = {[x,f(x)]: x in s}
    EQUAL ==> arb({p in {[x,f(x)]: x in s} | car(p) in {c}}) /= 0
    SIMPLF ==> Stat2: arb({[x,f(x)]: x in s | car([x,f(x)]) in {c}}) /= 0
    {[x,f(x)]: x in s | car([x,f(x)]) in {c}}-->T0(Stat2*) ==>
    				Stat3: {[x,f(x)]: x in s | car([x,f(x)]) in {c}} /= 0
--
-- Hence there would exist a $d in s$ such that $car([d,f(d)]) in {c}$, implying $c in s$,
-- a contradiction which proves our assertion.
--
    d-->Stat3() ==> Stat4: (d in s) & (car([d,f(d)]) in {c})
    (Stat1,Stat4)Discharge ==> QED
--
-- The following result summarizes the two which precede it.
--
Theorem fcn_symbol.4: [Mapformer image in general] g~[XX] = if XX in s then f(XX) else 0 end if. Proof:
    Suppose_not(c) ==> g~[c] /= if c in s then f(c) else 0 end if
	c-->Tfcn_symbol.3 ==> c in s
	c-->Tfcn_symbol.2 ==> false; Discharge ==> QED
--
-- We reformulate the preceding theorem in quantified form.
--
Theorem fcn_symbol.4a: [Image by a mapformer, quantified form] (FORALL x | g~[x] = if x in s then f(x) else 0 end if). Proof:
	Suppose_not ==> Stat1: AUTO
	x-->Stat1 ==> g~[x] /= if x in s then f(x) else 0 end if
	(g,x)-->Tfcn_symbol.4 ==> false; Discharge ==> QED
--
-- It is easy to derive the following formula for the range of a map $g$:
--
Theorem fcn_symbol.5: [Range of a mapformer] range(g) = {f(xx) : xx in s}. Proof:
Suppose_not ==> range(g) /= {f(x) : x in s}
--
-- For if not, it follows by definition of range that
-- ${cdr([x,f(x)]): x in s} /= {f(x) : x in s}$,
-- implying the existence of an x such that $cdr([x,f(x)]) /= f(x)$,
-- which is impossible.
--
	Use_def(range) ==> range(g) = {cdr(x): x in g}
	Assump ==> g = {[x,f(x)]: x in s}
	EQUAL ==> {cdr(x): x in {[x,f(x)]: x in s}} /= {f(x) : x in s}
	SIMPLF ==> {cdr([x,f(x)]): x in s} /= {f(x) : x in s}
	Set_monot ==> {cdr([x,f(x)]): x in s} = {f(x) : x in s}
Discharge ==> QED
--
-- And it is also easy to derive the following criterion for a map $g$ to be 1-1:
--
Def fcn_symbol.0a: [Witness to non-singlevaluedness of map inverse] xy7_thryvar := arb({[xx,yy]: xx in s, yy in s | (f(xx) = f(yy)) & (xx /= yy)})
Def fcn_symbol.0b: [First component of witness to non-singlevaluedness of map inverse] x9_thryvar := car(xy7_thryvar)
Def fcn_symbol.0c: [Second component of witness to non-singlevaluedness of map inverse] y9_thryvar := cdr(xy7_thryvar)
--
Theorem fcn_symbol.6: [Mapformer one-to-oneness test] ((x9_thryvar in s) & (y9_thryvar in s) & (f(x9_thryvar) = f(y9_thryvar)) & (x9_thryvar /= y9_thryvar)) or
					 one_1_map(g). Proof:
    Suppose_not ==> (not((x9_thryvar in s) & (y9_thryvar in s) & (f(x9_thryvar) = f(y9_thryvar)) & (x9_thryvar /= y9_thryvar))) &
    							(not one_1_map(g))
--
-- For if not, then it easily follows using our previously derived $one_1_test$ THEORY
-- that the set ${[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)}$ must be non-null,
-- so that by the axiom of choice and the definition of $x9_thryvar$, $y9_thryvar$
-- the pair $x9_thryvar,y9_thryvar$ must belong to it.
--
	APPLY(x6_thryvar:x,y6_thryvar:y) one_1_test(a(x)->x,b(x)->f(x),s->s) ==>
			((x in s) & (y in s) & (not((x = y) eq (f(x) = f(y))))) or one_1_map({[x,f(x)]: x in s})
      Assump ==> g = {[x,f(x)]: x in s}
	EQUAL ==> not one_1_map({[x,f(x)]: x in s})
	Suppose ==> Stat1: {[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)} = 0
	    (x,y)-->Stat1 ==> not((x in s) & (y in s) & (f(x) = f(y)) & (x /= y))
          Suppose ==> x = y
              EQUAL ==> f(x) = f(y)
          Discharge ==> x /= y
	ELEM ==> false; Discharge ==> {[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)} /= 0
	({[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)})-->T0 ==>
	arb({[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)}) in {[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)}
	Use_def(xy7_thryvar) ==>	Stat2: xy7_thryvar in {[x,y]: x in s, y in s | (f(x) = f(y)) & (x /= y)}
--
-- Hence there must exist elements $xx$ and $yy$ satisfying the condition seen below,
-- and since it is easily seen that these must be the two components $x9_thryvar$, $y9_thryvar$ of $xy7_thryvar$,
-- we have a contradiction with our hypothesis and so a proof of our assertion.
--
	(xx,yy)-->Stat2 ==> (xx in s) & (yy in s) & (xy7_thryvar = [xx,yy]) & (f(xx) = f(yy)) & (xx /= yy)
	ELEM ==> (xx = car(xy7_thryvar)) & (yy = cdr(xy7_thryvar))
    Use_def(x9_thryvar) ==> x9_thryvar = xx
    Use_def(y9_thryvar) ==> y9_thryvar = yy
    EQUAL ==> false; Discharge ==> QED
--
-- It follows immediately using our previously derived $Svm_test$ THEORY that $g$ must be single-valued.
--
 Theorem fcn_symbol.7: [?] Svm(g). Proof:
    Suppose_not ==> not Svm(g)
    APPLY(x3_thryvar:x,y3_thryvar:y) Svm_test(a(x)->x,b(x)->f(x),s->s) ==> (((x = y) & (f(x) /= f(y))) or Svm({[x,f(x)]: x in s}))
    Assump ==> g = {[x,f(x)]: x in s}
    EQUAL ==> (((x = y) & (f(x) /= f(y))) or Svm(g))
    ELEM ==> (x = y) & (f(x) /= f(y))
    EQUAL ==> false; Discharge ==> QED
--

ENTER_THEORY Set_theory
-- Note: this exits the subtheory 'fcn_symbol', and re-enters the main Set_theory.

-- Note: if we used 'DISPLAY fcn_symbol' at this point, the result would be as follows:
--
--DISPLAY fcn_symbol
--
--THEORY fcn_symbol(f(x),g,s)
--     g = {[x,f(x)]: x in s}
--==>(x9_thryvar,y9_thryvar)
--    domain(g) = s
--    (FORALL x | (x in s) imp (g~[x] = f(x)))
--    (FORALL x | (x notin s) imp (g~[x] = 0))
--    (FORALL x | g~[x] = if x in s then f(x) else 0 end if)
--    range(g) = {f(x) : x in s}
--   ((x9_thryvar in s) & (y9_thryvar in s) & (f(x9_thryvar) = f(y9_thryvar)) & (x9_thryvar /= y9_thryvar)) or
--								 one_1_map(g)
--    Svm(g)
--END fcn_symbol;

--
-- Single valued maps can always be represented in the convenient form
-- required by the preceding theory and repeated in the following theorem.
-- Conversely, the preceding theory tells us that any set of this form is a single-valued map.
--
Theorem 72: [Form of a single-valued map] Svm(F) eq (F = {[x,F~[x]]: x in domain(F)}). Proof:
    Suppose_not(f) ==> (Svm(f) & (f /= {[x,f~[x]]: x in domain(f)})) or
						((not Svm(f)) & (f = {[x,f~[x]]: x in domain(f)}))
--
-- For the preceding theory tells us that ${[x,f~[x]]: x in domain(f)}$
-- is single valued, leaving only the first of the two above contrary possibilities.
--
    Suppose ==> Stat1: (not Svm(f)) & (f = {[x,f~[x]]: x in domain(f)})
    APPLY() fcn_symbol(f(x)->f~[x],g->f,s->domain(f)) ==> Svm(f)
    (Stat1)Discharge ==> Svm(f) & (f /= {[x,f~[x]]: x in domain(f)})
--
-- By definition of domain, map application, and map restriction,
-- the preceding inequality simplifies to
-- $f /= {[car(y),cdr(arb({u in f | car(u) in {car(y)}}))]: y in f}$.
--
    Use_def(domain) ==> f /= {[x,f~[x] ]: x in {car(y): y in f}}
    SIMPLF ==> f /= {[car(y),f~[car(y)]]: y in f}
    Use_def(~) ==> f /= {[car(y),cdr(arb(f ON {car(y)}))]: y in f}
    Use_def(ON) ==> f /= {[car(y),cdr(arb({u in f | car(u) in {car(y)}}))]: y in f}
--
-- Since $f$ is a single-valued map and hence a map, this implies the inequality seen below:
--
    Use_def(Svm) ==> Is_map(f) & Stat2: (FORALL x in f, y1 in f | ((car(x) = car(y1)) imp (x = y1)))
    Use_def(Is_map) ==> f = {[car(y),cdr(y)]: y in f}
    EQUAL ==> Stat3: {[car(y),cdr(y)]: y in f} /= {[car(y),cdr(arb({u in f | car(u) in {car(y)}}))]: y in f}
--
-- Hence there must exist a $y in f$ for which $cdr(y)$ and $cdr(arb({u in f | car(u) in {car(y)}}))$
-- are different,
--
	y-->Stat3 ==> Stat4: (y in f) & ([car(y),cdr(y)] /= [car(y),cdr(arb({u in f | car(u) in {car(y)}}))])
--
-- But it is easily seen that ${u in f | car(u) in {car(y)}} = {y}$.
--
	Suppose ==> Stat5: {u in f | car(u) in {car(y)}} /= {y}
	d-->Stat5(*) ==> Stat6: not((d in {u in f | car(u) in {car(y)}}) eq (d in {y}))
	Set_monot ==> {u in f | car(u) in {car(y)}} = {u in f | car(u) = car(y)}
	(Stat6*)ELEM ==> not((d in {u in f | car(u) = car(y)}) eq (d = y))
	Suppose ==> Stat7: (d = y) & Stat8: (d notin {u in f | car(u) = car(y)})
	d-->Stat8(Stat7,Stat4) ==> false; Discharge ==> Stat9: d in {u in f | car(u) = car(y)}
	()-->Stat9() ==> (d in f) & (car(d) = car(y))
	(d,y)-->Stat2 ==> false; Discharge ==> {u in f | car(u) in {car(y)}} = {y}
	EQUAL ==> Stat10: {[car(y),cdr(y)]: y in f} /= {[car(y),cdr(arb({y}))]: y in f}
	e-->Stat10 ==> false; Discharge ==> QED
--
-- The following corollary simply adds the formula for $range(f)$ to the preceding result.
--
Theorem 73: [Form of a single-valued map range] Svm(F) imp (F = {[x,F~[x]]: x in domain(F)} & (range(F) = {F~[x]: x in domain(F)})). Proof:
    Suppose_not(f) ==> Svm(f) & (not((f = {[x,f~[x]]: x in domain(f)}) & (range(f) = {f~[x]: x in domain(f)})))
    f-->T72 ==> (f = {[x,f~[x]]: x in domain(f)}) & (range(f) /= {f~[x]: x in domain(f)})
    Use_def(range) ==> {cdr(x): x in f} /= {f~[x]: x in domain(f)}
    EQUAL ==> {cdr(x): x in {[x,f~[x]]: x in domain(f)}} /= {f~[x]: x in domain(f)}
    SIMPLF ==> Stat1: {cdr([x,f~[x]]): x in domain(f)} /= {f~[x]: x in domain(f)}
    x-->Stat1 ==> cdr([x,f~[x]]) /= f~[x]
    Discharge ==> QED
--
-- The following is a variant of Theorem 72.
--
Theorem 74: [Map image formula] (Svm(F) & (X in F)) imp (F~[car(X)] = cdr(X)). Proof:
    Suppose_not(f,a) ==> AUTO
--
-- For if our theorem is false, then by Theorem 72 there is an $a$ in ${[car(x),f~[car(x)]]: x in f}$
-- such that $f~[car(a)] /= cdr(a)$.
--
    f-->T72 ==> a in {[x,f~[x]]: x in domain(f)}
    Use_def(domain) ==> a in {[x,f~[x]]: x in {car(x): x in f}}
    SIMPLF ==> Stat1: a in {[car(x),f~[car(x)]]: x in f}
--
-- Such an $a$ must have the form $[car(b),f~[car(b)]]$ where $b in f$, so that $car(a) = car(b)$;
-- but then, since $f$ is single valued, we must have $a = b$, so$ cdr(a) = f~[car(a)]$.
--
    b-->Stat1 ==> AUTO
    ELEM ==> car(a) = car(b)
    Use_def(Svm) ==> Stat2: (FORALL x in f, y in f | ((car(x) = car(y)) imp (x = y)))
    (a,b)-->Stat2 ==> a = b
    EQUAL ==> f~[car(b)] = f~[car(a)]
    Discharge ==> QED
--
-- The following elementary lemma, related to that just stated, is sometimes useful.
--
 Theorem 75: (X in domain(F)) imp (F~[X] in range(F)). Proof:
	Suppose_not(x,f) ==> AUTO
	Use_def(domain) ==> Stat1: x in {car(y): y in f}
	y-->Stat1 ==> (x = car(y)) & (y in f)
	Use_def(~) ==> f~[x] = cdr(arb(f ON {x}))
	Use_def(ON) ==> arb(f ON {x}) = arb({u in f | car(u) in {x}})
	Suppose ==> Stat2: y notin {u in f | car(u) in {x}}
	y-->Stat2 ==> false; Discharge ==> {u in f | car(u) in {x}} /= 0
	({u in f | car(u) in {x}})-->T0 ==> Stat3: arb(f ON {x}) in {u in f | car(u) in {x}}
	()-->Stat3 ==> arb(f ON {x}) in f
	Suppose ==> cdr(arb(f ON {x})) notin range(f)
	Use_def(range) ==> Stat4: cdr(arb(f ON {x})) notin {cdr(y): y in f}
	(arb(f ON {x}))-->Stat4 ==> false; Discharge ==> cdr(arb(f ON {x})) in range(f)
	Discharge ==> QED
--
-- The following lemma simply states the elementary fact that every element of a map is a pair.
--
Theorem 76: [Map members are pairs, 2] (Is_map(F) & (U in F)) imp (U = [car(U),cdr(U)]). Proof:
    Suppose_not(g,u) ==> Is_map(g) & (u in g) & (u /= [car(u),cdr(u)])
    Use_def(Is_map) ==> Stat1: u in {[car(x),cdr(x)]: x in g}
    a-->Stat1 ==> (a in g) & (u = [car(a),cdr(a)])
    EQUAL ==> Stat2: ([car(a),cdr(a)] /= [car([car(a),cdr(a)]),cdr([car(a),cdr(a)])])
    (Stat2)Discharge ==> QED
--
-- The following is another lemma sometimes useful in connection with maps.
--
Theorem 77: [Map domain member lemma] Is_map(F) imp ((X in domain(F)) eq ([X,F~[X]] in F)). Proof:
    Suppose_not(f,x) ==> Is_map(f) & (not((x in domain(f)) eq ([x,f~[x]] in f)))
--
-- For suppose the contrary, and first consider the case $x in domain(f)$,
-- so that there exists a $y in f$ such that $x = car(y)$.
--
	Suppose ==> (x in domain(f)) & ([x,f~[x]] notin f)
	Use_def(domain) ==> Stat1: (x in {car(y): y in f}) & ([x,f~[x]] notin f)
	y-->Stat1 ==> (x = car(y)) & (y in f)
--
-- By definition of the operators involved, $f~[x] is cdr(yy)$ for some $yy in f$
-- such that $car(yy) = x$.
--
	Use_def(~) ==> f~[x] = cdr(arb(f ON {x}))
	Use_def(ON) ==> f~[x] = cdr(arb({u: u in f | car(u) in {x}}))
	Suppose ==> Stat2: y notin {u: u in f | car(u) in {x}}
	y-->Stat2 ==> false; Discharge ==> y in {u: u in f | car(u) in {x}}
	{u: u in f | car(u) in {x}}-->T0 ==>
	Stat3: arb({u: u in f | car(u) in {x}}) in {u: u in f | car(u) in {x}}
	yy-->Stat3 ==> (arb({u: u in f | car(u) in {x}}) = yy) & (yy in f) & (car(yy) = x)
	EQUAL ==> (f~[x] = cdr(yy)) & (yy in f) & (car(yy) = x)
--
-- But by Theorem 76, this implies that $yy notin f$, a contradiction which excludes
-- the case $x in domain(f)$ of our initial assumption, leaving only the case $[x,f~[x]] in f$.
--
	EQUAL ==> [car(yy),cdr(yy)] notin f
	(f,yy)-->T76 ==> yy  notin f
	Discharge ==> (x notin domain(f)) & ([x,f~[x]] in f)
--
-- But then by definition we have an immediate contradiction which proves our theorem.
--
	Use_def(domain) ==> Stat4: x notin {car(v): v in f}
	[x,f~[x]]-->Stat4 ==> false; Discharge ==> QED
--
--
THEORY Must_be_svm(b(x),s,u)
END Must_be_svm;
--
ENTER_THEORY Must_be_svm
--
Theorem Must_be_svm.1: [Single-valued map former] Svm({[x,b(x)]: x in s}) & (domain({[x,b(x)]: x in s}) = s) & (range({[x,b(x)]: x in s}) = {b(x): x in s}) & ((u in s) imp ({[x,b(x)]: x in s}~[u] = b(u))). Proof:
	Suppose_not() ==> not(Svm({[x,b(x)]: x in s}) & (domain({[x,b(x)]: x in s}) = s) & (range({[x,b(x)]: x in s}) = {b(x): x in s}) & ((u in s) imp ({[x,b(x)]: x in s}~[u] = b(u))))
	APPLY() Iz_map(a(x)->x,b(x)->b(x),s->s) ==> (domain({[x,b(x)]: x in s}) = {x: x in s}) & (range({[x,b(x)]: x in s}) = {b(x): x in s})
	SIMPLF ==> {x: x in s} = s
	Suppose ==> not Svm({[x,b(x)]: x in s})
	APPLY(x3_thryvar:x,y3_thryvar:y) Svm_test(a(x)->x,b(x)->b(x),s->s) ==>
	((x in s) & (y in s) & (x = y) & (b(x) /= b(y))) or Svm({[x,b(x)]: x in s})
	ELEM ==> ((x in s) & (y in s) & (x = y) & (b(x) /= b(y)))
	EQUAL ==> b(x) = b(y)
	Discharge ==> (u in s) & ({[x,b(x)]: x in s}~[u] /= b(u))
	APPLY(x9_thryvar:junk1,y9_thryvar:junk2) fcn_symbol(f(x)->b(x),g->{[y,b(y)]: y in s},s->s) ==> Stat1: (FORALL u in s | {[y,b(y)]: y in s}~[u] = b(u))
	u-->Stat1 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Must_be_svm
--
--THEORY Must_be_svm(b(x),s,u)
--==>
--     Svm({[x,b(x)]: x in s}) & (domain({[x,b(x)]: x in s}) = s) & (range({[x,b(x)]: x in s}) = {b(x): x in s}) & ((u in s) imp ({[x,b(x)]: x in s}~[u] = b(u)))
--END Must_be_svm;
--
-- The preceding mini-theory has the following obvious 2-variable analog.
-- The proof of the one theorem it provides is completely elementary.
--
THEORY Must_be_svm_2(b2(x,y),s,t,P2(x,y))
END Must_be_svm_2;
--
ENTER_THEORY Must_be_svm_2
--
Theorem Must_be_svm_2.1: [Single-valued map former, two-variable case] Svm({[[x,y],b2(x,y)]: x in s, y in t | P2(x,y)}). Proof:
	Suppose_not ==> not Svm({[[x,y],b2(x,y)]: x in s, y in t | P2(x,y)})
	APPLY(x4_thryvar:x,y4_thryvar:y,xp1_thryvar:xx,yp1_thryvar:yy) 	Svm_test_2(a2(x,y)->[x,y],b2(x,y)->b2(x,y),P2(x,y)->P2(x,y),s->s,t->t)	 ==>
		(((x in s) & (y in t) & (xx in s) & (yy in t) &
			([x,y] = [xx,yy]) & (b2(x,y) /= b2(xx,yy))) or
				Svm({[[x,y],b2(x,y)]: x in s, y in t | P2(x,y)}))
	ELEM ==> (x = xx) & (y = yy)
	EQUAL ==> b2(x,y) = b2(xx,yy)
	ELEM ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Must_be_svm_2
--
--THEORY Must_be_svm_2(b2(x,y),s,t,P2(x,y))
--==>
--     Svm({[[x,y],b2(x,y)]: x in s, y in t | P2(x,y)})
--END Must_be_svm_2;
--
-- The additivity of domain and range, stated in the following theorems,
-- both follow immediately by application of set monotonicity.
--
Theorem 78: [Map domains are additive] domain(F + G) = domain(F) + domain(G). Proof:
Suppose_not(f,g) ==> domain(f + g) /= domain(f) + domain(g)
	Use_def(domain) ==> {car(x): x in f + g} /= {car(x): x in f} + {car(x): x in g}
	Set_monot ==> {car(x): x in f + g} = {car(x): x in f} + {car(x): x in g}
Discharge ==> QED
--
Theorem 79: [Map ranges are additive] range(F + G) = range(F) + range(G). Proof:
Suppose_not(f,g) ==> range(f + g) /= range(f) + range(g)
	Use_def(range) ==> {cdr(x): x in f + g} /= {cdr(x): x in f} + {cdr(x): x in g}
	Set_monot ==> {cdr(x): x in f + g} = {cdr(x): x in f} + {cdr(x): x in g}
Discharge ==> QED
--
-- The following is a corollary of Theorem 48 and Theorem 79.
--
Theorem 80: [Range of a restriction map] range(F ON S) incin range(F). Proof:
Suppose_not(f,s) ==> not(range(f ON s) incin range(f))
	(f,s)-->T48 ==> f = (f ON s) + (f - (f ON s))
	(f ON s,f - (f ON s))-->T79 ==> range((f ON s) + (f - (f ON s))) = range(f ON s) + range(f - (f ON s))
	EQUAL ==> range(f) = range(f ON s) + range(f - (f ON s))
ELEM ==> false;  Discharge ==> QED
--
-- The following elementary lemmas concerning the additivity, monotonicity of the range function,
-- and some easy additional properties specific to 1-1 maps, are also useful.
--
Theorem 81: [Range of restriction to a union] range(F ON (S + T)) = range(F ON S) + range(F ON T). Proof:
Suppose_not(f,s,t) ==> range(f ON (s + t)) /= range(f ON s) + range(f ON t)
	(f,s,t)-->T63 ==> (f ON (s + t)) = (f ON s) + (f ON t)
	(f ON s,f ON t)-->T79 ==> range((f ON s) + (f ON t)) = range(f ON s) + range(f ON t);
EQUAL ==> false; Discharge ==> QED
--
Theorem 82: [Restriction to a subset] (S incs T) imp (range(F ON S) incs range(F ON T)). Proof:
Suppose_not(s,t,f) ==> (s incs t) & (not(range(f ON s) incs range(f ON t)))
	(f,t,s - t)-->T81 ==> range(f ON (t + (s - t))) incs range(f ON t)
	ELEM ==> t + (s - t) = s
EQUAL ==> false; Discharge ==> QED
--
-- Next we prove that the range of a 1-1 map $f$ on the intersection of two sets
-- is the intersection of the restrictions of $f$ to each of these two sets.
--
Theorem 83: [One-one map-restriction to an intersection] one_1_map(F) imp (range(F ON (S * T)) = range(F ON S) * range(F ON T)). Proof:
   Suppose_not(f,s,t) ==> one_1_map(f) & (range(f ON (s * t)) /= range(f ON s) * range(f ON t))
--
-- For suppose that $f$, $s$, and $t$ are a counterexample to our assertion.
-- Since by monotonicity $range(f ON (s * t))$ must be a subset of
-- both $range(f ON s)$ and   $range(f ON t)$, and hence of their intersection,
-- it follows that the intersection $I$ of these two latter sets must contain $range(f ON (s * t))$,
-- and so if our theorem is false $range(f ON (s * t))$ cannot be a subset of $I$.
--
	(s,s * t,f)-->T82 ==> range(f ON s) incs range(f ON (s * t))
	(t,s * t,f)-->T82 ==> range(f ON t) incs range(f ON (s * t))
	ELEM ==> Stat1: not(range(f ON (s * t)) incs range(f ON s) * range(f ON t))
--
-- Hence there must exist an element $c$ of $I$ which does not belong to $range(f ON (s * t))$,
-- and therefore elements $d in f$, $d in f$ such that $c = cdr(d)$, $c = cdr(e)$ such that
-- $car(d)$ and $car(e)$ are members of  $s$, $t$ respectively.
--
	c-->Stat1 ==> (c in range(f ON s) * range(f ON t)) & (c notin range(f ON (s * t)))
	Use_def(range) ==> (c in {cdr(x): x in (f ON s)}) & (c in {cdr(x): x in (f ON t)}) &
				(c notin {cdr(x): x in (f ON (s * t))})
	Use_def(ON) ==> (c in {cdr(x): x in {y in f | car(y) in s}}) &
	(c in {cdr(x): x in {y in f | car(y) in t}}) &
	(c notin {cdr(x): x in {y in f | car(y) in (s * t)}})
	SIMPLF ==> Stat2: (c in {cdr(x): x in f | car(x) in s}) & Stat3: (c in {cdr(x): x in f | car(x) in t})
			& Stat4: (c notin {cdr(x): x in f | car(x) in (s * t)})
	d-->Stat2 ==> (c = cdr(d)) & (d in f) & (car(d) in s)
	e-->Stat3 ==> (c = cdr(e)) & (e in f) & (car(e) in t)
--
-- But now, since $f$ is 1-1, we must have $d = e$, so that $car(d) in (s * t)$,
-- which contradicts $c notin range(f ON (s * t))$ and so proves our theorem.
--
	Use_def(one_1_map) ==> Stat5: (FORALL x in f, y in f | (cdr(x) = cdr(y)) imp (x = y))
	(d,e)-->Stat5 ==> d = e
	ELEM ==> car(d) in (s * t)
	d-->Stat4 ==> false; Discharge ==> QED
--
-- Our next lemma gives the entirely elementary fact that the restriction of a map to the null set,
-- and the range of this restriction, are both null.
--
Theorem 84: [Restriction to the null set] ((F ON 0) = 0) & (range(F ON 0) = 0). Proof:
    Suppose_not(f) ==> (f ON 0 /= 0) or (range(f ON 0) /= 0)
    Suppose ==> f ON 0 /= 0
	Use_def(ON) ==> Stat1: {y in f | car(y) in 0} /= 0
	d-->Stat1 ==> false; Discharge ==> f ON 0 = 0
    EQUAL ==> range(0) /= 0
    T59 ==> false; Discharge ==> QED
--
Theorem 85: [One-one map restriction to disjoint sets] (one_1_map(F) & (S * T = 0)) imp (range(F ON S) * range(F ON T) = 0). Proof:
   Suppose_not(f,s,t) ==> one_1_map(f) & (s * t = 0) & (range(f ON s) * range(f ON t) /= 0)
   (f,s,t)-->T83 ==> range(f ON (s * t)) /= 0
    EQUAL ==> range(f ON 0) /= 0
    f-->T84 ==> false; Discharge ==> QED
--
-- Next we show that if either of the domain and range of a set $f$ is empty, so is the other
-- (either of these conditions is equivalent to the condition that $f$ is empty).
--
Theorem 86: [Domain is null only when range is null] (domain(F) = 0) eq (range(F) = 0). Proof:
    Suppose_not(f) ==> not((domain(f) = 0) eq (range(f) = 0))
    Use_def(domain) ==> not(({car(x): x in f} = 0) eq (range(f) = 0))
    Use_def(range) ==> not(({car(x): x in f} = 0) eq ({cdr(x): x in f} = 0))
--
-- For if not, one of these sets must be empty and the other not.
-- Suppose first that ${cdr(x): x in f}$ is nonempty, so that there exists a $d$ in $f$.
-- Then the first set must also be nonempty. The same argument applies in the
-- case that ${car(x): x in f}$ is nonempty, and so our assertion holds in each case.
--
    Suppose ==> Stat1: ({car(x): x in f} = 0) & Stat2: ({cdr(x): x in f} /= 0)
    d-->Stat2 ==> d in f
    d-->Stat1 ==> false; Discharge ==> Stat3: ({car(x): x in f} /= 0) & Stat4: ({cdr(x): x in f} = 0)
    a-->Stat3 ==> a in f
    a-->Stat4 ==> false; Discharge ==> QED
--
-- The union of two single valued maps need not always be single valued,
-- but the following theorem tells us that it is if the domains of the two maps are disjoint.
--
Theorem 87: [Union of single-valued maps] (Svm(F) & Svm(G) & (domain(F) * domain(G) = 0)) imp Svm(F + G). Proof:
    Suppose_not(f,g) ==>
	Svm(f) & Svm(g) & (domain(f) * domain(g) = 0) & (not(Svm(f + g)))
--
-- For suppose not, use the definition  of '$Svm$' to expand the negative of our theorem,
-- and use the fact, which follows from Theorem 62, that $f + g$ must be a map.
-- from which it follows that $f + g$ must have two distinct elements $a$ and $b$
-- such that $car(a) = car(b)$.
--
    Use_def(Svm) ==> Is_map(f) & Stat1: (FORALL x in f, y in f | ((car(x) = car(y)) imp (x = y)))
    Use_def(Svm) ==> Is_map(g) & Stat2: (FORALL x in g, y in g | ((car(x) = car(y)) imp (x = y)))
    Use_def(Svm) ==> not(Is_map(f + g)) or not(FORALL x in f + g, y in f + g | ((car(x) = car(y)) imp (x = y)))
    (f,g)-->T62 ==> Stat3: not(FORALL x in f + g, y in f + g | ((car(x) = car(y)) imp (x = y)))
    (a,b)-->Stat3 ==> (a in f + g) & (b in f + g) & (car(a) = car(b)) & (a /= b)
--
-- Then, since $f$ and $g$ are both single valued, it follows that one of $a$ and  $b$
-- must belong to $f$ and the other to $g$.
-- Suppose for definiteness that $a$ belongs to $f$ and $b$ to $g$.
-- Then by Theorem 60 $car(a)$ belongs to $domain(f)$ and $car(b)$ to the disjoint set $domain(g)$,
-- which is impossible since $car(a) = car(b)$.
--
    (a,b)-->Stat1 ==> ((a in f) & (b in f)) imp ((car(a) = car(b)) imp (a = b))
    (a,b)-->Stat2 ==> ((a in g) & (b in g)) imp ((car(a) = car(b)) imp (a = b))
    ELEM ==> (((a in f) & (b in g)) or ((a in g) & (b in f)))
    Suppose ==> (a in f) & (b in g)
    (a,f)-->T60 ==> car(a) in domain(f)
    (b,g)-->T60 ==> car(b) in domain(g)
    ELEM ==> false; Discharge ==> (a in g) & (b in f)
--
-- This leaves only the symmetric case $(a in g) & (b in f)$,
-- which can be treated in the same way, proving our theorem.
--
    (a,g)-->T60 ==> car(a) in domain(g)
    (b,f)-->T60 ==> car(b) in domain(f)
    Discharge ==> QED
--
-- A very similar argument shows that the union of two 1-1 maps
-- with disjoint ranges and domains must be 1-1.
--
Theorem 88: [Union of 1-1 maps]
    (one_1_map(F) & one_1_map(G) & (range(F) * range(G) = 0) & (domain(F) * domain(G) = 0)) imp one_1_map(F + G). Proof:
    Suppose_not(f,g) ==>
	(one_1_map(f) & one_1_map(g) & (range(f) * range(g) = 0) & (domain(f) * domain(g) = 0)) &
	(not(one_1_map(f + g)))
--
-- For suppose not, use the definition  of 'one_1_map' to expand the negative of our theorem,
-- and use the fact, following by Theorem 87, that $f + g$ must be a single valued map.
-- from which it follows that $f + g$ must have two distinct elements $a$ and $b$
-- such that $cdr(a) = cdr(b)$.
--
    Use_def(one_1_map) ==> Svm(f) & Stat1:(FORALL x in f, y in f | ((cdr(x) = cdr(y)) imp (x = y))) &
	Svm(g) & Stat2:(FORALL x in g, y in g | ((cdr(x) = cdr(y)) imp (x = y))) &
	((not(Svm(f + g))) or not(FORALL x in f + g, y in f + g | ((cdr(x) = cdr(y)) imp (x = y))))
    (f,g)-->T87 ==> Stat3: not(FORALL x in f + g, y in f + g |((cdr(x) = cdr(y)) imp (x = y)))
    (a,b)-->Stat3 ==> Stat4: (a in f + g) & (b in f + g) & (cdr(a) = cdr(b)) & (not(a = b))
--
-- Then, since $f$ and $g$ are both 1-1 maps, it follows that one of $a$ and  $b$
-- must belong to $f$ and the other to $g$.
-- Suppose for definiteness that $a$ belongs to $f$ and $b$ to $g$.
-- Then by Theorem 61 $cdr(a)$ belongs to $range(f)$ and $cdr(a)$ to the disjoint set $range(g)$,
-- which is impossible since $cdr(a) = cdr(b)$.
--
    (a,b)-->Stat1 ==> ((a in f) & (b in f)) imp ((cdr(a) = cdr(b)) imp (a = b))
    (a,b)-->Stat2 ==> ((a in g) & (b in g)) imp ((cdr(a) = cdr(b)) imp (a = b))
    ELEM ==> (((a in f) & (b in g)) or ((a in g) & (b in f)))
    Suppose ==> (a in f) & (b in g)
    (a,f)-->T61 ==> cdr(a) in range(f)
    (b,g)-->T61 ==> cdr(b) in range(g)
    Discharge ==> (a in g) & (b in f)
--
-- This leaves only the symmetric case $(a in g) & (b in f)$,
-- which can be treated in the same way, proving our theorem.
--
    (a,g)-->T61 ==> cdr(a) in range(g)
    (b,f)-->T61 ==> cdr(b) in range(f)
    Discharge ==> QED
--
--
--
Theorem 89: [Union of 1-1 maps, 2] (one_1_map(F + G) & ((G * F) = 0)) imp ((domain(G) = (domain(F + G) - domain(F))) & (range(G) = (range(F + G) - range(F)))). Proof:
Suppose_not(f0,g0) ==> AUTO
--
-- For, assuming the contrary, we would get a contradiction.
-- Indeed, $domain$ and $range$ are additive operators.
-- Hence, the negation of the statement we want to prove
-- implies that either the intersection of the domains
-- or the intersection of the ranges would be non-void.
-- Single-valuedness would be contradicted in the former case,
-- injectivity would be contradicted in the latter case.
--
	Use_def(one_1_map)(*) ==> Svm(f0 + g0) & Stat1: (FORALL x in (f0 + g0), y in (f0 + g0) | (cdr(x) = cdr(y)) imp (x = y))
	Suppose ==> Stat2: domain(g0) /= (domain(f0 + g0) - domain(f0))
		(f0,g0)-->T78(Stat2*) ==> Stat3: (domain(f0) * domain(g0)) /= 0
		d-->Stat3(Stat3*) ==> (d in domain(f0)) & (d in domain(g0))
		Use_def(domain)(Stat3*) ==> Stat4: (d in {car(x): x in f0}) & (d in {car(x): x in g0})
		(x0,y0)-->Stat4(Stat4*) ==> (d = car(x0)) & (x0 in f0) & (d = car(y0)) & (y0 in g0)
		Use_def(Svm)(*) ==> Stat5: (FORALL x in (f0 + g0), y in (f0 + g0) | (car(x) = car(y)) imp (x = y))
		(x0,y0)-->Stat5(Stat4*) ==> x0 = y0
	Discharge ==> Stat6: range(g0) /= (range(f0 + g0) - range(f0))
	(f0,g0)-->T79(Stat6*) ==> Stat7: (range(f0) * range(g0)) /= 0
	r-->Stat7(Stat7*) ==> (r in range(f0)) & (r in range(g0))
	Use_def(range)(Stat6*) ==> Stat8: (r in {cdr(x): x in f0}) & (r in {cdr(x): x in g0})
	(x1,y1)-->Stat8(Stat8*) ==> (r = cdr(x1)) & (x1 in f0) & (r = cdr(y1)) & (y1 in g0)
	(x1,y1)-->Stat1(Stat8*) ==> x1 = y1
Discharge ==> QED
--
-- The following simple lemma will be useful in our later work with map inverses.
--
Theorem 90: [Members of the inverse map] Is_map(F) imp (([X,Y] in F) eq ([Y,X] in inv(F))). Proof:
    Suppose_not(f,x,y) ==> Is_map(f) & (not(([x,y] in f) eq ([y,x] in inv(f))))
--
-- In the contrary case, and first considering the subcase in which $[x,y]$ belongs to $f$,
-- use of the definition leads to an immediate contradiction, so that we must have
-- $[x,y] notin f$ and $[y,x] in inv(f)$.
--
    Suppose ==> ([x,y] in f) & ([y,x] notin inv(f))
    Use_def(inv) ==> Stat1: [y,x] notin {[cdr(u),car(u)]: u in f}
    ([x,y])-->Stat1 ==> [y,x] /= [cdr([x,y]),car([x,y])]
    Discharge ==> ([x,y] notin f) & ([y,x] in inv(f))
--
-- But in this case use of the definition also leads, via Theorem 76,
-- to an immediate contradiction, which completes the proof of the present lemma.
--
    Use_def(inv) ==>  ([x,y] notin f) & Stat2: ([y,x] in {[cdr(u),car(u)]: u in f})
    u-->Stat2 ==> ([y,x] = [cdr(u),car(u)]) & (u in f)
    ELEM ==> [car(u),cdr(u)] /= u;
    (f,u)-->T76 ==> false; Discharge ==> QED
--
-- The two following elementary lemmas note other ways in which
-- small 1-1 maps can be constructed.
-- First we observe that the singleton ${[x,y]}$ is always a 1-1 map.
--
Theorem 91: [Singletons as maps] Svm({[X,Y]}) & one_1_map({[X,Y]}) & (({[X,Y]}~[X]) = Y). Proof:
    Suppose_not(x1,y1) ==> not(Svm({[x1,y1]}) & one_1_map({[x1,y1]}) & (({[x1,y1]}~[x1]) = y1))
--
-- We prove the various clauses of this theorem successively.
-- The fact that ${[x1,y1]}$ is a map follows readily by use of our utility $Iz_map$ theory,
-- and by simplification.
--
    SIMPLF ==> {[car(u),cdr(u)]: u in {[x1,y1]}} = {[car([x1,y1]),cdr([x1,y1])]}
    ELEM ==> {[car(u),cdr(u)]: u in {[x1,y1]}} = {[x1,y1]}
    APPLY() Iz_map(a(u)->car(u),b(u)->cdr(u),s->{[x1,y1]}) ==> Is_map({[car(u),cdr(u)]: u in {[x1,y1]}})
    EQUAL ==> Is_map({[x1,y1]})
--
-- Likewise, to prove that ${[x1,y1]}$ is a single valued map we have only to use the definition of $Svm$.
--
    Suppose ==> not Svm({[x1,y1]})
    Use_def(Svm) ==> not(Is_map({[x1,y1]}) & (FORALL u in {[x1,y1]}, v in {[x1,y1]} | (car(u) = car(v)) imp (u = v)))
    ELEM ==> Stat1: not (FORALL u in {[x1,y1]}, v in {[x1,y1]} | (car(u) = car(v)) imp (u = v))
    (a,b)-->Stat1 ==> (a in {[x1,y1]}) & (b in {[x1,y1]}) & (car(a) = car(b)) & (a /= b)
    ELEM ==>  (a = [x1,y1]) & (b = [x1,y1])
    Discharge ==> Svm({[x1,y1]})
--
-- The proof that ${[x1,y1]}$ is 1-1 is equally elementary. Once this is done it only remains
-- to prove the final clause of our theorem.
--
    Suppose ==> not one_1_map({[x1,y1]})
    Use_def(one_1_map) ==> not (Svm({[x1,y1]}) & (FORALL u in {[x1,y1]}, v in {[x1,y1]} | ((cdr(u) = cdr(v)) imp (u = v))))
    ELEM ==> Stat2: not(FORALL u in {[x1,y1]}, v in {[x1,y1]} | ((cdr(u) = cdr(v)) imp (u = v)))
    (c,d)-->Stat2 ==> Stat3: (c in {[x1,y1]}) & (d in {[x1,y1]}) & (cdr(c) = cdr(d)) & (c /= d)
    (Stat3)Discharge ==> Stat4: {[x1,y1]}~[x1] /= y1
--
-- For this we simply use the definitions of map application, restriction, and range successively,
-- and simplify the resulting formula, to obtain a final contradiction which proves our theorem.
--
    Use_def(~) ==> {[x1,y1]}~[x1] = cdr(arb({[x1,y1]} ON {x1}))
    Use_def(ON) ==> {[x1,y1]}~[x1] = cdr(arb({u in {[x1,y1]} | car(u) in {x1}}))
    SIMPLF ==> {[x1,y1]}~[x1] = cdr(arb(if car([x1,y1]) in {x1} then {[x1,y1]} else 0 end if))
    ELEM ==> if car([x1,y1]) in {x1} then {[x1,y1]} else 0 end if = {[x1,y1]}
    EQUAL ==> cdr(arb({[x1,y1]})) = cdr(arb(if car([x1,y1]) in {x1} then {[x1,y1]} else 0 end if))
    ELEM ==> {[x1,y1]}~[x] = cdr(arb({[x1,y1]}))
    ELEM ==> cdr(arb({[x1,y1]})) = y1
    Discharge ==> QED
--
-- Next we observe that the doubleton ${[x,y],[z,w]}$ is a single-valued map if
-- $x /= z$, in which case ${[x,y],[z,w]}~[x] = y$.
--
Theorem 92: [Doubletons as maps] Is_map({[X,Y],[Z,W]}) & (domain({[X,Y],[Z,W]}) = {X,Z}) & (range({[X,Y],[Z,W]}) = {Y,W}) &
	((X /= Z) imp Svm({[X,Y],[Z,W]})). Proof:
Suppose_not(x0,y0,z0,w0) ==> AUTO
	TELEM ==> Is_map({[x0,y0],[z0,w0]})
	TELEM ==> domain({[x0,y0],[z0,w0]}) = {x0,z0}
	TELEM ==> range({[x0,y0],[z0,w0]}) = {y0,w0}
	Use_def(Svm) ==> Stat1: (not(FORALL x in {[x0,y0],[z0,w0]}, y in {[x0,y0],[z0,w0]} | (car(x) = car(y)) imp (x = y))) & (x0 /= z0)
	(x0,y0)-->T9(Stat1*) ==> car([x0,y0]) = x0
	(z0,w0)-->T9(Stat1*) ==> car([z0,w0]) = z0
	(p,q)-->Stat1(Stat1*) ==> Stat2: (p in {[x0,y0],[z0,w0]}) & (q in {[x0,y0],[z0,w0]}) & (car(p) = car(q)) & (p /= q)
	Suppose ==> (p = [x0,y0]) & (q = [z0,w0])
		EQUAL(Stat1) ==> false
	Discharge ==> AUTO
	(Stat2*)ELEM ==> (q = [x0,y0]) & (p = [z0,w0])
	EQUAL(Stat1) ==> false
	Discharge ==> QED
--
--
--
Theorem 93: [Doubletons as maps, 2] (X /= Z) imp ({[X,Y],[Z,W]}~[X] = Y). Proof:
    Suppose_not(x,wz,y,w) ==> Stat1: (x /= wz) & ({[x,y],[wz,w]}~[x] /= y)
--
-- To show this, use the definitions of map application, restriction, and range, and then
-- simplify, obtaining the equality seen below:
--
    Use_def(~) ==> {[x,y],[wz,w]}~[x] = cdr(arb({[x,y],[wz,w]} ON {x}))
    Use_def(ON) ==> {[x,y],[wz,w]}~[x] = cdr(arb({v in {[x,y],[wz,w]} | car(v) in {x}}))
--
-- It is now easy to see, since $x /= wz$, that ${v in {[x,y],[wz,w]} | car(v) in {x}} /= {[x,y]}$
--
    Suppose ==> Stat2: {v in {[x,y],[wz,w]} | car(v) in {x}} /= {[x,y]}
    ww-->Stat2 ==> Stat3: (ww in {v in {[x,y],[wz,w]} | (car(v) in {x})}) eq (ww /= [x,y])
    Suppose ==> Stat4: ww in {v in {[x,y],[wz,w]} | (car(v) in {x})}
        ()-->Stat4(Stat3) ==> Stat5: (ww = [wz,w]) & (car(ww) = x)
    (Stat1,Stat5)Discharge ==> Stat6: (ww = [x,y]) & Stat7: (ww notin {v in {[x,y],[wz,w]} | (car(v) in {x})})
    (Stat6)ELEM ==> car(ww) in {x}
    ww-->Stat7 ==> not ((ww in {[x,y],[wz,w]}) & (car(ww) in {x}))
    (Stat6)Discharge ==> {v in {[x,y],[wz,w]} | car(v) in {x}} = {[x,y]}
--
-- Hence, substituting into the third line of our proof, we find that ${[x,y],[wz,w]}~[x] = cdr(arb({[x,y]}))$,
-- which simplifies easily to the assertion of our theorem.
--
    EQUAL ==> {[x,y],[wz,w]}~[x] = cdr(arb({[x,y]}))
    ELEM ==> arb({[x,y]}) = [x,y]
    EQUAL ==> {[x,y],[wz,w]}~[x] = cdr([x,y])
    Discharge ==> QED
--
-- Next we give a simple formula for the restriction of  a map.
--
Theorem 94: [Domain of restriction] domain(F ON S) = domain(F) * S. Proof:
    Suppose_not(f,s) ==> not(domain(f ON s) = domain(f) * s)
--
-- For if we expand the negative of our theorem using the definitions
-- of the functions involved, we see that the two sets displayed below must differ:
--
    Use_def(domain) ==> {car(x): x in (f ON s)} /= {car(x): x in f} * s
    Use_def(ON) ==> {car(x): x in {x in f | car(x) in s}} /= {car(x): x in f} * s
    SIMPLF ==> Stat1: {car(x): x in f | car(x) in s} /= {car(x): x in f} * s
    c-->Stat1 ==> ((c in {car(x): x in f | car(x) in s}) & (c notin {car(x): x in f} * s)) or
	((c notin {car(x): x in f | car(x) in s}) & (c in {car(x): x in f} * s))
--
-- This is a disjunction. The first of its cases is impossible, since it would imply that
-- $c$ had the form $car(d)$ and was both in $s$ and not in $s$.
--
    Suppose ==> Stat2: (c in {car(x): x in f | car(x) in s}) & Stat3: (c notin {car(x): x in f} or c notin s)
    d-->Stat2 ==> (c = car(d)) & (d in f) & (car(d) in s)
    d-->Stat3 ==> false
--
-- Hence we need only consider the second case, but this leads immediately to a similar impossibility, proving our theorem.
--
    Discharge ==> Stat4: (c notin {car(x): x in f | car(x) in s}) & Stat5: (c in {car(x): x in f}) & (c in s)
    e-->Stat5 ==> (c = car(e)) & (e in f)
    e-->Stat4 ==> false; Discharge ==> QED
--
-- The following theorem gives formulae for the range and domain of a product map $f @ g$,
-- under the simplifying hypothesis that the range of $g$ is included in the domain of $f$.
--
Theorem 95: [Range and domain of map product] (range(F @ G) = range(F ON range(G))) & ((range(G) incin domain(F)) imp (domain(F @ G) = domain(G))). Proof:
    Suppose_not(f,g) ==>
	Stat1: (range(f @ g) /= range(f ON range(g))) or ((range(g) incin domain(f)) & (domain(f @ g) /= domain(g)))
--
-- Proceeding by contradiction, we have two cases to consider. First suppose that the two ranges
-- appearing in the theorem are different. Use the definitions
-- of the functions involved and simplify.
--
    Suppose ==> range(f @ g) /= range(f ON range(g))
    Use_def(range) ==> range(f @ g) = {cdr(x): x in f @ g}
    Use_def(@) ==> range(f @ g) = {cdr(x): x in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}}
    SIMPLF ==> range(f @ g) = {cdr([car(x),cdr(y)]): x in g, y in f | cdr(x) = car(y)}
--
-- But $range(f @ g)$ can be simplified further to ${cdr(x): x in f | car(x) in range(g)}$.
--
    Suppose ==> Stat2: {cdr([car(x),cdr(y)]): x in g, y in f | cdr(x) = car(y)} /=
    						{cdr(y): x in g, y in f | cdr(x) = car(y)}
    (ap,bp)-->Stat2 ==> cdr([car(ap),cdr(bp)]) /= cdr(bp)
    Discharge ==> range(f @ g) = {cdr(y): x in g, y in f | cdr(x) = car(y)}
--
-- From this, using the definitions of '$range$' and '$ON$', we get the set inequality seen below.
--
    Use_def(range) ==> range(f ON range(g)) = {cdr(x): x in f ON range(g)}
    Use_def(ON) ==> range(f ON range(g)) = {cdr(x): x in {x in f | car(x) in range(g)}}
    SIMPLF ==> range(f ON range(g)) = {cdr(x): x in f | car(x) in range(g)}
    ELEM ==> Stat3: {cdr(y): x in g, y in f | cdr(x) = car(y)} /= {cdr(x): x in f | car(x) in range(g)}
--
-- Hence there is a $c$ which is in one of these sets but not the other.
-- Suppose first that $c$ is in the first of these sets, and so has the form seen below.
--
    c-->Stat3 ==> ((c in {cdr(y): x in g, y in f | cdr(x) = car(y)}) & (c notin {cdr(x): x in f | car(x) in range(g)})) or
	((c notin {cdr(y): x in g, y in f | cdr(x) = car(y)}) & (c in {cdr(x): x in f | car(x) in range(g)}))
    Suppose ==> Stat4:
	(c in {cdr(y): x in g, y in f | cdr(x) = car(y)}) & Stat5: (c notin {cdr(x): x in f | car(x) in range(g)})
    (a,b)-->Stat4 ==> (c = cdr(b)) & (a in g) & (b in f) & (cdr(a) = car(b))
--
-- Then by Stat5 $car(b)$ is not in $range(g)$, which, using the definition of $range$,
-- leads to an immediate contradiction with Stat6
--
    b-->Stat5 ==> car(b) notin range(g)
    Use_def(range) ==> Stat7: not (car(b) in {cdr(x): x in g})
    a-->Stat7 ==> false;
--
-- Hence $c$ must be in the second of the sets considered above,
-- but not in the first, and so must have the form seen below.
--
    Discharge ==> Stat8: (c notin {cdr(y): x in g, y in f | cdr(x) = car(y)}) &
			Stat9: (c in {cdr(x): x in f | car(x) in range(g)})
    u-->Stat9 ==> (c = cdr(u)) & (u in f) & (car(u) in range(g))
    Use_def(range) ==> Stat10: car(u) in {cdr(x): x in g}
    v-->Stat10 ==> (car(u) = cdr(v)) & (v in g)
--
-- But this leads to an immediate contradiction with Stat8,
-- and so rules out the first of our two main cases,
-- leaving the only case $domain(f @ g) /= domain(g)$ to be considered.
--
    (v,u)-->Stat8 ==> not(c = cdr(u) & (u in f) & (v in g) & (cdr(v) = car(u)))
    Discharge ==> Stat11: range(f @ g) = range(f ON range(g))
    (Stat11,Stat1)ELEM ==> domain(f @ g) /= domain(g)
--
-- This can be handled in much the same way as the case just analyzed. Using the definitions
-- of the functions involved, we see that the two sets displayed below must differ.
--
    Use_def(domain) ==> {car(x): x in f @ g} /= {car(x): x in g}
    Use_def(@) ==> {car(x): x in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}} /= {car(x): x in g}
    SIMPLF ==> {car([car(x),cdr(y)]): x in g, y in f | cdr(x) = car(y)} /= {car(x): x in g}
    (car(X),cdr(Y))-->T7 ==> car([car(X),cdr(Y)]) = car(X)
    EQUAL ==> Stat12: {car(x): x in g, y in f | cdr(x) = car(y)} /= {car(x): x in g}
--
-- Hence there is a $ca$ which is in one of these sets but not the other.
-- Suppose first that $ca$ is in the first of these sets, and so has the form seen below.
--
    ca-->Stat12 ==> ((ca in {car(x): x in g, y in f | cdr(x) = car(y)}) & (ca notin {car(x): x in g})) or
	((ca notin {car(x): x in g, y in f | cdr(x) = car(y)}) & (ca in {car(x): x in g}))
    Suppose ==> Stat13: (ca in {car(x): x in g, y in f | cdr(x) = car(y)}) & Stat14: (ca notin {car(x): x in g})
--
-- Then by Stat15 $car(ba)$ is not in ${car(x): x in f}$,
-- which leads to an immediate contradiction.
--
    (aa,ba)-->Stat13 ==> (ca = car(aa)) & (aa in g) & (ba in f) & (cdr(aa) = car(ba))
    aa-->Stat14 ==> false
    Discharge ==> Stat16: (ca notin {car(x): x in g, y in f | cdr(x) = car(y)}) & Stat17: (ca in {car(x): x in g})
 --
-- Hence $ca$ must be in the second of the sets considered above,
-- but not in the first. Thus $ca$ must have the form $car(x)$ for some $x in g$.
-- Since $cdr(x)$ belongs to $range(g) incin domain(f)$, it follows that
-- $cdr(x) = car(y)$ for some $y in f$. Substitution of $x$ and $y$ into
-- Stat18 31 now leads immediately to a contradiction which completes our proof.
--
    x-->Stat17 ==> (ca = car(x)) & (x in g)
    Suppose ==> Stat19: cdr(x) notin {cdr(x): x in g}
    x-->Stat19 ==> false; Discharge ==> cdr(x) in {cdr(x): x in g}
    Use_def(range) ==> cdr(x) in range(g)
    ELEM ==> cdr(x) in domain(f)
    Use_def(domain) ==> Stat20: cdr(x) in {car(y): y in f}
    y-->Stat20 ==> (cdr(x) = car(y)) & (y in f)
    (x,y)-->Stat16 ==> false; Discharge ==> QED
--
-- If the range of $g$ equals the domain of $f$, the following slightly stronger corollary
-- to the preceding result applies. The proof simply combines Theorem 95 and Theorem 67.
--
Theorem 96: [Range and domain of map product, 2] (range(G) = domain(F)) imp ((range(F @ G) = range(F)) & (domain(F @ G) = domain(G))). Proof:
    Suppose_not(g,f) ==> (range(g) = domain(f)) & (not((range(f @ g) = range(f)) & (domain(f @ g) = domain(g))))
    (f,g)-->T95 ==> (range(f @ g) = range(f ON range(g))) & (domain(f @ g) = domain(g))
    EQUAL ==> (range(f @ g) = range(f ON domain(f))) & (domain(f @ g) = domain(g))
    f-->T67 ==> (f ON domain(f)) = f
    EQUAL ==> range(f ON domain(f)) = range(f)
    Discharge ==> QED
--
-- It is sometimes convenient to use the following corollary of Theorem 95
-- rather than the theorem itself.
--
Theorem 97: [Range and domain of map product, 3] (range(G) incin domain(F)) imp ((range(F @ G) incin range(F)) & (domain(F @ G) = domain(G))). Proof:
    Suppose_not(g,f) ==>
	Stat1: (range(g) incin domain(f)) & ((not(range(f @ g) incin range(f))) or domain(f @ g) /= domain(g))
	(f,g)-->T95 ==> (range(f @ g) = range(f ON range(g))) & (domain(f @ g) = domain(g))
	ELEM ==> not(range(f ON range(g)) incin range(f))
	(f,range(g))-->T80 ==> false; Discharge ==> QED
--
-- Our next easy theorem tells us that a 1-1 map, combined with the 'range' operator,
-- induces a 1-1 map on the set of subsets of its domain.
--
Theorem 98: [Range of restriction of one-one map] (one_1_map(F) & (S incin domain(F)) & (S /= domain(F))) imp
	((range(F ON S) incin range(F)) & (range(F ON S) /= range(F))). Proof:
	Suppose_not(f,s) ==> one_1_map(f) & (s incin domain(f)) & Stat1: (s /= domain(f)) &
	(not((range(f ON s) incin range(f)) & (range(f ON s) /= range(f))))
	(f,s)-->T80 ==> range(f ON s) = range(f)
	c-->Stat1 ==> (c in domain(f)) & (c notin s)
	Use_def(domain) ==> Stat2: c in {car(x): x in f}
	x-->Stat2 ==> (c = car(x)) & (x in f)
	Use_def(range) ==> range(f) = {cdr(x): x in f}
	Suppose ==> cdr(x) notin range(f)
	ELEM ==> Stat3: cdr(x) notin {cdr(x): x in f}
	x-->Stat3 ==> false; Discharge ==> cdr(x) in range(f ON s)
	Use_def(range) ==> cdr(x) in {cdr(x): x in (f ON s)}
	Use_def(ON) ==> cdr(x) in {cdr(x): x in {y in f | car(y) in s}}
	SIMPLF ==> Stat4: cdr(x) in {cdr(y): y in f | car(y) in s}
	y-->Stat4 ==> (cdr(x) = cdr(y)) & (y in f) & (car(y) in s)
	Use_def(one_1_map) ==> Stat5: (FORALL x in f, y in f | (cdr(x) = cdr(y)) imp (x = y))
	(x,y)-->Stat5 ==> x = y
	Discharge ==> QED
--
-- Next we turn to a discussion of map inverses. The following theorem tells us that
-- the inverse of a map $f$ is always a map, whose range and domain are respectively the domain and range of $f$.
--
Theorem 99: [Inverse map basic properties] Is_map(inv(F)) & range(inv(F)) = domain(F) & domain(inv(F)) = range(F). Proof:
    Suppose_not(f) ==> not(Is_map(inv(f)) & range(inv(f)) = domain(f) & domain(inv(f)) = range(f))
--
-- For by our utility $Iz_map$ theory $inv(f)$ must clearly be a map.
--
    Use_def(inv) ==> inv(f) = {[cdr(x),car(x)]: x in f}
    APPLY() Iz_map(a(x)->cdr(x),b(x)->car(x),s->f) ==> Is_map({[cdr(x),car(x)]: x in f})
    EQUAL ==> Is_map(inv(f))
    ELEM ==> not((range(inv(f)) = domain(f)) & (domain(inv(f)) = range(f)))
--
-- If $range(inv(f))$ and $domain(f)$ are different, then by definition the two sets
-- seen below are different, so that there exists a $y$ such that
-- $cdr([cdr(y),car(y)]) /= car(y)$, another impossibility, leaving only the
-- third alternative $domain(inv(f)) /= range(f)$ to be considered.
--
    Suppose ==> range(inv(f)) /= domain(f)
    Use_def(range) ==> {cdr(x): x in inv(f)} /= domain(f)
    Use_def(domain) ==> {cdr(x): x in inv(f)} /= {car(x): x in f}
    EQUAL ==> {cdr(x): x in {[cdr(x),car(x)]: x in f}} /= {car(x): x in f}
    SIMPLF ==> Stat1: {cdr([cdr(x),car(x)]): x in f} /= {car(x): x in f}
    y-->Stat1 ==> (y in f) & (cdr([cdr(y),car(y)]) /= car(y))
    Discharge ==> domain(inv(f)) /= range(f)
--
-- But $domain(inv(f)) /= range(f)$ leads to the third set inequality seen below, and through it to
-- the impossible inequality $car([cdr(u),car(u)]) /= cdr(u)$,
-- a contradiction which proves our theorem.
--
    Use_def(range) ==> domain(inv(f)) /= {cdr(x): x in f}
    Use_def(domain) ==> {car(x): x in inv(f)} /= {cdr(x): x in f}
    EQUAL ==> {car(x): x in {[cdr(x),car(x)]: x in f}} /= {cdr(x): x in f}
    SIMPLF ==> Stat2: {car([cdr(x),car(x)]): x in f} /= {cdr(x): x in f}
    u-->Stat2 ==> car([cdr(u),car(u)]) /= cdr(u)
    Discharge ==> QED
--
-- Next we show that the iterated inverse of a map is the map itself.
-- This follows in an elementary way from the definitions involved,
-- by an evident set-theoretic simplification.
--
Theorem 100: [Double inverse map] Is_map(F) imp (F = inv(inv(F))). Proof:
    Suppose_not(f) ==> Is_map(f) & (f /= inv(inv(f)))
    Use_def(Is_map) ==> (f = {[car(x),cdr(x)]: x in f}) & (f /= inv(inv(f)))
    Use_def(inv) ==> (f = {[car(x),cdr(x)]: x in f}) &
	(f /= {[cdr(x),car(x)]: x in {[cdr(y),car(y)]: y in f}})
    SIMPLF ==> {[cdr(x),car(x)]: x in {[cdr(y),car(y)]: y in f}} = {[cdr([cdr(y),car(y)]),car([cdr(y),car(y)])]: y in f}
    Set_monot ==> {[cdr([cdr(y),car(y)]),car([cdr(y),car(y)])]: y in f} = {[car(y),cdr(y)]: y in f}
    ELEM ==> f /= {[car(x),cdr(x)]: x in f}
    Discharge ==> QED
--
-- The following theorem tells us that if a map is one-to-one, so is its inverse.
-- The result follows easily by use of the two preceding theorems and use of the $one_1_test$
-- THEORY given earlier.
--
Theorem 101: [Inverse of a one-one map]
    one_1_map(F) imp (one_1_map(inv(F)) & (F = inv(inv(F))) & (range(inv(F)) = domain(F)) & (domain(inv(F)) = range(F))). Proof:
    Suppose_not(f) ==>
	Stat1: one_1_map(f) & (not ((one_1_map(inv(f)) & (f = inv(inv(f))) & (range(inv(f)) = domain(f)) & (domain(inv(f)) = range(f)))))
  	Use_def(one_1_map) ==> Svm(f)
    Use_def(Svm) ==> Is_map(f)
 --
-- Suppose that one of the assertions of our theorem is false. Theorem 99 and Theorem 100
-- this can only be the assertion concerning one-to-one-ness of $inv(f)$.
--
    f-->T99 ==> not (one_1_map(inv(f)) & (f = inv(inv(f))))
    Suppose ==> one_1_map(inv(f))
    Use_def(one_1_map) ==> Svm(inv(f))
    f-->T100 ==> f = inv(inv(f))
    Discharge ==> not one_1_map(inv(f))
    Use_def(inv) ==> not one_1_map({[cdr(x),car(x)]: x in f})
--
-- Since $inv(f)$ can be expressed as a setformer, the $one_1_test$ theory given earlier
-- tells us that $f$ must have elements $x$ and $y$ for which
-- $cdr(x) = cdr(y)$ and $x = y$ are inequivalent.
--
    APPLY(x6_thryvar:x,y6_thryvar:y) one_1_test(a(x)->car(x),b(x)->cdr(x),s->f) ==> (((x in f) & (y in f) &
	(not((cdr(x) = cdr(y)) eq (car(x) = car(y))))) or one_1_map({[cdr(x),car(x)]: x in f}))
    ELEM ==> not((cdr(x) = cdr(y)) eq (car(x) = car(y)))
--
-- But using the definition of $one_1_map$ we see at once that this is impossible,
-- a contradiction which proves our theorem.
--
    Use_def(one_1_map) ==> Svm(f) & Stat2: (FORALL x in f, y in f | (cdr(x) = cdr(y)) imp (x = y))
    Use_def(Svm) ==> Is_map(f) & Stat3: (FORALL x in f, y in f | (car(x) = car(y)) imp (x = y))
    (x,y)-->Stat2 ==> (cdr(x) = cdr(y)) imp (x = y)
    (x,y)-->Stat3 ==> (car(x) = car(y)) imp (x = y)
    EQUAL ==> (x = y) imp (car(x) = car(y))
    Discharge ==> QED
--
-- Next we prove that for any one-to-one map, the inverse map is a functional left inverse.
--
Theorem 102: [Inverse image of an element] (one_1_map(F) & (X in domain(F))) imp (inv(F)~[F~[X]] = X). Proof:
    Suppose_not(f,x) ==> one_1_map(f) & (x in domain(f)) & (inv(f)~[f~[x]] /= x)
--
-- We proceed by contradiction. Suppose that the 1-1 map $f$ has a domain element
-- $car(c)$ such that $inv(f)~[f~[car(c)]]$ = $inv(f)~[cdr(c)] /= car(c)$, where $c in f$.
--
    Use_def(domain) ==> Stat1: x in {car(y): y in f}
    c-->Stat1 ==> (c in f) & (x = car(c))
    Use_def(one_1_map) ==> Svm(f)
    (f,c)-->T74 ==> f~[car(c)] = cdr(c)
    EQUAL ==> Stat2: inv(f)~[cdr(c)] /= car(c)
--
-- Theorem 101 tells us that $inv(f)$ is a 1-1 map, and thus single-valued.
-- $[cdr(c),car(c)]$ must clearly belong to $inv(f)$. But then Theorem 74 tells us that
-- $(inv(f)~[car([cdr(c),car(c)])]) = cdr([cdr(c),car(c)])$.
-- This simplifies to $inv(f)~[cdr(c)] = car(c)$, contradicting our initial assumption,
-- and so proving the present theorem.
--
    f-->T101 ==> one_1_map(inv(f))
    Use_def(one_1_map) ==> Svm(inv(f))
    Suppose ==> [cdr(c),car(c)] notin inv(f)
    Use_def(inv) ==> Stat3: [cdr(c),car(c)] notin {[cdr(x),car(x)]: x in f}
    c-->Stat3 ==> (not c in f) or [cdr(c),car(c)] /= [cdr(c),car(c)]
    Discharge ==> [cdr(c),car(c)] in inv(f)
    (inv(f),[cdr(c),car(c)])-->T74 ==> (inv(f)~[car([cdr(c),car(c)])]) = cdr([cdr(c),car(c)])
    ELEM ==> car([cdr(c),car(c)]) = cdr(c)
    EQUAL ==> inv(f)~[cdr(c)] = cdr([cdr(c),car(c)])
    (Stat2)Discharge ==> QED
--
-- Our next theorem extends the preceding result by showing that
-- for elements in the range of $f$, the inverse map is a functional right inverse.
--
Theorem 103: [Inverse image of an element's map image] one_1_map(F) imp
	(((X in domain(F)) imp (inv(F)~[F~[X]] = X)) & ((X in range(F)) imp (F~[inv(F)~[X]] = X))). Proof:
    Suppose_not(f,c) ==> one_1_map(f) &
    	Stat1: (((c in domain(f)) & (inv(f)~[f~[c]] /= c)) or ((c in range(f))  &  (f~[inv(f)~[c]] /= c)))
--
-- For, supposing the contrary, there must either be a $c$ in the domain of $f$
-- for which $inv(f)~[f~[c]] /= c$, or a $c$ in the range of $f$ for which $f~[inv(f)~[c]] /= c$.
--
    (f,c)-->T102 ==> (c in domain(f)) imp (inv(f)~[f~[c]] = c)
--
-- However, Theorem 102 rules out the first possibility, and,
-- combined with Theorem 101, rules out the second possibility also,
-- thereby proving our theorem.
--
    f-->T101 ==> one_1_map(inv(f)) & (domain(inv(f)) = range(f)) & (f = inv(inv(f)))
    (inv(f),c)-->T102 ==> (c in domain(inv(f))) imp (inv(inv(f))~[inv(f)~[c]] = c)
    EQUAL ==> one_1_map(inv(f)) imp ((c in range(f)) imp (f~[inv(f)~[c]] = c))
    Discharge ==> QED
--
-- Our next small theory captures a simplification of nested setformer
-- similar to the one performed by SIMPLF inference, but where iterators
-- occur in inverse order.
--
THEORY setformer_unravel(e(f),s,g(y))
END setformer_unravel
--
ENTER_THEORY setformer_unravel
--
Theorem setformer_unravel1: {x: y in {e(f): f in s}, x in g(y)} = {x: f in s, x in g(e(f))}. Proof:
Suppose_not ==> Stat1: {x: y in {e(f): f in s}, x in g(y)} /= {x: f in s, x in g(e(f))}
	u-->Stat1 ==> (u in {x: y in {e(f): f in s}, x in g(y)}) neq (u in {x: f in s, x in g(e(f))})
	Suppose ==> Stat2: (u in {x: y in {e(f): f in s}, x in g(y)}) &
			Stat3: (u notin {x: f in s, x in g(e(f))})
		(y,x)-->Stat2(Stat2*) ==> Stat4: (y in {e(f): f in s}) & (x in g(y)) & (u = x)
		f-->Stat4(Stat2*) ==> (y = e(f)) & (f in s)
		EQUAL(Stat4*) ==> u in g(e(f))
	(f,u)-->Stat3(Stat2*) ==> false; Discharge ==> Stat5: (u in {x: f in s, x in g(e(f))}) &
			(u notin {x: y in {e(f): f in s}, x in g(y)})
	(fp,xp,e(fp),xp)-->Stat5(Stat5*) ==> Stat6: (fp in s) & Stat7: (e(fp) notin {e(f): f in s})
fp-->Stat7(Stat6*) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The following summarizes what has just been proved.
--
--DISPLAY setformer_unravel
--
--THEORY setformer_unravel(e(f),s,g(y))
--==>
--	{x: y in {e(f): f in s}, x in g(y)} = {x: f in s, x in g(e(f))}
--END setformer_unravel
--
-- ================ Basic laws concerning union-set ==================================
--
Theorem 104: [binary intersection distributes over monadic union]
	Un(F) * X = Un({y * X : y in F}). Proof:
Suppose_not(f,c) ==> Stat1: Un(f) * c /= Un({y * c : y in f})
	e-->Stat1 ==> (e in Un(f) * c) neq (e in Un({y * c : y in f}))
--
-- Arguing by contradiction, assume that $f,c$ are a counterexample to
-- the desired conclusion, so that we can choose a differentiator $e$ of
-- $Un({y * c : y in f})$ and $Un(f)$; recall, then, the definitions of
-- $Un({y * c : y in f}),Un(f)$, and simplify the formulation of the
-- former.
--
	Use_def(Un({y * c : y in f})) ==> AUTO
	SIMPLF ==> Un({y * c : y in f}) = {u: y in f, u in y * c}
	Use_def(Un(f)) ==> AUTO
	Suppose ==> Stat2: (e in {u: y in f, u in y * c}) &
			(e notin {u: v in f, u in v} * c)
--
-- If we suppose that the above-chosen differentiator $e$ belongs to
-- $Un({y * c : y in f})$, we reach a contradiction.
--
		(y0,u0)-->Stat2(Stat2*) ==> Stat3:
			(e notin {u: v in f, u in v}) &
			(y0 in f) & (e in y0)
		(y0,e)-->Stat3(Stat3*) ==> false
	Discharge ==> Stat4: (e in {u: v in f, u in v}) &
		(e notin {u: y in f, u in y * c}) & (e in c)
--
-- Even more readily we get a contradiction if we assume that the
-- differentiator belongs to $Un(f) + c$.
--
	(v1,u1,v1,u1)-->Stat4(Stat4*) ==> false
	Discharge ==> QED
--
Theorem 105: [membership in unionset] (X in Un(Y)) eq ({v in Y | X in v} /= 0). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def(Un) ==> (x0 in {u: v in y0, u in v}) eq ({v in y0 | x0 in v} = 0)
	Suppose ==> Stat1: (x0 in {u: v in y0, u in v}) & ({v in y0 | x0 in v} = 0)
		(v,u,v)-->Stat1(Stat1*) ==> false
	Discharge ==> Stat2: ({v in y0 | x0 in v} /= 0) & (x0 notin {u: v in y0, u in v})
	(w,w,x0)-->Stat2(Stat2*) ==> false
	Discharge ==> QED
--
Theorem 106: [Union set of a doubleton] Un({X,Y}) = (X + Y). Proof:
Suppose_not(u,v) ==> AUTO
	Use_def(Un) ==> Stat1: {x: y in {u,v}, x in y} /= (u + v)
	c-->Stat1 ==> (c in {x: y in {u,v}, x in y}) neq (c in (u+v))
	Suppose ==> Stat2: c in {x: y in {u,v}, x in y}
		(y,x)-->Stat2 ==> (y in {u,v}) & (c in y)
		Suppose ==> y = u
		Discharge ==> y = v
	Discharge ==> Stat3: c notin {x: y in {u,v}, x in y}
	Suppose ==> c in u
	(u,c)-->Stat3(Stat3*) ==> false; Discharge ==> c in v
(v,c)-->Stat3(Stat3*) ==> false; Discharge ==> QED
--
Theorem 107: [Union set of a singleton] Un({X}) = X. Proof:
Suppose_not(x) ==> AUTO
	(x,x)-->T106 ==> (Un({x,x}) = x) & ({x,x} = {x})
EQUAL ==> false; Discharge ==> QED
--
Theorem 108: [Recursive relationship for the union set] (Un(0) = 0) & ((X in M) imp (Un(M) = (X + Un(M - {X})))). Proof:
--
-- For, if not, there would be a counterexample $m$ to the second part of the
-- statement, since the first part of the statement trivially follows from
-- the very definition of the union-set operator.
--
Suppose_not(x0,m) ==> AUTO
	Suppose ==> Un(0) /= 0
		Use_def(Un) ==> Stat1: {x: y in 0, x in y} nincin 0
		(y1,x1)-->Stat1 ==> false
--
-- Every non-null set $m$, and in particular our counterexample, can be
-- decomposed as disjoint union $m = {x} + (m - {x})$, where $x$ is any
-- member of $m$.
--
	Discharge ==> Stat3: (m = ({x0} + (m - {x0}))) & (Un(m) /= (x0 + Un(m - {x0})))
--
-- However, the union-set of the union of two disjoint sets equals the union of their
-- respective union-sets; in our case, when one of the two sets is singleton and hence
-- its member equals its union-set, this tells us that $Un(m) = x0 + Un(m-{x0})$
-- and hence leads to a contradiction.
--
	Use_def(Un)(Stat3*) ==> Stat4: {x: y in m, x in y} /= (x0 + {x: y in (m - {x0}), x in y})
	b-->Stat4(Stat4*) ==> Stat5: ((b notin {x: y in m, x in y}) eq ((b in x0) or (b in {x: y in (m - {x0}), x in y})))
	Suppose ==> Stat6: (b in {x: y in m, x in y}) & (b notin x0) & (b notin {x: y in (m - {x0}), x in y})
		(u,x)-->Stat6(Stat6*) ==> Stat7: (u in m) & (b in u) & (u in (m - {x0}))
		(w,v,u,b)-->Stat6(Stat6*) ==> Stat8: b notin u
	(Stat7,Stat8*)Discharge ==> Stat9: (b notin {x: y in m, x in y}) & ((b in x0) or (b in {x: y in (m - {x0}), x in y}))
	(x0,b)-->Stat9(Stat3,Stat9*) ==> Stat11: b in {x: y in (m - {x0}), x in y}
	(ww,xx)-->Stat11(Stat11*) ==> (ww in (m - {x0})) & (b in ww)
	(ww,b)-->Stat9(Stat9*) ==> false
	Discharge ==> QED
--
Theorem 109: [Recursive relationship for the union set, 2] (Un(0) = 0) & ((M /= 0) imp (Un(M) = (arb(M) + Un(M - {arb(M)})))). Proof:
Suppose_not(m) ==> AUTO
	(arb(m),m)-->T108 ==> false
	Discharge ==> QED
--
THEORY unionset_commuter(e(x),s)
END unionset_commuter
--
ENTER_THEORY unionset_commuter
--
Theorem unionset_commuter1: [Set separation and unionset formation commute] {e(x): x in Un(s)} = Un({{e(x): x in f}: f in s}). Proof:
Suppose_not ==> Stat1: {e(x): x in Un(s)} /= Un({{e(x): x in f}: f in s})
	p-->Stat1 ==> (p in {e(x): x in Un(s)}) neq (p in Un({{e(u): u in f}: f in s}))
	Use_def(Un) ==> (p in {e(x): x in {q: f in s, q in f}}) neq (p in {x: y in {{e(u): u in f}: f in s}, x in y})
	APPLY() setformer_unravel(e(f)->{e(u): u in f},s->s,g(y)->y) ==>
		{x: y in {{e(u): u in f}: f in s}, x in y} = {x: f in s, x in {e(u): u in f}}
	SIMPLF ==> {x: y in {{e(u): u in f}: f in s}, x in y} = {e(u): f in s, u in f}
	SIMPLF ==> {e(x): x in {q: f in s, q in f}} = {e(q): f in s, q in f}
Discharge ==> QED
--
Theorem unionset_commuter2: [Set formation and set enumeration commute] {e(x): x in s} = Un({{e(x)}: x in s}). Proof:
Suppose_not ==> Stat1: {e(x): x in s} /= Un({{e(x)}: x in s})
	p-->Stat1 ==> (p in {e(x): x in s}) neq (p in Un({{e(f)}: f in s}))
	Use_def(Un) ==> (p in {e(x): x in s}) neq (p in {x: y in {{e(f)}: f in s}, x in y})
	APPLY() setformer_unravel(e(f)->{e(f)},s->s,g(y)->y) ==>
		{x: y in {{e(f)}: f in s}, x in y} = {x: f in s, x in {e(f)}}
	SIMPLF ==> {x: y in {{e(f)}: f in s}, x in y} = {x: f in s, x in {e(f)}}
	SIMPLF ==> {x: f in s, x in {e(f)}} = {e(f): f in s}
Discharge ==> QED
--
Theorem unionset_commuter3: [setformers whose iteration variable is bounded by 0 designate 0] {e(x): x in 0} = 0. Proof:
Suppose_not ==> Stat1: {e(x): x in 0} /= 0
	c-->Stat1 ==> Stat2: c in {e(x): x in 0}
d-->Stat2 ==> false; Discharge ==> QED
--
Theorem unionset_commuter4: [setformers whose iteration variable is bounded by a doubleton designate doubletons] {e(x): x in {s,T}} = {e(s),e(T)}. Proof:
Suppose_not(t) ==> AUTO
	Suppose ==> Stat1: e(s) notin {e(x): x in {s,t}}
	s-->Stat1 ==> false; Discharge ==> AUTO
	Suppose ==> Stat2: e(t) notin {e(x): x in {s,t}}
	t-->Stat2 ==> false; Discharge ==> Stat3: not({e(x): x in {s,t}} incin {e(s),e(t)})
	c-->Stat3(Stat3*) ==> Stat4: (c in {e(x): x in {s,t}}) & (c /= e(s)) & (c /= e(t))
	x-->Stat4(Stat4*) ==> (x in {s,t}) & (c = e(x))
	Suppose ==> x = s
	EQUAL(Stat4) ==> false; Discharge ==> x = t
EQUAL(Stat4) ==> false; Discharge ==> QED
--
Theorem unionset_commuter5: [setformers whose iteration variable is bounded by a singleton designate singletons] {e(x): x in {s}} = {e(s)}. Proof:
Suppose_not ==> AUTO
	(s,s)-->Tunionset_commuter4 ==> {e(x): x in {s,s}} = {e(s),e(s)}
	ELEM ==> ({s,s} = {s}) & ({e(s),e(s)} = {e(s)})
EQUAL ==> false; Discharge ==> QED
--
Theorem unionset_commuter6: [split of setformer over union-bounded iterator] {e(x): x in (s + T)} = {e(x): x in s} + {e(x): x in T}. Proof:
Suppose_not(t) ==> AUTO
	APPLY() unionset_commuter(e(x)->e(x),s->{s,t}) ==>
		{e(x): x in Un({s,t})} = Un({{e(x): x in f}: f in {s,t}})
	APPLY() unionset_commuter(e(f)->{e(u): u in f},s->s) ==>
		Stat1: (FORALL t | {{e(u): u in f}: f in {s,t}} = {{e(u): u in s},{e(u): u in t}})
	t-->Stat1(Stat1*) ==> {{e(u): u in f}: f in {s,t}} = {{e(u): u in s},{e(u): u in t}}
	({e(x): x in s},{e(x): x in t})-->T106 ==> Un({{e(x): x in s},{e(x): x in t}}) = ({e(x): x in s} + {e(x): x in t})
	(s,t)-->T106 ==> Un({s,t}) = (s + t)
EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY unionset_commuter
--
--THEORY unionset_commuter(e(x),s)
--	{e(x): x in Un(s)} = Un({{e(x): x in f}: f in s})
--	{e(x): x in s} = Un({{e(x)}: x in s})
--	{e(x): x in 0} = 0
--	(FORALL t | {e(x): x in {s,t}} = {e(s),e(t)})
--	{e(x): x in {s}} = {e(s)}
--	(FORALL t | {e(x): x in (s + t)} = {e(x): x in s} + {e(x): x in t})
--END unionset_commuter
--
-- Our next theorems state that the unionset operator
-- commutes with the map inversion operator, and with
-- range and domain operations.
--
Theorem 110: [Map inversion and unionset formation commute] inv(Un(S)) = Un({inv(f): f in S}). Proof:
Suppose_not(s) ==> AUTO
	APPLY() unionset_commuter(e(x)->[cdr(x),car(x)],s->s) ==>
		{[cdr(x),car(x)]: x in Un(s)} = Un({{[cdr(x),car(x)]: x in f}: f in s})
	Use_def(inv) ==> false
	Discharge ==> QED
--
Theorem 111: [Map inversion and the union operation commute] inv(X + Y) = inv(X) + inv(Y). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def(inv) ==> Stat1: {[cdr(v),car(v)]: v in (x0 + y0)} /= ({[cdr(v),car(v)]: v in x0} + {[cdr(v),car(v)]: v in y0})
	u-->Stat1(Stat1*) ==> (u in {[cdr(v),car(v)]: v in (x0 + y0)}) neq (u in ({[cdr(v),car(v)]: v in x0} + {[cdr(v),car(v)]: v in y0}))
	Suppose ==> Stat2: (u in {[cdr(v),car(v)]: v in x0}) & (u notin {[cdr(v),car(v)]: v in (x0 + y0)})
		(v0,v0)-->Stat2(Stat2*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat3: (u in {[cdr(v),car(v)]: v in y0}) & (u notin {[cdr(v),car(v)]: v in (x0 + y0)})
		(v1,v1)-->Stat3(Stat3*) ==> false
	Discharge ==> AUTO
	(Stat1*)ELEM ==> Stat4: (u in {[cdr(v),car(v)]: v in (x0 + y0)}) & (u notin {[cdr(v),car(v)]: v in x0}) & (u notin {[cdr(v),car(v)]: v in y0})
	(v2,v2,v2)-->Stat4(Stat4*) ==> false
	Discharge ==> QED
--
Theorem 112: [Range formation and unionset formation commute] range(Un(S)) = Un({range(f): f in S}). Proof:
Suppose_not(s) ==> AUTO
	APPLY() unionset_commuter(e(x)->cdr(x),s->s) ==>
		{cdr(x): x in Un(s)} = Un({{cdr(x): x in f}: f in s})
	Use_def(range) ==> false
	Discharge ==> QED
--
Theorem 113: [Domain formation and unionset formation commute] domain(Un(S)) = Un({domain(f): f in S}). Proof:
Suppose_not(s) ==> AUTO
	APPLY() unionset_commuter(e(x)->car(x),s->s) ==>
		{car(x): x in Un(s)} = Un({{car(x): x in f}: f in s})
	Use_def(domain) ==> false
	Discharge ==> QED
--
-- Also note that the domain and range of ${[x,y],[u,v]}$ are ${x,u}$ and ${y,v}$, respectively.
--
Theorem 114: [Domain and range of singleton and doubleton maps] (domain({[X,Y]}) = {X}) & (range({[X,Y]}) = {Y}) & (domain({[X,Y],[U,V]}) = {X,U}) & (range({[X,Y],[U,V]}) = {Y,V}). Proof:
Suppose_not(x0,y0,u,v) ==> AUTO
	APPLY() unionset_commuter(e(x)->car(x),s->([x0,y0])) ==>
		Stat1: {car(x): x in {[x0,y0]}} = {car([x0,y0])}
	TELEM ==> Stat2: car([x0,y0]) = x0
	Use_def(domain)(Stat3*) ==> Stat3: domain({[x0,y0]}) = {car(x): x in {[x0,y0]}}
	EQUAL(Stat1) ==> domain({[x0,y0]}) = {x0}
	APPLY() unionset_commuter(e(x)->cdr(x),s->([x0,y0])) ==>
		Stat4: {cdr(x): x in {[x0,y0]}} = {cdr([x0,y0])}
	TELEM ==> Stat5: cdr([x0,y0]) = y0
	Use_def(range)(Stat6*) ==> Stat6: range({[x0,y0]}) = {cdr(x): x in {[x0,y0]}}
	EQUAL(Stat4) ==> range({[x0,y0]}) = {y0}
	APPLY() unionset_commuter(e(x)->car(x),s->([x0,y0])) ==>
		Stat7: (FORALL t | {car(x): x in {[x0,y0],t}} = {car([x0,y0]),car(t)})
	([u,v])-->Stat7(Stat7*) ==> Stat8: {car(x): x in {[x0,y0],[u,v]}} = {car([x0,y0]),car([u,v])}
	TELEM ==> Stat9: car([u,v]) = u
	Use_def(domain)(Stat10*) ==> Stat10: domain({[x0,y0],[u,v]}) = {car(x): x in {[x0,y0],[u,v]}}
	EQUAL(Stat8,Stat9,Stat10,Stat2) ==> domain({[x0,y0],[u,v]}) = {x0,u}
	APPLY() unionset_commuter(e(x)->cdr(x),s->([x0,y0])) ==>
		Stat11: (FORALL t | {cdr(x): x in {[x0,y0],t}} = {cdr([x0,y0]),cdr(t)})
	([u,v])-->Stat11(Stat11*) ==> Stat12: {cdr(x): x in {[x0,y0],[u,v]}} = {cdr([x0,y0]),cdr([u,v])}
	TELEM ==> Stat13: cdr([u,v]) = v
	Use_def(range)(Stat14*) ==> Stat14: range({[x0,y0],[u,v]}) = {cdr(x): x in {[x0,y0],[u,v]}}
	EQUAL(Stat12,Stat13,Stat14,Stat5) ==> range({[x0,y0],[u,v]}) = {y0,v}
	Discharge ==> QED
--
--
-- Inverse maps often occur together with identity maps,
-- whose (entirely elementary) properties are collected in the following theorem.
--
Theorem 115: [Elementary properties of identity maps]
	one_1_map(ident(S)) & (domain(ident(S)) = S) & (range(ident(S)) = S) & (inv(ident(S)) = ident(S)) &
	 ((X in S) imp (ident(S)~[X] = X)) &
	(Is_map(F) imp (((domain(F) incin S) imp (F @ ident(S) = F)) & ((range(F) incin S) imp (ident(S) @ F = F)))). Proof:
    Suppose_not(s,x,f) ==> Stat1: (not one_1_map(ident(s))) or (domain(ident(s)) /= s) or (range(ident(s)) /= s) or
	(inv(ident(s)) /= ident(s)) or ((x in s) & (ident(s)~[x] /= x)) or
	(Is_map(f) & (domain(f) incin s) & ((f @ ident(s)) /= f)) or
	(Is_map(f) & (range(f) incin s) & ((ident(s) @ f) /= f))
--
-- Proceeding by contradiction, we shall show successively
-- that none of the clauses of our theorem can be false.
-- Indeed, it follows immediately using the $one_1_test$ developed
-- earlier that the first clause cannot be false.
--
    Use_def(ident) ==> ident(s) = {[x,x]: x in s}
    APPLY(x6_thryvar:xx,y6_thryvar:y) one_1_test(a(x)->x,b(x)->x,s->s) ==>
    		((not((xx = y) eq (xx = y))) or one_1_map({[x,x]: x in s}))
    ELEM ==> one_1_map({[x,x]: x in s})
    EQUAL ==> Stat2: one_1_map(ident(s))
--
-- In equally direct fashion, our 'fcn_symbol' theory tells us that neither the second, the
-- third, or the fifth clause of our theorem can be false.
-- --    (FORALL x in OM | (x in s) imp (g~[x] = f(x)))
--    (FORALL x in OM | (x notin s) imp (g~[X] = 0))
--    (FORALL x in OM | g~[x] = if x in s then f(x) else 0 end if)
--
    APPLY(x9_thryvar:u,y9_thryvar:v) fcn_symbol(f(x)->x,g->ident(s),s->s) ==>
	Svm(ident(s)) & (range(ident(s)) = {x: x in s}) & (domain(ident(s)) = s) &
		Stat3: (FORALL x | (x in s) imp (ident(s)~[x] = x)) &
				(((u in s) & (v in s) & (u = v) & (v /= v)) or one_1_map(ident(s)))
    x-->Stat3 ==> (x in s) imp (ident(s)~[x] = x)
    SIMPLF ==> Stat4: (range(ident(s))) = s
    (Stat2)ELEM ==> (range(ident(s)) = s) & (domain(ident(s)) = s) & ((x in domain(ident(s))) imp (ident(s)~[x] = x)) & one_1_map(ident(s))
--
-- We hence see that the only clauses of our original assumption which could be false are
-- the fourth clause and the two final clauses.
--
	(Stat2)ELEM ==> Stat5: (range(ident(s)) = s) & (domain(ident(s)) = s) & ((x in domain(ident(s))) imp (ident(s)~[x] = x)) & one_1_map(ident(s))
	EQUAL ==> Stat6: (range(ident(s)) = s) & (domain(ident(s)) = s) & ((x in s) imp (ident(s)~[x] = x)) & one_1_map(ident(s))
    (Stat1,Stat6)ELEM ==> Stat7: ((inv(ident(s)) /= ident(s)) or
    	(Is_map(f) & (domain(f) incin s) & ((f @ ident(s)) /= f))
	 or (Is_map(f) & (range(f) incin s) & ((ident(s) @ f) /= f)))
--
-- Use of the definition of $inv$ and an elementary simplification
-- shows immediately that the fourth clause cannot be false.
--
    Suppose ==> inv(ident(s)) /= ident(s)
    Use_def(ident) ==> inv({[x,x]: x in s}) /= {[x,x]: x in s}
    Use_def(inv) ==> {[cdr(y),car(y)]: y in {[x,x]: x in s}} /= {[x,x]: x in s}
    SIMPLF ==> Stat8: {[cdr([x,x]),car([x,x])]: x in s} /= {[x,x]: x in s}
    d-->Stat8 ==> Stat9: [cdr([d,d]),car([d,d])] /= [d,d]
    (Stat9)Discharge ==> inv(ident(s)) = ident(s)
--
-- Thus only one of the last two of our original clauses need be considered.
-- In both of these cases $f$ is a map.
--
    (Stat7)ELEM ==> Stat10: (Is_map(f) & (domain(f) incin s) & ((f @ ident(s)) /= f))
	 or (Is_map(f) & (range(f) incin s) & ((ident(s) @ f) /= f))
    (Stat10)ELEM ==> Stat11: Is_map(f)
--
-- Consider the first of these possibilities, and expand the definitions involved,
-- thereby showing that there exists a $c$ for which the conditions $c in f$
-- and $c in {[z,cdr(y)]: z in s, y in f | z = car(y)}$ are inequivalent.
--
    Suppose ==> Stat12: ((domain(f) incin s) & (f @ ident(s) /= f))
    Use_def(@) ==> {[car(x),cdr(y)]: x in ident(s), y in f | cdr(x) = car(y)} /= f
    Use_def(ident) ==> {[car(x),cdr(y)]: x in {[z,z]: z in s}, y in f | cdr(x) = car(y)} /= f
    SIMPLF ==> {[car(x),cdr(y)]: x in {[z,z]: z in s}, y in f | cdr(x) = car(y)} =
    				{[car([z,z]),cdr(y)]: z in s, y in f | cdr([z,z]) = car(y)}
    Set_monot ==> {[car([z,z]),cdr(y)]: z in s, y in f | cdr([z,z]) = car(y)} = {[z,cdr(y)]: z in s, y in f | z = car(y)}
    ELEM ==> Stat13: {[z,cdr(y)]: z in s, y in f | z = car(y)} /= f
    c-->Stat13 ==> ((c in {[z,cdr(y)]: z in s, y in f | z = car(y)}) & (c notin f)) or
	((c notin {[z,cdr(y)]: z in s, y in f | z = car(y)}) & (c in f))
--
-- In the first of the two resulting cases it follows, using Theorem 51, that
-- $c$ is both a member and not a member of $f$, a contradiction which rules out this case,
-- leaving only the case $c in f$.
--
    Suppose ==> Stat14: (c in {[z,cdr(y)]: z in s, y in f | z = car(y)}) & (c notin f)
    (a,b)-->Stat14 ==> Stat15: (c = [a,cdr(b)]) & (a in s) & (b in f) & (a = car(b)) & (c notin f)
    (f,b)-->T51 ==> b = [car(b),cdr(b)]
    (Stat15)Discharge ==> Stat16: (c notin {[z,cdr(y)]: z in s, y in f | z = car(y)}) & (c in f)
--
-- But in this case a contradiction follows immediately from Theorem 51,
-- leaving out for final consideration only the case $(range(f) incin s) & ((ident(s) @ f) /= f)$.
--
    (f,c)-->T51 ==> c = [car(c),cdr(c)]
    (car(c),c)-->Stat16 ==> Stat17: (c in f) & (car(c) notin s)
    (Stat17,Stat12)ELEM ==> Stat18: (c in f)  & (car(c) notin domain(f))
    Use_def(domain) ==> Stat19: car(c) notin {car(x): x in f}
    c-->Stat19 ==> not((c in f) & (car(c)= car(c)))
    Discharge ==> Stat20: (range(f) incin s) & ((ident(s) @ f) /= f)
--
-- By expanding the definitions involved, we see that there must exist an element $e$ for which
-- the conditions $e in f$ and $e in {[car(x),z]: x in f, z in s | cdr(x) = z}$ are inequivalent.
--
    Use_def(@) ==> {[car(x),cdr(y)]: x in f, y in ident(s) | cdr(x) = car(y)} /= f
    Use_def(ident) ==> {[car(x),cdr(y)]: x in f, y in {[z,z]: z in s} | cdr(x) = car(y)} /= f
    SIMPLF ==> {[car(x),cdr(y)]: x in f, y in {[z,z]: z in s} | cdr(x) = car(y)} =
    					{[car(x),cdr([z,z])]: x in f, z in s | cdr(x) = car([z,z])}
    Set_monot ==> {[car(x),cdr([z,z])]: x in f, z in s | cdr(x) = car([z,z])} = {[car(x),z]: x in f, z in s | cdr(x) = z}
    ELEM ==> Stat21: {[car(x),z]: x in f, z in s | cdr(x) = z} /= f
    e-->Stat21 ==> ((e in {[car(x),z]: x in f, z in s | cdr(x) = z}) & (e notin f)) or
	((e notin {[car(x),z]: x in f, z in s | cdr(x) = z}) & (e in f))
--
-- In the first of the two resulting cases it follows, using Theorem 51, that
-- $e$ is both a member and not a member of $f$, a contradiction which rules out this case,
-- leaving only the case $e in f$.
--
    Suppose ==> Stat22: (e in {[car(x),z]: x in f, z in s | cdr(x) = z}) & (e notin f)
    (aa,bb)-->Stat22 ==> (e = [car(aa),bb]) & (aa in f) & (bb in s) & (cdr(aa)=bb) & (e notin f)
    (f,aa)-->T51 ==> aa = [car(aa),cdr(aa)]
    (Stat22)Discharge ==> Stat23: (e notin {[car(x),z]: x in f, z in s | cdr(x) = z}) & (e in f)
--
-- But in this case a contradiction follows immediately from Theorem 51,
-- proving our theorem.
--
    (f,e)-->T51 ==> e = [car(e),cdr(e)]
    (e,cdr(e))-->Stat23 ==> Stat24: (e in f) & (cdr(e) notin s)
    (Stat24,Stat20)ELEM ==> (e in f)  & (cdr(e) notin range(f))
    Use_def(range) ==> Stat25: cdr(e) notin {cdr(x): x in f}
    e-->Stat25 ==> not((e in f) & (cdr(e)= cdr(e)))
    Discharge ==> QED
--
Theorem 116: [Composition with an identity map is restriction] (Is_map(F)) imp (F @ ident(S) = F ON S). Proof:
	Suppose_not(f,s) ==> Is_map(f) & (f @ ident(s) /= f ON s)
	Use_def(ident) ==> f @ ident(s) = f @ {[u,u]: u in s}
	Use_def(@) ==> {[car(x),cdr(y)]: x in {[u,u]: u in s}, y in f | cdr(x) = car(y)} = f @ {[u,u]: u in s}
	SIMPLF ==> {[car([u,u]),cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)} = {[car(x),cdr(y)]: x in {[u,u]: u in s}, y in f | cdr(x) = car(y)}
	Suppose ==> Stat1: {[car([u,u]),cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)} /= {[u,cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)}
	(u,y)-->Stat1 ==> false; Discharge ==> {[car([u,u]),cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)} = {[u,cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)}
	Suppose ==> Stat2: {[u,cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)} /= {[u,cdr(y)]: u in s, y in f | u = car(y)}
	(u1,y1)-->Stat2 ==> false; Discharge ==> {[u,cdr(y)]: u in s, y in f | cdr([u,u]) = car(y)} = {[u,cdr(y)]: u in s, y in f | u = car(y)}
	ELEM ==> {[u,cdr(y)]: u in s, y in f | u = car(y)} /= f ON s
	Suppose ==> Stat3: {[u,cdr(y)]: u in s, y in f | u = car(y)} /= {[car(y),cdr(y)]: y in f | car(y) in s}
		c-->Stat3 ==> not((c in {[u,cdr(y)]: u in s, y in f | u = car(y)}) eq (c in {[car(y),cdr(y)]: y in f | car(y) in s}))
		Suppose ==> Stat4: (c in {[u,cdr(y)]: u in s, y in f | u = car(y)}) & Stat5: (not(c in {[car(y),cdr(y)]: y in f | car(y) in s}))
			(u2,y2)-->Stat4 ==> (u2 in s) & (y2 in f) & (c = [u2,cdr(y2)]) & (u2 = car(y2))
			ELEM ==> (car(y2) in s) & (y2 in f) & (c = [car(y2),cdr(y2)])
		y2-->Stat5 ==> false; Discharge ==> Stat6: (not(c in {[u,cdr(y)]: u in s, y in f | u = car(y)})) & Stat7: (c in {[car(y),cdr(y)]: y in f | car(y) in s})
		y3-->Stat7 ==> (y3 in f) & (c = [car(y3),cdr(y3)]) & (car(y3) in s)
	(car(y3),y3)-->Stat6(Stat6) ==> false; Discharge ==> Stat8: {[car(y),cdr(y)]: y in f | car(y) in s} /= f ON s
	Use_def(Is_map) ==> f = {[car(y),cdr(y)]: y in f}
	EQUAL ==> Stat9: f ON s = {[car(y),cdr(y)]: y in f} ON s
	Use_def(ON) ==> Stat10: {[car(y),cdr(y)]: y in f} ON s = {u in {[car(y),cdr(y)]: y in f} | car(u) in s}
	SIMPLF ==> {u in {[car(y),cdr(y)]: y in f} | car(u) in s} = {[car(y),cdr(y)]: y in f | car([car(y),cdr(y)]) in s}
	ELEM ==> Stat11: {[car(y),cdr(y)]: y in f | car([car(y),cdr(y)]) in s} /= {[car(y),cdr(y)]: y in f | car(y) in s}
	y4-->Stat11 ==> car([car(y),cdr(y)]) /= car(y)
    Discharge ==> QED
--
-- Next we prove that the product of the inverse of a single-valued map $f$
-- by the map itself is the identity map on the range of $f$.
--
Theorem 117: [Composition with the inverse map] Svm(F) imp (F @ inv(F) = ident(range(F))). Proof:
    Suppose_not(f) ==> Svm(f) & (f @ inv(f) /= ident(range(f)))
--
-- For suppose that there is a counterexample to our theorem, and then expand and simplify
-- all the definitions involved, getting the set-theoretic inequality seen below.
--
    Use_def(ident) ==> f @ inv(f) /= {[x,x]: x in range(f)}
    Use_def(range) ==> f @ inv(f) /= {[x,x]: x in {cdr(y): y in f}}
    SIMPLF ==> f @ inv(f) /= {[cdr(x),cdr(x)]: x in f}
    Use_def(@) ==>
	{[car(x),cdr(y)]: x in inv(f), y in f | cdr(x) = car(y)} /= {[cdr(x),cdr(x)]: x in f}
    Use_def(inv) ==>
	{[car(x),cdr(y)]: x in {[cdr(u),car(u)]: u in f}, y in f | cdr(x) = car(y)}
	/= {[cdr(x),cdr(x)]: x in f}
    SIMPLF ==> {[car(x),cdr(y)]: x in {[cdr(u),car(u)]: u in f}, y in f | cdr(x) = car(y)}  =
    					{[car([cdr(u),car(u)]),cdr(y)]: u in f, y in f | cdr([cdr(u),car(u)]) = car(y)}
    Set_monot ==> {[car([cdr(u),car(u)]),cdr(y)]: u in f, y in f | cdr([cdr(u),car(u)]) = car(y)} =
    					{[cdr(u),cdr(y)]: u in f, y in f | car(u) = car(y)}
    ELEM ==> Stat1: {[cdr(x),cdr(y)]: x in f, y in f | car(x) = car(y)} /= {[cdr(x),cdr(x)]: x in f}
--
-- Since the sets displayed are not equal, there is a $c$ that is in one but not the other.
-- If it is in the first of these two sets but not the second, a contradiction results from
-- the assumed single-valuedness of $f$, ruling out this case.
--
     c-->Stat1 ==> Stat2: (((c in {[cdr(x),cdr(y)]: x in f, y in f | car(x) = car(y)}) & (c notin {[cdr(x),cdr(x)]: x in f})) or
	((c notin {[cdr(x),cdr(y)]: x in f, y in f | car(x) = car(y)}) & (c in {[cdr(x),cdr(x)]: x in f})))
     Suppose ==> Stat3: (c in {[cdr(x),cdr(y)]: x in f, y in f | car(x) = car(y)}) & Stat4: (c notin {[cdr(x),cdr(x)]: x in f})
     (a,b)-->Stat3 ==> Stat5: (a in f) & (b in f) & (c = [cdr(a),cdr(b)]) & (car(a) = car(b))
     b-->Stat4(Stat5*) ==> Stat6: (c /= [cdr(b),cdr(b)]) & (c = [cdr(a),cdr(b)])
     (Stat6)ELEM ==> a /= b
     Use_def(Svm) ==> Stat7: (FORALL x in f, y in f | (car(x) = car(y)) imp (x = y))
	 (a,b)-->Stat7 ==> false; Discharge ==>
	Stat8: (c notin {[cdr(x),cdr(y)]: x in f, y in f | car(x) = car(y)}) & Stat9: (c in {[cdr(x),cdr(x)]: x in f})
--
-- But in the remaining case $c$ has the form $[cdr(d),cdr(d)]$ for some $d in f$,
-- and a contradiction results in much the same way, proving our theorem.
--
	(d)-->Stat9 ==> (c = [cdr(d),cdr(d)]) & (d in f)
	(d,d)-->Stat8 ==> false; Discharge ==> QED
--
-- Next we extend Theorem 117: if a single-valued map $f$ is 1-1, the product of
-- its inverse by $f$ is also the identity map on the domain of $f$.
--
Theorem 118: [Inverses of one-one maps] one_1_map(F) imp (((F @ inv(F)) = ident(range(F))) & ((inv(F) @ F) = ident(domain(F)))). Proof:
    Suppose_not(f) ==> one_1_map(f) & ((f @ inv(f)) /= ident(range(f)) or ((inv(f) @ f) /= ident(domain(f))))
--
-- This follows by simple algebraic reasoning using Theorem 99, Theorem 100, Theorem 101, and Theorem 117.
--
    Use_def(one_1_map) ==> Svm(f)
    Use_def(Svm) ==> Is_map(f)
    f-->T117 ==> inv(f) @ f /= ident(domain(f))
    f-->T101 ==> one_1_map(inv(f))
    f-->T99 ==> range(inv(f)) = domain(f)
    f-->T100 ==> inv(inv(f)) = f
    Use_def(one_1_map) ==> Svm(inv(f))
    (inv(f))-->T117 ==> inv(f) @ inv(inv(f)) = ident(range(inv(f)))
    EQUAL ==> inv(f) @ f = ident(domain(f))
    Discharge ==> QED
--
-- Our next aim, which we will reach in several steps, is to prove a kind of converse to Theorem 118:
-- mutually inverse maps are each other's inverses.
--
Theorem 119: [Product of inverses lemma]
	(Is_map(F) & Is_map(G) & (domain(F) incin range(G)) & Svm(F @ G)) imp Svm(F). Proof:
	Suppose_not(f,g) ==> Stat1: Is_map(f) & Is_map(g) & (domain(f) incin range(g)) & Svm(f @ g) & (not(Svm(f)))
--
-- First we show that if the product $f @ g$ of two maps is single valued,
-- and if the range of $g$ includes the domain of $f$, then the map $f$ must be single valued.
-- For suppose that a counterexample exists, and apply the utility theory $Svm_test$.
--
	Use_def(Is_map) ==> f = {[car(x),cdr(x)]: x in f}
	APPLY(x3_thryvar:x,y3_thryvar:y) Svm_test(a(x)->car(x),b(x)->cdr(x),s->f) ==>
		(((x in f) & (y in f) & (car(x) = car(y)) & (cdr(x) /= cdr(y))) or Svm({[car(x),cdr(x)]: x in f}))
	EQUAL ==> (((x in f) & (y in f) & (car(x) = car(y)) & (cdr(x) /= cdr(y))) or Svm(f))
--
-- This tells us that there are elements $x$, $y$ in $f$ with $car(x) = car(y)$
-- such that $cdr(x) /= cdr(y)$.
--
	ELEM ==> Stat2: (x in f) & (y in f) & (car(x) = car(y)) & (cdr(x) /= cdr(y))
	Suppose ==> car(x) notin domain(f)
	Use_def(domain) ==> Stat3: car(x) notin {car(u): u in f}
	x-->Stat3 ==> false; Discharge ==> car(x) in range(g)
--
-- Therefore $car(x) = car(y)$ must have the form $cdr(u)$, where $u$ belongs to $g$.
-- It follows that $[car(u),cdr(x)]$ and $[car(u),cdr(y)]$ both belong to $f @ g$.
--
	Use_def(range) ==> Stat4: (car(x) in {cdr(u): u in g})
	u-->Stat4 ==> Stat5: (car(x) = cdr(u)) & (u in g)
	Suppose ==> [car(u),cdr(x)] notin (f @ g)
	Use_def(@) ==> Stat6: [car(u),cdr(x)] notin {[car(v),cdr(w)]: v in g, w in f | cdr(v) = car(w)}
	(u,x)-->Stat6 ==> Stat7: (u notin g or x notin f or [car(u),cdr(x)] /= [car(u),cdr(x)]
		or cdr(u) /= car(x))
	(Stat7,Stat2,Stat5*)Discharge ==> [car(u),cdr(x)] in (f @ g)
	Suppose ==> [car(u),cdr(y)] notin (f @ g)
	Use_def(@) ==> Stat8: [car(u),cdr(y)] notin {[car(v),cdr(w)]: v in g, w in f | cdr(v) = car(w)}
	(u,y)-->Stat8 ==> Stat9: (u notin g or y notin f or [car(u),cdr(y)] /= [car(u),cdr(y)]
		or cdr(u) /= car(y))
	(Stat9,Stat2,Stat5*)Discharge ==> [car(u),cdr(y)] in (f @ g)
--
-- But now, since $f @ g$ is single-valued, it follows that $[car(u),cdr(x)] = [car(u),cdr(y)]$
-- contrary to our initial assumption. This contradiction proves the present theorem.
--
    Use_def(Svm) ==> Stat10: (FORALL x in (f @ g), y in (f @ g) | ((car(x) = car(y)) imp (x = y)))
    ([car(u),cdr(x)],[car(u),cdr(y)])-->Stat10 ==> Stat11: (car(x) = car(y)) imp (x = y)
    (Stat2,Stat11)Discharge ==> QED
--
-- The following proof shows that the inverse of a product map is the
-- product of the inverses, taken in the reverse order.
--
Theorem 120: [Product of Inverses] (Is_map(F) & Is_map(G)) imp (inv(F @ G) = inv(G) @ inv(F)). Proof:
Suppose_not(f,g) ==> Is_map(f) & Is_map(g) & (inv(f @ g) /= inv(g) @ inv(f))
--
-- For if we expand all the definitions involved, simplify, and reverse the order of the bound
-- variables in the setformers which appear, we get the set inequality seen below.
--
	Use_def(Is_map) ==> (f = {[car(x),cdr(x)]: x in f}) &
	(g = {[car(x),cdr(x)]: x in g}) & (inv(f @ g) /= inv(g) @ inv(f))
	Use_def(@) ==> inv({[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}) /=
			{[car(x),cdr(y)]: x in inv(f), y in inv(g) | cdr(x) = car(y)}
	Use_def(inv) ==> {[cdr(u),car(u)]: u in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}} /=
	{[car(x),cdr(y)]: x in {[cdr(u),car(u)]: u in f}, y in {[cdr(v),car(v)]: v in g} | cdr(x) = car(y)}
	SIMPLF ==> {[cdr([car(x),cdr(y)]),car([car(x),cdr(y)])]: x in g, y in f | cdr(x) = car(y)}  /=
	{[car([cdr(u),car(u)]),cdr([cdr(v),car(v)])]:  u in f, v in g | cdr([cdr(u),car(u)]) = car([cdr(v),car(v)])}
	Set_monot ==> {[cdr([car(x),cdr(y)]),car([car(x),cdr(y)])]: x in g, y in f | cdr(x) = car(y)} =
		{[cdr(y),car(x)]: x in g, y in f | cdr(x) = car(y)}
	Set_monot ==> {[car([cdr(u),car(u)]),cdr([cdr(v),car(v)])]:  u in f, v in g | cdr([cdr(u),car(u)]) = car([cdr(v),car(v)])} =
		{[cdr(u),car(v)]:  u in f, v in g | car(u) = cdr(v)}
	ELEM ==> Stat1: {[cdr(y),car(x)]: x in g, y in f | cdr(x) = car(y)} /= {[cdr(u),car(v)]: u in f, v in g | car(u) = cdr(v)}
--
-- Thus there must exist an element $c$ which belongs to one of these two last sets but not the other,
-- say the first but not the second. his leads immediately to an elementary contradiction, ruling out this case.
--
	c-->Stat1 ==> ((c in {[cdr(y),car(x)]: x in g, y in f | cdr(x) = car(y)}) &
			(c notin {[cdr(u),car(v)]: u in f, v in g | car(u) = cdr(v)})) or
		((c notin {[cdr(y),car(x)]: x in g, y in f | cdr(x) = car(y)}) &
			(c in {[cdr(u),car(v)]: u in f, v in g | car(u) = cdr(v)}))
	Suppose ==> Stat2: (c in {[cdr(y),car(x)]: x in g, y in f | cdr(x) = car(y)}) &
			(c notin {[cdr(u),car(v)]: u in f, v in g | car(u) = cdr(v)})
	(x,y,y,x)-->Stat2 ==> (x in g) & (y in f) & (c = [cdr(y),car(x)]) &
					(not((x in g) & (y in f) & (c = [cdr(y),car(x)])))
	Discharge ==> Stat3: (c in {[cdr(u),car(v)]: u in f, v in g | car(u) = cdr(v)}) &
			(c notin {[cdr(y),car(x)]: x in g, y in f | cdr(x) = car(y)})
--
-- But the case in which $c$ belongs to the second but not the first leads to an exactly similar contradiction,
-- thereby proving that our assertion holds in every possible case.
--
	(x2,y2,y2,x2)-->Stat3 ==> (x2 in f) & (y2 in g) & (c = [cdr(x2),car(y2)]) &
					(not((x2 in f) & (y2 in g) & (c = [cdr(x2),car(y2)])))
Discharge ==> QED
--
-- Next we prove that a map is 1-1 if and only if it and its inverse are both single-valued.
--
Theorem 121: [One-one-ness and singlevaluedness] one_1_map(F) eq (Svm(F) & Svm(inv(F))). Proof:
 	Suppose_not(f) ==> Stat1: not(one_1_map(f) eq (Svm(f) & Svm(inv(f))))
--
-- Suppose the contrary, and first consider the case in which $f$ and $inv(f)$
-- are both single-valued, but f is not 1-1, so that by definition there exist
-- distinct elements of the form $[car(u),cdr(u)]$ with $u in f$ having identical
-- second components but different first components.
--
 	Suppose ==> Svm(f) & Svm(inv(f))
 	Use_def(one_1_map) ==> Stat2: not (FORALL x in f, y in f | (cdr(x) = cdr(y)) imp (x = y))
 	(x,y)-->Stat2 ==> Stat3: (x in f) & (y in f) & (cdr(x) = cdr(y)) & (x /= y)
 	Use_def(Svm) ==> Is_map(f)
 	Use_def(Is_map) ==> Stat4: x in {[car(u),cdr(u)]: u in f}
 	Use_def(Is_map) ==> Stat5: y in {[car(u),cdr(u)]: u in f}
 	u-->Stat4 ==> Stat6: (x = [car(u),cdr(u)]) & (u in f)
 	v-->Stat5 ==> Stat7: (y = [car(v),cdr(v)]) & (v in f)
	(Stat3,Stat6,Stat7*)ELEM ==>
	(cdr(x) = cdr(y)) & (x /= y) & (x = [car(u),cdr(u)]) & (y = [car(v),cdr(v)])
	EQUAL ==> Stat8: (cdr([car(u),cdr(u)]) = cdr([car(v),cdr(v)])) & ([car(u),cdr(u)] /= [car(v),cdr(v)])
	(Stat8)ELEM ==> Stat9: (cdr(u) = cdr(v))
	Suppose ==> car(u) = car(v)
            EQUAL ==> [car(u),cdr(u)] = [car(v),cdr(v)]
    (Stat8*)Discharge ==> Stat10: (car(u) /= car(v))
--
-- But then, by Theorem 90, $[cdr(u),car(u)]$ and $[cdr(v),car(v)]$
-- both belong to $inv(f)$, contradicting its single-valuedness.
--
	(f,car(u),cdr(u))-->T90 ==> Stat11: [cdr(u),car(u)] in inv(f)
	(f,car(v),cdr(v))-->T90 ==> Stat12: [cdr(v),car(v)] in inv(f)
	Use_def(Svm) ==> Stat13: (FORALL x in inv(f), y in inv(f) | (car(x) = car(y)) imp (x = y))
	([cdr(u),car(u)],[cdr(v),car(v)])-->Stat13 ==> Stat14: not(([cdr(u),car(u)] in inv(f)) & ([cdr(v),car(v)] in inv(f)) &
		(car([cdr(u),car(u)]) = car([cdr(v),car(v)])) & ([cdr(u),car(u)] /= [cdr(v),car(v)]))
--
-- The single, direct step
--	(Stat9,Stat10,Stat11,Stat12,Stat14)ELEM ==> false; Discharge ==> (not(Svm(f) & Svm(inv(f)))) & one_1_map(f)
-- takes very long, and therefore we expand it into the following five steps.
--
	(Stat11,Stat12,Stat14*)ELEM ==> Stat15: (car([cdr(u),car(u)]) /= car([cdr(v),car(v)])) or ([cdr(u),car(u)] = [cdr(v),car(v)])
	Suppose ==> Stat16: car([cdr(u),car(u)]) /= car([cdr(v),car(v)])
	(Stat9,Stat16)Discharge ==> Stat17: car([cdr(u),car(u)]) = car([cdr(v),car(v)])
	(Stat15,Stat17*)ELEM ==> Stat18: [cdr(u),car(u)] = [cdr(v),car(v)]
	(Stat10,Stat18)ELEM ==> false; Discharge ==> (not(Svm(f) & Svm(inv(f)))) & one_1_map(f)
--
-- Next consider the case in which $f$ is 1-1, but $f$ and $inv(f)$ are not both single-valued.
-- By definition of 'one_1_map', it must be $inv(f)$ that is not single valued,
-- so that there must exist distinct $xx$ and $yy$ in $inv(f)$ with identical first components.
-- Since these are in effect distinct elements of $f$ with identical second components,
-- they violate the fact that $f$ is 1-1, a contradiction which
-- completes the proof of the present theorem.
--
	Use_def(one_1_map) ==> not(Svm(inv(f))) &
	Stat19: (FORALL x in f, y in f | ((cdr(x) = cdr(y)) imp (x = y)))
	Use_def(Svm) ==>
	not(Is_map(inv(f)) & (FORALL x in inv(f), y in inv(f) | ((car(x) = car(y)) imp (x = y))))
	f-->T99 ==> Stat20:
	not(FORALL x in inv(f), y in inv(f) | ((car(x) = car(y)) imp (x = y)))
	(xx,yy)-->Stat20 ==> Stat21: (xx in inv(f)) & (yy in inv(f)) & (car(xx) = car(yy)) & (xx /= yy)
	Use_def(inv) ==> Stat22: xx in {[cdr(u),car(u)]: u in f}
	vv-->Stat22 ==> (xx = [cdr(vv),car(vv)]) & (vv in f)
	Use_def(inv) ==> Stat23: yy in {[cdr(u),car(u)]: u in f}
	w-->Stat23 ==> (yy = [cdr(w),car(w)]) & (w in f)
	(Stat21*)ELEM ==> Stat24: (xx /= yy) & (xx = [cdr(vv),car(vv)]) & (yy = [cdr(w),car(w)])
	Suppose ==> vv = w
	EQUAL ==> yy = [cdr(vv),car(vv)]
	(Stat24*)Discharge ==> vv /= w
	(Stat21*)ELEM ==> (car(xx) = car(yy)) & (xx = [cdr(vv),car(vv)]) & (yy = [cdr(w),car(w)])
	EQUAL ==> Stat25: car([cdr(vv),car(vv)]) = car([cdr(w),car(w)])
	(Stat25)ELEM ==> (cdr(vv) = cdr(w))
	(vv,w)-->Stat19 ==> false; Discharge ==> QED
--
-- The following theorem completes our proof that a pair of
-- mutually inverse maps are each other's inverses.
--
Theorem 122: [An inverse pair of maps must be 1-1 and must be each other's inverses]
    (Is_map(F) & Is_map(G) & (domain(F) = range(G)) & (range(F) = domain(G)) &
	(F @ G = ident(range(F))) & (G @ F = ident(domain(F)))) imp (one_1_map(F) & (G = inv(F))) Proof:
    Suppose_not(f,g) ==>
	Stat1: (Is_map(f) & Is_map(g) & (domain(f) = range(g)) & (range(f) = domain(g)) &
	(f @ g = ident(range(f))) & (g @ f = ident(domain(f)))) & (not(one_1_map(f) & (g = inv(f))))
--
-- For consider a counterexample $f$, $g$. By Theorem 119, $f$ and $g$ must both must be single-valued,
-- so either $f$ is not 1-1, or $g$ is not its inverse.
-- But by Theorem 99, $g$ has the same range and domain as the inverse of $f$,
--
	(range(f))-->T115 ==> one_1_map(ident(range(f)))
	(domain(f))-->T115 ==> one_1_map(ident(domain(f)))
	EQUAL ==> one_1_map(f @ g) & one_1_map(g @ f)
	Use_def(one_1_map) ==> Svm(f @ g) & Svm(g @ f)
	(f,g)-->T119 ==> Svm(f)
	(g,f)-->T119 ==> Svm(g)
	EQUAL ==> ident(range(f)) = ident(domain(g))
	EQUAL ==> ident(domain(f)) = ident(range(g))
	f-->T99 ==> Is_map(inv(f)) & (domain(inv(f)) = range(f))
	g-->T99 ==> Is_map(inv(g)) & (range(inv(g)) = domain(g))
--
-- and by Theorem 120 $inv(f)$ has $inv(g)$ as a right inverse,
-- so that by Theorem 119 $inv(f)$ must also be single-valued.
--
	Use_def(Svm) ==> Is_map(f)
	Use_def(Svm) ==> Is_map(g)
	(g,f)-->T120 ==> inv(g @ f) = inv(f) @ inv(g)
	(range(g))-->T115 ==> one_1_map(ident(range(g))) & (inv(ident(range(g))) = ident(range(g)))
	EQUAL ==> inv(f) @ inv(g) = ident(range(g))
	Use_def(one_1_map) ==> Svm(ident(range(g)))
    EQUAL ==> Svm(inv(f) @ inv(g)) & (domain(inv(f)) = range(inv(g)))
   	(inv(f),inv(g))-->T119 ==> Svm(inv(f))
--
-- Theorem 121 tells us that $f$ must be 1-1, so only the possibility that $g /= inv(f)$ needs
-- to be considered. But since $f @ inv(f)$ and $g @ f$ are both identity maps, we can reassociate
-- to show that the triple product $g @ f @ inv(f)$ is equal to both $g$ and $inv(f)$,
-- a contradiction which proves our theorem
--
	f-->T121 ==> Stat2: one_1_map(f) & (g /= inv(f))
	f-->T118 ==> f @ inv(f) = ident(range(f))
	(range(f),junk,g)-->T115 ==>
	(Is_map(g) & (domain(g) incin range(f))) imp (g @ ident(range(f)) = g)
	EQUAL ==> g @ (f @ inv(f)) = g
	(g,f,inv(f))-->T66 ==> (g @ f) @ inv(f) = g
	EQUAL ==> Stat3: ident(domain(f)) @ inv(f) = g
	f-->T99 ==> Stat4: range(inv(f)) = domain(f)
	(domain(f),junk,inv(f))-->T115 ==>
	Stat5: ((range(inv(f)) incin domain(f)) imp (ident(domain(f)) @ inv(f) = inv(f)))
	(Stat1,Stat3,Stat4,Stat5*)ELEM ==> Stat6: inv(f) = g
    (Stat1,Stat2,Stat6*)Discharge ==> QED
--
-- The following elementary lemma expresses the restriction of a single-valued map as a setformer.
--
Theorem 123: [Single-valued map restrictions as setformers] Svm(F) imp (((F ON S) = {[x,F~[x]]: x in domain(F) | x in S}) &
	(domain(F ON S) = {x: x in domain(F) | x in S}) &
	(range(F ON S) = {F~[x]: x in domain(F) | x in S})). Proof:
    Suppose_not(f,s) ==>
	Svm(f) & ((f ON s) /= {[x,f~[x]]: x in domain(f) | x in s} or domain(f ON s) /= {x: x in domain(f) | x in s} or
	range(f ON s) /= {f~[x]: x in domain(f) | x in s})
--
-- For if we suppose the first clause of our theorem to be false, use the definitions of the operators involved,
-- and simplify, we are led to the impossible inequalities seen below. Thus only the second and third
-- conclusion of the theorem need be considered.
--
    f-->T72 ==> f = {[u,f~[u]]: u in domain(f)}
    Use_def(ON) ==> (f ON s) = {x: x in f | car(x) in s}
    EQUAL ==> (f ON s) = {x: x in {[u,f~[u]]: u in domain(f)} | car(x) in s}
    SIMPLF ==> (f ON s) = {[x,f~[x]]: x in domain(f) | car([x,f~[x]]) in s}
    Suppose ==> (f ON s) /= {[x,f~[x]]: x in domain(f) | x in s}
    ELEM ==> Stat1: {[x,f~[x]]: x in domain(f) | x in s} /= {[x,f~[x]]: x in domain(f) | car([x,f~[x]]) in s}
    x-->Stat1 ==> (x in domain(f)) & (not ((x in s) eq (car([x,f~[x]]) in s)))
    Discharge ==> f ON s = {[x,f~[x]]: x in domain(f) | x in s}
--
-- Next suppose that our theorem's second conclusion is false. Using the relevant definitions
-- and simplifying much as above, we are led to a second impossible inequality. Hence only the
-- third conclusion of our theorem could be false.
--
    Suppose ==> range(f ON s) /= {f~[x]: x in domain(f) | x in s}
    Use_def(range) ==> range(f ON s) = {cdr(x): x in (f ON s)}
    EQUAL ==> range(f ON s) = {cdr(x): x in {[x,f~[x]]: x in domain(f) | x in s}}
    SIMPLF ==> range(f ON s) = {cdr([x,f~[x]]): x in domain(f) | x in s}
    ELEM ==> Stat2: {f~[x]: x in domain(f) | x in s} /= {cdr([x,f~[x]]): x in domain(f) | x in s}
    Set_monot ==> {f~[x]: x in domain(f) | x in s} = {cdr([x,f~[x]]): x in domain(f) | x in s}
    Discharge ==> domain(f ON s) /= {x: x in domain(f) | x in s}
--
-- But the domain can be handled in much the same way as the range, and so leads us to a final
-- contradiction which completes the proof of the present theorem.
--
    Use_def(domain) ==> domain(f ON s) = {car(x): x in (f ON s)}
    EQUAL ==> domain(f ON s) = {car(x): x in {[x,f~[x]]: x in domain(f) | x in s}}
    SIMPLF ==> domain(f ON s) = {car([x,f~[x]]): x in domain(f) | x in s}
    ELEM ==> Stat3: {x: x in domain(f) | x in s} /= {car([x,f~[x]]): x in domain(f) | x in s}
    Set_monot ==> {x: x in domain(f) | x in s} = {car([x,f~[x]]): x in domain(f) | x in s}
    Discharge ==> QED
--
-- The following elementary property of f~[x] is sometimes useful.
--
Theorem 124: [Image of a non-domain element] (X notin domain(F)) imp ((F~[X]) = 0). Proof:
	Suppose_not(x,f) ==> (x notin domain(f)) & ((f~[x]) /= 0)
	Use_def(~) ==> cdr(arb(f ON {x})) /= 0
	Suppose ==> f ON {x} = 0
		EQUAL ==> cdr(arb(0)) /= 0
		0-->T0(Stat1*) ==> Stat1: (arb(0) = 0) & ((0 - {arb(0)}) = 0)
		EQUAL ==> cdr(0) /= 0
 		Use_def(cdr)(Stat1*) ==> arb(arb(arb(0 - {arb(0)}) - {arb(0)})) /= 0
	EQUAL(Stat1) ==> false; Discharge ==> f ON {x} /= 0
	Use_def(ON) ==> Stat2: {p in f | car(p) in {x}} /= 0
	Use_def(domain) ==> Stat3: x notin {car(p): p in f}
	c--> Stat2 ==> (c in f) & (car(c) in {x})
	(Stat3)ELEM ==> car(c) = x
    c-->Stat3 ==> false; Discharge ==> QED
--
-- Our next elementary lemma generalizes the preceding to a useful relationship for (f ON s1)~[x]
--
Theorem 125: [Value of a restriction map] (F ON S)~[X] = if X in domain(F ON S) then F~[X] else 0 end if. Proof:
Suppose_not(f,s,x) ==> Stat1: (f ON s)~[x] /= if x in domain(f ON s) then f~[x] else 0 end if
--??	0-->T0(Stat1*) ==> (arb(0) = 0) &  & ((0 - {arb(0)}) = 0)
	0-->T0(Stat1*) ==> (arb(0) = 0) & ((0 - {arb(0)}) = 0)
	Use_def(cdr)(Stat1*) ==> cdr(0) =  arb(arb(arb(0 - {arb(0)}) - {arb(0)}))
	EQUAL(Stat1) ==> cdr(0) = 0
	Use_def(~) ==> (f ON s)~[x] = cdr(arb((f ON s) ON {x}))
	Use_def(~) ==> f~[x] = cdr(arb(f ON {x}))
	(f,s,{x})-->T69 ==> (f ON (s * {x})) = ((f ON s) ON {x})
	EQUAL ==> Stat2: (f ON s)~[x] = cdr(arb(f ON (s * {x})))
	(f,s)-->T94 ==> Stat3: domain(f ON s) = domain(f) * s
	Suppose ==> Stat4: x notin s
		(Stat3)ELEM ==> Stat5: (s * {x} = 0) & (x notin domain(f ON s))
		(Stat5,Stat1)ELEM ==> Stat6: (f ON s)~[x] /= 0
		(Stat6,Stat2)ELEM ==> (cdr(arb(f ON (s * {x})))) /= 0
		EQUAL ==> cdr(arb(f ON 0)) /= 0
		f-->T70 ==> f ON 0 = 0
		EQUAL ==> cdr(arb(0)) /= 0
		EQUAL ==> cdr(0) /= 0
	Discharge ==> x in s
	ELEM ==> s * {x} = {x}
	EQUAL ==> cdr(arb(f ON {x})) = cdr(arb(f ON (s * {x})))
	ELEM ==> Stat7: ((f ON s)~[x]) = (f~[x])
	Suppose ==> Stat8: x notin domain(f ON s)
		ELEM ==> x notin domain(f)
		(Stat1,Stat8)ELEM ==> (f ON s)~[x] /= 0
	(x,f ON s)-->T124 ==> false; Discharge ==> Stat9: x in domain(f ON s)
    (Stat1,Stat9,Stat7)ELEM ==> false; Discharge ==> QED
--
-- The following form of theorem 123 is sometimes more convenient.
--
Theorem 126: [Single-valued map restrictions as setformers, 2] Svm(F) imp (((F ON S) = {[x,F~[x]]: x in domain(F ON S)}) &
	(range(F ON S) = {F~[x]: x in domain(F ON S)})). Proof:
	Suppose_not(f,s1) ==> AUTO
	(f,s1)-->T57 ==> Svm(f ON s1)
	(f ON s1)-->T73 ==> ((f ON s1) = {[x,(f ON s1)~[x]]: x in domain(f ON s1)}) & (range(f ON s1) = {(f ON s1)~[x]: x in domain(f ON s1)})
	ELEM ==> ({[x,f~[x]]: x in domain(f ON s1)} /= {[x,(f ON s1)~[x]]: x in domain(f ON s1)}) or ({f~[x]: x in domain(f ON s1)} /= {(f ON s1)~[x]: x in domain(f ON s1)})
 	Suppose ==> Stat1: {f~[x]: x in domain(f ON s1)} /= {(f ON s1)~[x]: x in domain(f ON s1)}
		ELEM ==> not (({f~[x]: x in domain(f ON s1)} incin {(f ON s1)~[x]: x in domain(f ON s1)}) & ({f~[x]: x in domain(f ON s1)} incs {(f ON s1)~[x]: x in domain(f ON s1)}))
		Suppose ==> Stat2: not({f~[x]: x in domain(f ON s1)} incin {(f ON s1)~[x]: x in domain(f ON s1)})
			y-->Stat2 ==> (y in domain(f ON s1)) & (((f ON s1)~[y]) /= (f~[y]))
		(f,s1,y)-->T125 ==> false; Discharge ==> Stat3: not({f~[x]: x in domain(f ON s1)} incs {(f ON s1)~[x]: x in domain(f ON s1)})
	y1-->Stat3 ==> Stat4: (y1 in domain(f ON s1)) & (((f ON s1)~[y1]) /= (f~[y1]))
	(f,s1,y1)-->T125 ==> false; Discharge ==> {[x,f~[x]]: x in domain(f ON s1)} /= {[x,(f ON s1)~[x]]: x in domain(f ON s1)}
	ELEM ==> not (({[x,f~[x]]: x in domain(f ON s1)} incin {[x,(f ON s1)~[x]]: x in domain(f ON s1)}) & ({[x,f~[x]]: x in domain(f ON s1)} incs {[x,(f ON s1)~[x]]: x in domain(f ON s1)}))
	Suppose ==> Stat5: not({[x,f~[x]]: x in domain(f ON s1)} incin {[x,(f ON s1)~[x]]: x in domain(f ON s1)})
		y2-->Stat5 ==> Stat6: (y2 in domain(f ON s1)) & (([y2,(f ON s1)~[y2]]) /= ([y2,f~[y2]]))
		EQUAL ==> (f ON s1)~[y2] /= f~[y2]
		(f,s1,y2)-->T125 ==> false; Discharge ==> {[x,f~[x]]: x in domain(f ON s1)} incin {[x,(f ON s1)~[x]]: x in domain(f ON s1)}
		ELEM ==> Stat7: not({[x,f~[x]]: x in domain(f ON s1)} incs {[x,(f ON s1)~[x]]: x in domain(f ON s1)})
	y3-->Stat7 ==> Stat8: (y3 in domain(f ON s1)) & (((f ON s1)~[y3]) /= (f~[y3]))
	EQUAL ==> (f ON s1)~[y3] /= f~[y3]
	(f,s1,y3)-->T125 ==> false; Discharge ==> QED
--
-- Our next lemma simply re-expresses the condition that a map should be 1-1
-- in terms of the element-mapping operator $f~[x]$:
--
Theorem 127: [Images under one-one maps] (one_1_map(F) & (X in domain(F)) & (Y in domain(F)) & (F~[X] = F~[Y])) imp (X = Y). Proof:
    Suppose_not(f,x,y) ==> one_1_map(f) & (x in domain(f)) & (y in domain(f)) & (f~[x] = f~[y]) & (x /= y)
--
-- For suppose the contrary, and let $f$ be a 1-1 map, with distinct elements $x$, $y$ in its domain such that
-- $f~[x] = f~[y]$. Since it is easily seen that $[x,f~[x]]$ and $[y,f~[y]]$ both belong to $f$,
-- this would violate the definition of '$one_1_map$', a contradiction which completes our proof.
--
    Use_def(one_1_map) ==> Svm(f) &
    	Stat1: (FORALL x in f, y in f | ((cdr(x) = cdr(y)) imp (x = y)))
    f-->T72 ==> f = {[x,f~[x]]: x in domain(f)}
    Suppose ==> Stat2: [x,f~[x]] notin {[x,f~[x]]: x in domain(f)}
    x-->Stat2 ==> false; Discharge ==> [x,f~[x]] in f
    Suppose ==> Stat3: [y,f~[y]] notin {[x,f~[x]]: x in domain(f)}
    y-->Stat3 ==> false; Discharge ==> [y,f~[y]] in f
    ([x,f~[x]],[y,f~[y]])-->Stat1 ==> (cdr([x,f~[x]]) = cdr([y,f~[y]])) imp (x = y)
    Discharge ==> QED
--
-- Next we show that the composition of two single-valued maps is single valued.
--
Theorem 128: [Composition of single-valued maps] (Svm(F) & Svm(G)) imp Svm(F @ G). Proof:
    Suppose_not(f,g) ==> Svm(f) & Svm(g) & (not Svm(f @ g))
--
-- For suppose the contrary. Then by definition and using Theorem 55 it follows that
-- there exist $a$, $b$ in $f @ g$ with identical first components but distinct second components:
--
    Use_def(Svm) ==> Is_map(f) & Stat1: (FORALL x in f, y in f | ((car(x) = car(y)) imp (x = y))) &
	Is_map(g) & Stat2: (FORALL x in g, y in g | ((car(x) = car(y)) imp (x = y))) &
	(not(Is_map(f @ g) & (FORALL x in (f @ g), y in (f @ g) | ((car(x) = car(y)) imp (x = y)))))
    (f,g)-->T55 ==> Is_map(f @ g)
    ELEM ==> Stat3: not(FORALL x in (f @ g), y in (f @ g)| ((car(x) = car(y)) imp (x = y)))
    (a,b)-->Stat3 ==> (a in (f @ g)) & (b in (f @ g)) & (car(a) = car(b)) & (a /= b)
--
-- Thus, by definition of map multiplication, there exist $c$, $d$, $u$, $v$, with $c$, $u$ in $g$ and $d$, $v$ in $f$,
-- satisfying the condition displayed below.
--
    Use_def(@) ==> Stat4: (a in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)}) &
									(b in {[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)})
    (c,d,u,v)-->Stat4 ==> Stat5: (c in g) & (d in f) & (a = [car(c),cdr(d)]) & (cdr(c) = car(d)) &
			(u in g) & (v in f) & (b = [car(u),cdr(v)]) & (cdr(u) = car(v)) &
					(car(a) = car(b)) & (a /= b)
--
-- But then $car(c) = car(u)$, so by Stat5 we have $car(d) = car(v)$.
--
    (Stat5*)ELEM ==> Stat6: (c in g) & (u in g) & (car(a) = car(b)) & (a = [car(c),cdr(d)])
   						& (b = [car(u),cdr(v)])
    EQUAL ==> Stat7: car([car(c),cdr(d)]) = car([car(u),cdr(v)])
    (Stat7)ELEM ==> Stat8: car(c) = car(u)
    (c,u)-->Stat2 ==> Stat9: ((c in g) & (u in g) & (car(c) = car(u))) imp (c = u)
    (Stat6,Stat9,Stat8*)ELEM ==> Stat10: c = u
    EQUAL ==> cdr(c) = cdr(u)
    (Stat5*)ELEM ==> car(d) = car(v)
--
-- It follows by Stat5 that $cdr(d) = cdr(v)$, contradicting $a /= b$ and so proving our theorem.
--
    (d,v)-->Stat1 ==> Stat11: d = v
    (Stat5*)ELEM ==> Stat12: [car(c),cdr(d)] /= [car(u),cdr(v)]
    EQUAL ==> false; Discharge ==> QED
--
-- Our next theorem gives a standard elementary formula for $(f @ g)~[x]$.
--
Theorem 129: [Images under single-valued map composition] (Svm(F) & Svm(G) & (X in domain(G)) & (range(G) incin domain(F))) imp ((F @ G)~[X] = F~[G~[X]]). Proof:
    Suppose_not(f,g,x) ==>
    Svm(f) & Svm(g) & (x in domain(g)) & (range(g) incin domain(f)) & ((f @ g)~[x] /= f~[g~[x]])
--
-- For suppose the contrary. By Theorem 77, we have $[x,g~[x]] in g$ and $[g~[x],f~[g~[x]]] in f$.
--
	Use_def(Svm) ==> Is_map(g)
	(g,x)-->T77 ==> [x,g~[x]] in g
	Suppose ==> g~[x] notin range(g)
	Use_def(range) ==> Stat1: g~[x] notin {cdr(u): u in g}
	[x,g~[x]]-->Stat1 ==> not((g~[x] = cdr([x,g~[x]])) & ([x,g~[x]] in g))
	Discharge ==> g~[x] in range(g)
	ELEM ==> g~[x] in domain(f)
	Use_def(Svm) ==> Is_map(f)
	(f,g~[x])-->T77 ==> [g~[x],f~[g~[x]]] in f
--
-- It follows that $[x,f~[g~[x]]]$ belongs to $f @ g$, and so, since $f @ g$ is single valued by
-- Theorem 128, we have $f~[g~[x]] = (f @ g)~[x]$.
--
	Suppose ==> [x,f~[g~[x]]] notin (f @ g)
	Use_def(@) ==> Stat2: [x,f~[g~[x]]] notin {[car(u),cdr(v)]: u in g, v in f | cdr(u) = car(v)}
	([x,g~[x]],[g~[x],f~[g~[x]]])-->Stat2 ==>
	Stat3: not (([x,f~[g~[x]]] = [car([x,g~[x]]),cdr([g~[x],f~[g~[x]]])])
	& (cdr([x,g~[x]]) = car([g~[x],f~[g~[x]]])) & ([x,g~[x]] in g) & ([g~[x],f~[g~[x]]] in f))
	Discharge ==> [x,f~[g~[x]]] in (f @ g)
	(f,g)-->T128 ==> Svm(f @ g)
	(f @ g,[x,f~[g~[x]]])-->T74 ==> (f @ g)~[car([x,f~[g~[x]]])] = cdr([x,f~[g~[x]]])
	ELEM ==> car([x,f~[g~[x]]]) = x
	EQUAL ==> (f @ g)~[x] = cdr([x,f~[g~[x]]])
    Discharge ==> QED
--
-- Our next result is a corollary of Theorem 129 which adds several useful clauses to it.
--
Theorem 130: [Single-valued map ranges and domains as set formers] (Svm(F) & Svm(G) & (X in domain(G)) & (range(G) incin domain(F))) imp
	(((F @ G)~[X] = F~[G~[X]]) & (F @ G = {[x,F~[G~[x]]]: x in domain(G)}) & (range(F @ G) = {F~[G~[x]]: x in domain(G)})). Proof:
    Suppose_not(f,g,x) ==> Svm(f) & Svm(g) & (x in domain(g)) & (range(g) incin domain(f)) &
    (not(((f @ g)~[x] = f~[g~[x]]) & (f @ g = {[x,f~[g~[x]]]: x in domain(g)}) & (range(f @ g) = {f~[g~[x]]: x in domain(g)})))
--
-- For suppose that our statement is false, and let $f$, $g$ be a counterexample. It follows immediately
-- from Theorem 128, Theorem 73, and Theorem 95 that the two final clauses of our assertion must be true if
-- the expression $f~[g~[x]]$ appearing in the setformers seen there are replaced by $(f @ g)~[x]$.
--
    (f,g)-->T128 ==> Svm(f @ g)
    (f @ g)-->T73 ==> (f @ g = {[x,(f @ g)~[x]]: x in domain(f @ g)}) &
    						(range(f @ g) = {(f @ g)~[x]: x in domain(f @ g)})
    (f,g)-->T95 ==> domain(f @ g) = domain(g)
    EQUAL ==> (f @ g = {[x,(f @ g)~[x]]: x in domain(g)}) & (range(f @ g) = {(f @ g)~[x]: x in domain(g)})
--
-- However, Theorem 129 lets us replace $(f @ g)~[x]$ by $f~[g~[x]]$, after which our assertion is immediate.
--
    (f,g,x)-->T129 ==> (f @ g)~[x] = f~[g~[x]]
    ELEM ==> ({[x,(f @ g)~[x]]: x in domain(g)} /= {[x,f~[g~[x]]]: x in domain(g)}) or ({(f @ g)~[x]: x in domain(g)} /= {f~[g~[x]]: x in domain(g)})
    Suppose ==> Stat1: {[x,(f @ g)~[x]]: x in domain(g)} /= {[x,f~[g~[x]]]: x in domain(g)}
    xp-->Stat1 ==> ((f @ g)~[xp] /= f~[g~[xp]]) & (xp in domain(g))
    (f,g,xp)-->T129 ==> false; Discharge ==> Stat2: {(f @ g)~[x]: x in domain(g)} /= {f~[g~[x]]: x in domain(g)}
    xq-->Stat2 ==> ((f @ g)~[xq] /= f~[g~[xq]]) & (xq in domain(g))
    (f,g,xq)-->T129 ==> false; Discharge ==> QED
--
Theorem 131: [Image under single-valued map] (Svm(F) & (G incin F) & (X in domain(G))) imp (F~[X]=G~[X]). Proof:
    Suppose_not(f,g,x) ==> Stat1: Svm(f) & (g incin f) & (x in domain(g)) & (f~[x] /= g~[x])
	Use_def(~) ==> cdr(arb(f ON {x})) /= cdr(arb(g ON {x}))
	Use_def(ON) ==> cdr(arb({q: q in f | car(q) in {x}})) /= cdr(arb({q: q in g | car(q) in {x}}))
	Use_def(domain) ==> Stat2: x in {car(p): p in g}
	q-->Stat2 ==> (q in g) & (x = car(q))
	Set_monot ==> {p: p in g | car(p) in {x}} incin {p: p in f | car(p) in {x}}
	Suppose ==> Stat3: q notin {p: p in g | car(p) in {x}}
	q-->Stat3 ==> false; Discharge ==> Stat4: (q in {p: p in g | car(p) in {x}})
	Suppose ==> Stat5: not( {p: p in g | car(p) in {x}} incs {p: p in f | car(p) in {x}} )
	y-->Stat5 ==> Stat6: (y in {p: p in f | car(p) in {x}}) & (y notin {p: p in g | car(p) in {x}})
	(p,p)-->Stat6 ==> Stat7: (p in f) & (car(p) = x) & (p notin g)
	q1-->Stat4 ==> Stat8: (q1 in g) & (car(q1) = x)
	Use_def(Svm) ==>  Stat9: (FORALL x in f, y in f | (car(x) = car(y)) imp (x = y))
	(p,q1)-->Stat9(Stat7,Stat8,Stat1) ==> false; Discharge ==> {p: p in g | car(p) in {x}} = {p: p in f | car(p) in {x}}
    Discharge ==> QED
--
-- The fact that a map $f$ and its inverse are both 1-1 if either is
-- results easily from Theorem 121.
--
Theorem 132: [Single-valued and one-one maps] Is_map(F) imp (one_1_map(F) eq one_1_map(inv(F))). Proof:
    Suppose_not(f) ==> Is_map(f) & ( not(one_1_map(f) eq one_1_map(inv(f))))
    (f)-->T121 ==> one_1_map(f) eq (Svm(f) & Svm(inv(f)))
    (inv(f))-->T121 ==> one_1_map(inv(f)) eq (Svm(inv(f)) & Svm(inv(inv(f))))
    ELEM ==> not(Svm(f) eq Svm(inv(inv(f))))
    f-->T100 ==> f = inv(inv(f))
    Suppose ==> Svm(f)
	EQUAL ==> Svm(inv(inv(f)))
    Discharge ==> Svm(inv(inv(f))) & (not Svm(f))
    EQUAL ==> Svm(f)
    Discharge ==> QED
--
 -- Theorem 121 also lets us give a purely algebraic argument to show that
 -- the product of one-to-one mappings is one-to-one.
--
Theorem 133: [Composition of one-one maps] (one_1_map(F) & one_1_map(G)) imp one_1_map(F @ G).   Proof:
    Suppose_not(f,g) ==> one_1_map(f) & one_1_map(g) & (not one_1_map(f @ g))
--
-- For suppose the contrary, in which case it follows by Theorem 121 that
-- $f$, $g$ and their inverses are single-valued, but $f @ g$ is  not.
--
	f-->T121 ==> Svm(f) & Svm(inv(f))
	g-->T121 ==> Svm(g) & Svm(inv(g))
	(f @ g)-->T121 ==> not(Svm(f @ g) & Svm(inv(f @ g)))
--
-- But Theorem 128 tells us that $f @ g$ is single-valued, and Theorem 120 allows
-- $inv(f @ g)$ to be rewritten as a product of inverses which must be single-valued,
-- proving the present theorem.
--
	(f,g)-->T128 ==> Svm(f @ g)
	Use_def(Svm) ==> Is_map(f)
	Use_def(Svm) ==> Is_map(g)
 	(f,g)-->T120 ==> inv(f @ g) = inv(g) @ inv(f)
 	(inv(g),inv(f))-->T128 ==> Svm(inv(g) @ inv(f))
    EQUAL ==> false; Discharge ==> QED
--
-- The following slight variant of the definition of 'one_1_map' is sometimes useful.
--
Theorem 134: [Elements are defined uniquely by their one-one images] Svm(F) imp (one_1_map(F) eq
	(FORALL x in domain(F), y in domain(F) | ((F~[x] = F~[y]) imp (x = y)))). Proof:
    Suppose_not(f) ==> Svm(f) & (not(one_1_map(f) eq
    		(FORALL x in domain(f), y in domain(f) | ((f~[x] = f~[y]) imp (x = y)))))
--
-- We argue by contradiction, and so suppose that $f$ is a counterexample to our theorem.
-- Since $f$ is single-valued, Theorem 72 lets us represent it by the set expression
--    				$f = {[x,f~[x]]: x in domain(f)}$.
--
	f-->T72 ==> f = {[x,f~[x]]: x in domain(f)}
--
-- We can easily show that $f$ is 1-1. For suppose the contrary.
-- Then the $fcn_symbol$ theory given previously tells us the quantified clause
-- of our theorem must be false, a contradiction which proves our claim.
--
	Suppose ==> not one_1_map(f)
	ELEM ==> Stat1: (FORALL x in domain(f), y in domain(f) | ((f~[x] = f~[y]) imp (x = y)))
	APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(f(x)->f~[x],g->f,s->domain(f)) ==>
			((x in domain(f)) & (y in domain(f)) & (f~[x] = f~[y]) & (x /= y)) or one_1_map(f)
 	ELEM ==> (x in domain(f)) & (y in domain(f)) & (f~[x] = f~[y]) & (x /= y)
 	(x,y)-->Stat1 ==> false; Discharge ==> one_1_map(f) &
 			Stat2: (not(FORALL x in domain(f), y in domain(f) | ((f~[x] = f~[y]) imp (x = y))))
--
-- But an elementary contradiction with the definition of 1-1 map follows easily
-- in this case also, so our theorem is proved.
--
  	(u,v)-->Stat2 ==> (u in domain(f)) & (v in domain(f)) & (f~[u] = f~[v]) & (u /= v)
  	Suppose ==> [u,f~[u]] notin f
  	ELEM ==> Stat3: [u,f~[u]] notin {[x,f~[x]]: x in domain(f)}
  	u-->Stat3 ==> false; Discharge ==> [u,f~[u]] in f
  	Suppose ==> [v,f~[v]] notin f
  	ELEM ==> Stat4: [v,f~[v]] notin {[x,f~[x]]: x in domain(f)}
  	v-->Stat4 ==> false; Discharge ==> [v,f~[v]] in f
  	Use_def(one_1_map) ==> Stat5: (FORALL x in f, y in f | (cdr(x) = cdr(y)) imp (x = y))
    ([u,f~[u]],[v,f~[v]])-->Stat5 ==> false; Discharge ==> QED
--
-- Next we show that a 1-1 map on a set $u$ induces a 1-1 map on the power set of $u$.
--
Theorem 135: [A 1-1 map on a set $u$ induces a 1-1 map on the power set of $u$]
    (one_1_map(F) & (S incin domain(F)) & (T incin domain(F)) & (S /= T)) imp
    			(range(F ON S) /= range(F ON T)). Proof:
    Suppose_not(f,s,t) ==> one_1_map(f) & (s incin domain(f)) & (t incin domain(f)) & Stat1: (s /= t) &
    	(range(f ON s) = range(f ON t))
    c-->Stat1 ==> ((c in s) & (c notin t)) or ((c notin s) & (c in t))
--
-- For let $f$ be 1-1, and suppose that there are distinct subsets $s$ and $t$ of its domain such that
-- $range(f ON s)$ = $range(f ON t)$. Then there is an element $c$ of $domain(f)$ which is in
-- one of $s$ and $t$ but not the other. Using the definitions of the functions involved and simplifying,
-- we can rewrite the equality $range(f ON s) = range(f ON t)$ as follows:
--
    Use_def(one_1_map) ==> Svm(f) & Stat2: (FORALL x in f, y in f | (cdr(x) = cdr(y)) imp (x = y))
    f-->T72 ==> Stat3: f = {[x,f~[x]]: x in domain(f)}
    Use_def(range) ==> Stat4: {cdr(x): x in (f ON s)} = {cdr(x): x in (f ON t)}
    Use_def(ON) ==> {cdr(x): x in {x in f | car(x) in s}} = {cdr(x): x in {x in f | car(x) in t}}
    SIMPLF ==> {cdr(x): x in f | car(x) in s} = {cdr(x): x in f | car(x) in t}
    EQUAL ==> {cdr(x): x in {[x,f~[x]]: x in domain(f)} | car(x) in s} =
	{cdr(x): x in {[x,f~[x]]: x in domain(f)} | car(x) in t}
    SIMPLF ==> {cdr([x,f~[x]]): x in domain(f) | car([x,f~[x]]) in s} =
				{cdr([x,f~[x]]): x in domain(f) | car([x,f~[x]]) in t}
--
-- Suppose for definiteness sake that $c in s$, $c notin t$. Since $f~[c]$ must be in
-- $range(f ON s) = range(f ON t)$, it must have the form $f~[d]$ where $d in t$ and so $d /= c$.
--
   	Suppose ==> Stat5: [c,f~[c]] notin {[x,f~[x]]: x in domain(f)}
    c-->Stat5 ==> false; Discharge ==> [c,f~[c]] in f
    Suppose ==> (c in s) & (c notin t)
    Suppose ==> Stat6: f~[c] notin {cdr([x,f~[x]]): x in domain(f) | car([x,f~[x]]) in s}
    c-->Stat6 ==> (f~[c] /= cdr([c,f~[c]]) or c notin domain(f) or car([c,f~[c]]) notin s)
    Discharge ==> Stat7: f~[c] in {cdr([x,f~[x]]): x in domain(f) | car([x,f~[x]]) in t}
    d-->Stat7 ==> (f~[c] = cdr([d,f~[d]])) & ((d in domain(f)) & (car([d,f~[d]]) in t))
    ELEM ==> (f~[c] = f~[d]) & ((d in domain(f)) & (d in t))
    ELEM ==> c /= d
--
--  But since $f~[c] = f~[d]$, this contradicts the fact that $f$ is 1-1, and so we must have
--  $(c notin s) & (c in t)$.
--
   	Suppose ==> Stat8: [d,f~[d]] notin {[x,f~[x]]: x in domain(f)}
    d-->Stat8 ==> false; Discharge ==> [d,f~[d]] in f
    ([c,f~[c]],[d,f~[d]])-->Stat2 ==> (cdr([c,f~[c]]) = cdr([d,f~[d]])) imp ([c,f~[c]] = [d,f~[d]])
    ELEM ==> false; Discharge ==> (c notin s) & (c in t)
--
--  However, the case $c notin s$, $c in t$ leads to an exactly similar contradiction, thus completing our proof.
--
    Suppose ==> Stat9: f~[c] notin {cdr([x,f~[x]]): x in domain(f) | car([x,f~[x]]) in t}
    c-->Stat9 ==> (f~[c] /= cdr([c,f~[c]]) or c notin domain(f) or car([c,f~[c]]) notin t)
    Discharge ==> Stat10: f~[c] in {cdr([x,f~[x]]): x in domain(f) | car([x,f~[x]]) in s}
    dd-->Stat10 ==> Stat11: (f~[c] = cdr([dd,f~[dd]])) & ((dd in domain(f)) & (car([dd,f~[dd]]) in s))
    (Stat11)ELEM ==> (f~[c] = f~[dd]) & ((dd in domain(f)) & (dd in s))
    ELEM ==> c /= dd
    Suppose ==> Stat12: [dd,f~[dd]] notin {[x,f~[x]]: x in domain(f)}
    dd-->Stat12 ==> false; Discharge ==> [dd,f~[dd]] in f
    ([c,f~[c]],[dd,f~[dd]])-->Stat2 ==> (cdr([c,f~[c]]) = cdr([dd,f~[dd]])) imp ([c,f~[c]] = [dd,f~[dd]])
    Discharge ==> QED
--
-- The two following results, both elementary consequences by set monotonicity of the definitions
-- of the functions involved, show that map composition is distributive over map union,
-- both on the left and the right.
--
Theorem 136: [Union of map composition] (F + FF) @ G = (F @ G) + (FF @ G). Proof:
Suppose_not(f,ff,g) ==> (f + ff) @ g /= (f @ g) + (ff @ g)
    Use_def(@) ==> {[car(x),cdr(y)]: x in g, y in (f + ff) | cdr(x) = car(y)} /=
	{[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)} +
	{[car(x),cdr(y)]: x in g, y in ff | cdr(x) = car(y)}
    Set_monot ==> {[car(x),cdr(y)]: x in g, y in (f + ff) | cdr(x) = car(y)} =
	{[car(x),cdr(y)]: x in g, y in f | cdr(x) = car(y)} +
	{[car(x),cdr(y)]: x in g, y in ff | cdr(x) = car(y)}
Discharge ==> QED
--
Theorem 137: [Union of map composition, 2] G @ (F + FF) = (G @ F) + (G @ FF). Proof:
    Suppose_not(g,f,ff) ==> g @ (f + ff) /= (g @ f) + (g @ ff)
    Use_def(@) ==> {[car(x),cdr(y)]: x in (f + ff), y in g | cdr(x) = car(y)} /=
	{[car(x),cdr(y)]: x in f, y in g | cdr(x) = car(y)} +
	{[car(x),cdr(y)]: x in ff, y in g | cdr(x) = car(y)}
    Set_monot ==> {[car(x),cdr(y)]: x in (f + ff), y in g | cdr(x) = car(y)} =
	{[car(x),cdr(y)]: x in f, y in g | cdr(x) = car(y)} +
	{[car(x),cdr(y)]: x in ff, y in g | cdr(x) = car(y)}
    Discharge ==> QED
--
-- The theorem that now follows tells us that a 1-1 partial inverse can be defined for
-- any single-valued map.
--
Theorem 138: [Single-valued maps have 1-1 partial inverses]
    Svm(F) imp (EXISTS h | ((domain(h) = range(F)) & (range(h) incin domain(F)) & one_1_map(h)) &
	(FORALL x in range(F) | (F~[h~[x]] = x))). Proof:
    Suppose_not(f) ==> Svm(f) &
	Stat1: (not(EXISTS h | ((domain(h) = range(f)) & (range(h) incin domain(f)) & one_1_map(h) &
	(FORALL x in range(f) | f~[h~[x]] = x))))
--
-- We will refute the contrary supposition by giving the following
-- explicit definition of the partial inverse whose existence is asserted.
--
    Loc_def ==> h = {[x,arb({car(u): u in f | cdr(u) = x})]: x in range(f)}
--
-- The 'fcn_symbol' theory tells us immediately that this $h$ is a single-valued map with
-- domain equal to $range(f)$. Thus we have only to consider the three last clauses of our theorem.
--
	APPLY(x9_thryvar:x2,y9_thryvar:y2) fcn_symbol(f(x)->arb({car(u): u in f | cdr(u) = x}),g->h,s->range(f)) ==>
		Stat2: (domain(h) = range(f)) & Svm(h) &
			Stat3: (FORALL x | h~[x] = if x in range(f) then arb({car(u): u in f | cdr(u) = x}) else 0 end if)
    			& (range(h) = {arb({car(u): u in f | cdr(u) = x}): x in range(f)}) &
    				(((x2 in range(f)) & (y2 in range(f)) &
    		(arb({car(u): u in f | cdr(u) = x2}) = arb({car(u): u in f | cdr(u) = y2})) & (x2 /= y2))
    				 or one_1_map(h))
--
-- We first show that $(FORALL x in range(f) | h~[x] in {car(u): u in f | cdr(u) = x})$,
-- from which it will follow easily that $range(h) incin domain(f)$.
-- Indeed, if we suppose the existence of an $x in range(f)$ for which
-- $h~[x] notin {car(u): u in f | cdr(u) = x}$,
-- use of the axiom of choice leads to an immediate contradiction.
--
    Suppose ==> Stat4: not(FORALL v in range(f) | arb({car(u): u in f | cdr(u) = v})
    						in {car(u): u in f | cdr(u) = v})
    v-->Stat4 ==> (v in range(f)) &
    	(not(arb({car(u): u in f | cdr(u) = v}) in {car(u): u in f | cdr(u) = v}))
    {car(u): u in f | cdr(u) = v}-->T0 ==> Stat5: {car(u): u in f | cdr(u) = v} = 0
    Use_def(range) ==> Stat6: v in {cdr(x): x in f}
    vv-->Stat6 ==> (v = cdr(vv)) & (vv in f)
    vv-->Stat5 ==> false; Discharge ==>
    	Stat7: (FORALL v in range(f) | arb({car(u): u in f | cdr(u) = v}) in {car(u): u in f | cdr(u) = v})
--
-- Next we show (by contradiction) that $range(h) incin domain(f)$.
--
 	Suppose ==> Stat8: not(range(h) incin domain(f))
 	w-->Stat8 ==> Stat9: (w in range(h)) & (w notin domain(f))
 	(Stat2,Stat9)ELEM ==> Stat10: w in {arb({car(u): u in f | cdr(u) = x}): x in range(f)}
 	ww-->Stat10 ==> (w = arb({car(u): u in f | cdr(u) = ww})) & (ww in range(f))
 	ww-->Stat7 ==> w in {car(u): u in f | cdr(u) = ww}
 	Use_def(domain) ==> w notin {car(u): u in f}
 	Set_monot ==> {car(u): u in f} incs {car(u): u in f | cdr(u) = ww}
 	Discharge ==> range(h) incin domain(f)
--
-- The fact that $h$ is 1-1 also follows readily, since by repeated use of Stat11 10
-- its negative would imply the existence of $u1$ and $u2$ in $f$ with $car(u1) = car(u2)$ but
-- $cdr(u1) /= cdr(u2)$, contradicting the single-valuedness of $f$.
--
	Suppose ==> Stat12: not one_1_map(h)
	ELEM ==> Stat13: (x2 in range(f)) & (y2 in range(f) &
	arb({car(u): u in f | cdr(u) = x2}) = arb({car(u): u in f | cdr(u) = y2})) & (x2 /= y2)
	x2-->Stat7 ==> Stat14: arb({car(u): u in f | cdr(u) = x2}) in {car(u): u in f | cdr(u) = x2}
	y2-->Stat7 ==> Stat15: arb({car(u): u in f | cdr(u) = y2}) in {car(u): u in f | cdr(u) = y2}
	u1-->Stat14 ==> Stat16: (u1 in f) & (arb({car(u): u in f | cdr(u) = x2}) = car(u1)) & (cdr(u1) = x2)
	u2-->Stat15 ==> Stat17: (u2 in f) & (arb({car(u): u in f | cdr(u) = y2}) = car(u2)) & (cdr(u2) = y2)
	(Stat13,Stat16,Stat17)ELEM ==> (u1 in f) & (u2 in f) & (car(u1) = car(u2)) & (cdr(u1) /= cdr(u2))
	(f,u1)-->T74 ==> f~[car(u1)] = cdr(u1)
	(f,u2)-->T74 ==> f~[car(u2)] = cdr(u2)
	EQUAL ==> f~[car(u1)] = f~[car(u2)]
	Discharge ==> one_1_map(h)
--
-- It only remains to show that $f~[h~[x]] = x$ for all $x in range(f)$.
-- but it is easily seen that any counterexample $t$ to this assertion
-- would have to satisfy $h~[t] = car(tt)$ where $tt in f$ and $cdr(tt) = t$,
-- and hence $f~[car(tt)] = t$, contradicting $f~[h~[t]] /= t$,
-- and so completing the proof of the present theorem.
--
	Suppose ==> Stat18: not (FORALL x in range(f) | f~[h~[x]] = x)
	t-->Stat18 ==> (t in range(f)) & (f~[h~[t]] /= t)
	t-->Stat7 ==> arb({car(u): u in f | cdr(u) = t}) in {car(u): u in f | cdr(u) = t}
	t-->Stat3 ==> Stat19: h~[t] in {car(u): u in f | cdr(u) = t}
	tt-->Stat19 ==> (h~[t] = car(tt)) & (tt in f) & (cdr(tt) = t)
	(f,tt)-->T74 ==> f~[car(tt)] = t
	EQUAL ==> f~[h~[t]] = t
	Discharge ==> (FORALL x in range(f) | f~[h~[x]] = x)
	h-->Stat1 ==> false; Discharge ==> QED
--
-- The definition of the very useful Cartesian product operator is as follows:
--
Def 17: [Cartesian Product] Def(s PROD t) := {[x,y]: x in s, y in t}
--
-- We begin our discussion of this important operator by proving the elementary fact
-- that a Cartesian product is empty if either of its factors is empty.
-- The equally easy converse of this result will be proved later.
--
Theorem 139: [Cartesian product with a null set] (N PROD 0 = 0) & (0 PROD N = 0). Proof:
    Suppose_not(n) ==> (n PROD 0 /= 0) or (0 PROD n /= 0)
--
-- For supposing the negative of either of our conclusions leads immediately
-- to an elementary contradiction:
--
    Use_def(PROD) ==> ({[x,y]: x in n, y in 0} /= 0) or ({[x,y]: x in 0, y in n} /= 0)
    Suppose ==> Stat1: {[x,y]: x in n, y in 0} /= 0
    (c,d)-->Stat1 ==> (c in n) & (d in 0)
    Discharge ==> Stat2: {[x,y]: x in 0, y in n} /= 0
    dp-->Stat2 ==> Stat3: dp in {[x,y]: x in 0, y in n}
    (x1,y1)-->Stat3 ==> (dp = [x1,y1]) & (y1 in n) & (x1 in 0)
    Discharge ==> QED
--
-- ================ Additional laws concerning Cartesian product ==========================
--
-- It is easy to show that the first component of any member of the Cartesian product $s PROD t$
-- belongs to $s$, and its second component to $t$:
--
Theorem 140: [Members of Cartesian products] (X in (S PROD T)) imp ((car(X) in S) & (cdr(X) in T)). Proof:
--
-- This follows trivially from the very definition of Cartesian product.
--
    Suppose_not(x,s,t) ==> Stat1: (x in (s PROD t)) & (not( car(x) in s & cdr(x) in t))
	Use_def(PROD) ==> Stat2: x in {[u,v]: u in s, v in t}
	(a,b)-->Stat2 ==> Stat3: (a in s) & (b in t) & (x = [a,b])
    (Stat1,Stat3)Discharge ==> QED
--
-- Next we show that every subset of a Cartesian $S PROD T$ product is a map
-- whose domain and range are included in $S$ and $T$, respectively:
--
Theorem 141: [Subsets of Cartesian products] (Y incin (S PROD T)) eq (Is_map(Y) & (domain(Y) incin S) & (range(Y) incin T)). Proof:
--
-- This follows trivially from the fact that a map is a set each
-- of whose elements $x$ is a pair $[car(x),cdr(x)]$
--
Suppose_not(y,s,t) ==> AUTO
	Suppose ==> Stat1: ((y incin (s PROD t)) & ((not Is_map(y)) or (domain(y) nincin s) or (range(y) nincin t)))
		Use_def(PROD) ==> Stat2: y incin {[u,v]: u in s, v in t}
		Suppose ==> Stat3: not(Is_map(y))
			y-->T51(Stat3*) ==> Stat4: not(FORALL x in y | x = [car(x),cdr(x)])
			c-->Stat4(Stat4*) ==> Stat5: (c in y) & (c /= [car(c),cdr(c)])
			(Stat2,Stat5*)ELEM ==> Stat6: c in {[u,v]: u in s, v in t}
			(d,e)-->Stat6(Stat6*) ==> Stat7: c=[d,e]
		(Stat5,Stat7)Discharge ==> (domain(y) nincin s) or (range(y) nincin t)
		Suppose ==> Stat8: range(y) nincin t
			Use_def(range(y)) ==> AUTO
			e0-->Stat8(Stat8*) ==> Stat9: (e0 in {cdr(w): w in y}) & (e0 notin t)
			w-->Stat9(Stat2,Stat2*) ==> Stat10: (e0 = cdr(w)) & Stat11: (w in {[u,v]: u in s, v in t})
			(u,v)-->Stat11(Stat10*) ==> (w = [u,v]) & (v in t)
		(Stat8)Discharge ==> Stat12: domain(y) nincin s
		Use_def(domain(y)) ==> AUTO
		dp-->Stat12(Stat12*) ==> Stat13: (dp in {car(z): z in y}) & (dp notin s)
		z-->Stat13(Stat13,Stat2*) ==> Stat14: (dp = car(z)) & Stat15: (z in {[u,v]: u in s, v in t})
		(up,vp)-->Stat15(Stat14*) ==> (z = [up,vp]) & (up in s)
	(Stat12)Discharge ==> Stat16: Is_map(y) & (domain(y) incin s) & (range(y) incin t) & Stat17: (y nincin (s PROD t))
	cp-->Stat17(Stat16*) ==> (cp in y) & (cp notin (s PROD t))
	Use_def(Is_map(y)) ==> AUTO
	Use_def(PROD)(Stat16*) ==> Stat18: (cp in {[car(w),cdr(w)]: w in y}) &
			Stat19: (cp notin {[u,v]: u in s, v in t})
	wp-->Stat18(Stat18*) ==> Stat20: (cp = [car(wp),cdr(wp)]) & (wp in y)
	Use_def(domain(y)) ==> AUTO
	Suppose ==> Stat21: car(wp) notin {car(w): w in y}
	wp-->Stat21(Stat20,Stat20*) ==> false; Discharge ==> car(wp) in s
	Use_def(range(y)) ==> AUTO
	Suppose ==> Stat22: cdr(wp) notin {cdr(w): w in y}
	wp-->Stat22(Stat20,Stat20*) ==> false; Discharge ==> cdr(wp) in t
	(car(wp),cdr(wp))-->Stat19(Stat18*) ==> false; Discharge ==> QED
--
--
--
Theorem 142: [Image of Cartesian product by a singleton] (U in Z) imp (((Z PROD {V})~[U]) = V). Proof:
Suppose_not(u,z,v) ==> AUTO
	Use_def(PROD) ==> (z PROD {v}) = {[w,t]: w in z, t in {v}}
	SIMPLF ==> (z PROD {v}) = {[w,v]: w in z}
	APPLY() fcn_symbol(f(w)->v,g->(z PROD {v}),s->z) ==>
		Stat1: (FORALL w | (w in z) imp (((z PROD {v})~[w]) = v))
	u-->Stat1 ==> false; Discharge ==> QED
--
-- =======================================================================================
--
-- Our next result states another elementary property of the Cartesian product:
-- two such products are disjoint if their second factors are disjoint.
-- (The reader will readily perceive that the same is true for two Cartesian products
-- whose first factors are disjoint).
--
Theorem 143: [Cartesian product disjointness] (A * B = 0) imp ((X PROD A) * (Y PROD B) = 0). Proof:
    Suppose_not(a,b,xx,yy) ==> (a * b = 0) & Stat1: ((xx PROD a) * (yy PROD b) /= 0)
    c-->Stat1 ==> (c in (xx PROD a)) & (c in (yy PROD b))
    Use_def(PROD) ==> Stat2: (c in {[u,v]: u in xx, v in a}) & (c in {[u,v]: u in yy, v in b})
    (a1,b1,a2,b2)-->Stat2 ==> (c = [a1,b1]) & (a1 in xx) & (b1 in a) & (c = [a2,b2]) & (a2 in yy) & (b2 in b)
    Discharge ==> QED
--
-- The following theorem shows that even though the Cartesian product operator
-- is not associative, there always exists a natural 1-1 correspondence between
-- $((A PROD B) PROD C)$ and $(A PROD (B PROD C))$.
--
Theorem 144: [Cartesian modified associativity] (F = {[[[x,y],z],[x,[y,z]]]: x in A, y in B, z in C}) imp
	(one_1_map(F) & (domain(F) = ((A PROD B) PROD C)) & (range(F) = (A PROD (B PROD C)))). Proof:
    Suppose_not(f,a,b,c) ==> (f = {[[[x,y],z],[x,[y,z]]]: x in a, y in b, z in c}) &
	((not one_1_map(f)) or (domain(f) /= ((a PROD b) PROD c)) or
				(range(f) /= (a PROD (b PROD c))))
--
-- For suppose the contrary. Since we can apply one_1_test_3 to show that $f$ must be 1-1,
-- only the theorem clauses concerning the range and domain of f can be false.
--
    Suppose ==> not one_1_map(f)
        EQUAL ==> not one_1_map({[[[x,y],z],[x,[y,z]]]: x in a, y in b, z in c | true})
	Discharge ==> one_1_map(f)
--
-- Next suppose that the clause concerning $domain(f)$ is false.
-- Using the definitions of the operators involved we find that
-- there must exist elements x,y,u satisfying the impossible inequality seen below,
-- a contradiction leaving only the case $range(f) /= (a PROD (b PROD c))$ to be considered.
--
    Suppose ==> domain(f) /= ((a PROD b) PROD c)
    Use_def(domain) ==> {car(x): x in f} /= ((a PROD b) PROD c)
    EQUAL ==> {car(x): x in {[[[x,y],z],[x,[y,z]]]: x in a, y in b, z in c}} /= ((a PROD b) PROD c)
    SIMPLF ==> {car([[[x,y],z],[x,[y,z]]]): x in a, y in b, z in c} /= ((a PROD b) PROD c)
    Use_def(PROD) ==> {car([[[x,y],z],[x,[y,z]]]): x in a, y in b, z in c} /=
	{[u,z]: u in {[x,y]: x in a, y in b}, z in c}
    SIMPLF ==> Stat1: {car([[[x,y],z],[x,[y,z]]]): x in a, y in b, z in c} /=
    		{[[x,y],z]: x in a, y in b, z in c}
	(x,y,u)-->Stat1 ==> Stat2: car([[[x,y],u],[x,[y,u]]]) /= [[x,y],u]
    (Stat2)Discharge ==> range(f) /= (a PROD (b PROD c))
--
-- Expanding this last case using the definitions of the operators involved we see just as easily
-- that it leads to an impossible elementary inequality,
-- a final contradiction which completes the proof of our theorem.
--
    Use_def(range) ==> {cdr(x): x in f} /= (a PROD (b PROD c))
    EQUAL ==> {cdr(x): x in {[[[x,y],z],[x,[y,z]]]: x in a, y in b, z in c}} /= (a PROD (b PROD c))
    SIMPLF ==> {cdr([[[x,y],z],[x,[y,z]]]): x in a, y in b, z in c} /= (a PROD (b PROD c))
    Use_def(PROD) ==> {cdr([[[x,y],z],[x,[y,z]]]): x in a, y in b, z in c} /=
	{[x,v]: x in a, v in {[y,z]: y in b, z in c}}
    SIMPLF ==> Stat3: {cdr([[[x,y],z],[x,[y,z]]]): x in a, y in b, z in c} /=
    		{[x,[y,z]]: x in a, y in b, z in c}
	(xx,yy,uu)-->Stat3 ==> Stat4: cdr([[[xx,yy],uu],[xx,[yy,uu]]]) /= [xx,[yy,uu]]
    (Stat4)Discharge ==> QED
--
-- Moreover, even though the Cartesian product operator
-- is not commutative, there always exists a natural 1-1 correspondence between
-- $A PROD B$ and $B PROD A$.
--
Theorem 145: [Cartesian modified commutativity] (F = {[[x,y],[y,x]]: x in A, y in B}) imp
			(one_1_map(F) & (domain(F) = (A PROD B)) & (range(F) = (B PROD A))). Proof:
    Suppose_not(f,a,b) ==> (f = {[[x,y],[y,x]]: x in a, y in b}) &
   			((not one_1_map(f)) or domain(f) /= (a PROD b) or range(f) /= (b PROD a))
--
-- For suppose the contrary. Since we can apply $one_1_test_2$ to show that $f$ must be 1-1,
-- only the theorem clauses concerning the range and domain of $f$ can be false.
--
    Suppose ==> not one_1_map(f)
	APPLY(x6_thryvar:x,y6_thryvar:y,x2_thryvar:xx,y2_thryvar:yy) one_1_test_2(a2(x,y)->[x,y],b2(x,y)->[y,x],s->a,t->b) ==>
		not(([x,y] = [xx,yy]) eq ([y,x] = [yy,xx])) or one_1_map({[[x,y],[y,x]]: x in a, y in b})
	EQUAL ==> Stat1: not(([x,y] = [xx,yy]) eq ([y,x] = [yy,xx]))
	(Stat1)Discharge ==> one_1_map(f)
--
-- Next suppose that the clause concerning $domain(f)$ is false.
-- Using the definitions of the operators involved we find that
-- there must exist elements $x,y,u$ satisfying the impossible inequality seen below,
-- a contradiction leaving only the case $range(f) /= (a PROD (b PROD c))$ to be considered.
--
    Suppose ==> domain(f) /= (a PROD b)
    Use_def(domain) ==> {car(x): x in f} /= (a PROD b)
    EQUAL ==> {car(u): u in {[[x,y],[y,x]]: x in a, y in b}} /= (a PROD b)
    SIMPLF ==> {car([[x,y],[y,x]]): x in a, y in b} /= (a PROD b)
    Use_def(PROD) ==> Stat2: {car([[x,y],[y,x]]): x in a, y in b} /= {[x,y]: x in a, y in b}
    (xp,yp)-->Stat2 ==> Stat3: car([[xp,yp],[yp,xp]]) /= [xp,yp]
    (Stat3)Discharge ==> range(f) /= (b PROD a)
--
-- Expanding this last case using the definitions of the operators involved,
-- we see just as easily that it leads to an impossible elementary inequality,
-- a final contradiction which completes the proof of our theorem.
--
    Use_def(range) ==> {cdr(x): x in f} /= (b PROD a)
    EQUAL ==> {cdr(u): u in {[[x,y],[y,x]]: x in a, y in b}} /= (b PROD a)
    SIMPLF ==> {cdr([[x,y],[y,x]]): x in a, y in b} /= (b PROD a)
    Use_def(PROD) ==> {cdr([[x,y],[y,x]]): x in a, y in b} /= {[x,y]: x in b, y in a}
    Suppose ==> Stat4: {[x,y]: x in b, y in a} /= {[y,x]: x in a, y in b}
    c-->Stat4 ==> Stat5: ((c in {[x,y]: x in b, y in a}) & (c notin {[y,x]: x in a, y in b})) or
    				((c notin {[x,y]: x in b, y in a}) & (c in {[y,x]: x in a, y in b}))
    Suppose ==> Stat6: (c in {[x,y]: x in b, y in a}) & (c notin {[y,x]: x in a, y in b})
    (x1,y1,y1,x1)-->Stat6 ==> Stat7: (x1 in b) & (y1 in a) & (c = [x1,y1]) &
    					(not((y1 in a) & (x1 in b) & (c = [x1,y1])))
    (Stat7)Discharge ==> Stat8: (c in {[y,x]: x in a, y in b}) &
    										(c notin {[x,y]: x in b, y in a})
    (x2,y2,y2,x2)-->Stat8 ==> Stat9: (x2 in a) & (y2 in b) & (c = [y2,x2]) &
    					(not((x2 in a) & (y2 in b) & (c = [y2,x2])))
    (Stat9)Discharge ==>
    	Stat10: {cdr([[x,y],[y,x]]): x in a, y in b} /= {[y,x]: x in a, y in b}
    (x3,y3)-->Stat10 ==> Stat11: cdr([[x3,y3],[y3,x3]]) /= [y3,x3]
    (Stat11)Discharge ==> QED
--
-- The preceding preliminaries now being completed, we return to
-- a more serious discussion of results on cardinality.
-- Our first, preparatory result states that the restriction of the previously introduced
-- enumerating function $enum(x,s)$ to any ordinal $s$ is the identity function on $s$.
--
Theorem 146: [Enumeration of an ordinal] (Ord(S) & X in S) imp (enum(X,S) = X). Proof:
    Suppose_not(s,a) ==> Ord(s) & (a in s) & (enum(a,s) /= a)
--
-- For, supposing the contrary, there would necessarily exist a minimal ordinal
-- $b in s$ such that $enum(b,s) /= b$.
--
    APPLY(mt1_thryvar:b) transfinite_induction (n->a,P(x)->(x in s) & (enum(x,s) /= x)) ==>
		Stat1: (FORALL x | ((b in s) & (enum(b,s) /= b)) & (((x in b) imp (not ((x in s) & (enum(x,s) /= x))))))
	a0-->Stat1 ==> Stat2: (b in s) & (enum(b,s) /= b)
    (s,b)-->T13 ==> Stat3: b incin s
    Use_def(enum) ==> Stat4: enum(b,s) = if (s incin {enum(y,s): y in b}) then s else arb(s - {enum(y,s): y in b}) end if
--
-- But we can show that such a $b$ must satisfy ${enum(y,s): y in b} = b$.
-- Indeed, supposing the contrary, there would exist a $c$
-- which was in one of these sets but not the other.
-- Suppose first that $c notin b$, so that $c$ must be of the form $enum(d,s)$ where $d in b$,
-- and so $d in s$ since the ordinal $s$ includes each of its members.
--
    Suppose ==> Stat5: {enum(y,s): y in b} /= b
    c-->Stat5 ==> ((c in {enum(y,s): y in b}) & (c notin b)) or ((c notin {enum(y,s): y in b}) & (c in b))
    Suppose ==> Stat6: (c in {enum(y,s): y in b}) & (c notin b)
    d-->Stat6 ==> (c = enum(d,s)) & (d in b)
    ELEM ==> d in s
--
-- However the minimality of $b$ then implies that $enum(d,s) = d$, and so $d = c$
-- which is impossible since $c notin b$. This contradiction  proves that
-- we need only consider the second of our two original cases, that in which
-- $c$ belongs to $b$ and $c /= enum(c,s)$.
--
    d-->Stat1 ==> enum(d,s) = d
    Discharge ==> Stat7: (c notin {enum(y,s): y in b}) & (c in b)
    c-->Stat7 ==> not((c in b) & (c = enum(c,s)))
    ELEM ==> c /= enum(c,s)
--
-- However in this case Stat8 0 leads immediately to the contradiction $c notin s$,
-- completing the proof of our claim ${enum(y,s): y in b} = b$.
-- Therefore since $b in s$ and so $not(b incs s) and s - b /= 0$, the
-- previously cited definition of '$enum$' tells us that $enum(b,s) = arb(s - b)$,
-- and so using the axiom of choice we must have $arb(s - b) in s - b$, which implies
-- $arb(s - b) in s$.
--
    c-->Stat1 ==> c notin s
    Discharge ==> Stat8: {enum(y,s): y in b} = b
    (Stat2,Stat4,Stat8*)ELEM ==> Stat9: (enum(b,s) = arb(s - {enum(y,s): y in b})) & (not(s incin b))
    EQUAL(Stat8) ==> enum(b,s) = arb(s - b)
    (s - b)-->T0(Stat3,Stat9) ==> Stat10: (arb(s - b) in s - b) & (arb(s - b) * (s - b) = 0)
    (Stat10*)ELEM ==> Stat11: (arb(s - b) in s - b) & (arb(s - b) * (s - b) = 0) & (arb(s - b) in s)
--
-- But since $s$ is an ordinal, its elements $b$ and $arb(s - b)$ are ordered by membership,
-- and since $arb(s - b) in (s - b)$ we must have $b in arb(s - b)$ and hence $b notin s - b$
-- implying $b in b$, which is impossible.
--
    Use_def(Ord) ==> Stat12: (FORALL x in s, y in s | ((x in y) or (y in x) or (x = y)))
    (b,arb(s - b))-->Stat12(Stat2*) ==> Stat13: (b in arb(s - b)) or (arb(s - b) = b)
    (Stat8,Stat2,Stat9,Stat13*)Discharge ==> QED

--
-- Next we prove various key properties of the cardinality $#s$ of a set $s$,
-- showing first that $#s$ is the smallest ordinal in 1-1 correspondence with $s$.
--
Theorem 147: [Cardinality lemma] Ord(#S) & (EXISTS f in OM | (one_1_map(f) & (range(f) = S) & (domain(f) = #S))) &
	(not((EXISTS o in #S | (EXISTS g in OM | one_1_map(g) & (range(g) = S) & (domain(g) = o))))). Proof:
--
-- We proceed by contradiction. Let $s$ be a counterexample to our theorem, and first suppose that
-- either $#s$ is not an ordinal, or that there is no $f$ which puts $s$ into 1-1 correspondence
-- with $#s$. But then consider the specific $f$ defined as $f = {[x,enum(x,s)]: x in enum_Ord(s)}$.
--
    Suppose_not(s) ==> (not Ord(#s)) or (not(EXISTS f in OM | (one_1_map(f) & (range(f) = s) & (domain(f) = #s)))) or
	(EXISTS o in #s | (EXISTS g in OM | one_1_map(g) & (range(g) = s) & (domain(g) = o)))
    Use_def(#) ==> #s = arb({x: x in next(enum_Ord(s)) | (EXISTS f in OM | (one_1_map(f) & (domain(f) = x) & (range(f) = s)))})
	T47 ==> Stat1: (FORALL s | Ord(enum_Ord(s)) & (s = {enum(y,s): y in enum_Ord(s)}) &
		(FORALL y in enum_Ord(s), z in enum_Ord(s) | ((y /= z) imp (enum(y,s) /= enum(z,s)))))
    s-->Stat1 ==> Ord(enum_Ord(s)) & (s = {enum(y,s): y in enum_Ord(s)})
    (enum_Ord(s))-->T32 ==> Ord(next(enum_Ord(s)))
    Use_def(Ord) ==> Stat2: (FORALL x in next(enum_Ord(s)) | x incin next(enum_Ord(s)))
    Suppose ==> (not Ord(#s)) or (not(EXISTS f in OM | (one_1_map(f) & (domain(f) = #s) & (range(f) = s))))
    Loc_def ==> s1 = s
    Loc_def ==> f = {[x,enum(x,s1)]: x in enum_Ord(s1)}
--
-- Our general '$fcn_symbol$' theory tells us that this has $enum_Ord(s)$ as range,
-- and it is easily seen, using the definition of '$enum_Ord$' that it has domain $s$.
--
    APPLY(x9_thryvar:y,y9_thryvar:wz) fcn_symbol(f(x)->enum(x,s1),g->f,s->enum_Ord(s1)) ==>
		Svm(f) & (domain(f) = enum_Ord(s1)) & (range(f) = {enum(x,s1): x in enum_Ord(s1)}) &
			(((y in enum_Ord(s1)) & (wz in enum_Ord(s1)) &
						((enum(y,s1) = enum(wz,s1)) & (y /= wz))) or one_1_map(f))
	EQUAL ==>  Svm(f) & (domain(f) = enum_Ord(s)) & (range(f) = {enum(x,s): x in enum_Ord(s)}) &
			Stat3: (((y in enum_Ord(s)) & (wz in enum_Ord(s)) &
						((enum(y,s) = enum(wz,s)) & (y /= wz))) or one_1_map(f))
    ELEM ==> Svm(f) & (domain(f) = enum_Ord(s)) & (range(f) = s)
--
-- Next suppose that $f$ is not 1-1. Then, by Stat4 3, there would exist two distinct elements
-- $y$ and $wz$ of $enum_Ord(s)$ such that $enum(y,s) = enum(wz,s)$, which is impossible
-- by the definition of $enum_Ord$.
--
    Suppose ==> not one_1_map(f)
    ELEM ==> (y in enum_Ord(s)) & (wz in enum_Ord(s)) & (enum(y,s) = enum(wz,s)) & (y /= wz)
    s-->Stat1 ==> Stat5: (FORALL y in enum_Ord(s), z in enum_Ord(s) |
    								 (y /= z) imp (enum(y,s) /= enum(z,s)))
    (y,wz)-->Stat5 ==> ((y in enum_Ord(s)) & (wz in enum_Ord(s)) &
    						(y /= wz)) imp (enum(y,s) /= enum(wz,s))
    Discharge ==> one_1_map(f)
--
-- We know at this point that there is a 1-1 mapping $f$ between $s$ and some ordinal;
-- hence there is a least ordinal which can be mapped to $f$ in 1-1 fashion.
--
    Use_def(next) ==> next(enum_Ord(s)) = enum_Ord(s) + {enum_Ord(s)}
    Suppose ==>
	Stat6: enum_Ord(s) notin {x: x in next(enum_Ord(s)) | (EXISTS f in OM | (one_1_map(f) & (domain(f) = x) & (range(f) = s)))}
    (enum_Ord(s))-->Stat6 ==> (not ((enum_Ord(s) in next(enum_Ord(s))) &
	(EXISTS f in OM | (one_1_map(f) & (domain(f) = enum_Ord(s)) & (range(f) = s)))))
    ELEM ==> Stat7: not (EXISTS f in OM | (one_1_map(f) & (domain(f) = enum_Ord(s)) & (range(f) = s)))
    f-->Stat7 ==> false; Discharge ==>
    Stat8: enum_Ord(s) in {x: x in next(enum_Ord(s)) | (EXISTS f in OM | (one_1_map(f) & (domain(f) = x) & (range(f) = s)))}
   (Stat8)ELEM ==> {x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff)) & (domain(ff) = x) & (range(ff) = s))} /= 0
    {x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))}-->T0 ==>
	Stat9: (arb({x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))}) in
	{x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))}) &
	(arb({x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))}) *
	{x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))} = 0)
--
-- By definition, this least ordinal is the cardinality $#s$ of s, and so $#s$ is an ordinal,
-- and is in 1-1 correspondence with $s$. Therefore our theorem can only be false if
-- some smaller ordinal $o$ is also in 1-1 correspondence with $s$.
--
    ELEM ==> #s = arb({x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))})
    (Stat9*)ELEM ==> Stat10: (#s in {x: x in next(enum_Ord(s)) |
    				(EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))}) &
	 (#s * {x: x in next(enum_Ord(s)) |
	 		(EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))} = 0)
    x1-->Stat10 ==> (#s = x1) & (#s in next(enum_Ord(s))) &
    				(EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x1) & (range(ff) = s)))
    EQUAL ==> (EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = #s) & (range(ff) = s)))
    (next(enum_Ord(s)),#s)-->T12 ==> false;
    Discharge ==> Stat11: (EXISTS o in #s | (EXISTS g in OM | (one_1_map(g) & (range(g) = s)
    				 & (domain(g) = o))))
    o-->Stat11 ==> Stat12: (o in #s) & (EXISTS g in OM | (one_1_map(g) & (domain(g) = o) &
    			(range(g) = s)))
--
-- But by definition $#s$ is the least ordinal in 1-1 correspondence with $s$,
-- a final contradiction which completes the proof of the present theorem.
--
	ELEM ==> Stat13: (#s in {x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) &
	(domain(ff) = x) & (range(ff) = s)))}) &
	 (#s * {x: x in next(enum_Ord(s)) |
	 	(EXISTS ff in OM | (one_1_map(ff) & (domain(ff) = x) & (range(ff) = s)))} = 0)
    ELEM ==> Stat14: o notin {x: x in next(enum_Ord(s)) | (EXISTS ff in OM | (one_1_map(ff) &
    			(domain(ff) = x) & (range(ff) = s)))}
    o-->Stat14 ==> o notin next(enum_Ord(s))
    x2-->Stat13 ==> #s in next(enum_Ord(s))
    (#s)-->Stat2 ==> false; Discharge ==> QED
--
-- Using Theorem 147 it is easy to prove that no set $s$ can be a member of its own cardinality.
--
Theorem 148: [Cardinality minimum theorem] S notin #S. Proof:
	Suppose_not(s) ==> s in #s
	s-->T147 ==> Stat1: not((EXISTS o in #s | (EXISTS g in OM | one_1_map(g) & (range(g) = s) & (domain(g) = o))))
	s-->Stat1 ==> Stat2: not(EXISTS g in OM | one_1_map(g) & (range(g) = s) & (domain(g) = s))
	s-->T115 ==> one_1_map(ident(s)) & (domain(ident(s)) = s) & (range(ident(s)) = s)
	(ident(s))-->Stat2 ==> false; Discharge ==> QED
--
-- The following theorem states  a special property of the choice operator
-- '$arb$' which is sometimes useful.
--
Theorem 149: ['arb' is monotone decreasing for non-empty sets of ordinals]
    (Ord(R) & (R incs S) & (S incs T)) imp (arb(S) in arb(T) or arb(S) = arb(T) or T = 0). Proof+:
    Suppose_not(o,s,t) ==> Ord(o) & (o incs s) & (s incs t) &
    	(arb(s) notin arb(t)) & (arb(s) /= arb(t)) & (t /= 0)
--
-- For consider a nonempty subset $t$ of a set $s$ of ordinals.
-- Since $arb(t)$ is a member of $t$ and hence of $s$,
-- it cannot be a member of $arb(s)$. Thus, since both $arb(t)$ and $arb(s)$ must be
-- ordinals, our claim follows immediately from Theorem 31.
--
    s-->T0 ==> ((arb(s) in s) & (arb(s) * s = 0))
    t-->T0 ==> arb(t) in t
    (arb(s),arb(t))-->T31 ==> arb(t) in arb(s) * s
    Discharge ==> QED
--
-- Our next theorem, closely related to the preceding, tells us that '$arb$' selects the minimum
-- element of any set of ordinals.
--
Theorem 150: [Axiom of choice variant] ((S /= 0) & (FORALL x in S | Ord(x))) imp (FORALL x in S | x incs arb(S)). Proof:
    Suppose_not(s) ==> (s /= 0) & Stat1: (FORALL x in s | Ord(x)) &
    						Stat2: (not((FORALL x in s | x incs arb(s))))
--
-- For otherwise there is a non-null set $s$ of ordinals with a member $x$ not including $arb(s)$.
-- But by the axiom of choice, $x$ cannot be a member of $arb(s)$, and so by Theorem 31
-- $s$ must be a member, and hence a subset, of $x$, contradicting the definition of $x$,
-- and so proving our theorem.
--
    x-->Stat2 ==> (x in s) & (not(x incs arb(s)))
    x-->Stat1 ==> Ord(x)
    s-->T0 ==> (arb(s) in s) & (x notin arb(s))
    (arb(s))-->Stat1 ==> Ord(arb(s))
    (arb(s),x)-->T31 ==> arb(s) in x
    (x,arb(s))-->T34 ==> false; Discharge ==> QED
--
-- Our next aim is to prove that the cardinality of any subset $t$ of a set $s$ is
-- no more than the cardinality of $s$, This will be established by showing that
-- the enumerating ordinal of $t$ is no larger than that of $s$.
-- We prepare for this by showing that if $t$ is a subset of an ordinal $s$,
-- then the function $enum(x,t)$ is nondecreasing in the variable $x$.
--
Theorem 151: [Lemma for ordinal enumeration]
	(Ord(S) & (T incin S) & (X in S) & (Y in X)) imp (enum(Y,T) in enum(X,T) or enum(X,T) incs T). Proof+:
Suppose_not(s,t,x,y2) ==>
	Stat1: Ord(s) & (t incin s) & (x in s) & (y2 in x) & (enum(y2,t) notin enum(x,t)) & (not(enum(x,t) incs t))
--
-- For suppose the contrary. Then $enum(x,t)$ cannot be $t$, so by definition of '$enum$'
-- it must be a member of $t$, hence of $s$, hence an ordinal. Likewise $x$ must be an ordinal,
-- and so $y2$ must also be an ordinal. Moreover $t - {enum(u,t): u in x}$ must be nonempty.
--
	Use_def(enum) ==> enum(x,t) = if t incin {enum(u,t): u in x} then t else arb(t - {enum(u,t): u in x}) end if
	ELEM ==> Stat2: ((t - {enum(u,t): u in x}) /= 0) & (enum(x,t) = arb(t - {enum(u,t): u in x}))
	(t - {enum(u,t): u in x})-->T0(*) ==> (enum(x,t) in t - {enum(u,t): u in x}) & (enum(x,t) in s)
--
-- Thus $y2$ must be a subset of $x$, and so it follows by the principle of set monotonicity
-- that ${enum(u,t): u in y2} incin {enum(u,t): u in x}$. But then $t - {enum(u,t): u in y2}$ must be nonempty,
-- and so, by definition of '$enum$', $enum(y2,t) = arb(t - {enum(u,t): u in y2})$
--
	(x,y2)-->T13(Stat1,Stat1*) ==> y2 incin x
	EQUAL ==> Stat3: Ord(enum(x,t)) & Ord(x) & Ord(y2)
	Set_monot ==> Stat4: {enum(u,t): u in y2} incin {enum(u,t): u in x}
	Use_def(enum(y2,t)) ==> AUTO
	(Stat2,Stat4*)ELEM ==> Stat5: (t - {enum(u,t): u in y2} incs t - {enum(u,t): u in x}) & (t - {enum(u,t): u in y2} /= 0)
	(Stat4*)ELEM ==> Stat6: ((t - {enum(u,t): u in y2}) /= 0) & (enum(y2,t) = arb(t - {enum(u,t): u in y2}))
--
-- Thus, since we have seen that $t - {enum(u,t): u in y2} incs t - {enum(u,t): u in x}$,
-- it follows by Theorem 149 that $enum(y2,t)$ is no larger than $enum(x,t)$, so it must equal $enum(x,t)$.
-- But since $y2$ is in $x$ this is easily seen to be impossible, and so we have a contradiction
-- which proves our theorem.
--
	(s, t - {enum(u,t): u in y2},t - {enum(u,t): u in x})-->T149(Stat1,Stat2,Stat5,Stat6*) ==>
			Stat9: enum(y2,t) = enum(x,t)
	t-->T46(Stat10*) ==> Stat10: (EXISTS u | (Ord(u) & (t = {enum(y2,t): y2 in u})) &
							(FORALL y in u, wz in u | (y /= wz) imp (enum(y,t) /= enum(wz,t))))
	u-->Stat10(Stat10*) ==> Stat11: (FORALL y in u, wz in u | (y /= wz) imp (enum(y,t) /= enum(wz,t))) & Ord(u) & (t = {enum(y,t): y in u})
 	Suppose ==> y2 notin u
		(u,y2)-->T35(Stat3*) ==> u incin y2
		Set_monot ==> {enum(v,t): v in u} incin {enum(v,t): v in y2}
 	Discharge ==> Stat12: y2 in u
	Suppose ==> x notin u
		(u,x)-->T35(Stat3*) ==> u incin x
		Set_monot ==> {enum(v,t): v in u} incin {enum(v,t): v in x}
 	 Discharge ==> Stat13: x in u
	(x,y2)-->Stat11(Stat1,Stat12,Stat13,Stat9*) ==> false; Discharge ==> QED
--
-- We continue the sequence of steps which will lead us to a proof that the cardinality
-- of a subset of a set $s$ is no greater than $#s$. Our plan is to prove this first for ordinals
-- and then to generalize to arbitrary sets, using the fact that any set is in 1-1
-- correspondence with an ordinal. The following lemma states a related fact about
-- the standard enumeration of ordinals.
--
Theorem 152: [Subsets of an ordinal enumerate at least as rapidly as the ordinal]
	(Ord(S) & (T incin S) & (X in S)) imp (enum(X,T) incs X or enum(X,T) incs T). Proof+:
    Suppose_not(s,t,b) ==> Stat0: Ord(s) & (t incin s) & (b in s) & (not ((enum(b,t) incs b) or (enum(b,t) incs t)))
--
-- For suppose the contrary, so that there is an ordinal $s$ with a subset $t$ for which there exists a $b in s$
-- such that $enum(b,t)$ fails to include $b$ and is not $t$. By the principle of transfinite induction, there
-- exists a least such element of $s$, which we call $a$.
--
    APPLY(mt1_thryvar:a) transfinite_induction (n->b,P(x)->((x in s) & (not((enum(x,t) incs x) or (enum(x,t) incs t))))) ==>
		Stat1: (FORALL x | ((a in s) & (not((enum(a,t) incs a) or (enum(a,t) incs t)))) &
			((x in a) imp (not((x in s) & (not((enum(x,t) incs x) or (enum(x,t) incs t)))))))
	a0-->Stat1(Stat1*) ==> (a in s) & (not (enum(a,t) incs a)) & (not (enum(a,t) incs t))
--
-- It follows by definition of '$enum$' that $t$ cannot be a subset of ${enum(u,t): u in a}$, and that
-- $enum(a,t)$ is a member of $t - {enum(y,t): y in a}$
--
    Use_def(enum(a,t)) ==> AUTO
    (Stat0*)ELEM ==> ((t - {enum(y,t): y in a}) /= 0) & (enum(a,t) = arb(t - {enum(y,t): y in a}))
    (t - {enum(y,t): y in a})-->T0(Stat1*) ==> enum(a,t) in t - {enum(y,t): y in a}
--
-- Since $a$ is a member of $s$, it must be an ordinal and a subset of $s$.
-- Since $enum(a,t)$ belongs to $t$ it belongs to $s$, and so it is also an ordinal.
-- Since $enum(a,t)$ is not larger than $a$, it must be a member of $a$, so Theorem 151 tells us that
-- $enum(enum(a,t),t)$ is a member, and hence a subset, of $enum(a,t)$.
--
    (s,a)-->T34(Stat0*) ==> (a incin s) & (enum(a,t) in s)
    (a,enum(a,t))-->T35(Stat0*) ==> enum(a,t) in a
    (s,t,a,enum(a,t))-->T151(Stat0*) ==> enum(enum(a,t),t) in enum(a,t)
--
-- Since $enum(a,t)$ is a member of $t$, $enum(enum(a,t),t)$ cannot include $t$ since if it did we would have
-- the membership cycle $enum(a,t)$ $in$ $enum(enum(a,t),t)$ $in$ $enum(a,t)$.
-- Applying Stat2 1 we therefore find that $enum(enum(a,t),t) incs enum(a,t)$,
-- and hence the same impossible membership cycle, a contradiction which proves our theorem.
--
    (enum(a,t))-->Stat1(Stat1*) ==> ((not (enum(a,t) in s)) or enum(enum(a,t),t) incs enum(a,t) or enum(enum(a,t),t) incs t)
    Discharge ==> QED
--
-- It follows from the preceding theorem that ${enum(x,t): x in s} incs t$ for every subset
-- $t$ of an ordinal $s$
--
Theorem 153: [Subset enumeration lemma] (Ord(S) & (T incin S)) imp ({enum(x,T): x in S} incs T). Proof+:
Suppose_not(s,t) ==> AUTO
--
-- For suppose the contrary. Since by definition $s$ is both a member and a subset of $next(s)$,
-- and since $next(s)$ is an ordinal by Theorem 32, it follows by the previous theorem that
-- $enum(s,t) incs t$
--
	Loc_def ==> s1 = next(s)
	Use_def(next(s)) ==> AUTO
	(s1,t,s)-->T152(*) ==> enum(s,t) incs t
--
-- But since by assumption $t - {enum(y,t): y in s}$ is not empty, it follows by definition of '$enum$'
-- and by the axiom of choice that $enum(s,t)$ is a member of $t$, and hence a member of itself,
-- a contradiction which proves our theorem.
--
	Use_def(enum(s,t)) ==> AUTO
	Discharge ==> QED
--
-- Next we show that if $t$ is a subset of an ordinal $s$, there is an ordinal $x$ no larger than $s$
-- which 'enum' puts into 1-1 correspondence with $t$.
--
Theorem 154: [Second subset enumeration lemma] (Ord(S) & (T incin S)) imp (EXISTS x incin S | (Ord(x) & (T = {enum(y,T): y in x}) &
	(FORALL y in x, z in x | ((y /= z) imp (enum(y,T) /= enum(z,T)))))). Proof+:
Suppose_not(s,t) ==> AUTO
--
-- Suppose the contrary: that the map $enum(.,t)$ does not put $t$ in 1-1 correspondence with
-- the set ${enum(y,t): y in x}$ for any ordinal no larger than $s$. Since Theorem 153 tells us that
-- ${enum(x,t): x in s} incs t$, we can use the principle of transfinite induction
-- to find a smallest ordinal $u$ for which ${enum(x,t): x in u}$ includes $t$.
--
	(s,t)-->T153 ==> AUTO
	APPLY(mt1_thryvar:u) transfinite_induction (n->s,P(x)->Ord(x) & (x incin s) & ({enum(v,t): v in x} incs t)) ==>
		Stat1: (FORALL x | Ord(u) & (u incin s) & ({enum(v,t): v in u} incs t) &
				((x in u) imp (not(Ord(x) & (x incin s) & ({enum(w,t): w in x} incs t)))))
	x0-->Stat1(*) ==> Stat2: (not(EXISTS x incin s | (Ord(x) & (t = {enum(y,t): y in x}) & (FORALL y in x, z in x | ((y /= z) imp (enum(y,t) /= enum(z,t))))))) &

		Ord(u) & (u incin s) & ({enum(v,t): v in u} incs t)
--
-- We now aim to derive a contradiction.
-- By Stat3, '$enum$' cannot map $u$ onto $t$ in 1-1 fashion.
-- Thus it either (Case 1) does not map $u$ in 1-1 fashion, or (Case 2) maps $u$ onto a set different from $t$.
-- First suppose that we are in Case 2, so that there exist distinct $y$ and $wz$ in $u$
-- such that $enum(y,t) = enum(wz,t)$.
--
	Suppose ==> Stat4: not(FORALL y in u, z in u | ((y /= z) imp (enum(y,t) /= enum(z,t))))
		(y,wz)-->Stat4(Stat4*) ==> (y in u) & (wz in u) & (y /= wz) & (enum(y,t) = enum(wz,t))
--
--  Since $u$ is an ordinal, its members $y$ and $wz$ must also be ordinals, and must be subsets of $u$.
--
		(u,y)-->T13(Stat2*) ==> y incin u
		(u,wz)-->T13(Stat2*) ==> wz incin u
--
-- Since $y$ is an ordinal, a member of $u$, and a subset of $s$, Stat3 3 tells us that
-- ${enum(v,t): v in y}$ cannot include $t$. Also, since $enum(y,t) = enum(wz,t)$, it follows by
-- Theorem 44 that $t$ must belong either to ${enum(v,t): v in y}$ or ${enum(v,t): v in wz}$.
-- Suppose the former, so that there is an ordinal $a in y$ such that $t = enum(a,t)$.
-- Plainly, $a$ is a subset of $y$.
--
		y-->Stat1(Stat2*) ==>  Stat5: not({enum(v,t): v in y} incs t)
		Suppose ==> Stat6: t in {enum(v,t): v in y}
			a-->Stat6(Stat6*) ==> (t = enum(a,t)) & (a in y)
			(y,a)-->T34(Stat2*) ==> a incin y
--
-- Since $tv$ cannot be a member of $t$, it follows by definition of '$enum$' that $t$ must be a subset of
-- ${enum(v,t): v in a}$, and therefore of the larger set ${enum(v,t): v in y}$. But it was shown above
-- that ${enum(v,t): v in y}$ cannot include $t$. This contradiction excludes the possibility that
-- $t$ is a member of ${enum(v,t): v in y}$, and so implies that $t$ is a member of ${enum(v,t): v in wz}$.
--
			Use_def(enum(a,t)) ==> AUTO
			(Stat6)ELEM ==> t incin {enum(v,t): v in a}
			Set_monot ==> {enum(v,t): v in a} incin {enum(v,t): v in y}
		Discharge ==> AUTO

		(y,wz,t)-->T44(Stat2*) ==> Stat7: t in {enum(v,t): v in wz}
--
-- However, an exactly similar argument refutes this possibility, implying that $t /= {enum(y,t): y in u}$.
-- Also, as shown above, ${enum(v,t): v in u} incs t$, from which it is obvious that
-- there is a $c in {enum(y,t): y in u}$, hence of the form $enum(d,t)$ with $d in u$, such that  $c notin t$.
--
		b-->Stat7(Stat7*) ==> (t = enum(b,t)) & (b in wz)
		(wz,b)-->T34(Stat2*) ==> b incin wz
		Use_def(enum(b,t)) ==> AUTO
		(Stat7)ELEM ==> t incin {enum(v,t): v in b}
		Set_monot ==> {enum(v,t): v in b} incin {enum(v,t): v in wz}
		Set_monot ==> {enum(v,t): v in wz} incin {enum(v,t): v in u}
		(Stat7*)ELEM ==> t in {enum(v,t): v in u}
		(Stat7*)ELEM ==> Stat8: (t /= {enum(y,t): y in u}) & (t incin {enum(y,t): y in u})
		(Stat8*)ELEM ==> Stat9: not (t incs {enum(y,t): y in u})
		c-->Stat9(Stat9*) ==> Stat10: (c in {enum(y,t): y in u}) & (c notin t)
		d-->Stat10(Stat10*) ==> Stat11: (c = enum(d,t)) & (d in u) & (c notin t)
--
-- Since $u$ is an ordinal, its member $d$ must also be an ordinal and a subset of $d$.
-- Thus, by the minimality of $u$ (Stat3 3), ${enum(v,t): v in d}$ cannot include $t$,
-- which, by definition of 'enum', tells us that c = enum(d,t) must be a member of $t$,
-- contradicting what has just been proved. This excludes the case (Case 2) that we have had
-- under consideration, and so leaves open only the possibility that $t /= {enum(y,t): y in u}$;
-- but, since we have shown above that the second of these sets includes the first, if follows that
-- the first does  not include the second.
--
		(u,d)-->T13(Stat2*) ==> Stat12: d incin u
		d-->Stat1(Stat2,Stat11,Stat12*) ==> Stat13: not({enum(v,t): v in d} incs t)
		Use_def(enum(d,t)) ==> AUTO
		(t - {enum(y,t): y in d})-->T0(Stat13*) ==> enum(d,t) in t
	Discharge ==>  AUTO

	u-->Stat2(Stat2*) ==> Stat14: {enum(w,t): w in u} nincin t
--
-- Hence there is a $v in u$ such that $enum(v,t) notin t$, so it follows by definition of 'enum'
-- that $enum(v,t) notin t$, implying that ${enum(w): w in v} incs t$. Since the minimality
-- of $u$ rules this out, we have a contradiction which completes the proof of the present theorem.
--
	dd-->Stat14(Stat14*) ==> Stat15: (dd in {enum(w,t): w in u}) & (dd notin t)
	v-->Stat15(Stat15*) ==> Stat16: (v in u) & (enum(v,t) notin t)
	(u,v)-->T34(Stat2,Stat16*) ==> v incin s
	Use_def(enum(v,t)) ==> AUTO
	(t - {enum(w,t): w in v})-->T0(Stat16*) ==> {enum(w,t): w in v} incs t
	v-->Stat1(Stat2*) ==> false; Discharge ==> QED
--
-- In proving Theorem 156 below we will want the following direct consequence of Theorem 154,
-- which tells us that any subset of an ordinal $s$ is in 1-1 correspondence with an
-- ordinal no greater than $s$.
--
Theorem 155: [Enumerability lemma] (Ord(S) & (T incin S)) imp
	(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (domain(f) incin S) & (range(f) = T)). Proof:
Suppose_not(s,t) ==> Stat1: (not(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (domain(f) incin s) & (range(f) = t))) &
		 	Ord(s) & (t incin s)
--
-- For suppose the contrary, and let $t$ be a subset of an ordinal $s$ for which there is no
-- 1-1 correspondence with an ordinal no larger than $s$. By Theorem 154 there is an ordinal $xx$ no larger than $s$
-- for which the map $y->enum(y,t)$ is a 1-1 mapping of $xx$ onto $t$, contradicting the statement we have just
-- made and so proving our theorem.
--
	(s,t)-->T154(*) ==> Stat2: (EXISTS x incin s | (Ord(x) & (t = {enum(y,t): y in x}) &
			(FORALL y in x, wz in x | ((y /= wz) imp (enum(y,t) /= enum(wz,t))))))
	x2-->Stat2(*) ==> Stat3: (FORALL y in x2, wz in x2 | ((y /= wz) imp (enum(y,t) /= enum(wz,t)))) &
			Ord(x2) & (x2 incin s) & (t = {enum(y,t): y in x2})
	Loc_def ==> f = {[x,enum(x,t)]: x in x2}
	APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(f(x)->enum(x,t),g->f,s->x2) ==>
		Svm(f) & (domain(f) = x2) & (range(f) = {enum(x,t): x in x2}) &
		(((x in x2) & (y in x2) & (enum(x,t) = enum(y,t)) & (x /= y)) or one_1_map(f))
	(x,y)-->Stat3(Stat3*) ==> one_1_map(f)
	EQUAL(Stat3) ==> Ord(domain(f))
	f-->Stat1(Stat3*) ==> false; Discharge ==> QED
--
-- A straightforward consequence of Theorem 155, which is stated in the following theorem, is that
-- $#s$ is a cardinal in 1-1 correspondence with $s$ (rather than merely in the single-valued
-- correspondence which the definition of cardinality requires.)
-- This result has several easy but important corollaries which we then digress to prove.
--
Theorem 156: [Cardinality theorem] Card(#S) & Ord(#S) & (EXISTS f in OM | one_1_map(f) & (range(f) = S) & (domain(f) = #S)). Proof+:
Suppose_not(s) ==> AUTO
--
-- For suppose the contrary, i.e. either $#s$ is not a cardinal or is not in 1-1 correspondence with $s$.
-- Since by Theorem 147 $#s$ is an ordinal in 1-1 correspondence with $s$, it follows that
-- $#s$ must not be a cardinal. Thus, by definition of 'cardinal', there must exist a member $c$
-- of $#s$ and a 1-1 map of $c$ onto $#s$.
--
	s-->T147(*) ==> Stat1: (EXISTS f in OM | one_1_map(f) & (range(f) = s) & (domain(f) = #s)) &
				Ord(#s) &
				(not Card(#s)) &
			Stat2: (not(EXISTS o in #s | (EXISTS g in OM | one_1_map(g) & (range(g) = s) & (domain(g) = o))))
	Use_def(Card(#s)) ==> AUTO
	ELEM ==> Stat3: not(FORALL y in #s, ff in OM | not(domain(ff) = y) or not(range(ff) = #s) or not(Svm(ff)))
	(c,g)-->Stat3(Stat3*) ==> (c in #s) & (domain(g) = c) & (range(g) = #s) & Svm(g) & Ord(c)
--
-- By Theorem 138, $g$ has a 1-1 partial inverse $h$, which maps $#s$ to a subset of $c$, so the inverse of
-- $h$ is a 1-1 mapping of this subset $ssc$ onto $#s$.
--
	g-->T138(Stat3*) ==> Stat4: (EXISTS h | (domain(h) = range(g)) & (range(h) incin domain(g)) & one_1_map(h) &
								(FORALL x in range(g) | g~[h~[x]] = x))
	h-->Stat4(Stat3*) ==> Stat4a: (domain(h) = #s) & (range(h) incin c) & one_1_map(h)
	h-->T101(Stat4*) ==> (range(inv(h)) = #s) & (domain(inv(h)) incin c) & one_1_map(inv(h))
--
-- However, Theorem 155 tells us that there is a 1-1 map $f$ of an ordinal contained in $c$ onto $ssc$.
-- By Theorem 34, this ordinal must either be $c$ or a member of $c$, and so must be a member of
-- $#s$ in any case.
--
	(c,domain(inv(h)))-->T155(Stat3*) ==> Stat5: (EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (domain(f) incin c) &
				(range(f) = domain(inv(h))))
	f-->Stat5(Stat5*) ==> Stat5a: one_1_map(f) & Ord(domain(f)) & (domain(f) incin c) & (range(f) = domain(inv(h)))
	(c,domain(f))-->T34(Stat3*) ==> (domain(f) in c) or (domain(f) = c)
	(#s,c)-->T34(Stat1*) ==> (c incin #s) & (domain(f) in #s)
--
-- But now the map product $inv(h) @ f$ is a 1-1 map of a member of $#s$ onto $#s$, so if we let $ff$
-- be a 1-1 map of $#s$ to $s$, then $ff @ (inv(h) @ f)$ is a 1-1 map of a member of $#s$ onto $s$.
--
	(f,inv(h))-->T96(Stat4*) ==> (domain(inv(h) @ f) = domain(f)) & (range(inv(h) @ f) = #s)
	ff-->Stat1(Stat1,Stat1*) ==> Stat6a: one_1_map(ff) & (range(ff) = s) & (domain(ff) = #s)
--	Loc_def ==> Stat7a: (f1 = inv(h)) & (f2 = (inv(h) @ f)) & (f3 = (ff @ (inv(h) @ f)))
--	EQUAL(Stat4a,Stat5a,Stat6a,Stat7a) ==> one_1_map(inv(h) @ f) & one_1_map(ff @ (inv(h) @ f))
	(inv(h),f)-->T133(Stat4a*) ==> one_1_map(inv(h) @ f)
	(ff,inv(h) @ f)-->T133(Stat5a*) ==> one_1_map(ff @ (inv(h) @ f))
	(inv(h) @ f,ff)-->T96(Stat5a*) ==> (domain(ff @ (inv(h) @ f)) = domain(f)) & (range(ff @ (inv(h) @ f)) = s)
--
-- By Stat2, this is impossible, a contradiction which proves our theorem.
--
	(domain(f))-->Stat2(Stat5a*) ==> Stat8: (not(EXISTS g in OM | one_1_map(g) & (range(g) = s) & (domain(g) = domain(f))))
	(ff @ (inv(h) @ f))-->Stat8(Stat6a*) ==> false
	Discharge ==> QED
--
-- Theorem 156 implies that any two sets which are in 1-1 correspondence have the same cardinality.
--
Theorem 157: [One-one maps are cardinality preserving] one_1_map(F) imp (#range(F) = #domain(F)). Proof+:
Suppose_not(h) ==> AUTO
--
-- We proceed by contradiction, and so suppose that there exists
-- a 1-1 map whose range and domain have different cardinalities.
-- Since each of these two is are in 1-1 correspondence with its cardinality,
-- $#range(h)$ and $#domain(h)$ are in 1-1 correspondence with each other.
--
	(range(h))-->T147(*) ==> Stat1: (EXISTS f in OM | (one_1_map(f) & (range(f) = range(h)) & (domain(f) = #range(h)))) &
		Ord(#range(h))
	f-->Stat1(Stat1*) ==> one_1_map(f) & (range(f) = range(h)) & (domain(f) = #range(h))
	(domain(h))-->T147(*) ==> Stat2: (EXISTS f in OM | (one_1_map(f)  & (range(f) = domain(h)) & (domain(f) = #domain(h)))) &
		Ord(#domain(h))
	g-->Stat2(Stat2*) ==> one_1_map(g) & (range(g) = domain(h)) & (domain(g) = #domain(h))
	Loc_def ==> Stat3: (c0 = #range(h)) & (c1 = #domain(h)) & (hg = h @ g) & (f1 = inv(f)) & (f2 = (inv(f) @ (h @ g))) & (f3 = (inv(inv(f) @ (h @ g))))
	EQUAL ==> one_1_map(h @ g) & one_1_map(inv(f)) & one_1_map(inv(f) @ (h @ g)) & one_1_map(inv(inv(f) @ (h @ g)))
	f-->T101(*) ==> (range(inv(f)) = #range(h)) & (domain(inv(f)) = range(h))
	(g,h)-->T96(Stat2*) ==> (range(h @ g) = range(h)) & (domain(h @ g) = #domain(h))
	(h @ g,inv(f))-->T96(Stat1*) ==> Stat4: (range(inv(f) @ (h @ g)) = #range(h)) & (domain(inv(f) @ (h @ g)) = #domain(h))
	(inv(f) @ (h @ g))-->T101(Stat2*) ==> (range(inv(inv(f) @ (h @ g))) = #domain(h)) & (domain(inv(inv(f) @ (h @ g))) = #range(h))
	Use_def(one_1_map)(Stat3) ==> Svm(inv(inv(f) @ (h @ g))) & Svm(inv(f) @ (h @ g))
--
-- But by Theorem 31 one of the two distinct ordinals $#range(h)$ and $#domain(h)$,
-- must be a member of the other, even though both are cardinals by Theorem 156, so neither
-- can be in 1-1 correspondence with anything smaller. This contradiction proves our theorem.
--
	EQUAL(Stat3,Stat3) ==> Stat5: Card(#range(h)) & Card(#domain(h))
	Suppose ==> #range(h) in #domain(h)
		Use_def(Card)(Stat5,Stat5) ==> Stat6: (FORALL y in #domain(h), f in OM | (not(domain(f) = y) or not(range(f) = #domain(h)) or not(Svm(f))))
		(#range(h),inv(inv(f) @ (h @ g)))-->Stat6(Stat4*) ==> false
	Discharge ==> AUTO
	(#range(h),#domain(h))-->T31(*) ==> #domain(h) in #range(h)
	Use_def(Card)(Stat5,Stat5) ==> Stat7: (FORALL y in #range(h), f in OM | (not(domain(f) = y) or not(range(f) = #range(h)) or not(Svm(f))))
	(#domain(h),inv(f) @ (h @ g))-->Stat7(Stat4*) ==> false
	Discharge ==> QED
--
-- The following corollary rounds out Theorem 157 by proving that two sets
-- can be in 1-1 correspondence if and only if they have the same cardinality.
-- It is this result that captures the essence of the notion of cardinality.
--
Theorem 158: [Equicardinality is equivalent to one-one correspondence] (EXISTS F in OM | (one_1_map(F) & (range(F) = S) & (domain(F) = T))) eq (#S = #T). Proof:
Suppose_not(s,t) ==> AUTO
--
-- We proceed by contradiction. Since Theorem 157 implies that $s$ and $t$ cannot have
-- different cardinalities if they are in 1-1 correspondence, it must be that
-- they have the same cardinality but are not in 1-1 correspondence.
--
	Suppose ==> Stat1: (EXISTS f in OM | (one_1_map(f) & (range(f) = s) & (domain(f) = t))) & (#s /= #t)
		f-->Stat1 ==> one_1_map(f) & (range(f) = s) & (domain(f) = t)
		f-->T157 ==> #range(f) = #domain(f)
		EQUAL ==> false
	Discharge ==> Stat2: (not(EXISTS f in OM | (one_1_map(f) & (range(f) = s) & (domain(f) = t)))) & (#s = #t)
--
-- But by Theorem 156, $s$ and $t$ are in 1-1 correspondence with their respective cardinalities $#s$ and $#t$,
-- by mappings $g$ and $h$ respectively.
--
	s-->T156 ==> Stat3: (EXISTS f in OM | one_1_map(f) & (range(f) = s) & (domain(f) = #s))
	t-->T156 ==> Stat4: (EXISTS f in OM | one_1_map(f) & (range(f) = t) & (domain(f) = #t))
	g-->Stat3(Stat3,Stat3*) ==> one_1_map(g) & (range(g) = s) & (domain(g) = #s)
	h-->Stat4(Stat4,Stat4*) ==> one_1_map(h) & (range(h) = t) & (domain(h) = #t)
--
-- Hence the map $(g @ inv(h))$, whose domain and range are $t$ and $s$ respectively,
-- is 1-1, contradicting Stat2 and thereby proving our theorem.
--
	h-->T101(Stat4*) ==> one_1_map(inv(h)) & (range(inv(h)) = #t) & (domain(inv(h)) = t)
	(g,inv(h))-->T133(Stat4*) ==> one_1_map(g @ inv(h))
	(inv(h),g)-->T96(*) ==> (range(g @ inv(h)) = range(g)) & (domain(g @ inv(h)) = t)
 	(g @ inv(h))-->Stat2(Stat4*) ==> false
	Discharge ==> QED
--
-- It follows from Theorem 158 that the enumerating ordinal of a set $s$, like any other
-- set $t$ in 1-1 correspondence with $s$, has the same cardinality as $s$.
--
Theorem 159: [The enumerating ordinal of a set has the same cardinality as the set]
	(EXISTS o | Ord(o) & (S = {enum(x,S): x in o}) & (#o = #S)). Proof:
Suppose_not(s1) ==> Stat1: not(EXISTS o | (Ord(o) & s1 = {enum(x,s1): x in o} & (#o = #s1)))
--
-- Suppose the contrary, so that no ordinal which '$enum$' puts in 1-1 correspondence with $s$
-- has the same cardinality as $s1$.  Theorem 46 tells us that there is some ordinal $o$
-- which '$enum$' puts in 1-1 correspondence with $s1$, i.e. '$enum$' defines a 1-1 function $f$
-- whose domain is $o$ and whose range is $s1$. Thus $o$ and $s1$ have the same cardinality, and so
-- $o$ is a counterexample to Stat1, a contradiction which proves our theorem.
--
	s1-->T46 ==> Stat2: (EXISTS o | (Ord(o) & (s1 = {enum(x,s1): x in o}))
				& (FORALL y in o, z in o | ((y /= z) imp (enum(y,s1) /= enum(z,s1)))))
	o-->Stat2() ==> Stat3: Ord(o) & (s1 = {enum(x,s1): x in o}) &
		Stat4: (FORALL y in o, z in o | ((y /= z) imp (enum(y,s1) /= enum(z,s1))))
	Loc_def ==> f = {[x,enum(x,s1)]: x in o}
	APPLY(x9_thryvar:a,y9_thryvar:b) fcn_symbol(f(x)->enum(x,s1),g->f,s->o) ==>
		Svm(f) & (domain(f) = o) & (range(f) = {enum(x,s1): x in o}) &
			(((a in o) & (b in o) & (enum(a,s1) = enum(b,s1)) & (a /= b)) or one_1_map(f))
	(a,b)-->Stat4(Stat3*) ==> Stat5: one_1_map(f) & (domain(f) = o) & (range(f) = s1)
	(s1,o)-->T158(Stat5*) ==> Stat6: (EXISTS f in OM | (one_1_map(f) & (range(f) = s1) & (domain(f) = o))) imp (#s1 = #o)
	f-->Stat6(Stat5*) ==> #o = #s1
	o-->Stat1(Stat3*) ==> false
	Discharge ==> QED
--
-- Theorem 157 also has the two following corollaries, which state facts basic to the
-- arithmetic theory of infinite cardinals. The first of these is the associative law
-- for cardinal arithmetic, which follows as an elementary consequence of Theorem 144.
--
Theorem 160: [Associative Law for Cardinals] #((A PROD B) PROD C) = #(A PROD (B PROD C)). Proof:
Suppose_not(a,b,c) ==> AUTO
	Loc_def ==> f = {[[[x,y],wz],[x,[y,wz]]]: x in a, y in b, wz in c}
	(f,a,b,c)-->T144(*) ==> one_1_map(f) & (domain(f) = ((a PROD b) PROD c)) & (range(f) = (a PROD (b PROD c)))
	EQUAL ==> #domain(f) /= #range(f)
	f-->T157 ==> AUTO
	Discharge ==> QED
--
-- The following proof of the  associative law for cardinal arithmetic is equally elementary,
-- this time as a consequence of Theorem 145.
--
Theorem 161: [Commutative Law for Cardinals] #(A PROD B) = #(B PROD A). Proof:
Suppose_not(a,b) ==> AUTO
	Loc_def ==> f = {[[x,y],[y,x]]: x in a, y in b}
	(f,a,b)-->T145(*) ==> one_1_map(f) & (domain(f) = (a PROD b)) & (range(f) = (b PROD a))
	EQUAL ==> (#domain(f) = #(a PROD b)) & (#range(f) = #(b PROD a))
	f-->T157 ==> AUTO
	Discharge ==> QED
--
-- The following utility lemma simply notes that only the null set can have cardinality $0$.
--
Theorem 162: [Sets of cardinality 0 must be null] (#S = 0) eq (S = 0). Proof:
Suppose_not(s) ==> AUTO
--
-- For since any set $s$ is in 1-1 correspondence with its cardinality,
-- our result follows immediately from Theorem 86
--
	s-->T147(*) ==> Stat1: (EXISTS f in OM | (one_1_map(f) & (range(f) = s) & (domain(f) = #s)))
	f-->Stat1(*) ==> one_1_map(f) & (range(f) = s) & (domain(f) = #s)
	f-->T86 ==> AUTO
	Discharge ==> QED
--
 -- It is also useful to state the following variant of the preceding lemma,
 -- which notes that every nonzero cardinal is larger than $0$
--
Theorem 163: [Non-null sets have cardinality greater than 0] (0 in #S) eq (S /= 0). Proof:
Suppose_not(s) ==> AUTO
	s-->T162(*) ==> (0 notin #s) & (#s /= 0)
	s-->T147(*) ==> Ord(#s)
	Suppose ==> not Ord(0)
		Use_def(Ord(0)) ==> AUTO
		Suppose ==> Stat1: (not(FORALL x in 0 | x incin 0))
		c-->Stat1 ==> false; Discharge ==> Stat2: (not(FORALL x in 0, y in 0 | x in y or y in x or x = y))
		d-->Stat2 ==> false
	Discharge ==> Ord(0)
	(#s,0)-->T31(*) ==> false
	Discharge ==> QED
--
-- Next we show that a set $s$ is a cardinal if and only if it is its own cardinal.
--
Theorem 164: [A cardinal is its own cardinality] Card(S) eq (S = #S). Proof:
Suppose_not(s) ==> AUTO
--
-- We proceed by contradiction.  Since Theorem 156 tells us that $#s$ is a cardinal with which
-- $s$ is in 1-1 correspondence, only the first of the two cases displayed above need be considered.
-- In this case $s$ and $#s$ are both cardinals, hence ordinals, so one must be a member of the other.
--
	s-->T156 ==> Stat1: (EXISTS f in OM | one_1_map(f) & (range(f) = s) & (domain(f) = #s)) & Card(#s)
	Suppose ==> (not Card(s)) & (s = #s)
	EQUAL ==> false; Discharge ==> s /= #s
	f-->Stat1 ==> one_1_map(f) & (range(f) = s) & (domain(f) = #s)
	(s,#s)-->T31 ==> AUTO
	Use_def(Card)(Stat1) ==>
		Stat2: (FORALL y in s, f in OM | (not(domain(f) = y) or not(range(f) = s) or not(Svm(f)))) &
		Stat3: (FORALL y in #s, f in OM | (not(domain(f) = y) or not(range(f) = #s) or not(Svm(f)))) &
			 ((s in #s) or (#s in s))
--
-- But Stat2 (resp. Stat3) tells us that $#s$ cannot be a member of $s$
-- (resp. $s$ cannot be a member of $#s$), so we have a contradiction which proves our theorem.
--
	Suppose ==> #s in s
		Use_def(one_1_map(f)) ==> AUTO
		(#s,f)-->Stat2(Stat1*) ==> false
	Discharge ==> AUTO
	f-->T101(Stat1*) ==> one_1_map(inv(f)) & (range(inv(f)) = #s) & (domain(inv(f)) = s)
	Use_def(one_1_map(inv(f))) ==> AUTO 
	(s,inv(f))-->Stat3(Stat2*) ==> false
	Discharge ==> QED
--
-- In the following corollary we note that if $c$ is a cardinal
-- and is in 1-1 correspondence with a set $s$, then $c$ is $#s$.
--
Theorem 165: [Uniqueness of Cardinality]
	(Card(C) & (EXISTS f in OM | (one_1_map(f) & (range(f) = S) & domain(f) = C))) imp (C = #S). Proof:
    Suppose_not(c,s) ==> Card(c) & Stat1: (EXISTS f in OM | (one_1_map(f) & (range(f) = S) & domain(f) = C)) & (c /= #s)
    f-->Stat1 ==> Card(c) & one_1_map(f) & (range(f) = s) & (domain(f) = c) & (c /= #s)
--
-- Suppose the contrary, i.e. that there is a cardinal $c$ in 1-1 correspondence with $s$
-- which is different from $#s$.
	f-->T157 ==> #range(f) = #domain(f)
	EQUAL ==> #c /= c
	c-->T164 ==> false; Discharge ==> QED
--
-- Our next two results are also simple corollaries of the foregoing: the cardinality operator
-- "$\#$" is idempotent, and any two distinct cardinals are ordered by membership.
--
Theorem 166: [The cardinality operator is idempotent] #S = ##S. Proof:
	Suppose_not(s) ==> #s /= ##s
    s-->T156 ==> Card(#s)
    (#s)-->T164 ==> false; Discharge ==> QED
--
Theorem 167: [All cardinals are comparable] (#S in #T) or (#S = #T) or (#T in #S). Proof:
	Suppose_not(s,t) ==> not((#s in #t) or (#s = #t) or (#t in #s))
    s-->T156 ==> Ord(#s)
    t-->T156 ==> Ord(#t)
    (#s,#t)-->T31 ==> false; Discharge ==> QED
--
-- Next we note that the ordering of cardinals by membership is transitive,
-- simply because cardinals must be ordinals and our claim holds for ordinals by Theorem 34.
--
Theorem 168: [Cardinal comparison is transitive] ((#S in #T) & (#T in #R)) imp (#S in #R). Proof:
	Suppose_not(s,t,r) ==> (#s in #t) & (#t in #r) & (#s notin #r)
    r-->T156 ==> Ord(#r)
	(#r,#t)-->T12 ==> Ord(#t)
	(#r,#t)-->T34 ==> (Ord(#r) & Ord(#t)) imp ((#t incin #r) eq ((#t in #r) or (#t = #r)))
	ELEM ==> #s notin #r
    Discharge ==> QED
--
-- We can use the preceding results to prove that subsets of an ordinal
-- have a cardinality that is no larger than the ordinal. This is just a bit
-- short of the more general result (which follows as Theorem 170)
-- that subsets of a set $s$ can never have a cardinality greater than $#s$.
--
Theorem 169: [Subsets of an ordinal have a cardinality that is no larger than the ordinal]
    (Ord(S) & (T incin S)) imp (#T incin S). Proof:
    Suppose_not(s,t) ==> Ord(s) & (t incin s) & (not(#t incin s))
--
-- Proceeding by contradiction, let the ordinal $s$ and its subset $t$ be a counterexample.
-- By the preceding theorem, there is an ordinal $u$ no larger than $s$
-- which '$enum$' puts into 1-1 correspondence with $t$.
--
	(s,t)-->T154 ==> Stat1: (EXISTS x incin s | (Ord(x) & (t = {enum(y,t): y in x}) &
		(FORALL y in x, z in x | ((y /= z) imp (enum(y,t) /= enum(z,t))))))
    u-->Stat1 ==> Stat2: (u incin s) & Ord(u) & (t = {enum(y,t): y in u}) &
						Stat3: (FORALL y in u, wz in u | ((y /= wz) imp (enum(y,t) /= enum(wz,t))))
	Loc_def ==> g = {[x,enum(x,t)]: x in u}
    APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(f(x)->enum(x,t),g->g,s->u) ==>
			Svm(g) & (range(g) = {enum(x,t): x in u}) & (domain(g) = u) &
				(((x in u) & (y in u) & (enum(x,t) = enum(y,t)) & (x /= y)) or one_1_map(g))
    (x,y)-->Stat3 ==> one_1_map(g)
--
-- Theorem 157 now tells us that $#t = #u$. But it is easy to see that $u incs #u$ for every ordinal $u$.
--
    g-->T157 ==> #range(g) = #domain(g)
    EQUAL ==> #t = #u
    Suppose ==> Stat4: not(u incs #u)
    u-->T156 ==> Stat5: Card(#u) & Ord(#u) &
    	Stat6: (EXISTS f in OM | (one_1_map(f) & (range(f) = u) & (domain(f) = #u)))
    f-->Stat6 ==> Stat7: one_1_map(f) & (range(f) = u) & (domain(f) = #u)
    f-->T101(Stat7) ==> one_1_map(inv(f)) & (domain(inv(f)) = u) & (range(inv(f)) = #u)
    Use_def(one_1_map) ==> Stat8: Svm(inv(f))
    (u,#u)-->T29(Stat4,Stat5,Stat2) ==> Stat9: #u incs u
    (#u,u)-->T34(Stat2,Stat5,Stat9,Stat4) ==> u in #u
    Use_def(Card) ==>
    	Stat10: (FORALL y in #u, f in OM | (not(domain(f) = y) or not(range(f) = #u) or not(Svm(f))))
    (u,inv(f))-->Stat10 ==> false; Discharge ==> u incs #u
--
-- But now, since $s$ $incs$ $u$ $incs$ $#u = #t$, we must have $s incs #t$, contradicting our original
-- assumption and thus proving our theorem.
--
    Discharge ==> QED
--
-- The following theorem, which the preceding theorem anticipates,
-- states the basic fact that the cardinality of a subset $t$ of $s$
-- can be no larger than the cardinality of $s$.
--
Theorem 170: [Subset cardinality theorem] (T incin S) imp (#T incin #S). Proof:
    Suppose_not(t,s) ==> Stat1: (t incin s) & (not (#t incin #s))
--
-- For suppose that $t$ is a subset of $s$ but has a larger cardinality.
-- Then $s$ is in 1-1 correspondence with $#s$ by some map $f$,
-- and so the inverse of $f$ maps $t$ to a subset of $#s$ in 1-1, and hence cardinality-preserving, fashion.
--
    (s)-->T156 ==> Stat2: Card(#s)  and  (EXISTS f in OM | one_1_map(f) & (range(f) = s) & (domain(f) = #s))
    (f)-->Stat2 ==> one_1_map(f) & (range(f) = s) & (domain(f) = #s)
    f-->T101 ==> one_1_map(inv(f)) & (f = inv(inv(f))) & (range(inv(f)) = domain(f)) & (domain(inv(f)) = range(f))
    (inv(f),t)-->T58 ==> one_1_map(inv(f) ON t)
    (inv(f) ON t)-->T157 ==> Stat3: #domain(inv(f) ON t) = #range(inv(f) ON t)
    (inv(f),t)-->T80 ==> range(inv(f) ON t) incin #s
--
-- Since the cardinal $#s$ is an ordinal, it follows by Theorem 169 that $#range(inv(f) ON t)$
-- is not larger than $#s$. But since $inv(f) ON t$ is 1-1 and has domain $t$, $#range(inv(f) ON t) = #t$;
-- so $#t incin #s$, a contradiction which proves our theorem.
--
    (s)-->T147 ==> Ord(#s)
    (#s,range(inv(f) ON t))-->T169 ==> Stat4: #range(inv(f) ON t) incin #s
    (inv(f),t)-->T94 ==> domain(inv(f) ON t) = t
    EQUAL ==> Stat5: #domain(inv(f) ON t) = #t
    (Stat1,Stat3,Stat4,Stat5)Discharge ==> QED
--
-- The following somewhat more general result tells us that the range of a single-valued map is
-- never more numerous than its domain.
--
Theorem 171: [Single-valued mapping cannot increase cardinality] Svm(F) imp (#range(F) incin #domain(F)). Proof:
    Suppose_not(f) ==> Svm(f) & (not (#range(f) incin #domain(f)))
    f-->T138 ==> Stat1: (EXISTS h | ((domain(h) = range(f)) & (range(h) incin domain(f)) &
    				 one_1_map(h)) & (FORALL x in range(f) | (f~[h~[x]] = x)))
    h-->Stat1 ==> (domain(h) = range(f)) & (range(h) incin domain(f)) & one_1_map(h)
    (range(h),domain(f))-->T170 ==> #range(h) incin #domain(f)
    EQUAL ==> #domain(h) = #range(f)
    h-->T157 ==> false; Discharge ==> QED
--
-- Next we show that the domain and range of any map $f$ (and indeed of any set $f$) is no greater than $f$.
--
Theorem 172: [The cardinality of a map is no smaller than the cardinality of its domain] #domain(F) incin #F. Proof:
    Suppose_not(f) ==> not(#domain(f) incin #f)
--
-- For $domain(f)$ is a single-valued image of $f$ by the map ${[x,car(x)]: x in f}$, and so the
-- present theorem is a corollary of Theorem 171.
--
    Loc_def ==> g = {[x,car(x)]: x in f}
    APPLY() fcn_symbol(f(x)->car(x),g->g,s->f) ==> Svm(g) & (domain(g) = f) & (range(g) = {car(x): x in f})
    Use_def(domain) ==> range(g) = domain(f)
    g-->T171 ==> #range(g) incin #domain(g)
    EQUAL ==> #domain(f) incin #f
    Discharge ==> QED
--
Theorem 173: [The cardinality of a map is no smaller than the cardinality of its range] #range(F) incin #F. Proof:
    Suppose_not(f) ==> not (#range(f) incin #f)
--
-- For $range(f)$ is a single-valued image of $f$ by the map ${[x,cdr(x)]: x in f}$, and so the
-- present theorem is a corollary of Theorem 171.
--
   Loc_def ==> g = {[x,cdr(x)]: x in f}
   APPLY() fcn_symbol(f(x)->cdr(x),g->g,s->f) ==>
    		Svm(g) & (domain(g) = f) & (range(g) = {cdr(x): x in f})
    Use_def(range) ==> range(g) = range(f)
    g-->T171 ==> #range(g) incin #domain(g)
    EQUAL ==> #range(f) incin #f
    Discharge ==> QED
--
-- If the map $f$ is single-valued, the inequality given by Theorem 172 can be sharpened
-- to an equality:
--
Theorem 174: [The cardinality of a single-valued map equals the cardinality of its domain] Svm(F) imp (#domain(F) = #F). Proof:
    Suppose_not(f) ==> Svm(f) & (#domain(f) /= #f)
--
-- For in this case $domain(f)$ is easily seen to be a 1-1 image of $f$ by the map ${[x,car(x)]: x in f}$,
-- and so the present theorem is a corollary of Theorem 157.
--
    Loc_def ==> g = {[u,car(u)]: u in f}
    APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(f(x)->car(x),g->g,s->f) ==>
		Svm(g) & (domain(g) = f) & (range(g) = {car(x): x in f}) &
			(((x in f) & (y in f) & (car(x) = car(y)) & (x /= y)) or one_1_map(g))
    Use_def(domain) ==> range(g) = domain(f)
	Suppose ==> not one_1_map(g)
	ELEM ==> (x in f) & (y in f) & (car(x) = car(y)) & (x /= y)
	Use_def(Svm) ==> Stat1: (FORALL x in f, y in f | (car(x) = car(y)) imp (x = y))
    (x,y)-->Stat1 ==> false; Discharge ==> one_1_map(g)
    g-->T157 ==> #domain(g) = #range(g)
    EQUAL ==> #domain(f) = #f
    Discharge ==> QED
--
-- Our next theorem states that the restriction of a
-- single-valued map $f$ to any subset $a$ of $domain(f)$
-- has the same cardinality as $a$.
--
Theorem 175: [Cardinality of restriction maps] (Svm(F) & (domain(F) incs A)) imp (#(F ON A) = #A). Proof:
    Suppose_not(f,a) ==> Svm(f) & (domain(f) incs a) & (#(f ON a) /= #a)
        (f,a)-->T94 ==> domain(f ON a) = a
        EQUAL ==> #domain(f ON a) = #a
        (f,a)-->T57 ==> Svm(f ON a)
    (fON a)-->T174 ==> false; Discharge ==> QED
--
-- The preceding theorems allow us to add an additional result to our utility fcn_symbol theory.
-- This simply states the fact that the cardinality of a single-valued map is the cardinality
-- of its domain, and is at least as large as the cardinality of its range.
--
ENTER_THEORY fcn_symbol   [Add an additional result to the fcn_symbol theory]
--
Theorem fcn_symbol1: [Cardinality of mapformers and range formers] (#{[xx,f(xx)]: xx in s} = #s) & (#{f(xx): xx in s} incin #s). Proof:
	Suppose_not ==> not((#{[x,f(x)]: x in s} = #s) & (#{f(x): x in s} incin #s))
    Assump ==> g = {[x,f(x)]: x in s}
    Tfcn_symbol.1 ==> domain(g) = s
    Tfcn_symbol.5 ==> range(g) = {f(x): x in s}
    Tfcn_symbol.7 ==> Svm(g)
    g-->T174 ==> #domain(g) = #g
    EQUAL ==> #{[x,f(x)]: x in s} = #s
    g-->T173 ==> #range(g) incin #g
    EQUAL ==> #{f(x): x in s} incin #{[x,f(x)]: x in s}
    Discharge ==> QED
--
ENTER_THEORY Set_theory   [Return to the top-level theory]
--
-- Next we show that if $t$ is not null, the condition $(#s incs #t)$ is equivalent
-- to the existence of a single-valued map of $s$ onto $t$.
--
Theorem 176: [Condition for existence of a single-valued map between two sets] (#S incs #T) eq (T = 0 or (EXISTS f in OM | Svm(f) & (domain(f) = S) & (range(f) = T))). Proof:
    Suppose_not(s,t) ==> ((#s incs #t) & (t /= 0) & (not(EXISTS f in OM | Svm(f) & (domain(f) = s) & (range(f) = t)))) or
	((not (#s incs #t)) & (t = 0 or (EXISTS f in OM | Svm(f) & (domain(f) = s) & (range(f) = t))))
--
-- Proceed by contradiction, and so suppose that either (Case 1) $#s$ is at least as large as $#t$
-- but there exists no single-valued map of $s$ onto $t$, or that (Case 2) there exists such a map
-- but that $#t$ is larger than $#s$. Consider Case 1 first. By Theorem 147, there are 1-1 maps $h$ and $g$
-- which respectively send $#s$ and $#t$ to $s$ and $t$.
--
    Suppose ==> (#s incs #t) & (t /= 0) & Stat1: (not(EXISTS ff in OM | Svm(ff) & (domain(ff) = s) & (range(ff) = t)))
    (s)-->T147 ==> Stat2: (EXISTS f in OM | (one_1_map(f) & (range(f) = s) & (domain(f) = #s)))
    (h)-->Stat2 ==> one_1_map(h) & (range(h) = s) & (domain(h) = #s)
    (t)-->T147 ==> Stat3: (EXISTS f in OM | (one_1_map(f) & (range(f) = t) & (domain(f) = #t)))
    (g)-->Stat3 ==> one_1_map(g) & (range(g) = t) & (domain(g) = #t)
--
-- Moreover, we can easily define a single-valued map of $#s$ onto its subset $#t$.
-- Simply note that $0$ is an element of $#t$, and map all elements of $#s$ which
-- belong to $#t$ into themselves, and all other elements of $#s$ onto $0$.
--
	t-->T163 ==> 0 in #t
	Loc_def ==> f = {[x,if (x in (#t)) then x else 0 end if]: x in (#s)}
    APPLY() fcn_symbol(f(x)->if x in #t then x else 0 end if,g->f,s->#s) ==>
		Svm(f) & (domain(f) = #s) & (range(f) = {if x in #t then x else 0 end if: x in #s})
    Suppose ==> Stat4: range(f) /= #t
    c-->Stat4 ==> ((c in {if x in #t then x else 0 end if: x in #s}) & (c notin #t)) or
	((c notin {if x in #t then x else 0 end if: x in #s}) & (c in #t))
    Suppose ==> Stat5: (c notin {if x in #t then x else 0 end if: x in #s}) & (c in #t)
    c-->Stat5 ==> (c /= if c in #t then c else 0 end if or c notin #s)
    Discharge ==> Stat6: (c in {if x in #t then x else 0 end if: x in #s}) &
    										(c notin #t)
    d-->Stat6 ==> c = if d in #t then d else 0 end if
    Discharge ==> Svm(f) & (domain(f) = #s) & (range(f) = #t)
--
-- Theorem 101 now tells us that h has a 1-1 inverse which maps $s$ onto $#s$. Hence
-- $g @ (f @ inv(h))$ is a single-valued map of $s$ onto $t$, showing that Case 1 is impossible.
--
    h-->T101 ==> one_1_map(inv(h)) & (range(inv(h)) = #s) & (domain(inv(h)) = s)
    Use_def(one_1_map) ==> Svm(h) & Svm(g) & Svm(inv(h))
    (f,inv(h))-->T128 ==> Svm(f @ inv(h))
    (inv(h),f)-->T96 ==> (domain(f @ inv(h)) = s) & (range(f @ inv(h)) = #t)
    (g,f @ inv(h))-->T128 ==> Svm(g @ (f @ inv(h)))
    (f @ inv(h),g)-->T96 ==> (domain(g @ (f @ inv(h))) = s) & (range(g @ (f @ inv(h))) = t)
    (g @ (f @ inv(h)))-->Stat1 ==> false
--
-- So only Case2 remains to be considered. But in this case there is a single-valued map $hh$ of $s$ onto $t$,
-- and so Theorem 162, Theorem 174, and Theorem 173 lead to an immediate contradiction, proving our theorem.
--
    Discharge ==> (not #s incs #t) & (t = 0 or (EXISTS f in OM | Svm(f) & (domain(f) = s) & (range(f) = t)))
    ELEM ==> #t /= 0
    t-->T162 ==> t /= 0
    ELEM ==> Stat7: (EXISTS f in OM | Svm(f) & (domain(f) = s) & (range(f) = t))
    hh-->Stat7 ==> Svm(hh) & (domain(hh) = s) & (range(hh) = t)
    hh-->T174 ==> #hh = #domain(hh)
    EQUAL ==> #hh = #s
    hh-->T173 ==> #hh incs #range(hh)
    EQUAL ==> #hh incs #t
    Discharge ==> QED
--
-- The inverse image of a set under a map is the image of the set under the inverse of the map.
-- This notion, which appears in many arguments, has the following direct definition.
--
Def 14d: [Inverse Map Image] Def(G INV_IM R) := {car(p): p in G | cdr(p) in R}
--
-- We can use the foregoing defintion to prove various elementary properties of the inverse image,
-- beginning with the following, which in effect tells us that the inverse image operation is additive.
--
Theorem 177: [Domains and ranges of inverse] domain(G) = (G INV_IM R) + (G INV_IM (range(G) - R)). Proof:
    Suppose_not(g,r) ==> domain(g) /= (g INV_IM r) + (g INV_IM (range(g) - r))
--
-- For if not, expansion of the definitions involved brigns us to the inequality between setformers seen below.
--
	Use_def(domain) ==> {car(p): p in g} /= (g INV_IM r) + (g INV_IM (range(g) - r))
	Use_def(INV_IM) ==> {car(p): p in g} /=
		{car(p): p in g | cdr(p) in r} + {car(p): p in g | cdr(p) in (range(g) - r)}
--
-- But it is easily seen, using set monotonicity that the left side of this last inequality
-- includes the right, and so the right side must fail to include the left. Hence here is a point q
-- in the left-hand set but in neither of those on the right.
--
	Set_monot ==> {car(p): p in g} incs {car(p): p in g | cdr(p) in r}
	Set_monot ==> {car(p): p in g | cdr(p) in (range(g) - r)} incin {car(p): p in g}
	ELEM ==> Stat1: not( {car(p): p in g} incin
				({car(p): p in g | cdr(p) in r} + {car(p): p in g | cdr(p) in (range(g) - r)}))
	q-->Stat1 ==> Stat2: (q in {car(p): p in g}) &
						Stat3: (q notin {car(p): p in g | cdr(p) in r}) &
							Stat4: (q notin {car(p): p in g | cdr(p) in (range(g) - r)})
--
-- It follows immediately that $q = car(p)$ for some $p in g$, but that $q notin range(g)$,
-- an impossibility which completes our proof.
--
	p-->Stat2 ==> (q = car(p)) & (p in g)
	p-->Stat3 ==> cdr(p) notin r
	p-->Stat4 ==> cdr(p) notin range(g)
	Use_def(range) ==> Stat5: cdr(p) notin {cdr(p): p in g}
    p-->Stat5 ==> false; Discharge ==> QED
--
-- Next we show that the inverse images of two disjoint sets by a single-valued map are disjoint.
--
Theorem 178: [Range-decomposition of a map domain] ((S * R = 0) & Svm(G)) imp (((G INV_IM S) * (G INV_IM R)) = 0). Proof:
    Suppose_not(s,r,g) ==> (s * r = 0) & Svm(g) & (((g INV_IM s) * (g INV_IM r)) /= 0)
--
-- For if not there must exist points $p$ and $q$, in $s$ and $r$ respectively, such that $car(p) = car(q)$.
--
	Use_def(INV_IM) ==> Stat1: ({car(p): p in g | cdr(p) in s} * {car(p): p in g | cdr(p) in r}) /= 0
	c-->Stat1 ==> Stat2: (c in {car(p): p in g | cdr(p) in s}) & Stat3: (c in {car(p): p in g | cdr(p) in r})
	p-->Stat2 ==> (c = car(p)) & (p in g) & (cdr(p) in s)
	q-->Stat3 ==> (c = car(q)) & (q in g) & (cdr(q) in r)
	Use_def(Svm) ==> Stat4: (FORALL x in g, y in g | (car(x) = car(y)) imp (x = y))
--
-- But then $p = q$, so that $cdr(p) = cdr(q)$ must belong to both $s$ and $r$, a contradiction
-- which completes our proof.
--
 	(p,q)-->Stat4 ==> p = q
    Discharge ==> QED
--
-- The following entirely elementary lemma tells us that the inverse image by a map g
-- of any element in the range of g is a nonempty set.
--
Theorem 179: [Inverse image of a range element] (Y in range(G)) imp ((G INV_IM {Y}) /= 0). Proof:
    Suppose_not(y,g) ==> (y in range(g)) & ((g INV_IM {y}) = 0)
	Use_def(range) ==> Stat1: y in {cdr(p): p in g}
	Use_def(INV_IM) ==> Stat2: {car(p): p in g | cdr(p) in {y}} = 0
	p-->Stat1 ==> (y=cdr(p)) & (p in g)
    p-->Stat2 ==> false; Discharge ==> QED
--
-- The following easy lemma tells us that the "$INV_IM$" operator instroduced above is the
-- same as 'range of inverse', i.e. $f INV_IM r /= range(inv(f) ON r)$.
--
Theorem 180: [Range of a restricted inverse map] G INV_IM R = range(inv(G) ON R). Proof:
    Suppose_not(f,r) ==> f INV_IM r /= range(inv(f) ON r)
--
-- For the proof, we have only to expand our assertion using the defintions
-- of the operators involved and simplify the resulting setformers.
--
	Use_def(range) ==> f INV_IM r /= {cdr(q): q in inv(f) ON r}
	Use_def(ON) ==> f INV_IM r /= {cdr(q): q in {s in inv(f) | car(s) in r}}
	Use_def(inv) ==> f INV_IM r /= {cdr(q): q in {s in {[cdr(t),car(t)]: t in f} | car(s) in r}}
	SIMPLF ==> 	{cdr(s): s in {[cdr(t),car(t)]: t in f} | car(s) in r} =
							{cdr(q): q in {s in {[cdr(t),car(t)]: t in f} | car(s) in r}}
	SIMPLF ==> 	{cdr([cdr(t),car(t)]): t in f | car([cdr(t),car(t)]) in r} =
							{cdr(s): s in {[cdr(t),car(t)]: t in f} | car(s) in r}
	ELEM ==> f INV_IM r /= {cdr([cdr(t),car(t)]): t in f | car([cdr(t),car(t)]) in r}
    Use_def(INV_IM) ==> false; Discharge ==> QED
--
-- Next we show that for single-valued maps, the inverse image $G INV_IM R$ can be expressed
-- in an evident way as the set of images of the individual members of $R$ under $G$.
--
Theorem 181: [Single-valued inverse image as a setformer] Svm(inv(G)) imp (G INV_IM R = {inv(G)~[w]: w in (R * range(G))}). Proof:
    Suppose_not(f,r) ==> Svm(inv(f)) & (f INV_IM r /= {inv(f)~[y]: y in (r * range(f))})
--
-- Suppose that $f$ and $r$ furnish a counterexample to our assertion. Since Theorem 180 and Theorem 73
-- allow us to write $f INV_IM r$ as ${(inv(f) ON r)~[y]: y in domain(inv(f) ON r)}$,
-- the setformer inequality seen below would follow, and so there would exist an element c
-- in one of these sets but not the other.
--
	(f,r)-->T180 ==> range(inv(f) ON r) /= {inv(f)~[y]: y in (r * range(f))}
	(inv(f),r)-->T48 ==> Stat1: inv(f) ON r incin inv(f)
	(inv(f),r)-->T57 ==> Svm(inv(f) ON r)
	(inv(f) ON r)-->T73 ==>
		Stat2: {inv(f)~[y]: y in (r * range(f))} /= {(inv(f) ON r)~[y]: y in domain(inv(f) ON r)}
	(inv(f),r)-->T94 ==> domain(inv(f) ON r) = domain(inv(f)) * r
	f-->T99 ==> domain(inv(f) ON r) = r * range(f)
	c-->Stat2 ==>
		(c in {inv(f)~[y]: y in (r * range(f))}) eq (c notin {(inv(f) ON r)~[y]: y in domain(inv(f) ON r)})
--
-- If c is in the first set but not the second, it would follow since $domain(inv(f) ON r) = r * range(f)$
-- that there was some $y$ in $domain(inv(f) ON r)$ for which $inv(f)~[y] /= (inv(f) ON r)~[y]$, which is impossible.
-- Hence c must belong to the second of our two sets but not the first.
--
	Suppose ==> Stat3: (c in {inv(f)~[y]: y in (r * range(f))}) &
						(c notin {(inv(f) ON r)~[y]: y in domain(inv(f) ON r)})
	(y,y)-->Stat3 ==> (y in domain(inv(f) ON r)) & (inv(f)~[y] /= (inv(f) ON r)~[y])
	(inv(f),inv(f) ON r,y)-->T131 ==> false; Discharge ==>
				Stat4: (c in {(inv(f) ON r)~[y]: y in domain(inv(f) ON r)}) &
							(c notin {inv(f)~[y]: y in (r * range(f))})
--
-- However an equally elementary contradiction results in this case also, completing our proof.
--
	(yp,yp)-->Stat4 ==> (yp in domain(inv(f) ON r)) & (inv(f)~[yp] /= (inv(f) ON r)~[yp])
    (inv(f),inv(f) ON r,yp)-->T131 ==> false; Discharge ==> QED
--
-- It is equally easy to show that for 1-1 maps $g$ the inverse image under $g$ of a singleton set ${y}$ is
-- the image of the point $y$ under the inverse map $inv(g)$.
--
Theorem 182: [Inverse image of a range element] (one_1_map(G) & (Y in range(G))) imp (G INV_IM {Y} = {inv(G)~[Y]}). Proof:
    Suppose_not(g,y) ==> Stat1: one_1_map(g) & (y in range(g)) & ((g INV_IM {y}) /= {inv(g)~[y]})
--
-- Indeed, the negative of our assertion reduces to the set theoretic inequality seen below, and
-- since the first hand side of this inequality is plainly included in its left hand side, there
-- would have to exist an element u in the first of these sets but not the second.
--
	g-->T101 ==> one_1_map(inv(g))
	Use_def(one_1_map) ==> Stat2: Svm(inv(g))
	(g,{y})-->T181(Stat1,Stat2) ==> ({inv(g)~[v] : v in ({y} * range(g))} /= {inv(g)~[y]})
	Suppose ==> not({inv(g)~[v] : v in ({y} * range(g))} incs {inv(g)~[y]})
	ELEM ==> Stat3: inv(g)~[y] notin {inv(g)~[v] : v in ({y} * range(g))}
	y-->Stat3 ==> false; Discharge ==> Stat4: not({inv(g)~[v] : v in ({y} * range(g))} incin {inv(g)~[y]})
	u-->Stat4 ==> Stat5: (u in {inv(g)~[v] : v in ({y} * range(g))}) & (u /= inv(g)~[y])
--
-- But this supposition immediately leads to a contradiction wihc proves our theorem.
--
	v-->Stat5 ==> (u = inv(g)~[v]) & (v=y) & (u /= inv(g)~[y])
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the range of any map $g$ on the inverse image of a set $r$ by $g$
-- is the intersection of $r$ with the range of $g$.
--
Theorem 183: [Range of a map restricted to an inverse image] range(G ON (G INV_IM R)) incs (range(G) * R). Proof:
    Suppose_not(g,r) ==> Stat1: not(range(g ON (g INV_IM r)) incs (range(g) * r))
--
-- For supposing the contrary and using the definitions of the operators involved we are led to the
-- set-theoretic inequality seen below.
--
	c-->Stat1 ==> (c notin range(g ON (g INV_IM r))) & (c in range(g)) & (c in r)
	Use_def(ON) ==> c notin range({q: q in g | car(q) in (g INV_IM r)})
	Use_def(range) ==> (c notin {cdr(p): p in {q: q in g | car(q) in (g INV_IM r)}}) & (c in {cdr(p): p in g})
	SIMPLF ==> Stat2: (c in {cdr(p): p in g}) & (c notin {cdr(q): q in g | car(q) in (g INV_IM r)})
	(q1,q1)-->Stat2(Stat2*) ==> (c = cdr(q1)) & (q1 in g) & (car(q1) notin g INV_IM r)
	Use_def(INV_IM) ==> Stat3: car(q1) notin {car(t): t in g | cdr(t) in r}
	q1-->Stat3 ==> false; Discharge ==> QED
--
-- Next we show that for any single-valued map $g$ and set $a$, the range of $g$ on
-- the inverse image of $a$ under $g$ is $range(g) * a$.
--
Theorem 184: [Range of a single-valued map restricted to an inverse image] Svm(G) imp (range(G ON (G INV_IM A)) = range(G) * A). Proof:
Suppose_not(g,a) ==> AUTO
--
-- For supposing the contrary and using the definitions of the operators involved we are led to the
-- set-theoretic inequality seen below.
--
	(g,a)-->T183 ==> Svm(g) & (not(range(g ON (g INV_IM a)) incin range(g) * a))
	Use_def(range) ==> not({cdr(p): p in g ON (g INV_IM a)} incin {cdr(p): p in g} * a)
	Use_def(ON) ==> not({cdr(p): p in {q: q in g | car(q) in (g INV_IM a)}} incin {cdr(p): p in g} * a)
	SIMPLF ==> not({cdr(p): p in g | car(p) in (g INV_IM a)} incin {cdr(p): p in g} * a)
	Use_def(INV_IM) ==> Stat1: not({cdr(p): p in g | car(p) in {car(q): q in g | cdr(q) in a}} incin
									{cdr(p): p in g} * a)
	c-->Stat1 ==> Stat2: (c in {cdr(p): p in g | car(p) in {car(q): q in g | cdr(q) in a}}) &
								((c notin {cdr(p): p in g}) or (c notin a))
	p-->Stat2 ==> Stat3: (c = cdr(p)) & (p in g) & Stat4: (car(p) in {car(q): q in g | cdr(q) in a}) &
								((c notin {cdr(p): p in g}) or (c notin a))
	(q,p)-->Stat4 ==> Stat5: (c = cdr(p)) & (p in g) & (car(p) = car(q)) & (q in g) & (cdr(q) in a) & (c notin a)
	Use_def(Svm) ==>  Stat6: (FORALL x in g, y in g | (car(x) = car(y)) imp (x = y))
	(p,q)-->Stat6(Stat3*) ==> p = q
EQUAL(Stat5) ==> false; Discharge ==> QED
--
-- The following simple lemma tells us that for single-valued maps $g$ and sets $a$, $b$,
-- the inverse image of $b$ under the restriction of $g$ to the inverse image of $a$ is simply
-- the intersection $(g INV_IM a) * (g INV_IM b)$.
--
Theorem 185: [Inverse images by a single-valued map] Svm(G) imp ((G ON (G INV_IM A)) INV_IM B = (G INV_IM A) * (G INV_IM B)). Proof:
    Suppose_not(g,a,b) ==> Svm(g) & ((g ON (g INV_IM a)) INV_IM b /= (g INV_IM a) * (g INV_IM b))
--
-- For supposing the contrary, and using the definitions of "$INV_IM$" and "$ON$", we are led to the setformer
-- inequality seen below.
--
	Use_def(INV_IM) ==> {car(w): w in (g ON (g INV_IM a)) | cdr(w) in b} /=
								{car(w): w in g | cdr(w) in a} * {car(w): w in g | cdr(w) in b}
	Use_def(ON) ==> {car(w): w in (g ON (g INV_IM a)) | cdr(w) in b} =
								{car(w): w in {u: u in g | car(u) in (g INV_IM a)} | cdr(w) in b}
	SIMPLF() ==> {car(w): w in {u: u in g | car(u) in (g INV_IM a)} | cdr(w) in b} =
								{car(w): w in g | (car(w) in (g INV_IM a)) & (cdr(w) in b)}
	ELEM ==> {car(w): w in g | (car(w) in (g INV_IM a)) & (cdr(w) in b)} /=
								{car(w): w in g | cdr(w) in a} * {car(w): w in g | cdr(w) in b}
--
-- One more use of the definitions of "$INV_IM$" reduces this last inequality to the following still more
-- elementary form:
--
	Use_def(INV_IM) ==> {car(w): w in g | (car(w) in {car(u): u in g | cdr(u) in a}) & (cdr(w) in b)}
								 /= {car(w): w in g | cdr(w) in a} * {car(w): w in g | cdr(w) in b}
--
-- But it is easy to see that the condition appearing in the left-hand setformer in this last
-- inequality can be replaced by the condition $(cdr(w) in a) & (cdr(w) in b)$.
--
	Use_def(Svm) ==> Stat1: (FORALL x in g, y in g | (car(x) = car(y)) imp (x = y))
	Suppose ==> Stat2: {car(w): w in g | (car(w) in {car(u): u in g | cdr(u) in a}) & (cdr(w) in b)}
								 /= {car(w): w in g | (cdr(w) in a) & (cdr(w) in b)}
	c-->Stat2 ==> (c in g) & ((car(c) /= car(c) or
		(((car(c) in {car(u): u in g | (cdr(u) in a)}) & (cdr(c) in b)) & (not((cdr(c) in a) & (cdr(c) in b)))) or
		((not((car(c) in {car(u): u in g | (cdr(u) in a)}) & (cdr(c) in b))) & (cdr(c) in a) & (cdr(c) in b))))
	Suppose ==> Stat3: (((car(c) in {car(u): u in g | (cdr(u) in a)}) & (cdr(c) in b)) & (not((cdr(c) in a) & (cdr(c) in b))))
	v-->Stat3 ==> (v in g) & (car(c) = car(v)) & (cdr(v) in a)
	(v,c)-->Stat1 ==> c = v
	Discharge ==> (not((car(c) in {car(u): u in g | (cdr(u) in a)}) & (cdr(c) in b))) & (cdr(c) in a) & (cdr(c) in b)
	ELEM ==> Stat4: not(car(c) in {car(u): u in g | (cdr(u) in a)}) & (cdr(c) in b)
	c-->Stat4 ==> false;  Discharge ==>
		{car(w): w in g | (cdr(w) in a) & (cdr(w) in b)} /= {car(w): w in g | cdr(w) in a} * {car(w): w in g | cdr(w) in b}
--
-- But it is easy to see that this last inequality is impossible. Indeed, by set monotonicity
-- the left-hand side of this inequality is included in the right, so that the inequality would imply
-- the existence of a point $u$ such that $cdr(u) in a$, $cdr(u) in b$, whiel the conjuction
-- of these two conditions was false, and evident impossibility which completes the proof of our theorem.
--
	Set_monot() ==> {car(w): w in g | (cdr(w) in a) & (cdr(w) in b)} incin {car(w): w in g | cdr(w) in a}
	Set_monot() ==> {car(w): w in g | (cdr(w) in a) & (cdr(w) in b)} incin {car(w): w in g | cdr(w) in b}
	ELEM ==> Stat5: not({car(w): w in g | (cdr(w) in a) & (cdr(w) in b)} incs
					{car(w): w in g | cdr(w) in a} * {car(w): w in g | cdr(w) in b})
	d-->Stat5 ==> (d in {car(w): w in g | cdr(w) in a} * {car(w): w in g | cdr(w) in b}) &
					Stat6: (d notin {car(w): w in g | (cdr(w) in a) & (cdr(w) in b)})
	ELEM ==> Stat7: (d in {car(w): w in g | cdr(w) in a}) & Stat8: (d in {car(w): w in g | cdr(w) in b})
	u1-->Stat7 ==> (u1 in g) & (d = car(u1)) & (cdr(u1) in a)
	u2-->Stat8 ==> (u2 in g) & (d = car(u2)) & (cdr(u2) in b)
	(u1,u2)-->Stat1 ==> u1 = u2
	EQUAL ==> cdr(u1) in b
    u1-->Stat6 ==> false; Discharge ==> QED
--
-- It follows trivially using the principle of set monotonicity that the expression $g INV_IM a$
-- is monotone increasing in its second argument.
--
Theorem 186: [Monotonicity of inverse image] (B incin A) imp ((G INV_IM B) incin (G INV_IM A)). Proof:
    Suppose_not(b,a,g) ==> (b incin a) & (not((g INV_IM b) incin (g INV_IM a)))
	Set_monot ==> {car(p): p in g | cdr(p) in b} incin {car(p): p in g | cdr(p) in a}
    Use_def(INV_IM) ==> false; Discharge ==> QED
--
-- The following simple lemma tells us that successive restriction of a map $f$, first to a set
-- $a$ and then to $b$, produces the same result as restriction of $f$ to the intersection set $a * b$
--
Theorem 187: [Successive map restrictions] (((F ON A) ON B) = (F ON (A * B))). Proof:
    Suppose_not(f,a,b) ==> (f ON a) ON b /= f ON (a * b)
--
-- For a counterexample $f,a,b$ would imply the existence of a point $p$ which was in one
-- of the two sets in the following inequality but not the other, and evident impossibility
-- which proves our assertion.
--
	Use_def(ON) ==> {p: p in (f ON a) | car(p) in b} /= {p: p in f | car(p) in (a * b)}
	Use_def(ON) ==> {p: p in (f ON a) | car(p) in b} = {p: p in {q: q in f | car(q) in a} | car(p) in b}
	SIMPLF ==> Stat1: {p: p in f | (car(p) in a) & (car(p) in b)} /= {p: p in f | car(p) in (a * b)}
	Set_monot ==> {p: p in f | (car(p) in a) & (car(p) in b)} = {p: p in f | car(p) in (a * b)}
	Discharge ==> QED
--
-- ************************************************************************************************
--									Section 6: Finiteness
-- ************************************************************************************************
--
-- Our arguments till now have concerned ordinals and cardinals irrespective of whether they
-- are finite or infinite. Now we introduce the concept of finiteness and prove
-- its basic properties, in preparation for introduction of the set of integers and
-- derivation of the basic properties of integers.
--
Def 18: [Finiteness]
    Finite(s) := not(EXISTS f in OM | one_1_map(f) & (domain(f) = s) & (range(f) incin s) & (s /= range(f)))
--
-- We begin our work with the finiteness concept by proving the elementary but basic fact that
-- the null set is a finite cardinal.
--
Theorem 188: [0 is a finite cardinal] Ord(0) & Finite(0) & Card(0). Proof:
	Suppose_not ==> not(Ord(0) & Finite(0) & Card(0))
--
-- For the fact that $0$ is an ordinal is an immediate consequence of the definition of '$Ord$',
--
    Suppose ==> not Ord(0)
    Use_def(Ord) ==> (not(FORALL x in 0 | x incin 0)) or
	(not(FORALL x in 0, y in 0 | x in y or y in x or x = y))
    Suppose ==> Stat1: (not(FORALL x in 0 | x incin 0))
    c-->Stat1 ==> false; Discharge ==> Stat2: (not(FORALL x in 0, y in 0 | x in y or y in x or x = y))
    d-->Stat2 ==> false; Discharge ==> Ord(0)
--
-- Similarly, the fact that $0$ is a cardinal and is finite is an immediate consequence
-- of the definitions involved.
--
    Suppose ==> not Finite(0)
    Use_def(Finite) ==>
	Stat3:(EXISTS f in OM | one_1_map(f) & (domain(f) = 0) & (range(f) incin 0) & (0 /= range(f)))
    f-->Stat3 ==> (range(f) incin 0) & (0 /= range(f))
    Discharge ==> not Card(0)
    Use_def(Card) ==> (not Ord(0)) or
	(not(FORALL y in 0, f in OM | (not(domain(f) = y)) or (not(range(f) = 0)) or (not(Svm(f)))))
    ELEM ==>
	Stat4: not(FORALL y in 0, f in OM | (not(domain(f) = y)) or (not(range(f) = 0)) or (not(Svm(f))))
    a-->Stat4 ==> false; Discharge ==> QED
--
-- The following theorem states the important but elementary fact that subsets of a finite set are finite.
--
Theorem 189: [A subset of a finite set is finite] (Finite(S) & (S incs T)) imp Finite(T). Proof:
    Suppose_not(s,t) ==> Finite(s) & (s incs t) & (not Finite(t))
--
-- For suppose that there existed a finite set $s$ having an infinite subset $t$.
-- Then by definition there would be a 1-1 map $f$ of $t$ into a proper subset of itself.
-- This can be extended to a 1-1 map of $s$ into a proper subset of itself simply
-- by setting the extension to the identity map on $s - t$. But since $s$ is finite by assumption,
-- this is impossible.
--
    Use_def(Finite) ==>
	Stat1: (not(EXISTS g in OM | one_1_map(g) & (domain(g) = s) & (range(g) incin s) & (s /= range(g))))
    Use_def(Finite) ==>
	Stat2: (EXISTS h in OM  | one_1_map(h) & (domain(h) = t) & (range(h) incin t) & (t /= range(h)))
    h-->Stat2 ==> one_1_map(h) & (domain(h) = t) & (range(h) incin t) & (t /= range(h))
    (s - t)-->T115 ==> one_1_map(ident(s - t)) & (domain(ident(s - t)) = s - t) &
    							(range(ident(s - t)) = s - t)
    (h,ident(s - t))-->T88 ==> one_1_map(h + ident(s - t))
    (h,ident(s - t))-->T78 ==> domain(h + ident(s - t)) = domain(h) + (s - t)
    (h,ident(s - t))-->T79 ==> range(h + ident(s - t)) = range(h) + (s - t)
    (h + ident(s - t))-->Stat1 ==> false; Discharge ==> QED
--
-- Our next theorem states that if the domain of a 1-1 map is finite, so is its range.
-- This result is then easily generalized to single valued maps (Theorem 192 below).
--
Theorem 190: [One-one maps preserve finiteness] one_1_map(F) imp ((Finite(domain(F))) imp (Finite(range(F)))). Proof:
    Suppose_not(f2) ==> one_1_map(f2) & Finite(domain(f2)) & (not Finite(range(f2)))
--
-- If we suppose the contrary, then by definition there must exist a $g$ mapping $range(f2)$
-- into a proper subset of itself. But then $inv(f2) @ (g @ f2)$ is a 1-1 mapping of $domain(f2)$
-- into itself.
--
    Use_def(Finite) ==>
     Stat1: (not(EXISTS g in OM | one_1_map(g) & (domain(g) = domain(f2)) & (range(g) incin domain(f2)) & (range(g) /= domain(f2))))
    Use_def(Finite) ==>
	Stat2: (EXISTS g in OM | one_1_map(g) & (domain(g) = range(f2)) & (range(g) incin range(f2)) & (range(g) /= range(f2)))
    g-->Stat2 ==> one_1_map(g) & (domain(g) = range(f2)) &
    		(range(g) incin range(f2)) & (range(g) /= range(f2))
    f2-->T101 ==> one_1_map(inv(f2)) & (domain(f2) = range(inv(f2))) & (range(f2) = domain(inv(f2)))
    (g,f2)-->T133 ==> one_1_map(g @ f2)
    (inv(f2),g @ f2)-->T133 ==> one_1_map(inv(f2) @ (g @ f2))
    Use_def(one_1_map) ==> Svm(f2) & Svm(g) & Svm(inv(f2))
    (f2,g)-->T96 ==> (domain(g @ f2) = domain(f2)) & (range(g @ f2) = range(g))
    (g @ f2,inv(f2))-->T97 ==>
    	(domain(inv(f2) @ (g @ f2)) = domain(f2)) & (range(inv(f2) @ (g @ f2)) incin domain(f2))
--
-- and it is easily seen that $range(inv(f2) @ (g @ f2))$ must be a proper subset of $domain(f2)$,
-- contradicting the finiteness of $domain(f2)$, and so proving the present theorem.
--
    (inv(f2),g @ f2)-->T95 ==> range(inv(f2) @ (g @ f2)) = range(inv(f2) ON range(g @ f2))
    EQUAL ==> range(inv(f2) @ (g @ f2)) = range(inv(f2) ON range(g))
    (inv(f2),range(g))-->T98 ==> range(inv(f2)) /= range(inv(f2) ON range(g))
    (inv(f2))-->T67 ==> (inv(f2) ON domain(inv(f2))) = inv(f2)
    EQUAL ==> range(inv(f2) ON domain(inv(f2))) /= range(inv(f2) ON range(g))
    ELEM ==> range(inv(f2) @ (g @ f2)) /= domain(f2)
    (inv(f2) @ (g @ f2))-->Stat1 ==> false; Discharge ==> QED
--
-- If $s$ is a 1-1 map, the implication given in the preceding theorem
-- can be strengthened to an equivalence:
--
Theorem 191: [One-one maps preserve finiteness, 2] one_1_map(F) imp (Finite(domain(F)) eq Finite(range(F))). Proof:
    Suppose_not(f) ==> one_1_map(f) & (not(Finite(domain(f)) eq Finite(range(f))))
--
-- For in this case Theorem 190 applies to both $f$ and its inverse,
-- giving us a pair of implications, and so yielding the asserted equivalence.
--
    f-->T190 ==> Finite(domain(f)) imp Finite(range(f))
    f-->T101 ==> one_1_map(inv(f)) & (domain(inv(f)) = range(f)) & (range(inv(f)) = domain(f))
    (inv(f))-->T190 ==>  Finite(domain(inv(f))) imp Finite(range(inv(f)))
    EQUAL ==> Finite(range(f)) imp Finite(domain(f))
    Discharge ==> QED
--
-- We can also extend Theorem 190 from 1-1 maps to single-valued maps in general:
--
Theorem 192: [A single-valued map with finite domain has a finite range]
	(Svm(F) & Finite(domain(F))) imp Finite(range(F)). Proof:
    Suppose_not(f) ==> Svm(f) & Finite(domain(f)) & (not Finite(range(f)))
--
-- The result follows easily from Theorem 191 if we use Theorem 138, which tells us that
-- there is a 1-1 map, partially inverse to $f$, which maps $range(f)$ into a subset of $domain(f)$.
--
    (f)-->T138 ==> Stat1: (EXISTS h | (domain(h) = range(f)) & (range(h) incin domain(f)) & one_1_map(h) &
    									(FORALL x in range(f) | f~[h~[X]] = X))
    invm-->Stat1 ==> (domain(invm) = range(f)) & (range(invm) incin domain(f)) & one_1_map(invm)
    EQUAL ==> not Finite(domain(invm))
--
-- At this point we have the desired contradiction, because $not Finite(range(invm))$
-- and hence $not Finite(domain(f))$.
--
    invm-->T191 ==> false
    Discharge ==> QED
--
-- As an application of Theorem 192, we develop the following mini-theory
-- showing that the image of any finite set is a finite set.
--
THEORY finite_image(e(x),s0)
	Finite(s0)
END finite_image
--
ENTER_THEORY finite_image
--
Theorem finite_image.1: [Any image of a finite set is finite] Finite({e(x): x in s0}). Proof:
Suppose_not ==> AUTO
	ELEM ==> Svm({[x,e(x)]: x in s0}) & (domain({[x,e(x)]: x in s0}) = s0) & (range({[x,e(x)]: x in s0}) = {e(x): x in s0})
	Assump ==> Finite(s0)
	EQUAL ==> Finite(domain({[x,e(x)]: x in s0}))
	({[x,e(x)]: x in s0})-->T192 ==> Finite(range({[x,e(x)]: x in s0}))
EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY finite_image
--
--THEORY finite_image(e(x),s0)
--	Finite(s0)
--==>
--	Finite({e(x): x in s0})
--END finite_image
--
--
-- The following corollary to Theorem 191 states that
-- a set is finite if and only if its cardinality is finite.
-- The proof merely applies Theorem 191 twice, once to a 1-1 map from $#s$ to $s$,
-- and once to the inverse of this map.
--
Theorem 193: [A set is finite if and only if its cardinality is finite] Finite(S) eq Finite(#S). Proof:
    Suppose_not(s) ==> not(Finite(s) eq Finite(#s))
    (s)-->T156 ==> Stat1: Card(#s)  and  (EXISTS f in OM | one_1_map(f)  and  (range(f) = s)  and  (domain(f) = #s))
    (f)-->Stat1 ==> one_1_map(f) & (domain(f) = s) & (range(f) = #s)
    f-->T191 ==> Finite(s) imp Finite(#s)
    f-->T101 ==> one_1_map(inv(f)) & (range(inv(f)) = #s) & (domain(inv(f)) = s)
    f-->T191 ==> Finite(#s) imp Finite(s)
    Discharge ==> QED
--
-- Even if $t$ is a proper subset of a general set $s$ we can only assert that $#t$ is no greater than $#s$.
-- But if $s$ is finite, then, as the following theorem shows, $#t$ must be less than $s$.
--
Theorem 194: [Proper subsets of a finite set have fewer elements] (Finite(S) & (T incin S) & (T /= S)) imp (#T in #S). Proof:
    Suppose_not(s,t) ==> Finite(s) & (t incin s) & (t /= s) & (#t notin #s)
--
-- For, proceeding by contradiction, suppose that $t$ is a proper subset of the finite set $s$ and $#t notin #s$.
-- By Theorem 156, there exist 1-1 maps $f$ and $g$ of $#s$ and $#t$ to $s$ and $t$ respectively, and then
-- $inv(g)$ is a 1-1 map of $#s$ to $s$.
--
    t-->T156 ==> Stat1: Card(#t) & Ord(#t) &
    	(EXISTS f in OM | (one_1_map(f) & (range(f) = t) & (domain(f) = #t)))
    f-->Stat1 ==> one_1_map(f) & (range(f) = t) & (domain(f) = #t)
    s-->T156 ==> Stat2:  Card(#s) & Ord(#s) &
    	(EXISTS f in OM | (one_1_map(f) & (range(f) = s) & (domain(f) = #s)))
    g-->Stat2 ==> Card(#s) & one_1_map(g) & (domain(g) = #s) & (range(g) = s)
    g-->T101 ==> one_1_map(inv(g)) & (domain(inv(g)) = s) & (range(inv(g)) = #s)
--
-- Since $#t notin #s$ and both are ordinals, it follows by Theorem 170 and Theorem 34 that $#t = #s$, and so
-- $f @ inv(g)$ is a 1-1 map of $s$ onto $t$. Thus by the definition of finiteness
-- $t$ cannot be a proper subset of $s$, a contradiction proving our theorem.
--
    (t,s)-->T170 ==> #s incs #t
    (#s,#t)-->T34 ==>  #t = #s
    (inv(g),f)-->T96 ==> (domain(f @ inv(g)) = s) & (range(f @ inv(g)) = t)
    (f,inv(g))-->T133 ==> one_1_map(f @ inv(g))
    Use_def(Finite) ==> Stat3: not (EXISTS f in OM | one_1_map(f) & (domain(f) = s) & (range(f) incin s) & (range(f) /= s))
    (f @ inv(g))-->Stat3 ==> false; Discharge ==> QED
--
-- Another property of finite sets (which could be used to define them)
-- is stated in the following theorem: a finite set is not the image of any proper subset of
-- itself by a single-valued map.
--
Theorem 195: [A set is finite if and only if it is not the single-valued image of any of its finite subsets] Finite(S) eq
	(not(EXISTS f in OM | (Svm(f) & (range(f) = S) & (domain(f) incin S) & (S /= domain(f))))). Proof:
    Suppose_not(s) ==> not(Finite(s) eq
    	(not(EXISTS f in OM | (Svm(f) & (range(f) = s) & (domain(f) incin s) & (s /= domain(f))))))
--
-- First suppose the contrary, and first consider the case in which $s$ is finite but there exists a
-- single-valued map $f$ of a proper subset $s$ of onto $s$. By Theorem 138,
-- this has a 1-1 partial inverse mapping $s$ to a proper subset of $s$,
-- which is impossible by definition of finiteness. Hence we need only consider the
-- case in which $s$ is not finite, but there exists no single-valued map $f$ of a proper subset of $s$ onto $s$.
--
    Suppose ==> Finite(s) & Stat1: (EXISTS f in OM | (Svm(f) & (range(f) = s) & (domain(f) incin s) &
    								(s /= domain(f))))
    f-->Stat1 ==> Svm(f) & (range(f) = s) & (domain(f) incin s) & (s /= domain(f))
    f-->T138 ==> Stat2: (EXISTS h | ((domain(h) = range(f)) & (range(h) incin domain(f)) & one_1_map(h)) &
    						(FORALL x in range(f) | ((f~[h~[x]]) = x)))
    h-->Stat2 ==> (domain(h) = s) & (range(h) incin s) & (s /= range(h)) & one_1_map(h)
    Use_def(Finite) ==>
    	Stat3: not(EXISTS h in OM | ((one_1_map(h) & (domain(h) = s) & (range(h) incin s) & (range(h) /= s))))
    h-->Stat3 ==> false
    Discharge ==>  (not(Finite(s))) &
	Stat4: (not(EXISTS f in OM | Svm(f) & (range(f) = s) & (domain(f) incin s) & (s /= domain(f))))
--
-- Since by definition of finiteness there exists a 1-1 map $g$ of a proper subset of $s$ onto $s$, and
-- since the inverse of $g$ is also a 1-1 map, we have a contradiction in this case also, and so
-- our theorem is proved.
--
    Use_def(Finite) ==> Stat5:
    	(EXISTS f in OM | (one_1_map(f) & (domain(f) = s) & (range(f) incin s) & (s /= range(f))))
    g-->Stat5 ==> one_1_map(g) & (domain(g) = s) & (range(g) incin s) & (s /= range(g))
    g-->T101 ==> one_1_map(inv(g)) & (range(inv(g)) = s) & (domain(inv(g)) incin s) & (s /= domain(inv(g)))
    Use_def(one_1_map) ==> Svm(inv(g))
    (inv(g))-->Stat4 ==> false; Discharge ==> QED
--
-- Since members of an ordinal $s$ are also subsets of $s$, it follows immediately from Theorem 189
-- that any member of a finite ordinal is finite.
--
Theorem 196: [Members of a finite ordinal are finite] (Ord(S) & Finite(S) & (T in S)) imp Finite(T). Proof:
    Suppose_not(s,t) ==> AUTO
    (s,t)-->T13 ==> false; Discharge ==> QED
--
-- A further corollary of Theorem 195 is that any infinite ordinal is larger than any finite ordinal:
--
Theorem 197: [Any infinite ordinal is larger than any finite ordinal]
	(Ord(S) & Ord(T) & (not Finite(S)) & Finite(T)) imp (T in S). Proof:
    Suppose_not(s,t) ==> Ord(s) & Ord(t) & (not Finite(s)) & Finite(t) & (not(t in s))
    (s,t)-->T31 ==> (s in t) or (t in s) or (s = t)
 	EQUAL ==> s /= t
    ELEM ==> s in t
    (t,s)-->T196 ==> false; Discharge ==> QED
--
-- To exploit the fact that sets which are in 1-1 correspondence have the same cardinality,
-- we sometimes need to make use of elementary constructions of such maps.
-- The following lemma captures one such case: elements of a set $s$ can always be interchanged
-- by some 1-1 map.
--
Theorem 198: [Interchange lemma]
    ((X in S) & (Y in S)) imp (EXISTS f | one_1_map(f) & (range(f) = S) & (domain(f) = S) & ((f~[X]) = Y) & ((f~[Y]) = X)). Proof:
Suppose_not(a,s,b) ==>
	Stat1: (a in s) & (b in s) & Stat2: (not(EXISTS f | one_1_map(f) & (range(f) = s) & (domain(f) = s) & ((f~[a]) = b) & ((f~[b]) = a)))
--
-- For the desired map $f$ can be defined by $(f~[x]) = if x = a then b elseif x = b then a else x end if$,
--
	Loc_def ==> f = {[x,if x = a then b elseif x = b then a else x end if]: x in s}
--
-- and it is easily seen that the range of this map is $s$.
--
        APPLY(x9_thryvar:c2,y9_thryvar:d2) fcn_symbol(f(x)->if x = a then b elseif x = b then a else x end if,g->f,s->s) ==>
		Stat3: (((c2 in s) & (d2 in s) & (if c2 = a then b elseif c2 = b then a else c2 end if =
					if d2 = a then b elseif d2 = b then a else d2 end if) & (c2 /= d2)) or one_1_map(f))
        APPLY() fcn_symbol(f(x)->if x = a then b elseif x = b then a else x end if,g->f,s->s) ==>
		Stat4: (FORALL x | (x in s) imp ((f~[x]) = if x = a then b elseif x = b then a else x end if)) &
		Stat5: Svm(f) & (domain(f) = s) &
		(range(f) = {if x = a then b elseif x = b then a else x end if: x in s})
        Suppose ==> Stat6: s /= {if x = a then b elseif x = b then a else x end if: x in s}
            c-->Stat6 ==> Stat7: (c in s) eq (c notin {if x = a then b elseif x = b then a else x end if: x in s})
            Suppose ==> Stat8: (c in s) & Stat9: (c notin {if x = a then b elseif x = b then a else x end if: x in s})
                Suppose ==> c = b
                a-->Stat9 ==> false; Discharge ==> c /= b
                Suppose ==> c = a
                b-->Stat9 ==> false; Discharge ==> c /= a
            c-->Stat9 ==> false; Discharge ==> not((c in s) & (c notin {if x = a then b elseif x = b then a else x end if: x in s}))
            (Stat7*)ELEM ==> Stat10: (c notin s) & Stat11: (c in {if x = a then b elseif x = b then a else x end if: x in s})
            d-->Stat11(Stat10*) ==> Stat12: (c = if d = a then b elseif d = b then a else d end if) & (d in s) & (c notin s)
        (Stat1,Stat12)Discharge ==> Stat13: range(f) = s
--
-- The fact that $f$ is 1-1 is also elementary, so $f$ has all the properties which our theorem asserts.
--
        (Stat3*)ELEM ==> Stat14: one_1_map(f)
        b-->Stat4(Stat1,Stat1*) ==> Stat15: (f~[b]) = a
        a-->Stat4(Stat1,Stat1*) ==> Stat16: (f~[a]) = b
f-->Stat2(Stat13,Stat4,Stat14,Stat16,Stat15) ==> false; Discharge ==> QED
--
-- The following utility lemma gives us expressions for the map restriction of any single-valued map,
-- and for the range and domain of this restriction.
--
-- Using Theorem 198, we can easily prove that the successor set of any finite set is also finite.
--
Theorem 199: [Adding one element to a finite set leaves it finite] Finite(S) eq Finite(S + {X}). Proof:
    Suppose_not(s,a) ==> AUTO
--
-- Since any subset of a finite set is finite, our theorem can only be false
-- if $s$ is finite and $s + {a}$ is not, in which case $a$ is not in $s$ and there must exist
-- a 1-1 map $g$ of $s + {a}$ into a subset of $s + {a}$ which omits some element $c$ of $s + {a}$.
--
    ELEM ==> Finite(s) & (not Finite(s + {a}))
    Suppose ==> s = s + {a}
    EQUAL ==> false; Discharge ==> a notin s
    Use_def(Finite) ==>
	Stat1: (EXISTS f in OM | one_1_map(f) & (domain(f) = s + {a}) & (range(f) incin (s + {a})) &
			((s + {a}) /= range(f))) &
	Stat2: (not(EXISTS f in OM | one_1_map(f) & (domain(f) = s) & (range(f) incin s) & (s /= range(f))))
    g-->Stat1 ==> one_1_map(g) & (domain(g) = s + {a}) & Stat3: (s + {a} /= range(g)) & (range(g) incin (s + {a}))
    c-->Stat3 ==> (c in s + {a}) & (c notin range(g))
    ELEM ==> (a notin s) & (a in domain(g)) & (c in domain(g)) & (c notin range(g))
--
-- But by Theorem 198 there is a 1-1 map $f$ of $s + {a}$ onto itself which interchanges $a$ and $c$.
-- The product map $f @ g$ is therefore a 1-1 map $f$ of $s + {a}$ into itself whose range omits $a$.
--
    (a,domain(g),c)-->T198 ==> Stat4: (EXISTS f | one_1_map(f) & (range(f) = domain(g)) & (domain(f) = domain(g)) &
    				(f~[a] = c) & (f~[c] = a))
    f-->Stat4 ==> one_1_map(f) & (range(f) = domain(g)) & (domain(f) = domain(g)) &
    				(f~[a] = c) & (f~[c] = a)
    (f,g)-->T95 ==> (range(f @ g) = range(f ON range(g))) & (domain(f @ g) = s + {a})
    Use_def(one_1_map) ==> Svm(f)
    Suppose ==> a in range(f ON range(g))
    (f,range(g))-->T123 ==> Stat5: a in {f~[x]: x in domain(f) | x in range(g)}
     e-->Stat5 ==> (a = f~[e]) & (e in domain(f)) & (e in range(g))
   	 ELEM ==> (c in domain(f)) & (a = f~[c])
   	(f,e,c)-->T127 ==> false; Discharge ==> a notin range(f @ g)
--
-- Hence the restriction of $f$ to $s$ is a 1-1 mapping of $s$ into itself.
--
    (f,range(g))-->T80 ==> range(f ON range(g)) incin (s + {a})
    ELEM ==> range(f @ g) incin s
    (f,g)-->T133 ==> one_1_map(f @ g)
 	((f @ g),s)-->T58 ==> one_1_map((f @ g) ON s)
 	(f @ g,s)-->T94 ==> domain((f @ g) ON s) = s
 	(f @ g,s)-->T80 ==> range((f @ g) ON s) incin s
--
-- But it is easily seen that $(f @ g)~[a]$ must be an element of $s$,
--
 	ELEM ==> a in domain(f @ g)
 	Use_def(one_1_map) ==> Svm(f @ g)
 	(a,f @ g)-->T71 ==> (f @ g)~[a] in s
--
-- and that $(f @ g)~[a]$ is not a member of $range((f @ g) ON s)$
--
	(f @ g)-->T72 ==> f @ g = {[x,(f @ g)~[x]]: x in domain(f @ g)}
 	EQUAL ==> f @ g = {[x,(f @ g)~[x]]: x in (s + {a})}
 	Suppose ==> (f @ g)~[a] in range((f @ g) ON s)
 	Use_def(ON) ==> (f @ g)~[a] in range({x in (f @ g) | car(x) in s})
 	EQUAL ==> (f @ g)~[a] in range({x in {[x,(f @ g)~[x]]: x in (s + {a})} | car(x) in s})
 	SIMPLF ==> (f @ g)~[a] in range({[x,(f @ g)~[x]]: x in (s + {a}) | car([x,(f @ g)~[x]]) in s})
 	Use_def(range) ==>
 		(f @ g)~[a] in {cdr(y): y in {[x,(f @ g)~[x]]: x in (s + {a}) | car([x,(f @ g)~[x]]) in s}}
 	SIMPLF ==> Stat6: (f @ g)~[a] in {cdr([x,(f @ g)~[x]]): x in (s + {a}) | car([x,(f @ g)~[x]]) in s}
 	b-->Stat6 ==> (b in s + {a}) & (car([b,(f @ g)~[b]]) in s) & ((f @ g)~[a] = cdr([b,(f @ g)~[b]]))
 	ELEM ==> ((f @ g)~[a] = (f @ g)~[b]) & (b in s)
 	(f @ g,a)-->T103 ==> inv(f @ g)~[(f @ g)~[a]] = a
 	(f @ g,b)-->T103 ==> inv(f @ g)~[(f @ g)~[b]] = b
	EQUAL ==> a = b
	Discharge ==> range((f @ g) ON s) /= s
--
-- Therefore $(f @ g) ON s$ is a 1-1 mapping of $s$ into a proper subset of itself, violating our
-- assumption that $s$ is finite, and thereby proving the present theorem.
--
	Use_def(Finite) ==> Stat7: not(EXISTS f in OM |
	(one_1_map(f) & (domain(f) = s) & (range(f) incin s) & (s /= range(f))))
    ((f @ g) ON s)-->Stat7 ==> false; Discharge ==> QED
--
-- Theorem 199 has the following obvious corollary.
--
Theorem 200: [Finiteness of successor set] Finite(S) imp Finite(next(S)). Proof:
	Suppose_not(s) ==> Finite(s) & (not Finite(next(s)))
    Use_def(next) ==> next(s) = s + {s}
    (s,s)-->T199 ==> Finite(s + {s})
    EQUAL ==> false; Discharge ==> QED
--
-- The following equally obvious corollaries of Theorem 199 are also useful.
-- The fist simply states that any singleton is finite.
--
Theorem 201: [Singletons are finite] Finite({S}). Proof:
	Suppose_not(s) ==> not Finite({s})
    T188 ==> Finite(0)
    (0,s)-->T199 ==> Finite(0 + {s})
    ELEM ==> 0 + {s} = {s}
    EQUAL ==> false; Discharge ==> QED
--
-- Our next elementary result states that any unordered pair is also a finite set.
--
Theorem 202: [Doubletons are finite] Finite({S,T}). Proof:
Suppose_not(s,t) ==> not Finite({s,t})
--
-- For assuming the contrary would lead to a contradiction, since
-- prior theorems ensure that $Finite({s})$ and, consequently
-- $Finite({s} + {t})$
--
--?    T201 ==> Finite({s})
	s-->T201 ==> AUTO
	({s},t)-->T199 ==> AUTO
	TELEM ==> {s} + {t} = {s,t}
	EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the set whose existence is asserted by the Axiom of Infinity
-- must actually be infinite.
--
Theorem 203: [The basic infinite set is not finite] not(Finite(s_inf)). Proof:
	Suppose_not ==> Finite(s_inf)
    Loc_def ==> g = {[x,{x}]: x in s_inf}
--
-- For by the axiomatic assumption defining $s_inf$, the single-valued map ${[x,{x}]: x in s_inf}$
-- sends $s_inf$ into itself.
--
    APPLY(x9_thryvar:a1,y9_thryvar:a2) fcn_symbol(f(x)->{x},g->g,s->s_inf) ==>
    	Svm(g) & (domain(g) = s_inf) & (range(g) = {{x}: x in s_inf}) &
    		((((a1 in s_inf) & (a2 in s_inf)) & ({a1} = {a2}) & (a1 /= a2)) or one_1_map(g))
    Suppose ==> Stat1: not (range(g) incin s_inf)
    c-->Stat1 ==> Stat2: (c in {{x}: x in s_inf}) & (not c in s_inf)
    d-->Stat2 ==> (d in s_inf) & (c = {d}) & (not c in s_inf)
    T00 ==> (s_inf /= 0) & Stat3: (FORALL x in s_inf | {x} in s_inf)
    d-->Stat3 ==> (d in s_inf) imp ({d} in s_inf)
    Discharge ==> range(g) incin s_inf
--
-- But it is easily seen using the axiom of choice that $arb(s_inf)$ cannot be in the range of the map $g$.
-- Hence $g$ is a 1-1 map which maps $s_inf$ into a proper subset of itself, contradicting
-- the definition of finiteness, and thereby proving our theorem
--
	T00 ==> s_inf /= 0
    s_inf-->T0 ==> (arb(s_inf) in s_inf) & (arb(s_inf) * s_inf = 0)
    Suppose ==> range(g) = s_inf
    ELEM ==> Stat4: arb(s_inf) in {{x}: x in s_inf}
    e-->Stat4 ==> (e in s_inf) & (arb(s_inf) = {e})
    Discharge ==> range(g) /= s_inf
    Suppose ==> not one_1_map(g)
    Discharge ==> one_1_map(g)
    Use_def(Finite) ==>
    	Stat5: not(EXISTS f in OM | (one_1_map(f) & (domain(f) = s_inf) & (range(f) incin s_inf) & (s_inf /= range(f))))
    g-->Stat5 ==> false; Discharge ==> QED
--
-- It follows as a corollary of the preceding theorem that $#s_inf$ is an infinite cardinal.
--
Theorem 204: [Infinite cardinality theorem] not Finite(#s_inf). Proof:
	Suppose_not ==> Finite(#s_inf)
    s_inf-->T193 ==> Finite(#s_inf) eq Finite(s_inf)
    T203 ==> not(Finite(s_inf))
    Discharge ==> QED
--
-- The next theorem tells us that for finite sets there is no difference
-- between ordinals and cardinals, since all finite ordinals are cardinals.
--
Theorem 205: [All finite ordinals are cardinals] (Ord(X) & Finite(X)) imp Card(X). Proof+:
    Suppose_not(x) ==> Ord(x) & Finite(x) & (not Card(x))
--
-- For if $x$ is a finite ordinal which is not a cardinal, then by definition
-- there must exist a single-valued map $f$ of a member $y$ of $x$ onto $x$.
-- Plainly $y$ must be an ordinal and a proper subset of $x$.
--
    Use_def(Card) ==>
	Stat1: not(FORALL y in x, f in OM | (not(domain(f) = y)) or (not(range(f) = x)) or (not(Svm(f))))
    (y,f)-->Stat1 ==> (domain(f) = y) & (y in x) & (range(f) = x) & Svm(f)
    (x,y)-->T34 ==> (y incin x)
    ELEM ==> y /= x
--
-- By Theorem 138, $f$ has a 1-1 partial inverse $h$, whose domain is $range(f)$ and whose range is
-- a subset of $domain(f)$. Since $x$ is finite, this must map $x$ onto all of itself,
-- contradicting the fact that $y = domain(f)$ is a proper subset of $x$. This contradiction proves our theorem.
--
    f-->T138 ==> Stat2: (EXISTS h | ((domain(h) = range(f)) & (range(h) incin domain(f)) & one_1_map(h)) &
    								(FORALL x in range(f) | f~[h~[x]] = x))
    h-->Stat2 ==> (domain(h) = range(f)) & (range(h) incin domain(f)) & one_1_map(h)
    Use_def(Finite) ==>
	Stat3: not(EXISTS p in OM | one_1_map(p) & (domain(p) = x) & (range(p) incin x) & (x /= range(p)))
    h-->Stat3 ==> not(one_1_map(h) & (domain(h) = x) & (range(h) incin x) & (x /= range(h)))
    Discharge ==> QED
--
--
--
--
THEORY setformer_meet_join(s,t,h(u,v),R(u,v),Q(u,v))
END setformer_meet_join
--
ENTER_THEORY setformer_meet_join
--
Theorem setformer_meet_join.1: [Disjunction in a setformer] {h(u,v): u in s, v in t | R(u,v) or Q(u,v)} = ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)}). Proof:
    Suppose_not ==> Stat1: {h(u,v): u in s, v in t | R(u,v) or Q(u,v)} /= ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)})
    c-->Stat1 ==> (c in {h(u,v): u in s, v in t | R(u,v) or Q(u,v)}) eq (c notin ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)}))
    Suppose ==> (c notin ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)})) & Stat2: (c in {h(u,v): u in s, v in t | R(u,v) or Q(u,v)})
        ELEM ==> Stat3: (c notin {h(u,v): u in s, v in t | Q(u,v)}) & (c notin {h(u,v): u in s, v in t | R(u,v)})
        (u,v)-->Stat2 ==> (c = h(u,v)) & (u in s) & (v in t) & (R(u,v) or Q(u,v))
    (u,v,u,v)-->Stat3 ==> false; Discharge ==> (c in ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)})) & Stat4: (c notin {h(u,v): u in s, v in t | R(u,v) or Q(u,v)})
    ELEM ==> (c in {h(u,v): u in s, v in t | R(u,v)}) or (c in {h(u,v): u in s, v in t | Q(u,v)})
    Suppose ==> Stat5: c in {h(u,v): u in s, v in t | R(u,v)}
        (up,vp)-->Stat5 ==> (c = h(up,vp)) & (up in s) & (vp in t) & R(up,vp)
    (up,vp)-->Stat4 ==> false; Discharge ==> Stat6: c in {h(u,v): u in s, v in t | Q(u,v)}
    (uq,vq)-->Stat6 ==> (c = h(uq,vq)) & (uq in s) & (vq in t) & Q(uq,vq)
    (uq,vq)-->Stat4 ==> false; Discharge ==> QED
--
Theorem setformer_meet_join.2: [Conjunction in a setformer] {h(u,v): u in s, v in t | R(u,v) & Q(u,v)} incin ({h(u,v): u in s, v in t | R(u,v)} * {h(u,v): u in s, v in t | Q(u,v)}). Proof:
    Suppose_not ==> Stat1: not({h(u,v): u in s, v in t | R(u,v) & Q(u,v)} incin ({h(u,v): u in s, v in t | R(u,v)} * {h(u,v): u in s, v in t | Q(u,v)}))
        c-->Stat1 ==> (c notin ({h(u,v): u in s, v in t | R(u,v)} * {h(u,v): u in s, v in t | Q(u,v)})) & Stat2: (c in {h(u,v): u in s, v in t | R(u,v) & Q(u,v)})
        ELEM ==> Stat3: (c notin {h(u,v): u in s, v in t | Q(u,v)}) or (c notin {h(u,v): u in s, v in t | R(u,v)})
        (u,v)-->Stat2 ==> (c = h(u,v)) & (u in s) & (v in t) & (R(u,v) & Q(u,v))
        Suppose ==> Stat4: c notin {h(u,v): u in s, v in t | Q(u,v)}
        (u,v)-->Stat4 ==> false; Discharge ==> Stat5: c notin {h(u,v): u in s, v in t | R(u,v)}
    (u,v)-->Stat5 ==> false; Discharge ==> QED
--
Theorem setformer_meet_join.3: [Implication in a setformer] (FORALL u in s, v in t | Q(u,v) imp R(u,v)) imp ({h(u,v): u in s, v in t | Q(u,v)} incin {h(u,v): u in s, v in t | R(u,v)}). Proof:
    Suppose_not ==> Stat1: (FORALL u in s, v in t | Q(u,v) imp R(u,v)) & Stat2: (not({h(u,v): u in s, v in t | Q(u,v)} incin {h(u,v): u in s, v in t | R(u,v)}))
        (u,v)-->Stat2 ==> (u in s) & (v in t) & Q(u,v) & (not(R(u,v)))
    (u,v)-->Stat1 ==> false; Discharge ==> QED
--
Theorem setformer_meet_join.4: [Setformer cardinality inclusion, two-variable case] #{[u,v]: u in s, v in t | R(u,v)} incs #{h(u,v): u in s, v in t | R(u,v)}. Proof:
    Suppose_not ==> not(#{[u,v]: u in s, v in t | R(u,v)} incs #{h(u,v): u in s, v in t | R(u,v)})
        APPLY() Must_be_svm_2(b2(u,v)->h(u,v), s->s, t->t, P2(u,v)->R(u,v)) ==>
			Svm({[[u,v],h(u,v)]: u in s, v in t | R(u,v)}) &
			(domain({[[u,v],h(u,v)]: u in s, v in t | R(u,v)}) = {[u,v]: u in s, v in t | R(u,v)}) &
			(range({[[u,v],h(u,v)]: u in s, v in t | R(u,v)}) = {h(u,v): u in s, v in t | R(u,v)})
--        TELEM ==> Svm({[[u,v],h(u,v)]: u in s, v in t | R(u,v)})
--        TELEM ==> (domain({[[u,v],h(u,v)]: u in s, v in t | R(u,v)}) = {[u,v]: u in s, v in t | R(u,v)}) &
--			(range({[[u,v],h(u,v)]: u in s, v in t | R(u,v)}) = {h(u,v): u in s, v in t | R(u,v)})
	({[[u,v],h(u,v)]: u in s, v in t | R(u,v)})-->T171 ==> #domain({[[u,v],h(u,v)]: u in s, v in t | R(u,v)}) incs #range({[[u,v],h(u,v)]: u in s, v in t | R(u,v)})
    EQUAL ==> false; Discharge ==> QED
--
Theorem setformer_meet_join.5: [Setformer finiteness implication, two-variable case] Finite({[u,v]: u in s, v in t | R(u,v)}) imp Finite({h(u,v): u in s, v in t | R(u,v)}). Proof:
    Suppose_not ==> Finite({[u,v]: u in s, v in t | R(u,v)}) & (not Finite({h(u,v): u in s, v in t | R(u,v)}))
        Tsetformer_meet_join.4 ==> (#({[u,v]: u in s, v in t | R(u,v)})) incs (#({h(u,v): u in s, v in t | R(u,v)}))
        ({[u,v]: u in s, v in t | R(u,v)})-->T193 ==> Finite(#{[u,v]: u in s, v in t | R(u,v)})
        (#({[u,v]: u in s, v in t | R(u,v)}),#({h(u,v): u in s, v in t | R(u,v)}))-->T189 ==> Finite(#({h(u,v): u in s, v in t | R(u,v)}))
    (#({h(u,v): u in s, v in t | R(u,v)}))-->T193 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY setformer_meet_join
--
--THEORY setformer_meet_join(s,t,h(u,v),R(u,v),Q(u,v))
--==>
--    {h(u,v): u in s, v in t | (R(u,v) or Q(u,v))} = ({h(u,v): u in s, v in t | R(u,v)} + {h(u,v): u in s, v in t | Q(u,v)})
--    {h(u,v): u in s, v in t | R(u,v) & Q(u,v)} incin ({h(u,v): u in s, v in t | R(u,v)} * {h(u,v): u in s, v in t | Q(u,v)})
--    (FORALL u in s, v in t | Q(u,v) imp R(u,v)) imp ({h(u,v): u in s, v in t | Q(u,v)} incin {h(u,v): u in s, v in t | R(u,v)})
--    #{[u,v]: u in s, v in t | R(u,v)} incs #{h(u,v): u in s, v in t | R(u,v)}
--    Finite({[u,v]: u in s, v in t | R(u,v)}) imp Finite({h(u,v): u in s, v in t | R(u,v)})
--END setformer_meet_join
--
--
-- ************************************************************************************************
--			Section 7: The set of all Integers, basic arithmetic of integers and cardinals
-- ************************************************************************************************
--
-- Now we can take a decisive step into the realm of traditional mathematics by defining the set of
-- positive integers as the smallest infinite cardinal. These are the 'unsigned' integers,
-- including $0$. The proofs of their properties with which we now continue prepare for
-- subsequent introduction of the signed integers, from these the rational and real numbers,
-- and finally the complex numbers.
--
Def 18a: [The set of integers] Za := arb({x: x in next(#s_inf) | not Finite(x)})
--
-- The definition just given is justified by the following theorem, which tells us that $Za$
-- is in fact an infinite ordinal, whose members are exactly the finite ordinals.
--
Theorem 206: [The set of integers is an infinite ordinal consisting of all finite ordinals] Ord(Za) & (not Finite(Za)) & ((Card(X) & Finite(X)) eq (X in Za)). Proof+:
    Suppose_not(x) ==> (not Ord(Za)) or Finite(Za) or (not((Card(x) & Finite(x)) eq (x in Za)))
--
-- First we show that there exists an infinite ordinal, which will imply that
-- there is a smallest infinite ordinal. This is done using the axiom of infinity:
-- the cardinal of the infinite set which this axiom gives us must be infinite.
--
    T204 ==> not Finite(#s_inf)
    s_inf-->T156 ==> Ord(#s_inf)
    Use_def(next) ==> next(#s_inf) = #s_inf + {#s_inf}
    ELEM ==> #s_inf in next(#s_inf)
    Suppose ==> {x: x in next(#s_inf) | not Finite(x)} = 0
    ELEM ==> Stat1: #s_inf notin {x: x in next(#s_inf) | not Finite(x)}
    (#s_inf)-->Stat1 ==> not(#s_inf in next(#s_inf)) or Finite(#s_inf)
    Discharge ==> Stat2: {x: x in next(#s_inf) | not Finite(x)} /= 0
--
-- Since we have just shown that there is some infinite ordinal,
-- the axiom of choice tells us that $Za$ must be an infinite ordinal.
--
   {x: x in next(#s_inf) | not Finite(x)}-->T0 ==>
	(arb({x: x in next(#s_inf) | not Finite(x)}) in {x: x in next(#s_inf) | not Finite(x)}) &
	 (arb({x: x in next(#s_inf) | not Finite(x)}) * {x: x in next(#s_inf) | not Finite(x)} = 0)
    Use_def(Za) ==> Stat3: (Za in {x: x in next(#s_inf) | not Finite(x)})
    					& (Za * {x: x in next(#s_inf) | not Finite(x)} = 0)
    Za-->Stat3 ==> (Za in next(#s_inf)) & (not Finite(Za))
    (#s_inf)-->T32 ==> Ord(next(#s_inf))
    (next(#s_inf),Za)-->T12 ==> Ord(Za)
--
-- It follows from what has now been proved that only the third clause of our theorem can be false.
-- Hence there exists an x for which $(Card(x) & Finite(x))$ and $(x in Za)$ are inequivalent.
-- This inequivalence falls into two possible cases.
--
    ELEM ==> (Card(x) & Finite(x) & (not (x in Za))) or (((not Card(x)) or (not Finite(x))) & (x in Za))
--
-- The first of these cases is impossible, so the second must hold.
--
    Suppose ==> Card(x) & Finite(x) & (not (x in Za))
   	Use_def(Card) ==> Ord(x) & Finite(x) & (not (x in Za))
    (Za,x)-->T197 ==> ((Ord(x) & Ord(Za) & (not Finite(Za)) & Finite(x))) imp (x in Za)
    Discharge ==> ((not Card(x)) or (not Finite(x))) & (x in Za)
--
-- But since $Za$ has been defined as the smallest infinite ordinal,
-- each member of $Za$ is a finite ordinal, and hence a cardinal by Theorem 205.
--
    Suppose ==> not Finite(x)
    (next(#s_inf),Za)-->T34 ==> (x in next(#s_inf)) & (not Finite(x))
    Suppose ==> Stat4: x notin {u: u in next(#s_inf) | not Finite(u)}
    x-->Stat4 ==> false; Discharge ==> x in {u: u in next(#s_inf) | not Finite(u)}
    Discharge ==> Finite(x)
    x-->T205 ==> (Ord(x) & Finite(x)) imp Card(x)
    (Za,x)-->T12 ==> false
    Discharge ==> QED
--
-- It follows trivially from Theorem 206 that every element of Za is its own cardinality.
--
Theorem 207: [All integers are finite ordinals and cardinals] (X in Za) imp ((X = #X) & Card(X) & Ord(X) & Finite(X)). Proof:
--
-- Simply because every element of Za is finite and a cardinal, hence an ordinal.
--
    Suppose_not(m) ==> AUTO
	Use_def(Card(m)) ==> AUTO
	m-->T206 ==> Card(m) & Finite(m) & Ord(m)
	m-->T164 ==> m = #m
    Discharge ==> QED
--
Theorem 208: [Transitivity of integer comparison] ((M in Za) & (N in Za) & (I in N)) imp ((M in N) or (I in M)). Proof+:
Suppose_not(m,n,i) ==> AUTO
	(m,n)-->T31 ==> AUTO
(m,n)-->T13 ==> false; Discharge ==> QED
--
-- The standard set-theoretic (von Neumann) definitions of
-- the first few positive integers $1,2,3,...$ are as follows:
--
--Def 18b: [Standard definitions of the integers, (1 is next(0)) & (2 is next(1)) & (3 is next(2)) &...  ] one := next(0)
--
Def 18b: [The integer 1] Def(1) := next(0)
Def 18c: [The integer 2] Def(2) := next(1)
Def 18d: [The integer 3] Def(3) := next(2)
Def 18f: [The integer 4] Def(4) := next(3)
--
-- We show next that the set of integers is not merely an ordinal, but is indeed a cardinal.
--
Theorem 209: [The set of integers is a Cardinal] Card(Za). Proof:
    Suppose_not ==> not Card(Za)
--
-- For in the contrary case there would exist an element $y$ of $Za$ and a 1-1 map $f$ of $y$ onto $Za$.
--
    Use_def(Card) ==> (not Ord(Za)) or
	not(FORALL y in Za, f in OM | (not(domain(f) = y)) or (not(range(f) = Za)) or (not(Svm(f))))
    junk-->T206 ==> Ord(Za)
    ELEM ==>
	Stat1: not(FORALL y in Za, f in OM | (not(domain(f) = y)) or (not(range(f) = Za)) or (not(Svm(f))))
--
-- But then Theorem 192 would tell us that $Za$ is finite, a contradiction proving our theorem.
--
    (y,f)-->Stat1 ==> (y in Za) & (domain(f) = y) & (range(f) = Za) & Svm(f)
    f-->T192 ==> Finite(domain(f)) imp Finite(range(f))
    y-->T206 ==> Finite(y) & (not  Finite(Za))
    EQUAL ==> false; Discharge ==> QED
--
--
--
Theorem 210: [The successor of an integer is an integer] (I in Za) imp (Card(next(I)) & (next(I) in Za)). Proof+:
Suppose_not(i0) ==> AUTO
	i0-->T32(*) ==> Ord(next(i0))
	i0-->T200(*) ==> Finite(next(i0))
	(next(i0))-->T205(*) ==> Card(next(i0))
(next(i0))-->T206(*) ==> false; Discharge ==> QED
--
-- Our next aim is to define the first few integers and establish their elementary properties.
-- This is done in the two following theorems.
--
Theorem 211: [The first few integers are all cardinals] Ord(0) & (0 in Za) & (1 in Za) & (2 in Za) & (3 in Za) & Card(0) & Card(1) & Card(2) & Card(3). Proof:
Suppose_not ==> AUTO
--
-- All these statements are trivial corollaries of the fact that 0 is a cardinal,
-- and of Theorem 188, Theorem 206, and Theorem 210.
--
	T188(*) ==> Finite(0) & Card(0)
   	0-->T206(*) ==> 0 in Za
	Use_def(Card)(*) ==> Ord(0)
	0-->T210(*) ==> Card(next(0)) & (next(0) in Za)
	Use_def(1)(*) ==> Card(1) & (1 in Za)
	1-->T210(*) ==> Card(next(1)) & (next(1) in Za)
	Use_def(2)(*) ==> Card(2) & (2 in Za)
	2-->T210(*) ==> Card(next(2)) & (next(2) in Za)
Use_def(3)(*) ==> false; Discharge ==> QED

--
-- The following corollary to Theorem 211 merely adds the elementary fact
-- that the first 3 integers are all different.
--
Theorem 212: [The first few integers are all distinct] (0 in Za) & (1 in Za) & (2 in Za) & (3 in Za) & (1 /= 0) & (2 /= 0) & (3 /= 0) & (1 /= 2) & (1 /= 3) & (2 /= 3). Proof:
	Suppose_not ==> not((0 in Za) & (1 in Za) & (2 in Za) & (3 in Za) & (1 /= 0) & (2 /= 0) & (3 /= 0) & (1 /= 2) & (1 /= 3) & (2 /= 3))
    T211 ==> (0 in Za) & (1 in Za) & (2 in Za) & (3 in Za)
    Use_def(1) ==> Stat1: 1 = next(0)
    Use_def(2) ==> 2 = next(1)
    Use_def(3) ==> 3 = next(2)
    Use_def(next) ==> false; Discharge ==> QED
--
-- Next, in preparation for our account of integer arithmetic,
-- we define the main arithmetic operators,
-- not merely for integers, but for all cardinals, whether finite or infinite.
--
Def 19: [Cardinal sum] Def(n PLUS m) := #({[x,0]: x in n} + {[x,1]: x in m})
Def 20: [Cardinal product] Def(N TIMES M) := #(N PROD M)
Def 21: [Powerset of a set] pow(S) := {x: x incin S}
Def 22: [Cardinal Difference] Def(N MINUS M) := #(N - M)
--
-- The quotient $m OVER n$ is defined as the largest integer $k$ such that $k TIMES n$ is
-- no larger than $m$, and $m MOD n$ is defined as the remainder $m MINUS ((m OVER n) TIMES n)$.
--
Def 23: [Integer Quotient; Note that $x/0$ is defined as $Za$ for $x in Za$] Def(M OVER N) := Un({k in Za | (k TIMES N) incin M})
Def 24: [Integer Remainder] Def(M MOD N) := M MINUS ((M OVER N) TIMES N)
--
-- The fact that the power set of the null set is the singleton whose sole member is the
-- null set is an elementary consequence of the definition of 'pow'.
--
Theorem 213: [Powerset of the null set] pow(0) = {0}. Proof:
    Suppose_not ==> Stat1: pow(0) /= {0}
    c-->Stat1 ==> ((c in pow(0)) & (c /= 0)) or ((c notin pow(0)) & (c = 0))
    Use_def(pow) ==> ((c in {x: x incin 0}) & (c /= 0)) or ((c notin {x: x incin 0}) & (c = 0))
    Suppose ==> Stat2: (c notin {x: x incin 0}) & (c = 0)
    0-->Stat2 ==> false; Discharge ==> Stat3: (c in {x: x incin 0}) & (c /= 0)
    d-->Stat3 ==> false; Discharge ==> QED
--
-- A set belongs to another if and only if its singleton belongs to the powerset of the other set.
--
Theorem 214: [Membership, singleton, and powerset] (X in L) eq ({X} in pow(L)). Proof:
Suppose_not(x1,y1) ==> AUTO
	Use_def(pow)(*) ==> (x1 in y1) neq ({x1} in {l1: l1 incin y1})
	Suppose ==> Stat1: ({x1} in {l1: l1 incin y1}) & (x1 notin y1)
		(x0)-->Stat1(Stat1*) ==> false
	Discharge ==> Stat2: ({x1} notin {l1: l1 incin y1}) & (x1 in y1)
	({x1})-->Stat2(Stat2*) ==> false
	Discharge ==> QED
--
-- The powerset of a singleton is a doubleton consisting of $0$ and a singleton.
--
Theorem 215: [Singleton and powerset] ({0,X} incin pow(X)) & ((X = {Y}) imp (pow(X) = {0,X})). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def(pow(x0)) ==> AUTO
	Suppose ==> Stat1: {0,x0} nincin {y: y incin x0}
		a-->Stat1(Stat1*) ==> Stat2: (a notin  {y: y incin x0}) & ((a = 0) or (a = x0))
		a-->Stat2(Stat2*) ==> false
	Discharge ==> Stat3: ({y: y incin x0} nincin {0,x0}) & (x0 = {y0})
	b-->Stat3(Stat3*) ==> Stat4: (b in {y: y incin x0}) & (b /= 0) & (b /= {y0})
	c-->Stat4(Stat3*) ==> false
	Discharge ==> QED
--
-- The following elementary lemma just tells us that the two sets entering into the
-- definition of cardinal addition are always disjoint.
--
Theorem 216: [Disjointness of simple Cartesian products] {[x,0]: x in N} * {[x,1]: x in M} = 0. Proof:
    Suppose_not(n,m) ==> Stat1: {[x,0]: x in n} * {[x,1]: x in m} /= 0
    e-->Stat1 ==> Stat2: (e in {[x,0]: x in n}) & (e in {[x,1]: x in m})
    (x,y)-->Stat2 ==> (e = [x,0]) & (e = [y,1])
    T212 ==> 1 /= 0
    Discharge ==> QED
--
-- Next we show that the sum of two cardinalities $#n$, $#m$ can be computed using
-- any pair of disjoint sets of which the first has cardinality $#n$ and the second has cardinality $#m$.
--
Theorem 217: [First Disjoint sum lemma] ((N * M = 0) & (K * J = 0) & (#N = #K) & (#M = #J)) imp
			(#(N + M) = #(K + J)). Proof:
    Suppose_not(n,m,k,j) ==> ((n * m = 0) & (k * j = 0) & (#n = #k) & (#m = #j)) & (#(n + m) /= #(k + j))
      ELEM ==> Stat1: (n * m = 0) & (k * j = 0)
--
-- For supposing the contrary, and noting that there exist 1-1 maps $f$ and $g$ of $n$ to $j$ and $m$ to $k$,
-- we see immediately that $f + g$ is a 1-1 map of $m + n$ onto $j + k$, and so our claim follows using Theorem 88.
--
	(n,k)-->T158 ==> Stat2: (EXISTS f in OM | (one_1_map(f) & (range(f) = n) & (domain(f) = k)))
	f-->Stat2 ==> one_1_map(f) & (range(f) = n) & (domain(f) = k)
	(m,j)-->T158 ==> Stat3: (EXISTS f in OM | (one_1_map(f) & (range(f) = m) & (domain(f) = j)))
	g-->Stat3 ==> one_1_map(g) & (range(g) = m) & (domain(g) = j)
    (f,g)-->T88(Stat1) ==> one_1_map(f + g)
    (f,g)-->T79 ==> range(f + g) = range(f) + range(g)
    (f,g)-->T78 ==> domain(f + g) = domain(f) + domain(g)
--
-- Our result now follows from Theorem 157.
--
   (f + g)-->T157 ==> #domain(f + g) = #range(f + g)
   EQUAL ==> #(domain(f) + domain(g)) = #(range(f) + range(g))
   EQUAL ==> false; Discharge ==> QED
--
-- The following lemma, which simply notes a consequence of the elementary fact
--that  ${[x,a]: x in n}$ and $n$ are in 1-1 correspondence,
-- prepares for the proof of Theorem 221 below.
--
Theorem 218: [Cardinality of Cartesian product by a singleton] (#{[x,A]: x in M} = #M). Proof:
--
-- Since ${[x,[x,a]]: x in m}$ is clearly a 1-1 map, the present lemma is an obvious
-- consequence of Theorem 157.
--
    Suppose_not(a,m) ==> #{[x,a]: x in m} /= #m
	Loc_def ==> f = {[x,[x,a]]: x in m}
    APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(g->f,f(x)->[x,a],s->m) ==> (domain(f) = m) & (range(f) = {[x,a]: x in m})
    	 & (((x in m) & (y in m) & ([x,a] = [y,a]) & (x /= y)) or one_1_map(f))
	ELEM ==> one_1_map(f)
    f-->T157 ==> #domain(f) = #range(f)
    EQUAL ==> false; Discharge ==> QED
--
--
-- The monotonicity of arithmetic addition follows immediately from its definition.
--
Theorem 219: [Monotonicity of arithmetic addition] ((N incs N1) and (M incs M1)) imp (N PLUS M incs N1 PLUS M1). Proof:
    Suppose_not(n,n1,m,m1) ==> AUTO
    Use_def(PLUS) ==> (n PLUS m) = #({[x,0]: x in n} + {[x,1]: x in m})
    Use_def(PLUS) ==> not (#({[x,0]: x in n} + {[x,1]: x in m}) incs #({[x,0]: x in n1} + {[x,1]: x in m1}))
    ({[x,0]: x in n1} + {[x,1]: x in m1},{[x,0]: x in n} + {[x,1]: x in m})-->T170 ==> not (({[x,0]: x in n} + {[x,1]: x in m}) incs ({[x,0]: x in n1} + {[x,1]: x in m1}))
    Set_monot ==> ({[x,0]: x in n} + {[x,1]: x in m}) incs ({[x,0]: x in n1} + {[x,1]: x in m1})
    Discharge ==> QED
--
-- Next we show that the numerical sum $n PLUS m$ of any two disjoint sets is simply
-- the number of elements in their union.
--
Theorem 220: [Disjoint sum lemma] (N * M = 0) imp (N PLUS M = #(N + M)). Proof:
    Suppose_not(n,m) ==> (n * m = 0) & ((n PLUS m) /= #(n + m))
    Use_def(PLUS) ==> #({[x,0]: x in n} + {[x,1]: x in m}) /= #(n + m)
    (0,n)-->T218 ==> #{[x,0]: x in n} = #n
    (1,m)-->T218 ==> #{[x,1]: x in m} = #m
    (n,m)-->T216 ==> {[x,0]: x in n} * {[x,1]: x in m} = 0
    (n,m,{[x,0]: x in n},{[x,1]: x in m})-->T217 ==> false; Discharge ==> QED
--
-- Our next theorem tells us that the sum of two cardinals $i$ and $j$
-- can be calculated using any two sets $n$ and $m$ whose cardinalities are n and m respectively.
--
Theorem 221: [Arithmetic addition lemma] N PLUS M = #N PLUS #M. Proof:
--
-- Supposing that our theorem is false and expanding the definition of '$PLUS$' brings us to
-- the cardinal inequality seen just below.
--
    Suppose_not(n,m) ==> n PLUS m /= #n PLUS #m
    Use_def(PLUS) ==> #({[x,0]: x in n} + {[x,1]: x in m}) /= #({[x,0]: x in #n} + {[x,1]: x in #m})
--
-- But the pairs of sets appearing in this inequality are evidently disjoint, and
-- have the respective cardinalities $#n$, $#m$, $##n$, $##m$.
--
    T212 ==> Stat1:  1 /= 0
    Suppose ==> Stat2: {[x,0]: x in n} * {[x,1]: x in m} /= 0
    c-->Stat2 ==> c in {[x,0]: x in n} * {[x,1]: x in m}
    ELEM ==> Stat3: (c in {[x,0]: x in n}) & (c in {[x,1]: x in m})
    (d,e)-->Stat3() ==> Stat4: (d in n) & (c = [d,0]) & (e in m) & (c = [e,1])
    (Stat4,Stat1)Discharge ==> {[x,0]: x in n} * {[x,1]: x in m} = 0
    Suppose ==> Stat5: {[x,0]: x in #n} * {[x,1]: x in #m} /= 0
    cc-->Stat5 ==> cc in {[x,0]: x in #n} * {[x,1]: x in #m}
    ELEM ==> Stat6: (cc in {[x,0]: x in #n}) & (cc in {[x,1]: x in #m})
    (dd,ee)-->Stat6() ==> Stat7: (dd in #n) & (cc = [dd,0]) & (ee in #m) & (cc = [ee,1])
    (Stat7,Stat1)Discharge ==> {[x,0]: x in #n} * {[x,1]: x in #m} = 0
    (0,n)-->T218 ==> #{[x,0]: x in n} = #n
    (1,m)-->T218 ==> #{[x,1]: x in m} = #m
    (0,#n)-->T218 ==> #{[x,0]: x in #n} = ##n
    (1,#m)-->T218 ==> #{[x,1]: x in #m} = ##m
--
-- Hence our assertion follows from Theorem 166 and Theorem 217.
--
	n-->T166 ==> #{[x,0]: x in n} = #{[x,0]: x in #n}
	m-->T166 ==> #{[x,1]: x in m} = #{[x,1]: x in #m}
	({[x,0]: x in n},{[x,1]: x in m},{[x,0]: x in #n},{[x,1]: x in #m})-->T217 ==> false; Discharge ==> QED
--
-- It is sometimes convenient to use Theorem 216 in the following variant form:
--
Theorem 222: [Second Disjoint sum lemma] (N * M = 0) imp (#N PLUS #M = #(N + M)). Proof:
    Suppose_not(n,m) ==> (n * m = 0) & ((#n PLUS #m) /= #(n + m))
    (n,m)-->T221 ==> (n PLUS m) /= #(n + m)
    (n,m)-->T220 ==> false; Discharge ==> QED
--
-- The fact that cardinal multiplication of any $n$ by $1 $leaves $n$ unchanged
-- will be derived from the corresponding fact for Cartesian products, as stated
-- in the following theorem.
--
Theorem 223: [Cardinality of Cartesian product by a singleton, 2] #({C} PROD N) = #N. Proof:
    Suppose_not(c,n) ==> #({c} PROD n) /= #n
--
-- Make the contrary hypothesis, and use the definition of '$PROD$'.
--
   Use_def(PROD) ==> ({c} PROD n) = {[x,y]: x in {c}, y in n}
    SIMPLF ==> ({c} PROD n) = {[c,x]: x in n}
    EQUAL ==> #({c} PROD n) = #{[c,x]: x in n}
--
-- It is easily seen that {[x,[c,x]]: x in n} is a 1-1 map of n to {[c,x]: x in n}
--
    Loc_def ==> f = {[x,[c,x]]: x in n}
    APPLY(x9_thryvar:y,y9_thryvar:wz) fcn_symbol(f(x)->[c,x],g->f,s->n) ==>
		Svm(f) & (domain(f) = n) & (range(f) = {[c,x]: x in n}) &
				(((y in n) & (wz in n) & ([c,y] = [c,wz]) & (y /= wz)) or one_1_map(f))
     ELEM ==> one_1_map(f)
--
-- Thus the present theorem follows immediately from Theorem 157.
--
    f-->T157 ==> #domain(f) = #range(f)
    EQUAL ==> false; Discharge ==> QED
--
-- The following minor variant of Theorem 223 has much the same proof.
--
Theorem 224:  [Cardinality of Cartesian product by a singleton, 3] #(N PROD {C}) = #N. Proof:
    Suppose_not(n,c) ==> #(n PROD {c}) /= #n
--
-- Make the contrary hypothesis, and use the definition of '$PROD$'.
--
   Use_def(PROD) ==> (n PROD {c}) = {[x,y]: x in n, y in {c}}
    SIMPLF ==> (n PROD {c}) = {[x,c]: x in n}
    EQUAL ==> #(n PROD {c}) = #{[x,c]: x in n}
--
-- It is easily seen that {[x,[x,c]]: x in n} is a 1-1 map of n to {[x,c]: x in n}
--
    Loc_def ==> f = {[x,[x,c]]: x in n}
    APPLY(x9_thryvar:y,y9_thryvar:wz) fcn_symbol(f(x)->[x,c],g->f,s->n) ==>
		Svm(f) & (domain(f) = n) & (range(f) = {[x,c]: x in n}) &
	(((y in n) & (wz in n) & ([y,c] = [wz,c]) & (y /= wz)) or one_1_map(f))
     ELEM ==> one_1_map(f)
--
-- Thus the present theorem follows immediately from Theorem 157.
--
    f-->T157 ==> #domain(f) = #range(f)
    EQUAL ==> #n = #{[x,c]: x in n}
    Discharge ==> QED
--
-- Theorem 222 has the following corollary, which restates the definition of the
-- arithmetic sum in a more 'algebraic' form.
--
Theorem 225:  [Cardinality of a Cartesian product union] (A /= B) imp (#N PLUS #M = #((N PROD {A}) + (M PROD {B}))). Proof:
    Suppose_not(a,b,n,m) ==> (a /= b) & (#n PLUS #m /= #((n PROD {a}) + (m PROD {b})))
    ({a},{b},n,m)-->T143 ==> (n PROD {a}) * (m PROD {b})  = 0
    (n PROD {a},m PROD {b})-->T222 ==> #((n PROD {a}) + (m PROD {b})) = (#(n PROD {a}) PLUS #((m PROD {b})))
    (n,a)-->T224 ==> #(n PROD {a}) = #n
    (m,b)-->T224 ==> #(m PROD {b}) = #m
    EQUAL ==> false; Discharge ==> QED
--
-- The following easy corollaries of Theorem 221 generalize it slightly.
-- The proofs, which use Theorem 168, have an elementary algebraic flavor.
-- We show first that the arithmetic sum of any two sets is the sum of the first
-- and the cardinality of the second.
--
Theorem 226: [Arithmetic addition lemma 2] N PLUS M = N PLUS #M. Proof:
	Suppose_not(n,m) ==> n PLUS m /= n PLUS #m
    (n,m)-->T221 ==> n PLUS m = #n PLUS #m
    (n,#m)-->T221 ==> n PLUS #m = #n PLUS ##m
    m-->T166 ==> ##m = #m
    EQUAL ==> n PLUS #m = #n PLUS #m
    Discharge ==> QED
--
-- Next we show that the arithmetic sum of any two sets is the sum of the second
-- and the cardinality of the first.
--
Theorem 227: [Arithmetic addition lemma 3] N PLUS M = #N PLUS M. Proof:
	Suppose_not(n,m) ==> n PLUS m /= #n PLUS m
    (n,m)-->T221 ==> n PLUS m = #n PLUS #m
    (#n,m)-->T221 ==> #n PLUS m = ##n PLUS #m
    m-->T166 ==> ##n = #n
    EQUAL ==> #n PLUS m = #n PLUS #m
    Discharge ==> QED
--
-- The following 3-set variants of our earlier disjoint sum lemma are useful
-- in proving the associativity of arithmetic addition. We first prove that
-- the arithmetic sum of any three disjoint sets is the cardinality of their union.
--
Theorem 228: [Arithmetic associativity lemma] ((N * M = 0) & (N * K = 0) & (M * K = 0)) imp (((N PLUS M) PLUS K) = #((N + M) + K)). Proof:
    Suppose_not(n,m,k) ==> (n * m = 0) & (n * k = 0) & (m * k = 0) & (((n PLUS m) PLUS k) /= #((n + m) + k))
    (n,m)-->T220 ==> (n PLUS m) = #(n + m)
    EQUAL ==> ((n PLUS m) PLUS k) = ((#(n + m)) PLUS k)
    (n + m,k)-->T227 ==> ((#(n + m)) PLUS k) = ((n + m) PLUS k)
    (n + m,k)-->T220 ==> false; Discharge ==> QED
--
-- The following result also asserts that the arithmetic sum of any three disjoint sets
-- is the cardinality of their union, but now with the arithmetic sum differently associated.
--
Theorem 229: [Arithmetic associativity lemma 2] ((N * M = 0) & (N * K = 0) & (M * K = 0)) imp ((N PLUS (M PLUS K)) = #(N + (M + K))). Proof:
    Suppose_not(n,m,k) ==> (n * m = 0) & (n * k = 0) & (m * k = 0) & ((n PLUS (m PLUS k)) /= #(n + (m + k)))
    (m,k)-->T220 ==> m PLUS k = #(m + k)
    EQUAL ==> (n PLUS (m PLUS k)) = (n PLUS #(m + k))
    (n,m + k)-->T226 ==>  (n PLUS #(m + k)) =  (n PLUS (m + k))
    (n,m + k)-->T220 ==> false; Discharge ==> QED
--
-- Our next theorem tells us that the product of two cardinals $#n$ and $#m$ can also
-- be calculated using any two sets $n$ and $m$ whose cardinalities are $#n$ and $#m$ respectively.
--
Theorem 230: [Arithmetic multiplication lemma] (N TIMES M) = (#N TIMES #M). Proof:
    Suppose_not(n,m) ==> (n TIMES m) /= (#n TIMES #m)
--
-- Supposing that our theorem is false and expanding the definition of '$TIMES$' brings us to
-- the cardinal inequality seen just below.
--
    Use_def(TIMES) ==> #(n PROD m) /= #(#n PROD #m)
--
-- Theorem 156 tells us that there always exist 1-1 maps of $#n$ onto $n$ and of $#m$ onto $m$.
--
    (n)-->T156 ==> Stat1: Card(#n) & (EXISTS f in OM | one_1_map(f) & (range(f) = n) & (domain(f) = #n))
    (f)-->Stat1 ==> Stat2: one_1_map(f) & (domain(f) = #n) & (range(f) = n)
    (m)-->T156 ==> Stat3: Card(#m) & (EXISTS f in OM | one_1_map(f) & (range(f) = m) & (domain(f) = #m))
    (g)-->Stat3 ==> Stat4: one_1_map(g) & (domain(g) = #m) & (range(g) = m)
    Use_def(one_1_map) ==> Svm(f)
    Use_def(one_1_map) ==> Svm(g)
    Use_def(Svm) ==> Is_map(f)
    Use_def(Svm) ==> Is_map(g)
    Loc_def ==> g1 = g
    Loc_def ==> h = {[x,[f~[car(x)],g1~[cdr(x)]]]: x in {[x,y]: x in #n, y in #m}}
--
-- Now consider the map $h$ defined by ${[x,[f~[car(x)],g~[cdr(x)]]]: x in (#n PROD #m)}$.
-- We will show that this is a 1-1 map of $#n PROD #m$ onto $n PROD m$.
--
     APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(f(x)->[f~[car(x)],g1~[cdr(x)]],g->h,s->{[x,y]: x in #n, y in #m}) ==>
		Svm(h) & (range(h) = {[f~[car(x)],g1~[cdr(x)]]: x in {[x,y]: x in #n, y in #m}}) &
		(domain(h) = {[x,y]: x in #n, y in #m}) &
				(((x in {[x,y]: x in #n, y in #m}) & (y in {[x,y]: x in #n, y in #m}) &
					([f~[car(x)],g1~[cdr(x)]] = [f~[car(y)],g1~[cdr(y)]]) &  (x /= y)) or one_1_map(h))
	EQUAL ==> Stat5: Svm(h) & (range(h) = {[f~[car(x)],g~[cdr(x)]]: x in {[x,y]: x in #n, y in #m}}) &
		(domain(h) = {[x,y]: x in #n, y in #m}) &
				(((x in domain(h)) & (y in domain(h)) &
					([f~[car(x)],g~[cdr(x)]] = [f~[car(y)],g~[cdr(y)]]) &  (x /= y)) or one_1_map(h))
    SIMPLF ==> range(h) = {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m}
    Use_def(PROD) ==> #n PROD #m = {[x,y]: x in #n, y in #m}
    ELEM ==> domain(h) = #n PROD #m
--
-- Next we will show that $h$ is 1-1. Indeed, the distinct $x$ and $y$ which appear
-- in the final clause of the conjunction appearing as Stat6 6 above
-- must have the forms $[x1,y1]$ and $[x2,y2]$ respectively, and so either
-- $(x1 /= x2)$ or $(y1 /= y2)$.
--
	Suppose ==> not one_1_map(h)
	ELEM ==> Stat7: x /= y
	ELEM ==> Stat8: x in {[u,y]: u in #n, y in #m}
	(x1,y1)-->Stat8 ==> Stat9: (x = [x1,y1]) & (x1 in #n) & (y1 in #m)
	ELEM ==> Stat10: y in {[u,v]: u in #n, v in #m}
	(x2,y2)-->Stat10 ==> Stat11: (y = [x2,y2]) & (x2 in #n) & (y2 in #m)
	(Stat9,Stat11*)ELEM ==> Stat12: (x = [x1,y1]) & (y = [x2,y2])
	(Stat7,Stat12)ELEM ==> (x1 /= x2) or (y1 /= y2)
--
-- If $x1 /= x2$, then since $f$ is 1-1 it follows that $f(x1) /= f(x2)$, contradicting
-- $[f~[x1],g~[y1]] = [f~[x2],g~[y2]]$. Much the same argument applies if $y1 /= y2$.
-- Thus $[x1,y1] = [x2,y2]$, i.e. $x = y$, implying that $h$ is 1-1.
--
	EQUAL ==> [f~[car(x)],g~[cdr(x)]] = [f~[car([x1,y1])],g~[cdr([x1,y1])]]
	ELEM ==> (car([x1,y1]) = x1) & (cdr([x1,y1]) = y1)
	EQUAL ==> [f~[car(x)],g~[cdr(x)]] = [f~[x1],g~[y1]]
	EQUAL ==> [f~[car(y)],g~[cdr(y)]] = [f~[car([x2,y2])],g~[cdr([x2,y2])]]
	ELEM ==> (car([x2,y2]) = x2) & (cdr([x2,y2]) = y2)
	EQUAL ==> [f~[car(y)],g~[cdr(y)]] = [f~[x2],g~[y2]]
	Use_def(one_1_map) ==> Stat13: (FORALL x in f, y in f | (cdr(x) = cdr(y)) imp (x = y))
	Use_def(one_1_map) ==> Stat14: (FORALL x in g, y in g | (cdr(x) = cdr(y)) imp (x = y))
	(f,x1)-->T77 ==> [x1,f~[x1]] in f
	(f,x2)-->T77 ==> [x2,f~[x2]] in f
	([x1,f~[x1]],[x2,f~[x2]])-->Stat13 ==> (cdr([x1,f~[x1]]) = cdr([x2,f~[x2]])) imp ([x1,f~[x1]] = [x2,f~[x2]])
	ELEM ==> x1 = x2
--
-- Much the same argument applies if $y1 /= y2$.
--
	(g,y1)-->T77 ==> Stat15: [y1,g~[y1]] in g
	(g,y2)-->T77 ==> [y2,g~[y2]] in g
	([y1,g~[y1]],[y2,g~[y2]])-->Stat14(Stat15) ==> (cdr([y1,g~[y1]]) = cdr([y2,g~[y2]])) imp ([y1,g~[y1]] = [y2,g~[y2]])
	ELEM ==> y1 = y2
	EQUAL ==> [x1,y1] = [x2,y2]
	EQUAL ==> x = y
	Discharge ==> one_1_map(h)
--
-- Finally, we show that the range of $h$ is $n PROD m$. First suppose that $range(h)$ is not included
-- in $n PROD m$. Then there exists a $c = [f~[cx1],g~[cy1]]$, with $cx1 in #n$ and $cy1 in #m$,
-- such that $c notin n PROD m$, which is impossible since $f$ and $g$ map $#n$ and $#m$ into $n$ and $m$
-- respectively.
--
	Suppose ==> n PROD m /= {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m}
    Use_def(PROD) ==> n PROD m = {[x,y]: x in n, y in m}
	Suppose ==> Stat16: not({[x,y]: x in n, y in m} incs {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m})
	c-->Stat16 ==> Stat17: (c in {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m}) &
			Stat18: (c notin {[x,y]: x in n, y in m})
	(cx1,cy1)-->Stat17 ==> Stat19: (c = [f~[car([cx1,cy1])],g~[cdr([cx1,cy1])]]) &
					(cx1 in #n) & (cy1 in #m)
	(Stat2,Stat4,Stat19)ELEM ==> (cx1 in domain(f)) & (cy1 in domain(g))
	(cx1,f)-->T71 ==> f~[cx1] in n
	(cy1,g)-->T71 ==> g~[cy1] in m
	ELEM ==> car([cx1,cy1]) = cx1
	ELEM ==> cdr([cx1,cy1]) = cy1
	EQUAL ==> c = [f~[cx1],g~[cy1]]
	(f~[cx1],g~[cy1])-->Stat18 ==> not ((f~[cx1] in n) & (g~[cy1] in m) & (c = [f~[cx1],g~[cy1]]))
	Discharge ==>
	Stat20: not({[x,y]: x in n, y in m} incin {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m})
--
-- On the other hand, if $n PROD m$ is not included in $range(h)$,
-- there is an element $d = [dx1,dy1]$ in the first of these two sets but not in the second.
-- but then there exist $ex1 in #n$ and $ey1 in #m$ such that $dx1 = f~[ex1]$ and  $dy1 = g~[ey1]$,
-- so $d$ does belong to the second set.
--
	d-->Stat20 ==> Stat21: (d in {[x,y]: x in n, y in m}) &
			Stat22: (d notin {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m})
	(dx1,dy1)-->Stat21 ==> (dx1 in range(f)) & (dy1 in range(g)) & (d = [dx1,dy1])
	f-->T72 ==> f = {[x,f~[x]]: x in domain(f)}
	g-->T72 ==> g = {[x,g~[x]]: x in domain(g)}
	APPLY(x9_thryvar:x3,y9_thryvar:x4) fcn_symbol(f(x)->g~[x],g->g,s->domain(g)) ==> range(g) = {g~[x]: x in domain(g)}
	APPLY(x9_thryvar:y3,y9_thryvar:y4) fcn_symbol(f(x)->f~[x],g->f,s->domain(f)) ==> range(f) = {f~[x]: x in domain(f)}
	ELEM ==> Stat23: dx1 in {f~[x]: x in domain(f)}
	ELEM ==> Stat24: dy1 in {g~[x]: x in domain(g)}
	ex1-->Stat23 ==> Stat25: (ex1 in #n) & (dx1 = f~[ex1])
	ey1-->Stat24 ==> (ey1 in #m) & (dy1 = g~[ey1])
	(ex1,ey1)-->Stat22 ==> not((ex1 in #n) & (ey1 in #m) &
			(d = [f~[car([ex1,ey1])],g~[cdr([ex1,ey1])]]))
	(Stat23*)ELEM ==> (car([ex1,ey1]) = ex1) & (cdr([ex1,ey1]) = ey1)
	(Stat25*)ELEM ==> d /= [f~[car([ex1,ey1])],g~[cdr([ex1,ey1])]]
	EQUAL ==> d /= [f~[ex1],g~[ey1]]
	EQUAL ==> d = [f~[ex1],g~[ey1]]
	Discharge ==> n PROD m = {[f~[car([x,y])],g~[cdr([x,y])]]: x in #n, y in #m}
	ELEM ==> n PROD m = range(h)
	h-->T157 ==> #range(h) = #domain(h)
	EQUAL ==> #(n PROD m) = #(#n PROD #m)
--
-- This final contradiction completes the proof of our theorem.
--
    Discharge ==> QED
--
-- The following corollary of Theorem 230 is the 'product' analog of Theorem 226.
-- Its simple proof is algebraic in flavor.
--
Theorem 231: [Arithmetic multiplication lemma 2] N TIMES M = N TIMES #M. Proof:
	Suppose_not(n,m) ==> n TIMES m /= n TIMES #m
    (n,m)-->T230 ==> n TIMES m = #n TIMES #m
    (n,#m)-->T230 ==> n TIMES #m = #n TIMES ##m
    m-->T166 ==> ##m = #m
    EQUAL ==> n TIMES #m = #n TIMES #m
    Discharge ==> QED
--
-- it is also useful to state the following variants of the same fact.
-- The first of these tells us that the arithmetic product of two sets is the same as
-- the arithmetic product of their cardinalities.
--
Theorem 232: [Arithmetic multiplication lemma 3] #(N PROD M) = #(#N PROD #M). Proof:
	Suppose_not(n,m) ==> #(n PROD m) /= #(#n PROD #m)
	Use_def(TIMES) ==> #(n PROD m) = n TIMES m
	Use_def(TIMES) ==> #(#n PROD #m) = #n TIMES #m
	(n,m)-->T230 ==> false; Discharge ==> QED
--
-- Next we show that the arithmetic product of two sets is the same as
-- the arithmetic product of the first by the cardinality of the second.
--
Theorem 233: [Arithmetic multiplication lemma 4] #(N PROD M) = #(N PROD #M). Proof:
	Suppose_not(n,m) ==> #(n PROD m) /= #(n PROD #m)
	Use_def(TIMES) ==> #(n PROD m) = n TIMES m
	Use_def(TIMES) ==> #(n PROD #m) = n TIMES #m
	(n,m)-->T231 ==> false; Discharge ==> QED
--
-- The final result in this smalls series show that the arithmetic product of two sets is the same as
-- the arithmetic product of the cardinality of the first by the second.
--
Theorem 234: [Arithmetic multiplication lemma 5] #(N PROD M) = #(#N PROD M). Proof:
	Suppose_not(n,m) ==> #(n PROD m) /= #(#n PROD m)
	(n,m)-->T161 ==> #(m PROD n) /= #(#n PROD m)
	(#n,m)-->T161 ==> #(m PROD n) /= #(m PROD #n)
	(m,n)-->T233 ==> false; Discharge ==> QED
--
-- Next we note that a proper subset of a finite set $n$ has a cardinality which
-- is definitely smaller than that of $n$.
--
Theorem 235: [Strict monotonicity of finite cardinality] (Finite(N) & (M incin N) & (M /= N)) imp (#M in #N). Proof:
    Suppose_not(n,m) ==> Finite(n) & (m incin n) & (m /= n) & (#m notin #n)
--
-- Suppose than $n$ and $m$ constitute a counterexample to our theorem.
-- Since $m incin n$, $#m incin #n$ and since both $#m$ and $#n$ are ordinals
-- it follows by Theorem 170 that $#m = #n$. Thus $m$ and $n$ are in 1-1 correspondence,
-- which is impossible by the definition of finiteness.
--
    n-->T156 ==> Ord(#n)
    m-->T156 ==> Ord(#m)
    (#n,#m)-->T35 ==> #m incs #n
    (m,n)-->T170 ==> #m = #n
    (m,n)-->T158 ==> Stat1: (EXISTS f in OM | one_1_map(f) & (range(f) = m) & (domain(f) = n))
    g-->Stat1 ==> one_1_map(g) & (domain(g) = n) & (range(g) incin n) & (range(g) /= n)
    Use_def(Finite) ==> Stat2: not (EXISTS f in OM | one_1_map(f) & (domain(f) = n) & (range(f) incin n) & (range(f) /= n))
    g-->Stat2 ==> false; Discharge ==> QED
--
-- Using the result just proved, we can give the following variant
-- of the standard theory of transfinite induction.
--
THEORY finite_induction(n,P(x))
    Finite(n) & P(n)
END finite_induction;
--
ENTER_THEORY finite_induction
--
-- We show that if some finite set $n$ has a property $P$, there must exist a subset of $n$
-- which is finite, has property $P$, but has no strict subset also having property $P$.
-- This refines the ordinary principle of induction, which would only tell us that
-- $n$ has an element having property $P$, but itself having no element also having property $P$.
--
Def finite_induction0: [Witness for finite induction argument by subset induction] m1_thryvar :=
	arb({m: m incin n | (P(m) & (FORALL k incin m | ((k /= m) imp (not P(k)))))})
--
Theorem finite_induction1: [Induction principle for finite sets] (m1_thryvar incin n) & P(m1_thryvar) &
			(FORALL k incin m1_thryvar | ((k /= m1_thryvar) imp (not P(k)))). Proof:
--
-- The proof works by applying standard transfinite induction to the cardinality $#m$ of sets $m$
-- having the property $P(m)$. Since by our hypothesis $#n$ is an integer for which there exists a set $y$
-- such that $(#y = #n) & (y incin n) & P(y)$, the standard principle of induction tells us that
-- there must exist a smallest integer $m$ with this property.
--
Suppose_not ==> AUTO
	Assump ==> Finite(n) & P(n)
	n-->T193 ==> Finite(#n)
	n-->T156 ==> Card(#n)
	(#n)-->T206 ==> (#n in Za) & P(n)
	Suppose ==> Stat1: not(EXISTS y | (#y = #n) & (y incin n) & P(y))
		ELEM ==> (#n = #n) & (n incin n) & P(n)
		n-->Stat1(Stat1*) ==> false
	Discharge ==> (#n in Za) & (EXISTS y | (#y = #n) & (y incin n) & P(y))
	Loc_def ==> nn = n
	EQUAL ==> (#n in Za) & (EXISTS y | (#y = #n) & (y incin nn) & P(y))
	APPLY(mt1_thryvar:j) transfinite_induction (n->#n,P(x)->((x in Za) & (EXISTS y | (#y = x) & (y incin nn) & P(y)))) ==>
		(FORALL k | ((j in Za) & (EXISTS y | (#y = j) & (y incin nn) & P(y))) &
			((k in j) imp (not ((k in Za) & (EXISTS y | (#y = k) & (y incin nn) & P(y))))))
	EQUAL ==> Stat2: (FORALL k | ((j in Za) & (EXISTS y | (#y = j) & (y incin n) & P(y))) &
		((k in j) imp (not ((k in Za) & (EXISTS y | (#y = k) & (y incin n) & P(y))))))
	a-->Stat2 ==> (j in Za) & Stat3: (EXISTS y | (#y = j) & (y incin n) & P(y))
	m-->Stat3 ==> Stat4: (#m = j) & (m incin n) & P(m)
	Pred_monot ==> Finite(#m)
	Pred_monot ==> Finite(m)
	m-->T156 ==> Stat5: Ord(#m)
--
-- But now if the set $m$ has any proper subset $k$ such that $P(k)$, then by Theorem 194 $#k$
-- would be less than $#m$. Hence $m$ has the minimality property demanded by the present theorem.
--
	Suppose ==> Stat6: not ((FORALL k incin m | ((k /= m) imp (not P(k)))))
		k-->Stat6 ==> (k incin m) & ((k /= m) & P(k))
		Set_monot ==> #k incin #m
		Pred_monot ==> Finite(#k)
    		(m,k)-->T194 ==> #k /= #m
    		k-->T156 ==> Card(#k) & Ord(#k)
    		(#m,#k)-->T35(Stat5) ==> (#k in #m)
		(#k)-->T206 ==> #k in Za
		(#k)-->Stat2 ==> Stat7: not (EXISTS y | (#y = #k) & (y incin n) & P(y))
		k-->Stat7(Stat4) ==> false
	Discharge ==> Stat8: (FORALL k incin m | ((k /= m) imp (not P(k))))
	Suppose ==> Stat9: {m: m incin n | (P(m) & (FORALL k incin m | ((k /= m) imp (not P(k)))))} = 0
		m-->Stat9(Stat4,Stat8*) ==> false
	Discharge ==> AUTO
	Use_def(m1_thryvar) ==> m1_thryvar = arb({m: m incin n | (P(m) & (FORALL k incin m | ((k /= m) imp (not P(k)))))})
	({m: m incin n | (P(m) & (FORALL k incin m | ((k /= m) imp (not P(k)))))})-->T0(Stat8*) ==>
		Stat10: m1_thryvar in {m incin n | (P(m) & (FORALL k incin m | ((k /= m) imp (not P(k)))))}
	()-->Stat10(*) ==> false
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY finite_induction
--
--THEORY finite_induction(n,P(x))
--    Finite(n) & P(n)
--==>(m1_thryvar)
--    (m1_thryvar incin n) & P(m1_thryvar) & (FORALL k incin m1_thryvar | ((k /= m1_thryvar) imp (not P(k))))
--END finite_induction;
--
--
-- We can use the variant form of induction just derived to prove that the union of two sets is finite
-- if and only if both of the sets are finite.
--
Theorem 236: [The union of finite sets is finite] (Finite(N) & Finite(M)) eq Finite(N + M). Proof:
    Suppose_not(n,m) ==> not((Finite(n) & Finite(m)) eq Finite(n + m))
--
-- For if $n + m$ is finite, so are its subsets $m$ and $n$.
--
    ELEM ==> Finite(n) & Finite(m) & (not Finite(n + m))
--
-- Thus we only need to consider the possibility that $n$ and $m$ are finite, but $n + m$ is not.
-- In this case, we can apply the theory of finite induction developed just above
-- to show that there exists a finite set $nn$ such that $nn + m2$ is infinite, but $n2 + m$ is finite
-- for every proper subset $n2$ of $nn$.
--
    ELEM ==> (EXISTS m | Finite(m) & (not Finite(n + m)))
    APPLY(m1_thryvar:nn) finite_induction(n->n,P(x)->(Finite(x) & (EXISTS m | Finite(m) & (not Finite(x + m))))) ==>
		Finite(nn) & Stat1: (EXISTS m | Finite(m) & (not Finite(nn + m))) &
			Stat2: (FORALL n2 incin nn | ((n2 /= nn) imp
				(not (Finite(n2) & (EXISTS m | Finite(m) & (not Finite(n2 + m)))))))
    m2-->Stat1 ==> Finite(m2) & (not Finite(nn + m2))
--
-- If $nn$ is nonempty, then we can remove one element $c$ from it, getting a proper subset
-- $nn - {c}$ for which $(nn - {c}) + m2$ must therefore be finite. But then $nn + m2$ is also finite by Theorem 199,
-- a contradiction.
--
    Suppose ==> Stat3: nn /= 0
    c-->Stat3 ==> c in nn
    ELEM ==> ((nn - {c}) incin nn) & ((nn - {c}) /= nn) & (nn = (nn - {c}) + {c})
    (nn - {c})-->Stat2 ==> Stat4: (not (EXISTS m | Finite(m) & (not Finite(nn - {c} + m))))
    m2-->Stat4 ==> Finite((nn - {c}) + m2)
--
-- It follows that $nn$ must be empty. But this obviously contradicts the fact that $m2$ is finite,
-- and so concludes the proof of the present theorem.
--
    ((nn - {c}) + m2,c)-->T199 ==> false; Discharge ==> nn = 0
    Discharge ==> QED
--
-- An easy corollary of the preceding theorem is that removal of an initial segment
-- from the set $Za$ yields an infinite set.
--
Theorem 237: [Removal of an initial segment from $Za$ yields an infinite set] (N in Za) imp (not Finite(Za - N)). Proof:
Suppose_not(n) ==> AUTO
--
-- The key observation is that $n in Za$ implies that $n$ is finite;
-- hence, if $Za - n$ could be finite, so would be the superset
-- $(Za - n) + n$ of $Za$.
--
	n-->T206 ==> AUTO
	(Za - n, n)-->T236 ==> false; Discharge ==> QED
--
-- The union-set of a finite set of finite sets is finite:
--
Theorem 238: [The union of finitely many finite sets is finite] ((FORALL x in S | Finite(x)) & Finite(S)) imp Finite(Un(S)). Proof:
--
-- For if there were a counterexample $s$, then by the finite induction principle it would include an
-- inclusion-minimal counterexample $t$.
--
    Suppose_not(s) ==> Stat1: (FORALL x in s | Finite(x)) & Finite(s) & (not(Finite(Un(s))))
	APPLY(m1_thryvar:m) finite_induction(n->s,P(y)->(not(Finite(Un(y))))) ==> Stat2:
		(m incin s) & (not(Finite(Un(m)))) & (FORALL k incin m | ((k /= m) imp Finite(Un(k))))
--
-- Such a counterexample $m$ cannot be $0$, because $Un(0) = 0$, which is finite.
-- Consequently, the union set of $m$  can be decomposed as the
-- disjoint union $Un(m) = arb(m) + Un(m-{arb(m)})$.
--
	m-->T109 ==> Stat3: (Un(0) = 0) & ((m /= 0) imp (Un(m) = (arb(m) + Un(m - {arb(m)}))))
	T188 ==> Stat4: Finite(0)
	Suppose ==> Stat5: m = 0
	EQUAL(Stat5,Stat3,Stat4) ==> Stat6: Finite(Un(m))
	(Stat2,Stat6)Discharge ==> Stat7: m /= 0
--
-- Since $arb(m)$ belongs to $m$, it is finite; moreover, by the minimality of $m$,
-- $Un(m - {arb(m)})$ is also finite.
--
	(Stat3,Stat7,Stat2)ELEM ==> Stat8: (Un(m) = (arb(m) + Un(m - {arb(m)}))) & (arb(m) in s) &
						((m - {arb(m)}) incin m) & ((m - {arb(m)}) /= m)
	(arb(m))-->Stat1(Stat8) ==> Stat9: Finite(arb(m))
	(Stat2)ELEM ==> Stat10: (FORALL k incin m | ((k /= m) imp Finite(Un(k))))
	(m - {arb(m)})-->Stat10 ==> Stat11: Finite(Un(m - {arb(m)}))
	(arb(m),Un(m - {arb(m)}))-->T236(Stat9,Stat11) ==> Stat12: Finite(arb(m) + Un(m - {arb(m)}))
--
-- This implies that $Un(m)$ is finite, giving a contradiction which proves
-- the desired conclusion.
--
    (Stat8,Stat12,Stat2)Discharge ==> QED
--
Theorem 239: [Finite subsets of $Un(S)$ where $S$ is a nonvoid inclusion-chain] ((S /= 0) & (FORALL u in S, v in S | (u incs v) or (v incs u)) & Finite(Y) & (Un(S) incs Y)) imp (EXISTS z in S | z incs Y). Proof:
Suppose_not(s0,y1) ==> Stat1: (FORALL u in s0, v in s0 | (u incs v) or (v incs u)) & Finite(y1) & (Un(s0) incs y1) & (s0 /= 0) & (not(EXISTS z in s0 | z incs y1))
--
-- Arguing by contradiction, let $s0,y0$ be a counterexample, so that
-- $s0$ is a nonvoid inclusion-chain and $y0$ is a finite subset of
-- $Un(s0)$ which is not included in any element of $s0$.
-- Finite induction enables us to assume that $y0$ is
-- inclusion-minimal; i.e., $y0$ has no strict subset $k$
-- which is not included in some $z in s0$.
--
	APPLY(m1_thryvar:y0) finite_induction(n->y1,P(y)->(not(EXISTS z in s0 | z incs y))) ==>
		Stat2: (not(EXISTS z in s0 | z incs y0)) & Stat3: (FORALL k incin y0 | ((k /= y0) imp (not(not(EXISTS z in s0 | z incs k))))) & (y0 incin y1)
--
-- We readily exclude the equality $y0 = 0$ because, if it held, then
-- we would have $arb(s0) in s0$ and $arb(s0) incs y0$, which
-- conflicts with Stat4 Hence $arb(y0) in y0$.
-- Observe that $arb(y0) in z0$ holds for some
-- $z0 in s0$ (for, we have supposed $Un(s0) incs y0$); moreover,
-- $z1 incs y0 - {arb(y0)}$ holds for some $z1 in s0$, in view of
-- the supposed minimality of $y0$ in the counterexample. Both of
-- $z0,z1$ belong to $s0$, and therefore either one must include
-- the other; it is plain that the larger owns $arb(y0)$ as an
-- element and includes $y0 - {arb(y0)}$ as one of its subsets, but
-- then it includes the entire $y0$, which leads us to the sought
-- contradiction.
--
	(arb(s0))-->Stat2(Stat1,Stat1) ==> Stat5: y0 /= 0
	(Stat1,Stat2,Stat5)ELEM ==> arb(y0) in Un(s0)
	Use_def(Un)(Stat6*) ==> Stat7: arb(y0) in {u: v in s0, u in v}
	(z0,u0)-->Stat7(Stat7*) ==> (z0 in s0) & (arb(y0) in z0)
	(Stat5,Stat5)ELEM ==> (y0 incs (y0 - {arb(y0)})) & (y0 /= y0 - {arb(y0)})
	(y0 - {arb(y0)})-->Stat3 ==> Stat8: (EXISTS z in s0 | z incs (y0 - {arb(y0)}))
	z1-->Stat8(Stat8*) ==> (z1 in s0) & (z1 incs (y0 - {arb(y0)}))
	(z0,z1)-->Stat1(Stat7) ==> (z0 incs z1) or (z1 incs z0)
	z0-->Stat2(Stat7*) ==> Stat9: z1 incs z0
	z1-->Stat2(Stat7*) ==> false
    Discharge ==> QED
--
-- =======================================================================================
--
-- Next we prove a variant Theorem 236 which states that the union of two sets is finite
-- if and only if their arithmetic sum is finite.
--
Theorem 240: [An arithmetic sum is finite if its two terms are finite] Finite(N PLUS M) eq Finite(N + M). Proof:
    Suppose_not(n,m) ==> Stat1: not(Finite(n PLUS m) eq Finite(n + m))
--
-- For suppose that $n$, $m$ give a counterexample. By Theorem 193 and Theorem 236 our assertion
-- reduces to the pair of conditions $Finite(n) eq Finite({[x,0]: x in n})$ and $Finite(m) eq Finite({[x,1]: x in m})$.
--
    Use_def(PLUS) ==> Finite(n PLUS m) eq Finite(#({[x,0]: x in n} + {[x,1]: x in m}))
    ({[x,0]: x in n} + {[x,1]: x in m})-->T193 ==>
	Finite(#({[x,0]: x in n} + {[x,1]: x in m})) eq (Finite({[x,0]: x in n} + {[x,1]: x in m}))
    ({[x,0]: x in n},{[x,1]: x in m})-->T236 ==>
	Finite({[x,0]: x in n} + {[x,1]: x in m}) eq (Finite({[x,0]: x in n}) & Finite({[x,1]: x in m}))
    (n,m)-->T236(Stat2*) ==> Stat2: Finite(n + m) eq (Finite(n) & Finite(m))
    (Stat1*)ELEM ==> Stat3: not((Finite(n) eq Finite({[x,0]: x in n})) & (Finite(m) eq Finite({[x,1]: x in m})))
	Loc_def ==> f = {[x,car(x)]: x in {[v,0]: v in n}}
--
-- But $n$ and ${[x,0]: x in n}$ are plainly in 1-1 correspondence, and similarly for m.
--
    APPLY(x9_thryvar:a,y9_thryvar:b) fcn_symbol(f(x)->car(x),g->f,s->{[x,0]: x in n}) ==>
		Stat4: Svm(f) & (domain(f) = {[x,0]: x in n}) & (range(f) = {car(x): x in {[v,0]: v in n}}) &
			Stat5: (((a in {[x,0]: x in n}) & (b in {[y,0]: y in n}) & ((car(a) = car(b)) & (a /= b))) or one_1_map(f))
    (aa,bb)--> Stat5(Stat4*) ==> Stat6: ((a = [aa,0]) &
    				(b = [bb,0]) & (car(a) = car(b)) & (a /= b)) or one_1_map(f)
    (Stat6)ELEM ==> Stat7: one_1_map(f)
    Loc_def ==> g = {[x,car(x)]: x in {[x,1]: x in m}}
    APPLY(x9_thryvar:c,y9_thryvar:d) fcn_symbol(f(x)->car(x),g->g,s->{[x,1]: x in m}) ==>
		Stat8: Svm(g) & (domain(g) = {[x,1]: x in m}) & (range(g) = {car(x): x in {[v,1]: v in m}}) &
	 		Stat9: (((c in {[x,1]: x in m}) & (d in {[y,1]: y in m}) & (car(c) = car(d)) & (c /= d)) or one_1_map(g))
    (cc,dd)--> Stat9(Stat8*) ==> Stat10: ((c = [cc,1]) &
				(d  = [dd,1]) & (car(c) = car(d)) & (c /= d)) or one_1_map(g)
    (Stat10)ELEM ==> Stat11: one_1_map(g)
    SIMPLF ==> {car(x): x in {[v,0]: v in n}} = {car([v,0]): v in n}
    Set_monot ==> {car([v,0]): v in n} = {v: v in n}
    SIMPLF ==> {v: v in n} = n
    ELEM ==> Stat12: range(f) = n
    SIMPLF ==> {car(x): x in {[v,1]: v in m}} = {car([v,1]): v in m}
    Set_monot ==> {car([v,1]): v in m} = {v: v in m}
    SIMPLF(Stat13) ==> Stat13: {v: v in m} = m
    ELEM ==> range(g) = m
    f-->T191(Stat7*) ==> Stat14: Finite(range(f)) eq Finite(domain(f))
--
-- From which our assertion is obvious.
--
    EQUAL(Stat4,Stat12,Stat14) ==> Stat15: Finite(n) eq Finite({[x,0]: x in n})
    g-->T191(Stat11*) ==> Finite(range(g)) eq Finite(domain(g))
    EQUAL(Stat8) ==> Stat16: Finite(m) eq Finite({[x,1]: x in m})
    (Stat3,Stat15,Stat16)Discharge ==> QED
--
-- It follows as a corollary of the preceding theorem that the arithmetic sum of two sets is finite
-- if and only if both of the sets are finite.
--
Theorem 241: [An arithmetic sum is finite if and only if both its terms are finite] (Finite(N) & Finite(M)) eq Finite(N PLUS M). Proof:
	Suppose_not(n,m) ==> not((Finite(n) & Finite(m)) eq Finite(n PLUS m))
    (n,m)-->T240 ==> Finite(n PLUS m) eq Finite(n + m)
    (n,m)-->T236 ==> false; Discharge ==> QED
--
Theorem 242: [acyclicity of the closure of membership] X notin Ult_membs(X). Proof:
Suppose_not(x) ==> AUTO
	APPLY(mt2_thryvar:m) transfinite_member_induction(n->x,P(x)->(x in Ult_membs(x))) ==>
		Stat1: (FORALL k | (m in Ult_membs(m)) & (m in Ult_membs({x})) & ((k in m) imp (not (k in Ult_membs(k)))))
	0-->Stat1(Stat1*) ==> Stat2: m in Ult_membs(m)
	m-->T15(Stat1,Stat1*) ==> Ult_membs(m) = m + {v: k in m, v in Ult_membs(k)}
	(Stat2*)ELEM ==> Stat3: m in {v: k in m, v in Ult_membs(k)}
	(k,v)-->Stat3(Stat3*) ==> Stat4: (k in m) & (m in Ult_membs(k))
	(m,k)-->T22(Stat4*) ==> Ult_membs(m) incin Ult_membs(k)
	Use_def(Ult_membs)(Stat4*) ==> Ult_membs(m) = (m + {y: u in {Ult_membs(x): x in m}, y in u})
	(Stat4*)ELEM ==> Stat5: k in Ult_membs(k)
k-->Stat1(Stat4,Stat5*) ==> false; Discharge ==> QED
--
--Theorem OM: [one-one-ness of $Ult_membs$] (Ult_membs(X) = Ult_membs(Y)) imp (X = Y). Proof:
--Suppose_not(x,y) ==> AUTO
--Tsomehow ==> false; Discharge ==> QED
--
--
Theorem 243: [acyclicity of the closure of membership] ((X in Ult_membs({Y})) & (Y in Ult_membs({X}))) imp (X = Y). Proof:
Suppose_not(x,y) ==> AUTO
--
-- (i) Suppose_not. Then $x /= y$. By Theorem 18,
--	$Ult_membs({y}) = {y} + Ult_membs(y)$,
--     so $x in Ult_membs(y)$, and similarly $y in Ult_membs(x)$.
--
	y-->T18 ==> Stat1: (x /= y) & (x in Ult_membs({y})) & (Ult_membs({y}) = ({y} + Ult_membs(y)))
	(Stat1*)ELEM ==> Stat2: x in Ult_membs(y)
	x-->T18 ==> Stat3: (y /= x) & (y in Ult_membs({x})) & (Ult_membs({x}) = ({x} + Ult_membs(x)))
	(Stat3*)ELEM ==> Stat4: y in Ult_membs(x)
--
-- (ii) By T22 $Ult_membs(y) incin Ult_membs(x)$, so $x in Ult_membs(x)$,
--      and everything comes down to showing that this last is impossible.
--
	(y,x)-->T22(Stat4,Stat2*) ==> Stat5: x in Ult_membs(x)
--
-- (iii) Supposing the contrary, consider
--		$t = {a in Ult_membs({x}) | a in Ult_membs(a)}$.
--       Plainly $x in t$ so $t$ is not null and we can consider
--       (the rabbit!) $u = arb(t)$. Plainly $u in Ult_membs(u)$ and
--       $u in Ult_membs({x})$. By Theorem 15
--		$Ult_membs(u) = u + {v: w in u, v in Ult_membs(w)}$,
--       and since $u in u$ is impossible there must exist a $w in u$
--       such that $u in Ult_membs(w)$. But then $w in Ult_membs(w)$,
--       and since $w in Ult_membs(x)$ this contradicts the minimality
--       of $u$ (as a member of $t$) and proves our theorem.
--
x-->T242(Stat5*) ==> false; Discharge ==> QED
--
Theorem 244: [existence of an $in$-maximal set in any finite set] (EXISTS v | Finite(F) imp (((F = 0) or (v in F)) & ({y in (F-{v}) | v in Ult_membs({y})} = 0))). Proof:
Suppose_not(f0) ==> Stat1: not(EXISTS v | Finite(f0) imp (((f0 = 0) or (v in f0)) & ({y in (f0-{v}) | v in Ult_membs({y})} = 0)))
	Suppose ==> not(Finite(f0))
	0-->Stat1(Stat1*) ==> false; Discharge ==> Finite(f0)
	APPLY(m1_thryvar:f) finite_induction(n->f0,P(x)->(not(EXISTS v | Finite(x) imp (((x = 0) or (v in x)) & ({y in (x-{v}) | v in Ult_membs({y})} = 0))))) ==>
		Stat2: (not(EXISTS v | Finite(f) imp (((f = 0) or (v in f)) & ({y in (f-{v}) | v in Ult_membs({y})} = 0)))) &
		Stat3: (FORALL k incin f | (k /= f) imp (not(not(EXISTS v | Finite(k) imp (((k = 0) or (v in k)) & ({y in (k-{v}) | v in Ult_membs({y})} = 0))))))
	Suppose ==> (not(Finite(f))) or (f = 0)
		0-->Stat2(Stat2*) ==> Stat4: ((f-{0}) = 0) & ({y in (f-{0}) | 0 in Ult_membs({y})} /= 0)
		EQUAL(Stat4*) ==> Stat5: {y in 0 | 0 in Ult_membs({y})} /= 0
	y0-->Stat5(Stat5*) ==> false; Discharge ==> Stat6: Finite(f) & (f /= 0)
	(f-{arb(f)})-->Stat3(Stat6) ==> Stat7: (EXISTS v | Finite(f-{arb(f)}) imp ((((f-{arb(f)}) = 0) or (v in (f-{arb(f)}))) & ({y in ((f-{arb(f)})-{v}) | v in Ult_membs({y})} = 0)))
	(f,f-{arb(f)})-->T189(Stat6*) ==> Finite(f-{arb(f)})
	v0-->Stat7(Stat7*) ==> Stat8: (((f-{arb(f)}) = 0) or (v0 in (f-{arb(f)}))) & ({y in ((f-{arb(f)})-{v0}) | v0 in Ult_membs({y})} = 0)
	Suppose ==> Stat9: (f-{arb(f)}) = 0
		(Stat6,Stat9)ELEM ==> Stat10: f = {arb(f)}
		(arb(f))-->Stat2(Stat6,Stat10*) ==> Stat11: {y in (f-{arb(f)}) | arb(f) in Ult_membs({y})} /= 0
	y1-->Stat11(Stat9*) ==> false; Discharge ==> Stat12: (f-{arb(f)}) /= 0
	v0-->Stat2(Stat6,Stat8,Stat12*) ==> Stat13: {y in (f-{v0}) | v0 in Ult_membs({y})} /= 0
	v1-->Stat13(Stat13*) ==> Stat14: (v1 in (f-{v0})) & (v0 in Ult_membs({v1}))
	v1-->T18(Stat14*) ==> Stat15: v0 in Ult_membs(v1)
	Suppose ==> v1 /= arb(f)
		(Stat8*)ELEM ==> (v1 in ((f-{arb(f)})-{v0})) & Stat16: (v1 notin {y in ((f-{arb(f)})-{v0}) | v0 in Ult_membs({y})})
	v1-->Stat16(Stat14*) ==> false; Discharge ==>  Stat17: v1 = arb(f)
	v1-->Stat2(Stat6,Stat12,Stat17) ==> Stat18: {y in (f-{v1}) | v1 in Ult_membs({y})} /= 0
	v2-->Stat18(Stat18*) ==> Stat19: (v2 in (f-{v1})) & (v1 in Ult_membs({v2}))
	(v1,{v2})-->T22(Stat19,Stat15*) ==> v0 in Ult_membs({v2})
	(Stat8*)ELEM ==> Stat20: v2 notin {y in ((f-{arb(f)})-{v0}) | v0 in Ult_membs({y})}
	()-->Stat20(Stat14*) ==> (v2 = v0) & (v0 /= v1)
	EQUAL(Stat14*) ==> (v0 in Ult_membs({v1})) & (v1 in Ult_membs({v0}))
(v0,v1)-->T243(Stat20*) ==> false; Discharge ==> QED
--
-- The next two results, both trivial corollaries of Theorem 139,
-- state that an arithmetic product is zero if either of its factors is zero.
--
Theorem 245: [Anything times 0 is 0] (N TIMES 0) = 0. Proof:
	Suppose_not(n) ==> (n TIMES 0) /= 0
    Use_def(TIMES) ==> (n TIMES 0) = #(n PROD 0)
    n-->T139 ==> (n PROD 0) = 0
    EQUAL ==> (n TIMES 0) = #0
    0-->T162 ==> false; Discharge ==> QED
--
Theorem 246: [0 times anything is 0] (0 TIMES N) = 0. Proof:
	Suppose_not(n) ==> (0 TIMES n) /= 0
    Use_def(TIMES) ==> (0 TIMES n) = #(0 PROD n)
    n-->T139 ==> (0 PROD n) = 0
    EQUAL ==> (0 TIMES n) = #0
    0-->T162 ==> false; Discharge ==> QED
--
-- It is also trivial to show that arithmetic addition of $0$ to any $n$ leaves n unchanged.
--
Theorem 247: [0 is a right additive identity] (#N PLUS 0) = #N. Proof:
	Suppose_not(n) ==> (#n PLUS 0) /= #n
    Use_def(PLUS) ==> (#n PLUS 0) = #({[x,0]: x in #n} + {[x,1]: x in 0})
    Set_monot ==> {[x,1]: x in 0} = {x: x in 0}
    SIMPLF ==> {[x,1]: x in 0} = 0
    ELEM ==> {[x,0]: x in #n} + {[x,1]: x in 0} = {[x,0]: x in #n}
    EQUAL ==> (#n PLUS 0) = #{[x,0]: x in #n}
    (0,#n)-->T218 ==> #{[x,0]: x in #n} = ##n
    n-->T166 ==> false; Discharge ==> QED
--
-- The two following results simply translate Theorem 223 into
-- a statement concerning integer multiplication.
--
Theorem 248: [1 is a left multiplicative identity] (1 TIMES N) = #N. Proof:
    Suppose_not(n) ==> (1 TIMES n) /= #n
    Use_def(TIMES) ==> (1 TIMES n) = #(1 PROD n)
    Use_def(1) ==> 1 = next(0)
    Use_def(next) ==> 1 = 0 + {0}
    ELEM ==> 1 = {0}
    EQUAL ==> #n /= #({0} PROD n)
    (0,n)-->T223 ==> false; Discharge ==> QED
--
Theorem 249: [1 is a right multiplicative identity] (N TIMES 1) = #N. Proof:
    Suppose_not(n) ==> (n TIMES 1) /= #n
    Use_def(TIMES) ==> (n TIMES 1) = #(n PROD 1)
    Use_def(1) ==> 1 = next(0)
    Use_def(next) ==> 1 = 0 + {0}
    ELEM ==> 1 = {0}
    EQUAL ==> #n /= #(n PROD {0})
    (n,0)-->T224 ==> false; Discharge ==> QED
--
-- Next we state and prove a result valid not only in integer but in cardinal arithmetic:
-- the product of $n$ and $m$ is no smaller than $n$ if the cardinal $m$ is non-zero.
--
Theorem 250: [Monotonicity of multiplication] (M /= 0) imp (#(N PROD M) incs #N). Proof:
    Suppose_not(m,n) ==> Stat1: (m /= 0) & (not #(n PROD m) incs #n)
--
-- For suppose that m and n are a counterexample to our assertion, and let d belong to m.
-- Consider the single-valued map f defined by f = {[x,car(x)]: x in {[y,d]: y in n}},
-- whose range is easily seen to be n, while its domain is plainly a subset of n PROD m.
--
    d-->Stat1 ==> (d in m) & ({d} incin m)
    Loc_def ==> f = {[x,car(x)]: x in {[y,d]: y in n}}
    APPLY() fcn_symbol(f(x)->car(x),g->f,s->{[y,d]: y in n}) ==>
		Svm(f) & (domain(f) = {[y,d]: y in n}) & (range(f) = {car(x): x in {[y,d]: y in n}})
    SIMPLF ==> range(f) = {car([y,d]): y in n}
    Set_monot ==> {car([y,d]): y in n} = {y: y in n}
    ELEM ==> range(f) = {y: y in n}
    SIMPLF ==> range(f) = n
    EQUAL ==> Stat2: #range(f) = #n
    SIMPLF ==> {[y,d]: y in n} = {[y,z]: y in n, z in {d}}
    Set_monot ==> {[y,z]: y in n, z in {d}} incin {[y,z]: y in n, z in m}
    Use_def(PROD) ==> domain(f) incin (n PROD m)
--
-- It follows by Theorem 170 and Theorem 171 that the cardinality of the domain of $f$ is no more than that of
-- $n PROD m$, while the cardinality of $range(f)$ is no more than that of $domain(f)$.
--
    (domain(f),n PROD m)-->T170 ==> Stat3: #domain(f) incin #(n PROD m)
    (f)-->T171 ==> Stat4: #range(f) incin #domain(f)
    (Stat1,Stat3,Stat4,Stat2*)Discharge ==> QED
--
-- The following elementary lemma prepares for the proof of the
-- commutative law for cardinal addition.
--
Theorem 251: [Distributivity lemma] (A /= B) imp (N PLUS M = #((N PROD {A}) + (M PROD {B}))). Proof:
    Suppose_not(a,b,n,m) ==> (a /= b) & (n PLUS m /= #((n PROD {a}) + (m PROD {b})))
--
-- For supposing the contrary we can derive a contradiction
-- using Theorem 221, Theorem 143, Theorem 220, Theorem 221, and Theorem 224 in the following order:
--
    (n,m)-->T221 ==> n PLUS m = #n PLUS #m
    ({a},{b},n,m)-->T143 ==> (n PROD {a}) * (m PROD {b}) = 0
    (n PROD {a},m PROD {b})-->T220 ==> (n PROD {a}) PLUS (m PROD {b}) = #((n PROD {a}) + (m PROD {b}))
    (n PROD {a},m PROD {b})-->T221 ==> (n PROD {a}) PLUS (m PROD {b}) = #(n PROD {a}) PLUS #(m PROD {b})
    ELEM ==> #(n PROD {a}) PLUS #(m PROD {b}) = #((n PROD {a}) + (m PROD {b}))
    (n,a)-->T224 ==> #(n PROD {a}) = #n
    (m,b)-->T224 ==> #(m PROD {b}) = #m
    EQUAL ==> #n PLUS #m = #((n PROD {a}) + (m PROD {b}))
    Discharge ==> QED
--
-- Next we prove the commutative laws for cardinal arithmetic.
-- For addition the proof results almost immediately from Theorem 251.
--
Theorem 252: [Commutative law for addition] (N PLUS M) = (M PLUS N). Proof:
    Suppose_not(n,m) ==> (n PLUS m) /= (m PLUS n)
    T212 ==> 1 /= 0
    (0,1,n,m)-->T251 ==> (n PLUS m) = #((n PROD {0}) + (m PROD {1}))
    (1,0,m,n)-->T251 ==> (m PLUS n) = #((m PROD {1}) + (n PROD {0}))
	ELEM ==> (n PROD {0}) + (m PROD {1}) = (m PROD {1}) + (n PROD {0})
    EQUAL ==> false; Discharge ==> QED
--
-- The commutative law for cardinal multiplication is
-- an equally elementary consequence of Theorem 251.
--
Theorem 253: [Commutative law for multiplication] N TIMES M = M TIMES N. Proof:
    Suppose_not(n,m) ==> n TIMES m /= m TIMES n
    Use_def(TIMES) ==> #(n PROD m) /= #(m PROD n)
    (n,m)-->T161 ==> false; Discharge ==> QED
--
-- We can now slightly generalize Theorem 247 by stating that 0 is a bilateral identity.
--
Theorem 254: [0 is bilateral additive identity] (X in Za) imp (((X PLUS 0) = X) & ((0 PLUS X) = X)). Proof+:
    Suppose_not(x) ==> AUTO
        Suppose ==> (x PLUS 0) /= x
            x-->T164 ==> x = #x
            EQUAL ==> ((#x) PLUS 0) /= #x
        x-->T247 ==> false; Discharge ==> ((x PLUS 0) = x) & ((0 PLUS x) /= x)
        (x,0)-->T252 ==> (x PLUS 0) = (0 PLUS x)
    Discharge ==> QED
--
-- The following lemma states several facts which can be regarded as modified
-- 'distributive laws' for the Cartesian product.
--
Theorem 255: [Rules for intersection and union of Cartesian products] ((A PROD X) * (B PROD X) = (A * B) PROD X) & ((A PROD X) + (B PROD X) = (A + B) PROD X) &
	(((X PROD A) * (X PROD B)) = X PROD (A * B)) & (((X PROD A) + (X PROD B)) = X PROD (A + B)). Proof:
--
-- For suppose the contrary, and let a, b, and c be a counterexample to one of the four clauses of our theorem.
--
    Suppose_not(a,c,b) ==> ((a PROD c) * (b PROD c) /= ((a * b) PROD c) or (a PROD c) + (b PROD c) /= ((a + b) PROD c) or
	((c PROD a) * (c PROD b)) /= (c PROD (a * b)) or ((c PROD a) + (c PROD b)) /= c PROD (a + b))
--
-- Use of the definition of the cartesian product and of its evident additivity in both its arguments
-- tells us that neither the second or the fourth clause of our theorem can be violated.
--
    Suppose ==> ((a PROD c) + (b PROD c)) /= ((a + b) PROD c)
    Use_def(PROD) ==> {[x,y]: x in a, y in c} + {[x,y]: x in b, y in c} /= {[x,y]: x in a + b, y in c}
    Set_monot ==> {[x,y]: x in a, y in c} + {[x,y]: x in b, y in c} = {[x,y]: x in a + b, y in c}
    Discharge ==> (a PROD c) + (b PROD c) = ((a + b) PROD c)
    Suppose ==> ((c PROD a) + (c PROD b)) /= c PROD (a + b)
    Use_def(PROD) ==> {[x,y]: x in c, y in a} + {[x,y]: x in c, y in b} /= {[x,y]: x in c, y in a + b}
    Set_monot ==> {[x,y]: x in c, y in a} + {[x,y]: x in c, y in b} = {[x,y]: x in c, y in a + b}
    Discharge ==> ((c PROD a) + (c PROD b)) = c PROD (a + b)
--
-- Next suppose that the second clause of the theorem is violated. Using the definition of Cartesian product,
-- we see that there must exist an element $d$ which belongs to one of the two sets
--
--			${[x,y]: x in a, y in c} * {[x,y]: x in b, y in c}$	and		${[x,y]: x in a * b, y in c}$
--
-- but not the other. But if $d$ is in the first of these two sets but not the second we are led to the
-- elementary contradiction seen below.
--
    Suppose ==> (a PROD c) * (b PROD c) /= (a * b) PROD c
    Use_def(PROD) ==> Stat1: {[x,y]: x in a, y in c} * {[x,y]: x in b, y in c} /= {[x,y]: x in a * b, y in c}
    d-->Stat1 ==>
	((not((d in {[x,y]: x in a, y in c}) & (d in {[x,y]: x in b, y in c})) & (d in {[x,y]: x in a * b, y in c})) or
	((d in {[x,y]: x in a, y in c}) & (d in {[x,y]: x in b, y in c}) & (d notin {[x,y]: x in a * b, y in c})))
 Suppose ==>
    Stat2: ((d in {[x,y]: x in a, y in c}) & (d in {[x,y]: x in b, y in c})) & Stat3: (d notin {[x,y]: x in a * b, y in c})
    (a1,c1,b1,c2)-->Stat2 ==> Stat4: (d = [a1,c1]) & (a1 in a) & (c1 in c) & (d = [b1,c2]) & (b1 in b) & (c2 in c)
    (Stat4)ELEM ==> a1 in a * b
    (a1,c1)-->Stat3 ==> not(d = [a1,c1]) & (a1 in a * b) & (c1 in c)
--
-- Thus $d$ must be in the second of the two sets displayed above, but not the first. However, this assertion
-- is in evident contradiction with the monotone dependence of the cartesian product on its arguments.
-- This shows that it is only the fourth clause of our theorem that could be false.
--
    Discharge ==> not((d in {[x,y]: x in a, y in c}) & (d in {[x,y]: x in b, y in c})) & (d in {[x,y]: x in a * b, y in c})
    Set_monot ==> {[x,y]: x in a * b, y in c} incin {[x,y]: x in a, y in c}
    Set_monot ==> {[x,y]: x in a * b, y in c} incin {[x,y]: x in b, y in c}
    Discharge ==> ((c PROD a) * (c PROD b)) /= (c PROD (a * b))
--
-- But an argument almost identical to that just given can be used to rule out this last possibility.
-- For, using the definition of Cartesian product,
-- we see that there must exist an element $d2$ which belongs to one of the two sets seen just below, but not the other.
--
    Use_def(PROD) ==> Stat5: {[x,y]: x in c, y in a} * {[x,y]: x in c, y in b} /= {[x,y]: x in c, y in a * b}
    d2-->Stat5 ==>
	(((not((d2 in {[x,y]: x in c, y in a}) & (d2 in {[x,y]: x in c, y in b}))) & (d2 in {[x,y]: x in c, y in a * b})) or
	((d2 in {[x,y]: x in c, y in a}) & (d2 in {[x,y]: x in c, y in b}) & (d2 notin {[x,y]: x in c, y in a * b})))
--
-- If $d2$ is in the first of these two sets but not the second we are led to the
-- elementary contradiction seen below.
--
 Suppose ==>
    Stat6: (d2 in {[x,y]: x in c, y in a}) & (d2 in {[x,y]: x in c, y in b}) & Stat7: (d2 notin {[x,y]: x in c, y in a * b})
    (a21,c21,b21,c22)-->Stat6 ==> (d2 = [a21,c21]) & (a21 in c) & (c21 in a) & (d2 = [b21,c22]) & (b21 in c) & (c22 in b)
    ELEM ==> c21 in a * b
    (a21,c21)-->Stat7 ==> (not(d2 = [a21,c21])) & (a21 in c) & (c21 in a * b)
--
-- Thus $d2$ must be in the second of the two sets seen just above, but not the first. However, this assertion
-- is in contradiction with the monotone dependence of the cartesian product on its arguments.
-- This shows that none of the clauses of our theorem can be false, which is what we wanted to prove.
--
    Discharge ==> ((not((d2 in {[x,y]: x in c, y in a}) & (d2 in {[x,y]: x in c, y in b}))) & (d2 in {[x,y]: x in c, y in a * b}))
    Set_monot ==> {[x,y]: x in c, y in a * b} incin {[x,y]: x in c, y in a}
    Set_monot ==> {[x,y]: x in c, y in a * b} incin {[x,y]: x in c, y in b}
    Discharge ==> QED
--
-- The following 'monotonicity' consequence of Theorem 255 is often useful.
--
Theorem 256: [Cartesian product monotonicity] ((A incin B) & (C incin D)) imp ((A PROD C) incin (B PROD D)). Proof:
	Suppose_not(a,b,c,d) ==> (a incin b) & (c incin d) & (not ((a PROD c) incin (b PROD d)))
--
-- For the proof we have only to use Theore 203 twice and the use the transitivity of inclusion.
--
	(c,a,d)-->T255 ==> (a PROD c) * (a PROD d) = (a PROD (c * d))
	(a,d,b)-->T255 ==> (a PROD d) * (b PROD d) = ((a * b) PROD d)
	ELEM ==> (c * d = c) & (a * b = a)
	EQUAL ==> ((a PROD c) * (a PROD d) = (a PROD c)) & ((a PROD d) * (b PROD d) = (a PROD d))
	Discharge ==> QED
--
-- Sometimes one needs the following generalization of Theorem 255.
--
Theorem 257: [Intersection of Cartesian products] ((A PROD C) * (B PROD D) = (A * B) PROD (C * D)). Proof:
    Suppose_not(a,c,b,d) ==> (a PROD c) * (b PROD d) /= (a * b) PROD (c * d)
--
-- For suppose that $a$, $c$, $b$, $d$ form a counterexample to our assertion.
--
    (a * b,a,c * d,c)-->T256 ==> ((a * b) PROD (c * d)) incin (a PROD c)
    (a * b,b,c * d,d)-->T256 ==>((a * b) PROD (c * d)) incin (b PROD d)
    ELEM ==> Stat1: not(((a * b) PROD (c * d)) incs ((a PROD c) * (b PROD d)))
    u-->Stat1 ==> (u in (a PROD c)) & (u in (b PROD d)) & (u notin ((a * b) PROD (c * d)))
    Use_def(PROD) ==> Stat2: (u in {[x,y]: x in a,y in c}) & (u in {[x,y]: x in b,y in d}) &
    							Stat3: (u notin {[x,y]: x in a * b,y in c * d})
    (x1,y1,x2,y2)-->Stat2 ==> (x1 in a) & (y1 in c) & (u = [x1,y1]) & (x2 in b) & (y2 in d) & (u = [x2,y2])
    ELEM ==> (x1 in b) & (y1 in d)
    (x1,y1)-->Stat3 ==> false; Discharge ==> QED
--
-- Next we prove the associative law, first for cardinal addition, then for cardinal multiplication.
--
Theorem 258: [Associativity of arithmetic addition] N PLUS (M PLUS K) = (N PLUS M) PLUS K. Proof:
    Suppose_not(n,m,k) ==> n PLUS (m PLUS k) /= (n PLUS m) PLUS k
--
-- For let $n$, $m$, and $k$ be a counterexample to our assertion. It is clear that the sets
-- $n PROD {0}$, $m PROD {1}$, and $k PROD {2}$ are all disjoint, so that by Theorem 228 the sums
-- $((m PROD {1}) PLUS (k PROD {2})) PLUS (n PROD {0})$ and $((n PROD {0}) + (m PROD {1})) + (k PROD {2})$
-- can both be written as the cardinality of their union and so are equal.
--
	T212 ==> Stat1: (1 /= 0) & (2 /= 0) & (1 /= 2)
	ELEM ==> Stat2: ({1} * {0} = 0) & ({2} * {0} = 0) & ({1} * {2} = 0)
	({0},{1},n,m)-->T143 ==> (n PROD {0}) * (m PROD {1}) = 0
	({1},{2},m,k)-->T143 ==> (m PROD {1}) * (k PROD {2}) = 0
	({0},{2},n,k)-->T143 ==> (n PROD {0}) * (k PROD {2}) = 0
	(n PROD {0},m PROD {1},k PROD {2})-->T228 ==>
	((n PROD {0}) PLUS (m PROD {1})) PLUS (k PROD {2}) = #(((n PROD {0}) + (m PROD {1})) + (k PROD {2}))
	(m PROD {1},k PROD {2},n PROD {0})-->T228 ==>
	((m PROD {1}) PLUS (k PROD {2})) PLUS (n PROD {0})  = #(((m PROD {1}) + (k PROD {2})) + (n PROD {0}))
	(Stat1,Stat2*)ELEM ==>
	((m PROD {1}) + (k PROD {2})) + (n PROD {0}) = ((n PROD {0}) + (m PROD {1})) + (k PROD {2})
	EQUAL ==> #(((m PROD {1}) + (k PROD {2})) + (n PROD {0})) = #(((n PROD {0}) + (m PROD {1})) + (k PROD {2}))
	((m PROD {1}) PLUS (k PROD {2}),n PROD {0})-->T252 ==>
	((m PROD {1}) PLUS (k PROD {2})) PLUS (n PROD {0}) = (n PROD {0}) PLUS((m PROD {1}) PLUS (k PROD {2}))
	ELEM ==> Stat3: ((n PROD {0}) PLUS (m PROD {1})) PLUS (k PROD {2}) =
				(n PROD {0}) PLUS ((m PROD {1}) PLUS (k PROD {2}))
--
-- The cardinalities of the sets $n PROD {0}$ etc. are clearly equal to $#n$, $#m$, and $#k$ respectively,
-- and so the inner sums appearing in this last formula can be replaced by sums like $n PLUS m$ etc.
--
	(n,0)-->T224 ==> #(n PROD {0}) = #n
	(m,1)-->T224 ==> #(m PROD {1}) = #m
	(k,2)-->T224 ==> #(k PROD {2}) = #k
	(n PROD {0},m PROD {1})-->T221 ==> (n PROD {0}) PLUS (m PROD {1}) = (#(n PROD {0}) PLUS (#(m PROD {1})))
	EQUAL ==> (n PROD {0}) PLUS (m PROD {1}) = #n PLUS #m
	(m PROD {1},k PROD {2})-->T221 ==> (m PROD {1}) PLUS (k PROD {2}) = (#(m PROD {1})) PLUS (#(k PROD {2}))
	EQUAL ==> (m PROD {1}) PLUS (k PROD {2}) = (#m PLUS #k)
	(n,m)-->T221 ==> #n PLUS #m = n PLUS m
	(m,k)-->T221 ==> #m PLUS #k = m PLUS k
	EQUAL ==> (n PLUS m) PLUS (k PROD {2}) = (n PROD {0}) PLUS (m PLUS k)
--
-- However, we can replace the sets $k PROD {2}$ and $n PROD {0}$ appearing in this last formula by their cardinalities.
--
	(n PLUS m,(k PROD {2}))-->T226 ==> (n PLUS m) PLUS (k PROD {2}) = (n PLUS m) PLUS #(k PROD {2})
	(n PROD {0},m PLUS k)-->T227 ==> (n PROD {0}) PLUS (m PLUS k) = (#(n PROD {0})) PLUS (m PLUS k)
	EQUAL ==> (n PLUS m) PLUS #k = #n PLUS (m PLUS k)
--
-- And finally can use remove the two cardinality operators appearing in this last formula
-- to obtain the assertion of the present theorem.
--
	(n PLUS m,k)-->T226 ==> (n PLUS m) PLUS k = #n PLUS (m PLUS k)
	(n,m PLUS k)-->T227 ==>  false; Discharge ==> QED
--
-- Our next two theorems respectively give the associative law for multiplication and the
-- distributive law for multiplication over addition.
--
Theorem 259: [Associativity of arithmetic multiplication] N TIMES (M TIMES K) = (N TIMES M) TIMES K. Proof:
    Suppose_not(n,m,k) ==> n TIMES (m TIMES k) /= (n TIMES m) TIMES k
--
-- For suppose that $n$, $m$, and $k$ be a counterexample to the asserted associative law.
-- Using the definition of '$TIMES$', we can easily see that #$(n PROD (m PROD k))$
-- and $#((n PROD m) PROD k)$ must then be different.
--
    Use_def(TIMES) ==> n TIMES #(m PROD k) /= #(n PROD m) TIMES k
    Use_def(TIMES) ==> #(n PROD #(m PROD k)) /= #(#(n PROD m) PROD k)
    (n,m PROD k)-->T233 ==> #(n PROD #(m PROD k)) = #(n PROD (m PROD k))
    (n PROD m,k)-->T234 ==> #(#(n PROD m) PROD k) = #((n PROD m) PROD k)
--
-- But this clearly violates Theorem 160.
--
    (n,m,k)-->T160 ==> #(n PROD (m PROD k)) = #((n PROD m) PROD k)
    Discharge ==> QED
--
-- The following is the 'right-hand' version of the distributive law for integer multiplication over addition.
--
Theorem 260: [Arithmetic distributive law] N TIMES (M PLUS K) = (N TIMES M) PLUS (N TIMES K). Proof:
    Suppose_not(n,m,k) ==> n TIMES (m PLUS k) /= (n TIMES m) PLUS (n TIMES k)
--
-- For supposing the contrary, we can use the definition of '$PLUS$' on the left of the resulting inequality
-- and of '$TIMES$' on the right, and then simplify further, removing superfluous cardinality operators to get
-- the final inequality seen just before the next comment below.
--
 	T212 ==> Stat1: 0 /= 1
 	(m,k)-->T221 ==> (m PLUS k) = (#m PLUS #k)
    (0,1,m,k)-->T225 ==> (#m PLUS #k) = #((m PROD {0}) + (k PROD {1}))
    EQUAL ==> n TIMES #((m PROD {0}) + (k PROD {1})) /= (n TIMES m) PLUS (n TIMES k)
    Use_def(TIMES) ==> n TIMES #((m PROD {0}) + (k PROD {1})) /= #(n PROD m) PLUS #(n PROD k)
    (n,(m PROD {0}) + (k PROD {1}))-->T231 ==>
	n TIMES ((m PROD {0}) + (k PROD {1})) /= #(n PROD m) PLUS #(n PROD k)
    (#(n PROD m),n PROD k)-->T226 ==> n TIMES ((m PROD {0}) + (k PROD {1})) /= #(n PROD m) PLUS (n PROD k)
    (#(n PROD m),n PROD k)-->T252 ==> #(n PROD m) PLUS (n PROD k) = (n PROD k) PLUS #(n PROD m)
    (n PROD k,n PROD m)-->T226 ==> #(n PROD m) PLUS (n PROD k) = (n PROD k) PLUS (n PROD m)
    (n PROD m,n PROD k)-->T252 ==> #(n PROD m) PLUS (n PROD k) = (n PROD m) PLUS (n PROD k)
    Use_def(TIMES) ==> #(n PROD ((m PROD {0}) + (k PROD {1}))) /= (n PROD m) PLUS (n PROD k)
 --
-- The right-hand side of this last inequality can then be rewritten as follows
-- using Theorem 225:
--
  	(n PROD m,n PROD k)-->T221 ==> ((n PROD m) PLUS (n PROD k)) = (#(n PROD m) PLUS #(n PROD k))
    (0,1,n PROD m,n PROD k)-->T225 ==>
    	(#(n PROD m) PLUS #(n PROD k)) = #(((n PROD m) PROD {0}) + ((n PROD k) PROD {1}))
    (m PROD {0},n,k PROD {1})-->T255 ==>
    	(n PROD ((m PROD {0}) + (k PROD {1}))) = ((n PROD (m PROD {0})) + (n PROD (k PROD {1})))
    EQUAL ==> #((n PROD (m PROD {0})) + (n PROD (k PROD {1}))) /= #(((n PROD m) PROD {0}) + ((n PROD k) PROD {1}))
--
-- But the pairs of terms in this last inequality are easily seen to be disjoint:
--
	({0},{1},m,k)-->T143(Stat1,Stat1) ==> (m PROD {0}) * (k PROD {1}) = 0
	(m PROD {0},n,k PROD {1})-->T255 ==>
	(n PROD (m PROD {0})) * (n PROD (k PROD {1})) = (n PROD ((m PROD {0}) * (k PROD {1})))
	EQUAL ==> (n PROD (m PROD {0})) * (n PROD (k PROD {1})) = (n PROD 0)
	n-->T139 ==> (n PROD (m PROD {0})) * (n PROD (k PROD {1})) = 0
	({0},{1},n PROD m,n PROD k)-->T143 ==> ((n PROD m) PROD {0}) * ((n PROD k) PROD {1}) = 0
--
-- It now follows using Theorem 222 that the cardinalities of unions seen above
-- can be rewritten as arithmetic sums:
--
	(n PROD (m PROD {0}),n PROD (k PROD {1}))-->T222 ==>
	#((n PROD (m PROD {0})) + (n PROD (k PROD {1}))) = #(n PROD (m PROD {0})) PLUS #(n PROD (k PROD {1}))
	((n PROD m) PROD {0},(n PROD k) PROD {1})-->T222 ==>
	#(((n PROD m) PROD {0}) + ((n PROD k) PROD {1})) = #((n PROD m) PROD {0}) PLUS #((n PROD k) PROD {1})
	ELEM ==> Stat2: #(n PROD (m PROD {0})) PLUS #(n PROD (k PROD {1})) /= #((n PROD m) PROD {0}) PLUS #((n PROD k) PROD {1})
--
-- But this last inequality is easily seen to be impossible:
--
       (n,m,{0})-->T160 ==> #(n PROD (m PROD {0})) = #((n PROD m) PROD {0})
       (n,k,{1})-->T160 ==> #(n PROD (k PROD {1})) = #((n PROD k) PROD {1})
    EQUAL(Stat2) ==> false; Discharge ==> QED
--
-- Next we show that the product of two finite sets is finite. The  proof uses
-- the method of finite induction introduced above.
--
Theorem 261: [The arithmetic product of two finite sets is finite] (Finite(N) & Finite(M)) imp Finite(N TIMES M). Proof:
    Suppose_not(n,m) ==> Finite(n) & Finite(m) & (not Finite(n TIMES m))
--
-- For suppose that there exist finite $n$ and $m$ such that $n PROD m$ is infinite.
-- By our theory of finite induction, there exists finite $k$ and $mp$ such that $k PROD mp$ is
-- infinite, but $j PROD m2$ is finite for every finite m and proper subset $j$ of $k$.
--
    Use_def(TIMES) ==> Finite(n) & Finite(m) & (not Finite(#(n PROD m)))
    ({[x,y]: x in n & y in m})-->T193 ==> Finite(n) & Finite(m) & (not Finite(n PROD m))
    Suppose ==> Stat1: not(EXISTS m | Finite(m) & (not Finite(n PROD m)))
    m-->Stat1 ==> false; Discharge ==> Finite(n) & (EXISTS m | Finite(m) & (not Finite(n PROD m)))
    APPLY(m1_thryvar:k1) finite_induction (n->n,p(n)->Finite(n) & (EXISTS m | Finite(m) & (not Finite(n PROD m)))) ==>
		Finite(k1) & (EXISTS m | Finite(m) & (not Finite(k1 PROD m))) &
			(FORALL j incin k1 | ((j /= k1) imp (not(Finite(j) & (EXISTS m | Finite(m) & (not Finite(j PROD m)))))))
	Loc_def ==> k = k1
	EQUAL ==> Finite(k) & Stat2: (EXISTS m | Finite(m) & (not Finite(k PROD m))) &
			Stat3: (FORALL j incin k | ((j /= k) imp (not(Finite(j) & (EXISTS m | Finite(m) & (not Finite(j PROD m)))))))
    mp-->Stat2 ==> Stat4: Finite(mp) & (not Finite(k PROD mp))
--
-- Since $0 PROD mp$ is $0$, $k$ obviously cannot be empty, and so has a member $c$.
--
    Suppose ==> k = 0
    EQUAL ==> k PROD mp = 0 PROD mp
    mp-->T139 ==> k PROD mp = 0
    EQUAL ==> not Finite(0)
    T188 ==> false; Discharge ==> Stat5: k /= 0
    c-->Stat5 ==> Stat6: c in k
--
-- But then $k - {c}$ is a proper subset of $k$, so $(k - {c}) PROD m$ must be finite, and therefore
-- $((k - {c}) PROD m) + ({c} PROD m) = k PROD m$ must also be finite, a contradiction
-- which proves the present theorem.
--
   (Stat6)ELEM ==> (k = (k - {c}) + {c}) & ((k - {c}) incin k) & ((k - {c}) * {c} = 0)
    ELEM ==> Finite(k - {c})
    (k - {c})-->Stat3 ==> Stat7: not(EXISTS m | Finite(m) & (not Finite((k - {c}) PROD m)))
    mp-->Stat7 ==> Finite((k - {c}) PROD mp)
    (k - {c},mp,{c})-->T255 ==> ((k - {c}) + {c}) PROD mp = ((k - {c}) PROD mp) + ({c} PROD mp)
    ELEM ==> (k - {c}) + {c} = k
    EQUAL ==> k PROD mp = ((k - {c}) PROD mp) + ({c} PROD mp)
    (mp)-->T193 ==> Finite(#mp)
    (c,mp)-->T223 ==> #({c} PROD mp) = #mp
    EQUAL ==> Finite(#({c} PROD mp))
    ({c} PROD mp)-->T193 ==> Finite({c} PROD mp)
    ((k - {c}) PROD mp,{c} PROD mp)-->T236 ==> Finite(((k - {c}) PROD mp) + ({c} PROD mp))
    EQUAL ==> Stat8: Finite(k PROD mp)
    (Stat4,Stat8)Discharge ==> QED
--
-- The following is a simple corollary of Theorem 261
--
Theorem 262: [The Cartesian product of two finite sets is finite] (Finite(N) & Finite(M)) imp Finite(N PROD M). Proof:
    Suppose_not(n,m) ==> Finite(n) & Finite(m) & (not Finite(n PROD m))
	(n PROD m)-->T193 ==> not Finite(#(n PROD m))
	Use_def(TIMES) ==> not Finite(#(n TIMES m))
	(n,m)-->T261 ==> false; Discharge ==> QED
--
-- The following result restates the preceding theorem as a statement about the arithmetic multiplication operator.
--
Theorem 263: [If the product of two nonzero terms is finite, so are the terms] ((Finite(N) & Finite(M)) or N = 0 or M = 0) eq Finite(N TIMES M). Proof:
    Suppose_not(n,m) ==> Stat1: not(((Finite(n) & Finite(m)) or n = 0 or m = 0) eq Finite(n TIMES m))
--
-- For let $n$, $m$ be a counterexample to our assertion. It is easily seen that neither  $n$ nor $m$
-- can be empty, so either both must be finite and $n TIMES m$ infinite, or the revers.
--
    T188 ==> Finite(0)
    Suppose ==> n = 0
    EQUAL ==> Finite(n TIMES m) eq Finite(0 TIMES M)
    m-->T246 ==> 0 TIMES m = 0
    EQUAL ==> Finite(n TIMES m) eq Finite(0)
    Discharge ==> Stat2: n /= 0
    Suppose ==> m = 0
    EQUAL ==> Finite(n TIMES m) eq Finite(n TIMES 0)
    n-->T245 ==> n TIMES 0 = 0
    EQUAL ==> Finite(n TIMES 0) eq Finite(0)
    Discharge ==> Stat3: m /= 0
    (Stat1,Stat2,Stat3*)ELEM ==> not((Finite(n) & Finite(m)) eq Finite(n TIMES m))
--
-- Since $#(n PROD m)$ is evidently no less than
-- either $n$ and $m$, the second case is ruled out, so we have only to consider the first case.
--
    Suppose ==> Stat4: Finite(n TIMES m) & (not(Finite(n) & Finite(m)))
    Use_def(TIMES) ==> Finite(#(n PROD m))
    (m,n)-->T250 ==> #(n PROD m) incs #n
    (#(n PROD m),#n)-->T189 ==> Finite(#n)
    n-->T193 ==> Stat5: Finite(n)
    (n,m)-->T253 ==> n TIMES m = m TIMES n
    EQUAL ==> Finite(m TIMES n)
    Use_def(TIMES) ==> Finite(#(m PROD n))
    (n,m)-->T250 ==> #(m PROD n) incs #m
    (#(m PROD n),#m)-->T189 ==> Finite(#m)
    m-->T193 ==> Stat6: Finite(m)
    (Stat4,Stat5,Stat6*)Discharge ==> Finite(n) & Finite(m) & (not Finite(n TIMES m))
--
-- But the preceding theorem rules out this case, so our proof is complete.
--
    Use_def(TIMES) ==> not Finite(#(n PROD m))
    (n PROD m)-->T193 ==> not Finite(n PROD m)
    (n,m)-->T262 ==> false; Discharge ==>QED
--
-- We continue by proving that the power set of a finite set is also finite.
--
Theorem 264: [A set is finite if and only if its powerset is finite] Finite(N) eq Finite(pow(N)). Proof:
    Suppose_not(n) ==> (Finite(n) & (not Finite(pow(n)))) or ((not Finite(n)) & Finite(pow(n)))
--
-- If the asserted equivalence is false, there must exist an either a finite $n$ with an infinite power set,
-- or an infinite $n$ with a finite power set. Consider the second of these cases first.
-- In this case  ${arb(x): x in pow(n) - {0}}$, which is the range of the function $arb$ on the set $n$, must be finite.
-- But since every singleton ${y}$, with $y in n$, belongs to $pow(n) - {0}$,
-- it is plain that ${arb(x): x in pow(n) - {0}}$ includes $n$, ruling out this case.
--
    Suppose ==> (not Finite(n)) & Finite(pow(n))
    Loc_def ==> f = {[x,arb(x)]: x in pow(n) - {0}}
    APPLY() fcn_symbol(f(x)->arb(x),g->f,s->pow(n) - {0}) ==>
		Svm(f) & (domain(f) = pow(n) - {0}) & (range(f) = {arb(x): x in pow(n) - {0}})
    Suppose ==> Stat1: not (range(f) incin n)
    cp-->Stat1 ==> (cp in range(f)) & (cp notin n)
    ELEM ==> Stat2: cp in {arb(x): x in pow(n) - {0}}
    d-->Stat2 ==> (cp = arb(d)) & (d in pow(n) - {0})
    d-->T0 ==> cp in d
    Use_def(pow) ==> Stat3: d in {x: x incin n}
    d1-->Stat3 ==> d incin n
    Discharge ==> range(f) incin n
    Suppose ==> Stat4: not (n incin range(f))
    a-->Stat4 ==> (a notin range(f)) & (a in n)
    ELEM ==> Stat5: a notin {arb(x): x in pow(n) - {0}}
    {a}-->Stat5 ==> not(({a} /= 0) & (a = arb({a})) & ({a} in pow(n)))
    ELEM ==> {a} notin pow(n)
    Use_def(pow) ==> Stat6: {a} notin {x: x incin n}
    {a}-->Stat6 ==> not ({a} incin n)
    Discharge ==> range(f) = n
    ELEM ==> Finite(pow(n) - {0})
    EQUAL ==> Finite(domain(f))
    f-->T192 ==> Finite(range(f))
    Discharge ==> Finite(n) & (not Finite(pow(n)))
--
-- Thus it follows that if our theorem is false there must exist a finite $n$ with an infinite power set,
-- in which case the principle of finite induction tells us that there exists such a set $m$ with no
-- proper subset having the same property. Since {0} is finite, $m$ cannot be 0,
-- and therefore it must have some member $c$.
--
    APPLY(m1_thryvar:m) finite_induction(n->n,P(x)-> (not Finite(pow(x)))) ==> (m incin n) & (not Finite(pow(m))) &
			Stat7: (FORALL k incin m | ((k /= m) imp Finite(pow(k))))
    Suppose ==> m = 0
    T213 ==> pow(0) = {0}
    EQUAL ==> pow(m) = {0}
    EQUAL ==> not Finite({0})
    T188 ==> Finite(0)
    (0,0)-->T199 ==> Finite(0 + {0})
    ELEM ==> 0 + {0} = {0}
    EQUAL ==> Finite({0})
    Discharge ==> Stat8: m /= 0
    c-->Stat8 ==> Stat9: c in m
--
-- We can therefore decompose $pow(m)$ into (i) the collection of all subsets of $m$ which do contain $c$,
-- and (ii) the collection of all subsets of $m$ which do not contain $c$. It is easily seen that collection $b$
-- is the power set of $m - {c}$, and so, by the minimality of $m$, collection $b$ must be finite,
-- and therefore collection (i) must be infinite.
--
    Set_monot ==> {x: x in pow(m) | true} = {x: x in pow(m) | c in x or c notin x}
    SIMPLF ==> pow(m) = {x: x in pow(m) | c in x or c notin x}
    Set_monot ==> {x: x in pow(m) | c in x or c notin x} = {x: x in pow(m) | c in x} + {x: x in pow(m) | c notin x}
    ELEM ==> pow(m) = {x: x in pow(m) | c in x} + {x: x in pow(m) | c notin x}
    Use_def(pow) ==> {x: x in pow(m) | c notin x} = {x: x in {x: x incin m} | c notin x}
    SIMPLF ==> Stat10: {x: x in pow(m) | c notin x} = {x: x incin m | c notin x}
    Suppose ==> Stat11: {x: x incin m | c notin x} /= {x: x incin (m - {c})}
    dq-->Stat11 ==> (((dq in {x: x incin m | c notin x}) & (dq notin {x: x incin (m - {c})})) or
	((dq notin {x: x incin m | c notin x}) & (dq in {x: x incin (m - {c})})))
    Suppose ==> Stat12: (dq in {x: x incin m | c notin x}) & Stat13: (dq notin {x: x incin (m - {c})})
    ap-->Stat12 ==> (dq = ap) & (ap incin m) & (c notin ap)
    ap-->Stat13 ==> not((dq = ap) & (ap incin (m - {c})))
    Discharge ==> Stat14: (dq notin {x: x incin m | c notin x}) & Stat15: (dq in {x: x incin (m - {c})})
    b-->Stat15 ==> (dq = b) & (b incin (m - {c}))
    b-->Stat14 ==> not((dq incin m) & (c notin dq))
    Discharge ==> Stat16: {x: x incin m | c notin x} = {x: x incin (m - {c})}
    (Stat16,Stat10)ELEM ==> {x: x in pow(m) | c notin x} = {x: x incin (m - {c})}
    Use_def(pow) ==> {x: x in pow(m) | c notin x} = pow(m - {c})
    ELEM ==> (m - {c} incin m) & (m - {c} /= m)
    (m - {c})-->Stat7 ==> Finite(pow(m - {c}))
    EQUAL ==> Finite({x: x incin (m - {c})}) & Finite({x: x in pow(m) | c notin x})
    ({x: x in pow(m) | c in x},{x: x in pow(m) | c notin x})-->T236(*) ==>
    	(Finite({x: x in pow(m) | c in x}) & Finite({x: x in pow(m) | c notin x})) eq
    		Finite({x: x in pow(m) | c in x} + {x: x in pow(m) | c notin x})
    EQUAL ==> (Finite({x: x in pow(m) | c in x}) & Finite({x: x in pow(m) | c notin x})) eq Finite(pow(m))
    ELEM ==> not Finite({x: x in pow(m) | c in x})
    Use_def(pow) ==> not Finite({x: x in {y: y incin m} | c in x})
    SIMPLF ==> {x: x in {y: y incin m} | c in x} = {y: y incin m | c in y}
    EQUAL ==>  not Finite({y: y incin m | c in y})
--
-- But it is also easy to see that the single-valued map $ff(x)->x + {c}$ maps $pow(m - {c})$ onto the collection (i)
-- of sets, and the domain $pow(m - {c})$ of this map, and hence its range, is plainly finite.
--
	Loc_def ==> ff = {[x,x + {c}]: x in {x: x incin (m - {c})}}
    APPLY() fcn_symbol(f(x)->x + {c},g->ff,s->{x: x incin (m - {c})}) ==>
		Svm(ff) & (domain(ff) = {x: x incin (m - {c})}) & (range(ff) = {x + {c}: x in {x: x incin (m - {c})}})
    SIMPLF ==> range(ff) = {x + {c}: x incin (m - {c})}
    EQUAL ==> Finite(domain(ff))
    ff-->T192 ==> Finite(range(ff))
    EQUAL ==> Finite({x + {c}: x incin (m - {c})})
    Suppose ==> Stat17: {x + {c}: x incin (m - {c})} /= {x: x incin m | c in x}
    e-->Stat17(*) ==> Stat18: ((e in {x + {c}: x incin (m - {c})}) & (e notin {x: x incin m | c in x})) or
	((e notin {x + {c}: x incin (m - {c})}) & (e in {x: x incin m | c in x}))
    Suppose ==> Stat19: (e in {x + {c}: x incin (m - {c})}) & Stat20: (e notin {x: x incin m | c in x})
    e1-->Stat19 ==> Stat21: (e = e1 + {c}) & (e1 incin (m - {c}))
    (e1 + {c})-->Stat20 ==> Stat22: not((e = e1 + {c}) & ((e1 + {c}) incin m) & (c in e1 + {c}))
    (Stat21,Stat22,Stat9)ELEM ==> false;
    Discharge ==> Stat23: not((e in {x + {c}: x incin (m - {c})}) & (e notin {x: x incin m | c in x}))
    (Stat23,Stat18*)ELEM ==> Stat24: (e notin {x + {c}: x incin (m - {c})}) & Stat25: (e in {x: x incin m | c in x})
    e2-->Stat25 ==> Stat26: (e = e2) & (e2 incin m) & (c in e2)
    (e2 - {c})-->Stat24 ==> Stat27: not((e = (e2 - {c}) + {c}) & ((e2 - {c}) incin (m - {c})))
    EQUAL(Stat26,Stat27) ==> false; Discharge ==> {x + {c}: x incin (m - {c})} = {x: x incin m | c in x}
--
-- This contradiction proves our theorem.
--
    EQUAL ==> false; Discharge ==> QED
--
-- Our next proof, of Cantor's basic result that the cardinality of the power set of
-- any set $s$ is always larger than the cardinality of $s$, embodies a famous idea whose
-- discovery encouraged development if the theory of infinite cardinality in its early days.
--
Theorem 265: [Cantor's Theorem] #N in #pow(N). Proof:
    Suppose_not(n) ==> #n notin #pow(n)
--
-- For let $n$ be a counterexample to our assertion. $pow(n)$ in plainly not empty,
-- and since $#n$ and $#pow(n)$ are both ordinals we must have $#n incs #pow(n)$ by Theorem 35.
--
    Suppose ==> 0 notin pow(n)
    Use_def(pow) ==> Stat1:  0 notin {x: x incin n}
    0-->Stat1 ==> Stat2: not (0 incin n)
    Discharge ==> pow(n) /= 0
    n-->T156 ==> Ord(#n)
    (pow(n))-->T156 ==> Ord(#pow(n))
    (#pow(n),#n)-->T35 ==> #n incs #pow(n)
--
-- Hence Theorem 176 tells us that there is a single valued map $f$ of $n$ onto $pow(n)$.
-- Consider the subset $s = {x: x in n | x notin f~[x]}$ of $n$, which plainly belongs to $pow(n)$.
--
    (n,pow(n))-->T176 ==> Stat3: (EXISTS f in OM | Svm(f) & (domain(f) = n) & (range(f) = pow(n)))
    f-->Stat3 ==> Svm(f) & (domain(f) = n) & (range(f) = pow(n))
    Loc_def ==> s = {x: x in n | x notin f~[x]}
    Set_monot ==> {x: x in n | x notin f~[x]} incin {x: x in n}
    ELEM ==> s incin {x: x in n}
    SIMPLF ==> s incin n
    Suppose ==> not(s in pow(n))
    Use_def(pow) ==> Stat4: not(s in {x: x incin n})
    s-->Stat4 ==> not(s incin n)
    Discharge ==> s in pow(n)
    ELEM ==> s in range(f)
--
-- It is clear since $s$ belongs to the range of $f$ that $s = f~[c]$ for some $c in n$.
--
    T72 ==> f = {[x,f~[x]]: x in domain(f)}
    EQUAL ==> s in range({[x,f~[x]]: x in domain(f)})
    Use_def(range) ==> s in {cdr(y): y in {[x,f~[x]]: x in domain(f)}}
    SIMPLF ==> Stat5: s in {cdr([x,f~[x]]): x in domain(f)}
    c-->Stat5 ==> (c in domain(f)) & (s = cdr([c,f~[c]]))
    ELEM ==> (c in n) & (s = f~[c])
--
-- If $c in s$, then it follows immediately that  $c notin s$.
--
    Suppose ==> c in s
    ELEM ==> Stat6: c in {x: x in n | x notin f~[x]}
    d-->Stat6 ==> (c = d) & (c in n) & (c notin f~[d])
    EQUAL ==> (c notin f~[c])
    Discharge ==> c notin s
--
-- But in much the same way $c notin s$ implies that $c in s$,
-- so we have a contradiction which proves Cantor's theorem.
--
   	ELEM ==> Stat7: c notin {x: x in n | x notin f~[x]}
    c-->Stat7 ==> not((c in n) & (c notin f~[c]))
    ELEM ==> not((c in n) & (c notin s))
    Discharge ==> QED
--
--
--
Theorem 266: (S incin pow(Un(S))) & ((Finite(Un(S)) & (X incin S)) imp Finite(X)). Proof:
Suppose_not(s,x) ==> AUTO
	Suppose ==> Stat1: s nincin pow(Un(s))
		c-->Stat1(Stat1*) ==> Stat2: (c in s) & (c notin pow(Un(s)))
		Use_def(Un(s)) ==> AUTO
		Use_def(pow(Un(s))) ==> AUTO
		EQUAL(Stat2) ==> Stat3: c notin {u: u incin {v: y in s, v in y}}
		c-->Stat3(Stat3*) ==> Stat4: c nincin {v: y in s, v in y}
		e-->Stat4(Stat4*) ==> Stat5: (e notin {v: y in s, v in y}) & (e in c)
	(c,e)-->Stat5(Stat2,Stat2*) ==> false; Discharge ==> AUTO
--
-- At this point we have derived that
--	$(x incin s) & (s incin pow(Un(s))) & Finite(Un(s)) & (not Finite(x))$,
-- but this will also lead to a contradiction.
--
	(Un(s))-->T264 ==> false; Discharge ==> QED
--
-- The two elementary lemmas which now follow state basic fact concerning arithmetic subtraction.
-- We first show that a quantity subtracted from itself gives 0.
--
Theorem 267: [Arithmetic subtraction principle] N MINUS N = 0. Proof:
	Suppose_not(n) ==> n MINUS n /= 0
    Use_def(MINUS) ==> n MINUS n = #(n - n)
    ELEM ==> n - n = 0
    EQUAL ==> n MINUS n = #0
    T188 ==> Card(0)
    0-->T164 ==> false; Discharge ==> QED
--
-- Next we show that a quantity subtracted from itself gives 0.
--
Theorem 268: [0 is right identity for arithmetic subtraction] N MINUS 0 = #N. Proof:
	Suppose_not(n) ==> n MINUS 0 /= #n
    Use_def(MINUS) ==> #(n - 0) /= #n
    ELEM ==> n - 0 = n
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the cardinality of the sum of any two disjoint sets $n$, $m$ is determined
-- by the two separate cardinalities $#n$, $#m$.
--
Theorem 269: [Disjoint additivity lemma] ((N * M = 0) & (N2 * M2 = 0) & (#N = #N2) & (#M = #M2)) imp (#(N + M) = #(N2 + M2)). Proof:
    Suppose_not(n,m,n2,m2) ==> Stat1: (n * m = 0) & (n2 * m2 = 0) & (#n = #n2) & (#m = #m2) & (#(n + m) /= #(n2 + m2))
--
-- For our assertion results immediately by combining Theorem 220 and Theorem 221.
--
	(n,m)-->T220 ==> #(n + m) = n PLUS m
	(n2,m2)-->T220 ==> #(n2 + m2) = n2 PLUS m2
	(n,m)-->T221 ==> n PLUS m = #n PLUS #m
	(n2,m2)-->T221 ==> n2 PLUS m2 = #n2 PLUS #m2
    EQUAL ==> false; Discharge ==> QED
--
-- Our next theorem states that when, in a subtraction, the subtrahend
-- is an ordinal which exceeds the minuend, then the value of the
-- difference is 0.
--
Theorem 270: [Excess subtraction lemma] (Ord(Y) & (X in Y)) imp ((X MINUS Y) = 0). Proof:
    Suppose_not(y,x) ==> Ord(y) & (x in y) & ((x MINUS y) /= 0)
        Use_def(MINUS) ==> #(x - y) /= 0
        (x - y)-->T162 ==> (x - y) /= 0
    (y,x)-->T13 ==> false; Discharge ==> QED
--
-- The two following results state (and generalize) the fact that if an integer $n$ is at least as large as
-- an integer $m$, then $n$ is the arithmetic sum of $m$ and $(n MINUS m)$. The first of these theorems generalizes
-- this fact to arbitrary cardinals (and, indeed, sets). The second restates the same fact
-- in a more narrowly arithmetic form.
--
Theorem 271: [Subtraction lemma] (M incin N) imp (#N = #M PLUS (N MINUS M)). Proof:
    Suppose_not(m,n) ==> (m incin n) & (#n /= #m PLUS (n MINUS m))
--
-- For our assertion results immediately from Theorem 220 and the definition of subtraction.
--
    ELEM ==> (n = m + (n - m)) & (m * (n - m) = 0)
    (m,n - m)-->T220 ==> #(m + (n - m)) = m PLUS (n - m)
    EQUAL ==> #n = m PLUS (n - m)
    (m,n - m)-->T221 ==> #n = #m PLUS #(n - m)
    Use_def(MINUS) ==> false; Discharge ==> QED
--
-- The following variant form of the preceding lemma is sometimes useful.
--
Theorem 272: [Subtraction in the non-negative case] (M incin N) imp (#N = (N MINUS M) PLUS M). Proof:
	Suppose_not(m,n) ==> (m incin n) & (#n /= (n MINUS m) PLUS m)
    (m,n)-->T271 ==> (n MINUS m) PLUS m /= #m PLUS (n MINUS m)
	(m,n MINUS m)-->T227 ==> (n MINUS m) PLUS m /= m PLUS (n MINUS m)
	(m,n MINUS m)-->T252 ==> false; Discharge ==> QED
--
-- If we confine our attention to cardinals $#m$ and $#n$, the preceding results tell us that
-- if $#m$ is no larger than $#n$, we have $#n = #m PLUS (#n MINUS #m)$.
--
Theorem 273: [Subtraction lemma 2] (#M in #N or #M = #N) imp (#N = #M PLUS (#N MINUS #M)). Proof:
    Suppose_not(m,n) ==> (#m in #n or #m = #n) & (#n /= #m PLUS (#n MINUS #m))
--
-- Our assertion follows trivially form the preceding, since the present hypotheses imply that $#m incin #n$.
--
	n-->T156 ==> Ord(#n)
	m-->T156 ==> Ord(#m)
    (#n,#m)-->T34 ==> #m incin #n
    (#m,#n)-->T271 ==> ##n = ##m PLUS (#n MINUS #m)
    N-->T166 ==> ##n = #n
    M-->T166 ==> ##m = #m
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the union set of a set $s$ is the set-theoretic 'upper bound' of all its elements, i.e.
-- the smallest set which includes all these elements.
--
Theorem 274: [Union set as an upper bound] (FORALL x in S | x incin Un(S)) & ((FORALL x in S | x incin T) imp (Un(S) incin T)). Proof:
	Suppose_not(s,t) ==> (not(FORALL x in s | x incin Un(s))) or ((FORALL x in s | x incin t) & (not (Un(s) incin t)))
--
-- For if not, one of the two clauses of our theorem must be false. By definition of '$Un$', this
-- cannot be the first clause, so it must be the second.
--
    Suppose ==> Stat1: not(FORALL x in s | x incin Un(s))
    x-->Stat1 ==> Stat2: (x in s) & (not(x incin Un(s)))
    c-->Stat2 ==> (c in x) & (c notin Un(s))
    Use_def(Un) ==> Stat3: c notin {z: y in s, z in y}
    (x,c)-->Stat3 ==> false; Discharge ==> Stat4: (FORALL x in s | x incin t) & Stat5: (not (Un(s) incin t))
--
-- But a second use of the definition of '$Un$' shows that this case is also impossible, proving our theorem.
--
    d-->Stat5 ==> (d in Un(s)) & (d notin t)
    Use_def(Un) ==> Stat6: d in {z: y in s, z in y}
    (b,a)-->Stat6 ==> (d = a) & (b in s) & (a in b)
    b-->Stat4 ==> false; Discharge ==> QED
--
Theorem 275: (Un(S) = 0) eq ((S = 0) or (S = {0})). Proof:
Suppose_not(s) ==> AUTO
--
-- The implication
--	$((s = 0) or (s = {0})) imp (Un(s) = 0)$
-- is quickly proved by virtue of Theorem 109. Hence,
-- assuming the assertion of this theorem to be false, we must
-- have $(Un(s) = 0) & (s /= 0) & (s /= {0})$; and therefore
-- $s nincin {0}$, and we can find in $s$ a non-zero element $c$.
--
	ELEM ==> (arb({0}) = 0) & ({0} - {arb({0})} = 0)
	EQUAL ==> Un({0} - {arb({0})}) = Un(0)
	{0}-->T109(*) ==> Stat1: (Un(0) = 0) & (Un({0}) = 0)
	Suppose ==> (s = 0) & (Un(s) /= 0)
		EQUAL(Stat1) ==> false
	Discharge ==> AUTO
	Suppose ==> (s = {0}) & (Un(s) /= 0)
		EQUAL(Stat1) ==> false
	Discharge ==> Stat2: (s nincin {0}) & (Un(s) = 0)
--
-- Such a $c$ cannot be included in $Un(s)$...
--
	c-->Stat2(Stat2*) ==> Stat3: (c in s) & (c nincin Un(s))
--
-- ...contrary to one of the claims of Theorem 274. This
-- contradiction leads to the desired conclusion.
--
	s-->T274(Stat4*) ==> Stat4: (FORALL x in s | x incin Un(s))
	c-->Stat4(Stat3*) ==> false
	Discharge ==> QED
--
Theorem 276: [Monotonicity of the union-set operator] (S incin T) imp (Un(S) incin Un(T)). Proof:
Suppose_not(s,t) ==> Stat1: (s incin t) & (not(Un(s) incin Un(t)))
	(t,0)-->T274 ==> Stat2: (FORALL x in t | x incin Un(t))
	(s,Un(t))-->T274 ==> Stat3: (FORALL x in s | x incin Un(t)) imp (Un(s) incin Un(t))
	Suppose ==> Stat4: not(FORALL x in s | x incin Un(t))
		c-->Stat4 ==> Stat5: (c in s) & (c nincin Un(t))
	c-->Stat2(Stat5,Stat1*) ==> false; Discharge ==> Stat6: (FORALL x in s | x incin Un(t))
(Stat3,Stat6,Stat1*)ELEM ==> false; Discharge ==> QED
--
--
--
Theorem 277: [Binary and unary union operations commute] Un(X + Y) = Un(X) + Un(Y). Proof:
Suppose_not(x0,y0) ==> AUTO
	(x0,x0 + y0)-->T276 ==> AUTO
	(y0,x0 + y0)-->T276(*) ==> Stat1: Un(x0 + y0) nincin (Un(x0) + Un(y0))
	Use_def(Un(x0 + y0)) ==> AUTO
	Use_def(Un(x0)) ==> AUTO
	Use_def(Un(y0)) ==> AUTO
	u0-->Stat1(Stat1*) ==> Stat2: (u0 in {u: v in x0 + y0, u in v}) & (u0 notin {u: v in x0, u in v}) & (u0 notin {u: v in y0, u in v})
	(v1,u1,v1,u1,v1,u1)-->Stat2(Stat2*) ==> false
	Discharge ==> QED
--
Theorem 278: [Equivalent characterizations of transitive sets] (S incin pow(S)) eq (Un(S) incin S). Proof:
Suppose_not(s0) ==> AUTO
	Use_def(Un(s0)) ==> AUTO
	Use_def(pow(s0)) ==> AUTO
	Suppose ==> Stat1: Un(s0) nincin s0
		y0-->Stat1(*) ==> Stat2: (y0 in {u: v in s0, u in v}) & (y0 notin s0)
		(x1,y1)-->Stat2(*) ==> Stat3: (x1 in {y: y incin s0}) & (y0 in x1)
		y2-->Stat3(Stat2*) ==> false
	Discharge ==> Stat4: (s0 nincin pow(s0)) & (Un(s0) incin s0)
	x0-->Stat4(*) ==> Stat5: (x0 notin {y: y incin s0}) & (x0 in s0)
	s0-->T274(Stat4*) ==> Stat6: (FORALL x in s0 | x incin Un(s0))
	x0-->Stat6(Stat4*) ==> x0 incin s0
	x0-->Stat5(Stat6*) ==> false
	Discharge ==> QED
--
--
--
Theorem 279: (Un(S) incs Un({c: c in S | H notin c})) & (H notin Un({c: c in S | H notin c})). Proof:
Suppose_not(s,h) ==> AUTO
	Set_monot ==> {c: c in s} incs {c: c in s | h notin c}
	Use_def(Un({c: c in s | h notin c})) ==> AUTO
	({c: c in s | h notin c},s)-->T276 ==> Stat1: (h in {x: y in {c: c in s | h notin c}, x in y})
	(y1, x1)-->Stat1(Stat1*) ==> Stat2: (y1 in {c: c in s | h notin c}) & (h in y1)
	c1-->Stat2(Stat2*) ==> false
	Discharge ==> QED
--
-- If the set appearing in the preceding theorem is a collection of ordinals,
-- then its union set $Un(s)$ must be an ordinal. Indeed $Un(s)$ is the smallest ordinal
-- not smaller than any of the elements of $s$ (but this fact, an easy consequence of
-- Theorem 274, is not derived in what follows.)
--
Theorem 280: [The union of a set of ordinals is an ordinal] (FORALL x in S | Ord(x)) imp Ord(Un(S)). Proof+:
    Suppose_not(s) ==> Stat1: (FORALL x in s | Ord(x)) & (not(Ord(Un(s))))
--
-- For suppose that $s$ is a set of ordinals whose union set is not an ordinal.
-- Then $Un(s)$ either has an element $x$ not included in $Un(s)$, or a pair of distinct elements
-- not related by membership. First consider the first of these two possibilities.
--
    Use_def(Ord) ==>
	not((FORALL x in Un(s) | x incin Un(s)) & (FORALL x in Un(s), y in Un(s) | x in y or y in x or x = y))
    Use_def(Un) ==>
	(not((FORALL x in {wz: yy in s, wz in yy} | x incin {wz: yy in s, wz in yy}))) or
	(not((FORALL x in {wz: yy in s, wz in yy}, y in {wz: yy in s, wz in yy} | x in y or y in x or x = y)))
    Suppose ==> Stat2: not (FORALL x in {wz: yy in s, wz in yy} | x incin {wz: yy in s, wz in yy})
--
-- In this case there would have to be $a$, $c$ satisfying $a in s$, $x in a$, $c in s$ such that $c notin {wz: yy in s, wz in yy}$,
-- an evident impossibility which rules out this case.
--
    x-->Stat2 ==> Stat3: (x in {wz: yy in s, wz in yy}) & (not(x incin {wz: yy in s, wz in yy}))
    (a,b)-->Stat3 ==> (x = b) & (a in s) & (b in a) & Stat4: (not(x incin {wz: yy in s, wz in yy}))
    c-->Stat4 ==> (c in b) & Stat5: (not(c in {wz: yy in s, wz in yy}))
    a-->Stat1 ==> Ord(a)
    (a,b)-->T13 ==> c in a
    (a,c)-->Stat5 ==> false; Discharge ==>
	Stat6: not(FORALL x in {wz: yy in s, wz in yy}, y in {wz: yy in s, wz in yy} | x in y or y in x or x = y)
--
-- But if $Un(s)$ a pair of distinct elements $u$, $v$ not related by membership,
-- $u$ would be a member of some ordinal $au$ in s, and $v$ would be a member of some ordinal $av$ in s.
-- Since one of these ordinals would necessarily include the other this is impossible, so out theorem is proved.
--
    (u,v)-->Stat6 ==> Stat7: (u in {wz: yy in s, wz in yy}) & (v in {wz: yy in s, wz in yy})
    					& (not(u in v or v in u or u = v))
    (au,bu,av,bv)-->Stat7 ==> (au in s) & (u in au) & (av in s) & (v in av) & (not(u in v or v in u or u = v))
    au-->Stat1 ==> Ord(au)
    av-->Stat1 ==> Ord(av)
    (u,v)-->T31 ==> false; Discharge ==> QED
--
-- Next we prove that the arithmetic quotient of any $n$ by a nonzero $m$ is no larger than $n$.
--
Theorem 281: [Division monotonicity lemma] (M /= 0) imp ((N OVER M) incin N). Proof:
    Suppose_not(m,n) ==> Stat1: (m /= 0) & (not((n OVER m) incin n))
--
-- For suppose that $m$, $n$ is a counterexample to our assertion.
-- Then by definition of division there must exist $k in Za$ and $c in k$, with $c notin n$
-- and $(k TIMES m) incin n$.
--
    Use_def(OVER) ==> Stat2: not(Un({k in Za | (k TIMES m) incin n}) incin n)
    c-->Stat2 ==> (c notin n) & (c in Un({k in Za | (k TIMES m) incin n}))
    Use_def(Un) ==> c in {x: y in {k in Za | (k TIMES m) incin n}, x in y}
    SIMPLF ==> Stat3: c in {x: k in Za, x in k | (k TIMES m) incin n}
    (k,x)-->Stat3 ==> (k in Za) & (c in k) & ((k TIMES m) incin n)
--
-- Let $a$ be a member of $m$, so that $#(k PROD m) incs #(k PROD {a})$ and therefore
-- $k TIMES m incs k$. It follows that $n incs k$, and so $c in n$, a contradiction which proves our theorem.
--
    a-->Stat1 ==> a in m
    (k,k,{a},m)-->T256 ==> (k PROD m) incs (k PROD {a})
    (k PROD {a},k PROD m)-->T170 ==> #(k PROD m) incs #(k PROD {a})
    (k,a)-->T224 ==> #(k PROD m) incs #k
    Use_def(TIMES) ==> k TIMES m incs #k
    k-->T207 ==> k TIMES m incs k
    Discharge ==> QED
--
-- The following lemma tells us that if $n$ is and integer and $m$ is nonzero,
-- the arithmetic quotient of $n$ by $m$ is an integer.
--
Theorem 282: [Extended division monotonicity lemma] ((M /= 0) & (N in Za)) imp (((N OVER M) in Za) & ((N OVER M) incin N)). Proof+:
    Suppose_not(m,n) ==> (n in Za) & (m /= 0) & (((n OVER m) notin Za) or (not((n OVER m) incin n)))
--
-- For otherwise, since it is clear that every element of ${k in Za | (k TIMES m) incin n}$
-- is an ordinal, It follows by definition that $n OVER m$ is an ordinal.
--
    Suppose ==> Stat1: not(FORALL x in {k in Za | (k TIMES m) incin n} | Ord(x))
    x2-->Stat1 ==> Stat2: (x2 in {k in Za | (k TIMES m) incin n}) & (not Ord(x2))
	()-->Stat2 ==> false; Discharge ==> (FORALL x in {k in Za | (k TIMES m) incin n} | Ord(x))
    {k in Za | (k TIMES m) incin n}-->T280 ==> Ord(Un({k in Za | (k TIMES m) incin n}))
    Use_def(OVER) ==> (n OVER m) = Un({k in Za | (k TIMES m) incin n})
    EQUAL ==> Ord(n OVER m)
--
-- Since the second clause of our theorem is true by Theorem 281, $n OVER m$ cannot be an integer, and since
-- it is an ordinal, it cannot be finite. But since $n$ is finite this is impossible, so our theorem is proved.
--
   (m,n)-->T281 ==> ((n OVER m) incin n) & ((n OVER m) notin Za)
   (m,n)-->T281 ==> ((n OVER m) incin n) & Finite(n OVER m)
(n OVER m)-->T205 ==> false; Discharge ==> QED
--
-- Our next result asserts that the set of integers is closed under arithmetic addition, multiplication, and subtraction.
--
Theorem 283: [Closure properties of arithmetic operators] ((N in Za) & (M in Za)) imp ((N PLUS M in Za) & (N TIMES M in Za) & (N MINUS M in Za)). Proof+:
    Suppose_not(n,m) ==> (n in Za) & (m in Za) & (not((n PLUS m in Za) & (n TIMES m in Za) & (n MINUS m in Za)))
--
-- We simply use the definitions of these operators, which make it immediately clear that
-- the sum, product, and difference are all cardinals, and so must be integers if they are finite.
-- But this has been proved earlier for the sum and product, and is obvious for the difference.
--
    Use_def(PLUS) ==> n PLUS m = #({[x,0]: x in n} + {[x,1]: x in m})
    Use_def(TIMES) ==> n TIMES m = #(n PROD m)
    Use_def(MINUS) ==> n MINUS m = #(n - m)
    ELEM ==> Finite(n) & Finite(m)
    (n,m)-->T241 ==> Finite(n PLUS m)
    (n,m)-->T261 ==> Finite(n TIMES m)
    ELEM ==> n - m incin n
    (n,n - m)-->T189 ==> Finite(n - m)
    (n - m)-->T193 ==> Finite(#(n - m))
    EQUAL ==> Finite(n MINUS m)
    ({[x,0]: x in n} + {[x,1]: x in m})-->T156 ==> Card(#({[x,0]: x in n} + {[x,1]: x in m}))
    EQUAL ==> Card(n PLUS m)
    (n PROD m)-->T156 ==> Card(#(n PROD m))
    EQUAL ==> Card(n TIMES m)
    (n - m)-->T156 ==> Card(#(n - m))
    EQUAL ==> Card(n MINUS m)
    (n PLUS m)-->T206 ==> (n PLUS m) in Za
    (n TIMES m)-->T206 ==> (n TIMES m) in Za
    (n MINUS m)-->T206 ==> false; Discharge ==> QED
--
-- Next we show that the sum $m PLUS n$ of two integers is strictly larger than $n$ if $m /= 0$.
--
Theorem 284: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (N /= 0)) imp (M in (M PLUS N)). Proof:
    Suppose_not(m,n) ==> Stat1: (m in Za) & (n in Za) & Stat2: (n /= 0) & (m notin (m PLUS n))
--
-- For suppose that $m$, $n$ is a counterexample to our assertion. Since the set
-- ${[x,0]: x in m} + {[x,1]: x in n}$ whose cardinality defines the sum is finite,
-- It follows by Theorem 194 that we have only to prove that its second term
-- is not included in its first. But these two terms are clearly disjoint, and the second
-- must be nonempty since $n$ is nonempty. So our assertion is clear.
--
    Use_def(PLUS) ==> (m PLUS n) = #({[x,0]: x in m} + {[x,1]: x in n})
    (m,n)-->T216 ==> Stat3: {[x,0]: x in m} * {[x,1]: x in n} = 0
    e-->Stat2 ==> e in n
    Suppose ==> Stat4: [e,1] notin {[x,1]: x in n}
    e-->Stat4 ==> false; Discharge ==> Stat5: {[x,1]: x in n} /= 0
    (Stat5,Stat3)ELEM ==> ({[x,0]: x in m} incin ({[x,0]: x in m} + {[x,1]: x in n})) &
									({[x,0]: x in m} /= {[x,0]: x in m} + {[x,1]: x in n})
	(m,n)-->T283 ==> (m PLUS n) in Za
	(m PLUS n)-->T206 ==> Finite(m PLUS n)
	Use_def(PLUS) ==> m PLUS n = #({[x,0]: x in m} + {[x,1]: x in n})
	EQUAL ==> Finite(#({[x,0]: x in m} + {[x,1]: x in n}))
	({[x,0]: x in m} + {[x,1]: x in n})-->T193 ==> Finite({[x,0]: x in m} + {[x,1]: x in n})
    ({[x,0]: x in m} + {[x,1]: x in n},{[x,0]: x in m})-->T194 ==> Stat6: #{[x,0]: x in m} in (m PLUS n)
    (0,m)-->T218 ==> Stat7: #{[x,0]: x in m} = #m
    m-->T207 ==> Stat8: #m = m
    (Stat1,Stat6,Stat7,Stat8*)Discharge ==> QED
--
-- Our next elementary theorem asserts that only the empty set has cardinality $0$.
--
Theorem 285: [Only the nullset has cardinality zero] (#N = 0) imp (N = 0). Proof:
    Suppose_not(n) ==> (#n = 0) & (n /= 0)
--
-- For if #n = 0, then Theorem 159 tell us that n is the range of a map with empty domain,
-- an impossibility.
--
    n-->T147 ==> Stat1: (EXISTS f in OM | (one_1_map(f) & (range(f) = n) & (domain(f) = #n)))
    f-->Stat1 ==> (domain(f) = 0) & (range(f) /= 0)
    f-->T86 ==> false; Discharge ==> QED
--
-- The following theorem asserts that for integers addition is not merely monotonic,
-- but even strictly monotonic, in its second argument.
--
Theorem 286: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (K in N)) imp (M PLUS K in M PLUS N). Proof+:
    Suppose_not(m,n,k) ==> Stat1: (m in Za) & (n in Za) & (k in n) & ((m PLUS k) notin (m PLUS n))
--
-- For suppose that $n$, $m$, $k$ constitute a counterexample to our theorem.
-- Since the set $Za$ of integers is an ordinal, its members $n$ and $k$ are both ordinals and subsets of $Za$.
-- $n$ is plainly different from $k$, and equal to its own cardinality
--
    junk-->T206 ==> Ord(Za)
    (Za,n)-->T12 ==> Ord(n)
    Use_def(Ord) ==> Stat2: (FORALL n in Za | n incin Za) & (FORALL k in n | k incin n)
    (n,k)-->Stat2 ==> Stat3: (n incin Za) & (k incin n)
    n-->T207 ==> Stat4: n = #n
    ELEM ==> k /= n
    ELEM ==> Stat5: #n incin Za
--
-- Since $k$ is a subset of $n$, the set-theoretic facts stated just below are immediate.
-- It follows from this that $#(n - k)$ is an integer no larger than $#n$.
-- Moreover $k$ is a cardinal, and therefore is its own cardinality.
--
    ELEM ==> (n = (n - k) + k) & ((n - k) * k = 0) & (n incs (n - k))
    k-->T207 ==> k = #k
    (n-k,n)-->T170 ==> (#n incs #(n - k))
    (n - k)-->T156 ==> Card(#(n - k)) & Ord(#(n - k))
    n-->T156 ==> Card(#n) & Ord(#n)
    (#n,#(n - k))-->T34 ==> Stat6: ((#(n - k) in #n)) or ((#(n - k) = #n))
    (Stat6,Stat5,Stat1,Stat4*)ELEM ==> #(n - k) in Za
--
-- It follows easily using Theorem 222 that $n = (#(n - k) PLUS k)$,
-- and so by what has been stated above, and a little algebra, it follows that
-- $(m PLUS k) notin ((m PLUS k) PLUS #(n - k))$. But the set $n - k$ is nonempty,
-- and so by Theorem 284 the second of these sets is strictly larger than the first,
-- a contradiction which proves our assertion.
--
    (n - k,k)-->T222 ==> (#(n - k) PLUS #k) = #((n - k) + k)
    ELEM ==> (n - k) + k = n
    EQUAL ==> #n = (#(n - k) PLUS #k)
    (Stat3,Stat4,Stat1*)ELEM ==> k in Za
    EQUAL ==> Stat7: #n = (#(n - k) PLUS k)
    (Stat4,Stat7*)ELEM ==> n = (#(n - k) PLUS k)
    EQUAL ==> (m PLUS k) notin (m PLUS (#(n - k) PLUS k))
    ALGEBRA ==> ((m PLUS (#(n - k) PLUS k)) = ((m PLUS k) PLUS #(n - k))) & ((m PLUS k) in Za)
    ELEM ==> (m PLUS k) notin ((m PLUS k) PLUS #(n - k))
    (n - k)-->T285 ==> #(n - k) /= 0
    (m PLUS k,#(n - k))-->T284 ==> false; Discharge ==> QED
--
Theorem 287: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (K in N)) imp (M PLUS K in M PLUS N). Proof:
    Suppose_not(m,n,k) ==> Stat1: (m in Za) & (n in Za) & (k in n) & ((m PLUS k) notin (m PLUS n))
--
-- For suppose that $n$, $m$, $k$ constitute a counterexample to our theorem.
-- Since the set $Za$ of integers is an ordinal, its members $n$ and $k$ are both ordinals and
-- subsets of $Za$.
-- $n$ is plainly different from $k$, and equal to its own cardinality
--
    T206(*) ==> Stat2: Ord(Za)
    (Za,n)-->T12(Stat1*) ==> Ord(n)
    Use_def(Ord)(Stat2) ==> Stat3: (FORALL n in Za | n incin Za) & (FORALL k in n | k incin n)
    (n,k)-->Stat3(Stat1,Stat1*) ==> Stat4: (n incin Za) & (k incin n) & (k in Za)
    n-->T207(Stat1,Stat4*) ==> Stat5: (n = #n) & (#n incin Za)
--
-- Since $k$ is a subset of $n$, the set-theoretic facts stated just below are immediate.
-- It follows from this that $#(n - k)$ is an integer no larger than $#n$.
-- Moreover $k$ is a cardinal, and therefore is its own cardinality.
--
    (Stat4*)ELEM ==> (n = (n - k) + k) & ((n - k) * k = 0) & (n incs (n - k))
    k-->T207(Stat1,Stat4*) ==> Stat6: k = #k
    (n-k,n)-->T170(*) ==> Stat7: (#n incs #(n - k))
    (n - k)-->T156(*) ==> Card(#(n - k)) & Ord(#(n - k))
    n-->T156(*) ==> Card(#n) & Ord(#n)
    (#n,#(n - k))-->T34(Stat7*) ==> Stat8: (#(n - k) in #n) or (#(n - k) = #n)
    (Stat8,Stat5,Stat1*)ELEM ==> Stat9: #(n - k) in Za
--
-- It follows easily using Theorem 222 that $n = (#(n - k) PLUS k)$,
-- and so by what has been stated above, and a little algebra, it follows that
-- $(m PLUS k) notin ((m PLUS k) PLUS #(n - k))$. But the set $n - k$ is nonempty,
-- and so by Theorem 284 the second of these sets is strictly larger than the first,
-- a contradiction which proves our assertion.
--
    (n - k,k)-->T222(*) ==> Stat10: (#(n - k) PLUS #k) = #((n - k) + k)
    (Stat4,Stat4*)ELEM ==> Stat11: (n - k) + k = n
    ALGEBRA(Stat9,Stat4,Stat1) ==> Stat12: ((m PLUS (#(n - k) PLUS k)) = ((m PLUS k) PLUS #(n - k))) & ((m PLUS k) in Za)
    EQUAL ==> Stat13: (m PLUS k) notin ((m PLUS k) PLUS #(n - k))
    (n - k)-->T285(Stat1,Stat4*) ==> Stat14: #(n - k) /= 0
    (m PLUS k,#(n - k))-->T284 ==> false; Discharge ==> QED
--
-- Sometimes it is more convenient to use the following trivial corollary of Theorem 287.
--
Theorem 288: [Strict monotonicity of addition, 2] ((M in Za) & (N in Za) & (K in N)) imp (K PLUS M in N PLUS M). Proof:
	Suppose_not(m,n,k) ==> AUTO
	(k,m)-->T252 ==> AUTO
	(n,m)-->T252 ==> AUTO
	(m,n,k)-->T287 ==> AUTO
	Discharge ==> QED
--
-- Next we show that for integers (though not for more general cardinals) cancellation of the common second
-- argument of an equality between sums is allowed.
--
Theorem 289: [Cancellation] ((M in Za) & (N in Za) & (K in Za) & (M PLUS K = N PLUS K)) imp (M = N). Proof+:
Suppose_not(m,n,k) ==> AUTO
--
-- Suppose that  $n$, $m$, $k$ are a counterexample to our assertion.
-- Since the integers $m$ and $n$ are obviously ordinals,
-- they are either equal, or one of them is smaller than the other.
--
	(n,m)-->T31 ==> (n in m) or (n = m) or (m in n)
--
-- But since addition is strictly monotone in its second argument by Theorem 286,
-- and commutative by Theorem 252, it is impossible that either $m$ or $n$ should be smaller
-- than the other, so our result follows.
--
	(m,k)-->T252 ==> m PLUS k = k PLUS m
	(n,k)-->T252 ==> AUTO
    Suppose ==> n in m
	(k,m,n)-->T286 ==> false; Discharge ==> AUTO
    Suppose ==> m in n
	(k,n,m)-->T286 ==> false; Discharge ==> AUTO
    Discharge ==> QED
--
-- Our next theorem asserts that cardinal addition is monotone increasing
-- (but not necessarily strictly monotone) in its first argument.
--
Theorem 290: [Monotonicity of addition] (M incin N) imp ((M PLUS K) incin (N PLUS K)). Proof:
    Suppose_not(m,n,k) ==> (m incin n) & (not ((m PLUS k) incin (n PLUS k)))
--
-- Indeed, the set monotonicity principle and the monotonicity of cardinality (Theorem 170)
-- together rule out the existence of a counterexample $n$, $m$, $k$ to our assertion.
--
    Use_def(PLUS) ==> not (#({[x,0]: x in m} + {[x,1]: x in k}) incin #({[x,0]: x in n} + {[x,1]: x in k}))
    Set_monot ==> {[x,0]: x in m} incin {[x,0]: x in n}
    ELEM ==> ({[x,0]: x in m} + {[x,1]: x in k}) incin ({[x,0]: x in n} + {[x,1]: x in k})
    ({[x,0]: x in m} + {[x,1]: x in k},{[x,0]: x in n} + {[x,1]: x in k})-->T170 ==> false; Discharge ==> QED
--
-- Next we show, using the monotonicity of addition, that for cardinals $m PLUS n$ is never smaller than $n$.
--
Theorem 291: [Monotonicity of addition, 2] Card(M) imp ((M incin (I PLUS M)) & (M incin (M PLUS I))). Proof:
Suppose_not(m,i) ==> AUTO
	m-->T164 ==> m = #m
	m-->T247 ==> AUTO
	(#m,0)-->T252 ==> AUTO
	EQUAL ==> (0 PLUS m) = m
	(m,i)-->T252 ==> AUTO
(0,i,m)-->T290 ==> false; Discharge ==> QED
--
-- In particular, from the monotonicity of addition it follows that for unsigned integers $m PLUS n$ is never smaller than $n$.
--
Theorem 292: [Monotonicity of addition, 3] (M in Za) imp ((M incin (I PLUS M)) & (M incin (M PLUS I)) & ((M PLUS I) notin M) & ((I PLUS M) notin M)). Proof+:
Suppose_not(m,i) ==> AUTO
(m,i)-->T291 ==> false; Discharge ==> QED
--
-- The following easy result asserts that cardinal multiplication is monotone increasing
-- (but not necessarily strictly monotone) in its first argument.
--
Theorem 293: [Monotonicity of multiplication] (M incin N) imp ((M TIMES K) incin (N TIMES K)). Proof:
Suppose_not(m,n,k) ==> AUTO
--
-- For the set monotonicity principle and the monotonicity of cardinality (Theorem 170)
-- together rule out the existence of a counterexample $n$, $m$, $k$ to our assertion.
--
    Use_def(TIMES) ==> not(#(m PROD k) incin #(n PROD k))
    Use_def(PROD) ==> not (#{[x,y]: x in m, y in k} incin #{[x,y]: x in n, y in k})
    Set_monot ==> {[x,y]: x in m, y in k} incin {[x,y]: x in n, y in k}
    ({[x,y]: x in m, y in k},{[x,y]: x in n, y in k})-->T170 ==> false; Discharge ==> QED
--
-- The following corollary gives the strict version of the preceding result, in case the sets involved are integers.
--
Theorem 294: [Strict monotonicity of integer multiplication] ((M in N) & (N in Za) & (K in Za) & (K /= 0))
	imp ((M TIMES K) in (N TIMES K)). Proof+:
Suppose_not(m,n,k) ==> AUTO
--
-- First we can write $n PROD k$  as the disjoint union $(m PROD k) + ((n - m) PROD k)$,
-- and since the second term in this union is noempty, $m PROD k$ is a proper subset of $n PROD k$.
-- Since all these sets are clearly finite, it follows by Theorem 194 that  $#(m PROD k)$ is smaller than
-- $#(m PROD k)$. By definition of "$TIMES$", this is our assertion.
--
	(n,m)-->T13 ==> Stat0a: (m incin n)
	ELEM ==> Stat0: n - m /= 0
	Use_def(TIMES) ==> not (#(m PROD k) in #(n PROD k))
	(m,k,n - m)-->T255(Stat0a,Stat0a*) ==> Stat1a: ((m + (n - m)) PROD k = (m PROD k) + ((n - m) PROD k)) &
			((m PROD k) * ((n - m) PROD k) = (m * (n - m)) PROD k) &
			(n = m + (n - m)) & (m * (n - m) = 0)
	EQUAL(Stat1a) ==> Stat1: (n PROD k = (m PROD k) + ((n - m) PROD k)) & ((m PROD k) * ((n - m) PROD k) = 0 PROD k)
	k-->T139 ==> Stat2: (m PROD k) * ((n - m) PROD k) = 0
	(k,n - m)-->T250 ==> #((n - m) PROD k) incs #(n - m)
	(n - m)-->T162(Stat0,Stat0*) ==> #(n - m) /= 0
	ELEM ==> Stat2a: #((n - m) PROD k) /= 0
	((n - m) PROD k)-->T162(Stat2a*) ==> Stat3: ((n - m) PROD k) /= 0
	(Stat1,Stat2,Stat3)ELEM ==> ((m PROD k) incin (n PROD k)) & ((m PROD k) /= (n PROD k))
	(n,k)-->T262 ==> Finite(n PROD k)
	(n PROD k,m PROD k)-->T194 ==> #(m PROD k) in #(n PROD k)
	Discharge ==> QED
--
--
--
Theorem 295: [The sum of non-negative integers is at least as big at each addend] ((X in Za) & (Y in Za)) imp ((X PLUS Y) notin Y). Proof:
    Suppose_not(x,y) ==> AUTO
--
-- Reasoning by contradiction, and assuming that $x,y$ are a counterexample
-- to the assertion which we want to prove...
--
        y-->T254 ==> (0 PLUS y) = y
        (x,y)-->T252 ==> (x PLUS y) = (y PLUS x)
--
-- if we assume that $x=0$,...
--
        Suppose ==> x = 0
            EQUAL ==> (x PLUS y) = y
--
-- we have a conflict with the hypothesis $(x PLUS y) in y$.
--
        Discharge ==> x /= 0
--
-- On the other hand, since the fact $x /= 0$ enables us to exploit
-- Theorem 284, we have again a conflict with the hypothesis that
-- $(x PLUS y) in y$.
--
        (y,x)-->T284 ==> y in (y PLUS x)
    Discharge ==> QED
--
-- We now show that arithmetic addition of integers is strictly monotone
-- in its first argument.
--
Theorem 296: [Strict monotonicity of addition] ((M in Za) & (N in Za) & (K in Za)) imp
			(((M PLUS K) incin (N PLUS K)) eq (M incin N)). Proof+:
Suppose_not(m,n,k) ==> AUTO
--
-- For suppose that $m$, $n$, $k$ constitute a counterexample to our theorem.
-- Since we know that addition is non-strictly monotone, it must be that $(m PLUS k) incin (n PLUS k)$,
-- but that $m$ is not a subest of $n$.
--
    (m,n,k)-->T290 ==> ((m PLUS k) incin (n PLUS k)) & (not(m incin n))
--
-- But since all the quantities involved are integers, and therefore both cardinals and ordinals,
-- $n$ must be smaller than $n$, and so a contradiction results immediately from Theorem 286 and
-- the commutativity of addition (Theorem 252), thereby proving the present theorem.
--
	ALGEBRA ==> (m PLUS k in Za) & (n PLUS k in Za)
    (m,n)-->T35 ==> n in m
    (k,m,n)-->T286 ==> (k PLUS n) in (k PLUS m)
	(k,n)-->T252 ==> AUTO
	(k,m)-->T252 ==> AUTO
Discharge ==> QED
--
-- The following gives yet another version of Theorem 296.
--
Theorem 297: [Strict monotonicity of addition] ((M in Za) & (N in M) & (K in Za)) imp ((N PLUS K) in (M PLUS K)). Proof+:
Suppose_not(m,n,k) ==> AUTO
    (Za,m)-->T13 ==> n in Za
    ALGEBRA ==> (m PLUS k in Za) & (n PLUS k in Za)
    (m PLUS k,n PLUS k)-->T35 ==> (m PLUS k) incin (n PLUS k)
    (m,n,k)-->T296 ==> m incin n
Discharge ==> QED
--
-- Our next lemma tells us that subtracting anything from an integer gives an integer.
--
Theorem 298: [Subtraction Lemma] (N in Za) imp ((N MINUS M) in Za). Proof+:
Suppose_not(n,m) ==> AUTO
	Use_def(MINUS) ==> (#(n - m) notin Za)
	ELEM ==> n incs (n - m)
	(n - m)-->T156 ==> Card(#(n - m))
	(n - m)-->T193 ==> Finite(#(n - m))
	(#(n - m))-->T206 ==> false; Discharge ==> QED
--
Theorem 299: [Strict monotonicity of subtraction] ((N in Za) & (M in Za) & (K in N) & (M incs N)) imp
		((M MINUS N) in (M MINUS K)). Proof+:
Suppose_not(n,m,k) ==> AUTO
--
-- For let $n$, $m$, $k$ be a counterexample to our assertion. It then follows
-- by definition that $#(m - n) notin #(m - k)$, so that since all the integers involved must be ordinals
-- $k in n$ implies that $k$ is a proper subset of $n$ by Theorem 34.
--
    Use_def(MINUS) ==> #(m - n) notin #(m - k)
	(n,k)-->T34(*) ==> (k incin n) & (k /= n)
--
-- Hence $m - n$ is a proper subset of $m - k$, and since $m$ and thus $m - k$
--
	(m,m - k)-->T189(*) ==> Finite(m - k) & ((m - n) incin (m - k)) & ((m - n) /= (m - k))
(m - k,m - n)-->T194(*) ==> false; Discharge ==> QED
--
Theorem 300: [Monotonicity of subtraction] (K incs M) imp ((K MINUS N) incs (M MINUS N)). Proof:
	Suppose_not(k,m,n) ==> AUTO
	Use_def(MINUS) ==> not(#(k - n) incs #(m - n))
	(m - n,k - n)-->T170 ==> false; Discharge ==> QED
--
Theorem 301: [Monotonicity of subtraction, 2] (M incs N) imp ((K MINUS N) incs (K MINUS M)). Proof:
	Suppose_not(m,n,k) ==> AUTO
	Use_def(MINUS) ==> not(#(k - n) incs #(k - m))
	(k - m,k - n)-->T170 ==> false; Discharge ==> QED
--
Theorem 302: [Strict monotonicity of subtraction, 2] ((N in Za) & (M in Za) & (K in M) & (K incs N)) imp
		((K MINUS N) in (M MINUS N)). Proof+:
Suppose_not(n,m,k) ==> AUTO
	m-->T164(*) ==> m = #m
	ELEM ==> k in Za
	k-->T164 ==> k = #k
	ALGEBRA ==> ((k MINUS n) in Za) & ((m MINUS n) in Za)
	(m,k)-->T13(*) ==> k incin m
	(m,k,n)-->T300(*) ==> (k MINUS n) incin (m MINUS n)
	(m MINUS n,k MINUS n)-->T34(*) ==> (k MINUS n) = (m MINUS n)
	EQUAL ==> (k MINUS n) PLUS n = (m MINUS n) PLUS n
	(n,k)-->T272(*) ==> (k MINUS n) PLUS n = #k
	(n,m)-->T272(*) ==> (m MINUS n) PLUS n = #m
	Discharge ==> QED
--
-- For let $n$, $m$, $k$ be a counterexample to our assertion. It then follows
--
-- The next theorem tells us that two successive subtractions are equivalent to subtraction of a sum,
-- at least in the positive integer case which it covers.
--
Theorem 303: [Addition-subtraction commutativity] ((M in Za) & (N in Za) & (K in Za) & (N incs M) & ((N MINUS M) incs K)) imp
	((N incs (M PLUS K)) & (N MINUS (M PLUS K) = (N MINUS M) MINUS K)). Proof:
Suppose_not(m,n,k) ==> AUTO
--
-- For consider a potential counterexample $n,m,k$ to our assertion. Plainly $n MINUS m$ and
-- $((n MINUS m) MINUS k)$ are integers, and so all the quantities we consider are cardinals.
--
	ALGEBRA ==> ((n MINUS m) in Za) & (((n MINUS m) MINUS k) in Za)
	n-->T207(*) ==> n = #n
	m-->T207(*) ==> m = #m
	k-->T207(*) ==> k = #k
	(n MINUS m)-->T207(*) ==> n MINUS m = #(n MINUS m)
--
-- Theorem 271 used twice, plus a bit of algebra, tells us that
-- $n = ((n MINUS m) MINUS k) PLUS (k PLUS m)$, and so,
-- by the monotonicity of addition, $n$ must include $m PLUS k$.
--
	(m,n)-->T271(*) ==> #n = #m PLUS (n MINUS m)
    EQUAL ==> n = m PLUS (n MINUS m)
    ALGEBRA ==> n = (n MINUS m) PLUS m
	(k,n MINUS m)-->T271(*) ==> #(n MINUS m) = #k PLUS ((n MINUS m) MINUS k)
    EQUAL ==> (n MINUS m) = k PLUS ((n MINUS m) MINUS k)
    ALGEBRA ==> (n MINUS m) = ((n MINUS m) MINUS k) PLUS k
    EQUAL ==> n = (((n MINUS m) MINUS k) PLUS k) PLUS m
    ALGEBRA ==> n = ((n MINUS m) MINUS k) PLUS (k PLUS m)
    ELEM ==> ((n MINUS m) MINUS k) incs 0
	ALGEBRA ==> Stat1: (0 in Za) & ((m PLUS k) in Za) & ((k PLUS m) in Za) &
		(((n MINUS m) MINUS k) in Za) &
		(n MINUS (m PLUS k) in Za) & ((n MINUS m) MINUS k in Za)
	(0,(n MINUS m) MINUS k,(k PLUS m))-->T296(*) ==> n incs (0 PLUS (k PLUS m))
    ALGEBRA ==> (0 PLUS (k PLUS m)) = (m PLUS k)
    ELEM ==> n incs (m PLUS k)
	(m PLUS k)-->T207(Stat1*) ==> (m PLUS k) = #(m PLUS k)
--
-- Therefore, using Theorem 271 once more, we see that
-- $n = (n MINUS (m PLUS k)) PLUS (k PLUS m)$ also.
-- Theorem 289 now lets us cancel $k PLUS m$ from these two expressions for $n$,
-- thereby obtaining te formula asserted by the present theorem.
--
	(m PLUS k,n)-->T271(*) ==> n = #(m PLUS k) PLUS (n MINUS (m PLUS k))
    EQUAL ==> n = (m PLUS k) PLUS (n MINUS (m PLUS k))
    ALGEBRA ==> n = (n MINUS (m PLUS k)) PLUS (k PLUS m)
(n MINUS (m PLUS k),(n MINUS m) MINUS k,k PLUS m)-->T289(*) ==> false; Discharge ==> QED
--
--
Theorem 304: [Subtraction reverses addition] ((M in Za) & (N in Za)) imp ((M PLUS N) MINUS N = M). Proof:
    Suppose_not(m,n) ==> (m in Za) & (n in Za) & ((m PLUS n) MINUS n /= m)
--
-- For suppose that $m$, $n$ is a counterexample to our assertion. $m PLUS n$ and
-- $((m PLUS n) MINUS n)$, and $m PLUS n$ are easily seen to be integers.
-- Since addition is monotone and $0 PLUS n = n$, we have $n incin (m PLUS n)$.
--
    ALGEBRA ==> m PLUS n in Za
    (m PLUS n,n)-->T283 ==> ((m PLUS n) MINUS n) in Za
    (n,m)-->T292 ==> n incin (m PLUS n)
--
-- The subtraction lemma (Theorem 271) now tells us that $#(m PLUS n) = #n PLUS ((m PLUS n) MINUS n)$,
-- and since $n$ and $(m PLUS n)$ are cardinals, we get $m PLUS n = n PLUS ((m PLUS n) MINUS n)$
-- = $((m PLUS n) MINUS n) PLUS n$, from which $(m PLUS n) MINUS n = m$ follows by cancellation,
-- proving our theorem.
--
    (n,m PLUS n)-->T271 ==> #(m PLUS n) = #n PLUS ((m PLUS n) MINUS n)
    n-->T207 ==> n = #n
    (m PLUS n)-->T207 ==> (m PLUS n) = #(m PLUS n)
    EQUAL ==> #(m PLUS n) = n PLUS ((m PLUS n) MINUS n)
    EQUAL ==> (m PLUS n) = n PLUS ((m PLUS n) MINUS n)
    ALGEBRA ==> m PLUS n = ((m PLUS n) MINUS n) PLUS n
    (m,(m PLUS n) MINUS n,n)-->T289 ==> false; Discharge ==> QED
--
--
--
Theorem 304a: [Over finite sets, difference corresponds to subtraction] (Finite(N) & (M incin N)) imp (#N MINUS #M = #(N - M)). Proof:
Suppose_not(n0,m0) ==> AUTO
	ELEM ==> Finite(#(n0 - m0)) & Finite(#m0)
	m0-->T156(*) ==> Card(#m0)
	(n0 - m0)-->T156(*) ==> Card(#(n0 - m0))
	(#(n0 - m0))-->T206(*) ==> #(n0 - m0) in Za
	(#m0)-->T206(*) ==> #m0 in Za
	(m0,n0)-->T272 ==> #n0 = (n0 MINUS m0) PLUS m0
	Use_def(MINUS) ==> (n0 MINUS m0) = #(n0 - m0)
	(#(n0 - m0),m0)-->T226 ==> AUTO
	EQUAL ==> #n0 MINUS #m0 = (#(n0 - m0) PLUS #m0) MINUS #m0
	(#(n0 - m0),#m0)-->T304(*) ==> false
	Discharge ==> QED
	
--
-- Our next, entirely elementary, lemma simply tells us that the cardinality of any singleton is 1.
--
Theorem 305: [Singletons have one element] #{S} = {0}. Proof:
    Suppose_not(s) ==> #{s} /= {0}
--
-- For {0}, as the sucessor of 0, is clearly a cardinal, and so our assertion is
-- equivalent to #{s} /= #{0}.
--
    T211 ==> Card(1)
    Use_def(next) ==> next(0) = {0}
    Use_def(1) ==> 1 = next(0)
    Use_def(next) ==> 1 = 0 + {0}
    ELEM ==> 1 = {0}
    EQUAL ==> Card({0})
    {0}-->T164 ==> #{0} = {0}
--
-- But the map {[s,0]} evidently sends {s} to {0} and is 1-1,
-- our assertion is immediate from Theorem 157.
--
    Use_def(domain) ==> Stat1: domain({[s,0]}) = {car(x): x in {[s,0]}}
    SIMPLF ==> {car(x): x in {[s,0]}} = {car([s,0])}
    ELEM ==> {car([s,0])} = {s}
    (Stat1*)ELEM ==> domain({[s,0]}) = {s}
    Use_def(range) ==> Stat2: range({[s,0]}) = {cdr(x): x in {[s,0]}}
    SIMPLF(Stat2*) ==> Stat3: range({[s,0]}) = {cdr([s,0])}
    (Stat3)ELEM ==> range({[s,0]}) = {0}
    TELEM ==> one_1_map({[s,0]})
    {[s,0]}-->T157 ==> #domain({[s,0]}) = #range({[s,0]})
    EQUAL ==> #{s} = #{0}
    Discharge ==> QED
--
--
--
Theorem 305a: [Over finite sets, difference corresponds to subtraction, 2] (Finite(N) & (M in N)) imp (#N MINUS 1 = #(N - {M})). Proof:
Suppose_not(n0,m0) ==> AUTO
	TELEM ==> #{m0} = 1
	(n0,{m0})-->T304a ==> #n0 MINUS #{m0} = #(n0 - {m0})
	EQUAL ==> false
	Discharge ==> QED
--
-- Our next, entirely elementary, lemma simply tells us that the cardinality of any
-- subset of a singleton is either 0 or 1.
--
Theorem 306: ({X} incs Y) imp (#Y in 2). Proof:
Suppose_not(x0,y0) ==> AUTO
	TELEM ==> (2 = {0,1}) & (#{x0} = 1)
	Suppose ==> y0 = 0
		y0-->T162(*) ==> false
	Discharge ==> (y0 = {x0}) & (#y0 /= 1)
	EQUAL ==> false
	Discharge ==> QED
--
-- The following lemma characterizes sets of cardinality 1 as being
-- those sets $x$ which are formed by their own $arb(x)$ alone.
--
Theorem 307: (#X = 1) eq (X = {arb(X)}). Proof:
Suppose_not(x0) ==> AUTO
--
-- For, assuming the contrary, we derive a contradiction
-- by arguing as follows. Recall the definition of the
-- number 1 and the fact that all singletons have cardinality 1.
--
	TELEM ==> 1 = {0}
	(arb(x0))-->T305 ==> #{arb(x0)} = {0}
--
-- We readily see that the failing implication must be
--	$(#X = 1) imp (X = {arb(X)})$.
--
	Suppose ==> (x0 = {arb(x0)}) & (#x0 /= 1)
		EQUAL ==> false
	Discharge ==> (#x0 = {0}) & (x0 /= {arb(x0)})
--
-- However, we know that a set $x0$ of non-null cardinality
-- must be non-null, and therefore meets the condition
--	$arb(x0) in x0$.
-- In the case at hand, since we are assuming that $x0$ has finite
-- cardinality (specifically, 1), it follows that $x0$ is finite:
-- therefore, if the inclusion $x0 incs {arb(x0)}$ could be strict
-- then the cardinality $#x0$ would exceed 1.
--
	0-->T201 ==> Finite({0})
	EQUAL ==> Finite(#x0)
	x0-->T193 ==> Finite(x0)
	x0-->T162 ==> arb(x0) in x0
	(x0,{arb(x0)})-->T235 ==> false
	Discharge ==> QED
--
-- Our next theorem combines preceding results to show that if $m$ and $n$ are integers,
-- $n$ being nonzero, then $m$ can be written as a sum $n = q TIMES n PLUS r$, where $q$ is the
-- integer quotient of $m$ by $n$, and $r$ is a remainder less than $n$.
--
Theorem 308: [Integer division with remainder] ((M in Za) & (N in Za) & (N /= 0)) imp
	(((M OVER N) in Za) & (M incs ((M OVER N) TIMES N)) & ((M MOD N) in N)). Proof+:
    Suppose_not(m,n) ==> Stat1: (m in Za) & (n IN Za) & (n /= 0) &
	(not(((m OVER n) in Za) & (m incs ((m OVER n) TIMES n)) & ((m MOD n) in n)))
--
-- For suppose that our theorem has a counterexample $m$, $n$.  Consider the set $s$ of all integers
-- of the form $m MINUS (p TIMES n)$, where $p$ ranges over all integers such that $(p TIMES n)$
-- is no larger than $n$. This set cannot be empty, since by setting $p = 0$ we see that
 -- $m$ must belong to it.
--
	n-->T207(*) ==> n = #n
	m-->T207(*) ==> Stat2: m = #m
    Suppose ==> Stat3: {m MINUS (p TIMES n): p in Za | m incs (p TIMES n)} = 0
		ALGEBRA ==> (0 in Za) & (0 TIMES n = 0)
    0-->Stat3(Stat3*) ==> m /= m MINUS (0 TIMES n)
    EQUAL ==> m /= m MINUS 0
		m-->T268(*) ==> m MINUS 0 = m
    Discharge ==> {m MINUS (p TIMES n): p in Za | m incs (p TIMES n)} /= 0
--
-- Let $r = q TIMES n$ be the smallest integer in the set $s$, so that by the axiom of choice
-- $r$ belongs to and is disjoint from $s$. q and r are plainly integers.
--
    Loc_def ==> r = arb({m MINUS (p TIMES n): p in Za | m incs (p TIMES n)})
    {m MINUS (q TIMES n): q in Za | m incs (q TIMES n)}-->T0 ==>
	Stat4: (r in {m MINUS (p TIMES n): p in Za | m incs (p TIMES n)}) &
	(r * {m MINUS (p TIMES n): p in Za | m incs (p TIMES n)} = 0)
    q-->Stat4 ==> Stat5: (r = m MINUS (q TIMES n)) & (q in Za) & (m incs (q TIMES n))
	q-->T207(*) ==> Stat6: q = #q
	ALGEBRA ==> ((q TIMES n) in Za) & (r in Za)
--
-- If $r$ is not smaller than $n$, it follows by Theorem 303 that $m$ is at least as large as $(q TIMES n) PLUS n$,
-- and that $m MINUS ((q TIMES n) PLUS n) = (m MINUS (q TIMES n)) MINUS n$. It follows, using a little algebra,
-- that $m$ is at least as large as $((q PLUS 1) TIMES n)$, so $(m MINUS ((q PLUS 1) TIMES n))$
-- must belong to the set $s$ considered above. Since $r = arb(s)$, it follows that
-- $(m MINUS ((q PLUS 1) TIMES n)) = r MINUS n$ cannot be a member of $r$, contradicting Theorem 284. Hence
-- we must have $r in n$.
--
	r-->T207 ==> r = #r
    Suppose ==> r incs n
    EQUAL ==> (m MINUS (q TIMES n)) incs n
		(q TIMES n,m,n)-->T303(*) ==> (m incs ((q TIMES n) PLUS n)) &
    								(m MINUS ((q TIMES n) PLUS n) = (m MINUS (q TIMES n)) MINUS n)
	ALGEBRA ==> (q TIMES n) PLUS n = ((q PLUS 1) TIMES n)
	EQUAL ==> m incs ((q PLUS 1) TIMES n)
	ALGEBRA ==> (q PLUS 1) in Za
		Suppose ==> Stat7: (m MINUS ((q PLUS 1) TIMES n)) notin
				{m MINUS (p TIMES n): p in Za | m incs (p TIMES n)}
			(q PLUS 1)-->Stat7 ==> not(((m MINUS ((q PLUS 1) TIMES n)) =
				(m MINUS ((q PLUS 1) TIMES n))) &
						((q PLUS 1) in Za) & (m incs ((q PLUS 1) TIMES n)))
		Discharge ==> (m MINUS ((q PLUS 1) TIMES n)) in
			{m MINUS (p TIMES n): p in Za | m incs (p TIMES n)}
	ELEM ==> (m MINUS ((q PLUS 1) TIMES n)) notin r
	EQUAL ==> ((m MINUS (q TIMES n)) MINUS n) notin r
	EQUAL ==> Stat8: (r MINUS n) notin r
		(n,r)-->T271(*) ==> #r = #n PLUS (r MINUS n)
	EQUAL ==> r = n PLUS (r MINUS n)
	ALGEBRA ==> r = (r MINUS n) PLUS n
		(r,n)-->T283(*) ==> r MINUS n in Za
		(r MINUS n,n)-->T284(*) ==> Stat9: (r MINUS n) in r
	(Stat8,Stat9)Discharge ==> Stat9a: not(r incs n)
	ELEM ==> Ord(n) & Ord(r)
	(n,r)-->T35(Stat9a*) ==> Stat10: r in n
--
-- Our next aim is to show that $q$ = $m OVER n$ = $Un({k in Za | (k TIMES n) incin m})$. To this end we
-- first note that $q in {k in Za | (k TIMES n) incin m}$, and therefore every member of $q$ belongs to
-- $Un({k in Za | (k TIMES n) incin m})$, so that $q$ is included in this set.
--
	Suppose ==> Stat11: q notin {k in Za | (k TIMES n) incin m}
	()-->Stat11 ==> false; Discharge ==> q in {k in Za | (k TIMES n) incin m}
	Suppose ==> Stat12: not (Un({k in Za | (k TIMES n) incin m}) incs q)
	c-->Stat12 ==> (c in q) & (c notin Un({k in Za | (k TIMES n) incin m}))
	Use_def(Un) ==> Stat13: c notin {v: u in {k in Za | (k TIMES n) incin m}, v in u}
	SIMPLF ==> {v: u in {k in Za | (k TIMES n) incin m}, v in u} = {v: k in Za , v in k | (k TIMES n) incin m}
	(Stat13)ELEM ==> Stat14: c notin {v: k in Za , v in k | (k TIMES n) incin m}
	(q,c)-->Stat14 ==> false; Discharge ==> Un({k in Za | (k TIMES n) incin m}) incs q
--
-- Next suppose that $Un({k in Za | (k TIMES n) incin m})$ is not included in $q$, so that
--
	Suppose ==> Stat15: not (Un({k in Za | (k TIMES n) incin m})) incin q
	d-->Stat15 ==> (d in Un({k in Za | (k TIMES n) incin m})) & (d notin q)
	Use_def(Un) ==> d in {v: u in {k in Za | (k TIMES n) incin m}, v in u}
	SIMPLF ==> Stat16: d in {v: k in Za , v in k | (k TIMES n) incin m}
	(k1,v1)-->Stat16 ==> Stat17: (v1 notin q) & (k1 in Za) & (v1 in k1) & ((k1 TIMES n) incin m)
		(k1,v1)-->T13(*) ==> Stat19: k1 incs v1
		(q,v1)-->T31(*) ==> (q in v1) or (q = v1)
		(Stat17*)ELEM ==> q in k1
		(q,k1,n)-->T294(*) ==> (q TIMES n) in (k1 TIMES n)
	ALGEBRA ==> k1 TIMES n in Za
		(k1 TIMES n,m,q TIMES n)-->T299(*) ==> Stat20: m MINUS (k1 TIMES n) in m MINUS (q TIMES n)
	(Stat5,Stat20)ELEM ==> Stat21: m MINUS (k1 TIMES n) in r
	Suppose ==> Stat22: m MINUS (k1 TIMES n) notin {m MINUS (p TIMES n): p in Za | m incs (p TIMES n)}
	k1-->Stat22 ==> false; Discharge ==> Stat23: m MINUS (k1 TIMES n) in {m MINUS (p TIMES n): p in Za | m incs (p TIMES n)}
--
-- This contradiction proves that $q$ = $Un({k in Za | (k TIMES n) incin m})$ as asserted,
-- and then by definition $q$ = $m OVER n$ and $m MOD n = r$
--
	(Stat4,Stat23,Stat21)Discharge ==> q = Un({k in Za | (k TIMES n) incin m})
	Use_def(OVER) ==> Stat24: q = m OVER n
	EQUAL(Stat5) ==> Stat25: (m OVER n in Za) & (m incs ((m OVER n) TIMES n))
	EQUAL(Stat5,Stat24) ==> (r = m MINUS ((m OVER n) TIMES n))
	Use_def(MOD) ==> Stat26: m MOD n = r
	EQUAL(Stat10,Stat26) ==> Stat27: (m MOD n) in n
    (Stat1,Stat25,Stat27)Discharge ==> QED
--
-- Our next theorem states and generalizes the fact that if the product
-- of two cardinal numbers is zero, one of them must be zero.
--
Theorem 309: [If an integer product is zero, one of its factors is 0] (N TIMES M = 0) eq (N = 0 or M = 0). Proof:
    Suppose_not(n,m) ==> (((n TIMES m = 0) & (n /= 0) & (m /= 0)) or
    						((n = 0 or m = 0) & (not (n TIMES m = 0))))
    (n,m)-->T230 ==> (n TIMES m) = (#n TIMES #m)
	EQUAL ==> (((#n TIMES #m = 0) & (n /= 0) & (m /= 0)) or
    						((n = 0 or m = 0) & (not (#n TIMES #m = 0))))--
-- For let $n$ and $m$ form a counterexample to our assertion, and first suppose that
-- $#n TIMES #m is 0$, but neither $n$ nor $m$ is $0$, so that these sets contain singletons
-- ${c}$ and ${d}$ respectively. Then by Theorem 170 and Theorem 305, ${0}$ is a subset of both $#n$ and $#m$.
--
    Suppose ==> (#n TIMES #m = 0) & Stat1: (n /= 0) & Stat2: (m /= 0)
    c-->Stat1 ==> {c} incin n
    d-->Stat2 ==> {d} incin m
    ({c},n)-->T170 ==> #{c} incin #n
    ({d},m)-->T170 ==> #{d} incin #m
    d-->T305 ==> Stat3: {0} incin #m
    c-->T305 ==> Stat4: {0} incin #n
--
-- It follows easily that $[0,0]$ is a member of $(#n PROD #m)$, which must therefore
-- have cardinality at least $1$. This contradiction shows that if our theorem is false,
-- one of $m$ and $n$ must be $0$, while $#n TIMES #m$ is nonzero.
--
    Suppose ==> [0,0] notin #n PROD #m
    Use_def(PROD) ==> Stat5: [0,0] notin {[x,y]: x in #n, y in #m}
    (0,0)-->Stat5 ==> Stat6: not(([0,0] = [0,0]) & (0 in #n) & (0 in #m))
    (Stat3,Stat4,Stat6)Discharge ==> [0,0] in #n PROD #m
    ELEM ==> {[0,0]} incin (#n PROD #m)
    Set_monot ==> #{[0,0]} incin #(#n PROD #m)
    ([0,0])-->T305 ==> {0} incin #(#n PROD #m)
    Use_def(TIMES) ==> {0} incin (#n TIMES #m)
    Discharge ==> (n = 0 or m = 0) & (#n TIMES #m /= 0)
--
-- But now our conclusion follows immediately from the fact that $0 TIMES m = #(0 PROD #m)$
-- and $m TIMES 0$ are both $0$.
--
    T188 ==> Card(0)
    0-->T164 ==> #0 = 0
    Suppose ==> n = 0
    EQUAL ==> #n = #0
    EQUAL ==> 0 TIMES #m /= 0
    (#m)-->T246 ==> false; Discharge ==> m = 0
    EQUAL ==> #m = #0
    EQUAL ==> not (#n TIMES #0 = 0)
    (n,0)-->T230 ==> not (n TIMES 0 = 0)
    n-->T245 ==> false; Discharge ==> QED
--
-- The following very easy result tells us that arithmetic subtraction
-- is monotone increasing in its first parameter.
--
Theorem 310: [Subtraction monotonicity lemma] (N incs M) imp ((N MINUS K) incs (M MINUS K)). Proof:
    Suppose_not(n,m,k) ==> (n incs m) & (not((n MINUS k) incs (m MINUS k)))
--
-- For otherwise, by definition of subtraction and the monotonicity of cardinality
-- we would have $not (n - k incs m - k)$, which is impossible.
--
    Use_def(MINUS) ==> not(#(n - k) incs #(m - k))
    (m - k,n - k)-->T170 ==> not (n - k incs m - k)
    Discharge ==> QED
--
-- Next we show that if $m$ is a subset of $m$ and $n$ is finite, the cardinality of
-- the difference set $n - m$ is the cardinality of the difference of the cardinalities $#n$ and $#m$.
--
Theorem 311: [Cardinality of set difference] (Finite(N) & (N incs M)) imp (#(N - M) = #(#N - #M)). Proof:
    Suppose_not(n,m) ==> Finite(n) & (n incs m) & (#(n - m) /= #(#n - #m))
--
-- For let $n$, $m$ be a counterexample. Since $n incs m$, we must have $#n incs #m$.
-- Our aim is to prove that $#(n - m) PLUS #m /= #(#n - #m) PLUS #m$ and then use
-- cancellation to obtain the stated conclusion of our theorem.
-- We begin by using Theorem 271 twice to derive $#m PLUS #(#n - #m) = #m PLUS (n MINUS m)$.
--
	(m,n)-->T170 ==> #n incs #m
	Use_def(MINUS) ==> #(n - m) = n MINUS m
	(m,n)-->T271 ==> #n = #m PLUS (n MINUS m)
	EQUAL ==> #n = #m PLUS #(n - m)
	Use_def(MINUS) ==> #(#n - #m) = #n MINUS #m
	(#m,#n)-->T271 ==> ##n = ##m PLUS (#n MINUS #m)
	EQUAL ==> ##n = ##m PLUS #(#n - #m)
	n-->T166 ==> ##n = #n
	m-->T166 ==> ##m = #m
--
-- But since all the cardinalities involved in the equation mentioned above are integers,
-- the rules of algebra apply and make it clear that the rule of cancellation applies also.
-- Thus our conclusion follows.
--
	EQUAL ==> #n = #m PLUS #(#n - #m)
	n-->T193 ==> Finite(#n)
	(n,n - m)-->T189 ==> Finite(n - m) & Finite(m)
	(#n,#n - #m)-->T189 ==> Finite(#n - #m)
	(n - m)-->T193 ==> Finite(#(n - m))
	(#n - #m)-->T193 ==> Finite(#(#n - #m))
	(n - m)-->T156 ==> Card(#(n - m))
 	m-->T156 ==> Card(#m)
 	(#n - #m)-->T156 ==> Card(#(#n - #m))
	(#m)-->T206 ==> #m in Za
 	(#(n - m))-->T206 ==> #(n - m) in Za
 	(#(#n - #m))-->T206 ==> #(#n - #m) in Za
	ALGEBRA ==> ((#m PLUS #(n - m) = #(n - m) PLUS #m)) & ((#m PLUS #(#n - #m) = #(#n - #m) PLUS #m))
	ELEM ==> Stat1: #(n - m) PLUS #m = #(#n - #m) PLUS #m
	(Stat1*)ELEM ==> (n incs n - m) & (#n incs #n - #m)
   	(#(n - m),#(#n - #m),#m)-->T289 ==> false; Discharge ==> QED
--
--
-- The following theorem states the fact that integer addition is strictly monotone in its first argument.
--
Theorem 312: [Strong monotonicity of integer addition] ((N in Za) & (M in Za) & (K in Za)) imp ((N incs M) eq ((N PLUS K) incs (M PLUS K))). Proof:
    Suppose_not(n,m,k) ==> (n in Za) & (m in Za) & (k in Za) & (not((n incs m) eq ((n PLUS k) incs (m PLUS k))))
--
-- Suppose that $n$, $m$, $k$ are a counterexample to our assertion. If $n incs m$
-- our conclusion follows immediately from the definition of addition and the principle of set monotonicity.
--
    Suppose ==> (n incs m) & (not((n PLUS k) incs (m PLUS k)))
    Use_def(PLUS) ==> not(#({[x,0]: x in n} + {[x,1]: x in k}) incs #({[x,0]: x in m} + {[x,1]: x in k}))
    ({[x,0]: x in m} + {[x,1]: x in k},{[x,0]: x in n} + {[x,1]: x in k})-->T170 ==>
	not(({[x,0]: x in n} + {[x,1]: x in k}) incs ({[x,0]: x in m} + {[x,1]: x in k}))
    Set_monot ==> {[x,0]: x in n} incs {[x,0]: x in m}
    Discharge ==> (not(n incs m)) & ((n PLUS k) incs (m PLUS k))
--
-- Thus we must have $(n PLUS k) incs (m PLUS k)$ but $not (n incs m)$, which since
-- addition is (nonstrictly) monotone is impossible by Theorem 304.
--
    ((n PLUS k),(m PLUS k),k)-->T310 ==> ((n PLUS k) MINUS k) incs ((m PLUS k) MINUS k)
    (n,k)-->T304 ==> n incs ((m PLUS k) MINUS k)
    (m,k)-->T304 ==> false; Discharge ==> QED
--
-- Our next, very easy result states the inverse relationship between arithmetic addition and
-- subtraction in a very general but slightly unusual way.
--
Theorem 313: [Addition reverses subtraction] (N incs M) imp (#N = #M PLUS #(N - M)). Proof:
    Suppose_not(n,m) ==> (n incs m) & (#n /= #m PLUS #(n - m))
--
-- For if not we must have #n /= #m PLUS #(n - m), and so using the definition of subtraction
-- we find a contradiction With Theorem 271.
--
    (m,n)-->T271 ==> #n = #m PLUS (n MINUS m)
    Use_def(MINUS) ==> (n MINUS m) = #(n - m)
    EQUAL ==> #(n MINUS m) = ##(n - m)
    (n - m)-->T166 ==> #(n MINUS m) = #(n - m)
    EQUAL ==> false; Discharge ==> QED
--
-- Our next result states an elementary arithmetic relationship between integer subtraction and addition,
-- but only in the case in which all the quantities involved are non-negative.
--
Theorem 314: [Addition-subtraction commutativity, 2] ((N in Za) & (M in Za) & (K in Za) & (N incs M)) imp ((N PLUS K) MINUS (M PLUS K) = N MINUS M). Proof:
    Suppose_not(n,m,k) ==> (n in Za) & (m in Za) & (k in Za) & (n incs m) & ((n PLUS k) MINUS (m PLUS k) /= n MINUS m)
--
-- For suppose that $n$, $m$, $k$ are a couterexample to our assertion.
-- Since all the quantities involved are integers, we can reassociate to write
-- $(n MINUS m) PLUS (m PLUS k)$ as $((n MINUS m) PLUS m) PLUS k$,
-- and then use Theorem 272 to reduce this last quantity to $n PLUS k$.
--
	(n,k)-->T283 ==> (n PLUS k) in Za
 	(m,k)-->T283 ==> (m PLUS k) in Za
 	(n,m)-->T283 ==> (n MINUS m) in Za
 	(n PLUS k,m PLUS k)-->T283 ==> ((n PLUS k) MINUS (m PLUS k)) in Za
 	ALGEBRA ==> (n MINUS m) PLUS (m PLUS k) = ((n MINUS m) PLUS m) PLUS k
    n-->T207 ==> n = #n
    (n PLUS k)-->T207 ==> (n PLUS k) = #(n PLUS k)
 	(m,n)-->T272 ==> (n MINUS m) PLUS m = n
	EQUAL ==> (n MINUS m) PLUS (m PLUS k) = (n PLUS k)
	(m,n,k)-->T290 ==> (n PLUS k) incs (m PLUS k)
--
-- Now, subtracting $m PLUS k$ from $n PLUS k$ and then immediately adding it back, we find that
--
-- 	$((n MINUS m) PLUS (m PLUS k) MINUS (m PLUS k)) PLUS (m PLUS k) = (n PLUS k)$
--
-- so that our conclusion follows immediately from Theorem 289.
--
	(m PLUS k,n PLUS k)-->T272 ==> ((n PLUS k) MINUS (m PLUS k)) PLUS (m PLUS k) = (n PLUS k)
	((n PLUS k) MINUS (m PLUS k),n MINUS m,m PLUS k)-->T289 ==> false; Discharge ==> QED
--
-- Next we restate Theorem 271 into form useful independent of which of
-- the two sets $n$ and $m$ has the larger cardinality.
--
Theorem 315: [Addition-subtraction lemma] ((N in Za) & (M in Za)) imp (N = (M PLUS (N MINUS M)) or N = (M MINUS (M MINUS N))). Proof+:
    Suppose_not(n,m) ==> AUTO
--
-- Since one of the two ordinals n and m must include the other,
-- our conclusion follows immediately by two applications of Theorem 271 and one
-- of Theorem 304.
--
    n-->T207 ==> n = #n
    m-->T207 ==> m = #m
    (n,m)-->T29 ==> (n incin m) or (m incin n)
    Suppose ==> m incin n
    (m,n)-->T271 ==> n = (#m PLUS (n MINUS m))
    EQUAL ==> false; Discharge ==> n incin m
    (n,m)-->T271 ==> m = (#n PLUS (m MINUS n))
    EQUAL ==> m = (n PLUS (m MINUS n))
    ALGEBRA ==> (m MINUS n) in Za
    (n,m MINUS n)-->T304 ==> n = (n PLUS (m MINUS n)) MINUS (m MINUS n)
    EQUAL ==> false; Discharge ==> QED
---
--- ================ Additional theorems concerning unsigned integers =====================
--
-- Our next theorem states that the arithmetic increment of any set $n$ by $1$,
-- is the cardinality of the immediate successor of $n$.
--
Theorem 316: [The successor integer as a sum] (N PLUS 1) = #next(N). Proof:
--
-- For, if not, we could take an $n$ whose unitary increment $n PLUS 1$
-- differs from the cardinality $#next(n)$ of its immediate successor.
--
    Suppose_not(n) ==> Stat1: (n PLUS 1) /= #next(n)
--
-- But on the other hand, it follows from the theorems
-- $N PLUS M = N PLUS #M$ and $#{M}={0}$, exploiting the definitions
-- of $1$ and $next$ and elementary reasoning, that
-- $n PLUS {n} = n PLUS #{n}$ = $n PLUS 1$.
--
	(n,{n})-->T226 ==> Stat2: (n PLUS {n}) = (n PLUS #{n})
	n-->T305 ==> Stat3: #{n} = {0}
	Use_def(1) ==> 1 = next(0)
	Use_def(next) ==> Stat4: 1 = 0 + {0}
	(Stat3,Stat4)ELEM ==> Stat5: (n * {n} = 0) & (#{n} = 1)
	Use_def(next) ==> Stat6: #next(n) = #(n + {n})
--
-- Since $n$ and ${n}$ are disjoint, we also have $n PLUS {n} = #next(n)$.
--
    (n,{n})-->T220 ==> Stat7: (n PLUS {n}) = #(n + {n})
--
-- This leads to a contradiction which proves our assertion.
--
    EQUAL(Stat6,Stat7,Stat2,Stat5) ==> Stat8: #next(n) = (n PLUS 1)
    (Stat8,Stat1)Discharge ==> QED
--
-- An immediate corollary of Theorem 316 is that the increment by $1$
-- of any unsigned integer $N$, and the immediate successor of $N$, are the same:
--
Theorem 317: [The successor integer as a sum, 2] (N in Za) imp ((next(N) in Za) & ((N PLUS 1) = next(N))). Proof:
-- For, if not, we could take an unsigned integer n whose unitary
-- increment $n PLUS 1$ differs from its immediate successor $next(n)$.
    Suppose_not(n) ==> Stat1: (n in Za) & ((next(N) notin Za) or ((n PLUS 1) /= next(n)))
--
-- However, the unsigned integers are precisely the finite cardinals; so $n$ must be a finite cardinal.
--
	n-->T206 ==> Finite(n) & Card(n)
--
-- Therefore $next(n)$ is a finite cardinal, and accordingly it equals its
-- own cardinality. By Theorem abc, this leads us to a contradiction
-- which proves our theorem.
--
	Use_def(Card) ==> Ord(n)
	n-->T32 ==> Ord(next(n))
	n-->T200 ==> Finite(next(n))
	(next(n))-->T205 ==> Card(next(n))
	(next(n))-->T206 ==> Stat2: next(n) in Za
	(next(n))-->T164 ==> Stat3: next(n) = #next(n)
	n-->T316 ==> Stat4: (n PLUS 1) = #next(n)
    (Stat1,Stat3,Stat4,Stat2)Discharge ==> QED
--
-- The following useful combinatorial lemma is dear to Alberto Policriti
--
Theorem 318: [To witness that $n$ sets are different, fewer than $n$ elements suffice] (Finite(F) & (F /= 0)) imp (EXISTS d incin Un(F) | (#d in #F) & (FORALL w in F, y in F | (w * d = y * d) imp (w = y))). Proof:
Suppose_not(f) ==> Finite(f) & (f /= 0) & (not(EXISTS d incin Un(f) | (#d in #f) & (FORALL w in f, y in f | (w * d = y * d) imp (w = y))))
--
-- For, assuming the contrary, we would have an inclusion-minimal $f0$ contradicting the claim.
--
	APPLY(m1_thryvar:f0) finite_induction(n->f,P(x)->((x /= 0) & (not(EXISTS d incin Un(x) | (#d in #x) & (FORALL w in x, y in x | (w * d = y * d) imp (w = y)))))) ==>
		Stat1: (not(EXISTS d incin Un(f0) | (#d in #f0) & (FORALL w in f0, y in f0 | (w * d = y * d) imp (w = y)))) & (f0 incin f) & (f0 /= 0) &
		Stat2: (FORALL k incin f0 | ((k /= f0) imp (not ((k /= 0) & (not(EXISTS d incin Un(k) | (#d in #k) & (FORALL w in k, y in k | (w * d = y * d) imp (w = y))))))))
	(f,f0)-->T189(*) ==> Stat3: Finite(f0)
--
-- Such an $f0$ cannot be a singleton, because the claim vacuously holds for singletons.
--
	Suppose ==> Stat4: f0 = {arb(f0)}
		0-->Stat1(Stat1,Stat1*) ==> (#0 notin #f0) or (not(FORALL w in f0, y in f0 | (w * 0 = y * 0) imp (w = y)))
		(arb(f0))-->T305(Stat4*) ==> #{arb(f0)} = {0}
		0-->T162(Stat4*) ==> #0 = 0
		EQUAL(Stat4) ==> #f0 = {0}
		(Stat4*)ELEM ==> Stat5: (not(FORALL w in f0, y in f0 | (w * 0 = y * 0) imp (w = y)))
		(w0,y0)-->Stat5(Stat4*) ==> false
	Discharge ==> AUTO
--
-- But then the minimality assumption yields that the claim holds, for some $d = d0$, when
-- $F = f0 - {arb(f0)}$.
--
	(f0 - {arb(f0)})-->Stat2(Stat1) ==> Stat6: (EXISTS d incin Un(f0 - {arb(f0)}) | (#d in #(f0 - {arb(f0)})) & (FORALL w in (f0 - {arb(f0)}), y in (f0 - {arb(f0)}) | (w * d = y * d) imp (w = y)))
	d0-->Stat6(Stat6*) ==> Stat7: (FORALL w in (f0 - {arb(f0)}), y in (f0 - {arb(f0)}) | (w * d0 = y * d0) imp (w = y)) & (d0 incin Un(f0 - {arb(f0)})) & (#d0 in #(f0 - {arb(f0)}))
--
-- Observe that $arb(f0)$ is indiscernible, relative to $d0$, from some element $w1$ of $f0 - {arb(f0)}$.
--
	f0-->T109(Stat1*) ==> Un(f0) = (arb(f0) + Un(f0 - {arb(f0)}))
	Suppose ==> Stat8: {v in (f0 - {arb(f0)}) | v * d0 = arb(f0) * d0} = 0
		(f0 - {arb(f0)},f0)-->T170(Stat7*) ==> #(f0 - {arb(f0)}) incin #f0
		d0-->Stat1(Stat7*) ==> Stat9: not(FORALL w in f0, y in f0 | (w * d0 = y * d0) imp (w = y))
		(w,y)-->Stat9(Stat9*) ==> (w in f0) & (y in f0) & (w /= y) & (w * d0 = y * d0)
		(w,y)-->Stat7(Stat9*) ==> not((w /= arb(f0)) & (y /= arb(f0)))
		Suppose ==> w = arb(f0)
			y-->Stat8(Stat9*) ==> false
		Discharge ==> AUTO
		(Stat9*)ELEM ==> w * d0 = arb(f0) * d0
		w-->Stat8(Stat9*) ==> false
	Discharge ==> AUTO
	(Stat7)ELEM ==> Stat10: arb({v in (f0 - {arb(f0)}) | v * d0 = arb(f0) * d0}) in {v: v in (f0 - {arb(f0)}) | v * d0 = arb(f0) * d0}
	w1-->Stat10(Stat10*) ==> Stat11: (w1 /= arb(f0)) & (w1 in f0) & (w1 * d0 = arb(f0) * d0)
--
-- After picking a $c$ belonging to only one of $w1,arb(f0)$, we
-- consider the set $d0 + {c}$. Our goal becomes to derive a
-- contradiction by showing that the latter set duly differentiates any
-- two elements of $f0$ and meets the desired cardinality limitation.
--
	c-->Stat11(Stat11*) ==> Stat12: ((c in w1) eq (c notin arb(f0))) & (c notin d0)
	f0-->T274(Stat11*) ==> Stat13: (FORALL x in f0 | x incin Un(f0))
	w1-->Stat13(Stat11*) ==> w1 incin Un(f0)
	(Stat7*)ELEM ==> Stat14: ((w1 * (d0 + {c})) /= (arb(f0) * (d0 + {c}))) & ((d0 + {c}) incin Un(f0))
	(d0 + {c})-->Stat1(Stat14*) ==> not((#(d0 + {c}) in #f0) & (FORALL w in f0, y in f0 | (w * (d0 + {c}) = y * (d0 + {c})) imp (w = y)))
--
-- If two elements $w2,y2$ of $f0$, although distinct, are
-- indiscernible from one another relative to the set $d0 + {c}$,
-- either of them must be $arb(f0)$.
-- The other one cannot be $w1$, as can be seen from Stat15
-- therefore it is some $w3 in f0 - {arb(f0),w1}$, and since
-- $w3$ is discernible from $w1$ relative to $d0$, and $w1$ is
-- indiscernible from $arb(f0)$ relative to $d0$, $w3$ is
-- discernible from $arb(f0)$ relative to $d0$ (and hence also
-- relative to $d0 + {c}$. This contradiction indicates
-- that $d0 + {c}$ does not meet the desired cardinality
-- limitation $#(d0 + {c}) in #f0$.
--
	Suppose ==> Stat16: not((FORALL w in f0, y in f0 | (w * (d0 + {c}) = y * (d0 + {c})) imp (w = y)))
		(w2,y2)-->Stat16(Stat16*) ==> Stat17: (w2 in f0) & (y2 in f0) & (w2 * (d0 + {c}) = y2 * (d0 + {c})) & (w2 /= y2)
		(w2,y2)-->Stat7(Stat17*) ==> (w2 = arb(f0)) or (y2 = arb(f0))
		Suppose ==> Stat18: w2 = arb(f0)
--??			EQUAL(Stat14,Stat17,Stat18) ==> Stat19: y2 /= w1
			(Stat14,Stat17,Stat18*)ELEM ==> Stat19: y2 /= w1
			EQUAL(Stat17,Stat18) ==> Stat20: y2 /= arb(f0)
			(w1,y2)-->Stat7(Stat11,Stat17,Stat19,Stat20*) ==> Stat21: w1 * d0 /= y2 * d0
		(Stat11,Stat18,Stat21,Stat17*)Discharge ==> AUTO
		(Stat17*)ELEM ==> Stat22: y2 = arb(f0)
		(Stat14,Stat17,Stat22*)ELEM ==> Stat23: w2 /= w1
		EQUAL(Stat17,Stat22) ==> Stat24: w2 /= arb(f0)
		(w1,w2)-->Stat7(Stat11,Stat17,Stat23,Stat24) ==> Stat25: w1 * d0 /= w2 * d0
	(Stat11,Stat22,Stat25,Stat17*)Discharge ==> AUTO
	(Stat14*)ELEM ==> Stat26: #(d0 + {c}) notin #f0
--
-- However this is untenable, as we know that $#d0 in #(f0 - {arb(f0)})$,
-- and we can easily prove that $#d0$ is the immediate predecessor
-- of $#(d0 + {c})$ and that $#(f0 - {arb(f0)})$ precedes $#f0$.
--
	(f0 - {arb(f0)})-->T156(Stat26*) ==> Card(#(f0 - {arb(f0)}))
	f0-->T156(Stat26*) ==> Card(#f0)
	Use_def(Card) ==> Stat27: Ord(#(f0 - {arb(f0)})) & Ord(#f0)
	Suppose ==> #(d0 + {c}) /= next(#d0)
		Suppose ==> #d0 notin Za
			(f0,f0 - {arb(f0)})-->T189(Stat3,Stat3) ==> Finite(#(f0 - {arb(f0)}))
			(#(f0 - {arb(f0)}))-->T207 ==> AUTO
			(#(f0 - {arb(f0)}),#d0)-->T196(Stat7*) ==> Finite(#d0)
			d0-->T156(Stat27*) ==> Card(#d0)
			(#d0)-->T206(Stat27*) ==> false
		Discharge ==> AUTO
		(d0,{c})-->T222(Stat12,Stat12*) ==> #(d0 + {c}) = #d0 PLUS #{c}
		(#d0)-->T317(Stat26*) ==> #d0 PLUS 1 = next(#d0)
		c-->T305(Stat26*) ==> #{c} = {0}
		TELEM ==> {0} = 1
		EQUAL(Stat26) ==> false
	Discharge ==> AUTO
	(f0,f0 - {arb(f0)})-->T194(Stat3,Stat1) ==> Stat28: #(f0 - {arb(f0)}) in #f0
	(#(f0 - {arb(f0)}),#d0)-->T37(Stat7*) ==> (#(d0 + {c}) incin #(f0 - {arb(f0)})) & (#(d0 + {c}) /= #(f0 - {arb(f0)}))
	Use_def(Card(#(d0 + {c}))) ==> AUTO
	(d0 + {c})-->T156(Stat28*) ==> Stat29: Ord(#(d0 + {c}))
	(#(f0 - {arb(f0)}),#(d0 + {c}))-->T34(Stat27*) ==> Stat30: #(d0 + {c}) in #(f0 - {arb(f0)})
	(#f0,#(f0 - {arb(f0)}))-->T13(Stat27,Stat28,Stat26,Stat30*) ==> false
	Discharge ==> QED
--
-- A compact restatement of the preceding combinatorial lemma reads as follows:
--
Theorem 319: [To witness that $n$ sets are different, fewer than $n$ elements suffice, 2] (Finite(F) & (F /= 0)) imp ({d incin Un(F) | (#d in #F) & (#{w * d : w in F} = #F)} /= 0). Proof:
Suppose_not(f0) ==> AUTO
	f0-->T318 ==> Stat1: (EXISTS d incin Un(f0) | (#d in #f0) & (FORALL w in f0, y in f0 | (w * d = y * d) imp (w = y)))
	d0-->Stat1(Stat1*) ==> Stat2: (FORALL w in f0, y in f0 | (w * d0 = y * d0) imp (w = y)) & (d0 incin Un(f0)) & (#d0 in #f0)
	ELEM ==> Stat3: {d incin Un(f0) | (#d in #f0) & (#{w * d: w in f0} = #f0)} = 0
	d0-->Stat3(Stat2*) ==> #{w * d0: w in f0} /= #f0
	TELEM ==> Stat4: Svm({[w,w * d0]: w in f0}) & (domain({[w,w * d0]: w in f0}) = f0) & (range({[w,w * d0]: w in f0}) = {w * d0: w in f0})
--??	Use_def(one_1_map({[w,w * d0]: w in f0})) ==> AUTO
--??	Use_def(one_1_map)(Stat4*) ==> one_1_map({[w,w * d0]: w in f0}) eq (FORALL x in {[w,w * d0]: w in f0}, y in {[w,w * d0]: w in f0} | (cdr(x) = cdr(y)) imp (x = y))
	Use_def(one_1_map)(Stat4*) ==> (FORALL x in {[w,w * d0]: w in f0}, y in {[w,w * d0]: w in f0} | (cdr(x) = cdr(y)) imp (x = y)) imp one_1_map({[w,w * d0]: w in f0})
	Suppose ==> #range({[w,w * d0]: w in f0}) = #domain({[w,w * d0]: w in f0})
	EQUAL(Stat3) ==> false; Discharge ==> AUTO
	({[w,w * d0]: w in f0})-->T157(Stat4) ==> Stat5: not(FORALL x in {[w,w * d0]: w in f0}, y in {[w,w * d0]: w in f0} | (cdr(x) = cdr(y)) imp (x = y))
	(p,q)-->Stat5(Stat5*) ==> Stat6: (p in {[w,w * d0]: w in f0}) & (q in {[w,w * d0]: w in f0}) & (cdr(p) = cdr(q)) & (p /= q)
	(w0,y0)-->Stat6(Stat6*) ==> (p = [w0,w0 * d0]) & (w0 in f0) & (q = [y0,y0 * d0]) & (y0 in f0)
	TELEM ==> (cdr([w0,w0 * d0]) = w0 * d0) & (cdr([y0,y0 * d0]) = y0 * d0)
	EQUAL(Stat6) ==>  Stat7: w0 * d0 = y0 * d0
	(w0,y0)-->Stat2(Stat6*) ==> w0 = y0
	EQUAL(Stat6) ==> false
	Discharge ==> QED
--
-- Next we prove that the union-set of any finite set of
-- unsigned integers is an unsigned integer (actually, a member of $M$ unless $M$ is 0),...
--
Theorem 320: [The union set of a finite collection of integers is an integer] ((M incin Za) & Finite(M)) imp (((M /= 0) imp (Un(M) in M)) & (Un(M) in Za)). Proof+:
--
-- Assume that $n$ is a counterexample to our assertion. Then if the first clause of our assertion is violated,
-- it is violated by some inclusion-minimal $m incin n$.
--
    Suppose_not(n) ==> Stat1: (n incin Za) & Finite(n) & (((n /= 0) & (Un(n) notin n)) or (Un(n) notin Za))
	Suppose ==> (n /= 0) & (Un(n) notin n)
	APPLY(m1_thryvar:m) finite_induction(n->n,P(y)->((y/=0) & (Un(y) notin y))) ==>
		Stat2: ((m incin n) & (m /= 0) & (Un(m) notin m) &
			 (FORALL k incin m | ((k /= m) imp (not((k /= 0) & (Un(k) notin k))))))
--
-- Since $m$ is nonempty, $arb(m)$ is a member of $m$, and also $Un(m) = arb(m) + Un(m - {arb(m)})$ by Theorem 109.
-- Since $Un(m) notin m$, it follows that m cannot be a singleton, and so it must have some second integer member $c$.
--
	(Stat2)ELEM ==> Stat3: (FORALL k incin m | ((k /= m) imp (not((k /= 0) & (Un(k) notin k))))) & (m = {arb(m)} + (m - {arb(m)}))
	m-->T109 ==> Stat4: (Un(0) = 0) & (Un(m) = (arb(m) + Un(m - {arb(m)})))
	Suppose ==> Stat5: (m - {arb(m)}) = 0
	EQUAL(Stat5,Stat4) ==> Stat6: Un(m - {arb(m)}) = 0
		(Stat6,Stat4,Stat3,Stat2*)Discharge ==> Stat7: (m - {arb(m)}) /= 0
		c-->Stat7(Stat7*) ==> Stat8: c in (m - {arb(m)})
	(Stat2,Stat8,Stat1)ELEM ==> Stat9: (c in Za) & (arb(m) in Za) & (c /= arb(m)) & (c notin arb(m))
--
-- Since $c$ is not smaller than $arb(m)$, $arb(m)$ must be a member of $c$,
-- and hence a member of  a member of $m - {arb(m)}$, i.e. a member of $Un(m - {arb(m)})$.
--
		(c,arb(m))-->T31(Stat9*) ==> Stat11: arb(m) in c
	Suppose ==> arb(m) notin Un(m - {arb(m)})
	Use_def(Un) ==> Stat12: arb(m) notin {x: y in (m - {arb(m)}), x in y}
			(c,arb(m))-->Stat12(Stat12*) ==> Stat13: not((c in (m - {arb(c)})) & (arb(m) in c))
		(Stat11,Stat8,Stat13*)Discharge ==> Stat14: arb(m) in Un(m - {arb(m)})
--
-- Since $m - {arb(m)}$ is a non-empty subset of $m$, It follows by Stat15 2 that
-- $Un(m - {arb(m)}) in (m - {arb(m)})$, and so is an ordinal, whose member $arb(m)$ must therefore be a subset of it.
-- Thus, by statement 4, we have $Un(m) = Un(m - {arb(m)})$.
--
	(m - {arb(m)})-->Stat3(Stat8*) ==> Stat16: Un(m - {arb(m)}) in (m - {arb(m)})
	(Un(m - {arb(m)}),arb(m))-->T13 ==> Stat18: arb(m) incin Un(m - {arb(m)})
	(Stat4,Stat18*)ELEM ==> Stat19: Un(m) = Un(m - {arb(m)})
--
-- But this contradicts Stat15 2. Therefore our intial suppositon must be false,
-- i.e. either $n$ is 0 or $Un(n) in n$. If $Un(n) in n$ the assertion of our theorem
-- is clearly satisfied, so only the case $n = 0$ need be considered. But in this case our assertion is obvious.
-- Hence our theorem is valid in all cases.
--
	(Stat19,Stat16,Stat2*)Discharge ==> Stat20: (n = 0) or (Un(n) in n)
    Suppose ==> (n = 0) & (Un(n) notin Za)
		T109(*) ==> Un(0) = 0
	EQUAL==> false; Discharge ==> Stat22: not((n = 0) & (Un(n) notin Za))
    (Stat22,Stat20,Stat1)Discharge ==> QED
--
-- It follows easily from the preceding result the union-set of any unsigned
-- integer $m$ is an unsigned integer (in fact, it is always the predecessor of $m$):
--
Theorem 321: [The union set of a set of integers is the least upper bound of its elements] (M in Za) imp
	(((Un(M) in Za) & (Un(M) incin M)) & ((M /= 0) imp (Un(M) in M))). Proof+:
--
-- Assume that $m$ is a counterexample to our statement, and recall
-- that the unsigned integers are simply the finite cardinals.
-- It follows that $m$ is a finite ordinal included in $Za$, and then
-- (by excluding the trivial case $m = 0$) we get
-- a contradiction with prior lemmas.
--
    Suppose_not(m) ==> Stat1: (m in Za) & (not((Un(m) incin m) & (Un(m) in Za) & ((m /= 0) imp  (Un(m) in m))))
	T206(*) ==> Ord(Za)
	(Za,m)-->T13(*) ==> Stat2: m incin Za
	m-->T320(*) ==> Stat3: (Un(m) in Za) & ((m /= 0) imp (Un(m) in m))
	(Stat3,Stat1*)ELEM ==> Stat4: not(Un(m) incin m)
	Suppose ==> m = 0
	T109 ==> Stat5: Un(0) = 0
	EQUAL ==> Stat6: Un(m) = 0
	(Stat4,Stat6*)Discharge ==> Stat7: m /= 0
	(Stat7,Stat3,Stat2*)ELEM ==> (Un(m) in m) & (Un(m) in Za)
	(m,Un(m))-->T13(*) ==> Stat8: Un(m) incin m
    (Stat8,Stat4)Discharge ==> QED
--
-- Next we prove that for any non-zero unsigned
-- integer $m$, $Un(m)$ is the immediate predecessor of $m$:
--
Theorem 322: [Every nonzero integer has a predecessor] ((M in Za) & (M /= 0)) imp (M = (Un(M) PLUS 1)). Proof+:
    Suppose_not(m) ==> Stat1: (m in Za) & (m /= 0) & (m /= (Un(m) PLUS 1))
--
-- For let $m$ be a counterexample to our assertion. $Un(m)$ is an integer less than $m$
-- by Theorem 321, and $Un(m) PLUS 1$ is the sucessor $next(Un(m))$ of $Un(m)$.
-- Thus $Un(m) + {Un(m)}$ must be a subset of $m$, so if our theorem is false it cannot be a
-- superset of $m$.
--
	m-->T321(*) ==> Un(m) in m
	(m,Un(m))-->T13(*) ==> Un(m) incin m
	(Un(m))-->T317(*) ==> (Un(m) PLUS 1) = next(Un(m))
	Use_def(next(Un(m))) ==> AUTO
	ELEM ==> Stat5: not(m incin (Un(m) + {Un(m)}))
--
-- But in this case there must exist and integer $c$ less than $m$ but not in  $Un(m) + {Un(m)}$.
-- Theorem 274 tells us that such a c must be a subset of $Un(m)$,and hence either a member of  $Un(m)$.
-- However both these cases are clearly impossible, so our theorem is proved.
--
	c-->Stat5 ==> Stat6: (c in m) & (c notin (Un(m) + {Un(m)}))
	m-->T274 ==> Stat7: (FORALL x in m | x incin Un(m))
	c-->Stat7(Stat6) ==> c incin Un(m)
    (Un(m),c)-->T34 ==> Stat8: (c in Un(m)) or (c = Un(m))
    (Stat8,Stat6)Discharge ==> QED
--
-- Our next theorem states that the sum of any two integers $n$ and $c$ is the set-theoretic union of
-- $n$ with the set of sums of $n$ with the members of $c$.
--
Theorem 323: [The sum of integers as the union of smaller sums] ((X in Za) & (Y in Za)) imp ((X PLUS Y) = X + {(X PLUS u): u in Y}). Proof+:
    Suppose_not(n,c) ==> (n in Za) & (c in Za) & Stat1: ((n PLUS c) /= (n + {(n PLUS u): u in c}))
--
-- For let $n$, $c$ be a counterexample to our theorem. It is easily seen that $c$ cannot be $0$.
-- There must be an element $d$ which is in one but not both of the sets
-- appearing in the inequality seen above.
--
        d-->Stat1 ==> Stat1a: not((d in n PLUS c) eq (d in n + {(n PLUS u): u in c}))
        Suppose ==> c = 0
            Suppose ==> Stat2: {(n PLUS u): u in 0} /= 0
            a-->Stat2 ==> false; Discharge ==> {(n PLUS u): u in 0} = 0
            EQUAL ==> (n PLUS 0) /= (n + 0)
        n-->T254(*) ==> false; Discharge ==> c /= 0
--
        T206 ==> Ord(Za)
        (Za,c)-->T13 ==> c incin Za
        ALGEBRA ==> n PLUS c in Za
        (Za,n PLUS c)-->T13 ==> (n PLUS c) incin Za
--
-- All of our quantities are integers, and clearly $n PLUS c$ is greater than $n$.
-- First suppose that $d$ is in the second of these sets but not in the first,
-- so that $d notin n PLUS c$.
-- Then either $d in n$, or there exists an $e$ in $c$ such that $d = n PLUS e$.
-- The first of these cases is impossible, since it would imply $d in n PLUS c$.
-- But in the second case it is clear that  $d = n PLUS e$ is less than, hence a member of,
-- $n PLUS c$, a contradiction ruling out this case. Hence we can be sure that
-- $d$ is in the first of our sets but not in the second.
--
        (n,c)-->T284 ==> n in (n PLUS c)
        (n PLUS c,n)-->T34 ==> n incin (n PLUS c)
        Suppose ==> Stat3: d in {(n PLUS u): u in c}
            e-->Stat3 ==> (e in c) & (e in Za) & (d = n PLUS e)
        (n,c,e)-->T286 ==> false; Discharge ==> Stat4: (d notin {(n PLUS u): u in c}) & (d in n PLUS c) & (d in Za) & (n in Za)
--
-- Since we can now be sure that $d notin n$, we have $d = (d MINUS n) PLUS n$.
-- $d MINUS n$ is less than $c$ since $d$ is less than $n PLUS c$. Hence
--
        d-->T207 ==> d = #d
        (n,d)-->T35(Stat1a) ==> d incs n
        (n,d)-->T272 ==> d = (d MINUS n) PLUS n
        (d,n)-->T283 ==> (d MINUS n) in Za
--
-- If we suppose that $(d MINUS n) notin c$, then...
--
        Suppose ==> (d MINUS n) notin c
            (c,d MINUS n)-->T35 ==> (d MINUS n) incs c
            (c,d MINUS n,n)-->T290 ==> ((d MINUS n) PLUS n) incs (c PLUS n)
            EQUAL ==> d incs (c PLUS n)
--
-- ... ALGEBRA gives us $d incs (n PLUS c)$, leading to a contradiction
-- in this case, because we already know that $d in (n PLUS c)$.
--
        ALGEBRA ==> false; Discharge ==>  (d MINUS n) in c
--
-- However, $(d MINUS n) in c$  cannot hold either.
-- From this contradiction we get the desired conclusion.
--
        (d MINUS n)-->Stat4 ==> n PLUS (d MINUS n) /= d
    ALGEBRA ==> false; Discharge ==> QED
--
-- Our next result expresses the sum of any two integers $x$, $y$ as the union of x with
-- the set of all the members of $y$ with x. This is very similar to the preceding result,
-- but reverses the sum which appears inside the setformer in the conclusion of the theorem.
--
Theorem 324: [The sum of integers as the union of smaller sums, 2] ((X in Za) & (Y in Za)) imp ((X PLUS Y) = X + {(u PLUS X): u in Y}). Proof:
  	Suppose_not(x,y) ==> (x in Za) & (y in Za) & ((x PLUS y) /= (x + {(u PLUS x): u in y}))
--
-- Suppose that $x$, $y$ constitute a counterexample to our theorem,
-- and apply the preceding Theorem to $x$, $y$. Since it is easily seen that
-- ${(x PLUS u): u in y} = {(u PLUS x): u in y}$, our assertion follows immediately.
--
    (x,y)-->T323 ==> (x PLUS y) = x + {(x PLUS u): u in y}
    Suppose ==> Stat1: {(x PLUS u): u in y} /= {(u PLUS x): u in y}
    c-->Stat1 ==> (c in y) & ((x PLUS c) /= (c PLUS x))
    T206 ==> Ord(Za)
    (Za,y)-->T13 ==> c in Za
    ALGEBRA ==> false; Discharge ==> {(x PLUS u): u in y} = {(u PLUS x): u in y}
  	EQUAL ==> false; Discharge ==> QED
--
-- Next we prove a property of the integer subtraction operator very close
-- to that given by Theorem 272, namely $n = m PLUS (n MINUS m)$ if $m$ is no larger than $n$.
--
Theorem 325: [Subtraction reverses addition] ((X in Za) & (Y in Za) & (Y incin X)) imp (X = Y PLUS (X MINUS Y)). Proof+:
    Suppose_not(n,m) ==>  AUTO
--
-- For all our quantities are integers, so the conclusion of Theorem 272
-- is equivalent to that of the present theorem.
--
	T206 ==> Ord(Za)
	(Za,n)-->T13 ==> n incin Za
	n-->T207 ==> n = #n
	(m,n)-->T272 ==> #n = (n MINUS m) PLUS m
    ALGEBRA ==> false; Discharge ==> QED
--
Theorem 326: [Subtraction monotonicity lemma, 2] ((X in Za) & (Y in Za) & (U in (X PLUS Y)) & (Y /= 0)) imp ((U MINUS X) in Y). Proof+:
Suppose_not(x,y,u) ==> AUTO
	(x,y)-->T283 ==> (x PLUS y) in Za
	(x PLUS y)-->T206 ==> Ord(Za) & Finite(x PLUS y)
	ELEM ==> Ord(x) & Ord(x PLUS y)
	(x PLUS y,u)-->T12 ==> Ord(u)
	(u,x PLUS y)-->T35 ==> Stat1: (x PLUS y) incs u
	(x PLUS y,u,x)-->T310(Stat1*) ==> Stat2: ((x PLUS y) MINUS x) incs (u MINUS x)
	(x,y)-->T252(Stat2*) ==> (x PLUS y) = (y PLUS x)
	(y,x)-->T304 ==> ((y PLUS x) MINUS x) = y
	EQUAL(Stat2) ==> y incs (u MINUS x)
--
	(u,x PLUS y)-->T197 ==> Finite(u)
	u-->T205 ==> Card(u) & (u in Za)
	(u,x)-->T283 ==> (u MINUS x) in Za
	ELEM ==> ((u MINUS x) notin y) & (y in Za) & (x in Za)
	(y,u MINUS x)-->T35(Stat2*) ==> y = (u MINUS x)
	EQUAL ==> u in (x PLUS (u MINUS x))
	(u,x)-->T325 ==> x nincin u
	(x,u)-->T35 ==> u in x
	(x,u)-->T270 ==> 0 notin y
	T188 ==> Ord(0)
(y,0)-->T35 ==> false; Discharge ==> QED
--
-- The following in-recursive formula gives an alternative characterization of signed integer subtraction:
--
Theorem 327: [The integer difference as  a set of smaller differences] ((N in Za) & (M in Za)) imp ((N MINUS M) = {k MINUS M: k in N | M incin k}). Proof+:
    Suppose_not(n,m) ==> (n in Za) & (m in Za) & Stat1: ((n MINUS m) /= {k MINUS m: k in n | m incin k})
--
-- For let $n$, $m$ be a counterexample to our theorem. Since
-- $n, m, n MINUS m$ are unsigned integers, hence ordinals,
-- there must exist an $a$ belonging to just one of $n MINUS m$
-- and ${k MINUS m: k in n | (m in k) or (m = k)}$.
--
	ALGEBRA ==> (n MINUS m) in Za
	T206 ==> Ord(Za)
	ELEM ==> Ord(n MINUS m) & Ord(n) & Ord(m)
	a-->Stat1 ==> (a in (n MINUS m)) eq (a notin {k MINUS m: k in n | m incin k})
	Suppose ==> Stat2: (a in {k MINUS m: k in n | m incin k})
--
-- If $a$ belongs to ${k MINUS m: k in n | (m in k) or (m = k)}$, then $a$
-- equals $k MINUS m$ for some $k in n$ such that $m$ does not exceed $k$.
-- By monotonicity of integer subtraction $k MINUS m$ is no greater than,
-- and hence equal to, $n MINUS m$. Thus $m in n$ and $k = n$, contradicting $k in n$.
--
		k-->Stat2 ==> ((k MINUS m) notin (n MINUS m)) & (k in n) & (m incin k)
		(Za,n)-->T13 ==> k in Za
		(n,k)-->T13 ==> n incs k
		(n,k,m)-->T310 ==> (n MINUS m) incs (k MINUS m)
		ALGEBRA ==> Ord(k MINUS m)
		(n MINUS m,k MINUS m)-->T34 ==> k MINUS m = n MINUS m
		(k,m)-->T325 ==> k = m PLUS (k MINUS m)
		(n,m)-->T325 ==> n = m PLUS (n MINUS m)
	EQUAL ==> false; Discharge ==> Stat3: (a notin {k MINUS m: k in n | m incin k})
--
-- But in this case we have $a in (n MINUS m)$, so by strict monotonicity of addition
-- $(a PLUS m) in ((n MINUS m) PLUS m)$, i.e. $(a PLUS m) in n$, and therefore taking
-- $k = (a PLUS m)$ in Stat3 we have a contradiction which proves our theorem.
--
 	ELEM ==> (a in (n MINUS m))
 	(n,m)-->T283 ==> (n MINUS m) in Za
 	(Za,n MINUS m)-->T13 ==> a in Za
 	Use_def(MINUS) ==> #(n - m) /= 0
 	(n - m)-->T162 ==> n - m /= 0
 	ELEM ==> not(m incs n)
 	(n,m)-->T29 ==> n incs m
 	(m,n)-->T272 ==> #n = (n MINUS m) PLUS m
 	n-->T207 ==> n = (n MINUS m) PLUS m
 	(n MINUS m,a,m)-->T297 ==> (a PLUS m) in ((n MINUS m) PLUS m)
 	ELEM ==> (a PLUS m) in n
 	(a,m)-->T304 ==> a = (a PLUS m) MINUS m
 	ELEM ==> 0 incin a
	(m,a)-->T292 ==> m incin (a PLUS m)
 	(a PLUS m)-->Stat3 ==> false; Discharge ==> QED
--
-- It is sometimes useful to restate the preceding theorem in the following modified form:
--
Theorem 328: [The integer difference as a set of smaller differences] ((N in Za) & (M in Za)) imp ((N MINUS M) = {k in Za | (k PLUS M) in N}). Proof:
Suppose_not(n,m) ==> AUTO
	T206 ==> Ord(Za)
	(Za,n)-->T13 ==> n incin Za
	(n,m)-->T327 ==> Stat1: {k MINUS m: k in n | m incin k} /= {k in Za | (k PLUS m) in n}
	c-->Stat1 ==> not((c in {k MINUS m: k in n | m incin k}) eq (c in {k in Za | (k PLUS m) in n}))
	Suppose ==> Stat2: (c in {k MINUS m: k in n | m incin k}) & Stat3: (c notin {k in Za | (k PLUS m) in n})
		k1-->Stat2 ==> (c = k1 MINUS m) & (k1 in n) & (m incin k1)
		k1-->T206 ==> (k1 in Za) & Card(k1)
		k1-->T164 ==> k1 = #k1
		ALGEBRA ==> (k1 MINUS m) in Za
		()-->Stat3 ==> not ((c in Za) & ((c PLUS m) in n))
		EQUAL ==> not (((k1 MINUS m) in Za) & (((k1 MINUS m) PLUS m) in n))
		ELEM ==> ((k1 MINUS m) PLUS m) notin n
	(m,k1)-->T272 ==> false; Discharge ==> Stat4: (c in {k in Za | (k PLUS m) in n}) & Stat5: (c notin {k MINUS m: k in n | m incin k})
	()-->Stat4(Stat4*) ==> (c in Za) & ((c PLUS m) in n)
	(c PLUS m)-->Stat5(Stat4*) ==> (c /= ((c PLUS m) MINUS m)) or (m nincin (c PLUS m))
	(m,c)-->T292 ==> c /= ((c PLUS m) MINUS m)
(c,m)-->T304 ==> false; Discharge ==> QED
--
-- Our next goal is to show that every subset of the set $Za$ of unsigned integers
-- which is closed with respect to predecessor formation either belongs to $Za$
-- or coincides with $Za$. As a preliminary lemma, we show that for any
-- set $x$ closed with respect to predecessor formation, if an element $j$ of $Za$
-- does not belong to $x$, then no integer $h$ greater than $j$ belongs to $x$.
--
Theorem 329: ((J in Za - X) & (FORALL i | (next(i) in X) imp (i in X))) imp
		({h in Za | (h notin J) & (h in X)} = 0). Proof+:
    Suppose_not(j,x) ==> (j in Za - x) & ({h in Za | (h notin j) & (h in x)} /= 0) &
		Stat1: (FORALL i | (next(i) in x) imp (i in x))
--
-- For, suppose that $x,j$ contradict the statement just made and let
-- $h$ be the first integer which is not smaller than $j$ and belongs to $Za$.
--
        Loc_def ==> h = arb({h in Za | (h notin j) & (h in x)})
        ELEM ==> (j in Za) &
		(h * {h in Za | (h notin j) & (h in x)} = 0) &
		Stat2: (h in {h in Za | (h notin j) & (h in x)})
        ()-->Stat2 ==> (h in Za) & (h notin j) & (h in x)
        T206 ==> Ord(Za)
--
-- By T31, either $j,h$ coincide or one of $j,h$ belongs to the other. We must
-- exclude the case $j=h$, because $h$ belongs to $j$ and $j$ does not; moreover
-- we know that $h notin j$. Hence $j in h$ and $h$ has the form $next(k)$ for
-- some unsigned integer $k$.
--
        (j,h)-->T31 ==> j in h
        T211 ==> Ord(0) & Card(1)
        ALGEBRA ==> (h MINUS 1) in Za
        Use_def(Card) ==> Ord(1)
        Suppose ==> h /= next(h MINUS 1)
            (h,0)-->T31 ==> 0 in h
            Use_def(1) ==> 1 = next(0)
	    Use_def(next) ==> 1 incin h
            (1,h)-->T272 ==> #h = ((h MINUS 1) PLUS 1)
            h-->T207 ==> h = ((h MINUS 1) PLUS 1)
        (h MINUS 1)-->T317 ==> false; Discharge ==> AUTO
--
-- It turns out that the immediate predecessor of $h$ belongs to $h$ as well as
-- to the set ${h in Za | (h notin j) & (h in x)}$. However, this contradicts
-- the minimality criterion by which $h$ was selected by means of the $arb$ operator.
-- Indeed, we derive $next(h MINUS 1) incin j$, which is incompatible with
-- the earlier proved facts $j in h$, $h = next(h MINUS 1)$.
--
        (h MINUS 1)-->Stat1 ==> (h MINUS 1) in x
        Use_def(next) ==> Stat3: (h MINUS 1) notin {h in Za | (h notin j) & (h in x)}
        ()-->Stat3 ==> (h MINUS 1) in j
        (j,h MINUS 1)-->T13 ==> ((h MINUS 1) * {h MINUS 1}) incin j
--
-- This contradiction leads to the desired conclusion.
--
    Use_def(next) ==> false; Discharge ==> QED
--
-- Now we can easily draw the corollary we were aiming at.
--
Theorem 330: ((X incin Za) & (FORALL i | (next(i) in X) imp (i in X))) eq (X in next(Za)). Proof:
    Suppose_not(x) ==> ((x incin Za) & (FORALL i | (next(i) in x) imp (i in x))) eq (x notin next(Za))
--
-- Implication in one direction is trivial; for the converse...
--
        T206 ==> Ord(Za)
        Suppose ==> (not((x incin Za) & (FORALL i | (next(i) in x) imp (i in x)))) & (x in next(Za))
            Use_def(next) ==> (x in Za) or (x = Za)
            (Za,x)-->T13 ==> x incin Za
            ELEM ==> Stat1: not(FORALL i | (next(i) in x) imp (i in x))
            Suppose ==> not(Ord(x))
                Suppose ==> x = Za
                EQUAL ==> false; Discharge ==> x in Za
            (Za, x)-->T12 ==> false; Discharge ==> Ord(x)
            i-->Stat1 ==> (next(i) in x) & (i notin x)
            (x, next(i))-->T13 ==> next(i) incin x
        Use_def(next) ==> false; Discharge ==> (x incin Za)  & (x notin next(Za)) & (FORALL i | (next(i) in x) imp (i in x))
--
-- ... reasoning by contradiction, suppose that $x$ is included in the set $Za$ of all unsigned
-- integers and does not belong to $next(Za)$, i.e., $x$ differs from $Za$ and does not
-- belong to $Za$. Consider a minimally chosen element $j$ of $(Za-j)$. Clearly,
-- $j$ must differ from $x$. However, the preceding lemma makes it impossible
-- to find an element of $x$ which does not belong to $j$. On the other hand, insofar
-- an an element of the ordinal $Za$, $j$ must be a subset of $Za$; hence, any element
-- $h$ of $j$ not belonging to $x$ must be an element of $Za$ too, violating the supposed
-- minimality of $j$. Thus we are led to the contradiction $j/=x$, $j=x$, which proves
-- our statement.
--
        Loc_def ==> j = arb(Za - x)
        Use_def(next) ==> (j in (Za - x)) & (j * ((Za - x)) = 0) & Stat2: (x /= j)
        h-->Stat2 ==> (h in x) eq (h notin j)
        Suppose ==> (h notin j) & (h in x)
            Suppose ==> Stat3: h notin {h in Za | (h notin j) & (h in x)}
            ()-->Stat3 ==> false; Discharge ==> h in {h in Za | (h notin j) & (h in x)}
        (j,x)-->T329 ==> false; Discharge ==> (h in j) & (h notin x)
    (Za,j)-->T13 ==> false; Discharge ==> QED
--
--
--
Theorem 331: (({X,Y} incin next(Za)) & (#X in next(Y))) imp (((X = Y) & (Y = Za)) or (X in (next(Y) * Za))). Proof+:
Suppose_not(x,y) ==> AUTO
        T209(*) ==> Card(Za)
        Use_def(Card)(*) ==> Ord(Za) --? Why does this not follow from the preceding step by proof-by-structure?
--
-- Therefore $x$, which belongs to the ordinal $next(Za)$, is an ordinal.
--
        (next(Za), x)-->T12(*) ==> Ord(x)
        x-->T330(*) ==> x incin Za
        (Za, x)-->T27(*) ==> (x = Za) or (x = arb(Za - x))
        Suppose ==> (not Card(x))
            Suppose ==> x = Za
            EQUAL ==> false; Discharge ==> x in Za
        x-->T206(*) ==> false; Discharge ==> AUTO
	x-->T164(*) ==> x = #x
        EQUAL ==> x in next(y)
--
-- Observe that $x notin Za$ since $x in next(y)$ and $x notin (next(y) * Za)$;
-- therefore $x = Za$ (since $x in next(Za)$) and $y /= Za$ (since $(x /= y) or (y /= Za)$);
-- and hence $y in Za$ (since $y in next(Za)$). But this conflicts with the fact that
-- $x in next(y)$ (indeed, $Za notin next(U)$ for any unsigned integer $U$).
--
	Use_def(next) ==> false; Discharge ==> QED
--
-- We now show that every finite set of unsigned integers has an upper bound.
--
THEORY unsigned_integer_bynd(Q1(x))
    Finite({x in Za | Q1(x)})
END unsigned_integer_bynd
--
ENTER_THEORY unsigned_integer_bynd
--
Def 00q: [Upper bound of integer set] bynd_thryvar := next(Un({x in Za | Q1(x)}))
--
Theorem unsigned_integer_bynd.0: [Every finite set of unsigned integers has an upper bound]
		(bynd_thryvar in Za) & (FORALL i in Za | (Q1(i) imp (i in bynd_thryvar))). Proof+:
    Suppose_not ==> (bynd_thryvar notin Za) or (not (FORALL i in Za | (Q1(i) imp (i in bynd_thryvar))))
--
-- For it is clear that ${x in Za | Q1(x)}$ is a finite set of integers, and so by Theorem 317
-- and Theorem 320 $next(Un({x in Za | Q1(x)}))$ is an integer.
--
    Suppose ==> Stat1: not ({x in Za | Q1(x)} incin Za)
    	k-->Stat1 ==> (k notin Za) & Stat2: (k in {x in Za | Q1(x)})
    	()-->Stat2 ==> false
    Discharge ==> {x in Za | Q1(x)} incin Za
    Assump ==> Finite({x in Za | Q1(x)})
    ({x in Za | Q1(x)})-->T320 ==> Un({x in Za | Q1(x)}) in Za
	(Un({x in Za | Q1(x)}))-->T317 ==> next(Un({x in Za | Q1(x)})) in Za
	Use_def(bynd_thryvar) ==> Stat3: not (FORALL i in Za | (Q1(i) imp (i in bynd_thryvar)))
	i-->Stat3 ==> (i in Za) & Q1(i) & (i notin bynd_thryvar)
--
-- But by definition Un({x in Za | Q1(x)}) includes the element i of {x in Za | Q1(x)}, and so
-- i in next(Un({x in Za | Q1(x)})) by Theorem 206, a contradiction which proves our assertion.
--
	T206 ==> Ord(Za)
	(Za,Un({x in Za | Q1(x)}))-->T12 ==> Ord(Un({x in Za | Q1(x)}))
	Suppose ==> Stat4: (i notin next(Un({x in Za | Q1(x)})))
		(Un({x in Za | Q1(x)}),i)-->T36 ==> Stat5: not(i incin Un({x in Za | Q1(x)}))
		j-->Stat5 ==> (j in i) & (j notin Un({x in Za | Q1(x)}))
		Use_def(Un) ==> Stat6: j notin {u: v in {x in Za | Q1(x)},u in v}
		(i,j)-->Stat6 ==> not((j = j) & (i in {x in Za | Q1(x)}) & (j in i))
		ELEM ==> Stat7: i notin {x in Za | Q1(x)}
		i-->Stat7 ==> false
	Discharge ==> i in next(Un({x in Za | Q1(x)}))
    Use_def(bynd_thryvar) ==> false; Discharge ==> QED
--
-- The following subsidiary lemma captures a few useful auxiliary properties of the upper bound $bynd_thryvar$.
--
Theorem unsigned_integer_bynd.1: [Every finite set of unsigned integers has an upper bound] (bynd_thryvar in Za) &
	 (Za incs bynd_thryvar) & Ord(bynd_thryvar) & (FORALL i in Za | (Q1(i) imp (i in bynd_thryvar))) & (not Finite(Za - bynd_thryvar)). Proof:
Suppose_not ==> not((bynd_thryvar in Za) &
	 (Za incs bynd_thryvar) & Ord(bynd_thryvar) & (FORALL i in Za | (Q1(i) imp (i in bynd_thryvar))) & (not Finite(Za - bynd_thryvar)))
    Tunsigned_integer_bynd.0 ==> (bynd_thryvar in Za) & (not((Za incs bynd_thryvar) & Ord(bynd_thryvar) & (not Finite(Za - bynd_thryvar))))
    bynd_thryvar-->T206 ==> Ord(Za)
    (Za,bynd_thryvar)-->T13 ==> (bynd_thryvar incin Za)
    (Za,bynd_thryvar)-->T12 ==> Finite(Za - bynd_thryvar)
bynd_thryvar-->T237(*) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY unsigned_integer_bynd
--
--THEORY unsigned_integer_bynd(Q1(x))
--	Finite({x in Za | Q1(x)})
--==>(bynd_thryvar)
--	(bynd_thryvar in Za) &
--		(Za incs bynd_thryvar) & Ord(bynd_thryvar) & (FORALL i in Za | (Q1(i) imp (i in bynd_thryvar))) & (not Finite(Za - bynd_thryvar))
--END unsigned_integer_bynd
--
THEORY cauchyseq_lemma(n0,R(i,j))
    n0 in Za
    (not Finite({i * j : i in Za, j in Za | R(i,j)}))
END cauchyseq_lemma
--
ENTER_THEORY cauchyseq_lemma
--
Theorem cauchyseq_lemma.1: (not Finite({i * j : i in (Za - n0), j in (Za - n0) | R(i,j)})). Proof+:
    Suppose_not ==> AUTO
	Assump ==> Stat0: (n0 in Za) & (not Finite({i * j : i in Za, j in Za | R(i,j)}))
	ELEM ==> Finite(n0)
--
-- For since $n0$ is finite, ${i * j : i in Za, j in Za | R(i,j)} - n0$ must be infinite by assumption.
--
	Suppose ==> Finite({i * j : i in Za, j in Za | R(i,j)} - n0)
            ({i * j : i in Za, j in Za | R(i,j)} - n0,n0)-->T236 ==> Finite(({i * j : i in Za, j in Za | R(i,j)} - n0) + n0)
        	ELEM ==> ({i * j : i in Za, j in Za | R(i,j)} - n0) + n0 incs {i * j : i in Za, j in Za | R(i,j)}
        	(({i * j : i in Za, j in Za | R(i,j)} - n0) + n0,{i * j : i in Za, j in Za | R(i,j)})-->T189 ==> false
    Discharge ==> not(Finite({i * j : i in Za, j in Za | R(i,j)} - n0))
--
-- But it is easily seen that ${i * j : i in Za, j in Za | R(i,j)} - n0$ is a subset of ${i * j : i in (Za - n0), j in (Za - n0) | R(i,j)}$,
-- and so this latter set must also be must be infinite, proving the present Lemma.
--
    Suppose ==> Stat1: not(({i * j : i in Za, j in Za | R(i,j)} - n0) incin {i * j : i in Za - n0, j in Za - n0 | R(i,j)})
        k-->Stat1(Stat1*) ==> Stat2: (k in {i * j : i in Za, j in Za | R(i,j)}) & (k notin n0) & Stat3: (k notin {i * j : i in Za - n0, j in Za - n0 | R(i,j)})
        (i0,j0)-->Stat2 ==> Stat4: (i0 in Za) & (j0 in Za) & R(i0,j0) & (k = i0 * j0)
        (i0,j0)-->Stat3 ==> not((i0 in Za - n0) & (j0 in Za - n0) & R(i0,j0) & (k = i0 * j0))
        (Stat4)ELEM ==> (i0 in n0) or (j0 in n0)
	(i0,j0)-->T28(Stat0,Stat4) ==> Ord(i0 * j0) & Ord(n0)
		EQUAL ==> Ord(k)
        (n0,k)-->T35 ==> n0 incin k
--
-- Since ELEM(Stat4*) yields $(i0 in i0 * j0) or (j0 in i0 * j0)$,
-- we get a contradiction enabling us to discharge our temporary assumptions.
--
	(Stat4*)Discharge ==> ({i * j : i in Za, j in Za | R(i,j)} - n0) incin {i * j : i in Za - n0, j in Za - n0 | R(i,j)}
	({i * j : i in Za - n0, j in Za - n0 | R(i,j)},{i * j : i in Za, j in Za | R(i,j)} - n0)-->T189 ==> false
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY cauchyseq_lemma
--
--THEORY cauchyseq_lemma(n0,R(i,j))
--    n0 in Za
--    (not Finite({i * j | i in Za, j in Za | R(i,j)}))
--==>
--    (not Finite({i * j | i in (Za - n0), j in (Za - n0) | R(i,j)}))
--END cauchyseq_lemma
--
-- By Theorem 29, the set of integers, like any other ordinal, is closed under union and intersection.
--
--
Theorem 332: [Ordinal member maximum and minimum] (Ord(U) & (S in U) & (T in U)) imp
		((S + T in U) & (S * T in U)). Proof+:
Suppose_not(u,s,t) ==> AUTO
--
-- If a counterexample $u,s,t$ existed, then $s,t$ would both be ordinals, and hence one would include the
-- other. Therefore ${s + t, s * t} = {s,t}$, conflicting with $u incs {s,t} & u nincs {s + t, s * t}$.
--
(s,t)-->T29 ==> false; Discharge ==> QED
--
Theorem 333: [Integer member maximum and minimum] ((S in Za) & (T in Za)) imp ((S + T in Za) & (S * T in Za)). Proof+:
Suppose_not(s,t) ==> AUTO
    T206 ==> Ord(Za)
    (Za,s,t)-->T332 ==> false; Discharge ==> QED
--
-- We are now in position to prove the following small theory, which gives us a kind of converse of cauchyseq_lemma.1.
--
THEORY cauchyseq_lemma2(R(i,j))
    Finite({i * j : i in Za, j in Za | R(i,j)})
END cauchyseq_lemma2
--
ENTER_THEORY cauchyseq_lemma2
--
--
Theorem cauchyseq_lemma2.1: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i incs k) & (j incs k)) imp (not (R(i,j))))). Proof:
    Suppose_not ==> Stat1: AUTO
--
-- Indeed, it is easily seen that ${x in Za | x in {i * j : i in Za, j in Za | R(i,j)}} = {i * j: i in Za, j in Za | R(i,j)}$
--
    Suppose ==> Stat2: {x in Za | x in {i * j : i in Za, j in Za | R(i,j)}} /= {i * j: i in Za, j in Za | R(i,j)}
    y-->Stat2 ==> ((y in {x in Za | x in {i * j : i in Za, j in Za | R(i,j)}}) & (y notin {i * j: i in Za, j in Za | R(i,j)})) or ((y notin {x in Za | x in {i * j: i in Za, j in Za | R(i,j)}}) & (y in {i * j: i in Za, j in Za | R(i,j)}))
    Suppose ==> Stat3: (y in {x in Za | x in {i * j: i in Za, j in Za | R(i,j)}}) & (y notin {i * j: i in Za, j in Za | R(i,j)})
	()-->Stat3 ==> false; Discharge ==> Stat4: (y notin {x in Za | x in {i * j : i in Za, j in Za | R(i,j)}}) & Stat5: (y in {i * j: i in Za, j in Za | R(i,j)})
	y-->Stat4 ==> not(y in Za)
	(i0,j0)-->Stat5 ==> (i0 in Za) & (j0 in Za) & (y = i0 * j0)
	(i0,j0)-->T333 ==> false
	Discharge ==> {x in Za | x in {i * j : i in Za, j in Za | R(i,j)}} = {i * j: i in Za, j in Za | R(i,j)}
    Assump ==> Finite({i * j : i in Za, j in Za | R(i,j)})
--
-- and so ${x in Za | x in {i * j : i in Za, j in Za | R(i,j)}}$ is finite by assumption. Thus we can apply
-- unsigned_integer_bynd to find an integer k such that R(i,j) is false i,j is any pair of integers both larger than k
--
    EQUAL ==> Finite({x in Za | x in {i * j : i in Za, j in Za | R(i,j)}})
	APPLY(bynd_thryvar:k) unsigned_integer_bynd(Q1(x)->(x in {i * j : i in Za, j in Za | R(i,j)})) ==>
	(k in Za) & Stat6: (FORALL n in Za | ((n in {i * j: i in Za, j in Za | R(i,j)}) imp (n in k)))
    k-->Stat1 ==> Stat7: not (FORALL i in Za, j in Za | ((i incs k) & (j incs k)) imp (not (R(i,j))))
    (i,j)-->Stat7 ==> Stat8: (i in Za) & (j in Za) & (not((i incs k) & (j incs k)) imp (not (R(i,j))))
    (Stat8)ELEM ==> Stat9: (i in Za) & (j in Za) & (i incs k) & (j incs k) & R(i,j)
--
--
--
    (i,j)-->T333 ==> Stat10: i * j in Za
    (i * j)-->Stat6 ==> (i * j in {i * j : i in Za, j in Za | R(i,j)}) imp (i * j in k)
    Suppose ==> Stat11: i * j notin {i * j : i in Za, j in Za | R(i,j)}
    (i,j)-->Stat11 ==> false; Discharge ==> Stat12: i * j in k
    (Stat9,Stat12)ELEM ==> false; Discharge ==> QED
--
--
ENTER_THEORY Set_theory
--
-- Next we give an elementary lemma which characterizes a case in which a subset of an intger must be the entire integer.
--
Theorem 334: ((N in Za) & (S incin N) & (#S = N)) imp (S = N). Proof+:
Suppose_not(n,s) ==> AUTO
	n-->T164 ==> n = #n
	(n,s)-->T194 ==> false; Discharge ==> QED
--
-- ************************************************************************************************
-- 			Section 7a: Some elementary results concerning finite sequences
-- ************************************************************************************************
--
-- In this section we develop various elementary properties of finite sequences (of arbitrary elements),
-- constructs useful in a variety of analytic and combinatorial situations. and their conjuctions.
--
Def 24a: [Finite sequences] Fin_seqs(S) := {f incin (Za PROD S) | Svm(f) & (domain(f) in Za)}
Def 24b: [Sequence concatenation] concat(F,G) := {[n,if n in domain(F) then F~[n] else G~[n MINUS domain(F)] end if]: n in domain(F) PLUS domain(G)}
Def 24c: [Subsequences] Subseqs(F) := {F @ h: h incin (Za PROD Za) | Svm(h) & (FORALL i | (next(i) in domain(h)) imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)]))))}
Def 24d: [Shift operation for sequences] Shift(M) := {[i, M PLUS i]: i in Za}
Def 24e: [Shifted sequence] shifted_seq(F,M) := F @ Shift(M)
--
-- We begin the present collection of lemmas by noting the entirely elementary fact that every element
-- of a finite sequence of elements of a set $s$ is a pair whose first component is an integer
-- and whose second component belongs to $s$.
--
Theorem 335: [Finite sequences are single-valued maps with integer domains] (F in Fin_seqs(S)) eq (Svm(F) & (domain(F) in Za) & (range(F) incin S)). Proof:
	Suppose_not(f,s) ==> AUTO
	Suppose ==> (not(Svm(f) & (domain(f) in Za) & (range(f) incin s))) &  (f in Fin_seqs(s))
		Use_def(Fin_seqs) ==> Stat1: f in {f incin (Za PROD S) | Svm(f) & (domain(f) in Za)}
		()-->Stat1 ==> (f incin (Za PROD s)) & (not(range(f) incin s))
		(f,Za PROD s)-->T65 ==> not(range(Za PROD s) incin s)
		Use_def(range) ==> not({cdr(x): x in Za PROD s} incin s)
		Use_def(PROD) ==> not({cdr(x): x in {[n,v]: n in Za, v in s}} incin s)
		SIMPLF ==> Stat2: not({cdr([n,v]): n in Za, v in s} incin s)
		y-->Stat2 ==> (y notin s) & Stat3: (y in {cdr([n,v]): n in Za, v in s})
	(n,v)-->Stat3 ==> false;  Discharge ==> (Svm(f) & (domain(f) in Za) & (range(f) incin s)) & (not(f in Fin_seqs(s)))
	Use_def(Fin_seqs) ==> Stat4: f notin {g incin (Za PROD S) | Svm(g) & (domain(g) in Za)}
    g-->Stat4 ==> not(f incin (Za PROD S))
    Use_def(PROD) ==> Stat5: not(f incin ({[n,v]: n in Za, v in s}))
    c-->Stat5 ==> Stat6: (c in f) & Stat7: (c notin {[n,v]: n in Za, v in s})
    Use_def(Svm) ==> Is_map(f)
    Use_def(Is_map) ==> Stat8: c in {[car(x),cdr(x)]: x in f}
    x-->Stat8 ==> (x in f) & (c = [car(x),cdr(x)])
    (car(x),cdr(x))-->Stat7 ==> not((car(x) in Za) & (cdr(x) in s))
    Use_def(domain) ==>  domain(f) = {car(x): x in f}
    Use_def(range) ==> range(f) = {cdr(x): x in f}
    Suppose ==> Stat9: cdr(x) notin {cdr(x): x in f}
	x-->Stat9 ==> false; Discharge ==> cdr(x) in s
	T206 ==> Ord(Za)
	(Za,domain(f))-->T13 ==> domain(f) incin Za
	Suppose ==> Stat10: car(x) notin {car(x): x in f}
	x-->Stat10 ==> false; Discharge ==> car(x) in Za
    Discharge ==> QED
--
-- Next we note that the domain of a finite sequence $f$ is just $#f$.
-- The proof of this and various associated facts is direct and elementary.
--
Theorem 336: [Other properties of finite sequences] (F in Fin_seqs(S)) imp ((domain(F) = #domain(F)) & (domain(F) = #F) & (#F in Za) & Finite(F)). Proof+:
Suppose_not(f,s) ==> AUTO
	(f,s)-->T335 ==> Svm(f) & (domain(f) in Za)
--
-- Hence, $Card(domain(f))$ and $Finite(domain(f))$.
--
    (domain(f))-->T164 ==> domain(f) = #domain(f)
    f-->T174 ==> #domain(f) = #f
    EQUAL ==> Finite(#f)
    f-->T193 ==> false; Discharge ==> QED
--
-- The following simple reformulations of the condition for function equality
-- will be quite useful in some of the elementary proofs given later.
--
Theorem 337: [Two single-valued functions with common domain are equal if all their values are equal] (Svm(F) & Svm(G) & (domain(F) = S) & (domain(G) = S) & (FORALL n0 in S | F~[n0] = G~[n0])) imp (F = G). Proof:
	Suppose_not(f,g,s) ==> Svm(f) & Svm(g) & (domain(f) = s) & (domain(g) = s) & (f /= g) & Stat1: (FORALL n in s | f~[n] = g~[n])
	Suppose ==> s = 0
		f-->T24 ==> f = 0
	g-->T24 ==> false; Discharge ==> s /= 0
	f-->T72 ==> f = {[x,f~[x]]: x in domain(f)}
	g-->T72 ==> g = {[x,g~[x]]: x in domain(g)}
	EQUAL ==> f = {[x,f~[x]]: x in s}
	EQUAL ==> Stat2: {[x,f~[x]]: x in s} /= {[x,g~[x]]: x in s}
	x-->Stat2 ==> (x in s) & ([x,f~[x]] /= [x,g~[x]])
	ELEM ==> f~[x] /= g~[x]
	x-->Stat1 ==> false; Discharge ==> QED
--
--
--
Theorem 338: [Two functions from a collection of single-valued functions with common domain are equal if all their values are equal] ((S /= 0) & (FORALL h in Mapset | ((domain(h) = S) & Svm(h)))) imp ((FORALL n in S | ((F in Mapset) & (G in Mapset) & (F~[n] = G~[n]))) imp (F = G)). Proof:
	Suppose_not(s,mapset,f,g) ==> Stat1: (s /= 0) & Stat2: (FORALL h in mapset | ((domain(h) = s) & Svm(h))) & Stat3: (FORALL n in s | ((f in Mapset) & (g in Mapset) & (f~[n] = g~[n]))) & (f /= g)
	n-->Stat1 ==> n in s
	n-->Stat3 ==> (f in Mapset) & (g in Mapset)
	f-->Stat2 ==> (domain(f) = s) & Svm(f)
	g-->Stat2 ==> (domain(g) = s) & Svm(g)
	Suppose ==> Stat4: not (FORALL n in s | f~[n] = g~[n])
		k-->Stat4 ==> (k in s) & (f~[k] /= g~[k])
	k-->Stat3 ==> false; Discharge ==> (FORALL n in s | f~[n] = g~[n])
	(f,g,s)-->T337 ==> false; Discharge ==> QED
--
-- 'Shift' is obviously a single-valued function.
--
Theorem 339: [The shift-map of an integer is single-valued and maps Za into Za] ((M in Za) & (N in Za)) imp (Svm(Shift(M)) & (domain(Shift(M)) = Za) & (range(Shift(M)) incin Za) & (Shift(M)~[N] = M PLUS N)). Proof:
	Suppose_not(m,n) ==> AUTO
	APPLY() Must_be_svm(b(x)->m PLUS x,s->Za,u->n) ==> (n in Za) imp ({[i,m PLUS i]: i in Za}~[n] = (m PLUS n))
	Use_def(Shift) ==> Stat1: not({m PLUS i: i in Za} incin Za)
	j-->Stat1 ==> (j notin Za) & Stat2: (j in {m PLUS i: i in Za})
  	i-->Stat2 ==> (j = m PLUS i) & (i in Za)
	(m,i)-->T283 ==> false; Discharge ==> QED
--
-- Ths composition of two shift-maps yields a shift-map whose shift-number
-- is the sum of the shift-numbers of the operand maps.
--
Theorem 340: [Composition of shift-maps yields a shift-map] ((M in Za) & (N in Za)) imp (Shift(M) @ Shift(N) = Shift(M PLUS N)). Proof:
    Suppose_not(m,n) ==> AUTO
	(m,n)-->T283 ==> (m PLUS n in Za)
	(m PLUS n,n)-->T339 ==> Svm(Shift(m PLUS n)) & (domain(Shift(m PLUS n)) = Za)
 	(n,n)-->T339 ==> Svm(Shift(n)) & (domain(Shift(n)) = Za) & (range(Shift(n)) incin Za)
 	(m,n)-->T339 ==> Svm(Shift(m)) & (domain(Shift(m)) = Za)
 	(Shift(m),Shift(n))-->T128 ==> Svm(Shift(m) @ Shift(n))
	(Shift(m),Shift(n))-->T95 ==> domain(Shift(m) @ Shift(n)) = Za
    (Shift(m) @ Shift(n),Shift(m PLUS n),Za)-->T337 ==> AUTO
    ELEM ==> Stat1: not (FORALL k in Za | ((Shift(m) @ Shift(n))~[k]) = (Shift(m PLUS n)~[k]))
    k-->Stat1 ==> (k in Za) & ((Shift(m) @ Shift(n))~[k] /= (Shift(m PLUS n)~[k]))
	(n,k)-->T339 ==> (Shift(n)~[k]) = (n PLUS k)
	(n,k)-->T283 ==> (n PLUS k in Za)
	(m PLUS n,k)-->T339 ==> Shift(m PLUS n)~[k] = ((m PLUS n) PLUS k)
	(m,Shift(n)~[k])-->T339 ==> (Shift(m)~[Shift(n)~[k]]) = (m PLUS (Shift(n)~[k]))
	(Shift(m),Shift(n),k)-->T129 ==> ((Shift(m) @ Shift(n))~[k]) = (Shift(m)~[Shift(n)~[k]])
	EQUAL ==> m PLUS (Shift(n)~[k]) = m PLUS (n PLUS k)
	ELEM ==> (m PLUS n) PLUS k /= m PLUS (n PLUS k)
(m,n,k)-->T258 ==> false; Discharge ==> QED
--
--
Theorem 341: [Double shifting can be emulated by a single shift] ((M in Za) & (N in Za)) imp (shifted_seq(shifted_seq(F,M),N) = shifted_seq(F,M PLUS N)). Proof:
Suppose_not(m,n,f) ==> AUTO
	Use_def(shifted_seq) ==> ((f @ Shift(m)) @ Shift(n)) /= (f @ Shift(m PLUS n))
	(f,Shift(m),Shift(n))-->T66 ==>  (f @ (Shift(m) @ Shift(n))) /= (f @ Shift(m PLUS n))
	(m,n)-->T340 ==> (Shift(m) @ Shift(n)) = Shift(m PLUS n)
	EQUAL ==> false; Discharge ==> QED
--
Theorem 342: [Shift(0) is the identity map on Za] (Shift(0) = {[n,n]: n in Za}) & ((Is_map(F) & (domain(F) incin Za)) imp (F @ Shift(0) = F)). Proof:
	Suppose_not(f) ==> AUTO
	Suppose ==> Shift(0) /= {[n,n]: n in Za}
		Use_def(Shift) ==> Stat1: {[n,0 PLUS n]: n in Za} /= {[n,n]: n in Za}
		n-->Stat1 ==> (n in Za) & ([n,0 PLUS n] /= [n,n])
		ELEM ==> 0 PLUS n /= n
	n-->T254 ==> false; Discharge ==> (Shift(0) = {[n,n]: n in Za}) & (domain(f) incin Za) & (f @ Shift(0) /= f)
	Use_def(ident) ==> Shift(0) = ident(Za)
	f-->T67 ==> f = (f ON domain(f))
	(f,Za)-->T116 ==> f @ ident(Za) = (f ON Za)
	EQUAL ==> f @ Shift(0) = ((f ON domain(f)) ON Za)
	(f,domain(f),Za)-->T69 ==> f @ Shift(0) = (f ON (domain(f) * Za))
	ELEM ==> domain(f) * Za = domain(f)
	EQUAL ==> false; Discharge ==> QED
--
-- The following easy corollary is sometimes useful.
--
Theorem 343: [Shift-by-0 is the identity map on sequences] (Is_map(F) & (domain(F) incin Za)) imp (shifted_seq(F,0) = F). Proof:
    Suppose_not(f) ==> AUTO
    f-->T342 ==> AUTO
    ELEM ==> shifted_seq(f,0) /= f
    Use_def(shifted_seq) ==> false; Discharge ==> QED

--
-- The following alternative characterization of the left-shift operator can be useful,
-- e.g., in the proof of Theorem 350 below.
--
Theorem 344: [Form of a shifted sequence] ((M in Za) & (domain(F) incin Za)) imp (shifted_seq(F,M) = {[car(x) MINUS M,cdr(x)]: x in F | car(x) incs M}). Proof:
    Suppose_not(m,f) ==> Stat1: (m in Za) & (domain(f) incin Za) & (shifted_seq(f,m) /= {[car(x) MINUS m,cdr(x)]: x in f | car(x) incs m})
	Use_def(shifted_seq) ==> (f @ Shift(m)) /= {[car(x) MINUS m,cdr(x)]: x in f | car(x) incs m}
	Use_def(Shift) ==> (f @ {[i, m PLUS i]: i in Za}) /= {[car(x) MINUS m,cdr(x)]: x in f | car(x) incs m}
	Use_def(@) ==> {[car(p),cdr(q)]: p in {[i, m PLUS i]: i in Za}, q in f | cdr(p) = car(q)} /= {[car(x) MINUS m,cdr(x)]: x in f | car(x) incs m}
	SIMPLF ==> Stat2: {[car([i, m PLUS i]),cdr(q)]: i in Za, q in f | cdr([i, m PLUS i]) = car(q)} /= {[car(x) MINUS m,cdr(x)]: x in f | car(x) incs m}
	c-->Stat2 ==> (c in {[car([i, m PLUS i]),cdr(q)]: i in Za, q in f | cdr([i, m PLUS i]) = car(q)}) eq (c notin {[car(x) MINUS m,cdr(x)]: x in f | car(x) incs m})
	Suppose ==> Stat3: (c in {[car([i, m PLUS i]),cdr(q)]: i in Za, q in f | cdr([i, m PLUS i]) = car(q)}) & (c notin {[car(x) MINUS m,cdr(x)]: x in f | car(x) incs m})
		(i,q,q)-->Stat3(Stat3) ==> (c = [i,cdr(q)]) & (i in Za) & ((m PLUS i) = car(q)) & ((c /= [car(q) MINUS m,cdr(q)]) or (not(car(q) incs m)))
		ALGEBRA ==> ((m PLUS i) in Za) & (((m PLUS i) MINUS m) = ((i PLUS m) MINUS m))
		(i,m)-->T304(Stat1*) ==> ((i PLUS m) MINUS m) = i
		EQUAL(Stat3) ==> (car(q) in Za) & (not(car(q) incs m))
		TELEM ==> 0 incin i
		(m,i)-->T292 ==> m incin (m PLUS i)
        EQUAL ==> false; Discharge ==> Stat4: (c in {[car(x) MINUS m,cdr(x)]: x in f | car(x) incs m}) &  (c notin {[car([i, m PLUS i]),cdr(q)]: i in Za, q in f | cdr([i, m PLUS i]) = car(q)})
        (x,car(x) MINUS m,x)-->Stat4(Stat4) ==> (c = [car(x) MINUS m,cdr(x)]) & (x in f) & (car(x) incs m) & (((car(x) MINUS m) notin Za) or ((m PLUS (car(x) MINUS m)) /= car(x)))
        (x,f)-->T60 ==> car(x) in domain(f)
        ELEM ==> car(x) in Za
        ALGEBRA ==> (car(x) MINUS m) in Za
    	(car(x),m)-->T325 ==> (m PLUS (car(x) MINUS m)) = car(x)
        (Stat4*)ELEM ==> (m PLUS (car(x) MINUS m)) /= car(x)
    	Discharge ==> QED
--
-- The following lemmas will be used just below to show that the concatenation of two
-- finite sequences is also a finite sequence. Among other facts, we show that
-- the left-shift operator defined above always produces a single-valued map.
--
Theorem 345: [Properties of finite and shifted finite sequences] ((F in Fin_seqs(S)) & (G in Fin_seqs(S))) imp
				(Svm({[car(x) PLUS #F, cdr(x)]: x in G})
					& (domain(F) * domain({[car(x) PLUS #F, cdr(x)]: x in G}) = 0)). Proof+:
Suppose_not(f,s,g) ==> AUTO
   	Use_def(Fin_seqs) ==> Stat1: (f in {h: h incin (Za PROD S) | Svm(h) & (domain(h) in Za)}) &
   							Stat2: (g in {h: h incin (Za PROD S) | Svm(h) & (domain(h) in Za)})
   	h0-->Stat1 ==> (h0 incin (Za PROD S)) & (h0 = f) & Svm(h0) & (domain(h0) in Za)
   	h2-->Stat2 ==> (h2 incin (Za PROD S)) & (h2 = g) & Svm(h2) & (domain(h2) in Za)
   	EQUAL ==> (f incin (Za PROD S)) & Svm(f) & (domain(f) in Za)
   	EQUAL ==> (g incin (Za PROD S)) & Svm(g) & (domain(g) in Za)
  	f-->T336 ==> Stat3: (domain(f) = #f) & (#f in Za)
   	Suppose ==> not Svm({[car(x) PLUS #f, cdr(x)]: x in g})
    APPLY(x3_thryvar:c,y3_thryvar:d) Svm_test(a(x)->(car(x) PLUS #f),b(x)->cdr(x),s->g) ==>
    		((c in g) & (d in g) & (((car(c) PLUS #f) = (car(d) PLUS #f)) & (cdr(c) /= cdr(d))))
    				or Svm({[car(x) PLUS #f, cdr(x)]: x in g})
	ELEM ==> (c in (Za PROD s)) & (d in (Za PROD s))
--
-- Hence, $car(c) in Za$ and $car(d) in Za$.
--
	(c,Za,s)-->T140 ==> AUTO
	(d,Za,s)-->T140 ==> AUTO
	Use_def(Svm) ==> Stat4: (FORALL x in g, y in g | (car(x) = car(y)) imp (x = y))
	(c,d)-->Stat4 ==> Stat5: (car(c) = car(d)) imp (c = d)
	(car(c),car(d),#f)-->T289(Stat3*) ==> Stat6: c = d
	Discharge ==> Stat7: domain(f) * domain({[car(x) PLUS #f, cdr(x)]: x in g}) /= 0
--
--
--
	T336 ==> #f * domain({[car(x) PLUS #f, cdr(x)]: x in g}) /= 0
    Use_def(domain) ==> domain({[car(x) PLUS #f, cdr(x)]: x in g}) = {car(y): y in {[car(x) PLUS #f, cdr(x)]: x in g}}
	SIMPLF ==> Stat8: #f * {car([car(x) PLUS #f, cdr(x)]):  x in g} /= 0
	c1-->Stat8 ==> Stat9: (c1 in #f) & Stat10: (c1 in {car([car(x) PLUS #f, cdr(x)]):  x in g})
	y-->Stat10 ==> Stat11: (y in g) & (c1 = car([car(y) PLUS #f, cdr(y)]))
	(Stat11)ELEM ==> Stat12: c1 = car(y) PLUS #f
	(#f,car(y))-->T292(Stat3,Stat12*) ==> #f incin (car(y) PLUS #f)
	(Stat9)Discharge ==> QED
--
Theorem 346: ((F in Fin_seqs(S)) & (M in Za)) imp (((F ON M) in Fin_seqs(S)) & (shifted_seq(F,M) in Fin_seqs(S)) & (domain(shifted_seq(F,M)) = (#F MINUS M))). Proof+:
    Suppose_not(f,s,m) ==> Stat1: (f in Fin_seqs(s)) & (m in Za) & (((f ON m) notin Fin_seqs(s)) or (shifted_seq(f,m) notin Fin_seqs(s)) or (domain(shifted_seq(f,m)) /= (#f MINUS m)))
    f-->T335 ==> Stat2: Svm(f) & (domain(f) in Za) & (range(f) incin s)
    Use_def(shifted_seq) ==> ((f ON m) notin Fin_seqs(s)) or ((f @ Shift(m)) notin Fin_seqs(s)) or (domain(f @ Shift(m)) /= (#f MINUS m))
    (m,m)-->T339 ==> Svm(Shift(m)) & (domain(Shift(m)) = Za) & (range(Shift(m)) incin Za)
    (f,Shift(m))-->T95 ==> range(f @ Shift(m)) = range(f ON range(Shift(m)))
    (f,range(Shift(m)))-->T80 ==> range(f @ Shift(m)) incin s
    (f,Shift(m))-->T128 ==> Svm(f @ Shift(m))
    Use_def(domain) ==> domain(f @ Shift(m)) = {car(x): x in (f @ Shift(m))}
    Use_def(@) ==> domain(f @ Shift(m)) = {car(x): x in {[car(y),cdr(u)]: y in Shift(m), u in f | cdr(y) = car(u)}}
    SIMPLF ==> domain(f @ Shift(m)) = {car([car(y),cdr(u)]): y in Shift(m), u in f | cdr(y) = car(u)}
    Suppose ==> Stat3: {car([car(y),cdr(u)]): y in Shift(m), u in f | cdr(y) = car(u)} /= {car(y): y in Shift(m), u in f | cdr(y) = car(u)}
    (y1,u1)-->Stat3 ==> false; Discharge ==> domain(f @ Shift(m)) = {car(y): y in Shift(m), u in f | cdr(y) = car(u)}
    Use_def(Shift) ==> {car(y): y in Shift(m), u in f | cdr(y) = car(u)} = {car(y): y in {[i, m PLUS i]: i in Za}, u in f | cdr(y) = car(u)}
    ELEM ==> domain(f @ Shift(m)) = {car(y): y in {[i, m PLUS i]: i in Za}, u in f | cdr(y) = car(u)}
    SIMPLF ==> domain(f @ Shift(m)) = {car([i, m PLUS i]): i in Za, u in f | cdr([i, m PLUS i]) = car(u)}
	Suppose ==> Stat4: {car([i, m PLUS i]): i in Za, u in f | cdr([i, m PLUS i]) = car(u)} /= {i: i in Za, u in f | cdr([i, m PLUS i]) = car(u)}
    (y2,u2)-->Stat4 ==> false; Discharge ==> domain(f @ Shift(m)) = {i: i in Za, u in f | cdr([i, m PLUS i]) = car(u)}
	Suppose ==> Stat5: {i: i in Za, u in f | cdr([i, m PLUS i]) = car(u)} /= {i: i in Za, u in f | m PLUS i = car(u)}
    (y3,u3)-->Stat5 ==> false; Discharge ==> domain(f @ Shift(m)) = {i: i in Za, u in f | m PLUS i = car(u)}
    Suppose ==> {i: i in Za, u in f | m PLUS i = car(u)} /= {i: i in Za, v in domain(f) | m PLUS i = v}
	    Use_def(domain) ==> {i: i in Za, u in f | m PLUS i = car(u)} /= {i: i in Za, v in {car(u): u in f} | m PLUS i = v}
    SIMPLF ==> false; Discharge ==> domain(f @ Shift(m)) = {i: i in Za, v in domain(f) | m PLUS i = v}
    Suppose ==> Stat6: {i: i in Za, v in domain(f) | m PLUS i = v} /= {i: i in Za | (m PLUS i) in domain(f)}
		c-->Stat6 ==> not ((c in {i: i in Za, v in domain(f) | m PLUS i = v}) eq (c in {i: i in Za | (m PLUS i) in domain(f)}))
    Suppose ==> Stat7: (c in {i: i in Za, v in domain(f) | m PLUS i = v}) & Stat8: (c notin {i: i in Za | (m PLUS i) in domain(f)})
		(i,v)-->Stat7 ==> (c = i) & (i in Za) & (v in domain(f)) & (m PLUS i = v)
		i-->Stat8 ==> not((c = i) & (i in Za) & ((m PLUS i)  in domain(f)))
	Discharge ==> Stat9: (c notin {i: i in Za, v in domain(f) | (m PLUS i) = v}) & Stat10: (c in {i: i in Za | (m PLUS i) in domain(f)})
		i1-->Stat10 ==> (c = i1) & (i1 in Za) & ((m PLUS i1) in domain(f))
	(i1,m PLUS i1)-->Stat9 ==> false; Discharge ==> Stat11: domain(f @ Shift(m)) = {i: i in Za | (m PLUS i) in domain(f)}
	SIMPLF ==> Stat12: {i: i in Za | (m PLUS i) in domain(f)} = {i in Za | (m PLUS i) in domain(f)}
	Suppose ==> Stat13: {i: i in Za | (m PLUS i) in domain(f)} /= {i: i in Za | (i PLUS m) in domain(f)}
		c2-->Stat13 ==> (c2 in Za) & ((m PLUS c2) /= (c2 PLUS m))
	(m,c2)-->T252 ==> false; Discharge ==> Stat14: {i in Za | (m PLUS i) in domain(f)} = {i in Za | (i PLUS m) in domain(f)}
    (domain(f),m)-->T328(Stat11,Stat2,Stat1,Stat12,Stat14) ==> domain(f @ Shift(m)) = domain(f) MINUS m
    f-->T336 ==> domain(f) = #f
    EQUAL ==> ((f ON m) notin Fin_seqs(s)) or ((f @ Shift(m)) notin Fin_seqs(s))
    Suppose ==> (f @ Shift(m)) notin Fin_seqs(s)
    (f @ Shift(m))-->T335 ==> (domain(f) MINUS m) notin Za
    (domain(f),m)-->T283 ==> false; Discharge ==> (f ON m) notin Fin_seqs(s)
    Use_def(Fin_seqs) ==> Stat15: (f ON m) notin {g incin (Za PROD s) | Svm(g) & (domain(g) in Za)}
    (m,domain(f))-->T29(Stat1,Stat2*) ==> (m incin domain(f)) or (domain(f) incin m)
    Suppose ==> (domain(f) * m) = domain(f)
	(f,m)-->T68(Stat15*) ==> (f ON (domain(f) * m)) = (f ON m)
	f-->T67(Stat15*) ==> (f ON domain(f)) = f
    EQUAL(Stat1) ==> false; Discharge ==> not(domain(f) incin m)
    (f,m)-->T94(Stat1*) ==> domain(f ON m) in Za
    (f,m)-->T57(Stat2*) ==> Svm(f ON m)
    (f ON m)-->Stat15(Stat15*) ==> (f ON m) nincin (Za PROD s)
    Use_def(Svm)(Stat15*) ==> Is_map(f ON m)
    T206(Stat15*) ==> Ord(Za)
    (Za,domain(f ON m))-->T13(Stat15*) ==> domain(f ON m) incin Za
    (f,m)-->T80(Stat2*) ==> range(f ON m) incin s
    (f ON m,Za,s)-->T141(Stat15*) ==> false; Discharge ==> QED
--
-- We start with a preliminary lemma which shows that the concatenation of two finite sequences if is a finite sequence,
-- and which gives additional details concering the domin and range of the concatenation.
--
Theorem 347: [Concatenation of finite sequences] ((F in Fin_seqs(S)) & (G in Fin_seqs(S))) imp
			((concat(F,G) in Fin_seqs(S)) & (domain(concat(F,G)) = domain(F) PLUS domain(G)) & (range(concat(F,G)) = range(F) + range(G))) & ((U in domain(F) PLUS domain(G)) imp (concat(F,G)~[U] = if U in domain(F) then F~[U] else G~[U MINUS domain(F)] end if)). Proof+:
Suppose_not(f,s1,g,u) ==> AUTO
	Use_def(concat) ==> concat(f,g) = {[n,if n in domain(f) then f~[n] else g~[n MINUS domain(f)] end if]: n in domain(f) PLUS domain(g)}
	APPLY() Must_be_svm(b(x)->if x in domain(f) then f~[x] else g~[x MINUS domain(f)] end if,s->domain(f) PLUS domain(g),u->u) ==> Svm({[x,if x in domain(f) then f~[x] else g~[x MINUS domain(f)] end if]: x in domain(f) PLUS domain(g)}) & (domain({[x,if x in domain(f) then f~[x] else g~[x MINUS domain(f)] end if]: x in domain(f) PLUS domain(g)}) = domain(f) PLUS domain(g)) & (range({[x,if x in domain(f) then f~[x] else g~[x MINUS domain(f)] end if]: x in domain(f) PLUS domain(g)}) = {if x in domain(f) then f~[x] else g~[x MINUS domain(f)] end if: x in domain(f) PLUS domain(g)}) & ((u in domain(f) PLUS domain(g)) imp ({[x,if x in domain(f) then f~[x] else g~[x MINUS domain(f)] end if]: x in domain(f) PLUS domain(g)}~[u] = if u in domain(f) then f~[u] else g~[u MINUS domain(f)] end if))
	EQUAL ==> Stat2: Svm(concat(f,g)) & (domain(concat(f,g)) = domain(f) PLUS domain(g)) & (range(concat(f,g)) = {if x in domain(f) then f~[x] else g~[x MINUS domain(f)] end if: x in domain(f) PLUS domain(g)}) & ((u in domain(f) PLUS domain(g)) imp (concat(f,g)~[u] = if u in domain(f) then f~[u] else g~[u MINUS domain(f)] end if))
	(f,s1)-->T335 ==> Stat3: Svm(f) & (domain(f) in Za) & (range(f) incin s1)
	(g,s1)-->T335 ==> Stat4: Svm(g) & (domain(g) in Za) & (range(g) incin s1)
	ALGEBRA ==> Stat5: ((domain(g) PLUS domain(f)) = (domain(f) PLUS domain(g))) &
		((domain(f) PLUS domain(g)) in Za)
--
-- What is missing from the above conclusions is the fact that range(concat(f,g)) = range(f) + range(f)),
-- and we now establish this further fact, We begin by showing that the first of these two sets is included in the second
--
	Suppose ==> Stat7: not(range(concat(f,g)) incin (range(f) + range(g)))
		c-->Stat7 ==> Stat8: (c in {if x in domain(f) then f~[x] else g~[x MINUS domain(f)] end if: x in (domain(f) PLUS domain(g))}) & (c notin (range(f) + range(g)))
		x-->Stat8 ==> (x in (domain(f) PLUS domain(g))) & (c = if x in domain(f) then f~[x] else g~[x MINUS domain(f)] end if)
		(domain(f) PLUS domain(g),x)-->T12 ==> Ord(x)
		Suppose ==> x in domain(f)
		x-->T75 ==> false; Discharge ==> x notin domain(f)
		(domain(f),x)-->T35 ==> x incs domain(f)
		ELEM ==> g~[x MINUS domain(f)] notin range(g)
		(domain(g),domain(f))-->T304 ==> (domain(g) PLUS domain(f)) MINUS domain(f) = domain(g)
		EQUAL ==> (domain(f) PLUS domain(g)) MINUS domain(f) = domain(g)
--
-- It follows by strict monotonicity of subtraction that x MINUS domain(f) is a member of domain(g)
--
		(domain(f),domain(f) PLUS domain(g),x)-->T302 ==> (x MINUS domain(f)) in domain(g)
--
-- But then c = g~[x MINUS domain(f)] plainly belongs to range(g), a contradiction which proves our assertion
--
	(x MINUS domain(f),g)-->T75 ==> false; Discharge ==> range(concat(f,g)) incin (range(f) + range(g))
--
-- Next we show that range(concat(f,g)) incs (range(f) + range(g)), from which our theorem is immediate.
--
	ELEM ==> range(concat(f,g)) = {if x in domain(f) then f~[x] else g~[x MINUS domain(f)] end if: x in domain(f) PLUS domain(g)}
	f-->T73 ==> range(f) = {f~[x]: x in domain(f)}
	g-->T73 ==> range(g) = {g~[x]: x in domain(g)}
	Suppose ==> Stat9: not(range(concat(f,g)) incs range(f))
		c1-->Stat9 ==> Stat10: (c1 in {f~[x]: x in domain(f)}) & Stat11: (c1 notin {if x in domain(f) then f~[x] else g~[x MINUS domain(f)] end if: x in domain(f) PLUS domain(g)})
		x1-->Stat10 ==> (c1 = f~[x1]) & (x1 in domain(f))
	x1-->Stat11 ==> not(x1 in domain(f) PLUS domain(g))
	(domain(f),domain(f),domain(g),0)-->T219 ==> (domain(f) PLUS 0) incin (domain(f) PLUS domain(g))
	(domain(f))-->T254 ==> domain(f) PLUS 0 = domain(f);
	Discharge ==> range(concat(f,g)) incs range(f)
	Suppose ==> Stat12: not(range(concat(f,g)) incs range(g))
		c2-->Stat12 ==> Stat13: (c2 in {g~[x]: x in domain(g)}) & Stat14: (c2 notin {if x in domain(f) then f~[x] else g~[x MINUS domain(f)] end if: x in domain(f) PLUS domain(g)})
		x2-->Stat13 ==> (c2 = g~[x2]) & (x2 in domain(g))
		T206 ==> Ord(Za)
		(Za,domain(g))-->T13 ==> x2 in Za
		(domain(f),domain(g),x2)-->T288 ==> Stat15: (x2 PLUS domain(f)) in (domain(g) PLUS domain(f))
		(x2,domain(f))-->T304 ==> (x2 PLUS domain(f)) MINUS domain(f) = x2
		EQUAL ==> g~[(x2 PLUS domain(f)) MINUS domain(f)] = g~[x2]
		(x2,0,domain(f),domain(f))-->T219 ==> (x2 PLUS domain(f)) incs (0 PLUS domain(f))
		(domain(f))-->T254 ==> Stat16: (x2 PLUS domain(f)) incs domain(f)
		ELEM ==> Stat17: (x2 PLUS domain(f)) notin domain(f)
		(x2 PLUS domain(f))-->Stat14 ==> Stat18: not((c2 = if (x2 PLUS domain(f)) in domain(f) then f~[(x2 PLUS domain(f))] else g~[(x2 PLUS domain(f)) MINUS domain(f)] end if) & ((x2 PLUS domain(f)) in (domain(f) PLUS domain(g))))
		(Stat17,Stat18,Stat16,Stat5,Stat15)ELEM ==> not(c2 = (g~[(x2 PLUS domain(f)) MINUS domain(f)]))
	EQUAL ==> false; Discharge ==> Stat19: range(concat(f,g)) = (range(f) + range(g))
	(Stat2,Stat5,Stat19,Stat3,Stat4)ELEM ==> Svm(concat(f,g)) & (range(concat(f,g)) incin s1) & (domain(concat(f,g)) in Za)
	(concat(f,g),s1)-->T335 ==> concat(f,g) in Fin_seqs(s1)
	Discharge ==> QED
--
--
--
Theorem 348: [$0$ is bilateral unit for sequence concatenation] (F in Fin_seqs(S)) imp ((concat(F,0) = F) & (concat(0,F) = F)). Proof:
Suppose_not(f,s) ==> AUTO
    (f,s)-->T335 ==> Svm(f) & (domain(f) in Za)
    f-->T72 ==> f = {[n,f~[n]]: n in domain(f)}
    T59 ==> domain(0) = 0
    (domain(f))-->T254 ==> ((domain(f) PLUS 0) = domain(f)) & ((0 PLUS domain(f)) = domain(f))
    Suppose ==> concat(f,0) /= f
	Use_def(concat) ==> concat(f,0) = {[n,if n in domain(f) then f~[n] else 0~[n MINUS domain(f)] end if]: n in domain(f) PLUS domain(0)}
	EQUAL ==> Stat1: {[n,if n in domain(f) then f~[n] else 0~[n MINUS domain(f)] end if]: n in domain(f)} /= {[n,f~[n]]: n in domain(f)}
    n-->Stat1(Stat1) ==> false; Discharge ==> concat(0,f) /= f
    Use_def(concat) ==> concat(0,f) = {[n,if n in domain(0) then 0~[n] else f~[n MINUS domain(0)] end if]: n in domain(0) PLUS domain(f)}
    n-->T268 ==> (n MINUS 0) = #n
    EQUAL ==> Stat2: {[n,if n in 0 then 0~[n] else f~[#n] end if]: n in domain(f)} /= {[n,f~[n]]: n in domain(f)}
    m-->Stat2(Stat2) ==> (m in domain(f)) & ((f~[#m]) /= (f~[m]))
    T206 ==> Ord(Za)
    (Za,domain(f))-->T13 ==> m in Za
    m-->T207 ==> (#m) = m
EQUAL ==> false; Discharge ==> QED
--
--
--
Theorem 349: [Associativity of sequence concatenation] ((F in Fin_seqs(S)) & (G in Fin_seqs(S)) & (H in Fin_seqs(S))) imp (concat(F,concat(G,H)) = concat(concat(F,G),H)). Proof+:
Suppose_not(f,s,g,h) ==> AUTO
    ELEM ==> Stat1: (f in Fin_seqs(s)) & (g in Fin_seqs(s)) & (h in Fin_seqs(s))
    (f,s,g)-->T347 ==> Stat2: (concat(f,g) in Fin_seqs(s)) & (domain(concat(f,g)) = domain(f) PLUS domain(g))
    (g,s,h)-->T347 ==> Stat3: (concat(g,h) in Fin_seqs(s)) & (domain(concat(g,h)) = domain(g) PLUS domain(h))
    (f,s,concat(g,h))-->T347 ==> (concat(f,concat(g,h)) in Fin_seqs(s)) & (domain(concat(f,concat(g,h))) = domain(f) PLUS domain(concat(g,h)))
    (concat(f,g),s,h)-->T347 ==> (concat(concat(f,g),h) in Fin_seqs(s)) & (domain(concat(concat(f,g),h)) = domain(concat(f,g)) PLUS domain(h))
    EQUAL ==> (domain(concat(f,concat(g,h))) = (domain(f) PLUS (domain(g) PLUS domain(h)))) & (domain(concat(concat(f,g),h)) = (domain(f) PLUS domain(g)) PLUS domain(h))
    (concat(f,concat(g,h)),s)-->T335 ==> Svm(concat(f,concat(g,h)))
    (concat(concat(f,g),h),s)-->T335 ==> Svm(concat(concat(f,g),h))
    (domain(f),domain(g),domain(h))-->T258 ==> Stat4: (domain(f) PLUS (domain(g) PLUS domain(h))) = (domain(f) PLUS domain(g)) PLUS domain(h)
    (concat(f,concat(g,h)),concat(concat(f,g),h),domain(concat(f,concat(g,h))))-->T337 ==> not (FORALL j in domain(concat(f,concat(g,h))) | concat(f,concat(g,h))~[j] = concat(concat(f,g),h)~[j])
    EQUAL ==> Stat5: not (FORALL j in (domain(f) PLUS (domain(g) PLUS domain(h))) | concat(f,concat(g,h))~[j] = concat(concat(f,g),h)~[j])
    j-->Stat5 ==> Stat6: (j in (domain(f) PLUS (domain(g) PLUS domain(h)))) & (concat(f,concat(g,h))~[j] /= concat(concat(f,g),h)~[j])
--
-- Now we know that the single-valued maps $concat(f,concat(g,h))$ and $concat(concat(f,g),h)$ have the same domain,
-- and have only to prove that they have equal vaues at each point $j$ of that domain. Formulae for those values are easily derived.
--
    (f,s,g,j)-->T347(Stat5*)  ==> Stat7: (j in (domain(f) PLUS domain(g))) imp (concat(f,g)~[j] = if j in domain(f) then f~[j] else g~[j MINUS domain(f)] end if)
    (concat(f,g),s,h,j)-->T347(Stat7*) ==> Stat8: (j in (domain(concat(f,g)) PLUS domain(h))) imp (concat(concat(f,g),h)~[j] = if j in domain(concat(f,g)) then concat(f,g)~[j] else h~[j MINUS domain(concat(f,g))] end if)
    EQUAL(Stat2,Stat7,Stat8) ==> Stat9: (j in (domain(f) PLUS (domain(g)) PLUS domain(h))) imp (concat(concat(f,g),h)~[j] = if j in (domain(f) PLUS domain(g)) then if j in domain(f) then f~[j] else g~[j MINUS domain(f)] end if else h~[j MINUS (domain(f) PLUS domain(g))] end if)
    (Stat6,Stat9,Stat4*)ELEM ==> (concat(concat(f,g),h)~[j]) = if j in (domain(f) PLUS domain(g)) then if j in domain(f) then f~[j] else g~[j MINUS domain(f)] end if else h~[j MINUS (domain(f) PLUS domain(g))] end if
    (f,s,concat(g,h),j)-->T347(Stat9*) ==> Stat10: (j in (domain(f) PLUS (domain(concat(g,h))))) imp (concat(f,concat(g,h))~[j] = if j in domain(f) then f~[j] else concat(g,h)~[j MINUS domain(f)] end if)
    EQUAL(Stat10,Stat3) ==> (j in (domain(f) PLUS (domain(g) PLUS domain(h)))) imp (concat(f,concat(g,h))~[j] = if j in domain(f) then f~[j] else concat(g,h)~[j MINUS domain(f)] end if)
    (Stat6*)ELEM ==> Stat11: if j in (domain(f) PLUS domain(g)) then if j in domain(f) then f~[j] else g~[j MINUS domain(f)] end if else h~[j MINUS (domain(f) PLUS domain(g))] end if /= if j in domain(f) then f~[j] else concat(g,h)~[j MINUS domain(f)] end if
    (f,s)-->T336(Stat1,Stat1*) ==> Stat12: domain(f) in Za
    (g,s)-->T336(Stat1,Stat1*) ==> Stat13: domain(g) in Za
    (h,s)-->T336(Stat1,Stat1*) ==> domain(h) in Za
    ALGEBRA(Stat13*) ==> ((domain(g) PLUS domain(h)) in Za) & (0 in Za)
    Suppose ==> ((domain(f) PLUS (domain(g) PLUS domain(h))) MINUS domain(f)) /= (domain(g) PLUS domain(h))
	(domain(f),domain(g) PLUS domain(h))-->T252(Stat10*) ==> (domain(f) PLUS (domain(g) PLUS domain(h))) = ((domain(g) PLUS domain(h)) PLUS domain(f))
	EQUAL(Stat10*) ==> (((domain(g) PLUS domain(h)) PLUS domain(f)) MINUS domain(f)) /= (domain(g) PLUS domain(h))
    (domain(g) PLUS domain(h),domain(f))-->T304(Stat10*) ==> false; Discharge ==> ((domain(f) PLUS (domain(g) PLUS domain(h))) MINUS domain(f)) = (domain(g) PLUS domain(h))
    Suppose ==> domain(g) = 0
	(g,s)-->T335 ==> Svm(g)
	g-->T72(Stat11*) ==> g = {[x,g~[x]]: x in domain(g)}
	Set_monot ==> {[x,g~[x]]: x in 0} = {x: x in 0}
	SIMPLF(Stat11) ==> {[x,g~[x]]: x in 0} = 0
	EQUAL(Stat11) ==> g = 0
	h-->T348 ==> concat(0,h) = h
	f-->T348 ==> concat(f,0) = f
    EQUAL ==> false; Discharge ==> domain(g) /= 0
    Suppose ==> (domain(g) PLUS domain(h)) = 0
		(domain(g),domain(h))-->T252(Stat11*) ==> (domain(h) PLUS domain(g)) = 0
    (domain(h),domain(g))-->T284(Stat11*) ==> false; Discharge ==> (domain(g) PLUS domain(h)) /= 0
    (domain(f),domain(g) PLUS domain(h),j)-->T326(Stat6*) ==> Stat14: (j MINUS domain(f)) in (domain(g) PLUS domain(h))
    (g,s,h,j MINUS domain(f))-->T347(Stat1,Stat14*) ==> Stat15: concat(g,h)~[j MINUS domain(f)] = if (j MINUS domain(f)) in domain(g) then g~[j MINUS domain(f)] else h~[(j MINUS domain(f)) MINUS domain(g)] end if
    EQUAL(Stat15,Stat11) ==> if j in (domain(f) PLUS domain(g)) then if j in domain(f) then f~[j] else g~[j MINUS domain(f)] end if else h~[j MINUS (domain(f) PLUS domain(g))] end if /= if j in domain(f) then f~[j] else if (j MINUS domain(f)) in domain(g) then g~[j MINUS domain(f)] else h~[(j MINUS domain(f)) MINUS domain(g)] end if end if
    Suppose ==> not((j in domain(f)) imp (j in (domain(f) PLUS domain(g))))
	(domain(f))-->T254(Stat11*) ==> (0 PLUS domain(f)) = domain(f)
	(domain(g),domain(f))-->T252(Stat15*) ==> (domain(g) PLUS domain(f)) = (domain(f) PLUS domain(g))
    (0,domain(g),domain(f))-->T296(Stat11*) ==> false; Discharge ==> AUTO
    Suppose ==> (j notin Za) or (not Ord(j))
	j-->T207(Stat14*) ==> j notin Za
	T206(Stat14*) ==> Ord(Za)
	(domain(f),domain(g) PLUS domain(h))-->T283(Stat11) ==> (domain(f) PLUS (domain(g) PLUS domain(h))) in Za
	(Za,domain(f) PLUS (domain(g) PLUS domain(h)))-->T13(Stat6*) ==> (not Ord(domain(f) PLUS (domain(g) PLUS domain(h))))
    (domain(f),domain(g) PLUS domain(h))-->T283(Stat11*) ==> false; Discharge ==> AUTO
    Suppose ==> Stat16: not((j in (domain(f) PLUS domain(g))) eq ((j MINUS domain(f)) in domain(g)))
	Suppose ==> j in (domain(f) PLUS domain(g))
	(domain(f),domain(g),j)-->T326(Stat11*) ==> false; Discharge ==> Stat17: j notin (domain(f) PLUS domain(g))
	ALGEBRA(Stat11*) ==> (domain(f) PLUS domain(g)) in Za
	(domain(f) PLUS domain(g),j)-->T35(Stat15) ==> j incs (domain(f) PLUS domain(g))
	(j,domain(f) PLUS domain(g),domain(f))-->T310(Stat15*) ==> (j MINUS domain(f)) incs ((domain(f) PLUS domain(g)) MINUS domain(f))
	(domain(f),domain(g))-->T252(Stat15*) ==> (domain(f) PLUS domain(g)) = (domain(g) PLUS domain(f))
	EQUAL(Stat15) ==> Stat18: (j MINUS domain(f)) incs ((domain(g) PLUS domain(f)) MINUS domain(f))
    (domain(g),domain(f))-->T304(Stat12,Stat13,Stat18,Stat16,Stat17*) ==> false; Discharge ==> (not(j in domain(f))) imp ((j in (domain(f) PLUS domain(g))) eq ((j MINUS domain(f)) in domain(g)))
    TELEM ==> ((not(j in domain(f))) & (j in (domain(f) PLUS domain(g)))) imp ((g~[j MINUS domain(f)]) = (g~[j MINUS domain(f)]))
    Suppose ==> not(((not(j in domain(f))) & (not(j in (domain(f) PLUS domain(g))))) imp ((h~[j MINUS (domain(f) PLUS domain(g))]) = (h~[(j MINUS domain(f)) MINUS domain(g)])))
	(domain(f),j)-->T35(Stat11*) ==> j incs domain(f)
	(j,domain(f))-->T283(Stat11*) ==> ((j MINUS domain(f)) in Za) & ((j MINUS domain(f)) notin domain(g))
	(domain(g),j MINUS domain(f))-->T35(Stat13) ==> (j MINUS domain(f)) incs domain(g)
        (domain(f),j,domain(g))-->T303(Stat11*) ==> (j MINUS (domain(f) PLUS domain(g))) = ((j MINUS domain(f)) MINUS domain(g))
    EQUAL(Stat15) ==> false; Discharge ==> AUTO
    APPLY() if_then_else2(q->(j in domain(f)),p->(j in (domain(f) PLUS domain(g))),a->(f~[j]),b->(g~[j MINUS domain(f)]),c->(h~[j MINUS (domain(f) PLUS domain(g))]),pp->((j MINUS domain(f)) in domain(g)),ap->(f~[j]),bp->(g~[j MINUS domain(f)]),cp->(h~[(j MINUS domain(f)) MINUS domain(g)])) ==>
	if j in (domain(f) PLUS domain(g)) then if j in domain(f) then f~[j] else g~[j MINUS domain(f)] end if else h~[j MINUS (domain(f) PLUS domain(g))] end if = if j in domain(f) then f~[j] else if (j MINUS domain(f)) in domain(g) then g~[j MINUS domain(f)] else h~[(j MINUS domain(f)) MINUS domain(g)] end if end if
(Stat15*)Discharge ==> QED
--
Theorem 350: [Concatenation of shifted sequences] ((F in Fin_seqs(S)) & (M in domain(F))) imp ((shifted_seq(F,M) in Fin_seqs(S)) & (F = concat((F ON M), shifted_seq(F,M)))). Proof:
    Suppose_not(f,s,m) ==> AUTO
--
-- For, assuming the triple $f,s,m$ to be a counterexample to our theorem,
-- we reach a contradiction leading to the desired conclusion arguing as follows.
-- We begin by observing that $m$ is an unsigned integer insofar as an element of
-- the domain of $f$; hence, by the earlier Theorem 345, $shifted_seq(f,m)$
-- is a single-valued-map. Hence, if we assume that $shifted_seq(f,m) notin Fin_seqs(s)$,
-- the reason can either be that $shifted_seq(f,m)$ is not included in $Za PROD s$ or that
-- its domain is not an insigned integer.
--
	(f,s)-->T336 ==> (#f in Za) & (domain(f)=#f)
	(f,s)-->T335 ==> Stat1: Svm(f) & (range(f) incin s)
	Use_def(Svm) ==> Is_map(f)
	T206 ==> Ord(Za)
	(Za,domain(f))-->T12 ==> Ord(domain(f))
	(Za,domain(f))-->T13 ==> (domain(f) incin Za) & (m in Za)
	(domain(f),m)-->T13 ==> domain(f) incs m
	(m,f)-->T344 ==> Stat2: shifted_seq(f,m) = {[car(x) MINUS m,cdr(x)]: x in f | car(x) incs m}
	(f,s,m)-->T346 ==> Stat3: shifted_seq(f,m) in Fin_seqs(s)
	ELEM ==> Stat4: f /= concat((f ON m), shifted_seq(f,m))
--
-- Now assume that the two sides of the inequality
--	$f /= concat((f ON m), shifted_seq(f,m))$
-- just obtained have different domains. We reach a contradiction
-- arguing as follows.
--
	(f,s,m)-->T346 ==> Stat5: ((f ON m) in Fin_seqs(s)) &
		(shifted_seq(f,m) in Fin_seqs(s)) &
		(domain(shifted_seq(f,m)) = (#f MINUS m))
	(f,m)-->T94 ==> Stat6: domain(f ON m) = m
	Suppose ==> domain(f) /= domain(concat((f ON m), shifted_seq(f,m)))
		(f ON m,s,shifted_seq(f,m))-->T347 ==> domain(f) /= (domain(f ON m) PLUS domain(shifted_seq(f,m)))
		(m,#f)-->T272 ==> ((#f MINUS m) PLUS m) = #f
		(#f MINUS m,m)-->T252 ==> ((#f MINUS m) PLUS m) = (m PLUS (#f MINUS m))
	EQUAL ==> false; Discharge ==> Stat7: domain(f) = domain(concat((f ON m), shifted_seq(f,m)))
--
-- Since $f$ and $concat((f ON m), shifted_seq(f,m))$ are single-valued
-- maps and, as just observed, they have the same domain, they can only differ if
-- they send some element $n0$ of their common domain to different images.
--
	Suppose ==> Stat8: (FORALL n0 in domain(f) | (f~[n0]) = (concat((f ON m), shifted_seq(f,m))~[n0]))
		(f ON m,s,shifted_seq(f,m))-->T347(Stat5,Stat5*) ==> Stat9: concat((f ON m), shifted_seq(f,m)) in Fin_seqs(s)
		(concat((f ON m), shifted_seq(f,m)))-->T335(Stat9*) ==> Stat10: Svm(concat((f ON m), shifted_seq(f,m)))
	(f,concat((f ON m),shifted_seq(f,m)),domain(f))-->T337(Stat7,Stat1,Stat10,Stat4,Stat8*) ==> false; Discharge ==> Stat11: not(FORALL n0 in domain(f) | (f~[n0]) = (concat((f ON m), shifted_seq(f,m))~[n0]))
	n0-->Stat11(Stat11*) ==> Stat12: (n0 in domain(f)) & ((f~[n0]) /= (concat((f ON m), shifted_seq(f,m))~[n0]))
	Use_def(concat)(Stat11*) ==> concat((f ON m), shifted_seq(f,m)) = {[n,if n in domain(f ON m) then (f ON m)~[n] else (shifted_seq(f,m)~[n MINUS domain(f ON m)]) end if]: n in domain(f ON m) PLUS domain(shifted_seq(f,m))}
	APPLY() Must_be_svm(b(n)->if n in domain(f ON m) then (f ON m)~[n] else (shifted_seq(f,m)~[n MINUS domain(f ON m)]) end if,s->(domain(f ON m) PLUS domain(shifted_seq(f,m))),u->n0) ==>
		(domain({[n,if n in domain(f ON m) then (f ON m)~[n] else (shifted_seq(f,m)~[n MINUS domain(f ON m)]) end if]: n in (domain(f ON m) PLUS domain(shifted_seq(f,m)))}) = (domain(f ON m) PLUS domain(shifted_seq(f,m)))) &
		(n0 in (domain(f ON m) PLUS domain(shifted_seq(f,m)))) imp (({[n,if n in domain(f ON m) then (f ON m)~[n] else (shifted_seq(f,m)~[n MINUS domain(f ON m)]) end if]: n in (domain(f ON m) PLUS domain(shifted_seq(f,m)))}~[n0]) = if n0 in domain(f ON m) then (f ON m)~[n0] else (shifted_seq(f,m)~[n0 MINUS domain(f ON m)]) end if)
	EQUAL(Stat11) ==> ((concat((f ON m), shifted_seq(f,m))~[n0]) = (({[n,if n in domain(f ON m) then (f ON m)~[n] else (shifted_seq(f,m)~[n MINUS domain(f ON m)]) end if]: n in domain(f ON m) PLUS domain(shifted_seq(f,m))})~[n0])) &
		(domain(concat((f ON m), shifted_seq(f,m))) = (domain(f ON m) PLUS domain(shifted_seq(f,m))))
	(Stat7*)ELEM ==> Stat13: (f~[n0]) /= if n0 in domain(f ON m) then (f ON m)~[n0] else (shifted_seq(f,m)~[n0 MINUS domain(f ON m)]) end if
	EQUAL(Stat6,Stat13) ==> Stat14: (f~[n0]) /= if n0 in m then (f ON m)~[n0] else (shifted_seq(f,m)~[n0 MINUS m]) end if
--
-- Suppose first that $n0 in m$. Then, since $n0 in domain(f)$, we get
-- $(f~[n0]) = ((f ON m)~[n0])$, which leads to a contradiction.
-- Therefore, $n0 notin m$ and $(f~[n0]) /= (shifted_seq(f,m)~[n0 MINUS m])$.
--
	Suppose ==> Stat15: n0 in m
		(f,m)-->T94(Stat12,Stat15*) ==> n0 in domain(f ON m)
	(f,m,n0)-->T125(Stat14*) ==> false; Discharge ==> Stat16: n0 notin m
	(Stat14*)ELEM ==> Stat17: (f~[n0]) /= (shifted_seq(f,m)~[n0 MINUS m])
--
-- However, since $f$ and $shifted_seq(f,m)$ are single-valued maps, and plainly
-- $[n0,(f~[n0])] in f$ and $[n0 MINUS m,(f~[n0])] in shifted_seq(f,m)$
-- both hold (to see this more easily, we will designate $[n0,(f~[n0])]$ as $p$),
-- we reach the sought contradiction.
--
	Use_def(domain)(Stat12*) ==> Stat18: n0 in {car(p): p in f}
	p-->Stat18(Stat18*) ==> Stat19: (n0 = car(p)) & (p in f)
	(f,p)-->T74(Stat1,Stat19*) ==> Stat20: (f~[car(p)]) = cdr(p)
	(Za,m)-->T12(Stat1*) ==> Ord(m)
	(domain(f),car(p))-->T12(Stat1*) ==> Ord(car(p))
	(m,car(p))-->T35(Stat16*) ==> Stat21: car(p) incs m
	Suppose ==> Stat22: [car(p) MINUS m, cdr(p)] notin {[car(x) MINUS m,cdr(x)]: x in f | car(x) incs m}
	p-->Stat22(Stat19,Stat21*) ==> false; Discharge ==> Stat23: [car(p) MINUS m, cdr(p)] in {[car(x) MINUS m,cdr(x)]: x in f | car(x) incs m}
	(shifted_seq(f,m),s)-->T335(Stat3,Stat23,Stat2*) ==> Stat24: Svm(shifted_seq(f,m)) & ([car(p) MINUS m, cdr(p)] in shifted_seq(f,m))
	(shifted_seq(f,m),[car(p) MINUS m, cdr(p)])-->T74(Stat24*) ==> (shifted_seq(f,m)~[car(p) MINUS m]) = cdr(p)
    EQUAL(Stat17) ==> false; Discharge ==> QED
--
--
THEORY subseq(g,f)		 [Subsequence of a finite or denumerable sequence]
    Svm(f) & (domain(f) in next(Za))
    g in Subseqs(f)
END subseq;
--
ENTER_THEORY subseq
--
Def subseq.0: [Subsequence generator] h_thryvar := {p in arb({ h incin (Za PROD Za) | (g = (f @ h)) & Svm(h) & (FORALL i | (next(i) in domain(h)) imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) }) | cdr(p) in domain(f)}
--
Theorem subseq.1: (g = (f @ h_thryvar)) & one_1_map(h_thryvar) & (domain(h_thryvar) in next(Za)) & (range(h_thryvar) incin domain(f)) &
	(FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) imp ((h_thryvar~[i]) in (h_thryvar~[j]))). Proof:
    Suppose_not ==> Stat1: (g /= (f @ h_thryvar)) or (not one_1_map(h_thryvar)) or (domain(h_thryvar) notin next(Za)) or (not(range(h_thryvar) incin domain(f))) or (not(FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) imp ((h_thryvar~[i]) in (h_thryvar~[j]))))
--
-- We start with expanding the definition of 'Subseqs', which requires $g$ to be of the form $f @ h$,
-- with $h$ meeting various conditions which, however, do not include the condition that the components
-- of $h$ belong to $domain(f)$. Starting with the specific $h$ from which $h_thryvar$ has been obtained
-- by simply putting $h_thryvar = {p in h | cdr(p) in domain(f)}$, we must check that $h_thryvar$ is a
-- (finite or infinite) sequence enjoying the same properties as $h$, plus the additional one that its
-- components belong to the domain of $f$.
--
        Assump ==> Svm(f) & (domain(f) in next(Za)) & (g in Subseqs(f))
        (domain(f))-->T330 ==> domain(f) incin Za
        Use_def(Subseqs) ==> Stat2: (g in { f @ h: h incin (Za PROD Za) | Svm(h) & (FORALL i | (next(i) in domain(h)) imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) })
        Loc_def ==> h0 = arb({ h incin (Za PROD Za) | (g = (f @ h)) & Svm(h) & (FORALL i | (next(i) in domain(h)) imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) })
        Suppose ==> Stat3: 0 = { h incin (Za PROD Za) | (g = (f @ h)) & Svm(h) & (FORALL i | (next(i) in domain(h)) imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) }
            h1-->Stat2 ==> (h1 incin (Za PROD Za)) & (g = (f @ h1)) & Svm(h1) & (FORALL i | (next(i) in domain(h1)) imp ((i in domain(h1)) & ((h1~[i]) in (h1~[next(i)]))))
        h1-->Stat3 ==> false; Discharge ==> Stat4: h0 in { h incin (Za PROD Za) | (g = (f @ h)) & Svm(h) & (FORALL i | (next(i) in domain(h)) imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) }
        ()-->Stat4 ==> (g = (f @ h0)) & (h0 incin (Za PROD Za)) & Svm(h0) & Stat5: (FORALL i | (next(i) in domain(h0)) imp ((i in domain(h0)) & ((h0~[i]) in (h0~[next(i)]))))
        (h0, Za, Za)-->T141 ==> domain(h0) incin Za
        Use_def(h_thryvar) ==> h_thryvar = {p in arb({ h incin (Za PROD Za) | (g = (f @ h)) & Svm(h) & (FORALL i | (next(i) in domain(h)) imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) }) | cdr(p) in domain(f)}
        EQUAL ==> h_thryvar = {p in h0 | cdr(p) in domain(f)}
        Suppose ==> Stat6: not(h_thryvar incin h0)
            c-->Stat6 ==> (c notin h0) & Stat7: (c in {p in h0 | cdr(p) in domain(f)})
        ()-->Stat7(Stat6) ==> false; Discharge ==> h_thryvar incin h0
        (h_thryvar,h0)-->T65 ==> (domain(h_thryvar) incin domain(h0)) & (domain(h_thryvar) incin Za)
        (h_thryvar,h0)-->T53 ==> Stat8: Svm(h_thryvar)
        Use_def(Svm) ==> Is_map(h_thryvar)
        Suppose ==> Stat9: not(range(h_thryvar) incin domain(f))
            d-->Stat9 ==> (d notin domain(f)) & (d in range(h_thryvar))
            EQUAL ==> d in range({p in h0 | cdr(p) in domain(f)})
            Use_def(range) ==> d in {cdr(p): p in {p in h0 | cdr(p) in domain(f)}}
            SIMPLF ==> Stat10: d in {cdr(p): p in h0 | cdr(p) in domain(f)}
        q1-->Stat10(Stat9) ==> false; Discharge ==> range(h_thryvar) incin domain(f)
        Suppose ==> (f @ h0) /= (f @ h_thryvar)
            Use_def(@) ==> {[car(x),cdr(y)]: x in h0, y in f | cdr(x) = car(y)} /= {[car(x),cdr(y)]: x in h_thryvar, y in f | cdr(x) = car(y)}
            Set_monot ==> {[car(x),cdr(y)]: x in h_thryvar, y in f | cdr(x) = car(y)} incin {[car(x),cdr(y)]: x in h0, y in f | cdr(x) = car(y)}
            ELEM ==> Stat11: not({[car(x),cdr(y)]: x in h0, y in f | cdr(x) = car(y)} incin {[car(x),cdr(y)]: x in h_thryvar, y in f | cdr(x) = car(y)})
            e-->Stat11 ==> Stat12: (e in {[car(x),cdr(y)]: x in h0, y in f | cdr(x) = car(y)}) & (e notin {[car(x),cdr(y)]: x in h_thryvar, y in f | cdr(x) = car(y)})
            (x0,y0,x0,y0)-->Stat12 ==> (e = [car(x0),cdr(y0)]) & (x0 in h0) & (y0 in f) & (cdr(x0) = car(y0)) & Stat13: (x0 notin {p in h0 | cdr(p) in domain(f)})
            ()-->Stat13(Stat12*) ==> cdr(x0) notin domain(f)
            Use_def(domain) ==> Stat14: cdr(x0) notin {car(y): y in f}
        y0-->Stat14(Stat12*) ==> false; Discharge ==> ((f @ h_thryvar) = (f @ h0)) & (g = (f @ h_thryvar))
        T206 ==> Ord(Za)
        Za-->T32 ==> Ord(next(Za))
        (next(Za), domain(f))-->T12 ==> Ord(domain(f))
        Suppose ==> Stat15: not(FORALL i | (next(i) in domain(h_thryvar)) imp ((i in domain(h_thryvar)) & ((h_thryvar~[i]) in (h_thryvar~[next(i)]))))
            iq-->Stat15(Stat15) ==> (next(iq) in domain(h_thryvar)) & ((iq notin domain(h_thryvar)) or ((h_thryvar~[iq]) notin (h_thryvar~[next(iq)])))
            iq-->Stat5(Stat2) ==> (next(iq) in domain(h0)) & (iq in domain(h0)) & ((h0~[iq]) in (h0~[next(iq)]))
            (h_thryvar,next(iq))-->T77(Stat2*) ==> [next(iq),h_thryvar~[next(iq)]] in h0
            (h0,[next(iq),h_thryvar~[next(iq)]])-->T74(Stat2) ==> (h0~[car([next(iq),h_thryvar~[next(iq)]])]) = cdr([next(iq),h_thryvar~[next(iq)]])
            TELEM ==> (car([next(iq),h_thryvar~[next(iq)]]) = next(iq)) & (cdr([next(iq),h_thryvar~[next(iq)]]) = (h_thryvar~[next(iq)]))
            EQUAL(Stat15) ==> (h0~[next(iq)]) = (h_thryvar~[next(iq)])
            (h_thryvar,next(iq))-->T77(Stat8) ==> [next(iq),h_thryvar~[next(iq)]] in h_thryvar
            ([next(iq),h_thryvar~[next(iq)]], h_thryvar)-->T61(Stat8) ==> (h_thryvar~[next(iq)]) in domain(f)
            (domain(f), h_thryvar~[next(iq)])-->T13(Stat8*) ==> (h0~[iq]) in domain(f)
            Use_def(Svm) ==> Is_map(h0)
            (h0,iq)-->T77(Stat2*) ==> [iq,h0~[iq]] in h0
            Suppose ==> [iq,h0~[iq]] notin h_thryvar
                EQUAL ==> Stat16: [iq,h0~[iq]] notin {p in h0 | cdr(p) in domain(f)}
            ()-->Stat16(Stat15*) ==> false; Discharge ==> [iq,h0~[iq]] in h_thryvar
            (h_thryvar, [iq,h0~[iq]])-->T74(Stat2*) ==> (h_thryvar~[car([iq,h0~[iq]])]) = cdr([iq,h0~[iq]])
            TELEM ==> (car([iq,h0~[iq]]) = iq) & (cdr([iq,h0~[iq]]) = (h0~[iq]))
            EQUAL(Stat15*) ==> (h_thryvar~[iq]) = (h0~[iq])
            (Stat15*)ELEM ==> iq notin domain(h_thryvar)
        ([iq,h0~[iq]],h_thryvar)-->T60(Stat15*) ==> false; Discharge ==> Stat17: (FORALL i | (next(i) in domain(h_thryvar)) imp ((i in domain(h_thryvar)) & ((h_thryvar~[i]) in (h_thryvar~[next(i)]))))
--
        (h_thryvar, Za, domain(f))-->T141 ==> (range(h_thryvar) incin domain(f))
        (f,h_thryvar)-->T95 ==> (domain(f @ h_thryvar) = domain(h_thryvar)) & (range(f @ h_thryvar) = range(f ON range(h_thryvar)))
        (f, h_thryvar)-->T128 ==> Svm(f @ h_thryvar)
--
-- Observe that $f$ and $h_thryvar$ have ordinal numbers not exceeding $Za$ as their domains.
-- This is obvious (as has been proved above, en passant) for $f$, which either equals $Za$ or belongs to it.
-- Concerning $h_thryvar$ (and hence $g$, which has the same domain as $h_thryvar$),
-- what claimed follows from the earlier Theorem 330, because its domain is closed relative
-- to predecessor formation.
--
        Suppose ==> not(Ord(domain(h_thryvar)) & (domain(h_thryvar) in next(Za)))
            Suppose ==> Stat18: not(FORALL i | (next(i) in domain(h_thryvar)) imp (i in domain(h_thryvar)))
                ip-->Stat18 ==> (next(ip) in domain(h_thryvar)) & (ip notin domain(h_thryvar))
            ip-->Stat17 ==> false; Discharge ==> (FORALL i | (next(i) in domain(h_thryvar)) imp (i in domain(h_thryvar)))
            (domain(h_thryvar))-->T330 ==> domain(h_thryvar) in next(Za)
        (next(Za), domain(h_thryvar))-->T12 ==> false; Discharge ==> Ord(domain(h_thryvar)) & (domain(h_thryvar) in next(Za))
--
-- We will now see that $h_thryvar$ is a strictly increasing function, from which
-- its one-one-ness will follow.
--
        Suppose ==> Stat19: not(FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) imp ((h_thryvar~[i]) in (h_thryvar~[j])))
--
-- Indeed, assuming the contrary, we could choose unsigned integers $i1,j2$ such that $i1$ precedes $j2$
-- and $(h_thryvar~[i1]) notin (h_thryvar~[j2])$. Moreover, we can find the smallest $j1$ such that $i1$
-- precedes $j1$ and $(h_thryvar~[i1]) notin (h_thryvar~[j1])$. Notice that $j1$ cannot be the immediate
-- successor of $i1$.
--
            (i1,j2)-->Stat19 ==> (i1 in domain(h_thryvar)) & (j2 in domain(h_thryvar)) & (i1 in j2) & ((h_thryvar~[i1]) notin (h_thryvar~[j2]))
            Loc_def ==> j1 = arb({j in domain(h_thryvar) | (i1 in j) & ((h_thryvar~[i1]) notin (h_thryvar~[j]))})
            Suppose ==> Stat20: {j in domain(h_thryvar) | (i1 in j) & ((h_thryvar~[i1]) notin (h_thryvar~[j]))} = 0
            j2-->Stat20 ==> false; Discharge ==> Stat21: (j1 in {j in domain(h_thryvar) | (i1 in j) & ((h_thryvar~[i1]) notin (h_thryvar~[j]))}) & ((j1 * {j in domain(h_thryvar) | (i1 in j) & ((h_thryvar~[i1]) notin (h_thryvar~[j]))}) = 0)
            ()-->Stat21 ==> (j1 in domain(h_thryvar)) & (i1 in j1) & ((h_thryvar~[i1]) notin (h_thryvar~[j1]))
            Suppose ==> j1 = next(i1)
                EQUAL(Stat19) ==> ((h_thryvar~[i1]) notin (h_thryvar~[next(i1)])) & (next(i1) in domain(h_thryvar))
            i1-->Stat17(Stat19*) ==> false; Discharge ==> j1 /= next(i1)
--
-- From the fact $h_thryvar~[i1] in h_thryvar~[j1 MINUS 1]$ (due to the minimality
-- in the choice of $j1$) and the fact $h_thryvar~[j1 MINUS 1] in h_thryvar~[j1]$
-- (due to an assumed property of $h_thryvar$, whose domain is closed relative to
-- predecessor extraction), it follows that $(h_thryvar~[i1]) in (h_thryvar~[j1])$, contrary
-- to a fact just established. Thanks to this contradiction, we can discharge
-- our temporary assumption concluding that $h_thryvar$ fails to be one-one.
--
            T211(Stat19*) ==> (1 in Za) & Ord(0)
            (j1,1)-->T283(Stat2*) ==> (j1 MINUS 1) in Za
            (Za, j1)-->T12(Stat2*) ==> Ord(j1)
            Suppose ==> j1 /= next(j1 MINUS 1)
                (j1,0)-->T31(Stat21*) ==> 0 in j1
                Use_def(1) ==> 1 = next(0)
                Use_def(next) ==> 1 incin j1
                (1,j1)-->T272(Stat21*) ==> #j1 = ((j1 MINUS 1) PLUS 1)
                j1-->T207(Stat2*) ==> j1 = ((j1 MINUS 1) PLUS 1)
            (j1 MINUS 1)-->T317(Stat21*) ==> false; Discharge ==> j1 = next(j1 MINUS 1)
            Use_def(next) ==> (j1 MINUS 1) in j1
            EQUAL(Stat21*) ==> next(j1 MINUS 1) in domain(h_thryvar)
            (j1 MINUS 1)-->Stat17(Stat21*) ==> ((j1 MINUS 1) in domain(h_thryvar)) & ((h_thryvar~[j1 MINUS 1]) in (h_thryvar~[next(j1 MINUS 1)]))
            EQUAL(Stat21) ==> (h_thryvar~[j1 MINUS 1]) in (h_thryvar~[j1])
            Suppose ==> Stat22: (h_thryvar~[i1]) notin (h_thryvar~[j1 MINUS 1])
                EQUAL(Stat21*) ==> i1 in next(j1 MINUS 1)
                Use_def(next) ==> i1 in ((j1 MINUS 1) + {j1 MINUS 1})
                Suppose ==> i1 = (j1 MINUS 1)
                EQUAL(Stat21) ==> false; Discharge ==> i1 in (j1 MINUS 1)
                Suppose ==> Stat23: (j1 MINUS 1) notin {j in domain(h_thryvar) | (i1 in j) & ((h_thryvar~[i1]) notin (h_thryvar~[j]))}
                ()-->Stat23(Stat21*) ==> false; Discharge ==> (j1 MINUS 1) in {j in domain(h_thryvar) | (i1 in j) & ((h_thryvar~[i1]) notin (h_thryvar~[j]))}
            (Stat21*)Discharge ==> (h_thryvar~[i1]) in (h_thryvar~[j1 MINUS 1])
            (j1,h_thryvar)-->T71(Stat1*) ==> (h_thryvar~[j1]) in Za
            (Za, h_thryvar~[j1])-->T12(Stat8*) ==> Ord(h_thryvar~[j1])
        (h_thryvar~[j1], h_thryvar~[j1 MINUS 1])-->T13(Stat21*) ==> false; Discharge ==> (not one_1_map(h_thryvar)) & Stat24: (FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) imp ((h_thryvar~[i]) in (h_thryvar~[j])))
--
-- To now see that $h_thryvar$ is a one-one function, contradicting the conclusion just reached and thus
-- leading to the desired overall conclusion, we can exploit the strict monotonicity of $h_thryvar$.
--
--
-- In the first place, if we assume that $h_thryvar$ is not one-one, then we must admit the
-- existence of distinct pairs $p,q$ in $h_thryvar$ sharing the same second component.
--
        Use_def(one_1_map) ==> Stat25: not(FORALL x in h_thryvar, y in h_thryvar | (cdr(x) = cdr(y)) imp (x = y))
        (p,q)-->Stat25 ==> (p in h_thryvar) & (q in h_thryvar) & (cdr(p) = cdr(q)) & (p /= q)
        (h_thryvar,p)-->T51 ==> p = [car(p),cdr(p)]
        (h_thryvar,q)-->T51 ==> q = [car(q),cdr(q)]
        (p,h_thryvar)-->T60 ==> car(p) in Za
        (q,h_thryvar)-->T60 ==> car(q) in Za
        (Za,car(p))-->T12 ==> Ord(car(p))
        (Za,car(q))-->T12 ==> Ord(car(q))
        (car(p),car(q))-->T31(Stat25) ==> Stat26: (car(p) in car(q)) or (car(q) in car(p))
        (Stat25*)ELEM ==> (p in h_thryvar) & (q in h_thryvar) & (cdr(p) = cdr(q))
--
-- Let $p0,p1$ be such pairs $p,q$ ordered so that
-- the first component of $p0$ precedes the first component of $p1$.
-- Then $cdr(p0)$ must precede $cdr(p1)$, which leads to a contradiction.
--
        Loc_def ==> p0 = if (car(p) in car(q)) then p else q end if
        Loc_def ==> p1 = if (car(p) in car(q)) then q else p end if
        (p0, h_thryvar)-->T60(Stat26*) ==> car(p0) in domain(h_thryvar)
        (p1, h_thryvar)-->T60(Stat26*) ==> car(p1) in domain(h_thryvar)
        Suppose ==> not((car(p0) in car(p1)) & (cdr(p0) notin cdr(p1)))
            Suppose ==> car(p) in car(q)
                (Stat26*)ELEM ==> (p0 = p) & (p1 = q) & (cdr(p) notin cdr(q))
            EQUAL(Stat26*) ==> false; Discharge ==> car(q) in car(p)
            (Stat26*)ELEM ==> (p0 = q) & (p1 = p) & (cdr(q) notin cdr(p))
        EQUAL(Stat26*) ==> false; Discharge ==> Stat27: (car(p0) in car(p1)) & (cdr(p0) notin cdr(p1))
        (h_thryvar, p0)-->T74(Stat8*) ==> (h_thryvar~[car(p0)]) = cdr(p0)
        (h_thryvar, p1)-->T74(Stat8*) ==> (h_thryvar~[car(p1)]) = cdr(p1)
        EQUAL(Stat27) ==> (h_thryvar~[car(p0)]) notin (h_thryvar~[car(p1)])
    (car(p0),car(p1))-->Stat24 ==> false; Discharge ==> QED
--
Theorem subseq.2: {i in domain(h_thryvar) | i nincin (h_thryvar~[i])} = 0. Proof:
    Suppose_not ==> Stat1: {i in domain(h_thryvar) | (i nincin (h_thryvar~[i]))} /= 0
        Loc_def ==> i0 = arb({i in domain(h_thryvar) | (i nincin (h_thryvar~[i]))})
        ELEM ==> Stat2: ((i0 * {i in domain(h_thryvar) | (i nincin (h_thryvar~[i]))}) = 0) & Stat3: (i0 in {i in domain(h_thryvar) | (i nincin (h_thryvar~[i]))})
        ()-->Stat3 ==> (i0 in domain(h_thryvar)) & (i0 nincin (h_thryvar~[i0]))
        Assump ==> domain(f) in next(Za)
        (domain(f))-->T330 ==> domain(f) incin Za
        Tsubseq.1 ==> (domain(h_thryvar) in next(Za)) & (range(h_thryvar) incin Za) &
		Stat4: (FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) imp ((h_thryvar~[i]) in (h_thryvar~[j])))
        (domain(h_thryvar))-->T330 ==> domain(h_thryvar) incin Za
        T206 ==> Ord(Za)
        ELEM ==> (i0 in Za) & (i0 /= 0)
        T211(Stat2*) ==> (1 in Za) & Ord(0)
        (i0, 1)-->T283(Stat2*) ==> (i0 MINUS 1) in Za
        (Za, i0)-->T12(Stat2*) ==> Ord(i0)
        Suppose ==> i0 /= next(i0 MINUS 1)
            (i0,0)-->T31(Stat2*) ==> 0 in i0
            Use_def(1) ==> 1 = next(0)
            Use_def(next) ==> 1 incin i0
            (1,i0)-->T272(Stat2*) ==> #i0 = ((i0 MINUS 1) PLUS 1)
            i0-->T207(Stat2*) ==> i0 = ((i0 MINUS 1) PLUS 1)
        (i0 MINUS 1)-->T317(Stat2*) ==> false; Discharge ==> i0 = next(i0 MINUS 1)
        Use_def(next) ==> i0 = ((i0 MINUS 1) + {i0 MINUS 1})
        Za-->T32 ==> Ord(next(Za))
        (next(Za), domain(h_thryvar))-->T12 ==> Ord(domain(h_thryvar))
        (domain(h_thryvar), i0)-->T13 ==> (i0 MINUS 1) in domain(h_thryvar)
        (i0 MINUS 1, i0)-->Stat4 ==> (h_thryvar~[i0 MINUS 1]) in (h_thryvar~[i0])
        Suppose ==> ((i0 MINUS 1) nincin (h_thryvar~[i0 MINUS 1]))
            Suppose ==> Stat5: not((i0 MINUS 1) in {i in domain(h_thryvar) | (i nincin (h_thryvar~[i]))})
            ()-->Stat5 ==> false; Discharge ==> (i0 MINUS 1) in {i in domain(h_thryvar) | (i nincin (h_thryvar~[i]))}
        Discharge ==> (i0 MINUS 1) incin (h_thryvar~[i0 MINUS 1])
        (i0, h_thryvar)-->T71 ==> (h_thryvar~[i0]) in Za
        (Za, h_thryvar~[i0])-->T12 ==> Ord(h_thryvar~[i0])
        (h_thryvar~[i0], h_thryvar~[i0 MINUS 1])-->T13 ==> ((i0 MINUS 1) incin (h_thryvar~[i0])) & ((i0 MINUS 1) /= (h_thryvar~[i0]))
        (h_thryvar~[i0], i0 MINUS 1)-->T13 ==> (i0 MINUS 1) incin (h_thryvar~[i0])
        (i0, i0 MINUS 1)-->T12 ==> Ord(i0 MINUS 1)
        (h_thryvar~[i0], i0 MINUS 1)-->T34 ==> (i0 MINUS 1) in (h_thryvar~[i0])
     Use_def(next) ==> false; Discharge ==> QED
--
-- Our next theorem states that any subsequence $g$ of a (finite or infinite) sequence $f$
-- of elements of a set $s$ is also a sequence of elements of $s$, having a
-- (finite or infinite) length not exceeding the length of $f$.
--
Theorem subseq.3: Svm(g) & (g incin (domain(f) PROD range(f))) & (domain(g) in (next(Za) * next(domain(f)))). Proof:
    Suppose_not ==> (not Svm(g)) or (not(g incin (domain(f) PROD range(f)))) or (domain(g) notin (next(Za) * next(domain(f))))
	Assump ==> Svm(f) & (domain(f) in next(Za))
        Tsubseq.1 ==> (g = (f @ h_thryvar)) & one_1_map(h_thryvar) & (domain(h_thryvar) in next(Za)) & (range(h_thryvar) incin domain(f))
        T206 ==> Ord(Za)
        Za-->T32 ==> Ord(next(Za))
        (next(Za), domain(f))-->T12 ==> Ord(domain(f))
        Use_def(one_1_map) ==> Stat1: Svm(h_thryvar)
        (f,h_thryvar)-->T95 ==> (domain(f @ h_thryvar) = domain(h_thryvar)) & (range(f @ h_thryvar) = range(f ON range(h_thryvar)))
        (f, h_thryvar)-->T128 ==> Svm(f @ h_thryvar)
        (f, range(h_thryvar))-->T80 ==> range(f @ h_thryvar) incin range(f)
        EQUAL ==> Svm(g) & (domain(g) = domain(h_thryvar)) & (range(g) incin range(f))
--
-- This is, in detail, how we derive from the one-oneness of $h_thryvar$ the fact that
-- $domain(g)$ cannot be a larger ordinal than $domain(f)$. Then only the second alternative
-- of the or-statement in the Suppose_not statement,
-- namely $not(g incin (domain(f) PROD range(f)))$, survives.
--
        h_thryvar-->T157 ==> #range(h_thryvar) = #domain(h_thryvar)
        (domain(f), range(h_thryvar))-->T169 ==> #domain(h_thryvar) incin domain(f)
        (domain(h_thryvar))-->T147 ==> Ord(#domain(h_thryvar))
        (domain(f), #domain(h_thryvar))-->T34 ==> (#domain(h_thryvar) in domain(f)) or (#domain(h_thryvar) = domain(f))
        Use_def(next) ==> #domain(h_thryvar) in next(domain(f))
        (domain(h_thryvar), domain(f))-->T331 ==> ((domain(h_thryvar) = domain(f)) & (domain(f) = Za)) or (domain(h_thryvar) in (next(domain(f)) * Za))
--
        Suppose ==> domain(g) notin next(domain(f))
            (Stat1)ELEM ==> domain(h_thryvar) = domain(f)
            Use_def(next) ==> domain(f) in next(domain(f))
        (Stat1)Discharge ==> (not(g incin (domain(f) PROD range(f))))
--
-- However, $not(g incin (domain(f) PROD range(f)))$ amounts to one of the three possibilities
-- $not(Is_map(g))$, $not(domain(g) incin domain(f))$, or $not(range(g) incin range(f))$, the third
-- of which has already been eliminated. The first possibility must be discarded too, because
-- $g$ is known to be a single-valued map.
--
-- The possibility $not(domain(g) incin domain(f))$ would yield that
-- $domain(f)$ precedes $domain(g)$ in the standard order of ordinals, but
-- this conflicts with the fact, just derived above, that $domain(g) in next(domain(f))$.
--
        Use_def(Svm) ==> Is_map(g)
        (g, domain(f), range(f))-->T141 ==> not(domain(g) incin domain(f))
        (domain(f))-->T32 ==> Ord(next(domain(f)))
        (next(domain(f)), domain(g))-->T13 ==> domain(g) incin next(domain(f))
        Use_def(next) ==> domain(f) in domain(g)
    Use_def(next) ==> false; Discharge ==> QED
--
Theorem subseq.4: (domain(h_thryvar) /= Za) imp Finite(g). Proof:
    Suppose_not ==> (domain(h_thryvar) /= Za) & (not Finite(g))
        Tsubseq.1 ==> (g = (f @ h_thryvar)) & one_1_map(h_thryvar) & (domain(h_thryvar) in next(Za)) & (range(h_thryvar) incin domain(f))
        (domain(g))-->T206 ==> Ord(Za) & (not Finite(Za)) & ((domain(g) in Za) imp Finite(domain(g)))
        Assump ==> Svm(f) & (domain(f) in next(Za))
        (domain(f))-->T330 ==> domain(f) incin Za
        Use_def(next) ==> domain(h_thryvar) in Za
        (Za,domain(h_thryvar))-->T13 ==> (domain(h_thryvar) incin Za) & (range(h_thryvar) incin Za)
        (f,h_thryvar)-->T95 ==> domain(f @ h_thryvar) = domain(h_thryvar)
        Use_def(next) ==> Stat1: domain(h_thryvar) in Za
        (f,h_thryvar)-->T55 ==> Is_map(f @ h_thryvar)
        Use_def(one_1_map) ==> Svm(h_thryvar)
        (f, h_thryvar)-->T128 ==> Svm(f @ h_thryvar)
        EQUAL ==> (domain(g) in Za) & (Is_map(g)) & Svm(g)
        g-->T192 ==> Finite(range(g))
        (domain(g),range(g))-->T262 ==> Finite(domain(g) PROD range(g))
        (g,domain(g),range(g))-->T141(Stat1) ==> g incin (domain(g) PROD range(g))
    (domain(g) PROD range(g), g)-->T189 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY subseq
--
--THEORY subseq(g,f)		 [Subsequence of a finite or denumerable sequence]
--	Svm(f) & (domain(f) in next(Za))
--	g in Subseqs(f)
--==>(h_thryvar)
--	(g = (f @ h_thryvar)) & one_1_map(h_thryvar) & (domain(h_thryvar) in next(Za)) & (range(h_thryvar) incin domain(f))
--	(FORALL i in domain(h_thryvar), j in domain(h_thryvar) | (i in j) imp ((h_thryvar~[i]) in (h_thryvar~[j])))
--	({i in domain(h_thryvar) | (i nincin (h_thryvar~[i]))} = 0)
--	Svm(g) & (g incin (domain(f) PROD range(f))) & (domain(g) in (next(Za) * next(domain(f))))
--	((domain(h_thryvar) /= Za) imp Finite(g))
--END subseq;
--
--
--
--
-- Our next theorem states that every subsequence of a finite sequence $f$
-- of elements of a set $s$ is an alike sequence, whose length does not exceed the length of $f$.
--
Theorem 351: ((F in Fin_seqs(S)) & (G in Subseqs(F))) imp ((G in Fin_seqs(S)) & (domain(G) in next(domain(F)))). Proof:
    Suppose_not(f,s,g) ==> (f in Fin_seqs(s)) & (g in Subseqs(f)) & ((g notin Fin_seqs(s)) or (domain(g) notin next(domain(f))))
--
-- For, assuming by contradiction that $f,s,g$ are a counterexample, from the THEORY subseq
-- we get that $g$ is a function included in $domain(f) PROD s$,
-- having as its domain an ordinal not exceeding either $Za$ or $domain(f)$. It turns out
-- readily that $g$ is included in $Za PROD s$; hence, in order that $g$ does not belong
-- to $Fin_seqs(s)$, its domain must equal $Za$.
--
        Use_def(Fin_seqs) ==> Stat1: f in {f incin (Za PROD s) | Svm(f) & (domain(f) in Za)}
        ()-->Stat1 ==> (f incin (Za PROD s)) & Svm(f) & (domain(f) in Za)
        Use_def(next) ==> domain(f) in next(Za)
        APPLY(h_thryvar:h) subseq(g->g,f->f) ==>
		(g incin (domain(f) PROD range(f))) & Svm(g) & (domain(g) in (next(Za) * next(domain(f))))
        (f,Za,s)-->T141 ==> (domain(f) incin Za) & (range(f) incin s)
        (domain(f), Za, range(f), s)-->T256 ==> g incin (Za PROD s)
        (domain(f))-->T206 ==> Ord(Za) & Card(domain(f)) & Finite(domain(f))
        Za-->T32 ==> Ord(next(Za))
        Suppose ==> Za = domain(g)
--
-- However, if we assume that $domain(g) = Za$, then...
--
            Use_def(Card) ==> Ord(domain(f))
            (domain(f))-->T32 ==> Ord(next(domain(f)))
            (domain(f))-->T200 ==> Finite(next(domain(f)))
            (next(domain(f)))-->T205 ==> Card(next(domain(f)))
--
-- ...we get that $next(domain(f)) in domain(g)$, conflicting with $domain(g) in next(domain(f))$.
--
        (next(domain(f)))-->T206 ==> false; Discharge ==> Za /= domain(g)
        Use_def(next) ==> domain(g) in Za
        Use_def(Fin_seqs) ==> Stat2: g notin {f incin (Za PROD S) | Svm(f) & (domain(f) in Za)}
--
-- We have reached a contradiction showing that the statement of this lemma is true.
--
    ()-->Stat2 ==> false; Discharge ==> QED
--
--
-- Our next theorem states that every shifted sequence is a subsequence of the original sequence.
--
Theorem 352: (M in Za) imp (shifted_seq(F,M) in Subseqs(F)). Proof:
    Suppose_not(m,f) ==> Stat1: (m in Za) & (shifted_seq(f,m) notin Subseqs(f))
    Use_def(shifted_seq) ==> (f @ Shift(m)) notin Subseqs(f)
--
-- For, assuming that the contrary is true for $m,f$ and exploiting the definition of 'Subseqs',
-- we get that $Shift(m)$ is not a function, or it is not includedin $(Za PROD Za)$, or
-- its domain is not closed relative to predecessor extraction, or it is not increasing.
--
        Use_def(Subseqs) ==> Stat2: (f @ Shift(m)) notin {f @ h: h incin (Za PROD Za) | Svm(h) & (FORALL i | (next(i) in domain(h)) imp ((i in domain(h)) & ((h~[i]) in (h~[next(i)])))) }
        (Shift(m))-->Stat2 ==> (not(Shift(m) incin (Za PROD Za))) or (not Svm(Shift(m))) or (not (FORALL i | (next(i) in domain(Shift(m))) imp ((i in domain(Shift(m))) & (((Shift(m))~[i]) in ((Shift(m))~[next(i)])))))
        Use_def(Shift) ==> Shift(m) = {[i, m PLUS i]: i in Za}
--
-- The first two possibilities are discarded quite straightforwardly.
--
        Suppose ==> Stat3: not({[i, m PLUS i]: i in Za} incin (Za PROD Za))
            c-->Stat3 ==> Stat4: (c in {[i, m PLUS i]: i in Za}) & (c notin (Za PROD Za))
            ir-->Stat4 ==> (ir in Za) & ([ir, m PLUS ir] notin (Za PROD Za))
            ALGEBRA ==> (m PLUS ir) in Za
            Use_def(PROD) ==> Stat5: [ir, m PLUS ir] notin {[i,j]: i in Za, j in Za}
        (ir, m PLUS ir)-->Stat5 ==> false; Discharge ==> Shift(m) incin (Za PROD Za)
        (m,m)-->T339 ==> Stat6: Svm(Shift(m)) & Stat7: (not (FORALL i | (next(i) in domain(Shift(m))) imp ((i in domain(Shift(m))) & (((Shift(m))~[i]) in ((Shift(m))~[next(i)])))))
--
-- The third possibility is also discarded easily, so only the fourth one must be considered.
--
        i-->Stat7 ==> (next(i) in domain(Shift(m))) & ((i notin domain(Shift(m))) or (((Shift(m))~[i]) notin ((Shift(m))~[next(i)])))
        ELEM ==> domain({[i, m PLUS i]: i in Za}) = Za
        EQUAL ==> domain(Shift(m)) = domain({[i, m PLUS i]: i in Za})
        ELEM ==> next(i) in Za
        T206 ==> Ord(Za)
        (Za,next(i))-->T13 ==> next(i) incin Za
        Use_def(next) ==> Stat8: (i in Za) & (((Shift(m))~[i]) notin ((Shift(m))~[next(i)]))
--
-- By eliminating the fourth possibility, we get a contradiction proving the statement of the present theorem.
--
        Suppose ==> Stat9: [i, m PLUS i] notin {[i, m PLUS i]: i in Za}
        i-->Stat9 ==> false; Discharge ==> Stat10: [i, m PLUS i] in Shift(m)
        (Shift(m), [i, m PLUS i])-->T74(Stat6,Stat10*) ==> ((Shift(m))~[car([i, m PLUS i])]) = cdr([i, m PLUS i])
        Suppose ==> Stat11: [next(i), m PLUS next(i)] notin {[j, m PLUS j]: j in Za}
        (next(i))-->Stat11 ==> false; Discharge ==> Stat12: [next(i), m PLUS next(i)] in Shift(m)
        (Shift(m), [next(i), m PLUS next(i)])-->T74(Stat6,Stat12*) ==> ((Shift(m))~[car([next(i), m PLUS next(i)])]) = cdr([next(i), m PLUS next(i)])
        TELEM ==> (car([i, m PLUS i]) = i) & (cdr([i, m PLUS i]) = (m PLUS i)) & (car([next(i), m PLUS next(i)]) = next(i)) & (cdr([next(i), m PLUS next(i)]) = (m PLUS next(i)))
        i-->T317(Stat8,Stat8) ==> (i PLUS 1) = next(i)
        ALGEBRA ==> Stat13: ((m PLUS i) in Za) & ((m PLUS (i PLUS 1)) = ((m PLUS i) PLUS 1))
        (m PLUS i)-->T317(Stat13) ==> ((m PLUS i) PLUS 1) = next(m PLUS i)
        EQUAL(Stat8*) ==> (m PLUS i) notin next(m PLUS i)
    Use_def(next) ==> false; Discharge ==> QED
--
--
-- In the special case of a finite sequence $f$, the preceding theorem specializes into one stating
-- that every sequence obtained by shifting $f$ is a (finite) subsequence of $f$.
--
Theorem 353: ((F in Fin_seqs(S)) & (M in Za)) imp ((shifted_seq(F,M) in Fin_seqs(S)) & (domain(shifted_seq(F,M)) in next(domain(F)))). Proof:
    Suppose_not(f,s,m) ==> (f in Fin_seqs(s)) & (m in Za) & ((shifted_seq(f,m) notin Fin_seqs(s)) or (domain(shifted_seq(f,m)) notin next(domain(f))))
        (m,f)-->T352 ==> shifted_seq(f,m) in Subseqs(f)
        Use_def(shifted_seq) ==> ((f @ Shift(m)) in Subseqs(f)) & (((f @ Shift(m)) notin Fin_seqs(s)) or (domain(f @ Shift(m)) notin next(domain(f))))
        (f, s, f @ Shift(m))-->T351 ==> domain(f @ Shift(m)) notin next(domain(f))
        Use_def(Fin_seqs) ==> Stat1: f in {f incin (Za PROD s) | Svm(f) & (domain(f) in Za)}
        ()-->Stat1 ==> (f incin (Za PROD s)) & Svm(f) & (domain(f) in Za)
        Use_def(next) ==> domain(f) in next(Za)
        APPLY(h_thryvar:h) subseq(g->(f @ Shift(m)),f->f) ==>
		domain(f @ Shift(m)) in (next(Za) * next(domain(f)))
    Discharge ==> QED
--
Theorem 354: ((domain(F) = Za) & (M in Za)) imp (domain(shifted_seq(F,M)) = Za). Proof:
    Suppose_not(f,m) ==> (domain(f) = Za) & (m in Za) & (domain(shifted_seq(f,m)) /= Za)
        (m,f)-->T352 ==> shifted_seq(f,m) in Subseqs(f)
        Use_def(shifted_seq) ==> ((f @ Shift(m)) in Subseqs(f)) & (domain(f @ Shift(m)) /= Za)
        Use_def(Shift) ==> (domain(Shift(m)) = Za) & (range(Shift(m)) = { m PLUS i : i in Za })
        Suppose ==> not(range(Shift(m)) incin Za)
            Use_def(Shift) ==> Stat1: not({ m PLUS i : i in Za } incin Za)
            e-->Stat1 ==>  (e notin Za) & Stat2: (e in { m PLUS i : i in Za })
            i0-->Stat2 ==> (i0 in Za) & ((m PLUS i0) notin Za)
        (m,i0)-->T283 ==> false; Discharge ==> range(Shift(m)) incin domain(f)
    (f,Shift(m))-->T95 ==> false; Discharge ==> QED
--
--
-- ************************************************************************************************
--			Section 8: The cardinal product theorem (a digression)
-- ************************************************************************************************
--
-- Next we start to prepare for proof of the cardinal product theorem (Theorem 195 below), which asserts
-- that the product of two infinite cardinals is always the larger of the two. This proof
-- uses properties of the product ordering of the Cartesian product of two ordinals which the following
-- theory begins to lay out.
--
THEORY ordval_fcn(s,f(x))		 [Elementary properties of ordinal-valued functions]
    (s /= 0) & (FORALL x in s | Ord(f(x)))
END ordval_fcn;
--
ENTER_THEORY ordval_fcn
--
Def 00a: [Points at which f attains its minimum] rng_thryvar := {x: x in s | f(x) = arb({f(u): u in s})}
--
-- The first result we prove within the present theory is that the ordinal-valued function $f$
-- assumed by the theory always attains its minimum value $arb({f(u): u in s})$.
--
Theorem ordval_fcn1: [An ordinal-valued function attains its minimum]
    (rng_thryvar /= 0) & (FORALL x in rng_thryvar, y in s | f(x) incin f(y)) &
    	(rng_thryvar = {x: x in s | f(x) = arb({f(u): u in s})}). Proof:
    Suppose_not ==> rng_thryvar = 0 or
			(not (FORALL x in rng_thryvar, y in s | f(x) incin f(y))) or
				rng_thryvar /= {x: x in s | f(x) = arb({f(u): u in s})}
--
-- Assume the contrary. Since ${f(u): u in s}$ is clearly nonempty, $arb({f(y): y in s}) in {f(u): u in s}$
-- by the axiom of choice. Hence $arb({f(y): y in s})$ can be written as $f(d)$ with $d in s$,
-- and then it is clear by definition that $d in rng_thryvar$ so that $rng_thryvar /= 0$,
-- and hence only the second clause of out theorem can be false, i.e there must exist
-- $x in rng_thryvar$, $y in s$ such that $f(y)$ is less than $f(x)$.
--
	Use_def(rng_thryvar) ==> rng_thryvar = {x: x in s | f(x) = arb({f(u): u in s})}
    Assump ==> Stat1: (s /= 0) & Stat2: (FORALL x in s | Ord(f(x)))
    cp-->Stat1 ==> cp in s
    Suppose ==> Stat3: f(cp) notin {f(u): u in s}
    cp-->Stat3 ==> false; Discharge ==> {f(u): u in s} /= 0
    {f(y): y in s}-->T0 ==> Stat4: (arb({f(y): y in s}) in {f(u): u in s}) &
    			(arb({f(y): y in s}) * {f(u): u in s} = 0)
    d-->Stat4 ==> (d in s) & (arb({f(y): y in s}) = f(d))
    Suppose ==> d notin rng_thryvar
    Use_def(rng_thryvar) ==> Stat5: d notin {x: x in s | f(x) = arb({f(u): u in s})}
    d-->Stat5 ==> false; Discharge ==> Stat6: not(FORALL x in rng_thryvar, y in s | f(x) incin f(y))
    (x,y)-->Stat6 ==> Stat7: (x in rng_thryvar) & (y in s) & (not(f(x) incin f(y)))
--
-- $rng_thryvar$ is clearly a subset of $s$, while $f(x) = arb({f(u): u in s})$ and $f(y)$ are both ordinals.
--
    Suppose ==> Stat8: not(s incs rng_thryvar)
    c-->Stat8 ==> (c notin s) & (c in rng_thryvar)
    Use_def(rng_thryvar) ==> Stat9: c in {x in s | f(x) = arb({f(u): u in s})}
    ()-->Stat9 ==> false; Discharge ==> s incs rng_thryvar
    x-->Stat2 ==> Ord(f(x))
    y-->Stat2 ==> Ord(f(y))
    (f(x),f(y))-->T35 ==> f(y) in f(x)
    Use_def(rng_thryvar) ==> Stat10: x in {v: v in s | f(v) = arb({f(u): u in s})}
    v-->Stat10 ==> (x = v) & (f(v) = arb({f(u): u in s}))
    EQUAL ==> f(x) = arb({f(u): u in s})
--
-- But $f(y)$ is clearly in ${f(u): u in s}$, and since this violates
-- the disjointness clause of the axiom of choice as appled above,
-- have a contradiction which completes our proof.
--
    Suppose ==> Stat11: f(y) notin {f(u): u in s}
    y-->Stat11 ==> false; Discharge ==> f(y) in {f(u): u in s}
    Discharge ==> QED
--
-- It is also obvious that the set $rng_thryvar$ on which $f(x)$ attains its minimum value is
-- a subset of $s$.
--
Theorem ordval_fcn2: rng_thryvar incin s. Proof:
	Suppose_not ==> not(rng_thryvar incin s)
    Use_def(rng_thryvar) ==> rng_thryvar = {x: x in s | f(x) = arb({f(y): y in s})}
    Set_monot ==> {x: x in s | f(x) = arb({f(y): y in s})} incin {x: x in s}
    ELEM ==> rng_thryvar incin {x: x in s}
    SIMPLF ==> {x: x in s} = s
    Discharge ==> QED
--
-- Finally it is clear that any $y in s$ at which the minimum of $f$ is attained
-- belongs to the set $rng_thryvar$.
--
Theorem ordval_fcn3: (FORALL x in rng_thryvar, y in s | (f(x) = f(y)) imp (y in rng_thryvar)). Proof:
    Suppose_not ==> Stat1: not (FORALL x in rng_thryvar, y in s | (f(x) = f(y)) imp (y in rng_thryvar))
	(x,y)-->Stat1 ==> (x in rng_thryvar) & (y in s) & (f(x) = f(y)) & (y notin rng_thryvar)
	Use_def(rng_thryvar) ==> Stat2: x in {x in s | f(x) = arb({f(u): u in s})}
	()-->Stat2 ==> f(x) = arb({f(u): u in s})
	ELEM ==> f(y) = arb({f(u): u in s})
	Suppose ==> Stat3: y notin {x: x in s | f(x) = arb({f(u): u in s})}
	y-->Stat3 ==> false; Discharge ==> y in {x: x in s | f(x) = arb({f(u): u in s})}
	Use_def(rng_thryvar) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY ordval_fcn
--
--THEORY ordval_fcn(s,f);		 [Elementary functions of ordinal-valued functions]
--    (s /= 0) & (FORALL x in s | Ord(f(x)))
--==>(rng_thryvar)
--    (rng_thryvar = {x: x in s | f(x) = arb({f(y): y in s})}) & (rng /= 0) &
--    			(FORALL x in rng_thryvar, y in s | f(x) incin f(y))
--    (rng incin s)
--END ordval_fcn;
--
-- ----------------------------------------------------------------------------------------------
-- ----------------------------------------------------------------------------------------------
-- Our next theory concerns binary relations $R$ which are well-founded on a given domain $s$.
-- This means that $R$ is irreflexive on $s$, and that each non-null subset $t$ of this
-- domain has a 'minimal' element,i.e. an element not greater than any other element
-- of $t$ in the ordering defined by $R$.
-- We will show that any such relation can be extended into one  which is isomorphic to the
-- membership relator on an ordinal in 1-1 ordered correspondence with the set $s$.
-- ----------------------------------------------------------------------------------------------
-- ----------------------------------------------------------------------------------------------
--
THEORY well_founded_set(s,arg1_bef_arg2(x,y))
    (FORALL t | ((t incin s) & (t /= 0)) imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
END well_founded_set;
--
ENTER_THEORY well_founded_set
--
-- ----------------------------------------------------------------------------------------------
-- Our first theorem shows that the relation is antisymmetric, and hence irreflexive.
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.0:
    ((X in s) & (Y in s)) imp ((not(arg1_bef_arg2(X,Y) & arg1_bef_arg2(Y,X))) & (not arg1_bef_arg2(X,X))). Proof:
--
-- We proceed by contradiction. Suppose that our theorem is false, and let $x$, $y$ be a counterexample.
--
    Suppose_not(x,y) ==> (x in s) & (y in s) &  ((arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x)) or arg1_bef_arg2(x,x))
    ELEM ==> ({x,y} incin s) & ({x,y} /= 0) & ({x} incin s) & ({x} /= 0)
--
-- Suppose first that the pair $x,y$ violates antisymmetry, so that $x$ precedes $y$ and $y$ precedes $x$.
-- Any minimal element $u$ of the doubleton ${x,y}$ must be either $x$ or $y$; but if it is $x$ this
-- conflicts with the fact that $y$ precedes $x$; and symmetrically if the minimal element is $y$.
--
	 Suppose ==> arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x)
	 Assump ==> Stat1: (FORALL t | ((t incin s) & (t /= 0)) imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
	 ({x,y})-->Stat1 ==> Stat2: (EXISTS w in {x,y} | (FORALL v in {x,y} | (not arg1_bef_arg2(v,w))))
	 u-->Stat2 ==> (u in {x,y}) & Stat3: (FORALL v in {x,y} | (not arg1_bef_arg2(v,u)))
	 x-->Stat3 ==> (x in {x,y}) imp (not arg1_bef_arg2(x,u))
	 y-->Stat3 ==> (y in {x,y}) imp (not arg1_bef_arg2(y,u))
	 ELEM ==> ((u = y) & (not arg1_bef_arg2(x,u))) or ((u = x) & (not arg1_bef_arg2(y,u)))
	 Suppose ==> (u = y) & (not arg1_bef_arg2(x,u))
	 EQUAL ==> false; Discharge ==> (u = x) & (not arg1_bef_arg2(y,u))
	 EQUAL ==> false; Discharge ==> arg1_bef_arg2(x,x)
--
-- Similarly the minimal element of the singleton ${x}$ must be $x$, so $x$ cannot
-- precede $x$, completing our proof.
--
	({x})-->Stat1 ==> Stat4: (EXISTS w in {x} | (FORALL v in {x} | (not arg1_bef_arg2(v,w))))
	u2-->Stat4 ==> Stat5: (u2 in {x}) & (FORALL v in {x} | (not arg1_bef_arg2(v,u2)))
	u2-->Stat5 ==>  (u2 in {x}) &  ((u2 in {x}) imp (not arg1_bef_arg2(u2,u2)))
	ELEM ==> (u2 = x) & (not arg1_bef_arg2(u2,u2))
    EQUAL ==> false; Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- By assumption, we can define a selector '$Minrel1_thryvar$' which
-- picks a minimal element from each non-null subset of the domain $s$.
-- ----------------------------------------------------------------------------------------------
--
Def 10000: [?] Minrel1_thryvar(T) := if (T incin s) & (T /= 0) then
	arb({m: m in T | (FORALL y in T | (not arg1_bef_arg2(y,m)))}) else s end if
--
-- The following statement merely captures the definition of $Minrel1_thryvar$ as a theorem for use outside the present theory.
--
Theorem well_founded_set.00: Minrel1_thryvar(T) = if (T incin s) & (T /= 0) then
	arb({m: m in T | (FORALL y in T | (not arg1_bef_arg2(y,m)))}) else s end if. Proof:
	Suppose_not(t) ==> not(Minrel1_thryvar(T) = if (t incin s) & (t /= 0) then
	arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) else s end if)
	Use_def(Minrel1_thryvar) ==> false; Discharge ==> QED
--
Theorem well_founded_set.0a:
  ((T incin s) & (T /= 0)) imp ((Minrel1_thryvar(T) in T) & (FORALL y in T | (not arg1_bef_arg2(y,Minrel1_thryvar(T))))). Proof:
--
-- Proceeding by contradiction, assume that there is a non-null subset $t$ of the domain $s$
-- of our relation for which the operator $Minrel1_thryvar$ just introduced fails to
-- select a minimal element from $t$.
--
    Suppose_not(t) ==> (t incin s) & (t /= 0) &
    	(not((Minrel1_thryvar(t) in t) & (FORALL y in t | (not arg1_bef_arg2(y,Minrel1_thryvar(t))))))
	Assump ==> Stat1: (FORALL t | ((t incin s) & (t /= 0)) imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
	t-->Stat1 ==> Stat2: (EXISTS x in t | (FORALL y in t | (not arg1_bef_arg2(y,x))))
	m-->Stat2 ==> (m in t) & (FORALL y in t | (not arg1_bef_arg2(y,m)))
--
-- This conflicts with the fact that by assumption the set of minimal elements of $t$ cannot be empty,
-- and so the present lemma follows.
--
	Suppose ==> Stat3: {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))} = 0
	m-->Stat3 ==> false; Discharge ==>  arb({m: m in t |
	(FORALL y in t | (not arg1_bef_arg2(y,m)))}) in {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}
	Use_def(Minrel1_thryvar) ==> Minrel1_thryvar(t) = arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))})
	EQUAL ==> Stat4: Minrel1_thryvar(t) in {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}
	(mp)-->Stat4 ==> (mp = Minrel1_thryvar(t)) & (Minrel1_thryvar(t) in t) & (FORALL y in t | (not arg1_bef_arg2(y,mp)))
        EQUAL ==> (FORALL y in t | (not arg1_bef_arg2(y,Minrel1_thryvar(t))))
	Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Next we prove the elementary fact that $Minrel1_thryvar(t)$ cannot be less than $Minrel1_thryvar(r)$ if
-- $t$ and $s$ are both  non-null subsets of $s$ and $t$ is a subset of $r$:
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.0b: [Monotonicity of $Minrel1_thryvar$]
    ((R incin s) & (T incin R) & (T /= 0)) imp (not(arg1_bef_arg2(Minrel1_thryvar(T),Minrel1_thryvar(R)))). Proof:
--
-- Assuming the contrary, it follows that a minimal element of the subset $t$
-- of the set $r$ would precede some minimal element of $r$:
--
    Suppose_not(r,t) ==> (r incin s) & (t incin r) & (t /= 0) & (arg1_bef_arg2(Minrel1_thryvar(t),Minrel1_thryvar(r)))
    ELEM ==> (r /= 0) & (t incin s)
--
-- now use the preceding theorem twice, to derive a contradiction from the fact that
-- $Minrel1_thryvar(t)$ comes before  $Minrel1_thryvar(r)$
--
    t-->Twell_founded_set.0a ==> (Minrel1_thryvar(t) in t)
    r-->Twell_founded_set.0a ==> (Minrel1_thryvar(r) in r) &
    		Stat1: (FORALL y in r | (not arg1_bef_arg2(y,Minrel1_thryvar(r))))
    ELEM ==> Minrel1_thryvar(t) in r
    (Minrel1_thryvar(t))-->Stat1 ==> not(arg1_bef_arg2(Minrel1_thryvar(t),Minrel1_thryvar(r)))
    Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- The fact that for any non-null subset $t$ of $s$, $Minrel1_thryvar(t)$ belongs to $t$ is
-- an even more elementary consequence of the one assumption of the present theory.
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.0c: ((S incs T) & (T /= 0)) imp (Minrel1_thryvar(T) in T). Proof:
    Suppose_not(t) ==> (s incs t) & (t /= 0) & (Minrel1_thryvar(t) notin t)
    Use_def(Minrel1_thryvar) ==> Minrel1_thryvar(t) = arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))})
	Assump ==> Stat1: (FORALL t | ((t incin s) & (t /= 0)) imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
    t-->Stat1 ==> Stat2: (EXISTS x in t | (FORALL y in t | (not arg1_bef_arg2(y,x))))
    x-->Stat2 ==> Stat3: (x in t) & (FORALL y in t | (not arg1_bef_arg2(y,x)))
    Suppose ==>  Stat4: {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))} = 0
    x-->Stat4 ==> false; Discharge ==> {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))} /= 0
    {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}-->T0 ==>
    	arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) in
    			{m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}
    EQUAL ==> Stat5: Minrel1_thryvar(t) in {m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}
    m-->Stat5 ==> (Minrel1_thryvar(t) = m) & (m in t)
    Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- We now use the $Minrel1_thryvar$ selector to define a function
-- from ordinals into, and eventually onto, our ordered set $s$,
-- and prove a first elementary property of this function.
-- ----------------------------------------------------------------------------------------------
--
Def 00b: [The enumeration defined by a well-founded ordering relationship] ordenm_thryvar(X) := Minrel1_thryvar(s - {ordenm_thryvar(y): y in X})
--
-- The following statement captures the definition of ordenm_thryvar as a theorem for use outside the present theory.
--
Theorem well_founded_set.1a: ordenm_thryvar(X) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in X}). Proof:
	Suppose_not(x) ==> ordenm_thryvar(x) /= Minrel1_thryvar(s - {ordenm_thryvar(y): y in x})
	Use_def(ordenm_thryvar) ==> ordenm_thryvar(x) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in x})
	Discharge ==> QED
--
Theorem well_founded_set.1:
  (not(s incin {ordenm_thryvar(y): y in X})) imp ((ordenm_thryvar(X) in (s - {ordenm_thryvar(y): y in X}))
		& (FORALL y in (s - {ordenm_thryvar(y): y in X}) | not(arg1_bef_arg2(y,ordenm_thryvar(X))))). Proof:
    Suppose_not(x) ==> (not (s incin {ordenm_thryvar(y): y in x})) &
    		(not ((ordenm_thryvar(x) in (s - {ordenm_thryvar(y): y in x}))
	 & (FORALL y in (s - {ordenm_thryvar(y): y in x}) | not(arg1_bef_arg2(y,ordenm_thryvar(x))))))
--
-- The proof, which is by contradiction,  just uses the definition of 'ordenm_thryvar'
-- and Lemma well_founded_set.0a.
--
	ELEM ==> ((s - {ordenm_thryvar(y): y in x}) incin s) & ((s - {ordenm_thryvar(y): y in x}) /= 0)
--
-- For since $t = s - {ordenm_thryvar(y): y in x}$ is a non-null subset of $s$,
-- $Minrel1_thryvar(t) = ordenm_thryvar(x)$ is a minimal element of $t$, which is what we assert.
--
	(s - {ordenm_thryvar(y): y in x})-->Twell_founded_set.0a ==>
	 (Minrel1_thryvar(s - {ordenm_thryvar(y): y in x}) in (s - {ordenm_thryvar(y): y in x}))
	 & (FORALL y in (s - {ordenm_thryvar(y): y in x}) |
	 		not(arg1_bef_arg2(y,Minrel1_thryvar(s - {ordenm_thryvar(y): y in x}))))
    Use_def(ordenm_thryvar) ==> ordenm_thryvar(x) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in X})
    EQUAL ==> (ordenm_thryvar(x) in (s - {ordenm_thryvar(y): y in x}))
	 & (FORALL y in (s - {ordenm_thryvar(y): y in x}) | not(arg1_bef_arg2(y,ordenm_thryvar(x))))
    Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Next we show that $ordenm_thryvar(x) = s$ only if $s incin {ordenm_thryvar(y): y in X}$
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.2: (s incin {ordenm_thryvar(y): y in X}) eq (ordenm_thryvar(X) = s). Proof:
--
-- For assume the contrary, and first consider the case in which s incin {ordenm_thryvar(y): y in x}
--
    Suppose_not(x) ==> not((s incin {ordenm_thryvar(y): y in x}) eq (ordenm_thryvar(x) = s))
	Use_def(ordenm_thryvar) ==> ordenm_thryvar(x) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in x})
    Suppose ==> (s incin {ordenm_thryvar(y): y in x}) & (ordenm_thryvar(x) /= s)
--
-- In this case, the definitions of the operators involved lead to an immediate contradiction,
-- ruling it out, and so leave only the case $ordenm_thryvar(x) = s$ to be considered.
--
	ELEM ==> Minrel1_thryvar(s - {ordenm_thryvar(y): y in x}) /= s
	Use_def(Minrel1_thryvar) ==> (s - {ordenm_thryvar(y): y in x }) /= 0
	Discharge ==> ((s - {ordenm_thryvar(y): y in x}) /= 0) & (ordenm_thryvar(x) = s)
--
-- but then $s = Minrel1_thryvar(s - {ordenm_thryvar(y): y in x})$ by definition of $ordenm_thryvar$, and so must
-- belong to $s - {ordenm_thryvar(y): y in x}$
--
	ELEM ==> s = Minrel1_thryvar(s - {ordenm_thryvar(y): y in x})
	ELEM ==> ((s - {ordenm_thryvar(y): y in x}) incin s) & (s /= 0)
	(s,s - {ordenm_thryvar(y): y in x})-->Twell_founded_set.0c ==>
	Minrel1_thryvar(s - {ordenm_thryvar(y): y in x}) in s - {ordenm_thryvar(y): y in x}
   Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Our next result shows that the image, via the enumerator, of any $x$
-- is either $s$ or an element of $s$:
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.3: (ordenm_thryvar(X) /= s) imp (ordenm_thryvar(X) in s). Proof:
--
-- Suppose $x$ is a counterexample.
-- Then Theorem well_founded_set.2 tells us that some element of $s$ is
-- not the image, via the enumerator '$ordenm_thryvar$', of any element of $x$.
--
    Suppose_not(x) ==> (ordenm_thryvar(x) /= s) & (ordenm_thryvar(x) notin s)
	(s,x)-->Twell_founded_set.2 ==> not(s incin {ordenm_thryvar(y): y in x})
--
-- Thus, by Theorem well_founded_set.1, $ordenm_thryvar(x)$ belongs to $s$,
-- a contradiction which proves our statement.
--
	(s,x)-->Twell_founded_set.1 ==> ordenm_thryvar(x) in (s - {ordenm_thryvar(y): y in x})
    Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Now we show that ordenm_thryvar, restricted to ordinals,
-- is a monotone mapping into the ordered set s:
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.5: [Ordinal enumeration is monotone on ordinals]
 (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V))) imp (U in V). Proof:
--
-- For if the ordinals $o1$, $o2$ are a counterexample to the asserted statement...
--
    Suppose_not(o1,o2) ==>
	 Ord(o1) & Ord(o2) & (ordenm_thryvar(o1) /= s) & arg1_bef_arg2(ordenm_thryvar(o1),ordenm_thryvar(o2)) & (not(o1 in o2))
--
--	..then it follows from Theorem well_founded_set.2 that the images, via the enumerator,
--  of the elements of $o1$ fail to exhaust the elements of $s$:
--
	(s,o1)-->Twell_founded_set.2 ==> (not(s incin {ordenm_thryvar(y): y in o1}))
--
-- A contradiction will now be derived from the assumption that $o1$ does not
-- precede o2. Since ordinals $o1$, $o2$ can always be compared,
-- this assumption implies that $o2$ either precedes $o1$ or is equal to it.
--
	(o1,o2)-->T31 ==> (o2 in o1) or (o1 = o2)
--
-- But since, for ordinals, membership implies inclusion, Theorem well_ordered_set_0b
-- shows that  the $o1$-th element of $s$ cannot precede the $o2$-th element of s.
-- This contradiction proves our theorem.
--
	(o1,o2)-->T34 ==> (o2 in o1) imp (o2 incin o1)
	ELEM ==> o2 incin o1
	Set_monot ==> (s - {ordenm_thryvar(y): y in o1}) incin (s - {ordenm_thryvar(y): y in o2})
	ELEM ==> ((s - {ordenm_thryvar(y): y in o1}) /= 0) & ((s - {ordenm_thryvar(y): y in o2}) incin s)
	(s - {ordenm_thryvar(y): y in o2},s,s - {ordenm_thryvar(y): y in o1})-->Twell_founded_set.0b ==>
	 (not arg1_bef_arg2(Minrel1_thryvar(s - {ordenm_thryvar(y): y in o1}),Minrel1_thryvar(s - {ordenm_thryvar(y): y in o2})))
    Use_def(ordenm_thryvar) ==> ordenm_thryvar(o2) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in o2})
    Use_def(ordenm_thryvar) ==> ordenm_thryvar(o1) = Minrel1_thryvar(s - {ordenm_thryvar(y): y in o1})
    EQUAL ==> false; Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Next we show that the enumerator, restricted to any ordinal $v$, enumerates a
-- superset of the 'segment' of $s$ consisting of all elements of $s$ which precede the $v$-th:
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.6: {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} incin {ordenm_thryvar(x): x in V}. Proof:
--
-- Proceed by contradiction, and let $v$ be a counterexample, so that there is
-- some element $b$ of $s$ such that $arg1_bef_arg2(b,ordenm_thryvar(v))$ which
-- differs from the image $ordenm_thryvar(x)$ of any $x in v$.
--
    Suppose_not(v) ==> Stat1: not ({u: u in s |  arg1_bef_arg2(u,ordenm_thryvar(v))} incin {ordenm_thryvar(u): u in v})
	b-->Stat1 ==> Stat2: (b in {u: u in s |  arg1_bef_arg2(u,ordenm_thryvar(v))}) &
				Stat3: (b notin {ordenm_thryvar(u): u in v})
	bp-->Stat2 ==> (b = bp) & (b in s) & arg1_bef_arg2(bp,ordenm_thryvar(v))
        EQUAL ==> arg1_bef_arg2(b,ordenm_thryvar(v))
--
-- By Theorem well_founded_set.1, no element of $s - {ordenm_thryvar(y): y in v}$ can precede ordenm_thryvar(v).
-- In particular, $b$ cannot precede $ordenm_thryvar(v)$. This contradiction proves our theorem.
--
	ELEM ==> (b in (s - {ordenm_thryvar(u): u in v})) & (not (s incin {ordenm_thryvar(u): u in v}))
	(s,v)-->Twell_founded_set.1 ==>
	Stat4: (FORALL y in (s - {ordenm_thryvar(y): y in v}) | (not arg1_bef_arg2(y,ordenm_thryvar(v))))
	b-->Stat4 ==> (not arg1_bef_arg2(b,ordenm_thryvar(v)))
    Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Our next theorem asserts that distinct ordinals whose images under the enumerator
-- differ from (and hence belong to) $s$, have different images.
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.7: [Well-ordering is initially 1-1]
	 (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s) & (U /= V)) imp (ordenm_thryvar(U) /= ordenm_thryvar(V)). Proof:
    Suppose_not(o1,o2) ==>
	 Ord(o1) & Ord(o2) & (ordenm_thryvar(o1) /= s) & (ordenm_thryvar(o2) /= s) & (o1 /= o2) & (ordenm_thryvar(o1) = ordenm_thryvar(o2))
--
-- Proceed by contradiction, and let the ordinals $o1$, $o2$ be a counterexample.
-- It follows by theorems well_founded_set.1 and well_founded_set.2
-- that the image of $o1$ (resp. $o2$) lies outside ${ordenm_thryvar(y): y in o1}$
-- (resp. ${ordenm_thryvar(y): y in o2}$).
--
	(s,o1)-->Twell_founded_set.2 ==> not(s incin {ordenm_thryvar(y): y in o1})
	(s,o2)-->Twell_founded_set.2 ==> not(s incin {ordenm_thryvar(y): y in o2})
	(s,o1)-->Twell_founded_set.1 ==> ordenm_thryvar(o1) in (s - {ordenm_thryvar(y): y in o1})
	(s,o2)-->Twell_founded_set.1 ==> ordenm_thryvar(o2) in (s - {ordenm_thryvar(y): y in o2})
--
-- Given two distinct ordinals, one always precedes the other: assume first that $o1$ belongs to $o2$.
-- Then obviously the image of $o1$ is image of an element of $o2$, a contradiction.
--
	(o1,o2)-->T31 ==> (o1 in o2) or (o2 in o1)
	Suppose ==> o1 in o2
	Suppose ==> Stat1: ordenm_thryvar(o1) notin {ordenm_thryvar(y): y in o2}
	o1-->Stat1 ==> false; Discharge ==> ordenm_thryvar(o1) in {ordenm_thryvar(y): y in o2}
    Discharge ==> o2 in o1
--
-- A similar contradiction results if $o2$ belongs to $o1$. This shows that our
-- original assumption is false, and so completes our proof.
--
    Suppose ==> Stat2: ordenm_thryvar(o2) notin {ordenm_thryvar(y): y in o1}
    o2-->Stat2 ==> false; Discharge ==> ordenm_thryvar(o2) in {ordenm_thryvar(y): y in o1}
    Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- The following theorem asserts that for every $s$ there is an ordinal $o$ such that the restriction
-- to $o$ of the enumerator is a 1-1 map from $s$ onto $s$.
-- ----------------------------------------------------------------------------------------------
--
Theorem well_founded_set.8:
    (EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))). Proof:
--
-- Proceeding by contradiction, assume the theorem to be false.
--
    Suppose_not ==>
    	Stat1: not(EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
				& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))
--
-- We first show that there is at least one ordinal in $next(#pow(s))$ whose image under
-- the enumerator is all of $s$. For assume the contrary.  The cardinality of $pow(s)$
-- is an ordinal which must be different from $#s$. Hence by Theorem well_founded_set.2
-- the set ${ordenm_thryvar(y): y in #pow(s)}$ of images of elements of $#pow(s)$ cannot include $s$.
--
    (pow(s))-->T156 ==> Card(#pow(s)) & Ord(#pow(s))
    (#pow(s))-->T32 ==> Ord(next(#pow(s)))
    Suppose ==> Stat2: not(EXISTS o in next(#pow(s)) | (Ord(o) & (ordenm_thryvar(o) = s)))
    Use_def(next) ==> next(#pow(s)) = #pow(s) + {#pow(s)}
    ELEM ==> #pow(s) in next(#pow(s))
    (#pow(s))-->Stat2 ==> ordenm_thryvar(#pow(s)) /= s
     (s,#pow(s))-->Twell_founded_set.2 ==> not(s incin {ordenm_thryvar(y): y in #pow(s)})
--
-- But ${ordenm_thryvar(y): y in #pow(s)}$ must be included in $s$, for otherwise some element $ordenm_thryvar(b)$,
-- with $b in #pow(s)$ would lie outside $s$, whereas by definition $ordenm_thryvar(b)$
-- must belong to $s$.
--
    Suppose ==> Stat3: not ({ordenm_thryvar(o): o in #pow(s)} incin s)
    b1-->Stat3 ==> (b1 notin s) & Stat4: (b1 in {ordenm_thryvar(o): o in #pow(s)})
    b-->Stat4 ==> (b in #pow(s)) & (ordenm_thryvar(b) notin s)
    (next(#pow(s)),b)-->T12 ==> Ord(b)
    (next(#pow(s)),b)-->T13 ==> b incin #pow(s)
    Set_monot ==> (s - {ordenm_thryvar(y): y in #pow(s)}) incin (s - {ordenm_thryvar(y): y in b})
    ELEM ==>  not(s incin {ordenm_thryvar(y): y in b})
    (s,b)-->Twell_founded_set.1 ==> ordenm_thryvar(b) in (s - {ordenm_thryvar(y): y in b})
    Discharge ==> {ordenm_thryvar(o): o in #pow(s)} incin s
--
-- We can use our general 'fcn_symbol' theory to form a single-valued map $f$
-- which pairs each element of $#pow(s)$ to its image under the enumerator.
-- The following properties of this map result automatically:
--
	Loc_def ==> f = {[x,ordenm_thryvar(x)]: x in #pow(s)}
    APPLY(x9_thryvar:d1,y9_thryvar:d2) fcn_symbol(f(x)->ordenm_thryvar(x),g->f,s->#pow(s)) ==>
		Svm(f) & (domain(f) = #pow(s)) & (range(f) = {ordenm_thryvar(x): x in #pow(s)}) &
	 (((d1 in #pow(s)) & (d2 in #pow(s)) & (ordenm_thryvar(d1) = ordenm_thryvar(d2)) & (d1 /= d2)) or one_1_map(f))
--
-- But then the distinct elements $d1$, $d2$ cannot have the same image under the map $f$.
-- Indeed, since $d1$ and $d2$ belong to the ordinal $#pow(s)$,
-- they are ordinals included in $#pow(s)$; which by set monotonicity tells us that
-- neither ${ordenm_thryvar(y): y in d1}$ nor ${ordenm_thryvar(y): y in d2}$ can include $s$.
--
    Suppose ==> (d1 in #pow(s)) & (d2 in #pow(s)) & (ordenm_thryvar(d1) = ordenm_thryvar(d2)) & (d1 /= d2)
    (#pow(s),d1)-->T12 ==> Ord(d1)
    (#pow(s),d2)-->T12 ==> Ord(d2)
    (#pow(s),d1)-->T13 ==> d1 incin #pow(s)
    (#pow(s),d2)-->T13 ==> d2 incin #pow(s)
    Set_monot ==> {ordenm_thryvar(y): y in d1} incin {ordenm_thryvar(y): y in #pow(s)}
    Set_monot ==> {ordenm_thryvar(y): y in d2} incin {ordenm_thryvar(y): y in #pow(s)}
    ELEM ==> not (s incin {ordenm_thryvar(y): y in d1}) & (not (s incin {ordenm_thryvar(y): y in d2}))
--
-- But now Theorem well_founded_set.2 and Theorem well_founded_set.7 tell us that
-- $ordenm_thryvar(d1)$ and $ordenm_thryvar(d1)$ must be different, a contradiction which shows $f$ is one-one.
--
   (s,d1)-->Twell_founded_set.2 ==> ordenm_thryvar(d1) /= s
   (s,d2)-->Twell_founded_set.2 ==> ordenm_thryvar(d2) /= s
   (d1,d2)-->Twell_founded_set.7 ==> false; Discharge ==> one_1_map(f)
--
-- Since the domain and range of the 1-1 mapping $f$ have the same cardinality but are
-- $next(#pow(s))$ and a subset of $s$ respectively, it follows that $next(#pow(s))$
-- is less than or equal to the cardinality of $s$, violating Cantor's theorem. This refutes
-- our assumption that there is no ordinal in  $next(#pow(s))$ whose image under the enumerator is $s$.
--
    f-->T157 ==> #range(f) = #domain(f)
    EQUAL ==> #range(f) = ##pow(s)
    EQUAL ==> #{ordenm_thryvar(x): x in #pow(s)} = ##pow(s)
    (pow(s))-->T166 ==> #{ordenm_thryvar(x): x in #pow(s)} = #pow(s)
    ({ordenm_thryvar(x): x in #pow(s)},s)-->T170 ==> #pow(s) incin #s
    s-->T265 ==> #s in #pow(s)
    Discharge ==> Stat5: (EXISTS o in next(#pow(s)) | Ord(o) & (ordenm_thryvar(o) = s))
--
-- Having now established that there is an ordinal in  $next(#pow(s))$ whose image under the enumerator is $s$,
-- we give the smallest such ordinal the name $o$.
--
    o1-->Stat5 ==> (o1 in next(#pow(s))) & Ord(o1) & (ordenm_thryvar(o1) = s)
    APPLY(mt1_thryvar:o) transfinite_induction(n->o1,p(x)->((x in next(#pow(s))) & Ord(x) & (ordenm_thryvar(x) = s))) ==>
		Stat6: (FORALL x | (o in next(#pow(s))) & Ord(o) & (ordenm_thryvar(o) = s) &
			((x in o) imp (not((x in next(#pow(s))) & Ord(x) & (ordenm_thryvar(x) = s)))))
--
-- It follows from our initial hypothesis that either there is some element of $o in next(#pow(s))$
-- whose image is $s$, or the set of images of the elements of $o$ is different from $s$,
-- or the restriction of the enumerator to $o$ fails to be 1-1.
-- We consider these three possibilities in turn.
--
	a0-->Stat6 ==> (o in next(#pow(s))) & Ord(o) & (ordenm_thryvar(o) = s)
    o-->Stat1 ==> (s /= {ordenm_thryvar(x): x in o}) or (not(FORALL x in o | (ordenm_thryvar(x) /= s)))
								 or (not one_1_map({[x,ordenm_thryvar(x)]: x in o}))
--
-- Case 1. Suppose that there is some element $x$ of $o$ whose image under the enumerator is $s$.
-- Since $x$ must be an ordinal, this conflicts with the assumed minimality of $o$,
-- and so disposes of Case 1.
--
    Suppose ==> Stat7: not (FORALL x in o | ordenm_thryvar(x) /= s)
    (#pow(s))-->T32 ==> Ord(next(#pow(s)))
    x-->Stat7 ==> (x in o) & (ordenm_thryvar(x) = s)
    (next(#pow(s)),o)-->T13 ==> o incin next(#pow(s))
    ELEM ==> x in next(#pow(s))
    (o,x)-->T12 ==> Ord(x)
    x-->Stat6 ==> false; Discharge ==> Stat8: (FORALL x in o | ordenm_thryvar(x) /= s)
--
-- Theorem well_founded_set.3 now tells us ${ordenm_thryvar(y): y in o}$ must be a subset of $s$;
--
    Suppose ==> Stat9: not({ordenm_thryvar(y): y in o} incin s)
    c-->Stat9 ==> Stat10: (c in {ordenm_thryvar(y): y in o}) & (c notin s)
    y-->Stat10 ==> (y in o) & (ordenm_thryvar(y) notin s)
    y-->Stat8 ==> ordenm_thryvar(y) /= s
    y-->Twell_founded_set.3 ==> ordenm_thryvar(y) in s
    Discharge ==> {ordenm_thryvar(y): y in o} incin s
--
-- Case 2. Now suppose that ${ordenm_thryvar(y): y in o}$
-- is a proper subset of $s$. Then Theorem well_founded_set.2 tells us that
-- $ordenm_thryvar(o)$ is a member of $s$ and so is different from $s$, ruling out this case.
--
    Suppose ==> s /= {ordenm_thryvar(y): y in o}
    ELEM ==> not(s incin {ordenm_thryvar(y): y in o})
    (s,o)-->Twell_founded_set.2 ==> ordenm_thryvar(o) /= s
    Discharge ==> not one_1_map({[x,ordenm_thryvar(x)]: x in o})
--
-- Case 3. Finally, suppose that the restriction $h$ of the enumerator to $o$ is not 1-1,
-- and let $u,v$ be different elements of $o$ which have the same image under the map $h$.
-- Then $u$ and $v$ belong to $o$ and so must both be ordinals.
-- Moreover, since they belong to $o$ and $ordenm_thryvar(x) /= s$ for every element $x$ of $o$,
-- $ordenm_thryvar(u)$ and $ordenm_thryvar(v)$ both differ from $s$. Hence by well_founded_set.7
-- $ordenm_thryvar(u) /= ordenm_thryvar(v)$. This contradiction shows that $h$ is one-one, eliminating
-- the last of our three cases and so proving our theorem.
--
	Loc_def ==> h = {[x,ordenm_thryvar(x)]: x in o}
    APPLY(x9_thryvar:u,y9_thryvar:v) fcn_symbol(f(x)->ordenm_thryvar(x),g->h,s->o) ==>
		Svm(h) & (domain(h) = o) & (range(h) = {ordenm_thryvar(x): x in o}) &
	 		(((u in o) & (v in o) & (ordenm_thryvar(u) = ordenm_thryvar(v)) & (u /= v)) or one_1_map(h))
    Suppose ==> Stat11: (u in o) & (v in o) & (ordenm_thryvar(u) = ordenm_thryvar(v)) & (u /= v)
    (o,u)-->T12 ==> Ord(u)
    (o,v)-->T12 ==> Ord(v)
    u-->Stat8 ==> ordenm_thryvar(u) /= s
    v-->Stat8 ==> ordenm_thryvar(v) /= s
    (u,v)-->Twell_founded_set.7 ==> one_1_map({[x,ordenm_thryvar(x)]: x in o})
    Discharge ==> one_1_map(h)
    EQUAL ==> false; Discharge ==> QED
--
-- We can now make the following definition, convenient for subsequent application.
--
Def well_founded_set.b: [?] ord_thryvar := arb({o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))})
--
-- This last definition lets us reformulate the preceding theorem as follows.
--
Theorem well_founded_set.9:
    (ord_thryvar in next(#pow(s))) & Ord(ord_thryvar) & (s = {ordenm_thryvar(x): x in ord_thryvar})
			& (FORALL x in ord_thryvar | (ordenm_thryvar(x) /= s)) &
				one_1_map({[x,ordenm_thryvar(x)]: x in ord_thryvar}). Proof:
	Suppose_not ==> not((ord_thryvar in next(#pow(s))) & Ord(ord_thryvar) & (s = {ordenm_thryvar(x): x in ord_thryvar})
			& (FORALL x in ord_thryvar | (ordenm_thryvar(x) /= s)) &
				one_1_map({[x,ordenm_thryvar(x)]: x in ord_thryvar}))
	Twell_founded_set.8 ==> Stat1: (EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))
	o-->Stat1 ==> (o in next(#pow(s))) & Ord(o) & (s = {ordenm_thryvar(x): x in o})
			& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})
	Suppose ==> Stat2: o notin {o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))}
	o-->Stat2 ==> false; Discharge ==> o in {o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))}
	ELEM ==> 0 /= {o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))}
	({o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o}) & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))})-->T0 ==>
		arb({o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))}) in
			 	{o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))}
	Use_def(ord_thryvar) ==> Stat3: ord_thryvar in {o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))}
	()-->Stat3 ==> false; Discharge ==> QED
--
-- The results just proved can be summarized as follows:
--
ENTER_THEORY Set_theory
--
--DISPLAY well_founded_set
--
--THEORY well_founded_set(s,arg1_bef_arg2(y,x));
--    (FORALL t incin s | ((t /= 0) imp (EXISTS x in t | (FORALL y in t | (not arg1_bef_arg2(y,x))))))
--==>(Minrel1_thryvar,ordenm_thryvar,ord_thryvar)
--    (FORALL x in s, y in s | ((arg1_bef_arg2(x,y) imp (not arg1_bef_arg2(y,x))) & (not arg1_bef_arg2(x,x))))
--    (FORALL x in OM | (not(s incin {ordenm_thryvar(y): y in X})) imp ((ordenm_thryvar(X) in (s - {ordenm_thryvar(y): y in X}))
--	 			& (FORALL y in (s - {ordenm_thryvar(y): y in X}) | not(arg1_bef_arg2(y,ordenm_thryvar(X))))))
--    (FORALL x in OM | (s incin {ordenm_thryvar(y): y in X}) eq (ordenm_thryvar(X) = s))
--    (FORALL x in OM | (ordenm_thryvar(X) /= s) imp (ordenm_thryvar(X) in s))
--    (FORALL u in OM, v in OM | (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & --arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V)) imp (U in V)))
--    (FORALL v in OM | {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} incin {ordenm_thryvar(x): x in V})
--    (FORALL u in OM, v in OM | (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s) & (U /= V)) imp (ordenm_thryvar(U) /= ordenm_thryvar(V)))
--    (ord_thryvar in next(#pow(s))) & Ord(o) & (s = {ordenm_thryvar(x): x in ord_thryvar})
--			 & (FORALL x in ord_thryvar | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in ord_thryvar})
--    (FORALL t in OM | Minrel1_thryvar(t) = if (t incin s) & (t /= 0) then
--		arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) else s end if)
--END well_founded_set;
--
-- ----------------------------------------------------------------------------------------------
-- ----------------------------------------------------------------------------------------------
-- Our next theory, which extends the previous,  concerns binary relations
-- which strictly well-order a given domain $s$.
-- This means that the relation is transitive linear (sometimes called 'trichotomic')
-- and irreflexive on $s$, and that each non-null subset $t$ of this domain
-- has an element which precedes every other element of $t$ in the ordering.
-- We show that any such relation is order-isomorphic to the membership
-- relator on an ordinal in 1-1 ordered correspondence with the set.
--
THEORY well_ordered_set(s,arg1_bef_arg2(x,y))
    (FORALL x in s | (not arg1_bef_arg2(x,x)))
	(FORALL x in s, y in s, wz in s | ((arg1_bef_arg2(x,y) & arg1_bef_arg2(y,wz)) imp arg1_bef_arg2(x,wz)))
	(FORALL t incin s | ((t /= 0) imp (EXISTS x in t | (FORALL y in t | (arg1_bef_arg2(x,y) or (x = y))))))
END well_ordered_set;
--
ENTER_THEORY well_ordered_set
--
-- ----------------------------------------------------------------------------------------------
-- Trichotomy, which does not appear as an explicit theory assumption, will now be derived from
-- the assumption concerning minima; moreover, we will show that
-- each non-null set $t$ of the ordered domain has a minimal element,
-- that is an element which does not follow any other element of $t$ in the ordering.
-- ----------------------------------------------------------------------------------------------
--
Theorem well_ordered_set.0: ((X in s) & (Y in s)) imp (arg1_bef_arg2(X,Y) or arg1_bef_arg2(Y,X) or (X = Y)). Proof:
--
-- We proceed by contradiction. Suppose that our theorem is false, and let $x$, $y$, and $t$ be a counterexample.
--
    Suppose_not(x,y) ==> (x in s) & (y in s) & (not arg1_bef_arg2(x,y)) and (not arg1_bef_arg2(y,x)) and (x /= y)
--
-- If the asserted trichotomy does not hold, there must exist elements $x$, $y$ of $s$ which cannot be compared.
-- But these would form a doubleton without minimum, contradicting one of our assumptions.
--
	 Assump ==> Stat1: (FORALL t incin s | ((t /= 0) imp
								(EXISTS u in t | (FORALL v in t | (arg1_bef_arg2(u,v) or (u = v))))))
	 ELEM ==> ({x,y} incin s) & ({x,y} /= 0)
	 ({x,y})-->Stat1 ==>
	 		Stat2: (EXISTS x1 in {x,y} | (FORALL y1 in {x,y} | (arg1_bef_arg2(x1,y1) or (x1 = y1))))
	 u-->Stat2 ==> (u in {x,y}) & Stat3: (FORALL v in {x,y} | (arg1_bef_arg2(u,v) or (u = v)))
	 ELEM ==> ((u = x) or (u = y)) & (x in {x,y}) & (y in {x,y})
	 Suppose ==> u = x
	y-->Stat3 ==> arg1_bef_arg2(u,y) or (u = y)
	EQUAL ==> false; Discharge ==> u = y
	 x-->Stat3 ==> arg1_bef_arg2(u,x) or (u = x)
	EQUAL ==> false; Discharge ==> QED
--
Theorem well_ordered_set.0a: ((T incin s) & (T /= 0)) imp (EXISTS x in T | (FORALL y in T | (not arg1_bef_arg2(y,x)))). Proof:
	Suppose_not(t) ==> (t incin s) & (t /= 0) & Stat1: (not (EXISTS x in t | (FORALL y in t | (not arg1_bef_arg2(y,x)))))
--
-- Assuming the contrary, there must exist a non-null subset $t$ of $s$ each of whose
-- elements has at least one predecessor. On the other hand,
-- we know that $t$ has an element $v$ which precedes every other element of $t$: this element
-- cannot have any predecessors, else the irreflexivity of the ordering relation would be violated.
--
	Assump ==> Stat2: (FORALL t incin s |
					((t /= 0) imp (EXISTS x in t | (FORALL y in t | (arg1_bef_arg2(x,y) or (x = y))))))
	t-->Stat2 ==> Stat3: (EXISTS x in t | (FORALL y in t | (arg1_bef_arg2(x,y) or (x = y))))
	v-->Stat3 ==> (v in t) & Stat4: (FORALL y in t | (arg1_bef_arg2(v,y) or (v = y)))
	v-->Stat1 ==> Stat5: not (FORALL y in t | (not arg1_bef_arg2(y,v)))
	w-->Stat5 ==> (w in t) & arg1_bef_arg2(w,v)
	w-->Stat4 ==> arg1_bef_arg2(v,w) or (v = w)
	ELEM ==> (v in s) & (w in s)
	Assump ==> Stat6: (FORALL x in s | (not arg1_bef_arg2(x,x)))
	v-->Stat6 ==> not arg1_bef_arg2(v,v)
	Suppose ==> v = w
	EQUAL ==> false; Discharge ==> arg1_bef_arg2(v,w)
	Assump ==> Stat7: (FORALL x in s, y in s, wz in s |
					((arg1_bef_arg2(x,y) & arg1_bef_arg2(y,wz)) imp arg1_bef_arg2(x,wz)))
	(v,w,v)-->Stat7 ==> false; Discharge ==> QED
--
-- We can now import all theorems of the theory well_founded_set into the present theory.
--
	APPLY(Minrel1_thryvar:Minrel2_thryvar,ordenm_thryvar:ordenm_thryvar)
			well_founded_set(s->s,arg1_bef_arg2(x,y)->arg1_bef_arg2(x,y)) ==>
Theorem well_ordered_set.100:
	(FORALL x,y | ((x in s) & (y in s)) imp ((not (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x))) & (not arg1_bef_arg2(x,x)))) &
	(FORALL x | (not(s incin {ordenm_thryvar(y): y in x})) imp ((ordenm_thryvar(x) in (s - {ordenm_thryvar(y): y in x})) &
			(FORALL y in (s - {ordenm_thryvar(y): y in x}) | not(arg1_bef_arg2(y,ordenm_thryvar(x)))))) &
	(FORALL x | (s incin {ordenm_thryvar(y): y in x}) eq (ordenm_thryvar(x) = s)) &
	(FORALL x | (ordenm_thryvar(x) /= s) imp (ordenm_thryvar(x) in s)) &
	(FORALL u, v | (Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) & arg1_bef_arg2(ordenm_thryvar(u),ordenm_thryvar(v))) imp (u in v)) &
	(FORALL v | {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(v))} incin {ordenm_thryvar(x): x in v}) &
	(FORALL u, v | (Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) & (ordenm_thryvar(v) /= s) & (u /= v)) imp
			(ordenm_thryvar(u) /= ordenm_thryvar(v))) &
	(EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))) &
	(FORALL x | ordenm_thryvar(x) = Minrel2_thryvar(s - {ordenm_thryvar(y): y in x})) &
	(FORALL t | Minrel2_thryvar(t) = if (t incin s) & (t /= 0) then
				arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) else s end if)
--
Theorem well_ordered_set.10:  ((X in s) & (Y in s)) imp
		 	((arg1_bef_arg2(X,Y) imp (not arg1_bef_arg2(Y,X))) &
		 		(not arg1_bef_arg2(X,X))). Proof:
	Suppose_not(x,y) ==> ((x in s) & (y in s))  &
		 	(not ((arg1_bef_arg2(x,y) imp (not arg1_bef_arg2(y,x))) &
		 		(not arg1_bef_arg2(x,x))))
    Twell_ordered_set.100 ==> Stat1: (FORALL x,y | ((x in s) & (y in s)) imp
    			((not (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x))) & (not arg1_bef_arg2(x,x))))
    (x,y)-->Stat1 ==> ((x in s) & (y in s)) imp
		 	((arg1_bef_arg2(x,y) imp (not arg1_bef_arg2(y,x))) &
		 		(not arg1_bef_arg2(x,x)))
	Discharge ==> QED
--
Theorem well_ordered_set.1:  (not(s incin {ordenm_thryvar(y): y in X})) imp
	((ordenm_thryvar(X) in (s - {ordenm_thryvar(y): y in X})) &
		(FORALL y in (s - {ordenm_thryvar(y): y in X}) | not(arg1_bef_arg2(y,ordenm_thryvar(X))))). Proof:
 	Suppose_not(x) ==> (not(not(s incin {ordenm_thryvar(y): y in X})) imp
	((ordenm_thryvar(x) in (s - {ordenm_thryvar(y): y in x})) &
		(FORALL y in (s - {ordenm_thryvar(y): y in x}) | not(arg1_bef_arg2(y,ordenm_thryvar(x))))))
    Twell_ordered_set.100 ==> Stat1: (FORALL x | (not(s incin {ordenm_thryvar(y): y in X})) imp
    		((ordenm_thryvar(X) in (s - {ordenm_thryvar(y): y in X})) &
	 	(FORALL y in (s - {ordenm_thryvar(y): y in X}) | not(arg1_bef_arg2(y,ordenm_thryvar(X))))))
    x-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.2:  ((s incin {ordenm_thryvar(y): y in X}) eq (ordenm_thryvar(X) = s)). Proof:
  	Suppose_not(x) ==> not((s incin {ordenm_thryvar(y): y in x}) eq (ordenm_thryvar(x) = s))
    Twell_ordered_set.100 ==> Stat1: (FORALL x | (s incin {ordenm_thryvar(y): y in X}) eq (ordenm_thryvar(X) = s))
    x-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.3:  ((ordenm_thryvar(X) /= s) imp (ordenm_thryvar(X) in s)). Proof:
 	Suppose_not(x) ==> not((ordenm_thryvar(x) /= s) imp (ordenm_thryvar(x) in s))
    Twell_ordered_set.100 ==> Stat1: (FORALL x | (ordenm_thryvar(X) /= s) imp (ordenm_thryvar(X) in s))
    x-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.5a:
	(Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V))) imp (U in V). Proof:
 	Suppose_not(u,v) ==>
 		not((Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) & arg1_bef_arg2(ordenm_thryvar(u),ordenm_thryvar(v))) imp (u in v))
    Twell_ordered_set.100 ==> Stat1: (FORALL u, v | (Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) &
			arg1_bef_arg2(ordenm_thryvar(u),ordenm_thryvar(v))) imp (u in v))
    (u,v)-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.6a: ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} incin {ordenm_thryvar(x): x in V}). Proof:
  	Suppose_not(v) ==>  not({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(v))} incin {ordenm_thryvar(x): x in v})
    Twell_ordered_set.100 ==> Stat1: (FORALL v | {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} incin {ordenm_thryvar(x): x in V})
    v-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.7:  ((Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) &
	(ordenm_thryvar(V) /= s) & (U /= V)) imp (ordenm_thryvar(U) /= ordenm_thryvar(V))). Proof:
 	Suppose_not(u,v) ==>  not((Ord(u) & Ord(v) & (ordenm_thryvar(u) /= s) &
	(ordenm_thryvar(v) /= s) & (u /= v)) imp (ordenm_thryvar(u) /= ordenm_thryvar(v)))
    Twell_ordered_set.100 ==> Stat1: (FORALL u, v | (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s) & (U /= V)) imp (ordenm_thryvar(U) /= ordenm_thryvar(V)))
   (u,v)-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.8:  (EXISTS o | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o}))). Proof:
 	Suppose_not ==>  Stat1: not(EXISTS o | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
		& (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))
    Twell_ordered_set.100 ==> Stat2: (EXISTS o in next(#pow(s)) | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
			 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))
	o1-->Stat2 ==> (Ord(o1) & (s = {ordenm_thryvar(x): x in o1})
			 & (FORALL x in o1 | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o1}))
    o1-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.8a: ordenm_thryvar(X) = Minrel2_thryvar(s - {ordenm_thryvar(y): y in X}). Proof:
	Suppose_not(x) ==> ordenm_thryvar(x) /= Minrel2_thryvar(s - {ordenm_thryvar(y): y in x})
	Twell_ordered_set.100 ==> Stat1: (FORALL x | ordenm_thryvar(x) = Minrel2_thryvar(s - {ordenm_thryvar(y): y in x}))
	x-->Stat1 ==> false; Discharge ==> QED
--
Theorem well_ordered_set.8b: Minrel2_thryvar(T) = if (T incin s) & (T /= 0) then
		arb({m: m in T | (FORALL y in T | (not arg1_bef_arg2(y,m)))}) else s end if. Proof:
	Suppose_not(t) ==> Minrel2_thryvar(t) /= if (t incin s) & (t /= 0) then
			arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) else s end if
	Twell_ordered_set.100 ==> Stat1: (FORALL t | Minrel2_thryvar(t) = if (t incin s) & (t /= 0) then
		arb({m: m in t | (FORALL y in t | (not arg1_bef_arg2(y,m)))}) else s end if)
	t-->Stat1 ==> false; Discharge ==> QED
--
-- This mechanical transition being accomplished, our next theorem tells us that the enumerator,
-- restricted to ordinals, conforms to the linear ordering of $s$:
--
Theorem well_ordered_set.5: [Any well-ordering is isomorphic to an ordinal enumeration]
 (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s)) imp (arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V)) eq (U in V)). Proof:
--
-- For if the ordinals $o1$, $o2$ are a counterexample to the asserted statement...
--
    Suppose_not(o1,o2) ==>
	Ord(o1) & Ord(o2) & (ordenm_thryvar(o1) /= s) & (ordenm_thryvar(o2) /= s) & (not(arg1_bef_arg2(ordenm_thryvar(o1),ordenm_thryvar(o2)) eq (o1 in o2)))
--
-- ...then it follows from well_ordered_set.5a that the negated equivalence
-- is satisfied with its left-hand side false and its right-hand side true
--
	Suppose ==> arg1_bef_arg2(ordenm_thryvar(o1),ordenm_thryvar(o2)) & (o1 notin o2)
	(o1,o2)-->Twell_ordered_set.5a ==> false; Discharge ==> (not arg1_bef_arg2(ordenm_thryvar(o1),ordenm_thryvar(o2))) & (o1 in o2)
--
-- However, since the images of $o1$ an $o2$ via the enumerator $ordenm_thryvar$ both
-- belong to $s$, trichotomy implies that $ordenm_thryvar(o1)$ and $ordenm_thryvar(o2)$ can be compared.
	o1-->Twell_ordered_set.3 ==> ordenm_thryvar(o1) in s
	o2-->Twell_ordered_set.3 ==> ordenm_thryvar(o2) in s
	(ordenm_thryvar(o1),s,ordenm_thryvar(o2))-->Twell_ordered_set.0 ==>
	arg1_bef_arg2(ordenm_thryvar(o2),ordenm_thryvar(o1)) or (ordenm_thryvar(o1) = ordenm_thryvar(o2))
-- Neither ordenm_thryvar(o1) = ordenm_thryvar(o2) nor the only residual alternative can hold, though;
	(o1,o2)-->Twell_ordered_set.7 ==> arg1_bef_arg2(ordenm_thryvar(o2),ordenm_thryvar(o1))
-- and hence we are led to the desired contradiction.
    (o2,o1)-->Twell_ordered_set.5a ==> false; Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Next we show that the enumerator '$ordenm_thryvar$', restricted to an ordinal $v$
-- for which $ordenm_thryvar(v)$ belongs to $s$, enumerates the segment of $s$ consisting
-- of all elements which precede the $v$-th:
-- ----------------------------------------------------------------------------------------------
--
Theorem well_ordered_set.6: (Ord(V) & (ordenm_thryvar(V) /= s)) imp ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} = {ordenm_thryvar(x): x in V}). Proof:
    Suppose_not(o) ==> (Ord(o) & (ordenm_thryvar(o) /= s) & ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(o))} /= {ordenm_thryvar(u): u in o}))
--
-- Proceed by contradiction, and use transfinite induction to find the least ordinal $o$
-- for which our assertion is false.
--
    (s,o)-->Twell_ordered_set.6a ==> not({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(o))} incs {ordenm_thryvar(u): u in o})
    APPLY(mt1_thryvar:o1) transfinite_induction(n->o,P(x)->(Ord(x) & (ordenm_thryvar(x) /= s) & (not({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(x))} incs {ordenm_thryvar(u): u in x})))) ==>
	Stat1:	(FORALL x | Ord(o1) & (ordenm_thryvar(o1) /= s) & (not({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(o1))} incs {ordenm_thryvar(u): u in o1})) &
	((x in o1) imp (not(Ord(x) & (ordenm_thryvar(x) /= s) & (not({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(x))} incs {ordenm_thryvar(u): u in x}))))))
   0-->Stat1 ==> Ord(o1) & (ordenm_thryvar(o1) /= s) & Stat2: (not({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(o1))} incs {ordenm_thryvar(u): u in o1}))
--
-- Then since $ordenm_thryvar(o1)$ belongs to $s$, the range of $ordenm_thryvar$ on $o1$ is a proper subset of $s$;
-- and then by definition $ordenm_thryvar(o1)$ must be the least element of $s$ not in this range.
--
    (s,o1)-->Twell_ordered_set.2 ==> (not(s incin {ordenm_thryvar(y): y in o1}))
    (s,o1)-->Twell_ordered_set.1 ==> (ordenm_thryvar(o1) in (s - {ordenm_thryvar(y): y in o1})) &
	 Stat3: (FORALL y in (s - {ordenm_thryvar(y): y in o1}) | not(arg1_bef_arg2(y,ordenm_thryvar(o1))))
--
-- First suppose that there is an $o2 in o1$ such that $ordenm_thryvar(o2)$ does not precede $ordenm_thryvar(o1)$.
-- Then plainly $o2$ is an ordinal and a proper subset of $o1$.
--
    c-->Stat2 ==> Stat4: (c in {ordenm_thryvar(o2): o2 in o1}) & Stat5: (c notin {u: u in s |  arg1_bef_arg2(u,ordenm_thryvar(o1))})
    o2-->Stat4 ==> (c = ordenm_thryvar(o2)) & (o2 in o1)
    (o1,o2)-->T12 ==> Ord(o2)
    (o1,o2)-->T13 ==> o2 incin o1
--
-- Then it follows, since the range of $ordenm_thryvar$ on $o1$ is a proper subset of $s$,
-- that if we remove all images of elements of $o2$ from $s$, a nonempty set $r$  will remain.
-- Then the image of $u$ will be the least elements of $r$.
-- By its minimality, the image of $o1$ must precede the image of $u$,
-- which leads to a contradiction.
--
	Set_monot ==> {ordenm_thryvar(y): y in o1} incs {ordenm_thryvar(y): y in o2}
    ELEM ==> (not(s incin {ordenm_thryvar(y): y in o1})) & ((s - {ordenm_thryvar(y): y in o2}) /= 0)
    o2-->Twell_ordered_set.8a ==> ordenm_thryvar(o2) = Minrel2_thryvar(s - {ordenm_thryvar(y): y in o2})
    (s,o2)-->Twell_ordered_set.1 ==> ordenm_thryvar(o2) in s
    (ordenm_thryvar(o2))-->Stat5 ==> not(arg1_bef_arg2(ordenm_thryvar(o2),ordenm_thryvar(o1)))
--
-- On the other hand, if all images of elements of $o1$ precede the image of $o1$,
-- our initial assumption implies that some predecessor $b$ of the image of $o1$ in $s$
-- is not the image of an element of $o1$.
--
    (o2,o1)-->Twell_ordered_set.5 ==> false; Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- Our next theorem combines the preceding results to prove that when the image of an
-- ordinal under the enumerator differs from (and hence belongs to) $s$, the restriction $g$ of
-- 'ordenm_thryvar' to $v$ is a 1-1 map whose range consists of all predecessors in $s$ of the image of $v$.
-- ----------------------------------------------------------------------------------------------
--
Theorem well_ordered_set.9: (Ord(V) & (ordenm_thryvar(V) /= s)) imp
  ( one_1_map({[x,ordenm_thryvar(x)]: x in V})
   & (domain({[x,ordenm_thryvar(x)]: x in V}) = V)
   & (range({[x,ordenm_thryvar(x)]: x in V}) = {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))})
   & ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} = {ordenm_thryvar(x): x in V})). Proof:
--
-- For consider a counterexample $v$. Using '$fcn_symbol$', we see that
-- $g = {[x,ordenm_thryvar(x)]: x in v}$ is single-valued and has domain $v$. Moreover, if $g$ is not 1-1,
-- there are distinct elements $x$, $y$ of $v$ such that $ordenm_thryvar(x) = ordenm_thryvar(y)$.
--
    Suppose_not(v) ==> Ord(v) & (ordenm_thryvar(v) /= s) & (not(one_1_map({[x,ordenm_thryvar(x)]: x in v}) &
	(domain({[x,ordenm_thryvar(x)]: x in v}) = v) &
	(range({[x,ordenm_thryvar(x)]: x in v}) = {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(v))}) &
	({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(v))} = {ordenm_thryvar(x): x in v})))
	Loc_def ==> g = {[x,ordenm_thryvar(x)]: x in v}
    APPLY(x9_thryvar:x,y9_thryvar:y) fcn_symbol(f(x)->ordenm_thryvar(x),g->g,s->v) ==>
		Svm(g) & (range(g) = {ordenm_thryvar(x): x in v}) & (domain(g) = v) &
	 	(((x in v) & (y in v) & (ordenm_thryvar(x) = ordenm_thryvar(y)) & (x /= y)) or one_1_map(g))
    EQUAL ==> (range({[x,ordenm_thryvar(x)]: x in v}) = {ordenm_thryvar(x): x in v}) & (domain({[x,ordenm_thryvar(x)]: x in v}) = v)
--
-- But the final conjunct in this last formula leads to the following contradiction:
-- since $x$ and $y$ belong to the ordinal $v$ they are ordinals included in $v$.
-- But since $ordenm_thryvar(v) /= s$, Theorem well_ordered_set.2 tells us that
-- $s$ is not included in ${ordenm_thryvar(u): u in v}$.
--
    Suppose ==> (x in v) & (y in v) & (ordenm_thryvar(x) = ordenm_thryvar(y)) & (x /= y)
    (v,x)-->T12 ==> Ord(x)
    (v,y)-->T12 ==> Ord(y)
    (v,x)-->T13 ==> x incin v
    (v,y)-->T13 ==> y incin v
    (s,v)-->Twell_ordered_set.2 ==> not(s incin {ordenm_thryvar(u): u in v})
--
-- It follows that the images under $g$ of $x$ and $y$ both belong to $s$,
-- and then by well_ordered_set.7 they are
-- the same. This  contradiction shows that $g$ is one-one.
--
	Set_monot ==> {ordenm_thryvar(u): u in v} incs {ordenm_thryvar(u): u in x}
	Set_monot ==> {ordenm_thryvar(u): u in v} incs {ordenm_thryvar(u): u in y}
    ELEM ==> (not (s incin {ordenm_thryvar(u): u in x})) & (not (s incin {ordenm_thryvar(u): u in y}))
    (s,x)-->Twell_ordered_set.2 ==> ordenm_thryvar(x) /= s
    (s,y)-->Twell_ordered_set.2 ==> ordenm_thryvar(y) /= s
    (x,y)-->Twell_ordered_set.7 ==> false; Discharge ==> one_1_map(g)
    EQUAL ==> one_1_map({[x,ordenm_thryvar(x)]: x in v})
--
-- We still must prove that $g$ has the stated range,
-- but this is immediate from Theorem well_ordered_set.6,
-- completing the proof of the present theorem.
--
    v-->Twell_ordered_set.6 ==> false; Discharge ==> QED
--
-- ----------------------------------------------------------------------------------------------
-- ----------------------------------------------------------------------------------------------
--
-- The results just proved can be summarized as follows:
--
ENTER_THEORY Set_theory
--
--DISPLAY well_ordered_set
--
--THEORY well_ordered_set(s,arg1_bef_arg2(y,x));
--    (FORALL x in s | (not arg1_bef_arg2(x,x))) &
--    (FORALL x in s, y in s, z in s | ((arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) imp arg1_bef_arg2(x,z))) &
--	 (FORALL t incin s | ((t /= 0) imp (EXISTS x in t, y in t | arg1_bef_arg2(x,y) or x = y)))
--==>(ordenm_thryvar)
--    (FORALL x in s, y in s | (arg1_bef_arg2(x,y) or arg1_bef_arg2(y,x) or x = y))
--    (s incin {ordenm_thryvar(y): y in X}) eq (ordenm_thryvar(X) = s)
--    (ordenm_thryvar(X) /= s) imp (ordenm_thryvar(X) in s)
--	 [ny well-ordering is isomorphic to an ordinal enumeration]
--    (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s)) imp (arg1_bef_arg2(ordenm_thryvar(U),ordenm_thryvar(V)) eq (U in V))
--    (Ord(V) & (ordenm_thryvar(V) /= s)) imp ({u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))} = {ordenm_thryvar(x): x in V})
--    (Ord(U) & Ord(V) & (ordenm_thryvar(U) /= s) & (ordenm_thryvar(V) /= s) & (U /= V)) imp (ordenm_thryvar(U) /= ordenm_thryvar(V))
--    (EXISTS o | (Ord(o) & (s = {ordenm_thryvar(x): x in o})
--					 & (FORALL x in o | (ordenm_thryvar(x) /= s)) & one_1_map({[x,ordenm_thryvar(x)]: x in o})))
--    (Ord(V) & (ordenm_thryvar(V) /= s)) imp
--	 ( one_1_map({[x,ordenm_thryvar(x)]: x in V})
--	 & (domain({[x,ordenm_thryvar(x)]: x in V}) = V)
--	 & (range({[x,ordenm_thryvar(x)]: x in V}) = {u: u in s | arg1_bef_arg2(u,ordenm_thryvar(V))})
--	 & {u: u in s |  arg1_bef_arg2(u,ordenm_thryvar(V))} = {ordenm_thryvar(x): x in V})
--END well_ordered_set;
--
--
--
THEORY inh_well_founded_set(s,arg1_bef_arg2(Y,X),sp,displace(X))
	(FORALL t | ((t incin s) & (t /= 0)) imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
	(FORALL x | (x in sp) imp (displace(x) in s))
END inh_well_founded_set;
--
ENTER_THEORY inh_well_founded_set
--
Theorem inh_well_founded_set1: ((T incin sp) & (T /= 0)) imp (EXISTS w in T | (FORALL v in T | (not arg1_bef_arg2(displace(v),displace(w))))). Proof:
Suppose_not(t0) ==> (t0 incin sp) & (t0 /= 0) & Stat1: (not(EXISTS w in t0 | (FORALL v in t0 | (not arg1_bef_arg2(displace(v),displace(w))))))
	Suppose ==> Stat2: {displace(x): x in t0} nincin s
		c-->Stat2(Stat2*) ==> Stat3: (c in {displace(x): x in t0}) & (c notin s)
		cp-->Stat3(*) ==> (c = displace(cp)) & (cp in sp)
		Assump ==> Stat4: (FORALL x | (x in sp) imp (displace(x) in s))
	cp-->Stat4(Stat3*) ==> false; Discharge ==> AUTO
	Suppose ==> Stat5: {displace(x): x in t0} = 0
		(Stat5*)ELEM ==> Stat6: displace(arb(t0)) notin {displace(x): x in t0}
		(arb(t0))-->Stat6(Stat6*) ==> arb(t0) notin t0
	Discharge ==> AUTO
	Assump ==> Stat7: (FORALL t | ((t incin s) & (t /= 0)) imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
	{displace(x): x in t0}-->Stat7(*) ==> Stat8: (EXISTS w in {displace(x): x in t0} | (FORALL v in {displace(x): x in t0} | (not arg1_bef_arg2(v,w))))
	w-->Stat8(Stat8*) ==> Stat9: (w in {displace(x): x in t0}) & Stat10: (FORALL v in {displace(x): x in t0} | (not arg1_bef_arg2(v,w)))
	w0-->Stat9(Stat9*) ==> (w0 in t0) & (w = displace(w0))
	w0-->Stat1(Stat9*) ==> Stat11: not(FORALL v in t0 | (not arg1_bef_arg2(displace(v),displace(w0))))
	v0-->Stat11(Stat11*) ==> (v0 in t0) & arg1_bef_arg2(displace(v0),displace(w0))
	(displace(v0))-->Stat10(Stat11*) ==> (displace(v0) in {displace(x): x in t0}) imp (not arg1_bef_arg2(displace(v0),w))
	EQUAL(Stat9) ==> Stat12: ((displace(v0) in {displace(x): x in t0}) imp (not arg1_bef_arg2(displace(v0),displace(w0))))
	(Stat11*)ELEM ==> Stat13: displace(v0) notin {displace(x): x in t0}
	v0-->Stat13(Stat11*) ==> false
	Discharge ==> QED
--
-- The results just proved can be summarized as follows:
--
ENTER_THEORY Set_theory
--
--DISPLAY inh_well_founded_set
--
--THEORY inh_well_founded_set(s,arg1_bef_arg2(Y,X),sp,displace(X))
--	(FORALL t | ((t incin s) & (t /= 0)) imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2(v,w)))))
--	(FORALL x | (x in sp) imp (displace(x) in s))
--==>
--	(FORALL t | ((t incin sp) & (t /= 0)) imp (EXISTS w in t | (FORALL v in t | (not arg1_bef_arg2_thryvar(displace(v),displace(w))))))
--END inh_well_founded_set;
--
--
-- Next, in more direct preparation for the proof of the cardinal product theorem at which we aim,
-- we prove various properties of a modified lexicographic ordering of the Cartesian product set $s$ of
-- two ordinals. Our key goal is to show that s is well-ordered by this ordering.
--
THEORY product_order(o1,o2)
    Ord(o1) & Ord(o2)
END product_order;
--
ENTER_THEORY product_order
--
-- The following definition introduces the ordering that we will use: one pair $[x,y]$ of ordinals
-- is less than another pair $[u,v]$ iff either the maximum of $x$ and $y$ is less than the maximum of $u, v$,
-- or if these maxima are equal and $x$ is less than $u$, or if the maxima are equal,
-- $x = u$, and $y$ is less than $v$.
--
Def product_order_c: [Lexicographic ordering of a Cartesian product set] Ord1p2_thryvar(X,Y) := ((car(X) + cdr(X) in car(Y) + cdr(Y)) or
	 ((car(X) + cdr(X) = car(Y) + cdr(Y)) & (car(X) in car(Y))) or
	 ((car(X) + cdr(X) = car(Y) + cdr(Y)) & (car(X) = car(Y)) & (cdr(X) in cdr(Y))))
--
-- We first note, in the three following Lemmas, that for all pairs $[x,y]$ in the Cartesian
-- product of our two ordinals, $x$, $y$, the minimum and the maximum of $x$ and $y$ are ordinals.
-- Our first results are trivial consequences of the fact that any member of an ordinal is also an ordinal.
--
Theorem product_order_1: [The first component of any member of a Cartesian product of ordinals is an ordinal] (X in o1 PROD o2) imp Ord(car(X)). Proof:
    Suppose_not(x) ==> (x in o1 PROD o2) & (not Ord(car(x)))
    Use_def(PROD) ==> Stat1: x in {[u,v]: u in o1, v in o2}
    (a,b)-->Stat1 ==> (x = [a,b]) & (a in o1) & (b in o2)
    Assump ==> Ord(o1) & Ord(o2)
    (o1,a)-->T12 ==> Ord(a)
    ELEM ==> car(x) = a
    EQUAL ==> false; Discharge ==> QED
--
Theorem product_order_2: [The second component of any member of a Cartesian product of ordinals is an ordinal] (X in o1 PROD o2) imp Ord(cdr(X)). Proof:
    Suppose_not(x) ==> (x in o1 PROD o2) & (not Ord(cdr(x)))
    Use_def(PROD) ==> Stat1: x in {[u,v]: u in o1, v in o2}
    (a,b)-->Stat1 ==> (x = [a,b]) & (a in o1) & (b in o2)
    Assump ==> Ord(o1) & Ord(o2)
    (o2,b)-->T12 ==> Ord(b)
    ELEM ==> cdr(x) = b
   	EQUAL ==> false; Discharge ==> QED
--
-- Now we note a trivial consequence of the fact that the maximum of two ordinals is an ordinal.
--
Theorem product_order_3: [The maximum of the components of any member of a Cartesian product of ordinals is an ordinal] (X in o1 PROD o2) imp Ord(car(X) + cdr(X)). Proof:
    Suppose_not(x) ==> (x in o1 PROD o2) & (not Ord(car(x) + cdr(x)))
    Use_def(PROD) ==> Stat1: x in {[u,v]: u in o1, v in o2}
    (a,b)-->Stat1 ==> (x = [a,b]) & (a in o1) & (b in o2)
    Assump ==> Ord(o1) & Ord(o2)
    (o1,a)-->T12 ==> Ord(a)
    (o2,b)-->T12 ==> Ord(b)
    (a,b)-->T30 ==> Ord(a + b)
    ELEM ==> car(x) + cdr(x) = a + b
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the binary relationship $Ord1p2_thryvar$ defined above has the properties
-- required of a linear ordering. The following theorem asserts that any two distinct elements
-- of our Cartesian product set are related by this ordering, and product_order_5 tells us
-- that this ordering is transitive.
--
Theorem product_order_4: ((X in o1 PROD o2) & (Y in o1 PROD o2)) imp
	((Ord1p2_thryvar(X,Y) or Ord1p2_thryvar(Y,X) or X = Y) & (not Ord1p2_thryvar(X,X))). Proof:
    Suppose_not(x,y) ==> Stat1: (x in o1 PROD o2) & (y in o1 PROD o2) &
							(not(Ord1p2_thryvar(x,y) or Ord1p2_thryvar(y,x) or x = y) or Ord1p2_thryvar(x,x))
--
-- For let $x$, $o1$, $o2$, $y$ be a counterexample to our assertion, and use the definitions of the
-- ordering operations involved to translate the negative of our assertion into the
-- following statements:
--
    Use_def(Ord1p2_thryvar)(Stat2*) ==> Stat2: Ord1p2_thryvar(x,x) eq ((car(x) + cdr(x) in car(x) + cdr(x)) or
	 ((car(x) + cdr(x) = car(y) + cdr(x)) & (car(x) in car(x))) or
	 ((car(x) + cdr(x) = car(x) + cdr(x)) & (car(x) = car(x)) & (cdr(x) in cdr(x))))
    Use_def(Ord1p2_thryvar)(Stat3*) ==> Stat3: Ord1p2_thryvar(x,y) eq ((car(x) + cdr(x) in car(y) + cdr(y)) or
	 ((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) in car(y))) or
	 ((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) = car(y)) & (cdr(x) in cdr(y))))
    Use_def(Ord1p2_thryvar)(Stat4*) ==> Stat4: Ord1p2_thryvar(y,x) eq ((car(y) + cdr(y) in car(x) + cdr(x)) or
	 ((car(y) + cdr(y) = car(x) + cdr(x)) & (car(y) in car(x))) or
	 ((car(y) + cdr(y) = car(x) + cdr(x)) & (car(y) = car(x)) & (cdr(y) in cdr(x))))
--
-- Use the fact that $x$ and $y$ are members of the Cartesian product set o1 PROD o2 to translate
-- the first of these statements into assertions about the components $a$, $b$, $c$, $d$ of $x$ and $y$,
-- as follows:
--
    Use_def(PROD)(Stat1,Stat1*) ==> Stat5: (x in {[x1,y1]: x1 in o1, y1 in o2}) & (y in {[x1,y1]: x1 in o1, y1 in o2})
    (a,b,c,d)-->Stat5(Stat5*) ==> Stat6: (x = [a,b]) & (a in o1) & (b in o2) & (y = [c,d]) & (c in o1) & (d in o2)
    (Stat6)ELEM ==> Stat7: (car(x) = a) & (cdr(x) = b)
    (Stat6,Stat6)ELEM ==> Stat8: (car(y) = c) & (cdr(y) = d)
    (Stat7,Stat2*)ELEM ==> Stat9: Ord1p2_thryvar(x,x) eq ((a + b in a + b) or ((a + b = a + b) & (a in a)) or
	 ((a + b = a + b) & (a = a) & (b in b)))
--
-- Since the right-hand side of the resulting assertion is obviously impossible,
-- it follows that $Ord1p2_thryvar(x,x)$ must be false, so that we need only consider the
-- first clause of our assertion.
--
    (Stat9*)ELEM ==> Stat10: not Ord1p2_thryvar(x,x)
    (Stat10,Stat1*)ELEM ==> Stat11: not(Ord1p2_thryvar(x,y) or Ord1p2_thryvar(y,x) or x = y)
--
-- This translates easily into the statement about $a$, $b$, $c$, and $d$ seen below.
--
    (Stat7,Stat8,Stat3*)ELEM ==> Stat12: Ord1p2_thryvar(x,y) eq ((a + b in c + d) or ((a + b = c + d) & (a in c)) or
	 ((a + b = c + d) & (a = c) & (b in d)))
    (Stat7,Stat8,Stat4*)ELEM ==> Stat13: Ord1p2_thryvar(y,x) eq ((c + d in a + b) or ((c + d = a + b) & (c in a)) or
	 ((c + d = a + b) & (c = a) & (d in b)))
    (Stat11,Stat12,Stat13,Stat6*)ELEM ==> Stat14: not(((a + b in c + d) or ((a + b = c + d) & (a in c)) or
	 ((a + b = c + d) & (a = c) & (b in d))) or ((c + d in a + b) or ((c + d = a + b) & (c in a)) or
	 ((c + d = a + b) & (c = a) & (d in b))) or ([a,b] = [c,d]))
--
-- But now, since $a$, $b$, $c$, and $d$ are all ordinals (so that $a + b$ and $c + d$ are ordinals also),
-- it follows that $a + b = c + d$, so that statement 50 reduces to the simpler form seen as statement 53 below.
--
    Assump ==> Stat15: Ord(o1) & Ord(o2)
    (o1,a)-->T12(Stat15,Stat6*) ==> Stat16: Ord(a)
    (o2,b)-->T12(Stat15,Stat6*) ==> Stat17: Ord(b)
    (a,b)-->T30(Stat16,Stat17*) ==> Stat18: Ord(a + b)
    (o1,c)-->T12(Stat15,Stat6*) ==> Stat19: Ord(c)
    (o2,d)-->T12(Stat15,Stat6*) ==> Stat20: Ord(d)
    (c,d)-->T30(Stat19,Stat20*) ==> Stat21: Ord(c + d)
    (Stat14,Stat14*)ELEM ==> Stat22: not((a + b in c + d) or (c + d in a + b))
    (a + b,c + d)-->T31(Stat22,Stat18,Stat21) ==> Stat23: a + b = c + d
    (Stat14,Stat23*)ELEM ==> Stat24: not((a in c) or ((a = c) & (b in d)) or
	 (c in a) or ((c = a) & (d in b)) or ([a,b] = [c,d]))
--
-- Repeating this same argument for the pair $a$, $c$ of ordinals, we find that $a = c$,
-- so that statement 53 reduces to statement 55 as seen below.
--
    (a,c)-->T31(Stat24,Stat16,Stat19*) ==> Stat25: a = c
    (Stat25,Stat24*)ELEM ==> Stat26: not((b in d) or (d in b) or ([a,b] = [c,d]))
--
-- Repeating this same argument once more for $b$, $d$ , we find that $b = d$,
-- which implies $[a,b] = [c,d]$, and so proves our theorem.
--
    (b,d)-->T31(Stat26,Stat17,Stat20*) ==> Stat27: b = d
    (Stat25,Stat26,Stat27)Discharge ==> QED
--
--  Next we show that the binary relationship Ord1p2_thryvar has the transitivity property required of an ordering.
--
Theorem product_order_5: ((X in o1 PROD o2) & (Y in o1 PROD o2) & (Z in o1 PROD o2) &
		Ord1p2_thryvar(X,Y) & Ord1p2_thryvar(Y,Z)) imp Ord1p2_thryvar(X,Z). Proof:
    Suppose_not(x,y,wz) ==> Stat1: (x in (o1 PROD o2)) & (y in (o1 PROD o2)) & (wz in (o1 PROD o2)) &
			Ord1p2_thryvar(x,y) & Ord1p2_thryvar(y,wz) & (not(Ord1p2_thryvar(x,wz)))
--
-- For let $x = [a,b]$, $y = [c,d]$, $wz = [e,f]$ be a counterexample. Since all the quantities $a,b,c,d,e,f$,
-- and also $a + b$, $c + d$, $e + f$ are ordinals, they are all comparable both by membership and inclusion.
-- Since the ordering of pairs like [a.b] by Ord1p2_thryvar is first of all by membership, and hence inclusion, of a + b,
-- We must have $(a + b) incin (c + d)$, $(c + d) incin (e + f)$, but since $Ord1p2_thryvar(x,z)$ is false,
-- $(e + f)$ cannot be a proper superset of $(a + b)$; hence all the sets $(a + b)$, $(c + d)$, $(e + f)$
-- must be equal.
--
	(x,o1,o2,wz)-->Tproduct_order_4 ==> Ord1p2_thryvar(wz,x) or wz = x
    Use_def(Ord1p2_thryvar)(Stat1,Stat1*) ==> Stat2: ((car(x) + cdr(x) in car(y) + cdr(y)) or
	 ((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) in car(y))) or
	 ((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) = car(y)) & (cdr(x) in cdr(y))))
    Use_def(Ord1p2_thryvar)(Stat1,Stat1*) ==> Stat3: ((car(y) + cdr(y) in car(wz) + cdr(wz)) or
	 ((car(y) + cdr(y) = car(wz) + cdr(wz)) & (car(y) in car(wz))) or
	 ((car(y) + cdr(y) = car(wz) + cdr(wz)) & (car(y) = car(wz)) & (cdr(y) in cdr(wz))))
    Use_def(Ord1p2_thryvar)(Stat1,Stat1*) ==> Stat4: ((car(wz) + cdr(wz) in car(x) + cdr(x)) or
	 ((car(wz) + cdr(wz) = car(x) + cdr(x)) & (car(wz) in car(x))) or
	 ((car(wz) + cdr(wz) = car(x) + cdr(x)) & (car(wz) = car(x)) & (cdr(wz) in cdr(x)))) or wz = x
    Use_def(PROD)(Stat1,Stat1*) ==>
	Stat5: (x in {[x1,y1]: x1 in o1, y1 in o2}) & (y in {[x1,y1]: x1 in o1, y1 in o2}) &
				(wz in {[x,y]: x in o1, y in o2})
--??    (a,b,c,d,e,f)-->Stat5(Stat5*) ==>
--	Stat6: (x = [a,b]) & (a in o1) & (b in o2) & (y = [c,d]) & (c in o1) & (d in o2) &
--					(wz = [e,f]) & (e in o1) & (f in o2)
    (a,b,c,d,e,f)-->Stat5 ==>
	Stat6: (x = [a,b]) & (a in o1) & (b in o2) & (y = [c,d]) & (c in o1) & (d in o2) &
					(wz = [e,f]) & (e in o1) & (f in o2)
	ELEM ==> (car([a,b]) = a) & (cdr([a,b]) = b) & (car([c,d]) = c) & (cdr([c,d]) = d) & (car([e,f]) = e) & (cdr([e,f]) = f)
	EQUAL(Stat6) ==> Stat7: (car(x) = a) & (cdr(x) = b) & (car(y) = c) & (cdr(y) = d) & (car(wz) = e) & (cdr(wz) = f)
    EQUAL(Stat7,Stat2) ==> Stat8: ((a + b in c + d) or ((a + b = c + d) & (a in c)) or ((a + b = c + d) & ((a = c) & (b in d))))
    EQUAL(Stat7,Stat3) ==> Stat9: ((c + d in e + f) or ((c + d = e + f) & (c in e)) or ((c + d = e + f) & (c = e) & (d in f)))
    EQUAL(Stat6,Stat7,Stat4) ==> Stat10: ((e + f in a + b) or ((e + f = a + b) & (e in a)) or ((e + f = a + b) & (e = a) & (f in b))) or [e,f] = [a,b]
	(Stat10)ELEM ==> Stat11: (e + f in a + b) or (e + f = a + b)
    Assump ==> Stat12: Ord(o1) & Ord(o2)
    (o1,a)-->T12(Stat12,Stat6*) ==> Ord(a)
    (o2,b)-->T12(Stat12,Stat6*) ==> Ord(b)
    (o1,c)-->T12(Stat12,Stat6*) ==> Ord(c)
    (o2,d)-->T12(Stat12,Stat6*) ==> Ord(d)
    (o1,e)-->T12(Stat12,Stat6*) ==> Ord(e)
    (o2,f)-->T12(Stat12,Stat6*) ==> Ord(f)
    (Stat12*)ELEM ==> Stat13: Ord(a) & Ord(b) & Ord(c) & Ord(d) & Ord(e) & Ord(f)
    (a,b)-->T29(Stat13*) ==> (a incin b or b incin a)
    (c,d)-->T29(Stat13*) ==> (c incin d or d incin c)
    (e,f)-->T29(Stat13*) ==> (e incin f or f incin e)
    (a,e)-->T31(Stat13*) ==> (a in e or e in a or a = e)
    (b,f)-->T31(Stat13*) ==> (b in f or f in b or b = f)
    (a,b)-->T30(Stat13*) ==> Stat14: Ord(a + b)
    (c,d)-->T30(Stat13*) ==> Ord(c + d)
    (e,f)-->T30(Stat13*) ==> Ord(e + f)
    (Stat14*)ELEM ==> Stat15: Ord(a + b) & Ord(c + d) & Ord(e + f)
    (c + d,a + b)-->T34(Stat13*) ==> Stat16: (a + b in c + d) imp ((a + b) incin (c + d))
    (e + f,c + d)-->T34(Stat13*) ==> Stat17: (c + d in e + f) imp ((c + d) incin (e + f))
    (a + b,e + f)-->T34(Stat13*) ==> Stat18: (e + f in a + b) imp ((e + f) incin (a + b))
--
-- The known product-order relationships between $[a,b]$, $[c,d]$, and $[e,f]$ translate into
-- the following membership and equality statements.
--
    (Stat10)ELEM ==> Stat19: (e + f in a + b) or ((e + f = a + b) & (e in a)) or
    					((e + f = a + b) & (e = a) & (f in b)) or ((e = a) & (f = b))
--
-- The known ordering of these same pairs implies the following inclusions, from which the equality of all
-- three union sets follows. This in turn implies the membership relations, and hence the inclusions, seen below.
--
    (Stat8,Stat16*)ELEM ==> Stat20: ((a + b) incin (c + d))
    (Stat9,Stat17*)ELEM ==> Stat21: ((c + d) incin (e + f))
    (Stat11,Stat18*)ELEM ==> Stat22: ((e + f) incin (a + b))
    (Stat22,Stat20,Stat21,Stat8,Stat9*)ELEM ==> Stat23: (a + b = c + d) & (c + d = e + f) &
    					((a in c) or ((a = c) & (b in d))) & ((c in e) or ((c = e) & (d in f)))
    (c,a)-->T34(Stat13,Stat23*) ==> Stat24: c incs a
    (e,c)-->T34(Stat13,Stat23*) ==> Stat25: e incs c
    (a,e)-->T34(Stat19,Stat13,Stat23*) ==> Stat26: a incs e
--
-- But then clearly the sets $a$, $c$, and $e$ are all equal, so we must have $(b in d) & (d in f) & (b notin f)$,
-- which contradicts the fact that, for ordinals, the membership relationship is transitive.
--
    (Stat19,Stat23,Stat24,Stat25,Stat26*)ELEM ==> Stat27: (a = c) & (c = e) & (b in d) & (d in f) & (b notin f)
    (f,d)-->T34(Stat19*) ==> f incs d
    (Stat27*)Discharge ==> QED
--
-- Our next theorem states that $Ord1p2_thryvar$ has the well-ordering property:
-- any subset of our Cartesian product set contains an element minimal in the ordering $Ord1p2_thryvar$.
--
Theorem product_order_6: ((T incin (o1 PROD o2)) & (T /= 0)) imp
	(EXISTS x in T | (FORALL y in t | (Ord1p2_thryvar(x,y) or (x = y)))). Proof:
    Suppose_not(t) ==> Stat1: (t incin (o1 PROD o2)) & (t /= 0) & Stat2: (not(EXISTS x in t | (FORALL y in t | (Ord1p2_thryvar(x,y) or (x = y)))))
--
-- For in the contrary case some Cartesian product $o1 PROD o2$ of two ordinals has a subset $t$ having no minimal element.
-- Plainly, $car(x) + cdr(x)$ is an ordinal for every $x$ in $t$. Thus the set $rel_1$ of elements of $t$ on which
-- $car(x) + cdr(x)$ takes on its minimum value is nonempty.
--
    Assump ==> Ord(o1) & Ord(o2)
    Suppose ==> Stat3: not(FORALL x in t | (Ord(car(x) + cdr(x))))
    a-->Stat3 ==> (a in t) & (not Ord(car(a) + cdr(a)))
    ELEM ==> a in (o1 PROD o2)
    Use_def(PROD) ==> Stat4: a in {[x,y]: x in o1, y in o2}
    (b,c)-->Stat4 ==> (a = [b,c]) & (b in o1) & (c in o2)
    ELEM ==> car(a) + cdr(a) = b + c
    EQUAL ==> not Ord(b + c)
    (o1,b)-->T12 ==> Ord(b)
    (o2,c)-->T12 ==> Ord(c)
    (b,c)-->T30 ==> false; Discharge ==> (FORALL x in t | Ord(car(x) + cdr(x)))
    APPLY(rng_thryvar:rel_1) ordval_fcn(s->t,f(x)->car(x) + cdr(x)) ==>
		Stat5: (rel_1 /= 0) & (rel_1 incin t) &
			(rel_1 = {x: x in t | car(x) + cdr(x) = arb({car(y) + cdr(y): y in t})}) &
				Stat6: (FORALL x in rel_1, y in t | (car(x) + cdr(x)) incin (car(y) + cdr(y)))
--
-- Since the function $x->car(x)$ is also ordinal-valued, $rel_1$ admits a nonempty subset
-- $rel_2$ on which this function takes on its minimum value.
--
    Suppose ==> Stat7: not(FORALL x in rel_1 | Ord(car(x)))
    d-->Stat7 ==> (d in rel_1) & (not Ord(car(d)))
    ELEM ==> d in (o1 PROD o2)
    Use_def(PROD) ==> Stat8: d in {[x,y]: x in o1, y in o2}
    (b2,c2)-->Stat8 ==> (d = [b2,c2]) & (b2 in o1)
    ELEM ==> car(d) = b2
    EQUAL ==> not Ord(b2)
    Assump ==> Ord(o1) & Ord(o2)
    (o1,b2)-->T12 ==> false; Discharge ==> (FORALL x in rel_1 | Ord(car(x)))
    APPLY(rng_thryvar:rel_2) ordval_fcn(s->rel_1,f(x)->car(x)) ==>
		Stat9: (rel_2 /= 0) & (rel_2 incin rel_1) & (rel_2 = {x: x in rel_1 | car(x) = arb({car(u): u in rel_1})}) &
			Stat10: (FORALL x in rel_2, y in rel_1 | car(x) incin car(y))
--
-- Similarly, since the function $x->cdr(x)$ is also ordinal-valued, $rel_2$ admits
-- a nonempty subset $rel_3$ on which this function takes on its minimum value.
--
    Suppose ==> Stat11: not(FORALL x in rel_2 | Ord(cdr(x)))
    e-->Stat11 ==> (e in rel_2) & (not Ord(cdr(e)))
    ELEM ==> e in (o1 PROD o2)
    Use_def(PROD) ==> Stat12: e in {[x,y]: x in o1, y in o2}
    (b3,c3)-->Stat12 ==> (e = [b3,c3]) & (c3 in o2)
    ELEM ==> cdr(e) = c3
    EQUAL ==> not Ord(c3)
    (o2,c3)-->T12 ==> false; Discharge ==> (FORALL x in rel_2 | Ord(cdr(x)))
    APPLY(rng_thryvar:rel_3) ordval_fcn(s->rel_2,f(x)->cdr(x)) ==>
		Stat13: (rel_3 /= 0) & (rel_3 incin rel_2) &
			Stat14: (FORALL x in rel_3, y in rel_2 | cdr(x) incin cdr(y))
--
-- But it is easily seen that any element of the set $rel3$ is minimal over $t$ in the product order $Ord1p2_thryvar$.
--
    x-->Stat13 ==> Stat15: (x in rel_3) & (x in rel_2) & (x in rel_1)
    (Stat15,Stat5)ELEM ==> Stat16: x in {u: u in t | car(u) + cdr(u) = arb({car(v) + cdr(v): v in t})}
	(Stat15,Stat9)ELEM ==> Stat17: x in {v: v in rel_1 | car(v) = arb({car(u): u in rel_1})}
    x2-->Stat16 ==> Stat18: (x = x2) & (car(x2) + cdr(x2) = arb({car(y) + cdr(y): y in t}))
    EQUAL ==> Stat19: car(x) + cdr(x) = arb({car(y) + cdr(y): y in t})
    x3-->Stat17 ==> Stat20: (x = x3) & (car(x3) = arb({car(y): y in rel_1}))
    EQUAL ==> Stat21: car(x) = arb({car(y): y in rel_1})
    Suppose ==> Stat22: not(FORALL y in t | (Ord1p2_thryvar(x,y) or (x = y)))
    y-->Stat22 ==> Stat23: (y in t) & (not(Ord1p2_thryvar(x,y) or x = y))
    Use_def(Ord1p2_thryvar) ==> Stat24: not(car(x) + cdr(x) in car(y) + cdr(y) or
	 ((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) in car(y))) or
	 ((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) = car(y)) & (cdr(x) in cdr(y))) or x = y)
    (Stat1,Stat23,Stat15,Stat5)ELEM ==> (x in (o1 PROD o2)) & (y in (o1 PROD o2))
    Use_def(PROD) ==> Stat25: (x in {[u,v]: u in o1, v in o2}) & (y in {[u,v]: u in o1, v in o2})
    (u1,v1,u2,v2)-->Stat25 ==> Stat26: (x = [u1,v1]) & (u1 in o1) & (v1 in o2) & (y = [u2,v2]) &
    					(u2 in o1) & (v2 in o2)
    (Stat26)ELEM ==> Stat27: (car(x) = u1)
    (Stat26,Stat26)ELEM ==> Stat28: (cdr(x) = v1)
    (Stat26,Stat26)ELEM ==> Stat29: (car(y) = u2)
    (Stat26,Stat26)ELEM ==> Stat30: (cdr(y) = v2)
    (Stat26*)ELEM ==> Stat31: (x = [u1,v1]) & (y = [u2,v2])
	EQUAL ==> Stat32: not(u1 + v1 in u2 + v2 or ((u1 + v1 = u2 + v2) & (u1 in u2)) or
	 ((u1 + v1 = u2 + v2) & (u1 = u2) & (v1 in v2)) or [u1,v1] = [u2,v2])
	(x,y)-->Stat6 ==> (car(x) + cdr(x)) incin (car(y) + cdr(y))
	EQUAL ==> Stat33: (u1 + v1) incin (u2 + v2)
	(Stat32)ELEM ==> Stat34: not(u1 + v1 in u2 + v2)
--
-- By Stat25 all of $u1,v1,u2,v2$ are ordinals, and therefore
-- $u1 + v1$ and $u2 + v2$ are also ordinals.
--
    (o1,u1)-->T12 ==> Stat35: Ord(u1)
    (o2,v1)-->T12 ==> Stat36: Ord(v1)
    (o1,u2)-->T12 ==> Stat37: Ord(u2)
    (o2,v2)-->T12 ==> Stat38: Ord(v2)
    (u1,v1)-->T30 ==> Stat39: Ord(u1 + v1)
    (u2,v2)-->T30 ==> Stat40: Ord(u2 + v2)
--
-- It therefore follows by Stat41 and Stat42 and by Theorem 35 that $(u1 + v1) = (u2 + v2)$,
-- so that $y$, like $x$, must be a member of the subset $rel_1$ of $t$.
--
	(u2 + v2,u1 + v1)-->T35(Stat39,Stat40,Stat34) ==> Stat41: u1 + v1 incs u2 + v2
	(Stat41,Stat33)ELEM ==> Stat43: u2 + v2 = u1 + v1
	EQUAL(Stat43,Stat27,Stat28,Stat29,Stat30) ==> Stat42: car(y) + cdr(y) = car(x) + cdr(x)
	Suppose ==> Stat44: y notin rel_1
	(Stat5,Stat44)ELEM ==> Stat45: y notin {x: x in t | car(x) + cdr(x) = arb({car(u) + cdr(u): u in t})}
	y-->Stat45 ==> Stat46: car(y) + cdr(y) /= arb({car(x) + cdr(x): x in t})
	(Stat42,Stat46,Stat19)Discharge ==> y in rel_1
	(Stat32,Stat43)ELEM ==> Stat47: not((u1 in u2) or ((u1 = u2) & (v1 in v2)) or [u1,v1] = [u2,v2])
	(u2,u1)-->T35(Stat47,Stat35,Stat37) ==> Stat48: u1 incs u2
	(x,y)-->Stat10 ==> car(x) incin car(y)
	EQUAL ==> u1 incin u2
	(Stat48)ELEM ==> Stat49: u1 = u2
	EQUAL(Stat49,Stat27,Stat28,Stat29,Stat30) ==> Stat50: car(y) = car(x)
	Suppose ==> Stat51: y notin rel_2
	EQUAL(Stat51,Stat9) ==> Stat52: y notin {x: x in rel_1 | car(x) = arb({car(u): u in rel_1})}
	y-->Stat52 ==> Stat53: car(y) /= arb({car(x): x in rel_1})
	(Stat21,Stat50,Stat53)Discharge ==> y in rel_2
	(x,y)-->Stat14 ==> Stat54: cdr(x) incin cdr(y)
	EQUAL(Stat54,Stat27,Stat28,Stat29,Stat30) ==> Stat55: v1 incin v2
	(Stat49,Stat47)ELEM ==> Stat56: v1 notin v2
	(v2,v1)-->T35(Stat56,Stat36,Stat38) ==> Stat57: v1 incs v2
	(Stat55,Stat57)ELEM ==> Stat58: v1 = v2
	(Stat47,Stat58,Stat49)Discharge ==> Stat59: (FORALL y in t | (Ord1p2_thryvar(x,y) or (x = y)))
	x-->Stat2(Stat15,Stat13,Stat9,Stat5,Stat59) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The results just established can be summarized as follows.
--
--DISPLAY product_order
--
--THEORY product_order(o1,o2)	 [The product-ordering of two ordinals is a well-ordering]
--    Ord(o1) & Ord(o2)
--==>(Ord1p2_thryvar)
--    (FORALL x in o1 PROD o2 | Ord(car(x)))
--    (FORALL x in o1 PROD o2 | Ord(cdr(x)))
--    (FORALL x in o1 PROD o2 | Ord(car(x) + cdr(x)))
--    Ord1p2_thryvar(X,Y) eq ((car(X) + cdr(X) in car(Y) + cdr(Y)) or
--		((car(X) + cdr(X) = car(Y) + cdr(Y)) & (car(X) in car(Y))) or
--		((car(X) + cdr(X) = car(Y) + cdr(Y)) & (car(X) = car(Y)) & (cdr(X) in cdr(Y))))
--    (FORALL x in o1 PROD o2, y in o1 PROD o2 |
--    		(Ord1p2_thryvar(x,y) or Ord1p2_thryvar(y,x) or x = y) & (not Ord1p2_thryvar(x,x)))
--    (FORALL x in o1 PROD o2, y in o1 PROD o2 |
--    		(FORALL z in o1 PROD o2 | ((Ord1p2_thryvar(x,y) & (Ord1p2_thryvar(y,z)) imp Ord1p2_thryvar(x,z)))))
--    ((T incin (o1 PROD o2)) & (T /= 0)) imp
--    		(EXISTS x in T, y in t | (Ord1p2_thryvar(x,y) or x = y))
--END product_order;
--
-- Next we show that the addition of any single element to an infinite set
-- does not change its cardinality.
--
Theorem 355: ['One-more' lemma] (not Finite(S)) imp (#S = #(S + {C})). Proof:
    Suppose_not(s,c) ==> (not Finite(s)) & (#s /= #(s + {c}))
--
-- For suppose that $s$, $c$ is a counterexample to our assertion.
-- Since $s$ is infinite, it is the single-valued image of a proper subset of itself, whose domain therefore omits
-- some element $b$ of $s$. The mapping ${[b,c]}$ defined only on $b$ which maps $b$ to $c$ is plainly single-valued, and since
-- $b notin s$, $f + {[b,c]}$ is a single-valued mapping of a subset of $s$ onto $#(s + {c})$. Thus $#domain(f + {[b,c]})$
-- is not greater than $#s$, while $#range(f + {[b,c]})$ is $#(s + {c})$. Hence by Theorem 171  $#(s + {c})$ is no more than $#s$,
-- proving our assertion.
--
    s-->T195 ==> Stat1: (EXISTS f in OM | (Svm(f) & (range(f) = s) & (domain(f) incin s) & (s /= domain(f))))
    f-->Stat1 ==> Svm(f) & (range(f) = s) & (domain(f) incin s) & Stat2: (not(s incin domain(f)))
    b-->Stat2 ==> ({b} incin s) & ({b} * domain(f) = 0)
    ELEM ==> Svm({[b,c]}) & (range({[b,c]}) = {c}) & (domain({[b,c]}) = {b})
    (f,{[b,c]})-->T87 ==> Svm(f + {[b,c]})
    (f,{[b,c]})-->T78 ==> domain(f + {[b,c]}) incin s
    (f,{[b,c]})-->T79 ==> range(f + {[b,c]}) = s + {c}
    Set_monot ==> Stat3: #domain(f + {[b,c]}) incin #s
    (f + {[b,c]})-->T171 ==> #range(f + {[b,c]}) incin #domain(f + {[b,c]})
    EQUAL ==> Stat4: #(s + {c}) incin #domain(f + {[b,c]})
    (Stat3,Stat4)ELEM ==> Stat5: #(s + {c}) incin #s
    (Stat5*)ELEM ==> s incin (s + {c})
    (s,s + {c})-->T170 ==> false; Discharge ==> QED
--
-- Using Theorem 355, it is easy to prove inductively that the addition of
-- finitely many elements to an infinite set $s$ never changes the cardinality of $s$.
--
Theorem 356: ['Few-more' lemma] ((not Finite(S)) & Finite(T)) imp (#S = #(S + T)). Proof:
    Suppose_not(s,t) ==> (not Finite(s)) & Finite(t) & (#s /= #(s + t))
--
-- For if $s$, $t$ are a counterexample to our assertion, it follows
-- by the principle of finite induction proved earlier that there is a smallest
-- finite x for which there exists an infinite v for which $#v /= #(v + x)$
--
	Suppose ==> Stat1: not (EXISTS u | ((not Finite(u)) & (#u /= #(u + t))))
	s-->Stat1 ==> false;  Discharge ==> (EXISTS u | ((not Finite(u)) & (#u /= #(u + t))))
	APPLY(m1_thryvar:x) finite_induction(n->t,P(x)->(EXISTS u | ((not Finite(u)) & (#u /= #(u + x))))) ==>
		(x incin t) & Stat2: (EXISTS u | ((not Finite(u)) & (#u /= #(u + x)))) &
			Stat3: (FORALL y incin x | ((y /= x) imp (not ((EXISTS u | ((not Finite(u)) & (#u /= #(u + y))))))))
	v-->Stat2 ==> (not Finite(v)) & (#v /= #(v + x))
--
-- Since x plainly cannot be empty, it must have some element $c$.
-- Then $#(v + (x - {c})) = #v$ by the minimality of $x$, and so $#(v + (x - {c})) + {c} = #v$
-- by the preceding theorem, completing our proof.
--
	Suppose ==> x = 0
		TELEM ==> v = v + 0
	EQUAL ==> false; Discharge ==> Stat4: x /= 0
	c-->Stat4 ==> c in x
	(x - {c})-->Stat3 ==> Stat5: not (EXISTS u | ((not Finite(u)) & (#u /= #(u + (x - {c})))))
	v-->Stat5 ==> #v = #(v + (x - {c}))
	(v + (x - {c}),v)-->T189 ==> not Finite(v + (x - {c}))
	(v + (x - {c}),c)-->T355 ==> #(v + (x - {c}) + {c}) = #v
	ELEM ==> v + (x - {c}) + {c} = v + x
	EQUAL ==> false; Discharge ==> QED
--
Theorem 357: [Any infinite cardinal is a limit ordinal] ((not Finite(S)) & (X in #S)) imp (X + {X} in #S). Proof:
	Suppose_not(s,x) ==> (not Finite(s)) & (x in #s) & ((x + {x}) notin #s)
--
-- For let $s$, $x$ be a counterexample to our assertion, so $(x + {x}) notin #s$.
-- Plainly both $#s$ and its member $x$ are ordinals, while $#s$ must be infinite.
-- If $x$ is finite, so is its ordinal successor $x + {x}$, and therefore $x + {x}$
-- must be a member of the infinite ordinal $#s$ by Theorem 197, ruling out this
-- possibility.
--
	s-->T156 ==> Card(#s) & Ord(#s)
	(#s,x)-->T12 ==> Ord(x)
	x-->T32 ==> Ord(next(x))
	Use_def(next) ==> Ord(x + {x})
	Suppose ==> Finite(x)
	x-->T199 ==> Finite(x + {x})
--
-- Hence $x$ is infinite, implying $#(x + {x}) = #x$ by the One-more lemma.
-- Since by assumption x is less than, i.e. a proper subset of, $#s$,
-- and since $#x$ is no more than $x$ by Theorem 169, it follows that $#x = #(x + {x})$ is also
-- a proper subset of $#s$. But if $(x + {x}) notin #s$, then $#s incin (x + {x})$ by Theorem 35,
-- in which case it follows that $##s incin #(x + {x})$, so $#s incin #(x + {x})$
-- giving the contradiction $#s = #(x + {x})$, and so proving the present corollary.
--
	(#s,x + {x})-->T197 ==> false; Discharge ==> not Finite(x)
	(#s,x)-->T34 ==> Stat1: (x incin #s) & (x /= #s)
	(x,x)-->T169 ==> #x incin x
	(x,x)-->T355 ==> #(x + {x}) = #x
	(Stat1*)ELEM ==> (#(x + {x}) incin #s) & (#(x + {x}) /= #s)
	(#s,(x + {x}))-->T35 ==> #s incin (x + {x})
	(#s,(x + {x}))-->T170 ==> ##s incin #(x + {x})
	s-->T166 ==> false; Discharge ==> QED
--
-- Our next main aim is to prove the cardinal Division-by-2 Lemma which appears as Theorem 362 below.
-- Since this result lies a bit deeper than most of the theorems proved up to the present point, we
-- give an informal outline of its proof before entering upon its formal details.
-- The theorem asserts that for every infinite set $s$, $#s = #(s PROD {0,1})$. If this is false,
-- then $#s /= #(s PROD {0,1})$ = $(s TIMES {0,1}) = (#s TIMES {0,1})$ = $#(#s PROD {0,1})$,
-- so our assertion is also false for the infinite cardinal $#s$, and hence for some infinite ordinal.
-- It follows by the axiom of choice that our assertion is also false for some smallest infinite ordinal $s1$.
-- $s1$ must be a cardinal, since otherwise $#s1 in s1$, but also $s1 in #(s1 PROD {0,1})$ = $#(#s1 PROD {0,1})$,
-- so we would have $#s1 in #(#s1 PROD {0,1})$ also, contradicting the minimality of $s1$.
--
-- Order $s1 PROD {0,1}$ by the product ordering described above. The theory we have just established
-- tells us that this is a well-ordering, so that by our previous theory of well-orderings
-- there exists a 1-1 map $f$ from some ordinal $o$ onto $s1 PROD {0,1}$ which is monotone increasing if $o$
-- is given its standard ordering and $s1 PROD {0,1}$ is given its product ordering.
--
-- If $o1$ is a finite  member of the ordinal $o$, then obviously $#o1$ is a member of the infinite cardinal $s1$.
-- If $o1$ is an infinite  member of the ordinal $o$, then it is a proper subset of $o$;
-- so $range(f ON o1)$ is a proper subset $t$ of $s1 PROD {0,1}$.
-- If $[n,0] in range(f ON o1)$ and $m in n$, then $[m,k]$ is less than $[n,0]$ for each $k = 0,1$.
-- Hence there must exist some $[n,0] in s1 PROD {0,1}$ such that $[n,0] notin range(f ON o1)$,
-- since otherwise $range(f ON o1)$ would be all of $s1 PROD {0,1}$ rather than a proper subset.
-- It follows that for every $[m,k] in t$, $m$ is a member of $n$.
-- That is, $range(f ON o1)$ is a subset of $n PROD {0,1}$, and so it follows
-- from the minimality of $s1$ that $#t incin #(n PROD {0,1})$ = $n$ in $s1$. Hence $#o1$ is a member of $s1$
-- for each $o1$ in $o$, proving that $#o incin s1$ in this case also. Since $o$ is in $1-1$ correspondence with
-- $s1 PROD {0,1}$ it follows that $#(s1 PROD {0,1}) incin s1$, contrary to our assumption.
-- This contradiction proves our desired theorem.
--
-- To keep its details under control, we precede the formal proof of Theorem 362 with several lemmas,
-- as suggested by the preceding discussion. Our first lemma asserts that if $s$ and $t$ are ordinals,
-- $s$ being infinite, and if no member of $t$ has a cardinality larger than $#s$,
-- then $t$ has a cardinality no larger than $#s$.
--
Theorem 358: [If ordinal $S$ dominates the members of an ordinal $T$, $#S$ is no less than $#T$] (Ord(S) & Ord(T) & (not Finite(S)) & (FORALL u in T | #u in #S)) imp (#T incin #S). Proof:
	Suppose_not(s,t) ==> Ord(s) & Ord(t) & (not Finite(s)) &
				Stat1: (FORALL x in t | #x in #s) & Stat2: (not(#t incin #s))
	s-->T156 ==> Ord(#s)
	t-->T156 ==> Ord(#t)
	(#t,#s)-->T35 ==> #s in #t
	(t,t)-->T169 ==> #t incin t
	(#s)-->Stat1 ==> ##s in #s
	s-->T166 ==> false; Discharge ==> QED
--
-- We will also find the following elementary property of Cartesian product useful.
--
Theorem 359: [The cardinality of a non-null Cartesian product is at least the cardinality of its first factor] (T /= 0) imp (#S incin #(S PROD T)). Proof:
	Suppose_not(t,s) ==> Stat1: (t /= 0) & (not(#s incin #(s PROD t)))
	c-->Stat1 ==> c in t
	(s,s,{c},t)-->T256 ==> (s PROD {c}) incin (s PROD t)
	(s PROD {c},s PROD t)-->T170 ==> #(s PROD {c}) incin #(s PROD t)
	(s,c)-->T224 ==> false; Discharge ==> QED
--
-- Our next theorem, which simply combines results available through the product_order
-- and well_ordered_set theories developed above, tells us that the Cartesian product $o1 PROD o2$ of
-- any two ordinals is order-isomorphic to a third ordinal o via a 1-1 map that is strictly monotone
-- relative to the product order of $o1 PROD o2$.
--
Theorem 360: (Ord(O1) & Ord(O2)) imp
	(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (O1 PROD O2)) &
	(FORALL x in domain(f), y in domain(f) | (x in y) eq
 (((car(f~[x]) + cdr(f~[x])) in (car(f~[y]) + cdr(f~[y]))) or
 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) in car(f~[y]))) or
 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) = car(f~[y])) & (cdr(f~[x]) in cdr(f~[y])))))). Proof:
--
-- For suppose the contrary,
--
	Suppose_not(o1,o2) ==> Ord(o1) & Ord(o2) &
	Stat1: (not (EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (o1 PROD o2)) &
	(FORALL x in domain(f), y in domain(f) | (x in y) eq
 (((car(f~[x]) + cdr(f~[x])) in (car(f~[y]) + cdr(f~[y]))) or
 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) in car(f~[y]))) or
 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) = car(f~[y])) & (cdr(f~[x]) in cdr(f~[y])))))))
--
-- And consider the product ordering of $o1 PROD o2$, which is a well-ordering.
--
 	APPLY (Ord1p2_thryvar:prod_order) product_order(o1->o1,o2->o2) ==>
		Stat2: (FORALL x, y | prod_order(x,y) eq (car(x) + cdr(x) in car(y) + cdr(y) or
			((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) in car(y))) or
				((car(x) + cdr(x) = car(y) + cdr(y)) & (car(x) = car(y)) & (cdr(x) in cdr(y))))) &
			Stat3: (FORALL x, y | ((x in o1 PROD o2) & (y in o1 PROD o2)) imp
				((prod_order(x,y) or prod_order(y,x) or (x = y)) & (not prod_order(x,x)))) &
			Stat4: (FORALL x, y, z | ((x in o1 PROD o2) & (y in o1 PROD o2) & (z in o1 PROD o2) & prod_order(x,y) & prod_order(y,z)) imp prod_order(x,z)) &
			Stat5: (FORALL t | ((t incin (o1 PROD o2)) & (t /= 0)) imp
				(EXISTS x in t| (FORALL y in t | (prod_order(x,y) or (x = y)))))
--
-- Adjust unrestricted quantifiers to the syntax used in the hypotheses of the THEORY well_ordered_set.
--
    Suppose ==> Stat6: not(FORALL x in (o1 PROD o2) | (not prod_order(x,x)))
        x0-->Stat6 ==> (x0 in (o1 PROD o2)) & prod_order(x0,x0)
    (x0,x0)-->Stat3 ==> false; Discharge ==> (FORALL x in (o1 PROD o2) | (not prod_order(x,x)))
--
    Suppose ==> Stat7: not(FORALL x in (o1 PROD o2), y in (o1 PROD o2), z in (o1 PROD o2) | (prod_order(x,y) & prod_order(y,z)) imp prod_order(x,z))
        (x1,y1,z1)-->Stat7 ==> (x1 in (o1 PROD o2)) & (y1 in (o1 PROD o2)) & (z1 in (o1 PROD o2)) & prod_order(x1,y1) & prod_order(y1,z1) & (not prod_order(x1,z1))
    (x1,y1,z1)-->Stat4 ==> false; Discharge ==> (FORALL x in (o1 PROD o2), y in (o1 PROD o2), z in (o1 PROD o2) | (prod_order(x,y) & prod_order(y,z)) imp prod_order(x,z))
--
    Suppose ==> Stat8: (not(FORALL t incin (o1 PROD o2) | (t /= 0) imp
				(EXISTS x in t| (FORALL y in t | (prod_order(x,y) or (x = y))))))
        t0-->Stat8 ==> (t0 incin (o1 PROD o2)) & (t0 /= 0) & (not(EXISTS x in t0| (FORALL y in t0 | (prod_order(x,y) or (x = y)))))
    t0-->Stat5 ==> false; Discharge ==> (FORALL t incin (o1 PROD o2) | (t /= 0) imp
				(EXISTS x in t| (FORALL y in t | (prod_order(x,y) or (x = y)))))
--
-- It follows by the theory of well-ordered sets developed above that there exists an ordinal $o$
-- and a function $orden(x)$ such that $f = {[x,orden(x)]: x in o}$ is a 1-1 mapping of $o$ onto $o1 PROD o2$,
-- which puts the ordering of $o$ by membership into isomorphism with the product-ordering of $o1 PROD o2$.
--
	APPLY (ordenm_thryvar:orden) well_ordered_set(s->o1 PROD o2,arg1_bef_arg2(x,y)->prod_order(x,y)) ==>
		Stat9: (FORALL u, v | (Ord(u) & Ord(v) & (orden(u) /= o1 PROD o2) & (orden(v) /= o1 PROD o2)) imp
			 (prod_order(orden(u),orden(v)) eq (u in v))) &
		Stat10: (EXISTS o | (Ord(o) & (o1 PROD o2 = {orden(x): x in o}) &
					 (FORALL x in o | (orden(x) /= o1 PROD o2)) & one_1_map({[x,orden(x)]: x in o})))
	o-->Stat10 ==> Ord(o) & (o1 PROD o2 = {orden(x): x in o})
					 & Stat11: (FORALL x in o | (orden(x) /= o1 PROD o2)) & one_1_map({[x,orden(x)]: x in o})
 	Loc_def ==> f = {[x,orden(x)]: x in o}
 	APPLY() fcn_symbol(f(x)->orden(x),g->f,s->o) ==>  (domain(f) = o) & (range(f) = {orden(x): x in o}) &
 			Stat12: (FORALL x | (x in o) imp (f~[x] = orden(x)))
 	EQUAL ==> (domain(f) = o) & Ord(domain(f)) & (range(f) = (o1 PROD o2)) & one_1_map(f)
 	Suppose ==> Stat13: not(FORALL x in domain(f), y in domain(f) | (x in y) eq prod_order(orden(x),orden(y)))
 	(x,y)-->Stat13 ==> (x in o) & (y in o) & (not((x in y) eq prod_order(orden(x),orden(y))))
 	x-->Stat11 ==> orden(x) /= o1 PROD o2
 	y-->Stat11 ==> orden(y) /= o1 PROD o2
 	(o,x)-->T12 ==> Ord(x)
 	(o,y)-->T12 ==> Ord(y)
 	(x,y)-->Stat9 ==> false; Discharge ==>
 		Stat14: (FORALL x in domain(f), y in domain(f) | (x in y) eq prod_order(orden(x),orden(y)))
--
-- But it is now obvious that (x in y) has the explicit form asserted in our theorem, completing the present proof.
--
	f-->Stat1 ==> Stat15: not (FORALL x in domain(f), y in domain(f) | (x in y) eq
 (((car(f~[x]) + cdr(f~[x])) in (car(f~[y]) + cdr(f~[y]))) or
 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) in car(f~[y]))) or
 	(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) = car(f~[y])) & (cdr(f~[x]) in cdr(f~[y])))))
	(x2,y2)-->Stat15 ==> (x2 in domain(f)) & (y2 in domain(f)) &
	(not((x2 in y2) eq (((car(f~[x2]) + cdr(f~[x2])) in (car(f~[y2]) + cdr(f~[y2]))) or
 	(((car(f~[x2]) + cdr(f~[x2])) = (car(f~[y2]) + cdr(f~[y2]))) & (car(f~[x2]) in car(f~[y2]))) or
 	(((car(f~[x2]) + cdr(f~[x2])) = (car(f~[y2]) + cdr(f~[y2]))) & (car(f~[x2]) = car(f~[y2])) & (cdr(f~[x2]) in cdr(f~[y2]))))))
	(x2,y2)-->Stat14 ==> (x2 in y2) eq prod_order(orden(x2),orden(y2))
	(orden(x2),orden(y2))-->Stat2 ==> prod_order(orden(x2),orden(y2)) eq
	(car(orden(x2)) + cdr(orden(x2)) in car(orden(y2)) + cdr(orden(y2)) or
	((car(orden(x2)) + cdr(orden(x2)) = car(orden(y2)) + cdr(orden(y2))) & (car(orden(x2)) in car(orden(y2)))) or
	((car(orden(x2)) + cdr(orden(x2)) = car(orden(y2)) + cdr(orden(y2))) & (car(orden(x2)) = car(orden(y2))) &
		(cdr(orden(x2)) in cdr(orden(y2)))))
	x2-->Stat12 ==> f~[x2] = orden(x2)
	y2-->Stat12 ==> f~[y2] = orden(y2)
	EQUAL ==> false; Discharge ==> QED
--
-- The following extension of Theorem 360 gives us the subsequently needed property of the map $f$ whose existence
-- is asserted by Theorem 360: that the range of the restriction of $f$ to any element of its domain
-- is contained in $y PROD y$ for some $y$ less than the maximum of $o1$ and $o2$.
--
Theorem 361: (Card(O1) & Card(O2) & (not Finite(O1 + O2))) imp
	(EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (O1 PROD O2)) &
		(FORALL x in domain(f) | (EXISTS y in (O1 + O2) | range(f ON x) incin (y PROD y)))). Proof:
	Suppose_not(o1,o2) ==> Card(o1) & Card(o2) & (not Finite(o1 + o2)) &
	  Stat1: (not (EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (o1 PROD o2)) &
		(FORALL x in domain(f) | (EXISTS y in (o1 + o2) | range(f ON x) incin (y PROD y)))))
--
-- For suppose not. Take $f$ to be the mapping whose existence is given by the preceding theorem, and
-- let $w$ be an element of its domain which contradicts our present assertion.
--
	Use_def(Card) ==> Ord(o1) & Ord(o2)
	(o1,o2)-->T360 ==> Stat2: (EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (o1 PROD o2)) &
		(FORALL x in domain(f), y in domain(f) | (x in y) eq
 			(((car(f~[x]) + cdr(f~[x])) in (car(f~[y]) + cdr(f~[y]))) or
 				(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) in car(f~[y]))) or
 					(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) &
 						(car(f~[x]) = car(f~[y])) & (cdr(f~[x]) in cdr(f~[y]))))))
	f-->Stat2 ==> Stat3: one_1_map(f) & Ord(domain(f)) & (range(f) = (o1 PROD o2)) &
		Stat4: (FORALL x in domain(f), y in domain(f) | (x in y) eq
 			(((car(f~[x]) + cdr(f~[x])) in (car(f~[y]) + cdr(f~[y]))) or
 				(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) & (car(f~[x]) in car(f~[y]))) or
 					(((car(f~[x]) + cdr(f~[x])) = (car(f~[y]) + cdr(f~[y]))) &
 						(car(f~[x]) = car(f~[y])) & (cdr(f~[x]) in cdr(f~[y])))))
	f-->Stat1 ==> Stat5: not(FORALL x in domain(f) | (EXISTS y in (o1 + o2) | range(f ON x) incin (y PROD y)))
	w-->Stat5 ==> (w in domain(f)) & Stat6: (not(EXISTS y in (o1 + o2) | range(f ON w) incin (y PROD y)))
--
-- Since $w$ is a member of $domain(f)$ it is a proper subset of $domain(f)$. Hence the image of
-- $w$ by $f$ is a proper subset of $o1 PROD o2$. i.e. there exists some element $b = [c,d]$ in $o1 PROD o2$
-- which does not belong to $range(f ON w)$. Write $[c,d]$ as $[c,d] = cdr(e)$ where $e in f$.
--
	Use_def(range) ==> range(f ON w) = {cdr(x): x in f ON w}
	Use_def(ON) ==> range(f ON w) = {cdr(x): x in {p in f | car(p) in w}}
	SIMPLF ==>  range(f ON w) = {cdr(p): p in f | car(p) in w}
	(domain(f),w)-->T12 ==> Ord(w)
	(domain(f),w)-->T34 ==> (w incin domain(f)) & Stat7: (w /= domain(f))
	(f,w)-->T98 ==> (range(f ON w) incin range(f)) & Stat8: (range(f ON w) /= range(f))
	b-->Stat8 ==> (b in range(f)) & (b notin range(f ON w))
	Use_def(range) ==> Stat9: b in {cdr(x): x in f}
	e-->Stat9 ==> Stat10: (e in f) & (b = cdr(e))
	ELEM ==> b in o1 PROD o2
	Use_def(PROD) ==> Stat11: b in {[x,y]: x in o1,y in o2}
	(c,d)-->Stat11 ==> Stat12: (c in o1) & (d in o2) & (b = [c,d])
	(o1,c)-->T12 ==> Ord(c)
	(o2,d)-->T12 ==> Ord(d)
	(c,d)-->T30 ==> Stat13: Ord(c + d)
--
-- We shall now show that there can exist no $[c1,d1]$ in $range(f ON w)$ such that $c1$ or $d1$
-- is greater than $c + d$. For otherwise there would be an $x in f$ with $car(x) in w$ such that
-- $cdr(x) = [c1,d1]$ where $c1 + d1$ is greater than $c + d$, and so, since $f$ is an order-preserving
-- map of $domain(f)$ onto $o1 PROD o2$, we would have $car(e) in w$, contradicting  $b notin range(f ON w)$.
--
	Use_def(one_1_map) ==> Svm(f)
	Suppose ==> Stat14: not(FORALL x in f | ((car(x) in w) imp (((c + d) notin car(cdr(x))) & ((c + d) notin cdr(cdr(x))))))
	x-->Stat14(Stat14*) ==> Stat15: (x in f) & (car(x) in w) & ((c + d) in car(cdr(x)) or (c + d) in cdr(cdr(x)))
	e-->T60 ==> car(e) in domain(f)
	x-->T60 ==> car(x) in domain(f)
	(Stat15)ELEM ==> Stat16: (c + d) in car(cdr(x)) + cdr(cdr(x))
	(Stat16,Stat10,Stat12)ELEM ==> car(cdr(e)) + cdr(cdr(e)) in car(cdr(x)) + cdr(cdr(x))
	(f,e)-->T74 ==> cdr(e) = f~[car(e)]
	(f,x)-->T74 ==> cdr(x) = f~[car(x)]
	EQUAL ==> car(f~[car(e)]) + cdr(f~[car(e)]) in car(f~[car(x)]) + cdr(f~[car(x)])
	Suppose ==> car(x) = car(e)
	EQUAL ==> false; Discharge ==> car(x) /= car(e)
	(car(e),car(x))-->Stat4 ==> not(car(x) in car(e))
	(domain(f),car(e))-->T12 ==> Ord(car(e))
	(domain(f),car(x))-->T12 ==> Ord(car(x))
	(car(e),car(x))-->T31 ==> car(e) in car(x)
	(w,car(x))-->T13 ==> car(x) incin w
	ELEM ==> car(e) in w
	Suppose ==> cdr(e) notin range(f ON w)
	ELEM ==> Stat17: cdr(e) notin {cdr(p): p in f | car(p) in w}
	e-->Stat17 ==> false; Discharge ==> cdr(e) in range(f ON w)
	Discharge ==> Stat18: (FORALL x in f | ((car(x) in w) imp (((c + d) notin car(cdr(x))) & ((c + d) notin cdr(cdr(x))))))
--
-- It follows that $range(f ON w)$ is included in $next(c + d) PROD next(c + d)$.
--
	Suppose ==> Stat19: not(range(f ON w) incin (next(c + d) PROD next(c + d)))
	u-->Stat19 ==> (u in range(f ON w)) & (u notin (next(c + d) PROD next(c + d)))
	Use_def(PROD) ==> Stat20: u notin {[x,y]: x in next(c + d), y in next(c + d)}
	ELEM ==> Stat21: u in {cdr(p): p in f | car(p) in w}
	p-->Stat21 ==> Stat22: (p in f) & (u = cdr(p)) & (car(p) in w)
	p-->Stat18 ==> Stat23: ((c + d) notin car(cdr(p))) & ((c + d) notin cdr(cdr(p)))
	(p,f)-->T61 ==> Stat24: cdr(p) in range(f)
	(Stat24,Stat3)ELEM ==> cdr(p) in o1 PROD o2
	Use_def(PROD) ==> Stat25: cdr(p) in {[x,y]: x in o1,y in o2}
	(c2,d2)-->Stat25 ==> Stat26: (c2 in o1) & (d2 in o2) & (cdr(p) = [c2,d2])
	(Stat23,Stat26)ELEM ==> ((c + d) notin c2) & ((c + d) notin d2)
	(o1,c2)-->T12 ==> Ord(c2)
	(o2,d2)-->T12 ==> Ord(d2)
	(c2,c + d)-->T31 ==> Stat27: c2 in (c + d) or c2 = (c + d)
	(d2,c + d)-->T31 ==> d2 in (c + d) or d2 = (c + d)
	(Stat27)ELEM ==> (c2 in (c + d) + {c + d}) & (d2 in (c + d) + {c + d})
	Use_def(next) ==> Stat28: (c2 in next(c + d)) & (d2 in next(c + d))
	(c2,d2)-->Stat20(Stat28) ==> Stat29: u /= [c2,d2]
	(Stat29,Stat22,Stat26)ELEM ==> false
	Discharge ==>  Stat30: range(f ON w) incin (next(c + d) PROD next(c + d))
	(o1 + o2,o1)-->T189 ==> not Finite(o1 + o2)
	(o1,o2)-->T29 ==> Stat31: (o1 incin o2) or (o2 incin o1)
	(Stat31)ELEM ==> Stat32: o1 + o2 = o1 or o1 + o2 = o2
	(c,d)-->T29 ==> Stat33: (c incin d) or (d incin c)
	(Stat33)ELEM ==> Stat34: c + d = c or c + d = d
	(Stat32,Stat34,Stat12)ELEM ==> Stat35: c + d in o1 + o2
--
-- It is easily seen that $o1 + o2$, which is one of $o1$ and $o2$, must be a cardinal.
--
	Suppose ==> not Card(o1 + o2)
	Suppose ==> o1 + o2 = o1
	EQUAL ==> false; Discharge ==> o1 + o2 = o2
	EQUAL ==> false; Discharge ==> Card(o1 + o2)
	Use_def(Card) ==> Ord(o1 + o2)
	(c + d)-->T32 ==> Ord(next(c + d))
	Suppose ==> next(c + d) notin o1 + o2
--
-- But since $o1$ and $o2$ are cardinals, we have $next(c + d) in o1 + o2$,
-- so that we can take $y = next(c + d)$ as the element
-- whose existence is asserted by our theorem.
--
	(o1 + o2,next(c + d))-->T35 ==> Stat36: next(c + d) incs o1 + o2
	(next(c + d),o1 + o2)-->T189 ==> not Finite(next(c + d))
	(c + d)-->T200 ==> not Finite(c + d)
	Use_def(next) ==> next(c + d) = (c + d) + {c + d}
	EQUAL ==> #next(c + d) = #((c + d) + {c + d})
	(o1 + o2,next(c + d))-->T170(Stat36) ==> Stat37: #next(c + d) incs #(o1 + o2)
	(c + d,c + d)-->T355 ==> #next(c + d) = #(c + d)
	(Stat37)ELEM ==> Stat38: #(c + d) incs #(o1 + o2)
	(c + d,c + d)-->T169(Stat38,Stat13) ==> (c + d) incs #(o1 + o2)
	(o1 + o2)-->T164 ==> Stat39: (c + d) incs (o1 + o2)
	(Stat39,Stat35)Discharge ==> Stat40: next(c + d) in o1 + o2
	(next(c + d))-->Stat6(Stat40,Stat30) ==> false; Discharge ==> QED
--
-- The following theorem, whose proof we have already described, asserts that any infinite set
-- can be divided in half, and is in fact in 1-1 correspondence with $s PROD {0,1}$.
--
Theorem 362: [Cardinal Doubling Theorem] (not Finite(S)) imp (#(S PROD {0,1}) = #S). Proof:
    Suppose_not(s) ==> (not Finite(s)) & (#(s PROD {0,1}) /= #s)
--
-- If we suppose the contrary, then clearly $s$ is an infinite set and $#(s PROD {0,1}) /= #s$.
-- Since $#(s PROD {0,1})$ is obviously at least as large as $#(s PROD {0}) = #s$, $#(s PROD {0,1})$
-- must be larger than $#s$, so that $#s in #(s PROD {0,1})$. I.e. there exists an infinite ordinal
-- such that x is less than  $#(x PROD {0,1})$, and so by the principle of transfinite induction
-- there exists a least such x.
--
    Use_def(TIMES) ==> (s TIMES {0,1}) /= #s
    ({0,1},s)-->T253 ==> ({0,1} TIMES s) /= #s
    ({0,1},s)-->T231 ==> ({0,1} TIMES #s) /= #s
    ({0,1},#s)-->T253 ==> (#s TIMES {0,1}) /= #s
    Use_def(TIMES) ==> #(#s PROD {0,1}) /= #s
    ELEM ==> ({0,1} /= 0) & ({0,1} = 2)
    T212 ==> {0,1} in Za
    T209 ==> Card(Za)
    Use_def(Card) ==> Ord(Za)
    (Za,{0,1})-->T12 ==> Ord({0,1})
    (0,1)-->T202 ==> Finite({0,1})
    ({0,1})-->T205 ==> Card({0,1})
    ({0,1},#s)-->T359 ==> ##s incin #(#s PROD {0,1})
    s-->T166 ==> (##s incin #(#s PROD {0,1})) & (#(#s PROD {0,1}) /= ##s)
    (#s)-->T156 ==> Ord(##s)
    (#s PROD {0,1})-->T156 ==> Ord(#(#s PROD {0,1}))
    (#(#s PROD {0,1}),##s)-->T34 ==> ##s in #(#s PROD {0,1})
    s-->T193 ==> not Finite(#s)
    s-->T156 ==> Card(#s) & Ord(#s)
    ELEM ==> Ord(#s) & (not Finite(#s)) & (##s in #(#s PROD {0,1}))
	APPLY(mt1_thryvar:x2) transfinite_induction(n ->#s,P(y)->Ord(y) & (not Finite(y)) & (#y in #(y PROD {0,1})))==>
		Stat1: (FORALL k | (Ord(x2) & (not Finite(x2)) & (#x2 in #(x2 PROD {0,1}))) &
			((k in x2) imp (not (Ord(k) & (not Finite(k)) & (#k in #(k PROD {0,1}))))))
--
-- it is easy to see that the minimality of $x2$ implies that $x2 = #x2$, i.e. that the ordinal $x2$ is a cardinal.
--
	a-->Stat1 ==> Stat2: Ord(x2) & (not Finite(x2)) & (#x2 in #(x2 PROD {0,1}))
	x2-->T148 ==> x2 notin #x2
	x2-->T147 ==> Ord(#x2)
	x2-->T193 ==> not Finite(#x2)
	(#x2,x2)-->T35 ==> x2 incs #x2
	Suppose ==> x2 /= #x2
	(x2,#x2)-->T34 ==> #x2 in x2
	#x2-->Stat1 ==> ##x2 notin #(#x2 PROD {0,1})
	x2-->T166 ==> ##x2 = #x2
	(x2,{0,1})-->T234 ==> false; Discharge ==> Stat3: x2 = #x2
	x2-->T156 ==> Card(#x2)
	EQUAL ==> Card(x2)
	({0,1},x2)-->T189 ==> not(x2 incin {0,1})
	({0,1},x2)-->T29 ==> x2 incs {0,1}
	ELEM ==> Stat4: x2 = x2 + {0,1}
	EQUAL ==> not Finite(x2 + {0,1})
--
-- Since $x2$ and ${0,1}$ are both cardinals, we can apply Theorem 361 to put $x2 PROD {0,1}$ into a 1-1 monotone
-- correspondence $f$ with some ordinal $o = domain(f)$.
--
	(x2,{0,1})-->T361 ==>
		Stat5: (EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (x2 PROD {0,1})) &
		(FORALL x in domain(f) | (EXISTS y in (x2 + {0,1}) | range(f ON x) incin (y PROD y))))
	f-->Stat5 ==> Stat6: one_1_map(f) & Ord(domain(f)) & (range(f) = (x2 PROD {0,1})) &
			Stat7: (FORALL x in domain(f) | (EXISTS y in (x2 + {0,1}) | range(f ON x) incin (y PROD y)))
	(f,x2)-->T80 ==> Stat8: range(f ON x2) incin (x2 PROD {0,1})
--
-- Our next aim is to show that $#domain(f)$ is no more than $x2$. This will follow
-- from the fact that for each $x$ in $domain(f)$, $#x$ is less than $x2$.
--
	Suppose ==> not(#domain(f) incin x2)
	(domain(f))-->T156 ==> Ord(#domain(f))
	(#domain(f),x2)-->T35 ==> Stat9: x2 in #domain(f)
	(domain(f),domain(f))-->T169(Stat6,Stat9*) ==> x2 in domain(f)
	x2-->Stat7 ==> Stat10: (EXISTS y in (x2 + {0,1}) | range(f ON x2) incin (y PROD y))
	y-->Stat10(Stat4,Stat10) ==> Stat11: (y in x2) & (range(f ON x2) incin (y PROD y))
	(Stat11,Stat8)ELEM ==> range(f ON x2) incin ((y PROD y) * (x2 PROD {0,1}))
	(y,y,x2,{0,1})-->T257 ==> Stat12: range(f ON x2) incin ((y * x2) PROD (y * {0,1}))
	(y * x2,y,y * {0,1},{0,1})-->T256(Stat12) ==> range(f ON x2) incin (y PROD {0,1})
	(x2,y)-->T12 ==> Stat13: Ord(y)
	(domain(f),x2)-->T13 ==> x2 incin domain(f)
	(f,x2)-->T94 ==> domain(f ON x2) = x2
	EQUAL ==> not Finite(domain(f ON x2))
	(f,x2)-->T58 ==> one_1_map(f ON x2)
	(f ON x2)-->T191 ==> not Finite(range(f ON x2))
	(y PROD {0,1},range(f ON x2))-->T189 ==> not Finite(y PROD {0,1})
	(y,{0,1})-->T262 ==> not Finite(y)
	y-->Stat1 ==> #y notin #(y PROD {0,1})
	y-->T156 ==> Ord(#y)
	(y PROD {0,1})-->T156 ==> Ord(#(y PROD {0,1}))
	(#(y PROD {0,1}),#y)-->T35 ==> #(y PROD {0,1}) incin #y
	({0,1},y)-->T250 ==> #y = #(y PROD {0,1})
	(range(f ON x2),y PROD {0,1})-->T170 ==> #range(f ON x2) incin #y
	(f ON x2)-->T157 ==> #domain(f ON x2) incin #y
--
-- And now we have a contradiction with the fact that $y in x2$, thereby proving our theorem.
--
	EQUAL ==> Stat14: x2 incin #y
	(y,y)-->T169(Stat13,Stat14*) ==> x2 incin y
	Discharge ==> #domain(f) incin x2
	f-->T157 ==> #domain(f) = #range(f)
	EQUAL ==> #(x2 PROD {0,1}) incin x2
	Discharge ==> QED
--
-- Our next theorem states that if one of the two sets $s$, $t$ in a union is infinite, the
-- the cardinal sum of the two sets is the union (i.e. maximum) m of the cardinalities $#s$, $#t$.
--
Theorem 363: [The sum of two infinite quantities is their maximum] (not Finite(S)) imp ((S PLUS T) = #S + #T). Proof:
Suppose_not(s,t) ==> (not Finite(s)) & ((s PLUS t) /= #s + #t)
--
-- For let $s$, $t$ be a counterexample to our assertion, so that either $s PLUS t$ or $#(s + t)$
-- differs from the larger of $#s$ and $#t$.
-- One of the two cardinals $#s$, $#t$ must be a subset of the other. If $#s$ is a subset of $#t$,
-- then both these cardinals are infinite, and the maximum $#s + #t$ is $#t$, so $#s PLUS #t /= #t$.
-- Plainly $#s PLUS #t$ is no less than $0 PLUS #t = #t$, so $#s PLUS #t$ must be greater than $#t$.
--
	(s,t)-->T221 ==> (#s PLUS #t) /= #s + #t
	s-->T156 ==> Ord(#s) & Card(#s)
	t-->T156 ==> Ord(#t) & Card(#t)
	(#s,#t)-->T29 ==> (#s incin #t) or (#t incin #s)
	Suppose ==> #s incin #t
	ELEM ==> ((#s PLUS #t) /= #t)
	(#t,#s)-->T189 ==> not Finite(#t)
	(#t,#s)-->T291 ==> #t incin (#s PLUS #t)
--
-- But by monotonicity $#s PLUS #t$ is no greater than $#t PLUS #t$, which by Theorem 362 is $#t$.
-- This contradiction rules out the possibility that $#t incs #s$.
-- Thus it follows that $#s$ must be the larger of $#t$ and $#s$.
--
	Set_monot ==> {[x,0]: x in #s} incin {[x,0]: x in #t}
	ELEM ==> ({[x,0]: x in #s} + {[x,1]: x in #t}) incin ({[x,0]: x in #t} + {[x,1]: x in #t})
	ELEM ==> ({0} + {1}) = {0,1}
	Set_monot ==> {[x,y]: x in #t, y in {0}} + {[x,y]: x in #t, y in {1}} = {[x,y]: x in #t, y in ({0} + {1})}
	SIMPLF ==> {[x,y]: x in #t, y in {0}} + {[x,y]: x in #t, y in {1}} = {[x,0]: x in #t} + {[x,1]: x in #t}
	EQUAL ==> {[x,0]: x in #t} + {[x,1]: x in #t} = {[x,y]: x in #t, y in {0,1}}
	Use_def(PROD) ==> ({[x,0]: x in #s} + {[x,1]: x in #t}) incin (#t PROD {0,1})
	({[x,0]: x in #s} + {[x,1]: x in #t},#t PROD {0,1})-->T170 ==>
		#({[x,0]: x in #s} + {[x,1]: x in #t}) incin #(#t PROD {0,1})
	Use_def(PLUS) ==> (#s PLUS #t) incin #(#t PROD {0,1})
	#t-->T362 ==> (#s PLUS #t) incin ##t
	#t-->T164 ==> (#s PLUS #t) incin #t
	Discharge ==> (#t incin #s) & ((#s PLUS #t) /= #s)
--
-- Arguing in the same way once more, it follows that $#s PLUS #t$ must be $#s$,
-- and hence must be the maximum $#s + #t$ in this case also. Thus our theorem is verified in all cases.
--
	Set_monot ==> {[x,1]: x in #t} incin {[x,1]: x in #s}
	ELEM ==> ({[x,0]: x in #s} + {[x,1]: x in #t}) incin ({[x,0]: x in #s} + {[x,1]: x in #s})
	ELEM ==> ({0} + {1}) = {0,1}
	Set_monot ==> {[x,y]: x in #s, y in {0}} + {[x,y]: x in #s, y in {1}} = {[x,y]: x in #s, y in ({0} + {1})}
	SIMPLF ==> {[x,y]: x in #s, y in {0}} + {[x,y]: x in #s, y in {1}} = {[x,0]: x in #s} + {[x,1]: x in #s}
	EQUAL ==> {[x,0]: x in #s} + {[x,1]: x in #s} = {[x,y]: x in #s, y in {0,1}}
	Use_def(PROD) ==> ({[x,0]: x in #s} + {[x,1]: x in #t}) incin (#s PROD {0,1})
	({[x,0]: x in #s} + {[x,1]: x in #t},#s PROD {0,1})-->T170 ==>
		#({[x,0]: x in #s} + {[x,1]: x in #t}) incin #(#s PROD {0,1})
	Use_def(PLUS) ==> (#s PLUS #t) incin #(#s PROD {0,1})
	#s-->T362 ==> (#s PLUS #t) incin ##s
	#t-->T164 ==> (#s PLUS #t) incin #s
--
-- The possibility that $(s PLUS t) /= #s + #t$ now having been ruled out,
-- it follows that $#(s + t) /= #s + #t$. However, Theorem 222 tells us that $#(s + t) = #s PLUS #(t - s)$.
-- Since $(s PLUS t) = (#s PLUS #t)$ = $#s + #t$ also by Theorem 221,
--
(#s,#t)-->T291 ==> #s incin (#s PLUS #t); Discharge ==> QED
--
-- We can also prove that if one of the two sets $s$, $t$ in a union is infinite, the
-- cardinality of $s + t$ is the union (i.e. maximum) of the cardinalities $#s, #t$.
--
Theorem 364: [The cardinality of the union of two infinite quantities is the cardinality of the larger] (not Finite(S)) imp (#(S + T) = #S + #T). Proof:
	Suppose_not(s,t) ==> (not Finite(s)) & (#(s + t) /= #s + #t)
--
-- For one of the two ordinals $#s$, $#t$ must be included in the other.
-- If $#t$ is included in $#s$, we would have $#(s + t) /= #s$ and so
-- $#s in #(s + t)$, contradicting the fact that $#(s + t)$ can be no larger than $#(s PLUS s) = #s$
-- by the preceding results.
--
	t-->T156 ==> Ord(#t)
	s-->T156 ==> Ord(#s)
    (#s,#t)-->T29 ==> (#s incin #t) or (#t incin #s)
    s-->T193 ==> not Finite(#s)
    Suppose ==> #t incin #s
    ELEM ==> #(s + t) /= #s
    (t - s,t)-->T170 ==> #(t - s) incin #s
    (s,t - s)-->T222 ==> #(s + (t - s)) = #s PLUS #(t - s)
    ELEM ==> s + (t - s) = s + t
    EQUAL ==> #(s + t) = #s PLUS #(t - s)
    (#s,#(t - s))-->T363 ==> #(s + t) = ##s + ##(t - s)
    s-->T166 ==> #(s + t) = #s + ##(t - s)
   	(t - s)-->T166 ==> #(s + t) = #s
    Discharge ==> #s incin #t
--
-- But by symmetry we can we argue in exactly the same way with $s$ and $t$ reversed,
-- excluding this case also and so proving our theorem.
--
    (#t,#s)-->T189 ==> not Finite(#t)
    ELEM ==> #(s + t) /= #t
    (s - t,s)-->T170 ==> #(s - t) incin #t
    (t,s - t)-->T222 ==> #(t + (s - t)) = #t PLUS #(s - t)
    ELEM ==> t + (s - t) = s + t
    EQUAL ==> #(s + t) = #t PLUS #(s - t)
    (#t,#(s - t))-->T363 ==> #(s + t) = ##t + ##(s - t)
    t-->T166 ==> #(s + t) = #t + ##(s - t)
   	(s - t)-->T166 ==> #(s + t) = #t
    Discharge ==> QED
--
-- We are now ready to prove the Cardinal Square Theorem, but again
-- give an informal outline of its proof before entering upon its formal details.
-- The theorem asserts that for every infinite set s, $#s = #(s PROD s)$. If this is false,
-- then $#s /= #(s PROD s)$ = $(s TIMES s) = (#s TIMES #s)$ = $#(#s PROD #s)$,
-- so our assertion is also false for the infinite cardinal $#s$, and hence for some infinite ordinal.
-- It follows by the axiom of choice that our assertion is also false for some smallest infinite ordinal $s1$.
-- s1 must be a cardinal, since otherwise $#s1 in s1$, but also $s1 in #(s1 PROD s1)$ = $#(#s1 PROD #s1)$,
-- so we would have $#s1 in #(#s1 PROD #s1)$ also, contradicting the minimality of s1.
--
-- Order $s1 PROD s1$ by the product ordering described above. The theory we have just established
-- tells us that this is a well-ordering, so that by our previous theory of well-orderings
-- there exists a 1-1 map $f$ from some ordinal $o$ onto $s1 PROD s1$ which is monotone increasing if $o$
-- is given its standard ordering and $s1 PROD s1$ is given its product ordering.
--
-- If $o1$ is a finite  member of the ordinal $o$, then obviously $#o1$ is a member of the infinite cardinal $s1$.
-- If $o1$ is an infinite  member of the ordinal $o$, then it is a proper subset of $o$;
-- so $range(f ON o1)$ is a proper subset $t$ of $s1 PROD s1$.
-- As in the proof of Theorem 362 we show that there exists an $n$ in $s1$ such that
-- $range(f ON o1)$ is a subset of $n PROD n$, and so it follows
-- from the minimality of $s1$ that $#t incin #(n PROD n)$ = $n in s1$. Hence $#o1$ is a member of $s1$
-- for each $o1 in o$, proving that $#o incin s1$ in this case also. Since $o$ is in 1-1 correspondence with
-- $s1 PROD s1$ it follows that $#(s1 PROD s1) incin s1$, contrary to our assumption.
-- This contradiction proves our desired theorem.
--
Theorem 365: [Cardinal Square Theorem] (not Finite(S)) imp (#(S PROD S) = #S). Proof:
    Suppose_not(s) ==> (not Finite(s)) & (#(s PROD s) /= #s)
--
-- If we suppose the contrary, then clearly $s$ is an infinite set and $#(s PROD s) /= #s$.
-- Since $#(s PROD s)$ is obviously at least as large as $#(s PROD {0}) = #s$, $#(s PROD s)$
-- must be larger than $#s$, so that $#s in #(s PROD s)$. I.e. there exists an infinite ordinal
-- such that $x$ is less than  $#(x PROD x)$, and so by the principle of transfinite induction
-- there exists a least such $x$.
--
    Use_def(TIMES) ==> (s TIMES s) /= #s
    (s,s)-->T230 ==> (#s TIMES #s) /= #s
    Use_def(TIMES) ==> #(#s PROD #s) /= #s
    T188 ==> Finite(0)
    Suppose ==> s = 0
    EQUAL ==> false; Discharge ==> s /= 0
    s-->T162 ==> #s /= 0
    (#s,#s)-->T359 ==> #s incin #(#s PROD #s)
    (#s)-->T156 ==> Ord(#s)
    (#s PROD #s)-->T156 ==> Ord(#(#s PROD #s))
    (#(#s PROD #s),#s)-->T34 ==> #s in #(#s PROD #s)
    s-->T193 ==> not Finite(#s)
    s-->T156 ==> Card(#s) & Ord(#s)
	APPLY(mt1_thryvar:x2) transfinite_induction(n ->#s,P(y)->Ord(y) & (not Finite(y)) & (#y in #(y PROD y)))==>
		Stat1: (FORALL k | (Ord(x2) & (not Finite(x2)) & (#x2 in #(x2 PROD x2))) &
		 ((k in x2) imp (not (Ord(k) & (not Finite(k)) & (#k in #(k PROD k))))))
	a-->Stat1 ==> Stat2: Ord(x2) & (not Finite(x2)) & (#x2 in #(x2 PROD x2))
--
-- it is easy to see that the minimality of $x2$ implies that $x2 = #x2$, i.e. that the ordinal $x2$ is a cardinal.
--
	x2-->T148 ==> x2 notin #x2
	x2-->T147 ==> Ord(#x2)
	x2-->T193 ==> not Finite(#x2)
	(#x2,x2)-->T35 ==> x2 incs #x2
	Suppose ==> x2 /= #x2
	(x2,#x2)-->T34 ==> #x2 in x2
	(#x2)-->Stat1 ==> ##x2 notin #(#x2 PROD #x2)
	x2-->T166 ==> ##x2 = #x2
	(x2,x2)-->T232 ==> false; Discharge ==> Stat3: x2 = #x2
	(x2)-->T156 ==> Card(#x2)
	EQUAL ==> Card(x2)
	TELEM ==> x2 = x2 + x2
	EQUAL ==> not Finite(x2 + x2)
--
-- Since $x2$ is a cardinal, we can apply Theorem 361 to put $x2 PROD x2$ into a 1-1 monotone
-- correspondence $f$ with some ordinal $o = domain(f)$.
--
	(x2,x2)-->T361 ==>
		Stat4: (EXISTS f in OM | one_1_map(f) & Ord(domain(f)) & (range(f) = (x2 PROD x2)) &
		(FORALL x in domain(f) | (EXISTS y in (x2 + x2) | range(f ON x) incin (y PROD y))))
	f-->Stat4() ==> Stat5: one_1_map(f) & Ord(domain(f)) & (range(f) = (x2 PROD x2)) &
			Stat6: (FORALL x in domain(f) | (EXISTS y in (x2 + x2) | range(f ON x) incin (y PROD y)))
	(f,x2)-->T80 ==> Stat7: range(f ON x2) incin (x2 PROD x2)
--
-- Our next aim is to show that $#domain(f)$ is no more than $x2$. This will follow
-- from the fact that for each $x$ in $domain(f)$, $#x$ is less than $x2$.
--
	Suppose ==> not(#domain(f) incin x2)
	(domain(f))-->T156() ==> Ord(#domain(f))
	(#domain(f),x2)-->T35 ==> x2 in #domain(f)
	(domain(f),domain(f))-->T169(Stat2) ==> Stat8: x2 in domain(f)
	x2-->Stat6(Stat8) ==> Stat9: (EXISTS y in (x2 + x2) | range(f ON x2) incin (y PROD y))
	y-->Stat9(Stat9) ==> Stat10: (y in x2) & (range(f ON x2) incin (y PROD y))
	(Stat10,Stat7*)ELEM ==> Stat11: range(f ON x2) incin ((y PROD y) * (x2 PROD x2))
	(y,y,x2,x2)-->T257(Stat11) ==> range(f ON x2) incin ((y * x2) PROD (y * x2))
	(y * x2,y,y * x2,x2)-->T256 ==> range(f ON x2) incin (y PROD y)
	(x2,y)-->T12 ==> Stat12: Ord(y)
	(domain(f),x2)-->T13 ==> x2 incin domain(f)
	(f,x2)-->T94 ==> domain(f ON x2) = x2
	EQUAL ==> not Finite(domain(f ON x2))
	(f,x2)-->T58 ==> one_1_map(f ON x2)
	(f ON x2)-->T191 ==> not Finite(range(f ON x2))
	(y PROD y,range(f ON x2))-->T189 ==> not Finite(y PROD y)
	(y,y)-->T262 ==> not Finite(y)
	Suppose ==> y = 0
	EQUAL ==> not Finite(0)
	T188 ==> false; Discharge ==> y /= 0
	y-->Stat1 ==> #y notin #(y PROD y)
	y-->T156 ==> Ord(#y)
	(y PROD y)-->T156 ==> Ord(#(y PROD y))
	(#(y PROD y),#y)-->T35 ==> #(y PROD y) incin #y
	(y,y)-->T250 ==> #y = #(y PROD y)
	(range(f ON x2),y PROD y)-->T170 ==> #range(f ON x2) incin #y
	(f ON x2)-->T157 ==> #domain(f ON x2) incin #y
--
-- And now we have a contradiction with the fact that $y in x2$, thereby proving our theorem.
--
	EQUAL ==> Stat13: x2 incin #y
	(y,y)-->T169(Stat12,Stat13*) ==> x2 incin y
	Discharge ==> #domain(f) incin x2
	f-->T157 ==> #domain(f) = #range(f)
	EQUAL ==> #(x2 PROD x2) incin x2
	Discharge ==> QED
--
-- ************************************************************************************************
--							Section 9: The signed integers
-- ************************************************************************************************
--
-- After the preceding digression to prove the Cardinal Product theorem, we now return to our main task:
-- developing the standard foundations of analysis. Our first step is to define signed integers
-- and prove their properties. Signed integers and the arithmetic operations on them are defined as follows.
-- Note that we choose to define a signed integer as a pair $[x,y]$ of ordinary integers,
-- one or both of which is always zero. The idea is that $[x,0]$ represents the positive integer $x$, while
-- $[0,x]$ represents the negative integer $-x$.
--
Def 26: [The signed Integers] Si := {[x,y]: x in Za, y in Za | x = 0 or y = 0}
Def 27: [Signed Integer Reduction to Normal Form]
    Red(P) := [car(P) MINUS (car(P) * cdr(P)),cdr(P) MINUS (car(P) * cdr(P))]
Def 28: [Signed addition]
    Def(MM S_PLUS NN) := Red([car(MM) PLUS car(NN),cdr(MM) PLUS cdr(NN)])
Def 28a: [Absolute value of a signed integer] S_ABS(M) := [car(M) + cdr(M),0]
Def 28b: [Negative of a signed integer] S_Rev(M) := [cdr(M),car(M)]
Def 29: [Signed Product] Def(MM S_TIMES NN) :=
	Red([(car(MM) TIMES car(NN)) PLUS (cdr(MM) TIMES cdr(NN)),(car(MM) TIMES cdr(NN)) PLUS (car(NN) TIMES cdr(MM))])
Def 32: [Signed Difference] Def(N S_MINUS M) := Red([cdr(M) PLUS car(N),car(M) PLUS cdr(N)])
Def 33: [Sign of a signed integer] is_nonneg(x) := car(x) incs cdr(x)
--
-- Our first result concerning the small family of operations just introduced is that
-- the reduction $Red([m,n])$ of any pair of positive integers is a signed integer, and that
-- $m * n$ is always $0$.
--
Theorem 366: [Reduced form of an integer pair] ((M in Za) & (N in Za)) imp ((Red([M,N]) in Si) & (M * N in Za)). Proof:
    Suppose_not(m,n) ==> (m in Za) & (n in Za) & (Red([m,n]) notin Si or (m * n notin Za))
--
-- For suppose that there is a counterexample $m$, $n$ to our assertion. $m$ and $n$
-- are plainly finite ordinals, and so their intersection is also a finite ordinal
-- and therefore an integer. Hence the differences $m MINUS (m * n)$ and $n MINUS (m * n)$
-- are integers also.
--
	m-->T206 ==> Card(m) & Finite(m)
	n-->T206 ==> Card(n) & Finite(n)
    Use_def(Card) ==> Ord(m) & Ord(n)
    (m,n)-->T28 ==> Ord(m * n)
    (m,m * n)-->T189 ==> Finite(m * n)
    (m * n)-->T205 ==> Card(m * n)
    (m * n)-->T206 ==> m * n in Za
    (m,m * n)-->T283 ==> (m MINUS (m * n)) in Za
    (n,m * n)-->T283 ==> (n MINUS (m * n)) in Za
--
-- Since we have seen that $m * n$ is an integer, only the second conclusion of our theorem
-- can fail. But one of $m$ and $n$ must be no larger than the other, and if, e.g. this is $m$ we have
-- $m * n = m$ and so $Red([m,n]) = m MINUS m$ by definition, implying $Red([m,n]) = 0$ and so
-- proving that $Red([m,n]) in Si$. The proof in case $n$ is no larger than $m$ is equally trivial.
--
    (m,n)-->T29 ==> (m incin n) or (n incin m)
    ELEM ==> (m * n = m or m * n = n) & (Red([m,n]) notin Si)
    Use_def(Red) ==> [m MINUS (m * n),n MINUS (m * n)] notin Si
    Use_def(Si) ==> Stat1: [m MINUS (m * n),n MINUS (m * n)] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
    (m MINUS (m * n),n MINUS (m * n))-->Stat1 ==> (m MINUS (m * n) /= 0) & (n MINUS (m * n) /= 0)
    Suppose ==> m * n = m
    EQUAL ==> (m MINUS m) /= 0
    m-->T267 ==> false; Discharge ==> m * n = n
    EQUAL ==> (n MINUS n) /= 0
    n-->T267 ==> false; Discharge ==> QED
--
-- Next we note an entirely trivial consequence of our definition of signed integers: if $n$ is
-- and unsigned integer, then $[n,0]$ (the signed version of $n$) and $[0,n]$ (corresponding to $n$)
-- are signed integers.
--
Theorem 367: [Embedding of integers in the signed integers] (N in Za) imp (([N,0] in Si) & ([0,N] in Si)). Proof:
	Suppose_not(n) ==> (n in Za) & (([n,0] notin Si) or ([0,n] notin Si))
	T211 ==> 0 in Za
	Use_def(Si) ==> Si = {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	Suppose ==> Stat1: [n,0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(n,0)-->Stat1 ==> false; Discharge ==> Stat2: [0,n] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(0,n)-->Stat2 ==> false; Discharge ==> QED
--
-- It is also trivial that $[0,0]$ (the signed $0$), $[0,1]$ (the signed $1$), and  $[0,1]$ (corresponding to $-1$)
-- are all signed integers.
--
Theorem 368: [Basic properties of the signed integers 0,1, and -1] ([0,0] in Si) & ([1,0] in Si) & ([0,1] in Si) & ([1,0] /= [0,0]) & ([0,1] /= [0,0]) & ([1,0] /= [0,1]). Proof:
	Suppose_not ==> not(([0,0] in Si) & ([1,0] in Si) & ([0,1] in Si) & ([1,0] /= [0,0]) & ([0,1] /= [0,0]) & ([1,0] /= [0,1]))
    T212 ==> not(([0,0] in Si) & ([1,0] in Si) & ([0,1] in Si))
	T211 ==> (0 in Za) & (1 in Za)
	1-->T367 ==> [0,0] notin Si
	0-->T367 ==> false; Discharge ==> QED
--
-- Next we note various elementary facts concerning signed integers: they are always pairs of unsigned integers,
-- one of which is zero; signed integers are invariant under the reduction operator $Red$;
-- and the minimum  of the two components of a signed integer is always $0$.
--
Theorem 369: [The signed integers as integer pairs with one component equal to 0] (N in Si) imp ((N = [car(N),cdr(N)]) & (car(N) = 0 or cdr(N) = 0) & (car(N) in Za) & (cdr(N) in Za) &
			(Red(N) = N) & (car(N) * cdr(N) = 0)). Proof:
    Suppose_not(n) ==>
	Stat1: (n in Si) & ((n /= [car(n),cdr(n)]) or ((car(n) /= 0) & (cdr(n) /= 0)) or (car(n) notin Za) or (cdr(n) notin Za) or
					(Red(n) /= n) or (car(n) * cdr(n) /= 0))
--
-- Since $n$ is a signed integer, it has the form$ n = [i,j]$ where either $i$ or $j$ is $0$. Hence
-- our assertion can only be false if $Red(n) /= n$. But by definition $Red(n) = [i MINUS (i * j),j MINUS (i * j)]$,
-- so our assertion follows immediately from Theorem 207 and Theorem 268.
--
    Use_def(Si) ==> Stat2: n in {[x,y]: x in Za, y in Za | x = 0 or y = 0}
    (i,j)-->Stat2 ==> Stat3: (n = [i,j]) & (i in Za) & (j in Za) & (i = 0 or j = 0)
    ELEM ==> Stat4: i * j = 0
    (Stat3)ELEM ==> Stat5: ((car(n) = 0) or (cdr(n) = 0)) & (car(n) in Za) & (cdr(n) in Za) &
					(car(n) * cdr(n) = 0)
    (Stat3,Stat4)ELEM ==> Stat6: n = [car(n),cdr(n)]
    (Stat1,Stat5,Stat6*)ELEM ==> Stat7: Red(n) /= n
    Use_def(Red) ==> Stat8: Red([i,j]) = [i MINUS (i * j),j MINUS (i * j)]
    EQUAL ==> Red([i,j]) = Red(n)
    EQUAL ==> i MINUS (i * j) = i MINUS 0
    EQUAL ==> j MINUS (i * j) = j MINUS 0
    i-->T268 ==> i MINUS 0 = #i
    j-->T268 ==> j MINUS 0 = #j
    (Stat8)ELEM ==> Stat9: Red(n) = [#i,#j]
    i-->T207 ==> i = #i
    j-->T207 ==> j = #j
    (Stat9)ELEM ==> Stat10: Red(n) = [i,j]
    (Stat3,Stat7,Stat10*)Discharge ==> QED
--
-- The following variant form of the preceding theorem is often a bit more useful.
--
Theorem 370: [Signed integers as integer pairs, 2] (N in Si) imp ((N = [car(N),0] or N = [0,cdr(N)]) & (car(N) = 0 or cdr(N) = 0) &
				(car(N) in Za) & (cdr(N) in Za) & (Red(N) = N) & (car(N) * cdr(N) = 0)). Proof:
    Suppose_not(n) ==>
	Stat1: (n in Si) & (not((n = [car(n),0] or n = [0,cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za) &
					(Red(n) = n) & (car(n) * cdr(n) = 0)))
	n-->T369 ==> (n = [car(n),cdr(n)]) & (not(n = [car(n),0] or n = [0,cdr(n)])) & (car(n) = 0 or cdr(n) = 0)
    Suppose ==> car(n) = 0
    Discharge ==> cdr(n) = 0
    Discharge ==> QED
--
-- The following theorem states that the set of signed integers is closed under addition and multiplication.
--
Theorem 371: ((N in Si) & (M in Si)) imp ((N S_PLUS M in Si) & (N S_TIMES M in Si)). Proof:
--
-- The proof is elementary. We just use the definitions of the operators involved and the information
-- concerning the form of signed integers provided by Theorem 369.
--
	Suppose_not(n,m) ==> (n in Si) & (m in Si) & (not((n S_PLUS m in Si) & (n S_TIMES m in Si)))
     n-->T369 ==> (car(n) in Za) & (cdr(n) in Za)
    m-->T369 ==> (car(m) in Za) & (cdr(m) in Za)
    Use_def(S_PLUS) ==> n S_PLUS m = Red([car(n) PLUS car(m),cdr(n) PLUS cdr(m)])
	ALGEBRA ==> (car(n) PLUS car(m) in Za) & (cdr(n) PLUS cdr(m) in Za)
	(car(n) PLUS car(m),cdr(n) PLUS cdr(m))-->T366 ==> n S_PLUS m in Si
    Use_def(S_TIMES) ==> n S_TIMES m =
	Red([(car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m)),(car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n))])
    ALGEBRA ==> ((car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m)) in Za) &
	((car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n)) in Za)
    ((car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m)),(car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n)))-->T366 ==> false; Discharge ==> QED
--
-- Our next theorem asserts that the negative $S_Rev(n)$ of a signed integer, and the difference
-- $n S_MINUS m$ of two signed integers, are always signed integers.
--
Theorem 372: [Sign reversal and subtraction for signed integers] ((N in Si) & (M in Si)) imp ((S_Rev(M) in Si) & (N S_MINUS M in Si)). Proof:
 	Suppose_not(n,m) ==> (n in Si) & (m in Si) & (not((S_Rev(m) in Si) & (n S_MINUS m in Si)))
--
-- For a signed integer $n$ is simply a pair $[a,b]$ of ordinary integers one of which is zero,
-- so plainly its reverse $[b,a]$ has the same property.
--
 	n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
	m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
	Use_def(S_Rev) ==> S_Rev(m) = [cdr(m),car(m)]
	ELEM ==> (car([cdr(m),car(m)]) = cdr(m)) & (cdr([cdr(m),car(m)]) = car(m))
	EQUAL ==> (car(S_Rev(m)) = cdr(m)) & (cdr(S_Rev(m)) = car(m))
	Suppose ==> S_Rev(m) notin Si
	Use_def(Si) ==> Stat1: S_Rev(m) notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(cdr(m), car(m))-->Stat1 ==> false; Discharge ==> S_Rev(m) in Si
	ELEM ==> (n S_MINUS m) notin Si
--
-- Moreover the difference of two signed integers is by definition the reduction of a
-- pair of unsigned integers, and so is a signed integer by definition.
--
	Use_def(S_MINUS) ==> Red([cdr(m) PLUS car(n),car(m) PLUS cdr(n)]) notin Si
	ALGEBRA ==> ((cdr(m) PLUS car(n)) in Za) & ((car(m) PLUS cdr(n)) in Za)
	(cdr(m) PLUS car(n),car(m) PLUS cdr(n))-->T366 ==> false; Discharge ==> QED
--
-- Our next lemma states the elementary fact that any pair $[n,n]$ of unsigned integers
-- reduces to the pair [0,0].
--
Theorem 373: [Reduction of an integer pair $(n,n)$ always gives the signed 0 value] (N in Za) imp (Red([N,N]) = [0,0]). Proof:
	Suppose_not(n) ==> (n in Za) & (Red([n,n]) /= [0,0])
    Use_def(Red) ==> Red([n,n]) = [n MINUS (n * n),n MINUS (n * n)]
    ELEM ==> n * n = n
    EQUAL ==> Red([n,n]) = [n MINUS n,n MINUS n]
    n-->T267 ==> false; Discharge ==> QED
--
-- The following theorem, which generalizes the Lemma just noted, states that the value to which
-- any pair $[j,k]$ of integers reduces is unchanged if a common integer $m$ is added to both $i$ and $j$.
--
Theorem 374: [Reduction removes any common value added to the components of an integer pair] ((J in Za) & (K in Za) & (M in Za)) imp (Red([J PLUS M,K PLUS M]) = Red([J,K])). Proof+:
Suppose_not(j,k,m) ==> AUTO
--
-- Suppose that $j,k,m$ form a counterexample to our theorem. Of the two integers $j$, $k$ one is smaller.
-- Suppose for the moment that this is $j$, so that $j$ is a subset of $k$.
-- It follows that $j * k = j$, so by definition of the reduction operator, $Red([j,k]) = [0,k MINUS j]$.
--
    Use_def(Red) ==> Red([j PLUS m,k PLUS m]) =
	[(j PLUS m) MINUS ((j PLUS m) * (k PLUS m)),
	(k PLUS m) MINUS ((j PLUS m) * (k PLUS m))]
    Use_def(Red) ==> Red([j,k]) = [j MINUS (j * k),k MINUS (j * k)]
    (j,k)-->T29 ==> (j incin k) or (k incin j)
    Suppose ==> j incin k
    ELEM ==> j * k = j
    EQUAL ==> Stat1: Red([j,k]) = [j MINUS j,k MINUS j]
    j-->T267(Stat1) ==> Red([j,k]) = [0,k MINUS j]
--
-- By the monotonicity of addition, $j PLUS m$ is no greater than $k PLUS m$,
-- so it follows by the same argument as above that $Red([j PLUS m,k PLUS m]) = [0,(k PLUS m) MINUS (j PLUS m)]$.
-- Using Theorem 267 we now see that $Red([j PLUS m,k PLUS m]) = Red([j,k])$,
-- a contradiction which excludes the possibility that $j$ is less than $k$.
--
    (j,k,m)-->T290 ==> (j PLUS m) incin (k PLUS m)
    ELEM ==> (j PLUS m) * (k PLUS m) = j PLUS m
    EQUAL ==> Stat2: Red([j PLUS m,k PLUS m]) =
	[(j PLUS m) MINUS (j PLUS m),(k PLUS m) MINUS (j PLUS m)]
    (j PLUS m)-->T267(Stat2) ==> (j PLUS m) MINUS (j PLUS m) = 0
    (Stat2)ELEM ==> Red([j PLUS m,k PLUS m]) = [0,(k PLUS m) MINUS (j PLUS m)]
    (k,j,m)-->T314 ==> (k PLUS m) MINUS (j PLUS m) = k MINUS j
    EQUAL ==> false; Discharge ==> k incin j
--
-- It follows that $k$ is less than $j$. But in this case an argument exactly symmetric to that
-- just given leads to a contradiction, which proves our theorem.
--
    ELEM ==> j * k = k
    EQUAL ==> Red([j,k]) = [j MINUS k,k MINUS k]
    k-->T267 ==> k MINUS k = 0
    EQUAL ==> Red([j,k]) = [j MINUS k,0]
    (k,j,m)-->T290 ==> (k PLUS m) incin (j PLUS m)
    ELEM ==> (k PLUS m) * (j PLUS m) = k PLUS m
    Use_def(Red) ==> Red([j PLUS m,k PLUS m]) =
    	[(j PLUS m) MINUS (car([j PLUS m,k PLUS m]) * cdr([j PLUS m,k PLUS m])),
    					(k PLUS m) MINUS (car([j PLUS m,k PLUS m]) * cdr([j PLUS m,k PLUS m]))]
    ELEM ==> car([j PLUS m,k PLUS m]) * cdr([j PLUS m,k PLUS m]) = k PLUS m
    EQUAL ==> Red([j PLUS m,k PLUS m]) =
	[(j PLUS m) MINUS (k PLUS m),(k PLUS m) MINUS (k PLUS m)]
    (k PLUS m)-->T267 ==> (k PLUS m) MINUS (k PLUS m) = 0
    EQUAL ==> Red([j PLUS m,k PLUS m]) = [(j PLUS m) MINUS (k PLUS m),0]
    (j,k,m)-->T314 ==> ((j PLUS m) MINUS (k PLUS m)) = (j MINUS k)
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the intersection of two unsigned integers, being
-- the smaller of the two, is an unsigned integer.
--
Theorem 375: [The intersection of two unsigned integers is the smaller of the two] ((N in Za) & (M in Za)) imp (((N * M) in Za) & ((N * M) in {N,M}) & ((N MINUS (N * M)) in Za) & ((M MINUS (N * M)) in Za)). Proof+:
Suppose_not(n,m) ==> AUTO
	(n,m)-->T29 ==> (n * m in Za) & ((n * m = n) or (n * m = m))
	(n,n * m)-->T283 ==> (n MINUS (n * m)) in Za
	(m,n * m)-->T283 ==> (m MINUS (n * m)) in Za
	Discharge ==> QED
--
-- Next we show that the signed integer sum of any two pairs of integers is the sum of the
-- first with the reduction of the second.
--
Theorem 376: [The signed sum of two integer pairs is the sum of the first with the reduced form of the second] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) imp ([J,K] S_PLUS [N,M] = [J,K] S_PLUS Red([N,M])). Proof:
    Suppose_not(j,k,n,m) ==> AUTO
--
-- For suppose that there is a counterexample $j,k,n,m$ to our assertion. Of the two integers $n$, $m$,
-- one is smaller, so that $n * m$ is an integer in any case.
--
    n-->T207 ==> n = #n
    m-->T207 ==> m = #m
    (n,m)-->T375(*) ==> ((n * m) in Za) & (((n * m) = n) or ((n * m) = m)) & ((n MINUS (n * m)) in Za) & ((m MINUS (n * m)) in Za)
--
-- Use of the definitions of the $S_PLUS$ and $Red$ operators converts
-- the negative of our theorem into the inequality just below.
--
    Use_def(S_PLUS) ==>
		Red([j PLUS n,k PLUS m]) /= Red([j PLUS car(Red([n,m])),k PLUS cdr(Red([n,m]))])
    Use_def(Red) ==> Stat1: Red([n,m]) = [n MINUS (n * m),m MINUS (n * m)]
    (Stat1)ELEM ==> (n incs n * m) & (m incs n * m) &
    		(car(Red([n,m])) = n MINUS (n * m)) & (cdr(Red([n,m])) = m MINUS (n * m))
	EQUAL ==>  Red([j PLUS n,k PLUS m]) /= Red([j PLUS (n MINUS (n * m)),(k PLUS (m MINUS (n * m)))])
--
-- But we can add $n * m$ to both components of the pair seen on the right-hand side of this last inequality
-- without changing its reduction, and so after a bit more algebraic manipulation derive a contradiction
-- which proves the present theorem.
--
	ALGEBRA ==> (j PLUS (n MINUS (n * m)) in Za) & (k PLUS (m MINUS (n * m)) in Za)
	(j PLUS (n MINUS (n * m)),k PLUS (m MINUS (n * m)),(n * m))-->T374 ==>
		Red([j PLUS (n MINUS (n * m)),k PLUS (m MINUS (n * m))]) =
			Red([(j PLUS (n MINUS (n * m))) PLUS (n * m),(k PLUS (m MINUS (n * m))) PLUS (n * m)])
	ALGEBRA ==> Red([j PLUS (n MINUS (n * m)),(k PLUS (m MINUS (n * m)))]) =
		Red([j PLUS ((n MINUS (n * m)) PLUS (n * m)),k PLUS ((m MINUS (n * m)) PLUS (n * m))])
	(n*m,n)-->T272 ==> (n MINUS (n * m)) PLUS (n * m) = n
	(n*m,m)-->T272 ==> (m MINUS (n * m)) PLUS (n * m) = m
    EQUAL ==> false; Discharge ==> QED
--
-- The following elementary corollary to the theorem just proved  tells us that addition of any pair $p$
-- of integers to a signed integer $x$ produces the same result as addition of the reduced form of $p$ to $x$.
--
Theorem 377: [The sum of a signed integer and an integer pair remains the same if the pair is reduced] ((K in Si) & (N in Za) & (M in Za)) imp (K S_PLUS [N,M] = K S_PLUS Red([N,M])). Proof:
	Suppose_not(k,n,m) ==> AUTO
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) = 0 or cdr(k) = 0) & (car(k) in Za) & (cdr(k) in Za) & (Red(k) =k)
    (car(k),cdr(k),n,m)-->T376 ==>
    	[car(k),cdr(k)] S_PLUS [n,m] = [car(k),cdr(k)] S_PLUS Red([n,m])
    EQUAL ==> false; Discharge ==> QED
--
-- The following 'multiplication' analog to Theorem 377 states that multiplication of  a signed integer $k$
-- by any pair $p$ of integers produces the same result as multiplication of $k$ by the reduced form of $p$.
--
Theorem 378: [The product of a signed integer and an integer pair remains the same if the pair is reduced] ((K in Si) & (N in Za) & (M in Za)) imp (K S_TIMES [N,M] = K S_TIMES Red([N,M])). Proof:
    Suppose_not(k,n,m) ==> (k in Si) & (n in Za) & (m in Za) & (k S_TIMES [n,m] /= k S_TIMES Red([n,m]))
--
-- For suppose that $k = [cak,cdk]$, $n$, $m$ comprise a counterexample to our theorem, where plainly all of
-- $cak$, $cdk$, $n$, $m$ must be integers, and so must all the other quantities formed from them in the argument which follows.
-- Since $n * m$ is the minimum of $n$ and $m$ and so is no more than either, we have $(n MINUS (n * m)) PLUS (n * m) = n$,
-- and $(m MINUS (n * m)) PLUS (n * m) = m$, by theorems on unsigned integer subtractioand addition proved earlier.
--
    k-->T369 ==> Stat1: (k = [car(k),cdr(k)]) & (car(k) = 0 or cdr(k) = 0) & (car(k) in Za) & (cdr(k) in Za) & (Red(k) = k)
    (n,m)-->T375(*) ==> ((n * m) in Za) & ((n MINUS (n * m)) in Za) & ((m MINUS (n * m)) in Za)
    n-->T207 ==> (n = #n)
    m-->T207 ==> (m = #m)
    (n * m)-->T207 ==> (n * m) = #(n * m)
    (n * m,n)-->T271 ==> #(n * m) PLUS (n MINUS (n * m)) = #n
    (n * m,m)-->T271 ==> #(n * m) PLUS (m MINUS (n * m)) = #m
    EQUAL ==> (n * m) PLUS (n MINUS (n * m)) = n
    EQUAL ==> (n * m) PLUS (m MINUS (n * m)) = m
    (n MINUS (n * m),n * m)-->T252 ==> Stat2: (n MINUS (n * m)) PLUS (n * m) = n
    (m MINUS (n * m),n * m)-->T252 ==> Stat3: (m MINUS (n * m)) PLUS (n * m) = m
--
-- Using the definitions of signed integer multiplication and of reduction we can expand
-- the negative of our theorem into the inequality between reductions seen below.
--
    Use_def(S_TIMES) ==>
		Red([(car(k) TIMES n) PLUS (cdr(k) TIMES m),(car(k) TIMES m) PLUS (n TIMES cdr(k))]) /=
			Red([(car(k) TIMES car(Red([n,m]))) PLUS (cdr(k) TIMES cdr(Red([n,m]))),
				(car(k) TIMES cdr(Red([n,m]))) PLUS (car(Red([n,m])) TIMES cdr(k))])
    Loc_def ==> Stat4: cak = car(k)
    Loc_def ==> Stat5: cdk = cdr(k)
    (Stat1,Stat4,Stat5)ELEM ==> (k = [cak,cdk]) & (cak in Za) & (cdk in Za)
    Use_def(Red) ==> Stat6: Red([n,m]) = [n MINUS (n * m),m MINUS (n * m)]
    EQUAL ==> Red([(cak TIMES n) PLUS (cdk TIMES m),(cak TIMES m) PLUS (n TIMES cdk)]) /=
				Red([(cak TIMES car(Red([n,m]))) PLUS (cdk TIMES cdr(Red([n,m]))),
					(cak TIMES cdr(Red([n,m]))) PLUS (car(Red([n,m])) TIMES cdk)])
    (Stat6)ELEM ==> (n incs (n * m)) & (m incs (n * m)) &
    		(car(Red([n,m])) = n MINUS (n * m)) & (cdr(Red([n,m])) = m MINUS (n * m))
    EQUAL ==> Red([(cak TIMES n) PLUS (cdk TIMES m),(cak TIMES m) PLUS (n TIMES cdk)]) /=
				Red([(cak TIMES (n MINUS (n * m))) PLUS (cdk TIMES (m MINUS (n * m))),
    				(cak TIMES (m MINUS (n * m))) PLUS ((n MINUS (n * m)) TIMES cdk)])
	ALGEBRA ==> (cak TIMES (n MINUS (n * m))) PLUS (cdk TIMES (m MINUS (n * m))) in Za
	ALGEBRA ==> (cak TIMES (m MINUS (n * m))) PLUS ((n MINUS (n * m)) TIMES cdk) in Za
	ALGEBRA ==> (cak TIMES (n * m)) PLUS (cdk TIMES (n * m)) in Za
--
-- But now adding the quantity $((cak TIMES (n * m)) PLUS (cdk TIMES (n * m)))$ to both components
-- of the right hand side of this last inequality allows us to reduce it, via a series of elementary algebraic
-- transformations, to $Red([(cak TIMES n) PLUS (cdk TIMES m),(cak TIMES m) PLUS (cdk TIMES n)])$,
--
   ((cak TIMES (n MINUS (n * m))) PLUS (cdk TIMES (m MINUS (n * m))),(cak TIMES (m MINUS (n * m))) PLUS ((n MINUS (n * m)) TIMES cdk),(cak TIMES (n * m)) PLUS (cdk TIMES (n * m)))-->T374 ==>
		Red([(cak TIMES (n MINUS (n * m))) PLUS (cdk TIMES (m MINUS (n * m))),
			(cak TIMES (m MINUS (n * m))) PLUS ((n MINUS (n * m)) TIMES cdk)]) =
				Red([((cak TIMES (n MINUS (n * m))) PLUS (cdk TIMES (m MINUS (n * m))))
					PLUS ((cak TIMES (n * m)) PLUS (cdk TIMES (n * m))),
					(cak TIMES (m MINUS (n * m))) PLUS ((n MINUS (n * m)) TIMES cdk)
						PLUS ((cak TIMES (n * m)) PLUS (cdk TIMES (n * m)))])
    ALGEBRA ==> ((cak TIMES (n MINUS (n * m))) PLUS (cdk TIMES (m MINUS (n * m))))
					PLUS ((cak TIMES (n * m)) PLUS (cdk TIMES (n * m))) =
						((cak TIMES (n MINUS (n * m))) PLUS (cdk TIMES (m MINUS (n * m))))
							PLUS (cak TIMES (n * m)) PLUS (cdk TIMES (n * m))
    ALGEBRA ==> (cak TIMES (m MINUS (n * m))) PLUS ((n MINUS (n * m)) TIMES cdk)
					PLUS ((cak TIMES (n * m)) PLUS (cdk TIMES (n * m))) =
						(cak TIMES (m MINUS (n * m))) PLUS ((n MINUS (n * m)) TIMES cdk)
							PLUS (cak TIMES (n * m)) PLUS (cdk TIMES (n * m))
    EQUAL ==> Red([(cak TIMES (n MINUS (n * m))) PLUS (cdk TIMES (m MINUS (n * m))),
				(cak TIMES (m MINUS (n * m))) PLUS ((n MINUS (n * m)) TIMES cdk)]) =
					Red([((cak TIMES (n MINUS (n * m))) PLUS (cdk TIMES (m MINUS (n * m))))
						PLUS (cak TIMES (n * m)) PLUS (cdk TIMES (n * m)),
							(cak TIMES (m MINUS (n * m))) PLUS ((n MINUS (n * m)) TIMES cdk)
								PLUS (cak TIMES (n * m)) PLUS (cdk TIMES (n * m))])
    ALGEBRA ==> Stat7: Red([(cak TIMES (n MINUS (n * m))) PLUS (cdk TIMES (m MINUS (n * m))),
		(cak TIMES (m MINUS (n * m))) PLUS ((n MINUS (n * m)) TIMES cdk)]) =
			Red([(cak TIMES ((n MINUS (n * m)) PLUS (n * m))) PLUS (cdk TIMES ((m MINUS (n * m)) PLUS (n * m))),
				(cak TIMES ((m MINUS (n * m)) PLUS (n * m))) PLUS (cdk TIMES ((n MINUS (n * m)) PLUS (n * m)))])
    EQUAL(Stat2,Stat3,Stat7) ==> Red([(cak TIMES (n MINUS (n * m))) PLUS (cdk TIMES (m MINUS (n * m))),
		(cak TIMES (m MINUS (n * m))) PLUS ((n MINUS (n * m)) TIMES cdk)]) =
				Red([(cak TIMES n) PLUS (cdk TIMES m),(cak TIMES m) PLUS (cdk TIMES n)])
--
-- and now a contraction results immediately by one final algebraic step, completing the proof of the present theorem.
--
   ALGEBRA ==> Red([(cak TIMES n) PLUS (cdk TIMES m),(cak TIMES m) PLUS (cdk TIMES n)]) =
   				Red([(cak TIMES n) PLUS (cdk TIMES m),(cak TIMES m) PLUS (n TIMES cdk)])
   Discharge ==> QED
--
-- The two following elementary lemmas prepare for proof of the commutativity
-- of signed integer addition. We first prove commutativity for
-- the sum of a signed integer with an arbitrary pair of unsigned
-- integers.
--
Theorem 379: [Commutativity lemma for signed integers] ((K in Si) & (N in Za) & (M in Za)) imp (K S_PLUS [N,M] = [N,M] S_PLUS K). Proof:
  	Suppose_not(k,n,m) ==> AUTO
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) = 0 or cdr(k) = 0) & (car(k) in Za) & (cdr(k) in Za)
    Use_def(S_PLUS) ==> Red([car(k) PLUS car([n,m]),cdr(k) PLUS cdr([n,m])]) /=
    						Red([car([n,m]) PLUS car(k),cdr([n,m]) PLUS cdr(k)])
    ELEM ==> Red([car(k) PLUS n,cdr(k) PLUS m]) /= Red([n PLUS car(k),m PLUS cdr(k)])
    ALGEBRA ==> false; Discharge ==> QED
--
-- Next we prove commutativity for the sum of two pairs of unsigned integers.
--
Theorem 380: [Commutativity lemma for signed integers, 2] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) imp ([J,K] S_PLUS [N,M] = [N,M] S_PLUS [J,K]). Proof:
 	Suppose_not(j,k,n,m) ==> AUTO
    Use_def(S_PLUS) ==> Red([car([j,k]) PLUS car([n,m]),cdr([j,k]) PLUS cdr([n,m])]) /=
    						Red([car([n,m]) PLUS car([j,k]),cdr([n,m]) PLUS cdr([j,k])])
    ELEM ==> Red([j PLUS n,k PLUS m]) /= Red([n PLUS j,m PLUS k])
    ALGEBRA ==> false; Discharge ==> QED
--
-- Using the lemmas just proved, we can show immediately that signed integer addition is
-- commutative.
--
Theorem 381: [Commutative law for signed integer addition] ((N in Si) & (M in Si)) imp (N S_PLUS M = M S_PLUS N). Proof:
  	Suppose_not(n,m) ==> AUTO
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
    (n,car(m),cdr(m))-->T379 ==> n S_PLUS [car(m),cdr(m)] = [car(m),cdr(m)] S_PLUS n
    EQUAL ==> false; Discharge ==> QED
--
-- Using commutativity we can prove the following occasionally useful variants of Theorem 376,
-- the first stating that the sum of two pairs of unsigned integers is the sum of the reduction of the first pair
-- with the second pair, while the next states that the same sum is is the sum of the first pair
-- with the reduction of the second pair. Both proofs are elementary applicaions of fromulae already established.
--
Theorem 382: [The sum of two integer pairs remains the same if the first is reduced] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) imp ([J,K] S_PLUS [N,M] = Red([J,K]) S_PLUS [N,M]). Proof:
 	Suppose_not(j,k,n,m) ==> AUTO
    (j,k,n,m)-->T380 ==> [j,k] S_PLUS [n,m] = [n,m] S_PLUS [j,k]
    (j,k)-->T366 ==> Red([j,k]) in Si
    (Red([j,k]),n,m)-->T379 ==> (Red([j,k]) S_PLUS [n,m]) = ([n,m] S_PLUS Red([j,k]))
    (n,m,j,k)-->T376 ==> false; Discharge ==> QED
--
-- It is equally easy to show that the sum of two pairs of unsigned integers is the sum of their reductions.
--
Theorem 383: [The sum of two integer pairs remains the same if both are reduced] ((J in Za) & (K in Za) & (N in Za) & (M in Za)) imp ([J,K] S_PLUS [N,M] = Red([J,K]) S_PLUS Red([N,M])). Proof:
	Suppose_not(j,k,n,m) ==> AUTO
    (j,k)-->T366 ==> Red([j,k]) in Si
    (j,k,n,m)-->T382 ==> [j,k] S_PLUS [n,m] = Red([j,k]) S_PLUS [n,m]
    (Red([j,k]),n,m)-->T377 ==> false; Discharge ==> QED
--
-- Our next result gives the commutative law for signed integer multiplication.
--
Theorem 384: [Commutative law for signed integer multiplication] ((N in Si) & (M in Si)) imp (N S_TIMES M = M S_TIMES N). Proof:
  	Suppose_not(n,m) ==> AUTO
--
-- The proof results immediately by definition of the operators involved and by use of the elementary
-- algebraic properties of unsigned integers.
--
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
    ALGEBRA ==> (car(m) TIMES car(n)) PLUS (cdr(m) TIMES cdr(n)) = (car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m)) &
			(car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n)) = (car(m) TIMES cdr(n)) PLUS (car(n) TIMES cdr(m))
    Use_def(S_TIMES) ==> Red([(car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m)),
    	(car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n))]) /=
    			Red([(car(m) TIMES car(n)) PLUS (cdr(m) TIMES cdr(n)),
    			(car(m) TIMES cdr(n)) PLUS (car(n) TIMES cdr(m))])
    EQUAL ==> false; Discharge ==> QED
--
-- Our next goal is to prove the associative laws of signed integers. We begin by proving the associative law for signed integer addition.
--
Theorem 385: [Associative law for signed integer addition] ((K in Si) & (N in Si) & (M in Si)) imp (N S_PLUS (M S_PLUS K) = (N S_PLUS M) S_PLUS K). Proof:
--
-- Supposing that $k$, $n$, $m$ form a counterexample to our assertion, we begin by expanding
-- the inner '$S_PLUS$' operators using their definition, and then using Theorem 359 to
-- eliminate the unnecessary reduction operators '$Red$' that appear.
--
	Suppose_not(k,n,m) ==> AUTO
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) = 0 or cdr(k) = 0) & (car(k) in Za) & (cdr(k) in Za)
    (n,m)-->T371 ==> n S_PLUS m in Si
    (k,n S_PLUS m)-->T381 ==> (n S_PLUS m) S_PLUS k = k S_PLUS (n S_PLUS m)
    Use_def(S_PLUS) ==> n S_PLUS (m S_PLUS k) = n S_PLUS Red([car(m) PLUS car(k),cdr(m) PLUS cdr(k)])
    Use_def(S_PLUS) ==> k S_PLUS (n S_PLUS m) = k S_PLUS Red([car(n) PLUS car(m),cdr(n) PLUS cdr(m)])
    ALGEBRA ==> (car(m) PLUS car(k) in Za) & (cdr(m) PLUS cdr(k) in Za)
    (n,car(m) PLUS car(k),cdr(m) PLUS cdr(k))-->T377 ==>
	(n S_PLUS Red([car(m) PLUS car(k),cdr(m) PLUS cdr(k)])) = n S_PLUS [car(m) PLUS car(k),cdr(m) PLUS cdr(k)]
	ALGEBRA ==> (car(n) PLUS car(m) in Za) & (cdr(n) PLUS cdr(m) in Za)
    (k,car(n) PLUS car(m),cdr(n) PLUS cdr(m))-->T377 ==>
	(k S_PLUS Red([car(n) PLUS car(m),cdr(n) PLUS cdr(m)])) = k S_PLUS [car(n) PLUS car(m),cdr(n) PLUS cdr(m)]
--
-- Next we expand the outer '$S_PLUS$' operators using their definition, and note that
-- by the known algebraic properties of positive integer addition it follows that the
-- two resulting expressions are equal, a contradiction which proves our theorem.
--
    Use_def(S_PLUS) ==>
	n S_PLUS [car(m) PLUS car(k),cdr(m) PLUS cdr(k)] =
				Red([car(n) PLUS (car(m) PLUS car(k)),cdr(n) PLUS (cdr(m) PLUS cdr(k))])
    Use_def(S_PLUS) ==>
				k S_PLUS [car(n) PLUS car(m),cdr(n) PLUS cdr(m)] =
	Red([car(k) PLUS (car(n) PLUS car(m)),cdr(k) PLUS (cdr(n) PLUS cdr(m))])
    ALGEBRA ==> Red([car(n) PLUS (car(m) PLUS car(k)),cdr(n) PLUS (cdr(m) PLUS cdr(k))]) =
	Red([car(k) PLUS (car(n) PLUS car(m)),cdr(k) PLUS (cdr(n) PLUS cdr(m))])
    Discharge ==> QED
--
-- Our next theorem gives the distributive law for (signed) integer multiplication over addition.
--
Theorem 386: [Distributive law for signed integers]
    ((K in Si) & (N in Si) & (M in Si)) imp (N S_TIMES (M S_PLUS K) = (N S_TIMES M) S_PLUS (N S_TIMES K)). Proof:
--
-- As in all the proofs of the present group, we begin by expanding the operators involved
-- into their definitions, and removing all the redundant reduction operators '$Red$' that appear.
-- This is first done for the left-hand side of our assertion.
--
	Suppose_not(k,n,m) ==> AUTO
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) = 0 or cdr(k) = 0) & (car(k) in Za) & (cdr(k) in Za)
    (m,k)-->T371 ==> m S_PLUS k in Si
    (n,m)-->T371 ==> n S_TIMES m in Si
    (n,k)-->T371 ==> n S_TIMES k in Si
    ALGEBRA ==> (car(m) PLUS car(k) in Za) & (cdr(m) PLUS cdr(k) in Za)
    Use_def(S_PLUS) ==> n S_TIMES (m S_PLUS k) = n S_TIMES Red([car(m) PLUS car(k),cdr(m) PLUS cdr(k)])
    (n,car(m) PLUS car(k),cdr(m) PLUS cdr(k))-->T378 ==>
	n S_TIMES (m S_PLUS k) = n S_TIMES [car(m) PLUS car(k),cdr(m) PLUS cdr(k)]
    Use_def(S_TIMES) ==> n S_TIMES (m S_PLUS k) =
	Red([(car(n) TIMES (car(m) PLUS car(k))) PLUS (cdr(n) TIMES (cdr(m) PLUS cdr(k))),
				(car(n) TIMES (cdr(m) PLUS cdr(k))) PLUS ((car(m) PLUS car(k)) TIMES cdr(n))])
--
-- Next we expand and simplify the right-hand side of our assertion in the same way.
--
    Use_def(S_TIMES) ==> (n S_TIMES m) S_PLUS (n S_TIMES k) =
    Red([(car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m)),(car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n))]) S_PLUS
	Red([(car(n) TIMES car(k)) PLUS (cdr(n) TIMES cdr(k)),(car(n) TIMES cdr(k)) PLUS (car(k) TIMES cdr(n))])
    ALGEBRA ==> ((car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m)) in Za) & ((car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n)) in Za) &
		((car(n) TIMES car(k)) PLUS (cdr(n) TIMES cdr(k)) in Za) & ((car(n) TIMES cdr(k)) PLUS (car(k) TIMES cdr(n)) in Za)
			((car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m)),(car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n)), (car(n) TIMES car(k)) PLUS (cdr(n) TIMES cdr(k)),(car(n) TIMES cdr(k)) PLUS (car(k) TIMES cdr(n)))-->T383 ==>
    Stat1: (n S_TIMES m) S_PLUS (n S_TIMES k) =
		([(car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m)),(car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n))]) S_PLUS
			([(car(n) TIMES car(k)) PLUS (cdr(n) TIMES cdr(k)),(car(n) TIMES cdr(k)) PLUS (car(k) TIMES cdr(n))])
--
-- We complete our expansion of the left side of our assertion by expanding the central
-- signed addition operator which appears in it.
--
    Use_def(S_PLUS) ==> Stat2: ([(car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m)),(car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n))]) S_PLUS
		([(car(n) TIMES car(k)) PLUS (cdr(n) TIMES cdr(k)),(car(n) TIMES cdr(k)) PLUS (car(k) TIMES cdr(n))]) =
			Red([((car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m))) PLUS ((car(n) TIMES car(k)) PLUS (cdr(n) TIMES cdr(k))),
    			((car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n))) PLUS ((car(n) TIMES cdr(k)) PLUS (car(k) TIMES cdr(n)))])
    (Stat1,Stat2*)ELEM ==> (n S_TIMES m) S_PLUS (n S_TIMES k) =
		Red([((car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m))) PLUS ((car(n) TIMES car(k)) PLUS (cdr(n) TIMES cdr(k))),
    		((car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n))) PLUS ((car(n) TIMES cdr(k)) PLUS (car(k) TIMES cdr(n)))])
--
-- Now rearraangement of thems using the algebraic properties of signed integers brings us to the desired result.
--
    ALGEBRA ==> (n S_TIMES m) S_PLUS (n S_TIMES k) =
		Red([(car(n) TIMES (car(m) PLUS car(k))) PLUS (cdr(n) TIMES (cdr(m) PLUS cdr(k))),
			(car(n) TIMES (cdr(m) PLUS cdr(k))) PLUS ((car(m) PLUS car(k)) TIMES cdr(n))])
    Discharge ==> QED
--
-- The following easy lemma shows that pairs of the form $[n,0]$ are invariant under the reduction operator 'Red'.
--
Theorem 387: [Reduction of a pair $(N,0)$ gives $(N,0)$] (N in Za) imp (Red([N,0]) = [N,0]). Proof:
--
-- The result follows trivially from the definition of reduction, since for all such pairs
-- the minimum of the two components is clearly 0.
--
Suppose_not(n) ==> AUTO
    Use_def(Red) ==> Red([n,0]) = [n MINUS (n * 0),0 MINUS (n * 0)]
    TELEM ==> n * 0 = 0
    EQUAL ==> Stat1: Red([n,0]) = [n MINUS 0,0 MINUS 0]
    n-->T268(Stat1) ==> Red([n,0]) = [#n,0 MINUS 0]
    n-->T207 ==> n = #n
    EQUAL ==> Red([n,0]) = [n,0 MINUS 0]
    0-->T268() ==> (0 MINUS 0) = #0
    T188 ==> Card(0)
    0-->T164() ==> 0 = #0
    EQUAL ==> false; Discharge ==> QED
--
-- Our next result tells us that the embedding $n->[n,0]$ of integers into signed integers is an algebraic isomorphism.
--
Theorem 388: [Embedding of Integers in Signed Integers]
     ((N in Za) & (M in Za)) imp (([N PLUS M,0] = [N,0] S_PLUS [M,0] & [N TIMES M,0] = [N,0] S_TIMES [M,0]) &
				((N incs M) imp ([N,0] S_MINUS [M,0] = [N MINUS M,0]))). Proof:
    Suppose_not(n,m) ==>
	(n in Za) & (m in Za) & (([n PLUS m,0] /= [n,0] S_PLUS [m,0]) or ([n TIMES m,0] /= [n,0] S_TIMES [m,0]) or
				((n incs m) & ([n,0] S_MINUS [m,0] /= [n MINUS m,0])))
--
-- For signed addition and multiplication,our assertion follows immediately from their definitions.
--
    Use_def(S_PLUS) ==> [n,0] S_PLUS [m,0] = Red([n PLUS m,0 PLUS 0])
    ALGEBRA ==> ([n,0] S_PLUS [m,0] = Red([n PLUS m,0])) & (n PLUS m in Za)
    (n PLUS m)-->T387 ==> [n,0] S_PLUS [m,0] = [n PLUS m,0]
    Use_def(S_TIMES) ==> [n,0] S_TIMES [m,0] = Red([(n TIMES m) PLUS (0 TIMES 0),(n TIMES 0) PLUS (m TIMES 0)])
    ALGEBRA ==> ((n TIMES m) PLUS (0 TIMES 0) = n TIMES m) & ((n TIMES 0) PLUS (m TIMES 0) = 0) & (n TIMES m in Za)
    EQUAL ==> [n,0] S_TIMES [m,0] = Red([n TIMES m,0])
    (n TIMES m)-->T387 ==> [n TIMES m,0] = [n,0] S_TIMES [m,0]
--
-- Thus only the final clause of our theorem can be false. But in this case
-- our assertion follows immediately from the definition and fact that
-- the unsigned integer difference $m MINUS m$ is zero.
--
    ELEM ==> (n incs m) & ([n,0] S_MINUS [m,0] /= [n MINUS m,0])
    Use_def(S_MINUS) ==> [n,0] S_MINUS [m,0] = Red([0 PLUS n,m PLUS 0])
    ALGEBRA ==> (0 PLUS n = n) & (m PLUS 0 = m)
    EQUAL ==> [n MINUS m,0] /= Red([n,m])
    Use_def(Red) ==> [n MINUS m,0] /= [n MINUS (n * m),m MINUS (n * m)]
    ELEM ==> n * m = m
    EQUAL ==> Stat1: [n MINUS m,0] /= [n MINUS m,m MINUS m]
    (Stat1)ELEM ==> m MINUS m /= 0
    m-->T267 ==> false; Discharge ==> QED
--
-- The trivial lemma which now follows states that sign-reversal for signed integers
-- corresponds to interchange of their unsigned integer components.
--
Theorem 389: [Sign-reversal of signed integers] ((N in Za) & (M in Za)) imp (S_Rev(Red([M,N])) = Red([N,M])). Proof:
    Suppose_not(n,m) ==> (n in Za) & (m in Za) & (S_Rev(Red([m,n])) /= Red([n,m]))
    Use_def(Red) ==> S_Rev([m MINUS m * n,n MINUS m * n]) /= [n MINUS m * n,m MINUS m * n]
    Use_def(S_Rev) ==> false; Discharge ==> QED
--
-- Next we show that the negative of the product of two signed integers
-- is the product of the first by the negative of the second.
--
Theorem 390: [$n*-m=-(n*m)$ for signed integers] ((N in Si) & (M in Si)) imp (N S_TIMES S_Rev(M) = S_Rev(N S_TIMES M)). Proof:
    Suppose_not(n,m) ==>
	(n in Si) & (m in Si) & ((n S_TIMES S_Rev(m)) /= S_Rev(n S_TIMES m))
--
-- For let $n$, $m$ form a counterexample to our assertion, and use the definitions
-- of the operators involved to express $n S_TIMES S_Rev(m)$ as the reduction of a
-- pair formed algebraically from the components of $n$ and $m$.
--
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) in Za) & (cdr(n) in Za)
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) in Za) & (cdr(m) in Za)
    Use_def(S_TIMES) ==> n S_TIMES S_Rev(m) =
    		Red([(car(n) TIMES car(S_Rev(m))) PLUS (cdr(n) TIMES cdr(S_Rev(m))),
				(car(n) TIMES cdr(S_Rev(m))) PLUS (car(S_Rev(m)) TIMES cdr(n))])
    Use_def(S_Rev) ==> Stat1: S_Rev(m) = [cdr(m),car(m)]
    (Stat1)ELEM ==> car(S_Rev(m)) = cdr(m)
    (Stat1,Stat1)ELEM ==> cdr(S_Rev(m)) = car(m)
    EQUAL ==> n S_TIMES S_Rev(m) = Red([(car(n) TIMES cdr(m)) PLUS (cdr(n) TIMES car(m)),
											(car(n) TIMES car(m)) PLUS (cdr(m) TIMES cdr(n))])
--
-- Now use these definitions once more to express $S_Rev(n S_TIMES m)$ in the same way.
-- Then a final bit of algebra on the positive-integer components of the two resulting pairs
-- shows that they are equal, ad so proves our theorem.
--
    Use_def(S_TIMES) ==> S_Rev(n S_TIMES m) = S_Rev(Red([(car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m)),
								(car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n))]))
    ALGEBRA ==> ((car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m)) in Za) &
								((car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n)) in Za)
    ((car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n)),(car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m)))-->T389 ==>
	S_Rev(n S_TIMES m) = Red([(car(n) TIMES cdr(m)) PLUS (car(m) TIMES cdr(n)),
										(car(n) TIMES car(m)) PLUS (cdr(n) TIMES cdr(m))])
    ALGEBRA ==> false; Discharge ==> QED
--
-- Our next theorem asserts that the reverse of any signed integer $n$ is also a signed integer,
-- and that the sum of n and its reverse is zero.
--
Theorem 391: [Basic properties of the signed negative] (N in Si) imp ((S_Rev(N) in Si) & (S_Rev(N) S_PLUS N = [0,0]) & (S_Rev(S_Rev(N)) = N)). Proof:
    Suppose_not(n) ==> Stat1: (n in Si) & ((S_Rev(n) notin Si) or (S_Rev(n) S_PLUS n /= [0,0]) or (S_Rev(S_Rev(n)) /= n))
--
-- That $S_Rev(n)$ is a signed integer follows trivially fro its definition.
--
    n-->T369 ==> Stat2: (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    ALGEBRA ==> (car(n) PLUS cdr(n)) in Za
    Use_def(S_Rev) ==> Stat3: S_Rev(n) = [cdr(n),car(n)]
    (Stat3)ELEM ==> (car(S_Rev(n)) = cdr(n)) & (cdr(S_Rev(n)) = car(n))
    Suppose ==> S_Rev(n) notin Si
    Use_def(Si) ==> Stat4: [cdr(n),car(n)] notin {[x,y]: x in Za, y in Za | ((x = 0) or (y = 0))}
    (cdr(n),car(n))-->Stat4 ==> false; Discharge ==> Stat5: S_Rev(n) in Si
--
-- Moreover, $S_Rev(n) S_PLUS n$ is $Red([car(n) PLUS cdr(n),car(n) PLUS cdr(n)])$, and so
-- reduces to $[0,0]$, completing our proof
--
    EQUAL ==> Stat6: S_Rev(S_Rev(n)) = S_Rev([cdr(n),car(n)])
    Use_def(S_Rev) ==> Stat7: S_Rev([cdr(n),car(n)]) = [cdr([cdr(n),car(n)]),car([cdr(n),car(n)])]
    (Stat7)ELEM ==> Stat8: S_Rev([cdr(n),car(n)]) = [car(n),cdr(n)]
    (Stat5,Stat6,Stat8,Stat2*)ELEM ==> Stat9: (S_Rev(n) in Si) & (S_Rev(S_Rev(n)) = n)
    (Stat1,Stat5,Stat9*)ELEM ==> Stat10: S_Rev(n) S_PLUS n /= [0,0]
    Use_def(S_PLUS) ==> S_Rev(n) S_PLUS n = Red([car(S_Rev(n)) PLUS car(n),cdr(S_Rev(n)) PLUS cdr(n)])
    EQUAL ==> S_Rev(n) S_PLUS n = Red([cdr(n) PLUS car(n),car(n) PLUS cdr(n)])
    ALGEBRA ==> Stat11: S_Rev(n) S_PLUS n = Red([car(n) PLUS cdr(n),car(n) PLUS cdr(n)])
    (car(n) PLUS cdr(n))-->T373(*) ==> Stat12: Red([car(n) PLUS cdr(n),car(n) PLUS cdr(n)]) = [0,0]
    (Stat10,Stat11,Stat12*)Discharge ==> QED
--
-- Using commutativity, it is trivial to generalize Theorem 390 by showing that
-- the negative of the product of two signed integers
-- is the product of either by the negative of the other.
--
Theorem 392: [Inversion lemma] ((N in Si) & (M in Si)) imp
		((S_Rev(N S_TIMES M) = S_Rev(N) S_TIMES M) & (S_Rev(N S_TIMES M) = N S_TIMES S_Rev(M))). Proof:
    Suppose_not(n,m) ==> (n in Si) & (m in Si) &
		((S_Rev(n S_TIMES m) /= S_Rev(n) S_TIMES m) or (S_Rev(n S_TIMES m) /= n S_TIMES S_Rev(m)))
    (n,m)-->T390 ==> S_Rev(n S_TIMES m) /= S_Rev(n) S_TIMES m
    (m,n)-->T390 ==> S_Rev(m S_TIMES n) = m S_TIMES S_Rev(n)
    (m,n)-->T384 ==> n S_TIMES m = m S_TIMES n
    EQUAL ==> S_Rev(n S_TIMES m) = m S_TIMES S_Rev(n)
    n-->T391 ==> S_Rev(n) in Si
    (m,S_Rev(n))-->T384 ==> false; Discharge ==> QED
--
-- Next we not that for any signed integer $n$ the 'double negative'
-- $S_Rev(S_Rev(n))$ is $n$. The proof follows from the fact that
-- a double reversal of any pair yields the original pair.
--
Theorem 393: [Inversion lemma II] (N in Si) imp (S_Rev(S_Rev(N)) = N). Proof:
	Suppose_not(n) ==> (n in Si) & (S_Rev(S_Rev(n)) /= n)
	n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
	Use_def(S_Rev) ==> Stat1: S_Rev(n) = [cdr(n),car(n)]
	EQUAL ==> S_Rev([cdr(n),car(n)]) /= n
	Use_def(S_Rev) ==> [cdr([cdr(n),car(n)]),car([cdr(n),car(n)])] /= n
	Discharge ==> QED
--
-- Our next aim is to prove the associative law for signed integer multiplication.
-- We approach this via a sequence of steps: first the case of three non-negative signed integers is considered;
-- next the case of one general signed integer and two non-negative signed integers; next the case
-- one two signed integers and one non-negative signed integer; and then finally the general case.
--
-- Our first lemma states the associativity rule for multiplication of three non-negative signed integers.
--
Theorem 394: [Associativity lemma]
 	((N in Za) & (M in Za) & (K in Za)) imp ([N,0] S_TIMES ([M,0] S_TIMES [K,0]) = ([N,0] S_TIMES [M,0]) S_TIMES [K,0]). Proof:
    Suppose_not(n,m,k) ==> (n in Za) & (m in Za) & (k in Za) & ([n,0] S_TIMES ([m,0] S_TIMES [k,0]) /= ([n,0] S_TIMES [m,0]) S_TIMES [k,0])
--
-- In this case the proof follows directly from the definition of signed integer multiplication and the
-- associative law of unsigned integer multiplication.
--
    (m,k)-->T388 ==> [m,0] S_TIMES [k,0] = [m TIMES k,0]
    (n,m)-->T388 ==> [n,0] S_TIMES [m,0] = [n TIMES m,0]
    ALGEBRA ==> (m TIMES k in Za) & (n TIMES m in Za)
    EQUAL ==> (([n,0] S_TIMES ([m,0] S_TIMES [k,0])) = ([n,0] S_TIMES [m TIMES k,0])) &
	((([n,0] S_TIMES [m,0]) S_TIMES [k,0]) = ([n TIMES m,0] S_TIMES [k,0]))
    (n TIMES m,k)-->T388 ==> (([n,0] S_TIMES [m,0]) S_TIMES [k,0]) = [(n TIMES m) TIMES k,0]
    (n,m TIMES k)-->T388 ==> ([n,0] S_TIMES ([m,0] S_TIMES [k,0])) = [n TIMES (m TIMES k),0]
    ALGEBRA ==> n TIMES (m TIMES k) = (n TIMES m) TIMES k
    Discharge ==> QED
--
-- Next we prove the associativity rule for multiplication of two non-negative signed integers and one general
-- signed integer.
--
Theorem 395: [Associativity lemma]
    ((K in Si) & (N in Za) & (M in Za)) imp ([N,0] S_TIMES ([M,0] S_TIMES K) = ([N,0] S_TIMES [M,0]) S_TIMES K). Proof:
    Suppose_not(k,n,m) ==>
	(k in Si) & (n in Za) & (m in Za) & ([n,0] S_TIMES ([m,0] S_TIMES k) /= ([n,0] S_TIMES [m,0]) S_TIMES k)
--
-- Consider a counterexample $k,n,m$. The case in which $k = [car(k),0]$ is nonnegative is covered by
-- Theorem 394, so we have only to consider the case in which $k = [0,cdr(k)]$ is negative, and thus
-- $S_Rev(k) = [cdr(k),0]$ is non-negative.
--
    k-->T369 ==> (k = [car(k),0] or k = [0,cdr(k)]) & (car(k) in Za) & (cdr(k) in Za)
    Suppose ==> k = [car(k),0]
    EQUAL ==> [n,0] S_TIMES ([m,0] S_TIMES [car(k),0]) /= ([n,0] S_TIMES [m,0]) S_TIMES [car(k),0]
    (n,m,car(k))-->T394 ==> false; Discharge ==> k = [0,cdr(k)]
    Use_def(S_Rev) ==> S_Rev(k) = [cdr(k),0]
    T211 ==> 0 in Za
    Suppose ==> [n,0] notin Si
    Use_def(Si) ==> Stat1: [n,0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(n,0)-->Stat1 ==> false; Discharge ==> [n,0] in Si
    Suppose ==> [m,0] notin Si
    Use_def(Si) ==> Stat2: [m,0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(m,0)-->Stat2 ==> false; Discharge ==> [m,0] in Si
    Suppose ==> S_Rev(k) notin Si
    Use_def(Si) ==> Stat3: [cdr(k),0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(cdr(k),0)-->Stat3 ==> false; Discharge ==> S_Rev(k) in Si
    ([n,0],[m,0])-->T371 ==> ([n,0] S_TIMES [m,0]) in Si
    ([m,0],k)-->T371 ==> ([m,0] S_TIMES k) in Si
--
-- In this case associativity applies to the product $[n,0] S_TIMES ([m,0] S_TIMES S_Rev(k))$,
-- and so several uses of Theorem 392 and of the associative law for unsigned integers
-- brings us to the desired result.
--
    (n,m,cdr(k))-->T394 ==> ([n,0] S_TIMES ([m,0] S_TIMES [cdr(k),0])) = (([n,0] S_TIMES [m,0]) S_TIMES [cdr(k),0])
    EQUAL ==> ([n,0] S_TIMES ([m,0] S_TIMES S_Rev(k))) = (([n,0] S_TIMES [m,0]) S_TIMES S_Rev(k))
    ([n,0] S_TIMES [m,0],k)-->T392 ==>
	([n,0] S_TIMES [m,0]) S_TIMES S_Rev(k) = S_Rev(([n,0] S_TIMES [m,0]) S_TIMES k)
    ([m,0],k)-->T392 ==> ([m,0] S_TIMES S_Rev(k)) = S_Rev([m,0] S_TIMES k)
    ([n,0],[m,0] S_TIMES k)-->T392 ==> [n,0] S_TIMES S_Rev([m,0] S_TIMES k) = S_Rev([n,0] S_TIMES ([m,0] S_TIMES k))
    EQUAL ==> S_Rev(S_Rev([n,0] S_TIMES ([m,0] S_TIMES k))) = S_Rev(S_Rev(([n,0] S_TIMES [m,0]) S_TIMES k))
    ([n,0],[m,0] S_TIMES k)-->T371 ==> [n,0] S_TIMES ([m,0] S_TIMES k) in Si
    ([n,0] S_TIMES [m,0],k)-->T371 ==> ([n,0] S_TIMES [m,0]) S_TIMES k in Si
    ([n,0] S_TIMES ([m,0] S_TIMES k))-->T391 ==>
	S_Rev(S_Rev([n,0] S_TIMES ([m,0] S_TIMES k))) = [n,0] S_TIMES ([m,0] S_TIMES k)
    (([n,0] S_TIMES [m,0]) S_TIMES k)-->T391 ==> false; Discharge ==> QED
--
-- Next we prove the associativity rule for multiplication of a non-negative signed integer and two general
-- signed integers.
--
Theorem 396: [Associativity lemma II]
    ((K in Si) & (N in Za) & (M in Si)) imp ([N,0] S_TIMES (M S_TIMES K) = ([N,0] S_TIMES M) S_TIMES K). Proof:
    Suppose_not(k,n,m) ==>
	(k in Si) & (n in Za) & (m in Si) & (([n,0] S_TIMES (m S_TIMES k) /= ([n,0] S_TIMES m) S_TIMES k))
--
-- Consider a counterexample k,n,m. The case in which $m = [car(m),0]$ is nonnegative is covered by
-- Theorem 394, so we have only to consider the case in which $m = [0,cdr(m)]$ is negative, and thus
-- $S_Rev(m) = [cdr(m),0]$ is non-negative.
--
    T211 ==> 0 in Za
    m-->T369 ==> (m = [car(m),0] or m = [0,cdr(m)]) & (car(m) in Za) & (cdr(m) in Za)
    Suppose ==> m = [car(m),0]
    EQUAL ==> [n,0] S_TIMES ([car(m),0] S_TIMES k) /= ([n,0] S_TIMES [car(m),0]) S_TIMES k
    (k,n,car(m))-->T395 ==> false; Discharge ==> m = [0,cdr(m)]
    Use_def(S_Rev) ==> S_Rev(m) = [cdr(m),0]
    Suppose ==> [n,0] notin Si
    Use_def(Si) ==> Stat1: [n,0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(n,0)-->Stat1 ==> false; Discharge ==> [n,0] in Si
    Suppose ==> S_Rev(m) notin Si
    Use_def(Si) ==> Stat2: [cdr(m),0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(cdr(m),0)-->Stat2 ==> false; Discharge ==> S_Rev(m) in Si
    ([n,0],m)-->T371 ==> [n,0] S_TIMES m in Si
    (m,k)-->T371 ==> m S_TIMES k in Si
--
-- In this case associativity applies to the product $[N,0] S_TIMES ([cdr(m),0] S_TIMES k)$,
-- leading directly via  manipulation of the reversal operator $S_Rev$ to the formula we need.
--
    (k,n,cdr(m))-->T395 ==> ([n,0] S_TIMES ([cdr(m),0] S_TIMES k)) = (([n,0] S_TIMES [cdr(m),0]) S_TIMES k)
    EQUAL ==> ([n,0] S_TIMES (S_Rev(m) S_TIMES k)) = (([n,0] S_TIMES S_Rev(m)) S_TIMES k)
    ([n,0],m)-->T392 ==> [n,0] S_TIMES S_Rev(m) = S_Rev([n,0] S_TIMES m)
    (m,k)-->T392 ==> S_Rev(m) S_TIMES k = S_Rev(m S_TIMES k)
    EQUAL ==> S_Rev([n,0] S_TIMES m) S_TIMES k = [n,0] S_TIMES S_Rev(m S_TIMES k)
    ([n,0] S_TIMES m,k)-->T392 ==> S_Rev([n,0] S_TIMES m) S_TIMES k = S_Rev(([n,0] S_TIMES m) S_TIMES k)
    ([n,0],m S_TIMES k)-->T392 ==> [n,0] S_TIMES S_Rev(m S_TIMES k) = S_Rev([n,0] S_TIMES (m S_TIMES k))
    EQUAL ==> S_Rev(S_Rev([n,0] S_TIMES (m S_TIMES k))) = S_Rev(S_Rev(([n,0] S_TIMES m) S_TIMES k))
    ([n,0],m S_TIMES k)-->T371 ==> [n,0] S_TIMES (m S_TIMES k) in Si
    ([n,0] S_TIMES m,k)-->T371 ==> ([n,0] S_TIMES m) S_TIMES k in Si
    ([n,0] S_TIMES (m S_TIMES k))-->T391 ==>
	S_Rev(S_Rev([n,0] S_TIMES (m S_TIMES k))) = [n,0] S_TIMES (m S_TIMES k)
    (([n,0] S_TIMES m) S_TIMES k)-->T391 ==> false; Discharge ==> QED
--
-- Finally we prove the associativity rule for multiplication of signed integers in the general case.
--
Theorem 397: [Associative law] ((K in Si) & (N in Si) & (M in Si)) imp (N S_TIMES (M S_TIMES K) = (N S_TIMES M) S_TIMES K). Proof:
	Suppose_not(k,n,m) ==>
     (k in Si) & (n in Si) & (m in Si) & (n S_TIMES (m S_TIMES k) /= (n S_TIMES m) S_TIMES k)
--
-- Consider a counterexample $k,n,m$. The case in which $n = [car(n),0]$ is nonnegative is covered by
-- Theorem 394, so we have only to consider the case in which $n = [0,cdr(n)]$ is negative, and thus
-- $S_Rev(n) = [cdr(n),0]$ is non-negative.
--
    n-->T369 ==> (n = [car(n),0] or n = [0,cdr(n)]) & (car(n) in Za) & (cdr(n) in Za)
    T211 ==> 0 in Za
    Suppose ==> n = [car(n),0]
    EQUAL ==> [car(n),0] S_TIMES (m S_TIMES k) /= ([car(n),0] S_TIMES m) S_TIMES k
    (k,car(n),m)-->T396 ==> false; Discharge ==> n = [0,cdr(n)]
    Use_def(S_Rev) ==> S_Rev(n) = [cdr(n),0]
    Suppose ==> S_Rev(n) notin Si
    Use_def(Si) ==> Stat1: [cdr(n),0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(cdr(n),0)-->Stat1 ==> false; Discharge ==> S_Rev(n) in Si
--
-- But in this case the preceding theorem tells us that associativity applies to the product
-- $S_Rev(n) S_TIMES (m S_TIMES k)$, and so we can derive the required conclusion
-- by an easy manipulation of the reversal operator $S_Rev$.
--
    (n,m)-->T371 ==> n S_TIMES m in Si
    (m,k)-->T371 ==> m S_TIMES k in Si
    (k,cdr(n),m)-->T396 ==> [cdr(n),0] S_TIMES (m S_TIMES k) = ([cdr(n),0] S_TIMES m) S_TIMES k
    EQUAL ==> S_Rev(n) S_TIMES (m S_TIMES k) = (S_Rev(n) S_TIMES m) S_TIMES k
    (n,m S_TIMES k)-->T392 ==> S_Rev(n) S_TIMES (m S_TIMES k) = S_Rev(n S_TIMES (m S_TIMES k))
    (n,m)-->T392 ==> S_Rev(n) S_TIMES m = S_Rev(n S_TIMES m)
    EQUAL ==> S_Rev(n S_TIMES m) S_TIMES k = S_Rev(n S_TIMES (m S_TIMES k))
    (n S_TIMES m,k)-->T392 ==> S_Rev(n S_TIMES m) S_TIMES k = S_Rev((n S_TIMES m) S_TIMES k)
    (n,m S_TIMES k)-->T392 ==> n S_TIMES S_Rev(m S_TIMES k) = S_Rev(n S_TIMES (m S_TIMES k))
    EQUAL ==> S_Rev(S_Rev(n S_TIMES (m S_TIMES k))) = S_Rev(S_Rev((n S_TIMES m) S_TIMES k))
    (n,m S_TIMES k)-->T371 ==> n S_TIMES (m S_TIMES k) in Si
    (n S_TIMES m,k)-->T371 ==> (n S_TIMES m) S_TIMES k in Si
    (n S_TIMES (m S_TIMES k))-->T391 ==>
	S_Rev(S_Rev(n S_TIMES (m S_TIMES k))) = n S_TIMES (m S_TIMES k)
    ((n S_TIMES m) S_TIMES k)-->T391 ==> false; Discharge ==> QED
--
-- Next we prove that subtraction of one signed integer from another
-- is equivalent to addition of the negative of the first to the second.
--
Theorem 398: [Subtraction is addition of the negative] ((N in Si) & (M in Si)) imp ((N S_MINUS M) = (N S_PLUS S_Rev(M))). Proof:
    Suppose_not(n,m) ==> (n in Si) & (m in Si) & ((n S_MINUS m) /= (n S_PLUS S_Rev(m)))
--
-- The proof results easily by expanding the definitions of the operators involved and a bit of unsigned integer arithmetic.
--
    Use_def(Si) ==> Stat1: m in {[x,y]: x in Za, y in Za | ((x = 0) or (y = 0))}
    (m1,m2)-->Stat1 ==> (m = [m1,m2]) & (m1 in Za) & (m2 in Za)
    ELEM ==> (m = [car(m),cdr(m)]) & (car(m) in Za) & (cdr(m) in Za)
    Use_def(Si) ==> Stat2: n in {[x,y]: x in Za, y in Za | ((x = 0) or (y = 0))}
    (n1,n2)-->Stat2 ==> Stat3: (n = [n1,n2]) & (n1 in Za) & (n2 in Za)
    (Stat3)ELEM ==> (n = [car(n),cdr(n)]) & (car(n) in Za) & (cdr(n) in Za)
    Use_def(S_MINUS) ==> n S_MINUS m = Red([cdr(m) PLUS car(n),car(m) PLUS cdr(n)])
    Use_def(S_Rev) ==> Stat4: S_Rev(m) = [cdr(m),car(m)]
    (Stat4)ELEM ==> (car(S_Rev(m)) = cdr(m)) & (cdr(S_Rev(m)) = car(m))
    Use_def(S_PLUS) ==> n S_PLUS S_Rev(m) = Red([car(n) PLUS car(S_Rev(m)),cdr(n) PLUS cdr(S_Rev(m))])
    EQUAL ==> n S_PLUS S_Rev(m) = Red([car(n) PLUS cdr(m),cdr(n) PLUS car(m)])
    ALGEBRA ==> ((cdr(m) PLUS car(n)) = (car(n) PLUS cdr(m))) & ((car(m) PLUS cdr(n)) = (cdr(n) PLUS car(m)))
    EQUAL ==> false; Discharge ==> QED
--
-- The following theorem tells us that for signed integers subtraction is always the reverse of addition.
-- It is this generalization of the corresponding but more restricted rule for unsigned integers that
-- justifies the introduction of the signed integers.
--
Theorem 399: [Subtraction reverses signed integer addition] ((N in Si) & (M in Si)) imp (N = M S_PLUS (N S_MINUS M)). Proof:
    Suppose_not(n,m) ==> (n in Si) & (m in Si) & (n /= m S_PLUS (n S_MINUS m))
--
-- By expanding the definitions of the operators involved, a bit of unsigned integer arithmetic,
-- and elimination of superfluous reduction operators, we can readily reduce the negative of our assertion
-- to the inequality seen below.
--
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    ELEM ==> car(n) * cdr(n) = 0
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
    Use_def(S_MINUS) ==> n /= m S_PLUS Red([cdr(m) PLUS car(n),car(m) PLUS cdr(n)])
    ALGEBRA ==> (cdr(m) PLUS car(n) in Za) & (car(m) PLUS cdr(n) in Za) & (car(m) PLUS cdr(m) in Za)
    (m,cdr(m) PLUS car(n),car(m) PLUS cdr(n))-->T377 ==>
    	m S_PLUS Red([cdr(m) PLUS car(n),car(m) PLUS cdr(n)]) = m S_PLUS [cdr(m) PLUS car(n),car(m) PLUS cdr(n)]
    Use_def(S_PLUS) ==> m S_PLUS [cdr(m) PLUS car(n),car(m) PLUS cdr(n)] =
     							Red([car(m) PLUS car([cdr(m) PLUS car(n),car(m) PLUS cdr(n)]),
     								cdr(m) PLUS cdr([cdr(m) PLUS car(n),car(m) PLUS cdr(n)])])
    ELEM ==> car([cdr(m) PLUS car(n),car(m) PLUS cdr(n)]) = cdr(m) PLUS car(n)
    ELEM ==> cdr([cdr(m) PLUS car(n),car(m) PLUS cdr(n)]) = car(m) PLUS cdr(n)
    EQUAL ==> m S_PLUS [cdr(m) PLUS car(n),car(m) PLUS cdr(n)] =
     							Red([car(m) PLUS (cdr(m) PLUS car(n)),cdr(m) PLUS (car(m) PLUS cdr(n))])
    ELEM ==> n /= Red([car(m) PLUS (cdr(m) PLUS car(n)),cdr(m) PLUS (car(m) PLUS cdr(n))])
--
-- But since the same quantity $car(m) PLUS cdr(m)$ is added to both components
-- of the pair appearing on the right of this last equality, it reduces readily to the
-- contradictory form $n /= [car(n),cdr(n)]$, thereby proving our assertion.
--
    ALGEBRA ==> n /= Red([car(n) PLUS (car(m) PLUS cdr(m)),cdr(n) PLUS (car(m) PLUS cdr(m))])
    (car(n),cdr(n),car(m) PLUS cdr(m))-->T374 ==> n /= Red([car(n),cdr(n)])
    Use_def(Red) ==> n /= [car(n) MINUS (car(n) * cdr(n)),cdr(n) MINUS (car(n) * cdr(n))]
    EQUAL ==> n /= [car(n) MINUS 0,cdr(n) MINUS 0]
    (car(n))-->T268 ==> car(n) MINUS 0 = #car(n)
    (cdr(n))-->T268 ==> cdr(n) MINUS 0 = #cdr(n)
    (car(n))-->T206 ==> Card(car(n))
    (cdr(n))-->T206 ==> Card(cdr(n))
    (car(n))-->T164 ==> car(n) MINUS 0 = car(n)
    (cdr(n))-->T164 ==> cdr(n) MINUS 0 = cdr(n)
    EQUAL ==> false; Discharge ==> QED
--
-- Next we prove that the negative of $m S_PLUS n$ is the sum of $S_Rev(n)$ and $S_Rev(m)$.
--
Theorem 400: [The negative of a sum is the sum of the negatives] ((N in Si) & (M in Si)) imp (S_Rev(N S_PLUS M) = S_Rev(N) S_PLUS S_Rev(M)). Proof:
    Suppose_not(n,m) ==> (n in Si) & (m in Si) & (S_Rev(n S_PLUS m) /= S_Rev(n) S_PLUS S_Rev(m))
--
--
--
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    Use_def(S_Rev) ==> Stat1: S_Rev(n) = [cdr(n),car(n)]
	(Stat1)ELEM ==> car(S_Rev(n)) = cdr(n)
        (Stat1,Stat1)ELEM ==> cdr(S_Rev(n)) = car(n)
    Use_def(S_Rev) ==> Stat2: S_Rev(m) = [cdr(m),car(m)]
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) = 0 or cdr(m) = 0) & (car(m) in Za) & (cdr(m) in Za)
	(Stat2,Stat2)ELEM ==> car(S_Rev(m)) = cdr(m)
	(Stat2,Stat2)ELEM ==> cdr(S_Rev(m)) = car(m)
--
    Use_def(S_PLUS) ==> n S_PLUS m = Red([car(n) PLUS car(m),cdr(n) PLUS cdr(m)])
	Use_def(S_PLUS) ==> S_Rev(n) S_PLUS S_Rev(m) = Red([car(S_Rev(n)) PLUS car(S_Rev(m)),cdr(S_Rev(n)) PLUS cdr(S_Rev(m))])
	EQUAL ==> S_Rev(n) S_PLUS S_Rev(m) = Red([cdr(n) PLUS cdr(m),car(n) PLUS car(m)])
	EQUAL ==> S_Rev(N S_PLUS M) = S_Rev(Red([car(n) PLUS car(m),cdr(n) PLUS cdr(m)]))
	ALGEBRA ==> (car(n) PLUS car(m) in Za) & (cdr(n) PLUS cdr(m) in Za)
	(cdr(n) PLUS cdr(m),car(n) PLUS car(m))-->T389 ==> false; Discharge ==> QED
--
-- We now go on to establish multiplication rules for the signed integer constants zero and one,
-- proving that zero times anything is zero, while one times any signed integer $n$ is $n$.
-- Moreover the product of the reverse $[0,1]$ of $[1,0]$ by itself is $[1,0]$.
--
Theorem 401: [Basic properties of the signed integers 0 and 1] (([0,1] S_TIMES [0,1]) = [1,0]) & ((X in Si) imp ((([1,0] S_TIMES X) = X) & (([0,0] S_TIMES X) = [0,0]))). Proof:
    Suppose_not(x) ==> (([0,1] S_TIMES [0,1]) /= [1,0]) or ((x in Si) & ((([1,0] S_TIMES x) /= x) or
    						(([0,0] S_TIMES x) /= [0,0])))
--
--
--
    Use_def(S_TIMES) ==> ([0,1] S_TIMES [0,1]) =
    						Red([(car([0,1]) TIMES car([0,1])) PLUS (cdr([0,1]) TIMES cdr([0,1])),
    								(car([0,1]) TIMES cdr([0,1])) PLUS (car([0,1]) TIMES cdr([0,1]))])
    ELEM ==> (car([0,1]) = 0) & (cdr([0,1]) = 1) & (1 * 0 = 0)
    T211 ==> Stat1: (1 in Za) & (0 in Za)
    EQUAL ==> ([0,1] S_TIMES [0,1]) = Red([(0 TIMES 0) PLUS (1 TIMES 1),(0 TIMES 1) PLUS (0 TIMES 1)])
    ALGEBRA ==> (([0,1] S_TIMES [0,1]) = Red([1,0]))
    T211 ==> Card(1)
    T211 ==> Card(0)
    1-->T164 ==> Stat2: 1 = #1
    0-->T164 ==> 0 = #0
    Use_def(Red) ==> ([0,1] S_TIMES [0,1]) = [1 MINUS (1 * 0),0 MINUS (1 * 0)]
    EQUAL ==> Stat3: ([0,1] S_TIMES [0,1]) = [1 MINUS 0,0 MINUS 0]
    1-->T268(Stat3,Stat2) ==> ([0,1] S_TIMES [0,1]) = [1,0 MINUS 0]
    0-->T268 ==> 0 MINUS 0 = #0
    EQUAL ==> Stat4: (x in Si) & ((([1,0] S_TIMES x) /= x) or (([0,0] S_TIMES x) /= [0,0]))
    Use_def(S_TIMES) ==> ([0,0] S_TIMES x) = Red([(car([0,0]) TIMES car(x)) PLUS (cdr([0,0]) TIMES cdr(x)),
    					(car([0,0]) TIMES cdr(x)) PLUS (car(x) TIMES cdr([0,0]))])
    TELEM ==> (car([0,0]) = 0) & (cdr([0,0]) = 0) & (car([1,0]) = 1) & (cdr([1,0]) = 0)
    EQUAL ==> ([0,0] S_TIMES x) =
    	Red([(0 TIMES car(x)) PLUS (0 TIMES cdr(x)),(0 TIMES cdr(x)) PLUS (car(x) TIMES 0)])
    Use_def(Si) ==> Stat5: x in {[u,y]: u in Za, y in Za | u = 0 or y = 0}
    (u,y)-->Stat5 ==> Stat6: (x = [u,y]) & (u in Za) & (y in Za) & (u = 0 or y = 0)
    (Stat6*)ELEM ==> Stat7: x = [u,y]
    (Stat7)ELEM ==> Stat8: (car(x) = u) & (cdr(x) = y) & (x = [car(x),cdr(x)])
    (Stat6,Stat8*)ELEM ==> Stat9: (car(x) in Za) & (cdr(x) in Za) & (car(x) * cdr(x) = 0)
    (car(x))-->T207(Stat9*) ==> car(x) = #car(x)
    (cdr(x))-->T207(Stat9*) ==> cdr(x) = #cdr(x)
    ALGEBRA ==> Stat10: ([0,0] S_TIMES x) = Red([0,0])
 	0-->T373(Stat10,Stat1) ==> Stat11: ([0,0] S_TIMES x) = [0,0]
    Use_def(S_TIMES) ==> ([1,0] S_TIMES x) = Red([(car([1,0]) TIMES car(x)) PLUS (cdr([1,0]) TIMES cdr(x)),
    					(car([1,0]) TIMES cdr(x)) PLUS (car(x) TIMES cdr([1,0]))])
 	EQUAL ==> ([1,0] S_TIMES x) =
    	Red([(1 TIMES car(x)) PLUS (0 TIMES cdr(x)),(1 TIMES cdr(x)) PLUS (car(x) TIMES 0)])
    ALGEBRA ==> ([1,0] S_TIMES x) = Red([car(x),cdr(x)])
 	EQUAL ==> Stat12: ([1,0] S_TIMES x) = Red(x)
 	Use_def(Red) ==> Red(x) = [car(x) MINUS (car(x) * cdr(x)),cdr(x) MINUS (car(x) * cdr(x))]
 	EQUAL ==> Stat13: Red(x) = [car(x) MINUS 0,cdr(x) MINUS 0]
    (car(x))-->T268 ==> car(x) MINUS 0 = #car(x)
    (cdr(x))-->T268 ==> cdr(x) MINUS 0 = #cdr(x)
 	EQUAL ==> Stat14: Red(x) = [car(x),cdr(x)]
 	(Stat12,Stat14,Stat8,Stat9*)ELEM ==> Stat15: ([1,0] S_TIMES x) = x
    (Stat4,Stat15,Stat11*)Discharge ==> QED
--
-- It follows trially from the preceding theorem that the product
-- of any signed integer $n$ by one is $n$.
--
Theorem 402: [1 is the multiplicative unit for signed integers] (K in Si) imp (K S_TIMES [1,0] = K). Proof:
    Suppose_not(k) ==> (k in Si) & (k S_TIMES [1,0] /= k)
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) in Za) & (cdr(k) in Za) & (car(k) = 0 or cdr(k) = 0)
    T211 ==> (1 in Za) & (0 in Za)
    Use_def(S_TIMES) ==> (k S_TIMES [1,0]) = Red([(car(k) TIMES car([1,0])) PLUS (cdr(k) TIMES cdr([1,0])),
			(car(k) TIMES cdr([1,0])) PLUS (car([1,0]) TIMES cdr(k))])
    ELEM ==> (car([1,0]) = 1) & (cdr([1,0]) = 0) & (1 * 0 = 0)
    EQUAL ==> (k S_TIMES [1,0]) = Red([(car(k) TIMES 1) PLUS (cdr(k) TIMES 0),(car(k) TIMES 0) PLUS (1 TIMES cdr(k))])
    ALGEBRA ==> k S_TIMES [1,0] = Red([car(k),cdr(k)])
    Use_def(Red) ==> k S_TIMES [1,0] = [car(k) MINUS (car(k) * cdr(k)),cdr(k) MINUS (car(k) * cdr(k))]
    ELEM ==> car(k) * cdr(k) = 0
    EQUAL ==> k S_TIMES [1,0] = [car(k) MINUS 0,cdr(k) MINUS 0]
    (car(k))-->T268 ==> car(k) MINUS 0 = #car(k)
    (cdr(k))-->T268 ==> cdr(k) MINUS 0 = #cdr(k)
    (car(k))-->T207 ==> car(k) = #car(k)
    (cdr(k))-->T207 ==> cdr(k) = #cdr(k)
    EQUAL ==> false; Discharge ==> QED
--
--
--
Theorem 403: [The negative of a signed integer is its product by -1] ((K in Si) & (M in Si)) imp (K S_MINUS M = K S_PLUS (M S_TIMES [0,1])). Proof:
    Suppose_not(k,m) ==> (k in Si) & (m in Si) & (k S_MINUS m /= k S_PLUS (m S_TIMES [0,1]))
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) in Za) & (cdr(k) in Za) & (car(k) = 0 or cdr(k) = 0) & (Red(k) = k)
    m-->T369 ==> (m = [car(m),cdr(m)]) & (car(m) in Za) & (cdr(m) in Za) & (car(m) = 0 or cdr(m) = 0) & (Red(m) = m)
    Use_def(S_TIMES) ==>
	 m S_TIMES [0,1] = Red([(car(m) TIMES car([0,1])) PLUS (cdr(m) TIMES cdr([0,1])),(car(m) TIMES cdr([0,1])) PLUS (car([0,1]) TIMES cdr(m))])
    ELEM ==> (car([0,1]) = 0) & (cdr([0,1]) = 1)
    EQUAL ==>
	m S_TIMES [0,1] = Red([(car(m) TIMES 0) PLUS (cdr(m) TIMES 1),(car(m) TIMES 1) PLUS (0 TIMES cdr(m))])
    ALGEBRA ==> m S_TIMES [0,1] = Red([cdr(m),car(m)])
    Use_def(S_MINUS) ==> k S_MINUS m = Red([cdr(m) PLUS car(k),car(m) PLUS cdr(k)])
    EQUAL ==> k S_PLUS (m S_TIMES [0,1]) = k S_PLUS Red([cdr(m),car(m)])
    (k,cdr(m),car(m))-->T377 ==> k S_PLUS (m S_TIMES [0,1]) = k S_PLUS [cdr(m),car(m)]
    Use_def(S_PLUS) ==> k S_PLUS (m S_TIMES [0,1]) = Red([car(k) PLUS cdr(m),cdr(k) PLUS car(m)])
    ELEM ==> Red([cdr(m) PLUS car(k),car(m) PLUS cdr(k)]) /= Red([car(k) PLUS cdr(m),cdr(k) PLUS car(m)])
    ALGEBRA ==> false; Discharge ==> QED
--
-- Next we note that for any singed integer $k$, $k S_MINUS k$ is zero.
-- The proof results trivially from the definition of the operators involved.
--
Theorem 404: [A signed integer minus itself gives 0] (K in Si) imp (K S_MINUS K = [0,0]). Proof:
    Suppose_not(k) ==> (k in Si) & (k S_MINUS k /= [0,0])
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) in Za) & (cdr(k) in Za) & (car(k) = 0 or cdr(k) = 0) & (Red(k) = k)
    Use_def(S_MINUS) ==> k S_MINUS k = Red([cdr(k) PLUS car(k),car(k) PLUS cdr(k)])
    ALGEBRA ==> Red([car(k) PLUS cdr(k),car(k) PLUS cdr(k)]) /= [0,0]
    ALGEBRA ==> car(k) PLUS cdr(k) in Za
    (car(k) PLUS cdr(k))-->T373 ==> false; Discharge ==> QED
--
-- It follows equally trivially that the sum of any signed integer $k$ and zero is $k$.
--
Theorem 405: [0 is the right additive identity for signed integers] (K in Si) imp (K S_PLUS [0,0] = K). Proof:
    Suppose_not(k) ==> (k in Si) & (k S_PLUS [0,0] /= k)
    k-->T369 ==> (k = [car(k),cdr(k)]) & (car(k) in Za) & (cdr(k) in Za) & (Red(k) = k)
    Use_def(S_PLUS) ==> k S_PLUS [0,0] = Red([car(k) PLUS 0,cdr(k) PLUS 0])
    ALGEBRA ==> k S_PLUS [0,0] = Red([car(k),cdr(k)])
    EQUAL ==> false; Discharge ==> QED
--
-- And so it follows equally trivially by commutativity that the sum of zero and any signed integer $k$ is $k$.
--
Theorem 406: [0 is the left additive identity for signed integers] (K in Si) imp ([0,0] S_PLUS K = K). Proof:
    Suppose_not(k) ==> (k in Si) & ([0,0] S_PLUS k /= k)
    T368 ==> [0,0] in Si
    ([0,0],k)-->T381 ==> [0,0] S_PLUS k = k S_PLUS [0,0]
    k-->T405 ==> k S_PLUS [0,0] = k
    Discharge ==> QED
--
-- The following easy theorem gives the very important cancellation rule for signed integer multiplication:
-- if the product of two signed integers is zero, one of them must be zero. This fact
-- is central to the discussion of rational numbers which follows subsequently.
--
Theorem 407: [$Si$ is an Integral Domain]
	((N in Si) & (M in Si) & ((M S_TIMES N) = [0,0])) imp ((M = [0,0]) or (N = [0,0])). Proof:
    Suppose_not(n,m) ==> Stat1: (n in Si) & (m in Si) & (m S_TIMES n = [0,0]) & (m /= [0,0]) & (n /= [0,0])
--
--
--
    m-->T369 ==> Stat2: (m = [car(m),cdr(m)]) & ((car(m) = 0) or (cdr(m) = 0)) & (car(m) in Za) & (cdr(m) in Za)
    n-->T369 ==> Stat3: (n = [car(n),cdr(n)]) & ((car(n) = 0) or (cdr(n) = 0)) & (car(n) in Za) & (cdr(n) in Za)
    Use_def(S_TIMES) ==> Stat4: Red([(car(m) TIMES car(n)) PLUS (cdr(m) TIMES cdr(n)),
							(car(m) TIMES cdr(n)) PLUS (car(n) TIMES cdr(m))]) = [0,0]
    Suppose ==> Stat5: (car(n) = 0) & (cdr(n) = 0)
    EQUAL(Stat1,Stat3,Stat5) ==> false; Discharge ==> Stat6: (not(car(n) = 0)) or (not(cdr(n) = 0))
    (Stat6)ELEM ==> (car(n) /= 0) or (cdr(n) /= 0)
    Suppose ==> Stat7: (car(m) = 0) & (cdr(m) = 0)
    EQUAL(Stat1,Stat2,Stat7) ==> false; Discharge ==> Stat8: (not(car(m) = 0)) or (not(cdr(m) = 0))
    (Stat8)ELEM ==> (car(m) /= 0) or (cdr(m) /= 0)
    Suppose ==> Stat9: car(n) /= 0
    (Stat3)ELEM ==> cdr(n) = 0
    EQUAL ==> Red([(car(m) TIMES car(n)) PLUS (cdr(m) TIMES 0),
							(car(m) TIMES 0) PLUS (car(n) TIMES cdr(m))]) = [0,0]
    ALGEBRA ==> Stat10: [0,0] = Red([car(m) TIMES car(n),car(n) TIMES cdr(m)])
    Use_def(Red) ==> Red([car(m) TIMES car(n),car(n) TIMES cdr(m)]) =
    	[(car(m) TIMES car(n)) MINUS (((car(m) TIMES car(n))) * (car(n) TIMES cdr(m))),
    		(car(n) TIMES cdr(m)) MINUS (((car(m) TIMES car(n))) * (car(n) TIMES cdr(m)))]
   (car(n))-->T245 ==> Stat11: car(n) TIMES 0 = 0
    Suppose ==> Stat12: ((car(m) TIMES car(n))) * (car(n) TIMES cdr(m)) /= 0
    (Stat12)ELEM ==> (car(n) TIMES cdr(m) /= 0) & (car(m) TIMES car(n) /= 0)
    Suppose ==> cdr(m) = 0
    EQUAL ==> false; Discharge ==> car(m) = 0
    EQUAL ==> 0 TIMES car(n) /= 0
    (0,car(n))-->T253 ==> Stat13: car(n) TIMES 0 /= 0
    (Stat11,Stat13)Discharge ==> ((car(m) TIMES car(n))) * (car(n) TIMES cdr(m)) = 0
    EQUAL ==> Red([car(m) TIMES car(n),car(n) TIMES cdr(m)]) =
    	[(car(m) TIMES car(n)) MINUS 0,(car(n) TIMES cdr(m)) MINUS 0]
    (car(m) TIMES car(n))-->T268 ==> (car(m) TIMES car(n)) MINUS 0 = #(car(m) TIMES car(n))
    (car(n) TIMES cdr(m))-->T268 ==> (car(n) TIMES cdr(m)) MINUS 0 = #(car(n) TIMES cdr(m))
    EQUAL ==> Stat14:  Red([car(m) TIMES car(n),car(n) TIMES cdr(m)]) =
    							[#(car(m) TIMES car(n)),#(car(n) TIMES cdr(m))]
    (Stat14,Stat10)ELEM ==> Stat15: [#(car(m) TIMES car(n)),#(car(n) TIMES cdr(m))] = [0,0]
    (Stat15)ELEM ==> (#(car(m) TIMES car(n)) = 0) & (#(car(n) TIMES cdr(m)) = 0)
    (car(m) TIMES car(n))-->T162 ==> Stat16: car(m) TIMES car(n) = 0
    (car(n) TIMES cdr(m))-->T162 ==> Stat17: car(n) TIMES cdr(m) = 0
    (car(m),car(n))-->T309(Stat16,Stat9) ==> car(m) = 0
    (car(n),cdr(m))-->T309(Stat17,Stat9) ==> cdr(m) = 0
    Discharge ==> Stat18: (car(n) = 0) & (cdr(n) /= 0)
    EQUAL ==>  Red([(car(m) TIMES 0) PLUS (cdr(m) TIMES cdr(n)),
							(car(m) TIMES cdr(n)) PLUS (0 TIMES cdr(m))]) = [0,0]
    ALGEBRA ==> Stat19: [0,0] = Red([cdr(m) TIMES cdr(n),car(m) TIMES cdr(n)])
    Use_def(Red) ==> Red([cdr(m) TIMES cdr(n),car(m) TIMES cdr(n)]) =
    	[(cdr(m) TIMES cdr(n)) MINUS (((cdr(m) TIMES cdr(n))) * (car(m) TIMES cdr(n))),
    		(car(m) TIMES cdr(n)) MINUS (((cdr(m) TIMES cdr(n))) * (car(m) TIMES cdr(n)))]
    (cdr(n))-->T245 ==> Stat20: cdr(n) TIMES 0 = 0
    (cdr(n),0)-->T253(Stat20) ==> Stat21: 0 TIMES cdr(n) = 0
    Suppose ==> Stat22: (cdr(m) TIMES cdr(n)) * (car(m) TIMES cdr(n)) /= 0
    (Stat22)ELEM ==> (cdr(m) TIMES cdr(n) /= 0) & (car(m) TIMES cdr(n) /= 0)
    Suppose ==> cdr(m) = 0
    EQUAL ==> false; Discharge ==> car(m) = 0
    EQUAL ==> 0 TIMES cdr(n) /= 0
    (0,cdr(n))-->T253 ==> Stat23: cdr(n) TIMES 0 /= 0
    (Stat20,Stat23)Discharge ==> (cdr(m) TIMES cdr(n)) * (car(m) TIMES cdr(n)) = 0
    EQUAL ==> Red([cdr(m) TIMES cdr(n),car(m) TIMES cdr(n)]) =
    	[(cdr(m) TIMES cdr(n)) MINUS 0,(car(m) TIMES cdr(n)) MINUS 0]
    (cdr(m) TIMES cdr(n))-->T268 ==> (cdr(m) TIMES cdr(n)) MINUS 0 = #(cdr(m) TIMES cdr(n))
    (car(m) TIMES cdr(n))-->T268 ==> (car(m) TIMES cdr(n)) MINUS 0 = #(car(m) TIMES cdr(n))
    EQUAL ==> Stat24:  Red([cdr(m) TIMES cdr(n),car(m) TIMES cdr(n)]) =
    							[#(cdr(m) TIMES cdr(n)),#(car(m) TIMES cdr(n))]
    (Stat24,Stat19)ELEM ==> Stat25: [#(cdr(m) TIMES cdr(n)),#(car(m) TIMES cdr(n))] = [0,0]
    (Stat25)ELEM ==> (#(cdr(m) TIMES cdr(n)) = 0) & (#(car(m) TIMES cdr(n)) = 0)
    (cdr(m) TIMES cdr(n))-->T162 ==> Stat26: cdr(m) TIMES cdr(n) = 0
    (car(m) TIMES cdr(n))-->T162 ==> Stat27: car(m) TIMES cdr(n) = 0
    (car(m),cdr(n))-->T309(Stat27,Stat18) ==> car(m) = 0
    (cdr(m),cdr(n))-->T309(Stat26,Stat18) ==> cdr(m) = 0
    Discharge ==> QED

--
-- Next we prove the distributivity of multiplication over subtraction.
--

Theorem 408: [Distributivity of multiplication over subtraction]
    ((N in Si) & (M in Si) & (K in Si)) imp ((m S_TIMES n) S_MINUS (k S_TIMES n) = (m S_MINUS k) S_TIMES n). Proof:
    Suppose_not(n,m,k) ==> (n in Si) & (m in Si) & (k in Si) & ((m S_TIMES n) S_MINUS (k S_TIMES n) /= (m S_MINUS k) S_TIMES n)
--
-- For suppose that signed integers $n$, $m$, $k$ are a counterexample to our assertion. Using Theorem 371, Theorem 372, Theorem 392,
-- and Theorem 398 we can rewrite the negative of our assertion (in a form using $S_PLUS$ instead of $S_MINUS$) as
--
--		$((m S_TIMES n) S_PLUS (S_Rev(k) S_TIMES n) /= (m S_PLUS S_Rev(k)) S_TIMES n)$
--
	(m,n)-->T371 ==> (m S_TIMES n) in Si
	(k,n)-->T371 ==> (k S_TIMES n) in Si
    (m S_TIMES n,k S_TIMES n)-->T398 ==> (m S_TIMES n) S_MINUS (k S_TIMES n) = (m S_TIMES n) S_PLUS S_Rev(k S_TIMES n)
    (m,k)-->T398 ==> (m S_MINUS k) = (m S_PLUS S_Rev(k))
    (k,n)-->T392 ==> S_Rev(k S_TIMES n) = S_Rev(k) S_TIMES n
    EQUAL ==> ((m S_TIMES n) S_PLUS (S_Rev(k) S_TIMES n) /= (m S_PLUS S_Rev(k)) S_TIMES n)
--
-- Then, using the commutativity of the '$S_TIMES$' operator, we can rewrite the above inequality as
--
--		$((n S_TIMES m) S_PLUS (n S_TIMES S_Rev(k)) /= n S_TIMES (m S_PLUS S_Rev(k)))$
--
-- which stands in contradiction to the distributivity rule for signed integer addition,
-- and so proves our theorem.
--
    k-->T391 ==> S_Rev(k) in Si
	(m,S_Rev(k))-->T371 ==> (m S_PLUS S_Rev(k)) in Si
	(m,n)-->T384 ==> m S_TIMES n = n S_TIMES m
	(S_Rev(k),n)-->T384 ==> S_Rev(k) S_TIMES n = n S_TIMES S_Rev(k)
 	(m S_PLUS S_Rev(k),n)-->T384 ==> (m S_PLUS S_Rev(k)) S_TIMES n = n S_TIMES (m S_PLUS S_Rev(k))
 	EQUAL ==> ((n S_TIMES m) S_PLUS (n S_TIMES S_Rev(k))) /= (n S_TIMES (m S_PLUS S_Rev(k)))
 	(S_Rev(k),n)-->T384 ==> S_Rev(k) S_TIMES n = n S_TIMES S_Rev(k)
    (S_Rev(k),n,m)-->T386 ==> false; Discharge ==> QED
--
-- Our next theorem states the principle of cancellation for the ring of signed integers.
-- The proof is straightforward and algebraic: from $m S_TIMES n = k S_TIMES n$ deduce $(m S_MINUS k) S_TIMES n = 0$,
-- and then apply Theorem 407.
--
Theorem 409: [$Si$ multiplicative cancellation]
	((N in Si) & (M in Si) & (K in Si) & (M S_TIMES N = K S_TIMES N) & (N /= [0,0])) imp (M = K). Proof:
    Suppose_not(n,m,k) ==> (n in Si) & (m in Si) & (k in Si) & (m S_TIMES n = k S_TIMES n) & (n /= [0,0]) & (m /= k)
    EQUAL ==> (m S_TIMES n) S_MINUS (k S_TIMES n) = (k S_TIMES n) S_MINUS (k S_TIMES n)
    (k,n)-->T371 ==> (k S_TIMES n) in Si
    (k S_TIMES n)-->T404 ==> (m S_TIMES n) S_MINUS (k S_TIMES n) = [0,0]
    (m,k)-->T372 ==> (m S_MINUS k) in Si
    (n,m,k)-->T408 ==> (m S_MINUS k) S_TIMES n = [0,0]
    (n,m S_MINUS k)-->T407 ==> (m S_MINUS k) = [0,0]
    EQUAL ==> k S_PLUS (m S_MINUS k) = k S_PLUS [0,0]
    (m,k)-->T399 ==> m = k S_PLUS [0,0]
    k-->T405 ==> false; Discharge ==> QED
--
-- Next we prove that the product of any signed integer $n$ by my minus 0ne is the reverse of $n$.
--
Theorem 410: [Multiplication by -1] (N in Si) imp (S_Rev(N) = [0,1] S_TIMES N). Proof:
    Suppose_not(n) ==> (n in Si) & (S_Rev(n) /= [0,1] S_TIMES n)
--
--
--
    n-->T369 ==> (n = [car(n),cdr(n)]) & (car(n) = 0 or cdr(n) = 0) & (car(n) in Za) & (cdr(n) in Za)
    Use_def(S_TIMES) ==>
    	S_Rev(n) /= Red([(car([0,1]) TIMES car(n)) PLUS (cdr([0,1]) TIMES cdr(n)),
    							(car([0,1]) TIMES cdr(n)) PLUS (car(n) TIMES cdr([0,1]))])
    ELEM ==> (car([0,1]) = 0) & (cdr([0,1]) = 1)
    EQUAL ==> S_Rev(n) /= Red([(0 TIMES car(n)) PLUS (1 TIMES cdr(n)),
    							(0 TIMES cdr(n)) PLUS (car(n) TIMES 1)])
    ALGEBRA ==> S_Rev(n) /= Red([cdr(n),car(n)])
    Use_def(Red) ==> Red([cdr(n),car(n)]) = [cdr(n) MINUS (cdr(n) * car(n)),car(n) MINUS (cdr(n) * car(n))]
    ELEM ==> (cdr(n) * car(n)) = 0
    EQUAL ==> Red([cdr(n),car(n)]) = [cdr(n) MINUS 0,car(n) MINUS 0]
    (cdr(n))-->T268 ==> (cdr(n) MINUS 0) = #cdr(n)
    (car(n))-->T268 ==> (car(n) MINUS 0) = #car(n)
    (cdr(n))-->T206 ==> Card(cdr(n))
    (car(n))-->T206 ==> Card(car(n))
    (cdr(n))-->T164 ==> #cdr(n) = cdr(n)
    (car(n))-->T164 ==> #car(n) = car(n)
    EQUAL ==> Red([cdr(n),car(n)]) = [cdr(n),car(n)]
    Use_def(S_Rev) ==> S_Rev(n) = [cdr(n),car(n)]
    Discharge ==> QED
--
-- ************************************************************************************************
--			Section 10: Mathematical induction for integers; the general summation operator
-- ************************************************************************************************
--
-- We now develop the standard theory of mathematical induction (for integers), which tells us that
-- if there exists an integer $n$ having some property $P(n)$, there exists a smallest integer $m$ having the property $P(m)$.
--
THEORY mathematical_induction(n,P(x))
    (n in Za) & P(n)
END mathematical_induction;
--
ENTER_THEORY mathematical_induction
--
-- We begin with two small 'glue' theorems, the first of which merely restates the assumptionof the present theory, therby making it
-- available to the theorem-level APPLY inference which follows.
--
Theorem mathematical_induction00: [Basic assumption for proofs by mathematical induction] (n in Za) & P(n). Proof:
	Suppose_not ==> not((n in Za) & P(n))
    Assump ==> (n in Za) & P(n)
    Discharge ==> QED
--
-- Next we APPLY transfinite_induction, to get a conclusion close to that which we desire.
--
   APPLY(mt1_thryvar:m2_thryvar) transfinite_induction(n->n,P(x)->((x in Za) & P(x))) ==>
    	Theorem mathematical_induction0: [The minimum integer having a given property, preliminary version] (FORALL k | ((m2_thryvar in Za) & P(m2_thryvar)) & ((k in m2_thryvar) imp (not ((k in Za) & P(k)))))

--
-- The following result, which is the sole externally useful theorem of the present theory, shows that the quantity $m2_thryvar$
-- supplied by applying standard transfinite induction to the predicate $(n in Za) & P(n)$ has the minimality property we desire.
--
Theorem mathematical_induction1: [The minimum integer having a given property] (m2_thryvar in Za) & P(m2_thryvar) & (FORALL k in m2_thryvar | not P(k)). Proof:
	Suppose_not ==> Stat1: not((m2_thryvar in Za) & P(m2_thryvar) & (FORALL k in m2_thryvar | not P(k)))
--
-- Unwrap part of quantified statement which is not affected by the quantifier:
--
  	Tmathematical_induction0 ==> Stat2: (FORALL k | ((m2_thryvar in Za) & P(m2_thryvar)) & ((k in m2_thryvar) imp (not ((k in Za) & P(k)))))
    0-->Stat2 ==> (m2_thryvar in Za) & P(m2_thryvar)
--
--
-- For if not there would be some member $m$ of $m2_thryvar$ having the property $P(m)$,
-- and since this $m$ would necessarily be an integer we have a contradiction which proves our assertion.
--
    ELEM ==> Stat3: not (FORALL n in m2_thryvar | not P(n))
    m-->Stat3 ==> (m in m2_thryvar) & P(m)
    m-->Stat2 ==> m notin Za
    junk-->T206 ==> Ord(Za)
    (Za,m2_thryvar)-->T12 ==> Ord(m2_thryvar)
    (m2_thryvar,m)-->T12 ==> Ord(m)
    (Za,m)-->T35 ==> Za incin m
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY mathematical_induction
--
--THEORY mathematical_induction(n,P(x))
--    n in Za
--    P(n)
--==>(m2_thryvar)
--    (m2_thryvar in Za) & P(m2_thryvar) & (FORALL n in m2_thryvar | not P(n))
--END mathematical_induction;
--
--
-- One sometimes needs to give proofs by 'double induction', which use the fact that
-- if there exist any $n$ and $k$ satisfying a 2-variable predicate $R(n,k)$, then
-- there exist $m$ and $j$ satisfying this same predicate, which are minimal in the sense that
-- $R(k,i)$ must be false for any $k$ less than $m$ and any $i$ at all, while $R(m,i)$
-- must also be false for any $i$ less than $j$. We give theories capable of supplying
-- this fact in two variants: the first in which $n$ and $k$ are general sets, the second in which
-- all the quantities involved are integers.
--
--
THEORY double_transfinite_induction(n,k,R(x,y))
    R(n,k)
END double_transfinite_induction;
--
ENTER_THEORY double_transfinite_induction
--
Theorem double_transfinite_induction.0: [Basic assumption for proofs by double transfinite induction] (EXISTS i | R(n,i)). Proof:
    Suppose_not ==> Stat1: not(EXISTS i | R(n,i))
        Assump ==> R(n,k)
    k-->Stat1 ==> false; Discharge ==> QED
--
APPLY(mt1_thryvar:m3_thryvar) transfinite_induction(n->n, P(x)->(EXISTS i | R(x,i))) ==>
	Theorem double_transfinite_induction.1: [Minimum first element in a double transfinite induction] (FORALL k | ((EXISTS i | R(m3_thryvar,i)) & ((k in m3_thryvar) imp (not (EXISTS i | R(k,i))))))
--
Theorem double_transfinite_induction.2: [Existence of a second element corresponding to the minimum first element] (EXISTS i | R(m3_thryvar,i)). Proof:
    Suppose_not ==> Stat1: (not (EXISTS i | R(m3_thryvar,i)))
        Tdouble_transfinite_induction.1 ==> Stat2: (FORALL k | ((EXISTS i | R(m3_thryvar,i)) & ((k in m3_thryvar) imp (not (EXISTS i | R(k,i))))))
        0-->Stat2 ==> Stat3: (EXISTS i | R(m3_thryvar,i))
    (Stat1,Stat3)Discharge ==> QED
--
APPLY(v1_thryvar:ei1) Skolem() ==>
	Theorem double_transfinite_induction.3: [Minimum second element in a double transfinite induction] R(m3_thryvar,ei1)
--
APPLY(mt1_thryvar:j1_thryvar) transfinite_induction(n->ei1,P(x)->R(m3_thryvar,x)) ==>
	Theorem double_transfinite_induction.4: [Minimal element properties in a double transfinite induction] (FORALL k | R(m3_thryvar,j1_thryvar) & ((k in j1_thryvar) imp (not R(m3_thryvar,k))))
--
--
-- As an obvious corollary of the statements proved by the preceding two
-- applications of transfinite induction, we get the following statement,
-- which will be externalized by the present THEORY.
--
Theorem double_transfinite_induction.5: [Minimal element properties in a double transfinite induction, 2] R(m3_thryvar,j1_thryvar) & ((K in m3_thryvar) imp (not R(K,I))) & ((I in j1_thryvar) imp (not R(m3_thryvar,I))). Proof:
    Suppose_not(i) ==> (not R(m3_thryvar,j1_thryvar)) or ((k in m3_thryvar) & R(k,i)) or ((i in j1_thryvar) & R(m3_thryvar,i))
        Suppose ==> Stat1: (k in m3_thryvar) & R(k,i)
            Tdouble_transfinite_induction.1 ==> Stat2: (FORALL k | (EXISTS i | R(m3_thryvar,i)) & ((k in m3_thryvar) imp (not (EXISTS i | R(k,i)))))
            k-->Stat2 ==> Stat3: (not(EXISTS i | R(k,i)))
        i-->Stat3 ==> false; Discharge ==> (not R(m3_thryvar,j1_thryvar)) or ((i in j1_thryvar) & R(m3_thryvar,i))
        Tdouble_transfinite_induction.4 ==> Stat4: (FORALL i | R(m3_thryvar,j1_thryvar) & ((i in j1_thryvar) imp (not R(m3_thryvar,i))))
    i-->Stat4 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY double_transfinite_induction
--
--
--THEORY double_transfinite_induction(R(x,y));
--    (EXISTS n, k | R(n,k))
--==>(m3_thryvar,j1_thryvar)
--    R(m3_thryvar,j1_thryvar) & (FORALL k in m3_thryvar, i in OM | not R(k,i)) & (FORALL i in j1_thryvar | not R(m3_thryvar,i))
--END double_transfinite_induction;
--
--
--
-- The following simple variant of the preceding theory tells us that
-- if there exist any integers $n$ and $k$ satisfying a 2-variable predicate $R(n,k)$, then
-- there exist integers  $m$ and $j$ satisyfing this same predicate, which are minimal in the sense that
-- $R(k,i)$ must be false for any integer $k$ less than $m$ and any integer $i$ at all, while $R(m,i)$
-- must also be false for any integer $i$ less than $j$.
--
THEORY double_mathematical_induction(n,k,R(x,y))
    (n in Za) & (k in Za) & R(n,k)
END double_mathematical_induction;
--
ENTER_THEORY double_mathematical_induction
--
Theorem double_mathematical_induction.0: [Basic assumption for double integer induction] (EXISTS i | (i in Za) & R(n,i)). Proof:
    Suppose_not ==> Stat1: not(EXISTS i | (i in Za) & R(n,i))
        Assump ==> (k in Za) & R(n,k)
    k-->Stat1 ==> false; Discharge ==> QED
--
APPLY(m2_thryvar:mm_thryvar) mathematical_induction(n->n, P(x)->(EXISTS i | (i in Za) & R(x,i))) ==>
	Theorem double_mathematical_induction.1: [Minimum first element for a double integer induction] (mm_thryvar in Za) & (EXISTS i | (i in Za) & R(mm_thryvar,i)) & (FORALL k in mm_thryvar | not (EXISTS i | (i in Za) & R(k,i)))
--
Theorem double_mathematical_induction.2: (EXISTS i | (i in Za) & R(mm_thryvar,i)). Proof:
    Suppose_not ==> Stat1: (not (EXISTS i | (i in Za) & R(mm_thryvar,i)))
        Tdouble_mathematical_induction.1 ==> Stat2: (FORALL k | (mm_thryvar in Za) & (EXISTS i | (i in Za) & R(mm_thryvar,i)) & ((k in mm_thryvar) imp (not (EXISTS i | (i in Za) & R(k,i)))))
        0-->Stat2 ==> Stat3: (EXISTS i | (i in Za) & R(mm_thryvar,i))
   (Stat1,Stat3)Discharge ==> QED
--
APPLY(v1_thryvar:ei2) Skolem() ==>
	Theorem double_mathematical_induction.3: (ei2 in Za) & R(mm_thryvar,ei2)
--
APPLY(m2_thryvar:j2_thryvar) mathematical_induction(n->ei2, P(x)->R(mm_thryvar,x)) ==>
	Theorem double_mathematical_induction.4:  (FORALL i | (j2_thryvar in Za) & R(mm_thryvar,j2_thryvar) &
			((i in j2_thryvar) imp (not ((i in Za) & R(mm_thryvar,i)))))
--
-- As a straightforward corollary of the statements proved by the preceding two
-- applications of mathematical induction, we get the following statement,
-- which will be externalized by the present THEORY.
--
Theorem double_mathematical_induction.5: (mm_thryvar in Za) & (j2_thryvar in Za) & R(mm_thryvar,j2_thryvar) & (((K in mm_thryvar) & (I in Za)) imp (not R(K,I))) & ((I in j2_thryvar) imp (not R(mm_thryvar,I))). Proof:
    Suppose_not(i) ==> (mm_thryvar notin Za) or (j2_thryvar notin Za) or (not R(mm_thryvar,j2_thryvar)) or ((k in mm_thryvar) & (i in Za) & R(k,i)) or ((i in j2_thryvar) & R(mm_thryvar,i))
        Suppose ==> (mm_thryvar notin Za) or ((k in mm_thryvar) & (i in Za) & R(k,i))
            Tdouble_mathematical_induction.1 ==> (mm_thryvar in Za) & (EXISTS i | (i in Za) & R(mm_thryvar,i)) & Stat1: (FORALL k in mm_thryvar | not (EXISTS i | (i in Za) & R(k,i)))
            k-->Stat1 ==> Stat2: (not (EXISTS i | (i in Za) & R(k,i)))
        i-->Stat2 ==> false; Discharge ==> (j2_thryvar notin Za) or (not R(mm_thryvar,j2_thryvar)) or ((i in j2_thryvar) & R(mm_thryvar,i))
        Tdouble_mathematical_induction.4 ==> Stat3: (FORALL i | (j2_thryvar in Za) & R(mm_thryvar,j2_thryvar) & ((i in j2_thryvar) imp (not((i in Za) &  R(mm_thryvar,i)))))
    i-->Stat3 ==> (i in j2_thryvar) & (j2_thryvar in Za) & (i notin Za)
    junk-->T206 ==> Ord(Za)
    (Za,j2_thryvar)-->T12 ==> Ord(j2_thryvar)
    (j2_thryvar,i)-->T12 ==> Ord(i)
    (Za,i)-->T35 ==> Za incin i
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY double_mathematical_induction
--
--THEORY double_mathematical_induction(n,k,R(x,y));
--    (n in Za) & (k in Za) & R(n,k)
--==>(mm_thryvar,j2_thryvar)
--    (FORALL k, i | (mm_thryvar in Za) & (j2_thryvar in Za) & R(mm_thryvar,j2_thryvar) &
--	(((k in mm_thryvar) & (i in Za)) imp (not R(k,i))) & ((i in j2_thryvar) imp (not R(mm_thryvar,i))))
--END double_mathematical_induction;
--
--
--
-- The following mini-theory shows that any infinite increasing sequence all of whose images are
-- circumscribed by a finite set has two consecutive equal components.
--
THEORY confinedIncrSeq(e(x),s0)
	Finite(s0)
	(FORALL i in Za | e(i) incin (e(next(i)) * s0))
END confinedIncrSeq
--
Def 10070: [position of first repetition in confined increasing sequence] m5_thryvar := arb({i in Za | e(next(i)) incin e(i)})
--
ENTER_THEORY confinedIncrSeq
--
Theorem confinedIncrSeq1: [global increase of a stepwise increasing sequence] ((I in J) & (J in Za)) imp (e(I) incin e(J)). Proof:
Suppose_not(i0,j0) ==> AUTO
	T206(*) ==> Stat1: Ord(Za)
	(Za,j0)-->T13(*) ==> (i0 in Za) & (j0 in Za) & (e(i0) nincin e(j0))
--?	APPLY(mm_thryvar:i1,j2_thryvar:i2) double_mathematical_induction(n->i0,k->j0,R(x,y)->((x in y) & (e(x) nincin e(y)))) ==>
--?		Stat2: (FORALL k, i | (i1 in Za) & (i2 in Za) & ((i1 in i2) & (e(i1) nincin e(i2))) & (((k in i1) & (i in Za)) imp (not ((k in i) & (e(k) nincin e(i))))) & ((i in i2) imp (not ((i1 in i) & (e(i1) nincin e(i))))))
--	(0,0)-->Stat2(Stat2*) ==> Stat3: (i1 in Za) & (i2 in Za) & (i1 in i2) & (e(i1) nincin e(i2))
--	Suppose ==> Stat4: not(FORALL i in i2 | not((i1 in i) & (e(i1) nincin e(i))))
--		i4-->Stat4(Stat4*) ==> Stat5: (i4 in i2) & (i1 in i4) & (e(i1) nincin e(i4))
--	(0,i4)-->Stat2(Stat5*) ==> false; Discharge ==> Stat6: (FORALL i in i2 | not((i1 in i) & (e(i1) nincin e(i))))
	APPLY(mm_thryvar:i1,j2_thryvar:i2) double_mathematical_induction(n->i0,k->j0,R(x,y)->((x in y) & (e(x) nincin e(y)))) ==>
		Stat7: (i1 in Za) & Stat6: (FORALL i | (i2 in Za) & ((i1 in i2) & (e(i1) nincin e(i2))) &
				((i in i2) imp (not((i in Za) & ((i1 in i) & (e(i1) nincin e(i)))))))
	0-->Stat6(Stat7*) ==> Stat3: (i1 in Za) & (i2 in Za) & (i1 in i2) & (e(i1) nincin e(i2))
	Loc_def ==> i3 = Un(i2)
	i2-->T321(Stat3*) ==> Stat8: i3 in Za
	i3-->T317(Stat8*) ==> (i3 PLUS 1) = next(i3)
	EQUAL(Stat3) ==> (Un(i2) PLUS 1) = next(i3)
	i2-->T322(Stat3*) ==> Stat9: i2 = next(i3)
	(Za,i3)-->T12(Stat1,Stat8*) ==> Stat10: Ord(i3)
	(i3,i1)-->T36(Stat3*) ==> (i1 incin i3) & Ord(i1)
	Assump ==> Stat11: (FORALL i in Za | e(i) incin (e(next(i)) * s0))
	Suppose ==> i1 = i3
		EQUAL(Stat3) ==> e(i1) nincin e(next(i1))
	i1-->Stat11(Stat3*) ==> false; Discharge ==> i1 /= i3
	(i3,i1)-->T34(Stat10*) ==> Stat12: i1 in i3
	Use_def(next)(Stat9*) ==> i3 in i2
	i3-->Stat6(Stat8*) ==> Stat13: e(i1) incin e(i3)
	i3-->Stat11(Stat8,Stat8*) ==> e(i3) incin e(next(i3))
	EQUAL(Stat9) ==> Stat14: e(i3) incin e(i2)
(Stat13,Stat14,Stat3*)Discharge ==> QED
--
Theorem confinedIncrSeq2: [position of first repetition in confined increasing sequence] (m5_thryvar in Za) & (e(next(m5_thryvar)) = e(m5_thryvar)) & ((m5_thryvar * {i in Za | e(next(i)) incin e(i)}) = 0). Proof:
Suppose_not ==> AUTO
--
-- Assuming the contrary, observe in the first place that the set
--	{i in Za | e(next(i)) incin e(i)}
-- cannot be empty.
--
	Assump ==> Stat1: (FORALL i in Za | e(i) incin (e(next(i)) * s0))
	Suppose ==> {i in Za | e(next(i)) incin e(i)} /= 0
		Use_def(m5_thryvar) ==> m5_thryvar = arb({i in Za | e(next(i)) incin e(i)})
		({i in Za | e(next(i)) incin e(i)})-->T0(*) ==> Stat2: (m5_thryvar in {i in Za | e(next(i)) incin e(i)}) & ((m5_thryvar * {i in Za | e(next(i)) incin e(i)}) = 0)
		m5_thryvar-->Stat2(*) ==> Stat3: (m5_thryvar in Za) & (e(m5_thryvar) nincin e(next(m5_thryvar)))
	m5_thryvar-->Stat1(Stat3*) ==> false; Discharge ==> Stat4: {i in Za | e(next(i)) incin e(i)} = 0
--
-- Otherwise stated, there is an element in $e(next(i)) - e(i)$, for every $i$ in $Za$.
--
	Suppose ==> Stat5: not(FORALL i in Za | arb(e(next(i)) - e(i)) in (e(next(i)) - e(i)))
		i1-->Stat5(Stat5*) ==> (i1 in Za) & (arb(e(next(i1)) - e(i1)) notin (e(next(i1)) - e(i1)))
		(e(next(i1)) - e(i1))-->T0(Stat5*) ==> e(next(i1)) incin e(i1)
	i1-->Stat4(Stat4*) ==> false; Discharge ==> Stat6: (FORALL i in Za | arb(e(next(i)) - e(i)) in (e(next(i)) - e(i)))
--
-- We will show that the mapping which sends every integer $i$ into $arb(e(next(i)) - e(i))$ is
-- one-one. However, since its domain $Za$ is infinite, and all of its images belong to $s0$,
-- this leads to a contradiction, from which the desired statement ensues.
--
	Suppose ==> Stat7: not(range({[i,arb(e(next(i)) - e(i))]: i in Za }) incin s0)
		TELEM ==> range({[i,arb(e(next(i)) - e(i))]: i in Za }) = {arb(e(next(i)) - e(i)): i in Za }
		(Stat7*)ELEM ==> Stat8: not({arb(e(next(i)) - e(i)): i in Za} incin s0)
		c-->Stat8(Stat8*) ==> Stat9: (c in {arb(e(next(i)) - e(i)): i in Za}) & (c notin s0)
		i0-->Stat9(Stat9*) ==> (i0 in Za) & (arb(e(next(i0)) - e(i0)) notin s0)
		i0-->Stat6(Stat6*) ==> arb(e(next(i0)) - e(i0)) in (e(next(i0)) - e(i0))
		i0-->T210(Stat9*) ==> next(i0) in Za
	(next(i0))-->Stat1(Stat9*) ==> false; Discharge ==> Stat10: range({[i,arb(e(next(i)) - e(i))]: i in Za }) incin s0
	Suppose ==> one_1_map({[i,arb(e(next(i)) - e(i))]: i in Za})
		T206(Stat10*) ==> (not Finite(Za))
		TELEM ==> domain({[i,arb(e(next(i)) - e(i))]: i in Za }) = Za
		({[i,arb(e(next(i)) - e(i))]: i in Za})-->T191(Stat10*) ==> (not Finite(range({[i,arb(e(next(i)) - e(i))]: i in Za})))
		Assump ==> Finite(s0)
	(s0,range({[i,arb(e(next(i)) - e(i))]: i in Za}))-->T189(Stat10*) ==> false; Discharge ==> Stat11: (not one_1_map({[i,arb(e(next(i)) - e(i))]: i in Za}))
--
-- Denying that the mapping which sends every integer $i$ into $arb(e(next(i)) - e(i))$ is
-- one-one would, in fact, amount to denying that it inverse is single-valued.
-- Let $i2,i3$ be integers which witness this fact.
--
	Use_def(one_1_map)(Stat11) ==> Stat12: not(FORALL x in {[i,arb(e(next(i)) - e(i))]: i in Za}, y in {[i,arb(e(next(i)) - e(i))]: i in Za} | (cdr(x) = cdr(y)) imp (x = y))
	(p,q)-->Stat12(Stat12*) ==> Stat13: (p in {[i,arb(e(next(i)) - e(i))]: i in Za}) & (q in {[i,arb(e(next(i)) - e(i))]: i in Za}) & (cdr(p) = cdr(q)) & (p /= q)
	(i2,i3)-->Stat13(Stat13*) ==> Stat14: (p = [i2,arb(e(next(i2)) - e(i2))]) & (i2 in Za) & (q = [i3,arb(e(next(i3)) - e(i3))]) & (i3 in Za)
	EQUAL(Stat13) ==> Stat15: (cdr([i2,arb(e(next(i2)) - e(i2))]) = cdr([i3,arb(e(next(i3)) - e(i3))]))
	(Stat15)ELEM ==> Stat16: arb(e(next(i2)) - e(i2)) = arb(e(next(i3)) - e(i3))
	EQUAL(Stat13) ==> Stat17: [i2,arb(e(next(i2)) - e(i2))] /= [i3,arb(e(next(i3)) - e(i3))]
	(Stat16)ELEM ==> Stat18: i2 /= i3
--
-- Either $i2 in i3$ or $i3 in i2$, because $i2,i3$ are ordinals. In the former case
-- $next(i2) in i3$ or $next(i2) = i3$, and hence $e(next(i2)) incin e(i3)$ by the
-- preceding Theorem confinedIncrSeq2. But then it is impossible that $arb(e(next(i2)) - e(i2))$
-- belongs to $e(next(i3)) - e(i3)$, and we face a contradiction.
--
	T206(Stat18*) ==> Ord(Za)
	(Za,i2)-->T12(Stat14*) ==> Ord(i2)
	(Za,i3)-->T12(Stat14*) ==> Ord(i3)
	i3-->Stat6(Stat14*) ==> Stat19: arb(e(next(i3)) - e(i3)) in (e(next(i3)) - e(i3))
	i2-->Stat6(Stat14*) ==> Stat20: arb(e(next(i2)) - e(i2)) in (e(next(i2)) - e(i2))
	Suppose ==> i2 in i3
		(i3,i2)-->T37(Stat18*) ==> next(i2) incin i3
		i2-->T210(Stat14,Stat14*) ==> next(i2) in Za
		(Za,next(i2))-->T12(Stat18*) ==> Ord(next(i2))
		(i3,next(i2))-->T34(Stat18*) ==> (next(i2) in i3) or (next(i2) = i3)
		Suppose ==> Stat21: e(next(i2)) nincin e(i3)
			Suppose ==> next(i2) = i3
				EQUAL(Stat21) ==> e(next(i2)) = e(i3)
			(Stat21*)Discharge ==> next(i2) in i3
		(next(i2),i3)-->TconfinedIncrSeq1(Stat13*) ==> false; Discharge ==> Stat22: e(next(i2)) incin e(i3)
	(Stat16,Stat19,Stat20,Stat22*)Discharge ==> i2 notin i3
	(i2,i3)-->T31(Stat18*) ==> i3 in i2
--
-- Analogously we get a contradiction if we suppose that $i3 in i2$.
-- This last contradiction leads to the desired conclusion.
--
	(i2,i3)-->T37(Stat18*) ==> next(i3) incin i2
	i3-->T210(Stat14,Stat14*) ==> next(i3) in Za
	(Za,next(i3))-->T12(Stat18*) ==> Ord(next(i3))
	(i2,next(i3))-->T34(Stat18*) ==> (next(i3) in i2) or (next(i3) = i2)
	Suppose ==> Stat23: e(next(i3)) nincin e(i2)
		Suppose ==> next(i3) = i2
			EQUAL(Stat23) ==> e(next(i3)) = e(i2)
		(Stat23*)Discharge ==> next(i3) in i2
	(next(i3),i2)-->TconfinedIncrSeq1(Stat13*) ==> false; Discharge ==> Stat24: e(next(i3)) incin e(i2)
(Stat16,Stat19,Stat20,Stat24*)Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY confinedIncrSeq
--
--THEORY confinedIncrSeq(e(x),s0)
--	Finite(s0)
--	(FORALL i in Za | e(i) incin (e(next(i)) * s0))
--==>(m5_thryvar)
--	(FORALL i, j | ((i in j) & (j in Za)) imp (e(i) incin e(j)))
--	(m5_thryvar in Za) & (e(next(m5_thryvar)) = e(m5_thryvar)) & ((m5_thryvar * {i in Za | e(next(i)) incin e(i)}) = 0)
--END confinedIncrSeq
--
--
-- Next we prove a general version of the principle that recursive definitions of functions $h$
-- over any well-founded set are valid if the definition of $h(x)$ involves only values $y$ which
-- precede $y$ in the well-founded relation of the set. Given a well-ordering relationship $arg1_bef_arg2$,
-- and given any functions $f(x)$, $g4(x,y,u,v)$, and $P(x,y,u)$ our aim is to prove that therese exists a function
-- $h$ which satisfies the identity
--	$(FORALL x in s, t in OM | h3_thryvar(x,s,t) = f({g4(h3_thryvar(y,s,t),y,x,t): y in s | arg1_bef_arg2(y,x) & P(h3_thryvar(y,s,t),s,y,x,t)},s,x,t))$.
--
-- This is not an immediate consequence of our principle of recursive definition, which insists on using the membership relator in place of the
-- general well-foundedness relator $arg1_bef_arg2$ which we now consider. We therefore proceed by introducng an enumerator which relates
-- $arg1_bef_arg2$ closely enough to memebership for our principle of recursive definition to be used.
--
THEORY wellfounded_recursive_fcn(s,arg1_bef_arg2(y,x),f3(b,x,t),g4(a,y,x,t),P4(a,y,x,t))
	(FORALL t | ((t incin s) & (t /= 0) imp (EXISTS x in t | (FORALL y in t | not(arg1_bef_arg2(y,x))))))
END wellfounded_recursive_fcn;
--
ENTER_THEORY wellfounded_recursive_fcn
--
--
-- We begin by importing a theorem of the theory well_founded_set into the present theory.
--
	APPLY(Minrel1_thryvar:Minrel3_thryvar,ordenm_thryvar:orden,ord_thryvar:o1)
			well_founded_set(s->s,arg1_bef_arg2(x,y)->arg1_bef_arg2(x,y)) ==>
Theorem wellfounded_recursive_fcn.100: (FORALL u, v | (Ord(u) & Ord(v) & (orden(u) /= s) &
				arg1_bef_arg2(orden(u),orden(v))) imp (u in v)) &
		(EXISTS o in next(#pow(s)) | (Ord(o) & (s = {orden(x): x in o}) &
			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o})))
--
-- To draw the conclusion seen a bit below we must simplify the quantifier which appears in the preceding statement.
--
Theorem wellfounded_recursive_fcn.100a: (EXISTS o | (Ord(o) & (s = {orden(x): x in o}) &
			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o}))). Proof:
	Suppose_not ==> Stat1: not (EXISTS o | (Ord(o) & (s = {orden(x): x in o}) &
			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o})))
	Twellfounded_recursive_fcn.100 ==> Stat2: (EXISTS o in next(#pow(s)) | (Ord(o) & (s = {orden(x): x in o}) &
			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o})))
	o-->Stat2 ==> Ord(o) & (s = {orden(x): x in o}) &
			(FORALL x in o | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o})
	o-->Stat1 ==> false; Discharge ==> QED
--
-- We can now introduce a specific constant o by Skolemizing the existential statement seen just above.
--
APPLY(v1_thryvar:o2) Skolem() ==>
Theorem wellfounded_recursive_fcn.101: (Ord(o2) & (s = {orden(x): x in o2}) &
			(FORALL x in o2 | (orden(x) /= s)) & one_1_map({[x,orden(x)]: x in o2}))
--
-- We also introduce an indexing function which will turn out to be the inverse of this
-- one-to-one mapping and to assign consecutive ordinals to the elements of $s$.
--
Def 00r: [Ordinal index defined by the standard enumeration of sets] index(X) := arb({j: j in o2 | orden(j) = X})
--
-- The desired function $h$ is not directly definable by a recursive rule based on the well-founded relation.
-- On the other hand, we can define an auxiliary function $hh$ by means of a recursive rule based
-- on membership; and then define $h$ in terms of $hh$ and the indexing function.
--
Def 00s: [?] hh(X,T) := f3({g4(hh(j,T),orden(j),orden(X),T): j in X | arg1_bef_arg2(orden(j),orden(X)) &
								 P4(hh(j,T),orden(j),orden(X),T)}, orden(X), T)
--
Def 00t: [?] wfh2_thryvar(V,T) := hh(index(V), T)
--
-- We first prove that the 'index' function defined above assigns an ordinal preceding $o2$ to every
-- element of $s$ and is a partial inverse of the enumerator $orden$.
--
Theorem wellfounded_recursive_fcn.1: (V in s) imp ((index(V) in o2) & Ord(index(V)) & (orden(index(V)) = V)). Proof:
    Suppose_not(v) ==> (v in s) & ((index(v) notin o2) or (not Ord(index(v))) or (orden(index(v)) /= v))
--
-- For if $v$ is a counterexample to our theorem, it must be the image under the
-- $orden$ of some element $x in o2$. hence the set ${j: j in o2 | orden(j) = v}$ cannot
-- be empty, and so the index of $v$ must belong to this set.
--
	Twellfounded_recursive_fcn.101 ==> Ord(o2) & (s = {orden(x): x in o2})
	EQUAL ==> Stat1: v in {orden(x): x in o2}
	x-->Stat1 ==> (v = orden(x)) & (x in o2)
	Suppose ==> Stat2: {j: j in o2 | orden(j) = v} = 0
	x-->Stat2 ==> false; Discharge ==> arb({j: j in o2 | orden(j) = v}) in {j: j in o2 | orden(j) = v}
	Use_def(index) ==> Stat3: index(v) in {j: j in o2 | orden(j) = v}
--
-- $index(v)$ must therefore be an element $j$ of $o2$ whose image under $orden$ is $v$.
-- By our initial assumption this implies, that it cannot be an ordinal. Since $o2$ is an ordinal,
-- so that its elements are also ordinals, this leads to an immediate ontradiction.
--
    j-->Stat3 ==> Stat4: (index(v) = j) & (j in o2) & (orden(j) = v)
    EQUAL ==> orden(index(v)) = v
    (o2,index(v))-->T12 ==> false; Discharge ==> QED
--
-- Next we prove that for every element $v$ of the set $s$ of the well-founded relation is defined, the subset
-- ${j: j in index(v) | arg1_bef_arg2(orden(j),v)}$ can be written as ${index(w): w in s | arg1_bef_arg2(w,v)}$.
--
Theorem wellfounded_recursive_fcn.2: (V in s) imp ({j: j in index(V) | arg1_bef_arg2(orden(j),V)} = {index(w): w in s | arg1_bef_arg2(w,V)}). Proof:
    Suppose_not(v) ==> (v in s) & Stat1: ({j: j in index(v) | arg1_bef_arg2(orden(j),v)} /= {index(w): w in s | arg1_bef_arg2(w,v)})
-- Suppose that $v$ is a counterexample $v$ to our assertion, and let $c$ be an element which belongs to one of
-- these two sets but not the other.
-- If $c$ belongs to ${index(w): w in s | arg1_bef_arg2(w,v)}$, then $c$ is the index of
-- some $w in s$, in which case the preceding Theorem tells us that
-- $v$ and $w$ have indices which are ordinals whose images under the enumerator
-- $enum$ are $v$ and $w$ respectively. Theorem wellfounded_recursive_fcn.100 then tells us that the index of $w$
-- precedes that of $v$ in the standard ordering of ordinals, which leads easily to a contradiction also
-- in this case.
--
	v-->Twellfounded_recursive_fcn.1 ==> (index(v) in o2) & Ord(index(v)) & (orden(index(v)) = v)
	c-->Stat1 ==> (c in {j: j in index(v) | arg1_bef_arg2(orden(j),v)}) eq (c notin {index(w): w in s | arg1_bef_arg2(w,v)})
	Suppose ==> Stat2: (c in {index(w): w in s | arg1_bef_arg2(w,v)}) & (c notin {j: j in index(v) | arg1_bef_arg2(orden(j),v)})
	(w,index(w))-->Stat2 ==> (c = index(w)) & (w in s) & arg1_bef_arg2(w,v) & ((index(w) notin index(v)) or (not arg1_bef_arg2(orden(index(w)),v)))
	w-->Twellfounded_recursive_fcn.1 ==> Ord(index(w)) & (orden(index(w)) = w)
	EQUAL ==> arg1_bef_arg2(orden(index(w)),v) & arg1_bef_arg2(orden(index(w)),orden(index(v)))
	Twellfounded_recursive_fcn.100 ==> Stat3: (FORALL u, v | (Ord(u) & Ord(v) & (orden(u) /= s) &
				arg1_bef_arg2(orden(u),orden(v))) imp (u in v))
	(index(w),index(v))-->Stat3 ==> false;
	Discharge ==> Stat4: (c in {j: j in index(v) | arg1_bef_arg2(orden(j),v)}) & (c notin {index(w): w in s | arg1_bef_arg2(w,v)})
--
-- Hence $c$ must belong to ${j: j in index(v) | arg1_bef_arg2(orden(j),v)}$;
-- and thus $orden(c)$ must precede $v$ in our well-founded relation. Moreover, it is readily
-- seen that $c$ belongs to $o2$ and that $orden(c) in s$.
--
	(j,orden(c))-->Stat4 ==> (c=j) & (c in index(v)) & arg1_bef_arg2(orden(j),v) &
		((c /= index(orden(c))) or (orden(c) notin s) or (not arg1_bef_arg2(orden(c),v)))
	EQUAL ==> arg1_bef_arg2(orden(c),v)
	Twellfounded_recursive_fcn.101 ==> Ord(o2) & (s = {orden(x): x in o2}) & one_1_map({[x,orden(x)]: x in o2})
	(o2,index(v))-->T13 ==> c in o2
	Suppose ==> orden(c) notin s
	EQUAL ==> Stat5: orden(c) notin {orden(x): x in o2}
	c-->Stat5 ==> false; Discharge ==> (orden(c) in s) & (c /= index(orden(c)))
--
-- Using Theorem wellfounded_recursive_fcn.1 again, we find that the index $i$ of $orden(c)$
-- belongs to $o2$ and has $orden(i)=orden(c)$. Since $orden$ is one-to-one over $s$, we get
-- a contradiction in this case too, proving our theorem.
--
	(orden(c))-->Twellfounded_recursive_fcn.1 ==> (index(orden(c)) in o2) & (orden(index(orden(c))) = orden(c))
	Suppose ==> Stat6: [c,orden(c)] notin {[x,orden(x)]: x in o2}
	c-->Stat6 ==> false; Discharge ==> [c,orden(c)] in {[x,orden(x)]: x in o2}
	Suppose ==> Stat7: [index(orden(c)),orden(index(orden(c)))] notin {[x,orden(x)]: x in o2}
	(index(orden(c)))-->Stat7 ==> false; Discharge ==> [index(orden(c)),orden(index(orden(c)))] in {[x,orden(x)]: x in o2}
	Use_def(one_1_map) ==> Stat8: (FORALL x in {[x,orden(x)]: x in o2}, y in {[x,orden(x)]: x in o2} | (cdr(x) = cdr(y)) imp (x = y))
    ([index(orden(c)),orden(index(orden(c)))],[c,orden(c)])-->Stat8 ==> false; Discharge ==> QED
--
-- Now we show that the function $h$, although defined indirectly in the manner seen above,
-- nevertheless satisfies the recursive relationship that we have defined.
--
--
Theorem wellfounded_recursive_fcn.3: (X in s) imp (wfh2_thryvar(X,T) = f3({g4(wfh2_thryvar(y,T),y,X,T): y in s | arg1_bef_arg2(y,X) & P4(wfh2_thryvar(y,T),y,X,T)},X,T)). Proof:
    Suppose_not(v,t) ==> (v in s) & (wfh2_thryvar(v,t) /= f3({g4(wfh2_thryvar(y,t),y,v,t): y in s | arg1_bef_arg2(y,v) & P4(wfh2_thryvar(y,t),y,v,t)},v,t))
--
-- For suppose that some $v$ in the domain $s$ of the well_founded relation
-- $h$ fails to satisfy this recursion. Expand the definition of $h$
-- and then simplify the resulting expression, using Theorems wellfounded_recursive_fcn.1 and 2 in the following way to derive a contradiction.
--
	Use_def(wfh2_thryvar) ==> wfh2_thryvar(v,t) = hh(index(v), t)
	Use_def(hh) ==> hh(index(v), t) = f3({g4(hh(j,t),orden(j),orden(index(v)),t): j in index(v) | arg1_bef_arg2(orden(j),orden(index(v))) & P4(hh(j,t),orden(j),orden(index(v)),t)}, orden(index(v)), t)
	v-->Twellfounded_recursive_fcn.1 ==> orden(index(v)) = v
	EQUAL ==> wfh2_thryvar(v, t) = f3({g4(hh(j,t),orden(j),v,t): j in index(v) | arg1_bef_arg2(orden(j),v) & P4(hh(j,t),orden(j),v,t)}, v, t)
	Suppose ==> {g4(hh(j,t),orden(j),v,t): j in index(v) | arg1_bef_arg2(orden(j),v) & P4(hh(j,t),orden(j),v,t)} /=
		{g4(hh(j,t),orden(j),v,t): j in {j: j in index(v) | arg1_bef_arg2(orden(j),v)} | P4(hh(j,t),orden(j),v,t)}
	SIMPLF ==> false;  Discharge ==> {g4(hh(j,t),orden(j),v,t): j in index(v) | arg1_bef_arg2(orden(j),v) & P4(hh(j,t),orden(j),v,t)} =
		{g4(hh(j,t),orden(j),v,t): j in {j: j in index(v) | arg1_bef_arg2(orden(j),v)} | P4(hh(j,t),orden(j),v,t)}
	v-->Twellfounded_recursive_fcn.2 ==> {j: j in index(v) | arg1_bef_arg2(orden(j),v)} = {index(y): y in s | arg1_bef_arg2(y,v)}
	EQUAL ==> {g4(hh(j,t),orden(j),v,t): j in {j: j in index(v) | arg1_bef_arg2(orden(j),v)} | P4(hh(j,t),orden(j),v,t)} =
		{g4(hh(j,t),orden(j),v,t): j in {index(y): y in s | arg1_bef_arg2(y,v)} | P4(hh(j,t),orden(j),v,t)}
	SIMPLF ==> {g4(hh(j,t),orden(j),v,t): j in {index(y): y in s | arg1_bef_arg2(y,v)} | P4(hh(j,t),orden(j),v,t)} =
		{g4(hh(index(y),t),orden(index(y)),v,t): y in s | arg1_bef_arg2(y,v) & P4(hh(index(y),t),orden(index(y)),v,t)}
	Suppose ==> Stat1: {g4(hh(index(y),t),orden(index(y)),v,t): y in s | arg1_bef_arg2(y,v) & P4(hh(index(y),t),orden(index(y)),v,t)} /=
		{g4(wfh2_thryvar(y,t),y,v,t): y in s | arg1_bef_arg2(y,v) & P4(wfh2_thryvar(y,t),y,v,t)}
	    w-->Stat1 ==> (w in s) &  ((g4(hh(index(w),t),orden(index(w)),v,t) /= g4(wfh2_thryvar(w,t),w,v,t)) or not(P4(hh(index(w),t),orden(index(w)),v,t)) eq P4(wfh2_thryvar(w,t),w,v,t))
	    Use_def(wfh2_thryvar) ==> wfh2_thryvar(w,t) = hh(index(w), t)
	    w-->Twellfounded_recursive_fcn.1 ==> orden(index(w)) = w
	EQUAL ==> false; Discharge ==> {g4(hh(index(y),t),orden(index(y)),v,t): y in s | arg1_bef_arg2(y,v) & P4(hh(index(y),t),orden(index(y)),v,t)} =
		{g4(wfh2_thryvar(y,t),y,v,t): y in s | arg1_bef_arg2(y,v) & P4(wfh2_thryvar(y,t),y,v,t)}
	EQUAL ==> wfh2_thryvar(v, t) = f3({g4(wfh2_thryvar(y,t),y,v,t): y in s | arg1_bef_arg2(y,v) & P4(wfh2_thryvar(y,t),y,v,t)}, v, t)
    Discharge ==> QED
--
APPLY(wfh2_thryvar:rk_thryvar) wellfounded_recursive_fcn(s->s,arg1_bef_arg2(y,x)->arg1_bef_arg2(y,x),f3(b,x,t)->Un(b),g4(a,y,x,t)->next(a),P4(a,y,x,t)->([y,x] in t)) ==>
	Theorem wellfounded_recursive_fcn.4: (FORALL x, t | (x in s) imp (rk_thryvar(x,t) = Un({next(rk_thryvar(y,t)): y in s | arg1_bef_arg2(y,x) & ([y,x] in t)})))
--
ENTER_THEORY Set_theory
--
-- The theory just derived can be summarized as follows.
--
--DISPLAY wellfounded_recursive_fcn
--
--THEORY wellfounded_recursive_fcn(s,arg1_bef_arg2(y,x),f3(b,x,t),g4(a,y,x,t),P4(a,y,x,t))
--	(FORALL t incin s | ((t /= 0) imp (EXISTS x in t | (FORALL y in t | not(arg1_bef_arg2(y,x))))))
--==>(wfh2_thryvar,rk_thryvar)
--	(FORALL x, t | (x in s) imp (wfh2_thryvar(x,t) = f3({g4(wfh2_thryvar(y,t),y,x,t): y in s | arg1_bef_arg2(y,x) & P4(wfh2_thryvar(y,t),y,x,t)},x,t)))
--	(FORALL x, t | (x in s) imp (rk_thryvar(x,t) = Un({next(rk_thryvar(y,t)): y in s | arg1_bef_arg2(y,x) & ([y,x] in t)})))
--END wellfounded_recursive_fcn;
--
-- The following theorem states that inclusion is a well-founded relation on each
-- family of finite sets.
--
Theorem 411: [well-foundedness of inclusion between finite sets] ((FORALL v in X | Finite(v)) & (U incin X) & (U /= 0)) imp
		(EXISTS w in U | (FORALL y in U | not((y incin w) & (y /= w)))). Proof:
    Suppose_not(x,u) ==> Stat1: (u incin x) & (u /= 0) &
		Stat2: (not(EXISTS w in u | (FORALL y in u | not((y incin w) & (y /= w))))) &
		Stat3: (FORALL v in x | Finite(v))
--
-- For, assuming the contrary, there must exist a finite non-null set $u$ none of
-- whose elements is inclusion minimal. Apply the theory of finite induction to $arb(u)$,
-- thereby obtaining a set $m$ having strict subset $k$ belonging to $u$ but which is such that no
-- strict subset of any such k belongs to $u$. Consideration of $m$ and such a $k$
-- leads immediatiately to a contradiction which proves our theorem.
--
    Suppose ==> Stat4: not(EXISTS y in u | (y incin arb(u)) & (y /= arb(u)))
        (arb(u),y0)-->Stat2 ==> Stat5: not(FORALL y in u | not((y incin arb(u)) & (y /= arb(u))))
	    y0-->Stat5 ==> (y0 in u) & (y0 incin arb(u)) & (y0 /= arb(u))
	y0-->Stat4 ==> false; Discharge ==> (EXISTS y in u | (y incin arb(u)) & (y /= arb(u)))
	(arb(u))-->Stat3 ==> Finite(arb(u))
	APPLY(m1_thryvar:m) finite_induction(n->arb(u), P(x)->(EXISTS y in u | (y incin x) & (y /= x))) ==>
		Stat6: (EXISTS y in u | (y incin m) & (y /= m)) &
			Stat7: (FORALL k incin m | (k /= m) imp (not(EXISTS y in u | (y incin k) & (y /= k))))
	k-->Stat6 ==> Stat8: (k in u) & (k incin m) & (k /= m)
	k-->Stat7 ==> Stat9: not(EXISTS y in u | (y incin k) & (y /= k))
    k-->Stat2 ==> Stat10: not(FORALL y in u | not((y incin k) & (y /= k)))
    y1-->Stat10 ==> (y1 in u) & (y1 incin k) & (y1 /= k)
    y1-->Stat9 ==> false; Discharge ==> QED
--
-- Our main aim in the theorems which now follow is to prove that every one of a wide class of recursions
-- specifies a function  defined everywhere over the integers, or more generally
-- over various families of finite sets. As a first step in this direction,
-- we consider a pair of functions $h_q$ and $h_r$, both of which satisfy the same recursive
-- relationship on their domains $d$, which are assumed to be such that every subset of a member of
-- of $d$ is finite and belongs to $d$. (For example, $d$ might be ${x: x incin s | Finite(x)}$).
-- We show that $h_q$ and $h_r$ necessarily agree on the intersection of their domains,
-- and so have a common single-valued extension.
--
THEORY finite_recursion_coherence(q,r,h_q(x,t),h_r(x,t),f3(b,x,t),g4(a,y,x,t),P4(a,y,x,t))
	(FORALL x in q, y incin x | Finite(x) & (y in q))
	(FORALL x in r, y incin x | Finite(x) & (y in r))
	(FORALL x in q, t | h_q(x,t) = f3({g4(h_q(y,t),y,x,t): y in q | (y incin x) & (y /= x) & P4(h_q(y,t),y,x,t)},x,t))
	(FORALL x in r, t | h_r(x,t) = f3({g4(h_r(y,t),y,x,t): y in r | (y incin x) & (y /= x) & P4(h_r(y,t),y,x,t)},x,t))
END finite_recursion_coherence;

ENTER_THEORY finite_recursion_coherence

Theorem finite_recursion_coherence.1: ((X in q) & (X in r)) imp (h_q(X,T) = h_r(X,T)). Proof:
    Suppose_not(x,t) ==> (x in q) & (x in r) & (h_q(x,t) /= h_r(x,t))
--
-- For suppose that $m$, $q$, $r$, and $t$ form a counterexample to our assertion, where by the principle of finite
-- induction we can assume that no proper subset of $m$ is also a counterexample.
--
	Assump ==> Stat1: (FORALL x in q, y incin x | Finite(x) & (y in q))
	(x,x)-->Stat1 ==> Finite(x)
	APPLY(m1_thryvar:m) finite_induction(n->x, P(v)->(h_q(v,t) /= h_r(v,t))) ==>
		(m incin x) & (h_q(m,t) /= h_r(m,t)) & Stat2: (FORALL k incin m | ((k /= m) imp (not (h_q(k,t) /= h_r(k,t)))))
	(x,m)-->Stat1 ==> m in q
	Assump ==> Stat3: (FORALL x in r, y incin x | Finite(x) & (y in r))
	(x,m)-->Stat3 ==> m in r
--
-- Since $h_q(m,t)$ and $h_r(m,t)$ difer, the recursive expressions for these quantities must also differ,
-- and so there must exist a $c$ belonging to one, but not the other, of of the two sets displayed below.
--
	Assump ==> Stat4: (FORALL x in q, t | h_q(x,t) = f3({g4(h_q(y,t),y,x,t): y in q | (y incin x) & (y /= x) & P4(h_q(y,t),y,x,t)},x,t))
	(m,t)-->Stat4 ==> h_q(m,t) = f3({g4(h_q(y,t),y,m,t): y in q | (y incin m) & (y /= m) & P4(h_q(y,t),y,m,t)},m,t)
	Assump ==> Stat5: (FORALL x in r, t | h_r(x,t) = f3({g4(h_r(y,t),y,x,t): y in r | (y incin x) & (y /= x) & P4(h_r(y,t),y,x,t)},x,t))
	(m,t)-->Stat5 ==> h_r(m,t) = f3({g4(h_r(y,t),y,m,t): y in r | (y incin m) & (y /= m) & P4(h_r(y,t),y,m,t)},m,t)
	EQUAL ==> f3({g4(h_q(y,t),y,m,t): y in q | (y incin m) & (y /= m) &
					P4(h_q(y,t),y,m,t)},m,t) /= f3({g4(h_r(y,t),y,m,t): y in r | (y incin m) & (y /= m) & P4(h_r(y,t),y,m,t)},m,t)
	Suppose ==> {g4(h_q(y,t),y,m,t): y in q | (y incin m) & (y /= m) & P4(h_q(y,t),y,m,t)} =
		{g4(h_r(y,t),y,m,t): y in r | (y incin m) & (y /= m) & P4(h_r(y,t),y,m,t)}
	EQUAL ==> false; Discharge ==> Stat6: {g4(h_q(y,t),y,m,t): y in q | (y incin m) & (y /= m) & P4(h_q(y,t),y,m,t)} /=
		{g4(h_r(y,t),y,m,t): y in r | (y incin m) & (y /= m) & P4(h_r(y,t),y,m,t)}
	c-->Stat6 ==> (c in {g4(h_q(y,t),y,m,t): y in q | (y incin m) & (y /= m) & P4(h_q(y,t),y,m,t)}) eq
				(c notin {g4(h_r(y,t),y,m,t): y in r | (y incin m) & (y /= m) & P4(h_r(y,t),y,m,t)})
--
-- Suppose that $c$ belongs to the first, but not the second, of these sets. Then $m$ must have a proper subset $k$
-- for which $h_q(k,t)$ and $h_q(k,t)$ differ, which is impossible by the minimality of $m$
--
	Suppose ==> Stat7: (c in {g4(h_q(y,t),y,m,t): y in q | (y incin m) & (y /= m) & P4(h_q(y,t),y,m,t)}) &
		(c notin {g4(h_r(y,t),y,m,t): y in r | (y incin m) & (y /= m) & P4(h_r(y,t),y,m,t)})
	(k,k)-->Stat7 ==> (k in q) & (k incin m) & (k /= m) & P4(h_q(k,t),k,m,t) &
							((g4(h_q(k,t),k,m,t) /= g4(h_r(k,t),k,m,t)) or (k notin r) or (not(P4(h_r(k,t),k,m,t))))
	(m,k)-->Stat3 ==> k in r
	k-->Stat2 ==> h_q(k,t) = h_r(k,t)
	EQUAL ==> (g4(h_q(k,t),k,m,t) = g4(h_r(k,t),k,m,t)) & P4(h_r(k,t),k,m,t)
	Discharge ==> Stat8: (c in {g4(h_r(y,t),y,m,t): y in r | (y incin m) & (y /= m) & P4(h_r(y,t),y,m,t)}) &
		(c notin {g4(h_q(y,t),y,m,t): y in q | (y incin m) & (y /= m) & P4(h_q(y,t),y,m,t)})
--
-- But exactly the same argument applies if $c$ belongs to the second, but not the first, of these sets,
-- and so our theorem is proved.
--
	(kp,kp)-->Stat8 ==> Stat9: (kp in r) & (kp incin m) & (kp /= m) & P4(h_r(kp,t),kp,m,t) &
		((g4(h_r(kp,t),kp,m,t) /= g4(h_q(kp,t),kp,m,t)) or (kp notin q) or (not(P4(h_q(kp,t),kp,m,t))))
	(m,kp)-->Stat1 ==> kp in q
	kp-->Stat2 ==> h_q(kp,t) = h_r(kp,t)
	EQUAL ==> (g4(h_q(kp,t),kp,m,t) = g4(h_r(kp,t),kp,m,t)) & P4(h_q(kp,t),kp,m,t)
    (Stat9)Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The theory just established can be summarized as follows.
--
--DISPLAY finite_recursion_coherence
--
--THEORY finite_recursion_coherence(q,r,h_q(x,t),h_r(x,t),f3(b,x,t),g4(a,y,x,t),P4(a,y,x,t))
--	(FORALL x in q, y incin x | Finite(x) & (y in q))
--	(FORALL x in r, y incin x | Finite(x) & (y in r))
--	(FORALL x in q, t | h_q(x,t) = f3({g4(h_q(y,t),y,x,t): y in q | (y incin x) & (y /= x) & P4(h_q(y,t),y,x,t)},x,t))
--	(FORALL x in r, t | h_r(x,t) = f3({g4(h_r(y,t),y,x,t): y in r | (y incin x) & (y /= x) & P4(h_r(y,t),y,x,t)},x,t))
--==>
--	(FORALL x, t | ((x in q) & (x in r)) imp (h_q(x,t) = h_r(x,t)))
--END finite_recursion_coherence;
--
-- In further preparation for the theory of recursive function defined over finite sets,
-- we show that any relation devoid of cycles, when restricted to a finite set, turns
-- out to be well-founded over such domain. To make matters simple (since defining acyclic
-- relations would be a relatively complicated matter, we assume the relation to be
-- transitive (this covers, for example, the significant case of strict inclusion).
--
THEORY fin_well_founded(s,arg1_bef_arg2(y,x))
    (FORALL x,y,wz | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,wz)) imp arg1_bef_arg2(x,wz))
    (FORALL x | not(arg1_bef_arg2(x,x)))
    Finite(s)
END fin_well_founded;
--
ENTER_THEORY fin_well_founded
--
Theorem fin_well_founded.1: ((V incin s) & (V /= 0)) imp (EXISTS m in V | (FORALL y in V | not(arg1_bef_arg2(y,m)))). Proof:
    Suppose_not(v) ==>  (v incin s) & (v /= 0) & (not(EXISTS m in v | (FORALL y in v | not(arg1_bef_arg2(y,m)))))
--
-- Assuming by contradiction that the relation $arg1_bef_arg2$ is not well-founded on the finite set $s$,
-- there would be a non-null subset $v$ of $s$ which has no minimal element. By application of the
-- THEORY finite_induction, we can choose a smallest subset $w$ of $s$ which has no minimal element.
--
        Assump ==> Finite(s)
        Assump ==> Stat1: (FORALL x | not(arg1_bef_arg2(x,x)))
        (s,v)-->T189 ==> Finite(v)
        APPLY(m1_thryvar:w) finite_induction(n->v,P(x)->((x /= 0) & (not(EXISTS m in x | (FORALL y in x | not(arg1_bef_arg2(y,m))))))) ==>
	      (w incin v) & (w /= 0) & Stat2: (not(EXISTS m in w | (FORALL y in w | not(arg1_bef_arg2(y,m))))) &
	  Stat3: (FORALL k incin w | (k /= w) imp (not((k /= 0) & (not(EXISTS m in k | (FORALL y in k | not(arg1_bef_arg2(y,m))))))))
        (arb(w))-->Stat1 ==> (not(arg1_bef_arg2(arb(w),arb(w))))
--
-- Clearly, $w$ cannot be a singleton (else $arb(w)$ would be its minimum). We can hence
-- find a minimal element $m$ in $w - {arb(w)}$.
--
        Suppose ==> w = {arb(w)}
            (arb(w))-->Stat2 ==> Stat4: (not(FORALL y in w | not(arg1_bef_arg2(y,arb(w)))))
            y-->Stat4 ==> (y in w) & arg1_bef_arg2(y,arb(w))
            ELEM ==> y = arb(w)
        EQUAL ==> false; Discharge ==> ((w - {arb(w)}) incin w) & (w - {arb(w)} /= w) & (w - {arb(w)} /= 0)
        (w - {arb(w)})-->Stat3 ==> Stat5: (EXISTS m in (w - {arb(w)}) | (FORALL y in (w - {arb(w)}) | not(arg1_bef_arg2(y,m))))
        m-->Stat5 ==> (m in (w - {arb(w)})) & (m in (w - {arb(w)})) & Stat6: (FORALL y in (w - {arb(w)}) | not(arg1_bef_arg2(y,m)))
        m-->Stat2 ==> Stat7: (not(FORALL y in w | not(arg1_bef_arg2(y,m))))
--
-- If $arb(w)$ did not precede $m$ in the relation $arg1_bef_arg2$, then it would
-- readily follow that $m$ would  be minimal in $w$; to avoid this contradiction,
-- we must assume that $arb(w)$ precedes $m$.
--
        Suppose ==> (not(arg1_bef_arg2(arb(w),m)))
            yp-->Stat7 ==> (yp in w) & arg1_bef_arg2(yp,m)
            Suppose ==> yp = arb(w)
            EQUAL ==> false; Discharge ==> yp /= arb(w)
        yp-->Stat6 ==> false; Discharge ==> arg1_bef_arg2(arb(w),m)
--
-- Then $x$ cannot precede $arb(w)$ in the relation $arg1_bef_arg2$, for any $w in w$
-- (else we would have $x /= arb(w)$ and $x$ before $m$ in the relation $arg1_bef_arg2$).
-- Consequently, $arb(w)$ is a minimal element of $w$; this new contradiction enables us to
-- conclude with the desired statement.
--
        (arb(w))-->Stat2 ==> Stat8: (not(FORALL y in w | not(arg1_bef_arg2(y,arb(w)))))
        yq-->Stat8 ==> (yq in w) & arg1_bef_arg2(yq,arb(w))
        Assump ==> Stat9: (FORALL x, y, wz | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,wz)) imp arg1_bef_arg2(x,wz))
        (yq,arb(w),m)-->Stat9 ==> arg1_bef_arg2(yq,m)
        Suppose ==> arb(w) = yq
        EQUAL ==> false; Discharge ==> yq in (w - {arb(w)})
    yq-->Stat6 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- The theory just established can be summarized as follows.
--
--DISPLAY fin_well_founded
--
--THEORY fin_well_founded(s,arg1_bef_arg2(x,y))
--    (FORALL x,y,z | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) imp arg1_bef_arg2(x,z))
--    (FORALL x | not(arg1_bef_arg2(x,x)))
--    Finite(s)
--==>
--    ((V incin s) & (V /= 0)) imp (EXISTS m in V | (FORALL x in V | not(arg1_bef_arg2(x,m))))
--END fin_well_founded;
--
--
-- Our next aim is to prove that any recursion which determines a value $h2(s,t)$ dependent on two parameters,
-- the first of these being a finite set, in terms of the values $h2(sp,t)$ for which $sp$ is a proper subset of $s$,
-- actually defines a function $h2(s,t)$ single-valued for all finite $s$ and all $t$. We state this result by defining
-- an auxiliary theory whose first theorem, seen just below, has a form allowing immediate Skolemization.
-- By Skolemizing this we will derive a second result in the convenient form desired.
--
THEORY finite_recursive_fcn(f3(b,x,t),g4(a,y,x,t),P4(a,y,x,t))
END finite_recursive_fcn;
--
--
ENTER_THEORY finite_recursive_fcn
--
-- We now show that the finite subsets of any set $s$ are well-ordered by strict inclusion.
--
Theorem finite_recursive_fcn.0: ((T incin {y: y incin S | Finite(y)}) & (T /= 0)) imp (EXISTS x in T | (FORALL y in T | not((y incin x) & (y /= x)))). Proof:
--
-- As a matter of fact, if we consider any non-null subset $t$ of the
-- family of all finite subsets of $s$, and then take an element $r$ of $t$,
-- then the set $mm$ of all minorants of $r$ in $t$ turns out to be finite
-- (inasmuch as a subset of $pow(r)$, which is finite). Hence it will have an
-- inclusion-minimal element $m$, which will also be minimal in $t$.
--
    Suppose_not(t,s) ==> Stat1: (t /= 0) & (t incin {y: y incin s | Finite(y)}) & Stat2: (not(EXISTS x in t | (FORALL y in t | not((y incin x) & (y /= x)))))
        r-->Stat1 ==> (r in t) & Stat3: (r in {y: y incin s | Finite(y)})
        a-->Stat3 ==> (r = a) & Finite(a)
        EQUAL ==> Finite(r)
        Loc_def ==> mm = {y: y in t | (y incin r) & (y /= r)}
        Suppose ==> Stat4: (not(mm incin pow(r)))
            c-->Stat4 ==> (c in mm) & (c notin pow(r))
            Use_def(pow) ==> Stat5: ((c in {y: y in t | (y incin r) & (y /= r)}) & (c notin {x: x incin r}))
        (yp,yp)-->Stat5 ==> false; Discharge ==> mm incin pow(r)
        r-->T264 ==> Finite(pow(r))
        (pow(r),mm)-->T189 ==> Finite(mm)
        r-->T264 ==> Finite(pow(r))
        (pow(r),mm)-->T189 ==> Finite(mm)
        Suppose ==> Stat6: ({y: y in t | (y incin r) & (y /= r)} = 0)
            r-->Stat2 ==> Stat7: (not(FORALL y in t | not((y incin r) & (y /= r))))
            y-->Stat7 ==> (y in t) & (y incin r) & (y /= r)
        y-->Stat6 ==> false; Discharge ==> mm /= 0
        Suppose ==> Stat8: (not(FORALL x | not((x incin x) & (x /= x))))
        xp-->Stat8 ==> false; Discharge ==> (FORALL x | not((x incin x) & (x /= x)))
        Suppose ==> Stat9: (not(FORALL xx,yy,wz | (((xx incin yy) & (xx /= yy)) & ((yy incin wz) & (yy /= wz))) imp ((xx incin wz) & (xx /= wz))))
        (xx,yy,wz)-->Stat9(*) ==> false; Discharge ==> (FORALL xx,yy,wz | (((xx incin yy) & (xx /= yy)) & ((yy incin wz) & (yy /= wz))) imp ((xx incin wz) & (xx /= wz)))
        APPLY() fin_well_founded(s->(pow(r)),arg1_bef_arg2(y,x)->((y incin x) & (y /= x))) ==>
		Stat10: (FORALL v | ((v incin pow(r)) & (v /= 0)) imp (EXISTS m in v | (FORALL x in v | not((x incin m) & (x /= m)))))
        mm-->Stat10(Stat1*) ==> Stat11: (EXISTS m in mm | (FORALL x in mm | not((x incin m) & (x /= m))))
        m-->Stat11(Stat1*) ==> Stat12: (m in {y: y in t | (y incin r) & (y /= r)}) & Stat13: (FORALL x in mm | not((x incin m) & (x /= m)))
        yq-->Stat12(Stat1*) ==> (m in t) & (m incin r) & (m /= r)
        m-->Stat2(Stat1*) ==> Stat14: (not(FORALL y in t | not((y incin m) & (y /= m))))
        u-->Stat14(Stat1*) ==> (u in t) & (u incin m) & (u /= m)
        Suppose ==> Stat15: u notin {y: y in t | (y incin r) & (y /= r)}
        u-->Stat15(Stat1*) ==> false; Discharge ==> u in mm
    u-->Stat13(Stat1*) ==> false; Discharge ==> QED
--
Theorem finite_recursive_fcn.1: (FORALL s,t | (EXISTS h | (FORALL x | ((x incin s) & Finite(x)) imp
			(h~[x] = f3({g4(h~[y],y,x,t): y incin x | (y /= x) & P4(h~[y],y,x,t)},x,t))))). Proof:
    Suppose_not ==> Stat1: not (FORALL s,t | (EXISTS h | (FORALL x | ((x incin s) & Finite(x)) imp
			(h~[x] = f3({g4(h~[y],y,x,t): y incin x | (y /= x) & P4(h~[y],y,x,t)},x,t)))))
--
-- For if we let $s$, $t$ be a counterexample to our assertion and apply our wellfounded_recursive_fcn THEORY,
-- a contradiction results easily. Indeed, the wellfounded_recursive_fcn THEORY defined previously
-- gives us a function $hh$ satisfying the recursive relationship seen just below.
--
	    (s,t)-->Stat1 ==> Stat2: not (EXISTS h | (FORALL x | ((x incin s) & Finite(x)) imp
										(h~[x] = f3({g4(h~[y],y,x,t): y incin x | (y /= x) & P4(h~[y],y,x,t)},x,t))))
        Suppose ==> Stat3: (not(FORALL t | ((t incin {y: y incin s | Finite(y)}) & (t /= 0)) imp (EXISTS x in t | (FORALL y in t | not((y incin x) & (y /= x))))))
            d-->Stat3 ==> ((d incin {y: y incin s | Finite(y)}) & (d /= 0)) & (not(EXISTS x in d | (FORALL y in d | not((y incin x) & (y /= x)))))
        (d,s)-->Tfinite_recursive_fcn.0 ==> false; Discharge ==> (FORALL t | ((t incin {y: y incin s | Finite(y)}) & (t /= 0)) imp (EXISTS x in t | (FORALL y in t | not((y incin x) & (y /= x)))))
	    APPLY(wfh2_thryvar:hh) wellfounded_recursive_fcn(s->{y: y incin s | Finite(y)}, arg1_bef_arg2(y,x)->((y incin x) & (y /= x)), f3(b,x,t)->f3(b,x,t), g4(a,y,x,t)->g4(a,y,x,t), P4(a,y,x,t)->P4(a,y,x,t)) ==>
				Stat4: (FORALL x, t | (x in {y: y incin s | Finite(y)}) imp
					(hh(x,t) = f3({g4(hh(y,t),y,x,t): y in {y: y incin s | Finite(y)} | (y incin x) & (y /= x) & P4(hh(y,t),y,x,t)},x,t)))
--
-- But this recursive relationship can be rewritten in the simplified form seen in the following. For were this not the case,
-- the two sets seen below would necessarily differ.
--
        Suppose ==> Stat5: not (FORALL x, t | (x in {y: y incin s | Finite(y)}) imp
				(hh(x,t) = f3({g4(hh(y,t),y,x,t): y incin x | (y /= x) & P4(hh(y,t),y,x,t)},x,t)))
	        (xp,tp)-->Stat5 ==> Stat6: (xp in {y: y incin s | Finite(y)}) & (hh(xp,tp) /= f3({g4(hh(y,tp),y,xp,tp): y incin xp | (y /= xp) & P4(hh(y,tp),y,xp,tp)},xp,tp))
	        x-->Stat6 ==> (x=xp) & (xp incin s) & Finite(x)
            EQUAL ==> Finite(xp)
	        (x,t)-->Stat4 ==> hh(x,t) = f3({g4(hh(y,t),y,x,t): y in {y: y incin s | Finite(y)} | (y incin x) & (y /= x) & P4(hh(y,t),y,x,t)},x,t)
	        Suppose ==> {g4(hh(y,t),y,x,t): y incin x | (y /= x) & P4(hh(y,t),y,x,t)} =
					{g4(hh(y,t),y,x,t): y in {y: y incin s | Finite(y)} | (y incin x) & (y /= x) & P4(hh(y,t),y,x,t)}
	        EQUAL ==> false; Discharge ==> Stat7: {g4(hh(y,t),y,x,t): y incin x | (y /= x) & P4(hh(y,t),y,x,t)} /=
					{g4(hh(y,t),y,x,t): y in {y: y incin s | Finite(y)} | (y incin x) & (y /= x) & P4(hh(y,t),y,x,t)}
--
-- And it is easily seen that these two sets must be equal.
--
	        c-->Stat7 ==> (c in {g4(hh(y,t),y,x,t): y incin x | (y /= x) & P4(hh(y,t),y,x,t)}) eq
						(c notin {g4(hh(y,t),y,x,t): y in {y: y incin s | Finite(y)} | (y incin x) & (y /= x) & P4(hh(y,t),y,x,t)})
	        Suppose ==> Stat8: (c in {g4(hh(y,t),y,x,t): y incin x | (y /= x) & P4(hh(y,t),y,x,t)}) &
					Stat9: (c notin {g4(hh(y,t),y,x,t): y in {y: y incin s | Finite(y)} | (y incin x) & (y /= x) & P4(hh(y,t),y,x,t)})
	            y-->Stat8 ==> (c = g4(hh(y,t),y,x,t)) & (y incin x) & (y /= x) & P4(hh(y,t),y,x,t)
	            y-->Stat9 ==> Stat10: y notin {y: y incin s | Finite(y)}
                (x,y)-->T189 ==> Finite(y)
	        y-->Stat10 ==> false; Discharge ==> Stat11: (c notin {g4(hh(y,t),y,x,t): y incin x | (y /= x) & P4(hh(y,t),y,x,t)}) &
					Stat12: (c in {g4(hh(y,t),y,x,t): y in {y: y incin s  | Finite(y)} | (y incin x) & (y /= x) & P4(hh(y,t),y,x,t)})
                yp-->Stat12 ==> (c = g4(hh(yp,t),yp,x,t)) & (yp incin x) & (yp /= x) & P4(hh(yp,t),yp,x,t) & (yp in {y: y incin s  | Finite(y)})
        yp-->Stat11 ==> false; Discharge ==> Stat13: (FORALL x, t | (x in {y: y incin s | Finite(y)}) imp
				(hh(x,t) = f3({g4(hh(y,t),y,x,t): y incin x | (y /= x) & P4(hh(y,t),y,x,t)},x,t)))
--
-- Holding $t$ fixed, we can now view $hh(x,t)$ as a map $h2$ satisfying $h2~[x] = if x in {y: y incin s} then hh(x,t) else 0 end if$
-- for all $x$.
--
	    Loc_def ==> h2 = {[x,hh(x,t)]: x in {y: y incin s | Finite(y)}}
	    APPLY() fcn_symbol(f(x)->hh(x,t),g->h2,s->{y: y incin s | Finite(y)}) ==>
			Svm(h2) & Stat14: (FORALL x | h2~[x] = if x in {y: y incin s | Finite(y)} then hh(x,t) else 0 end if)
        SIMPLF ==> (h2 = {[x,hh(x,t)]: x incin s | Finite(x)})
--
-- But now $h2$ is easily seen to satify the recursive relationship seen below, and so can serve as the $h$ whose existence our theorem asserts.
--
        Suppose ==> Stat15: not(FORALL x | ((x incin s) & Finite(x)) imp
										(h2~[x] = f3({g4(h2~[y],y,x,t): y incin x | (y /= x) & P4(h2~[y],y,x,t)},x,t)))
            x2-->Stat15 ==> (x2 incin s) & Finite(x2) & (h2~[x2] /= f3({g4(h2~[y],y,x2,t): y incin x2 | (y /= x2) & P4(h2~[y],y,x2,t)},x2,t))
            x2-->Stat14 ==> h2~[x2] = if x2 in {y: y incin s | Finite(y)} then hh(x2,t) else 0 end if
            Suppose ==> Stat16: not (x2 in {y: y incin s | Finite(y)})
            x2-->Stat16 ==> false; Discharge ==> x2 in {y: y incin s | Finite(y)}
	        ELEM ==> h2~[x2] = hh(x2,t)
            (x2,t)-->Stat13 ==> hh(x2,t) = f3({g4(hh(y,t),y,x2,t): y incin x2 | (y /= x2) & P4(hh(y,t),y,x2,t)},x2,t)
            ELEM ==> f3({g4(h2~[y],y,x2,t): y incin x2 | (y /= x2) & P4(h2~[y],y,x2,t)},x2,t) /= f3({g4(hh(y,t),y,x2,t): y incin x2 | (y /= x2) & P4(hh(y,t),y,x2,t)},x2,t)
            Suppose ==> {g4(h2~[y],y,x2,t): y incin x2 | (y /= x2) & P4(h2~[y],y,x2,t)} = {g4(hh(y,t),y,x2,t): y incin x2 | (y /= x2) & P4(hh(y,t),y,x2,t)}
            EQUAL ==> false; Discharge ==> Stat17: {g4(h2~[y],y,x2,t): y incin x2 | (y /= x2) & P4(h2~[y],y,x2,t)} /= {g4(hh(y,t),y,x2,t): y incin x2 | (y /= x2) & P4(hh(y,t),y,x2,t)}
            dp-->Stat17 ==> (dp incin x2) & (g4(h2~[dp],dp,x2,t) /= g4(hh(dp,t),dp,x2,t) or ((dp /= x2) & P4(h2~[dp],dp,x2,t) & (not ((dp /= x2) & P4(hh(dp,t),dp,x2,t)))) or
					((not (((dp /= x2) & P4(h2~[dp],dp,x2,t)))) & (dp /= x2) & P4(hh(dp,t),dp,x2,t)))
            ELEM ==> g4(h2~[dp],dp,x2,t) /= g4(hh(dp,t),dp,x2,t) or (not (P4(hh(dp,t),dp,x2,t) eq P4(h2~[dp],dp,x2,t)))
	        Suppose ==> h2~[dp] = hh(dp,t)
	        EQUAL ==> false; Discharge ==> h2~[dp] /= hh(dp,t)
	        dp-->Stat14 ==> h2~[dp] = if dp in {y: y incin s | Finite(y)} then hh(dp,t) else 0 end if
	        Suppose ==> Stat18: dp notin {y: y incin s | Finite(y)}
                (x2,dp)-->T189 ==> Finite(dp)
            dp-->Stat18 ==> false; Discharge ==> dp in {y: y incin s | Finite(y)}
        Discharge ==> (FORALL x | ((x incin s) & Finite(x)) imp
										(h2~[x] = f3({g4(h2~[y],y,x,t): y incin x | (y /= x) & P4(h2~[y],y,x,t)},x,t)))
    h2-->Stat2 ==> false; Discharge ==> QED
--
--	We now define an auxiliary function $hsko(s,t)$ by Skolemizing the preceding theorem.
-- The formal definition is as follows.
--
APPLY(v1_thryvar:hsko) Skolem() ==>
    Theorem finite_recursive_fcn.a: (FORALL s,t | (FORALL x | ((x incin s) & Finite(x)) imp
			(hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y incin x | (y /= x) & P4(hsko(s,t)~[y],y,x,t)},x,t))))
--
-- The following theorem simply transforms the preceding into a more readily usable form.
--
Theorem finite_recursive_fcn.2: (FORALL x | ((x incin S) & Finite(x)) imp
			(hsko(S,T)~[x] = f3({g4(hsko(S,T)~[y],y,x,T): y incin x | (y /= x) & P4(hsko(S,T)~[y],y,x,T)},x,T))). Proof:
	Suppose_not(s,t) ==> not (FORALL x | ((x incin s) & Finite(x)) imp
			(hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y incin x | (y /= x) & P4(hsko(s,t)~[y],y,x,t)},x,t)))
	Tfinite_recursive_fcn.a ==> Stat1: (FORALL s,t | (FORALL x | ((x incin s) & Finite(x)) imp
			(hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y incin x | (y /= x) & P4(hsko(s,t)~[y],y,x,t)},x,t))))
	(s,t)-->Stat1 ==> false; Discharge ==> QED
--
-- The function $h_thryvar$ at which the present theory aims is defined as follows in terms of $hsko$.
--
Def finite_recursive_fcn.b: [?] rech2_thryvar(u,v) := hsko(u,v)~[u]
--
-- Our next theorem states the property of $h_thryvar$ at which we aim.
--
Theorem finite_recursive_fcn.3: Finite(S) imp (rech2_thryvar(S,T) = f3({g4(rech2_thryvar(y,T),y,S,T): y incin S | (y /= S) & P4(rech2_thryvar(y,T),y,S,T)},S,T)). Proof:
    Suppose_not(s,t) ==> Finite(s) & (rech2_thryvar(s,t) /= f3({g4(rech2_thryvar(y,t),y,s,t): y incin s | (y /= s) & P4(rech2_thryvar(y,t),y,s,t)},s,t))
--
--
--
	Use_def(rech2_thryvar) ==> hsko(s,t)~[s] /= f3({g4(hsko(y,t)~[y],y,s,t): y incin s | (y /= s) & P4(hsko(y,t)~[y],y,s,t)},s,t)
	Tfinite_recursive_fcn.2 ==> Stat1: (FORALL x | ((x incin s) & Finite(x)) imp
			(hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y incin x | (y /= x) & P4(hsko(s,t)~[y],y,x,t)},x,t)))
	s-->Stat1 ==> hsko(s,t)~[s] = f3({g4(hsko(s,t)~[y],y,s,t): y incin s | (y /= s) & P4(hsko(s,t)~[y],y,s,t)},s,t)
	Suppose ==> {g4(hsko(s,t)~[y],y,s,t): y incin s | (y /= s) & P4(hsko(s,t)~[y],y,s,t)} =
					{g4(hsko(y,t)~[y],y,s,t): y incin s | (y /= s) & P4(hsko(y,t)~[y],y,s,t)}
	EQUAL ==> false; Discharge ==> Stat2: {g4(hsko(s,t)~[y],y,s,t): y incin s | (y /= s) & P4(hsko(s,t)~[y],y,s,t)} /=
					{g4(hsko(y,t)~[y],y,s,t): y incin s | (y /= s) & P4(hsko(y,t)~[y],y,s,t)}
	c-->Stat2 ==> (c incin s) &  ((g4(hsko(s,t)~[c],c,s,t) /= g4(hsko(c,t)~[c],c,s,t)) or ((c /= s) & P4(hsko(s,t)~[c],c,s,t) & (not((c /= s) &
				P4(hsko(c,t)~[c],c,s,t)))) or
							 ((not ((c /= s) & P4(hsko(s,t)~[c],c,s,t))) & (c /= s) & P4(hsko(c,t)~[c],c,s,t)))
	(s,c)-->T189 ==> Finite(c)
	ELEM ==> ((g4(hsko(s,t)~[c],c,s,t) /= g4(hsko(c,t)~[c],c,s,t)) or (not (P4(hsko(s,t)~[c],c,s,t) eq P4(hsko(c,t)~[c],c,s,t))))
	Suppose ==> hsko(c,t)~[c] = hsko(s,t)~[c]
	EQUAL ==> false; Discharge ==> hsko(c,t)~[c] /= hsko(s,t)~[c]
--
-- Next we show that the pair $hsko(c,t)~[y]$ and $hsko(s,t)~[y]$ of functions have the four properties needed to allow
-- application of the finite_recursion_coherence THEORY derived above. This is done for each of the four necessary statements
-- in turn by showing that the opposite supposition leads to a contradiction.
--
	Suppose ==> Stat3: not (FORALL x in pow(c), y incin x | Finite(x) & (y in pow(c)))
	(a2,b2)-->Stat3 ==> (a2 in pow(c)) & (b2 incin a2) & ((not Finite(a2)) or (b2 notin pow(c)))
	Use_def(pow) ==> Stat4: (a2 in {x: x incin c})
	a2p-->Stat4 ==> a2 incin c
	(c,a2)-->T189 ==> b2 notin pow(c)
	Use_def(pow) ==> Stat5: b2 notin {x: x incin c}
	b2-->Stat5 ==> false; Discharge ==> (FORALL x in pow(c), y incin x | Finite(x) & (y in pow(c)))
--
-- Next we consider the second of the four necessary properties.
--
	Suppose ==> Stat6: not (FORALL x in pow(s), y incin x | Finite(x) & (y in pow(s)))
	(a,b)-->Stat6 ==> (a in pow(s)) & (b incin a) & ((not Finite(a)) or (b notin pow(s)))
	Use_def(pow) ==> Stat7: (a in {x: x incin s})
	ap-->Stat7 ==> a incin s
	(s,a)-->T189 ==> b notin pow(s)
	Use_def(pow) ==> Stat8: b notin {x: x incin s}
	b-->Stat8 ==> false; Discharge ==> (FORALL x in pow(s), y incin x | Finite(x) & (y in pow(s)))
--
-- Having now established the first two of the four necessary properties we consider the third.
--
	Suppose ==> Stat9: not (FORALL x in pow(c), t | hsko(c,t)~[x] = f3({g4(hsko(c,t)~[y],y,x,t): y in pow(c) | (y incin x) & (y /= x) &
					P4(hsko(c,t)~[y],y,x,t)},x,t))
	(a3,tq)-->Stat9(Stat9) ==> (a3 in pow(c)) &
				(hsko(c,tq)~[a3] /= f3({g4(hsko(c,tq)~[y],y,a3,tq): y in pow(c) | (y incin a3) & (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)},a3,tq))
	Use_def(pow) ==> Stat10: a3 in {x: x incin c}
	d3-->Stat10 ==> a3 incin c
	(c,a3)-->T189 ==> Finite(a3)
	(c,tq)-->Tfinite_recursive_fcn.2 ==> Stat11: (FORALL x | ((x incin c) & Finite(x)) imp
			(hsko(c,tq)~[x] = f3({g4(hsko(c,tq)~[y],y,x,tq): y incin x | (y /= x) & P4(hsko(c,tq)~[y],y,x,tq)},x,tq)))
	a3-->Stat11 ==> hsko(c,tq)~[a3] = f3({g4(hsko(c,tq)~[y],y,a3,tq): y incin a3 | (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)},a3,tq)
	Suppose ==> {g4(hsko(c,tq)~[y],y,a3,tq): y in pow(c) | (y incin a3) & (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)} =
					{g4(hsko(c,tq)~[y],y,a3,tq): y incin a3 | (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)}
	EQUAL ==> false; Discharge ==> Stat12: {g4(hsko(c,tq)~[y],y,a3,tq): y in pow(c) | (y incin a3) & (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)} /=
					{g4(hsko(c,tq)~[y],y,a3,tq): y incin a3 | (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)}
	c2-->Stat12 ==> (c2 in {g4(hsko(c,tq)~[y],y,a3,tq): y in pow(c) | (y incin a3) & (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)}) eq
						(c2 notin {g4(hsko(c,tq)~[y],y,a3,tq): y incin a3 | (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)})
	Suppose ==> Stat13: (c2 in {g4(hsko(c,tq)~[y],y,a3,tq): y in pow(c) | (y incin a3) & (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)}) &
						Stat14: (c2 notin {g4(hsko(c,tq)~[y],y,a3,tq): y incin a3 | (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)})
	d2-->Stat13 ==> (d2 in pow(c)) & (c2 = g4(hsko(c,tq)~[d2],d2,a3,tq)) & (d2 incin a3) & (d2 /= a3) & P4(hsko(c,tq)~[d2],d2,a3,tq)
	d2-->Stat14 ==> false; Discharge ==> Stat15: (c2 notin {g4(hsko(c,tq)~[y],y,a3,tq): y in pow(c) | (y incin a3) & (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)}) &
						Stat16: (c2 in {g4(hsko(c,tq)~[y],y,a3,tq): y incin a3 | (y /= a3) & P4(hsko(c,tq)~[y],y,a3,tq)})
	c3-->Stat16 ==> (c3 incin a3) & (c2 = g4(hsko(c,tq)~[c3],c3,a3,tq)) & (c3 /= a3) & P4(hsko(c,tq)~[c3],c3,a3,tq)
	c3-->Stat15 ==> c3 notin pow(c)
	Use_def(pow) ==> Stat17: c3 notin {x: x incin c}
	c3-->Stat17 ==> false; Discharge ==> (FORALL x in pow(c), t | hsko(c,t)~[x] = f3({g4(hsko(c,t)~[y],y,x,t): y in pow(c) | (y incin x) & (y /= x) &
					P4(hsko(c,t)~[y],y,x,t)},x,t))
--
-- Having now established the first three of the four necessary properties it only remains to consider the fourth and last.
-- This can be handled in a manner almost identical to that of the third case considered above.
--
	Suppose ==> Stat18: not (FORALL x in pow(s), t | hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y in pow(s) | (y incin x) & (y /= x) &
							P4(hsko(s,t)~[y],y,x,t)},x,t))
	(a4,tp)-->Stat18(Stat18) ==> (a4 in pow(s)) & (hsko(s,tp)~[a4] /= f3({g4(hsko(s,tp)~[y],y,a4,tp): y in pow(s) | (y incin a4) & (y /= a4) &
							P4(hsko(s,tp)~[y],y,a4,tp)},a4,tp))
	Use_def(pow) ==> Stat19: a4 in {x: x incin s}
	d4-->Stat19 ==> Stat20: a4 incin s
	(s,a4)-->T189 ==> Finite(a4)
	(s,tp)-->Tfinite_recursive_fcn.2 ==> Stat21: (FORALL x | ((x incin s) & Finite(x)) imp
			(hsko(s,tp)~[x] = f3({g4(hsko(s,tp)~[y],y,x,tp): y incin x | (y /= x) & P4(hsko(s,tp)~[y],y,x,tp)},x,tp)))
	a4-->Stat21(Stat20) ==> hsko(s,tp)~[a4] = f3({g4(hsko(s,tp)~[y],y,a4,tp): y incin a4 | (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)},a4,tp)
	Suppose ==> {g4(hsko(s,tp)~[y],y,a4,tp): y in pow(s) | (y incin a4) & (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)} =
					{g4(hsko(s,tp)~[y],y,a4,tp): y incin a4 | (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)}
	EQUAL ==> false; Discharge ==> Stat22: {g4(hsko(s,tp)~[y],y,a4,tp): y in pow(s) | (y incin a4) & (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)} /=
					{g4(hsko(s,tp)~[y],y,a4,tp): y incin a4 | (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)}
	c4-->Stat22 ==> (c4 in {g4(hsko(s,tp)~[y],y,a4,tp): y in pow(s) | (y incin a4) & (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)}) eq
						(c4 notin {g4(hsko(s,tp)~[y],y,a4,tp): y incin a4 | (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)})
	Suppose ==> Stat23: (c4 in {g4(hsko(s,tp)~[y],y,a4,tp): y in pow(s) | (y incin a4) & (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)}) &
						Stat24: (c4 notin {g4(hsko(s,tp)~[y],y,a4,tp): y incin a4 | (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)})
	d5-->Stat23 ==> Stat25: (d5 in pow(s)) & (d5 incin a4) & (c4 = g4(hsko(s,tp)~[d5],d5,a4,tp)) & (d5 /= a4) & P4(hsko(s,tp)~[d5],d5,a4,tp)
	d5-->Stat24(Stat25) ==> false; Discharge ==>
			Stat26: (c4 notin {g4(hsko(s,tp)~[y],y,a4,tp): y in pow(s) | (y incin a4) & (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)}) &
						Stat27: (c4 in {g4(hsko(s,tp)~[y],y,a4,tp): y incin a4 | (y /= a4) & P4(hsko(s,tp)~[y],y,a4,tp)})
	d6-->Stat27 ==> (d6 incin a4) & (c4 = g4(hsko(s,tp)~[d6],d6,a4,tp)) & (d6 /= a4) & P4(hsko(s,tp)~[d6],d6,a4,tp)
	d6-->Stat26 ==> (d6 notin pow(s))
	Use_def(pow) ==> Stat28: d6 notin {x: x incin s}
	d6-->Stat28 ==> false; Discharge ==>
		(FORALL x in pow(s), t | hsko(s,t)~[x] = f3({g4(hsko(s,t)~[y],y,x,t): y in pow(s) | (y incin x) & (y /= x) &
							P4(hsko(s,t)~[y],y,x,t)},x,t))
--
-- We now have everything needed to apply the finite_recursion_coherence THEORY developed above.
-- This gives a direct contradiction with the inequality $hsko(c,t)~[c] /= hsko(s,t)~[c]$ proved earlier, and so
-- completes the proof of the present theorem.
--
	APPLY() finite_recursion_coherence(q->pow(c),r->pow(s),h_q(x,t)->hsko(c,t)~[x],h_r(x,t)->hsko(s,t)~[x],f3(b,x,t)->f3(b,x,t),g4(a,y,x,t)->g4(a,y,x,t),P4(a,y,x,t)->P4(a,y,x,t)) ==>
			Stat29: (FORALL x, t | ((x in pow(c)) & (x in pow(s))) imp (hsko(c,t)~[x] = hsko(s,t)~[x]))
	Suppose ==> c notin pow(s)
	Use_def(pow) ==> Stat30: c notin {x: x incin s}
	c-->Stat30 ==> false; Discharge ==> c in pow(s)
	Suppose ==> c notin pow(c)
	Use_def(pow) ==> Stat31: c notin {x: x incin c}
	c-->Stat31 ==> false; Discharge ==> c in pow(c)
	(c,t)-->Stat29 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- DISPLAY finite_recursive_fcn
--
-- THEORY finite_recursive_fcn(f3(b,x,t),g4(a,y,x,t),P4(a,y,x,t))
--
--	(FORALL s, t | Finite(s) imp (rech2_thryvar(s,t) = f3({g4(rech2_thryvar(y,t),y,s,t): y incin s |
--		(y /= s) & P4(rech2_thryvar(y,t),y,s,t)},s,t)))
--
-- END finite_recursive_fcn;
--
-- We will now derive a variant recursive function definition method which is simpler (but more limited)
-- than that which our prior finite_recursive_fcn THEORY affords. This applies to cases in which the value $f(s)$
-- can be defined in terms of  $f(sl(s))$ alone, for some strict subset $sl(s)$ (most typically
-- $s - {arb(s)}$). For this, we simply specialize the THEORY finite_recursive_fcn.
--
THEORY finite_tailrecursive_fcn(f(t),g3(a,x,t),sl(x))
	(FORALL x | (sl(x) incin x) & ((x /= 0) imp (sl(x) /= x)))
END finite_tailrecursive_fcn;
--
ENTER_THEORY finite_tailrecursive_fcn
--
	APPLY(rech2_thryvar:trech2_thryvar) finite_recursive_fcn(f3(b,x,t)->(if b = 0 then f(t) else arb(b) end if), g4(a,y,x,t)->g3(a,x,t), P4(a,y,x,t)->(y = sl(x))) ==>
Theorem finite_tailrecursive_fcn.0: (FORALL s,t | Finite(s) imp (trech2_thryvar(s,t) =
		if      ({g3(trech2_thryvar(y,t),s,t): y incin s | (y /= s) & (y = sl(s))} = 0) then f(t)
		else arb({g3(trech2_thryvar(y,t),s,t): y incin s | (y /= s) & (y = sl(s))}) end if))
--
-- The clumsy recursive relationship appearing in this last Theorem can be simplified by noting that the condition
-- ${g3(trech2_thryvar(y,T),S,T): y incin S | (y /= S) & (y = sel(S))} = 0$ is equivalent to $S = 0$,
-- and that when $S /= 0$ ${g3(trech2_thryvar(y,T),S,T): y incin S | (y /= S) & (y = sel(S))}$
-- is just ${g3(trech2_thryvar(sel(S),T),S,T)}$. The proof which follows does this.
--
Theorem finite_tailrecursive_fcn.1: Finite(S) imp (trech2_thryvar(S,T) = if (S = 0) then f(T) else g3(trech2_thryvar(sl(S), T), S,T) end if). Proof:
    Suppose_not(s,t) ==> Finite(s) & (trech2_thryvar(s,t) /= if s = 0 then f(t) else g3(trech2_thryvar(sl(s), t), s,t) end if)
	Tfinite_tailrecursive_fcn.0 ==> Stat1: (FORALL s,t | Finite(s) imp (trech2_thryvar(s,t) =
		if ({g3(trech2_thryvar(y,t),s,t): y incin s | (y /= s) & (y = sl(s))} = 0) then f(t)
			else arb({g3(trech2_thryvar(y,t),s,t): y incin s | (y /= s) & (y = sl(s))}) end if))
	(s,t)-->Stat1 ==>
			trech2_thryvar(s,t) = if {g3(trech2_thryvar(y,t),s,t): y incin s | (y /= s) & (y = sl(s))} = 0 then f(t)
					else arb({g3(trech2_thryvar(y,t),s,t): y incin s | (y /= s) & (y = sl(s))}) end if
	Suppose ==> s = 0
	ELEM ==> Stat2: {g3(trech2_thryvar(y,t),s,t): y incin s | (y /= s) & (y = sl(s))} /= 0
	c-->Stat2 ==> false; Discharge ==> s /= 0
        Assump ==> Stat3: (FORALL x | (sl(x) incin x) & ((x /= 0) imp (sl(x) /= x)))
	s-->Stat3 ==> (sl(s) incin s) & (sl(s) /= s)
	Suppose ==> Stat4: {g3(trech2_thryvar(y,t),s,t): y incin s | (y /= s) & (y = sl(s))} = 0
	(sl(s))-->Stat4 ==> false; Discharge ==> (trech2_thryvar(s,t) /= g3(trech2_thryvar(sl(s), t), s,t)) &
			Stat5: (trech2_thryvar(s,t) in {g3(trech2_thryvar(y,t),s,t): y incin s | (y /= s) & (y = sl(s))})
	y-->Stat5 ==> (y = sl(s)) & (trech2_thryvar(s,t) = g3(trech2_thryvar(y,t),s,t))
    EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY finite_tailrecursive_fcn
--
--THEORY finite_tailrecursive_fcn(f(t),g3(a,x,t),sl(x))
--	(FORALL x | (sl(x) incin x) & ((x /= 0) imp (sl(x) /= x)))
--==>(trech2_thryvar)
--	(FORALL s, t | Finite(s) imp (trech2_thryvar(s,t) = if (s = 0) then f(t) else g3(trech2_thryvar(sl(s), t), s,t) end if))
--END finite_tailrecursive_fcn;
--
-- We will now derive a variant recursive function definition method which is simpler (but more limited)
-- than that which our prior finite_recursive_fcn THEORY affords. This applies to cases in which the value $f(s)$
-- can be defined in terms of  $f(s - {arb(s)})$ alone. For this, we simply specialize the THEORY finite_recursive_fcn.
--
THEORY finite_tailrecursive_fcn1(f(t),g3(a,x,t))
END finite_tailrecursive_fcn1;
--
ENTER_THEORY finite_tailrecursive_fcn1
--
Theorem finite_tailrecursive_fcn1.0: ((X - {arb(X)}) incin X) & ((X /= 0) imp ((X - {arb(X)}) /= X)). Proof:
    Suppose_not(x) ==> (not(((x - {arb(x)}) incin x) & ((x /= 0) imp ((x - {arb(x)}) /= x))))
    Discharge ==> QED
--
	APPLY(trech2_thryvar:trech_thryvar) finite_tailrecursive_fcn(f(t)->f(t), g3(a,x,t)->g3(a,x,t), sl(x)->(x - {arb(x)})) ==>
Theorem finite_tailrecursive_fcn1.1: (FORALL s,t | Finite(s) imp (trech_thryvar(s,t) =
		if (s = 0) then f(t)
		else g3(trech_thryvar(s - {arb(s)}, t), s,t) end if))
--
ENTER_THEORY Set_theory
--
--DISPLAY finite_tailrecursive_fcn1
--
--THEORY finite_tailrecursive_fcn1(f(t),g3(a,x,t));
--==>(trech_thryvar)
--    (FORALL s, t | Finite(s) imp (trech_thryvar(s,t) = if (s = 0) then f(t) else g3(trech_thryvar(s - {arb(s)}, t), s,t) end if))
--END finite_tailrecursive_fcn1;
--
-- Our next variant recursive function definition scheme is even simpler, but applies only when the
-- function being defined is monadic, rather than dyadic as above. To derive it we simply specialize the preceding theory.
--
THEORY finite_tailrecursive_fcn2(f0,g2(a,x))
END finite_tailrecursive_fcn2;
--
ENTER_THEORY finite_tailrecursive_fcn2
--
	APPLY(trech_thryvar:h) finite_tailrecursive_fcn1(f(t)->f0,g3(a,x,t)->g2(a,x)) ==>
Theorem finite_tailrecursive_fcn2.0: (FORALL s,t | Finite(s) imp (h(s,t) = if s = 0 then f0 else g2(h(s - {arb(s)},t),s) end if))
--
Def 00f: [?] h1_thryvar(S) := h(S,0)
--
Theorem finite_tailrecursive_fcn2.1: Finite(S) imp (h1_thryvar(S) = if S = 0 then f0 else g2(h1_thryvar(S - {arb(S)}),S) end if). Proof:
    Suppose_not(s) ==> Finite(s) & (h1_thryvar(s) /= if s = 0 then f0 else g2(h1_thryvar(s - {arb(s)}),s) end if)
    Tfinite_tailrecursive_fcn2.0 ==> Stat1: (FORALL s,t | Finite(s) imp (h(s,t) = if s = 0 then f0 else g2(h(s - {arb(s)},t),s) end if))
	(s,0)-->Stat1 ==> h(s,0) = if s = 0 then f0 else g2(h(s - {arb(s)},0),s) end if
Use_def(h1_thryvar) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY finite_tailrecursive_fcn2
--
--THEORY finite_tailrecursive_fcn2(f0,g2(a,x))
--==>(h1_thryvar)
--    (FORALL s | Finite(s) imp (h1_thryvar(s) = if s = 0 then f0 else g2(h1_thryvar(s - {arb(s)}),s) end if))
--END finite_tailrecursive_fcn2;
--
-- Our next aim is to introduce the very important and often used 'theory of sigma', which
-- shows that for any commutative operation $PLUZ$ defined on a set $s$ and having
-- the algebraic properties of addition, there exists a summation operator $sigma$,
-- defined for all finite, single-valued mappings $g$ having values in $s$, which represents the repeated sum
-- customarily written using an informal 'three dots' notation as $g(x1) PLUZ g(x2) PLUZ ... PLUZ g(xn)$.
-- This summation operator sends the empty mapping into the additive zero element of the underlying domain $s$
-- and maps any singleton ${[x,y]}$ with $y in s$  into $y$. The sigma operator is additive over
-- pairs of mappings having disjoint domains, and, more generally, if $g$ is
-- decomposed in any way into a collection of disjoint parts $gj$, then
-- $sigma(g)$ is the sum of all the values $sigma(gj)$, where $gj$ runs over all the
-- parts into which $g$ has been decomposed.

--
-- This theory will be used to define sums of finite sequences of elements of many kinds, e.g.
-- integers, signed integers, rational, real and complex numbers, functions whose values are
-- integers, signed integers, rational, real or complex numbers, etc. It can also be used to
-- define extended product operators $PI(g)$ of the kind which would ordinarily be written less formally as
-- $g(x1) TIMES g(x2) TIMES ... TIMES g(xn)$ etc.
--
THEORY sigma_theory(s,pluz(x,y),e)
    e in s
    (FORALL x | (x in s) imp (pluz(x,e) = x))
    (FORALL x,y | ((x in s) & (y in s)) imp (pluz(x,y) = pluz(y,x)))
    (FORALL x,y | ((x in s) & (y in s)) imp (pluz(x,y) in s))
    (FORALL x,y,z | ((x in s) & (y in s) & (z in s)) imp (pluz(pluz(x,y),z) = pluz(x,pluz(y,z))))
END sigma_theory;
--
ENTER_THEORY sigma_theory
--
-- Our first step is to define the $sigma$ operation by applying our recursive definition
-- schema to the conditional expression appearing in the following formula.
--
APPLY(h1_thryvar:sigma_thryvar) finite_tailrecursive_fcn2(f0->e,g2(y,x)->pluz(y,cdr(arb(x)))) ==>
    Theorem sigma_theory0: [Recursive formula for generalized sum] (FORALL x | Finite(x) imp (sigma_thryvar(x) = if x = 0 then e else pluz(sigma_thryvar(x - {arb(x)}),cdr(arb(x))) end if))
--
-- Next we begin the sequence of proofs belonging to the present theory by showing that,
-- when applied to the null set, the sigma-operation associated with the generic addition
-- operator $PLUZ$ yields the additive zero element of the underlying domain $s$.
--
Theorem sigma_theory1: [Summation of null map is zero] sigma_thryvar(0) = e. Proof:
    Suppose_not ==> sigma_thryvar(0) /= e
    T188 ==> Finite(0)
    Tsigma_theory0 ==> Stat1: (FORALL x | Finite(x) imp (sigma_thryvar(x) = if x = 0 then e else pluz(sigma_thryvar(x - {arb(x)}),cdr(arb(x))) end if))
    0-->Stat1 ==> false; Discharge ==> QED
--
-- Next we show that when applied to any singleton set ${[v,y]}$ with $y$ in the domain $s$
-- underlying $PLUZ$ the sigma-operation simply yields $y$:
--
Theorem sigma_theory2: [Summation of singleton map is range element] (cdr(X) in s) imp (sigma_thryvar({X}) = cdr(X)). Proof:
    Suppose_not(x) ==> (cdr(x) in s) & (sigma_thryvar({x}) /= cdr(x))
--
-- This follows immediately by defintion of the function $sigma_thryvar$ and from the fact that the
-- costant $e$ appearing in the preceding heorm is the additive zero element of the underlying domain $s$.
--
    x-->T201 ==> Finite({x})
    Tsigma_theory0 ==> Stat1: (FORALL x | Finite(x) imp (sigma_thryvar(x) = if x = 0 then e else pluz(sigma_thryvar(x - {arb(x)}),cdr(arb(x))) end if))
    ({x})-->Stat1 ==> sigma_thryvar({x}) = pluz(sigma_thryvar({x} - {arb({x})}),cdr(arb({x})))
    TELEM ==> ({x} - {arb({x})} = 0) & (arb({x}) = x)
    Tsigma_theory1 ==> sigma_thryvar(0) = e
    EQUAL ==> sigma_thryvar({x}) = pluz(e,cdr(x))
    Assump ==> (e in s) & Stat2: (FORALL x | (x in s) imp (pluz(x,e) = x)) & Stat3: (FORALL x, y | ((x in s) & (y in s)) imp (pluz(x,y) = pluz(y,x)))
    (e,cdr(x))-->Stat3 ==> sigma_thryvar({x}) = pluz(cdr(x),e)
    (cdr(x))-->Stat2 ==> false; Discharge ==> QED
--
-- Our next lemm tells us that when applied to a finite map $F$ whose range
-- is included in the domain $s$ underlying $PLUZ$,
-- the sigma-operation yields an element of $s$:
--
Theorem sigma_theory3: [Sum value belongs to closed range of map] (Finite(F) & (range(F) incin s)) imp (sigma_thryvar(F) in s). Proof:
    Suppose_not(f1) ==> Finite(f1) & (range(f1) incin s) & (sigma_thryvar(f1) notin s)
--
-- For, assuming the contrary, there would be a map $f$ contradicting the statement which we want to prove
-- which was also inclusion-minimal. By an earlier theorem, such an $f$ would be non-null.
--
    APPLY(m1_thryvar:f) finite_induction(n->f1,P(x)->(range(x) incin s) & (sigma_thryvar(x) notin s)) ==>
	 (f incin f1) & (range(f) incin s) & (sigma_thryvar(f) notin s) &
	Stat1: (FORALL g incin f | ((g /= f) imp (not((range(g) incin s) & (sigma_thryvar(g) notin s)))))
    (f1,f)-->T189 ==> Finite(f)
    Suppose ==> f = 0
    Tsigma_theory1 ==> sigma_thryvar(0) = e
    Assump ==> e in s
    EQUAL ==> false; Discharge ==> (f incs f - {arb(f)}) & (f - {arb(f)} /= f) & (arb(f) in f)
--
-- But then removal of $arb(f)$ from $f$ would produce a map strictly included in $f$ whose
-- sigma-image would not belong to $s$, a contradiction which proves the desired statement.
--
    (f - {arb(f)})-->Stat1 ==> not((range(f - {arb(f)}) incin s) & (sigma_thryvar(f - {arb(f)}) notin s))
    Use_def(range) ==> (range(f - {arb(f)}) = {cdr(x): x in f - {arb(f)}}) & (range(f) = {cdr(x): x in f})
    Set_monot ==> {cdr(x): x in f - {arb(f)}} incin {cdr(x): x in f}
    ELEM ==> sigma_thryvar(f - {arb(f)}) in s
    Tsigma_theory0 ==> Stat2: (FORALL x | Finite(x) imp (sigma_thryvar(x) = if x = 0 then e else pluz(sigma_thryvar(x - {arb(x)}),cdr(arb(x))) end if))
    f-->Stat2 ==> sigma_thryvar(f) = pluz(sigma_thryvar(f - {arb(f)}),cdr(arb(f)))
    Suppose ==> Stat3: cdr(arb(f)) notin {cdr(x): x in f}
    (arb(f))-->Stat3 ==> false; Discharge ==> cdr(arb(f)) in s
    Assump ==> Stat4: (FORALL x,y | ((x in s) & (y in s)) imp (pluz(x,y) in s))
    (sigma_thryvar(f - {arb(f)}),cdr(arb(f)))-->Stat4 ==> false; Discharge ==> QED
--
-- The following theorem shows that in the recursive definition of $sigma_thryvar(f)$
-- (where $f$ is a finite non-null map whose range is included in the domain underlying $PLUZ$),
-- any element $c$ of $f$ can take the place of $arb(f)$.
--
Theorem sigma_theory4: [Removal of single element from domain of a sum] ((C in F) &
	Finite(F) & (range(F) incin s)) imp (sigma_thryvar(F) = pluz(sigma_thryvar(F - {C}),cdr(C))). Proof:
Suppose_not(c1,f1) ==> AUTO
--
-- For, assuming the contrary, there would exist an inclusion-minimal map $f$
-- contradicting our assertion, so that $f$ would have an element $c$ such that
-- $sigma_thryvar(f) /= sigma_thryvar(f - {c}) PLUZ cdr(c)$, whereas
-- $sigma_thryvar(f) = sigma_thryvar(f - {arb(f)}) PLUZ cdr(arb(f))$ by definition.
--
	Suppose ==> Stat1: not(EXISTS c in f1 | sigma_thryvar(f1) /= pluz(sigma_thryvar(f1 - {c}),cdr(c)))
	c1-->Stat1 ==> false; Discharge ==>
		Finite(f1) & (range(f1) incin s) & (EXISTS c in f1 | sigma_thryvar(f1) /= pluz(sigma_thryvar(f1 - {c}),cdr(c)))
	APPLY(m1_thryvar:f) finite_induction (n->f1,P(x)->(range(x) incin s) & (EXISTS c in x | sigma_thryvar(x) /= pluz(sigma_thryvar(x - {c}),cdr(c)))) ==>
		Stat2: (f incin f1) & (range(f) incin s) &
		Stat3: (EXISTS c in f | sigma_thryvar(f) /= pluz(sigma_thryvar(f - {c}),cdr(c))) &
		Stat4: (FORALL g incin f | ((g /= f) imp (not((range(g) incin s)) &
		(EXISTS d in g | sigma_thryvar(g) /= pluz(sigma_thryvar(g - {d}),cdr(d))))))
	(f1,f)-->T189 ==> Finite(f)
	c-->Stat3 ==> Stat5: (c in f) & (sigma_thryvar(f) /= pluz(sigma_thryvar(f - {c}),cdr(c)))
	Tsigma_theory0 ==> Stat6: (FORALL x | Finite(x) imp (sigma_thryvar(x) = if x = 0 then e else pluz(sigma_thryvar(x - {arb(x)}),cdr(arb(x))) end if))
	f-->Stat6 ==> sigma_thryvar(f) = pluz(sigma_thryvar(f - {arb(f)}),cdr(arb(f)))
--
-- Given the counterexample that we have assumed, it is clear that $f$ includes ${c}$ strictly.
-- Moreover, the assumed minimality of $f$ implies that any element of $f - {arb(f)}$,
-- in particular $c$, can be used to calculate $sigma_thryvar(f - {c})$.
--
	Suppose ==> arb(f) = c
	EQUAL ==> false; Discharge ==> Stat7: (arb(f) /= c)
	(Stat5,Stat7)ELEM ==> Stat8: ((f - {c}) /= 0) & ((f - {arb(f)}) incin f) & ((f - {arb(f)}) /= f) & (c in (f - {arb(f)}))
	(f - {arb(f)},f)-->T65(Stat2,Stat2*) ==> range(f - {arb(f)}) incin s
	(f - {arb(f)})-->Stat4(Stat8*) ==> Stat9: not(EXISTS c in f - {arb(f)} |
		sigma_thryvar(f - {arb(f)}) /= pluz(sigma_thryvar(f - {arb(f)} - {c}),cdr(c)))
	c-->Stat9(Stat8,Stat8*) ==> sigma_thryvar(f - {arb(f)}) = pluz(sigma_thryvar(f - {arb(f)} - {c}),cdr(c))
--
-- Using the minimality of $f$ once more we can derive the following expression for $sigma_thryvar(f - {c})$.
--
	(Stat5,Stat7)ELEM ==> Stat10: ((f - {c}) incin f) & (f - {c} /= f) & (arb(f) in f - {c})
	(f - {c},f)-->T65(Stat2,Stat2*) ==> (range(f - {c}) incin range(f)) & (range(f - {c}) incin s)
	(f - {c})-->Stat4(Stat10*) ==>
			Stat11: not(EXISTS d in f - {c} | sigma_thryvar(f - {c}) /= pluz(sigma_thryvar(f - {c} - {d}),cdr(d)))
	(arb(f))-->Stat11(Stat10,Stat10*) ==> sigma_thryvar(f - {c}) = pluz(sigma_thryvar(f - {arb(f)} - {c}),cdr(arb(f)))
--
-- Using the commutativity and associativity of $PLUZ$ we can now derive an easy contradiction
-- which completes our proof.
--
	(c,f)-->T61(Stat5,Stat2*) ==> Stat12: cdr(c) in s
	(arb(f),f)-->T61(Stat10,Stat2*) ==> cdr(arb(f)) in s
	(f,f - {arb(f)} - {c})-->T189(Stat2*) ==> Finite(f - {arb(f)} - {c})
	(f - {arb(f)} - {c},f)-->T65(Stat2*) ==> range(f - {arb(f)} - {c}) incin s
	(f - {arb(f)} - {c})-->Tsigma_theory3(Stat12*) ==> sigma_thryvar(f - {arb(f)} - {c}) in s
	Assump ==> Stat13: (FORALL x,y,z | ((x in s) & (y in s) & (z in s)) imp (pluz(pluz(x,y),z) = pluz(x,pluz(y,z))))
	(sigma_thryvar(f - {arb(f)} - {c}), cdr(arb(f)), cdr(c))-->Stat13(Stat11*) ==>
		pluz(pluz( sigma_thryvar(f - {arb(f)} - {c}), cdr(arb(f)) ), cdr(c)) =
			pluz(sigma_thryvar(f - {arb(f)} - {c}), pluz( cdr(arb(f)), cdr(c) ))
	Assump ==> Stat14: (FORALL x,y | ((x in s) & (y in s)) imp  (pluz(x,y) = pluz(y,x)))
	(cdr(arb(f)), cdr(c))-->Stat14(Stat12*) ==> pluz(cdr(arb(f)),cdr(c)) = pluz(cdr(c),cdr(arb(f)))
	(sigma_thryvar(f - {arb(f)} - {c}), cdr(c), cdr(arb(f)))-->Stat13(Stat11*) ==>
					pluz(sigma_thryvar(f - {arb(f)} - {c}), pluz(cdr(c), cdr(arb(f))) ) =
						pluz(pluz(sigma_thryvar(f - {arb(f)} - {c}), cdr(c) ), cdr(arb(f)))
EQUAL(Stat5) ==> false; Discharge ==> QED
--
-- Next we show that if map $f$ like that considered in the previous theorems is divided into two disjoint parts
-- $f1$ and $f2$, we have $sigma_thryvar(f) = sigma_thryvar(f1) PLUZ sigma_thryvar(f2)$.
--
Theorem sigma_theory5: [The generalized sum of a union map is a sum of sums] (Finite(F) & Is_map(F) & (range(F) incin s)) imp
	(sigma_thryvar(F) = pluz(sigma_thryvar(F ON (domain(F) * T)), sigma_thryvar(F ON (domain(F) - T)))). Proof:
Suppose_not(f1,t1) ==> AUTO
--
-- Assuming that there exists a counterexample to our thorem, we can choose an
-- inclusion-minimal map $f$ that contradicts it, along with a set $t$ for which
-- $sigma_thryvar(f) /= sigma_thryvar(f ON (domain(f) * t)) PLUZ sigma_thryvar(f ON (domain(f) - t))$.
--
	Suppose ==> Stat1: (FORALL t | sigma_thryvar(f1) = pluz(sigma_thryvar(f1 ON (domain(f1) * t)), sigma_thryvar(f1 ON (domain(f1) - t))))
	t1-->Stat1 ==> false; Discharge ==> (not(FORALL t | sigma_thryvar(f1) =
			pluz(sigma_thryvar(f1 ON (domain(f1) * t)), sigma_thryvar(f1 ON (domain(f1) - t)))))
	APPLY(m1_thryvar:f) finite_induction (n->f1,P(x)->(range(x) incin s) & Is_map(x) & (not(FORALL t | sigma_thryvar(x) = pluz(sigma_thryvar(x ON (domain(x) * t)), sigma_thryvar(x ON (domain(x) - t)))))) ==>
		Stat2: (f incin f1) & (range(f) incin s) & Is_map(f) &
		Stat3: (not(FORALL t | sigma_thryvar(f) =
			pluz(sigma_thryvar(f ON (domain(f) * t)), sigma_thryvar(f ON (domain(f) - t))))) &
		Stat4: (FORALL g incin f | ((g /= f) imp (not((range(g) incin s)) & Is_map(g) &
			(not(FORALL t | sigma_thryvar(g) = pluz(sigma_thryvar(g ON (domain(g) * t)), sigma_thryvar(g ON (domain(g) - t))))))))
	(f1,f)-->T189(*) ==> Stat5: Finite(f)
	t-->Stat3(Stat2*) ==> sigma_thryvar(f) /= pluz(sigma_thryvar(f ON (domain(f) * t)), sigma_thryvar(f ON (domain(f) - t)))
--
-- Next we can decompose $f$ as the disjoint union of $f ON (domain(f) * t)$ with $f ON (domain(f) - t)$.
--
    TELEM ==> domain(f) = (domain(f) * t) + (domain(f) - t)
    EQUAL ==> f ON domain(f) = f ON ((domain(f) * t) + (domain(f) - t))
    (f,domain(f) * t,domain(f) - t)-->T63 ==>
    			f ON domain(f) = (f ON (domain(f) * t)) + (f ON (domain(f) - t))
    (f,t)-->T68(*) ==> f ON (domain(f) * t) = f ON t
    f-->T67 ==> f = (f ON t) + (f ON (domain(f) - t))
--
-- It follows from the following assumptions and instances of theorems of the present theory...
--
    Assump ==> Stat6: e in s
    Assump ==> Stat7: (FORALL x | (x in s) imp (pluz(x,e) = x))
    Assump ==> Stat8: (FORALL x,y | ((x in s) & (y in s)) imp (pluz(x, y) = pluz(y, x)))
    Tsigma_theory1 ==> sigma_thryvar(0) = e
    (f,(domain(f) - t))-->T52(*) ==> (f ON (domain(f) - t)) incin f
    (f,f ON (domain(f) - t))-->T189(Stat5*) ==> Finite(f ON (domain(f) - t))
    (f,(domain(f) - t))-->T80(Stat2,Stat2*) ==> range(f ON (domain(f) - t)) incin s
    (f ON (domain(f) - t))-->Tsigma_theory3 ==> Stat9: sigma_thryvar(f ON (domain(f) - t)) in s
--
-- ... that $t$ must intersect the domain of $f$; more specifically, $f ON t$ cannot be null.
--
    Suppose ==> f ON t = 0
    (Stat2)ELEM ==> f = f ON (domain(f) - t)
    EQUAL(Stat2) ==> sigma_thryvar(f) = sigma_thryvar(f ON (domain(f) - t))
    (sigma_thryvar(f ON (domain(f) - t)))-->Stat7 ==> sigma_thryvar(f) = pluz(sigma_thryvar(f ON (domain(f) - t)), e)
    EQUAL(Stat2) ==> sigma_thryvar(f) /= pluz(e, sigma_thryvar(f ON (domain(f) - t)))
    (e,sigma_thryvar(f ON (domain(f) - t)))-->Stat8 ==> false; Discharge ==> Stat10: f ON t /= 0
--
-- Hence we can pick an element $c$ from the restricted map $f ON (domain(f) * t)$,
-- which must satisfy $domain(f - {c}) - t = domain(f) - t$.
--
    c-->Stat10(Stat2) ==> Stat11: c in (f ON (domain(f) * t))
    Use_def(ON) ==> Stat12: c in {x in f | car(x) in (domain(f) * t)}
    ()-->Stat12(Stat12) ==> Stat13: car(c) in (domain(f) * t)
    (f-{c},t)-->T68(*) ==>  ((f-{c}) ON (domain(f-{c}) * t)) = ((f-{c}) ON t)
    Suppose ==> Stat14: domain(f - {c}) - t /= domain(f) - t
	(f - {c},f)-->T65(Stat14*) ==> Stat15: not(domain(f - {c}) - t incs domain(f) - t)
	b-->Stat15(Stat15*) ==> (b in domain(f) - t) & (b notin domain(f - {c}))
	Use_def(domain) ==> (b in {car(x): x in f} - t) & (b notin domain(f - {c}))
	(Stat2)ELEM ==> Stat16: b in {car(x): x in f}
	b1-->Stat16(Stat16) ==> (b = car(b1)) & (b1 in f)
	Use_def(domain) ==> Stat17: (b notin {car(x): x in f - {c}})
	b1-->Stat17(Stat15) ==> b1 notin f - {c}
    (Stat2)Discharge ==> Stat18: domain(f - {c}) - t = domain(f) - t
--
-- It easily follows that $(f ON (domain(f) - t)) = ((f-{c}) ON (domain(f) - t))$; for, ...
--
--
    (f-{c},{c},(domain(f) - t))-->T64 ==> ((f-{c}+{c}) ON (domain(f) - t)) =
    	((f - {c}) ON (domain(f) - t)) + ({c} ON (domain(f) - t))
    (Stat2)ELEM ==> f = f - {c} + {c}
    EQUAL(Stat18) ==> f ON (domain(f) - t) = ((f - {c}) ON (domain(f - {c}) - t)) + ({c} ON (domain(f) - t))
--
-- ...assuming that ${c} ON (domain(f) - t) /= 0$ would contradict the
-- fact, already established,  that $car(c) in t$.
--
    Suppose ==> Stat19: {c} ON (domain(f) - t) /= 0
	a-->Stat19 ==> a in ({c} ON (domain(f) - t))
	Use_def(ON) ==> Stat20: a in {p in {c} | car(p) in domain(f)-t}
	()-->Stat20 ==> (a in {c}) & (car(a) in domain(f)-t)
    (Stat12)Discharge ==> Stat21: f ON (domain(f) - t) = (f - {c}) ON (domain(f - {c}) - t)
--
-- It is also easy to sharpen the preceding observation into the equality
--	$(f ON (domain(f) - t)) = ((f - {c}) ON (domain(f) - t))$.
--
    Suppose ==> Stat22: (f ON (domain(f) - t)) /= ((f - {c}) ON (domain(f) - t))
    Use_def(ON)(Stat22*) ==> (f ON (domain(f) - t) = {x in f | car(x) in domain(f) - t}) &
	((f - {c}) ON (domain(f) - t) = {x in (f - {c}) | car(x) in domain(f) - t})
    TELEM ==> f = (f - {c}) + (f - (f - {c}))
    (f - {c},f - (f - {c}),domain(f) - t)-->T64(Stat23*) ==>
    	Stat23: ((f - {c}) + (f - (f - {c})) ON (domain(f) - t)) incs ((f - {c}) ON (domain(f) - t))
    EQUAL(Stat22) ==> (f ON (domain(f) - t)) incs ((f - {c}) ON (domain(f) - t))
    (Stat22)ELEM ==> not ((f ON (domain(f) - t)) incin ((f - {c}) ON (domain(f) - t)))
    d-->Stat22(Stat22) ==> Stat24: (d in {x in f | car(x) in domain(f) - t}) &
		Stat25: (d notin {x in f - {c} | car(x) in domain(f) - t})
    d-->Stat24(Stat24*) ==> (d in f) & (car(d) in domain(f) - t) & (d notin (f - {c}))
    (Stat2*)Discharge ==> Stat26: (f ON (domain(f) - t)) = ((f - {c}) ON (domain(f) - t))
--
-- The assumed minimality of $f$ now leads to the equality
--	$sigma_thryvar(f - {c}) = sigma_thryvar((f - {c}) ON (domain(f - {c}) * t)) PLUZ sigma_thryvar(f ON (domain(f) - t))$,
--
    Suppose ==> sigma_thryvar(f - {c}) /=
    	pluz(sigma_thryvar((f - {c}) ON (domain(f - {c}) * t)), sigma_thryvar((f - {c}) ON (domain(f - {c}) - t)))
	(Stat18)ELEM ==> (f - {c} incin f) & (f - {c} /= f)
	(f - {c},f)-->T52(Stat2,Stat2*) ==> Is_map(f - {c})
	(f - {c},f)-->T65(Stat2,Stat2*) ==> range(f - {c}) incin s
	(f, f-{c})-->T189(Stat5*) ==> Finite(f-{c})
	(f - {c})-->Stat4(Stat26*) ==> Stat27: (FORALL t | sigma_thryvar(f - {c}) =
		pluz(sigma_thryvar((f - {c}) ON (domain(f - {c}) * t)), sigma_thryvar((f - {c}) ON (domain(f - {c}) - t))))
    t-->Stat27(Stat26) ==> false; Discharge ==> Stat28: sigma_thryvar(f - {c}) =
    	pluz(sigma_thryvar((f - {c}) ON (domain(f - {c}) * t)), sigma_thryvar((f - {c}) ON (domain(f - {c}) - t)))
--
--  whence, thanks to the assumptions and earlier theorems of the present theory, ...
--
    (c,f)-->Tsigma_theory4 ==> sigma_thryvar(f) = pluz(sigma_thryvar(f - {c}), cdr(c))
    EQUAL(Stat18) ==> sigma_thryvar(f) = pluz(pluz(sigma_thryvar((f - {c}) ON (domain(f - {c}) * t)), sigma_thryvar(f ON (domain(f) - t))), cdr(c))
    Assump ==> Stat29: (FORALL x,y | ((x in s) & (y in s)) imp (pluz(x,y) in s))
    Assump ==> Stat30: (FORALL x, y, z | ((x in s) & (y in s) & (z in s)) imp (pluz(pluz(x,y),z) = pluz(x,pluz(y,z))))
--
    (f,(domain(f) - t))-->T48(Stat28) ==> (f ON (domain(f) - t)) incin  f
    (f,(f ON (domain(f) - t)))-->T189 ==> Finite(f ON (domain(f) - t))
    ((f ON (domain(f) - t)),f)-->T65 ==> range(f ON (domain(f) - t)) incin s
--
    ((f - {c}), (domain(f - {c}) * t) )-->T48 ==> ((f - {c}) ON (domain(f - {c}) * t)) incin  f
    (f,((f - {c}) ON (domain(f - {c}) * t)))-->T189 ==> Finite((f - {c}) ON (domain(f - {c}) * t))
    (((f - {c}) ON (domain(f - {c}) * t)),f)-->T65 ==> range((f - {c}) ON (domain(f - {c}) * t)) incin s
    ((f - {c}) ON (domain(f - {c}) * t))-->Tsigma_theory3 ==> sigma_thryvar((f - {c}) ON (domain(f - {c}) * t)) in s
--
-- ... we find that
--	$sigma_thryvar(f) = (sigma_thryvar((f - {c}) ON (domain(f - {c}) * t)) PLUZ cdr(c)) PLUZ sigma_thryvar(f ON (domain(f) - t))$
--
    Suppose ==> Stat31: cdr(c) notin s
	(Stat2,Stat31*)ELEM ==> cdr(c) notin range(f)
	Use_def(range)(Stat31*) ==> Stat32: cdr(c) notin {cdr(x): x in f}
	c-->Stat32(Stat32) ==> c notin f
    (f,dom(f)*t)-->T48(*) ==> false; Discharge ==> Stat33: cdr(c) in s
    (sigma_thryvar((f - {c}) ON (domain(f - {c}) * t)),sigma_thryvar(f ON (domain(f) - t)),cdr(c))-->Stat30(*) ==>
		sigma_thryvar(f) =
			pluz(sigma_thryvar((f - {c}) ON (domain(f - {c})) * t), pluz(sigma_thryvar(f ON (domain(f) - t)), cdr(c)))
    (sigma_thryvar((f - {c}) ON (domain(f - {c}) * t)),cdr(c),sigma_thryvar(f ON (domain(f) - t)))-->Stat30(*) ==>
	 	pluz(sigma_thryvar((f - {c}) ON (domain(f - {c}) * t)), pluz(cdr(c), sigma_thryvar(f ON (domain(f) - t)))) =
	 		pluz(pluz(sigma_thryvar((f - {c}) ON (domain(f - {c}) * t)), cdr(c)), sigma_thryvar(f ON (domain(f) - t)))
    (sigma_thryvar(f ON (domain(f) - t)), cdr(c))-->Stat8(Stat33,Stat9*) ==> pluz(sigma_thryvar(f ON (domain(f) - t)), cdr(c)) =
    	pluz(cdr(c), sigma_thryvar(f ON (domain(f) - t)))
    EQUAL(Stat2) ==> sigma_thryvar(f) =
    	pluz(pluz(sigma_thryvar((f - {c}) ON (domain(f - {c}) * t)), cdr(c)), sigma_thryvar(f ON (domain(f) - t)))
--
-- Addition of the first two terms on the right-hand side of this equality is easily seen to
-- yield $sigma_thryvar(f ON (domain(f) * t))$; thus, by using Theorem $sigma_theory4$ we get
-- a contradiction which proves the present theorem.
--
    ({c},f-{c},t)-->T64(Stat34*) ==> Stat34: (f-{c}+{c}) ON t = ((f-{c}) ON t) + ({c} ON t)
    EQUAL(Stat2) ==> (f ON t) = ((f-{c}) ON t) + ({c} ON t)
    Suppose ==> Stat35: ({c} ON t) /= {c}
	({c},t)-->T48(Stat35*) ==> Stat36: c notin {c} ON t
	Use_def(ON)(Stat36*) ==> Stat37: c notin {x in {c} | car(x) in t}
    c-->Stat37(Stat13,Stat13*) ==> false; Discharge ==> f ON (domain(f) * t) = ((f-{c}) ON (domain(f-{c}) * t)) + {c}
    (f-{c},domain(f-{c}) * t)-->T48(*) ==> f ON (domain(f) * t) - {c} = ((f-{c}) ON (domain(f-{c}) * t))
    EQUAL(Stat30) ==> sigma_thryvar(f ON (domain(f) * t) - {c}) = sigma_thryvar((f-{c}) ON (domain(f-{c}) * t))
--
    (f,(domain(f) * t))-->T48(*) ==> Stat38: (f ON (domain(f) * t)) incin f
    (f,f ON (domain(f) * t))-->T189(Stat38,Stat5*) ==> Stat39: Finite(f ON (domain(f) * t))
    (f ON (domain(f) * t),f)-->T65(Stat38,Stat2*) ==> Stat40: range(f ON (domain(f) * t)) incin s
    (c,f ON (domain(f) * t))-->Tsigma_theory4(Stat11,Stat39,Stat40*) ==>
    	sigma_thryvar(f ON (domain(f) * t)) = pluz(sigma_thryvar(f ON (domain(f) * t) - {c}), cdr(c))
EQUAL(Stat2*) ==> false; Discharge ==> QED
--
-- Our next theorem shows that if a map $f$ with values in s  is
-- decomposed in any way into a collection of disjoint parts $fj$, then
-- $sigma(f)$ is the sum of all the values $sigma(fj)$, where $fj$ runs over all the
-- parts into which $f$ has been decomposed. To state this result formally, we make use of
-- an auxiliary single-valued mapping $g$ having the same domain as f, and decompose
-- the domain of f into the collection of sets $g INV_IM {y}$, where $y$ varies
-- over the range of $g$.
--
Theorem sigma_theory6: [Rearrangement-of-sums theorem]
    (Finite(F) & Svm(F) & Svm(G) & (domain(F) = domain(G)) & (range(F) incin s)) imp
	(sigma_thryvar(F) = sigma_thryvar({[y,sigma_thryvar(F ON (G INV_IM {y}))]: y in range(G)})). Proof:
--
-- Assuming by contradiction the statement to be false, we could take
-- a counterexample $f,g$ with $f$ incusion-minimal.
--
    Suppose_not(f1,g1) ==> Stat1: Finite(f1) & Svm(f1) & Svm(g1) & (domain(f1) = domain(g1)) & (range(f1) incin s) &
	  (sigma_thryvar(f1) /= sigma_thryvar({[y,sigma_thryvar(f1 ON (g1 INV_IM {y}))]: y in range(g1)}))
    Suppose ==> Stat2: not((EXISTS g | Svm(g) & (domain(f1) = domain(g)) & (sigma_thryvar(f1) /= sigma_thryvar({[y,sigma_thryvar(f1 ON (g INV_IM {y}))]: y in range(g)}))))
    g1-->Stat2 ==> false; Discharge ==> (EXISTS g | Svm(g) & (domain(f1) = domain(g)) & (sigma_thryvar(f1) /= sigma_thryvar({[y,sigma_thryvar(f1 ON (g INV_IM {y}))]: y in range(g)})))
    APPLY(m1_thryvar:f) finite_induction(n->f1,P(x)->(Svm(x) & (range(x) incin s) & (EXISTS g | Svm(g) & (domain(x) = domain(g)) & (sigma_thryvar(x) /= sigma_thryvar({[y,sigma_thryvar(x ON (g INV_IM {y}))]: y in range(g)}))))) ==>
	Stat3:(f incin f1) & Svm(f) & (range(f) incin s) &
	Stat4: (EXISTS g | Svm(g) & (domain(f) = domain(g)) & (sigma_thryvar(f) /= sigma_thryvar({[y,sigma_thryvar(f ON (g INV_IM {y}))]: y in range(g)}))) &
	Stat5: (FORALL h incin f | (h /= f) imp (not(Svm(h) & (range(h) incin s) & (EXISTS k | Svm(k) & (domain(h) = domain(k)) & (sigma_thryvar(h) /= sigma_thryvar({[v,sigma_thryvar(h ON (k INV_IM {v}))]: v in range(k)}))))))
--
    (f1,f)-->T189 ==> Finite(f)
    g-->Stat4 ==> Stat6: Svm(g) & (domain(f) = domain(g)) & (sigma_thryvar(f) /= sigma_thryvar({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}))
--
-- Note that $range(g)$ cannot be null, else $domain(f)=domain(g)$ would be null too,
-- which would quickly lead us to a contradiction.
--
    Suppose ==> range(g) = 0
	g-->T86 ==> Stat7: domain(f) = 0
	APPLY() setformer0(e(x)->car(x),s->f,P(x)->false) ==> (f /= 0) imp ({car(x): x in f} /= 0)
	Use_def(domain) ==> Stat8: (f /= 0) imp (domain(f) /= 0)
	(Stat7,Stat8)ELEM ==> f = 0
	Suppose ==> Stat9: {[y,sigma_thryvar(f ON (g INV_IM {y}))]: y in range(g)} /= 0
	d-->Stat9 ==> false; Discharge ==> {[y,sigma_thryvar(f ON (g INV_IM {y}))]: y in range(g)} = 0
    EQUAL ==> false; Discharge ==> Stat10: range(g) /= 0
--
-- Hence we can pick a $y$ from $range(g)$, and decompose the domain of $f$ as disjoint union
--	$domain(f)=(g INV_IM {y})+(g INV_IM (range(g)-{y}))$,
-- where $g INV_IM {8y}/=0$. By Theorem sigma_theory5, we will have
--	$sigma_thryvar(f) = sigma_thryvar(f ON (g INV_IM {y})) PLUZ sigma_thryvar(g INV_IM (range(g)-{y}))$.
--
    y-->Stat10 ==> y in range(g)
    (y,g)-->T179 ==> Stat11: (g INV_IM {y}) /= 0
    (g,{y})-->T177 ==> domain(f) = ((g INV_IM {y}) + (g INV_IM (range(g) - {y})))
    ({y},range(g)-{y},g)-->T178 ==> ((g INV_IM {y}) * (g INV_IM (range(g) - {y}))) = 0
    Use_def(Svm) ==> Stat12: Is_map(f) & (range(f) incin s) & Finite(f)
    (f,s,g INV_IM {y})-->Tsigma_theory5(Stat12) ==> sigma_thryvar(f) = pluz(sigma_thryvar(f ON (domain(f) * (g INV_IM {y}))), sigma_thryvar(f ON (domain(f) - (g INV_IM {y}))))
    (Stat11)ELEM ==> (domain(f) * (g INV_IM {y}) = g INV_IM {y}) & (domain(f) - (g INV_IM {y})) = g INV_IM (range(g)-{y})
    EQUAL ==> Stat13: sigma_thryvar(f) = pluz(sigma_thryvar(f ON (g INV_IM {y})), sigma_thryvar(f ON (g INV_IM (range(g)-{y}))))
--
-- Before we can exploit the assumed minimality of $f$, we must show that the restriction
-- of $f$ to $g INV_IM (range(g)-{y})$ is strictly included in $f$.
--
    Suppose ==> not((f ON (g INV_IM (range(g) - {y})) incin f) & (f /= f ON (g INV_IM (range(g) - {y}))))
      x-->Stat11 ==> (x in (g INV_IM {y}))
      Suppose ==> [x,f~[x]] notin f
        f-->T72 ==> Stat14: [x,f~[x]] notin {[xx,f~[xx]]: xx in domain(f)}
        (g,{x})-->T177 ==> x in domain(f)
      x-->Stat14 ==> false; Discharge ==> [x,f~[x]] in f
      (f,domain(f) - (g INV_IM {y}))-->T48 ==> f ON (domain(f) - (g INV_IM {y})) incin f
      (f,domain(f) - (g INV_IM {y}))-->T57 ==> Svm(f ON (domain(f) - (g INV_IM {y})))
      EQUAL ==> Svm(f ON (g INV_IM (range(g)-{y})))
      (f ON (domain(f) - (g INV_IM {y})))-->T72 ==> Stat15: {[xx,(f ON (domain(f) - (g INV_IM {y})))~[xx]]: xx in domain(f ON (domain(f) - (g INV_IM {y})))} = f ON (domain(f) - (g INV_IM {y}))
      (f,domain(f) - (g INV_IM {y}))-->T94 ==> x notin domain(f ON (domain(f) - (g INV_IM {y})))
      Suppose ==> [x,f~[x]] in (f ON (domain(f) - (g INV_IM {y})))
        EQUAL ==> Stat16: [x,f~[x]] in {[xx,(f ON (domain(f) - (g INV_IM {y})))~[xx]]: xx in domain(f ON (domain(f) - (g INV_IM {y})))}
        xp-->Stat16 ==> Stat17:  (x = xp) & (xp in domain(f ON (domain(f) - (g INV_IM {y}))))
      EQUAL ==> false; Discharge ==> f /= f ON (domain(f) - (g INV_IM {y}))
   EQUAL ==> false; Discharge ==> Stat18: (f ON (g INV_IM (range(g) - {y})) incin f) & (f /= f ON (g INV_IM (range(g)-{y})))
--
-- Simplification of the expression for $sigma_thryvar(f ON (g INV_IM (range(g) - {y})))$
-- which results from this remark leads us to the equality
--
--	$sigma_thryvar(f ON (g INV_IM (range(g) - {y}))) = sigma_thryvar({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}})$.
--
   Suppose ==> Stat19: sigma_thryvar(f ON (g INV_IM (range(g) - {y}))) /= sigma_thryvar({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}})
        Suppose ==>  not(range(f ON (g INV_IM (range(g) - {y}))) incin s)
            (f,g INV_IM (range(g) - {y}))-->T48() ==> f ON (g INV_IM (range(g) - {y})) incin f
        (f ON (g INV_IM (range(g) - {y})),f)-->T65(Stat3) ==> false; Discharge ==> range(f ON (g INV_IM (range(g) - {y}))) incin s
        (f ON (g INV_IM (range(g) - {y})))-->Stat5(Stat18) ==>  (not(Svm(f ON (g INV_IM (range(g) - {y}))))) or
		(not(EXISTS k | Svm(k) & (domain(f ON (g INV_IM (range(g) - {y}))) = domain(k)) & (sigma_thryvar(f ON (g INV_IM (range(g) - {y}))) /= sigma_thryvar({[v,sigma_thryvar((f ON (g INV_IM (range(g) - {y}))) ON (k INV_IM {v}))]: v in range(k)}))))
        (f, (g INV_IM (range(g) - {y})))-->T48 ==> f ON (g INV_IM (range(g) - {y})) incin f
        (f ON (g INV_IM (range(g) - {y})))-->T53 ==>
		 Stat20: not(EXISTS k | Svm(k) & (domain(f ON (g INV_IM (range(g) - {y}))) = domain(k)) & (sigma_thryvar(f ON (g INV_IM (range(g) - {y}))) /= sigma_thryvar({[v,sigma_thryvar((f ON (g INV_IM (range(g) - {y}))) ON (k INV_IM {v}))]: v in range(k)})))
        (g, (g INV_IM (range(g) - {y})))-->T48 ==> g ON (g INV_IM (range(g) - {y})) incin g
        (g, (g INV_IM (range(g) - {y})))-->T57 ==> Svm(g ON (g INV_IM (range(g) - {y})))
        (f,(g INV_IM (range(g) - {y})))-->T94 ==> domain(f ON (g INV_IM (range(g) - {y}))) = domain(f) * (g INV_IM (range(g) - {y}))
        (g,(g INV_IM (range(g) - {y})))-->T94 ==> domain(f ON (g INV_IM (range(g) - {y}))) = domain(g ON (g INV_IM (range(g) - {y})))
        (g ON (g INV_IM (range(g) - {y})))-->Stat20 ==> sigma_thryvar(f ON (g INV_IM (range(g) - {y}))) = sigma_thryvar({[v,sigma_thryvar((f ON (g INV_IM (range(g) - {y}))) ON ((g ON (g INV_IM (range(g) - {y}))) INV_IM {v}))]: v in range(g ON (g INV_IM (range(g) - {y})))})
        (g, (range(g) - {y}))-->T184 ==> range(g ON (g INV_IM (range(g) - {y}))) = range(g) - {y}
        EQUAL ==> Stat21: sigma_thryvar(f ON (g INV_IM (range(g) - {y}))) = sigma_thryvar({[v,sigma_thryvar((f ON (g INV_IM (range(g) - {y}))) ON ((g ON (g INV_IM (range(g) - {y}))) INV_IM {v}))]: v in range(g) - {y}})
        Suppose ==> Stat22: (not(FORALL v in (range(g) - {y}) | (f ON (g INV_IM (range(g) - {y}))) ON ((g ON (g INV_IM (range(g) - {y}))) INV_IM {v}) = f ON (g INV_IM {v})))
            Loc_def ==> ry = range(g) - {y}
            Loc_def ==> gry = g INV_IM ry
            Loc_def ==> gory = g ON gry
            EQUAL ==> Stat23: (not(FORALL v in ry | (f ON (g INV_IM (range(g) - {y}))) ON (gory INV_IM {v}) = f ON (g INV_IM {v})))
            vp-->Stat23 ==> ({vp} incin ry) & ((f ON (g INV_IM (range(g) - {y}))) ON (gory INV_IM {vp}) /= f ON (g INV_IM {vp}))
            Loc_def ==> wp = {vp}
            EQUAL ==> (f ON (g INV_IM ry)) ON (gory INV_IM wp) /= f ON (g INV_IM wp)
            (wp, ry, g)-->T186(Stat23) ==> (g INV_IM wp) = (g INV_IM ry) * (g INV_IM wp)
            Suppose ==> (f ON (g INV_IM ry)) ON (g INV_IM wp) /= f ON (g INV_IM wp)
                (f, (g INV_IM ry), (g INV_IM wp))-->T187 ==> (f ON (g INV_IM ry)) ON (g INV_IM wp) = f ON ((g INV_IM ry) * (g INV_IM wp))
            EQUAL ==> false; Discharge ==>  (f ON (g INV_IM ry)) ON (g INV_IM wp) = f ON (g INV_IM wp)
            Suppose ==> gory INV_IM wp = g INV_IM wp
                EQUAL ==> (f ON (g INV_IM ry)) ON (gory INV_IM wp) = (f ON (g INV_IM ry)) ON (g INV_IM wp)
            EQUAL ==> false; Discharge ==> gory INV_IM wp /= g INV_IM wp
            (g, ry, wp)-->T185 ==> ((g ON (g INV_IM ry)) INV_IM wp) = (g INV_IM wp)
            EQUAL ==> gory INV_IM wp = g INV_IM wp
        ELEM ==> false; Discharge ==> Stat24: (FORALL v in (range(g) - {y}) | (f ON (g INV_IM (range(g) - {y}))) ON ((g ON (g INV_IM (range(g) - {y}))) INV_IM {v}) = f ON (g INV_IM {v}))
        Suppose ==> Stat25: {[v,sigma_thryvar((f ON (g INV_IM (range(g) - {y}))) ON ((g ON (g INV_IM (range(g) - {y}))) INV_IM {v}))]: v in range(g) - {y}} /= {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}}
            vq-->Stat25 ==> (vq in range(g) - {y}) &  (sigma_thryvar((f ON (g INV_IM (range(g) - {y}))) ON ((g ON (g INV_IM (range(g) - {y}))) INV_IM {vq})) /= sigma_thryvar(f ON (g INV_IM {vq})))
            vq-->Stat24 ==> (f ON (g INV_IM (range(g) - {y}))) ON ((g ON (g INV_IM (range(g) - {y}))) INV_IM {vq}) = f ON (g INV_IM {vq})
        EQUAL ==> false; Discharge ==> Stat26: {[v,sigma_thryvar((f ON (g INV_IM (range(g) - {y}))) ON ((g ON (g INV_IM (range(g) - {y}))) INV_IM {v}))]: v in range(g) - {y}} = {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}}
        EQUAL(Stat26,Stat21) ==> Stat27: sigma_thryvar(f ON (g INV_IM (range(g) - {y}))) = sigma_thryvar({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}})
        (Stat27,Stat19)ELEM ==>  false; Discharge ==> Stat28: sigma_thryvar(f ON (g INV_IM (range(g) - {y}))) = sigma_thryvar({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}})
--
-- Next we ascertain all conditions needed for instantiation of
-- the variables of Theorem sigma_theory4 to $[y,sigma_thryvar(f ON (g INV_IM {y}))]$
-- and to ${[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}$ respectively.
--
   Suppose ==> {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}} + {[y,sigma_thryvar(f ON (g INV_IM {y}))]} /= {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}
        Set_monot ==> {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}} incin {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}
        Suppose ==> Stat29: [y,sigma_thryvar(f ON (g INV_IM {y}))] notin {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}
        y-->Stat29 ==> false; Discharge ==> Stat30: not({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}} + {[y,sigma_thryvar(f ON (g INV_IM {y}))]}
        	incs {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)})
        a-->Stat30 ==> Stat31: (a in {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}) &
		(a notin {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}}) &
		(a /= [y,sigma_thryvar(f ON (g INV_IM {y}))])
        (u,u)-->Stat31 ==> Stat32: (a = [u,sigma_thryvar(f ON (g INV_IM {u}))]) & (u in range(g)) & (u notin range(g) - {y}) & (a /= [y,sigma_thryvar(f ON (g INV_IM {y}))])
    (Stat32)ELEM ==> (u=y) & (sigma_thryvar(f ON (g INV_IM {u})) /= sigma_thryvar(f ON (g INV_IM {y})))
    EQUAL ==> false; Discharge ==> Stat33: {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}} + {[y,sigma_thryvar(f ON (g INV_IM {y}))]}
        = {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}
--
-- One of the conditions needed for the application of Theorem sigma_theory4 is proved
-- as follows, exploiting the known fact that a single-valued map is finite if and only
-- if its domain is finite.
--
    Suppose ==> not(Finite({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}))
        g-->T174 ==> #g = #domain(g)
        f-->T174 ==> #f = #domain(f)
        f-->T193 ==> Finite(#f)
        EQUAL ==> Finite(#domain(g))
        ELEM ==> Svm({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}) &
		domain({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}) = range(g)
        (domain(g))-->T193 ==> Finite(domain(g))
        g-->T192 ==> Finite(range(g))
        EQUAL ==> Finite(domain({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}))
        (domain({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}))-->T193 ==>
		Finite(#domain({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}))
        ({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)})-->T174 ==> #domain({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}) =
		#{[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}
        EQUAL ==> Finite(#{[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)})
    ({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)})-->T193 ==> false; Discharge ==>
		Stat34: Finite({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)})
--
--
--
--
    Suppose ==> Stat35: not(range({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}) incin s)
        (Stat35)ELEM ==> Stat36: not({sigma_thryvar(f ON (g INV_IM {v})): v in range(g)} incin s)
        b-->Stat36() ==> Stat37: (b in {sigma_thryvar(f ON (g INV_IM {v})): v in range(g)}) & (b notin s)
        w-->Stat37() ==> (b = sigma_thryvar(f ON (g INV_IM {w}))) & (w in range(g))
        (f, (g INV_IM {w}))-->T48 ==> f ON (g INV_IM {w}) incin f
        (f ON (g INV_IM {w}),f)-->T53 ==> Svm(f ON (g INV_IM {w}))
        (f, f ON (g INV_IM {w}))-->T189 ==> Finite(f ON (g INV_IM {w}))
        (f ON (g INV_IM {w}),f)-->T65 ==> range(f ON (g INV_IM {w})) incin range(f)
    (f ON (g INV_IM {w}))-->Tsigma_theory3(Stat1*) ==> false; Discharge ==> Stat38: range({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}) incin s
    ([y,sigma_thryvar(f ON (g INV_IM {y}))], {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)})-->Tsigma_theory4(Stat33,Stat34,Stat38) ==>
		sigma_thryvar({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}) = pluz(sigma_thryvar({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)} - {[y,sigma_thryvar(f ON (g INV_IM {y}))]}), sigma_thryvar(f ON (g INV_IM {y})))
    Suppose ==> Stat39: [y,sigma_thryvar(f ON (g INV_IM {y}))] in {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}}
        v-->Stat39 ==> Stat40: (v /= y) & ([y,sigma_thryvar(f ON (g INV_IM {y}))] = [v,sigma_thryvar(f ON (g INV_IM {v}))])
    (Stat40)Discharge ==> Stat41: [y,sigma_thryvar(f ON (g INV_IM {y}))] notin {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}}
    (Stat33,Stat41)ELEM ==> ([y,sigma_thryvar(f ON (g INV_IM {y}))] in {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}) &
	({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)} - {[y,sigma_thryvar(f ON (g INV_IM {y}))]} =
	 {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}})
    EQUAL ==> Stat42: sigma_thryvar({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}) = pluz(sigma_thryvar({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}}), sigma_thryvar(f ON (g INV_IM {y})))
--
-- Before we can exploit commutativity, we must check that the two addends
-- on the left-hand side of the equality just obtained belong to $s$.
-- Thanks to the Theorem sigma_theory_3, it suffices to show that both of
-- them are finite and have range contained in $s$.
--
    (f, (g INV_IM {y}))-->T48 ==> f ON (g INV_IM {y}) incin f
    (f, f ON (g INV_IM {y}))-->T189 ==> Finite(f ON (g INV_IM {y}))
    (f ON (g INV_IM {y}),f)-->T65 ==> range(f ON (g INV_IM {y})) incin range(f)
    (f ON (g INV_IM {y}))-->Tsigma_theory3 ==> Stat43: sigma_thryvar(f ON (g INV_IM {y})) in s
    Set_monot ==> {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}} incin {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}
    ({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)}, {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}})-->T189 ==>
		Finite({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}})
    ({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}}, {[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g)})-->T65 ==> range({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}}) incin s
    ({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}})-->Tsigma_theory3 ==> Stat44: sigma_thryvar({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}}) in s
    Assump ==> Stat45: (FORALL t, z | ((t in s) & (z in s)) imp (pluz(t,z) = pluz(z,t)))
    (sigma_thryvar(f ON (g INV_IM {y})), sigma_thryvar({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}}))-->Stat45 ==>
		Stat46: pluz(sigma_thryvar(f ON (g INV_IM {y})), sigma_thryvar({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}})) =
			pluz(sigma_thryvar({[v,sigma_thryvar(f ON (g INV_IM {v}))]: v in range(g) - {y}}), sigma_thryvar(f ON (g INV_IM {y})))
    EQUAL(Stat46,Stat42,Stat13,Stat28,Stat6) ==> false; Discharge ==> QED
--
-- The following theorem is a specialized variant of the rearrangement-of-sums theorem,
-- providing essentially the same conclusion as that given by the rearrangement-of-sums theorem,
-- but from hypotheses that are sometimes more convenient.
--
Theorem sigma_theory7: [Sum permutation theorem]
    (Finite(F) & Svm(F) & one_1_map(G) & (domain(F) = domain(G)) & (range(F) incin s)) imp
					(sigma_thryvar(F) = sigma_thryvar({[y,F~[inv(G)~[y]]]: y in range(G)})). Proof:
    Suppose_not(f,g) ==> Finite(f) & Svm(f) & one_1_map(g) &
    	(domain(f) = domain(g)) & (range(f) incin s) &
	  			(sigma_thryvar(f) /= sigma_thryvar({[y,f~[inv(g)~[y]]]: y in range(g)}))
--
-- For suppose that $f$ and $g$ furnish a counterexample to our assertion.
--
    Use_def(one_1_map) ==> Svm(g)
    Suppose ==> {[y,sigma_thryvar(f ON (g INV_IM {y}))]: y in range(g)} = {[y,f~[inv(g)~[y]]]: y in range(g)}
	EQUAL ==> sigma_thryvar({[y,sigma_thryvar(f ON (g INV_IM {y}))]: y in range(g)}) =
					 sigma_thryvar({[y,f~[inv(g)~[y]]]: y in range(g)})
    (f,g)-->Tsigma_theory6 ==> false; Discharge ==>
    	Stat1: {[y,sigma_thryvar(f ON (g INV_IM {y}))]: y in range(g)} /= {[y,f~[inv(g)~[y]]]: y in range(g)}
    y-->Stat1 ==> (y in range(g)) & (sigma_thryvar(f ON (g INV_IM {y})) /= f~[inv(g)~[y]])
    (g,y)-->T182 ==> g INV_IM {y} = {inv(g)~[y]}
    g-->T99 ==> (range(g) = domain(inv(g))) & (domain(g) = range(inv(g)))
    (y,inv(g))-->T71 ==> inv(g)~[y] in domain(f)
    Use_def(Svm) ==> Is_map(f)
    (f,inv(g)~[y])-->T77 ==> [inv(g)~[y],f~[inv(g)~[y]]] in f
    Suppose ==> f ON {inv(g)~[y]} /= {[inv(g)~[y],f~[inv(g)~[y]]]}
	Use_def(ON) ==> {p: p in f | car(p) in {inv(g)~[y]}} /= {[inv(g)~[y],f~[inv(g)~[y]]]}
    Suppose ==> Stat2: [inv(g)~[y],f~[inv(g)~[y]]] notin {p: p in f | car(p) in {inv(g)~[y]}}
    TELEM ==> car([inv(g)~[y],f~[inv(g)~[y]]]) = inv(g)~[y]
    ([inv(g)~[y],f~[inv(g)~[y]]])-->Stat2 ==> false; Discharge ==>
    			Stat3: not({p: p in f | car(p) in {inv(g)~[y]}} incin {[inv(g)~[y],f~[inv(g)~[y]]]})
    q-->Stat3 ==> Stat4: (q in {p: p in f | car(p) in {inv(g)~[y]}}) & (q /= [inv(g)~[y],f~[inv(g)~[y]]])
    p-->Stat4 ==> (p in f) & (car(p) = inv(g)~[y]) & (p /= [inv(g)~[y],f~[inv(g)~[y]]])
    Use_def(Svm) ==> Stat5: (FORALL x in f, y in f | (car(x) = car(y)) imp (x = y))
    (p,[inv(g)~[y],f~[inv(g)~[y]]])-->Stat5 ==> false; Discharge ==>
    		f ON {inv(g)~[y]} = {[inv(g)~[y],f~[inv(g)~[y]]]}
    Suppose ==> cdr([inv(g)~[y],f~[inv(g)~[y]]]) notin s
	ELEM ==> f~[inv(g)~[y]] notin s
    (inv(g)~[y],f)-->T71 ==> false; Discharge ==> cdr([inv(g)~[y],f~[inv(g)~[y]]]) in s
    ([inv(g)~[y],f~[inv(g)~[y]]])-->Tsigma_theory2 ==>
    			sigma_thryvar({[inv(g)~[y],f~[inv(g)~[y]]]}) = f~[inv(g)~[y]]
    EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY sigma_theory
--
--THEORY sigma_theory(s,x PLUZ y,e)  [Contains some elementary lemmas about single-valued functions]
--    e in s
--    (FORALL x in s | (x PLUZ e = x))
--    (FORALL x in s, y in s | (x PLUZ y = y PLUZ x))
--    (FORALL x in s, y in s | x PLUZ y in s)
--    (FORALL x in s, y in s, z in s | (x PLUZ y) PLUZ z = x PLUZ (y PLUZ z))
--==> (sigma_thryvar)
--    (sigma_thryvar(0) = e)
--    (FORALL x | (cdr(x) in s) imp (sigma_thryvar({x}) = cdr(x)))
--    (FORALL f | (Finite(f) & (range(f) incin s)) imp (sigma_thryvar(f) in s))
--    (FORALL c, f | ((c in f) & Finite(f) & (range(f) incin s)) imp (sigma_thryvar(f) = sigma_thryvar(f - {c}) PLUZ cdr(c)))
--    (FORALL f, t | (Finite(f) & Is_map(f) & (range(f) incin s)) imp (sigma_thryvar(f) = (sigma_thryvar(f ON (domain(f) * t)) PLUZ sigma_thryvar(f ON (domain(f) - t)))))
--    (FORALL f in OM, g | (Finite(f) & Svm(f) & Svm(g) & (domain(f) = domain(g)) & (range(f) incin s)) imp (sigma_thryvar(f) = sigma_thryvar({[y,sigma_thryvar(f ON (g INV_IM {y}))]: y in range(g)})))
--    (FORALL f in OM, g | (Finite(f) & Svm(f) & one_1_map(g) & (domain(f) = domain(g)) & (range(f) incin s)) imp (sigma_thryvar(f) = sigma_thryvar({[y,f~[inv(g)~[y]]]: y in range(g)})))
--END sigma_theory;
--
-- ************************************************************************************************
--		Section 11: Equivalence relationships and Classes; Linear orderings
-- ************************************************************************************************
--
-- Next we introduce another tool used constantly, the theory of equivalence classes,
-- which tells us that a two-variable predicate $R(x,y)$ on a set $s$ can be represented in the form
-- $f(x) = f(y)$ using a one-variable auxiliary function $f$ if and only if $P$ is transitive and reflexive.
-- Since it is obvious that any relationship of the form $f(x) = f(y)$ must be transitive and reflexive,
-- we need only consider the converse. To construct the mapping $f$, we decompose the domain of $P$
-- into 'equivalence classes', namely the collection of all sets each containing all elements $x$ such that
-- $R(x,y)$ holds for a given $y$, and then simply map each $x$ into the equivalence class to which it belongs.
--
THEORY equivalence_classes(R(x,y),s) [Theory of equivalence classes]
    (FORALL x in s,y in s | (R(x,y) eq R(y,x)) & R(x,x))
    (FORALL x in s,y in s,z in s | ((R(x,y) & R(y,z)) imp R(x,z)))
END equivalence_classes;
--
ENTER_THEORY equivalence_classes
--
-- The formal definitions of the notions described just above are as follows.
-- The first definition is that of the equivalence class to which a given element of $s$ belongs,
-- and the second is that of the collection of all equivalence classes.
--
    Def equivalence_classes.0a: [The equivalence class of an element $X$] f1_thryvar(x) := {z in s | R(x,z)}
    Def equivalence_classes.0b: [The set of all equivalence classes formed by partitioning] Eqc_thryvar := {f1_thryvar(x): x in s}
--
-- We now show that, as promised, the transitive relationship $R(x,y)$ is equivalent to $f1_thryvar(x) = f1_thryvar(y)$.
--
Theorem equivalence_classes1: [Elements are equivalent if and only if their equivalence classes are equal] ((X in s) & (Y in s)) imp (R(X,Y) eq (f1_thryvar(X) = f1_thryvar(Y))). Proof:
    Suppose_not(x,y) ==> (x in s) & (y in s) & (not(R(x,y) eq (f1_thryvar(x) = f1_thryvar(y))))
--
-- For if $R(x,y)$ is true, then since $P$ is a transitive relation any w satisfying $R(x,w)$
-- must also satisfy $R(x,w)$ and so by definition we must have $f1_thryvar(x) = f1_thryvar(y)$.
--
    Suppose ==> R(x,y) & (f1_thryvar(x) /= f1_thryvar(y))
    Use_def(f1_thryvar) ==> Stat1: {z in s | R(x,z)} /= {z in s | R(y,z)}
    c-->Stat1 ==> (c in s) & ((R(x,c) & (not R(y,c))) or ((not R(x,c)) & R(y,c)))
    Assump ==> Stat2: (FORALL u in s, v in s | (R(u,v) eq R(v,u)) & R(u,u))
    Assump ==> Stat3: (FORALL u in s,v in s,w in s | ((R(u,v) & R(v,w)) imp R(u,w)))
    Suppose ==> R(x,c) & (not R(y,c))
    (x,y)-->Stat2 ==> R(y,x)
    (y,x,c)-->Stat3 ==> false; Discharge ==> (not R(x,c)) & R(y,c)
    (x,y,c)-->Stat3 ==> false; Discharge ==> (not R(x,y)) & (f1_thryvar(x) = f1_thryvar(y))
--
-- Conversely if $f1_thryvar(x) = f1_thryvar(y)$ is true, then since $x$ plainly belongs to
-- $f1_thryvar(x)$, it must also belong to $f1_thryvar(y)$, and so by definition we must have
-- $R(x,y)$, thereby completing the proof of our theorem.
--
    Use_def(f1_thryvar) ==> {z in s | R(x,z)} = {z in s | R(y,z)}
    Suppose ==> Stat4: y notin {z in s | R(y,z)}
    ()-->Stat4 ==> not R(y,y)
    (y,y)-->Stat2 ==> false; Discharge ==> Stat5: y in {z in s | R(x,z)}
    ()-->Stat5 ==> false; Discharge ==> QED
--
-- Next we prove the elementary facts that $f1_thryvar$ maps elements of $s$ into elements of the
-- equivalence class set $Eqc_thryvar$, and that for each equivalence class $y$, $arb(y)$ is
-- a member of $s$ whose equivalence class is $y$.
--
Theorem equivalence_classes2:  [The equivalence class of any element is an equivalence class] (X in s) imp (f1_thryvar(X) in Eqc_thryvar). Proof:
    Suppose_not(x) ==> (x in s) & (f1_thryvar(x) notin Eqc_thryvar)
--
--
--
    Use_def(Eqc_thryvar) ==> (x in s) & Stat1: (f1_thryvar(x) notin {f1_thryvar(x): x in s})
	x-->Stat1 ==> false; Discharge ==> QED
--
Theorem equivalence_classes2b: [Any element of an equivalence class can represent the class] ((X in Eqc_thryvar) imp ((arb(X) in s) & (f1_thryvar(arb(X)) = X))). Proof:
	Suppose_not(y) ==> (y in Eqc_thryvar) & ((arb(y) notin s) or f1_thryvar(arb(y)) /= y)
	Use_def(Eqc_thryvar) ==> Stat1: y in {f1_thryvar(x): x in s}
    c-->Stat1 ==> (y = f1_thryvar(c)) & (c in s)
    Use_def(f1_thryvar) ==> f1_thryvar(c) = {wz in s | R(c,wz)}
    Suppose ==> c notin f1_thryvar(c)
    ELEM ==> Stat2: c notin {wz in s | R(c,wz)}
    Assump ==> Stat3: (FORALL x in s,y in s | (R(x,y) eq R(y,x)) & R(x,x)) &
    				Stat4: (FORALL x in s,y in s,z in s | ((R(x,y) & R(y,z)) imp R(x,z)))
    c-->Stat2 ==> not R(c,c)
    (c,c)-->Stat3 ==> false; Discharge ==> c in f1_thryvar(c)
    ELEM ==> f1_thryvar(c) /= 0
    (f1_thryvar(c))-->T0 ==> arb(f1_thryvar(c)) in f1_thryvar(c)
    Use_def(f1_thryvar) ==> arb(f1_thryvar(c)) in {wz in s | R(c,wz)}
    EQUAL ==> Stat5: arb(y) in {wz in s | R(c,wz)}
    ()-->Stat5 ==> (arb(y) in s) & R(c,arb(y))
    ELEM ==> f1_thryvar(arb(y)) /= f1_thryvar(c)
    Use_def(f1_thryvar) ==> Stat6: {wz in s | R(arb(y),wz)} /= {wz in s | R(c,wz)}
    d-->Stat6 ==> (d in s) & ((R(arb(y),d) & (not R(c,d))) or (not(R(arb(y),d)) & R(c,d)))
    Suppose ==> R(arb(y),d) & (not R(c,d))
	(c,arb(y),d)-->Stat4 ==> false; Discharge ==> (not R(arb(y),d)) & R(c,d)
	(arb(y),c)-->Stat3 ==> R(arb(y),c)
    (arb(y),c,d)-->Stat4 ==> false; Discharge ==> QED

-- Our next, quite trivial result rounds out the previous theorem by proving that $arb(f1_thryvar(x))$
-- is equivalent to $x$ for any $x in s$.
--
Theorem equivalence_classes3: [Any two elements of an equivalence class are equivalent] (X in s) imp R(x,arb(f1_thryvar(x))). Proof:
    Suppose_not(u) ==> (u in s) & (not R(u,arb(f1_thryvar(u))))
    u-->Tequivalence_classes2 ==> f1_thryvar(u) in Eqc_thryvar
    (f1_thryvar(u))-->Tequivalence_classes2b ==>
    	(arb(f1_thryvar(u)) in s) & (f1_thryvar(arb(f1_thryvar(u))) = f1_thryvar(u))
    (u,s,arb(f1_thryvar(u)))-->Tequivalence_classes1 ==> R(u,arb(f1_thryvar(u)))
    Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY equivalence_classes
--
--THEORY equivalence_classes(R(x,y),s) [Theory of equivalence classes]
--    (FORALL x in s, y in s | (R(x,y) eq R(y,x)) & R(x,x))
--    (FORALL x in s, y in s, z in s | ((R(x,y) & R(y,z)) imp R(x,z)))
--==>(f1_thryvar,Eqc_thryvar)
--    (FORALL x in s | f1_thryvar(x) in Eqc_thryvar) & (FORALL y in Eqc_thryvar | (arb(y) in s) & (f1_thryvar(arb(y)) = y))
--    (FORALL x in s, y in s | R(x,y) eq (f1_thryvar(x) = f1_thryvar(y)))
--    (FORALL x in s | R(x,arb(f1_thryvar(x))))
--END equivalence_classes;
--
-- Next we introduce another tool used constantly, the theory of strict linear orderings.
-- This tells us that any transitive and irreflexive two-argument ordering predicate
-- on a set $s$ induces various other useful
-- predicates and operations, including a maximum operation over every finite subset of $s$.
--
THEORY linear_order(s0,arg1_bef_arg2(X,Y))
    (FORALL x in  s0, y in s0, z in s0 | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) imp arg1_bef_arg2(x,z))
    (FORALL x in s0 | not(arg1_bef_arg2(x,x)))
    (FORALL x in  s0, y in s0 | arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x))
END linear_order
--
ENTER_THEORY linear_order
--
Def 10030: [Less-than-or-equal comparison] Def(X le_thryvar Y) := (arg1_bef_arg2(X,Y) or (X = Y))
--
-- The following easy theorem shows that, like the 'strict' order relationship $arg1_bef_arg2$
-- originally given, the 'less-than-or-equal' relation which $arg1_bef_arg2$ defines is transitive.
--
Theorem linear_order_1: (({U,V,W} incin s0) & (U le_thryvar V) & (V le_thryvar W)) imp (U le_thryvar W). Proof:
    Suppose_not(x,y,z) ==> ({x,y,z} incin s0) & (x le_thryvar y) & (y le_thryvar z) & (not (x le_thryvar z))
        Use_def(le_thryvar) ==> (arg1_bef_arg2(x,y) or (x = y)) & (arg1_bef_arg2(y,z) or (y = z)) & (not(arg1_bef_arg2(x,z) or (x = z)))
        Suppose ==> (x = y) & (y = z)
        Discharge ==> (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) or (arg1_bef_arg2(x,y) & (y = z)) or ((x = y) & arg1_bef_arg2(y,z))
        Suppose ==> arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)
            Assump ==> Stat1: (FORALL x in  s0, y in s0, z in s0 | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) imp arg1_bef_arg2(x,z))
        (x,y,z)-->Stat1 ==> false; Discharge ==> (arg1_bef_arg2(x,y) & (y = z)) or ((x = y) & arg1_bef_arg2(y,z))
        Suppose ==> arg1_bef_arg2(x,y) & (y = z)
        EQUAL ==> false; Discharge ==> ((x = y) & arg1_bef_arg2(y,z))
    EQUAL ==> false; Discharge ==> QED
--
-- The irreflexivity property of the strict order $arg1_bef_arg2$ implies the
-- following property of its associated 'less-than-or-equal' relation.
--
Theorem linear_order_2: (({U,V} incin s0) & (U le_thryvar V) & (V le_thryvar U)) imp (U = V). Proof:
    Suppose_not(x,y) ==> ({x,y} incin s0) & (x le_thryvar y) & (y le_thryvar x) & (x /= y)
        Use_def(le_thryvar) ==> arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x)
        Assump ==> Stat1: (FORALL x in  s0, y in s0, z in s0 | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) imp arg1_bef_arg2(x,z))
        (x,y,x)-->Stat1 ==> arg1_bef_arg2(x,x)
        Assump ==> Stat2: (FORALL x in s0 | not(arg1_bef_arg2(x,x)))
    x-->Stat2 ==> false; Discharge ==> QED
--
-- The following operation $smaller_thryvar$ extends the choice of the smaller element of a pair to the universe
-- of all sets by taking $s0$ itself as the value of smallest element for pairs one of whose elements is not in s0.
--
Def 10031: [Choice of the smaller] smaller_thryvar(X,Y) := if ((X notin s0) & (Y notin s0)) then s0 elseif (X notin s0) then Y elseif (Y notin s0) then X elseif arg1_bef_arg2(X,Y) then X else Y end if
--
-- The operation which chooses the smaller of its two arguments is commutative:
--
Theorem linear_order_3: smaller_thryvar(X,Y) = smaller_thryvar(Y,X). Proof:
Suppose_not(x,y) ==> Stat1: smaller_thryvar(x,y) /= smaller_thryvar(y,x)
	Suppose ==> not((x in s0) & (y in s0))
	Use_def(smaller_thryvar) ==> false; Discharge ==> Stat2: (x in s0) & (y in s0)
	Assump ==> Stat3: (FORALL x in  s0, y in s0 | arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x))
	(x,y)-->Stat3(Stat2*) ==> arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x)
	Suppose ==> Stat4: arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x)
		Assump ==> Stat5: (FORALL x in  s0, y in s0, z in s0 | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) imp arg1_bef_arg2(x,z))
		(x,y,x)-->Stat5(Stat2,Stat4*) ==> Stat6: arg1_bef_arg2(x,x)
		Assump ==> Stat7: (FORALL x in s0 | not(arg1_bef_arg2(x,x)))
	x-->Stat7(Stat2,Stat4,Stat6*) ==> false; Discharge ==> Stat8: not(arg1_bef_arg2(x,y) & arg1_bef_arg2(y,x))
	Suppose ==> Stat9: x = y
	EQUAL(Stat1,Stat9*) ==> false; Discharge ==> Stat10: arg1_bef_arg2(x,y) or arg1_bef_arg2(y,x)
	Suppose ==> Stat11: arg1_bef_arg2(x,y)
	Use_def(smaller_thryvar) ==> false; Discharge ==> Stat12: arg1_bef_arg2(y,x)
Use_def(smaller_thryvar) ==> false; Discharge ==> QED
--
-- Our assumptions concerning the strict order $arg1_bef_arg2$ also imply the
-- following familiar property of the associated 'less-than-or-equal' relation, i.e.
-- given any two elements of the domain $s0$, at least one one must be no larger than the other.
--
Theorem linear_order_4: ({U,V} incin s0) imp ((U le_thryvar V) or (V le_thryvar U)). Proof:
    Suppose_not(x,y) ==> ({x,y} incin s0) & (not (x le_thryvar y)) & (not (y le_thryvar x))
        Use_def(le_thryvar) ==> (x /= y) & (not arg1_bef_arg2(x,y)) & (not arg1_bef_arg2(y,x))
        Assump ==> Stat1: (FORALL x in  s0, y in s0 | arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x))
    (x,y)-->Stat1 ==> false; Discharge ==> QED
--
-- The following theorem extends this last assertion to three elements:
-- of any three elements in $s0$, one is smallest.
--
Theorem linear_order_5: ({U,V,W} incin s0) imp (((U le_thryvar V) & (U le_thryvar W)) or
	((V le_thryvar U) & (V le_thryvar W)) or ((W le_thryvar U) & (W le_thryvar V))). Proof:
    Suppose_not(x,y,z) ==> Stat1: ({x,y,z} incin s0) & (not ((x le_thryvar y) & (x le_thryvar z))) &
		(not ((y le_thryvar x) & (y le_thryvar z))) & (not ((z le_thryvar x) & (z le_thryvar y)))
        (x,y)-->Tlinear_order_4 ==> (x le_thryvar y) or (y le_thryvar x)
        (y,z)-->Tlinear_order_4 ==> (y le_thryvar z) or (z le_thryvar y)
        (x,z)-->Tlinear_order_4 ==> (x le_thryvar z) or (z le_thryvar x)
        Suppose ==> Stat2: (x le_thryvar y) & (y le_thryvar z)
        (x,y,z)-->Tlinear_order_1(Stat1,Stat2) ==> false; Discharge ==> (y le_thryvar x) & (z le_thryvar y)
    (z,y,x)-->Tlinear_order_1 ==> false; Discharge ==> QED
--
-- Every two-element subset of $s0$ is closed with respect to the operation which
-- chooses the smaller of its two arguments:
--
Theorem linear_order_6: ({X,Y} incin s0) imp (smaller_thryvar(X,Y) in {X,Y}). Proof:
    Suppose_not(x,y) ==> ({x,y} incin s0) & (smaller_thryvar(x,y) notin {x,y})
    Use_def(smaller_thryvar) ==> smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if
    Discharge ==> QED
--
-- When $x,y$ are elements of $s0$ such that $x$ is
-- less than or equal to $y$, is $x$, the smaller is $x$:
--
Theorem linear_order_7: (({X,Y} incin s0) & (arg1_bef_arg2(X,Y) or (X = Y))) imp ((smaller_thryvar(X,Y) = X) & (smaller_thryvar(Y,X) = X)). Proof:
    Suppose_not(x,y) ==> ({x,y} incin s0) & (arg1_bef_arg2(x,y) or (x = y)) & ((smaller_thryvar(x,y) /= x) or (smaller_thryvar(y,x) /= x))
        (x,y)-->Tlinear_order_3 ==> Stat1: (x in s0) & (y in s0) & (smaller_thryvar(x,y) /= x)
        Suppose ==> arg1_bef_arg2(x,y)
        Use_def(smaller_thryvar) ==> smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if
        (Stat1)Discharge ==> x = y
    (x,y)-->Tlinear_order_6(Stat1) ==> false; Discharge ==> QED
--
-- The set $s0$, which we have taken as the conventional minimum, acts as
-- the unit element of the operation which chooses the smaller of its two
-- arguments:
--
Theorem linear_order_8: (X in next(s0)) imp (smaller_thryvar(X,s0) = X). Proof:
    Suppose_not(x) ==> AUTO
	Suppose ==> x in s0
	Use_def(smaller_thryvar) ==> false; Discharge ==> x notin s0
	Use_def(next) ==> Stat1: (x = s0) & (smaller_thryvar(x,s0) /= x)
    Use_def(smaller_thryvar)(Stat1*) ==> false; Discharge ==> QED
--
-- The operation which chooses the smaller of its two arguments is associative:
--
Theorem linear_order_9: smaller_thryvar(X,smaller_thryvar(Y,W)) = smaller_thryvar(smaller_thryvar(X,Y),W). Proof:
    Suppose_not(x,y,w) ==> smaller_thryvar(x,smaller_thryvar(y,w)) /= smaller_thryvar(smaller_thryvar(x,y),w)
--
-- For it is easily seen that all three elements $x,y,w$ of a counterexample belong to $s0$;...
--
        Suppose ==> (x notin s0) & (y notin s0) & (w notin s0)
            TELEM ==> s0 notin s0
            Use_def(smaller_thryvar) ==> smaller_thryvar(y,w) = s0
            Use_def(smaller_thryvar) ==> smaller_thryvar(x,y) = s0
            Use_def(smaller_thryvar) ==> smaller_thryvar(x,s0) = s0
            Use_def(smaller_thryvar) ==> smaller_thryvar(s0,w) = s0
        EQUAL ==> false; Discharge ==> Stat1: (x in s0) or (y in s0) or (w in s0)
        Suppose ==> Stat2: (x notin s0) & (w notin s0)
            (Stat1*)ELEM ==> (y in s0)
            Use_def(smaller_thryvar) ==> (smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if) &
		(smaller_thryvar(y,w) = if ((y notin s0) & (w notin s0)) then s0 elseif (y notin s0) then w elseif (w notin s0) then y elseif arg1_bef_arg2(y,w) then y else w end if)
            (Stat2*)ELEM ==> (smaller_thryvar(x,y) = y) & (smaller_thryvar(y,w) = y)
        EQUAL ==> false; Discharge ==> Stat3: (x in s0) or (w in s0)
        Suppose ==> Stat4: (y notin s0) & (w notin s0)
            (Stat3*)ELEM ==> Stat5: (x in s0) & (s0 notin s0)
            Use_def(smaller_thryvar) ==> (smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if) &
		(smaller_thryvar(x,w) = if ((x notin s0) & (w notin s0)) then s0 elseif (x notin s0) then w elseif (w notin s0) then x elseif arg1_bef_arg2(x,w) then x else w end if)
            (Stat4*)ELEM ==> (smaller_thryvar(x,y) = x) & (smaller_thryvar(x,w) = x)
            Use_def(smaller_thryvar) ==> Stat6: (smaller_thryvar(x,s0) = if ((x notin s0) & (s0 notin s0)) then s0 elseif (x notin s0) then s0 elseif (s0 notin s0) then x elseif arg1_bef_arg2(x,s0) then x else s0 end if)
            (Stat5,Stat6*)ELEM ==> (smaller_thryvar(x,s0) = x)
            Use_def(smaller_thryvar) ==> smaller_thryvar(y,w) = s0
        EQUAL ==> false; Discharge ==> Stat7: (y in s0) or (w in s0)
        Suppose ==> Stat8: (x notin s0) & (y notin s0)
            (Stat7*)ELEM ==> Stat9: (w in s0) & (s0 notin s0)
            Use_def(smaller_thryvar) ==> (smaller_thryvar(y,w) = if ((y notin s0) & (w notin s0)) then s0 elseif (y notin s0) then w elseif (w notin s0) then y elseif arg1_bef_arg2(y,w) then y else w end if) &
		(smaller_thryvar(x,w) = if ((x notin s0) & (w notin s0)) then s0 elseif (x notin s0) then w elseif (w notin s0) then x elseif arg1_bef_arg2(x,w) then x else w end if)
            (Stat8*)ELEM ==> (smaller_thryvar(y,w) = w) & (smaller_thryvar(x,w) = w)
            Use_def(smaller_thryvar) ==> Stat10: (smaller_thryvar(s0,w) = if ((s0 notin s0) & (w notin s0)) then s0 elseif (s0 notin s0) then w elseif (w notin s0) then s0 elseif arg1_bef_arg2(s0,w) then s0 else w end if)
            (Stat9,Stat10*)ELEM ==> (smaller_thryvar(s0,w) = w)
            Use_def(smaller_thryvar) ==> smaller_thryvar(x,y) = s0
        EQUAL ==> false; Discharge ==> Stat11: (x in s0) or (y in s0)
        Suppose ==> Stat12: w notin s0
            (Stat3,Stat7,Stat12*)ELEM ==> (x in s0) & (y in s0)
            Use_def(smaller_thryvar) ==> (smaller_thryvar(y,w) = if ((y notin s0) & (w notin s0)) then s0 elseif (y notin s0) then w elseif (w notin s0) then y elseif arg1_bef_arg2(y,w) then y else w end if) &
		(smaller_thryvar(smaller_thryvar(x,y),w) = if ((smaller_thryvar(x,y) notin s0) & (w notin s0)) then s0 elseif (smaller_thryvar(x,y) notin s0) then w elseif (w notin s0) then smaller_thryvar(x,y) elseif arg1_bef_arg2(smaller_thryvar(x,y),w) then smaller_thryvar(x,y) else w end if)
            (x,y)-->Tlinear_order_6(Stat12*) ==> smaller_thryvar(x,y) in s0
            (Stat12*)ELEM ==> (smaller_thryvar(smaller_thryvar(x,y),w) = smaller_thryvar(x,y)) &
		(smaller_thryvar(y,w) = y)
        EQUAL ==> false; Discharge ==> Stat13: w in s0
        Suppose ==> Stat14: x notin s0
            (Stat3,Stat11,Stat14*)ELEM ==> (y in s0) & (w in s0)
            Use_def(smaller_thryvar) ==> (smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if) &
		(smaller_thryvar(x,smaller_thryvar(y,w)) = if ((x notin s0) & (smaller_thryvar(y,w) notin s0)) then s0 elseif (x notin s0) then smaller_thryvar(y,w) elseif (smaller_thryvar(y,w) notin s0) then x elseif arg1_bef_arg2(x,smaller_thryvar(y,w)) then x else smaller_thryvar(y,w) end if)
            (y,w)-->Tlinear_order_6(Stat14*) ==> smaller_thryvar(y,w) in s0
            (Stat14*)ELEM ==> (smaller_thryvar(x,smaller_thryvar(y,w)) = smaller_thryvar(y,w)) &
		(smaller_thryvar(x,y) = y)
        EQUAL ==> false; Discharge ==> Stat15: x in s0
        Suppose ==> Stat16: y notin s0
            (Stat11,Stat7,Stat16*)ELEM ==> (x in s0) & (w in s0)
            Use_def(smaller_thryvar) ==> (smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if) &
		(smaller_thryvar(y,w) = if ((y notin s0) & (w notin s0)) then s0 elseif (y notin s0) then w elseif (w notin s0) then y elseif arg1_bef_arg2(y,w) then y else w end if)
            (Stat16*)ELEM ==> (smaller_thryvar(x,y) = x) & (smaller_thryvar(y,w) = w)
        EQUAL ==> false; Discharge ==> Stat17: y in s0
--        (Stat13,Stat15,Stat17*)ELEM ==> Stat18: (x in s0) & (y in s0) & (w in s0)
--
-- ... but then we easily reach a contradiction no matter which of the three is smallest,
-- thereby deriving our desired conclusion.
--
        (x,y,w)-->Tlinear_order_5(Stat13,Stat15,Stat17*) ==> ((x le_thryvar y) & (x le_thryvar w)) or
		((y le_thryvar x) & (y le_thryvar w)) or ((w le_thryvar x) & (w le_thryvar y))
        Suppose ==> (x le_thryvar y) & (x le_thryvar w)
            Use_def(le_thryvar) ==> Stat19: (arg1_bef_arg2(x,y) or (x = y))
            Use_def(le_thryvar) ==> Stat20: (arg1_bef_arg2(x,w) or (x = w))
            (x,y)-->Tlinear_order_7(Stat15,Stat17,Stat19*) ==> smaller_thryvar(x,y) = x
            (x,w)-->Tlinear_order_7(Stat15,Stat13,Stat20*) ==> smaller_thryvar(x,w) = x
            (y,w)-->Tlinear_order_6(Stat17,Stat13*) ==> smaller_thryvar(y,w) in {y,w}
            Suppose ==> smaller_thryvar(y,w) = y
            EQUAL ==> false; Discharge ==> smaller_thryvar(y,w) = w
        EQUAL ==> false; Discharge ==> ((y le_thryvar x) & (y le_thryvar w)) or ((w le_thryvar x) & (w le_thryvar y))
        Suppose ==> (y le_thryvar x) & (y le_thryvar w)
            Use_def(le_thryvar) ==> Stat21: (arg1_bef_arg2(y,x) or (y = x))
            Use_def(le_thryvar) ==> Stat22: (arg1_bef_arg2(y,w) or (y = w))
            (y,x)-->Tlinear_order_7(Stat15,Stat17,Stat21*) ==> smaller_thryvar(x,y) = y
            (y,w)-->Tlinear_order_7(Stat17,Stat13,Stat22*) ==> smaller_thryvar(y,w) = y
        EQUAL ==> false; Discharge ==> (w le_thryvar x) & (w le_thryvar y)
        Use_def(le_thryvar) ==> Stat23: (arg1_bef_arg2(w,x) or (w = x))
        Use_def(le_thryvar) ==> Stat24: (arg1_bef_arg2(w,y) or (w = y))
        (w,y)-->Tlinear_order_7(Stat17,Stat13,Stat24*) ==> smaller_thryvar(y,w) = w
        (w,x)-->Tlinear_order_7(Stat15,Stat13,Stat23*) ==> smaller_thryvar(x,w) = w
        (x,y)-->Tlinear_order_6(Stat17,Stat15*) ==> smaller_thryvar(x,y) in {x,y}
        Suppose ==> smaller_thryvar(x,y) = x
        EQUAL ==> false; Discharge ==> smaller_thryvar(x,y) = y
    EQUAL ==> false; Discharge ==> QED
--
-- The set $s0 + {s0}$ is closed with respect to the operation which
-- chooses the smaller of its two arguments:
--
Theorem linear_order_10: ((X in next(s0)) & (Y in next(s0))) imp (smaller_thryvar(X,Y) in next(s0)). Proof:
    Suppose_not(x,y) ==> AUTO
	Use_def(next) ==> (x in (s0 + {s0})) & (y in (s0 + {s0})) & (smaller_thryvar(x,y) notin (s0 + {s0}))
        Suppose ==> (x = s0) or (y = s0)
        Use_def(smaller_thryvar) ==> false; Discharge ==> (x in s0) & (y in s0)
    (x,y)-->Tlinear_order_6 ==> false; Discharge ==> QED
--
--
--
Theorem linear_order_11: (s0 in next(s0)) & (FORALL x,y,z | ((x in next(s0)) & (y in next(s0)) & (z in next(s0))) imp (smaller_thryvar(x,smaller_thryvar(y,z)) = smaller_thryvar(smaller_thryvar(x,y),z))) &
	(FORALL x,y | ((x in next(s0)) & (y in next(s0))) imp (smaller_thryvar(x,y) = smaller_thryvar(y,x))). Proof:
Suppose_not ==> AUTO
	Use_def(next) ==> s0 in next(s0)
	Suppose ==> Stat1: not(FORALL x,y | ((x in next(s0)) & (y in next(s0))) imp (smaller_thryvar(x,y) = smaller_thryvar(y,x)))
		(x0,y0)-->Stat1(Stat1*) ==> smaller_thryvar(x0,y0) /= smaller_thryvar(y0,x0)
	(x0,y0)-->Tlinear_order_3 ==> false; Discharge ==> Stat2: not(FORALL x,y,z | ((x in next(s0)) & (y in next(s0)) & (z in next(s0))) imp (smaller_thryvar(x,smaller_thryvar(y,z)) = smaller_thryvar(smaller_thryvar(x,y),z)))
	(x,y,w)-->Stat2 ==> smaller_thryvar(x,smaller_thryvar(y,w)) /= smaller_thryvar(smaller_thryvar(x,y),w)
(x,y,w)-->Tlinear_order_9 ==> false; Discharge ==> QED
--
-- We have now derived all that is necessary to apply our general 'theory of Sigma' to the binary operation $smaller_thryvar$.
-- Doing so, we can conclude immediately that the $smaller_thryvar$ operation extends to an operator $min_over_thryvar$
-- defined on all finite mappings with values in the linearly ordered set $next(s0)$, and that this
-- operation maps every subset of $s0$ into an element of $s0$.
--
APPLY(sigma_thryvar:min_over_thryvar) sigma_theory(s->next(s0),pluz(i,j)->smaller_thryvar(i,j),e->s0) ==>
Theorem linear_order_12: (FORALL f | (Finite(f) & (range(f) incin next(s0))) imp (min_over_thryvar(f) in next(s0))) &
	(FORALL x | (cdr(x) in next(s0)) imp (min_over_thryvar({x}) = cdr(x))) &
	(FORALL f,t | (Finite(f) & Is_map(f) & (range(f) incin next(s0))) imp (min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f ON (domain(f) * t)),min_over_thryvar(f ON (domain(f) - t))))) &
	(FORALL c,f | ((c in f) & Finite(f) & (range(f) incin next(s0))) imp (min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f - {c}),cdr(c))))
--
Theorem linear_order_13: (Svm(F) & (range(F) incin s0) & Finite(F)) imp
	(((P in F) imp (min_over_thryvar({P}) = (F~[car(P)]))) &
	 (min_over_thryvar(F) = smaller_thryvar(min_over_thryvar(F ON (domain(F) * A)),min_over_thryvar(F ON (domain(F) - A))))). Proof:
Suppose_not(f,p,a) ==> AUTO
	Use_def(next) ==> Stat1: Svm(f) & (range(f) incin next(s0)) & Finite(f)
	Tlinear_order_12 ==> Stat2: (FORALL x | (cdr(x) in next(s0)) imp (min_over_thryvar({x}) = cdr(x))) &
		Stat3: (FORALL f,a | (Finite(f) & Is_map(f) & (range(f) incin next(s0))) imp (min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f ON (domain(f) * a)),min_over_thryvar(f ON (domain(f) - a)))))
	Use_def(Svm) ==> Is_map(f)
	Suppose ==> Stat4: not((p in f) imp (min_over_thryvar({p}) = (f~[car(p)])))
		(p,f)-->T61(Stat4,Stat1*) ==> cdr(p) in next(s0)
		p-->Stat2(Stat4*) ==> min_over_thryvar({p}) = cdr(p)
		(f,p)-->T74(Stat1,Stat4*) ==> cdr(p) = (f~[car(p)])
	(Stat4*)Discharge ==> min_over_thryvar(f) /= smaller_thryvar(min_over_thryvar(f ON (domain(f) * a)),min_over_thryvar(f ON (domain(f) - a)))
(f,a)-->Stat3(Stat1*) ==> false; Discharge ==> QED
--
-- We can sharpen the preceding theorem by asserting that for each non-null finite mapping $f$ to which
-- it applies, $min_over_thryvar$ is actually a member of $range(f)$.
--
Theorem linear_order_14: (Svm(F) & (range(F) incin s0) & Finite(F) & (F /= 0)) imp
	(min_over_thryvar(F) in range(F)). Proof:
Suppose_not(f1) ==> AUTO
--
-- Reasoning by contradiction, let us assume that a
-- counterexample $f$ to the statement of this theorem exists.
-- Without loss of generality, we may assume that $f$
-- is inclusion-minimal among the counterexamples.
--
        APPLY(m1_thryvar:f) finite_induction(n->f1,P(f)->(Svm(f) & (range(f) incin s0) & Finite(f) & (f /= 0) & (min_over_thryvar(f) notin range(f)))) ==>
                Stat1: (Svm(f) & (range(f) incin s0) & Finite(f) & (f /= 0) & (min_over_thryvar(f) notin range(f))) &
		Stat2: (FORALL k incin f | (k /= f) imp (not(Svm(k) & (range(k) incin s0) & Finite(k) & (k /= 0) & (min_over_thryvar(k) notin range(k)))))
	(arb(f),f)-->T61(Stat1) ==> Stat3: (arb(f) in f) & (cdr(arb(f)) in range(f))
	(f,arb(f))-->T74(Stat1*) ==> (f~[car(arb(f))]) in range(f)
--
-- By recourse to the Theorem linear_order_13, we easily discard the possibility that
-- $f$ is singleton; but then, if we remove from $f$ its element $arb(f)$, we get a
-- mapping whose $min_over_thryvar$ is, by the assumed minimality of $min_over_thryvar$,
-- a member of $range(f)$. For  $f$, the operation $min_over_thryvar$ yields the value
--	$smaller_thryvar(min_over_thryvar(f - arb(f)),cdr(arb(f)))$
-- which, being the smaller of two members of $range(f)$, will coincide with one of the two,
-- and hence must belong to $range(f)$ in its turn. This conflicts with the initial hypothesis,
-- a contradiction which leads us to the desired conclusion.
--
	Suppose ==> f = {arb(f)}
--?		(f,arb(f))-->Tlinear_order_13(Stat1*) ==> min_over_thryvar({arb(f)}) = (f~[car(arb(f))])
		(f,s0,arb(f))-->Tlinear_order_13(Stat1*) ==> min_over_thryvar({arb(f)}) = (f~[car(arb(f))])
	EQUAL(Stat1) ==> false; Discharge ==> (f - {arb(f)}) /= 0
	Use_def(next)(Stat1*) ==> range(f) incin next(s0)
	Tlinear_order_12(Stat1*) ==> Stat4: (FORALL c,f | ((c in f) & Finite(f) & (range(f) incin next(s0))) imp (min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f - {c}),cdr(c))))
	(arb(f),f)-->Stat4(Stat1*) ==> Stat5: min_over_thryvar(f) = smaller_thryvar(min_over_thryvar(f - {arb(f)}),cdr(arb(f)))
	(f - {arb(f)})-->Stat2(Stat1*) ==> Stat6: not(Svm(f - {arb(f)}) & (range(f - {arb(f)}) incin s0) & Finite(f - {arb(f)}) & (min_over_thryvar(f - {arb(f)}) notin range(f - {arb(f)})))
	(f - {arb(f)},f)-->T53(Stat1,Stat6*) ==> Stat7: not((range(f - {arb(f)}) incin s0) & Finite(f - {arb(f)}) & (min_over_thryvar(f - {arb(f)}) notin range(f - {arb(f)})))
	(f - {arb(f)},f)-->T65(Stat1,Stat7*) ==> Stat8: range(f - {arb(f)}) incin range(f)
	(f,f - {arb(f)})-->T189(Stat1,Stat7,Stat8*) ==> Stat9: min_over_thryvar(f - {arb(f)}) in range(f)
(min_over_thryvar(f - {arb(f)}),cdr(arb(f)))-->Tlinear_order_6(Stat9,Stat1,Stat5,Stat3*) ==> false; Discharge ==> QED
--
Theorem linear_order_15: ({X,Y} incin s0) imp ((smaller_thryvar(X,Y) = X) eq (arg1_bef_arg2(X,Y) or (X = Y))). Proof:
    Suppose_not(x,y) ==> ({x,y} incin s0) & ((smaller_thryvar(x,y) /= x) eq (arg1_bef_arg2(x,y) or (x = y)))
        Suppose ==> arg1_bef_arg2(x,y) or (x = y)
        (x,y)-->Tlinear_order_7 ==> false; Discharge ==> smaller_thryvar(x,y) = x
    Use_def(smaller_thryvar) ==> false; Discharge ==> QED
--
-- The following definition of the upper bounds of a set $t$
-- takes into account only the part of $t$ which consists of elements of
-- the domain $s0$ underlying the present theory.
--
Def 10033: [Upper bounds] ubs_thryvar(T) := {x in s0 | (FORALL y in (T * s0) | smaller_thryvar(y,x) = y)}
--
-- The maximum of a set $t$ is the upper bound of $t$ ---if any--- which
-- belongs to $t$. If there is no such element, we conventionally take
-- the domain $s0$ underlying the present theory as the maximum.
--
Def 10034: [Maximum of a set] max_thryvar(T) := arb({s0} + (T * ubs_thryvar(T)))
--
-- In a way similar to the maximum, we conventionally take the least upper
-- bound of a set $t$, when none proper exists, to be $s0$.
--
Def 10035: [Least upper bound of a set] lub_thryvar(T) := arb({s0} + {x in ubs_thryvar(T) | ubs_thryvar(T) incin ubs_thryvar({x})})
--
-- It readily follows from the definitions that the upper bounds of $0$
-- form the entire $s0$ (which also equals the conventional maximum of $0$).
--
Theorem linear_order_16: (ubs_thryvar(0) = s0) & (max_thryvar(0) = s0). Proof:
    Suppose_not ==> (ubs_thryvar(0) /= s0) or (max_thryvar(0) /= s0)
        Use_def(max_thryvar) ==> Stat1: ubs_thryvar(0) /= s0
        c-->Stat1 ==> (c in ubs_thryvar(0)) eq (c notin s0)
        Use_def(ubs_thryvar) ==> (c in {x in s0 | (FORALL y in (0 * s0) | smaller_thryvar(y,x) = y)}) eq (c notin s0)
        Suppose ==> Stat2: c in {x in s0 | (FORALL y in (0 * s0) | smaller_thryvar(y,x) = y)}
        ()-->Stat2 ==> false; Discharge ==> Stat3: (c notin {x in s0 | (FORALL y in (0 * s0) | smaller_thryvar(y,x) = y)})
        ()-->Stat3 ==> Stat4: not(FORALL y in (0 * s0) | smaller_thryvar(y,c) = y)
    y-->Stat4 ==> false; Discharge ==> QED
--
-- As defined above, the set of upper bounds and the maximum of any set $t$
-- do not depend on those elements of $t$ which lie outside $s0$.
--
Theorem linear_order_17: (ubs_thryvar(T) incin s0) & (ubs_thryvar(T) = ubs_thryvar(T * s0)) & (max_thryvar(T) = max_thryvar(T * s0)). Proof:
    Suppose_not(t) ==> (not(ubs_thryvar(t) incin s0)) or (ubs_thryvar(t) /= ubs_thryvar(t * s0)) or (max_thryvar(t) /= max_thryvar(t * s0))
        Use_def(ubs_thryvar) ==> ubs_thryvar(t) = {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)}
        Suppose ==> Stat1: not({x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)} incin s0)
        c-->Stat1 ==> (c notin s0) & Stat2: (c in {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)})
        ()-->Stat2 ==> false; Discharge ==> Stat3: (ubs_thryvar(t) incin s0) & ((ubs_thryvar(t) /= ubs_thryvar(t * s0)) or (max_thryvar(t) /= max_thryvar(t * s0)))
        Suppose ==> Stat4: ubs_thryvar(t) /= ubs_thryvar(t * s0)
            Use_def(ubs_thryvar) ==> {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)} /= {x in s0 | (FORALL y in ((t * s0) * s0) | smaller_thryvar(y,x) = y)}
            TELEM ==> t * s0 = (t * s0) * s0
        EQUAL(Stat4) ==> false; Discharge ==> Stat5: (ubs_thryvar(t) = ubs_thryvar(t * s0)) & (max_thryvar(t) /= max_thryvar(t * s0))
        Use_def(max_thryvar)(Stat3,Stat5) ==> (arb({s0} + (t * ubs_thryvar(t))) /= arb({s0} + ((t * s0) * ubs_thryvar(t * s0)))) & (t * ubs_thryvar(t)) = ((t * s0) * ubs_thryvar(t * s0))
    EQUAL(Stat5) ==> false; Discharge ==> QED
--
-- Every non-null finite subset $t$ of $s0$ is endowed with maximum.
-- Such maximum belongs to $t$ and exceeds every other element of $t$.
--
Theorem linear_order_18: (Finite(T) & (X in T) & (T incin s0)) imp ((max_thryvar(T) in T) & ((X = max_thryvar(T)) or (arg1_bef_arg2(X,max_thryvar(T))))). Proof:
    Suppose_not(t0,x0) ==> Stat1: Finite(t0) & (x0 in t0) & (t0 incin s0) & (not((max_thryvar(t0) in t0) & ((x0 = max_thryvar(t0)) or (arg1_bef_arg2(x0,max_thryvar(t0))))))
--
-- For, if not, then we could take an inclusion-minimal $t$ for which
-- an $x1$ exists violating the statement.
--
        Suppose ==> Stat2: (FORALL x in t0 | (max_thryvar(t0) in t0) & ((x = max_thryvar(t0)) or arg1_bef_arg2(x,max_thryvar(t0))))
        x0-->Stat2 ==> false; Discharge ==> not(FORALL x in t0 | (max_thryvar(t0) in t0) & ((x = max_thryvar(t0)) or arg1_bef_arg2(x,max_thryvar(t0))))
        APPLY(m1_thryvar:t) finite_induction(n->t0,P(k)->(not(FORALL x in k | (max_thryvar(k) in k) & ((x = max_thryvar(k)) or arg1_bef_arg2(x,max_thryvar(k)))))) ==>
		(t incin t0) &
                Stat3: (not(FORALL x in t | (max_thryvar(t) in t) & ((x = max_thryvar(t)) or arg1_bef_arg2(x,max_thryvar(t))))) &
		Stat4: (FORALL k incin t | ((k /= t) imp (FORALL x in k | (max_thryvar(k) in k) & ((x = max_thryvar(k)) or arg1_bef_arg2(x,max_thryvar(k))))))
        x1-->Stat3 ==> (x1 in t) & ((max_thryvar(t) notin t) or ((x1 /= max_thryvar(t)) and (not arg1_bef_arg2(x1,max_thryvar(t)))))
        ELEM ==> Stat5: (t incin s0) & (x1 in t) & (x1 /= max_thryvar(t)) & ((max_thryvar(t) notin t) or (not arg1_bef_arg2(x1,max_thryvar(t))))
        (t - {x1})-->Stat4(Stat5) ==> Stat6: (FORALL x in (t - {x1}) | (max_thryvar(t - {x1}) in (t - {x1})) & ((x = max_thryvar(t - {x1})) or arg1_bef_arg2(x,max_thryvar(t - {x1}))))
--
-- Observe that $x1$ cannot be the sole member of $t$. This entails that
-- the maximum of $t - {x1}$ belongs to $t - {x1}$ and exceeds any
-- element $y$ of $t - {x1}$.
--
        Suppose ==> t = {x1}
            Suppose ==> x1 notin ubs_thryvar(t)
                Use_def(ubs_thryvar) ==> Stat7: x1 notin {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)}
                ()-->Stat7(Stat5) ==> Stat8: not(FORALL y in (t * s0) | smaller_thryvar(y,x1) = y)
                y1-->Stat8(Stat5) ==> Stat9: (y1 = x1) & (not(smaller_thryvar(y1,x1) = y1))
                EQUAL(Stat8) ==> Stat10: not(smaller_thryvar(x1,x1) = x1)
            (x1,x1)-->Tlinear_order_6(Stat5,Stat10) ==> false; Discharge ==> {x1} = (t * ubs_thryvar(t))
            Use_def(max_thryvar) ==> max_thryvar(t) = arb({s0} + (t * ubs_thryvar(t)))
            (Stat6)ELEM ==> Stat11: max_thryvar(t) = arb({s0,x1})
        (Stat11,Stat5)Discharge ==> Stat12: (t - {x1}) /= 0
        c-->Stat12(Stat12) ==> Stat13: c in (t - {x1})
        c-->Stat6(Stat13) ==> Stat14: max_thryvar(t - {x1}) in (t - {x1})
        Use_def(max_thryvar) ==> Stat15: max_thryvar(t - {x1}) = arb({s0} + ((t - {x1}) * ubs_thryvar(t - {x1})))
        (Stat5,Stat14,Stat15)ELEM ==> max_thryvar(t - {x1}) in ubs_thryvar(t - {x1})
        Use_def(ubs_thryvar) ==> Stat16: max_thryvar(t - {x1}) in {x in s0 | (FORALL y in ((t - {x1}) * s0) | smaller_thryvar(y,x) = y)}
        ()-->Stat16(Stat16) ==> Stat17: (FORALL y in ((t - {x1}) * s0) | smaller_thryvar(y,max_thryvar(t - {x1})) = y)
--
-- In view of thrichotomy, we need to consider only two cases:
-- either $arg1_bef_arg2(x1,max_thryvar(t))$ or $arg1_bef_arg2(max_thryvar(t),x1)$.
--
        Assump ==> Stat18: (FORALL x in  s0, y in s0 | arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x))
        (x1,max_thryvar(t - {x1}))-->Stat18(Stat5,Stat14) ==> arg1_bef_arg2(x1,max_thryvar(t - {x1})) or arg1_bef_arg2(max_thryvar(t - {x1}),x1)
        Use_def(max_thryvar) ==> Stat19: max_thryvar(t) = arb({s0} + (t * ubs_thryvar(t)))
--
-- Assuming that $x1$ is smaller than the maximum of $t - {x1}$, we derive
-- that this maximum is also the maximum of $t$, which leads to a contradiction.
--
        Suppose ==> Stat20: arg1_bef_arg2(x1,max_thryvar(t - {x1}))
            Suppose ==> Stat21: not(FORALL y in (t * s0) | smaller_thryvar(y,max_thryvar(t - {x1})) = y)
                y2-->Stat21(Stat21) ==> Stat22: (y2 in (t * s0)) & (smaller_thryvar(y2,max_thryvar(t - {x1})) /= y2)
                Suppose ==> y2 in t - {x1}
                y2-->Stat17(Stat17) ==> false; Discharge ==> y2 = x1
                EQUAL(Stat22) ==> Stat23: smaller_thryvar(x1,max_thryvar(t - {x1})) /= x1
                Use_def(smaller_thryvar) ==> Stat24: smaller_thryvar(x1,max_thryvar(t - {x1})) = if (x1 notin s0) & (max_thryvar(t - {x1}) notin s0) then s0
                        elseif (x1 notin s0) then max_thryvar(t - {x1})
 			elseif (max_thryvar(t - {x1}) notin s0) then x1
       			elseif arg1_bef_arg2(x1,max_thryvar(t - {x1})) then x1 else max_thryvar(t - {x1}) end if
            (Stat24,Stat5,Stat14,Stat20,Stat23)Discharge ==> Stat25: (FORALL y in (t * s0) | smaller_thryvar(y,max_thryvar(t - {x1})) = y)
            Suppose ==> Stat26: max_thryvar(t) /= max_thryvar(t - {x1})
                Suppose ==> Stat27: max_thryvar(t - {x1}) notin (t * ubs_thryvar(t))
                    (Stat27,Stat14)ELEM ==> max_thryvar(t - {x1}) notin ubs_thryvar(t)
                    Use_def(ubs_thryvar) ==> Stat28: max_thryvar(t - {x1}) notin {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)}
                ()-->Stat28(Stat14,Stat5,Stat25) ==> false; Discharge ==> Stat29: max_thryvar(t - {x1}) in (t * ubs_thryvar(t))
                Suppose ==> Stat30: max_thryvar(t) = s0
                    (Stat5,Stat19,Stat30)ELEM ==> max_thryvar(t - {x1}) notin (t * ubs_thryvar(t))
                (Stat29)Discharge ==> max_thryvar(t) /= s0
                (Stat19)ELEM ==> Stat31: max_thryvar(t) in (t * ubs_thryvar(t))
                Use_def(ubs_thryvar) ==> Stat32: max_thryvar(t) in {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)}
                ()-->Stat32(Stat32) ==> Stat33: (FORALL y in (t * s0) | smaller_thryvar(y,max_thryvar(t)) = y)
                (max_thryvar(t - {x1}))-->Stat33(Stat33,Stat14,Stat5) ==> smaller_thryvar(max_thryvar(t - {x1}),max_thryvar(t)) = max_thryvar(t - {x1})
                (max_thryvar(t))-->Stat25(Stat31,Stat5) ==> smaller_thryvar(max_thryvar(t),max_thryvar(t - {x1})) = max_thryvar(t)
            (max_thryvar(t - {x1}),max_thryvar(t))-->Tlinear_order_3(Stat26) ==> false; Discharge ==> Stat34: max_thryvar(t) = max_thryvar(t - {x1})
            EQUAL ==> Stat35: arg1_bef_arg2(x1,max_thryvar(t))
        (Stat34,Stat35,Stat14,Stat5)Discharge ==> Stat36: arg1_bef_arg2(max_thryvar(t - {x1}),x1)
--
-- Hence the maximum of $t - {x1}$ must be smaller than $x1$,
-- and therefore $x1$ turns out to be the maximum of $t$. But this leads to a contradiction too;
-- hence we conclude that the desired statement holds.
--
        Suppose ==> Stat37: not(FORALL y in (t * s0) | smaller_thryvar(y,x1) = y)
            y3-->Stat37(Stat37) ==> Stat38: (y3 in t) & (smaller_thryvar(y3,x1) /= y3)
            (y3,x1)-->Tlinear_order_6(Stat38,Stat5) ==> smaller_thryvar(y3,x1) = x1
            EQUAL(Stat38) ==> x1 /= y3
            Suppose ==> Stat39: y3 in t - {x1}
                y3-->Stat17 ==> Stat40: smaller_thryvar(y3,max_thryvar(t - {x1})) = y3
                Use_def(le_thryvar) ==> Stat41: (max_thryvar(t - {x1}) le_thryvar x1)
                Use_def(smaller_thryvar) ==> Stat42: smaller_thryvar(y3,max_thryvar(t - {x1})) = if ((y3 notin s0) & (max_thryvar(t - {x1}) notin s0)) then s0
			elseif (y3 notin s0) then max_thryvar(t - {x1})
			elseif (max_thryvar(t - {x1}) notin s0) then y3 elseif
			arg1_bef_arg2(y3,max_thryvar(t - {x1})) then y3 else max_thryvar(t - {x1}) end if
                (Stat42,Stat39,Stat5,Stat14,Stat40)ELEM ==> arg1_bef_arg2(y3,max_thryvar(t - {x1})) or (y3 = max_thryvar(t - {x1}))
                Use_def(le_thryvar) ==> Stat43: (y3 le_thryvar max_thryvar(t - {x1}))
                (y3,max_thryvar(t - {x1}),x1)-->Tlinear_order_1(Stat41,Stat43,Stat39,Stat5,Stat14) ==> (y3 le_thryvar x1)
                Use_def(le_thryvar) ==> Stat44: arg1_bef_arg2(y3,x1)
                Use_def(smaller_thryvar) ==> Stat45: smaller_thryvar(y3,x1) = if ((y3 notin s0) & (x1 notin s0)) then s0
			elseif (y3 notin s0) then x1 elseif (x1 notin s0) then y3 elseif
			arg1_bef_arg2(y3,x1) then y3 else x1 end if
            (Stat45,Stat39,Stat5,Stat44,Stat38)Discharge ==> y3 = x1
        (Stat38)Discharge ==> Stat46: (FORALL y in (t * s0) | smaller_thryvar(y,x1) = y)
        Suppose ==> Stat47: max_thryvar(t) /= x1
            Suppose ==> Stat48: x1 notin (t * ubs_thryvar(t))
                (Stat48,Stat5)ELEM ==> x1 notin ubs_thryvar(t)
                Use_def(ubs_thryvar) ==> Stat49: x1 notin {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)}
            ()-->Stat49(Stat5,Stat46) ==> false; Discharge ==> Stat50: x1 in (t * ubs_thryvar(t))
            Suppose ==> Stat51: max_thryvar(t) = s0
                (Stat5,Stat19,Stat51)ELEM ==> x1 notin (t * ubs_thryvar(t))
            (Stat50)Discharge ==> max_thryvar(t) /= s0
            (Stat19)ELEM ==> Stat52: max_thryvar(t) in (t * ubs_thryvar(t))
            Use_def(ubs_thryvar) ==> Stat53: max_thryvar(t) in {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)}
            ()-->Stat32(Stat53) ==> Stat54: (FORALL y in (t * s0) | smaller_thryvar(y,max_thryvar(t)) = y)
            (x1)-->Stat54(Stat54,Stat5) ==> smaller_thryvar(x1,max_thryvar(t)) = x1
            (max_thryvar(t))-->Stat46(Stat52,Stat5) ==> smaller_thryvar(max_thryvar(t),x1) = max_thryvar(t)
        (x1,max_thryvar(t))-->Tlinear_order_3(Stat47) ==> false; Discharge ==> Stat55: max_thryvar(t) = x1
        EQUAL ==> Stat56: arg1_bef_arg2(x1,max_thryvar(t))
    (Stat55,Stat56,Stat5)Discharge ==> QED
--
Def 10036: [strict order comparison in reverse] arg1_aft_arg2(X,Y) := arg1_bef_arg2(Y,X)
--
Theorem linear_order_19: (FORALL x in  s0, y in s0, z in s0 | (arg1_aft_arg2(x,y) & arg1_aft_arg2(y,z)) imp arg1_aft_arg2(x,z)) &
    (FORALL x in s0 | not(arg1_aft_arg2(x,x))) &
    (FORALL x in  s0, y in s0 | arg1_aft_arg2(x,y) or (x = y) or arg1_aft_arg2(y,x)). Proof:
Suppose_not ==> AUTO
	Assump ==> Stat1: (FORALL x in  s0, y in s0, z in s0 | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) imp arg1_bef_arg2(x,z)) &
		Stat2: (FORALL x in s0 | not(arg1_bef_arg2(x,x))) &
		Stat3: (FORALL x in  s0, y in s0 | arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x))
	Suppose ==> Stat4: not(FORALL x in s0, y in s0, z in s0 | (arg1_aft_arg2(x,y) & arg1_aft_arg2(y,z)) imp arg1_aft_arg2(x,z))
		(x1,y1,z1)-->Stat4(Stat4*) ==> (x1 in s0) & (y1 in s0) & (z1 in s0) & arg1_aft_arg2(x1,y1) & arg1_aft_arg2(y1,z1) & (not arg1_aft_arg2(x1,z1))
		Use_def(arg1_aft_arg2)(Stat4*) ==> arg1_bef_arg2(y1,x1) & arg1_bef_arg2(z1,y1) & (not arg1_bef_arg2(z1,x1))
	(z1,y1,x1)-->Stat1(Stat4*) ==> false; Discharge ==> (FORALL x in  s0, y in s0, z in s0 | (arg1_aft_arg2(x,y) & arg1_aft_arg2(y,z)) imp arg1_aft_arg2(x,z))
	Suppose ==> Stat5: not(FORALL x in s0 | not(arg1_aft_arg2(x,x)))
		x2-->Stat5(Stat5*) ==> (x2 in s0) & arg1_aft_arg2(x2,x2)
		Use_def(arg1_aft_arg2)(Stat5*) ==> arg1_bef_arg2(x2,x2)
	x2-->Stat2(Stat5*) ==> false; Discharge ==> Stat6: not(FORALL x in  s0, y in s0 | arg1_aft_arg2(x,y) or (x = y) or arg1_aft_arg2(y,x))
	(x3,y3)-->Stat6(Stat6*) ==> (x3 in s0) & (y3 in s0) & (not(arg1_aft_arg2(x3,y3) or (x3 = y3) or arg1_aft_arg2(y3,x3)))
	Use_def(arg1_aft_arg2)(Stat6*) ==> (not(arg1_bef_arg2(y3,x3) or (x3 = y3) or arg1_bef_arg2(x3,y3)))
(y3,x3)-->Stat3(Stat6*) ==> false; Discharge ==> QED
--
APPLY(le_thryvar:ge_thryvar,smaller_thryvar:larger_thryvar,min_over_thryvar:max_over_thryvar,ubs_thryvar:lbs_thryvar,max_thryvar:min_thryvar,lub_thryvar:glb_thryvar) linear_order(s0->s0, arg1_bef_arg2(X,Y)->arg1_aft_arg2(X,Y)) ==>
Theorem linear_order_20: --? (FORALL x, y | (x ge_thryvar y) eq (arg1_aft_arg2(x,y) or (x = y))) &
	(FORALL x, y | larger_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_aft_arg2(x,y) then x else y end if) &
	(FORALL x, y | larger_thryvar(x,y) = larger_thryvar(y,x)) &
	(FORALL x, y | ({x,y} incin s0) imp (larger_thryvar(x,y) in {x,y})) &
	(FORALL x | (x in next(s0)) imp (larger_thryvar(x,s0) = x)) &
	(FORALL x, y, z | larger_thryvar(x,larger_thryvar(y,z)) = larger_thryvar(larger_thryvar(x,y),z)) &
	(FORALL x, y | ((x in next(s0)) & (y in next(s0))) imp (larger_thryvar(x,y) in next(s0))) &
	(FORALL f,p,a | (Svm(f) & (range(f) incin s0) & Finite(f)) imp
		(((p in f) imp (max_over_thryvar({p}) = (f~[car(p)]))) &
		(max_over_thryvar(f) = larger_thryvar(max_over_thryvar(f ON (domain(f) * a)),max_over_thryvar(f ON (domain(f) - a)))))) &
	(FORALL f | (Svm(f) & (range(f) incin s0) & Finite(f) & (f /= 0)) imp (max_over_thryvar(f) in range(f))) &
	(FORALL x, y | ({x,y} incin s0) imp ((larger_thryvar(x,y) = x) eq (arg1_aft_arg2(x,y) or (x = y)))) &
	(FORALL t | lbs_thryvar(t) = {x in s0 | (FORALL y in (t * s0) | larger_thryvar(y,x) = y)}) &
	(FORALL t | min_thryvar(t) = arb({s0} + (t * lbs_thryvar(t)))) &
	(FORALL t | glb_thryvar(t) = arb({s0} + {x in lbs_thryvar(t) | lbs_thryvar(t) incin lbs_thryvar({x})})) &
	(lbs_thryvar(0) = s0) & (min_thryvar(0) = s0) &
	(FORALL t | (lbs_thryvar(t) incin s0) & (lbs_thryvar(t) = lbs_thryvar(t * s0)) & (min_thryvar(t) = min_thryvar(t * s0))) &
	(FORALL t, x | (Finite(t) & (x in t) & (t incin s0)) imp ((min_thryvar(t) in t) & ((x = min_thryvar(t)) or (arg1_aft_arg2(x,min_thryvar(t))))))
--
ENTER_THEORY Set_theory
--
--DISPLAY linear_order
--
--THEORY linear_order(s0,arg1_bef_arg2(X,Y))
--    (FORALL x in s0, y in s0, z in s0 | (arg1_bef_arg2(x,y) & arg1_bef_arg2(y,z)) imp arg1_bef_arg2(x,z))
--    (FORALL x in s0 | not(arg1_bef_arg2(x,x)))
--    (FORALL x in s0, y in s0 | arg1_bef_arg2(x,y) or (x = y) or arg1_bef_arg2(y,x))
--==>(le_thryvar,smaller_thryvar,ubs_thryvar,max_thryvar,lub_thryvar)
--    (FORALL x, y | ((x le_thryvar y) eq (arg1_bef_arg2(x,y)) or (x = y)))
--    (FORALL x, y | smaller_thryvar(x,y) = if ((x notin s0) & (y notin s0)) then s0 elseif (x notin s0) then y elseif (y notin s0) then x elseif arg1_bef_arg2(x,y) then x else y end if)
--    (FORALL u, v, w | (({u,v,w} incin s0) & (u le_thryvar v) & (v le_thryvar w)) imp (u le_thryvar w))
--    (FORALL u, v | (({u,v} incin s0) & (u le_thryvar v) & (v le_thryvar u)) imp (u = v))
--    (FORALL u, v | ({u,v} incin s0) imp ((u le_thryvar v) or (v le_thryvar u)))
--    (FORALL u, v, w | ({u,v,w} incin s0) imp (((u le_thryvar v) & (u le_thryvar w)) or ((v le_thryvar u) & (v le_thryvar w)) or ((w le_thryvar u) & (w le_thryvar v))))
--    (FORALL x, y | smaller_thryvar(x,y) = smaller_thryvar(y,x))
--    (FORALL x | (smaller_thryvar(x,s0) = s0) & (smaller_thryvar(s0,x) = s0))
--    (FORALL x, y | ({x,y} incin s0) imp (smaller_thryvar(x,y) in {x,y}))
--    (FORALL x, y | (({x,y} incin s0) & (arg1_bef_arg2(x,y) or (x = y))) imp ((smaller_thryvar(x,y) = x) & (smaller_thryvar(y,x) = x)))
--    (FORALL x, y | ({x,y} incin s0) imp ((smaller_thryvar(x,y) = x) eq (arg1_bef_arg2(x,y) or (x = y))))
--    (FORALL x, y, z | smaller_thryvar(x,smaller_thryvar(y,z)) = smaller_thryvar(smaller_thryvar(x,y),z))
--    (FORALL x in (s0 + {s0}), y in (s0 + {s0}) | smaller_thryvar(x,y) in (s0 + {s0}))
--    (FORALL t | ubs_thryvar(t) = {x in s0 | (FORALL y in (t * s0) | smaller_thryvar(y,x) = y)})
--    (FORALL t | max_thryvar(t) = arb({s0} + (t * ubs_thryvar(t))))
--    (FORALL t | lub_thryvar(t) = arb({s0} + {x in ubs_thryvar(t) | ubs_thryvar(t) incin ubs_thryvar({x})}))
--    (ubs_thryvar(0) = s0) & (max_thryvar(0) = s0)
--    (FORALL t | (ubs_thryvar(t) incin s0) & (ubs_thryvar(t) = ubs_thryvar(t * s0)) & (max_thryvar(t) = max_thryvar(t * s0)))
--    (FORALL t, x | (Finite(t) & (x in t) & (t incin s0)) imp ((max_thryvar(t) in t) & ((x = max_thryvar(t)) or (arg1_bef_arg2(x,max_thryvar(t))))))
--END linear_order
-- ************************************************************************************************
--							Section 12: Various other inductive principles
-- ************************************************************************************************
--
-- For subsequent use, we reformulate a few special cases of the principle of transfinite definition as THEORYs
-- that can be applied internally within the proofs of theorems.
--
THEORY transfinite_definition_0_params(g(x),h1(x))
END transfinite_definition_0_params;
--
ENTER_THEORY transfinite_definition_0_params
--
Def transfinite_definition_0_params.0a: [Function defined by a 1-parameter transfinite recursion] f_thryvar(X) := g({h1(f_thryvar(t)): t in X})
--
Theorem transfinite_definition_0_params1: [One-parameter transfinite recursive function definition] f_thryvar(X) = g({h1(f_thryvar(t)): t in X}). Proof:
	Suppose_not(x) ==> f_thryvar(x) /= g({h1(f_thryvar(t)): t in x})
	Use_def(f_thryvar) ==> f_thryvar(x) = g({h1(f_thryvar(t)): t in x})
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY transfinite_definition_0_params
--
--THEORY transfinite_definition_0_params(g(x),h1(x))
--==>(f_thryvar)
--	(FORALL x | f_thryvar(x) = g({h1(f_thryvar(t)): t in x}))
--END transfinite_definition_0_params;
--
THEORY transfinite_definition_1_params(g2(x,a),h(x,a))
END transfinite_definition_1_params;
--
ENTER_THEORY transfinite_definition_1_params
--
Def transfinite_definition_1_params.0a: [Function defined by a transfinite recursion with supplementary parameter] f2_thryvar(X,A) := g2({h(f2_thryvar(t,A),A): t in X},A)
--
Theorem transfinite_definition_1_params1: [Recursive transfinite function definition with auxilliary parameter] f2_thryvar(X,A) = g2({h(f2_thryvar(t,A),A): t in X},A). Proof:
	Suppose_not(x,a) ==> f2_thryvar(x,a) /= g2({h(f2_thryvar(t,a),a): t in x},a)
	Use_def(f2_thryvar) ==> f2_thryvar(x,a) = g2({h(f2_thryvar(t,a),a): t in x},a)
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY transfinite_definition_1_params
--
--THEORY transfinite_definition_1_params(g2(x,a),h(x,a))
--==>(f2_thryvar)
--	(FORALL x,a | f2_thryvar(x,a) = g2({h(f2_thryvar(t),a): t in x},a))
--END transfinite_definition_1_params;
--
--
-- Our next proof establishes a first, purely set-theoretic form of the well-known Zorn's Lemma.
-- We prove that if $t$ is any collection of sets such that every subfamily of $t$
-- linearly ordered by inclusion admits an upper bound in $t$, then $t$ has an element maximal for inclusion,
-- i.e. not properly included in any other element of $t$.
--
Theorem 412: [Zorn's lemma] (FORALL x incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) imp (EXISTS w in T | (FORALL y in x | w incs y))))
		 imp (EXISTS y in T | (FORALL x in T | not ((x incs y) & (x /= y)))). Proof:
	Suppose_not(t) ==> Stat1: (FORALL x incin t | ((FORALL u in x,v in x | (u incs v or v incs u)) imp (EXISTS w in t | (FORALL y in x | w incs y))))
			& Stat2: (not (EXISTS y in t | (FORALL x in t | not ((x incs y) & (x /= y)))))
--
-- For supposing the contrary, we can define a mapping of $t$ into $t$ which sends each element of $t$ into a strictly larger element,
-- and also a mapping of every subset of $t$ linearly ordered by inclusion into an upper bound for it in $t$.
--
	Loc_def ==> larger = {[x,arb({y in t | ((y incs x) & (y /= x))})]: x in t}
	APPLY() fcn_symbol(f(x)->arb({y in t | ((y incs x) & (y /= x))}),g->larger,s->t) ==>
		Svm(larger) & Stat3: (FORALL x | larger~[x] = if x in t then arb({y in t | ((y incs x) & (y /= x))}) else 0 end if)
	Loc_def ==> upper_bound = {[x,arb({y in t | (FORALL u in x | y incs u)})]: x in pow(t)}
	APPLY() fcn_symbol(f(x)->arb({y in t | (FORALL u in x | y incs u)}),g->upper_bound,s->pow(t)) ==>
		Svm(upper_bound) & Stat4: (FORALL x | upper_bound~[x] = if x in pow(t) then arb({y in t | (FORALL u in x | y incs u)}) else 0 end if)
	Loc_def ==> s = Un(t)
--
-- Now we use the functions 'upper_bound' and 'larger' to introduce the following (recursively defined) function,
-- which we will then show maps each ordinal into $t$, and is strictly monotone increasing.
--
	APPLY(f_thryvar:Zo) transfinite_definition_0_params(g(x)->larger~[upper_bound~[x]],h1(x)->x) ==>
		Stat5: (FORALL x | Zo(x) = larger~[upper_bound~[{Zo(y): y in x}]])
	Suppose ==> Stat6: (EXISTS x | Ord(x) & (Zo(x) notin t or (EXISTS u in x | not((Zo(x) incs Zo(u)) & (Zo(x) /= Zo(u))))))
--
-- For if there exists some counterexample to this last assertion, then by transfinite induction
-- there exists a smallest such counterexample $c$.
--
	d-->Stat6 ==>                                      Ord(d) & ((Zo(d) notin t) or (EXISTS u in d | not((Zo(d) incs Zo(u)) & (Zo(d) /= Zo(u)))))
	APPLY(mt1_thryvar:c) transfinite_induction(n->d,P(x)->(Ord(x) & ((Zo(x) notin t) or (EXISTS u in x | not((Zo(x) incs Zo(u)) & (Zo(x) /= Zo(u))))))) ==>
	       Stat7: (FORALL x      |                     (Ord(c) & ((Zo(c) notin t) or (EXISTS u in c | not((Zo(c) incs Zo(u)) & (Zo(c) /= Zo(u)))))) &
		                      ((x in c) imp    (not(Ord(x) & ((Zo(x) notin t) or (EXISTS u in x | not((Zo(x) incs Zo(u)) & (Zo(x) /= Zo(u)))))))))
	0-->Stat7 ==> (Ord(c) & ((Zo(c) notin t) or (EXISTS u in c | not((Zo(c) incs Zo(u)) & (Zo(c) /= Zo(u))))))
        Suppose ==> Stat8: not(FORALL x in c | not (Ord(x) & ((Zo(x) notin t) or (EXISTS u in x | not((Zo(x) incs Zo(u)) & (Zo(x) /= Zo(u)))))))
            x0-->Stat8 ==> (x0 in c) & Ord(x0) & ((Zo(x0) notin t) or (EXISTS u in x0 | not((Zo(x0) incs Zo(u)) & (Zo(x0) /= Zo(u)))))
	x0-->Stat7 ==> false; Discharge ==> Stat9: (FORALL x in c | not (Ord(x) & ((Zo(x) notin t) or (EXISTS u in x | not((Zo(x) incs Zo(u)) & (Zo(x) /= Zo(u)))))))
--
-- For this minimal counterexample $c$, the set ${Zo(y): y in c}$ must be a collection of subsets of $t$
-- and must be linearly ordered by inclusion.
--
	Suppose ==> Stat10: not (t incs {Zo(y): y in c})
	x1-->Stat10 ==> Stat11: (x1 in {Zo(y): y in c}) & (x1 notin t)
	y1-->Stat11 ==> (y1 in c) & (x1 = Zo(y1))
	y1-->Stat9 ==> not(Ord(y1) & (Zo(y1) notin t))
	(c,y1)-->T12 ==> Ord(y1)
	(Stat11)Discharge ==> t incs {Zo(y): y in c}
	Suppose ==> Stat12: not(FORALL u in {Zo(y): y in c},v in {Zo(y): y in c} | (u incs v or v incs u))
	(a,b)-->Stat12 ==> Stat13: (a in {Zo(y): y in c}) & (b in {Zo(y): y in c}) & (not(a incs b or b incs a))
	(o1,o2)-->Stat13 ==> Stat14: (o1 in c) & (o2 in c) & (not (Zo(o1) incs Zo(o2) or Zo(o2) incs Zo(o1)))
	(c,o1)-->T12 ==> Ord(o1)
	(c,o2)-->T12 ==> Ord(o2)
	o1-->Stat9 ==> Stat15: not(EXISTS u in o1 | not((Zo(o1) incs Zo(u)) & (Zo(o1) /= Zo(u))))
	o2-->Stat9 ==> Stat16: not(EXISTS u in o2 | not((Zo(o2) incs Zo(u)) & (Zo(o2) /= Zo(u))))
	(o1,o2)-->T31 ==> o1 in o2 or o2 in o1 or o1 = o2
	Suppose ==> o1 = o2
	EQUAL ==> Zo(o1) = Zo(o2)
	(Stat14)Discharge ==> o1 in o2 or o2 in o1
	Suppose ==> o2 in o1
	o2-->Stat15 ==> false; Discharge ==> o1 in o2
	o1-->Stat16 ==> false; Discharge ==> (FORALL u in {Zo(y): y in c},v in {Zo(y): y in c} | (u incs v or v incs u))
--
-- Thus, by definition, ${Zo(y): y in c}$ must have an upper bound $cb$ which is a subset of $t$, and therefore
-- by the axiom of choice $upper_bound~[{Zo(z1): z1 in c}]$ must belong to $t$ and include every element of ${Zo(y): y in c}$.
--
	({Zo(z1): z1 in c})-->Stat1 ==> Stat17: (EXISTS w in t | (FORALL y in {Zo(z1): z1 in c} | w incs y))
	cb-->Stat17 ==>(cb in t) & (FORALL y in {Zo(z1): z1 in c} | cb incs y)
	({Zo(z1): z1 in c})-->Stat4 ==> upper_bound~[{Zo(z1): z1 in c}] =
			if {Zo(z1): z1 in c} in pow(t) then arb({y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)}) else 0 end if
	Suppose ==> {Zo(z1): z1 in c} notin pow(t)
	Use_def(pow) ==> Stat18: {Zo(z1): z1 in c} notin {x: x incin t}
	({Zo(z1): z1 in c})-->Stat18 ==> false; Discharge ==>
			upper_bound~[{Zo(z1): z1 in c}] = arb({y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)})
	Suppose ==> Stat19: {y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)} = 0
	cb-->Stat19 ==> false; Discharge ==> {y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)} /= 0
	({y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)})-->T0 ==>
		arb({y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)}) in {y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)}
	(Stat17)ELEM ==> Stat20: upper_bound~[{Zo(z1): z1 in c}] in {y in t | (FORALL u in {Zo(z1): z1 in c} | y incs u)}
	()-->Stat20 ==> (upper_bound~[{Zo(z1): z1 in c}] in t) &
					Stat21: (FORALL u in {Zo(z1): z1 in c} | upper_bound~[{Zo(z1): z1 in c}] incs u)
--
-- It follows by a second use of the axiom of choice that $larger~[upper_bound~[{Zo(z1): z1 in c}]] = Zo(c)$ is an element of $t$
-- properly including every element of ${Zo(y): y in c}$. This refutes our earlier supposition, and so
-- lets us conclude that $Zo$ sends ordinals into $t$ and is strictly monotone increasing.
--
	(upper_bound~[{Zo(z1): z1 in c}])-->Stat3 ==> larger~[upper_bound~[{Zo(z1): z1 in c}]] = arb({y in t |
						((y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}]))})
	(upper_bound~[{Zo(z1): z1 in c}])-->Stat2 ==> Stat22: not (FORALL x in t |
						not ((x incs upper_bound~[{Zo(z1): z1 in c}]) & (x /= upper_bound~[{Zo(z1): z1 in c}])))
	cu-->Stat22 ==> (cu in t) & (cu incs upper_bound~[{Zo(z1): z1 in c}]) & (cu /= upper_bound~[{Zo(z1): z1 in c}])
	Suppose ==> Stat23: {y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])} = 0
	cu-->Stat23 ==> false; Discharge ==> {y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])} /= 0
	({y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])})-->T0 ==>
		arb({y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])}) in
			{y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])}
	(Stat20)ELEM ==> larger~[upper_bound~[{Zo(z1): z1 in c}]] in {y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])}
	c-->Stat5 ==> Stat24: Zo(c) in {y in t | (y incs upper_bound~[{Zo(z1): z1 in c}]) & (y /= upper_bound~[{Zo(z1): z1 in c}])}
	()-->Stat24 ==> (Zo(c) in t) &  (Zo(c) incs upper_bound~[{Zo(z1): z1 in c}]) & (Zo(c) /= upper_bound~[{Zo(z1): z1 in c}])
	ELEM ==> Stat25: (EXISTS u in c | not((Zo(c) incs Zo(u)) & (Zo(c) /= Zo(u))))
	cv-->Stat25 ==> (cv in c) & (not((Zo(c) incs Zo(cv)) & (Zo(c) /= Zo(cv))))
	(Stat22)ELEM ==> not(upper_bound~[{Zo(z1): z1 in c}] incs Zo(cv))
	(Zo(cv))-->Stat21 ==> Stat26: Zo(cv) notin {Zo(z1): z1 in c}
	cv-->Stat26 ==> false; Discharge ==>
			Stat27: not(EXISTS x | Ord(x) & (Zo(x) notin t or (EXISTS u in x | not((Zo(x) incs Zo(u)) & (Zo(x) /= Zo(u))))))
--
-- Thus $Zo$ is a 1-1 map of all ordinals into the set $t$, a thing impossible.
-- The easiest way of seeing this is to consider the restriction of $Zo$ to an ordinal
-- greater than the cardinality of $t$, for example to $#pow(t)$; this can certainly have no
-- 1-1 map into $t$, giving a contradiction which proves our assertion.
--
	t-->T265 ==> #t in #pow(t)
	t-->T147 ==> Ord(#t)
	(pow(t))-->T147 ==> Ord(#pow(t))
	APPLY(x9_thryvar:o3,y9_thryvar:o4) fcn_symbol(g->{[x,Zo(x)]: x in #pow(t)},f(x)->Zo(x),s->#pow(t)) ==>
	 	(domain({[x,Zo(x)]: x in #pow(t)}) = #pow(t)) & (range({[x,Zo(x)]: x in #pow(t)}) = {Zo(x): x in #pow(t)}) &
	 	(((o3 in #pow(t)) & (o4 in #pow(t)) & (Zo(o3) = Zo(o4)) & (o3 /= o4)) or one_1_map({[x,Zo(x)]: x in #pow(t)}))
	Suppose ==> not one_1_map({[x,Zo(x)]: x in #pow(t)})
	ELEM ==> (o3 in #pow(t)) & (o4 in #pow(t)) & (Zo(o3) = Zo(o4)) & (o3 /= o4)
	(#pow(t),o3)-->T12 ==> Ord(o3)
	(#pow(t),o4)-->T12 ==> Ord(o4)
	(o3,o4)-->T31 ==> o3 in o4 or o4 in o3
	Suppose ==> o3 in o4
	o4-->Stat27 ==> Stat28: not (EXISTS u in o4 | not((Zo(o4) incs Zo(u)) & (Zo(o4) /= Zo(u))))
	o3-->Stat28 ==> false; Discharge ==> o4 in o3
	o3-->Stat27 ==> Stat29: not (EXISTS u in o3 | not((Zo(o3) incs Zo(u)) & (Zo(o3) /= Zo(u))))
	o4-->Stat29 ==> false; Discharge ==> one_1_map({[x,Zo(x)]: x in #pow(t)})
	Suppose ==> not (t incs range({[x,Zo(x)]: x in #pow(t)}))
	ELEM ==> Stat30: not (t incs {Zo(x): x in #pow(t)})
	e-->Stat30 ==> Stat31: (e in {Zo(x): x in #pow(t)}) & (e notin t)
	e2-->Stat31 ==> (e2 in #pow(t)) & (e = Zo(e2))
	(#pow(t),e2)-->T12 ==> Ord(e2)
	e2-->Stat27 ==> false; Discharge ==> t incs range({[x,Zo(x)]: x in #pow(t)})
	(range({[x,Zo(x)]: x in #pow(t)}),t)-->T170 ==> #t incs #range({[x,Zo(x)]: x in #pow(t)})
	({[x,Zo(x)]: x in #pow(t)})-->T157 ==> #t incs #domain({[x,Zo(x)]: x in #pow(t)})
    EQUAL ==> #t incs ##pow(t)
    (pow(t))-->T166 ==> false; Discharge ==> QED
--
--
-- The following corollary of the preceding theorem shows that if $s$ is any member of a family $t$ of sets
-- sets satisfying the hypotheses of that theorem, then $s$ is contained in an element of $t$ maximal in $t$.
--
Theorem 413: [Zorn's lemma generalized form] (FORALL x incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) imp (EXISTS w in T | (FORALL y in x | w incs y))))
		 imp (FORALL u in T | (EXISTS y in T | (y incs u) & (FORALL x in T | not ((x incs y) & (x /= y))))). Proof:
	Suppose_not(t) ==> Stat1: (FORALL x incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) imp
				(EXISTS w in T | (FORALL y in x | w incs y)))) &
						Stat2: (not (FORALL u in t | (EXISTS y in t | (y incs u) & (FORALL x in t | not ((x incs y) & (x /= y))))))
--
-- For suppose that $u in t$ contradicts the conclusion of our theorem, and consider the subset $tt$ of all elements of $t$
-- which contain $u$. It is clear that every collection of subsets of $tt$ linearly ordered by inclusion has an upper bound in $tt$,
-- and so by the preceding theorem $tt$ contains an element $ma$ maximal for inclusions among all the sets in $tt$.
--
	u-->Stat2 ==> (u in t) & Stat3: (not (EXISTS y in t | (y incs u) & (FORALL x in t | not ((x incs y) & (x /= y)))))
	Loc_def ==> tt = {x in t | x incs u}
	Suppose ==> Stat4: not(t incs tt)
	c-->Stat4 ==> (c notin t) & Stat5: (c in {x in t | x incs u})
	()-->Stat5 ==> false; Discharge ==> t incs tt
	Suppose ==> Stat6: not(FORALL x incin tt | ((FORALL u in x,v in x | (u incs v or v incs u)) imp (EXISTS w in tt | (FORALL y in x | w incs y))))
	d-->Stat6 ==> (d incin tt) & (FORALL u in d,v in d | (u incs v or v incs u)) & Stat7: (not(EXISTS w in tt | (FORALL y in d | w incs y)))
	d-->Stat1 ==> Stat8: (EXISTS w in t | (FORALL y in d | w incs y))
	wd-->Stat8 ==> (wd in t) & Stat9: (FORALL y in d | wd incs y)
--
-- Since $u in tt$, $d$ cannot be null, from which it is easily seen that $wd$ must contain $u$, and so $wd in tt$,
-- Thu it follows by The0rem 332a that $tt$ has an element $wa$ maximal (for inclusion) in
--
	Suppose ==> u notin tt
	ELEM ==> Stat10: u notin {x in t | x incs u}
	()-->Stat10 ==> false; Discharge ==> u in tt
	Suppose ==> d = 0
	u-->Stat7 ==> Stat11: not (FORALL y in d | u incs y)
	a-->Stat11 ==> false; Discharge ==> Stat12: d /= 0
	b-->Stat12 ==> b in d
	b-->Stat9 ==> wd incs b
	ELEM ==> Stat13: b in {x in t | x incs u}
	()-->Stat13 ==> wd incs u
	Suppose ==> wd notin tt
	ELEM ==> Stat14: wd notin {x in t | x incs u}
	()-->Stat14 ==> false; Discharge ==> wd in tt
	wd-->Stat7 ==> false; Discharge ==>
		(FORALL x incin tt | ((FORALL u in x,v in x | (u incs v or v incs u)) imp (EXISTS w in tt | (FORALL y in x | w incs y))))
	tt-->T412 ==> Stat15: (EXISTS y in tt | (FORALL x in tt | not ((x incs y) & (x /= y))))
	ma-->Stat15 ==> (ma in tt) & Stat16: (FORALL x in tt | not ((x incs ma) & (x /= ma)))
--
-- But it is easily seen that $ma$ is maximal in the whole collection $t$, and so our theorem is proved.
--
	ma-->Stat3 ==> not ((ma incs u) & (FORALL x in t | not ((x incs ma) & (x /= ma))))
	ELEM ==> Stat17: ma in {x in t | x incs u}
	()-->Stat17 ==> ma incs u
	ELEM ==> Stat18: not (FORALL x in t | not ((x incs ma) & (x /= ma)))
	e-->Stat18 ==> (e in t) & (e incs ma) & (e /= ma)
	ELEM ==> e incs u
	Suppose ==> e notin tt
	ELEM ==> Stat19: e notin {x in t | x incs u}
	()-->Stat19 ==> false; Discharge ==> e in tt
    e-->Stat16 ==> false; Discharge ==> QED
--
-- Next we note a special case common in applications of Theorem 413, namely that in which the union of any
-- linearly ordered collection of elements of $t$ is a subset of $t$.
--
Theorem 414: [Zorn's lemma for union-closed collections] (FORALL x incin T | ((FORALL u in x,v in x | (u incs v or v incs u)) imp (Un(x) in T)))
		 imp (FORALL u in T | (EXISTS y in T | (y incs u) & (FORALL x in T | not ((x incs y) & (x /= y))))). Proof:
	Suppose_not(t) ==> Stat1: (FORALL x incin t | ((FORALL u in x,v in x | (u incs v or v incs u)) imp (Un(x) in t))) &
 			(not (FORALL u in t | (EXISTS y in t | (y incs u) & (FORALL x in t | not ((x incs y) & (x /= y))))))
--
-- For given any subcollection of $t$ linearly ordered by inclusion, $Un(t)$ plainly includes all the sets in $t$,
-- and so our present assertion follows immediately from the preceding theorem.
--
	T413 ==> Stat2: not (FORALL x incin t | ((FORALL u in x,v in x | (u incs v or v incs u)) imp (EXISTS w in t | (FORALL y in x | w incs y))))
	a-->Stat2 ==> (a incin t) & (FORALL u in a,v in a | (u incs v or v incs u)) & Stat3: (not (EXISTS w in t | (FORALL y in a | w incs y)))
	a-->Stat1 ==> Un(a) in t
	(Un(a))-->Stat3 ==> Stat4: not(FORALL y in a | Un(a) incs y)
	b-->Stat4 ==> (b in a) & Stat5: (not(Un(a) incs b))
	c-->Stat5 ==> (c in b) & (c notin Un(a))
	Use_def(Un) ==> Stat6: c notin {y: x in a,y in x}
	(b,c)-->Stat6 ==> false; Discharge ==> QED
--
-- We shall now show how Theorem 414 can be used to construct a so-called 'ultrafilter' containing any given
-- set theoretic 'filter'. The definitions involved are as follows. A collection $t$ of subsets of a set $s$
-- is called a 'filter' in $s$ if (a) $0 notin t$; (b) $t$  any superset of any member of $t$ belongs to $t$;
-- (c) any  intersection of two elements of $t$ belongs to $t$. A filter in $s$ is called an 'ultrafilter' in $s$
-- if for any subset $u$ of $s$, either $u$ or $s - u$ belongs to $t$. The formal definitions are as follows:
--
Def 332a: [The predicate '$T$ is a filter on the set $S$] Filter(T,S) := (T incin pow(S)) & (0 notin T) & (FORALL x in T, y in T | x * y in T) & (FORALL x in T, y incin S | ((y incs x) imp (y in T)))
Def 332b: [The predicate '$T$ is an ultrafilter on the set $S$] Ultrafilter(T,S) := Filter(T,S) & (FORALL y incin S | (y in T or S - y in T))
--
--
-- It is easily seen that the union $Un(C)$ of any linearly ordered collection $C$ of filters in a set $S$ is also a filter in $S$.
-- Indeed, (a) since $0$ is not in any element of $C$ it is not in $Un(C)$; (b) If $x$ is a superset of an element $y$ of $Un(C)$,
-- then since $y$ must belong to some member $t$ of $C$, $x$ must also belong to $t$ and hence to $Un(C)$;
-- (c) given any two elements $A$ and $B$ of $Un(C)$, $A$ (resp. $B$) must belong to some element (i.e. filter) $FA$ (resp. $FB$) of $C$,
-- But then, since the elements of $C$ are linearly ordered by inclusion, one of the two filters $FA$ and $FB$, say $FA$, but included the other.
-- Hence $A$ and $B$ are both members of $FA$
--
-- It follows using Theorem 414 that every filter is contained in a maximal filter. But it is easily seen that a filter $t$ in $s$ is maximal
-- (among all filters in $s$) if and only if it is an ultrafilter in $s$. For if $t$ is an ultrafilter it cannot be enlarged
-- by adding any subset $x$ of $s$ not already in $t$, since $s - x$ must already belong to $t$, and thus addition of
-- $x$ would force $x * (s - x)$ = $0$ to belong to the resulting filter, which is impossible by definition of a filter.
-- Conversely, if neither $x$ nor $s - x$ belong to $t$ we can extend $t$ to the larger filter $tp$ consisting of all subsets of $s$
-- which include a set of the form $f * x$, where $f$ belongs to $t$. Indeed, it is clear that the family $tp$ of sets defined
-- in this way is closed under intersection, and that it includes any superset o any of its sets. Hence to show that $tp$ is a filter
-- we have only to show that no set of the form $f * x$ can be null. But if $f * x$ were null, we would have $(s - x) incs f$, so
-- $(s - x)$ would be a member of $t$, contrary to assumption.
--
-- The formal versions of the preceding informal arguments are as follows.
--
Theorem 415: ((FORALL t in TP | Filter(t,S)) & (FORALL u in TP, v in TP | (u incs v or v incs u))) imp  Filter(Un(TP),S). Proof:
	Suppose_not(tp,s) ==> Stat1: (FORALL t in tp | Filter(t,s)) & Stat2: (FORALL u in tp, v in tp | (u incs v or v incs u)) &
							(not Filter(Un(tp),s))
	Use_def(Filter) ==> not ((Un(tp) incin pow(s)) & (0 notin Un(tp)) & (FORALL x in Un(tp), y in Un(tp) | x * y in Un(tp)) &
							(FORALL x in Un(tp), y incin s | ((y incs x) imp (y in Un(tp)))))
	Suppose ==> Stat3: not (Un(tp) incin pow(s))
	a-->Stat3 ==> (a in Un(tp)) & (a notin pow(s))
	Use_def(Un) ==> Stat4: a in {x: y in tp, x in y}
	Use_def(pow) ==> a notin {x: x incin s}
	(b,c)-->Stat4 ==> (b in tp) & (c in b) & (a = c)
	b-->Stat1 ==> Filter(b,s)
	Use_def(Filter) ==> b incin pow(s)
	Discharge ==> Un(tp) incin pow(s)
	Suppose ==> 0 in Un(tp)
	Use_def(Un) ==> Stat5: 0 in {x: y in tp, x in y}
	(b2,c2)-->Stat5 ==> (b2 in tp) & (0 in b2)
	b2-->Stat1 ==> Filter(b2,s)
	Use_def(Filter) ==> false; Discharge ==> 0 notin Un(tp)
	Suppose ==> Stat6: not (FORALL x in Un(tp), y incin s | ((y incs x) imp (y in Un(tp))))
	(b3,c3)-->Stat6 ==> (b3 in Un(tp)) & (c3 incin s) & (c3 incs b3) & (c3 notin Un(tp))
	Use_def(Un) ==> Stat7: b3 in {x: y in tp, x in y}
	(b4,c4)-->Stat7 ==> (b4 in tp) & (b3 in b4)
	b4-->Stat1 ==> Filter(b4,s)
	Use_def(Filter) ==> Stat8: (FORALL x in b4, y incin s | ((y incs x) imp (y in b4)))
	(b3,c3)-->Stat8 ==> c3 in b4
	Use_def(Un) ==> Stat9: c3 notin {x: y in tp, x in y}
	(b4,c3)-->Stat9 ==> false; Discharge ==> Stat10: not (FORALL x in Un(tp), y in Un(tp) | x * y in Un(tp))
--
-- Thus only the third clause in the definition of 'Filter' could be false for $tp$.
-- But since the elements of $tp$ are linearly ordered by inclusion it is
-- easily seen that this clause must also be true, so $tp$ must be a filter, as asserted.
--
 	(a2,a3)-->Stat10 ==> (a2 in Un(tp)) & (a3 in Un(tp)) & (a2 * a3 notin Un(tp))
 	Use_def(Un) ==> Stat11: (a2 in {x: y in tp, x in y}) & (a3 in {x: y in tp, x in y})
 	(b5,c5,b6,c6)-->Stat11 ==> (b5 in tp) & (a2 in b5) & (b6 in tp) & (a3 in b6)
 	(b5,b6)-->Stat2 ==> b5 incs b6 or b6 incs b5
 	Suppose ==> b5 incs b6
 	ELEM ==> a3 in b5
 	b5-->Stat1 ==> Filter(b5,s)
 	Use_def(Filter) ==> Stat12: (FORALL x in b5, y in b5 | x * y in b5)
 	(a2,a3)-->Stat12 ==> a2 * a3 in b5
 	Use_def(Un) ==> Stat13: a2 * a3 notin {x: y in tp, x in y}
 	(b5,a2 * a3)-->Stat13 ==> false; Discharge ==> b6 incs b5
 	ELEM ==> a2 in b6
 	b6-->Stat1 ==> Filter(b6,s)
 	Use_def(Filter) ==> Stat14: (FORALL x in b6, y in b6 | x * y in b6)
 	(a2,a3)-->Stat14 ==> a2 * a3 in b6
 	Use_def(Un) ==> Stat15: a2 * a3 notin {x: y in tp, x in y}
 	(b6,a2 * a3)-->Stat15 ==> false; Discharge ==> QED
--
-- Next we prove the lemma, anticipated above, that a filter is maximal if and only if it is an ultrafilter.
--
Theorem 416: (S /= 0) imp ((Filter(T,S) & (FORALL x incin pow(S) | ((x incs T) & Filter(x,S)) imp (x = T))) eq Ultrafilter(T,S)). Proof:
	Suppose_not(s,t) ==> (s /= 0) & (not((Filter(t,s) & (FORALL x incin pow(s) | ((x incs t) & Filter(x,s)) imp (x = t))) eq Ultrafilter(t,s)))
--
-- For it is easily seen that an ultrafilter must be a maximal filter.
--
	Suppose ==> Ultrafilter(t,s) & (not(Filter(t,s) & (FORALL x incin pow(s) | ((x incs t) & Filter(x,s)) imp (x = t))))
	Use_def(Ultrafilter) ==> Stat1: not (FORALL x incin pow(s) | ((x incs t) & Filter(x,s)) imp (x = t))
	t2-->Stat1 ==> (t2 incin pow(s)) & (t2 incs t) & Filter(t2,s) & (t2 /= t)
	ELEM ==> Stat2: not(t incs t2)
	a-->Stat2 ==> (a in t2) and (a notin t)
	Use_def(Filter) ==> t2 incin pow(s)
	ELEM ==> a in pow(s)
	Use_def(pow) ==> Stat3: a in {x: x incin s}
	cp-->Stat3 ==> a incin s
	Use_def(Ultrafilter) ==> Stat4: (FORALL y incin s | (y in t or s - y in t))
	a-->Stat4 ==> s - a in t2
	Use_def(Filter) ==> (0 notin t2) & Stat5: (FORALL x in t2, y in t2 | x * y in t2)
	(a,s - a)-->Stat5 ==> false;  Discharge ==> (not Ultrafilter(t,s)) & Filter(t,s) &
			Stat6: (FORALL x incin pow(s) | ((x incs t) & Filter(x,s)) imp (x = t))
--
-- Thus if our theorem is false $t$ must be a maximal filter but not an ultrafilter.
--
	Use_def(Ultrafilter) ==> Stat7: not(FORALL y incin s | (y in t or s - y in t))
	c-->Stat7 ==> (c incin s) & (c notin t) & (s - c notin t)
	Loc_def ==> t3 = {x: x incin s | (EXISTS y  in t| x incs y * c)}
	Suppose ==> not Filter(t3,s)
	Use_def(Filter) ==> not((t3 incin pow(s)) & (0 notin t3) & (FORALL x in t3, y in t3 | x * y in t3) &
			(FORALL x in t3, y incin s | ((y incs x) imp (y in t3))))
	Suppose ==> Stat8: not (t3 incin pow(s))
	b-->Stat8 ==> Stat9: (b in {x: x incin s | (EXISTS y  in t| x incs y * c)}) & (b notin pow(s))
	b2-->Stat9 ==> b incin s
	Use_def(pow) ==> Stat10: b notin {x: x incin s}
	b-->Stat10 ==> false; Discharge ==> t3 incin pow(s)
	Suppose ==> Stat11: not (FORALL x in t3, y incin s | ((y incs x) imp (y in t3)))
	(b3,c3)-->Stat11 ==> Stat12: (b3 in {x: x incin s | (EXISTS y  in t | x incs y * c)}) & (c3 incin s) &
			(c3 incs b3) & Stat13: (c3 notin {x: x incin s | (EXISTS y  in t | x incs y * c)})
	b4-->Stat12 ==> (b4 incin s) & (EXISTS y in t | b4 incs y * c) & (b3 = b4)
	EQUAL ==> (b3 incin s) & Stat14: (EXISTS y in t | b3 incs y * c)
	c4-->Stat14 ==> (c4 in t) & (b3 incs c4 * c)
	c3-->Stat13 ==> Stat15: not (EXISTS y in t | c3 incs y * c)
	c4-->Stat15 ==> false; Discharge ==> (FORALL x in t3, y incin s | ((y incs x) imp (y in t3)))
	Suppose ==> Stat16: not (FORALL x in t3, y in t3 | x * y in t3)
	(b5,c5)-->Stat16 ==> Stat17: (b5 in {x: x incin s | (EXISTS y in t | x incs y * c)}) &
			Stat18: (c5 in {x: x incin s | (EXISTS y in t | x incs y * c)}) &
			Stat19: (not (b5 * c5 in {x: x incin s | (EXISTS y in t | x incs y * c)}))
	b6-->Stat17 ==> (b6 incin s) & Stat20: (EXISTS y in t | b6 incs y * c) & (b5 = b6)
	EQUAL ==> (b5 incin s) & (EXISTS y in t | b5 incs y * c)
	c6-->Stat18 ==> (c6 incin s) & Stat21: (EXISTS y in t | c6 incs y * c) & (c5 = c6)
	EQUAL ==> (c5 incin s) & (EXISTS y in t | c5 incs y * c)
	d6-->Stat20 ==> (d6 in t) & (b5 incs d6 * c)
	e6-->Stat21 ==> (e6 in t) & (c5 incs e6 * c)
	ELEM ==> b5 * c5 incs (d6 * e6) * c
	Use_def(Filter) ==> Stat22: (FORALL x in t, y in t | x * y in t)
	(d6,e6)-->Stat22 ==> d6 * e6 in t
	(b5 * c5)-->Stat19 ==> Stat23: not (EXISTS y in t | b5 * c5 incs y * c)
	(d6 * e6)-->Stat23 ==> false; Discharge ==> Stat24: 0 in {x: x incin s | (EXISTS y in t | x incs y * c)}
	x-->Stat24 ==> Stat25: (EXISTS y in t | x incs y * c) & (x = 0)
	y-->Stat25 ==> (y in t) & (y * c = 0)
	Use_def(Filter) ==> (t incin pow(s)) & Stat26: (FORALL x in t, y incin s | ((y incs x) imp (y in t)))
	ELEM ==> y in pow(s)
	Use_def(pow) ==> Stat27: y in {x: x incin s}
	yy-->Stat27 ==> y incin s
	ELEM ==> y incin (s - c)
	(y,s - c)-->Stat26 ==> false; Discharge ==> Filter(t3,s)
--
    Use_def(Filter) ==> Stat28: (t incin pow(s)) & (0 notin t) &
		Stat29: (FORALL x in t, y in t | (x * y) in t) &
		Stat30: (FORALL x in t, y incin s | (y incs x) imp (y in t))
    Suppose ==> not(t3 incin pow(s))
	EQUAL ==> Stat31: not({x: x incin s | (EXISTS y in t | x incs (y * c))} incin pow(s))
	x0-->Stat31 ==> (x0 notin pow(s)) & Stat32: (x0 in {x incin s | (EXISTS y in t | x incs (y * c))})
	()-->Stat32 ==> x0 incin s
	Use_def(pow) ==> Stat33: (x0 notin {x: x incin s})
    x0-->Stat33 ==> false; Discharge ==> t3 incin pow(s)
--
-- Aiming now at showing that $t3$ strictly includes $t$, let us check first that $t /= 0$.
-- The proof of this fact is that otherwise it would be included in ${s}$,
-- which is a filter on $s$ since $s /= 0$.
--
    Suppose ==> t = 0
        Suppose ==> not({s} incin pow(s))
            Use_def(pow) ==> Stat34: (s notin {x: x incin s})
        s-->Stat34 ==> false; Discharge ==> {s} incin pow(s)
        Suppose ==> not(Filter({s},s))
            Use_def(Filter) ==> not((FORALL x in {s}, y in {s} | (x * y) in {s}) & (FORALL x in {s}, y incin s | (y incs x) imp (y in {s})))
            Suppose ==> Stat35: not(FORALL x in {s}, y in {s} | (x * y) in {s})
             (x5,x6)-->Stat35(Stat35) ==> false; Discharge ==> Stat36: not(FORALL x in {s}, y incin s | (y incs x) imp (y in {s}))
        (x7,x8)-->Stat36 ==> false; Discharge ==> Filter({s},s)
    ({s})-->Stat6 ==> false; Discharge ==> t /= 0
    Suppose ==> Stat37: c notin {x incin s | (EXISTS y in t | x incs (y * c))}
        ()-->Stat37 ==> Stat38: (not(EXISTS y in t | c incs (y * c)))
    (arb(t))-->Stat38 ==> false; Discharge ==> t /= t3
    Suppose ==> Stat39: not(t3 incs t)
        d-->Stat39 ==> (d in t) & Stat40: (not(d in {x incin s | (EXISTS y in t | x incs (y * c))}))
        ()-->Stat40 ==> (not (d incin s)) or (not(EXISTS y in t | d incs (y * c)))
        Use_def(Filter) ==> d in pow(s)
        Use_def(pow) ==> Stat41: d in {x: x incin s}
        x9-->Stat41 ==> Stat42: (not(EXISTS y in t | d incs (y * c)))
    d-->Stat42 ==> false; Discharge ==> t3 incs t
	t3-->Stat6 ==> false; Discharge ==> QED
--
-- Since Theorem 415 tells us that the hypothesis of Theorem 414 is valid for the set of filters in a set $s$,
-- the following conclusion results immediately.
--
Theorem 417: [Every filter on a set $S$ can be extended to an ultrafilter on $S$] (Filter(T,S) & (S /= 0)) imp (EXISTS u | ((u incs T) & Ultrafilter(u,S))). Proof:
	Suppose_not(t,s) ==> (s /= 0) & Filter(t,s) & Stat1: (not (EXISTS u | ((u incs t) & Ultrafilter(u,s))))
--
-- For let $t$, $s$ be a counterexample to our assertion, and consider the collection $filters_in_s$
-- of all filters in $s$. Since it is easily seen that $filters_in_s$ satisfies the hypothesis of Theorem 414,
-- it follows that $t$ is contained in some maximal filter.
--
	Loc_def ==> filters_in_s = {f incin pow(s) | Filter(f,s)}
	Suppose ==> Stat2: not (FORALL x incin filters_in_s | ((FORALL u in x,v in x | (u incs v or v incs u)) imp (Un(x) in filters_in_s)))
	x1-->Stat2 ==> (x1 incin filters_in_s) & (FORALL u in x1, v in x1 | (u incs v or v incs u)) & (Un(x1) notin filters_in_s)
	ELEM ==> Stat3: (x1 incin {f incin pow(s) | Filter(f,s)}) & Stat4: (Un(x1) notin {f incin pow(s) | Filter(f,s)})
	Suppose ==> Stat5: not (FORALL y in x1 |  Filter(y,s))
	y1-->Stat5 ==> (y1 in x1) & (not Filter(y1,s))
	ELEM ==> Stat6: y1 in {f incin pow(s) | Filter(f,s)}
	()-->Stat6 ==> false; Discharge ==> (FORALL y in x1 |  Filter(y,s))
	x1-->T415 ==> Filter(Un(x1),s)
	()-->Stat4 ==> Stat7: not(Un(x1) incin pow(s))
	c-->Stat7 ==> (c in Un(x1)) & (c notin pow(s))
	Use_def(Un) ==> Stat8: c in {x: y in x1,x in y}
	(y2,c2)-->Stat8 ==> (y2 in x1) & (c2 in y2)  & (c2 = c)
	ELEM ==> Stat9: (y2 in {f incin pow(s) | Filter(f,s)}) & (c in y2)
	()-->Stat9 ==> Filter(y2,s)
	Use_def(Filter) ==> false; Discharge ==>
		(FORALL x incin filters_in_s | ((FORALL u in x,v in x | (u incs v or v incs u)) imp (Un(x) in filters_in_s)))
	filters_in_s-->T414 ==> Stat10: (FORALL u in filters_in_s | (EXISTS y in filters_in_s |
			(y incs u) & (FORALL x in filters_in_s | not ((x incs y) & (x /= y)))))
	Suppose ==> t notin filters_in_s
	ELEM ==> Stat11: t notin {f incin pow(s) | Filter(f,s)}
	()-->Stat11 ==> Stat12: not (t incin pow(s))
	Use_def(Filter) ==> false; Discharge ==> t in filters_in_s
	t-->Stat10 ==> Stat13: (EXISTS y in filters_in_s | (y incs t) & (FORALL x in filters_in_s | not ((x incs y) & (x /= y))))
	tm-->Stat13 ==> Stat14: (tm in filters_in_s) & (tm incs t) & Stat15: (FORALL x in filters_in_s | not ((x incs tm) & (x /= tm)))
--
-- But it follows using Theorem 416 that $tm$ must be an ultrafilter, and so our theorem is proved.
--
	Suppose ==> Stat16: not (FORALL x incin pow(s) | ((x incs tm) & Filter(x,s)) imp (x = tm))
	t2-->Stat16 ==> (t2 incin pow(s)) & (t2 incs tm) & Filter(t2,s) & (t2 /= tm)
	t2-->Stat15 ==> Stat17: t2 notin {f incin pow(s) | Filter(f,s)}
	t2-->Stat17 ==> false; Discharge ==> (FORALL x incin pow(s) | ((x incs tm) & Filter(x,s)) imp (x = tm))
	EQUAL ==> Stat18: tm in {f incin pow(s) | Filter(f,s)}
	()-->Stat18 ==> Filter(tm,s)
	(s,tm)-->T416 ==> Stat19: Ultrafilter(tm,s)
	tm-->Stat1(Stat14,Stat19) ==> false; Discharge ==> QED
--
-- ************************************************************************************************
--							Section 13: Formal fractions and rational numbers
-- ************************************************************************************************
--
-- We have seen above that the signed integers is a collection of quantities into which the unsigned
-- integers can be embedded in a manner preserving all the basic algebraic operations on unsigned integers.
-- In this sense, the unsigned integers are an 'extension' of the unsigned integers.
-- This is the first of several extensions, each of which  serves to simplify some aspect
-- of the collection of numbers being extended. As previously noted, extension of the unsigned integers
-- to the signed integers serves to simplify the properties of subtraction. Three extensions subsequent to this
-- respectively introduce (i) the rational numbers, thereby simplifying division; (ii) the real numbers,
-- thereby ensuring that every polynomial which takes on both positive and negative values
-- also takes on the zero value; (iii) the complex numbers, thereby ensuring that every polynomial
-- other than a simple constant has at least one zero. We shall see that these extended families of numbers
-- have many deep properties other than the basic properties noted.
--
-- Of these extensions it is the introduction of real numbers which will involve the deepest construction.
--
-- In the present section we begin to walk the path outlined above by introducing the rational numbers.
-- This is done in two steps. First we introduce the formal fractions and the elementary algebraic
-- operations on them. Formal fractions are simply ordered pairs of signed integers $[m,n]$, $m$ being the fraction's
-- 'numerator' and $n$ its denominator. Then an eqivalence relation beween fractions is introduced.
-- This amounts to the fractions becoming identical when each is reduced to 'lowest terms' by division of
-- its nuerator and denoinator by thier greatest common factor, but is more conveniently expressed
-- by the condition that
--
Def 35: [The set of formal fractions] Fr := {[x,y]: x in Si, y in Si | y /= [0,0]}
Def 36: [Equivalence of formal fractions] Same_frac(P,Q) := car(P) S_TIMES cdr(Q) = cdr(P) S_TIMES car(Q)
Def 36a: [Nonnegative fraction] Fr_is_nonneg(X) := is_nonneg(car(X) S_TIMES cdr(X))
--
-- Our next few results show that the binary predicate '$Same_frac$' is an equivalence relation.
-- We begin by showing that '$Same_frac$' is symmetric and transitive. The proof simply uses the definition
-- to our expand our assertion into simple algebraic relationships for signed integers,
-- which then follow by elementary algebraic manipulation.
--
Theorem 418: [Equivalence of fractions is reflexive and symmetric] (FORALL x in Fr,y in Fr | (Same_frac(x,y) eq Same_frac(y,x)) & Same_frac(x,x)). Proof:
    Suppose_not ==> Stat1: not (FORALL x in Fr,Y in Fr | (Same_frac(x,y) eq Same_frac(y,x)) & Same_frac(x,x))
    (x,y)-->Stat1 ==> (x in Fr) & (y in Fr) & (not(Same_frac(x,y) eq Same_frac(y,x)) or (not Same_frac(x,x)))
    Use_def(Fr) ==> Stat2: (x in {[u,v]: u in Si, v in Si | v /= [0,0]}) & (y in {[u,v]: u in Si, v in Si | v /= [0,0]})
    (a,b,c,d)-->Stat2 ==> Stat3: (x = [a,b]) & (a in Si) & (b in Si) & (y = [c,d]) & (c in Si) & (d in Si)
    (Stat3)ELEM ==> (car(x) = a) & (cdr(x) = b)
    (Stat3,Stat3)ELEM ==> (car(y) = c) & (cdr(y) = d)
    Suppose ==> not Same_frac(x,x)
    Use_def(Same_frac) ==> (car(x) S_TIMES cdr(x)) /= (cdr(x) S_TIMES car(x))
    (car(x),cdr(x))-->T384(Stat1*) ==> false; Discharge ==> not(Same_frac(x,y) eq Same_frac(y,x))
    Suppose ==> Same_frac(x,y) & (not Same_frac(y,x))
    Use_def(Same_frac) ==> ((car(x) S_TIMES cdr(y)) = (cdr(x) S_TIMES car(y))) &
    							((car(y) S_TIMES cdr(x)) /= (cdr(y) S_TIMES car(x)))
    EQUAL ==> (a S_TIMES d = b S_TIMES c) & (c S_TIMES b /= d S_TIMES a)
    ALGEBRA ==> false; Discharge ==> (not Same_frac(x,y)) & Same_frac(y,x)
    Use_def(Same_frac) ==> ((car(x) S_TIMES cdr(y)) /= (cdr(x) S_TIMES car(y))) &
    							((car(y) S_TIMES cdr(x)) = (cdr(y) S_TIMES car(x)))
    EQUAL ==> (a S_TIMES d /= b S_TIMES c) & (c S_TIMES b = d S_TIMES a)
    ALGEBRA ==> false; Discharge ==> QED
--
Theorem 419: [Equivalence of fractions is transitive] (FORALL x in Fr, y in Fr, wz in Fr | (Same_frac(x,y) & Same_frac(y,wz)) imp Same_frac(x,wz)). Proof:
    Suppose_not ==> Stat1: not (FORALL x in Fr, y in Fr, wz in Fr | (Same_frac(x,y) & Same_frac(y,wz)) imp Same_frac(x,wz))
    (x,y,wz)-->Stat1 ==> (x in Fr) & (y in Fr) & (wz in Fr) & Same_frac(x,y) & Same_frac(y,wz) & (not Same_frac(x,wz))
    Use_def(Fr) ==> Stat2: (x in {[u,v]: u in Si, v in Si | v /= [0,0]}) &
	Stat3:(y in {[u,v]: u in Si, v in Si | v /= [0,0]}) & Stat4:(wz in {[u,v]: u in Si, v in Si | v /= [0,0]})
    (a,b)-->Stat2 ==> Stat5: (x = [a,b]) & (a in Si) & (b in Si)
    (Stat5)ELEM ==> (car(x) = a) & (cdr(x) = b)
    (c,d)-->Stat3 ==> Stat6: (y = [c,d]) & (c in Si) & (d in Si) & (d /= [0,0])
    (Stat6)ELEM ==> (car(y) = c) & (cdr(y) = d)
    (e,f)-->Stat4 ==> Stat7: (wz = [e,f]) & (e in Si) & (f in Si)
    (Stat7)ELEM ==> (car(wz) = e) & (cdr(wz) = f)
    Use_def(Same_frac) ==> ((car(x) S_TIMES cdr(y)) = (cdr(x) S_TIMES car(y))) &
    	((car(y) S_TIMES cdr(wz)) = (cdr(y) S_TIMES car(wz))) & ((car(x) S_TIMES cdr(wz)) /= (cdr(x) S_TIMES car(wz)))
    EQUAL ==> (a S_TIMES d = b S_TIMES c) & (c S_TIMES f = d S_TIMES e) & (a S_TIMES f /= b S_TIMES e)
    EQUAL ==> (a S_TIMES d) S_TIMES f = (b S_TIMES c) S_TIMES f
    ALGEBRA(Stat5,Stat6,Stat7) ==> ((a S_TIMES d) S_TIMES f = (a S_TIMES f) S_TIMES d) &
    									((b S_TIMES c) S_TIMES f = b S_TIMES (c S_TIMES f))
    EQUAL ==> (a S_TIMES d) S_TIMES f = b S_TIMES (d S_TIMES e)
    ALGEBRA ==> (a S_TIMES f) S_TIMES d = b S_TIMES (d S_TIMES e)
    ALGEBRA ==> b S_TIMES (d S_TIMES e) = (b S_TIMES e) S_TIMES d
    ALGEBRA ==> ((a S_TIMES f) in Si) & ((b S_TIMES e) in Si)
    ELEM ==> (a S_TIMES f) S_TIMES d = (b S_TIMES e) S_TIMES d
    (d,a S_TIMES f,b S_TIMES e)-->T409 ==> false; Discharge ==> QED
--
-- Now that we know that '$Same_frac$' is an equivalence relationship, we can apply the
-- equivalence_classes theory to it, to derive
--
APPLY(Eqc_thryvar:Ra,f1_thryvar:Fr_to_Ra) equivalence_classes(R(x,y)->Same_frac(x,y),s->Fr) ==>
    Theorem 420: [Fractions are equivalent if and only if the rational numbers they define are equal] (FORALL x, y | ((x in Fr) & (y in Fr)) imp ((Same_frac(x,y) eq (Fr_to_Ra(x) = Fr_to_Ra(y))))) &
    (FORALL x  | (x in Ra) imp ((arb(x) in Fr) & (Fr_to_Ra(arb(x)) = x))) &
    (FORALL x | (x in Fr) imp (Fr_to_Ra(x) in Ra)) &
    (FORALL x | (x in Fr) imp Same_frac(x,arb(Fr_to_Ra(x))))
--
--			[Note: $Ra$ is the set of rational numbers.]
--
Theorem 421: [Every fraction is equivalent to every member of its rational number class] (X in Fr) imp ((Fr_to_Ra(X) in Ra) & Same_frac(X,arb(Fr_to_Ra(X)))). Proof:
	Suppose_not(x) ==>  (x in Fr) & ((Fr_to_Ra(x) notin Ra) or (not(Same_frac(x,arb(Fr_to_Ra(x))))))
	T420 ==> Stat1: (FORALL x |  (x in Fr) imp (Fr_to_Ra(x) in Ra)) & (FORALL x | (x in Fr) imp (Same_frac(x,arb(Fr_to_Ra(x)))))
	(x,x)-->Stat1 ==> false; Discharge ==> QED
--
Theorem 422: [Alternate version of Theorem 420] ((X in Fr) & (Y in Fr)) imp (Same_frac(X,Y) eq (Fr_to_Ra(X) = Fr_to_Ra(Y))). Proof:
	Suppose_not(x,y) ==> (x in Fr) & (y in Fr) & (not(Same_frac(x,y) eq (Fr_to_Ra(x) = Fr_to_Ra(y))))
	T420 ==> Stat1: (FORALL x, y | (x in Fr) & (y in Fr) imp (Same_frac(x,y) eq (Fr_to_Ra(x) = Fr_to_Ra(y))))
	(x,y)-->Stat1 ==> false; Discharge ==> QED
--
Theorem 423: [Alternate version of Theorem 421] (Y in Ra) imp ((arb(Y) in Fr) & (Fr_to_Ra(arb(Y)) = Y)). Proof:
	Suppose_not(y) ==> (y in Ra) & ((arb(y) notin Fr) or (Fr_to_Ra(arb(y)) /= y))
	T420 ==> Stat1: (FORALL y | (y in Ra) imp ((arb(y) in Fr) & (Fr_to_Ra(arb(y)) = y)))
	y-->Stat1 ==> false; Discharge ==> QED
--
Def 37: [The zero rational] Ra_0 := Fr_to_Ra([[0,0],[1,0]])
Def 37a: [The unit rational] Ra_1 := Fr_to_Ra([[1,0],[1,0]])
Def 38: [Rational Sum] Def(x Ra_PLUS y) :=
    Fr_to_Ra([(car(arb(x)) S_TIMES cdr(arb(y))) S_PLUS (car(arb(y)) S_TIMES cdr(arb(x))),
				cdr(arb(x)) S_TIMES cdr(arb(y))])
Def 39: [Rational product]
    Def(x Ra_TIMES y) := Fr_to_Ra([car(arb(x)) S_TIMES car(arb(y)),cdr(arb(x)) S_TIMES cdr(arb(y))])
Def 40: [Rational reciprocal] Recip(x) := Fr_to_Ra([cdr(arb(x)),car(arb(x))])
Def 41: [Rational quotient] Def(x Ra_OVER y) := x Ra_TIMES Recip(y)
Def 42: [Rational negative]
    Ra_Rev(x) := Fr_to_Ra([S_Rev(car(arb(x))),cdr(arb(x))])
Def 43: [Nonnegative Rational] Ra_is_nonneg(X) := is_nonneg(car(arb(X)) S_TIMES cdr(arb(X)))
Def 44: [Rational Subtraction] Def(x Ra_MINUS y) := x Ra_PLUS Ra_Rev(y)
--
THEORY Ordered_add(g,e,pluz(x,y),minz(x,y),rvz(x),nneg(x))
	(e in g) & (FORALL x in g | (pluz(x,e) = x) & (pluz(x,rvz(x)) = e) & (rvz(x) in g))
	(FORALL x in g, y in g | (pluz(x,y) in g) & (pluz(x,y) = pluz(y,x)) & (pluz(x,rvz(y)) = minz(x,y)))
	(FORALL x in g, y in g, z in g | pluz(pluz(x,y),z) = pluz(x,pluz(y,z)))
	(FORALL x in g, y in g | ((nneg(x) & nneg(y)) imp (nneg(pluz(x,y)))))
	(FORALL x in g | (nneg(x) or nneg(rvz(x))) & ((nneg(x) & nneg(rvz(x))) imp (x = e)))
END Ordered_add;
--
ENTER_THEORY Ordered_add [Note that no theorems need to be proved since a decision algorithm is available]
    Def 00j: [Generic 'greater or equal' comparison] GE_thryvar(X,Y) := nneg(pluz(X,rvz(Y)))
    Def 00k: [Generic 'less or equal' comparison] LE_thryvar(X,Y) := GE_thryvar(Y,X)
    Def 00m: [Generic 'greater than' comparison] GT_thryvar(X,Y) := (GE_thryvar(X,Y) & (X /= Y))
    Def 00n: [Generic 'less than' comparison] LT_thryvar(X,Y) := GT_thryvar(Y,X)
--
Theorem Ordered_add.0: [Echo of relator definitions] (GE_thryvar(X,Y) eq nneg(pluz(X,rvz(Y)))) &
	(LE_thryvar(X,Y) eq GE_thryvar(Y,X)) &
	(GT_thryvar(X,Y) eq (GE_thryvar(X,Y) & (X /= Y))) &
	(LT_thryvar(X,Y) eq GT_thryvar(Y,X)). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(GE_thryvar) ==> GE_thryvar(x,y) eq nneg(pluz(x,rvz(y)))
	Use_def(LE_thryvar) ==> LE_thryvar(x,y) eq GE_thryvar(y,x)
	Use_def(GT_thryvar) ==> GT_thryvar(x,y) eq (GE_thryvar(x,y) & (x /= y))
	Use_def(LT_thryvar) ==> LT_thryvar(x,y) eq GT_thryvar(y,x)
Discharge ==> QED
--
--
Theorem Ordered_add.1: [Interface to Otter-based THEORY of orderedGroups] (LE_thryvar(X,Y) eq nneg(pluz(Y,rvz(X)))) &
	(((X in g) & (Y in g)) imp (GT_thryvar(X,Y) eq (nneg(pluz(X,rvz(Y))) & (X /= Y)))) &
	(((X in g) & (Y in g)) imp (GT_thryvar(X,Y) eq (nneg(minz(X,Y)) & (X /= Y)))). Proof:
    Suppose_not(x,y) ==> (LE_thryvar(x,y) eq (not nneg(pluz(y,rvz(x))))) or
		((x in g) & (y in g) & ((GT_thryvar(x,y) eq ((not nneg(pluz(x,rvz(y)))) or (x = y))))) or
		((x in g) & (y in g) & ((GT_thryvar(x,y) eq ((not nneg(minz(x,y))) or (x = y)))))
        Suppose ==> LE_thryvar(x,y) eq (not nneg(pluz(y,rvz(x))))
            Use_def(LE_thryvar) ==> LE_thryvar(x,y) eq GE_thryvar(y,x)
            Use_def(GE_thryvar) ==> GE_thryvar(y,x) eq nneg(pluz(y,rvz(x)))
        EQUAL ==> false; Discharge ==>
		((x in g) & (y in g) & ((GT_thryvar(x,y) eq ((not nneg(pluz(x,rvz(y)))) or (x = y))))) or
		((x in g) & (y in g) & ((GT_thryvar(x,y) eq ((not nneg(minz(x,y))) or (x = y)))))
        Assump ==> Stat1: (FORALL x in g, y in g | (pluz(x,y) in g) & (pluz(x,y) = pluz(y,x)) & (pluz(x,rvz(y)) = minz(x,y)))
        (x,y)-->Stat1 ==> pluz(x,rvz(y)) = minz(x,y)
        EQUAL ==> ((x in g) & (y in g) & ((GT_thryvar(x,y) eq ((not nneg(pluz(x,rvz(y)))) or (x = y)))))
        Use_def(GT_thryvar) ==> ((x in g) & (y in g) & (((GE_thryvar(x,y) & (x /= y)) eq ((not nneg(pluz(x,rvz(y)))) or (x = y)))))
    Use_def(GE_thryvar) ==> false; Discharge ==> QED
--
Theorem Ordered_add.2: [The ordering by $GE_thryvar$ is a linear ordering] ((X in g) & (Y in g) & ((X = Y) or (not GE_thryvar(X,Y)))) imp GE_thryvar(Y,X). Proof:
    Suppose_not(cp,c) ==> Stat1: (c in g) & (cp in g) & (not GE_thryvar(c,cp)) & ((c = cp) or (not GE_thryvar(cp,c)))
        Use_def(GE_thryvar) ==> (not nneg(pluz(c,rvz(cp)))) & ((c = cp) or (not nneg(pluz(cp,rvz(c)))))
        Assump ==> (e in g) & Stat2: (FORALL x in g | (pluz(x,e) = x) & (pluz(x,rvz(x)) = e) & (rvz(x) in g))
        Assump ==> Stat3: (FORALL x in g, y in g | (pluz(x,y) in g) & (pluz(x,y) = pluz(y,x)) & (pluz(x,rvz(y)) = minz(x,y)))
        Suppose ==> Stat4: not(FORALL x in g | pluz(e,x) = x)
            x-->Stat4 ==> (x in g) & (pluz(e,x) /= x)
            (x,e)-->Stat3 ==> pluz(x,e) /= x
        x-->Stat2 ==> false; Discharge ==> Stat5: (FORALL x in g | pluz(e,x) = x)
        Assump ==> Stat6: (FORALL x in g | (nneg(x) or nneg(rvz(x))) & ((nneg(x) & nneg(rvz(x))) imp (x = e)))
        Suppose ==> c = cp
            EQUAL ==> (not nneg(pluz(c,rvz(c))))
            c-->Stat2 ==> pluz(c,rvz(c)) = e
            EQUAL ==> (not nneg(e))
            e-->Stat2 ==> rvz(e) in g
            (rvz(e))-->Stat5 ==> pluz(e,rvz(e)) = rvz(e)
            e-->Stat2 ==> pluz(e,rvz(e)) = e
            EQUAL ==> rvz(e) = e
            e-->Stat6 ==> nneg(e) or nneg(rvz(e))
        EQUAL ==> false; Discharge ==> (not nneg(pluz(cp,rvz(c))))
        c-->Stat2 ==> Stat7: rvz(c) in g
        cp-->Stat2 ==> Stat8: rvz(cp) in g
        (c,rvz(cp))-->Stat3 ==> pluz(c,rvz(cp)) in g
        (cp,rvz(c))-->Stat3 ==> pluz(cp,rvz(c)) in g
        (pluz(c,rvz(cp)))-->Stat6 ==> Stat9: nneg(rvz(pluz(c,rvz(cp))))
        (pluz(cp,rvz(c)))-->Stat6 ==> nneg(rvz(pluz(cp,rvz(c))))
        (pluz(c,rvz(cp)))-->Stat2 ==> rvz(pluz(c,rvz(cp))) in g
        (pluz(cp,rvz(c)))-->Stat2 ==> rvz(pluz(cp,rvz(c))) in g
        Assump ==> Stat10: (FORALL x in g, y in g | ((nneg(x) & nneg(y)) imp (nneg(pluz(x,y)))))
        (rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c))))-->Stat10(Stat9) ==> nneg(pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c)))))
        (rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c))))-->Stat3(Stat9) ==> pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c)))) in g
        (cp,rvz(c))-->Stat3(Stat1,Stat7) ==> pluz(cp,rvz(c)) = pluz(rvz(c),cp)
        (c,rvz(cp))-->Stat3(Stat1,Stat8) ==> pluz(c,rvz(cp)) = pluz(rvz(cp),c)
        EQUAL ==> nneg(rvz(pluz(rvz(cp),c))) & (not nneg(pluz(rvz(c),cp))) & (rvz(pluz(rvz(cp),c)) in g)
        (rvz(pluz(rvz(cp),c)),pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c)))))-->Stat10 ==> nneg(pluz(rvz(pluz(rvz(cp),c)),pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c))))))
        Assump ==> Stat11: (FORALL x in g, y in g, z in g | pluz(pluz(x,y),z) = pluz(x,pluz(y,z)))
        Suppose ==> pluz(rvz(pluz(rvz(cp),c)),pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c))))) /= pluz(rvz(c),cp)
            Suppose ==> Stat12: not(FORALL x in g, y in g | pluz(rvz(x),pluz(x,y)) = y)
                (x1,y1)-->Stat12 ==> (x1 in g) & (y1 in g) & (pluz(rvz(x1),pluz(x1,y1)) /= y1)
                x1-->Stat2 ==> rvz(x1) in g
                (rvz(x1),x1,y1)-->Stat11(Stat12) ==> pluz(rvz(x1),pluz(x1,y1)) = pluz(pluz(rvz(x1),x1),y1)
                (rvz(x1),x1)-->Stat3 ==> pluz(rvz(x1),x1) = pluz(x1,rvz(x1))
                x1-->Stat2 ==>  pluz(x1,rvz(x1)) = e
                y1-->Stat5 ==> pluz(e,y1) = y1
            EQUAL(Stat12) ==> false; Discharge ==> Stat13: (FORALL x in g, y in g | pluz(rvz(x),pluz(x,y)) = y)
            Suppose ==> Stat14: not(FORALL x in g, y in g | rvz(pluz(x,rvz(y))) = pluz(y,rvz(x)))
                (x2,y2)-->Stat14 ==> (x2 in g) & (y2 in g) & (rvz(pluz(x2,rvz(y2))) /= pluz(y2,rvz(x2)))
                Suppose ==> Stat15: not(FORALL x in g | rvz(rvz(x)) = x)
                    x3-->Stat15 ==> (x3 in g) & (rvz(rvz(x3)) /= x3)
                    x3-->Stat2 ==> (rvz(x3) in g) & (pluz(x3,rvz(x3)) = e)
                    (rvz(x3),x3)-->Stat3 ==> pluz(rvz(x3),x3) = pluz(x3,rvz(x3))
                    (rvz(x3),x3)-->Stat13 ==> pluz(rvz(rvz(x3)),pluz(rvz(x3),x3)) = x3
                    (rvz(x3))-->Stat2 ==> rvz(rvz(x3)) in g
                    (rvz(rvz(x3)))-->Stat2 ==> pluz(rvz(rvz(x3)),e) = rvz(rvz(x3))
                EQUAL(Stat15) ==> false; Discharge ==> Stat16: (FORALL x in g | rvz(rvz(x)) = x)
                Suppose ==> Stat17: not(FORALL x in g, y in g | pluz(rvz(x),pluz(y,x)) = y)
                    (x4,y4)-->Stat17 ==> (x4 in g) & (y4 in g) & (pluz(rvz(x4),pluz(y4,x4)) /= y4)
                    (x4,y4)-->Stat3 ==> pluz(y4,x4) = pluz(x4,y4)
                    (x4,y4)-->Stat13 ==> pluz(rvz(x4),pluz(x4,y4)) = y4
                EQUAL(Stat17) ==> false; Discharge ==> Stat18: (FORALL x in g, y in g | pluz(rvz(x),pluz(y,x)) = y)
                Suppose ==> Stat19: not(FORALL x in g, y in g | pluz(rvz(pluz(x,y)),x) = rvz(y))
                    (x5,y5)-->Stat19 ==> (x5 in g) & (y5 in g) & (pluz(rvz(pluz(x5,y5)),x5) /= rvz(y5))
	            (x5,y5)-->Stat3 ==> pluz(x5,y5) in g
                    (pluz(x5,y5))-->Stat2 ==> rvz(pluz(x5,y5)) in g
                    y5-->Stat2 ==> rvz(y5) in g
                    (pluz(x5,y5),rvz(y5))-->Stat18 ==> pluz(rvz(pluz(x5,y5)),pluz(rvz(y5),pluz(x5,y5))) = rvz(y5)
                    (y5,x5)-->Stat18 ==> pluz(rvz(y5),pluz(x5,y5)) = x5
                EQUAL(Stat19) ==> false; Discharge ==> Stat20: (FORALL x in g, y in g | pluz(rvz(pluz(x,y)),x) = rvz(y))
                Suppose ==> Stat21: not(FORALL x in g, y in g | rvz(pluz(x,y)) = pluz(rvz(x),rvz(y)) )
                    (x6,y6)-->Stat21 ==> (x6 in g) & (y6 in g) & (rvz(pluz(x6,y6)) /= pluz(rvz(x6),rvz(y6)))
	            (x6,y6)-->Stat3 ==> pluz(x6,y6) in g
                    y6-->Stat2 ==> rvz(y6) in g
                    (rvz(y6),pluz(x6,y6))-->Stat20 ==> pluz(rvz(pluz(rvz(y6),pluz(x6,y6))),rvz(y6)) = rvz(pluz(x6,y6))
                    (y6,x6)-->Stat18 ==> pluz(rvz(y6),pluz(x6,y6)) = x6
                EQUAL(Stat21) ==> false; Discharge ==> Stat22: (FORALL x in g, y in g | rvz(pluz(x,y)) = pluz(rvz(x),rvz(y)))
                y2-->Stat2 ==> rvz(y2) in g
                (x2,rvz(y2))-->Stat22 ==> rvz(pluz(x2,rvz(y2))) = pluz(rvz(x2),rvz(rvz(y2)))
                y2-->Stat16 ==> rvz(rvz(y2)) = y2
                x2-->Stat2 ==> rvz(x2) in g
                (rvz(x2),y2)-->Stat3 ==> pluz(rvz(x2),y2) = pluz(y2,rvz(x2))
            EQUAL(Stat14) ==> false; Discharge ==> Stat23: (FORALL x in g, y in g | rvz(pluz(x,rvz(y))) = pluz(y,rvz(x)))
            (c,cp)-->Stat23 ==> Stat24: rvz(pluz(c,rvz(cp))) = pluz(cp,rvz(c))
            Suppose ==> Stat25: pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c)))) /= e
                (cp,c)-->Stat23 ==> rvz(pluz(cp,rvz(c))) = pluz(c,rvz(cp))
                (cp,rvz(c),pluz(c,rvz(cp)))-->Stat11 ==> pluz(pluz(cp,rvz(c)),pluz(c,rvz(cp))) = pluz(cp,pluz(rvz(c),pluz(c,rvz(cp))))
                (c,rvz(cp))-->Stat13 ==> pluz(rvz(c),pluz(c,rvz(cp))) = rvz(cp)
                cp-->Stat2 ==> pluz(cp,rvz(cp)) = e
            EQUAL(Stat24) ==> false; Discharge ==> Stat26: pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c)))) = e
            (c,rvz(cp))-->Stat3 ==> pluz(c,rvz(cp)) = pluz(rvz(cp),c)
            (cp,rvz(c))-->Stat3 ==> pluz(cp,rvz(c)) = pluz(rvz(c),cp)
            (c,rvz(cp))-->Stat23 ==> rvz(pluz(c,rvz(cp))) = pluz(cp,rvz(c))
            (pluz(rvz(c),cp))-->Stat2 ==> pluz(pluz(rvz(c),cp),e) = pluz(rvz(c),cp)
        EQUAL(Stat11) ==> false; Discharge ==> pluz(rvz(pluz(rvz(cp),c)),pluz(rvz(pluz(c,rvz(cp))),rvz(pluz(cp,rvz(c))))) = pluz(rvz(c),cp)
    EQUAL ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY Ordered_add
--
--THEORY Ordered_add(g,e,pluz(i,j),minz(i,j),rvz(i),nneg(j));
--    (e in g) & (FORALL x in g | (pluz(x,e) = x) & (pluz(x,rvz(x)) = e) & (rvz(x) in g))
--    (FORALL x in g, y in g | (pluz(x,y) in g) & (pluz(x,y) = pluz(y,x)) & (pluz(x,rvz(y)) = minz(x,y)))
--    (FORALL x in g, y in g, z in g | pluz(pluz(x,y),z) = pluz(x,pluz(y,z)))
--    (FORALL x in g, y in g | (nneg(x) & nneg(y)) imp nneg(pluz(x,y)))
--    (FORALL x in g | (nneg(x) or nneg(rvz(x))) & ((nneg(x) & nneg(rvz(x))) imp (x = e)))
--==>(GE_thryvar,LE_thryvar,GT_thryvar,LT_thryvar)
--    (FORALL x,y | GE_thryvar(x,y) eq nneg(x pluz rvz(y)))
--    (FORALL x,y | LE_thryva(x,y) eq GE_thryvar(y,x))
--    (FORALL x,y | GT_thryvar(x,y) eq (GE_thryvar(x,y) & (x /= y)))
--    (FORALL x,y | LT_thryvar(x,y) eq GT_thryvar(y,x))
--    (FORALL x,y | (LE_thryvar(x,y) eq nneg(y pluz rvz(x))))
--    (FORALL x,y | ((x in g) & (y in g)) imp (GT_thryvar(x,y) eq (nneg(x pluz rvz(y)) & (x /= y))))
--    (FORALL x,y | ((x in g) & (y in g)) imp (GT_thryvar(x,y) eq (nneg(x minz y) & (x /= y))))
--    (FORALL x,y | ((x in g) & (y in g) & ((x = y) or (not GE_thryvar(x,y)))) imp GE_thryvar(y,x))
--END Ordered_add;
--
Theorem 424: [If a signed integer and its additive inverse are both nonnegative, the signed integer is zero] (X in Si) imp ((is_nonneg(X) or is_nonneg(S_Rev(X))) & ((is_nonneg(X) & is_nonneg(S_Rev(X))) imp (X = [0,0]))). Proof:
	Suppose_not(x) ==> Stat1: (x in Si) &
	((not(is_nonneg(x) or is_nonneg(S_Rev(x)))) or ((is_nonneg(x) & is_nonneg(S_Rev(x))) & (x /= [0,0])))
    x-->T369 ==> Stat2: (x = [car(x),cdr(x)]) & (car(x) = 0 or cdr(x) = 0) & (car(x) in Za) & (cdr(x) in Za)
    Use_def(is_nonneg) ==> Stat3: (is_nonneg(x) eq (car(x) incs cdr(x))) &
    							(is_nonneg(S_Rev(x)) eq (car(S_Rev(x)) incs cdr(S_Rev(x))))
	Use_def(S_Rev) ==> Stat4: S_Rev(x) = [cdr(x),car(x)]
	(Stat4)ELEM ==> (car(S_Rev(x)) = cdr(x)) & (cdr(S_Rev(x)) = car(x))
	(Stat2*)ELEM ==> Stat5: is_nonneg(x) or is_nonneg(S_Rev(x))
    (Stat1,Stat5*)ELEM ==> is_nonneg(x) & is_nonneg(S_Rev(x)) & (x /= [0,0])
    ELEM ==> Stat6: car(x) = cdr(x)
    (Stat2,Stat6)ELEM ==> (car(x) = 0) & (cdr(x) = 0)
    EQUAL ==> false; Discharge ==> QED
--
Theorem 425: [The sum of two non-negative signed integers is non-negative] (((X in Si) & (Y in Si) & is_nonneg(X) & is_nonneg(Y))) imp (is_nonneg(X S_PLUS Y) & is_nonneg(X S_TIMES Y)). Proof:
	Suppose_not(x,y) ==> (x in Si) & (y in Si) & is_nonneg(x) & is_nonneg(y) &
			(not(is_nonneg(x S_PLUS y) & is_nonneg(x S_TIMES y)))
    x-->T369 ==> Stat1: (x = [car(x),cdr(x)]) & (car(x) = 0 or cdr(x) = 0) & (car(x) in Za) & (cdr(x) in Za)
    y-->T369 ==> Stat2: (y = [car(y),cdr(y)]) & (car(y) = 0 or cdr(y) = 0) & (car(y) in Za) & (cdr(y) in Za)
    Use_def(is_nonneg) ==> Stat3: (car(x) incs cdr(x)) & (car(y) incs cdr(y))
    (Stat1,Stat2,Stat3*)ELEM ==> Stat4: (cdr(x) = 0) & (cdr(y) = 0)
    EQUAL ==> Stat5: (x = [car(x),0]) & (y = [car(y),0])
    Use_def(S_PLUS) ==> x S_PLUS y = Red([car(x) PLUS car(y),cdr(x) PLUS cdr(y)])
    EQUAL ==> x S_PLUS y = Red([car(x) PLUS car(y),0 PLUS 0])
    ALGEBRA ==> (0 PLUS 0 = 0) & (car(x) PLUS car(y) in Za)
    EQUAL ==> x S_PLUS y = Red([car(x) PLUS car(y),0])
    (car(x) PLUS car(y))-->T387 ==> Stat6: x S_PLUS y = [car(x) PLUS car(y),0]
    (Stat6)ELEM ==> car(x S_PLUS y) incs cdr(x S_PLUS y)
    Use_def(is_nonneg) ==> is_nonneg(x S_PLUS y)
    Use_def(S_TIMES) ==>
	x S_TIMES y = Red([(car(x) TIMES car(y)) PLUS (cdr(x) TIMES cdr(y)),(car(x) TIMES cdr(y)) PLUS (car(y) TIMES cdr(x))])
    EQUAL ==>x S_TIMES y = Red([(car(x) TIMES car(y)) PLUS (0 TIMES 0),(car(x) TIMES 0) PLUS (car(y) TIMES 0)])
    ALGEBRA ==> (((car(x) TIMES car(y)) PLUS (0 TIMES 0)) = (car(x) TIMES car(y))) &
    					((car(x) TIMES 0) PLUS (car(y) TIMES 0) = 0) & ((car(x) TIMES car(y)) in Za)
    EQUAL ==> (x S_TIMES y = Red([car(x) TIMES car(y),0]))
    (car(x) TIMES car(y))-->T387 ==> Stat7: x S_TIMES y = [car(x) TIMES car(y),0]
    (Stat7)ELEM ==> car(x S_TIMES y) incs cdr(x S_TIMES y)
    Use_def(is_nonneg) ==> is_nonneg(x S_TIMES y)
    Discharge ==> QED
--
-- The following compound of earlier theorems is derived
-- uniquely as a trigger for the THEORY Ordered_add.
--
Theorem 426: ([0,0] in Si) & (FORALL x in Si | ((x S_PLUS [0,0]) = x) & ((x S_PLUS S_Rev(x)) = [0,0]) & (S_Rev(x) in Si)) &
	(FORALL x in Si, y in Si | ((x S_PLUS y) in Si) & ((x S_PLUS y) = (y S_PLUS x)) & ((x S_PLUS S_Rev(y)) = (x S_MINUS y))) &
	(FORALL x in Si, y in Si, z in Si | ((x S_PLUS y) S_PLUS z) = (x S_PLUS (y S_PLUS z))) &
	(FORALL x in Si, y in Si | (is_nonneg(x) & is_nonneg(y)) imp is_nonneg(x S_PLUS y)) &
	(FORALL x in Si | (is_nonneg(x) or is_nonneg(S_Rev(x))) & ((is_nonneg(x) & is_nonneg(S_Rev(x))) imp (x = [0,0]))). Proof:
Suppose_not ==> AUTO
	T368 ==> [0,0] in Si
	Suppose ==> Stat1: not(FORALL x in Si | ((x S_PLUS [0,0]) = x) & ((x S_PLUS S_Rev(x)) = [0,0]) & (S_Rev(x) in Si))
		x1-->Stat1(Stat1*) ==> (x1 in Si) & (((x1 S_PLUS [0,0]) /= x1) or ((x1 S_PLUS S_Rev(x1)) /= [0,0]) or (S_Rev(x1) notin Si))
		x1-->T405(Stat1*) ==> (x1 S_PLUS [0,0]) = x1
		x1-->T391(Stat1*) ==> (S_Rev(x1) in Si) & ((S_Rev(x1) S_PLUS x1) = [0,0])
	(x1,S_Rev(x1))-->T381(Stat1*) ==> false; Discharge ==> (FORALL x in Si | ((x S_PLUS [0,0]) = x) & ((x S_PLUS S_Rev(x)) = [0,0]) & (S_Rev(x) in Si))
	Suppose ==> Stat2: not(FORALL x in Si, y in Si | ((x S_PLUS y) in Si) & ((x S_PLUS y) = (y S_PLUS x)) & ((x S_PLUS S_Rev(y)) = (x S_MINUS y)))
		(x2,y2)-->Stat2(Stat2*) ==> (x2 in Si) & (y2 in Si) & (((x2 S_PLUS y2) notin Si) or ((x2 S_PLUS y2) /= (y2 S_PLUS x2)) or ((x2 S_PLUS S_Rev(y2)) /= (x2 S_MINUS y2)))
		(x2,y2)-->T371(Stat2*) ==> (x2 S_PLUS y2) in Si
		(x2,y2)-->T381(Stat2*) ==> (x2 S_PLUS y2) = (y2 S_PLUS x2)
	(x2,y2)-->T398(Stat2*) ==> false; Discharge ==> (FORALL x in Si, y in Si | ((x S_PLUS y) in Si) & ((x S_PLUS y) = (y S_PLUS x)) & ((x S_PLUS S_Rev(y)) = (x S_MINUS y)))
	Suppose ==> Stat3: not(FORALL x in Si, y in Si, z in Si | ((x S_PLUS y) S_PLUS z) = (x S_PLUS (y S_PLUS z)))
		(x3,y3,z3)-->Stat3(Stat3*) ==> (x3 in Si) & (y3 in Si) & (z3 in Si) & (((x3 S_PLUS y3) S_PLUS z3) /= (x3 S_PLUS (y3 S_PLUS z3)))
	(z3,x3,y3)-->T385(Stat3*) ==> false; Discharge ==> (FORALL x in Si, y in Si, z in Si | ((x S_PLUS y) S_PLUS z) = (x S_PLUS (y S_PLUS z)))
	Suppose ==> Stat4: not(FORALL x in Si, y in Si | (is_nonneg(x) & is_nonneg(y)) imp is_nonneg(x S_PLUS y))
		(x4,y4)-->Stat4(Stat4*) ==> (x4 in Si) & (y4 in Si) & is_nonneg(x4) & is_nonneg(y4) & (not is_nonneg(x4 S_PLUS y4))
	(x4,y4)-->T425(Stat4*) ==> false; Discharge ==> Stat5: not(FORALL x in Si | (is_nonneg(x) or is_nonneg(S_Rev(x))) & ((is_nonneg(x) & is_nonneg(S_Rev(x))) imp (x = [0,0])))
	x5-->Stat5(Stat5*) ==> (x5 in Si) & ((not(is_nonneg(x5) or is_nonneg(S_Rev(x5)))) or (not((is_nonneg(x5) & is_nonneg(S_Rev(x5))) imp (x5 = [0,0]))))
x5-->T424(Stat5*) ==> false; Discharge ==> QED
--
APPLY(GE_thryvar:S_GE,LE_thryvar:S_LE,GT_thryvar:S_GT,LT_thryvar:S_LT) Ordered_add(g->Si,e->[0,0],pluz(i,j)->(i S_PLUS j),minz(i,j)->(i S_MINUS j),rvz(i)->S_Rev(i),nneg(j)->is_nonneg(j)) ==>
Theorem 427: [The ordering of two signed integers is defined by the sign of their differences] (FORALL x, y | (S_GE(x,y) eq is_nonneg(x S_PLUS S_Rev(y))) & (S_LE(x,y) eq S_GE(y,x)) &
	(S_GT(x,y) eq (S_GE(x,y) & (x /= y))) & (S_LT(x,y) eq S_GT(y,x)))
--
    Def 00o: Def(X S_GE Y) := S_GE(X,Y)
    Def 00p: Def(X S_LE Y) := S_LE(X,Y)
    Def 00u: Def(X S_GT Y) := S_GT(X,Y)
    Def 00v: Def(X S_LT Y) := S_LT(X,Y)
--
Theorem 428: [The ordering of two signed integers is defined by the sign of their differences] ((X S_GE Y) eq is_nonneg(X S_PLUS S_Rev(Y))) & ((X S_LE Y) eq (Y S_GE X)) &
	((X S_GT Y) eq ((X S_GE Y) & (X /= Y))) & ((X S_LT Y) eq (Y S_GT X)). Proof:
Suppose_not(x,y) ==> AUTO
	T427 ==> (FORALL x, y | (S_GE(x,y) eq is_nonneg(x S_PLUS S_Rev(y))) &
		(S_LE(x,y) eq S_GE(y,x)) &
		(S_GT(x,y) eq (S_GE(x,y) & (x /= y))) & (S_LT(x,y) eq S_GT(y,x)))
	Use_def(S_GE) ==> ((x S_GE y) eq S_GE(x,y)) & ((y S_GE x) eq S_GE(y,x))
	Use_def(S_LE) ==> (x S_LE y) eq S_LE(x,y)
	Use_def(S_GT) ==> ((x S_GT y) eq S_GT(x,y)) & ((y S_GT x) eq S_GT(y,x))
	Use_def(S_LT) ==> (x S_LT y) eq S_LT(x,y)
	EQUAL ==> Stat1: (FORALL x, y | ((x S_GE y) eq is_nonneg(x S_PLUS S_Rev(y))) & ((x S_LE y) eq (y S_GE x)) &
	((x S_GT y) eq ((x S_GE y) & (x /= y))) & ((x S_LT y) eq (y S_GT x)))
(x,y)-->Stat1(*) ==> false; Discharge ==> QED
--
Theorem 429: [The square of any signed integer is non-negative] (X in Si) imp is_nonneg(X S_TIMES X). Proof:
    Suppose_not(x) ==> (x in Si) & (not is_nonneg(x S_TIMES x))
    Suppose ==> is_nonneg(x)
    (x,x)-->T425 ==> false; Discharge ==> not is_nonneg(x)
    x-->T424 ==> is_nonneg(S_Rev(x))
    x-->T391 ==> S_Rev(x) in Si
    (S_Rev(x),S_Rev(x))-->T425 ==> is_nonneg(S_Rev(x) S_TIMES S_Rev(x))
    ALGEBRA ==> S_Rev(x) S_TIMES S_Rev(x) = x S_TIMES x
    EQUAL ==> false; Discharge ==> QED
--
Theorem 430: [The product of signed integers $x,y$ of which $x$ is positive is non-negative iff $y$ is non-negative] ((X in Si) & (Y in Si) & (X /= [0,0]) & is_nonneg(X)) imp (is_nonneg(X S_TIMES Y) eq is_nonneg(Y)). Proof:
    Suppose_not(x,y) ==> (x in Si) & (y in Si) & (x /= [0,0]) & is_nonneg(x) & (not (is_nonneg(x S_TIMES y) eq is_nonneg(y)))
    Suppose ==> is_nonneg(y)
    (x,y)-->T425 ==> false; Discharge ==> (not is_nonneg(y)) & is_nonneg(x S_TIMES y)
    y-->T424 ==> is_nonneg(S_Rev(y))
    y-->T391 ==> S_Rev(y) in Si
    (x,S_Rev(y))-->T425 ==> is_nonneg(x S_TIMES S_Rev(y))
    ALGEBRA ==> ((x S_TIMES S_Rev(y)) = S_Rev(x S_TIMES y)) & (x S_TIMES y in Si)
    EQUAL ==> is_nonneg(S_Rev(x S_TIMES y))
    (x S_TIMES y)-->T424 ==> x S_TIMES y = [0,0]
    (y,x)-->T407 ==> Stat1: y = [0,0]
    Use_def(is_nonneg) ==> not(car(y) incs cdr(y))
    (Stat1)Discharge ==> QED
--
Theorem 431: [Fractions are pairs of signed integers with non-zero denominator] (X in Fr) eq ((X = [car(X),cdr(X)]) & (car(X) in Si) & (cdr(X) in Si) & (cdr(X) /= [0,0])). Proof:
    Suppose_not(x) ==> not((x in Fr) eq ((x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) &
    						(cdr(x) /= [0,0])))
    Suppose ==> Stat1: (x in Fr) &
    		(not((x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])))
    Use_def(Fr) ==> Stat2: x in {[u,y]: u in Si, y in Si | y /= [0,0]}
    (u,y)-->Stat2 ==> Stat3: (x = [u,y]) & (u in Si) & (y in Si) & (y /= [0,0])
    (Stat3*)ELEM ==> Stat4: x = [u,y]
    (Stat4)ELEM ==> Stat5: (x = [car(x),cdr(x)]) & (car(x) = u) & (cdr(x) = y)
    (Stat3,Stat5*)ELEM ==> Stat6: (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])
    (Stat1,Stat5,Stat6*)Discharge ==> (x = [car(x),cdr(x)]) & (car(x) in Si) &
    	(cdr(x) in Si) & (cdr(x) /= [0,0]) & (not(x in Fr))
    Use_def(Fr) ==> Stat7: x notin {[u,y]: u in Si, y in Si | y /= [0,0]}
    (car(x),cdr(x))-->Stat7 ==> not((x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0]))
    Discharge ==> QED
--
Theorem 432: [Fractions are pairs of signed integers with non-zero denominator, 2] ((X in Si) & (Y in Si)) imp (([X,Y] in Fr) eq (Y /= [0,0])). Proof:
Suppose_not(x0,y0) ==> AUTO
	(x0,y0)-->T9(Stat1*) ==> Stat1: (car([x0,y0]) = x0) & (cdr([x0,y0]) = y0)
	Suppose ==> [x0,y0] in Fr
	([x0,y0])-->T431(*) ==> false; Discharge ==> [x0,y0] notin Fr
	(x0,y0)-->T10(Stat2*) ==> Stat2: [x0,y0] = [car([x0,y0]),cdr([x0,y0])]
([x0,y0])-->T431(*) ==> false; Discharge ==> QED
--
Theorem 433: [Rational numbers are classes of pairs of signed integers] (N in Ra) imp ((arb(N) in Fr) & (arb(N) = [car(arb(N)),cdr(arb(N))]) & (car(arb(N)) in Si) &
				(cdr(arb(N)) in Si) & (cdr(arb(N)) /= [0,0])). Proof:
    Suppose_not(n) ==>
	(n in Ra) & (not((arb(n) in Fr) & (arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])))
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    (arb(n))-->T431 ==> false; Discharge ==> QED
--
-- Next, as a preliminary toward consideration of the properties of products of rational numbers,
-- we prove that if two pairs $x$, $y$ and $w$, $wz$ of formal fractions are given, with $Same_frac(x,y)$
-- and similarly for $x$, $y$, then the formal product of $x$ by $w$ represents the same
-- rational number as the formal product of $y$ by $wz$.
--
Theorem 434: [Fractions are equivalent if their cross-products are equal] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) imp
    Same_frac([(car(X) S_TIMES cdr(W)) S_PLUS (car(W) S_TIMES cdr(X)),cdr(X) S_TIMES cdr(W)],
	[(car(Y) S_TIMES cdr(Z)) S_PLUS (car(Z) S_TIMES cdr(Y)),cdr(Y) S_TIMES cdr(Z)]). Proof:
	Suppose_not(x,y,w,wz) ==> (x in Fr) & (y in Fr) & Same_frac(x,y) & (w in Fr) & (wz in Fr) & Same_frac(w,wz) &
	(not Same_frac([(car(x) S_TIMES cdr(w)) S_PLUS (car(w) S_TIMES cdr(x)),cdr(x) S_TIMES cdr(w)],
	[(car(y) S_TIMES cdr(wz)) S_PLUS (car(wz) S_TIMES cdr(y)),cdr(y) S_TIMES cdr(wz)]))
    x-->T431 ==> (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si)
    y-->T431 ==> (y = [car(y),cdr(y)]) & (car(y) in Si) & (cdr(y) in Si)
    w-->T431 ==> (w = [car(w),cdr(w)]) & (car(w) in Si) & (cdr(w) in Si)
    wz-->T431 ==> (wz = [car(wz),cdr(wz)]) & (car(wz) in Si) & (cdr(wz) in Si)
    Use_def(Same_frac) ==>
	(car(x) S_TIMES cdr(y) = cdr(x) S_TIMES car(y)) & (car(w) S_TIMES cdr(wz) = cdr(w) S_TIMES car(wz))
    Loc_def ==> Stat1: prod1 = [(car(x) S_TIMES cdr(w)) S_PLUS (car(w) S_TIMES cdr(x)),cdr(x) S_TIMES cdr(w)]
    (Stat1)ELEM ==> Stat2: car(prod1) = (car(x) S_TIMES cdr(w)) S_PLUS (car(w) S_TIMES cdr(x))
    (Stat1)ELEM ==> Stat3: cdr(prod1) = cdr(x) S_TIMES cdr(w)
    Loc_def ==> Stat4: prod2 = [(car(y) S_TIMES cdr(wz)) S_PLUS (car(wz) S_TIMES cdr(y)),cdr(y) S_TIMES cdr(wz)]
    (Stat4)ELEM ==> Stat5: car(prod2) = (car(y) S_TIMES cdr(wz)) S_PLUS (car(wz) S_TIMES cdr(y))
    (Stat4)ELEM ==> Stat6: cdr(prod2) = cdr(y) S_TIMES cdr(wz)
    EQUAL ==> not Same_frac(prod1,prod2)
    Use_def(Same_frac) ==> Stat7: car(prod1) S_TIMES cdr(prod2) /= cdr(prod1) S_TIMES car(prod2)
    EQUAL(Stat2,Stat3,Stat5,Stat6,Stat7) ==>
    	((car(x) S_TIMES cdr(w)) S_PLUS (car(w) S_TIMES cdr(x))) S_TIMES (cdr(y) S_TIMES cdr(wz)) /=
	(cdr(x) S_TIMES cdr(w)) S_TIMES ((car(y) S_TIMES cdr(wz)) S_PLUS (car(wz) S_TIMES cdr(y)))
--
-- To conclude our proof we simply apply the distributive law for signed integers
-- to the left and right hand sides of the last inequality seen above,
--
    ALGEBRA ==> ((cdr(x) S_TIMES cdr(w)) S_TIMES ((car(y) S_TIMES cdr(wz)) S_PLUS (car(wz) S_TIMES cdr(y)))) =
	((cdr(x) S_TIMES car(y)) S_TIMES (cdr(w) S_TIMES cdr(wz))) S_PLUS
		((cdr(w) S_TIMES car(wz)) S_TIMES (cdr(y) S_TIMES cdr(x)))
    ALGEBRA ==> ((car(x) S_TIMES cdr(w)) S_PLUS (car(w) S_TIMES cdr(x))) S_TIMES (cdr(y) S_TIMES cdr(wz)) =
	((car(x) S_TIMES cdr(y)) S_TIMES (cdr(w) S_TIMES cdr(wz))) S_PLUS
		((car(w) S_TIMES cdr(wz)) S_TIMES (cdr(y) S_TIMES cdr(x)))
    EQUAL ==> false; Discharge ==> QED
--
-- The following corollary restates the preceding lemma in an obvious way.
--
Theorem 435: [If two pair of fractions are equivalent, their formal sums are also equivalent] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) imp
	(Fr_to_Ra([(car(X) S_TIMES cdr(W)) S_PLUS (car(W) S_TIMES cdr(X)),cdr(X) S_TIMES cdr(W)]) =
	Fr_to_Ra([(car(Y) S_TIMES cdr(Z)) S_PLUS (car(Z) S_TIMES cdr(Y)),cdr(Y) S_TIMES cdr(Z)])). Proof:
	Suppose_not(x,y,w,wz) ==> (x in Fr) & (y in Fr) & Same_frac(x,y) & (w in Fr) & (wz in Fr) & Same_frac(w,wz) &
	(Fr_to_Ra([(car(x) S_TIMES cdr(w)) S_PLUS (car(w) S_TIMES cdr(x)),cdr(x) S_TIMES cdr(w)]) /=
   			Fr_to_Ra([(car(y) S_TIMES cdr(wz)) S_PLUS (car(wz) S_TIMES cdr(y)),cdr(y) S_TIMES cdr(wz)]))
    x-->T431 ==> Stat1: (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])
    w-->T431 ==> (w = [car(w),cdr(w)]) & (car(w) in Si) & (cdr(w) in Si) & (cdr(w) /= [0,0])
    (cdr(w),cdr(x))-->T407(Stat1*) ==> cdr(x) S_TIMES cdr(w) /= [0,0]
    y-->T431 ==> Stat2: (y = [car(y),cdr(y)]) & (car(y) in Si) & (cdr(y) in Si) & (cdr(y) /= [0,0])
    wz-->T431 ==> (wz = [car(wz),cdr(wz)]) & (car(wz) in Si) & (cdr(wz) in Si) & (cdr(wz) /= [0,0])
     (cdr(wz),cdr(y))-->T407(Stat2*) ==> cdr(y) S_TIMES cdr(wz) /= [0,0]
   	ALGEBRA ==> (car(x) S_TIMES cdr(w)) S_PLUS (car(w) S_TIMES cdr(x)) in Si
    	ALGEBRA ==> (cdr(x) S_TIMES cdr(w)) in Si
   	ALGEBRA ==> (car(y) S_TIMES cdr(wz)) S_PLUS (car(wz) S_TIMES cdr(y)) in Si
   	ALGEBRA ==> (cdr(y) S_TIMES cdr(wz)) in Si
  	((car(x) S_TIMES cdr(w)) S_PLUS (car(w) S_TIMES cdr(x)),cdr(x) S_TIMES cdr(w))-->T432(*) ==>
   			[(car(x) S_TIMES cdr(w)) S_PLUS (car(w) S_TIMES cdr(x)),cdr(x) S_TIMES cdr(w)] in Fr
   	((car(y) S_TIMES cdr(wz)) S_PLUS (car(wz) S_TIMES cdr(y)),cdr(y) S_TIMES cdr(wz))-->T432(*) ==>
   		[(car(y) S_TIMES cdr(wz)) S_PLUS (car(wz) S_TIMES cdr(y)),cdr(y) S_TIMES cdr(wz)] in Fr
	(x,y,w,wz)-->T434 ==> Same_frac([(car(x) S_TIMES cdr(w)) S_PLUS (car(w) S_TIMES cdr(x)),cdr(x) S_TIMES cdr(w)],
			 [(car(y) S_TIMES cdr(wz)) S_PLUS (car(wz) S_TIMES cdr(y)),cdr(y) S_TIMES cdr(wz)])
	([(car(x) S_TIMES cdr(w)) S_PLUS (car(w) S_TIMES cdr(x)),cdr(x) S_TIMES cdr(w)],[(car(y) S_TIMES cdr(wz)) S_PLUS (car(wz) S_TIMES cdr(y)),cdr(y) S_TIMES cdr(wz)])-->T422 ==> false
   Discharge ==> QED
--
Theorem 436: [If two pairs of fractions are equivalent, their formal products are also equivalent] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) imp
    Same_frac([car(X) S_TIMES car(W),cdr(X) S_TIMES cdr(W)],[car(Y) S_TIMES car(Z),cdr(Y) S_TIMES cdr(Z)]). Proof:
    Suppose_not(x,y,w,wz) ==> (x in Fr) & (y in Fr) & Same_frac(x,y) & (w in Fr) & (wz in Fr) & Same_frac(w,wz) &
	(not Same_frac([car(x) S_TIMES car(w),cdr(x) S_TIMES cdr(w)],[car(y) S_TIMES car(wz),cdr(y) S_TIMES cdr(wz)]))
    x-->T431 ==> (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si)
    y-->T431 ==> (y = [car(y),cdr(y)]) & (car(y) in Si) & (cdr(y) in Si)
    w-->T431 ==> (w = [car(w),cdr(w)]) & (car(w) in Si) & (cdr(w) in Si)
    wz-->T431 ==> (wz = [car(wz),cdr(wz)]) & (car(wz) in Si) & (cdr(wz) in Si)
    Use_def(Same_frac) ==> (car(x) S_TIMES cdr(y) = cdr(x) S_TIMES car(y)) &
    							(car(w) S_TIMES cdr(wz) = cdr(w) S_TIMES car(wz))
    Use_def(Same_frac) ==> Stat1:  (car([car(x) S_TIMES car(w),cdr(x) S_TIMES cdr(w)])) S_TIMES
    							(cdr([car(y) S_TIMES car(wz),cdr(y) S_TIMES cdr(wz)])) /=
					(cdr([car(x) S_TIMES car(w),cdr(x) S_TIMES cdr(w)])) S_TIMES
						(car([car(y) S_TIMES car(wz),cdr(y) S_TIMES cdr(wz)]))
    ELEM ==> car([car(x) S_TIMES car(w),cdr(x) S_TIMES cdr(w)]) = car(x) S_TIMES car(w)
    ELEM ==> cdr([car(x) S_TIMES car(w),cdr(x) S_TIMES cdr(w)]) = cdr(x) S_TIMES cdr(w)
    ELEM ==> car([car(y) S_TIMES car(wz),cdr(y) S_TIMES cdr(wz)]) = car(y) S_TIMES car(wz)
    ELEM ==> cdr([car(y) S_TIMES car(wz),cdr(y) S_TIMES cdr(wz)]) = cdr(y) S_TIMES cdr(wz)
    EQUAL(Stat1) ==> (car(x) S_TIMES car(w)) S_TIMES (cdr(y) S_TIMES cdr(wz)) /=
			 (cdr(x) S_TIMES cdr(w)) S_TIMES (car(y) S_TIMES car(wz))
    ALGEBRA ==> (car(x) S_TIMES car(w)) S_TIMES (cdr(y) S_TIMES cdr(wz)) =
		(car(x) S_TIMES cdr(y)) S_TIMES (car(w) S_TIMES cdr(wz))
    ALGEBRA ==> (cdr(x) S_TIMES cdr(w)) S_TIMES (car(y) S_TIMES car(wz)) =
		(cdr(x) S_TIMES car(y)) S_TIMES (cdr(w) S_TIMES car(wz))
    ELEM ==> (car(x) S_TIMES cdr(y)) S_TIMES (car(w) S_TIMES cdr(wz)) /=
    			(cdr(x) S_TIMES car(y)) S_TIMES (cdr(w) S_TIMES car(wz))
    EQUAL ==> false; Discharge ==> QED
--
-- The following corollary restates the preceding lemma in an obvious way.
--
Theorem 437: [If two pairs of fractions are equivalent, their formal sums define the same rational number] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & (W in Fr) & (Z in Fr) & Same_frac(W,Z)) imp
	(Fr_to_Ra([car(X) S_TIMES car(W),cdr(X) S_TIMES cdr(W)]) = Fr_to_Ra([car(Y) S_TIMES car(Z),cdr(Y) S_TIMES cdr(Z)])). Proof:
	Suppose_not(x,y,w,wz) ==> (x in Fr) & (y in Fr) & Same_frac(x,y) & (w in Fr) & (wz in Fr) & Same_frac(w,wz) &
	(Fr_to_Ra([car(x) S_TIMES car(w),cdr(x) S_TIMES cdr(w)]) /= Fr_to_Ra([car(y) S_TIMES car(wz),cdr(y) S_TIMES cdr(wz)]))
    x-->T431 ==> Stat1: (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])
    w-->T431 ==> (w = [car(w),cdr(w)]) & (car(w) in Si) & (cdr(w) in Si) & (cdr(w) /= [0,0])
    (cdr(w),cdr(x))-->T407(Stat1*) ==> cdr(x) S_TIMES cdr(w) /= [0,0]
    y-->T431 ==> Stat2: (y = [car(y),cdr(y)]) & (car(y) in Si) & (cdr(y) in Si) & (cdr(y) /= [0,0])
    wz-->T431 ==> (wz = [car(wz),cdr(wz)]) & (car(wz) in Si) & (cdr(wz) in Si) & (cdr(wz) /= [0,0])
     (cdr(wz),cdr(y))-->T407(Stat2*) ==> cdr(y) S_TIMES cdr(wz) /= [0,0]
   	ALGEBRA ==> (car(x) S_TIMES car(w)) in Si
    ALGEBRA ==> (cdr(x) S_TIMES cdr(w)) in Si
   	ALGEBRA ==> (car(y) S_TIMES car(wz)) in Si
   	ALGEBRA ==> (cdr(y) S_TIMES cdr(wz)) in Si
  	(car(x) S_TIMES car(w),cdr(x) S_TIMES cdr(w))-->T432(*) ==>
   			[car(x) S_TIMES car(w),cdr(x) S_TIMES cdr(w)] in Fr
   	(car(y) S_TIMES car(wz),cdr(y) S_TIMES cdr(wz))-->T432(*) ==>
   			[car(y) S_TIMES car(wz),cdr(y) S_TIMES cdr(wz)] in Fr
	(x,y,w,wz)-->T436 ==> Same_frac([car(x) S_TIMES car(w),cdr(x) S_TIMES cdr(w)],[car(y) S_TIMES car(wz),cdr(y) S_TIMES cdr(wz)])
	([car(x) S_TIMES car(w),cdr(x) S_TIMES cdr(w)],[car(y) S_TIMES car(wz),cdr(y) S_TIMES cdr(wz)])-->T422 ==> false
   	Discharge ==> QED
--
-- Our next lemma gives a variant of the formula for the sum of two rationals; this will be useful later.
--
Theorem 438: [The sum of a rational number and a formal fraction can be expressed as a sum of formal fractions] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) imp (X Ra_PLUS Fr_to_Ra([Y,Z]) =
    Fr_to_Ra([(car(arb(X)) S_TIMES Z) S_PLUS (cdr(arb(X)) S_TIMES Y),(cdr(arb(X)) S_TIMES Z)])). Proof:
    Suppose_not(x,y,wz) ==> (x in Ra) & (y in Si) & (wz in Si) & (wz /= [0,0]) & (x Ra_PLUS Fr_to_Ra([y,wz]) /=
	Fr_to_Ra([(car(arb(x)) S_TIMES wz) S_PLUS (cdr(arb(x)) S_TIMES y),cdr(arb(x)) S_TIMES wz]))
--
-- For let $x,y,wz$ be a counterexample to our assertion. Since $x$ is  rational, both $arb(x)$ and $[y,wz]$ are fractions.
-- By Theorem 431, $[y,wz]$ is a fraction equivalent to the standard representative, $arb(Fr_to_Ra([y,wz]))$,
-- of its equivalence class.
--
	x-->T423 ==> Stat1: arb(x) in Fr
    (arb(x))-->T431 ==> (arb(x) = [car(arb(x)),cdr(arb(x))]) &
    						(car(arb(x)) in Si) & (cdr(arb(x)) in Si) & (cdr(arb(x)) /= [0,0])
    (y,wz)-->T432(*) ==> [y,wz] in Fr
    ([y,wz])-->T421 ==> Fr_to_Ra([y,wz]) in Ra
    (Fr_to_Ra([y,wz]))-->T433 ==> arb(Fr_to_Ra([y,wz])) in Fr
    ([y,wz])-->T421 ==> Same_frac([y,wz],arb(Fr_to_Ra([y,wz])))
    T418 ==> Stat2: (FORALL v in Fr, w in Fr | (Same_frac(v,w) eq Same_frac(w,v)) & Same_frac(v,v))
    (arb(x),arb(x))-->Stat2(Stat1,Stat1) ==> Same_frac(arb(x),arb(x))
--
-- Using Theorem 435, we can therefore replace $arb(Fr_to_Ra([y,wz])$ by $[y,wz]$ in
-- the standard expression for the rational product seen below.
--
    Use_def(Ra_PLUS) ==> x Ra_PLUS Fr_to_Ra([y,wz]) =
	Fr_to_Ra([(car(arb(x)) S_TIMES cdr(arb(Fr_to_Ra([y,wz])))) S_PLUS (car(arb(Fr_to_Ra([y,wz]))) S_TIMES cdr(arb(x))),
				cdr(arb(x)) S_TIMES cdr(arb(Fr_to_Ra([y,wz])))])
    (arb(x),arb(x),[y,wz],arb(Fr_to_Ra([y,wz])))-->T435 ==> Fr_to_Ra([(car(arb(x)) S_TIMES cdr(arb(Fr_to_Ra([y,wz]))))
    			S_PLUS (car(arb(Fr_to_Ra([y,wz]))) S_TIMES cdr(arb(x))),
				cdr(arb(x)) S_TIMES cdr(arb(Fr_to_Ra([y,wz])))]) =
			Fr_to_Ra([(car(arb(x)) S_TIMES cdr([y,wz])) S_PLUS (car([y,wz]) S_TIMES cdr(arb(x))),
				cdr(arb(x)) S_TIMES cdr([y,wz])])
    ELEM ==> (cdr([y,wz]) = wz) & (car([y,wz]) = y)
    EQUAL ==> x Ra_PLUS Fr_to_Ra([y,wz]) =
	 Fr_to_Ra([(car(arb(x)) S_TIMES wz) S_PLUS (y S_TIMES cdr(arb(x))), cdr(arb(x)) S_TIMES wz])
    ALGEBRA ==> y S_TIMES cdr(arb(x)) = cdr(arb(x)) S_TIMES y;
    EQUAL ==> false; Discharge ==> QED
--
Theorem 439: [The product of a rational number and a formal fraction can be expressed as a product of formal fractions] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) imp (X Ra_TIMES Fr_to_Ra([Y,Z]) =
			Fr_to_Ra([car(arb(X)) S_TIMES Y,cdr(arb(X)) S_TIMES Z])). Proof:
    Suppose_not(x,y,wz) ==> (x in Ra) & (y in Si) & (wz in Si) & (wz /= [0,0]) &
    	((x Ra_TIMES Fr_to_Ra([y,wz])) /=  Fr_to_Ra([car(arb(x)) S_TIMES y,cdr(arb(x)) S_TIMES wz]))
    x-->T433 ==> (arb(x) = [car(arb(x)),cdr(arb(x))]) & (car(arb(x)) in Si) & (cdr(arb(x)) in Si) &( cdr(arb(x)) /= [0,0])
    (y,wz)-->T432(*) ==> [y,wz] in Fr
    ([y,wz])-->T421 ==> Fr_to_Ra([y,wz]) in Ra
    (Fr_to_Ra([y,wz]))-->T423 ==> arb(Fr_to_Ra([y,wz])) in Fr
    ([y,wz])-->T421 ==> Same_frac([y,wz],arb(Fr_to_Ra([y,wz])))
    x-->T423 ==> Stat1: arb(x) in Fr
    T418 ==> Stat2: (FORALL v in Fr, w in Fr | (Same_frac(v,w) eq Same_frac(w,v)) & Same_frac(v,v))
    (arb(x),arb(x))-->Stat2(Stat1) ==> Same_frac(arb(x),arb(x))
    Use_def(Ra_TIMES) ==> x Ra_TIMES Fr_to_Ra([y,wz]) =
	Fr_to_Ra([car(arb(x)) S_TIMES car(arb(Fr_to_Ra([y,wz]))), cdr(arb(x)) S_TIMES cdr(arb(Fr_to_Ra([y,wz])))])
    (arb(x),arb(x),[y,wz],arb(Fr_to_Ra([y,wz])))-->T437 ==> x Ra_TIMES Fr_to_Ra([y,wz]) =
			 Fr_to_Ra([car(arb(x)) S_TIMES car([y,wz]), cdr(arb(x)) S_TIMES cdr([y,wz])])
    ELEM ==> (car([y,wz]) = y) & (cdr([y,wz]) = wz)
    EQUAL ==> x Ra_TIMES Fr_to_Ra([y,wz]) =
			Fr_to_Ra([car(arb(x)) S_TIMES y, cdr(arb(x)) S_TIMES wz])
    Discharge ==> QED
--
Theorem 440: [Reversing both the numerator and denominator of a formal fraction does not change the rational it represents] (X in Fr) imp Same_frac(X,[S_Rev(car(X)),S_Rev(cdr(X))]). Proof:
    Suppose_not(x) ==> (x in Fr) & (not Same_frac(x,[S_Rev(car(x)),S_Rev(cdr(x))]))
    x-->T431 ==> (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])
    Use_def(Same_frac) ==> Stat1: car(x) S_TIMES cdr([S_Rev(car(x)),S_Rev(cdr(x))]) /=
    							cdr(x) S_TIMES car([S_Rev(car(x)),S_Rev(cdr(x))])
    (car(x),cdr(x))-->T390 ==> car(x) S_TIMES S_Rev(cdr(x)) = S_Rev(car(x) S_TIMES cdr(x))
    (cdr(x),car(x))-->T390 ==> cdr(x) S_TIMES S_Rev(car(x)) = S_Rev(cdr(x) S_TIMES car(x))
    (Stat1)ELEM ==> S_Rev(car(x) S_TIMES cdr(x)) /= S_Rev(cdr(x) S_TIMES car(x))
    ALGEBRA ==> false; Discharge ==> QED
--
-- Next we show that if two fractions, both with positive denominators, are equivalent,
-- then one is has a non-negative numerator if and only if the other does. This lemma
-- prepares for the proof of the more general statement given by Theorem 444 below.
--
Theorem 441: [?] ((X in Fr) & (Y in Fr) & Same_frac(X,Y) & is_nonneg(cdr(X)) & is_nonneg(cdr(Y))) imp
	((is_nonneg(car(X)) or car(X) = [0,0]) eq (is_nonneg(car(Y)) or car(Y) = [0,0])). Proof:
    Suppose_not(x,y) ==> Stat1: (x in Fr) & (y in Fr) & Same_frac(x,y) & is_nonneg(cdr(x)) & is_nonneg(cdr(y)) &
	(not ((is_nonneg(car(x)) or car(x) = [0,0]) eq (is_nonneg(car(y)) or car(y) = [0,0])))
--
-- For consider a counterexample x,y. It is easily seen that if one of the fractions is zero so is the other.
-- Hence we have only to consider the case in which one of the  fractions, say x, has a positive numerator and the
-- other has a negative numerator.
--
    x-->T431 ==> (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])
    y-->T431 ==> (y = [car(y),cdr(y)]) & (car(y) in Si) & (cdr(y) in Si) & (cdr(y) /= [0,0])
    Use_def(Same_frac) ==> Stat2: car(x) S_TIMES cdr(y) = cdr(x) S_TIMES car(y)
    Suppose ==> car(x) = [0,0]
    EQUAL ==> [0,0] S_TIMES cdr(y) = cdr(x) S_TIMES car(y)
    (cdr(y))-->T401 ==> cdr(x) S_TIMES car(y) = [0,0]
    (car(y),cdr(x))-->T407(Stat1*) ==> car(y) = [0,0]
    Discharge ==> Stat3: car(x) /= [0,0]
    Suppose ==> car(y) = [0,0]
    EQUAL ==> car(x) S_TIMES cdr(y) = cdr(x) S_TIMES [0,0]
    ALGEBRA ==> car(x) S_TIMES cdr(y) = [0,0] S_TIMES cdr(x)
    (cdr(x))-->T401 ==> car(x) S_TIMES cdr(y) = [0,0]
    (cdr(y),car(x))-->T407(Stat1*) ==> car(x) = [0,0]
    Discharge ==> Stat4: car(y) /= [0,0]
    (Stat1,Stat3,Stat4)ELEM ==> not (is_nonneg(car(x)) eq is_nonneg(car(y)))
    ALGEBRA ==> (cdr(x) S_TIMES car(y) in Si) & (car(x) S_TIMES cdr(y) in Si)
--
-- In this case, Theorem 424 tells us that S_Rev(car(y)) must be non-negative.
-- A bit of algebra now shows that both car(x) S_TIMES cdr(y) and S_Rev(car(x) S_TIMES cdr(y))
-- must be non-negative. Hence car(x) S_TIMES cdr(y) must be zero,
-- and therefore car(x) must also be zero by Theorem 407.
--
    Suppose ==> Stat5: is_nonneg(car(x))
    ELEM ==> not is_nonneg(car(y))
    (car(x),cdr(y))-->T425 ==> is_nonneg(car(x) S_TIMES cdr(y))
    (car(y))-->T424 ==> is_nonneg(S_Rev(car(y)))
    (car(y))-->T391 ==> S_Rev(car(y)) in Si
    (cdr(x),S_Rev(car(y)))-->T425 ==> is_nonneg(cdr(x) S_TIMES S_Rev(car(y)))
    ALGEBRA ==> Stat6: is_nonneg(S_Rev(cdr(x) S_TIMES car(y)))
    EQUAL(Stat2,Stat6) ==> is_nonneg(S_Rev(car(x) S_TIMES cdr(y)))
    (car(x) S_TIMES cdr(y))-->T424 ==> car(x) S_TIMES cdr(y) = [0,0]
    (cdr(y),car(x))-->T407(Stat1*) ==> false; Discharge ==> Stat7: (not is_nonneg(car(x))) & is_nonneg(car(y))
    (cdr(x),car(y))-->T425 ==> is_nonneg(cdr(x) S_TIMES car(y))
    (car(x))-->T424 ==> is_nonneg(S_Rev(car(x)))
    (car(x))-->T391 ==> S_Rev(car(x)) in Si
    (cdr(y),S_Rev(car(x)))-->T425 ==> is_nonneg(cdr(y) S_TIMES S_Rev(car(x)))
    ALGEBRA ==> Stat8: is_nonneg(S_Rev(car(x) S_TIMES cdr(y)))
    EQUAL(Stat2,Stat8) ==> is_nonneg(S_Rev(cdr(x) S_TIMES car(y)))
    (cdr(x) S_TIMES car(y))-->T424 ==> cdr(x) S_TIMES car(y) = [0,0]
    (car(y),cdr(x))-->T407(Stat1*) ==> false; Discharge ==> QED
--
-- The following theorem generalizes the preceding result by showing that if one of two equivalent
-- fractions is non-negative, so is the other.
--
Theorem 442: [The sign of the product of the numerator and denominator of a fraction defines the sign of the rational number which it represents]
    ((X in Fr) & (Y in Fr) & Same_frac(X,Y)) imp (is_nonneg(car(X) S_TIMES cdr(X)) eq is_nonneg(car(Y) S_TIMES cdr(Y))).   Proof:
	Suppose_not(x,y) ==> Stat1: (x in Fr) & (y in Fr) & Same_frac(x,y) &
	(not (is_nonneg(car(x) S_TIMES cdr(x)) eq is_nonneg(car(y) S_TIMES cdr(y))))
    x-->T431 ==> (x = [car(x),cdr(x)]) & (car(x) in Si) & (cdr(x) in Si) & (cdr(x) /= [0,0])
    y-->T431 ==> (y = [car(y),cdr(y)]) & (car(y) in Si) & (cdr(y) in Si) & (cdr(y) /= [0,0])
    Loc_def ==> ax = car(x)
    Loc_def ==> dx = cdr(x)
    Loc_def ==> ay = car(y)
    Loc_def ==> dy = cdr(y)
    EQUAL ==> (dx /= [0,0]) & (dy /= [0,0])
    Use_def(Same_frac) ==> car(x) S_TIMES cdr(y) = cdr(x) S_TIMES car(y)
    EQUAL ==> ax S_TIMES dy = dx S_TIMES ay
    EQUAL ==> Stat2: (ax in Si) & (dx in Si) & (ay in Si) & (dy in Si)
    EQUAL ==> (ax S_TIMES dy) S_TIMES (dx S_TIMES dy) = (dx S_TIMES ay) S_TIMES (dx S_TIMES dy)
    EQUAL ==> not (is_nonneg(ax S_TIMES dx) eq is_nonneg(ay S_TIMES dy))
    ALGEBRA(Stat2) ==> (dy S_TIMES dy) S_TIMES (ax S_TIMES dx) = (dx S_TIMES dx) S_TIMES (ay S_TIMES dy)
    EQUAL ==> is_nonneg((dy S_TIMES dy) S_TIMES (ax S_TIMES dx)) eq is_nonneg((dx S_TIMES dx) S_TIMES (ay S_TIMES dy))
    dx-->T429 ==> is_nonneg(dx S_TIMES dx)
    dy-->T429 ==> is_nonneg(dy S_TIMES dy)
    (dx,dx)-->T407(Stat1*) ==> dx S_TIMES dx /= [0,0]
    (dy,dy)-->T407(Stat1*) ==> dy S_TIMES dy /= [0,0]
    ALGEBRA ==> (dx S_TIMES dx in Si) & (ay S_TIMES dy in Si)
    ALGEBRA ==> (dy S_TIMES dy in Si) & (ax S_TIMES dx in Si)
    (dy S_TIMES dy,ax S_TIMES dx)-->T430 ==>
	is_nonneg((dy S_TIMES dy) S_TIMES (ax S_TIMES dx)) eq is_nonneg(ax S_TIMES dx)
    (dx S_TIMES dx,ay S_TIMES dy)-->T430 ==>
	is_nonneg((dx S_TIMES dx) S_TIMES (ay S_TIMES dy)) eq is_nonneg(ay S_TIMES dy)
    Discharge ==> QED
--
Theorem 443: [?] (X in Fr) imp (Fr_is_nonneg(X) eq Fr_is_nonneg([S_Rev(car(X)),S_Rev(cdr(X))])). Proof:
    Suppose_not(n) ==> Stat1: (n in Fr) & (not(Fr_is_nonneg(n) eq Fr_is_nonneg([S_Rev(car(n)),S_Rev(cdr(n))])))
    n-->T431 ==> (n = [car(n),cdr(n)]) & (car(n) in Si) & (cdr(n) in Si) & (cdr(n) /= [0,0])
    Use_def(Fr_is_nonneg) ==> Stat2: Fr_is_nonneg(n) eq is_nonneg(car(n) S_TIMES cdr(n))
    Use_def(Fr_is_nonneg) ==> Stat3: Fr_is_nonneg([S_Rev(car(n)),S_Rev(cdr(n))]) eq
    		is_nonneg(car([S_Rev(car(n)),S_Rev(cdr(n))]) S_TIMES cdr([S_Rev(car(n)),S_Rev(cdr(n))]))
    (Stat1,Stat2,Stat3*)ELEM ==>
    	not((is_nonneg(car([S_Rev(car(n)),S_Rev(cdr(n))]) S_TIMES cdr([S_Rev(car(n)),S_Rev(cdr(n))]))) eq
    							(is_nonneg(car(n) S_TIMES cdr(n))))
    (car(n))-->T391 ==> S_Rev(car(n)) in Si
    (cdr(n))-->T391 ==> S_Rev(cdr(n)) in Si
 	ELEM ==> car([S_Rev(car(n)),S_Rev(cdr(n))]) = S_Rev(car(n))
  	ELEM ==> cdr([S_Rev(car(n)),S_Rev(cdr(n))]) = S_Rev(cdr(n))
  	EQUAL ==> Stat4: not(is_nonneg(S_Rev(car(n)) S_TIMES S_Rev(cdr(n))) eq (is_nonneg(car(n) S_TIMES cdr(n))))
    ALGEBRA ==> S_Rev(car(n)) S_TIMES S_Rev(cdr(n)) = car(n) S_TIMES cdr(n)
    EQUAL(Stat4) ==> false; Discharge ==> QED
--
-- Next we show that if two fractions, both with positive denominators, are equivalent,
-- then one has a non-negative numerator if and only if the other does.
--
Theorem 444: [?] ((X in Fr) & (Y in Fr) & Same_frac(X,Y)) imp (Fr_is_nonneg(X) eq Fr_is_nonneg(Y)). Proof:
    Suppose_not(n,m) ==> Stat1: (n in Fr) & (m in Fr) & Same_frac(n,m) & (not(Fr_is_nonneg(n) eq Fr_is_nonneg(m)))
    n-->T431 ==> (n = [car(n),cdr(n)]) & (car(n) in Si) & (cdr(n) in Si) & (cdr(n) /= [0,0])
    m-->T431 ==> (m = [car(m),cdr(m)]) & (car(m) in Si) & (cdr(m) in Si) & (cdr(m) /= [0,0])
    Use_def(Fr_is_nonneg) ==> (not (is_nonneg(car(n) S_TIMES cdr(n)) eq is_nonneg(car(m) S_TIMES cdr(m))))
    Use_def(Same_frac) ==> car(n) S_TIMES cdr(m) = cdr(n) S_TIMES car(m)
	EQUAL ==> (car(n) S_TIMES cdr(m)) S_TIMES (cdr(n) S_TIMES cdr(m))  =
		(cdr(n) S_TIMES car(m)) S_TIMES (cdr(n) S_TIMES cdr(m))
	ALGEBRA ==> Stat2: (car(n) S_TIMES cdr(n) in Si) & (car(m) S_TIMES cdr(m) in Si)
	ALGEBRA ==> Stat3: (cdr(n) S_TIMES cdr(n) in Si) & (cdr(m) S_TIMES cdr(m) in Si)
	ALGEBRA ==> (cdr(m) S_TIMES cdr(m)) S_TIMES (car(n) S_TIMES cdr(n)) =
			(cdr(n) S_TIMES cdr(n)) S_TIMES (car(m) S_TIMES cdr(m))
	(cdr(n))-->T429 ==> Stat4: is_nonneg(cdr(n) S_TIMES cdr(n))
	(cdr(m))-->T429 ==> Stat5: is_nonneg(cdr(m) S_TIMES cdr(m))
	(cdr(n),cdr(n))-->T407(Stat1*) ==> Stat6: cdr(n) S_TIMES cdr(n) /= [0,0]
	(cdr(m),cdr(m))-->T407(Stat1*) ==> Stat7: cdr(m) S_TIMES cdr(m) /= [0,0]
	(cdr(m) S_TIMES cdr(m),car(n) S_TIMES cdr(n))-->T430(Stat2,Stat3,Stat5,Stat7) ==>
	is_nonneg((cdr(m) S_TIMES cdr(m)) S_TIMES (car(n) S_TIMES cdr(n))) eq is_nonneg(car(n) S_TIMES cdr(n))
	(cdr(n) S_TIMES cdr(n),car(m) S_TIMES cdr(m))-->T430(Stat2,Stat3,Stat4,Stat6) ==>
	is_nonneg((cdr(n) S_TIMES cdr(n)) S_TIMES (car(m) S_TIMES cdr(m))) eq is_nonneg(car(m) S_TIMES cdr(m))
	EQUAL ==> false; Discharge ==> QED
--
-- Now we are in position to begin consideration of the algebra of rational numbers.
-- As a first result  of this kind we prove the commutative law for rational numbers.
--
Theorem 445: [Commutativity of rational addition] ((N in Ra) & (M in Ra)) imp
	((N Ra_PLUS M in Ra) & (N Ra_PLUS M = M Ra_PLUS N)). Proof:
    Suppose_not(n,m) ==> (n in Ra) & (m in Ra) & ((n Ra_PLUS m notin Ra) or (n Ra_PLUS m /= m Ra_PLUS n))
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(n))-->T431 ==>
	Stat1: (arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
    (arb(m))-->T431 ==>
	Stat2: (arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
	Suppose ==> Stat3: n Ra_PLUS m notin Ra
	Use_def(Ra_PLUS) ==> Fr_to_Ra([(car(arb(n)) S_TIMES cdr(arb(m))) S_PLUS (car(arb(m)) S_TIMES cdr(arb(n))),
				cdr(arb(n)) S_TIMES cdr(arb(m))]) notin Ra
    T420 ==> Stat4: (FORALL x | (x in Fr) imp (Fr_to_Ra(x) in Ra))
    ([(car(arb(n)) S_TIMES cdr(arb(m))) S_PLUS (car(arb(m)) S_TIMES cdr(arb(n))),cdr(arb(n)) S_TIMES cdr(arb(m))])-->Stat4(Stat3) ==>
	[(car(arb(n)) S_TIMES cdr(arb(m))) S_PLUS (car(arb(m)) S_TIMES cdr(arb(n))),
				cdr(arb(n)) S_TIMES cdr(arb(m))] notin Fr
    ALGEBRA ==> (car(arb(n)) S_TIMES cdr(arb(m))) S_PLUS (car(arb(m)) S_TIMES cdr(arb(n))) in Si
    ALGEBRA ==> cdr(arb(n)) S_TIMES cdr(arb(m)) in Si
    (cdr(arb(m)),cdr(arb(n)))-->T407(Stat1,Stat2*) ==> cdr(arb(n)) S_TIMES cdr(arb(m)) /= [0,0]
    ([(car(arb(n)) S_TIMES cdr(arb(m))) S_PLUS (car(arb(m)) S_TIMES cdr(arb(n))),cdr(arb(n)) S_TIMES cdr(arb(m))])-->T431 ==> false; Discharge ==> (n Ra_PLUS m /= m Ra_PLUS n)
    Use_def(Ra_PLUS) ==> Fr_to_Ra([(car(arb(m)) S_TIMES cdr(arb(n))) S_PLUS (car(arb(n)) S_TIMES cdr(arb(m))),
				cdr(arb(m)) S_TIMES cdr(arb(n))]) /=
	Fr_to_Ra([(car(arb(n)) S_TIMES cdr(arb(m))) S_PLUS (car(arb(m)) S_TIMES cdr(arb(n))),
				cdr(arb(n)) S_TIMES cdr(arb(m))])
    ALGEBRA ==> false; Discharge ==> QED
--
-- The following corollary of Theorem 438 expresses the sum of two rationals,
-- one of them derived explicitly from a fraction, in a form that is sometimes convenient.
--
Theorem 446: [?] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) imp (Fr_to_Ra([Y,Z]) Ra_PLUS X =
    Fr_to_Ra([(car(arb(X)) S_TIMES Z) S_PLUS (cdr(arb(X)) S_TIMES Y),(cdr(arb(X)) S_TIMES Z)])). Proof:
    Suppose_not(x,y,z) ==> AUTO
    (x,y,z)-->T438 ==> Fr_to_Ra([y,z]) Ra_PLUS x /= x Ra_PLUS Fr_to_Ra([y,z])
    (y,z)-->T432(*) ==> [y,z] in Fr
    ([y,z])-->T421 ==> Fr_to_Ra([y,z]) in Ra
    (x,Fr_to_Ra([y,z]))-->T445 ==> false; Discharge ==> QED
--
-- Next we express the sum of two rationals, both derived explicitly from a fraction, in a convenient form.
--
Theorem 447: [?] ((X in Si) & (Y in Si) & (Z in Si) & (W in Si) & (Y /= [0,0]) & (W /= [0,0])) imp
  (Fr_to_Ra([X,Y]) Ra_PLUS Fr_to_Ra([Z,W]) = Fr_to_Ra([(X S_TIMES W) S_PLUS (Z S_TIMES Y),Y S_TIMES W])). Proof:
    Suppose_not(x,y,wz,w) ==> (x in Si) & (y in Si) & (wz in Si) & (w in Si) & (y /= [0,0]) & (w /= [0,0]) &
	(Fr_to_Ra([x,y]) Ra_PLUS Fr_to_Ra([wz,w]) /=
			Fr_to_Ra([(x S_TIMES w) S_PLUS (wz S_TIMES y),y S_TIMES w]))
    (x,y)-->T432(*) ==> [x,y] in Fr
    ([x,y])-->T421 ==> Fr_to_Ra([x,y]) in Ra
    (Fr_to_Ra([x,y]))-->T433 ==> arb(Fr_to_Ra([x,y])) in Fr
    (arb(Fr_to_Ra([x,y])))-->T431 ==> cdr(arb(Fr_to_Ra([x,y]))) in Si
    ([x,y])-->T421 ==> Same_frac([x,y],arb(Fr_to_Ra([x,y])))
	(Fr_to_Ra([x,y]),wz,w)-->T438 ==> (Fr_to_Ra([x,y]) Ra_PLUS Fr_to_Ra([wz,w])) =
    		Fr_to_Ra([(car(arb(Fr_to_Ra([x,y]))) S_TIMES w) S_PLUS (cdr(arb(Fr_to_Ra([x,y]))) S_TIMES wz),
    										cdr(arb(Fr_to_Ra([x,y]))) S_TIMES w])
    (wz,w)-->T432(*) ==> Stat1: [wz,w] in Fr
    T418 ==> Stat2: (FORALL v in Fr, u in Fr | (Same_frac(v,u) eq Same_frac(u,v)) & Same_frac(v,v))
      ([wz,w],[wz,w])-->Stat2 ==> Same_frac([wz,w],[wz,w])
 	([x,y],arb(Fr_to_Ra([x,y])),[wz,w],[wz,w])-->T435 ==>
	Fr_to_Ra([(car([x,y]) S_TIMES cdr([wz,w])) S_PLUS (car([wz,w]) S_TIMES cdr([x,y])),
				cdr([x,y]) S_TIMES cdr([wz,w])]) =
	Fr_to_Ra([(car(arb(Fr_to_Ra([x,y]))) S_TIMES cdr([wz,w])) S_PLUS (car([wz,w]) S_TIMES cdr(arb(Fr_to_Ra([x,y])))),
	cdr(arb(Fr_to_Ra([x,y]))) S_TIMES cdr([wz,w])])
	 ELEM ==> (car([x,y]) = x) & (cdr([x,y]) = y) & (car([wz,w]) = wz) & (cdr([wz,w]) = w)
	 (wz,cdr(arb(Fr_to_Ra([x,y]))))-->T384 ==>
	 		(wz S_TIMES cdr(arb(Fr_to_Ra([x,y])))) = (cdr(arb(Fr_to_Ra([x,y]))) S_TIMES wz)
	 EQUAL ==> Fr_to_Ra([(x S_TIMES w) S_PLUS (wz S_TIMES y),y S_TIMES w]) =
	Fr_to_Ra([(car(arb(Fr_to_Ra([x,y]))) S_TIMES w) S_PLUS (cdr(arb(Fr_to_Ra([x,y]))) S_TIMES wz),
	cdr(arb(Fr_to_Ra([x,y]))) S_TIMES w])
     Discharge ==> QED
--
-- The proof that rational multiplication is commutative is also elementary and algebraic.
--
Theorem 448: [Commutativity of rational multiplication] ((N in Ra) & (M in Ra)) imp
		((N Ra_TIMES M in Ra) & (N Ra_TIMES M = M Ra_TIMES N)). Proof:
    Suppose_not(n,m) ==> (n in Ra) & (m in Ra) & ((n Ra_TIMES m notin Ra) or n Ra_TIMES m /= m Ra_TIMES n)
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(n))-->T431 ==>
	Stat1: (arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
    (arb(m))-->T431 ==>
	Stat2: (arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
	Suppose ==> Stat3: (n Ra_TIMES m) notin Ra
	Use_def(Ra_TIMES) ==> Fr_to_Ra([car(arb(n)) S_TIMES car(arb(m)),cdr(arb(n)) S_TIMES cdr(arb(m))]) notin Ra
    T420 ==> Stat4: (FORALL x | (x in Fr) imp (Fr_to_Ra(x) in Ra))
    ([car(arb(n)) S_TIMES car(arb(m)),cdr(arb(n)) S_TIMES cdr(arb(m))])-->Stat4(Stat3) ==>
	[car(arb(n)) S_TIMES car(arb(m)),cdr(arb(n)) S_TIMES cdr(arb(m))] notin Fr
    ALGEBRA ==> car(arb(n)) S_TIMES car(arb(m)) in Si
    ALGEBRA ==> cdr(arb(n)) S_TIMES cdr(arb(m)) in Si
    (cdr(arb(m)),cdr(arb(n)))-->T407(Stat1,Stat2*) ==> cdr(arb(n)) S_TIMES cdr(arb(m)) /= [0,0]
    ([car(arb(n)) S_TIMES car(arb(m)),cdr(arb(n)) S_TIMES cdr(arb(m))])-->T431 ==> false; Discharge ==> (n Ra_TIMES m /= m Ra_TIMES n)
    Use_def(Ra_TIMES) ==> Fr_to_Ra([car(arb(m)) S_TIMES car(arb(n)),cdr(arb(m)) S_TIMES cdr(arb(n))]) /=
	Fr_to_Ra([car(arb(n)) S_TIMES car(arb(m)),cdr(arb(n)) S_TIMES cdr(arb(m))])
    ALGEBRA ==> false; Discharge ==> QED
--
Theorem 449: [?] ((X in Ra) & (Y in Si) & (Z in Si) & (Z /= [0,0])) imp
	((Fr_to_Ra([Y,Z]) Ra_TIMES X) =
			Fr_to_Ra([car(arb(X)) S_TIMES Y,cdr(arb(X)) S_TIMES Z])). Proof:
    Suppose_not(x,y,wz) ==> (x in Ra) & (y in Si) & (wz in Si) & (wz /= [0,0]) &
    			((Fr_to_Ra([y,wz]) Ra_TIMES x) /=
	 				Fr_to_Ra([car(arb(x)) S_TIMES y,cdr(arb(x)) S_TIMES wz]))
    (x,y,wz)-->T439 ==> (x Ra_TIMES Fr_to_Ra([y,wz])) = Fr_to_Ra([car(arb(x)) S_TIMES y,cdr(arb(x)) S_TIMES wz])
    (y,wz)-->T432(*) ==> [y,wz] in Fr
    ([y,wz])-->T421 ==> Fr_to_Ra([y,wz]) in Ra
    (x,Fr_to_Ra([y,wz]))-->T448 ==> false; Discharge ==> QED
--
-- Next we prove the associative law for rational addition.
--
Theorem 450: [Associative law for rational addition] ((K in Ra) & (N in Ra) & (M in Ra)) imp (N Ra_PLUS (M Ra_PLUS K) = (N Ra_PLUS M) Ra_PLUS K). Proof:
    Suppose_not(k,n,m) ==> Stat1: (k in Ra) & (n in Ra) & (m in Ra) & (n Ra_PLUS (m Ra_PLUS k) /= (n Ra_PLUS m) Ra_PLUS k)
--
-- For let $k,n,m$ be a counterexample to our assertion, so that $arb(k) = [ak,dk]$, $arb(n) = [an,dn]$, $arb(m) = [am,dm]$
-- are fractions with signed integer numerators and denominators.
--
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    Loc_def ==> arn = arb(n)
    EQUAL ==> (arn in Fr) & (Fr_to_Ra(arn) = n)
    Loc_def ==> an = car(arn)
    Loc_def ==> dn = cdr(arn)
    (arn)-->T431 ==> (arn = [car(arn),cdr(arn)]) & (car(arn) in Si) & (cdr(arn) in Si) & (cdr(arn) /= [0,0])
    EQUAL ==> Stat2: (arn = [an,dn]) & (an in Si) & (dn in Si) & (dn /= [0,0])
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    Loc_def ==> arm = arb(m)
  	EQUAL ==> (arm in Fr) & (Fr_to_Ra(arm) = m)
    Loc_def ==> am = car(arm)
    Loc_def ==> dm = cdr(arm)
    (arm)-->T431 ==> (arm = [car(arm),cdr(arm)]) & (car(arm) in Si) & (cdr(arm) in Si) & (cdr(arm) /= [0,0])
    EQUAL ==> Stat3: (arm = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    k-->T423 ==> (arb(k) in Fr) & (Fr_to_Ra(arb(k)) = k)
    Loc_def ==> ark = arb(k)
    EQUAL ==> (ark in Fr) & (Fr_to_Ra(ark) = k)
    Loc_def ==> ak = car(ark)
    Loc_def ==> dk = cdr(ark)
    (ark)-->T431 ==> (ark = [car(ark),cdr(ark)]) & (car(ark) in Si) & (cdr(ark) in Si) & (cdr(ark) /= [0,0])
    EQUAL ==> Stat4: (ark = [ak,dk]) & (ak in Si) & (dk in Si) & (dk /= [0,0])
    (dk,dm)-->T407(Stat4,Stat3*) ==> dm S_TIMES dk /= [0,0]
--
-- By definition of rational addition, $Fr_to_Ra([(am S_TIMES dk) S_PLUS (ak S_TIMES dm),dm S_TIMES dk]) = m + k$
-- and $Fr_to_Ra([(an S_TIMES dm) S_PLUS (am S_TIMES dn),dn S_TIMES dm]) = n + m$, so that the negative
-- of our associative law can be written in the manner seen below.
--
    Use_def(Ra_PLUS) ==> m Ra_PLUS k =
    	Fr_to_Ra([(car(arb(m)) S_TIMES cdr(arb(k))) S_PLUS (car(arb(k)) S_TIMES cdr(arb(m))),
    				cdr(arb(m)) S_TIMES cdr(arb(k))])
    EQUAL ==> m Ra_PLUS k = Fr_to_Ra([(am S_TIMES dk) S_PLUS (ak S_TIMES dm),dm S_TIMES dk])
    Use_def(Ra_PLUS)(Stat2) ==> n Ra_PLUS m =
    	Fr_to_Ra([(car(arb(n)) S_TIMES cdr(arb(m))) S_PLUS (car(arb(m)) S_TIMES cdr(arb(n))),
    				cdr(arb(n)) S_TIMES cdr(arb(m))])
    EQUAL ==> n Ra_PLUS m = Fr_to_Ra([(an S_TIMES dm) S_PLUS (am S_TIMES dn),dn S_TIMES dm])
    EQUAL ==> n Ra_PLUS Fr_to_Ra([(am S_TIMES dk) S_PLUS (ak S_TIMES dm),dm S_TIMES dk]) /=
					Fr_to_Ra([(an S_TIMES dm) S_PLUS (am S_TIMES dn),dn S_TIMES dm]) Ra_PLUS k
    ALGEBRA ==> Stat5: ((am S_TIMES dk) S_PLUS (ak S_TIMES dm) in Si) & ((dm S_TIMES dk) in Si) &
	((an S_TIMES dm) S_PLUS (am S_TIMES dn) in Si) & ((dn S_TIMES dm) in Si)
   (dm,dk)-->T407 ==> Stat6: dm S_TIMES dk /= [0,0]
    (n,(am S_TIMES dk) S_PLUS (ak S_TIMES dm),dm S_TIMES dk)-->T438(Stat1,Stat5,Stat6) ==>
	Fr_to_Ra([(car(arb(n)) S_TIMES (dm S_TIMES dk)) S_PLUS
	(cdr(arb(n)) S_TIMES ((am S_TIMES dk) S_PLUS (ak S_TIMES dm))), cdr(arb(n)) S_TIMES (dm S_TIMES dk)])
			= (n Ra_PLUS Fr_to_Ra([(am S_TIMES dk) S_PLUS (ak S_TIMES dm),dm S_TIMES dk]))
    EQUAL ==>  Fr_to_Ra([(an S_TIMES (dm S_TIMES dk)) S_PLUS
	(dn S_TIMES ((am S_TIMES dk) S_PLUS (ak S_TIMES dm))), dn S_TIMES (dm S_TIMES dk)])
			= n Ra_PLUS (m Ra_PLUS k)
   (dm,dn)-->T407(Stat2,Stat3*) ==> Stat7: dn S_TIMES dm /= [0,0]
 	(k,(an S_TIMES dm) S_PLUS (am S_TIMES dn),dn S_TIMES dm)-->T446(Stat1,Stat5,Stat7) ==>
	Fr_to_Ra([(an S_TIMES dm) S_PLUS (am S_TIMES dn),dn S_TIMES dm]) Ra_PLUS k =
    		Fr_to_Ra([(car(arb(k)) S_TIMES (dn S_TIMES dm)) S_PLUS (cdr(arb(k)) S_TIMES
    			((an S_TIMES dm) S_PLUS (am S_TIMES dn))),(cdr(arb(k)) S_TIMES (dn S_TIMES dm))])
    EQUAL ==> (n Ra_PLUS m) Ra_PLUS k =
    		Fr_to_Ra([(ak S_TIMES (dn S_TIMES dm)) S_PLUS
    			(dk S_TIMES ((an S_TIMES dm) S_PLUS (am S_TIMES dn))),(dk S_TIMES (dn S_TIMES dm))])
    ELEM ==> Fr_to_Ra([(an S_TIMES (dm S_TIMES dk)) S_PLUS
	(dn S_TIMES ((am S_TIMES dk) S_PLUS (ak S_TIMES dm))), dn S_TIMES (dm S_TIMES dk)]) /=
    	Fr_to_Ra([(ak S_TIMES (dn S_TIMES dm)) S_PLUS
    			(dk S_TIMES ((an S_TIMES dm) S_PLUS (am S_TIMES dn))),(dk S_TIMES (dn S_TIMES dm))])
    ALGEBRA ==> false; Discharge ==> QED
--
Theorem 451: [The zero rational is the identity for rational addition] (Ra_0 in Ra) & (Ra_1 in Ra) & ((M in Ra) imp (M = M Ra_PLUS Ra_0)). Proof:
    Suppose_not(m) ==> Stat1: (Ra_0 notin Ra) or (Ra_1 notin Ra) or ((m in Ra) & (m /= m Ra_PLUS Ra_0))
    T368 ==> Stat2: ([0,0] in Si) & ([1,0] in Si)
    T212 ==> Stat3: 1 /= 0
    (Stat2)ELEM ==> ([[0,0],[1,0]] = [car([[0,0],[1,0]]),cdr([[0,0],[1,0]])]) &
    		(car([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) /= [0,0])
    ([0,0],[1,0])-->T432(*) ==> [[0,0],[1,0]] in Fr
    ([[0,0],[1,0]])-->T421 ==> Fr_to_Ra([[0,0],[1,0]]) in Ra
    Use_def(Ra_0) ==> Stat4: Ra_0 in Ra
    (Stat2)ELEM ==> ([[1,0],[1,0]] = [car([[1,0],[1,0]]),cdr([[1,0],[1,0]])]) &
    		(car([[1,0],[1,0]]) in Si) & (cdr([[1,0],[1,0]]) in Si) & (cdr([[1,0],[1,0]]) /= [0,0])
    ([1,0],[1,0])-->T432(*) ==> [[1,0],[1,0]] in Fr
    ([[1,0],[1,0]])-->T421 ==> Fr_to_Ra([[1,0],[1,0]]) in Ra
    Use_def(Ra_1) ==> Stat5: Ra_1 in Ra
    (Stat1,Stat4,Stat5*)ELEM ==> (m in Ra) & (m /= m Ra_PLUS Ra_0)
    m-->T423 ==> Stat6: (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(m))-->T431(Stat2*) ==> Stat7: (arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    Loc_def ==> Stat8: arm = arb(m)
    EQUAL ==> Stat9: (arm in Fr) & (Fr_to_Ra(arm) = m)
    Loc_def ==> am = car(arm)
    Loc_def ==> dm = cdr(arm)
    EQUAL ==> (arm = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    Use_def(Ra_0) ==> m /= m Ra_PLUS Fr_to_Ra([[0,0],[1,0]])
    Use_def(Ra_PLUS) ==> m /=
	Fr_to_Ra([(car(arb(m)) S_TIMES cdr(arb(Fr_to_Ra([[0,0],[1,0]])))) S_PLUS
			(car(arb(Fr_to_Ra([[0,0],[1,0]]))) S_TIMES cdr(arb(m))),
				cdr(arb(m)) S_TIMES cdr(arb(Fr_to_Ra([[0,0],[1,0]])))])
    ELEM ==> Stat10: (car([[0,0],[1,0]]) = [0,0]) & (cdr([[0,0],[1,0]]) = [1,0])
    (Fr_to_Ra([[0,0],[1,0]]))-->T423 ==> arb(Fr_to_Ra([[0,0],[1,0]])) in Fr
    [[0,0],[1,0]]-->T421 ==> Same_frac([[0,0],[1,0]],arb(Fr_to_Ra([[0,0],[1,0]])))
    T418 ==> Stat11: (FORALL v in Fr, w in Fr | (Same_frac(v,w) eq Same_frac(w,v)) & Same_frac(v,v))
    (arb(m),arb(m))-->Stat11(Stat8,Stat9) ==> Same_frac(arb(m),arb(m))
    (arb(m),arb(m),[[0,0],[1,0]],arb(Fr_to_Ra([[0,0],[1,0]])))-->T435 ==> Stat12:
	 m /= Fr_to_Ra([(car(arb(m)) S_TIMES cdr([[0,0],[1,0]])) S_PLUS (car([[0,0],[1,0]]) S_TIMES cdr(arb(m))),
	 								 cdr(arb(m)) S_TIMES cdr([[0,0],[1,0]])])
    EQUAL(Stat12,Stat10) ==>
    	m /= Fr_to_Ra([(car(arb(m)) S_TIMES [1,0]) S_PLUS ([0,0] S_TIMES cdr(arb(m))), cdr(arb(m)) S_TIMES [1,0]])
    (car(arb(m)))-->T401 ==> [1,0] S_TIMES car(arb(m)) = car(arb(m))
    (cdr(arb(m)))-->T401 ==> Stat13: [1,0] S_TIMES cdr(arb(m)) = cdr(arb(m))
    (cdr(arb(m)))-->T401 ==> [0,0] S_TIMES cdr(arb(m)) = [0,0]
    (car(arb(m)))-->T405 ==> (car(arb(m)) S_PLUS [0,0]) = car(arb(m))
    ALGEBRA(Stat13,Stat2,Stat7) ==> cdr(arb(m)) S_TIMES [1,0] = cdr(arb(m))
    ALGEBRA ==> (car(arb(m)) S_TIMES [1,0]) S_PLUS ([0,0] S_TIMES cdr(arb(m))) = car(arb(m))
    EQUAL ==> Stat14: m /= Fr_to_Ra([car(arb(m)),cdr(arb(m))])
    EQUAL(Stat6,Stat7,Stat14) ==> false; Discharge ==> QED
--
-- Next we prove that the rational version of the algebraic law 'x + (-x) = 0'.
--
Theorem 452: [The sum of a rational number and its additive inverse is zero] (M in Ra) imp ((Ra_Rev(M) in Ra) & ((M Ra_PLUS Ra_Rev(M)) = Ra_0)). Proof:
    Suppose_not(m) ==> (m in Ra) & ((Ra_Rev(m) notin Ra) or (m Ra_PLUS Ra_Rev(m)) /= Ra_0)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(m))-->T431 ==>
	(arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    Loc_def ==> am = car(arb(m))
    Loc_def ==> dm = cdr(arb(m))
    EQUAL ==> Stat1: (arb(m) = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    (dm,dm)-->T407(Stat1*) ==> dm S_TIMES dm /= [0,0]
    T368 ==> Stat2: ([0,0] in Si) & ([1,0] in Si)
    ALGEBRA ==> dm S_TIMES dm in Si
    ([0,0],dm S_TIMES dm)-->T432(Stat1*) ==> Stat3: [[0,0],dm S_TIMES dm] in Fr
    am-->T391 ==> S_Rev(am) in Si
    Suppose ==> Ra_Rev(m) notin Ra
    Use_def(Ra_Rev) ==> Stat4: Fr_to_Ra([S_Rev(car(arb(m))),cdr(arb(m))]) notin Ra
    T420 ==> Stat5: (FORALL x | (x in Fr) imp (Fr_to_Ra(x) in Ra))
    ([S_Rev(car(arb(m))),cdr(arb(m))])-->Stat5(Stat4) ==> [S_Rev(car(arb(m))),cdr(arb(m))] notin Fr
    EQUAL ==> [S_Rev(am),dm] notin Fr
    ([S_Rev(am),dm])-->T431 ==> false; Discharge ==> (m Ra_PLUS Ra_Rev(m)) /= Ra_0
--
--
--
    Use_def(Ra_Rev) ==> m Ra_PLUS Fr_to_Ra([S_Rev(car(arb(m))),cdr(arb(m))]) /= Ra_0
    EQUAL ==> m Ra_PLUS Fr_to_Ra([S_Rev(am),dm]) /= Ra_0
    (m,S_Rev(am),dm)-->T438 ==>
    	Fr_to_Ra([(car(arb(m)) S_TIMES dm) S_PLUS (cdr(arb(m)) S_TIMES S_Rev(am)),cdr(arb(m)) S_TIMES dm]) /= Ra_0
    EQUAL ==> Ra_0 /= Fr_to_Ra([(am S_TIMES dm) S_PLUS (dm S_TIMES S_Rev(am)),dm S_TIMES dm])
    ALGEBRA ==> (am S_TIMES dm) S_PLUS (dm S_TIMES S_Rev(am)) = (am S_TIMES dm) S_MINUS (am S_TIMES dm)
    ALGEBRA ==> am S_TIMES dm in Si
    (am S_TIMES dm)-->T404 ==> (am S_TIMES dm) S_PLUS (dm S_TIMES S_Rev(am)) = [0,0]
    EQUAL ==> Ra_0 /= Fr_to_Ra([[0,0],dm S_TIMES dm])
    Use_def(Ra_0) ==> Stat6: Fr_to_Ra([[0,0],[1,0]]) /= Fr_to_Ra([[0,0],dm S_TIMES dm])
    ELEM ==> Stat7: (car([[0,0],[1,0]]) = [0,0]) & (cdr([[0,0],[1,0]]) = [1,0])
    T212 ==> Stat8: 1 /= 0
    (Stat7,Stat8,Stat2)ELEM ==> ([[0,0],[1,0]] = [car([[0,0],[1,0]]),cdr([[0,0],[1,0]])]) &
    		(car([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) /= [0,0])
    ([0,0],[1,0])-->T432(*) ==> Stat9: [[0,0],[1,0]] in Fr
    ([[0,0],[1,0]],[[0,0],dm S_TIMES dm])-->T422(Stat9,Stat3,Stat6) ==>
    		not(Same_frac([[0,0],[1,0]],[[0,0],dm S_TIMES dm]))
    Use_def(Same_frac) ==> Stat10: [0,0] S_TIMES (dm S_TIMES dm) /= [1,0] S_TIMES [0,0]
    (dm S_TIMES dm)-->T401 ==> [0,0] S_TIMES (dm S_TIMES dm) = [0,0]
    (Stat10)ELEM ==> Stat11: [0,0] /= [1,0] S_TIMES [0,0]
    ([1,0])-->T401 ==> [0,0] S_TIMES [1,0] = [0,0]
    ALGEBRA(Stat11,Stat2) ==> [0,0] S_TIMES [1,0] = [1,0] S_TIMES [0,0]
    (Stat11)Discharge ==> QED
--
-- Sometimes the folllowing variant of Theorem 452 is more convenient.
--
Theorem 453: [The sum of a rational number and its additive inverse is zero, 2] (M in Ra) imp ((Ra_Rev(M) in Ra) & ((Ra_Rev(M) Ra_PLUS M) = Ra_0)). Proof:
	Suppose_not(m) ==> AUTO
	(m)-->T452 ==> AUTO
	(m,Ra_Rev(m))-->T445 ==> false; Discharge ==> QED
--
-- We also need to know that the difference of rationals is rational.
--
Theorem 454: [The difference of two rationals is rational] ((N in Ra) & (M in Ra)) imp ((N Ra_MINUS M) in Ra). Proof:
	Suppose_not(n,m) ==> AUTO
	Use_def(Ra_MINUS) ==> not((n Ra_PLUS Ra_Rev(m)) in Ra)
	m-->T453 ==> Ra_Rev(m) in Ra
	(n,Ra_Rev(m))-->T445 ==> false; Discharge ==> QED
--
-- The following elementary generalization of the preceding theorem gives the
-- rational case of the inverse relationship between addition and subtraction.
--
Theorem 455: [Rational subtraction is equivalent to addition of the rational negative] ((N in Ra) & (M in Ra)) imp (N = M Ra_PLUS (N Ra_MINUS M)). Proof:
    Suppose_not(n,m) ==> (n in Ra) & (m in Ra) & (n /= m Ra_PLUS (n Ra_MINUS m))
    Use_def(Ra_MINUS) ==> n /= m Ra_PLUS (n Ra_PLUS Ra_Rev(m))
    m-->T452 ==> Ra_Rev(m) in Ra
    (n,Ra_Rev(m))-->T445 ==> n Ra_PLUS Ra_Rev(m) = Ra_Rev(m) Ra_PLUS n
    EQUAL ==> n /= m Ra_PLUS (Ra_Rev(m) Ra_PLUS n)
    (n,m,Ra_Rev(m))-->T450 ==> n /= (m Ra_PLUS Ra_Rev(m)) Ra_PLUS n
    m-->T452 ==> m Ra_PLUS Ra_Rev(m) = Ra_0
    EQUAL ==> n /= Ra_0 Ra_PLUS n
    T451 ==> Ra_0 in Ra
    n-->T451 ==> n Ra_PLUS Ra_0 = n
    (n,Ra_0)-->T445 ==> false; Discharge ==> QED
--
-- Our next theorem states the associative law for rational multiplication.
--
Theorem 456: [Associative law for rational multiplication] ((K in Ra) & (N in Ra) & (M in Ra)) imp (N Ra_TIMES (M Ra_TIMES K) = (N Ra_TIMES M) Ra_TIMES K). Proof:
    Suppose_not(k,n,m) ==> Stat1: (k in Ra) & (n in Ra) & (m in Ra) & (n Ra_TIMES (m Ra_TIMES k) /= (n Ra_TIMES m) Ra_TIMES k)
	(n,m)-->T448 ==> (n Ra_TIMES m) in Ra
    (n Ra_TIMES m,k)-->T448 ==> n Ra_TIMES (m Ra_TIMES k) /= k Ra_TIMES (n Ra_TIMES m)
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    k-->T423 ==> (arb(k) in Fr) & (Fr_to_Ra(arb(k)) = k)
    (arb(n))-->T431 ==>
	(arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
    (arb(m))-->T431 ==>
	(arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    (arb(k))-->T431 ==>
	(arb(k) = [car(arb(k)),cdr(arb(k))]) & (car(arb(k)) in Si) & (cdr(arb(k)) in Si) & (cdr(arb(k)) /= [0,0])
    Loc_def ==> an = car(arb(n))
    Loc_def ==> am = car(arb(m))
    Loc_def ==> ak = car(arb(k))
    Loc_def ==> dn = cdr(arb(n))
    Loc_def ==> dm = cdr(arb(m))
    Loc_def ==> dk = cdr(arb(k))
    EQUAL ==> Stat2: (arb(n) = [an,dn]) & (an in Si) & (dn in Si) & (dn /= [0,0])
    EQUAL ==> Stat3: (arb(m) = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    EQUAL ==> Stat4: (arb(k) = [ak,dk]) & (ak in Si) & (dk in Si) & (dk /= [0,0])
    Use_def(Ra_TIMES) ==> n Ra_TIMES Fr_to_Ra([car(arb(m)) S_TIMES car(arb(k)),cdr(arb(m)) S_TIMES cdr(arb(k))]) /=
    							k Ra_TIMES Fr_to_Ra([car(arb(n)) S_TIMES car(arb(m)),cdr(arb(n)) S_TIMES cdr(arb(m))])
    EQUAL ==> n Ra_TIMES Fr_to_Ra([am S_TIMES ak,dm S_TIMES dk]) /= k Ra_TIMES Fr_to_Ra([an S_TIMES am,dn S_TIMES dm])
    (dk,dm)-->T407(Stat3,Stat4*) ==> Stat5: dm S_TIMES dk /= [0,0]
    (dm,dn)-->T407(Stat3,Stat2*) ==> Stat6: dn S_TIMES dm /= [0,0]
    ALGEBRA ==> Stat7: (an S_TIMES am in Si) & (dn S_TIMES dm in Si) & (am S_TIMES ak in Si) & (dm S_TIMES dk in Si)
    ([am S_TIMES ak,dm S_TIMES dk])-->T431(Stat7,Stat5) ==> [am S_TIMES ak,dm S_TIMES dk] in Fr
    ([an S_TIMES am,dn S_TIMES dm])-->T431(Stat7,Stat6) ==> [an S_TIMES am,dn S_TIMES dm] in Fr
    (n,am S_TIMES ak,dm S_TIMES dk)-->T439(Stat7,Stat5,Stat1,Stat2,Stat3,Stat4) ==>
    			n Ra_TIMES Fr_to_Ra([am S_TIMES ak,dm S_TIMES dk]) =
		Fr_to_Ra([car(arb(n)) S_TIMES (am S_TIMES ak),cdr(arb(n)) S_TIMES (dm S_TIMES dk)])
   	EQUAL ==> n Ra_TIMES Fr_to_Ra([am S_TIMES ak,dm S_TIMES dk]) =
		Fr_to_Ra([an S_TIMES (am S_TIMES ak),dn S_TIMES (dm S_TIMES dk)])
    (k,an S_TIMES am,dn S_TIMES dm)-->T439(Stat7,Stat6,Stat1,Stat2,Stat3,Stat4) ==>
    			k Ra_TIMES Fr_to_Ra([an S_TIMES am,dn S_TIMES dm]) =
		Fr_to_Ra([car(arb(k)) S_TIMES (an S_TIMES am),cdr(arb(k)) S_TIMES (dn S_TIMES dm)])
    EQUAL ==> k Ra_TIMES Fr_to_Ra([an S_TIMES am,dn S_TIMES dm]) =
		Fr_to_Ra([ak S_TIMES (an S_TIMES am),dk S_TIMES (dn S_TIMES dm)])
    ALGEBRA ==> false; Discharge ==> QED
--
-- Next we prove that a rational number remains unchanged if its numerator and denominator are multiplied
-- by a common integer.
--
Theorem 457: [Muliplication of numerator and denominator by a common nonzero function does not change the rational number it represents]
    ((K in Si) & (N in Si) & (M in Si) & (K /= [0,0]) & (M /= [0,0])) imp (Fr_to_Ra([N,M]) = Fr_to_Ra([K S_TIMES N,K S_TIMES M])).  Proof:
	Suppose_not(k,n,m) ==> (k in Si) & (n in Si) & (m in Si) & (k /= [0,0]) & (m /= [0,0]) &
			(Fr_to_Ra([n,m]) /= Fr_to_Ra([k S_TIMES n,k S_TIMES m]))
    (n,m)-->T432(*) ==> [n,m] in Fr
    ALGEBRA ==> (k S_TIMES n in Si) & (k S_TIMES m in Si)
    (m,k)-->T407 ==> k S_TIMES m /= [0,0]
    (k S_TIMES n,k S_TIMES m)-->T432(*) ==> [k S_TIMES n,k S_TIMES m] in Fr
    ([n,m],[k S_TIMES n,k S_TIMES m])-->T422 ==> not Same_frac([n,m],[k S_TIMES n,k S_TIMES m])
    Use_def(Same_frac) ==> n S_TIMES (k S_TIMES m) /= m S_TIMES (k S_TIMES n)
    ALGEBRA ==> false; Discharge ==> QED
--
-- The following theorem states the distributive law for rational numbers.
--
Theorem 458: [Distributive law for rationals] ((K in Ra) & (N in Ra) & (M in Ra)) imp (N Ra_TIMES (M Ra_PLUS K) = (N Ra_TIMES M) Ra_PLUS (N Ra_TIMES K)). Proof:
    Suppose_not(k,n,m) ==> Stat1: (k in Ra) & (n in Ra) & (m in Ra) &
    	(n Ra_TIMES (m Ra_PLUS k) /= (n Ra_TIMES m) Ra_PLUS (n Ra_TIMES k))
--
-- Supposing the contrary, consider the fractions defining each of our three rational numbers.
--
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    k-->T423 ==> (arb(k) in Fr) & (Fr_to_Ra(arb(k)) = k)
    (arb(n))-->T431 ==>
	Stat2: (arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
    (arb(m))-->T431 ==>
	Stat3: (arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    (arb(k))-->T431 ==>
	Stat4: (arb(k) = [car(arb(k)),cdr(arb(k))]) & (car(arb(k)) in Si) & (cdr(arb(k)) in Si) & (cdr(arb(k)) /= [0,0])
--
-- To keep our notation under control, it is convenient to introduce abbreviations for
-- the numerators and denominators of these fractions.
--
    Loc_def ==> Stat5: an = car(arb(n))
    Loc_def ==> Stat6: am = car(arb(m))
    Loc_def ==> Stat7: ak = car(arb(k))
    Loc_def ==> Stat8: dn = cdr(arb(n))
    Loc_def ==> Stat9: dm = cdr(arb(m))
    Loc_def ==> Stat10: dk = cdr(arb(k))
    EQUAL ==> Stat11: (arb(n) = [an,dn]) & (an in Si) & (dn in Si) & (dn /= [0,0])
    EQUAL ==> Stat12: (arb(m) = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    EQUAL ==> Stat13: (arb(k) = [ak,dk]) & (ak in Si) & (dk in Si) & (dk /= [0,0])
--
-- It is obvious that the various products entering into the definition of the
-- product and sum rationals that will concern us are all signed integers.
-- Thus we can express all these product and sum rationals in terms of their defining fractions.
--
    ALGEBRA ==> Stat14: (an S_TIMES am in Si) & (an S_TIMES ak in Si) & ((am S_TIMES dk) S_PLUS (ak S_TIMES dm) in Si)
	& (dn S_TIMES dm in Si) & (dn S_TIMES dk in Si) & (dm S_TIMES dk in Si)
    (dm,dn)-->T407(Stat11*) ==> Stat15: dn S_TIMES dm /= [0,0]
    (dk,dn)-->T407(Stat11*) ==> Stat16: dn S_TIMES dk /= [0,0]
    (dk,dm)-->T407(Stat11*) ==> Stat17: dm S_TIMES dk /= [0,0]
    Use_def(Ra_PLUS) ==> Stat18: m Ra_PLUS k =
    	Fr_to_Ra([(car(arb(m)) S_TIMES cdr(arb(k))) S_PLUS (car(arb(k)) S_TIMES cdr(arb(m))),
    				cdr(arb(m)) S_TIMES cdr(arb(k))])
    Use_def(Ra_TIMES) ==> Stat19: n Ra_TIMES m = Fr_to_Ra([car(arb(n)) S_TIMES car(arb(m)),
    							cdr(arb(n)) S_TIMES cdr(arb(m))])
    Use_def(Ra_TIMES) ==> Stat20: n Ra_TIMES k = Fr_to_Ra([car(arb(n)) S_TIMES car(arb(k)),
    							cdr(arb(n)) S_TIMES cdr(arb(k))])
    EQUAL ==> m Ra_PLUS k = Fr_to_Ra([(am S_TIMES dk) S_PLUS (ak S_TIMES dm),dm S_TIMES dk])
    EQUAL ==> n Ra_TIMES m = Fr_to_Ra([an S_TIMES am,dn S_TIMES dm])
    EQUAL ==> n Ra_TIMES k = Fr_to_Ra([an S_TIMES ak,dn S_TIMES dk])
    EQUAL ==> Stat21: n Ra_TIMES (m Ra_PLUS k) =
    	n Ra_TIMES Fr_to_Ra([(am S_TIMES dk) S_PLUS (ak S_TIMES dm),dm S_TIMES dk])
    ALGEBRA ==> Stat22: (am S_TIMES dk) S_PLUS (ak S_TIMES dm) in Si
    (n,(am S_TIMES dk) S_PLUS (ak S_TIMES dm),dm S_TIMES dk)-->T439(Stat1,Stat21,Stat22,Stat14,Stat17) ==>
    	Stat23: n Ra_TIMES (m Ra_PLUS k) =
	Fr_to_Ra([car(arb(n)) S_TIMES ((am S_TIMES dk) S_PLUS (ak S_TIMES dm)),cdr(arb(n)) S_TIMES (dm S_TIMES dk)])
    EQUAL(Stat23,Stat5,Stat8) ==> n Ra_TIMES (m Ra_PLUS k) =
	Fr_to_Ra([an S_TIMES ((am S_TIMES dk) S_PLUS (ak S_TIMES dm)),dn S_TIMES (dm S_TIMES dk)])
    (an S_TIMES am,dn S_TIMES dm,an S_TIMES ak,dn S_TIMES dk)-->T447(Stat14,Stat15,Stat16,Stat17) ==>
    	Fr_to_Ra([an S_TIMES am,dn S_TIMES dm]) Ra_PLUS Fr_to_Ra([an S_TIMES ak,dn S_TIMES dk]) =
	Fr_to_Ra([((an S_TIMES am) S_TIMES (dn S_TIMES dk)) S_PLUS ((an S_TIMES ak) S_TIMES (dn S_TIMES dm)),
	((dn S_TIMES dm) S_TIMES (dn S_TIMES dk))])
    EQUAL ==> (n Ra_TIMES m) Ra_PLUS (n Ra_TIMES k) =
	Fr_to_Ra([((an S_TIMES am) S_TIMES (dn S_TIMES dk)) S_PLUS ((an S_TIMES ak) S_TIMES (dn S_TIMES dm)),
	((dn S_TIMES dm) S_TIMES (dn S_TIMES dk))])
    ALGEBRA(Stat11*) ==> (n Ra_TIMES m) Ra_PLUS (n Ra_TIMES k) =
	Fr_to_Ra([dn S_TIMES (an S_TIMES ((am S_TIMES dk) S_PLUS (ak S_TIMES dm))),
				dn S_TIMES (dn S_TIMES (dm S_TIMES dk))])
    Loc_def ==> Stat24: aa = (an S_TIMES ((am S_TIMES dk) S_PLUS (ak S_TIMES dm)))
    Loc_def ==> Stat25: dd = (dn S_TIMES (dm S_TIMES dk))
--
-- This brings us to the following expressions for the quantities with which we are concerned,
-- which must be different if our theorem fails:
--
    EQUAL ==> Stat26: (n Ra_TIMES m) Ra_PLUS (n Ra_TIMES k) = Fr_to_Ra([dn S_TIMES aa, dn S_TIMES dd])
    EQUAL ==> Stat27: n Ra_TIMES (m Ra_PLUS k) = Fr_to_Ra([aa,dd])
    Use_def(Same_frac) ==> Stat28: Same_frac([dn S_TIMES aa, dn S_TIMES dd],[aa,dd]) eq
	(car([dn S_TIMES aa, dn S_TIMES dd]) S_TIMES cdr([aa,dd]) =
		cdr([dn S_TIMES aa, dn S_TIMES dd]) S_TIMES car([aa,dd]))
    (Stat28)ELEM ==> (car([dn S_TIMES aa, dn S_TIMES dd]) = dn S_TIMES aa) &
    					(cdr([dn S_TIMES aa, dn S_TIMES dd]) = dn S_TIMES dd)
    (Stat28)ELEM ==> (car([aa,dd]) = aa) & (cdr([aa,dd]) = dd)
    EQUAL(Stat28) ==> Stat29: Same_frac([dn S_TIMES aa, dn S_TIMES dd],[aa,dd]) eq
	((dn S_TIMES aa) S_TIMES dd = (dn S_TIMES dd) S_TIMES aa)
    ALGEBRA(Stat11,Stat12,Stat13) ==> Stat30: ((an S_TIMES ((am S_TIMES dk) S_PLUS (ak S_TIMES dm))) in Si) &
    			 ((dn S_TIMES (dm S_TIMES dk)) in Si)
    (dm S_TIMES dk,dn)-->T407(Stat11,Stat17,Stat14*) ==> Stat31: (dn S_TIMES (dm S_TIMES dk)) /= [0,0]
    EQUAL ==> Stat32: (aa in Si) & (dd in Si) & (dd /= [0,0])
    ALGEBRA(Stat11) ==> (dn S_TIMES aa in Si) & (dn S_TIMES dd in Si)
    (aa,dd)-->T432(Stat32,Stat32*) ==> Stat33: [aa,dd] in Fr
    ALGEBRA(Stat11) ==> (dn S_TIMES aa) S_TIMES dd = (dn S_TIMES dd) S_TIMES aa
    (dd,dn)-->T407(Stat11,Stat32*) ==> dn S_TIMES dd /= [0,0]
    (dn S_TIMES aa, dn S_TIMES dd)-->T432(Stat32*) ==> Stat34: [dn S_TIMES aa, dn S_TIMES dd] in Fr
    (Stat29)ELEM ==> Stat35: Same_frac([dn S_TIMES aa, dn S_TIMES dd],[aa,dd])
    ([dn S_TIMES aa, dn S_TIMES dd],[aa,dd])-->T422(Stat1,Stat26,Stat27,Stat35,Stat33,Stat34) ==> false; Discharge ==> QED
--
-- The following result, which is only a slight variant of what has gone before,
-- rexpresses the condition that the rational number derived from a fraction
-- should be non-negative in terms of the fraction's numerator and denominator.
--
Theorem 459: [Expressing the sign of a rational in terms of the numerator and denominator of any representing fraction] ((X in Si) & (Y in Si) & (Y /= [0,0])) imp (Ra_is_nonneg(Fr_to_Ra([X,Y])) eq is_nonneg(X S_TIMES Y)). Proof:
    Suppose_not(n,m) ==> (n in Si) & (m in Si) & (m /= [0,0]) & (not(Ra_is_nonneg(Fr_to_Ra([n,m])) eq is_nonneg(n S_TIMES m)))
    (n,m)-->T432(*) ==> [n,m] in Fr
    ([n,m])-->T421 ==> Fr_to_Ra([n,m]) in Ra
    (Fr_to_Ra([n,m]))-->T423 ==> arb(Fr_to_Ra([n,m])) in Fr
    ([n,m])-->T421 ==> Same_frac([n,m],arb(Fr_to_Ra([n,m])))
    ([n,m],arb(Fr_to_Ra([n,m])))-->T442 ==>
	is_nonneg(car(arb(Fr_to_Ra([n,m]))) S_TIMES cdr(arb(Fr_to_Ra([n,m])))) eq is_nonneg(car([n,m]) S_TIMES cdr([n,m]))
    ELEM ==> (car([n,m]) = n) & (cdr([n,m]) = m)
    EQUAL ==> is_nonneg(car(arb(Fr_to_Ra([n,m]))) S_TIMES cdr(arb(Fr_to_Ra([n,m])))) eq is_nonneg(n S_TIMES m)
    Use_def(Ra_is_nonneg) ==>
	Ra_is_nonneg(Fr_to_Ra([n,m])) eq (is_nonneg(car(arb(Fr_to_Ra([n,m]))) S_TIMES cdr(arb(Fr_to_Ra([n,m])))))
    Discharge ==> QED
--
-- Next we not that various utility constants are signed integers (or fractions): the zero and unity signed integers,
-- likewise the zero and unity fractions.
--
Theorem 460: [The unit and zero signed signed integers addition] ([1,0] in Si) & ([0,0] in Si) & ([1,0] /= [0,0]) & ([[0,0],[1,0]] in Fr) & ([[1,0],[1,0]] in Fr). Proof:
	Suppose_not ==> not( ([1,0] in Si) & ([0,0] in Si) & ([1,0] /= [0,0]) & ([[0,0],[1,0]] in Fr) & ([[1,0],[1,0]] in Fr))
	T212 ==> (0 in Za) & (1 in Za) & (0 /= 1)
	Suppose ==> [1,0] notin Si
	Use_def(Si) ==> Stat1: [1,0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(1,0)-->Stat1 ==> false; Discharge ==> [1,0] in Si
	Suppose ==> [0,0] notin Si
	Use_def(Si) ==> Stat2: [0,0] notin {[x,y]: x in Za, y in Za | x = 0 or y = 0}
	(0,0)-->Stat2 ==> false; Discharge ==> [0,0] in Si
	ELEM ==> [1,0] /= [0,0]
    ([0,0],[1,0])-->T432(*) ==> [[0,0],[1,0]] in Fr
    ([1,0],[1,0])-->T432(*) ==> [[1,0],[1,0]] in Fr
    Discharge ==> QED
--
-- Our next, quite elementary, result simply state that the unit rational number is the multiplicative unit for rationals.
--
Theorem 461: [The unit rational is the rational multiplicative identity] (M in Ra) imp (M = M Ra_TIMES Ra_1). Proof:
    Suppose_not(m) ==> (m in Ra) & (m /= m Ra_TIMES Ra_1)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(m))-->T431 ==>
	(arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    Loc_def ==> am = car(arb(m))
    Loc_def ==> dm = cdr(arb(m))
    Use_def(Ra_1) ==> m /= m Ra_TIMES Fr_to_Ra([[1,0],[1,0]])
    T460 ==> ([1,0] in Si) & ([1,0] /= [0,0])
    (m,[1,0],[1,0])-->T439 ==>  m /= Fr_to_Ra([car(arb(m)) S_TIMES [1,0],cdr(arb(m)) S_TIMES [1,0]])
    EQUAL ==> m /= Fr_to_Ra([am S_TIMES [1,0],dm S_TIMES [1,0]])
    am-->T402 ==> am S_TIMES [1,0] = am
    dm-->T402 ==> dm S_TIMES [1,0] = dm
    EQUAL ==> m /= Fr_to_Ra([am,dm])
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that if m is a nonzero rational, its reciprocal Recip(m) is also a rational,
-- and is the multiplicative inverse of m. This tells us that the rational numbers form an
-- algebraic 'field'.
--
Theorem 462: [Multiplication of a rational by its reciprocal gives 1] ((M in Ra) & (M /= Ra_0)) imp ((Recip(M) in Ra) & (M Ra_TIMES Recip(M) = Ra_1)). Proof:
    Suppose_not(m) ==> Stat1: (m in Ra) & (m /= Ra_0) & (Recip(m) notin Ra or m Ra_TIMES Recip(m) /= Ra_1)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(m))-->T431 ==>
	(arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    Loc_def ==> am = car(arb(m))
    Loc_def ==> dm = cdr(arb(m))
    EQUAL ==> Stat2: (arb(m) = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    EQUAL ==> [am,dm] in Fr
    T460 ==> Stat3: ([1,0] in Si) & ([0,0] in Si) & ([1,0] /= [0,0]) & ([[0,0],[1,0]] in Fr) & ([[1,0],[1,0]] in Fr)
    Suppose ==> am = [0,0]
    EQUAL ==> am S_TIMES [1,0] = [0,0] S_TIMES [1,0]
    dm-->T401 ==> [0,0] S_TIMES dm = [0,0]
    ([1,0])-->T401 ==> [0,0] S_TIMES dm = [0,0]
    ALGEBRA ==> dm S_TIMES [0,0] = [0,0]
    ELEM ==> (car([am,dm]) = am) & (cdr([am,dm]) = dm) & (car([[0,0],[1,0]]) = [0,0]) & (cdr([[0,0],[1,0]]) = [1,0])
    EQUAL ==> car([am,dm]) S_TIMES cdr([[0,0],[1,0]]) = cdr([am,dm]) S_TIMES car([[0,0],[1,0]])
    Use_def(Same_frac) ==> Same_frac([am,dm],[[0,0],[1,0]])
    ([am,dm],[[0,0],[1,0]])-->T422 ==> Fr_to_Ra([am,dm]) = Fr_to_Ra([[0,0],[1,0]])
    EQUAL ==> Fr_to_Ra([am,dm]) = m
    Use_def(Ra_0) ==> false; Discharge ==> Stat4: am /= [0,0]
    Use_def(Recip) ==> Recip(m) = Fr_to_Ra([cdr(arb(m)),car(arb(m))])
    (dm,am)-->T432(*) ==> [dm,am] in Fr
    ALGEBRA ==> (am S_TIMES dm in Si) & (dm S_TIMES am in Si)
	(am,dm)-->T407(Stat2,Stat4*) ==> dm S_TIMES am /= [0,0]
    (am S_TIMES dm,dm S_TIMES am)-->T432(*) ==> Stat5: [am S_TIMES dm,dm S_TIMES am] in Fr
    EQUAL ==> Stat6: Recip(m) = Fr_to_Ra([dm,am])
    ([dm,am])-->T421 ==> Stat7: Recip(m) in Ra
    EQUAL(Stat7,Stat1,Stat6) ==> Stat8: (m Ra_TIMES Fr_to_Ra([dm,am]) /= Ra_1)
    (m,dm,am)-->T439(Stat1,Stat8,Stat2,Stat4) ==> Fr_to_Ra([car(arb(m)) S_TIMES dm,cdr(arb(m)) S_TIMES am]) /= Ra_1
    EQUAL ==> Fr_to_Ra([am S_TIMES dm,dm S_TIMES am]) /= Ra_1
    Use_def(Ra_1) ==> Stat9: Fr_to_Ra([am S_TIMES dm,dm S_TIMES am]) /= Fr_to_Ra([[1,0],[1,0]])
    ([am S_TIMES dm,dm S_TIMES am],[[1,0],[1,0]])-->T422(Stat9,Stat3,Stat5) ==>
    		not Same_frac([am S_TIMES dm,dm S_TIMES am],[[1,0],[1,0]])
    Use_def(Same_frac) ==> Stat10: car([am S_TIMES dm,dm S_TIMES am]) S_TIMES cdr([[1,0],[1,0]]) /=
    	cdr([am S_TIMES dm,dm S_TIMES am]) S_TIMES car([[1,0],[1,0]])
    (Stat10)ELEM ==> (am S_TIMES dm) S_TIMES [1,0] /= (dm S_TIMES am) S_TIMES [1,0]
    ALGEBRA ==> false; Discharge ==> QED
--
-- The following corollary of Theorem 462 is of a merely technical nature.
--
Theorem 463: ((N in Ra) & (M in Ra) & (M /= Ra_0)) imp (((N Ra_TIMES (M Ra_TIMES M)) Ra_TIMES (Recip(M) Ra_TIMES Recip(M))) = N). Proof:
    Suppose_not(n,m) ==> AUTO
        m-->T462 ==> (Recip(m) in Ra) & ((m Ra_TIMES Recip(m)) = Ra_1)
        (m,m)-->T448 ==> (m Ra_TIMES m) in Ra
        (Recip(m),Recip(m))-->T448 ==> (Recip(m) Ra_TIMES Recip(m)) in Ra
        (Recip(m),m Ra_TIMES m,Recip(m))-->T456 ==> ((m Ra_TIMES m) Ra_TIMES (Recip(m) Ra_TIMES Recip(m))) = (((m Ra_TIMES m) Ra_TIMES Recip(m)) Ra_TIMES Recip(m))
        (Recip(m) Ra_TIMES Recip(m),n,m Ra_TIMES m)-->T456 ==> (n Ra_TIMES ((m Ra_TIMES m) Ra_TIMES (Recip(m) Ra_TIMES Recip(m)))) = ((n Ra_TIMES (m Ra_TIMES m)) Ra_TIMES (Recip(m) Ra_TIMES Recip(m)))
        (Recip(m),m,m)-->T456 ==> (m Ra_TIMES (m Ra_TIMES Recip(m))) = ((m Ra_TIMES m) Ra_TIMES Recip(m))
        m-->T461 ==> (m = m Ra_TIMES Ra_1)
        n-->T461 ==> (n = n Ra_TIMES Ra_1)
    EQUAL ==> false; Discharge ==> QED
--
-- The following elementary extension of Theorem 462 gives
-- the inverse relationship between rational multiplication and division.
--
Theorem 464: [Rational division is multiplication by the reciprocal] ((N in Ra) & (M in Ra) & (M /= Ra_0)) imp (N = M Ra_TIMES (N Ra_OVER M)). Proof:
    Suppose_not(n,m) ==> (n in Ra) & (m in Ra) & (m /= Ra_0) & (n /= m Ra_TIMES (n Ra_OVER m))
    m-->T462 ==> Recip(m) in Ra
    Use_def(Ra_OVER) ==> n Ra_OVER m = n Ra_TIMES Recip(m)
    EQUAL ==> n /= m Ra_TIMES (n Ra_TIMES Recip(m))
    (m,n Ra_TIMES Recip(m))-->T448 ==> n /= m Ra_TIMES (n Ra_TIMES Recip(m))
    (n,Recip(m))-->T448 ==> n Ra_TIMES Recip(m) = Recip(m) Ra_TIMES n
    EQUAL ==> n /= m Ra_TIMES (Recip(m) Ra_TIMES n)
    (n,m,Recip(m))-->T456 ==> n /= (m Ra_TIMES Recip(m)) Ra_TIMES n
    m-->T462 ==> m Ra_TIMES Recip(m) = Ra_1
    EQUAL ==> n /= Ra_1 Ra_TIMES n
    T451 ==> Ra_1 in Ra
    (n,Ra_1)-->T448 ==> n /= n Ra_TIMES Ra_1
    n-->T461 ==> false; Discharge ==> QED
--
Theorem 465: [0 and 1 have non-negative rationals] Ra_is_nonneg(Ra_0) & Ra_is_nonneg(Ra_1). Proof:
	Suppose_not ==> not (Ra_is_nonneg(Ra_0) & Ra_is_nonneg(Ra_1))
    T368 ==> Stat1: ([0,0] in Si) & ([1,0] in Si)
    T212 ==> Stat2: 1 /= 0
    (Stat1)ELEM ==> ([[0,0],[1,0]] = [car([[0,0],[1,0]]),cdr([[0,0],[1,0]])]) &
    		(car([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) /= [0,0])
    ([0,0],[1,0])-->T432(*) ==> [[0,0],[1,0]] in Fr
    ([1,0],[1,0])-->T432(*) ==> [[1,0],[1,0]] in Fr
	([[0,0],[1,0]])-->T421 ==> Fr_to_Ra([[0,0],[1,0]]) in Ra
	([[1,0],[1,0]])-->T421 ==> Fr_to_Ra([[1,0],[1,0]]) in Ra
	(Fr_to_Ra([[0,0],[1,0]]))-->T423 ==> arb(Fr_to_Ra([[0,0],[1,0]])) in Fr
	(Fr_to_Ra([[1,0],[1,0]]))-->T423 ==> arb(Fr_to_Ra([[1,0],[1,0]])) in Fr
	Use_def(Ra_0) ==> Ra_0 = Fr_to_Ra([[0,0],[1,0]])
	Use_def(Ra_1) ==> Ra_1 = Fr_to_Ra([[1,0],[1,0]])
	EQUAL ==> not (Ra_is_nonneg(Fr_to_Ra([[0,0],[1,0]])) & Ra_is_nonneg(Fr_to_Ra([[1,0],[1,0]])))
    T460 ==> ([0,0] in Si) & ([1,0] in Si) & ([1,0] /= [0,0])
    Use_def(Ra_is_nonneg) ==>
    	(Ra_is_nonneg(Fr_to_Ra([[0,0],[1,0]])) eq
    		is_nonneg(car(arb(Fr_to_Ra([[0,0],[1,0]]))) S_TIMES cdr(arb(Fr_to_Ra([[0,0],[1,0]]))))) &
	(Ra_is_nonneg(Fr_to_Ra([[1,0],[1,0]])) eq
		is_nonneg(car(arb(Fr_to_Ra([[1,0],[1,0]]))) S_TIMES cdr(arb(Fr_to_Ra([[1,0],[1,0]])))))
    ELEM ==> (car([[0,0],[1,0]]) = [0,0]) & (cdr([[0,0],[1,0]]) = [1,0])
    ELEM ==> (car([[1,0],[1,0]]) = [1,0]) & (cdr([[1,0],[1,0]]) = [1,0])
    ([[1,0],[1,0]])-->T421 ==> Same_frac([[1,0],[1,0]],arb(Fr_to_Ra([[1,0],[1,0]])))
    ([[0,0],[1,0]])-->T421 ==> Same_frac([[0,0],[1,0]],arb(Fr_to_Ra([[0,0],[1,0]])))
    ([[1,0],[1,0]],arb(Fr_to_Ra([[1,0],[1,0]])))-->T442 ==>
    	is_nonneg(car([[1,0],[1,0]]) S_TIMES cdr([[1,0],[1,0]])) eq
    			is_nonneg(car(arb(Fr_to_Ra([[1,0],[1,0]]))) S_TIMES cdr(arb(Fr_to_Ra([[1,0],[1,0]]))))
    ([[0,0],[1,0]],arb(Fr_to_Ra([[0,0],[1,0]])))-->T442 ==>
    	is_nonneg(car([[0,0],[1,0]]) S_TIMES cdr([[0,0],[1,0]])) eq
    			is_nonneg(car(arb(Fr_to_Ra([[0,0],[1,0]]))) S_TIMES cdr(arb(Fr_to_Ra([[0,0],[1,0]]))))
    EQUAL ==> (Ra_is_nonneg(Fr_to_Ra([[0,0],[1,0]])) eq is_nonneg([0,0] S_TIMES [1,0])) &
		(Ra_is_nonneg(Fr_to_Ra([[1,0],[1,0]])) eq is_nonneg([1,0] S_TIMES [1,0]))
    ([0,0])-->T402 ==> [0,0] S_TIMES [1,0] = [0,0]
    ([1,0])-->T402 ==> [1,0] S_TIMES [1,0] = [1,0]
    EQUAL ==> Ra_is_nonneg(Fr_to_Ra([[0,0],[1,0]])) eq is_nonneg([0,0])
    EQUAL ==> Ra_is_nonneg(Fr_to_Ra([[1,0],[1,0]])) eq is_nonneg([1,0])
    Use_def(is_nonneg) ==> Ra_is_nonneg(Fr_to_Ra([[0,0],[1,0]])) &  Ra_is_nonneg(Fr_to_Ra([[1,0],[1,0]]))
    Discharge ==> QED
--
-- Next we show that given a rational number $r$, either it or its reverse $Ra_Rev(r)$
-- must be non-negative, and that if both are non-negative $r$ must be zero.
-- This is the rational analog of Theorem 424 for signed integers.
--
Theorem 466: [One of a rational and its additive inverse is always non-negative, and both are non-negative only if the rational is zero] (X in Ra) imp ((Ra_is_nonneg(X) or Ra_is_nonneg(Ra_Rev(X))) &
	((Ra_is_nonneg(X) & Ra_is_nonneg(Ra_Rev(X))) imp (X = Ra_0))). Proof:
--
-- This is a duplicate of Theorem 466: one of the two should be suppressed!
--
	Suppose_not(n) ==> (n in Ra) & ((not (Ra_is_nonneg(n) or Ra_is_nonneg(Ra_Rev(n)))) or
				(Ra_is_nonneg(n) & Ra_is_nonneg(Ra_Rev(n)) & (n /= Ra_0)))
	Use_def(Ra_Rev) ==> Ra_Rev(n) = Fr_to_Ra([S_Rev(car(arb(n))),cdr(arb(n))])
	EQUAL ==> Ra_is_nonneg(Ra_Rev(n)) eq Ra_is_nonneg(Fr_to_Ra([S_Rev(car(arb(n))),cdr(arb(n))]))
	n-->T423 ==> Stat1: (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
	(arb(n))-->T431 ==>
	(arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
    EQUAL ==> [car(arb(n)),cdr(arb(n))] in Fr
    (car(arb(n)))-->T391 ==> S_Rev(car(arb(n))) in Si
    (S_Rev(car(arb(n))),cdr(arb(n)))-->T459 ==>
    		Ra_is_nonneg(Ra_Rev(n)) eq is_nonneg(S_Rev(car(arb(n))) S_TIMES cdr(arb(n)))
	ELEM ==> (not (Ra_is_nonneg(n) or is_nonneg(S_Rev(car(arb(n))) S_TIMES cdr(arb(n))))) or
				((Ra_is_nonneg(n) & is_nonneg(S_Rev(car(arb(n))) S_TIMES cdr(arb(n)))) & (n /= Ra_0))
	Use_def(Ra_is_nonneg) ==> (not(is_nonneg(car(arb(n)) S_TIMES cdr(arb(n))) or
					is_nonneg(S_Rev(car(arb(n))) S_TIMES cdr(arb(n))))) or
			(is_nonneg(car(arb(n)) S_TIMES cdr(arb(n))) &
					is_nonneg(S_Rev(car(arb(n))) S_TIMES cdr(arb(n))) & (n /= Ra_0))
	ALGEBRA ==> S_Rev(car(arb(n))) S_TIMES cdr(arb(n)) = S_Rev(car(arb(n)) S_TIMES cdr(arb(n)))
	EQUAL ==> (not(is_nonneg(car(arb(n)) S_TIMES cdr(arb(n))) or
					is_nonneg(S_Rev(car(arb(n)) S_TIMES cdr(arb(n)))))) or
			(is_nonneg(car(arb(n)) S_TIMES cdr(arb(n))) &
					is_nonneg(S_Rev(car(arb(n)) S_TIMES cdr(arb(n)))) & (n /= Ra_0))
	ALGEBRA ==> car(arb(n)) S_TIMES cdr(arb(n)) in Si
	(car(arb(n)) S_TIMES cdr(arb(n)))-->T424 ==> Stat2: (car(arb(n)) S_TIMES cdr(arb(n)) = [0,0]) & (n /= Ra_0)
	(cdr(arb(n)),car(arb(n)))-->T407 ==> car(arb(n)) = [0,0]
	Use_def(Ra_0) ==> Ra_0 = Fr_to_Ra([[0,0],[1,0]])
	Use_def(Same_frac) ==> Stat3: Same_frac([[0,0],[1,0]],[car(arb(n)),cdr(arb(n))]) eq
			(car([[0,0],[1,0]]) S_TIMES cdr([car(arb(n)),cdr(arb(n))]) =
						cdr([[0,0],[1,0]]) S_TIMES car([car(arb(n)),cdr(arb(n))]))
	(Stat3)ELEM ==> Same_frac([[0,0],[1,0]],[car(arb(n)),cdr(arb(n))]) eq
	([0,0] S_TIMES cdr(arb(n)) = [1,0] S_TIMES car(arb(n)))
	EQUAL ==> Stat4: Same_frac([[0,0],[1,0]],[car(arb(n)),cdr(arb(n))]) eq
	([0,0] S_TIMES cdr(arb(n)) = [1,0] S_TIMES [0,0])
	(cdr(arb(n)))-->T401 ==> [0,0] S_TIMES cdr(arb(n)) = [0,0]
	T368 ==> [0,0] in Si
	([0,0])-->T401 ==> [1,0] S_TIMES [0,0] = [0,0]
	T368 ==> Stat5: ([0,0] in Si) & ([1,0] in Si)
    T212 ==> Stat6: 1 /= 0
    (Stat5)ELEM ==> ([[0,0],[1,0]] = [car([[0,0],[1,0]]),cdr([[0,0],[1,0]])]) &
    		(car([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) /= [0,0])
    ([0,0],[1,0])-->T432(*) ==> [[0,0],[1,0]] in Fr
	(Stat4)ELEM ==> Same_frac([[0,0],[1,0]],[car(arb(n)),cdr(arb(n))])
	([[0,0],[1,0]],[car(arb(n)),cdr(arb(n))])-->T422 ==>
			Fr_to_Ra([[0,0],[1,0]]) = Fr_to_Ra([car(arb(n)),cdr(arb(n))])
	EQUAL ==> Stat7: Ra_0 = Fr_to_Ra(arb(n))
	(Stat7,Stat2,Stat1)Discharge ==> QED
--
--
--
Theorem 467: [The unit rational is the identity for multiplication] (X in Ra) imp (X = X Ra_TIMES Ra_1). Proof:
    Suppose_not(n) ==> (n in Ra) & (n /= n Ra_TIMES Ra_1)
    Use_def(Ra_1) ==> n /= n Ra_TIMES Fr_to_Ra([[1,0],[1,0]])
    T368 ==> ([1,0] in Si) & ([1,0] /= [0,0])
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    (n,[1,0],[1,0])-->T439 ==> n Ra_TIMES Fr_to_Ra([[1,0],[1,0]]) =
    			Fr_to_Ra([car(arb(n)) S_TIMES [1,0],cdr(arb(n)) S_TIMES [1,0]])
    (arb(n))-->T431 ==>
	(arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
 	(car(arb(n)))-->T402 ==> car(arb(n)) S_TIMES [1,0] = car(arb(n))
 	(cdr(arb(n)))-->T402 ==> cdr(arb(n)) S_TIMES [1,0] = cdr(arb(n))
 	EQUAL ==> n Ra_TIMES Fr_to_Ra([[1,0],[1,0]]) = Fr_to_Ra([car(arb(n)),cdr(arb(n))])
 	EQUAL ==> false; Discharge ==> QED
--
-- Next we show that a rational number is zero if and only if the numerator of any one of
-- its expressions as a fraction is zero.
--
Theorem 468: [The zero rational is represented by any fraction whose numerator is 0] (X in Ra) imp ((X = Ra_0) eq (car(arb(X)) = [0,0])). Proof:
    Suppose_not(n) ==> (n in Ra) & (not((n = Ra_0) eq (car(arb(n)) = [0,0])))
    Use_def(Ra_0) ==> Ra_0 = Fr_to_Ra([[0,0],[1,0]])
    T368 ==> Stat1: ([0,0] in Si) & ([1,0] in Si) & ([1,0] /= [0,0])
    ([0,0],[1,0])-->T432(*) ==> [[0,0],[1,0]] in Fr
	ELEM ==> (cdr([[0,0],[1,0]]) = [1,0]) & (car([[0,0],[1,0]]) = [0,0])
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    (arb(n))-->T431 ==>
	(arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
	Suppose ==> car(arb(n)) = [0,0]
	Suppose ==> not Same_frac(arb(n),[[0,0],[1,0]])
    Use_def(Same_frac) ==> cdr(arb(n)) S_TIMES car([[0,0],[1,0]]) /= car(arb(n)) S_TIMES cdr([[0,0],[1,0]])
	EQUAL ==> cdr(arb(n)) S_TIMES [0,0] /= [0,0] S_TIMES [1,0]
	ALGEBRA ==> [0,0] S_TIMES cdr(arb(n)) /= [0,0] S_TIMES [1,0]
	(cdr(arb(n)))-->T401 ==> [0,0] S_TIMES cdr(arb(n)) = [0,0]
 	([1,0])-->T401 ==> false; Discharge ==> Same_frac(arb(n),[[0,0],[1,0]])
	(arb(n),[[0,0],[1,0]])-->T422 ==> Fr_to_Ra(arb(n)) = Fr_to_Ra([[0,0],[1,0]])
	EQUAL ==> false; Discharge ==> (car(arb(n)) /= [0,0]) & (n = Ra_0)
	ELEM ==> Fr_to_Ra(arb(n)) = Fr_to_Ra([[0,0],[1,0]])
	(arb(n),[[0,0],[1,0]])-->T422 ==> Same_frac(arb(n),[[0,0],[1,0]])
	Use_def(Same_frac) ==> car(arb(n)) S_TIMES cdr([[0,0],[1,0]]) = cdr(arb(n)) S_TIMES car([[0,0],[1,0]])
	EQUAL ==> car(arb(n)) S_TIMES [1,0] = cdr(arb(n)) S_TIMES [0,0]
	ALGEBRA ==> car(arb(n)) S_TIMES [1,0] = [0,0] S_TIMES cdr(arb(n))
	(cdr(arb(n)))-->T401 ==> car(arb(n)) S_TIMES [1,0] = [0,0]
	ALGEBRA ==> [1,0] S_TIMES car(arb(n)) = [0,0]
    (car(arb(n)))-->T401 ==> false; Discharge ==> QED
--
-- Our next theorem states that the product and sum of any two non-negative rational numbers
-- is non-negative.
--
Theorem 469: [The sum and product of two non-negative rationals is non-negative] ((X in Ra) & (Y in Ra) & Ra_is_nonneg(X) & Ra_is_nonneg(Y)) imp
	(Ra_is_nonneg(X Ra_PLUS Y) & Ra_is_nonneg(X Ra_TIMES Y)). Proof:
    Suppose_not(n,m) ==> (n in Ra) & (m in Ra) & Ra_is_nonneg(n) & Ra_is_nonneg(m) &
	(not(Ra_is_nonneg(n Ra_PLUS m) & Ra_is_nonneg(n Ra_TIMES m)))
    n-->T423 ==> (arb(n) in Fr) & (Fr_to_Ra(arb(n)) = n)
    m-->T423 ==> (arb(m) in Fr) & (Fr_to_Ra(arb(m)) = m)
    (arb(n))-->T431 ==>
	(arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) & (cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
    (arb(m))-->T431 ==>
	(arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) & (cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
    Loc_def ==> an = car(arb(n))
    Loc_def ==> dn = cdr(arb(n))
    Loc_def ==> am = car(arb(m))
    Loc_def ==> dm = cdr(arb(m))
    EQUAL ==> Stat1: (arb(n) = [an,dn]) & (an in Si) & (dn in Si) & (dn /= [0,0])
    EQUAL ==> Stat2: (arb(m) = [am,dm]) & (am in Si) & (dm in Si) & (dm /= [0,0])
    (dm,dn)-->T407(Stat1,Stat2*) ==> Stat3: dn S_TIMES dm /= [0,0]
    Use_def(Ra_is_nonneg) ==> is_nonneg(car(arb(n)) S_TIMES cdr(arb(n))) & is_nonneg(car(arb(m)) S_TIMES cdr(arb(m)))
    EQUAL ==> Stat4: is_nonneg(an S_TIMES dn) & is_nonneg(am S_TIMES dm)
    ALGEBRA ==> Stat5: (an S_TIMES am in Si) & (dn S_TIMES dm in Si)
    ALGEBRA ==> Stat6: (an S_TIMES dn in Si) & (am S_TIMES dm in Si)
    Suppose ==> not Ra_is_nonneg(n Ra_TIMES m)
    Use_def(Ra_TIMES) ==> not Ra_is_nonneg(Fr_to_Ra([car(arb(n)) S_TIMES car(arb(m)),cdr(arb(n)) S_TIMES cdr(arb(m))]))
    EQUAL ==> not Ra_is_nonneg(Fr_to_Ra([an S_TIMES am, dn S_TIMES dm]))
    (an S_TIMES am, dn S_TIMES dm)-->T459 ==> not is_nonneg((an S_TIMES am) S_TIMES (dn S_TIMES dm))
    ALGEBRA ==> not is_nonneg((an S_TIMES dn) S_TIMES (am S_TIMES dm))
    (an S_TIMES dn,am S_TIMES dm)-->T425 ==> false; Discharge ==> not Ra_is_nonneg(n Ra_PLUS m)
    Use_def(Ra_PLUS) ==> not Ra_is_nonneg(Fr_to_Ra([(car(arb(n)) S_TIMES cdr(arb(m))) S_PLUS (car(arb(m)) S_TIMES cdr(arb(n))),
    											cdr(arb(n)) S_TIMES cdr(arb(m))]))
    EQUAL ==> Stat7: not Ra_is_nonneg(Fr_to_Ra([(an S_TIMES dm) S_PLUS (am S_TIMES dn), dn S_TIMES dm]))
    ALGEBRA ==> Stat8: (an S_TIMES dm) S_PLUS (am S_TIMES dn) in Si
    ((an S_TIMES dm) S_PLUS (am S_TIMES dn),dn S_TIMES dm)-->T459(Stat7,Stat8,Stat5,Stat3) ==>
	not is_nonneg(((an S_TIMES dm) S_PLUS (am S_TIMES dn)) S_TIMES (dn S_TIMES dm))
    ALGEBRA ==> not is_nonneg(((an S_TIMES dn) S_TIMES (dm S_TIMES dm)) S_PLUS ((am S_TIMES dm) S_TIMES (dn S_TIMES dn)))
    dn-->T429 ==> Stat9: is_nonneg(dn S_TIMES dn)
    dm-->T429 ==> Stat10: is_nonneg(dm S_TIMES dm)
    ALGEBRA ==> Stat11: (dm S_TIMES dm in Si) & (dn S_TIMES dn in Si)
    (an S_TIMES dn,dm S_TIMES dm)-->T425(Stat5,Stat4,Stat9,Stat10,Stat6,Stat11) ==> Stat12: is_nonneg((an S_TIMES dn) S_TIMES (dm S_TIMES dm))
    (am S_TIMES dm,dn S_TIMES dn)-->T425(Stat5,Stat4,Stat9,Stat10,Stat6,Stat11) ==> is_nonneg((am S_TIMES dm) S_TIMES (dn S_TIMES dn))
    ALGEBRA ==> ((an S_TIMES dn) S_TIMES (dm S_TIMES dm) in SI) & ((am S_TIMES dm) S_TIMES (dn S_TIMES dn) in Si)
    ((an S_TIMES dn) S_TIMES (dm S_TIMES dm),((am S_TIMES dm) S_TIMES (dn S_TIMES dn)))-->T425(Stat12) ==>
	is_nonneg(((an S_TIMES dn) S_TIMES (dm S_TIMES dm)) S_PLUS ((am S_TIMES dm) S_TIMES (dn S_TIMES dn)))
    Discharge ==> QED
--
-- We add various additional elementary properties of the ordering of rationals.
--

--
-- The following compound of earlier theorems is derived
-- uniquely as a trigger for the THEORY Ordered_add.
--
Theorem 470: (Ra_0 in Ra) &
	(FORALL x in Ra | ((x Ra_PLUS Ra_0) = x) & ((x Ra_PLUS Ra_Rev(x)) = Ra_0) & (Ra_Rev(x) in Ra))  &
	(FORALL x in Ra, y in Ra | ((x Ra_PLUS y) in Ra) & ((x Ra_PLUS y) = (y Ra_PLUS x)) & ((x Ra_PLUS Ra_Rev(y)) = (x Ra_MINUS y))) &
	(FORALL x in Ra, y in Ra, z in Ra | ((x Ra_PLUS y) Ra_PLUS z) = (x Ra_PLUS (y Ra_PLUS z))) &
	(FORALL x in Ra, y in Ra | (Ra_is_nonneg(x) & Ra_is_nonneg(y)) imp Ra_is_nonneg(x Ra_PLUS y)) &
	(FORALL x in Ra | (Ra_is_nonneg(x) or Ra_is_nonneg(Ra_Rev(x))) & ((Ra_is_nonneg(x) & Ra_is_nonneg(Ra_Rev(x))) imp (x = Ra_0))). Proof:
Suppose_not ==> AUTO
	ALGEBRA ==> Ra_0 in Ra
	Suppose ==> Stat1: not(FORALL x in Ra | ((x Ra_PLUS Ra_0) = x) & ((x Ra_PLUS Ra_Rev(x)) = Ra_0) & (Ra_Rev(x) in Ra))
		x1-->Stat1(Stat1*) ==> (x1 in Ra) & (not(((x1 Ra_PLUS Ra_0) = x1) & ((x1 Ra_PLUS Ra_Rev(x1)) = Ra_0) & (Ra_Rev(x1) in Ra)))
			ALGEBRA(Stat1) ==> ((x1 Ra_PLUS Ra_0) = x1) & ((x1 Ra_PLUS Ra_Rev(x1)) = Ra_0) & (Ra_Rev(x1) in Ra)
	(Stat1)Discharge ==> AUTO
	Suppose ==> Stat2: not(FORALL x in Ra, y in Ra | ((x Ra_PLUS y) in Ra) & ((x Ra_PLUS y) = (y Ra_PLUS x)) & ((x Ra_PLUS Ra_Rev(y)) = (x Ra_MINUS y)))
		(x2,y2)-->Stat2(Stat2*) ==> (x2 in Ra) & (y2 in Ra) & (not(((x2 Ra_PLUS y2) in Ra) & ((x2 Ra_PLUS y2) = (y2 Ra_PLUS x2)) & ((x2 Ra_PLUS Ra_Rev(y2)) = (x2 Ra_MINUS y2))))
			ALGEBRA(Stat2) ==> ((x2 Ra_PLUS y2) in Ra) & ((x2 Ra_PLUS y2) = (y2 Ra_PLUS x2)) & ((x2 Ra_PLUS Ra_Rev(y2)) = (x2 Ra_MINUS y2))
	(Stat2)Discharge ==> AUTO
	Suppose ==> Stat3: not(FORALL x in Ra, y in Ra, z in Ra | ((x Ra_PLUS y) Ra_PLUS z) = (x Ra_PLUS (y Ra_PLUS z)))
		(x3,y3,z3)-->Stat3(Stat3*) ==> (x3 in Ra) & (y3 in Ra) & (z3 in Ra) & (((x3 Ra_PLUS y3) Ra_PLUS z3) /= (x3 Ra_PLUS (y3 Ra_PLUS z3)))
	ALGEBRA(Stat3) ==> false; (Stat3)Discharge ==> AUTO
	Suppose ==> Stat4: not(FORALL x in Ra, y in Ra | (Ra_is_nonneg(x) & Ra_is_nonneg(y)) imp Ra_is_nonneg(x Ra_PLUS y))
		(x4,y4)-->Stat4(Stat4*) ==> (x4 in Ra) & (y4 in Ra) & (not((Ra_is_nonneg(x4) & Ra_is_nonneg(y4)) imp Ra_is_nonneg(x4 Ra_PLUS y4)))
	(x4,y4)-->T469(Stat4*) ==> false; Discharge ==> Stat5: not(FORALL x in Ra | (Ra_is_nonneg(x) or Ra_is_nonneg(Ra_Rev(x))) & ((Ra_is_nonneg(x) & Ra_is_nonneg(Ra_Rev(x))) imp (x = Ra_0)))
	x5-->Stat5(Stat5*) ==> (x5 in Ra) & (not((Ra_is_nonneg(x5) or Ra_is_nonneg(Ra_Rev(x5))) & ((Ra_is_nonneg(x5) & Ra_is_nonneg(Ra_Rev(x5))) imp (x5 = Ra_0))))
	x5-->T466(Stat5*) ==> false; Discharge ==> QED
--
--
--
APPLY(GE_thryvar:Ra_GE,LE_thryvar:Ra_LE,GT_thryvar:Ra_GT,LT_thryvar:Ra_LT) Ordered_add(g->Ra,e->Ra_0,pluz(i,j)->(i Ra_PLUS j),minz(i,j)->(i Ra_MINUS j),rvz(i)->Ra_Rev(i),nneg(j)->Ra_is_nonneg(j)) ==>
Theorem 471: [The ordering of two rationals is defined by the sign of their differences, 0] (FORALL x, y | (Ra_GE(x,y) eq Ra_is_nonneg(x Ra_PLUS Ra_Rev(y))) & (Ra_LE(x,y) eq Ra_GE(y,x)) &
	(Ra_GT(x,y) eq (Ra_GE(x,y) & (x /= y))) & (Ra_LT(x,y) eq Ra_GT(y,x))) &
	(FORALL x, y | (Ra_LE(x,y) eq Ra_is_nonneg((y Ra_PLUS Ra_Rev(x)))) &
		(((x in Ra) & (y in Ra)) imp (Ra_GT(x,y) eq (Ra_is_nonneg((x Ra_PLUS Ra_Rev(y))) & (x /= y)))) &
		(((x in Ra) & (y in Ra)) imp (Ra_GT(x,y) eq (Ra_is_nonneg((x Ra_MINUS y)) & (x /= y))))) &
	(FORALL x, y | ((x in Ra) & (y in Ra) & ((x = y) or (not Ra_GE(x,y)))) imp Ra_GE(y,x))
--
    Def 000o: Def(X Ra_GE Y) := Ra_GE(X,Y)
    Def 000p: Def(X Ra_LE Y) := Ra_LE(X,Y)
    Def 000q: Def(X Ra_GT Y) := Ra_GT(X,Y)
    Def 000r: Def(X Ra_LT Y) := Ra_LT(X,Y)

Theorem 472: [The ordering of two rationals is defined by the sign of their differences] (FORALL x,y | ((x Ra_GE y) eq Ra_is_nonneg(x Ra_PLUS Ra_Rev(y)))) &
	(FORALL x,y | (x Ra_LE y) eq (y Ra_GE x)) &
	(FORALL x,y | ((x Ra_GT y) eq ((x Ra_GE y) & (x /= y)))) &
	(FORALL x,y | ((x Ra_LT y) eq (y Ra_GT x)))  &
    (FORALL x,y | ((x Ra_LE y) eq Ra_is_nonneg(y Ra_PLUS Ra_Rev(x)))) &
	(FORALL x,y | (((x in Ra) & (y in Ra)) imp ((x Ra_GT y) eq (Ra_is_nonneg(x Ra_PLUS Ra_Rev(y)) & (x /= y))))) &
	(FORALL x,y | (((x in Ra) & (y in Ra)) imp ((x Ra_GT y) eq (Ra_is_nonneg(x Ra_MINUS y) & (x /= y))))) &
    (FORALL x,y | (((x in Ra) & (y in Ra) & ((x = y) or (not(x Ra_GE y)))) imp (y Ra_GE x))). Proof:
Suppose_not ==> AUTO
	T471 ==> Stat1: (FORALL x, y | (Ra_GE(x,y) eq Ra_is_nonneg(x Ra_PLUS Ra_Rev(y))) &
		(Ra_LE(x,y) eq Ra_GE(y,x)) &
		(Ra_GT(x,y) eq (Ra_GE(x,y) & (x /= y))) &
		(Ra_LT(x,y) eq Ra_GT(y,x))) &
		Stat2:	(FORALL x, y | ((x in Ra) & (y in Ra) & ((x = y) or (not Ra_GE(x,y)))) imp Ra_GE(y,x)) &
		Stat3: (FORALL x, y | (Ra_LE(x,y) eq Ra_is_nonneg((y Ra_PLUS Ra_Rev(x)))) &
		(((x in Ra) & (y in Ra)) imp (Ra_GT(x,y) eq (Ra_is_nonneg((x Ra_PLUS Ra_Rev(y))) & (x /= y)))) &
		(((x in Ra) & (y in Ra)) imp (Ra_GT(x,y) eq (Ra_is_nonneg((x Ra_MINUS y)) & (x /= y)))))
	Suppose ==> Stat4: not(FORALL x,y | ((x Ra_GE y) eq Ra_is_nonneg(x Ra_PLUS Ra_Rev(y))))
		(x1,y1)-->Stat4(Stat4*) ==> (x1 Ra_GE y1) neq Ra_is_nonneg(x1 Ra_PLUS Ra_Rev(y1))
		Use_def(Ra_GE) ==> Ra_GE(x1,y1) neq Ra_is_nonneg(x1 Ra_PLUS Ra_Rev(y1))
	(x1,y1)-->Stat1(Stat4*) ==> false; Discharge ==> AUTO
	Suppose ==> Stat5: not(FORALL x,y | (x Ra_LE y) eq (y Ra_GE x))
		(x2,y2)-->Stat5(Stat5*) ==> AUTO
		Use_def(Ra_LE) ==> (x2 Ra_LE y2) eq Ra_LE(x2,y2)
		Use_def(Ra_GE) ==> (y2 Ra_GE x2) eq Ra_GE(y2,x2)
	(x2,y2)-->Stat1(Stat5*) ==> false; Discharge ==> AUTO
	Suppose ==> Stat6: not(FORALL x,y | ((x Ra_GT y) eq ((x Ra_GE y) & (x /= y))))
		(x3,y3)-->Stat6(Stat6*) ==> AUTO
		Use_def(Ra_GT) ==> (x3 Ra_GT y3) eq RA_GT(x3,y3)
		Use_def(Ra_GE) ==> (x3 Ra_GE y3) eq Ra_GE(x3,y3)
	(x3,y3)-->Stat1(Stat6*) ==> false; Discharge ==> AUTO
	Suppose ==> Stat7: not(FORALL x,y | ((x Ra_LT y) eq (y Ra_GT x)))
		(x4,y4)-->Stat7(Stat7*) ==> AUTO
		(x4,y4)-->Stat1(Stat1,Stat1*) ==> Ra_LT(x4,y4) eq Ra_GT(y4,x4)
		Use_def(Ra_LT) ==> (x4 Ra_LT y4) eq Ra_LT(x4,y4)
		Use_def(Ra_GT) ==> (y4 Ra_GT x4) eq RA_GT(y4,x4)
	(Stat7*)Discharge ==> AUTO
	Suppose ==> Stat8: not(FORALL x,y | (((x in Ra) & (y in Ra) & ((x = y) or (not(x Ra_GE y)))) imp (y Ra_GE x)))
		(x5,y5)-->Stat8(Stat8*) ==> AUTO
		(x5,y5)-->Stat2(Stat1,Stat1*) ==> ((x5 in Ra) & (y5 in Ra) & ((x5 = y5) or (not Ra_GE(x5,y5)))) imp Ra_GE(y5,x5)
		Use_def(Ra_GE) ==> ((x5 Ra_GE y5) eq Ra_GE(x5,y5)) & ((y5 Ra_GE x5) eq Ra_GE(y5,x5))
	(Stat8*)Discharge ==> AUTO
	Suppose ==> Stat9: not(FORALL x,y | ((x Ra_LE y) eq Ra_is_nonneg(y Ra_PLUS Ra_Rev(x))))
		(x6,y6)-->Stat9(Stat9*) ==> AUTO
		(x6,y6)-->Stat3(Stat1,Stat1*) ==> Ra_LE(x6,y6) eq Ra_is_nonneg((y6 Ra_PLUS Ra_Rev(x6)))
		Use_def(Ra_LE) ==> (x6 Ra_LE y6) eq Ra_LE(x6,y6)
	(Stat9*)Discharge ==> AUTO
	Suppose ==> Stat10: not(FORALL x,y | (((x in Ra) & (y in Ra)) imp ((x Ra_GT y) eq (Ra_is_nonneg(x Ra_PLUS Ra_Rev(y)) & (x /= y)))))
		(x7,y7)-->Stat10(Stat10*) ==> AUTO
		(x7,y7)-->Stat3(Stat1,Stat1*) ==> (((x7 in Ra) & (y7 in Ra)) imp (Ra_GT(x7,y7) eq (Ra_is_nonneg((x7 Ra_PLUS Ra_Rev(y7))) & (x7 /= y7))))
		Use_def(Ra_GT) ==> (x7 Ra_GT y7) eq Ra_GT(x7,y7)
	(Stat10*)Discharge ==> Stat11: not(FORALL x,y | (((x in Ra) & (y in Ra)) imp ((x Ra_GT y) eq (Ra_is_nonneg(x Ra_MINUS y) & (x /= y)))))
	(x8,y8)-->Stat11(Stat11*) ==> AUTO
	(x8,y8)-->Stat3(Stat1,Stat1*) ==> (((x8 in Ra) & (y8 in Ra)) imp (Ra_GT(x8,y8) eq (Ra_is_nonneg((x8 Ra_MINUS y8)) & (x8 /= y8))))
	Use_def(Ra_GT) ==> (x8 Ra_GT y8) eq Ra_GT(x8,y8)
(Stat11*)Discharge ==> QED
--
Theorem 473: [Various basic properties of rational comparison] ((X Ra_GE Y) eq Ra_is_nonneg(X Ra_PLUS Ra_Rev(Y))) &
	((X Ra_LE Y) eq (Y Ra_GE X)) &
	((X Ra_GT Y) eq ((X Ra_GE Y) & (X /= Y))) &
	((X Ra_LT Y) eq (Y Ra_GT X))  &
	((X Ra_LE Y) eq Ra_is_nonneg(Y Ra_PLUS Ra_Rev(X))) &
	(((X in Ra) & (Y in Ra)) imp ((X Ra_GT Y) eq (Ra_is_nonneg(X Ra_PLUS Ra_Rev(Y)) & (X /= Y)))) &
	(((X in Ra) & (Y in Ra)) imp ((X Ra_GT Y) eq (Ra_is_nonneg(X Ra_MINUS Y) & (X /= Y)))) &
	(((X in Ra) & (Y in Ra) & ((X = Y) or (not(X Ra_GE Y)))) imp (Y Ra_GE X)). Proof:
    Suppose_not(x,y) ==> not(((x Ra_GE y) eq Ra_is_nonneg(x Ra_PLUS Ra_Rev(y))) &
	((x Ra_LE y) eq (y Ra_GE x)) &
	((x Ra_GT y) eq ((x Ra_GE y) & (x /= y))) &
	((x Ra_LT y) eq (y Ra_GT x))  &
	((x Ra_LE y) eq Ra_is_nonneg(y Ra_PLUS Ra_Rev(x))) &
	(((x in Ra) & (y in Ra)) imp ((x Ra_GT y) eq (Ra_is_nonneg(x Ra_PLUS Ra_Rev(y)) & (x /= y)))) &
	(((x in Ra) & (y in Ra)) imp ((x Ra_GT y) eq (Ra_is_nonneg(x Ra_MINUS y) & (x /= y)))) &
	(((x in Ra) & (y in Ra) & ((x = y) or (not(x Ra_GE y)))) imp (y Ra_GE x)))
        Suppose ==> not(((x Ra_GE y) eq Ra_is_nonneg(x Ra_PLUS Ra_Rev(y))))
            T472 ==> Stat1: (FORALL x,y | ((x Ra_GE y) eq Ra_is_nonneg(x Ra_PLUS Ra_Rev(y))))
        (x,y)-->Stat1 ==> false; Discharge ==> ((x Ra_GE y) eq Ra_is_nonneg(x Ra_PLUS Ra_Rev(y)))
        Suppose ==> not(((x Ra_LE y) eq (y Ra_GE x)))
            T472 ==> Stat2: (FORALL x,y | ((x Ra_LE y) eq (y Ra_GE x)))
        (x,y)-->Stat2 ==> false; Discharge ==> ((x Ra_LE y) eq (y Ra_GE x))
        Suppose ==> not((x Ra_GT y) eq ((x Ra_GE y) & (x /= y)))
            T472 ==> Stat3: (FORALL x,y | ((x Ra_GT y) eq ((x Ra_GE y) & (x /= y))))
        (x,y)-->Stat3 ==> false; Discharge ==> ((x Ra_GT y) eq ((x Ra_GE y) & (x /= y)))
        Suppose ==> not((x Ra_LT y) eq (y Ra_GT x))
            T472 ==> Stat4: (FORALL x,y | ((x Ra_LT y) eq (y Ra_GT x)))
        (x,y)-->Stat4 ==> false; Discharge ==> ((x Ra_LT y) eq (y Ra_GT x))
        Suppose ==> not((x Ra_LE y) eq Ra_is_nonneg(y Ra_PLUS Ra_Rev(x)))
            T472 ==> Stat5: (FORALL x,y | ((x Ra_LE y) eq Ra_is_nonneg(y Ra_PLUS Ra_Rev(x))))
        (x,y)-->Stat5 ==> false; Discharge ==> ((x Ra_LE y) eq Ra_is_nonneg(y Ra_PLUS Ra_Rev(x)))
        Suppose ==> not(((x in Ra) & (y in Ra)) imp ((x Ra_GT y) eq (Ra_is_nonneg(x Ra_PLUS Ra_Rev(y)) & (x /= y))))
            T472 ==> Stat6: (FORALL x,y | (((x in Ra) & (y in Ra)) imp ((x Ra_GT y) eq (Ra_is_nonneg(x Ra_PLUS Ra_Rev(y)) & (x /= y)))))
        (x,y)-->Stat6 ==> false; Discharge ==> (((x in Ra) & (y in Ra)) imp ((x Ra_GT y) eq (Ra_is_nonneg(x Ra_PLUS Ra_Rev(y)) & (x /= y))))
        Suppose ==> not(((x in Ra) & (y in Ra)) imp ((x Ra_GT y) eq (Ra_is_nonneg(x Ra_MINUS y) & (x /= y))))
            T472 ==> Stat7: (FORALL x,y | (((x in Ra) & (y in Ra)) imp ((x Ra_GT y) eq (Ra_is_nonneg(x Ra_MINUS y) & (x /= y)))))
        (x,y)-->Stat7 ==> false; Discharge ==> not(((X in Ra) & (Y in Ra) & ((X = Y) or (not(X Ra_GE Y)))) imp (Y Ra_GE X))
        T472 ==> Stat8: (FORALL x,y | (((x in Ra) & (y in Ra) & ((x = y) or (not(x Ra_GE y)))) imp (y Ra_GE x)))
    (x,y)-->Stat8 ==> false; Discharge ==> QED
--
-- The following easy lemmas add more elementary properties of inequality to the preceding.
--
Theorem 474: [Greater_than_equal is greater-than and equal] ((X in Ra) & (Y in Ra)) imp ((X Ra_GE Y) eq ((X Ra_GT Y) or (X = Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	(y,x)-->T473 ==> (x = y) imp (x Ra_GE y)
	(x,y)-->T473 ==> (x Ra_GT y or x = y) eq (x Ra_GE y or x = y)
	Discharge ==> QED
--
Theorem 475: [Less_than_equal is less-than and equal] ((X in Ra) & (Y in Ra)) imp ((X Ra_LE Y) eq ((X Ra_LT Y) or (X = Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T473 ==> ((y Ra_GE x) eq (x Ra_LE y)) & ((y Ra_GT x) eq (x Ra_LT y))
	(y,x)-->T474 ==> false; Discharge ==> QED
--
Theorem 476: [The rationals are a linearly ordered set] ((X in Ra) & (Y in Ra)) imp ((X Ra_GT Y) or (X = Y) or (Y Ra_GT X)). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T473 ==> x Ra_GE y or y Ra_GE x
	(y,x)-->T474 ==> (y Ra_GE x) eq (y Ra_GT x or X = Y)
	(x,y)-->T474 ==> false; Discharge ==> QED
--
Theorem 477: [The rationals are a linearly ordered set, 2] ((X in Ra) & (Y in Ra)) imp ((X Ra_LT Y) or (X = Y) or (Y Ra_LT X)). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T473 ==> (y Ra_GT x) eq (x Ra_LT y)
	(y,x)-->T473 ==> (x Ra_GT y) eq (y Ra_LT x)
	(y,x)-->T476 ==> false; Discharge ==> QED
--
Theorem 478: [The rationals are a linearly ordered set,3] ((X in Ra) & (Y in Ra)) imp ((X Ra_GT Y) or (Y Ra_GE X)). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T476 ==> AUTO
	(y,x)-->T474 ==> false; Discharge ==> QED
--
Theorem 479: [The rationals are a linearly ordered set,4] ((X in Ra) & (Y in Ra)) imp ((X Ra_LT Y) or (Y Ra_LE X)). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T477 ==> AUTO
	(y,x)-->T475 ==> false; Discharge ==> QED
--
Theorem 480: [Transitivity of ordering] ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_GE Y) & (Y Ra_GE Z)) imp (X Ra_GE Z)). Proof:
	Suppose_not(x,y,z) ==> (x in Ra) & (y in Ra) & (z in Ra) & (x Ra_GE y) & (y Ra_GE z) & (not(x Ra_GE z))
	(x,y)-->T473 ==> (x Ra_GE y) eq Ra_is_nonneg(x Ra_PLUS Ra_Rev(y))
	(y,z)-->T473 ==> (y Ra_GE z) eq Ra_is_nonneg(y Ra_PLUS Ra_Rev(z))
	(x,z)-->T473 ==> (x Ra_GE z) eq Ra_is_nonneg(x Ra_PLUS Ra_Rev(z))
	ALGEBRA ==> ((x Ra_PLUS Ra_Rev(y)) in Ra) & ((y Ra_PLUS Ra_Rev(z)) in Ra) & ((x Ra_PLUS Ra_Rev(z)) in Ra)
	ALGEBRA ==> (x Ra_PLUS Ra_Rev(y)) Ra_PLUS (y Ra_PLUS Ra_Rev(z)) = (x Ra_PLUS Ra_Rev(z)) Ra_PLUS (y Ra_PLUS Ra_Rev(y))
	y-->T452 ==> y Ra_PLUS Ra_Rev(y) = Ra_0
	EQUAL ==> (x Ra_PLUS Ra_Rev(y)) Ra_PLUS (y Ra_PLUS Ra_Rev(z)) = (x Ra_PLUS Ra_Rev(z)) Ra_PLUS Ra_0
	ALGEBRA ==> (x Ra_PLUS Ra_Rev(y)) Ra_PLUS (y Ra_PLUS Ra_Rev(z)) = (x Ra_PLUS Ra_Rev(z))
	(x Ra_PLUS Ra_Rev(y),y Ra_PLUS Ra_Rev(z))-->T469 ==> Ra_is_nonneg((x Ra_PLUS Ra_Rev(y)) Ra_PLUS (y Ra_PLUS Ra_Rev(z)))
	EQUAL ==> Ra_is_nonneg(x Ra_PLUS Ra_Rev(z))
	Discharge ==> QED
--
-- Our next lemma simply states that the zero rational is its own negative
-- and that the unit rational is  positive.
--
Theorem 481: [Properties of the rational zero and unit] (Ra_Rev(Ra_0) = Ra_0) & (Ra_1 /= Ra_0) & (Ra_1 Ra_GT Ra_0). Proof:
	Suppose_not ==> Stat1: (Ra_Rev(Ra_0) /= Ra_0) or (Ra_1 = Ra_0) or (not (Ra_1 Ra_GT Ra_0))
--
-- The first part of this assertion has the following elementary algebraic proof.
--
	T451 ==> (Ra_0 in Ra) & (Ra_1 in Ra)
	Ra_0-->T452 ==> (Ra_0 Ra_PLUS Ra_Rev(Ra_0) = Ra_0) & (Ra_Rev(Ra_0) in Ra)
	(Ra_Rev(Ra_0))-->T451 ==> Ra_Rev(Ra_0) Ra_PLUS Ra_0 = Ra_Rev(Ra_0)
	(Ra_0,Ra_Rev(Ra_0))-->T445 ==> Stat2: Ra_0 = Ra_Rev(Ra_0)
--
-- Similarly, to prove that $Ra_1 /= Ra_0$, we have only to use the definitions of the
-- quantities and operators involved, and do a bit of algebra.
--
	Suppose ==> Ra_1 = Ra_0
	Use_def(Ra_1) ==> Fr_to_Ra([[1,0],[1,0]]) = Ra_0
	Use_def(Ra_0) ==> Fr_to_Ra([[1,0],[1,0]]) = Fr_to_Ra([[0,0],[1,0]])
	T368 ==> Stat3: ([0,0] in Si) & ([1,0] in Si) & ([1,0] /= [0,0])
	(Stat3)ELEM ==> (car([[1,0],[1,0]]) in Si) & (cdr([[1,0],[1,0]]) in Si) & (cdr([[1,0],[1,0]]) /= [0,0])
    ([1,0],[1,0])-->T432(*) ==> [[1,0],[1,0]] in Fr
	(Stat3)ELEM ==> (car([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) in Si) & (cdr([[0,0],[1,0]]) /= [0,0])
    ([0,0],[1,0])-->T432(*) ==> [[0,0],[1,0]] in Fr
	([[1,0],[1,0]],[[0,0],[1,0]])-->T422 ==> Same_frac([[1,0],[1,0]],[[0,0],[1,0]])
	Use_def(Same_frac) ==> car([[1,0],[1,0]]) S_TIMES cdr([[0,0],[1,0]]) = cdr([[1,0],[1,0]]) S_TIMES car([[0,0],[1,0]])
	TELEM ==> (car([[1,0],[1,0]]) = [1,0]) & (cdr([[1,0],[1,0]]) = [1,0])
	TELEM ==> (car([[0,0],[1,0]]) = [0,0]) & (cdr([[0,0],[1,0]]) = [1,0])
	EQUAL ==> [1,0] S_TIMES [1,0] = [1,0] S_TIMES [0,0]
	([1,0])-->T402 ==> [1,0] = [1,0] S_TIMES [0,0]
	([0,0])-->T401 ==> [1,0] = [0,0]
	T368 ==> false; Discharge ==> Stat4: Ra_1 /= Ra_0
--
--
--
    (Ra_1,Ra_0)-->T473 ==> (Ra_1 Ra_GT Ra_0) eq (Ra_is_nonneg(Ra_1 Ra_PLUS Ra_Rev(Ra_0)) & (Ra_1 /= Ra_0))
    EQUAL ==> (Ra_1 Ra_GT Ra_0) eq (Ra_is_nonneg(Ra_1 Ra_PLUS Ra_0) & (Ra_1 /= Ra_0))
    Ra_1-->T451 ==> Ra_1 Ra_PLUS Ra_0 = Ra_1
    EQUAL ==> (Ra_1 Ra_GT Ra_0) eq (Ra_is_nonneg(Ra_1) & (Ra_1 /= Ra_0))
    ALGEBRA ==> Stat5: ((Ra_1 Ra_GT Ra_0) eq (Ra_is_nonneg(Ra_1) & (Ra_1 /= Ra_0)))
    T465 ==> Stat6: Ra_is_nonneg(Ra_1)
    (Stat2,Stat4,Stat5,Stat6,Stat1*)Discharge ==> QED
--
-- Alternate characterization of non-negativity for rationals.
--
Theorem 482: [Alternate characterization of non-negativity for rationals] (X in Ra) imp ((Ra_is_nonneg(X) eq (X Ra_GE Ra_0)) & ((X Ra_GT Ra_0) imp Ra_is_nonneg(X))). Proof:
Suppose_not(x) ==> AUTO
	Suppose ==> Stat1: Ra_is_nonneg(x) eq (not(x Ra_GE Ra_0))
		(x,Ra_0)-->T473(Stat1*) ==> Ra_is_nonneg(x) eq (not Ra_is_nonneg(x Ra_PLUS Ra_Rev(Ra_0)))
		()-->T481 ==> AUTO
		x-->T451(*) ==> x = (x Ra_PLUS Ra_0)
		EQUAL(Stat1) ==> Stat2: Ra_is_nonneg(x) eq (not Ra_is_nonneg(x))
	(Stat2*)ELEM ==> false; Discharge ==> Stat3: (Ra_is_nonneg(x) eq (x Ra_GE Ra_0)) & (x Ra_GT Ra_0) & (not Ra_is_nonneg(x))
(x,Ra_0)-->T473(Stat3*) ==> false; Discharge ==> QED
--
-- Our next two theorems give the distributive law for subtraction, first in its simplest form, and then generally.
-- We begin with two preliminary lemmas, which give the corresponding rule for fractions.
--
Theorem 483: [Reversing the numerators of two equivalent rational fractions leaves them equivalent] ((X in Si) & (Y in Si) & (XP in Si) & (YP in Si) & Same_frac([X,Y],[XP,YP])) imp
	Same_frac([S_Rev(X),Y],[S_Rev(XP),YP]). Proof:
	Suppose_not(m,n,mp,np) ==> (m in Si) & (n in Si) & (mp in Si) & (np in Si) & Same_frac([m,n],[mp,np]) &
						(not Same_frac([S_Rev(m),n],[S_Rev(mp),np]))
	Use_def(Same_frac) ==> (car([m,n]) S_TIMES cdr([mp,np]) = cdr([m,n]) S_TIMES car([mp,np])) &
	(not(car([S_Rev(m),n]) S_TIMES cdr([S_Rev(mp),np]) = cdr([S_Rev(m),n]) S_TIMES car([S_Rev(mp),np])))
	ELEM ==> (car([m,n]) = m) & (cdr([m,n]) = n) & (car([mp,np]) = mp) & (cdr([mp,np]) = np)
	ELEM ==> (car([S_Rev(m),n]) = S_Rev(m)) & (cdr([S_Rev(m),n]) = n) &
		(car([S_Rev(mp),np]) = S_Rev(mp)) & (cdr([S_Rev(mp),np]) = np)
	EQUAL ==> ((m S_TIMES np) = (n S_TIMES mp)) & (not((S_Rev(m) S_TIMES np) = (n S_TIMES S_Rev(mp))))
	m-->T391 ==> S_Rev(m) in Si
    ALGEBRA ==> (S_Rev(m) S_TIMES np) = (np S_TIMES S_Rev(m))
    (np,m)-->T390 ==> (np S_TIMES S_Rev(m)) = S_Rev(np S_TIMES m)
    (n,mp)-->T390 ==> (n S_TIMES S_Rev(mp)) = S_Rev(n S_TIMES mp)
    ALGEBRA ==> false; Discharge ==> QED

Theorem 484: [Alternate form of Theorem 483] ((X in Si) & (Y in Si) & (Y /= [0,0])) imp (Ra_Rev(Fr_to_Ra([X,Y])) = Fr_to_Ra([S_Rev(X),Y])). Proof:
	Suppose_not(m,n) ==> ((m in Si) & (n in Si) & (n /= [0,0])) & (Ra_Rev(Fr_to_Ra([m,n])) /= Fr_to_Ra([S_Rev(m),n]))
	Use_def(Ra_Rev) ==> Ra_Rev(Fr_to_Ra([m,n]))  = Fr_to_Ra([S_Rev(car(arb(Fr_to_Ra([m,n])))),cdr(arb(Fr_to_Ra([m,n])))])
	(m,n)-->T432(*) ==> [m,n] in Fr
	m-->T391 ==> S_Rev(m) in Si
	(S_Rev(m),n)-->T432(*) ==> [S_Rev(m),n] in Fr
	([m,n])-->T421 ==> (Fr_to_Ra([m,n]) in Ra) & Same_frac([m,n],arb(Fr_to_Ra([m,n])))
	(Fr_to_Ra([m,n]))-->T423 ==> arb(Fr_to_Ra([m,n])) in Fr
	(arb(Fr_to_Ra([m,n])))-->T431 ==> (arb(Fr_to_Ra([m,n])) = [car(arb(Fr_to_Ra([m,n]))),cdr(arb(Fr_to_Ra([m,n])))]) &
	(car(arb(Fr_to_Ra([m,n]))) in Si) & (cdr(arb(Fr_to_Ra([m,n]))) in Si) & (cdr(arb(Fr_to_Ra([m,n]))) /= [0,0])
	(car(arb(Fr_to_Ra([m,n]))))-->T391 ==> S_Rev(car(arb(Fr_to_Ra([m,n])))) in Si
	(S_Rev(car(arb(Fr_to_Ra([m,n])))),cdr(arb(Fr_to_Ra([m,n]))))-->T432(*) ==>
	[S_Rev(car(arb(Fr_to_Ra([m,n])))),cdr(arb(Fr_to_Ra([m,n])))] in Fr
	EQUAL ==> Same_frac([m,n],[car(arb(Fr_to_Ra([m,n]))),cdr(arb(Fr_to_Ra([m,n])))])
	EQUAL ==> [car(arb(Fr_to_Ra([m,n]))),cdr(arb(Fr_to_Ra([m,n])))]  in Fr
	(m,n,car(arb(Fr_to_Ra([m,n]))),cdr(arb(Fr_to_Ra([m,n]))))-->T483 ==>
	Same_frac([S_Rev(m),n],[S_Rev(car(arb(Fr_to_Ra([m,n])))),cdr(arb(Fr_to_Ra([m,n])))])
	([S_Rev(m),n],[S_Rev(car(arb(Fr_to_Ra([m,n])))),cdr(arb(Fr_to_Ra([m,n])))])-->T422 ==> false; Discharge ==> QED

Theorem 485: [First law of signs for rational multiplication] ((X in Ra) & (Y in Ra)) imp ((X Ra_TIMES Ra_Rev(Y)) = Ra_Rev(X Ra_TIMES Y)). Proof:
	Suppose_not(m,n) ==> Stat1: (m in Ra) & (n in Ra) & (m Ra_TIMES Ra_Rev(n) /= Ra_Rev(m Ra_TIMES n))
	n-->T423 ==> (n = Fr_to_Ra(arb(n))) & (arb(n) in Fr)
	(arb(n))-->T431 ==> (arb(n) = [car(arb(n)),cdr(arb(n))]) & (car(arb(n)) in Si) &
				(cdr(arb(n)) in Si) & (cdr(arb(n)) /= [0,0])
	m-->T423 ==> (m = Fr_to_Ra(arb(m))) & (arb(m) in Fr)
	(arb(m))-->T431 ==> (arb(m) = [car(arb(m)),cdr(arb(m))]) & (car(arb(m)) in Si) &
				(cdr(arb(m)) in Si) & (cdr(arb(m)) /= [0,0])
	Use_def(Ra_Rev) ==> m Ra_TIMES Ra_Rev(n) = m Ra_TIMES Fr_to_Ra([S_Rev(car(arb(n))),cdr(arb(n))])
	(car(arb(n)))-->T391 ==> S_Rev(car(arb(n))) in Si
	(m,S_Rev(car(arb(n))),cdr(arb(n)))-->T439 ==> m Ra_TIMES Fr_to_Ra([S_Rev(car(arb(n))),cdr(arb(n))]) =
	Fr_to_Ra([car(arb(m)) S_TIMES S_Rev(car(arb(n))),cdr(arb(m)) S_TIMES cdr(arb(n))])
	(car(arb(m)),car(arb(n)))-->T390 ==> car(arb(m)) S_TIMES S_Rev(car(arb(n))) = S_Rev(car(arb(m)) S_TIMES car(arb(n)))
	EQUAL ==> m Ra_TIMES Fr_to_Ra([S_Rev(car(arb(n))),cdr(arb(n))]) =
	Fr_to_Ra([S_Rev(car(arb(m)) S_TIMES car(arb(n))),cdr(arb(m)) S_TIMES cdr(arb(n))])
	ALGEBRA ==> (car(arb(m)) S_TIMES car(arb(n)) in Si) & (cdr(arb(m)) S_TIMES cdr(arb(n)) in Si)
	(cdr(arb(n)),cdr(arb(m)))-->T407(Stat1*) ==> cdr(arb(m)) S_TIMES cdr(arb(n)) /= [0,0]
	(car(arb(m)) S_TIMES car(arb(n)),cdr(arb(m)) S_TIMES cdr(arb(n)))-->T484 ==>
	m Ra_TIMES Fr_to_Ra([S_Rev(car(arb(n))),cdr(arb(n))]) =
		Ra_Rev(Fr_to_Ra([car(arb(m)) S_TIMES car(arb(n)),cdr(arb(m)) S_TIMES cdr(arb(n))]))
	Use_def(Ra_TIMES) ==> m Ra_TIMES n = Fr_to_Ra([car(arb(m)) S_TIMES car(arb(n)),cdr(arb(m)) S_TIMES cdr(arb(n))])
	EQUAL ==> false; Discharge ==> QED
--
Theorem 486: [The reverse of a rational $X$ is the reverse of 1, times $X$] (X in Ra) imp (Ra_Rev(X) = (Ra_Rev(Ra_1) Ra_TIMES X)). Proof:
Suppose_not(m) ==>AUTO
	m-->T461 ==> m = (m Ra_TIMES Ra_1)
	T451 ==> Ra_1 in Ra
	Ra_1-->T452 ==> Ra_Rev(Ra_1) in Ra
	(m,Ra_1)-->T485 ==> (m Ra_TIMES Ra_Rev(Ra_1)) = Ra_Rev(m Ra_TIMES Ra_1)
	(m,Ra_Rev(Ra_1))-->T448 ==> (m Ra_TIMES Ra_Rev(Ra_1)) = (Ra_Rev(Ra_1) Ra_TIMES m)
EQUAL ==> false; Discharge ==> QED
--
Theorem 487: ((X in Ra) & (Y in Ra) & (Z in Ra)) imp ((X Ra_TIMES (Y Ra_MINUS Z)) = (X Ra_TIMES Y) Ra_MINUS (X Ra_TIMES Z)). Proof:
	Suppose_not(m,n,k) ==> (m in Ra) & (n in Ra) & (k in Ra) &
	((m Ra_TIMES (n Ra_MINUS k)) /= (m Ra_TIMES n) Ra_MINUS (m Ra_TIMES k))
	Use_def(Ra_MINUS) ==> ((m Ra_TIMES (n Ra_PLUS Ra_Rev(k))) /= (m Ra_TIMES n) Ra_PLUS Ra_Rev(m Ra_TIMES k))
	k-->T452 ==> Ra_Rev(k) in Ra
	(Ra_Rev(k),m,n)-->T458 ==>
	((m Ra_TIMES n) Ra_PLUS Ra_Rev(m Ra_TIMES k)) /= ((m Ra_TIMES n) Ra_PLUS (m Ra_TIMES Ra_Rev(k)))
	(m,k)-->T485 ==> Ra_Rev(m Ra_TIMES k) = (m Ra_TIMES Ra_Rev(k))
	EQUAL ==> false; Discharge ==> QED
--
-- Now we prove that multiplication of two rationals $m$, $n$ satisfying $m Ra_GT n$ by a common
-- strictly positive fraction produces two products satisfying the same condition.
--
Theorem 488: [Strict monotonicity of rational multiplication over 1st argument] ((X in Ra) & (Y in Ra) & (X1 in Ra) & (X Ra_GT Y) & (X1 Ra_GT Ra_0)) imp ((X Ra_TIMES X1) Ra_GT (Y Ra_TIMES X1)). Proof:
    Suppose_not(m,n,k) ==>
    (m in Ra) & (n in Ra) & (k in Ra) & (m Ra_GT n) & (k Ra_GT Ra_0) & (not((m Ra_TIMES k) Ra_GT (n Ra_TIMES k)))
    (m,n)-->T473 ==> Ra_is_nonneg(m Ra_MINUS n) & (m /= n)
    T451 ==> Ra_0 in Ra
    (k,Ra_0)-->T473 ==> Ra_is_nonneg(k Ra_MINUS Ra_0) & (k /= Ra_0)
    Use_def(Ra_MINUS) ==> Ra_is_nonneg(m Ra_PLUS Ra_Rev(n)) & Ra_is_nonneg(k Ra_PLUS Ra_Rev(Ra_0))
    (m,k)-->T448 ==> (m Ra_TIMES k) in Ra
    (n,k)-->T448 ==> (n Ra_TIMES k) in Ra
    (m Ra_TIMES k,n Ra_TIMES k)-->T473 ==> not(Ra_is_nonneg((m Ra_TIMES k) Ra_MINUS (n Ra_TIMES k)) & (m Ra_TIMES k /= n Ra_TIMES k))
    Use_def(Ra_MINUS) ==> not(Ra_is_nonneg((m Ra_TIMES k) Ra_PLUS Ra_Rev(n Ra_TIMES k)) & (m Ra_TIMES k /= n Ra_TIMES k))
    T481 ==> Ra_Rev(Ra_0) = Ra_0
    EQUAL ==> Ra_is_nonneg(k Ra_PLUS Ra_0)
    k-->T451 ==> k Ra_PLUS Ra_0 = k
    EQUAL ==> Ra_is_nonneg(k)
    n-->T452 ==> Ra_Rev(n) in Ra
    (m,Ra_Rev(n))-->T445 ==> m Ra_PLUS Ra_Rev(n) in Ra
    (k,m Ra_PLUS Ra_Rev(n))-->T469 ==> Ra_is_nonneg(k Ra_TIMES (m Ra_PLUS Ra_Rev(n)))
    (Ra_Rev(n),k,m)-->T458 ==> k Ra_TIMES (m Ra_PLUS Ra_Rev(n)) = (k Ra_TIMES m) Ra_PLUS (k Ra_TIMES Ra_Rev(n))
    (k,n)-->T485 ==> (k Ra_TIMES Ra_Rev(n)) = Ra_Rev(k Ra_TIMES n)
    EQUAL ==> Ra_is_nonneg((k Ra_TIMES m) Ra_PLUS Ra_Rev(k Ra_TIMES n))
    (k,m)-->T448 ==> k Ra_TIMES m = m Ra_TIMES k
    (k,n)-->T448 ==> k Ra_TIMES n = n Ra_TIMES k
    EQUAL ==> Ra_is_nonneg((m Ra_TIMES k) Ra_PLUS Ra_Rev(n Ra_TIMES k))
    ELEM ==> m Ra_TIMES k = n Ra_TIMES k
    EQUAL ==> (m Ra_TIMES k) Ra_TIMES Recip(k) = (n Ra_TIMES k) Ra_TIMES Recip(k)
    k-->T462 ==> (Recip(k) in Ra) & (k Ra_TIMES Recip(k) = Ra_1)
    (Recip(k),m,k)-->T456 ==> (m Ra_TIMES k) Ra_TIMES Recip(k) = m Ra_TIMES (k Ra_TIMES Recip(k))
    (Recip(k),n,k)-->T456 ==> (n Ra_TIMES k) Ra_TIMES Recip(k) = n Ra_TIMES (k Ra_TIMES Recip(k))
    EQUAL ==> m Ra_TIMES (k Ra_TIMES Recip(k)) = n Ra_TIMES (k Ra_TIMES Recip(k))
    EQUAL ==> m Ra_TIMES Ra_1 = n Ra_TIMES Ra_1
    m-->T461 ==> m = m Ra_TIMES Ra_1
    n-->T461 ==> n = n Ra_TIMES Ra_1
   EQUAL ==> false; Discharge ==> QED
--
-- The following lemma states that the product of any rational by zero is zero.
--
Theorem 489: (X in Ra) imp (X Ra_TIMES Ra_0 = Ra_0). Proof:
	Suppose_not(m) ==> (m in Ra) & (m Ra_TIMES Ra_0 /= Ra_0)
	T481 ==> Ra_Rev(Ra_0) = Ra_0
	T451 ==> Ra_0 in Ra
	(m,Ra_0)-->T448 ==> m Ra_TIMES Ra_0 in Ra
	(m,Ra_0)-->T485 ==> m Ra_TIMES Ra_Rev(Ra_0) = Ra_Rev(m Ra_TIMES Ra_0)
	(m Ra_TIMES Ra_0)-->T466 ==> (Ra_is_nonneg(m Ra_TIMES Ra_0) or Ra_is_nonneg(Ra_Rev(m Ra_TIMES Ra_0))) &
	((Ra_is_nonneg(m Ra_TIMES Ra_0) & Ra_is_nonneg(Ra_Rev(m Ra_TIMES Ra_0))) imp (m Ra_TIMES Ra_0 = Ra_0))
	EQUAL ==> false; Discharge ==> QED
--
-- It follows easily from Theorem 488 and Theorem 489 that
-- the product of positive rationals is positive.
--
Theorem 490: ((X in Ra) & (Y in Ra) & (X Ra_GT Ra_0) & (Y Ra_GT Ra_0)) imp ((X Ra_TIMES Y) Ra_GT Ra_0). Proof:
Suppose_not(x,y) ==> AUTO
	T451 ==> Ra_0 in Ra
	(x,Ra_0,y)-->T488 ==> (x Ra_TIMES y) Ra_GT (Ra_0 Ra_TIMES y)
	y-->T489 ==> y Ra_TIMES Ra_0 = Ra_0
	(Ra_0,y)-->T448 ==> Ra_0 Ra_TIMES y = Ra_0
EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the reciprocal of a positive rational is positive.
--
Theorem 491: ((X in Ra) & (X Ra_GT Ra_0)) imp (Recip(X) Ra_GT Ra_0). Proof:
    Suppose_not(m) ==> (m in Ra) & (m Ra_GT Ra_0) & (not Recip(m) Ra_GT Ra_0)
    (m,Ra_0)-->T473 ==> Ra_is_nonneg(m Ra_PLUS Ra_Rev(Ra_0)) & (m /= Ra_0)
    m-->T462 ==> (Recip(m) in Ra) & (m Ra_TIMES Recip(m) = Ra_1)
    (Recip(m))-->T452 ==> Ra_Rev(Recip(m)) in Ra
    (Recip(m),Ra_0)-->T473 ==> (not Ra_is_nonneg(Recip(m) Ra_PLUS Ra_Rev(Ra_0)) or Recip(m) = Ra_0)
    T481 ==> Ra_Rev(Ra_0) = Ra_0
    EQUAL ==> Ra_is_nonneg(m Ra_PLUS Ra_0) & (m /= Ra_0) &
    			(not Ra_is_nonneg(Recip(m) Ra_PLUS Ra_0) or Recip(m) = Ra_0)
    (m)-->T451 ==> Stat1: (Ra_1 in Ra) & (m Ra_PLUS Ra_0 = m)
    (Recip(m))-->T451 ==> Recip(m) Ra_PLUS Ra_0 = Recip(m)
    EQUAL ==> Ra_is_nonneg(m) & (m /= Ra_0) & (not Ra_is_nonneg(Recip(m)) or Recip(m) = Ra_0)
    T481 ==> Stat2: Ra_1 /= Ra_0
    Suppose ==> Recip(m) = Ra_0
    EQUAL ==> m Ra_TIMES Ra_0 = Ra_1
    m-->T489 ==> false; Discharge ==> not Ra_is_nonneg(Recip(m))
    (Recip(m))-->T466 ==> Ra_is_nonneg(Ra_Rev(Recip(m)))
    (m,Ra_Rev(Recip(m)))-->T469 ==> Ra_is_nonneg(m Ra_TIMES Ra_Rev(Recip(m)))
    (m,Recip(m))-->T485 ==> m Ra_TIMES Ra_Rev(Recip(m)) = Ra_Rev(m Ra_TIMES Recip(m))
    m-->T462 ==> m Ra_TIMES Recip(m) = Ra_1
    EQUAL ==> Stat3: Ra_is_nonneg(Ra_Rev(Ra_1))
    T465 ==> Stat4: Ra_is_nonneg(Ra_1)
    Ra_1-->T466(Stat1,Stat2,Stat3,Stat4) ==> false; Discharge ==> QED
--
-- It is important to know that sign reversal commutes with rational addition.
--
Theorem 492: ((X in Ra) & (Y in Ra)) imp (Ra_Rev(X Ra_PLUS Y) = (Ra_Rev(X) Ra_PLUS Ra_Rev(Y))). Proof:
	Suppose_not(m,n) ==> (m in Ra) & (n in Ra) & (Ra_Rev(m Ra_PLUS n) /= (Ra_Rev(m) Ra_PLUS Ra_Rev(n)))
	ALGEBRA ==> m Ra_PLUS n in Ra
	n-->T452 ==> Ra_Rev(n) in Ra
	m-->T452 ==> Ra_Rev(m) in Ra
	(m Ra_PLUS n)-->T452 ==> Ra_Rev(m Ra_PLUS n) in Ra
	Loc_def ==> rm = Ra_Rev(m)
	Loc_def ==> rn = Ra_Rev(n)
	Loc_def ==> rmpn = Ra_Rev(m Ra_PLUS n)
	EQUAL ==> (rm in Ra) & (rn in Ra) & (rmpn in Ra)
	EQUAL ==> rmpn /= rm Ra_PLUS rn
	m-->T452 ==> (m Ra_PLUS Ra_Rev(m)) = Ra_0
	n-->T452 ==> (n Ra_PLUS Ra_Rev(n)) = Ra_0
	(m Ra_PLUS n)-->T452 ==> ((m Ra_PLUS n) Ra_PLUS Ra_Rev(m Ra_PLUS n)) = Ra_0
	EQUAL ==> (m Ra_PLUS rm) = Ra_0
	EQUAL ==> (n Ra_PLUS rn) = Ra_0
	EQUAL ==> ((m Ra_PLUS n) Ra_PLUS rmpn) = Ra_0
	ALGEBRA ==> (rn Ra_PLUS rm) Ra_PLUS ((m Ra_PLUS n) Ra_PLUS rmpn) = ((n Ra_PLUS rn) Ra_PLUS (m Ra_PLUS rm)) Ra_PLUS rmpn
	EQUAL ==> (rn Ra_PLUS rm) Ra_PLUS Ra_0 = (Ra_0 Ra_PLUS Ra_0) Ra_PLUS rmpn
	ALGEBRA ==> (rm Ra_PLUS rn) = rmpn
	EQUAL ==> false; Discharge ==> QED
--
-- Our next three lemmas assert the monotonicity and strict monotonicity of rational addition.
-- We prove monotonicity first.
--
Theorem 493: [Monotonicity of rational addition] ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X Ra_GE Y) &
	 (XP Ra_GE YP)) imp ((X Ra_PLUS XP) Ra_GE (Y Ra_PLUS YP)). Proof:
	Suppose_not(m,n,mp,np) ==> (m in Ra) & (n in Ra) & (mp in Ra) & (np in Ra) & (m Ra_GE n) &
	((mp Ra_GE np) & (not((m Ra_PLUS mp) Ra_GE (n Ra_PLUS np))))
	ALGEBRA ==> (Ra_Rev(n) in Ra) & (Ra_Rev(np) in Ra) & (m Ra_PLUS Ra_Rev(n) in Ra) & (mp Ra_PLUS Ra_Rev(np) in Ra)
	(m,n)-->T473 ==> Ra_is_nonneg(m Ra_PLUS Ra_Rev(n))
	(mp,np)-->T473 ==> Ra_is_nonneg(mp Ra_PLUS Ra_Rev(np))
	(m Ra_PLUS mp,n Ra_PLUS np)-->T473 ==> not Ra_is_nonneg((m Ra_PLUS mp) Ra_PLUS Ra_Rev(n Ra_PLUS np))
	Loc_def ==> rn = Ra_Rev(n)
	Loc_def ==> rnp = Ra_Rev(np)
    EQUAL ==> (rn in Ra) & (rnp in Ra) & (m Ra_PLUS rn in Ra) & (mp Ra_PLUS rnp in Ra) & Ra_is_nonneg(m Ra_PLUS rn) & Ra_is_nonneg(mp Ra_PLUS rnp)
	(n,np)-->T492 ==> (Ra_Rev(n) Ra_PLUS Ra_Rev(np)) = Ra_Rev(n Ra_PLUS np)
	EQUAL ==> ((rn Ra_PLUS rnp) = Ra_Rev(n Ra_PLUS np)) & (not Ra_is_nonneg((m Ra_PLUS mp) Ra_PLUS (rn Ra_PLUS rnp)))
	(m Ra_PLUS rn,mp Ra_PLUS rnp)-->T469 ==> Ra_is_nonneg((m Ra_PLUS rn) Ra_PLUS (mp Ra_PLUS rnp))
	ALGEBRA ==> ((m Ra_PLUS rn) Ra_PLUS (mp Ra_PLUS rnp)) = ((m Ra_PLUS mp) Ra_PLUS (rn Ra_PLUS rnp))
	EQUAL ==> false; Discharge ==> QED
--
-- Next we prove the familiar facts that the reverse of the reverse of a rational $n$ is $n$,
-- and that the reciprocal of the reciprocal of non-zero rational $n$ is $n$.
--
Theorem 494: (X in Ra) imp (Ra_Rev(Ra_Rev(X)) = X). Proof:
	Suppose_not(m) ==> (m in Ra) & (Ra_Rev(Ra_Rev(m)) /= m)
	m-->T452 ==> (Ra_Rev(m) in Ra) & (m Ra_PLUS Ra_Rev(m) = Ra_0)
	(Ra_Rev(m))-->T452 ==> (Ra_Rev(Ra_Rev(m)) in Ra) & (Ra_Rev(m) Ra_PLUS Ra_Rev(Ra_Rev(m)) = Ra_0)
	EQUAL ==> (m Ra_PLUS Ra_Rev(m)) Ra_PLUS Ra_Rev(Ra_Rev(m)) = Ra_0 Ra_PLUS Ra_Rev(Ra_Rev(m))
	T451 ==> Ra_0 in Ra
	(Ra_0,Ra_Rev(Ra_Rev(m)))-->T445 ==> Ra_0 Ra_PLUS Ra_Rev(Ra_Rev(m)) = Ra_Rev(Ra_Rev(m)) Ra_PLUS Ra_0
	(Ra_Rev(Ra_Rev(m)))-->T451 ==> (m Ra_PLUS Ra_Rev(m)) Ra_PLUS Ra_Rev(Ra_Rev(m)) = Ra_Rev(Ra_Rev(m))
	(Ra_Rev(Ra_Rev(m)),m,Ra_Rev(m))-->T450 ==> m Ra_PLUS (Ra_Rev(m) Ra_PLUS Ra_Rev(Ra_Rev(m))) = Ra_Rev(Ra_Rev(m))
	EQUAL ==> m Ra_PLUS Ra_0 = Ra_Rev(Ra_Rev(m))
	m-->T451 ==> false; Discharge ==> QED
--
-- The following elementary consequence of Theorem OM is sometimes more convenient.
--
Theorem 495: ((X in Ra) & (Y in Ra)) imp (((X Ra_GE Y) or (Y Ra_GE X)) &
	(((X Ra_GE Y) & (Y Ra_GE X)) imp (X = Y))). Proof:
	Suppose_not(m,n) ==> (m in Ra) & (n in Ra) & ((not((m Ra_GE n) or (n Ra_GE m))) or
	(((m Ra_GE n) & (n Ra_GE m)) & (m /= n)))
	(m,n)-->T473 ==> (m Ra_GE n) eq Ra_is_nonneg(m Ra_PLUS Ra_Rev(n))
	(n,m)-->T473 ==> (n Ra_GE m) eq Ra_is_nonneg(n Ra_PLUS Ra_Rev(m))
	n-->T452 ==> Ra_Rev(n) in Ra
	m-->T452 ==> Ra_Rev(m) in Ra
	(m,Ra_Rev(n))-->T492 ==> Ra_Rev(m Ra_PLUS Ra_Rev(n)) = Ra_Rev(m) Ra_PLUS Ra_Rev(Ra_Rev(n))
	n-->T494 ==> Ra_Rev(Ra_Rev(n)) = n
	EQUAL ==> Ra_Rev(m Ra_PLUS Ra_Rev(n)) = Ra_Rev(m) Ra_PLUS n
	(Ra_Rev(m),n)-->T445 ==> Ra_Rev(m) Ra_PLUS n = n Ra_PLUS Ra_Rev(m)
	EQUAL ==> (n Ra_GE m) eq Ra_is_nonneg(Ra_Rev(m Ra_PLUS Ra_Rev(n)))
	ELEM ==> (not(Ra_is_nonneg(m Ra_PLUS Ra_Rev(n)) or Ra_is_nonneg(Ra_Rev(m Ra_PLUS Ra_Rev(n))))) or
	(Ra_is_nonneg(m Ra_PLUS Ra_Rev(n)) & Ra_is_nonneg(Ra_Rev(m Ra_PLUS Ra_Rev(n))) & (m /= n))
	ALGEBRA ==> m Ra_PLUS Ra_Rev(n) in Ra
	(m Ra_PLUS Ra_Rev(n))-->T466 ==> Stat1: (m Ra_PLUS Ra_Rev(n) = Ra_0) & (m /= n)
	(m,Ra_Rev(n))-->T445 ==> m Ra_PLUS Ra_Rev(n) = Ra_Rev(n) Ra_PLUS m
	EQUAL ==> n Ra_PLUS (Ra_Rev(n) Ra_PLUS m) = n Ra_PLUS Ra_0
	n-->T451 ==> n Ra_PLUS Ra_0 = n
	(Stat1)ELEM ==> n Ra_PLUS (Ra_Rev(n) Ra_PLUS m) = n
	(m,n,Ra_Rev(n))-->T450 ==> (n Ra_PLUS Ra_Rev(n)) Ra_PLUS m = n
	n-->T452 ==> n Ra_PLUS Ra_Rev(n) = Ra_0
	EQUAL ==> Ra_0 Ra_PLUS m = n
	ALGEBRA ==> false; Discharge ==> QED
--
-- Theorem 495 allows us to prove various other elementary but useful results concerning the ordering of rationals.
--
Theorem 496: [Transitivity of ordering, strict case]  ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_GE Y) & (Y Ra_GT Z)) imp (X Ra_GT Z)). Proof:
	Suppose_not(x,y,z) ==> AUTO
	(y,z)-->T473 ==> (y Ra_GE z) & (y /= z)
	(x,y,z)-->T480 ==> x Ra_GE z
	(x,z)-->T473 ==> x = z
	EQUAL ==> (z Ra_GE y) & (y Ra_GT z)
	(y,z)-->T473 ==> y Ra_GE z
	(y,z)-->T495 ==> y = z
	(y,z)-->T473 ==> false; Discharge ==> QED
--
Theorem 497: [Transitivity of ordering, strict case 2] ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_GT Y) & (Y Ra_GE Z)) imp (X Ra_GT Z)). Proof:
	Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T473 ==> (x Ra_GE y) & (x /= y)
	(x,y,z)-->T480 ==> x Ra_GE z
	(x,z)-->T473 ==> x = z
	EQUAL ==> (z Ra_GT y) & (y Ra_GE z)
	(z,y)-->T473 ==> z Ra_GE y
	(y,z)-->T495 ==> y = z
	(z,y)-->T473 ==> false; Discharge ==> QED
--
Theorem 498: [Transitivity of ordering, strict case 3]  ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_GT Y) & (Y Ra_GT Z)) imp (X Ra_GT Z)). Proof:
	Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T473 ==> (x Ra_GE y)
	(x,y,z)-->T496 ==> false; Discharge ==> QED
--
Theorem 499:  [Transitivity of ordering by 'less than'] ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_LE Y) & (Y Ra_LT Z)) imp (X Ra_LT Z)). Proof:
	Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T473 ==> (y Ra_GE x) eq (x Ra_LE y)
	(y,z)-->T473 ==> (z Ra_GT y) eq (y Ra_LT z)
	(x,z)-->T473 ==> (z Ra_GT x) eq (x Ra_LT z)
	(z,y,x)-->T497 ==> false;	Discharge ==> QED
--
Theorem 500: [Transitivity of ordering by 'less than', 2] ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_LT Y) & (Y Ra_LE Z)) imp (X Ra_LT Z)). Proof:
	Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T473 ==> (y Ra_GT x) eq (x Ra_LT y)
	(y,z)-->T473 ==> (z Ra_GE y) eq (y Ra_LE z)
	(x,z)-->T473 ==> (z Ra_GT x) eq (x Ra_LT z)
	(z,y,x)-->T496 ==> false;	Discharge ==> QED
--
Theorem 501: [Transitivity of ordering by 'less than', 3] ((X in Ra) & (Y in Ra) & (Z in Ra)) imp (((X Ra_LT Y) & (Y Ra_LT Z)) imp (X Ra_LT Z)). Proof:
	Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T475 ==> (x Ra_LE y)
	(x,y,z)-->T499 ==> false; Discharge ==> QED

-- Next we prove that rational reversal is a monotone decreasing function.
--
Theorem 502: ((X in Ra) & (Y in Ra) & (X Ra_GE Y)) imp (Ra_Rev(Y) Ra_GE Ra_Rev(X)). Proof:
	Suppose_not(m,n) ==> (m in Ra) & (n in Ra) & (m Ra_GE n) & (not(Ra_Rev(n) Ra_GE Ra_Rev(m)))
	n-->T452 ==> Ra_Rev(n) in Ra
	m-->T452 ==> Ra_Rev(m) in Ra
	(Ra_Rev(n),Ra_Rev(m))-->T495 ==> Ra_Rev(m) Ra_GE Ra_Rev(n)
	(m,n)-->T473 ==> Ra_is_nonneg(m Ra_PLUS Ra_Rev(n))
	(Ra_Rev(n),Ra_Rev(m))-->T473 ==> not Ra_is_nonneg(Ra_Rev(n) Ra_PLUS Ra_Rev(Ra_Rev(m)))
	m-->T494 ==> Ra_Rev(Ra_Rev(m)) = m
	EQUAL ==> not Ra_is_nonneg(Ra_Rev(n) Ra_PLUS m)
	(Ra_Rev(n),m)-->T445 ==> Ra_Rev(n) Ra_PLUS m = m Ra_PLUS Ra_Rev(n)
	EQUAL ==> false; Discharge ==> QED
--
-- An equally familiar fact is that the reverse of $y$ is smaller than the
-- reverse of $x$ when $x,y$ are rational numbers and $x$ is smaller than $y$.
--
Theorem 503: ((X in Ra) & (Y in Ra) & (X Ra_GT Y)) imp (Ra_Rev(Y) Ra_GT Ra_Rev(X)). Proof:
    Suppose_not(x,y) ==> (x in Ra) & (y in Ra) & (x Ra_GT y) & (not(Ra_Rev(y) Ra_GT Ra_Rev(x)))
        (x,y)-->T473 ==> Ra_is_nonneg(x Ra_PLUS Ra_Rev(y)) & (x /= y)
        (Ra_Rev(y),Ra_Rev(x))-->T473 ==> (not Ra_is_nonneg(Ra_Rev(y) Ra_PLUS Ra_Rev(Ra_Rev(x)))) or (Ra_Rev(y) = Ra_Rev(x))
        x-->T494 ==> Ra_Rev(Ra_Rev(x)) = x
        y-->T494 ==> Ra_Rev(Ra_Rev(y)) = y
        y-->T452 ==> Ra_Rev(y) in Ra
        (x,Ra_Rev(y))-->T445 ==> (x Ra_PLUS Ra_Rev(y)) = (Ra_Rev(y) Ra_PLUS x)
        EQUAL ==> Ra_is_nonneg(Ra_Rev(y) Ra_PLUS Ra_Rev(Ra_Rev(x)))
        ELEM ==> Ra_Rev(y) = Ra_Rev(x)
    EQUAL ==> false; Discharge ==> QED
--
-- We now combine the preceding lemmas to prove strict monotonicity of rational addition.
--
Theorem 504: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X Ra_GE Y) &
	 (XP Ra_GT YP)) imp ((X Ra_PLUS XP) Ra_GT (Y Ra_PLUS YP)). Proof:
	Suppose_not(m,n,mp,np) ==> (m in Ra) & (n in Ra) & (mp in Ra) & (np in Ra) & (m Ra_GE n) &
	((mp Ra_GT np) & (not((m Ra_PLUS mp) Ra_GT (n Ra_PLUS np))))
--
-- Suppose that $m$, $n$, $mp$, and $np$ form a counterexample to our theorem.
-- Since addition is known to be monotone, we have at least $(m Ra_PLUS mp) Ra_GE (n Ra_PLUS np)$,
-- and since the corresponding strict inequality is false we must have $(m Ra_PLUS mp) = (n Ra_PLUS np)$,
-- so that $(np Ra_PLUS n) Ra_GE (mp Ra_PLUS m)$ is also true.
--
	(mp,np)-->T473 ==> mp Ra_GE np
	(m,n,mp,np)-->T493 ==> (m Ra_PLUS mp) Ra_GE (n Ra_PLUS np)
	(m Ra_PLUS mp,n Ra_PLUS np)-->T473 ==> m Ra_PLUS mp = n Ra_PLUS np
        ALGEBRA ==> (n Ra_PLUS np) Ra_GE (m Ra_PLUS mp)
	ALGEBRA ==> (np Ra_PLUS n) Ra_GE (mp Ra_PLUS m)
--
-- By Theorem 502, we have $Ra_Rev(n) Ra_GE Ra_Rev(m)$, and then adding these
-- last two inequalities and reassociating we find that $np Ra_GE mp$, so that $np = mp$,
-- contradicting $mp Ra_GT np$ an so proving our theorem.
--
	(m,n)-->T502 ==> Ra_Rev(n) Ra_GE Ra_Rev(m)
	n-->T452 ==> (Ra_Rev(n) in Ra) & (n Ra_PLUS Ra_Rev(n) = Ra_0)
	m-->T452 ==> (Ra_Rev(m) in Ra) & (m Ra_PLUS Ra_Rev(m) = Ra_0)
	ALGEBRA ==> (mp Ra_PLUS m in Ra) & (np Ra_PLUS n in Ra)
	(np Ra_PLUS n,mp Ra_PLUS m,Ra_Rev(n),Ra_Rev(m))-->T493 ==>
	((np Ra_PLUS n) Ra_PLUS Ra_Rev(n)) Ra_GE ((mp Ra_PLUS m) Ra_PLUS Ra_Rev(m))
	(Ra_Rev(n),np,n)-->T450 ==> ((np Ra_PLUS n) Ra_PLUS Ra_Rev(n)) = (np Ra_PLUS (n Ra_PLUS Ra_Rev(n)))
	(Ra_Rev(m),mp,m)-->T450 ==> ((mp Ra_PLUS m) Ra_PLUS Ra_Rev(m)) = (mp Ra_PLUS (m Ra_PLUS Ra_Rev(m)))
	EQUAL ==> (np Ra_PLUS Ra_0) Ra_GE (mp Ra_PLUS Ra_0)
	np-->T451 ==> np Ra_PLUS Ra_0 = np
	mp-->T451 ==> mp Ra_PLUS Ra_0 = mp
	EQUAL ==> np Ra_GE mp
	(mp,np)-->T495 ==> mp = np
	(mp,np)-->T473 ==> false; Discharge ==> QED
--
--
-- The following slight variant of Theorem 504 is sometimes more convenient.
--
Theorem 505: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X Ra_GT Y) &
	 (XP Ra_GE YP)) imp ((X Ra_PLUS XP) Ra_GT (Y Ra_PLUS YP)). Proof:
	 Suppose_not(m,n,mp,np) ==> AUTO
	 (mp,np,m,n)-->T504 ==> AUTO
	 (m,mp)-->T445 ==> m Ra_PLUS mp = mp Ra_PLUS m
	 (n,np)-->T445 ==> n Ra_PLUS np = np Ra_PLUS n
	 EQUAL ==> false; Discharge ==> QED
--
Theorem 506: ((X in Ra) & (X /= Ra_0)) imp ((Recip(X) /= Ra_0) & Recip(Recip(X)) = X). Proof:
	Suppose_not(m) ==> (m in Ra) & (m /= Ra_0) & (Recip(m) = Ra_0 or Recip(Recip(m)) /= m)
	m-->T462 ==> (Recip(m) in Ra) & (m Ra_TIMES Recip(m) = Ra_1)
	Suppose ==> Recip(m) = Ra_0
	EQUAL ==> (m Ra_TIMES Ra_0 = Ra_1)
	m-->T489 ==> Ra_0 = Ra_1
	T481 ==> false; Discharge ==> (Recip(m) /= Ra_0)
	(Recip(m))-->T462 ==> (Recip(Recip(m)) in Ra) & (Recip(m) Ra_TIMES Recip(Recip(m)) = Ra_1)
	EQUAL ==> (m Ra_TIMES Recip(m)) Ra_TIMES Recip(Recip(m)) = Ra_1 Ra_TIMES Recip(Recip(m))
	T451 ==> Ra_1 in Ra
	(Ra_1,Recip(Recip(m)))-->T448 ==> (Ra_1 Ra_TIMES Recip(Recip(m)) = Recip(Recip(m)) Ra_TIMES Ra_1)
	(Recip(Recip(m)))-->T461 ==> Recip(Recip(m)) Ra_TIMES Ra_1 = Recip(Recip(m))
	ELEM ==> (m Ra_TIMES Recip(m)) Ra_TIMES Recip(Recip(m)) = Recip(Recip(m))
	(Recip(Recip(m)),m,Recip(m))-->T456 ==> m Ra_TIMES (Recip(m) Ra_TIMES Recip(Recip(m))) = Recip(Recip(m))
	EQUAL ==> m Ra_TIMES Ra_1 = Recip(Recip(m))
	m-->T461 ==> false; Discharge ==> QED
--
Theorem 507: ([2,0] in Si) & (is_nonneg([2,0])) & is_nonneg([1,0]) & (Fr_to_Ra([[1,0],[2,0]]) in Ra) &
		(Fr_to_Ra([[1,0],[2,0]]) Ra_GT Ra_0). Proof:
    Suppose_not ==> Stat1: ([2,0] notin Si) or (not is_nonneg([2,0])) or (not is_nonneg([1,0])) or
		(Fr_to_Ra([[1,0],[2,0]]) notin Ra) or (not (Fr_to_Ra([[1,0],[2,0]]) Ra_GT Ra_0))
-- or (not (((X Ra_GT Ra_0) Ra_TIMES Fr_to_Ra([[1,0],[2,0]])) Ra_GT Ra_0))
        T460 ==> ([1,0] in Si)
        Use_def(is_nonneg) ==> is_nonneg([1,0])
        ([1,0],[1,0])-->T425 ==> is_nonneg([1,0] S_PLUS [1,0])
        Use_def(S_PLUS) ==> ([1,0] S_PLUS [1,0]) = Red([car([1,0]) PLUS car([1,0]),cdr([1,0]) PLUS cdr([1,0])])
        T211 ==> (0 in Za) & (1 in Za) & (2 in Za) & Card(0) & Card(1)
        0-->T164 ==> 0 = #0
        1-->T164 ==> 1 = #1
        0-->T247 ==> #0 PLUS 0 = 0
        1-->T317 ==> 1 PLUS 1 = next(1)
        Use_def(2) ==> (1 PLUS 1 = 2)
        T212 ==> Stat2: (1 /= 0) & (2 /= 0)
        (Stat2)ELEM ==> Stat3: (car([1,0]) = 1) & (cdr([1,0]) = 0) & ([2,0] /= [0,0]) & ([1,0] /= [0,0])
        2-->T387 ==> Red([2,0]) = [2,0]
        EQUAL ==> [1,0] S_PLUS [1,0] = [2,0]
        0-->T367 ==> Stat4: [0,0] in Si
        1-->T367 ==> Stat5: [1,0] in Si
        2-->T367 ==> Stat6: [2,0] in Si
        EQUAL ==> is_nonneg([2,0]) & (not (Fr_to_Ra([[1,0],[2,0]]) Ra_GT Ra_0))
        T451 ==> Ra_0 in Ra
        TELEM ==> [[1,0],[2,0]] in Fr
        ([[1,0],[2,0]])-->T421 ==> Fr_to_Ra([[1,0],[2,0]]) in Ra
        (Fr_to_Ra([[1,0],[2,0]]), Ra_0)-->T473 ==> (not Ra_is_nonneg(Fr_to_Ra([[1,0],[2,0]]) Ra_MINUS Ra_0)) or (Fr_to_Ra([[1,0],[2,0]]) = Ra_0)
        ([[1,0],[2,0]])-->T431(Stat3,Stat5,Stat6*) ==> [[1,0],[2,0]] in Fr
        Suppose ==> Fr_to_Ra([[1,0],[2,0]]) notin Ra
        ([[1,0],[2,0]])-->T421(Stat1*) ==> false; Discharge ==> Fr_to_Ra([[1,0],[2,0]]) in Ra
        Suppose ==> not Ra_is_nonneg(Fr_to_Ra([[1,0],[2,0]]) Ra_MINUS Ra_0)
            Use_def(Ra_MINUS) ==> not Ra_is_nonneg(Fr_to_Ra([[1,0],[2,0]]) Ra_PLUS Ra_Rev(Ra_0))
            T481 ==> Ra_Rev(Ra_0) = Ra_0
            (Fr_to_Ra([[1,0],[2,0]]))-->T451(*) ==> Fr_to_Ra([[1,0],[2,0]]) Ra_PLUS Ra_0 = Fr_to_Ra([[1,0],[2,0]])
            EQUAL ==> not Ra_is_nonneg(Fr_to_Ra([[1,0],[2,0]]))
            ([1,0],[2,0])-->T425(Stat1*) ==> is_nonneg([1,0] S_TIMES [2,0])
        ([1,0],[2,0])-->T459(Stat1*) ==> false; Discharge ==> Fr_to_Ra([[1,0],[2,0]]) = Ra_0
        Use_def(Ra_0) ==> Fr_to_Ra([[1,0],[2,0]]) = Fr_to_Ra([[0,0],[1,0]])
        T420 ==> Stat7: (FORALL x, y | ((x in Fr) & (y in Fr)) imp ((Same_frac(x,y) eq (Fr_to_Ra(x) = Fr_to_Ra(y)))))
        ([[0,0],[1,0]])-->T431(Stat3,Stat4,Stat5*) ==> [[0,0],[1,0]] in Fr
        ([[1,0],[2,0]],[[0,0],[1,0]])-->Stat7(Stat6*) ==> Same_frac([[1,0],[2,0]],[[0,0],[1,0]])
        Use_def(Same_frac) ==> Stat8: car([[1,0],[2,0]]) S_TIMES cdr([[0,0],[1,0]]) = cdr([[1,0],[2,0]]) S_TIMES car([[0,0],[1,0]])
        TELEM ==> (car([[1,0],[2,0]]) = [1,0]) & (cdr([[0,0],[1,0]]) = [1,0]) & (cdr([[1,0],[2,0]]) = [2,0]) & (car([[0,0],[1,0]]) = [0,0])
        EQUAL(Stat8) ==> Stat9: [1,0] S_TIMES [1,0] = [2,0] S_TIMES [0,0]
        ([1,0])-->T401(Stat5,Stat5) ==> Stat10: [1,0] S_TIMES [1,0] = [1,0]
        ([2,0])-->T401(Stat6,Stat6) ==> Stat11: [0,0] S_TIMES [2,0] = [0,0]
        ([0,0],[2,0])-->T384(Stat4,Stat6) ==> Stat12: [0,0] S_TIMES [2,0] = [2,0] S_TIMES [0,0]
    (Stat9,Stat10,Stat11,Stat12,Stat3*)Discharge ==> QED
--
-- The following lemmas supply the evident facts that the strict and nonstrict rational comparisons
-- are both transitive relationships. We begin with the nonstrict version.
--
Theorem 508: [Transitivity of ordering by 'greater than'] ((X in Ra) & (Y in Ra) & (Z in Ra) &
	(X Ra_GE Y) & (Y Ra_GE Z)) imp (X Ra_GE Z). Proof:
	Suppose_not(m,n,j) ==> (m in Ra) & (n in Ra) & (j in Ra) & (m Ra_GE n) & (n Ra_GE j) & (not (m Ra_GE j))
	(m,n)-->T473 ==> Ra_is_nonneg(m Ra_PLUS Ra_Rev(n))
	(n,j)-->T473 ==> Ra_is_nonneg(n Ra_PLUS Ra_Rev(j))
	(m,j)-->T473 ==> not Ra_is_nonneg(m Ra_PLUS Ra_Rev(j))
	m-->T452 ==> (Ra_Rev(m) in Ra)
	n-->T452 ==> (Ra_Rev(n) in Ra)
	j-->T452 ==> (Ra_Rev(j) in Ra)
	ALGEBRA ==> (m Ra_PLUS Ra_Rev(n) in Ra) & (n Ra_PLUS Ra_Rev(j) in Ra)
	(m Ra_PLUS Ra_Rev(n),n Ra_PLUS Ra_Rev(j))-->T469 ==>
	Ra_is_nonneg((m Ra_PLUS Ra_Rev(n)) Ra_PLUS (n Ra_PLUS Ra_Rev(j)))
	(n Ra_PLUS Ra_Rev(j),m,Ra_Rev(n))-->T450 ==>
	m Ra_PLUS (Ra_Rev(n) Ra_PLUS (n Ra_PLUS Ra_Rev(j))) = (m Ra_PLUS Ra_Rev(n)) Ra_PLUS (n Ra_PLUS Ra_Rev(j))
	(Ra_Rev(j),Ra_Rev(n),n)-->T450 ==> (Ra_Rev(n) Ra_PLUS n) Ra_PLUS Ra_Rev(j) = Ra_Rev(n) Ra_PLUS (n Ra_PLUS Ra_Rev(j))
	(Ra_Rev(n),n)-->T445 ==> Ra_Rev(n) Ra_PLUS n = n Ra_PLUS Ra_Rev(n)
	EQUAL ==> Ra_is_nonneg(m Ra_PLUS ((n Ra_PLUS Ra_Rev(n)) Ra_PLUS Ra_Rev(j)))
	n-->T452 ==> n Ra_PLUS Ra_Rev(n) = Ra_0
	EQUAL ==> Ra_is_nonneg(m Ra_PLUS (Ra_0 Ra_PLUS Ra_Rev(j)))
	T451 ==> Ra_0 in Ra
	(Ra_0,Ra_Rev(j))-->T445 ==> Ra_0 Ra_PLUS Ra_Rev(j) = Ra_Rev(j) Ra_PLUS Ra_0
	(Ra_Rev(j))-->T451 ==> Ra_Rev(j) Ra_PLUS Ra_0 = Ra_Rev(j)
	EQUAL ==> false; Discharge ==> QED
--
-- The preceding lemma can be used to prove the following 'strict' version of itself.
--
Theorem 509: [Transitivity of ordering, strict case] ((X in Ra) & (Y in Ra) & (Z in Ra) &
	(X Ra_GT Y) & (Y Ra_GE Z)) imp (X Ra_GT Z). Proof:
	Suppose_not(m,n,j) ==> (m in Ra) & (n in Ra) & (j in Ra) & (m Ra_GT n) & (n Ra_GE j) & (not (m Ra_GT j))
	(m,n)-->T473 ==> m Ra_GE n
	(m,n,j)-->T508 ==> m Ra_GE j
	(m,j)-->T473 ==> m = j
	EQUAL ==> j Ra_GT n
	(j,n)-->T473 ==> j Ra_GE n
	(n,j)-->T495 ==> n = j
	(j,n)-->T473 ==> false; Discharge ==> QED
--
-- It is sometimes convenient to use the following slight variant of the preceding lemma.
--
Theorem 510: [Transitivity of ordering, strict case 2] ((X in Ra) & (Y in Ra) & (Z in Ra) &
	(X Ra_GE Y) & (Y Ra_GT Z)) imp (X Ra_GT Z). Proof:
	Suppose_not(m,n,j) ==> (m in Ra) & (n in Ra) & (j in Ra) & (m Ra_GE n) & (n Ra_GT j) & (not (m Ra_GT j))
	(n,j)-->T473 ==> n Ra_GE j
	(m,n,j)-->T508 ==> m Ra_GE j
	(m,j)-->T473 ==> m = j
	EQUAL ==> j Ra_GE n
	(n,j)-->T473 ==> n Ra_GE j
	(n,j)-->T495 ==> n = j
	(n,j)-->T473 ==> false; Discharge ==> QED
--
Theorem 511: ((X in Ra) & (Y in Ra) & (Z in Ra) & (X Ra_GT Y) & (Y Ra_GT Z)) imp (X Ra_GT Z). Proof:
    Suppose_not(x,y,w) ==> (x in Ra) & (y in Ra) & (w in Ra) & (x Ra_GT y) & (y Ra_GT w) & (not(x Ra_GT w))
        (y,w)-->T473 ==> y Ra_GE w
    (x,y,w)-->T509 ==> false; Discharge ==> QED
--
-- The properties of $Ra_GT$ are mirrored by properties of $Ra_LT$ and hence
-- enable us to exploit, in connection with $Ra$, the theory of linear orderings.
--
Theorem 512: (FORALL x in Ra, y in Ra, z in Ra | ((x Ra_LT y) & (y Ra_LT z)) imp (x Ra_LT z)). Proof:
    Suppose_not ==> Stat1: not(FORALL x in Ra, y in Ra, z in Ra | ((x Ra_LT y) & (y Ra_LT z)) imp (x Ra_LT z))
        (x,y,w)-->Stat1 ==> (x in Ra) & (y in Ra) & (w in Ra) & (x Ra_LT y) & (y Ra_LT w) & (not (x Ra_LT w))
        (x,y)-->T473 ==> y Ra_GT x
        (y,w)-->T473 ==> w Ra_GT y
        (w,y)-->T473 ==> w Ra_GE y
        (w,y,x)-->T510 ==> w Ra_GT x
    (x,w)-->T473 ==> false; Discharge ==> QED
--
Theorem 513: (FORALL x in Ra | not(x Ra_LT x)). Proof:
    Suppose_not ==> Stat1: not(FORALL x in Ra | not(x Ra_LT x))
        x-->Stat1 ==> (x in Ra) & (x Ra_LT x)
    (x,x)-->T473 ==> false; Discharge ==> QED
--
Theorem 514: (FORALL x in Ra, y in Ra | (x Ra_LT y) or (x = y) or (y Ra_LT x)). Proof:
    Suppose_not ==> Stat1: not(FORALL x in Ra, y in Ra | (x Ra_LT y) or (x = y) or (y Ra_LT x))
        (x,y)-->Stat1 ==> (x in Ra) & (y in Ra) & (not((x Ra_LT y) or (x = y) or (y Ra_LT x)))
        (y,x)-->T495 ==> (y Ra_GE x) or (x Ra_GE y)
        Suppose ==> y Ra_GE x
            (y,x)-->T473 ==> y Ra_GT x
            (x,y)-->T473 ==> false; Discharge ==> (x Ra_GE y) & (x /= y)
        (x,y)-->T473 ==> (x Ra_GT y)
    (y,x)-->T473 ==> false; Discharge ==> QED
--
APPLY(smaller_thryvar:smaller_Ra,ubs_thryvar:ubs_Ra,min_over_thryvar:min_over_Ra,max_thryvar:max_Ra,lub_thryvar:lub_Ra) linear_order(s0->Ra, arg1_bef_arg2(X,Y)->(X Ra_LT Y)) ==>
Theorem 515: (FORALL x, y | smaller_Ra(x,y) = if ((x notin Ra) & (y notin Ra)) then Ra elseif (x notin Ra) then y elseif (y notin Ra) then x elseif (x Ra_LT y) then x else y end if) &
	(FORALL x, y | smaller_Ra(x,y) = smaller_Ra(y,x)) &
	(FORALL x, y | ({x,y} incin Ra) imp (smaller_Ra(x,y) in {x,y})) &
	(FORALL x | (x in next(Ra)) imp (smaller_Ra(x,Ra) = x)) &
	(FORALL x, y, z | smaller_Ra(x,smaller_Ra(y,z)) = smaller_Ra(smaller_Ra(x,y),z)) &
	(FORALL x, y | ((x in next(Ra)) & (y in next(Ra))) imp (smaller_Ra(x,y) in next(Ra))) &
	(FORALL f,p,a | (Svm(f) & (range(f) incin Ra) & Finite(f)) imp
		(((p in f) imp (min_over_Ra({p}) = (f~[car(p)]))) &
		(min_over_Ra(f) = smaller_Ra(min_over_Ra(f ON (domain(f) * a)),min_over_Ra(f ON (domain(f) - a)))))) &
	(FORALL f | (Svm(f) & (range(f) incin Ra) & Finite(f) & (f /= 0)) imp (min_over_Ra(f) in range(f))) &
	(FORALL x, y | ({x,y} incin Ra) imp ((smaller_Ra(x,y) = x) eq ((x Ra_LT y) or (x = y)))) &
	(FORALL t | ubs_Ra(t) = {x in Ra | (FORALL y in (t * Ra) | smaller_Ra(y,x) = y)}) &
	(FORALL t | max_Ra(t) = arb({Ra} + (t * ubs_Ra(t)))) &
	(FORALL t | lub_Ra(t) = arb({Ra} + {x in ubs_Ra(t) | ubs_Ra(t) incin ubs_Ra({x})})) &
	(ubs_Ra(0) = Ra) & (max_Ra(0) = Ra) &
	(FORALL t | (ubs_Ra(t) incin Ra) & (ubs_Ra(t) = ubs_Ra(t * Ra)) & (max_Ra(t) = max_Ra(t * Ra))) &
	(FORALL t, x | (Finite(t) & (x in t) & (t incin Ra)) imp ((max_Ra(t) in t) & ((x = max_Ra(t)) or ((x Ra_LT max_Ra(t))))))
--
-- For positive rationals, multiplication is also monotone and strictly monotone.
-- We prove the nonstrict version of this assertion first.
--
Theorem 516: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X Ra_GE Y) & (Y Ra_GE Ra_0) &
	 (YP Ra_GE Ra_0) & (XP Ra_GE YP)) imp ((X Ra_TIMES XP) Ra_GE (Y Ra_TIMES YP)). Proof:
	Suppose_not(m,n,mp,np) ==> (m in Ra) & (n in Ra) & (mp in Ra) & (np in Ra) & (m Ra_GE n) & (mp Ra_GE np) &
	(n Ra_GE Ra_0) & (np Ra_GE Ra_0) & (not((m Ra_TIMES mp) Ra_GE (n Ra_TIMES np)))
	(m,n)-->T473 ==> Ra_is_nonneg(m Ra_PLUS Ra_Rev(n))
	(mp,np)-->T473 ==> Ra_is_nonneg(mp Ra_PLUS Ra_Rev(np))
	(m Ra_TIMES mp,n Ra_TIMES np)-->T473 ==> not Ra_is_nonneg((m Ra_TIMES mp) Ra_PLUS Ra_Rev(n Ra_TIMES np))
	(np,n)-->T448 ==> n Ra_TIMES np = np Ra_TIMES n
	(np,n)-->T485 ==> np Ra_TIMES Ra_Rev(n) = Ra_Rev(np Ra_TIMES n)
	T451 ==> Ra_0 in Ra
	(np,Ra_0)-->T473 ==> np Ra_GE Ra_0
	(m,n,Ra_0)-->T508 ==> m Ra_GE Ra_0
	(m,Ra_0)-->T473 ==> m Ra_GE Ra_0
	(m,Ra_0)-->T473 ==> Ra_is_nonneg(m Ra_PLUS Ra_Rev(Ra_0))
	(np,Ra_0)-->T473 ==> Ra_is_nonneg(np Ra_PLUS Ra_Rev(Ra_0))
	T481 ==> Ra_Rev(Ra_0) = Ra_0
	EQUAL ==> Ra_is_nonneg(m Ra_PLUS Ra_0) & Ra_is_nonneg(np Ra_PLUS Ra_0)
	ALGEBRA ==> Ra_is_nonneg(m) & Ra_is_nonneg(np)
	n-->T452 ==> Ra_Rev(n) in Ra
	np-->T452 ==> (Ra_Rev(np) in Ra) & (np Ra_PLUS Ra_Rev(np) = Ra_0)
	Loc_def ==> rn = Ra_Rev(n)
	Loc_def ==> rnp = Ra_Rev(np)
	EQUAL ==> Ra_is_nonneg(m Ra_PLUS rn) & Ra_is_nonneg(mp Ra_PLUS rnp) & (rn in Ra) & (rnp in Ra)
	EQUAL ==> (np Ra_PLUS rnp = Ra_0) & (not Ra_is_nonneg((m Ra_TIMES mp) Ra_PLUS (np Ra_TIMES rn)))
	ALGEBRA ==> (m Ra_PLUS rn in Ra) & (mp Ra_PLUS rnp in Ra) &
	(m Ra_TIMES (mp Ra_PLUS rnp) in Ra) & (np Ra_TIMES (m Ra_PLUS rn) in Ra)
	(m,mp Ra_PLUS rnp)-->T469 ==> Ra_is_nonneg(m Ra_TIMES (mp Ra_PLUS rnp))
	(np,m Ra_PLUS rn)-->T469 ==> Ra_is_nonneg(np Ra_TIMES (m Ra_PLUS rn))
	(m Ra_TIMES (mp Ra_PLUS rnp),np Ra_TIMES (m Ra_PLUS rn))-->T469 ==>
	Ra_is_nonneg((m Ra_TIMES (mp Ra_PLUS rnp)) Ra_PLUS (np Ra_TIMES (m Ra_PLUS rn)))
	ALGEBRA ==> Ra_is_nonneg(((m Ra_TIMES mp) Ra_PLUS (np Ra_TIMES rn)) Ra_PLUS ((m Ra_TIMES (np Ra_PLUS rnp))))
	EQUAL ==> Ra_is_nonneg(((m Ra_TIMES mp) Ra_PLUS (np Ra_TIMES rn)) Ra_PLUS ((m Ra_TIMES Ra_0)))
	ALGEBRA ==> Ra_is_nonneg((m Ra_TIMES mp) Ra_PLUS (np Ra_TIMES rn))
	EQUAL ==> false; Discharge ==> QED
--
-- The following lemma is the 'strict' variant of the preceding.
--
Theorem 517: ((X in Ra) & (Y in Ra) & (XP in Ra) & (YP in Ra) & (X Ra_GT Y) & (Y Ra_GT Ra_0) &
	 (YP Ra_GT Ra_0) & (XP Ra_GE YP)) imp ((X Ra_TIMES XP) Ra_GT (Y Ra_TIMES YP)). Proof:
	Suppose_not(m,n,mp,np) ==> (m in Ra) & (n in Ra) & (mp in Ra) & (np in Ra) & (m Ra_GT n) & (mp Ra_GE np) &
	(n Ra_GT Ra_0) & (np Ra_GT Ra_0) & (not((m Ra_TIMES mp) Ra_GT (n Ra_TIMES np)))
	n-->T452 ==> (Ra_Rev(n) in Ra) & (n Ra_PLUS Ra_Rev(n) = Ra_0)
	T451 ==> Ra_0 in Ra
	EQUAL ==> m Ra_PLUS (n Ra_PLUS Ra_Rev(n)) = m Ra_PLUS Ra_0
	m-->T451 ==> m Ra_PLUS (n Ra_PLUS Ra_Rev(n)) = m
	(m,n)-->T473 ==> (m Ra_GE n) & (m /= n)
	(n,Ra_0)-->T473 ==> (n Ra_GE Ra_0) & (n /= Ra_0)
	(np,Ra_0)-->T473 ==> (np Ra_GE Ra_0) & (np /= Ra_0)
	(m,n)-->T473 ==> Ra_is_nonneg(m Ra_PLUS Ra_Rev(n))
	(mp,np,Ra_0)-->T510 ==> mp Ra_GT Ra_0
	(mp,Ra_0)-->T473 ==> (mp Ra_GE Ra_0) & (mp /= Ra_0)
	(mp,Ra_0)-->T473 ==> Ra_is_nonneg(mp Ra_PLUS Ra_Rev(Ra_0))
	T481 ==> Ra_Rev(Ra_0) = Ra_0
	EQUAL ==> Ra_is_nonneg(mp Ra_PLUS Ra_0)
	ALGEBRA ==> Ra_is_nonneg(mp)
	Loc_def ==> rn = Ra_Rev(n)
	EQUAL ==> Stat1: (m Ra_PLUS (n Ra_PLUS rn) = m) & Ra_is_nonneg(m Ra_PLUS rn) & (rn in Ra)
	EQUAL ==> n Ra_PLUS rn = Ra_0
	ALGEBRA ==> (m Ra_PLUS rn in Ra) & (n Ra_PLUS rn in Ra)
	(mp,m Ra_PLUS rn)-->T469 ==> Ra_is_nonneg(mp Ra_TIMES (m Ra_PLUS rn))
	ALGEBRA ==> mp Ra_TIMES (m Ra_PLUS rn) = (mp Ra_TIMES (m Ra_PLUS rn)) Ra_PLUS Ra_0
	EQUAL(Stat1) ==> (mp Ra_TIMES m) = (mp Ra_TIMES (m Ra_PLUS (n Ra_PLUS rn)))
	ALGEBRA ==> (m Ra_PLUS (n Ra_PLUS rn)) = (n Ra_PLUS (m Ra_PLUS rn))
	EQUAL(Stat1) ==> (mp Ra_TIMES m) = (mp Ra_TIMES (n Ra_PLUS (m Ra_PLUS rn)))
	(m Ra_PLUS rn,mp,n)-->T458 ==> (mp Ra_TIMES (n Ra_PLUS (m Ra_PLUS rn))) =
					((mp Ra_TIMES n) Ra_PLUS (mp Ra_TIMES (m Ra_PLUS rn)))
	ALGEBRA ==> m Ra_PLUS rn in Ra
	ALGEBRA ==> ((mp Ra_TIMES n) in Ra) & ((np Ra_TIMES n) in Ra) & ((mp Ra_TIMES (m Ra_PLUS rn)) in Ra)
	n-->T452 ==> Stat2: n Ra_PLUS Ra_Rev(n) = Ra_0
	T465 ==> Stat3: Ra_is_nonneg(Ra_0)
	EQUAL(Stat2) ==> Ra_is_nonneg(n Ra_PLUS Ra_Rev(n))
	(n,n)-->T473 ==> n Ra_GE n
	Ra_0-->T452 ==> Stat4: Ra_0 Ra_PLUS Ra_Rev(Ra_0) = Ra_0
	EQUAL(Stat4,Stat3) ==> Ra_is_nonneg(Ra_0 Ra_PLUS Ra_Rev(Ra_0))
	(Ra_0,Ra_0)-->T473 ==> Ra_0 Ra_GE Ra_0
	(mp,np,n,n)-->T516 ==> (mp Ra_TIMES n) Ra_GE (np Ra_TIMES n)
	ALGEBRA ==> Ra_is_nonneg((m Ra_PLUS rn) Ra_PLUS Ra_0)
	EQUAL ==> Ra_is_nonneg((m Ra_PLUS rn) Ra_PLUS Ra_Rev(Ra_0))
	(m Ra_PLUS rn,Ra_0)-->T473 ==> (m Ra_PLUS rn) Ra_GE Ra_0
	(mp,Ra_0,m Ra_PLUS rn,Ra_0)-->T516 ==> (mp Ra_TIMES (m Ra_PLUS rn)) Ra_GE (Ra_0 Ra_TIMES Ra_0)
	Ra_0-->T489 ==> Ra_0 Ra_TIMES Ra_0 = Ra_0
	EQUAL ==> (mp Ra_TIMES (m Ra_PLUS rn)) Ra_GE Ra_0
	Suppose ==> Stat5: m Ra_PLUS rn = Ra_0
	EQUAL(Stat5) ==> (m Ra_PLUS rn) Ra_PLUS n = Ra_0 Ra_PLUS n
	ALGEBRA ==> m Ra_PLUS (n Ra_PLUS rn) = n
	EQUAL ==> m Ra_PLUS Ra_0 = n
	ALGEBRA ==> false; Discharge ==> m Ra_PLUS rn /= Ra_0
	Suppose ==> (mp Ra_TIMES (m Ra_PLUS rn)) = Ra_0
	EQUAL ==> Stat6: (mp Ra_TIMES (m Ra_PLUS rn)) Ra_TIMES Recip(m Ra_PLUS rn) = Ra_0 Ra_TIMES Recip(m Ra_PLUS rn)
	(m Ra_PLUS rn)-->T462 ==> (Recip(m Ra_PLUS rn) in Ra) & ((m Ra_PLUS rn) Ra_TIMES Recip(m Ra_PLUS rn) = Ra_1)
	ALGEBRA ==> mp Ra_TIMES ((m Ra_PLUS rn) Ra_TIMES Recip(m Ra_PLUS rn)) = Ra_0
	EQUAL ==> mp Ra_TIMES Ra_1 = Ra_0
	ALGEBRA ==> false; Discharge ==> (mp Ra_TIMES (m Ra_PLUS rn)) /= Ra_0
	(mp Ra_TIMES (m Ra_PLUS rn),Ra_0)-->T473 ==> (mp Ra_TIMES (m Ra_PLUS rn)) Ra_GT Ra_0
	(mp Ra_TIMES n,np Ra_TIMES n,mp Ra_TIMES (m Ra_PLUS rn),Ra_0)-->T504 ==>
	((mp Ra_TIMES n) Ra_PLUS (mp Ra_TIMES (m Ra_PLUS rn))) Ra_GT ((np Ra_TIMES n) Ra_PLUS Ra_0)
	ALGEBRA ==> (mp Ra_TIMES (n Ra_PLUS (m Ra_PLUS rn))) Ra_GT (np Ra_TIMES n)
	EQUAL ==> false; Discharge ==> QED
--
-- Next we show that the mapping of a positive rational to its reciprocal is
-- strictly monotone decreasing.
--
Theorem 518: [The rational reciprocal is monotone decreasing for positive rationals] ((X in Ra) & (Y in Ra) & (X Ra_GT Y) & (Y Ra_GT Ra_0)) imp (Recip(Y) Ra_GT Recip(X)). Proof:
	Suppose_not(m,n) ==> (m in Ra) & (n in Ra) & (m Ra_GT n) & (n Ra_GT Ra_0) & (not(Recip(n) Ra_GT Recip(m)))
	(m,n)-->T473 ==> m Ra_GE n
	T451 ==> Ra_0 in Ra
	(m,n,Ra_0)-->T510 ==> m Ra_GT Ra_0
	(n,Ra_0)-->T473 ==> (n Ra_GE Ra_0) & (n /= Ra_0)
	(m,Ra_0)-->T473 ==> (m Ra_GE Ra_0) & (m /= Ra_0)
	m-->T462 ==> Recip(m) in Ra
	n-->T462 ==> Recip(n) in Ra
	(Recip(n),Recip(m))-->T473 ==> (not (Recip(n) Ra_GE Recip(m))) or (Recip(n) = Recip(m))
	Suppose ==> Recip(n) = Recip(m)
	EQUAL ==> Recip(Recip(n)) = Recip(Recip(m))
	m-->T506 ==> Recip(Recip(m)) = m
	n-->T506 ==> Recip(Recip(n)) = n
	ELEM ==> m = n
	(m,n)-->T473 ==> false; Discharge ==> not (Recip(n) Ra_GE Recip(m))
	(Recip(n),Recip(m))-->T495 ==> Recip(m) Ra_GE Recip(n)
	n-->T491 ==> Recip(n) Ra_GT Ra_0
	(m,n,Recip(m),Recip(n))-->T517 ==> ((m Ra_TIMES Recip(m)) Ra_GT (n Ra_TIMES Recip(n)))
	m-->T462 ==> m Ra_TIMES Recip(m) = Ra_1
	n-->T462 ==> n Ra_TIMES Recip(n) = Ra_1
	EQUAL ==> Ra_1 Ra_GT Ra_1
	(Ra_1,Ra_1)-->T473 ==> false; Discharge ==> QED
--
-- The following result gives us a fact about rationals that will be significant
-- when we come to use them for defining real numbers: between any two distinct
-- rational numbers there exists a third (their average) which lies between the larger
-- and the smaller of the two.
--
Theorem 519: [The average of two rational numbers lies between them] ((X in Ra) & (Y in Ra) & (X Ra_GT Y)) imp
	((X Ra_GT ((X Ra_PLUS Y) Ra_OVER (Ra_1 Ra_PLUS Ra_1))) & (((X Ra_PLUS Y) Ra_OVER (Ra_1 Ra_PLUS Ra_1)) Ra_GT Y)). Proof:
    Suppose_not(m,n) ==> (m in Ra) & (n in Ra) & (m Ra_GT n) &
	(not ((m Ra_GT ((m Ra_PLUS n) Ra_OVER (Ra_1 Ra_PLUS Ra_1))) & (((m Ra_PLUS n) Ra_OVER (Ra_1 Ra_PLUS Ra_1)) Ra_GT n)))
 	(m,m)-->T473 ==> m Ra_GE m
 	(n,n)-->T473 ==> n Ra_GE n
    (n,n,m,n)-->T504 ==> ((n Ra_PLUS m) Ra_GT (n Ra_PLUS n))
    (m,m,m,n)-->T504 ==> ((m Ra_PLUS m) Ra_GT (m Ra_PLUS n))
    T451 ==> Ra_1 in Ra
    ALGEBRA ==> (m Ra_PLUS n) Ra_GT (n Ra_TIMES (Ra_1 Ra_PLUS Ra_1))
    ALGEBRA ==> (m Ra_TIMES (Ra_1 Ra_PLUS Ra_1)) Ra_GT (m Ra_PLUS n)
    ALGEBRA ==> (Ra_1 in Ra) & (Ra_0 in Ra) & (Ra_1 Ra_PLUS Ra_1 in Ra)
    ALGEBRA ==> (m Ra_TIMES (Ra_1 Ra_PLUS Ra_1)) in Ra
    ALGEBRA ==> (m Ra_PLUS n in Ra) & (n Ra_TIMES (Ra_1 Ra_PLUS Ra_1) in Ra)
    ALGEBRA ==> (n Ra_TIMES Ra_1 = n) & (m Ra_TIMES Ra_1 = m)
    T481 ==> Ra_1 Ra_GT Ra_0
    (Ra_1,Ra_0)-->T473 ==> Ra_1 Ra_GE Ra_0
    (Ra_1,Ra_0,Ra_1,Ra_0)-->T504 ==> (Ra_1 Ra_PLUS Ra_1) Ra_GT (Ra_0 Ra_PLUS Ra_0)
    ALGEBRA ==> (Ra_1 Ra_PLUS Ra_1) Ra_GT Ra_0
    (Ra_1 Ra_PLUS Ra_1,Ra_0)-->T473 ==> (Ra_1 Ra_PLUS Ra_1) /= Ra_0
    (Ra_1 Ra_PLUS Ra_1)-->T462 ==> Recip(Ra_1 Ra_PLUS Ra_1) in Ra
    (Ra_1 Ra_PLUS Ra_1)-->T491 ==> Recip(Ra_1 Ra_PLUS Ra_1) Ra_GT Ra_0
    (m Ra_PLUS n,n Ra_TIMES (Ra_1 Ra_PLUS Ra_1),Recip(Ra_1 Ra_PLUS Ra_1))-->T488 ==>
	((m Ra_PLUS n) Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1)) Ra_GT
	((n Ra_TIMES (Ra_1 Ra_PLUS Ra_1)) Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1))
    ALGEBRA ==>  ((m Ra_PLUS n) Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1)) Ra_GT
    				(n Ra_TIMES ((Ra_1 Ra_PLUS Ra_1) Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1)))
    (Ra_1 Ra_PLUS Ra_1)-->T462 ==> (Ra_1 Ra_PLUS Ra_1) Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1) = Ra_1
    EQUAL ==> ((m Ra_PLUS n) Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1)) Ra_GT n
    Use_def(Ra_OVER) ==> ((m Ra_PLUS n) Ra_OVER (Ra_1 Ra_PLUS Ra_1)) Ra_GT n
    (m Ra_TIMES (Ra_1 Ra_PLUS Ra_1),m Ra_PLUS n,Recip(Ra_1 Ra_PLUS Ra_1))-->T488 ==>
	((m Ra_TIMES (Ra_1 Ra_PLUS Ra_1)) Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1)) Ra_GT
	((m Ra_PLUS n) Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1))
    ALGEBRA ==> (m Ra_TIMES ((Ra_1 Ra_PLUS Ra_1) Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1))) Ra_GT
	((m Ra_PLUS n) Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1))
    EQUAL ==> m Ra_GT ((m Ra_PLUS n) Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1))
    Use_def(Ra_OVER) ==> m Ra_GT ((m Ra_PLUS n) Ra_OVER (Ra_1 Ra_PLUS Ra_1))
    Discharge ==> QED
--
Theorem 520: [Properties of the rational number 2] ((Ra_1 Ra_PLUS Ra_1) in Ra) & ((Ra_1 Ra_PLUS Ra_1) Ra_GT Ra_0) &
                (Recip(Ra_1 Ra_PLUS Ra_1) in Ra) &
		((X in Ra) imp ((X Ra_OVER (Ra_1 Ra_PLUS Ra_1)) in Ra)). Proof:
    Suppose_not(x) ==> ((Ra_1 Ra_PLUS Ra_1) notin Ra) or (not((Ra_1 Ra_PLUS Ra_1) Ra_GT Ra_0)) or
		(Recip(Ra_1 Ra_PLUS Ra_1) notin Ra) or
		((x in Ra) & ((x Ra_OVER (Ra_1 Ra_PLUS Ra_1)) notin Ra))
        Ra_0-->T451 ==> (Ra_0 in Ra) & (Ra_1 in Ra) & (Ra_0 = (Ra_0 Ra_PLUS Ra_0))
        (Ra_1,Ra_1)-->T445 ==> Stat1: (Ra_1 Ra_PLUS Ra_1) in Ra
        T481 ==> Ra_1 Ra_GT Ra_0
        (Ra_1,Ra_0)-->T473 ==> Ra_1 Ra_GE Ra_0
        (Ra_1,Ra_0,Ra_1,Ra_0)-->T504 ==> Stat2: (Ra_1 Ra_PLUS Ra_1) Ra_GT (Ra_0 Ra_PLUS Ra_0)
        Ra_0-->T451 ==> Ra_0 = (Ra_0 Ra_PLUS Ra_0)
        EQUAL(Stat2) ==> (Ra_1 Ra_PLUS Ra_1) Ra_GT Ra_0
        (Ra_1 Ra_PLUS Ra_1, Ra_0)-->T473 ==> Stat3: (Ra_1 Ra_PLUS Ra_1) /= Ra_0
        (Ra_1 Ra_PLUS Ra_1)-->T462(Stat1,Stat3) ==> Recip(Ra_1 Ra_PLUS Ra_1) in Ra
        ELEM ==> ((x in Ra) & ((x Ra_OVER (Ra_1 Ra_PLUS Ra_1)) notin Ra))
        Use_def(Ra_OVER) ==> (x Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1)) notin Ra
    (x,Recip(Ra_1 Ra_PLUS Ra_1))-->T448 ==> false; Discharge ==> QED
--
-- The next theorem asserts that every rational number $x$ can be obtained as the sum of
-- its half plus its half. Its proof derives this general statement from the specific
-- case when $x=1$.
--
Theorem 521: [Any rational number can be divided into two equal halves] (X in Ra) imp (X = ((X Ra_OVER (Ra_1 Ra_PLUS Ra_1)) Ra_PLUS (X Ra_OVER (Ra_1 Ra_PLUS Ra_1)))). Proof:
    Suppose_not(x) ==> (x in Ra) & (x /= ((x Ra_OVER (Ra_1 Ra_PLUS Ra_1)) Ra_PLUS (x Ra_OVER (Ra_1 Ra_PLUS Ra_1))))
        T520 ==> ((Ra_1 Ra_PLUS Ra_1) in Ra) & ((Ra_1 Ra_PLUS Ra_1) Ra_GT Ra_0) & (Recip(Ra_1 Ra_PLUS Ra_1) in Ra)
        Suppose ==> Ra_1 /= (Recip(Ra_1 Ra_PLUS Ra_1) Ra_PLUS Recip(Ra_1 Ra_PLUS Ra_1))
            (Ra_1 Ra_PLUS Ra_1, Ra_0)-->T473 ==> (Ra_1 Ra_PLUS Ra_1) /= Ra_0
            (Ra_1 Ra_PLUS Ra_1)-->T462 ==> Ra_1 = ((Ra_1 Ra_PLUS Ra_1) Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1))
            T451 ==> Ra_1 in Ra
            ((Ra_1 Ra_PLUS Ra_1), Recip(Ra_1 Ra_PLUS Ra_1))-->T448 ==> ((Ra_1 Ra_PLUS Ra_1) Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1)) = (Recip(Ra_1 Ra_PLUS Ra_1) Ra_TIMES (Ra_1 Ra_PLUS Ra_1))
            (Ra_1, Recip(Ra_1 Ra_PLUS Ra_1), Ra_1)-->T458 ==> (Recip(Ra_1 Ra_PLUS Ra_1) Ra_TIMES (Ra_1 Ra_PLUS Ra_1)) =
		((Recip(Ra_1 Ra_PLUS Ra_1) Ra_TIMES Ra_1) Ra_PLUS (Recip(Ra_1 Ra_PLUS Ra_1) Ra_TIMES Ra_1))
            (Recip(Ra_1 Ra_PLUS Ra_1))-->T461 ==> (Recip(Ra_1 Ra_PLUS Ra_1) Ra_TIMES Ra_1) = Recip(Ra_1 Ra_PLUS Ra_1)
        EQUAL ==> false; Discharge ==> Ra_1 = (Recip(Ra_1 Ra_PLUS Ra_1) Ra_PLUS Recip(Ra_1 Ra_PLUS Ra_1))
        Use_def(Ra_OVER) ==> ((x Ra_OVER (Ra_1 Ra_PLUS Ra_1)) Ra_PLUS (x Ra_OVER (Ra_1 Ra_PLUS Ra_1))) = ((x Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1)) Ra_PLUS (x Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1)))
        (Recip(Ra_1 Ra_PLUS Ra_1),x,Recip(Ra_1 Ra_PLUS Ra_1))-->T458 ==> ((x Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1)) Ra_PLUS (x Ra_TIMES Recip(Ra_1 Ra_PLUS Ra_1))) =
		(x Ra_TIMES (Recip(Ra_1 Ra_PLUS Ra_1) Ra_PLUS Recip(Ra_1 Ra_PLUS Ra_1)))
        x-->T461 ==> (x Ra_TIMES Ra_1) = x
    EQUAL ==> false; Discharge ==> QED
--
-- The following theorem shows that every positive rational number exceeds the sum of two
-- smaller, positive and distinct rational numbers.
--
Theorem 522: [Every positive rational exceeds the sum of two smaller positive rationals] ((X in Ra) & (X Ra_GT Ra_0)) imp (EXISTS e in Ra, e0 in Ra | (X Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e Ra_GT Ra_0) & (X Ra_GT (e Ra_PLUS e0))). Proof:
    Suppose_not(x) ==> ((x in Ra) & (x Ra_GT Ra_0)) & Stat1: (not(EXISTS e in Ra, e0 in Ra | (x Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e Ra_GT Ra_0) & (x Ra_GT (e Ra_PLUS e0))))
--
-- For, if there could be a counterexample $x$, then we could take $e$ to be one half
-- of $x$ and $e0$ to be a half of $e$; and with these values, exploiting previously
-- proved lemmas, we would easily come to a contradiction.
--
        Loc_def ==> e = (x Ra_OVER (Ra_1 Ra_PLUS Ra_1))
        x-->T451 ==> (Ra_0 in Ra) & (x = (x Ra_PLUS Ra_0))
        (x,Ra_0)-->T519 ==> (x Ra_GT ((x Ra_PLUS Ra_0) Ra_OVER (Ra_1 Ra_PLUS Ra_1))) & (((x Ra_PLUS Ra_0) Ra_OVER (Ra_1 Ra_PLUS Ra_1)) Ra_GT Ra_0)
        x-->T520 ==> (x Ra_OVER (Ra_1 Ra_PLUS Ra_1)) in Ra
        EQUAL ==> (x Ra_GT e) & (e Ra_GT Ra_0) & (e in Ra)
        (e,e)-->T473 ==> e Ra_GE e
        (e,Ra_0)-->T473 ==> e Ra_GE Ra_0
        Loc_def ==> e0 = (e Ra_OVER (Ra_1 Ra_PLUS Ra_1))
        e-->T451 ==> e = (e Ra_PLUS Ra_0)
        (e,Ra_0)-->T519 ==> (e Ra_GT ((e Ra_PLUS Ra_0) Ra_OVER (Ra_1 Ra_PLUS Ra_1))) & (((e Ra_PLUS Ra_0) Ra_OVER (Ra_1 Ra_PLUS Ra_1)) Ra_GT Ra_0)
        e-->T520 ==> (e Ra_OVER (Ra_1 Ra_PLUS Ra_1)) in Ra
        EQUAL ==> (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e0 in Ra)
        x-->T521 ==> x = ((x Ra_OVER (Ra_1 Ra_PLUS Ra_1)) Ra_PLUS (x Ra_OVER (Ra_1 Ra_PLUS Ra_1)))
        EQUAL ==> x = (e Ra_PLUS e)
        (e,e,e,e0)-->T504 ==> (e Ra_PLUS e) Ra_GT (e Ra_PLUS e0)
        EQUAL ==> x Ra_GT (e Ra_PLUS e0)
        (e,Ra_0,e0,Ra_0)-->T504 ==> (e Ra_PLUS e0) Ra_GT (Ra_0 Ra_PLUS Ra_0)
        Ra_0-->T451 ==> Ra_0 = (Ra_0 Ra_PLUS Ra_0)
        EQUAL ==> (e Ra_PLUS e0) Ra_GT Ra_0
    (e,e0)-->Stat1 ==> false; Discharge ==> QED
--
-- As a corallary it follows that any positive rational is larger than some other positive rational.
--
Theorem 523: [Every positive rational exceeds some smaller positive rational] ((X in Ra) & (X Ra_GT Ra_0)) imp (EXISTS e in Ra | (X Ra_GT e) & (e Ra_GT Ra_0)). Proof:
	Suppose_not(x) ==> (x in Ra) & (x Ra_GT Ra_0) & Stat1: (not(EXISTS e in Ra | (x Ra_GT e) & (e Ra_GT Ra_0)))
	x-->T522 ==> Stat2: (EXISTS e in Ra, e0 in Ra | (x Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e Ra_GT Ra_0) & (x Ra_GT (e Ra_PLUS e0)))
	(e,e0)-->Stat2 ==> (e in Ra) & (e0 in Ra) & (x Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0)
	(x,e,e0)-->T511 ==> x Ra_GT e0
	e0-->Stat1 ==> false; Discharge ==> QED
--
-- It is also useful to know that the square of any rational number is non-negative.
--
Theorem 524: [the squares of rational numbers are non-negative] (X in Ra) imp ((X Ra_TIMES X) Ra_GE Ra_0). Proof:
	Suppose_not(n) ==> (n in Ra) & (not((n Ra_TIMES n) Ra_GE Ra_0))
	(n Ra_TIMES n,Ra_0)-->T473 ==> not Ra_is_nonneg((n Ra_TIMES n) Ra_PLUS Ra_Rev(Ra_0))
	T481 ==> Ra_Rev(Ra_0) = Ra_0
	EQUAL ==> not Ra_is_nonneg((n Ra_TIMES n) Ra_PLUS Ra_0)
	ALGEBRA ==> not Ra_is_nonneg(n Ra_TIMES n)
	n-->T452 ==> Ra_Rev(n) in Ra
	n-->T466 ==> Ra_is_nonneg(n) or Ra_is_nonneg(Ra_Rev(n))
	Suppose ==> Ra_is_nonneg(n)
	(n,n)-->T469 ==> false; Discharge ==> Ra_is_nonneg(Ra_Rev(n))
	(Ra_Rev(n),Ra_Rev(n))-->T469 ==> Ra_is_nonneg(Ra_Rev(n) Ra_TIMES Ra_Rev(n))
	(Ra_Rev(n),n)-->T485 ==> Ra_Rev(n) Ra_TIMES Ra_Rev(n) = Ra_Rev(Ra_Rev(n) Ra_TIMES n)
	(Ra_Rev(n),n)-->T448 ==> Ra_Rev(n) Ra_TIMES n = n Ra_TIMES Ra_Rev(n)
	(n,n)-->T485 ==> Ra_Rev(n Ra_TIMES n) = n Ra_TIMES Ra_Rev(n)
	EQUAL ==> Ra_Rev(n) Ra_TIMES Ra_Rev(n) = Ra_Rev(Ra_Rev(n Ra_TIMES n))
	ALGEBRA ==> (n Ra_TIMES n) in Ra
	(n Ra_TIMES n)-->T494 ==> Ra_Rev(Ra_Rev(n Ra_TIMES n)) = n Ra_TIMES n
	EQUAL ==> false; Discharge ==> QED
--
APPLY_otter(abs_thryvar:Ra_ABS) orderedGroups(In_domain(x)->(x in Ra), pluz(x,y)->(x Ra_PLUS y), e->Ra_0, rvz(x)->Ra_Rev(x), nneg(x)->Ra_is_nonneg(x), leq(x,y)->(x Ra_LE y)) ==>
Theorem 525: [rational numbers meet facts known about ordered groups in general] (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_PLUS y) = (x Ra_PLUS z)) imp (y = z))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_Rev(x Ra_PLUS Ra_Rev(y)) = (y Ra_PLUS Ra_Rev(x)))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) imp ((x Ra_LE y) or (y Ra_LE x))) &
	(FORALL x | (x in Ra) imp (x Ra_LE x)) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_LE y) & (y Ra_LE z)) imp (x Ra_LE z))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_LE y) & (x /= y) & (y Ra_LE z)) imp (x /= z))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_LE y) & (y Ra_LE z) & (y /= z)) imp (x /= z))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp ((x Ra_LE y) imp ((x Ra_PLUS z) Ra_LE (y Ra_PLUS z)))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_PLUS z) = (y Ra_PLUS z)) imp (x = y))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_LE y) & (x /= y)) imp ((x Ra_PLUS z) /= (y Ra_PLUS z)))) &
	(FORALL x | (x in Ra) imp (Ra_ABS(x Ra_PLUS Ra_Rev(x)) = Ra_0)) &
	(FORALL x | (x in Ra) imp (x Ra_LE Ra_ABS(x))) &
	(FORALL x | (x in Ra) imp (Ra_ABS(Ra_ABS(x)) = Ra_ABS(x))) &
	(FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0))) &
	(FORALL x | (x in Ra) imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) imp ((x Ra_PLUS y) Ra_LE (Ra_ABS(x) Ra_PLUS Ra_ABS(y)))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp ((Ra_ABS(x Ra_PLUS Ra_Rev(y)) Ra_LE z) imp (y Ra_LE (x Ra_PLUS z)))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_ABS(x Ra_PLUS y) Ra_LE (Ra_ABS(x) Ra_PLUS Ra_ABS(y)))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) imp ((not(Ra_is_nonneg(x))) imp ((x Ra_LE Ra_ABS(y)) & (x /= Ra_ABS(y))))) &
	(FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (Ra_ABS((x Ra_PLUS Ra_Rev(z))) Ra_LE (Ra_ABS(x Ra_PLUS Ra_Rev(y)) Ra_PLUS Ra_ABS(y Ra_PLUS Ra_Rev(z))))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_is_nonneg(y) imp ((x Ra_PLUS Ra_Rev(y)) Ra_LE (x Ra_PLUS y)))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_ABS(Ra_ABS(x) Ra_PLUS Ra_Rev(Ra_ABS(y))) Ra_LE Ra_ABS(x Ra_PLUS Ra_Rev(y)))) &
	(FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_ABS(x) Ra_PLUS Ra_Rev(Ra_ABS(Ra_ABS(y) Ra_PLUS Ra_Rev(Ra_ABS(x)))) Ra_LE Ra_ABS(y)))
--
--Def 45a: [Absolute value of a rational number] Ra_ABS(X) := if Ra_is_nonneg(X) then X else Ra_Rev(X) end if
--
--
Theorem 526: ((X in Ra) & (Y in Ra) & (not(X Ra_LE Y))) imp (X Ra_GT Y). Proof:
    Suppose_not(x,y) ==> AUTO
	T525 ==> Stat1: (FORALL x,y | ((x in Ra) & (y in Ra)) imp ((x Ra_LE y) or (y Ra_LE x))) &
		Stat2: 	(FORALL x | (x in Ra) imp (x Ra_LE x))
	(x,y)-->Stat1(*) ==> Stat3: y Ra_LE x
	(y,x)-->T473(Stat3,Stat3*) ==> Stat4: x Ra_GE y
	x-->Stat2(*) ==> Stat5: x Ra_LE x
	Suppose ==> x = y
	EQUAL ==> false; Discharge ==> Stat6: x /= y
	(x,x)-->T473(Stat5,Stat5*) ==> x Ra_GE x
    (x,y)-->T473(*) ==> false; Discharge ==> QED

--
-- It is useful to keep at hand the facts that the absolute value
-- of a rational number is a rational number and that the absolute
-- value of the product of two rational numbers equals the product
-- of the absolute values of the operands.
--
Theorem 527: [The absolute value of a rational $x$ is a non-negative rational no smaller than $x$] (X in Ra) imp ((Ra_ABS(X) in Ra) & (Ra_ABS(X) Ra_GE Ra_0) & (Ra_ABS(X) Ra_GE X)). Proof:
    Suppose_not(x) ==> (x in Ra) & ((Ra_ABS(x) notin Ra) or (not(Ra_ABS(x) Ra_GE Ra_0)) or (not(Ra_ABS(x) Ra_GE x)))
	T525 ==> Stat1: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
	x-->Stat1 ==> Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if
	Suppose ==> Ra_ABS(x) notin Ra
	x-->T452 ==> false; Discharge ==> (Ra_ABS(x) in Ra) & ((not(Ra_ABS(x) Ra_GE Ra_0)) or (not(Ra_ABS(x) Ra_GE x)))
	(Ra_ABS(x))-->T451 ==> (Ra_ABS(x) = Ra_ABS(x) Ra_PLUS Ra_0) & (Ra_0 in Ra)
	T481 ==> Ra_Rev(Ra_0) = Ra_0
	Suppose ==> Ra_is_nonneg(x)
		ELEM ==> Ra_ABS(x) = x
		EQUAL ==> (not(x Ra_GE Ra_0)) or (not(x Ra_GE x))
		(x,x)-->T474 ==> not(x Ra_GE Ra_0)
		(x,Ra_0)-->T473 ==> not Ra_is_nonneg(x Ra_PLUS Ra_Rev(Ra_0))
		EQUAL ==> not Ra_is_nonneg(x Ra_PLUS Ra_0)
		x-->T451 ==> x Ra_PLUS Ra_0 = x
	EQUAL ==> false; Discharge ==> (not(Ra_is_nonneg(x))) & (Ra_ABS(x) = Ra_Rev(x))
	x-->T466 ==> Ra_is_nonneg(Ra_Rev(x))
	Suppose ==> not(Ra_ABS(x) Ra_GE x)
		EQUAL ==> not(Ra_Rev(x) Ra_GE x)
		x-->T452 ==> Ra_Rev(x) in Ra
		(Ra_Rev(x),x)-->T473 ==> not Ra_is_nonneg(Ra_Rev(x) Ra_PLUS Ra_Rev(x))
	(Ra_Rev(x),Ra_Rev(x))-->T469 ==> false; Discharge ==> Ra_ABS(x) Ra_GE x
	EQUAL ==> Ra_Rev(x) Ra_GE x
	x-->T466 ==> Ra_is_nonneg(Ra_Rev(x))
	EQUAL ==> Ra_is_nonneg(Ra_ABS(x) Ra_PLUS Ra_Rev(Ra_0))
    (Ra_ABS(x), Ra_0)-->T473 ==> false; Discharge ==> QED
--
--Theorem myTempTheorem3: [just for debugging purposes] (X in Ra) imp (Ra_ABS(X) in Ra). Proof:
--	Suppose_not(x) ==> AUTO
--	x-->T432==> false; Discharge ==> QED
--
Theorem 528: [The absolute value of a non-negative rational $x$ is $x$] (X in Ra) imp ((X Ra_GE Ra_0) eq (Ra_ABS(X) = X)). Proof:
Suppose_not(x) ==> AUTO
	(x,Ra_0)-->T473 ==> (x Ra_GE Ra_0) eq Ra_is_nonneg(x Ra_PLUS Ra_Rev(Ra_0))
	x-->T451 ==> (Ra_0 in Ra) & (x = (x Ra_PLUS Ra_0))
	T481 ==> Ra_Rev(Ra_0) = Ra_0
	EQUAL ==> (x Ra_GE Ra_0) eq Ra_is_nonneg(x)
	T525 ==> Stat1: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
	Suppose ==> Ra_is_nonneg(x)
	x-->Stat1(*) ==> false; Discharge ==> (not Ra_is_nonneg(x)) & (Ra_ABS(x) = x)
	x-->Stat1(Stat1*) ==> x = Ra_Rev(x)
	EQUAL(Stat1) ==> (not Ra_is_nonneg(Ra_Rev(x)))
x-->T466(*) ==> false; Discharge ==> QED
--
Theorem 529: [The absolute value of a rational $x$ greater than $Ra_0$ is $x$] ((X in Ra) & (X Ra_GT Ra_0)) imp (Ra_ABS(X) = X). Proof:
Suppose_not(x) ==> AUTO
	(x,Ra_0)-->T473 ==> x Ra_GE Ra_0
x-->T528 ==> false; Discharge ==> QED
--
Theorem 530: [The absolute value of a rational product is the product of the absolute values] ((X in Ra) & (Y in Ra)) imp (Ra_ABS(X Ra_TIMES Y) = (Ra_ABS(X) Ra_TIMES Ra_ABS(Y))). Proof:
    Suppose_not(x,y) ==> (x in Ra) & (y in Ra) & (Ra_ABS(x Ra_TIMES y) /= (Ra_ABS(x) Ra_TIMES Ra_ABS(y)))
--
-- For, assuming $x,y$ to be a counterexample to the desired statement,
-- we will reach a contradiction in each one of the possible cases, which are:
-- $x=Ra_0$ or $y=Ra_0$; $x$ and $y$ both positive; one of $x,y$ positive, the other
-- one negative; both of $x$ and $y$ negative.
--
-- We begin by collecting various elementary algebraic
-- consequences of our hypothesis.
--
        ALGEBRA ==> ((x Ra_TIMES y) in Ra) & (Ra_0 in Ra)
        x-->T452 ==> Ra_Rev(x) in Ra
        y-->T452 ==> Ra_Rev(y) in Ra
        x-->T527 ==> Ra_ABS(x) in Ra
        y-->T527 ==> Ra_ABS(y) in Ra
        (x,y)-->T448 ==> (x Ra_TIMES y) = (y Ra_TIMES x)
        x-->T451 ==> x = x Ra_PLUS Ra_0
        y-->T451 ==> y = y Ra_PLUS Ra_0
        (Ra_Rev(x))-->T451 ==> Ra_Rev(x) = Ra_Rev(x) Ra_PLUS Ra_0
        (Ra_Rev(y))-->T451 ==> Ra_Rev(y) = Ra_Rev(y) Ra_PLUS Ra_0
        T481 ==> Ra_Rev(Ra_0) = Ra_0
        (x Ra_TIMES y)-->T452 ==> Ra_Rev(x Ra_TIMES y) in Ra
        (Ra_Rev(x Ra_TIMES y))-->T451 ==> Ra_Rev(x Ra_TIMES y) Ra_PLUS Ra_0 = Ra_Rev(x Ra_TIMES y)
        (Ra_Rev(x Ra_TIMES y),Ra_0)-->T445 ==> Stat1: Ra_0 Ra_PLUS Ra_Rev(x Ra_TIMES y) = Ra_Rev(x Ra_TIMES y)
        (x,y)-->T485 ==> (x Ra_TIMES Ra_Rev(y)) = Ra_Rev(x Ra_TIMES y)
        (y,x)-->T485 ==> (y Ra_TIMES Ra_Rev(x)) = Ra_Rev(y Ra_TIMES x)
        (y,Ra_Rev(x))-->T448 ==> (y Ra_TIMES Ra_Rev(x)) = (Ra_Rev(x) Ra_TIMES y)
        T525 ==> Stat2: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &
		   Stat3: (FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0))) &
		   Stat4: (FORALL x | (x in Ra) imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
--
-- The case when either $x$ or $y$ is zero readily leads to a contradiction,
-- because one of $Ra_ABS(x),Ra_ABS(y)$ is zero in this case, and hence
-- the product of $x,y$, its absolute value, and the product of
-- $Ra_ABS(x),Ra_ABS(y)$ coincide.
--
        Suppose ==> (x = Ra_0) or (y = Ra_0)
            x-->T489 ==> (x Ra_TIMES Ra_0) = Ra_0
            y-->T489 ==> (y Ra_TIMES Ra_0) = Ra_0
            Suppose ==> ((x Ra_TIMES y) /= Ra_0) or ((Ra_ABS(x) Ra_TIMES Ra_ABS(y)) /= Ra_0)
                Suppose ==> x = Ra_0
                    x-->Stat3 ==> Ra_ABS(x) = Ra_0
                    (Ra_ABS(y))-->T489 ==> (Ra_ABS(y) Ra_TIMES Ra_0) = Ra_0
                    (Ra_ABS(y),Ra_0)-->T448 ==> (Ra_ABS(y) Ra_TIMES Ra_0) = (Ra_0 Ra_TIMES Ra_ABS(y))
                EQUAL ==> false; Discharge ==> y = Ra_0
                y-->Stat3 ==> Ra_ABS(y) = Ra_0
                (Ra_ABS(x))-->T489 ==> (Ra_ABS(x) Ra_TIMES Ra_0) = Ra_0
            EQUAL ==> false; Discharge ==> ((x Ra_TIMES y) = Ra_0) & ((Ra_ABS(x) Ra_TIMES Ra_ABS(y)) = Ra_0)
        (x Ra_TIMES y)-->Stat3 ==> false; Discharge ==> (x /= Ra_0) & (y /= Ra_0)
--
-- The case when $x$ and $y$ are positive is settled with equal ease, because
-- in this case the absolute value of $x Ra_TIMES y$, coinciding with
-- $x Ra_TIMES y$, equals the product of $x$ and $y$, which
-- in their turn are the absolute values of $x$ and $y$.
--
        Suppose ==> (Ra_0 Ra_LT x) & (Ra_0 Ra_LT y)
            (Ra_0,x)-->T473 ==> x Ra_GT Ra_0
            (x,Ra_0)-->T473 ==> Ra_is_nonneg(x Ra_PLUS Ra_Rev(Ra_0))
            EQUAL ==> Ra_is_nonneg(x)
--
            (Ra_0,y)-->T473 ==> y Ra_GT Ra_0
            (y,Ra_0)-->T473 ==> Ra_is_nonneg(y Ra_PLUS Ra_Rev(Ra_0))
            EQUAL ==> Ra_is_nonneg(y)
--
            (x,y)-->T469 ==> Ra_is_nonneg(x Ra_TIMES y)
            x-->Stat2 ==> Ra_ABS(x) = x
            y-->Stat2 ==> Ra_ABS(y) = y
            (x Ra_TIMES y)-->Stat2 ==> Ra_ABS(x Ra_TIMES y) = (x Ra_TIMES y)
        EQUAL ==> false; Discharge ==> not((Ra_0 Ra_LT x) & (Ra_0 Ra_LT y))
--
-- The case when $x$ is positive and $y$ is negative is but slightly
-- more complicated. The product of $x$ and $y$ is negative, and hence
-- the absolute value of this product is the reverse of it. This equals
-- the product of $x$ with the reverse of $y$, which turns out to be
-- the product of the absolute values of $x$ and $y$.
--
        Suppose ==> (Ra_0 Ra_LT x) & (y Ra_LT Ra_0)
            (Ra_0,x)-->T473 ==> x Ra_GT Ra_0
            (x,Ra_0)-->T473 ==> Ra_is_nonneg(x Ra_PLUS Ra_Rev(Ra_0))
            EQUAL ==> Ra_is_nonneg(x)
            x-->Stat2 ==> Ra_ABS(x) = x
--
            (y,Ra_0)-->T473 ==> Ra_0 Ra_GT y
            (Ra_0,y)-->T473 ==> Ra_is_nonneg(Ra_0 Ra_PLUS Ra_Rev(y))
            (Ra_0,Ra_Rev(y))-->T445 ==> Ra_0 Ra_PLUS Ra_Rev(y) = Ra_Rev(y)
            EQUAL ==> Ra_is_nonneg(Ra_Rev(y))
            y-->Stat4 ==> Ra_ABS(Ra_Rev(y)) = Ra_ABS(y)
            (Ra_Rev(y))-->Stat2 ==> Ra_ABS(y) = Ra_Rev(y)
--
            EQUAL ==> Ra_Rev(x Ra_TIMES y) = Ra_ABS(x) Ra_TIMES Ra_ABS(y)
--
            Suppose ==> Ra_is_nonneg(x Ra_TIMES y)
--
-- Under this assumption, since $y Ra_LT Ra_0$ yields $Ra_Rev(y) Ra_GT Ra_0$
-- and moreover $x$ is positive, the product $x Ra_TIMES Ra_Rev(y)$ would turn
-- out to be positive too; and consequently $Ra_Rev(x Ra_TIMES Ra_Rev(y))$,
-- which equals $x Ra_TIMES y$, would be negative.
--
                (y,Ra_0)-->T473 ==> Ra_0 Ra_GT y
                (Ra_0,y)-->T503 ==> Ra_Rev(y) Ra_GT Ra_Rev(Ra_0)
                EQUAL ==> Ra_Rev(y) Ra_GT Ra_0
                (x,Ra_0,Ra_Rev(y))-->T488 ==> (x Ra_TIMES Ra_Rev(y)) Ra_GT (Ra_0 Ra_TIMES Ra_Rev(y))
                ALGEBRA ==> ((x Ra_TIMES Ra_Rev(y)) in Ra) & ((Ra_0 Ra_TIMES Ra_Rev(y)) in Ra)
                (x Ra_TIMES Ra_Rev(y),Ra_0 Ra_TIMES Ra_Rev(y))-->T503 ==> Ra_Rev(Ra_0 Ra_TIMES Ra_Rev(y)) Ra_GT Ra_Rev(x Ra_TIMES Ra_Rev(y))
                (Ra_Rev(y))-->T489 ==> (Ra_Rev(y) Ra_TIMES Ra_0) = Ra_0
                (Ra_Rev(y),Ra_0)-->T448 ==> (Ra_Rev(y) Ra_TIMES Ra_0) = (Ra_0 Ra_TIMES Ra_Rev(y))
                (x Ra_TIMES y)-->T494 ==> Ra_Rev(Ra_Rev(x Ra_TIMES y)) = x Ra_TIMES y
                EQUAL ==> (x Ra_TIMES Ra_Rev(y)) Ra_GT Ra_0
                (x Ra_TIMES Ra_Rev(y),Ra_0)-->T503 ==> Ra_Rev(Ra_0) Ra_GT Ra_Rev(x Ra_TIMES Ra_Rev(y))
                (x,y)-->T485 ==> x Ra_TIMES Ra_Rev(y) = Ra_Rev(x Ra_TIMES y)
                EQUAL ==> Ra_0 Ra_GT (x Ra_TIMES y)
                (Ra_0,x Ra_TIMES y)-->T473 ==> Stat5: Ra_is_nonneg(Ra_0 Ra_PLUS Ra_Rev(x Ra_TIMES y))
                EQUAL(Stat1,Stat5) ==>  Ra_is_nonneg(Ra_Rev(x Ra_TIMES y))
                (x Ra_TIMES y)-->T466 ==> x Ra_TIMES y = Ra_0
            (Ra_0,x Ra_TIMES y)-->T473 ==> false; Discharge ==> not Ra_is_nonneg(x Ra_TIMES y)
            (x Ra_TIMES y)-->Stat2 ==> Ra_ABS(x Ra_TIMES y) = Ra_Rev(x Ra_TIMES y)
        EQUAL ==> false; Discharge ==> (not((Ra_0 Ra_LT x) & (y Ra_LT Ra_0)))
--
-- The case when $y$ is positive and $x$ is negative is
-- entirely analogous to the one just discussed.
--
        Suppose ==> (x Ra_LT Ra_0) & (Ra_0 Ra_LT y)
            (Ra_0,y)-->T473 ==> y Ra_GT Ra_0
            (y,Ra_0)-->T473 ==> Ra_is_nonneg(y Ra_PLUS Ra_Rev(Ra_0))
            EQUAL ==> Ra_is_nonneg(y)
            y-->Stat2 ==> Ra_ABS(y) = y
--
            (x,Ra_0)-->T473 ==> Ra_0 Ra_GT x
            (Ra_0,x)-->T473 ==> Ra_is_nonneg(Ra_0 Ra_PLUS Ra_Rev(x))
            (Ra_0,Ra_Rev(x))-->T445 ==> Ra_0 Ra_PLUS Ra_Rev(x) = Ra_Rev(x)
            EQUAL ==> Ra_is_nonneg(Ra_Rev(x))
            x-->Stat4 ==> Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)
            (Ra_Rev(x))-->Stat2 ==> Ra_ABS(x) = Ra_Rev(x)
--
            EQUAL ==> Ra_Rev(x Ra_TIMES y) = Ra_ABS(x) Ra_TIMES Ra_ABS(y)
--
            Suppose ==> Ra_is_nonneg(x Ra_TIMES y)
--
-- Under this assumption, since $x Ra_LT Ra_0$ yields $Ra_Rev(x) Ra_GT Ra_0$
-- and moreover $y$ is positive, the product $Ra_Rev(x) Ra_TIMES y$ would turn
-- out to be positive too; and consequently $Ra_Rev(Ra_Rev(x) Ra_TIMES y)$,
-- which equals $x Ra_TIMES y$, would be negative.
--
                (x,Ra_0)-->T473 ==> Ra_0 Ra_GT x
                (Ra_0,x)-->T503 ==> Ra_Rev(x) Ra_GT Ra_Rev(Ra_0)
                EQUAL ==> Ra_Rev(x) Ra_GT Ra_0
                (Ra_Rev(x),Ra_0,y)-->T488 ==> (Ra_Rev(x) Ra_TIMES y) Ra_GT (Ra_0 Ra_TIMES y)
                ALGEBRA ==> ((Ra_Rev(x) Ra_TIMES y) in Ra) & ((Ra_0 Ra_TIMES y) in Ra)
                (Ra_Rev(x) Ra_TIMES y,Ra_0 Ra_TIMES y)-->T503 ==> Ra_Rev(Ra_0 Ra_TIMES y) Ra_GT Ra_Rev(Ra_Rev(x) Ra_TIMES y)
                y-->T489 ==> (y Ra_TIMES Ra_0) = Ra_0
                (y,Ra_0)-->T448 ==> (y Ra_TIMES Ra_0) = (Ra_0 Ra_TIMES y)
                (x Ra_TIMES y)-->T494 ==> Ra_Rev(Ra_Rev(x Ra_TIMES y)) = x Ra_TIMES y
                EQUAL ==> (Ra_Rev(x) Ra_TIMES y) Ra_GT Ra_0
                (Ra_Rev(x) Ra_TIMES y,Ra_0)-->T503 ==> Ra_Rev(Ra_0) Ra_GT Ra_Rev(Ra_Rev(x) Ra_TIMES y)
                (y,x)-->T485 ==> y Ra_TIMES Ra_Rev(x) = Ra_Rev(y Ra_TIMES x)
                (Ra_Rev(x),y)-->T448 ==> Ra_Rev(x) Ra_TIMES y = y Ra_TIMES Ra_Rev(x)
                EQUAL ==> Ra_0 Ra_GT (x Ra_TIMES y)
                (Ra_0,x Ra_TIMES y)-->T473 ==> Stat6: Ra_is_nonneg(Ra_0 Ra_PLUS Ra_Rev(x Ra_TIMES y))
                EQUAL(Stat1,Stat6) ==>  Ra_is_nonneg(Ra_Rev(x Ra_TIMES y))
                (x Ra_TIMES y)-->T466 ==> x Ra_TIMES y = Ra_0
            (Ra_0,x Ra_TIMES y)-->T473 ==> false; Discharge ==> not Ra_is_nonneg(x Ra_TIMES y)
            (x Ra_TIMES y)-->Stat2 ==> Ra_ABS(x Ra_TIMES y) = Ra_Rev(x Ra_TIMES y)
        EQUAL ==> false; Discharge ==> (not((x Ra_LT Ra_0) & (Ra_0 Ra_LT y)))
--
-- The only remaining case is the one in which $x,y$ are negative.
-- In this case the absolute value of $x Ra_TIMES y$ coincides with
-- $x Ra_TIMES y$ and equals the product of the reverses of $x$ and $y$, which
-- in their turn are the absolute values of $x$ and $y$.
--
        T514 ==> Stat7: (FORALL x in Ra, y in Ra | (x Ra_LT y) or (x = y) or (y Ra_LT x))
        (x,Ra_0)-->Stat7 ==> (x = Ra_0) or (x Ra_LT Ra_0) or (Ra_0 Ra_LT x)
        (y,Ra_0)-->Stat7 ==> (y = Ra_0) or (y Ra_LT Ra_0) or (Ra_0 Ra_LT y)
        ELEM ==> (x Ra_LT Ra_0) & (y Ra_LT Ra_0)
--
        (x,Ra_0)-->T473 ==> Ra_0 Ra_GT x
        (Ra_0,x)-->T473 ==> Ra_is_nonneg(Ra_0 Ra_PLUS Ra_Rev(x))
        (Ra_0,Ra_Rev(x))-->T445 ==> Ra_0 Ra_PLUS Ra_Rev(x) = Ra_Rev(x)
        EQUAL ==> Ra_is_nonneg(Ra_Rev(x))
        x-->Stat4 ==> Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)
        (Ra_Rev(x))-->Stat2 ==> Ra_ABS(x) = Ra_Rev(x)
--
        (y,Ra_0)-->T473 ==> Ra_0 Ra_GT y
        (Ra_0,y)-->T473 ==> Ra_is_nonneg(Ra_0 Ra_PLUS Ra_Rev(y))
        (Ra_0,Ra_Rev(y))-->T445 ==> Ra_0 Ra_PLUS Ra_Rev(y) = Ra_Rev(y)
        EQUAL ==> Ra_is_nonneg(Ra_Rev(y))
        y-->Stat4 ==> Ra_ABS(Ra_Rev(y)) = Ra_ABS(y)
        (Ra_Rev(y))-->Stat2 ==> Ra_ABS(y) = Ra_Rev(y)
--
        (Ra_Rev(x),y)-->T485 ==> Ra_Rev(x) Ra_TIMES Ra_Rev(y) = Ra_Rev(Ra_Rev(x) Ra_TIMES y)
        (Ra_Rev(x),y)-->T448 ==> (Ra_Rev(x) Ra_TIMES y) = (y Ra_TIMES Ra_Rev(x))
        (y,x)-->T485 ==> (y Ra_TIMES Ra_Rev(x)) = Ra_Rev(y Ra_TIMES x)
        (x Ra_TIMES y)-->T494 ==> Ra_Rev(Ra_Rev(x Ra_TIMES y)) = x Ra_TIMES y
--
-- This yields the conclusion
--	$x Ra_TIMES y = Ra_ABS(x) Ra_TIMES Ra_ABS(y)$,
-- leading to a contradiction. Since all possible cases have
-- been analyzed and then discarded, this terminates our proof.
--
    EQUAL ==> false; Discharge ==> QED
--
-- Our next theorem shows that the only divisor of zero, over the rationals, is zero.
--
Theorem 531: [If the product of two rationals is 0, one of them is 0] ((X in Ra) & (Y in Ra)) imp (((X Ra_TIMES Y) = Ra_0) eq ((X = Ra_0) or (Y = Ra_0))). Proof:
    Suppose_not(x,y) ==> Stat1: (x in Ra) & (y in Ra) & (((x Ra_TIMES y) /= Ra_0) eq ((x = Ra_0) or (y = Ra_0)))
        ALGEBRA ==> Stat2: ((x Ra_TIMES Ra_0) in Ra) & ((x Ra_TIMES Ra_0) = Ra_0) & ((Ra_0 Ra_TIMES y) = Ra_0)
        Suppose ==> (x = Ra_0)
            EQUAL ==> (x Ra_TIMES y) = Ra_0
        Discharge ==> (x /= Ra_0)
        Suppose ==> (y = Ra_0)
            EQUAL ==> (x Ra_TIMES y) = Ra_0
        Discharge ==> Stat3: (y /= Ra_0) &  ((x Ra_TIMES y) = Ra_0)
        T525 ==> Stat4:	(FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0)))
        x-->T527(Stat1,Stat1) ==> (Ra_ABS(x) in Ra) & (Ra_ABS(x) Ra_GE Ra_0)
        y-->T527 ==> (Ra_ABS(y) in Ra) & (Ra_ABS(y) Ra_GE Ra_0)
        x-->Stat4 ==> Ra_ABS(x) /= Ra_0
        y-->Stat4 ==> Ra_ABS(y) /= Ra_0
        (Ra_ABS(x),Ra_0)-->T473 ==> (Ra_ABS(x) Ra_GT Ra_0)
        (Ra_ABS(y),Ra_0)-->T473 ==> (Ra_ABS(y) Ra_GT Ra_0)
        (Ra_ABS(x),Ra_0,Ra_ABS(y))-->T488 ==> (Ra_ABS(x) Ra_TIMES Ra_ABS(y)) Ra_GT (Ra_0 Ra_TIMES Ra_ABS(y))
        ALGEBRA ==> ((Ra_ABS(x) Ra_TIMES Ra_ABS(y)) in Ra) & ((Ra_0 Ra_TIMES Ra_ABS(y)) = Ra_0)
        EQUAL ==> (Ra_ABS(x) Ra_TIMES Ra_ABS(y)) Ra_GT Ra_0
        (x Ra_TIMES y)-->Stat4(Stat3,Stat2) ==> Stat5: Ra_ABS(x Ra_TIMES y) = Ra_0
        (x,y)-->T530(Stat1,Stat5) ==> (Ra_ABS(x) Ra_TIMES Ra_ABS(y)) = Ra_0
    (Ra_ABS(x) Ra_TIMES Ra_ABS(y),Ra_0)-->T473 ==> false; Discharge ==> QED
--
-- The following theorem shows that the products $X Ra_TIMES Y$,  $X Ra_TIMES Za$
-- are equal only if either $X=Ra_0$ or $Y=Za$.
--
Theorem 532: [Cancellation rule for rational multiplication] ((X in Ra) & (Y in Ra) & (U in Ra) & (X /= Ra_0) & ((X Ra_TIMES Y) = (X Ra_TIMES U))) imp (Y = U). Proof:
    Suppose_not(x,y,z) ==> (x in Ra) & (y in Ra) & (z in Ra) & (x /= Ra_0) & ((x Ra_TIMES y) = (x Ra_TIMES z)) & (y /= z)
        x-->T462 ==> (Recip(x) in Ra) & ((x Ra_TIMES Recip(x)) = Ra_1)
        T451 ==> Ra_1 in Ra
        y-->T461 ==> ((y Ra_TIMES Ra_1) = y)
        z-->T461 ==> ((z Ra_TIMES Ra_1) = z)
        (y, Ra_1)-->T448 ==> ((y Ra_TIMES Ra_1) = (Ra_1 Ra_TIMES y))
        (z, Ra_1)-->T448 ==> ((z Ra_TIMES Ra_1) = (Ra_1 Ra_TIMES z))
        (x,Recip(x))-->T448 ==> ((x Ra_TIMES Recip(x)) = (Recip(x) Ra_TIMES x))
        (y,Recip(x),x)-->T456 ==> ((Recip(x) Ra_TIMES (x Ra_TIMES y)) = ((Recip(x) Ra_TIMES x) Ra_TIMES y))
        (z,Recip(x),x)-->T456 ==> ((Recip(x) Ra_TIMES (x Ra_TIMES z)) = ((Recip(x) Ra_TIMES x) Ra_TIMES z))
    EQUAL ==> false; Discharge ==> QED
--
-- Next we show that over rational numbers the reciprocal of a product equals the product of reciprocals.
--
Theorem 533: [The reciprocal of a rational product is the product of the reciprocals] ((X in Ra) & (Y in Ra) & (X /= Ra_0) & (Y /= Ra_0)) imp (Recip(X Ra_TIMES Y) = (Recip(X) Ra_TIMES Recip(Y))). Proof:
    Suppose_not(x,y) ==> (x in Ra) & (y in Ra) & (x /= Ra_0) & (y /= Ra_0) & (Recip(x Ra_TIMES y) /= (Recip(x) Ra_TIMES Recip(y)))
        ALGEBRA ==> ((x Ra_TIMES y) in Ra) & (Ra_1 in Ra)
        x-->T462 ==> (Recip(x) in Ra) & ((x Ra_TIMES Recip(x)) = Ra_1)
        y-->T462 ==> (Recip(y) in Ra) & ((y Ra_TIMES Recip(y)) = Ra_1)
        (x,y)-->T531 ==> (X Ra_TIMES Y) /= Ra_0
        (x Ra_TIMES y)-->T462 ==> (Recip(x Ra_TIMES y) in Ra) & (((x Ra_TIMES y) Ra_TIMES Recip(x Ra_TIMES y)) = Ra_1)
        ALGEBRA ==> (Recip(x) Ra_TIMES Recip(y)) in Ra
--
-- We first prove that if both sides of the identity we are aiming at are multiplied by $(x Ra_TIMES y)$,
-- then we get an identity.
--
        ALGEBRA ==> (((x Ra_TIMES y) Ra_TIMES (Recip(x) Ra_TIMES Recip(y))) = ((x Ra_TIMES Recip(x)) Ra_TIMES (y Ra_TIMES Recip(y)))) & (Ra_1 Ra_TIMES Ra_1 = Ra_1) & ((Recip(x Ra_TIMES y) Ra_TIMES Ra_1) = Recip(x Ra_TIMES y))
--
-- Both sides of this first intermediate identity can now be multiplied by $Recip(x Ra_TIMES y)$.
-- This leads to a second intermediate identity.
--
        EQUAL ==> Recip(x Ra_TIMES y) Ra_TIMES ((x Ra_TIMES y) Ra_TIMES (Recip(x) Ra_TIMES Recip(y))) = Recip(x Ra_TIMES y)
        ALGEBRA ==> (Recip(x Ra_TIMES y) Ra_TIMES ((x Ra_TIMES y) Ra_TIMES (Recip(x) Ra_TIMES Recip(y))) = (Recip(x Ra_TIMES y) Ra_TIMES (x Ra_TIMES y)) Ra_TIMES (Recip(x) Ra_TIMES Recip(y))) & ((Recip(x Ra_TIMES y) Ra_TIMES (x Ra_TIMES y)) = ((x Ra_TIMES y) Ra_TIMES Recip(x Ra_TIMES y))) & ((Ra_1 Ra_TIMES (Recip(x) Ra_TIMES Recip(y))) = (Recip(x) Ra_TIMES Recip(y)))
--
-- The left-hand side of the second intermediate identity is readily proved to equal
-- the left-hand side of the desired identity. The other side was already syntactically
-- identical to the right-hand side of the desired equality. This leads to the desired conclusion.
--
        EQUAL ==> (Recip(x) Ra_TIMES Recip(y)) = Recip(x Ra_TIMES y)
    Discharge ==> QED
--
Theorem 534: [Formula for the sum of two rational quotients] ((X in Ra) & (Y in Ra) & (U in Ra) & (V in Ra) & (X /= Ra_0) & (Y /= Ra_0)) imp (((U Ra_OVER X) Ra_PLUS (V Ra_OVER Y)) = (((Y Ra_TIMES U) Ra_PLUS (X Ra_TIMES V)) Ra_OVER (X Ra_TIMES Y))). Proof:
    Suppose_not(x,y,u,v) ==> ((x in Ra) & (y in Ra) & (u in Ra) & (v in Ra) & (x /= Ra_0) & (y /= Ra_0)) & (((u Ra_OVER x) Ra_PLUS (v Ra_OVER y)) /= (((y Ra_TIMES u) Ra_PLUS (x Ra_TIMES v)) Ra_OVER (x Ra_TIMES y)))
--
-- For, if not, then we could find rational numbers $x,y,u,v$ constituting a counterexample.
-- Putting $u_o_x = (u Ra_OVER x)$ and $v_o_y = (v Ra_OVER y)$ for brevity, we have
--		$(x Ra_TIMES y) Ra_TIMES (u_o_x Ra_PLUS v_o_y) = ((x Ra_TIMES y) Ra_TIMES u_o_x) Ra_PLUS ((x Ra_TIMES y) Ra_TIMES v_o_y)$
-- by distributivity.
--
        x-->T462 ==> (Recip(x) in Ra) & ((x Ra_TIMES Recip(x)) = Ra_1)
        y-->T462 ==> (Recip(y) in Ra) & ((y Ra_TIMES Recip(y)) = Ra_1)
        ALGEBRA ==> ((u Ra_TIMES Recip(x)) in Ra) &  ((x Ra_TIMES y) in Ra) & ((x Ra_TIMES v) in Ra) & ((y Ra_TIMES u) in Ra) & ((((y Ra_TIMES u) Ra_PLUS (x Ra_TIMES v))) in Ra)
        (v,Recip(y))-->T448 ==> (v Ra_TIMES Recip(y)) in Ra
        Use_def(Ra_OVER) ==> (u Ra_OVER x = u Ra_TIMES Recip(x)) & (v Ra_OVER y = v Ra_TIMES Recip(y))
        Loc_def ==> u_o_x = u Ra_OVER x
        Loc_def ==> v_o_y = v Ra_OVER y
        EQUAL ==> (u_o_x in Ra) & (v_o_y in Ra)
        ALGEBRA ==> (((x Ra_TIMES y) Ra_TIMES (u_o_x Ra_PLUS v_o_y)) = ((x Ra_TIMES y) Ra_TIMES u_o_x) Ra_PLUS ((x Ra_TIMES y) Ra_TIMES v_o_y))
--
-- It follows that
--		$Recip(x Ra_TIMES y) Ra_TIMES ((x Ra_TIMES y) Ra_TIMES (u_o_v Ra_PLUS v_o_y)) = Recip(x Ra_TIMES y) Ra_TIMES ((x Ra_TIMES y) Ra_TIMES u_o_x) Ra_PLUS ((x Ra_TIMES y) Ra_TIMES v_o_y)$,
-- where the left-hand side simplifies into $((x Ra_TIMES y) Ra_TIMES (u_o_v Ra_PLUS v_o_y))$ and the right-hand side into
--		$Recip(x Ra_TIMES y) Ra_TIMES ((y Ra_TIMES u) Ra_PLUS (x Ra_TIMES v))$.
--
        (x,y)-->T531 ==> (x Ra_TIMES y) /= Ra_0
        (x Ra_TIMES y)-->T462 ==> (Recip(x Ra_TIMES y) in Ra) & (((x Ra_TIMES y) Ra_TIMES Recip(x Ra_TIMES y)) = Ra_1)
        ALGEBRA ==> ((Recip(x Ra_TIMES y) Ra_TIMES (x Ra_TIMES y)) in Ra) & ((Recip(x Ra_TIMES y) Ra_TIMES (x Ra_TIMES y)) = Ra_1)  & ((u_o_x Ra_PLUS v_o_y) in Ra)
        ALGEBRA ==> ((Recip(x Ra_TIMES y) Ra_TIMES ((x Ra_TIMES y) Ra_TIMES (u_o_x Ra_PLUS v_o_y))) = ((Recip(x Ra_TIMES y) Ra_TIMES (x Ra_TIMES y)) Ra_TIMES (u_o_x Ra_PLUS v_o_y))) & ((Ra_1 Ra_TIMES (u_o_x Ra_PLUS v_o_y)) = (u_o_x Ra_PLUS v_o_y))
        EQUAL ==> (Recip(x Ra_TIMES y) Ra_TIMES ((x Ra_TIMES y) Ra_TIMES (u_o_x Ra_PLUS v_o_y))) = (u_o_x Ra_PLUS v_o_y)
        ALGEBRA ==> (((x Ra_TIMES y) Ra_TIMES (u Ra_TIMES Recip(x))) = ((x Ra_TIMES Recip(x)) Ra_TIMES (y Ra_TIMES u))) & (((x Ra_TIMES y) Ra_TIMES (v Ra_TIMES Recip(y))) = ((y Ra_TIMES Recip(y)) Ra_TIMES (x Ra_TIMES v))) & ((Ra_1 Ra_TIMES (y Ra_TIMES u)) = (y Ra_TIMES u)) & ((Ra_1 Ra_TIMES (x Ra_TIMES v)) = (x Ra_TIMES v))
--        EQUAL ==> (((x Ra_TIMES y) Ra_TIMES (u Ra_TIMES Recip(x))) Ra_PLUS ((x Ra_TIMES y) Ra_TIMES (v Ra_TIMES Recip(y)))) = ((y Ra_TIMES u) Ra_PLUS (x Ra_TIMES v))
--        EQUAL ==> (((x Ra_TIMES y) Ra_TIMES u_o_x) Ra_PLUS ((x Ra_TIMES y) Ra_TIMES v_o_y)) = ((y Ra_TIMES u) Ra_PLUS (x Ra_TIMES v))
        EQUAL ==> (u_o_x Ra_PLUS v_o_y) = (Recip(x Ra_TIMES y) Ra_TIMES ((y Ra_TIMES u) Ra_PLUS (x Ra_TIMES v)))
        ALGEBRA ==> (Recip(x Ra_TIMES y) Ra_TIMES ((y Ra_TIMES u) Ra_PLUS (x Ra_TIMES v))) = (((y Ra_TIMES u) Ra_PLUS (x Ra_TIMES v)) Ra_TIMES Recip(x Ra_TIMES y))
--
-- In view of the definition of the rational-reciprocal operation, this leads to a contradiction,
-- proving our theorem.
--
        Use_def(Ra_OVER) ==> (u_o_x Ra_PLUS v_o_y) = (((y Ra_TIMES u) Ra_PLUS (x Ra_TIMES v)) Ra_OVER (x Ra_TIMES y))
    EQUAL ==> false; Discharge ==> QED
--
-- Here is an obvious corollary of the preceding theorem: the difference of reciprocals of two rational numbers
-- equals the difference of the operands divided by their product.
--
Theorem 535: ((X in Ra) & (Y in Ra) & (X /= Ra_0) & (Y /= Ra_0)) imp ((Recip(X) Ra_MINUS Recip(Y)) = ((Y Ra_MINUS X) Ra_OVER (X Ra_TIMES Y))). Proof:
    Suppose_not(x,y) ==> (x in Ra) & (y in Ra) & (x /= Ra_0) & (y /= Ra_0) & ((Recip(x) Ra_MINUS Recip(y)) /= ((y Ra_MINUS x) Ra_OVER (x Ra_TIMES y)))
        Use_def(Ra_MINUS) ==> ((Recip(x) Ra_MINUS Recip(y)) = (Recip(x) Ra_PLUS Ra_Rev(Recip(y)))) & ((y Ra_MINUS x) = (y Ra_PLUS Ra_Rev(x)))
        x-->T462 ==> (Recip(x) in Ra)
        Suppose ==> (Ra_1 Ra_OVER x) /= Recip(x)
            Use_def(Ra_OVER) ==> (Ra_1 Ra_TIMES Recip(x)) /= Recip(x)
        ALGEBRA ==> false; Discharge ==> (Ra_1 Ra_OVER x) = Recip(x)
        y-->T462 ==> (Recip(y) in Ra)
        Suppose ==> (Ra_1 Ra_OVER y) /= Recip(y)
            Use_def(Ra_OVER) ==> (Ra_1 Ra_TIMES Recip(y)) /= Recip(y)
        ALGEBRA ==> false; Discharge ==> (Ra_1 Ra_OVER y) = Recip(y)
        ALGEBRA ==> (Ra_1 in Ra) & ((y Ra_TIMES Ra_1) = y) & ((x Ra_TIMES Ra_1) = x) &  (Recip(y) = (Recip(y) Ra_TIMES Ra_1))
        Ra_1-->T452 ==> (Ra_Rev(Ra_1) in Ra)
        (Ra_Rev(Ra_1),Recip(y))-->T448 ==> ((Ra_Rev(Ra_1) Ra_TIMES Recip(y)) in Ra) & ((Recip(y) Ra_TIMES Ra_Rev(Ra_1)) = (Ra_Rev(Ra_1) Ra_TIMES Recip(y)))
        Ra_1-->T494 ==> (Ra_Rev(Ra_Rev(Ra_1)) = Ra_1)
        EQUAL ==> (Recip(y) = (Recip(y) Ra_TIMES Ra_Rev(Ra_Rev(Ra_1))))
        (Recip(y),Ra_Rev(Ra_1))-->T485 ==> Recip(y) = Ra_Rev(Recip(y) Ra_TIMES Ra_Rev(Ra_1))
        EQUAL ==> Ra_Rev(Recip(y)) = Ra_Rev(Ra_Rev(Ra_Rev(Ra_1) Ra_TIMES Recip(y)))
        (Ra_Rev(Ra_1) Ra_TIMES Recip(y))-->T494 ==> Ra_Rev(Recip(y)) = (Ra_Rev(Ra_1) Ra_TIMES Recip(y))
        Use_def(Ra_OVER) ==> Ra_Rev(Recip(y)) = (Ra_Rev(Ra_1) Ra_OVER y)
        EQUAL ==> (Recip(x) Ra_MINUS Recip(y)) = ((Ra_1 Ra_OVER x) Ra_PLUS (Ra_Rev(Ra_1) Ra_OVER y))
        (x,y,Ra_1,Ra_Rev(Ra_1))-->T534 ==> (Recip(x) Ra_MINUS Recip(y)) = (((y Ra_TIMES Ra_1) Ra_PLUS (x Ra_TIMES Ra_Rev(Ra_1))) Ra_OVER (x Ra_TIMES y))
        (x,Ra_1)-->T485 ==> (x Ra_TIMES Ra_Rev(Ra_1)) = Ra_Rev(x Ra_TIMES Ra_1)
        EQUAL ==> (Recip(x) Ra_MINUS Recip(y)) = ((y Ra_PLUS Ra_Rev(x)) Ra_OVER (x Ra_TIMES y))
    EQUAL ==> false; Discharge ==> QED
--
-- Let us also show that the absolute value of the reciprocal equals the reciprocal of the absolute value.
--
Theorem 536: [The absolute value of the reciprocal equals the reciprocal of the absolute value] ((X in Ra) & (X /= Ra_0)) imp (Ra_ABS(Recip(X)) = Recip(Ra_ABS(X))). Proof:
    Suppose_not(x) ==> (x in Ra) & (x /= Ra_0) & (Ra_ABS(Recip(x)) /= Recip(Ra_ABS(x)))
        x-->T462 ==> (Recip(x) in Ra) & ((x Ra_TIMES Recip(x)) = Ra_1)
        x-->T527 ==> Ra_ABS(x) in Ra
        (x,Recip(x))-->T530 ==> (Ra_ABS(x) Ra_TIMES Ra_ABS(Recip(x))) = Ra_ABS(x Ra_TIMES Recip(x))
        T465 ==> Ra_is_nonneg(Ra_1)
        T525 ==> Stat1: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &
			Stat2: (FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0)))
        Ra_1-->Stat1 ==> Ra_ABS(Ra_1) = Ra_1
        x-->Stat2 ==> Ra_ABS(x) /= Ra_0
        (Ra_ABS(x))-->T462 ==> (Recip(Ra_ABS(x)) in Ra) & ((Ra_ABS(x) Ra_TIMES Recip(Ra_ABS(x))) = Ra_1)
        (Recip(Ra_ABS(x)))-->T461 ==> (Recip(Ra_ABS(x)) RA_TIMES Ra_1) = Recip(Ra_ABS(x))
        EQUAL ==> (Recip(Ra_ABS(x)) RA_TIMES (Ra_ABS(x) Ra_TIMES Ra_ABS(Recip(x)))) = Recip(Ra_ABS(x))
        (Recip(x))-->T527 ==> Ra_ABS(Recip(x)) in Ra
        (Ra_ABS(Recip(x)),Recip(Ra_ABS(x)),Ra_ABS(x))-->T456 ==> ((Recip(Ra_ABS(x)) RA_TIMES Ra_ABS(x)) Ra_TIMES Ra_ABS(Recip(x))) = Recip(Ra_ABS(x))
        (Recip(Ra_ABS(x)),Ra_ABS(x))-->T448 ==> ((Recip(Ra_ABS(x)) RA_TIMES Ra_ABS(x)) in Ra) & ((Recip(Ra_ABS(x)) RA_TIMES Ra_ABS(x)) = Ra_1)
        (Recip(Ra_ABS(x)) RA_TIMES Ra_ABS(x),Ra_ABS(Recip(x)))-->T448 ==> (Ra_ABS(Recip(x)) Ra_TIMES (Recip(Ra_ABS(x)) RA_TIMES Ra_ABS(x))) = Recip(Ra_ABS(x))
        EQUAL ==> (Ra_ABS(Recip(x)) Ra_TIMES Ra_1) = Recip(Ra_ABS(x))
    (Ra_ABS(Recip(x)))-->T461 ==> false; Discharge ==> QED
--
--
Theorem 537: ((X in Ra) & (Y in Ra)) imp (Ra_ABS(X Ra_MINUS Y) = Ra_ABS(Y Ra_MINUS X)). Proof:
Suppose_not(x,y) ==> AUTO
	T525 ==> Stat1: (FORALL x | (x in Ra) imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x))) &
		Stat2: (FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_Rev(x Ra_PLUS Ra_Rev(y)) = (y Ra_PLUS Ra_Rev(x))))
	Use_def(Ra_MINUS) ==> Stat3: Ra_ABS(x Ra_PLUS Ra_Rev(y)) /= Ra_ABS(y Ra_PLUS Ra_Rev(x))
        y-->T452 ==> Ra_Rev(y) in Ra
	(x,Ra_Rev(y))-->T445 ==> Stat4: (x Ra_PLUS Ra_Rev(y)) in Ra
	(x Ra_PLUS Ra_Rev(y))-->Stat1(Stat4*) ==> Ra_ABS(Ra_Rev(x Ra_PLUS Ra_Rev(y))) = Ra_ABS(x Ra_PLUS Ra_Rev(y))
        (x,y)-->Stat2 ==> Ra_Rev(x Ra_PLUS Ra_Rev(y)) = (y Ra_PLUS Ra_Rev(x))
EQUAL(Stat3) ==> false; Discharge ==> QED
--
Theorem 538: ((X in Ra) & (Y in Ra) & (A in Ra) & (B in Ra) & (Ra_ABS(X) Ra_GT A) & (Ra_ABS(Y) Ra_GT B) & (A Ra_GT Ra_0) & (B Ra_GT Ra_0)) imp (Ra_ABS(Recip(X) Ra_MINUS Recip(Y)) Ra_LE (Ra_ABS(X Ra_MINUS Y) Ra_TIMES (Recip(A) Ra_TIMES Recip(B)))). Proof:
Suppose_not(x,y,a,b) ==> Stat1: (x in Ra) & (y in Ra) & (a in Ra) & (b in Ra) & (Ra_ABS(x) Ra_GT a) & (Ra_ABS(y) Ra_GT b) & (a Ra_GT Ra_0) & (b Ra_GT Ra_0) & (not(Ra_ABS(Recip(x) Ra_MINUS Recip(y)) Ra_LE (Ra_ABS(x Ra_MINUS y) Ra_TIMES (Recip(a) Ra_TIMES Recip(b)))))
	T525 ==> Stat2: (FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0)))
        T451 ==> Ra_0 in Ra
	x-->T527 ==> Stat3: Ra_ABS(x) in Ra
	y-->T527 ==> Stat4: Ra_ABS(y) in Ra
	(Ra_ABS(x),a,Ra_0)-->T511 ==> Stat5: Ra_ABS(x) Ra_GT Ra_0
	(Ra_ABS(y),b,Ra_0)-->T511 ==> Stat6: Ra_ABS(y) Ra_GT Ra_0
--
--	Use_def(Ra_GT)(Stat1,Stat5*) ==> Stat7: (Ra_ABS(x) /= Ra_0) & (Ra_ABS(y) /= Ra_0) & (a /= Ra_0) & (b /= Ra_0)
(Ra_ABS(x),Ra_0)-->T473(Stat5,Stat5*) ==> Stat7: Ra_ABS(x) /= Ra_0
(Ra_ABS(y),Ra_0)-->T473(Stat6,Stat6*) ==> Stat8: Ra_ABS(y) /= Ra_0
(a,Ra_0)-->T473(Stat1,Stat1*) ==> Stat9: a /= Ra_0
(b,Ra_0)-->T473(Stat1,Stat1*) ==> Stat10: b /= Ra_0
	Suppose ==> (x = Ra_0) or (y = Ra_0)
		x-->Stat2(*) ==> x /= Ra_0
		y-->Stat2(*) ==> y /= Ra_0
	Discharge ==> Stat11: (x /= Ra_0) & (y /= Ra_0)
	(Ra_ABS(x),a)-->T518(Stat1,Stat5,Stat3*) ==> Stat12: Recip(a) Ra_GT Recip(Ra_ABS(x))
	(Ra_ABS(y),b)-->T518(Stat1,Stat6,Stat4*) ==> Recip(b) Ra_GT Recip(Ra_ABS(y))
	a-->T462(Stat9,Stat1*) ==> Recip(a) in Ra
	b-->T462(Stat10,Stat1*) ==> Recip(b) in Ra
	(Recip(a),Recip(b))-->T448(Stat12*) ==> (Recip(a) Ra_TIMES Recip(b)) in Ra
	(Ra_ABS(x))-->T462(Stat7,Stat3*) ==> Recip(Ra_ABS(x)) in Ra
	(Ra_ABS(y))-->T462(Stat8,Stat4*) ==> Recip(Ra_ABS(y)) in Ra
	(Recip(b),Recip(Ra_ABS(y)))-->T473(Stat6*) ==> Recip(b) Ra_GE Recip(Ra_ABS(y))
        (Ra_ABS(x))-->T491(Stat3,Stat5*) ==> Recip(Ra_ABS(x)) Ra_GT Ra_0
        (Ra_ABS(y))-->T491(Stat4,Stat6*) ==> Recip(Ra_ABS(y)) Ra_GT Ra_0
	(Recip(a),Recip(Ra_ABS(x)),Recip(b),Recip(Ra_ABS(y)))-->T517(Stat12*) ==> (Recip(a) Ra_TIMES Recip(b)) Ra_GT (Recip(Ra_ABS(x)) Ra_TIMES Recip(Ra_ABS(y)))
	(Ra_ABS(x),Ra_ABS(y))-->T533(Stat7,Stat8,Stat3,Stat4*) ==> Stat13: (Recip(Ra_ABS(x)) Ra_TIMES Recip(Ra_ABS(y))) = Recip(Ra_ABS(x) Ra_TIMES Ra_ABS(y))
	(x,y)-->T530(Stat1,Stat1*) ==> (Ra_ABS(x Ra_TIMES y) = (Ra_ABS(x) Ra_TIMES Ra_ABS(y)))
	EQUAL(Stat5) ==> (Recip(a) Ra_TIMES Recip(b)) Ra_GT Recip(Ra_ABS(x Ra_TIMES y))
	((Recip(a) Ra_TIMES Recip(b)),Recip(Ra_ABS(x Ra_TIMES y)))-->T473(Stat13*) ==> (Recip(a) Ra_TIMES Recip(b)) Ra_GE Recip(Ra_ABS(x Ra_TIMES y))
	ALGEBRA(Stat1,Stat1) ==> Stat14: ((x Ra_MINUS y) in Ra) & ((x Ra_TIMES y) in Ra)
 	(x Ra_MINUS y)-->T527(Stat14*) ==> (Ra_ABS(x Ra_MINUS y) in Ra) & (Ra_ABS(x Ra_MINUS y) Ra_GE Ra_0)
	(Ra_ABS(x Ra_MINUS y),Ra_ABS(x Ra_MINUS y))-->T473(Stat14*) ==> Ra_ABS(x Ra_MINUS y) Ra_GE Ra_ABS(x Ra_MINUS y)
	(x Ra_TIMES y)-->T527(Stat14*) ==> Stat15: (Ra_ABS(x Ra_TIMES y) in Ra) & (Ra_ABS(x Ra_TIMES y) Ra_GE Ra_0)
--	Use_def(Ra_GT)(Stat5,Stat6*) ==> (Ra_ABS(x) /= Ra_0) & (Ra_ABS(y) /= Ra_0)
	(Ra_ABS(x),Ra_0)-->T473(Stat5,Stat5*) ==> Ra_ABS(x) /= Ra_0
	(Ra_ABS(y),Ra_0)-->T473(Stat6,Stat6*) ==> Ra_ABS(y) /= Ra_0
	(Ra_ABS(x),Ra_ABS(y))-->T531(Stat3*) ==> Ra_ABS(x Ra_TIMES y) /= Ra_0
	(Ra_ABS(x Ra_TIMES y),Ra_0)-->T473(Stat15*) ==> Ra_ABS(x Ra_TIMES y) Ra_GT Ra_0
	(Ra_ABS(x Ra_TIMES y))-->T491(Stat15*) ==> Recip(Ra_ABS(x Ra_TIMES y)) Ra_GT Ra_0
	(Recip(Ra_ABS(x Ra_TIMES y)),Ra_0)-->T473(Stat15*) ==> Recip(Ra_ABS(x Ra_TIMES y)) Ra_GE Ra_0
	(Ra_ABS(x Ra_TIMES y))-->T462(Stat15*) ==> Recip(Ra_ABS(x Ra_TIMES y)) in Ra
	(Ra_ABS(x Ra_MINUS y),Ra_ABS(x Ra_MINUS y),Recip(a) Ra_TIMES Recip(b),Recip(Ra_ABS(x Ra_TIMES y)))-->T516(Stat12*) ==> ((Ra_ABS(x Ra_MINUS y)) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))) Ra_GE
((Ra_ABS(x Ra_MINUS y)) Ra_TIMES Recip(Ra_ABS(x Ra_TIMES y)))
	(x Ra_TIMES y)-->Stat2(Stat14*) ==> (x Ra_TIMES y) /= Ra_0
	(x Ra_TIMES y)-->T536(Stat14*) ==> Recip(Ra_ABS(x Ra_TIMES y)) = Ra_ABS(Recip(x Ra_TIMES y))
	(x Ra_TIMES y)-->T462(Stat14*) ==> Recip(x Ra_TIMES y) in Ra
	(x Ra_MINUS y,Recip(x Ra_TIMES y))-->T530(Stat14*) ==> (Ra_ABS(x Ra_MINUS y) Ra_TIMES Ra_ABS(Recip(x Ra_TIMES y))) = Ra_ABS((x Ra_MINUS y) Ra_TIMES Recip(x Ra_TIMES y))
	EQUAL(Stat14) ==> Stat16: ((Ra_ABS(x Ra_MINUS y)) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))) Ra_GE Ra_ABS((x Ra_MINUS y) Ra_TIMES Recip(x Ra_TIMES y))
	Use_def(Ra_OVER)(Stat16*) ==> ((Ra_ABS(x Ra_MINUS y)) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))) Ra_GE Ra_ABS((x Ra_MINUS y) Ra_OVER (x Ra_TIMES y))
	y-->T462(Stat1,Stat11*) ==> Stat17: Recip(y) in Ra
	x-->T462(Stat1,Stat11*) ==> Stat18: Recip(x) in Ra
	(y,x)-->T535(Stat1,Stat11*) ==> (Recip(y) Ra_MINUS Recip(x)) = ((x Ra_MINUS y) Ra_OVER (y Ra_TIMES x))
        ALGEBRA(Stat1,Stat17,Stat18*) ==> Stat19: ((y Ra_TIMES x) = (x Ra_TIMES y)) & ((Recip(y) Ra_MINUS Recip(x)) in Ra)
        EQUAL(Stat11) ==> Stat20: ((Ra_ABS(x Ra_MINUS y)) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))) Ra_GE Ra_ABS(Recip(y) Ra_MINUS Recip(x))
        (Ra_ABS(Recip(y) Ra_MINUS Recip(x)),((Ra_ABS(x Ra_MINUS y)) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))))-->T473(Stat20*) ==> Stat21: Ra_ABS(Recip(y) Ra_MINUS Recip(x)) Ra_LE ((Ra_ABS(x Ra_MINUS y)) Ra_TIMES (Recip(a) Ra_TIMES Recip(b)))
--
-- Since the absolute value of a difference equals the absolute value of the difference
-- with arguments interchanged, we can discharge the pending assumption and so complete
-- the present proof.
--
	(Recip(x),Recip(y))-->T537(Stat17,Stat18*) ==> Stat22: Ra_ABS(Recip(x) Ra_MINUS Recip(y)) = Ra_ABS(Recip(y) Ra_MINUS Recip(x))
EQUAL(Stat21,Stat22,Stat1) ==> false; Discharge ==> QED
--
--
-- ************************************************************************************************
--								Section 14: Real numbers
-- ************************************************************************************************
--
Def 46: [The set of rational sequences] RaSeq := {f: f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}
Def 47: [The constant 0 rational sequence] Ra0Seq := Za PROD {Ra_0}
Def 48: [The constant 1 rational sequence] Ra1Seq := Za PROD {Ra_1}
Def 49: [Pointwise sum of rational sequences] Def(X Ras_PLUS Y) := {[car(p),cdr(p) Ra_PLUS (Y~[car(p)])]: p in X}
Def 50: [Pointwise additive inverse of rational sequence] Ras_Rev(X) := {[car(p),Ra_Rev(cdr(p))]: p in X}
Def 51: [Pointwise absolute value of rational sequence] Ras_ABS(X) := {[car(p),Ra_ABS(cdr(p))]: p in X}
Def 52: [Pointwise difference of rational sequences] Def(X Ras_MINUS Y) := X Ras_PLUS Ras_Rev(Y)
Def 53: [Product of rational sequences] Def(X Ras_TIMES Y) := {[car(p),cdr(p) Ra_TIMES (Y~[car(p)])]: p in X}
-- Def 54: [Pointwise reciprocal of rational sequence] Ras_Recip(X) := {[#{j: j in i | (X~[j]) /= Ra_0}, Recip(X~[i])]: i in Za | (X~[i]) /= Ra_0}
Def 54: [Pointwise reciprocal of rational sequence] Ras_Recip(X) := shifted_seq({[i, Recip(X~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (X~[i]) /= Ra_0)}))
Def 55: [Pointwise quotient of rational sequences] Def(X Ras_OVER Y) := X Ras_TIMES Ras_Recip(Y)
Def 56: [Rational Cauchy sequences] RaCauchy := {f: f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
Def 57: [Equivalence of rational sequences] Ra_eqseq(F,G) := (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in domain(F) | Ra_ABS((F~[x]) Ra_MINUS (G~[x])) Ra_GT eps}))
--
-- It is obvious that every Rational Cauchy sequence is a rational sequence
--
Theorem 539: [Every Rational Cauchy sequence is a rational sequence] RaCauchy incin RaSeq. Proof:
Suppose_not ==> Stat1: not(RaCauchy incin RaSeq)
	f-->Stat1 ==> (f in RaCauchy) & (f notin RaSeq)
	Use_def(RaCauchy) ==> Stat2: f in {g in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps }))}
()-->Stat2 ==> f in RaSeq; Discharge ==> QED
--
-- Moreover, the range of a rational sequence is plainly included in the set of rationals;
-- its domain is the set of integers, and each of its image elements is a rational.
--
Theorem 540: [The range of a rational sequence is included in the set of rationals] (F in RaSeq) imp ((domain(F) = Za) & Svm(F) & (range(F) incin Ra) & ((X in Za) imp (F~[X] in Ra))). Proof:
Suppose_not(f,x) ==> AUTO
	Use_def(RaSeq) ==> Stat1: f in {g incin (Za PROD Ra) | (domain(g) = Za) & Svm(g)}
	()-->Stat1 ==> (f incin (Za PROD Ra)) & Svm(f) & (domain(f) = Za)
	(f,Za,Ra)-->T141 ==> (range(f) incin Ra) & (x in Za) & (f~[x] notin Ra)
--
-- For, assuming $f,x$ to be a counterexample, we are led to a contradiction as follows.
-- From Theorem 141, we immediately get that the only conclusion of the theorem's assertion
-- which can be false is the implication $((x in Za) imp (f~[x] in Ra))$.
-- However, the only remaining possibility is discarded immediately thanks to Theorem 71.
--
(x,f)-->T71(*) ==> false; Discharge ==> QED
--
--
--
Theorem 541: [Reformulation of condition for sequence equivalence] ({F,G} incin RaSeq) imp (Ra_eqseq(F,G) eq (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in Za | Ra_ABS((F~[x]) Ra_MINUS (G~[x])) Ra_GT eps}))). Proof:
Suppose_not(f,g) ==> AUTO
	Use_def(Ra_eqseq) ==> Ra_eqseq(f,g) eq (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in domain(f) | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps}))
	f-->T540 ==> domain(f) = Za
EQUAL ==> false; Discharge ==> QED
--

Theorem 542: [Condition for rational sequence equality] (FORALL n in Za | ((F in RaSeq) & (G in RaSeq) & (F~[n] = G~[n]))) imp (F = G). Proof:
Suppose_not(f,g) ==> AUTO
	T212(*) ==> Za /= 0
	Suppose ==> Stat1: not(FORALL h in RaSeq | ((domain(h) = Za) & Svm(h)))
		h--> Stat1 ==> (h in RaSeq) & (not((domain(h) = Za) & Svm(h)))
		Use_def(RaSeq) ==> Stat2: h in {f: f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}
		f1-->Stat2 ==> (h = f1) & (domain(f1) = Za) & Svm(f1)
	EQUAL ==> false; Discharge ==> (FORALL h in RaSeq | ((domain(h) = Za) & Svm(h)))
(Za,RaSeq)-->T338(*) ==> false; Discharge ==> QED
--
--
THEORY pointwiseU(fp,h,d,r,uop(X))
	Svm(fp) & (domain(fp) = d) & (range(fp) incin r)
	(FORALL x in r | uop(x) in r)
	h = {[car(p),uop(cdr(p))]: p in fp}
END pointwiseU
--
ENTER_THEORY pointwiseU
--
Theorem pointwiseU.1: h = {[u,uop(fp~[u])]: u in d}. Proof:
    Suppose_not ==> h /= {[u,uop(fp~[u])]: u in d}
	Assump ==> h = {[car(p),uop(cdr(p))]: p in fp}
	ELEM ==> {[car(p),uop(cdr(p))]: p in fp} /= {[u,uop(fp~[u])]: u in d}
	Assump ==> Svm(fp) & (domain(fp) = d) & (range(fp) incin r)
	fp-->T72 ==> fp = {[w,fp~[w]]: w in domain(fp)}
	EQUAL ==> {[car(p),uop(cdr(p))]: p in fp} = {[car(p),uop(cdr(p))]: p in {[w,fp~[w]]: w in d}}
	SIMPLF ==> Stat1: {[car([w,fp~[w]]),uop(cdr([w,fp~[w]]))]: w in d} /= {[u,uop(fp~[u])]: u in d}
	c-->Stat1 ==> (c in {[car([w,fp~[w]]),uop(cdr([w,fp~[w]]))]: w in d}) eq (c notin {[u,uop(fp~[u])]: u in d})
	Suppose ==> Stat2: (c in {[car([w,fp~[w]]),uop(cdr([w,fp~[w]]))]: w in d}) & (c notin {[u,uop(fp~[u])]: u in d})
	(w,w)-->Stat2(Stat2) ==> false; Discharge ==> Stat3: (c in {[u,uop(fp~[u])]: u in d}) & (c notin {[car([w,fp~[w]]),uop(cdr([w,fp~[w]]))]: w in d})
    (u,u)-->Stat3(Stat3) ==> fail; Discharge ==> QED
--
Theorem pointwiseU.2: Svm(h) & (domain(h) = d) & (range(h) incin r). Proof:
    Suppose_not ==> (not Svm(h)) or (domain(h) /= d) or (not(range(h) incin r))
	TpointwiseU.1 ==> h = {[u,uop(fp~[u])]: u in d}
	APPLY() fcn_symbol(f(u)->uop(fp~[u]), g->h, s->d) ==> (domain(h) = d) & (range(h) = {uop(fp~[u]): u in d}) & Svm(h)
	ELEM ==> Stat1: not({uop(fp~[u]): u in d} incin r)
	c-->Stat1 ==> Stat2: (c in {uop(fp~[u]): u in d}) & (c notin r)
	x-->Stat2 ==> (x in d) & (c = uop(fp~[x]))
	Assump ==> Svm(fp) & (domain(fp) = d) & (range(fp) incin r)
	fp-->T72 ==> fp = {[w,fp~[w]]: w in domain(fp)}
	TELEM ==> range({[w,fp~[w]]: w in domain(fp)}) = {fp~[w]: w in domain(fp)}
	EQUAL ==> range(fp) = {fp~[w]: w in domain(fp)}
	EQUAL ==> Stat3: range(fp) = {fp~[w]: w in d}
	Suppose ==> Stat4: fp~[x] notin range(fp)
		(Stat3,Stat4)ELEM ==> Stat5: fp~[x] notin {fp~[w]: w in d}
	x-->Stat5 ==> false; Discharge ==> fp~[x] in r
	Assump ==> Stat6: (FORALL x in r | uop(x) in r)
    (fp~[x])-->Stat6 ==> false; Discharge ==> QED
--
Theorem pointwiseU.3: (FORALL x in d | h~[x] = uop(fp~[x])). Proof:
	Suppose_not ==> Stat1: AUTO
	x-->Stat1 ==> (x in d) & (h~[x] /= uop(fp~[x]))
	TpointwiseU.1 ==> h = {[u,uop(fp~[u])]: u in d}
	APPLY() fcn_symbol(f(x)->uop(fp~[x]),g->h,s->d) ==> Stat2: (FORALL x | h~[x] = if x in d then uop(fp~[x]) else 0 end if)
	x-->Stat2 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY pointwiseU
--
--THEORY pointwiseU(fp,h,d,r,uop(X))
--	Svm(fp) & (domain(fp) = d) & (range(fp) incin r)
--	(FORALL x in r, y in r | bop(x,y) in r)
--	h = {[car(p),uop(cdr(p))]: p in fp}
--==>
--	h = {[u,uop(fp~[u])]: u in d}
--	Svm(h) & (domain(h) = d) & (range(h) incin r)
--  (FORALL x in d | h~[x] = uop(fp~[x]))
--END pointwiseU
--
--
THEORY pointwise(fq,fp,h,d,r,bop(X,Y))
	Svm(fq) & (domain(fq) = d) & (range(fq) incin r)
	Svm(fp) & (domain(fp) = d) & (range(fp) incin r)
	(FORALL x in r, y in r | bop(x,y) in r)
	h = {[car(p),bop(cdr(p),fp~[car(p)])]: p in fq}
END pointwise
--
ENTER_THEORY pointwise
--
Theorem pointwise.1: h = {[u,bop(fq~[u],fp~[u])]: u in d}. Proof:
    Suppose_not ==> h /= {[u,bop(fq~[u],fp~[u])]: u in d}
        Assump ==> h = {[car(p),bop(cdr(p),fp~[car(p)])]: p in fq}
        ELEM ==> {[car(p),bop(cdr(p),fp~[car(p)])]: p in fq} /= {[u,bop(fq~[u],fp~[u])]: u in d}
        Assump ==> Svm(fq) & (domain(fq) = d) & (range(fq) incin r)
        fq-->T72 ==> fq = {[w,fq~[w]]: w in domain(fq)}
        EQUAL ==> {[car(p),bop(cdr(p),fp~[car(p)])]: p in fq} = {[car(p),bop(cdr(p),fp~[car(p)])]: p in {[w,fq~[w]]: w in d}}
        SIMPLF ==> Stat1: {[car([w,fq~[w]]),bop(cdr([w,fq~[w]]),fp~[car([w,fq~[w]])])]: w in d} /= {[u,bop(fq~[u],fp~[u])]: u in d}
        c-->Stat1 ==> (c in {[car([w,fq~[w]]),bop(cdr([w,fq~[w]]),fp~[car([w,fq~[w]])])]: w in d}) eq (c notin {[u,bop(fq~[u],fp~[u])]: u in d})
        Suppose ==> Stat2: (c in {[car([w,fq~[w]]),bop(cdr([w,fq~[w]]),fp~[car([w,fq~[w]])])]: w in d}) & (c notin {[u,bop(fq~[u],fp~[u])]: u in d})
        (w,w)-->Stat2(Stat2) ==> false; Discharge ==> Stat3: (c in {[u,bop(fq~[u],fp~[u])]: u in d}) & (c notin {[car([w,fq~[w]]),bop(cdr([w,fq~[w]]),fp~[car([w,fq~[w]])])]: w in d})
    (u,u)-->Stat3(Stat3) ==> fail; Discharge ==> QED
--
Theorem pointwise.2: Svm(h) & (domain(h) = d) & (range(h) incin r). Proof:
    Suppose_not ==> (not Svm(h)) or (domain(h) /= d) or (not(range(h) incin r))
        Tpointwise.1 ==> h = {[u,bop(fq~[u],fp~[u])]: u in d}
        APPLY() fcn_symbol(f(u)->bop(fq~[u],fp~[u]), g->h, s->d) ==> (domain(h) = d) & (range(h) = {bop(fq~[u],fp~[u]): u in d}) & Svm(h)
        ELEM ==> Stat1: not({bop(fq~[u],fp~[u]): u in d} incin r)
        c-->Stat1 ==> Stat2: (c in {bop(fq~[u],fp~[u]): u in d}) & (c notin r)
        x-->Stat2 ==> (x in d) & (c = bop(fq~[x],fp~[x]))
        Assump ==> Svm(fq) & (domain(fq) = d) & (range(fq) incin r)
        Assump ==> Svm(fp) & (domain(fp) = d) & (range(fp) incin r)
        fq-->T72 ==> fq = {[w,fq~[w]]: w in domain(fq)}
        TELEM ==> range({[w,fq~[w]]: w in domain(fq)}) = {fq~[w]: w in domain(fq)}
        EQUAL ==> range(fq) = {fq~[w]: w in domain(fq)}
        fp-->T72 ==> fp = {[w,fp~[w]]: w in domain(fp)}
        TELEM ==> range({[w,fp~[w]]: w in domain(fp)}) = {fp~[w]: w in domain(fp)}
        EQUAL ==> range(fp) = {fp~[w]: w in domain(fp)}
        EQUAL ==> Stat3: range(fq) = {fq~[w]: w in d}
        EQUAL ==> Stat4: range(fp) = {fp~[w]: w in d}
        Suppose ==> Stat5: fq~[x] notin range(fq)
            (Stat3,Stat5)ELEM ==> Stat6: fq~[x] notin {fq~[w]: w in d}
        x-->Stat6 ==> false; Discharge ==> fq~[x] in r
        Suppose ==> Stat7: fp~[x] notin range(fp)
            (Stat4,Stat7)ELEM ==> Stat8: fp~[x] notin {fp~[w]: w in d}
        x-->Stat8 ==> false; Discharge ==> fp~[x] in r
        Assump ==> Stat9: (FORALL x in r, y in r | bop(x,y) in r)
    (fq~[x],fp~[x])-->Stat9 ==> false; Discharge ==> QED
--
Theorem pointwise.3: (FORALL x in d | h~[x] = bop(fq~[x],fp~[x])). Proof:
	Suppose_not ==> Stat1: AUTO
	x-->Stat1 ==> (x in d) & (h~[x] /= bop(fq~[x],fp~[x]))
	Tpointwise.1 ==> h = {[u,bop(fq~[u],fp~[u])]: u in d}
	APPLY() fcn_symbol(f(x)->bop(fq~[x],fp~[x]),g->h,s->d) ==> Stat2: (FORALL x | h~[x] = if x in d then bop(fq~[x],fp~[x]) else 0 end if)
	x-->Stat2 ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY pointwise
--
--THEORY pointwise(f,fp,h,d,r,bop(X,Y))
--	Svm(f) & (domain(f) = d) & (range(f) incin r)
--	Svm(fp) & (domain(fp) = d) & (range(fp) incin r)
--	(FORALL x in r, y in r | bop(x,y) in r)
--	h = {[car(p),bop(cdr(p),fp~[car(p)])]: p in f}
--==>
--	h = {[u,bop(f~[u],fp~[u])]: u in d}
--	Svm(h) & (domain(h) = d) & (range(h) incin r)
--  (FORALL x in d | h~[x] = bop(f~[x],fp~[x]))
--END pointwise
--
-- We begin by proving that every constant sequence whose image belongs
-- to the rationals is a Cauchy sequence.
--
Theorem 543: (X in Ra) imp ((Za PROD {X}) in RaCauchy). Proof:
Suppose_not(x2) ==> (x2 in Ra) & ((Za PROD {x2}) notin RaCauchy)
	Use_def(RaCauchy) ==> Stat1: (Za PROD {x2}) notin {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
	Use_def(PROD) ==> Za PROD {x2} = {[yy,x]: yy in Za, x in {x2}}
	SIMPLF ==> (Za PROD {x2}) = {[yy,x2]: yy in Za}
	APPLY() fcn_symbol(f(yy)->x2, g->(Za PROD {x2}), s->Za) ==> (domain(Za PROD {x2}) = Za) & Svm(Za PROD {x2})
			& Stat2: (FORALL yy | ((Za PROD {x2})~[yy]) = if yy in Za then x2 else 0 end if)
	Suppose ==> (Za PROD {x2}) notin RaSeq
		(Za,Za,{x2},Ra)-->T256 ==> (Za PROD {x2}) incin (Za PROD Ra)
		Use_def(RaSeq) ==>  Stat3: (Za PROD {x2}) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}
	()-->Stat3 ==> false; Discharge ==> (Za PROD {x2}) in RaSeq
	()-->Stat1 ==> Stat4: (not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
	Finite({ i * j : i in Za, j in Za | Ra_ABS(((Za PROD {x2})~[i]) Ra_MINUS ((Za PROD {x2})~[j])) Ra_GT eps })))
	eps-->Stat4 ==> (eps in Ra) & (eps Ra_GT Ra_0) & (not Finite({ i * j : i in Za, j in Za | Ra_ABS(((Za PROD {x2})~[i]) Ra_MINUS ((Za PROD {x2})~[j])) Ra_GT eps }))
	T188 ==> Finite(0)
	EQUAL ==> Stat5: 0 /= { i * j : i in Za, j in Za | Ra_ABS(((Za PROD {x2})~[i]) Ra_MINUS ((Za PROD {x2})~[j])) Ra_GT eps }
	(i,j)-->Stat5 ==> Stat6: (i in Za) & (j in Za) & (Ra_ABS(((Za PROD {x2})~[i]) Ra_MINUS ((Za PROD {x2})~[j])) Ra_GT eps)
	i-->Stat2 ==> ((Za PROD {x2})~[i]) = x2
	j-->Stat2 ==> ((Za PROD {x2})~[j]) = x2
	ALGEBRA ==> ((x2 Ra_MINUS x2) = Ra_0) & (Ra_0 in Ra)
	T465 ==> Ra_is_nonneg(Ra_0)
	T525 ==> Stat7: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
	Ra_0-->Stat7 ==> Ra_ABS(Ra_0) = Ra_0
	EQUAL(Stat6) ==> Ra_0 Ra_GT eps
	(Ra_0,eps)-->T473 ==> (Ra_0 Ra_GE eps) & (Ra_0 /= eps)
	(eps,Ra_0)-->T473 ==> eps Ra_GE Ra_0
(eps,Ra_0)-->T495 ==> false; Discharge ==> QED
--
--
--
Theorem 544: (X in Ra) imp (Ras_ABS(Za PROD {X}) = (Za PROD {Ra_ABS(X)})). Proof:
Suppose_not(y0) ==> AUTO
	y0-->T543(*) ==> Stat1: Ras_ABS(Za PROD {y0}) /= (Za PROD {Ra_ABS(y0)})
	Use_def(PROD)(Stat1*) ==> Ras_ABS(Za PROD {y0}) /= {[x,y]: x in Za, y in {Ra_ABS(y0)}}
	SIMPLF(Stat1*) ==> Ras_ABS(Za PROD {y0}) /= {[x,Ra_ABS(y0)]: x in Za}
	Use_def(Ras_ABS)(Stat1*) ==> Stat2: {[x,Ra_ABS(y0)]: x in Za} /= {[car(p),Ra_ABS(cdr(p))]: p in (Za PROD {y0})}
	c-->Stat2(Stat2*) ==> (c in {[x,Ra_ABS(y0)]: x in Za}) eq (c notin {[car(p),Ra_ABS(cdr(p))]: p in (Za PROD {y0})})
	Suppose ==> Stat3: (c in {[x,Ra_ABS(y0)]: x in Za}) & (c notin {[car(p),Ra_ABS(cdr(p))]: p in (Za PROD {y0})})
		(k,[k,y0])-->Stat3(Stat3*) ==> (k in Za) & (([k,Ra_ABS(y0)] /= [car([k,y0]),Ra_ABS(cdr([k,y0]))]) or ([k,y0] notin (Za PROD {y0})))
		(k,y0)-->T9(*) ==> (car([k,y0]) = k) & (cdr([k,y0]) = y0)
		EQUAL(Stat3) ==> Stat4: ([k,Ra_ABS(y0)] /= [k,Ra_ABS(y0)]) or ([k,y0] notin (Za PROD {y0}))
		(Stat4*)ELEM ==> Stat5: [k,y0] notin (Za PROD {y0})
		Use_def(PROD)(Stat5*) ==> Stat6: [k,y0] notin {[x,y]: x in Za, y in {y0}}
	(k,y0)-->Stat6(Stat3*) ==> false; Discharge ==> Stat7: (c in {[car(p),Ra_ABS(cdr(p))]: p in (Za PROD {y0})}) & (c notin {[x,Ra_ABS(y0)]: x in Za})
	(q,car(q))-->Stat7(Stat7*) ==> Stat8: (q in (Za PROD {y0})) & (([car(q),Ra_ABS(cdr(q))] /= [car(q),Ra_ABS(y0)]) or (car(q) notin Za))
	Use_def(PROD)(Stat8*) ==> Stat9: q in {[x,y]: x in Za, y in {y0}}
	SIMPLF(Stat9*) ==> Stat10: q in {[x,y0]: x in Za}
	h-->Stat10(Stat10*) ==> (h in Za) & (q = [h,y0])
	(h,y0)-->T9(*) ==> (car([h,y0]) = h) & (cdr([h,y0]) = y0)
	EQUAL(Stat8) ==> ([h,Ra_ABS(y0)] /= [h,Ra_ABS(y0)]) or (h notin Za)
(Stat10*)Discharge ==> QED
--
-- As a corollary of Theorem 543, the sequence which has constant value $Ra_0$,
-- and the one which has constant value $Ra_1$, are Cauchy sequences.
--
Theorem 545: {Ra0Seq,Ra1Seq} incin RaCauchy. Proof:
Suppose_not ==> AUTO
	Use_def(Ra0Seq) ==> Ra0Seq = (Za PROD {Ra_0})
	Use_def(Ra1Seq) ==> Ra1Seq = (Za PROD {Ra_1})
	ALGEBRA ==> (Ra_0 in Ra) & (Ra_1 in Ra)
	Ra_0-->T543(*) ==> (Za PROD {Ra_0}) in RaCauchy
Ra_1-->T543(*) ==> false; Discharge ==> QED
--
-- Every sequence of rational numbers is equivalent to itself:
--
Theorem 546: (F in RaSeq) imp ((domain(F) = Za) & Svm(F) & (range(F) incin Ra) & Ra_eqseq(F,F)). Proof:
Suppose_not(f) ==> AUTO
	(f,0)-->T540(*) ==> (range(f) incin Ra) & (not Ra_eqseq(f,f))
	Use_def(Ra_eqseq) ==> Stat1: (not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
	Finite({x : x in domain(f) | Ra_ABS((f~[x]) Ra_MINUS (f~[x])) Ra_GT eps})))
	e-->Stat1 ==> (e in Ra) & (e Ra_GT Ra_0) & (not Finite({x : x in domain(f) | Ra_ABS((f~[x]) Ra_MINUS (f~[x])) Ra_GT e}))
	TELEM ==> Finite(0)
	(Stat1)ELEM ==> Stat2: {x : x in domain(f) | Ra_ABS((f~[x]) Ra_MINUS (f~[x])) Ra_GT e} /= 0
	x-->Stat2 ==> (x in domain(f)) & (Ra_ABS((f~[x]) Ra_MINUS (f~[x])) Ra_GT e)
	(Ra_ABS((f~[x]) Ra_MINUS (f~[x])),e)-->T473 ==> Ra_ABS((f~[x]) Ra_MINUS (f~[x])) Ra_GE e
	(x,f)-->T71 ==> Stat3: (f~[x]) in Ra
	ALGEBRA(Stat3) ==> Stat4: (((f~[x]) Ra_MINUS (f~[x])) = Ra_0) & (Ra_0 in Ra)
	T465 ==> Ra_is_nonneg(Ra_0)
	EQUAL(Stat4) ==> Ra_is_nonneg((f~[x]) Ra_MINUS (f~[x]))
	T525 ==> Stat5: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
	((f~[x]) Ra_MINUS (f~[x]))-->Stat5 ==> Ra_ABS((f~[x]) Ra_MINUS (f~[x])) = Ra_0
	(Ra_ABS((f~[x]) Ra_MINUS (f~[x])), e, Ra_0)-->T510 ==> Ra_ABS((f~[x]) Ra_MINUS (f~[x])) Ra_GT Ra_0
-- 	Use_def(Ra_GT) ==> false; Discharge ==> QED
(Ra_ABS((f~[x]) Ra_MINUS (f~[x])),Ra_0)-->T473 ==> false; Discharge ==> QED
--
Theorem 547: ((F in RaSeq) & (N in Za) & (I in Za)) imp ((shifted_seq(F,N)~[I]) = (F~[N PLUS I])). Proof:
Suppose_not(h,n,i) ==> AUTO
	h-->T546(*) ==> (domain(h) = Za) & Svm(h) & (range(h) incin Ra)
	Use_def(shifted_seq)(*) ==> Stat1: ((h @ Shift(n))~[i]) /= (h~[n PLUS i])
	(n,i)-->T339(*) ==> Svm(Shift(n)) & (domain(Shift(n)) = Za) & (range(Shift(n)) incin Za) & ((Shift(n)~[i]) = (n PLUS i))
	(h,Shift(n),i)-->T129(*) ==> ((h @ Shift(n))~[i]) = (h~[Shift(n)~[i]])
EQUAL(Stat1) ==> false; Discharge ==> QED
--
-- The image of any unsigned integer via $Ras0Seq$ is $Ra_0$;
-- the image of any unsigned integer via $Ras1Seq$ is $Ra_1$.
--
Theorem 548: (U in Za) imp (((Ra0Seq~[U]) = Ra_0) & ((Ra1Seq~[U]) = Ra_1)). Proof:
Suppose_not(u) ==> AUTO
	T545(*) ==> (Ra0Seq in RaCauchy) & (Ra1Seq in RaCauchy)
	T539(*) ==> Stat1: (Ra0Seq in RaSeq) & (Ra1Seq in RaSeq)
	Use_def(Ra0Seq) ==> Stat2: Ra0Seq = (Za PROD {Ra_0})
	Use_def(Ra1Seq) ==> Ra1Seq = (Za PROD {Ra_1})
	Use_def(PROD)(Stat2) ==> (Ra0Seq = {[x,y]: x in Za, y in {Ra_0}}) & (Ra1Seq = {[x,y]: x in Za, y in {Ra_1}})
	Suppose ==> Stat3: [u,Ra_0] notin {[x,y]: x in Za, y in {Ra_0}}
	(u,Ra_0)-->Stat3(*) ==> false; Discharge ==> Stat4: [u,Ra_0] in Ra0Seq
	Suppose ==> Stat5: [u,Ra_1] notin {[x,y]: x in Za, y in {Ra_1}}
	(u,Ra_1)-->Stat5(*) ==> false; Discharge ==> Stat6: [u,Ra_1] in Ra1Seq
	Ra0Seq-->T546(Stat1,Stat1*) ==> Stat7: Svm(Ra0Seq)
	Ra1Seq-->T546(Stat1,Stat1*) ==> Stat8: Svm(Ra1Seq)
	(Ra0Seq,[u,Ra_0])-->T74(Stat4,Stat7*) ==> (Ra0Seq~[car([u,Ra_0])]) = cdr([u,Ra_0])
	(Ra1Seq,[u,Ra_1])-->T74(Stat6,Stat8*) ==> (Ra1Seq~[car([u,Ra_1])]) = cdr([u,Ra_1])
	(u,Ra_0)-->T9(Stat9*) ==> Stat9: (car([u,Ra_0]) = u) & (cdr([u,Ra_0]) = Ra_0)
	(u,Ra_0)-->T9(Stat10*) ==> Stat10: (car([u,Ra_1]) = u) & (cdr([u,Ra_1]) = Ra_1)
EQUAL ==> false; Discharge ==> QED
--
-- More generally, in the case of a rational Cauchy sequence $f$,
-- every infinite subsequence $g$ of $f$ is a rational Cauchy sequence equivalent to $f$.
--
Theorem 549: ((F in RaCauchy) & (G in Subseqs(F)) & (not Finite(G))) imp ((G in RaCauchy) & Ra_eqseq(F,G)). Proof+:
Suppose_not(f,g) ==> AUTO
		Use_def(RaCauchy) ==> Stat1: f in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
		()-->Stat1(Stat1*) ==> (f in RaSeq) &
			Stat2: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))
		Use_def(RaSeq) ==> Stat3: f in {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}
		()-->Stat3(Stat3*) ==> (f incin (Za PROD Ra)) & (domain(f) = Za) & Svm(f)
		Use_def(next(Za)) ==> AUTO
		APPLY(h_thryvar:h) subseq(g->g,f->f) ==> Stat4:
			(g = (f @ h)) & one_1_map(h) & (domain(h) in next(Za)) & (range(h) incin domain(f)) &
			(g incin (domain(f) PROD range(f))) & Svm(g) & (domain(g) in (next(Za) * next(domain(f)))) &
			({i in domain(h) | (i nincin (h~[i]))} = 0) &
			Stat5: (FORALL i in domain(h), j in domain(h) | (i in j) imp ((h~[i]) in (h~[j])))
		Use_def(one_1_map) ==> Svm(h)
		(f,Za,Ra)-->T141(*) ==> (domain(f) incin Za) & (range(f) incin Ra)
		(domain(f), Za, range(f), Ra)-->T256(*) ==> g incin (Za PROD Ra)
		Suppose ==> (domain(g) /= Za) or (domain(h) /= Za)
			(f,h)-->T95(*) ==> domain(f @ h) = domain(h)
			EQUAL ==> (domain(g) in next(Za)) & (domain(g) = domain(h))
			Use_def(next) ==> domain(g) in Za
			g-->T174(*) ==> (#domain(g) = #g) & Finite(#domain(g))
			EQUAL ==> Finite(#g)
		g-->T193(*) ==> false; Discharge ==> Stat6: (domain(g) = Za) & (domain(h) = Za)
		Suppose ==> g notin RaCauchy
			Use_def(RaCauchy) ==> Stat7: g notin {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
					Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
		()-->Stat7(*) ==> (g notin RaSeq) or (not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
				Finite({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps })))
		Suppose ==> g notin RaSeq
			Use_def(RaSeq) ==> Stat8: g notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}
			()-->Stat8(*) ==> false; Discharge ==> Stat9: (not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
				Finite({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps })))
            eps0-->Stat9(*) ==> (eps0 in Ra) & (eps0 Ra_GT Ra_0) & (not Finite({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 }))
            eps0-->Stat2(*) ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps0 })
            (h, { i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 })-->T58(*) ==> one_1_map(h ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 }))
            Suppose ==> domain(h ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 })) /= { i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 }
                (h, { i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 })-->T94 ==> Stat10: not({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 } incin Za)
                c-->Stat10 ==> Stat11: (c in { i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 }) & (c notin Za)
                (ip, jp)-->Stat11(Stat11*) ==> (ip in Za) & (jp in Za) & ((ip * jp) notin Za)
            (ip,jp)-->T366(*) ==> false; Discharge ==> domain(h ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 })) = { i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 }
            Suppose ==> Stat12: not(range(h ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 })) incin { i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps0 })
                d-->Stat12(Stat12*) ==> (d in range(h ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 }))) & (d notin { i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps0 })
                (h, { i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 })-->T123(*) ==> Stat13: d in ({h~[x]: x in domain(h) | x in { i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 }})
                iq-->Stat13(Stat6*) ==> Stat14: (iq in Za) & (iq in { i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 }) & ((h~[iq]) notin { i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps0 })
                (i0, j0, h~[i0], h~[j0])-->Stat14(Stat14*) ==> Stat15: (i0 in Za) & (j0 in Za) & (iq = (i0 * j0)) & (Ra_ABS((g~[i0]) Ra_MINUS (g~[j0])) Ra_GT eps0) & (((h~[iq]) /= (h~[i0]) * (h~[j0])) or ((h~[i0]) notin Za) or ((h~[j0]) notin Za) or (not(Ra_ABS((f~[h~[i0]]) Ra_MINUS (f~[h~[j0]])) Ra_GT eps0)))
                (f,h,i0)-->T129(*) ==> ((f @ h)~[i0]) = (f~[h~[i0]])
                (f,h,j0)-->T129(*) ==> ((f @ h)~[j0]) = (f~[h~[j0]])
                EQUAL ==> Ra_ABS((f~[h~[i0]]) Ra_MINUS (f~[h~[j0]])) Ra_GT eps0
                (i0, h)-->T71(Stat3*) ==> (h~[i0]) in Za
                (j0, h)-->T71(Stat3*) ==> (h~[j0]) in Za
                EQUAL ==> (h~[i0 * j0]) /= (h~[i0]) * (h~[j0])
                T206(*) ==> Ord(Za)
                Suppose ==> i0 = j0
                    (Stat14*)ELEM ==> (i0 * j0) = i0
                EQUAL ==> false; Discharge ==> i0 /= j0
                (i0, j0)-->T31(Stat14*) ==> (i0 in j0) or (j0 in i0)
                Suppose ==> Stat16: i0 in j0
                    (j0, i0)-->T13(Stat14*) ==> (i0 * j0) = i0
                    (i0, j0)-->Stat5(Stat6,Stat15,Stat16*) ==> (h~[i0]) in (h~[j0])
--??                    (i0, j0)-->Stat5(Stat6*) ==> (h~[i0]) in (h~[j0])
                    (h~[j0], h~[i0])-->T13(Stat14*) ==> ((h~[i0]) * (h~[j0])) = (h~[i0])
                EQUAL ==> false; Discharge ==> Stat17: j0 in i0
                (i0, j0)-->T13(Stat14*) ==> (i0 * j0) = j0
                (j0, i0)-->Stat5(Stat6,Stat15,Stat17*) ==> (h~[j0]) in (h~[i0])
                (h~[i0], h~[j0])-->T13(Stat14*) ==> ((h~[i0]) * (h~[j0])) = (h~[j0])
            EQUAL ==> false; Discharge ==> range(h ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 })) incin { i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps0 }
            ({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps0 }, range(h ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 })))-->T189(*) ==> Finite(range(h ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 })))
            (h ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 }))-->T191(*) ==> Finite(domain(h ON ({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps0 })))
        EQUAL ==> false; Discharge ==> not Ra_eqseq(f,g)
        Use_def(Ra_eqseq) ==> Stat18: not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in domain(f) | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps}))
        eps1-->Stat18(Stat18*) ==> (eps1 in Ra) & (eps1 Ra_GT Ra_0) & (not Finite({x in domain(f) | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1}))
        Suppose ==> Finite({x in Za | Ra_ABS((f~[x]) Ra_MINUS (f~[h~[x]])) Ra_GT eps1})
            EQUAL ==> Stat19: {x in Za | Ra_ABS((f~[x]) Ra_MINUS (f~[h~[x]])) Ra_GT eps1} /= {x in Za | Ra_ABS((f~[x]) Ra_MINUS ((f @ h)~[x])) Ra_GT eps1}
            xp-->Stat19(Stat19*) ==> (xp in Za) & (not((Ra_ABS((f~[xp]) Ra_MINUS (f~[h~[xp]])) Ra_GT eps1) eq (Ra_ABS((f~[xp]) Ra_MINUS ((f @ h)~[xp])) Ra_GT eps1)))
            (f,h,xp)-->T129(*) ==>  ((f @ h)~[xp]) = (f~[h~ [xp]])
        EQUAL ==> false; Discharge ==> not Finite({x in Za | Ra_ABS((f~[x]) Ra_MINUS (f~[h~[x]])) Ra_GT eps1})
        eps1-->Stat2(*) ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps1 })
        ({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps1 }, {x in Za | Ra_ABS((f~[x]) Ra_MINUS (f~[h~[x]])) Ra_GT eps1})-->T189(*) ==> Stat20: not ({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps1 } incs {x in Za | Ra_ABS((f~[x]) Ra_MINUS (f~[h~[x]])) Ra_GT eps1})
        i1-->Stat20(*) ==> Stat21: (i1 in {x in Za | Ra_ABS((f~[x]) Ra_MINUS (f~[h~[x]])) Ra_GT eps1}) & (i1 notin { i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps1 })
        (i1, h~[i1])-->Stat21(Stat3*) ==> Stat22: (i1 in Za) & (((i1 * (h~[i1])) /= i1) or ((h~[i1]) notin Za))
        (i1, h)-->T71(Stat3*) ==> Stat23: (i1 * (h~[i1])) /= i1
        (Stat4*)ELEM ==> Stat24: i1 notin {i in domain(h) | i nincin (h~[i])}
()-->Stat24(Stat6,Stat23,Stat22*) ==> false; Discharge ==> QED
--
-- It follows immediately from Theorem 539 and Theorem 540 that every Cauchy sequence,
-- applied to an element of $Za$, returns an element of $Ra$.
--
Theorem 550: (F in RaCauchy) imp ((H in Za) imp (F~[H] in Ra)). Proof:
Suppose_not(f,h) ==> AUTO
    T539(*) ==> f in RaSeq
(f,h)-->T540 ==> false; Discharge ==> QED
--
-- For every Cauchy sequence $f$, there is a subscript $k$ past which the
-- distance between any two images $f~[i],f~[j]$ is no larger than any fixed
-- positive rational.
--
Theorem 551: ((Eps in Ra) & (Eps Ra_GT Ra_0) & (F in RaCauchy)) imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (not (Ra_ABS((F~[i]) Ra_MINUS (F~[j]))) Ra_GT Eps))). Proof+:
Suppose_not(eps,f) ==> AUTO
	Use_def(RaCauchy) ==> Stat1: (f in {g: g in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps }))}) &
		(eps in Ra) & (eps Ra_GT Ra_0) &
		Stat2: (not(EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (not (Ra_ABS((F~[i]) Ra_MINUS (F~[j]))) Ra_GT eps))))
	g-->Stat1(Stat1*) ==> (f = g) & (g in RaSeq) & (FORALL eps1 in Ra | (eps1 Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((g~[i]) Ra_MINUS (g~[j])) Ra_GT eps1 }))
	EQUAL ==> Stat3: (FORALL eps1 in Ra | (eps1 Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps1 }))
	eps-->Stat3(Stat1*) ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps })
	APPLY() cauchyseq_lemma2(R(i,j)->(Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps)) ==>
		Stat4: (EXISTS k in Za | (FORALL i in Za, j in Za | (((i incs k) & (j incs k)) imp (not(Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps)))))
	k-->Stat4(Stat4*) ==> (k in Za) & Stat5: (FORALL i in Za, j in Za | ((i incs k) & (j incs k)) imp (not(Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps)))
	k-->Stat2(Stat4*) ==> Stat6: not (FORALL i in Za, j in Za | (((i notin k) & (j notin k)) imp (not (Ra_ABS((f~[i]) Ra_MINUS (f~[j]))) Ra_GT eps)))
	(i,j)-->Stat6(Stat6*) ==> Stat7: (i in Za) & (j in Za) & (i notin k) & (j notin k) & (Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps)
	(i,j)-->Stat5(Stat3*) ==> ((i incs k) & (j incs k)) imp (not(Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps))
	(Stat7*)ELEM ==> (not((i incs k) & (j incs k)))
	T206(*) ==> Ord(Za) & Ord(i) & Ord(j) & Ord(k)
	(k,i)-->T35(*) ==> (i incs k)
	(k,j)-->T35(*) ==> false; Discharge ==> QED
--
-- It is easily seen that the preceding assertion can be reformulated to assert that
-- there is a subscript $k$ past which the
-- distance between any two images $f~[i],f~[j]$ is smaller than any fixed
-- positive rational.
--
 Theorem 552: ((Eps in Ra) & (Eps Ra_GT Ra_0) & (F in RaCauchy)) imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (Eps Ra_GT (Ra_ABS((F~[i]) Ra_MINUS (F~[j])))) )). Proof:
    Suppose_not(eps,f) ==> (f in RaCauchy) & (eps in Ra) & (eps Ra_GT Ra_0) & Stat1: (not(EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (eps Ra_GT (Ra_ABS((f~[i]) Ra_MINUS (f~[j])))) )))
    eps-->T523 ==> Stat2: (EXISTS eps0 in Ra | ((eps Ra_GT eps0) & (eps0 Ra_GT Ra_0)))
    eps0-->Stat2 ==> (eps0 in Ra) & (eps Ra_GT eps0) & (eps0 Ra_GT Ra_0)
    (eps0,f)-->T551 ==> Stat3: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (not (Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps0))))
    k-->Stat3 ==> (k in Za) & Stat4: (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (not (Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps0)))
    k-->Stat1 ==> Stat5: not(FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (eps Ra_GT (Ra_ABS((f~[i]) Ra_MINUS (f~[j])))))
--
-- Thus we have a positive $eps0$ smaller than $eps$, and a $k$ such that $Ra_ABS((f~[i]) Ra_MINUS (f~[j]))$ is no larger than $eps0$
-- if $i$ and $j$ are both larger than $k$.
--
    (i,j)-->Stat5 ==> (i in Za) & (j in Za) & (i notin k) & (j notin k) & (not(eps Ra_GT (Ra_ABS((f~[i]) Ra_MINUS (f~[j])))))
    (i,j)-->Stat4 ==> not(Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps0)
    T539(*) ==> f in RaSeq
    (f,i)-->T540 ==> f~[i] in Ra
    (f,j)-->T540 ==> f~[j] in Ra
	ALGEBRA ==> (f~[i]) Ra_MINUS (f~[j]) in Ra
	((f~[i]) Ra_MINUS (f~[j]))-->T527 ==> Ra_ABS((f~[i]) Ra_MINUS (f~[j])) in Ra
    (Ra_ABS((f~[i]) Ra_MINUS (f~[j])),eps0)-->T476 ==> (eps0 Ra_GT Ra_ABS((f~[i]) Ra_MINUS (f~[j]))) or (eps0 = Ra_ABS((f~[i]) Ra_MINUS (f~[j])))
	(eps0,Ra_ABS((f~[i]) Ra_MINUS (f~[j])))-->T474 ==> eps0 Ra_GE (Ra_ABS((f~[i]) Ra_MINUS (f~[j])))
	(eps,eps0,Ra_ABS((f~[i]) Ra_MINUS (f~[j])))-->T497 ==> eps Ra_GT Ra_ABS((f~[i]) Ra_MINUS (f~[j]))
	Discharge ==> QED
--
-- In preparation for proving that the relation $Ra_eqseq(F,G)$ between rational sequences
-- is an equivalence relation, we now establish the following assertion, involving a hybrid
-- of transitivity and symmetry:
--
Theorem 553: (({F,G,H} incin RaSeq) & Ra_eqseq(F,G) & Ra_eqseq(G,H)) imp Ra_eqseq(H,F). Proof:
Suppose_not(f,g,k) ==> AUTO
--
-- For, assuming $f,g,k$ to be a counterexample to our
-- conclusion, we can derive a contradiction from the fact that the set
--	${x : x in domain(k) | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps}$
-- can be infinite for some positive value of $eps$, unlike the corresponding
-- sets which have $f,g$ and $g,k$ in place of $k,f$ respectively.
--
	Use_def(Ra_eqseq) ==> (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in domain(f) | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps})) &
		(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in domain(g) | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps})) &
		(not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({x : x in domain(k) | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps})))
--
-- Noting that $f,g,k$ have $Za$ as their common domain,
-- and have all of their images in $Ra$, we can restate
-- our hypothesis more simply.
--
	f-->T546 ==> (domain(f) = Za) & Svm(f)
	g-->T546 ==> (domain(g) = Za) & Svm(g)
	k-->T546 ==> (domain(k) = Za) & Svm(k)
	EQUAL ==> Stat1: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps})) &
		Stat2: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps})) &
		Stat3: (not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({x : x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps})))
--
-- Let $eps0$ be a positive value for $eps$ which makes the set
-- indicated above infinite; moreover, let $eps1,eps2$ be smaller
-- positive values whose addition is smaller than $eps0$ (e.g.,
-- one could take $eps1=eps2$ to be one half or one third of $eps0$).
-- We have assumed the finiteness of the two sets
--	${x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1}$,
--	${x : x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2}$.
--
	eps0-->Stat3 ==> (eps0 in Ra) & (eps0 Ra_GT Ra_0) &
		(not Finite({x : x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0}))
	eps0-->T522 ==> Stat4: (EXISTS e in Ra, e0 in Ra | (eps0 Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e Ra_GT Ra_0) & (eps0 Ra_GT (e Ra_PLUS e0)))
	(eps1,eps2)-->Stat4 ==> (eps1 in Ra) & (eps2 in Ra) & (eps0 Ra_GT eps1) & (eps1 Ra_GT eps2) & (eps2 Ra_GT Ra_0) & (eps1 Ra_GT Ra_0) & (eps0 Ra_GT (eps1 Ra_PLUS eps2))
	eps1-->Stat1 ==> Finite({x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1})
	eps2-->Stat2 ==> Finite({x : x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2})
--
-- Due to the inequality
--	$Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_LE (Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_PLUS Ra_ABS((g~[x]) Ra_MINUS (k~[x])))$,
-- it turns out that the set
--	${x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0}$
-- is included in the union of the two sets
--	${x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1}$,
--	${x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2}$,
-- both of which must be finite, in consequence of the assumptions made.
--
	Suppose ==> Stat5: not({x : x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0} incin ({x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1} + {x : x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2}))
            x-->Stat5 ==> Stat6: (x in {x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0}) & Stat7: (x notin {x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1}) & Stat8: (x notin {x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2})
            ()-->Stat6 ==> (x in Za) & (Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0)
        	(f,x)-->T540 ==> f~[x] in Ra
        	(g,x)-->T540 ==> g~[x] in Ra
        	(k,x)-->T540 ==> k~[x] in Ra
            ()-->Stat7 ==> not(Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1)
            ()-->Stat8 ==> not(Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2)
            ALGEBRA ==> (((f~[x]) Ra_MINUS (g~[x])) in Ra) & (((g~[x]) Ra_MINUS (k~[x])) in Ra) & (((f~[x]) Ra_MINUS (k~[x])) in Ra) & (((k~[x]) Ra_MINUS (f~[x])) in Ra) & ((eps1 Ra_PLUS eps2) in Ra)
            ((f~[x]) Ra_MINUS (g~[x]))-->T527 ==> Ra_ABS((f~[x]) Ra_MINUS (g~[x])) in Ra
            ((g~[x]) Ra_MINUS (k~[x]))-->T527 ==> Ra_ABS((g~[x]) Ra_MINUS (k~[x])) in Ra
            ((k~[x]) Ra_MINUS (f~[x]))-->T527 ==> Ra_ABS((k~[x]) Ra_MINUS (f~[x])) in Ra
            ALGEBRA ==> (Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_PLUS Ra_ABS((g~[x]) Ra_MINUS (k~[x]))) in Ra
            (Ra_ABS((f~[x]) Ra_MINUS (g~[x])), eps1)-->T473 ==> (eps1 Ra_GE Ra_ABS((f~[x]) Ra_MINUS (g~[x])))
            (Ra_ABS((g~[x]) Ra_MINUS (k~[x])), eps2)-->T473 ==> (eps2 Ra_GE Ra_ABS((g~[x]) Ra_MINUS (k~[x])))
            T525 ==> Stat9: (FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (Ra_ABS((x Ra_PLUS Ra_Rev(z))) Ra_LE (Ra_ABS(x Ra_PLUS Ra_Rev(y)) Ra_PLUS Ra_ABS(y Ra_PLUS Ra_Rev(z))))) &
			Stat10: (FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_Rev(x Ra_PLUS Ra_Rev(y)) = (y Ra_PLUS Ra_Rev(x)))) &
			Stat11: (FORALL x | (x in Ra) imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
            (f~[x], g~[x], k~[x])-->Stat9 ==> Ra_ABS((f~[x]) Ra_PLUS Ra_Rev(k~[x])) Ra_LE (Ra_ABS((f~[x]) Ra_PLUS Ra_Rev(g~[x])) Ra_PLUS Ra_ABS((g~[x]) Ra_PLUS Ra_Rev(k~[x])))
            (f~[x], k~[x])-->Stat10 ==> Ra_Rev((f~[x]) Ra_PLUS Ra_Rev(k~[x])) = ((k~[x]) Ra_PLUS Ra_Rev(f~[x]))
            Use_def(Ra_MINUS) ==> ((f~[x]) Ra_PLUS Ra_Rev(k~[x])) in Ra
            ((f~[x]) Ra_PLUS Ra_Rev(k~[x]))-->Stat11 ==> Ra_ABS(Ra_Rev((f~[x]) Ra_PLUS Ra_Rev(k~[x]))) = Ra_ABS((f~[x]) Ra_PLUS Ra_Rev(k~[x]))
            Use_def(Ra_MINUS) ==> (((f~[x]) Ra_PLUS Ra_Rev(k~[x])) = ((f~[x]) Ra_MINUS (k~[x]))) & (((f~[x]) Ra_PLUS Ra_Rev(g~[x])) = ((f~[x]) Ra_MINUS (g~[x]))) & (((g~[x]) Ra_PLUS Ra_Rev(k~[x])) = ((g~[x]) Ra_MINUS (k~[x]))) & (((k~[x]) Ra_PLUS Ra_Rev(f~[x])) = ((k~[x]) Ra_MINUS (f~[x])))
            EQUAL ==> Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_LE (Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_PLUS Ra_ABS((g~[x]) Ra_MINUS (k~[x])))
            (Ra_ABS((k~[x]) Ra_MINUS (f~[x])), Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_PLUS Ra_ABS((g~[x]) Ra_MINUS (k~[x])))-->T473 ==> (Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_PLUS Ra_ABS((g~[x]) Ra_MINUS (k~[x]))) Ra_GE Ra_ABS((k~[x]) Ra_MINUS (f~[x]))
            (eps1, Ra_ABS((f~[x]) Ra_MINUS (g~[x])), eps2, Ra_ABS((g~[x]) Ra_MINUS (k~[x])))-->T493 ==> (eps1 Ra_PLUS eps2) Ra_GE (Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_PLUS Ra_ABS((g~[x]) Ra_MINUS (k~[x])))
            (eps1 Ra_PLUS eps2, Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_PLUS Ra_ABS((g~[x]) Ra_MINUS (k~[x])), Ra_ABS((k~[x]) Ra_MINUS (f~[x])))-->T508 ==> (eps1 Ra_PLUS eps2) Ra_GE (Ra_ABS((k~[x]) Ra_MINUS (f~[x])))
            (eps0, eps1 Ra_PLUS eps2, Ra_ABS((k~[x]) Ra_MINUS (f~[x])))-->T509 ==> eps0 Ra_GT (Ra_ABS((k~[x]) Ra_MINUS (f~[x])))
            (Ra_ABS((k~[x]) Ra_MINUS (f~[x])), eps0)-->T473 ==> (Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GE eps0)
            (eps0, Ra_ABS((k~[x]) Ra_MINUS (f~[x])), eps0)-->T509 ==> eps0 Ra_GT eps0
	(eps0,eps0)-->T473 ==> false; Discharge ==> {x : x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0} incin ({x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1} + {x : x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2})
	TELEM ==> Svm({x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1}) &
		(range({x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1}) = {x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1}) & (domain({x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1}) = {x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1}) &
		Svm({x : x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2}) & (range({x : x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2}) = {x : x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2}) & (domain({x : x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2}) = {x : x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2})
	({x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1})-->T192 ==> Finite({x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1})
	({x : x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2})-->T192 ==> Finite({x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2})
--
-- Accordingly, since the sets
--	${x : x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0}$,
--	${x : x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0}$
-- have the same cardinality, they must both be finite, which contradicts
-- our assumption that the former of them is infinite. This contradiction
-- leads to the desired conclusion.
--
	({x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1}, {x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2})-->T236 ==> Finite({x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1} + {x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2})
	({x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps1} + {x in Za | Ra_ABS((g~[x]) Ra_MINUS (k~[x])) Ra_GT eps2}, {x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0})-->T189 ==> Finite({x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0})
	TELEM ==> Svm({x : x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0}) & (domain({x : x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0}) = {x : x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0}) & (range({x : x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0}) = {x : x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0})
	({x : x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0})-->T192 ==> Finite({x : x in Za | Ra_ABS((k~[x]) Ra_MINUS (f~[x])) Ra_GT eps0})
Discharge ==> QED
--
-- To prepare for showing that the set of rational Cauchy sequences is closed
-- under the pointwise algebraic operations introduced above, we prove that
-- these operations map rational sequences to rational sequences.
--
Theorem 554: ({F,G} incin RaSeq) imp
	(((F Ras_PLUS G) in RaSeq) &
		(Ras_ABS(G) in RaSeq) &
		(Ras_Rev(G) in RaSeq) &
		((F Ras_TIMES G) in RaSeq) &
		((F Ras_PLUS G) = {[u,((F~[u]) Ra_PLUS  (G~[u]))]: u in Za}) &
		(Ras_ABS(G) = {[u,Ra_ABS(G~[u])]: u in Za}) &
		(Ras_Rev(G) = {[u,Ra_Rev(G~[u])]: u in Za}) &
		((F Ras_TIMES G) = {[u,((F~[u]) Ra_TIMES (G~[u]))]: u in Za})). Proof:
Suppose_not(fq,fp) ==> AUTO
--
-- Reasoning by contradiction, assume that $fq,fp$ form a counterexample
-- to the desired statement.
--
        fq-->T546(*) ==> Stat1: (domain(fq) = Za) & Svm(fq) & (range(fq) incin Ra)
        fp-->T546(*) ==> Stat2: (domain(fp) = Za) & Svm(fp) & (range(fp) incin Ra)
        Use_def(Ras_PLUS) ==> (fq Ras_PLUS  fp) = {[car(p),cdr(p) Ra_PLUS  (fp~[car(p)])]: p in fq}
        Use_def(Ras_ABS(fp)) ==> AUTO
        Use_def(Ras_Rev(fp)) ==> AUTO
        Use_def(Ras_TIMES) ==> (fq Ras_TIMES fp) = {[car(p),cdr(p) Ra_TIMES (fp~[car(p)])]: p in fq}
--
-- After unfolding the definitions which are directly involved,
-- we recall that $Ra$ is closed under addition, multiplication, sign inversion,
-- and absolute value operation. This allows us to invoke the THEORY 'pointwise'
-- ('pointwiseU' in the monadic case) for each one of these four operations,
-- thereby leading to the desired contradiction.
--
        Suppose ==> Stat3: not(FORALL x in Ra, y in Ra | (x Ra_PLUS y) in Ra)
            (x1,y1)-->Stat3 ==> Stat4: (x1 in Ra) & (y1 in Ra) & ((x1 Ra_PLUS y1) notin Ra)
        ALGEBRA(Stat4) ==> (x1 Ra_PLUS y1) in Ra; Discharge ==> AUTO
        Suppose ==> Stat5: not(FORALL x in Ra, y in Ra | (x Ra_TIMES y) in Ra)
            (x2,y2)-->Stat5 ==> Stat6: (x2 in Ra) & (y2 in Ra) & ((x2 Ra_TIMES y2) notin Ra)
        ALGEBRA(Stat6) ==> (x2 Ra_TIMES y2) in Ra; Discharge ==> AUTO
        Suppose ==> Stat7: not(FORALL x in Ra | Ra_ABS(x) in Ra)
            x3-->Stat7 ==> (x3 in Ra) & (Ra_ABS(x3) notin Ra)
        x3-->T527 ==> false; Discharge ==> AUTO
        Suppose ==> Stat8: not(FORALL x in Ra | Ra_Rev(x) in Ra)
            x4-->Stat8 ==> Stat9: (x4 in Ra) & (Ra_Rev(x4) notin Ra)
        ALGEBRA(Stat9) ==> Ra_Rev(x4) in Ra; Discharge ==> AUTO
        APPLY() pointwise(fq->fq,fp->fp,h->(fq Ras_PLUS fp),d->Za,r->Ra,bop(x,y)->(x Ra_PLUS y)) ==>
	Stat10:	((fq Ras_PLUS  fp) = {[u,((fq~[u]) Ra_PLUS  (fp~[u]))]: u in Za}) &
                Svm(fq Ras_PLUS  fp) & (domain(fq Ras_PLUS  fp) = Za) & (range(fq Ras_PLUS fp) incin Ra)
        APPLY() pointwise(fq->fq,fp->fp,h->(fq Ras_TIMES fp),d->Za,r->Ra,bop(x,y)->(x Ra_TIMES y)) ==>
	Stat11:	((fq Ras_TIMES fp) = {[u,((fq~[u]) Ra_TIMES (fp~[u]))]: u in Za}) &
                Svm(fq Ras_TIMES fp) & (domain(fq Ras_TIMES fp) = Za) & (range(fq Ras_TIMES fp) incin Ra)
        APPLY() pointwiseU(fp->fp,h->Ras_ABS(fp),d->Za,r->Ra,uop(x)->Ra_ABS(x)) ==>
	Stat12:	(Ras_ABS(fp) = {[u,Ra_ABS(fp~[u])]: u in Za}) &
                Svm(Ras_ABS(fp)) & (domain(Ras_ABS(fp)) = Za) & (range(Ras_ABS(fp)) incin Ra)
        APPLY() pointwiseU(fp->fp,h->Ras_Rev(fp),d->Za,r->Ra,uop(x)->Ra_Rev(x)) ==>
	Stat13:	(Ras_Rev(fp) = {[u,Ra_Rev(fp~[u])]: u in Za}) &
                Svm(Ras_Rev(fp)) & (domain(Ras_Rev(fp)) = Za) & (range(Ras_Rev(fp)) incin Ra)
        Use_def(RaSeq) ==> ((fq Ras_PLUS  fp) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}) or
                           ((fq Ras_TIMES fp) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}) or
                           (Ras_ABS(fp) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}) or
                           (Ras_Rev(fp) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)})
        Suppose ==> Stat14: Ras_ABS(fp) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}
            Use_def(Svm(Ras_ABS(fp))) ==> AUTO
            (Ras_ABS(fp),Za,Ra)-->T141(Stat12*) ==> Ras_ABS(fp) incin (Za PROD Ra)
        ()-->Stat14(Stat12*) ==> false; Discharge ==> ((fq Ras_PLUS fp) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}) or
                                ((fq Ras_TIMES fp) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}) or
                                (Ras_Rev(fp) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)})
        Suppose ==> Stat15: ((fq Ras_TIMES fp) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)})
            Use_def(Svm(fq Ras_TIMES fp)) ==> AUTO
            (fq Ras_TIMES fp,Za,Ra)-->T141(Stat11*) ==> (fq Ras_TIMES fp) incin (Za PROD Ra)
        ()-->Stat15(Stat11*) ==> false; Discharge ==> ((fq Ras_PLUS fp) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}) or
                                (Ras_Rev(fp) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)})
        Suppose ==> Stat16: ((fq Ras_PLUS fp) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)})
            Use_def(Svm(fq Ras_PLUS fp)) ==> AUTO
            (fq Ras_PLUS fp,Za,Ra)-->T141(Stat10*) ==> (fq Ras_PLUS fp) incin (Za PROD Ra)
        ()-->Stat16(Stat10*) ==> false; Discharge ==> Stat17: Ras_Rev(fp) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}
        Use_def(Svm(Ras_Rev(fp))) ==> AUTO
        (Ras_Rev(fp),Za,Ra)-->T141(Stat13*) ==> Ras_Rev(fp) incin (Za PROD Ra)
()-->Stat17(Stat13*) ==> false; Discharge ==> QED
--
-- It will often be convenient to use the following simplified (and partly repeated) consequences of the preceding result.
--
Theorem 555: (({F1,G1} incin RaSeq) & (N in Za)) imp ((F1~[N] in Ra) & (G1~[N] in Ra) &
		((F1 Ras_PLUS G1 in RaSeq) & ((F1 Ras_PLUS G1)~[N] = (F1~[N]) Ra_PLUS (G1~[N]))) &
		(((Ras_ABS(G1) in RaSeq) & (Ras_ABS(G1)~[N] = Ra_ABS(G1~[N])))) &
		(((Ras_Rev(G1) in RaSeq) & (Ras_Rev(G1)~[N] = Ra_Rev(G1~[N])))) &
		(((F1 Ras_TIMES G1 in RaSeq) & (F1 Ras_TIMES G1)~[N] = ((F1~[N]) Ra_TIMES (G1~[N]))))). Proof:
Suppose_not(f1,g1,n) ==> AUTO
	ELEM ==> Stat1: n in Za
	(f1,n)-->T540(*) ==> (f1~[n]) in Ra
	(g1,n)-->T540(*) ==> (g1~[n]) in Ra
	(f1,g1)-->T554(*) ==> ((f1 Ras_PLUS g1) in RaSeq) & (Ras_ABS(g1) in RaSeq) &
		(Ras_Rev(g1) in RaSeq) & ((f1 Ras_TIMES g1) in RaSeq) &
		 ((f1 Ras_PLUS g1) = {[n,((f1~[n]) Ra_PLUS  (g1~[n]))]: n in Za}) &
		(Ras_ABS(g1) = {[n,Ra_ABS(g1~[n])]: n in Za}) &
		(Ras_Rev(g1) = {[n,Ra_Rev(g1~[n])]: n in Za}) &
		((f1 Ras_TIMES g1) = {[n,((f1~[n]) Ra_TIMES (g1~[n]))]: n in Za})
	APPLY() fcn_symbol(f(x)->((f1~[x]) Ra_PLUS (g1~[x])),g->f1 Ras_PLUS g1,s->Za) ==> Stat2: (FORALL x | (x in Za) imp (((f1 Ras_PLUS g1)~[x]) = ((f1~[x]) Ra_PLUS (g1~[x]))))
	APPLY() fcn_symbol(f(x)->Ra_ABS(g1~[x]),g->Ras_ABS(g1),s->Za) ==> Stat3: (FORALL x | (x in Za) imp ((Ras_ABS(g1)~[x]) = Ra_ABS(g1~[x])))
	APPLY() fcn_symbol(f(x)->Ra_Rev(g1~[x]),g->Ras_Rev(g1),s->Za) ==> Stat4: (FORALL x | (x in Za) imp ((Ras_Rev(g1)~[x]) = Ra_Rev(g1~[x])))
	APPLY() fcn_symbol(f(x)->((f1~[x]) Ra_TIMES (g1~[x])),g->f1 Ras_TIMES g1,s->Za) ==> Stat5: (FORALL x | (x in Za) imp (((f1 Ras_TIMES g1)~[x]) = ((f1~[x]) Ra_TIMES (g1~[x]))))
--
	n-->Stat2(Stat1,Stat1*) ==> ((f1 Ras_PLUS g1)~[n]) = ((f1~[n]) Ra_PLUS (g1~[n]))
	n-->Stat3(Stat1,Stat1*) ==> (Ras_ABS(g1)~[n]) = Ra_ABS(g1~[n])
	n-->Stat4(Stat1,Stat1*) ==> (Ras_Rev(g1)~[n]) = Ra_Rev(g1~[n])
	n-->Stat5(Stat1,Stat1*) ==> ((f1 Ras_TIMES g1)~[n]) = ((f1~[n]) Ra_TIMES (g1~[n]));
	Discharge ==> QED
--
-- We prove next that the set of rational Cauchy sequences is closed
-- under the pointwise algebraic operations introduced above.
--
Theorem 556: ({F,G} incin RaCauchy) imp
	(((F Ras_PLUS G) in RaCauchy) & (Ras_ABS(F) in RaCauchy) & (Ras_Rev(F) in RaCauchy)). Proof:
Suppose_not(fq,fp) ==> AUTO
--
-- For suppose that $fq,fp$ form a counterexample to our assertion.
--
	Use_def(RaCauchy) ==> Stat1: (fq in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
			& Stat2: (fp in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
	()-->Stat1(Stat1*) ==> Stat3: (fq in RaSeq) & Stat4: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps }))
	()-->Stat2(Stat1*) ==> Stat5: (fp in RaSeq) & Stat6: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps }))
	(fq,fp)-->T554(Stat1*) ==> Stat7: ((fq Ras_PLUS fp) in RaSeq)
	(fq,fq)-->T554(Stat1*) ==> Stat8: (Ras_ABS(fq) in RaSeq) & (Ras_Rev(fq) in RaSeq)
--
-- Using the definitions of the functions involved,
-- and since, by the preceding theorem, our pointwise operations of rational
-- sequences produce rational sequences, we can argue as follows:
--
	Suppose ==> (fq Ras_PLUS fp) notin RaCauchy
--
-- Assuming that $fq Ras_PLUS fp$ is not a Cauchy sequence (unlike
-- $fq$ and $fp$), there would exist a positive real $eps0$ for which
-- the set
--	${ i * j : i in Za, j in Za | Ra_ABS(((fq Ras_PLUS fp)~[i]) Ra_MINUS ((fq Ras_PLUS fp)~[j])) Ra_GT eps0 }$
-- is infinite, unlike the analogous sets which have $fq$ and $fp$, respectively,
-- in place of $fq Ras_PLUS fp$, and positive rationals $eps1$ and $eps2$ smaller than
-- one half of $eps0$ in place of $eps0$.
--
            Use_def(RaCauchy) ==> Stat9: (fq Ras_PLUS fp) notin {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
            ()-->Stat9 ==> Stat10: not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS(((fq Ras_PLUS fp)~[i]) Ra_MINUS ((fq Ras_PLUS fp)~[j])) Ra_GT eps }))
            eps0-->Stat10(Stat10) ==> Stat11: (eps0 in Ra) & (eps0 Ra_GT Ra_0) & (not(
		Finite({ i * j : i in Za, j in Za | Ra_ABS(((fq Ras_PLUS fp)~[i]) Ra_MINUS ((fq Ras_PLUS fp)~[j])) Ra_GT eps0 })))
            eps0-->T522 ==> Stat12: (EXISTS e in Ra, e0 in Ra | (eps0 Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e Ra_GT Ra_0) & (eps0 Ra_GT (e Ra_PLUS e0)))
            (eps1,eps2)-->Stat12 ==> Stat13: (eps1 in Ra) & (eps2 in Ra) & (eps2 Ra_GT Ra_0) & (eps1 Ra_GT Ra_0) & (eps0 Ra_GT (eps1 Ra_PLUS eps2))
            eps1-->Stat4 ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps1 })
            eps2-->Stat6 ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps2 })
--
-- However, this assumption would lead to conflict with the inequality (holding for all $i,j$)
--	$Ra_ABS((fq Ras_PLUS fp)~[i] Ra_MINUS (fq Ras_PLUS fp)~[j]) Ra_LE Ra_ABS((fq~[i] Ra_MINUS fq~[j]) Ras_PLUS (fp~[i] Ra_MINUS fq~[j]))$.
--
            APPLY() setformer_meet_join(s->Za, t->Za, h(i,j)->(i*j), R(i,j)->(Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps1), Q(i,j)->(Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps2)) ==>
		{(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps1) or (Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps2)} = ({(i*j): i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps1 } + {(i*j): i in Za, j in Za | Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps2 })
            ({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps1 }, { i * j : i in Za, j in Za | Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps2 })-->T189 ==> Finite({(i*j): i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps1 } + {(i*j): i in Za, j in Za | Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps2 })
            EQUAL ==> Finite({(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps1) or (Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps2)})
            Suppose ==> Stat14: { i * j : i in Za, j in Za | Ra_ABS(((fq Ras_PLUS fp)~[i]) Ra_MINUS ((fq Ras_PLUS fp)~[j])) Ra_GT eps0 } nincin {(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps1) or (Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps2)}
                (i0,j0)-->Stat14 ==> Stat15: (i0 in Za) & (j0 in Za) & (Ra_ABS(((fq Ras_PLUS fp)~[i0]) Ra_MINUS ((fq Ras_PLUS fp)~[j0])) Ra_GT eps0) & (not(Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_GT eps1)) & (not(Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_GT eps2))
		(fq,fp,i0)-->T555(Stat3,Stat5,Stat15*) ==> Stat16: (fq~[i0] in Ra) & (fp~[i0] in Ra) & (((fq Ras_PLUS fp)~[i0]) = ((fq~[i0]) Ra_PLUS (fp~[i0])))
		(fq,fp,j0)-->T555(Stat3,Stat5,Stat15*) ==> (fq~[j0] in Ra) & (fp~[j0] in Ra) & (((fq Ras_PLUS fp)~[j0]) = ((fq~[j0]) Ra_PLUS (fp~[j0])))
                EQUAL(Stat14) ==> Ra_ABS((((fq~[i0]) Ra_PLUS (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_PLUS (fp~[j0])))) Ra_GT eps0
                ALGEBRA(Stat16) ==> (((fq~[i0]) Ra_MINUS (fq~[j0])) in Ra) &
			(((fp~[i0]) Ra_MINUS (fp~[j0])) in Ra) &
			(((((fq~[i0]) Ra_PLUS (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_PLUS (fp~[j0])))) = (((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0]))))
                ((fq~[i0]) Ra_MINUS (fq~[j0]))-->T527 ==> Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) in Ra
                ((fp~[i0]) Ra_MINUS (fp~[j0]))-->T527(Stat14) ==> Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) in Ra
                (Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])), eps1)-->T473(Stat13*) ==> eps1 Ra_GE Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))
                (Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])), eps2)-->T473(Stat13*) ==> eps2 Ra_GE Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))
                ALGEBRA(Stat13,Stat13) ==> (eps1 Ra_PLUS eps2) in Ra
		ALGEBRA(Stat16) ==> ((Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) in Ra) &
			((((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0]))) in Ra)
                (((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0])))-->T527(Stat14) ==> Ra_ABS(((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0]))) in Ra
                (eps1, Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])), eps2, Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])))-->T493(Stat13*) ==> (eps1 Ra_PLUS eps2) Ra_GE (Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])))
                T525(Stat14) ==> Stat17: (FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_ABS(x Ra_PLUS y) Ra_LE (Ra_ABS(x) Ra_PLUS Ra_ABS(y))))
                ((fq~[i0]) Ra_MINUS (fq~[j0]), (fp~[i0]) Ra_MINUS (fp~[j0]))-->Stat17(Stat14) ==> Ra_ABS(((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_LE (Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])))
                (Ra_ABS(((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0]))), (Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))))-->T473(Stat14) ==> (Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_GE Ra_ABS(((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0])))
                (eps1 Ra_PLUS eps2, (Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))), Ra_ABS(((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0]))))-->T508(Stat14) ==> (eps1 Ra_PLUS eps2) Ra_GE Ra_ABS(((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0])))
                EQUAL(Stat15) ==> Ra_ABS(((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_GT eps0
                ((Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))), Ra_ABS(((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0]))), eps0)-->T510(Stat11*) ==> ((Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])))) Ra_GT eps0
                (eps1 Ra_PLUS eps2, (Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))), eps0)-->T510(Stat11*) ==> (eps1 Ra_PLUS eps2) Ra_GT eps0
                (eps1 Ra_PLUS eps2, eps0)-->T473(Stat11*) ==> (eps1 Ra_PLUS eps2) Ra_GE eps0
                (eps0, eps1 Ra_PLUS eps2, eps0)-->T509(Stat11*) ==> eps0 Ra_GT eps0
            (eps0,eps0)-->T473(Stat11*) ==> false; Discharge ==> AUTO
--
-- Since the inclusion just proves entails that the set on the left-hand side is finite,
-- we have reached a contradiction, proving that the pointwise sum of rational Cauchy sequences
-- is an alike sequence.
--
	({(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps1) or (Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps2)}, { i * j : i in Za, j in Za | Ra_ABS(((fq Ras_PLUS fp)~[i]) Ra_MINUS ((fq Ras_PLUS fp)~[j])) Ra_GT eps0 })-->T189(Stat11) ==> false; Discharge ==>
		(Ras_ABS(fq) notin RaCauchy) or (Ras_Rev(fq) notin RaCauchy)
--
-- Assuming next that $Ras_ABS(fq)$ is not a Cauchy sequence (unlike $fq$),
-- there would exist a positive real $eps3$ for which the set
--	${ i * j : i in Za, j in Za | Ra_ABS((Ras_ABS(fq)~[i]) Ra_MINUS (Ras_ABS(fq)~[j])) Ra_GT eps3 }$
-- is infinite, unlike the analogous set having $fq$ in place of $Ras_ABS(fq)$.
-- However, this would lead to a conflict with the inequality (holding for all $i,j$)
--	$Ra_ABS(Ras_ABS(fq)~[i] Ra_MINUS Ras_ABS(fq)~[j]) Ra_LE Ra_ABS(fq~[i] Ra_MINUS fq~[j])$.
--
        Suppose ==> Ras_ABS(fq) notin RaCauchy
            Use_def(RaCauchy) ==> Stat18: Ras_ABS(fq) notin {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
            ()-->Stat18 ==> Stat19: not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((Ras_ABS(fq)~[i]) Ra_MINUS (Ras_ABS(fq)~[j])) Ra_GT eps }))
            eps3-->Stat19 ==> (eps3 in Ra) & (eps3 Ra_GT Ra_0) & (not Finite({ i * j : i in Za, j in Za | Ra_ABS((Ras_ABS(fq)~[i]) Ra_MINUS (Ras_ABS(fq)~[j])) Ra_GT eps3 }))
            eps3-->Stat4 ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps3 })
--
-- Indeed, since
--	${ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps3 }$
-- is a superset of
--	${ i * j : i in Za, j in Za | Ra_ABS(Ra_ABS(fq~[i]) Ra_MINUS Ra_ABS(fq~[j])) Ra_GT eps3 }$,
-- the latter cannot be infinite when the former is finite.
--
            Suppose ==> Stat20: not({ i * j : i in Za, j in Za | Ra_ABS((Ras_ABS(fq)~[i]) Ra_MINUS (Ras_ABS(fq)~[j])) Ra_GT eps3 } incin { i * j : i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps3 })
                (i1,j1)-->Stat20 ==> Stat21: (i1 in Za) & (j1 in Za) & (Ra_ABS((Ras_ABS(fq)~[i1]) Ra_MINUS (Ras_ABS(fq)~[j1])) Ra_GT eps3) & (not(Ra_ABS((fq~[i1]) Ra_MINUS (fq~[j1])) Ra_GT eps3))
		(fq,fq,i1)-->T555(Stat3,Stat21*) ==> ((Ras_ABS(fq)~[i1]) = Ra_ABS(fq~[i1])) & (fq~[i1] in Ra)
		(fq,fq,j1)-->T555(Stat3,Stat21*) ==> ((Ras_ABS(fq)~[j1]) = Ra_ABS(fq~[j1])) & (fq~[j1] in Ra)
		EQUAL(Stat21) ==> Ra_ABS(Ra_ABS(fq~[i1]) Ra_MINUS Ra_ABS(fq~[j1])) Ra_GT eps3
                (fq~[i1])-->T527 ==> Ra_ABS(fq~[i1]) in Ra
                (fq~[j1])-->T527 ==> Ra_ABS(fq~[j1]) in Ra
                ALGEBRA(Stat21) ==> (((fq~[i1]) Ra_MINUS (fq~[j1])) in Ra) & ((Ra_ABS(fq~[i1]) Ra_MINUS Ra_ABS(fq~[j1])) in Ra)
                ((fq~[i1]) Ra_MINUS (fq~[j1]))-->T527 ==> Ra_ABS((fq~[i1]) Ra_MINUS (fq~[j1])) in Ra
                (Ra_ABS(fq~[i1]) Ra_MINUS Ra_ABS(fq~[j1]))-->T527 ==> Ra_ABS(Ra_ABS(fq~[i1]) Ra_MINUS Ra_ABS(fq~[j1])) in Ra
                T525 ==> Stat22: (FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_ABS(Ra_ABS(x) Ra_PLUS Ra_Rev(Ra_ABS(y))) Ra_LE Ra_ABS(x Ra_PLUS Ra_Rev(y))))
                (fq~[i1],fq~[j1])-->Stat22 ==>  (Ra_ABS(Ra_ABS(fq~[i1]) Ra_PLUS Ra_Rev(Ra_ABS(fq~[j1]))) Ra_LE Ra_ABS((fq~[i1]) Ra_PLUS Ra_Rev(fq~[j1])))
                Use_def(Ra_MINUS) ==> Ra_ABS(Ra_ABS(fq~[i1]) Ra_MINUS Ra_ABS(fq~[j1])) Ra_LE Ra_ABS((fq~[i1]) Ra_MINUS (fq~[j1]))
                (Ra_ABS(Ra_ABS(fq~[i1]) Ra_MINUS Ra_ABS(fq~[j1])), Ra_ABS((fq~[i1]) Ra_MINUS (fq~[j1])))-->T473 ==> Ra_ABS((fq~[i1]) Ra_MINUS (fq~[j1])) Ra_GE Ra_ABS(Ra_ABS(fq~[i1]) Ra_MINUS Ra_ABS(fq~[j1]))
            (Ra_ABS((fq~[i1]) Ra_MINUS (fq~[j1])), Ra_ABS(Ra_ABS(fq~[i1]) Ra_MINUS Ra_ABS(fq~[j1])), eps3)-->T510 ==> false; Discharge ==> { i * j : i in Za, j in Za | Ra_ABS((Ras_ABS(fq)~[i]) Ra_MINUS (Ras_ABS(fq)~[j])) Ra_GT eps3 } incin { i * j : i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps3 }
        ({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps3 },  {i * j : i in Za, j in Za | Ra_ABS((Ras_ABS(fq)~[i]) Ra_MINUS (Ras_ABS(fq)~[j])) Ra_GT eps3 })-->T189 ==> false; Discharge ==> Ras_Rev(fq) notin RaCauchy
--
-- Third and last, let us assume that $Ras_Rev(fq)$ is not a Cauchy sequence
-- (unlike $fq$). Then there would exist a positive real $eps4$ for which the set
--	${ i * j : i in Za, j in Za | Ra_ABS(Ras_Rev(fq)~[i] Ra_MINUS Ras_Rev(fq)~[j]) Ra_GT eps4 }$
-- is infinite, unlike the analogous set having $fq$ in place of $Ras_Rev(fq)$.
-- However, this would lead to a conflict with the equality (holding for all $i,j$)
--	$Ra_ABS(Ras_Rev(fq)~[i] Ra_MINUS Ras_Rev(fq)~[j]) = Ra_ABS(fq~[i] Ra_MINUS fq~[j])$.
--
            Use_def(RaCauchy) ==> Stat23: Ras_Rev(fq) notin {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
            ()-->Stat23 ==> Stat24: not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((Ras_Rev(fq)~[i]) Ra_MINUS (Ras_Rev(fq)~[j])) Ra_GT eps }))
            eps4-->Stat24 ==> Stat25: (eps4 in Ra) & (eps4 Ra_GT Ra_0) & (not Finite({ i * j : i in Za, j in Za | Ra_ABS((Ras_Rev(fq)~[i]) Ra_MINUS (Ras_Rev(fq)~[j])) Ra_GT eps4 }))
            eps4-->Stat4 ==> Finite({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps4 })
            EQUAL(Stat25) ==> Stat26: { i * j : i in Za, j in Za | Ra_ABS((Ras_Rev(fq)~[i]) Ra_MINUS (Ras_Rev(fq)~[j])) Ra_GT eps4 } /= { i * j : i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps4 }
            (i2,j2)-->Stat26 ==> Stat27: (i2 in Za) & (j2 in Za) & ((Ra_ABS((Ras_Rev(fq)~[i2]) Ra_MINUS (Ras_Rev(fq)~[j2])) Ra_GT eps4) eq (not(Ra_ABS((fq~[i2]) Ra_MINUS (fq~[j2])) Ra_GT eps4)))
            (fq,fq,i2)-->T555(Stat3,Stat27*) ==> Stat28: ((Ras_Rev(fq)~[i2]) = Ra_Rev(fq~[i2])) & (fq~[i2] in Ra)
            (fq,fq,j2)-->T555(Stat3,Stat27*) ==> ((Ras_Rev(fq)~[j2]) = Ra_Rev(fq~[j2])) & (fq~[j2] in Ra)
            EQUAL(Stat26) ==> Stat29: ((Ra_ABS(Ra_Rev(fq~[i2]) Ra_MINUS Ra_Rev(fq~[j2])) Ra_GT eps4) eq (not(Ra_ABS((fq~[i2]) Ra_MINUS (fq~[j2])) Ra_GT eps4)))
            Suppose ==> Ra_ABS(Ra_Rev(fq~[i2]) Ra_MINUS Ra_Rev(fq~[j2])) /= Ra_ABS((fq~[i2]) Ra_MINUS (fq~[j2]))
		ALGEBRA(Stat28) ==> (Ra_ABS(Ra_Rev(fq~[i2]) Ra_MINUS Ra_Rev(fq~[j2])) = Ra_ABS(Ra_Rev(fq~[i2]) Ra_PLUS Ra_Rev(Ra_Rev(fq~[j2])))) &
				(((fq~[j2]) Ra_PLUS Ra_Rev(fq~[i2])) in Ra) &
				(((fq~[i2]) Ra_PLUS Ra_Rev(fq~[j2])) = ((fq~[i2]) Ra_MINUS (fq~[j2]))) &
				((Ra_Rev(fq~[i2]) Ra_MINUS Ra_Rev(fq~[j2])) = ((fq~[j2]) Ra_PLUS Ra_Rev(fq~[i2]))) &
				(Ra_Rev((fq~[j2]) Ra_PLUS Ra_Rev(fq~[i2])) = ((fq~[i2]) Ra_MINUS (fq~[j2])))
                T525 ==> Stat30: (FORALL x | (x in Ra) imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
                ((fq~[j2]) Ra_PLUS Ra_Rev(fq~[i2]))-->Stat30 ==> Ra_ABS(Ra_Rev((fq~[j2]) Ra_PLUS Ra_Rev(fq~[i2]))) = Ra_ABS((fq~[j2]) Ra_PLUS Ra_Rev(fq~[i2]))
            EQUAL(Stat29) ==> false; Discharge ==> Stat31: Ra_ABS(Ra_Rev(fq~[i2]) Ra_MINUS Ra_Rev(fq~[j2])) = Ra_ABS((fq~[i2]) Ra_MINUS (fq~[j2]))
            Suppose ==> Ra_ABS(Ra_Rev(fq~[i2]) Ra_MINUS Ra_Rev(fq~[j2])) Ra_GT eps4
                EQUAL(Stat31) ==> Ra_ABS((fq~[i2]) Ra_MINUS (fq~[j2])) Ra_GT eps4
            (Stat29)Discharge ==> not(Ra_ABS(Ra_Rev(fq~[i2]) Ra_MINUS Ra_Rev(fq~[j2])) Ra_GT eps4)
            EQUAL(Stat31) ==> not(Ra_ABS((fq~[i2]) Ra_MINUS (fq~[j2])) Ra_GT eps4)
    (Stat29)Discharge ==> QED
--
-- Every finite set of rationals has an upper bound.
--
Theorem 557: ((S incin Ra) & Finite(S)) imp (EXISTS u in Ra | (FORALL y in S | u Ra_GE y)). Proof:
	Suppose_not(s) ==> Stat1: (s incin Ra) & Finite(s) & Stat2: (not(EXISTS u in Ra | (FORALL y in s | u Ra_GE y)))
--
-- For, assuming the contrary of our thesis to hold for a subset $s$ of $Ra$, it is trivial that
-- $s$ is non-void (because $Ra$ is non-void).
--
		Suppose ==> s = 0
			T451 ==> Ra_0 in Ra
			Ra_0--> Stat2 ==> Stat3: not(FORALL y in s | Ra_0 Ra_GE y)
		y0-->Stat3 ==> false; Discharge ==> Stat4: s /= 0
		s-->T0(Stat4*) ==> arb(s) in s
--
-- But then, we can exploit one of the clauses of Theorem 515 to draw the desired contradiction.
--
		T515 ==> Stat5: (FORALL t, x | (Finite(t) & (x in t) & (t incin Ra)) imp ((max_Ra(t) in t) & ((x = max_Ra(t)) or (x Ra_LT max_Ra(t)))))
		(s,arb(s))-->Stat5(Stat1*) ==> max_Ra(s) in Ra
		(max_Ra(s))-->Stat2(Stat5*) ==> Stat6: not(FORALL y in s | max_Ra(s) Ra_GE y)
		y1-->Stat6(Stat6*) ==> (y1 in s) & (not(max_Ra(s) Ra_GE y1))
		(s,y1)-->Stat5(Stat1*) ==> (y1 = max_Ra(s)) or (y1 Ra_LT max_Ra(s))
		(y1,max_Ra(s))-->T473(Stat6*) ==> (y1 = max_Ra(s)) or (max_Ra(s) Ra_GT y1)
	(max_Ra(s),y1)-->T474(Stat1*) ==> false; Discharge ==> QED
--
-- Theorem 557 has the following 'integer' analog, needed below.
--
Theorem 558: [Every finite set of integers has a strict upper bound] ((S incin Za) & Finite(S)) imp (EXISTS u in Za | (FORALL y in S | y in u)). Proof+:
--
--	For supposing that $s$ is a counterexample to the assertion we can easily see that all the members of $s$ must be
--	integers and $s$ itself is finite, from which it follows that $(Un(s) + {Un(s)}) in Za$.
--
Suppose_not(s) ==> (s incin Za) & Finite(s) & Stat1: (not(EXISTS u in Za | (FORALL y in s | y in u)))
	Suppose ==> Stat2: not(FORALL x in s | Ord(x))
		x1-->Stat2 ==> (x1 in Za) & (not Ord(x1))
		ELEM ==> Ord(x1)
	Discharge ==> AUTO
	s-->T280 ==> Stat2a: Ord(Un(s))
	Suppose ==> Stat3: not(FORALL x in s | Finite(x))
		x2-->Stat3(Stat3*) ==> (x2 in s) & (not Finite(x2))
		x2-->T206 ==> false
	Discharge ==> (FORALL x in s | Finite(x))
	s-->T238 ==> Stat3a: Finite(Un(s))
	(Un(s),Un(s))-->T199(Stat3a*) ==> Finite(Un(s) + {Un(s)})
	(Un(s))-->T33(Stat2a*) ==> Ord(Un(s) + {Un(s)})
	(Stat3a*)ELEM ==> (Un(s) + {Un(s)}) in Za
--
--	Hence by our initial assumption there must exist a $y in s$ which is not in $Un(s) + {Un(s)}$.
--	On the other hand $y$ is included in $s$ by definition of union, and since $y$ is not a member of $Un(s)$, while both
--	$y$ and $Un(s)$ are ordinals, it follows that $Un(s)$ is included in $y$, so that $y = Un(s)$ and hence $y in {Un(s)}$,
--	a contradiction which proves our theorem.
--
	(Un(s) + {Un(s)})-->Stat1 ==> Stat4: not(FORALL y in s | y in Un(s) + {Un(s)})
 	y-->Stat4 ==> (y in s) & (not(y in Un(s) + {Un(s)})) & (y in Za) & Ord(y)
	s-->T274 ==> Stat5: (FORALL x in s | x incin Un(s))
	y-->Stat5 ==> y incin Un(s)
	(Un(s),y)-->T31(Stat2a*) ==> Un(s) in y
	(y,Un(s))-->T34 ==> false; Discharge ==> QED
--
-- Every rational Cauchy sequence has an upper bound.
--
Theorem 559: [Every rational Cauchy sequence has an upper bound] (F in RaCauchy) imp (EXISTS x in Ra | (FORALL y in range(F) | y Ra_LE x)). Proof+:
Suppose_not(f) ==> (f in RaCauchy) & Stat1: (not(EXISTS x in Ra | (FORALL y in range(f) | y Ra_LE x) ))
--
-- For let $f$ be a counterexample to our assertion, i.e. a  Cauchy sequence having no upper bound.
-- Let $i0$ be an unsigned integer past which the distance between any two components of $f$ is
-- always smaller than $Ra_1$. Since $i0$ is a finite set and $f$ a single-valued map, the range
-- of $f$ on $i0$ must also be finite.
--
	T539(*) ==> Stat1a: f in RaSeq
	f-->T546 ==> Stat2: (domain(f) = Za) & Svm(f) & (range(f) incin Ra)
	ALGEBRA ==> (Ra_1 in Ra) & (Ra_0 in Ra)
	T481 ==> Ra_1 Ra_GT Ra_0
	(Ra_1,f)-->T552 ==> Stat3: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (Ra_1 Ra_GT Ra_ABS((f~[i]) Ra_MINUS (f~[j]))) ))
	i0-->Stat3 ==> Stat3a: (i0 in Za) & Stat4: (FORALL i in Za, j in Za | ((i notin i0) & (j notin i0)) imp (Ra_1 Ra_GT Ra_ABS((f~[i]) Ra_MINUS (f~[j]))) )
	T206 ==> Ord(Za)
	(Za,i0)-->T13 ==> (i0 incin Za) & Finite(i0)
	(f,i0)-->T80 ==> Stat5: range(f ON i0) incin Ra
	(f,i0)-->T57 ==> Svm(f ON i0)
	(f,i0)-->T94 ==> Stat6: domain(f ON i0) = i0
	EQUAL ==> Finite(domain(f ON i0))
	(f ON i0)-->T192 ==> Stat7: Finite(range(f ON i0))
	(f,i0)-->T126 ==> Stat8: range(f ON i0) = {f~[i]: i in domain(f ON i0)}
	EQUAL(Stat6,Stat8) ==> Stat9: (range(f ON i0) = {f~[i]: i in i0})
	EQUAL(Stat7,Stat5,Stat9) ==> Stat10: Finite({f~[i]: i in i0}) & ({f~[i]: i in i0} incin Ra)
	(f,f,i0)-->T555(Stat1a,Stat3a*) ==> Stat10a: f~[i0] in Ra
	ALGEBRA(Stat10a) ==> Stat12: (Ra_Rev(f~[i0]) in Ra) & ((f~[i0] Ra_PLUS Ra_1) in Ra) &
		((Ra_1 Ra_PLUS (f~[i0])) in Ra) & (Ra_1 Ra_PLUS (f~[i0]) = (f~[i0]) Ra_PLUS Ra_1)
	(f~[i0] Ra_PLUS Ra_1)-->T201(*) ==> Stat11: Finite({f~[i0] Ra_PLUS Ra_1})
--
-- It is easily seen that $f~[i0] Ra_PLUS Ra_1$ is an upper bound for the set $f~[j]$ of components of $f$ for which $j notin i0$.
-- Indeed, let $j$ be a counterexample to this assertion, i.e. $j notin i0$ and $not((f~[i0] Ra_PLUS Ra_1) Ra_GT f~[j])$.
-- But since $Ra_1 Ra_GT ((f~[j]) Ra_PLUS Ra_Rev(f~[i0]))$ we must have $f~[i0] Ra_PLUS Ra_1 Ra_GT f~[j]$,
-- a contradiction proving our claim.
--
	Suppose ==> Stat13: (EXISTS j in Za | ((j notin i0) & (not(((f~[i0]) Ra_PLUS Ra_1) Ra_GT (f~[j])))))
		j-->Stat13 ==> Stat14: (j in Za) & (j notin i0) & Stat15: (not(((f~[i0]) Ra_PLUS Ra_1) Ra_GT (f~[j])))
		(j,i0)-->Stat4 ==> Ra_1 Ra_GT Ra_ABS((f~[j]) Ra_MINUS (f~[i0]))
		Use_def(Ra_MINUS) ==> Ra_1 Ra_GT Ra_ABS((f~[j]) Ra_PLUS Ra_Rev(f~[i0]))
		j-->T71(Stat14,Stat2) ==> Stat16: f~[j] in Ra
		ALGEBRA(Stat10a,Stat16) ==> ((f~[j]) Ra_PLUS Ra_Rev(f~[i0])) in Ra
		((f~[j]) Ra_PLUS Ra_Rev(f~[i0]))-->T527 ==> Ra_ABS((f~[j]) Ra_PLUS Ra_Rev(f~[i0])) in Ra
		((f~[j]) Ra_PLUS Ra_Rev(f~[i0]))-->T527 ==> Ra_ABS((f~[j]) Ra_PLUS Ra_Rev(f~[i0])) Ra_GE ((f~[j]) Ra_PLUS Ra_Rev(f~[i0]))
		(Ra_1,Ra_ABS((f~[j]) Ra_PLUS Ra_Rev(f~[i0])),((f~[j]) Ra_PLUS Ra_Rev(f~[i0])))-->T497 ==> Ra_1 Ra_GT ((f~[j]) Ra_PLUS Ra_Rev(f~[i0]))
		(f~[i0],f~[i0])-->T474 ==> (f~[i0]) Ra_GE (f~[i0])
		(Ra_1,(f~[j]) Ra_PLUS Ra_Rev(f~[i0]),f~[i0],f~[i0])-->T505 ==> (Ra_1 Ra_PLUS (f~[i0])) Ra_GT (((f~[j]) Ra_PLUS Ra_Rev(f~[i0])) Ra_PLUS (f~[i0]))
		ALGEBRA(Stat10a,Stat16) ==> ((((f~[j]) Ra_PLUS Ra_Rev(f~[i0])) Ra_PLUS (f~[i0])) = ((f~[j]) Ra_PLUS (Ra_Rev(f~[i0]) Ra_PLUS (f~[i0])))) &
				(Ra_Rev(f~[i0]) Ra_PLUS (f~[i0]) = Ra_0) &
				((f~[j]) Ra_PLUS Ra_0 = (f~[j]))
	EQUAL(Stat12) ==> false; Discharge ==> Stat17: not (EXISTS j in Za | ((j notin i0) & (not(((f~[i0]) Ra_PLUS Ra_1) Ra_GT (f~[j])))))
--
-- By Theorem 557, the finite set
-- ${f~[i]: i in i0} + {f~[i0] Ra_PLUS Ra_1}$ of rationals has an upper bound $r$.
--
	({f~[i]: i in i0},{f~[i0] Ra_PLUS Ra_1})-->T236(Stat10,Stat11) ==> Finite({f~[i]: i in i0} + {f~[i0] Ra_PLUS Ra_1})
	ELEM ==> ({f~[i]: i in i0} + {f~[i0] Ra_PLUS Ra_1}) incin Ra
	({f~[i]: i in i0} + {f~[i0] Ra_PLUS Ra_1})-->T557 ==> Stat18: (EXISTS u in Ra | (FORALL y in ({f~[i]: i in i0} + {f~[i0] Ra_PLUS Ra_1}) | u Ra_GE y))
	r-->Stat18 ==> Stat19: (r in Ra) & Stat20: (FORALL y in ({f~[i]: i in i0} + {f~[i0] Ra_PLUS Ra_1}) | r Ra_GE y)
--
-- But it is easily seen that $r$ must also be an upper bound for the entire Cauchy sequence $f$,
-- proving our theorem.
--
	ELEM ==> (f~[i0] Ra_PLUS Ra_1) in {f~[i0] Ra_PLUS Ra_1}
	(f~[i0] Ra_PLUS Ra_1)-->Stat20 ==> Stat21: r Ra_GE (f~[i0] Ra_PLUS Ra_1)
	f-->T73 ==> range(f) = {f~[v]: v in domain(f)}
	EQUAL ==> range(f) = {f~[v]: v in Za}
	r-->Stat1 ==> Stat22: (r in Ra) & (not (FORALL y in range(f) | y Ra_LE r))
	EQUAL(Stat12) ==> not(FORALL y in {f~[v]: v in Za} | y Ra_LE r)
	SIMPLF ==> Stat23: not (FORALL v in Za | f~[v] Ra_LE r)
	k-->Stat23 ==> Stat24: (k in Za) & (not((f~[k]) Ra_LE r))
	(f~[k],r)-->T473(Stat24) ==> Stat25: not(r Ra_GE (f~[k]))
	k-->T71(Stat2,Stat24) ==> Stat26: ((f~[k]) in Ra) & Stat27: ((f~[k]) in range(f))
	(f~[k])-->Stat20 ==> Stat28: not((f~[k]) in {f~[i]: i in i0})
	k-->Stat28 ==> k notin i0
	k-->Stat17 ==> Stat29: ((f~[i0]) Ra_PLUS Ra_1) Ra_GT (f~[k])
	((f~[i0]) Ra_PLUS Ra_1,f~[k])-->T474 ==> Stat30: ((f~[i0]) Ra_PLUS Ra_1) Ra_GE (f~[k])
	(r,(f~[i0]) Ra_PLUS Ra_1,f~[k])-->T508(Stat22,Stat12,Stat26,Stat30,Stat21) ==> Stat31: r Ra_GE (f~[k])
	(Stat25,Stat31*)Discharge ==> QED
--
-- As an immediate corollary, every Cauchy sequence has an upper bound
-- for the absolute values of its components.
--
Theorem 560: (F in RaCauchy) imp (EXISTS x in Ra | (FORALL y in range(F) | Ra_ABS(y) Ra_LT x )). Proof:
    Suppose_not(f) ==> (f in RaCauchy) & Stat1: (not(EXISTS x in Ra | (FORALL y in range(f) | Ra_ABS(y) Ra_LT x) ))
        T539(*) ==> f in RaSeq
        f-->T546 ==> (domain(f) = Za) & Svm(f) & (range(f) incin Ra)
        (f,f)-->T556 ==> Ras_ABS(f) in RaCauchy
        (f,f)-->T554 ==> Ras_ABS(f) = {[u, Ra_ABS(f~[u])]: u in Za}
        (Ras_ABS(f))-->T559 ==> Stat2: (EXISTS x in Ra | (FORALL y in range(Ras_ABS(f)) | y Ra_LE x ))
        c-->Stat2 ==> (c in Ra) & Stat3: (FORALL y in range(Ras_ABS(f)) | y Ra_LE c )
        ALGEBRA ==> (Ra_0 in Ra) & (Ra_1 in Ra) & ((c Ra_PLUS Ra_1) in Ra)
        (c Ra_PLUS Ra_1)-->Stat1 ==> Stat4: not(FORALL y in range(f) | Ra_ABS(y) Ra_LT (c Ra_PLUS Ra_1))
        d-->Stat4 ==> (d in range(f)) & (not(Ra_ABS(d) Ra_LT (c Ra_PLUS Ra_1)))
        Suppose ==> Ra_ABS(d) notin range(Ras_ABS(f))
            f-->T73 ==> Stat5: d in {f~[x]: x in domain(f)}
            a-->Stat5 ==> (d = f~[a]) & (a in Za)
            TELEM ==> range({[u, Ra_ABS(f~[u])]: u in Za}) = {Ra_ABS(f~[u]): u in Za}
            EQUAL ==> (range(Ras_ABS(f)) = {Ra_ABS(f~[u]): u in Za}) & (Ra_ABS(d) = Ra_ABS(f~[a]))
            ELEM ==> Stat6: Ra_ABS(d) notin {Ra_ABS(f~[u]): u in Za}
        a-->Stat6 ==> false; Discharge ==> Ra_ABS(d) in range(Ras_ABS(f))
        (Ra_ABS(d))-->Stat3 ==> Ra_ABS(d) Ra_LE c
        (Ra_ABS(d),c)-->T473 ==> c Ra_GE Ra_ABS(d)
        T481 ==> Ra_1 Ra_GT Ra_0
        d-->T527 ==> Ra_ABS(d) in Ra
        (c,Ra_ABS(d),Ra_1,Ra_0)-->T504 ==> (c Ra_PLUS Ra_1) Ra_GT (Ra_ABS(d) Ra_PLUS Ra_0)
        ALGEBRA ==> (Ra_ABS(d) Ra_PLUS Ra_0) = Ra_ABS(d)
        EQUAL ==> (c Ra_PLUS Ra_1) Ra_GT Ra_ABS(d)
    (Ra_ABS(d),c Ra_PLUS Ra_1)-->T473 ==> false; Discharge ==> QED
--
--
Theorem 561: ({F,G} incin RaCauchy) imp (((F Ras_MINUS G) in RaCauchy) & ((F Ras_TIMES G) in RaCauchy)). Proof:
Suppose_not(fq,fp) ==> AUTO
--
-- Reasoning by contradiction, assume that $fq,fp$ form a counterexample
-- to the desired statement. We readily discard the possibility that
-- $(fq Ras_MINUS fp) notin RaCauchy$. Only the possibility that
-- $(fq Ras_TIMES fp) notin RaCauchy$ must be analyzed in detail, and
-- we will reach a contradiction in this case also.
--
	Suppose ==> Stat1: (fq Ras_MINUS fp) notin RaCauchy
		Use_def(Ras_MINUS)(Stat1*) ==> (fq Ras_PLUS Ras_Rev(fp)) notin RaCauchy
		(fp,fp)-->T556(*) ==> Ras_Rev(fp) in RaCauchy
	(fq,Ras_Rev(fp))-->T556(*) ==> false; Discharge ==> Stat2: ({fp,fq} incin RaCauchy) &
		((fq Ras_TIMES fp) notin RaCauchy)
--
-- Assuming that $fq Ras_TIMES fp$ is not a Cauchy sequence (unlike
-- $fq$ and $fp$), there would exist a positive real $eps0$ for which
-- the set
--	${ i * j : i in Za, j in Za | Ra_ABS(((fq Ras_TIMES fp)~[i]) Ra_MINUS ((fq Ras_TIMES fp)~[j])) Ra_GT eps0 }$
-- is infinite, unlike the analogous sets which have $fp$ and $fq$, respectively,
-- in place of $fq Ras_TIMES fp$ and have, in place of $eps0$, positive rationals
-- $eps1$ and $eps2$ smaller than one half of $eps0 Ra_OVER m$, where $m$ is chosen
-- to be larger than the absolute value of any component of $fq$ and of any component
-- of $fp$.
--
	Use_def(RaCauchy)(Stat2*) ==> Stat3: (fq Ras_TIMES fp) notin {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
	  Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))} &
			Stat4: fq in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
	  Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))} &
			Stat5: fp in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
				Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
	()-->Stat4(Stat3*) ==> Stat6: (fq in RaSeq) & Stat7: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps }))
	()-->Stat5(Stat3*) ==> Stat8: (fp in RaSeq) & Stat9: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps }))
	fq-->T546(Stat6,Stat6*) ==> Stat10: (domain(fq) = Za) & Svm(fq) & (range(fq) incin Ra)
	fp-->T546(Stat8,Stat8*) ==> Stat11: (domain(fp) = Za) & Svm(fp) & (range(fp) incin Ra)
	(fq,fp)-->T554(Stat6*) ==> Stat12: ((fq Ras_TIMES fp) in RaSeq) &
			Stat13: ((fq Ras_TIMES fp) = {[u,((fq~[u]) Ra_TIMES (fp~[u]))]: u in Za})
	()-->Stat3(Stat3*) ==> Stat14: not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS(((fq Ras_TIMES fp)~[i]) Ra_MINUS ((fq Ras_TIMES fp)~[j])) Ra_GT eps }))
	eps0-->Stat14(Stat14*) ==> Stat15: (eps0 in Ra) & (eps0 Ra_GT Ra_0) & (not(
			Finite({ i * j : i in Za, j in Za | Ra_ABS(((fq Ras_TIMES fp)~[i]) Ra_MINUS ((fq Ras_TIMES fp)~[j])) Ra_GT eps0 })))
	fq-->T560(Stat2,Stat2*) ==> Stat16: (EXISTS x in Ra | (FORALL y in range(fq) | Ra_ABS(y) Ra_LT x ))
	mq-->Stat16(Stat16*) ==> (mq in Ra) & Stat17: (FORALL y in range(fq) | Ra_ABS(y) Ra_LT mq )
	fp-->T560(Stat2,Stat2*) ==> Stat18: (EXISTS x in Ra | (FORALL y in range(fp) | Ra_ABS(y) Ra_LT x ))
	mp-->Stat18(Stat18*) ==> (mp in Ra) & Stat19: (FORALL y in range(fp) | Ra_ABS(y) Ra_LT mp )
	Loc_def ==> m = if (mq Ra_GT mp) then mq else mp end if
	(Stat16*)ELEM ==> Stat20: m in Ra
	Suppose ==> Stat21: not(FORALL y in range(fq) | Ra_ABS(y) Ra_LT m)
		y1-->Stat21(Stat21*) ==> (y1 in range(fq)) & (not(Ra_ABS(y1) Ra_LT m))
		y1-->Stat17(Stat16*) ==> Ra_ABS(y1) Ra_LT mq
		Suppose ==> m = mq
		EQUAL(Stat21) ==> false; Discharge ==> m /= mq
		(Stat18)ELEM ==> not(mq Ra_GT mp)
		(mq,mp)-->T473(Stat16*) ==> (mp Ra_GE mq) & (m = mp)
		y1-->T527(Stat10*) ==> Ra_ABS(y1) in Ra
		(Ra_ABS(y1),mq)-->T473(Stat16*) ==> mq Ra_GT Ra_ABS(y1)
		(mp,mq,Ra_ABS(y1))-->T510(Stat16*) ==> mp Ra_GT Ra_ABS(y1)
		EQUAL(Stat21) ==> m Ra_GT Ra_ABS(y1)
	(Ra_ABS(y1),m)-->T473(Stat20*) ==> false; Discharge ==> Stat22: (FORALL y in range(fq) | Ra_ABS(y) Ra_LT m)
	Suppose ==> Stat23: not(FORALL y in range(fp) | Ra_ABS(y) Ra_LT m)
		y2-->Stat23(Stat23*) ==> (y2 in range(fp)) &  (not(Ra_ABS(y2) Ra_LT m))
		y2-->Stat19(Stat18*) ==> Ra_ABS(y2) Ra_LT mp
		Suppose ==> m = mp
		EQUAL(Stat23) ==> false; Discharge ==> m /= mp
		ELEM ==> (mq Ra_GT mp) & (m = mq)
		y2-->T527(Stat11*) ==> Ra_ABS(y2) in Ra
		(Ra_ABS(y2),mp)-->T473(Stat18*) ==> mp Ra_GT Ra_ABS(y2)
		(mq,mp,Ra_ABS(y2))-->T511(Stat16*) ==> mq Ra_GT Ra_ABS(y2)
		EQUAL(Stat23) ==> m Ra_GT Ra_ABS(y2)
	(Ra_ABS(y2),m)-->T473(Stat20*) ==> false; Discharge ==> Stat24: (FORALL y in range(fp) | Ra_ABS(y) Ra_LT m )
	ALGEBRA(Stat24) ==> (Ra_0 in Ra)
	Suppose ==> not(m Ra_GT Ra_0)
		ALGEBRA(Stat10,Stat10) ==> Stat25: 0 in domain(fq)
		(0,fq)-->T71(Stat2,Stat10,Stat25*) ==> Stat26: (fq~[0]) in range(fq)
		(fq~[0])-->Stat22(Stat26*) ==> Ra_ABS(fq~[0]) Ra_LT m
		(fq~[0])-->T527(Stat10,Stat26*) ==> (Ra_ABS(fq~[0]) Ra_GE Ra_0) & (Ra_ABS(fq~[0]) in Ra)
		(Ra_ABS(fq~[0]), m)-->T473(Stat26*) ==> m Ra_GT Ra_ABS(fq~[0])
	(m, Ra_ABS(fq~[0]), Ra_0)-->T509(Stat2*) ==> false; Discharge ==> AUTO
	(m, Ra_0)-->T473(Stat2*) ==> m /= Ra_0
	m-->T462(Stat20*) ==> Stat27: (Recip(m) in Ra) & ((m Ra_TIMES Recip(m)) = Ra_1)
	ALGEBRA(Stat20,Stat15,Stat27) ==> (Ra_0 = (Ra_0 Ra_PLUS Ra_0)) &
		((eps0 Ra_TIMES Recip(m)) in Ra) &
		((Ra_0 Ra_TIMES Recip(m)) = (Recip(m) Ra_TIMES Ra_0))
	m-->T491(Stat2*) ==> Recip(m) Ra_GT Ra_0
	(eps0, Ra_0, Recip(m))-->T488(Stat2*) ==> (eps0 Ra_TIMES Recip(m)) Ra_GT (Ra_0 Ra_TIMES Recip(m))
	ALGEBRA(Stat27,Stat27*) ==> (Recip(m) Ra_TIMES Ra_0) = Ra_0
	EQUAL(Stat2) ==> (eps0 Ra_TIMES Recip(m)) Ra_GT Ra_0
	(eps0 Ra_TIMES Recip(m))-->T522(Stat2*) ==> Stat28: (EXISTS e in Ra, e0 in Ra | ((eps0 Ra_TIMES Recip(m)) Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e Ra_GT Ra_0) & ((eps0 Ra_TIMES Recip(m)) Ra_GT (e Ra_PLUS e0)))
	(eps1,eps2)-->Stat28 ==> Stat29: (eps1 in Ra) & (eps2 in Ra) & (eps2 Ra_GT Ra_0) & (eps1 Ra_GT Ra_0) & ((eps0 Ra_TIMES Recip(m)) Ra_GT (eps1 Ra_PLUS eps2))
	(eps1,Ra_0)-->T473(Stat2*) ==> (eps1 Ra_GE Ra_0)
	(eps1,Ra_0,eps2,Ra_0)-->T504(Stat2*) ==> (eps1 Ra_PLUS eps2) Ra_GT (Ra_0 Ra_PLUS Ra_0)
	EQUAL(Stat2) ==> (eps1 Ra_PLUS eps2) Ra_GT Ra_0
	m-->T491(Stat2*) ==> Recip(m) Ra_GT Ra_0
	ALGEBRA(Stat29,Stat20,Stat15,Stat27) ==> ((eps1 Ra_PLUS eps2) in Ra) &
		(((eps0 Ra_TIMES Recip(m)) Ra_TIMES m) = (eps0 Ra_TIMES (m Ra_TIMES Recip(m)))) &
		(((eps1 Ra_PLUS eps2) Ra_TIMES m) = (m Ra_TIMES (eps1 Ra_PLUS eps2))) &
		((eps0 Ra_TIMES Ra_1) = eps0)
	(eps0 Ra_TIMES Recip(m), eps1 Ra_PLUS eps2, m)-->T488(Stat2*) ==> ((eps0 Ra_TIMES Recip(m)) Ra_TIMES m) Ra_GT ((eps1 Ra_PLUS eps2) Ra_TIMES m)
	EQUAL(Stat2) ==> eps0 Ra_GT (m Ra_TIMES (eps1 Ra_PLUS eps2))
--
	eps2-->Stat7 ==> Stat30: Finite({ (i * j) : i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps2 })
	eps1-->Stat9 ==> Stat31: Finite({ (i * j) : i in Za, j in Za | Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps1 })
--
-- However, this assumption would lead to a conflict with the inequality (holding for all $i,j in Za$)
--	$Ra_ABS((fq Ras_TIMES fp)~[i] Ra_MINUS (fq Ras_TIMES fp)~[j]) Ra_LE (m Ra_TIMES Ra_ABS((fq~[i] Ra_MINUS fq~[j]) Ra_PLUS (fp~[i] Ra_MINUS fp~[j])))$,
-- as we are about to show.
--
	APPLY() setformer_meet_join(s->Za, t->Za, h(i,j)->(i*j), R(i,j)->(Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps2), Q(i,j)->(Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps1)) ==>
			Stat32: {(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps2) or (Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps1)} = ({(i*j): i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps2 } + {(i*j): i in Za, j in Za | Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps1 })
	({ i * j : i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps2 }, { i * j : i in Za, j in Za | Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps1 })-->T236(Stat30,Stat31*) ==>
			Finite({(i*j): i in Za, j in Za | Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps2 } + {(i*j): i in Za, j in Za | Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps1 })
 	EQUAL(Stat32) ==> Finite({(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps2) or (Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps1)})
	Suppose ==> Stat33: not({(i * j): i in Za, j in Za | Ra_ABS(((fq Ras_TIMES fp)~[i]) Ra_MINUS ((fq Ras_TIMES fp)~[j])) Ra_GT eps0 } incin {(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps2) or (Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps1)})
--
-- If we make the temporary assumption that
--	$not({(i * j): i in Za, j in Za | Ra_ABS(((fq Ras_TIMES fp)~[i]) Ra_MINUS ((fq Ras_TIMES fp)~[j])) Ra_GT eps0 } incin {(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps2) or (Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps1)})$,
-- then, by proving the above-stated inequality, we reach a contradiction as follows.
-- In the first place, observe that if $i0,j0$ are unsigned integers for which $i0*j0$
-- belongs to the set appearing as left-hand side but does not belong to the right-hand side then
--	$Ra_ABS((((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0])))) Ra_GT eps0$,
--	$(Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_LE eps1) & (Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_LE eps2)$.
--
		(i0,j0)-->Stat33 ==> Stat34: (i0 in Za) & (j0 in Za) & (Ra_ABS(((fq Ras_TIMES fp)~[i0]) Ra_MINUS ((fq Ras_TIMES fp)~[j0])) Ra_GT eps0) & (not(Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_GT eps2)) & (not(Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_GT eps1))
		APPLY() fcn_symbol(f(u)->((fq~[u]) Ra_TIMES (fp~[u])), g->(fq Ras_TIMES fp), s->Za) ==>
			Stat35: (FORALL x | ((fq Ras_TIMES fp)~[x]) = if x in Za then ((fq~[x]) Ra_TIMES (fp~[x])) else 0 end if)
		i0-->Stat35(Stat34*) ==> ((fq Ras_TIMES fp)~[i0]) = ((fq~[i0]) Ra_TIMES (fp~[i0]))
		j0-->Stat35(Stat34*) ==> ((fq Ras_TIMES fp)~[j0]) = ((fq~[j0]) Ra_TIMES (fp~[j0]))
		EQUAL(Stat33) ==> Stat36: Ra_ABS((((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0])))) Ra_GT eps0
--
-- Secondly, we easily check that various quantities belong to $Ra$.
--
		Suppose ==> (fq~[i0]) notin range(fq)
			fq-->T73(Stat10*) ==> Stat37: (fq~[i0]) notin {(fq~[j]): j in domain(fq)}
		i0-->Stat37(Stat10,Stat34*) ==> false; Discharge ==> Stat38: (fq~[i0]) in range(fq)
		Suppose ==> (fp~[j0]) notin range(fp)
			fp-->T73(Stat11*) ==> Stat39: (fp~[j0]) notin {(fp~[j]): j in domain(fp)}
		j0-->Stat39(Stat11,Stat34*) ==> false; Discharge ==> Stat40: (fp~[j0]) in range(fp)
		(fq,fp,i0)-->T555(Stat6,Stat8,Stat34*) ==> Stat41: ((fq~[i0]) in Ra) & ((fp~[i0]) in Ra)
		(fq,fp,j0)-->T555(Stat6,Stat8,Stat34*) ==> Stat42: ((fq~[j0]) in Ra) & ((fp~[j0]) in Ra)
		(fq~[i0])-->T527(Stat41*) ==> Stat43: Ra_ABS(fq~[i0]) in Ra
		ALGEBRA(Stat41,Stat42) ==> Stat44: (((fq~[i0]) Ra_MINUS (fq~[j0])) in Ra)
		((fq~[i0]) Ra_MINUS (fq~[j0]))-->T527(Stat44*) ==> Stat45: (Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) in Ra) & (Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_GE Ra_0)
		(fp~[j0])-->T527(Stat41*) ==> Stat46: Ra_ABS(fp~[j0]) in Ra
		ALGEBRA(Stat42,Stat41) ==> Stat47: ((fp~[i0]) Ra_MINUS (fp~[j0])) in Ra
		((fp~[i0]) Ra_MINUS (fp~[j0]))-->T527(Stat41*) ==> Stat48: (Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) in Ra) & (Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_GE Ra_0)
		ALGEBRA(Stat20,Stat29) ==> (m Ra_TIMES (eps1 Ra_PLUS eps2)) in Ra
		ALGEBRA(Stat41,Stat42) ==> ((((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0]))) in Ra) &
				(((fq~[i0]) Ra_TIMES ((fp~[i0]) Ra_MINUS (fp~[j0]))) in Ra) &
				(((fp~[j0]) Ra_TIMES ((fq~[i0]) Ra_MINUS (fq~[j0]))) in Ra)
		(((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0])))-->T527(Stat41*) ==> Ra_ABS(((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_PLUS ((fp~[i0]) Ra_MINUS (fp~[j0]))) in Ra
		ALGEBRA(Stat48,Stat45,Stat46,Stat43) ==> ((Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))) in Ra) &
				((Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) in Ra) &
				((Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_PLUS Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))) in Ra) &
				(((Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))) in Ra)
		ALGEBRA(Stat41) ==> Stat49: ((Ra_Rev((fq~[i0]) Ra_TIMES (fp~[j0])) in Ra) & ((((fq~[i0]) Ra_TIMES (fp~[j0])) Ra_PLUS Ra_Rev((fq~[i0]) Ra_TIMES (fp~[j0]))) = Ra_0)) &
				((((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_PLUS (Ra_Rev((fq~[i0]) Ra_TIMES (fp~[j0])) Ra_PLUS ((fq~[i0]) Ra_TIMES (fp~[j0])))) = ((((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_PLUS Ra_Rev((fq~[i0]) Ra_TIMES (fp~[j0]))) Ra_PLUS ((fq~[i0]) Ra_TIMES (fp~[j0]))))
		ALGEBRA(Stat41,Stat42) ==> Stat50: (((fq~[j0]) Ra_TIMES (fp~[j0])) = ((fp~[j0]) Ra_TIMES (fq~[j0]))) &
				((((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_PLUS Ra_Rev((fq~[i0]) Ra_TIMES (fp~[j0])) Ra_PLUS ((fq~[i0]) Ra_TIMES (fp~[j0]))) Ra_PLUS Ra_Rev((fq~[j0]) Ra_TIMES (fp~[j0])) = (((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_PLUS Ra_Rev((fq~[i0]) Ra_TIMES (fp~[j0]))) Ra_PLUS (((fq~[i0]) Ra_TIMES (fp~[j0])) Ra_PLUS Ra_Rev((fq~[j0]) Ra_TIMES (fp~[j0])))) &
				(((fq~[i0]) Ra_TIMES (fp~[i0])) in Ra) &
				(((fq~[i0]) Ra_TIMES (fp~[j0])) in Ra)
--
-- By exploiting some of the above membership relations, we easily get
--	$(eps1 Ra_PLUS eps2) Ra_GE (Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_PLUS Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))$,
-- and hence
--	$eps0 Ra_GT ((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))$.
--
		(Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])), eps1)-->T473(Stat29*) ==> eps1 Ra_GE Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))
		(Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])), eps2)-->T473(Stat29*) ==> eps2 Ra_GE Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))
		(eps1, Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])), eps2, Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))-->T493(Stat29*) ==> (eps1 Ra_PLUS eps2) Ra_GE (Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_PLUS Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))
		Suppose ==> Stat51: not((m Ra_TIMES (eps1 Ra_PLUS eps2)) Ra_GE ((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))))
			ALGEBRA(Stat48,Stat45,Stat20) ==> (m Ra_TIMES (Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_PLUS Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))) = ((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))
			Suppose ==> (eps1 Ra_PLUS eps2) = (Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_PLUS Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))
				EQUAL(Stat51*) ==> (m Ra_TIMES (eps1 Ra_PLUS eps2)) = ((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))
			(((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))), (m Ra_TIMES (eps1 Ra_PLUS eps2)))-->T473(Stat41*) ==> false; Discharge ==> AUTO
			(eps1 Ra_PLUS eps2, Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_PLUS Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))-->T473(Stat41*) ==> (eps1 Ra_PLUS eps2) Ra_GT (Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_PLUS Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))
			(eps1 Ra_PLUS eps2, Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_PLUS Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])), m)-->T488(Stat18*) ==> ((eps1 Ra_PLUS eps2) Ra_TIMES m) Ra_GT ((Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_PLUS Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))) Ra_TIMES m)
			ALGEBRA(Stat20,Stat29) ==> (m Ra_TIMES (eps1 Ra_PLUS eps2)) = ((eps1 Ra_PLUS eps2) Ra_TIMES m)
			ALGEBRA(Stat20,Stat48,Stat45) ==> ((Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_PLUS Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))) Ra_TIMES m) = (m Ra_TIMES (Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_PLUS Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))
			EQUAL(Stat51*) ==> (m Ra_TIMES (eps1 Ra_PLUS eps2)) Ra_GT ((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))
		((m Ra_TIMES (eps1 Ra_PLUS eps2)), ((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))))-->T473(Stat51*) ==> false; Discharge ==> AUTO
		(Stat28*)ELEM ==> (m Ra_TIMES (eps1 Ra_PLUS eps2)) Ra_GE ((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))
		ALGEBRA(Stat20,Stat48,Stat45) ==> Stat52: ((m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))) in Ra) &
				((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) in Ra) &
				(((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))) in Ra)
		(eps0, m Ra_TIMES (eps1 Ra_PLUS eps2), (m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))-->T509(Stat15*) ==> eps0 Ra_GT ((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))
		(eps0, (m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))-->T473(Stat42*) ==> Stat53: eps0 Ra_GE ((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))
--
-- As a consequence, $eps1 Ra_PLUS eps2$ is greater than or equal to
--	$Ra_ABS(((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_MINUS (fp~[j0])))$,
-- because this quantity equals
--	$Ra_ABS(((fq~[i0]) Ra_TIMES ((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS ((fp~[j0]) Ra_TIMES ((fq~[i0]) Ra_MINUS (fq~[j0]))))$,
--
		(Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])), eps2)-->T473(Stat35*) ==> eps2 Ra_GE Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))
		(Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])), eps1)-->T473(Stat35*) ==> eps1 Ra_GE Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))
		(eps1, Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])), eps2, Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))-->T493(Stat35*) ==> Stat54: (eps1 Ra_PLUS eps2) Ra_GE (Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_PLUS Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))
		Suppose ==> Stat55: (((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0]))) /=
							(((fq~[i0]) Ra_TIMES ((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS ((fp~[j0]) Ra_TIMES ((fq~[i0]) Ra_MINUS (fq~[j0]))))
			ALGEBRA(Stat41,Stat42) ==> ((fq~[i0]) Ra_TIMES ((fp~[i0]) Ra_MINUS (fp~[j0])) = ((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[i0]) Ra_TIMES (fp~[j0]))) &
				((fp~[j0]) Ra_TIMES ((fq~[i0]) Ra_MINUS (fq~[j0])) = ((fq~[i0]) Ra_TIMES (fp~[j0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0]))) &
				((((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[i0]) Ra_TIMES (fp~[j0]))) = (((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_PLUS Ra_Rev((fq~[i0]) Ra_TIMES (fp~[j0])))) &
				((((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_PLUS Ra_Rev((fq~[i0]) Ra_TIMES (fp~[j0]))) Ra_PLUS (((fq~[i0]) Ra_TIMES (fp~[j0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0]))) = (((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_PLUS (Ra_Rev((fq~[i0]) Ra_TIMES (fp~[j0])) Ra_PLUS ((fq~[i0]) Ra_TIMES (fp~[j0])))) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0]))) &
				((Ra_Rev((fq~[i0]) Ra_TIMES (fp~[j0])) Ra_PLUS ((fq~[i0]) Ra_TIMES (fp~[j0]))) = Ra_0) &
				((((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_PLUS Ra_0) = ((fq~[i0]) Ra_TIMES (fp~[i0])))
		EQUAL(Stat55) ==> false; Discharge ==> AUTO
		(Stat54*)ELEM ==> Stat56: (((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0]))) =
							(((fq~[i0]) Ra_TIMES ((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS ((fp~[j0]) Ra_TIMES ((fq~[i0]) Ra_MINUS (fq~[j0]))))
		EQUAL(Stat56) ==> Ra_ABS(((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0]))) =
							Ra_ABS(((fq~[i0]) Ra_TIMES ((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS ((fp~[j0]) Ra_TIMES ((fq~[i0]) Ra_MINUS (fq~[j0]))))
-- ..., in its turn
--	$Ra_ABS(((fq~[i0]) Ra_TIMES ((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS ((fp~[j0]) Ra_TIMES ((fq~[i0]) Ra_MINUS (fq~[j0]))))$
-- is smaller than or equal to
--	$((Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))$,
--
		T525(Stat57*) ==> Stat57: (FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_ABS(x Ra_PLUS y) Ra_LE (Ra_ABS(x) Ra_PLUS Ra_ABS(y))))
		(((fq~[i0]) Ra_TIMES ((fp~[i0]) Ra_MINUS (fp~[j0]))), ((fp~[j0]) Ra_TIMES ((fq~[i0]) Ra_MINUS (fq~[j0]))))-->Stat57(Stat35*) ==>
					Ra_ABS(((fq~[i0]) Ra_TIMES ((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS ((fp~[j0]) Ra_TIMES ((fq~[i0]) Ra_MINUS (fq~[j0])))) Ra_LE (Ra_ABS((fq~[i0]) Ra_TIMES ((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS Ra_ABS((fp~[j0]) Ra_TIMES ((fq~[i0]) Ra_MINUS (fq~[j0]))))
		(fq~[i0], (fp~[i0]) Ra_MINUS (fp~[j0]))-->T530(Stat41,Stat47*) ==> Ra_ABS((fq~[i0]) Ra_TIMES ((fp~[i0]) Ra_MINUS (fp~[j0]))) = (Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])))
		(fp~[j0], (fq~[i0]) Ra_MINUS (fq~[j0]))-->T530(Stat42,Stat44*) ==> Ra_ABS((fp~[j0]) Ra_TIMES ((fq~[i0]) Ra_MINUS (fq~[j0]))) = (Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))
		EQUAL(Stat56) ==> Ra_ABS(((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0]))) Ra_LE ((Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))
		(Ra_ABS(((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0]))), ((Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))))-->T473(Stat35*) ==> ((Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))) Ra_GE Ra_ABS(((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0])))
--
-- ... which in its turn is smaller than or equal to
--	$(m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))$,
--
		ALGEBRA(Stat20,Stat20) ==> Stat58: m Ra_TIMES Ra_0 = Ra_0
		Suppose ==> not((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_GE (Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))))
			(fq~[i0])-->Stat22(Stat38,Stat38*) ==> Ra_ABS(fq~[i0]) Ra_LT m
			(Ra_ABS(fq~[i0]),m)-->T473(Stat35*) ==> m Ra_GT Ra_ABS(fq~[i0])
			Suppose ==> Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) Ra_GT Ra_0
				(m, Ra_ABS(fq~[i0]), Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])))-->T488(Stat20*) ==> (m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_GT (Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])))
			(m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])), (Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))))-->T473(Stat52*) ==> false; Discharge ==> AUTO
			(Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])), Ra_0)-->T473(Stat35*) ==> Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])) = Ra_0
			ALGEBRA(Stat43,Stat43) ==> (Ra_ABS(fq~[i0]) Ra_TIMES Ra_0) = Ra_0
			EQUAL(Stat58*) ==> (m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) = (Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])))
		((Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))), (m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))))-->T473(Stat35*) ==> false; Discharge ==> AUTO
		Suppose ==> not((m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))) Ra_GE (Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))
			(fp~[j0])-->Stat24(Stat40,Stat40*) ==> Ra_ABS(fp~[j0]) Ra_LT m
			(Ra_ABS(fp~[j0]),m)-->T473(Stat35*) ==> m Ra_GT Ra_ABS(fp~[j0])
			Suppose ==> Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) Ra_GT Ra_0
				(m, Ra_ABS(fp~[j0]), Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))-->T488(Stat20*) ==> (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))) Ra_GT (Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))
			(m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])), (Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))-->T473(Stat58*) ==> false; Discharge ==> AUTO
			(Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])), Ra_0)-->T473(Stat35*) ==> Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])) = Ra_0
			ALGEBRA(Stat46,Stat46) ==> (Ra_ABS(fp~[j0]) Ra_TIMES Ra_0) = Ra_0
			EQUAL(Stat58*) ==> (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))) = (Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))
		((Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))), (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))-->T473(Stat35*) ==> false; Discharge ==> AUTO
		(m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])), Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0])), m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])), Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))-->T493(Stat20*) ==>
					((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))) Ra_GE ((Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0]))))
--
-- ... hence, by exploiting the transitivity laws which the ordering of rationals obeys, we
-- get to the absurd conclusion that $eps0 Ra_GT eps0$.
--
		ALGEBRA(Stat41,Stat42*) ==> (((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0]))) in Ra
		(((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0])))-->T527(Stat41*) ==> Stat59: Ra_ABS(((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0]))) in Ra
		(((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))), ((Ra_ABS(fq~[i0]) Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (Ra_ABS(fp~[j0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))), Ra_ABS(((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0]))))-->T508(Stat41*) ==> Stat60:
				((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))) Ra_GE Ra_ABS(((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0])))
		(((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))), Ra_ABS(((fq~[i0]) Ra_TIMES (fp~[i0])) Ra_MINUS ((fq~[j0]) Ra_TIMES (fp~[j0]))), eps0)-->T510(Stat15,Stat59,Stat52,Stat60,Stat36*) ==> Stat61:
				((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))) Ra_GT eps0
		(eps0, ((m Ra_TIMES Ra_ABS((fp~[i0]) Ra_MINUS (fp~[j0]))) Ra_PLUS (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fq~[j0])))), eps0)-->T510(Stat15,Stat52,Stat53,Stat61*) ==> eps0 Ra_GT eps0
	(eps0,eps0)-->T473(Stat58*) ==> false; Discharge ==> AUTO
	(Stat32*)ELEM ==> { (i * j) : i in Za, j in Za | Ra_ABS(((fq Ras_TIMES fp)~[i]) Ra_MINUS ((fq Ras_TIMES fp)~[j])) Ra_GT eps0 } incin {(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps2) or (Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps1)}
--
-- Since the inclusion just proved entails that the set on the left-hand side is finite,
-- we have reached the desired contradiction, proving the statement of the present theorem.
--
({(i*j): i in Za, j in Za | (Ra_ABS((fq~[i]) Ra_MINUS (fq~[j])) Ra_GT eps1) or (Ra_ABS((fp~[i]) Ra_MINUS (fp~[j])) Ra_GT eps2)}, { i * j : i in Za, j in Za | Ra_ABS(((fq Ras_TIMES fp)~[i]) Ra_MINUS ((fq Ras_TIMES fp)~[j])) Ra_GT eps0 })-->T189(Stat15) ==> false; Discharge ==> QED
--
-- Preliminary to showing that the reciprocal of any rational Cauchy sequence not equivalent to the zero sequence
-- is, in its turn, a rational Cauchy sequence, we prove that
-- for every rational Cauchy sequence $g$  which is not equivalent to the everywhere null sequence,
-- there is  a positive rational number $eps$ such that all but a finite number of components of $g$
-- have an absolute value exceeding $eps$.
--
Theorem 562: ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) imp (EXISTS eps in Ra | (eps Ra_GT Ra_0) & Finite({i in Za | eps Ra_GE Ra_ABS(G~[i])})). Proof+:
Suppose_not(g) ==> (g in RaCauchy) & (not Ra_eqseq(g,Ra0Seq)) & Stat1: (not (EXISTS eps in Ra | (eps Ra_GT Ra_0) & Finite({i in Za | eps Ra_GE Ra_ABS(g~[i])})))
--
-- For, suppose the contrary, namely that $g$ is a rational Cauchy sequence which is not equivalent to the everywhere null sequence,
-- and that $g$ has, for every positive rational $eps$, an infinite number of components whose absolute value does not exceed $eps$.
-- We will reach a contradiction as follows.
--
-- Various obvious facts immediately follow from $g$ being a non-zero rational Cauchy sequence; in particular:
-- (1) there is a positive rational $eps0$ such that infinitely many components of $g$ have an absolute value larger than $eps0$,
-- and (2) there is an integer $k0$ such that the distance between any two components of $g$, beyond the $k0$-th component,
-- is smaller than $eps1$, where $eps1$ and $eps2$ are positive rationals whose sum is inferior to $eps0$.
--
	Use_def(Ra_eqseq) ==> Stat2: (not (FORALL eps in Ra | (eps Ra_GT Ra_0) imp Finite({x : x in domain(g) | Ra_ABS((g~[x]) Ra_MINUS (Ra0Seq~[x])) Ra_GT eps})))
	eps0-->Stat2 ==> Stat3: (eps0 in Ra) & (eps0 Ra_GT Ra_0) & (not Finite({x : x in domain(g) | Ra_ABS((g~[x]) Ra_MINUS (Ra0Seq~[x])) Ra_GT eps0}))
	eps0-->T522 ==> Stat4: (EXISTS e in Ra, e0 in Ra | (eps0 Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e Ra_GT Ra_0) & (eps0 Ra_GT (e Ra_PLUS e0)))
	(eps1,eps2)-->Stat4 ==> Stat5: (eps1 in Ra) & (eps2 in Ra) & (eps2 Ra_GT Ra_0) & (eps1 Ra_GT Ra_0) & (eps0 Ra_GT (eps1 Ra_PLUS eps2))
	(eps1,g)-->T552 ==> Stat6: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (eps1 Ra_GT Ra_ABS((g~[i]) Ra_MINUS (g~[j]))) ))
	k0-->Stat6 ==> Stat6a: (k0 in Za) & Stat7: (FORALL i in Za, j in Za | ((i notin k0) & (j notin k0)) imp (eps1 Ra_GT Ra_ABS((g~[i]) Ra_MINUS (g~[j]))) )
	Use_def(RaCauchy) ==> Stat8: g in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
	()-->Stat8 ==> Stat9: g in RaSeq
	g-->T546 ==> (domain(g) = Za) & (range(g) incin Ra)
--
-- We then argue that for some integer $k1$ greater than or equal to $k0$,
-- the absolute value of the $k1$-th component of $g$ exceeds $eps0$.
--
	Suppose ==> Stat10: not(EXISTS k in (Za - k0) | Ra_ABS(g~[k]) Ra_GT eps0)
	    Suppose ==> {x : x in domain(g) | Ra_ABS((g~[x]) Ra_MINUS (Ra0Seq~[x])) Ra_GT eps0} /= {x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0}
		EQUAL ==> Stat11: {x : x in Za | Ra_ABS((g~[x]) Ra_MINUS (Ra0Seq~[x])) Ra_GT eps0} /= {x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0}
		x0-->Stat11 ==> Stat11a: (x0 in Za) & ((Ra_ABS((g~[x0]) Ra_MINUS (Ra0Seq~[x0])) Ra_GT eps0) eq (not(Ra_ABS(g~[x0]) Ra_GT eps0)))
		x0-->T548(Stat11a*) ==> (Ra0Seq~[x0]) = Ra_0
		(g,x0)-->T540(Stat9,Stat11a*) ==> Stat10a: (g~[x0]) in Ra
		(g~[x0])-->T527(Stat10a*) ==> Ra_ABS(g~[x0]) in Ra
		ALGEBRA(Stat10a) ==> ((g~[x0]) Ra_MINUS Ra_0) = (g~[x0])
	    EQUAL(Stat8) ==> false; Discharge ==> AUTO
	    TELEM ==> {x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0} = ({x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0} * k0) + ({x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0} - k0)
            EQUAL ==> Stat12: not Finite(({x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0} * k0) + ({x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0} - k0))
	    ({x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0},{x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0} * k0)-->T189 ==> Finite({x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0} * k0)
	    ({x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0} * k0,{x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0} - k0)-->T236(Stat12) ==> not Finite({x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0} - k0)
	    TELEM ==> Finite(0)
	    EQUAL ==>  Stat13: ({x : x in Za | Ra_ABS(g~[x]) Ra_GT eps0} - k0) /= 0
	    kp-->Stat13(Stat13*) ==> (kp notin k0) & Stat14: (kp in {x: x in Za | Ra_ABS(g~[x]) Ra_GT eps0})
	    xp-->Stat14 ==> (kp = xp) & (kp in Za) & (Ra_ABS(g~[xp]) Ra_GT eps0)
	    EQUAL ==> Ra_ABS(g~[kp]) Ra_GT eps0
	kp-->Stat10 ==> false; Discharge ==> Stat15: (EXISTS k in (Za - k0) | Ra_ABS(g~[k]) Ra_GT eps0)
	k1-->Stat15 ==> Stat16: (k1 in (Za - k0)) & (Ra_ABS(g~[k1]) Ra_GT eps0) & (k1 in Za)
--
-- If we now take an integer $k2$ greater than $k1$ where the absolute value of $g$ does not exceed $eps2$, ...
--
	eps2-->Stat1 ==> not Finite({i in Za | eps2 Ra_GE Ra_ABS(g~[i])})
	T206 ==> Ord(Za)
	(Za,k1)-->T13(Stat16) ==> Za = k1 + (Za - k1)
	Suppose ==> Stat17: {i in Za | eps2 Ra_GE Ra_ABS(g~[i])} /= ({i in k1 | eps2 Ra_GE Ra_ABS(g~[i])} + {i in (Za - k1) | eps2 Ra_GE Ra_ABS(g~[i])})
	    Set_monot ==> ({i in k1 | eps2 Ra_GE Ra_ABS(g~[i])} incin {i in Za | eps2 Ra_GE Ra_ABS(g~[i])})
	    Set_monot ==> ({i in (Za - k1) | eps2 Ra_GE Ra_ABS(g~[i])} incin {i in Za | eps2 Ra_GE Ra_ABS(g~[i])})
	    (Stat17)ELEM ==> Stat18: not({i in Za | eps2 Ra_GE Ra_ABS(g~[i])} incin ({i in k1 | eps2 Ra_GE Ra_ABS(g~[i])} + {i in (Za - k1) | eps2 Ra_GE Ra_ABS(g~[i])}))
	    iq-->Stat18(Stat18) ==> (not(iq in {i in k1 | eps2 Ra_GE Ra_ABS(g~[i])} + {i in (Za - k1) | eps2 Ra_GE Ra_ABS(g~[i])})) & Stat19: (iq in {i in Za | eps2 Ra_GE Ra_ABS(g~[i])})
	    ()-->Stat19(Stat18*) ==> (iq in Za) & (eps2 Ra_GE Ra_ABS(g~[iq])) & Stat20: (iq notin {i in k1 | eps2 Ra_GE Ra_ABS(g~[i])}) & Stat21: (iq notin {i in (Za - k1) | eps2 Ra_GE Ra_ABS(g~[i])})
	    iq-->Stat20(Stat18*) ==> iq notin k1
	iq-->Stat21(Stat18*) ==> false; Discharge ==> {i in Za | eps2 Ra_GE Ra_ABS(g~[i])} = ({i in k1 | eps2 Ra_GE Ra_ABS(g~[i])} + {i in (Za - k1) | eps2 Ra_GE Ra_ABS(g~[i])})
	EQUAL ==> not Finite({i in k1 | eps2 Ra_GE Ra_ABS(g~[i])} + {i in (Za - k1) | eps2 Ra_GE Ra_ABS(g~[i])})
	Suppose ==> Stat22: not({i in k1 | eps2 Ra_GE Ra_ABS(g~[i])} incin k1)
	    Set_monot ==> {i: i in k1 | eps2 Ra_GE Ra_ABS(g~[i])} incin {i: i in k1}
	(Stat22)Discharge ==> AUTO
	(k1,{i in k1 | eps2 Ra_GE Ra_ABS(g~[i])})-->T189(Stat16*) ==> Finite({i in k1 | eps2 Ra_GE Ra_ABS(g~[i])})
	({i in k1 | eps2 Ra_GE Ra_ABS(g~[i])},{i in (Za - k1) | eps2 Ra_GE Ra_ABS(g~[i])})-->T236 ==> not Finite({i in (Za - k1) | eps2 Ra_GE Ra_ABS (g~[i])})
	TELEM ==> Finite(0)
	EQUAL ==> Stat23: {i in (Za - k1) | eps2 Ra_GE Ra_ABS(g~[i])} /= 0
	k2-->Stat23 ==> Stat24: (k2 in (Za - k1)) & (eps2 Ra_GE Ra_ABS(g~[k2])) & (k2 in Za)
--
-- ...then the distance between $g~[k1]$ and $g~[k2]$ exceeds $eps1$, which is absurd.
-- This contradiction gives the desired conclusion.
--
	T525 ==> Stat25: (FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_LE y) & (y Ra_LE z)) imp (x Ra_LE z))) &
				Stat26: (FORALL x | (x in Ra) imp (x Ra_LE Ra_ABS(x))) &
        	 Stat27: (FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_ABS(Ra_ABS(x) Ra_PLUS Ra_Rev(Ra_ABS(y))) Ra_LE Ra_ABS(x Ra_PLUS Ra_Rev(y)))) &
				Stat28: (FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp ((x Ra_LE y) imp ((x Ra_PLUS z) Ra_LE (y Ra_PLUS z)))) &
				Stat29: (FORALL x,y,z | ((x in Ra) & (y in Ra) & (z in Ra)) imp (((x Ra_LE y) & (x /= y)) imp ((x Ra_PLUS z) /= (y Ra_PLUS z))))
	(g,k1)-->T540(Stat9,Stat16*) ==> Stat25a: (g~[k1]) in Ra
	(g~[k1])-->T527(Stat25a*) ==> Stat26a: Ra_ABS(g~[k1]) in Ra
	(g,k2)-->T540(Stat9,Stat24*) ==> Stat27a: (g~[k2]) in Ra
	(g~[k2])-->T527(Stat27a*) ==> Stat30: Ra_ABS(g~[k2]) in Ra
	ALGEBRA(Stat25a*) ==> Stat31: (((g~[k1]) Ra_MINUS (g~[k2])) = ((g~[k1]) Ra_PLUS Ra_Rev(g~[k2]))) &
        	((Ra_ABS(g~[k1]) Ra_MINUS Ra_ABS(g~[k2])) = (Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))) &
		(Ra_Rev(Ra_ABS(g~[k2])) in Ra) &
		((Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) in Ra)
	(g~[k1],g~[k2])-->Stat27 ==> Ra_ABS(Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) Ra_LE Ra_ABS((g~[k1]) Ra_PLUS Ra_Rev(g~[k2]))
	(Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))-->Stat26 ==> Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])) Ra_LE Ra_ABS(Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))
	(Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))-->T527 ==> Ra_ABS(Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) in Ra
	ALGEBRA(Stat25a,Stat27a) ==> ((g~[k1]) Ra_PLUS Ra_Rev(g~[k2])) in Ra
	((g~[k1]) Ra_PLUS Ra_Rev(g~[k2]))-->T527 ==> Stat33: Ra_ABS((g~[k1]) Ra_PLUS Ra_Rev(g~[k2])) in Ra
	(Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])),Ra_ABS(Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))),Ra_ABS((g~[k1]) Ra_PLUS Ra_Rev(g~[k2])))-->Stat25 ==> Stat34: (Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) Ra_LE Ra_ABS((g~[k1]) Ra_PLUS Ra_Rev(g~[k2]))
--
--
--
	(Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])),Ra_ABS((g~[k1]) Ra_PLUS Ra_Rev(g~[k2])))-->T473(Stat34) ==> Ra_ABS((g~[k1]) Ra_PLUS Ra_Rev(g~[k2])) Ra_GE (Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))
	ALGEBRA(Stat26a,Stat30) ==> (Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) = (Ra_Rev(Ra_ABS(g~[k2])) Ra_PLUS Ra_ABS(g~[k1]))
	EQUAL(Stat33) ==> Ra_ABS((g~[k1]) Ra_PLUS Ra_Rev(g~[k2])) Ra_GE (Ra_Rev(Ra_ABS(g~[k2])) Ra_PLUS Ra_ABS(g~[k1]))
	(Ra_Rev(Ra_ABS(g~[k2])),Ra_Rev(Ra_ABS(g~[k2])))-->T495 ==> Ra_Rev(Ra_ABS(g~[k2])) Ra_GE Ra_Rev(Ra_ABS(g~[k2]))
	(Ra_Rev(Ra_ABS(g~[k2])),Ra_Rev(Ra_ABS(g~[k2])),Ra_ABS(g~[k1]),eps0)-->T504 ==> (Ra_Rev(Ra_ABS(g~[k2])) Ra_PLUS Ra_ABS(g~[k1])) Ra_GT (Ra_Rev(Ra_ABS(g~[k2])) Ra_PLUS eps0)
	ALGEBRA(Stat26a,Stat30) ==> Ra_Rev(Ra_ABS(g~[k2])) Ra_PLUS Ra_ABS(g~[k1]) = Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))
	ALGEBRA(Stat30,Stat3) ==> Stat41: ((eps0 Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) in Ra) & (Ra_Rev(Ra_ABS(g~[k2])) Ra_PLUS eps0 = eps0 Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))
	EQUAL(Stat33) ==> Stat35: (Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) Ra_GT (eps0 Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])))
	(eps2,Ra_ABS(g~[k2]))-->T502(Stat24,Stat5,Stat30*) ==> Stat36: Ra_Rev(Ra_ABS(g~[k2])) Ra_GE Ra_Rev(eps2)
	(eps0,eps0)-->T495(Stat3,Stat3*) ==> Stat37: eps0 Ra_GE eps0
	ALGEBRA(Stat5,Stat5) ==> Stat38: Ra_Rev(eps2) in Ra
	(eps0,eps0,Ra_Rev(Ra_ABS(g~[k2])),Ra_Rev(eps2))-->T493(Stat3,Stat36,Stat37,Stat38,Stat31) ==> Stat39: (eps0 Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) Ra_GE (eps0 Ra_PLUS Ra_Rev(eps2))
	ALGEBRA(Stat3,Stat5) ==> Stat40: (eps0 Ra_PLUS Ra_Rev(eps2)) in Ra
	((Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))),(eps0 Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))),(eps0 Ra_PLUS Ra_Rev(eps2)))-->T509(Stat35,Stat39,Stat31,Stat40,Stat41) ==>
				(Ra_ABS(g~[k1])Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) Ra_GT (eps0 Ra_PLUS Ra_Rev(eps2))
	(Ra_Rev(eps2),Ra_Rev(eps2))-->T495(Stat38,Stat38*) ==> Ra_Rev(eps2) Ra_GE Ra_Rev(eps2)
	(eps0,eps1 Ra_PLUS eps2)-->T473 ==> eps0 Ra_GE (eps1 Ra_PLUS eps2)
	ALGEBRA(Stat5,Stat5) ==> (((eps1 Ra_PLUS eps2) Ra_PLUS Ra_Rev(eps2)) = (eps1 Ra_PLUS (eps2 Ra_PLUS Ra_Rev(eps2)))) &
				((eps2 Ra_PLUS Ra_Rev(eps2)) = Ra_0) & ((eps1 Ra_PLUS Ra_0) = eps1) & ((eps1 Ra_PLUS eps2) in Ra)
	(eps0,eps1 Ra_PLUS eps2,Ra_Rev(eps2),Ra_Rev(eps2))-->T493 ==> (eps0 Ra_PLUS Ra_Rev(eps2)) Ra_GE ((eps1 Ra_PLUS eps2) Ra_PLUS Ra_Rev(eps2))
	EQUAL(Stat33) ==> (eps0 Ra_PLUS Ra_Rev(eps2)) Ra_GE eps1
	((Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))),(eps0 Ra_PLUS Ra_Rev(eps2)),eps1)-->T509 ==> (Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2]))) Ra_GT eps1
	(Ra_ABS((g~[k1]) Ra_PLUS Ra_Rev(g~[k2])),Ra_ABS(g~[k1]) Ra_PLUS Ra_Rev(Ra_ABS(g~[k2])),eps1)-->T510 ==> Stat42: Ra_ABS((g~[k1]) Ra_PLUS Ra_Rev(g~[k2])) Ra_GT eps1
	Suppose ==> k2 in k0
	    (k0,k1)-->T35(Stat16,Stat6a*) ==> Stat42a: k0 incin k1
	    (k1,k2)-->T35(Stat24,Stat16,Stat42a*) ==> k0 incin k2
	(k0,k2)-->T35 ==> false; Discharge ==> Stat43: k2 notin k0
	(k1,k2)-->Stat7(Stat43,Stat16,Stat24*) ==> eps1 Ra_GT Ra_ABS((g~[k1]) Ra_MINUS (g~[k2]))
	(eps1,Ra_ABS((g~[k1]) Ra_MINUS (g~[k2])))-->T473 ==> eps1 Ra_GE Ra_ABS((g~[k1]) Ra_MINUS (g~[k2]))
	Use_def(Ra_MINUS) ==> Stat44: eps1 Ra_GE Ra_ABS((g~[k1]) Ra_PLUS Ra_Rev(g~[k2]))
	(eps1,Ra_ABS((g~[k1]) Ra_PLUS Ra_Rev(g~[k2])),eps1)-->T510(Stat44,Stat42,Stat5,Stat33*) ==> eps1 Ra_GT eps1
	(eps1,eps1)-->T473 ==> Stat45: eps1 Ra_LT eps1
	T513 ==> Stat46: (FORALL x in Ra | not(x Ra_LT x))
	eps1-->Stat46(Stat45,Stat5*) ==> false; Discharge ==> QED
--
-- An alternative way of stating Theorem 562 is to say that for every rational
-- Cauchy sequence $g$  which is not equivalent to the everywhere null sequence,
-- there exists a positive rational number $eps$ and an unsigned integer $n$
-- beyond which all the components $g~[i]$ of $g$ have an absolute value greater than $eps$.
--
Theorem 563: ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) imp (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
		(FORALL i in (Za - n) | (Ra_ABS(G~[i]) Ra_GT eps) & (Ra_ABS(G~[i]) Ra_GT Ra_0)) & (Ra_ABS(G~[n]) Ra_GT Ra_0)). Proof:
    Suppose_not(g) ==> (g in RaCauchy) & (not Ra_eqseq(g,Ra0Seq)) & Stat1: (not(EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) & (FORALL i in (Za - n) | (Ra_ABS(g~[i]) Ra_GT eps) & (Ra_ABS(g~[i]) Ra_GT Ra_0)) & (Ra_ABS(g~[n]) Ra_GT Ra_0)))
        g-->T562 ==> Stat2: (EXISTS eps in Ra | (eps Ra_GT Ra_0) & Finite({i in Za | eps Ra_GE Ra_ABS(g~[i])}))
        a-->Stat2 ==> (a in Ra) & (a Ra_GT Ra_0) & Finite({i in Za | a Ra_GE Ra_ABS(g~[i])})
        Suppose ==> Stat3: not(EXISTS n in Za | (FORALL i in (Za - n) | (Ra_ABS(g~[i]) Ra_GT a) & (Ra_ABS(g~[i]) Ra_GT Ra_0)) & (Ra_ABS(g~[n]) Ra_GT Ra_0))
            APPLY(bynd_thryvar:m) unsigned_integer_bynd(Q1(i)->(a Ra_GE Ra_ABS(g~[i]))) ==>
				(m in Za) & (Za incs m) & Ord(m) & (not Finite (Za - m)) & Stat4: (FORALL i in Za | ((a Ra_GE Ra_ABS(g~[i])) imp (i in m)))
            Use_def(RaCauchy) ==> Stat5: g in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
            ()-->Stat5 ==> g in RaSeq
            g-->T546 ==> Stat6: (domain(g) = Za) & (range(g) incin Ra)
            Suppose ==> Stat7: not(FORALL i in (Za - m) | Ra_ABS(g~[i]) Ra_GT a)
                i0-->Stat7 ==> Stat8: (i0 in (Za - m)) & (not(Ra_ABS(g~[i0]) Ra_GT a))
                (Ra_ABS(g~[i0]),a)-->T473 ==> not((Ra_ABS(g~[i0]) Ra_GT a) & (Ra_ABS(g~[i0]) /= a))
                (i0,g)-->T71(Stat6,Stat8) ==> (g~[i0]) in Ra
                (g~[i0])-->T527 ==> Ra_ABS(g~[i0]) in Ra
                (Ra_ABS(g~[i0]),a)-->T473 ==> a Ra_GE Ra_ABS(g~[i0])
            i0-->Stat4 ==> false; Discharge ==> Stat9: (FORALL i in (Za - m) | Ra_ABS(g~[i]) Ra_GT a)
            Suppose ==> Stat10: not(FORALL i in (Za - m) | (Ra_ABS(g~[i]) Ra_GT a) & (Ra_ABS(g~[i]) Ra_GT Ra_0))
                i1-->Stat10 ==> Stat11: (i1 in (Za - m)) & (not((Ra_ABS(g~[i1]) Ra_GT a) & (Ra_ABS(g~[i1]) Ra_GT Ra_0)))
                i1-->Stat9 ==> (i1 in (Za - m)) & (Ra_ABS(g~[i1]) Ra_GT a)
                (Ra_ABS(g~[i1]),a)-->T473 ==> (Ra_ABS(g~[i1]) Ra_GE a)
                T451 ==> Ra_0 in Ra
                (i1,g)-->T71(Stat6,Stat11) ==> (g~[i1]) in Ra
                (g~[i1])-->T527 ==> Ra_ABS(g~[i1]) in Ra
            (Ra_ABS(g~[i1]),a,Ra_0)-->T510 ==> false; Discharge ==> Stat12: (FORALL i in (Za - m) | (Ra_ABS(g~[i]) Ra_GT a) & (Ra_ABS(g~[i]) Ra_GT Ra_0))
            m-->Stat12 ==> Ra_ABS(g~[m]) Ra_GT Ra_0
        m-->Stat3 ==> false; Discharge ==> Stat13: (EXISTS n in Za | (FORALL i in (Za - n) | (Ra_ABS(g~[i]) Ra_GT a) & (Ra_ABS(g~[i]) Ra_GT Ra_0)) & (Ra_ABS(g~[n]) Ra_GT Ra_0))
        n0-->Stat13 ==> (n0 in Za) & (FORALL i in (Za - n0) | (Ra_ABS(g~[i]) Ra_GT a) & (Ra_ABS(g~[i]) Ra_GT Ra_0)) & (Ra_ABS(g~[n0]) Ra_GT Ra_0)
    (a,n0)-->Stat1 ==> false; Discharge ==> QED
--
-- It follows from Theorem 563 that for every rational
-- Cauchy sequence $h$  which is not equivalent to the everywhere null sequence,
-- there exists a positive rational number $eps$ and an unsigned integer $n$
-- beyond which:
-- (1) all the components $h~[i]$ of $h$ have an absolute value greater than $eps$;
-- (2) all the components $h~[j], h~[i]$ of $h$ differ by less than $eps$.
--
Theorem 564: ((H in RaCauchy) & (not Ra_eqseq(H,Ra0Seq))) imp (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
	(FORALL i in (Za - n) | Ra_ABS(H~[i]) Ra_GT eps) &
	(FORALL i in Za, j in Za | ((i notin n) & (j notin n)) imp (eps Ra_GT (Ra_ABS((H~[i]) Ra_MINUS (H~[j])))))). Proof:
Suppose_not(h) ==> ((h in RaCauchy) & (not Ra_eqseq(h,Ra0Seq))) &
	Stat1: (not(EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
		(FORALL i in (Za - n) | Ra_ABS(h~[i]) Ra_GT eps) &
		(FORALL i in Za, j in Za | ((i notin n) & (j notin n)) imp (eps Ra_GT (Ra_ABS((h~[i]) Ra_MINUS (h~[j])))))))
--
-- Let the Cauchy sequence $h$ be a counterexample to our claim.
-- Then, by Theorem 563, there exists a positive rational $eps0$ and an integer $n0$
-- beyond which all the components $h~[i]$ of $h$ have an absolute value greater than $eps0$.
--
	h-->T563(*) ==> Stat2: (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
		(FORALL i in (Za - n) | (Ra_ABS(h~[i]) Ra_GT eps) & (Ra_ABS(h~[i]) Ra_GT Ra_0)) & (Ra_ABS(h~[n]) Ra_GT Ra_0))
	(eps0,n0)-->Stat2(Stat2*) ==> Stat3: (eps0 in Ra) & (n0 in Za) & (eps0 Ra_GT Ra_0) &
		Stat4: (FORALL i in (Za - n0) | (Ra_ABS(h~[i]) Ra_GT eps0) & (Ra_ABS(h~[i]) Ra_GT Ra_0)) & (Ra_ABS(h~[n0]) Ra_GT Ra_0)
--
-- Moreover, exploiting Theorem 552 we can pick an integer $n1$ beyond which
-- all the components $h~[j], h~[i]$ of $h$ differ by less than $eps0$.
--
	(eps0,h)-->T552(*) ==> Stat5: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (eps0 Ra_GT (Ra_ABS((h~[i]) Ra_MINUS (h~[j])))) ))
	n1-->Stat5(Stat5*) ==> Stat6: (n1 in Za) & Stat7: (FORALL i in Za, j in Za | ((i notin n1) & (j notin n1)) imp (eps0 Ra_GT (Ra_ABS((h~[i]) Ra_MINUS (h~[j])))) )
--
-- Hence, letting $n2$ be greater than the maximum of $n0$ and $n1$, it follows that both of
-- the preceding conditions are satisfied by all the components $h~[j], h~[i]$ of $h$ beyond $n2$.
--
	(n0,n1)-->T202(Stat6*) ==> Stat8: Finite({n0,n1})
	({n0,n1})-->T558(Stat3,Stat6,Stat8*) ==> Stat9: (EXISTS i in Za | (FORALL j in {n0,n1} | j in i))
	n2-->Stat9(Stat9*) ==> Stat10: (n2 in Za) & Stat11: (FORALL j in {n0,n1} | j in n2)
	n0-->Stat11(Stat10*) ==> Stat12: n0 in n2
	Suppose ==> Stat13: not(FORALL i in (Za - n2) | Ra_ABS(h~[i]) Ra_GT eps0)
		i0-->Stat13(Stat13*) ==> Stat14: (i0 in (Za - n2)) & (not(Ra_ABS(h~[i0]) Ra_GT eps0))
		(n2,n0,i0)-->T208(Stat10,Stat3,Stat12,Stat14) ==> Stat15: i0 notin n0
	i0-->Stat4(Stat15,Stat14*) ==> false; Discharge ==> Stat16: (FORALL i in (Za - n2) | Ra_ABS(h~[i]) Ra_GT eps0)
	n1-->Stat11(Stat10,Stat10*) ==> Stat17: n1 in n2
	Suppose ==> Stat18: not(FORALL i in Za, j in Za | ((i notin n2) & (j notin n2)) imp (eps0 Ra_GT (Ra_ABS((h~[i]) Ra_MINUS (h~[j])))) )
		(i1,i2)-->Stat18(Stat18*)==> Stat19: (i1 in Za) & (i2 in Za) & (i1 notin n2) & (i2 notin n2) & (not(eps0 Ra_GT (Ra_ABS((h~[i1]) Ra_MINUS (h~[i2])))))
		(n2,n1,i1)-->T208(Stat10,Stat6,Stat17,Stat19) ==> i1 notin n1
		(n2,n1,i2)-->T208(Stat10,Stat6,Stat17,Stat19) ==> i2 notin n1
	(i1,i2)-->Stat7(Stat19*) ==> false; Discharge ==> Stat20: (FORALL i in Za, j in Za | ((i notin n2) & (j notin n2)) imp (eps0 Ra_GT (Ra_ABS((h~[i]) Ra_MINUS (h~[j])))) )
(eps0,n2)-->Stat1(Stat3,Stat10,Stat16,Stat20*) ==> false; Discharge ==> QED
--
-- Preliminary to showing that the reciprocal of any rational Cauchy sequence not equivalent to the zero sequence
-- is, in its turn, a rational Cauchy sequence, we prove that every  rational Cauchy sequence not equivalent to
-- the zero sequence has, from a certain point on, only non-zero components.
--
Theorem 565: ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) imp ({h in Za | (FORALL i in (Za - h) | (G~[i]) /= Ra_0)} /= 0). Proof:
Suppose_not(g) ==> (g in RaCauchy) & (not Ra_eqseq(g,Ra0Seq)) & Stat1: ({h in Za | (FORALL i in (Za - h) | (g~[i]) /= Ra_0)} = 0)
	g-->T563 ==> Stat2: (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
			(FORALL i in (Za - n) | (Ra_ABS(g~[i]) Ra_GT eps) & (Ra_ABS(g~[i]) Ra_GT Ra_0)) & (Ra_ABS(g~[n]) Ra_GT Ra_0))
	(a,n)-->Stat2 ==> Stat3: (FORALL i in (Za - n) | (Ra_ABS(g~[i]) Ra_GT a) & (Ra_ABS(g~[i]) Ra_GT Ra_0)) & (Ra_ABS(g~[n]) Ra_GT Ra_0) & (a in Ra) & (n in Za) & (a Ra_GT Ra_0)
	n-->Stat1 ==> Stat4: not(FORALL i in (Za - n) | (g~[i]) /= Ra_0)
	i0-->Stat4 ==> Stat5: (i0 in (Za - n)) & ((g~[i0]) = Ra_0)
	i0-->Stat3 ==> Ra_ABS(g~[i0]) Ra_GT a
	Use_def(RaCauchy) ==> Stat6: g in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
	()-->Stat6 ==> g in RaSeq
	g-->T546 ==> Stat7: (domain(g) = Za) & (range(g) incin Ra)
	(i0,g)-->T71(Stat7,Stat5*) ==> (g~[i0]) in Ra
	(g~[i0])-->T527 ==> Ra_ABS(g~[i0]) in Ra
	(a,Ra_0)-->T473(Stat3*) ==> a Ra_GE Ra_0
	(Ra_ABS(g~[i0]),a,Ra_0)-->T509 ==> Ra_ABS(g~[i0]) Ra_GT Ra_0
	(Ra_ABS(g~[i0]),Ra_0)-->T473 ==> Ra_ABS(g~[i0]) /= Ra_0
	T525 ==> Stat8: (FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0)))
(g~[i0])-->Stat8 ==> false; Discharge ==> QED
--
Theorem 566: ((F in RaSeq) & (M = arb({h in Za | (FORALL i in (Za - h) | (F~[i]) /= Ra_0)}))) imp (Ras_Recip(F) = Ras_Recip(shifted_seq(F,M))). Proof+:
Suppose_not(f,m) ==> AUTO
--
-- Reasoning by contradiction, assume that $f$ is a counterexample.
--
	Use_def(Ras_Recip) ==> Stat1: (m = arb({h in Za | (FORALL i in (Za - h) | (f~[i]) /= Ra_0)})) &
		(shifted_seq({[i, Recip(f~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (f~[i]) /= Ra_0)})) /= shifted_seq({[i, Recip((shifted_seq(f,m))~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)})))
	f-->T546(*) ==> Stat2: (domain(f) = Za) & Svm(f) & (range(f) incin Ra)
--
-- The integer $m = arb({h in Za | (FORALL i in (Za - h) | (f~[i]) /= Ra_0)})$ cannot be $0$
-- must belongs to the set ${h in Za | (FORALL i in (Za - h) | (f~[i]) /= Ra_0)}$.
--
	Use_def(Svm)(Stat2*) ==> Is_map(f)
	Suppose ==> m = 0
		f-->T343(Stat2*) ==> shifted_seq(f,0) = f
	EQUAL ==> false; Discharge ==> Stat3: m /= 0
	({h in Za | (FORALL i in (Za - h) | (f~[i]) /= Ra_0)})-->T0(Stat1,Stat3*) ==> Stat4: m in {h in Za | (FORALL i in (Za - h) | (f~[i]) /= Ra_0)}
	()-->Stat4(Stat4*) ==> Stat5: (m in Za) & Stat6: (FORALL i in (Za - m) | (f~[i]) /= Ra_0)
--
-- On the other hand, the analogous shift number $n$ required in the determination of the reciprocal of
-- $shifted_seq(f,m)$ must be $0$, since $0$ clearly belongs to the set
--	${h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)}$.
-- For, assuming the contrary, there would be an unsigned integer $i0$ for which $((shifted_seq(f,m))~[i0]) = Ra_0$.
-- However, $(shifted_seq(f,m))~[i0]$ has the same value as $f~[m PLUS i0]$ and the latter cannot be $Ra_0$, because
-- $m PLUS i0$ is not smaller than $m$. Therefore [...]
--
--
	Suppose ==> Stat7: arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)}) /= 0
		Loc_def ==> n = arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)})
		({h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)})-->T0(Stat7*) ==> Stat8: (n * {h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)} = 0) &
			Stat9: (n in {h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)})
		()-->Stat9 ==> n in Za
		T211 ==> 0 in Za
		Suppose ==> 0 in {h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)}
		(n,0)-->T31(Stat7*) ==> false; Discharge ==> Stat10: 0 notin {h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)}
		()-->Stat10(Stat8*) ==> Stat11: not(FORALL i in (Za - 0) | ((shifted_seq(f,m))~[i]) /= Ra_0)
		i0-->Stat11(Stat11*) ==> Stat12: (i0 in Za) & (((shifted_seq(f,m))~[i0]) = Ra_0)
		Use_def(shifted_seq)(Stat12*) ==> Stat13: ((f @ Shift(m))~[i0]) = Ra_0
		(m,i0)-->T339(Stat5,Stat12*) ==> Stat14: Svm(Shift(m)) & (domain(Shift(m)) = Za) & (range(Shift(m)) incin Za) & ((Shift(m)~[i0])=(m PLUS i0))
		(f,Shift(m),i0)-->T130(Stat2,Stat14,Stat12,Stat13*) ==> Ra_0 = f~[Shift(m)~[i0]]
		EQUAL(Stat14) ==> Stat15: Ra_0 = f~[m PLUS i0]
		(m,i0)-->T292 ==> Stat16: (i0 PLUS m) notin m
		ALGEBRA(Stat5,Stat12,Stat16) ==> Stat17: ((m PLUS i0) notin m) & ((m PLUS i0) in Za)
	(m PLUS i0)-->Stat6(Stat17,Stat15*) ==> false; Discharge ==> Stat18: arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(f,m))~[i]) /= Ra_0)}) = 0
	({[i, Recip((shifted_seq(f,m))~[i])]: i in Za})-->T343(Stat18*) ==> Stat19: shifted_seq({[i, Recip((shifted_seq(f,m))~[i])]: i in Za},0) = {[i, Recip((shifted_seq(f,m))~[i])]: i in Za}
	EQUAL(Stat1,Stat18,Stat19) ==> Stat20: shifted_seq({[i, Recip(f~[i])]: i in Za}, m) /= {[i, Recip((shifted_seq(f,m))~[i])]: i in Za}
--
-- We will refute the inequality just obtained, thereby being able to draw the desired conclusion.
-- We begin by observing that $shifted_seq({[i, Recip(f~[i])]: i in Za}, m)$ has the same domain as
-- ${[i, Recip((shifted_seq(f,m))~[i])]: i in Za}$, namely $Za$.
--
	({[i, Recip(f~[i])]: i in Za},m)-->T354(Stat5,Stat5*) ==> domain(shifted_seq({[i, Recip(f~[i])]: i in Za}, m)) = Za
	TELEM ==> (Za /= 0) & Svm({[i, Recip((shifted_seq(f,m))~[i])]: i in Za}) & (domain({[i, Recip((shifted_seq(f,m))~[i])]: i in Za}) = Za)
--
-- Then, picking an unsigned integer $n0$ where the left-hand side of the inequality Stat20
-- has a value differring from the value of the right-hand side, and simplifying the
-- expression of the right-hand value relative to $n0$, we get the inequality
--	$(shifted_seq({[i, Recip(f~[i])]: i in Za}, m)~[n0]) /= Recip((shifted_seq(f,m))~[n0])$.
-- Hence we get
--	$(shifted_seq({[i, Recip(f~[i])]: i in Za}, m)~[n0]) /= Recip(f~[m PLUS n0])$.
--
        (m, {[i, Recip(f~[i])]: i in Za})-->T352(Stat5,Stat5*) ==> shifted_seq({[i, Recip(f~[i])]: i in Za}, m) in Subseqs({[i, Recip(f~[i])]: i in Za})
        TELEM ==> Stat21: Svm({[i, Recip(f~[i])]: i in Za}) & (domain({[i, Recip(f~[i])]: i in Za}) = Za)
        Use_def(next) ==> domain({[i, Recip(f~[i])]: i in Za}) in next(Za)
        APPLY(h_thryvar:h) subseq(g->shifted_seq({[i, Recip(f~[i])]: i in Za}, m),f->{[i, Recip(f~[i])]: i in Za}) ==> Svm(shifted_seq({[i, Recip(f~[i])]: i in Za}, m))
	(shifted_seq({[i, Recip(f~[i])]: i in Za}, m),{[i, Recip((shifted_seq(f,m))~[i])]: i in Za},Za)-->T337(Stat20*) ==> Stat22: not(FORALL i in Za | (shifted_seq({[i, Recip(f~[i])]: i in Za}, m)~[i]) = ({[i, Recip((shifted_seq(f,m))~[i])]: i in Za}~[i]))
	n0-->Stat22(Stat22*) ==> Stat23: (n0 in Za) & ((shifted_seq({[i, Recip(f~[i])]: i in Za}, m)~[n0]) /= ({[i,Recip((shifted_seq(f,m))~[i])]: i in Za}~[n0]))
	APPLY() Must_be_svm(b(i)->Recip((shifted_seq(f,m))~[i]),s->Za,u->n0) ==> (n0 in Za) imp (({[i,Recip((shifted_seq(f,m))~[i])]: i in Za}~[n0]) = Recip((shifted_seq(f,m))~[n0]))
	Use_def(shifted_seq)(Stat23*) ==> Stat24: (({[i, Recip(f~[i])]: i in Za} @ Shift(m))~[n0]) /= Recip((f @ Shift(m))~[n0])
	(m,n0)-->T339(Stat5,Stat23*) ==> Stat25: Svm(Shift(m)) & (domain(Shift(m)) = Za) & (range(Shift(m)) incin Za) & ((Shift(m)~[n0]) = (m PLUS n0))
	(f,Shift(m),n0)-->T129(Stat2,Stat23,Stat25*) ==> ((f @ Shift(m))~[n0]) = (f~[Shift(m)~[n0]])
	EQUAL(Stat24) ==> Stat26: (({[i, Recip(f~[i])]: i in Za} @ Shift(m))~[n0]) /= Recip(f~[m PLUS n0])
	({[i, Recip(f~[i])]: i in Za},Shift(m),n0)-->T129(Stat23,Stat25,Stat26*) ==> Stat27: ({[i, Recip(f~[i])]: i in Za}~[(Shift(m))~[n0]]) /= Recip(f~[m PLUS n0])
	EQUAL(Stat27,Stat25) ==> Stat28: ({[i, Recip(f~[i])]: i in Za}~[m PLUS n0]) /= Recip(f~[m PLUS n0])
--
-- However, the left-hand side of the inequality so obtained can easily be reduced
-- to the same form as the right-hand side, which leads to the sought contradiction.
--
	APPLY() Must_be_svm(b(i)->Recip(f~[i]),s->Za,u->(m PLUS n0)) ==> Stat29: ((m PLUS n0) in Za) imp (({[i, Recip(f~[i])]: i in Za}~[m PLUS n0]) = Recip(f~[m PLUS n0]))
(m,n0)-->T283(Stat5,Stat23,Stat29,Stat28*) ==> false; Discharge ==> QED
--
-- What follows generalizes the reflexivity property of $Ra_eqseq$ stated by Theorem 546.
--
Theorem 567: ((F in RaCauchy) & (M in Za)) imp ((shifted_seq(F,M) in RaCauchy) & Ra_eqseq(F,shifted_seq(F,M))). Proof:
Suppose_not(f,m) ==> AUTO
--
-- Assume $f,m$ to be a counterexample to our statement.
-- To see that $shifted_seq(f,m)$ is infinite (which will allow us to exploit Theorem 354),
-- it suffices to show that its domain is $Za$. This yields that this subsequence of $f$
-- is a Cauchy sequence equivalent to $f$, proving the desired statement.
--
	T539(*) ==> Stat1: f in RaSeq
	f-->T546(Stat1*) ==> (domain(f) = Za) & (range(f) incin Ra) & Svm(f)
	(f,m)-->T354(*) ==> Stat2: domain(shifted_seq(f,m)) = Za
	(shifted_seq(f,m))-->T172(Stat2*) ==> #domain(shifted_seq(f,m)) incin #shifted_seq(f,m)
	T209(Stat2*) ==> Card(Za)
	Za-->T164(Stat2*) ==> Za = #Za
	T206(Stat2*) ==> (not Finite(Za))
	EQUAL(Stat2*) ==> (not Finite(#domain(shifted_seq(f,m))))
	(#shifted_seq(f,m),#domain(shifted_seq(f,m)))-->T189(Stat2*) ==> (not Finite(shifted_seq(f,m)))
	(m,f)-->T352(*) ==> shifted_seq(f,m) in Subseqs(f)
(f,shifted_seq(f,m))-->T549(*) ==> false; Discharge ==> QED
--
--
--
Theorem 568: ((F in RaCauchy) & (not Ra_eqseq(F,Ra0Seq))) imp (EXISTS g in RaCauchy | Ra_eqseq(F,g) & (Ras_Recip(F) = Ras_Recip(g)) &
	(FORALL i in Za | ((g~[i]) /= Ra_0) & (Ras_Recip(g)~[i] = Recip(g~[i])))). Proof+:
Suppose_not(fp) ==> Stat1: (fp in RaCauchy) & (not Ra_eqseq(fp,Ra0Seq)) & Stat2: (not(EXISTS g in RaCauchy | Ra_eqseq(fp,g) & (Ras_Recip(fp) = Ras_Recip(g)) &
	(FORALL i in Za | ((g~[i]) /= Ra_0) & (Ras_Recip(g)~[i] = Recip(g~[i])))))
--
-- Reasoning by contradiction, assume that $fp$ is a Cauchy sequence, inequivalent
-- to the zero sequence, such that no Cauchy sequence $g$ equivalent to $fp$ and whose
-- reciprocal equals the reciprocal $Ras_Recip(fp)$ of $fp$ exists fulfilling
-- the condition $(FORALL i in Za | ((g~[i]) /= Ra_0) & (Ras_Recip(g)~[i] = Recip(g~[i])))$.
--
	Use_def(Ras_Recip) ==> Ras_Recip(fp) = shifted_seq({[i, Recip(fp~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (fp~[i]) /= Ra_0)}))
	Loc_def ==> Stat3: m0 = arb({h in Za | (FORALL i in (Za - h) | (fp~[i]) /= Ra_0)})
	EQUAL ==> Ras_Recip(fp) = shifted_seq({[i, Recip(fp~[i])]: i in Za}, m0)
--
-- We will show that if $shifted_seq(fp,m0)$ is taken as $g$ in Stat2, a contradiction
-- proving the desired statement arises.
-- Observe, in the first place, that the shift number $m0$ used in the definition of
-- $Recip(fp)$ belongs to $Za$; accordingly, $shifted_seq(fp,m0)$ is a subsequence
-- (not necessarily infinite, a priori) of the sequence $fp$.
--
	Suppose ==> Stat4: not((m0 in Za) & (FORALL i in (Za - m0) | (fp~[i]) /= Ra_0))
		fp-->T565(Stat1,Stat1*) ==> Stat5: {h in Za | (FORALL i in (Za - h) | (fp~[i]) /= Ra_0)} /= 0
		({h in Za | (FORALL i in (Za - h) | (fp~[i]) /= Ra_0)})-->T0(Stat3,Stat5*) ==> Stat6: (m0 in {h in Za | (FORALL i in (Za - h) | (fp~[i]) /= Ra_0)})
	()-->Stat6(Stat4*) ==> false; Discharge ==> Stat7: (m0 in Za) & Stat8: (FORALL i in (Za - m0) | (fp~[i]) /= Ra_0)
--
-- The preceding Theorem 566 and Theorem 567 yield that $shifted_seq(fp,m0)$ is a
-- Cauchy sequence equivalent to $fp$ and has the same reciprocal as $fp$.
--
	(fp,m0)-->T567(Stat1,Stat7*) ==>  Stat9: (shifted_seq(fp,m0) in RaCauchy) & (Ra_eqseq(fp,shifted_seq(fp,m0)))
	T539(Stat1,Stat1*) ==> Stat10: fp in RaSeq
	(fp,m0)-->T566(Stat10,Stat3*) ==> Stat11: Ras_Recip(fp) = Ras_Recip(shifted_seq(fp,m0))
--
-- At this point, all that remains to be proved is that each component of the sequence
-- $shifted_seq(fp,m0)$ is non-zero and each component of the reciprocal of this sequence
-- equals the reciprocal of the corresponding component of $shifted_seq(fp,m0)$.
--
--
-- To see that zero cannot be a component of $shifted_seq(fp,m)$, otherwise stated that
--	$((shifted_seq(fp,m0))~[i]) /= Ra_0$
-- for any $i in Za$, it suffices to exploit the definitions
-- of the reciprocal of a rational Cauchy sequence and of the $Shift$ sequence.
--
	Suppose ==> Stat12: not(FORALL i in Za | ((shifted_seq(fp,m0))~[i]) /= Ra_0)
		i2-->Stat12(Stat12*) ==> Stat13: (i2 in Za) & (((shifted_seq(fp,m0))~[i2]) = Ra_0)
		Use_def(shifted_seq)(Stat12*) ==> ((fp @ Shift(m0))~[i2]) = Ra_0
		fp-->T546(Stat10,Stat10*) ==> Stat14: (domain(fp) = Za) & (range(fp) incin Ra) & Svm(fp)
		(m0,i2)-->T339(Stat7,Stat13*) ==> Svm(Shift(m0)) & (domain(Shift(m0)) = Za) & (range(Shift(m0)) incin Za) & ((Shift(m0)~[i2])=(m0 PLUS i2))
		(fp,Shift(m0),i2)-->T130(Stat13*) ==> Ra_0 = fp~[Shift(m0)~[i2]]
		EQUAL(Stat14) ==> Stat15: Ra_0 = fp~[m0 PLUS i2]
		(m0,i2)-->T283(Stat7,Stat13*) ==> (m0 PLUS i2) in Za
		(m0,i2)-->T292(Stat7,Stat7*) ==> (m0 PLUS i2) notin m0
	(m0 PLUS i2)-->Stat8(Stat15*) ==> false; Discharge ==> Stat16: (FORALL i in Za | ((shifted_seq(fp,m0))~[i]) /= Ra_0)
--
	Suppose ==> Stat17: not(FORALL i in Za | (((shifted_seq(fp,m0))~[i]) /= Ra_0) & ((Ras_Recip(shifted_seq(fp,m0))~[i]) = Recip(shifted_seq(fp,m0)~[i])))
		i0-->Stat17(Stat17*) ==> Stat18: (i0 in Za) & ((((shifted_seq(fp,m0))~[i0]) = Ra_0) or ((Ras_Recip(shifted_seq(fp,m0))~[i0]) /= Recip(shifted_seq(fp,m0)~[i0])))
		i0-->Stat16(Stat18*) ==> (Ras_Recip(shifted_seq(fp,m0))~[i0]) /= Recip(shifted_seq(fp,m0)~[i0])
--
-- Observe now that on the one hand
--	$arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)})$
-- must differ from $0$.
--
		Use_def(Ras_Recip)(Stat18*) ==> (shifted_seq({[i, Recip((shifted_seq(fp,m0))~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}))~[i0]) /= Recip(shifted_seq(fp,m0)~[i0])
		Suppose ==> arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}) = 0
			({[i, Recip((shifted_seq(fp,m0))~[i])]: i in Za})-->T343(Stat18*) ==> shifted_seq({[i, Recip((shifted_seq(fp,m0))~[i])]: i in Za}, 0) = {[i, Recip((shifted_seq(fp,m0))~[i])]: i in Za}
			EQUAL(Stat18) ==> (shifted_seq({[i, Recip((shifted_seq(fp,m0))~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}))~[i0]) = ({[i, Recip((shifted_seq(fp,m0))~[i])]: i in Za}~[i0])
			APPLY() Must_be_svm(b(i)->Recip((shifted_seq(fp,m0))~[i]),s->Za,u->i0) ==> (i0 in Za) imp ({[i,Recip((shifted_seq(fp,m0))~[i])]: i in Za}~[i0] = Recip((shifted_seq(fp,m0))~[i0]))
		(Stat17*)ELEM ==> false; Discharge ==> Stat19: arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}) /= 0
--
-- But, on the other hand, if it differs from $0$, then $0$ cannot be a member of the
-- non-void set
--	${h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}$,...
--
		({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)})-->T0(Stat19*) ==> Stat20: (arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}) in {h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)})  & (arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}) * {h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)} = 0)
		()-->Stat20(Stat20*) ==> arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}) in Za
--		(arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}))-->T207(Stat20*) ==> Ord(arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}))
		T211 ==> Stat21: Ord(0) & (0 in Za)
		(arb({h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}),0)-->T31(Stat19*) ==> Stat22: 0 notin {h in Za | (FORALL i in (Za - h) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)}
--
-- ... and hence there must exist a non-negative integer $i1$ such that the $i1$-th component
-- of $shifted_seq(fp,m0))~[i1])$ is zero,...
--
		()-->Stat22(Stat21*) ==> Stat23: not(FORALL i in (Za - 0) | ((shifted_seq(fp,m0))~[i]) /= Ra_0)
		i1-->Stat23(Stat23*) ==> Stat24: (i1 in Za) & (((shifted_seq(fp,m0))~[i1]) = Ra_0)
--
-- ... a possibility which we have discarded already.
--
	i1-->Stat16(Stat24*) ==> false; Discharge ==> Stat25: (FORALL i in Za | (((shifted_seq(fp,m0))~[i]) /= Ra_0) & ((Ras_Recip(shifted_seq(fp,m0))~[i]) = Recip(shifted_seq(fp,m0)~[i])))
--
-- Having now proved that $g=shifted_seq(fp,m)$ enjoys all properties appearing in the
-- formula Stat2 stating that no sequence $g$ with those properties exists, we reach
-- by contradiction the desired conclusion.
--
(shifted_seq(fp,m0))-->Stat2(Stat9,Stat11,Stat25*) ==> false; Discharge ==> QED
--
--
--
Theorem 569: [The reciprocal of a non-null rational sequence is a rational sequence] ((G in RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) imp (Ras_Recip(G) in RaSeq). Proof:
--??    Suppose_not(gp) ==> Stat1: AUTO
    Suppose_not(gp) ==> Stat1: (gp in RaCauchy) & (not Ra_eqseq(gp,Ra0Seq)) & (Ras_Recip(gp) notin RaSeq)
--
-- Reasoning by contradiction, assume that $gp$ is a Cauchy sequence, inequivalent to the zero sequence, and that
-- the reciprocal $Ras_Recip(gp)$ of $gp$ is not an infinite sequence of rational numbers.
--
        Use_def(Ras_Recip) ==> shifted_seq({[i, Recip(gp~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})) notin RaSeq
        Loc_def ==> Stat2: a0 = arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})
        EQUAL ==> shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) notin RaSeq
--
-- Observe, in the first place, that the shift number $a0$ used in the definition of
-- $Ras_Recip(gp)$ belongs to $Za$; accordingly, $Recip(gp)$ is a subsequence
-- (not necessarily infinite, a priori) of the sequence ${[i, Recip(gp~[i])]: i in Za}$.
--
        Suppose ==> Stat3: not((a0 in Za) & (FORALL i in (Za - a0) | (gp~[i]) /= Ra_0))
            gp-->T565(Stat1,Stat1*) ==> Stat4: {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)} /= 0
            ({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})-->T0(Stat2,Stat4*) ==> Stat5: (a0 in {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})
        ()-->Stat5(Stat3*) ==> false; Discharge ==> Stat6: (a0 in Za) & Stat7: (FORALL i in (Za - a0) | (gp~[i]) /= Ra_0)
--
        (a0, {[i, Recip(gp~[i])]: i in Za})-->T352(Stat6,Stat6*) ==> shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) in Subseqs({[i, Recip(gp~[i])]: i in Za})
--
-- Hence $Recip(gp)$ is a single-valued map whose domain and range are included
-- in the domain and range of ${[i, Recip(gp~[i])]: i in Za}$ (the former of which
-- is $Za$), respectively.
--
        TELEM ==> Stat8: Svm({[i, Recip(gp~[i])]: i in Za}) & (domain({[i, Recip(gp~[i])]: i in Za}) = Za)
        Use_def(next) ==> domain({[i, Recip(gp~[i])]: i in Za}) in next(Za)
        APPLY(h_thryvar:h) subseq(g->shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0),f->{[i, Recip(gp~[i])]: i in Za}) ==>
 		Stat9: Svm(shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)) & (shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) incin (domain({[i, Recip(gp~[i])]: i in Za}) PROD range({[i, Recip(gp~[i])]: i in Za})))
--
-- Moreover, the domain of $Recip(gp)$ is precisely $Za$; therefore our
-- initial hypothesis becomes that $Recip(gp)$ is not included in $Za PROD Ra$,
-- while on the other hand it is included in $Za PROD range({[i, Recip(gp~[i])]: i in Za})$.
--
        ({[i, Recip(gp~[i])]: i in Za},a0)-->T354(Stat8,Stat6*) ==> Stat10: domain(shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)) = Za
        Use_def(RaSeq) ==> Stat11: shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) notin {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}
        ()-->Stat11(Stat9*) ==> Stat12: shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) nincin (Za PROD Ra)
--
--
--
        Suppose ==> Stat13: shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) nincin (Za PROD {Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0})
            (shifted_seq({[i, Recip(gp~[i])]: i in Za},a0),domain({[i, Recip(gp~[i])]: i in Za}),range({[i, Recip(gp~[i])]: i in Za}))-->T141(Stat9,Stat9*) ==> Stat14: Is_map(shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0))
            (shifted_seq({[i, Recip(gp~[i])]: i in Za},a0),Za,{Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0})-->T141(Stat13,Stat10,Stat14*) ==> Stat15: not(range(shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)) incin {Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0})
            d-->Stat15(Stat15*) ==> (d in range(shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0))) & Stat16: (d notin {Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0})
            Use_def(shifted_seq)(Stat15*) ==> d in range({[i, Recip(gp~[i])]: i in Za} @ Shift(a0))
            Use_def(Shift)(Stat15*) ==> d in range({[i, Recip(gp~[i])]: i in Za} @ {[i, a0 PLUS i]: i in Za})
            Use_def(@)(Stat15*) ==> d in range({[car(x),cdr(y)]: x in {[i, a0 PLUS i]: i in Za}, y in {[i, Recip(gp~[i])]: i in Za} | cdr(x) = car(y)})
            SIMPLF(Stat15*) ==> Stat17: d in range({[car([i, a0 PLUS i]),cdr([j, Recip(gp~[j])])]: i in Za, j in Za | cdr([i, a0 PLUS i]) = car([j, Recip(gp~[j])])})
            (Stat17)ELEM ==> Stat18: d in {Recip(gp~[j]): i in Za, j in Za | (a0 PLUS i) = j}
            (i1,j1)-->Stat18(Stat18*) ==> Stat19: (i1 in Za) & (j1 in Za)  & (d = Recip(gp~[j1])) & ((a0 PLUS i1) = j1)
            j1-->Stat16(Stat19*) ==> (gp~[j1]) = Ra_0
            EQUAL(Stat19) ==> Stat20: (gp~[a0 PLUS i1]) = Ra_0
            Suppose ==> Stat21: (a0 PLUS i1) notin (Za - a0)
                ALGEBRA(Stat6,Stat19,Stat21*) ==> Stat22: ((a0 PLUS i1) in a0)  & ((a0 PLUS 0) notin a0)
                Suppose ==> i1 = 0
                EQUAL(Stat19) ==> false; Discharge ==> Stat23: i1 /= 0
            (a0,i1)-->T284(Stat6,Stat19,Stat23,Stat22*) ==>  false; Discharge ==> Stat24: (a0 PLUS i1) in (Za - a0)
        (a0 PLUS i1)-->Stat7(Stat24,Stat20*) ==> false; Discharge ==> Stat25: shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0) incin (Za PROD {Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0})
        Suppose ==> Stat26: not({Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0 } incin Ra)
            r0-->Stat26 ==> (r0 notin Ra) & Stat27: (r0 in {Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0})
            i0-->Stat27 ==> Stat28: (i0 in Za) & (Recip(gp~[i0]) notin Ra) & ((gp~[i0]) /= Ra_0)
            (gp,i0)-->T550(Stat28,Stat1*) ==> (gp~[i0]) in Ra
        (gp~[i0])-->T462(Stat26) ==> false; Discharge ==> Stat29: {Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0} incin Ra
    (Za,Za,{Recip(gp~[i]): i in Za | (gp~[i]) /= Ra_0},Ra)-->T256(Stat25,Stat29,Stat12*) ==> false; Discharge ==> QED
--
-- Next we prove that the reciprocal of any rational Cauchy sequence
-- not equivalent to the zero sequence is, in its turn, a rational Cauchy sequence.
--
Theorem 570: [Reciprocal and quotient of rational Cauchy sequences are, when defined, Cauchy sequences] (({F,G} incin RaCauchy) & (not Ra_eqseq(G,Ra0Seq))) imp ((Ras_Recip(G) in RaCauchy) & ((F Ras_OVER G) in RaCauchy)). Proof+:
Suppose_not(f,gq) ==> AUTO
--
-- Reasoning by contradiction, assume that $f,gq$ are Cauchy sequences, $gq$ is inequivalent to the zero sequence, and
-- either the reciprocal of $gq$ or the quotient of $f$ by $gq$ fails to be a Cauchy sequence. Of these alternatives,
-- the former prevails immediately, and we must therefore proceed assuming that $Recip(gq)$ is not a Cauchy sequence.
--
	Suppose ==> Ras_Recip(gq) in RaCauchy
		Use_def(Ras_OVER) ==> (f Ras_TIMES Ras_Recip(gq)) notin RaCauchy
	(f, Ras_Recip(gq))-->T561 ==> false; Discharge ==> Stat1: (gq in RaCauchy) & (not Ra_eqseq(gq,Ra0Seq)) & (Ras_Recip(gq) notin RaCauchy)
--
-- Without loss of generality, we can assume that there is a rational
-- Cauchy sequence $gp$ whose reciprocal equals the sequence of the
-- reciprocals of the individual components of $gp$ and fails to be
-- a rational Cauchy sequence. Obviously such sequence $gp$ is not
-- equivalent to the everywhere null sequence.
--
	gq-->T568 ==> Stat2: (EXISTS g in RaCauchy | Ra_eqseq(gq,g) & (Ras_Recip(gq) = Ras_Recip(g)) &
		(FORALL i in Za | ((g~[i]) /= Ra_0) & (Ras_Recip(g)~[i] = Recip(g~[i]))))
	gp-->Stat2(Stat1*) ==> Stat3: (gp in RaCauchy) & Ra_eqseq(gq,gp) & (Ras_Recip(gp) notin RaCauchy) &
		Stat4: (FORALL i in Za | ((gp~[i]) /= Ra_0) & (Ras_Recip(gp)~[i] = Recip(gp~[i])))
	Suppose ==> Ra_eqseq(gp,Ra0Seq)
		T545(Stat3*) ==> Ra0Seq in RaCauchy
		T539(*) ==> (Ra0Seq in RaSeq) & (gq in RaSeq) & (gp in RaSeq)
		(gq,gp,Ra0Seq)-->T553(Stat3*) ==> Ra_eqseq(Ra0Seq,gq)
		Ra0Seq-->T546(Stat3*) ==> Ra_eqseq(Ra0Seq,Ra0Seq)
	(Ra0Seq,Ra0Seq,gq)-->T553(*) ==> false; Discharge ==> not(Ra_eqseq(gp,Ra0Seq))
--
-- Saying that $Ras_Recip(gp)$ is not a Cauchy sequence amounts to asserting that
-- either it is not an infinite sequence of rational numbers
-- or for some positive rational number $eps=eps0$ the set
--	${ i * j : i in Za, j in Za | Ra_ABS((shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)~[i]) Ra_MINUS (shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)~[j])) Ra_GT eps }$,
-- where $a0=arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})$, is infinite.
-- However, the former case must be excluded by Theorem T455a.
--
	Use_def(RaCauchy)(Stat3*) ==> Stat5: Ras_Recip(gp) notin {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
	gp-->T569(Stat3*) ==> (Ras_Recip(gp) in RaSeq)
	() --> Stat5(Stat5*) ==> (not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS(((Ras_Recip(gp))~[i]) Ra_MINUS ((Ras_Recip(gp))~[j])) Ra_GT eps })))
	Use_def(Ras_Recip)(Stat5*) ==> Stat6: (shifted_seq({[i, Recip(gp~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})) in RaSeq) & Stat7: (not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS((shifted_seq({[i, Recip(gp~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)}))~[i]) Ra_MINUS (shifted_seq({[i, Recip(gp~[i])]: i in Za}, arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)}))~[j])) Ra_GT eps })))
	Loc_def ==> Stat8: a0 = arb({h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})
	EQUAL(Stat6) ==> Stat9: (not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS((shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)~[i]) Ra_MINUS (shifted_seq({[i, Recip(gp~[i])]: i in Za}, a0)~[j])) Ra_GT eps })))
--
-- After recalling a few basic facts which will be useful in the ongoing,
-- observe that the shift number $a0$ used in the definition of $Recip(gp)$
-- is 0 and hence it belongs to $Za$. This remark enables us to simplify
-- Stat9, referring it directly to the sequence
-- ${[i, Recip(gp~[i])]: i in Za}$ instead of to one of its shifted
-- subsequences.
--
	T451(Stat9*) ==> Stat10: Ra_0 in Ra
	T525(Stat9*) ==> Stat11: (FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0))) &
		Stat12:  (FORALL x | (x in Ra) imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x))) &
		Stat13:  (FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_Rev(x Ra_PLUS Ra_Rev(y)) = (y Ra_PLUS Ra_Rev(x)))) &
		Stat14: (FORALL x | (x in Ra) imp (x Ra_LE x))
--
	Suppose ==> Stat15: not((a0 = 0) & (a0 in Za) & (FORALL i in (Za - a0) | (gp~[i]) /= Ra_0))
		T211(Stat15*) ==> Ord(0) & (0 in Za)
		Suppose ==> Stat16: 0 notin {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)}
			()-->Stat16(Stat15*) ==> Stat17: not(FORALL i in (Za - 0) | (gp~[i]) /= Ra_0)
			i5-->Stat17(Stat17*) ==> (i5 in Za) & ((gp~[i5]) = Ra_0)
		i5-->Stat4(Stat17*) ==> false; Discharge ==> Stat18: 0 in {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)}
		(Stat8,Stat18)ELEM ==> (0 notin a0) & Stat19: (a0 in {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)})
		()-->Stat19(Stat18*) ==> (a0 in Za) & (FORALL i in (Za - a0) | (gp~[i]) /= Ra_0)
	(0,a0)-->T31(Stat15*) ==> false; Discharge ==> Stat20: (a0 = 0) & (a0 in Za) & Stat21: (FORALL i in (Za - a0) | (gp~[i]) /= Ra_0)
	Suppose ==> Stat22: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i]) Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j])) Ra_GT eps }))
		TELEM ==> Is_map({[i, Recip(gp~[i])]: i in Za}) & (domain({[i, Recip(gp~[i])]: i in Za}) = Za)
		({[i, Recip(gp~[i])]: i in Za})-->T343(Stat20*) ==> Stat23: shifted_seq({[i, Recip(gp~[i])]: i in Za},0) = {[i, Recip(gp~[i])]: i in Za}
	EQUAL(Stat23,Stat20,Stat22,Stat9) ==> false; Discharge ==> Stat24: (not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({ i * j : i in Za, j in Za | Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i]) Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j])) Ra_GT eps })))
--
-- Having already discarded the possibility that the reciprocal of $gp$ be not an infinite sequence of
-- rational numbers, we are left with the other alternative to consider. This will lead to a contradiction too.
-- Pick a positive rational number $a$ and a nonnegative integer $n0$ so that all components
-- of the sequence $Ra_ABS(gp~[i])$ are, from the $n0$-th on, greater than $a$. The reciprocal of $a$
-- and the square of this reciprocal clearly belong to $Ra$.
--
	eps0-->Stat24(Stat24,Stat24*) ==> Stat25: (eps0 in Ra) & (eps0 Ra_GT Ra_0) & (not Finite({ i * j : i in Za, j in Za | Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i]) Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j])) Ra_GT eps0 }))
	gp-->T563 ==> Stat26: (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
		(FORALL i in (Za - n) | (Ra_ABS(gp~[i]) Ra_GT eps) & (Ra_ABS(gp~[i]) Ra_GT Ra_0)) & (Ra_ABS(gp~[n]) Ra_GT Ra_0))
	(a,n0)-->Stat26 ==> Stat27: (a in Ra) & (a Ra_GT Ra_0) & (n0 in Za) &
			Stat28: (FORALL i in (Za - n0) | (Ra_ABS(gp~[i]) Ra_GT a) & (Ra_ABS(gp~[i]) Ra_GT Ra_0))
	(a,Ra_0)-->T473(Stat10,Stat27) ==> Stat29: a /= Ra_0
	a-->T462(Stat27*) ==> Stat30: Recip(a) in Ra
	ALGEBRA(Stat27*) ==> Stat31: ((Recip(a) Ra_TIMES Recip(a)) in Ra)
--
-- We begin here the main part of this proof by showing that
--	$Ra_ABS(Recip(gp~[i]) Ra_MINUS Recip(gp~[j])) Ra_LE ((Ra_ABS((gp~[i]) Ra_MINUS (gp~[j]))) Ra_OVER (a Ra_TIMES a))$
-- and
--	$({[i, Recip(gp~[i])]: i in Za}~[i]) = Recip(gp~[i])$,
--	$({[i, Recip(gp~[i])]: i in Za}~[j]) = Recip(gp~[j])$
-- hold for all $i,j in (Za - n0)$, which we now show in a few lines.
--
        Suppose ==> Stat32: not(FORALL i in (Za - n0), j in (Za - n0) | Ra_ABS(Recip(gp~[i]) Ra_MINUS Recip(gp~[j])) Ra_LE ((Ra_ABS((gp~[i]) Ra_MINUS (gp~[j]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(a))))
            (p,q)-->Stat32(Stat32*) ==> Stat33: (p in (Za - n0)) & (q in (Za - n0)) &  (not Ra_ABS(Recip(gp~[p]) Ra_MINUS Recip(gp~[q])) Ra_LE ((Ra_ABS((gp~[p]) Ra_MINUS (gp~[q]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(a))))
            (gp,p)-->T550(Stat33,Stat3*) ==> Stat34: (gp~[p]) in Ra
            (gp,q)-->T550(Stat33,Stat3*) ==> Stat35: (gp~[q]) in Ra
            p-->Stat28 ==> Stat36: Ra_ABS(gp~[p]) Ra_GT a
            q-->Stat28 ==> Stat37: Ra_ABS(gp~[q]) Ra_GT a
        (gp~[p],gp~[q],a,a)-->T538(Stat34,Stat35,Stat36,Stat37,Stat27,Stat33*) ==> false; Discharge ==> Stat38: (FORALL i in (Za - n0), j in (Za - n0) | Ra_ABS(Recip(gp~[i]) Ra_MINUS Recip(gp~[j])) Ra_LE ((Ra_ABS((gp~[i]) Ra_MINUS (gp~[j]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(a))))
--
-- Secondly, we show that the set of all intersections $i*j$ with $i,j in (Za-n0)$ such that
--	$Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a))$
-- is finite; since, moreover, this is a set of unsigned integers, it has an upper bound $u0$.
--
        Suppose ==> Stat39: (not Finite({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )}))
            Set_monot ==> {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )} incin {i * j : i in Za, j in Za | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )}
            ({i * j : i in Za, j in Za | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )},{i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )})-->T189(Stat39) ==> (not Finite({i * j : i in Za, j in Za | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )}))
            Use_def(RaCauchy)(Stat3) ==> Stat40: gp in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
            ()-->Stat40(Stat40) ==> Stat41: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp Finite({ i * j : i in Za, j in Za | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT eps }))
            ALGEBRA ==> ((eps0 Ra_TIMES (a Ra_TIMES a)) in Ra) & (Ra_0 in Ra) & ((Ra_0 Ra_TIMES a) = Ra_0) & ((a Ra_TIMES a) in Ra) & ((Ra_0 Ra_TIMES (a Ra_TIMES a)) = Ra_0)
            (a,Ra_0,a)-->T488(Stat27) ==> (a Ra_TIMES a) Ra_GT (Ra_0 Ra_TIMES a)
            EQUAL(Stat41) ==> (a Ra_TIMES a) Ra_GT Ra_0
            (eps0,Ra_0,a Ra_TIMES a)-->T488(Stat25) ==> (eps0 Ra_TIMES (a Ra_TIMES a)) Ra_GT (Ra_0 Ra_TIMES (a Ra_TIMES a))
            EQUAL(Stat41) ==> (eps0 Ra_TIMES (a Ra_TIMES a)) Ra_GT Ra_0
        (eps0 Ra_TIMES (a Ra_TIMES a))-->Stat41(Stat39*) ==> false; Discharge ==> Stat42: Finite({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )})
--
        Suppose ==> Stat43: not({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )} incin Za)
            c2-->Stat43(Stat43) ==> (c2 notin Za) & Stat44: (c2 in {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )})
            (i2,j2)-->Stat44(Stat43) ==> (i2 in Za) & (j2 in Za) & ((i2 * j2) notin Za)
            T206 ==> Ord(Za)
        (i2,j2)-->T29(Stat43) ==> false; Discharge ==> Stat45: {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )} incin Za
        Loc_def ==> Stat46: u0 = Un({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )})
--
-- The upper bound $u0$ is also the maximum of
--	${i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )}$,
-- provided this set is nonempty.
--
        ({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )})-->T320(Stat42) ==> Stat47: (u0 in Za) & (({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )} /= 0) imp (u0 in {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a) )}))
--
-- Both $n0$ and $next(u0)$ are easily shown to belong to $Za$; therefore the
-- larger of them belongs to $Za$; hence, due to a peculiar property of Cauchy sequences
-- captured by the THEORY cauchyseq_lemma,
-- the set of all intersections $i*j$ with $i,j in (Za-(next(u0) + n0))$ such that
-- $Recip(gp~[i]) Ra_MINUS Recip(gp~[j]) Ra_GT eps0$ is infinite. From this set we can
-- pick an element $i3*j3$.
--
        Suppose ==> Stat48: n0 notin {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)}
            ()-->Stat48(Stat27*) ==> Stat49: (not(FORALL i in (Za - n0) | (gp~[i]) /= Ra_0))
            n1-->Stat49(Stat49) ==> Stat50: (n1 in (Za - n0)) & ((gp~[n1]) = Ra_0)
                (gp,n1)-->T550(Stat50,Stat3*) ==> (gp~[n1]) in Ra
                n1-->Stat28(Stat27,Stat50*) ==> Ra_ABS(gp~[n1]) Ra_GT Ra_0
                (Ra_ABS(gp~[n1]),Ra_0)-->T473(Stat49*) ==> Ra_ABS(gp~[n1]) /= Ra_0
        (gp~[n1])-->Stat11(Stat49*) ==> false; Discharge ==> Stat51: n0 in {h in Za | (FORALL i in (Za - h) | (gp~[i]) /= Ra_0)}
        (Stat20,Stat51*)ELEM ==> Stat52: n0 notin a0
--
        Suppose ==> next(u0) notin Za
            ALGEBRA(Stat52) ==> 1 in Za
            u0-->T317(Stat47*) ==> (u0 PLUS 1) = next(u0)
        (u0,1)-->T283(Stat47*) ==> false; Discharge ==> Stat53: next(u0) in Za
        (Stat27,Stat27*)ELEM ==> n0 in Za
	(Stat53)ELEM ==> Ord(n0) & Ord(next(u0))
        Suppose ==> (next(u0) + n0) notin Za
        (next(u0),n0)-->T29(Stat47*) ==> false; Discharge ==> (next(u0) + n0) in Za
--
        APPLY() cauchyseq_lemma(n0->(next(u0)+n0),R(i,j)->(Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i]) Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j])) Ra_GT eps0)) ==>
			Stat55: not(Finite({ i * j : i in (Za - (next(u0)+n0)), j in (Za - (next(u0)+n0)) | Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i]) Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j])) Ra_GT eps0 }))
        T188(Stat55*) ==> Finite(0)
        EQUAL(Stat55) ==> Stat56: { i * j : i in (Za - (next(u0)+n0)), j in (Za - (next(u0)+n0)) | Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i]) Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j])) Ra_GT eps0 } /= 0
        (i3,j3)-->Stat56(Stat56*) ==> Stat57: (i3 in (Za - (next(u0)+n0))) & (j3 in (Za - (next(u0)+n0))) & (Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i3]) Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j3])) Ra_GT eps0)
--
-- Obviously, $i3$ and $j3$ belong to $Za - n0$.
-- (It will turn out later that they do not exceed $next(u0)$
-- and the smaller of them is at most $u0$.)
--
        (Stat57,Stat57*)ELEM ==> Stat58: (i3 in Za) & (j3 in Za) & (i3 notin n0) & (j3 notin n0) & (i3 notin next(u0)) & (j3 notin next(u0))
--
--
--
        Suppose ==> Stat59: Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a))
            Suppose ==> Stat60: (i3 * j3) notin {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a))}
            (i3,j3)-->Stat60(Stat58*) ==> false; Discharge ==> Stat61: (i3 * j3) in {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a))}
            ({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a))})-->T274(Stat61*) ==> Stat62: (FORALL x in {i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a))} | x incin Un({i * j : i in (Za - n0), j in (Za - n0) | Ra_ABS((gp~[i]) Ra_MINUS (gp~[j])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a))}))
            (i3 * j3)-->Stat62(Stat61,Stat46*) ==> Stat63: (i3 * j3) incin u0
--
            (Stat58)ELEM ==> Stat64: Ord(i3) & Ord(j3)
            (i3,j3)-->T29(Stat64*) ==> Stat66: ((i3 * j3) = i3) or ((j3 * i3) = j3)
--
            Suppose ==> (not(Ord(i3 * j3))) or ((i3 * j3) notin (Za - next(u0)))
                Suppose ==> (i3 * j3) = i3
                    (Stat58,Stat58*)ELEM ==> i3 in (Za - next(u0))
                EQUAL(Stat64) ==> false; Discharge ==> Stat67: (i3 * j3) /= i3
                (Stat66,Stat67*)ELEM ==> (i3 * j3) = j3
                (Stat58,Stat58*)ELEM ==> j3 in (Za - next(u0))
            EQUAL(Stat64) ==> false; Discharge ==> Stat68: Ord(i3 * j3) & ((i3 * j3) in (Za - next(u0)))
            Use_def(next)(Stat68) ==> (i3 * j3) in (Za - (u0+{u0}))
            (u0,i3 * j3)-->T31(Stat47*) ==> Stat69: (u0 in (i3 * j3)) 
        (Stat69,Stat63*)ELEM ==> false; Discharge ==> Stat70: not(Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3])) Ra_GT (eps0 Ra_TIMES (a Ra_TIMES a)))
--
--
--
        Suppose ==> Stat71: not(Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])) Ra_GT eps0)
            TELEM ==> Stat72: Svm({[i, Recip(gp~[i])]: i in Za}) & (domain({[i, Recip(gp~[i])]: i in Za}) = Za)
            Suppose ==> Stat73: [i3,Recip(gp~[i3])] notin {[i,Recip(gp~[i])]: i in Za}
            i3-->Stat73(Stat58*) ==> false; Discharge ==> Stat74: [i3,Recip(gp~[i3])] in {[i,Recip(gp~[i])]: i in Za}
            Suppose ==> Stat75: [j3,Recip(gp~[j3])] notin {[i,Recip(gp~[i])]: i in Za}
            j3-->Stat75(Stat58*) ==> false; Discharge ==> [j3,Recip(gp~[j3])] in {[i,Recip(gp~[i])]: i in Za}
            ({[i,Recip(gp~[i])]: i in Za},[i3,Recip(gp~[i3])])-->T74(Stat74*) ==> ({[i,Recip(gp~[i])]: i in Za}~[car([i3,Recip(gp~[i3])])]) = cdr([i3,Recip(gp~[i3])])
            ({[i,Recip(gp~[i])]: i in Za},[j3,Recip(gp~[j3])])-->T74(Stat74*) ==> ({[i,Recip(gp~[i])]: i in Za}~[car([j3,Recip(gp~[j3])])]) = cdr([j3,Recip(gp~[j3])])
            TELEM ==> car([i3,Recip(gp~[i3])]) = i3
            TELEM ==> cdr([i3,Recip(gp~[i3])]) = Recip(gp~[i3])
            TELEM ==> car([j3,Recip(gp~[j3])]) = j3
            TELEM ==> cdr([j3,Recip(gp~[j3])]) = Recip(gp~[j3])
            EQUAL(Stat70) ==> Stat76: not(Ra_ABS(({[i, Recip(gp~[i])]: i in Za}~[i3]) Ra_MINUS ({[i, Recip(gp~[i])]: i in Za}~[j3])) Ra_GT eps0)
        (Stat57,Stat76*)ELEM ==> false; Discharge ==> Stat77: Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])) Ra_GT eps0
--
--
--
        (gp,j3)-->T550(Stat58,Stat3*) ==> Stat78: (gp~[j3]) in Ra
        (gp,i3)-->T550(Stat58,Stat3*) ==> Stat79: (gp~[i3]) in Ra
        Suppose ==> Stat80: Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])) notin Ra
            Suppose ==> Stat81: ((gp~[i3]) = Ra_0) or ((gp~[j3]) = Ra_0)
                i3-->Stat21(Stat20*) ==> (gp~[i3]) /= Ra_0
                j3-->Stat21(Stat20*) ==> (gp~[j3]) /= Ra_0
            (Stat81*)Discharge ==> Stat82: not(((gp~[i3]) = Ra_0) or ((gp~[j3]) = Ra_0))
            (gp~[j3])-->T462(Stat78,Stat82*) ==> Stat83: Recip(gp~[j3]) in Ra
            (gp~[i3])-->T462(Stat79,Stat82*) ==> Stat84: Recip(gp~[i3]) in Ra
            ALGEBRA(Stat83,Stat84) ==> Stat85: (Ra_Rev(Recip(gp~[j3])) in Ra) &
			((Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])) in Ra)
        (Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3]))-->T527(Stat85,Stat80*) ==> false; Discharge ==> Stat86: Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])) in Ra
--
        T513(Stat79*) ==> Stat87: (FORALL x in Ra | not(x Ra_LT x))
        eps0-->Stat87(Stat25,Stat25*) ==> Stat88: not(eps0 Ra_LT eps0)
        Suppose ==> Stat89: not(Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])) Ra_LE eps0)
            (Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])),eps0)-->T526(Stat86,Stat25,Stat89*) ==> Stat90: Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])) Ra_GT eps0
            (i3,j3)-->Stat38(Stat58*) ==> Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])) Ra_LE ((Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(a)))
            (Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])),((Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(a))))-->T473(Stat86*) ==> Stat91: ((Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(a))) Ra_GE Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3]))
            ALGEBRA(Stat78,Stat79) ==> ((gp~[i3]) Ra_MINUS (gp~[j3])) in Ra
            ((gp~[i3]) Ra_MINUS (gp~[j3]))-->T527(Stat91*) ==> Stat92: (Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3])) in Ra) & (Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3])) Ra_GE Ra_0)
            ALGEBRA(Stat92,Stat30) ==> Stat93: ((Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(a))) in Ra
            (((Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(a))),Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])),eps0)-->T510(Stat86,Stat93,Stat25,Stat90,Stat91*) ==> Stat94: ((Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(a))) Ra_GT eps0
            ALGEBRA(Stat25,Stat27,Stat30*) ==> Stat95: ((eps0 Ra_TIMES (a Ra_TIMES a)) in Ra) & (Ra_0 in Ra) & ((Ra_0 Ra_TIMES Recip(a)) = Ra_0)
            (Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3])),eps0 Ra_TIMES (a Ra_TIMES a))-->T526(Stat70*) ==> Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3])) Ra_LE (eps0 Ra_TIMES (a Ra_TIMES a))
            a-->T491(Stat27*) ==> Stat96: Recip(a) Ra_GT Ra_0
            (Recip(a),Ra_0,Recip(a))-->T488(Stat30,Stat95,Stat96*) ==> (Recip(a) Ra_TIMES Recip(a)) Ra_GT (Ra_0 Ra_TIMES Recip(a))
            EQUAL(Stat95) ==> (Recip(a) Ra_TIMES Recip(a)) Ra_GT Ra_0
            (Recip(a) Ra_TIMES Recip(a),Ra_0)-->T473(Stat96*) ==> Stat97: (Recip(a) Ra_TIMES Recip(a)) Ra_GE Ra_0
            (Recip(a) Ra_TIMES Recip(a))-->Stat14(Stat31,Stat31*) ==> (Recip(a) Ra_TIMES Recip(a)) Ra_LE (Recip(a) Ra_TIMES Recip(a))
            (Recip(a) Ra_TIMES Recip(a),Recip(a) Ra_TIMES Recip(a))-->T473(Stat97*) ==> Stat98: (Recip(a) Ra_TIMES Recip(a)) Ra_GE (Recip(a) Ra_TIMES Recip(a))
            (Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3])),eps0 Ra_TIMES (a Ra_TIMES a))-->T473(Stat95*) ==> Stat99: (eps0 Ra_TIMES (a Ra_TIMES a)) Ra_GE Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3]))
            (eps0 Ra_TIMES (a Ra_TIMES a),Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3])),Recip(a) Ra_TIMES Recip(a),Recip(a) Ra_TIMES Recip(a))-->T516(Stat95,Stat92,Stat31,Stat99,Stat97,Stat98*) ==> ((eps0 Ra_TIMES (a Ra_TIMES a)) Ra_TIMES (Recip(a) Ra_TIMES Recip(a))) Ra_GE (Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3])) Ra_TIMES (Recip(a) Ra_TIMES Recip(a)))
            (eps0,a)-->T463(Stat25,Stat27,Stat29*) ==> ((eps0 Ra_TIMES (a Ra_TIMES a)) Ra_TIMES (Recip(a) Ra_TIMES Recip(a))) = eps0
            EQUAL(Stat99*) ==> Stat100: eps0 Ra_GE (Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3])) Ra_TIMES (Recip(a) Ra_TIMES Recip(a)))
            (eps0,Ra_ABS((gp~[i3]) Ra_MINUS (gp~[j3])) Ra_TIMES (Recip(a) Ra_TIMES Recip(a)),eps0)-->T510(Stat25,Stat93,Stat100,Stat94*) ==> Stat102: eps0 Ra_GT eps0
        (eps0,eps0)-->T473(Stat102,Stat88*) ==> false; Discharge ==> Stat103: Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])) Ra_LE eps0
        (Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])),eps0)-->T473(Stat103,Stat103*) ==> Stat104: eps0 Ra_GE Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3]))
        (eps0,Ra_ABS(Recip(gp~[i3]) Ra_MINUS Recip(gp~[j3])),eps0)-->T510(Stat25,Stat86,Stat77,Stat104*) ==> eps0 Ra_GT eps0
--
    (eps0,eps0)-->T473(Stat88*) ==> false; Discharge ==> QED
--
-- Our next lemma states that if $f,fp$ and $g,gp$ are rational
-- sequences, with $f$ equivalent to $g$ and $fp$ equivalent to $gp$, then the pointwise
-- sum of $f$ and $fp$ is equivalent to the pointwise sum of $g$ and $gp$.
--
Theorem 571: (({F,G,Fp,Gp} incin RaSeq) & Ra_eqseq(F,G) & Ra_eqseq(Fp,Gp)) imp Ra_eqseq(F Ras_PLUS Fp, G Ras_PLUS Gp). Proof:
    Suppose_not(fq,gq,fp,gp) ==> ({fq,gq,fp,gp} incin RaSeq) &
		Ra_eqseq(fq,gq) & Ra_eqseq(fp,gp) & (not Ra_eqseq(fq Ras_PLUS fp, gq Ras_PLUS gp))
--
-- Suppose that $fq,gq,fp,gp$ are a counterexample to our assertion. Then by definition of equivalence of rational
-- sequences, there exists  some positive rational number $eps0$ for which the set
--	${x : x in domain(fq Ras_PLUS fp) | Ra_ABS(((fq Ras_PLUS fp)~[x]) Ra_MINUS ((gq Ras_PLUS gp)~[x])) Ra_GT eps0}$
-- is infinite. But $eps0$ can be writen as the sum $eps1,eps2$ of two smaller positive rationals,
-- and for these the two analogous sets formed using $fq,gq,eps1$ and $fp,gp,eps2$ respectively,
-- are finite.
--
	(fq,gq)-->T541 ==> Stat1: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp Finite({x : x in Za | Ra_ABS((fq~[x]) Ra_MINUS (gq~[x])) Ra_GT eps}))
	(fp,gp)-->T541 ==> Stat2: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp Finite({x : x in Za | Ra_ABS((fp~[x]) Ra_MINUS (gp~[x])) Ra_GT eps}))
	(fq,fp)-->T554 ==> (fq Ras_PLUS fp) in RaSeq
	(gq,gp)-->T554 ==> (gq Ras_PLUS gp) in RaSeq
	(fq Ras_PLUS fp,gq Ras_PLUS gp)-->T541 ==> Stat3: (not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
	Finite({x : x in Za | Ra_ABS(((fq Ras_PLUS fp)~[x]) Ra_MINUS ((gq Ras_PLUS gp)~[x])) Ra_GT eps})))
	eps0-->Stat3 ==> (eps0 in Ra) & (eps0 Ra_GT Ra_0) & (not
	Finite({x : x in Za | Ra_ABS(((fq Ras_PLUS fp)~[x]) Ra_MINUS ((gq Ras_PLUS gp)~[x])) Ra_GT eps0}))
	eps0-->T522 ==> Stat4: (EXISTS e in Ra, e0 in Ra | (eps0 Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e Ra_GT Ra_0) & (eps0 Ra_GT (e Ra_PLUS e0)))
	(eps1,eps2)-->Stat4 ==> (eps1 in Ra) & (eps2 in Ra) & (eps2 Ra_GT Ra_0) & (eps1 Ra_GT Ra_0) & (eps0 Ra_GT (eps1 Ra_PLUS eps2))
	eps1-->Stat1 ==> Finite({x : x in Za | Ra_ABS((fq~[x]) Ra_MINUS (gq~[x])) Ra_GT eps1})
	eps2-->Stat2 ==> Finite({x : x in Za | Ra_ABS((fp~[x]) Ra_MINUS (gp~[x])) Ra_GT eps2})
--
-- However, it is easily seen that the infinite set noted above is included in the union of the
-- two other sets, giving a contradiction which proves our theorem. Indeed, it follows that
-- there must exit an integer m such that $Ra_ABS(((fq~[m] Ra_PLUS fp~[m]) Ra_MINUS ((gq~[m] Ra_PLUS gp~[m]))) Ra_GT eps0$
-- while $Ra_ABS((fq~[m]) Ra_MINUS (gq~[m])) Ra_LE eps1$ and $Ra_ABS((fp~[m]) Ra_MINUS (gp~[m])) Ra_LE eps2$,
--
    Suppose ==> Stat5: not({x : x in Za | Ra_ABS(((fq Ras_PLUS fp)~[x]) Ra_MINUS ((gq Ras_PLUS gp)~[x])) Ra_GT eps0} incin ({x : x in Za | Ra_ABS((fq~[x]) Ra_MINUS (gq~[x])) Ra_GT eps1} + {x : x in Za | Ra_ABS((fp~[x]) Ra_MINUS (gp~[x])) Ra_GT eps2}))
	n--> Stat5 ==> Stat6: (n in {x : x in Za | Ra_ABS(((fq Ras_PLUS fp)~[x]) Ra_MINUS ((gq Ras_PLUS gp)~[x])) Ra_GT eps0}) &
					Stat7: (n notin {x : x in Za | Ra_ABS((fq~[x]) Ra_MINUS (gq~[x])) Ra_GT eps1}) &
					Stat8: (n notin {x : x in Za | Ra_ABS((fp~[x]) Ra_MINUS (gp~[x])) Ra_GT eps2})
	m-->Stat6 ==> (n = m) & (m in Za) & (Ra_ABS(((fq Ras_PLUS fp)~[m]) Ra_MINUS ((gq Ras_PLUS gp)~[m])) Ra_GT eps0)
	m-->Stat7 ==> not (Ra_ABS((fq~[m]) Ra_MINUS (gq~[m])) Ra_GT eps1)
	m-->Stat8 ==> not (Ra_ABS((fp~[m]) Ra_MINUS (gp~[m])) Ra_GT eps2)
--
-- which is in contradiction with an elementary rational inequality.
--
	(fq,m)-->T540 ==> fq~[m] in Ra
	(gq,m)-->T540 ==> gq~[m] in Ra
	(fp,m)-->T540 ==> fp~[m] in Ra
	(gp,m)-->T540 ==> gp~[m] in Ra
	(fq,fp,m)-->T555 ==> (fq Ras_PLUS fp)~[m] = ((fq~[m]) Ra_PLUS (fp~[m]))
	(gq,gp,m)-->T555 ==> (gq Ras_PLUS gp)~[m] = ((gq~[m]) Ra_PLUS (gp~[m]))
	EQUAL ==> Stat9: Ra_ABS(((fq~[m]) Ra_PLUS (fp~[m])) Ra_MINUS ((gq~[m]) Ra_PLUS (gp~[m]))) Ra_GT eps0
	ALGEBRA ==> ((fq~[m]) Ra_PLUS (fp~[m])) Ra_MINUS ((gq~[m]) Ra_PLUS (gp~[m])) = ((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS ((fp~[m]) Ra_MINUS (gp~[m]))
	EQUAL ==> Ra_ABS(((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS ((fp~[m]) Ra_MINUS (gp~[m]))) Ra_GT eps0
	ALGEBRA ==> Stat10: (fq~[m]) Ra_MINUS (gq~[m]) in Ra
	ALGEBRA ==> Stat11: (fp~[m]) Ra_MINUS (gp~[m]) in Ra
	((fq~[m]) Ra_MINUS (gq~[m]))-->T527 ==> Ra_ABS((fq~[m]) Ra_MINUS (gq~[m])) in Ra
	((fp~[m]) Ra_MINUS (gp~[m]))-->T527 ==> Ra_ABS((fp~[m]) Ra_MINUS (gp~[m])) in Ra
	(Ra_ABS((fq~[m]) Ra_MINUS (gq~[m])),eps1)-->T478 ==> eps1 Ra_GE Ra_ABS((fq~[m]) Ra_MINUS (gq~[m]))
	(Ra_ABS((fp~[m]) Ra_MINUS (gp~[m])),eps2)-->T478 ==> eps2 Ra_GE Ra_ABS((fp~[m]) Ra_MINUS (gp~[m]))
	(eps1,Ra_ABS((fq~[m]) Ra_MINUS (gq~[m])),eps2,Ra_ABS((fp~[m]) Ra_MINUS (gp~[m])))-->T493 ==> Stat12: (eps1 Ra_PLUS eps2) Ra_GE (Ra_ABS((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS Ra_ABS((fp~[m]) Ra_MINUS (gp~[m])))
	T525 ==> Stat13: (FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_ABS(x Ra_PLUS y) Ra_LE (Ra_ABS(x) Ra_PLUS Ra_ABS(y))))
	((fq~[m]) Ra_MINUS (gq~[m]),(fp~[m]) Ra_MINUS (gp~[m]))-->Stat13(Stat10,Stat11) ==> Ra_ABS(((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS ((fp~[m]) Ra_MINUS (gp~[m]))) Ra_LE (Ra_ABS((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS Ra_ABS((fp~[m]) Ra_MINUS (gp~[m])))
	(Ra_ABS(((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS ((fp~[m]) Ra_MINUS (gp~[m]))),Ra_ABS((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS Ra_ABS((fp~[m]) Ra_MINUS (gp~[m])))-->T473 ==> Stat14: (Ra_ABS((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS Ra_ABS((fp~[m]) Ra_MINUS (gp~[m]))) Ra_GE Ra_ABS(((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS ((fp~[m]) Ra_MINUS (gp~[m])))
	ALGEBRA ==> Stat15: (eps1 Ra_PLUS eps2 in Ra) & ((Ra_ABS((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS Ra_ABS((fp~[m]) Ra_MINUS (gp~[m]))) in Ra)
	ALGEBRA ==> (((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS ((fp~[m]) Ra_MINUS (gp~[m]))) in Ra
	ALGEBRA ==> Stat16: (Ra_ABS((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS Ra_ABS((fp~[m]) Ra_MINUS (gp~[m]))) in Ra
	(((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS ((fp~[m]) Ra_MINUS (gp~[m])))-->T527 ==> Stat17: Ra_ABS(((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS ((fp~[m]) Ra_MINUS (gp~[m]))) in Ra
	(eps1 Ra_PLUS eps2,Ra_ABS((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS Ra_ABS((fp~[m]) Ra_MINUS (gp~[m])),Ra_ABS(((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS ((fp~[m]) Ra_MINUS (gp~[m]))))-->T480(Stat14,Stat12,Stat17,Stat16,Stat15) ==> (eps1 Ra_PLUS eps2) Ra_GE Ra_ABS(((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS ((fp~[m]) Ra_MINUS (gp~[m])))
	(eps1 Ra_PLUS eps2,Ra_ABS(((fq~[m]) Ra_MINUS (gq~[m])) Ra_PLUS ((fp~[m]) Ra_MINUS (gp~[m]))),eps0)-->T496 ==> Stat18: (eps1 Ra_PLUS eps2) Ra_GT eps0
	(eps0,eps1 Ra_PLUS eps2,eps0)-->T498 ==> eps0 Ra_GT eps0
	(eps0,eps0)-->T473 ==> false; Discharge ==> {x : x in Za | Ra_ABS(((fq Ras_PLUS fp)~[x]) Ra_MINUS ((gq Ras_PLUS gp)~[x])) Ra_GT eps0} incin ({x : x in Za | Ra_ABS((fq~[x]) Ra_MINUS (gq~[x])) Ra_GT eps1} + {x : x in Za | Ra_ABS((fp~[x]) Ra_MINUS (gp~[x])) Ra_GT eps2})
	({x : x in Za | Ra_ABS((fq~[x]) Ra_MINUS (gq~[x])) Ra_GT eps1},{x : x in Za | Ra_ABS((fp~[x]) Ra_MINUS (gp~[x])) Ra_GT eps2})-->T236 ==> Finite({x : x in Za | Ra_ABS((fq~[x]) Ra_MINUS (gq~[x])) Ra_GT eps1} + {x : x in Za | Ra_ABS((fp~[x]) Ra_MINUS (gp~[x])) Ra_GT eps2})
	({x : x in Za | Ra_ABS((fq~[x]) Ra_MINUS (gq~[x])) Ra_GT eps1} + {x : x in Za | Ra_ABS((fp~[x]) Ra_MINUS (gp~[x])) Ra_GT eps2},{x : x in Za | Ra_ABS(((fq Ras_PLUS fp)~[x]) Ra_MINUS ((gq Ras_PLUS gp)~[x])) Ra_GT eps0})-->T189 ==> false
	Discharge ==> QED
--
-- A trivial corollary of the lemma stating that when $f,fp$ and $g,gp$ are rational
-- sequences with $f$ equivalent to $g$ and $fp$ equivalent to $gp$ then the pointwise
-- sum of $f$ and $fp$ is equivalent to the pointwise sum of $g$ and $gp$ is the
-- analogous lemma stating the same for rational Cauchy sequences.
--
Theorem 572: (({F,G,Fp,Gp} incin RaCauchy) & Ra_eqseq(F,G) & Ra_eqseq(Fp,Gp)) imp Ra_eqseq(F Ras_PLUS Fp, G Ras_PLUS Gp). Proof:
    Suppose_not(fq,gq,fp,gp) ==> ({fq,gq,fp,gp} incin RaCauchy) &
		Ra_eqseq(fq,gq) & Ra_eqseq(fp,gp) & (not Ra_eqseq(fq Ras_PLUS fp, gq Ras_PLUS gp))
        Use_def(RaCauchy) ==> Stat1: (fq in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
                            & Stat2: (fp in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
                            & Stat3: (gq in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
                            & Stat4: (gp in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
       ()-->Stat1 ==> fq in RaSeq
       ()-->Stat2 ==> fp in RaSeq
       ()-->Stat3 ==> gq in RaSeq
       ()-->Stat4 ==> gp in RaSeq
    (fq,gq,fp,gp)-->T571 ==> false; Discharge ==> QED
--
-- Our next lemma states that when $f,fp$ and $g$ are rational Cauchy
-- sequences with $f$ equivalent to $fp$ then the pointwise
-- product of $f$ and $g$ is equivalent to the pointwise product of $fp$ and $g$.
--
Theorem 573: (({F,Fp,G} incin RaCauchy) & Ra_eqseq(F,Fp)) imp Ra_eqseq(F Ras_TIMES G, Fp Ras_TIMES G). Proof:
    Suppose_not(fq,fp,gp) ==> AUTO
--
-- For, suppose $fq,gq,gp$ to be a counterexample to our assertion.
-- The definition of equivalence between rational
-- sequences implies that for some positive rational number $eps=eps0$, the set
--	${x : x in domain(fq Ras_TIMES gp) | Ra_ABS(((fq Ras_TIMES gp)~[x]) Ra_MINUS ((fp Ras_TIMES gp)~[x])) Ra_GT eps}$
-- is infinite, whereas the analogous set which has $fq,fp,(eps0 Ra_OVER m)$
-- in place of $(fq Ras_TIMES gp)$, $(fp Ras_TIMES gp)$ is finite,
-- where $m$ $eps1$ is a number exceeding the absolute values
-- of all components of the sequence $gp$.
--
        Use_def(Ra_eqseq) ==> Stat1: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in domain(fq) | Ra_ABS((fq~[x]) Ra_MINUS (fp~[x])) Ra_GT eps})) &
		Stat2: (not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in domain(fq Ras_TIMES gp) | Ra_ABS(((fq Ras_TIMES gp)~[x]) Ra_MINUS ((fp Ras_TIMES gp)~[x])) Ra_GT eps})))
        eps0-->Stat2 ==> Stat3: (eps0 in Ra) & (eps0 Ra_GT Ra_0) & (not
		Finite({x : x in domain(fq Ras_TIMES gp) | Ra_ABS(((fq Ras_TIMES gp)~[x]) Ra_MINUS ((fp Ras_TIMES gp)~[x])) Ra_GT eps0}))
        gp-->T560 ==> Stat4: (EXISTS x in Ra | (FORALL y in range(gp) | Ra_ABS(y) Ra_LT x ))
        m-->Stat4(Stat4) ==> Stat5: (m in Ra) & Stat6: (FORALL y in range(gp) | Ra_ABS(y) Ra_LT m)
        Use_def(RaCauchy) ==> Stat7: gp in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
        ()-->Stat7 ==> Stat8: gp in RaSeq
        gp-->T546 ==> Stat9: (domain(gp) = Za) & (range(gp) incin Ra)
        T451 ==> Stat10: Ra_0 in Ra
        Suppose ==> not(m Ra_GT Ra_0)
            T211 ==> 0 in domain(gp)
            (0,gp)-->T71 ==> (gp~[0]) in range(gp)
            (gp~[0])-->Stat6 ==> Ra_ABS(gp~[0]) Ra_LT m
            (gp~[0])-->T527 ==> Ra_ABS(gp~[0]) Ra_GE Ra_0
            (Ra_ABS(gp~[0]), m)-->T473 ==> m Ra_GT Ra_ABS(gp~[0])
            (gp~[0])-->T527 ==> Ra_ABS(gp~[0]) in Ra
        (m, Ra_ABS(gp~[0]), Ra_0)-->T509 ==> false; Discharge ==> m Ra_GT Ra_0
        (m, Ra_0)-->T473 ==> m /= Ra_0
        m-->T462 ==> Stat11: (Recip(m) in Ra) & ((m Ra_TIMES Recip(m)) = Ra_1)
        m-->T491 ==> Recip(m) Ra_GT Ra_0
        Suppose ==> not(Finite({x : x in domain(fq) | Ra_ABS((fq~[x]) Ra_MINUS (fp~[x])) Ra_GT (eps0 Ra_TIMES Recip(m))}))
            (eps0, Ra_0, Recip(m))-->T488 ==> Stat12: (eps0 Ra_TIMES Recip(m)) Ra_GT (Ra_0 Ra_TIMES Recip(m))
            (Ra_0, Recip(m))-->T448(Stat10) ==> (Ra_0 Ra_TIMES Recip(m)) = (Recip(m) Ra_TIMES Ra_0)
            (Recip(m))-->T489(Stat10) ==> (Recip(m) Ra_TIMES Ra_0) = Ra_0
            EQUAL(Stat12) ==> (eps0 Ra_TIMES Recip(m)) Ra_GT Ra_0
            (eps0, Recip(m))-->T448(Stat1) ==> (eps0 Ra_TIMES Recip(m)) in Ra
        (eps0 Ra_TIMES Recip(m))-->Stat1 ==> false; Discharge ==> Finite({x : x in domain(fq) | Ra_ABS((fq~[x]) Ra_MINUS (fp~[x])) Ra_GT (eps0 Ra_TIMES Recip(m))})
--
-- We will reach the desired contradiction, thus proving the present lemma, by showing that
-- the former of the two sets mentioned above is included in the latter. Hence, since the latter
-- is finite, the former cannot be infinite. Temporarily assuming that the inclusion does not hold,
-- we can find an unsigned integer $i0$ belonging to the former set but not belonging to the latter,
-- so that
--	$Ra_ABS(((fq Ras_TIMES gp)~[i0]) Ra_MINUS ((fp Ras_TIMES gp)~[i0])) Ra_GT eps0$,
--	$not Ra_ABS((fq~[i0]) Ra_MINUS (fp~[i0])) Ra_GT (eps0 Ra_OVER Recip(m))$.
--
        Suppose ==> Stat13: not({x : x in domain(fq Ras_TIMES gp) | Ra_ABS(((fq Ras_TIMES gp)~[x]) Ra_MINUS ((fp Ras_TIMES gp)~[x])) Ra_GT eps0} incin {x : x in domain(fq) | Ra_ABS((fq~[x]) Ra_MINUS (fp~[x])) Ra_GT (eps0 Ra_TIMES Recip(m))})
            Use_def(RaCauchy) ==> Stat14: (fq in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
		& Stat15: (fp in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
            ()-->Stat14 ==> Stat16: fq in RaSeq
            ()-->Stat15 ==> Stat17: fp in RaSeq
            (fq,gp)-->T554 ==> ((fq Ras_TIMES gp) in RaSeq) & ((fq Ras_TIMES gp) = {[u,((fq~[u]) Ra_TIMES (gp~[u]))]: u in Za})
            (fp,gp)-->T554 ==> ((fp Ras_TIMES gp) = {[u,((fp~[u]) Ra_TIMES (gp~[u]))]: u in Za})
            fq-->T546 ==> domain(fq) = Za
            (fq Ras_TIMES gp)-->T546 ==> domain(fq Ras_TIMES gp) = Za
            EQUAL(Stat13) ==> Stat18: not({x : x in Za | Ra_ABS(((fq Ras_TIMES gp)~[x]) Ra_MINUS ((fp Ras_TIMES gp)~[x])) Ra_GT eps0} incin {x : x in Za | Ra_ABS((fq~[x]) Ra_MINUS (fp~[x])) Ra_GT (eps0 Ra_TIMES Recip(m))})
            i0-->Stat18 ==> Stat19: (i0 in Za) & (Ra_ABS(((fq Ras_TIMES gp)~[i0]) Ra_MINUS ((fp Ras_TIMES gp)~[i0])) Ra_GT eps0) &
			(not Ra_ABS((fq~[i0]) Ra_MINUS (fp~[i0])) Ra_GT (eps0 Ra_TIMES Recip(m)))
            Use_def(Ra_MINUS) ==> (not Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])) Ra_GT (eps0 Ra_TIMES Recip(m)))
--
-- On the one hand, we observe that
--	$(eps0 Ra_OVER Recip(m)) Ra_GE Ra_ABS((fq~[i0]) Ra_MINUS (fp~[i0]))$,
--
            (fq,fp,i0)-->T555(Stat16,Stat17,Stat19*) ==> Stat20: ((fq~[i0]) in Ra) & ((fp~[i0]) in Ra)
            ALGEBRA(Stat20) ==> (Ra_Rev(fp~[i0]) in Ra) &
		(((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])) in Ra)
            ((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))-->T527 ==> (Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])) in Ra) & (Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])) Ra_GE Ra_0)
            (gp,i0)-->T540(Stat8,Stat19*) ==> Stat21: (gp~[i0]) in Ra
            (i0,gp)-->T71(Stat19,Stat9*) ==> (gp~[i0]) in range(gp)
            (gp~[i0])-->T527 ==> Stat22: Ra_ABS(gp~[i0]) in Ra
            ((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))-->T527 ==> Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])) in Ra
            ALGEBRA(Stat3,Stat11) ==> (eps0 Ra_TIMES Recip(m)) in Ra
	    (Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])), eps0 Ra_TIMES Recip(m))-->T473 ==> (eps0 Ra_TIMES Recip(m)) Ra_GE Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))
--
-- ... so that
--	$eps0 Ra_GE (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fp~[i0])))$.
--
            (m, Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])))-->T448 ==> ((m Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))) in Ra) & ((m Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))) = (Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])) Ra_TIMES m))
            Suppose ==> not(eps0 Ra_GE (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))))
                ALGEBRA(Stat3,Stat5,Stat11) ==> (eps0 = eps0 Ra_TIMES Ra_1) &
                		((m Ra_TIMES Recip(m)) = (Recip(m) Ra_TIMES m)) &
				((eps0 Ra_TIMES (Recip(m) Ra_TIMES m)) = ((eps0 Ra_TIMES Recip(m)) Ra_TIMES m))
                EQUAL(Stat10) ==> eps0 = ((eps0 Ra_TIMES Recip(m)) Ra_TIMES m)
                (eps0 Ra_TIMES Recip(m), Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])))-->T473 ==> ((eps0 Ra_TIMES Recip(m)) Ra_GT Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))) or ((eps0 Ra_TIMES Recip(m)) = Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])))
                Suppose ==> (eps0 Ra_TIMES Recip(m)) = Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))
                    EQUAL ==> eps0 = (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])))
                (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])), eps0)-->T473 ==> false; Discharge ==> (eps0 Ra_TIMES Recip(m)) Ra_GT Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))
                (eps0 Ra_TIMES Recip(m), Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])), m)-->T488(Stat4) ==> ((eps0 Ra_TIMES Recip(m)) Ra_TIMES m) Ra_GT (Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])) Ra_TIMES m)
                EQUAL ==> eps0 Ra_GT (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])))
            (eps0, m Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])))-->T473 ==> false; Discharge ==> eps0 Ra_GE (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])))
--
-- On the other hand, we have that
--	$(Ra_ABS(gp~[i0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fp~[i0]))) Ra_GT eps0$,
--
            APPLY() fcn_symbol(f(u)->((fq~[u]) Ra_TIMES (gp~[u])), g->(fq Ras_TIMES gp), s->Za) ==>
				Stat23: (FORALL x | ((fq Ras_TIMES gp)~[x]) = if x in Za then ((fq~[x]) Ra_TIMES (gp~[x])) else 0 end if)
            APPLY() fcn_symbol(f(u)->((fp~[u]) Ra_TIMES (gp~[u])), g->(fp Ras_TIMES gp), s->Za) ==>
				Stat24: (FORALL x | ((fp Ras_TIMES gp)~[x]) = if x in Za then ((fp~[x]) Ra_TIMES (gp~[x])) else 0 end if)
            Use_def(Ra_MINUS) ==> Stat25: Ra_ABS(((fq Ras_TIMES gp)~[i0]) Ra_PLUS Ra_Rev((fp Ras_TIMES gp)~[i0])) Ra_GT eps0
            i0-->Stat23(Stat19,Stat19) ==> ((fq Ras_TIMES gp)~[i0]) = ((fq~[i0]) Ra_TIMES (gp~[i0]))
            i0-->Stat24(Stat19,Stat19) ==> ((fp Ras_TIMES gp)~[i0]) = ((fp~[i0]) Ra_TIMES (gp~[i0]))
            ALGEBRA(Stat20,Stat21) ==> (((fq~[i0]) Ra_TIMES (gp~[i0])) in Ra) & (((fq~[i0]) Ra_TIMES (gp~[i0])) = ((gp~[i0]) Ra_TIMES (fq~[i0]))) &
				(((fp~[i0]) Ra_TIMES (gp~[i0])) in Ra) & (((fp~[i0]) Ra_TIMES (gp~[i0])) = ((gp~[i0]) Ra_TIMES (fp~[i0]))) &
				(Ra_Rev((gp~[i0]) Ra_TIMES (fp~[i0])) = ((gp~[i0]) Ra_TIMES Ra_Rev(fp~[i0]))) &
				((gp~[i0]) Ra_TIMES ((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])) = (((gp~[i0]) Ra_TIMES (fq~[i0])) Ra_PLUS ((gp~[i0]) Ra_TIMES Ra_Rev(fp~[i0]))))
            (gp~[i0], (fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))-->T530 ==> Stat26: Ra_ABS((gp~[i0]) Ra_TIMES ((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))) = (Ra_ABS(gp~[i0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])))
            EQUAL(Stat25) ==> Ra_ABS((gp~[i0]) Ra_TIMES ((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))) Ra_GT eps0
            EQUAL(Stat26) ==> (Ra_ABS(gp~[i0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))) Ra_GT eps0
--
-- ... and therefore that
--	$(m Ra_TIMES Ra_ABS((fq~[i0]) Ra_MINUS (fp~[i0]))) Ra_GT eps0$.
--
            Suppose ==> not((m Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))) Ra_GT eps0)
                (gp~[i0])-->Stat6 ==> Ra_ABS(gp~[i0]) Ra_LT m
                (Ra_ABS(gp~[i0]), m)-->T473 ==> m Ra_GT Ra_ABS(gp~[i0])
                Suppose ==> not(Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])) Ra_GT Ra_0)
                    (Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])), Ra_0)-->T473(Stat13) ==> Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])) = Ra_0
                    ALGEBRA(Stat22,Stat22) ==> (Ra_ABS(gp~[i0]) Ra_TIMES Ra_0) = Ra_0
                    EQUAL(Stat26) ==> Ra_0 Ra_GT eps0
                    (Ra_0,eps0,Ra_0)-->T511 ==> Ra_0 Ra_GT Ra_0
                (Ra_0,Ra_0)-->T473 ==> false; Discharge ==> Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])) Ra_GT Ra_0
                (m, Ra_ABS(gp~[i0]), Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])))-->T488(Stat4) ==> (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))) Ra_GT (Ra_ABS(gp~[i0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])))
                (Ra_ABS(gp~[i0]), Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])))-->T448 ==> (Ra_ABS(gp~[i0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))) in Ra
            (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])), Ra_ABS(gp~[i0]) Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])), eps0)-->T511(Stat1) ==> false; Discharge ==> (m Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0]))) Ra_GT eps0
--
--
-- By exploiting one of the transitivity laws which the ordering of rational numbers obeys, we get that $eps0 Ra_GT eps0$,
-- an absurdity showing that the desired inclusion between sets actually holds.
--
            (eps0, m Ra_TIMES Ra_ABS((fq~[i0]) Ra_PLUS Ra_Rev(fp~[i0])), eps0)-->T510 ==> eps0 Ra_GT eps0
        (eps0, eps0)-->T473 ==> false; Discharge ==> {x : x in domain(fq) | Ra_ABS((fq~[x]) Ra_MINUS (fp~[x])) Ra_GT (eps0 Ra_TIMES Recip(m))} incs {x : x in domain(fq Ras_TIMES gp) | Ra_ABS(((fq Ras_TIMES gp)~[x]) Ra_MINUS ((fp Ras_TIMES gp)~[x])) Ra_GT eps0}
--
-- The desired conclusion now follows immediately.
--
    ({x : x in domain(fq) | Ra_ABS((fq~[x]) Ra_MINUS (fp~[x])) Ra_GT (eps0 Ra_TIMES Recip(m))}, {x : x in domain(fq Ras_TIMES gp) | Ra_ABS(((fq Ras_TIMES gp)~[x]) Ra_MINUS ((fp Ras_TIMES gp)~[x])) Ra_GT eps0})-->T189 ==> false; Discharge ==> QED
--
-- An easy corollary of the preceding lemma is the following:
-- When $fq,fp$ and $gq,gp$ are rational Cauchy sequences with $fq$
-- equivalent to $gq$ and $fp$ equivalent to $gp$,  the pointwise
-- product of $fq$ and $fp$ is equivalent to the pointwise product of $fp$ and $gp$.
--
Theorem 574: (({F,G,Fp,Gp} incin RaCauchy) & Ra_eqseq(F,G) & Ra_eqseq(Fp,Gp)) imp Ra_eqseq(F Ras_TIMES Fp, G Ras_TIMES Gp). Proof:
    Suppose_not(fq,gq,fp,gp) ==> ({fq,gq,fp,gp} incin RaCauchy) &
		Ra_eqseq(fq,gq) & Ra_eqseq(fp,gp) & (not Ra_eqseq(fq Ras_TIMES fp, gq Ras_TIMES gp))
--
-- For, assuming $fq,gq,fp,gp$ to be a counterexample to the statement of this lemma, we reach
-- a contradiction by arguing as follows. If follows from the preceding lemma that
-- $gq Ra_TIMES gp$ and $gp Ra_TIMES fq$ are equivalent to
-- $fq Ra_TIMES gp$ and to $fp Ra_TIMES fq$, respectively.
--
        Use_def(RaCauchy) ==> Stat1: (fq in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
                            & Stat2: (fp in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
                            & Stat3: (gq in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
                            & Stat4: (gp in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
        ()-->Stat1 ==> fq in RaSeq
        ()-->Stat2 ==> fp in RaSeq
        ()-->Stat3 ==> gq in RaSeq
        ()-->Stat4 ==> gp in RaSeq
        gq-->T546 ==> Ra_eqseq(gq,gq)
        (fq, gq, gq)-->T553 ==> Ra_eqseq(gq,fq)
        gp-->T546 ==> Ra_eqseq(gp,gp)
        (fp, gp, gp)-->T553 ==> Ra_eqseq(gp,fp)
        (gq, fq, gp)-->T573 ==> Ra_eqseq(gq Ras_TIMES gp, fq Ras_TIMES gp)
        (gp, fp, fq)-->T573 ==> Ra_eqseq(gp Ras_TIMES fq, fp Ras_TIMES fq)
--
-- The sequence $gp Ra_TIMES fq$ is easily shown to equal $fq Ra_TIMES gp$,
-- and $fp Ra_TIMES fq$ is likewise shown to equal $fq Ra_TIMES fp$.
--
        (fq, gp)-->T554 ==> ((fq Ras_TIMES gp) in RaSeq) & ((fq Ras_TIMES gp) = {[u,((fq~[u]) Ra_TIMES (gp~[u]))]: u in Za})
        (fp, fq)-->T554 ==> ((fp Ras_TIMES fq) in RaSeq) & ((fp Ras_TIMES fq) = {[u,((fp~[u]) Ra_TIMES (fq~[u]))]: u in Za})
        (gq, gp)-->T554 ==> ((gq Ras_TIMES gp) in RaSeq)
        (gp, fq)-->T554 ==> ((gp Ras_TIMES fq) in RaSeq) & ((gp Ras_TIMES fq) = {[u,((gp~[u]) Ra_TIMES (fq~[u]))]: u in Za})
        (fq, fp)-->T554 ==> ((fq Ras_TIMES fp) in RaSeq) & ((fq Ras_TIMES fp) = {[u,((fq~[u]) Ra_TIMES (fp~[u]))]: u in Za})
        fq-->T546 ==> Stat5: (domain(fq) = Za) & Svm(fq) & (range(fq) incin Ra)
        fp-->T546 ==> Stat6: (domain(fp) = Za) & Svm(fp) & (range(fp) incin Ra)
        gp-->T546 ==> Stat7: (domain(gp) = Za) & Svm(gp) & (range(gp) incin Ra)
        Suppose ==> (fq Ras_TIMES gp) /= (gp Ras_TIMES fq)
            EQUAL ==> Stat8: {[u,((fq~[u]) Ra_TIMES (gp~[u]))]: u in Za} /= {[u,((gp~[u]) Ra_TIMES (fq~[u]))]: u in Za}
            u1-->Stat8 ==> Stat9: (u1 in Za) & (((fq~[u1]) Ra_TIMES (gp~[u1])) /= ((gp~[u1]) Ra_TIMES (fq~[u1])))
            (fq~[u1], gp~[u1])-->T448 ==> ((fq~[u1]) notin Ra) or ((gp~[u1]) notin Ra)
            Suppose ==> (fq~[u1]) notin Ra
                fq-->T73(Stat5) ==> Stat10: (fq~[u1]) notin {(fq~[j]): j in domain(fq)}
            u1-->Stat10(Stat5,Stat9) ==> false; Discharge ==> Stat11: (gp~[u1]) notin Ra
            gp-->T73(Stat7) ==> Stat12:  (gp~[u1]) notin {(gp~[j]): j in domain(gp)}
        u1-->Stat12(Stat7,Stat9) ==> false; Discharge ==> (fq Ras_TIMES gp) = (gp Ras_TIMES fq)
        Suppose ==> (fp Ras_TIMES fq) /= (fq Ras_TIMES fp)
            EQUAL ==> Stat13: {[u,((fp~[u]) Ra_TIMES (fq~[u]))]: u in Za} /= {[u,((fq~[u]) Ra_TIMES (fp~[u]))]: u in Za}
            u2-->Stat13 ==> Stat14: (u2 in Za) & (((fp~[u2]) Ra_TIMES (fq~[u2])) /= ((fq~[u2]) Ra_TIMES (fp~[u2])))
            (fp~[u2], fq~[u2])-->T448 ==> ((fp~[u2]) notin Ra) or ((fq~[u2]) notin Ra)
            Suppose ==> (fp~[u2]) notin Ra
                fp-->T73(Stat6) ==> Stat15: (fp~[u2]) notin {(fp~[j]): j in domain(fp)}
            u2-->Stat15(Stat6,Stat14) ==> false; Discharge ==> Stat16: (fq~[u2]) notin Ra
            fq-->T73(Stat5) ==> Stat17:  (fq~[u2]) notin {(fq~[j]): j in domain(fq)}
        u2-->Stat17(Stat5,Stat14) ==> false; Discharge ==> (fp Ras_TIMES fq) = (fq Ras_TIMES fp)
--
-- Therefore, by transitivity of the equivalence relation between rational sequences, we get
-- that $gq Ra_TIMES gp$ and $fq Ra_TIMES fp$, a contradiction leading to the desired conclusion.
--
        EQUAL ==> Ra_eqseq(gq Ras_TIMES gp, gp Ras_TIMES fq) & Ra_eqseq(gp Ras_TIMES fq, fq Ras_TIMES fp)
    (gq Ras_TIMES gp, gp Ras_TIMES fq, fq Ras_TIMES fp)-->T553 ==> false; Discharge ==> QED
--
-- If two rational Cauchy sequences are equivalent, then their negatives are equivalent.
--
Theorem 575: (({F,G} incin RaCauchy) & Ra_eqseq(F,G)) imp Ra_eqseq(Ras_Rev(F),Ras_Rev(G)). Proof:
Suppose_not(f,g) ==> AUTO
	T539(*) ==> (f in RaSeq) & (g in RaSeq)
	(f,f)-->T554 ==> Ras_Rev(f) in RaSeq
	(g,g)-->T554 ==> Ras_Rev(g) in RaSeq
	(f,g)-->T541 ==> Stat1: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps}))
	(Ras_Rev(f),Ras_Rev(g))-->T541 ==> Stat2: not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in Za | Ra_ABS((Ras_Rev(f)~[x]) Ra_MINUS (Ras_Rev(g)~[x])) Ra_GT eps}))
	eps0-->Stat2 ==> Stat3: (eps0 in Ra) & (eps0 Ra_GT Ra_0) & (not Finite({x : x in Za | Ra_ABS((Ras_Rev(f)~[x]) Ra_MINUS (Ras_Rev(g)~[x])) Ra_GT eps0}))
	eps0-->Stat1 ==> Stat4: Finite({x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps0})
	Suppose ==> Stat5: {x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps0} /= {x : x in Za | Ra_ABS((Ras_Rev(f)~[x]) Ra_MINUS (Ras_Rev(g)~[x])) Ra_GT eps0}
		x0-->Stat5 ==> Stat6: (x0 in Za) & ((Ra_ABS((f~[x0]) Ra_MINUS (g~[x0])) Ra_GT eps0) eq (not(Ra_ABS((Ras_Rev(f)~[x0]) Ra_MINUS (Ras_Rev(g)~[x0])) Ra_GT eps0)))
		(f,x0)-->T550 ==> (f~[x0]) in Ra
		(g,g)-->T556 ==> Ras_Rev(g) in RaCauchy
		(g,g,x0)-->T555 ==> (Ras_Rev(g)~[x0]) = Ra_Rev(g~[x0])
		(f,f,x0)-->T555 ==> (Ras_Rev(f)~[x0]) = Ra_Rev(f~[x0])
		(Ras_Rev(g),x0)-->T550(Stat6) ==> Ra_Rev(g~[x0]) in Ra
		Suppose ==> Ra_ABS((f~[x0]) Ra_MINUS (g~[x0])) = Ra_ABS(Ra_Rev(f~[x0]) Ra_MINUS Ra_Rev(g~[x0]))
		EQUAL(Stat6) ==> false; Discharge ==> Stat7: Ra_ABS((f~[x0]) Ra_MINUS (g~[x0])) /= Ra_ABS(Ra_Rev(f~[x0]) Ra_MINUS Ra_Rev(g~[x0]))
		Use_def(Ra_MINUS)(Stat7) ==> Stat8: Ra_ABS((f~[x0]) Ra_PLUS Ra_Rev(g~[x0])) /= Ra_ABS(Ra_Rev(f~[x0]) Ra_PLUS Ra_Rev(Ra_Rev(g~[x0])))
		(f~[x0],Ra_Rev(g~[x0]))-->T445(Stat6*) ==> Stat9: ((f~[x0]) Ra_PLUS Ra_Rev(g~[x0])) in Ra
		(f~[x0],Ra_Rev(g~[x0]))-->T492 ==> Ra_Rev((f~[x0]) Ra_PLUS Ra_Rev(g~[x0])) = (Ra_Rev(f~[x0]) Ra_PLUS Ra_Rev(Ra_Rev(g~[x0])))
		T525(Stat9*) ==> Stat10: (FORALL x | (x in Ra) imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
		((f~[x0]) Ra_PLUS Ra_Rev(g~[x0]))-->Stat10(Stat10,Stat9*) ==> Ra_ABS(Ra_Rev((f~[x0]) Ra_PLUS Ra_Rev(g~[x0]))) = Ra_ABS((f~[x0]) Ra_PLUS Ra_Rev(g~[x0]))
        EQUAL(Stat8) ==> false; Discharge ==> Stat11: {x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps0} = {x : x in Za | Ra_ABS((Ras_Rev(f)~[x]) Ra_MINUS (Ras_Rev(g)~[x])) Ra_GT eps0}
EQUAL(Stat11,Stat3,Stat4) ==> false; Discharge ==> QED
--
-- If two rational Cauchy sequences are equivalent, then their pointwise absolute values are equivalent.
--
Theorem 576: (({F,G} incin RaCauchy) & Ra_eqseq(F,G)) imp Ra_eqseq(Ras_ABS(F),Ras_ABS(G)). Proof:
Suppose_not(f,g) ==> AUTO
--
-- Reasoning by contradiction, let $f,g$ be a counterexample to the statement of this theorem.
-- Then we can take a positive rational number $eps0$ such that the set of subscripts
-- which index corresponding components of $Ras_ABS(f),Ras_ABS(g)$ differring by more than $eps0$
-- is infinite, whereas the analogous set of subscripts for $f,g$ is finite.
-- There is, hence, a nonnegative integer $n0$ belonging to the first but not the second
-- of these sets of subscripts.
--
	T539(*) ==> Stat1: (f in RaSeq) & (g in RaSeq)
	(f,f)-->T554(*) ==> Ras_ABS(f) in RaSeq
	(g,g)-->T554(*) ==> Ras_ABS(g) in RaSeq
	(f,g)-->T541(*) ==> Stat2: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp Finite({x : x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps}))
	(Ras_ABS(f),Ras_ABS(g))-->T541(*) ==> Stat3: not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp Finite({x : x in Za | Ra_ABS(((Ras_ABS(f))~[x]) Ra_MINUS ((Ras_ABS(g))~[x])) Ra_GT eps}))
	eps0-->Stat3 ==> Stat4: (eps0 in Ra) & (eps0 Ra_GT Ra_0) & (not Finite({x: x in Za | Ra_ABS(((Ras_ABS(f))~[x]) Ra_MINUS ((Ras_ABS(g))~[x])) Ra_GT eps0}))
	eps0-->Stat2 ==> Finite({x: x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps0})
	({x: x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps0},{x: x in Za | Ra_ABS(((Ras_ABS(f))~[x]) Ra_MINUS ((Ras_ABS(g))~[x])) Ra_GT eps0})-->T189(Stat4*) ==> Stat5: not({x: x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps0} incs {x: x in Za | Ra_ABS(((Ras_ABS(f))~[x]) Ra_MINUS ((Ras_ABS(g))~[x])) Ra_GT eps0})
	n0-->Stat5(Stat5*) ==> Stat6: (n0 in Za) & (Ra_ABS(((Ras_ABS(f))~[n0]) Ra_MINUS ((Ras_ABS(g))~[n0])) Ra_GT eps0) & (not(Ra_ABS((f~[n0]) Ra_MINUS (g~[n0])) Ra_GT eps0))
--
-- Observe that distance between the $f$-image of $n0$ and the $g$-image of $n0$ is
-- greater than the distance between the $Ras_ABS(f)$-image of $n0$ and the
-- $Ras_ABS(g)$-image of $n0$.
--
	T525(Stat6*) ==> Stat7: (FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_ABS(Ra_ABS(x) Ra_PLUS Ra_Rev(Ra_ABS(y))) Ra_LE Ra_ABS(x Ra_PLUS Ra_Rev(y))))
	(f,g,n0)-->T555(Stat1,Stat6*) ==> ((f~[n0]) in Ra) & ((g~[n0]) in Ra)
	(f~[n0],g~[n0])-->Stat7(Stat7*) ==> Stat8: Ra_ABS(Ra_ABS(f~[n0]) Ra_PLUS Ra_Rev(Ra_ABS(g~[n0]))) Ra_LE Ra_ABS((f~[n0]) Ra_PLUS Ra_Rev(g~[n0]))
	(Ra_ABS(Ra_ABS(f~[n0]) Ra_PLUS Ra_Rev(Ra_ABS(g~[n0]))),Ra_ABS((f~[n0]) Ra_PLUS Ra_Rev(g~[n0])))-->T473(Stat8*) ==> Stat9: Ra_ABS((f~[n0]) Ra_PLUS Ra_Rev(g~[n0])) Ra_GE Ra_ABS(Ra_ABS(f~[n0]) Ra_PLUS Ra_Rev(Ra_ABS(g~[n0])))
	Use_def(Ra_MINUS)(Stat6,Stat6*) ==> Stat10: (Ra_ABS(((Ras_ABS(f))~[n0]) Ra_PLUS Ra_Rev((Ras_ABS(g))~[n0])) Ra_GT eps0) & (not(Ra_ABS((f~[n0]) Ra_PLUS Ra_Rev(g~[n0])) Ra_GT eps0))
--
-- By simplifying the first clause of Stat10, we obtain an inequality whose left-hand side
-- coincides with the right-hand side of the inequality Stat11
--
	Suppose ==> Stat12: Ra_ABS(((Ras_ABS(f))~[n0]) Ra_PLUS Ra_Rev((Ras_ABS(g))~[n0])) /= Ra_ABS(Ra_ABS(f~[n0]) Ra_PLUS Ra_Rev(Ra_ABS(g~[n0])))
		(f,f,n0)-->T555(Stat1,Stat6*) ==> ((Ras_ABS(f))~[n0]) = Ra_ABS(f~[n0])
		(g,g,n0)-->T555(Stat1,Stat6*) ==> ((Ras_ABS(g))~[n0]) = Ra_ABS(g~[n0])
	EQUAL(Stat12) ==> false; Discharge ==> Stat13: Ra_ABS(((Ras_ABS(f))~[n0]) Ra_PLUS Ra_Rev((Ras_ABS(g))~[n0])) = Ra_ABS(Ra_ABS(f~[n0]) Ra_PLUS Ra_Rev(Ra_ABS(g~[n0])))
	EQUAL(Stat10,Stat13) ==> Stat14: Ra_ABS(Ra_ABS(f~[n0]) Ra_PLUS Ra_Rev(Ra_ABS(g~[n0]))) Ra_GT eps0
--
-- We must briefly digress here to show that both sides of the inequalities Stat9
-- and Stat14 lines designate real numbers, so that we can propagate inequalities by
-- exploiting Theorem 510, thus contradicting the second clause of Stat15
--
	(g~[n0])-->T452(Stat7*) ==> Ra_Rev(g~[n0]) in Ra
	(f~[n0],Ra_Rev(g~[n0]))-->T445(Stat7*) ==> ((f~[n0]) Ra_PLUS Ra_Rev(g~[n0])) in Ra
	((f~[n0]) Ra_PLUS Ra_Rev(g~[n0]))-->T527(Stat7*) ==> Stat16: Ra_ABS((f~[n0]) Ra_PLUS Ra_Rev(g~[n0])) in Ra
	(f~[n0])-->T527(Stat7*) ==> Ra_ABS(f~[n0]) in Ra
	(g~[n0])-->T527(Stat7*) ==> Ra_ABS(g~[n0]) in Ra
	(Ra_ABS(g~[n0]))-->T452(Stat10*) ==> Ra_Rev(Ra_ABS(g~[n0])) in Ra
	(Ra_ABS(f~[n0]),Ra_Rev(Ra_ABS(g~[n0])))-->T445(Stat10*) ==> (Ra_ABS(f~[n0]) Ra_PLUS Ra_Rev(Ra_ABS(g~[n0]))) in Ra
	(Ra_ABS(f~[n0]) Ra_PLUS Ra_Rev(Ra_ABS(g~[n0])))-->T527(Stat10*) ==> Stat17: Ra_ABS(Ra_ABS(f~[n0]) Ra_PLUS Ra_Rev(Ra_ABS(g~[n0]))) in Ra
(Ra_ABS((f~[n0]) Ra_PLUS Ra_Rev(g~[n0])),Ra_ABS(Ra_ABS(f~[n0]) Ra_PLUS Ra_Rev(Ra_ABS(g~[n0]))),eps0)-->T510(Stat9,Stat14,Stat16,Stat17,Stat4,Stat10*) ==> false; Discharge ==> QED
--
-- We can also show that if two rational Cauchy sequences are equivalent, but not
-- equivalent to the zero rational sequence, then their reciprocals are equivalent.
--
Theorem 577: (({F,G} incin RaCauchy) & Ra_eqseq(F,G) & (not(Ra_eqseq(F,Ra0Seq)))) imp Ra_eqseq(Ras_Recip(F),Ras_Recip(G)). Proof:
Suppose_not(h,k) ==> AUTO
--
-- Reasoning by contradiction, assume that $f,g$ are a counterexample to
-- the statement of this theorem. Without loss of generality, we can assume that
-- no shift is needed in order to get $Recip(f)$ from $f$ or to get $Recip(g)$ from $g$.
-- Observe also that $g$ is not equivalent to the zero sequence.
--
    T545 ==> Ra0Seq in RaCauchy
    T539(*) ==> (h in RaSeq) & (k in RaSeq) & (Ra0Seq in RaSeq)
    Suppose ==> Ra_eqseq(k,Ra0Seq)
		(h,k,Ra0Seq)-->T553 ==> Ra_eqseq(Ra0Seq,h)
		h-->T546 ==> Ra_eqseq(h,h)
    (Ra0Seq,h,h)-->T553 ==> false; Discharge ==> (not(Ra_eqseq(k,Ra0Seq)))
    h-->T568 ==> Stat1: (EXISTS g in RaCauchy | Ra_eqseq(h,g) & (Ras_Recip(h) = Ras_Recip(g)) &
	(FORALL u in Za | ((g~[u]) /= Ra_0) & (Ras_Recip(g)~[u] = Recip(g~[u]))))
    k-->T568 ==> Stat2: (EXISTS g in RaCauchy | Ra_eqseq(k,g) & (Ras_Recip(k) = Ras_Recip(g)) &
	(FORALL u in Za | ((g~[u]) /= Ra_0) & (Ras_Recip(g)~[u] = Recip(g~[u]))))
    f-->Stat1 ==> Stat3: (f in RaCauchy) & Ra_eqseq(h,f) & (Ras_Recip(h) = Ras_Recip(f)) &
	Stat4: (FORALL u in Za | ((f~[u]) /= Ra_0) & (Ras_Recip(f)~[u] = Recip(f~[u])))
    g-->Stat2 ==> Stat5: (g in RaCauchy) & Ra_eqseq(k,g) & (Ras_Recip(k) = Ras_Recip(g)) &
	Stat6: (FORALL u in Za | ((g~[u]) /= Ra_0) & (Ras_Recip(g)~[u] = Recip(g~[u])))
    T539(*) ==> Stat7: (f in RaSeq) & (g in RaSeq)
    (h,k,g)-->T553 ==> Ra_eqseq(g,h)
    (g,h,f)-->T553 ==> Ra_eqseq(f,g)
    Ra0Seq-->T546 ==> Stat8: Ra_eqseq(Ra0Seq,Ra0Seq)
    Suppose ==> Stat9: Ra_eqseq(f,Ra0Seq)
	(h,f,Ra0Seq)-->T553 ==> Ra_eqseq(Ra0Seq,h)
    (Ra0Seq,Ra0Seq,h)-->T553 ==> false; Discharge ==> (not Ra_eqseq(f,Ra0Seq))
    Suppose ==> Ra_eqseq(g,Ra0Seq)
	(f,g,Ra0Seq)-->T553 ==> Ra_eqseq(Ra0Seq,f)
    (Ra0Seq,Ra0Seq,f)-->T553 ==> false; Discharge ==> (not Ra_eqseq(g,Ra0Seq))
    Suppose ==> Ra_eqseq(Ras_Recip(f),Ras_Recip(g))
    EQUAL ==> false; Discharge ==> Stat10: (({f,g} incin RaCauchy) & Ra_eqseq(f,g) & (not(Ra_eqseq(f,Ra0Seq))) & (not(Ra_eqseq(g,Ra0Seq)))) & (not Ra_eqseq(Ras_Recip(f),Ras_Recip(g)))
--
-- It follows, from the inequivalence between $f$ and the zero sequence
-- and exploiting the transitivity of equivalence, that $g$ is not
-- equivalent to the zero sequence. Hence the reciprocals of $f,g$ are
-- defined and they are rational Cauchy sequences.
--
	Suppose ==> Ra_eqseq(g,Ra0Seq)
		(f,g,Ra0Seq)-->T553 ==> Ra_eqseq(Ra0Seq,f)
		f-->T546 ==> Ra_eqseq(f,f)
	(Ra0Seq,f,f)-->T553 ==> false; Discharge ==> (not(Ra_eqseq(g,Ra0Seq)))
	(f,f)-->T570 ==> Ras_Recip(f) in RaCauchy
	(g,g)-->T570 ==> Ras_Recip(g) in RaCauchy
	T539(Stat10*) ==> (Ras_Recip(f) in RaSeq) & (Ras_Recip(g) in RaSeq)
--
-- There is a threshold $n0$ past which all components of $f$ exceed a certain
-- positive rational number $a$. Likewise, there is a threshold $n1$ past which
-- all components of $g$ exceed a certain positive rational $b$. Accordingly, if
-- we take $n2$ to be the larger of $n0,n1$, past $n2$ every component of $f$
-- will be greater than $a$ and every component of $g$ will be greater than $b$.
--
	f-->T563 ==> Stat11: (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
		(FORALL i in (Za - n) | (Ra_ABS(f~[i]) Ra_GT eps) & (Ra_ABS(f~[i]) Ra_GT Ra_0)) & (Ra_ABS(f~[n]) Ra_GT Ra_0))
        (a,n0)-->Stat11(Stat11*) ==> Stat12: (a in Ra) & (n0 in Za) & (a Ra_GT Ra_0) &
		Stat13: (FORALL i in (Za - n0) | (Ra_ABS(f~[i]) Ra_GT a) & (Ra_ABS(f~[i]) Ra_GT Ra_0))
	g-->T563 ==> Stat14: (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
		(FORALL i in (Za - n) | (Ra_ABS(g~[i]) Ra_GT eps) & (Ra_ABS(g~[i]) Ra_GT Ra_0)) & (Ra_ABS(g~[n]) Ra_GT Ra_0))
        (b,n1)-->Stat14(Stat14*) ==> Stat15: (b in Ra) & (n1 in Za) & (b Ra_GT Ra_0) &
		Stat16: (FORALL i in (Za - n1) | (Ra_ABS(g~[i]) Ra_GT b) & (Ra_ABS(g~[i]) Ra_GT Ra_0))
	Loc_def ==> Stat17: n2 = Un({n0,n1})
	Suppose ==> not( (n2 in Za) & (FORALL i in (Za - n2) |
			(Ra_ABS(f~[i]) Ra_GT Ra_0) & (Ra_ABS(g~[i]) Ra_GT Ra_0) &
			(Ra_ABS(f~[i]) Ra_GT a) & (Ra_ABS(g~[i]) Ra_GT b)) )
		(n0,n1)-->T202 ==> Stat18: Finite({n0,n1})
		({n0,n1})-->T320(Stat11*) ==> (n2 in Za) &
			Stat19: (not( (FORALL i in (Za - n2) |
				(Ra_ABS(f~[i]) Ra_GT Ra_0) & (Ra_ABS(g~[i]) Ra_GT Ra_0) &
				(Ra_ABS(f~[i]) Ra_GT a) & (Ra_ABS(g~[i]) Ra_GT b) )))
		i0-->Stat19(Stat18*) ==> Stat20: (i0 in (Za - n2)) &
			((not(Ra_ABS(f~[i0]) Ra_GT Ra_0)) or (not(Ra_ABS(g~[i0]) Ra_GT Ra_0)) or
			 (not(Ra_ABS(f~[i0]) Ra_GT a)) or (not(Ra_ABS(g~[i0]) Ra_GT b)) )
		({n0,n1})-->T274(Stat18*) ==> Stat21: (FORALL x in {n0,n1} | x incin Un({n0,n1}))
		n0-->Stat21(Stat17,Stat20*) ==> i0 in (Za - n0)
		n1-->Stat21(Stat17,Stat20*) ==> i0 in (Za - n1)
		i0-->Stat13(Stat20*) ==> (not(Ra_ABS(g~[i0]) Ra_GT Ra_0)) or (not(Ra_ABS(g~[i0]) Ra_GT b))
	i0-->Stat16(Stat20*) ==> false; Discharge ==> Stat22: (n2 in Za) &
		Stat23: (FORALL i in (Za - n2) |
			(Ra_ABS(f~[i]) Ra_GT Ra_0) & (Ra_ABS(g~[i]) Ra_GT Ra_0) &
			(Ra_ABS(f~[i]) Ra_GT a) & (Ra_ABS(g~[i]) Ra_GT b))
--
-- Since we have assumed that $Ras_Recip(f)$ is not equivalent to $Ras_Recip(g)$,
-- there must exist a positive rational $eps0$ such that the set of the indices
-- of the components of $Ras_Recip(f)$ whose distance from the corresponding
-- components of $Ras_Recip(g)$ exceeds $eps0$ is infinite. On the other hand,
-- since we have assumed that $f$ is equivalent to $g$, the set of the indices
-- of the components of $f$ whose distance from the corresponding components
-- of $g$ exceeds $eps0 Ra_TIMES (b Ra_TIMES a)$ is finite.
--
	(Ras_Recip(f),Ras_Recip(g))-->T541 ==> Stat24: not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps}))
	eps0-->Stat24 ==> Stat25: (eps0 in Ra) & (eps0 Ra_GT Ra_0) & (not Finite({x : x in Za | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0}))
	(b,a)-->T448(Stat12,Stat15*) ==> Stat26: (b Ra_TIMES a) in Ra
	(b,a)-->T490(Stat12,Stat15*) ==> Stat27: (b Ra_TIMES a) Ra_GT Ra_0
	(eps0,b Ra_TIMES a)-->T448(Stat25*) ==> Stat28: (eps0 Ra_TIMES (b Ra_TIMES a)) in Ra
	(eps0,b Ra_TIMES a)-->T490(Stat25*) ==> (eps0 Ra_TIMES (b Ra_TIMES a)) Ra_GT Ra_0
	(f,g)-->T541 ==> Stat29: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x: x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT eps}))
	(eps0 Ra_TIMES (b Ra_TIMES a))-->Stat29(Stat28*) ==>
		Stat30: Finite({x: x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT (eps0 Ra_TIMES (b Ra_TIMES a))})
--
-- Of course, since $n2$ is finite, also the set of the indices of
-- components of $Ras_Recip(f)$, from the $n2$ on, whose distance from the
-- corresponding components of $Ras_Recip(g)$ exceeds $eps0$ is infinite.
-- (However, below we will show that this set includes the set of the indices
-- of the components of $f$ whose distance from the corresponding components
-- of $g$ exceeds $eps0 Ra_TIMES (b Ra_TIMES a)$ is finite, thus getting
-- the desired contradiction.)
--
	Suppose ==> Stat31: Finite({x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0})
		Suppose ==> Stat32: not({x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0} incs ({x : x in Za | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0} - n2))
			c-->Stat32(Stat32*) ==> Stat33: (c notin {x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0}) & (c notin n2) & Stat34: (c in {x in Za | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0})
			()-->Stat34 ==> (c in Za) & (Ra_ABS((Ras_Recip(f)~[c]) Ra_MINUS (Ras_Recip(g)~[c])) Ra_GT eps0)
		c-->Stat33(Stat33*) ==> false; Discharge ==> {x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0} incs ({x : x in Za | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0} - n2)
		({x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0},{x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0} - n2)-->T189(Stat31*) ==> Stat35: Finite({x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0} - n2)
		n2-->T206(Stat22,Stat22*) ==> Finite(n2)
		({x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0} - n2,n2)-->T236(Stat35*) ==> Stat36: Finite(({x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0} - n2) + n2)
	(({x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0} - n2) + n2,{x: x in Za | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0})-->T189(Stat36,Stat25*) ==> false; Discharge ==> Stat37: (not Finite({x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0}))
--
-- The following obvious remarks and technical lemma derived from Theorem 525
-- will be useful in the ongoing:
--
	a-->T491(Stat12,Stat12*) ==> Recip(a) Ra_GT Ra_0
	b-->T491(Stat15,Stat15*) ==> Recip(b) Ra_GT Ra_0
	(a,Ra_0)-->T473(Stat12,Stat12*) ==> Stat38: a /= Ra_0
	(b,Ra_0)-->T473(Stat15,Stat15*) ==> Stat39: b /= Ra_0
	a-->T462(Stat12,Stat38*) ==> Stat40: (Recip(a) in Ra) & ((a Ra_TIMES Recip(a)) = Ra_1)
	b-->T462(Stat15,Stat39*) ==> Stat41: (Recip(b) in Ra) & ((b Ra_TIMES Recip(b)) = Ra_1)
        (Recip(a),Recip(b))-->T448(Stat40,Stat41*) ==> Stat42: (Recip(a) Ra_TIMES Recip(b)) in Ra
--
	T525(Stat41*) ==> Stat43: (FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0))) &
		Stat44:  (FORALL x | (x in Ra) imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x))) &
		Stat45:  (FORALL x,y | ((x in Ra) & (y in Ra)) imp (Ra_Rev(x Ra_PLUS Ra_Rev(y)) = (y Ra_PLUS Ra_Rev(x)))) &
		Stat46: (FORALL x | (x in Ra) imp (x Ra_LE x))
--
-- We now develop the core of this proof, by showing that the inequality
--	$Ra_ABS(Recip(f~[i]) Ra_MINUS Recip(g~[i])) Ra_LE ((Ra_ABS((f~[i]) Ra_MINUS (g~[i]))) Ra_OVER (a Ra_TIMES b))$
-- holds for all $i in (Za - n2)$.
--
        Suppose ==> Stat47: not(FORALL i in (Za - n2) | Ra_ABS(Recip(f~[i]) Ra_MINUS Recip(g~[i])) Ra_LE ((Ra_ABS((f~[i]) Ra_MINUS (g~[i]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))))
            p-->Stat47(Stat47*) ==> Stat48: (p in (Za - n2)) &  (not Ra_ABS(Recip(f~[p]) Ra_MINUS Recip(g~[p])) Ra_LE ((Ra_ABS((f~[p]) Ra_MINUS (g~[p]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))))
            (f,g,p)-->T555(Stat48,Stat7*) ==> Stat49: ((f~[p]) in Ra) & ((g~[p]) in Ra)
            p-->Stat23(Stat48*) ==> Stat50: (Ra_ABS(f~[p]) Ra_GT a) & (Ra_ABS(g~[p]) Ra_GT b)
        (f~[p],g~[p],a,b)-->T538(Stat49,Stat12,Stat15,Stat50,Stat48*) ==> false; Discharge ==> Stat51: (FORALL i in (Za - n2) | Ra_ABS(Recip(f~[i]) Ra_MINUS Recip(g~[i])) Ra_LE ((Ra_ABS((f~[i]) Ra_MINUS (g~[i]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))))
--
-- As announced above, we aim at completing the proof of this theorem by showing that the
-- infinite set
--	${x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0}$
-- is included in
--	${x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT (eps0 Ra_TIMES (b Ra_TIMES a))}$,
-- a fact conflicting with the finiteness of the latter, proved above.
--
	Suppose ==> Stat52: not({x: x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT (eps0 Ra_TIMES (b Ra_TIMES a))} incs {x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0})
--
-- Assuming temporarily that the announced inclusion did not hold, we could pick an integer $i2$
-- belonging to the latter set but not belonging to the former. This majorant of $n2$ would meet
-- the inequality of Stat53 This readily yields that the rational number
--	$((Ra_ABS((f~[i2]) Ra_MINUS (g~[i2]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(b)))$
-- is greater than $eps0$; hence
--	$(((Ra_ABS((f~[i2]) Ra_MINUS (g~[i2]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(b)))) Ra_TIMES (a Ra_TIMES b)$
-- is greater than $eps0 Ra_TIMES (a Ra_TIMES b)$.
--
		i1-->Stat52(Stat52*) ==> Stat54: (i1 in {x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0}) & (i1 notin {x: x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT (eps0 Ra_TIMES (b Ra_TIMES a))})
		(i2,i2)-->Stat54(Stat54*) ==> Stat55: (i2 in Za) & (i2 notin n2) & (Ra_ABS((Ras_Recip(f)~[i2]) Ra_MINUS (Ras_Recip(g)~[i2])) Ra_GT eps0) & (not (Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) Ra_GT (eps0 Ra_TIMES (b Ra_TIMES a))))
		i2-->Stat51(Stat55*) ==> Stat56: Ra_ABS(Recip(f~[i2]) Ra_MINUS Recip(g~[i2])) Ra_LE ((Ra_ABS((f~[i2]) Ra_MINUS (g~[i2]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(b)))
--
		(Ra_ABS(Recip(f~[i2]) Ra_MINUS Recip(g~[i2])),((Ra_ABS((f~[i2]) Ra_MINUS (g~[i2]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))))-->T473(Stat56,Stat56*) ==>
			Stat57: ((Ra_ABS((f~[i2]) Ra_MINUS (g~[i2]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))) Ra_GE Ra_ABS(Recip(f~[i2]) Ra_MINUS Recip(g~[i2]))
		(g,f,i2)-->T555(Stat55,Stat7*) ==> Stat58: ((g~[i2]) in Ra) & ((f~[i2]) in Ra)
		(g~[i2])-->T452(Stat58,Stat58*) ==> Ra_Rev(g~[i2]) in Ra
		(f~[i2],Ra_Rev(g~[i2]))-->T445(Stat58*) ==> ((f~[i2]) Ra_PLUS Ra_Rev(g~[i2])) in Ra
		Use_def(Ra_MINUS)(Stat58*) ==> Stat59: ((f~[i2]) Ra_MINUS (g~[i2])) in Ra
		((f~[i2]) Ra_MINUS (g~[i2]))-->T527(Stat59*) ==> Stat60: Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) in Ra
		(Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])),Recip(a) Ra_TIMES Recip(b))-->T448(Stat60,Stat42*) ==> Stat61: Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) Ra_TIMES (Recip(a) Ra_TIMES Recip(b)) in Ra
		i2-->Stat23(Stat55,Stat55*) ==> (Ra_ABS(f~[i2]) Ra_GT Ra_0) & (Ra_ABS(g~[i2]) Ra_GT Ra_0)
		(Ra_ABS(f~[i2]),Ra_0)-->T473(Stat61*) ==> Ra_ABS(f~[i2]) /= Ra_0
		(Ra_ABS(g~[i2]),Ra_0)-->T473(Stat61*) ==> Ra_ABS(g~[i2]) /= Ra_0
		(g~[i2])-->Stat43(Stat58*) ==> Stat62: (g~[i2]) /= Ra_0
		(f~[i2])-->Stat43(Stat58*) ==> Stat63: (f~[i2]) /= Ra_0
		(g~[i2])-->T462(Stat58*) ==> Stat64: Recip(g~[i2]) in Ra
		(f~[i2])-->T462(Stat58*) ==> Stat65: Recip(f~[i2]) in Ra
		(Recip(g~[i2]))-->T452(Stat61*) ==> Ra_Rev(Recip(g~[i2])) in Ra
		(Recip(f~[i2]),Ra_Rev(Recip(g~[i2])))-->T445(Stat61*) ==> Stat66: (Recip(f~[i2]) Ra_PLUS Ra_Rev(Recip(g~[i2]))) in Ra
		(Recip(f~[i2]) Ra_PLUS Ra_Rev(Recip(g~[i2])))-->T527(Stat66*) ==> Stat67: Ra_ABS(Recip(f~[i2]) Ra_PLUS Ra_Rev(Recip(g~[i2]))) in Ra
		ALGEBRA(Stat64,Stat65,Stat67) ==> Ra_ABS(Recip(f~[i2]) Ra_MINUS Recip(g~[i2])) in Ra
		i2-->Stat4(Stat10,Stat55,Stat63*) ==> (Ras_Recip(f)~[i2]) = Recip(f~[i2])
		i2-->Stat6(Stat10,Stat55,Stat62*) ==> (Ras_Recip(g)~[i2]) = Recip(g~[i2])
		EQUAL(Stat57) ==> Stat68: (((Ra_ABS((f~[i2]) Ra_MINUS (g~[i2]))) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))) Ra_GE Ra_ABS((Ras_Recip(f)~[i2]) Ra_MINUS (Ras_Recip(g)~[i2]))) &
			(Ra_ABS((Ras_Recip(f)~[i2]) Ra_MINUS (Ras_Recip(g)~[i2])) in Ra)
		(Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) Ra_TIMES (Recip(a) Ra_TIMES Recip(b)),Ra_ABS((Ras_Recip(f)~[i2]) Ra_MINUS (Ras_Recip(g)~[i2])),eps0)-->T510(Stat68,Stat61,Stat25,Stat55*) ==>
			Stat69: (Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))) Ra_GT eps0
--
		(b Ra_TIMES a,b Ra_TIMES a)-->T495(Stat26*) ==> Stat70: (b Ra_TIMES a) Ra_GE (b Ra_TIMES a)
		(Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) Ra_TIMES (Recip(a) Ra_TIMES Recip(b)),eps0,b Ra_TIMES a,b Ra_TIMES a)-->T517(Stat61,Stat25,Stat69,Stat26,Stat27,Stat70*) ==> Stat71: ((Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))) Ra_TIMES (b Ra_TIMES a)) Ra_GT (eps0 Ra_TIMES (b Ra_TIMES a))
--
-- Notice, however, that $Ra_ABS((f~[i2]) Ra_MINUS (g~[i2]))$ equals
--	$(Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))) Ra_TIMES (b Ra_TIMES a)$.
--
		Suppose ==> Stat72: Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) /= (Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))) Ra_TIMES (b Ra_TIMES a)
			(b Ra_TIMES a,Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])),Recip(a) Ra_TIMES Recip(b))-->T456(Stat60,Stat42,Stat26*) ==> Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) Ra_TIMES ((Recip(a) Ra_TIMES Recip(b)) Ra_TIMES (b Ra_TIMES a)) = (Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))) Ra_TIMES (b Ra_TIMES a)
			(b Ra_TIMES a,Recip(a),Recip(b))-->T456(Stat26,Stat40,Stat41*) ==> (Recip(a) Ra_TIMES (Recip(b) Ra_TIMES (b Ra_TIMES a))) = ((Recip(a) Ra_TIMES Recip(b)) Ra_TIMES (b Ra_TIMES a))
			(a,Recip(b),b)-->T456(Stat41,Stat12,Stat15*) ==> (Recip(b) Ra_TIMES (b Ra_TIMES a)) = ((Recip(b) Ra_TIMES b) Ra_TIMES a)
			(Recip(b),b)-->T448(Stat15,Stat41*) ==> (Recip(b) Ra_TIMES b) = Ra_1
			(Recip(a),a)-->T448(Stat12,Stat40*) ==> (Recip(a) Ra_TIMES a) = Ra_1
			a-->T461(Stat12*) ==> a = (a Ra_TIMES Ra_1)
			T451(Stat72*) ==> Stat73: Ra_1 in Ra
			(a,Ra_1)-->T448(Stat12,Stat73*) ==> (a Ra_TIMES Ra_1) = (Ra_1 Ra_TIMES a)
			(Recip(a) Ra_TIMES Recip(b))-->T461(Stat42*) ==> (Recip(a) Ra_TIMES Recip(b)) = ((Recip(a) Ra_TIMES Recip(b)) Ra_TIMES Ra_1)
			(Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])))-->T461(Stat60*) ==> (Ra_ABS((f~[i2]) Ra_MINUS (g~[i2]))) = ((Ra_ABS((f~[i2]) Ra_MINUS (g~[i2]))) Ra_TIMES Ra_1)
		EQUAL(Stat72) ==> false; Discharge ==> Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) = (Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) Ra_TIMES (Recip(a) Ra_TIMES Recip(b))) Ra_TIMES (b Ra_TIMES a)
		EQUAL(Stat71) ==> Stat74: Ra_ABS((f~[i2]) Ra_MINUS (g~[i2])) Ra_GT (eps0 Ra_TIMES (b Ra_TIMES a))
--
-- This leads to the desired contradiction, proving the present theorem.
--
	(Stat74,Stat55*)Discharge ==> Stat75: {x: x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT (eps0 Ra_TIMES (b Ra_TIMES a))} incs {x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0}
--
({x: x in Za | Ra_ABS((f~[x]) Ra_MINUS (g~[x])) Ra_GT (eps0 Ra_TIMES (b Ra_TIMES a))},{x: x in (Za - n2) | Ra_ABS((Ras_Recip(f)~[x]) Ra_MINUS (Ras_Recip(g)~[x])) Ra_GT eps0})-->T189(Stat75,Stat37,Stat30*) ==> false; Discharge ==> QED
--
-- Proof of the algebraic rules for the operations on rational sequences introduced above
-- will rest on the fact that two rational sequences are equal if and only if they have
-- the same value for each integer, and on the rules
-- for calculating the values at each integer of
--
--
--
-- Next we prove that the algebraic operations on rational sequences introduced above obey the
-- normal commutative, distributive, etc., algebraic laws. Our first two results state
-- the commutative laws for addition and multiplication respectively. These results follow trivially
-- from the pointwise definitions of the operations $Ras_PLUS$ and $Ras_TIMES$.
--
Theorem 578: ({F,G} incin RaSeq) imp (F Ras_PLUS G = G Ras_PLUS F). Proof:
    Suppose_not(f,g) ==> AUTO
	(f Ras_PLUS g,g Ras_PLUS f)-->T542 ==> Stat1: AUTO
	n-->Stat1 ==> AUTO
    (f,g)-->T555 ==> (f Ras_PLUS g in RaSeq) & (f~[n] in Ra) & (g~[n] in Ra) & ((f Ras_PLUS g)~[n] = (f~[n]) Ra_PLUS (g~[n]))
    (g,f)-->T555 ==> (g Ras_PLUS f in RaSeq) & ((g Ras_PLUS f)~[n] = (g~[n]) Ra_PLUS (f~[n]))
    (f~[n],g~[n])-->T445 ==> false; Discharge ==> QED
--
Theorem 579: ({F,G} incin RaSeq) imp (F Ras_TIMES G = G Ras_TIMES F). Proof:
    Suppose_not(f,g) ==> AUTO
	(f Ras_TIMES g,g Ras_TIMES f)-->T542 ==> Stat1: AUTO
	n-->Stat1 ==> AUTO
    (f,g)-->T555 ==> (f Ras_TIMES g in RaSeq) & (f~[n] in Ra) & (g~[n] in Ra) & ((f Ras_TIMES g)~[n] = (f~[n]) Ra_TIMES (g~[n]))
    (g,f)-->T555 ==> (g Ras_TIMES f in RaSeq) & ((g Ras_TIMES f)~[n] = (g~[n]) Ra_TIMES (f~[n]))
    (f~[n],g~[n])-->T448 ==> false; Discharge ==> QED
--
-- It is equally easy to prove the associative laws for addition and multiplication
-- of rational sequences. Once more, these results follow trivially
-- from the pointwise definitions of the operations $Ras_PLUS$ and $Ras_TIMES$.
--
Theorem 580: ({F,G,H} incin RaSeq) imp
	((F Ras_PLUS G) Ras_PLUS H = F Ras_PLUS (G Ras_PLUS H)). Proof:
--
-- For let f,g,h be a counterexample, and consider the values at a generic integer n of all the function compositions which appear.
-- By Theorem 338 the function values ((f Ras_PLUS h) Ras_PLUS h)~[n] and (f Ras_PLUS (h Ras_PLUS h))~[n] must be distinct at n,
--
    Suppose_not(f,g,h) ==> AUTO
	((f Ras_PLUS g) Ras_PLUS h,(f Ras_PLUS (g Ras_PLUS h)))-->T542 ==> Stat1: AUTO
	n-->Stat1 ==> AUTO
	(f,g,n)-->T555 ==> ((f Ras_PLUS g) in RaSeq) & (f~[n] in Ra) & (g~[n] in Ra) & ((f Ras_PLUS g)~[n] = (f~[n]) Ra_PLUS (g~[n]))
	(g,h,n)-->T555 ==> ((g Ras_PLUS h) in RaSeq) & (g~[n] in Ra) & (h~[n] in Ra) & ((g Ras_PLUS h)~[n] = (g~[n]) Ra_PLUS (h~[n]))
	(f Ras_PLUS g,h,n)-->T555 ==> (((f Ras_PLUS g) Ras_PLUS h) in RaSeq) & (((f Ras_PLUS g) Ras_PLUS h)~[n] = ((f Ras_PLUS g)~[n]) Ra_PLUS (h~[n]))
	(f,g Ras_PLUS h,n)-->T555 ==> ((f Ras_PLUS (g Ras_PLUS h)) in RaSeq) & ((f Ras_PLUS (g Ras_PLUS h))~[n] = ((f~[n]) Ra_PLUS ((g Ras_PLUS h)~[n])))
--
-- which is easily seen to be impossible if we express these function values in terms of f~[n],g~[n], and h~[n],
-- a contradiction which proves our theorem.
--
	EQUAL ==> ((f~[n]) Ra_PLUS (g~[n])) Ra_PLUS (h~[n]) = ((f Ras_PLUS g) Ras_PLUS h)~[n]
	EQUAL ==> (f~[n]) Ra_PLUS ((g~[n]) Ra_PLUS (h~[n])) = (f Ras_PLUS (g Ras_PLUS h))~[n]
	ELEM ==> ((f~[n]) Ra_PLUS (g~[n])) Ra_PLUS (h~[n]) /= (f~[n]) Ra_PLUS ((g~[n]) Ra_PLUS (h~[n]))
    (h~[n],f~[n],g~[n])-->T450 ==> false; Discharge ==> QED
--
Theorem 581: ({F,G,H} incin RaSeq) imp
	((F Ras_TIMES G) Ras_TIMES H = F Ras_TIMES (G Ras_TIMES H)). Proof:
    Suppose_not(fp,gp,hp) ==> ({fp,gp,hp} incin RaSeq) &  ((fp Ras_TIMES gp) Ras_TIMES hp /= fp Ras_TIMES (gp Ras_TIMES hp))
        (fp,gp)-->T554 ==> ((fp Ras_TIMES gp) in RaSeq) & ((fp Ras_TIMES gp) = {[u,((fp~[u]) Ra_TIMES (gp~[u]))]: u in Za})
        (gp,hp)-->T554 ==> ((gp Ras_TIMES hp) in RaSeq) & ((gp Ras_TIMES hp) = {[u,((gp~[u]) Ra_TIMES (hp~[u]))]: u in Za})
        (fp Ras_TIMES gp, hp)-->T554 ==> ((fp Ras_TIMES gp) Ras_TIMES hp) = {[u,(((fp Ras_TIMES gp)~[u]) Ra_TIMES (hp~[u]))]: u in Za}
        (fp, gp Ras_TIMES hp)-->T554 ==> (fp Ras_TIMES (gp Ras_TIMES hp)) = {[u,((fp~[u]) Ra_TIMES ((gp Ras_TIMES hp)~[u]))]: u in Za}
        EQUAL ==> Stat1: {[u,(((fp Ras_TIMES gp)~[u]) Ra_TIMES (hp~[u]))]: u in Za} /= {[u,((fp~[u]) Ra_TIMES ((gp Ras_TIMES hp)~[u]))]: u in Za}
        i-->Stat1 ==> (i in Za) & ((((fp Ras_TIMES gp)~[i]) Ra_TIMES (hp~[i])) /= ((fp~[i]) Ra_TIMES ((gp Ras_TIMES hp)~[i])))
        APPLY() fcn_symbol(f(u)->((fp~[u]) Ra_TIMES (gp~[u])), g->(fp Ras_TIMES gp), s->Za) ==>
				Stat2: (FORALL x | ((fp Ras_TIMES gp)~[x]) = if x in Za then ((fp~[x]) Ra_TIMES (gp~[x])) else 0 end if)
        APPLY() fcn_symbol(f(u)->((gp~[u]) Ra_TIMES (hp~[u])), g->(gp Ras_TIMES hp), s->Za) ==>
				Stat3: (FORALL x | ((gp Ras_TIMES hp)~[x]) = if x in Za then ((gp~[x]) Ra_TIMES (hp~[x])) else 0 end if)
        i-->Stat2 ==> ((fp Ras_TIMES gp)~[i]) = ((fp~[i]) Ra_TIMES (gp~[i]))
        i-->Stat3 ==> ((gp Ras_TIMES hp)~[i]) = ((gp~[i]) Ra_TIMES (hp~[i]))
        EQUAL ==> (((fp~[i]) Ra_TIMES (gp~[i])) Ra_TIMES (hp~[i])) /= ((fp~[i]) Ra_TIMES ((gp~[i]) Ra_TIMES (hp~[i])))
        ELEM ==>  (fp in RaSeq) & (gp in RaSeq) &(hp in RaSeq)
        (fp,i)-->T540 ==> (fp~[i]) in Ra
        (gp,i)-->T540 ==> (gp~[i]) in Ra
        (hp,i)-->T540 ==> (hp~[i]) in Ra
    (hp~[i], fp~[i], gp~[i])-->T456 ==> false; Discharge ==> QED
--
Theorem 582: [Double-inversion law for rational sequences] (X in RaSeq) imp (Ras_Rev(Ras_Rev(X))=X). Proof:
    Suppose_not(h) ==>AUTO
        (h,h)-->T554 ==> Ras_Rev(h) in RaSeq
        (h,Ras_Rev(h))-->T554 ==> Ras_Rev(Ras_Rev(h)) in RaSeq
        h-->T546 ==> Svm(h) & (domain(h) = Za)
        (Ras_Rev(Ras_Rev(h)))-->T546 ==> Svm(Ras_Rev(Ras_Rev(h))) & (domain(Ras_Rev(Ras_Rev(h))) = Za)
        h-->T72 ==> h = {[i,h~[i]]: i in domain(h)}
        (Ras_Rev(Ras_Rev(h)))-->T72 ==> (Ras_Rev(Ras_Rev(h))) = {[i,(Ras_Rev(Ras_Rev(h)))~[i]]: i in domain(Ras_Rev(Ras_Rev(h)))}
        Suppose ==> {[i,h~[i]]: i in Za} = {[i,(Ras_Rev(Ras_Rev(h)))~[i]]: i in Za}
        EQUAL ==> false; Discharge ==> Stat1: {[i,h~[i]]: i in Za} /= {[i,(Ras_Rev(Ras_Rev(h)))~[i]]: i in Za}
        i-->Stat1(Stat1) ==> Stat2: (i in Za) & ((h~[i]) /= ((Ras_Rev(Ras_Rev(h)))~[i]))
        (h,h,i)-->T555 ==> ((Ras_Rev(h))~[i]) = Ra_Rev(h~[i])
        (h,Ras_Rev(h),i)-->T555 ==> ((Ras_Rev(Ras_Rev(h)))~[i]) = Ra_Rev((Ras_Rev(h))~[i])
        Suppose ==> (h~[i]) = Ra_Rev(Ra_Rev(h~[i]))
        EQUAL(Stat2) ==> false; Discharge ==> Stat3: (h~[i]) /= Ra_Rev(Ra_Rev(h~[i]))
        (h,i)-->T540 ==> (h~[i]) in Ra
    (h~[i])-->T494(Stat3*) ==>false; Discharge ==> QED
--
Theorem 583: [Distributive law for multiplication of rational sequences] ({X,Y,V} incin RaSeq) imp ((X Ras_TIMES (Y Ras_PLUS V)) = ((X Ras_TIMES Y) Ras_PLUS (X Ras_TIMES V))). Proof:
    Suppose_not(h,k,v) ==>AUTO
        (h,k)-->T554 ==> (h Ras_TIMES k) in RaSeq
        (h,v)-->T554 ==> (h Ras_TIMES v) in RaSeq
        (k,v)-->T554 ==> (k Ras_PLUS v) in RaSeq
        (h,k Ras_PLUS v)-->T554 ==> (h Ras_TIMES (k Ras_PLUS v)) in RaSeq
        (h Ras_TIMES k,h Ras_TIMES v)-->T554 ==> ((h Ras_TIMES k) Ras_PLUS (h Ras_TIMES v)) in RaSeq
        h-->T546 ==> Svm(h) & (domain(h) = Za)
        k-->T546 ==> Svm(k) & (domain(k) = Za)
        v-->T546 ==> Svm(v) & (domain(v) = Za)
        (h Ras_TIMES (k Ras_PLUS v))-->T546 ==> Svm(h Ras_TIMES (k Ras_PLUS v)) & (domain(h Ras_TIMES (k Ras_PLUS v)) = Za)
        ((h Ras_TIMES k) Ras_PLUS (h Ras_TIMES v))-->T546 ==> Svm((h Ras_TIMES k) Ras_PLUS (h Ras_TIMES v)) & (domain((h Ras_TIMES k) Ras_PLUS (h Ras_TIMES v)) = Za)
        (h Ras_TIMES (k Ras_PLUS v))-->T72 ==> (h Ras_TIMES (k Ras_PLUS v)) = {[i,(h Ras_TIMES (k Ras_PLUS v))~[i]]: i in domain(h Ras_TIMES (k Ras_PLUS v))}
        ((h Ras_TIMES k) Ras_PLUS (h Ras_TIMES v))-->T72 ==> ((h Ras_TIMES k) Ras_PLUS (h Ras_TIMES v)) = {[i,((h Ras_TIMES k) Ras_PLUS (h Ras_TIMES v))~[i]]: i in domain((h Ras_TIMES k) Ras_PLUS (h Ras_TIMES v))}
        Suppose ==> {[i,(h Ras_TIMES (k Ras_PLUS v))~[i]]: i in Za} = {[i,((h Ras_TIMES k) Ras_PLUS (h Ras_TIMES v))~[i]]: i in Za}
        EQUAL ==> false; Discharge ==> Stat1: {[i,(h Ras_TIMES (k Ras_PLUS v))~[i]]: i in Za} /= {[i,((h Ras_TIMES k) Ras_PLUS (h Ras_TIMES v))~[i]]: i in Za}
        i-->Stat1(Stat1) ==> Stat2: (i in Za) & (((h Ras_TIMES (k Ras_PLUS v))~[i]) /= (((h Ras_TIMES k) Ras_PLUS (h Ras_TIMES v))~[i]))
        (h,k Ras_PLUS v,i)-->T555 ==> ((h Ras_TIMES (k Ras_PLUS v))~[i]) = ((h~[i]) Ra_TIMES ((k Ras_PLUS v)~[i]))
        (k,v,i)-->T555 ==> ((k Ras_PLUS v)~[i]) = ((k~[i]) Ra_PLUS (v~[i]))
        (h Ras_TIMES k,h Ras_TIMES v,i)-->T555 ==> (((h Ras_TIMES k) Ras_PLUS (h Ras_TIMES v))~[i]) = (((h Ras_TIMES k)~[i]) Ra_PLUS ((h Ras_TIMES v)~[i]))
        (h,k,i)-->T555 ==> ((h Ras_TIMES k)~[i]) = ((h~[i]) Ra_TIMES (k~[i]))
        (h,v,i)-->T555 ==> ((h Ras_TIMES v)~[i]) = ((h~[i]) Ra_TIMES (v~[i]))
        Suppose ==> (((h~[i]) Ra_TIMES (k~[i])) Ra_PLUS ((h~[i]) Ra_TIMES (v~[i]))) = ((h~[i]) Ra_TIMES ((k~[i]) Ra_PLUS (v~[i])))
        EQUAL(Stat2) ==> false; Discharge ==> Stat3: (((h~[i]) Ra_TIMES (k~[i])) Ra_PLUS ((h~[i]) Ra_TIMES (v~[i]))) /= ((h~[i]) Ra_TIMES ((k~[i]) Ra_PLUS (v~[i])))
        (h,i)-->T540 ==> (h~[i]) in Ra
        (k,i)-->T540 ==> (k~[i]) in Ra
        (v,i)-->T540 ==> (v~[i]) in Ra
    (v~[i],h~[i],k~[i])-->T458(Stat3*) ==>false; Discharge ==> QED
--
Theorem 584: [Law of signs for multiplication of rational sequences] ({X,Y} incin RaSeq) imp ((X Ras_TIMES Ras_Rev(Y)) = Ras_Rev(X Ras_TIMES Y)). Proof:
    Suppose_not(h,k) ==>AUTO
        (k,k)-->T554 ==> Ras_Rev(k) in RaSeq
        (h,Ras_Rev(k))-->T554 ==> (h Ras_TIMES Ras_Rev(k)) in RaSeq
        (h,k)-->T554 ==> (h Ras_TIMES k) in RaSeq
        (h,h Ras_TIMES k)-->T554 ==> Ras_Rev(h Ras_TIMES k) in RaSeq
        (h Ras_TIMES Ras_Rev(k))-->T546 ==> Svm(h Ras_TIMES Ras_Rev(k)) & (domain(h Ras_TIMES Ras_Rev(k)) = Za)
        (Ras_Rev(h Ras_TIMES k))-->T546 ==> Svm(Ras_Rev(h Ras_TIMES k)) & (domain(Ras_Rev(h Ras_TIMES k)) = Za)
        (h Ras_TIMES Ras_Rev(k))-->T72 ==> (h Ras_TIMES Ras_Rev(k)) = {[i,(h Ras_TIMES Ras_Rev(k))~[i]]: i in domain(h Ras_TIMES Ras_Rev(k))}
        (Ras_Rev(h Ras_TIMES k))-->T72 ==> (Ras_Rev(h Ras_TIMES k)) = {[i,(Ras_Rev(h Ras_TIMES k))~[i]]: i in domain(Ras_Rev(h Ras_TIMES k))}
        Suppose ==> {[i,(h Ras_TIMES Ras_Rev(k))~[i]]: i in Za} = {[i,(Ras_Rev(h Ras_TIMES k))~[i]]: i in Za}
        EQUAL ==> false; Discharge ==> Stat1: {[i,(h Ras_TIMES Ras_Rev(k))~[i]]: i in Za} /= {[i,(Ras_Rev(h Ras_TIMES k))~[i]]: i in Za}
        i-->Stat1(Stat1) ==> Stat2: (i in Za) & (((h Ras_TIMES Ras_Rev(k))~[i]) /= ((Ras_Rev(h Ras_TIMES k))~[i]))
        (h,Ras_Rev(k),i)-->T555 ==> ((h Ras_TIMES Ras_Rev(k))~[i]) = ((h~[i]) Ra_TIMES ((Ras_Rev(k))~[i]))
        (h,k,i)-->T555 ==> ((Ras_Rev(k))~[i]) = Ra_Rev(k~[i])
        (h,h Ras_TIMES k,i)-->T555 ==> ((Ras_Rev(h Ras_TIMES k))~[i]) = Ra_Rev((h Ras_TIMES k)~[i])
        (h,k,i)-->T555 ==> ((h Ras_TIMES k)~[i]) = ((h~[i]) Ra_TIMES (k~[i]))
        EQUAL(Stat2) ==> Stat3: ((h~[i]) Ra_TIMES Ra_Rev(k~[i])) /= Ra_Rev((h~[i]) Ra_TIMES (k~[i]))
        (h,i)-->T540 ==> (h~[i]) in Ra
        (k,i)-->T540 ==> (k~[i]) in Ra
    (h~[i],k~[i])-->T485(Stat3*) ==>false; Discharge ==> QED
--
Theorem 585: [Law of signs for multiplication of rational sequences, 2] ({X,Y} incin RaSeq) imp (((Ras_Rev(X) Ras_TIMES Y) = Ras_Rev(X Ras_TIMES Y)) & ((Ras_Rev(X) Ras_TIMES Ras_Rev(Y)) = (X Ras_TIMES Y))). Proof:
    Suppose_not(x,y) ==>AUTO
        (x,x)-->T554 ==> Ras_Rev(x) in RaSeq
        Suppose ==> (Ras_Rev(x) Ras_TIMES y) /= Ras_Rev(x Ras_TIMES y)
            (Ras_Rev(x),y)-->T579 ==> (Ras_Rev(x) Ras_TIMES y) = (y Ras_TIMES Ras_Rev(x))
            (y,x)-->T584 ==> (Ras_Rev(x) Ras_TIMES y) = Ras_Rev(y Ras_TIMES x)
            (y,x)-->T579 ==> (x Ras_TIMES y) = (y Ras_TIMES x)
        EQUAL ==> false; Discharge ==> ((Ras_Rev(x) Ras_TIMES y) = Ras_Rev(x Ras_TIMES y)) & ((Ras_Rev(x) Ras_TIMES Ras_Rev(y)) /= (x Ras_TIMES y))
        (y,y)-->T554 ==> Ras_Rev(y) in RaSeq
        (Ras_Rev(x),y)-->T584 ==> (Ras_Rev(x) Ras_TIMES Ras_Rev(y)) = Ras_Rev(Ras_Rev(x) Ras_TIMES y)
        EQUAL ==> (Ras_Rev(x) Ras_TIMES Ras_Rev(y)) = Ras_Rev(Ras_Rev(x Ras_TIMES y))
        (x,y)-->T554 ==> (x Ras_TIMES y) in RaSeq
    (x Ras_TIMES y)-->T582 ==> false; Discharge ==> QED
--
Theorem 586: [Any rational sequence times 0 is 0] (X in RaSeq) imp ((X Ras_TIMES Ra0Seq) = Ra0Seq). Proof:
Suppose_not(h) ==> AUTO
	T545(*) ==> Ra0Seq in RaCauchy
	T539(*) ==> Stat1: Ra0Seq in RaSeq
	(h,Ra0Seq)-->T554(*) ==> Stat2: ((h Ras_TIMES Ra0Seq) in RaSeq) & ((h Ras_TIMES Ra0Seq) = {[i,(h~[i]) Ra_TIMES (Ra0Seq~[i])]: i in Za})
	(h Ras_TIMES Ra0Seq,Ra0Seq)-->T542(*) ==> Stat3: not(FORALL n in Za | (((h Ras_TIMES Ra0Seq) in RaSeq) & (Ra0Seq in RaSeq) & (((h Ras_TIMES Ra0Seq)~[n]) = (Ra0Seq~[n]))))
	n0-->Stat3(Stat2,Stat1*) ==> Stat4: (n0 in Za) & (((h Ras_TIMES Ra0Seq)~[n0]) /= (Ra0Seq~[n0]))
	EQUAL(Stat4,Stat2) ==> ({[i,(h~[i]) Ra_TIMES (Ra0Seq~[i])]: i in Za}~[n0]) /= (Ra0Seq~[n0])
	APPLY() Must_be_svm(b(i)->(h~[i]) Ra_TIMES (Ra0Seq~[i]),s->Za,u->n0) ==> (n0 in Za) imp (({[i,(h~[i]) Ra_TIMES (Ra0Seq~[i])]: i in Za}~[n0]) = ((h~[n0]) Ra_TIMES (Ra0Seq~[n0])))
        n0-->T548(Stat4,Stat4*) ==> Stat5: (Ra0Seq~[n0]) = Ra_0
	EQUAL(Stat5) ==> ((h~[n0]) Ra_TIMES (Ra0Seq~[n0])) = ((h~[n0]) Ra_TIMES Ra_0)
	(h,n0)-->T540(*) ==> (h~[n0]) in Ra
(h~[n0])-->T489(Stat4*) ==> false; Discharge ==> QED
--
Theorem 587: [0 is a right additive identity for rational sequences] (X in RaSeq) imp (X Ras_PLUS Ra0Seq = X). Proof:
Suppose_not(h) ==> AUTO
	T545(*) ==> Ra0Seq in RaCauchy
	T539(*) ==> Stat1: (Ra0Seq in RaSeq) & (h in RaSeq)
	(h,Ra0Seq)-->T554(*) ==> Stat2: ((h Ras_PLUS Ra0Seq) in RaSeq) & ((h Ras_PLUS Ra0Seq)  = {[i,(h~[i]) Ra_PLUS (Ra0Seq~[i])]: i in Za})
	(h Ras_PLUS Ra0Seq,h)-->T542(*) ==> Stat3: not(FORALL n in Za | (((h Ras_PLUS Ra0Seq) in RaSeq) & (h in RaSeq) & (((h Ras_PLUS Ra0Seq)~[n]) = (h~[n]))))
	n0-->Stat3(*) ==> Stat4: (n0 in Za) & (((h Ras_PLUS Ra0Seq)~[n0]) /= (h~[n0]))
	EQUAL(Stat4,Stat2) ==> ({[i,(h~[i]) Ra_PLUS (Ra0Seq~[i])]: i in Za}~[n0]) /= (h~[n0])
	APPLY() Must_be_svm(b(i)->(h~[i]) Ra_PLUS (Ra0Seq~[i]),s->Za,u->n0) ==> (n0 in Za) imp (({[i,(h~[i]) Ra_PLUS (Ra0Seq~[i])]: i in Za}~[n0]) = ((h~[n0]) Ra_PLUS (Ra0Seq~[n0])))
        n0-->T548(Stat4,Stat4*) ==> Stat5: (Ra0Seq~[n0]) = Ra_0
	EQUAL(Stat5) ==> ((h~[n0]) Ra_PLUS (Ra0Seq~[n0])) = ((h~[n0]) Ra_PLUS Ra_0)
	(h,n0)-->T540(*) ==> (h~[n0]) in Ra
(h~[n0])-->T451(Stat4*) ==> false; Discharge ==> QED
--
Theorem 588: [1 is a left multiplicative identity for rational sequences] (X in RaSeq) imp (X Ras_TIMES Ra1Seq = X). Proof:
Suppose_not(h) ==> AUTO
	T545(*) ==> Ra1Seq in RaCauchy
	T539(*) ==> Stat1: Ra1Seq in RaSeq
	(h,Ra1Seq)-->T554(*) ==> Stat2: ((h Ras_TIMES Ra1Seq) in RaSeq) & ((h Ras_TIMES Ra1Seq) = {[i,(h~[i]) Ra_TIMES (Ra1Seq~[i])]: i in Za})
	(h Ras_TIMES Ra1Seq,h)-->T542(*) ==> Stat3: not(FORALL n in Za | (((h Ras_TIMES Ra1Seq) in RaSeq) & (h in RaSeq) & (((h Ras_TIMES Ra1Seq)~[n]) = (h~[n]))))
	n0-->Stat3(*) ==> Stat4: (n0 in Za) & (((h Ras_TIMES Ra1Seq)~[n0]) /= (h~[n0]))
	EQUAL(Stat4,Stat2) ==> ({[i,(h~[i]) Ra_TIMES (Ra1Seq~[i])]: i in Za}~[n0]) /= (h~[n0])
	APPLY() Must_be_svm(b(i)->(h~[i]) Ra_TIMES (Ra1Seq~[i]),s->Za,u->n0) ==> (n0 in Za) imp (({[i,(h~[i]) Ra_TIMES (Ra1Seq~[i])]: i in Za}~[n0]) = ((h~[n0]) Ra_TIMES (Ra1Seq~[n0])))
        n0-->T548(Stat4,Stat4*) ==> Stat5: (Ra1Seq~[n0]) = Ra_1
	EQUAL(Stat5) ==> ((h~[n0]) Ra_TIMES (Ra1Seq~[n0])) = ((h~[n0]) Ra_TIMES Ra_1)
	(h,n0)-->T540(*) ==> (h~[n0]) in Ra
(h~[n0])-->T461(Stat4*) ==> false; Discharge ==> QED
--
Theorem 589: [0 is right subtractive identity for rational sequence subtraction] (X in RaSeq) imp (X Ras_MINUS Ra0Seq = X). Proof:
Suppose_not(h) ==> AUTO
	Use_def(Ras_MINUS) ==> Stat1: (h Ras_PLUS Ras_Rev(Ra0Seq)) /= h
	T545(*) ==> Ra0Seq in RaCauchy
	T539(*) ==> Stat2: Ra0Seq in RaSeq
	(Ra0Seq,Ra0Seq)-->T554(*) ==> Stat3: (Ras_Rev(Ra0Seq) in RaSeq) & (Ras_Rev(Ra0Seq) = {[i,Ra_Rev(Ra0Seq~[i])]: i in Za})
	(h,Ras_Rev(Ra0Seq))-->T554(*) ==> Stat4: ((h Ras_PLUS Ras_Rev(Ra0Seq)) in RaSeq) & ((h Ras_PLUS Ras_Rev(Ra0Seq)) = {[i,(h~[i]) Ra_PLUS ((Ras_Rev(Ra0Seq))~[i])]: i in Za})
	(h Ras_PLUS Ras_Rev(Ra0Seq),h)-->T542(Stat1,Stat1*) ==> Stat5: not(FORALL n in Za | ((h Ras_PLUS Ras_Rev(Ra0Seq)) in RaSeq) & (h in RaSeq) & (((h Ras_PLUS Ras_Rev(Ra0Seq))~[n]) = (h~[n])))
	n0-->Stat5(*) ==> Stat6: (n0 in Za) & (((h Ras_PLUS Ras_Rev(Ra0Seq))~[n0]) /= (h~[n0]))
	EQUAL(Stat6,Stat4,Stat3) ==> ({[i,(h~[i]) Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[i])]: i in Za}~[n0]) /= (h~[n0])
	APPLY() Must_be_svm(b(i)->(h~[i]) Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[i]),s->Za,u->n0) ==> (n0 in Za) imp (({[i,(h~[i]) Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[i])]: i in Za}~[n0]) = ((h~[n0]) Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[n0])))
	APPLY() Must_be_svm(b(i)->Ra_Rev(Ra0Seq~[i]),s->Za,u->n0) ==> (n0 in Za) imp (({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[n0]) = Ra_Rev(Ra0Seq~[n0]))
        n0-->T548(Stat6*) ==> Stat7: ((Ra0Seq~[n0]) = Ra_0) & (({[i,(h~[i]) Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[i])]: i in Za}~[n0]) = ((h~[n0]) Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[n0]))) & (({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[n0]) = Ra_Rev(Ra0Seq~[n0]))
        T481 ==> Ra_Rev(Ra_0) = Ra_0
	EQUAL(Stat7) ==> ({[i,(h~[i]) Ra_PLUS ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[i])]: i in Za}~[n0]) = ((h~[n0]) Ra_PLUS Ra_0)
	(h,n0)-->T540 ==> (h~[n0]) in Ra
(h~[n0])-->T451(Stat6*) ==> false; Discharge ==> QED
--
Theorem 590: [Basic properties of the signed negative for rational sequences] (X in RaSeq) imp ((Ras_Rev(X) in RaSeq) & ((Ras_Rev(X) Ras_PLUS X) = Ra0Seq) & (Ras_Rev(Ras_Rev(X)) = X)). Proof:
Suppose_not(h) ==> AUTO
	(h,h)-->T554 ==> ((Ras_Rev(h) Ras_PLUS h) /= Ra0Seq) or (Ras_Rev(Ras_Rev(h)) /= h)
	Suppose ==> Stat1: (h in RaSeq) & ((Ras_Rev(h) Ras_PLUS h) /= Ra0Seq)
		T545(Stat1*) ==> Ra0Seq in RaCauchy
		T539(Stat1*) ==> Ra0Seq in RaSeq
		(h,h)-->T554(Stat1*) ==> Ras_Rev(h) in RaSeq
		(Ras_Rev(h),h)-->T554(Stat1*) ==> (Ras_Rev(h) Ras_PLUS h) in RaSeq
		(Ras_Rev(h) Ras_PLUS h,Ra0Seq)-->T542(Stat1,Stat1*) ==> Stat2: not(FORALL n in Za | ((Ras_Rev(h) Ras_PLUS h) in RaSeq) & (Ra0Seq in RaSeq) & (((Ras_Rev(h) Ras_PLUS h)~[n]) = (Ra0Seq~[n])))
		n0-->Stat2(Stat1*) ==> (n0 in Za) & (((Ras_Rev(h) Ras_PLUS h)~[n0]) /= (Ra0Seq~[n0]))
		(Ras_Rev(h),h,n0)-->T555(Stat1*) ==> ((Ras_Rev(h) Ras_PLUS h)~[n0]) = ((Ras_Rev(h)~[n0]) Ra_PLUS (h~[n0]))
		(h,h,n0)-->T555(Stat1*) ==> (Ras_Rev(h)~[n0]) = Ra_Rev(h~[n0])
		n0-->T548(Stat1*) ==> (Ra0Seq~[n0]) = Ra_0
		EQUAL(Stat1*) ==> (Ra_Rev(h~[n0]) Ra_PLUS (h~[n0])) /= Ra_0
		(h,n0)-->T540(Stat1*) ==> (h~[n0]) in Ra
		(h~[n0])-->T452(Stat1*) ==> (Ra_Rev(h~[n0]) in Ra) & (((h~[n0]) Ra_PLUS Ra_Rev(h~[n0])) = Ra_0)
	(h~[n0],Ra_Rev(h~[n0]))-->T445(Stat1*) ==> false; Discharge ==> Stat3: (h in RaSeq) & (Ras_Rev(Ras_Rev(h)) /= h)
	(h,h)-->T554(Stat3*) ==> Ras_Rev(h) in RaSeq
	(h,Ras_Rev(h))-->T554(Stat3*) ==> Ras_Rev(Ras_Rev(h)) in RaSeq
	(Ras_Rev(Ras_Rev(h)),h)-->T542(Stat3,Stat3*) ==> Stat4: not(FORALL n in Za | (Ras_Rev(Ras_Rev(h)) in RaSeq) & (h in RaSeq) & ((Ras_Rev(Ras_Rev(h))~[n]) = (h~[n])))
	n1-->Stat4(Stat3*) ==> (n1 in Za) & ((Ras_Rev(Ras_Rev(h))~[n1]) /= (h~[n1]))
	(h,Ras_Rev(h),n1)-->T555(Stat3*) ==> (Ras_Rev(Ras_Rev(h))~[n1]) = Ra_Rev((Ras_Rev(h))~[n1])
	(h,h,n1)-->T555(Stat3*) ==> (Ras_Rev(h)~[n1]) = Ra_Rev(h~[n1])
	EQUAL(Stat4*) ==> Ra_Rev(Ra_Rev(h~[n1])) /= (h~[n1])
	(h,n1)-->T540(Stat3*) ==> (h~[n1]) in Ra
(h~[n1])-->T494(Stat4*) ==> false; Discharge ==> QED
--
--
Theorem 591: [Reciprocal sequence principle] ((X in RaCauchy) & (not Ra_eqseq(X,Ra0Seq))) imp Ra_eqseq(X Ras_TIMES Ras_Recip(X),Ra1Seq). Proof:
Suppose_not(f) ==>AUTO
--
-- Reasoning by contradiction, assume that a counterexample exists. We can, without loss of
-- generality, assume that the counterexample to the desired statement is a rational Cauchy
-- sequence $g$ whose reciprocal owns, as components, the reciprocals of the components of $g$.
--
	f-->T568 ==> Stat1: (EXISTS g in RaCauchy | Ra_eqseq(f,g) & (Ras_Recip(f) = Ras_Recip(g)) & (FORALL u in Za | ((g~[u]) /= Ra_0) & ((Ras_Recip(g)~[u]) = Recip(g~[u]))))
	g-->Stat1 ==> Stat2: (g in RaCauchy) & Ra_eqseq(f,g) & (Ras_Recip(f) = Ras_Recip(g)) & Stat3: (FORALL u in Za | ((g~[u]) /= Ra_0) & ((Ras_Recip(g)~[u]) = Recip(g~[u])))
	T545(Stat2*) ==> (Ra0Seq in RaCauchy) & (Ra1Seq in RaCauchy)
	T539(*) ==> Stat4: (g in RaSeq) & (f in RaSeq) & (Ra0Seq in RaSeq) & (Ra1Seq in RaSeq)
	Suppose ==> Ra_eqseq(g,Ra0Seq)
		Ra0Seq-->T546(Stat4,Stat4*) ==> Ra_eqseq(Ra0Seq,Ra0Seq)
		(g,Ra0Seq,Ra0Seq)-->T553(Stat2*) ==> Ra_eqseq(Ra0Seq,g)
		f-->T546(Stat2*) ==> Ra_eqseq(f,f)
		(f,f,g)-->T553(Stat2*) ==> Ra_eqseq(g,f)
	(Ra0Seq,g,f)-->T553(*) ==> false; Discharge ==> not(Ra_eqseq(g,Ra0Seq))
	(g,g)-->T570(Stat2*) ==> Ras_Recip(g) in RaCauchy
	T539(Stat2*) ==> Stat5: Ras_Recip(g) in RaSeq
	(g,Ras_Recip(g))-->T554(Stat2*) ==> Stat6: ((g Ras_TIMES Ras_Recip(g)) in RaSeq) &
		((g Ras_TIMES Ras_Recip(g)) = {[i,((g~[i]) Ra_TIMES ((Ras_Recip(g))~[i]))]: i in Za})
	Ra1Seq-->T546(Stat4,Stat4*) ==> Stat7: Ra_eqseq(Ra1Seq,Ra1Seq)
	Suppose ==> Stat8: Ra_eqseq(g Ras_TIMES Ras_Recip(g),Ra1Seq)
		(f,f)-->T570(*) ==> Ras_Recip(f) in RaCauchy
		(Ras_Recip(g))-->T546(Stat5,Stat5*) ==> Ra_eqseq(Ras_Recip(g),Ras_Recip(g))
		EQUAL(Stat2) ==> Stat9: Ra_eqseq(Ras_Recip(f),Ras_Recip(g)) & (Ras_Recip(f) in RaSeq)
		(f,g,Ras_Recip(f),Ras_Recip(g))-->T574(*) ==> Ra_eqseq(f Ras_TIMES Ras_Recip(f), g Ras_TIMES Ras_Recip(g))
		(f,Ras_Recip(f))-->T554(Stat4,Stat9*) ==> (f Ras_TIMES Ras_Recip(f)) in RaSeq
		(f Ras_TIMES Ras_Recip(f),g Ras_TIMES Ras_Recip(g),Ra1Seq)-->T553(Stat4*) ==> Ra_eqseq(Ra1Seq,f Ras_TIMES Ras_Recip(f))
	(Ra1Seq,Ra1Seq,f Ras_TIMES Ras_Recip(f))-->T553(*) ==> false; Discharge ==> Stat10: not(Ra_eqseq(g Ras_TIMES Ras_Recip(g),Ra1Seq))
--
-- Since $g Ras_TIMES Ras_Recip(g)$ is not equivalent to $Ra1Seq$, by reflexivity of
-- equivalence these sequences must differ from one another, and hence they must differ
-- in the $n0$-th component for some unsigned integer $n0$.
--
	Suppose ==> Stat11: (g Ras_TIMES Ras_Recip(g)) = Ra1Seq
	EQUAL(Stat7,Stat10,Stat11) ==> false; Discharge ==> Stat12: (g Ras_TIMES Ras_Recip(g)) /= Ra1Seq
	(g Ras_TIMES Ras_Recip(g),Ra1Seq)-->T542(Stat12*) ==> Stat13: not(FORALL n in Za | (((g Ras_TIMES Ras_Recip(g)) in RaSeq) & (Ra1Seq in RaSeq) & (((g Ras_TIMES Ras_Recip(g))~[n]) = (Ra1Seq~[n]))))
	n0-->Stat13(Stat6,Stat4*) ==> Stat14: (n0 in Za) & (((g Ras_TIMES Ras_Recip(g))~[n0]) /= (Ra1Seq~[n0]))
--
	EQUAL(Stat14,Stat6) ==> (({[i,((g~[i]) Ra_TIMES ((Ras_Recip(g))~[i]))]: i in Za}~[n0]) /= (Ra1Seq~[n0]))
	APPLY() Must_be_svm(b(i)->((g~[i]) Ra_TIMES ((Ras_Recip(g))~[i])),s->Za,u->n0) ==> (n0 in Za) imp (({[i,((g~[i]) Ra_TIMES ((Ras_Recip(g))~[i]))]: i in Za}~[n0]) = ((g~[n0]) Ra_TIMES ((Ras_Recip(g))~[n0])))
        n0-->T548(Stat14,Stat14*) ==> (Ra1Seq~[n0]) = Ra_1
	(Stat14*)ELEM ==> Stat15: ((g~[n0]) Ra_TIMES ((Ras_Recip(g))~[n0])) /= Ra_1
--
	(g,n0)-->T540(Stat14,Stat4*) ==> Stat16: (g~[n0]) in Ra
	n0-->Stat3(Stat14,Stat14*) ==> Stat17: ((g~[n0]) /= Ra_0) & ((Ras_Recip(g)~[n0]) = Recip(g~[n0]))
	EQUAL(Stat15,Stat17) ==> ((g~[n0]) Ra_TIMES Recip(g~[n0])) /= Ra_1
(g~[n0])-->T462(Stat16*) ==> false; Discharge ==> QED
--
--
Theorem 592: [The negative of a sum of rational sequences is the sum of the negatives] ((X in RaSeq) & (Y in RaSeq)) imp (Ras_Rev(X Ras_PLUS Y) = Ras_Rev(X) Ras_PLUS Ras_Rev(Y)). Proof:
Suppose_not(h,k) ==>AUTO
	(h,k)-->T554 ==> ((h Ras_PLUS k) in RaSeq) & (Ras_Rev(k) in RaSeq)
	(h,h)-->T554 ==> Ras_Rev(h) in RaSeq
	(Ras_Rev(h),Ras_Rev(k))-->T554 ==> (Ras_Rev(h) Ras_PLUS Ras_Rev(k)) in RaSeq
	(h,h Ras_PLUS k)-->T554 ==> Ras_Rev(h Ras_PLUS k) in RaSeq
	(Ras_Rev(h Ras_PLUS k))-->T546 ==> Svm(Ras_Rev(h Ras_PLUS k)) & (domain(Ras_Rev(h Ras_PLUS k)) = Za)
	(Ras_Rev(h) Ras_PLUS Ras_Rev(k))-->T546 ==> Svm(Ras_Rev(h) Ras_PLUS Ras_Rev(k)) & (domain(Ras_Rev(h) Ras_PLUS Ras_Rev(k)) = Za)
	(Ras_Rev(h Ras_PLUS k))-->T72(*) ==> Ras_Rev(h Ras_PLUS k) = {[i,Ras_Rev(h Ras_PLUS k)~[i]]: i in domain(Ras_Rev(h Ras_PLUS k))}
	(Ras_Rev(h) Ras_PLUS Ras_Rev(k))-->T72(*) ==> (Ras_Rev(h) Ras_PLUS Ras_Rev(k)) = {[i,(Ras_Rev(h) Ras_PLUS Ras_Rev(k))~[i]]: i in domain(Ras_Rev(h) Ras_PLUS Ras_Rev(k))}
	Suppose ==> {[i,Ras_Rev(h Ras_PLUS k)~[i]]: i in Za} = {[i,(Ras_Rev(h) Ras_PLUS Ras_Rev(k))~[i]]: i in Za}
	EQUAL ==> false; Discharge ==> Stat1: {[i,Ras_Rev(h Ras_PLUS k)~[i]]: i in Za} /= {[i,(Ras_Rev(h) Ras_PLUS Ras_Rev(k))~[i]]: i in Za}
	i-->Stat1(Stat1) ==> Stat2: (i in Za) & ((Ras_Rev(h Ras_PLUS k)~[i]) /= ((Ras_Rev(h) Ras_PLUS Ras_Rev(k))~[i]))
        (h,h Ras_PLUS k,i)-->T555 ==> (Ras_Rev(h Ras_PLUS k)~[i]) = Ra_Rev((h Ras_PLUS k)~[i])
	(h,k,i)-->T555 ==> ((h Ras_PLUS k)~[i]) = ((h~[i]) Ra_PLUS (k~[i]))
	(Ras_Rev(h),Ras_Rev(k),i)-->T555 ==> ((Ras_Rev(h) Ras_PLUS Ras_Rev(k))~[i]) = ((Ras_Rev(h)~[i]) Ra_PLUS (Ras_Rev(k)~[i]))
	(h,h,i)-->T555 ==> (Ras_Rev(h)~[i]) = Ra_Rev(h~[i])
	(k,k,i)-->T555 ==> (Ras_Rev(k)~[i]) = Ra_Rev(k~[i])
	EQUAL ==> Ra_Rev((h Ras_PLUS k)~[i]) = Ra_Rev((h~[i]) Ra_PLUS (k~[i]))
	EQUAL ==> ((Ras_Rev(h)~[i]) Ra_PLUS (Ras_Rev(k)~[i])) = (Ra_Rev(h~[i]) Ra_PLUS Ra_Rev(k~[i]))
	(h,i)-->T540 ==> (h~[i]) in Ra
	(k,i)-->T540 ==> (k~[i]) in Ra
	(h~[i])-->T452 ==> Ra_Rev(h~[i]) in Ra
(h~[i],k~[i])-->T492(Stat2*) ==> false; Discharge ==> QED
--
Theorem 593: [A rational sequence minus itself gives 0] (X in RaSeq) imp ((X Ras_MINUS X) = Ra0Seq). Proof:
Suppose_not(h) ==>AUTO
	T545(*) ==> Ra0Seq in RaCauchy
	T539(*) ==> Ra0Seq in RaSeq
	(h,h)-->T554 ==> Ras_Rev(h) in RaSeq
	(h,Ras_Rev(h))-->T554 ==> (h Ras_PLUS Ras_Rev(h)) in RaSeq
        Use_def(Ras_MINUS) ==> ((h Ras_PLUS Ras_Rev(h)) /= Ra0Seq)
	Ra0Seq-->T546 ==> Svm(Ra0Seq) & (domain(Ra0Seq) = Za)
	(h Ras_PLUS Ras_Rev(h))-->T546 ==> Svm(h Ras_PLUS Ras_Rev(h)) & (domain(h Ras_PLUS Ras_Rev(h)) = Za)
	Ra0Seq-->T72 ==> Ra0Seq = {[i,Ra0Seq~[i]]: i in domain(Ra0Seq)}
	(h Ras_PLUS Ras_Rev(h))-->T72(*) ==> (h Ras_PLUS Ras_Rev(h)) = {[i,(h Ras_PLUS Ras_Rev(h))~[i]]: i in domain(h Ras_PLUS Ras_Rev(h))}
	Suppose ==> {[i,Ra0Seq~[i]]: i in Za} = {[i,(h Ras_PLUS Ras_Rev(h))~[i]]: i in Za}
	EQUAL ==> false; Discharge ==> Stat1: {[i,Ra0Seq~[i]]: i in Za} /= {[i,(h Ras_PLUS Ras_Rev(h))~[i]]: i in Za}
	i-->Stat1(Stat1) ==>  Stat2: (i in Za) & ((Ra0Seq~[i]) /= ((h Ras_PLUS Ras_Rev(h))~[i]))
	(h,Ras_Rev(h),i)-->T555 ==> ((h Ras_PLUS Ras_Rev(h))~[i]) = ((h~[i]) Ra_PLUS (Ras_Rev(h)~[i]))
	(h,h,i)-->T555 ==> (Ras_Rev(h)~[i]) = Ra_Rev(h~[i])
	i-->T548 ==> (Ra0Seq~[i]) = Ra_0
	EQUAL ==> ((h~[i]) Ra_PLUS (Ras_Rev(h)~[i])) = ((h~[i]) Ra_PLUS Ra_Rev(h~[i]))
	(h,i)-->T540 ==> (h~[i]) in Ra
(h~[i])-->T452(Stat2*) ==> false; Discharge ==> QED
--
Theorem 594: [Multiplication by $Ras_Rev(Ra1Seq)$] (X in RaSeq) imp (Ras_Rev(X) = (Ras_Rev(Ra1Seq) Ras_TIMES X)). Proof:
Suppose_not(h) ==>AUTO
	T545(*) ==> Ra1Seq in RaCauchy
	T539(*) ==> Ra1Seq in RaSeq
	(Ra1Seq,Ra1Seq)-->T554 ==> Ras_Rev(Ra1Seq) in RaSeq
	(h,h)-->T554 ==> Ras_Rev(h) in RaSeq
	(Ras_Rev(Ra1Seq),h)-->T554 ==> (Ras_Rev(Ra1Seq) Ras_TIMES h) in RaSeq
	(Ras_Rev(h))-->T546 ==> Svm(Ras_Rev(h)) & (domain(Ras_Rev(h)) = Za)
	(Ras_Rev(Ra1Seq) Ras_TIMES h)-->T546 ==> Svm(Ras_Rev(Ra1Seq) Ras_TIMES h) & (domain(Ras_Rev(Ra1Seq) Ras_TIMES h) = Za)
	(Ras_Rev(h))-->T72 ==> Ras_Rev(h) = {[i,Ras_Rev(h)~[i]]: i in domain(Ras_Rev(h))}
	(Ras_Rev(Ra1Seq) Ras_TIMES h)-->T72(*) ==> (Ras_Rev(Ra1Seq) Ras_TIMES h) = {[i,(Ras_Rev(Ra1Seq) Ras_TIMES h)~[i]]: i in domain(Ras_Rev(Ra1Seq) Ras_TIMES h)}
	Suppose ==> {[i,Ras_Rev(h)~[i]]: i in Za} = {[i,(Ras_Rev(Ra1Seq) Ras_TIMES h)~[i]]: i in Za}
	EQUAL ==> false; Discharge ==> Stat1: {[i,Ras_Rev(h)~[i]]: i in Za} /= {[i,(Ras_Rev(Ra1Seq) Ras_TIMES h)~[i]]: i in Za}
	i-->Stat1(Stat1) ==>  Stat2: (i in Za) & ((Ras_Rev(h)~[i]) /= ((Ras_Rev(Ra1Seq) Ras_TIMES h)~[i]))
	(Ras_Rev(Ra1Seq),h,i)-->T555 ==> ((Ras_Rev(Ra1Seq) Ras_TIMES h)~[i]) = ((Ras_Rev(Ra1Seq)~[i]) Ra_TIMES (h~[i]))
        (h,h,i)-->T555 ==> (Ras_Rev(h)~[i]) = Ra_Rev(h~[i])
        (h,Ra1Seq,i)-->T555 ==> (Ras_Rev(Ra1Seq)~[i]) = Ra_Rev(Ra1Seq~[i])
	i-->T548 ==> (Ra1Seq~[i]) = Ra_1
	EQUAL ==> ((Ras_Rev(Ra1Seq)~[i]) Ra_TIMES (h~[i])) = (Ra_Rev(Ra_1) Ra_TIMES (h~[i]))
	(h,i)-->T540 ==> (h~[i]) in Ra
(h~[i])-->T486 ==> false; Discharge ==> QED
--
Theorem 595: [The zero sequence is its own negative] Ras_Rev(Ra0Seq) = Ra0Seq. Proof:
Suppose_not ==> AUTO
	T545(*) ==> Ra0Seq in RaCauchy
	T539(*) ==> Stat1: Ra0Seq in RaSeq
	(Ra0Seq,Ra0Seq)-->T554(*) ==> Stat2: (Ras_Rev(Ra0Seq) in RaSeq) &
		(Ras_Rev(Ra0Seq) = {[i,Ra_Rev(Ra0Seq~[i])]: i in Za})
	(Ras_Rev(Ra0Seq),Ra0Seq)-->T542(*) ==> Stat3: not(FORALL n in Za | (((Ras_Rev(Ra0Seq)) in RaSeq) & (Ra0Seq in RaSeq) & (((Ras_Rev(Ra0Seq))~[n]) = (Ra0Seq~[n]))))
	n0-->Stat3(*) ==> Stat4: (n0 in Za) & (((Ras_Rev(Ra0Seq))~[n0]) /= (Ra0Seq~[n0]))
	EQUAL(Stat4,Stat2) ==> ({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[n0]) /= (Ra0Seq~[n0])
	APPLY() Must_be_svm(b(i)->Ra_Rev(Ra0Seq~[i]),s->Za,u->n0) ==> (n0 in Za) imp (({[i,Ra_Rev(Ra0Seq~[i])]: i in Za}~[n0]) = (Ra_Rev(Ra0Seq~[n0])))
        n0-->T548(Stat4,Stat4*) ==> Stat5: (Ra0Seq~[n0]) = Ra_0
	T481(Stat5*) ==> Ra_Rev(Ra_0) = Ra_0
	EQUAL(Stat5) ==> Ra_Rev(Ra0Seq~[n0]) = Ra_0
(Stat4*)Discharge ==> QED
--
Theorem 596: [The zero/unit sequence is its own absolute value] (Ras_ABS(Ra0Seq) = Ra0Seq) & (Ras_ABS(Ra1Seq) = Ra1Seq). Proof:
Suppose_not ==> AUTO
	()-->T545 ==> AUTO
	()-->T539 ==> AUTO
	(Ra0Seq,Ra0Seq)-->T554(*) ==> Stat1: (Ras_ABS(Ra0Seq) in RaSeq) &
		(Ras_ABS(Ra0Seq) = {[i,Ra_ABS(Ra0Seq~[i])]: i in Za})
	(Ra1Seq,Ra1Seq)-->T554(*) ==> Stat2: (Ras_ABS(Ra1Seq) in RaSeq) &
		(Ras_ABS(Ra1Seq) = {[i,Ra_ABS(Ra1Seq~[i])]: i in Za})
	T525(Stat3*) ==> Stat3: (FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0))) &
        	Stat4: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
--
-- Rejection of the assertion, which consists of two alternative cases,
-- proceeds quite similarly in either case.
--
	Suppose ==> Ras_ABS(Ra0Seq) /= Ra0Seq
		(Ras_ABS(Ra0Seq),Ra0Seq)-->T542(*) ==> Stat5: not(FORALL n in Za | (((Ras_ABS(Ra0Seq)) in RaSeq) & (Ra0Seq in RaSeq) & (((Ras_ABS(Ra0Seq))~[n]) = (Ra0Seq~[n]))))
		n0-->Stat5(*) ==> Stat6: (n0 in Za) & (((Ras_ABS(Ra0Seq))~[n0]) /= (Ra0Seq~[n0]))
		EQUAL(Stat6,Stat1) ==> ({[i,Ra_ABS(Ra0Seq~[i])]: i in Za}~[n0]) /= (Ra0Seq~[n0])
		APPLY() Must_be_svm(b(i)->Ra_ABS(Ra0Seq~[i]),s->Za,u->n0) ==> (n0 in Za) imp (({[i,Ra_ABS(Ra0Seq~[i])]: i in Za}~[n0]) = (Ra_ABS(Ra0Seq~[n0])))
		n0-->T548(Stat6,Stat6*) ==> Stat7: (Ra0Seq~[n0]) = Ra_0
		T451(Stat7*) ==> Ra_0 in Ra
		Ra_0-->Stat3(Stat6*) ==> Ra_ABS(Ra_0) = Ra_0
		EQUAL(Stat7) ==> Ra_ABS(Ra0Seq~[n0]) = Ra_0
	(Stat6*)Discharge ==> Ras_ABS(Ra1Seq) /= Ra1Seq
--
--
	(Ras_ABS(Ra1Seq),Ra1Seq)-->T542(*) ==> Stat8: not(FORALL n in Za | (((Ras_ABS(Ra1Seq)) in RaSeq) & (Ra1Seq in RaSeq) & (((Ras_ABS(Ra1Seq))~[n]) = (Ra1Seq~[n]))))
	n1-->Stat8(*) ==> Stat9: (n1 in Za) & (((Ras_ABS(Ra1Seq))~[n1]) /= (Ra1Seq~[n1]))
	EQUAL(Stat9,Stat2) ==> ({[i,Ra_ABS(Ra1Seq~[i])]: i in Za}~[n1]) /= (Ra1Seq~[n1])
	APPLY() Must_be_svm(b(i)->Ra_ABS(Ra1Seq~[i]),s->Za,u->n1) ==> (n1 in Za) imp (({[i,Ra_ABS(Ra1Seq~[i])]: i in Za}~[n1]) = (Ra_ABS(Ra1Seq~[n1])))
        n1-->T548(Stat9,Stat9*) ==> Stat10: (Ra1Seq~[n1]) = Ra_1
        T465(Stat10*) ==> Ra_is_nonneg(Ra_1)
        Ra_1-->Stat4(Stat10*) ==> Ra_ABS(Ra_1) = Ra_1
	EQUAL(Stat10) ==> Ra_ABS(Ra1Seq~[n1]) = Ra_1
(Stat9*)Discharge ==> QED
--
Theorem 597: [?] ((H in RaCauchy) & Ra_eqseq(H,Ra0Seq)) imp (Ra_eqseq(Ras_ABS(H),Ra0Seq) & (Ra_eqseq(Ras_Rev(H),Ra0Seq))). Proof:
Suppose_not(h) ==> AUTO
	T545(*) ==> Ra0Seq in RaCauchy
	Suppose ==> Stat1: (not Ra_eqseq(Ras_Rev(h),Ra0Seq))
		(h,Ra0Seq)-->T575(*) ==> Ra_eqseq(Ras_Rev(h),Ras_Rev(Ra0Seq))
		T595 ==> Ras_Rev(Ra0Seq) = Ra0Seq
	EQUAL(Stat1) ==> false; Discharge ==> Stat2: (not Ra_eqseq(Ras_ABS(h),Ra0Seq))
	(h,Ra0Seq)-->T576(*) ==> Ra_eqseq(Ras_ABS(h),Ras_ABS(Ra0Seq))
	T596 ==> Ras_ABS(Ra0Seq) = Ra0Seq
EQUAL(Stat2) ==> false; Discharge ==> QED
--
Theorem 598: [All terms of a Cauchy sequence not equivalent to zero have the same sign and have an absolute value bounded below beyond a certain point] ((F in RaCauchy) &
	(not Ra_eqseq(F,Ra0Seq))) imp (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) & (FORALL i in (Za - n) | (Ra_ABS(F~[i]) Ra_GT eps) &
	(Ra_ABS(F~[i]) = if ((F~[n]) Ra_GE Ra_0) then (F~[i]) else Ra_Rev(F~[i]) end if) )). Proof:
Suppose_not(h) ==> ((h in RaCauchy) & (not Ra_eqseq(h,Ra0Seq))) & Stat1: (not(EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) & (FORALL i in (Za - n) | (Ra_ABS(h~[i]) Ra_GT eps) &
		(Ra_ABS(h~[i]) = if ((h~[n]) Ra_GE Ra_0) then (h~[i]) else Ra_Rev(h~[i]) end if) )))
	T539(*) ==> Stat2: h in RaSeq
--
-- Let the Cauchy sequence $h$ be a counterexample to our claim.
-- Then it is easily seen that $h$ cannot be equivalent to $Ra0Seq$; hence,
-- by Theorem 564, there exists a positive rational $eps0$ and an integer $n0$
-- beyond which all the components $h~[i]$ of $h$ have an absolute value greater than $eps0$
-- and all the components $h~[j], h~[i]$ of $h$ differ by less than $eps0$.
--
	h-->T564(*) ==> Stat3: (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
		(FORALL i in (Za - n) | Ra_ABS(h~[i]) Ra_GT eps) &
		(FORALL i in Za, j in Za | ((i notin n) & (j notin n)) imp (eps Ra_GT (Ra_ABS((h~[i]) Ra_MINUS (h~[j])))) ))
	(eps0,n0)-->Stat3(Stat3*) ==> Stat4: (eps0 in Ra) & (n0 in Za) & (eps0 Ra_GT Ra_0) &
		Stat5: (FORALL i in (Za - n0) | Ra_ABS(h~[i]) Ra_GT eps0) &
		Stat6: (FORALL i in Za, j in Za | ((i notin n0) & (j notin n0)) imp (eps0 Ra_GT (Ra_ABS((h~[i]) Ra_MINUS (h~[j])))) )
--
-- Our initial hypothesis now yields the existence of a component, say the $i1$-th,
-- beyond the $n0$-th component, whose absolute value does not comply in sign with
-- the $n0$-th component.
--
	(eps0,n0)-->Stat1(Stat4*) ==> Stat7: not(FORALL i in (Za - n0) | (Ra_ABS(h~[i]) Ra_GT eps0) &
		(Ra_ABS(h~[i]) = if ((h~[n0]) Ra_GE Ra_0) then (h~[i]) else Ra_Rev(h~[i]) end if) )
	i1-->Stat7(Stat7*) ==> Stat8: (i1 in (Za - n0)) & (not(Ra_ABS(h~[i1]) Ra_GT eps0) or (Ra_ABS(h~[i1]) /= if ((h~[n0]) Ra_GE Ra_0) then (h~[i1]) else Ra_Rev(h~[i1]) end if))
	i1-->Stat5(Stat8*) ==> Stat9: (Ra_ABS(h~[i1]) Ra_GT eps0) & (Ra_ABS(h~[i1]) /= if ((h~[n0]) Ra_GE Ra_0) then (h~[i1]) else Ra_Rev(h~[i1]) end if)
--
-- Either $h~[n0]$ is positive, or it is negative. In the first case...
--
	n0-->Stat5(Stat4*) ==> Stat10: Ra_ABS(h~[n0]) Ra_GT eps0
	(h,n0)-->T540(Stat2,Stat4*) ==> Stat11: (h~[n0]) in Ra
	(h~[n0])-->T527(Stat11*) ==> Stat12: (Ra_ABS(h~[n0]) in Ra) & (Ra_ABS(h~[n0]) Ra_GE Ra_0)
	(h~[n0])-->T451(Stat11,Stat11*) ==> Stat13: Ra_0 in Ra
	(Ra_ABS(h~[n0]),eps0,Ra_0)-->T498(Stat12,Stat4,Stat13,Stat10*) ==> Ra_ABS(h~[n0]) Ra_GT Ra_0
	(Ra_ABS(h~[n0]),Ra_0)-->T473(Stat13*) ==> Stat14: Ra_ABS(h~[n0]) /= Ra_0
	T525(Stat13*) ==> Stat15: (FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0)))
	(h~[n0])-->Stat15(Stat11,Stat14*) ==> Stat16: (h~[n0]) /= Ra_0
	(h~[n0],Ra_0)-->T476(Stat11,Stat13,Stat16*) ==> ((h~[n0]) Ra_GT Ra_0) or (Ra_0 Ra_GT (h~[n0]))
	(h,i1)-->T540(Stat2,Stat8*) ==> Stat17: (h~[i1]) in Ra
	(h~[i1])-->T452(Stat17*) ==> Stat18: Ra_Rev(h~[i1]) in Ra
	T481(Stat18*) ==> Stat19: Ra_Rev(Ra_0) = Ra_0
	(eps0,eps0)-->T473(Stat19*) ==> Stat20: not(eps0 Ra_GT eps0)
	eps0-->T451(Stat4,Stat4*) ==> Stat21: eps0 = (eps0 Ra_PLUS Ra_0)
	Suppose ==> (h~[n0]) Ra_GT Ra_0
--
-- ... we reach a contradiction as follows. Observe that $Ra_ABS(h~[n0])$ equals $h~[n0]$, and
-- Stat9 yields that $Ra_ABS(h~[i1]) /= (h~[i1])$ in this case, and hence $h~[i1]$ is negative.
-- However, this conflicts with the fact that the distance between $h~[n0]$, which is bigger
-- than $eps0$, and $h~[i1]$ is smaller than $eps0$.
--
		(h~[n0],Ra_0)-->T473(Stat16*) ==> Stat22: (h~[n0]) Ra_GE Ra_0
		(h~[n0])-->T529(Stat11*) ==> Stat23: Ra_ABS(h~[n0]) = (h~[n0])
		(Stat22,Stat9*)ELEM ==> Stat24: Ra_ABS(h~[i1]) /= (h~[i1])
		(h~[i1])-->T528(Stat24,Stat17*) ==> Stat25: not((h~[i1]) Ra_GE Ra_0)
		(Ra_0,h~[i1])-->T478(Stat13,Stat17,Stat25*) ==> Stat26: Ra_0 Ra_GT (h~[i1])
		(Ra_0,h~[i1])-->T503(Stat26,Stat13,Stat17*) ==> Stat27: Ra_Rev(h~[i1]) Ra_GT Ra_Rev(Ra_0)
		EQUAL(Stat27,Stat19) ==> Stat28: Ra_Rev(h~[i1]) Ra_GT Ra_0
		EQUAL(Stat23,Stat10) ==> Stat29: (h~[n0]) Ra_GT eps0
		(h~[n0],eps0)-->T473(Stat29*) ==> Stat30: (h~[n0]) Ra_GE eps0
		(h~[n0],eps0,Ra_Rev(h~[i1]),Ra_0)-->T504(Stat11,Stat4,Stat18,Stat13,Stat30,Stat28*) ==>
			Stat31: ((h~[n0]) Ra_PLUS Ra_Rev(h~[i1])) Ra_GT (eps0 Ra_PLUS Ra_0)
		EQUAL(Stat31,Stat21) ==> Stat32: ((h~[n0]) Ra_PLUS Ra_Rev(h~[i1])) Ra_GT eps0
		(h~[n0],Ra_Rev(h~[i1]))-->T445(Stat11,Stat18*) ==> Stat33: ((h~[n0]) Ra_PLUS Ra_Rev(h~[i1])) in Ra
		((h~[n0]) Ra_PLUS Ra_Rev(h~[i1]),eps0,Ra_0)-->T498(Stat32,Stat33,Stat4,Stat13*) ==> ((h~[n0]) Ra_PLUS Ra_Rev(h~[i1])) Ra_GT Ra_0
		((h~[n0]) Ra_PLUS Ra_Rev(h~[i1]))-->T529(Stat33*) ==> Ra_ABS((h~[n0]) Ra_PLUS Ra_Rev(h~[i1])) = ((h~[n0]) Ra_PLUS Ra_Rev(h~[i1]))
		Use_def(Ra_MINUS) ==> (h~[n0]) Ra_MINUS (h~[i1]) = (h~[n0]) Ra_PLUS Ra_Rev(h~[i1])
		EQUAL(Stat32) ==> Stat34: (Ra_ABS((h~[n0]) Ra_MINUS (h~[i1])) in Ra) & (Ra_ABS((h~[n0]) Ra_MINUS (h~[i1])) Ra_GT eps0)
		(n0,i1)-->Stat6(Stat4,Stat8*) ==> Stat35: eps0 Ra_GT Ra_ABS((h~[n0]) Ra_MINUS (h~[i1]))
	(eps0,Ra_ABS((h~[n0]) Ra_MINUS (h~[i1])),eps0)-->T498(Stat4,Stat34,Stat35,Stat20*) ==> false; Discharge ==> Stat36: Ra_0 Ra_GT (h~[n0])
--
-- Hence $h~[n0]$ is negative; but then we reach again a contradiction,
-- leading to the desired overall conclusion, as follows. Observe that $Ra_ABS(h~[n0])$ equals
-- $Ra_Rev(h~[n0])$, and Stat9 yields that $Ra_ABS(h~[i1]) /= Ra_Rev(h~[i1])$ in this case,
-- and hence $h~[i1]$ is positive. However, this conflicts with the fact that the distance
-- between $h~[n0]$, which is smaller than $eps0$, and $h~[i1]$ is smaller than $eps0$.
--
	T525(Stat36*) ==> Stat37: (FORALL x | (x in Ra) imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
	(h~[n0])-->Stat37(Stat11,Stat11*) ==> Stat38: Ra_ABS(Ra_Rev(h~[n0])) = Ra_ABS(h~[n0])
	(Ra_0,h~[n0])-->T503(Stat36,Stat11,Stat13*) ==> Stat39: Ra_Rev(h~[n0]) Ra_GT Ra_Rev(Ra_0)
	EQUAL(Stat39,Stat19) ==> Stat40: Ra_Rev(h~[n0]) Ra_GT Ra_0
	(h~[n0])-->T452(Stat11,Stat11*) ==> Stat41: Ra_Rev(h~[n0]) in Ra
	(Ra_Rev(h~[n0]))-->T529(Stat38*) ==> Ra_ABS(h~[n0]) = Ra_Rev(h~[n0])
	Suppose ==> Stat42: (h~[n0]) Ra_GE Ra_0
		(Ra_0,h~[n0],Ra_0)-->T497(Stat13,Stat11,Stat36,Stat42*) ==> Ra_0 Ra_GT Ra_0
--	Use_def(Ra_GT)(Stat42*) ==> false; Discharge ==> Stat43: not((h~[n0]) Ra_GE Ra_0)
	(Ra_0,Ra_0)-->T473(Stat42*) ==> false; Discharge ==> Stat43: not((h~[n0]) Ra_GE Ra_0)
	(Stat9,Stat43*)ELEM ==> Stat44: Ra_ABS(h~[i1]) /= Ra_Rev(h~[i1])
	(h~[i1])-->Stat37(Stat17,Stat17*) ==> Stat45: Ra_ABS(Ra_Rev(h~[i1])) = Ra_ABS(h~[i1])
	(Ra_Rev(h~[i1]))-->T528(Stat44,Stat45,Stat18*) ==> Stat46: not(Ra_Rev(h~[i1]) Ra_GE Ra_0)
	(Ra_0,Ra_Rev(h~[i1]))-->T478(Stat13,Stat18,Stat46*) ==> Stat47: Ra_0 Ra_GT Ra_Rev(h~[i1])
	(Ra_0,Ra_Rev(h~[i1]))-->T503(Stat13,Stat18,Stat47*) ==> Stat48: Ra_Rev(Ra_Rev(h~[i1])) Ra_GT Ra_Rev(Ra_0)
	(h~[i1])-->T494(Stat17*) ==> Stat49: Ra_Rev(Ra_Rev(h~[i1])) = h~[i1]
	EQUAL(Stat48,Stat49,Stat19) ==> Stat50: (h~[i1]) Ra_GT Ra_0
	(h~[i1])-->T529(Stat17,Stat50*) ==> Stat51: Ra_ABS(h~[i1]) = (h~[i1])
	EQUAL(Stat9,Stat51) ==> Stat52: (h~[i1]) Ra_GT eps0
	(h~[n0])-->T452(Stat17*) ==> Stat53: Ra_Rev(h~[n0]) in Ra
	(Ra_Rev(h~[n0]),Ra_0)-->T473(Stat40*) ==> Stat54: Ra_Rev(h~[n0]) Ra_GE Ra_0
	(h~[i1],eps0,Ra_Rev(h~[n0]),Ra_0)-->T505(Stat17,Stat4,Stat41,Stat13,Stat52,Stat54*) ==> Stat55: (h~[i1] Ra_PLUS Ra_Rev(h~[n0])) Ra_GT (eps0 Ra_PLUS Ra_0)
	EQUAL(Stat55,Stat21) ==> Stat56: ((h~[i1]) Ra_PLUS Ra_Rev(h~[n0])) Ra_GT eps0
	(h~[i1],Ra_Rev(h~[n0]))-->T445(Stat17,Stat41*) ==> Stat57: ((h~[i1]) Ra_PLUS Ra_Rev(h~[n0])) in Ra
	((h~[i1]) Ra_PLUS Ra_Rev(h~[n0]),eps0,Ra_0)-->T498(Stat57,Stat4,Stat13,Stat56*) ==> ((h~[i1]) Ra_PLUS Ra_Rev(h~[n0])) Ra_GT Ra_0
	((h~[i1]) Ra_PLUS Ra_Rev(h~[n0]))-->T529(Stat57*) ==> Ra_ABS((h~[i1]) Ra_PLUS Ra_Rev(h~[n0])) = ((h~[i1]) Ra_PLUS Ra_Rev(h~[n0]))
	Use_def(Ra_MINUS) ==> Stat58: Ra_ABS((h~[i1]) Ra_MINUS (h~[n0])) = Ra_ABS((h~[i1]) Ra_PLUS Ra_Rev(h~[n0]))
	EQUAL(Stat56) ==> Stat59: (Ra_ABS((h~[i1]) Ra_MINUS (h~[n0])) Ra_GT eps0) & (Ra_ABS((h~[i1]) Ra_MINUS (h~[n0])) in Ra)
	(i1,n0)-->Stat6(Stat8,Stat4*) ==> Stat60: eps0 Ra_GT Ra_ABS((h~[i1]) Ra_MINUS (h~[n0]))
(eps0,Ra_ABS((h~[i1]) Ra_MINUS (h~[n0])),eps0)-->T498(Stat59,Stat60,Stat4,Stat20*) ==> false; Discharge ==> QED
--
Theorem 599: [All terms of a Cauchy sequence not equivalent to zero have the same sign beyond a certain point] ((F in RaCauchy) &
	(not Ra_eqseq(F,Ra0Seq))) imp (EXISTS n in Za | shifted_seq(Ras_ABS(F),n) =
	if ((F~[n]) Ra_GE Ra_0) then shifted_seq(F,n) else shifted_seq(Ras_Rev(F),n) end if). Proof:
Suppose_not(h) ==> Stat1: ((h in RaCauchy) & (not Ra_eqseq(h,Ra0Seq))) & Stat2: (not(EXISTS n in Za | shifted_seq(Ras_ABS(h),n) =
	if ((h~[n]) Ra_GE Ra_0) then shifted_seq(h,n) else shifted_seq(Ras_Rev(h),n) end if))
	T539(*) ==> Stat3: h in RaSeq
--
-- Let the Cauchy sequence $h$ be a counterexample to our claim.
-- Then it is easily seen that $h$ cannot be equivalent to $Ra0Seq$; hence,
-- by Theorem 564, there exists a positive rational $eps0$ and an integer $n0$
-- beyond which all the components $h~[i]$ of $h$ have an absolute value greater than $eps0$
-- and all the components $h~[j], h~[i]$ of $h$ differ by less than $eps0$.
--
	h-->T564(*) ==> Stat4: (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
		(FORALL i in (Za - n) | Ra_ABS(h~[i]) Ra_GT eps) &
		(FORALL i in Za, j in Za | ((i notin n) & (j notin n)) imp (eps Ra_GT (Ra_ABS((h~[i]) Ra_MINUS (h~[j])))) ))
	(eps0,n0)-->Stat4(Stat4*) ==> Stat5: (eps0 in Ra) & (n0 in Za) & (eps0 Ra_GT Ra_0) &
		Stat6: (FORALL i in (Za - n0) | Ra_ABS(h~[i]) Ra_GT eps0) &
		Stat7: (FORALL i in Za, j in Za | ((i notin n0) & (j notin n0)) imp (eps0 Ra_GT (Ra_ABS((h~[i]) Ra_MINUS (h~[j])))) )
--
-- Our initial hypothesis now yields the existence of a component, say the $i1$-th,
-- beyond the $n0$-th component, whose absolute value does not comply in sign with
-- the $n0$-th component.
--
	n0-->Stat2(Stat5*) ==> Stat8: shifted_seq(Ras_ABS(h),n0) /=
		if ((h~[n0]) Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if
	(h,n0)-->T567(Stat1,Stat5*) ==> shifted_seq(h,n0) in RaCauchy
	(h,h)-->T556(Stat1,Stat1*) ==> Stat9: (Ras_Rev(h) in RaCauchy) & (Ras_ABS(h) in RaCauchy)
	(Ras_Rev(h),n0)-->T567(Stat9,Stat5*) ==> shifted_seq(Ras_Rev(h),n0) in RaCauchy
	(Ras_ABS(h),n0)-->T567(Stat9,Stat5*) ==> shifted_seq(Ras_ABS(h),n0) in RaCauchy
	T539(Stat8*) ==> Stat10: (shifted_seq(h,n0) in RaSeq) & (shifted_seq(Ras_Rev(h),n0) in RaSeq) &
		(shifted_seq(Ras_ABS(h),n0) in RaSeq) &
		((if ((h~[n0]) Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if) in RaSeq)
	(shifted_seq(Ras_ABS(h),n0),if ((h~[n0]) Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if)-->T542(Stat10,Stat8*) ==>
		Stat11: not(FORALL i in Za | ((shifted_seq(Ras_ABS(h),n0) in RaSeq) & ((if ((h~[n0]) Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if) in RaSeq) & (((shifted_seq(Ras_ABS(h),n0))~[i]) = ((if ((h~[n0]) Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if)~[i]))))
	i0-->Stat11(Stat10*) ==> Stat12: (i0 in Za) & (((shifted_seq(Ras_ABS(h),n0))~[i0]) /= (if ((h~[n0]) Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if)~[i0])
	Loc_def ==> Stat13: i1 = (n0 PLUS i0)
	(n0,i0)-->T283(Stat5,Stat12*) ==> (n0 PLUS i0) in Za
	(n0,i0)-->T292(Stat5*) ==> (n0 PLUS i0) notin n0
	(Stat13*)ELEM ==> Stat14: i1 in (Za - n0)
	i1-->Stat6(Stat14*) ==> Stat15: Ra_ABS(h~[i1]) Ra_GT eps0
	Suppose ==> Stat16: Ra_ABS(h~[i1]) = if ((h~[n0]) Ra_GE Ra_0) then (h~[i1]) else Ra_Rev(h~[i1]) end if
		APPLY() if_then_else(p->((h~[n0]) Ra_GE Ra_0),a->shifted_seq(h,n0),b->shifted_seq(Ras_Rev(h),n0),f(x)->(x~[i0])) ==> Stat17:
			((if ((h~[n0]) Ra_GE Ra_0) then shifted_seq(h,n0) else shifted_seq(Ras_Rev(h),n0) end if)~[i0]) = (if ((h~[n0]) Ra_GE Ra_0) then ((shifted_seq(h,n0))~[i0]) else ((shifted_seq(Ras_Rev(h),n0))~[i0]) end if)
		(h,n0,i0)-->T547(Stat3,Stat12,Stat5*) ==> ((shifted_seq(h,n0))~[i0]) = (h~[n0 PLUS i0])
		T539(Stat9*) ==> Stat18: (Ras_Rev(h) in RaSeq) & (Ras_ABS(h) in RaSeq)
		(Ras_Rev(h),n0,i0)-->T547(Stat18,Stat9,Stat12,Stat5*) ==> ((shifted_seq(Ras_Rev(h),n0))~[i0]) = ((Ras_Rev(h))~[n0 PLUS i0])
		(Ras_ABS(h),n0,i0)-->T547(Stat18,Stat9,Stat12,Stat5*) ==> ((shifted_seq(Ras_ABS(h),n0))~[i0]) = ((Ras_ABS(h))~[n0 PLUS i0])
		EQUAL(Stat12) ==> Stat19: ((Ras_ABS(h))~[i1]) /= (if ((h~[n0]) Ra_GE Ra_0) then (h~[i1]) else ((Ras_Rev(h))~[i1]) end if)
		(h,h,i1)-->T555(Stat3,Stat14*) ==> Stat20: (((Ras_ABS(h))~[i1]) = Ra_ABS(h~[i1])) & (((Ras_Rev(h))~[i1]) = Ra_Rev(h~[i1]))
	(Stat19,Stat20,Stat16*)ELEM ==> false; Discharge ==> Stat21: Ra_ABS(h~[i1]) /= if ((h~[n0]) Ra_GE Ra_0) then (h~[i1]) else Ra_Rev(h~[i1]) end if
--
-- Either $h~[n0]$ is positive, or it is negative. In the first case...
--
	n0-->Stat6(Stat5*) ==> Stat22: Ra_ABS(h~[n0]) Ra_GT eps0
	(h,n0)-->T540(Stat3,Stat5*) ==> Stat23: (h~[n0]) in Ra
	(h~[n0])-->T527(Stat23*) ==> Stat24: (Ra_ABS(h~[n0]) in Ra) & (Ra_ABS(h~[n0]) Ra_GE Ra_0)
	(h~[n0])-->T451(Stat23,Stat23*) ==> Stat25: Ra_0 in Ra
	(Ra_ABS(h~[n0]),eps0,Ra_0)-->T498(Stat24,Stat5,Stat25,Stat22*) ==> Ra_ABS(h~[n0]) Ra_GT Ra_0
	(Ra_ABS(h~[n0]),Ra_0)-->T473(Stat25*) ==> Stat26: Ra_ABS(h~[n0]) /= Ra_0
	T525(Stat25*) ==> Stat27: (FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0)))
	(h~[n0])-->Stat27(Stat23,Stat26*) ==> Stat28: (h~[n0]) /= Ra_0
	(h~[n0],Ra_0)-->T476(Stat23,Stat25,Stat28*) ==> ((h~[n0]) Ra_GT Ra_0) or (Ra_0 Ra_GT (h~[n0]))
	(h,i1)-->T540(Stat3,Stat14*) ==> Stat29: (h~[i1]) in Ra
	(h~[i1])-->T452(Stat29*) ==> Stat30: Ra_Rev(h~[i1]) in Ra
	T481(Stat30*) ==> Stat31: Ra_Rev(Ra_0) = Ra_0
	(eps0,eps0)-->T473(Stat31*) ==> Stat32: not(eps0 Ra_GT eps0)
	eps0-->T451(Stat5,Stat5*) ==> Stat33: eps0 = (eps0 Ra_PLUS Ra_0)
	Suppose ==> (h~[n0]) Ra_GT Ra_0
--
-- ... we reach a contradiction as follows. Observe that $Ra_ABS(h~[n0])$ equals $h~[n0]$, and
-- Stat21 yields that $Ra_ABS(h~[i1]) /= (h~[i1])$ in this case, and hence $h~[i1]$ is negative.
-- However, this conflicts with the fact that the distance between $h~[n0]$, which is bigger
-- than $eps0$, and $h~[i1]$ is smaller than $eps0$.
--
		(h~[n0],Ra_0)-->T473(Stat28*) ==> Stat34: (h~[n0]) Ra_GE Ra_0
		(h~[n0])-->T529(Stat23*) ==> Stat35: Ra_ABS(h~[n0]) = (h~[n0])
		(Stat34,Stat21*)ELEM ==> Stat36: Ra_ABS(h~[i1]) /= (h~[i1])
		(h~[i1])-->T528(Stat36,Stat29*) ==> Stat37: not((h~[i1]) Ra_GE Ra_0)
		(Ra_0,h~[i1])-->T478(Stat25,Stat29,Stat37*) ==> Stat38: Ra_0 Ra_GT (h~[i1])
		(Ra_0,h~[i1])-->T503(Stat38,Stat25,Stat29*) ==> Stat39: Ra_Rev(h~[i1]) Ra_GT Ra_Rev(Ra_0)
		EQUAL(Stat39,Stat31) ==> Stat40: Ra_Rev(h~[i1]) Ra_GT Ra_0
		EQUAL(Stat35,Stat22) ==> Stat41: (h~[n0]) Ra_GT eps0
		(h~[n0],eps0)-->T473(Stat41*) ==> Stat42: (h~[n0]) Ra_GE eps0
		(h~[n0],eps0,Ra_Rev(h~[i1]),Ra_0)-->T504(Stat23,Stat5,Stat30,Stat25,Stat42,Stat40*) ==>
			Stat43: ((h~[n0]) Ra_PLUS Ra_Rev(h~[i1])) Ra_GT (eps0 Ra_PLUS Ra_0)
		EQUAL(Stat43,Stat33) ==> Stat44: ((h~[n0]) Ra_PLUS Ra_Rev(h~[i1])) Ra_GT eps0
		(h~[n0],Ra_Rev(h~[i1]))-->T445(Stat23,Stat30*) ==> Stat45: ((h~[n0]) Ra_PLUS Ra_Rev(h~[i1])) in Ra
		((h~[n0]) Ra_PLUS Ra_Rev(h~[i1]),eps0,Ra_0)-->T498(Stat44,Stat45,Stat5,Stat25*) ==> ((h~[n0]) Ra_PLUS Ra_Rev(h~[i1])) Ra_GT Ra_0
		((h~[n0]) Ra_PLUS Ra_Rev(h~[i1]))-->T529(Stat45*) ==> Ra_ABS((h~[n0]) Ra_PLUS Ra_Rev(h~[i1])) = ((h~[n0]) Ra_PLUS Ra_Rev(h~[i1]))
		Use_def(Ra_MINUS) ==> (h~[n0]) Ra_MINUS (h~[i1]) = (h~[n0]) Ra_PLUS Ra_Rev(h~[i1])
		EQUAL(Stat44) ==> Stat46: (Ra_ABS((h~[n0]) Ra_MINUS (h~[i1])) in Ra) & (Ra_ABS((h~[n0]) Ra_MINUS (h~[i1])) Ra_GT eps0)
		(n0,i1)-->Stat7(Stat5,Stat14*) ==> Stat47: eps0 Ra_GT Ra_ABS((h~[n0]) Ra_MINUS (h~[i1]))
	(eps0,Ra_ABS((h~[n0]) Ra_MINUS (h~[i1])),eps0)-->T498(Stat5,Stat46,Stat47,Stat32*) ==> false; Discharge ==> Stat48: Ra_0 Ra_GT (h~[n0])
--
-- Hence $h~[n0]$ is negative; but then we reach again a contradiction,
-- leading to the desired overall conclusion, as follows. Observe that $Ra_ABS(h~[n0])$ equals
-- $Ra_Rev(h~[n0])$, and Stat21 yields that $Ra_ABS(h~[i1]) /= Ra_Rev(h~[i1])$ in this case,
-- and hence $h~[i1]$ is positive. However, this conflicts with the fact that the distance
-- between $h~[n0]$, which is smaller than $eps0$, and $h~[i1]$ is smaller than $eps0$.
--
	T525(Stat48*) ==> Stat49: (FORALL x | (x in Ra) imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
	(h~[n0])-->Stat49(Stat23,Stat23*) ==> Stat50: Ra_ABS(Ra_Rev(h~[n0])) = Ra_ABS(h~[n0])
	(Ra_0,h~[n0])-->T503(Stat48,Stat23,Stat25*) ==> Stat51: Ra_Rev(h~[n0]) Ra_GT Ra_Rev(Ra_0)
	EQUAL(Stat51,Stat31) ==> Stat52: Ra_Rev(h~[n0]) Ra_GT Ra_0
	(h~[n0])-->T452(Stat23,Stat23*) ==> Stat53: Ra_Rev(h~[n0]) in Ra
	(Ra_Rev(h~[n0]))-->T529(Stat50*) ==> Ra_ABS(h~[n0]) = Ra_Rev(h~[n0])
	Suppose ==> Stat54: (h~[n0]) Ra_GE Ra_0
		(Ra_0,h~[n0],Ra_0)-->T497(Stat25,Stat23,Stat48,Stat54*) ==> Ra_0 Ra_GT Ra_0
--	Use_def(Ra_GT)(Stat54*) ==> false; Discharge ==> Stat55: not((h~[n0]) Ra_GE Ra_0)
	(Ra_0,Ra_0)-->T473(Stat54*) ==> false; Discharge ==> Stat55: not((h~[n0]) Ra_GE Ra_0)
	(Stat21,Stat55*)ELEM ==> Stat56: Ra_ABS(h~[i1]) /= Ra_Rev(h~[i1])
	(h~[i1])-->Stat49(Stat29,Stat29*) ==> Stat57: Ra_ABS(Ra_Rev(h~[i1])) = Ra_ABS(h~[i1])
	(Ra_Rev(h~[i1]))-->T528(Stat56,Stat57,Stat30*) ==> Stat58: not(Ra_Rev(h~[i1]) Ra_GE Ra_0)
	(Ra_0,Ra_Rev(h~[i1]))-->T478(Stat25,Stat30,Stat58*) ==> Stat59: Ra_0 Ra_GT Ra_Rev(h~[i1])
	(Ra_0,Ra_Rev(h~[i1]))-->T503(Stat25,Stat30,Stat59*) ==> Stat60: Ra_Rev(Ra_Rev(h~[i1])) Ra_GT Ra_Rev(Ra_0)
	(h~[i1])-->T494(Stat29*) ==> Stat61: Ra_Rev(Ra_Rev(h~[i1])) = h~[i1]
	EQUAL(Stat60,Stat61,Stat31) ==> Stat62: (h~[i1]) Ra_GT Ra_0
	(h~[i1])-->T529(Stat29,Stat62*) ==> Stat63: Ra_ABS(h~[i1]) = (h~[i1])
	EQUAL(Stat15,Stat63) ==> Stat64: (h~[i1]) Ra_GT eps0
	(h~[n0])-->T452(Stat29*) ==> Stat65: Ra_Rev(h~[n0]) in Ra
	(Ra_Rev(h~[n0]),Ra_0)-->T473(Stat52*) ==> Stat66: Ra_Rev(h~[n0]) Ra_GE Ra_0
	(h~[i1],eps0,Ra_Rev(h~[n0]),Ra_0)-->T505(Stat29,Stat5,Stat53,Stat25,Stat64,Stat66*) ==> Stat67: (h~[i1] Ra_PLUS Ra_Rev(h~[n0])) Ra_GT (eps0 Ra_PLUS Ra_0)
	EQUAL(Stat67,Stat33) ==> Stat68: ((h~[i1]) Ra_PLUS Ra_Rev(h~[n0])) Ra_GT eps0
	(h~[i1],Ra_Rev(h~[n0]))-->T445(Stat29,Stat53*) ==> Stat69: ((h~[i1]) Ra_PLUS Ra_Rev(h~[n0])) in Ra
	((h~[i1]) Ra_PLUS Ra_Rev(h~[n0]),eps0,Ra_0)-->T498(Stat69,Stat5,Stat25,Stat68*) ==> ((h~[i1]) Ra_PLUS Ra_Rev(h~[n0])) Ra_GT Ra_0
	((h~[i1]) Ra_PLUS Ra_Rev(h~[n0]))-->T529(Stat69*) ==> Ra_ABS((h~[i1]) Ra_PLUS Ra_Rev(h~[n0])) = ((h~[i1]) Ra_PLUS Ra_Rev(h~[n0]))
	Use_def(Ra_MINUS) ==> Stat70: Ra_ABS((h~[i1]) Ra_MINUS (h~[n0])) = Ra_ABS((h~[i1]) Ra_PLUS Ra_Rev(h~[n0]))
	EQUAL(Stat68) ==> Stat71: (Ra_ABS((h~[i1]) Ra_MINUS (h~[n0])) Ra_GT eps0) & (Ra_ABS((h~[i1]) Ra_MINUS (h~[n0])) in Ra)
	(i1,n0)-->Stat7(Stat14,Stat5*) ==> Stat72: eps0 Ra_GT Ra_ABS((h~[i1]) Ra_MINUS (h~[n0]))
(eps0,Ra_ABS((h~[i1]) Ra_MINUS (h~[n0])),eps0)-->T498(Stat71,Stat72,Stat5,Stat32*) ==> false; Discharge ==> QED
--
--
--
Theorem 600: [A rational Cauchy sequence is equivalent to zero iff both it and its additive inverse are equivalent to its absolute value] (F in RaCauchy) imp (Ra_eqseq(F,Ra0Seq) eq (Ra_eqseq(Ras_ABS(F),F) & Ra_eqseq(Ras_ABS(F),Ras_Rev(F)))). Proof:
Suppose_not(h) ==> AUTO
--
-- Let the Cauchy sequence $h$ be a counterexample to our claim, so that
-- $h$ and its pointwise negative and its pointwise absolute values are
-- sequences of rational numbers.
--
	T545(*) ==> Stat1: (Ra0Seq in RaCauchy) & (h in RaCauchy)
	(h,h)-->T556(Stat1*) ==> Stat2: (Ras_ABS(h) in RaCauchy) & (Ras_Rev(h) in RaCauchy)
	T539(Stat1*) ==> Stat3: (Ras_ABS(h) in RaSeq) & (Ras_Rev(h) in RaSeq) & (Ra0Seq in RaSeq) & (h in RaSeq)
	h-->T546(Stat3*) ==> Stat4: (domain(h) = Za) & Svm(h) & (range(h) incin Ra) & Ra_eqseq(h,h)
--
-- Then it is easily seen that $h$ cannot be equivalent to $Ra0Seq$.
--
	Suppose ==> Ra_eqseq(h,Ra0Seq)
		ELEM ==> Stat5: not((Ra_eqseq(Ras_ABS(h),h) & Ra_eqseq(Ras_ABS(h),Ras_Rev(h))))
		h-->T597(*) ==> Ra_eqseq(Ras_ABS(h),Ra0Seq) & Ra_eqseq(Ras_Rev(h),Ra0Seq)
		Ra0Seq-->T546(*) ==> Ra_eqseq(Ra0Seq,Ra0Seq)
		(h,Ra0Seq,Ra0Seq)-->T553(*) ==> Ra_eqseq(Ra0Seq,h)
		(Ras_ABS(h),Ra0Seq,h)-->T553(*) ==> Stat6: Ra_eqseq(h,Ras_ABS(h))
		(h,h,Ras_ABS(h))-->T553(Stat3,Stat4,Stat6,Stat5*) ==> (not Ra_eqseq(Ras_ABS(h),Ras_Rev(h)))
		(Ras_ABS(h),Ra0Seq,Ra0Seq)-->T553(Stat1*) ==> Ra_eqseq(Ra0Seq,Ras_ABS(h))
	(Ras_Rev(h),Ra0Seq,Ras_ABS(h))-->T553(Stat1*) ==> false; Discharge ==> Stat7: (h in RaCauchy) & (not Ra_eqseq(h,Ra0Seq)) & Ra_eqseq(Ras_ABS(h),h) & Ra_eqseq(Ras_ABS(h),Ras_Rev(h))
--
-- Hence it must be the reverse implication which fails.
-- By Theorem 564 there exists a positive rational $eps0$ and an integer $n0$
-- beyond which all the components $h~[i]$ of $h$ have an absolute value greater than $eps0$
-- and all the components $h~[j], h~[i]$ of $h$ differ by less than $eps0$.
-- By the transitivity of equivalence between
-- infinite rational sequences, we have that $shifted_seq(Ras_Rev(h),n0)$ and $shifted_seq(h,n0)$
-- are equivalent; therefore the set of subscripts for which the distance between the
-- corresponding components of these two sequences exceeds $eps0 Ra_PLUS eps0$ is finite.
--
	h-->T564(*) ==> Stat8: (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
		(FORALL i in (Za - n) | Ra_ABS(h~[i]) Ra_GT eps) &
		(FORALL i in Za, j in Za | ((i notin n) & (j notin n)) imp (eps Ra_GT (Ra_ABS((h~[i]) Ra_MINUS (h~[j])))) ))
	(eps0,n0)-->Stat8(Stat8*) ==> Stat9: (eps0 in Ra) & (n0 in Za) & (eps0 Ra_GT Ra_0) &
		Stat10: (FORALL i in (Za - n0) | Ra_ABS(h~[i]) Ra_GT eps0)
	(h,n0)-->T567(Stat1,Stat9*) ==> Stat11: (shifted_seq(h,n0) in RaCauchy) & Ra_eqseq(h,shifted_seq(h,n0))
	(Ras_Rev(h),n0)-->T567(Stat2,Stat9*) ==> Stat12: (shifted_seq(Ras_Rev(h),n0) in RaCauchy) & Ra_eqseq(Ras_Rev(h),shifted_seq(Ras_Rev(h),n0))
	T539(Stat7*) ==> Stat13: (shifted_seq(h,n0) in RaSeq) & (shifted_seq(Ras_Rev(h),n0) in RaSeq)
	(Ras_ABS(h),h,shifted_seq(h,n0))-->T553(Stat7,Stat11,Stat3,Stat13*) ==> Stat14: Ra_eqseq(shifted_seq(h,n0),Ras_ABS(h))
	(Ras_ABS(h),Ras_Rev(h),shifted_seq(Ras_Rev(h),n0))-->T553(Stat7,Stat12,Stat3,Stat13*) ==> Stat15: Ra_eqseq(shifted_seq(Ras_Rev(h),n0),Ras_ABS(h))
	(Ras_ABS(h))-->T546(Stat3*) ==> Stat16: Ra_eqseq(Ras_ABS(h),Ras_ABS(h))
	(shifted_seq(Ras_Rev(h),n0),Ras_ABS(h),Ras_ABS(h))-->T553(Stat15,Stat16,Stat13,Stat3*) ==> Stat17: Ra_eqseq(Ras_ABS(h),shifted_seq(Ras_Rev(h),n0))
	(shifted_seq(h,n0),Ras_ABS(h),shifted_seq(Ras_Rev(h),n0))-->T553(Stat14,Stat17,Stat13,Stat3*) ==> Stat18: Ra_eqseq(shifted_seq(Ras_Rev(h),n0),shifted_seq(h,n0))
	(shifted_seq(Ras_Rev(h),n0),shifted_seq(h,n0))-->T541(Stat13,Stat18*) ==> Stat19: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp Finite({x : x in Za | Ra_ABS(((shifted_seq(Ras_Rev(h),n0))~[x]) Ra_MINUS ((shifted_seq(h,n0))~[x])) Ra_GT eps}))
	Ra_0-->T451(Stat18*) ==> Stat20: (Ra_0 in Ra) & (Ra_0 = (Ra_0 Ra_PLUS Ra_0))
	(eps0,eps0)-->T445(Stat9,Stat9*)==> Stat21: (eps0 Ra_PLUS eps0) in Ra
	(eps0,Ra_0)-->T473(Stat9,Stat9*) ==> Stat22: eps0 Ra_GE Ra_0
	(eps0,Ra_0,eps0,Ra_0)-->T504(Stat9,Stat20,Stat22*) ==> (eps0 Ra_PLUS eps0) Ra_GT (Ra_0 Ra_PLUS Ra_0)
	EQUAL(Stat20*) ==> Stat23: (eps0 Ra_PLUS eps0) Ra_GT Ra_0
	(eps0 Ra_PLUS eps0)-->Stat19(Stat21,Stat23*) ==> Finite({x : x in Za | Ra_ABS(((shifted_seq(Ras_Rev(h),n0))~[x]) Ra_MINUS ((shifted_seq(h,n0))~[x])) Ra_GT (eps0 Ra_PLUS eps0)})
--
-- However, it is easy to see that $(shifted_seq(h,n0))~[i]$ and
-- $(shifted_seq(Ras_Rev(h),n0))~[i]$ have, for all $i in Za$, opposite signs and the same
-- absolute value, so that one of the two equals $Ra_ABS((shifted_seq(h,n0))~[i])$ and the other
-- equals the negative of this value; accordingly, the distance between them is twice
-- $Ra_ABS((shifted_seq(h,n0))~[i])$, a value exceeding $eps0 Ra_PLUS eps0$. Hence the set
--	${x : x in Za | Ra_ABS(((shifted_seq(Ras_Rev(h),n0))~[x]) Ra_MINUS ((shifted_seq(h,n0))~[x])) Ra_GT (eps0 Ra_PLUS eps0)}$,
-- which includes $Za$, cannot be finite, a contradiction leading to the desired overall
-- conclusion of this proof.
--
	Suppose ==> Stat24: not({i: i in Za | true} incin {i : i in Za | Ra_ABS(((shifted_seq(Ras_Rev(h),n0))~[i]) Ra_MINUS ((shifted_seq(h,n0))~[i])) Ra_GT (eps0 Ra_PLUS eps0)})
		i1-->Stat24(Stat24*) ==> Stat25: (i1 in Za) & (not (Ra_ABS(((shifted_seq(Ras_Rev(h),n0))~[i1]) Ra_MINUS ((shifted_seq(h,n0))~[i1])) Ra_GT (eps0 Ra_PLUS eps0)))
		Use_def(shifted_seq)(Stat24*) ==> (not (Ra_ABS(((Ras_Rev(h) @ Shift(n0))~[i1]) Ra_MINUS ((h @ Shift(n0))~[i1])) Ra_GT (eps0 Ra_PLUS eps0)))
		(n0,i1)-->T339(Stat9,Stat25*) ==> Stat26: Svm(Shift(n0)) & (domain(Shift(n0)) = Za) & (range(Shift(n0)) incin Za) & ((Shift(n0)~[i1]) = (n0 PLUS i1))
		(h,Shift(n0),i1)-->T129(Stat4,Stat26,Stat25*) ==> ((h @ Shift(n0))~[i1]) = (h~[Shift(n0)~[i1]])
		(Ras_Rev(h))-->T546(Stat3,Stat3*) ==> Stat27: (domain(Ras_Rev(h)) = Za) & Svm(Ras_Rev(h)) & (range(Ras_Rev(h)) incin Ra) & Ra_eqseq(Ras_Rev(h),Ras_Rev(h))
		(Ras_Rev(h),Shift(n0),i1)-->T129(Stat27,Stat26,Stat25*) ==> ((Ras_Rev(h) @ Shift(n0))~[i1]) = (Ras_Rev(h)~[Shift(n0)~[i1]])
		(n0,i1)-->T283(Stat9,Stat25*) ==> Stat28: (n0 PLUS i1) in Za
		(h,h,n0 PLUS i1)-->T555(Stat3,Stat28*) ==> (Ras_Rev(h)~[n0 PLUS i1]) = Ra_Rev(h~[n0 PLUS i1])
		EQUAL(Stat25*) ==> Stat29: (not (Ra_ABS(Ra_Rev(h~[n0 PLUS i1]) Ra_MINUS (h~[n0 PLUS i1])) Ra_GT (eps0 Ra_PLUS eps0)))
		(h,n0 PLUS i1)-->T540(Stat3,Stat28*) ==> Stat30: (h~[n0 PLUS i1]) in Ra
		(h~[n0 PLUS i1])-->T452(Stat29*) ==> Stat31: Ra_Rev(h~[n0 PLUS i1]) in Ra
		T525(Stat29*) ==> Stat32: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
--
-- Entering into greater detail, let us observe that for each $i1 in Za$
--	$Ra_ABS(Ra_Rev(h~[n0 PLUS i1]) Ra_MINUS (h~[n0 PLUS i1]))$
-- equals the absolute value of twice $Ra_ABS(h~[n0 PLUS i1])$, independently of
-- whether $Ra_ABS(h~[n0 PLUS i1])$ equals $h~[n0 PLUS i1]$ or it equals
-- the opposite of $h~[n0 PLUS i1]$. Since $Ra_ABS(h~[n0 PLUS i1])$ is nonnegative,
-- the same holds for its double, and therefore the absolute value of twice
-- $Ra_ABS(h~[n0 PLUS i1])$ equals twice $Ra_ABS(h~[n0 PLUS i1])$. This value
-- must be more than twice bigger than $eps0$.
--
		Suppose ==> Ra_ABS(Ra_Rev(h~[n0 PLUS i1]) Ra_MINUS (h~[n0 PLUS i1])) /= Ra_ABS(Ra_ABS(h~[n0 PLUS i1]) Ra_PLUS Ra_ABS(h~[n0 PLUS i1]))
			(h~[n0 PLUS i1])-->Stat32(Stat32,Stat32*) ==> (Ra_ABS(h~[n0 PLUS i1]) = (h~[n0 PLUS i1])) or (Ra_ABS(h~[n0 PLUS i1]) = Ra_Rev(h~[n0 PLUS i1]))
			Suppose ==> Ra_ABS(h~[n0 PLUS i1]) = (h~[n0 PLUS i1])
				(h~[n0 PLUS i1],Ra_Rev(h~[n0 PLUS i1]))-->T537(Stat30,Stat31*) ==>
					Ra_ABS(Ra_Rev(h~[n0 PLUS i1]) Ra_MINUS (h~[n0 PLUS i1])) = Ra_ABS((h~[n0 PLUS i1]) Ra_MINUS Ra_Rev(h~[n0 PLUS i1]))
				Use_def(Ra_MINUS)(Stat32*) ==> Ra_ABS((h~[n0 PLUS i1]) Ra_MINUS Ra_Rev(h~[n0 PLUS i1])) = Ra_ABS((h~[n0 PLUS i1]) Ra_PLUS Ra_Rev(Ra_Rev(h~[n0 PLUS i1])))
				(h~[n0 PLUS i1])-->T494(Stat30,Stat30*) ==> Ra_Rev(Ra_Rev(h~[n0 PLUS i1])) = (h~[n0 PLUS i1])
			EQUAL(Stat32*) ==> false; Discharge ==> Ra_ABS(h~[n0 PLUS i1]) = Ra_Rev(h~[n0 PLUS i1])
			Use_def(Ra_MINUS)(Stat32*) ==> (Ra_Rev(h~[n0 PLUS i1]) Ra_MINUS (h~[n0 PLUS i1])) = (Ra_Rev(h~[n0 PLUS i1]) Ra_PLUS Ra_Rev(h~[n0 PLUS i1]))
		EQUAL(Stat32*) ==> false; Discharge ==> Ra_ABS(Ra_Rev(h~[n0 PLUS i1]) Ra_MINUS (h~[n0 PLUS i1])) = Ra_ABS(Ra_ABS(h~[n0 PLUS i1]) Ra_PLUS Ra_ABS(h~[n0 PLUS i1]))
		(h~[n0 PLUS i1])-->T527(Stat30,Stat30*) ==> Stat33: (Ra_ABS(h~[n0 PLUS i1]) in Ra) & (Ra_ABS(h~[n0 PLUS i1]) Ra_GE Ra_0)
		(Ra_ABS(h~[n0 PLUS i1]),Ra_0,Ra_ABS(h~[n0 PLUS i1]),Ra_0)-->T493(Stat33,Stat20*) ==> Stat34: (Ra_ABS(h~[n0 PLUS i1]) Ra_PLUS Ra_ABS(h~[n0 PLUS i1])) Ra_GE (Ra_0 Ra_PLUS Ra_0)
		EQUAL(Stat20,Stat34*) ==> (Ra_ABS(h~[n0 PLUS i1]) Ra_PLUS Ra_ABS(h~[n0 PLUS i1])) Ra_GE Ra_0
		(Ra_ABS(h~[n0 PLUS i1]),Ra_ABS(h~[n0 PLUS i1]))-->T445(Stat33*) ==> (Ra_ABS(h~[n0 PLUS i1]) Ra_PLUS Ra_ABS(h~[n0 PLUS i1])) in Ra
		(Ra_ABS(h~[n0 PLUS i1]) Ra_PLUS Ra_ABS(h~[n0 PLUS i1]))-->T528(Stat34*) ==> Ra_ABS(Ra_ABS(h~[n0 PLUS i1]) Ra_PLUS Ra_ABS(h~[n0 PLUS i1])) = (Ra_ABS(h~[n0 PLUS i1]) Ra_PLUS Ra_ABS(h~[n0 PLUS i1]))
		EQUAL(Stat29*) ==> Stat35: (not ((Ra_ABS(h~[n0 PLUS i1]) Ra_PLUS Ra_ABS(h~[n0 PLUS i1])) Ra_GT (eps0 Ra_PLUS eps0)))
		(n0,i1)-->T292(Stat9*) ==> Stat36: (n0 PLUS i1) notin n0
		(n0 PLUS i1)-->Stat10(Stat28,Stat36*) ==> Stat37: Ra_ABS(h~[n0 PLUS i1]) Ra_GT eps0
		(Ra_ABS(h~[n0 PLUS i1]),eps0)-->T473(Stat37*) ==> Stat38: Ra_ABS(h~[n0 PLUS i1]) Ra_GE eps0
	(Ra_ABS(h~[n0 PLUS i1]),eps0,Ra_ABS(h~[n0 PLUS i1]),eps0)-->T504(Stat37,Stat38,Stat9,Stat35,Stat33*) ==> false; Discharge ==> AUTO
	T206(Stat23*) ==> (not Finite(Za))
	({i : i in Za | Ra_ABS(((shifted_seq(Ras_Rev(h),n0))~[i]) Ra_MINUS ((shifted_seq(h,n0))~[i])) Ra_GT (eps0 Ra_PLUS eps0)},Za)-->T189(Stat23*) ==> false; Discharge ==> QED
--
--
--
Theorem 601: [One of a Cauchy sequence and its additive inverse is always equivalent to a non-negative sequence] ((F in RaCauchy) & (not Ra_eqseq(F,Ra0Seq))) imp
	(EXISTS n in Za | ((shifted_seq(Ras_ABS(F),n) = shifted_seq(F,n)) & Ra_eqseq(Ras_ABS(F),F)) or
			((shifted_seq(Ras_ABS(F),n) = shifted_seq(Ras_Rev(F),n)) & Ra_eqseq(Ras_ABS(F),Ras_Rev(F)))). Proof:
Suppose_not(h) ==> AUTO
--
-- Let the Cauchy sequence $h$ be a counterexample to our claim, so that
-- $h$ and its pointwise negative and its pointwise absolute values are
-- sequences of rational numbers.
--
	(h,h)-->T556(*) ==> Stat1: (h in RaCauchy) & (Ras_ABS(h) in RaCauchy) & (Ras_Rev(h) in RaCauchy)
	T539(*) ==> Stat2: (Ras_ABS(h) in RaSeq) & (Ras_Rev(h) in RaSeq) & (h in RaSeq)
	h-->T546(Stat2*) ==> Stat3: (domain(h) = Za) & Svm(h) & (range(h) incin Ra) & Ra_eqseq(h,h)
	(Ras_Rev(h))-->T546(Stat2,Stat2*) ==> Stat4: (domain(Ras_Rev(h)) = Za) & Svm(Ras_Rev(h)) & (range(Ras_Rev(h)) incin Ra) & Ra_eqseq(Ras_Rev(h),Ras_Rev(h))
	ELEM ==> Stat5: (not(EXISTS n in Za | ((shifted_seq(Ras_ABS(h),n) = shifted_seq(h,n)) & Ra_eqseq(Ras_ABS(h),h)) or
			((shifted_seq(Ras_ABS(h),n) = shifted_seq(Ras_Rev(h),n)) & Ra_eqseq(Ras_ABS(h),Ras_Rev(h)))))
--
-- By Theorem 599, for a suitably chosen unsigned integer $n1$ we have either
--	$shifted_seq(Ras_ABS(F),n1) = shifted_seq(F,n1)$,
-- hence $Ra_eqseq(shifted_seq(Ras_ABS(F),n1),shifted_seq(F,n1))$,
-- or
--	$shifted_seq(Ras_ABS(F),n1) = shifted_seq(Ras_Rev(F),n1)$,
-- and hence $Ra_eqseq(shifted_seq(Ras_ABS(F),n1),shifted_seq(Ras_Rev(F),n1))$.
--
	h-->T599(*) ==> Stat6:  (EXISTS n in Za | shifted_seq(Ras_ABS(h),n) =
			if ((h~[n]) Ra_GE Ra_0) then shifted_seq(h,n) else shifted_seq(Ras_Rev(h),n) end if)
	n1-->Stat6(Stat6*) ==> Stat7: (n1 in Za) & ((shifted_seq(Ras_ABS(h),n1) = shifted_seq(h,n1)) or
			(shifted_seq(Ras_ABS(h),n1) = shifted_seq(Ras_Rev(h),n1)))
	(h,n1)-->T567(Stat7,Stat1*) ==> Stat8:
			(shifted_seq(h,n1) in RaCauchy) & Ra_eqseq(h,shifted_seq(h,n1))
	(Ras_ABS(h),n1)-->T567(Stat7,Stat1*) ==> Stat9:
			(shifted_seq(Ras_ABS(h),n1) in RaCauchy) & Ra_eqseq(Ras_ABS(h),shifted_seq(Ras_ABS(h),n1))
	T539(Stat8*) ==> Stat10: (shifted_seq(h,n1) in RaSeq) & (shifted_seq(Ras_ABS(h),n1) in RaSeq)
	(shifted_seq(Ras_ABS(h),n1))-->T546(Stat10*) ==> Stat11: Ra_eqseq(shifted_seq(Ras_ABS(h),n1),shifted_seq(Ras_ABS(h),n1))
--
-- It is easily seen that $Ra_eqseq(Ras_ABS(h),h)$ in the first of these cases,
-- and $Ra_eqseq(Ras_ABS(h),Ras_Rev(h))$ in the second,
-- a contradiction proving the first claim of our theorem.
--
	Suppose ==> shifted_seq(Ras_ABS(h),n1) = shifted_seq(h,n1)
		EQUAL(Stat11*) ==> Stat12: Ra_eqseq(shifted_seq(h,n1),shifted_seq(Ras_ABS(h),n1))
		(h,shifted_seq(h,n1),shifted_seq(Ras_ABS(h),n1))-->T553(Stat8,Stat12,Stat2,Stat10*) ==> Stat13: Ra_eqseq(shifted_seq(Ras_ABS(h),n1),h)
		(Ras_ABS(h),shifted_seq(Ras_ABS(h),n1),h)-->T553(Stat9,Stat13,Stat10,Stat2*) ==> Stat14: Ra_eqseq(h,Ras_ABS(h))
		(h,h,Ras_ABS(h))-->T553(Stat3,Stat14,Stat2,Stat5*) ==> Ra_eqseq(Ras_ABS(h),h)
	n1-->Stat5(Stat7*) ==> false; Discharge ==> shifted_seq(Ras_ABS(h),n1) = shifted_seq(Ras_Rev(h),n1)
	EQUAL(Stat11*) ==> Stat15: Ra_eqseq(shifted_seq(Ras_Rev(h),n1),shifted_seq(Ras_ABS(h),n1))
	(Ras_Rev(h),n1)-->T567(Stat7,Stat1*) ==> Stat16:
		(shifted_seq(Ras_Rev(h),n1) in RaCauchy) & Ra_eqseq(Ras_Rev(h),shifted_seq(Ras_Rev(h),n1))
	T539(Stat16*) ==> Stat17: shifted_seq(Ras_Rev(h),n1) in RaSeq
	(Ras_Rev(h),shifted_seq(Ras_Rev(h),n1),shifted_seq(Ras_ABS(h),n1))-->T553(Stat16,Stat15,Stat2,Stat17,Stat10*) ==>
		Stat18: Ra_eqseq(shifted_seq(Ras_ABS(h),n1),Ras_Rev(h))
	(Ras_ABS(h),shifted_seq(Ras_ABS(h),n1),Ras_Rev(h))-->T553(Stat9,Stat18,Stat10,Stat2*) ==> Stat19: Ra_eqseq(Ras_Rev(h),Ras_ABS(h))
	(Ras_Rev(h),Ras_Rev(h),Ras_ABS(h))-->T553(Stat4,Stat19,Stat2,Stat5*) ==> Ra_eqseq(Ras_ABS(h),Ras_Rev(h))
	n1-->Stat5(Stat7*) ==> false; Discharge ==> QED
--
--
--
Theorem 602: [One of a Cauchy sequence $F$ and its additive inverse is always equivalent to a non-negative sequence, and both are equivalent to non-negative sequences only if $F$ is equivalent to zero] (F in RaCauchy) imp ((Ra_eqseq(Ras_ABS(F),F) or Ra_eqseq(Ras_ABS(F),Ras_Rev(F))) & (((Ra_eqseq(Ras_ABS(F),F) & Ra_eqseq(Ras_ABS(F),Ras_Rev(F)))) imp Ra_eqseq(F,Ra0Seq))). Proof:
Suppose_not(h) ==> AUTO
--
-- Let the Cauchy sequence $h$ be a counterexample to our claim, so that
-- $h$ and its pointwise negative and its pointwise absolute values are
-- sequences of rational numbers. Thanks to Theorem 600, we know that it
-- is our first assertion that fails. But then, by Theorem 601, we get a contradiction.
--
	(h,h)-->T556(*) ==> Stat1: (Ras_ABS(h) in RaCauchy) & (Ras_Rev(h) in RaCauchy)
	T539(*) ==> Stat2: (Ras_ABS(h) in RaSeq) & (Ras_Rev(h) in RaSeq) & (h in RaSeq)
	h-->T546(Stat2*) ==> Stat3: (domain(h) = Za) & Svm(h) & (range(h) incin Ra) & Ra_eqseq(h,h)
	(Ras_Rev(h))-->T546(Stat2,Stat2*) ==> Stat4: (domain(Ras_Rev(h)) = Za) & Svm(Ras_Rev(h)) & (range(Ras_Rev(h)) incin Ra) & Ra_eqseq(Ras_Rev(h),Ras_Rev(h))
	h-->T600(*) ==> Stat5: (not(Ra_eqseq(Ras_ABS(h),h) or Ra_eqseq(Ras_ABS(h),Ras_Rev(h)))) & (h in RaCauchy) & (not Ra_eqseq(h,Ra0Seq))
	h-->T601(Stat5*) ==> Stat6: (EXISTS n in Za | ((shifted_seq(Ras_ABS(h),n) = shifted_seq(h,n)) & Ra_eqseq(Ras_ABS(h),h)) or
			((shifted_seq(Ras_ABS(h),n) = shifted_seq(Ras_Rev(h),n)) & Ra_eqseq(Ras_ABS(h),Ras_Rev(h))))
	n-->Stat6(Stat5*) ==> false; Discharge ==> QED
--
--
--
Theorem 603: [The unit Cauchy sequences $Ra0Seq,Ra1Seq$ differ from one another] (not Ra_eqseq(Ra0Seq,Ra1Seq)). Proof:
Suppose_not ==> AUTO
	T545(Stat1*) ==> Stat1: {Ra0Seq,Ra1Seq} incin RaCauchy
	T539(Stat1*) ==> (Ra0Seq in RaSeq) & (Ra1Seq in RaSeq)
	(Ra0Seq,Ra1Seq)-->T541(*) ==> Stat2: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in Za | Ra_ABS((Ra0Seq~[x]) Ra_MINUS (Ra1Seq~[x])) Ra_GT eps}))
	Ra_1-->T451 ==> (Ra_1 in Ra) & (Ra_0 in Ra) & (Ra_1 = (Ra_1 Ra_PLUS Ra_0))
	T481 ==> (Ra_1 Ra_GT Ra_0) & (Ra_Rev(Ra_0) = Ra_0) & (Ra_1 = (Ra_1 Ra_PLUS Ra_0))
	Ra_1-->T522 ==> Stat3: (EXISTS e in Ra, e0 in Ra | (Ra_1 Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e Ra_GT Ra_0) & (Ra_1 Ra_GT (e Ra_PLUS e0)))
	(eps0,e0)-->Stat3 ==> (eps0 in Ra) & (Ra_1 Ra_GT eps0) & (eps0 Ra_GT Ra_0)
	eps0-->Stat2(Stat2*) ==> Stat4: Finite({x : x in Za | Ra_ABS((Ra0Seq~[x]) Ra_MINUS (Ra1Seq~[x])) Ra_GT eps0})
	T206(Stat4) ==> not Finite({x : x in Za})
	EQUAL(Stat4) ==> Stat5: {x : x in Za | Ra_ABS((Ra0Seq~[x]) Ra_MINUS (Ra1Seq~[x])) Ra_GT eps0} /= {x : x in Za}
	x-->Stat5(Stat5*) ==> (x in Za) & (not(Ra_ABS((Ra0Seq~[x]) Ra_MINUS (Ra1Seq~[x])) Ra_GT eps0))
	x-->T548 ==> ((Ra0Seq~[x]) = Ra_0) & ((Ra1Seq~[x]) = Ra_1)
	(Ra_0,Ra_1)-->T537(Stat2*) ==> Ra_ABS(Ra_0 Ra_MINUS Ra_1) = Ra_ABS(Ra_1 Ra_MINUS Ra_0)
	EQUAL(Stat5) ==> not(Ra_ABS(Ra_1 Ra_MINUS Ra_0) Ra_GT eps0)
	Use_def(Ra_MINUS) ==> not(Ra_ABS(Ra_1 Ra_PLUS Ra_Rev(Ra_0)) Ra_GT eps0)
        T465(Stat6) ==> Stat6: Ra_is_nonneg(Ra_1)
        T525(Stat6) ==> Stat7: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
        Ra_1-->Stat7 ==> Ra_ABS(Ra_1) = Ra_1
	EQUAL(Stat2) ==> not(Ra_1 Ra_GT eps0)
(Stat3*)Discharge ==> QED
--
--
--
Theorem 604: [A rational sequence F and its additive inverse have the same absolute value] (F in RaSeq) imp (Ras_ABS(Ras_Rev(F)) = Ras_ABS(F)). Proof:
	Suppose_not(f) ==>AUTO
	(Ras_ABS(Ras_Rev(f)),Ras_ABS(f))-->T542 ==> Stat1: AUTO
	n-->Stat1 ==> AUTO
    (f,f,n)-->T555 ==> (Ras_Rev(f) in RaSeq) & (Ras_ABS(f) in RaSeq) & (f~[n] in Ra) & (Ras_Rev(f)~[n] = Ra_Rev(f~[n])) & (Ras_ABS(f)~[n] = Ra_ABS(f~[n]))
    (Ras_Rev(f),Ras_Rev(f),n)-->T555 ==> (Ras_ABS(Ras_Rev(f)) in RaSeq) & (Ras_ABS(Ras_Rev(f))~[n] = Ra_ABS(Ras_Rev(f)~[n]))
    EQUAL ==> Ra_ABS(Ra_Rev(f~[n])) /= Ra_ABS(f~[n])
    T525 ==> Stat2: (FORALL x | (x in Ra) imp (Ra_ABS(Ra_Rev(x)) = Ra_ABS(x)))
	(f~[n])-->Stat2 ==> false; Discharge ==> QED
--
--
-- It is easily seen that the zero and unit rational sequences play their proper algebraic roles.
--
Theorem 605: (F in RaSeq) imp (((F Ras_PLUS Ra0Seq) = F) & ((F Ras_TIMES Ra1Seq) = F)). Proof:
    Suppose_not(f) ==> Stat1: (f in RaSeq) & (((f Ras_PLUS Ra0Seq) /= f) or ((f Ras_TIMES Ra1Seq) /= f))
--
-- Indeed, if we assume the contrary, either the zero rational sequence does not behave
-- as additive unit element among rational sequences, or the unit rational does not
-- behave as multiplicative unit element. Either alternative will lead to a contradiction,
-- and the two proofs will closely resemble each other.
--
	Use_def(RaSeq) ==> Stat2: f in {f incin (Za PROD Ra) | (domain(f) = Za) & Svm(f)}
	()-->Stat2 ==> (domain(f) = Za) & Svm(f)
	f-->T72 ==> f = {[i,f~[i]]: i in domain(f)}
	T545 ==> {Ra0Seq,Ra1Seq} incin RaCauchy
	T539(*) ==> (Ra0Seq in RaSeq) & (Ra1Seq in RaSeq)
--
-- Assume first that $Ra0Seq$ does not behave as additive unit element.
--
        Suppose ==> Stat3: (f Ras_PLUS Ra0Seq) /= f
--
-- By the pointwise definition of $Ras_PLUS$, the sequence $f Ras_PLUS Ra0Seq$ associates
-- the rational value $(f~[u]) Ra_PLUS (Ra0Seq~[u])$ with each unsigned integer $u$.
--
            (f,Ra0Seq)-->T554 ==> (f Ras_PLUS Ra0Seq) = {[u,((f~[u]) Ra_PLUS (Ra0Seq~[u]))]: u in Za}
--
-- On the other hand, $Ra0Seq~[u]$ has value $Ra_0$ for all unsigned integers $u$; therefore,
-- since $Ra_0$ behaves as additive unit element among rational numbers, $(f~[u]) Ra_PLUS (Ra0Seq~[u])$
-- always carries the value $f~[u]$. Accordingly the sequence $f Ras_PLUS Ra0Seq$, whose values coincide
-- with those of $f$ over the common domain $Za$, must coincide with $f$.
--
            d-->Stat3 ==> (d in {[u,((f~[u]) Ra_PLUS (Ra0Seq~[u]))]: u in Za}) eq (d notin f)
            Suppose ==> Stat4: (d notin {[i,f~[i]]: i in domain(f)}) & Stat5: (d in {[u,((f~[u]) Ra_PLUS (Ra0Seq~[u]))]: u in Za})
                i0-->Stat5 ==> Stat6: (i0 in Za) & (d = [i0,((f~[i0]) Ra_PLUS (Ra0Seq~[i0]))])
                i0-->T548 ==> (Ra0Seq~[i0]) = Ra_0
                (f,i0)-->T540(Stat1,Stat6*) ==> (f~[i0]) in Ra
                (f~[i0])-->T451 ==> ((f~[i0]) Ra_PLUS Ra_0) = (f~[i0])
                EQUAL ==> d = [i0,f~[i0]]
            i0-->Stat4 ==> false; Discharge ==> Stat7: (d in {[i,f~[i]]: i in domain(f)}) & (d notin {[u,((f~[u]) Ra_PLUS (Ra0Seq~[u]))]: u in Za})
            (i1,i1)-->Stat7 ==> Stat8: (d = [i1,f~[i1]]) & (i1 in Za) & (d /= [i1,((f~[i1]) Ra_PLUS (Ra0Seq~[i1]))])
            i1-->T548 ==> (Ra0Seq~[i1]) = Ra_0
            (f,i1)-->T540(Stat1,Stat8*) ==> (f~[i1]) in Ra
            (f~[i1])-->T451 ==> ((f~[i1]) Ra_PLUS Ra_0) = (f~[i1])
        EQUAL ==> false; Discharge ==> Stat9: (f Ras_TIMES Ra1Seq) /= f
--
-- We have drawn a contradiction from the assumption that $Ra0Seq$ does not behave as additive unit element;
-- hence we must now reason under the assumption that $Ra1Seq$ does not behave as additive unit element.
-- By the pointwise definition of $Ras_TIMES$, the sequence $f Ras_TIMES Ra1Seq$ associates
-- the rational value $(f~[u]) Ra_TIMES (Ra0Seq~[u])$ with each unsigned integer $u$.
--
        (f,Ra1Seq)-->T554 ==> (f Ras_TIMES Ra1Seq) = {[u,((f~[u]) Ra_TIMES (Ra1Seq~[u]))]: u in Za}
        Use_def(Ra1Seq) ==> Ra1Seq = Za PROD {Ra_1}
        Use_def(PROD) ==> Ra1Seq = {[x,y]: x in Za, y in {Ra_1}}
        Suppose ==> Stat10: {[x,y]: x in Za, y in {Ra_1}} /= {[x,Ra_1]: x in Za}
            cp-->Stat10 ==> (cp in {[x,y]: x in Za, y in {Ra_1}}) eq (cp notin {[x,Ra_1]: x in Za})
            Suppose ==> Stat11: (cp in {[x,y]: x in Za, y in {Ra_1}}) & (cp notin {[x,Ra_1]: x in Za})
            (x2,y2,x2)-->Stat11 ==> false; Discharge ==> Stat12: (cp in {[x,Ra_1]: x in Za}) & (cp notin {[x,y]: x in Za, y in {Ra_1}})
        (x3,x3,Ra_1)-->Stat12 ==> false; Discharge ==> Ra1Seq = {[x,Ra_1]: x in Za}
--
-- On the other hand, $Ra1Seq~[u]$ has value $Ra_1$ for all unsigned integers $u$; therefore,
-- since $Ra_1$ behaves as multiplicative unit element among rational numbers, $(f~[u]) Ra_TIMES (Ra1Seq~[u])$
-- always carries the value $f~[u]$. Accordingly the sequence $f Ras_TIMES Ra1Seq$, whose values coincide
-- with those of $f$ over the common domain $Za$, must coincide with $f$.
--
        APPLY() fcn_symbol(f(u)->Ra_1, g->Ra1Seq, s->Za) ==>
				Stat13: (FORALL x | (Ra1Seq~[x]) = if x in Za then Ra_1 else 0 end if)
        dp-->Stat9 ==> (dp in {[u,((f~[u]) Ra_TIMES (Ra1Seq~[u]))]: u in Za}) eq (dp notin f)
        Suppose ==> Stat14: (dp notin {[i,f~[i]]: i in domain(f)}) & Stat15: (dp in {[u,((f~[u]) Ra_TIMES (Ra1Seq~[u]))]: u in Za})
            i2-->Stat15 ==> (i2 in Za) & (dp = [i2,((f~[i2]) Ra_TIMES (Ra1Seq~[i2]))])
            i2-->Stat13 ==> (Ra1Seq~[i2]) = Ra_1
            (f,i2)-->T540 ==> (f~[i2]) in Ra
            (f~[i2])-->T461 ==> ((f~[i2]) Ra_TIMES Ra_1) = (f~[i2])
            EQUAL ==> dp = [i2,f~[i2]]
        i2-->Stat14 ==> false; Discharge ==> Stat16: (dp in {[i,f~[i]]: i in domain(f)}) & (dp notin {[u,((f~[u]) Ra_TIMES (Ra1Seq~[u]))]: u in Za})
        (i3,i3)-->Stat16 ==> (dp = [i3,f~[i3]]) & (i3 in Za) & (dp /= [i3,((f~[i3]) Ra_TIMES (Ra1Seq~[i3]))])
        i3-->Stat13 ==> (Ra1Seq~[i3]) = Ra_1
        (f,i3)-->T540 ==> (f~[i3]) in Ra
        (f~[i3])-->T461 ==> ((f~[i3]) Ra_TIMES Ra_1) = (f~[i3])
    EQUAL ==> false; Discharge ==> QED
--
-- We are now ready to state the properties of the relation $Ra_eqseq(F,G)$
-- between rational Cauchy sequences in such a way that we can
-- apply the THEORY equivalence_classes
--
Theorem 606: (FORALL f in RaCauchy, g in RaCauchy | (Ra_eqseq(f,g) eq Ra_eqseq(g,f)) & Ra_eqseq(f,f)). Proof:
    Suppose_not ==> Stat1: not(FORALL f in RaCauchy, g in RaCauchy | (Ra_eqseq(f,g) eq Ra_eqseq(g,f)) & Ra_eqseq(f,f))
        (f,g)-->Stat1 ==> (f in RaCauchy) & (g in RaCauchy) & ((Ra_eqseq(f,g) eq (not Ra_eqseq(g,f))) or (not Ra_eqseq(f,f)))
        Suppose ==> (f notin RaSeq) or (g notin RaSeq) or (not Ra_eqseq(f,f)) or (not Ra_eqseq(g,g))
            Use_def(RaCauchy) ==> Stat2: (f in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}) &
		Stat3: (g in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
            ()-->Stat3 ==> g in RaSeq
            ()-->Stat2 ==> f in RaSeq
            f-->T546 ==> not Ra_eqseq(g,g)
        g-->T546 ==> false; Discharge ==> (f in RaSeq) & (g in RaSeq) & Ra_eqseq(f,f) & Ra_eqseq(g,g) & (Ra_eqseq(f,g) eq (not Ra_eqseq(g,f)))
        (f,f,g)-->T553 ==> Ra_eqseq(g,f)
    (g,g,f)-->T553 ==> false; Discharge ==> QED
--
-- The following lemma reformulates Theorem 606 in a form that is often easier to use.
--
Theorem 607: ((F in RaCauchy) & (G in RaCauchy)) imp ((Ra_eqseq(F,G) eq Ra_eqseq(G,F)) & Ra_eqseq(F,F)). Proof:
	Suppose_not(f,g) ==> AUTO
	T606 ==> Stat1: AUTO
	(f,g)-->Stat1 ==> false; Discharge ==> QED
--
Theorem 608: (FORALL f in RaCauchy, g in RaCauchy, h in RaCauchy | (Ra_eqseq(f,g) & Ra_eqseq(g,h)) imp Ra_eqseq(f,h)). Proof:
    Suppose_not ==> Stat1: not(FORALL f in RaCauchy, g in RaCauchy, h in RaCauchy | (Ra_eqseq(f,g) & Ra_eqseq(g,h)) imp Ra_eqseq(f,h))
        (f,g,h)-->Stat1 ==> (f in RaCauchy) & (g in RaCauchy) & (h in RaCauchy) & Ra_eqseq(f,g) & Ra_eqseq(g,h) & (not Ra_eqseq(f,h))
        Suppose ==> (f notin RaSeq) or (g notin RaSeq) or (h notin RaSeq)
            Use_def(RaCauchy) ==> Stat2: (f in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}) &
		Stat3: (g in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}) &
		Stat4: (h in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))})
            ()-->Stat4 ==> h in RaSeq
            ()-->Stat3 ==> g in RaSeq
        ()-->Stat2 ==> false; Discharge ==> (f in RaSeq) & (g in RaSeq) & (h in RaSeq)
        (f,g,h)-->T553 ==> Ra_eqseq(h,f)
        h-->T546 ==> Ra_eqseq(h,h)
    (h,h,f)-->T553 ==> false; Discharge ==> QED
--
-- Now that we know that '$Ra_eqseq$' is an equivalence relationship, we can apply the
-- equivalence_classes theory to it, to derive
--
APPLY(Eqc_thryvar:Re,f1_thryvar:Cauchy_to_Re) equivalence_classes(R(x,y)->Ra_eqseq(x,y),s->RaCauchy) ==>
    Theorem 609: (FORALL x, y | ((x in RaCauchy) & (y in RaCauchy)) imp ((Ra_eqseq(x,y) eq (Cauchy_to_Re(x) = Cauchy_to_Re(y))))) &
    (FORALL x | (x in Re) imp ((arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x))) &
    (FORALL x | (x in RaCauchy) imp (Cauchy_to_Re(x) in Re)) &
    (FORALL x | (x in RaCauchy) imp Ra_eqseq(x,arb(Cauchy_to_Re(x))))
--
-- To ease its application, it is convenient to rewrite the preceding result as the two following statements.
--
Theorem 610: ((X in RaCauchy) & (Y in RaCauchy)) imp ((Ra_eqseq(X,Y) eq (Cauchy_to_Re(X) = Cauchy_to_Re(Y))) & (Cauchy_to_Re(X) in Re) & Ra_eqseq(X,arb(Cauchy_to_Re(X)))). Proof:
	Suppose_not(x,y) ==> AUTO
	T609 ==> Stat1: (FORALL x, y | ((x in RaCauchy) & (y in RaCauchy)) imp ((Ra_eqseq(x,y) eq (Cauchy_to_Re(x) = Cauchy_to_Re(y))))) &
    Stat2: (FORALL x | (x in Re) imp ((arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x))) &
    Stat3: (FORALL x | (x in RaCauchy) imp (Cauchy_to_Re(x) in Re)) &
    Stat4: (FORALL x | (x in RaCauchy) imp Ra_eqseq(x,arb(Cauchy_to_Re(x))))
	(x,y)-->Stat1 ==> ((x in RaCauchy) & (y in RaCauchy)) imp ((Ra_eqseq(x,y) eq (Cauchy_to_Re(x) = Cauchy_to_Re(y))))
	x-->Stat3 ==> (x in RaCauchy) imp (Cauchy_to_Re(x) in Re)
	x-->Stat4 ==> false; Discharge ==> QED
--
Theorem 611: (X in Re) imp ((arb(X) in RaCauchy) & (arb(X) in RaSeq) & (Cauchy_to_Re(arb(X)) = X)). Proof:
	Suppose_not(x) ==> AUTO
	T609 ==> Stat1: (FORALL x, y | ((x in RaCauchy) & (y in RaCauchy)) imp ((Ra_eqseq(x,y) eq (Cauchy_to_Re(x) = Cauchy_to_Re(y))))) &
    Stat2: (FORALL x | (x in Re) imp ((arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x))) &
    Stat3: (FORALL x | (x in RaCauchy) imp (Cauchy_to_Re(x) in Re)) &
    Stat4: (FORALL x | (x in RaCauchy) imp Ra_eqseq(x,arb(Cauchy_to_Re(x))))
	x-->Stat2 ==> (arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x)
	T539(*) ==> arb(x) in RaSeq
	Discharge ==> QED
--
Def 58: [The zero real] R_0 := Cauchy_to_Re(Ra0Seq)
Def 58a: [The unit real] R_1 := Cauchy_to_Re(Ra1Seq)
Def 59: [Real Sum] Def(X R_PLUS Y) := Cauchy_to_Re(arb(X) Ras_PLUS arb(Y))
Def 60: [Real Negative] R_Rev(X) := Cauchy_to_Re(Ras_Rev(arb(X)))
Def 61: [Real Subtraction] Def(X R_MINUS Y) := Cauchy_to_Re(arb(X) Ras_MINUS arb(Y))
--Def 62: [Absolute value, i.e. the larger of $X$ and $R_Rev(X)$] abs(X) := Cauchy_to_Re(Ras_ABS(arb(X)))
Def 63: [Real Multiplication] Def(X R_TIMES Y) := Cauchy_to_Re(arb(X) Ras_TIMES arb(Y))
Def 64: [Real Reciprocal] R_Recip(X) := Cauchy_to_Re(Ras_Recip(arb(X)))
Def 65: [Real Quotient] Def(X R_OVER Y) := X R_TIMES R_Recip(Y)
--
Def 66: [Non-negative Real] R_is_nonneg(X) := (Cauchy_to_Re(Ras_ABS(arb(X))) = X)
Def 67: [Real Comparison] Def(X R_GT Y) := R_is_nonneg(X R_MINUS Y) & (X /= Y)
Def 68: [Real Comparison] Def(X R_GE Y) := R_is_nonneg(X R_MINUS Y)
Def 67a: [Real Comparison] Def(X R_LT Y) := R_is_nonneg(Y R_MINUS X) & (X /= Y)
Def 68a: [Real Comparison] Def(X R_LE Y) := R_is_nonneg(Y R_MINUS X)
--
Theorem 612: (R_0 in Re) & (R_1 in Re). Proof:
    Suppose_not ==> (R_0 notin Re) or (R_1 notin Re)
        T545 ==> (Ra0Seq in RaCauchy) & (Ra1Seq in RaCauchy)
        (Ra0Seq,Ra0Seq)-->T610 ==> Cauchy_to_Re(Ra0Seq) in Re
        (Ra1Seq,Ra1Seq)-->T610 ==> Cauchy_to_Re(Ra1Seq) in Re
        Use_def(R_0) ==> R_1 notin Re
    Use_def(R_1) ==> false; Discharge ==> QED
--
Theorem 613: ({X,Y} incin Re) imp (((X R_PLUS Y) in Re) & (R_Rev(X) in Re)). Proof:
    Suppose_not(x,y) ==> ({x,y} incin Re) & (((x R_PLUS y) notin Re) or (R_Rev(x) notin Re))
        x-->T611(*) ==> arb(x) in RaCauchy
        y-->T611(*) ==> arb(y) in RaCauchy
        (arb(x),arb(y))-->T556(*) ==> ((arb(x) Ras_PLUS arb(y)) in RaCauchy) & (Ras_ABS(arb(x)) in RaCauchy) & (Ras_Rev(arb(x)) in RaCauchy)
        (arb(x) Ras_PLUS arb(y),arb(x) Ras_PLUS arb(y))-->T610(*) ==> Cauchy_to_Re(arb(x) Ras_PLUS arb(y)) in Re
        Use_def(R_PLUS) ==> Stat1: R_Rev(x) notin Re
        (Ras_Rev(arb(x)),Ras_Rev(arb(x)))-->T610(*) ==> Cauchy_to_Re(Ras_Rev(arb(x))) in Re
    Use_def(R_Rev) ==> false; Discharge ==> QED
--
Theorem 614: ({X,Y} incin Re) imp (((X R_MINUS Y) in Re) & ((X R_TIMES Y) in Re)). Proof:
    Suppose_not(x,y) ==> ({x,y} incin Re) & (((x R_MINUS y) notin Re) or ((x R_TIMES y) notin Re))
        x-->T611 ==> arb(x) in RaCauchy
        y-->T611 ==> arb(y) in RaCauchy
        (arb(x),arb(y))-->T561 ==> ((arb(x) Ras_MINUS arb(y)) in RaCauchy) & ((arb(x) Ras_TIMES arb(y)) in RaCauchy)
        (arb(x) Ras_MINUS arb(y),arb(x) Ras_TIMES arb(y))-->T610 ==> Cauchy_to_Re(arb(x) Ras_MINUS arb(y)) in Re
        Use_def(R_MINUS) ==> (x R_TIMES y) notin Re
        (arb(x) Ras_TIMES arb(y),arb(x) Ras_TIMES arb(y))-->T610 ==> Cauchy_to_Re(arb(x) Ras_TIMES arb(y)) in Re
    Use_def(R_TIMES) ==> false; Discharge ==> QED
--
-- It is now easy to prove the commutative and associative laws for real addition.
--
Theorem 615: [Commutative law for real addition] ({X,Y} incin Re) imp ((X R_PLUS Y) = (Y R_PLUS X)). Proof:
    Suppose_not(x,y) ==> ({x,y} incin Re) & ((x R_PLUS y) /= (y R_PLUS x))
--
-- For let x,y,v be a counterexample to our assertion, and let arb(x) and arb(y) be Cauchy sequences belonging
-- to these equivalence classes (of Cauchy sequences). Then our assertion follows immediately from Theorem 578.
--
       x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq)
       y-->T611 ==> (arb(y) in RaCauchy) & (arb(y) in RaSeq)
       (arb(x),arb(y))-->T578 ==> Stat1: (arb(x) Ras_PLUS arb(y)) = (arb(y) Ras_PLUS arb(x))
       Use_def(R_PLUS) ==> Cauchy_to_Re(arb(x) Ras_PLUS arb(y)) /= Cauchy_to_Re(arb(y) Ras_PLUS arb(x))
       EQUAL(Stat1) ==> false; Discharge ==> QED
--
-- The following elementary lemma makes subsequent proof of the associative law for real addition easy.
--
Theorem 616: [Elementary algebraic lemma for real addition] ((X in RaCauchy) & (Y in RaCauchy)) imp (Cauchy_to_Re(X Ras_PLUS Y) = (Cauchy_to_Re(X) R_PLUS Cauchy_to_Re(Y))). Proof:
    Suppose_not(x,y) ==> (x in RaCauchy) & (y in RaCauchy) & (Cauchy_to_Re(x Ras_PLUS y) /= (Cauchy_to_Re(x) R_PLUS Cauchy_to_Re(y)))
    T539(*) ==> (x in RaSeq) & (y in RaSeq)
	Use_def(R_PLUS) ==> Cauchy_to_Re(arb(Cauchy_to_Re(x)) Ras_PLUS arb(Cauchy_to_Re(y))) /= Cauchy_to_Re(x Ras_PLUS y)
	(x,x)-->T610 ==> Ra_eqseq(x,arb(Cauchy_to_Re(x))) & (Cauchy_to_Re(x) in Re)
	(y,y)-->T610 ==> Ra_eqseq(y,arb(Cauchy_to_Re(y))) & (Cauchy_to_Re(y) in Re)
	(x,y)-->T556 ==> (x Ras_PLUS y) in RaCauchy
	(Cauchy_to_Re(x))-->T611 ==> (arb(Cauchy_to_Re(x)) in RaCauchy) & (arb(Cauchy_to_Re(x)) in RaSeq)
	(Cauchy_to_Re(y))-->T611 ==> (arb(Cauchy_to_Re(y)) in RaCauchy) & (arb(Cauchy_to_Re(y)) in RaSeq)
	(x,arb(Cauchy_to_Re(x)),y,arb(Cauchy_to_Re(y)))-->T571 ==> Ra_eqseq(x Ras_PLUS y,arb(Cauchy_to_Re(x)) Ras_PLUS arb(Cauchy_to_Re(y)))
	(arb(Cauchy_to_Re(x)),arb(Cauchy_to_Re(y)))-->T556 ==> (arb(Cauchy_to_Re(x)) Ras_PLUS arb(Cauchy_to_Re(y))) in RaCauchy
	(x Ras_PLUS y,arb(Cauchy_to_Re(x)) Ras_PLUS arb(Cauchy_to_Re(y)))-->T610 ==> false; Discharge ==> QED

Theorem 617: [Associative law for real addition] ({X,Y,V} incin Re) imp ((X R_PLUS (Y R_PLUS V)) = ((X R_PLUS Y) R_PLUS V)). Proof:
    Suppose_not(x,y,v) ==> ({x,y,v} incin Re) & ((x R_PLUS (y R_PLUS v)) /= ((x R_PLUS y) R_PLUS v))
--
-- For let x,y,v be a counterexample to our assertion, so arb(x), arb(y), and arb(v) are Cauchy sequences belonging
-- to these equivalence classes (of Cauchy sequences). By Theorem 580, pointwise addition of these rational sequences is associative
--
	x-->T611(*) ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	y-->T611(*) ==> (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
	v-->T611(*) ==> (arb(v) in RaCauchy) & (arb(v) in RaSeq) & (Cauchy_to_Re(arb(v)) = v)
	(arb(x),arb(y),arb(v))-->T580(*) ==> ((arb(x) Ras_PLUS (arb(y) Ras_PLUS arb(v))) = ((arb(x) Ras_PLUS arb(y)) Ras_PLUS arb(v)))
	(arb(y),arb(v))-->T556(*) ==> (arb(y) Ras_PLUS arb(v)) in RaCauchy
	(arb(x),arb(y))-->T556(*) ==> (arb(x) Ras_PLUS arb(y)) in RaCauchy
--
-- But in the case before us equivalence classes of sums are by definition sums of equivalence classes,
-- so our theorem follows routinely.
--
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_PLUS (arb(y) Ras_PLUS arb(v))) = Cauchy_to_Re((arb(x) Ras_PLUS arb(y)) Ras_PLUS arb(v))
	(arb(x),arb(y) Ras_PLUS arb(v))-->T616 ==> Cauchy_to_Re(arb(x) Ras_PLUS (arb(y) Ras_PLUS arb(v))) = (Cauchy_to_Re(arb(x)) R_PLUS Cauchy_to_Re(arb(y) Ras_PLUS arb(v)))
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_PLUS (arb(y) Ras_PLUS arb(v))) = (x R_PLUS Cauchy_to_Re(arb(y) Ras_PLUS arb(v)))
	(arb(y),arb(v))-->T616 ==> Cauchy_to_Re(arb(y) Ras_PLUS arb(v)) = (Cauchy_to_Re(arb(y)) R_PLUS Cauchy_to_Re(arb(v)))
	EQUAL ==> Cauchy_to_Re(arb(y) Ras_PLUS arb(v)) = (y R_PLUS v)
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_PLUS (arb(y) Ras_PLUS arb(v))) = x R_PLUS (y R_PLUS v)
	(arb(x) Ras_PLUS arb(y),arb(v))-->T616 ==> Cauchy_to_Re((arb(x) Ras_PLUS arb(y)) Ras_PLUS arb(v)) = Cauchy_to_Re(arb(x) Ras_PLUS arb(y)) R_PLUS Cauchy_to_Re(arb(v))
	EQUAL ==> Cauchy_to_Re((arb(x) Ras_PLUS arb(y)) Ras_PLUS arb(v)) = Cauchy_to_Re(arb(x) Ras_PLUS arb(y)) R_PLUS v
	(arb(x),arb(y))-->T616 ==> Cauchy_to_Re(arb(x) Ras_PLUS arb(y)) = (Cauchy_to_Re(arb(x)) R_PLUS Cauchy_to_Re(arb(y)))
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_PLUS arb(y)) = (x R_PLUS y)
	EQUAL ==> false; Discharge ==> QED
--
-- Next we prove the corresponding propositions for real multiplication.
--
Theorem 618: [Commutative law for real multiplication] ({X,Y} incin Re) imp ((X R_TIMES Y) = (Y R_TIMES X)). Proof:
Suppose_not(x,y) ==> ({x,y} incin Re) & ((x R_TIMES y) /= (y R_TIMES x))
--
-- For let x,y,v be a counterexample to our assertion, and let arb(x) and arb(y) be Cauchy sequences belonging
-- to these equivalence classes (of Cauchy sequences). Then our assertion follows immediately from Theorem 578.
--
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq)
	y-->T611 ==> (arb(y) in RaCauchy) & (arb(y) in RaSeq)
	(arb(x),arb(y))-->T579 ==> Stat1: (arb(x) Ras_TIMES arb(y)) = (arb(y) Ras_TIMES arb(x))
	Use_def(R_TIMES) ==> Cauchy_to_Re(arb(x) Ras_TIMES arb(y)) /= Cauchy_to_Re(arb(y) Ras_TIMES arb(x))
EQUAL(Stat1) ==> false; Discharge ==> QED
--
Theorem 619: [Elementary algebraic lemma for real multiplication] ((X in RaCauchy) & (Y in RaCauchy)) imp (Cauchy_to_Re(X Ras_TIMES Y) = (Cauchy_to_Re(X) R_TIMES Cauchy_to_Re(Y))). Proof:
    Suppose_not(x,y) ==> (x in RaCauchy) & (y in RaCauchy) & (Cauchy_to_Re(x Ras_TIMES y) /= (Cauchy_to_Re(x) R_TIMES Cauchy_to_Re(y)))
    T539(*) ==> (x in RaSeq) & (y in RaSeq)
	Use_def(R_TIMES) ==> Cauchy_to_Re(arb(Cauchy_to_Re(x)) Ras_TIMES arb(Cauchy_to_Re(y))) /= Cauchy_to_Re(x Ras_TIMES y)
	(x,x)-->T610 ==> Ra_eqseq(x,arb(Cauchy_to_Re(x))) & (Cauchy_to_Re(x) in Re)
	(y,y)-->T610 ==> Ra_eqseq(y,arb(Cauchy_to_Re(y))) & (Cauchy_to_Re(y) in Re)
	(x,y)-->T561 ==> (x Ras_TIMES y) in RaCauchy
	(Cauchy_to_Re(x))-->T611 ==> (arb(Cauchy_to_Re(x)) in RaCauchy) & (arb(Cauchy_to_Re(x)) in RaSeq)
	(Cauchy_to_Re(y))-->T611 ==> (arb(Cauchy_to_Re(y)) in RaCauchy) & (arb(Cauchy_to_Re(y)) in RaSeq)
	(x,arb(Cauchy_to_Re(x)),y,arb(Cauchy_to_Re(y)))-->T574 ==> Ra_eqseq(x Ras_TIMES y,arb(Cauchy_to_Re(x)) Ras_TIMES arb(Cauchy_to_Re(y)))
	(arb(Cauchy_to_Re(x)),arb(Cauchy_to_Re(y)))-->T561 ==> (arb(Cauchy_to_Re(x)) Ras_TIMES arb(Cauchy_to_Re(y))) in RaCauchy
	(x Ras_TIMES y,arb(Cauchy_to_Re(x)) Ras_TIMES arb(Cauchy_to_Re(y)))-->T610 ==> false; Discharge ==> QED

Theorem 620: [Associative law for real multiplication] ({X,Y,V} incin Re) imp ((X R_TIMES (Y R_TIMES V)) = ((X R_TIMES Y) R_TIMES V)). Proof:
    Suppose_not(x,y,v) ==> (x in Re) & (y in Re) & (v in Re) & ((x R_TIMES (y R_TIMES v)) /= ((x R_TIMES y) R_TIMES v))
--
-- For let x,y,v be a counterexample to our assertion, and let arb(x), arb(y), and arb(v) be Cauchy sequences belonging
-- to these equivalence classes (of Cauchy sequences). By theorem 580, pointwise addition of these rational sequences is associative.
--
	x-->T611 ==> Stat1: (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	y-->T611 ==> Stat2: (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
	v-->T611 ==> Stat3: (arb(v) in RaCauchy) & (arb(v) in RaSeq) & (Cauchy_to_Re(arb(v)) = v)
	(arb(x),arb(y),arb(v))-->T581(Stat1) ==> ((arb(x) Ras_TIMES (arb(y) Ras_TIMES arb(v))) = ((arb(x) Ras_TIMES arb(y)) Ras_TIMES arb(v)))
	(arb(y),arb(v))-->T561(Stat1) ==> (arb(y) Ras_TIMES arb(v)) in RaCauchy
	(arb(x),arb(y))-->T561 ==> (arb(x) Ras_TIMES arb(y)) in RaCauchy
--
-- But in the case before us equivalence classes of products are by definition products of equivalence classes,
-- so our theorem follows routinely.
--
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_TIMES (arb(y) Ras_TIMES arb(v))) = Cauchy_to_Re((arb(x) Ras_TIMES arb(y)) Ras_TIMES arb(v))
	(arb(x),arb(y) Ras_TIMES arb(v))-->T619 ==> Cauchy_to_Re(arb(x) Ras_TIMES (arb(y) Ras_TIMES arb(v))) = (Cauchy_to_Re(arb(x)) R_TIMES Cauchy_to_Re(arb(y) Ras_TIMES arb(v)))
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_TIMES (arb(y) Ras_TIMES arb(v))) = (x R_TIMES Cauchy_to_Re(arb(y) Ras_TIMES arb(v)))
	(arb(y),arb(v))-->T619 ==> Cauchy_to_Re(arb(y) Ras_TIMES arb(v)) = (Cauchy_to_Re(arb(y)) R_TIMES Cauchy_to_Re(arb(v)))
	EQUAL ==> Cauchy_to_Re(arb(y) Ras_TIMES arb(v)) = (y R_TIMES v)
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_TIMES (arb(y) Ras_TIMES arb(v))) = x R_TIMES (y R_TIMES v)
	(arb(x) Ras_TIMES arb(y),arb(v))-->T619 ==> Cauchy_to_Re((arb(x) Ras_TIMES arb(y)) Ras_TIMES arb(v)) = Cauchy_to_Re(arb(x) Ras_TIMES arb(y)) R_TIMES Cauchy_to_Re(arb(v))
	EQUAL ==> Cauchy_to_Re((arb(x) Ras_TIMES arb(y)) Ras_TIMES arb(v)) = Cauchy_to_Re(arb(x) Ras_TIMES arb(y)) R_TIMES v
	(arb(x),arb(y))-->T619 ==> Cauchy_to_Re(arb(x) Ras_TIMES arb(y)) = (Cauchy_to_Re(arb(x)) R_TIMES Cauchy_to_Re(arb(y)))
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_TIMES arb(y)) = (x R_TIMES y)
	EQUAL ==> false; Discharge ==> QED
--
Theorem 621: [Distributive law for real multiplication] ({X,Y,V} incin Re) imp ((X R_TIMES (Y R_PLUS V)) = ((X R_TIMES Y) R_PLUS (X R_TIMES V))). Proof:
	Suppose_not(x,y,v) ==> (x in Re) & (y in Re) & (v in Re) & (x R_TIMES (y R_PLUS v) /= (x R_TIMES y) R_PLUS (x R_TIMES v))
--
-- For let x,y,v be a counterexample to our assertion, and let arb(x), arb(y), and arb(v) be Cauchy sequences belonging
-- to these equivalence classes (of Cauchy sequences). By theorem 583, pointwise addition of these rational sequences is associative.
--
	x-->T611 ==> Stat1: (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	y-->T611 ==> Stat2: (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
	v-->T611 ==> Stat3: (arb(v) in RaCauchy) & (arb(v) in RaSeq) & (Cauchy_to_Re(arb(v)) = v)
	(arb(x),arb(y),arb(v))-->T583(Stat1) ==> (arb(x) Ras_TIMES (arb(y) Ras_PLUS arb(v))) = ((arb(x) Ras_TIMES arb(y)) Ras_PLUS (arb(x) Ras_TIMES arb(v)))
	(arb(y),arb(v))-->T556(Stat1) ==> (arb(y) Ras_PLUS arb(v)) in RaCauchy
	(arb(x),arb(y))-->T561 ==> (arb(x) Ras_TIMES arb(y)) in RaCauchy
	(arb(x),arb(v))-->T561 ==> (arb(x) Ras_TIMES arb(v)) in RaCauchy
--
-- But in the case before us equivalence classes of sums are by definition sums of equivalence classes,
-- and similarly for products, so our theorem follows routinely.
--
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_TIMES (arb(y) Ras_PLUS arb(v))) = Cauchy_to_Re((arb(x) Ras_TIMES arb(y)) Ras_PLUS (arb(x) Ras_TIMES arb(v)))
	(arb(x),arb(y) Ras_PLUS arb(v))-->T619 ==> Cauchy_to_Re(arb(x) Ras_TIMES (arb(y) Ras_PLUS arb(v))) = (Cauchy_to_Re(arb(x)) R_TIMES Cauchy_to_Re(arb(y) Ras_PLUS arb(v)))
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_TIMES (arb(y) Ras_PLUS arb(v))) = (x R_TIMES Cauchy_to_Re(arb(y) Ras_PLUS arb(v)))
	(arb(y),arb(v))-->T616 ==> Cauchy_to_Re(arb(y) Ras_PLUS arb(v)) = (Cauchy_to_Re(arb(y)) R_PLUS Cauchy_to_Re(arb(v)))
	EQUAL ==> Cauchy_to_Re(arb(y) Ras_PLUS arb(v)) = (y R_PLUS v)
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_TIMES (arb(y) Ras_PLUS arb(v))) = x R_TIMES (y R_PLUS v)
	(arb(x) Ras_TIMES arb(y),arb(x) Ras_TIMES arb(v))-->T616 ==> Cauchy_to_Re((arb(x) Ras_TIMES arb(y)) Ras_PLUS (arb(x) Ras_TIMES arb(v))) = Cauchy_to_Re(arb(x) Ras_TIMES arb(y)) R_PLUS Cauchy_to_Re(arb(x) Ras_TIMES arb(v))
	(arb(x),arb(y))-->T619 ==> Cauchy_to_Re(arb(x) Ras_TIMES arb(y)) = Cauchy_to_Re(arb(x)) R_TIMES Cauchy_to_Re(arb(y))
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_TIMES arb(y)) = x R_TIMES y
	(arb(x),arb(v))-->T619 ==> Cauchy_to_Re(arb(x) Ras_TIMES arb(v)) = Cauchy_to_Re(arb(x)) R_TIMES Cauchy_to_Re(arb(v))
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_TIMES arb(v)) = x R_TIMES v
	EQUAL ==> false; Discharge ==> QED
--
Theorem 622: [Lemma for law of signs] (X in RaCauchy) imp (Cauchy_to_Re(Ras_Rev(X)) = R_Rev(Cauchy_to_Re(X))). Proof:
	Suppose_not(x) ==> AUTO
	Use_def(R_Rev) ==> R_Rev(Cauchy_to_Re(x)) = Cauchy_to_Re(Ras_Rev(arb(Cauchy_to_Re(x))))
	(x,x)-->T610 ==> Ra_eqseq(x,arb(Cauchy_to_Re(x))) &  (Cauchy_to_Re(x) in Re)
	(Cauchy_to_Re(x))-->T611 ==> arb(Cauchy_to_Re(x)) in RaCauchy
	(x,arb(Cauchy_to_Re(x)))-->T575 ==> Ra_eqseq(Ras_Rev(x),Ras_Rev(arb(Cauchy_to_Re(x))))
	(x,x)-->T556 ==> Ras_Rev(x) in RaCauchy
	(arb(Cauchy_to_Re(x)),x)-->T556 ==> Ras_Rev(arb(Cauchy_to_Re(x))) in RaCauchy
	(Ras_Rev(x),Ras_Rev(arb(Cauchy_to_Re(x))))-->T610 ==> Cauchy_to_Re(Ras_Rev(x)) = Cauchy_to_Re(Ras_Rev(arb(Cauchy_to_Re(x))))
	Discharge ==> QED
--
Theorem 623: [Law of signs for real multiplication] ({X,Y} incin Re) imp (((X R_TIMES R_Rev(Y)) = R_Rev(X R_TIMES Y)) & ((R_Rev(X) R_TIMES Y) = R_Rev(X R_TIMES Y)) & ((R_Rev(X) R_TIMES R_Rev(Y)) = (X R_TIMES Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	x-->T611 ==> Stat1: (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	y-->T611 ==> Stat2: (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
	(arb(x),arb(y))-->T584 ==> ((arb(x) Ras_TIMES Ras_Rev(arb(y))) = Ras_Rev(arb(x) Ras_TIMES arb(y)))
        (arb(x),arb(y))-->T585 ==> ((Ras_Rev(arb(x)) Ras_TIMES arb(y)) = Ras_Rev(arb(x) Ras_TIMES arb(y))) & ((Ras_Rev(arb(x)) Ras_TIMES Ras_Rev(arb(y))) = (arb(x) Ras_TIMES arb(y)))
	EQUAL ==> (Cauchy_to_Re(arb(x) Ras_TIMES Ras_Rev(arb(y))) = Cauchy_to_Re(Ras_Rev(arb(x) Ras_TIMES arb(y)))) & (Cauchy_to_Re(Ras_Rev(arb(x)) Ras_TIMES arb(y)) = Cauchy_to_Re(Ras_Rev(arb(x) Ras_TIMES arb(y)))) & (Cauchy_to_Re(Ras_Rev(arb(x)) Ras_TIMES Ras_Rev(arb(y))) = Cauchy_to_Re(arb(x) Ras_TIMES arb(y)))
	(arb(x),arb(x))-->T556 ==> Ras_Rev(arb(x)) in RaCauchy
	(arb(y),arb(y))-->T556 ==> Ras_Rev(arb(y)) in RaCauchy
	(arb(x),arb(y))-->T561 ==> (arb(x) Ras_TIMES arb(y)) in RaCauchy
	(Ras_Rev(arb(x)),Ras_Rev(arb(y)))-->T619 ==> Cauchy_to_Re(Ras_Rev(arb(x)) Ras_TIMES Ras_Rev(arb(y))) = Cauchy_to_Re(Ras_Rev(arb(x))) R_TIMES Cauchy_to_Re(Ras_Rev(arb(y)))
	(arb(x),arb(y))-->T619 ==> Cauchy_to_Re(arb(x) Ras_TIMES arb(y)) = Cauchy_to_Re(arb(x)) R_TIMES Cauchy_to_Re(arb(y))
	(arb(x),Ras_Rev(arb(y)))-->T619 ==> Cauchy_to_Re(arb(x) Ras_TIMES Ras_Rev(arb(y))) = Cauchy_to_Re(arb(x)) R_TIMES Cauchy_to_Re(Ras_Rev(arb(y)))
	(Ras_Rev(arb(x)),arb(y))-->T619 ==> Cauchy_to_Re(Ras_Rev(arb(x)) Ras_TIMES arb(y)) = Cauchy_to_Re(Ras_Rev(arb(x))) R_TIMES Cauchy_to_Re(arb(y))
	Use_def(R_Rev) ==> Cauchy_to_Re(Ras_Rev(arb(x))) = R_Rev(x)
	Use_def(R_Rev) ==> Cauchy_to_Re(Ras_Rev(arb(y))) = R_Rev(y)
	(arb(x) Ras_TIMES arb(y))-->T622 ==> Cauchy_to_Re(Ras_Rev(arb(x) Ras_TIMES arb(y))) = R_Rev(Cauchy_to_Re(arb(x) Ras_TIMES arb(y)))
	EQUAL ==> Cauchy_to_Re(Ras_Rev(arb(x)) Ras_TIMES arb(y)) = R_Rev(x) R_TIMES y
	EQUAL ==> Cauchy_to_Re(arb(x)) R_TIMES Cauchy_to_Re(arb(y)) = x R_TIMES y
	EQUAL ==> R_Rev(Cauchy_to_Re(arb(x) Ras_TIMES arb(y))) = R_Rev(x R_TIMES y)
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_TIMES Ras_Rev(arb(y))) = x R_TIMES R_Rev(y)
	EQUAL ==> Cauchy_to_Re(Ras_Rev(arb(x)) Ras_TIMES Ras_Rev(arb(y))) = R_Rev(x) R_TIMES R_Rev(y)
	Discharge ==> QED
--
--
-- Next follow a list of theorems giving various elementary properties of real additon, multiplication, and subtraction.
-- In many cases these follow from corresponding algebraic properties of rational Cauchy sequences.
-- The style of proof used is often that already seen in our last few proof.s
--
Theorem 624: [Any real times 0 is 0] (X in Re) imp ((X R_TIMES R_0) = R_0). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	(arb(x))-->T586 ==> (arb(x) Ras_TIMES Ra0Seq) = Ra0Seq
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_TIMES Ra0Seq) = Cauchy_to_Re(Ra0Seq)
	T545 ==> Ra0Seq in RaCauchy
	(arb(x),Ra0Seq)-->T619 ==> Cauchy_to_Re(arb(x) Ras_TIMES Ra0Seq) = Cauchy_to_Re(arb(x)) R_TIMES Cauchy_to_Re(Ra0Seq)
	EQUAL ==> x R_TIMES Cauchy_to_Re(Ra0Seq) = Cauchy_to_Re(Ra0Seq)
	Use_def(R_0) ==> (x R_TIMES R_0) = R_0
	Discharge ==> QED
--
Theorem 625: [0 times any real is 0] (X in Re) imp (R_0 R_TIMES X = R_0). Proof:
	Suppose_not(x) ==> AUTO
	T612 ==> R_0 in Re
	(x,R_0)-->T618 ==> R_0 R_TIMES x = x R_TIMES R_0
	x-->T624 ==> false; Discharge ==> QED
--
Theorem 626: [0 is a right and left additive identity for reals] (X in Re) imp ((X R_PLUS R_0 = X) & (R_0 R_PLUS X = X)). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	(arb(x))-->T605 ==> (arb(x) Ras_PLUS Ra0Seq) = arb(x)
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_PLUS Ra0Seq) = Cauchy_to_Re(arb(x))
	T545 ==> Ra0Seq in RaCauchy
	(arb(x),Ra0Seq)-->T616 ==> Cauchy_to_Re(arb(x) Ras_PLUS Ra0Seq) = Cauchy_to_Re(arb(x)) R_PLUS Cauchy_to_Re(Ra0Seq)
	EQUAL ==> Cauchy_to_Re(arb(x)) R_PLUS Cauchy_to_Re(Ra0Seq) = x R_PLUS Cauchy_to_Re(Ra0Seq)
	Use_def(R_0) ==> x R_PLUS R_0 = x
	T612 ==> R_0 in Re
	(x,R_0)-->T615 ==> false;  Discharge ==> QED
--
Theorem 627: [1 is a right multiplicative identity for reals] (X in Re) imp (X R_TIMES R_1 = X). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	(arb(x))-->T605 ==> (arb(x) Ras_TIMES Ra1Seq) = arb(x)
	EQUAL ==> Cauchy_to_Re(arb(x) Ras_TIMES Ra1Seq) = Cauchy_to_Re(arb(x))
	T545 ==> Ra1Seq in RaCauchy
	(arb(x),Ra1Seq)-->T619 ==> Cauchy_to_Re(arb(x) Ras_TIMES Ra1Seq) = Cauchy_to_Re(arb(x)) R_TIMES Cauchy_to_Re(Ra1Seq)
	EQUAL ==>Cauchy_to_Re(arb(x) Ras_TIMES Ra1Seq) = x R_TIMES Cauchy_to_Re(Ra1Seq)
	Use_def(R_1) ==> x R_TIMES R_1 = x
	T612 ==> R_1 in Re
	(x,R_1)-->T615 ==> false;  Discharge ==> QED
--
Theorem 628: [1 is a left multiplicative identity for reals] (X in Re) imp (R_1 R_TIMES X = X). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	T612 ==> R_1 in Re
	(x,R_1)-->T618 ==> R_1 R_TIMES x = x R_TIMES R_1
	x-->T627 ==> false; Discharge ==> QED
--
Theorem 629: [The zero real is its own negative] R_Rev(R_0) = R_0. Proof:
	Suppose_not ==> AUTO
	T595 ==> AUTO
	Use_def(R_0) ==> R_Rev(Cauchy_to_Re(Ra0Seq)) /= Cauchy_to_Re(Ra0Seq)
	Use_def(R_Rev) ==> Cauchy_to_Re(Ras_Rev(arb(Cauchy_to_Re(Ra0Seq)))) /= Cauchy_to_Re(Ra0Seq)
	T545 ==> Ra0Seq in RaCauchy
	(Ra0Seq,Ra0Seq)-->T610 ==> Ra_eqseq(Ra0Seq,arb(Cauchy_to_Re(Ra0Seq))) & (Cauchy_to_Re(Ra0Seq) in Re)
	(Cauchy_to_Re(Ra0Seq))-->T611 ==> arb(Cauchy_to_Re(Ra0Seq)) in RaCauchy
	(arb(Cauchy_to_Re(Ra0Seq)),Ra0Seq)-->T607 ==> Ra_eqseq(arb(Cauchy_to_Re(Ra0Seq)),Ra0Seq)
	(arb(Cauchy_to_Re(Ra0Seq)),arb(Cauchy_to_Re(Ra0Seq)))-->T556 ==> Ras_Rev(arb(Cauchy_to_Re(Ra0Seq))) in RaCauchy
	(Ras_Rev(arb(Cauchy_to_Re(Ra0Seq))),Ra0Seq)-->T610 ==>
			not Ra_eqseq(Ras_Rev(arb(Cauchy_to_Re(Ra0Seq))),Ra0Seq)
	(arb(Cauchy_to_Re(Ra0Seq)),Ra0Seq)-->T575 ==> Ra_eqseq(Ras_Rev(arb(Cauchy_to_Re(Ra0Seq))),Ras_Rev(Ra0Seq))
	T595 ==> Ras_Rev(Ra0Seq) = Ra0Seq
	EQUAL ==> Ra_eqseq(Ras_Rev(arb(Cauchy_to_Re(Ra0Seq))),Ra0Seq)
	Discharge ==> QED
--
Theorem 630: [0 is right identity for real subtraction] (X in Re) imp (X R_MINUS R_0 = X). Proof:
	Suppose_not(x) ==> AUTO
	Use_def(R_MINUS) ==> Cauchy_to_Re(arb(x) Ras_MINUS arb(R_0)) /= x
	Use_def(Ras_MINUS) ==> Cauchy_to_Re(arb(x) Ras_PLUS Ras_Rev(arb(R_0))) /= x
	T612 ==> R_0 in Re
	R_0-->T611 ==> (arb(R_0)in RaCauchy)  & (Cauchy_to_Re(arb(R_0)) = R_0)
	x-->T611 ==> (arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x)
	(arb(R_0),arb(R_0))-->T556 ==> Ras_Rev(arb(R_0)) in RaCauchy
	(arb(x),Ras_Rev(arb(R_0)))-->T616 ==> Cauchy_to_Re(arb(x)) R_PLUS Cauchy_to_Re(Ras_Rev(arb(R_0))) /= x
	Use_def(R_Rev) ==> Cauchy_to_Re(Ras_Rev(arb(R_0))) = R_Rev(R_0)
	T629 ==> Cauchy_to_Re(Ras_Rev(arb(R_0))) = R_0
	EQUAL ==> Cauchy_to_Re(arb(x)) R_PLUS R_0 /= x
	EQUAL ==> x R_PLUS R_0 /= x
	x-->T626 ==> false; Discharge ==> QED
--
Theorem 631: [Real subtraction principle] (X in Re) imp (X R_MINUS X = R_0). Proof:
	Suppose_not(x) ==> AUTO
	Use_def(R_MINUS) ==> Cauchy_to_Re(arb(x) Ras_MINUS arb(x)) /= R_0
	Use_def(Ras_MINUS) ==> Cauchy_to_Re(arb(x) Ras_PLUS Ras_Rev(arb(x))) /= R_0
	x-->T611 ==> arb(x) in RaCauchy
	T539(*) ==> arb(x) in RaSeq
	(arb(x))-->T590 ==> Ras_Rev(arb(x)) Ras_PLUS arb(x) = Ra0Seq
	EQUAL ==> Cauchy_to_Re(Ras_Rev(arb(x)) Ras_PLUS arb(x)) = Cauchy_to_Re(Ra0Seq)
	Use_def(R_0) ==> Cauchy_to_Re(Ras_Rev(arb(x)) Ras_PLUS arb(x)) = R_0
	(arb(x),arb(x))-->T556 ==> Ras_Rev(arb(x)) in RaCauchy
	(Ras_Rev(arb(x)),arb(x))-->T616 ==> Cauchy_to_Re(Ras_Rev(arb(x))) R_PLUS Cauchy_to_Re(arb(x)) = R_0
	(arb(x),Ras_Rev(arb(x)))-->T616 ==> Cauchy_to_Re(arb(x)) R_PLUS Cauchy_to_Re(Ras_Rev(arb(x))) /= R_0
	(arb(x),arb(x))-->T610 ==> Cauchy_to_Re(arb(x)) in Re
	(Ras_Rev(arb(x)),arb(x))-->T610 ==> Cauchy_to_Re(Ras_Rev(arb(x))) in Re
	(Cauchy_to_Re(arb(x)),Cauchy_to_Re(Ras_Rev(arb(x))))-->T615 ==> false; Discharge ==> QED
--
Theorem 632: [Basic properties of the signed negative for reals] (X in Re) imp ((R_Rev(X) in Re) & ((R_Rev(X) R_PLUS X) = R_0)). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	Use_def(R_Rev) ==> R_Rev(x) = Cauchy_to_Re(Ras_Rev(arb(x)))
	(arb(x),arb(x))-->T556 ==> Ras_Rev(arb(x)) in RaCauchy
	(Ras_Rev(arb(x)),arb(x))-->T610 ==> R_Rev(x) in Re
	(arb(x))-->T590 ==> Ras_Rev(arb(x)) Ras_PLUS arb(x) = Ra0Seq
	EQUAL ==> Cauchy_to_Re(Ras_Rev(arb(x)) Ras_PLUS arb(x)) = Cauchy_to_Re(Ra0Seq)
	Use_def(R_0) ==> Cauchy_to_Re(Ras_Rev(arb(x)) Ras_PLUS arb(x)) = R_0
	(Ras_Rev(arb(x)),arb(x))-->T616 ==> Cauchy_to_Re(Ras_Rev(arb(x))) R_PLUS Cauchy_to_Re(arb(x)) = R_0
	EQUAL ==> (R_Rev(x) R_PLUS x) = R_0
	Discharge ==> QED
--
Theorem 633: [Basic properties of the signed negative for reals, 2] (X in Re) imp (R_Rev(R_Rev(X)) = X). Proof:
Suppose_not(x) ==> AUTO
	x-->T632(*) ==> R_Rev(x) in Re
	(R_Rev(x))-->T632(*) ==> R_Rev(R_Rev(x)) in Re
	(R_Rev(R_Rev(x)),R_Rev(x),x)-->T617(*) ==> ((R_Rev(R_Rev(x)) R_PLUS R_Rev(x)) R_PLUS x) = (R_Rev(R_Rev(x)) R_PLUS (R_Rev(x) R_PLUS x))
	x-->T632(*) ==> (R_Rev(x) R_PLUS x) = R_0
	(R_Rev(x))-->T632(*) ==> (R_Rev(R_Rev(x)) R_PLUS R_Rev(x)) = R_0
	EQUAL ==> (R_0 R_PLUS x) = (R_Rev(R_Rev(x)) R_PLUS R_0)
	x-->T626(*) ==> x = (R_Rev(R_Rev(x)) R_PLUS R_0)
	(R_Rev(R_Rev(x)))-->T626(*) ==> R_Rev(R_Rev(x)) = (R_Rev(R_Rev(x)) R_PLUS R_0)
Discharge ==> QED
--
Theorem 634: [Real additive Cancellation] ((X in Re) & (Y in Re) & (V in Re) & (X R_PLUS V = Y R_PLUS V)) imp (X = Y). Proof:
	Suppose_not(x,y,v) ==> (x in Re) & (y in Re) & (v in Re) & (x R_PLUS v = y R_PLUS v) & (x /= y)
	(x,v)-->T613 ==> x R_PLUS v in Re
	(y,v)-->T613 ==> y R_PLUS v in Re
	EQUAL ==> ((x R_PLUS v) R_PLUS R_Rev(v)) = ((y R_PLUS v) R_PLUS R_Rev(v))
	(v,v)-->T613 ==> R_Rev(v) in Re
	v-->T632 ==> (R_Rev(v) R_PLUS v) = R_0
	(v,R_Rev(v))-->T615 ==> (v R_PLUS R_Rev(v)) = R_0
	(x,v,R_Rev(v))-->T617 ==> ((x R_PLUS v) R_PLUS R_Rev(v)) = (x R_PLUS (v R_PLUS R_Rev(v)))
	(y,v,R_Rev(v))-->T617 ==> ((y R_PLUS v) R_PLUS R_Rev(v)) = (y R_PLUS (v R_PLUS R_Rev(v)))
	EQUAL ==> (x R_PLUS R_0) = (y R_PLUS R_0)
	x-->T626 ==> x R_PLUS R_0 = x
	y-->T626 ==> false; Discharge ==> QED
--
Theorem 635: [Real subtraction is addition of the negative] ((X in Re) & (Y in Re)) imp ((X R_MINUS Y) = (X R_PLUS R_Rev(Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	y-->T611 ==> (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
	Use_def(R_MINUS) ==> x R_MINUS y = Cauchy_to_Re(arb(x) Ras_MINUS arb(y))
	Use_def(Ras_MINUS) ==> arb(x) Ras_MINUS arb(y) = arb(x) Ras_PLUS Ras_Rev(arb(y))
	EQUAL ==> x R_MINUS y = Cauchy_to_Re(arb(x) Ras_PLUS Ras_Rev(arb(y)))
	(arb(y),arb(y))-->T556 ==> Ras_Rev(arb(y)) in RaCauchy
	(arb(x),Ras_Rev(arb(y)))-->T616 ==> x R_MINUS y = Cauchy_to_Re(arb(x)) R_PLUS Cauchy_to_Re(Ras_Rev(arb(y)))
	EQUAL ==> x R_MINUS y = x R_PLUS Cauchy_to_Re(Ras_Rev(arb(y)))
	Use_def(R_Rev) ==> R_Rev(y) = Cauchy_to_Re(Ras_Rev(arb(y)))
	EQUAL ==> false; Discharge ==> QED
--
Theorem 636: [The sum of a real number and its additive inverse is zero] (X in Re) imp ((R_Rev(X) in Re) & ((X R_PLUS R_Rev(X)) = R_0)). Proof:
Suppose_not(x) ==> AUTO
	(x,x)-->T613(*) ==> (x R_PLUS R_Rev(x)) /= R_0
	(x,x)-->T635 ==> AUTO
x-->T631(*) ==> false; Discharge ==> QED
--
Theorem 637: [The negative of a real $x$ is zero iff $x$ is zero] (X in Re) imp ((R_Rev(X) = R_0) eq (X = R_0)). Proof:
Suppose_not(x) ==> AUTO
	Suppose ==> x = R_0
		()-->T629 ==> AUTO
	EQUAL ==> false; Discharge ==> (x /= R_0) & (R_Rev(X) = R_0)
	x-->T636(*) ==> (x R_PLUS R_Rev(x)) = R_0
	x-->T626(*) ==> (x R_PLUS R_0) = x
EQUAL ==> false; Discharge ==> QED
--
Theorem 638: [The negative of a real sum is the sum of the negatives] ((X in Re) & (Y in Re)) imp (R_Rev(X R_PLUS Y) = R_Rev(X) R_PLUS R_Rev(Y)). Proof:
	Suppose_not(x,y) ==> AUTO
	x-->T613 ==> R_Rev(x) in Re
	y-->T613 ==> R_Rev(y) in Re
	(R_Rev(x),R_Rev(y))-->T613 ==> R_Rev(x) R_PLUS R_Rev(y) in Re
	(x,y)-->T613 ==> x R_PLUS y in Re
	(x R_PLUS y)-->T613 ==> R_Rev(x R_PLUS y) in Re
	(R_Rev(x R_PLUS y),(R_Rev(x) R_PLUS R_Rev(y)),y)-->T634 ==> R_Rev(x R_PLUS y) R_PLUS y /= (R_Rev(x) R_PLUS R_Rev(y)) R_PLUS y
	(R_Rev(x),R_Rev(y),y)-->T617 ==> (R_Rev(x) R_PLUS R_Rev(y)) R_PLUS y = R_Rev(x) R_PLUS (R_Rev(y) R_PLUS y)
	y-->T632 ==> R_Rev(y) R_PLUS y = R_0
	EQUAL ==> (R_Rev(x) R_PLUS R_Rev(y)) R_PLUS y = R_Rev(x) R_PLUS R_0
	(R_Rev(x))-->T626 ==> R_Rev(x) R_PLUS R_0 = R_Rev(x)
	EQUAL ==> (R_Rev(x) R_PLUS R_Rev(y)) R_PLUS y = R_Rev(x)
	EQUAL ==> ((R_Rev(x) R_PLUS R_Rev(y)) R_PLUS y) R_PLUS x = R_Rev(x) R_PLUS x
	x-->T632 ==> ((R_Rev(x) R_PLUS R_Rev(y)) R_PLUS y) R_PLUS x = R_0
	(R_Rev(x),R_Rev(y))-->T613 ==> (R_Rev(x) R_PLUS R_Rev(y)) in Re
	(R_Rev(x) R_PLUS R_Rev(y),y,x)-->T617 ==> ((R_Rev(x) R_PLUS R_Rev(y)) R_PLUS y) R_PLUS x = (R_Rev(x) R_PLUS R_Rev(y)) R_PLUS (y R_PLUS x)
	(x,y)-->T615 ==> y R_PLUS x = x R_PLUS y
	EQUAL ==> (R_Rev(x) R_PLUS R_Rev(y)) R_PLUS (x R_PLUS y) = R_0
	y-->T632 ==> R_Rev(y) R_PLUS y = R_0
	(x,y)-->T613 ==> (x R_PLUS y) in Re
	(x R_PLUS y)-->T632 ==> R_Rev(x R_PLUS y) R_PLUS (x R_PLUS y) = R_0
	(R_Rev(x R_PLUS y),R_Rev(x) R_PLUS R_Rev(y),x R_PLUS y)-->T634 ==> false; Discharge ==> QED
--
Theorem 639: [Real addition-subtraction commutativity] ((X in Re) & (Y in Re) & (V in Re)) imp (X R_MINUS (Y R_PLUS V) = (X R_MINUS Y) R_MINUS V). Proof:
	Suppose_not(x,y,v) ==> AUTO
	(y,v)-->T613 ==> y R_PLUS v in Re
	(x,y)-->T614 ==> x R_MINUS y in Re
	(x,y R_PLUS v)-->T635 ==> (x R_MINUS (y R_PLUS v)) = (x R_PLUS R_Rev(y R_PLUS v))
	(x R_MINUS y,v)-->T635 ==> ((x R_MINUS y) R_MINUS v) = ((x R_MINUS y) R_PLUS R_Rev(v))
	(x,y)-->T635 ==>x R_MINUS y = x R_PLUS R_Rev(y)
	EQUAL ==> (x R_PLUS R_Rev(y R_PLUS v)) /= ((x R_PLUS R_Rev(y)) R_PLUS R_Rev(v))
	y-->T613 ==> R_Rev(y) in Re
	v-->T613 ==> R_Rev(v) in Re
	(x,R_Rev(y),R_Rev(v))-->T617 ==> (x R_PLUS R_Rev(y R_PLUS v)) /= (x R_PLUS (R_Rev(y) R_PLUS R_Rev(v)))
	(y,v)-->T638 ==> R_Rev(y R_PLUS v) = R_Rev(y) R_PLUS R_Rev(v)
	EQUAL ==> false; Discharge ==> QED
--
Theorem 640: [Real subtraction reverses addition] ((X in Re) & (Y in Re)) imp ((X R_PLUS Y) R_MINUS Y = X). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T613 ==> x R_PLUS y in Re
	(x R_PLUS y,y)-->T635 ==> (x R_PLUS y) R_MINUS y = (x R_PLUS y) R_PLUS R_Rev(y)
	y-->T613 ==> R_Rev(y) in Re
	(x,y,R_Rev(y))-->T617 ==> (x R_PLUS y) R_MINUS y = x R_PLUS (y R_PLUS R_Rev(y))
	y-->T632 ==> R_Rev(y) R_PLUS y = R_0
	(y,R_Rev(y))-->T615 ==> y R_PLUS R_Rev(y) = R_0
	EQUAL ==> (x R_PLUS y) R_MINUS y = x R_PLUS R_0
	x-->T626 ==> false; Discharge ==> QED
--
Theorem 641: [Real subtraction reverses  addition, 2] ((X in Re) & (Y in Re)) imp (X = (Y R_PLUS (X R_MINUS Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	(x,y)-->T635 ==> x R_MINUS y = x R_PLUS R_Rev(y)
	y-->T613 ==> R_Rev(y) in Re
	(x,R_Rev(y))-->T615 ==> x R_MINUS y = R_Rev(y) R_PLUS x
	EQUAL ==> y R_PLUS (x R_MINUS y) = y R_PLUS (R_Rev(y) R_PLUS x)
	(y,R_Rev(y),x)-->T617 ==> y R_PLUS (x R_MINUS y) = (y R_PLUS R_Rev(y)) R_PLUS x
	y-->T632 ==> R_Rev(y) R_PLUS y = R_0
	(y,R_Rev(y))-->T615 ==> y R_PLUS R_Rev(y) = R_0
	EQUAL ==> y R_PLUS (x R_MINUS y) = R_0 R_PLUS x
	x-->T626 ==> false; Discharge ==> QED
--
Theorem 642: [Multiplication by $R_Rev(R_1)$] (X in Re) imp (R_Rev(X) = R_Rev(R_1) R_TIMES X). Proof:
	Suppose_not(x) ==> AUTO
	T612 ==> R_1 in Re
	(R_1,R_1)-->T613 ==> R_Rev(R_1) in Re
	(x,x)-->T613 ==> R_Rev(x) in Re
	(x,R_Rev(R_1))-->T614 ==> x R_TIMES R_Rev(R_1) in Re
	(x,R_Rev(R_1))-->T618 ==> R_Rev(x) /= x R_TIMES R_Rev(R_1)
	(R_Rev(x),x R_TIMES R_Rev(R_1),x)-->T634 ==> R_Rev(x) R_PLUS x /= (x R_TIMES R_Rev(R_1)) R_PLUS x
	x-->T632 ==> R_0 /= (x R_TIMES R_Rev(R_1)) R_PLUS x
	x-->T627 ==> x = x R_TIMES R_1
	EQUAL ==> R_0 /= (x R_TIMES R_Rev(R_1)) R_PLUS (x R_TIMES R_1)
	(x,R_Rev(R_1),R_1)-->T621 ==> R_0 /= (x R_TIMES (R_Rev(R_1) R_PLUS R_1))
	R_1-->T632 ==> R_Rev(R_1) R_PLUS R_1 = R_0
	EQUAL ==> R_0 /= x R_TIMES R_0
	x-->T624 ==> false; Discharge ==> QED
--
Theorem 643: [Distributivity of multiplication over subtraction] ((X in Re) & (Y in Re) & (V in Re)) imp ((X R_TIMES (Y R_MINUS V)) = ((X R_TIMES Y) R_MINUS (X R_TIMES V))). Proof:
	Suppose_not(x,y,v) ==> AUTO
	(x,y)-->T614 ==> (x R_TIMES y) in Re
	(x,v)-->T614 ==> (x R_TIMES v) in Re
	(x R_TIMES v,x R_TIMES v)-->T613 ==> R_Rev(x R_TIMES v) in Re
	(v,v)-->T613 ==> R_Rev(v) in Re
	(y,v)-->T614 ==> (y R_MINUS v) in Re
	(x,y R_MINUS v)-->T614 ==> x R_TIMES (y R_MINUS v) in Re
	(x R_TIMES y,x R_TIMES v)-->T614 ==> (x R_TIMES y) R_MINUS (x R_TIMES v) in Re
	(x R_TIMES (y R_MINUS v),(x R_TIMES y) R_MINUS (x R_TIMES v),x R_TIMES v)-->T634 ==> (x R_TIMES (y R_MINUS v)) R_PLUS (x R_TIMES v) /= ((x R_TIMES y) R_MINUS (x R_TIMES v)) R_PLUS (x R_TIMES v)
	(x,y R_MINUS v,v)-->T621 ==> (x R_TIMES ((y R_MINUS v) R_PLUS v)) /= ((x R_TIMES y) R_MINUS (x R_TIMES v)) R_PLUS (x R_TIMES v)
	(x R_TIMES y,x R_TIMES v)-->T635 ==> (x R_TIMES y) R_MINUS (x R_TIMES v) = (x R_TIMES y) R_PLUS R_Rev(x R_TIMES v)
	EQUAL ==> (x R_TIMES ((y R_MINUS v) R_PLUS v)) /= ((x R_TIMES y) R_PLUS R_Rev(x R_TIMES v)) R_PLUS (x R_TIMES v)
	(x R_TIMES y,R_Rev(x R_TIMES v),x R_TIMES v)-->T617 ==> (x R_TIMES ((y R_MINUS v) R_PLUS v)) /= (x R_TIMES y) R_PLUS (R_Rev(x R_TIMES v) R_PLUS (x R_TIMES v))
	(x R_TIMES v)-->T632 ==> R_Rev(x R_TIMES v) R_PLUS (x R_TIMES v) = R_0
	EQUAL ==>  (x R_TIMES ((y R_MINUS v) R_PLUS v)) /= (x R_TIMES y) R_PLUS R_0
	(x R_TIMES y)-->T626 ==> (x R_TIMES y) R_PLUS R_0 = (x R_TIMES y)
	ELEM ==> (x R_TIMES ((y R_MINUS v) R_PLUS v)) /= (x R_TIMES y)
	(y,v)-->T635 ==> y R_MINUS v = y R_PLUS R_Rev(v)
	EQUAL ==> (x R_TIMES ((y R_PLUS R_Rev(v)) R_PLUS v)) /= (x R_TIMES y)
	(y,R_Rev(v),v)-->T617 ==> ((y R_PLUS R_Rev(v)) R_PLUS v) = y R_PLUS (R_Rev(v) R_PLUS v)
	v-->T632 ==> R_Rev(v) R_PLUS v = R_0
	EQUAL ==> (x R_TIMES (y R_PLUS R_0)) /= (x R_TIMES y)
	y-->T626 ==> y R_PLUS R_0 = y
	EQUAL ==> false; Discharge ==> QED
--
Theorem 644: [Additive inverse of real difference] ((X in Re) & (Y in Re)) imp (R_Rev(X R_MINUS Y) = (Y R_MINUS X)). Proof:
Suppose_not(x,y) ==> AUTO
--
-- Assuming the negative of the statement to hold for $x$ and $y$,
-- we reach a contradiction as follows. Theorem 614
-- ensures us that the difference $x R_MINUS y$ belongs to $Re$.
--
	(x,y)-->T614 ==> AUTO
--
-- Moreover, thanks to Theorem 642,
-- each term of the form $R_Rev(z)$, with $z in Re$, can be
-- rewritten as $R_Rev(R_1) R_TIMES z$.
--
	x-->T642 ==> AUTO
	y-->T642 ==> AUTO
	(x R_MINUS y)-->T642(*) ==> Stat1: (R_Rev(x R_MINUS y) = (R_Rev(R_1) R_TIMES (x R_MINUS y))) &
		(R_Rev(x) = (R_Rev(R_1) R_TIMES x)) & (R_Rev(y) = (R_Rev(R_1) R_TIMES y))
--
-- After noticing that  $R_Rev(R_1),R_Rev(x),R_Rev(y)$ belong to $Re$,
-- we can distribute $R_Rev(R_1)$ over the difference $x R_MINUS y$,
-- thus obtaining for $R_Rev(x R_MINUS y)$ the expression
--	$(R_Rev(R_1) R_TIMES x) R_MINUS (R_Rev(R_1) R_TIMES y)$,
-- also writable as $R_Rev(x) R_MINUS R_Rev(y)$, .
-- Moreover, note that $R_Rev(R_Rev(y))=y$ by Theorem 633.
--
	()-->T612 ==> AUTO
	(R_1,R_1)-->T613 ==> AUTO
	(R_Rev(R_1),x,y)-->T643(*) ==> Stat2: R_Rev(x R_MINUS y) = ((R_Rev(R_1) R_TIMES x) R_MINUS (R_Rev(R_1) R_TIMES y))
	(x,x)-->T613 ==> AUTO
	(y,y)-->T613 ==> AUTO
	y-->T633(*) ==> (R_Rev(R_Rev(y)) = y) & (R_Rev(x) in Re) & (R_Rev(y) in Re)
--
-- Hence, if we re-express difference $R_Rev(x) R_MINUS R_Rev(y)$
-- in terms of addition and additive inverse operation,
-- then by means of the commutativity of addition we get the desired contradiction.
--
	(R_Rev(x),R_Rev(y))-->T635(Stat2*) ==> (R_Rev(x) R_MINUS R_Rev(y)) = (R_Rev(x) R_PLUS R_Rev(R_Rev(y)))
	(R_Rev(x),y)-->T615(*) ==> (R_Rev(x) R_PLUS y) = (y R_PLUS R_Rev(x))
	EQUAL(Stat1) ==> R_Rev(x R_MINUS y) = (y R_PLUS R_Rev(x))
(y,x)-->T635(*) ==> false; Discharge ==> QED
--
Theorem 645: [Real reciprocal principle] ((X in Re) & (X /= R_0)) imp (X R_TIMES R_Recip(X) = R_1). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	T545(*) ==> (Ra0Seq in RaCauchy) & (Ra1Seq in RaCauchy)
	Suppose ==> Ra_eqseq(arb(x),Ra0Seq)
	(arb(x),Ra0Seq)-->T610 ==> x = Cauchy_to_Re(Ra0Seq)
	Use_def(R_0) ==> false
	Discharge ==> not Ra_eqseq(arb(x),Ra0Seq)
	(arb(x),arb(x))-->T570 ==> Ras_Recip(arb(x)) in RaCauchy
	(arb(x),Ras_Recip(arb(x)))-->T561 ==> arb(x) Ras_TIMES Ras_Recip(arb(x)) in RaCauchy
	(arb(x))-->T591 ==> Ra_eqseq(arb(x) Ras_TIMES Ras_Recip(arb(x)),Ra1Seq)
	(arb(x) Ras_TIMES Ras_Recip(arb(x)),Ra1Seq)-->T610 ==> Cauchy_to_Re(arb(x) Ras_TIMES Ras_Recip(arb(x))) = Cauchy_to_Re(Ra1Seq)
	(arb(x),Ras_Recip(arb(x)))-->T619 ==> Cauchy_to_Re(arb(x)) R_TIMES Cauchy_to_Re(Ras_Recip(arb(x))) = Cauchy_to_Re(Ra1Seq)
	Use_def(R_Recip) ==> Cauchy_to_Re(arb(x)) R_TIMES R_Recip(x) = Cauchy_to_Re(Ra1Seq)
	Use_def(R_1) ==> Cauchy_to_Re(arb(x)) R_TIMES R_Recip(x) = R_1
	EQUAL ==> false; Discharge ==> QED
--
Theorem 646: [Real division principle] ((X in Re) & (X /= R_0)) imp (X R_OVER X = R_1). Proof:
	Suppose_not(x) ==> AUTO
	Use_def(R_OVER) ==> x R_TIMES R_Recip(x) /= R_1
	x-->T645 ==> false; Discharge ==> QED
--
Theorem 647: [Basic properties of the reciprocal for reals] ((X in Re) & (X /= R_0)) imp ((R_Recip(X) in Re) & (R_Recip(X) /= R_0) & ((R_Recip(X) R_TIMES X) = R_1)). Proof:
	Suppose_not(x) ==> AUTO
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	T545(*) ==> (Ra0Seq in RaCauchy) & (Ra1Seq in RaCauchy)
	Suppose ==> Ra_eqseq(arb(x),Ra0Seq)
	(arb(x),Ra0Seq)-->T610 ==> x = Cauchy_to_Re(Ra0Seq)
	Use_def(R_0) ==> false; Discharge ==> not Ra_eqseq(arb(x),Ra0Seq)
	Use_def(R_Recip) ==> R_Recip(x) = Cauchy_to_Re(Ras_Recip(arb(x)))
	(arb(x),arb(x))-->T570 ==> Ras_Recip(arb(x)) in RaCauchy
	(Ras_Recip(arb(x)),arb(x))-->T610 ==> R_Recip(x) in Re
	Suppose ==> (R_Recip(x) R_TIMES x) /= R_1
		x-->T645 ==> (x R_TIMES R_Recip(x)) = R_1
		(x,R_Recip(x))-->T618 ==> (x R_TIMES R_Recip(x)) = (R_Recip(x) R_TIMES x)
	EQUAL ==> false; Discharge ==> R_Recip(x) = R_0
	Use_def(R_Recip) ==> Cauchy_to_Re(Ras_Recip(arb(x))) = R_0
	Use_def(R_0) ==> Cauchy_to_Re(Ras_Recip(arb(x))) = Cauchy_to_Re(Ra0Seq)
	(Ras_Recip(arb(x)),Ra0Seq)-->T610 ==> Ra_eqseq(Ras_Recip(arb(x)),Ra0Seq)
	(arb(x))-->T546 ==> Ra_eqseq(arb(x),arb(x))
	(arb(x),arb(x),Ras_Recip(arb(x)),Ra0Seq)-->T574 ==> Ra_eqseq(arb(x) Ras_TIMES Ras_Recip(arb(x)),arb(x) Ras_TIMES Ra0Seq)
	(arb(x))-->T586 ==> (arb(x) Ras_TIMES Ra0Seq) = Ra0Seq
	EQUAL ==> Ra_eqseq(arb(x) Ras_TIMES Ras_Recip(arb(x)),Ra0Seq)
	(arb(x))-->T591 ==> Ra_eqseq(arb(x) Ras_TIMES Ras_Recip(arb(x)),Ra1Seq)
	T539(*) ==> (Ra1Seq in RaSeq) & (Ras_Recip(arb(x)) in RaSeq) & (Ra0Seq in RaSeq)
	Ra1Seq-->T546 ==> Ra_eqseq(Ra1Seq,Ra1Seq)
	(arb(x),Ras_Recip(arb(x)))-->T554 ==> (arb(x) Ras_TIMES Ras_Recip(arb(x))) in RaSeq
	(arb(x) Ras_TIMES Ras_Recip(arb(x)),Ra1Seq,Ra1Seq)-->T553 ==> Ra_eqseq(Ra1Seq,arb(x) Ras_TIMES Ras_Recip(arb(x)))
	(Ra1Seq,arb(x) Ras_TIMES Ras_Recip(arb(x)),Ra0Seq)-->T553 ==> Ra_eqseq(Ra0Seq,Ra1Seq)
	T603 ==> false; Discharge ==> QED
--
Theorem 648: [Basic properties of the reciprocal for reals, 2] ((X in Re) & (X /= R_0)) imp (R_Recip(R_Recip(X)) = X). Proof:
	Suppose_not(x) ==> AUTO
	x-->T647 ==> (R_Recip(x) in Re) & (R_Recip(x) /= R_0)
	(R_Recip(x))-->T647 ==> R_Recip(R_Recip(x)) in Re
	(R_Recip(R_Recip(x)),R_Recip(x),x)-->T620 ==> (R_Recip(R_Recip(x)) R_TIMES R_Recip(x)) R_TIMES x = R_Recip(R_Recip(x)) R_TIMES (R_Recip(x) R_TIMES x)
	x-->T647 ==> R_Recip(x) R_TIMES x = R_1
	(R_Recip(x))-->T647 ==> R_Recip(R_Recip(x)) R_TIMES R_Recip(x) = R_1
	EQUAL ==> R_1 R_TIMES x = R_Recip(R_Recip(x)) R_TIMES R_1
	x-->T628 ==> x = R_Recip(R_Recip(x)) R_TIMES R_1
	(R_Recip(R_Recip(x)))-->T627 ==> R_Recip(R_Recip(x)) = R_Recip(R_Recip(x)) R_TIMES R_1
	Discharge ==> QED
--
Theorem 649: [Reverse of real reciprocal] ((X in Re) & (X /= R_0)) imp (R_Recip(R_Rev(X)) = R_Rev(R_Recip(X))). Proof:
Suppose_not(x) ==> AUTO
--
-- We will reduce the expression $(R_Rev(x) R_TIMES R_Recip(R_Rev(x))) R_TIMES R_Rev(R_Recip(x))$
-- to $R_Rev(R_Recip(x))$ on the one hand, and to $R_Recip(R_Recip(x))$ on the other.
--
	(x,x)-->T613(*) ==> Stat1: R_Rev(x) in Re
	Suppose ==> R_Rev(x) = R_0
		x-->T626(*) ==> (x R_PLUS R_0) = x
		x-->T636(*) ==> (x R_PLUS R_Rev(x)) = R_0
	EQUAL ==> false; Discharge ==> R_Rev(x) /= R_0
	(R_Rev(x))-->T647(*) ==> Stat2: (R_Recip(R_Rev(x)) in Re) & (R_Recip(R_Rev(x)) /= R_0)
	(R_Rev(x))-->T645(*) ==> Stat3: (R_Rev(x) R_TIMES R_Recip(R_Rev(x))) = R_1
	x-->T647(*) ==> R_Recip(x) in Re
	(R_Recip(x),R_Recip(x))-->T613(*) ==> R_Rev(R_Recip(x)) in Re
	(R_Rev(R_Recip(x)))-->T628(*) ==> (R_1 R_TIMES R_Rev(R_Recip(x))) = R_Rev(R_Recip(x))
	EQUAL(Stat3) ==> (R_Rev(x) R_TIMES R_Recip(R_Rev(x))) R_TIMES R_Rev(R_Recip(x)) = R_Rev(R_Recip(x))
--
	(R_Rev(x),R_Recip(R_Rev(x)))-->T618(*) ==> Stat4: (R_Rev(x) R_TIMES R_Recip(R_Rev(x))) = (R_Recip(R_Rev(x)) R_TIMES R_Rev(x))
	(R_Recip(R_Rev(x)),R_Rev(x))-->T614(Stat1,Stat2*) ==> (R_Recip(R_Rev(x)) R_TIMES R_Rev(x)) in Re
	(R_Recip(R_Rev(x)) R_TIMES R_Rev(x),R_Recip(x))-->T623(*) ==> ((R_Recip(R_Rev(x)) R_TIMES R_Rev(x)) R_TIMES R_Rev(R_Recip(x))) = R_Rev((R_Recip(R_Rev(x)) R_TIMES R_Rev(x)) R_TIMES R_Recip(x))
	(R_Recip(R_Rev(x)),R_Rev(x),R_Recip(x))-->T620(*) ==> ((R_Recip(R_Rev(x)) R_TIMES R_Rev(x)) R_TIMES R_Recip(x)) = (R_Recip(R_Rev(x)) R_TIMES (R_Rev(x) R_TIMES R_Recip(x)))
	(x,R_Recip(x))-->T623(*) ==> (R_Rev(x) R_TIMES R_Recip(x)) = R_Rev(x R_TIMES R_Recip(x))
	x-->T645(*) ==> (x R_TIMES R_Recip(x)) = R_1
	T612(*) ==> R_1 in Re
	(R_Recip(R_Rev(x)),R_1)-->T623(*) ==> (R_Recip(R_Rev(x)) R_TIMES R_Rev(R_1)) = R_Rev(R_Recip(R_Rev(x)) R_TIMES R_1)
	(R_Recip(R_Rev(x)))-->T627(*) ==> (R_Recip(R_Rev(x)) R_TIMES R_1) = R_Recip(R_Rev(x))
	(R_Recip(R_Rev(x)))-->T633(*) ==> R_Rev(R_Rev(R_Recip(R_Rev(x)))) = R_Recip(R_Rev(x))
	EQUAL(Stat4) ==> (R_Rev(x) R_TIMES R_Recip(R_Rev(x))) R_TIMES R_Rev(R_Recip(x)) = R_Recip(R_Rev(x))
Discharge ==> QED
--
Theorem 650: [Real multiplicative Cancellation] ((X in Re) & (Y in Re) & (V in Re) & (X R_TIMES V = Y R_TIMES V) & (V /= R_0)) imp (X = Y). Proof:
	Suppose_not(x,y,v) ==> (x in Re) & (y in Re) & (v in Re) & (x R_TIMES v = y R_TIMES v) & (v /= R_0) & (x /= y)
	(x,v)-->T614 ==> x R_TIMES v in Re
	(y,v)-->T614 ==> y R_TIMES v in Re
	EQUAL ==> ((x R_TIMES v) R_TIMES R_Recip(v)) = ((y R_TIMES v) R_TIMES R_Recip(v))
	v-->T647 ==> (R_Recip(v) in Re) & (R_Recip(v) /= R_0) & (R_Recip(v) R_TIMES v = R_1)
	(v,R_Recip(v))-->T618 ==> (v R_TIMES R_Recip(v)) = R_1
	(x,v,R_Recip(v))-->T620 ==> ((x R_TIMES v) R_TIMES R_Recip(v)) = (x R_TIMES (v R_TIMES R_Recip(v)))
	(y,v,R_Recip(v))-->T620 ==> ((y R_TIMES v) R_TIMES R_Recip(v)) = (y R_TIMES (v R_TIMES R_Recip(v)))
	EQUAL ==> (x R_TIMES R_1) = (y R_TIMES R_1)
	x-->T627 ==> x R_TIMES R_1 = x
	y-->T627 ==> false; Discharge ==> QED
--
Theorem 651: [Reals are closed under division] ((X in Re) & (Y in Re) & (Y /= R_0)) imp ((X R_OVER Y in Re) & ((X /= R_0) imp ((X R_OVER Y /= R_0) & (X R_TIMES Y /= R_0)))). Proof:
	Suppose_not(x,y) ==> AUTO
	y-->T647 ==> (R_Recip(y) in Re) & (R_Recip(y) /= R_0)
	T612 ==> R_0 in Re
	Suppose ==> x R_OVER y notin Re
	Use_def(R_OVER) ==> x R_TIMES R_Recip(y) notin Re
	(x,R_Recip(y))-->T614 ==> false; Discharge ==> (x /= R_0) & ((x R_OVER y = R_0) or (x R_TIMES y = R_0))
	Suppose ==> x R_OVER y = R_0
	Use_def(R_OVER) ==> x R_TIMES R_Recip(y) = R_0
	(R_Recip(y))-->T625 ==> R_0 R_TIMES R_Recip(y) = R_0
	(x,R_0,R_Recip(y))-->T650 ==> false; Discharge ==> x R_TIMES y = R_0
	y-->T625 ==> R_0 R_TIMES y = R_0
	(x,R_0,y)-->T650 ==> false; Discharge ==> QED
--
Theorem 652: [Real division is multiplication by the reciprocal] ((X in Re) & (Y in Re) & (Y /= R_0)) imp ((X R_OVER Y) = (X R_TIMES R_Recip(Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	Use_def(R_OVER) ==> false; Discharge ==> QED
--
Theorem 653: [The reciprocal of a real product is the product of the reciprocals] ((X in Re) & (Y in Re) & (X /= R_0) & (Y /= R_0)) imp ((X R_TIMES Y /= R_0) & R_Recip(X R_TIMES Y) = R_Recip(X) R_TIMES R_Recip(Y)). Proof:
	Suppose_not(x,y) ==> AUTO
	x-->T647 ==> (R_Recip(x) in Re) & (R_Recip(x) /= R_0)
	y-->T647 ==> (R_Recip(y) in Re) & (R_Recip(y) /= R_0)
	(R_Recip(x),R_Recip(y))-->T614 ==> R_Recip(x) R_TIMES R_Recip(y) in Re
	(x,y)-->T614 ==> x R_TIMES y in Re
	Suppose ==> x R_TIMES y = R_0
		y-->T625 ==> R_0 R_TIMES y = R_0
		T625 ==> R_0 in Re
		(x,R_0,y)-->T650 ==> false; Discharge ==> x R_TIMES y /= R_0
	(x R_TIMES y)-->T647 ==> R_Recip(x R_TIMES y) in Re
	(R_Recip(x R_TIMES y),(R_Recip(x) R_TIMES R_Recip(y)),y)-->T650 ==> R_Recip(x R_TIMES y) R_TIMES y /= (R_Recip(x) R_TIMES R_Recip(y)) R_TIMES y
	(R_Recip(x),R_Recip(y),y)-->T620 ==> (R_Recip(x) R_TIMES R_Recip(y)) R_TIMES y = R_Recip(x) R_TIMES (R_Recip(y) R_TIMES y)
	y-->T647 ==> R_Recip(y) R_TIMES y = R_1
	EQUAL ==> (R_Recip(x) R_TIMES R_Recip(y)) R_TIMES y = R_Recip(x) R_TIMES R_1
	(R_Recip(x))-->T627 ==> R_Recip(x) R_TIMES R_1 = R_Recip(x)
	EQUAL ==> (R_Recip(x) R_TIMES R_Recip(y)) R_TIMES y = R_Recip(x)
	EQUAL ==> ((R_Recip(x) R_TIMES R_Recip(y)) R_TIMES y) R_TIMES x = R_Recip(x) R_TIMES x
	x-->T647 ==> ((R_Recip(x) R_TIMES R_Recip(y)) R_TIMES y) R_TIMES x = R_1
	(R_Recip(x),R_Recip(y))-->T613 ==> (R_Recip(x) R_TIMES R_Recip(y)) in Re
	(R_Recip(x) R_TIMES R_Recip(y),y,x)-->T620 ==> ((R_Recip(x) R_TIMES R_Recip(y)) R_TIMES y) R_TIMES x = (R_Recip(x) R_TIMES R_Recip(y)) R_TIMES (y R_TIMES x)
	(x,y)-->T618 ==> y R_TIMES x = x R_TIMES y
	EQUAL ==> (R_Recip(x) R_TIMES R_Recip(y)) R_TIMES (x R_TIMES y) = R_1
	y-->T632 ==> R_Recip(y) R_TIMES y = R_1
	(x,y)-->T613 ==> (x R_TIMES y) in Re
	(x R_TIMES y)-->T647 ==> R_Recip(x R_TIMES y) R_TIMES (x R_TIMES y) = R_1
	(R_Recip(x R_TIMES y),R_Recip(x) R_TIMES R_Recip(y),x R_TIMES y)-->T650 ==> false; Discharge ==> QED
--
Theorem 654: [Real multiplication-division commutativity] ((X in Re) & (Y in Re) & (Y /= R_0) & (V in Re) & (V /= R_0)) imp (X R_OVER (Y R_TIMES V) = (X R_OVER Y) R_OVER V). Proof:
	Suppose_not(x,y,v) ==> AUTO
	(x,y)-->T651 ==> x R_OVER y in Re
	(y,v)-->T651 ==> y R_TIMES v /= R_0
	(y,v)-->T614 ==> y R_TIMES v in Re
	(x,y R_TIMES v)-->T652 ==> (x R_OVER (y R_TIMES v)) = (x R_TIMES R_Recip(y R_TIMES v))
	(x R_OVER y,v)-->T652 ==> ((x R_OVER y) R_OVER v) = ((x R_OVER y) R_TIMES R_Recip(v))
	(x,y)-->T652 ==>x R_OVER y = x R_TIMES R_Recip(y)
	EQUAL ==> (x R_TIMES R_Recip(y R_TIMES v)) /= ((x R_TIMES R_Recip(y)) R_TIMES R_Recip(v))
	y-->T647 ==> R_Recip(y) in Re
	v-->T647 ==> R_Recip(v) in Re
	(x,R_Recip(y),R_Recip(v))-->T620 ==> (x R_TIMES R_Recip(y R_TIMES v)) /= (x R_TIMES (R_Recip(y) R_TIMES R_Recip(v)))
	(y R_TIMES v)-->T647 ==> R_Recip(y R_TIMES v) in Re
	(R_Recip(y),R_Recip(v))-->T614 ==> R_Recip(y) R_TIMES R_Recip(v) in Re
	(x,R_Recip(y R_TIMES v))-->T618 ==> x R_TIMES R_Recip(y R_TIMES v) = R_Recip(y R_TIMES v) R_TIMES x
	(x,R_Recip(y) R_TIMES R_Recip(v))-->T618 ==> x R_TIMES (R_Recip(y) R_TIMES R_Recip(v)) = (R_Recip(y) R_TIMES R_Recip(v)) R_TIMES x
	(x,R_Recip(y),R_Recip(v))-->T620 ==> (x R_TIMES R_Recip(y R_TIMES v)) /= (x R_TIMES (R_Recip(y) R_TIMES R_Recip(v)))
	ELEM ==> (R_Recip(y) R_TIMES R_Recip(v)) R_TIMES x /= R_Recip(y R_TIMES v) R_TIMES x
	Suppose ==> R_Recip(y R_TIMES v) = R_Recip(y) R_TIMES R_Recip(v)
	EQUAL ==> false; Discharge ==> R_Recip(y R_TIMES v) /= R_Recip(y) R_TIMES R_Recip(v)
	(y,v)-->T653 ==> false; Discharge ==> QED
--
Theorem 655: [A real divided by itself gives 1] ((X in Re) & (X /= R_0)) imp (X R_OVER X = R_1). Proof:
	Suppose_not(x) ==> AUTO
	Use_def(R_OVER) ==> x R_TIMES R_Recip(x) /= R_1
	x-->T645 ==> false; Discharge ==> QED
--
Theorem 656: [Real reciprocal as a quotient] ((X in Re) & (X /= R_0)) imp (R_Recip(X) = R_1 R_OVER X). Proof:
	Suppose_not(x) ==> AUTO
	Use_def(R_OVER) ==> R_1 R_OVER x = R_1 R_TIMES R_Recip(x)
	x-->T647 ==> R_Recip(x) in Re
	(R_Recip(X))-->T628 ==> false; Discharge ==> QED
--
Theorem 657: [Distributivity of division over addition] ((X in Re) & (Y in Re) & (V in Re) & (V /= R_0)) imp ((X R_PLUS Y) R_OVER V = ((X R_OVER V) R_PLUS (Y R_OVER V))). Proof:
	Suppose_not(x,y,v) ==> AUTO
	Use_def(R_OVER) ==> ((x R_PLUS y) R_TIMES R_Recip(v)) /= ((x R_TIMES R_Recip(v)) R_PLUS (y R_TIMES R_Recip(v)))
	v-->T647 ==> R_Recip(v) in Re
	(x,y)-->T613 ==> x R_PLUS y in Re
	(x,R_Recip(v))-->T618 ==> x R_TIMES R_Recip(v) = R_Recip(v) R_TIMES x
	(y,R_Recip(v))-->T618 ==> y R_TIMES R_Recip(v) = R_Recip(v) R_TIMES y
	(x R_PLUS y,R_Recip(v))-->T618 ==> ((x R_PLUS y) R_TIMES R_Recip(v)) = (R_Recip(v) R_TIMES (x R_PLUS y))
	EQUAL ==> ((x R_TIMES R_Recip(v)) R_PLUS (y R_TIMES R_Recip(v))) = ((R_Recip(v) R_TIMES x) R_PLUS (R_Recip(v) R_TIMES y))
	EQUAL ==> (R_Recip(v) R_TIMES (x R_PLUS y)) /= ((R_Recip(v) R_TIMES x) R_PLUS (R_Recip(v) R_TIMES y))
	(R_Recip(v),x,y)-->T621 ==> false; Discharge ==> QED
--
Theorem 658: [Real division reverses multiplication] ((X in Re) & (Y in Re) & (Y /= R_0)) imp ((X R_TIMES Y) R_OVER Y = X). Proof:
	Suppose_not(x,y) ==> AUTO
	Use_def(R_OVER) ==> (x R_TIMES y) R_TIMES R_Recip(y) /= x
	y-->T647 ==> R_Recip(y) in Re
	(x,y,R_Recip(y))-->T620 ==> x R_TIMES (y R_TIMES R_Recip(y)) /= x
	y-->T645 ==> y R_TIMES R_Recip(y) = R_1
	EQUAL ==> x R_TIMES R_1 /= x
	x-->T627 ==> false; Discharge ==> QED
--
Theorem 659: [Real division reverses multiplication,2] ((X in Re) & (Y in Re) & (Y /= R_0)) imp (X = (Y R_TIMES (X R_OVER Y))). Proof:
	Suppose_not(x,y) ==> AUTO
	Use_def(R_OVER) ==> (y R_TIMES (x R_TIMES R_Recip(y))) /= x
	y-->T647 ==> R_Recip(y) in Re
	(x,R_Recip(y))-->T618 ==> x R_TIMES R_Recip(y) = R_Recip(y) R_TIMES x
	EQUAL ==> (y R_TIMES (R_Recip(y) R_TIMES x)) /= x
	(y,R_Recip(y),x)-->T620 ==> (y R_TIMES R_Recip(y)) R_TIMES x /= x
	y-->T645 ==> y R_TIMES R_Recip(y) = R_1
	EQUAL ==> R_1 R_TIMES x /= x
	x-->T628 ==> false; Discharge ==> QED
--
Theorem 660: [Distributivity of division over subtraction] ((X in Re) & (Y in Re) & (V in Re) & (V /= R_0)) imp (((X R_MINUS Y) R_OVER V) = ((X R_OVER V) R_MINUS (Y R_OVER V))). Proof:
	Suppose_not(x,y,v) ==> AUTO
	Use_def(R_OVER) ==> ((x R_MINUS y) R_TIMES R_Recip(v)) /= ((x R_TIMES R_Recip(v)) R_MINUS (y R_TIMES R_Recip(v)))
	v-->T647 ==> R_Recip(v) in Re
	(x,y)-->T614 ==> x R_MINUS y in Re
	(x,R_Recip(v))-->T618 ==> x R_TIMES R_Recip(v) = R_Recip(v) R_TIMES x
	(y,R_Recip(v))-->T618 ==> y R_TIMES R_Recip(v) = R_Recip(v) R_TIMES y
	(x R_MINUS y,R_Recip(v))-->T618 ==> ((x R_MINUS y) R_TIMES R_Recip(v)) = (R_Recip(v) R_TIMES (x R_MINUS y))
	EQUAL ==> ((x R_TIMES R_Recip(v)) R_MINUS (y R_TIMES R_Recip(v))) = ((R_Recip(v) R_TIMES x) R_MINUS (R_Recip(v) R_TIMES y))
	EQUAL ==> (R_Recip(v) R_TIMES (x R_MINUS y)) /= ((R_Recip(v) R_TIMES x) R_MINUS (R_Recip(v) R_TIMES y))
	(R_Recip(v),x,y)-->T643 ==> false; Discharge ==> QED
--
Theorem 661: (X in Re) imp ((R_Rev(X) = Cauchy_to_Re(arb(R_Rev(X)))) & Ra_eqseq(Ras_ABS(arb(X)),arb(Cauchy_to_Re(Ras_ABS(arb(X)))))). Proof:
Suppose_not(x) ==> AUTO
--
-- In spite of their different syntactic look, the two conclusions of this theorem
-- are obtained by the same formal mechanism. Indeed, both $Ras_Rev(p)$ and $Ras_ABS(p)$
-- are rational Cauchy sequences when $p$ is a rational Cauchy sequence, hence in
-- particular when $p=arb(x)$ for some real number $x$.
-- Therefore, thanks to Theorem 611, if the operation $Cauchy_to_Re(y)$ is applied
-- to either $Ras_Rev(arb(x))$ or $Ras_ABS(arb(x))$, we get the same result as we would
-- obtain by applying the operation $Cauchy_to_Re(arb(Cauchy_to_Re(y)))$ to the
-- same operand.
--
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	(R_Rev(x))-->T611(*) ==> Stat1: (not Ra_eqseq(Ras_ABS(arb(x)),arb(Cauchy_to_Re(Ras_ABS(arb(x))))))
	x-->T611(*) ==> arb(x) in RaCauchy
	(arb(x),arb(x))-->T556(Stat1*) ==> Stat2: Ras_ABS(arb(x)) in RaCauchy
	(Ras_ABS(arb(x)),Ras_ABS(arb(x)))-->T610(Stat2*) ==> Cauchy_to_Re(Ras_ABS(arb(x))) in Re
	(Cauchy_to_Re(Ras_ABS(arb(x))))-->T611(Stat2*) ==> arb(Cauchy_to_Re(Ras_ABS(arb(x)))) in RaCauchy
	(Ras_ABS(arb(x)),arb(Cauchy_to_Re(Ras_ABS(arb(x)))))-->T610(Stat1*) ==> Cauchy_to_Re(Ras_ABS(arb(x))) /= Cauchy_to_Re(arb(Cauchy_to_Re(Ras_ABS(arb(x)))))
(Cauchy_to_Re(Ras_ABS(arb(x))))-->T611(Stat2*) ==> false; Discharge ==> QED
--
Theorem 662: ((X in Re) & (Y in Re)) imp Ra_eqseq((arb(X) Ras_PLUS arb(Y)),arb(Cauchy_to_Re(arb(X) Ras_PLUS arb(Y)))). Proof:
Suppose_not(x,y) ==> AUTO
	ELEM ==> Stat1: (not Ra_eqseq(arb(x) Ras_PLUS arb(y),arb(Cauchy_to_Re((arb(x) Ras_PLUS arb(y))))))
	x-->T611(*) ==> arb(x) in RaCauchy
	y-->T611(*) ==> arb(y) in RaCauchy
	(arb(x),arb(y))-->T556(Stat1*) ==> Stat2: (arb(x) Ras_PLUS arb(y)) in RaCauchy
	(arb(x) Ras_PLUS arb(y),arb(x) Ras_PLUS arb(y))-->T610(Stat2*) ==> Cauchy_to_Re(arb(x) Ras_PLUS arb(y)) in Re
	(Cauchy_to_Re(arb(x) Ras_PLUS arb(y)))-->T611(Stat2*) ==> arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y))) in RaCauchy
	(arb(x) Ras_PLUS arb(y),arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y))))-->T610(Stat1*) ==> Cauchy_to_Re(arb(x) Ras_PLUS arb(y)) /= Cauchy_to_Re(arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y))))
(Cauchy_to_Re(arb(x) Ras_PLUS arb(y)))-->T611(Stat2*) ==> false; Discharge ==> QED
--
-- Our next group of theorems, all elementary, deal with real comparisons and a few elementary real inequalities.
--
Theorem 663: [Any real $x$ or its reverse is non-negative, and if both are non-negative, then $x = 0$] (X in Re) imp ((R_is_nonneg(X) or R_is_nonneg(R_Rev(X))) & ((R_is_nonneg(X) & R_is_nonneg(R_Rev(X))) imp (X = R_0))). Proof:
Suppose_not(x) ==> AUTO
	ELEM ==> Stat1: not((R_is_nonneg(x) or R_is_nonneg(R_Rev(x))) & ((R_is_nonneg(X) & R_is_nonneg(R_Rev(X))) imp (X = R_0)))
	x-->T611 ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	(arb(x))-->T602 ==> ((Ra_eqseq(Ras_ABS(arb(x)),arb(x)) or Ra_eqseq(Ras_ABS(arb(x)),Ras_Rev(arb(x))))) & (((Ra_eqseq(Ras_ABS(arb(x)),arb(x)) & Ra_eqseq(Ras_ABS(arb(x)),Ras_Rev(arb(x))))) imp Ra_eqseq(arb(x),Ra0Seq))
	(arb(x))-->T604 ==> Ras_ABS(Ras_Rev(arb(x))) = Ras_ABS(arb(x))
	EQUAL ==> ((Ra_eqseq(Ras_ABS(arb(x)),arb(x)) or Ra_eqseq(Ras_ABS(Ras_Rev(arb(x))),Ras_Rev(arb(x))))) & (((Ra_eqseq(Ras_ABS(arb(x)),arb(x)) & Ra_eqseq(Ras_ABS(Ras_Rev(arb(x))),Ras_Rev(arb(x))))) imp Ra_eqseq(arb(x),Ra0Seq))
	(arb(x),arb(x))-->T556(*) ==> Stat2: (Ras_ABS(arb(x)) in RaCauchy) & (Ras_Rev(arb(x)) in RaCauchy)
	(Ras_Rev(arb(x)))-->T556(*) ==> Ras_ABS(Ras_Rev(arb(x))) in RaCauchy
	(Ras_ABS(arb(x)),arb(x))-->T610(*) ==> Ra_eqseq(Ras_ABS(arb(x)),arb(x)) eq (Cauchy_to_Re(Ras_ABS(arb(x))) = Cauchy_to_Re(arb(x)))
	(Ras_ABS(Ras_Rev(arb(x))),Ras_Rev(arb(x)))-->T610(*) ==> Ra_eqseq(Ras_ABS(Ras_Rev(arb(x))),Ras_Rev(arb(x))) eq (Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x)))) = Cauchy_to_Re(Ras_Rev(arb(x))))
	T545 ==> Ra0Seq in RaCauchy
	(arb(x),Ra0Seq)-->T610(*) ==> Ra_eqseq(arb(x),Ra0Seq) eq (x = Cauchy_to_Re(Ra0Seq))
	Use_def(R_0) ==> Ra_eqseq(arb(x),Ra0Seq) eq (x = R_0)
	ELEM ==> ((Cauchy_to_Re(Ras_ABS(arb(x))) = x) or (Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x)))) = Cauchy_to_Re(Ras_Rev(arb(x))))) & (((Cauchy_to_Re(Ras_ABS(arb(x))) = x) & (Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x)))) = Cauchy_to_Re(Ras_Rev(arb(x))))) imp Ra_eqseq(arb(x),Ra0Seq))
	Use_def(R_Rev) ==> R_Rev(x) = Cauchy_to_Re(Ras_Rev(arb(x)))
	EQUAL ==> Stat3: ((Cauchy_to_Re(Ras_ABS(arb(x))) = x) or (Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x)))) = R_Rev(x))) & (((Cauchy_to_Re(Ras_ABS(arb(x))) = x) & (Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x)))) = R_Rev(x))) imp (x = R_0))
	Suppose ==> Cauchy_to_Re(Ras_ABS(arb(R_Rev(x)))) /= Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x))))
		(x,x)-->T613(*) ==> R_Rev(x) in Re
		(R_Rev(x))-->T611(Stat3*) ==> arb(R_Rev(x)) in RaCauchy
		(arb(R_Rev(x)),arb(R_Rev(x)))-->T556(Stat3*) ==> Ras_ABS(arb(R_Rev(x))) in RaCauchy
		(Ras_Rev(arb(x)),Ras_Rev(arb(x)))-->T556(Stat2,Stat2*) ==> Ras_ABS(Ras_Rev(arb(x))) in RaCauchy
		(Ras_ABS(arb(R_Rev(x))),Ras_ABS(Ras_Rev(arb(x))))-->T610(Stat3*) ==> (not Ra_eqseq(Ras_ABS(arb(R_Rev(x))),Ras_ABS(Ras_Rev(arb(x)))))
		(arb(R_Rev(x)),Ras_Rev(arb(x)))-->T576(Stat2*) ==> (not Ra_eqseq(arb(R_Rev(x)),Ras_Rev(arb(x))))
		(arb(R_Rev(x)),Ras_Rev(arb(x)))-->T610(Stat2*) ==> Stat4: Cauchy_to_Re(arb(R_Rev(x))) /= Cauchy_to_Re(Ras_Rev(arb(x)))
		x-->T661(*) ==> Cauchy_to_Re(arb(R_Rev(x))) = R_Rev(x)
	Use_def(R_Rev)(Stat4*) ==> false; Discharge ==> Stat5: Cauchy_to_Re(Ras_ABS(arb(R_Rev(x)))) = Cauchy_to_Re(Ras_ABS(Ras_Rev(arb(x))))
--
-- The sought contradiction now follows, from the very definition of the non-negativity predicate.
--
--??Use_def(R_is_nonneg)(Stat5*) ==> false; Discharge ==> QED
	Use_def(R_is_nonneg) ==> Stat6: (R_is_nonneg(x) eq (Cauchy_to_Re(Ras_ABS(arb(x))) = x)) & (R_is_nonneg(R_Rev(x)) eq (Cauchy_to_Re(Ras_ABS(arb(R_Rev(x)))) = R_Rev(x)))
(Stat3,Stat5,Stat6,Stat1*)Discharge ==> QED
--
Theorem 664: [Each non-negative rational Cauchy sequences is equivalent to its own absolute value] (X in Re) imp (R_is_nonneg(X) eq Ra_eqseq(arb(X),Ras_ABS(arb(X)))). Proof:
Suppose_not(x0) ==> AUTO
	Use_def(R_is_nonneg)(*) ==> Stat1: (x0 in Re) & ((Cauchy_to_Re(Ras_ABS(arb(x0))) = x0) neq Ra_eqseq(arb(x0),Ras_ABS(arb(x0))))
	x0-->T611(*) ==> Stat2: (arb(x0) in RaCauchy) & (Cauchy_to_Re(arb(x0)) = x0)
	(arb(x0),arb(x0))-->T556(Stat2*) ==> Ras_ABS(arb(x0)) in RaCauchy
(arb(x0),Ras_ABS(arb(x0)))-->T610(*) ==> false; Discharge ==> QED
--
Theorem 665: [The sum of two non-negative rational Cauchy sequences is equivalent to its own absolute value] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) imp Ra_eqseq(arb(X) Ras_PLUS arb(Y),Ras_ABS(arb(X) Ras_PLUS arb(Y))). Proof+:
Suppose_not(x0,y0) ==> AUTO
--
-- Reasoning by contradiction, we assume that $x0,y0$ are a counterexample
-- to the assertion of this theorem.
--
	x0-->T611(*) ==> Stat1: arb(x0) in RaCauchy
	y0-->T611(*) ==> Stat2: arb(y0) in RaCauchy
	(arb(x0),arb(y0))-->T556(Stat1*) ==> Stat3: ((arb(x0) Ras_PLUS arb(y0)) in RaCauchy) & (Ras_ABS(arb(x0)) in RaCauchy)
	(arb(x0) Ras_PLUS arb(y0),arb(x0) Ras_PLUS arb(y0))-->T556(Stat3*) ==> Ras_ABS(arb(x0) Ras_PLUS arb(y0)) in RaCauchy
	()-->T545 ==> AUTO
	T539(Stat1*) ==> Stat4: {Ra0Seq,arb(x0),arb(y0),arb(x0) Ras_PLUS arb(y0),Ras_ABS(arb(x0)),Ras_ABS(arb(x0) Ras_PLUS arb(y0))} incin RaSeq
--
-- One trivial case can be discarded immediately: in a counterample $x0,y0$ to the assertion of this
-- theorem, the rational Cauchy sequence $arb(y0)$ cannot be equivalent to $Ra0Seq$.
--
	Suppose ==> Ra_eqseq(arb(y0),Ra0Seq)
		(arb(x0),arb(x0))-->T607(Stat1*) ==> Ra_eqseq(arb(x0),arb(x0))
		(arb(x0),arb(x0),arb(y0),Ra0Seq)-->T572(Stat1*) ==> Stat5: Ra_eqseq(arb(x0) Ras_PLUS arb(y0),arb(x0) Ras_PLUS Ra0Seq)
		(arb(x0))-->T605(Stat4,Stat4*) ==> Stat6: (arb(x0) Ras_PLUS Ra0Seq) = arb(x0)
		EQUAL(Stat5) ==> Stat7: Ra_eqseq(arb(x0) Ras_PLUS arb(y0),arb(x0))
		x0-->T664(*) ==> Ra_eqseq(arb(x0),Ras_ABS(arb(x0)))
		(arb(x0) Ras_PLUS arb(y0),arb(x0),Ras_ABS(arb(x0)))-->T553(Stat4*) ==> Ra_eqseq(Ras_ABS(arb(x0)),arb(x0) Ras_PLUS arb(y0))
		(arb(x0) Ras_PLUS arb(y0),arb(x0) Ras_PLUS Ra0Seq)-->T576(Stat3,Stat5,Stat1,Stat6*) ==> Ra_eqseq(Ras_ABS(arb(x0) Ras_PLUS arb(y0)),Ras_ABS(arb(x0) Ras_PLUS Ra0Seq))
		EQUAL(Stat5) ==> Stat8: Ra_eqseq(Ras_ABS(arb(x0) Ras_PLUS Ra0Seq),arb(x0) Ras_PLUS arb(y0)) &
			(Ras_ABS(arb(x0) Ras_PLUS Ra0Seq) = Ras_ABS(arb(x0)))
		(Stat3,Stat8*)ELEM ==> Ras_ABS(arb(x0) Ras_PLUS Ra0Seq) in RaCauchy
	(Ras_ABS(arb(x0) Ras_PLUS arb(y0)),Ras_ABS(arb(x0) Ras_PLUS Ra0Seq),arb(x0) Ras_PLUS arb(y0))-->T553(*) ==> false; Discharge ==> Stat9: (not Ra_eqseq(arb(y0),Ra0Seq))
--
-- Another trivial case can be discarded arguing in an entirely analogous fashion:
-- in a counterample $x0,y0$ to the assertion of this theorem, the rational Cauchy sequence
-- $arb(x0)$ cannot be equivalent to $Ra0Seq$.
--
	(arb(y0),arb(y0))-->T556(Stat2*) ==> Stat10: Ras_ABS(arb(y0)) in RaCauchy
	T539(Stat10*) ==> Stat11: Ras_ABS(arb(y0)) in RaSeq
	Suppose ==> Ra_eqseq(arb(x0),Ra0Seq)
		(arb(y0),arb(y0))-->T607(Stat1*) ==> Ra_eqseq(arb(y0),arb(y0))
		(arb(x0),Ra0Seq,arb(y0),arb(y0))-->T572(Stat1*) ==> Stat12: Ra_eqseq(arb(x0) Ras_PLUS arb(y0),Ra0Seq Ras_PLUS arb(y0))
		(Ra0Seq,arb(y0))-->T578(Stat4,Stat4*) ==> Stat13: (Ra0Seq Ras_PLUS arb(y0)) = (arb(y0) Ras_PLUS Ra0Seq)
		(arb(y0))-->T605(Stat4,Stat4*) ==> Stat14: (arb(y0) Ras_PLUS Ra0Seq) = arb(y0)
		EQUAL(Stat12) ==> Stat15: Ra_eqseq(arb(x0) Ras_PLUS arb(y0),arb(y0))
		y0-->T664(*) ==> Ra_eqseq(arb(y0),Ras_ABS(arb(y0)))
		(arb(x0) Ras_PLUS arb(y0),arb(y0),Ras_ABS(arb(y0)))-->T553(Stat4*) ==> Ra_eqseq(Ras_ABS(arb(y0)),arb(x0) Ras_PLUS arb(y0))
		(arb(x0) Ras_PLUS arb(y0),Ra0Seq Ras_PLUS arb(y0))-->T576(Stat3,Stat13,Stat14,Stat2,Stat12*) ==> Ra_eqseq(Ras_ABS(arb(x0) Ras_PLUS arb(y0)),Ras_ABS(Ra0Seq Ras_PLUS arb(y0)))
		EQUAL(Stat12) ==> Stat16: Ra_eqseq(Ras_ABS(Ra0Seq Ras_PLUS arb(y0)),arb(x0) Ras_PLUS arb(y0)) &
			(Ras_ABS(Ra0Seq Ras_PLUS arb(y0)) = Ras_ABS(arb(y0)))
		(Stat10*)ELEM ==> Ras_ABS(Ra0Seq Ras_PLUS arb(y0)) in RaCauchy
	(Ras_ABS(arb(x0) Ras_PLUS arb(y0)),Ras_ABS(Ra0Seq Ras_PLUS arb(y0)),arb(x0) Ras_PLUS arb(y0))-->T553(*) ==> false; Discharge ==> Stat17: (not Ra_eqseq(arb(x0),Ra0Seq))
--
-- Knowing that neither of $arb(x0),arb(y0)$ can be equivalent to $Ra0Seq$, we can now
-- exploit Theorem 598 to pick positive real numbers $eps0,eps1$ and unsigned integers
-- $n0,n1$ so that all components of $arb(x0)$ which lie beyond the $n0$-th component
-- have an absolute value greater than $eps0$ and they all have the same sign; and, likewise,
-- all components of $arb(y0)$ which lie beyond the $n1$-th component
-- have an absolute value greater than $eps1$ and they all have the same sign.
--
	(arb(x0))-->T598(Stat1,Stat17*) ==> Stat18: (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
			(FORALL i in (Za - n) | (Ra_ABS((arb(x0))~[i]) Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n]) Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) ))
	(eps0,n0)-->Stat18(Stat18*) ==> (eps0 in Ra) & (n0 in Za) & (eps0 Ra_GT Ra_0) &
			Stat19: (FORALL i in (Za - n0) | (Ra_ABS((arb(x0))~[i]) Ra_GT eps0) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n0]) Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) )
	(arb(y0))-->T598(Stat2,Stat9*) ==> Stat20: (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
			(FORALL i in (Za - n) | (Ra_ABS((arb(y0))~[i]) Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n]) Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) ))
	(eps1,n1)-->Stat20(Stat20*) ==> (eps1 in Ra) & (n1 in Za) & (eps1 Ra_GT Ra_0) &
			Stat21: (FORALL i in (Za - n1) | (Ra_ABS((arb(y0))~[i]) Ra_GT eps1) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n1]) Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) )
--
-- Indicating by $n$ the greater of $n0,n1$ and by $eps$ the smaller of
-- $eps0,eps1$, we hence have that all components of $arb(x0)$ which lie beyond the
-- $n$-th component have an absolute value greater than $eps$ and they all have
-- the same sign; and, likewise, all components of $arb(y0)$ which lie beyond the
-- $n$-th component have an absolute value greater than $eps$ and they all have
-- the same sign.
--
	Loc_def ==> Stat22: n = Un({n0,n1})
	(n0,n1)-->T202(Stat22*) ==> Finite({n0,n1})
	({n0,n1})-->T320(Stat18*) ==> Un({n0,n1}) in Za
	(n0,n1)-->T106(Stat22*) ==> Stat23: (n0 incin n) & (n1 incin n)
	EQUAL(Stat22) ==> Stat24: n in Za
	n-->T237(Stat24*) ==> Stat25: (not Finite(Za - n))
	Loc_def ==> Stat26: eps = if eps1 Ra_GT eps0 then eps0 else eps1 end if
	Suppose ==> not((eps in Ra) & (eps Ra_GT Ra_0))
		Suppose ==> eps1 Ra_GT eps0
			(Stat26*)ELEM ==> eps = eps0
		EQUAL(Stat18*) ==> false; Discharge ==> not(eps1 Ra_GT eps0)
		(Stat26*)ELEM ==> eps = eps1
	EQUAL(Stat20*) ==> false; Discharge ==> Stat27: (eps in Ra) & (eps Ra_GT Ra_0)
	Ra_0-->T451(Stat27*) ==> Stat28: Ra_0 in Ra
	Suppose ==> Stat29: not(FORALL i in (Za - n) | (Ra_ABS((arb(x0))~[i]) Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n0]) Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) )
		i0-->Stat29(Stat22*) ==> (i0 in (Za - n0)) & (not((Ra_ABS((arb(x0))~[i0]) Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i0]) = if (((arb(x0))~[n0]) Ra_GE Ra_0) then ((arb(x0))~[i0]) else Ra_Rev((arb(x0))~[i0]) end if)))
		i0-->Stat19(Stat29*) ==> Stat30: (Ra_ABS((arb(x0))~[i0]) Ra_GT eps0) & (not(Ra_ABS((arb(x0))~[i0]) Ra_GT eps))
		Suppose ==> eps1 Ra_GT eps0
			(Stat26*)ELEM ==> eps = eps0
		EQUAL(Stat30*) ==> false; Discharge ==> (not(eps1 Ra_GT eps0)) & (eps = eps1)
		EQUAL(Stat30*) ==> (not(Ra_ABS((arb(x0))~[i0]) Ra_GT eps1))
		(arb(x0),i0)-->T540(Stat4*) ==> ((arb(x0))~[i0]) in Ra
		((arb(x0))~[i0])-->T527(Stat30*) ==> Ra_ABS((arb(x0))~[i0]) in Ra
		(eps1,eps0)-->T478(Stat18*) ==> eps0 Ra_GE eps1
	(Ra_ABS((arb(x0))~[i0]),eps0,eps1)-->T509(Stat18*) ==> false; Discharge ==> Stat31: (FORALL i in (Za - n) | (Ra_ABS((arb(x0))~[i]) Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n0]) Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) )
	Suppose ==> Stat32: not(FORALL i in (Za - n) | (Ra_ABS((arb(y0))~[i]) Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n1]) Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) )
		i1-->Stat32(Stat23,Stat23*) ==> (i1 in (Za - n1)) & (not((Ra_ABS((arb(y0))~[i1]) Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i1]) = if (((arb(y0))~[n1]) Ra_GE Ra_0) then ((arb(y0))~[i1]) else Ra_Rev((arb(y0))~[i1]) end if)))
		i1-->Stat21(Stat32*) ==> Stat33: (Ra_ABS((arb(y0))~[i1]) Ra_GT eps1) & (not(Ra_ABS((arb(y0))~[i1]) Ra_GT eps))
		Suppose ==> not(eps1 Ra_GT eps0)
			(Stat26*)ELEM ==> eps = eps1
		EQUAL(Stat33*) ==> false; Discharge ==> (eps1 Ra_GT eps0) & (eps = eps0)
		EQUAL(Stat33*) ==> (not(Ra_ABS((arb(y0))~[i1]) Ra_GT eps0))
		(arb(y0),i1)-->T540(Stat4*) ==> ((arb(y0))~[i1]) in Ra
		((arb(y0))~[i1])-->T527(Stat33*) ==> Ra_ABS((arb(y0))~[i1]) in Ra
	(Ra_ABS((arb(y0))~[i1]),eps1,eps0)-->T511(Stat18*) ==> false; Discharge ==> Stat34: (FORALL i in (Za - n) | (Ra_ABS((arb(y0))~[i]) Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n1]) Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) )
--
-- Note that in both cases "the same sign" actually means "positive sign",
-- as a consequence of $arb(x0)$ and $arb(y0)$ being non-negative.
--
	Use_def(R_is_nonneg)(*) ==> Stat35: (Cauchy_to_Re(Ras_ABS(arb(x0))) = x0) & (Cauchy_to_Re(Ras_ABS(arb(y0))) = y0)
	T525 ==> Stat36: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &
			Stat37: 	(FORALL x | (x in Ra) imp (x Ra_LE x))
	Suppose ==> Stat38: not(((eps Ra_PLUS eps) in Ra) & ((eps Ra_PLUS eps) Ra_GT eps))
		(eps,eps)-->T445(Stat27,Stat27*) ==> (eps Ra_PLUS eps) in Ra
		eps-->Stat37(Stat27,Stat27*) ==> eps Ra_LE eps
		(eps,eps)-->T473(Stat38*) ==> eps Ra_GE eps
		(eps,eps,eps,Ra_0)-->T504(Stat27*) ==> (eps Ra_PLUS eps) Ra_GT (eps Ra_PLUS Ra_0)
		eps-->T451(Stat27*) ==> (eps Ra_PLUS Ra_0) = eps
	EQUAL(Stat38) ==> false; Discharge ==> Stat39: ((eps Ra_PLUS eps) in Ra) & ((eps Ra_PLUS eps) Ra_GT eps)
--
	Suppose ==> Stat40: not(((arb(x0))~[n0]) Ra_GE Ra_0)
--
-- On the one hand, in fact, as far as $(arb(x0))~[n0]$ is concerned, if we assume that the sign
-- is negative then, by expanding the definition of $R_is_nonneg(x0)$ in the initial
-- definition, we get the equivalence of $Ras_ABS(arb(x0))$ with $arb(x0)$,
-- and hence the finiteness of the set
--	${x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps}$.
--
		x0-->T611(*) ==> Stat41: Cauchy_to_Re(Ras_ABS(arb(x0))) = Cauchy_to_Re(arb(x0))
		(Ras_ABS(arb(x0)),arb(x0))-->T610(Stat1,Stat3,Stat41*) ==> Stat42: Ra_eqseq(Ras_ABS(arb(x0)),arb(x0))
		(Ras_ABS(arb(x0)),arb(x0))-->T541(Stat4,Stat42*) ==> Stat43: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps}))
		eps-->Stat43(Stat27,Stat27*) ==> Stat44: Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps})
--?		Set_monot(Stat44*) ==> {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps} incin {x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps}
		Set_monot(Stat44) ==> {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps} incin {x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps}
		({x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps},{x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps})-->T189(Stat43*) ==> Stat45: Finite({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps})
--
-- As a consequence, there is an $i2$ no smaller than $n$ in $Za$ satisfying
--	$not(Ra_ABS(((Ras_ABS(arb(x0)))~[i2]) Ra_MINUS ((arb(x0))~[i2])) Ra_GT eps)$.
-- By the above statement Stat31, such $i2$ must also satisfy the inequality
--	$(Ra_ABS((arb(x0))~[i2]) Ra_GT eps) & (Ra_ABS((arb(x0))~[i2]) = Ra_Rev((arb(x0))~[i2]))$.
--
		Suppose ==> Stat46: (FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[i]) Ra_MINUS ((arb(x0))~[i])) Ra_GT eps)
			Suppose ==> Stat47: {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps} incs (Za - n)
			({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps},Za - n)-->T189(Stat47,Stat25,Stat45*) ==> false; Discharge ==> Stat48: not({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps} incs (Za - n))
			i4-->Stat48(Stat48*) ==> (i4 in (Za - n)) & Stat49: (i4 notin {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps})
			i4-->Stat46(Stat48*) ==> Ra_ABS(((Ras_ABS(arb(x0)))~[i4]) Ra_MINUS ((arb(x0))~[i4])) Ra_GT eps
		i4-->Stat49(Stat48*) ==> false; Discharge ==> Stat50: not(FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[i]) Ra_MINUS ((arb(x0))~[i])) Ra_GT eps)
		i2-->Stat50(Stat50*) ==> Stat51: (i2 in (Za - n)) & (not(Ra_ABS(((Ras_ABS(arb(x0)))~[i2]) Ra_MINUS ((arb(x0))~[i2])) Ra_GT eps))
		i2-->Stat31(Stat40*) ==> (Ra_ABS((arb(x0))~[i2]) Ra_GT eps) & (Ra_ABS((arb(x0))~[i2]) = Ra_Rev((arb(x0))~[i2]))
--
-- Therefore, taking the definitions of $Ras_ARB(_)$ and of $_ Ra_MINUS _$
-- into account, we get that
--	$not(Ra_Rev(Ra_ABS((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2])) Ra_GT eps)$,
-- where $Ra_Rev((arb(x0))~[i2])$ exceeds the positive number $eps$.
--
		Use_def(Ra_MINUS)(Stat50*) ==> (((Ras_ABS(arb(x0)))~[i2]) Ra_MINUS ((arb(x0))~[i2])) = (((Ras_ABS(arb(x0)))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2]))
		(arb(x0),arb(x0),i2)-->T555(Stat51,Stat4*) ==> ((Ras_ABS(arb(x0)))~[i2]) = Ra_ABS((arb(x0))~[i2])
		EQUAL(Stat51) ==> (Ra_Rev((arb(x0))~[i2]) Ra_GT eps) & (not(Ra_ABS(Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2])) Ra_GT eps))
		(arb(x0),i2)-->T540(Stat4,Stat51*) ==> ((arb(x0))~[i2]) in Ra
		((arb(x0))~[i2])-->T452(Stat51*) ==> Ra_Rev((arb(x0))~[i2]) in Ra
		(Ra_Rev((arb(x0))~[i2]),eps,Ra_0)-->T498(Stat27*) ==> Ra_Rev((arb(x0))~[i2]) Ra_GT Ra_0
		(Ra_Rev((arb(x0))~[i2]))-->T482(Stat51*) ==> Ra_is_nonneg(Ra_Rev((arb(x0))~[i2]))
		(Ra_Rev((arb(x0))~[i2]),Ra_Rev((arb(x0))~[i2]))-->T469(Stat51*) ==> Ra_is_nonneg(Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2]))
		(Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2]))-->Stat36(Stat51) ==> Ra_ABS(Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2])) = (Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2]))
		EQUAL(Stat51) ==> Stat52: not(Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2]) Ra_GT eps)
		(Ra_Rev((arb(x0))~[i2]),eps)-->T473(Stat51*) ==> Ra_Rev((arb(x0))~[i2]) Ra_GE eps
		(Ra_Rev((arb(x0))~[i2]),eps,Ra_Rev((arb(x0))~[i2]),eps)-->T504(Stat27*) ==> Stat53: (Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2])) Ra_GT (eps Ra_PLUS eps)
		(Ra_Rev((arb(x0))~[i2]),Ra_Rev((arb(x0))~[i2]))-->T445(Stat51*) ==> Stat54: (Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2])) in Ra
	(Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2]),eps Ra_PLUS eps,eps)-->T498(Stat27,Stat39,Stat54,Stat53,Stat52*) ==> false; Discharge ==> Stat55: ((arb(x0))~[n0]) Ra_GE Ra_0
--
-- On the other hand, concerning $(arb(y0))~[n1]$, we can argue in an entirely
-- analogous fashion to draw a contradiction from the temporary assumption that
-- this quantity is negative.
--
	Suppose ==> Stat56: not(((arb(y0))~[n1]) Ra_GE Ra_0)
		y0-->T611(*) ==> Stat57: Cauchy_to_Re(Ras_ABS(arb(y0))) = Cauchy_to_Re(arb(y0))
		(Ras_ABS(arb(y0)),arb(y0))-->T610(Stat2,Stat10,Stat57*) ==> Stat58:Ra_eqseq(Ras_ABS(arb(y0)),arb(y0))
		(Ras_ABS(arb(y0)),arb(y0))-->T541(Stat4,Stat11,Stat58*) ==> Stat59: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps}))
		eps-->Stat59(Stat27,Stat27*) ==> Stat60: Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps})
		Set_monot(Stat60) ==> {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps} incin {x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps}
		({x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps},{x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps})-->T189(Stat60*) ==> Stat61: Finite({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps})
		Suppose ==> Stat62: (FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[i]) Ra_MINUS ((arb(y0))~[i])) Ra_GT eps)
			Suppose ==> Stat63: {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps} incs (Za - n)
			({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps},Za - n)-->T189(Stat63,Stat25,Stat61*) ==> false; Discharge ==> Stat64: not({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps} incs (Za - n))
			i5-->Stat64(Stat64*) ==> (i5 in (Za - n)) & Stat65: (i5 notin {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps})
			i5-->Stat62(Stat64*) ==> Ra_ABS(((Ras_ABS(arb(y0)))~[i5]) Ra_MINUS ((arb(y0))~[i5])) Ra_GT eps
		i5-->Stat65(Stat64*) ==> false; Discharge ==> Stat66: not(FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[i]) Ra_MINUS ((arb(y0))~[i])) Ra_GT eps)
		i3-->Stat66(Stat66*) ==> Stat67: (i3 in (Za - n)) & (not(Ra_ABS(((Ras_ABS(arb(y0)))~[i3]) Ra_MINUS ((arb(y0))~[i3])) Ra_GT eps))
		i3-->Stat34(Stat56*) ==> (Ra_ABS((arb(y0))~[i3]) Ra_GT eps) & (Ra_ABS((arb(y0))~[i3]) = Ra_Rev((arb(y0))~[i3]))
		Use_def(Ra_MINUS)(Stat66*) ==> (((Ras_ABS(arb(y0)))~[i3]) Ra_MINUS ((arb(y0))~[i3])) = (((Ras_ABS(arb(y0)))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3]))
		(arb(y0),arb(y0),i3)-->T555(Stat67,Stat4*) ==> ((Ras_ABS(arb(y0)))~[i3]) = Ra_ABS((arb(y0))~[i3])
		EQUAL(Stat67) ==> (Ra_Rev((arb(y0))~[i3]) Ra_GT eps) & (not(Ra_ABS(Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3])) Ra_GT eps))
		(arb(y0),i3)-->T540(Stat4,Stat67*) ==> ((arb(y0))~[i3]) in Ra
		((arb(y0))~[i3])-->T452(Stat67*) ==> Ra_Rev((arb(y0))~[i3]) in Ra
		(Ra_Rev((arb(y0))~[i3]),eps,Ra_0)-->T498(Stat27*) ==> Ra_Rev((arb(y0))~[i3]) Ra_GT Ra_0
		(Ra_Rev((arb(y0))~[i3]))-->T482(Stat67*) ==> Ra_is_nonneg(Ra_Rev((arb(y0))~[i3]))
		(Ra_Rev((arb(y0))~[i3]),Ra_Rev((arb(y0))~[i3]))-->T469(Stat67*) ==> Ra_is_nonneg(Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3]))
		(Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3]))-->Stat36(Stat67*) ==> Ra_ABS(Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3])) = (Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3]))
		EQUAL(Stat67) ==> Stat68: not(Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3]) Ra_GT eps)
		(Ra_Rev((arb(y0))~[i3]),eps)-->T473(Stat67*) ==> Ra_Rev((arb(y0))~[i3]) Ra_GE eps
		(Ra_Rev((arb(y0))~[i3]),eps,Ra_Rev((arb(y0))~[i3]),eps)-->T504(Stat27*) ==> Stat69: (Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3])) Ra_GT (eps Ra_PLUS eps)
		(Ra_Rev((arb(y0))~[i3]),Ra_Rev((arb(y0))~[i3]))-->T445(Stat67*) ==> Stat70: (Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3])) in Ra
	(Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3]),eps Ra_PLUS eps,eps)-->T498(Stat39,Stat27,Stat70,Stat69,Stat68*) ==> false; Discharge ==> Stat71: ((arb(y0))~[n1]) Ra_GE Ra_0
--
-- Now, thanks to Theorem 541, we can reformulate the condition for sequence
-- inequivalence which is part of our initial hypothesis as the condition that the set
--	${i : i in Za | Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i])) Ra_GT eps3}$
-- is infinite for a suitable positive rational number $eps3$.
--
	(arb(x0) Ras_PLUS arb(y0),Ras_ABS(arb(x0) Ras_PLUS arb(y0)))-->T541(*) ==> Stat72: not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({i : i in Za | Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i])) Ra_GT eps}))
	eps3-->Stat72(Stat72*) ==> Stat73: (eps3 in Ra) & (eps3 Ra_GT Ra_0) &
		(not Finite({i : i in Za | Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i])) Ra_GT eps3}))
--
-- However, it is easy to see that the quantity
--	$Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[x]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0))~[x]))$
-- is null for every integer $i$ greater than or equal to $n$, and hence the set under
-- examination must be a subset of $n$ which is finite. Hence it will be finite in its
-- turn, which leads to a contradiction proving the desired assertion.
--
	(n,{i : i in Za | Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i])) Ra_GT eps3})-->T189(Stat24,Stat73*) ==> Stat74: not(n incs {i : i in Za | Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i])) Ra_GT eps3})
	i6-->Stat74(Stat74*) ==> Stat75: (i6 in {i in Za | Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i])) Ra_GT eps3}) & (i6 notin n)
	()-->Stat76(Stat75*) ==> Stat76: (i6 in (Za - n)) & (Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6])) Ra_GT eps3)
	Suppose ==> ((arb(x0) Ras_PLUS arb(y0))~[i6]) = ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6])
		(arb(x0) Ras_PLUS arb(y0),i6)-->T540(Stat4,Stat76*) ==> ((arb(x0) Ras_PLUS arb(y0))~[i6]) in Ra
		(arb(x0) Ras_PLUS arb(y0),arb(x0) Ras_PLUS arb(y0))-->T554(Stat4,Stat4*) ==> (Ras_ABS(arb(x0) Ras_PLUS arb(y0))) in RaSeq
		(Ras_ABS(arb(x0) Ras_PLUS arb(y0)),i6)-->T540(Stat76*) ==> ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6]) in Ra
		((arb(x0) Ras_PLUS arb(y0))~[i6],(Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6])-->T454(Stat76*) ==> (((arb(x0) Ras_PLUS arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6])) in Ra
		(((arb(x0) Ras_PLUS arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6]))-->T527(Stat76*) ==> Stat77: Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6])) in Ra
		(Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6])),eps3,Ra_0)-->T498(Stat76,Stat73,Stat77,Stat28*) ==> Stat78: Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6])) Ra_GT Ra_0
		(Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6])),Ra_0)-->T473(Stat78,Stat28*) ==> Stat79: Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6])) /= Ra_0
		((arb(x0) Ras_PLUS arb(y0))~[i6])-->T452(Stat76*) ==> ((((arb(x0) Ras_PLUS arb(y0))~[i6])) Ra_PLUS Ra_Rev(((arb(x0) Ras_PLUS arb(y0))~[i6]))) = Ra_0
        	T465(Stat79*) ==> Ra_is_nonneg(Ra_0)
	        T525(Stat79*) ==> Stat80: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
        	Ra_0-->Stat80(Stat79*) ==> Ra_ABS(Ra_0) = Ra_0
		EQUAL(Stat76) ==> Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i6]) Ra_PLUS Ra_Rev((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6])) = Ra_0
		Use_def(Ra_MINUS)(Stat79*) ==> Ra_ABS(((arb(x0) Ras_PLUS arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6])) = Ra_0
	(Stat79*)ELEM ==> false; Discharge ==> Stat81: ((arb(x0) Ras_PLUS arb(y0))~[i6]) /= ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6])
	(arb(x0),arb(y0),i6)-->T555(Stat4,Stat76*) ==> ((arb(x0) Ras_PLUS arb(y0))~[i6]) = (((arb(x0))~[i6]) Ra_PLUS ((arb(y0))~[i6]))
	(arb(x0) Ras_PLUS arb(y0),arb(x0) Ras_PLUS arb(y0),i6)-->T555(Stat4,Stat76*) ==> ((Ras_ABS(arb(x0) Ras_PLUS arb(y0)))~[i6]) = Ra_ABS((arb(x0) Ras_PLUS arb(y0))~[i6])
	EQUAL(Stat81) ==> Stat82: (((arb(x0))~[i6]) Ra_PLUS ((arb(y0))~[i6])) /= Ra_ABS(((arb(x0))~[i6]) Ra_PLUS ((arb(y0))~[i6]))
--
--
--
	Suppose ==> not((((arb(x0))~[i6]) in Ra) & Ra_is_nonneg(((arb(x0))~[i6])))
		(arb(x0),i6)-->T540(Stat4,Stat76*) ==> ((arb(x0))~[i6]) in Ra
		i6-->Stat31(Stat76,Stat55*) ==> Ra_ABS((arb(x0))~[i6]) = ((arb(x0))~[i6])
		((arb(x0))~[i6])-->T528(Stat82*) ==> ((arb(x0))~[i6]) Ra_GE Ra_0
	((arb(x0))~[i6])-->T482(Stat82*) ==> false; Discharge ==> (((arb(x0))~[i6]) in Ra) & Ra_is_nonneg(((arb(x0))~[i6]))
	Suppose ==> not((((arb(y0))~[i6]) in Ra) & Ra_is_nonneg(((arb(y0))~[i6])))
		(arb(y0),i6)-->T540(Stat4,Stat76*) ==> ((arb(y0))~[i6]) in Ra
		i6-->Stat34(Stat76,Stat71*) ==> Ra_ABS((arb(y0))~[i6]) = ((arb(y0))~[i6])
		((arb(y0))~[i6])-->T528(Stat82*) ==> ((arb(y0))~[i6]) Ra_GE Ra_0
	((arb(y0))~[i6])-->T482(Stat82*) ==> false; Discharge ==> (((arb(y0))~[i6]) in Ra) & Ra_is_nonneg(((arb(y0))~[i6]))
	((arb(x0))~[i6],(arb(y0))~[i6])-->T469(Stat82*) ==> Stat83: Ra_is_nonneg(((arb(x0))~[i6]) Ra_PLUS ((arb(y0))~[i6]))
	((arb(x0))~[i6],(arb(y0))~[i6])-->T445(Stat82*) ==> (((arb(x0))~[i6]) Ra_PLUS ((arb(y0))~[i6])) in Ra
	(((arb(x0))~[i6]) Ra_PLUS ((arb(y0))~[i6]))-->T482(Stat83*) ==> (((arb(x0))~[i6]) Ra_PLUS ((arb(y0))~[i6])) Ra_GE Ra_0
(((arb(x0))~[i6]) Ra_PLUS ((arb(y0))~[i6]))-->T528(Stat82*) ==> false; Discharge ==> QED
--
Theorem 666: [The product of two non-negative rational Cauchy sequences is equivalent to its own absolute value] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) imp Ra_eqseq(arb(X) Ras_TIMES arb(Y),Ras_ABS(arb(X) Ras_TIMES arb(Y))). Proof+:
Suppose_not(x0,y0) ==> AUTO
--
-- Reasoning by contradiction, we assume that $x0,y0$ are a counterexample
-- to the assertion of this theorem.
--
	x0-->T611(*) ==> Stat1: arb(x0) in RaCauchy
	y0-->T611(*) ==> Stat2: arb(y0) in RaCauchy
	(arb(x0),arb(y0))-->T556(Stat1*) ==> Stat3: Ras_ABS(arb(x0)) in RaCauchy
	(arb(x0),arb(y0))-->T561(Stat1*) ==> Stat4: (arb(x0) Ras_TIMES arb(y0)) in RaCauchy
	(arb(x0) Ras_TIMES arb(y0),arb(x0) Ras_TIMES arb(y0))-->T556(Stat3*) ==> Ras_ABS(arb(x0) Ras_TIMES arb(y0)) in RaCauchy
	()-->T545 ==> AUTO
	T539(Stat1*) ==> Stat5: {Ra0Seq,arb(x0),arb(y0),arb(x0) Ras_TIMES arb(y0),Ras_ABS(arb(x0)),Ras_ABS(arb(x0) Ras_TIMES arb(y0))} incin RaSeq
--
-- One trivial case can be discarded immediately: in a counterample $x0,y0$ to the assertion of this
-- theorem, the rational Cauchy sequence $arb(y0)$ cannot be equivalent to $Ra0Seq$.
--
	Suppose ==> Ra_eqseq(arb(x0) Ras_TIMES arb(y0),Ra0Seq)
		()-->T596 ==> AUTO
		Ra0Seq-->T546(Stat5,Stat5*) ==> Ra_eqseq(Ra0Seq,Ra0Seq)
		EQUAL(Stat5) ==> Ra_eqseq(Ras_ABS(Ra0Seq),Ra0Seq)
		(arb(x0) Ras_TIMES arb(y0))-->T597(Stat4*) ==> Ra_eqseq(Ras_ABS(arb(x0) Ras_TIMES arb(y0)),Ra0Seq)
		(Ras_ABS(arb(x0) Ras_TIMES arb(y0)),Ra0Seq,Ra0Seq)-->T553(Stat5*) ==> Ra_eqseq(Ra0Seq,Ras_ABS(arb(x0) Ras_TIMES arb(y0)))
		(arb(x0) Ras_TIMES arb(y0),Ra0Seq,Ras_ABS(arb(x0) Ras_TIMES arb(y0)))-->T553(Stat5*) ==> Ra_eqseq(Ras_ABS(arb(x0) Ras_TIMES arb(y0)),arb(x0) Ras_TIMES arb(y0))
		(arb(x0) Ras_TIMES arb(y0))-->T546(Stat5,Stat5*) ==> Ra_eqseq(arb(x0) Ras_TIMES arb(y0),arb(x0) Ras_TIMES arb(y0))
	(Ras_ABS(arb(x0) Ras_TIMES arb(y0)),arb(x0) Ras_TIMES arb(y0),arb(x0) Ras_TIMES arb(y0))-->T553(*) ==> false; Discharge ==> (not Ra_eqseq(arb(x0) Ras_TIMES arb(y0),Ra0Seq))
	Suppose ==> Ra_eqseq(arb(y0),Ra0Seq)
		(arb(x0),arb(x0))-->T607(Stat1*) ==> Ra_eqseq(arb(x0),arb(x0))
		(arb(x0),arb(x0),arb(y0),Ra0Seq)-->T574(Stat1*) ==> Ra_eqseq(arb(x0) Ras_TIMES arb(y0),arb(x0) Ras_TIMES Ra0Seq)
		(arb(x0))-->T586(Stat5,Stat5*) ==> (arb(x0) Ras_TIMES Ra0Seq) = Ra0Seq
	EQUAL(Stat5) ==> false; Discharge ==>  Stat6: (not Ra_eqseq(arb(y0),Ra0Seq))
--
-- Another trivial case can be discarded arguing in an entirely analogous fashion:
-- in a counterample $x0,y0$ to the assertion of this theorem, the rational Cauchy sequence
-- $arb(x0)$ cannot be equivalent to $Ra0Seq$.
--
	(arb(y0),arb(y0))-->T556(Stat2*) ==> Stat7: Ras_ABS(arb(y0)) in RaCauchy
	T539(Stat7*) ==> Stat8: Ras_ABS(arb(y0)) in RaSeq
	Suppose ==> Ra_eqseq(arb(x0),Ra0Seq)
		(arb(y0),arb(y0))-->T607(Stat1*) ==> Ra_eqseq(arb(y0),arb(y0))
		(arb(x0),Ra0Seq,arb(y0),arb(y0))-->T574(Stat1*) ==> Ra_eqseq(arb(x0) Ras_TIMES arb(y0),Ra0Seq Ras_TIMES arb(y0))
		(arb(y0))-->T586(Stat5,Stat5*) ==> (arb(y0) Ras_TIMES Ra0Seq) = Ra0Seq
		(arb(y0),Ra0Seq)-->T579(Stat5,Stat5*) ==> (arb(y0) Ras_TIMES Ra0Seq) = (Ra0Seq Ras_TIMES arb(y0))
	EQUAL(Stat5) ==> false; Discharge ==> Stat9: (not Ra_eqseq(arb(x0),Ra0Seq))
--
-- Knowing that neither of $arb(x0),arb(y0)$ can be equivalent to $Ra0Seq$, we can now
-- exploit Theorem 598 to pick positive real numbers $eps0,eps1$ and unsigned integers
-- $n0,n1$ so that all components of $arb(x0)$ which lie beyond the $n0$-th component
-- have an absolute value greater than $eps0$ and they all have the same sign; and, likewise,
-- all components of $arb(y0)$ which lie beyond the $n1$-th component
-- have an absolute value greater than $eps1$ and they all have the same sign.
--
	(arb(x0))-->T598(Stat1,Stat9*) ==> Stat10: (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
			(FORALL i in (Za - n) | (Ra_ABS((arb(x0))~[i]) Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n]) Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) ))
	(eps0,n0)-->Stat10(Stat10*) ==> (eps0 in Ra) & (n0 in Za) & (eps0 Ra_GT Ra_0) &
			Stat11: (FORALL i in (Za - n0) | (Ra_ABS((arb(x0))~[i]) Ra_GT eps0) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n0]) Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) )
	(arb(y0))-->T598(Stat2,Stat6*) ==> Stat12: (EXISTS eps in Ra, n in Za | (eps Ra_GT Ra_0) &
			(FORALL i in (Za - n) | (Ra_ABS((arb(y0))~[i]) Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n]) Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) ))
	(eps1,n1)-->Stat12(Stat12*) ==> (eps1 in Ra) & (n1 in Za) & (eps1 Ra_GT Ra_0) &
			Stat13: (FORALL i in (Za - n1) | (Ra_ABS((arb(y0))~[i]) Ra_GT eps1) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n1]) Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) )
--
-- Indicating by $n$ the greater of $n0,n1$ and by $eps$ the smaller of
-- $eps0,eps1$, we hence have that all components of $arb(x0)$ which lie beyond the
-- $n$-th component have an absolute value greater than $eps$ and they all have
-- the same sign; and, likewise, all components of $arb(y0)$ which lie beyond the
-- $n$-th component have an absolute value greater than $eps$ and they all have
-- the same sign.
--
	Loc_def ==> Stat14: n = Un({n0,n1})
	(n0,n1)-->T202(Stat14*) ==> Finite({n0,n1})
	({n0,n1})-->T320(Stat10*) ==> Un({n0,n1}) in Za
	(n0,n1)-->T106(Stat14*) ==> Stat15: (n0 incin n) & (n1 incin n)
	EQUAL(Stat14) ==> Stat16: n in Za
	n-->T237(Stat16*) ==> Stat17: (not Finite(Za - n))
	Loc_def ==> Stat18: eps = if eps1 Ra_GT eps0 then eps0 else eps1 end if
	Suppose ==> not((eps in Ra) & (eps Ra_GT Ra_0))
		Suppose ==> eps1 Ra_GT eps0
			(Stat18*)ELEM ==> eps = eps0
		EQUAL(Stat10*) ==> false; Discharge ==> not(eps1 Ra_GT eps0)
		(Stat18*)ELEM ==> eps = eps1
	EQUAL(Stat12*) ==> false; Discharge ==> Stat19: (eps in Ra) & (eps Ra_GT Ra_0)
	Ra_0-->T451(Stat19*) ==> Stat20: Ra_0 in Ra
	Suppose ==> Stat21: not(FORALL i in (Za - n) | (Ra_ABS((arb(x0))~[i]) Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n0]) Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) )
		i0-->Stat21(Stat14*) ==> (i0 in (Za - n0)) & (not((Ra_ABS((arb(x0))~[i0]) Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i0]) = if (((arb(x0))~[n0]) Ra_GE Ra_0) then ((arb(x0))~[i0]) else Ra_Rev((arb(x0))~[i0]) end if)))
		i0-->Stat11(Stat21*) ==> Stat22: (Ra_ABS((arb(x0))~[i0]) Ra_GT eps0) & (not(Ra_ABS((arb(x0))~[i0]) Ra_GT eps))
		Suppose ==> eps1 Ra_GT eps0
			(Stat18*)ELEM ==> eps = eps0
		EQUAL(Stat22*) ==> false; Discharge ==> (not(eps1 Ra_GT eps0)) & (eps = eps1)
		EQUAL(Stat22*) ==> (not(Ra_ABS((arb(x0))~[i0]) Ra_GT eps1))
		(arb(x0),i0)-->T540(Stat5*) ==> ((arb(x0))~[i0]) in Ra
		((arb(x0))~[i0])-->T527(Stat22*) ==> Ra_ABS((arb(x0))~[i0]) in Ra
		(eps1,eps0)-->T478(Stat10*) ==> eps0 Ra_GE eps1
	(Ra_ABS((arb(x0))~[i0]),eps0,eps1)-->T509(Stat10*) ==> false; Discharge ==> Stat23: (FORALL i in (Za - n) | (Ra_ABS((arb(x0))~[i]) Ra_GT eps) &
			(Ra_ABS((arb(x0))~[i]) = if (((arb(x0))~[n0]) Ra_GE Ra_0) then ((arb(x0))~[i]) else Ra_Rev((arb(x0))~[i]) end if) )
	Suppose ==> Stat24: not(FORALL i in (Za - n) | (Ra_ABS((arb(y0))~[i]) Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n1]) Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) )
		i1-->Stat24(Stat15,Stat15*) ==> (i1 in (Za - n1)) & (not((Ra_ABS((arb(y0))~[i1]) Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i1]) = if (((arb(y0))~[n1]) Ra_GE Ra_0) then ((arb(y0))~[i1]) else Ra_Rev((arb(y0))~[i1]) end if)))
		i1-->Stat13(Stat24*) ==> Stat25: (Ra_ABS((arb(y0))~[i1]) Ra_GT eps1) & (not(Ra_ABS((arb(y0))~[i1]) Ra_GT eps))
		Suppose ==> not(eps1 Ra_GT eps0)
			(Stat18*)ELEM ==> eps = eps1
		EQUAL(Stat25*) ==> false; Discharge ==> (eps1 Ra_GT eps0) & (eps = eps0)
		EQUAL(Stat25*) ==> (not(Ra_ABS((arb(y0))~[i1]) Ra_GT eps0))
		(arb(y0),i1)-->T540(Stat5*) ==> ((arb(y0))~[i1]) in Ra
		((arb(y0))~[i1])-->T527(Stat25*) ==> Ra_ABS((arb(y0))~[i1]) in Ra
	(Ra_ABS((arb(y0))~[i1]),eps1,eps0)-->T511(Stat10*) ==> false; Discharge ==> Stat26: (FORALL i in (Za - n) | (Ra_ABS((arb(y0))~[i]) Ra_GT eps) &
			(Ra_ABS((arb(y0))~[i]) = if (((arb(y0))~[n1]) Ra_GE Ra_0) then ((arb(y0))~[i]) else Ra_Rev((arb(y0))~[i]) end if) )
--
-- Note that in both cases "the same sign" actually means "positive sign",
-- as a consequence of $arb(x0)$ and $arb(y0)$ being non-negative.
--
	Use_def(R_is_nonneg)(*) ==> Stat27: (Cauchy_to_Re(Ras_ABS(arb(x0))) = x0) & (Cauchy_to_Re(Ras_ABS(arb(y0))) = y0)
	T525 ==> Stat28: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &
			Stat29: 	(FORALL x | (x in Ra) imp (x Ra_LE x))
	Suppose ==> Stat30: not(((eps Ra_PLUS eps) in Ra) & ((eps Ra_PLUS eps) Ra_GT eps))
		(eps,eps)-->T445(Stat19,Stat19*) ==> (eps Ra_PLUS eps) in Ra
		eps-->Stat29(Stat19,Stat19*) ==> eps Ra_LE eps
		(eps,eps)-->T473(Stat30*) ==> eps Ra_GE eps
		(eps,eps,eps,Ra_0)-->T504(Stat19*) ==> (eps Ra_PLUS eps) Ra_GT (eps Ra_PLUS Ra_0)
		eps-->T451(Stat19*) ==> (eps Ra_PLUS Ra_0) = eps
	EQUAL(Stat30) ==> false; Discharge ==> Stat31: ((eps Ra_PLUS eps) in Ra) & ((eps Ra_PLUS eps) Ra_GT eps)
--
	Suppose ==> Stat32: not(((arb(x0))~[n0]) Ra_GE Ra_0)
--
-- On the one hand, in fact, as far as $(arb(x0))~[n0]$ is concerned, if we assume that the sign
-- is negative then, by expanding the definition of $R_is_nonneg(x0)$ in the initial
-- definition, we get the equivalence of $Ras_ABS(arb(x0))$ with $arb(x0)$,
-- and hence the finiteness of the set
--	${x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps}$.
--
		x0-->T611(*) ==> Stat33: Cauchy_to_Re(Ras_ABS(arb(x0))) = Cauchy_to_Re(arb(x0))
		(Ras_ABS(arb(x0)),arb(x0))-->T610(Stat1,Stat3,Stat33*) ==> Stat34: Ra_eqseq(Ras_ABS(arb(x0)),arb(x0))
		(Ras_ABS(arb(x0)),arb(x0))-->T541(Stat5,Stat34*) ==> Stat35: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps}))
		eps-->Stat35(Stat19,Stat19*) ==> Stat36: Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps})
		Set_monot(Stat36) ==> {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps} incin {x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps}
		({x : x in Za | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps},{x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps})-->T189(Stat35*) ==> Stat37: Finite({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps})
--
-- As a consequence, there is an $i2$ no smaller than $n$ in $Za$ satisfying
--	$not(Ra_ABS(((Ras_ABS(arb(x0)))~[i2]) Ra_MINUS ((arb(x0))~[i2])) Ra_GT eps)$.
-- By the above statement Stat23, such $i2$ must also satisfy the inequality
--	$(Ra_ABS((arb(x0))~[i2]) Ra_GT eps) & (Ra_ABS((arb(x0))~[i2]) = Ra_Rev((arb(x0))~[i2]))$.
--
		Suppose ==> Stat38: (FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[i]) Ra_MINUS ((arb(x0))~[i])) Ra_GT eps)
			Suppose ==> Stat39: {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps} incs (Za - n)
			({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps},Za - n)-->T189(Stat39,Stat17,Stat37*) ==> false; Discharge ==> Stat40: not({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps} incs (Za - n))
			i4-->Stat40(Stat40*) ==> (i4 in (Za - n)) & Stat41: (i4 notin {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[x]) Ra_MINUS ((arb(x0))~[x])) Ra_GT eps})
			i4-->Stat38(Stat40*) ==> Ra_ABS(((Ras_ABS(arb(x0)))~[i4]) Ra_MINUS ((arb(x0))~[i4])) Ra_GT eps
		i4-->Stat41(Stat40*) ==> false; Discharge ==> Stat42: not(FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(x0)))~[i]) Ra_MINUS ((arb(x0))~[i])) Ra_GT eps)
		i2-->Stat42(Stat42*) ==> Stat43: (i2 in (Za - n)) & (not(Ra_ABS(((Ras_ABS(arb(x0)))~[i2]) Ra_MINUS ((arb(x0))~[i2])) Ra_GT eps))
		i2-->Stat23(Stat32*) ==> (Ra_ABS((arb(x0))~[i2]) Ra_GT eps) & (Ra_ABS((arb(x0))~[i2]) = Ra_Rev((arb(x0))~[i2]))
--
-- Therefore, taking the definitions of $Ras_ARB(_)$ and of $_ Ra_MINUS _$
-- into account, we get that
--	$not(Ra_Rev(Ra_ABS((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2])) Ra_GT eps)$,
-- where $Ra_Rev((arb(x0))~[i2])$ exceeds the positive number $eps$.
--
		Use_def(Ra_MINUS)(Stat42*) ==> (((Ras_ABS(arb(x0)))~[i2]) Ra_MINUS ((arb(x0))~[i2])) = (((Ras_ABS(arb(x0)))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2]))
		(arb(x0),arb(x0),i2)-->T555(Stat43,Stat5*) ==> ((Ras_ABS(arb(x0)))~[i2]) = Ra_ABS((arb(x0))~[i2])
		EQUAL(Stat43) ==> (Ra_Rev((arb(x0))~[i2]) Ra_GT eps) & (not(Ra_ABS(Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2])) Ra_GT eps))
		(arb(x0),i2)-->T540(Stat5,Stat43*) ==> ((arb(x0))~[i2]) in Ra
		((arb(x0))~[i2])-->T452(Stat43*) ==> Ra_Rev((arb(x0))~[i2]) in Ra
		(Ra_Rev((arb(x0))~[i2]),eps,Ra_0)-->T498(Stat19*) ==> Ra_Rev((arb(x0))~[i2]) Ra_GT Ra_0
		(Ra_Rev((arb(x0))~[i2]))-->T482(Stat43*) ==> Ra_is_nonneg(Ra_Rev((arb(x0))~[i2]))
		(Ra_Rev((arb(x0))~[i2]),Ra_Rev((arb(x0))~[i2]))-->T469(Stat43*) ==> Ra_is_nonneg(Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2]))
		(Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2]))-->Stat28(Stat43) ==> Ra_ABS(Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2])) = (Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2]))
		EQUAL(Stat43) ==> Stat44: not(Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2]) Ra_GT eps)
		(Ra_Rev((arb(x0))~[i2]),eps)-->T473(Stat43*) ==> Ra_Rev((arb(x0))~[i2]) Ra_GE eps
		(Ra_Rev((arb(x0))~[i2]),eps,Ra_Rev((arb(x0))~[i2]),eps)-->T504(Stat19*) ==> Stat45: (Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2])) Ra_GT (eps Ra_PLUS eps)
		(Ra_Rev((arb(x0))~[i2]),Ra_Rev((arb(x0))~[i2]))-->T445(Stat43*) ==> Stat46: (Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2])) in Ra
	(Ra_Rev((arb(x0))~[i2]) Ra_PLUS Ra_Rev((arb(x0))~[i2]),eps Ra_PLUS eps,eps)-->T498(Stat19,Stat31,Stat46,Stat45,Stat44*) ==> false; Discharge ==> Stat47: ((arb(x0))~[n0]) Ra_GE Ra_0
--
-- On the other hand, concerning $(arb(y0))~[n1]$, we can argue in an entirely
-- analogous fashion to draw a contradiction from the temporary assumption that
-- this quantity is negative.
--
	Suppose ==> Stat48: not(((arb(y0))~[n1]) Ra_GE Ra_0)
		y0-->T611(*) ==> Stat49: Cauchy_to_Re(Ras_ABS(arb(y0))) = Cauchy_to_Re(arb(y0))
		(Ras_ABS(arb(y0)),arb(y0))-->T610(Stat2,Stat7,Stat49*) ==> Stat50:Ra_eqseq(Ras_ABS(arb(y0)),arb(y0))
		(Ras_ABS(arb(y0)),arb(y0))-->T541(Stat5,Stat8,Stat50*) ==> Stat51: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps}))
		eps-->Stat51(Stat19,Stat19*) ==> Stat52: Finite({x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps})
		Set_monot(Stat52) ==> {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps} incin {x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps}
		({x : x in Za | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps},{x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps})-->T189(Stat52*) ==> Stat53: Finite({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps})
		Suppose ==> Stat54: (FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[i]) Ra_MINUS ((arb(y0))~[i])) Ra_GT eps)
			Suppose ==> Stat55: {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps} incs (Za - n)
			({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps},Za - n)-->T189(Stat55,Stat17,Stat53*) ==> false; Discharge ==> Stat56: not({x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps} incs (Za - n))
			i5-->Stat56(Stat56*) ==> (i5 in (Za - n)) & Stat57: (i5 notin {x : x in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[x]) Ra_MINUS ((arb(y0))~[x])) Ra_GT eps})
			i5-->Stat54(Stat56*) ==> Ra_ABS(((Ras_ABS(arb(y0)))~[i5]) Ra_MINUS ((arb(y0))~[i5])) Ra_GT eps
		i5-->Stat57(Stat56*) ==> false; Discharge ==> Stat58: not(FORALL i in (Za - n) | Ra_ABS(((Ras_ABS(arb(y0)))~[i]) Ra_MINUS ((arb(y0))~[i])) Ra_GT eps)
		i3-->Stat58(Stat58*) ==> Stat59: (i3 in (Za - n)) & (not(Ra_ABS(((Ras_ABS(arb(y0)))~[i3]) Ra_MINUS ((arb(y0))~[i3])) Ra_GT eps))
		i3-->Stat26(Stat48*) ==> (Ra_ABS((arb(y0))~[i3]) Ra_GT eps) & (Ra_ABS((arb(y0))~[i3]) = Ra_Rev((arb(y0))~[i3]))
		Use_def(Ra_MINUS)(Stat58*) ==> (((Ras_ABS(arb(y0)))~[i3]) Ra_MINUS ((arb(y0))~[i3])) = (((Ras_ABS(arb(y0)))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3]))
		(arb(y0),arb(y0),i3)-->T555(Stat59,Stat5*) ==> ((Ras_ABS(arb(y0)))~[i3]) = Ra_ABS((arb(y0))~[i3])
		EQUAL(Stat59) ==> (Ra_Rev((arb(y0))~[i3]) Ra_GT eps) & (not(Ra_ABS(Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3])) Ra_GT eps))
		(arb(y0),i3)-->T540(Stat5,Stat59*) ==> ((arb(y0))~[i3]) in Ra
		((arb(y0))~[i3])-->T452(Stat59*) ==> Ra_Rev((arb(y0))~[i3]) in Ra
		(Ra_Rev((arb(y0))~[i3]),eps,Ra_0)-->T498(Stat19*) ==> Ra_Rev((arb(y0))~[i3]) Ra_GT Ra_0
		(Ra_Rev((arb(y0))~[i3]))-->T482(Stat59*) ==> Ra_is_nonneg(Ra_Rev((arb(y0))~[i3]))
		(Ra_Rev((arb(y0))~[i3]),Ra_Rev((arb(y0))~[i3]))-->T469(Stat59*) ==> Ra_is_nonneg(Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3]))
		(Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3]))-->Stat28(Stat59*) ==> Ra_ABS(Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3])) = (Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3]))
		EQUAL(Stat59) ==> Stat60: not(Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3]) Ra_GT eps)
		(Ra_Rev((arb(y0))~[i3]),eps)-->T473(Stat59*) ==> Ra_Rev((arb(y0))~[i3]) Ra_GE eps
		(Ra_Rev((arb(y0))~[i3]),eps,Ra_Rev((arb(y0))~[i3]),eps)-->T504(Stat19*) ==> Stat61: (Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3])) Ra_GT (eps Ra_PLUS eps)
		(Ra_Rev((arb(y0))~[i3]),Ra_Rev((arb(y0))~[i3]))-->T445(Stat59*) ==> Stat62: (Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3])) in Ra
	(Ra_Rev((arb(y0))~[i3]) Ra_PLUS Ra_Rev((arb(y0))~[i3]),eps Ra_PLUS eps,eps)-->T498(Stat31,Stat19,Stat62,Stat61,Stat60*) ==> false; Discharge ==> Stat63: ((arb(y0))~[n1]) Ra_GE Ra_0
--
-- Now, thanks to Theorem 541, we can reformulate the condition for sequence
-- inequivalence which is part of our initial hypothesis as the condition that the set
--	${i : i in Za | Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i])) Ra_GT eps3}$
-- is infinite for a suitable positive rational number $eps3$.
--
	(arb(x0) Ras_TIMES arb(y0),Ras_ABS(arb(x0) Ras_TIMES arb(y0)))-->T541(*) ==> Stat64: not(FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({i : i in Za | Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i])) Ra_GT eps}))
	eps3-->Stat64(Stat64*) ==> Stat65: (eps3 in Ra) & (eps3 Ra_GT Ra_0) &
		(not Finite({i : i in Za | Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i])) Ra_GT eps3}))
--
-- However, it is easy to see that the quantity
--	$Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[x]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0))~[x]))$
-- is null for every integer $i$ greater than or equal to $n$, and hence the set under
-- examination must be a subset of $n$ which is finite. Hence it will be finite in its
-- turn, which leads to a contradiction proving the desired assertion.
--
	(n,{i : i in Za | Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i])) Ra_GT eps3})-->T189(Stat16,Stat65*) ==> Stat66: not(n incs {i : i in Za | Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i])) Ra_GT eps3})
	i6-->Stat66(Stat66*) ==> Stat67: (i6 in {i in Za | Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i])) Ra_GT eps3}) & (i6 notin n)
	()-->Stat68(Stat67*) ==> Stat68: (i6 in (Za - n)) & (Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6])) Ra_GT eps3)
	Suppose ==> ((arb(x0) Ras_TIMES arb(y0))~[i6]) = ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6])
		(arb(x0) Ras_TIMES arb(y0),i6)-->T540(Stat5,Stat68*) ==> ((arb(x0) Ras_TIMES arb(y0))~[i6]) in Ra
		(arb(x0) Ras_TIMES arb(y0),arb(x0) Ras_TIMES arb(y0))-->T554(Stat5,Stat5*) ==> (Ras_ABS(arb(x0) Ras_TIMES arb(y0))) in RaSeq
		(Ras_ABS(arb(x0) Ras_TIMES arb(y0)),i6)-->T540(Stat68*) ==> ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6]) in Ra
		((arb(x0) Ras_TIMES arb(y0))~[i6],(Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6])-->T454(Stat68*) ==> (((arb(x0) Ras_TIMES arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6])) in Ra
		(((arb(x0) Ras_TIMES arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6]))-->T527(Stat68*) ==> Stat69: Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6])) in Ra
		(Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6])),eps3,Ra_0)-->T498(Stat68,Stat65,Stat69,Stat20*) ==> Stat70: Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6])) Ra_GT Ra_0
		(Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6])),Ra_0)-->T473(Stat70,Stat20*) ==> Stat71: Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6])) /= Ra_0
		((arb(x0) Ras_TIMES arb(y0))~[i6])-->T452(Stat68*) ==> ((((arb(x0) Ras_TIMES arb(y0))~[i6])) Ra_PLUS Ra_Rev(((arb(x0) Ras_TIMES arb(y0))~[i6]))) = Ra_0
        	T465(Stat71*) ==> Ra_is_nonneg(Ra_0)
	        T525(Stat71*) ==> Stat72: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
        	Ra_0-->Stat72(Stat71*) ==> Ra_ABS(Ra_0) = Ra_0
		EQUAL(Stat68) ==> Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i6]) Ra_PLUS Ra_Rev((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6])) = Ra_0
		Use_def(Ra_MINUS)(Stat71*) ==> Ra_ABS(((arb(x0) Ras_TIMES arb(y0))~[i6]) Ra_MINUS ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6])) = Ra_0
	(Stat71*)ELEM ==> false; Discharge ==> Stat73: ((arb(x0) Ras_TIMES arb(y0))~[i6]) /= ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6])
	(arb(x0),arb(y0),i6)-->T555(Stat5,Stat68*) ==> ((arb(x0) Ras_TIMES arb(y0))~[i6]) = (((arb(x0))~[i6]) Ra_TIMES ((arb(y0))~[i6]))
	(arb(x0) Ras_TIMES arb(y0),arb(x0) Ras_TIMES arb(y0),i6)-->T555(Stat5,Stat68*) ==> ((Ras_ABS(arb(x0) Ras_TIMES arb(y0)))~[i6]) = Ra_ABS((arb(x0) Ras_TIMES arb(y0))~[i6])
	EQUAL(Stat73) ==> Stat74: (((arb(x0))~[i6]) Ra_TIMES ((arb(y0))~[i6])) /= Ra_ABS(((arb(x0))~[i6]) Ra_TIMES ((arb(y0))~[i6]))
--
--
--
	Suppose ==> not((((arb(x0))~[i6]) in Ra) & Ra_is_nonneg(((arb(x0))~[i6])))
		(arb(x0),i6)-->T540(Stat5,Stat68*) ==> ((arb(x0))~[i6]) in Ra
		i6-->Stat23(Stat68,Stat47*) ==> Ra_ABS((arb(x0))~[i6]) = ((arb(x0))~[i6])
		((arb(x0))~[i6])-->T528(Stat74*) ==> ((arb(x0))~[i6]) Ra_GE Ra_0
	((arb(x0))~[i6])-->T482(Stat74*) ==> false; Discharge ==> (((arb(x0))~[i6]) in Ra) & Ra_is_nonneg(((arb(x0))~[i6]))
	Suppose ==> not((((arb(y0))~[i6]) in Ra) & Ra_is_nonneg(((arb(y0))~[i6])))
		(arb(y0),i6)-->T540(Stat5,Stat68*) ==> ((arb(y0))~[i6]) in Ra
		i6-->Stat26(Stat68,Stat63*) ==> Ra_ABS((arb(y0))~[i6]) = ((arb(y0))~[i6])
		((arb(y0))~[i6])-->T528(Stat74*) ==> ((arb(y0))~[i6]) Ra_GE Ra_0
	((arb(y0))~[i6])-->T482(Stat74*) ==> false; Discharge ==> (((arb(y0))~[i6]) in Ra) & Ra_is_nonneg(((arb(y0))~[i6]))
	((arb(x0))~[i6],(arb(y0))~[i6])-->T469(Stat74*) ==> Stat75: Ra_is_nonneg(((arb(x0))~[i6]) Ra_TIMES ((arb(y0))~[i6]))
	((arb(x0))~[i6],(arb(y0))~[i6])-->T448(Stat74*) ==> (((arb(x0))~[i6]) Ra_TIMES ((arb(y0))~[i6])) in Ra
	(((arb(x0))~[i6]) Ra_TIMES ((arb(y0))~[i6]))-->T482(Stat75*) ==> (((arb(x0))~[i6]) Ra_TIMES ((arb(y0))~[i6])) Ra_GE Ra_0
(((arb(x0))~[i6]) Ra_TIMES ((arb(y0))~[i6]))-->T528(Stat74*) ==> false; Discharge ==> QED
--
Theorem 667: [The sum and product of two non-negative reals is non-negative] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) imp (R_is_nonneg(X R_PLUS Y) & R_is_nonneg(X R_TIMES Y)). Proof:
Suppose_not(x,y) ==> AUTO
    x-->T611(*) ==> Stat1: (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
    y-->T611(*) ==> Stat2: (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
    Suppose ==> (not R_is_nonneg(x R_PLUS y))
	Use_def(R_PLUS) ==> (not R_is_nonneg(Cauchy_to_Re(arb(x) Ras_PLUS arb(y))))
	Use_def(R_is_nonneg) ==> Stat3: (Cauchy_to_Re(Ras_ABS(arb(x))) = x) & (Cauchy_to_Re(Ras_ABS(arb(y))) = y) &
		(Cauchy_to_Re(Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y))))) /= Cauchy_to_Re(arb(x) Ras_PLUS arb(y)))
	(arb(x),arb(y))-->T556(Stat1,Stat2*) ==> (arb(x) Ras_PLUS arb(y)) in RaCauchy
--
	(arb(x) Ras_PLUS arb(y),arb(x) Ras_PLUS arb(y))-->T610(Stat3*) ==> (Cauchy_to_Re(arb(x) Ras_PLUS arb(y)) in Re)  & (Ra_eqseq(arb(x) Ras_PLUS arb(y),arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y)))))
	(Cauchy_to_Re(arb(x) Ras_PLUS arb(y)))-->T611(Stat3*) ==> arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y))) in RaCauchy
	(arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y))),arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y))))-->T556(Stat3*) ==> Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y)))) in RaCauchy
	(Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y)))),arb(x) Ras_PLUS arb(y))-->T610(Stat3*) ==> (not Ra_eqseq(Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y)))),arb(x) Ras_PLUS arb(y)))
	Suppose ==> Ra_eqseq(Ras_ABS(arb(x) Ras_PLUS arb(y)),Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y)))))
		(arb(x) Ras_PLUS arb(y),arb(x) Ras_PLUS arb(y))-->T556(Stat3*) ==> Ras_ABS(arb(x) Ras_PLUS arb(y)) in RaCauchy
		(x,y)-->T665(*) ==> Ra_eqseq(arb(x) Ras_PLUS arb(y),Ras_ABS(arb(x) Ras_PLUS arb(y)))
		T539(Stat3*) ==> ((arb(x) Ras_PLUS arb(y)) in RaSeq) & ((Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y))))) in RaSeq) & (Ras_ABS(arb(x) Ras_PLUS arb(y)) in RaSeq)
	(arb(x) Ras_PLUS arb(y),Ras_ABS(arb(x) Ras_PLUS arb(y)),Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y)))))-->T553(Stat3*) ==> false; Discharge ==> (not Ra_eqseq(Ras_ABS(arb(x) Ras_PLUS arb(y)),Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y))))))
	(arb(x) Ras_PLUS arb(y),arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y))))-->T576(Stat3*) ==> (not Ra_eqseq(arb(x) Ras_PLUS arb(y),arb(Cauchy_to_Re(arb(x) Ras_PLUS arb(y)))))
    (x,y)-->T662(*) ==> false; Discharge ==> (not R_is_nonneg(x R_TIMES y))
--
--
--
	Use_def(R_TIMES) ==> (not R_is_nonneg(Cauchy_to_Re(arb(x) Ras_TIMES arb(y))))
	Use_def(R_is_nonneg) ==> Stat4: (Cauchy_to_Re(Ras_ABS(arb(x))) = x) & (Cauchy_to_Re(Ras_ABS(arb(y))) = y) &
		(Cauchy_to_Re(Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y))))) /= Cauchy_to_Re(arb(x) Ras_TIMES arb(y)))
	x-->T611(*) ==> (arb(x) in RaCauchy) & (arb(x) in RaSeq) & (Cauchy_to_Re(arb(x)) = x)
	y-->T611(*) ==> (arb(y) in RaCauchy) & (arb(y) in RaSeq) & (Cauchy_to_Re(arb(y)) = y)
	(arb(x),arb(y))-->T561(Stat1,Stat2*) ==> (arb(x) Ras_TIMES arb(y)) in RaCauchy
--
	(arb(x) Ras_TIMES arb(y),arb(x) Ras_TIMES arb(y))-->T610(Stat4*) ==> (Cauchy_to_Re(arb(x) Ras_TIMES arb(y)) in Re)  & (Ra_eqseq(arb(x) Ras_TIMES arb(y),arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y)))))
	(Cauchy_to_Re(arb(x) Ras_TIMES arb(y)))-->T611(Stat4*) ==> arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y))) in RaCauchy
	(arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y))),arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y))))-->T556(Stat4*) ==> Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y)))) in RaCauchy
	(Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y)))),arb(x) Ras_TIMES arb(y))-->T610(Stat4*) ==> (not Ra_eqseq(Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y)))),arb(x) Ras_TIMES arb(y)))
	Suppose ==> Ra_eqseq(Ras_ABS(arb(x) Ras_TIMES arb(y)),Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y)))))
		(arb(x) Ras_TIMES arb(y),arb(x) Ras_TIMES arb(y))-->T556(Stat4*) ==> Ras_ABS(arb(x) Ras_TIMES arb(y)) in RaCauchy
		(x,y)-->T666(*) ==> Ra_eqseq(arb(x) Ras_TIMES arb(y),Ras_ABS(arb(x) Ras_TIMES arb(y)))
		T539(Stat4*) ==> ((arb(x) Ras_TIMES arb(y)) in RaSeq) & ((Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y))))) in RaSeq) & (Ras_ABS(arb(x) Ras_TIMES arb(y)) in RaSeq)
	(arb(x) Ras_TIMES arb(y),Ras_ABS(arb(x) Ras_TIMES arb(y)),Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y)))))-->T553(Stat4*) ==> false; Discharge ==> (not Ra_eqseq(Ras_ABS(arb(x) Ras_TIMES arb(y)),Ras_ABS(arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y))))))
	(arb(x) Ras_TIMES arb(y),arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y))))-->T576(Stat4*) ==> (not Ra_eqseq(arb(x) Ras_TIMES arb(y),arb(Cauchy_to_Re(arb(x) Ras_TIMES arb(y)))))
(x,y)-->T662(*) ==> false; Discharge ==> QED
--
Theorem 668: [Transitivity of ordering] ((X in Re) & (Y in Re) & (Z in Re) & (X R_GE Y) & (Y R_GE Z)) imp (X R_GE Z). Proof:
	Suppose_not(x,y,z0) ==> AUTO
	Use_def(R_GE) ==> R_is_nonneg(x R_MINUS y) & R_is_nonneg(y R_MINUS z0) & (not R_is_nonneg(x R_MINUS z0))
	(x,y)-->T635 ==> x R_MINUS y = x R_PLUS R_Rev(y)
	(y,z0)-->T635 ==> y R_MINUS z0 = y R_PLUS R_Rev(z0)
	(x,z0)-->T635 ==> x R_MINUS z0 = x R_PLUS R_Rev(z0)
	EQUAL ==> R_is_nonneg(x R_PLUS R_Rev(y)) & R_is_nonneg(y R_PLUS R_Rev(z0)) & (not R_is_nonneg(x R_PLUS R_Rev(z0)))
	y-->T613 ==> R_Rev(y) in Re
	z0-->T613 ==> R_Rev(z0) in Re
	(x,R_Rev(y))-->T613 ==> x R_PLUS R_Rev(y) in Re
	(y,R_Rev(z0))-->T613 ==> y R_PLUS R_Rev(z0) in Re
	(x R_PLUS R_Rev(y),y R_PLUS R_Rev(z0))-->T667 ==> R_is_nonneg((x R_PLUS R_Rev(y)) R_PLUS (y R_PLUS R_Rev(z0)))
	(x,R_Rev(y),y R_PLUS R_Rev(z0))-->T617 ==> (x R_PLUS R_Rev(y)) R_PLUS (y R_PLUS R_Rev(z0)) = x R_PLUS (R_Rev(y) R_PLUS (y R_PLUS R_Rev(z0)))
	(R_Rev(y),y,R_Rev(z0))-->T617 ==> R_Rev(y) R_PLUS (y R_PLUS R_Rev(z0)) = (R_Rev(y) R_PLUS y) R_PLUS R_Rev(z0)
	EQUAL ==> (x R_PLUS R_Rev(y)) R_PLUS (y R_PLUS R_Rev(z0)) = (x R_PLUS ((R_Rev(y) R_PLUS y) R_PLUS R_Rev(z0)))
	y-->T632 ==> R_Rev(y) R_PLUS y = R_0
	EQUAL ==> (x R_PLUS R_Rev(y)) R_PLUS (y R_PLUS R_Rev(z0)) = (x R_PLUS (R_0 R_PLUS R_Rev(z0)))
	(R_Rev(z0))-->T626 ==> R_0 R_PLUS R_Rev(z0) = R_Rev(z0)
	EQUAL ==> false; Discharge ==> QED
--
Theorem 669: [The reals are a linearly ordered set] ((X in Re) & (Y in Re)) imp ((X R_GT Y) or (X = Y) or (Y R_GT X)). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(R_GT)(*) ==> (x /= y) & (not R_is_nonneg(x R_MINUS y)) & (not R_is_nonneg(y R_MINUS x))
	(x,y)-->T644(*) ==> R_Rev(x R_MINUS y) = (y R_MINUS x)
	EQUAL ==> (not R_is_nonneg(R_Rev(x R_MINUS y)))
	(x,y)-->T614 ==> AUTO
(x R_MINUS y)-->T663(*) ==> false; Discharge ==> QED
--
Theorem 670: [The reals are a linearly ordered set, 2] ((X in Re) & (Y in Re)) imp ((X R_LT Y) or (X = Y) or (Y R_LT X)). Proof:
Suppose_not(x,y) ==> AUTO
	(y,x)-->T669(*) ==> (y R_GT x) or (y = x) or (x R_GT y)
	Use_def(R_GT)(*) ==> (R_is_nonneg(y R_MINUS x) & (y /= x)) or (y = x) or (R_is_nonneg(x R_MINUS y) & (x /= y))
Use_def(R_LT)(*) ==> false; Discharge ==> QED
--
Theorem 671: [0 and 1 are non-negative reals] R_is_nonneg(R_0) & R_is_nonneg(R_1). Proof:
Suppose_not ==> AUTO
	Use_def(R_is_nonneg) ==> Stat1: (Cauchy_to_Re(Ras_ABS(arb(R_0))) /= R_0) or (Cauchy_to_Re(Ras_ABS(arb(R_1))) /= R_1)
	()-->T545 ==> AUTO
	()-->T596 ==> AUTO
	Suppose ==> Stat2: Cauchy_to_Re(Ras_ABS(arb(R_0))) /= R_0
		Use_def(R_0)(Stat2*) ==> Cauchy_to_Re(Ras_ABS(arb(Cauchy_to_Re(Ra0Seq)))) /= Cauchy_to_Re(Ra0Seq)
		(Ra0Seq,Ra0Seq)-->T610(Stat1*) ==> Stat3: Ra_eqseq(Ra0Seq,arb(Cauchy_to_Re(Ra0Seq))) & (Cauchy_to_Re(Ra0Seq) in Re)
		(Cauchy_to_Re(Ra0Seq))-->T611(Stat3*) ==> arb(Cauchy_to_Re(Ra0Seq)) in RaCauchy
		(Ra0Seq,arb(Cauchy_to_Re(Ra0Seq)))-->T576(Stat1*) ==> Ra_eqseq(Ras_ABS(Ra0Seq),Ras_ABS(arb(Cauchy_to_Re(Ra0Seq))))
		EQUAL(Stat1) ==> Ra_eqseq(Ra0Seq,Ras_ABS(arb(Cauchy_to_Re(Ra0Seq))))
		(arb(Cauchy_to_Re(Ra0Seq)),Ra0Seq)-->T556(Stat1*) ==> Ras_ABS(arb(Cauchy_to_Re(Ra0Seq))) in RaCauchy
	(Ra0Seq,Ras_ABS(arb(Cauchy_to_Re(Ra0Seq))))-->T610(Stat1*) ==> false; Discharge ==> Stat4: Cauchy_to_Re(Ras_ABS(arb(R_1))) /= R_1
--
-- The rest of this proof is entirely analogous to the part of it which precedes.
--
	Use_def(R_1)(Stat4*) ==> Cauchy_to_Re(Ras_ABS(arb(Cauchy_to_Re(Ra1Seq)))) /= Cauchy_to_Re(Ra1Seq)
	(Ra1Seq,Ra1Seq)-->T610(Stat1*) ==> Stat5: Ra_eqseq(Ra1Seq,arb(Cauchy_to_Re(Ra1Seq))) & (Cauchy_to_Re(Ra1Seq) in Re)
	(Cauchy_to_Re(Ra1Seq))-->T611(Stat5*) ==> arb(Cauchy_to_Re(Ra1Seq)) in RaCauchy
	(Ra1Seq,arb(Cauchy_to_Re(Ra1Seq)))-->T576(Stat1*) ==> Ra_eqseq(Ras_ABS(Ra1Seq),Ras_ABS(arb(Cauchy_to_Re(Ra1Seq))))
	EQUAL(Stat1) ==> Ra_eqseq(Ra1Seq,Ras_ABS(arb(Cauchy_to_Re(Ra1Seq))))
	(arb(Cauchy_to_Re(Ra1Seq)),Ra1Seq)-->T556(Stat1*) ==> Ras_ABS(arb(Cauchy_to_Re(Ra1Seq))) in RaCauchy
(Ra1Seq,Ras_ABS(arb(Cauchy_to_Re(Ra1Seq))))-->T610(Stat1*) ==> false; Discharge ==> QED

--
Theorem 672: [The reals are a linearly ordered set, 3] ((X in Re) & (Y in Re)) imp (((X R_GE Y) or (Y R_GE X)) & (((X R_GE Y) & (Y R_GE X)) imp (X = Y))). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(R_GE)(*) ==> not(((R_is_nonneg(x R_MINUS y) or R_is_nonneg(y R_MINUS x)) & ((R_is_nonneg(x R_MINUS y) & R_is_nonneg(y R_MINUS x)) imp (x = y))))
	(x,y)-->T669(*) ==> Stat1: (x R_GT y) or (x = y) or (y R_GT x)
	Use_def(R_GT)(Stat1*) ==> Stat2: (R_is_nonneg(x R_MINUS y) & (x /= y)) or (x = y) or (R_is_nonneg(y R_MINUS x) & (y /= x))
	Suppose ==> not(R_is_nonneg(x R_MINUS y) or R_is_nonneg(y R_MINUS x))
		(Stat2*)ELEM ==> x = y
		x-->T631(*) ==> (x R_MINUS x) = R_0
		T671(*) ==> R_is_nonneg(R_0)
	EQUAL(Stat2) ==> false; Discharge ==> Stat3: R_is_nonneg(x R_MINUS y) & R_is_nonneg(y R_MINUS x) & (x /= y)
	(x,y)-->T644(*) ==> R_Rev(x R_MINUS y) = (y R_MINUS x)
	EQUAL(Stat3*) ==> R_is_nonneg(R_Rev(x R_MINUS y))
	(x,y)-->T614(*) ==> (x R_MINUS y) in Re
	(x R_MINUS y)-->T663(Stat3*) ==> (x R_MINUS y) = R_0
	(x,y)-->T641(*) ==> x = y R_PLUS (x R_MINUS y)
	y-->T626(*) ==> y R_PLUS R_0 = y
EQUAL(Stat3) ==> false; Discharge ==> QED
--
Theorem 673: [The ordering of reals is defined by the sign of their differences] ((((X in Re) & (Y in Re)) imp ((X R_GE Y) eq R_is_nonneg(X R_PLUS R_Rev(Y))))) & ((X R_LE Y) eq (Y R_GE X)) & ((X R_GT Y) eq ((X R_GE Y) & (X /= Y))) & ((X R_LT Y) eq (Y R_GT X)). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(R_LE) ==> (x R_LE y) eq R_is_nonneg(y R_MINUS x)
--??	Use_def(y R_GE x) ==> AUTO
	Use_def(R_GE) ==> Stat1: (x R_LE y) eq (y R_GE x)
	Use_def(R_LT) ==> (x R_LT y) eq (R_is_nonneg(y R_MINUS x) & (x /= y))
	Use_def(R_GT) ==> (y R_GT x) eq (R_is_nonneg(y R_MINUS x) & (y /= x))
	Use_def(R_GE) ==> (x R_GE y) eq R_is_nonneg(x R_MINUS y)
	Use_def(R_GT) ==> Stat2: (x in Re) & (y in Re) & (not((x R_GE y) eq R_is_nonneg(x R_PLUS R_Rev(y))))
	(x,y)-->T635(Stat2*) ==> (x R_MINUS y) = (x R_PLUS R_Rev(y))
EQUAL ==> false; Discharge ==> QED
--
Theorem 674: [Various basic properties of real comparison, quantified form] (FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_GE y) eq R_is_nonneg(x R_PLUS R_Rev(y)))) & (FORALL x, y | ((x R_LE y) eq (y R_GE x))) & (FORALL x, y | ((x R_GT y) eq ((x R_GE y) & (x /= y)))) & (FORALL x, y | ((x R_LT y) eq (y R_GT x))) & (FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_LE y) eq (R_is_nonneg(y R_PLUS R_Rev(x))))) & (FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_PLUS R_Rev(y)) & (x /= y)))) & (FORALL x, y | (((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_MINUS y) & (x /= y))))) & (FORALL x, y | ((x in Re) & (y in Re) & ((x = y) or (not(x R_GE y)))) imp (y R_GE x)). Proof:
Suppose_not ==> AUTO
	Suppose ==> Stat1: not(FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_GE y) eq R_is_nonneg(x R_PLUS R_Rev(y))))
		(x1,y1)-->Stat1(Stat1*) ==> (x1 in Re) & (y1 in Re) & (not((x1 R_GE y1) eq R_is_nonneg(x1 R_PLUS R_Rev(y1))))
	(x1,y1)-->T673(Stat1*) ==> false; Discharge ==> (FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_GE y) eq R_is_nonneg(x R_PLUS R_Rev(y))))
	Suppose ==> Stat2: not(FORALL x, y | (x R_LE y) eq (y R_GE x))
		(x2,y2)-->Stat2(Stat2*) ==> not((x2 R_LE y2) eq (y2 R_GE x2))
	(x2,y2)-->T673(Stat2*) ==> false; Discharge ==> (FORALL x, y | (x R_LE y) eq (y R_GE x))
	Suppose ==> Stat3: not(FORALL x, y | (x R_GT y) eq ((x R_GE y) & (x /= y)))
		(x3,y3)-->Stat3(Stat3*) ==> not((x3 R_GT y3) eq ((x3 R_GE y3) & (x3 /= y3)))
	(x3,y3)-->T673(Stat3*) ==> false; Discharge ==> (FORALL x, y | (x R_GT y) eq ((x R_GE y) & (x /= y)))
	Suppose ==> Stat4: not(FORALL x, y | (x R_LT y) eq (y R_GT x))
		(x4,y4)-->Stat4(Stat4*) ==> not((x4 R_LT y4) eq (y4 R_GT x4))
	(x4,y4)-->T673(Stat4*) ==> false; Discharge ==> (FORALL x, y | (x R_LT y) eq (y R_GT x))
	Suppose ==> Stat5: not(FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_LE y) eq (R_is_nonneg(y R_PLUS R_Rev(x)))))
		(x5,y5)-->Stat5(Stat5*) ==> (x5 in Re) & (y5 in Re) & (not((x5 R_LE y5) eq (R_is_nonneg(y5 R_PLUS R_Rev(x5)))))
		(x5,y5)-->T673(Stat5*) ==> (x5 R_LE y5) eq (y5 R_GE x5)
	(y5,x5)-->T673(Stat5*) ==> false; Discharge ==> (FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_LE y) eq (R_is_nonneg(y R_PLUS R_Rev(x)))))
	Suppose ==> Stat6: not(FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_PLUS R_Rev(y)) & (x /= y))))
		(x6,y6)-->Stat6(Stat6*) ==> not(((x6 in Re) & (y6 in Re)) imp ((x6 R_GT y6) eq (R_is_nonneg(x6 R_PLUS R_Rev(y6)) & (x6 /= y6))))
		(x6,y6)-->T673(Stat6*) ==> (x6 R_GT y6) eq ((x6 R_GE y6) & (x6 /= y6))
	(x6,y6)-->T673(Stat6*) ==> false; Discharge ==> Stat7: (FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_PLUS R_Rev(y)) & (x /= y))))
	Suppose ==> Stat8: not(FORALL x, y | (((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_MINUS y) & (x /= y)))))
		(x7,y7)-->Stat8(Stat8*) ==> not(((x7 in Re) & (y7 in Re)) imp ((x7 R_GT y7) eq (R_is_nonneg(x7 R_MINUS y7) & (x7 /= y7))))
		(x7,y7)-->T635(Stat8*) ==> (x7 R_MINUS y7) = (x7 R_PLUS R_Rev(y7))
		EQUAL(Stat8) ==> not(((x7 in Re) & (y7 in Re)) imp ((x7 R_GT y7) eq (R_is_nonneg(x7 R_PLUS R_Rev(y7)) & (x7 /= y7))))
	(x7,y7)-->Stat7(Stat8*) ==> false; Discharge ==> Stat9: not(FORALL x, y | ((x in Re) & (y in Re) & ((x = y) or (not(x R_GE y)))) imp (y R_GE x))
	(x8,y8)-->Stat9(Stat9*) ==> ((x8 in Re) & (y8 in Re) & ((x8 = y8) or (not(x8 R_GE y8)))) & (not(y8 R_GE x8))
	(x8,y8)-->T672(Stat9*) ==> (x8 R_GE y8) or (y8 R_GE x8)
	Suppose ==> x8 = y8
	EQUAL(Stat9) ==> false; Discharge ==> x8 /= y8
(Stat9*)Discharge ==> QED
--
Theorem 675: [Various basic properties of real comparison] (((X in Re) & (Y in Re)) imp ((X R_GE Y) eq R_is_nonneg(X R_PLUS R_Rev(Y)))) & ((X R_LE Y) eq (Y R_GE X)) & ((X R_GT Y) eq ((X R_GE Y) & (X /= Y))) & ((X R_LT Y) eq (Y R_GT X)) & (((X in Re) & (Y in Re)) imp ((X R_LE Y) eq R_is_nonneg(Y R_PLUS R_Rev(X)))) & (((X in Re) & (Y in Re)) imp ((X R_GT Y) eq (R_is_nonneg(X R_PLUS R_Rev(Y)) & (X /= Y)))) & (((X in Re) & (Y in Re)) imp ((X R_GT Y) eq (R_is_nonneg(X R_MINUS Y) & (X /= Y)))) & (((X in Re) & (Y in Re) & ((X = Y) or (not(X R_GE Y)))) imp (Y R_GE X)). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T673(*) ==> not((((x in Re) & (y in Re)) imp ((x R_LE y) eq R_is_nonneg(y R_PLUS R_Rev(x)))) & (((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_PLUS R_Rev(y)) & (x /= y)))) & (((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_MINUS y) & (x /= y)))) & (((x in Re) & (y in Re) & ((x = y) or (not(x R_GE y)))) imp (y R_GE x)))
	T674(*) ==> Stat1: (FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_LE y) eq (R_is_nonneg(y R_PLUS R_Rev(x))))) &
		Stat2: (FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_PLUS R_Rev(y)) & (x /= y)))) &
		Stat3: (FORALL x, y | (((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_MINUS y) & (x /= y))))) &
		Stat4: (FORALL x, y | ((x in Re) & (y in Re) & ((x = y) or (not(x R_GE y)))) imp (y R_GE x))
	Suppose ==> Stat5: not(((x in Re) & (y in Re)) imp ((x R_LE y) eq R_is_nonneg(y R_PLUS R_Rev(x))))
	(x,y)-->Stat1(Stat5*) ==> false; Discharge ==> (((x in Re) & (y in Re)) imp ((x R_LE y) eq R_is_nonneg(y R_PLUS R_Rev(x))))
	Suppose ==> Stat6: not(((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_PLUS R_Rev(y)) & (x /= y))))
	(x,y)-->Stat2(Stat6*) ==> false; Discharge ==> (((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_PLUS R_Rev(y)) & (x /= y))))
	Suppose ==> Stat7: not(((x in Re) & (y in Re)) imp ((x R_GT y) eq (R_is_nonneg(x R_MINUS y) & (x /= y))))
	(x,y)-->Stat3(Stat7*) ==> false; Discharge ==> Stat8: not(((x in Re) & (y in Re) & ((x = y) or (not(x R_GE y)))) imp (y R_GE x))
(x,y)-->Stat4(Stat8*) ==> false; Discharge ==> QED
--
Theorem 676: [Mutual exclusion of strict real comparators] ((X in Re) & (Y in Re) & (X R_GT Y)) imp (not(X R_LT Y)). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T675(*) ==> (x R_GE y) & (x /= y) & (y R_GT x)
	(y,x)-->T675(*) ==> y R_GE x
	(x,y)-->T672(*) ==> false
	Discharge ==> QED
--
Theorem 677: [Transitivity of ordering, strict case] ((X in Re) & (Y in Re) & (Z in Re) & (X R_GT Y) & (Y R_GE Z)) imp (X R_GT Z). Proof:
Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T673(*) ==> x R_GE y
	(x,y,z)-->T668(*) ==> x R_GE z
	(x,z)-->T673(*) ==> x = z
	EQUAL ==> y R_GE x
	(x,y)-->T672(*) ==> x = y
	EQUAL ==> x R_GT x
(x,x)-->T673(*) ==> false; Discharge ==> QED
--
Theorem 678: [Transitivity of ordering, strict case 2] ((X in Re) & (Y in Re) & (Z in Re) & (X R_GE Y) & (Y R_GT Z)) imp (X R_GT Z). Proof:
Suppose_not(x,y,z) ==> AUTO
	(y,z)-->T673(*) ==> y R_GE z
	(x,y,z)-->T668(*) ==> x R_GE z
	(x,z)-->T673(*) ==> x = z
	EQUAL ==> y R_GE x
	(x,y)-->T672(*) ==> x = y
	EQUAL ==> x R_GT x
(x,x)-->T673(*) ==> false; Discharge ==> QED
--
Theorem 679: [Transitivity of ordering,strict case 3] ((X in Re) & (Y in Re) & (Z in Re) & (X R_GT Y) & (Y R_GT Z)) imp (X R_GT Z). Proof:
Suppose_not(x,y,z) ==> AUTO
	(x,y)-->T673(*) ==> x R_GE y
(x,y,z)-->T678(*) ==> false; Discharge ==> QED
--
Theorem 680: [Greater_than_equal is greater-than and equal] ((X in Re) & (Y in Re)) imp ((X R_GE Y) eq ((X R_GT Y) or (X = Y))). Proof:
Suppose_not(x,y) ==> AUTO
	Suppose ==> x R_GT y
	(x,y)-->T673(*) ==> false; Discharge ==> not(x R_GT y)
	Suppose ==> x = y
		(x,x)-->T672(*) ==> x R_GE x
	EQUAL ==> false; Discharge ==> (x /= y) & (x R_GE y)
(x,y)-->T673(*) ==> false; Discharge ==> QED
--
Theorem 681: [Greater_than_equal is greater-than and equal] (X in Re) imp ((X R_GE R_0) eq R_is_nonneg(X)). Proof:
Suppose_not(x) ==> AUTO
	T612(*) ==> R_0 in Re
	(x,R_0)-->T680(*) ==> (x R_GE R_0) eq ((x R_GT R_0) or (x = R_0))
	(x,R_0)-->T675(*) ==> (x R_GE R_0) eq ((R_is_nonneg(x R_MINUS R_0) & (x /= R_0)) or (x = R_0))
	x-->T630(*) ==> (x R_MINUS R_0) = x
	EQUAL ==> (x R_GE R_0) eq ((R_is_nonneg(x) & (x /= R_0)) or (x = R_0))
	ELEM ==> Stat1: not(((R_is_nonneg(x) & (x /= R_0)) or (x = R_0)) imp R_is_nonneg(x))
	Suppose ==> x = R_0
		()-->T671 ==> AUTO
	EQUAL(Stat1) ==> false; Discharge ==> x /= R_0
(Stat1*)Discharge ==> QED
--
Theorem 682: [Less_than_equal is less-than and equal] ((X in Re) & (Y in Re)) imp ((X R_LE Y) eq ((X R_LT Y) or (X = Y))). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T673(*) ==> ((x R_LE y) eq (y R_GE x)) & ((x R_LT y) eq (y R_GT x))
(y,x)-->T680(*) ==> false; Discharge ==> QED
--
Theorem 683: [Transitivity of ordering by 'less than'] ((X in Re) & (Y in Re) & (Z in Re)) imp (((X R_LE Y) & (Y R_LT Z)) imp (X R_LT Z)). Proof:
Suppose_not(x,y,z) ==> AUTO
	(y,z)-->T673(*) ==> z R_GT y
	(x,y)-->T673(*) ==> y R_GE x
	(x,z)-->T673(*) ==> not(z R_GT x)
(z,y,x)-->T677(*) ==> false; Discharge ==> QED
--
Theorem 684: [Transitivity of ordering by 'less than', 2] ((X in Re) & (Y in Re) & (Z in Re)) imp (((X R_LT Y) & (Y R_LE Z)) imp (X R_LT Z)). Proof:
Suppose_not(x,y,z) ==> AUTO
	(y,z)-->T673(*) ==> z R_GE y
	(x,y)-->T673(*) ==> y R_GT x
	(x,z)-->T673(*) ==> not(z R_GT x)
(z,y,x)-->T678(*) ==> false; Discharge ==> QED
--
Theorem 685: [Transitivity of ordering by 'less than', 3] ((X in Re) & (Y in Re) & (Z in Re)) imp (((X R_LT Y) & (Y R_LT Z)) imp (X R_LT Z)). Proof:
Suppose_not(x,y,z) ==> AUTO
	(y,z)-->T673(*) ==> z R_GT y
	(x,y)-->T673(*) ==> y R_GT x
	(x,z)-->T673(*) ==> not(z R_GT x)
(z,y,x)-->T679(*) ==> false; Discharge ==> QED
--
Theorem 686: [No real is less than itself] not(X R_LT X). Proof:
Suppose_not(x) ==> AUTO
Use_def(R_LT) ==> false; Discharge ==> QED
--
-- The properties of $R_GT$ are mirrored by properties of $R_LT$ and hence
-- enable us to exploit, in connection with $Re$, the theory of linear orderings.
--
Theorem 687: (FORALL x in Re, y in Re, z in Re | ((x R_LT y) & (y R_LT z)) imp (x R_LT z)). Proof:
    Suppose_not ==> Stat1: not(FORALL x in Re, y in Re, z in Re | ((x R_LT y) & (y R_LT z)) imp (x R_LT z))
        (x,y,w)-->Stat1(*) ==> (x in Re) & (y in Re) & (w in Re) & (x R_LT y) & (y R_LT w) & (not (x R_LT w))
        (x,y)-->T675(*) ==> y R_GT x
        (y,w)-->T675(*) ==> w R_GT y
        (w,y)-->T675(*) ==> w R_GE y
        (w,y,x)-->T678(*) ==> w R_GT x
    (x,w)-->T675 ==> false; Discharge ==> QED
--
Theorem 688: (FORALL x in Re | not(x R_LT x)). Proof:
    Suppose_not ==> Stat1: not(FORALL x in Re | not(x R_LT x))
        x-->Stat1(*) ==> (x in Re) & (x R_LT x)
    x-->T686(*) ==> false; Discharge ==> QED
--
Theorem 689: (FORALL x in Re, y in Re | (x R_LT y) or (x = y) or (y R_LT x)). Proof:
    Suppose_not ==> Stat1: not(FORALL x in Re, y in Re | (x R_LT y) or (x = y) or (y R_LT x))
        (x,y)-->Stat1(*) ==> (x in Re) & (y in Re) & (not((x R_LT y) or (x = y) or (y R_LT x)))
        (y,x)-->T672(*) ==> (y R_GE x) or (x R_GE y)
        Suppose ==> y R_GE x
            (y,x)-->T675(*) ==> y R_GT x
            (x,y)-->T675(*) ==> false; Discharge ==> (x R_GE y) & (x /= y)
        (x,y)-->T675(*) ==> (x R_GT y)
    (y,x)-->T675(*) ==> false; Discharge ==> QED
--
APPLY(smaller_thryvar:smaller_Re,ubs_thryvar:ubs_Re,min_over_thryvar:min_over_Re,max_thryvar:max_Re,lub_thryvar:lub_Re) linear_order(s0->Re, arg1_bef_arg2(X,Y)->(X R_LT Y)) ==>
Theorem 690: (FORALL x, y | smaller_Re(x,y) = if ((x notin Re) & (y notin Re)) then Re elseif (x notin Re) then y elseif (y notin Re) then x elseif (x R_LT y) then x else y end if) &
	(FORALL x, y | smaller_Re(x,y) = smaller_Re(y,x)) &
	(FORALL x, y | ({x,y} incin Re) imp (smaller_Re(x,y) in {x,y})) &
	(FORALL x | (x in next(Re)) imp (smaller_Re(x,Re) = x)) &
	(FORALL x, y, z | smaller_Re(x,smaller_Re(y,z)) = smaller_Re(smaller_Re(x,y),z)) &
	(FORALL x, y | ((x in next(Re)) & (y in next(Re))) imp (smaller_Re(x,y) in next(Re))) &
	(FORALL f,p,a | (Svm(f) & (range(f) incin Re) & Finite(f)) imp
		(((p in f) imp (min_over_Re({p}) = (f~[car(p)]))) &
		(min_over_Re(f) = smaller_Re(min_over_Re(f ON (domain(f) * a)),min_over_Re(f ON (domain(f) - a)))))) &
	(FORALL f | (Svm(f) & (range(f) incin Re) & Finite(f) & (f /= 0)) imp (min_over_Re(f) in range(f))) &
	(FORALL x, y | ({x,y} incin Re) imp ((smaller_Re(x,y) = x) eq ((x R_LT y) or (x = y)))) &
	(FORALL t | ubs_Re(t) = {x in Re | (FORALL y in (t * Re) | smaller_Re(y,x) = y)}) &
	(FORALL t | max_Re(t) = arb({Re} + (t * ubs_Re(t)))) &
	(FORALL t | lub_Re(t) = arb({Re} + {x in ubs_Re(t) | ubs_Re(t) incin ubs_Re({x})})) &
	(ubs_Re(0) = Re) & (max_Re(0) = Re) &
	(FORALL t | (ubs_Re(t) incin Re) & (ubs_Re(t) = ubs_Re(t * Re)) & (max_Re(t) = max_Re(t * Re))) &
	(FORALL t, x | (Finite(t) & (x in t) & (t incin Re)) imp ((max_Re(t) in t) & ((x = max_Re(t)) or ((x R_LT max_Re(t))))))
--
Theorem 691: [Sign reversal inverts comparisons] ((X in Re) & (Y in Re) & (X R_GE Y)) imp (R_Rev(Y) R_GE R_Rev(X)). Proof:
Suppose_not(x,y) ==> AUTO
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	(y,y)-->T613(*) ==> R_Rev(y) in Re
	(R_Rev(y),R_Rev(x))-->T675(*) ==> (not R_is_nonneg(R_Rev(y) R_PLUS R_Rev(R_Rev(x))))
	x-->T633(*) ==> R_Rev(R_Rev(x)) = x
	EQUAL ==> (not R_is_nonneg(R_Rev(y) R_PLUS x))
	(R_Rev(y),x)-->T613(*) ==> (R_Rev(y) R_PLUS x) in Re
	(R_Rev(y) R_PLUS x)-->T663(*) ==> R_is_nonneg(R_Rev(R_Rev(y) R_PLUS x))
	(R_Rev(y),x)-->T638(*) ==> R_Rev(R_Rev(y) R_PLUS x) = R_Rev(R_Rev(y)) R_PLUS R_Rev(x)
	y-->T633(*) ==> R_Rev(R_Rev(y)) = y
	EQUAL ==> R_is_nonneg(y R_PLUS R_Rev(x))
	(y,x)-->T675(*) ==> y R_GE x
	(x,y)-->T672(*) ==> y = x
	(R_Rev(y),R_Rev(y))-->T672(*) ==> R_Rev(y) R_GE R_Rev(y)
EQUAL ==> false; Discharge ==> QED
--
Theorem 692: [Sign reversal inverts comparisons,2] ((X in Re) & (Y in Re)) imp (((X R_GE Y) eq (R_Rev(Y) R_GE R_Rev(X))) & ((X R_GT Y) eq (R_Rev(Y) R_GT R_Rev(X)))). Proof:
Suppose_not(x,y) ==> AUTO
	(y,y)-->T613(*) ==> R_Rev(y) in Re
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	x-->T633(*) ==> R_Rev(R_Rev(x)) = x
	y-->T633(*) ==> R_Rev(R_Rev(y)) = y
	Suppose ==> not((x R_GE y) eq (R_Rev(y) R_GE R_Rev(x)))
		(x,y)-->T691(*) ==> (R_Rev(y) R_GE R_Rev(x)) & (not(x R_GE y))
		(R_Rev(y),R_Rev(x))-->T691(*) ==> R_Rev(R_Rev(x)) R_GE R_Rev(R_Rev(y))
	EQUAL ==> false; Discharge ==> not((x R_GT y) eq (R_Rev(y) R_GT R_Rev(x)))
	Suppose ==> (x R_GT y) & (not(R_Rev(y) R_GT R_Rev(x)))
		(x,y)-->T675(*) ==> (x R_GE y) & (x /= y)
		(x,y)-->T691(*) ==> R_Rev(y) R_GE R_Rev(x)
		(R_Rev(y),R_Rev(x))-->T675(*) ==> R_Rev(y) = R_Rev(x)
	EQUAL ==> false; Discharge ==> (R_Rev(y) R_GT R_Rev(x)) & (not(x R_GT y))
	(R_Rev(y),R_Rev(x))-->T675(*) ==> (R_Rev(y) R_GE R_Rev(x)) & (R_Rev(y) /= R_Rev(x))
	(R_Rev(y),R_Rev(x))-->T691(*) ==> R_Rev(R_Rev(x)) R_GE R_Rev(R_Rev(y))
	y-->T633(*) ==> R_Rev(R_Rev(y)) = y
	x-->T633(*) ==> R_Rev(R_Rev(x)) = x
	EQUAL ==> x R_GE y
	(x,y)-->T675(*) ==> x = y
EQUAL ==> false; Discharge ==> QED
--
--
Theorem 693: [Properties of the real zero and unit] (R_Rev(R_0) = R_0) & (R_1 /= R_0) & (R_1 R_GT R_0) & (R_Recip(R_1) = R_1). Proof:
Suppose_not ==> AUTO
	()-->T629 ==> AUTO
	()-->T612 ==> AUTO
	Suppose ==> R_1 = R_0
		Use_def(R_1) ==> Cauchy_to_Re(Ra1Seq) = R_0
		Use_def(R_0) ==> R_0 = Cauchy_to_Re(Ra0Seq)
		EQUAL ==> Cauchy_to_Re(Ra1Seq) = Cauchy_to_Re(Ra0Seq)
		()-->T545 ==> AUTO
		(Ra1Seq,Ra0Seq)-->T610(*) ==> Ra_eqseq(Ra1Seq,Ra0Seq)
		()-->T539 ==> AUTO
		Ra_1-->T451 ==> (Ra_0 in Ra) & (Ra_1 in Ra) & (Ra_1 = (Ra_1 Ra_PLUS Ra_0))
		()-->T481 ==> AUTO
		(Ra1Seq,Ra0Seq)-->T541(*) ==> Stat1: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
			Finite({x : x in Za | Ra_ABS((Ra1Seq~[x]) Ra_MINUS (Ra0Seq~[x])) Ra_GT eps}))
		(Ra_1,Ra_0)-->T519(*) ==> (Ra_1 Ra_GT ((Ra_1 Ra_PLUS Ra_0) Ra_OVER (Ra_1 Ra_PLUS Ra_1))) &
			(((Ra_1 Ra_PLUS Ra_0) Ra_OVER (Ra_1 Ra_PLUS Ra_1)) Ra_GT Ra_0)
		Loc_def ==> eps = (Ra_1 Ra_OVER (Ra_1 Ra_PLUS Ra_1))
		EQUAL ==> Stat2: (Ra_1 Ra_GT eps) & (eps Ra_GT Ra_0)
		Ra_1-->T520(*) ==> eps in Ra
		eps-->Stat1(*) ==> Finite({x : x in Za | Ra_ABS((Ra1Seq~[x]) Ra_MINUS (Ra0Seq~[x])) Ra_GT eps})
		0-->T206(*) ==> (not Finite(Za))
		({x : x in Za | Ra_ABS((Ra1Seq~[x]) Ra_MINUS (Ra0Seq~[x])) Ra_GT eps},Za)-->T189(Stat1*) ==> Stat3: not({x : x in Za | Ra_ABS((Ra1Seq~[x]) Ra_MINUS (Ra0Seq~[x])) Ra_GT eps} incs Za)
		i-->Stat3(Stat3*) ==> Stat4: (i notin {x : x in Za | Ra_ABS((Ra1Seq~[x]) Ra_MINUS (Ra0Seq~[x])) Ra_GT eps}) & (i in Za)
		i-->Stat4(Stat4*) ==> not(Ra_ABS((Ra1Seq~[i]) Ra_MINUS (Ra0Seq~[i])) Ra_GT eps)
		i-->T548(Stat4*) ==> ((Ra0Seq~[i]) = Ra_0) & ((Ra1Seq~[i]) = Ra_1)
		EQUAL(Stat4) ==> not(Ra_ABS(Ra_1 Ra_MINUS Ra_0) Ra_GT eps)
		Use_def(Ra_MINUS)(Stat4*) ==> not(Ra_ABS(Ra_1 Ra_PLUS Ra_Rev(Ra_0)) Ra_GT eps)
		EQUAL ==> Stat5: not(Ra_ABS(Ra_1) Ra_GT eps)
	        T465(Stat6) ==> Stat6: Ra_is_nonneg(Ra_1)
        	T525(Stat6) ==> Stat7: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
        	Ra_1-->Stat7(Stat6*) ==> Stat8: Ra_ABS(Ra_1) = Ra_1
	EQUAL(Stat2,Stat5,Stat8) ==> false; Discharge ==> (R_1 /= R_0) & (not((R_1 R_GT R_0) & (R_Recip(R_1) = R_1)))
	Suppose ==> (not (R_1 R_GT R_0))
		(R_1,R_0)-->T675(*) ==> (not R_is_nonneg(R_1 R_PLUS R_Rev(R_0)))
		R_1-->T626(*) ==> (R_1 R_PLUS R_0) = R_1
		()-->T671 ==> AUTO
	EQUAL ==> false; Discharge ==> R_Recip(R_1) /= R_1
	R_1-->T645(*) ==> (R_1 R_TIMES R_Recip(R_1)) = R_1
	R_1-->T647(*) ==> R_Recip(R_1) in Re
(R_Recip(R_1))-->T628(*) ==> false; Discharge ==> QED
--
Theorem 694: [Monotonicity of addition over 2nd argument] ((X in Re) & (XP in Re) & (YP in Re) & (XP R_GE YP)) imp ((X R_PLUS XP) R_GE (X R_PLUS YP)). Proof:
Suppose_not(x,xp,yp) ==> AUTO
	Use_def(R_GE) ==> Stat1: (x in Re) & (xp in Re) & (yp in Re) & R_is_nonneg(xp R_MINUS yp) & (not R_is_nonneg((x R_PLUS xp) R_MINUS (x R_PLUS yp)))
	(x,xp)-->T615(Stat1,Stat1*) ==> Stat2: (x R_PLUS xp) = (xp R_PLUS x)
	(x,yp)-->T615(Stat1,Stat1*) ==> Stat3: (x R_PLUS yp) = (yp R_PLUS x)
	(xp,x)-->T613(Stat1,Stat1*) ==> Stat4: (xp R_PLUS x) in Re
	(yp,x)-->T613(Stat1,Stat1*) ==> Stat5: ((yp R_PLUS x) in Re) & (R_Rev(yp) in Re)
	(xp R_PLUS x,yp R_PLUS x)-->T635(Stat4*) ==> Stat6: ((xp R_PLUS x) R_MINUS (yp R_PLUS x)) = ((xp R_PLUS x) R_PLUS R_Rev(yp R_PLUS x))
	(yp R_PLUS x,yp R_PLUS x)-->T613(Stat5*) ==> Stat7: R_Rev(yp R_PLUS x) in Re
	(xp,x,R_Rev(yp R_PLUS x))-->T617(Stat1,Stat7*) ==> Stat8: ((xp R_PLUS x) R_PLUS R_Rev(yp R_PLUS x)) = (xp R_PLUS (x R_PLUS R_Rev(yp R_PLUS x)))
	(yp,x)-->T638(Stat1,Stat1*) ==> Stat9: R_Rev(yp R_PLUS x) = R_Rev(yp) R_PLUS R_Rev(x)
	(R_Rev(yp),x)-->T641(Stat1,Stat5*) ==> Stat10: (x R_PLUS (R_Rev(yp) R_MINUS x)) = R_Rev(yp)
	(xp,yp)-->T635(Stat1,Stat1*) ==> Stat11: (xp R_MINUS yp) = (xp R_PLUS R_Rev(yp))
EQUAL(Stat1,Stat2,Stat3,Stat6,Stat8,Stat9,Stat10,Stat11*) ==> false; Discharge ==> QED
--
Theorem 695: [Monotonicity of real addition] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X R_GE Y) & (XP R_GE YP)) imp ((X R_PLUS XP) R_GE (Y R_PLUS YP)). Proof:
Suppose_not(x,y,xp,yp) ==> AUTO
	(x,xp,yp)-->T694(*) ==> (x R_PLUS xp) R_GE (x R_PLUS yp)
	(yp,x,y)-->T694(*) ==> (yp R_PLUS x) R_GE (yp R_PLUS y)
	(yp,x)-->T615(*) ==> (yp R_PLUS x) = (x R_PLUS yp)
	(yp,y)-->T615(*) ==> (yp R_PLUS y) = (y R_PLUS yp)
	EQUAL ==> (x R_PLUS yp) R_GE (y R_PLUS yp)
	(x,xp)-->T613(*) ==> (x R_PLUS xp) in Re
	(x,yp)-->T613(*) ==> (x R_PLUS yp) in Re
	(y,yp)-->T613(*) ==> (y R_PLUS yp) in Re
(x R_PLUS xp,x R_PLUS yp,y R_PLUS yp)-->T668(*) ==> false; Discharge ==> QED
--
Theorem 696: [Strict monotonicity of addition] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X R_GE Y) & (XP R_GT YP)) imp ((X R_PLUS XP) R_GT (Y R_PLUS YP)). Proof:
Suppose_not(x,y,xp,yp) ==> AUTO
--
-- Suppose that $x$, $y$, $xp$, and $yp$ form a counterexample to our theorem.
-- Since addition is known to be monotone, we have at least $(x R_PLUS xp) R_GE (y R_PLUS yp)$,
-- and since the corresponding strict inequality is false we must have $(x R_PLUS xp) = (x R_PLUS xp)$,
-- so that $(xp R_PLUS x) Ra_GE (yp R_PLUS y)$ is also true.
--
	(xp,yp)-->T675(*) ==> Stat1: (xp R_GE yp) & (xp /= yp)
	(x,y,xp,yp)-->T695(*) ==> (x R_PLUS xp) R_GE (y R_PLUS yp)
	(x R_PLUS xp,y R_PLUS yp)-->T675(*) ==> (x R_PLUS xp) = (y R_PLUS yp)
	(x,xp)-->T613(*) ==> Stat2: (x R_PLUS xp) in Re
	(y,yp)-->T613(*) ==> (y R_PLUS yp) in Re
	(y R_PLUS yp,x R_PLUS xp)-->T680(*) ==> (y R_PLUS yp) R_GE (x R_PLUS xp)
	(x,xp)-->T615(*) ==> (x R_PLUS xp) = (xp R_PLUS x)
	(y,yp)-->T615(*) ==> (y R_PLUS yp) = (yp R_PLUS y)
        EQUAL(Stat2) ==> ((yp R_PLUS y) R_GE (xp R_PLUS x)) & ((xp R_PLUS x) in Re) & ((yp R_PLUS y) in Re)
--
-- By Theorem 691, we have $R_Rev(y) R_GE R_Rev(x)$, and then adding these
-- last two inequalities and reassociating we find that $yp R_GE xp$, so that $yp = xp$,
-- contradicting $xp R_GT yp$ an so proving our theorem.
--
	(x,y)-->T691(*) ==> R_Rev(y) R_GE R_Rev(x)
	y-->T636(*) ==> (R_Rev(y) in Re) & ((y R_PLUS R_Rev(y)) = R_0)
	x-->T636(*) ==> (R_Rev(x) in Re) & ((x R_PLUS R_Rev(x)) = R_0)
	(yp R_PLUS y,xp R_PLUS x,R_Rev(y),R_Rev(x))-->T695(*) ==>
		((yp R_PLUS y) R_PLUS R_Rev(y)) R_GE ((xp R_PLUS x) R_PLUS R_Rev(x))
	(yp,y,R_Rev(y))-->T617(*) ==> ((yp R_PLUS y) R_PLUS R_Rev(y)) = (yp R_PLUS (y R_PLUS R_Rev(y)))
	(xp,x,R_Rev(x))-->T617(*) ==> ((xp R_PLUS x) R_PLUS R_Rev(x)) = (xp R_PLUS (x R_PLUS R_Rev(x)))
	EQUAL ==> (yp R_PLUS R_0) R_GE (xp R_PLUS R_0)
	yp-->T626(*) ==> (yp R_PLUS R_0) = yp
	xp-->T626(*) ==> (xp R_PLUS R_0) = xp
	EQUAL ==> yp R_GE xp
(xp,yp)-->T672(*) ==> false; Discharge ==> QED
--
Theorem 697: [Strict monotonicity of addition] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X R_GT Y) & (XP R_GE YP)) imp ((X R_PLUS XP) R_GT (Y R_PLUS YP)). Proof:
Suppose_not(x,y,xp,yp) ==> AUTO
	(xp,yp,x,y)-->T696(*) ==> (xp R_PLUS x) R_GT (yp R_PLUS y)
	ALGEBRA ==> ((xp R_PLUS x) = (x R_PLUS xp)) & ((yp R_PLUS y) = (y R_PLUS yp))
EQUAL ==> false; Discharge ==> QED
--
Theorem 698: [Strict monotonicity of addition, 2] ((X in Re) & (Y in Re) & (V in Re) & (X R_GE Y)) imp (((Y R_PLUS V) R_GE (X R_PLUS V)) eq (X = Y)). Proof:
Suppose_not(x,y,v) ==> AUTO
	(y,v)-->T613(*) ==> Stat1: (y R_PLUS v) in Re
	(x,v)-->T613(*) ==> (x R_PLUS v) in Re
	Suppose ==> x = y
		EQUAL ==> (y R_PLUS v) = (x R_PLUS v)
	(y R_PLUS v,x R_PLUS v)-->T680(*) ==> false; Discharge ==> x /= y
	(x,y)-->T680(*) ==> x R_GT y
	(v,v)-->T680(*) ==> v R_GE v
	(v,v,x,y)-->T696(*) ==> Stat2: (v R_PLUS x) R_GT (v R_PLUS y)
	(v,x)-->T615(*) ==> (v R_PLUS x) = (x R_PLUS v)
	(v,y)-->T615(*) ==> (v R_PLUS y) = (y R_PLUS v)
	EQUAL(Stat2) ==> (x R_PLUS v) R_GT (y R_PLUS v)
	(x R_PLUS v,y R_PLUS v)-->T673(Stat1*) ==> ((x R_PLUS v) R_GE (y R_PLUS v)) & ((x R_PLUS v) /= (y R_PLUS v))
(x R_PLUS v,y R_PLUS v)-->T672(*) ==> false; Discharge ==> QED
--
Theorem 699: ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & (X R_PLUS Y = R_0)) imp ((X = R_0) & (Y = R_0)). Proof:
Suppose_not(x,y) ==> Stat1: (x in Re) & (y in Re) & R_is_nonneg(x) & R_is_nonneg(y) & (x R_PLUS y = R_0) & ((x /= R_0) or (y /= R_0))
        x-->T681(*) ==> Stat2: x R_GE R_0
        y-->T681(*) ==> Stat3: y R_GE R_0
        T612(*) ==> Stat4: R_0 in Re
        R_0-->T626(Stat4*) ==> Stat5: R_0 R_PLUS R_0 = R_0
        Suppose ==> Stat6: y /= R_0
                (y, R_0)-->T680(Stat1, Stat3, Stat4, Stat6*) ==> Stat7: y R_GT R_0
                (x,R_0,y,R_0)-->T696(Stat1, Stat4, Stat2, Stat7*) ==> Stat8: (x R_PLUS y) R_GT (R_0 R_PLUS R_0)
                EQUAL(Stat8, Stat5*) ==> (x R_PLUS y) R_GT R_0
        Use_def(R_GT) ==> false; Discharge ==> Stat9: x /= R_0
        (x, R_0)-->T680(Stat1, Stat2, Stat4, Stat9*) ==> Stat10: x R_GT R_0
        (y,R_0,x,R_0)-->T696(Stat1, Stat4, Stat3, Stat10*) ==> Stat11: (y R_PLUS x) R_GT (R_0 R_PLUS R_0)
        EQUAL(Stat11, Stat5*) ==> Stat12: (y R_PLUS x) R_GT R_0
        (y, x)-->T615(Stat1, Stat1*) ==> Stat13: (y R_PLUS x) = (x R_PLUS y)
        EQUAL(Stat12, Stat13*)  ==> Stat14: (x R_PLUS y) R_GT R_0
Use_def(R_GT)(Stat1, Stat14) ==> false; Discharge ==> QED
--
Theorem 700: [The product of two reals is 0 if and only if one of them is 0] ((X in Re) & (Y in Re)) imp (((X R_TIMES Y) = R_0) eq ((X = R_0) or (Y = R_0))). Proof:
Suppose_not(x,y) ==> AUTO
	Suppose ==> x = R_0
		y-->T625(*) ==> (R_0 R_TIMES y) = R_0
	EQUAL ==> false; Discharge ==> Stat1: x /= R_0
	Suppose ==> y = R_0
		x-->T624(*) ==> (x R_TIMES R_0) = R_0
	EQUAL ==> false; Discharge ==> (y /= R_0) & ((x R_TIMES y) = R_0)
	(x,y)-->T658(*) ==> ((x R_TIMES y) R_OVER y) = x
	y-->T647(*) ==> Stat2: R_Recip(y) in Re
	(R_Recip(y))-->T625(Stat2*) ==> (R_0 R_TIMES R_Recip(y)) = R_0
	Use_def(R_OVER)(Stat2*) ==> (R_0 R_OVER y) = R_0
EQUAL(Stat1) ==> false; Discharge ==> QED
--
Theorem 701: [Monotonicity of multiplication over 2nd argument] ((X in Re) & (XP in Re) & (YP in Re) & (X R_GE R_0) & (XP R_GE YP)) imp ((X R_TIMES XP) R_GE (X R_TIMES YP)). Proof:
Suppose_not(x,xp,yp) ==> AUTO
	(xp,yp)-->T614(*) ==> Stat1: (xp R_MINUS yp) in Re
	(x,xp,yp)-->T643(*) ==> Stat2: (x R_TIMES (xp R_MINUS yp)) = ((x R_TIMES xp) R_MINUS (x R_TIMES yp))
	Use_def(R_GE)(*) ==> Stat3: (x in Re) & R_is_nonneg(x R_MINUS R_0) & R_is_nonneg(xp R_MINUS yp) & (not R_is_nonneg((x R_TIMES xp) R_MINUS (x R_TIMES yp)))
	x-->T630(Stat3,Stat3*) ==> (x R_MINUS R_0) = x
	EQUAL(Stat2*) ==> Stat4: R_is_nonneg(x) & (not R_is_nonneg(x R_TIMES (xp R_MINUS yp)))
(x,xp R_MINUS yp)-->T667(Stat1,Stat3,Stat4*) ==> false; Discharge ==> QED
--
Theorem 702: [Monotonicity of multiplication] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X R_GE Y) & (Y R_GE R_0) & (YP R_GE R_0) & (XP R_GE YP)) imp ((X R_TIMES XP) R_GE (Y R_TIMES YP)). Proof:
Suppose_not(x,y,xp,yp) ==> AUTO
	T612(*) ==> R_0 in Re
	(x,y,R_0)-->T668(*) ==> x R_GE R_0
	(x,xp,yp)-->T701(*) ==> (x R_TIMES xp) R_GE (x R_TIMES yp)
	(yp,x,y)-->T701(*) ==> (yp R_TIMES x) R_GE (yp R_TIMES y)
	(yp,x)-->T618(*) ==> (yp R_TIMES x) = (x R_TIMES yp)
	(yp,y)-->T618(*) ==> (yp R_TIMES y) = (y R_TIMES yp)
	EQUAL ==> (x R_TIMES yp) R_GE (y R_TIMES yp)
	(x,xp)-->T614(*) ==> (x R_TIMES xp) in Re
	(x,yp)-->T614(*) ==> (x R_TIMES yp) in Re
	(y,yp)-->T614(*) ==> (y R_TIMES yp) in Re
(x R_TIMES xp,x R_TIMES yp,y R_TIMES yp)-->T668(*) ==> false; Discharge ==> QED
--
Theorem 703: [Strict monotonicity of multiplication over 2nd argument] ((X in Re) & (XP in Re) & (YP in Re) & (X R_GT R_0) & (XP R_GT YP)) imp ((X R_TIMES XP) R_GT (X R_TIMES YP)). Proof:
Suppose_not(x,xp,yp) ==> AUTO
	(xp,yp)-->T673(*) ==> xp R_GE yp
	(x,R_0)-->T673(*) ==> x R_GE R_0
	(x,x)-->T672(*) ==> x R_GE x
	(x,xp,yp)-->T701(*) ==> (x R_TIMES xp) R_GE (x R_TIMES yp)
	(x R_TIMES xp,x R_TIMES yp)-->T673(*) ==> Stat1: (x R_TIMES xp) = (x R_TIMES yp)
	(xp,yp)-->T675(*) ==> R_is_nonneg(xp R_MINUS yp) & (xp /= yp)
	(xp,yp)-->T641(*) ==> xp = (yp R_PLUS (xp R_MINUS yp))
	(xp,yp)-->T614(*) ==> (xp R_MINUS yp) in Re
	(x,yp,xp R_MINUS yp)-->T621(*) ==> (x R_TIMES (yp R_PLUS (xp R_MINUS yp))) = ((x R_TIMES yp) R_PLUS (x R_TIMES (xp R_MINUS yp)))
	(x,yp)-->T614(*) ==> Stat2: (x R_TIMES yp) in Re
	(x R_TIMES yp)-->T626(*) ==> ((x R_TIMES yp) R_PLUS R_0) = (x R_TIMES yp)
	EQUAL(Stat1) ==> ((x R_TIMES yp) R_PLUS R_0) = ((x R_TIMES yp) R_PLUS (x R_TIMES (xp R_MINUS yp)))
	(x,xp R_MINUS yp)-->T614(*) ==> (x R_TIMES (xp R_MINUS yp)) in Re
	(x R_TIMES yp,x R_TIMES (xp R_MINUS yp))-->T615(*) ==> ((x R_TIMES yp) R_PLUS (x R_TIMES (xp R_MINUS yp))) = ((x R_TIMES (xp R_MINUS yp)) R_PLUS (x R_TIMES yp))
	T612(*) ==> R_0 in Re
	(x R_TIMES yp,R_0)-->T615(*) ==> ((x R_TIMES yp) R_PLUS R_0) = (R_0 R_PLUS (x R_TIMES yp))
	(R_0,x R_TIMES (xp R_MINUS yp),x R_TIMES yp)-->T634(Stat2*) ==> (x R_TIMES (xp R_MINUS yp)) = R_0
	(x,R_0)-->T675(*) ==> x /= R_0
	(x,xp R_MINUS yp)-->T700(*) ==> (xp R_MINUS yp) = R_0
	yp-->T626(*) ==> yp R_PLUS R_0 = yp
EQUAL(Stat1) ==> false; Discharge ==> QED
--
Theorem 704: [Strict monotonicity of multiplication] ((X in Re) & (Y in Re) & (XP in Re) & (YP in Re) & (X R_GE Y) & (Y R_GT R_0) & (YP R_GT R_0) & (XP R_GT YP)) imp ((X R_TIMES XP) R_GT (Y R_TIMES YP)). Proof:
Suppose_not(x,y,xp,yp) ==> AUTO
	T612(*) ==> R_0 in Re
	(x,y,R_0)-->T678(*) ==> x R_GT R_0
	Suppose ==> x = y
		EQUAL ==> not((x R_TIMES xp) R_GT (x R_TIMES yp))
	(x,xp,yp)-->T703(*) ==> false; Discharge ==> x /= y
	(x,y)-->T673(*) ==> x R_GT y
	(x,y,R_0)-->T679(*) ==> x R_GT R_0
	(xp,yp,R_0)-->T679(*) ==> xp R_GT R_0
        (xp,x,y)-->T703(*) ==> Stat1: (xp R_TIMES x) R_GT (xp R_TIMES y)
	(xp,x)-->T618(*) ==> (xp R_TIMES x) = (x R_TIMES xp)
	(xp,y)-->T618(*) ==> (xp R_TIMES y) = (y R_TIMES xp)
	EQUAL(Stat1) ==> (x R_TIMES xp) R_GT (y R_TIMES xp)
	(y,xp,yp)-->T703(*) ==> (y R_TIMES xp) R_GT (y R_TIMES yp)
	(x,xp)-->T614(*) ==> (x R_TIMES xp) in Re
	(y,xp)-->T614(*) ==> (y R_TIMES xp) in Re
	(y,yp)-->T614(*) ==> (y R_TIMES yp) in Re
(x R_TIMES xp,y R_TIMES xp,y R_TIMES yp)-->T679(*) ==> false; Discharge ==> QED
--
Theorem 705: [Multiplication by a positive real is strictly monotone] ((X in Re) & (Y in Re) & (Z in Re) & (X R_GT Y) & (Z R_GT R_0)) imp ((X R_TIMES Z) R_GT (Y R_TIMES Z)). Proof:
Suppose_not(x,y,v) ==> AUTO
	(v,v)-->T672(*) ==> v R_GE v
	(v,R_0)-->T673(*) ==> (v R_GE R_0) & (v /= R_0)
	Suppose ==> y R_GT R_0
		(v,v,x,y)-->T704(*) ==> (v R_TIMES x) R_GT (v R_TIMES y)
		(v,x)-->T618(*) ==> (v R_TIMES x) = (x R_TIMES v)
		(v,y)-->T618(*) ==> (v R_TIMES y) = (y R_TIMES v)
	EQUAL ==> false; Discharge ==> not(y R_GT R_0)
	()-->T612 ==> AUTO
	(y,R_0)-->T669(*) ==> (y = R_0) or (R_0 R_GT y)
	(x,v)-->T614(*) ==> (x R_TIMES v) in Re
	v-->T625(*) ==> (R_0 R_TIMES v) = R_0
	Suppose ==> y = R_0
		EQUAL ==> Stat1: (x R_GT R_0) & (not((x R_TIMES v) R_GT R_0))
		(x,R_0)-->T673(Stat1*) ==> (x R_GE R_0) & (x /= R_0)
		(R_0,R_0)-->T672(*) ==> R_0 R_GE R_0
		(x,R_0,v,R_0)-->T702(*) ==> (x R_TIMES v) R_GE (R_0 R_TIMES R_0)
		R_0-->T625(*) ==> (R_0 R_TIMES R_0) = R_0
		EQUAL ==> (x R_TIMES v) R_GE R_0
		(x R_TIMES v,R_0)-->T680(*) ==> (x R_TIMES v) = R_0
	(x,v)-->T653(*) ==> false; Discharge ==> (y /= R_0) & (R_0 R_GT y)
	(x,y)-->T692(*) ==> R_Rev(y) R_GT R_Rev(x)
	(R_Rev(y),R_Rev(x))-->T673(*) ==> R_Rev(y) R_GE R_Rev(x)
	(y,y)-->T613(*) ==> R_Rev(y) in Re
	(R_0,y)-->T692(*) ==> R_Rev(y) R_GT R_Rev(R_0)
	()-->T693 ==> AUTO
	EQUAL ==> R_Rev(y) R_GT R_0
	(R_Rev(y),R_0)-->T673(*) ==> R_Rev(y) R_GE R_0
	(R_0,R_0)-->T672(*) ==> R_0 R_GE R_0
	(y,v)-->T614(*) ==> (y R_TIMES v) in Re
	Suppose ==> x = R_0
		v-->T624(*) ==> (v R_TIMES R_0) = R_0
		(v,v,R_Rev(y),R_0)-->T702(*) ==> (v R_TIMES R_Rev(y)) R_GE (v R_TIMES R_0)
		(v,y)-->T623(*) ==> (v R_TIMES R_Rev(y)) = R_Rev(v R_TIMES y)
		(v,x)-->T623(*) ==> (v R_TIMES R_Rev(x)) = R_Rev(v R_TIMES x)
		(v,y)-->T618(*) ==> (v R_TIMES y) = (y R_TIMES v)
		(v,x)-->T618(*) ==> (v R_TIMES x) = (x R_TIMES v)
		EQUAL ==> (R_Rev(y R_TIMES v) R_GE R_Rev(R_0)) & (not(R_0 R_GT (y R_TIMES v)))
		(R_0,y R_TIMES v)-->T692(*) ==> R_0 R_GE (y R_TIMES v)
		(R_0,y R_TIMES v)-->T680(*) ==> R_0 = (y R_TIMES v)
	(y,v)-->T700(*) ==> false; Discharge ==> x /= R_0
	(x,R_0)-->T669(*) ==> (x R_GT R_0) or (R_0 R_GT x)
	(y,v)-->T623(*) ==> (R_Rev(y) R_TIMES v) = R_Rev(y R_TIMES v)
	Suppose ==> x R_GT R_0
		(x,R_0)-->T673(*) ==> (x R_GE R_0) & (x /= R_0)
		(x,R_0,v,v)-->T702(*) ==> (x R_TIMES v) R_GE (R_0 R_TIMES v)
		EQUAL ==> (x R_TIMES v) R_GE R_0
		(x,v)-->T700(*) ==> (x R_TIMES v) /= R_0
		(x R_TIMES v,R_0)-->T680(*) ==> (x R_TIMES v) R_GT R_0
		(R_Rev(y),R_0,v,v)-->T702(*) ==> (R_Rev(y) R_TIMES v) R_GE (R_0 R_TIMES v)
		EQUAL ==> R_Rev(y R_TIMES v) R_GE R_Rev(R_0)
		(R_0,y R_TIMES v)-->T692(*) ==> R_0 R_GE (y R_TIMES v)
	(x R_TIMES v,R_0,y R_TIMES v)-->T677(*) ==> false; Discharge ==> R_0 R_GT x
	(R_0,x)-->T692(*) ==> R_Rev(x) R_GT R_Rev(R_0)
	EQUAL ==> R_Rev(x) R_GT R_0
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	(v,v,R_Rev(y),R_Rev(x))-->T704(*) ==> (v R_TIMES R_Rev(y)) R_GT (v R_TIMES R_Rev(x))
	(v,R_Rev(y))-->T618(*) ==> (v R_TIMES R_Rev(y)) = (R_Rev(y) R_TIMES v)
	(v,R_Rev(x))-->T618(*) ==> (v R_TIMES R_Rev(x)) = (R_Rev(x) R_TIMES v)
	(x,v)-->T623(*) ==> (R_Rev(x) R_TIMES v) = R_Rev(x R_TIMES v)
	EQUAL ==> R_Rev(y R_TIMES v) R_GT R_Rev(x R_TIMES v)
(x R_TIMES v,y R_TIMES v)-->T692(*) ==> false; Discharge ==> QED
--
Theorem 706: [The product of reals $x,y$ of which $x$ is positive is non-negative iff $y$ is non-negative] ((X in Re) & (Y in Re) & (X /= R_0) & R_is_nonneg(X)) imp (R_is_nonneg(X R_TIMES Y) eq R_is_nonneg(Y)). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T614(*) ==> Stat1: (x R_TIMES y) in Re
	()-->T612 ==> AUTO
	()-->T671 ==> AUTO
	()-->T693 ==> AUTO
	Suppose ==> not(x R_GT R_0)
		x-->T681(*) ==> x R_GE R_0
	(x,R_0)-->T680(*) ==> false; Discharge ==> x R_GT R_0
	Suppose ==> R_is_nonneg(y)
		y-->T681(*) ==> y R_GE R_0
		(y,R_0)-->T680(*) ==> (y R_GT R_0) or (y = R_0)
		Suppose ==> y = R_0
			x-->T624(*) ==> (x R_TIMES R_0) = R_0
		EQUAL ==> false; Discharge ==> (y R_GT R_0)
		(x,R_0,y)-->T705(*) ==> (x R_TIMES y) R_GT (R_0 R_TIMES y)
		y-->T625(*) ==> (R_0 R_TIMES y) = R_0
		EQUAL ==> (x R_TIMES y) R_GT R_0
		(x R_TIMES y,R_0)-->T680(*) ==> (x R_TIMES y) R_GE R_0
	(x R_TIMES y)-->T681(*) ==> false; Discharge ==> Stat2: (not R_is_nonneg(y)) & R_is_nonneg(x R_TIMES y)
	y-->T663(*) ==> R_is_nonneg(R_Rev(y))
	(y,y)-->T613(*) ==> R_Rev(y) in Re
	(R_Rev(y))-->T681(Stat2*) ==> R_Rev(y) R_GE R_0
	(R_Rev(y),R_0)-->T680(*) ==> (R_Rev(y) R_GT R_0) or (R_Rev(y) = R_0)
	Suppose ==> R_Rev(y) = R_0
		y-->T633(*) ==> R_Rev(R_Rev(y)) = y
	EQUAL ==> false; Discharge ==> R_Rev(y) R_GT R_0
	(x,R_0,R_Rev(y))-->T705(*) ==> Stat3: (x R_TIMES R_Rev(y)) R_GT (R_0 R_TIMES R_Rev(y))
	(R_Rev(y))-->T625(*) ==> (R_0 R_TIMES R_Rev(y)) = R_0
	EQUAL(Stat3) ==> (x R_TIMES R_Rev(y)) R_GT R_0
	(x,y)-->T623(*) ==> (x R_TIMES R_Rev(y)) = R_Rev(x R_TIMES y)
	EQUAL ==> R_Rev(x R_TIMES y) R_GT R_0
	(x R_TIMES y,x R_TIMES y)-->T613(Stat1,Stat1*) ==> Stat4: R_Rev(x R_TIMES y) in Re
	(R_Rev(x R_TIMES y),R_0)-->T680(*) ==> R_Rev(x R_TIMES y) R_GE R_0
	(R_Rev(x R_TIMES y))-->T681(Stat4*) ==> Stat5: R_is_nonneg(R_Rev(x R_TIMES y))
	(R_Rev(y))-->T681(Stat2*) ==> R_Rev(y) R_GE R_0
	(x R_TIMES y)-->T663(Stat1,Stat2,Stat5*) ==> (x R_TIMES y) = R_0
	(x,R_0)-->T675(*) ==> x /= R_0
	(R_Rev(y),R_0)-->T675(*) ==> R_Rev(y) /= R_0
	Suppose ==> y = R_0
	EQUAL ==> false; Discharge ==> y /= R_0
(x,y)-->T700(*) ==> false; Discharge ==> QED
--
Theorem 707: [The product of nonnegative reals is non-negative] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) imp R_is_nonneg(X R_TIMES Y). Proof:
Suppose_not(x,y) ==> AUTO
	x-->T706(*) ==> x = R_0
	y-->T625(*) ==> (R_0 R_TIMES y) = R_0
	EQUAL ==> (not R_is_nonneg(R_0))
T671 ==> false; Discharge ==> QED
--
Theorem 708: [Condition for positiveness of a product of reals] ((X in Re) & (Y in Re)) imp (((X R_TIMES Y) R_GT R_0) eq (((X R_GT R_0) & (Y R_GT R_0)) or ((R_0 R_GT X) & (R_0 R_GT Y)))). Proof:
Suppose_not(x,y) ==> AUTO
--
-- By the trichotomic property of the ordering relation on reals, there are
-- six cases to be considered, namely the combinations of one of the possibilities
-- $x = R_0,x R_GT R_0,R_0 R_GT x$ with one of the possibilities
-- $y = R_0,y R_GT R_0,R_0 R_GT y$. We will see that in none of the cases
-- the assertion of this theorem cannot be false.
--
	()-->T612 ==> AUTO
	(x,R_0)-->T669(*) ==> Stat1: (x = R_0) or (x R_GT R_0) or (R_0 R_GT x)
	(y,R_0)-->T669(*) ==> (y = R_0) or (y R_GT R_0) or (R_0 R_GT y)
	Suppose ==> x = R_0
		y-->T625(*) ==> (R_0 R_TIMES y) = R_0
		EQUAL ==> (x R_TIMES y) = R_0
		(x R_TIMES y,R_0)-->T673(*) ==> not((x R_TIMES y) R_GT R_0)
		(x,R_0)-->T673(*) ==> not(x R_GT R_0)
	(R_0,x)-->T673(*) ==> false; Discharge ==> x /= R_0
	Suppose ==> y = R_0
		x-->T624(*) ==> (x R_TIMES R_0) = R_0
		EQUAL ==> (x R_TIMES y) = R_0
		(x R_TIMES y,R_0)-->T673(*) ==> not((x R_TIMES y) R_GT R_0)
		(y,R_0)-->T673(*) ==> not(y R_GT R_0)
	(R_0,y)-->T673(*) ==> false; Discharge ==> y /= R_0
	(x,y)-->T614(*) ==> Stat2: (x R_TIMES y) in Re
	(x,y)-->T700(*) ==> (x R_TIMES y) /= R_0
	Suppose ==> (x R_GT R_0) & (y R_GT R_0)
		(x,R_0)-->T673(*) ==> x R_GE R_0
		(y,R_0)-->T673(*) ==> y R_GE R_0
		x-->T681(*) ==> R_is_nonneg(x)
		y-->T681(*) ==> R_is_nonneg(y)
		(x,y)-->T707(*) ==> R_is_nonneg(x R_TIMES y)
		(x R_TIMES y)-->T681(*) ==> (x R_TIMES y) R_GE R_0
	(x R_TIMES y,R_0)-->T673(*) ==> false; Discharge ==> not((x R_GT R_0) & (y R_GT R_0))
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	(y,y)-->T613(*) ==> R_Rev(y) in Re
	Suppose ==> (not(x R_GT R_0)) & (not(y R_GT R_0))
		(x,R_0)-->T680(*) ==> not(x R_GE R_0)
		(y,R_0)-->T680(*) ==> not(y R_GE R_0)
		x-->T681(*) ==> (not R_is_nonneg(x))
		y-->T681(*) ==> (not R_is_nonneg(y))
		x-->T663(*) ==> R_is_nonneg(R_Rev(x))
		y-->T663(*) ==> R_is_nonneg(R_Rev(y))
		(R_Rev(x),R_Rev(y))-->T707(*) ==> R_is_nonneg(R_Rev(x) R_TIMES R_Rev(y))
		(x,y)-->T623(*) ==> (R_Rev(x) R_TIMES R_Rev(y)) = (x R_TIMES y)
		EQUAL ==> R_is_nonneg(x R_TIMES y)
		(x R_TIMES y)-->T681(*) ==> (x R_TIMES y) R_GE R_0
	(x R_TIMES y,R_0)-->T673(*) ==> false; Discharge ==> (x R_GT R_0) or (y R_GT R_0)
	Suppose ==> x R_GT R_0
		(x,R_0)-->T680(*) ==> x R_GE R_0
		x-->T681(*) ==> R_is_nonneg(x)
		(y,R_0)-->T680(*) ==> not(y R_GE R_0)
		y-->T681(*) ==> not(R_is_nonneg(y))
		y-->T663(*) ==> R_is_nonneg(R_Rev(y))
		(x,R_Rev(y))-->T707(*) ==> R_is_nonneg(x R_TIMES R_Rev(y))
		(x,y)-->T623(*) ==> (x R_TIMES R_Rev(y)) = R_Rev(x R_TIMES y)
		EQUAL ==> R_is_nonneg(R_Rev(x R_TIMES y))
		(x R_TIMES y)-->T663(*) ==> (not R_is_nonneg(x R_TIMES y))
		(x R_TIMES y)-->T681(*) ==> not((x R_TIMES y) R_GE R_0)
		(y,R_0)-->T673(*) ==> not(y R_GT R_0)
		(x,R_0)-->T672(*) ==> not(R_0 R_GE x)
		(R_0,x)-->T673(*) ==> not(R_0 R_GT x)
	(x R_TIMES y,R_0)-->T673(*) ==> false; Discharge ==> y R_GT R_0
	(y,R_0)-->T680(*) ==> y R_GE R_0
	y-->T681(*) ==> R_is_nonneg(y)
	(x,R_0)-->T680(*) ==> not(x R_GE R_0)
	x-->T681(*) ==> (not R_is_nonneg(x))
	x-->T663(*) ==> R_is_nonneg(R_Rev(x))
	(R_Rev(x),y)-->T707(*) ==> R_is_nonneg(R_Rev(x) R_TIMES y)
	(x,y)-->T623(*) ==> (R_Rev(x) R_TIMES y) = R_Rev(x R_TIMES y)
	EQUAL ==> R_is_nonneg(R_Rev(x R_TIMES y))
	(x R_TIMES y)-->T663(*) ==> (not R_is_nonneg(x R_TIMES y))
	(x R_TIMES y)-->T681(*) ==> not((x R_TIMES y) R_GE R_0)
	(x,R_0)-->T673(*) ==> not(x R_GT R_0)
	(y,R_0)-->T672(*) ==> not(R_0 R_GE y)
	(R_0,y)-->T673(*) ==> not(R_0 R_GT y)
(x R_TIMES y,R_0)-->T673(*) ==> false; Discharge ==> QED
--
Theorem 709: [The reciprocal of a positive real is positive] ((X in Re) & (X R_GT R_0)) imp (R_Recip(X) R_GT R_0). Proof:
Suppose_not(x) ==> AUTO
	()-->T612 ==> AUTO
	(x,R_0)-->T675(*) ==> x /= R_0
	x-->T647(*) ==> (R_Recip(x) in Re) & (R_Recip(x) /= R_0) & ((R_Recip(x) R_TIMES x) = R_1)
	(R_Recip(x),x)-->T618(*) ==> (R_Recip(x) R_TIMES x) = (x R_TIMES R_Recip(x))
	()-->T671 ==> AUTO
	EQUAL ==> R_is_nonneg(x R_TIMES R_Recip(x))
	(x,R_0)-->T675(*) ==> x R_GE R_0
	x-->T681(*) ==> R_is_nonneg(x)
	()-->T693(*) ==> AUTO
	(x,R_Recip(x))-->T706(*) ==> R_is_nonneg(R_Recip(x))
	(R_Recip(x))-->T681(*) ==> R_Recip(x) R_GE R_0
	(R_Recip(x),R_0)-->T680(*) ==> R_Recip(x) = R_0
	EQUAL ==> (R_0 R_TIMES x) = R_1
	x-->T625 ==> AUTO
()-->T693(*) ==> false; Discharge ==> QED
--
Theorem 710: [The sum of non-negative reals is at least as big at each addend] ((X in Re) & (Y in Re) & (X R_GE R_0)) imp ((X R_PLUS Y) R_GE Y). Proof:
Suppose_not(x,y) ==> AUTO
	(y,y)-->T672(*) ==> y R_GE y
	()-->T612() ==> AUTO
	(x,R_0,y,y)-->T695(*) ==> (x R_PLUS y) R_GE (R_0 R_PLUS y)
	y-->T626(*) ==> (R_0 R_PLUS y) = y
EQUAL ==> false; Discharge ==> QED
--
Theorem 711: [The sum of non-negative reals is zero only if the addends are zero] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & (X R_PLUS Y = R_0)) imp ((X = R_0) & (Y = R_0)). Proof:
Suppose_not(x,y) ==> AUTO
	ALGEBRA ==> Stat1: ((y R_PLUS x) = R_0) & ((x R_PLUS y) = R_0) & (R_0 in Re) & (x in Re) & (y in Re)
	x-->T681(*) ==> Stat2: x R_GE R_0
	(x,y)-->T710(*) ==> Stat3: (x R_PLUS y) R_GE y
	EQUAL(Stat1,Stat3) ==> Stat4: R_0 R_GE y
	y-->T681(*) ==> Stat5: y R_GE R_0
	(y,x)-->T710(*) ==> Stat6: (y R_PLUS x) R_GE x
	EQUAL(Stat1,Stat6) ==> Stat7: R_0 R_GE x
	(x,R_0)-->T680(Stat2,Stat1*) ==> Stat8: (x R_GT R_0) or (x = R_0)
	(y,R_0)-->T680(Stat5,Stat1*) ==> Stat9: (y R_GT R_0) or (y = R_0)
	Suppose ==> x /= R_0
		(Stat8*)ELEM ==> Stat10: x R_GT R_0
		(R_0,x,R_0)-->T678(Stat7,Stat10,Stat1*) ==> Stat11: R_0 R_GT R_0
	(R_0,R_0)-->T673(Stat11*) ==> false; Discharge ==> y /= R_0
	(Stat9*)ELEM ==> Stat12: y R_GT R_0
	(R_0,y,R_0)-->T678(Stat4,Stat12,Stat1*) ==> Stat13: R_0 R_GT R_0
	(R_0,R_0)-->T673(Stat13*) ==> false
	Discharge ==> QED
--
Theorem 712: [The reciprocal is monotone decreasing for positive reals] ((X in Re) & (Y in Re) & (X R_GT Y) & (Y R_GT R_0)) imp (R_Recip(Y) R_GT R_Recip(X)). Proof:
Suppose_not(x,y) ==> AUTO
	T612(*) ==> Stat1: (R_0 in Re) & (R_1 in Re)
	(x,y,R_0)-->T679(*) ==> x R_GT R_0
	(x,R_0)-->T675(*) ==> x /= R_0
	(y,R_0)-->T675(*) ==> y /= R_0
	Suppose ==> Stat2: R_Recip(x) = R_Recip(y)
		x-->T648(*) ==> R_Recip(R_Recip(x)) = x
		y-->T648(*) ==> R_Recip(R_Recip(y)) = y
		(x,y)-->T675(*) ==> x /= y
	EQUAL(Stat2) ==> false; Discharge ==> R_Recip(x) /= R_Recip(y)
	x-->T647(*) ==> Stat3: (R_Recip(x) in Re) & (R_Recip(x) /= R_0) & ((R_Recip(x) R_TIMES x) = R_1)
	y-->T647(*) ==> (R_Recip(y) in Re) & (R_Recip(y) /= R_0) & ((R_Recip(y) R_TIMES y) = R_1)
	Suppose ==> R_Recip(x) R_GT R_Recip(y)
		(R_Recip(x),R_Recip(y))-->T675(Stat3*) ==> R_Recip(x) R_GE R_Recip(y)
		y-->T709(*) ==> R_Recip(y) R_GT R_0
		(R_Recip(x),R_Recip(y),x,y)-->T704(*) ==> (R_Recip(x) R_TIMES x) R_GT (R_Recip(y) R_TIMES y)
		EQUAL(Stat3) ==> R_1 R_GT R_1
	(R_1,R_1)-->T675(Stat1*) ==> false; Discharge ==> not(R_Recip(x) R_GT R_Recip(y))
(R_Recip(x),R_Recip(y))-->T669(*) ==> false; Discharge ==> QED
--
Theorem 713: [Two non-null reals are equal iff their reciprocals are equal] ((X in Re) & (X /= R_0) & (Y in Re) & (Y /= R_0) & (R_Recip(X) = R_Recip(Y))) imp (X = Y). Proof:
Suppose_not(x,y) ==> AUTO
	ELEM ==> R_Recip(x) = R_Recip(y)
	y-->T645(*) ==> (y R_TIMES R_Recip(y)) = R_1
	EQUAL ==> (y R_TIMES R_Recip(x)) = R_1
	x-->T645(*) ==> (x R_TIMES R_Recip(x)) = R_1
	y-->T647(*) ==> (R_Recip(x) in Re) & (R_Recip(x) /= R_0)
(x,y,R_Recip(x))-->T650(*) ==> false; Discharge ==> QED
--
Theorem 714: [The square of any real is non-negative] (X in Re) imp R_is_nonneg(X R_TIMES X). Proof:
Suppose_not(x) ==> AUTO
	x-->T663(*) ==> R_is_nonneg(x) or R_is_nonneg(R_Rev(x))
	Suppose ==> R_is_nonneg(x)
	(x,x)-->T707(*) ==> false; Discharge ==> R_is_nonneg(R_Rev(x))
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	(R_Rev(x),R_Rev(x))-->T707(*) ==> R_is_nonneg(R_Rev(x) R_TIMES R_Rev(x))
	(x,x)-->T623 ==> (R_Rev(x) R_TIMES R_Rev(x)) = (x R_TIMES x)
EQUAL ==> false; Discharge ==> QED
--
Theorem 715: [Monotonicity of squaring] ((X in Re) & (Y in Re) & (X R_GE R_0) & (Y R_GE R_0)) imp ((X R_GE Y) eq ((X R_TIMES X) R_GE (Y R_TIMES Y))). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y,x,y)-->T702(*) ==> Stat1: ((x R_TIMES x) R_GE (y R_TIMES y)) & (not(x R_GE y)) & (x in Re) & (y in Re) & (x R_GE R_0) & (y R_GE R_0)
	(y,y)-->T614(Stat1,Stat1*) ==> (y R_TIMES y) in Re
	(y,y)-->T672(Stat1,Stat1*) ==> y R_GE y
	x-->T624(Stat1,Stat1*) ==> (x R_TIMES R_0) = R_0
	y-->T624(Stat1,Stat1*) ==> (y R_TIMES R_0) = R_0
	T612(Stat2*) ==> Stat2: R_0 in Re
	(R_0,R_0)-->T672(Stat2*) ==> R_0 R_GE R_0
	Suppose ==> x = R_0
		(y,R_0,y,R_0)-->T702(Stat1*) ==> (y R_TIMES y) R_GE (R_0 R_TIMES R_0)
		EQUAL(Stat1) ==> (R_0 R_GE (y R_TIMES y)) & ((y R_TIMES y) R_GE R_0)
		(R_0,y R_TIMES y)-->T675(Stat1*) ==> Stat3: (R_0 R_GT (y R_TIMES y)) or (R_0 = (y R_TIMES y))
		Suppose ==> R_0 R_GT (y R_TIMES y)
			(R_0,y R_TIMES y,R_0)-->T677(Stat1*) ==> R_0 R_GT R_0
		(R_0,R_0)-->T673(Stat1*) ==> false; Discharge ==> Stat4: not(R_0 R_GT (y R_TIMES y))
		(y,y)-->T700(Stat1,Stat3,Stat4*) ==> y = R_0
	EQUAL(Stat1) ==> false; Discharge ==> Stat5: x /= R_0
	Suppose ==> y = R_0
	EQUAL(Stat1) ==> false; Discharge ==> Stat6: y /= R_0
	(x,x)-->T614(Stat1,Stat1*) ==> (x R_TIMES x) in Re
	(x,x)-->T672(Stat1,Stat1*) ==> x R_GE x
	(x,x,x,R_0)-->T702(Stat1*) ==> (x R_TIMES x) R_GE (x R_TIMES R_0)
	(y,y,y,R_0)-->T702(Stat1*) ==> (y R_TIMES y) R_GE (y R_TIMES R_0)
	EQUAL(Stat1) ==> ((x R_TIMES x) R_GE R_0) & ((y R_TIMES y) R_GE R_0)
	x-->T647(Stat1,Stat5*) ==> Stat7: (R_Recip(x) in Re) & (R_Recip(x) /= R_0) & ((R_Recip(x) R_TIMES x) = R_1)
	y-->T647(Stat1,Stat6*) ==> Stat8: (R_Recip(y) in Re) & (R_Recip(y) /= R_0) & ((R_Recip(y) R_TIMES y) = R_1)
	(x,R_0)-->T675(Stat1,Stat2,Stat5*) ==> Stat9: x R_GT R_0
	(y,R_0)-->T675(Stat1,Stat2,Stat6*) ==> Stat10: y R_GT R_0
	x-->T709(Stat1,Stat9*) ==> Stat11: R_Recip(x) R_GT R_0
	y-->T709(Stat1,Stat10*) ==> Stat12: R_Recip(y) R_GT R_0
	(R_Recip(x),R_0)-->T675(Stat11,Stat7,Stat2*) ==> R_Recip(x) R_GE R_0
	(R_Recip(y),R_0)-->T675(Stat12,Stat8,Stat2*) ==> R_Recip(y) R_GE R_0
	Suppose ==> Stat13: not(R_Recip(x) R_GE R_Recip(y))
		(x,y)-->T672(Stat1,Stat1*) ==> Stat14: y R_GE x
		Suppose ==> Stat15: y = x
			EQUAL(Stat15) ==> Stat16: R_Recip(x) = R_Recip(y)
		(R_Recip(x), R_Recip(y))-->T680(Stat7,Stat8,Stat16,Stat13*) ==> false; Discharge ==> Stat17: y /= x
		(y, x)-->T680(Stat1, Stat14, Stat17*) ==> Stat18: y R_GT x
		(R_Recip(x), R_Recip(y))-->T672(Stat7, Stat8, Stat13*) ==> Stat19: R_Recip(y) R_GE R_Recip(x)
		(R_Recip(y), R_Recip(x), y, x)-->T704(Stat1, Stat9, Stat7, Stat8, Stat11, Stat18, Stat19*) ==> Stat20: (R_Recip(y) R_TIMES y) R_GT (R_Recip(x) R_TIMES x)
		EQUAL(Stat7, Stat8, Stat20*) ==> Stat21: R_1 R_GT R_1
	Use_def(R_GT)(Stat21*)	==> false; Discharge ==> R_Recip(x) R_GE R_Recip(y)
	(x R_TIMES x,y R_TIMES y,R_Recip(x),R_Recip(y))-->T702(Stat1*) ==> ((x R_TIMES x) R_TIMES R_Recip(x)) R_GE ((y R_TIMES y) R_TIMES R_Recip(y))
	(x,x,R_Recip(x))-->T620(Stat1,Stat7*) ==> ((x R_TIMES x) R_TIMES R_Recip(x)) = (x R_TIMES (x R_TIMES R_Recip(x)))
	(y,y,R_Recip(y))-->T620(Stat1,Stat8*) ==> ((y R_TIMES y) R_TIMES R_Recip(y)) = (y R_TIMES (y R_TIMES R_Recip(y)))
	(x,R_Recip(x))-->T618(Stat1,Stat7*) ==> (x R_TIMES R_Recip(x)) = (R_Recip(x) R_TIMES x)
	(y,R_Recip(y))-->T618(Stat1,Stat8*) ==> (y R_TIMES R_Recip(y)) = (R_Recip(y) R_TIMES y)
	x-->T627(Stat1,Stat1*) ==> (x R_TIMES R_1) = x
	y-->T627(Stat1,Stat1*) ==> (y R_TIMES R_1) = y
EQUAL(Stat1) ==> false; Discharge ==> QED
--
Theorem 716: [Properties of the real number 2] ((R_1 R_PLUS R_1) in Re) & ((R_1 R_PLUS R_1) R_GT R_0) & (R_Recip(R_1 R_PLUS R_1) in Re) & (R_Recip(R_1 R_PLUS R_1) /= R_0) & ((X in Re) imp ((X R_OVER (R_1 R_PLUS R_1)) in Re)). Proof:
Suppose_not(x) ==> AUTO
--
-- Let us recall that $R_0,R_1$ belong to $Re$ and that twice $R_0$ is $R_0$.
-- Moreover, $R_0$ is self-negative and is smaller that $R_1$. Hence, by
-- the strict monotonicity of addition, twice $R_1$ exceeds $R_0$.
--
	()-->T693 ==> AUTO
	(R_1,R_0)-->T673(*) ==> R_1 R_GE R_0
	()-->T612 ==> AUTO
	(R_0,R_0)-->T672(*) ==> R_0 R_GE R_0
        (R_1,R_0,R_1,R_0)-->T696(*) ==> Stat1: (R_1 R_PLUS R_1) R_GT (R_0 R_PLUS R_0)
	R_0-->T626 ==> (R_0 R_PLUS R_0) = R_0
	EQUAL(Stat1) ==> Stat2: (R_1 R_PLUS R_1) R_GT R_0
--
-- It follows from the fact that $R_1 R_PLUS R_1$ is non-zero that its reciprocal
-- belongs to $Re$ and is non-zero. Hence, the only way the assertion could
-- be false would be the existence of a real number $x$ exists whose quotient by
-- $R_1 R_PLUS R_1$ does not belong to $Re$.
--
	(R_1 R_PLUS R_1,R_0)-->T673(Stat2*) ==> (R_1 R_PLUS R_1) /= R_0
	(R_1,R_1)-->T613(*) ==> (R_1 R_PLUS R_1) in Re
	(R_1 R_PLUS R_1)-->T647(*) ==> Stat3: (R_Recip(R_1 R_PLUS R_1) in Re) & (x in Re) & ((x R_OVER (R_1 R_PLUS R_1)) notin Re)
	(x,R_Recip(R_1 R_PLUS R_1))-->T614(Stat3*) ==> (x R_TIMES R_Recip(R_1 R_PLUS R_1)) in Re
Use_def(R_OVER)(Stat3*) ==> false; Discharge ==> QED
--
-- The following proof is entirely analogous to the proof of Theorem 521 concerning rationals.
--
Theorem 717: [Any real number can be divided into two equal halves] (X in Re) imp (X = (X R_OVER (R_1 R_PLUS R_1)) R_PLUS (X R_OVER (R_1 R_PLUS R_1))). Proof:
Suppose_not(x) ==> AUTO
	x-->T716(*) ==> ((R_1 R_PLUS R_1) in Re) & ((R_1 R_PLUS R_1) R_GT R_0) & (R_Recip(R_1 R_PLUS R_1) in Re) & (R_Recip(R_1 R_PLUS R_1) /= R_0) & ((x in Re) imp ((x R_OVER (R_1 R_PLUS R_1)) in Re))
	T612(*) ==> (R_0 in Re) & (R_1 in Re)
	(R_1 R_PLUS R_1,R_0)-->T675(*) ==> (R_1 R_PLUS R_1) /= R_0
	Suppose ==> R_1 /= (R_Recip(R_1 R_PLUS R_1) R_PLUS R_Recip(R_1 R_PLUS R_1))
		(R_1 R_PLUS R_1)-->T645(*) ==> R_1 = ((R_1 R_PLUS R_1) R_TIMES R_Recip(R_1 R_PLUS R_1))
		((R_1 R_PLUS R_1),R_Recip(R_1 R_PLUS R_1))-->T618(*) ==> ((R_1 R_PLUS R_1) R_TIMES R_Recip(R_1 R_PLUS R_1)) = (R_Recip(R_1 R_PLUS R_1) R_TIMES (R_1 R_PLUS R_1))
		(R_Recip(R_1 R_PLUS R_1),R_1,R_1)-->T621(*) ==> (R_Recip(R_1 R_PLUS R_1) R_TIMES (R_1 R_PLUS R_1)) =
			((R_Recip(R_1 R_PLUS R_1) R_TIMES R_1) R_PLUS (R_Recip(R_1 R_PLUS R_1) R_TIMES R_1))
		(R_Recip(R_1 R_PLUS R_1))-->T627(*) ==> (R_Recip(R_1 R_PLUS R_1) R_TIMES R_1) = R_Recip(R_1 R_PLUS R_1)
	EQUAL ==> false; Discharge ==> R_1 = (R_Recip(R_1 R_PLUS R_1) R_PLUS R_Recip(R_1 R_PLUS R_1))
        (x,R_1 R_PLUS R_1)-->T652(*) ==> (x R_OVER (R_1 R_PLUS R_1)) = (x R_TIMES R_Recip(R_1 R_PLUS R_1))
	EQUAL ==> ((x R_OVER (R_1 R_PLUS R_1)) R_PLUS (x R_OVER (R_1 R_PLUS R_1))) = ((x R_TIMES R_Recip(R_1 R_PLUS R_1)) R_PLUS (x R_TIMES R_Recip(R_1 R_PLUS R_1)))
        (x,R_Recip(R_1 R_PLUS R_1),R_Recip(R_1 R_PLUS R_1))-->T621(*) ==> ((x R_TIMES R_Recip(R_1 R_PLUS R_1)) R_PLUS (x R_TIMES R_Recip(R_1 R_PLUS R_1))) =
		(x R_TIMES (R_Recip(R_1 R_PLUS R_1) R_PLUS R_Recip(R_1 R_PLUS R_1)))
        x-->T627(*) ==> (x R_TIMES R_1) = x
    EQUAL ==> false; Discharge ==> QED
--
-- The following proof is closely analogous to the proof of Theorem 519 concerning rationals.
--
Theorem 718: [The average of two real numbers lies between them] ((X in Re) & (Y in Re) & (X R_GT Y)) imp ((X R_GT ((X R_PLUS Y) R_OVER (R_1 R_PLUS R_1))) & (((X R_PLUS Y) R_OVER (R_1 R_PLUS R_1)) R_GT Y)). Proof:
Suppose_not(m,n) ==> AUTO
	(m,m)-->T672(*) ==> m R_GE m
	(n,n)-->T672(*) ==> n R_GE n
	(n,n,m,n)-->T696(*) ==> (n R_PLUS m) R_GT (n R_PLUS n)
	(m,m,m,n)-->T696(*) ==> (m R_PLUS m) R_GT (m R_PLUS n)
	n-->T627(*) ==> (n R_TIMES R_1) = n
	m-->T627(*) ==> (m R_TIMES R_1) = m
	T612(*) ==> (R_0 in Re) & (R_1 in Re)
	(n,R_1,R_1)-->T621(*) ==> ((n R_TIMES R_1) R_PLUS (n R_TIMES R_1)) = (n R_TIMES (R_1 R_PLUS R_1))
	(m,R_1,R_1)-->T621(*) ==> ((m R_TIMES R_1) R_PLUS (m R_TIMES R_1)) = (m R_TIMES (R_1 R_PLUS R_1))
	(n,m)-->T615(*) ==> (n R_PLUS m) = (m R_PLUS n)
	(m,n)-->T613(*) ==> (m R_PLUS n) in Re
	(m R_PLUS n)-->T716(*) ==> ((R_1 R_PLUS R_1) in Re) & ((R_1 R_PLUS R_1) R_GT R_0) & (R_Recip(R_1 R_PLUS R_1) in Re)
	(R_1 R_PLUS R_1,R_0)-->T673(*) ==> (R_1 R_PLUS R_1) /= R_0
	(R_1 R_PLUS R_1)-->T709(*) ==> R_Recip(R_1 R_PLUS R_1) R_GT R_0
	(R_Recip(R_1 R_PLUS R_1),m R_PLUS n)-->T618(*) ==> (R_Recip(R_1 R_PLUS R_1) R_TIMES (m R_PLUS n)) = ((m R_PLUS n) R_TIMES R_Recip(R_1 R_PLUS R_1))
	(R_1 R_PLUS R_1)-->T645(*) ==> ((R_1 R_PLUS R_1) R_TIMES R_Recip(R_1 R_PLUS R_1)) = R_1
	(m R_PLUS n,R_1 R_PLUS R_1)-->T652(*) ==> ((m R_PLUS n) R_TIMES R_Recip(R_1 R_PLUS R_1)) = ((m R_PLUS n) R_OVER (R_1 R_PLUS R_1))
	Suppose ==> not(((m R_PLUS n) R_OVER (R_1 R_PLUS R_1)) R_GT n)
		(n,R_1 R_PLUS R_1)-->T614(*) ==> (n R_TIMES (R_1 R_PLUS R_1)) in Re
		EQUAL ==> (m R_PLUS n) R_GT (n R_TIMES (R_1 R_PLUS R_1))
		(R_Recip(R_1 R_PLUS R_1),m R_PLUS n,n R_TIMES (R_1 R_PLUS R_1))-->T703(*) ==>
			(R_Recip(R_1 R_PLUS R_1) R_TIMES (m R_PLUS n)) R_GT
			(R_Recip(R_1 R_PLUS R_1) R_TIMES (n R_TIMES (R_1 R_PLUS R_1)))
		(R_Recip(R_1 R_PLUS R_1),n R_TIMES (R_1 R_PLUS R_1))-->T618(*) ==> (R_Recip(R_1 R_PLUS R_1) R_TIMES (n R_TIMES (R_1 R_PLUS R_1))) = ((n R_TIMES (R_1 R_PLUS R_1)) R_TIMES R_Recip(R_1 R_PLUS R_1))
		(n,R_1 R_PLUS R_1,R_Recip(R_1 R_PLUS R_1))-->T620(*) ==> ((n R_TIMES (R_1 R_PLUS R_1)) R_TIMES R_Recip(R_1 R_PLUS R_1)) = (n R_TIMES ((R_1 R_PLUS R_1) R_TIMES R_Recip(R_1 R_PLUS R_1)))
	EQUAL ==> false; Discharge ==> not(m R_GT ((m R_PLUS n) R_OVER (R_1 R_PLUS R_1)))
	(m,R_1 R_PLUS R_1)-->T614(*) ==> (m R_TIMES (R_1 R_PLUS R_1)) in Re
	EQUAL ==> ((m R_TIMES (R_1 R_PLUS R_1)) R_GT (m R_PLUS n))
	(R_Recip(R_1 R_PLUS R_1),m R_TIMES (R_1 R_PLUS R_1),m R_PLUS n)-->T703(*) ==>
		(R_Recip(R_1 R_PLUS R_1) R_TIMES (m R_TIMES (R_1 R_PLUS R_1))) R_GT
		(R_Recip(R_1 R_PLUS R_1) R_TIMES (m R_PLUS n))
	(R_Recip(R_1 R_PLUS R_1),m R_TIMES (R_1 R_PLUS R_1))-->T618(*) ==> (R_Recip(R_1 R_PLUS R_1) R_TIMES (m R_TIMES (R_1 R_PLUS R_1))) = ((m R_TIMES (R_1 R_PLUS R_1)) R_TIMES R_Recip(R_1 R_PLUS R_1))
	EQUAL ==> ((m R_TIMES (R_1 R_PLUS R_1)) R_TIMES R_Recip(R_1 R_PLUS R_1)) R_GT
		((m R_PLUS n) R_TIMES R_Recip(R_1 R_PLUS R_1))
	(m,R_1 R_PLUS R_1,R_Recip(R_1 R_PLUS R_1))-->T620(*) ==> ((m R_TIMES (R_1 R_PLUS R_1)) R_TIMES R_Recip(R_1 R_PLUS R_1)) = (m R_TIMES ((R_1 R_PLUS R_1) R_TIMES R_Recip(R_1 R_PLUS R_1)))
EQUAL ==> false; Discharge ==> QED
--
--
-- The following proof is entirely analogous to the proof of Theorem 522 concerning rationals.
--
Theorem 719: [Every positive real exceeds the sum of two smaller positive reals] ((X in Re) & (X R_GT R_0)) imp (EXISTS e in Re , e0 in Re | (X R_GT e) & (e R_GT e0) & (e0 R_GT R_0) & (e R_GT R_0) & (X R_GT (e R_PLUS e0))). Proof:
Suppose_not(x) ==> AUTO
--
-- For, if there could be a counterexample $x$, then we could take $e$ to be one half
-- of $x$ and $e0$ to be a half of $e$; and with these values, exploiting previously
-- proved lemmas, we would easily come to a contradiction.
--
	Loc_def ==> e = (x R_OVER (R_1 R_PLUS R_1))
	T612(*) ==> R_0 in Re
	x-->T626(*) ==> x = (x R_PLUS R_0)
	(x,R_0)-->T718(*) ==> (x R_GT ((x R_PLUS R_0) R_OVER (R_1 R_PLUS R_1))) & (((x R_PLUS R_0) R_OVER (R_1 R_PLUS R_1)) R_GT R_0)
	x-->T716(*) ==> (x R_OVER (R_1 R_PLUS R_1)) in Re
	EQUAL ==> (x R_GT e) & (e R_GT R_0) & (e in Re)
	(e,e)-->T672(*) ==> e R_GE e
	(e,R_0)-->T673(*) ==> e R_GE R_0
	Loc_def ==> e0 = (e R_OVER (R_1 R_PLUS R_1))
	e-->T626(*) ==> e = (e R_PLUS R_0)
	(e,R_0)-->T718(*) ==> (e R_GT ((e R_PLUS R_0) R_OVER (R_1 R_PLUS R_1))) & (((e R_PLUS R_0) R_OVER (R_1 R_PLUS R_1)) R_GT R_0)
	e-->T716(*) ==> (e R_OVER (R_1 R_PLUS R_1)) in Re
	EQUAL ==> (e R_GT e0) & (e0 R_GT R_0) & (e in Re)
	x-->T717(*) ==> x = ((x R_OVER (R_1 R_PLUS R_1)) R_PLUS (x R_OVER (R_1 R_PLUS R_1)))
	EQUAL ==> x = (e R_PLUS e)
        (e,e,e,e0)-->T696(*) ==> (e R_PLUS e) R_GT (e R_PLUS e0)
	EQUAL ==> x R_GT (e R_PLUS e0)
	(e,R_0,e0,R_0)-->T696(*) ==> (e R_PLUS e0) R_GT (R_0 R_PLUS R_0)
	R_0-->T626(*) ==> R_0 = (R_0 R_PLUS R_0)
	EQUAL ==> (e R_PLUS e0) R_GT R_0
	ELEM ==> Stat1: (not(EXISTS e in Re, e0 in Re | (x R_GT e) & (e R_GT e0) & (e0 R_GT R_0) & (e R_GT R_0) & (x R_GT (e R_PLUS e0))))
(e,e0)-->Stat1(*) ==> false; Discharge ==> QED
--
-- The following proof is entirely analogous to the proof of Theorem 523 concerning rationals.
--
Theorem 720: [Every positive real exceeds some smaller positive real] ((X in Re) & (X R_GT R_0)) imp (EXISTS e in Re | (X R_GT e) & (e R_GT R_0)). Proof:
Suppose_not(x) ==> AUTO
	x-->T719(*) ==> Stat1: (EXISTS e in Re, e0 in Re | (x R_GT e) & (e R_GT e0) & (e0 R_GT R_0) & (e R_GT R_0) & (x R_GT (e R_PLUS e0)))
	(e,e0)-->Stat1(Stat1*) ==> (e in Re) & (e0 in Re) & (x R_GT e) & (e R_GT e0) & (e0 R_GT R_0)
	(x,e,e0)-->T679(*) ==> x R_GT e0
	ELEM ==> Stat2: (not(EXISTS e in Re | (x R_GT e) & (e R_GT R_0)))
e0-->Stat2(*) ==> false; Discharge ==> QED
--
Theorem 721: [Trigger for Otter theory 'orderedGroups'] (R_0 in Re) &
	(FORALL x,y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) in Re)) &
	(FORALL x | (x in Re) imp (R_Rev(x) in Re)) &
	(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) imp (((x R_PLUS y) R_PLUS z) = (x R_PLUS (y R_PLUS z)))) &
	(FORALL x | (x in Re) imp ((x R_PLUS R_0) = x)) &
	(FORALL x | (x in Re) imp ((x R_PLUS R_Rev(x)) = R_0)) &
	(FORALL x,y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) = (y R_PLUS x))) &
	(FORALL x,y | ((x in Re) & (y in Re)) imp ((R_is_nonneg(x) & R_is_nonneg(y)) imp R_is_nonneg(x R_PLUS y))) &
	(FORALL x | (x in Re) imp (R_is_nonneg(x) or R_is_nonneg(R_Rev(x)))) &
	(FORALL x | (x in Re) imp ((R_is_nonneg(x) & R_is_nonneg(R_Rev(x))) imp (x = R_0))) &
	(FORALL x,y | ((x in Re) & (y in Re)) imp ((x R_LE y) eq R_is_nonneg(y R_PLUS R_Rev(x)))). Proof:
Suppose_not ==> AUTO
	()-->T612 ==> AUTO
	Suppose ==> Stat1: not(FORALL x,y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) in Re))
		(x1,y1)-->Stat1(Stat1*) ==> (x1 in Re) & (y1 in Re) & ((x1 R_PLUS y1) notin Re)
	(x1,y1)-->T613(Stat1*) ==> false; Discharge ==> (FORALL x,y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) in Re))
	Suppose ==> Stat2: not(FORALL x | (x in Re) imp (R_Rev(x) in Re))
		x2-->Stat2(Stat2*) ==> (x2 in Re) & (R_Rev(x2) notin Re)
	(x2,x2)-->T613(Stat2*) ==> false; Discharge ==> (FORALL x | (x in Re) imp (R_Rev(x) in Re))
	Suppose ==> Stat3: not(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) imp (((x R_PLUS y) R_PLUS z) = (x R_PLUS (y R_PLUS z))))
		(x3,y3,z3)-->Stat3(Stat3*) ==> (x3 in Re) & (y3 in Re) & (z3 in Re) & (((x3 R_PLUS y3) R_PLUS z3) /= (x3 R_PLUS (y3 R_PLUS z3)))
	(x3,y3,z3)-->T617(Stat3*) ==> false; Discharge ==> (FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) imp (((x R_PLUS y) R_PLUS z) = (x R_PLUS (y R_PLUS z))))
	Suppose ==> Stat4: not(FORALL x | (x in Re) imp ((x R_PLUS R_0) = x))
		x4-->Stat4(Stat4*) ==> (x4 in Re) & ((x4 R_PLUS R_0) /= x4)
	x4-->T626(Stat4*) ==> false; Discharge ==> (FORALL x | (x in Re) imp ((x R_PLUS R_0) = x))
	Suppose ==> Stat5: not(FORALL x | (x in Re) imp ((x R_PLUS R_Rev(x)) = R_0))
		x5-->Stat5(Stat5*) ==> (x5 in Re) & ((x5 R_PLUS R_Rev(x5)) /= R_0)
		(x5,x5)-->T635(Stat5*) ==> (x5 R_MINUS x5) /= R_0
	x5-->T631(Stat5*) ==> false; Discharge ==> (FORALL x | (x in Re) imp ((x R_PLUS R_Rev(x)) = R_0))
	Suppose ==> Stat6: not(FORALL x,y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) = (y R_PLUS x)))
		(x6,y6)-->Stat6(Stat6*) ==> (x6 in Re) & (y6 in Re) & ((x6 R_PLUS y6) /= (y6 R_PLUS x6))
	(x6,y6)-->T615(Stat6*) ==> false; Discharge ==> (FORALL x,y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) = (y R_PLUS x)))
	Suppose ==> Stat7: not(FORALL x,y | ((x in Re) & (y in Re)) imp ((R_is_nonneg(x) & R_is_nonneg(y)) imp R_is_nonneg(x R_PLUS y)))
		(x7,y7)-->Stat7(Stat7*) ==> (x7 in Re) & (y7 in Re) & R_is_nonneg(x7) & R_is_nonneg(y7) & (not R_is_nonneg(x7 R_PLUS y7))
	(x7,y7)-->T667(Stat7*) ==> false; Discharge ==> (FORALL x,y | ((x in Re) & (y in Re)) imp ((R_is_nonneg(x) & R_is_nonneg(y)) imp R_is_nonneg(x R_PLUS y)))
	Suppose ==> Stat8: not(FORALL x | (x in Re) imp (R_is_nonneg(x) or R_is_nonneg(R_Rev(x))))
		x8-->Stat8(Stat8*) ==> (x8 in Re) & (not(R_is_nonneg(x8) or R_is_nonneg(R_Rev(x8))))
	x8-->T663(Stat8*) ==> false; Discharge ==> (FORALL x | (x in Re) imp (R_is_nonneg(x) or R_is_nonneg(R_Rev(x))))
	Suppose ==> Stat9: not(FORALL x | (x in Re) imp ((R_is_nonneg(x) & R_is_nonneg(R_Rev(x))) imp (x = R_0)))
		x9-->Stat9(Stat9*) ==> (x9 in Re) & R_is_nonneg(x9) & R_is_nonneg(R_Rev(x9)) & (x9 /= R_0)
	x9-->T663(Stat9*) ==> false; Discharge ==> Stat10: not(FORALL x,y | ((x in Re) & (y in Re)) imp ((x R_LE y) eq R_is_nonneg(y R_PLUS R_Rev(x))))
	(x0,y0)-->Stat10(Stat10*) ==> (x0 in Re) & (y0 in Re) & (not((x0 R_LE y0) eq R_is_nonneg(y0 R_PLUS R_Rev(x0))))
(x0,y0)-->T675(Stat10*) ==> false; Discharge ==> QED
--
APPLY_otter(abs_thryvar:abs) orderedGroups(In_domain(x)->(x in Re), pluz(x,y)->(x R_PLUS y), e->R_0, rvz(x)->R_Rev(x), nneg(x)->R_is_nonneg(x), leq(x,y)->(x R_LE y)) ==>
Theorem 722: [Basic properties of the absolute value function] (FORALL x | abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if) &
	(FORALL x | (x in Re) imp (x R_LE abs(x))) &
	(FORALL x | (x in Re) imp (abs(abs(x)) = abs(x))) &
	(FORALL x | (x in Re) imp ((abs(x) = R_0) eq (x = R_0))) &
	(FORALL x | (x in Re) imp (abs(R_Rev(x)) = abs(x))) &
	(FORALL x,y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) R_LE (abs(x) R_PLUS abs(y)))) &
	(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) imp ((abs(x R_PLUS R_Rev(y)) R_LE z) imp (y R_LE (x R_PLUS z)))) &
	(FORALL x,y | ((x in Re) & (y in Re)) imp (abs(x R_PLUS y) R_LE (abs(x) R_PLUS abs(y)))) &
	(FORALL x,y | ((x in Re) & (y in Re)) imp ((not(R_is_nonneg(x))) imp ((x R_LE abs(y)) & (x /= abs(y))))) &
	(FORALL x,y,z | ((x in Re) & (y in Re) & (z in Re)) imp (abs((x R_PLUS R_Rev(z))) R_LE (abs(x R_PLUS R_Rev(y)) R_PLUS abs(y R_PLUS R_Rev(z))))) &
	(FORALL x,y | ((x in Re) & (y in Re)) imp (abs(abs(x) R_PLUS R_Rev(abs(y))) R_LE abs(x R_PLUS R_Rev(y)))) &
	(FORALL x,y | ((x in Re) & (y in Re)) imp (abs(x) R_PLUS R_Rev(abs(abs(y) R_PLUS R_Rev(abs(x)))) R_LE abs(y)))
--
Theorem 723: [The absolute value of $x$ is a non-negative real no smaller than $x$] (X in Re) imp ((abs(X) in Re) & (abs(X) R_GE R_0) & (abs(X) R_GE X) & (R_is_nonneg(abs(X)))). Proof:
Suppose_not(x) ==> AUTO
	T722(*) ==> Stat1: (FORALL x | abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if) & (x in Re)
	x-->Stat1(Stat1*) ==> abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if
	(x,x)-->T613(Stat1*) ==> R_Rev(x) in Re
	(Stat1*)ELEM ==> abs(x) in Re
	Suppose ==> Stat2: R_is_nonneg(x)
		x-->T681(Stat1*) ==> (x R_GE R_0) & (abs(x) = x)
		(x,x)-->T672(Stat1*) ==> x R_GE x
		EQUAL(Stat2) ==> (abs(x) R_GE R_0) & (abs(x) R_GE x) & R_is_nonneg(abs(x))
	Discharge ==> (not R_is_nonneg(x))
	x-->T663(Stat1*) ==> Stat3: R_is_nonneg(R_Rev(x)) & (abs(x) = R_Rev(x))
	EQUAL(Stat3) ==> R_is_nonneg(abs(x))
	(abs(x))-->T681(Stat1*) ==> abs(x) R_GE R_0
	x-->T681(Stat1*) ==> not(x R_GE R_0)
	T612(Stat3*) ==> R_0 in Re
	(x,R_0)-->T672(Stat1*) ==> R_0 R_GE x
(abs(x),R_0,x)-->T668(*) ==> false; Discharge ==> QED
--
Theorem 724: [The absolute value of $x$ is whichever of $x$ and $-x$ is non-negative] (X in Re) imp (abs(X) = if R_is_nonneg(X) then X else R_Rev(X) end if). Proof:
Suppose_not(x) ==> AUTO
	T722(*) ==> Stat1: (FORALL x | abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if) & (x in Re)
x-->Stat1(*) ==> false; Discharge ==> QED
--
Theorem 725: [The absolute value of $x$ is whichever of $x$ and $-x$ is non-negative, 2] (X in Re) imp (abs(X) = if R_is_nonneg(R_Rev(X)) then R_Rev(X) else X end if). Proof:
Suppose_not(x) ==> AUTO
	Suppose ==> Stat1: x = R_0
		()-->T629(*) ==> AUTO
		()-->T671(*) ==> AUTO
		EQUAL(Stat1) ==> (R_Rev(x) = R_0) & R_is_nonneg(R_Rev(x))
		ELEM ==> abs(x) /= R_Rev(x)
		T722(*) ==> Stat2: (FORALL x | (x in Re) imp ((abs(x) = R_0) eq (x = R_0)))
		x-->Stat2(*) ==> abs(x) = R_0
	x-->Stat2(*) ==> false; Discharge ==> x /= R_0
	x-->T663(*) ==> R_is_nonneg(x) neq R_is_nonneg(R_Rev(x))
	Suppose ==> (not R_is_nonneg(R_Rev(x)))
	x-->T724(*) ==> false; Discharge ==> R_is_nonneg(R_Rev(x))
x-->T724(*) ==> false; Discharge ==> QED
--
Theorem 726: [The absolute value of a real product is the product of absolute values] ((X in Re) & (Y in Re)) imp (abs(X R_TIMES Y) = (abs(X) R_TIMES abs(Y))). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T614(*) ==> Stat1: (x R_TIMES y) in Re
	Suppose ==> Stat2: (x = R_0) or (y = R_0)
		T722(*) ==> Stat3: (FORALL x | (x in Re) imp ((abs(x) = R_0) eq (x = R_0))) & (x in Re) & (y in Re)
		Suppose ==> not((abs(x) = R_0) or (abs(y) = R_0))
			Suppose ==> x = R_0
			x-->Stat3(Stat3*) ==> false; Discharge ==> y = R_0
		y-->Stat3(Stat3*) ==> false; Discharge ==> Stat4: (abs(x) = R_0) or (abs(y) = R_0)
		(x,y)-->T700(Stat2*) ==> (x R_TIMES y) = R_0
		(x R_TIMES y)-->Stat3(*) ==> Stat5: (abs(x) R_TIMES abs(y)) /= R_0
		x-->T723(Stat3*) ==> abs(x) in Re
		y-->T723(Stat3*) ==> abs(y) in Re
	(abs(x),abs(y))-->T700(Stat4*) ==> false; Discharge ==> Stat6: (x /= R_0) & (y /= R_0) & (x in Re) & (y in Re)
	x-->T724(Stat6,Stat6*) ==> Stat7: abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if
	y-->T724(Stat6,Stat6*) ==> Stat8: abs(y) = if R_is_nonneg(y) then y else R_Rev(y) end if
	(x R_TIMES y)-->T724(Stat1*) ==> Stat9: abs(x R_TIMES y) = if R_is_nonneg(x R_TIMES y) then (x R_TIMES y) else R_Rev(x R_TIMES y) end if
	x-->T642(Stat6,Stat6*) ==> R_Rev(x) = (R_Rev(R_1) R_TIMES x)
	y-->T642(Stat6,Stat6*) ==> R_Rev(y) = (R_Rev(R_1) R_TIMES y)
	(x R_TIMES y)-->T642(Stat1,Stat1*) ==> R_Rev(x R_TIMES y) = (R_Rev(R_1) R_TIMES (x R_TIMES y))
	(x,y)-->T623(Stat6,Stat6*) ==> Stat10: (((x R_TIMES R_Rev(y)) = R_Rev(x R_TIMES y)) & ((R_Rev(x) R_TIMES y) = R_Rev(x R_TIMES y)) & ((R_Rev(x) R_TIMES R_Rev(y)) = (x R_TIMES y)))
	(x,x)-->T613(Stat6,Stat6*) ==> R_Rev(x) in Re
	(y,y)-->T613(Stat6,Stat6*) ==> R_Rev(y) in Re
	Suppose ==> Stat11: R_is_nonneg(x) & R_is_nonneg(y)
		(x,y)-->T667(Stat6,Stat11*) ==> Stat12: R_is_nonneg(x R_TIMES y)
		(Stat7,Stat8,Stat9,Stat11,Stat12*)ELEM ==> (abs(x) = x) & (abs(y) = y) & (abs(x R_TIMES y) = (x R_TIMES y))
	EQUAL ==> false; Discharge ==> not(R_is_nonneg(x) & R_is_nonneg(y))
	(x,y)-->T700(*) ==> Stat13: ((x R_TIMES y) /= R_0) & (x in Re) & (y in Re)
	Suppose ==> Stat14: R_is_nonneg(x) & (not R_is_nonneg(y))
		y-->T663(Stat10*) ==> R_is_nonneg(R_Rev(y))
		(x,R_Rev(y))-->T667(Stat10*) ==> R_is_nonneg(x R_TIMES R_Rev(y))
		EQUAL(Stat10) ==> R_is_nonneg(R_Rev(x R_TIMES y))
		(x R_TIMES y)-->T663(Stat1*) ==> abs(x R_TIMES y) = R_Rev(x R_TIMES y)
		(Stat7,Stat8,Stat9,Stat14*)ELEM ==> (abs(x) = x) & (abs(y) = R_Rev(y))
	EQUAL ==> false; Discharge ==> not(R_is_nonneg(x) & (not R_is_nonneg(y)))
	Suppose ==> Stat15: R_is_nonneg(y) & (not R_is_nonneg(x))
		x-->T663(Stat10*) ==> R_is_nonneg(R_Rev(x))
		(R_Rev(x),y)-->T667(Stat10*) ==> R_is_nonneg(R_Rev(x) R_TIMES y)
		EQUAL(Stat10) ==> R_is_nonneg(R_Rev(x R_TIMES y))
		(x R_TIMES y)-->T663(Stat1*) ==> abs(x R_TIMES y) = R_Rev(x R_TIMES y)
		(Stat7,Stat8,Stat9,Stat15*)ELEM ==> (abs(x) = R_Rev(x)) & (abs(y) = y)
	EQUAL ==> false; Discharge ==> Stat16: (not R_is_nonneg(x)) & (not R_is_nonneg(y))
	x-->T663(Stat13*) ==> R_is_nonneg(R_Rev(x))
	y-->T663(Stat13*) ==> R_is_nonneg(R_Rev(y))
	(R_Rev(x),R_Rev(y))-->T667(Stat10*) ==> R_is_nonneg(R_Rev(x) R_TIMES R_Rev(y))
	EQUAL(Stat10) ==> Stat17: R_is_nonneg(x R_TIMES y)
	(Stat7,Stat8,Stat9,Stat16,Stat17*)ELEM ==> (abs(x) = R_Rev(x)) & (abs(y) = R_Rev(y)) & (abs(x R_TIMES y) = (x R_TIMES y))
EQUAL ==> false; Discharge ==> QED
--
--
--
Theorem 727: [$x$ and $-x$ have the same absolute value] (X in Re) imp (abs(X) = abs(R_Rev(X))). Proof:
Suppose_not(x) ==> AUTO
	T722(*) ==> Stat1: (FORALL x | (x in Re) imp (abs(R_Rev(x)) = abs(x)))
x-->Stat1(*) ==> false; Discharge ==> QED
--
--
--
--Theorem OM: [Another characterization of the absolute value of a real] (X in Re) imp (abs(X) = Cauchy_to_Re(Ras_ABS(arb(X)))). Proof:
--Suppose_not(x) ==> AUTO
--	x-->T724(*) ==> abs(x) = if R_is_nonneg(x) then x else R_Rev(x) end if
--	Suppose ==> R_is_nonneg(x)
--		ELEM ==> abs(x) = x
--		EQUAL ==> x /= Cauchy_to_Re(Ras_ABS(arb(x)))
--		x-->T664(*) ==> Ra_eqseq(arb(x),Ras_ABS(arb(x)))
--		x-->T611(*) ==> (arb(x) in RaCauchy) & (Cauchy_to_Re(arb(x)) = x)
--		(arb(x),arb(x))-->T556(*) ==> Ras_ABS(arb(x)) in RaCauchy
--	(arb(x),Ras_ABS(arb(x)))-->T610(*) ==> false; Discharge ==> (not R_is_nonneg(x)) & (abs(x) = R_Rev(x))
--	Use_def(R_is_nonneg)(*) ==> Stat1: (Cauchy_to_Re(Ras_ABS(arb(x))) /= x) & (R_Rev(x) /= Cauchy_to_Re(Ras_ABS(arb(X))))
--	Use_def(R_Rev)(Stat1*) ==> Cauchy_to_Re(Ras_ABS(arb(x))) /= Cauchy_to_Re(Ras_Rev(arb(x)))
--Tsomehow ==> false; Discharge ==> QED
--
--
--
Theorem 728: [Monotonicity of addition, 2] ((X in Re) & (Y in Re) & R_is_nonneg(R_Rev(Y))) imp ((X R_GT (X R_PLUS Y)) or (X = (X R_PLUS Y))). Proof:
Suppose_not(x,y) ==> AUTO
--
-- Assuming the contrary of the assertion to hold for $x,y$, we easily obtain $R_0 R_GE y$
-- and hence, by <ddition, $(x R_PLUS R_0) R_GE (x R_PLUS y)$
--
	(y,y)-->T613 ==> AUTO
	(R_Rev(y))-->T681(*) ==> R_Rev(y) R_GE R_0
	()-->T612 ==> AUTO
	(R_Rev(y),R_0)-->T691(*) ==> Stat1: R_Rev(R_0) R_GE R_Rev(R_Rev(y))
	()-->T629 ==> AUTO
	y-->T633(*) ==> R_Rev(R_Rev(y)) = y
	EQUAL(Stat1) ==> R_0 R_GE y
	(x,x)-->T672(*) ==> x R_GE x
	(x,x,R_0,y)-->T695(*) ==> (x R_PLUS R_0) R_GE (x R_PLUS y)
--
-- Since $(x R_PLUS R_0) = R_0$ and
-- $(x R_GE (x R_PLUS y)) eq ((x R_GT (x R_PLUS y)) or (x = (x R_PLUS y)))$,
-- we readily get into a contradiction, which gives us the desired conclusion.
--
	(x,y)-->T613 ==> AUTO
	(x,x R_PLUS y)-->T680(*) ==> not(x R_GE (x R_PLUS y))
	x-->T626(*) ==> (x R_PLUS R_0) = x
EQUAL ==> false; Discharge ==> QED
--
Theorem 729: ((X in Re) & (Y in Re) & R_is_nonneg(X) & (not R_is_nonneg(Y))) imp
		((X R_GE abs(X R_PLUS Y)) or (R_Rev(Y) R_GE abs(X R_PLUS Y))). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T613(*) ==> Stat1: ((x R_PLUS y) in Re) & (R_Rev(x) in Re)
	(y,y)-->T613(*) ==> Stat2: (R_Rev(y) in Re)
	(x R_PLUS y)-->T723(*) ==> abs(x R_PLUS y) in Re
	(x R_PLUS y)-->T723(Stat1*) ==> (abs(x R_PLUS y) in Re) & (abs(x R_PLUS y) R_GE R_0) & (abs(x R_PLUS y) R_GE (x R_PLUS y))
	(x,abs(x R_PLUS y))-->T680(*) ==> not((x R_GT abs(x R_PLUS y)) or (x = abs(x R_PLUS y)) or (R_Rev(y) R_GE abs(x R_PLUS y)))
	(R_Rev(y),abs(x R_PLUS y))-->T680(*) ==> Stat3: (x in Re) & (y in Re) & R_is_nonneg(x) & (not (R_is_nonneg(y))) &
		(not((x R_GT abs(x R_PLUS y)) or (x = abs(x R_PLUS y)) or (R_Rev(y) R_GT abs(x R_PLUS y)) or (R_Rev(y) = abs(x R_PLUS y))))
	y-->T663(*) ==> R_is_nonneg(R_Rev(y))
	y-->T725(*) ==> abs(y) = R_Rev(y)
	(x,y)-->T728(*) ==> (x R_GT (x R_PLUS y)) or (x = (x R_PLUS y))
	x-->T633(*) ==> R_Rev(R_Rev(x)) = x
	EQUAL ==> R_is_nonneg(R_Rev(R_Rev(x)))
	x-->T724(*) ==> abs(x) = x
	(R_Rev(y),R_Rev(x))-->T728(*) ==> Stat4: (R_Rev(y) R_GT (R_Rev(y) R_PLUS R_Rev(x))) or (R_Rev(y) = (R_Rev(y) R_PLUS R_Rev(x)))
	Suppose ==> Stat5: R_is_nonneg(x R_PLUS y)
		(x R_PLUS y)-->T724(Stat1,Stat5*) ==> abs(x R_PLUS y) = x R_PLUS y
		EQUAL ==> (x R_GT abs(x R_PLUS y)) or (x = abs(x R_PLUS y))
	(x,abs(x R_PLUS y))-->T680(*) ==> false; Discharge ==> Stat6: (not R_is_nonneg(x R_PLUS y))
	(x R_PLUS y)-->T663(Stat1*) ==> R_is_nonneg(R_Rev(x R_PLUS y))
	(x R_PLUS y)-->T725(*) ==> abs(x R_PLUS y) = R_Rev(x R_PLUS y)
	(x R_PLUS y)-->T724(Stat1,Stat6*) ==> abs(x R_PLUS y) = R_Rev(x R_PLUS y)
	(x,y)-->T638(*) ==> abs(x R_PLUS y) = (R_Rev(x) R_PLUS R_Rev(y))
	(R_Rev(x),R_Rev(y))-->T615(*) ==> (R_Rev(x) R_PLUS R_Rev(y)) = (R_Rev(y) R_PLUS R_Rev(x))
	EQUAL(Stat4) ==> (R_Rev(y) R_GT abs(x R_PLUS y)) or (R_Rev(y) = abs(x R_PLUS y))
(R_Rev(y),abs(x R_PLUS y))-->T680(*)  ==> false; Discharge ==> QED
--
Theorem 730: ((X in Re) & (Y in Re)) imp (((X R_PLUS abs(Y)) R_GE X)). Proof:
Suppose_not(x,y) ==> AUTO
	y-->T723(*) ==> Stat1: (abs(y) in Re) & R_is_nonneg(abs(y))
	(abs(y))-->T633(*) ==> R_Rev(R_Rev(abs(y))) = abs(y)
	(abs(y),abs(y))-->T613(*) ==> R_Rev(abs(y)) in Re
	EQUAL(Stat1) ==> R_is_nonneg(R_Rev(R_Rev(abs(y))))
	(x,x)-->T613(*) ==> R_Rev(x) in Re
	(R_Rev(x),R_Rev(abs(y)))-->T728(*) ==> (R_Rev(x) R_GT (R_Rev(x) R_PLUS R_Rev(abs(y)))) or (R_Rev(x) = (R_Rev(x) R_PLUS R_Rev(abs(y))))
	(R_Rev(x),R_Rev(abs(y)))-->T613(*) ==> (R_Rev(x) R_PLUS R_Rev(abs(y))) in Re
	(R_Rev(x),R_Rev(x) R_PLUS R_Rev(abs(y)))-->T680(*) ==> R_Rev(x) R_GE (R_Rev(x) R_PLUS R_Rev(abs(y)))
	(R_Rev(x),R_Rev(x) R_PLUS R_Rev(abs(y)))-->T691(*) ==> Stat2: R_Rev(R_Rev(x) R_PLUS R_Rev(abs(y))) R_GE R_Rev(R_Rev(x))
	x-->T723(*) ==> abs(x) in Re
	(abs(x))-->T633(Stat2) ==> R_Rev(R_Rev(abs(x))) = abs(x)
	x-->T633(*) ==> R_Rev(R_Rev(x)) = x
	(R_Rev(x),R_Rev(abs(y)))-->T638(Stat1*) ==> R_Rev(R_Rev(x) R_PLUS R_Rev(abs(y))) = (R_Rev(R_Rev(x)) R_PLUS R_Rev(R_Rev(abs(y))))
EQUAL ==> false; Discharge ==> QED
--
Theorem 731: ((X in Re) & (Y in Re)) imp (((abs(X) R_PLUS abs(Y)) R_GT abs(X R_PLUS Y)) or ((abs(X) R_PLUS abs(Y)) = abs(X R_PLUS Y))). Proof:
Suppose_not(x,y) ==> AUTO
	T722(*) ==> Stat1: (FORALL x,y | ((x in Re) & (y in Re)) imp (abs(x R_PLUS y) R_LE (abs(x) R_PLUS abs(y))))
	(x,y)-->Stat1(*) ==> Stat2: (x in Re) & (y in Re) & (abs(x R_PLUS y) R_LE (abs(x) R_PLUS abs(y)))
	(x,y)-->T613(Stat2*) ==> Stat3: (x R_PLUS y) in Re
	(x R_PLUS y)-->T723(Stat3*) ==> abs(x R_PLUS y) in Re
	x-->T723(Stat2*) ==> abs(x) in Re
	y-->T723(Stat2*) ==> abs(y) in Re
	(abs(x),abs(y))-->T613(Stat3*) ==> (abs(x) R_PLUS abs(y)) in Re
	(abs(x) R_PLUS abs(y),abs(x R_PLUS y))-->T680(*) ==> not((abs(x) R_PLUS abs(y)) R_GE abs(x R_PLUS y))
(abs(x R_PLUS y),abs(x) R_PLUS abs(y))-->T673(Stat2*) ==> false; Discharge ==> QED
--
Theorem 732: [The absolute value of a real quotient is the quotient of absolute values]  ((X in Re) & (Y in Re) & (Y /= R_0)) imp ((abs(X) R_OVER abs(Y)) = abs(X R_OVER Y)). Proof:
Suppose_not(x,y) ==> AUTO
--
-- Regarding the right-hand side of the supposed inequality, we easily reduce
-- it to the form $(abs(x) R_TIMES abs(R_Recip(y)))$.
--
	(x,y)-->T652(*) ==> Stat1: ((x R_OVER y) = (x R_TIMES R_Recip(y))) & (x in Re) & (y in Re) & (y /= R_0)
	y-->T647(Stat1*) ==> Stat2: (R_Recip(y) in Re) & (R_Recip(y) /= R_0)
	(x,R_Recip(y))-->T726(Stat1*) ==> abs(x R_TIMES R_Recip(y)) = (abs(x) R_TIMES abs(R_Recip(y)))
	EQUAL ==> Stat3: (abs(x) R_OVER abs(y)) /= (abs(x) R_TIMES abs(R_Recip(y)))
--
-- By reducing the left-hand side of the supposed inequality to the same form
-- to which we have reduced the right-hand side,
-- we will reach a contradiction and hence the desired conclusion.
-- As a preliminary step, after observing that $abs(y) /= R_0$,
-- we reduce the left-hand side to a form where $R_Recip(abs(y))$
-- appears in place of $abs(R_Recip(y))$.
--
	y-->T723(Stat1,Stat1*) ==> Stat4: (abs(y) in Re) & (abs(y) R_GE R_0) & (abs(y) R_GE y) & R_is_nonneg(abs(y))
	Suppose ==> Stat5: abs(y) = R_0
		EQUAL(Stat3) ==> Stat6: R_0 R_GE y
		T612(Stat7*) ==> Stat7: R_0 in Re
		(R_0,y)-->T673(Stat1,Stat6,Stat7*) ==> R_is_nonneg(R_0 R_PLUS R_Rev(y))
		(y,y)-->T613(Stat1,Stat1*) ==> R_Rev(y) in Re
		(R_Rev(y))-->T626(Stat7*) ==> (R_0 R_PLUS R_Rev(y)) = R_Rev(y)
		EQUAL(Stat7) ==> R_is_nonneg(R_Rev(y))
		y-->T725(Stat1,Stat5*) ==> R_0 = R_Rev(y)
		T693 ==> R_Rev(R_0) = R_0
		y-->T633(Stat1,Stat1*) ==> R_Rev(R_Rev(y)) = y
	EQUAL(Stat1) ==> false; Discharge ==> Stat8: abs(y) /= R_0
	x-->T723(Stat1,Stat1*) ==> abs(x) in Re
	(abs(x),abs(y))-->T652(Stat3*) ==> Stat9: (abs(x) R_TIMES R_Recip(abs(y))) /= (abs(x) R_TIMES abs(R_Recip(y)))
--
-- Then we show that $R_Recip(abs(y))$ and $abs(R_Recip(y))$ are,
-- as a matter of fact, the same number, thus reaching the expected contradiction.
-- This part of the proof splits into the case when $y$ is positive and the
-- case when $y$ is negative.
--
	Suppose ==> Stat10: R_Recip(abs(y)) /= abs(R_Recip(y))
		Suppose ==> Stat11: R_is_nonneg(y) & (not R_is_nonneg(R_Rev(y)))
			y-->T724(Stat1,Stat11*) ==> abs(y) = y
			y-->T630(Stat1,Stat1*) ==> (y R_MINUS R_0) = y
			EQUAL(Stat9) ==> Stat12: (R_Recip(y) /= abs(R_Recip(y))) & R_is_nonneg(y R_MINUS R_0)
			Use_def(R_GT)(Stat1,Stat12*) ==> Stat13: y R_GT R_0
			y-->T709(Stat1,Stat13*) ==> R_Recip(y) R_GT R_0
			Use_def(R_GT)(Stat13*) ==> R_is_nonneg(R_Recip(y) R_MINUS R_0)
			(R_Recip(y))-->T630(Stat2,Stat2*) ==> (R_Recip(y) R_MINUS R_0) = R_Recip(y)
			EQUAL(Stat13) ==> Stat14: R_is_nonneg(R_Recip(y))
			(R_Recip(y))-->T724(Stat2,Stat14*) ==> abs(R_Recip(y)) = R_Recip(y)
		EQUAL(Stat10) ==> false; Discharge ==> Stat15: not(R_is_nonneg(y) & (not R_is_nonneg(R_Rev(y))))
		y-->T663(Stat1,Stat15*) ==> Stat16: (not R_is_nonneg(y)) & R_is_nonneg(R_Rev(y))
		y-->T724(Stat1,Stat16*) ==> Stat17: abs(y) = R_Rev(y)
		(R_Rev(y))-->T630(Stat4,Stat17*) ==> (R_Rev(y) R_MINUS R_0) = R_Rev(y)
		EQUAL(Stat10) ==> (R_Recip(R_Rev(y)) /= abs(R_Recip(y))) & R_is_nonneg(R_Rev(y) R_MINUS R_0)
		Use_def(R_GT)(Stat8,Stat17*) ==> Stat18: R_Rev(y) R_GT R_0
		(R_Rev(y))-->T709(Stat4,Stat17,Stat18*) ==> R_Recip(R_Rev(y)) R_GT R_0
		Use_def(R_GT)(Stat13*) ==> Stat19: R_is_nonneg(R_Recip(R_Rev(y)) R_MINUS R_0)
		(R_Rev(y))-->T647(Stat4,Stat17,Stat8*) ==> Stat20: (R_Recip(R_Rev(y)) in Re) & (R_Recip(R_Rev(y)) /= R_0)
		(R_Recip(R_Rev(y)))-->T630(Stat20,Stat20*) ==> (R_Recip(R_Rev(y)) R_MINUS R_0) = R_Recip(R_Rev(y))
		EQUAL(Stat18) ==> Stat21: R_is_nonneg(R_Recip(R_Rev(y)))
		(R_Recip(R_Rev(y)))-->T724(Stat20,Stat21*) ==> abs(R_Recip(R_Rev(y))) = R_Recip(R_Rev(y))
		y-->T649(Stat1,Stat1*) ==> R_Recip(R_Rev(y)) = R_Rev(R_Recip(y))
		EQUAL(Stat10) ==> Stat22: abs(R_Rev(R_Recip(y))) /= abs(R_Recip(y))
	(R_Recip(y))-->T727(Stat2,Stat22*) ==> false; Discharge ==> R_Recip(abs(y)) = abs(R_Recip(y))
EQUAL(Stat9*) ==> false; Discharge ==> QED
--
-- The equivalent real of a rational number $r$
-- is the real number defined by the constant Cauchy
-- sequence all of whose values are $r$.
--
Def 69: [Embedding of rationals into reals] ReRa(X) := Cauchy_to_Re(Za PROD {X})
--
-- In preparation for Theorem 736, we need the following two elementary lemmas.
--
Theorem 733: (X in Ra) imp (Ra_is_nonneg(X) eq Ra_eqseq(Za PROD {Ra_ABS(X)},Za PROD {X})). Proof:
Suppose_not(x0) ==> AUTO
	x0-->T452(*) ==> Ra_Rev(x0) in Ra
	T525(*) ==> Stat1: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if) &
		Stat2: (FORALL x | (x in Ra) imp (Ra_ABS(x Ra_PLUS Ra_Rev(x)) = Ra_0)) &
		Stat3: (FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0)))
	x0-->T543(*) ==> (Za PROD {x0}) in RaCauchy
	(Ra_Rev(x0))-->T543(*) ==> (Za PROD {Ra_Rev(x0)}) in RaCauchy
	T539(Stat1*) ==> ((Za PROD {x0}) in RaSeq) & ((Za PROD {Ra_Rev(x0)}) in RaSeq)
	Suppose ==> Ra_is_nonneg(x0) & (not Ra_eqseq(Za PROD {Ra_ABS(x0)},Za PROD {x0}))
		x0-->Stat1(Stat1) ==> Ra_ABS(x0) = x0
		EQUAL(Stat1) ==> (not Ra_eqseq(Za PROD {x0}, Za PROD {x0}))
	(Za PROD {x0})-->T546(Stat1*) ==> false; Discharge ==> (not Ra_is_nonneg(x0)) & Ra_eqseq(Za PROD {Ra_ABS(x0)},Za PROD {x0})
	x0-->Stat1(Stat1*) ==> Ra_ABS(x0) = Ra_Rev(x0)
	EQUAL(Stat1) ==> Ra_eqseq(Za PROD {Ra_Rev(x0)},Za PROD {x0})
	(Za PROD {Ra_Rev(x0)},Za PROD {x0})-->T541(Stat1*) ==> Stat4: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp Finite({i: i in Za | Ra_ABS(((Za PROD {Ra_Rev(x0)})~[i]) Ra_MINUS ((Za PROD {x0})~[i])) Ra_GT eps}))
	(Ra_Rev(x0),x0)-->T454(*) ==> (Ra_Rev(x0) Ra_MINUS x0) in Ra
	Suppose ==> (not((Ra_Rev(x0) Ra_MINUS x0) Ra_GT Ra_0))
		Use_def(Ra_MINUS)(Stat4*) ==> (not((Ra_Rev(x0) Ra_PLUS Ra_Rev(x0)) Ra_GT Ra_0))
		x0-->T451(*) ==> (Ra_0 in Ra) & (x0 = (x0 Ra_PLUS Ra_0))
		Suppose ==> Ra_Rev(x0) = Ra_0
			x0-->Stat2(*) ==> Ra_ABS(x0 Ra_PLUS Ra_Rev(x0)) = Ra_0
			(x0,Ra_Rev(x0))-->T445(*) ==> (x0 Ra_PLUS Ra_Rev(x0)) in Ra
			(x0 Ra_PLUS Ra_Rev(x0))-->Stat3(*) ==> (x0 Ra_PLUS Ra_Rev(x0)) = Ra_0
			EQUAL(Stat4) ==> x0 = Ra_0
			T465(*) ==> Ra_is_nonneg(Ra_0)
		EQUAL(Stat1) ==> false; Discharge ==> Ra_Rev(x0) /= Ra_0
		x0-->T466(*) ==> Ra_is_nonneg(Ra_Rev(x0))
		(Ra_Rev(x0))-->T482(*) ==> Ra_Rev(x0) Ra_GE Ra_0
		(Ra_Rev(x0),Ra_0)-->T473(*) ==> Ra_Rev(x0) Ra_GT Ra_0
		(Ra_Rev(x0),Ra_0,Ra_Rev(x0),Ra_0)-->T505(*) ==> (Ra_Rev(x0) Ra_PLUS Ra_Rev(x0)) Ra_GT (Ra_0 Ra_PLUS Ra_0)
		Ra_0-->T451(*) ==> Ra_0 = (Ra_0 Ra_PLUS Ra_0)
	EQUAL(Stat4) ==> false; Discharge ==> (Ra_Rev(x0) Ra_MINUS x0) Ra_GT Ra_0
	(Ra_Rev(x0) Ra_MINUS x0)-->T522(*) ==> Stat5: (EXISTS e in Ra, e0 in Ra | ((Ra_Rev(x0) Ra_MINUS x0) Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e Ra_GT Ra_0) & ((Ra_Rev(x0) Ra_MINUS x0) Ra_GT (e Ra_PLUS e0)))
	(e,e0)-->Stat5(Stat5*) ==> (e in Ra) & (e Ra_GT Ra_0) & ((Ra_Rev(x0) Ra_MINUS x0) Ra_GT e)
	Suppose ==> Za = {i: i in Za | Ra_ABS(((Za PROD {Ra_Rev(x0)})~[i]) Ra_MINUS ((Za PROD {x0})~[i])) Ra_GT e}
		e-->Stat4(Stat4*) ==> Finite({i: i in Za | Ra_ABS(((Za PROD {Ra_Rev(x0)})~[i]) Ra_MINUS ((Za PROD {x0})~[i])) Ra_GT e})
		EQUAL(Stat5*) ==> Finite(Za)
	0-->T206(Stat5*) ==> false; Discharge ==> Stat6: Za /= {i: i in Za | Ra_ABS(((Za PROD {Ra_Rev(x0)})~[i]) Ra_MINUS ((Za PROD {x0})~[i])) Ra_GT e}
	SIMPLF(Stat6*) ==> Stat7: {i: i in Za} /=  {i: i in Za | Ra_ABS(((Za PROD {Ra_Rev(x0)})~[i]) Ra_MINUS ((Za PROD {x0})~[i])) Ra_GT e}
	i0-->Stat7(Stat7*) ==> Stat8: (i0 in Za) & (not(Ra_ABS(((Za PROD {Ra_Rev(x0)})~[i0]) Ra_MINUS ((Za PROD {x0})~[i0])) Ra_GT e))
	Suppose ==> (((Za PROD {Ra_Rev(x0)})~[i0]) = Ra_Rev(x0)) & (((Za PROD {x0})~[i0]) = x0)
		(Ra_Rev(x0) Ra_MINUS x0)-->T529(Stat4*) ==> Ra_ABS(Ra_Rev(x0) Ra_MINUS x0) = (Ra_Rev(x0) Ra_MINUS x0)
	EQUAL(Stat5) ==> false; Discharge ==> (not((((Za PROD {Ra_Rev(x0)})~[i0]) = Ra_Rev(x0)) & (((Za PROD {x0})~[i0]) = x0)))
	Suppose ==> Stat9: ((Za PROD {Ra_Rev(x0)})~[i0]) /= Ra_Rev(x0)
		Use_def(PROD)(Stat9*) ==> (Za PROD {Ra_Rev(x0)}) = {[x,y]: x in Za, y in {Ra_Rev(x0)}}
		SIMPLF(Stat9*) ==> (Za PROD {Ra_Rev(x0)}) = {[x,Ra_Rev(x0)]: x in Za}
		APPLY() fcn_symbol(f(yy)->Ra_Rev(x0), g->(Za PROD {Ra_Rev(x0)}), s->Za) ==> (domain(Za PROD {Ra_Rev(x0)}) = Za) & Svm(Za PROD {Ra_Rev(x0)})
			& Stat10: (FORALL yy | ((Za PROD {Ra_Rev(x0)})~[yy]) = if yy in Za then Ra_Rev(x0) else 0 end if)
	i0-->Stat10(Stat8) ==> false; Discharge ==> Stat11: ((Za PROD {x0})~[i0]) /= x0
	Use_def(PROD)(Stat11*) ==> (Za PROD {x0}) = {[x,y]: x in Za, y in {x0}}
	SIMPLF(Stat11*) ==> (Za PROD {x0}) = {[x,x0]: x in Za}
	APPLY() fcn_symbol(f(yy)->x0, g->(Za PROD {x0}), s->Za) ==> (domain(Za PROD {x0}) = Za) & Svm(Za PROD {x0})
		& Stat12: (FORALL yy | ((Za PROD {x0})~[yy]) = if yy in Za then x0 else 0 end if)
i0-->Stat12(Stat8) ==> false; Discharge ==> QED
--
--
--
Theorem 734: (X in Ra) imp (R_is_nonneg(Cauchy_to_Re(Za PROD {X})) eq (ReRa(Ra_ABS(X)) = ReRa(X))). Proof:
Suppose_not(y0) ==> AUTO
	T608(Stat1*) ==> Stat1: (FORALL f in RaCauchy, g in RaCauchy, h in RaCauchy | (Ra_eqseq(f,g) & Ra_eqseq(g,h)) imp Ra_eqseq(f,h))
	y0-->T544(*) ==> Stat2: Ras_ABS(Za PROD {y0}) = (Za PROD {Ra_ABS(y0)})
	Use_def(ReRa) ==> Stat3: (y0 in Ra) & (not(R_is_nonneg(Cauchy_to_Re(Za PROD {y0})) eq (Cauchy_to_Re(Za PROD {Ra_ABS(y0)}) = Cauchy_to_Re(Za PROD {y0}))))
	y0-->T527(Stat3*) ==> Ra_ABS(y0) in Ra
	y0-->T543(Stat3*) ==> Stat4: (Za PROD {y0}) in RaCauchy
	(Ra_ABS(y0))-->T543(Stat3*) ==> (Za PROD {Ra_ABS(y0)}) in RaCauchy
	(Za PROD {y0},Za PROD {y0})-->T610(Stat3*) ==> (Cauchy_to_Re(Za PROD {y0}) in Re) &
		Ra_eqseq(Za PROD {y0},arb(Cauchy_to_Re(Za PROD {y0})))
	(Za PROD {Ra_ABS(y0)},Za PROD {y0})-->T610(Stat3*) ==> (Cauchy_to_Re(Za PROD {Ra_ABS(y0)}) in Re) &
		Ra_eqseq(Za PROD {Ra_ABS(y0)},arb(Cauchy_to_Re(Za PROD {Ra_ABS(y0)}))) &
		((Cauchy_to_Re(Za PROD {Ra_ABS(y0)}) = Cauchy_to_Re(Za PROD {y0})) eq (Ra_eqseq(Za PROD {Ra_ABS(y0)},Za PROD {y0})))
	(Cauchy_to_Re(Za PROD {y0}))-->T664(Stat3*) ==> R_is_nonneg(Cauchy_to_Re(Za PROD {y0})) eq Ra_eqseq(arb(Cauchy_to_Re(Za PROD {y0})),Ras_ABS(arb(Cauchy_to_Re(Za PROD {y0}))))
	(Cauchy_to_Re(Za PROD {y0}))-->T611(Stat3*) ==> Stat5: arb(Cauchy_to_Re(Za PROD {y0})) in RaCauchy
	(arb(Cauchy_to_Re(Za PROD {y0})),arb(Cauchy_to_Re(Za PROD {y0})))-->T556(Stat5,Stat5*) ==> Ras_ABS(arb(Cauchy_to_Re(Za PROD {y0}))) in RaCauchy
	(Za PROD {y0},Za PROD {y0})-->T556(Stat4,Stat4*) ==> Ras_ABS(Za PROD {y0}) in RaCauchy
	(Za PROD {y0},arb(Cauchy_to_Re(Za PROD {y0})))-->T576(Stat3*) ==> Stat6: Ra_eqseq(Ras_ABS(Za PROD {y0}),Ras_ABS(arb(Cauchy_to_Re(Za PROD {y0}))))
	Suppose ==> R_is_nonneg(Cauchy_to_Re(Za PROD {y0}))
		(Stat3*)ELEM ==> Ra_eqseq(arb(Cauchy_to_Re(Za PROD {y0})),Ras_ABS(arb(Cauchy_to_Re(Za PROD {y0})))) &
				(not Ra_eqseq(Za PROD {Ra_ABS(y0)},Za PROD {y0}))
		(Za PROD {y0},arb(Cauchy_to_Re(Za PROD {y0})),Ras_ABS(arb(Cauchy_to_Re(Za PROD {y0}))))-->Stat1(Stat3*) ==> Ra_eqseq(Za PROD {y0},Ras_ABS(arb(Cauchy_to_Re(Za PROD {y0}))))
		(Ras_ABS(Za PROD {y0}),Ras_ABS(arb(Cauchy_to_Re(Za PROD {y0}))))-->T607(Stat3*) ==> Ra_eqseq(Ras_ABS(arb(Cauchy_to_Re(Za PROD {y0}))),Ras_ABS(Za PROD {y0}))
		(Za PROD {y0},Ras_ABS(arb(Cauchy_to_Re(Za PROD {y0}))),Ras_ABS(Za PROD {y0}))-->Stat1(Stat3*) ==> Ra_eqseq(Za PROD {y0},Ras_ABS(Za PROD {y0}))
		(Za PROD {y0},Ras_ABS(Za PROD {y0}))-->T607(Stat3*) ==> Ra_eqseq(Ras_ABS(Za PROD {y0}),Za PROD {y0})
	EQUAL(Stat2) ==> false; Discharge ==> (not R_is_nonneg(Cauchy_to_Re(Za PROD {y0})))
	(Stat3*)ELEM ==> Stat7: (not Ra_eqseq(arb(Cauchy_to_Re(Za PROD {y0})),Ras_ABS(arb(Cauchy_to_Re(Za PROD {y0}))))) &
		Ra_eqseq(Za PROD {Ra_ABS(y0)},Za PROD {y0})
	EQUAL(Stat2,Stat6) ==> Ra_eqseq(Za PROD {Ra_ABS(y0)},Ras_ABS(arb(Cauchy_to_Re(Za PROD {y0}))))
	(Za PROD {Ra_ABS(y0)},Za PROD {y0})-->T607(Stat3*) ==> Ra_eqseq(Za PROD {y0},Za PROD {Ra_ABS(y0)})
	(Za PROD {y0},arb(Cauchy_to_Re(Za PROD {y0})))-->T607(Stat3*) ==> Ra_eqseq(arb(Cauchy_to_Re(Za PROD {y0})),Za PROD {y0})
	(arb(Cauchy_to_Re(Za PROD {y0})),Za PROD {y0},Za PROD {Ra_ABS(y0)})-->Stat1(Stat3*) ==> Ra_eqseq(arb(Cauchy_to_Re(Za PROD {y0})),Za PROD {Ra_ABS(y0)})
(arb(Cauchy_to_Re(Za PROD {y0})),Za PROD {Ra_ABS(y0)},Ras_ABS(arb(Cauchy_to_Re(Za PROD {y0}))))-->Stat1(Stat3*) ==> false; Discharge ==> QED
--
-- The following two elementary theorems simply notes that the embedding of rationals into reals
-- defined by the function ReRa just introduced is an isomorphism in all respects.
--
Theorem 735: [The embedding of rationals into reals preserves all elementary algebraic operations, 1]  (Y in Ra) imp ((ReRa(Y) in Re) &
	(ReRa(Ra_Rev(Y)) = R_Rev(ReRa(Y))) &
	(R_is_nonneg(ReRa(Y)) eq Ra_is_nonneg(Y)) &
	(ReRa(Ra_ABS(Y)) = abs(ReRa(Y)))). Proof:
Suppose_not(y0) ==> AUTO
	Use_def(ReRa)(*) ==> Stat1: (ReRa(y0) = Cauchy_to_Re(Za PROD {y0})) & (y0 in Ra)
	y0-->T543(*) ==> Stat2: (Za PROD {y0}) in RaCauchy
	(Za PROD {y0},Za PROD {y0})-->T610(Stat1*) ==> Stat3: ReRa(y0) in Re
	Suppose ==> ReRa(Ra_Rev(y0)) /= R_Rev(ReRa(y0))
		(Za PROD {y0})-->T622(*) ==> Cauchy_to_Re(Ras_Rev(Za PROD {y0})) = R_Rev(Cauchy_to_Re(Za PROD {y0}))
		Use_def(ReRa(Ra_Rev(y0))) ==> AUTO
		Use_def(Ras_Rev(Za PROD {y0})) ==> AUTO
		Suppose ==> (Za PROD {Ra_Rev(y0)}) = {[car(p),Ra_Rev(cdr(p))]: p in (Za PROD {y0})}
		EQUAL ==> false; Discharge ==> Stat4: (Za PROD {Ra_Rev(y0)}) /= {[car(p),Ra_Rev(cdr(p))]: p in (Za PROD {y0})}
		p1-->Stat4(Stat4*) ==> (p1 in (Za PROD {Ra_Rev(y0)})) eq (p1 notin {[car(p),Ra_Rev(cdr(p))]: p in (Za PROD {y0})})
		Use_def(PROD) ==> (Za PROD {Ra_Rev(y0)}) = {[x,y]: x in Za, y in {Ra_Rev(y0)}}
		SIMPLF(Stat4*) ==> (p1 in {[x,Ra_Rev(y0)]: x in Za}) eq (p1 notin {[car(p),Ra_Rev(cdr(p))]: p in (Za PROD {y0})})
		Suppose ==> Stat5: (p1 in {[x,Ra_Rev(y0)]: x in Za}) & (p1 notin {[car(p),Ra_Rev(cdr(p))]: p in (Za PROD {y0})})
			(x1,[x1,y0])-->Stat5(Stat5*) ==> (x1 in Za) & (p1 = [x1,Ra_Rev(y0)]) & ((p1 /= [car([x1,y0]),Ra_Rev(cdr([x1,y0]))]) or ([x1,y0] notin (Za PROD {y0})))
			(x1,y0)-->T9 ==> AUTO
			EQUAL(Stat5) ==> (p1 = [car([x1,y0]),Ra_Rev(cdr([x1,y0]))])
			Use_def(PROD)(Stat5*) ==> Stat6: [x1,y0] notin {[x,y]: x in Za, y in {y0}}
		(x1,y0)-->Stat6(Stat5*) ==> false; Discharge ==> Stat7: (p1 in {[car(p),Ra_Rev(cdr(p))]: p in (Za PROD {y0})}) & (p1 notin {[x,Ra_Rev(y0)]: x in Za})
		(p2,car(p2))-->Stat7(Stat7*) ==> Stat8: (p1 = [car(p2),Ra_Rev(cdr(p2))]) & (p2 in (Za PROD {y0})) & ((p1 /= [car(p2),Ra_Rev(y0)]) or (car(p2) notin Za))
		Use_def(PROD)(Stat8*) ==> Stat9: p2 in {[x,y]: x in Za, y in {y0}}
		(x2,y2)-->Stat9(Stat8*) ==> Stat10: (x2 in Za) & (y2 = y0) & (p2 = [x2,y2]) & (([car(p2),Ra_Rev(cdr(p2))] /= [car(p2),Ra_Rev(y0)]) or (car(p2) notin Za))
		(x2,y2)-->T9 ==> AUTO
		EQUAL(Stat10) ==> Stat11: (car(p2) = x2) & (cdr(p2) = y0)
		(Stat10*)ELEM ==> [car(p2),Ra_Rev(cdr(p2))] /= [car(p2),Ra_Rev(y0)]
	EQUAL(Stat11) ==> false; Discharge ==> Stat12: ReRa(Ra_Rev(y0)) = R_Rev(ReRa(y0))
	Suppose ==> Stat13: not(R_is_nonneg(Cauchy_to_Re(Za PROD {y0})) eq Ra_is_nonneg(y0))
		y0-->T734(Stat13,Stat1*) ==> Stat14: (not((ReRa(Ra_ABS(y0)) = ReRa(y0)) eq Ra_is_nonneg(y0)))
		y0-->T733(Stat14,Stat13,Stat1*) ==> Stat15: (not((ReRa(Ra_ABS(y0)) = ReRa(y0)) eq Ra_eqseq(Za PROD {Ra_ABS(y0)},Za PROD {y0})))
		Use_def(ReRa)(Stat15*) ==> Stat16: (not((Cauchy_to_Re(Za PROD {Ra_ABS(y0)}) = Cauchy_to_Re(Za PROD {y0})) eq Ra_eqseq(Za PROD {Ra_ABS(y0)},Za PROD {y0})))
		y0-->T527(Stat1*) ==> Stat17: Ra_ABS(y0) in Ra
		(Ra_ABS(y0))-->T543(Stat17*) ==> Stat18: (Za PROD {Ra_ABS(y0)}) in RaCauchy
	(Za PROD {Ra_ABS(y0)},Za PROD {y0})-->T610(Stat18,Stat2,Stat16*) ==> false; Discharge ==> Stat19: R_is_nonneg(Cauchy_to_Re(Za PROD {y0})) eq Ra_is_nonneg(y0)
	Use_def(ReRa)(Stat19*) ==> R_is_nonneg(ReRa(y0)) eq Ra_is_nonneg(y0)
	ELEM ==> ReRa(Ra_ABS(y0)) /= abs(ReRa(y0))
	Suppose ==> Stat20: Cauchy_to_Re(Ras_ABS(Za PROD {y0})) /= abs(Cauchy_to_Re(Za PROD {y0}))
		(Cauchy_to_Re(Za PROD {y0}))-->T724(Stat1,Stat3*) ==> abs(Cauchy_to_Re(Za PROD {y0})) =
			if R_is_nonneg(Cauchy_to_Re(Za PROD {y0})) then Cauchy_to_Re(Za PROD {y0}) else R_Rev(Cauchy_to_Re(Za PROD {y0})) end if
		T525(*) ==> Stat21: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
		y0-->Stat21(Stat21*) ==> Ra_ABS(y0) = if Ra_is_nonneg(y0) then y0 else Ra_Rev(y0) end if
		APPLY() if_then_else(p->Ra_is_nonneg(y0),a->y0,b->Ra_Rev(y0),f(x)->Cauchy_to_Re(Za PROD {x})) ==>
			Cauchy_to_Re(Za PROD {if Ra_is_nonneg(y0) then y0 else Ra_Rev(y0) end if}) = if Ra_is_nonneg(y0) then Cauchy_to_Re(Za PROD {y0}) else Cauchy_to_Re(Za PROD {Ra_Rev(y0)}) end if
		Use_def(ReRa)(Stat12,Stat12*) ==> R_Rev(Cauchy_to_Re(Za PROD {y0})) = Cauchy_to_Re(Za PROD {Ra_Rev(y0)})
		y0-->T544(Stat1,Stat1*) ==> Ras_ABS(Za PROD {y0}) = (Za PROD {Ra_ABS(y0)})
		EQUAL(Stat20) ==> Stat22: if Ra_is_nonneg(y0) then Cauchy_to_Re(Za PROD {y0}) else Cauchy_to_Re(Za PROD {Ra_Rev(y0)}) end if /= if R_is_nonneg(Cauchy_to_Re(Za PROD {y0})) then Cauchy_to_Re(Za PROD {y0}) else Cauchy_to_Re(Za PROD {Ra_Rev(y0)}) end if
	(Stat22,Stat19)ELEM ==> false; Discharge ==> Cauchy_to_Re(Ras_ABS(Za PROD {y0})) = abs(Cauchy_to_Re(Za PROD {y0}))
	Use_def(ReRa(Ra_ABS(y0))) ==> AUTO
	Use_def(Ras_ABS(Za PROD {y0})) ==> AUTO
	Suppose ==> (Za PROD {Ra_ABS(y0)}) = {[car(p),Ra_ABS(cdr(p))]: p in (Za PROD {y0})}
	EQUAL ==> false; Discharge ==> Stat23: (Za PROD {Ra_ABS(y0)}) /= {[car(p),Ra_ABS(cdr(p))]: p in (Za PROD {y0})}
	p8-->Stat23(Stat23*) ==> (p8 in (Za PROD {Ra_ABS(y0)})) eq (p8 notin {[car(p),Ra_ABS(cdr(p))]: p in (Za PROD {y0})})
	Use_def(PROD) ==> (Za PROD {Ra_ABS(y0)}) = {[x,y]: x in Za, y in {Ra_ABS(y0)}}
	SIMPLF(Stat23*) ==> (p8 in {[x,Ra_ABS(y0)]: x in Za}) eq (p8 notin {[car(p),Ra_ABS(cdr(p))]: p in (Za PROD {y0})})
	Suppose ==> Stat24: (p8 in {[x,Ra_ABS(y0)]: x in Za}) & (p8 notin {[car(p),Ra_ABS(cdr(p))]: p in (Za PROD {y0})})
		(x8,[x8,y0])-->Stat24(Stat24*) ==> (x8 in Za) & (p8 = [x8,Ra_ABS(y0)]) & ((p8 /= [car([x8,y0]),Ra_ABS(cdr([x8,y0]))]) or ([x8,y0] notin (Za PROD {y0})))
		(x8,y0)-->T9 ==> AUTO
		EQUAL(Stat24) ==> (p8 = [car([x8,y0]),Ra_ABS(cdr([x8,y0]))])
		Use_def(PROD)(Stat24*) ==> Stat25: [x8,y0] notin {[x,y]: x in Za, y in {y0}}
	(x8,y0)-->Stat25(Stat24*) ==> false; Discharge ==> Stat26: (p8 in {[car(p),Ra_ABS(cdr(p))]: p in (Za PROD {y0})}) & (p8 notin {[x,Ra_ABS(y0)]: x in Za})
	(p9,car(p9))-->Stat26(Stat26*) ==> Stat27: (p8 = [car(p9),Ra_ABS(cdr(p9))]) & (p9 in (Za PROD {y0})) & ((p8 /= [car(p9),Ra_ABS(y0)]) or (car(p9) notin Za))
	Use_def(PROD)(Stat27*) ==> Stat28: p9 in {[x,y]: x in Za, y in {y0}}
	(x9,y9)-->Stat28(Stat27*) ==> Stat29: (x9 in Za) & (y9 = y0) & (p9 = [x9,y9]) & (([car(p9),Ra_ABS(cdr(p9))] /= [car(p9),Ra_ABS(y0)]) or (car(p9) notin Za))
	(x9,y9)-->T9 ==> AUTO
	EQUAL(Stat29) ==> Stat30: (car(p9) = x9) & (cdr(p9) = y0)
	(Stat29*)ELEM ==> [car(p9),Ra_ABS(cdr(p9))] /= [car(p9),Ra_ABS(y0)]
EQUAL(Stat30) ==> false; Discharge ==> QED

--
Theorem 736: [The embedding of rationals into reals preserves all elementary algebraic operations, 2]  ((X in Ra) & (Y in Ra)) imp ((ReRa(X) in Re) & (ReRa(Y) in Re) &
	(ReRa(X Ra_PLUS Y) = ReRa(X) R_PLUS ReRa(Y)) &
	(ReRa(X Ra_TIMES Y) = ReRa(X) R_TIMES ReRa(Y))). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def(ReRa)(*) ==> Stat1: (ReRa(x0) = Cauchy_to_Re(Za PROD {x0})) & (ReRa(y0) = Cauchy_to_Re(Za PROD {y0})) & (y0 in Ra)
	x0-->T543(*) ==> (Za PROD {x0}) in RaCauchy
	y0-->T543(*) ==> Stat2: (Za PROD {y0}) in RaCauchy
	(Za PROD {x0},Za PROD {x0})-->T610(Stat1*) ==> ReRa(x0) in Re
	y0-->T735(Stat1*) ==> Stat3: (ReRa(y0) in Re) & (ReRa(Ra_Rev(y0)) = R_Rev(ReRa(y0)))
	Suppose ==> Stat4: ReRa(x0 Ra_PLUS y0) /= (ReRa(x0) R_PLUS ReRa(y0))
		Use_def(ReRa)(*) ==> ReRa(x0 Ra_PLUS y0) = Cauchy_to_Re(Za PROD {x0 Ra_PLUS y0})
		(Za PROD {x0},Za PROD {y0})-->T616(Stat1*) ==> Cauchy_to_Re((Za PROD {x0}) Ras_PLUS (Za PROD {y0})) = (Cauchy_to_Re(Za PROD {x0}) R_PLUS Cauchy_to_Re(Za PROD {y0}))
		EQUAL(Stat1) ==> Cauchy_to_Re(Za PROD {x0 Ra_PLUS y0}) /= Cauchy_to_Re((Za PROD {x0}) Ras_PLUS (Za PROD {y0}))
		Suppose ==> (Za PROD {x0 Ra_PLUS y0}) = ((Za PROD {x0}) Ras_PLUS (Za PROD {y0}))
		EQUAL(Stat4*) ==> false; Discharge ==> (Za PROD {x0 Ra_PLUS y0}) /= ((Za PROD {x0}) Ras_PLUS (Za PROD {y0}))
		Use_def(Ras_PLUS)(Stat4*) ==> Stat5: (Za PROD {x0 Ra_PLUS y0}) /= {[car(p),cdr(p) Ra_PLUS ((Za PROD {y0})~[car(p)])]: p in (Za PROD {x0})}
		p3-->Stat5(Stat5*) ==> (p3 in (Za PROD {x0 Ra_PLUS y0})) eq (p3 notin {[car(p),cdr(p) Ra_PLUS ((Za PROD {y0})~[car(p)])]: p in (Za PROD {x0})})
		Use_def(PROD) ==> (Za PROD {x0 Ra_PLUS y0}) = {[x,y]: x in Za, y in {x0 Ra_PLUS y0}}
		SIMPLF(Stat5*) ==> (p3 in {[x,x0 Ra_PLUS y0]: x in Za}) eq (p3 notin {[car(p),cdr(p) Ra_PLUS ((Za PROD {y0})~[car(p)])]: p in (Za PROD {x0})})
		Suppose ==> Stat6: (p3 in {[x,x0 Ra_PLUS y0]: x in Za}) & (p3 notin {[car(p),cdr(p) Ra_PLUS ((Za PROD {y0})~[car(p)])]: p in (Za PROD {x0})})
			(x3,[x3,x0])-->Stat6(Stat6*) ==> (x3 in Za) & (p3 = [x3,x0 Ra_PLUS y0]) & ((p3 /= [car([x3,x0]),cdr([x3,x0]) Ra_PLUS ((Za PROD {y0})~[car([x3,x0])])]) or ([x3,x0] notin (Za PROD {x0})))
			(x3,x0)-->T9 ==> AUTO
			(x3,Za,y0)-->T142(Stat6*) ==> ((Za PROD {y0})~[x3]) = y0
			EQUAL(Stat6) ==> ((Za PROD {y0})~[car([x3,x0])]) = y0
			EQUAL(Stat6) ==> (p3 = [car([x3,x0]),cdr([x3,x0]) Ra_PLUS ((Za PROD {y0})~[car([x3,x0])])])
			Use_def(PROD)(Stat6*) ==> Stat7: [x3,x0] notin {[x,y]: x in Za, y in {x0}}
		(x3,x0)-->Stat7(Stat6*) ==> false; Discharge ==> Stat8: (p3 in {[car(p),cdr(p) Ra_PLUS ((Za PROD {y0})~[car(p)])]: p in (Za PROD {x0})}) & (p3 notin {[x,x0 Ra_PLUS y0]: x in Za})
		(p4,car(p4))-->Stat8(Stat8*) ==> Stat9: (p3 = [car(p4),cdr(p4) Ra_PLUS ((Za PROD {y0})~[car(p4)])]) & (p4 in (Za PROD {x0})) & ((p3 /= [car(p4),x0 Ra_PLUS y0]) or (car(p4) notin Za))
		Use_def(PROD)(Stat9*) ==> Stat10: p4 in {[x,y]: x in Za, y in {x0}}
		(x4,y4)-->Stat10(Stat9*) ==> Stat11: (x4 in Za) & (y4 = x0) & (p4 = [x4,y4]) & (([car(p4),cdr(p4) Ra_PLUS ((Za PROD {y0})~[car(p4)])] /= [car(p4),x0 Ra_PLUS y0]) or (car(p4) notin Za))
		(x4,y4)-->T9 ==> AUTO
		EQUAL(Stat11) ==> Stat12: (car(p4) = x4) & (cdr(p4) = y4)
		(Stat11*)ELEM ==> [car(p4),cdr(p4) Ra_PLUS ((Za PROD {y0})~[car(p4)])] /= [car(p4),x0 Ra_PLUS y0]
		(car(p4),Za,y0)-->T142(Stat11*) ==> ((Za PROD {y0})~[car(p4)]) = y0
	EQUAL(Stat11) ==> false; Discharge ==> Stat13: ReRa(x0 Ra_TIMES y0) /= (ReRa(x0) R_TIMES ReRa(y0))
	Use_def(ReRa)(*) ==> ReRa(x0 Ra_TIMES y0) = Cauchy_to_Re(Za PROD {x0 Ra_TIMES y0})
	(Za PROD {x0},Za PROD {y0})-->T619(Stat1*) ==> Cauchy_to_Re((Za PROD {x0}) Ras_TIMES (Za PROD {y0})) = (Cauchy_to_Re(Za PROD {x0}) R_TIMES Cauchy_to_Re(Za PROD {y0}))
	EQUAL ==> Cauchy_to_Re(Za PROD {x0 Ra_TIMES y0}) /= Cauchy_to_Re((Za PROD {x0}) Ras_TIMES (Za PROD {y0}))
	Suppose ==> (Za PROD {x0 Ra_TIMES y0}) = ((Za PROD {x0}) Ras_TIMES (Za PROD {y0}))
	EQUAL(Stat13*) ==> false; Discharge ==> (Za PROD {x0 Ra_TIMES y0}) /= ((Za PROD {x0}) Ras_TIMES (Za PROD {y0}))
	Use_def(Ras_TIMES)(Stat13*) ==> Stat14: (Za PROD {x0 Ra_TIMES y0}) /= {[car(p),cdr(p) Ra_TIMES ((Za PROD {y0})~[car(p)])]: p in (Za PROD {x0})}
	p6-->Stat14(Stat14*) ==> (p6 in (Za PROD {x0 Ra_TIMES y0})) eq (p6 notin {[car(p),cdr(p) Ra_TIMES ((Za PROD {y0})~[car(p)])]: p in (Za PROD {x0})})
	Use_def(PROD) ==> (Za PROD {x0 Ra_TIMES y0}) = {[x,y]: x in Za, y in {x0 Ra_TIMES y0}}
	SIMPLF(Stat14*) ==> (p6 in {[x,x0 Ra_TIMES y0]: x in Za}) eq (p6 notin {[car(p),cdr(p) Ra_TIMES ((Za PROD {y0})~[car(p)])]: p in (Za PROD {x0})})
	Suppose ==> Stat15: (p6 in {[x,x0 Ra_TIMES y0]: x in Za}) & (p6 notin {[car(p),cdr(p) Ra_TIMES ((Za PROD {y0})~[car(p)])]: p in (Za PROD {x0})})
		(x6,[x6,x0])-->Stat15(Stat15*) ==> (x6 in Za) & (p6 = [x6,x0 Ra_TIMES y0]) & ((p6 /= [car([x6,x0]),cdr([x6,x0]) Ra_TIMES ((Za PROD {y0})~[car([x6,x0])])]) or ([x6,x0] notin (Za PROD {x0})))
		(x6,x0)-->T9 ==> AUTO
		(x6,Za,y0)-->T142(Stat15*) ==> ((Za PROD {y0})~[x6]) = y0
		EQUAL(Stat15) ==> ((Za PROD {y0})~[car([x6,x0])]) = y0
		EQUAL(Stat15) ==> (p6 = [car([x6,x0]),cdr([x6,x0]) Ra_TIMES ((Za PROD {y0})~[car([x6,x0])])])
		Use_def(PROD)(Stat15*) ==> Stat16: [x6,x0] notin {[x,y]: x in Za, y in {x0}}
	(x6,x0)-->Stat16(Stat15*) ==> false; Discharge ==> Stat17: (p6 in {[car(p),cdr(p) Ra_TIMES ((Za PROD {y0})~[car(p)])]: p in (Za PROD {x0})}) & (p6 notin {[x,x0 Ra_TIMES y0]: x in Za})
	(p7,car(p7))-->Stat17(Stat17*) ==> Stat18: (p6 = [car(p7),cdr(p7) Ra_TIMES ((Za PROD {y0})~[car(p7)])]) & (p7 in (Za PROD {x0})) & ((p6 /= [car(p7),x0 Ra_TIMES y0]) or (car(p7) notin Za))
	Use_def(PROD)(Stat18*) ==> Stat19: p7 in {[x,y]: x in Za, y in {x0}}
	(x7,y7)-->Stat19(Stat18*) ==> Stat20: (x7 in Za) & (y7 = x0) & (p7 = [x7,y7]) & (([car(p7),cdr(p7) Ra_TIMES ((Za PROD {y0})~[car(p7)])] /= [car(p7),x0 Ra_TIMES y0]) or (car(p7) notin Za))
	(x7,y7)-->T9 ==> AUTO
	EQUAL(Stat20) ==> Stat21: (car(p7) = x7) & (cdr(p7) = y7)
	(Stat20*)ELEM ==> [car(p7),cdr(p7) Ra_TIMES ((Za PROD {y0})~[car(p7)])] /= [car(p7),x0 Ra_TIMES y0]
	(car(p7),Za,y0)-->T142(Stat20*) ==> ((Za PROD {y0})~[car(p7)]) = y0
EQUAL(Stat20) ==> false; Discharge ==> QED
--
Theorem 737: [The embedding of rationals into reals preserves all elementary algebraic operations, 3]  ((X in Ra) & (Y in Ra)) imp
			(ReRa(X Ra_MINUS Y) = (ReRa(X) R_MINUS ReRa(Y))). Proof:
Suppose_not(x0,y0) ==> AUTO
	y0-->T735(*) ==> Stat1: (ReRa(y0) in Re) & (R_Rev(ReRa(y0)) = ReRa(Ra_Rev(y0)))
	y0-->T452(*) ==> Ra_Rev(y0) in Ra
	(x0,Ra_Rev(y0))-->T736(*) ==> (ReRa(x0) in Re) & (ReRa(x0) R_PLUS ReRa(Ra_Rev(y0)) = ReRa(x0 Ra_PLUS Ra_Rev(y0)))
	(ReRa(x0),ReRa(y0))-->T635(Stat1*) ==> (ReRa(x0) R_MINUS ReRa(y0)) = (ReRa(x0) R_PLUS R_Rev(ReRa(y0)))
	Use_def(Ra_MINUS)(*) ==> (x0 Ra_MINUS y0) = (x0 Ra_PLUS Ra_Rev(y0))
EQUAL ==> false; Discharge ==> QED
--
Theorem 738: [The embedding of rationals into reals is 1-1]  ((X in Ra) & (Y in Ra)) imp ((ReRa(X) = ReRa(Y)) eq (X = Y)). Proof:
Suppose_not(v,y) ==> AUTO
	Suppose ==> (v = y) & (ReRa(v) /= ReRa(y))
	EQUAL ==> false; Discharge ==> (ReRa(v) = ReRa(y)) & (v /= y)
	Use_def(ReRa) ==> Stat1: (Cauchy_to_Re(Za PROD {v}) = Cauchy_to_Re(Za PROD {y})) & (v in Ra) & (y in Ra) & (v /= y)
	v-->T543(Stat1*) ==> (Za PROD {v}) in RaCauchy
	y-->T543(Stat1*) ==> (Za PROD {y}) in RaCauchy
	(Za PROD {v},Za PROD {y})-->T610(Stat1*) ==> Ra_eqseq(Za PROD {v},Za PROD {y})
	T539(Stat1*) ==> {Za PROD {v},Za PROD {y}} incin RaSeq
	(Za PROD {v},Za PROD {y})-->T541(Stat1*) ==> Stat2: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({u: u in Za | Ra_ABS(((Za PROD {v})~[u]) Ra_MINUS ((Za PROD {y})~[u])) Ra_GT eps}))
	(v,y)-->T454(Stat1*) ==> (v Ra_MINUS y) in Ra
 	(v Ra_MINUS y)-->T527(Stat1*) ==> (Ra_ABS(v Ra_MINUS y) in Ra) & (Ra_ABS(v Ra_MINUS y) Ra_GE Ra_0)
	y-->T451(Stat1*) ==> (Ra_0 in Ra) & (y = (y Ra_PLUS Ra_0))
	Suppose ==> not(Ra_ABS(v Ra_MINUS y) Ra_GT Ra_0)
		(Ra_ABS(v Ra_MINUS y),Ra_0)-->T473(Stat2*) ==> Ra_ABS(v Ra_MINUS y) = Ra_0
		T525(Stat3*) ==> Stat3: (FORALL x | (x in Ra) imp ((Ra_ABS(x) = Ra_0) eq (x = Ra_0)))
		(v Ra_MINUS y)-->Stat3(Stat2*) ==> (v Ra_MINUS y) = Ra_0
		EQUAL(Stat2) ==> (y Ra_PLUS (v Ra_MINUS y)) = y
	(v,y)-->T455(Stat1*) ==> false; Discharge ==> Ra_ABS(v Ra_MINUS y) Ra_GT Ra_0
	(Ra_ABS(v Ra_MINUS y))-->T522(Stat2*) ==> Stat4: (EXISTS e in Ra, e0 in Ra | (Ra_ABS(v Ra_MINUS y) Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e Ra_GT Ra_0) & (Ra_ABS(v Ra_MINUS y) Ra_GT (e Ra_PLUS e0)))
	(e,e0)-->Stat4(Stat4*) ==> (e in Ra) & (Ra_ABS(v Ra_MINUS y) Ra_GT e) & (e Ra_GT Ra_0)
	Suppose ==> Stat5: {u: u in Za | Ra_ABS(((Za PROD {v})~[u]) Ra_MINUS ((Za PROD {y})~[u])) Ra_GT e} = Za
		e-->Stat2(Stat2*) ==> Finite({u: u in Za | Ra_ABS(((Za PROD {v})~[u]) Ra_MINUS ((Za PROD {y})~[u])) Ra_GT e})
		0-->T206(*) ==> (not Finite(Za))
	EQUAL(Stat5) ==> false; Discharge ==> Stat6: {u in Za | Ra_ABS(((Za PROD {v})~[u]) Ra_MINUS ((Za PROD {y})~[u])) Ra_GT e} /= Za
	u-->Stat6(Stat6*) ==> (u in {u in Za | Ra_ABS(((Za PROD {v})~[u]) Ra_MINUS ((Za PROD {y})~[u])) Ra_GT e}) neq (u in Za)
	Suppose ==> Stat7: u in {u in Za | Ra_ABS(((Za PROD {v})~[u]) Ra_MINUS ((Za PROD {y})~[u])) Ra_GT e}
	()-->Stat7(Stat6*) ==> false; Discharge ==> Stat8: (u notin {u in Za | Ra_ABS(((Za PROD {v})~[u]) Ra_MINUS ((Za PROD {y})~[u])) Ra_GT e}) & (u in Za)
	u-->Stat8(Stat8*) ==> not(Ra_ABS(((Za PROD {v})~[u]) Ra_MINUS ((Za PROD {y})~[u])) Ra_GT e)
	(u,Za,v)-->T142(Stat8*) ==> ((Za PROD {v})~[u]) = v
	(u,Za,y)-->T142(Stat8*) ==> ((Za PROD {y})~[u]) = y
EQUAL(Stat4) ==> false; Discharge ==> QED
--
Theorem 739: [The embedding of rationals into reals preserves 0 and 1]  (ReRa(Ra_0) = R_0) & (ReRa(Ra_1) = R_1). Proof:
Suppose_not ==> AUTO
	Use_def(ReRa(Ra_0)) ==> AUTO
--?	Use_def(Ra0Seq) ==> AUTO
--?	Use_def(R_0) ==> AUTO
	Use_def(Ra0Seq) ==> Ra0Seq = Za PROD {Ra_0}
	Use_def(R_0) ==> R_0 = Cauchy_to_Re(Ra0Seq)
	Use_def(ReRa(Ra_1)) ==> AUTO
	Use_def(Ra1Seq) ==> Ra1Seq = Za PROD {Ra_1}
	Use_def(R_1) ==> R_1 = Cauchy_to_Re(Ra1Seq)
EQUAL ==> false; Discharge ==> QED
--
-- The statement concerning isomorphism given above applies to division also, except
-- that in this case we should avoid dividing by 0.
--
Theorem 740: [The embedding of rationals into reals preserves quotients by nonzero quantities]  ((X in Ra) & (Y in Ra) & (Y /= Ra_0)) imp
			((R_Recip(ReRa(Y)) = ReRa(Recip(Y))) &
			((ReRa(X) R_OVER ReRa(Y)) = ReRa(X Ra_OVER Y))). Proof:
Suppose_not(x0,y0) ==> AUTO
	y0-->T462(*) ==> (Recip(y0) in Ra) & ((y0 Ra_TIMES Recip(y0)) = Ra_1)
	Suppose ==> R_Recip(ReRa(y0)) /= ReRa(Recip(y0))
		(y0,Recip(y0))-->T736(*) ==> (ReRa(y0) in Re) & (ReRa(Recip(y0)) in Re) & (ReRa(y0 Ra_TIMES Recip(y0)) = (ReRa(y0) R_TIMES ReRa(Recip(y0))))
		T739(*) ==> ReRa(Ra_1) = R_1
		EQUAL ==> (ReRa(y0) R_TIMES ReRa(Recip(y0))) = R_1
--
-- The inequality $ReRa(y0) /= R_0$ follows from the one-one-ness of $ReRa$ and from
-- the facts $(y0 /= R_0) & (R_0=ReRa(Ra_0))$.
--
		Suppose ==> ReRa(y0) = R_0
			Ra_0-->T451(Stat1*) ==> Stat1: Ra_0 in Ra
			T739(Stat1*) ==> ReRa(Ra_0) = R_0
		(y0,Ra_0)-->T738(*) ==> false; Discharge ==> ReRa(y0) /= R_0
		(ReRa(y0))-->T647(*) ==> (R_Recip(ReRa(y0)) in Re) & ((R_Recip(ReRa(y0)) R_TIMES ReRa(y0)) = R_1)
		(R_Recip(ReRa(y0)),ReRa(y0),ReRa(Recip(y0)))-->T620(*) ==> (R_Recip(ReRa(y0)) R_TIMES (ReRa(y0) R_TIMES ReRa(Recip(y0)))) = ((R_Recip(ReRa(y0)) R_TIMES ReRa(y0)) R_TIMES ReRa(Recip(y0)))
		EQUAL ==> (R_Recip(ReRa(y0)) R_TIMES R_1) = (R_1 R_TIMES ReRa(Recip(y0)))
		(R_Recip(ReRa(y0)))-->T627(*) ==> (R_Recip(ReRa(y0)) R_TIMES R_1) = R_Recip(ReRa(y0))
		(ReRa(Recip(y0)))-->T628(*) ==> (R_1 R_TIMES ReRa(Recip(y0))) = ReRa(Recip(y0))
	EQUAL ==> false; Discharge ==> Stat2: R_Recip(ReRa(y0)) = ReRa(Recip(y0))
	ELEM ==> Stat3: (ReRa(x0) R_OVER ReRa(y0)) /= ReRa(x0 Ra_OVER y0)
	Use_def(Ra_OVER)(Stat3*) ==> Stat4: (ReRa(x0) R_OVER ReRa(y0)) /= ReRa(x0 Ra_TIMES Recip(y0))
	Use_def(R_OVER)(Stat4*) ==> (ReRa(x0) R_TIMES R_Recip(ReRa(y0))) /= ReRa(x0 Ra_TIMES Recip(y0))
	EQUAL(Stat2) ==> (ReRa(x0) R_TIMES ReRa(Recip(y0))) /= ReRa(x0 Ra_TIMES Recip(y0))
(x0,Recip(y0))-->T736(*) ==> false; Discharge ==> QED
--
-- Moreover the embedding of rationals into reals defined by ReRa preserves all ordering relationships.
--
Theorem 741: [The embedding of rationals into reals preserves ordering]  ((X in Ra) & (Y in Ra)) imp (((ReRa(X) R_GE ReRa(Y)) eq (X Ra_GE Y)) &
		((ReRa(X) R_GT ReRa(Y)) eq (X Ra_GT Y)) &
		((ReRa(Y) R_LE ReRa(X)) eq (Y Ra_LE X)) &
		((ReRa(Y) R_LT ReRa(X)) eq (Y Ra_LT X))). Proof:
Suppose_not(x0,y0) ==> AUTO
	(x0,y0)-->T736(*) ==> (ReRa(x0) in Re) & (ReRa(y0) in Re)
	Suppose ==> (not((ReRa(x0) R_GE ReRa(y0)) eq (x0 Ra_GE y0)))
		(x0,y0)-->T473(*) ==> Stat1: (not((ReRa(x0) R_GE ReRa(y0)) eq Ra_is_nonneg(x0 Ra_PLUS Ra_Rev(y0))))
		Use_def(Ra_MINUS)(Stat1*) ==> Stat2: (not((ReRa(x0) R_GE ReRa(y0)) eq Ra_is_nonneg(x0 Ra_MINUS y0)))
		Use_def(R_GE)(Stat2*) ==> (not(R_is_nonneg(ReRa(x0) R_MINUS ReRa(y0)) eq Ra_is_nonneg(x0 Ra_MINUS y0)))
		(x0,y0)-->T737(*) ==> (ReRa(x0) R_MINUS ReRa(y0)) = ReRa(x0 Ra_MINUS y0)
		EQUAL(Stat2) ==> (not(R_is_nonneg(ReRa(x0 Ra_MINUS y0)) eq Ra_is_nonneg(x0 Ra_MINUS y0)))
		(x0,y0)-->T454(*) ==> (x0 Ra_MINUS y0) in Ra
	(x0 Ra_MINUS y0)-->T735(Stat2*) ==> false; Discharge ==> (ReRa(x0) R_GE ReRa(y0)) eq (x0 Ra_GE y0)
	Suppose ==> (not((ReRa(x0) R_GT ReRa(y0)) eq (x0 Ra_GT y0)))
		(x0,y0)-->T473(*) ==> (not((ReRa(x0) R_GT ReRa(y0)) eq ((ReRa(x0) R_GE ReRa(y0)) & (x0 /= y0))))
		(x0,y0)-->T738(*) ==> (not((ReRa(x0) R_GT ReRa(y0)) eq ((ReRa(x0) R_GE ReRa(y0)) & (ReRa(x0) /= ReRa(y0)))))
	(ReRa(x0),ReRa(y0))-->T673(*) ==> false; Discharge ==> (ReRa(x0) R_GT ReRa(y0)) eq (x0 Ra_GT y0)
	Suppose ==> Stat3: (not((ReRa(y0) R_LE ReRa(x0)) eq (y0 Ra_LE x0)))
		(y0,x0)-->T473(Stat3*) ==> (not((ReRa(y0) R_LE ReRa(x0)) eq (x0 Ra_GE y0)))
	(ReRa(y0),ReRa(x0))-->T673(*) ==> false; Discharge ==> (not((ReRa(y0) R_LT ReRa(x0)) eq (y0 Ra_LT x0)))
	(y0,x0)-->T473(*) ==> (not((ReRa(y0) R_LT ReRa(x0)) eq (x0 Ra_GT y0)))
(ReRa(y0),ReRa(x0))-->T673(*) ==> false; Discharge ==> QED
--
Theorem 742: [The images of rationals via the embedding form a dense subset of the reals, 1] ((X in Re) & (Eps in Ra) & (Eps Ra_GT Ra_0)) imp (EXISTS y in Ra | Finite({m in Za | Ra_ABS(((arb(X))~[m]) Ra_MINUS y) Ra_GE Eps}) ). Proof+:
Suppose_not(x0,eps0) ==> Stat1: (not (EXISTS y in Ra | Finite({m in Za | Ra_ABS(((arb(x0))~[m]) Ra_MINUS y) Ra_GE eps0}) )) & (x0 in Re) & (eps0 in Ra) & (eps0 Ra_GT Ra_0)
--
-- Reasoning by contradiction, assume that $x0,eps0$ are a counterexample to
-- the statement of this theorem. Moreover, let $eps$ be a rational number below $eps0$.
--
	eps0-->T522(Stat1*) ==> Stat2: (EXISTS e in Ra, e0 in Ra | (eps0 Ra_GT e) & (e Ra_GT e0) & (e0 Ra_GT Ra_0) & (e Ra_GT Ra_0) & (eps0 Ra_GT (e Ra_PLUS e0)))
	(eps,e0)-->Stat2(Stat2*) ==> Stat3: (eps in Ra) & (eps0 Ra_GT eps) & (eps Ra_GT Ra_0)
--
-- Since $arb(x0)$ is a rational Cauchy sequence, the distance between two
-- of its components, beyond a certain subscript value $m0$, does not exceed $eps$.
-- To get such an $m0$, it suffices to observe that $Za$, unlike the set
-- ${ i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) Ra_MINUS ((arb(x0))~[j])) Ra_GT eps }$,
-- is infinite, so that $Za$ must have a member $m0$ which does not belong to the latter set.
--
	x0-->T611(Stat1*) ==> Stat4: arb(x0) in RaCauchy
	Use_def(RaCauchy)(Stat4*) ==> Stat5: arb(x0) in {f in RaSeq | (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS((f~[i]) Ra_MINUS (f~[j])) Ra_GT eps }))}
	()-->Stat5(Stat5*) ==> Stat6: (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({ i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) Ra_MINUS ((arb(x0))~[j])) Ra_GT eps })) &
		(arb(x0) in RaSeq)
	eps-->Stat6(Stat3,Stat3*) ==> Stat7: Finite({ i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) Ra_MINUS ((arb(x0))~[j])) Ra_GT eps })
	0-->T206(Stat7*) ==> (not Finite(Za))
        EQUAL(Stat7)==> Stat8: Za /= { i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) Ra_MINUS ((arb(x0))~[j])) Ra_GT eps }
	Suppose ==> Stat9: not({ i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) Ra_MINUS ((arb(x0))~[j])) Ra_GT eps } incin Za)
		k-->Stat9(Stat9*) ==> (k notin Za) & Stat10: (k in { i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) Ra_MINUS ((arb(x0))~[j])) Ra_GT eps })
		(i0,j0)-->Stat10(Stat9*) ==> (i0 in Za) & (j0 in Za) & ((i0 * j0) notin Za)
	(i0,j0)-->T333(Stat9*) ==> false; Discharge ==> { i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) Ra_MINUS ((arb(x0))~[j])) Ra_GT eps } incin Za
	(Stat8*)ELEM ==> Stat11: not({ i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) Ra_MINUS ((arb(x0))~[j])) Ra_GT eps } incs Za)
	m0-->Stat11(Stat11*) ==> Stat12: (m0 in Za) & Stat13: (m0 notin { i * j : i in Za, j in Za | Ra_ABS(((arb(x0))~[i]) Ra_MINUS ((arb(x0))~[j])) Ra_GT eps })
--
-- The distance between two components, beyond $m0$, is therefore smaller than $eps0$;
-- because $eps$ is smaller than $eps0$.
-- This leads to a contradiction: indeed, if we take $y0 = ((arb(x0))~[m0])$ then
-- $y0$ contradicts Stat14 This proves the desired conclusion.
--
	Loc_def ==> Stat15: y0 = ((arb(x0))~[m0])
	(arb(x0),m0)-->T540(Stat6,Stat12,Stat15*) ==> Stat16: y0 in Ra
	y0-->Stat1(Stat16*) ==> (not Finite({m in Za | Ra_ABS(((arb(x0))~[m]) Ra_MINUS y0) Ra_GE eps0}) )
	m0-->T210(Stat12,Stat12*) ==> next(m0) in Za
	(next(m0),{m in Za | Ra_ABS(((arb(x0))~[m]) Ra_MINUS y0) Ra_GE eps0})-->T189(Stat16*) ==> Stat17: (not(next(m0) incs {m in Za | Ra_ABS(((arb(x0))~[m]) Ra_MINUS y0) Ra_GE eps0}))
	m1-->Stat17(Stat17*) ==> Stat18: (m1 in {m in Za | Ra_ABS(((arb(x0))~[m]) Ra_MINUS y0) Ra_GE eps0}) &
		(m1 notin next(m0))
	()-->Stat18(Stat18*) ==> Stat19: (m1 in Za) & (Ra_ABS(((arb(x0))~[m1]) Ra_MINUS y0) Ra_GE eps0)
	Use_def(next)(Stat18,Stat18*) ==> m1 notin (m0 + {m0})
	(m0,m1)-->T31(Stat12*) ==> m0 in m1
	(m1,m0)-->T13(Stat19*) ==> Stat20: m0 incin m1
	(m1,m0)-->Stat13(Stat12,Stat19,Stat20*) ==> (not(Ra_ABS(((arb(x0))~[m1]) Ra_MINUS ((arb(x0))~[m0])) Ra_GT eps))
	EQUAL(Stat15) ==> Stat21: (not(Ra_ABS(((arb(x0))~[m1]) Ra_MINUS y0) Ra_GT eps))
	(arb(x0),m1)-->T540(Stat6,Stat19*) ==> ((arb(x0))~[m1]) in Ra
	((arb(x0))~[m1],y0)-->T454(Stat16*) ==> Stat22: (((arb(x0))~[m1]) Ra_MINUS y0) in Ra
	(((arb(x0))~[m1]) Ra_MINUS y0)-->T527(Stat22*) ==> Stat23: Ra_ABS(((arb(x0))~[m1]) Ra_MINUS y0) in Ra
	(Ra_ABS(((arb(x0))~[m1]) Ra_MINUS y0),eps)-->T478(Stat23,Stat3,Stat21*) ==> Stat24: eps Ra_GE Ra_ABS(((arb(x0))~[m1]) Ra_MINUS y0)
	(eps0,eps,Ra_ABS(((arb(x0))~[m1]) Ra_MINUS y0))-->T497(Stat3,Stat1,Stat23,Stat24*) ==> Stat25: eps0 Ra_GT Ra_ABS(((arb(x0))~[m1]) Ra_MINUS y0)
	(eps0,Ra_ABS(((arb(x0))~[m1]) Ra_MINUS y0),eps0)-->T497(Stat1,Stat23,Stat19,Stat25*) ==> Stat26: eps0 Ra_GT eps0
(eps0,eps0)-->T473(Stat26*) ==> false; Discharge ==> QED
--
--Theorem OM: [The images of rationals via the embedding form a dense subset of the reals, 2] ((X in Re) & (Eps in Re) & (Eps R_GT R_0)) imp (EXISTS y in Ra | Eps R_GT abs(X R_MINUS ReRa(y))). Proof:
--Suppose_not(x0,eps) ==> Stat1: (not (EXISTS y in Ra | eps R_GT abs(x0 R_MINUS ReRa(y)))) & (x0 in Re) & (eps in Re) & (eps R_GT R_0)
--Tsomehow ==> false; Discharge ==> QED
--
-- There is also an elementary 'natural' embedding of signed integers into rationals
-- which preserves all operations other than division.
--
Def 70: [Embedding of signed integers into rationals] RaSi(X) := Fr_to_Ra([X,[1,0]])
--
Theorem 743: [The embedding of signed integers into rationals preserves all elementary algebraic operations, 1]  (X in Si) imp ((RaSi(X) in Ra) &
	(Ra_is_nonneg(RaSi(X)) eq is_nonneg(X)) & (RaSi(S_Rev(X)) = Ra_Rev(RaSi(X))) & (RaSi(S_ABS(X)) = Ra_ABS(RaSi(X)))). Proof:
Suppose_not(x0) ==> AUTO
	Use_def(RaSi(x0)) ==> AUTO
	T368(*) ==> Stat1: ([1,0] in Si) & ([1,0] /= [0,0]) & ((Ra_is_nonneg(RaSi(x0)) neq is_nonneg(x0)) or (RaSi(x0) notin Ra) or (RaSi(S_Rev(x0)) /= Ra_Rev(RaSi(x0))) or (RaSi(S_ABS(x0)) /= Ra_ABS(RaSi(x0))))
	Suppose ==> RaSi(x0) notin Ra
		EQUAL ==> Stat2: Fr_to_Ra([x0,[1,0]]) notin Ra
		([x0,[1,0]])-->T421(Stat2*) ==> Stat3: [x0,[1,0]] notin Fr
	(x0,[1,0])-->T432(*) ==> false; Discharge ==> RaSi(x0) in Ra
	Suppose ==> Fr_to_Ra([S_Rev(x0),[1,0]]) /= Ra_Rev(Fr_to_Ra([x0,[1,0]]))
	(x0,[1,0])-->T484(*) ==> false; Discharge ==> Stat4: Fr_to_Ra([S_Rev(x0),[1,0]]) = Ra_Rev(Fr_to_Ra([x0,[1,0]]))
	Use_def(RaSi(S_Rev(x0))) ==> AUTO
	EQUAL ==> RaSi(S_Rev(x0)) = Ra_Rev(RaSi(x0))
	(x0,[1,0])-->T459(*) ==> Ra_is_nonneg(Fr_to_Ra([x0,[1,0]])) eq is_nonneg(x0 S_TIMES [1,0])
	x0-->T402(*) ==> (x0 S_TIMES [1,0]) = x0
	EQUAL ==> Ra_is_nonneg(RaSi(x0)) eq is_nonneg(x0)
	(Stat1*)ELEM ==> RaSi(S_ABS(x0)) /= Ra_ABS(RaSi(x0))
	Use_def(RaSi(S_ABS(x0))) ==> AUTO
	EQUAL ==> Stat5: Fr_to_Ra([S_ABS(x0),[1,0]]) /= Ra_ABS(Fr_to_Ra([x0,[1,0]]))
	Use_def(S_ABS)(Stat5*) ==> Fr_to_Ra([[car(x0)+cdr(x0),0],[1,0]]) /= Ra_ABS(Fr_to_Ra([x0,[1,0]]))
	T525(Stat6*) ==> Stat6: (FORALL x | Ra_ABS(x) = if Ra_is_nonneg(x) then x else Ra_Rev(x) end if)
	(Fr_to_Ra([x0,[1,0]]))-->Stat6(Stat6*) ==> Ra_ABS(Fr_to_Ra([x0,[1,0]])) = if Ra_is_nonneg(Fr_to_Ra([x0,[1,0]])) then Fr_to_Ra([x0,[1,0]]) else Ra_Rev(Fr_to_Ra([x0,[1,0]])) end if
	EQUAL(Stat4) ==> Stat7: Fr_to_Ra([[car(x0)+cdr(x0),0],[1,0]]) /= if is_nonneg(x0) then Fr_to_Ra([x0,[1,0]]) else Ra_Rev(Fr_to_Ra([x0,[1,0]])) end if
	Use_def(is_nonneg(x0)) ==> AUTO
	Use_def(S_Rev(x0)) ==> AUTO
	EQUAL(Stat4) ==> Stat8: Fr_to_Ra([[car(x0)+cdr(x0),0],[1,0]]) /= if (car(x0) incs cdr(x0)) then Fr_to_Ra([x0,[1,0]]) else Fr_to_Ra([[cdr(x0),car(x0)],[1,0]]) end if
	x0-->T369(*) ==> x0 = [car(x0),cdr(x0)]
	x0-->T369(*) ==> Stat9: (car(x0) = 0) or (cdr(x0) = 0)
	Suppose ==> Stat10: cdr(x0) = 0
		(Stat10*)ELEM ==> (car(x0) + cdr(x0)) = car(x0)
		(Stat10*)ELEM ==> Stat11: car(x0) incs cdr(x0)
		EQUAL(Stat8) ==> Fr_to_Ra([x0,[1,0]]) /= if (car(x0) incs cdr(x0)) then Fr_to_Ra([x0,[1,0]]) else Fr_to_Ra([[cdr(x0),car(x0)],[1,0]]) end if
	(Stat11)ELEM ==> false; Discharge ==> Stat12: cdr(x0) /= 0
	(Stat9*)ELEM ==> car(x0) = 0
	(Stat9,Stat12*)ELEM ==> (car(x0) + cdr(x0)) = cdr(x0)
	(Stat9,Stat12*)ELEM ==> (not(car(x0) incs cdr(x0)))
EQUAL(Stat8) ==> false; Discharge ==> QED
--
Theorem 744: [The embedding of signed integers into rationals preserves all elementary algebraic operations, 2]  ((X in Si) & (Y in Si)) imp ((RaSi(X) in Ra) & (RaSi(Y) in Ra) &
	(RaSi(X S_PLUS Y) = RaSi(X) Ra_PLUS RaSi(Y)) &
	(RaSi(X S_TIMES Y) = RaSi(X) Ra_TIMES RaSi(Y))). Proof:
Suppose_not(x0,y0) ==> AUTO
	x0-->T743(*) ==> Stat1: (RaSi(x0) in Ra) & (x0 in Si)
	y0-->T743(*) ==> Stat2: (RaSi(y0) in Ra) & (y0 in Si)
	ELEM ==> Stat3: (RaSi(x0 S_PLUS y0) /= RaSi(x0) Ra_PLUS RaSi(y0)) or (RaSi(x0 S_TIMES y0) /= RaSi(x0) Ra_TIMES RaSi(y0))
	T368(Stat4*) ==> Stat4: ([1,0] in Si) & ([1,0] /= [0,0])
	Use_def(RaSi)(Stat1*) ==> Stat5: (Fr_to_Ra([x0,[1,0]]) in Ra) & (Fr_to_Ra([y0,[1,0]]) in Ra)
	(x0,[1,0])-->T432(Stat1,Stat4*) ==> Stat6: [x0,[1,0]] in Fr
	T418(Stat7*) ==> Stat7: (FORALL x in Fr,y in Fr | (Same_frac(x,y) eq Same_frac(y,x)) & Same_frac(x,x))
	(Fr_to_Ra([x0,[1,0]]))-->T423(Stat4*) ==> Stat8: arb(Fr_to_Ra([x0,[1,0]])) in Fr
	(arb(Fr_to_Ra([x0,[1,0]])))-->T431(Stat8*) ==> Stat9: (car(arb(Fr_to_Ra([x0,[1,0]]))) in Si) & (cdr(arb(Fr_to_Ra([x0,[1,0]]))) in Si)
	Suppose ==> Stat10: RaSi(x0 S_PLUS y0) /= (RaSi(x0) Ra_PLUS RaSi(y0))
		Use_def(RaSi)(Stat10*) ==> Fr_to_Ra([x0 S_PLUS y0,[1,0]]) /= (Fr_to_Ra([x0,[1,0]]) Ra_PLUS Fr_to_Ra([y0,[1,0]]))
		(Fr_to_Ra([x0,[1,0]]),y0,[1,0])-->T438(Stat2*) ==> Stat11: Fr_to_Ra([x0 S_PLUS y0,[1,0]]) /=
			Fr_to_Ra([(car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES [1,0]) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0),(cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES [1,0])])
		(car(arb(Fr_to_Ra([x0,[1,0]]))))-->T402(Stat8*) ==> (car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES [1,0]) = car(arb(Fr_to_Ra([x0,[1,0]])))
		(cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T402(Stat8*) ==> (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES [1,0]) = cdr(arb(Fr_to_Ra([x0,[1,0]])))
		EQUAL(Stat10) ==> Fr_to_Ra([x0 S_PLUS y0,[1,0]]) /=
			Fr_to_Ra([car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))])
		(cdr(arb(Fr_to_Ra([x0,[1,0]]))),y0)-->T371(Stat2*) ==> Stat12: (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0) in Si
		(car(arb(Fr_to_Ra([x0,[1,0]]))),cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0)-->T371(Stat8*) ==> (car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0)) in Si
		(Fr_to_Ra([x0,[1,0]]))-->T423(Stat5,Stat5*) ==> Stat13: arb(Fr_to_Ra([x0,[1,0]])) in Fr
		(arb(Fr_to_Ra([x0,[1,0]])))-->T431(Stat13*) ==> cdr(arb(Fr_to_Ra([x0,[1,0]]))) /= [0,0]
		(car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T432(Stat8*) ==> [car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))] in Fr
		(x0,y0)-->T371(Stat1,Stat2*) ==> Stat14: (x0 S_PLUS y0) in Si
		(x0 S_PLUS y0,[1,0])-->T432(Stat14,Stat4*) ==> [x0 S_PLUS y0,[1,0]] in Fr
		([car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))],[x0 S_PLUS y0,[1,0]])-->T422(Stat11*) ==>
			(not(Same_frac([car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))],[x0 S_PLUS y0,[1,0]])))
--
-- We have just restated the inequality assumed temporarily as inequivalence between two fractions.
-- However, Theorem 421 gives us the equivalence between the fractions $[x0,[1,0]]$ and $arb(Fr_to_Ra([x0,[1,0]]))$,
-- whence a contradiction easily follows by a merely algebraic argument.
--
		([x0,[1,0]])-->T421(Stat6,Stat6*) ==> Same_frac([x0,[1,0]],arb(Fr_to_Ra([x0,[1,0]])))
		([x0,[1,0]],arb(Fr_to_Ra([x0,[1,0]])))-->Stat7(Stat6*) ==> Stat15: Same_frac(arb(Fr_to_Ra([x0,[1,0]])),[x0,[1,0]])
		Use_def(Same_frac)(Stat15*) ==> ((car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES cdr([x0,[1,0]])) = (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES car([x0,[1,0]]))) &
			((car([car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))]) S_TIMES cdr([x0 S_PLUS y0,[1,0]])) /= (cdr([car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))]) S_TIMES car([x0 S_PLUS y0,[1,0]])))
		(x0,[1,0])-->T9(Stat15*) ==> (car([x0,[1,0]]) = x0) & (cdr([x0,[1,0]]) = [1,0])
		EQUAL(Stat8) ==> car(arb(Fr_to_Ra([x0,[1,0]]))) = (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES x0)
		(car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T9(Stat16*) ==> Stat16: (car([car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))]) = car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0)) & (cdr([car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0),cdr(arb(Fr_to_Ra([x0,[1,0]])))]) = cdr(arb(Fr_to_Ra([x0,[1,0]]))))
		(x0 S_PLUS y0,[1,0])-->T9(Stat17*) ==> Stat17: (car([x0 S_PLUS y0,[1,0]]) = (x0 S_PLUS y0)) & (cdr([x0 S_PLUS y0,[1,0]]) = [1,0])
		(car(arb(Fr_to_Ra([x0,[1,0]]))),cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0)-->T371(Stat12,Stat9*) ==> (car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0)) in Si
		(car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0))-->T402(Stat17*) ==> ((car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0)) S_TIMES [1,0]) = (car(arb(Fr_to_Ra([x0,[1,0]]))) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0))
		EQUAL(Stat15) ==> Stat18: ((cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES x0) S_PLUS (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0)) /= (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES (x0 S_PLUS y0))
	(y0,cdr(arb(Fr_to_Ra([x0,[1,0]]))),x0)-->T386(Stat1,Stat2,Stat9,Stat18*) ==> false; Discharge ==> RaSi(x0 S_PLUS y0) = (RaSi(x0) Ra_PLUS RaSi(y0))
	(Stat3*)ELEM ==> Stat19: RaSi(x0 S_TIMES y0) /= (RaSi(x0) Ra_TIMES RaSi(y0))
	Use_def(RaSi)(Stat19*) ==> Fr_to_Ra([x0 S_TIMES y0,[1,0]]) /= (Fr_to_Ra([x0,[1,0]]) Ra_TIMES Fr_to_Ra([y0,[1,0]]))
	(Fr_to_Ra([x0,[1,0]]),y0,[1,0])-->T439(Stat2*) ==> Stat20: Fr_to_Ra([x0 S_TIMES y0,[1,0]]) /=
		Fr_to_Ra([car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES [1,0]])
	(cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T402(Stat9,Stat9*) ==> (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES [1,0]) = cdr(arb(Fr_to_Ra([x0,[1,0]])))
	EQUAL(Stat20) ==> Stat21: Fr_to_Ra([x0 S_TIMES y0,[1,0]]) /=
		Fr_to_Ra([car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))])
	([x0,[1,0]])-->T421(Stat6,Stat6*) ==> Stat22: Same_frac([x0,[1,0]],arb(Fr_to_Ra([x0,[1,0]])))
	(y0,[1,0])-->T432(Stat2,Stat4*) ==> Stat23: [y0,[1,0]] in Fr
	([y0,[1,0]],[y0,[1,0]])-->Stat7(Stat7*) ==> Stat24: Same_frac([y0,[1,0]],[y0,[1,0]])
	([x0,[1,0]],arb(Fr_to_Ra([x0,[1,0]])),[y0,[1,0]],[y0,[1,0]])-->T436(Stat6,Stat23,Stat8,Stat22,Stat24*) ==> Same_frac([car([x0,[1,0]]) S_TIMES car([y0,[1,0]]),cdr([x0,[1,0]]) S_TIMES cdr([y0,[1,0]])],[car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES car([y0,[1,0]]),cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES cdr([y0,[1,0]])])
	(x0,[1,0])-->T9(Stat25*) ==> Stat25: (car([x0,[1,0]]) = x0) & (cdr([x0,[1,0]]) = [1,0])
	(y0,[1,0])-->T9(Stat26*) ==> Stat26: (car([y0,[1,0]]) = y0) & (cdr([y0,[1,0]]) = [1,0])
	(cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T402(Stat9,Stat9*) ==> (cdr(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES [1,0]) = cdr(arb(Fr_to_Ra([x0,[1,0]])))
	([1,0])-->T402(Stat4,Stat4*) ==> ([1,0] S_TIMES [1,0]) = [1,0]
	EQUAL(Stat24) ==> Same_frac([x0 S_TIMES y0,[1,0]],[car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))])
	(x0,y0)-->T371(Stat1,Stat2*) ==> Stat27: (x0 S_TIMES y0) in Si
	(x0 S_TIMES y0,[1,0])-->T432(Stat27,Stat4*) ==> Stat28: [x0 S_TIMES y0,[1,0]] in Fr
	(car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T10(Stat29*) ==> Stat29: [car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))] = [car([car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))]),cdr([car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))])]
	(Fr_to_Ra([x0,[1,0]]))-->T423(Stat5,Stat5*) ==> Stat30: arb(Fr_to_Ra([x0,[1,0]])) in Fr
	(arb(Fr_to_Ra([x0,[1,0]])))-->T431(Stat30*) ==> Stat31: (car(arb(Fr_to_Ra([x0,[1,0]]))) in Si) & (cdr(arb(Fr_to_Ra([x0,[1,0]]))) in Si)
	(car(arb(Fr_to_Ra([x0,[1,0]]))),y0)-->T371(Stat31,Stat2*) ==> Stat32: (car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0) in Si
	(Fr_to_Ra([x0,[1,0]]))-->T423(Stat5,Stat5*) ==> Stat33: arb(Fr_to_Ra([x0,[1,0]])) in Fr
	(arb(Fr_to_Ra([x0,[1,0]])))-->T431(Stat33*) ==> Stat34: cdr(arb(Fr_to_Ra([x0,[1,0]]))) /= [0,0]
	(car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]]))))-->T432(Stat31,Stat32,Stat34*) ==> [car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))] in Fr
([x0 S_TIMES y0,[1,0]],[car(arb(Fr_to_Ra([x0,[1,0]]))) S_TIMES y0,cdr(arb(Fr_to_Ra([x0,[1,0]])))])-->T422(Stat21*) ==> false; Discharge ==> QED
--
Theorem 745: [The embedding of signed integers into rationals preserves all elementary algebraic operations, 3]  ((X in Si) & (Y in Si)) imp
	(RaSi(X S_MINUS Y) = RaSi(X) Ra_MINUS RaSi(Y)). Proof:
Suppose_not(x0,y0) ==> AUTO
	y0-->T743(*) ==> (RaSi(y0) in Ra) & (RaSi(S_Rev(y0)) = Ra_Rev(RaSi(y0)))
	(x0,y0)-->T398(*) ==> (x0 S_MINUS y0) = (x0 S_PLUS S_Rev(y0))
	y0-->T391(*) ==> S_Rev(y0) in Si
	(x0,S_Rev(y0))-->T744(*) ==> RaSi(x0 S_PLUS S_Rev(y0)) = (RaSi(x0) Ra_PLUS RaSi(S_Rev(y0)))
	EQUAL ==> RaSi(x0 S_MINUS y0) = (RaSi(x0) Ra_PLUS Ra_Rev(RaSi(y0)))
--?	Use_def(Ra_MINUS)(*) ==> (RaSi(X) Ra_MINUS RaSi(Y)) = (RaSi(x0) Ra_PLUS Ra_Rev(RaSi(y0)))
	Use_def(Ra_MINUS)(*) ==> (RaSi(x0) Ra_MINUS RaSi(y0)) = (RaSi(x0) Ra_PLUS Ra_Rev(RaSi(y0)))
EQUAL ==> false; Discharge ==> QED
--
Theorem 746: [The embedding of signed integers into rationals is 1-1]  ((X in Si) & (Y in Si)) imp ((RaSi(X) = RaSi(Y)) eq (X = Y)). Proof:
Suppose_not(x,y) ==> AUTO
	Suppose ==> x = y
	EQUAL ==> false; Discharge ==> Stat1: (x in Si) & (y in Si) & (x /= y) & (RaSi(x) = RaSi(y))
	Use_def(RaSi)(Stat1*) ==> Stat2: (x in Si) & (y in Si) & (Fr_to_Ra([x,[1,0]]) = Fr_to_Ra([y,[1,0]])) & (x /= y)
	T420(Stat2*) ==> Stat3: (FORALL u, v | ((u in Fr) & (v in Fr)) imp ((Same_frac(u,v) eq (Fr_to_Ra(u) = Fr_to_Ra(v)))))
	T211(Stat3*) ==> (1 in Za)
        1-->T367(Stat3*) ==> [1,0] in Si
	TELEM ==> [1,0] /= [0,0]
	Suppose ==> Stat4: [x,[1,0]] notin {[u,v]: u in Si, v in Si | v /= [0,0]}
	(x,[1,0])-->Stat4(Stat2*) ==> false; Discharge ==> [x,[1,0]] in {[u,v]: u in Si, v in Si | v /= [0,0]}
	Suppose ==> Stat5: [y,[1,0]] notin {[u,v]: u in Si, v in Si | v /= [0,0]}
	(y,[1,0])-->Stat5(Stat2*) ==> false; Discharge ==> [y,[1,0]] in {[u,v]: u in Si, v in Si | v /= [0,0]}
	Use_def(Fr)(Stat1*) ==> Fr = {[u,v]: u in Si, v in Si | v /= [0,0]}
	EQUAL(Stat1) ==> ([x,[1,0]] in Fr) & ([y,[1,0]] in Fr)
	([x,[1,0]],[y,[1,0]])-->Stat3(Stat2*) ==> Stat6: Same_frac([x,[1,0]],[y,[1,0]])
	Use_def(Same_frac)(Stat6*) ==> car([x,[1,0]]) S_TIMES cdr([y,[1,0]]) = cdr([x,[1,0]]) S_TIMES car([y,[1,0]])
	TELEM ==> car([x,[1,0]]) = x
	TELEM ==> cdr([x,[1,0]]) = [1,0]
	TELEM ==> car([y,[1,0]]) = y
	TELEM ==> cdr([y,[1,0]]) = [1,0]
	x-->T402(Stat2,Stat2*) ==> (x S_TIMES [1,0]) = x
	y-->T401(Stat2,Stat2*) ==> ([1,0] S_TIMES y) = y
EQUAL(Stat2) ==> false; Discharge ==> QED
--
Theorem 747: [The embedding of signed integers into rationals preserves 0 and 1]  RaSi([0,0]) = Ra_0 & RaSi([1,0]) = Ra_1. Proof:
Suppose_not ==> AUTO
	Use_def(RaSi)(*) ==> Stat1: not((Fr_to_Ra([[0,0],[1,0]]) = Ra_0) & (Fr_to_Ra([[1,0],[1,0]]) = Ra_1))
	Use_def(Ra_0)(Stat1*) ==> Stat2: Fr_to_Ra([[1,0],[1,0]]) /= Ra_1
Use_def(Ra_1)(Stat2*) ==> false; Discharge ==> QED
--
Theorem 748: [The embedding of signed integers into rationals preserves ordering]  ((X in Si) & (Y in Si)) imp (((RaSi(X) Ra_GE RaSi(Y)) eq (X S_GE Y)) &
			((RaSi(X) Ra_GT RaSi(Y)) eq (X S_GT Y)) &
			((RaSi(Y) Ra_LE RaSi(X)) eq (Y S_LE X)) &
			((RaSi(Y) Ra_LT RaSi(X)) eq (Y S_LT X))). Proof:
Suppose_not(x0,y0) ==> AUTO
	(x0,y0)-->T428(*) ==> Stat1: ((x0 S_GE y0) eq is_nonneg(x0 S_PLUS S_Rev(y0))) &
		((x0 S_GT y0) eq ((x0 S_GE y0) & (x0 /= y0))) & (x0 in Si) & (y0 in Si)
	(x0,y0)-->T744(*) ==> (RaSi(x0) in Ra) & (RaSi(y0) in Ra)
	(RaSi(x0),RaSi(y0))-->T473(Stat1*) ==> ((RaSi(x0) Ra_GE RaSi(y0)) eq Ra_is_nonneg(RaSi(x0) Ra_PLUS Ra_Rev(RaSi(y0)))) &
		((RaSi(x0) Ra_GT RaSi(y0)) eq ((RaSi(x0) Ra_GE RaSi(y0)) & (RaSi(x0) /= RaSi(y0))))
	Suppose ==> not((RaSi(x0) Ra_GE RaSi(y0)) eq (x0 S_GE y0))
		(Stat1*)ELEM ==> not(Ra_is_nonneg(RaSi(x0) Ra_PLUS Ra_Rev(RaSi(y0))) eq is_nonneg(x0 S_PLUS S_Rev(y0)))
		y0-->T743(Stat1,Stat1*) ==> RaSi(S_Rev(y0)) = Ra_Rev(RaSi(y0))
		(y0,y0)-->T372(Stat1,Stat1*) ==> Stat2: S_Rev(y0) in Si
		(x0,S_Rev(y0))-->T744(Stat1,Stat2*) ==> RaSi(x0 S_PLUS S_Rev(y0)) = (RaSi(x0) Ra_PLUS RaSi(S_Rev(y0)))
		EQUAL(Stat1) ==> Stat3: not(Ra_is_nonneg(RaSi(x0 S_PLUS S_Rev(y0))) eq is_nonneg(x0 S_PLUS S_Rev(y0)))
		(x0,S_Rev(y0))-->T371(Stat1,Stat2*) ==> (x0 S_PLUS S_Rev(y0)) in Si
	(x0 S_PLUS S_Rev(y0))-->T743(Stat3*) ==> false; Discharge ==> Stat4: (RaSi(x0) Ra_GE RaSi(y0)) eq (x0 S_GE y0)
	(x0,y0)-->T746(Stat1,Stat1*) ==> (x0 = y0) eq (RaSi(x0) = RaSi(y0))
	(Stat1*)ELEM ==> ((RaSi(x0) Ra_GT RaSi(y0)) eq (x0 S_GT y0)) & (x0 in Si) & (y0 in Si)
	(y0,x0)-->T428(Stat1*) ==> ((y0 S_LE x0) eq (x0 S_GE y0)) &
		((y0 S_LT x0) eq (x0 S_GT y0))
	(RaSi(y0),RaSi(x0))-->T473(Stat1*) ==> ((RaSi(y0) Ra_LE RaSi(x0)) eq (RaSi(x0) Ra_GE RaSi(y0))) &
		((RaSi(y0) Ra_LT RaSi(x0)) eq (RaSi(x0) Ra_GT RaSi(y0)))
ELEM ==> false; Discharge ==> QED
--
-- Finally the 'natural' embedding of integers into signed integers
-- preserves all operations other than division and subtraction.
--
Def 71: [Embedding of integers into signed integers] SiZa(X) := [X,0]
--
Theorem 749: [The embedding of integers into signed integers preserves all elementary algebraic operations on integers]  ((X in Za) & (Y in Za)) imp ((SiZa(X) in Si) & (SiZa(Y) in Si) &
	(SiZa(X PLUS Y) = SiZa(X) S_PLUS SiZa(Y)) &
	(SiZa(X TIMES Y) = SiZa(X) S_TIMES SiZa(Y))). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(SiZa)(*) ==> Stat1: (x in Za) & (y in Za) & (not(([x,0] in Si) & ([y,0] in Si) &
		([x PLUS y,0] = ([x,0] S_PLUS [y,0])) &
		([x TIMES y,0] = ([x,0] S_TIMES [y,0]))))
	x-->T367(Stat1*) ==> [x,0] in Si
	y-->T367(Stat1*) ==> ([x PLUS y,0] /= ([x,0] S_PLUS [y,0])) or ([x TIMES y,0] /= ([x,0] S_TIMES [y,0]))
(x,y)-->T388(Stat1*) ==> false; Discharge ==> QED
--
Theorem 750: [The embedding of integers into signed integers is 1-1]  ((X in Za) & (Y in Za) & (SiZa(X) = SiZa(Y))) imp (X = Y). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(SiZa)(*) ==> Stat1: ([x,0] = [y,0]) & (x /= y)
(Stat1*)Discharge ==> QED
--
Theorem 751: [The embedding of integers into signed integers preserves 0 and 1]  (SiZa(0) = [0,0]) & (SiZa(1) = [1,0]). Proof:
Suppose_not ==> AUTO
Use_def(SiZa)(*) ==> false; Discharge ==> QED
--
Theorem 752: [The embedding of integers into signed integers preserves ordering]  ((X in Za) & (Y in Za)) imp (((SiZa(X) S_GE SiZa(Y)) eq (X incs Y)) &
			((SiZa(X) S_GT SiZa(Y)) eq (Y in X)) &
			((SiZa(Y) S_LE SiZa(X)) eq (Y incin X)) &
			((SiZa(Y) S_LT SiZa(X)) eq (Y in X))). Proof+:
Suppose_not(x,y) ==> AUTO
	T427(*) ==> Stat1: (FORALL x, y | (S_GE(x,y) eq is_nonneg(x S_PLUS S_Rev(y))) &
		(S_LE(x,y) eq S_GE(y,x)) & (S_GT(x,y) eq (S_GE(x,y) & (x /= y))) & (S_LT(x,y) eq S_GT(y,x)))
	(SiZa(x),SiZa(y))-->Stat1(*) ==> (S_GE(SiZa(x),SiZa(y)) eq is_nonneg(SiZa(x) S_PLUS S_Rev(SiZa(y)))) &
		(S_LE(SiZa(x),SiZa(y)) eq S_GE(SiZa(y),SiZa(x))) & (S_GT(SiZa(x),SiZa(y)) eq (S_GE(SiZa(x),SiZa(y)) & (SiZa(x) /= SiZa(y)))) & (S_LT(SiZa(x),SiZa(y)) eq S_GT(SiZa(y),SiZa(x)))
	(SiZa(y),SiZa(x))-->Stat1(*) ==>
		(S_LE(SiZa(y),SiZa(x)) eq S_GE(SiZa(x),SiZa(y))) & (S_GT(SiZa(y),SiZa(x)) eq (S_GE(SiZa(y),SiZa(x)) & (SiZa(y) /= SiZa(x)))) & (S_LT(SiZa(y),SiZa(x)) eq S_GT(SiZa(x),SiZa(y)))
	Suppose ==> (SiZa(x) S_GE SiZa(y)) neq (x incs y)
		Use_def(S_GE)(*) ==> Stat2: is_nonneg(SiZa(x) S_PLUS S_Rev(SiZa(y))) neq (x incs y)
		Use_def(SiZa)(Stat2*) ==> is_nonneg([x,0] S_PLUS S_Rev([y,0])) neq (x incs y)
		Use_def(S_Rev)(Stat2*) ==> is_nonneg([x,0] S_PLUS [cdr([y,0]),car([y,0])]) neq (x incs y)
		TELEM ==> car([y,0]) = y
		TELEM ==> cdr([y,0]) = 0
		EQUAL(Stat2) ==> Stat3: is_nonneg([x,0] S_PLUS [0,y]) neq (x incs y)
		Use_def(S_PLUS)(Stat3*) ==> is_nonneg(Red([car([x,0]) PLUS car([0,y]),cdr([x,0]) PLUS cdr([0,y])])) neq (x incs y)
		TELEM ==> car([x,0]) = x
		TELEM ==> car([0,y]) = 0
		TELEM ==> cdr([x,0]) = 0
		TELEM ==> cdr([0,y]) = y
		ELEM ==> Stat4: (x in Za) & (y in Za)
		ALGEBRA(Stat4) ==> ((x PLUS 0) = x) & ((0 PLUS y) = y)
		EQUAL(Stat3) ==> Stat5: is_nonneg(Red([x,y])) neq (x incs y)
		Use_def(Red)(Stat5*) ==> is_nonneg([car([x,y]) MINUS (car([x,y]) * cdr([x,y])),cdr([x,y]) MINUS (car([x,y]) * cdr([x,y]))]) neq (x incs y)
		TELEM ==> car([x,y]) = x
		TELEM ==> cdr([x,y]) = y
		EQUAL(Stat5) ==> Stat6: is_nonneg([x MINUS (x * y),y MINUS (x * y)]) neq (x incs y)
		Use_def(is_nonneg)(Stat6*) ==> (car([x MINUS (x * y),y MINUS (x * y)]) incs cdr([x MINUS (x * y),y MINUS (x * y)])) neq (x incs y)
		(x MINUS (x * y),y MINUS (x * y))-->T9(*) ==> (car([x MINUS (x * y),y MINUS (x * y)]) = x MINUS (x * y)) &
				(cdr([x MINUS (x * y),y MINUS (x * y)]) = y MINUS (x * y))
		EQUAL(Stat6) ==> ((x MINUS (x * y)) incs (y MINUS (x * y))) neq (x incs y)
		(x,y)-->T375(*) ==> Stat7: ((x * y) in Za) & ((x MINUS (x * y)) in Za) & ((y MINUS (x * y)) in Za)
		(x,x*y)-->T325(*) ==> x = ((x*y) PLUS (x MINUS (x*y)))
		(y,x*y)-->T325(*) ==> y = ((x*y) PLUS (y MINUS (x*y)))
		ALGEBRA(Stat4,Stat7) ==> (((x*y) PLUS (x MINUS (x*y))) = ((x MINUS (x*y)) PLUS (x*y))) &
				(((x*y) PLUS (y MINUS (x*y))) = ((y MINUS (x*y)) PLUS (x*y)))
	(y MINUS (x*y),x MINUS (x*y),x*y)-->T296(Stat6*) ==> false; Discharge ==> (SiZa(x) S_GE SiZa(y)) eq (x incs y)
	Suppose ==> (SiZa(x) S_GT SiZa(y)) neq (y in x)
		Use_def(S_GT)(*) ==> (S_GE(SiZa(x),SiZa(y)) & (SiZa(x) /= SiZa(y))) neq (y in x)
		Suppose ==> (SiZa(x) /= SiZa(y)) neq (x /= y)
			(x,y)-->T750(*) ==> (SiZa(x) /= SiZa(y)) & (x = y)
		EQUAL ==> false; Discharge ==> (SiZa(x) /= SiZa(y)) eq (x /= y)
		EQUAL ==> (S_GE(SiZa(x),SiZa(y)) & (x /= y)) neq (y in x)
		Use_def(S_GE)(*) ==> ((x incs y) & (x /= y)) neq (y in x)
	(x,y)-->T34(*) ==> false; Discharge ==> (SiZa(x) S_GT SiZa(y)) eq (y in x)
	Suppose ==> (SiZa(y) S_LE SiZa(x)) neq (y incin x)
		Use_def(S_LE)(*) ==> S_GE(SiZa(x),SiZa(y)) neq (y incin x)
	Use_def(S_GE)(*) ==> false; Discharge ==> (SiZa(y) S_LT SiZa(x)) neq (y in x)
	Use_def(S_LT)(*) ==> S_GT(SiZa(x),SiZa(y)) neq (y in x)
Use_def(S_GT)(*) ==> false; Discharge ==> QED
--
-- The definitions for rational sequences and rational Cauchy sequences given previously
-- extend readily to the real case.
--
Def 72: [The set of real sequences] ReSeq := {f: f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)}
--
Def 73: [Real Cauchy sequences] ReCauchy := {f: f in ReSeq | (FORALL eps in Re | (eps R_GT R_0) imp
		Finite({i * j : i in Za, j in Za | abs((f~[i]) R_MINUS (f~[j])) R_GT eps}))}
--
-- The definitions for pointwise sequence sums given for rational sequences extend with equal ease to the real case.
--
Def 74: [Sum of real functions] Def(X Res_PLUS Y) := {[car(p),cdr(p) R_PLUS (Y~[car(p)])]: p in X}
Def 75: [Additive inverse of real function] Res_Rev(X) := {[car(p),R_Rev(cdr(p))]: p in X}
Def 76: [Absolute values of real function] Res_ABS(X) := {[car(p),abs(cdr(p))]: p in X}
Def 77: [Difference of real functions] Def(X Res_MINUS Y) := X Res_PLUS Res_Rev(Y)
Def 78: [Product of real functions] Def(X Res_TIMES Y) := {[car(p),cdr(p) R_TIMES (Y~[car(p)])]: p in X}
Def 78a: [Quotient of real functions] Def(X Res_OVER Y) := {[car(p),cdr(p) R_OVER (Y~[car(p)])]: p in X | Y~[car(p)] /= R_0}
--
-- Next we state and prove various elementary properties of the absolute values of real numbers,
-- deriving them from the corresponding properties of rationals and of rational sequences.
--
Theorem 753: [Elementary properties of the real absolute value]  ((X in Re) & (Y in Re)) imp ((abs(X) in Re) & (abs(Y) in Re) &
			(abs(X R_TIMES Y) = (abs(X) R_TIMES abs(Y))) & ((abs(X) R_PLUS abs(Y)) R_GE abs(X R_PLUS Y) & (abs(R_Rev(X)) = abs(X)))). Proof:
Suppose_not(x,y) ==> AUTO
	(x,y)-->T726(*) ==> abs(x R_TIMES y) = (abs(x) R_TIMES abs(y))
	x-->T727(*) ==> abs(R_Rev(x)) = abs(x)
	x-->T723(*) ==> Stat1: abs(x) in Re
	y-->T723(*) ==> Stat2: abs(y) in Re
	(x,y)-->T731(*) ==> (((abs(x) R_PLUS abs(y)) R_GT abs(x R_PLUS y)) or ((abs(x) R_PLUS abs(y)) = abs(x R_PLUS y)))
	ELEM ==> Stat3: (x in Re) & (y in Re)
	ALGEBRA(Stat3) ==> (x R_PLUS y) in Re
	ALGEBRA(Stat1,Stat2) ==> Stat4: (abs(x) R_PLUS abs(y)) in Re
	(x R_PLUS y)-->T723(Stat3*) ==> abs(x R_PLUS y) in Re
(abs(x) R_PLUS abs(y),abs(x R_PLUS y))-->T680(*) ==> false; Discharge ==> QED
--
-- It is obvious that every real Cauchy sequence is a real sequence
--
Theorem 754: [Every real Cauchy sequence is a real sequence] ReCauchy incin ReSeq. Proof:
Suppose_not ==> Stat1: ReCauchy nincin ReSeq
	g-->Stat1(Stat1*) ==> Stat2: (g in ReCauchy) & (g notin ReSeq)
	Use_def(ReCauchy) ==> Stat3: g in {f in ReSeq | (FORALL eps in Re | (eps R_GT R_0) imp
		Finite({i * j : i in Za, j in Za | abs((f~[i]) R_MINUS (f~[j])) R_GT eps}))}
()-->Stat3(Stat2*) ==> false; Discharge ==> QED
--
-- Moreover, the range of a real sequence is plainly included in the set of reals;
-- its domain is the set of integers, and each of its image elements is a real.
--
Theorem 755: [The range of a real sequence is included in the set of reals] (F in ReSeq) imp ((domain(F) = Za) & Svm(F) & (range(F) incin Re) & ((X in Za) imp (F~[X] in Re))). Proof:
Suppose_not(f,x) ==> AUTO
	Use_def(ReSeq) ==> Stat1: f in {g incin (Za PROD Re) | (domain(g) = Za) & Svm(g)}
	()-->Stat1 ==> AUTO
	(f,Za,Re)-->T141 ==> AUTO
--
-- For, assuming $f,x$ to be a counterexample, we are led to a contradiction as follows.
-- From Theorem 141, we immediately get that the only conclusion of the theorem's assertion
-- which can be false is the implication $((x in Za) imp (f~[x] in Re))$.
-- However, the only remaining possibility is discarded immediately thanks to Theorem 71.
--
(x,f)-->T71(*) ==> false; Discharge ==> QED
--
-- The following theorem about real Cauchy sequences is closely analogous
-- to Theorem 554 about rational Cauchy sequences.
--
Theorem 756: ({F,G} incin ReSeq) imp
	(((F Res_PLUS G) in ReSeq) &
		(Res_ABS(G) in ReSeq) &
		(Res_Rev(G) in ReSeq) &
		((F Res_TIMES G) in ReSeq) &
		((F Res_PLUS G) = {[u,((F~[u]) R_PLUS  (G~[u]))]: u in Za}) &
		(Res_ABS(G) = {[u,abs(G~[u])]: u in Za}) &
		(Res_Rev(G) = {[u,R_Rev(G~[u])]: u in Za}) &
		((F Res_TIMES G) = {[u,((F~[u]) R_TIMES (G~[u]))]: u in Za})). Proof:
Suppose_not(f0,g0) ==> AUTO
--
-- Reasoning by contradiction, assume that $f0,g0$ form a counterexample
-- to the desired statement.
--
	f0-->T755(*) ==> Stat1: (domain(f0) = Za) & Svm(f0) & (range(f0) incin Re)
	g0-->T755(*) ==> Stat2: (domain(g0) = Za) & Svm(g0) & (range(g0) incin Re)
	Use_def(Res_PLUS) ==> (f0 Res_PLUS g0) = {[car(p),cdr(p) R_PLUS (g0~[car(p)])]: p in f0}
	Use_def(Res_ABS) ==> Res_ABS(g0) = {[car(p),abs(cdr(p))]: p in g0}
	Use_def(Res_Rev) ==> Res_Rev(g0) = {[car(p),R_Rev(cdr(p))]: p in g0}
	Use_def(Res_TIMES) ==> (f0 Res_TIMES g0) = {[car(p),cdr(p) R_TIMES (g0~[car(p)])]: p in f0}
--
-- After unfolding the definitions which are directly involved,
-- we recall that $Re$ is closed under addition, multiplication, sign inversion,
-- and absolute value operation. This allows us to invoke the THEORY 'pointwise'
-- ('pointwiseU' in the monadic case) for each one of these four operations,
-- thereby leading to the desired contradiction.
--
	Suppose ==> Stat3: not(FORALL x in Re, y in Re | (x R_PLUS y) in Re)
		(x1,y1)-->Stat3 ==> Stat4: (x1 in Re) & (y1 in Re) & ((x1 R_PLUS y1) notin Re)
	ALGEBRA(Stat4) ==> (x1 R_PLUS y1) in Re; Discharge ==> AUTO
	Suppose ==> Stat5: not(FORALL x in Re, y in Re | (x R_TIMES y) in Re)
		(x2,y2)-->Stat5 ==> Stat6: (x2 in Re) & (y2 in Re) & ((x2 R_TIMES y2) notin Re)
	ALGEBRA(Stat6) ==> (x2 R_TIMES y2) in Re; Discharge ==> AUTO
	Suppose ==> Stat7: not(FORALL x in Re | abs(x) in Re)
		x3-->Stat7 ==> (x3 in Re) & (abs(x3) notin Re)
	x3-->T723 ==> false; Discharge ==> AUTO
	Suppose ==> Stat8: not(FORALL x in Re | R_Rev(x) in Re)
		x4-->Stat8 ==> Stat9: (x4 in Re) & (R_Rev(x4) notin Re)
	ALGEBRA(Stat9) ==> R_Rev(x4) in Re; Discharge ==> AUTO
	APPLY() pointwise(fq->f0,fp->g0,h->(f0 Res_PLUS g0),d->Za,r->Re,bop(x,y)->(x R_PLUS y)) ==>
	Stat10:	((f0 Res_PLUS g0) = {[u,((f0~[u]) R_PLUS (g0~[u]))]: u in Za}) &
		Svm(f0 Res_PLUS g0) & (domain(f0 Res_PLUS g0) = Za) & (range(f0 Res_PLUS g0) incin Re)
	APPLY() pointwise(fq->f0,fp->g0,h->(f0 Res_TIMES g0),d->Za,r->Re,bop(x,y)->(x R_TIMES y)) ==>
	Stat11:	((f0 Res_TIMES g0) = {[u,((f0~[u]) R_TIMES (g0~[u]))]: u in Za}) &
		Svm(f0 Res_TIMES g0) & (domain(f0 Res_TIMES g0) = Za) & (range(f0 Res_TIMES g0) incin Re)
	APPLY() pointwiseU(fp->g0,h->Res_ABS(g0),d->Za,r->Re,uop(x)->abs(x)) ==>
	Stat12:	(Res_ABS(g0) = {[u,abs(g0~[u])]: u in Za}) &
		Svm(Res_ABS(g0)) & (domain(Res_ABS(g0)) = Za) & (range(Res_ABS(g0)) incin Re)
	APPLY() pointwiseU(fp->g0,h->Res_Rev(g0),d->Za,r->Re,uop(x)->R_Rev(x)) ==>
	Stat13:	(Res_Rev(g0) = {[u,R_Rev(g0~[u])]: u in Za}) &
		Svm(Res_Rev(g0)) & (domain(Res_Rev(g0)) = Za) & (range(Res_Rev(g0)) incin Re)
	Use_def(ReSeq) ==> ((f0 Res_PLUS g0) notin {f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)}) or
			((f0 Res_TIMES g0) notin {f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)}) or
			(Res_ABS(g0) notin {f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)}) or
			(Res_Rev(g0) notin {f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)})
	Suppose ==> Stat14: Res_ABS(g0) notin {f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)}
		Use_def(Svm(Res_ABS(g0))) ==> AUTO
		(Res_ABS(g0),Za,Re)-->T141(Stat12*) ==> Res_ABS(g0) incin (Za PROD Re)
	()-->Stat14(Stat12*) ==> false; Discharge ==> ((f0 Res_PLUS g0) notin {f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)}) or
			((f0 Res_TIMES g0) notin {f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)}) or
			(Res_Rev(g0) notin {f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)})
	Suppose ==> Stat15: ((f0 Res_TIMES g0) notin {f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)})
		Use_def(Svm(f0 Res_TIMES g0)) ==> AUTO
		(f0 Res_TIMES g0,Za,Re)-->T141(Stat11*) ==> (f0 Res_TIMES g0) incin (Za PROD Re)
	()-->Stat15(Stat11*) ==> false; Discharge ==> ((f0 Res_PLUS g0) notin {f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)}) or
			(Res_Rev(g0) notin {f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)})
	Suppose ==> Stat16: ((f0 Res_PLUS g0) notin {f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)})
		Use_def(Svm(f0 Res_PLUS g0)) ==> AUTO
		(f0 Res_PLUS g0,Za,Re)-->T141(Stat10*) ==> (f0 Res_PLUS g0) incin (Za PROD Re)
	()-->Stat16(Stat10*) ==> false; Discharge ==> Stat17: Res_Rev(g0) notin {f incin (Za PROD Re) | (domain(f) = Za) & Svm(f)}
	Use_def(Svm(Res_Rev(g0))) ==> AUTO
	(Res_Rev(g0),Za,Re)-->T141(Stat13*) ==> Res_Rev(g0) incin (Za PROD Re)
	()-->Stat17(Stat13*) ==> false; Discharge ==> QED
--
--
-- It will often be convenient to use the following simplified (and partly repeated) consequences of the preceding result.
--
Theorem 757: (({F1,G1} incin ReSeq) & (N in Za)) imp ((F1~[N] in Re) & (G1~[N] in Re) &
		((F1 Res_PLUS G1 in ReSeq) & ((F1 Res_PLUS G1)~[N] = (F1~[N]) R_PLUS (G1~[N]))) &
		(((Res_ABS(G1) in ReSeq) & (Res_ABS(G1)~[N] = abs(G1~[N])))) &
		(((Res_Rev(G1) in ReSeq) & (Res_Rev(G1)~[N] = R_Rev(G1~[N])))) &
		(((F1 Res_TIMES G1 in ReSeq) & (F1 Res_TIMES G1)~[N] = ((F1~[N]) R_TIMES (G1~[N]))))). Proof:
Suppose_not(f1,g1,n) ==> AUTO
	ELEM ==> Stat1: n in Za
	(f1,n)-->T755(*) ==> (f1~[n]) in Re
	(g1,n)-->T755(*) ==> (g1~[n]) in Re
	(f1,g1)-->T756(*) ==> ((f1 Res_PLUS g1) in ReSeq) & (Res_ABS(g1) in ReSeq) &
		(Res_Rev(g1) in ReSeq) & ((f1 Res_TIMES g1) in ReSeq) &
		 ((f1 Res_PLUS g1) = {[n,((f1~[n]) R_PLUS  (g1~[n]))]: n in Za}) &
		(Res_ABS(g1) = {[n,abs(g1~[n])]: n in Za}) &
		(Res_Rev(g1) = {[n,R_Rev(g1~[n])]: n in Za}) &
		((f1 Res_TIMES g1) = {[n,((f1~[n]) R_TIMES (g1~[n]))]: n in Za})
	APPLY() fcn_symbol(f(x)->((f1~[x]) R_PLUS (g1~[x])),g->f1 Res_PLUS g1,s->Za) ==> Stat2: (FORALL x | (x in Za) imp (((f1 Res_PLUS g1)~[x]) = ((f1~[x]) R_PLUS (g1~[x]))))
	APPLY() fcn_symbol(f(x)->abs(g1~[x]),g->Res_ABS(g1),s->Za) ==> Stat3: (FORALL x | (x in Za) imp ((Res_ABS(g1)~[x]) = abs(g1~[x])))
	APPLY() fcn_symbol(f(x)->R_Rev(g1~[x]),g->Res_Rev(g1),s->Za) ==> Stat4: (FORALL x | (x in Za) imp ((Res_Rev(g1)~[x]) = R_Rev(g1~[x])))
	APPLY() fcn_symbol(f(x)->((f1~[x]) R_TIMES (g1~[x])),g->f1 Res_TIMES g1,s->Za) ==> Stat5: (FORALL x | (x in Za) imp (((f1 Res_TIMES g1)~[x]) = ((f1~[x]) R_TIMES (g1~[x]))))
--
	n-->Stat2(Stat1,Stat1*) ==> ((f1 Res_PLUS g1)~[n]) = ((f1~[n]) R_PLUS (g1~[n]))
	n-->Stat3(Stat1,Stat1*) ==> (Res_ABS(g1)~[n]) = abs(g1~[n])
	n-->Stat4(Stat1,Stat1*) ==> (Res_Rev(g1)~[n]) = R_Rev(g1~[n])
	n-->Stat5(Stat1,Stat1*) ==> ((f1 Res_TIMES g1)~[n]) = ((f1~[n]) R_TIMES (g1~[n]))
	Discharge ==> QED
--
-- We prove next that the set of real Cauchy sequences is closed
-- under the pointwise algebraic operations introduced above.
--
Theorem 758: ({F,G} incin ReCauchy) imp
	(((F Res_PLUS G) in ReCauchy) & (Res_ABS(F) in ReCauchy) & (Res_Rev(F) in ReCauchy)). Proof:
Suppose_not(fq,fp) ==> AUTO
--
-- For suppose that $fq,fp$ form a counterexample to our assertion.
--
	Use_def(ReCauchy) ==> Stat1: (fq in {f in ReSeq | (FORALL eps in Re | (eps R_GT R_0) imp
		Finite({ i * j : i in Za, j in Za | abs((f~[i]) R_MINUS (f~[j])) R_GT eps }))})
			& Stat2: (fp in {f in ReSeq | (FORALL eps in Re | (eps R_GT R_0) imp
		Finite({ i * j : i in Za, j in Za | abs((f~[i]) R_MINUS (f~[j])) R_GT eps }))})
	()-->Stat1(Stat1*) ==> Stat3: (fq in ReSeq) & Stat4: (FORALL eps in Re | (eps R_GT R_0) imp
		Finite({ i * j : i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps }))
	()-->Stat2(Stat1*) ==> Stat5: (fp in ReSeq) & Stat6: (FORALL eps in Re | (eps R_GT R_0) imp
		Finite({ i * j : i in Za, j in Za | abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps }))
	(fq,fp)-->T756(Stat1*) ==> Stat7: ((fq Res_PLUS fp) in ReSeq)
	(fq,fq)-->T756(Stat1*) ==> Stat8: (Res_ABS(fq) in ReSeq) & (Res_Rev(fq) in ReSeq)
--
-- Using the definitions of the functions involved,
-- and since, by the preceding theorem, our pointwise operations of real
-- sequences produce real sequences, we can argue as follows:
--
	Suppose ==> (fq Res_PLUS fp) notin ReCauchy
--
-- Assuming that $fq Res_PLUS fp$ is not a Cauchy sequence (unlike
-- $fq$ and $fp$), there would exist a positive real $eps0$ for which
-- the set
--	${ i * j : i in Za, j in Za | abs(((fq Res_PLUS fp)~[i]) R_MINUS ((fq Res_PLUS fp)~[j])) R_GT eps0 }$
-- is infinite, unlike the analogous sets which have $fq$ and $fp$, respectively,
-- in place of $fq Res_PLUS fp$, and positive rationals $eps1$ and $eps2$ smaller than
-- one half of $eps0$ in place of $eps0$.
--
            Use_def(ReCauchy) ==> Stat9: (fq Res_PLUS fp) notin {f in ReSeq | (FORALL eps in Re | (eps R_GT R_0) imp
		Finite({ i * j : i in Za, j in Za | abs((f~[i]) R_MINUS (f~[j])) R_GT eps }))}
            ()-->Stat9 ==> Stat10: not(FORALL eps in Re | (eps R_GT R_0) imp
		Finite({ i * j : i in Za, j in Za | abs(((fq Res_PLUS fp)~[i]) R_MINUS ((fq Res_PLUS fp)~[j])) R_GT eps }))
            eps0-->Stat10(Stat10) ==> Stat11: (eps0 in Re) & (eps0 R_GT R_0) & (not(
		Finite({ i * j : i in Za, j in Za | abs(((fq Res_PLUS fp)~[i]) R_MINUS ((fq Res_PLUS fp)~[j])) R_GT eps0 })))
            eps0-->T719 ==> Stat12: (EXISTS e in Re, e0 in Re | (eps0 R_GT e) & (e R_GT e0) & (e0 R_GT R_0) & (e R_GT R_0) & (eps0 R_GT (e R_PLUS e0)))
            (eps1,eps2)-->Stat12 ==> Stat13: (eps1 in Re) & (eps2 in Re) & (eps2 R_GT R_0) & (eps1 R_GT R_0) & (eps0 R_GT (eps1 R_PLUS eps2))
            eps1-->Stat4 ==> Finite({ i * j : i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps1 })
            eps2-->Stat6 ==> Finite({ i * j : i in Za, j in Za | abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps2 })
--
-- However, this assumption would lead to conflict with the inequality (holding for all $i,j$)
--	$abs((fq Res_PLUS fp)~[i] R_MINUS (fq Res_PLUS fp)~[j]) R_LE abs((fq~[i] R_MINUS fq~[j]) Res_PLUS (fp~[i] R_MINUS fq~[j]))$.
--
            APPLY() setformer_meet_join(s->Za, t->Za, h(i,j)->(i*j), R(i,j)->(abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps1), Q(i,j)->(abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps2)) ==>
		{(i*j): i in Za, j in Za | (abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps1) or (abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps2)} = ({(i*j): i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps1 } + {(i*j): i in Za, j in Za | abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps2 })
            ({ i * j : i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps1 }, { i * j : i in Za, j in Za | abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps2 })-->T189 ==> Finite({(i*j): i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps1 } + {(i*j): i in Za, j in Za | abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps2 })
            EQUAL ==> Finite({(i*j): i in Za, j in Za | (abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps1) or (abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps2)})
            Suppose ==> Stat14: { i * j : i in Za, j in Za | abs(((fq Res_PLUS fp)~[i]) R_MINUS ((fq Res_PLUS fp)~[j])) R_GT eps0 } nincin {(i*j): i in Za, j in Za | (abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps1) or (abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps2)}
                (i0,j0)-->Stat14 ==> Stat15: (i0 in Za) & (j0 in Za) & (abs(((fq Res_PLUS fp)~[i0]) R_MINUS ((fq Res_PLUS fp)~[j0])) R_GT eps0) & (not(abs((fq~[i0]) R_MINUS (fq~[j0])) R_GT eps1)) & (not(abs((fp~[i0]) R_MINUS (fp~[j0])) R_GT eps2))
		(fq,fp,i0)-->T757(Stat3,Stat5,Stat15*) ==> Stat16: (fq~[i0] in Re) & (fp~[i0] in Re) & (((fq Res_PLUS fp)~[i0]) = ((fq~[i0]) R_PLUS (fp~[i0])))
		(fq,fp,j0)-->T757(Stat3,Stat5,Stat15*) ==> (fq~[j0] in Re) & (fp~[j0] in Re) & (((fq Res_PLUS fp)~[j0]) = ((fq~[j0]) R_PLUS (fp~[j0])))
                EQUAL(Stat14) ==> abs((((fq~[i0]) R_PLUS (fp~[i0])) R_MINUS ((fq~[j0]) R_PLUS (fp~[j0])))) R_GT eps0
                ALGEBRA(Stat16) ==> (((fq~[i0]) R_MINUS (fq~[j0])) in Re) &
			(((fp~[i0]) R_MINUS (fp~[j0])) in Re) &
			(((((fq~[i0]) R_PLUS (fp~[i0])) R_MINUS ((fq~[j0]) R_PLUS (fp~[j0])))) = (((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0]))))
                ((fq~[i0]) R_MINUS (fq~[j0]))-->T723 ==> abs((fq~[i0]) R_MINUS (fq~[j0])) in Re
                ((fp~[i0]) R_MINUS (fp~[j0]))-->T723(Stat14) ==> abs((fp~[i0]) R_MINUS (fp~[j0])) in Re
                (abs((fq~[i0]) R_MINUS (fq~[j0])), eps1)-->T675(Stat13*) ==> eps1 R_GE abs((fq~[i0]) R_MINUS (fq~[j0]))
                (abs((fp~[i0]) R_MINUS (fp~[j0])), eps2)-->T675(Stat13*) ==> eps2 R_GE abs((fp~[i0]) R_MINUS (fp~[j0]))
                ALGEBRA(Stat13,Stat13) ==> (eps1 R_PLUS eps2) in Re
		ALGEBRA(Stat16) ==> ((abs((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS abs((fp~[i0]) R_MINUS (fp~[j0]))) in Re) &
			((((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0]))) in Re)
                (((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0])))-->T723(Stat14) ==> abs(((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0]))) in Re
                (eps1, abs((fq~[i0]) R_MINUS (fq~[j0])), eps2, abs((fp~[i0]) R_MINUS (fp~[j0])))-->T695(Stat13*) ==> (eps1 R_PLUS eps2) R_GE (abs((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS abs((fp~[i0]) R_MINUS (fp~[j0])))
                T722(Stat14) ==> Stat17: (FORALL x,y | ((x in Re) & (y in Re)) imp (abs(x R_PLUS y) R_LE (abs(x) R_PLUS abs(y))))
                ((fq~[i0]) R_MINUS (fq~[j0]), (fp~[i0]) R_MINUS (fp~[j0]))-->Stat17(Stat14) ==> abs(((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0]))) R_LE (abs((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS abs((fp~[i0]) R_MINUS (fp~[j0])))
                (abs(((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0]))), (abs((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS abs((fp~[i0]) R_MINUS (fp~[j0]))))-->T675(Stat14) ==> (abs((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS abs((fp~[i0]) R_MINUS (fp~[j0]))) R_GE abs(((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0])))
                (eps1 R_PLUS eps2, (abs((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS abs((fp~[i0]) R_MINUS (fp~[j0]))), abs(((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0]))))-->T668(Stat14) ==> (eps1 R_PLUS eps2) R_GE abs(((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0])))
                EQUAL(Stat15) ==> abs(((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0]))) R_GT eps0
                ((abs((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS abs((fp~[i0]) R_MINUS (fp~[j0]))), abs(((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0]))), eps0)-->T678(Stat11*) ==> ((abs((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS abs((fp~[i0]) R_MINUS (fp~[j0])))) R_GT eps0
                (eps1 R_PLUS eps2, (abs((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS abs((fp~[i0]) R_MINUS (fp~[j0]))), eps0)-->T678(Stat11*) ==> (eps1 R_PLUS eps2) R_GT eps0
                (eps1 R_PLUS eps2, eps0)-->T675(Stat11*) ==> (eps1 R_PLUS eps2) R_GE eps0
                (eps0, eps1 R_PLUS eps2, eps0)-->T677(Stat11*) ==> eps0 R_GT eps0
            (eps0,eps0)-->T675(Stat11*) ==> false; Discharge ==> AUTO
--
-- Since the inclusion just proves entails that the set on the left-hand side is finite,
-- we have reached a contradiction, proving that the pointwise sum of real Cauchy sequences
-- is an alike sequence.
--
	({(i*j): i in Za, j in Za | (abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps1) or (abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps2)}, { i * j : i in Za, j in Za | abs(((fq Res_PLUS fp)~[i]) R_MINUS ((fq Res_PLUS fp)~[j])) R_GT eps0 })-->T189(Stat11) ==> false; Discharge ==>
		(Res_ABS(fq) notin ReCauchy) or (Res_Rev(fq) notin ReCauchy)
--
-- Assuming next that $Res_ABS(fq)$ is not a Cauchy sequence (unlike $fq$),
-- there would exist a positive real $eps3$ for which the set
--	${ i * j : i in Za, j in Za | abs((Res_ABS(fq)~[i]) R_MINUS (Res_ABS(fq)~[j])) R_GT eps3 }$
-- is infinite, unlike the analogous set having $fq$ in place of $Res_ABS(fq)$.
-- However, this would lead to a conflict with the inequality (holding for all $i,j$)
--	$abs(Res_ABS(fq)~[i] R_MINUS Res_ABS(fq)~[j]) R_LE abs(fq~[i] Re_MINUS fq~[j])$.
--
        Suppose ==> Res_ABS(fq) notin ReCauchy
            Use_def(ReCauchy) ==> Stat18: Res_ABS(fq) notin {f in ReSeq | (FORALL eps in Re | (eps R_GT R_0) imp
		Finite({ i * j : i in Za, j in Za | abs((f~[i]) R_MINUS (f~[j])) R_GT eps }))}
            ()-->Stat18 ==> Stat19: not(FORALL eps in Re | (eps R_GT R_0) imp
		Finite({ i * j : i in Za, j in Za | abs((Res_ABS(fq)~[i]) R_MINUS (Res_ABS(fq)~[j])) R_GT eps }))
            eps3-->Stat19 ==> (eps3 in Re) & (eps3 R_GT R_0) & (not Finite({ i * j : i in Za, j in Za | abs((Res_ABS(fq)~[i]) R_MINUS (Res_ABS(fq)~[j])) R_GT eps3 }))
            eps3-->Stat4 ==> Finite({ i * j : i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps3 })
--
-- Indeed, since
--	${ i * j : i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps3 }$
-- is a superset of
--	${ i * j : i in Za, j in Za | abs(abs(fq~[i]) R_MINUS abs(fq~[j])) R_GT eps3 }$,
-- the latter cannot be infinite when the former is finite.
--
            Suppose ==> Stat20: not({ i * j : i in Za, j in Za | abs((Res_ABS(fq)~[i]) R_MINUS (Res_ABS(fq)~[j])) R_GT eps3 } incin { i * j : i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps3 })
                (i1,j1)-->Stat20 ==> Stat21: (i1 in Za) & (j1 in Za) & (abs((Res_ABS(fq)~[i1]) R_MINUS (Res_ABS(fq)~[j1])) R_GT eps3) & (not(abs((fq~[i1]) R_MINUS (fq~[j1])) R_GT eps3))
		(fq,fq,i1)-->T757(Stat3,Stat21*) ==> ((Res_ABS(fq)~[i1]) = abs(fq~[i1])) & (fq~[i1] in Re)
		(fq,fq,j1)-->T757(Stat3,Stat21*) ==> ((Res_ABS(fq)~[j1]) = abs(fq~[j1])) & (fq~[j1] in Re)
		EQUAL(Stat21) ==> abs(abs(fq~[i1]) R_MINUS abs(fq~[j1])) R_GT eps3
                (fq~[i1])-->T723 ==> abs(fq~[i1]) in Re
                (fq~[j1])-->T723 ==> abs(fq~[j1]) in Re
                ALGEBRA(Stat21) ==> (((fq~[i1]) R_MINUS (fq~[j1])) in Re) & ((abs(fq~[i1]) R_MINUS abs(fq~[j1])) in Re)
                ((fq~[i1]) R_MINUS (fq~[j1]))-->T723 ==> abs((fq~[i1]) R_MINUS (fq~[j1])) in Re
                (abs(fq~[i1]) R_MINUS abs(fq~[j1]))-->T723 ==> abs(abs(fq~[i1]) R_MINUS abs(fq~[j1])) in Re
                T722 ==> Stat22: (FORALL x,y | ((x in Re) & (y in Re)) imp (abs(abs(x) R_PLUS R_Rev(abs(y))) R_LE abs(x R_PLUS R_Rev(y))))
                (fq~[i1],fq~[j1])-->Stat22 ==> (abs(abs(fq~[i1]) R_PLUS R_Rev(abs(fq~[j1]))) R_LE abs((fq~[i1]) R_PLUS R_Rev(fq~[j1])))
		(abs(fq~[i1]),abs(fq~[j1]))-->T635(Stat21*) ==> abs(fq~[i1]) R_MINUS abs(fq~[j1]) = abs(fq~[i1]) R_PLUS R_Rev(abs(fq~[j1]))
		(fq~[i1],fq~[j1])-->T635(Stat20*) ==> (fq~[i1]) R_MINUS (fq~[j1]) = (fq~[i1]) R_PLUS R_Rev(fq~[j1])
                EQUAL(Stat22) ==> abs(abs(fq~[i1]) R_MINUS abs(fq~[j1])) R_LE abs((fq~[i1]) R_MINUS (fq~[j1]))
                (abs(abs(fq~[i1]) R_MINUS abs(fq~[j1])), abs((fq~[i1]) R_MINUS (fq~[j1])))-->T675 ==> abs((fq~[i1]) R_MINUS (fq~[j1])) R_GE abs(abs(fq~[i1]) R_MINUS abs(fq~[j1]))
            (abs((fq~[i1]) R_MINUS (fq~[j1])), abs(abs(fq~[i1]) R_MINUS abs(fq~[j1])), eps3)-->T678 ==> false; Discharge ==> { i * j : i in Za, j in Za | abs((Res_ABS(fq)~[i]) R_MINUS (Res_ABS(fq)~[j])) R_GT eps3 } incin { i * j : i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps3 }
        ({ i * j : i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps3 },  {i * j : i in Za, j in Za | abs((Res_ABS(fq)~[i]) R_MINUS (Res_ABS(fq)~[j])) R_GT eps3 })-->T189 ==> false; Discharge ==> Res_Rev(fq) notin ReCauchy
--
-- Third and last, let us assume that $Res_Rev(fq)$ is not a Cauchy sequence
-- (unlike $fq$). Then there would exist a positive real $eps4$ for which the set
--	${ i * j : i in Za, j in Za | abs(Res_Rev(fq)~[i] R_MINUS Res_Rev(fq)~[j]) R_GT eps4 }$
-- is infinite, unlike the analogous set having $fq$ in place of $Res_Rev(fq)$.
-- However, this would lead to a conflict with the equality (holding for all $i,j$)
--	$abs(Res_Rev(fq)~[i] R_MINUS Res_Rev(fq)~[j]) = abs(fq~[i] R_MINUS fq~[j])$.
--
            Use_def(ReCauchy) ==> Stat23: Res_Rev(fq) notin {f in ReSeq | (FORALL eps in Re | (eps R_GT R_0) imp
		Finite({ i * j : i in Za, j in Za | abs((f~[i]) R_MINUS (f~[j])) R_GT eps }))}
            ()-->Stat23 ==> Stat24: not(FORALL eps in Re | (eps R_GT R_0) imp
		Finite({ i * j : i in Za, j in Za | abs((Res_Rev(fq)~[i]) R_MINUS (Res_Rev(fq)~[j])) R_GT eps }))
            eps4-->Stat24 ==> Stat25: (eps4 in Re) & (eps4 R_GT R_0) & (not Finite({ i * j : i in Za, j in Za | abs((Res_Rev(fq)~[i]) R_MINUS (Res_Rev(fq)~[j])) R_GT eps4 }))
            eps4-->Stat4 ==> Finite({ i * j : i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps4 })
            EQUAL(Stat25) ==> Stat26: { i * j : i in Za, j in Za | abs((Res_Rev(fq)~[i]) R_MINUS (Res_Rev(fq)~[j])) R_GT eps4 } /= { i * j : i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps4 }
            (i2,j2)-->Stat26 ==> Stat27: (i2 in Za) & (j2 in Za) & ((abs((Res_Rev(fq)~[i2]) R_MINUS (Res_Rev(fq)~[j2])) R_GT eps4) eq (not(abs((fq~[i2]) R_MINUS (fq~[j2])) R_GT eps4)))
            (fq,fq,i2)-->T757(Stat3,Stat27*) ==> Stat28: ((Res_Rev(fq)~[i2]) = R_Rev(fq~[i2])) & (fq~[i2] in Re)
            (fq,fq,j2)-->T757(Stat3,Stat27*) ==> ((Res_Rev(fq)~[j2]) = R_Rev(fq~[j2])) & (fq~[j2] in Re)
            EQUAL(Stat26) ==> Stat29: ((abs(R_Rev(fq~[i2]) R_MINUS R_Rev(fq~[j2])) R_GT eps4) eq (not(abs((fq~[i2]) R_MINUS (fq~[j2])) R_GT eps4)))
            Suppose ==> abs(R_Rev(fq~[i2]) R_MINUS R_Rev(fq~[j2])) /= abs((fq~[i2]) R_MINUS (fq~[j2]))
		ALGEBRA(Stat28) ==> (abs(R_Rev(fq~[i2]) R_MINUS R_Rev(fq~[j2])) = abs(R_Rev(fq~[i2]) R_PLUS R_Rev(R_Rev(fq~[j2])))) &
				(((fq~[j2]) R_PLUS R_Rev(fq~[i2])) in Re) &
				(((fq~[i2]) R_PLUS R_Rev(fq~[j2])) = ((fq~[i2]) R_MINUS (fq~[j2]))) &
				((R_Rev(fq~[i2]) R_MINUS R_Rev(fq~[j2])) = ((fq~[j2]) R_PLUS R_Rev(fq~[i2]))) &
				(R_Rev((fq~[j2]) R_PLUS R_Rev(fq~[i2])) = ((fq~[i2]) R_MINUS (fq~[j2])))
                T722 ==> Stat30: (FORALL x | (x in Re) imp (abs(R_Rev(x)) = abs(x)))
                ((fq~[j2]) R_PLUS R_Rev(fq~[i2]))-->Stat30 ==> abs(R_Rev((fq~[j2]) R_PLUS R_Rev(fq~[i2]))) = abs((fq~[j2]) R_PLUS R_Rev(fq~[i2]))
            EQUAL(Stat29) ==> false; Discharge ==> Stat31: abs(R_Rev(fq~[i2]) R_MINUS R_Rev(fq~[j2])) = abs((fq~[i2]) R_MINUS (fq~[j2]))
            Suppose ==> abs(R_Rev(fq~[i2]) R_MINUS R_Rev(fq~[j2])) R_GT eps4
                EQUAL(Stat31) ==> abs((fq~[i2]) R_MINUS (fq~[j2])) R_GT eps4
            (Stat29)Discharge ==> not(abs(R_Rev(fq~[i2]) R_MINUS R_Rev(fq~[j2])) R_GT eps4)
            EQUAL(Stat31) ==> not(abs((fq~[i2]) R_MINUS (fq~[j2])) R_GT eps4)
    (Stat29)Discharge ==> QED
--
-- For every Cauchy sequence $f$, there is a subscript $k$ past which the
-- distance between any two images $f~[i],f~[j]$ is no larger than any fixed
-- positive rational.
--
Theorem 759: ((Eps in Re) & (Eps R_GT R_0) & (F in ReCauchy)) imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (not (abs((F~[i]) R_MINUS (F~[j]))) R_GT Eps))). Proof+:
Suppose_not(eps,f) ==> AUTO
	Use_def(ReCauchy) ==> Stat1: (f in {g: g in ReSeq | (FORALL eps in Re | (eps R_GT R_0) imp
		Finite({ i * j : i in Za, j in Za | abs((g~[i]) R_MINUS (g~[j])) R_GT eps }))}) &
		(eps in Re) & (eps R_GT R_0) &
		Stat2: (not(EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (not (abs((F~[i]) R_MINUS (F~[j]))) R_GT eps))))
	g-->Stat1(Stat1*) ==> (f = g) & (g in ReSeq) & (FORALL eps1 in Re | (eps1 R_GT R_0) imp
		Finite({ i * j : i in Za, j in Za | abs((g~[i]) R_MINUS (g~[j])) R_GT eps1 }))
	EQUAL ==> Stat3: (FORALL eps1 in Re | (eps1 R_GT R_0) imp
		Finite({ i * j : i in Za, j in Za | abs((f~[i]) R_MINUS (f~[j])) R_GT eps1 }))
	eps-->Stat3(Stat1*) ==> Finite({ i * j : i in Za, j in Za | abs((f~[i]) R_MINUS (f~[j])) R_GT eps })
	APPLY() cauchyseq_lemma2(R(i,j)->(abs((f~[i]) R_MINUS (f~[j])) R_GT eps)) ==>
		Stat4: (EXISTS k in Za | (FORALL i in Za, j in Za | (((i incs k) & (j incs k)) imp (not(abs((f~[i]) R_MINUS (f~[j])) R_GT eps)))))
	k-->Stat4(Stat4*) ==> (k in Za) & Stat5: (FORALL i in Za, j in Za | ((i incs k) & (j incs k)) imp (not(abs((f~[i]) R_MINUS (f~[j])) R_GT eps)))
	k-->Stat2(Stat4*) ==> Stat6: not (FORALL i in Za, j in Za | (((i notin k) & (j notin k)) imp (not (abs((f~[i]) R_MINUS (f~[j]))) R_GT eps)))
	(i,j)-->Stat6(Stat6*) ==> Stat7: (i in Za) & (j in Za) & (i notin k) & (j notin k) & (abs((f~[i]) R_MINUS (f~[j])) R_GT eps)
	(i,j)-->Stat5(Stat3*) ==> ((i incs k) & (j incs k)) imp (not(abs((f~[i]) R_MINUS (f~[j])) R_GT eps))
	(Stat7*)ELEM ==> (not((i incs k) & (j incs k)))
	T206(*) ==> Ord(Za) & Ord(i) & Ord(j) & Ord(k)
	(k,i)-->T35(*) ==> (i incs k)
	(k,j)-->T35(*) ==> false; Discharge ==> QED
--
-- It is easily seen that the preceding assertion can be reformulated to assert that
-- there is a subscript $k$ past which the
-- distance between any two images $f~[i],f~[j]$ is smaller than any fixed
-- positive rational.
--
Theorem 760: ((Eps in Re) & (Eps R_GT R_0) & (F in ReCauchy)) imp (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (Eps R_GT (abs((F~[i]) R_MINUS (F~[j])))) )). Proof:
Suppose_not(eps,f) ==> (f in ReCauchy) & (eps in Re) & (eps R_GT R_0) & Stat1: (not(EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (eps R_GT (abs((f~[i]) R_MINUS (f~[j])))) )))
	eps-->T720 ==> Stat2: (EXISTS eps0 in Re | ((eps R_GT eps0) & (eps0 R_GT R_0)))
	eps0-->Stat2 ==> (eps0 in Re) & (eps R_GT eps0) & (eps0 R_GT R_0)
	(eps0,f)-->T759 ==> Stat3: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (not (abs((f~[i]) R_MINUS (f~[j])) R_GT eps0))))
	k-->Stat3 ==> (k in Za) & Stat4: (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (not (abs((f~[i]) R_MINUS (f~[j])) R_GT eps0)))
	k-->Stat1 ==> Stat5: not(FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (eps R_GT (abs((f~[i]) R_MINUS (f~[j])))))
--
-- Thus we have a positive $eps0$ smaller than $eps$, and a $k$ such that $abs((f~[i]) R_MINUS (f~[j]))$ is no larger than $eps0$
-- if $i$ and $j$ are both larger than $k$.
--
	(i,j)-->Stat5 ==> (i in Za) & (j in Za) & (i notin k) & (j notin k) & (not(eps R_GT (abs((f~[i]) R_MINUS (f~[j])))))
	(i,j)-->Stat4 ==> not(abs((f~[i]) R_MINUS (f~[j])) R_GT eps0)
	T754(*) ==> f in ReSeq
	(f,i)-->T755 ==> f~[i] in Re
	(f,j)-->T755 ==> f~[j] in Re
	ALGEBRA ==> (f~[i]) R_MINUS (f~[j]) in Re
	((f~[i]) R_MINUS (f~[j]))-->T723 ==> abs((f~[i]) R_MINUS (f~[j])) in Re
	(abs((f~[i]) R_MINUS (f~[j])),eps0)-->T669 ==> (eps0 R_GT abs((f~[i]) R_MINUS (f~[j]))) or (eps0 = abs((f~[i]) R_MINUS (f~[j])))
	(eps0,abs((f~[i]) R_MINUS (f~[j])))-->T680 ==> eps0 R_GE (abs((f~[i]) R_MINUS (f~[j])))
	(eps,eps0,abs((f~[i]) R_MINUS (f~[j])))-->T677 ==> eps R_GT abs((f~[i]) R_MINUS (f~[j]))
	Discharge ==> QED
--
-- Every finite set of reals has an upper bound.
--
Theorem 761: ((S incin Re) & Finite(S)) imp (EXISTS u in Re | (FORALL y in S | u R_GE y)). Proof:
	Suppose_not(s) ==> Stat1: (s incin Re) & Finite(s) & Stat2: (not(EXISTS u in Re | (FORALL y in s | u R_GE y)))
--
-- For, assuming the contrary of our thesis to hold for a subset $s$ of $Re$, it is trivial that
-- $s$ is non-void (because $Re$ is non-void).
--
		Suppose ==> s = 0
			ALGEBRA ==> R_0 in Re
			R_0--> Stat2 ==> Stat3: not(FORALL y in s | R_0 R_GE y)
		y0-->Stat3 ==> false; Discharge ==> Stat4: s /= 0
		s-->T0(Stat4*) ==> arb(s) in s
--
-- But then, we can exploit one of the clauses of Theorem 690 to draw the desired contradiction.
--
		T690 ==> Stat5: (FORALL t, x | (Finite(t) & (x in t) & (t incin Re)) imp ((max_Re(t) in t) & ((x = max_Re(t)) or (x R_LT max_Re(t)))))
		(s,arb(s))-->Stat5(Stat1*) ==> max_Re(s) in Re
		(max_Re(s))-->Stat2(Stat5*) ==> Stat6: not(FORALL y in s | max_Re(s) R_GE y)
		y1-->Stat6(Stat6*) ==> (y1 in s) & (not(max_Re(s) R_GE y1))
		(s,y1)-->Stat5(Stat1*) ==> (y1 = max_Re(s)) or (y1 R_LT max_Re(s))
		(y1,max_Re(s))-->T675(Stat6*) ==> (y1 = max_Re(s)) or (max_Re(s) R_GT y1)
	(max_Re(s),y1)-->T680(Stat1*) ==> false; Discharge ==> QED
--
-- Every real Cauchy sequence has an upper bound.
--
Theorem 762: [Every real Cauchy sequence has an upper bound] (F in ReCauchy) imp (EXISTS x in Re | (FORALL y in range(F) | y R_LE x)). Proof+:
Suppose_not(f) ==> (f in ReCauchy) & Stat1: (not(EXISTS x in Re | (FORALL y in range(f) | y R_LE x) ))
--
-- For let $f$ be a counterexample to our assertion, i.e. a  Cauchy sequence having no upper bound.
-- Let $i0$ be an unsigned integer past which the distance between any two components of $f$ is
-- always smaller than $R_1$. Since $i0$ is a finite set and $f$ a single-valued map, the range
-- of $f$ on $i0$ must also be finite.
--
	T754(*) ==> Stat1a: f in ReSeq
	f-->T755 ==> Stat2: (domain(f) = Za) & Svm(f) & (range(f) incin Re)
	ALGEBRA ==> (R_1 in Re) & (R_0 in Re)
	T693 ==> R_1 R_GT R_0
	(R_1,f)-->T760 ==> Stat3: (EXISTS k in Za | (FORALL i in Za, j in Za | ((i notin k) & (j notin k)) imp (R_1 R_GT abs((f~[i]) R_MINUS (f~[j]))) ))
	i0-->Stat3 ==> Stat3a: (i0 in Za) & Stat4: (FORALL i in Za, j in Za | ((i notin i0) & (j notin i0)) imp (R_1 R_GT abs((f~[i]) R_MINUS (f~[j]))) )
	T206 ==> Ord(Za)
	(Za,i0)-->T13 ==> (i0 incin Za) & Finite(i0)
	(f,i0)-->T80 ==> Stat5: range(f ON i0) incin Re
	(f,i0)-->T57 ==> Svm(f ON i0)
	(f,i0)-->T94 ==> Stat6: domain(f ON i0) = i0
	EQUAL ==> Finite(domain(f ON i0))
	(f ON i0)-->T192 ==> Stat7: Finite(range(f ON i0))
	(f,i0)-->T126 ==> Stat8: range(f ON i0) = {f~[i]: i in domain(f ON i0)}
	EQUAL(Stat6,Stat8) ==> Stat9: (range(f ON i0) = {f~[i]: i in i0})
	EQUAL(Stat7,Stat5,Stat9) ==> Stat10: Finite({f~[i]: i in i0}) & ({f~[i]: i in i0} incin Re)
	(f,f,i0)-->T757(Stat1a,Stat3a*) ==> Stat10a: f~[i0] in Re
	ALGEBRA(Stat10a) ==> Stat12: (R_Rev(f~[i0]) in Re) & ((f~[i0] R_PLUS R_1) in Re) &
		((R_1 R_PLUS (f~[i0])) in Re) & (R_1 R_PLUS (f~[i0]) = (f~[i0]) R_PLUS R_1)
	(f~[i0] R_PLUS R_1)-->T201(*) ==> Stat11: Finite({f~[i0] R_PLUS R_1})
--
-- It is easily seen that $f~[i0] R_PLUS R_1$ is an upper bound for the set $f~[j]$ of components of $f$ for which $j notin i0$.
-- Indeed, let $j$ be a counterexample to this assertion, i.e. $j notin i0$ and $not((f~[i0] R_PLUS R_1) R_GT f~[j])$.
-- But since $R_1 R_GT ((f~[j]) R_PLUS R_Rev(f~[i0]))$ we must have $f~[i0] R_PLUS R_1 R_GT f~[j]$,
-- a contradiction proving our claim.
--
	Suppose ==> Stat13: (EXISTS j in Za | ((j notin i0) & (not(((f~[i0]) R_PLUS R_1) R_GT (f~[j])))))
		j-->Stat13 ==> Stat14: (j in Za) & (j notin i0) & Stat15: (not(((f~[i0]) R_PLUS R_1) R_GT (f~[j])))
		(j,i0)-->Stat4 ==> R_1 R_GT abs((f~[j]) R_MINUS (f~[i0]))
		j-->T71(Stat14,Stat2) ==> Stat16: f~[j] in Re
		ALGEBRA(Stat10a,Stat16) ==> ((f~[j]) R_PLUS R_Rev(f~[i0])) in Re
		(f~[j],f~[i0])-->T635(Stat10a,Stat16*) ==> ((f~[j]) R_MINUS (f~[i0])) = ((f~[j]) R_PLUS R_Rev(f~[i0]))
		EQUAL(Stat14) ==> R_1 R_GT abs((f~[j]) R_PLUS R_Rev(f~[i0]))
		((f~[j]) R_PLUS R_Rev(f~[i0]))-->T723 ==> abs((f~[j]) R_PLUS R_Rev(f~[i0])) in Re
		((f~[j]) R_PLUS R_Rev(f~[i0]))-->T723 ==> abs((f~[j]) R_PLUS R_Rev(f~[i0])) R_GE ((f~[j]) R_PLUS R_Rev(f~[i0]))
		(R_1,abs((f~[j]) R_PLUS R_Rev(f~[i0])),((f~[j]) R_PLUS R_Rev(f~[i0])))-->T677 ==> R_1 R_GT ((f~[j]) R_PLUS R_Rev(f~[i0]))
		(f~[i0],f~[i0])-->T680 ==> (f~[i0]) R_GE (f~[i0])
		(R_1,(f~[j]) R_PLUS R_Rev(f~[i0]),f~[i0],f~[i0])-->T697 ==> (R_1 R_PLUS (f~[i0])) R_GT (((f~[j]) R_PLUS R_Rev(f~[i0])) R_PLUS (f~[i0]))
		ALGEBRA(Stat10a,Stat16) ==> ((((f~[j]) R_PLUS R_Rev(f~[i0])) R_PLUS (f~[i0])) = ((f~[j]) R_PLUS (R_Rev(f~[i0]) R_PLUS (f~[i0])))) &
			(R_Rev(f~[i0]) R_PLUS (f~[i0]) = R_0) & ((f~[j]) R_PLUS R_0 = (f~[j]))
	EQUAL(Stat12) ==> false; Discharge ==> Stat17: not (EXISTS j in Za | ((j notin i0) & (not(((f~[i0]) R_PLUS R_1) R_GT (f~[j])))))
--
-- By Theorem 761, the finite set
-- ${f~[i]: i in i0} + {f~[i0] R_PLUS R_1}$ of reals has an upper bound $r$.
--
	({f~[i]: i in i0},{f~[i0] R_PLUS R_1})-->T236(Stat10,Stat11) ==> Finite({f~[i]: i in i0} + {f~[i0] R_PLUS R_1})
	ELEM ==> ({f~[i]: i in i0} + {f~[i0] R_PLUS R_1}) incin Re
	({f~[i]: i in i0} + {f~[i0] R_PLUS R_1})-->T761 ==> Stat18: (EXISTS u in Re | (FORALL y in ({f~[i]: i in i0} + {f~[i0] R_PLUS R_1}) | u R_GE y))
	r-->Stat18 ==> Stat19: (r in Re) & Stat20: (FORALL y in ({f~[i]: i in i0} + {f~[i0] R_PLUS R_1}) | r R_GE y)
--
-- But it is easily seen that $r$ must also be an upper bound for the entire Cauchy sequence $f$,
-- proving our theorem.
--
	ELEM ==> (f~[i0] R_PLUS R_1) in {f~[i0] R_PLUS R_1}
	(f~[i0] R_PLUS R_1)-->Stat20 ==> Stat21: r R_GE (f~[i0] R_PLUS R_1)
	f-->T73 ==> range(f) = {f~[v]: v in domain(f)}
	EQUAL ==> range(f) = {f~[v]: v in Za}
	r-->Stat1 ==> Stat22: (r in Re) & (not (FORALL y in range(f) | y R_LE r))
	EQUAL(Stat12) ==> not(FORALL y in {f~[v]: v in Za} | y R_LE r)
	SIMPLF ==> Stat23: not (FORALL v in Za | f~[v] R_LE r)
	k-->Stat23 ==> Stat24: (k in Za) & (not((f~[k]) R_LE r))
	(f~[k],r)-->T675(Stat24) ==> Stat25: not(r R_GE (f~[k]))
	k-->T71(Stat2,Stat24) ==> Stat26: ((f~[k]) in Re) & Stat27: ((f~[k]) in range(f))
	(f~[k])-->Stat20 ==> Stat28: not((f~[k]) in {f~[i]: i in i0})
	k-->Stat28 ==> k notin i0
	k-->Stat17 ==> Stat29: ((f~[i0]) R_PLUS R_1) R_GT (f~[k])
	((f~[i0]) R_PLUS R_1,f~[k])-->T680 ==> Stat30: ((f~[i0]) R_PLUS R_1) R_GE (f~[k])
	(r,(f~[i0]) R_PLUS R_1,f~[k])-->T668(Stat22,Stat12,Stat26,Stat30,Stat21) ==> Stat31: r R_GE (f~[k])
	(Stat25,Stat31*)Discharge ==> QED
--
-- As an immediate corollary, every Cauchy sequence has an upper bound
-- for the absolute values of its components.
--
Theorem 763: (F in ReCauchy) imp (EXISTS x in Re | (FORALL y in range(F) | abs(y) R_LT x )). Proof:
    Suppose_not(f) ==> (f in ReCauchy) & Stat1: (not(EXISTS x in Re | (FORALL y in range(f) | abs(y) R_LT x) ))
        T754(*) ==> f in ReSeq
        f-->T755 ==> (domain(f) = Za) & Svm(f) & (range(f) incin Re)
        (f,f)-->T758 ==> Res_ABS(f) in ReCauchy
        (f,f)-->T756 ==> Res_ABS(f) = {[u, abs(f~[u])]: u in Za}
        (Res_ABS(f))-->T762 ==> Stat2: (EXISTS x in Re | (FORALL y in range(Res_ABS(f)) | y R_LE x ))
        c-->Stat2 ==> (c in Re) & Stat3: (FORALL y in range(Res_ABS(f)) | y R_LE c )
        ALGEBRA ==> (R_0 in Re) & (R_1 in Re) & ((c R_PLUS R_1) in Re)
        (c R_PLUS R_1)-->Stat1 ==> Stat4: not(FORALL y in range(f) | abs(y) R_LT (c R_PLUS R_1))
        d-->Stat4 ==> (d in range(f)) & (not(abs(d) R_LT (c R_PLUS R_1)))
        Suppose ==> abs(d) notin range(Res_ABS(f))
            f-->T73 ==> Stat5: d in {f~[x]: x in domain(f)}
            a-->Stat5 ==> (d = f~[a]) & (a in Za)
            TELEM ==> range({[u, abs(f~[u])]: u in Za}) = {abs(f~[u]): u in Za}
            EQUAL ==> (range(Res_ABS(f)) = {abs(f~[u]): u in Za}) & (abs(d) = abs(f~[a]))
            ELEM ==> Stat6: abs(d) notin {abs(f~[u]): u in Za}
        a-->Stat6 ==> false; Discharge ==> abs(d) in range(Res_ABS(f))
        (abs(d))-->Stat3 ==> abs(d) R_LE c
        (abs(d),c)-->T675 ==> c R_GE abs(d)
        T693 ==> R_1 R_GT R_0
        d-->T723 ==> abs(d) in Re
        (c,abs(d),R_1,R_0)-->T696 ==> (c R_PLUS R_1) R_GT (abs(d) R_PLUS R_0)
        ALGEBRA ==> (abs(d) R_PLUS R_0) = abs(d)
        EQUAL ==> (c R_PLUS R_1) R_GT abs(d)
    (abs(d),c R_PLUS R_1)-->T675 ==> false; Discharge ==> QED
--
--
--
Theorem 764: ({F,G} incin ReCauchy) imp (((F Res_MINUS G) in ReCauchy) & ((F Res_TIMES G) in ReCauchy)). Proof:
Suppose_not(fq,fp) ==> AUTO
--
-- Reasoning by contradiction, assume that $fq,fp$ form a counterexample
-- to the desired statement. We readily discard the possibility that
-- $(fq Res_MINUS fp) notin ReCauchy$. Only the possibility that
-- $(fq Res_TIMES fp) notin ReCauchy$ must be analyzed in detail, and
-- we will reach a contradiction in this case also.
--
	Suppose ==> Stat1: (fq Res_MINUS fp) notin ReCauchy
		Use_def(Res_MINUS)(Stat1*) ==> (fq Res_PLUS Res_Rev(fp)) notin ReCauchy
		(fp,fp)-->T758(*) ==> Res_Rev(fp) in ReCauchy
	(fq,Res_Rev(fp))-->T758(*) ==> false; Discharge ==> Stat2: ({fp,fq} incin ReCauchy) &
		((fq Res_TIMES fp) notin ReCauchy)
--
-- Assuming that $fq Res_TIMES fp$ is not a Cauchy sequence (unlike
-- $fq$ and $fp$), there would exist a positive real $eps0$ for which
-- the set
--	${ i * j : i in Za, j in Za | abs(((fq Res_TIMES fp)~[i]) R_MINUS ((fq Res_TIMES fp)~[j])) R_GT eps0 }$
-- is infinite, unlike the analogous sets which have $fp$ and $fq$, respectively,
-- in place of $fq Res_TIMES fp$ and have, in place of $eps0$, positive reals
-- $eps1$ and $eps2$ smaller than one half of $eps0 R_OVER m$, where $m$ is chosen
-- to be larger than the absolute value of any component of $fq$ and of any component
-- of $fp$.
--
	Use_def(ReCauchy)(Stat2*) ==> Stat3: (fq Res_TIMES fp) notin {f in ReSeq | (FORALL eps in Re | (eps R_GT R_0) imp
	  Finite({ i * j : i in Za, j in Za | abs((f~[i]) R_MINUS (f~[j])) R_GT eps }))} &
			Stat4: fq in {f in ReSeq | (FORALL eps in Re | (eps R_GT R_0) imp
	  Finite({ i * j : i in Za, j in Za | abs((f~[i]) R_MINUS (f~[j])) R_GT eps }))} &
			Stat5: fp in {f in ReSeq | (FORALL eps in Re | (eps R_GT R_0) imp
				Finite({ i * j : i in Za, j in Za | abs((f~[i]) R_MINUS (f~[j])) R_GT eps }))}
	()-->Stat4(Stat3*) ==> Stat6: (fq in ReSeq) & Stat7: (FORALL eps in Re | (eps R_GT R_0) imp
			Finite({ i * j : i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps }))
	()-->Stat5(Stat3*) ==> Stat8: (fp in ReSeq) & Stat9: (FORALL eps in Re | (eps R_GT R_0) imp
			Finite({ i * j : i in Za, j in Za | abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps }))
	fq-->T755(Stat6,Stat6*) ==> Stat10: (domain(fq) = Za) & Svm(fq) & (range(fq) incin Re)
	fp-->T755(Stat8,Stat8*) ==> Stat11: (domain(fp) = Za) & Svm(fp) & (range(fp) incin Re)
	(fq,fp)-->T756(Stat6*) ==> Stat12: ((fq Res_TIMES fp) in ReSeq) &
			Stat13: ((fq Res_TIMES fp) = {[u,((fq~[u]) R_TIMES (fp~[u]))]: u in Za})
	()-->Stat3(Stat3*) ==> Stat14: not(FORALL eps in Re | (eps R_GT R_0) imp
			Finite({ i * j : i in Za, j in Za | abs(((fq Res_TIMES fp)~[i]) R_MINUS ((fq Res_TIMES fp)~[j])) R_GT eps }))
	eps0-->Stat14(Stat14*) ==> Stat15: (eps0 in Re) & (eps0 R_GT R_0) & (not(
			Finite({ i * j : i in Za, j in Za | abs(((fq Res_TIMES fp)~[i]) R_MINUS ((fq Res_TIMES fp)~[j])) R_GT eps0 })))
	fq-->T763(Stat2,Stat2*) ==> Stat16: (EXISTS x in Re | (FORALL y in range(fq) | abs(y) R_LT x ))
	mq-->Stat16(Stat16*) ==> (mq in Re) & Stat17: (FORALL y in range(fq) | abs(y) R_LT mq )
	fp-->T763(Stat2,Stat2*) ==> Stat18: (EXISTS x in Re | (FORALL y in range(fp) | abs(y) R_LT x ))
	mp-->Stat18(Stat18*) ==> (mp in Re) & Stat19: (FORALL y in range(fp) | abs(y) R_LT mp )
	Loc_def ==> m = if (mq R_GT mp) then mq else mp end if
	(Stat16*)ELEM ==> Stat20: m in Re
	Suppose ==> Stat21: not(FORALL y in range(fq) | abs(y) R_LT m)
		y1-->Stat21(Stat21*) ==> (y1 in range(fq)) & (not(abs(y1) R_LT m))
		y1-->Stat17(Stat16*) ==> abs(y1) R_LT mq
		Suppose ==> m = mq
		EQUAL(Stat21) ==> false; Discharge ==> m /= mq
		(Stat18)ELEM ==> not(mq R_GT mp)
		(mq,mp)-->T675(Stat16*) ==> (mp R_GE mq) & (m = mp)
		y1-->T723(Stat10*) ==> abs(y1) in Re
		(abs(y1),mq)-->T675(Stat16*) ==> mq R_GT abs(y1)
		(mp,mq,abs(y1))-->T678(Stat16*) ==> mp R_GT abs(y1)
		EQUAL(Stat21) ==> m R_GT abs(y1)
	(abs(y1),m)-->T675(Stat20*) ==> false; Discharge ==> Stat22: (FORALL y in range(fq) | abs(y) R_LT m)
	Suppose ==> Stat23: not(FORALL y in range(fp) | abs(y) R_LT m)
		y2-->Stat23(Stat23*) ==> (y2 in range(fp)) &  (not(abs(y2) R_LT m))
		y2-->Stat19(Stat18*) ==> abs(y2) R_LT mp
		Suppose ==> m = mp
		EQUAL(Stat23) ==> false; Discharge ==> m /= mp
		ELEM ==> (mq R_GT mp) & (m = mq)
		y2-->T723(Stat11*) ==> abs(y2) in Re
		(abs(y2),mp)-->T675(Stat18*) ==> mp R_GT abs(y2)
		(mq,mp,abs(y2))-->T679(Stat16*) ==> mq R_GT abs(y2)
		EQUAL(Stat23) ==> m R_GT abs(y2)
	(abs(y2),m)-->T675(Stat20*) ==> false; Discharge ==> Stat24: (FORALL y in range(fp) | abs(y) R_LT m )
	ALGEBRA(Stat24) ==> (R_0 in Re)
	Suppose ==> not(m R_GT R_0)
		ALGEBRA(Stat10,Stat10) ==> Stat25: 0 in domain(fq)
		(0,fq)-->T71(Stat2,Stat10,Stat25*) ==> Stat26: (fq~[0]) in range(fq)
		(fq~[0])-->Stat22(Stat26*) ==> abs(fq~[0]) R_LT m
		(fq~[0])-->T723(Stat10,Stat26*) ==> (abs(fq~[0]) R_GE R_0) & (abs(fq~[0]) in Re)
		(abs(fq~[0]), m)-->T675(Stat26*) ==> m R_GT abs(fq~[0])
	(m, abs(fq~[0]), R_0)-->T677(Stat2*) ==> false; Discharge ==> AUTO
	(m, R_0)-->T675(Stat2*) ==> m /= R_0
	m-->T647(Stat2*) ==> Stat27: (R_Recip(m) in Re) & ((R_Recip(m) R_TIMES m) = R_1)
	ALGEBRA(Stat20,Stat15,Stat27) ==> (R_0 = (R_0 R_PLUS R_0)) &
		((eps0 R_TIMES R_Recip(m)) in Re) &
		((R_0 R_TIMES R_Recip(m)) = (R_Recip(m) R_TIMES R_0)) &
		((R_Recip(m) R_TIMES m) = (m R_TIMES R_Recip(m)))
	m-->T709(Stat2*) ==> R_Recip(m) R_GT R_0
	(eps0, R_0, R_Recip(m))-->T705(Stat2*) ==> (eps0 R_TIMES R_Recip(m)) R_GT (R_0 R_TIMES R_Recip(m))
	ALGEBRA(Stat27) ==> (R_Recip(m) R_TIMES R_0) = R_0
	EQUAL(Stat2) ==> (eps0 R_TIMES R_Recip(m)) R_GT R_0
	(eps0 R_TIMES R_Recip(m))-->T719(Stat2*) ==> Stat28: (EXISTS e in Re, e0 in Re | ((eps0 R_TIMES R_Recip(m)) R_GT e) & (e R_GT e0) & (e0 R_GT R_0) & (e R_GT R_0) & ((eps0 R_TIMES R_Recip(m)) R_GT (e R_PLUS e0)))
	(eps1,eps2)-->Stat28 ==> Stat29: (eps1 in Re) & (eps2 in Re) & (eps2 R_GT R_0) & (eps1 R_GT R_0) & ((eps0 R_TIMES R_Recip(m)) R_GT (eps1 R_PLUS eps2))
	(eps1,R_0)-->T675(Stat2*) ==> (eps1 R_GE R_0)
	(eps1,R_0,eps2,R_0)-->T696(Stat2*) ==> (eps1 R_PLUS eps2) R_GT (R_0 R_PLUS R_0)
	EQUAL(Stat2) ==> (eps1 R_PLUS eps2) R_GT R_0
	m-->T709(Stat2*) ==> R_Recip(m) R_GT R_0
	ALGEBRA(Stat29,Stat20,Stat15,Stat27) ==> ((eps1 R_PLUS eps2) in Re) &
		(((eps0 R_TIMES R_Recip(m)) R_TIMES m) = (eps0 R_TIMES (m R_TIMES R_Recip(m)))) &
		(((eps1 R_PLUS eps2) R_TIMES m) = (m R_TIMES (eps1 R_PLUS eps2))) &
		((eps0 R_TIMES R_1) = eps0)
	(eps0 R_TIMES R_Recip(m), eps1 R_PLUS eps2, m)-->T705(Stat2*) ==> ((eps0 R_TIMES R_Recip(m)) R_TIMES m) R_GT ((eps1 R_PLUS eps2) R_TIMES m)
	EQUAL(Stat2) ==> eps0 R_GT (m R_TIMES (eps1 R_PLUS eps2))
--
	eps2-->Stat7 ==> Stat30: Finite({ (i * j) : i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps2 })
	eps1-->Stat9 ==> Stat31: Finite({ (i * j) : i in Za, j in Za | abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps1 })
--
-- However, this assumption would lead to a conflict with the inequality (holding for all $i,j in Za$)
--	$abs((fq Res_TIMES fp)~[i] R_MINUS (fq Res_TIMES fp)~[j]) R_LE (m R_TIMES abs((fq~[i] R_MINUS fq~[j]) R_PLUS (fp~[i] R_MINUS fp~[j])))$,
-- as we are about to show.
--
	APPLY() setformer_meet_join(s->Za, t->Za, h(i,j)->(i*j), R(i,j)->(abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps2), Q(i,j)->(abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps1)) ==>
			Stat32: {(i*j): i in Za, j in Za | (abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps2) or (abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps1)} = ({(i*j): i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps2 } + {(i*j): i in Za, j in Za | abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps1 })
	({ i * j : i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps2 }, { i * j : i in Za, j in Za | abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps1 })-->T236(Stat30,Stat31*) ==>
			Finite({(i*j): i in Za, j in Za | abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps2 } + {(i*j): i in Za, j in Za | abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps1 })
 	EQUAL(Stat32) ==> Finite({(i*j): i in Za, j in Za | (abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps2) or (abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps1)})
	Suppose ==> Stat33: not({(i * j): i in Za, j in Za | abs(((fq Res_TIMES fp)~[i]) R_MINUS ((fq Res_TIMES fp)~[j])) R_GT eps0 } incin {(i*j): i in Za, j in Za | (abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps2) or (abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps1)})
--
-- If we make the temporary assumption that
--	$not({(i * j): i in Za, j in Za | abs(((fq Res_TIMES fp)~[i]) R_MINUS ((fq Res_TIMES fp)~[j])) R_GT eps0 } incin {(i*j): i in Za, j in Za | (abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps2) or (abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps1)})$,
-- then, by proving the above-stated inequality, we reach a contradiction as follows.
-- In the first place, observe that if $i0,j0$ are unsigned integers for which $i0*j0$
-- belongs to the set appearing as left-hand side but does not belong to the right-hand side then
--	$abs((((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0])))) R_GT eps0$,
--	$(abs((fp~[i0]) R_MINUS (fp~[j0])) R_LE eps1) & (abs((fq~[i0]) R_MINUS (fq~[j0])) R_LE eps2)$.
--
		(i0,j0)-->Stat33 ==> Stat34: (i0 in Za) & (j0 in Za) & (abs(((fq Res_TIMES fp)~[i0]) R_MINUS ((fq Res_TIMES fp)~[j0])) R_GT eps0) & (not(abs((fq~[i0]) R_MINUS (fq~[j0])) R_GT eps2)) & (not(abs((fp~[i0]) R_MINUS (fp~[j0])) R_GT eps1))
		APPLY() fcn_symbol(f(u)->((fq~[u]) R_TIMES (fp~[u])), g->(fq Res_TIMES fp), s->Za) ==>
			Stat35: (FORALL x | ((fq Res_TIMES fp)~[x]) = if x in Za then ((fq~[x]) R_TIMES (fp~[x])) else 0 end if)
		i0-->Stat35(Stat34*) ==> ((fq Res_TIMES fp)~[i0]) = ((fq~[i0]) R_TIMES (fp~[i0]))
		j0-->Stat35(Stat34*) ==> ((fq Res_TIMES fp)~[j0]) = ((fq~[j0]) R_TIMES (fp~[j0]))
		EQUAL(Stat33) ==> Stat36: abs((((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0])))) R_GT eps0
--
-- Secondly, we easily check that various quantities belong to $Re$.
--
		Suppose ==> (fq~[i0]) notin range(fq)
			fq-->T73(Stat10*) ==> Stat37: (fq~[i0]) notin {(fq~[j]): j in domain(fq)}
		i0-->Stat37(Stat10,Stat34*) ==> false; Discharge ==> Stat38: (fq~[i0]) in range(fq)
		Suppose ==> (fp~[j0]) notin range(fp)
			fp-->T73(Stat11*) ==> Stat39: (fp~[j0]) notin {(fp~[j]): j in domain(fp)}
		j0-->Stat39(Stat11,Stat34*) ==> false; Discharge ==> Stat40: (fp~[j0]) in range(fp)
		(fq,fp,i0)-->T757(Stat6,Stat8,Stat34*) ==> Stat41: ((fq~[i0]) in Re) & ((fp~[i0]) in Re)
		(fq,fp,j0)-->T757(Stat6,Stat8,Stat34*) ==> Stat42: ((fq~[j0]) in Re) & ((fp~[j0]) in Re)
		(fq~[i0])-->T723(Stat41*) ==> Stat43: abs(fq~[i0]) in Re
		ALGEBRA(Stat41,Stat42) ==> Stat44: (((fq~[i0]) R_MINUS (fq~[j0])) in Re)
		((fq~[i0]) R_MINUS (fq~[j0]))-->T723(Stat44*) ==> Stat45: (abs((fq~[i0]) R_MINUS (fq~[j0])) in Re) & (abs((fq~[i0]) R_MINUS (fq~[j0])) R_GE R_0)
		(fp~[j0])-->T723(Stat41*) ==> Stat46: abs(fp~[j0]) in Re
		ALGEBRA(Stat42,Stat41) ==> Stat47: ((fp~[i0]) R_MINUS (fp~[j0])) in Re
		((fp~[i0]) R_MINUS (fp~[j0]))-->T723(Stat41*) ==> Stat48: (abs((fp~[i0]) R_MINUS (fp~[j0])) in Re) & (abs((fp~[i0]) R_MINUS (fp~[j0])) R_GE R_0)
		ALGEBRA(Stat20,Stat29) ==> (m R_TIMES (eps1 R_PLUS eps2)) in Re
		ALGEBRA(Stat41,Stat42) ==> ((((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0]))) in Re) &
				(((fq~[i0]) R_TIMES ((fp~[i0]) R_MINUS (fp~[j0]))) in Re) &
				(((fp~[j0]) R_TIMES ((fq~[i0]) R_MINUS (fq~[j0]))) in Re)
		(((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0])))-->T723(Stat41*) ==> abs(((fq~[i0]) R_MINUS (fq~[j0])) R_PLUS ((fp~[i0]) R_MINUS (fp~[j0]))) in Re
		ALGEBRA(Stat48,Stat45,Stat46,Stat43) ==> ((abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))) in Re) &
				((abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) in Re) &
				((abs((fp~[i0]) R_MINUS (fp~[j0])) R_PLUS abs((fq~[i0]) R_MINUS (fq~[j0]))) in Re) &
				(((abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))) in Re)
		ALGEBRA(Stat41) ==> Stat49: ((R_Rev((fq~[i0]) R_TIMES (fp~[j0])) in Re) & ((((fq~[i0]) R_TIMES (fp~[j0])) R_PLUS R_Rev((fq~[i0]) R_TIMES (fp~[j0]))) = R_0)) &
				((((fq~[i0]) R_TIMES (fp~[i0])) R_PLUS (R_Rev((fq~[i0]) R_TIMES (fp~[j0])) R_PLUS ((fq~[i0]) R_TIMES (fp~[j0])))) = ((((fq~[i0]) R_TIMES (fp~[i0])) R_PLUS R_Rev((fq~[i0]) R_TIMES (fp~[j0]))) R_PLUS ((fq~[i0]) R_TIMES (fp~[j0]))))
		ALGEBRA(Stat41,Stat42) ==> Stat50: (((fq~[j0]) R_TIMES (fp~[j0])) = ((fp~[j0]) R_TIMES (fq~[j0]))) &
				((((fq~[i0]) R_TIMES (fp~[i0])) R_PLUS R_Rev((fq~[i0]) R_TIMES (fp~[j0])) R_PLUS ((fq~[i0]) R_TIMES (fp~[j0]))) R_PLUS R_Rev((fq~[j0]) R_TIMES (fp~[j0])) = (((fq~[i0]) R_TIMES (fp~[i0])) R_PLUS R_Rev((fq~[i0]) R_TIMES (fp~[j0]))) R_PLUS (((fq~[i0]) R_TIMES (fp~[j0])) R_PLUS R_Rev((fq~[j0]) R_TIMES (fp~[j0])))) &
				(((fq~[i0]) R_TIMES (fp~[i0])) in Re) &
				(((fq~[i0]) R_TIMES (fp~[j0])) in Re)
--
-- By exploiting some of the above membership relations, we easily get
--	$(eps1 R_PLUS eps2) R_GE (abs((fp~[i0]) R_MINUS (fp~[j0])) R_PLUS abs((fq~[i0]) R_MINUS (fq~[j0])))$,
-- and hence
--	$eps0 R_GT ((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))$.
--
		(abs((fp~[i0]) R_MINUS (fp~[j0])), eps1)-->T675(Stat29*) ==> eps1 R_GE abs((fp~[i0]) R_MINUS (fp~[j0]))
		(abs((fq~[i0]) R_MINUS (fq~[j0])), eps2)-->T675(Stat29*) ==> eps2 R_GE abs((fq~[i0]) R_MINUS (fq~[j0]))
		(eps1, abs((fp~[i0]) R_MINUS (fp~[j0])), eps2, abs((fq~[i0]) R_MINUS (fq~[j0])))-->T695(Stat29*) ==> (eps1 R_PLUS eps2) R_GE (abs((fp~[i0]) R_MINUS (fp~[j0])) R_PLUS abs((fq~[i0]) R_MINUS (fq~[j0])))
		Suppose ==> Stat51: not((m R_TIMES (eps1 R_PLUS eps2)) R_GE ((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))))
			ALGEBRA(Stat48,Stat45,Stat20) ==> (m R_TIMES (abs((fp~[i0]) R_MINUS (fp~[j0])) R_PLUS abs((fq~[i0]) R_MINUS (fq~[j0])))) = ((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))
			Suppose ==> (eps1 R_PLUS eps2) = (abs((fp~[i0]) R_MINUS (fp~[j0])) R_PLUS abs((fq~[i0]) R_MINUS (fq~[j0])))
				EQUAL(Stat51*) ==> (m R_TIMES (eps1 R_PLUS eps2)) = ((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))
			(((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))), (m R_TIMES (eps1 R_PLUS eps2)))-->T675(Stat41*) ==> false; Discharge ==> AUTO
			(eps1 R_PLUS eps2, abs((fp~[i0]) R_MINUS (fp~[j0])) R_PLUS abs((fq~[i0]) R_MINUS (fq~[j0])))-->T675(Stat41*) ==> (eps1 R_PLUS eps2) R_GT (abs((fp~[i0]) R_MINUS (fp~[j0])) R_PLUS abs((fq~[i0]) R_MINUS (fq~[j0])))
			(eps1 R_PLUS eps2, abs((fp~[i0]) R_MINUS (fp~[j0])) R_PLUS abs((fq~[i0]) R_MINUS (fq~[j0])), m)-->T705(Stat18*) ==> ((eps1 R_PLUS eps2) R_TIMES m) R_GT ((abs((fp~[i0]) R_MINUS (fp~[j0])) R_PLUS abs((fq~[i0]) R_MINUS (fq~[j0]))) R_TIMES m)
			ALGEBRA(Stat20,Stat29) ==> (m R_TIMES (eps1 R_PLUS eps2)) = ((eps1 R_PLUS eps2) R_TIMES m)
			ALGEBRA(Stat20,Stat48,Stat45) ==> ((abs((fp~[i0]) R_MINUS (fp~[j0])) R_PLUS abs((fq~[i0]) R_MINUS (fq~[j0]))) R_TIMES m) = (m R_TIMES (abs((fp~[i0]) R_MINUS (fp~[j0])) R_PLUS abs((fq~[i0]) R_MINUS (fq~[j0]))))
			EQUAL(Stat51*) ==> (m R_TIMES (eps1 R_PLUS eps2)) R_GT ((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))
		((m R_TIMES (eps1 R_PLUS eps2)), ((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))))-->T675(Stat51*) ==> false; Discharge ==> AUTO
		(Stat28*)ELEM ==> (m R_TIMES (eps1 R_PLUS eps2)) R_GE ((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))
		ALGEBRA(Stat20,Stat48,Stat45) ==> Stat52: ((m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))) in Re) &
				((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) in Re) &
				(((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))) in Re)
		(eps0, m R_TIMES (eps1 R_PLUS eps2), (m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))-->T677(Stat15*) ==> eps0 R_GT ((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))
		(eps0, (m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))-->T675(Stat42*) ==> Stat53: eps0 R_GE ((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))
--
-- As a consequence, $eps1 R_PLUS eps2$ is greater than or equal to
--	$abs(((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_MINUS (fp~[j0])))$,
-- because this quantity equals
--	$abs(((fq~[i0]) R_TIMES ((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS ((fp~[j0]) R_TIMES ((fq~[i0]) R_MINUS (fq~[j0]))))$,
--
		(abs((fq~[i0]) R_MINUS (fq~[j0])), eps2)-->T675(Stat35*) ==> eps2 R_GE abs((fq~[i0]) R_MINUS (fq~[j0]))
		(abs((fp~[i0]) R_MINUS (fp~[j0])), eps1)-->T675(Stat35*) ==> eps1 R_GE abs((fp~[i0]) R_MINUS (fp~[j0]))
		(eps1, abs((fp~[i0]) R_MINUS (fp~[j0])), eps2, abs((fq~[i0]) R_MINUS (fq~[j0])))-->T695(Stat35*) ==> Stat54: (eps1 R_PLUS eps2) R_GE (abs((fp~[i0]) R_MINUS (fp~[j0])) R_PLUS abs((fq~[i0]) R_MINUS (fq~[j0])))
		Suppose ==> Stat55: (((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0]))) /=
							(((fq~[i0]) R_TIMES ((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS ((fp~[j0]) R_TIMES ((fq~[i0]) R_MINUS (fq~[j0]))))
			ALGEBRA(Stat41,Stat42) ==> ((fq~[i0]) R_TIMES ((fp~[i0]) R_MINUS (fp~[j0])) = ((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[i0]) R_TIMES (fp~[j0]))) &
				((fp~[j0]) R_TIMES ((fq~[i0]) R_MINUS (fq~[j0])) = ((fq~[i0]) R_TIMES (fp~[j0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0]))) &
				((((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[i0]) R_TIMES (fp~[j0]))) = (((fq~[i0]) R_TIMES (fp~[i0])) R_PLUS R_Rev((fq~[i0]) R_TIMES (fp~[j0])))) &
				((((fq~[i0]) R_TIMES (fp~[i0])) R_PLUS R_Rev((fq~[i0]) R_TIMES (fp~[j0]))) R_PLUS (((fq~[i0]) R_TIMES (fp~[j0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0]))) = (((fq~[i0]) R_TIMES (fp~[i0])) R_PLUS (R_Rev((fq~[i0]) R_TIMES (fp~[j0])) R_PLUS ((fq~[i0]) R_TIMES (fp~[j0])))) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0]))) &
				((R_Rev((fq~[i0]) R_TIMES (fp~[j0])) R_PLUS ((fq~[i0]) R_TIMES (fp~[j0]))) = R_0) &
				((((fq~[i0]) R_TIMES (fp~[i0])) R_PLUS R_0) = ((fq~[i0]) R_TIMES (fp~[i0])))
		EQUAL(Stat55) ==> false; Discharge ==> AUTO
		(Stat54*)ELEM ==> Stat56: (((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0]))) =
							(((fq~[i0]) R_TIMES ((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS ((fp~[j0]) R_TIMES ((fq~[i0]) R_MINUS (fq~[j0]))))
		EQUAL(Stat56) ==> abs(((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0]))) =
							abs(((fq~[i0]) R_TIMES ((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS ((fp~[j0]) R_TIMES ((fq~[i0]) R_MINUS (fq~[j0]))))
-- ..., in its turn
--	$abs(((fq~[i0]) R_TIMES ((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS ((fp~[j0]) R_TIMES ((fq~[i0]) R_MINUS (fq~[j0]))))$
-- is smaller than or equal to
--	$((abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))$,
--
		T722(Stat57*) ==> Stat57: (FORALL x,y | ((x in Re) & (y in Re)) imp (abs(x R_PLUS y) R_LE (abs(x) R_PLUS abs(y))))
		(((fq~[i0]) R_TIMES ((fp~[i0]) R_MINUS (fp~[j0]))), ((fp~[j0]) R_TIMES ((fq~[i0]) R_MINUS (fq~[j0]))))-->Stat57(Stat35*) ==>
					abs(((fq~[i0]) R_TIMES ((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS ((fp~[j0]) R_TIMES ((fq~[i0]) R_MINUS (fq~[j0])))) R_LE (abs((fq~[i0]) R_TIMES ((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS abs((fp~[j0]) R_TIMES ((fq~[i0]) R_MINUS (fq~[j0]))))
		(fq~[i0], (fp~[i0]) R_MINUS (fp~[j0]))-->T726(Stat41,Stat47*) ==> abs((fq~[i0]) R_TIMES ((fp~[i0]) R_MINUS (fp~[j0]))) = (abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0])))
		(fp~[j0], (fq~[i0]) R_MINUS (fq~[j0]))-->T726(Stat42,Stat44*) ==> abs((fp~[j0]) R_TIMES ((fq~[i0]) R_MINUS (fq~[j0]))) = (abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))
		EQUAL(Stat56) ==> abs(((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0]))) R_LE ((abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))
		(abs(((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0]))), ((abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))))-->T675(Stat35*) ==> ((abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))) R_GE abs(((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0])))
--
-- ... which in its turn is smaller than or equal to
--	$(m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))$,
--
		ALGEBRA(Stat20,Stat20) ==> Stat58: m R_TIMES R_0 = R_0
		Suppose ==> not((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_GE (abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))))
			(fq~[i0])-->Stat22(Stat38,Stat38*) ==> abs(fq~[i0]) R_LT m
			(abs(fq~[i0]),m)-->T675(Stat35*) ==> m R_GT abs(fq~[i0])
			Suppose ==> abs((fp~[i0]) R_MINUS (fp~[j0])) R_GT R_0
				(m, abs(fq~[i0]), abs((fp~[i0]) R_MINUS (fp~[j0])))-->T705(Stat20*) ==> (m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_GT (abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0])))
			(m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0])), (abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))))-->T675(Stat52*) ==> false; Discharge ==> AUTO
			(abs((fp~[i0]) R_MINUS (fp~[j0])), R_0)-->T675(Stat35*) ==> abs((fp~[i0]) R_MINUS (fp~[j0])) = R_0
			ALGEBRA(Stat43,Stat43) ==> (abs(fq~[i0]) R_TIMES R_0) = R_0
			EQUAL(Stat58*) ==> (m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) = (abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0])))
		((abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))), (m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))))-->T675(Stat35*) ==> false; Discharge ==> AUTO
		Suppose ==> not((m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))) R_GE (abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))
			(fp~[j0])-->Stat24(Stat40,Stat40*) ==> abs(fp~[j0]) R_LT m
			(abs(fp~[j0]),m)-->T675(Stat35*) ==> m R_GT abs(fp~[j0])
			Suppose ==> abs((fq~[i0]) R_MINUS (fq~[j0])) R_GT R_0
				(m, abs(fp~[j0]), abs((fq~[i0]) R_MINUS (fq~[j0])))-->T705(Stat20*) ==> (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))) R_GT (abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))
			(m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])), (abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))-->T675(Stat58*) ==> false; Discharge ==> AUTO
			(abs((fq~[i0]) R_MINUS (fq~[j0])), R_0)-->T675(Stat35*) ==> abs((fq~[i0]) R_MINUS (fq~[j0])) = R_0
			ALGEBRA(Stat46,Stat46) ==> (abs(fp~[j0]) R_TIMES R_0) = R_0
			EQUAL(Stat58*) ==> (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))) = (abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))
		((abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))), (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))-->T675(Stat35*) ==> false; Discharge ==> AUTO
		(m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0])), abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0])), m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])), abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))-->T695(Stat20*) ==>
					((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))) R_GE ((abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0]))))
--
-- ... hence, by exploiting the transitivity laws which the ordering of reals obeys, we
-- get to the absurd conclusion that $eps0 R_GT eps0$.
--
		ALGEBRA(Stat41,Stat42*) ==> (((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0]))) in Re
		(((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0])))-->T723(Stat41*) ==> Stat59: abs(((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0]))) in Re
		(((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))), ((abs(fq~[i0]) R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (abs(fp~[j0]) R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))), abs(((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0]))))-->T668(Stat41*) ==> Stat60:
				((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))) R_GE abs(((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0])))
		(((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))), abs(((fq~[i0]) R_TIMES (fp~[i0])) R_MINUS ((fq~[j0]) R_TIMES (fp~[j0]))), eps0)-->T678(Stat15,Stat59,Stat52,Stat60,Stat36*) ==> Stat61:
				((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))) R_GT eps0
		(eps0, ((m R_TIMES abs((fp~[i0]) R_MINUS (fp~[j0]))) R_PLUS (m R_TIMES abs((fq~[i0]) R_MINUS (fq~[j0])))), eps0)-->T678(Stat15,Stat52,Stat53,Stat61*) ==> eps0 R_GT eps0
	(eps0,eps0)-->T675(Stat58*) ==> false; Discharge ==> AUTO
	(Stat32*)ELEM ==> { (i * j) : i in Za, j in Za | abs(((fq Res_TIMES fp)~[i]) R_MINUS ((fq Res_TIMES fp)~[j])) R_GT eps0 } incin {(i*j): i in Za, j in Za | (abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps2) or (abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps1)}
--
-- Since the inclusion just proved entails that the set on the left-hand side is finite,
-- we have reached the desired contradiction, proving the statement of the present theorem.
--
({(i*j): i in Za, j in Za | (abs((fq~[i]) R_MINUS (fq~[j])) R_GT eps1) or (abs((fp~[i]) R_MINUS (fp~[j])) R_GT eps2)}, { i * j : i in Za, j in Za | abs(((fq Res_TIMES fp)~[i]) R_MINUS ((fq Res_TIMES fp)~[j])) R_GT eps0 })-->T189(Stat15) ==> false; Discharge ==> QED
--
--
--
-- A sequence $g$ of rational numbers is said to be an approximating sequence for a real number $r$
-- if $Cauchy_to_Re(g) = r$. $g$ is said to be an approximating sequence for a  real sequence $f$ if
-- for each positive real $eps$, the set of $n in domain(f)$ such that $abs(ReRa(g(n)) - f(n)) R_GT eps$
-- is finite.
--
Def 79: [Approximating rational sequence for a real sequence] Ra_apseq(F,G) := (FORALL eps in Re | (eps R_GT R_0) imp
			Finite({x : x in domain(G) | (abs(ReRa(G~[x]) R_MINUS (F~[x])) R_GT eps)}))
--
Def 79a: Ra_approx(F) := arb({g in RaCauchy | Ra_apseq(F,g)})
--
-- The limit of a real Cauchy sequence is the real number defined by any of its approximating
-- rational sequences (all of which are the same).
--
Def 80:  [Limit of a real Cauchy sequence] limit(F) := Cauchy_to_Re(arb({g in RaCauchy | Ra_apseq(F,g)}))
--
Theorem 765: [Every real Cauchy sequence can be approximated by a rational sequence] (F in ReCauchy) imp (0 /= {g in RaCauchy | Ra_apseq(F,g)}). Proof:
Suppose_not(f0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem 766: [Every real Cauchy sequence has a real limit] (F in ReCauchy) imp ((Ra_approx(F) in RaCauchy) & (Ra_approx(F) in RaSeq) & Ra_apseq(F,Ra_approx(F)) & (limit(F) in Re)). Proof:
Suppose_not(f0) ==> AUTO
	Use_def(Ra_approx(f0)) ==> AUTO
	f0-->T765 ==> Stat1: Ra_approx(f0) in {g in RaCauchy | Ra_apseq(f0,g)}
	()-->Stat1(*) ==> Stat2: (Ra_approx(f0) in RaCauchy) & (not((Ra_approx(f0) in RaSeq) & (limit(f0) in Re)))
	T539(Stat2*) ==> Stat3: limit(f0) notin Re
	Use_def(limit(f0)) ==> AUTO
	Use_def(Ra_approx(f0)) ==> AUTO
	EQUAL(Stat3) ==> Cauchy_to_Re(Ra_approx(f0)) notin Re
(Ra_approx(f0),Ra_approx(f0))-->T610(Stat2*) ==> false; Discharge ==> QED
--
-- Our next theorem establishes the assertion concerning limits stated above, by showing that
-- if $F$ is a Cauchy sequence of reals, and $G$ is a sequence of rationals approximating $F$,
-- then $G$ is a Cauchy seqence of rationals, and $Cauchy_to_Re(G) = limit(F)$.
--
Theorem 767: [The limit of a real Cauchy sequence is the real defined by any of its rational approximations] ((F in ReCauchy) & (G in RaSeq) & Ra_apseq(F,G)) imp ((G in RaCauchy) & (Cauchy_to_Re(G) = limit(F))). Proof:
Suppose_not(f0,g0) ==> AUTO
	Use_def(Ra_apseq) ==> Stat1: (FORALL eps in Re | (eps R_GT R_0) imp
		Finite({x : x in domain(g0) | (abs(ReRa(g0~[x]) R_MINUS (f0~[x])) R_GT eps)}))
	Suppose ==> g0 notin RaCauchy
	Tsomehow ==> false; Discharge ==> Stat2: (g0 in RaCauchy) & Ra_apseq(f0,g0)
	Use_def(limit)(*) ==> Cauchy_to_Re(g0) /= Cauchy_to_Re(arb({g in RaCauchy | Ra_apseq(f0,g)}))
	Loc_def ==> Stat3: g1 = arb({g in RaCauchy | Ra_apseq(f0,g)})
	Suppose ==> not(g1 in {g in RaCauchy | Ra_apseq(f0,g)})
		{g in RaCauchy | Ra_apseq(f0,g)}-->T0(Stat3*) ==> Stat4: g0 notin {g in RaCauchy | Ra_apseq(f0,g)}
	g0-->Stat4(Stat2,Stat2*) ==> false; Discharge ==> Stat5: g1 in {g in RaCauchy | Ra_apseq(f0,g)}
	()-->Stat5(Stat5*) ==> Stat6: (g1 in RaCauchy) & Ra_apseq(f0,g1)
	EQUAL(Stat2) ==> Cauchy_to_Re(g0) /= Cauchy_to_Re(g1)
	(g0,g1)-->T610(Stat2*) ==> (not Ra_eqseq(g0,g1)) & (Cauchy_to_Re(g0) in Re)
	T539(Stat2,Stat6*) ==> {g0,g1} incin RaSeq
	(g0,g1)-->T541(Stat6*) ==> Stat7: (not (FORALL eps in Ra | (eps Ra_GT Ra_0) imp
		Finite({x : x in Za | Ra_ABS((g0~[x]) Ra_MINUS (g1~[x])) Ra_GT eps})))
	eps0-->Stat7(Stat7*) ==> (eps0 in Ra) & (eps0 Ra_GT Ra_0) &
		(not Finite({x : x in Za | Ra_ABS((g0~[x]) Ra_MINUS (g1~[x])) Ra_GT eps0}))
Tsomehow ==> false; Discharge ==> QED
--
-- It is easily seen that the 'approximation' relationship we have introduced is
-- additive and multiplicative.
--
Theorem 768: [The elementary operations on reals map Cauchy sequences into Cauchy sequences] ((F in ReCauchy) & (G in ReCauchy) & (Fp in RaCauchy) & (Gp in RaCauchy) & Ra_apseq(F,Fp) & Ra_apseq(G,Gp)) imp
			((((F Res_PLUS G in ReCauchy) & Ra_apseq(F Res_PLUS G,Fp Ras_PLUS Gp))) &
			(((F Res_MINUS G in ReCauchy) & Ra_apseq(F Res_MINUS G,Fp Ras_MINUS Gp))) &
			(((F Res_TIMES G in ReCauchy) & Ra_apseq(F Res_TIMES G,Fp Ras_TIMES Gp)))). Proof:
Suppose_not(f0,g0,f1,g1) ==> AUTO
	(f0,g0)-->T758 ==> (f0 Res_PLUS g0) in ReCauchy
	(f0,g0)-->T764 ==> ((f0 Res_MINUS g0) in ReCauchy) & ((f0 Res_TIMES g0) in ReCauchy)
Tsomehow ==> false; Discharge ==> QED
--
-- The results just proved can be read as asserting that the limit operation for real sequences
-- is additive and multiplicative.
--
Theorem 769: [The limit of a sum is the sum of limits] ((F in ReCauchy) & (G in ReCauchy)) imp (limit(F Res_PLUS G) = (limit(F) R_PLUS limit(G))). Proof:
Suppose_not(f0,g0) ==> AUTO
	f0-->T766(*) ==> Ra_apseq(f0,Ra_approx(f0)) & (Ra_approx(f0) in RaCauchy)
	g0-->T766(*) ==> Ra_apseq(g0,Ra_approx(g0)) & (Ra_approx(g0) in RaCauchy)
	(f0,g0,Ra_approx(f0),Ra_approx(g0))-->T768(*) ==> ((f0 Res_PLUS g0) in ReCauchy) & Ra_apseq(f0 Res_PLUS g0,Ra_approx(f0) Ras_PLUS Ra_approx(g0))
	T539(*) ==> {Ra_approx(f0),Ra_approx(g0)} incin RaSeq
	(Ra_approx(f0),Ra_approx(g0))-->T554(*) ==> (Ra_approx(f0) Ras_PLUS Ra_approx(g0)) in RaSeq
	(f0 Res_PLUS g0,Ra_approx(f0) Ras_PLUS Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0) Ras_PLUS Ra_approx(g0)) = limit(f0 Res_PLUS g0)
	(Ra_approx(f0),Ra_approx(g0))-->T616(*) ==> (Cauchy_to_Re(Ra_approx(f0)) R_PLUS Cauchy_to_Re(Ra_approx(g0))) = limit(f0 Res_PLUS g0)
	(f0,Ra_approx(f0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0)) = limit(f0)
	(g0,Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(g0)) = limit(g0)
EQUAL ==> false; Discharge ==> QED
--
Theorem 770: [The limit of a difference is the difference of limits] ((F in ReCauchy) & (G in ReCauchy)) imp (limit(F Res_MINUS G) = limit(F) R_MINUS limit(G)). Proof:
Suppose_not(f0,g0) ==> AUTO
	f0-->T766(*) ==> Ra_apseq(f0,Ra_approx(f0)) & (Ra_approx(f0) in RaCauchy)
	g0-->T766(*) ==> Ra_apseq(g0,Ra_approx(g0)) & (Ra_approx(g0) in RaCauchy)
	(f0,g0,Ra_approx(f0),Ra_approx(g0))-->T768(*) ==> ((f0 Res_MINUS g0) in ReCauchy) & Ra_apseq(f0 Res_MINUS g0,Ra_approx(f0) Ras_MINUS Ra_approx(g0))
	T539(*) ==> {Ra_approx(f0),Ra_approx(g0)} incin RaSeq
	Suppose ==> (Ra_approx(f0) Ras_MINUS Ra_approx(g0)) notin RaSeq
		Use_def(Ras_MINUS) ==> (Ra_approx(f0) Ras_PLUS Ras_Rev(Ra_approx(g0))) notin RaSeq
		(Ra_approx(g0),Ra_approx(g0))-->T554(*) ==> Ras_Rev(Ra_approx(g0)) in RaSeq
	(Ra_approx(f0),Ras_Rev(Ra_approx(g0)))-->T554(*) ==> false; Discharge ==> (Ra_approx(f0) Ras_MINUS Ra_approx(g0)) in RaSeq
	(f0 Res_MINUS g0,Ra_approx(f0) Ras_MINUS Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0) Ras_MINUS Ra_approx(g0)) = limit(f0 Res_MINUS g0)
	Suppose ==> Cauchy_to_Re(Ra_approx(f0) Ras_MINUS Ra_approx(g0)) /= (Cauchy_to_Re(Ra_approx(f0)) R_MINUS Cauchy_to_Re(Ra_approx(g0)))
		Use_def(Ras_MINUS)(*) ==> Cauchy_to_Re(Ra_approx(f0) Ras_PLUS Ras_Rev(Ra_approx(g0))) /= (Cauchy_to_Re(Ra_approx(f0)) R_MINUS Cauchy_to_Re(Ra_approx(g0)))
		(Ra_approx(g0),Ra_approx(g0))-->T556(*) ==> Ras_Rev(Ra_approx(g0)) in RaCauchy
		(Ra_approx(f0),Ras_Rev(Ra_approx(g0)))-->T616(*) ==> (Cauchy_to_Re(Ra_approx(f0)) R_PLUS Cauchy_to_Re(Ras_Rev(Ra_approx(g0)))) /= (Cauchy_to_Re(Ra_approx(f0)) R_MINUS Cauchy_to_Re(Ra_approx(g0)))
		(Ra_approx(g0))-->T622(*) ==> Cauchy_to_Re(Ras_Rev(Ra_approx(g0))) = R_Rev(Cauchy_to_Re(Ra_approx(g0)))
		(Ra_approx(f0),Ra_approx(f0))-->T610(*) ==> Cauchy_to_Re(Ra_approx(f0)) in Re
		(Ra_approx(g0),Ra_approx(g0))-->T610(*) ==> Cauchy_to_Re(Ra_approx(g0)) in Re
		(Cauchy_to_Re(Ra_approx(f0)),Cauchy_to_Re(Ra_approx(g0)))-->T635(*) ==> (Cauchy_to_Re(Ra_approx(f0)) R_MINUS Cauchy_to_Re(Ra_approx(g0))) = (Cauchy_to_Re(Ra_approx(f0)) R_PLUS R_Rev(Cauchy_to_Re(Ra_approx(g0))))
	EQUAL ==> false; Discharge ==> (Cauchy_to_Re(Ra_approx(f0)) R_MINUS Cauchy_to_Re(Ra_approx(g0))) = limit(f0 Res_MINUS g0)
	(f0,Ra_approx(f0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0)) = limit(f0)
	(g0,Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(g0)) = limit(g0)
EQUAL ==> false; Discharge ==> QED
--
Theorem 771: [The limit of a product is the product of limits] ((F in ReCauchy) & (G in ReCauchy)) imp (limit(F Res_TIMES G) = limit(F) R_TIMES limit(G)).Proof:
Suppose_not(f0,g0) ==> AUTO
	f0-->T766(*) ==> Ra_apseq(f0,Ra_approx(f0)) & (Ra_approx(f0) in RaCauchy)
	g0-->T766(*) ==> Ra_apseq(g0,Ra_approx(g0)) & (Ra_approx(g0) in RaCauchy)
	(f0,g0,Ra_approx(f0),Ra_approx(g0))-->T768(*) ==> ((f0 Res_TIMES g0) in ReCauchy) & Ra_apseq(f0 Res_TIMES g0,Ra_approx(f0) Ras_TIMES Ra_approx(g0))
	T539(*) ==> {Ra_approx(f0),Ra_approx(g0)} incin RaSeq
	T211(*) ==> 0 in Za
	(Ra_approx(f0),Ra_approx(g0),0)-->T555(*) ==> (Ra_approx(f0) Ras_TIMES Ra_approx(g0)) in RaSeq
	(f0 Res_TIMES g0,Ra_approx(f0) Ras_TIMES Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0) Ras_TIMES Ra_approx(g0)) = limit(f0 Res_TIMES g0)
	(Ra_approx(f0),Ra_approx(g0))-->T619(*) ==> (Cauchy_to_Re(Ra_approx(f0)) R_TIMES Cauchy_to_Re(Ra_approx(g0))) = limit(f0 Res_TIMES g0)
	(f0,Ra_approx(f0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0)) = limit(f0)
	(g0,Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(g0)) = limit(g0)
EQUAL ==> false; Discharge ==> QED
--
-- If we make an additional hypothesis forbidding division by zero, a theorem like those just
-- stated applies to division also.
--
Theorem 772: [The limit of a quotient is the quotient of limits, provided that the denominator limit  is non-zero] ((F in ReCauchy) & (G in ReCauchy) & (limit(G) /= R_0)) imp (limit(F Res_OVER G) = limit(F) R_OVER limit(G)). Proof:
Suppose_not(f0,g0) ==> AUTO
	f0-->T766(*) ==> Ra_apseq(f0,Ra_approx(f0)) & (Ra_approx(f0) in RaCauchy)
	g0-->T766(*) ==> Ra_apseq(g0,Ra_approx(g0)) & (Ra_approx(g0) in RaCauchy)
--	(f0,g0,Ra_approx(f0),Ra_approx(g0))-->T768(*) ==> ((f0 Res_TIMES g0) in ReCauchy) & Ra_apseq(f0 Res_TIMES g0,Ra_approx(f0) Ras_TIMES Ra_approx(g0))
--	T539(*) ==> {Ra_approx(f0),Ra_approx(g0)} incin RaSeq
--	T211(*) ==> 0 in Za
--	(Ra_approx(f0),Ra_approx(g0),0)-->T555(*) ==> (Ra_approx(f0) Ras_TIMES Ra_approx(g0)) in RaSeq
--	(f0 Res_TIMES g0,Ra_approx(f0) Ras_TIMES Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0) Ras_TIMES Ra_approx(g0)) = limit(f0 Res_TIMES g0)
--	(Ra_approx(f0),Ra_approx(g0))-->T619(*) ==> (Cauchy_to_Re(Ra_approx(f0)) R_TIMES Cauchy_to_Re(Ra_approx(g0))) = limit(f0 Res_TIMES g0)
--	(f0,Ra_approx(f0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(f0)) = limit(f0)
--	(g0,Ra_approx(g0))-->T767(*) ==> Cauchy_to_Re(Ra_approx(g0)) = limit(g0)
-- EQUAL ==> false; Discharge ==>
Tsomehow ==> false; Discharge ==> QED
--
Theorem 773: [Any real $x$ is included between two rationals which can be arbitrarily close together] ((X in Re) & (EPS in Re) & (EPS R_GT R_0)) imp (EXISTS r1 in Ra, r2 in Ra | ((ReRa(r1) R_GT X) & (X R_GT ReRa(r2)) & (ReRa(r1 Ra_MINUS r2) R_LE EPS))). Proof:
Suppose_not(x0,eps0) ==> (x0 in Re) & (eps0 in Re) & (eps0 R_GT R_0) & Stat1: (not(EXISTS r1 in Ra, r2 in Ra  | ((ReRa(r1) R_GT x0) & (x0 R_GT ReRa(r2)) & (ReRa(r1 Ra_MINUS r2) R_LE eps0))))
--
-- For suppose that the real numbers $x0$ and $eps0$ are counterexamples to our assertion.
-- It is clear that $eps0$ is nonzero, and so by Theorem 562 there is a positive rational $r$
-- such that all but a finite number of components of the Cauchy sequence $arb(eps)$
-- have an absolute value greater than $r$ for all but a finite number of elements.
--
	ALGEBRA ==> Ra_0 in Ra
	(eps0,R_0)-->T673(*) ==> Stat2: (eps0 R_GE R_0) & (eps0 /= R_0)
	eps0-->T611(*) ==> (arb(eps0) in RaCauchy) & (Cauchy_to_Re(arb(eps0)) = eps0)
	Suppose ==> Ra_eqseq(arb(eps0),Ra0Seq)
		T545(Stat3*) ==> Stat3: Ra0Seq in RaCauchy
		(arb(eps0),Ra0Seq)-->T610(Stat2*) ==> eps0 = Cauchy_to_Re(Ra0Seq)
	Use_def(R_0)(Stat2*) ==> false; Discharge ==> (not Ra_eqseq(arb(eps0),Ra0Seq))
	(arb(eps0))-->T562(Stat2*) ==> (EXISTS r in Ra | (r Ra_GT Ra_0) & Finite({i in Za | r Ra_GE Ra_ABS((arb(eps0))~[i])}))
--
-- But since $arb(eps0)$ and $Ras_ABS(arb(eps0))$ are equivalent Cauchy sequences,
-- all but a finite number of the components of $arb(eps0)$ must be larger than $r/2$.
--
	(arb(eps0),arb(eps0))-->T556(Stat2*) ==> Ras_ABS(arb(eps0)) in RaCauchy
	T539(Stat2*) ==> Stat4: (arb(eps0) in RaSeq) & (Ras_ABS(arb(eps0)) in RaSeq)
	Suppose ==> not(Ra_eqseq(arb(eps0),Ras_ABS(arb(eps0))))
		(arb(eps0),Ras_ABS(arb(eps0)))-->T541(Stat4*) ==> not(FORALL e in Ra | (e Ra_GT Ra_0) imp Finite({x: x in Za | Ra_ABS(((arb(eps0))~[x]) Ra_MINUS (Ras_ABS(arb(eps0))~[x])) Ra_GT e}))
	Tsomehow ==> false; Discharge ==> AUTO
--
-- Since $arb(x0)$ is a Cauchy sequence, all its components $arb(x0)~[i]$ beyond a certain $arb(x0)~[j]$
-- must differ from $arb(x0)~[j]$ by less than $ReRa(r/8)$.
-- Thus the components of $arb(x0) Ra_MINUS (Za PROD {(arb(x0)~[j] Ra_MINUS ReRa(r/8))})$ must be positive
-- beyond a certain point, while those of $arb(x0) Ra_MINUS (Za PROD {(arb(x0)~[j] Ra_PLUS ReRa(r/8))})$
-- must be negative.
--

--
-- It follows that $x0 R_GT ReRa(arb(x0)~[j] Ra_MINUS ReRa(r/4))$ and $x0 R_LT ReRa(arb(x0)~[j] Ra_PLUS ReRa(r/4))$.
-- But since the two rationals $arb(x0)~[j] Ra_MINUS ReRa(r/4)$ and $arb(x0)~[j] Ra_PLUS ReRa(r/4)$ differ
-- by $r/2$, and $ReRa(r/4) R_LE eps0$, we have contradicted Stat2 and thereby proved our theorem.
--
Tsomehow ==> false; Discharge ==> QED
--
Theorem 774: [For any real $x$, there exists a rational $r$ such that $r >= x$] (X in Re) imp (EXISTS r in Ra | ReRa(r) R_GT X). Proof:
	Suppose_not(x) ==> AUTO
-- For $R_1 R_GT R_0$, and so by Theorem 773 there exists an $r1 in Ra$ such that $ReRa(r1) R_GT x$,
-- proving our assertion
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 775: [Any rational $r$ is the quotient of two signed integers, of which the second is positive] (x in Ra) imp (EXISTS m in Si, n in Si | ((n S_GE [1,0]) & (x = RaSi(m) Ra_OVER RaSi(n)))). Proof:
	Suppose_not(r) ==> AUTO
-- For by Theorem *** the fraction arb(r) is a pair [m,n] of signed integers with n /= [0,0].
-- If n SI_GT [0,0] we must have n SI_GE [1,0] and so our assertion is obvious, while if n SI_LT [0,0]
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 776: [For any rational $r$, there exists an integer $n$ such that $n >= r$] (R in Ra) imp (EXISTS n in Za | RaSi(SiZa(n)) Ra_GE R). Proof:
	Suppose_not(r) ==> AUTO
-- For by Theorem 775 the r can be written as a pair [m,n] of signed integers, the second being positive.
-- Writing S_abs(m) as [k,0] where k in Za, it is easily seen that RaSi(SiZa(k)) R_GE x
	r-->T775 ==> Stat1: (EXISTS m in Si, n in Si | ((n S_GE [1,0]) & (r = RaSi(m) Ra_OVER RaSi(n))))
	(m,n)-->Stat1 ==> (m in Si) & (n in Si) & (n S_GE [1,0])  & (r = RaSi(m) Ra_OVER RaSi(n))
--?	Discharge ==> RaSi(m) Ra_GE RaSi([1,0])
	Tsomehow ==> false; Discharge ==> QED

Theorem 777: [For any real $x$, there exists an integer $n$ such that $n > x$] (X in Re) imp (EXISTS n in Za | ReRa(RaSi(SiZa(n))) R_GT X). Proof:
	Suppose_not(x) ==> AUTO
-- Indeed, by Theorem 774 there is a rational r such that ReRa(r) R_GT x, and by Theorem 776 there is an integer
-- n such that RaSi(SiZa(n)) R_GE r. Since it is then clear that ReRa(RaSi(SiZa(n))) R_GT x, our theorem is proved.
	Tsomehow ==> false; Discharge ==> QED

Theorem 778: [For any real $x$ and $eps > 0$, there exists an integer $n$ such that $n  eps > x$] ((X in Re) & (Eps in Re) & (Eps R_GT R_0)) imp (EXISTS n in Za | ((ReRa(RaSi(SiZa(n))) R_TIMES Eps) R_GT X)). Proof:
	Suppose_not(x,eps) ==> AUTO
-- Indeed, by Theorem 777 there is an integer $n$ greater than $x/eps$, from which it is easily seen that $(ReRa(RaSi(SiZa(n))) R_TIMES e) R_GT x$
	Tsomehow ==> false; Discharge ==> QED

Theorem 779: [For any real $x$ and $eps > 0$, there exists an integer $n$ such that $eps > x/n$] ((X in Re) & (Eps in Re) & (Eps R_GT R_0)) imp (EXISTS n in Za | (Eps R_GT (X R_OVER ReRa(RaSi(SiZa(n)))))). Proof:
	Suppose_not(x,eps) ==> AUTO
-- Indeed, by Theorem 778 there is an integer $n$ such that n  eps > x, from which our assertion is immediate.
	Tsomehow ==> false; Discharge ==> QED

Theorem 780: [For any non-negative real $x$ and $eps > 0$, there exists an integer $n$ such that $n R_TIMES eps > x$ and $(n - 1)  eps <= x$] ((X in Re) & (Eps in Re) & (Eps R_GT R_0)) imp (EXISTS n in Za | (Eps R_GT (X R_OVER ReRa(RaSi(SiZa(n)))))). Proof:
	Suppose_not(x,eps) ==> AUTO
-- If $x$ is 0 we can take $n = 1$. In the contrary case $x$ is positive, and then $0 R_TIMES x$ is
	Tsomehow ==> false; Discharge ==> QED

Theorem 781: [Every positive real is bounded below by a rational fraction of the form $1/n$]  ((X in Re) & (X R_GT R_0)) imp (EXISTS n in Za | (R_1 R_OVER ReRa(RaSi(SiZa(n)))) R_LT X). Proof:
	Suppose_not(x) ==> AUTO
-- For by Theorem 778 there exists an integer $n$ such that $R_1 R_LT (x R_TIMES ReRa(RaSi(SiZa(n))))$,
-- from which our assertion is immediate.
	Tsomehow ==> false; Discharge ==> QED

-- It is plain that every real number has the approximating rational sequence $arb(x)$.
-- The following elementary result extends this statement to real Cauchy sequences $g$
-- in general, by showing that every such sequence has at least one (indeed, many) approximating
-- rational Cauchy sequences.

Theorem 782: [Every real Cauchy sequence is approximated by a rational Cauchy sequence] (F in ReCauchy) imp (EXISTS g in RaCauchy | Ra_apseq(F,g)). Proof:
	Suppose_not(f) ==> AUTO
--
-- It follows from Theorem 773 that for every component $f~[n]$ of our real Cauchy sequence,
-- there exists a rational $r$ such the $R_ABS(f~[n] R_MINUS r) < 1/n$.
--
-- Skolemization of the assertion just proved gives us a sequence $g$ of rationals such that
-- $R_ABS(f~[n] R_MINUS ReRa(g~[n])) < 1/n$
--
-- But then it is easily seen that $g$ is a rational Cauchy sequence which approximates $f$, proving our
-- theorem.
--
	Tsomehow ==> false; Discharge ==> QED

-- Any two approximating rational sequences for a given real Cauchy sequence are equivalent.

Theorem 783: [Any two approximating rational sequences for a given real Cauchy sequence are equivalent]  ((F in ReCauchy) & Ra_apseq(F,G) & Ra_apseq(F,GP)) imp ((G in RaCauchy) & (GP in RaCauchy) & (Cauchy_to_Re(G) = Cauchy_to_Re(GP))). Proof:
	Suppose_not(f,g,gp) ==> AUTO
--
-- For it is easily seen that for each positive rational $eps$, there can be a most finitely many integers
-- $n$ for which $g~[n]$ differs from $gp~[n]$ by ore than $eps$, proving our assertion.
--
	Tsomehow ==> false; Discharge ==> QED

Theorem 784: [For any non-empty set $s$ of reals which is bounded above, and for any positive real $eps$, there exists an $u in s$ such that $u + eps$ is an upper bound of $s$] ((S incin Re) & (S /= 0) & (Eps in Re) & (Eps R_GT R_0) & (Y in Re) & (FORALL x in S | Y R_GE x)) imp (EXISTS u in S | (FORALL x in S | u R_GE x)). Proof:
	Suppose_not(s,eps,y) ==> AUTO
--
-- We can prove this assertion as follows. Pick a positive integer $k$, consider it as a real number,
-- set $eps = 1/k$, some $v in s$, and consider the sequence $v + n * eps$ for all $n in Za$.
-- Since by Theorem 778 there exists an $n$ for which $(v + n * eps) R_GE y$, there exists
-- some $n$ for which $v + n * eps$ is greater than all the elements of $s$, but $v + (n - 1) * eps$
-- is not such a strict upper bound, i.e. there exists a $w in s$
-- which is no smaller than $v + (n - 1) * eps$. This gives us a $w$ which belongs to $s$ for which
-- $w + 1/k$ is an upper bound for all of $s$.
--
	Tsomehow ==> false; Discharge ==> QED
--
-- The following theorem states a crucial completeness property of real numbers:
-- every non-empty set of such numbers  which is bounded above has a least upper bound.
--

Theorem 785: [Any bounded set of reals has a least upper bound] ((S incin Re) & (S /= 0) & (EXISTS y in Re | (FORALL x in S | y R_GE x))) imp (EXISTS u in Re | ((FORALL x in S | u R_GE x) & (FORALL v in Re | (v R_LT u imp (not (FORALL x in s | v R_GE x)))))). Proof:
	Suppose_not(s) ==> AUTO
--
-- Our basic idea is to construct a Cauchy sequence of elements of $s$ which converges to
-- an upper bound of $s$.
-- For this, we Skolemize the preceding assertion, thereby obtaining a sequence $g~[k]$ of elements of
-- $s$ such that $g~[k] + 1/k$
-- is an upper bound for all the elements of $s$. It follows that $(g~[k] + 1/k) R_GE g~[j]$ for all
-- positive integers $k$ and $j$,
-- and since $(g~[j] + 1/j) R_GE g~[k]$, $g$ is clearly a Cauchy sequence.
--
-- Let $lm$ be the limit of this Cauchy sequence. It is easily seen that $lm$ is an upper bound for $s$.
-- But since lm can be no larger than any upper bound of $s$, it must be the least upper bound
-- whose existence our theorem asserts.
--
	Tsomehow ==> false; Discharge ==> QED

-- A real function is said to be continuous if it maps real Cauchy sequences into
-- real Cauchy sequences.

Def 81: [Real functions of a real variable continuous on a set S] Cf_RR(F,S) := ((domain(F) = S) & (range(F) incin Re) & Svm(F) & Svm(F) &
				(FORALL G in ReCauchy | (((range(G) incin S) & (limit(F) in S)) imp (F @ G in ReCauchy))))

--
-- The important exponential function x ** n can be defined by applying the 'finite_tailrecursive_fcn1' THEORY discussed previously
--
APPLY(trech_thryvar:ToThe1) finite_tailrecursive_fcn1(f(t)->R_1,g3(a,x,t)->(a R_TIMES t)) ==>
	Theorem 786: (FORALL s, t | Finite(s) imp (ToThe1(s,t) = if (s = 0) then R_1 else (ToThe1(s - {arb(s)},t) R_TIMES t) end if))
--
-- One easily proves that the function just introduced provides a real result when its second parameter is real and
-- its first parameter is a finite set, e.g. an unsigned integer. Moreover, what counts of its second parameter is only
-- its cardinality.
--
Theorem 787a: (Finite(S) & (T in Re)) imp (ToThe1(S,T) in Re). Proof+:
Suppose_not(s1,t0) ==> AUTO
	T786 ==> Stat1: (FORALL s, t | Finite(s) imp (ToThe1(s,t) = if (s = 0) then R_1 else (ToThe1(s - {arb(s)},t) R_TIMES t) end if))
	APPLY(m1_thryvar:s0) finite_induction(n->s1,P(x)->(ToThe1(x,t0) notin Re)) ==>
		Stat2: (FORALL k incin s0 | (k /= s0) imp (not(ToThe1(k,t0) notin Re))) & (s0 incin s1) & (ToThe1(s0,t0) notin Re)
	(s0,t0)-->Stat1(*) ==> ToThe1(s0,t0) = if (s0 = 0) then R_1 else (ToThe1(s0 - {arb(s0)},t0) R_TIMES t0) end if
	Suppose ==> s0 = 0
		(Stat2*)ELEM ==> R_1 notin Re
		ALGEBRA ==> false
	(Stat2*)Discharge ==> AUTO
	(s0 - {arb(s0)},t0)-->Stat2(Stat2) ==> ToThe1(s0 - {arb(s0)},t0) in Re
	(Stat2*)ELEM ==> ToThe1(s0,t0) = ToThe1(s0 - {arb(s0)},t0) R_TIMES t0
	ALGEBRA ==> false; Discharge ==> QED
--
Theorem 787b: Finite(S) imp (ToThe1(S,T) = ToThe1(#S,T)). Proof+:
Suppose_not(s1,t0) ==> AUTO
	T786 ==> Stat1: (FORALL s, t | Finite(s) imp (ToThe1(s,t) = if (s = 0) then R_1 else (ToThe1(s - {arb(s)},t) R_TIMES t) end if))
	Loc_def ==> n1 = #s1
	Suppose ==> not(EXISTS s | (#s = n1) & (ToThe1(s,t0) /= ToThe1(n1,t0)))
		EQUAL ==> Stat2: not(EXISTS s | (#s = #s1) & (ToThe1(s,t0) /= ToThe1(#s1,t0)))
		s1-->Stat2(*) ==> false
	Discharge ==> (EXISTS s | (#s = n1) & (ToThe1(s,t0) /= ToThe1(n1,t0)))
	APPLY(m2_thryvar:n0) mathematical_induction(n->n1,P(x)->(EXISTS s | (#s = x) & (ToThe1(s,t0) /= ToThe1(x,t0)))) ==>
		Stat3: (FORALL k in n0 | not(EXISTS s | (#s = k) & (ToThe1(s,t0) /= ToThe1(k,t0)))) & (n0 in Za) & Stat4: (EXISTS s | (#s = n0) & (ToThe1(s,t0) /= ToThe1(n0,t0)))
	s0-->Stat4(Stat3*) ==> (#s0 = n0) & (ToThe1(s0,t0) /= ToThe1(n0,t0))
	s0-->T162 ==> AUTO
	Suppose ==> n0 = 0
		(Stat3*)ELEM ==> s0 = n0
		EQUAL ==> false
	Discharge ==> AUTO
	n0-->T164(Stat3) ==> Stat5: (arb(s0) in s0) & (arb(n0) in n0) & Finite(n0) & (n0 = #n0)
	EQUAL(Stat3) ==> Finite(#s0)
	(s0,t0)-->Stat1(Stat5*) ==> ToThe1(s0,t0) = ToThe1(s0 - {arb(s0)},t0) R_TIMES t0
	(n0,t0)-->Stat1(Stat5*) ==> ToThe1(n0,t0) = ToThe1(n0 - {arb(n0)},t0) R_TIMES t0
	Suppose ==> ToThe1(s0 - {arb(s0)},t0) = ToThe1(n0 - {arb(n0)},t0)
		EQUAL(Stat3) ==> false
	Discharge ==> AUTO
	(n0,arb(n0))-->T305a(Stat5*) ==> #(n0 - {arb(n0)}) = #n0 MINUS 1
	(s0,arb(s0))-->T305a(Stat5*) ==> #(s0 - {arb(s0)}) = #s0 MINUS 1
	EQUAL(Stat3) ==> (#(n0 - {arb(n0)}) = n0 MINUS 1) & (#(s0 - {arb(s0)}) = n0 MINUS 1)
	Suppose ==> n0 MINUS 1 notin n0
		(1,n0)-->T29 ==> AUTO
		n0-->T268 ==> AUTO
		TELEM ==> (0 in 1) & (1 in Za) & (1 = {0})
		(1,n0,0)-->T299(Stat3*) ==> false
	Discharge ==> AUTO
	(n0 MINUS 1)-->Stat3(Stat5*) ==> Stat6: not(EXISTS s | (#s = n0 MINUS 1) & (ToThe1(s,t0) /= ToThe1(n0 MINUS 1,t0)))
	(s0 - {arb(s0)})-->Stat6(Stat5*) ==> ToThe1(s0 - {arb(s0)},t0) = ToThe1(n0 MINUS 1,t0)
--??	(n0 - {arb(n0)})-->Stat6(Stat5*) ==> ToThe1(n0 - {arb(n0)},t0) = ToThe1(n0 MINUS 1,t0) -- Why's this step unnecessary?
	EQUAL(Stat3) ==> false	
	Discharge ==> QED
--
-- It is conventional and more convenient to represent the exponential function in infix form.
--
Def 81a: [Powers of a real number] Def(X ToThe N) := ToThe1(N,X)
--
-- We can restate the immediately preceding Theorem 786 in the following familiar form.
--
--
Theorem 787: ((N in Za) & (X in Re)) imp ((X ToThe N) = if (N = 0) then R_1 else X R_TIMES (X ToThe (N MINUS 1)) end if). Proof+:
Suppose_not(n1,x0) ==> AUTO
	TELEM ==> 1 in Za
	(n1,1)-->T283 ==> (n1 MINUS 1) in Za
	(n1 MINUS 1,x0)-->T787a(*) ==> ToThe1(n1 MINUS 1, x0) in Re
	Use_def(ToThe) ==> ToThe1(n1,x0) /= if (n1 = 0) then R_1 else x0 R_TIMES ToThe1(n1 MINUS 1, x0) end if
	ALGEBRA ==> ToThe1(n1,x0) /= if (n1 = 0) then R_1 else ToThe1(n1 MINUS 1, x0) R_TIMES x0 end if
	APPLY(m2_thryvar:n0) mathematical_induction(n->n1,P(x)->(ToThe1(x,x0) /= if (x = 0) then R_1 else ToThe1(x MINUS 1,x0) R_TIMES x0 end if)) ==>
		Stat1: (FORALL k in n0 | not(ToThe1(k,x0) /= if (k = 0) then R_1 else ToThe1(k MINUS 1,x0) R_TIMES x0 end if)) & 
		(n0 in Za) & (ToThe1(n0,x0) /= if (n0 = 0) then R_1 else ToThe1(n0 MINUS 1,x0) R_TIMES x0 end if)
	T786 ==> Stat2: (FORALL s, t | Finite(s) imp (ToThe1(s,t) = if (s = 0) then R_1 else (ToThe1(s - {arb(s)},t) R_TIMES t) end if))
	n0-->T164(Stat1) ==> Finite(n0) & Finite(n0 - {arb(n0)}) & (n0 = #n0) & Finite(0)
	(n0,x0)-->Stat2(Stat2*) ==> ToThe1(n0,x0) = if (n0 = 0) then R_1 else (ToThe1(n0 - {arb(n0)},x0) R_TIMES x0) end if
	Suppose ==> n0 = 0
	(Stat1*)Discharge ==> AUTO
	Suppose ==> Stat3: ToThe1(n0 - {arb(n0)},x0) = ToThe1(n0 MINUS 1,x0)
		(Stat1*)ELEM ==> ToThe1(n0 - {arb(n0)},x0) R_TIMES x0 /= ToThe1(n0 MINUS 1,x0) R_TIMES x0
		EQUAL(Stat3) ==> false
	Discharge ==> AUTO
	n0-->T0(Stat2*) ==> arb(n0) in n0
	Suppose ==> #(n0 - {arb(n0)}) = #n0 MINUS 1
		(n0 - {arb(n0)},x0)-->T787b(Stat2*) ==> ToThe1(#(n0 - {arb(n0)}),x0) /= ToThe1(n0 MINUS 1,x0)
		EQUAL(Stat2) ==> false
	Discharge ==> AUTO
	(n0,arb(n0))-->T305a(Stat2*) ==> false
	Discharge ==> QED
--
-- The usual recursive proofs can be used to establish the familiar properties of the exponential function.
--
Theorem 788: (X in Re) imp ((X ToThe 0 = R_1) & (X ToThe 1 = X) & (((M in Za) & (N in Za)) imp (X ToThe (M PLUS N) = (X ToThe M) R_TIMES (X ToThe N)))). Proof:
Suppose_not(x0,m0,n0) ==> AUTO
	T786 ==> Stat1: (FORALL s, t | Finite(s) imp (ToThe1(s,t) = if (s = 0) then R_1 else (ToThe1(s - {arb(s)},t) R_TIMES t) end if))
	TELEM ==> Finite(0)
	(0,x0)-->Stat1(Stat1*) ==> ToThe1(0,x0) = R_1
	Use_def(ToThe) ==> Stat2: (x0 in Re) & (not((ToThe1(1,x0) = x0) & (((m0 in Za) & (n0 in Za)) imp (ToThe1(m0 PLUS n0,x0) = ToThe1(m0,x0) R_TIMES ToThe1(n0,x0)))))
	Tsomehow ==> false; Discharge ==> QED
--
-- Another familiar property of the exponential function is as follows.
--
Theorem 789: ((X in Re) & (M in Za) & (N in Za)) imp (((X ToThe M) ToThe N) = (X ToThe (M TIMES N))). Proof:
Suppose_not(x0,m0,n0) ==> AUTO
	Use_def(ToThe) ==> Stat1: (x0 in Re) & (m0 in Za) & (n0 in Za) & (ToThe1(n0,ToThe1(m0,x0)) /= ToThe1(m0 TIMES n0,x0))
	Tsomehow ==> false; Discharge ==> QED
--
-- It is now easy to define general polynomial functions of a real variable. We begin by defining
-- the sum of a finite series of reals.
--
--APPLY(sigma_thryvar:R_SIGMA) sigma_theory(s->Re,pluz(x,y)->x R_PLUS y,e->R_0) ==>
Theorem 790: (R_SIGMA(0) = R_0) &
	(FORALL x in OM | (cdr(x) in Re) imp (R_SIGMA({x}) = cdr(x))) &
	(FORALL f in OM | (Finite(f) & (range(f) incin Re)) imp (R_SIGMA(f) in Re)) &
	(FORALL f in OM, c in f | (Finite(f) & (range(f) incin Re)) imp (R_SIGMA(f) = R_SIGMA(f - {c}) R_PLUS cdr(c))) &
	(FORALL f in OM | (Finite(f) & Is_map(f) & (range(f) incin Re)) imp
	(FORALL t | R_SIGMA(f) = R_SIGMA(f ON (domain(f) * t)) R_PLUS R_SIGMA(f ON (domain(f) - t)))) &
	(FORALL f in OM, g | (Finite(f) & Svm(f) & Svm(g) & (domain(f) = domain(g)) & (range(f) incin Re)) imp
		(R_SIGMA(f) = R_SIGMA({[y,R_SIGMA(f ON (g INV_IM {y}))]: y in range(g)}))) &
	(FORALL f in OM, g | (Finite(f) & Svm(f) & one_1_map(g) & (domain(f) = domain(g)) & (range(f) incin Re)) imp
		(R_SIGMA(f) = R_SIGMA({[y,f~[inv(g)~[y]]]: y in range(g)})))
--
-- To ease application of the preceding theorem we restate it in a less quantifier-ridden form.
--
Theorem 791: (R_SIGMA(0) = R_0) &
	((cdr(X) in Re) imp (R_SIGMA({X}) = cdr(X))) &
	((Finite(F) & (range(F) incin Re)) imp (R_SIGMA(F) in Re)) &
	((Finite(F) & (range(F) incin Re)) imp (R_SIGMA(F) = R_SIGMA(F - {c}) R_PLUS cdr(c))) &
	((Finite(F) & Is_map(F) & (range(F) incin Re)) imp
		R_SIGMA(F) = R_SIGMA(F ON (domain(F) * T)) R_PLUS R_SIGMA(F ON (domain(F) - T))) &
	((Finite(F) & Svm(F) & Svm(G) & (domain(F) = domain(G)) & (range(F) incin Re)) imp
		(R_SIGMA(F) = R_SIGMA({[y,R_SIGMA(F ON (G INV_IM {y}))]: y in range(G)}))) &
	((Finite(F) & Svm(F) & one_1_map(G) & (domain(F) = domain(G)) & (range(F) incin Re)) imp
		(R_SIGMA(F) = R_SIGMA({[y,F~[inv(G)~[y]]]: y in range(G)}))). Proof:
	Suppose_not(x,f,c,t,g) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED

Def 81b: [Polynomial functions of a real variable] Polval(F,X) := R_SIGMA({F~[n] R_TIMES (X ToThe n): n in domain(F)})

Def 81g: [The real polynomial function corresponding to a formal polynomial] PolFcn(F) := {[x,Polval(F,x)]: x in Re}
--
-- Work with polynomials always involves consideration of polynomial functions along with the
-- corresponding formal operations on polymomials, wich are seen in the two following definitions.
--
Def 81c: [Formal sum of polynomials] Def(f PolPlus g) := {(if n in domain(f) then f~[n] else R_0 end if) R_PLUS (if n in domain(g) then g~[n] else R_0 end if): n in domain(f) + domain(g)}
--
Def 81d: [Formal difference of polynomials] Def(f PolMinus g) := {if n in domain(f) then f~[n] else R_0 end if R_PLUS if n in domain(g) then g~[n] else R_0 end if: n in domain(f) + domain(g)}
--
Def 81q: [Formal product of polynomials] Def(f PolTimes g) := {if n in domain(f) then f~[n] else R_0 end if R_PLUS if n in domain(g) then g~[n] else R_0 end if: n in domain(f) + domain(g)}
--
Def 81f: [Formal composition of polynomials ******** TO BE FILLED IN] Def(f PolComp g) := {if n in domain(f) then f~[n] else R_0 end if R_PLUS if n in domain(g) then g~[n] else R_0 end if: n in domain(f) + domain(g)}

Def 82: [Pointwise sum of Real Functions] Def(f F_PLUS g) := {[x,f~[x] R_PLUS g~[x]]: x in Re}
Def 82a: [Pointwise difference of Real Functions] Def(f F_MINUS g) := {[x,f~[x] R_MINUS g~[x]]: x in Re}
Def 83: [Pointwise product of Real Functions] Def(f F_TIMES g) := {[x,f~[x] R_TIMES g~[x]]: x in Re}
Def 83a: [Pointwise quotient of Real Functions] Def(f F_OVER g) := {[x,f~[x] R_OVER g~[x]]: x in Re | g~[x] /= R_0}
Def 85: [Constant zero function] RF_0 := {[x,R_0]: x in Re}
Def 85a: [Constant unit function] RF_1 := {[x,R_1]: x in Re}

--
-- The formal operations on polymials correspond to the actual operations on polynomial functions.
--
Theorem 792: ((F in Fin_Seqs(Re)) & (G in Fin_Seqs(Re)) & (X in Re)) imp (((Polval(F,X) R_PLUS Polval(G,X)) = Polval(F PolPlus G,X)) & ((Polval(F,X) R_MINUS Polval(G,X)) = Polval(F PolMinus G,X)) & ((Polval(F,X) R_TIMES Polval(G,X)) = Polval(F PolTimes G,X))). Proof:
	Suppose_not(f,g,x) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
-- We can of course restate the preceding theorem in terms of the set of real functions and the pointwise operations on them.
--
Theorem 793: ((F in Fin_Seqs(Re)) & (G in Fin_Seqs(Re))) imp (((PolFcn(F) F_PLUS PolFcn(G)) = PolFcn(F PolPlus G)) & ((PolFcn(F) F_MINUS PolFcn(G)) = PolFcn(F PolMinus G)) & ((PolFcn(F) F_TIMES PolFcn(G)) = PolFcn(F PolTimes G))). Proof:
	Suppose_not(f,g) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
-- If $f$ is a real continuous function on a set $S$, and $g$ is a real Cauchy sequence with values in $S$,
-- then the image $h$ of $g$ under $f$ satisfies $f(limit(g)) = limit(h)$.
--
Theorem 794: [Continuous functions map limits into limits] (Cf_RR(F,S) & (G in ReCauchy) & (range(G) incin S)) imp ((F @ G in ReCauchy) & (limit(F @ G) = F~[limit(G)])). Proof:
	Suppose_not(f,s,g) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 795: [The pointwise sum and product of two real continuous functions on two sets is continuous on their intersection] (Cf_RR(F,S) & Cf_RR(G,S2)) imp (Cf_RR(F Res_PLUS G,S * S2) & Cf_RR(F Res_TIMES G,S * S2)). Proof:
	Suppose_not(f,s,g,s2) ==> AUTO
        APPLY() pointwise(fq->f,fp->g,h->(f Res_PLUS g),d->Za,r->Re,bop(x,y)->(x R_PLUS y)) ==>
		((f Res_PLUS g) = {[u,((f~[u]) R_PLUS (g~[u]))]: u in Za}) &
                Svm(f Res_PLUS g) & (domain(f Res_PLUS g) = Za) & (range(f Res_PLUS g) incin Re)
        APPLY() pointwise(fq->f,fp->g,h->(f Res_TIMES g),d->Za,r->Re,bop(x,y)->(x R_TIMES y)) ==>
		((fq Res_TIMES fp) = {[u,((fq~[u]) R_TIMES (fp~[u]))]: u in Za}) &
                Svm(f Ras_TIMES g) & (domain(f Res_TIMES g) = Za) & (range(f Res_TIMES g) incin Re)
        APPLY() pointwiseU(fp->g,h->Res_ABS(g),d->Za,r->Re,uop(x)->abs(x)) ==>
		(Res_ABS(g) = {[u,abs(g~[u])]: u in Za}) &
                Svm(Res_ABS(g)) & (domain(Res_ABS(g)) = Za) & (range(Res_ABS(g)) incin Re)
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 796: [The quotient of two real continuous functions on two sets is continuous on the set of points in their intersection at which the denominator is nonzero] (Cf_RR(F,S) & Cf_RR(G,S2)) imp Cf_RR(F Res_OVER G,{x in S * S2 | G~[x] /= R_0}). Proof:
	Suppose_not(f,s,g,s2) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 797: [The composition of two real continuous functions is continuous.] (Cf_RR(F,S) & Cf_RR(G,T) & (range(G ON T) incin S)) imp Cf_RR(F @ G,T). Proof:
	Suppose_not(f,s,g,t) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
-- Since applications of the general theorems proved in the present section will often refer to particular functions,
-- we give a few easy theorems which prove that a few basic kinds of functions are continuous.
--
Theorem 798: [Polynomial functions are continuous everywhere] (F in Fin_Seqs(Re)) imp Cf_RR(PolFcn(F),Re). Proof:
	Suppose_not(f) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 799: [Polynomial quotients are continuous wherever their denominator is nonzero] ((F in Fin_Seqs(Re)) & (G in Fin_Seqs(Re))) imp Cf_RR(F F_OVER G,{x in Re | G~[x] /= R_0}). Proof:
	Suppose_not(f,g) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
-- Next we prove the basic fact that a real-valued function of a real variable continuous on the closed interval $[x,y]$
-- of real numbers which is negative at $x$ and positive at $y$ must be zero at some point $u$
-- between $x$ and $y$, i.e. $f(u) = 0$. It is to guarantee this basic property of the 'real continuum'
-- that the careful and elaborate construction of the real numbers as equivalence classes of Cauchy
-- sequences was devised (by Georg Cantor).
--
Theorem 800: [Crossing-completness principle for the real numbers] ((Cf_RR(F,I(X,Y)) & (X in Re) & (Y in Re) & (R_0 R_GE (F~[X])) & (R_0 R_LE (F~[Y])) & (X R_LE Y)) imp (EXISTS v | ((X R_LE v) & (v R_LE Y) & ((F~[v]) = R_0)))). Proof:
	Suppose_not(f,x,y) ==> AUTO
--
-- This theorem, like many of the other basic theorems of real analysis following below, will be
-- proved using the existence and properties of the least upper bound. Let s be the set of all
-- points $u in I(x,y)$ at which $f~[u]$ is non-negative, and let $w$ be the least upper bound of $s$.
--
-- Then since $w$ is the limit of a sequence of points in $s$, $f~[w]$ must be non-negative.
-- On the other hand $f~[w]$ cannot be strictly positive, since if it were it would be less than $y$,
-- and then since $f$ is continuous it would be non-negative on an entire interval containing $w$,
-- contradicting the fact that $w$ is an upper bound of $s$.
--
-- This contradiction proves our theorem.
--
	Tsomehow ==> false; Discharge ==> QED
--
-- Using Theorem 800 we show that every non-negative real number has a non-negative square root,
-- and then that this square root is unique, and that the square root function is monotone increasing.
-- The following simple theorems collect these elementary properties of the real square root.
--

--
-- Next we prove another of the basic theorems of real analysis: Every function continuous
-- on a bounded closed set of reals attains its maximum.
--
Theorem 801: (Cf_RR(F,S) & BoundedClosedRe(S)) imp (EXISTS u in S | (FORALL v in S | F~[u] R_GE F~[v])). Proof:
	Suppose_not(f,s) ==> AUTO
--
-- Again we use the properties of the least upper bound. First we prove that the function $f$ must be bounded above.
-- Indeed, suppose the contrary, and let $I(x,y)$ be a closed interval including $s$. Consider the set $t$ of points $w$
-- in this interval such that $f$ is bounded on $s * I(x,w)$, and let $u$ be the least upper bound of $t$. $u$ must belong to $s$,
-- since otherwise some interval $I(a,b)$ about $u$ would be disjoint from $s$, and then plainly $f$ would be bounded on $s * I(x,b)$,
-- contradicting the fact that $f$ must be unbounded on $s * I(x,c)$ for every $c$ larger than $u$, and so proving our claim.
--
-- Now that we know that the range of $f$ is bounded above, let $ub$ be its least upper bound, and consider the set $t$ of points $w$
-- in $I(x,y)$ such that all the values in $range(f ON (s * I(x,t)))$ are less than $ub$. Let $t1$ be the least upper bound of these $t$.
-- If $f~[t1] R_LT ub$, then $f$ is less than $ub$ on an interval about $t1$, contradicting the definition
-- of $t1$ as a least upper bound.
--
-- It follows that $f~[t1] = ub$, and since $ub$ is an upper bound for $range(f ON s)$ our theorem is proved.
--
	Tsomehow ==> false; Discharge ==> QED
--
-- The fact that constant real functions are continuous is trivial.
--
-- It follows as a corollary that every function continuous
-- on a bounded closed set of reals attains its minimum.
--
Theorem 802: (Cf_RR(F,S) & BoundedClosedRe(S)) imp (EXISTS u in I(X,Y) | (FORALL v in S | F~[u] R_LE F~[v])). Proof:
	Suppose_not(f,s,x,y) ==> AUTO
-- To prove the present we have only to apply the preceding theorem to the reversal RF_0 F_MINUS F of  F.
	Tsomehow ==> false; Discharge ==> QED
--
-- Together, the results just proved tell us that a function continuous on a closed interval
-- of reals maps this domain onto a second closed interval of reals.
--
Theorem 803: (Cf_RR(F,I(X,Y)) & (X in Re) & (Y in Re)) imp (EXISTS u in I(X,Y), v in  I(X,Y) | range(F ON I(X,Y)) = I(f~[u],f~[v])). Proof:
	Suppose_not(f,x,y) ==> AUTO
--
-- For let $m$ be the minimum and $M$ the maximum value of $f$. Then by Theorems 681a and b,
-- there exist points $x1$ and $y1$ in $I(x,y)$ such that $f~[x1]$ is the minimum and $f~[y1]$ the maximum
-- of $f$.
--
-- It follows that $range(f) incin I(f~[x1],f~[y1])$. Hence if $range(f) /= I(f~[x1],f~[y1])$,
-- there must exist a $c$ in $I(f~[x1],f~[y1])$ which is not in $range(f)$. But then $f~[x1] R_MINUS c$
-- is nonpositive and $f~[y1] R_MINUS c$ is non-negative. But then, applying Theorem 800 to the
-- continuous function $f F_MINUS (Re PROD {c})$, it follows that there must exist a $u in I(x1,y1)$ such that
-- $(f~[u]) R_MINUS c = R_0$, i.e. $(f~[u]) = c$, so that $c$ is in $range(f)$, a contradiction which proves our theorem.
--
Tsomehow ==> false; Discharge ==> QED
--
-- As the last in the present series of basic theorems of real analysis, we prove the Heine-Borel theorem:
-- Any covering of a bounded closed set by the interiors of a set $T$ of intervals is covered by a finite subset of the intervals in $T$.
--
Theorem 804: (BoundedClosedRe(S) & (S incin Un({OI(car(ends),cdr(ends)): ends in T})) & (FORALL ends in T | ends in (Re PROD Re))) imp (EXISTS t1 | (t1 incin T) & Finite(t1) & (S incin Un({OI(car(ends),cdr(ends)): ends in t1}))). Proof:
	Suppose_not(s,t) ==> AUTO
--
-- We prove the present result, like those which have gone before it, by using the least upper bound principle.
-- Let $bl$ and $bu$ respectively be a lower and upper bounds for the set $s$, and consider the collection $v$ of all $c$ in $s$
-- such that $s * I(bl,c)$ is covered by the interiors of a finite subset of the intervals in $T$. Let $u$ be the
-- least upper bound of these $c$.
--
-- $u$ must belong to $s$, since otherwise $v$ would have a smaller upper bound. Nut the $s$ is contained
-- in the interior of some one of the intervals $I(a,b)$ of $T$, and $s * I(bl,a)$ is contained in the
-- union of the interiors of some finite subset $T1$ of $T$. It follows that all the points interior to
-- $I(a,b)$ must belong to $s$, contradicting the fact that $v$ is an upper bound of $s$.
--
-- This contradiction completes the proof of our theorem.
--
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 805: [Square of binomials] ((X in Re) & (Y in Re)) imp ( ((X R_PLUS Y) R_TIMES (X R_PLUS Y)) = ((X R_TIMES X) R_PLUS (Y R_TIMES Y)) R_PLUS ((X R_TIMES Y) R_PLUS (X R_TIMES Y)) ). Proof:
Suppose_not(x,y) ==> AUTO
	ALGEBRA ==> (((x R_PLUS y) R_TIMES (x R_PLUS y)) = (x R_TIMES (x R_PLUS y)) R_PLUS (y R_TIMES (x R_PLUS y))) &
		((x R_TIMES (x R_PLUS y)) = ((x R_TIMES x) R_PLUS (x R_TIMES y))) &
		((y R_TIMES (x R_PLUS y)) = ((y R_TIMES y) R_PLUS (x R_TIMES y))) &
		(((x R_TIMES x) R_PLUS (x R_TIMES y)) R_PLUS ((y R_TIMES y) R_PLUS (x R_TIMES y)) = ((x R_TIMES x) R_PLUS (y R_TIMES y)) R_PLUS ((x R_TIMES y) R_PLUS (x R_TIMES y)))
	EQUAL ==> false; Discharge ==> QED
--
Theorem 806: [Square of binomials, 2] ((X in Re) & (Y in Re)) imp ( ((X R_MINUS Y) R_TIMES (X R_MINUS Y)) = ((X R_TIMES X) R_PLUS (Y R_TIMES Y)) R_MINUS ((X R_TIMES Y) R_PLUS (X R_TIMES Y)) ). Proof:
Suppose_not(x,y) ==> AUTO
	(y,y)-->T613(*) ==> (R_Rev(y) in Re)
	(x,R_Rev(y))-->T805(*) ==> ((x R_PLUS R_Rev(y)) R_TIMES (x R_PLUS R_Rev(y))) = ((x R_TIMES x) R_PLUS (R_Rev(y) R_TIMES R_Rev(y))) R_PLUS ((x R_TIMES R_Rev(y)) R_PLUS (x R_TIMES R_Rev(y)))
	(x,y)-->T635(*) ==> ((x R_MINUS y) = (x R_PLUS R_Rev(y)))
	(y,y)-->T623(*) ==> (R_Rev(y) R_TIMES R_Rev(y) = y R_TIMES y)
	(x,y)-->T623(*) ==> (x R_TIMES R_Rev(y)) = R_Rev(x R_TIMES y)
--??	ALGEBRA ==> ((x R_TIMES y) in Re) & ((x R_TIMES x) in Re) & ((y R_TIMES y) in Re)
	(x,y)-->T614(*) ==> (x R_TIMES y) in Re
	(x R_TIMES y,x R_TIMES y)-->T638(*) ==> R_Rev(x R_TIMES y) R_PLUS R_Rev(x R_TIMES y) = R_Rev((x R_TIMES y) R_PLUS (x R_TIMES y))
	(x,x)-->T614(*) ==> (x R_TIMES x) in Re
	(y,y)-->T614(*) ==> (y R_TIMES y) in Re
	(x R_TIMES x,y R_TIMES y)-->T613(*) ==> ((x R_TIMES x) R_PLUS (y R_TIMES y)) in Re
	(x R_TIMES y,x R_TIMES y)-->T613(*) ==> ((x R_TIMES y) R_PLUS (x R_TIMES y)) in Re
	((x R_TIMES x) R_PLUS (y R_TIMES y),(x R_TIMES y) R_PLUS (x R_TIMES y))-->T635(*) ==> ((x R_TIMES x) R_PLUS (y R_TIMES y)) R_PLUS R_Rev((x R_TIMES y) R_PLUS (x R_TIMES y)) = ((x R_TIMES x) R_PLUS (y R_TIMES y)) R_MINUS ((x R_TIMES y) R_PLUS (x R_TIMES y))
	EQUAL ==> false; Discharge ==> QED
--
Theorem 807: [Noticeable product of binomials] ((X in Re) & (Y in Re)) imp (((X R_MINUS Y) R_TIMES (X R_PLUS Y)) = ((X R_TIMES X) R_MINUS (Y R_TIMES Y))). Proof:
Suppose_not(x,y) ==> AUTO
	ALGEBRA ==> ((x R_MINUS y) R_TIMES (x R_PLUS y)) = ((x R_TIMES x) R_MINUS (y R_TIMES x)) R_PLUS ((y R_TIMES x) R_MINUS (y R_TIMES y))
	ALGEBRA ==> ((x R_TIMES x) R_MINUS (y R_TIMES x)) R_PLUS ((y R_TIMES x) R_MINUS (y R_TIMES y)) = ((x R_TIMES x) R_PLUS ((y R_TIMES x) R_MINUS (y R_TIMES x))) R_MINUS (y R_TIMES y)
	ALGEBRA ==> ((x R_TIMES x) R_PLUS ((y R_TIMES x) R_MINUS (y R_TIMES x))) = (x R_TIMES x)
	EQUAL ==> false; Discharge ==> QED
--
Theorem 808: [The square of the square root of any positive $x$ is $x$] ((X in Re) & (R_is_nonneg(X))) imp ((sqrt(X) in Re) & (R_is_nonneg(sqrt(X))) & ((sqrt(X) R_TIMES sqrt(X)) = X)). Proof:
Suppose_not(x) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 809: [The positive square root is unique] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & ((Y R_TIMES Y) = X)) imp (Y = sqrt(X)). Proof:
Suppose_not(x,y) ==> AUTO
	x-->T808(*) ==> Stat1: (sqrt(x) in Re) & R_is_nonneg(sqrt(x)) & ((sqrt(x) R_TIMES sqrt(x)) = (y R_TIMES y)) & (y in Re)
	ALGEBRA(Stat1) ==> (((y R_TIMES y) R_MINUS (y R_TIMES y)) = R_0) &
		((sqrt(x) R_MINUS y) in Re) &
		((sqrt(x) R_PLUS y) in Re)
	EQUAL ==> ((sqrt(x) R_TIMES sqrt(x)) R_MINUS (y R_TIMES y)) = R_0
	(sqrt(x),y)-->T807(*) ==> ((sqrt(x) R_MINUS y) R_TIMES (sqrt(x) R_PLUS y)) = R_0
	(sqrt(x) R_MINUS y,sqrt(x) R_PLUS y)-->T700(*) ==> ((sqrt(x) R_MINUS y) = R_0) or ((sqrt(x) R_PLUS y) = R_0)
	Suppose ==> (sqrt(x) R_MINUS y) = R_0
		ALGEBRA(Stat1,Stat1) ==> (R_0 R_PLUS y = y) & ((sqrt(x) R_MINUS y) R_PLUS y = sqrt(x))
	EQUAL ==> false; Discharge ==> (sqrt(x) R_PLUS y) = R_0
	(sqrt(x),y)-->T711(*) ==> sqrt(x) = y
	Discharge ==> QED
--
Theorem 810: [The square root is monotone increasing for positive numbers] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y) & (X R_GT Y)) imp (sqrt(X) R_GT sqrt(Y)). Proof:
Suppose_not(x0,y0) ==> AUTO
	x0-->T808(*) ==> Stat1: (sqrt(x0) in Re) & R_is_nonneg(sqrt(x0)) & ((sqrt(x0) R_TIMES sqrt(x0)) = x0)
	y0-->T808(*) ==> Stat2: (sqrt(y0) in Re) & R_is_nonneg(sqrt(y0)) & ((sqrt(y0) R_TIMES sqrt(y0)) = y0)
	(sqrt(x0),sqrt(y0))-->T667(*) ==> R_is_nonneg(sqrt(x0) R_PLUS sqrt(y0))
--
-- The two square roots can clearly not be equal, so one of the two must be greater.
-- Therefore their sum cannot be $R_0$, else both of them would equal $R_0$.
--
	Suppose ==> sqrt(x0) = sqrt(y0)
		EQUAL(Stat1) ==> x0 = y0
	Use_def(R_GT)(*) ==> false; Discharge ==> AUTO
	(sqrt(x0),sqrt(y0))-->T699(*) ==> (sqrt(x0) R_PLUS sqrt(y0)) /= R_0
--
-- But $sqrt(y0)$ cannot be greater than $sqrt(x0)$, since if it were $y0$ would be greater than $x0$, contrary to assumption.
-- Thus $sqrt(x0)$ must be greater than $sqrt(y0)$, proving our theorem.
--
	Use_def(R_GT)(*) ==> Stat3: R_is_nonneg(x0 R_MINUS y0) & (x0 /= y0) & (x0 in Re) & (y0 in Re)
	Suppose ==> x0 R_MINUS y0 = R_0
		EQUAL(Stat3) ==> (x0 R_MINUS y0) R_PLUS y0 = R_0 R_PLUS y0
	ALGEBRA(Stat3) ==> false; Discharge ==> AUTO
	(sqrt(x0),sqrt(y0))-->T807(*) ==> ((sqrt(x0) R_MINUS sqrt(y0)) R_TIMES (sqrt(x0) R_PLUS sqrt(y0))) =
			((sqrt(x0) R_TIMES sqrt(x0)) R_MINUS (sqrt(y0) R_TIMES sqrt(y0)))
	ALGEBRA(Stat1,Stat2) ==> ((sqrt(x0) R_PLUS sqrt(y0)) R_TIMES (sqrt(x0) R_MINUS sqrt(y0))) = ((sqrt(x0) R_MINUS sqrt(y0)) R_TIMES (sqrt(x0) R_PLUS sqrt(y0)))
	EQUAL(Stat1) ==> R_is_nonneg((sqrt(x0) R_PLUS sqrt(y0)) R_TIMES (sqrt(x0) R_MINUS sqrt(y0))) &
		(((sqrt(x0) R_PLUS sqrt(y0)) R_TIMES (sqrt(x0) R_MINUS sqrt(y0))) /= R_0)
	ALGEBRA(Stat1,Stat2) ==> ((sqrt(x0) R_PLUS sqrt(y0)) in Re) & ((sqrt(x0) R_MINUS sqrt(y0)) in Re)
	(sqrt(x0) R_PLUS sqrt(y0),sqrt(x0) R_MINUS sqrt(y0))-->T700(*) ==> ((sqrt(x0) R_PLUS sqrt(y0)) /= R_0) & ((sqrt(x0) R_MINUS sqrt(y0)) /= R_0)
	Use_def(R_GT)(*) ==> not(R_is_nonneg(sqrt(x0) R_MINUS sqrt(y0)))
	(sqrt(x0) R_PLUS sqrt(y0),sqrt(x0) R_MINUS sqrt(y0))-->T706(*) ==> false; Discharge ==> QED
--
Theorem 811: [The square root of a product is the product of the square roots] ((X in Re) & (Y in Re) & R_is_nonneg(X) & R_is_nonneg(Y)) imp (sqrt(X R_TIMES Y) = (sqrt(X) R_TIMES sqrt(Y))). Proof:
Suppose_not(n,m) ==> AUTO
	n-->T808(*) ==> Stat1: (sqrt(n) in Re) & ((sqrt(n) R_TIMES sqrt(n)) = n) & (R_is_nonneg(sqrt(n))) & (n in Re)
	m-->T808(*) ==> (sqrt(m) in Re) & ((sqrt(m) R_TIMES sqrt(m)) = m) & (R_is_nonneg(sqrt(m))) & (m in Re)
	ALGEBRA(Stat1) ==> (((sqrt(n) R_TIMES sqrt(m)) R_TIMES (sqrt(n) R_TIMES sqrt(m))) = ((sqrt(n) R_TIMES sqrt(n)) R_TIMES (sqrt(m) R_TIMES sqrt(m)))) & ((n R_TIMES m) in Re) & ((sqrt(n) R_TIMES sqrt(m)) in Re)
	EQUAL(Stat1) ==> ((sqrt(n) R_TIMES sqrt(m)) R_TIMES (sqrt(n) R_TIMES sqrt(m))) = (n R_TIMES m)
	(sqrt(n),sqrt(m))-->T667(Stat1) ==> R_is_nonneg(sqrt(n) R_TIMES sqrt(m))
	(n,m)-->T667(*) ==> R_is_nonneg(n R_TIMES m)
	(n R_TIMES m,sqrt(n) R_TIMES sqrt(m))-->T809(*) ==> false; Discharge ==> QED
--
Theorem 812: [The square of the square root of any real $w=(x R_TIMES x) R_PLUS (y R_TIMES y)$ is $w$] ((X in Re) & (Y in Re)) imp (sqrt((X R_TIMES X) R_PLUS (Y R_TIMES Y)) R_TIMES sqrt((X R_TIMES X) R_PLUS (Y R_TIMES Y)) = ((X R_TIMES X) R_PLUS (Y R_TIMES Y))). Proof:
Suppose_not(x,y) ==> Stat1: (x in Re) & (y in Re) & (sqrt((x R_TIMES x) R_PLUS (y R_TIMES y)) R_TIMES sqrt((x R_TIMES x) R_PLUS (y R_TIMES y)) /= ((x R_TIMES x) R_PLUS (y R_TIMES y)))
	T721(*) ==> Stat2: (FORALL x,y | ((x in Re) & (y in Re)) imp ((R_is_nonneg(x) & R_is_nonneg(y)) imp R_is_nonneg(x R_PLUS y)))
	x-->T714(Stat1,Stat1*) ==> Stat3: R_is_nonneg(x R_TIMES x)
	y-->T714(Stat1,Stat1*) ==> Stat4: R_is_nonneg(y R_TIMES y)
	ALGEBRA(Stat1,Stat1*) ==> Stat5: ((x R_TIMES x) in Re) & ((y R_TIMES y) in Re) & (((x R_TIMES x) R_PLUS (y R_TIMES y)) in Re)
	(x R_TIMES x,y R_TIMES y)-->Stat2(Stat3,Stat4,Stat5*) ==> Stat6: R_is_nonneg((x R_TIMES x) R_PLUS (y R_TIMES y))
	((x R_TIMES x) R_PLUS (y R_TIMES y))-->T808(Stat1,Stat6,Stat5*) ==> false; Discharge ==> QED
--
-- ************************************************************************************************
--			Section 14a: basic theorems of the differential calculus of real functions
-- ************************************************************************************************

--
-- A real-valued function defined
--

Def 88: [Difference-and-diagonal trick for defining the derivative] DD(f,df) := {if x~[0] /= x~[1] then (f~[x~[0]] R_MINUS f~[x~[1]]) R_OVER (x~[0] R_MINUS x~[1])
					else df~[x~[0]] end if: x in Euc(2)}
--
Def 89: [Derivative of function of a real variable] Der(f) := arb({df in Za | domain(f) = domain(df) &		-- FIX TEMP PATCH Za ********
		is_continuous_REnF(DD(f,df) ON (domain(f) PROD domain(f)),2)})
--
Theorem 813: ((N in Si) & (M in Si) & (M /= [0,0]) & is_nonneg(M)) imp
	(EXISTS k in Si | is_nonneg(N S_MINUS (k S_TIMES M)) & is_nonneg(((k S_PLUS [1,0])S_TIMES M)) S_MINUS N). Proof:
    Suppose_not(n,m) ==> (n in Si) & (m in Si) & (m /= [0,0]) & is_nonneg(m) &
	(not(EXISTS k in Si | is_nonneg(n S_MINUS (k S_TIMES m)) & is_nonneg(((k S_PLUS [1,0]) S_TIMES m)) S_MINUS n))
    THUS ==> false; Discharge ==> QED
--
--
Theorem 814: ((N in Re) & (M in Re)) imp (((abs(N) R_PLUS abs(M)) R_GT abs(N R_MINUS M)) or ((abs(N) R_PLUS abs(M)) = abs(N R_MINUS M))). Proof:
Suppose_not(n,m) ==> AUTO
	(n,m)-->T635(*) ==> (n R_MINUS m) = (n R_PLUS R_Rev(m))
	m-->T727(*) ==> abs(m) = abs(R_Rev(m))
	EQUAL ==> not(abs(n) R_PLUS abs(R_Rev(m)) R_GT abs(n R_PLUS R_Rev(m)) or
			abs(n) R_PLUS abs(R_Rev(m)) = abs(n R_PLUS R_Rev(m)))
	ALGEBRA ==> R_Rev(m) in Re
    (n,R_Rev(m))-->T731(*) ==> false; Discharge ==> QED
--
-- ************************************************************************************************
--								Section 15: Complex numbers
-- ************************************************************************************************
--
Def 170: [The set of complex numbers] Cm := Re PROD Re
Def 171: [Complex addition] Def(X C_PLUS Y) := [car(X) R_PLUS car(Y),cdr(X) R_PLUS cdr(Y)]
Def 172: [Complex product]
    Def(X C_TIMES Y) := [(car(X) R_TIMES car(Y)) R_MINUS (cdr(X) R_TIMES cdr(Y)),
		(car(X) R_TIMES cdr(Y)) R_PLUS (cdr(X) R_TIMES car(Y))]
Def 173: [The complex norm] C_abs(X) := sqrt((car(X) R_TIMES car(X)) R_PLUS (cdr(X) R_TIMES cdr(X)))
Def 174: [The complex reciprocal]
    C_Recip(x) := [car(x) R_OVER (C_abs(x) R_TIMES C_abs(x)),R_Rev(cdr(x)) R_OVER (C_abs(x) R_TIMES C_abs(x))]
--
Def 175: [Complex Quotient] Def(X C_OVER Y) := X C_TIMES C_Recip(Y)
Def 176: [Complex negative] C_Rev(X) := [R_Rev(car(X)),R_Rev(cdr(X))]
Def 177: [Complex difference] Def(N C_MINUS M) := N C_PLUS C_Rev(M)
Def 178: [Complex zero] C_0 := [R_0,R_0]
Def 179: [Complex unity] C_1 := [R_1,R_0]
--
Theorem 815: ((X in Re) & (Y in Re)) imp ([X,Y] in Cm). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def(Cm) ==> [x0,y0] notin (Re PROD Re)
	Use_def(PROD) ==> Stat1: [x0,y0] notin {[x,y]: x in Re, y in Re}
(x0,y0)-->Stat1(*) ==> false; Discharge ==> QED
--
Theorem 816: (M in Cm) eq ((M = [car(M),cdr(M)]) & (car(M) in Re) & (cdr(M) in Re)). Proof+:
Suppose_not(m) ==> AUTO
	Use_def(Cm) ==> Stat0: (Cm = (Re PROD Re)) & (not((m in (Re PROD Re)) eq ((m = [car(m),cdr(m)]) & (car(m) in Re) & (cdr(m) in Re))))
	Suppose ==> Stat1: m in (Re PROD Re)
		(m,Re,Re)-->T140(Stat1*) ==> (car(m) in Re) & (cdr(m) in Re)
		({m},Re,Re)-->T141(Stat1*) ==> Is_map({m})
	({m},m)-->T51(Stat0*) ==> false; Discharge ==> Stat2: (m = [car(m),cdr(m)]) & (car(m) in Re) & (cdr(m) in Re) & (m notin Cm)
(car(m),cdr(m))-->T815(Stat2*) ==> false; Discharge ==> QED
--
Theorem 817: (C_0 in Cm) & (C_1 in Cm). Proof:
Suppose_not ==> (C_0 notin Cm) or (C_1 notin Cm)
	Use_def(C_0) ==> C_0 = [R_0,R_0]
	Use_def(C_1) ==> C_1 = [R_1,R_0]
	T612 ==> (R_1 in Re) & (R_0 in Re)
	(R_0,R_0)-->T815 ==> C_0 in Cm
(R_1,R_0)-->T815 ==> false; Discharge ==> QED
--
Theorem 818: ((N in Cm) & (M in Cm)) imp ((N C_PLUS M in Cm) & (N C_TIMES M in Cm)). Proof:
Suppose_not(n,m) ==> AUTO
    n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re)
    m-->T816(*) ==> Stat2: (car(m) in Re) & (cdr(m) in Re)
    Use_def(C_PLUS)(*) ==> Stat3: n C_PLUS m = [car(n) R_PLUS car(m),cdr(n) R_PLUS cdr(m)]
    (car(n),car(m))-->T613(Stat1, Stat2*) ==> car(n) R_PLUS car(m) in Re
    (cdr(n),cdr(m))-->T613(Stat1, Stat2*) ==> cdr(n) R_PLUS cdr(m) in Re
    (car(n) R_PLUS car(m), cdr(n) R_PLUS cdr(m))-->T815(Stat3*) ==> n C_PLUS m in Cm
--
    Use_def(C_TIMES) ==> Stat4: (n C_TIMES m) =
        [(car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m)),
         (car(n) R_TIMES cdr(m)) R_PLUS  (cdr(n) R_TIMES car(m))]
    (car(n), car(m))-->T614(Stat1, Stat2*) ==> Stat5: (car(n) R_TIMES car(m)) in Re
    (cdr(n), cdr(m))-->T614(Stat1, Stat2*) ==> (cdr(n) R_TIMES cdr(m)) in Re
    ((car(n) R_TIMES car(m)), (cdr(n) R_TIMES cdr(m)))-->T614(Stat5*) ==> (car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m)) in Re
    (car(n), cdr(m))-->T614(Stat1, Stat2*) ==> Stat6: (car(n) R_TIMES cdr(m)) in Re
    (cdr(n), car(m))-->T614(Stat1, Stat2*) ==> (cdr(n) R_TIMES car(m)) in Re
    (car(n) R_TIMES cdr(m),  cdr(n) R_TIMES car(m))-->T613(Stat6*) ==> (car(n) R_TIMES cdr(m)) R_PLUS (cdr(n) R_TIMES car(m)) in Re
((car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m)), (car(n) R_TIMES cdr(m)) R_PLUS (cdr(n) R_TIMES car(m)))-->T815(*) ==> false; Discharge ==> QED
--
Theorem 819: ((N in Cm) & (M in Cm)) imp (N C_PLUS M = M C_PLUS N). Proof:
Suppose_not(n,m) ==> Stat1: (n in Cm) & (m in Cm) & ((n C_PLUS m) /= (m C_PLUS n))
    m-->T816(*) ==> (car(m) in Re) & (cdr(m) in Re) & (m = [car(m),cdr(m)])
    n-->T816(*) ==> (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
    Use_def(C_PLUS)(Stat1,Stat1*) ==> Stat2: [car(n) R_PLUS car(m),cdr(n) R_PLUS cdr(m)] /= [car(m) R_PLUS car(n),cdr(m) R_PLUS cdr(n)]
    (Stat2)ELEM ==> ((car(n) R_PLUS car(m)) /= (car(m) R_PLUS car(n))) or (cdr(n) R_PLUS cdr(m) /= cdr(m) R_PLUS cdr(n))
    (car(n),car(m))-->T615(*) ==> (car(n) R_PLUS car(m)) = (car(m) R_PLUS car(n))
(cdr(n),cdr(m))-->T615(*) ==> false; Discharge ==> QED
--
Theorem 820: (N in Cm) imp ((N = N C_PLUS C_0) & (N = C_0 C_PLUS  N)). Proof:
Suppose_not(n) ==> AUTO
	T817(*) ==> C_0 in Cm
	(C_0,n)-->T819(*) ==> (C_0 C_PLUS n) = (n C_PLUS C_0)
	Suppose ==> n = (n C_PLUS C_0)
		EQUAL ==> n = (C_0 C_PLUS n)
	Discharge ==> Stat1: (n in Cm) & (n /= (n C_PLUS C_0))
	Use_def(C_PLUS)(Stat1,Stat1*) ==> Stat2: n /= [car(n) R_PLUS car(C_0),cdr(n) R_PLUS cdr(C_0)]
	Use_def(C_0)(Stat2,Stat2*) ==> Stat3: n /= [car(n) R_PLUS R_0,cdr(n) R_PLUS R_0]
	n-->T816(Stat1,Stat1*) ==> Stat4: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
	(car(n))-->T626(Stat4,Stat4*) ==> (car(n) R_PLUS R_0) = car(n)
	(cdr(n))-->T626(Stat4,Stat4*) ==> (cdr(n) R_PLUS R_0) = cdr(n)
EQUAL(Stat3) ==> false; Discharge ==> QED
--
--
Theorem 821: (N in Cm) imp ((C_Rev(N) in Cm) & (C_Rev(C_Rev(N)) = N)). Proof:
Suppose_not(n) ==> AUTO
--
-- For, assuming the contrary to hold for $n$, we readily discard the possibility
-- $C_Rev(n) notin Cm$ by exploiting the definition of $C_Rev(n)$ and the fact that
-- the set of reals is closed relative to the operation $R_Rev$.
--
	n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
	Use_def(C_Rev(n)) ==> AUTO
	(car(n), car(n))-->T613(Stat1,Stat1*) ==> (R_Rev(car(n)) in Re)
	(cdr(n), cdr(n))-->T613(Stat1,Stat1*) ==> (R_Rev(cdr(n)) in Re)
	(R_Rev(car(n)), R_Rev(cdr(n)))-->T815(*) ==> Stat2: C_Rev(C_Rev(n)) /= n
--
-- The other possibility, namely $C_Rev(C_Rev(n)) /= [car(n),cdr(n)]$,
-- is discharged with equal ease, thanks to the definition of $C_Rev(C_Rev(n))$
-- and to the identity $R_Rev(R_Rev(X)) = X$ holding for all reals $X$.
--
	Use_def(C_Rev)(Stat1,Stat2*) ==> Stat3: [R_Rev(R_Rev(car(n))),R_Rev(R_Rev(cdr(n)))] /= [car(n),cdr(n)]
	(car(n))-->T633(Stat1,Stat1*) ==> R_Rev(R_Rev(car(n))) = car(n)
	(cdr(n))-->T633(Stat1,Stat1*) ==> R_Rev(R_Rev(cdr(n))) = cdr(n)
EQUAL(Stat3) ==> false; Discharge ==> QED
--
Theorem 822: (N in Cm) imp (C_Rev(N) C_PLUS N = C_0). Proof:
Suppose_not(n) ==> AUTO
--
-- For, assuming the contrary to hold for $n$, we readily reach a contradiction
-- by exploiting the definitions of $C_Rev(n)$, $C_Rev(n) C_PLUS n$, and $C_0$,
-- and the identity $R_Rev(X) R_PLUS X = R_0$.
--
	n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re)
	Use_def(C_PLUS) ==> Stat2: [car(C_Rev(n)) R_PLUS car(n), cdr(C_Rev(n)) R_PLUS cdr(n)] /= C_0
	Use_def(C_Rev(n)) ==> AUTO
	(R_Rev(car(n)),R_Rev(cdr(n)))-->T9 ==> AUTO
	(car(n))-->T632(Stat1,Stat1*) ==> R_Rev(car(n)) R_PLUS car(n) = R_0
	(cdr(n))-->T632(Stat1,Stat1*) ==> R_Rev(cdr(n)) R_PLUS cdr(n) = R_0
	Use_def(C_0) ==> C_0 = [R_0,R_0]
EQUAL(Stat2) ==> false; Discharge ==> QED
--
Theorem 823: ((N in Cm) & (M in Cm)) imp (N = M C_PLUS (N C_MINUS M)). Proof:
Suppose_not(n,m) ==> AUTO
--
-- Basic properties of $n, m, C_Rev(m)$:
--
    n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
    m-->T816(*) ==> Stat2: (car(m) in Re) & (cdr(m) in Re)
    (car(m))-->T632(Stat2*) ==> Stat3: R_Rev(car(m)) in Re
    (cdr(m))-->T632(Stat2*) ==> Stat4: R_Rev(cdr(m)) in Re
    m-->T821(*) ==> C_Rev(m) in Cm
    (C_Rev(m))-->T816(Stat3*) ==> (car(C_Rev(m)) in Re) & (cdr(C_Rev(m)) in Re)
    Use_def(C_Rev)(Stat5) ==> Stat5: (car(C_Rev(m)) = R_Rev(car(m))) &
		(cdr(C_Rev(m)) = R_Rev(cdr(m)))
--
-- We rewrite the negation of the desired conclusion by exploiting the definition of $C_MINUS$;...
--
    Use_def(C_PLUS)(Stat6) ==> Stat6: (car(n C_PLUS C_Rev(m)) = car(n) R_PLUS car(C_Rev(m))) &
		(cdr(n C_PLUS C_Rev(m)) = cdr(n) R_PLUS cdr(C_Rev(m)))
    Use_def(C_MINUS)(*) ==> n /= m C_PLUS (n C_PLUS C_Rev(m))
--
-- ... and then, by taking the commutative property of $R_PLUS$ into account,...
--
    (car(n), R_Rev(car(m)))-->T615(Stat1, Stat2, Stat3*) ==> car(n) R_PLUS R_Rev(car(m)) = R_Rev(car(m)) R_PLUS car(n)
    (cdr(n), R_Rev(cdr(m)))-->T615(Stat1,Stat2,Stat4*) ==> cdr(n) R_PLUS R_Rev(cdr(m)) = R_Rev(cdr(m)) R_PLUS cdr(n)
    Use_def(C_PLUS)(*) ==> Stat7:
	(m C_PLUS (n C_PLUS C_Rev(m)) =
                 [car(m) R_PLUS car(n C_PLUS C_Rev(m)), cdr(m) R_PLUS cdr(n C_PLUS C_Rev(m))])
--
-- ...as well as associativity of real addition, we can further rewrite it.
--
    (car(m), R_Rev(car(m)), car(n))-->T617(*) ==>
        car(m) R_PLUS (R_Rev(car(m)) R_PLUS car(n)) = (car(m) R_PLUS R_Rev(car(m))) R_PLUS car(n)
    (cdr(m), R_Rev(cdr(m)), cdr(n))-->T617(*) ==>
        cdr(m) R_PLUS (R_Rev(cdr(m)) R_PLUS cdr(n)) = (cdr(m) R_PLUS R_Rev(cdr(m))) R_PLUS cdr(n)
    EQUAL(Stat5) ==> n /=
        [(car(m) R_PLUS R_Rev(car(m))) R_PLUS car(n), (cdr(m) R_PLUS R_Rev(cdr(m))) R_PLUS cdr(n)]
--
-- However, the inequality which we have now reached conflicts with the algebra of reals,
-- which ensures equality of the two sides.
--
    (car(m), R_Rev(car(m)))-->T615(Stat1*) ==> car(m) R_PLUS R_Rev(car(m)) = R_Rev(car(m)) R_PLUS car(m)
    (cdr(m), R_Rev(cdr(m)))-->T615(Stat1*) ==> cdr(m) R_PLUS R_Rev(cdr(m)) = R_Rev(cdr(m)) R_PLUS cdr(m)
    (car(m))-->T632(Stat2, Stat2*) ==> R_Rev(car(m)) R_PLUS car(m) = R_0
    (cdr(m))-->T632(Stat2, Stat2*) ==> R_Rev(cdr(m)) R_PLUS cdr(m) = R_0
    (car(n))-->T626(Stat1, Stat1*) ==> R_0 R_PLUS car(n) = car(n)
    (cdr(n))-->T626(Stat1, Stat1*) ==> R_0 R_PLUS cdr(n) = cdr(n)
EQUAL(Stat1) ==> false; Discharge ==> QED
--
Theorem 824: ((N in Cm) & (M in Cm)) imp (N C_TIMES M = M C_TIMES N). Proof:
Suppose_not(n,m) ==> AUTO
    n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
    m-->T816(*) ==> Stat2: (car(m) in Re) & (cdr(m) in Re) & (m = [car(m),cdr(m)])
    Use_def(C_TIMES)(*) ==> n C_TIMES m = [(car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m)),(car(n) R_TIMES cdr(m)) R_PLUS (cdr(n) R_TIMES car(m))]
    Use_def(C_TIMES)(*) ==> m C_TIMES n = [(car(m) R_TIMES car(n)) R_MINUS (cdr(m) R_TIMES cdr(n)),(car(m) R_TIMES cdr(n)) R_PLUS (cdr(m) R_TIMES car(n))]
    (car(n), car(m))-->T618(Stat1, Stat2*) ==> (car(n) R_TIMES car(m)) = (car(m) R_TIMES car(n))
    (cdr(n), cdr(m))-->T618(Stat1, Stat2*) ==> (cdr(n) R_TIMES cdr(m)) = (cdr(m) R_TIMES cdr(n))
    (car(n), cdr(m))-->T618(Stat1, Stat2*) ==> (car(n) R_TIMES cdr(m)) = (cdr(m) R_TIMES car(n))
    (cdr(n), car(m))-->T618(Stat1, Stat2*) ==> (cdr(n) R_TIMES car(m)) = (car(m) R_TIMES cdr(n))
    (cdr(m), car(n))-->T614(Stat1, Stat2*) ==> Stat3: (cdr(m) R_TIMES car(n)) in Re
    (car(m), cdr(n))-->T614(Stat1, Stat2*) ==> Stat4: (car(m) R_TIMES cdr(n)) in Re
    ((cdr(m) R_TIMES car(n)), (car(m) R_TIMES cdr(n)))-->T615(Stat3, Stat4*) ==> ((cdr(m) R_TIMES car(n)) R_PLUS (car(m) R_TIMES cdr(n))) = ((car(m) R_TIMES cdr(n)) R_PLUS (cdr(m) R_TIMES car(n)))
    EQUAL ==> false
Discharge ==> QED
--
Theorem 825: (N in Cm) imp ((C_abs(N) in Re) & R_is_nonneg(C_abs(N))). Proof:
Suppose_not(n) ==> AUTO
	n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
	(car(n))-->T714(Stat1,Stat1*) ==> Stat2: R_is_nonneg(car(n) R_TIMES car(n))
	(cdr(n))-->T714(Stat1,Stat1*) ==> R_is_nonneg(cdr(n) R_TIMES cdr(n))
	ALGEBRA(Stat1) ==> Stat3: ((car(n) R_TIMES car(n)) in Re) & ((cdr(n) R_TIMES cdr(n)) in Re) &
		(((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n))) in Re)
	((car(n) R_TIMES car(n)), (cdr(n) R_TIMES cdr(n)))-->T667(Stat2*) ==> R_is_nonneg((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n)))
	((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n)))-->T808(Stat3*) ==> (sqrt((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n))) in Re) &
		(R_is_nonneg(sqrt((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n)))))
	Use_def(C_abs)(*) ==> false
	Discharge ==> QED
--
Theorem 826: (N in Cm) imp (C_abs(N) = C_abs(C_Rev(N))). Proof:
Suppose_not(n) ==> AUTO
	n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
	n-->T821(*) ==> Stat2: C_Rev(n) in Cm
	(C_Rev(n))-->T816(Stat2*) ==> Stat3: (car(C_Rev(n)) in Re) & (cdr(C_Rev(n)) in Re) & (C_Rev(n) = [car(C_Rev(n)),cdr(C_Rev(n))])
	Use_def(C_Rev)(*) ==> C_Rev(n) = [R_Rev(car(n)),R_Rev(cdr(n))]
	(Stat3)ELEM ==> car(C_Rev(n)) = R_Rev(car(n)) & cdr(C_Rev(n)) = R_Rev(cdr(n))
	Use_def(C_abs)(*) ==> (C_abs(n) = sqrt((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n)))) &
		(C_abs(C_Rev(n)) = sqrt((car(C_Rev(n)) R_TIMES car(C_Rev(n))) R_PLUS (cdr(C_Rev(n)) R_TIMES cdr(C_Rev(n)))))
	ALGEBRA(Stat1, Stat1) ==> ((R_Rev(car(n)) R_TIMES R_Rev(car(n))) = (car(n) R_TIMES car(n))) &
		((R_Rev(cdr(n)) R_TIMES R_Rev(cdr(n))) = (cdr(n) R_TIMES cdr(n)))
	EQUAL ==> false
	Discharge ==> QED
--
Theorem 827: ((N in Cm) & (M in Cm)) imp
	(((C_abs(N) R_PLUS C_abs(M)) R_GT C_abs(N C_PLUS M)) or (C_abs(N) R_PLUS C_abs(M) = C_abs(N C_PLUS M))). Proof:
Suppose_not(n,m) ==> Stat1: (n in Cm) & (m in Cm) &
	(not((C_abs(n) R_PLUS C_abs(m) R_GT C_abs(n C_PLUS m)) or (C_abs(n) R_PLUS C_abs(m) = C_abs(n C_PLUS m))))
--
-- We rewrite the inequality by using the definitions of $C_abs, C_PLUS$:
--
    n-->T816(*) ==> Stat2: (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)])
    m-->T816(*) ==> Stat3: (car(m) in Re) & (cdr(m) in Re) & (m = [car(m),cdr(m)])
    (n, m)-->T818(*) ==> Stat4: (n C_PLUS m) in Cm
    Use_def(C_abs)(*) ==> Stat5:
	(C_abs(n) = sqrt((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n)))) &
        (C_abs(m) = sqrt((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))))
--
    (n C_PLUS m)-->T816(Stat4, Stat4*) ==> Stat6: (car(n C_PLUS m) in Re) & (cdr(n C_PLUS m) in Re) & (n C_PLUS m = [car(n C_PLUS m), cdr(n C_PLUS m)])
    Use_def(C_PLUS)(Stat4, Stat4*) ==> Stat7: (car(n C_PLUS m) = (car(n) R_PLUS car(m))) & (cdr(n C_PLUS m) = (cdr(n) R_PLUS cdr(m)))
    Use_def(C_abs)(Stat4) ==> Stat8:
        C_abs(n C_PLUS m) = sqrt((car(n C_PLUS m) R_TIMES car(n C_PLUS m)) R_PLUS
                    (cdr(n C_PLUS m) R_TIMES cdr(n C_PLUS m)))
--
-- The right-hand side of the inequality which we have assumed true at the beginning
-- is positive if and only if $R_is_nonneg(C_abs(n C_PLUS m))$,
-- viz. iff $C_abs(n C_PLUS m) R_GE R_0$.
--
    n-->T825(*) ==> Stat9: (C_abs(n) in Re) & R_is_nonneg(C_abs(n))
    m-->T825(*) ==> Stat10: (C_abs(m) in Re) & R_is_nonneg(C_abs(m))
    (n C_PLUS m)-->T825(Stat4, Stat4*) ==> Stat11: (C_abs(n C_PLUS m) in Re) & R_is_nonneg(C_abs(n C_PLUS m))
    (C_abs(n C_PLUS m))-->T681(Stat11, Stat11*) ==> Stat12: (C_abs(n C_PLUS m) R_GE R_0)
--
-- We will use the inequality in the $R_GE$ form:
--
    (C_abs(n), C_abs(m))-->T613(Stat9, Stat10*) ==> Stat13: (C_abs(n) R_PLUS C_abs(m)) in Re
    (C_abs(n) R_PLUS C_abs(m), C_abs(n C_PLUS m))-->T680(Stat1, Stat11, Stat13*) ==> Stat14: not((C_abs(n) R_PLUS C_abs(m)) R_GE C_abs(n C_PLUS m))
--
-- Now we can multiply the inequality by itself:
--
    (C_abs(n), C_abs(m))-->T667(Stat2, Stat3, Stat9, Stat10*) ==> Stat15: R_is_nonneg(C_abs(n) R_PLUS C_abs(m))
    (C_abs(n) R_PLUS C_abs(m))-->T681(Stat13, Stat15*) ==> Stat16: (C_abs(n) R_PLUS C_abs(m)) R_GE R_0
    (C_abs(n) R_PLUS C_abs(m), C_abs(n C_PLUS m))-->T715(Stat11, Stat12, Stat13,Stat14,Stat16*) ==> Stat17:
        not(((C_abs(n) R_PLUS C_abs(m)) R_TIMES (C_abs(n) R_PLUS C_abs(m))) R_GE (C_abs(n C_PLUS m) R_TIMES C_abs(n C_PLUS m)))
--
-- Then we rewrite the right-hand side of the inequality above as follows:
--
    ALGEBRA(Stat2,Stat3) ==> Stat18:  ((car(n) R_PLUS car(m)) in Re) &
		((cdr(n) R_PLUS cdr(m)) in Re) &
		(((car(n) R_PLUS car(m)) R_TIMES (car(n) R_PLUS car(m))) in Re) &
		(((cdr(n) R_PLUS cdr(m)) R_TIMES (cdr(n) R_PLUS cdr(m))) in Re) &
		((((car(n) R_PLUS car(m)) R_TIMES (car(n) R_PLUS car(m))) R_PLUS ((cdr(n) R_PLUS cdr(m)) R_TIMES (cdr(n) R_PLUS cdr(m)))) in Re)
--
    (car(n) R_PLUS car(m))-->T714(Stat18*) ==> R_is_nonneg((car(n) R_PLUS car(m)) R_TIMES (car(n) R_PLUS car(m)))
    (cdr(n) R_PLUS cdr(m))-->T714(Stat18, Stat18*) ==> R_is_nonneg((cdr(n) R_PLUS cdr(m)) R_TIMES (cdr(n) R_PLUS cdr(m)))
    ((car(n) R_PLUS car(m)) R_TIMES (car(n) R_PLUS car(m)),(cdr(n) R_PLUS cdr(m)) R_TIMES (cdr(n) R_PLUS cdr(m)))-->T667(Stat18*) ==>
        Stat19: R_is_nonneg(((car(n) R_PLUS car(m)) R_TIMES (car(n) R_PLUS car(m))) R_PLUS ((cdr(n) R_PLUS cdr(m)) R_TIMES (cdr(n) R_PLUS cdr(m))))
--
    (((car(n) R_PLUS car(m)) R_TIMES (car(n) R_PLUS car(m))) R_PLUS ((cdr(n) R_PLUS cdr(m)) R_TIMES (cdr(n) R_PLUS cdr(m))))-->T808(Stat18, Stat19*) ==> Stat20:
	sqrt(((car(n) R_PLUS car(m)) R_TIMES (car(n) R_PLUS car(m))) R_PLUS ((cdr(n) R_PLUS cdr(m)) R_TIMES (cdr(n) R_PLUS cdr(m)))) R_TIMES
	sqrt(((car(n) R_PLUS car(m)) R_TIMES (car(n) R_PLUS car(m))) R_PLUS ((cdr(n) R_PLUS cdr(m)) R_TIMES (cdr(n) R_PLUS cdr(m)))) =
	    (((car(n) R_PLUS car(m)) R_TIMES (car(n) R_PLUS car(m))) R_PLUS ((cdr(n) R_PLUS cdr(m)) R_TIMES (cdr(n) R_PLUS cdr(m))))
--
-- rewriting the first parenthesis
--
    ALGEBRA(Stat2,Stat3) ==> Stat21: ((car(n) R_PLUS car(m)) R_TIMES (car(n) R_PLUS car(m)) = (car(n) R_TIMES (car(n) R_PLUS car(m))) R_PLUS (car(m) R_TIMES (car(n) R_PLUS car(m)))) &
		(car(n) R_TIMES (car(n) R_PLUS car(m)) = (car(n) R_TIMES car(n)) R_PLUS (car(n) R_TIMES car(m))) &
		(car(m) R_TIMES (car(n) R_PLUS car(m)) = (car(m) R_TIMES car(n)) R_PLUS (car(m) R_TIMES car(m)))
--
-- rewriting the second parenthesis
--
    ALGEBRA(Stat2,Stat3) ==> Stat22: ((cdr(n) R_PLUS cdr(m)) R_TIMES (cdr(n) R_PLUS cdr(m)) = (cdr(n) R_TIMES (cdr(n) R_PLUS cdr(m))) R_PLUS (cdr(m) R_TIMES (cdr(n) R_PLUS cdr(m)))) &
		(cdr(n) R_TIMES (cdr(n) R_PLUS cdr(m)) = (cdr(n) R_TIMES cdr(n)) R_PLUS (cdr(n) R_TIMES cdr(m))) &
		(cdr(m) R_TIMES (cdr(n) R_PLUS cdr(m)) = (cdr(m) R_TIMES cdr(n)) R_PLUS (cdr(m) R_TIMES cdr(m)))
    EQUAL(Stat21,Stat22,Stat8,Stat20,Stat7) ==> Stat23: (C_abs(n C_PLUS m) R_TIMES C_abs(n C_PLUS m)) =
	(((car(n) R_TIMES car(n)) R_PLUS (car(n) R_TIMES car(m))) R_PLUS ((car(m) R_TIMES car(n)) R_PLUS (car(m) R_TIMES car(m)))) R_PLUS
        (((cdr(n) R_TIMES cdr(n)) R_PLUS (cdr(n) R_TIMES cdr(m))) R_PLUS ((cdr(m) R_TIMES cdr(n)) R_PLUS (cdr(m) R_TIMES cdr(m))))

--
-- Then we rewrite the left-hand side of the inequality above as follows:
--
--
-- rewriting the first $sqrt$
    ALGEBRA(Stat2,Stat3) ==> Stat24: ((car(n) R_TIMES car(n)) in Re) &
		((cdr(n) R_TIMES cdr(n)) in Re) &
		(((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n))) in Re)
    (car(n))-->T714(Stat2, Stat2*) ==> Stat25:  R_is_nonneg(car(n) R_TIMES car(n))
    (cdr(n))-->T714(Stat2, Stat2*) ==> Stat26: R_is_nonneg(cdr(n) R_TIMES cdr(n))
    (car(n) R_TIMES car(n), cdr(n) R_TIMES cdr(n))-->T667(Stat24, Stat25, Stat26*) ==> Stat27: R_is_nonneg((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n)))
    ((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n)))-->T808(Stat24, Stat27*) ==> Stat28:
        (sqrt((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n))) R_TIMES
         sqrt((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n))) =
            ((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n)))) &
        (sqrt((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n))) in Re)
--
-- rewriting the second $sqrt$
    ALGEBRA(Stat2,Stat3) ==> Stat29: ((car(m) R_TIMES car(m)) in Re) &
		((cdr(m) R_TIMES cdr(m)) in Re) &
		(((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))) in Re)
    (car(m))-->T714(Stat3, Stat3*) ==> Stat30:  R_is_nonneg(car(m) R_TIMES car(m))
    (cdr(m))-->T714(Stat3, Stat3*) ==> Stat31: R_is_nonneg(cdr(m) R_TIMES cdr(m))
    (car(m) R_TIMES car(m), cdr(m) R_TIMES cdr(m))-->T667(Stat29, Stat32, Stat30, Stat31*) ==> Stat33: R_is_nonneg((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m)))
    ((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m)))-->T808(Stat29, Stat33*) ==> Stat34:
        (sqrt((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))) R_TIMES
        sqrt((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))) =
            ((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m)))) &
        (sqrt((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))) in Re)
--
-- It will ease our arguments having short aliases for $C_abs(n)$, $C_abs(m)$
-- available to us.
--
    Loc_def ==> Stat35: (C_abs_n = sqrt((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n)))) &
			(C_abs_m = sqrt((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))))
--
    EQUAL(Stat28,Stat34,Stat35) ==> Stat36: (C_abs_n in Re) & (C_abs_m in Re)
--
    ALGEBRA(Stat36) ==> Stat37:
        ((C_abs_n R_PLUS C_abs_m) R_TIMES (C_abs_n R_PLUS C_abs_m) =
		(C_abs_n R_TIMES (C_abs_n R_PLUS C_abs_m)) R_PLUS (C_abs_m R_TIMES (C_abs_n R_PLUS C_abs_m))) &
	(C_abs_n R_TIMES (C_abs_n R_PLUS C_abs_m) = (C_abs_n R_TIMES C_abs_n) R_PLUS (C_abs_n R_TIMES C_abs_m)) &
	(C_abs_m R_TIMES (C_abs_n R_PLUS C_abs_m) = (C_abs_m R_TIMES C_abs_n) R_PLUS (C_abs_m R_TIMES C_abs_m))
--
    EQUAL(Stat37,Stat5,Stat28,Stat34,Stat35) ==> Stat38: ((C_abs(n) R_PLUS C_abs(m)) R_TIMES (C_abs(n) R_PLUS C_abs(m))) =
	(((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n))) R_PLUS (C_abs_n R_TIMES C_abs_m)) R_PLUS
	((C_abs_m R_TIMES C_abs_n) R_PLUS ((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))))
--
    EQUAL(Stat38,Stat23,Stat17) ==> not(((((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n))) R_PLUS (C_abs_n R_TIMES C_abs_m)) R_PLUS
		((C_abs_m R_TIMES C_abs_n) R_PLUS ((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))))) R_GE
	((((car(n) R_TIMES car(n)) R_PLUS (car(n) R_TIMES car(m))) R_PLUS ((car(m) R_TIMES car(n)) R_PLUS (car(m) R_TIMES car(m)))) R_PLUS
        (((cdr(n) R_TIMES cdr(n)) R_PLUS (cdr(n) R_TIMES cdr(m))) R_PLUS ((cdr(m) R_TIMES cdr(n)) R_PLUS (cdr(m) R_TIMES cdr(m))))))
--
Tsomehow ==> false; Discharge ==> QED
--
Theorem 828: ((N in Cm) & (M in Cm)) imp
    (((C_abs(N) R_PLUS C_abs(M)) R_GT C_abs(N C_MINUS M)) or (C_abs(N) R_PLUS C_abs(M) = C_abs(N C_MINUS M))). Proof:
Suppose_not(n,m) ==>
    (n in Cm) & (m in Cm) & (not((C_abs(n) R_PLUS C_abs(m) R_GT C_abs(n C_MINUS m)) or (C_abs(n) R_PLUS C_abs(m) = C_abs(n C_MINUS m))))
    Use_def(C_MINUS)(*) ==> n C_MINUS m = n C_PLUS C_Rev(m)
    m-->T821(*) ==> C_Rev(m) in Cm
    m-->T826(*) ==> C_abs(C_Rev(m)) = C_abs(m)
    (n, C_Rev(m))-->T827 ==> (C_abs(n) R_PLUS C_abs(C_Rev(m)) R_GT C_abs(n C_PLUS C_Rev(m))) or (C_abs(n) R_PLUS C_abs(C_Rev(m)) = C_abs(n C_PLUS C_Rev(m)))
EQUAL ==> false; Discharge ==> QED
--
Theorem 829: ((N in Cm) & (M in Cm)) imp (C_abs(N) R_TIMES C_abs(M) = C_abs(N C_TIMES M)). Proof:
Suppose_not(n,m) ==> AUTO
--
-- Assuming the contrary of the claim, it follows from $n in Cm$, $m in Cm$ that
-- their components are reals, and that their product is a complex. By recalling
-- the definitions of $C_abs$, $C_TIMES$, and dropping the square roots (since their
-- arguments are easily recognized to be non-negative reals, we obtain an inequality
-- which will be refuted by merely algeraic arguments, referring to the reals.
--
	n-->T816(*) ==> Stat1: (car(n) in Re) & (cdr(n) in Re)
	m-->T816(*) ==> Stat2: (car(m) in Re) & (cdr(m) in Re)
	(n,m)-->T818(*) ==> (n C_TIMES m) in Cm
	Use_def(C_abs)(*) ==> Stat3: sqrt((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n))) R_TIMES sqrt((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))) /=
		sqrt((car(n C_TIMES m) R_TIMES car(n C_TIMES m)) R_PLUS (cdr(n C_TIMES m) R_TIMES cdr(n C_TIMES m)))
	Use_def(C_TIMES)(*) ==> Stat4: (n C_TIMES m) = [(car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m)),
		(car(n) R_TIMES cdr(m)) R_PLUS (cdr(n) R_TIMES car(m))]
	(n C_TIMES m)-->T816(Stat1*) ==> (car(n C_TIMES m) in Re) & (cdr(n C_TIMES m) in Re)
	ALGEBRA(Stat1,Stat2) ==> ((car(n) R_TIMES car(n)) in Re) &
			((car(m) R_TIMES car(m)) in Re) &
			((cdr(n) R_TIMES cdr(n)) in Re) &
			((cdr(m) R_TIMES cdr(m)) in Re) &
			((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n)) in Re) &
			((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m)) in Re)
	(car(n))-->T714(Stat1,Stat1*) ==> R_is_nonneg(car(n) R_TIMES car(n))
	(cdr(n))-->T714(Stat1,Stat1*) ==> R_is_nonneg(cdr(n) R_TIMES cdr(n))
	(car(m))-->T714(Stat2,Stat2*) ==> R_is_nonneg(car(m) R_TIMES car(m))
	(cdr(m))-->T714(Stat2,Stat2*) ==> R_is_nonneg(cdr(m) R_TIMES cdr(m))
	(car(n) R_TIMES car(n),cdr(n) R_TIMES cdr(n))-->T667(Stat3*) ==> R_is_nonneg((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n)))
	(car(m) R_TIMES car(m),cdr(m) R_TIMES cdr(m))-->T667(Stat3*) ==> R_is_nonneg((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m)))
	Suppose ==> Stat5: ((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n))) R_TIMES ((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))) = ((car(n C_TIMES m) R_TIMES car(n C_TIMES m)) R_PLUS (cdr(n C_TIMES m) R_TIMES cdr(n C_TIMES m)))
		((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n)),(car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m)))-->T811(Stat3*) ==> sqrt(((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n))) R_TIMES ((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m)))) /= sqrt((car(n C_TIMES m) R_TIMES car(n C_TIMES m)) R_PLUS (cdr(n C_TIMES m) R_TIMES cdr(n C_TIMES m)))
		EQUAL(Stat5) ==> false
	Discharge ==> AUTO
	TELEM ==> car([(car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m)),
		(car(n) R_TIMES cdr(m)) R_PLUS (cdr(n) R_TIMES car(m))]) = (car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m))
	TELEM ==> cdr([(car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m)),
		(car(n) R_TIMES cdr(m)) R_PLUS (cdr(n) R_TIMES car(m))]) = (car(n) R_TIMES cdr(m)) R_PLUS (cdr(n) R_TIMES car(m))
	EQUAL(Stat4) ==> Stat6: ((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n))) R_TIMES ((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))) /= ((((car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m))) R_TIMES ((car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m)))) R_PLUS (((car(n) R_TIMES cdr(m)) R_PLUS (cdr(n) R_TIMES car(m))) R_TIMES ((car(n) R_TIMES cdr(m)) R_PLUS (cdr(n) R_TIMES car(m)))))
	ALGEBRA(Stat1,Stat2) ==> (((car(n) R_TIMES car(n)) R_PLUS (cdr(n) R_TIMES cdr(n))) R_TIMES ((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))) =
		((car(n) R_TIMES car(n)) R_TIMES ((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m)))) R_PLUS
		((cdr(n) R_TIMES cdr(n)) R_TIMES ((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m)))))  &
		((car(n) R_TIMES car(n)) R_TIMES ((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))) =
			((car(n) R_TIMES car(n)) R_TIMES (car(m) R_TIMES car(m))) R_PLUS ((car(n) R_TIMES car(n)) R_TIMES (cdr(m) R_TIMES cdr(m)))) &
		((cdr(n) R_TIMES cdr(n)) R_TIMES ((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))) =
			((cdr(n) R_TIMES cdr(n)) R_TIMES (car(m) R_TIMES car(m))) R_PLUS ((cdr(n) R_TIMES cdr(n)) R_TIMES (cdr(m) R_TIMES cdr(m))))
	EQUAL ==> Stat7: (((car(n) R_TIMES car(n)) R_TIMES (car(m) R_TIMES car(m))) R_PLUS ((car(n) R_TIMES car(n)) R_TIMES (cdr(m) R_TIMES cdr(m)))) R_PLUS (((cdr(n) R_TIMES cdr(n)) R_TIMES (car(m) R_TIMES car(m))) R_PLUS ((cdr(n) R_TIMES cdr(n)) R_TIMES (cdr(m) R_TIMES cdr(m)))) /=
		((((car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m))) R_TIMES ((car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m)))) R_PLUS (((car(n) R_TIMES cdr(m)) R_PLUS (cdr(n) R_TIMES car(m))) R_TIMES ((car(n) R_TIMES cdr(m)) R_PLUS (cdr(n) R_TIMES car(m)))))
	ALGEBRA(Stat1,Stat2) ==> Stat8: ((car(n) R_TIMES car(m)) in Re) & ((cdr(n) R_TIMES cdr(m)) in Re) & ((car(n) R_TIMES cdr(m)) in Re) & ((cdr(n) R_TIMES car(m)) in Re) & ((car(n) R_TIMES car(m)) R_TIMES (cdr(n) R_TIMES cdr(m)) = (car(n) R_TIMES cdr(m)) R_TIMES (cdr(n) R_TIMES car(m))) &
		(((((car(n) R_TIMES car(m)) R_TIMES (car(n) R_TIMES car(m))) R_PLUS ((cdr(n) R_TIMES cdr(m)) R_TIMES (cdr(n) R_TIMES cdr(m)))) R_MINUS (((car(n) R_TIMES car(m)) R_TIMES (cdr(n) R_TIMES cdr(m))) R_PLUS ((car(n) R_TIMES car(m)) R_TIMES (cdr(n) R_TIMES cdr(m))))) R_PLUS
		 ((((car(n) R_TIMES cdr(m)) R_TIMES (car(n) R_TIMES cdr(m))) R_PLUS ((cdr(n) R_TIMES car(m)) R_TIMES (cdr(n) R_TIMES car(m)))) R_PLUS  (((car(n) R_TIMES cdr(m)) R_TIMES (cdr(n) R_TIMES car(m))) R_PLUS ((car(n) R_TIMES cdr(m)) R_TIMES (cdr(n) R_TIMES car(m))))) =
		 ((((car(n) R_TIMES car(m)) R_TIMES (car(n) R_TIMES car(m))) R_PLUS ((cdr(n) R_TIMES cdr(m)) R_TIMES (cdr(n) R_TIMES cdr(m))))) R_PLUS
		 ((((car(n) R_TIMES cdr(m)) R_TIMES (car(n) R_TIMES cdr(m))) R_PLUS ((cdr(n) R_TIMES car(m)) R_TIMES (cdr(n) R_TIMES car(m))))))
	(car(n) R_TIMES car(m),cdr(n) R_TIMES cdr(m))-->T806(Stat8,Stat8*) ==> ((car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m))) R_TIMES ((car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m))) = (((car(n) R_TIMES car(m)) R_TIMES (car(n) R_TIMES car(m))) R_PLUS ((cdr(n) R_TIMES cdr(m)) R_TIMES (cdr(n) R_TIMES cdr(m)))) R_MINUS (((car(n) R_TIMES car(m)) R_TIMES (cdr(n) R_TIMES cdr(m))) R_PLUS ((car(n) R_TIMES car(m)) R_TIMES (cdr(n) R_TIMES cdr(m))))
	(car(n) R_TIMES cdr(m),cdr(n) R_TIMES car(m))-->T805(Stat8,Stat8*) ==> ((car(n) R_TIMES cdr(m)) R_PLUS  (cdr(n) R_TIMES car(m))) R_TIMES ((car(n) R_TIMES cdr(m)) R_PLUS  (cdr(n) R_TIMES car(m))) = (((car(n) R_TIMES cdr(m)) R_TIMES (car(n) R_TIMES cdr(m))) R_PLUS ((cdr(n) R_TIMES car(m)) R_TIMES (cdr(n) R_TIMES car(m)))) R_PLUS  (((car(n) R_TIMES cdr(m)) R_TIMES (cdr(n) R_TIMES car(m))) R_PLUS ((car(n) R_TIMES cdr(m)) R_TIMES (cdr(n) R_TIMES car(m))))
	EQUAL(Stat7) ==> Stat9: (((car(n) R_TIMES car(n)) R_TIMES (car(m) R_TIMES car(m))) R_PLUS
				 ((car(n) R_TIMES car(n)) R_TIMES (cdr(m) R_TIMES cdr(m)))) R_PLUS
				(((cdr(n) R_TIMES cdr(n)) R_TIMES (car(m) R_TIMES car(m))) R_PLUS
				 ((cdr(n) R_TIMES cdr(n)) R_TIMES (cdr(m) R_TIMES cdr(m)))) /=
		((((car(n) R_TIMES car(m)) R_TIMES (car(n) R_TIMES car(m))) R_PLUS ((cdr(n) R_TIMES cdr(m)) R_TIMES (cdr(n) R_TIMES cdr(m))))) R_PLUS
		((((car(n) R_TIMES cdr(m)) R_TIMES (car(n) R_TIMES cdr(m))) R_PLUS ((cdr(n) R_TIMES car(m)) R_TIMES (cdr(n) R_TIMES car(m)))))
ALGEBRA(Stat1,Stat2,Stat9) ==> false; Discharge ==> QED
--
Theorem 830: ((N in Cm) & (M in Cm) & (M /= C_0)) imp (C_abs(N) R_OVER C_abs(M) = C_abs(N C_OVER M)). Proof:
    Suppose_not(n,m) ==> (n in Cm) & (m in Cm) & (m /= C_0) & (C_abs(n) R_OVER C_abs(m) /= C_abs(n C_OVER m))
    THUS ==> (car(n) in Re) & (cdr(n) in Re) & (n = [car(n),cdr(n)]) & (car(m) in Re) & (cdr(m) in Re) & (m = [car(m),cdr(m)])
     TO_BE_CONTINUED ==> false; Discharge ==> QED
--
Theorem 831: ((K in Cm) & (N in Cm) & (M in Cm)) imp (N C_PLUS (M C_PLUS K) = (N C_PLUS M) C_PLUS K). Proof:
Suppose_not(k,n,m) ==> Stat1: (k in Cm) & (n in Cm) & (m in Cm) & (n C_PLUS (m C_PLUS k) /= (n C_PLUS m) C_PLUS k)
	Use_def(C_PLUS)(*) ==> Stat2:
		(car(n C_PLUS m) = (car(n) R_PLUS car(m))) &
		(cdr(n C_PLUS m) = (cdr(n) R_PLUS cdr(m))) &
		(car(m C_PLUS k) = (car(m) R_PLUS car(k))) &
		(cdr(m C_PLUS k) = (cdr(m) R_PLUS cdr(k))) &
		(n C_PLUS (m C_PLUS k) = [car(n) R_PLUS car(m C_PLUS k),cdr(n) R_PLUS cdr(m C_PLUS k)]) &
		((n C_PLUS m) C_PLUS k = [car(n C_PLUS m) R_PLUS car(k),cdr(n C_PLUS m) R_PLUS cdr(k)])
	Loc_def ==> Stat3: an = car(n)
	Loc_def ==> Stat4: dn = cdr(n)
	Loc_def ==> Stat5: am = car(m)
	Loc_def ==> Stat6: dm = cdr(m)
	Loc_def ==> Stat7: ak = car(k)
	Loc_def ==> Stat8: dk = cdr(k)
	EQUAL(Stat1) ==> Stat9:
			[an R_PLUS (am R_PLUS ak), dn R_PLUS (dm R_PLUS dk)] /=
			[(an R_PLUS am) R_PLUS ak, (dn R_PLUS dm) R_PLUS dk]
	n-->T816(Stat1,Stat3,Stat4*) ==> (an in Re) & (dn in Re)
	m-->T816(Stat1,Stat5,Stat6*) ==> (am in Re) & (dm in Re)
	k-->T816(Stat1,Stat7,Stat8*) ==> (ak in Re) & (dk in Re)
ALGEBRA(Stat9*) ==> false; Discharge ==> QED
--
--
--
Theorem 832: ((K in Cm) & (N in Cm) & (M in Cm)) imp ((N C_TIMES (M C_TIMES K)) = ((N C_TIMES M) C_TIMES K)). Proof:
Suppose_not(k,n,m) ==> Stat1: (k in Cm) & (n in Cm) & (m in Cm) & (n C_TIMES (m C_TIMES k) /= (n C_TIMES m) C_TIMES k)
	Use_def(C_TIMES)(*) ==> Stat2:
		(car(n C_TIMES m) = (car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m))) &
		(cdr(n C_TIMES m) = (car(n) R_TIMES cdr(m)) R_PLUS  (cdr(n) R_TIMES car(m))) &
		(car(m C_TIMES k) = (car(m) R_TIMES car(k)) R_MINUS (cdr(m) R_TIMES cdr(k))) &
		(cdr(m C_TIMES k) = (car(m) R_TIMES cdr(k)) R_PLUS  (cdr(m) R_TIMES car(k))) &
		((n C_TIMES (m C_TIMES k)) = [(car(n) R_TIMES car(m C_TIMES k)) R_MINUS (cdr(n) R_TIMES cdr(m C_TIMES k)),
			(car(n) R_TIMES cdr(m C_TIMES k)) R_PLUS (cdr(n) R_TIMES car(m C_TIMES k))]) &
		(((n C_TIMES m) C_TIMES k) = [(car(n C_TIMES m) R_TIMES car(k)) R_MINUS (cdr(n C_TIMES m) R_TIMES cdr(k)),
			(car(n C_TIMES m) R_TIMES cdr(k)) R_PLUS (cdr(n C_TIMES m) R_TIMES car(k))])
	Loc_def ==> Stat3: ((an = car(n)) & (dn = cdr(n))) &
			((am = car(m)) & (dm = cdr(m))) &
			((ak = car(k)) & (dk = cdr(k)))
	EQUAL ==> Stat4:
			[(an R_TIMES ((am R_TIMES ak) R_MINUS (dm R_TIMES dk))) R_MINUS (dn R_TIMES ((am R_TIMES dk) R_PLUS  (dm R_TIMES ak))),
			 (an R_TIMES ((am R_TIMES dk) R_PLUS  (dm R_TIMES ak))) R_PLUS (dn R_TIMES ((am R_TIMES ak) R_MINUS (dm R_TIMES dk)))] /=
			[(((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_TIMES ak) R_MINUS (((an R_TIMES dm) R_PLUS  (dn R_TIMES am)) R_TIMES dk),
			 (((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_TIMES dk) R_PLUS  (((an R_TIMES dm) R_PLUS  (dn R_TIMES am)) R_TIMES ak)]
	(Stat4)ELEM ==> ((an R_TIMES ((am R_TIMES ak) R_MINUS (dm R_TIMES dk))) R_MINUS (dn R_TIMES ((am R_TIMES dk) R_PLUS  (dm R_TIMES ak))) /= (((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_TIMES ak) R_MINUS (((an R_TIMES dm) R_PLUS  (dn R_TIMES am)) R_TIMES dk)) or
		((an R_TIMES ((am R_TIMES dk) R_PLUS  (dm R_TIMES ak))) R_PLUS (dn R_TIMES ((am R_TIMES ak) R_MINUS (dm R_TIMES dk))) /= (((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_TIMES dk) R_PLUS  (((an R_TIMES dm) R_PLUS  (dn R_TIMES am)) R_TIMES ak))
	n-->T816(Stat1,Stat3*) ==> Stat5: (an in Re) & (dn in Re)
	m-->T816(Stat1,Stat3*) ==> Stat6: (am in Re) & (dm in Re)
	k-->T816(Stat1,Stat3,Stat5*) ==> Stat7: (ak in Re) & (dk in Re) & (an in Re) & (dn in Re)
	Suppose ==> Stat8: (an R_TIMES ((am R_TIMES ak) R_MINUS (dm R_TIMES dk))) R_MINUS (dn R_TIMES ((am R_TIMES dk) R_PLUS  (dm R_TIMES ak))) /= (((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_TIMES ak) R_MINUS (((an R_TIMES dm) R_PLUS  (dn R_TIMES am)) R_TIMES dk)
		ALGEBRA(Stat6,Stat7) ==> ((an R_TIMES ((am R_TIMES ak) R_MINUS (dm R_TIMES dk))) = (an R_TIMES (am R_TIMES ak)) R_MINUS (an R_TIMES (dm R_TIMES dk))) &
			((dn R_TIMES ((am R_TIMES dk) R_PLUS  (dm R_TIMES ak))) = (dn R_TIMES (am R_TIMES dk)) R_PLUS  (dn R_TIMES (dm R_TIMES ak))) &
			(((an R_TIMES (am R_TIMES ak)) R_MINUS (an R_TIMES (dm R_TIMES dk))) R_MINUS ((dn R_TIMES (am R_TIMES dk)) R_PLUS (dn R_TIMES (dm R_TIMES ak))) = (((an R_TIMES (am R_TIMES ak)) R_MINUS (an R_TIMES (dm R_TIMES dk))) R_MINUS (dn R_TIMES (am R_TIMES dk))) R_MINUS (dn R_TIMES (dm R_TIMES ak))) &
			((((an R_TIMES (am R_TIMES ak)) R_MINUS (an R_TIMES (dm R_TIMES dk))) R_MINUS (dn R_TIMES (am R_TIMES dk))) R_MINUS (dn R_TIMES (dm R_TIMES ak)) = (((an R_TIMES (am R_TIMES ak)) R_MINUS (an R_TIMES (dm R_TIMES dk))) R_MINUS (dn R_TIMES (am R_TIMES dk))) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES ak))) &
			((((an R_TIMES (am R_TIMES ak)) R_MINUS (an R_TIMES (dm R_TIMES dk))) R_MINUS (dn R_TIMES (am R_TIMES dk))) = (((an R_TIMES (am R_TIMES ak)) R_MINUS (an R_TIMES (dm R_TIMES dk))) R_PLUS R_Rev(dn R_TIMES (am R_TIMES dk)))) &
			((an R_TIMES (am R_TIMES ak)) R_MINUS (an R_TIMES (dm R_TIMES dk)) = (an R_TIMES (am R_TIMES ak)) R_PLUS R_Rev(an R_TIMES (dm R_TIMES dk)))
		EQUAL(Stat8) ==> Stat9: (((an R_TIMES (am R_TIMES ak)) R_PLUS R_Rev(an R_TIMES (dm R_TIMES dk))) R_PLUS R_Rev(dn R_TIMES (am R_TIMES dk))) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES ak)) /= (((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_TIMES ak) R_MINUS (((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES dk)
		ALGEBRA(Stat6,Stat7) ==> ((an R_TIMES (am R_TIMES ak)) R_PLUS (R_Rev(an R_TIMES (dm R_TIMES dk)) R_PLUS R_Rev(dn R_TIMES (am R_TIMES dk))) = ((an R_TIMES (am R_TIMES ak)) R_PLUS R_Rev(an R_TIMES (dm R_TIMES dk))) R_PLUS R_Rev(dn R_TIMES (am R_TIMES dk))) &
			(R_Rev((an R_TIMES (dm R_TIMES dk)) R_PLUS (dn R_TIMES (am R_TIMES dk))) = R_Rev(an R_TIMES (dm R_TIMES dk)) R_PLUS R_Rev(dn R_TIMES (am R_TIMES dk)))
		EQUAL(Stat9) ==> Stat10: ((an R_TIMES (am R_TIMES ak)) R_PLUS R_Rev((an R_TIMES (dm R_TIMES dk)) R_PLUS (dn R_TIMES (am R_TIMES dk)))) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES ak)) /= (((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_TIMES ak) R_MINUS (((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES dk)
		ALGEBRA(Stat6,Stat7) ==> (an R_TIMES (dm R_TIMES dk) = (an R_TIMES dm) R_TIMES dk) &
			(dn R_TIMES (am R_TIMES dk) = (dn R_TIMES am) R_TIMES dk) &
			(dk R_TIMES (an R_TIMES dm) = (an R_TIMES dm) R_TIMES dk) &
			(dk R_TIMES (dn R_TIMES am) = (dn R_TIMES am) R_TIMES dk) &
			(dk R_TIMES ((an R_TIMES dm) R_PLUS (dn R_TIMES am)) = (dk R_TIMES (an R_TIMES dm)) R_PLUS (dk R_TIMES (dn R_TIMES am))) &
			(dk R_TIMES ((an R_TIMES dm) R_PLUS (dn R_TIMES am)) = ((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES dk)
		EQUAL(Stat10) ==> Stat11: ((an R_TIMES (am R_TIMES ak)) R_PLUS R_Rev(((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES dk)) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES ak)) /= (((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_TIMES ak) R_MINUS (((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES dk)
		ALGEBRA(Stat6,Stat7) ==>
			(((an R_TIMES (am R_TIMES ak)) R_PLUS R_Rev(((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES dk)) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES ak)) = (an R_TIMES (am R_TIMES ak)) R_PLUS (R_Rev(((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES dk) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES ak)))) &
			((R_Rev(((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES dk) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES ak))) = (R_Rev(dn R_TIMES (dm R_TIMES ak)) R_PLUS R_Rev(((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES dk)))
		Loc_def ==> Stat12: (rdndmak = R_Rev(dn R_TIMES (dm R_TIMES ak))) &
			(rdd = R_Rev(((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES dk))
		ALGEBRA(Stat6,Stat7,Stat12) ==> Stat13: (rdndmak in Re) & (rdd in Re)
		ALGEBRA(Stat6,Stat7,Stat13) ==> (((an R_TIMES (am R_TIMES ak)) R_PLUS rdndmak) R_PLUS rdd = (an R_TIMES (am R_TIMES ak)) R_PLUS (rdndmak R_PLUS rdd)) &
			(((an R_TIMES (am R_TIMES ak)) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES ak))) = ((an R_TIMES (am R_TIMES ak)) R_MINUS (dn R_TIMES (dm R_TIMES ak)))) &
			(an R_TIMES (am R_TIMES ak) = (an R_TIMES am) R_TIMES ak) &
			(dn R_TIMES (dm R_TIMES ak) = (dn R_TIMES dm) R_TIMES ak) &
			(((an R_TIMES am) R_TIMES ak) R_PLUS R_Rev((dn R_TIMES dm) R_TIMES ak) = ((an R_TIMES am) R_TIMES ak) R_MINUS ((dn R_TIMES dm) R_TIMES ak)) &
			((ak R_TIMES (an R_TIMES am) = (an R_TIMES am) R_TIMES ak) & (ak R_TIMES (dn R_TIMES dm) = (dn R_TIMES dm) R_TIMES ak)) &
			(((ak R_TIMES (an R_TIMES am)) R_MINUS (ak R_TIMES (dn R_TIMES dm))) R_PLUS R_Rev(((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES dk) = ((ak R_TIMES (an R_TIMES am)) R_MINUS (ak R_TIMES (dn R_TIMES dm))) R_MINUS (((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES dk)) &
			(ak R_TIMES ((an R_TIMES am) R_MINUS (dn R_TIMES dm)) = ((ak R_TIMES (an R_TIMES am)) R_MINUS (ak R_TIMES (dn R_TIMES dm)))) &
			((ak R_TIMES ((an R_TIMES am) R_MINUS (dn R_TIMES dm))) = (((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_TIMES ak))
	EQUAL(Stat11) ==> false; Discharge ==> Stat14: (an R_TIMES ((am R_TIMES dk) R_PLUS  (dm R_TIMES ak))) R_PLUS (dn R_TIMES ((am R_TIMES ak) R_MINUS (dm R_TIMES dk))) /= (((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_TIMES dk) R_PLUS (((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES ak)
--	Suppose ==> Stat15: (an R_TIMES ((am R_TIMES dk) R_PLUS  (dm R_TIMES ak))) R_PLUS (dn R_TIMES ((am R_TIMES ak) R_MINUS (dm R_TIMES dk))) /= ((an R_TIMES (am R_TIMES dk)) R_MINUS (dn R_TIMES (dm R_TIMES dk))) R_PLUS ((an R_TIMES (dm R_TIMES ak)) R_PLUS (dn R_TIMES (am R_TIMES ak)))
		ALGEBRA(Stat6,Stat7) ==> ((an R_TIMES ((am R_TIMES dk) R_PLUS  (dm R_TIMES ak))) = (an R_TIMES (am R_TIMES dk)) R_PLUS  (an R_TIMES (dm R_TIMES ak))) &
			((dn R_TIMES ((am R_TIMES ak) R_MINUS (dm R_TIMES dk))) = (dn R_TIMES (am R_TIMES ak)) R_MINUS (dn R_TIMES (dm R_TIMES dk))) &
			((dn R_TIMES (am R_TIMES ak)) R_MINUS (dn R_TIMES (dm R_TIMES dk)) = (dn R_TIMES (am R_TIMES ak)) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES dk))) &
			((dn R_TIMES (am R_TIMES ak)) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES dk)) = R_Rev(dn R_TIMES (dm R_TIMES dk)) R_PLUS (dn R_TIMES (am R_TIMES ak))) &
			((((an R_TIMES (am R_TIMES dk)) R_PLUS (an R_TIMES (dm R_TIMES ak))) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES dk))) R_PLUS (dn R_TIMES (am R_TIMES ak)) = ((an R_TIMES (am R_TIMES dk)) R_PLUS (an R_TIMES (dm R_TIMES ak))) R_PLUS (R_Rev(dn R_TIMES (dm R_TIMES dk)) R_PLUS (dn R_TIMES (am R_TIMES ak)))) &
			((((an R_TIMES (am R_TIMES dk)) R_PLUS (an R_TIMES (dm R_TIMES ak))) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES dk))) = ((an R_TIMES (am R_TIMES dk)) R_PLUS ((an R_TIMES (dm R_TIMES ak)) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES dk))))) &
			(((an R_TIMES (dm R_TIMES ak)) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES dk))) = (R_Rev(dn R_TIMES (dm R_TIMES dk)) R_PLUS (an R_TIMES (dm R_TIMES ak)))) &
			((an R_TIMES (am R_TIMES dk)) R_PLUS (R_Rev(dn R_TIMES (dm R_TIMES dk)) R_PLUS (an R_TIMES (dm R_TIMES ak))) = ((an R_TIMES (am R_TIMES dk)) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES dk))) R_PLUS (an R_TIMES (dm R_TIMES ak))) &
			(((an R_TIMES (am R_TIMES dk)) R_PLUS R_Rev(dn R_TIMES (dm R_TIMES dk))) = ((an R_TIMES (am R_TIMES dk)) R_MINUS (dn R_TIMES (dm R_TIMES dk)))) &
			((((an R_TIMES (am R_TIMES dk)) R_MINUS (dn R_TIMES (dm R_TIMES dk))) R_PLUS (an R_TIMES (dm R_TIMES ak))) R_PLUS (dn R_TIMES (am R_TIMES ak)) = ((an R_TIMES (am R_TIMES dk)) R_MINUS (dn R_TIMES (dm R_TIMES dk))) R_PLUS ((an R_TIMES (dm R_TIMES ak)) R_PLUS (dn R_TIMES (am R_TIMES ak))))
--	EQUAL(Stat15) ==> false; Discharge ==> Stat16: ((an R_TIMES (am R_TIMES dk)) R_MINUS (dn R_TIMES (dm R_TIMES dk))) R_PLUS ((an R_TIMES (dm R_TIMES ak)) R_PLUS (dn R_TIMES (am R_TIMES ak))) /= (((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_TIMES dk) R_PLUS (((an R_TIMES dm) R_PLUS (dn R_TIMES am)) R_TIMES ak)
	ALGEBRA(Stat6,Stat7) ==> ((an R_TIMES (am R_TIMES dk) = (an R_TIMES am) R_TIMES dk) &
		(dn R_TIMES (dm R_TIMES dk) = (dn R_TIMES dm) R_TIMES dk)) &
		(an R_TIMES (dm R_TIMES ak) = (an R_TIMES dm) R_TIMES ak) &
		(dn R_TIMES (am R_TIMES ak) = (dn R_TIMES am) R_TIMES ak) &
		(dk R_TIMES (an R_TIMES am) = (an R_TIMES am) R_TIMES dk) &
		(dk R_TIMES (dn R_TIMES dm) = (dn R_TIMES dm) R_TIMES dk) &
		(ak R_TIMES (an R_TIMES dm) = (an R_TIMES dm) R_TIMES ak) &
		(ak R_TIMES (dn R_TIMES am) = (dn R_TIMES am) R_TIMES ak) &
		(((dk R_TIMES (an R_TIMES am)) R_MINUS (dk R_TIMES (dn R_TIMES dm))) = dk R_TIMES ((an R_TIMES am) R_MINUS (dn R_TIMES dm))) &
		(((ak R_TIMES (an R_TIMES dm)) R_PLUS  (ak R_TIMES (dn R_TIMES am))) = ak R_TIMES ((an R_TIMES dm) R_PLUS  (dn R_TIMES am))) &
		(dk R_TIMES ((an R_TIMES am) R_MINUS (dn R_TIMES dm)) = ((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_TIMES dk) &
		(ak R_TIMES ((an R_TIMES dm) R_PLUS  (dn R_TIMES am)) = ((an R_TIMES dm) R_PLUS  (dn R_TIMES am)) R_TIMES ak)
EQUAL(Stat14) ==> false; Discharge ==> QED
--
--
--
Theorem 833: ((K in Cm) & (N in Cm) & (M in Cm)) imp ((N C_TIMES (M C_PLUS K)) = ((N C_TIMES M) C_PLUS (N C_TIMES K))). Proof:
Suppose_not(k,n,m) ==> AUTO
	ELEM ==> Stat1: (k in Cm) & (n in Cm) & (m in Cm)
	Use_def(C_PLUS)(*) ==> Stat2: (car(m C_PLUS k) = (car(m) R_PLUS car(k))) & (cdr(m C_PLUS k) = (cdr(m) R_PLUS cdr(k)))
	Use_def(C_TIMES)(Stat2*) ==> Stat3:
		((n C_TIMES m) = [(car(n) R_TIMES car(m)) R_MINUS (cdr(n) R_TIMES cdr(m)), (car(n) R_TIMES cdr(m)) R_PLUS (cdr(n) R_TIMES car(m))]) &
		((n C_TIMES k) = [(car(n) R_TIMES car(k)) R_MINUS (cdr(n) R_TIMES cdr(k)), (car(n) R_TIMES cdr(k)) R_PLUS (cdr(n) R_TIMES car(k))]) &
		((n C_TIMES (m C_PLUS k)) = [(car(n) R_TIMES car(m C_PLUS k)) R_MINUS (cdr(n) R_TIMES cdr(m C_PLUS k)),
			(car(n) R_TIMES cdr(m C_PLUS k)) R_PLUS (cdr(n) R_TIMES car(m C_PLUS k))])
	Loc_def ==> Stat4: (an = car(n)) & (((dn = cdr(n)) & (am = car(m))) & ((dm = cdr(m)) & (ak = car(k))) & (dk = cdr(k)))
	EQUAL ==> Stat5: [(an R_TIMES (am R_PLUS ak)) R_MINUS (dn R_TIMES (dm R_PLUS dk)),
				  (an R_TIMES (dm R_PLUS dk)) R_PLUS (dn R_TIMES (am R_PLUS ak))] /=
		([(an R_TIMES am) R_MINUS (dn R_TIMES dm), (an R_TIMES dm) R_PLUS (dn R_TIMES am)] C_PLUS
		 [(an R_TIMES ak) R_MINUS (dn R_TIMES dk), (an R_TIMES dk) R_PLUS (dn R_TIMES ak)])
	Use_def(C_PLUS)(Stat5*) ==> Stat6: [(an R_TIMES (am R_PLUS ak)) R_MINUS (dn R_TIMES (dm R_PLUS dk)),
					(an R_TIMES (dm R_PLUS dk)) R_PLUS (dn R_TIMES (am R_PLUS ak))] /=
		[((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_PLUS ((an R_TIMES ak) R_MINUS (dn R_TIMES dk)),
		 ((an R_TIMES dm) R_PLUS  (dn R_TIMES am)) R_PLUS ((an R_TIMES dk) R_PLUS  (dn R_TIMES ak))]
	(Stat6)ELEM ==> Stat7: ((an R_TIMES (am R_PLUS ak)) R_MINUS (dn R_TIMES (dm R_PLUS dk)) /= ((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_PLUS ((an R_TIMES ak) R_MINUS (dn R_TIMES dk))) or
		((an R_TIMES (dm R_PLUS dk)) R_PLUS  (dn R_TIMES (am R_PLUS ak)) /= ((an R_TIMES dm) R_PLUS  (dn R_TIMES am)) R_PLUS ((an R_TIMES dk) R_PLUS  (dn R_TIMES ak)))
	ELEM ==> (k in Cm) & (n in Cm) & (m in Cm)
	n-->T816(Stat1,Stat4*) ==> Stat8: (an in Re) & (dn in Re)
	m-->T816(Stat1,Stat4*) ==> (am in Re) & (dm in Re)
	k-->T816(Stat1,Stat4*) ==> (ak in Re) & (dk in Re)
	ALGEBRA(Stat8) ==> (an R_TIMES (am R_PLUS ak)) R_MINUS (dn R_TIMES (dm R_PLUS dk)) = ((an R_TIMES am) R_MINUS (dn R_TIMES dm)) R_PLUS ((an R_TIMES ak) R_MINUS (dn R_TIMES dk))
--	ALGEBRA(Stat8) ==> ((an R_TIMES (dm R_PLUS dk)) R_PLUS  (dn R_TIMES (am R_PLUS ak)) = ((an R_TIMES dm) R_PLUS  (dn R_TIMES am)) R_PLUS ((an R_TIMES dk) R_PLUS  (dn R_TIMES ak)))
ALGEBRA(Stat7*) ==> false; Discharge ==> QED
--
--
--
Theorem 834: (M in Cm) imp ((M = (M C_TIMES C_1)) & (M = (C_1 C_TIMES M))). Proof:
Suppose_not(m) ==> AUTO
	T817(*) ==> C_1 in Cm
	(m,C_1)-->T824(*) ==> (C_1 C_TIMES m) = (m C_TIMES C_1)
	Suppose ==> m = (m C_TIMES C_1)
		EQUAL ==> m = (C_1 C_TIMES m)
	Discharge ==> Stat1: (m in Cm) & (m /= (m C_TIMES C_1))
	m-->T816(Stat1*) ==> Stat2: (car(m) in Re) & (cdr(m) in Re) & (m = [car(m),cdr(m)])
	Use_def(C_TIMES)(Stat1*) ==> m /= [(car(m) R_TIMES car(C_1)) R_MINUS (cdr(m) R_TIMES cdr(C_1)),
		(car(m) R_TIMES cdr(C_1)) R_PLUS (cdr(m) R_TIMES car(C_1))]
	Use_def(C_1)(Stat1) ==> (car(C_1) = R_1) & (cdr(C_1) = R_0)
	ALGEBRA(Stat2) ==> ((car(m) R_TIMES R_1) R_MINUS (cdr(m) R_TIMES R_0) = car(m)) & ((car(m) R_TIMES R_0) R_PLUS (cdr(m) R_TIMES R_1) = cdr(m))
EQUAL(Stat2) ==> false; Discharge ==> QED

--
Theorem 835: ((M in Cm) & (M /= C_0)) imp ((C_Recip(M) in Cm) & ((M C_TIMES C_Recip(M)) = C_1)). Proof:
Suppose_not(m) ==> AUTO
	m-->T816(*) ==> Stat1: (car(m) in Re) & (cdr(m) in Re) & (m = [car(m),cdr(m)])
	Use_def(C_0) ==> (car(m) /= R_0) or (cdr(m) /= R_0)
	Use_def(C_abs) ==> Stat2: C_abs(m) = sqrt((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m)))
	Loc_def ==> Stat3: nrm = (car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m))
	(car(m))-->T714(Stat1, Stat1*) ==> Stat4: R_is_nonneg(car(m) R_TIMES car(m))
	(cdr(m))-->T714(Stat1, Stat1*) ==> R_is_nonneg(cdr(m) R_TIMES cdr(m))
	ALGEBRA(Stat1, Stat1) ==> ((car(m) R_TIMES car(m)) in Re) & ((cdr(m) R_TIMES cdr(m)) in Re)
	(car(m) R_TIMES car(m), cdr(m) R_TIMES cdr(m))-->T667(Stat4*) ==> Stat5: R_is_nonneg((car(m) R_TIMES car(m)) R_PLUS (cdr(m) R_TIMES cdr(m)))
	ALGEBRA(Stat1,Stat3) ==> Stat6: nrm in Re
	EQUAL(Stat3, Stat5) ==> Stat7: R_is_nonneg(nrm)
	Suppose ==> nrm = R_0
		(car(m) R_TIMES car(m), cdr(m) R_TIMES cdr(m))-->T699(Stat3*) ==> ((car(m) R_TIMES car(m)) = R_0) & ((cdr(m) R_TIMES cdr(m)) = R_0)
		(car(m), car(m))-->T700(*) ==> car(m) = R_0
	(cdr(m), cdr(m))-->T700(*) ==> false; Discharge ==> Stat8: nrm /= R_0
	nrm-->T808 ==> Stat9: sqrt(nrm) R_TIMES sqrt(nrm) = nrm
	EQUAL ==> Stat10: C_abs(m) R_TIMES C_abs(m) = nrm
	Use_def(C_Recip(m)) ==> AUTO
	EQUAL ==> Stat11: C_Recip(m) = [(car(m) R_OVER nrm), (R_Rev(cdr(m)) R_OVER nrm)]
--
-- we now show that $C_Recip(m)$ in $Cm$
--
	(car(m), nrm)-->T651(Stat1, Stat6, Stat8*) ==> Stat12: (car(m) R_OVER nrm) in Re
	(cdr(m), cdr(m))-->T613(Stat1, Stat1*) ==> Stat13: R_Rev(cdr(m)) in Re
	(R_Rev(cdr(m)), nrm)-->T651(Stat13, Stat6, Stat8*) ==> (R_Rev(cdr(m)) R_OVER nrm) in Re
	(car(m) R_OVER nrm, R_Rev(cdr(m)) R_OVER nrm)-->T815(Stat10*) ==> Stat14: C_Recip(m) in Cm
--
-- we rewrite $m C_TIMES C_Recip(m)$ in order to show that $m C_TIMES C_Recip(m) = C_1$
--
	Use_def(C_TIMES) ==> m C_TIMES C_Recip(m) =
		[((car(m) R_TIMES car(C_Recip(m))) R_MINUS (cdr(m) R_TIMES cdr(C_Recip(m)))),
		 ((car(m) R_TIMES cdr(C_Recip(m))) R_PLUS (cdr(m) R_TIMES car(C_Recip(m))))]
	(C_Recip(m))-->T816(Stat14, Stat14) ==> (car(C_Recip(m)) in Re) & (cdr(C_Recip(m)) in Re) & (C_Recip(m) = [car(C_Recip(m)),cdr(C_Recip(m))])
	(Stat11)ELEM ==> (car(C_Recip(m)) = (car(m) R_OVER nrm)) & (cdr(C_Recip(m)) = (R_Rev(cdr(m)) R_OVER nrm))
	EQUAL(Stat11) ==> m C_TIMES C_Recip(m) =
		[((car(m) R_TIMES (car(m) R_OVER nrm)) R_MINUS (cdr(m) R_TIMES (R_Rev(cdr(m)) R_OVER nrm))),
		 ((car(m) R_TIMES (R_Rev(cdr(m)) R_OVER nrm)) R_PLUS (cdr(m) R_TIMES (car(m) R_OVER nrm)))]
	Use_def(R_OVER)(*) ==> M C_TIMES C_Recip(M) =
		[(car(m) R_TIMES (car(m) R_TIMES R_Recip(nrm))) R_MINUS (cdr(m) R_TIMES (R_Rev(cdr(m)) R_TIMES R_Recip(nrm))),
		 (car(m) R_TIMES (R_Rev(cdr(m)) R_TIMES R_Recip(nrm))) R_PLUS (cdr(m) R_TIMES (car(m) R_TIMES R_Recip(nrm)))]
	(nrm)-->T647(Stat6, Stat8*) ==> Stat15: R_Recip(nrm) in Re
--
-- we now show that $car(m C_TIMES C_Recip(m)) = R_1$
--
	ALGEBRA(Stat1,Stat1) ==> (cdr(m) R_TIMES R_Rev(cdr(m)) = R_Rev(cdr(m) R_TIMES cdr(m))) &
		(((car(m) R_TIMES car(m)) R_MINUS (cdr(m) R_TIMES R_Rev(cdr(m)))) = (car(m) R_TIMES car(m)) R_PLUS R_Rev(cdr(m) R_TIMES R_Rev(cdr(m)))) &
		(R_Rev(R_Rev(cdr(m) R_TIMES cdr(m))) = (cdr(m) R_TIMES cdr(m)))
	(nrm)-->T647(Stat6, Stat8*) ==> R_Recip(nrm) R_TIMES nrm = R_1
--
-- we now show that $cdr(m C_TIMES C_Recip(m)) = R_0$
--
	ALGEBRA(Stat1,Stat15) ==> (car(m) R_TIMES (R_Rev(cdr(m)) R_TIMES R_Recip(nrm)) = (car(m) R_TIMES R_Rev(cdr(m))) R_TIMES R_Recip(nrm)) &
		(R_Rev(car(m) R_TIMES cdr(m)) R_TIMES R_Recip(nrm) = R_Recip(nrm) R_TIMES R_Rev(car(m) R_TIMES cdr(m))) &
		((car(m) R_TIMES cdr(m)) R_TIMES R_Recip(nrm) = R_Recip(nrm) R_TIMES (car(m) R_TIMES cdr(m))) &
		((R_Recip(nrm) R_TIMES R_Rev(car(m) R_TIMES cdr(m))) R_PLUS (R_Recip(nrm) R_TIMES (car(m) R_TIMES cdr(m))) = R_Recip(nrm) R_TIMES (R_Rev(car(m) R_TIMES cdr(m)) R_PLUS (car(m) R_TIMES cdr(m))))
	ALGEBRA(Stat1,Stat1) ==> (car(m) R_TIMES R_Rev(cdr(m)) = R_Rev(car(m) R_TIMES cdr(m))) &
		(cdr(m) R_TIMES car(m) = car(m) R_TIMES cdr(m)) &
		((car(m) R_TIMES cdr(m)) R_PLUS R_Rev(car(m) R_TIMES cdr(m)) = R_0)
	ALGEBRA(Stat15,Stat15) ==> R_Recip(nrm) R_TIMES R_0 = R_0
EQUAL ==> false; Discharge ==> QED
--
Theorem 836: ((N in Cm) & (M in Cm) & (M /= C_0)) imp (N = M C_TIMES (N C_OVER M)). Proof:
Suppose_not(n,m) ==> AUTO
        Use_def(C_OVER)(*) ==> n /= m C_TIMES (n C_TIMES C_Recip(m))
        m-->T835(*) ==> Stat1: (C_Recip(m) in Cm) & (m C_TIMES C_Recip(m) = C_1)
        (n, C_Recip(m))-->T824(*) ==> n C_TIMES C_Recip(m) = C_Recip(m) C_TIMES n
        (n,m, C_Recip(m))-->T832(*) ==> m C_TIMES (C_Recip(m) C_TIMES n) = (m C_TIMES C_Recip(m)) C_TIMES n
        EQUAL ==> n /= C_1 C_TIMES n
        T817(*) ==> C_1 in Cm
        (C_1, n)-->T824(*) ==> C_1 C_TIMES n = n C_TIMES C_1
n-->T834(*) ==> false; Discharge ==>QED
--
Theorem 837: (R_0 in Re) & (FORALL x | (x in Re) imp ((x R_PLUS R_0) = x)) &
	(FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) = (y R_PLUS x))) &
	(FORALL x, y | ((x in Re) & (y in Re)) imp ((x R_PLUS y) in Re)) &
	(FORALL x, y, z | ((x in Re) & (y in Re) & (z in Re)) imp (((x R_PLUS y) R_PLUS z) = (x R_PLUS (y R_PLUS z)))). Proof:
Suppose_not ==> AUTO
    ALGEBRA ==> R_0 in Re
    Suppose ==> Stat1: not(FORALL x | (x in Re) imp (x R_PLUS R_0 = x))
		x1-->Stat1(Stat1*) ==> (x1 in Re) & (x1 R_PLUS R_0 /= x1)
	ALGEBRA(Stat1) ==> false; Discharge ==> (FORALL x | (x in Re) imp (x R_PLUS R_0 = x))
	Suppose ==> Stat2: not(FORALL x, y | ((x in Re) & (y in Re)) imp (x R_PLUS y = y R_PLUS x))
		(x2,y2)-->Stat2(Stat2*) ==> (x2 in Re) & (y2 in Re) & (x2 R_PLUS y2 /= y2 R_PLUS x2)
	ALGEBRA(Stat2) ==> false; Discharge ==> (FORALL x, y | ((x in Re) & (y in Re)) imp (x R_PLUS y = y R_PLUS x))
	Suppose ==> Stat3: not(FORALL x, y | ((x in Re) & (y in Re)) imp (x R_PLUS y in Re))
		(x3,y3)-->Stat3(Stat3*) ==> (x3 in Re) & (y3 in Re) & (x3 R_PLUS y3 notin Re)
	ALGEBRA(Stat3) ==> false; Discharge ==> Stat4: not(FORALL x, y, z | ((x in Re) & (y in Re) & (z in Re)) imp ((x R_PLUS y) R_PLUS z = x R_PLUS (y R_PLUS z)))
	(x4,y4,z4)-->Stat4(Stat4*) ==> (x4 in Re) & (y4 in Re) & (z4 in Re) & ((x4 R_PLUS y4) R_PLUS z4 /= x4 R_PLUS (y4 R_PLUS z4))
ALGEBRA(Stat4) ==> false; Discharge ==> QED
--
-- [Sums for Real Maps with finite domains]
APPLY(sigma_thryvar:Sig) sigma_theory(s->Re,pluz(i,j)->(i R_PLUS j),e->R_0) ==>
Theorem real_sigma0: (Sig(0) = R_0) &
    (FORALL x | (cdr(x) in Re) imp (Sig({x}) = cdr(x))) &
	(FORALL f | (Finite(f) & (range(f) incin Re)) imp (Sig(f) in Re)) &
	(FORALL c,f | ((c in f) & Finite(f) & (range(f) incin Re)) imp (Sig(f) = Sig(f - {c}) R_PLUS cdr(c))) &
	(FORALL f,t | (Finite(f) & Is_map(f) & (range(f) incin Re)) imp (Sig(f) = (Sig(f ON (domain(f) * t)) R_PLUS Sig(f ON (domain(f) - t)))))
--
--
Theorem real_sigma: (Svm(F) & (range(F) incin Re) & Finite(F)) imp
	((Sig(F) in Re) & ((P in F) imp (Sig({P}) = (F~[car(P)]))) &
	 (Sig(F) = (Sig(F ON (domain(F) * A)) R_PLUS Sig(F ON (domain(F) - A))))). Proof:
Suppose_not(f,p,a) ==> AUTO
	ELEM ==> Stat1: Svm(f) & (range(f) incin Re) & Finite(f)
	Treal_sigma0 ==> Stat2: (FORALL f | (Finite(f) & (range(f) incin Re)) imp (Sig(f) in Re)) &
		Stat3: (FORALL x | (cdr(x) in Re) imp (Sig({x}) = cdr(x))) &
		Stat4: (FORALL f,a | (Finite(f) & Is_map(f) & (range(f) incin Re)) imp (Sig(f) = (Sig(f ON (domain(f) * a)) R_PLUS Sig(f ON (domain(f) - a)))))
	f-->Stat2(Stat1*) ==> Sig(f) in Re
	Use_def(Svm) ==> Is_map(f)
	Suppose ==> Stat5: not((p in f) imp (Sig({p}) = (f~[car(p)])))
		(p,f)-->T61(Stat5,Stat1*) ==> cdr(p) in Re
		p-->Stat3(Stat5*) ==> Sig({p}) = cdr(p)
		(f,p)-->T74(Stat1,Stat5*) ==> cdr(p) = (f~[car(p)])
	(Stat5*)Discharge ==> Sig(f) /= (Sig(f ON (domain(f) * a)) R_PLUS Sig(f ON (domain(f) - a)))
(f,a)-->Stat4(Stat1*) ==> false; Discharge ==> QED
--
Def 80a: [Sums of absolutely convergent infinite series]
     Sig_inf(f) := Un({Sig(f ON s): s incin Domain(f) | Finite(s)})
--
Def 81h: [Real functions of a real variable]
    RF := {f incin (Re PROD Re) | Svm(f) & domain(f) = Re}
--
Def 84: [Pointwise LUB of a set of Real Functions] LUB(s) := {[x,Un({f~[x]: f in s})]: x in Re}
--
Theorem 838: (RF_0 in RF). Proof:
Suppose_not ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 839: (N in RF) imp ((N F_PLUS RF_0) = N). Proof:
Suppose_not(n) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 840: ((N in RF) & (M in RF)) imp ((N F_PLUS M) = (M F_PLUS N)). Proof:
Suppose_not(n,m) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 841: ((N in RF) & (M in RF)) imp ((N F_PLUS M) in RF). Proof:
Suppose_not(n,m) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 842: ((N in RF) & (M in RF)) imp (N F_TIMES M = M F_TIMES N). Proof:
Suppose_not(n,m) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 843: ((N in RF) & (M in RF) & (K in RF)) imp (N F_PLUS (M F_PLUS K) = (N F_PLUS M) F_PLUS K). Proof:
Suppose_not(n,m,k) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 844: ((K in RF) & (N in RF) & (M in RF)) imp (N F_TIMES (M F_TIMES K) = (N F_TIMES M) F_TIMES K). Proof:
Suppose_not(k,n,m) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
Theorem 845: ((K in RF) & (N in RF) & (M in RF)) imp (N F_TIMES (M F_PLUS K) = (N F_TIMES M) F_PLUS (N F_TIMES K)). Proof:
Suppose_not(k,n,m) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
-- [Sums for series of real functions]
--
APPLY(sigma_thryvar:FSig) sigma_theory(s->RF,pluz(i,j)->(i F_PLUS j),e->RF_0) ==>
Theorem real_function_sigma: (FSig(0) = RF_0) &
	(FORALL x | (cdr(x) in RF) imp (FSig({x}) = cdr(x))) &
	(FORALL ser | (Finite(ser) & (range(ser) incin RF)) imp (FSig(ser) in RF)) &
	(FORALL ser, a | (Finite(ser) & Is_map(ser) & (range(ser) incin RF)) imp
			(FSig(ser) = (FSig(ser ON (domain(ser) * a)) F_PLUS FSig(ser ON (domain(ser) - a))))) &
    (FORALL p, ser | ((p in ser) & Finite(ser) & (range(ser) incin RF)) imp
			(FSig(ser) = FSig(ser - {p}) F_PLUS cdr(p)))
--
Def 86: [Pointwise sums of absolutely convergent infinite series of real functions] FSig_inf(ser) := LUB({Sig(ser ON s): s incin domain(ser) | Finite(s)})
--
-- [Product of a nonempty family of sets; Note - this is also the real greatest lower bound]
Def 87: [Greatest lower bound of a set of ordinals] GLB(s) := {x in arb(s) | (FORALL y in s | x in y)}
--
Def 88a: [Block function] Bl_f(a,b,c) := {[x,if a incin x and x incin b then c else R_0 end if]: x in Re}
--
Def 89a: [Block function integral] BFInt(f) := arb({c R_TIMES (b R_MINUS a): a in Re, b in Re, c in Re | Bl_f(a,b,c) = f})
--
Def 90: [Block functions] RBF := {Bl_f(a,b,c): a in Re, b in Re, c in Re}
--
Def 91: [Comparison of real functions] Def(f RF_GT g) := (f /= g) & (FORALL x in Re | f~[x] incs g~[x])
--
Def 92: [Lebesgue Upper Integral of a Positive Function] ULeInt(f) :=
	GLB({Sig_inf({[n,BFInt(ser~[n])]: n in Za}): ser incin (Za PROD RBF) | Svm(ser) & (FSig_inf(ser) RF_GT f)})
--
Def 93: [Positive Part of a real function] Pos_part(f) := {[x, if f~[x] incs R_0 then f~[x] else R_0 end if]: x in Re}
--
Def 94: [Pointwise additive inverse of a real function] RF_Rev(f) := {[x, R_Rev(f~[x])]: x in Re}
--
Def 95: [Lebesgue Integral of a real-valued function] Int(f) := ULeInt(Pos_part(f)) R_MINUS ULeInt(Pos_part(RF_Rev(f)))
--
Def 96: [Continuous real function of a real variable] is_continuous_RF(f) := (f incin (Re PROD Re)) & Svm(f) &
    (FORALL x in domain(f), eps in Re | (EXISTS delt in Re, y in domain(f) | ((delt R_GT 0) &
	(eps incs R_0 & eps /= R_0 & delt incs abs(x R_MINUS y)) imp (eps incs abs(f~[x] R_MINUS f~[y])))))
--
Def 97: [Euclidean n-space] Euc(n) := {f incin (n PROD Re) | Svm(f) & domain(f) = n}
--
Def 98: [Euclidean norm] norm(f) := sqrt(FSig(f))
--
--Def 99: [Pointwise difference of Real Functions] Def(f F_MINUS g) := {[x,f~[x] R_MINUS g~[x]]: x in domain(f)}
--
Def 100: [Continuous function on Euclidean n-space] is_continuous_REnF(f,n) := (f incin (Euc(n) PROD Euc(n))) & Svm(f) &
    (FORALL x in domain(f), eps in Re | (EXISTS delt in Re | (FORALL y in domain(f) |
	(delt incs R_0 & delt /= R_0 &
	(eps incs R_0 & eps /= R_0 & delt incs norm(x F_MINUS y)) imp (eps incs abs(f~[x] R_MINUS f~[y]))))))
--
Def 103: [Complex functions of a complex variable] CF := {f incin (Cm PROD Cm) | Svm(f) & domain(f) = Cm}
--
Def 104: [Complex Euclidean $n$-space] CEuc(n) := {f incin (n PROD Cm) | Svm(f) & domain(f) = n}
--
Def 105: [Difference-and-diagonal trick, complex case] CDD(f,df) := {if x~[0] /= x~[1] then (f~[x~[0]] C_MINUS f~[x~[1]]) C_OVER (x~[0] C_MINUS x~[1])
					else df~[x~[0]] end if: x in CEuc(2)}
--
Def 106: [Continuous function of a complex variable] is_continuous_CF(f) := (f incin (Cm PROD Cm)) & Svm(f) &
    (FORALL x in domain(f), eps in Re | (EXISTS delt in Re | (FORALL y in domain(f) |
	(delt incs R_0 & delt /= R_0 &
	(eps incs R_0 & eps /= R_0 & delt incs norm(x C_MINUS y)) imp (eps incs norm(f~[x] C_MINUS f~[y]))))))
--
Def 107: [Complex Euclidean norm] Cnorm(f) := sqrt(FSig({[m,C_abs(f~[m]) R_TIMES C_abs(f~[m])]: m in domain(f)}))
--
Def 108: [Difference of Complex Functions] Def(f CF_MINUS g) := {[x,f~[x] C_MINUS g~[x]]: x in Cm}
--
Def 109: [Continuous function on Complex Euclidean n-space] is_continuous_CEnF(f,n) := (f incin (CE(n) PROD CE(n))) & Svm(f) &
 (FORALL x in domain(f), eps in Re | (EXISTS delt in Re | (FORALL y in domain(f) |
    (delt incs R_0 & delt /= R_0 &
     (eps incs R_0 & eps /= R_0 & delt incs Cnorm(x CF_MINUS y)) imp (eps incs Cnorm(f~[x] CF_MINUS f~[y]))))))
--
Def 110: [Derivative of function of a complex variable] CDer(f) := arb({df in CF | domain(f) = domain(df) &
		is_continuous_CEnF(CDD(f,df) ON (domain(f) PROD domain(f)),2)})
--
Def 111: [Open set in the complex plane] is_open_C_set(s) := (s incin Cm) &
		is_continuous_CF({[z,if z in s then [R_0,R_0] else [R_1,R_0] end if]: z in Cm})
--
Def 112: [Analytic function of a complex variable] is_analytic_CF(f) := is_continuous_CF(f) & is_open_C_set(domain(f)) & CDer(f) /= 0
--
Def 113: [Complex exponential function] C_exp_fcn := arb({f: f incin (Cm PROD Cm) | is_analytic_CF(f) & CDer(f) = f & f~[[R_0,R_0]] = [R_1,R_0]})
--
Def 114: [The constant $pi$] pi := arb({x in Re | x incs R_0 & x /= R_0 & C_exp_fcn([R_0,x]) = [R_1,R_0] &
		(FORALL y in Re | ((C_exp_fcn([R_0,y]) = [R_1,R_0]) imp (y = x or R_0 incs y)))})
--
Def 115: [Continuous complex function on the reals] is_continuous_CoRF(f) := (f incin (Re PROD Cm)) & Svm(f) &
    (FORALL x in domain(f), eps in Re | (EXISTS delt in Re | (FORALL y in domain(f) | ((delt R_GT 0) &
	(eps incs R_0 & eps /= R_0 & delt incs abs(x R_MINUS y)) imp (eps incs norm(f~[x] C_MINUS f~[y]))))))
--
Def 116: [Difference-and-diagonal trick, real-to-complex case] CRDD(f,df) := {if x~[0] /= x~[1] then (f~[x~[0]] C_MINUS f~[x~[1]]) C_OVER (x~[0] C_MINUS x~[1])
					else df~[x~[0]] end if: x in E(2)}
--
Def 117: [Continuous complex function on $E(n)$] is_continuous_CREnF(f,n) := (f incin (E(n) PROD Cm)) & Svm(f) &
 (FORALL x in domain(f), eps in Re | (EXISTS delt in Re | (FORALL y in domain(f) | ((delt R_GT R_0) &
    ((eps R_GT R_0) & (delt R_GE norm(x F_MINUS y))) imp (eps R_GE C_abs(f~[x] CF_MINUS f~[y]))))))
--
Def 118: [Derivative of complex function of a real variable] CRDer(f) := arb({df in CF | domain(f) = domain(df) &
		is_continuous_CREnF(CRDD(f,df) ON (domain(f) PROD domain(f)),2)})
--
Def 119: [Real Interval] Interval(a,b) := {x in Re | a incin x & x incin b}
--
Def 120: [Continuously differentiable curve in the complex plane] is_CD_curv(f,a,b) :=
    is_continuous_CoRF(f) & (domain(f) = Interval(a,b)) & (0 /= CRDer(f)) & is_continuous_CoRF(CRDer(f))
--
Def 121: [Complex line integral] Line_Int(f,curv,a,b) :=
    [Int({[x,if x notin Interval(a,b) then R_0 else car(f~[curv~[x]] C_TIMES CRDer(curv)~[x]) end if]:
							x in Re}),
    Int({[x,if x notin Interval(a,b) then R_0 else cdr(f~[curv~[x]] C_TIMES CRDer(curv)~[x]) end if]:
							x in Re})]
Theorem 846: [Cauchy integral theorem]
    is_analytic_CF(F) imp (EXISTS eps in Re | (eps R_GT R_0) &
	 (FORALL crv1, crv2 | (is_CD_curv(crv1,R_0,R_1) & is_CD_curv(crv2,R_0,R_1) &
	 ((crv1~[R_0]) = (crv1~[R_1])) & ((crv2~[R_0]) = (crv2~[R_1])) &
	 (FORALL x in Interval(R_0,R_1) | eps R_GE C_abs((crv1~[x]) C_MINUS (crv2~[x]))))
	imp (Line_Int(F,crv1,R_0,R_1) = Line_Int(F,crv2,R_0,R_1)) )). Proof:
Suppose_not(f) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
Theorem 847: [Cauchy integral formula]
    (is_analytic_CF(F) & (domain(F) incs {w in Cm | C_abs(w) R_GE R_1})) imp
	(FORALL w in Cm | (C_abs(w) R_GT R_1) imp ((F~[w]) = (Line_Int({[x,(F~[x]) C_OVER (x C_MINUS w)]: x in (Cm -{w})},
		{[x,C_exp_fcn([R_0,x])]: x in Re}, R_0, pi R_PLUS pi) C_OVER ([R_0,pi R_PLUS pi])) )). Proof:
Suppose_not(f) ==> AUTO
	Tsomehow ==> false; Discharge ==> QED
--
--PAUSE HERE ------------
--
-- Beyond this point, the number of steps of definition needed to reach any concept, say,
-- of classical functional analysis can be estimated by counting the number of definitions
-- needed to reach the corresponding point in any standard reference on this subject, e.g. Dunford-Schwartz.
--
--BEGIN HERE ------------
--
--
-- ************************************************************************************************
--			Section 16: Rank, cumulative hierarchies, superstructures, hereditarily finite sets
-- ************************************************************************************************
--
Def 10090: [Rank of a set] rk(X) := Un({next(rk(y)): y in X})
--
--
Theorem 848: (S = 0) eq (rk(S) = 0). Proof:
Suppose_not(s0) ==> AUTO
	Use_def(rk(0)) ==> AUTO
	Suppose ==> Stat1: {next(rk(y)): y in 0} /= 0
		c-->Stat1(Stat1*) ==> false
	Discharge ==> {next(rk(y)): y in 0} = 0
	T109 ==> Un(0) = 0
	EQUAL ==> rk(0) = 0
	Suppose ==> s0 = 0
		EQUAL ==> false
	Discharge ==> AUTO
	Use_def(rk(s0)) ==> AUTO
	ELEM ==> Stat2: (arb(s0) in s0) & (Un({next(rk(y)): y in s0}) = 0)
	Suppose ==> Stat3: {next(rk(y)): y in s0} /= 0
		({next(rk(y)): y in s0})-->T109(Stat2) ==> Stat4: 0 in {next(rk(y)): y in s0}
		y0-->Stat4(Stat4*) ==> 0 = next(rk(y0))
		Use_def(next(rk(y0))) ==> AUTO
	(Stat4*)Discharge ==> Stat5: {next(rk(y)): y in s0} = 0
	(arb(s0))-->Stat5(Stat2*) ==> false
	Discharge ==> QED
--
--
Theorem 849: rk({X}) = next(rk(X)). Proof:
Suppose_not(x0) ==> AUTO
	Use_def(rk({x0})) ==> AUTO
	SIMPLF ==> {next(rk(y)): y in {x0}} = {next(rk(x0))}
	(next(rk(x0)))-->T107 ==> AUTO
	EQUAL ==> false
	Discharge ==> QED
--
-- The following theorem will be generalized later into
--	$rk(Un(X)) = Un({rk(y): y in X})$.
--
Theorem 850: rk(X + Y) = rk(X) + rk(Y). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def(rk(x0 + y0)) ==> AUTO
	Use_def(rk(x0)) ==> AUTO
	Use_def(rk(y0)) ==> AUTO
	ELEM ==> Stat1: Un({next(rk(y)): y in x0 + y0}) /= Un({next(rk(y)): y in x0}) + Un({next(rk(y)): y in y0})
	Set_monot ==> {next(rk(y)): y in x0} incin {next(rk(y)): y in x0 + y0}
	Set_monot ==> {next(rk(y)): y in y0} incin {next(rk(y)): y in x0 + y0}
	({next(rk(y)): y in x0},{next(rk(y)): y in x0 + y0})-->T276 ==> AUTO
	({next(rk(y)): y in y0},{next(rk(y)): y in x0 + y0})-->T276(Stat1*) ==> Stat2: Un({next(rk(y)): y in x0 + y0}) nincin (Un({next(rk(y)): y in x0}) + Un({next(rk(y)): y in y0}))
	({next(rk(y)): y in x0},{next(rk(y)): y in y0})-->T277(Stat2*) ==> Un({next(rk(y)): y in x0 + y0}) nincin Un({next(rk(y)): y in x0} + {next(rk(y)): y in y0})
	({next(rk(y)): y in x0 + y0},{next(rk(y)): y in x0} + {next(rk(y)): y in y0})-->T276(Stat2*) ==> Stat3: {next(rk(y)): y in x0 + y0} nincin ({next(rk(y)): y in x0} + {next(rk(y)): y in y0})
	x1-->Stat3(Stat3*) ==> Stat4:(x1 in {next(rk(y)): y in x0 + y0}) & (x1 notin {next(rk(y)): y in x0}) & (x1 notin {next(rk(y)): y in y0})
	(y1,y1,y1)-->Stat4(Stat4*) ==> false
	Discharge ==> QED
--
--
Theorem 851: rk({X,Y}) = next(rk(X)) + next(rk(Y)). Proof:
Suppose_not(x0,y0) ==> AUTO
	({x0},{y0})-->T850 ==> AUTO
	x0-->T849 ==> AUTO
	y0-->T849 ==> AUTO
	TELEM ==> {x0,y0} = {x0} + {y0}
	EQUAL ==> false
	Discharge ==> QED
--
--
Theorem 852: ((X incin Y) imp (rk(X) incin rk(Y))) & ((X in Y) imp (rk(X) in rk(Y))). Proof:
Suppose_not(x0,y0) ==> AUTO
	Suppose ==> Stat1: (x0 incin y0) & (not(rk(x0) incin rk(y0)))
		(Stat1*)ELEM ==> y0 = (x0 + (y0 - x0))
		(x0,y0 - x0)-->T850 ==> AUTO
		EQUAL(Stat1) ==> rk(y0) = rk(x0) + rk(y0 - x0)
	(Stat1*)Discharge ==> AUTO
	Suppose ==> Stat2: next(rk(x0)) notin {next(rk(y)): y in y0}
	x0-->Stat2(*) ==> false; Discharge ==> Stat3: next(rk(x0)) in {next(rk(y)): y in y0}
	({next(rk(y)): y in y0})-->T274(Stat3*) ==> Stat4: (FORALL x in {next(rk(y)): y in y0} | x incin Un({next(rk(y)): y in y0}))
	(next(rk(x0)))-->Stat4(Stat3*) ==> next(rk(x0)) incin Un({next(rk(y)): y in y0})
	Use_def(rk(y0)) ==> AUTO
	Use_def(next) ==> false
	Discharge ==> QED
--
--
Theorem 853: rk(Un(X)) = Un({rk(y): y in X}). Proof:
Suppose_not(x0) ==> AUTO
	Suppose ==> Un({rk(y): y in x0}) nincin rk(Un(x0))
		({rk(y): y in x0},rk(Un(x0)))-->T274(*) ==> Stat1: not(FORALL x in {rk(y): y in x0} | x incin rk(Un(x0)))
		SIMPLF ==> Stat2: not(FORALL y in x0 | rk(y) incin rk(Un(x0)))
		y0-->Stat2(Stat2*) ==> (y0 in x0) & (rk(y0) nincin rk(Un(x0)))
		x0-->T274(*) ==> Stat3: (FORALL x in x0 | x incin Un(x0))
		y0-->Stat3(Stat2*) ==> y0 incin Un(x0)
		(y0,Un(x0))-->T852(Stat2*) ==> false
	Discharge ==> Stat4: rk(Un(x0)) nincin Un({rk(y): y in x0})
	c-->Stat4(Stat4*) ==> (c in rk(Un(x0))) & (c notin Un({rk(y): y in x0}))
	Use_def(rk(Un(x0))) ==> AUTO
	Use_def(Un(x0)) ==> AUTO
	EQUAL(Stat4) ==> c in Un({next(rk(y)): y in {u: v in x0, u in v}})
	SIMPLF ==> Stat5: c in Un({next(rk(y)): v in x0, y in v})
	Use_def(Un)(Stat5*) ==> c in {u: w in {next(rk(y)): v in x0, y in v}, u in w}
	SIMPLF(Stat5*) ==> Stat6: c in {u: v in x0, y in v, u in next(rk(y))}
	(v1,y1,u1)-->Stat6(Stat6*) ==> (v1 in x0) & (y1 in v1) & (c in next(rk(y1)))
	Use_def(Un({rk(y): y in x0})) ==> AUTO
	(Stat4*)ELEM ==> Stat7: c notin {u: v in {rk(y): y in x0}, u in v}
	SIMPLF(Stat7*) ==> Stat8: c notin {u: y in x0, u in rk(y)}
	(v1,c)-->Stat8(Stat6*) ==> c notin rk(v1)
	Use_def(rk(v1)) ==> AUTO
	(Stat8*)ELEM ==> Stat9: c notin Un({next(rk(w)): w in v1})
	Use_def(Un)(Stat9*) ==> Stat10: c notin {u: v in {next(rk(w)): w in v1}, u in v}
	SIMPLF(Stat10*) ==> Stat11: c notin {u: w in v1, u in next(rk(w))}
	(y1,c)-->Stat11(Stat6*) ==> false
	Discharge ==> QED
--
--
Theorem 854: [The values of the rank function are ordinals] Ord(rk(X)). Proof:
Suppose_not(c) ==> not Ord(rk(c))
	APPLY(mt1_thryvar:m) transfinite_induction(n->c,P(x)->(not Ord(rk(x)))) ==>
		Stat1: (FORALL k | (not Ord(rk(m))) & ((k in m) imp Ord(rk(k))))
	Suppose ==> Stat2: not(FORALL v in {next(rk(i)): i in m} | Ord(v))
		v0-->Stat2(Stat2) ==> Stat3: (not Ord(v0)) & Stat4: (v0 in {next(rk(i)): i in m})
		i0-->Stat4(Stat3) ==> Stat5: (i0 in m) & (v0 = next(rk(i0)))
		i0-->Stat1(Stat5) ==> Stat6: Ord(rk(i0))
		(rk(i0))-->T32(Stat6) ==> Ord(next(rk(i0)))
	EQUAL(Stat3) ==> false; Discharge ==> Stat7: (FORALL v in {next(rk(i)): i in m} | Ord(v))
	({next(rk(i)): i in m})-->T280(Stat7) ==> Stat8: Ord(Un({next(rk(i)): i in m}))
	Use_def(rk) ==> rk(m) = Un({next(rk(i)): i in m})
	0-->Stat1 ==> (not Ord(rk(m)))
EQUAL(Stat8) ==> false; Discharge ==> QED
--
--
--
Theorem 855: rk([X,Y]) = next(next(next(rk(X)))) + next(next(next(next(rk(Y))))). Proof:
Suppose_not(x0,y0) ==> AUTO
	Use_def([]) ==> Stat1: rk({{x0},{{x0},{{y0},y0}}}) /= next(next(next(rk(x0)))) + next(next(next(next(rk(y0)))))
	Suppose ==> Stat2: rk({{x0},{{x0},{{y0},y0}}}) /= next(rk({{x0},{{y0},y0}}))
		({x0},{{x0},{{y0},y0}})-->T851(Stat2*) ==> Stat3: next(rk({x0})) nincin next(rk({{x0},{{y0},y0}}))
		({{x0}},{{x0},{{y0},y0}})-->T852(Stat3*) ==> rk({{x0}}) incin rk({{x0},{{y0},y0}})
		({{x0}})-->T854(Stat3*) ==> Ord(rk({{x0}}))
		(rk({{x0}}),rk({x0}))-->T37 ==> AUTO
		({x0},{{x0}})-->T852(Stat2*) ==> Stat4: next(rk({x0})) incin rk({{x0},{{y0},y0}})
		Use_def(next)(Stat3,Stat4*) ==> false
	Discharge ==> rk({{x0},{{x0},{{y0},y0}}}) = next(rk({{x0},{{y0},y0}}))
	({x0},{{y0},y0})-->T851(*) ==> rk({{x0},{{y0},y0}}) = next(rk({x0})) + next(rk({{y0},y0}))
	EQUAL(Stat1) ==> Stat5: next(next(rk({x0})) + next(rk({{y0},y0}))) /= next(next(next(rk(x0)))) + next(next(next(next(rk(y0)))))
	y0-->T849(*) ==> rk({y0}) = next(rk(y0))
	({y0},y0)-->T851(*) ==> rk({{y0},y0}) = next(rk({y0})) + next(rk(y0))
--??	Use_def(next)(*) ==> next(next(rk(y0))) + next(rk(y0)) = next(next(rk(y0)))
	Use_def(next(next(rk(y0)))) ==> AUTO
	(Stat5*)ELEM ==> next(next(rk(y0))) + next(rk(y0)) = next(next(rk(y0)))
	x0-->T849(Stat1*) ==> rk({x0}) = next(rk(x0))
	EQUAL(Stat5) ==> Stat6: next(next(next(rk(x0))) + next(next(next(rk(y0))))) /= next(next(next(rk(x0)))) + next(next(next(next(rk(y0)))))
	x0-->T854(Stat6*) ==> Ord(rk(x0))
	(rk(x0))-->T32(Stat6*) ==> Ord(next(rk(x0)))
	(next(rk(x0)))-->T32(Stat6*) ==> Stat7: Ord(next(next(rk(x0))))
	y0-->T854(Stat6*) ==> Ord(rk(y0))
	(rk(y0))-->T32(Stat6*) ==> Ord(next(rk(y0)))
	(next(rk(y0)))-->T32(Stat6*) ==> Ord(next(next(rk(y0))))
	(next(next(rk(y0))))-->T32(Stat6*) ==> Stat8: Ord(next(next(next(rk(y0)))))
	(next(next(rk(x0))),next(next(next(rk(y0)))))-->T29(Stat7,Stat8*) ==> (next(next(rk(x0))) incin next(next(next(rk(y0))))) or (next(next(rk(x0))) incs next(next(next(rk(y0)))))
	Suppose ==> Stat9: next(next(rk(x0))) incin next(next(next(rk(y0))))
		(Stat9*)ELEM ==> next(next(rk(x0))) + next(next(next(rk(y0)))) = next(next(next(rk(y0))))
		EQUAL(Stat9) ==> next(next(next(rk(x0))) + next(next(next(rk(y0))))) = next(next(next(next(rk(y0)))))
		(next(next(next(rk(y0)))),next(next(rk(x0))))-->T34(Stat7,Stat8,Stat9*) ==> (next(next(rk(x0))) in next(next(next(rk(y0))))) or (next(next(rk(x0))) = next(next(next(rk(y0)))))
		Suppose ==> next(next(rk(x0))) = next(next(next(rk(y0))))
			EQUAL(Stat9) ==> next(next(next(rk(x0)))) = next(next(next(rk(x0))) + next(next(next(rk(y0)))))
			(Stat6*)ELEM ==> false
		Discharge ==> AUTO
		(next(next(next(rk(y0)))),next(next(rk(x0))))-->T37(Stat8*) ==> next(next(next(rk(x0)))) incin next(next(next(rk(y0))))
		Use_def(next(next(next(next(rk(y0)))))) ==> AUTO
		(Stat6*)ELEM ==> false
	Discharge ==> Stat10: next(next(rk(x0))) + next(next(next(rk(y0)))) = next(next(rk(x0)))
	EQUAL(Stat10) ==> Stat11: next(next(next(rk(x0))) + next(next(next(rk(y0))))) = next(next(next(rk(x0))))
	(next(next(rk(x0))),next(next(next(rk(y0)))))-->T34(Stat7*) ==> (next(next(next(rk(y0)))) in next(next(rk(x0)))) or (next(next(rk(x0))) = next(next(next(rk(y0)))))
	Suppose ==> next(next(rk(x0))) = next(next(next(rk(y0))))
		EQUAL(Stat10) ==> Stat12: next(next(next(next(rk(y0))))) = next(next(next(rk(x0))))
		(Stat6,Stat11,Stat12*)ELEM ==> false
	Discharge ==> AUTO
	Use_def(next(next(next(rk(x0))))) ==> AUTO
	(next(next(rk(x0))),next(next(next(rk(y0)))))-->T37(Stat7*) ==> Stat13: next(next(next(next(rk(y0))))) incin next(next(next(rk(x0))))
	(Stat6,Stat11,Stat13*)ELEM ==> false
	Discharge ==> QED
--
Theorem 856: [Every ordinal equals its own rank] Ord(X) imp (X = rk(X)). Proof:
Suppose_not(x) ==> Ord(x) & (x /= rk(x))
	APPLY(t_thryvar:m) ordinal_induction(o->x,P(i)->(i/=rk(i))) ==>
		Stat1: Ord(m) & (m /= rk(m)) & Stat2: (FORALL x in m | not(x /= rk(x)))
	Suppose ==> m /= Un({next(i): i in m})
		Suppose ==> Stat3: not(m incs Un({next(i): i in m}))
			({next(i): i in m},m)-->T274(Stat3) ==> Stat4: not(FORALL x in {next(i): i in m} | x incin m)
			x1-->Stat4 ==> (not(x1 incin m)) & Stat5: (x1 in {next(i): i in m})
			i1-->Stat5 ==> Stat6: (x1 = next(i1)) & (i1 in m) & (not(x1 incin m))
		(m,i1)-->T37(Stat1,Stat6) ==> false; Discharge ==> Stat7: not(m incin Un({next(i): i in m}))
		i2-->Stat7 ==> Stat8: (i2 in m) & (i2 notin Un({next(i): i in m}))
		Use_def(Un) ==> Stat9: i2 notin {x: y in {next(i): i in m}, x in y}
		Suppose ==> Stat10: next(i2) notin {next(i): i in m}
		i2-->Stat10(Stat8,Stat8) ==> false; Discharge ==> next(i2) in {next(i): i in m}
		Use_def(next) ==> i2 in next(i2)
	(next(i2),i2)-->Stat9(Stat9) ==> false; Discharge ==> Stat11: m = Un({next(i): i in m})
	Suppose ==> Stat12: {next(i): i in m} /= {next(rk(i)): i in m}
		i0-->Stat12(Stat12) ==> Stat13: (i0 in m) & (next(i0) /= next(rk(i0)))
		i0-->Stat2(Stat13) ==> i0 = rk(i0)
	EQUAL(Stat13) ==> false; Discharge ==> {next(i): i in m} = {next(rk(i)): i in m}
	EQUAL(Stat11) ==> m = Un({next(rk(i)): i in m})
	Use_def(rk) ==> rk(m) = Un({next(rk(i)): i in m})
(Stat1)ELEM ==> false; Discharge ==> QED
--
-- The following definition provides a mechanism enabling the construction of an infinite
-- sequence of singletons of strictly increasing ranks originating from any set fixed initially.
--
Def 995: [iterated singleton formation] snglIter(X,V) := if X = 0 then {V} else {snglIter(y,V): y in X | next(y) = X} end if
--
--
Theorem 857: [iterated singleton formation produces increasing ranks] (rk(V) in rk(snglIter(0,V))) &
	(((N in Za) & (M in Za) & (N in M)) imp (rk(snglIter(N,V)) in rk(snglIter(M,V)))). Proof+:
Suppose_not(v0,n0,m1) ==> AUTO
--
-- The first part of the claim is obvious,...
--
	Suppose ==> rk(v0) notin rk(snglIter(0,v0))
		Use_def(snglIter) ==> snglIter(0,v0) = {v0}
		v0-->T849(*) ==> rk({v0}) = next(rk(v0))
		Use_def(next) ==> rk(v0) in rk({v0})
		EQUAL ==> false
	Discharge ==> Stat0: (n0 in Za) & (m1 in Za) & (n0 in m1) & (rk(snglIter(n0,v0)) notin rk(snglIter(m1,v0)))
--
-- ...hence, arguing by contradiction, we assume that a counterexample $v0,n0,m1$ to the second
-- part of the claim exists. Then we pick an $m0$ which is minimum in forming a counterexample
-- with those particular $v0,n0$.
--
	APPLY(m2_thryvar:m0) mathematical_induction(n->m1,P(x)->((n0 in x) & (rk(snglIter(n0,v0)) notin rk(snglIter(x,v0))))) ==>
		Stat1: (m0 in Za) & ((n0 in m0) & (rk(snglIter(n0,v0)) notin rk(snglIter(m0,v0)))) &
		Stat2: (FORALL n in m0 | not ((n0 in n) & (rk(snglIter(n0,v0)) notin rk(snglIter(n,v0)))))
--
-- It turns out readily that $rk(snglIter(Un(m0),v0)) in rk(snglIter(m0,v0))$ holds, since
-- $Un(m0)$ is the immediate predecessor of $m0$.
--
	m0-->T321(Stat1*) ==> Un(m0) in Za
	(Un(m0))-->T317(Stat1*) ==> (next(Un(m0)) in Za) & (Un(m0) PLUS 1 = next(Un(m0)))
	m0-->T322(Stat1*) ==> Stat3: m0 = next(Un(m0))
	Use_def(next(Un(m0))) ==> AUTO
	Suppose ==> rk(snglIter(Un(m0),v0)) notin rk(snglIter(m0,v0))
		Use_def(snglIter)(Stat1*) ==> snglIter(m0,v0) = if m0 = 0 then {v0} else {snglIter(y,v0): y in m0 | next(y) = m0} end if
		(Stat1,Stat1*)ELEM ==> if m0 = 0 then {v0} else {snglIter(y,v0): y in m0 | next(y) = m0} end if = {snglIter(y,v0): y in m0 | next(y) = m0}
		(snglIter(Un(m0),v0),snglIter(m0,v0))-->T852(Stat1*) ==> Stat4: snglIter(Un(m0),v0) notin {snglIter(y,v0): y in m0 | next(y) = m0}
 		(Un(m0))-->Stat4(Stat3*) ==> false
	Discharge ==> AUTO
--
-- Therefore $rk(snglIter(Un(m0),v0)) in rk(snglIter(m0,v0))$ holds, which implies $n0 notin Un(m0)$,
-- else we would have $rk(snglIter(n0,v0)) in rk(snglIter(m0,v0))$.
--
	Suppose ==> Stat5: n0 in Un(m0)
		(Un(m0))-->Stat2(Stat3*) ==> rk(snglIter(n0,v0)) in rk(snglIter(Un(m0),v0))
		(snglIter(n0,v0))-->T854(Stat5*) ==> Ord(rk(snglIter(n0,v0)))
		(snglIter(m0,v0))-->T854(Stat5*) ==> Ord(rk(snglIter(m0,v0)))
		(rk(snglIter(n0,v0)),rk(snglIter(m0,v0)))-->T31(Stat1*) ==> false
	Discharge ==> n0 notin Un(m0)
--
	Suppose ==> n0 = Un(m0)
		EQUAL(Stat1) ==> rk(snglIter(Un(m0),v0)) notin rk(snglIter(m0,v0))
	(Stat3*)Discharge ==> AUTO
--
-- Since $n0$ and $Un(m0)$ are ordinals, they are comparable by membership:
-- the only possibility left, at this point, is that $Un(m0) in n0$, which conflicts
-- with the false that $m0$ is the immediate successor of $Un(m0)$, that $n0$
-- precedes it, and differs from $Un(m0)$.
--
	(n0,Un(m0))-->T31(Stat1*) ==> false
	Discharge ==> QED
--
Def 10091: [$X$-th level of the cumulative structure based on $B$] cumstr(B,X) := B + Un({pow(cumstr(B,y)): y in X})
Def 10092: [superstructure based on a set $B$ of 'urelements']
	supstr(B,S) := (S=cumstr(B,Za)) & (FORALL i in Za | (cumstr(B,next(i))-cumstr(B,i))*B=0)
--
Theorem 858: [the 0-th level of any cumulative structure equals the base] cumstr(B,0) = B. Proof:
Suppose_not(b0) ==> AUTO
	Use_def(cumstr(b0,0)) ==> AUTO
	Suppose ==> Stat1: {pow(cumstr(b0,y)): y in 0} /= 0
		e-->Stat1(Stat1*) ==> Stat2: e in {pow(cumstr(b0,y)): y in 0}
		y0-->Stat1(Stat2*) ==> false
	Discharge ==> {pow(cumstr(b0,y)): y in 0} = 0
	T109(*) ==> Un(0) = 0
	EQUAL ==> cumstr(b0,0) = b0 + 0
	Discharge ==> QED
--
-- The following theorem admits a generalization which we are not proving, namely:
--	$(B incin C) imp (cumstr(B,X) incin cumstr(C,X + Y))$.
--
Theorem 859: [The constructor of the cumulative structure is monotone non-decreasing] cumstr(B,X) incin cumstr(B,X + Y). Proof:
Suppose_not(b,x0,y0) ==> AUTO
	Use_def(cumstr(b,x0)) ==> AUTO
	Use_def(cumstr(b,x0 + y0)) ==> AUTO
	ELEM ==> Un({pow(cumstr(b,y)): y in x0}) nincin Un({pow(cumstr(b,y)): y in x0 + y0})
	Set_monot ==> {pow(cumstr(b,y)): y in x0} incin {pow(cumstr(b,y)): y in x0 + y0}
	({pow(cumstr(b,y)): y in x0},{pow(cumstr(b,y)): y in x0 + y0})-->T276 ==> false
	Discharge ==> QED
--
--
--
Theorem 860: [The constructor of the cumulative structure inserts 0 at all levels but the first] (0 notin B) imp ((X /= 0) eq (0 in cumstr(B,X))). Proof:
Suppose_not(b,x0) ==> AUTO
--
-- Reasoning by contradiction, let $b,x0$ be a counterexample, so that $0 notin b$ but the
-- biimplication $(x0 /= 0) eq (0 in cumstr(b,x0))$ is false. Suppose first that
-- $x0 /= 0$ and $0 notin cumstr(b,x0)$.
--
	Suppose ==> x0 /= 0
--
-- In this case, by the definition of $cumstr(b,x0)$, we would have
-- $0 notin Un({pow(cumstr(b,y)): y in x0})$, which is absurd since
-- $pow(cumstr(b,arb(x0))) incin Un({pow(cumstr(b,y)): y in x0})$ and
-- $0 in pow(V)$ holds for any set $V$.
--
		Loc_def ==> Stat1: a = arb(x0)
		x0-->T0(*) ==> a in x0
		Use_def(cumstr(b,x0)) ==> AUTO
		ELEM ==> Stat2: 0 notin Un({pow(cumstr(b,y)): y in x0})
		Suppose ==> Stat3: pow(cumstr(b,a)) nincin Un({pow(cumstr(b,y)): y in x0})
			({pow(cumstr(b,y)): y in x0})-->T274(*) ==> Stat4: (FORALL x in {pow(cumstr(b,y)): y in x0} | x incin Un({pow(cumstr(b,y)): y in x0}))
			(pow(cumstr(b,a)))-->Stat4(Stat3,Stat3*) ==> Stat5: pow(cumstr(b,a)) notin {pow(cumstr(b,y)): y in x0}
			a-->Stat5(Stat1*) ==> false
		Discharge ==> AUTO
		Use_def(pow(cumstr(b,a))) ==> AUTO
		(Stat2*)ELEM ==> Stat6: 0 notin {y: y incin cumstr(b,a)}
	0-->Stat6(Stat6*) ==> false; Discharge ==> Stat7: (x0 = 0) & (0 in cumstr(b,x0))
--
-- A contradiction is readily obtained also under the opposite supposition
-- that $x0 = 0$ and $0 in cumstr(b,x0)$. This supposition would in fact
-- imply that $cumstr(b,x0) = b$, but we have assumed that $0 notin b$.
-- This contradiction leads us to the desired conclusion.
--
	b-->T858 ==> AUTO
	EQUAL ==> cumstr(b,x0) = 0
	(Stat7*)Discharge ==> QED
--
--
--
Theorem 861: [All subsets of each layer of a cumulative structure belong to its subsequent layers] ((Y in X) & (Z incin cumstr(B,Y))) imp (Z in cumstr(B,X)). Proof:
Suppose_not(y0,x0,z0,b0) ==> AUTO
	Use_def(cumstr(b0,x0)) ==> AUTO
	({pow(cumstr(b0,y)): y in x0})-->T274(*) ==> Stat1: (FORALL x in {pow(cumstr(b0,y)): y in x0} | x incin Un({pow(cumstr(b0,y)): y in x0}))
	(pow(cumstr(b0,y0)))-->Stat1(*) ==> Stat2: (pow(cumstr(b0,y0)) notin {pow(cumstr(b0,y)): y in x0}) or (z0 notin pow(cumstr(b0,y0)))
	Use_def(pow(cumstr(b0,y0))) ==> AUTO
	y0-->Stat2(*) ==> Stat3: z0 notin {z: z incin cumstr(b0,y0)}
	z0-->Stat3(*) ==> false
	Discharge ==> QED
--
--
Theorem 862: [Quasi-transitivity of the layers of a cumulative structure] Ord(X) imp ((cumstr(B,X) - B) incin pow(cumstr(B,X))). Proof:
Suppose_not(x0,b) ==> Stat1: ((cumstr(b,x0) - b) nincin pow(cumstr(b,x0))) & Ord(x0)
--
-- For assuming that the claim fails to hold for $x0,b$, we pick a $y1$ belonging to
-- $(cumstr(b,x0) - b) incin pow(cumstr(b,x0))$ and then find a contradiction arguing as follows.
--
	Use_def(cumstr(b,x0)) ==> AUTO
	y0-->Stat1(Stat1*) ==> Stat2: (y0 in Un({pow(cumstr(b,y)): y in x0})) & (y0 notin pow(cumstr(b,x0)))
	Use_def(Un)(Stat2*) ==> y0 in {u: v in {pow(cumstr(b,y)): y in x0}, u in v}
	SIMPLF ==> Stat3: y0 in {u: y in x0, u in pow(cumstr(b,y))}
	(y1,u1)-->Stat3(Stat3*) ==> (y1 in x0) & (y0 in pow(cumstr(b,y1)))
--
-- Since $x0$ is an ordinal, $y1 incin x0$ follows from $y1 in x0$, and hence
-- $cumstr(b,y1) incin cumstr(b,x0)$ by Theorem 859, and therefore
-- $pow(cumstr(b,y1)) incin pow(cumstr(b,x0))$. But then $y0 in pow(cumstr(b,x0))$ follows
-- from $y0 in pow(cumstr(b,y1))$, which conflicts with the hypothesis with which our argument
-- by contradiction began.
--
	Suppose ==> Stat4: pow(cumstr(b,y1)) nincin pow(cumstr(b,x0))
		c-->Stat4(Stat4*) ==> Stat5: (c in pow(cumstr(b,y1))) & (c notin pow(cumstr(b,x0)))
		Use_def(pow)(Stat5*) ==> Stat6: (c in {y: y incin cumstr(b,y1)}) & (c notin {y: y incin cumstr(b,x0)})
		(c1,c1)-->Stat6(Stat6*) ==> not(cumstr(b,y1) incin cumstr(b,x0))
		(b,y1,x0 - y1)-->T859 ==> AUTO
		(x0,y1)-->T13(Stat1*) ==> x0 = y1 + (x0 - y1)
		EQUAL(Stat3) ==> false
	Discharge ==> AUTO
(Stat2*)Discharge ==> QED
--
Theorem 863: [Transitivity of each layer in the von Neumann hierarchy] Ord(X) imp ((cumstr(0,X) incin pow(cumstr(0,X))) & (Un(cumstr(0,X)) incin cumstr(0,X))). Proof:
Suppose_not(x) ==> AUTO
	(x,0)-->T862(*) ==> (cumstr(0,x) incin pow(cumstr(0,x))) & (Un(cumstr(0,x)) nincin cumstr(0,x))
	(cumstr(0,x))-->T278(*) ==> false
	Discharge ==> QED
--
Theorem 864: [closedness under dyadic union of the cumulative hierarchy $cumstr(B,Za)$] ((S in cumstr(B,Za) - B) & (T in cumstr(B,Za) - B)) imp ((S + T) in cumstr(B,Za)). Proof+:
Suppose_not(s0,b0,t0) ==> AUTO
--
-- Reasoning by contradiction, assume $s0,t0$ to be a counterexample, so that (by the definitions
-- of $cumstr$) $s0$ belongs to $pow(cumstr(b0,i0))$ and
-- $t0$ belongs to $pow(cumstr(b0,i1))$ for suitably chosen $i0 in Za$, $i1 in Za$.
--
	Use_def(cumstr(b0,Za)) ==> AUTO
	Use_def(Un({pow(cumstr(b0,y)): y in Za})) ==> AUTO
	SIMPLF ==> Un({pow(cumstr(b0,y)): y in Za}) = {u: y in Za, u in pow(cumstr(b0,y))}
	ELEM ==> Stat1: (s0 in {u: y in Za, u in pow(cumstr(b0,y))}) & Stat2: (t0 in {u: y in Za, u in pow(cumstr(b0,y))}) & ((s0 + t0) notin cumstr(b0,Za))
	(i0,u0,i1,u1)-->Stat1(Stat1*) ==> Stat3: (s0 in pow(cumstr(b0,i0))) & Stat4: (t0 in pow(cumstr(b0,i1))) & (i0 in Za) & (i1 in Za)
--
-- But then, $s0$ belongs to $cumstr(b0,next(i0))$ and
-- $t0$ belongs to $cumstr(b0,next(i1))$, and therefore
-- $s0 + t0$ is included in $cumstr(b0,next(i0 + i1))$.
--
	Suppose ==> s0 notin cumstr(b0,next(i0))
		Use_def(next(i0)) ==> AUTO
		Use_def(cumstr(b0,i0+{i0})) ==> AUTO
		EQUAL(Stat3) ==> s0 notin (b0 + Un({pow(cumstr(b0,j)): j in i0+{i0}}))
		Use_def(Un({pow(cumstr(b0,y)): y in i0+{i0}})) ==> AUTO
		SIMPLF(Stat3) ==> Un({pow(cumstr(b0,y)): y in i0+{i0}}) = {u: y in i0+{i0}, u in pow(cumstr(b0,y))}
		(Stat3*)ELEM ==> Stat5: s0 notin {u: y in i0+{i0}, u in pow(cumstr(b0,y))}
		(i0,s0)-->Stat5(Stat3,Stat3*) ==> false
	Discharge ==> AUTO
	Suppose ==> t0 notin cumstr(b0,next(i1))
		Use_def(next(i1)) ==> AUTO
		Use_def(cumstr(b0,i1+{i1})) ==> AUTO
		EQUAL(Stat3) ==> t0 notin (b0 + Un({pow(cumstr(b0,j)): j in i1+{i1}}))
		Use_def(Un({pow(cumstr(b0,y)): y in i1+{i1}})) ==> AUTO
		SIMPLF(Stat3) ==> Un({pow(cumstr(b0,y)): y in i1+{i1}}) = {u: y in i1+{i1}, u in pow(cumstr(b0,y))}
		(Stat3*)ELEM ==> Stat6: t0 notin {u: y in i1+{i1}, u in pow(cumstr(b0,y))}
		(i1,t0)-->Stat6(Stat3,Stat3*) ==> false
	Discharge ==> AUTO
	i0-->T210(Stat3,Stat3*) ==> next(i0) in Za
	i1-->T210(Stat3,Stat3*) ==> next(i1) in Za
	(next(i0),next(i1))-->T333(Stat3*) ==> Stat7: (next(i0) + next(i1)) in Za
	(b0,next(i0),next(i1))-->T859(Stat3*) ==> s0 in cumstr(b0,next(i0) + next(i1))
	(b0,next(i1),next(i0))-->T859(Stat3*) ==> (t0 in cumstr(b0,next(i1) + next(i0))) & (next(i1) + next(i0) = next(i0) + next(i1))
	EQUAL(Stat7) ==> t0 in cumstr(b0,next(i0) + next(i1))
	Use_def(Card(next(i0) + next(i1))) ==> AUTO
	Use_def(pow(cumstr(b0,next(i0) + next(i1)))) ==> AUTO
	(next(i0) + next(i1),b0)-->T862(*) ==> Stat8: (s0 in {y: y incin cumstr(b0,next(i0) + next(i1))}) & (t0 in {y: y incin cumstr(b0,next(i0) + next(i1))})
	(y0,y1)-->Stat8(Stat8*) ==> (s0 + t0) incin cumstr(b0,next(i0) + next(i1))
	Suppose ==> Stat9: (s0 + t0) notin {y: y incin cumstr(b0,next(i0) + next(i1))}
	(s0 + t0)-->Stat9(Stat8*) ==> false; Discharge ==> AUTO
	Use_def(pow(cumstr(b0,next(i0) + next(i1)))) ==> AUTO
	(Stat7*)ELEM ==> Stat10: (s0 + t0) in {y: y incin (cumstr(b0,next(i0) + next(i1)))}
	y2-->Stat10(Stat10*) ==> (s0 + t0) incin cumstr(b0,next(i0) + next(i1))
--
-- By Theorem 861, this implies that $pow(s0)$ belongs to $cumstr(b0,Za)$, which leads to
-- the desired contradiction.
--
	(next(i0) + next(i1),Za,s0 + t0,b0)-->T861(Stat7*) ==> Stat11: (s0 + t0) in cumstr(b0,Za)
	(Stat1,Stat11*)Discharge ==> QED
--
Theorem 865: [All sets of rank bounded by $X$ belong to $pow(cumstr(0,X))$] (rk(Y) incin X) imp (Y incin cumstr(0,X)). Proof:
Suppose_not(v,u) ==> AUTO
	Suppose ==> Stat1: not(EXISTS v | (rk(v) incin u) & (v nincin cumstr(0,u)))
	v-->Stat1(*) ==> false; Discharge ==> (EXISTS v | (rk(v) incin u) & (v nincin cumstr(0,u)))
	APPLY(mt1_thryvar:m) transfinite_induction(n->u,P(x)->(EXISTS v | (rk(v) incin x) & (v nincin cumstr(0,x)))) ==>
		Stat2: (FORALL k | (EXISTS v | (rk(v) incin m) & (v nincin cumstr(0,m))) &
			((k in m) imp (not(EXISTS v | (rk(v) incin k) & (v nincin cumstr(0,k))))))
	0-->Stat2(Stat2*) ==> Stat3: (EXISTS v | (rk(v) incin m) & (v nincin cumstr(0,m)))
	e-->Stat3(Stat3*) ==> Stat4: (rk(e) incin m) & Stat5: (not(e incin cumstr(0,m)))
	c-->Stat5(Stat4*) ==> Stat6: (c in e) & (c notin cumstr(0,m))
	(c,e)-->T852(Stat4*) ==> Stat7: rk(c) in m
	(rk(c))-->Stat2(Stat4*) ==> Stat8: not(EXISTS v | (rk(v) incin rk(c)) & (v nincin cumstr(0,rk(c))))
	c-->Stat8(Stat8*) ==> Stat9: c incin cumstr(0,rk(c))
	Suppose ==> c notin pow(cumstr(0,rk(c)))
		Use_def(pow)(Stat9*) ==> Stat10: c notin {x: x incin cumstr(0,rk(c))}
	c-->Stat10(Stat9*) ==> false; Discharge ==> Stat11: c in pow(cumstr(0,rk(c)))
	Use_def(cumstr(0,m)) ==> AUTO
	(Stat4*)ELEM ==> c notin Un({pow(cumstr(0,y)): y in m})
	({pow(cumstr(0,y)): y in m})-->T274(Stat12*) ==> Stat12: (FORALL x in {pow(cumstr(0,y)): y in m} | x incin Un({pow(cumstr(0,y)): y in m}))
	Suppose ==> Stat13: pow(cumstr(0,rk(c))) notin {pow(cumstr(0,y)): y in m}
	(rk(c))-->Stat13(Stat7,Stat7*) ==> false; Discharge ==> pow(cumstr(0,rk(c))) in {pow(cumstr(0,y)): y in m}
(pow(cumstr(0,rk(c))))-->Stat12(Stat11*) ==> false; Discharge ==> QED
--
Theorem 866: [The sets of rank bounded by $X$ form $pow(cumstr(0,X))$] Ord(X) imp ((rk(Y) incin X) eq (Y incin cumstr(0,X))). Proof:
Suppose_not(u,v) ==> AUTO
	(v,u)-->T865(*) ==> Stat1: Ord(u) & (rk(v) nincin u) & (v incin cumstr(0,u))
	Suppose ==> Stat2: not(EXISTS v | (rk(v) nincin u) & (v incin cumstr(0,u)))
	v-->Stat2(*) ==> false; Discharge ==> (EXISTS v | (rk(v) nincin u) & (v incin cumstr(0,u)))
	APPLY(mt1_thryvar:m) transfinite_induction(n->u,P(x)->(Ord(x) & (EXISTS v | (rk(v) nincin x) & (v incin cumstr(0,x))))) ==>
		Stat3: (FORALL k | (Ord(m) & (EXISTS v | (rk(v) nincin m) & (v incin cumstr(0,m)))) &
			((k in m) imp (not(Ord(k) & (EXISTS v | (rk(v) nincin k) & (v incin cumstr(0,k)))))))
	0-->Stat3(Stat3*) ==> Stat4: Ord(m) & (EXISTS v | (rk(v) nincin m) & (v incin cumstr(0,m)))
	e-->Stat4(Stat4*) ==> Stat5: (e incin cumstr(0,m)) & (rk(e) nincin m)
	e-->T854(Stat5*) ==> Ord(rk(e))
	(rk(e),m)-->T35(Stat4*) ==> Stat6: m in rk(e)
	Use_def(rk(e)) ==> AUTO
	(Stat6*)ELEM ==> Stat7: m in Un({next(rk(w)): w in e})
	Use_def(Un)(Stat7*) ==> m in {y: x in {next(rk(w)): w in e}, y in x}
	SIMPLF(Stat7*) ==> Stat8: m in {y: w in e, y in next(rk(w))}
	(d,y0)-->Stat8(Stat5*) ==> Stat9: (d in cumstr(0,m)) & (m in next(rk(d)))
	Use_def(cumstr(0,m)) ==> AUTO
	(Stat9*)ELEM ==> Stat10: d in Un({pow(cumstr(0,w)): w in m})
	Use_def(Un)(Stat10*) ==> d in {y: x in {pow(cumstr(0,w)): w in m}, y in x}
	SIMPLF(Stat10*) ==> Stat11: d in {y: w in m, y in pow(cumstr(0,w))}
	(c,y1)-->Stat11(Stat11*) ==> Stat12: (c in m) & (d in pow(cumstr(0,c)))
	Use_def(pow)(Stat12*) ==> Stat13: d in {x: x incin cumstr(0,c)}
	d1-->Stat13(Stat13*) ==> d incin cumstr(0,c)
	(m,c)-->T12(Stat4,Stat12*) ==> Ord(c)
	c-->Stat3(Stat12*) ==> Stat14: not(EXISTS v | (rk(v) nincin c) & (v incin cumstr(0,c)))
	d-->Stat14(Stat13*) ==> rk(d) incin c
	d-->T854(Stat14*) ==> Ord(rk(d))
	(rk(d),m)-->T31(Stat4*) ==> Stat15: rk(d) in m
	(m,rk(d))-->T37(Stat4,Stat15*) ==> Stat16: next(rk(d)) incin m
(Stat9,Stat16*)Discharge ==> QED
--
Theorem 867: [All sets of rank $X$ belong to $cumstr(0,next(X))-cumstr(0,X)$] (X = rk(Y)) imp (Y in (cumstr(0,next(X)) - cumstr(0,X))). Proof:
Suppose_not(x0,y0) ==> AUTO
	y0-->T854(*) ==> Ord(rk(y0))
	EQUAL ==> Ord(x0)
--
-- For, if we assume the contrary to hold for $x0,y0$, then Theorem 866 implies
-- that $y0 incin pow(cumstr(0,x0))$ and therefore $y0 in cumstr(0,next(x0))$,
-- $y0 in cumstr(0,x0)$.
--
	Suppose ==> Stat1: y0 notin cumstr(0,next(x0))
		Use_def(cumstr(0,next(x0))) ==> AUTO
		(Stat1*)ELEM ==> Stat2: y0 notin Un({pow(cumstr(0,y)): y in next(x0)})
		Suppose ==> Stat3: y0 notin pow(cumstr(0,x0))
			Use_def(pow)(Stat3*) ==> Stat4: y0 notin {x: x incin cumstr(0,x0)}
			(x0,y0)-->T866(*) ==> y0 incin cumstr(0,x0)
		y0-->Stat4(Stat4*) ==> false; Discharge ==> y0 in pow(cumstr(0,x0))
		Suppose ==> Stat5: pow(cumstr(0,x0)) notin {pow(cumstr(0,y)): y in next(x0)}
			Use_def(next(x0)) ==> AUTO
		x0-->Stat5(Stat5*) ==> false; Discharge ==> pow(cumstr(0,x0)) in {pow(cumstr(0,y)): y in next(x0)}
		{pow(cumstr(0,y)): y in next(x0)}-->T274(Stat6*) ==> Stat6: (FORALL x in {pow(cumstr(0,y)): y in next(x0)} | x incin Un({pow(cumstr(0,y)): y in next(x0)}))
	(pow(cumstr(0,x0)))-->Stat6(Stat2*) ==> false; Discharge ==> Stat7: y0 in cumstr(0,x0)
	Use_def(cumstr(0,x0)) ==> AUTO
	(Stat7*)ELEM ==> Stat8: y0 in Un({pow(cumstr(0,v)): v in x0})
--
-- But then $rk(y0) incin x1$, which leads to a contradiction whence the desired conclusion follows.
--
	Use_def(Un)(Stat8*) ==> Stat9: y0 in {x: y in {pow(cumstr(0,v)): v in x0}, x in y}
	(p,y1)-->Stat9(Stat9*) ==> Stat10: (p in {pow(cumstr(0,v)): v in x0}) & (y0 in p)
	x1-->Stat10(Stat10*) ==> Stat11: (x1 in x0) & (y0 in pow(cumstr(0,x1)))
	Use_def(pow)(Stat11*) ==> Stat12: y0 in {x: x incin cumstr(0,x1)}
	y2-->Stat12(Stat12*) ==> y0 incin cumstr(0,x1)
	(x0,x1)-->T12(*) ==> Ord(x1) & (rk(y0) = x0)
(x1,y0)-->T866(Stat11*) ==> false; Discharge ==> QED
--
Theorem 868: [The rank of sets in $cumstr(0,next(X))-cumstr(0,X)$ does not exceed $X$] (Ord(X) & (Y in (cumstr(0,next(X)) - cumstr(0,X)))) imp (rk(Y) incin X). Proof:
Suppose_not(x1,y1) ==> AUTO
	(x1,y1)-->T866(*) ==> y1 nincin cumstr(0,x1)
	Use_def(cumstr(0,x1)) ==> AUTO
	Use_def(cumstr(0,next(x1))) ==> AUTO
	ELEM ==> (y1 in Un({pow(cumstr(0,w)): w in next(x1)})) & (y1 notin Un({pow(cumstr(0,w)): w in x1}))
	Use_def(Un)(*) ==> Stat1: (y1 in {x: y in {pow(cumstr(0,w)): w in next(x1)}, x in y}) & (y1 notin {x: y in {pow(cumstr(0,w)): w in x1}, x in y})
	(v1,y2,v1,y2)-->Stat1(Stat1*) ==> Stat2: (v1 in {pow(cumstr(0,w)): w in next(x1)}) & (v1 notin {pow(cumstr(0,w)): w in x1}) & (y1 in v1)
	Use_def(next(x1)) ==> AUTO
	(w1,w1)-->Stat2(Stat2*) ==> (v1 = pow(cumstr(0,w1))) & (w1 = x1)
	Use_def(pow(cumstr(0,x1))) ==> AUTO
	EQUAL(Stat2) ==> Stat3: y1 in {x: x incin cumstr(0,x1)}
y3-->Stat3(*) ==> false; Discharge ==> QED
--
Theorem 869: [The sets of rank $X$ form $cumstr(0,next(X))-cumstr(0,X)$] Ord(X) imp ((rk(Y) = X) eq (Y in (cumstr(0,next(X)) - cumstr(0,X)))). Proof:
Suppose_not(x1,y1) ==> AUTO
--
-- Reasoning by contradiction, let $y1$ and $x1$ be a set and
-- an ordinal with $y1 in (cumstr(0,next(x1)) - cumstr(0,x1))$ but with
-- $x1 nincin rk(y1)$.
--
	(x1,y1)-->T867(*) ==> Stat1: Ord(x1) & (y1 in (cumstr(0,next(x1)) - cumstr(0,x1))) & (rk(y1) /= x1)
	(x1,y1)-->T868(Stat1*) ==> Stat2: Ord(x1) & (y1 in (cumstr(0,next(x1)) - cumstr(0,x1))) & Stat3: (x1 nincin rk(y1))
--
-- Let $y1 in (cumstr(0,next(x1)) - cumstr(0,x1))$ and $x1 nincin rk(y1)$.
-- Hence we can pick an $x2$ belonging to $x1 - rk(y1)$.
-- Then we have $y2 notin cumstr(0,x2)$ for some $y2 in y1$, which hence satisfies $rk(y2) in rk(y1)$.
--
	x2-->Stat3(Stat2*) ==> Stat4: (x2 notin rk(y1)) & (x2 in x1)
	Use_def(cumstr(0,x1)) ==> AUTO
	Use_def(cumstr(0,next(x1))) ==> AUTO
	Use_def(Un({pow(cumstr(0,y)): y in x1})) ==> AUTO
	Use_def(Un({pow(cumstr(0,y)): y in next(x1)})) ==> AUTO
	(Stat2*)ELEM ==> Stat5: (y1 in {x: y in {pow(cumstr(0,y)): y in next(x1)}, x in y}) &
		Stat6: (y1 notin {x: y in {pow(cumstr(0,y)): y in x1}, x in y})
	Suppose ==> y1 in pow(cumstr(0,x2))
		(pow(cumstr(0,x2)),y1)-->Stat6(Stat5*) ==> Stat7: pow(cumstr(0,x2)) notin {pow(cumstr(0,y)): y in x1}
	x2-->Stat7(Stat4,Stat4*) ==> false; Discharge ==> AUTO
	Use_def(pow) ==> Stat8: y1 notin {x: x incin cumstr(0,x2)}
	y1-->Stat8(Stat8*) ==> Stat9: y1 nincin cumstr(0,x2)
	y2-->Stat9(Stat9*) ==> Stat10: (y2 in y1) & (y2 notin cumstr(0,x2))
--
-- We know that $y2$ belongs to $cumstr(0,next(rk(y2))) - cumstr(0,rk(y2))$.
-- Therefore, $rk(y2)$ is greater than or equal to $x2$, else by monotonicity $y2$ would
-- belong to $cumstr(0,x2)$.
--
	y2-->T854(Stat10*) ==> Ord(rk(y2))
	(rk(y2),y2)-->T867(Stat4*) ==> y2 in cumstr(0,next(rk(y2)))
	(x1,x2)-->T12(*) ==> Ord(x2)
	Suppose ==> rk(y2) nincs x2
		(x2,rk(y2))-->T35(Stat10*) ==> rk(y2) in x2
		(x2,rk(y2))-->T37(Stat10*) ==> next(rk(y2))+(x2-next(rk(y2))) = x2
		(0,next(rk(y2)),x2-next(rk(y2)))-->T859(Stat10*) ==> y2 in cumstr(0,next(rk(y2))+(x2-next(rk(y2))))
	EQUAL(Stat9) ==> false; Discharge ==> rk(y2) incs x2
--
-- Since $y2 in y1$ implies $rk(y2) in rk(y1)$, we find that
-- $rk(y1)$ is greater than or equal to $x2$, contradicting Stat11
--
	y1-->T854(Stat10*) ==> Ord(rk(y1))
	(y2,y1)-->T852(Stat10,Stat10*) ==> rk(y2) in rk(y1)
	(rk(y1),rk(y2))-->T13(Stat10*) ==> rk(y1) incs x2
(rk(y1),x2)-->T35(Stat4*) ==> false; Discharge ==> QED
--
--
--
Theorem 870: [Sets whose rank belongs to an ordinal are those in its level] Ord(X) imp ((rk(Y) in X) eq (Y in cumstr(0,X))). Proof+:
Suppose_not(x0,y0) ==> AUTO
	Suppose ==> rk(y0) in x0
		(rk(y0),y0)-->T867(*) ==> y0 in cumstr(0,next(rk(y0)))
		(0,next(rk(y0)),x0)-->T859(*) ==> y0 in cumstr(0,next(rk(y0)) + x0)
		(x0,rk(y0))-->T37 ==> next(rk(y0)) + x0 = x0
		EQUAL ==> y0 in cumstr(0,x0)
	Discharge ==> AUTO
	Use_def(cumstr(0,x0)) ==> AUTO
	Use_def(Un({pow(cumstr(0,y)): y in x0})) ==> AUTO
	ELEM ==> Stat1: Ord(x0) & (y0 in {v: u in {pow(cumstr(0,y)): y in x0}, v in u}) & (rk(y0) notin x0)
	SIMPLF(Stat1) ==> Stat2: y0 in {v: y in x0, v in pow(cumstr(0,y))}
	(x1,v1)-->Stat2(Stat2*) ==> Stat3: (x1 in x0) & (y0 in pow(cumstr(0,x1)))
	Use_def(pow)(Stat3*) ==> Stat4: y0 in {y: y incin cumstr(0,x1)}
	y1-->Stat4(Stat4*) ==> y0 incin cumstr(0,x1)
	(x1,y0)-->T866(Stat1*) ==> (rk(y0) incin x1) & (rk(y0) /= x0)
	(x0,x1)-->T13(Stat1*) ==> rk(y0) incin x0
	y0-->T854(Stat4*) ==> Ord(rk(y0))
	(x0,rk(y0))-->T34(Stat1*) ==> false
	Discharge ==> QED
--
--
--
Theorem 871: Ord(X) imp (rk(cumstr(0,X)) = X). Proof:
Suppose_not(x0) ==> AUTO
	Use_def(cumstr) ==> cumstr(0,next(x0)) = Un({pow(cumstr(0,y)): y in next(x0)})
	Use_def(Un({pow(cumstr(0,y)): y in next(x0)})) ==> AUTO
	(x0,cumstr(0,x0))-->T869(*) ==> Stat1: cumstr(0,x0) notin {u: v in {pow(cumstr(0,y)): y in next(x0)}, u in v}
	SIMPLF(Stat1) ==>  Stat2: cumstr(0,x0) notin {u: y in next(x0), u in pow(cumstr(0,y))}
	Use_def(next(x0)) ==> AUTO
	Use_def(pow(cumstr(0,x0))) ==> AUTO
	(x0,cumstr(0,x0))-->Stat2(Stat2*) ==> Stat3: cumstr(0,x0) notin {y: y incin cumstr(0,x0)}
	(cumstr(0,x0))-->Stat3(Stat3*) ==> false
	Discharge ==> QED
--
--
--
Theorem 872: (Ord(X) & Ord(Y) & (X in Y) & (Z notin cumstr(0,Y))) imp (X in rk(Z)). Proof:
Suppose_not(x0,y0,z0) ==> AUTO
	ELEM ==> Stat1: (y0 nincin rk(z0)) & (z0 notin cumstr(0,y0))
	z0-->T854(*) ==> Stat2: Ord(rk(z0)) & Ord(y0)
	(y0,rk(z0))-->T29(Stat1*) ==> y0 = y0  + rk(z0)
	(0,rk(z0),y0)-->T859(Stat2*) ==> cumstr(0,rk(z0)) incin cumstr(0,y0 + rk(z0))
	EQUAL(Stat2) ==> cumstr(0,rk(z0)) incin cumstr(0,y0)
	(z0,rk(z0))-->T865(Stat2*) ==> z0 incin cumstr(0,y0)
	(y0,z0)-->T866(Stat1*) ==> Stat3: (rk(z0) incin y0) & (rk(z0) /= y0)
	(y0,rk(z0))-->T34(Stat2*) ==> rk(z0) in y0
	(y0,rk(z0))-->T37(Stat2*) ==> Stat4: next(rk(z0)) incin y0
	(rk(z0),z0)-->T867(Stat2*) ==> z0 in cumstr(0,next(rk(z0)))
	(0,next(rk(z0)),y0)-->T859(Stat4*) ==> z0 in cumstr(0,next(rk(z0)) + y0)
	(Stat4,Stat4*)ELEM ==> next(rk(z0)) + y0 = y0
	EQUAL(Stat4) ==> Stat5: z0 in cumstr(0,y0)
	(Stat1,Stat5*)Discharge ==> QED
--
--
--
Theorem 873: (N in Za) imp Finite(cumstr(0,N)). Proof+:
Suppose_not(n1) ==> AUTO
	APPLY(m2_thryvar:n0) mathematical_induction(n->n1,P(x)->(not Finite(cumstr(0,x)))) ==>
		Stat1: (FORALL n in n0 | not(not Finite(cumstr(0,n)))) & (n0 in Za) & (not Finite(cumstr(0,n0)))
	Use_def(cumstr(0,n0)) ==> AUTO
	ELEM ==> cumstr(0,n0) = Un({pow(cumstr(0,y)): y in n0})
	Suppose ==> Stat2: not(FORALL x in {pow(cumstr(0,y)): y in n0} | Finite(x))
		x0-->Stat2(Stat2*) ==> Stat3: (x0 in {pow(cumstr(0,y)): y in n0}) & (not Finite(x0))
		m0-->Stat3(Stat3*) ==> (m0 in n0) & (x0 = pow(cumstr(0,m0)))
		m0-->Stat1(Stat1*) ==> Finite(cumstr(0,m0))
		(cumstr(0,m0))-->T264(Stat3*) ==> Finite(pow(cumstr(0,m0)))
		EQUAL ==> false
	Discharge ==> AUTO
	Suppose ==> Stat4: (not Finite({pow(cumstr(0,y)): y in n0}))
		TELEM ==> (range({[y,pow(cumstr(0,y))]: y in n0}) = {pow(cumstr(0,y)): y in n0}) &
				(domain({[y,pow(cumstr(0,y))]: y in n0}) = n0) &
				Svm({[y,pow(cumstr(0,y))]: y in n0})
		(Stat1,Stat1*)ELEM ==> Finite(n0)
		EQUAL(Stat4) ==> Finite(domain({[y,pow(cumstr(0,y))]: y in n0}))
		({[y,pow(cumstr(0,y))]: y in n0})-->T192(Stat4*) ==> Finite(range({[y,pow(cumstr(0,y))]: y in n0}))
		EQUAL(Stat4) ==> false
	Discharge ==> AUTO
	({pow(cumstr(0,y)): y in n0})-->T238(Stat1*) ==> Finite(Un({pow(cumstr(0,y)): y in n0}))
	EQUAL(Stat1) ==> false
	Discharge ==> QED
--
--
--
Theorem 874: (W = cumstr(0,rk({snglIter(n,X): n in Za}))) imp ((X incin W) & (not Finite(W - X)) & (1 in rk(W))). Proof+:
Suppose_not(w0,x0) ==> AUTO
	Suppose ==> Stat1: (not(FORALL n in Za, m in Za | (rk(x0) in rk(snglIter(0,x0))) & ((n in m) imp (rk(snglIter(n,x0)) in rk(snglIter(m,x0))))))
		(n0,m0)-->Stat1 ==> AUTO
		(x0,n0,m0)-->T857(Stat1*) ==> false
	Discharge ==> Stat2: (FORALL n in Za, m in Za | (rk(x0) in rk(snglIter(0,x0))) & ((n in m) imp (rk(snglIter(n,x0)) in rk(snglIter(m,x0)))))
	T211(*) ==> 0 in Za
	(0,0)-->Stat2(Stat2*) ==> rk(x0) in rk(snglIter(0,x0))
	Suppose ==> Stat3: rk(snglIter(0,x0)) notin rk({snglIter(n,x0): n in Za})
		(snglIter(0,x0),{snglIter(n,x0): n in Za})-->T852(Stat3*) ==> Stat4: snglIter(0,x0) notin {snglIter(n,x0): n in Za}
		0-->Stat4(Stat2*) ==> false
	Discharge ==> rk(snglIter(0,x0)) in rk({snglIter(n,x0): n in Za})
	x0-->T854(Stat2*) ==> Ord(rk(x0))
	({snglIter(n,x0): n in Za})-->T854(Stat2*) ==> Ord(rk({snglIter(n,x0): n in Za}))
	Suppose ==> x0 nincin w0
		(rk(x0),rk({snglIter(n,x0): n in Za}))-->T31(Stat2*) ==> rk(x0) in rk({snglIter(n,x0): n in Za})
		(rk({snglIter(n,x0): n in Za}),rk(x0))-->T13(Stat2*) ==> rk(x0) incin rk({snglIter(n,x0): n in Za})
		(rk({snglIter(n,x0): n in Za}),x0)-->T866(*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat5: 1 notin rk(w0)
		Use_def(snglIter) ==> snglIter(0,x0) = {x0}
		x0-->T849(Stat5*) ==> rk({x0}) = next(rk(x0))
		EQUAL(Stat5) ==> rk(snglIter(0,x0)) = next(rk(x0))
		(rk({snglIter(n,x0): n in Za}))-->T871(Stat2*) ==> rk(cumstr(0,rk({snglIter(n,x0): n in Za}))) = rk({snglIter(n,x0): n in Za})
		EQUAL ==> rk(snglIter(0,x0)) in rk(w0)
		Use_def(next(rk(x0))) ==> AUTO
		(Stat5*)ELEM ==> Stat6: rk(x0) in rk(snglIter(0,x0))
		T211 ==> Ord(0) & Card(1)
		(snglIter(0,x0))-->T854(Stat5*) ==> Stat7: Ord(rk(snglIter(0,x0)))
		(0,rk(snglIter(0,x0)))-->T31(Stat6*) ==> 0 in rk(snglIter(0,x0))
		Use_def(Card) ==> Ord(1)
		TELEM ==> 1 = {0}
		(1,rk(snglIter(0,x0)))-->T31(Stat5*) ==> 1 in rk(snglIter(0,x0))
		w0-->T854(Stat7*) ==> Ord(rk(w0))
		(1,rk(w0))-->T31(Stat5*) ==> false
	Discharge ==> Stat8: Finite(w0 - x0)
	TELEM ==> Svm({[n,snglIter(n,x0)]: n in Za}) & (domain({[n,snglIter(n,x0)]: n in Za}) = Za) & (range({[n,snglIter(n,x0)]: n in Za}) = {snglIter(n,x0): n in Za})
	Suppose ==> (not one_1_map({[n,snglIter(n,x0)]: n in Za}))
		Use_def(one_1_map)(Stat8*) ==> Stat9: not(FORALL x in {[n,snglIter(n,x0)]: n in Za}, y in {[n,snglIter(n,x0)]: n in Za} | (cdr(x) = cdr(y)) imp (x = y))
		(x2,y2)-->Stat9(Stat9*) ==> Stat10: (x2 in {[n,snglIter(n,x0)]: n in Za}) & (y2 in {[n,snglIter(n,x0)]: n in Za}) & (cdr(x2) = cdr(y2)) & (x2 /= y2)
		(n2,m2)-->Stat10(Stat10*) ==> (x2 = [n2,snglIter(n2,x0)]) & (n2 in Za) & (y2 = [m2,snglIter(m2,x0)]) & (m2 in Za)
		TELEM ==> (cdr([n2,snglIter(n2,x0)]) = snglIter(n2,x0)) & (cdr([m2,snglIter(m2,x0)]) = snglIter(m2,x0))
		EQUAL(Stat10) ==> rk(snglIter(n2,x0)) = rk(snglIter(m2,x0))
		EQUAL(Stat10) ==> Stat11: [n2,snglIter(n2,x0)] /= [m2,snglIter(n2,x0)]
		(Stat11)ELEM ==> n2 /= m2
		(n2,m2)-->T31(Stat10*) ==> (n2 in m2) or (m2 in n2)
		Suppose ==> n2 in m2
			(x0,n2,m2)-->T857(Stat10*) ==> false
		Discharge ==> AUTO
		(x0,m2,n2)-->T857(Stat10*) ==> false
	Discharge ==> AUTO
	EQUAL ==> Stat12: w0 = cumstr(0,rk({snglIter(n,x0): n in Za}))
	(w0 - x0,{snglIter(n,x0): n in Za})-->T189 ==> AUTO
	Suppose ==> {snglIter(n,x0): n in Za} nincin (w0 - x0)
		({[n,snglIter(n,x0)]: n in Za})-->T854(*) ==> Ord(rk({snglIter(n,x0): n in Za}))
		(rk({snglIter(n,x0): n in Za}),{snglIter(n,x0): n in Za})-->T866(Stat12*) ==> Stat13: {snglIter(n,x0): n in Za} * x0 /= 0
		c-->Stat13(Stat13*) ==> Stat14: (c in {snglIter(n,x0): n in Za}) & (c in x0)
		n1-->Stat14(Stat14*) ==> (n1 in Za) & (snglIter(n1,x0) in x0)
		(snglIter(n1,x0),x0)-->T852(Stat14*) ==> rk(snglIter(n1,x0)) in rk(x0)
--
-- But on the other hand it turns out easily that if $n1=0$ then $rk(x0) in rk(snglIter(n1,x0))$ and,
-- if $n1/=0$, then $rk(x0) in rk(snglIter(0,x0))$ and $rk(snglIter(0,x0)) in rk(snglIter(n1,x0))$;
-- accordingly, a contradiciton ensues in either case, and therefore ${snglIter(n,x0): n in Za} incin w0 - x0$.
--
		(x0,0,n1)-->T857 ==> AUTO
		Suppose ==> n1 = 0
			EQUAL(Stat14) ==> rk(snglIter(0,x0)) in rk(x0)
		(Stat14*)Discharge ==> AUTO
		T188(Stat14*) ==> Ord(0)
		(0,n1)-->T31(Stat14*) ==> 0 in n1
		T211(Stat14*) ==> rk(snglIter(0,x0)) in rk(snglIter(n1,x0))
	(Stat14*)Discharge ==> AUTO
	T206(Stat12*) ==> (not Finite(Za))
	({[n,snglIter(n,x0)]: n in Za})-->T191(Stat8*) ==> false
	Discharge ==> QED
--
-- Every set $b$ can be injected in a superstructure whose basis
-- is in one-to-one correspondence with $b$.
--
THEORY superstructure(b)
END superstructure
--
ENTER_THEORY superstructure
--
Def 10094: ur_thryvar := {{enum(x,Za+#b),Za+#b}: x in #b}
--
Theorem superstructure.0: (EXISTS f | one_1_map(f) & (range(f) = b) & (domain(f) = #b)). Proof:
    Suppose_not ==> Stat1: not(EXISTS f | (one_1_map(f) & (range(f) = b) & (domain(f) = #b)))
    b-->T147 ==> Stat2: (EXISTS f in OM | (one_1_map(f) & (range(f) = b) & (domain(f) = #b)))
    f-->Stat2(Stat2) ==> Stat3: one_1_map(f) & (range(f) = b) & (domain(f) = #b)
    f-->Stat1(Stat3) ==> false; Discharge ==> QED
--
APPLY(v1_thryvar:f) Skolem() ==>
Theorem superstructure.1: one_1_map(f) & (range(f) = b) & (domain(f) = #b)
--
Def 10095: bij_thryvar := {[x,{enum(inv(f)~[x],Za+#b),Za+#b}]: x in b}
Def 10096: sst_thryvar := cumstr(ur_thryvar,Za)
--
Theorem superstructure.2: one_1_map(bij_thryvar) & (domain(bij_thryvar)=b) & (range(bij_thryvar)=ur_thryvar). Proof:
    Suppose_not ==> AUTO
    Tsomehow ==> false; Discharge ==> QED
--
Theorem superstructure.3: supstr(ur_thryvar,sst_thryvar). Proof:
    Suppose_not ==> AUTO
    Tsomehow ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY superstructure
--
--THEORY superstructure(b)
--==>(sst_thryvar,ur_thryvar,bij_thryvar)
--	one_1_map(bij_thryvar) & (domain(bij_thryvar)=b) & (range(bij_thryvar)=ur_thryvar)
--	supstr(ur_thryvar,sst_thryvar)
--END superstructure
--
--
--
Def 10100: [hereditarily finite sets] Hfin := cumstr(0,Za)
--
Theorem 875: [the null set is hereditarily finite] 0 in Hfin. Proof:
Suppose_not ==> AUTO
	Use_def(Hfin) ==> Stat1: 0 notin cumstr(0,Za)
	(0,Za)-->T860(*) ==> Za = 0
	T212(*) ==> false
	Discharge ==> QED
--
Theorem 876: [transitivity of the collection of hereditarily finite sets] ((S in Hfin) & (X in S)) imp (X in Hfin). Proof:
Suppose_not(s0,x0) ==> AUTO
	Use_def(Hfin) ==> Stat1: (s0 in cumstr(0,Za)) & (x0 in s0) & (x0 notin cumstr(0,Za))
	T206(*) ==> Ord(Za)
	Use_def(pow(cumstr(0,Za))) ==> AUTO
	Za-->T863(Stat1*) ==> Stat2: s0 in {y: y incin cumstr(0,Za)}
	y0-->Stat2(Stat1,Stat1*) ==> false; Discharge ==> QED
--
Theorem 877: [extensionality of membership over the hereditarily finite sets] ((S in Hfin) & (T in Hfin) & (FORALL x | (x in Hfin) imp ((x in S) eq (x in T)))) imp (S = T). Proof:
Suppose_not(s0,t0) ==> Stat1: (FORALL x | (x in Hfin) imp ((x in s0) eq (x in t0))) & (s0 in Hfin) & (t0 in Hfin) & Stat2: (s0 /= t0)
	c-->Stat2(*) ==> (c in s0) neq (c in t0)
	Suppose ==> (not (c in Hfin))
		(s0,c)-->T876(*) ==> c notin s0
		(t0,c)-->T876(*) ==> false
	Discharge ==> AUTO
	c-->Stat1(*) ==> false
	Discharge ==> QED
--
--
--
Theorem 878: [closedness under powerset formation of the collection of hereditarily finite sets] (S in Hfin) imp (pow(S) in Hfin). Proof:
Suppose_not(s0) ==> AUTO
--
-- Reasoning by contradiction, assume $s0$ to be a counterexample, so that (by the definitions
-- of $Hfin$ and of $cumstr$) $s0$ belongs to $pow(cumstr(0,i0))$ for some $i0 in Za$.
--
	Use_def(cumstr(0,Za)) ==> AUTO
	Use_def(Un({pow(cumstr(0,y)): y in Za})) ==> AUTO
	SIMPLF ==> Un({pow(cumstr(0,y)): y in Za}) = {u: y in Za, u in pow(cumstr(0,y))}
	Use_def(Hfin) ==> Stat1: (s0 in {u: y in Za, u in pow(cumstr(0,y))}) & (pow(s0) notin cumstr(0,Za))
	(i0,u0)-->Stat1(Stat1*) ==> Stat2: (s0 in pow(cumstr(0,i0))) & (i0 in Za)
--
-- But then, $s0$ belongs to $cumstr(0,next(i0))$ and therefore its
-- powerset $pow(s0)$ is included in $cumstr(0,next(i0))$.
--
	Suppose	==> Stat3: ({y: y incin s0} nincin {y: y incin cumstr(0,i0)})
		Use_def(pow(cumstr(0,i0))) ==> AUTO
		e-->Stat3(Stat2*) ==> Stat4: (e in {y: y incin s0}) & (s0 in {y: y incin cumstr(0,i0)}) & (e notin {y: y incin cumstr(0,i0)})
		(y0,y1,e)-->Stat4(Stat4*) ==> false
	Discharge ==> AUTO
	Use_def(pow)(Stat2*) ==> pow(s0) incin pow(cumstr(0,i0))
	Suppose ==> Stat5: pow(cumstr(0,i0)) nincin cumstr(0,next(i0))
		Use_def(next(i0)) ==> AUTO
		Use_def(cumstr(0,i0+{i0})) ==> AUTO
		EQUAL(Stat2) ==> pow(cumstr(0,i0)) nincin (0 + Un({pow(cumstr(0,j)): j in i0+{i0}}))
		({pow(cumstr(0,j)): j in i0+{i0}})-->T274(*) ==> Stat6: (FORALL x in {pow(cumstr(0,j)): j in i0+{i0}} | x incin Un({pow(cumstr(0,j)): j in i0+{i0}}))
		(pow(cumstr(0,i0)))-->Stat6(Stat5*) ==> Stat7: pow(cumstr(0,i0)) notin {pow(cumstr(0,j)): j in i0+{i0}}
		i0-->Stat7(Stat7*) ==> false
	Discharge ==> AUTO
--
-- By Theorem 861, this implies that $pow(s0)$ belongs to $cumstr(0,Za)$, which leads to
-- the desired contradiction.
--
	i0-->T210(Stat2,Stat2*) ==> next(i0) in Za
	(next(i0),Za,pow(s0),0)-->T861(Stat1*) ==> false
	Discharge ==> QED
--
--
--
Theorem 879: [closedness under singleton formation of the collection of hereditarily finite sets] (S in Hfin) imp ({S} in Hfin). Proof:
Suppose_not(s0) ==> AUTO
--
-- Reasoning by contradiction, assume $s0$ to be a counterexample.
-- We already know that $(pow(pow(s0)) in Hfin)$ follows from $(pow(s0) in Hfin)$;
-- therefore we have a contradiction, because ${s0} in pow(pow(s0))$
-- and $Hfin$ is transitive.
--
	s0-->T878(*) ==> (pow(s0) in Hfin)
	(pow(s0))-->T878(*) ==> (pow(pow(s0)) in Hfin)
	(pow(pow(s0)),{s0})-->T876(*) ==> {s0} notin pow(pow(s0))
	Use_def(pow(s0)) ==> AUTO
	(s0,pow(s0))-->T214(*) ==> Stat1: s0 notin {y: y incin s0}
	s0-->Stat1(Stat1*) ==> false
	Discharge ==> QED
--
--
--
-- As an immediate corollary of Theorem 864, we have that the hereditarily finite sets are closed under dyadic union.
--
Theorem 880: [closedness under dyadic union of the collection of hereditarily finite sets] ((S in Hfin) & (T in Hfin)) imp ((S + T) in Hfin). Proof:
Suppose_not(s0,t0) ==> AUTO
	Use_def(Hfin) ==> Stat1: (s0 in cumstr(0,Za) - 0) & Stat2: (t0 in cumstr(0,Za) - 0) & ((s0 + t0) notin cumstr(0,Za))
	(s0,0,t0)-->T864(*) ==> false
	Discharge ==> QED
--
--
--
Theorem 881: [closedness under set difference of the collection of hereditarily finite sets] ((S in Hfin) & (T in Hfin)) imp (((S - T) in Hfin) & ({S,T} in Hfin)). Proof:
Suppose_not(s0,t0) ==> AUTO
--
-- Reasoning by contradiction, assume $s0,t0$ to be a counterexample. We readily ascertain that ${s0,t0} in Hfin$,
-- thanks to the fact that $Hfin$ is closed relative to singleton formation and to dyadic union.
--
	s0-->T879(*) ==> {s0} in Hfin
	t0-->T879(*) ==> {t0} in Hfin
	({s0},{t0})-->T880(*) ==> ({s0} + {t0}) in Hfin
	TELEM ==> {s0}+{t0} = {s0,t0}
	EQUAL ==> {s0,t0} in Hfin
--
-- It remains to be shown that ${s0,t0} in Hfin$. By Theorem 880
-- $(s0 + t0) in Hfin$ holds, and hence (by the definitions of $Hfin$ and of $cumstr$) $s0+t0$ belongs to
-- $pow(cumstr(0,i0))$ for a suitably chosen $i0 in Za$.
--
	(s0,t0)-->T880(*) ==> (s0 + t0) in Hfin
	Use_def(cumstr(0,Za)) ==> AUTO
	Use_def(Un({pow(cumstr(0,y)): y in Za})) ==> AUTO
	SIMPLF ==> Un({pow(cumstr(0,y)): y in Za}) = {u: y in Za, u in pow(cumstr(0,y))}
	Use_def(Hfin) ==> Stat1: (s0+t0 in {u: y in Za, u in pow(cumstr(0,y))}) & ((s0 - t0) notin cumstr(0,Za))
	Use_def(pow(cumstr(0,i0))) ==> AUTO
	(i0,u0)-->Stat1(Stat1*) ==> Stat2: (s0+t0 in {y: y incin cumstr(0,i0)}) & (i0 in Za)
--
-- But then, $s0 + t0$ and $s0 - t0$ are included in $cumstr(0,i0)$.
-- By Theorem 861, this implies that $s0-t0$ belongs to $cumstr(0,Za)$, which leads to
-- the desired contradiction.
--
	y0-->Stat2(Stat2*) ==> (s0 - t0) incin cumstr(0,i0)
	(i0,Za,s0 - t0,0)-->T861(Stat1*) ==> false
	Discharge ==> QED
--
--
--
Theorem 882: [closedness under selection of the collection of hereditarily finite sets] (S in Hfin) imp (arb(S) in Hfin). Proof:
Suppose_not(s0) ==> AUTO
	Suppose ==> arb(s0) = 0
		EQUAL ==> (not (0 in Hfin))
		T875 ==> false
	Discharge ==> arb(s0) in s0
	(s0,arb(s0))-->T876(*) ==> false
	Discharge ==> QED
--
--
--
Theorem 883: [all subsets of an hereditarily finite set are hereditarily finite] ((S in Hfin) & (T incin S)) imp (T in Hfin). Proof:
Suppose_not(s0,t0) ==> AUTO
--
-- Reasoning by contradiction, assume $s0,t0$ to be a counterexample, so that (by the definitions
-- of $Hfin$ and of $cumstr$) $s0$ belongs to $pow(cumstr(0,i0))$ for some $i0 in Za$.
--
	Use_def(cumstr(0,Za)) ==> AUTO
	Use_def(Un({pow(cumstr(0,y)): y in Za})) ==> AUTO
	SIMPLF ==> Un({pow(cumstr(0,y)): y in Za}) = {u: y in Za, u in pow(cumstr(0,y))}
	Use_def(Hfin) ==> Stat1: (s0 in {u: y in Za, u in pow(cumstr(0,y))}) & (t0 notin {u: y in Za, u in pow(cumstr(0,y))})
	(i0,u0,i0,t0)-->Stat1(Stat1*) ==> Stat2: (s0 in pow(cumstr(0,i0))) & (i0 in Za) & (t0 notin pow(cumstr(0,i0)))
--
-- This implies that $s0$ is a subset of $cumstr(0,i0)$, but then $t0$
-- is a subset of $cumstr(0,i0)$, too, which leads us to the desired contradiction.
--
	Use_def(pow)(Stat2,Stat2*) ==> Stat3: (s0 in {y: y incin cumstr(0,i0)}) & (t0 notin {y: y incin cumstr(0,i0)})
	(y0,t0)-->Stat3(*) ==> false
	Discharge ==> QED
--
--
--
Theorem 884: [alternative characterization of hereditarily finite sets] (S in Hfin) eq (Finite(S) & ({u in S | not (u in Hfin)} = 0)). Proof:
Suppose_not(s0) ==> AUTO
	Suppose ==> s0 in Hfin
		Suppose ==> (not Finite(s0))
--
-- Reasoning by contradiction, assume $s0$ to be a counterexample, so that (by the definitions
-- of $Hfin$ and of $cumstr$) $s0$ belongs to $pow(cumstr(0,i0))$ for some $i0 in Za$.
--
			Use_def(cumstr(0,Za)) ==> AUTO
			Use_def(Un({pow(cumstr(0,y)): y in Za})) ==> AUTO
			SIMPLF ==> Un({pow(cumstr(0,y)): y in Za}) = {u: y in Za, u in pow(cumstr(0,y))}
			Use_def(Hfin) ==> Stat1: (s0 in {u: y in Za, u in pow(cumstr(0,y))})
			(i0,u0)-->Stat1(Stat1*) ==> Stat2: (s0 in pow(cumstr(0,i0))) & (i0 in Za)
--
-- Since $cumstr(0,i0)$ is finite by Theorem 873, so is every subset of its, and hence $s0$ is finite.
--
			i0-->T873(*) ==> Finite(cumstr(0,i0))
			Use_def(pow)(Stat2,Stat2*) ==> Stat3: s0 in {y: y incin cumstr(0,i0)}
			y0-->Stat3(Stat3*) ==> s0 incin cumstr(0,i0)
			(cumstr(0,i0),s0)-->T189(*) ==> false
		Discharge ==> Stat4: {u in s0 | not (u in Hfin)} /= 0
		c-->Stat4(Stat4*) ==> (c in s0) & (not (c in Hfin))
		(s0,c)-->T876(*) ==> false
	Discharge ==> Finite(s0) & ({u in s0 | not (u in Hfin)} = 0) & (not (s0 in Hfin))
	APPLY(m1_thryvar:s1) finite_induction(n->s0,P(x)->(({u in x | not (u in Hfin)} = 0) & (not (x in Hfin)))) ==>
		Stat5: (FORALL k incin s1 | ((k /= s1) imp (not (({u in k | not (u in Hfin)} = 0) & (not (k in Hfin)))))) & Stat6: ({u in s1 | not (u in Hfin)} = 0) & (s1 notin Hfin)
	T875(Stat5) ==> arb(s1) in s1
	Loc_def ==> a = arb(s1)
	(s1 - {a})-->Stat5(Stat5*) ==> (not (({u in (s1 - {a}) | not (u in Hfin)} = 0) & (not ((s1 - {a}) in Hfin))))
	Set_monot(Stat5*) ==> {u in (s1 - {a}) | not (u in Hfin)} incin {u in s1 | not (u in Hfin)}
	(Stat5*)ELEM ==> ((s1 - {a}) in Hfin) & ((s1 - {a}) + {a} = s1)
	Suppose ==> (not (a in Hfin))
	a-->Stat6(Stat5*) ==> false; Discharge ==> AUTO
	a-->T879(Stat5*) ==> {a} in Hfin
	(s1 - {a},{a})-->T880(Stat5*) ==> ((s1 - {a}) + {a}) in Hfin
	EQUAL(Stat5) ==> false
	Discharge ==> QED
--
--
--
Theorem 885: [closedness under unionset of the collection of hereditarily finite sets] (S in Hfin) imp (Un(S) in Hfin). Proof:
Suppose_not(s0) ==> AUTO
--
-- Assuming that $s0$ is hereditarily finite, we have by Theorem 884 that $s0$ is finite
-- and that every element of $s0$ has (by the very definition of $s0 in Hfin$) a finite rank.
-- By Theorem 853, the rank of the unionset $Un(s0)$ is the union of the ranks of the
-- elements of $s0$; hence, recalling that the union of any finite set of natural numbers
-- is a natural number, the rank of $Un(s0)$ is finite; this proves that $Un(s0)$ is
-- hereditarily finite.
--
	s0-->T884(*) ==> Stat1: ({x in s0 | not (x in Hfin)} = 0) & Finite(s0)
	Use_def(Hfin)(Stat1*) ==> Stat2: Un(s0) notin cumstr(0,Za)
	T206(Stat2*) ==> Ord(Za)
	s0-->T853 ==> AUTO
	(Za,Un(s0))-->T870(Stat2*) ==> Un({rk(y): y in s0}) notin Za
	({rk(y): y in s0})-->T320(Stat2*) ==> ({rk(y): y in s0} nincin Za) or (not Finite({rk(y): y in s0}))
	Suppose ==> Stat3: {rk(y): y in s0} nincin Za
		c-->Stat3(Stat3*) ==> Stat4: (c in {rk(y): y in s0}) & (c notin Za)
		y0-->Stat4(Stat4*) ==> (y0 in s0) & (rk(y0) notin Za)
		y0-->T854(Stat4*) ==> Ord(rk(y0))
		(rk(y0))-->T205 ==> AUTO
		(rk(y0))-->T206(Stat4*) ==> (not Finite(rk(y0)))
		(rk(y0))-->T206(Stat4*) ==> (rk(y0) notin Za)  & Ord(Za)
		(Za,y0)-->T870(Stat4*) ==> y0 notin cumstr(0,Za)
		Use_def(Hfin)(Stat4*) ==> (not (y0 in Hfin))
		y0-->Stat1(Stat4*) ==> false
	Discharge ==> Stat5: (not Finite({rk(y): y in s0}))
	TELEM ==> Svm({[y,rk(y)]: y in s0}) & (domain({[y,rk(y)]: y in s0}) = s0) & (range({[y,rk(y)]: y in s0}) = {rk(y): y in s0})
	EQUAL(Stat1) ==> (Finite(domain({[y,rk(y)]: y in s0}))) & (not Finite(range({[y,rk(y)]: y in s0})))
	({[y,rk(y)]: y in s0})-->T192(Stat5*) ==> false
	Discharge ==> QED
--
--
--
THEORY herfin_induction(s0,P(x))
	(s0 in Hfin)
	P(s0)
END herfin_induction
--
ENTER_THEORY herfin_induction
--
Theorem herfin_induction0: [finiteness ensues from hereditary finiteness] Finite(s0). Proof:
Suppose_not ==> AUTO
	Assump ==> (s0 in Hfin)
	s0-->T884(*) ==> false
	Discharge ==> QED
--
-- The following theorem shows that we can select inside the given $s0$ an element $x$ for which $P(x)$ holds,
-- none of whose strict subsets $y$ likewise meets $P(y)$.
--
APPLY(m1_thryvar:hf0_thryvar) finite_induction(n->s0,P(x)->P(x)) ==>
Theorem herfin_induction1: [inclusion-minimal hereditarily finite set satisfying $P$] (hf0_thryvar incin s0) & P(hf0_thryvar) &
	(FORALL k incin hf0_thryvar | (k /= hf0_thryvar) imp (not P(k)))
--
-- The following theorem shows that we can find an hereditarily finite set $x$ for which $P(x)$ holds,
-- none of whose elements $y$ (or, more generally, no set having lower rank than $x$) likewise meets $P(y)$.
--
Theorem herfin_induction2: [rank-minimal hereditarily finite set satisfying $P$] (EXISTS x in cumstr(0,Za) | P(x) & (FORALL k | (rk(k) in rk(x)) imp (not P(k)))). Proof:
Suppose_not ==> Stat1: not(EXISTS x in cumstr(0,Za) | P(x) & (FORALL k | (rk(k) in rk(x)) imp (not P(k))))
--
-- It follows from the assumptions of this THEORY that the set ${n: n in Za, x in cumstr(0,n) | P(x)}$ is nonnull;
-- therefore $a := arb({n: n in Za, x incin cumstr(0,n) | P(x)})$ belongs to this set. But then we can choose
-- $n0 in Za$, $x0 in cumstr(0,n0)$ so that $P(x0)$ holds. Plainly $x0 in cumstr(0,Z0)$ and no set $x$ having smaller
-- rank than $x0$ can meet $P(x)$.
--
	Suppose ==> Stat2: {n: n in Za, x incin cumstr(0,n) | P(x)} = 0
		Assump ==> (s0 in Hfin)
		Use_def(Hfin) ==> s0 in cumstr(0,Za)
		Use_def(cumstr(0,Za)) ==> AUTO
		(Stat2*)ELEM ==> s0 in Un({pow(cumstr(0,n)): n in Za})
		Use_def(Un)(Stat2*) ==> s0 in {v: u in {pow(cumstr(0,n)): n in Za}, v in u}
		SIMPLF(Stat2*) ==> Stat3: s0 in {v: n in Za, v in pow(cumstr(0,n))}
		Use_def(pow(cumstr(0,m))) ==> AUTO
		(m,v0)-->Stat3(Stat3*) ==> Stat4: (s0 in {y: y incin cumstr(0,m)}) & (m in Za)
		y0-->Stat4(Stat4*) ==> s0 incin cumstr(0,m)
		Assump ==> P(s0)
		(m,s0)-->Stat2(Stat2*) ==> false
	Discharge ==> AUTO
	Loc_def ==> a = arb({n: n in Za, x incin  cumstr(0,n) | P(x)})
	({n: n in Za, x incin cumstr(0,n) | P(x)})-->T0(*) ==> Stat5: (a in {n: n in Za, x incin  cumstr(0,n) | P(x)}) & (a * {n: n in Za, x incin  cumstr(0,n) | P(x)} = 0)
	(n0,x0)-->Stat5(Stat5*) ==> (n0 in Za) & (x0 incin cumstr(0,n0)) & P(x0) & (n0 * {n: n in Za, x incin cumstr(0,n) | P(x)} = 0)
	(n0,Za,x0,0)-->T861(Stat5*) ==> x0 in cumstr(0,Za)
	x0-->Stat1(Stat5*) ==> Stat6: not(FORALL k | (rk(k) in rk(x0)) imp (not P(k)))
	k0-->Stat6(Stat6*) ==> (rk(k0) in rk(x0)) & P(k0)
--
-- Indeed, if we assume that $P(k0)$ holds for some $k0$ having smaller rank than $x0$, then we are led to a contradiction as follows.
-- Since $rk(x0)$ differs from $0$, the same holds true for $x0$, and hence for $cumstr(0,n0)$, and hence for $n0$. Calling $m0$ the
-- immediate predecessor of $n0$, if follows from $x0 incin cumstr(0,n0)$ that $rk(x0) incin n0$; therefore $rk(k0) in n0$, and
-- hence $rk(k0) incin m0$, $k0 incin cumstr(0,m0)$, whence a contradiction readily follows.
--
	x0-->T848(Stat5*) ==> cumstr(0,n0) /= 0
	Suppose ==> n0 = 0
		0-->T858(Stat5*) ==> cumstr(0,0) = 0
		EQUAL(Stat6) ==> false
	Discharge ==> AUTO
	Loc_def ==> m0 = Un(n0)
	n0-->T321(Stat5*) ==> Stat7: (m0 notin {n: n in Za, x incin cumstr(0,n) | P(x)}) & (m0 in Za) & (m0 incin n0) & (m0 in n0)
	Suppose ==> k0 nincin cumstr(0,m0)
		n0-->T322(Stat5*) ==> n0 = Un(n0) PLUS 1
		m0-->T317 ==> m0 PLUS 1 = next(m0)
		EQUAL(Stat6) ==> n0 = next(m0)
		T206(Stat7*) ==> Ord(Za)
		(Za,n0)-->T12(Stat5*) ==> Ord(n0)
		(Za,m0)-->T12(Stat7*) ==> Ord(m0)
		(n0,x0)-->T866(Stat5*) ==> rk(k0) in next(m0)
		(m0,rk(k0))-->T36(Stat7*) ==> rk(k0) incin m0
		(m0,k0)-->T866(Stat7*) ==> false
	Discharge ==> AUTO
	(m0,k0)-->Stat7(Stat6*) ==> false
	Discharge ==> QED
--
--
-- The following theorem shows that we can find an hereditarily finite set $x$ for which $P(x)$ holds,
-- none of whose elements or strict subsets $y$ likewise meets $P(y)$.
--
Theorem herfin_induction3: [existence of membership/inclusion-minimal hereditarily finite set satisfying $P$] (EXISTS x | (x in Hfin) & P(x) & (FORALL k | ((k in x) or ((k incin x) & (k /= x))) imp (not P(k)))). Proof:
Suppose_not ==> Stat1: not(EXISTS x | (x in Hfin) & P(x) & (FORALL k | ((k in x) or ((k incin x) & (k /= x))) imp (not P(k))))
	Therfin_induction2(*) ==> Stat2: (EXISTS x in cumstr(0,Za) | P(x) & (FORALL k | (rk(k) in rk(x)) imp (not P(k))))
	Use_def(Hfin) ==> (x0 in Hfin) eq (x0 in cumstr(0,Za)) 
	x0-->Stat2(Stat2*) ==> Stat3: (FORALL k | (rk(k) in rk(x0)) imp (not P(k))) & (x0 in Hfin) & P(x0)
	APPLY(hf0_thryvar:x1) herfin_induction(s0->x0,P(x)->P(x)) ==> Stat4: (FORALL k incin x1 | (k /= x1) imp (not P(k))) & (x1 incin x0) & P(x1)
	Suppose ==> Stat5: not(FORALL k | ((k in x1) or ((k incin x1) & (k /= x1))) imp (not P(k)))
		x2-->Stat5(Stat5*) ==> ((x2 in x1) or ((x2 incin x1) & (x2 /= x1))) & P(x2)
		Suppose ==> (x2 incin x1) & (x2 /= x1)
		x2-->Stat4(Stat4*) ==> false; Discharge ==> AUTO
		(x2,x0)-->T852 ==> AUTO
		x2-->Stat3(Stat4*) ==> false
	Discharge ==> AUTO
	(x0,x1)-->T883(Stat3*) ==> x1 in Hfin
	x1-->Stat1(Stat4*) ==> false
	Discharge ==> QED
--
-- Here we assign a name to a membership/inclusion-minimal hereditarily finite set satisfying $P$.
--
APPLY(v1_thryvar:hf1_thryvar) Skolem() ==>
Theorem herfin_induction4: [membership/inclusion-minimal hereditarily finite set satisfying $P$] (hf1_thryvar in Hfin) & P(hf1_thryvar) & (FORALL k | ((k in hf1_thryvar) or ((k incin hf1_thryvar) & (k /= hf1_thryvar))) imp (not P(k)))
--
ENTER_THEORY Set_theory
--
--
--DISPLAY herfin_induction
--
--THEORY herfin_induction(s0,P(x))
--	(s0 in Hfin)
--	P(s0)
--==>(hf0_thryvar,hf1_thryvar)
-- (FORALL k incin hf0_thryvar | (k /= hf0_thryvar) imp (not P(k))) & (hf0_thryvar incin s0) & P(hf0_thryvar)
-- (FORALL k | ((k in hf1_thryvar) or ((k incin hf1_thryvar) & (k /= hf1_thryvar))) imp (not P(k))) & (hf1_thryvar in Hfin) & P(hf1_thryvar)
-- (EXISTS x in cumstr(0,Za) | P(x) & (FORALL k | (rk(k) in rk(x)) imp (not P(k))))
--END herfin_induction
--
--
--
--
Theorem 886: [alternative characterization of hereditarily finite sets, 2] (S in Hfin) eq (Finite(Ult_membs(S))). Proof:
Suppose_not(s0) ==> AUTO
--
-- To prove the "if" part of the claim, assume that $Ult_membs(s0)$ is finite. Then
-- a set $sp$ exists which meets the conditions $Finite(Ult_membs(sp)) & (not (sp in Hfin))$
-- but none of whose members meets analogous conditions. Since $sp$ is included in $Ult_membs(sp)$,
-- it is finite; therefore, in view of Theorem 884, at least one of its members---call it $c$---must
-- fail to be hereditarily finite. Due to the minimality of $sp$, $Ult_membs(c)$ must be finite;
-- however, this conflicts with the monotonic law Theorem 23, ensuring that
-- $Ult_membs(c) imp Ult_membs(sp)$.
--
	Suppose ==> Finite(Ult_membs(s0)) & (not (s0 in Hfin))
		APPLY(mt1_thryvar:sp) transfinite_induction(n->s0,P(x)->(Finite(Ult_membs(x)) & (not (x in Hfin)))) ==>
			Stat1: (FORALL k | (Finite(Ult_membs(sp)) & (not (sp in Hfin))) & ((k in sp) imp (not (Finite(Ult_membs(k)) & (not (k in Hfin))))))
		0-->Stat1(Stat1*) ==> Finite(Ult_membs(sp)) & (not (sp in Hfin))
		(Ult_membs(sp),sp)-->T189 ==> AUTO
		sp-->T14(Stat1*) ==> (sp incin Ult_membs(sp)) & Finite(sp)
		sp-->T884(Stat1*) ==> Stat2: {u in sp | not (u in Hfin)} /= 0
		c-->Stat2(Stat2*) ==> (c in sp) & (not (c in Hfin))
		(Ult_membs(sp),Ult_membs(c))-->T189 ==> AUTO
		(c,sp)-->T22(Stat1*) ==> Finite(Ult_membs(c))
		c-->Stat1(Stat2*) ==> false
	Discharge ==> (s0 in Hfin) & (not Finite(Ult_membs(s0)))
	APPLY(hf1_thryvar:s1) herfin_induction(s0->s0,P(x)->(not Finite(Ult_membs(x)))) ==>
		Stat3: (FORALL k | ((k in s1) or ((k incin s1) & (k /= s1))) imp (not (not Finite(Ult_membs(k))))) & (s1 in Hfin) & (not Finite(Ult_membs(s1)))
	Suppose ==> s1 = 0
		T188(Stat3*) ==> Ord(0) & Finite(0)
		0-->T17(Stat3*) ==> Ult_membs(0) = 0
		EQUAL(Stat3) ==> false
	Discharge ==> AUTO
	Loc_def ==> a = arb(s1)
	s1-->T0(Stat3*) ==> Stat4: a in s1
	Suppose ==> Stat5: s1 = {a}
		a-->T18(Stat5*) ==> Ult_membs({a}) = Ult_membs(a) + {a}
		a-->Stat3(Stat4*) ==> Finite(Ult_membs(a))
		(Ult_membs(a),a)-->T199(Stat5*) ==> Finite(Ult_membs(a) + {a})
		EQUAL(Stat3) ==> false
	Discharge ==> AUTO
	(s1,{a})-->T883(Stat3*) ==> ({a} in Hfin) & ({a} incin s1) & ({a} /= s1)
	(s1,s1 - {a})-->T883(Stat3*) ==> ((s1 - {a}) in Hfin) & (s1 - {a} incin s1) & (s1 - {a} /= s1)
	({a})-->Stat3(Stat4*) ==> Finite(Ult_membs({a}))
	(s1 - {a})-->Stat3(Stat4*) ==> Finite(Ult_membs(s1 - {a}))
	(Ult_membs({a}),Ult_membs(s1 - {a}))-->T236(Stat4*) ==> Finite(Ult_membs({a}) + Ult_membs(s1 - {a}))
	(Ult_membs({a}) + Ult_membs(s1 - {a}),Ult_membs(s1))-->T189(Stat3*) ==> Stat6: Ult_membs(s1) nincin (Ult_membs({a}) + Ult_membs(s1 - {a}))
	e-->Stat6(Stat6*) ==> (e in Ult_membs(s1)) & (e notin Ult_membs({a})) & (e notin Ult_membs(s1 - {a}))
	s1-->T15 ==> AUTO
	{a}-->T15 ==> AUTO
	(s1 - {a})-->T15(Stat4*) ==> Stat7: (e in {v: x in s1, v in Ult_membs(x)}) & (e notin {v: x in {a}, v in Ult_membs(x)}) & (e notin {v: x in s1 - {a}, v in Ult_membs(x)})
	(x1,v1,x1,v1,x1,v1)-->Stat7(Stat7*) ==> false
	Discharge ==> QED
--
-- ************************************************************************************************
--			Section 17: Map calculus
-- ************************************************************************************************
--
THEORY based_maps(uu,rr)
	rr incin pow(uu PROD uu)
	ident(uu) in rr
	(FORALL q in rr | (Un(rr) - q) in rr)
	(FORALL q in rr | inv(q) in rr)
	(FORALL p in rr, q in rr | (p + q) in rr)
	(FORALL p in rr, q in rr | (q @ p) in rr)
END based_maps
--
ENTER_THEORY based_maps
--
Def based_maps.1: compl_thryvar(X) := (uu PROD uu) - X
--
Def based_maps.2: ident_thryvar := ident(uu)
--
Theorem based_maps.1: ((X in rr) & (Y in rr)) imp ((X + Y) = (Y + X)). Proof:
Suppose_not(x0,y0) ==> AUTO
	Discharge ==> QED
--
Theorem based_maps.2: ((X in rr) & (Y in rr) & (Z in rr)) imp ((X + Y) + Z = X + (Y + Z)). Proof:
Suppose_not(x0,y0,z0) ==> AUTO
	Discharge ==> QED
--
Theorem based_maps.3: ((X in rr) & (Y in rr)) imp (compl_thryvar(compl_thryvar(X + Y) + compl_thryvar(X + compl_thryvar(Y))) = X). Proof:
Suppose_not(x0,y0) ==> AUTO
	Assump ==> rr incin pow(uu PROD uu)
	Use_def(pow(uu PROD uu)) ==> AUTO
	ELEM ==> Stat1: (x0 in {y: y incin (uu PROD uu)}) & (y0 in {y: y incin (uu PROD uu)})
	(xp,yp)--> Stat1(Stat1*) ==> Stat2: (x0 incin (uu PROD uu)) & (y0 incin (uu PROD uu))
	Use_def(compl_thryvar) ==> (uu PROD uu) - (((uu PROD uu) - (x0 + y0)) + ((uu PROD uu) - (x0 + ((uu PROD uu) - y0)))) /= x0
	(Stat2*)Discharge ==> QED
--
Theorem based_maps.4: ((X in rr) & (Y in rr) & (Z in rr)) imp ((X @ Y) @ Z = X @ (Y @ Z)). Proof:
Suppose_not(x0,y0,z0) ==> AUTO
	(x0,y0,z0)-->T66 ==> AUTO
	Discharge ==> QED
--
Theorem based_maps.5: ((X in rr) & (Y in rr) & (Z in rr)) imp (Z @ (X + Y) = (Z @ X) + (Z @ Y)). Proof:
Suppose_not(x0,y0,z0) ==> AUTO
	(z0,x0,y0)-->T137 ==> AUTO
	Discharge ==> QED
--
Theorem based_maps.6: (X in rr) imp ((ident_thryvar @ X) = X). Proof:
Suppose_not(x0) ==> AUTO
	Use_def(ident_thryvar) ==> (ident(uu) @ x0) /= x0
	Assump ==> rr incin pow(uu PROD uu)
	Use_def(pow(uu PROD uu)) ==> AUTO
	ELEM ==> Stat1: x0 in {y: y incin (uu PROD uu)}
	y0 --> Stat1(Stat1*) ==> x0 incin (uu PROD uu)
	(uu PROD uu,uu,uu)-->T141(*) ==> Is_map(uu PROD uu)
	(x0,uu PROD uu)-->T52(*) ==> Is_map(x0)
	(uu,0,x0)-->T115(*) ==> range(x0) nincin uu
	(x0,uu PROD uu)-->T65(*) ==> range(x0) incin range(uu PROD uu)
	(uu PROD uu,uu,uu)-->T141(*) ==> false
	Discharge ==> QED
--
Theorem based_maps.7: (X in rr) imp (inv(inv(X)) = X). Proof:
Suppose_not(x0) ==> AUTO
	x0-->T100(*) ==> (not Is_map(x0))
	Assump ==> rr incin pow(uu PROD uu)
	Use_def(pow(uu PROD uu)) ==> AUTO
	ELEM ==> Stat1: x0 in {y: y incin (uu PROD uu)}
	y0-->Stat1(Stat1*) ==> x0 incin (uu PROD uu)
 	(x0,uu,uu)-->T141(*) ==> false
	Discharge ==> QED
--
Theorem based_maps.8: ((X in rr) & (Y in rr)) imp (inv(X + Y) = inv(X) + inv(Y)). Proof:
Suppose_not(x0,y0) ==> AUTO
	(x0,y0)-->T111(*) ==> false
	Discharge ==> QED
--
Theorem based_maps.9: ((X in rr) & (Y in rr)) imp (inv(X @ Y) = inv(Y) @ inv(X)). Proof:
Suppose_not(x0,y0) ==> AUTO
	Assump ==> rr incin pow(uu PROD uu)
	Use_def(pow(uu PROD uu)) ==> AUTO
	ELEM ==> Stat1: (x0 in {y: y incin (uu PROD uu)}) & (y0 in {y: y incin (uu PROD uu)})
	(xp,yp)--> Stat1(Stat1*) ==> Stat2: (x0 incin (uu PROD uu)) & (y0 incin (uu PROD uu))
	(uu PROD uu,uu,uu)-->T141(Stat2*) ==> Is_map(uu PROD uu)
	(x0,uu PROD uu)-->T52(Stat2*) ==> Is_map(x0)
	(y0,uu PROD uu)-->T52(Stat2*) ==> Is_map(y0)
	(x0,y0)-->T120(*) ==> false
	Discharge ==> QED
--
Theorem based_maps.10: ((X in rr) & (Y in rr)) imp ((compl_thryvar(Y @ X) @ inv(X)) + compl_thryvar(Y) = compl_thryvar(Y)). Proof:
Suppose_not(x0,y0) ==> AUTO
	Assump ==> rr incin pow(uu PROD uu)
	Use_def(pow(uu PROD uu)) ==> AUTO
	ELEM ==> Stat1: (x0 in {y: y incin (uu PROD uu)}) & (y0 in {y: y incin (uu PROD uu)})
	(xp,yp)--> Stat1(Stat1*) ==> Stat2: (x0 incin (uu PROD uu)) & (y0 incin (uu PROD uu))
--
	Use_def(compl_thryvar) ==> Stat3: (((uu PROD uu) - (y0 @ x0)) @ inv(x0)) nincin ((uu PROD uu) - y0)
	v0-->Stat3(Stat3*) ==> Stat4: (v0 in (((uu PROD uu) - (y0 @ x0)) @ inv(x0))) & (v0 notin ((uu PROD uu) - y0))
	Use_def(@) ==> Stat5: v0 in {[car(p),cdr(q)]: p in inv(x0), q in ((uu PROD uu) - (y0 @ x0)) | cdr(p) = car(q)}
	Use_def(inv(x0)) ==> AUTO
	Use_def(@) ==> (y0 @ x0) = {[car(r),cdr(s)]: r in x0, s in y0 | cdr(r) = car(s)}
	(p0,q0)-->Stat5(Stat4*) ==> Stat6: (p0 in {[cdr(v),car(v)]: v in x0}) & (q0 in ((uu PROD uu) - {[car(r),cdr(s)]: r in x0, s in y0 | cdr(r) = car(s)})) & (cdr(p0) = car(q0)) & (v0 = [car(p0),cdr(q0)])
	w0-->Stat6(Stat6*) ==> Stat7: (q0 notin {[car(r),cdr(s)]: r in x0, s in y0 | cdr(r) = car(s)}) & (w0 in x0) & (p0 = [cdr(w0),car(w0)])
	(cdr(w0),cdr(v0))-->T9(Stat7*) ==> (car([cdr(w0),cdr(v0)]) = cdr(w0)) & (cdr([cdr(w0),cdr(v0)]) = cdr(v0))
	(w0,[cdr(w0),cdr(v0)])-->Stat7(Stat7*) ==> Stat8: (q0 /= [car(w0),cdr([cdr(w0),cdr(v0)])]) or ([cdr(w0),cdr(v0)] notin y0)
	(cdr(w0),car(w0))-->T9(Stat8*) ==> (car([cdr(w0),car(w0)]) = cdr(w0)) & (cdr([cdr(w0),car(w0)]) = car(w0))
	Suppose ==> q0 /= [car(w0),cdr([cdr(w0),cdr(v0)])]
		EQUAL(Stat6) ==> (q0 /= [car(w0),cdr(v0)]) & (cdr(p0) = car(w0)) & (cdr(p0) = car(q0))
		(uu PROD uu,q0)-->T51(Stat6,Stat6*) ==> Is_map(uu PROD uu) imp (q0 = [car(q0),cdr(q0)])
		(uu PROD uu,uu,uu)-->T141(Stat8*) ==> Stat9: ([car(q0),cdr(q0)] /= [car(w0),cdr(v0)]) & (car(q0) = car(w0))
		(Stat9)ELEM ==> cdr(q0) /= cdr(v0)
		(car(p0),cdr(q0))-->T9(Stat9*) ==> cdr([car(p0),cdr(q0)]) = cdr(q0)
		EQUAL(Stat6) ==> false
	Discharge ==> q0 = [car(w0),cdr([cdr(w0),cdr(v0)])]
	(Stat8*)ELEM ==> [cdr(w0),cdr(v0)] notin y0
	(car(w0),cdr([cdr(w0),cdr(v0)]))-->T9(Stat8*) ==> cdr([car(w0),cdr([cdr(w0),cdr(v0)])]) = cdr(v0)
--??	EQUAL(Stat7) ==> [car(p0),cdr(q0)] notin y0
	EQUAL(Stat7) ==> Stat10: (cdr(q0) = cdr(v0)) & (car(p0) = cdr(w0))
	EQUAL(Stat8) ==> Stat11: [car(p0),cdr(q0)] notin y0
	(Stat4,Stat6,Stat11*)ELEM ==> [car(p0),cdr(q0)] notin (uu PROD uu)
	Use_def(PROD)(Stat11*) ==> Stat12: [car(p0),cdr(q0)] notin {[x,y]: x in uu, y in uu}
	(car(p0),cdr(q0))-->Stat12(Stat12*) ==> (car(p0) notin uu) or (cdr(q0) notin uu)
	(w0,uu,uu)-->T140(Stat2,Stat7,Stat10*) ==> car(p0) in uu
	(q0,uu,uu)-->T140(Stat6,Stat6*) ==> cdr(q0) in uu
	(Stat12*)Discharge ==> QED
--
--
ENTER_THEORY Set_theory
--
--DISPLAY based_maps
--
--THEORY based_maps(uu,rr)
--	rr incin pow(uu PROD uu)
--	ident(uu) in rr
--	(FORALL q in rr | (Un(rr) - q) in rr)
--	(FORALL q in rr | inv(q) in rr)
--	(FORALL p in rr, q in rr | (p + q) in rr)
--	(FORALL p in rr, q in rr | (q @ p) in rr)
--==>(compl_thryvar,ident_thryvar)
--	(FORALL x | compl_thryvar(x) = ((uu PROD uu) - x))
--	(ident_thryvar = ident(uu))
--	(FORALL x, y | ((x in rr) & (y in rr)) imp ((x + y) = (y + x)))
--	(FORALL x, y, z | ((x in rr) & (y in rr) & (z in rr)) imp ((x + y) + z = x + (y + z)))
--	(FORALL x, y | ((x in rr) & (y in rr)) imp (compl_thryvar(compl_thryvar(x + y) + compl_thryvar(x + compl_thryvar(y))) = x))
--	(FORALL x, y, z | ((x in rr) & (y in rr) & (z in rr)) imp ((x @ y) @ z = x @ (y @ z)))
--	(FORALL x, y, z | ((x in rr) & (y in rr) & (z in rr)) imp (z @ (x + y) = (z @ x) + (z @ y)))
--	(FORALL x | (x in rr) imp ((ident_thryvar @ x) = x))
--	(FORALL x | (x in rr) imp (inv(inv(x)) = x))
--	(FORALL x, y, z | ((x in rr) & (y in rr)) imp (inv(x + y) = inv(x) + inv(y)))
--	(FORALL x, y | ((x in rr) & (y in rr)) imp (inv(x @ y) = inv(y) @ inv(x)))
--	(FORALL x, y | ((x in rr) & (y in rr)) imp ((compl_thryvar(y @ x) @ inv(x)) + compl_thryvar(y) = compl_thryvar(y)))
--END based_maps
--
--
-- ************************************************************************************************
--			Section 18: Finite state automata
-- ************************************************************************************************
--
--
-- Next we develop the theory of a
-- (nondeterministic and finite) Kleene automaton.
--
THEORY nfa(a,v,s,t,d)
--
-- A nondeterministic finite automaton is
-- characterized by its alphabet $a$,
-- its set $v$ of states, among which the start
-- states $s$ and the accepting states $t$,
-- and by its transition relation $d$.
-- As a convenient trick, the entire alphabet is used
-- as the label for free (or 'in-place') transitions.
--
	(a /= 0) & Finite(a)
	((s + t) incin v) & Finite(v)
	d incin ((v PROD next(a)) PROD v)
END nfa
--
ENTER_THEORY nfa
--
Theorem nfa1: [transition triples are finitely many] Finite(d). Proof:
Suppose_not ==> AUTO
--
-- For, assuming the contrary, since $d$ is a subset of the
-- Cartesian product of two finite sets (which is finite in its turn),
-- we get a contradiction.
--
	Assump ==> Stat1: Finite(a) & Finite(v)
	(a,a)-->T199(Stat1*) ==> Stat2: Finite(a + {a})
	Use_def(next(a)) ==> AUTO
	EQUAL(Stat2) ==> Finite(next(a))
	(v,next(a))-->T262(Stat1*) ==> Stat3: Finite(v PROD next(a))
	(v PROD next(a),v)-->T262(Stat1,Stat3*) ==> Stat4: Finite((v PROD next(a)) PROD v)
	Assump ==> d incin ((v PROD next(a)) PROD v)
	((v PROD next(a)) PROD v,d)-->T189(Stat4*) ==> Finite(d)
    Discharge ==> QED
--
Def nfa1: [neighbors $p$ of a set $q$ of states] nfaNeighbor_thryvar(p,q) := (p incs q) & ({y: x in p, y in v - p | [[x,a],y] in d} = 0)
--
Def nfa2: [epsilon-closure of sets of states] nfaEps_thryvar := {[q,{z in v | (FORALL p incin v | nfaNeighbor_thryvar(p,q) imp (z in p))}]: q incin v}
--
-- In the following definition it is understood that the first
-- argument will normally be a set $q$ of states coinciding with
-- its own epsilon-closure while the second argument will be a
-- character drawn from the alphabet $a$.
--
Def nfa3: [transition over a symbol of the alphabet] nfa1_thryvar(C,Q) := {z: y in Q, z in v | [[y,C],z] in d}
--
Theorem nfa2: [strict inclusion between strings is a well-founded relation] ((W incin Fin_seqs(a)) & (W /= 0)) imp (EXISTS m in W | (FORALL y in W | not((y incin m) & (y /= m)))). Proof:
Suppose_not(w0) ==> AUTO
	(Fin_seqs(a),w0)-->T411(*) ==> Stat1: not(FORALL y in Fin_seqs(a) | Finite(y))
	y0-->Stat1(Stat1*) ==> Stat2: (y0 in Fin_seqs(a)) & (not Finite(y0))
	(y0,a)-->T336(Stat2*) ==> false
	Discharge ==> QED
--
APPLY(wfh2_thryvar:nfa_thryvar) wellfounded_recursive_fcn(s->Fin_seqs(a),
	arg1_bef_arg2(Y,X)->((Y incin X) & (Y /= X)),
	f3(B,W,Q)->(nfaEps_thryvar~[if W=0 then Q else nfa1_thryvar(W~[#W MINUS 1],arb(B)) end if]),
	g4(Qp,y,x,t)->Qp,P4(q,Wp,W,t)->(Wp=W ON (#W MINUS 1))) ==>
Theorem nfa3: [consumption of a string over the alphabet] (FORALL w,q | (w in Fin_seqs(a)) imp
	(nfa_thryvar(w,q) = (nfaEps_thryvar~[if w=0 then q else nfa1_thryvar(w~[#w MINUS 1],arb({nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp incin w) & (wp /= w)) & (wp = w ON (#w MINUS 1))})) end if])))
--
-- We can simplify as follows the characterization just given of the transitions over strings:
--
Theorem nfa4: [consumption of a string over the alphabet, 2] (W in Fin_seqs(a)) imp
	(nfa_thryvar(W,Q) = (nfaEps_thryvar~[if W = 0 then Q else nfa1_thryvar(W~[#W MINUS 1],nfa_thryvar(W ON (#W MINUS 1),Q)) end if])). Proof:
Suppose_not(w,q) ==> AUTO
	Tnfa3(*) ==> Stat1: (FORALL w,q | (w in Fin_seqs(a)) imp (nfa_thryvar(w,q) =
		(nfaEps_thryvar~[if w=0 then q else nfa1_thryvar(w~[#w MINUS 1],arb({nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp incin w) & (wp /= w)) & (wp = w ON (#w MINUS 1))})) end if])))
	(w,q)-->Stat1(*) ==> nfa_thryvar(w,q) =
		(nfaEps_thryvar~[if w=0 then q else nfa1_thryvar(w~[#w MINUS 1],arb({nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp incin w) & (wp /= w)) & (wp = w ON (#w MINUS 1))})) end if])
	Suppose ==> arb({nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp incin w) & (wp /= w)) & (wp = w ON (#w MINUS 1))}) =
		nfa_thryvar(w ON (#w MINUS 1),q)
		EQUAL ==> false
	Discharge ==> AUTO
	Suppose ==> Stat2: #w = 0
		w-->T162(*) ==> w = 0
		(Stat2*)ELEM ==> if w = 0 then q else nfa1_thryvar(W~[#W MINUS 1],nfa_thryvar(W ON (#W MINUS 1),Q)) end if = q
		(Stat2*)ELEM ==> if w=0 then q else nfa1_thryvar(w~[#w MINUS 1],arb({nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp incin w) & (wp /= w)) & (wp = w ON (#w MINUS 1))})) end if = q
		EQUAL ==> false
	Discharge ==> AUTO
	ELEM ==> Stat3: ({nfa_thryvar(w ON (#w MINUS 1),q)} /=
			{nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp incin w) & (wp /= w)) & (wp = w ON (#w MINUS 1))}) &
			(w in Fin_seqs(a)) & (#w /= 0)
--
-- Pick a witness $q0$ of the above-derived set inequality, so that $q0$
-- belongs to one of the two members, but not to the other. Whether it belongs
-- to the left-hand member or to the right-hand one, we will reach a contradiction.
-- Therefore we can conclude that the desired conclusion holds.
--
	q0-->Stat3 ==> AUTO
	Suppose ==> q0 notin {nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp incin w) & (wp /= w)) & (wp = w ON (#w MINUS 1))}
		(Stat3*)ELEM ==> Stat4: nfa_thryvar(w ON (#w MINUS 1),q) notin {nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp incin w) & (wp /= w)) & (wp = w ON (#w MINUS 1))}
		(w,#w MINUS 1)-->T48 ==> AUTO
		(w ON (#w MINUS 1))-->Stat4(Stat4*) ==> ((w ON (#w MINUS 1)) notin Fin_seqs(a)) or ((w ON (#w MINUS 1)) = w)
		(w,a)-->T336(Stat3*) ==> Stat5: (domain(w) = #w) & (#w in Za)
		Suppose ==> (w ON (#w MINUS 1)) = w
			(w,#w MINUS 1)-->T94 ==> AUTO
			EQUAL(Stat5) ==> #w = #w * (#w MINUS 1)
			(Stat5*)ELEM ==> #w incin (#w MINUS 1)
			ALGEBRA(Stat5) ==> (0 in Za) & (1 in Za)
			w-->T166(Stat5*) ==> ##w = #w
			w-->T156(Stat5*) ==> Ord(#w)
			T188(Stat5*) ==> Ord(0)
			(0,#w)-->T31(Stat3*) ==> Stat6: 0 in #w
			Use_def(next(0)) ==> AUTO
			Use_def(1)(Stat6*) ==> (1 = {0}) & (#w incs 1)
			(#w)-->T268(Stat5) ==> #w MINUS 0 = #w
			(1,#w,0)-->T299(Stat5*) ==> false
		Discharge ==> AUTO
		ALGEBRA(Stat5) ==> (#w MINUS 1) in Za
		(w,a,#w MINUS 1)-->T346(Stat3*) ==> false
	Discharge ==> Stat7: (q0 in {nfa_thryvar(wp,q): wp in Fin_seqs(a) | ((wp incin w) & (wp /= w)) & (wp = w ON (#w MINUS 1))}) &
			(q0 /= nfa_thryvar(w ON (#w MINUS 1),q))
	wq-->Stat7(Stat7*) ==> (wq = w ON (#w MINUS 1)) & (q0 = nfa_thryvar(wq,q))
	EQUAL(Stat7) ==> false
	Discharge ==> QED
--
-- Observe that the consumption of a string over the alphabet leads from sets of states to sets of states:
--
Theorem nfa5: [consumption of a string leads to states] (W in Fin_seqs(a)) imp (nfa_thryvar(W,Q) incin v). Proof:
Suppose_not(w0,q0) ==> AUTO
--
-- Arguing by contradiction, assume that $w0,q0$ form a counterexample to the claim of this
-- theorem. Recall that $nfa_thryvar(W,Q)$ is, by Theorem nfa4, an $nfaEps_ythryvar$-image.
--
	(w0,a,q0)-->Tnfa4 ==> AUTO --??
	Suppose ==> if w0 = 0 then q0 else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),q0)) end if notin domain(nfaEps_thryvar)
	(if w0 = 0 then q0 else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),q0)) end if,nfaEps_thryvar)-->T124(*) ==> false; Discharge ==> AUTO
--
-- Therefore, $nfa_thryvar(W,Q)$ belongs to $range(nfaEps_ythryvar)$, which inspection of
-- the definition of $nfaEps_ythryvar$ readily reveals to be included in $pow(v)$.
--
	(if w0 = 0 then q0 else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),q0)) end if,nfaEps_thryvar)-->T71(*) ==> nfa_thryvar(w0,q0) in range(nfaEps_thryvar)
	Use_def(nfaEps_thryvar) ==> Stat1: nfa_thryvar(w0,q0) in {{z in v | (FORALL p incin v | nfaNeighbor_thryvar(p,q) imp (z in p))}: q incin v}
	q1-->Stat1(*) ==> Stat2: {z in v | (FORALL p incin v | nfaNeighbor_thryvar(p,q1) imp (z in p))} nincin v
	z-->Stat2(Stat2*) ==> Stat3: (z in {z in v | (FORALL p incin v | nfaNeighbor_thryvar(p,q1) imp (z in p))}) & (z notin v)
	()-->Stat3(Stat3*) ==> false
	Discharge ==> QED
--
Def nfa4: [regular language spanned by the automaton] nfaLang_thryvar := {w in Fin_seqs(a) | t * nfa_thryvar(w,s) /= 0}
--
-- In the special case in which the automaton is deterministic, in the
-- sense to be specified next, it becomes possible to characterize more
-- simply the transitions over strings and the language spanned by the
-- automaton. In this case, in fact, consumption of a string starting
-- with any specific state (typically the initial state) either
-- gets stuck in a state which, confronted with the scanned symbol,
-- does not enable transition, or leads to a single state.
--
Def nfa5: [characterization of determinism] Is_dfa_thryvar := (#s = 1) & Svm(d) & (domain(d) incin (v PROD a))
--
Theorem nfa6: [characterization of determinism, 1] ((#s = 1) & Svm(d) & (domain(d) incin (v PROD a))) imp Is_dfa_thryvar. Proof:
Suppose_not ==> AUTO
	Use_def(Is_dfa_thryvar) ==> false
	Discharge ==> QED
--
Theorem nfa7: Is_dfa_thryvar imp (nfaNeighbor_thryvar(P,Q) eq (P incs Q)). Proof:
Suppose_not(p,q) ==> AUTO
	Use_def(nfaNeighbor_thryvar) ==> Stat1: {y: x in p, y in v - p | [[x,a],y] in d} /= 0
	(x0,y0)-->Stat1(Stat1*) ==> [[x0,a],y0] in d
	([x0,a],y)-->T9(Stat2*) ==> Stat2: car([[x0,a],y0]) = [x0,a]
	Use_def(Is_dfa_thryvar)(Stat2*) ==> domain(d) incin (v PROD a)
	([[x0,a],y0],d)-->T60(Stat1*) ==> Stat3: [x0,a] in (v PROD a)
	(x0,a)-->T9(Stat4*) ==> Stat4: cdr([x0,a]) = a
	([x0,a],v,a)-->T140(Stat3*) ==> false
	Discharge ==> QED
--
Theorem nfa8: Is_dfa_thryvar imp (((Q incin v) imp ((nfaEps_thryvar~[Q]) = Q)) & ((Q nincin v) imp ((nfaEps_thryvar~[Q]) = 0))). Proof:
Suppose_not(qp) ==> AUTO
	Suppose ==> nfaEps_thryvar /= {[q,q]: q incin v}
		Use_def(nfaEps_thryvar) ==> Stat1: {[q,{z in v | (FORALL p incin v | nfaNeighbor_thryvar(p,q) imp (z in p))}]: q incin v} /= {[q,q]: q incin v}
		q0-->Stat1(Stat1*) ==> Stat2: (q0 incin v) & ([q0,{z in v | (FORALL p incin v | nfaNeighbor_thryvar(p,q0) imp (z in p))}] /= [q0,q0])
		Suppose ==> {z in v | (FORALL p incin v | nfaNeighbor_thryvar(p,q0) imp (z in p))} = q0
			EQUAL(Stat2) ==> false
		Discharge ==> Stat3: {z in v | (FORALL p incin v | nfaNeighbor_thryvar(p,q0) imp (z in p))} /= q0
		y0-->Stat3(Stat3*) ==> (y0 in {z in v | (FORALL p incin v | nfaNeighbor_thryvar(p,q0) imp (z in p))}) eq (y0 notin q0)
		Suppose ==> Stat4: y0 in {z in v | (FORALL p incin v | nfaNeighbor_thryvar(p,q0) imp (z in p))}
			()-->Stat4(Stat3*) ==> Stat5: (FORALL p incin v | nfaNeighbor_thryvar(p,q0) imp (y0 in p)) & (y0 notin q0)
			(q0,q0)-->Tnfa7(*) ==> Stat6: nfaNeighbor_thryvar(q0,q0)
			q0-->Stat5(Stat2,Stat5,Stat6*) ==> false
		Discharge ==> AUTO
		(Stat3*)ELEM ==> Stat7: (y0 notin {z in v | (FORALL p incin v | nfaNeighbor_thryvar(p,q0) imp (z in p))}) & (y0 in q0)
		y0-->Stat7(Stat7,Stat2*) ==> Stat8: not(FORALL p incin v | nfaNeighbor_thryvar(p,q0) imp (y0 in p))
		q1-->Stat8(Stat8*) ==> (nfaNeighbor_thryvar(q1,q0)) & (y0 notin q1)
		(q1,q0)-->Tnfa7(*) ==> q1 incs q0
	(Stat7*)Discharge ==> Stat9: nfaEps_thryvar = {[q,q]: q incin v}
	TELEM ==> Is_map({[q,q]: q incin v}) & (domain({[q,q]: q incin v}) = {q: q incin v})
	Suppose ==> Stat10: qp nincin v
		Suppose ==> Stat11: qp in {q: q incin v}
			q2-->Stat11(Stat10*) ==> false
		Discharge ==> qp notin {q: q incin v}
		EQUAL(Stat9) ==> qp notin domain(nfaEps_thryvar)
		(qp,nfaEps_thryvar)-->T124(*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat12: qp notin {q: q incin v}
		qp-->Stat12(Stat9*) ==> false
	Discharge ==> qp in {q: q incin v}
	EQUAL(Stat9) ==> Stat13: Is_map(nfaEps_thryvar) & (qp in domain(nfaEps_thryvar))
	(nfaEps_thryvar,qp)-->T77(Stat9*) ==> Stat14: [qp,nfaEps_thryvar~[qp]] in {[q,q]: q incin v}
	q3-->Stat14(*) ==> Stat15: ([qp,nfaEps_thryvar~[qp]] = [q3,q3]) & ((nfaEps_thryvar~[qp]) /= qp)
	(Stat15)ELEM ==> false
	Discharge ==> QED
--
Theorem nfa9: [characterization of determinism, 2] (Is_dfa_thryvar & (W in Fin_seqs(a))) imp (#nfa_thryvar(W,{Y}) in 2). Proof:
Suppose_not(w,y0) ==> AUTO
--
-- Arguing by contradiction, assume that $w,y0$ form a counterexample to the claim of this
-- theorem. Since $w$ is finite, we can exploit finite induction to pick a $w0$ such that $w0,y0$
-- is a counterexample whose component $w0$ is inclusion-minimal.
--
	(w,a)-->T336(*) ==> Finite(w)
	APPLY(m1_thryvar:w0) finite_induction(n->w,P(X)->((X in Fin_seqs(a)) & (#nfa_thryvar(X,{y0}) notin 2))) ==>
		Stat1: ((w0 in Fin_seqs(a)) & (#nfa_thryvar(w0,{y0}) notin 2)) &
		(FORALL k incin w0 | (k /= w0) imp (not ((k in Fin_seqs(a)) & (#nfa_thryvar(k,{y0}) notin 2))))
--
-- By resorting to the standard characterization of the consumption of
-- a string by the automaton, we readily discard the possibility $w0=0$.
--
	(w0,a,{y0})-->Tnfa4(Stat1*) ==> nfa_thryvar(w0,{y0}) = (nfaEps_thryvar~[if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) end if]) --??
	TELEM ==> Stat2: (2 = {0,1}) & (1 = {0})
	Suppose ==> w0 = 0
		(Stat2*)ELEM ==> if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) end if = {y0}
--
-- (Even the case when $y0 notin v$ must be taken into account, and
-- causes a minor digression in this part of the proof.)
--
		({y0})-->Tnfa8(*) ==> ((y0 notin v) imp ((nfaEps_thryvar~[{y0}]) = 0)) &
				((y0 in v) imp ((nfaEps_thryvar~[{y0}]) = {y0}))
		Suppose ==> y0 notin v
			0-->T162(Stat2*) ==> (#0 = 0) & ((nfaEps_thryvar~[{y0}]) = 0)
			EQUAL(Stat1) ==> #nfa_thryvar(w0,{y0}) = 0
		(Stat1*)Discharge ==> AUTO
		y0-->T305(Stat2*) ==> (#{y0} = {0}) & ((nfaEps_thryvar~[{y0}]) = {y0})
		EQUAL(Stat1) ==> {0} notin {0,{0}}
	(Stat2*)Discharge ==> AUTO
--
-- But then, the induction hypothesis applies to $w0 ON (#w0 MINUS 1)$,
-- because this string is strictly included in $w0$.
--
	(Stat2*)ELEM ==> Stat3: if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) end if = nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))
	Use_def(nfa1_thryvar)(Stat3*) ==> if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) end if = {z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d}
	(w0,a)-->T336(Stat1,Stat1*) ==> (#w0 in Za) & (domain(w0) = #w0)
	Suppose ==> Stat4: (w0 ON (#w0 MINUS 1)) notin Fin_seqs(a)
		(w0,a,#w0 MINUS 1)-->T346(Stat1,Stat4*) ==> (#w0 MINUS 1) notin Za
		ALGEBRA(Stat3) ==> false
	Discharge ==> AUTO
	(w0,#w0 MINUS 1)-->T48(Stat3*) ==> (w0 ON (#w0 MINUS 1)) incin w0
	Suppose ==> w0 ON (#w0 MINUS 1) = w0
		(w0,#w0 MINUS 1)-->T94(Stat3*) ==> domain(w0 ON (#w0 MINUS 1)) = domain(w0) * (#w0 MINUS 1)
		EQUAL(Stat3) ==> Stat5: domain(w0) * (#w0 MINUS 1) = #w0
		(#w0)-->T268(Stat5) ==> (#w0 MINUS 1) incs (#w0 MINUS 0)
		T211(Stat5*) ==> (0 in Za) & (1 in Za)
		w0-->T162(Stat2*) ==> #w0 /= 0
		w0-->T156(Stat5*) ==> Ord(#w0)
		T188(Stat5*) ==> Ord(0)
		(0,#w0)-->T31(Stat2*) ==> #w0 incs 1
		(1,#w0,0)-->T299(Stat2*) ==> false
	Discharge ==> AUTO
	(w0 ON (#w0 MINUS 1))-->Stat1(Stat2*) ==> Stat6: #nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}) in {0,1}
--
-- The case $nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}) = 0$ trivially leads to a contradiction, because in
-- this case no additional transition can take place after consumption of the initial part of the string.
--
	Suppose ==> #nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}) = 0
		(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))-->T162(Stat6*) ==> nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}) = 0
		Suppose ==> Stat7: {z: y in 0, z in v | [[y,w0~[#w0 MINUS 1]],z] in d} /= 0
			(y1,z1)-->Stat7(Stat7*) ==> false
		Discharge ==> {z: y in 0, z in v | [[y,w0~[#w0 MINUS 1]],z] in d} = 0
		EQUAL(Stat3) ==> if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) end if = 0
		Suppose ==> Stat8: 0 notin {q: q incin v}
			0-->Stat8(Stat8*) ==> false
		Discharge ==> AUTO
		({[q,q]: q incin v},0)-->T77(Stat2*) ==> Stat9: [0,{[q,q]: q incin v}~[0]] in {[q,q]: q incin v}
		q1-->Stat9(Stat9) ==> 0 = {[q,q]: q incin v}~[0]
		EQUAL(Stat1) ==> false
	Discharge ==> Stat10: #nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}) = 1
	(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))-->T307(Stat10*) ==> Stat11: nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}) = {arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))}
	Suppose ==> Stat12: {z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d} nincin {d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]}
		z0-->Stat12(Stat12*) ==> Stat13: (z0 in {z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d}) & (z0 /= d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]])
		(y2,z2)-->Stat13(Stat11*) ==> (y2 = arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))) & ([[y2,w0~[#w0 MINUS 1]],z2] in d) & (z2 /= d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]])
		EQUAL(Stat13) ==> ([[y2,w0~[#w0 MINUS 1]],z2] in d) & (z2 /= d~[[y2,w0~[#w0 MINUS 1]]])
		Use_def(Is_dfa_thryvar)(*) ==> Svm(d)
		([y2,w0~[#w0 MINUS 1]],z2)-->T9(Stat13*) ==> (car([[y2,w0~[#w0 MINUS 1]],z2]) = [y2,w0~[#w0 MINUS 1]]) &  (cdr([[y2,w0~[#w0 MINUS 1]],z2]) = z2)
		(d,[[y2,w0~[#w0 MINUS 1]],z2])-->T74(Stat13*) ==> (d~[car([[y2,w0~[#w0 MINUS 1]],z2])]) = z2
		EQUAL(Stat13) ==> false
	Discharge ==> AUTO
	(d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]],{z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d})-->T306(Stat11*) ==> Stat14:
			#{z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d} in 2
	Suppose ==> Stat15: {z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d} nincin v
		zp-->Stat15(Stat15*) ==> Stat16: (zp in {z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d}) & (zp notin v)
		(y3,z3)-->Stat16(Stat16*) ==> false
	Discharge ==> AUTO
	({z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d})-->Tnfa8(*) ==>
			(nfaEps_thryvar~[{z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d}]) = {z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d}
	EQUAL(Stat1) ==> false
	Discharge ==> QED
--
Theorem nfa10: [deterministic consumption of a string over the alphabet, 3] (Is_dfa_thryvar & (W in Fin_seqs(a)) & (Y in v)) imp
	(nfa_thryvar(W,{Y}) = if W = 0 then {Y}
	elseif nfa_thryvar(W ON (#W MINUS 1),{Y}) = 0 then 0
	elseif [arb(nfa_thryvar(W ON (#W MINUS 1),{Y})),W~[#W MINUS 1]] notin domain(d) then 0
	else {d~[[arb(nfa_thryvar(W ON (#W MINUS 1),{Y})),W~[#W MINUS 1]]]} end if). Proof:
Suppose_not(w0,y0) ==> AUTO
--
-- For, assuming the contrary, we reach a contradiction by arguing as follows.
--
	(w0,a,{y0})-->Tnfa4(*) ==> Stat1: (nfa_thryvar(w0,{y0}) = (nfaEps_thryvar~[if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) end if])) & Is_dfa_thryvar & (y0 in v) --??
--
-- As a preliminary, let us observe that the application of $nfaEps_thryvar$ can be simplified off
-- from the definition of $nfa_thryvar(w0,{y0})$ thanks to the determinism hypothesis.
--
	Suppose ==> (nfaEps_thryvar~[if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) end if]) /= if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) end if
		(if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) end if)-->Tnfa8(Stat1*) ==> if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) end if nincin v
		Suppose ==> w0 = 0
		(Stat1*)ELEM ==> false; Discharge ==> AUTO
		(Stat1*)ELEM ==> nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) nincin v
		Use_def(nfa1_thryvar) ==> Stat2: {z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d} nincin v
		zp-->Stat2(Stat2*) ==> Stat3: (zp in {z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d}) & (zp notin v)
		(yq,zq)-->Stat3(Stat3*) ==> false
	Discharge ==> (nfaEps_thryvar~[if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) end if]) = if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) end if
--
-- One by one, we will examine all branches of the if_then_else expression appearing as right-hand side
-- of the inequality assumed initially, to see that each of them leads to a contradiction.
--
	Suppose ==> Stat4: w0 = 0
		ELEM ==> false
	Discharge ==> Stat5: w0 /= 0
	(Stat5*)ELEM ==> if w0 = 0 then {y0} else nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) end if = nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))
	EQUAL ==> Stat6: (nfa_thryvar(w0,{y0}) = nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))) &
		Is_dfa_thryvar & (y0 in v) & (w0 in Fin_seqs(a)) &
		(nfa_thryvar(w0,{y0}) /= if w0 = 0 then {y0}
	elseif nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}) = 0 then 0
	elseif [arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]] notin domain(d) then 0
	else {d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]} end if)
	Suppose ==> nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}) = 0
		(Stat5*)ELEM ==> nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) /= 0
		EQUAL(Stat6) ==> Stat7: nfa1_thryvar(w0~[#w0 MINUS 1],0) /= 0
		Use_def(nfa1_thryvar(w0~[#w0 MINUS 1],0)) ==> AUTO
		z0-->Stat7(Stat7*) ==> Stat8: z0 in {z: y in 0, z in v | [[y,w0~[#w0 MINUS 1]],z] in d}
		z1-->Stat8(Stat8*) ==> false
	Discharge ==> AUTO
	Suppose ==> (w0 ON (#w0 MINUS 1)) notin Fin_seqs(a)
		(w0,a)-->T336(Stat6*) ==> (#w0 in Za) & (domain(w0) = #w0)
		(w0,a,#w0 MINUS 1)-->T346(Stat6*) ==> (#w0 MINUS 1) notin Za
		ALGEBRA(Stat6) ==> false
	Discharge ==> AUTO
	TELEM ==> 2 = {0,1}
	(w0 ON (#w0 MINUS 1),a,y0)-->Tnfa9(Stat6*) ==> Stat9: #nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}) in {0,1} --??
	(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))-->T307 ==> AUTO
	Suppose ==> Stat10: [arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]] notin domain(d)
		(Stat5*)ELEM ==> nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) /= 0
		Use_def(nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))) ==> AUTO
		EQUAL(Stat6) ==> Stat11: {z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d} /= 0
		(y3,z3)-->Stat11(Stat11*) ==> (y3 in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) & ([[y3,w0~[#w0 MINUS 1]],z3] in d)
		(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))-->T162(Stat6*) ==> y3 = arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))
		EQUAL(Stat11) ==> [[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],z3] in d
		([arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],z3)-->T9(Stat11*) ==> car([[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],z3]) = [arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]
		([[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],z3],d)-->T60(Stat10*) ==> false
	Discharge ==> AUTO
	(Stat5*)ELEM ==> Stat12: nfa1_thryvar(w0~[#w0 MINUS 1],nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})) /= {d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]}
	Use_def(nfa1_thryvar)(Stat12*) ==> {z: y in nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}), z in v | [[y,w0~[#w0 MINUS 1]],z] in d} /= {d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]}
	(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))-->T162(Stat5*) ==> nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}) = {arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))}
	EQUAL ==> Stat13: {z: y in {arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0}))}, z in v | [[y,w0~[#w0 MINUS 1]],z] in d} /= {d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]}
	SIMPLF(Stat13*) ==> {z in v | [[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],z] in d} /= {d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]}
	Use_def(Is_dfa_thryvar)(Stat6,Stat6*) ==> Svm(d)
	Use_def(Svm)(Stat13*) ==> Is_map(d)
	(d,[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]])-->T77(Stat9*) ==> [[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]] in d
	Suppose ==> Stat14: (d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]) notin {z in v | [[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],z] in d}
		Assump ==> d incin ((v PROD next(a)) PROD v)
		([arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]])-->T9(Stat14*) ==> cdr([[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]]) = (d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]])
		([[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]],v PROD next(a),v)-->T140(Stat13*) ==> (d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]) in v
		(d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]])-->Stat14(Stat13*) ==> false
	Discharge ==> AUTO
	(Stat13*)ELEM ==> Stat15: {z in v | [[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],z] in d} nincin {d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]}
	z2-->Stat15(Stat15*) ==> Stat16: (z2 in {z in v | [[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],z] in d}) & (z2 /= (d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]))
	()-->Stat16(Stat16*) ==> (z2 in v) & ([[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],z2] in d)
	Use_def(Svm)(Stat13*) ==> Stat17: (FORALL x in d, y in d | (car(x) = car(y)) imp (x = y))
	([arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]])-->T9(Stat17*) ==> car([[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]]) = [arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]
	([arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],z2)-->T9(Stat17*) ==> car([[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],z2]) = [arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]
	([[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]],[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],z2])-->Stat17(Stat13*) ==> Stat18: [[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]]=[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]],z2]
	(Stat18)ELEM ==> Stat19: (d~[[arb(nfa_thryvar(w0 ON (#w0 MINUS 1),{y0})),w0~[#w0 MINUS 1]]]) = z2
	(Stat19,Stat16*)ELEM ==> false
	Discharge ==> QED
--
Theorem nfa11: [language accepted by a deterministic automaton] Is_dfa_thryvar imp (nfaLang_thryvar = {z in Fin_seqs(a) | (#nfa_thryvar(z,s) = 1) & (nfa_thryvar(z,s) incin t)}). Proof:
Suppose_not ==> AUTO
	Use_def(nfaLang_thryvar) ==> Stat1: {w: w in Fin_seqs(a) | t * nfa_thryvar(w,s) /= 0} /= {w: w in Fin_seqs(a) | (#nfa_thryvar(w,s) = 1) & (nfa_thryvar(w,s) incin t)}
	w0-->Stat1(*) ==> Stat2: (w0 in Fin_seqs(a)) & ((t * nfa_thryvar(w0,s) /= 0) neq ((#nfa_thryvar(w0,s) = 1) & (nfa_thryvar(w0,s) incin t))) & Is_dfa_thryvar
	(w0,a,arb(s))-->Tnfa9(Stat2*) ==> Stat3: #nfa_thryvar(w0,{arb(s)}) in 2 --??
	Use_def(Is_dfa_thryvar)(Stat2*) ==> #s = 1
	s-->T307(Stat2*) ==> s = {arb(s)}
	TELEM ==> 2 = {0,1}
	EQUAL(Stat3) ==> Stat4: #nfa_thryvar(w0,s) in {0,1}
	Suppose ==> Stat5: #nfa_thryvar(w0,s) /= 1
		(nfa_thryvar(w0,s))-->T162(Stat4*) ==> Stat6: nfa_thryvar(w0,s) = 0
		(Stat2,Stat5,Stat6*)ELEM ==> false
	Discharge ==> Stat7: #nfa_thryvar(w0,s) = 1
	(nfa_thryvar(w0,s))-->T307(Stat4*) ==> Stat8: nfa_thryvar(w0,s) = {arb(nfa_thryvar(w0,s))}
	(Stat2,Stat7,Stat8*)ELEM ==> false
	Discharge ==> QED
--
-- In sight of a bootstrap of the current theory of a
-- non-deterministic finite state automaton, we characterize
-- the associated deterministic finite state automaton.
--
Def nfa6: [states of associated deterministic automaton] dfaStates_thryvar := {nfaEps_thryvar~[q]: q incin v}
--
Def nfa7: [start states of associated deterministic automaton] dfaStart_thryvar := nfaEps_thryvar~[s]
--
Def nfa8: [accepting states of associated deterministic automaton] dfaAccept_thryvar := {q in dfaStates_thryvar | t * q /= 0}
--
Def nfa9: [transition function of associated deterministic automaton] dfaTrans_thryvar := {[[q,c],nfaEps_thryvar~[nfa1_thryvar(c,q)]]: q in dfaStates_thryvar, c in a}
--
-- The following theorem, preparatory to the self-application of this theory, does not include
-- the claims $a /= 0$ and $Finite(a)$, because these will be inherited assumptions.
--
Theorem nfa12: [preparation for self-application of this THEORY]
	(({dfaStart_thryvar} + dfaAccept_thryvar) incin dfaStates_thryvar) & Finite(dfaStates_thryvar) &
	(dfaTrans_thryvar incin ((dfaStates_thryvar PROD next(a)) PROD dfaStates_thryvar)) &
	Svm(dfaTrans_thryvar) & (domain(dfaTrans_thryvar) incin (dfaStates_thryvar PROD a)) &
	(range(dfaTrans_thryvar) incin dfaStates_thryvar). Proof:
Suppose_not ==> AUTO
	Assump ==> Stat1: s incin v
	Use_def(dfaStates_thryvar) ==> Stat3: dfaStates_thryvar = {nfaEps_thryvar~[q]: q incin v}
	Suppose ==> dfaStart_thryvar notin dfaStates_thryvar
		Use_def(dfaStart_thryvar) ==> Stat4: nfaEps_thryvar~[s] notin {nfaEps_thryvar~[q]: q incin v}
		s-->Stat4(Stat1*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat5: dfaAccept_thryvar nincin dfaStates_thryvar
		Use_def(dfaAccept_thryvar) ==> Stat6: {q in dfaStates_thryvar | t * q /= 0} nincin dfaStates_thryvar
		q1-->Stat6(Stat6*) ==> Stat7: (q1 in {q in dfaStates_thryvar | t * q /= 0}) & (q1 notin dfaStates_thryvar)
		()-->Stat7(Stat7*) ==> false
	Discharge ==> AUTO
	TELEM ==> Svm({[[q,c],nfaEps_thryvar~[nfa1_thryvar(c,q)]]: q in dfaStates_thryvar, c in a})
	TELEM ==> domain({[[q,c],nfaEps_thryvar~[nfa1_thryvar(c,q)]]: q in dfaStates_thryvar, c in a}) = {[q,c]: q in dfaStates_thryvar, c in a}
	TELEM ==> range({[[q,c],nfaEps_thryvar~[nfa1_thryvar(c,q)]]: q in dfaStates_thryvar, c in a}) = {nfaEps_thryvar~[nfa1_thryvar(c,q)]: q in dfaStates_thryvar, c in a}
	Use_def(dfaTrans_thryvar) ==> Stat8: Svm(dfaTrans_thryvar) & (domain(dfaTrans_thryvar) incin {[q,c]: q in dfaStates_thryvar, c in a}) & (range(dfaTrans_thryvar) = {nfaEps_thryvar~[nfa1_thryvar(c,q)]: q in dfaStates_thryvar, c in a})
	Use_def(PROD) ==> domain(dfaTrans_thryvar) incin (dfaStates_thryvar PROD a)
	Suppose ==> range(dfaTrans_thryvar) nincin dfaStates_thryvar
		EQUAL(Stat8) ==> Stat9: {nfaEps_thryvar~[nfa1_thryvar(c,q)]: q in dfaStates_thryvar, c in a} nincin dfaStates_thryvar
		y2-->Stat9(Stat9*) ==> Stat10: (y2 in  {nfaEps_thryvar~[nfa1_thryvar(c,q)]: q in dfaStates_thryvar, c in a}) & (y2 notin dfaStates_thryvar)
--
--?? With context (Stat1*), the following step would fail:
--
		(q2,c2)-->Stat10(Stat10,Stat3*) ==> Stat11: (nfaEps_thryvar~[nfa1_thryvar(c2,q2)]) notin {nfaEps_thryvar~[q]: q incin v}
		(nfa1_thryvar(c2,q2))-->Stat11(Stat11*) ==> Stat12: nfa1_thryvar(c2,q2) nincin v
		Use_def(nfa1_thryvar)(Stat12*) ==> Stat13: {z: y in q2, z in v | [[y,c2],z] in d} nincin v
		z2-->Stat13(Stat13*) ==> Stat14: (z2 in {z: y in q2, z in v | [[y,c2],z] in d}) & (z2 notin v)
		(y3,z3)-->Stat14(Stat14*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat15: dfaTrans_thryvar nincin ((dfaStates_thryvar PROD next(a)) PROD dfaStates_thryvar)
		Use_def(Svm)(Stat8,Stat8*) ==> Is_map(dfaTrans_thryvar)
		Use_def(next)(Stat15*) ==> a incin next(a)
		(dfaStates_thryvar,dfaStates_thryvar,a,next(a))-->T256(Stat8*) ==> domain(dfaTrans_thryvar) incin (dfaStates_thryvar PROD next(a))
		(dfaTrans_thryvar,dfaStates_thryvar PROD next(a),dfaStates_thryvar)-->T141(Stat8*) ==> false
	Discharge ==> Stat16: (not Finite(dfaStates_thryvar))
	Assump ==> Finite(v)
	v-->T264(Stat16*) ==> Finite(pow(v))
	APPLY() finite_image(e(X)->(nfaEps_thryvar~[X]),s0->(pow(v))) ==> Finite({nfaEps_thryvar~[q]: q in pow(v)})
	Suppose ==> Stat17: {nfaEps_thryvar~[q]: q in pow(v)} /= {nfaEps_thryvar~[q]: q incin v}
		q3-->Stat17(Stat17*) ==> (q3 in {nfaEps_thryvar~[q]: q in pow(v)}) eq (q3 notin {nfaEps_thryvar~[q]: q incin v})
		Use_def(pow)(Stat17*) ==> Stat18: pow(v) = {q: q incin v}
		Suppose ==> Stat19: (q3 in {nfaEps_thryvar~[q]: q in pow(v)}) & (q3 notin {nfaEps_thryvar~[q]: q incin v})
			(q4,q4)-->Stat19(Stat18*) ==> Stat20: (q4 in {q: q incin v}) & (q4 nincin v)
			q5-->Stat20(Stat20*) ==> false
		Discharge ==> AUTO
		(Stat17*)ELEM ==> Stat21: (q3 in {nfaEps_thryvar~[q]: q incin v}) & (q3 notin {nfaEps_thryvar~[q]: q in pow(v)})
		(q6,q6)-->Stat21(Stat18*) ==> Stat22: (q6 notin {q: q incin v}) & (q6 incin v)
		q6-->Stat22(Stat22*) ==> false
	Discharge ==> {nfaEps_thryvar~[q]: q in pow(v)} = {nfaEps_thryvar~[q]: q incin v}
	EQUAL(Stat3) ==> false
	Discharge ==> QED
--
APPLY(nfa_thryvar:dfa_thryvar,nfaLang_thryvar:dfaLang_thryvar,Is_dfa_thryvar:Js_dfa_thryvar) nfa(a->a,v->dfaStates_thryvar,s->{dfaStart_thryvar},t->dfaAccept_thryvar,d->dfaTrans_thryvar) ==>
Theorem nfa13: Finite(dfaTrans_thryvar) &
	(((#{dfaStart_thryvar} = 1) & Svm(dfaTrans_thryvar) & (domain(dfaTrans_thryvar) incin (dfaStates_thryvar PROD a))) imp Js_dfa_thryvar) &
	(FORALL w, y | (Js_dfa_thryvar & (w in Fin_seqs(a))) imp (#dfa_thryvar(w,{y}) in 2)) &
	(FORALL w, y | (Js_dfa_thryvar & (w in Fin_seqs(a)) & (y in dfaStates_thryvar)) imp
		(dfa_thryvar(w,{y}) = if w = 0 then {y}
		elseif dfa_thryvar(w ON (#w MINUS 1),{y}) = 0 then 0
		elseif [arb(dfa_thryvar(W ON (#W MINUS 1),{Y})),W~[#W MINUS 1]] notin domain(dfaTrans_thryvar) then 0
		else {dfaTrans_thryvar~[[arb(dfa_thryvar(w ON (#w MINUS 1),{y})),w~[#w MINUS 1]]]} end if)) &
	(Js_dfa_thryvar  imp (dfaLang_thryvar =
		{z in Fin_seqs(a) | (#dfa_thryvar(z,{dfaStart_thryvar}) = 1) & (dfa_thryvar(z,{dfaStart_thryvar}) incin dfaAccept_thryvar)}))
--
Theorem nfa14: Js_dfa_thryvar. Proof:
Suppose_not ==> AUTO
	Tnfa13(*) ==> Stat1: not((#{dfaStart_thryvar} = 1) & Svm(dfaTrans_thryvar) & (domain(dfaTrans_thryvar) incin (dfaStates_thryvar PROD a)))
	TELEM ==> 1 = {0}
	(dfaStart_thryvar)-->T305(Stat1*) ==> #{dfaStart_thryvar} = 1
	TELEM ==> Svm({[[q,c],nfaEps_thryvar(nfa1_thryvar(c,q))]: q in dfaStates_thryvar, c in a})
	Use_def(dfaTrans_thryvar) ==> Svm(dfaTrans_thryvar)
	TELEM ==> domain({[[q,c],nfaEps_thryvar(nfa1_thryvar(c,q))]: q in dfaStates_thryvar, c in a}) = {[q,c]: q in dfaStates_thryvar, c in a}
	Use_def(dfaTrans_thryvar) ==> domain(dfaTrans_thryvar) = {[q,c]: q in dfaStates_thryvar, c in a}
	Use_def(PROD) ==> domain(dfaTrans_thryvar) = dfaStates_thryvar PROD a
	Discharge ==> QED
--
Theorem nfa15: (W in Fin_seqs(a)) imp (#dfa_thryvar(W,{Y}) in 2). Proof:
Suppose_not(w,y) ==> AUTO
	Tnfa13(*) ==> Stat1: (FORALL w, y | (Js_dfa_thryvar & (w in Fin_seqs(a))) imp (#dfa_thryvar(w,{y}) in 2))
	Tnfa14 ==> Js_dfa_thryvar
	(w,y)-->Stat1(*) ==> false
	Discharge ==> QED
--
--
Theorem nfa16: ((W in Fin_seqs(a)) & (Y in dfaStates_thryvar)) imp (dfa_thryvar(W,{Y}) = if W = 0 then {Y}
		elseif dfa_thryvar(W ON (#W MINUS 1),{Y}) = 0 then 0
		elseif [arb(dfa_thryvar(W ON (#W MINUS 1),{Y})),W~[#W MINUS 1]] notin domain(dfaTrans_thryvar) then 0
		else {dfaTrans_thryvar~[[arb(dfa_thryvar(W ON (#W MINUS 1),{Y})),W~[#W MINUS 1]]]} end if). Proof:
Suppose_not(w,y) ==> AUTO
	Tnfa13(*) ==> Stat1: (FORALL w, y | (Js_dfa_thryvar & (w in Fin_seqs(a)) & (y in dfaStates_thryvar)) imp
		(dfa_thryvar(w,{y}) = if w = 0 then {y}
		elseif dfa_thryvar(w ON (#w MINUS 1),{y}) = 0 then 0
		elseif [arb(dfa_thryvar(w ON (#w MINUS 1),{y})),w~[#w MINUS 1]] notin domain(dfaTrans_thryvar) then 0
		else {dfaTrans_thryvar~[[arb(dfa_thryvar(w ON (#w MINUS 1),{y})),w~[#w MINUS 1]]]} end if))
	Tnfa14 ==> Js_dfa_thryvar
	(w,y)-->Stat1(*) ==> false
	Discharge ==> QED
--
Theorem nfa17: dfaLang_thryvar = {z in Fin_seqs(a) | (#dfa_thryvar(z,{dfaStart_thryvar}) = 1) & (dfa_thryvar(z,{dfaStart_thryvar}) incin dfaAccept_thryvar)}. Proof:
Suppose_not ==> AUTO
	Tnfa14 ==> Js_dfa_thryvar
	Tnfa13 ==> false
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- A nondeterministic finite automaton is
-- characterized by its alphabet $a$,
-- its set $v$ of states, among which the start
-- states $s$ and the accepting states $t$,
-- and by its transition relation $d$.
-- As a convenient trick, the entire alphabet is used
-- as the label for free (or 'in-place') transitions.
--
-- DISPLAY nfa
--
-- THEORY nfa(a,v,s,t,d)
--
--	(a /= 0) & Finite(a)
--	((s + t) incin v) & Finite(v)
--	d incin ((v PROD next(a)) PROD v)
-- ==>(nfaNeighbor_thryvar,nfaEps_thryvar,nfa1_thryvar,nfa_thryvar,nfaLang_thryvar,Is_dfa_thryvar,dfaStates_thryvar,dfaStart_thryvar,dfaAccept_thryvar,dfaTrans_thryvar,dfa_thryvar,dfaLang_thryvar)
--	Finite(d)
--	(FORALL p,q | nfaNeighbor_thryvar(p,q) eq ((p incs q) & ({y: x in p, y in v - p | [[x,a],y] in d} = 0)))
--	(nfaEps_thryvar = {[q,{z in v | (FORALL p incin v | nfaNeighbor_thryvar(p,q) imp (z in p))}]: q incin v})
--	(FORALL c,q | nfa1_thryvar(c,q) = {z: y in q, z in v | [[y,c],z] in d})
--	(FORALL w | ((w incin Fin_seqs(a)) & (w /= 0)) imp (EXISTS m in w | (FORALL y in w | not((y incin m) & (y /= m)))))
--	(FORALL w | (w in Fin_seqs(a)) imp (nfa_thryvar(w,q) = (nfaEps_thryvar~[if w = 0 then q else nfa1_thryvar(w~[#w MINUS 1],nfa_thryvar(w ON (#w MINUS 1),q)) end if])))
--	(FORALL w, q | (w in Fin_seqs(a)) imp (nfa_thryvar(w,q) incin v))
--	(nfaLang_thryvar = {w in Fin_seqs(a) | t * nfa_thryvar(w,s) /= 0})
--	(Is_dfa_thryvar eq ((#s = 1) & Svm(d) & (domain(d) incin (v PROD a))))
--	(FORALL p, q | Is_dfa_thryvar imp (nfaNeighbor_thryvar(p,q) eq (p incs q)))
--	(FORALL q | Is_dfa_thryvar imp (((q incin v) imp ((nfaEps_thryvar~[q]) = q)) & ((q nincin v) imp ((nfaEps_thryvar~[q]) = 0))))
--	(FORALL w, y | (Is_dfa_thryvar & (w in Fin_seqs(a))) imp (#nfa_thryvar(w,{y}) in 2))
--	Is_dfa_thryvar imp (nfaLang_thryvar = {z in Fin_seqs(a) | (#nfa_thryvar(z,s) = 1) & (nfa_thryvar(z,s) incin t)})
--	(dfaStates_thryvar = {nfaEps_thryvar~[q]: q incin v})
--	(dfaStart_thryvar = (nfaEps_thryvar~[s]))
--	(dfaAccept_thryvar = {q in dfaStates_thryvar | t * q /= 0})
--	(dfaTrans_thryvar = {[[q,c],nfaEps_thryvar(nfa1_thryvar(c,q))]: q in dfaStates_thryvar, c in a})
--	Finite(dfaTrans_thryvar)
--	(FORALL w, y | (w in Fin_seqs(a)) imp (#dfa_thryvar(w,{y}) in 2))
--	(FORALL w, y | ((w in Fin_seqs(a)) & (y in dfaStates_thryvar)) imp (dfa_thryvar(w,{y}) = if w = 0 then {y} elseif dfa_thryvar(w ON (#w MINUS 1),{y}) = 0 then 0 elseif [arb(dfa_thryvar(w ON (#w MINUS 1),{y})),w~[#w MINUS 1]] notin domain(dfaTrans_thryvar) then 0 else {dfaTrans_thryvar~[[arb(dfa_thryvar(w ON (#w MINUS 1),{y})),w~[#w MINUS 1]]]} end if))
--	dfaLang_thryvar = {z in Fin_seqs(a) | (#dfa_thryvar(z,{dfaStart_thryvar}) = 1) & (dfa_thryvar(z,{dfaStart_thryvar}) incin dfaAccept_thryvar)}
-- END nfa
--
-- ************************************************************************************************
--			Section 19: Mostowski collapse, infinite spirals
-- ************************************************************************************************
--
--
THEORY collapse(W(X))
END collapse
--
ENTER_THEORY collapse
--
Def collapse1: Mostowski_thryvar(X) := {Mostowski_thryvar(y): y in X | W(y)}
--
Theorem collapse1: (W(C) & W(D) & (D in C)) imp (Mostowski_thryvar(D) in Mostowski_thryvar(C)). Proof:
Suppose_not(c,cp) ==> AUTO
	Use_def(Mostowski_thryvar(c)) ==> AUTO
	ELEM ==> Stat1: Mostowski_thryvar(cp) notin {Mostowski_thryvar(y): y in c | W(y)}
	cp-->Stat1(*) ==> false
	Discharge ==> QED
--
Theorem collapse2: ((FORALL c, cp | (W(c) & W(cp) & (Mostowski_thryvar(cp) = Mostowski_thryvar(c))) imp (cp = c) ) &
		W(C) & W(D)) imp ((Mostowski_thryvar(D) in Mostowski_thryvar(C)) eq (D in C)). Proof:
Suppose_not(c0,d0) ==> AUTO
--
-- Reasoning by contradiction, we argue as follows. Suppose $c0,d0$ are
-- a counterexample to the claim of this theorem. Then, taking
-- Theorem collapse1 into account, we know that since the equivalence
--	$(Mostowski_thryvar(d0) in Mostowski_thryvar(c0)) eq (d0 in c0)$
-- must be false, its direct implication that fails. And hence
--	$(Mostowski_thryvar(d0) in Mostowski_thryvar(c0)) & (d0 notin c0)$
--
	ELEM ==> Stat1: (FORALL c, cp | (W(c) & W(cp) & (Mostowski_thryvar(cp) = Mostowski_thryvar(c))) imp (cp = c) )
	(c0,d0)-->Tcollapse1(*) ==> Stat2: W(c0) & W(d0) & (Mostowski_thryvar(d0) in Mostowski_thryvar(c0)) & (d0 notin c0)
--
-- By the definition of $Mostowski_thryvar(c0)$, some element $y0$ of
-- $c0$ must be such that $W(y0)$ and
-- $Mostowski_thryvar(d0) = Mostowski_thryvar(y0)$ both hold.
--
	Use_def(Mostowski_thryvar(c0)) ==> AUTO
	(Stat2*)ELEM ==> Stat3: Mostowski_thryvar(d0) in {Mostowski_thryvar(y): y in c0 | W(y)}
	y0-->Stat3(Stat3*) ==> (Mostowski_thryvar(d0) = Mostowski_thryvar(y0)) & (y0 in c0) & W(y0)
--
-- However, by the injectivity hypothesis, this implies that $y0=d0$,
-- conflicting with the supposed fact $d0 notin c0$.
--
	(d0,y0)-->Stat1(Stat2*) ==> false
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- DISPLAY collapse
--
-- THEORY collapse(W(X))
-- ==>(Mostowski_thryvar)
--	(FORALL c, cp | (W(c) & W(cp) & (cp in c)) imp (Mostowski_thryvar(cp) in Mostowski_thryvar(c)))
--	(FORALL c, d | ((FORALL c, cp | (W(c) & W(cp) & (Mostowski_thryvar(cp) = Mostowski_thryvar(c))) imp
--			(cp = c) ) &
--			W(c) & W(d)) imp ((Mostowski_thryvar(d) in Mostowski_thryvar(c)) eq (d in c)))
-- END collapse
--
--
--
THEORY mutual_climbing
END mutual_climbing
--
ENTER_THEORY mutual_climbing
--
Def 10011: om_thryvar(I) := [{cdr(om_thryvar(k)): k in I}, {car(om_thryvar(k)): k in I} + { {cdr(om_thryvar(k)): k in I} }]
Def 10012: om1_thryvar := {cdr(om_thryvar(k)): k in Za}
Def 10013: om2_thryvar := {car(om_thryvar(k)): k in Za}
--
Theorem mutual_climbing1: (Ord(I) & Ord(J)) imp (car(om_thryvar(I)) /= cdr(om_thryvar(J))). Proof:
Suppose_not(i,j) ==> Stat1: Ord(i) & Ord(j) & (car(om_thryvar(i)) = cdr(om_thryvar(j)))
	TELEM ==> Stat2: true
	Use_def(om_thryvar)(Stat2,Stat2*) ==> Stat3: om_thryvar(j) = [{ cdr(om_thryvar(k)): k in j },
		({ car(om_thryvar(k)): k in j } + {{ cdr(om_thryvar(k)): k in j }})]
	Use_def(om_thryvar)(Stat2,Stat2*) ==> Stat4: om_thryvar(i) = [{ cdr(om_thryvar(k)): k in i },
		({ car(om_thryvar(k)): k in i } + {{ cdr(om_thryvar(k)): k in i }})]
	(Stat3,Stat3)ELEM ==> Stat5: (car(om_thryvar(j)) = { cdr(om_thryvar(k)): k in j })
	(Stat3,Stat3)ELEM ==> Stat6: (cdr(om_thryvar(j)) = ({ car(om_thryvar(k)): k in j } + {{ cdr(om_thryvar(k)): k in j }}))
	(Stat4,Stat4)ELEM ==> Stat7: car(om_thryvar(i)) = { cdr(om_thryvar(k)): k in i }
	(Stat1,Stat5,Stat6,Stat7*)ELEM ==> Stat8: (car(om_thryvar(i)) /= car(om_thryvar(j))) &
		Stat9: (car(om_thryvar(i)) notin { car(om_thryvar(k)): k in j }) &
		Stat10: (cdr(om_thryvar(j)) notin { cdr(om_thryvar(k)): k in i })
	Suppose ==> i = j
	EQUAL(Stat8*) ==> false; Discharge ==> Stat11: i /= j
	i-->Stat9(Stat8,Stat8*) ==> i notin j
	j-->Stat10(Stat8,Stat8*) ==> j notin i
	(Stat1,Stat1*)ELEM ==> Ord(i) & Ord(j)
(i,j)-->T31(Stat11*) ==> false; Discharge ==> QED
--
Theorem mutual_climbing2: (Ord(I) & Ord(J) & (I /= J)) imp ((car(om_thryvar(I)) /= car(om_thryvar(J))) &
		(cdr(om_thryvar(I)) /= cdr(om_thryvar(J)))). Proof:
Suppose_not(i,j) ==> Stat1: Ord(i) & Ord(j) & (i /= j) & ((car(om_thryvar(i)) = car(om_thryvar(j))) or
		(cdr(om_thryvar(i)) = cdr(om_thryvar(j))))
--
-- Reasoning by contradiction, assume that $i,j$ are a counterexample
-- to the asserted statement.
--
	TELEM ==> Stat2: true
	Use_def(om_thryvar)(Stat2,Stat2*) ==> Stat3: om_thryvar(j) = [{ cdr(om_thryvar(k)): k in j },
		({ car(om_thryvar(k)): k in j } + {{ cdr(om_thryvar(k)): k in j }})]
	Use_def(om_thryvar)(Stat2,Stat2*) ==> Stat4: om_thryvar(i) = [{ cdr(om_thryvar(k)): k in i },
		({ car(om_thryvar(k)): k in i } + {{ cdr(om_thryvar(k)): k in i }})]
	(Stat3,Stat3)ELEM ==> Stat5: (car(om_thryvar(j)) = { cdr(om_thryvar(k)): k in j })
	(Stat3,Stat3)ELEM ==> Stat6: (cdr(om_thryvar(j)) = ({ car(om_thryvar(k)): k in j } + {{ cdr(om_thryvar(k)): k in j }}))
	(Stat4,Stat4)ELEM ==> Stat7: car(om_thryvar(i)) = { cdr(om_thryvar(k)): k in i }
	(Stat4,Stat4)ELEM ==> Stat8: (cdr(om_thryvar(i)) = ({ car(om_thryvar(k)): k in i } + {{ cdr(om_thryvar(k)): k in i }}))
	(Stat5,Stat6,Stat7,Stat8*)ELEM ==> Stat9: (car(om_thryvar(i)) in cdr(om_thryvar(i))) & (car(om_thryvar(j)) in cdr(om_thryvar(j)))
--
-- We can easily prove that $i notin j$.
--
	Suppose ==> Stat10: i in j
		Suppose ==> cdr(om_thryvar(i)) notin car(om_thryvar(j))
			EQUAL(Stat2*) ==> Stat11: cdr(om_thryvar(i)) notin { cdr(om_thryvar(k)): k in j }
		i-->Stat11(Stat10*) ==> false; Discharge ==> Stat12: cdr(om_thryvar(i)) in car(om_thryvar(j))
	(Stat9,Stat12,Stat1*)ELEM ==> false; Discharge ==> Stat13: i notin j
--
-- The proof that $j notin i$ is entirely analogous.
--
	Suppose ==> Stat14: j in i
		Suppose ==> cdr(om_thryvar(j)) notin car(om_thryvar(i))
			EQUAL(Stat2*) ==> Stat15: cdr(om_thryvar(j)) notin { cdr(om_thryvar(k)): k in i }
		j-->Stat15(Stat14*) ==> false; Discharge ==> Stat16: cdr(om_thryvar(j)) in car(om_thryvar(i))
	(Stat9,Stat16,Stat1*)ELEM ==> false; Discharge ==> j notin i
--
-- Since $i$ and $j$ are, by assumption, distinct ordinals,
-- one of the two should belong to the other. However,
-- both possibilities have been discarded already, which
-- leads to the desired contradiction.
--
	(Stat1,Stat1*)ELEM ==> Ord(i) & Ord(j) & (i /= j)
(i,j)-->T31(Stat13*) ==> false; Discharge ==> QED
--
Theorem mutual_climbing3: ((X in om1_thryvar) & (Y in om2_thryvar)) imp ((X in Y) or (Y in X)). Proof+:
Suppose_not(x,y) ==> Stat1: (x in om1_thryvar) & (y in om2_thryvar) & (x notin y) & (y notin x)
 	Use_def(om1_thryvar)(Stat1*) ==> Stat2: x in {cdr(om_thryvar(k)): k in Za}
	Use_def(om2_thryvar)(Stat1*) ==> Stat3: y in {car(om_thryvar(k)): k in Za}
	k0-->Stat2(Stat2*) ==> Stat4: (x = cdr(om_thryvar(k0))) & (k0 in Za)
	k1-->Stat3(Stat3*) ==> Stat5: (y = car(om_thryvar(k1))) & (k1 in Za)
	Use_def(om_thryvar)(Stat3*) ==> Stat6: om_thryvar(k1) = [{cdr(om_thryvar(k)): k in k1}, {car(om_thryvar(k)): k in k1} + { {cdr(om_thryvar(k)): k in k1} }]
	(Stat6)ELEM ==> Stat7: car(om_thryvar(k1)) = {cdr(om_thryvar(k)): k in k1}
	Use_def(om_thryvar)(Stat3*) ==> Stat8: om_thryvar(k0) = [{cdr(om_thryvar(k)): k in k0}, {car(om_thryvar(k)): k in k0} + { {cdr(om_thryvar(k)): k in k0} }]
	(Stat8)ELEM ==> Stat9: cdr(om_thryvar(k0)) = {car(om_thryvar(k)): k in k0} + { {cdr(om_thryvar(k)): k in k0} }
	(Stat4,Stat5,Stat7,Stat9*)ELEM ==> Stat10: (x = {car(om_thryvar(k)): k in k0} + { {cdr(om_thryvar(k)): k in k0} }) &
	(y = {cdr(om_thryvar(k)): k in k1})
	Suppose ==> k0 = k1
		EQUAL(Stat10*) ==> Stat11: y = {cdr(om_thryvar(k)): k in k0}
	(Stat11,Stat10,Stat1*)ELEM ==> false; Discharge ==> Stat12: k0 /= k1
	Suppose ==> Stat13: k0 in k1
		(Stat1,Stat4,Stat10*)ELEM ==> Stat14: cdr(om_thryvar(k0)) notin {cdr(om_thryvar(k)): k in k1}
	k0-->Stat14(Stat13*) ==> false; Discharge ==> k0 notin k1
	Suppose ==> Stat15: k1 in k0
		(Stat1,Stat5,Stat10*)ELEM ==> Stat16: car(om_thryvar(k1)) notin {car(om_thryvar(k)): k in k0}
	k1-->Stat16(Stat15*) ==> false; Discharge ==> k1 notin k0
(k0,k1)-->T31(Stat3*) ==> false; Discharge ==> QED
--
Theorem mutual_climbing4: ((om1_thryvar * om2_thryvar) = 0) & (om1_thryvar /= om2_thryvar). Proof:
Suppose_not ==> AUTO
--
-- Reasoning by contradiction, assume that the negative of the assertion
-- of this theorem holds. We can discharge the negative of the first conjunct.
--
	Suppose ==> Stat1: (om1_thryvar * om2_thryvar) /= 0
		x-->Stat1(Stat1*) ==> (x in om1_thryvar) & (x in om2_thryvar)
	(x,x)-->Tmutual_climbing3(Stat1*) ==> false; Discharge ==> Stat2: ((om1_thryvar * om2_thryvar) = 0) & (om1_thryvar = om2_thryvar)
--
-- This yields that $om1_thryvar$ and $om2_thryvar$ are disjoint, but equal.
-- However, disjoint sets either of which is non-null, must differ; therefore,
-- if we prove $om2_thryvar /= 0$, a contradiction will ensue, as desired.
--
	Suppose ==> Stat3: om2_thryvar = 0
		Use_def(om2_thryvar)(Stat3*) ==> Stat4: {cdr(om_thryvar(k)): k in 0} notin {car(om_thryvar(k)): k in Za}
		T211(Stat4,Stat4*) ==> 0 in Za
		0-->Stat4(Stat4*) ==> Stat5: {cdr(om_thryvar(k)): k in 0} /= car(om_thryvar(0))
		Use_def(om_thryvar)(Stat3,Stat3*) ==> Stat6: om_thryvar(0) = [{cdr(om_thryvar(k)): k in 0}, {car(om_thryvar(k)): k in 0} + { {cdr(om_thryvar(k)): k in 0} }]
		(Stat6)ELEM ==> Stat7: car(om_thryvar(0)) = {cdr(om_thryvar(k)): k in 0}
	(Stat5,Stat7*)Discharge ==> om2_thryvar /= 0
(Stat2*)Discharge ==> QED
--
Theorem mutual_climbing5: (om1_thryvar notin om2_thryvar) & (om2_thryvar notin om1_thryvar). Proof+:
Suppose_not ==> AUTO
--
-- Reasoning by contradiction, assume the negative of the assertion at whose proof we are aiming.
-- Consider first the case $om1_thryvar in om2_thryvar$. A contradiction is reached as follows.
--
	Use_def(om1_thryvar)(*) ==> Stat1: om1_thryvar = {cdr(om_thryvar(k)): k in Za}
	Use_def(om2_thryvar)(*) ==> om2_thryvar = {car(om_thryvar(k)): k in Za}
	Suppose ==> om1_thryvar in om2_thryvar
		EQUAL(Stat1*) ==> Stat2: {cdr(om_thryvar(k)): k in Za} in {car(om_thryvar(k)): k in Za}
		k0-->Stat2(Stat2*) ==> Stat3: (k0 in Za) & ({cdr(om_thryvar(k)): k in Za} = car(om_thryvar(k0)))
		Use_def(om_thryvar)(Stat3*) ==> Stat4: om_thryvar(k0) = [{cdr(om_thryvar(k)): k in k0}, {car(om_thryvar(k)): k in k0} + { {cdr(om_thryvar(k)): k in k0} }]
		(Stat4)ELEM ==> car(om_thryvar(k0)) = {cdr(om_thryvar(k)): k in k0}
		(Stat3*)ELEM ==> Stat5: {cdr(om_thryvar(k)): k in Za} = {cdr(om_thryvar(k)): k in k0}
		k0-->T317(Stat3,Stat3*) ==> Stat6: next(k0) in Za
		Suppose ==> Stat7: cdr(om_thryvar(next(k0))) notin {cdr(om_thryvar(k)): k in Za}
		(next(k0))-->Stat7(Stat6) ==> false; Discharge ==> cdr(om_thryvar(next(k0))) in {cdr(om_thryvar(k)): k in Za}
		EQUAL(Stat5*) ==> Stat8: cdr(om_thryvar(next(k0))) in {cdr(om_thryvar(k)): k in k0}
		k1-->Stat8(Stat8*) ==> Stat9: (cdr(om_thryvar(next(k0))) = cdr(om_thryvar(k1))) & (k1 in k0)
		(k0,k1)-->T12(Stat3*) ==> Ord(k1)
		Use_def(next)(Stat9,Stat9*) ==> k1 /= next(k0)
	(next(k0),k1)-->Tmutual_climbing2(Stat3*) ==> false; Discharge ==> Stat10: om2_thryvar in om1_thryvar
--
-- Consider then the other case, namely $om2_thryvar in om1_thryvar$.
-- This can be treated in a way entirely analogous to the case considered above,
-- leading to a contradiction which proves the desired assertion.
--
	EQUAL(Stat1*) ==> Stat11: {car(om_thryvar(k)): k in Za} in {cdr(om_thryvar(k)): k in Za}
	k2-->Stat11(Stat11*) ==> Stat12: (k2 in Za) & ({car(om_thryvar(k)): k in Za} = cdr(om_thryvar(k2)))
	Use_def(om_thryvar)(Stat12*) ==> Stat13: om_thryvar(k2) = [{cdr(om_thryvar(k)): k in k2}, {car(om_thryvar(k)): k in k2} + { {cdr(om_thryvar(k)): k in k2} }]
	(Stat13)ELEM ==> cdr(om_thryvar(k2)) = {car(om_thryvar(k)): k in k2} + { {cdr(om_thryvar(k)): k in k2} }
	(Stat12*)ELEM ==> Stat14: {car(om_thryvar(k)): k in Za} = {car(om_thryvar(k)): k in k2} + { {cdr(om_thryvar(k)): k in k2} }
	k2-->T317(Stat12,Stat12*) ==> Stat15: next(k2) in Za
	Suppose ==> Stat16: car(om_thryvar(next(k2))) notin {car(om_thryvar(k)): k in Za}
	(next(k2))-->Stat16(Stat15) ==> false; Discharge ==> car(om_thryvar(next(k2))) in {car(om_thryvar(k)): k in Za}
	EQUAL(Stat14*) ==> Stat17: car(om_thryvar(next(k2))) in {car(om_thryvar(k)): k in k2} + { {cdr(om_thryvar(k)): k in k2} }
	Suppose ==> Stat18: car(om_thryvar(next(k2))) = {cdr(om_thryvar(k)): k in k2}
		Use_def(om_thryvar)(Stat17*) ==> Stat19: om_thryvar(next(k2)) = [{cdr(om_thryvar(k)): k in next(k2)}, {car(om_thryvar(k)): k in next(k2)} + { {cdr(om_thryvar(k)): k in next(k2)} }]
		(Stat19)ELEM ==> car(om_thryvar(next(k2))) = {cdr(om_thryvar(k)): k in next(k2)}
		Use_def(om_thryvar)(Stat17,Stat17*) ==> Stat20: om_thryvar(k2) = [{cdr(om_thryvar(k)): k in k2}, {car(om_thryvar(k)): k in k2} + { {cdr(om_thryvar(k)): k in k2} }]
		(Stat20)ELEM ==> Stat21: car(om_thryvar(k2)) = {cdr(om_thryvar(k)): k in k2}
		(Stat18*)ELEM ==> car(om_thryvar(next(k2))) = car(om_thryvar(k2))
		Use_def(next)(Stat18,Stat18) ==> next(k2) /= k2
	(next(k2),k2)-->Tmutual_climbing2(Stat12*) ==> false; Discharge ==> Stat22: car(om_thryvar(next(k2))) in {car(om_thryvar(k)): k in k2}
	k3-->Stat22(Stat22*) ==> Stat23: (car(om_thryvar(next(k2))) = car(om_thryvar(k3))) & (k3 in k2)
	(k2,k3)-->T12(Stat12*) ==> Ord(k3)
	Use_def(next)(Stat23,Stat23*) ==> k3 /= next(k2)
(next(k2),k3)-->Tmutual_climbing2(Stat15*) ==> false; Discharge ==> QED
--
Theorem mutual_climbing6: (Un(om1_thryvar) incin om2_thryvar) & (Un(om2_thryvar) incin om1_thryvar). Proof:
Suppose_not ==> AUTO
	Suppose ==> Stat1: not(Un(om1_thryvar) incin om2_thryvar)
		c-->Stat1(Stat1*) ==> Stat2: (c in Un(om1_thryvar)) & (c notin om2_thryvar)
		Use_def(Un)(Stat2*) ==> Stat3: c in {x: y in om1_thryvar, x in y}
		(d,e)-->Stat3(Stat3*) ==> (d in om1_thryvar) & (c in d)
		Use_def(om1_thryvar)(*) ==> Stat4: d in {cdr(om_thryvar(k)): k in Za}
		k1-->Stat4(Stat4*) ==> (k1 in Za) & (d = cdr(om_thryvar(k1)))
		Use_def(om_thryvar)(Stat4*) ==> Stat5: om_thryvar(k1) = [{cdr(om_thryvar(k)): k in k1}, {car(om_thryvar(k)): k in k1} + { {cdr(om_thryvar(k)): k in k1} }]
		(Stat5)ELEM ==> cdr(om_thryvar(k1)) = {car(om_thryvar(k)): k in k1} + { {cdr(om_thryvar(k)): k in k1} }
		(Stat3*)ELEM ==> c in ({car(om_thryvar(k)): k in k1} + { {cdr(om_thryvar(k)): k in k1} })
		Use_def(om2_thryvar)(Stat2,Stat2*) ==> Stat6: c notin {car(om_thryvar(k)): k in Za}
		Suppose ==> Stat7: c in {car(om_thryvar(k)): k in k1}
			k2-->Stat7(Stat7*) ==> (k2 in k1) & (c = car(om_thryvar(k2)))
			T206(*) ==> Ord(Za)
			(Za,k1)-->T13(Stat4*) ==> k2 in Za
		k2-->Stat6(Stat7*) ==> false; Discharge ==> c notin {car(om_thryvar(k)): k in k1}
		(Stat5*)ELEM ==> c = {cdr(om_thryvar(k)): k in k1}
		Use_def(om_thryvar)(Stat7*) ==> Stat8: om_thryvar(k1) = [{cdr(om_thryvar(k)): k in k1}, {car(om_thryvar(k)): k in k1} + { {cdr(om_thryvar(k)): k in k1} }]
		(Stat8)ELEM ==> car(om_thryvar(k1)) = {cdr(om_thryvar(k)): k in k1}
	k1-->Stat6(Stat4*) ==> false; Discharge ==> Stat9: not(Un(om2_thryvar) incin om1_thryvar)
	c1-->Stat9(Stat9*) ==> Stat10: (c1 in Un(om2_thryvar)) & (c1 notin om1_thryvar)
	Use_def(Un)(Stat10*) ==> Stat11: c1 in {x: y in om2_thryvar, x in y}
	(d1,e1)-->Stat11(Stat11*) ==> (d1 in om2_thryvar) & (c1 in d1)
	Use_def(om2_thryvar)(*) ==> Stat12: d1 in {car(om_thryvar(k)): k in Za}
	k3-->Stat12(Stat12*) ==> (k3 in Za) & (d1 = car(om_thryvar(k3)))
	Use_def(om_thryvar)(Stat4*) ==> Stat13: om_thryvar(k3) = [{cdr(om_thryvar(k)): k in k3}, {car(om_thryvar(k)): k in k3} + { {cdr(om_thryvar(k)): k in k3} }]
	(Stat13)ELEM ==> car(om_thryvar(k3)) = {cdr(om_thryvar(k)): k in k3}
	(Stat11*)ELEM ==> Stat14: c1 in {cdr(om_thryvar(k)): k in k3}
	Use_def(om1_thryvar)(Stat10,Stat10*) ==> Stat15: c1 notin {cdr(om_thryvar(k)): k in Za}
	k4-->Stat14(Stat14*) ==> (c1 = cdr(om_thryvar(k4))) & (k4 in k3)
	T206(*) ==> Ord(Za)
	(Za,k3)-->T13(Stat12*) ==> k4 in Za
k4-->Stat15(Stat15*) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY mutual_climbing
--
--THEORY mutual_climbing
--==>(om1_thryvar,om2_thryvar)
-- ((X in om1_thryvar) & (Y in om2_thryvar)) imp ((X in Y) or (Y in X))
-- ((om1_thryvar * om2_thryvar) = 0) & (om1_thryvar /= om2_thryvar)
-- (om1_thryvar notin om2_thryvar) & (om2_thryvar notin om1_thryvar)
-- (Un(om1_thryvar) incin om2_thryvar) & (Un(om2_thryvar) incin om1_thryvar)
--END mutual_climbing
--
--
--
THEORY twin_infinities(om1,om2)
	(FORALL x in om1, y in om2 | (x in y) or (y in x))
	om1 /= om2
	(om1 notin om2) & (om2 notin om1)
	(Un(om1) incin om2) & (Un(om2) incin om1)
END twin_infinities
--
ENTER_THEORY twin_infinities
--
Theorem twin_infinities1: not(Finite(om1 + om2)). Proof:
Suppose_not ==> AUTO
	(om1 + om2)-->T244 ==> Stat1: (EXISTS v | Finite(om1 + om2) imp ((((om1 + om2) = 0) or (v in (om1 + om2))) & ({y in ((om1 + om2)-{v}) | v in Ult_membs({y})} = 0)))
	v0-->Stat1(*) ==> (((om1 + om2) = 0) or (v0 in (om1 + om2))) & ({y in ((om1 + om2)-{v0}) | v0 in Ult_membs({y})} = 0)
	Assump ==> om1 /= om2
	(Stat1*)ELEM ==> Stat2: (v0 in (om1 + om2)) & ({y in ((om1 + om2)-{v0}) | v0 in Ult_membs({y})} = 0)
	Assump ==> Stat3: (FORALL x in om1, y in om2 | (x in y) or (y in x))
	Assump ==> (om1 notin om2) & (om2 notin om1)
	Assump ==> (Un(om1) incin om2) & (Un(om2) incin om1)
	Suppose ==> v0 in om1
		Suppose ==> Stat4: not(om2 incin v0)
			v1-->Stat4(Stat4*) ==> (v1 in om2) & (v1 notin v0)
			(v0,v1)-->Stat3(Stat2*) ==> (v0 in v1) & Stat5: (v1 notin {y in ((om1 + om2)-{v0}) | v0 in Ult_membs({y})})
			()-->Stat5(Stat4*) ==> v0 notin Ult_membs({v1})
			v1-->T18(Stat4*) ==> v0 notin Ult_membs(v1)
		v1-->T14(Stat4*) ==> false; Discharge ==> om2 incin v0
		(Stat3*)ELEM ==> Stat6: (om2 incin v0) & Stat7: (v0 /= om2)
		c1-->Stat7(Stat6*) ==> (c1 in v0) & (c1 notin om2)
		om1-->T274 ==> Stat8: (FORALL x in om1 | x incin Un(om1))
	v0-->Stat8(Stat3*) ==> false; Discharge ==> v0 notin om1
	(Stat2*)ELEM ==> v0 in om2
	Suppose ==> Stat9: not(om1 incin v0)
		v2-->Stat9(Stat9*) ==> (v2 in om1) & (v2 notin v0)
		(v2,v0)-->Stat3(Stat2*) ==> (v0 in v2) & Stat10: (v2 notin {y in ((om1 + om2)-{v0}) | v0 in Ult_membs({y})})
		()-->Stat10(Stat9*) ==> v0 notin Ult_membs({v2})
		v2-->T18(Stat9*) ==> v0 notin Ult_membs(v2)
	v2-->T14(Stat9*) ==> false; Discharge ==> om1 incin v0
	(Stat3*)ELEM ==> Stat11: (om1 incin v0) & Stat12: (v0 /= om1)
	c2-->Stat12(Stat11*) ==> (c2 in v0) & (c2 notin om1)
	om2-->T274 ==> Stat13: (FORALL x in om2 | x incin Un(om2))
v0-->Stat13(Stat3*) ==> false; Discharge ==> QED
--
Theorem twin_infinities2: not(Finite(om1) or Finite(om2)). Proof:
Suppose_not ==> AUTO
	Ttwin_infinities1 ==> Stat1: not(Finite(om1 + om2))
	(om1,om2)-->T236(Stat1*) ==> not(Finite(om1) & Finite(om2))
	Assump ==> Stat2: (Un(om1) incin om2) & (Un(om2) incin om1)
	Suppose ==> Stat3: Finite(om1)
		Suppose ==> Stat4: not(om2 incin pow(om1))
			c2-->Stat4(Stat4*) ==> (c2 in om2) & (c2 notin pow(om1))
			Use_def(pow) ==> Stat5: c2 notin {x: x incin om1}
			c2-->Stat5(Stat5*) ==> not(c2 incin om1)
			om2-->T274(Stat4*) ==> Stat6: (FORALL x in om2 | x incin Un(om2))
		c2-->Stat6(Stat2*) ==> false; Discharge ==> om2 incin pow(om1)
		om1-->T264(Stat3*) ==> Finite(pow(om1))
	(pow(om1),om2)-->T189(Stat1*) ==> false; Discharge ==> Stat7: Finite(om2)
	Suppose ==> Stat8: not(om1 incin pow(om2))
		c1-->Stat8(Stat8*) ==> (c1 in om1) & (c1 notin pow(om2))
		Use_def(pow) ==> Stat9: c1 notin {x: x incin om2}
		c1-->Stat9(Stat9*) ==> not(c1 incin om2)
		om1-->T274(Stat8*) ==> Stat10: (FORALL x in om1 | x incin Un(om1))
	c1-->Stat10(Stat2*) ==> false; Discharge ==> om1 incin pow(om2)
	om2-->T264(Stat7,Stat7*) ==> Finite(pow(om2))
(pow(om2),om1)-->T189(Stat1*) ==> false; Discharge ==> QED
--
Theorem twin_infinities3: (om1 * om2) = 0. Proof:
Suppose_not ==> Stat1: (om1 * om2) /= 0
--
-- Reasoning by contradiction, assume that the negative of the assertion
-- of this theorem holds. We can discharge the negative of the first conjunct.
--
	x-->Stat1(Stat1*) ==> (x in om1) & (x in om2)
	Assump ==> Stat2: (FORALL x in om1, y in om2 | (x in y) or (y in x))
(x,x)-->Stat2(Stat1*) ==> false; Discharge ==> QED
--
-- The following theorem could easily be deduced from the
-- fact, proved above, that $om1$ and $om2$ are infinite.
-- However, we opt for a direct proof.
--
Theorem twin_infinities4: (om1 /= 0) & (om2 /= 0). Proof:
Suppose_not ==> AUTO
	Assump ==> (om1 notin om2) & (om2 notin om1)
	Assump ==> Stat1: (Un(om1) incin om2) & (Un(om2) incin om1)
	Assump ==> Stat2: om1 /= om2
	c-->Stat2 ==> (c in om1) eq (c notin om2)
	Suppose ==> c in om1
		om1-->T274(Stat2,Stat2*) ==> Stat3: (FORALL x in om1 | x incin Un(om1))
		c-->Stat3(Stat1*) ==> c incin om2
	ELEM ==> false; Discharge ==> c in om2
	om2-->T274(Stat2,Stat2*) ==> Stat4: (FORALL x in om2 | x incin Un(om2))
	c-->Stat4(Stat1*) ==> c incin om1
ELEM ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY twin_infinities
--
--THEORY twin_infinities(om1,om2)
--	(FORALL x in om1, y in om2 | ((x in om1) & (y in om2)) imp ((x in y) or (y in x)))
--	om1 /= om2
--	(om1 notin om2) & (om2 notin om1)
--	(Un(om1) incin om2) & (Un(om2) incin om1)
--==>
--	not(Finite(om1) or Finite(om2))
--	(om1 * om2) = 0
--END twin_infinities
--
--PAUSE HERE ----------------------------------------------------------------------------------------------------
--
--BEGIN HERE ----------------------------------------------------------------------------------------------------
--
-- ************************************************************************************************
--			Section 20: Propositional satisfiability, Davis-Putnam satisfiability test, compactness
-- ************************************************************************************************
--
--
-- A toggling map is a single-valued map which is self-inverse and anti-diagonal.
--
Def 998: Is_tog(T) := Svm(T) & (inv(T) = T) & ({p in T | car(p) = cdr(p)} = 0)
--
Theorem 887: (Is_tog(T) & (X in domain(T))) imp (((T~[X]) /= X) & ((T~[T~[X]]) = X)). Proof:
Suppose_not(t0,x0) ==> AUTO
	Use_def(Is_tog) ==> Stat1: ({p in t0 | car(p) = cdr(p)} = 0) & Svm(t0) & (inv(t0) = t0) & (x0 in domain(t0)) & (not(((t0~[x0]) /= x0) & ((t0~[t0~[x0]]) = x0)))
	Use_def(Svm(t0)) ==> AUTO
	(t0,x0)-->T77 ==> AUTO
	(t0,x0,t0~[x0])-->T90(Stat1*) ==> Stat2: ([x0,t0~[x0]] in t0) & ([t0~[x0],x0] in t0)
	Suppose ==> x0 = t0~[x0]
		EQUAL(Stat2) ==> Stat3: [x0,x0] in t0
		TELEM ==> (car([x0,x0]) = x0) & (cdr([x0,x0]) = x0)
		([x0,x0])-->Stat1(Stat3*) ==> false
	Discharge ==> Stat4: x0 /= t0~[t0~[x0]]
	(t0,[t0~[x0],x0])-->T74(Stat1,Stat2*) ==> (t0~[car([t0~[x0],x0])]) = cdr([t0~[x0],x0])
	TELEM ==> (car([t0~[x0],x0]) = t0~[x0]) & (cdr([t0~[x0],x0]) = x0)
	EQUAL(Stat4) ==> false
	Discharge ==> QED
--
-- Every infinite set supports a toggling map.
--
Theorem 888: (not Finite(S)) imp (EXISTS f | Is_tog(f) & (domain(f) = S)). Proof:
Suppose_not(s0) ==> Stat1: (not (EXISTS t | Is_tog(t) & (domain(t) = s0))) & (not Finite(s0))
--
-- For, assume $s0$ to be a counterexample. Then a one-one correspondence
-- $f0$ between $s0 PROD {0,1}$ and $s0$ can be found. We obtain from it the
-- map $t0$ which puts into mutual correspondence those pairs $[v,w]$ in $s0 PROD s0$
-- which originate, as $f0$-images, from distinct pairs $[x,0],[x,1]$ in $s0 PROD {0,1}$
-- which share the same first component. It will turn out that $t0$ is a toggling map
-- for $s0$, contrary to the initial assumption that such a map does not exist.
--
	s0-->T362(*) ==> #(s0 PROD {0,1}) = #s0
	(s0,s0 PROD {0,1})-->T158(*) ==> Stat2: (EXISTS f in OM | one_1_map(f) & (range(f) = s0) & (domain(f) = s0 PROD {0,1}))
	f0-->Stat2(Stat2*) ==> one_1_map(f0) & (range(f0) = s0) & (domain(f0) = s0 PROD {0,1})
	Loc_def ==> Stat3: t0 = {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}
	TELEM ==> Is_map({[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)})
--
-- In order to see that $s0$ is the domain of $t0$, we momentarily assume that a witness $y0$
-- of the difference between $s0$ and the set ${cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}$
-- exists.
--
	Suppose ==> Stat4: domain({[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) /= s0
		TELEM ==> domain({[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) =
			{cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}
		y0-->Stat4(Stat4*) ==> Stat5: (y0 in {cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) neq (y0 in s0)
--
-- Suppose first that $y0$ belongs to $s0$, and let $[x0,b0]$ be the pair for which
-- $f0~[[x0,b0]] = y0$. Putting $b1=1 - b0$, we will have $[x0,b0]/=[x0,b1]$ and hence
-- $f0~[[x0,b0]] /= f0~[[x0,b1]]$ by one-one-ness. Therefore, $[[x0,b0],f0~[[x0,b0]]]$ and
-- $[[x0,b1],f0~[[x0,b1]]]$ are distinct pairs in $f0$ with $cdr([[x0,b0],f0~[[x0,b0]]])=y0$;
-- therefore $y0$ belongs to ${cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}$,
-- a contradiction.
--
		Use_def(one_1_map) ==> Stat6: (FORALL x in f0, y in f0 | (cdr(x) = cdr(y)) imp (x = y)) & Svm(f0)
		Use_def(Svm)(Stat6*) ==> Stat7: (FORALL x in f0, y in f0 | (car(x) = car(y)) imp (x = y)) & Is_map(f0)
		Suppose ==> y0 in s0
			f0-->T73(Stat2*) ==> Stat8: y0 in {f0~[x]: x in domain(f0)}
			p2-->Stat8(Stat2*) ==> (y0 = f0~[p2]) & (p2 in domain(f0)) & (p2 in s0 PROD {0,1})
			Use_def(PROD)(Stat8*) ==> Stat9: p2 in {[x,y]: x in s0, y in {0,1}}
			(x0,b0)-->Stat9(Stat9*) ==> (x0 in s0) & (b0 in {0,1}) & (p2 = [x0,b0])
			TELEM ==> Stat10: 1 = {0}
			Loc_def ==> b1 = 1 - b0
			(Stat10*)ELEM ==> Stat11: (b1 /= b0) & (b1 in {0,1})
			(Stat11)ELEM ==> [x0,b0] /= [x0,b1]
			Suppose ==> [x0,b1] notin domain(f0)
				(Stat2*)ELEM ==> Stat12: [x0,b1] notin s0 PROD {0,1}
				Use_def(PROD)(Stat12*) ==> Stat13: [x0,b1] notin {[x,y]: x in s0, y in {0,1}}
				(x0,b1)-->Stat13(Stat9*) ==> false
			Discharge ==> AUTO
			Suppose ==> [[x0,b0],f0~[[x0,b0]]] = [[x0,b1],f0~[[x0,b1]]]
				(f0,[x0,b0],[x0,b1])-->T127(Stat2*) ==> Stat14: f0~[[x0,b0]] /= f0~[[x0,b1]]
				TELEM ==> (cdr([[x0,b0],f0~[[x0,b0]]]) = f0~[[x0,b0]]) & (cdr([[x0,b1],f0~[[x0,b1]]]) = f0~[[x0,b1]])
				EQUAL(Stat11) ==> false
			Discharge ==> AUTO
			TELEM ==> cdr([[x0,b0],f0~[[x0,b0]]]) = f0~[[x0,b0]]
			EQUAL ==> ([x0,b0] in domain(f0)) & (y0 = cdr([[x0,b0],f0~[[x0,b0]]]))
			(f0,[x0,b0])-->T77(Stat7*) ==> [[x0,b0],f0~[[x0,b0]]] in f0
			(f0,[x0,b1])-->T77(Stat7*) ==> [[x0,b1],f0~[[x0,b1]]] in f0
			(Stat5*)ELEM ==> Stat15: y0 notin {cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}
			([[x0,b0],f0~[[x0,b0]]],[[x0,b1],f0~[[x0,b1]]])-->Stat15(Stat11*) ==> car(car([[x0,b0],f0~[[x0,b0]]])) /= car(car([[x0,b1],f0~[[x0,b1]]]))
			TELEM ==> (car(car([[x0,b0],f0~[[x0,b0]]])) = x0) & (car(car([[x0,b1],f0~[[x0,b1]]])) = x0)
		(Stat15*)Discharge ==> AUTO
--
-- To see that $y0$ cannot belong to ${cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}$
-- either, suppose that this is the case. But then $y0 = cdr(p0)$ holds for some $p0 in f0$, and therefore
-- $y0$ belongs to the range of $f0$, which is $s0$; again a contradiction.
--
		(Stat4*)ELEM ==> Stat16: y0 in {cdr(p): p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}
		(p0,q0)-->Stat16(Stat16*) ==> (p0 in f0) & (y0 = cdr(p0))
		(p0,f0)-->T61(Stat2*) ==> false
	Discharge ==> domain({[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) = s0
--
-- Next we check that the map $t0$ is single-valued.
--
	EQUAL ==> Stat17: Is_map(t0) & (domain(t0) = s0)
	t0-->Stat1(*) ==> (not Is_tog(t0))
	Use_def(Is_tog(t0)) ==> AUTO
	(Stat17*)ELEM ==> not(Svm(t0) & (inv(t0) = t0) & ({p in t0 | car(p) = cdr(p)} = 0))
	Suppose ==> not Svm(t0)
		Use_def(Svm)(Stat17*) ==> Stat18: not(FORALL x in t0, y in t0 | (car(x) = car(y)) imp (x = y))
		(p3,q3)-->Stat18(Stat18*) ==> (p3 in t0) & (q3 in t0) & (car(p3) = car(q3)) & (p3 /= q3)
		EQUAL ==> Stat19: (p3 in {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) & (q3 in {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)})
		(p4,q4,p5,q5)-->Stat19(Stat19*) ==> Stat20: (p3 = [cdr(p4),cdr(q4)]) & (p4 in f0) & (q4 in f0) & (car(car(p4)) = car(car(q4))) & (p4 /= q4) &
			(q3 = [cdr(p5),cdr(q5)]) & (p5 in f0) & (q5 in f0) & (car(car(p5)) = car(car(q5))) & (p5 /= q5)
		TELEM ==> (car([cdr(p4),cdr(q4)]) = cdr(p4)) & (car([cdr(p5),cdr(q5)]) = cdr(p5))
		EQUAL(Stat18) ==> cdr(p4) = cdr(p5)
		(p4,p5)-->Stat6(Stat18*) ==> p4 = p5
		EQUAL(Stat18) ==> (car(car(q4)) = car(car(q5))) & (q4 /= q5)
		(q4,q5)-->Stat7(Stat18*) ==> car(q4) /= car(q5)
		(q4,p4)-->Stat7(Stat18*) ==> car(q4) /= car(p4)
		(p5,q5)-->Stat7(Stat18*) ==> car(p5) /= car(q5)
		(q5,f0)-->T60(Stat18*) ==> car(q5) in domain(f0)
		(q4,f0)-->T60(Stat18*) ==> car(q4) in domain(f0)
		(p5,f0)-->T60(Stat18*) ==> car(p5) in domain(f0)
		(Stat2*)ELEM ==> Stat21: (car(q5) in s0 PROD {0,1}) & (car(q4) in s0 PROD {0,1}) & (car(p5) in s0 PROD {0,1})
		(s0 PROD {0,1},s0,{0,1})-->T141(Stat21*) ==> Is_map(s0 PROD {0,1})
		(s0 PROD {0,1},car(q5))-->T76(Stat21*) ==> car(q5) = [car(car(q5)),cdr(car(q5))]
		(s0 PROD {0,1},car(q4))-->T76(Stat21*) ==> car(q4) = [car(car(q4)),cdr(car(q4))]
		(s0 PROD {0,1},car(p5))-->T76(Stat21*) ==> car(p5) = [car(car(p5)),cdr(car(p5))]
		Suppose ==> cdr(car(q4)) = cdr(car(q5))
			EQUAL(Stat20) ==> cdr(car(q4)) /= cdr(car(q5))
		Discharge==> Stat22: cdr(car(q4)) /= cdr(car(q5))
		Suppose ==> cdr(car(q4)) = cdr(car(p5))
			EQUAL(Stat20) ==> false
		Discharge==> AUTO
		Suppose ==> cdr(car(p5)) = cdr(car(q5))
			EQUAL(Stat20) ==> false
		Discharge==> AUTO
		(car(q5),s0,{0,1})-->T140(Stat21,Stat21*) ==> cdr(car(q5)) in {0,1}
		(car(q4),s0,{0,1})-->T140(Stat21,Stat21*) ==> cdr(car(q4)) in {0,1}
		(car(p5),s0,{0,1})-->T140(Stat21,Stat21*) ==> cdr(car(p5)) in {0,1}
	(Stat22*)Discharge ==> AUTO
--
-- Next we check that $t0$ is self-inverse. Assuming the contrary, there
-- would be a pair $w0$ belonging to one of $t0,inv(t0)$ but not to the other.
-- A contradiction arises readily whichever of the two is assumed.
--
	Suppose ==> Stat23: inv(t0) /= t0
		w0-->Stat23(Stat23*) ==> (w0 in inv(t0)) eq (w0 notin t0)
		Use_def(inv(t0)) ==> AUTO
		EQUAL(Stat2) ==> inv(t0) = {[cdr(x),car(x)]: x in {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}}
		SIMPLF(Stat23*) ==> Stat24: inv(t0) = {[cdr([cdr(p),cdr(q)]),car([cdr(p),cdr(q)])]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}
		EQUAL(Stat2) ==> Stat25: (w0 in {[cdr([cdr(p),cdr(q)]),car([cdr(p),cdr(q)])]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) eq (w0 notin {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)})
		Suppose ==> Stat26: (w0 in {[cdr([cdr(p),cdr(q)]),car([cdr(p),cdr(q)])]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) & (w0 notin {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)})
			(p6,q6,q6,p6)-->Stat26(Stat26*) ==> false
		Discharge ==> AUTO
		(Stat25*)ELEM ==> Stat27: (w0 in {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) & (w0 notin {[cdr([cdr(p),cdr(q)]),car([cdr(p),cdr(q)])]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)})
		(p7,q7,q7,p7)-->Stat27(Stat27*) ==> false
	Discharge ==> Stat28: {p in t0 | car(p) = cdr(p)} /= 0
--
-- To complete the proof that $t0$ is a toggling map, we must check that $t0$ is anti-diagonal.
-- Assuming the contrary, there would be a pair $w1$ in $t0$ with equal components.
--
	w1-->Stat28(Stat3,Stat3*) ==> Stat29: (w1 in {[cdr(p),cdr(q)]: p in f0, q in f0 | (car(car(p)) = car(car(q))) & (p /= q)}) & (car(w1) = cdr(w1))
--
-- But then some pair $w1 in t0$ has coinciding components; however, this means that
-- distinct pairs in $f0$ have the same second component, contrary to the
-- one-one-ness of $f0$.
--
	(p1,q1)-->Stat29(Stat29*) ==> (p1 in f0) & (q1 in f0) & (w1 = [cdr(p1),cdr(q1)]) & (car(w1) = cdr(w1)) & (p1 /= q1)
	TELEM ==> (car([cdr(p1),cdr(q1)]) = cdr(p1)) & (cdr([cdr(p1),cdr(q1)]) = cdr(q1))
	EQUAL(Stat29) ==> cdr(p1) = cdr(q1)
	Use_def(one_1_map)(Stat2*) ==> Stat30: (FORALL x in f0, y in f0 | (cdr(x) = cdr(y)) imp (x = y))
	(p1,q1)-->Stat30(Stat29*) ==> false
	Discharge ==> QED
--
THEORY globalizeMap(t)
	Svm(t) & (range(t) incs domain(t))
END globalizeMap
--
ENTER_THEORY globalizeMap
--
Theorem globalizeMap1: Finite(t) imp ((range(t) = domain(t)) & (one_1_map(t))). Proof:
Suppose_not ==> AUTO
	Assump ==> Svm(t) & (range(t) incs domain(t))
	Suppose ==> range(t) /= domain(t)
		(domain(t),range(t))-->T170(*) ==> #domain(t) incin #range(t)
		t-->T171(*) ==> #domain(t) = #range(t)
		APPLY() finite_image(e(x)->cdr(x),s0->t) ==> Stat1: Finite({cdr(x): x in t})
		Use_def(range)(Stat1*) ==> Finite(range(t))
		(range(t),domain(t))-->T194(*) ==> false
	Discharge ==>  Stat2: Svm(t) & Finite(t) & (range(t) = domain(t)) & (not one_1_map(t))
	Use_def(one_1_map)(Stat2*) ==> Stat3: not(FORALL x in t, y in t | (cdr(x) = cdr(y)) imp (x = y))
	(v,w)-->Stat3(Stat3*) ==> Stat4: (v in t) & (w in t) & (cdr(v) = cdr(w)) & (v /= w)
--
-- Consider now the mapping $t - {v}$, whose single-valuedness and finiteness
-- are obvious.
--
	(t - {v},t)-->T53(Stat2,Stat2*) ==> Stat5: Svm(t - {v})
	(t,t - {v})-->T189(Stat2,Stat2*) ==> Finite(t - {v})
--
-- It is easily seen that $t - {v}$ has the same range as $t$,
-- and that its domain and range are the same set (so that $t - {v}$
-- is, like $t$, a permutation).
--
	Suppose ==> Stat6: range(t - {v}) /= range(t)
		(Stat4*)ELEM ==> Stat7: ((t - {v}) + {v}) = t
		(t - {v},{v})-->T79(Stat7*) ==> (range((t - {v}) + {v}) = (range(t - {v}) + range({v})))
		Use_def(range)(Stat8*) ==> Stat8: range({v}) = {cdr(x): x in {v}}
 		SIMPLF(Stat8) ==> range({v}) = {cdr(v)}
		Use_def(range)(Stat9*) ==> Stat9: range({w}) = {cdr(x): x in {w}}
		SIMPLF(Stat9) ==> Stat10: range({w}) = {cdr(w)}
		EQUAL(Stat4) ==> Stat11: range(t) = (range(t - {v}) + {cdr(w)})
	({w},t - {v})-->T65(Stat10,Stat11,Stat6,Stat4*) ==> false; Discharge ==> Stat12: range(t - {v}) = range(t)
	Suppose ==> Stat13: domain(t - {v}) /= range(t - {v})
		APPLY() finite_image(e(x)->cdr(x),s0->(t - {v})) ==>
			Stat14: Finite({cdr(x): x in (t - {v})})
		Use_def(range)(Stat14*) ==> Stat15: Finite(range(t - {v}))
		(t - {v},t)-->T65(Stat16*) ==> Stat16: domain(t - {v}) incin domain(t)
		(range(t - {v}))-->T195(Stat15*) ==> Stat17: (not(EXISTS f in OM | (Svm(f) & (range(f) = range(t - {v})) & (domain(f) incin range(t - {v})) & (range(t - {v}) /= domain(f)))))
	(t - {v})-->Stat17(Stat13,Stat16,Stat2,Stat12,Stat5*) ==> false; Discharge ==> Stat18: domain(t - {v}) = range(t - {v})
--
-- There is hence a pair in $t - {v}$ which shares the first component with $v$.
-- This implies that there are two pairs with the same first component in $t$,
-- which conflicts with the single-valuedness of $t$.
--
	Use_def(Svm)(Stat2,Stat2*) ==> Stat19: Is_map(t)
	Suppose ==> [car(v),(t - {v})~[car(v)]] notin (t - {v})
		Use_def(Svm)(Stat5,Stat5*) ==> Is_map(t - {v})
		(t - {v},car(v))-->T77(Stat19*) ==> Stat20: car(v) notin domain(t - {v})
		(Stat20,Stat18,Stat12,Stat2*)ELEM ==> car(v) notin domain(t)
		Use_def(domain)(Stat20*) ==> Stat21: car(v) notin {car(x): x in t}
	v-->Stat21(Stat4*) ==> false; Discharge ==> Stat22: [car(v),(t - {v})~[car(v)]] in (t - {v})
	(t,v)-->T76(Stat4,Stat19*) ==> (v = [car(v),cdr(v)]) & ([car(v),cdr(v)] in t)
	Use_def(Svm)(Stat2*) ==> Stat23: (FORALL x in t, y in t | (car(x) = car(y)) imp (x = y))
	([car(v),cdr(v)],[car(v),(t - {v})~[car(v)]])-->Stat23(Stat22*) ==> Stat24: car([car(v),cdr(v)]) /= car([car(v),(t - {v})~[car(v)]])
--
-- This contradiction leads us to the desired result.
--
	(Stat24)Discharge ==> QED
Theorem globalizeMap2: (EXISTS o | Ord(o) & (1 in o) & (domain(t) incin cumstr(0,o)) & (not Finite(cumstr(0,o) - domain(t)))). Proof:
Suppose_not ==> Stat1: not(EXISTS o | Ord(o) & (1 in o) & (domain(t) incin cumstr(0,o)) & (not Finite(cumstr(0,o) - domain(t))))
	(cumstr(0,rk({snglIter(n,domain(t)): n in Za})),domain(t))-->T874(*) ==> (domain(t) incin cumstr(0,rk({snglIter(n,domain(t)): n in Za}))) & (not Finite(cumstr(0,rk({snglIter(n,domain(t)): n in Za})) - domain(t))) & (1 in rk(cumstr(0,rk({snglIter(n,domain(t)): n in Za}))))
	({snglIter(n,domain(t)): n in Za})-->T854(*) ==> Ord(rk({snglIter(n,domain(t)): n in Za}))
	(rk({snglIter(n,domain(t)): n in Za}))-->T871(*) ==> rk(cumstr(0,rk({snglIter(n,domain(t)): n in Za}))) = rk({snglIter(n,domain(t)): n in Za})
	Loc_def ==> o = rk({snglIter(n,domain(t)): n in Za})
	EQUAL ==> Ord(o)
	o-->T856(*) ==> o = rk(o)
	EQUAL ==> (rk(cumstr(0,o)) = o) & (1 in o) & (domain(t) incin cumstr(0,o)) & (not Finite(cumstr(0,o) - domain(t)))
	o-->Stat1(Stat1*) ==> false
	Discharge ==> QED
--
	APPLY(v1_thryvar:rk_thryvar) Skolem() ==>
Theorem globalizeMap3: Ord(rk_thryvar) & (1 in rk_thryvar) & (domain(t) incin cumstr(0,rk_thryvar)) & (not Finite(cumstr(0,rk_thryvar) - domain(t)))
--
Theorem globalizeMap4: (EXISTS tp | Is_tog(tp) & (domain(tp) = cumstr(0,rk_thryvar) - domain(t))). Proof:
Suppose_not ==> AUTO
	TglobalizeMap3(*) ==> (not Finite(cumstr(0,rk_thryvar) - domain(t)))
	(cumstr(0,rk_thryvar) - domain(t))-->T888(*) ==> false
	Discharge ==> QED
--
	APPLY(v1_thryvar:tg_thryvar) Skolem() ==>
Theorem globalizeMap5:  Is_tog(tg_thryvar) & (domain(tg_thryvar) = cumstr(0,rk_thryvar) - domain(t))
--
--
--
Def globalizeMap0: [formal negative] togg_thryvar(X) := ((X - 1) + (1 - X))
--
--
--
Theorem globalizeMap6: [alternative characterization of formal negative, via toggling; symmetry and irreflexivity of toggling] ((((X - 1) = (Y - 1)) & ((X * 1) = (1 - Y))) eq (Y = togg_thryvar(X))) & ((((X - 1) = (Y - 1)) & ((X * 1) = (1 - Y))) imp ((((Y - 1) = (X - 1)) & ((Y * 1) = (1 - X))) & (X /= Y))). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(togg_thryvar(x)) ==> AUTO
	EQUAL ==> Stat1: not(((((x - 1) = (y - 1)) & ((x * 1) = (1 - y))) eq (y = ((x - 1) + (1 - x)))) & ((((x - 1) = (y - 1)) & ((x * 1) = (1 - y))) imp ((((y - 1) = (x - 1)) & ((y * 1) = (1 - x))) & (x /= y))))
	TELEM ==> 1 /= 0
	(Stat1*)ELEM ==> false; Discharge ==> QED
--
--
--
Theorem globalizeMap7: [double negation affirms] (togg_thryvar(togg_thryvar(X)) = X) & (togg_thryvar(X) /= X). Proof:
Suppose_not(x) ==> AUTO
	Use_def(togg_thryvar(x)) ==> AUTO
	TELEM ==> (1 /= 0)
	ELEM ==> togg_thryvar(togg_thryvar(x)) /= x
	Use_def(togg_thryvar(togg_thryvar(x))) ==> AUTO
	EQUAL ==> Stat1: ((((x - 1) + (1 - x)) - 1) + (1 - ((x - 1) + (1 - x)))) /= x
	(Stat1*)Discharge ==> QED
--
--
--
Theorem globalizeMap8: [negation of special sets] (togg_thryvar(0) = 1) & (togg_thryvar(1) = 0) & (togg_thryvar({{X,Y}}) = {0,{X,Y}}) & ((X /= 0) imp (togg_thryvar({0,X}) = {X})). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(togg_thryvar(0)) ==> AUTO
	Use_def(togg_thryvar(1)) ==> AUTO
	TELEM ==> Stat1: 1 = {0}
	Suppose ==> (x /= 0) & (togg_thryvar({0,x}) /= {x})
	Use_def(togg_thryvar)(Stat1*) ==> false; Discharge ==> Stat2: togg_thryvar({{x,y}}) /= {0,{x,y}}
	Use_def(togg_thryvar)(Stat1*) ==> false; Discharge ==> QED
--
-- The following theorem shows that, beyond a very low threshold,
-- a specific toggling operator preserves rank.
--
Theorem globalizeMap9: [global toggling preserves rank] (1 in rk(X)) imp (rk(X) = rk((X - 1) + (1 - X))). Proof:
Suppose_not(x0) ==> AUTO
	T211(*) ==> Card(1)
	Use_def(Card) ==> Ord(1)
	1-->T856(*) ==> Stat1: (1 = rk(1)) & (rk(1) in rk(x0))
	x0-->T854(Stat1*) ==> Ord(rk(x0))
	(rk(x0),rk(1))-->T13(Stat1*) ==> rk(1) incin rk(x0)
	ELEM ==> rk(x0) /= rk((x0 - 1) + (1 - x0))
	Suppose ==> Stat2: 1 incin x0
		(Stat2*)ELEM ==>  (1 + (x0 - 1) = x0) & ((x0 - 1) + (1 - x0) = x0 - 1)
		(1,x0-1)-->T850(*) ==> rk(1 + (x0 - 1)) = rk(1) + rk(x0 - 1)
		EQUAL(Stat2) ==> Stat3: rk(x0) = rk(1) + rk(x0 - 1)
		EQUAL ==> (rk(x0) /= rk(x0 - 1)) & Ord(rk(1))
		(Stat3*)ELEM ==> rk(1) nincin rk(x0 - 1)
		(x0 - 1)-->T854(Stat1*) ==> Ord(rk(x0 - 1))
--
-- Of the two ordinals $rk(1),rk(x0 - 1)$ one must include the other,
-- but inclusion in one direction would imply $rk(x0) = rk(1)$ and hence
-- $rk(x0) in rk(1)$; inclusion in the opposite direction conflicts with
-- $rk(x0) /= rk(x0 - 1)$.
--
		(rk(1),rk(x0 - 1))-->T29(Stat1*) ==> false
	Discharge ==> Stat4: 1 nincin x0
	TELEM ==> 1 = {0}
	(Stat4*)ELEM ==> ((x0 - 1) = x0) & ((1 - x0) = 1)
	EQUAL ==> rk(x0) /= rk(x0 + 1)
	(x0,1)-->T850(Stat4*) ==> rk(x0) /= rk(x0) + rk(1)
	(Stat1*)Discharge ==> QED
--
Def globalizeMap1: qtog_thryvar(X) := if X in domain(t) then (t~[X]) elseif X in cumstr(0,rk_thryvar) then (tg_thryvar~[X]) else ((X - 1) + (1 - X)) end if
--
Theorem globalizeMap10: (X in domain(t)) imp (qtog_thryvar(X) = t~[X]). Proof:
Suppose_not(x0) ==> AUTO
	Use_def(qtog_thryvar) ==> false
	Discharge ==> QED
--
Theorem globalizeMap11: (X notin range(t)) imp ((qtog_thryvar(X) /= X) & (qtog_thryvar(qtog_thryvar(X)) = X)). Proof:
Suppose_not(x0) ==> Stat1: (x0 notin range(t)) & (not((qtog_thryvar(x0) /= x0) & (qtog_thryvar(qtog_thryvar(x0)) = x0)))
	Assump ==> Stat2: Svm(t) & (range(t) incs domain(t))
	(Stat1*)ELEM ==> (not(x0 in domain(t)))
	Use_def(qtog_thryvar(x0)) ==> AUTO
	Suppose ==> x0 in cumstr(0,rk_thryvar)
		(Stat2*)ELEM ==> Stat3: qtog_thryvar(x0) = (tg_thryvar~[x0])
		Use_def(Is_tog(tg_thryvar)) ==> AUTO
		TglobalizeMap5(Stat2) ==> Stat4: (domain(tg_thryvar) = cumstr(0,rk_thryvar) - domain(t)) & (x0 in domain(tg_thryvar)) &
				Is_tog(tg_thryvar) & Svm(tg_thryvar) & (inv(tg_thryvar) = tg_thryvar)
		EQUAL(Stat2) ==> domain(inv(tg_thryvar)) = domain(tg_thryvar)
		Use_def(Svm(tg_thryvar)) ==> AUTO
		(tg_thryvar,x0,tg_thryvar~[x0])-->T90 ==> AUTO
		(tg_thryvar,x0)-->T77 ==> AUTO
		TELEM ==> car([tg_thryvar~[x0],x0]) = tg_thryvar~[x0]
		([tg_thryvar~[x0],x0],inv(tg_thryvar))-->T60(Stat2*) ==> Stat5: (tg_thryvar~[x0]) in domain(tg_thryvar)
		(Stat4,Stat5*)ELEM ==> Stat6: ((tg_thryvar~[x0]) in cumstr(0,rk_thryvar)) & (not((tg_thryvar~[x0]) in domain(t)))
		Use_def(qtog_thryvar(tg_thryvar~[x0])) ==> AUTO
		(Stat6*)ELEM ==> qtog_thryvar(tg_thryvar~[x0]) = (tg_thryvar~[tg_thryvar~[x0]])
		EQUAL(Stat2) ==> qtog_thryvar(qtog_thryvar(x0)) = (tg_thryvar~[tg_thryvar~[x0]])
		(tg_thryvar,x0)-->T887(Stat4*) ==> (tg_thryvar~[x0] /= x0) & (tg_thryvar~[tg_thryvar~[x0]] = x0)
		EQUAL(Stat3) ==> Stat7: (qtog_thryvar(x0) /= x0) & (qtog_thryvar(qtog_thryvar(x0)) = x0)
	(Stat1,Stat7*)Discharge ==> Stat8: x0 notin cumstr(0,rk_thryvar)
	ELEM ==> qtog_thryvar(x0) = (x0 - 1) + (1 - x0)
	TglobalizeMap3(Stat8*) ==> Stat9: Ord(rk_thryvar) & (1 in rk_thryvar)
	T211 ==> Ord(0) & Card(1)
	Use_def(Card) ==> Ord(1)
	(1,rk_thryvar,x0)-->T872(Stat8*) ==> 1 in rk(x0)
	x0-->TglobalizeMap9(Stat8*) ==> rk(x0) = rk((x0 - 1) + (1 - x0))
	Suppose ==> Stat10: ((x0 - 1) + (1 - x0)) in cumstr(0,rk_thryvar)
		(rk((x0 - 1) + (1 - x0)),(x0 - 1) + (1 - x0))-->T867(Stat10*) ==> ((x0 - 1) + (1 - x0)) in (cumstr(0,next(rk((x0 - 1) + (1 - x0)))) - cumstr(0,rk((x0 - 1) + (1 - x0))))
		EQUAL(Stat9) ==> ((x0 - 1) + (1 - x0)) in (cumstr(0,next(rk(x0))) - cumstr(0,rk(x0)))
		x0-->T854(Stat10*) ==> Ord(rk(x0))
		Suppose ==> not(cumstr(0,next(rk(x0))) incin cumstr(0,rk_thryvar))
			(rk(x0))-->T32(Stat10*) ==> Ord(next(rk(x0)))
			(next(rk(x0)),rk_thryvar)-->T29(Stat9*) ==> (next(rk(x0)) incin rk_thryvar) or (rk_thryvar incin next(rk(x0)))
			Suppose ==> next(rk(x0)) incin rk_thryvar
				(Stat10*)ELEM ==> rk_thryvar = next(rk(x0)) + rk_thryvar
				(0,next(rk(x0)),rk_thryvar)-->T859(Stat10*) ==> cumstr(0,next(rk(x0))) incin cumstr(0,next(rk(x0)) + rk_thryvar)
				EQUAL(Stat10) ==> false
			Discharge ==> (rk_thryvar incin next(rk(x0))) & (rk_thryvar /= next(rk(x0)))
			(next(rk(x0)),rk_thryvar)-->T34(Stat9*) ==> rk_thryvar in next(rk(x0))
			(rk(x0),rk_thryvar)-->T36(Stat10*) ==> Stat11: rk_thryvar incin rk(x0)
			(0,rk_thryvar,rk(x0))-->T859(Stat11*) ==> cumstr(0,rk_thryvar) incin cumstr(0,rk_thryvar + rk(x0))
			(Stat11*)ELEM ==> rk_thryvar + rk(x0) = rk(x0)
			EQUAL(Stat11) ==> cumstr(0,rk_thryvar) incin cumstr(0,rk(x0))
			(Stat10*)ELEM ==> false
		Discharge ==> cumstr(0,next(rk(x0))) incin cumstr(0,rk_thryvar)
		(rk(x0),x0)-->T867(Stat8*) ==> false
	Discharge ==> AUTO
	Suppose ==> ((x0 - 1) + (1 - x0)) in domain(t)
	TglobalizeMap3 ==> false; Discharge ==> AUTO
	Use_def(qtog_thryvar((x0 - 1) + (1 - x0))) ==> AUTO
	(Stat8*)ELEM ==> qtog_thryvar((x0 - 1) + (1 - x0)) = x0
	TELEM ==> Stat12: 1 /= 0
	(Stat12*)ELEM ==> ((x0 - 1) + (1 - x0)) /= x0
	EQUAL(Stat8) ==> (qtog_thryvar(qtog_thryvar(x0)) = x0) & (qtog_thryvar(x0) /= x0)
	(Stat1*)Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--
-- DISPLAY globalizeMap
--
-- THEORY globalizeMap(t)
--	Svm(t) & (range(t) incs domain(t))
-- ==>(togg_thryvar,qtog_thryvar)
--	Finite(t) imp ((range(t) = domain(t)) & (one_1_map(t)))
--	(FORALL x | togg_thryvar(x) = ((x - 1) + (1 - x)))
--	(FORALL x, y | ((((x - 1) = (y - 1)) & ((x * 1) = (1 - y))) eq (y = togg_thryvar(x))) & ((((x - 1) = (y - 1)) & ((x * 1) = (1 - y))) imp ((((y - 1) = (x - 1)) & ((y * 1) = (1 - x))) & (x /= y))))
--	(FORALL x | (togg_thryvar(togg_thryvar(x)) = x) & (togg_thryvar(x) /= x))
--	(FORALL x,y | (togg_thryvar(0) = 1) & (togg_thryvar(1) = 0) & (togg_thryvar({{x,y}}) = {0,{x,y}}) & ((x /= 0) imp (togg_thryvar({0,x}) = {x})))
--	(FORALL x | (1 in rk(x)) imp (rk(x) = rk((x - 1) + (1 - x))))
--	(FORALL x | (x in domain(t)) imp (qtog_thryvar(x) = t~[x]))
--	(FORALL x | (x notin range(t)) imp ((qtog_thryvar(x) /= x) & (qtog_thryvar(qtog_thryvar(x)) = x)))
-- END globalizeMap
--
THEORY globalizeTog(t)
	Is_tog(t)
END globalizeTog
--
--
ENTER_THEORY globalizeTog
--
Theorem globalizeTog0: Svm(t) & (range(t) = domain(t)). Proof:
Suppose_not ==> AUTO
	Assump ==> Is_tog(t)
	Use_def(Is_tog) ==> Svm(t) & (inv(t) = t)
	EQUAL ==> domain(inv(t)) = domain(t)
	t-->T99(*) ==> false
	Discharge ==> QED
--
	APPLY(qtog_thryvar:tog_thryvar) globalizeMap(t->t) ==>
Theorem globalizeTog1: (FORALL x | (x in domain(t)) imp (tog_thryvar(x) = t~[x])) &
	(FORALL x | (x notin range(t)) imp ((tog_thryvar(x) /= x) & (tog_thryvar(tog_thryvar(x)) = x)))
--
Theorem globalizeTog2: (tog_thryvar(X) /= X) & (tog_thryvar(tog_thryvar(X)) = X). Proof:
Suppose_not(x0) ==> AUTO
	TglobalizeTog1 ==> Stat1: (FORALL x | (x in domain(t)) imp (tog_thryvar(x) = t~[x])) &
		Stat2: (FORALL x | (x notin range(t)) imp ((tog_thryvar(x) /= x) & (tog_thryvar(tog_thryvar(x)) = x)))
	TglobalizeTog0 ==> range(t) = domain(t)
	x0-->Stat2(*) ==> (x0 in domain(t)) & (not(tog_thryvar(x0) /= x0) & (tog_thryvar(tog_thryvar(x0)) = x0))
	x0-->Stat1(Stat1*) ==> tog_thryvar(x0) = t~[x0]
	(x0,t)-->T71(Stat1*) ==> (t~[x0]) in range(t)
	(t~[x0])-->Stat1(Stat1*) ==> tog_thryvar(t~[x0]) = t~[t~[x0]]
	Assump ==> Is_tog(t)
	(t,x0)-->T887(Stat1*) ==> ((t~[x0]) /= x0) & ((t~[t~[x0]]) = x0)
	EQUAL(Stat1) ==> (tog_thryvar(x0) /= x0) & (tog_thryvar(tog_thryvar(x0)) = x0)
	(Stat1*)Discharge ==> QED
--
-- DISPLAY globalizeTog
--
-- THEORY globalizeTog(t)
--	Is_tog(t)
-- ==>(tog_thryvar)
--	(FORALL x | (x in domain(t)) imp (tog_thryvar(x) = t~[x]))
--	(FORALL x | (tog_thryvar(x) /= x) & (tog_thryvar(tog_thryvar(x)) = x))
-- END globalizeTog
--
--
--
Theorem 889: Svm(0) & (range(0) incs domain(0)). Proof:
Suppose_not ==> AUTO
T59 ==> false; Discharge ==> QED
--
	APPLY(togg_thryvar:togg) globalizeMap(t->0) ==>
Theorem 890: (FORALL x | togg(x) = ((x - 1) + (1 - x))) &
	(FORALL x | (togg(togg(x)) = x) & (togg(x) /= x)) &
	(FORALL x | (1 in rk(x)) imp (rk(x) = rk((x - 1) + (1 - x)))) &
	(FORALL x, y | (togg(0) = 1) & (togg(1) = 0) & (togg({{x,y}}) = {0,{x,y}}) & ((x /= 0) imp (togg({0,x}) = {x})))
--
Theorem 891: [specification of formal negative] togg(X) = ((X - 1) + (1 - X)). Proof:
Suppose_not(x) ==> AUTO
	T890(*) ==> Stat1: (FORALL x | togg(x) = ((x - 1) + (1 - x)))
	x-->Stat1(*) ==> false
	Discharge ==> QED
--
Theorem 892: [formal negative and affirmative have the same rank] (1 in rk(X)) imp (rk(X) = rk((X - 1) + (1 - X))). Proof:
Suppose_not(x) ==> AUTO
	T890(*) ==> Stat1: (FORALL x | (1 in rk(x)) imp (rk(x) = rk((x - 1) + (1 - x))))
	x-->Stat1(*) ==> false
	Discharge ==> QED
--
Theorem 893: [double negation affirms] (togg(togg(X)) = X) & (togg(X) /= X). Proof:
Suppose_not(x) ==> AUTO
	T890(*) ==> Stat1: (FORALL x | (togg(togg(x)) = x) & (togg(x) /= x))
	x-->Stat1(*) ==> false
	Discharge ==> QED
--
--
--
Theorem 894: [negation of special sets] (togg(0) = 1) & (togg(1) = 0) & (togg({{X,Y}}) = {0,{X,Y}}) & ((X /= 0) imp (togg({0,X}) = {X})). Proof:
Suppose_not(x,y) ==> AUTO
	T890(*) ==> Stat1: (FORALL x, y | (togg(0) = 1) & (togg(1) = 0) & (togg({{x,y}}) = {0,{x,y}}) & ((x /= 0) imp (togg({0,x}) = {x})))
	(x,y)-->Stat1(*) ==> false
	Discharge ==> QED
--
--
--
Def 15003: [literals associated with any set $C$, viewed as an alphabet] signedSymbs(C) := {b + {{g}} : b incin 1, g in C}
--
Def 15004: [atomic symbol underlying a literal] atm(X) := arb(arb(X - 1))
--
--
--
Theorem 895: [unsigned symbol retrieval from literal] (B incin 1) imp (atm(B + {{G}}) = G). Proof:
Suppose_not(b,g) ==> AUTO
	Use_def(atm)(*) ==> Stat1: (arb(arb((b + {{g}}) - 1)) /= g) & (b incin 1)
	TELEM ==> 1 = {0}
	(Stat1*)ELEM ==> Stat2: (b = 0) or (b = {0})
	Suppose ==> Stat3: ((b + {{g}}) - {0}) /= {{g}}
		(Stat2*)ELEM ==> b = {0}
		EQUAL(Stat3) ==> Stat4: (({0} + {{g}}) - {0}) /= {{g}}
	(Stat4*)Discharge ==> ((b + {{g}}) - {0}) = {{g}}
	EQUAL(Stat1) ==> Stat5: arb(arb({{g}})) /= g
	(Stat5)Discharge ==> QED
--
--
--
Theorem 896:  [sign removal from literal] (atm(togg(X)) = atm(X)) & ((X in signedSymbs(C)) imp (atm(X) in C)). Proof:
Suppose_not(x,c) ==> AUTO
	Suppose ==> atm(togg(x)) /= atm(x)
		Use_def(atm)(*) ==> arb(arb(togg(x) - 1)) /= arb(arb(x - 1))
		x-->T891(*) ==> togg(x) = ((x-1)+(1-x))
		EQUAL ==> arb(arb(((x-1)+(1-x)) - 1)) /= arb(arb(x - 1))
		TELEM ==> (((x-1)+(1-x)) - 1) = x - 1
	EQUAL ==> false; Discharge ==> (x in signedSymbs(c)) & (atm(x) notin c)
	Use_def(signedSymbs)(*) ==> Stat1: x in {b + {{g}} : b incin 1, g in c}
	(b,g)-->Stat1(Stat1*) ==> Stat2: (b incin 1) & (g in c) & (x = b + {{g}})
	EQUAL ==> atm(b + {{g}}) notin c
	(b,g)-->T895(Stat2*) ==> false
	Discharge ==> QED
--
--
--
Theorem 897: [equal literals share the same atom] (((B + {H}) = (D + {K})) & (B in {0,{0}}) & (K /= 0)) imp (H = K). Proof:
Suppose_not(b,h,d,k) ==> AUTO
	Discharge ==> QED
--
--
--
Theorem 898: [literals associated with a singleton alphabet] (signedSymbs(0) = 0) & (signedSymbs({G}) = {{{G}},togg({{G}})}). Proof:
Suppose_not(gp) ==> AUTO
	Suppose ==> Stat1: signedSymbs(0) /= 0
		Use_def(signedSymbs)(Stat1*) ==> Stat2: {b + {{g}} : b incin 1, g in 0} /= 0
	(b0,g0)-->Stat2(Stat2*) ==> false; Discharge ==> Stat3: signedSymbs({gp}) /= {{{gp}},togg({{gp}})}
	(gp,gp)-->T894(Stat3*) ==> togg({{gp,gp}}) = {0,{gp,gp}}
	TELEM ==> {gp,gp} = {gp}
	EQUAL ==> togg({{gp}}) = {0,{gp}}
	EQUAL(Stat3) ==> signedSymbs({gp}) /= {{{gp}},{0,{gp}}}
	Use_def(signedSymbs) ==> Stat4: {b + {{g}} : b incin 1, g in {gp}} /= {{{gp}},{0,{gp}}}
	c-->Stat4(Stat4*) ==> (c in {b + {{g}} : b incin 1, g in {gp}}) eq (c notin {{{gp}},{0,{gp}}})
	TELEM ==> 1 = {0}
	EQUAL(Stat4) ==> Stat5: (c in {b + {{g}} : b incin {0}, g in {gp}}) eq (c notin {{{gp}},{0,{gp}}})
	Suppose ==> Stat6: c in {b + {{g}} : b incin {0}, g in {gp}}
		(b,g)-->Stat6(Stat5*) ==> (c = b + {{g}}) & (b in {0,{0}}) & (g = gp) & (c notin {{{gp}},{0,{gp}}})
		Suppose ==> b = 0
		(Stat6*)Discharge ==> b /= 0
	(Stat6*)Discharge ==> (c in {{{gp}},{0,{gp}}}) & Stat7: (c notin {b + {{g}} : b incin {0}, g in {gp}})
	Suppose ==> Stat8: c = {{gp}}
	(0,gp)-->Stat7(Stat8*) ==> false; Discharge ==> Stat9: c = {0,{gp}}
	({0},gp)-->Stat7(Stat9*) ==> false
	Discharge ==> QED
--
--
--
Theorem 899: [literals over disjoint alphabets] ((C * D) = 0) imp (((signedSymbs(C) * signedSymbs(D)) = 0) & ((signedSymbs(C) + signedSymbs(D)) = signedSymbs(C + D))). Proof:
Suppose_not(c,d) ==> AUTO
    	Suppose ==> (signedSymbs(c) * signedSymbs(d)) /= 0
		Use_def(signedSymbs)(*) ==> Stat1: (({b + {{g}} : b incin 1, g in c} * {b + {{g}} : b incin 1, g in d}) /= 0) & ((c * d) = 0)
		h-->Stat1(Stat1*) ==> Stat2: (h in {b + {{g}} : b incin 1, g in c}) & (h in {b + {{g}} : b incin 1, g in d})
		TELEM ==> 1 = {0}
		(b,g,bp,gp)-->Stat2(Stat2*) ==> Stat3: ((b + {{g}}) = (bp + {{gp}})) & (b in {0,{0}}) & (g in c) & (gp in d)
--
-- However, this yields that $g = gp$, contradicting the disjointness of $c,d$.
--
	(b,{g},bp,{gp})-->T897(Stat1*) ==> false; Discharge ==> Stat4: (signedSymbs(c) + signedSymbs(d)) /= signedSymbs(c + d)
	Use_def(signedSymbs)(Stat4*) ==> Stat5: (({b + {{g}} : b incin 1, g in c} + {b + {{g}} : b incin 1, g in d}) /= {b + {{g}} : b incin 1, g in (c + d)}) & ((c * d) = 0)
	e-->Stat5(Stat5*) ==> Stat6: ((e in {b + {{g}} : b incin 1, g in c}) or (e in {b + {{g}} : b incin 1, g in d})) eq (e notin {b + {{g}} : b incin 1, g in (c + d)})
        Suppose ==> Stat7: e in {b + {{g}} : b incin 1, g in c}
		(b1,g1)-->Stat7(Stat6*) ==> Stat8: (b1 incin 1) & (g1 in c) & Stat9: ((b1 + {{g1}}) notin {b + {{g}} : b incin 1, g in (c + d)})
	(b1,g1)-->Stat9(Stat8*) ==> false; Discharge ==> Stat10: e notin {b + {{g}} : b incin 1, g in c}
        Suppose ==> Stat11: e in {b + {{g}} : b incin 1, g in d}
		(b2,g2)-->Stat11(Stat5*) ==> Stat12: (b2 incin 1) & (g2 in d) & Stat13: ((b2 + {{g2}}) notin {b + {{g}} : b incin 1, g in (c + d)})
	(b2,g2)-->Stat13(Stat12*) ==> false; Discharge ==> e notin {b + {{g}} : b incin 1, g in d}
	(Stat5*)ELEM ==> Stat14: (e in {b + {{g}} : b incin 1, g in (c + d)})
	(b3,g3)-->Stat14(Stat10*) ==> Stat15: (b3 incin 1) & (g3 in (c + d)) & Stat16: ((b3 + {{g3}}) notin {b + {{g}} : b incin 1, g in c}) & Stat17: (b3 + {{g3}} notin {b + {{g}} : b incin 1, g in d})
	Suppose ==> g3 in c
	(b3,g3)-->Stat16(Stat15*) ==> false; Discharge ==> g3 in d
	(b3,g3)-->Stat17(Stat15*) ==> false
	Discharge ==> QED
--
--
--
Theorem 900: [decomposition of the set of all literals over a nonnull set] (C /= 0) imp (signedSymbs(C) = {{{arb(C)}},togg({{arb(C)}})} + signedSymbs(C - {arb(C)})). Proof:
Suppose_not(c) ==> AUTO
	c-->T0(*) ==> c = ({arb(c)} + (c - {arb(c)}))
	({arb(c)},c - {arb(c)})-->T899(*) ==> (signedSymbs({arb(c)}) + signedSymbs(c - {arb(c)})) = signedSymbs({arb(c)} + (c - {arb(c)}))
	(arb(c))-->T898(*) ==> signedSymbs({arb(c)}) = {{{arb(C)}},togg({{arb(C)}})}
	EQUAL ==> false
	Discharge ==> QED
--
--
--
THEORY signedSymbols(atms)
--
-- This theory receives a set $atms$ of which it will univocally convert
-- every element $x$ into a positive literal by the affirmation operation
-- $aff_thryvar(x)$ and into a negative literal by the negation operation
-- $neg_thryvar(aff_thryvar(x))$, where $neg_thryvar$ is a Galois correspondence.
-- For a finite set $atms$, positive integer encodings and their negatives
-- would suffice, but a more general approach will be taken here, and
-- $aff_thryvar,neg_thryvar$ will be defined globally. Along with the functions
-- $aff_thryvar,neg_thryvar$, this theory returns a collection $lits_thryvar$ of
-- positive and negative literals including all the affirmed and negated images
-- of the "symbols" in $atms$. Moreover, it returns a designation $false_thryvar$
-- for falsehood such that the pair $false_thryvar,neg_thryvar(false_thryvar)$
-- of complementary truth values does not intersect $lits_thryvar$. All literals,
-- as well as the logical constants, will share the same rank exceeding
-- the ordinal $Za$.
--
END signedSymbols
--
ENTER_THEORY signedSymbols
--
Def signedSymbols1: aff_thryvar(X) := {{X,atms + Za}}
--
Def signedSymbols2: neg_thryvar(X) := togg(X)
--
Def signedSymbols3: lits_thryvar := {b + {{x,atms + Za}}: b incin 1, x in atms}
--
Def signedSymbols4: false_thryvar := {{atms + Za}}
--
--
--
Theorem signedSymbols1: [affirmation is one-one] (X /= Y) imp (aff_thryvar(x) /= aff_thryvar(y)). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(aff_thryvar) ==> Stat1: (x /= y) & ({{x,atms + Za}} = {{y,atms + Za}})
	(Stat1*)Discharge ==> QED
--
Theorem signedSymbols2: [negation is a Galois correspondence] (neg_thryvar(neg_thryvar(X)) = X) & (neg_thryvar(X) /= X). Proof:
Suppose_not(x) ==> AUTO
	Use_def(neg_thryvar) ==> Stat1: not((togg(togg(x)) = x) & (togg(x) /= x))
	x-->T893(Stat1*) ==> false; Discharge ==> QED
--
Theorem signedSymbols3: [positive and negative literals do not intersect] aff_thryvar(X) /= neg_thryvar(aff_thryvar(Y)). Proof:
Suppose_not(x,y) ==> AUTO
	Use_def(aff_thryvar(x)) ==> AUTO
	Use_def(aff_thryvar(y)) ==> AUTO
	Use_def(neg_thryvar({{y, atms + Za}})) ==> AUTO
	(y,atms + Za)-->T894 ==> togg({{y, atms + Za}}) = {0,{y, atms + Za}}
	EQUAL ==> {{x,atms + Za}} = {0,{y, atms + Za}}
	TELEM ==> 0 /= {x, atms + Za}
	Discharge ==> QED
--
Theorem signedSymbols4: [affirmation of an atom produced a literal] {aff_thryvar(x): x in atms} incin lits_thryvar. Proof:
Suppose_not ==> Stat1: not ({aff_thryvar(x): x in atms} incin lits_thryvar)
	h-->Stat1 ==> Stat2: (h in {aff_thryvar(x): x in atms}) & (h notin lits_thryvar)
	x-->Stat2 ==> Stat3: (x in atms) & (aff_thryvar(x) notin lits_thryvar)
	Use_def(aff_thryvar) ==> aff_thryvar(x) = {{x, atms + Za}}
	Use_def(lits_thryvar) ==> Stat4: {{x, atms + Za}} notin {b + {{x, atms + Za}}: b incin 1, x in atms}
	(0,x)-->Stat4 ==> false
	Discharge ==> QED
--
Theorem signedSymbols5: [literals are closed under negation] {neg_thryvar(x): x in lits_thryvar} = lits_thryvar. Proof:
Suppose_not ==> AUTO
	Suppose ==> Stat1: {neg_thryvar(x): x in lits_thryvar} nincin lits_thryvar
		n-->Stat1(Stat1*) ==> Stat2: (n in {neg_thryvar(x): x in lits_thryvar}) & (n notin lits_thryvar)
		h-->Stat2(Stat2*) ==> Stat3: (h in lits_thryvar) & (neg_thryvar(h) notin lits_thryvar)
		Use_def(lits_thryvar)(*) ==> Stat4: h in {b + {{x, atms + Za}}: b incin 1, x in atms} &
			Stat5: neg_thryvar(h) notin {b + {{x, atms + Za}}: b incin 1, x in atms}
		(b,x)-->Stat4(Stat4*) ==> Stat6: (x in atms) & (b incin 1) & (h = b + {{x, atms + Za}})
--
-- For some reason, the following Suppose did not work, and I had to resort to a direct argument
--
--??		Suppose ==> {{x, atms + Za}} - 1 /= {{x, atms + Za}}
--			TELEM ==> 1 = {0}
--			EQUAL(Stat6) ==> Stat7: {{x, atms + Za}} - {0} /= {{x, atms + Za}}
--			(Stat7*)ELEM ==> 0 = {x, atms + Za}
--		Discharge ==> AUTO
		TELEM ==> Stat7: 1 = {0}
		TELEM ==> 0 /= {x, atms + Za}
		(Stat7*)ELEM ==> {{x, atms + Za}} - 1 = {{x, atms + Za}}
		h-->T891(*) ==> togg(h) = ((h-1)+(1-h))
		Use_def(neg_thryvar) ==> neg_thryvar(h) = (1 - b) + {{x, atms + Za}}
		(1 - b, x)-->Stat5(Stat6*) ==> false
	Discharge ==> Stat8: ({neg_thryvar(x): x in lits_thryvar} incin lits_thryvar) &
			Stat9: (lits_thryvar nincin {neg_thryvar(x): x in lits_thryvar})
	c-->Stat9(Stat8*) ==> Stat10: (c in lits_thryvar) & (c notin {neg_thryvar(x): x in lits_thryvar})
		c-->TsignedSymbols2(Stat10*) ==> Stat11: neg_thryvar(neg_thryvar(c)) notin {neg_thryvar(x): x in lits_thryvar}
		(neg_thryvar(c))-->Stat11(Stat8*) ==> Stat12: neg_thryvar(c) notin {neg_thryvar(x): x in lits_thryvar}
		c-->Stat12(Stat10*) ==> false
	Discharge ==> QED
--
Theorem signedSymbols6: false_thryvar notin lits_thryvar. Proof:
Suppose_not ==> AUTO
	Use_def(false_thryvar) ==> {{atms + Za}} in lits_thryvar
	Use_def(lits_thryvar) ==> Stat1: {{atms + Za}} in {b + {{x, atms + Za}}: b incin 1, x in atms}
	TELEM ==> 1 = {0}
	(b,x)-->Stat1(Stat1*) ==> Stat2: ({{atms + Za}} = b + {{x, atms + Za}}) & (b incin {0}) & (x in atms)
	Suppose ==> b = {0}
		(Stat2*)ELEM ==> Stat3: 0 in {{atms + Za}}
	(Stat3*)Discharge ==> AUTO
	(Stat2*)Discharge ==> QED
--
Theorem signedSymbols7: {rk(x): x in lits_thryvar} incin {rk(false_thryvar)}. Proof:
Suppose_not ==> Stat1: {rk(x): x in lits_thryvar} nincin {rk(false_thryvar)}
	({atms + Za})-->T849(*) ==> Stat2: rk({{atms + Za}}) = next(rk({atms + Za}))
	Use_def(false_thryvar) ==> false_thryvar = {{atms + Za}}
	EQUAL(Stat2) ==> rk(false_thryvar) = next(rk({atms + Za}))
	Suppose ==> rk({0,{atms + Za}}) /= next(rk({atms + Za}))
		(0,{atms + Za})-->T851(Stat2*) ==> Stat3: rk({0,{atms + Za}}) = next(rk(0)) + next(rk({atms + Za}))
		0-->T848 ==> rk(0) = 0
		Use_def(1) ==> 1 = next(0)
		EQUAL(Stat3) ==> Stat4: rk({0,{atms + Za}}) = 1 + next(rk({atms + Za}))
		({atms + Za})-->T854 ==> AUTO
		(rk({atms + Za}))-->T32(Stat3*) ==> Ord(next(rk({atms + Za})))
		T211 ==> Card(1)
		Use_def(Card) ==> Ord(1)
		Use_def(next) ==> next(rk({atms + Za})) /= 0
		TELEM ==> 1 = {0}
		(1,next(rk({atms + Za})))-->T29(Stat4*) ==> rk({0,{atms + Za}}) = next(rk({atms + Za}))
	Discharge ==> Stat5: rk({0,{atms + Za}}) = next(rk({atms + Za}))
	r0-->Stat1(Stat1*) ==> Stat6: (r0 in {rk(x): x in lits_thryvar}) & (r0 /= rk(false_thryvar))
	x0-->Stat6(Stat6*) ==> Stat7: (x0 in lits_thryvar) & (rk(x0) /= rk(false_thryvar))
	Use_def(lits_thryvar)(Stat7*) ==> Stat8: x0 in {b + {{x,atms + Za}}: b incin 1, x in atms}
	TELEM ==> 1 = {0}
	(b1,x1)-->Stat8(Stat8*) ==> (b1 in {0,{0}}) & (x1 in atms) & (x0 = b1 + {{x1,atms + Za}})
	(b1,{{x1,atms + Za}})-->T850(Stat8*) ==> rk(b1 + {{x1,atms + Za}}) = rk(b1) + rk({{x1,atms + Za}})
	({x1,atms + Za})-->T849(Stat8*) ==> rk({{x1,atms + Za}}) = next(rk({x1,atms + Za}))
	(x1,atms + Za)-->T851(Stat8*) ==> Stat9: rk({x1,atms + Za}) = next(rk(x1)) + next(rk(atms + Za))
	(x1,atms + Za)-->T852(Stat8*) ==> rk(x1) in rk(atms + Za)
--
-- Since, by Theorem 854, $rk(x1)$ and $rk(atms + Za)$ are ordinals,
-- and the former belongs to the latter,
-- $next(rk(x1))$ is included in $rk(atms + Za)$.
--
	(atms + Za)-->T854 ==> AUTO
	Use_def(next(rk(atms + Za))) ==> AUTO
	(rk(atms + Za),rk(x1))-->T37(Stat9*) ==> rk({x1,atms + Za}) = next(rk(atms + Za))
	(atms + Za)-->T849(Stat9*) ==> rk({atms + Za}) = next(rk(atms + Za))
	EQUAL(Stat8) ==> rk(x0) = rk(b1) + next(rk({atms + Za}))
	Suppose ==> b1 = 0
		b1-->T848(*) ==> false
	Discharge ==> b1 = {0}
	EQUAL(Stat2) ==> rk(x0) = rk({0}) + rk({{atms + Za}})
	({0},{{atms + Za}})-->T850(Stat9*) ==> rk({0} + {{atms + Za}}) = rk({0}) + rk({{atms + Za}})
	TELEM ==> {0} + {{atms + Za}} = {0,{atms + Za}}
	EQUAL(Stat5) ==> rk(x0) = next(rk({atms + Za}))
	Discharge ==> QED
--
--Theorem signedSymbols7a: (X in lits_thryvar + {neg_thryvar(false_thryvar)}) imp (rk(X) = rk(false_thryvar)). Proof:
--Suppose_not(x0) ==> AUTO
--	({atms + Za})-->T849(*) ==> Stat1: rk({{atms + Za}}) = next(rk({atms + Za}))
--	Use_def(false_thryvar) ==> false_thryvar = {{atms + Za}}
--	EQUAL(Stat1) ==> rk(false_thryvar) = next(rk({atms + Za}))
--	Suppose ==> rk({0,{atms + Za}}) /= next(rk({atms + Za}))
--		(0,{atms + Za})-->T851(Stat1*) ==> Stat2: rk({0,{atms + Za}}) = next(rk(0)) + next(rk({atms + Za}))
--		0-->T848 ==> rk(0) = 0
--		Use_def(1) ==> 1 = next(0)
--		EQUAL(Stat2) ==> Stat3: rk({0,{atms + Za}}) = 1 + next(rk({atms + Za}))
--		({atms + Za})-->T854 ==> AUTO
--		(rk({atms + Za}))-->T32(Stat2*) ==> Ord(next(rk({atms + Za})))
--		T211 ==> Card(1)
--		Use_def(Card) ==> Ord(1)
--		Use_def(next) ==> next(rk({atms + Za})) /= 0
--		TELEM ==> 1 = {0}
--		(1,next(rk({atms + Za})))-->T29(Stat3*) ==> rk({0,{atms + Za}}) = next(rk({atms + Za}))
--	Discharge ==> Stat4: rk({0,{atms + Za}}) = next(rk({atms + Za}))
--	Suppose ==> x0 = neg_thryvar(false_thryvar)
--		Use_def(neg_thryvar) ==> neg_thryvar(false_thryvar) = togg(false_thryvar)
--		(atms + Za,atms + Za)-->T894(Stat1*) ==> Stat5: togg({{atms + Za,atms + Za}}) = {0,{atms + Za,atms + Za}}
--		TELEM ==> {atms + Za,atms + Za} = {atms + Za}
--		EQUAL(Stat5) ==> togg({{atms + Za}}) = {0,{atms + Za}}
--		EQUAL(Stat1) ==> rk(x0) = rk({0,{atms + Za}})
--		EQUAL(Stat4) ==> rk(x0) = next(rk({atms + Za}))
--	Discharge ==> x0 in lits_thryvar
--	Use_def(lits_thryvar) ==> Stat6: x0 in {b + {{x,atms + Za}}: b incin 1, x in atms}
--	TELEM ==> 1 = {0}
--	(b1,x1)-->Stat6(Stat6*) ==> (b1 in {0,{0}}) & (x1 in atms) & (x0 = b1 + {{x1,atms + Za}})
--	(b1,{{x1,atms + Za}})-->T850(Stat6*) ==> rk(b1 + {{x1,atms + Za}}) = rk(b1) + rk({{x1,atms + Za}})
--	({x1,atms + Za})-->T849(Stat6*) ==> rk({{x1,atms + Za}}) = next(rk({x1,atms + Za}))
--	(x1,atms + Za)-->T851(Stat6*) ==> Stat7: rk({x1,atms + Za}) = next(rk(x1)) + next(rk(atms + Za))
--	(x1,atms + Za)-->T852(Stat6*) ==> rk(x1) in rk(atms + Za)
--
-- -- Since, by Theorem 854, $rk(x1)$ and $rk(atms + Za)$ are ordinals,
-- -- and the former belongs to the latter,
-- -- $next(rk(x1))$ is included in $rk(atms + Za)$.
--
--	(atms + Za)-->T854 ==> AUTO
--	Use_def(next(rk(atms + Za))) ==> AUTO
--	(rk(atms + Za),rk(x1))-->T37(Stat7*) ==> rk({x1,atms + Za}) = next(rk(atms + Za))
--	(atms + Za)-->T849(Stat7*) ==> rk({atms + Za}) = next(rk(atms + Za))
--	EQUAL(Stat6) ==> rk(x0) = rk(b1) + next(rk({atms + Za}))
--	Suppose ==> b1 = 0
--		b1-->T848(*) ==> false
--	Discharge ==> b1 = {0}
--	EQUAL(Stat1) ==> rk(x0) = rk({0}) + rk({{atms + Za}})
--	({0},{{atms + Za}})-->T850(Stat7*) ==> rk({0} + {{atms + Za}}) = rk({0}) + rk({{atms + Za}})
--	TELEM ==> {0} + {{atms + Za}} = {0,{atms + Za}}
--	EQUAL(Stat4) ==> rk(x0) = next(rk({atms + Za}))
--	Discharge ==> QED
--
--
Theorem signedSymbols8: (N in next(Za)) imp (N in rk(false_thryvar)). Proof:
Suppose_not(n0) ==> AUTO
--
-- For, assuming $n0$ to be a counterexample, by taking into account the definition
-- of $rk(false_thryvar)$, we would have $n0 in next(Za)$ and $n0 notin next(next(rk(atms) + Za))$.
-- But then, $rk(atms) + Za$ would be an ordinal not smaller than $Za$, and therefore
-- $next(rk(atms) + Za)$ would be an ordinal not smaller than $next(Za)$, and therefore
-- the ordinal $n0$ would belong to $next(rk(atms) + Za)$ and to $next(next(rk(atms) + Za))$.
-- The resulting contradiction proves the desired claim.
--
	Use_def(false_thryvar) ==> n0 notin rk({{atms + Za}})
	({atms + Za})-->T849 ==> AUTO
	(atms + Za)-->T849 ==> AUTO
	(atms,Za)-->T850 ==> AUTO
	Za-->T856 ==> AUTO
	T206(*) ==> Stat1: Ord(Za) & (Za = rk(Za)) & (n0 in next(Za))
	EQUAL ==> Stat2: n0 notin next(next(rk(atms) + Za))
	atms-->T854 ==> AUTO
	(rk(atms),Za)-->T30 ==> AUTO
	(rk(atms) + Za)-->T32(Stat1*) ==> Stat3: Ord(next(rk(atms) + Za))
	(Za,n0)-->T36(Stat1,Stat1*) ==> Stat4: (n0 incin (rk(atms) + Za)) & Ord(n0)
	Use_def(next)(Stat4*) ==> n0 incin next(rk(atms) + Za)
	(next(rk(atms) + Za),n0)-->T36(Stat3*) ==> Stat5: n0 in next(next(rk(atms) + Za))
	(Stat2,Stat5*)Discharge ==> QED
--
Theorem signedSymbols9: (rk(X) notin rk(false_thryvar)) imp (rk(neg_thryvar(X)) = rk(X)). Proof:
Suppose_not(x0) ==> (rk(x0) notin rk(false_thryvar)) & (rk(neg_thryvar(x0)) /= rk(x0))
	x0-->T891 ==> AUTO
	Use_def(neg_thryvar(x0)) ==> AUTO
	EQUAL ==> Stat1: (rk(x0) notin rk(false_thryvar)) & (rk((x0 - 1) + (1 - x0)) /= rk(x0))
	x0-->T892(Stat1*) ==> Stat2: 1 notin rk(x0)
	1-->TsignedSymbols8 ==> AUTO
	TELEM ==> 1 in Za
	Use_def(next)(Stat2*) ==> 1 in rk(false_thryvar)
--
-- Now, since $rk(x0)$ and $rk(false_thryvar)$ are ordinals, by
-- Theorem 854, and since the former is not smaller than the latter,
-- the latter is included in the former, which implies $1 in rk(x0)$,
-- a contradiction.
--
	x0-->T854 ==> AUTO
	false_thryvar-->T854 ==> AUTO
	(rk(false_thryvar),rk(x0))-->T35(Stat1*) ==> false
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- DISPLAY signedSymbols
--
-- THEORY signedSymbols(atms)
--
-- ==> (aff_thryvar, neg_thryvar, lits_thryvar, false_thryvar)
--
--	(FORALL x, y | (x /= y) imp (aff_thryvar(x) /= aff_thryvar(y)))
--
--	(FORALL x | (neg_thryvar(neg_thryvar(x)) = x) & (neg_thryvar(x) /= x))
--
--	(FORALL x, y | aff_thryvar(x) /= neg_thryvar(aff_thryvar(y)))
--
--	{aff_thryvar(x): x in atms} incin lits_thryvar
--
--	{neg_thryvar(x): x in lits_thryvar} = lits_thryvar
--
--	false_thryvar notin lits_thryvar
--
--	{rk(x): x in lits_thryvar} incin {rk(false_thryvar)}
--
--	(FORALL n | (n in next(Za)) imp (n in rk(false_thryvar)))
--
--	(FORALL x | (rk(x) notin rk(false_thryvar)) imp (rk(neg_thryvar(x)) = rk(x)))
--
-- END signedSymbols
--
--
THEORY cnfModels(tog(X))
--
-- This theory receives a global Galois correspondence $tog(x)$, and will
-- introduce corresponding notions of models and satisfiability of propositional
-- conjunctive normal forms. Moreover it proves various lemmas enabling
-- reduction of an instance of the satifiability/modeling problem for
-- conjunctive normal forms to a simpler instance of the same problem.
-- These correspond to the tautology elimination rule, and to the unit literal
-- rule, pure literal rule, and splitting rule of the classical Davis-Putnam
-- algorithm.
--
	(FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
--
END cnfModels
--
--
ENTER_THEORY cnfModels
--
Def cnfModels1: [model of a conjunctive normal form, represented as a set of sets of literals]
	Has_cnfModel_thryvar(S,M) := ({h in M | tog(h) in M} = 0) & ({c in S | (M * c) = 0} = 0)
--
Def cnfModels2: [satisfiability of a conjunctive normal form, represented as a set of sets of literals]
	Is_cnfSat_thryvar(S) := (EXISTS m | Has_cnfModel_thryvar(S,m))
--
--
--
Theorem cnfModels0: [assumption concerning tog] (tog(tog(X)) = X) & (tog(X) /= X). Proof:
Suppose_not(x) ==> AUTO
	Assump ==> Stat1: (FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
	x-->Stat1 ==> false; Discharge ==> QED
--
--
--
Theorem cnfModels1: [property of the models of $0$] Has_cnfModel_thryvar(0,M) eq ({h in M | tog(h) in M} = 0). Proof:
Suppose_not(m0) ==> AUTO
	Use_def(Has_cnfModel_thryvar)(*) ==> Stat1: {c in 0 | (m0 * c) = 0} /= 0
	c-->Stat1(Stat1*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels2: [blatant truth, manifest absurdity] Has_cnfModel_thryvar(0,0) & Is_cnfSat_thryvar(0) & ((0 in S) imp (not(Is_cnfSat_thryvar(S)))). Proof:
Suppose_not(s) ==> AUTO
	Suppose ==> Stat1: not(Has_cnfModel_thryvar(0,0))
		0-->TcnfModels1(Stat1*) ==> Stat2: {h in 0 | tog(h) in 0} /= 0
	h0-->Stat2(Stat2*) ==> false; Discharge ==> Stat3: Has_cnfModel_thryvar(0,0)
	Suppose ==> not(Is_cnfSat_thryvar(0))
		Use_def(Is_cnfSat_thryvar)(*) ==> Stat4: (not(EXISTS m | Has_cnfModel_thryvar(0,m)))
	0-->Stat4(Stat3*) ==> false; Discharge ==> Stat5: (0 in s) & (Is_cnfSat_thryvar(s))
	Use_def(Is_cnfSat_thryvar)(Stat5*) ==> Stat6: (EXISTS m | Has_cnfModel_thryvar(s,m))
	m-->Stat6(Stat6*) ==> Stat7: Has_cnfModel_thryvar(s,m)
	Use_def(Has_cnfModel_thryvar)(Stat7*) ==> Stat8: {c in s | (m * c) = 0} = 0
	0-->Stat8(Stat5,Stat5*) ==> false
	Discharge ==> QED
--
-- Although not obviously true, like $0$, any set $s$ which contains no pair of
-- complementary literals is trivially satisfiable.
--
Theorem cnfModels3: [plain satisfiability] (({h in Un(S) | tog(h) in Un(S)} = 0) & (0 notin S)) imp (Has_cnfModel_thryvar(S,Un(S)) & Is_cnfSat_thryvar(S)). Proof:
Suppose_not(s) ==> AUTO
--
-- For, assuming $s$ to contradict this assertion, we readily get that $Un(s)$ is not
-- a model of $s$; but then, $Un(s)$ must fail to intersect some $c$ belonging to $s$.
--
	Suppose ==> Has_cnfModel_thryvar(s,Un(s))
		Use_def(Is_cnfSat_thryvar) ==> Stat1: not(EXISTS m | Has_cnfModel_thryvar(s,m))
		(Un(s))-->Stat1 ==> false
	Discharge ==> AUTO
	Use_def(Has_cnfModel_thryvar) ==> Stat2: {c in s | (Un(s) * c) = 0} /= 0
	Use_def(Un(s)) ==> AUTO
	c-->Stat2 ==> Stat3: (arb(c) notin {h: d in s, h in d}) & (c in s) & (arb(c) in c)
--
-- Since such a $c$ cannot be $0$, any of its elements belongs to $Un(s)$, and we
-- get a contradiction which proves the desired statement.
--
	(c,arb(c))-->Stat3(Stat3*) ==> false
	Discharge ==> QED
--
-- As a consequence of the preceding theorem any set $s$ which consists of its singletons
-- none of which has its complement in $s$ is satisfiable.
--
Theorem cnfModels4: [plain satisfiability, 2] ({u: u in S, h in u | (u = {h}) & ({h,tog(h)} * Un(S - {u}) = 0)} incs S) imp (Has_cnfModel_thryvar(S,Un(S)) & Is_cnfSat_thryvar(S)). Proof:
Suppose_not(s) ==> AUTO
--
-- For, assuming $s$ to contradict this assertion, we easily get that $s$ meets the hypotheses of
-- the preceding theorem. From this we derive a contradiction giving the desired conclusion.
--
	Suppose ==> 0 in s
		ELEM ==> Stat1: 0 in {u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)}
		(u,h)-->Stat1 ==> false
	Discharge ==> 0 notin s
	s-->TcnfModels3 ==> Stat2: {h in Un(s) | tog(h) in Un(s)} /= 0
	Use_def(Un(s)) ==> AUTO
	h0-->Stat2(Stat2*) ==> Stat3: (h0 in {k: c in s, k in c}) & (tog(h0) in {k: c in s, k in c})
	(c0,k0,c1,k1)-->Stat3(Stat3*) ==> Stat4: (c0 in s) & (h0 in c0) & (c1 in s) & (tog(h0) in c1)
	ELEM ==> Stat5: (c0 in {u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)}) &
		(c1 in {u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)})
	(u0,h2,u1,h1)-->Stat5(Stat4*) ==> Stat6: (h0 = h2) & (u0 = {h0}) & (u0 in s) &
		({tog(h0)} in s) & (tog(h2) notin Un(s - {u0}))
	EQUAL(Stat6) ==> Stat7: tog(h0) notin Un(s - {u0})
	(tog(h0),s - {u0})-->T105(Stat7*) ==> Stat8: {c in (s - {u0}) | tog(h0) in c} = 0
	({tog(h0)})-->Stat8(Stat6,Stat6*) ==> Stat9: {tog(h0)} = {h0}
	h0-->TcnfModels0(Stat9*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels5: [cnf model subsumption] ((T incin S) & Has_cnfModel_thryvar(S,M)) imp Has_cnfModel_thryvar(T,M). Proof:
Suppose_not(t,s,m) ==> AUTO
	Use_def(Has_cnfModel_thryvar)(*) ==> Stat1: (t incin s) & ({h in m | tog(h) in m} = 0) & ({c in s | (m * c) = 0} = 0) & ({c in t | (m * c) = 0} /= 0)
	Set_monot ==> {c in t | (m * c) = 0} incin {c in s | (m * c) = 0}
	(Stat1*)Discharge ==> QED
--
--
--
Theorem cnfModels6: [cnf model subsumption,2] ((T incin S) & Is_cnfSat_thryvar(S)) imp Is_cnfSat_thryvar(T). Proof:
Suppose_not(t,s) ==> AUTO
	Use_def(Is_cnfSat_thryvar)(*) ==> Stat1: (EXISTS m | Has_cnfModel_thryvar(s,m)) &
			Stat2: (not (EXISTS m | Has_cnfModel_thryvar(t,m)))
	m-->Stat1 ==> AUTO
	(t,s,m)-->TcnfModels5 ==> AUTO
	m-->Stat2 ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels7: [shrinking of cnf_model] Has_cnfModel_thryvar(S,M) imp Has_cnfModel_thryvar(S, M * Un(S)). Proof:
Suppose_not(s,m) ==> AUTO
	Use_def(Has_cnfModel_thryvar)(*) ==> ({h in m | tog(h) in m} = 0) & ({c in s | (m * c) = 0} = 0) & (({h in (m * Un(s)) | tog(h) in (m * Un(s))} /= 0) or ({c in s | ((m * Un(s)) * c) = 0} /= 0))
	Use_def(Un)(*) ==> Stat1: ({h in m | tog(h) in m} = 0) & Stat2: ({c in s | (m * c) = 0} = 0) & (({h in (m * {h: c in s, h in c}) | tog(h) in (m * {h: c in s, h in c})} /= 0) or ({c in s | ((m * {h: c in s, h in c}) * c) = 0} /= 0))
	Suppose ==> Stat3: {h in (m * {h: c in s, h in c}) | tog(h) in (m * {h: c in s, h in c})} /= 0
		k-->Stat3(Stat3*) ==> Stat4: (k in m) & (tog(k) in m)
	k-->Stat1(Stat4*) ==> false; Discharge ==> Stat5: {c in s | ((m * {h: c in s, h in c}) * c) = 0} /= 0
	d-->Stat5(Stat5*) ==> Stat6: (d in s) & Stat7: (((m * {h: c in s, h in c}) * d) = 0)
	d-->Stat2(Stat6*) ==> Stat8: (m * d) /= 0
	q-->Stat8(Stat8*) ==> q in (m * d)
	Suppose ==> Stat9: q notin {h: c in s, h in c}
	(d,q)-->Stat9(Stat6*) ==> false; Discharge ==> q in {h: c in s, h in c}
	(Stat6*)Discharge ==> QED
--
--
--
Theorem cnfModels8: [broadening of cnf-model] (Has_cnfModel_thryvar(S,M) & ({h in (N - M) | tog(h) in N} = 0) & (M incin N)) imp Has_cnfModel_thryvar(S,N). Proof:
Suppose_not(s,m,n) ==> AUTO
	Use_def(Has_cnfModel_thryvar) ==> Stat1: ({h in m | tog(h) in m} = 0) & Stat2: ({c in s | (m * c) = 0} = 0) & (m incin n) & (({h in n | tog(h) in n} /= 0) or ({c in s | (n * c) = 0} /= 0)) &  Stat3: ({h in (n - m) | tog(h) in n} = 0)
	Suppose ==> Stat4: {h in n | tog(h) in n} /= 0
		k-->Stat4(Stat4*) ==> Stat5: (k in n) & (tog(k) in n)
		Suppose ==> k in (n - m)
		k-->Stat3(Stat5*) ==> false; Discharge ==> k in (n * m )
		k-->Stat1(Stat5*) ==> Stat6: tog(k) in (n - m)
		(tog(k))-->Stat3(Stat6*) ==> Stat7: tog(tog(k)) notin n
	k-->TcnfModels0(Stat5,Stat7*) ==> false; Discharge ==> Stat8: {c in s | (n * c) = 0} /= 0
	c-->Stat8(Stat1,Stat1*) ==> Stat9: (c in s) & ((m * c) = 0)
	c-->Stat2(Stat9*) ==> false
	Discharge ==> QED
--
-- Our next theorem state that if $m$ is a model for some CNF-formula $S$, and
-- if $m1$ results from $m$ by addition of new non-complementary literals, then
-- $m1$ is a model for the null set of clauses.
--
Theorem cnfModels9: [extensibility of models] Has_cnfModel_thryvar(S,M) imp
	Has_cnfModel_thryvar(0, M + {arb({k,tog(k)}): c in T, k in (c - M) | tog(k) in (c - M)}). Proof:
Suppose_not(s,m,t) ==> AUTO
	Loc_def ==> Stat1: m0 = {arb({k,tog(k)}): c in t, k in (c - m) | tog(k) in (c - m)}
	Use_def(Has_cnfModel_thryvar) ==> Stat2: {h in m | tog(h) in m} = 0
	EQUAL ==> (not Has_cnfModel_thryvar(0, m + m0))
	(m + m0)-->TcnfModels1 ==> Stat3: {h in (m + m0) | tog(h) in (m + m0)} /= 0
	h0-->Stat3(Stat3*) ==> (h0 in m + m0) & (tog(h0) in m + m0)
--
-- Since $h0,tog(h0)$ do not belong together to $m$, one of the two belongs to the set
--	${arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}$,
-- while its complement either belongs to this same set or belongs to $m$.
-- All three possibilities will be discarded, one by one, in what follows.
--
	h0-->Stat2(*) ==> (h0 notin m) or (tog(h0) notin m)
	h0-->TcnfModels0 ==> Stat4: (tog(tog(h0)) = h0)  & (tog(h0) /= h0)
	Suppose ==> Stat5: (tog(h0) in m) & Stat6: (h0 in {arb({k,tog(k)}): c in t, k in (c - m) | tog(k) in (c - m)})
		(c0,k0)-->Stat6(Stat5) ==> ((h0 = k0) or (h0 =tog(k0))) & (k0 notin m)  & (tog(k0) notin m)
		Suppose ==> h0 = k0
			EQUAL(Stat4) ==> false
		Discharge ==> h0 = tog(k0)
		EQUAL(Stat4) ==> tog(h0) = tog(tog(k0))
		k0-->TcnfModels0 ==> false
	Discharge ==> AUTO
	Suppose ==> Stat7: (h0 in m) & Stat8: (tog(h0) in {arb({k,tog(k)}): c in t, k in (c - m) | tog(k) in (c - m)})
		(c1,k1)-->Stat8(Stat7) ==> ((tog(h0) = k1) or (tog(h0) = tog(k1))) & (k1 notin m) & (tog(k1) notin m)
		Suppose ==> tog(h0) = k1
			EQUAL(Stat4) ==> false
		Discharge ==> tog(h0) = tog(k1)
		EQUAL(Stat4) ==> tog(tog(h0)) = tog(tog(k1))
		k1-->TcnfModels0 ==> false
	Discharge ==> AUTO
	(Stat1*)ELEM ==> Stat9: (h0 in {arb({k,tog(k)}): c in t, k in (c - m) | tog(k) in (c - m)}) &
		(tog(h0) in {arb({k,tog(k)}): c in t, k in (c - m) | tog(k) in (c - m)})
	(c2,k2,c3,k3)-->Stat9(Stat9*) ==> Stat10: (h0 = arb({k2,tog(k2)})) & (tog(h0) = arb({k3,tog(k3)}))
	({k2, tog(k2)})-->T0(Stat10*) ==> Stat11: (h0 = k2) or (h0 = tog(k2))
	({k3, tog(k3)})-->T0(Stat10*) ==> (tog(h0) = k3) or (tog(h0) = tog(k3))
--
-- We will arrive at a contradiction by showing that $h0 = tog(h0)$
-- because ${k2, tog(k2)} = {k3, tog(k3)}$.
--
-- Firstly, let us show that ${k2, tog(k2)} * {k3, tog(k3)} /= 0$.
--
		Suppose ==> Stat12: {k2, tog(k2)} * {k3, tog(k3)} = 0
			Suppose ==> h0 = k2
				EQUAL(Stat12) ==> tog(h0) = tog(k2)
			(Stat11*)Discharge ==> AUTO
			(Stat11*)ELEM ==> h0 = tog(k2)
			EQUAL(Stat12) ==> tog(h0) = tog(tog(k2))
		k2-->TcnfModels0(Stat11*) ==> false; Discharge ==> Stat13: {k2, tog(k2)} * {k3, tog(k3)} /= 0
--
-- Now we can show that ${k2, tog(k2)} = {k3, tog(k3)}$.
--
		Suppose ==> Stat14: {k2, tog(k2)} /= {k3, tog(k3)}
			Loc_def ==> hh = arb({k2, tog(k2)} * {k3, tog(k3)})
			({k2, tog(k2)} * {k3, tog(k3)})-->T0(Stat13*) ==> Stat15: (hh in {k2, tog(k2)}) & (hh in {k3, tog(k3)})
			Suppose ==> (hh = k2) & (hh = k3)
				EQUAL(Stat15) ==> tog(k2) = tog(k3)
			(Stat14*)Discharge ==> AUTO
			Suppose ==> Stat16: (hh = tog(k2)) & (hh = tog(k3))
				k2-->TcnfModels0(Stat16*) ==> AUTO
				k3-->TcnfModels0(Stat16*) ==> AUTO
				EQUAL(Stat16) ==> k2 = k3
			(Stat14*)Discharge ==> AUTO
 			Suppose ==> Stat17: (hh = k2) & (hh = tog(k3))
				k3-->TcnfModels0(Stat17*) ==> AUTO
				EQUAL(Stat17) ==> tog(k2) = k3
			(Stat14*)Discharge ==> AUTO
			Suppose ==> Stat18: (hh = k3) & (hh = tog(k2))
				k2-->TcnfModels0(Stat18*) ==> AUTO
				EQUAL(Stat18) ==> tog(k3) = k2
			(Stat14*)Discharge ==> AUTO
		(Stat15*)Discharge ==> Stat19: {k2, tog(k2)} = {k3, tog(k3)}
		(Stat4,Stat10,Stat19*)Discharge ==> QED
--
-- The following theorem states that if a CNF-formula $S$ admitting a model $M$ is
-- enriched with a set of tautological clauses, then the resulting conjunction
-- $S1$ has a superset $M1$ of $M$ as a model, where each literal in $M1 - M$
-- belongs, together with its complement, to some tautological clause of $S1 - S$.
--
Theorem cnfModels10: [tautology withdrawal rule] Has_cnfModel_thryvar(S,M) imp
	Has_cnfModel_thryvar(S + {c: c in T, h in c | tog(h) in c},
		M + {arb({h,tog(h)}): c in T, h in (c - M) | tog(h) in (c - M)}). Proof:
Suppose_not(s,m,t) ==> AUTO
--
-- Reasoning by contradiction, assume that $s,m,t$ are a counterexample,
-- so that $m$ is a model for $s$ but its extension
--	$m1 = m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}$
-- fails to be a model for
--	$s1 = s + {c: c in t, h in c | tog(h) in c}$.
-- Then either there are complementary literals $h1,tog(h1)$ in $m1$, or there is
-- some clause in $s1$ which does not intersect $m1$. We readily eliminate the former case,
-- thanks to Theorem cnfModels9.
--
	(s,m,t)-->TcnfModels9 ==> AUTO
	Use_def(Has_cnfModel_thryvar(s + {c: c in t, h in c | tog(h) in c}, m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)})) ==> AUTO
	(m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)})-->TcnfModels1(*) ==> Stat1:
		{c in (s + {c: c in t, h in c | tog(h) in c}) | ((m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}) * c) = 0} /= 0
--
-- We must now analyze the case, ${c in s1 | m1 * c = 0} /= 0$,
-- when some clause $cc$ in $s1$ does not intersect $m1$. We will see that this
-- case leads to a contradiction too.
--
	cc-->Stat1(Stat1*) ==> Stat2: ((cc in s) or (cc in {c: c in t, h in c | tog(h) in c})) &
		(((m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}) * cc) = 0)
--
-- Note that such a clause $cc$ cannot belong to $s$; in fact, assuming the
-- contrary, since $cc * m1 = 0$ and $m1 incs m$, we would obtain $cc * m1 = 0$,
-- conflicting with $m$ being a model of $s$.
--
	Use_def(Has_cnfModel_thryvar) ==> Stat3: {c in s | (m * c) = 0} = 0
	cc-->Stat3(Stat2*) ==> cc notin s
--
-- Therefore $cc$ is a tautological clause in $t$, within which
-- we can find complementary literals $hx,tog(hk)$.
-- Neither $hx in m$ nor $tog(hx) in m$ can hold; else we would have
--	$cc * {hx,tog(hx)} * m /= 0$.
--
	(Stat2*)ELEM ==> Stat4: cc in {c: c in t, h in c | tog(h) in c}
	(cx, hx)-->Stat4(Stat2*) ==> Stat5: (cc in t) & (hx in cc) & (tog(hx) in cc) &
		({hx,tog(hx)} * m = 0)
--
-- We will show that
--	${hx,tog(hx)} * {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)} /= 0$,
-- contrary to Stat6
--
	(Stat2,Stat5*)ELEM ==> Stat7: (hx notin {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}) &
		Stat8: (tog(hx) notin {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)})
	(hx)-->TcnfModels0(Stat7*) ==> Stat9: tog(tog(hx)) = hx
	(cc, hx)-->Stat7(Stat4*) ==> Stat10: hx /= arb({hx,tog(hx)})
	(cc, tog(hx))-->Stat8(Stat4*) ==> tog(hx) /= arb({tog(hx),tog(tog(hx))})
	(Stat9)Discharge ==> QED
--
--
--
Theorem cnfModels11: [preliminary to splitting rule] (Has_cnfModel_thryvar(S,M) & (not Has_cnfModel_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}, M + {H}))) imp (tog(H) in M). Proof:
Suppose_not(s,m,hh) ==> AUTO
--
-- For, assuming the contrary of the desired conclusion to hold for $s,m,hh$,
-- we will find that there is a clause $c1 in s$ which is not modeled by $m$,
-- a contradiction which proves the theorem.
--
	Use_def(Has_cnfModel_thryvar) ==> Stat1: ({h in m | tog(h) in m} = 0) &
			Stat2: ({c in s | (m * c) = 0} = 0) &
			(not (({h in (m + {hh})| tog(h) in (m + {hh})} = 0) &
			     ({c in ({c - {tog(hh)}: c in s | hh notin c} + {{hh}}) | ((m + {hh}) * c) = 0} = 0))) &
			(tog(hh) notin m)
--
-- Since we are assuming that $m + {hh}$ does not model the conjunctive normal form
--	${h in (m + {hh}) | tog(h) in (m + {hh})}$,
-- either it contains complementary literals $h0,tog(h0)$, or it does not intersect
-- some clause $c0$ belonging to this set. We rule out the first possibility...
--
	Suppose ==> Stat3: {h in (m + {hh}) | tog(h) in (m + {hh})} /= 0
		h0-->Stat3(Stat3*) ==> Stat4: (h0 in (m + {hh})) & (tog(h0) in (m + {hh}))
--
-- ...by observing that of these two complementary literals one must equal $hh$ whereas,
--  since the two differ, the other (which cannot be $tog(hh)$) must belong to $m$.
--
		h0-->Stat1(Stat3*) ==> (h0 = hh) or (tog(h0) = hh)
		h0-->TcnfModels0(Stat4*) ==> (tog(tog(h0)) = h0) & (tog(h0) /= h0)
		Suppose ==> Stat5: (h0 in m) & (tog(h0) = hh)
			EQUAL(Stat1) ==> false
		Discharge ==> h0 = hh
		EQUAL(Stat1) ==> false
	Discharge ==> Stat6: {c in ({c - {tog(hh)}: c in s | hh notin c} + {{hh}}) | ((m + {hh}) * c) = 0} /= 0
--
-- To rule out the other possibility, we observe that since $m + {hh}$
-- and $c0 = c1 - {tog(hh)}$, where $c1$ belongs to $s$ do not intersect,
-- $m$ does not intersect a clause of $s$, the contradiction announced above.
--
	c0-->Stat6(Stat6*) ==> Stat7: (c0 in {c - {tog(hh)}: c in s | hh notin c}) & ((m + {hh}) * c0 = 0)
	c1-->Stat7(Stat1*) ==> Stat8: (c1 in s) & (c1 * m = 0)
	c1-->Stat2(Stat8*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels12: [splitting rule] Has_cnfModel_thryvar(S,M) imp (Has_cnfModel_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}, M + {H}) or Has_cnfModel_thryvar({{tog(H)}} + {c - {H}: c in S | tog(H) notin c}, M + {tog(H)})). Proof:
Suppose_not(s,m,h) ==> AUTO
--
-- Reasoning by contradiction, suppose that $s,m,h$ form a counterexample to the theorem's
-- assertion. It follows from Theorem cnfModels11 that the complementary literals $h,tog(h)$
-- belong together to $m$, which is incompatible with the fact that $m$ is a model.
--
	Suppose ==> tog(h) notin m
	(s,m,h)-->TcnfModels11(*) ==> false; Discharge ==> AUTO
	h-->TcnfModels0(*) ==> tog(tog(h)) = h
	EQUAL ==> (not Has_cnfModel_thryvar({c - {tog(tog(h))}: c in s | tog(h) notin c} + {{tog(h)}}, m + {tog(h)}))
	Suppose ==> h notin m
	(s,m,tog(h))-->TcnfModels11(*) ==> false; Discharge ==> AUTO
	Use_def(Has_cnfModel_thryvar) ==> Stat1: {h in m | tog(h) in m} = 0
	h-->Stat1(*) ==> false; Discharge ==> QED
--
--
--
Theorem cnfModels13: [splitting rule, 2] Has_cnfModel_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}, M) imp Has_cnfModel_thryvar(S,M). Proof:
Suppose_not(h0,s,m) ==> AUTO
	Use_def(Has_cnfModel_thryvar)(*) ==> ({h in m | tog(h) in m} = 0) &
		Stat1: ({c in ({{h0}} + {c - {tog(h0)}: c in s | h0 notin c}) | (m * c) = 0} = 0) &
		Stat2: ({c in s | (m * c) = 0} /= 0)
	c1-->Stat2(*) ==> (c1 in s) & ((m * c1) = 0)
	Suppose ==> h0 in c1
		({h0})-->Stat1(*) ==> m * {h0} /= 0
	Discharge ==> h0 notin c1
	Suppose ==> Stat3: (c1 - {tog(h0)}) notin {c - {tog(h0)}: c in s | h0 notin c}
		(c1)-->Stat3(*) ==> false
	Discharge ==> AUTO
	(c1 - {tog(h0)})-->Stat1(*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels14: [preliminary to splitting rule, 2] Is_cnfSat_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}) imp Is_cnfSat_thryvar(S). Proof:
Suppose_not(hh,s) ==> AUTO
	Use_def(Is_cnfSat_thryvar) ==> Stat1: (not (EXISTS m | Has_cnfModel_thryvar(s,m))) & Stat2: (EXISTS m | Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c} + {{hh}}, m))

	m2-->Stat2(Stat1*) ==> Stat3: Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c} + {{hh}}, m2)
	Use_def(Has_cnfModel_thryvar) ==> Stat4: {h in m2 | tog(h) in m2} = 0
--
-- we build a new set $m3$ such that $tog(hh) notin m3$ and hence $m3$ can be broadened by adding $hh$
--
	Loc_def ==> m3 = m2 * {h: c in {c - {tog(hh)}: c in s | hh notin c}, h in c}

	({c - {tog(hh)}: c in s | hh notin c}, {c - {tog(hh)}: c in s | hh notin c} + {{hh}}, m2)-->TcnfModels5(Stat3*) ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m2)
	({c - {tog(hh)}: c in s | hh notin c}, m2)-->TcnfModels7(Stat4*) ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m2 * Un({c - {tog(hh)}: c in s | hh notin c}))
	Use_def(Un)(Stat4*) ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m2 * {h: c in {c - {tog(hh)}: c in s | hh notin c}, h in c})
	EQUAL(Stat4) ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m3)

--
-- indeed, $tog(hh) notin m3$
--
	Suppose ==> tog(hh) in m3
		(Stat4*)ELEM ==> Stat5: tog(hh) in {h: c in {c - {tog(hh)}: c in s | hh notin c}, h in c}
		(cc2, hh2) -->Stat5(Stat5*) ==> Stat6: (cc2 in {c - {tog(hh)}: c in s | hh notin c}) & (tog(hh) in cc2)
		(cc3)-->Stat6(Stat6*) ==> false
	Discharge ==> AUTO
--
-- we use $m3 + {hh}$ to create a counterexample
--
	(m3 + {hh})-->Stat1(Stat1,Stat1*) ==> (not Has_cnfModel_thryvar(s,m3 + {hh}))
--
-- we have $Has_cnfModel_thryvar(0,m3 + {hh})$
--
	Suppose ==> Stat7: {h in (m3 + {hh}) | tog(h) in (m3 + {hh})} /= 0
		h0-->Stat7(Stat7*) ==> (h0 in (m3 + {hh})) & (tog(h0) in (m3 + {hh}))
		(Stat4*)ELEM ==> Stat8: (h0 in (m2 + {hh})) & (tog(h0) in (m2 + {hh}))

		(h0)-->Stat4(Stat7) ==> (h0 = hh) or (tog(h0) = hh)
		h0-->TcnfModels0(Stat8*) ==> (tog(tog(h0)) = h0) & (tog(h0) /= h0)
		Suppose ==> Stat9: (h0 in m2) & (tog(h0) = hh)
			EQUAL(Stat4) ==> false
		Discharge ==> (h0 = hh) & (tog(h0) in m3)
		EQUAL(Stat4) ==> false

	Discharge ==> AUTO
--
-- it remains that
--
	Use_def(Has_cnfModel_thryvar) ==> Stat10: ({c in s | ((m3 + {hh}) * c) = 0} /= 0)
--
-- by rewriting $Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m3)$, we have
--
	Use_def(Has_cnfModel_thryvar) ==> Stat11: ({c in {k - {tog(hh)}: k in s | hh notin k} | (m3 * c) = 0} = 0)
--
-- we now choose a $d in s$
--
	d-->Stat10(Stat10*) ==> Stat12: (d notin {c in {k - {tog(hh)}: k in s | hh notin k} | (m3 * c) = 0}) & (d in s) & (((m3 + {hh}) * d) = 0)
	d-->Stat12(Stat12*) ==> Stat13: d notin {k - {tog(hh)}: k in s | hh notin k}
	d-->Stat13(Stat12*) ==> (tog(hh) in d) & (hh notin d)
--
-- it remains to consider $tog(hh) in d$
-- but $(d - {tog(hh)})$ does not intersects $m3$ and hence the contradiction
--
	Suppose ==> Stat14: (d - {tog(hh)}) notin {k - {tog(hh)}: k in s | hh notin k}
		d-->Stat14(Stat12*) ==> false
	Discharge ==> AUTO
--
-- since $m3 * (d - tog(hh)) = 0$, we have
--
	(d - {tog(hh)})-->Stat11(Stat11*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels15: [splitting rule, 2] Is_cnfSat_thryvar(S) eq (Is_cnfSat_thryvar({{H}} + {c - {tog(H)}: c in S | H notin c}) or Is_cnfSat_thryvar({{tog(H)}} + {c - {H}: c in S | tog(H) notin c})). Proof:
Suppose_not(s,h0) ==> AUTO
	Suppose ==> Is_cnfSat_thryvar(s) & (not (Is_cnfSat_thryvar({{h0}} + {c - {tog(h0)}: c in s | h0 notin c}) or Is_cnfSat_thryvar({{tog(h0)}} + {c - {h0}: c in s | tog(h0) notin c})))
		Use_def(Is_cnfSat_thryvar)(*) ==>
			Stat1: (EXISTS m | Has_cnfModel_thryvar(s,m)) &
			Stat2: (not (EXISTS m | Has_cnfModel_thryvar({{h0}} + {c - {tog(h0)}: c in s | h0 notin c}, m))) &
			Stat3: (not (EXISTS m | Has_cnfModel_thryvar({{tog(h0)}} + {c - {h0}: c in s | tog(h0) notin c}, m)))
		m1-->Stat1(Stat1*) ==> Stat4: Has_cnfModel_thryvar(s,m1)
		(s,m1,h0)-->TcnfModels12(Stat4*) ==> Has_cnfModel_thryvar({{h0}} + {c - {tog(h0)}: c in s | h0 notin c}, m1 + {h0}) or Has_cnfModel_thryvar({{tog(h0)}} + {c - {h0}: c in s | tog(h0) notin c}, m1 + {tog(h0)})
		Suppose ==> Stat5: Has_cnfModel_thryvar({{h0}} + {c - {tog(h0)}: c in s | h0 notin c}, m1 + {h0})
			(m1 + {h0})-->Stat2(Stat5*) ==> false
		Discharge ==> Stat6: Has_cnfModel_thryvar({{tog(h0)}} + {c - {h0}: c in s | tog(h0) notin c}, m1 + {tog(h0)})
		(m1 + {tog(h0)})-->Stat3(Stat6*) ==> false
	Discharge ==> AUTO
	Suppose ==> Is_cnfSat_thryvar({{h0}} + {c - {tog(h0)}: c in S | h0 notin c})
		(h0, s)-->TcnfModels14(*) ==> false
	Discharge ==> AUTO
	h0-->TcnfModels0(*) ==> tog(tog(h0)) = h0
	EQUAL ==> Is_cnfSat_thryvar({{tog(h0)}} + {c - {tog(tog(h0))}: c in s | tog(h0) notin c})
	(tog(h0), s)-->TcnfModels14(*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels16: [pure literal rule, 2] (tog(H) notin Un(S)) imp (Is_cnfSat_thryvar(S) eq Is_cnfSat_thryvar({{H}} + {c in S | H notin c})). Proof:
Suppose_not(h0,s) ==> AUTO
--
-- Assume $h0,s$ to be a couterexample.
--
	(tog(h0),s)-->T105(*) ==> Stat1: {v in s | tog(h0) in v} = 0
	Use_def(Is_cnfSat_thryvar(s)) ==> AUTO
	Use_def(Is_cnfSat_thryvar({{h0}} + {c in s | h0 notin c})) ==> AUTO
	Suppose ==> Stat2: (EXISTS m | Has_cnfModel_thryvar({{h0}} + {d in s | h0 notin d}, m)) &
		(not(EXISTS m | Has_cnfModel_thryvar(s, m)))
--
-- The possibility that a model of ${{h0}} + {d in s | h0 notin d}$ be not a model
-- of $s$ will be discarded easily. In fact, it will satisfy all clauses in $s$
-- to which $h0$ belongs, as well as all other clauses in $s$.
--
		(m0,m0)-->Stat2(Stat2*) ==> Stat3: Has_cnfModel_thryvar({{h0}} + {d in s | h0 notin d}, m0) &
				(not Has_cnfModel_thryvar(s,m0))
		Use_def(Has_cnfModel_thryvar)(Stat3*) ==> Stat4: ({c in ({{h0}} + {d in s | h0 notin d}) | m0 * c = 0 } = 0) &
				({c in s | m0 * c = 0 } /= 0)
		({h0},c0)-->Stat4(Stat4*) ==> (h0 in m0) & (c0 in s) & (m0 * c0 = 0)
		c0-->Stat4(Stat4*) ==> Stat5: c0 notin {d in s | h0 notin d}
		c0-->Stat5(Stat4*) ==> false
	Discharge ==> Stat6: (EXISTS m | Has_cnfModel_thryvar(s, m)) &
		(not(EXISTS m | Has_cnfModel_thryvar({{h0}} + {d in s | h0 notin d}, m)))
--
-- The possibility that $s$ has a model $m1$ must be discarded also, by means of the following
-- more elaborate argument. If we replace $tog(h0)$ by $h0$ within $m1$,
-- we will get another model of $s$, which will model ${{h0}} + {d in s | h0 notin d}$ too.
--
	(m1,(m1 - {tog(h0)}) + {h0})-->Stat6(Stat6*) ==> Stat7: Has_cnfModel_thryvar(s, m1) &
		(not Has_cnfModel_thryvar({{h0}} + {d in s | h0 notin d}, (m1 - {tog(h0)}) + {h0}))
	Use_def(Has_cnfModel_thryvar)(Stat7*) ==> Stat8: ({k in m1 | tog(k) in m1} = 0) &
			Stat9: ({c in s | m1 * c = 0 } = 0) &
		(not(({k in ((m1 - {tog(h0)}) + {h0}) | tog(k) in ((m1 - {tog(h0)}) + {h0})} = 0) &
			({c in ({{h0}} + {d in s | h0 notin d}) | ((m1 - {tog(h0)}) + {h0}) * c = 0 } = 0)))
	Suppose ==> Stat10: {k in ((m1 - {tog(h0)}) + {h0}) | tog(k) in ((m1 - {tog(h0)}) + {h0})} /= 0
		h1-->Stat10(Stat10*) ==> Stat11: (h1 in ((m1 - {tog(h0)}) + {h0})) &
			(tog(h1) in ((m1 - {tog(h0)}) + {h0}))
		h0-->TcnfModels0(Stat12*) ==> Stat12: (tog(tog(h0)) = h0) & (tog(h0) /= h0)
		Suppose ==> h1 = h0
			EQUAL(Stat12) ==> tog(h1) = tog(h0)
		(Stat11*)Discharge ==> AUTO
		Suppose ==> tog(h1) = h0
			h1-->TcnfModels0(Stat12) ==> tog(tog(h1)) = h1
			EQUAL(Stat12) ==> tog(h0) = h1
		(Stat11*)Discharge ==> (h1 in m1) & (tog(h1) in m1)
		h1-->Stat8(Stat12*) ==> false
	Discharge ==> Stat13: {c in ({{h0}} + {d in s | h0 notin d}) | ((m1 - {tog(h0)}) + {h0}) * c = 0 } /= 0
		c1-->Stat13(Stat13*) ==> Stat14: (c1 in {d in s | h0 notin d}) & (((m1 - {tog(h0)}) + {h0}) * c1 = 0)
	d1-->Stat14(Stat14*) ==> (c1 in s) & ((m1 - {tog(h0)}) * c1 = 0)
	c1-->Stat1(Stat14*) ==> m1 * c1 = 0
	c1-->Stat9(Stat14*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels17: [unit literal rule, 0] (({H} in S) & Has_cnfModel_thryvar(S,M)) imp ((H in M) & (tog(H) notin M)). Proof:
Suppose_not(h0,s0,m0) ==> AUTO
	Use_def(Has_cnfModel_thryvar) ==> Stat1: ({c in s0 | (m0 * c) = 0} = 0) & Stat2: ({h in m0 | tog(h) in m0} = 0)
	({h0},h0)-->Stat1(*) ==> false
	Discharge ==> QED
--
Def cnfModels3: [finite satisfiability of a set of conjunctive normal forms, each represented as a set of sets of literals]
	Is_cnfFinSat_thryvar(P) := (FORALL f incin P | Finite(f) imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))
--
-- A finitely satisfiable set can be extended into a finitely satisfiable set by addition
-- of one of the two opposites $x,tog(x)$.
--
Theorem cnfModels18: Is_cnfFinSat_thryvar(P) imp Is_cnfFinSat_thryvar(P + {{{X}}}) or Is_cnfFinSat_thryvar(P + {{{tog(X)}}}). Proof:
Suppose_not(p0,x0) ==> AUTO
--
-- Arguing by contradiction, let $p0,x0$ be a counterexample to the claim,
-- so that unsatisfiable finite subsets $f0,f1$ of $p0 + {{{x0}}}$ and
-- $p0 + {{{tog(x0)}}}$, respectively, can be found. This means that
-- no model can satisfy all sets in $f0$ simultaneously
-- or can satisfy all sets in $f1$ simultaneously.
--
	Use_def(Is_cnfFinSat_thryvar) ==> Stat1: (not(FORALL f incin (p0 + {{{x0     }}}) | Finite(f) imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))) &
		                                 (not(FORALL f incin (p0 + {{{tog(x0)}}}) | Finite(f) imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m)))))
	(f0,f1)-->Stat1 ==> Stat2:
		(f0 incin (p0 + {{{x0     }}})) & Finite(f0) & Stat3: (not(EXISTS m | (FORALL s in f0 | Has_cnfModel_thryvar(s,m)))) &
		(f1 incin (p0 + {{{tog(x0)}}})) & Finite(f1) & Stat4: (not(EXISTS m | (FORALL s in f1 | Has_cnfModel_thryvar(s,m))))
--
-- Consider the set $f2 = (f0 - {{{x0}}}) + (f1 - {{{tog(x0)}}})$, which is finite
-- and included in $p0$ and therefore satisfiable (because $p0$ is finitely satisfiable).
--
	Loc_def ==> Stat5: f2 = (f0 - {{{x0}}}) + (f1 - {{{tog(x0)}}})
	(Stat2*)ELEM ==> p0 incs f2
	Suppose ==> (not Finite(f2))
		(f0,f0 - {{{x0}}})-->T189(Stat2,Stat2*) ==> Finite(f0 - {{{x0}}})
		(f1,f1 - {{{tog(x0)}}})-->T189(Stat2,Stat2*) ==> Finite(f1 - {{{tog(x0)}}})
		(f0 - {{{x0}}},f1 - {{{tog(x0)}}})-->T236(Stat5*) ==> Finite((f0 - {{{x0}}}) + (f1 - {{{tog(x0)}}}))
		EQUAL(Stat5) ==> false
	Discharge ==> AUTO
	Use_def(Is_cnfFinSat_thryvar) ==> Stat6: (FORALL f incin p0 | Finite(f) imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))
	f2-->Stat6(Stat5*) ==> Stat7: (EXISTS m | (FORALL s in f2 | Has_cnfModel_thryvar(s,m)))
--
-- If $m1$ is a model which satisfies all sets of sets in $f2$ simultaneously,
-- we can obtain a new model $m2$ by inserting $x0$ into it, unless $m1$
-- has $tog(x0)$ as a member, in which case we put $m2=m1$. It is easy to see
-- that $m2$ is a model of $f2$ which pronounces about the truth-value of $x0$.
--
	m1-->Stat7(Stat7*) ==> Stat8: (FORALL s in f2 | Has_cnfModel_thryvar(s,m1))
	Loc_def ==> Stat9: m2 = if tog(x0) notin m1 then m1 + {x0} else m1 end if
	Suppose ==> Stat10: not(FORALL s in f2 | Has_cnfModel_thryvar(s,m2))
		s-->Stat10(Stat10*) ==> (s in f2) & (not Has_cnfModel_thryvar(s,m2))
		s-->Stat8(Stat9*) ==> Has_cnfModel_thryvar(s,m1)
		(s,m1,m2)-->TcnfModels8(Stat9*) ==> Stat11: {h in m2 - m1 | tog(h) in m2} /= 0
		h-->Stat11(Stat11*) ==> Stat12: (h in m2 - m1) & (tog(h) in m2)
		x0-->TcnfModels0(Stat9,Stat12*) ==> Stat13: (h = x0) & (tog(x0) /= x0)
		EQUAL(Stat12) ==> Stat14: (x0 in m2 - m1) & (tog(x0) in m2)
	(Stat9,Stat13,Stat14*)Discharge ==> AUTO
	Use_def(Has_cnfModel_thryvar)(Stat9*) ==> Stat15: (FORALL s in f2 | ({h in m2 | tog(h) in m2} = 0) & ({c in s | (m2 * c) = 0} = 0))
	(Stat9,Stat9*)ELEM ==> (tog(x0) in m2) or (x0 in m2)
--
-- Observe that $f2$ cannot be empty, else $f0$ would be satisfiable.
-- As an immediate consequence, there no complementary pair appears in $m2$.
--
	Suppose ==> Stat16: f2 = 0
		Suppose ==> 0 = f0
			0-->Stat3(Stat16*) ==> not(FORALL s in f0 | Has_cnfModel_thryvar(s,0))
			EQUAL(Stat16) ==> Stat17: not(FORALL s in 0 | Has_cnfModel_thryvar(s,0))
			s4-->Stat17(Stat17*) ==> false
		Discharge ==> Stat18: 0 /= f0
		({x0})-->Stat3(Stat16*) ==> Stat19: not(FORALL s in f0 | Has_cnfModel_thryvar(s,{x0}))
		(Stat5,Stat16,Stat18*)ELEM ==> {{{x0}}} = f0
		t0-->Stat19(Stat19*) ==> (t0 = {{x0}}) & (not Has_cnfModel_thryvar(t0,{x0}))
		EQUAL(Stat19) ==> Stat20: (not Has_cnfModel_thryvar({{x0}},{x0}))
		Use_def(Has_cnfModel_thryvar)(Stat20*) ==> not(({h in {x0} | tog(h) in {x0}} = 0) & ({c in {{x0}} | ({x0} * c) = 0} = 0))
		Suppose ==> Stat21: {h in {x0} | tog(h) in {x0}} /= 0
			h1-->Stat21(Stat21*) ==> h1 = tog(h1)
			h1-->TcnfModels0(Stat21*) ==> false
		Discharge ==> AUTO
		(Stat19*)ELEM ==> Stat22: {c in {{x0}} | ({x0} * c) = 0} /= 0
		c5-->Stat22(Stat22*) ==> false
	Discharge ==> AUTO
	(arb(f2))-->Stat15(Stat15) ==> Stat23: {h in m2 | tog(h) in m2} = 0
--
-- Considering the two cases when $tog(x0) in m2$ and when $x0 in m2$ separately,
-- we will reach a contradiction in either case, thus reaching the conclusion
-- of the theorem. Assume the former case first. Since $m2$ models all sets
-- in $f2$, the only set in $f1$ which can be false in $m2$ is ${{tog(x0)}}$,
-- which is impossible since $tog(x0)$ belongs to $m2$.
--
	Suppose ==> tog(x0) in m2
		Suppose ==> Stat24: not(FORALL s in (f1 - {{{tog(x0)}}}) | {c in s | m2 * c = 0} = 0)
			s2-->Stat24(Stat5,Stat5*) ==> Stat25: ({c in s2 | m2 * c = 0} /= 0) & (s2 in f2)
			c2-->Stat25(Stat25*) ==> Stat26: (c2 in s2) & (m2 * c2 = 0)
			s2-->Stat15(Stat24*) ==> Stat27: c2 notin {c in s2 | m2 * c = 0}
			c2-->Stat27(Stat26*) ==> false
		Discharge ==> Stat28: (FORALL s in (f1 - {{{tog(x0)}}}) | {c in s | m2 * c = 0} = 0)
		m2-->Stat4(Stat2,Stat2*) ==> Stat29: not(FORALL s in f1 | Has_cnfModel_thryvar(s,m2))
		s1-->Stat29(Stat29*) ==> Stat30: (s1 in f1) & (not(Has_cnfModel_thryvar(s1,m2)))
		Use_def(Has_cnfModel_thryvar)(Stat30,Stat23*) ==> Stat31: {c in s1 | m2 * c = 0} /= 0
		s1-->Stat28(Stat30*) ==> s1 = {{tog(x0)}}
		c0-->Stat31(Stat23*) ==> false
	Discharge ==> AUTO
--
-- Likewise, we derive a contradiction from $x0 in m2$, because in this case
-- ${{x0}}$ would be the only candidate set for falsifiability by $m2$ within $f0$.
--
	(Stat15*)ELEM ==> x0 in m2
	Suppose ==> Stat32: not(FORALL s in (f0 - {{{x0}}}) | {c in s | m2 * c = 0} = 0)
		s3-->Stat32(Stat5,Stat5*) ==> Stat33: ({c in s3 | m2 * c = 0} /= 0) & (s3 in f2)
		c3-->Stat33(Stat33*) ==> Stat34: (c3 in s3) & (m2 * c3 = 0)
		s3-->Stat15(Stat32*) ==> Stat35: c3 notin {c in s3 | m2 * c = 0}
		c3-->Stat35(Stat34*) ==> false
	Discharge ==> Stat36: (FORALL s in (f0 - {{{x0}}}) | {c in s | m2 * c = 0} = 0)
	m2-->Stat3(Stat2,Stat2*) ==> Stat37: not(FORALL s in f0 | Has_cnfModel_thryvar(s,m2))
	s0-->Stat37(Stat37*) ==> Stat38: (s0 in f0) & (not(Has_cnfModel_thryvar(s0,m2)))
	Use_def(Has_cnfModel_thryvar)(Stat38,Stat23*) ==> Stat39: {c in s0 | m2 * c = 0} /= 0
	s0-->Stat36(Stat38*) ==> s0 = {{x0}}
	c6-->Stat39(Stat23*) ==> false
	Discharge ==> QED
--
-- Every finitely satisfiable set of sets of finite clauses admits a model
-- which satisfies all of its members simultaneously.
--
Theorem cnfModels19: [compactness of classical propositional logic] (Is_cnfFinSat_thryvar(P) & (FORALL s in P, c in s | Finite(c))) imp (EXISTS m | (FORALL s in P | Has_cnfModel_thryvar(s,m))). Proof:
Suppose_not(p0) ==> Is_cnfFinSat_thryvar(p0) & Stat1: (FORALL s in p0, c in s | Finite(c)) & Stat2: (not (EXISTS m | (FORALL s in p0 | Has_cnfModel_thryvar(s,m))))
--
-- Compactness: If $P$ is a finitely satisfiable set such that
--	$(FORALL s in P, c in s | Finite(c))$,
-- then $P$ is satisfiable.
--
-- Finite satisfiability is intended in the sense that for every finite subset $f$ of $P$ there exists a set $m_f$
-- such that both of the sets ${x in m_f | tog(x) in m_f}, {c: s in f, c in s | m_f * c = 0}$ equal the null set $0$.
--
-- Satisfiability is meant in the sense that there exists a set $m$
-- such that both of the sets ${x in m | tog(x) in m}, {c: s in P, c in s | m * c = 0}$ equal $0$.
--
-- As for $tog$, it is a function defined for all sets, such that
--	$(FORALL x | (tog(x) /= x) & (tog(tog(x)) = x))$.
--
-- Since $tog$ is global, it is not necessary to fix before the compactness theorem is stated
-- what is meant by literals: it will be convenient to define at the outset of its proof the
-- following set of so-called "literals":
--	$L = {x: s in P, c in s, y in c, x in {y, tog(y)}}$.
--
-- The Zorn lemma will be applied to the family $Sigma$ (partially ordered by set inclusion) formed
-- by those subsets $Q$ of $pow(pow(L))$ such that:
--	(1)	$Q$ includes $P$ as a subset;
--	(2)	$Q$ is finitely satisfiable.
--
-- We must show that every subchain $K$ of $Sigma$ has an upper bound in $Sigma$. If $K = 0$,
-- such an upper bound is $P$ (which, trivially, belongs to $Sigma$).
--
-- If $K$ is a non-void subchain of $Sigma$, it will suffice to show that $Un(K)$ belongs to $Sigma$.
-- It is obvious that $Un(K)$ includes $P$. As regards the finite satisfiability of $Un(K)$,
-- arguing by contradiction let us assume that $f$ is a finite subsets, not satisfiable,
-- of $Un(K)$. Since Theorem 239 guarantees the existence of a $Q0$ including $f$ in $K$,
-- the finite satisfiability of $Q0$, inscribed within the very definition of $Sigma$,
-- would be contradicted.
--
-- By the Zorn lemma, $Sigma$ has maximal elements: let $Q1$ be one of them. Then Theorem cnfModels18
-- ensures that, for every $x in L$, either ${{x}}$ or ${{tog(x)}}$ must belong to $Q1$
-- (the cannot belong together to $Q1$, else the finite satisfiability of $Q1$ would be violated).
-- Let us form the set $m = {x in L | {{x}} in Q1}$ and verify that it intersects every $c$
-- belonging to any $s$ belonging to $P$, which will demonstrate the compactness theorem,
-- since $m$ is a model of $P$. Suppose, arguing by contradiction, that $s1 in P$ and $c1 in s1$
-- are such that $m * c1 = 0$. Since $c1$ is finite, the set
--	${{{x}}: x in L | tog(x) in c1} + {s1}$
-- turns out to be a finite unsatisfiable subset of $Q1$. Here is the contradiction we were
-- aiming at.
--
	Loc_def ==> Stat3: lits = {x: s in p0, c in s, y in c, x in {y,tog(y)}}
	Loc_def ==> Stat4: sigm = {q incin pow(pow(lits)) | (p0 incin q) & Is_cnfFinSat_thryvar(q)}
	Suppose ==> p0 notin sigm
		EQUAL ==> Stat5: p0 notin {q incin pow(pow(lits)) | (p0 incin q) & Is_cnfFinSat_thryvar(q)}
		p0-->Stat5(*) ==> Stat6: p0 nincin pow(pow(lits))
		Use_def(pow(pow(lits))) ==> AUTO
		s0-->Stat6(Stat6*) ==> Stat7: (s0 notin {s: s incin pow(lits)}) & (s0 in p0)
		Use_def(pow(lits)) ==> AUTO
		s0-->Stat7(Stat7*) ==> Stat8: s0 nincin {c: c incin lits}
		c0-->Stat8(Stat8*) ==> Stat9: (c0 notin {c: c incin lits}) & (c0 in s0)
		c0-->Stat9(Stat9*) ==> Stat10: c0 nincin lits
		y0-->Stat10(Stat3,Stat3*) ==> Stat11: (y0 notin {x: s in p0, c in s, y in c, x in {y,tog(y)}}) & (y0 in c0)
		(s0,c0,y0,y0)-->Stat11(Stat7*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat12: not(FORALL x incin sigm | ((FORALL u in x, v in x | ((u incs v) or (v incs u))) imp (EXISTS w in sigm | (FORALL y in x | w incs y))))
		g0-->Stat12(Stat12*) ==> Stat13: (not(EXISTS w in sigm | (FORALL y in g0 | w incs y))) & (FORALL u in g0, v in g0 | ((u incs v) or (v incs u))) & (g0 incin sigm)
		Suppose ==> g0 = 0
			p0-->Stat13(Stat4*) ==> Stat14: not(FORALL y in g0 | p0 incs y)
			y1-->Stat14(Stat13*) ==> false
		Discharge ==> AUTO
		Loc_def ==> a0 = arb(g0)
		g0-->T0(Stat13*) ==> Stat15: (a0 in g0) & (a0 in sigm)
		(Stat4,Stat15*)ELEM ==> Stat16: a0 in {q incin pow(pow(lits)) | (p0 incin q) & Is_cnfFinSat_thryvar(q)}
		g0-->T274(Stat16*) ==> Stat17: (FORALL x in g0 | x incin Un(g0))
		Suppose ==> Un(g0) in sigm
			(Un(g0))-->Stat13(Stat17*) ==> Stat18: not(FORALL y in g0 | Un(g0) incs y)
			y2-->Stat18 ==> AUTO
			y2-->Stat17(Stat18*) ==> false
		Discharge ==> AUTO
		(Stat4*)ELEM ==> Stat19: Un(g0) notin {q incin pow(pow(lits)) | (p0 incin q) & Is_cnfFinSat_thryvar(q)}
		a0-->Stat17 ==> AUTO
		()-->Stat16(Stat15*) ==> p0 incin Un(g0)
		(Un(g0))-->Stat19(Stat19*) ==> Stat20: ((Un(g0) nincin pow(pow(lits))) or (not Is_cnfFinSat_thryvar(Un(g0))))
		Suppose ==> Un(g0) nincin pow(pow(lits))
			(g0,pow(pow(lits)))-->T274(Stat20*) ==> Stat21: not(FORALL x in g0 | x incin pow(pow(lits)))
			q2-->Stat21(Stat13,Stat4*) ==> Stat22: (q2 in {q incin pow(pow(lits)) | (p0 incin q) & Is_cnfFinSat_thryvar(q)}) & (q2 nincin pow(pow(lits)))
			()-->Stat22(Stat22*) ==> false
		Discharge ==> AUTO
		(Stat20*)ELEM ==> (not Is_cnfFinSat_thryvar(Un(g0)))
		Use_def(Is_cnfFinSat_thryvar)(Stat20*) ==> Stat23: not(FORALL f incin Un(g0) | Finite(f) imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))
		f0-->Stat23(Stat23*) ==> (f0 incin Un(g0)) & Finite(f0) & (not(EXISTS m | (FORALL s in f0 | Has_cnfModel_thryvar(s,m))))
		(g0,f0)-->T239(Stat13*) ==> Stat24: (EXISTS z in g0 | z incs f0)
		q0-->Stat24(Stat13,Stat4*) ==> Stat25: (q0 in {q incin pow(pow(lits)) | (p0 incin q) & Is_cnfFinSat_thryvar(q)}) & (q0 incs f0)
		Use_def(Is_cnfFinSat_thryvar(q0)) ==> AUTO
		()-->Stat25(Stat25*) ==> Stat26: (FORALL f incin q0 | Finite(f) imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))
		f0-->Stat26(Stat23*) ==> false
	Discharge ==> AUTO
	sigm-->T412(*) ==> Stat27: (EXISTS y in sigm | (FORALL x in sigm | not ((x incs y) & (x /= y))))
	q1-->Stat27(Stat27*) ==> Stat28: (FORALL x in sigm | not ((x incs q1) & (x /= q1))) & (q1 in sigm)
	Suppose ==> Stat29: not(FORALL x in lits | ({{x}} in q1) or ({{tog(x)}} in q1))
		x1-->Stat29(Stat29*) ==> Stat30: (x1 in lits) & ({{x1}} notin q1) & ({{tog(x1)}} notin q1)
--
-- Suppose that $({{x1}} notin q1) & ({{tog(x1)}} notin q1)$. Then the sets $(q1 + {{x1}})$ and $(q1 + {{{tog(x1)}}})$,
-- which are greater than $q1$ w.r.t. inclusion, will be finitely satisfiable by Theorem cnfModels18.
-- This contradicts the maximality of $q1$
--
		(Stat28,Stat4*)ELEM ==> Stat31: q1 in {q incin pow(pow(lits)) | (p0 incin q) & Is_cnfFinSat_thryvar(q)}
		()-->Stat31(Stat31*) ==> (q1 incin pow(pow(lits))) & (p0 incin q1) & Is_cnfFinSat_thryvar(q1)
		(q1,x1)-->TcnfModels18(Stat31*) ==> Is_cnfFinSat_thryvar(q1 + {{{x1}}}) or Is_cnfFinSat_thryvar(q1 + {{{tog(x1)}}})
--
-- In the following we show that indeed both $(q1 + {{x1}})$ and $(q1 + {{{tog(x1)}}})$ belong to $sigm$
--
		(Stat31*)ELEM ==> Stat32: (p0 incin (q1 + {{{x1}}})) & (p0 incin (q1 + {{{tog(x1)}}}))
--
		(x1,lits)-->T214(Stat30,Stat30*) ==> {x1} in pow(lits)
		({x1},pow(lits))-->T214(Stat32*) ==> {{{x1}}} incin pow(pow(lits))
--
		Suppose ==> Stat33: tog(x1) notin lits
			EQUAL(Stat33, Stat3) ==> Stat34: tog(x1) notin {x: s in p0, c in s, y in c, x in {y,tog(y)}}
			EQUAL(Stat30, Stat3) ==> Stat35: x1 in {x: s in p0, c in s, y in c, x in {y,tog(y)}}
			(s3,c3,y3,x3)-->Stat35(Stat35*) ==> Stat36: (s3 in p0) & (c3 in s3) & (y3 in c3) & (x1 in {y3, tog(y3)})
			(Stat36)ELEM ==> (x1 = y3) or (x1 = tog(y3))
			Suppose ==> x1 = y3
				EQUAL(Stat36) ==> tog(x1) in {y3, tog(y3)}
				(s3,c3,y3,tog(x1))-->Stat34(Stat35*) ==> false
			Discharge ==> AUTO
			(Stat36*)ELEM ==> Stat37: x1 = tog(y3)
			Assump ==> Stat38: (FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
			(y3)-->Stat38(Stat38*) ==> tog(tog(y3)) = y3
			EQUAL(Stat37) ==> tog(x1) in {y3, tog(y3)}
			(s3,c3,y3,tog(x1))-->Stat34(Stat35*) ==> false
		Discharge ==> AUTO
--
		(tog(x1),lits)-->T214(Stat32*) ==> {tog(x1)} in pow(lits)
		({tog(x1)},pow(lits))-->T214(Stat32*) ==> {{{tog(x1)}}} incin pow(pow(lits))
--
		(Stat29*)ELEM ==> Stat39: ((q1 + {{{x1}}}) incin pow(pow(lits))) & ((q1 + {{{tog(x1)}}}) incin pow(pow(lits)))
--
-- Suppose now that $Is_cnfFinSat_thryvar(q1 + {{{x1}}})$.
-- As $q1 + {{{x1}}} incs q1$ we arrive at a contradiction regarding the maximality of $q1$.
--
		Suppose ==> Is_cnfFinSat_thryvar(q1 + {{{x1}}})
			(Stat30*)ELEM ==> q1 + {{{x1}}} /= q1
			Suppose ==> Stat40: (q1 + {{{x1}}}) notin sigm
				EQUAL(Stat40, Stat4) ==> Stat41: (q1 + {{{x1}}}) notin {q incin pow(pow(lits)) | (p0 incin q) & Is_cnfFinSat_thryvar(q)}
				(q1 + {{{x1}}})-->Stat41(Stat29) ==> false
			Discharge ==> AUTO
			(q1 + {{{x1}}})-->Stat28(Stat39) ==> false
		Discharge ==> AUTO
--
-- In an analogous manner we treat the case $Is_cnfFinSat_thryvar(q1 + {{{tog(x1)}}})$.
--
		(Stat30*)ELEM ==> q1 + {{{tog(x1)}}} /= q1
		Suppose ==> Stat42: (q1 + {{{tog(x1)}}}) notin sigm
			EQUAL(Stat42, Stat4) ==> Stat43: (q1 + {{{tog(x1)}}}) notin {q incin pow(pow(lits)) | (p0 incin q) & Is_cnfFinSat_thryvar(q)}
			(q1 + {{{tog(x1)}}})-->Stat43(Stat29) ==> false
		Discharge ==> AUTO
		(q1 + {{{tog(x1)}}})-->Stat28(Stat39) ==> false
	Discharge ==> Stat44: (FORALL x in lits | ({{x}} in q1) or ({{tog(x)}} in q1))
--
--
--
-- redundant
	(Stat28,Stat4*)ELEM ==> Stat45: q1 in {q incin pow(pow(lits)) | (p0 incin q) & Is_cnfFinSat_thryvar(q)}
	Use_def(Is_cnfFinSat_thryvar(q1)) ==> AUTO
	()-->Stat45(Stat45*) ==> (q1 incin pow(pow(lits))) & (p0 incin q1) & Stat46: (FORALL f incin q1 | Finite(f) imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))
-- /redundant
--
	Loc_def ==> Stat47: m0 = {x in lits | {{x}} in q1}
	Suppose ==> Stat48: not (FORALL s in p0 | Has_cnfModel_thryvar(s,m0))
		(s1)-->Stat48(Stat48*) ==> (s1 in p0) & (not Has_cnfModel_thryvar(s1,m0))
-- from $s1 in p0$ and $p0 incin q1$ we have $s1 in q1$
		(Stat45*)ELEM ==> Stat49: s1 in q1
		Use_def(Has_cnfModel_thryvar)(Stat48*) ==> ({h in m0 | tog(h) in m0} /= 0) or ({c in s1 | (m0 * c) = 0} /= 0)
		Suppose ==> Stat50: ({h in m0 | tog(h) in m0} /= 0)
			(h1)-->Stat50(Stat50*) ==> (h1 in m0) & (tog(h1) in m0)
			EQUAL(Stat47) ==> Stat51: (h1 in {x in lits | {{x}} in q1}) & Stat52: (tog(h1) in {x in lits | {{x}} in q1})
			()-->Stat51(Stat51*) ==> (h1 in lits) & ({{h1}} in q1)
			()-->Stat52(Stat51*) ==> (tog(h1) in lits) & ({{tog(h1)}} in q1)
--
--
--
			({{h1}}, {{tog(h1)}})-->T202 ==> Finite({{{h1}}, {{tog(h1)}}})
			(Stat51)ELEM ==> {{{h1}}, {{tog(h1)}}} incin q1
			({{{h1}}, {{tog(h1)}}})-->Stat46(Stat48) ==> Stat53: (EXISTS m | (FORALL s in {{{h1}}, {{tog(h1)}}} | Has_cnfModel_thryvar(s,m)))
			(m1)-->Stat53(Stat53*) ==> Stat54: (FORALL s in {{{h1}}, {{tog(h1)}}} | Has_cnfModel_thryvar(s,m1))
			({{h1}})-->Stat54(Stat54*) ==> Has_cnfModel_thryvar({{h1}},m1)
			({{tog(h1)}})-->Stat54(Stat54*) ==> Has_cnfModel_thryvar({{tog(h1)}},m1)
			Use_def(Has_cnfModel_thryvar)(Stat54*) ==> Stat55: ({h in m1 | tog(h) in m1} = 0) & Stat56: ({c in {{h1}} | (m1 * c) = 0} = 0) & Stat57: ({c in {{tog(h1)}} | (m1 * c) = 0} = 0)
			({h1})-->Stat56(Stat55*) ==> h1 in m1
			({tog(h1)})-->Stat57(Stat55*) ==> tog(h1) in m1
			(h1)-->Stat55(Stat55*) ==> false
		Discharge ==> Stat58: {c in s1 | (m0 * c) = 0} /= 0
--
-- It remains to be seen that $({c in s1 | (m0 * c) = 0} /= 0)$. It this were not the case,
-- then we could pick a $c1 in s1$ not intersecting $m0$. Since $c1$ is finite, so is
-- ${{{x}}: x in lits | tog(x) in c1} + {s1}$, which is a subset of $p0$; but this would be
-- a finite unsatisfiable set of $p0$, which conflicts with the assumtion that $q1$ is
-- finitely satisfiable. This contradiction, allowing us to discharge the pending supposition,
-- readily leads us to the desired conclusion.
--
		(c1)-->Stat58(Stat58*) ==> (c1 in s1) & ((m0 * c1) = 0)
		(s1, c1)-->Stat1(Stat48*) ==> Finite(c1)
		TELEM ==> Svm({[x,{{tog(x)}}]: x in c1}) & (range({[x,{{tog(x)}}]: x in c1}) = {{{tog(x)}}: x in c1}) & (domain({[x,{{tog(x)}}]: x in c1}) = c1)
		EQUAL(Stat58) ==> Finite(domain({[x,{{tog(x)}}]: x in c1}))
		({[x,{{tog(x)}}]: x in c1})-->T192(Stat58*) ==> Finite(range({[x,{{tog(x)}}]: x in c1}))
		({{{tog(x)}}: x in c1},s1)-->T199 ==> AUTO
		EQUAL(Stat58) ==> Stat59: Finite({{{tog(x)}}: x in c1} + {s1})
		Suppose ==> Stat60: ({{{tog(x)}}: x in c1} + {s1}) nincin q1
			s4-->Stat60(Stat49,Stat49*) ==> Stat61: (s4 in {{{tog(x)}}: x in c1}) & (s4 notin q1)
			x4-->Stat61(Stat58*) ==> Stat62: (x4 in c1) & ({{tog(x4)}} notin q1) & (x4 notin m0)
			Suppose ==> Stat63: x4 notin {x: s in p0, c in s, y in c, x in {y,tog(y)}}
				(s1,c1,x4,x4)-->Stat63(Stat48*) ==> false
			Discharge ==> Stat64: x4 in {x: s in p0, c in s, y in c, x in {y,tog(y)}}
			EQUAL(Stat3,Stat64,Stat62,Stat47) ==> Stat65: (x4 notin {x in lits | {{x}} in q1}) & (x4 in lits)
			x4-->Stat44(Stat65,Stat62*) ==> {{x4}} in q1
			x4-->Stat65(Stat65*) ==> false
		Discharge ==> AUTO
		({{{tog(x)}}: x in c1} + {s1})-->Stat46(Stat59*) ==> Stat66: (EXISTS m | (FORALL s in ({{{tog(x)}}: x in c1} + {s1}) | Has_cnfModel_thryvar(s,m)))
		m2-->Stat66(Stat66*) ==> Stat67: (FORALL s in ({{{tog(x)}}: x in c1} + {s1}) | Has_cnfModel_thryvar(s,m2))
		Use_def(Has_cnfModel_thryvar(s1,m2)) ==> AUTO
		s1-->Stat67(Stat67*) ==> Stat68: ({c in s1 | (m2 * c) = 0} = 0) & Stat69: ({h in m2 | tog(h) in m2} = 0)
		c1-->Stat68(Stat58*) ==> Stat70: m2 * c1 /= 0
		h3-->Stat70(Stat70*) ==> (h3 in c1) & (h3 in m2)
		Suppose ==> Stat71: {{tog(h3)}} notin {{{tog(x)}}: x in c1}
			h3-->Stat71(Stat70*) ==> false
		Discharge ==> AUTO
		Use_def(Has_cnfModel_thryvar({{tog(h3)}},m2)) ==> AUTO
		({{tog(h3)}})-->Stat67(Stat70*) ==> Stat72: {c in {{tog(h3)}} | (m2 * c) = 0} = 0
		({tog(h3)})-->Stat72(Stat72*) ==> tog(h3) in m2
		h3-->Stat69(Stat70*) ==> false
	Discharge ==> AUTO
	(m0)-->Stat2(Stat47*) ==> false
Discharge ==> QED
--
-- OLD THEOREMS, TO BE ELIMINATED FROM THIS THEORY:
--
--
--
--
Theorem cnfModels20: [broadening of cnf-model, 2] (Has_cnfModel_thryvar(S,M) & (N incs M) & Has_cnfModel_thryvar(T,N)) imp Has_cnfModel_thryvar(S,N). Proof:
Suppose_not(s,m,n,t) ==> AUTO
	Set_monot ==> {h in n | tog(h) in n} incs {h in (n - m) | tog(h) in n}
	Use_def(Has_cnfModel_thryvar) ==> {h in (n - m) | tog(h) in n} = 0
	(s,m,n)-->TcnfModels8(*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels21: [shrinking of cnf_model, 2] (Has_cnfModel_thryvar(S,M) & (H notin Un(S))) imp (Has_cnfModel_thryvar(S, M - {H})). Proof:
Suppose_not(s,m,h0)==> AUTO
	(s,m)-->TcnfModels7(*) ==> Has_cnfModel_thryvar(s,m * Un(s))
	Use_def(Has_cnfModel_thryvar) ==> {h in m | tog(h) in m} = 0
	Set_monot ==> {h in m | tog(h) in m} incs {h in (m - {h0}) | tog(h) in (m - {h0})}
	ELEM ==> {h in (m - {h0}) | tog(h) in (m - {h0})} = 0
	(m - {h0})-->TcnfModels1(*) ==> Has_cnfModel_thryvar(0, m - {h0})
	(s,m * Un(s),m - {h0},0)-->TcnfModels20(*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels22: [broadening of cnf_model, 3] ({H,tog(H)} * M = 0) imp (Has_cnfModel_thryvar(0,M) eq Has_cnfModel_thryvar(0, M + {H})). Proof:
Suppose_not(hh,m) ==> AUTO
	Suppose ==> Stat1: Has_cnfModel_thryvar(0,m)
		Use_def(Has_cnfModel_thryvar) ==> ({h in m | tog(h) in m} = 0) & (not Has_cnfModel_thryvar(0,m+{hh}))
		(0,m,m+{hh})-->TcnfModels8(Stat1*) ==> Stat2: {h in ((m+{hh})-m) | tog(h) in (m + {hh})} /= 0
		c1-->Stat2(Stat2*) ==> (c1 = hh) & (tog(c1) in (m + {hh}))
		EQUAL(Stat2) ==> tog(hh) in (m + {hh})
		hh-->TcnfModels0(Stat2*) ==> tog(hh) /= hh
	Discharge ==> AUTO
--
-- Hence we have
--	$Has_cnfModel_thryvar(0,m+{hh}) & (not Has_cnfModel_thryvar(0,m))$,
-- but this will also lead to a contradiction.
--
	(m + {hh})-->TcnfModels1 ==> Stat3: {h in (m + {hh}) | tog(h) in (m + {hh})} = 0
	m-->TcnfModels1 ==> Stat4: {h in m | tog(h) in m} /= 0
	h1-->Stat4(Stat4) ==> (h1 in m) & (tog(h1) in m)
	h1-->Stat3(Stat4) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels23: [disjunctive tautology] {h in C | tog(h) in C} incin {h in C | Has_cnfModel_thryvar({C},{h}) & Has_cnfModel_thryvar({C},{tog(h)})}. Proof:
Suppose_not(d) ==> Stat1: not({h in d | tog(h) in d} incin {h in d | Has_cnfModel_thryvar({d},{h}) & Has_cnfModel_thryvar({d},{tog(h)})})
	k-->Stat1(Stat1*) ==> Stat2: (k in d) & (tog(k) in d) & ((not(Has_cnfModel_thryvar({d},{k}))) or (not(Has_cnfModel_thryvar({d},{tog(k)}))))
	Suppose ==> Stat3: not(Has_cnfModel_thryvar({d},{k}))
		Use_def(Has_cnfModel_thryvar)(Stat3*) ==> ({h in {k} | tog(h) in {k}} /= 0) or ({c in {d} | ({k} * c) = 0} /= 0)
		Suppose ==>  Stat4: {h in {k} | tog(h) in {k}} /= 0
			j-->Stat4(Stat4*) ==> Stat5: j = tog(j)
		j-->TcnfModels0(Stat4*) ==> false; Discharge ==> Stat6: {c in {d} | ({k} * c) = 0} /= 0
	c-->Stat6(Stat2,Stat2*) ==> false; Discharge ==> not(Has_cnfModel_thryvar({d},{tog(k)}))
	Use_def(Has_cnfModel_thryvar)(Stat3*) ==> ({h in {tog(k)} | tog(h) in {tog(k)}} /= 0) or ({c in {d} | ({tog(k)} * c) = 0} /= 0)
	Suppose ==> Stat7: {h in {tog(k)} | tog(h) in {tog(k)}} /= 0
		j1-->Stat7(Stat7*) ==> (j1 = tog(k)) & (tog(j1) = tog(k))
		EQUAL(Stat7) ==> Stat8: tog(k) = tog(tog(k))
	(tog(k))-->TcnfModels0(Stat8*) ==> false; Discharge ==> Stat9: {c in {d} | ({tog(k)} * c) = 0} /= 0
	c1-->Stat9(Stat2,Stat2*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels24: [disjunctive tautology, 2] ((H in C) & (tog(H) in C)) imp (Has_cnfModel_thryvar({C},{H}) & Has_cnfModel_thryvar({C},{tog(H)})). Proof:
Suppose_not(k,d) ==> AUTO
	d-->TcnfModels23 ==> AUTO
	Suppose ==> Stat1: k notin {h in d | tog(h) in d}
	()-->Stat1(*) ==> false; Discharge ==> Stat2: k in {h in d | Has_cnfModel_thryvar({d},{h}) & Has_cnfModel_thryvar({d},{tog(h)})}
	()-->Stat2(*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels25: [tautology withdrawal rule, 2] ({c: c in S, h in c | tog(h) in c} incs T) imp (Is_cnfSat_thryvar(S) eq Is_cnfSat_thryvar(S - T)). Proof:
Suppose_not(s,t) ==> Stat1: ({c: c in S, h in c | tog(h) in c} incs T) & (not (Is_cnfSat_thryvar(S) eq Is_cnfSat_thryvar(S - T)))
	Suppose ==> Is_cnfSat_thryvar(s) & (not Is_cnfSat_thryvar(s - t))
		Use_def(Is_cnfSat_thryvar) ==> Stat2: (EXISTS m | Has_cnfModel_thryvar(s,m)) & (not(EXISTS m | Has_cnfModel_thryvar(s - t,m)))
		(m,m)-->Stat2(Stat2*) ==> Has_cnfModel_thryvar(s,m) & (not Has_cnfModel_thryvar(s - t,m))
		Use_def(Has_cnfModel_thryvar) ==> Stat3: ({c in (s - t) | (m * c) = 0} /= 0) & ({c in s | (m * c) = 0} = 0)
--
-- we will now show that Has_cnfModel_thryvar(s - t, m), which comes to ${c in (s - t) | (m * c) = 0} = 0$
--
	(cc,cc)-->Stat3(Stat3*) ==> false; Discharge ==> Is_cnfSat_thryvar(s - t) & (not Is_cnfSat_thryvar(s))
--
	Use_def(Is_cnfSat_thryvar) ==> Stat4: (EXISTS m | Has_cnfModel_thryvar(s - t,m))
	(n)-->Stat4(Stat4*) ==> Has_cnfModel_thryvar(s - t,n)
--
-- we will use Theorem cnfModels15, by enriching $s - t$ with $t$
-- {arb({h,tog(h)}): c in T, h in (c - M) | tog(h) in (c - M)}
--
	(s - t, n, t)-->TcnfModels10(*) ==> Has_cnfModel_thryvar((s - t) + {c: c in t, h in c | tog(h) in c}, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)})

--
-- We will now show that ${c: c in t, h in c | tog(h) in c} = t$, and hence (since plainly $s incs t$ holds)
-- ...
--
	Suppose ==> Stat5: {c: c in t, h in c | tog(h) in c} /= t
--
-- For this to take place, we have a priori two possibilities, one of which gets immediately discarded.
-- On the other hand, if there could exist an $x in t$ such that $x notin {c: c in t, h in c | tog(h) in c}$,
-- then $x in {c: c in s, h in c | tog(h)}$ should hold; which would, however, lead to a contradiction.
-- We hence draw that ${c: c in t, h in c | tog(h) in c} = t$...
--
		x-->Stat5(Stat5*) ==> Stat6: (x in {c: c in t, h in c | tog(h) in c}) eq (x notin t)
		Suppose ==> Stat7: x in {c: c in t, h in c | tog(h) in c}
		(c0,h0)-->Stat7(Stat6*) ==> false; Discharge ==> Stat8: (x in {c: c in s, h in c | tog(h) in c}) & (x notin {c: c in t, h in c | tog(h) in c})
	(c1,h1,c1,h1)-->Stat8(Stat6*) ==> false; Discharge ==> Stat9: {c: c in t, h in c | tog(h) in c} = t
--
-- ...and now that ${c: c in t, h in c | tog(h) in c} = t$, we can write
-- $Has_cnfModel_thryvar((s - t) + t, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)}) eq Has_cnfModel_thryvar(s, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)})$.
--

	Use_def(Is_cnfSat_thryvar) ==> Stat10: not (EXISTS m | Has_cnfModel_thryvar(s,m))
	EQUAL(Stat9*) ==> Has_cnfModel_thryvar((s - t) + {c: c in t, h in c | tog(h) in c}, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)}) eq
	Has_cnfModel_thryvar((s - t) + t, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)})
	Suppose ==> Stat11: not (s incs t)
		c2-->Stat11(Stat11*) ==> Stat12: (c2 in t) & (c2 notin s)
		(Stat1, Stat12*)ELEM ==> Stat13: c2 in {c: c in s, h in c | tog(h) in c}
		(c3, h3)-->Stat13(Stat12*) ==> false
	Discharge ==> Stat14: s incs t
	(Stat14*)ELEM ==> Stat15: (s - t) + t = s
	EQUAL(Stat15*) ==> Has_cnfModel_thryvar((s - t) + t, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)}) eq
			Has_cnfModel_thryvar(s, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)})
			(n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)})-->Stat10(Stat9*) ==> not Has_cnfModel_thryvar(s, n + {arb({h, tog(h)}): c in t, h in (c-n) | tog(h) in (c-n)})
	Discharge ==> QED
--
--
--
Theorem cnfModels26: [pure literal rule] ((H in Un(S)) & (tog(H) notin Un(S)) & Has_cnfModel_thryvar(0,M) & (not(Has_cnfModel_thryvar({{H,tog(H)}},M)))) imp (Has_cnfModel_thryvar(S, M + {H}) eq Has_cnfModel_thryvar({c in S | H notin c}, M)). Proof:
Suppose_not(h0,s,m) ==> AUTO
--
-- Preamble making the negation of the desired conclusion more explicit.
--
	(h0,s)-->T105(*) ==> Stat1: {v in s | h0 in v} /= 0
	(tog(h0),s)-->T105(*) ==> Stat2: {d in s | tog(h0) in d} = 0
	cc-->Stat1(*) ==> Stat3: (h0 in cc) & (cc in s) &
	Stat4: ({d in s | tog(h0) in d} = 0) & Has_cnfModel_thryvar(0,m) & (not(Has_cnfModel_thryvar({{h0,tog(h0)}},m))) & (not (Has_cnfModel_thryvar(s, m + {h0}) eq Has_cnfModel_thryvar({c in s | h0 notin c}, m)))
--
-- by rewriting $not(Has_cnfModel_thryvar({{H,tog(H)}},M))$, we have $(h0 notin m) & (tog(h0) notin m)$
--
	Use_def(Has_cnfModel_thryvar)(Stat3*) ==> Stat5: {c in {{h0, tog(h0)}} | (m * c) = 0} /= 0
	c0-->Stat5(Stat5*) ==> Stat6: (h0 notin m) & (tog(h0) notin m)
--
	Suppose ==> Has_cnfModel_thryvar(s, m + {h0})
		(s, m + {h0}, h0)-->TcnfModels12(Stat3*) ==> (Has_cnfModel_thryvar({c - {tog(h0)}: c in s | h0 notin c} + {{h0}}, m + {h0} + {h0}) or Has_cnfModel_thryvar({c - {h0}: c in S | tog(h0) notin c} + {{tog(h0)}}, m + {h0} + {tog(h0)}))
--
-- we rule out the second case, as $m + {h0} + {tog(h0)}$ cannot be a model
--
		Suppose ==> Stat7: Has_cnfModel_thryvar({c - {h0}: c in S | tog(h0) notin c} + {{tog(h0)}}, m + {h0} + {tog(h0)})
			Use_def(Has_cnfModel_thryvar)(Stat7*) ==> Stat8: {h in (m + {h0} + {tog(h0)}) | tog(h) in (m + {h0} + {tog(h0)})} = 0
			h0-->Stat8(Stat8*) ==> false
		Discharge ==> Stat9: Has_cnfModel_thryvar({c - {tog(h0)}: c in s | h0 notin c} + {{h0}}, m + {h0} + {h0})
--
		TELEM ==> m + {h0} + {h0} = m + {h0}
		EQUAL(Stat9*) ==> Stat10: Has_cnfModel_thryvar({c - {tog(h0)}: c in s | h0 notin c} + {{h0}}, m + {h0})

		({c - {tog(h0)}: c in s | h0 notin c}, {c - {tog(h0)}: c in s | h0 notin c} + {{h0}}, m + {h0})-->TcnfModels5(Stat10*) ==>
			Stat11: Has_cnfModel_thryvar({c - {tog(h0)}: c in s | h0 notin c}, m + {h0})

		Suppose ==> Stat12: ({c - {tog(h0)}: c in s | h0 notin c}) /= ({c: c in s | h0 notin c})
			c3-->Stat12(Stat12*) ==> Stat13: (c3 in s) & ((c3 -  {tog(h0)}) /= c3)
--
-- therefore $tog(h0) in c3$, and from the hypothesis we get a contradiction
--
			c3-->Stat4(Stat13*) ==> false
		Discharge ==> {c - {tog(h0)}: c in s | h0 notin c} = {c: c in s | h0 notin c}
		EQUAL ==> Has_cnfModel_thryvar({c: c in s | h0 notin c}, m + {h0})

		Suppose ==> Stat14: h0 in Un({c: c in s | h0 notin c})
			(h0,{c: c in s | h0 notin c})-->T105(Stat14*) ==> Stat15: {d in {c: c in s | h0 notin c} | h0 in d} /= 0
			c1-->Stat15(Stat15*) ==> Stat16: (c1 in {c: c in s | h0 notin c}) & (h0 in c1)
			(c2)-->Stat16(Stat16*) ==> false
		Discharge ==> AUTO
--
		({c: c in s | h0 notin c}, m + {h0}, h0)-->TcnfModels21(Stat11) ==> Stat17: Has_cnfModel_thryvar({c: c in s | h0 notin c}, (m + {h0}) - {h0})
-- $h0 notin m$ and hence
		ELEM ==> (m + {h0}) - {h0} = m
		EQUAL ==> false
	Discharge ==> Has_cnfModel_thryvar({c in s | h0 notin c}, m)

--
-- the reverse implication
--

	Use_def(Has_cnfModel_thryvar) ==> ({h in m | tog(h) in m} = 0) & Stat18: ({c in {c in s | h0 notin c} | (m * c) = 0} = 0)
	Use_def(Has_cnfModel_thryvar) ==> ({h in (m + {h0}) | tog(h) in (m + {h0})} /= 0) or ({c in s | ((m + {h0}) * c) = 0} /= 0)
--
-- we analyse the two cases
--
	Suppose ==> Stat19: ({h in (m + {h0}) | tog(h) in (m + {h0})} /= 0)
		h3-->Stat19(Stat19*) ==> (h3 in (m + {h0})) & (tog(h3) in (m + {h0}))
		Use_def(Has_cnfModel_thryvar) ==> Stat20: {h in m | tog(h) in m} = 0
		h3-->TcnfModels0(Stat20*) ==> Stat21: (tog(tog(h3)) = h3) & (tog(h3) /= h3)
--
-- since $h3$ and $tog(h3)$ cannot be both in $m$, we have the two cases,
-- which are quickly discharged by the fact that $(h0 notin m) & (tog(h0) notin m)$
--
		h3-->Stat20(Stat19*) ==> (h3 = h0) or (tog(h3) = h0)
		Suppose ==> Stat22: h3 = h0
			EQUAL ==> false
		Discharge ==> Stat23: tog(h3) = h0
		EQUAL ==> false
	Discharge ==> Stat24: ({c in s | ((m + {h0}) * c) = 0} /= 0)
--
-- it remains that
--
	c4-->Stat24(Stat24*) ==> (c4 in s) & Stat25: (((m + {h0}) * c4) = 0)
--
-- we will show that $c4 in {c in s | h0 notin c}$, and as $(m * c4) = 0$ we get a contradiction
--
	Suppose ==> Stat26: c4 notin {c in s | h0 notin c}
		c4-->Stat26(Stat24*) ==> false
	Discharge ==> AUTO
	c4-->Stat18(Stat24*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels27: [unit literal rule] (({H} in S) & Has_cnfModel_thryvar(0,M) & ({H,tog(H)} * M = 0)) imp (Has_cnfModel_thryvar(S, M + {H}) eq Has_cnfModel_thryvar({c - {tog(H)}: c in S | H notin c}, M)). Proof:
Suppose_not(hh,s,m) ==> AUTO
--
-- let's consider the reverse implication
--
	Suppose ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m)
		Use_def(Has_cnfModel_thryvar) ==> Stat1: ({h in m | tog(h) in m} = 0) & Stat2: ({c in {c - {tog(hh)}: c in s | hh notin c} | (m * c) = 0} = 0) &
			(({h in (m + {hh}) | tog(h) in (m + {hh})} /= 0) or ({c in s | ((m + {hh}) * c) = 0} /= 0))
--
-- suppose that $not Has_cnfModel_thryvar(0, m + {hh})$ by this contradicts $Stat3
--
		Suppose ==> Stat4: ({h in (m + {hh}) | tog(h) in (m + {hh})} /= 0)
			(m + {hh})-->TcnfModels1(Stat4*) ==> not Has_cnfModel_thryvar(0, m + {hh})
			(hh, m)-->TcnfModels22(*) ==> false
		Discharge ==> Stat5: {c in s | ((m + {hh}) * c) = 0} /= 0
		c0-->Stat5(Stat5*) ==> (c0 in s) & (((m + {hh}) * c0) = 0)
		ELEM ==> (hh notin c0) & ((m * (c0 - tog(hh))) = 0)
		Suppose ==> Stat6: (c0 - {tog(hh)}) notin {c - {tog(hh)}: c in s | hh notin c}
			c0-->Stat6(*) ==> false
		Discharge ==> (c0 - {tog(hh)}) in {c - {tog(hh)}: c in s | hh notin c}
		(c0 - {tog(hh)})-->Stat2(Stat5*) ==> false
	Discharge ==> Has_cnfModel_thryvar(s, m + {hh})
--
-- the remaining case
--
	Use_def(Has_cnfModel_thryvar) ==> Stat7: ({h in (m + {hh}) | tog(h) in (m + {hh})} = 0) & Stat8: ({c in s | ((m + {hh}) * c) = 0} = 0) &
		(({h in m | tog(h) in m} /= 0) or ({c in {c - {tog(hh)}: c in s | hh notin c} | (m * c) = 0} /= 0))
--
-- again $not Has_cnfModel_thryvar(0, m)$ leads to a contradiction
--
	Suppose ==> {h in m | tog(h) in m} /= 0
		m-->TcnfModels1(Stat7*) ==> not Has_cnfModel_thryvar(0, m)
		(hh, m)-->TcnfModels11(*) ==> false
	Discharge ==> Stat9: {c in {c - {tog(hh)}: c in s | hh notin c} | (m * c) = 0} /= 0
--
	c10-->Stat9(Stat9*) ==> Stat10: (c10 in {c - {tog(hh)}: c in s | hh notin c}) & ((m * c10) = 0)
	c1-->Stat10(Stat10*) ==> (c10 = c1 - {tog(hh)}) & (c1 in s) & (hh notin c1)
	Suppose ==> Stat11: (c1 * (m + {hh})) /= 0
		h0-->Stat11(Stat11*) ==> (h0 in c1) & (h0 in (m + {hh}))
--
-- by rewriting $not(Has_cnfModel_thryvar({{H,tog(H)}},M))$, we have $(hh notin m) & (tog(hh) notin m)$
--
		Use_def(Has_cnfModel_thryvar) ==> Stat12: {c in {{hh, tog(hh)}} | (m * c) = 0} /= 0
		c5-->Stat12(Stat12) ==> (c5 in {{hh, tog(hh)}}) & ((m * c5) = 0)
		ELEM ==> Stat13: m * {hh, tog(hh)} = 0
		Suppose ==> (hh in m) or (tog(hh) in m)
			(hh)-->Stat13(Stat13) ==> tog(hh) in m
			(tog(hh))-->Stat13(Stat13) ==> false
		Discharge ==> (hh notin m) & (tog(hh) notin m)
--
-- It elementarily follows from what precedes that $h0 in m$ and $h0 in c10$;
-- but this conflicts with the second part of Stat14
--
	(Stat10*)Discharge ==> (c1 * (m + {hh})) = 0
--
-- $c1$ generates the contradiction for Stat8
--
	c1-->Stat8(Stat10*) ==> false
	Discharge ==> QED
--
--
--
Theorem cnfModels28: [unit literal rule, 2] ({H} in S) imp (Is_cnfSat_thryvar(S) eq Is_cnfSat_thryvar({c - {tog(H)}: c in S | H notin c})). Proof:
Suppose_not(hh,s) ==> AUTO
	Suppose ==> Is_cnfSat_thryvar(s)
		Use_def(Is_cnfSat_thryvar) ==> Stat1: (EXISTS m | Has_cnfModel_thryvar(s,m)) & Stat2: (not (EXISTS m | Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c},m)))
		m-->Stat1(Stat1*) ==> Has_cnfModel_thryvar(s,m)
		Use_def(Has_cnfModel_thryvar)(*) ==> Stat3: ({h in m | tog(h) in m} = 0) & Stat4: ({c in s | (m * c) = 0} = 0)
--
-- we verify the hypothesis of Theorem cnfModels25 for $hh, s, m - {hh}$
--
-- firstly, $Has_cnfModel_thryvar(0, m - {hh})$
--
		Suppose ==> Stat5: not Has_cnfModel_thryvar(0, m - {hh})
			(m - {hh})-->TcnfModels1(Stat5*) ==> Stat6: {h in (m - {hh}) | tog(h) in (m - {hh})} /=0
			h1-->Stat6(Stat6) ==> Stat7: (h1 in (m - {hh})) & (tog(h1) in (m - {hh}))
			h1-->Stat3(Stat7) ==> false
		Discharge ==> Has_cnfModel_thryvar(0, m - {hh})
--
-- secondly, $not Has_cnfModel_thryvar({{hh, tog(hh)}}, m - {hh})$
--
		{hh}-->Stat4(*) ==> Stat8: hh in m
		hh-->Stat3(Stat8*) ==> tog(hh) notin m
		Suppose ==> Has_cnfModel_thryvar({{hh, tog(hh)}}, m - {hh})
			Use_def(Has_cnfModel_thryvar)(*) ==> Stat9: ({c in {{hh, tog(hh)}} | ((m - {hh}) * c) = 0} = 0)
			({hh, tog(hh)})-->Stat9(Stat8*) ==> false
		Discharge ==> not Has_cnfModel_thryvar({{hh, tog(hh)}}, m - {hh})
--
-- now we prepare to apply Theorem cnfModels25
--
		(Stat8, Stat8*)ELEM ==> Stat10: (m - {hh}) + {hh} = m
		EQUAL ==> Has_cnfModel_thryvar(s, (m - {hh}) + {hh})

		(hh, s, m - {hh})-->TcnfModels27 ==> Stat11: Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, m - {hh})
		(m - {hh})-->Stat2(Stat11*) ==> false
	Discharge ==> Is_cnfSat_thryvar({c - {tog(hh)}: c in s | hh notin c})
--
-- the reverse implication
--
	Use_def(Is_cnfSat_thryvar) ==> Stat12: (EXISTS m | Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c},m)) & Stat13: (not (EXISTS m | Has_cnfModel_thryvar(s,m)))
	n-->Stat12(Stat12*) ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c},n)
	Suppose ==> Stat14: hh in Un({c - {tog(hh)}: c in s | hh notin c})
		Use_def(Un)(Stat14*) ==> Stat15: hh in {h: c in {c - {tog(hh)}: c in s | hh notin c}, h in c}
		(c2, h2)-->Stat15(Stat15*) ==> Stat16: (c2 in {c - {tog(hh)}: c in s | hh notin c}) & (hh in c2)
		(c3)-->Stat16(Stat16*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat17: tog(hh) in Un({c - {tog(hh)}: c in s | hh notin c})
		Use_def(Un)(Stat17*) ==> Stat18: tog(hh) in {h: c in {c - {tog(hh)}: c in s | hh notin c}, h in c}
		(c4, h4)-->Stat18(Stat18*) ==> Stat19: (c4 in {c - {tog(hh)}: c in s | hh notin c}) & (tog(hh) in c4)
		(c5)-->Stat19(Stat19*) ==> false
	Discharge ==> AUTO
	({c - {tog(hh)}: c in s | hh notin c}, n, hh)-->TcnfModels21 ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, n - {hh})
	({c - {tog(hh)}: c in s | hh notin c}, n - {hh}, tog(hh))-->TcnfModels21 ==> Has_cnfModel_thryvar({c - {tog(hh)}: c in s | hh notin c}, (n - {hh}) - {tog(hh)})

	Use_def(Has_cnfModel_thryvar)(*) ==> Stat20: ({h in ((n - {hh}) - {tog(hh)}) | tog(h) in ((n - {hh}) - {tog(hh)})} = 0) & Stat21: ({c in {c - {tog(hh)}: c in s | hh notin c} | (((n - {hh}) - {tog(hh)}) * c) = 0} = 0)
--
-- we verify the hypothesis of Theorem cnfModels25 for $hh, s, (n - {hh}) - {tog(hh)}$
--
-- firstly, $Has_cnfModel_thryvar(0, ((n - {hh}) - {tog(hh)}))$
--
	((n - {hh}) - {tog(hh)})-->TcnfModels1(Stat20*) ==> Has_cnfModel_thryvar(0, (n - {hh}) - {tog(hh)})
--
-- secondly, $not Has_cnfModel_thryvar({{hh, tog(hh)}}, (n - {hh}) - {tog(hh)})$
--
	Suppose ==> Has_cnfModel_thryvar({{hh, tog(hh)}}, (n - {hh}) - {tog(hh)})
		Use_def(Has_cnfModel_thryvar)(*) ==> Stat22: ({c in {{hh, tog(hh)}} | (((n - {hh}) - {tog(hh)}) * c) = 0} = 0)
		({hh, tog(hh)})-->Stat22(Stat22*) ==> false
	Discharge ==> not Has_cnfModel_thryvar({{hh, tog(hh)}}, (n - {hh}) - {tog(hh)})
--
-- we apply Theorem cnfModels25
--
	(hh, s, (n - {hh}) - {tog(hh)})-->TcnfModels27 ==> Stat23: Has_cnfModel_thryvar(s, ((n - {hh}) - {tog(hh)}) + {hh})
	(((n - {hh}) - {tog(hh)}) + {hh})-->Stat13(Stat23*) ==> false
	Discharge ==> QED
--
-- The following is a specialized variant of Theorem 279
--
Theorem cnfModels29: (Un(S) incs Un({c - {tog(H)}: c in S | H notin c})) & (H notin Un({c - {tog(H)}: c in S | H notin c})). Proof:
Suppose_not(s,h) ==> AUTO
	Suppose ==> Stat1: not(Un(s) incs Un({c - {tog(h)}: c in s | h notin c}))
		h0-->Stat1(Stat1*) ==> (h0 in Un({c - {tog(h)}: c in s | h notin c})) & (h0 notin Un(s))
		Use_def(Un) ==> Stat2: (h0 in {x: y in {c - {tog(h)}: c in s | h notin c}, x in y}) &
			Stat3: (h0 notin {x: y in s, x in y})
		(y,x)-->Stat2(Stat2*) ==> Stat4: (h0 in y) & Stat5: (y in {c - {tog(h)}: c in s | h notin c})
		c-->Stat5(Stat4*) ==> (c in s) & (y = c - {tog(h)})
		(c, h0)-->Stat3(Stat4*) ==> false
	Discharge ==> h in Un({c - {tog(h)}: c in s| h notin c})
	Use_def(Un) ==> Stat6: (h in {x: y in {c - {tog(h)}: c in s | h notin c}, x in y})
	(y1, x1)-->Stat6(Stat6*) ==> Stat7: (y1 in {c - {tog(h)}: c in s | h notin c}) & (h in y1)
	c1-->Stat7(Stat7*) ==> false
	Discharge ==> QED
--
-- Subsets of finitely satisfiable sets are finitely satisfiable.
--
Theorem cnfModels30: (Is_cnfFinSat_thryvar(P) & (P incs Q)) imp Is_cnfFinSat_thryvar(Q). Proof:
Suppose_not(p0,q0) ==> AUTO
--
-- Arguing by contradiction, let $p0,q0$ be a counterexample to the claim.
--
	Use_def(Is_cnfFinSat_thryvar) ==> Stat1: (not(FORALL f incin q0 | Finite(f) imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m))))) &
		(FORALL f incin p0 | Finite(f) imp (EXISTS n | (FORALL s in f | Has_cnfModel_thryvar(s,n))))
--
-- Therefore, a finite subset $f0$ of $q0$ exists whose elements are not all simultaneously satisfiable;
-- but then, the very same $f0$ would also be a subset of $p0$ (since $p0 incs q0$),
-- contradicting the finite satisfiability of $q0$.
--
	(f0,f0)-->Stat1 ==> false
	Discharge ==> QED
--
--
--
ENTER_THEORY Set_theory
--
-- DISPLAY cnfModels
--
-- THEORY cnfModels(tog(x))
--
--
--	(FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
--
-- ==> (Has_cnfModel_thryvar, Is_cnfSat_thryvar, Is_cnfFinSat_thryvar)
--
--	(FORALL s, m | Has_cnfModel_thryvar(s,m) eq (({h in m | tog(h) in m} = 0) & ({c in s | (m * c) = 0} = 0)))
--
--	(FORALL s | Is_cnfSat_thryvar(s) eq (EXISTS m | Has_cnfModel_thryvar(s,m)))
--
--	(FORALL m | Has_cnfModel_thryvar(0,m) eq ({h in m | tog(h) in m} = 0))
--
--	(FORALL s | Has_cnfModel_thryvar(0,0) & Is_cnfSat_thryvar(0) & ((0 in s) imp (not(Is_cnfSat_thryvar(s)))))
--
--	(FORALL s | (({h in Un(s) | tog(h) in Un(s)} = 0) & (0 notin s)) imp (Has_cnfModel_thryvar(s,Un(s)) & Is_cnfSat_thryvar(s)))
--
--	(FORALL s | ({u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)} incs s) imp (Has_cnfModel_thryvar(s,Un(s)) & Is_cnfSat_thryvar(s)))
--
--	(FORALL t, s, m | ((t incin s) & Has_cnfModel_thryvar(s,m)) imp Has_cnfModel_thryvar(t,m))
--
--	(FORALL t, s | ((t incin s) & Is_cnfSat_thryvar(s)) imp Is_cnfSat_thryvar(t))
--
--	(FORALL s, m | Has_cnfModel_thryvar(s,m) imp Has_cnfModel_thryvar(s, m * Un(s)))
--	(FORALL s, m, n | (Has_cnfModel_thryvar(s,m) &
--		({h in (n - m) | tog(h) in n} = 0) & (m incin n)) imp Has_cnfModel_thryvar(s,n))
--
--	(FORALL s, m, t | Has_cnfModel_thryvar(s,m) imp Has_cnfModel_thryvar(0, m + {arb({k,tog(k)}): c in t, k in (c - m) | tog(k) in (c - m)}))
--
--	(FORALL s, m, t | Has_cnfModel_thryvar(s,m) imp Has_cnfModel_thryvar(s + {c: c in t, h in c | tog(h) in c}, m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}))
--
--	(FORALL s, m, h | (Has_cnfModel_thryvar(s,m) & (not Has_cnfModel_thryvar({{h}} + {c - {tog(h)}: c in s | H notin c}, m + {h}))) imp (tog(h) in m))
--
--	(FORALL s, m, h | Has_cnfModel_thryvar(s,m) imp (Has_cnfModel_thryvar({{h}} + {c - {tog(h)}: c in s | H notin c}, m + {h}) or Has_cnfModel_thryvar({{tog(h)}} + {c - {h}: c in s | tog(h) notin c}, m + {tog(h)})))
--
--	(FORALL h, s, m | Has_cnfModel_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}, m) imp Has_cnfModel_thryvar(s,m))
--
--	(FORALL h, s | Is_cnfSat_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}) imp Is_cnfSat_thryvar(s))
--
--	(FORALL s, h | Is_cnfSat_thryvar(s) eq (Is_cnfSat_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}) or Is_cnfSat_thryvar({{tog(h)}} + {c - {h}: c in S | tog(h) notin c})))
--
--	(FORALL h, s | (tog(h) notin Un(s)) imp (Is_cnfSat_thryvar(s) eq Is_cnfSat_thryvar({{h}} + {c in s | h notin c})))
--
--	(FORALL h, s, m | (({h} in s) & Has_cnfModel_thryvar(s,m)) imp ((h in m) & (tog(h) notin m)))
--
--	(FORALL s, t | ({c: c in s, h in c | tog(h) in c} incs t) imp (Is_cnfSat_thryvar(s) eq Is_cnfSat_thryvar(s - t)))
--
--	(FORALL s, h | Is_cnfSat_thryvar(s) eq (Is_cnfSat_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}) or Is_cnfSat_thryvar({{tog(h)}} + {c - {h}: c in s | tog(h) notin c})))
--
--	(FORALL h, s | ((h in Un(s)) & (tog(h) notin Un(s))) imp (Is_cnfSat_thryvar(s) eq Is_cnfSat_thryvar({c in s | h notin c})))
--
--	(FORALL h, c, s, m| ((h in c) & (c in s) & ({d in s | tog(h) in d} = 0) & Has_cnfModel_thryvar(0,m) & (not(Has_cnfModel_thryvar({{h,tog(h)}},m)))) imp (Has_cnfModel_thryvar(s, m + {h}) eq Has_cnfModel_thryvar({c in s | h notin c}, m)))
--
--	(FORALL h, c, s | ((h in c) & (c in s) & ({d in s | tog(h) in d} = 0)) imp (Is_cnfSat_thryvar(s) eq Is_cnfSat_thryvar({c in s | h notin c})))
--
--	(FORALL h, s, m| (({h} in s) & Has_cnfModel_thryvar(0,m) & ({h,tog(h)} * m = 0)) imp (Has_cnfModel_thryvar(s, m + {h}) eq Has_cnfModel_thryvar({c - {tog(h)}: c in s | h notin c}, m)))
--
--	(FORALL h, s | ({h} in s) imp (Is_cnfSat_thryvar(s) eq Is_cnfSat_thryvar({c - {tog(h)}: c in s | h notin c})))
--
--	(FORALL s, h | (Un(s) incs Un({c - {tog(h)}: c in s | h notin c})) & (h notin Un({c - {tog(h)}: c in s | h notin c})))
--
--	(FORALL s, m, n | (Has_cnfModel_thryvar(s,m) & ({h in (n - m) | tog(h) in n} = 0) & (m incin n)) imp Has_cnfModel_thryvar(s,n))
--
--	(FORALL s, m, n, t | (Has_cnfModel_thryvar(s,m) & (n incs m) & Has_cnfModel_thryvar(t,n)) imp Has_cnfModel_thryvar(s,n))
--
--	(FORALL s, m, h | (Has_cnfModel_thryvar(s,m) & (h notin Un(s))) imp (Has_cnfModel_thryvar(s, m - {h})))
--
--	(FORALL h, s, m | ((h in Un(s)) & (tog(h) notin Un(s)) & Has_cnfModel_thryvar(0,m) & (not(Has_cnfModel_thryvar({{h,tog(h)}},m)))) imp (Has_cnfModel_thryvar(s, m + {h}) eq Has_cnfModel_thryvar({c in s | H notin c}, m)))
--
--	(FORALL h, m | ({h,tog(h)} * m = 0) imp (Has_cnfModel_thryvar(0,m) eq Has_cnfModel_thryvar(0, m + {h})))
--
--	(FORALL c | {h in c | tog(h) in c} incin {h in c | Has_cnfModel_thryvar({c},{h}) & Has_cnfModel_thryvar({c},{tog(h)})})
--
--	(FORALL h, c | ((h in c) & (tog(h) in c)) imp (Has_cnfModel_thryvar({c},{h}) & Has_cnfModel_thryvar({c},{tog(h)})))
--
--	(FORALL p | Is_cnfFinSat_thryvar(p) eq (FORALL f incin P | Finite(f) imp (EXISTS m | (FORALL s in f | Has_cnfModel_thryvar(s,m)))))
--
--	(FORALL p, q | (Is_cnfFinSat_thryvar(p) & (p incs q)) imp Is_cnfFinSat_thryvar(q))
--
--	(FORALL p, x | Is_cnfFinSat_thryvar(p) imp Is_cnfFinSat_thryvar(p + {{{x}}}) or Is_cnfFinSat_thryvar(p + {{{tog(x)}}}))
--
--	(FORALL p |(Is_cnfFinSat_thryvar(p) & (FORALL s in p, c in s | Finite(c))) imp (EXISTS m | (FORALL s in p | Has_cnfModel_thryvar(s,m))))
--
-- END cnfModels
--
--
--
THEORY davisPutnam(tog(X),lits,fail,sl(S))
--
-- This theory develops an "archetype" version of the Davis-Putnam algorithm
-- for propositional conjunctive normal forms constructed from a given
-- collection $lits$ of literals: this is done assuming that a global
-- Galois correspondence $tog(x)$ (modeling negation over $lits$) is given,
-- along with a function $sl(s)$ choosing from any non-trivial conjunctive
-- normal form $s$ a literal appearing in $s$. In terms of $sl$, a function
-- $dp_thryvar(s)$ will be recursively defined, returning a model for
-- any satisfiable conjunctive normal form $s$. A dummy value $fail$ is also
-- passed as a parameter, whose insertion into a model will render it
-- fictitious, to indicate unsatisfiability.
--
	(FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
--
	{tog(x): x in lits} = lits
--
	fail notin lits
--
	(FORALL s | ((s /= 0) & (0 notin s)) imp (sl(s) in Un(s)))
--
END davisPutnam
--
ENTER_THEORY davisPutnam
--
-- We define a set of clauses to be a finite set of finite sets of literals:
-- each finite set of literals, called a "clause", will be treated as a disjunction;
-- and a set of sets of literals will be treated  as a conjunction of clauses.
-- Accordingly, the null set $0$ will represent falsehood when viewed as a clause,
-- whereas it will represent truth when viewed as a set of clauses.
--
Def davisPutnam0: clauSets_thryvar := { s incin pow(lits) | Finite(Un(s)) }
--
--
--
Theorem davisPutnam0: (tog(tog(H)) = H) & (tog(H) /= H) &
((tog(H) notin Un(S)) imp ({c in S | H notin c} = {c - {tog(H)}: c  in S | H notin c})). Proof:
Suppose_not(h,s) ==> AUTO
	Assump ==> Stat1: (FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
	h-->Stat1(*) ==> AUTO
	(tog(h),s)-->T105(*) ==> Stat2: (({c: c in s | h notin c} /= {c - {tog(h)}: c  in s | h notin c})) &
		({v in s | tog(h) in v} = 0)
	(c,c)-->Stat2(Stat2*) ==> false
	Discharge ==> QED
--
-- We begin by checking that the formal definition just given of the sets of clauses over
-- the given literals matches our intentions, as informally declared above. The two
-- following theorems show that any $S in clauSets$ is finite, as is any of its
-- members. Incidentally, we observe that neither $fail$ nor its complement
-- occurs in any $S in clauSets$.
--
Theorem davisPutnam1: (S in clauSets_thryvar) imp (Finite(S) & Finite(Un(S)) &
		(Un(S) incin lits) & (fail notin Un(S)) & (tog(fail) notin Un(S))). Proof:
Suppose_not(s) ==> AUTO
--
-- Assuming $s$ to be a counterexample to the claim...
--
	Use_def(clauSets_thryvar) ==> Stat1: s in { s incin pow(lits) | Finite(Un(s)) }
	()-->Stat1(*) ==> Finite(Un(s))
	(s,s)-->T266(*) ==> Finite(s)
--
-- ...we readily discard the possibility that $s$ is infinite.
--
	Use_def(Un(s)) ==> AUTO
	Assump ==> Stat2: ({tog(x): x in lits} = lits) & (fail notin lits)
	Suppose ==> Stat3: Un(s) nincin lits
		h0-->Stat3(Stat1*) ==> Stat4: (h0 in {h: c in s, h in c}) & (h0 notin lits)
		(c0,h1)-->Stat4(Stat4*) ==> (c0 in s) & (h0 in c0)
		Use_def(clauSets_thryvar) ==> Stat5: s in { s incin pow(lits) | Finite(Un(s)) }
		Use_def(pow(lits)) ==> AUTO
		()-->Stat5(Stat4*) ==> Stat6: c0 in {x: x incin lits}
		c1-->Stat6(Stat4*) ==> false
--
-- Since it is easily recognized that $Un(s) incin lits$, we are left with
-- two possibilities: that $fail in Un(s)$, hence $fail notin lits$; or that
-- $tog(fail) in Un(s)$, hence $tog(fail) notin lits$. The first is untenable,
-- because it manifestly contradicts an assumption of the present THEORY;
-- hence we are left with the possibility $tog(fail) notin lits$.
--
	Discharge ==> Stat7: tog(fail) in {tog(x): x in lits}
	h2-->Stat7(Stat7*) ==> (tog(fail) = tog(h2)) & (h2 in lits)
	fail-->TdavisPutnam0(Stat7*) ==> tog(tog(fail)) = fail
	h2-->TdavisPutnam0(Stat7*) ==> tog(tog(h2)) = h2
--
-- However, this leads to a contradiction too, thanks to the other assumptions of
-- the present THEORY.
--
	EQUAL(Stat2) ==> false
	Discharge ==> QED
--
Theorem davisPutnam2: ((S in clauSets_thryvar) & (C in S)) imp Finite(C). Proof:
Suppose_not(s,c) ==> AUTO
	Use_def(clauSets_thryvar) ==> Stat1: s in { s incin pow(lits) | Finite(Un(s)) }
	()-->Stat1(Stat1*) ==> Finite(Un(s))
	s-->T274 ==> Stat2: (FORALL x in s | x incin Un(s))
	c-->Stat2(*) ==> c incin Un(s)
	(Un(s),c)-->T189(*) ==> false
	Discharge ==> QED
--
-- Observe that any subset of a set of clauses is a set of clauses:
--
Theorem davisPutnam3: ((S in clauSets_thryvar) & ((T incin S) or (Un(T) incin Un(S)))) imp (T in clauSets_thryvar). Proof:
Suppose_not(s,t) ==> AUTO
--
-- Indeed, if $t$ is a subset of a set $s$ of clauses, its unionset
-- will be included in the unionset of $s$, which is finite, and hence
-- will be finite in its turn. Moreover $Un(t)$ will, like $Un(s)$, have
-- only literals as members. The alternative $Un(t) incin Un(s)$ leads,
-- by a slightly more elaborate argument, to a similar contradiction.
--
	Suppose ==> Un(t) nincin Un(s)
		(t,s)-->T276(*) ==> false
	Discharge ==> AUTO
	Use_def(clauSets_thryvar)(*) ==> Stat1: s in { s incin pow(lits) | Finite(Un(s)) } &
		Stat2: (t notin { s incin pow(lits) | Finite(Un(s)) })
	t-->Stat2 ==> AUTO
	(Un(s),Un(t))-->T189 ==> AUTO
	()-->Stat1(*) ==> Stat3: (Finite(Un(s))) & (s incin pow(lits)) & Stat4: (t nincin pow(lits))
	Use_def(pow(lits)) ==> AUTO
	c-->Stat4(Stat3*) ==> Stat5: (c notin {d: d incin lits}) & (c in t)
	c-->Stat5(Stat5*) ==> Stat6: c nincin lits
	h-->Stat6(Stat6*) ==> Stat7: (h in c) & (h notin lits)
	Use_def(Un(s)) ==> AUTO
	Suppose ==> h notin Un(s)
		Use_def(Un(t)) ==> AUTO
		ELEM ==> Stat8: h notin {x: d in t, x in d}
		(c,h)-->Stat8(Stat5,Stat7*) ==> false
	Discharge ==> Stat9: h in {x: d in s, x in d}
	(d,hp)-->Stat9(Stat3*) ==> Stat10: (d in {x: x incin lits}) & (h in d)
	dp-->Stat10(Stat10,Stat7*) ==> false
	Discharge ==> QED
--
-- Then we import from the THEORY $cnfModel$ the notions concerning the satisfiability
-- of propositional formulae in conjunctive normal form (represented as sets of clauses).
-- Moreover, we import a batch of useful information about satisfiability and models.
--
APPLY(Has_cnfModel_thryvar:Has_dpModel_thryvar,Is_cnfSat_thryvar:Is_dpSat_thryvar) cnfModels(tog(X)->tog(X)) ==>
Theorem davisPutnam4:
	(FORALL s | Is_dpSat_thryvar(s) = (EXISTS m | Has_dpModel_thryvar(s,m))) &
	(FORALL s | Has_dpModel_thryvar(0,0) & Is_dpSat_thryvar(0) & ((0 in s) imp (not(Is_dpSat_thryvar(s))))) &
	(FORALL s | ({u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)} incs s) imp (Has_dpModel_thryvar(s,Un(s)) & Is_dpSat_thryvar(s))) &
	(FORALL s, h | Is_dpSat_thryvar(s) eq
		(Is_dpSat_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}) or
			Is_dpSat_thryvar({{tog(h)}} + {c - {h}: c in s | tog(h) notin c}))) &
	(FORALL h, s | (tog(h) notin Un(s)) imp
		(Is_dpSat_thryvar(s) eq Is_dpSat_thryvar({{h}} + {c in s | h notin c}))) &
	(FORALL h, s, m | (({h} in s) & Has_dpModel_thryvar(s,m)) imp ((h in m) & (tog(h) notin m))) &
	(FORALL h, s, m | Has_dpModel_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}, m) imp
		Has_dpModel_thryvar(s,m)) &
	(FORALL s, m, t | Has_dpModel_thryvar(s,m) imp Has_dpModel_thryvar(s + {c: c in t, h in c | tog(h) in c}, m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)})) &
	(FORALL t,s | ((t incin s) & Is_dpSat_thryvar(s)) imp Is_dpSat_thryvar(t))
--
Def davisPutnam1: settled_thryvar(S) := {u: u in S, h in u | (u = {h}) & ({h,tog(h)} * Un(S - {u}) = 0)}
--
Def davisPutnam2: pk_thryvar := {[x,sl(x - settled_thryvar(x))]: x in clauSets_thryvar}
--
-- In sight of defining the Davis-Putnam procedure recursively, we must single out
-- a well-founded relation over the family $clauSets$ of all sets of clauses.
-- A set of clauses is regarded as being "smaller" than another if its unsettled part
-- involves fewer literals than the unsettled part of the other. Our next theorem shows
-- that the relationship just introduced is indeed well-founded over the family $clauSets$
-- of sets of clauses.
--
Theorem davisPutnam5: ((G incin clauSets_thryvar) & (G /= 0)) imp
	(EXISTS m in G | (FORALL v in G | not((Un(v - settled_thryvar(v)) incin Un(m - settled_thryvar(m))) &
				(Un(v - settled_thryvar(v)) /= Un(m - settled_thryvar(m)))))). Proof:
Suppose_not(g) ==> Stat1: (not (EXISTS m in g | (FORALL v in g |
			not((Un(v - settled_thryvar(v)) incin Un(m - settled_thryvar(m))) &
				(Un(v - settled_thryvar(v)) /= Un(m - settled_thryvar(m))))))) &
			(g incin clauSets_thryvar) & (g /= 0)
--
-- Assuming a counterexample $g$ to the claim to exist, we will reach a contradiction
-- by observing that every member of the set ${Un(xp): xp in clauSets_thryvar}$ is finite, and
-- hence strict inclusion is well-founded on this set, by Theorem 411. Moreover, it is clear
-- that $Un(x - settled_thryvar(x))$ is a member of this set for any $x in clauSets_thryvar$;
-- therefore the relation holding between any two members of $clauSets_thryvar$ when the
-- unionset of the (unsettled part of the) former is strictly included in the unionset of the
-- (unsettled part of the) latter is well-founded.
--
	Suppose ==> Stat2: not(FORALL x in {Un(xp): xp in clauSets_thryvar} | Finite(x))
		yq-->Stat2(Stat2*) ==> Stat3: (yq in {Un(xp): xp in clauSets_thryvar}) & (not Finite(yq))
		xq-->Stat3(Stat3*) ==> (yq = Un(xq)) & (xq in clauSets_thryvar) & (not Finite(yq))
		Use_def(clauSets_thryvar) ==> Stat4: xq in { s incin pow(lits) | Finite(Un(s)) }
		()-->Stat4(Stat4*) ==> Finite(Un(xq))
	EQUAL ==> false; Discharge ==> AUTO
	Suppose ==> Stat5: not(FORALL t |
			((t incin {Un(xp): xp in clauSets_thryvar}) & (t /= 0)) imp
			(EXISTS w in t | (FORALL v in t | not((v incin w) & (v /= w)))))
		u-->Stat5 ==> AUTO
	({Un(xp): xp in clauSets_thryvar},u)-->T411(*) ==> false; Discharge ==> AUTO
	Suppose ==> Stat6: not(FORALL x | (x in clauSets_thryvar) imp (Un(x - settled_thryvar(x)) in {Un(xp): xp in clauSets_thryvar}))
		x-->Stat6(Stat6*) ==> Stat7: (Un(x - settled_thryvar(x)) notin
			{Un(xp): xp in clauSets_thryvar}) & (x in clauSets_thryvar)
		(x,x - settled_thryvar(x))-->TdavisPutnam3(Stat7*) ==>
			((x - settled_thryvar(x)) in clauSets_thryvar)
	(x - settled_thryvar(x))-->Stat7(Stat7*) ==> false; Discharge ==> AUTO
	APPLY() inh_well_founded_set(s->{Un(xp): xp in clauSets_thryvar},arg1_bef_arg2(Y,X)->((Y incin X) & (Y /= X)),sp->clauSets_thryvar,displace(X)->Un(X - settled_thryvar(X))) ==>
		Stat8: (FORALL t | ((t incin clauSets_thryvar) & (t /= 0)) imp (EXISTS w in t | (FORALL v in t | not((Un(v - settled_thryvar(v)) incin Un(w - settled_thryvar(w))) & (Un(v - settled_thryvar(v)) /= Un(w - settled_thryvar(w)))))))
	g-->Stat8(Stat1,Stat1*) ==> false
	Discharge ==> QED
--
-- In sight of invoking the THEORY $wellfounded_recursive_fcn$, we define
-- an operator $f3_dp_thryvar$ and a predicate $P3_dp_thryvar$, both ternary, which will play
-- the role of formal input parameters. The third argument of these is meant to designate a
-- "picking" function like the one just defined. As regards the operator $f3_dp_thryvar$, its
-- first and second argument generally designate a set $x$ of clauses and a doubleton
-- collection of models, one modeling $x + {{p~[x]}}$ and one modeling $x + {{tog(p~[x])}}$;
-- the pseudo-model ${fail}$ being used in place of either when a genuine model does not exists.
-- When $x$ is trivially satisfiable (e.g. null), as it coincides with its obvious part, then
-- $f3_dp_thryvar(x,_,_)$ supplies its model $Un(x)$;  when $x$ is manifestly false,
-- as flagged by the null clause present in it, $f3_dp_thryvar(x,_,_)$ returns ${fail}$;
-- when $x$ is neither trivially satisfiable nor manifestly false, $f3_dp_thryvar(x,m,p)$
-- draws a model of $x$ (if any) from $m$, giving priority to the model of $x + {{p~[x]}}$ if
-- this exist but picking the model of $x + {{tog(p~[x])}}$ when the former does not exist
-- (of course if neither has a model, $m={{fail}}$ will hold.
--
Def davisPutnam3: f3_dp_thryvar(X,M,P) := if 0 in X then {fail}
	elseif settled_thryvar(X) incs X then Un(X)
	else arb({ w in M | ((fail notin Un(M)) imp ((P~[X]) in w)) &
                  ((fail in w) imp (FORALL v in M | fail in v)) })
	end if
--
-- As regards the predicate $P3_dp_thryvar$, its first argument again designates a set
-- $x$ of clauses, and its second designates the set $y$ resulting from the simplification
-- of $x$ when either the literal $h$ or its complement $tog(h)$ is assumed to be true,
-- where $h$ is selected from $x$ by the picking function. It would be pointless to carry out
-- the simplification relative to $tog(h)$ when $h$ is a "pure" literal, namely one whose
-- complement does not occur in $x$: in this case the above-discussed operator $f3_dp_thryvar$
-- will receive a singleton, instead of a doubleton, set of models. There are situations
-- in which the picking function is not guaranteed to return anything significant, but they
-- cause no problem because in such cases the satisfiability check for $x$ is obvious and
-- can be performed directly the the operator $f3_dp_thryvar$ without reduction of $x$ to
-- a simpler $y$.
--
Def davisPutnam4: P3_dp_thryvar(X,Y,P) := ( ((tog(P~[X]) in Un(X)) &
		(Y = {{tog(P~[X])}} + {c - {P~[X]}: c in X | tog(P~[X]) notin c})) or
		(Y = {{P~[X]}} + {c - {tog(P~[X])}: c in X | (P~[X]) notin c}) )
--
APPLY(wfh2_thryvar:dp0_thryvar) wellfounded_recursive_fcn(s->clauSets_thryvar,
	arg1_bef_arg2(y,x)->((Un(y - settled_thryvar(y)) incin Un(x - settled_thryvar(x))) &
		(Un(y - settled_thryvar(y)) /= Un(x - settled_thryvar(x)))),
	f3(b,x,p)->f3_dp_thryvar(x,b,p),
	g4(m,y,x,p)->m,
	P4(m,y,x,p)->P3_dp_thryvar(x,y,p)) ==>
Theorem davisPutnam6: (FORALL x, p | (x in clauSets_thryvar) imp (dp0_thryvar(x,p) =
	f3_dp_thryvar(x,{dp0_thryvar(y,p): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) incin Un(x - settled_thryvar(x))) &
		 (Un(y - settled_thryvar(y)) /= Un(x - settled_thryvar(x)))) &
		P3_dp_thryvar(x,y,p)},p)))
--
--
--
Theorem davisPutnam7: (X in clauSets_thryvar) imp (#Un(X - settled_thryvar(X))  in Za). Proof:
Suppose_not(s) ==> AUTO
	Loc_def ==> Stat1: n = #Un(s - settled_thryvar(s))
	ELEM ==> n notin Za
	(Un(s - settled_thryvar(s)))-->T156(*) ==> Card(#Un(s - settled_thryvar(s)))
	(#Un(s - settled_thryvar(s)))-->T206(Stat1) ==> (not Finite(Un(s - settled_thryvar(s))))
	(s - settled_thryvar(s),s)-->T276(*) ==> Un(s) incs Un(s - settled_thryvar(s))
	(Un(s),Un(s - settled_thryvar(s)))-->T189(*) ==> (not Finite(Un(s)))
	Use_def(clauSets_thryvar) ==> Stat2: s in { s incin pow(lits) | Finite(Un(s)) }
	()-->Stat2(*) ==> false
	Discharge ==> QED
--
--
--
Theorem davisPutnam8: ((X in clauSets_thryvar) & (H in Un(X - settled_thryvar(X))) & ((Y = {{H}} + {c - {tog(H)}: c in X | H notin c}))) imp
	((Y in clauSets_thryvar) & (Un(Y - settled_thryvar(Y)) /= Un(X - settled_thryvar(X))) &
	(Un(Y - settled_thryvar(Y)) incin Un(X - settled_thryvar(X)))). Proof:
Suppose_not(x0,h0,y0) ==> AUTO
--
	ELEM ==> Stat1: (y0 = {{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c})
	(x0 - settled_thryvar(x0), x0)-->T276(*) ==> Stat2: h0 in Un(x0)
	Suppose ==> Stat3: Un(y0) nincin Un(x0)
		a-->Stat3(Stat3*) ==> (a in Un(y0)) & (a notin Un(x0))
		EQUAL ==> Stat4: (a in Un({{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c})) & (a notin Un(x0))
		Use_def(Un)(Stat4*) ==> Stat5: (a in {u: v in ({{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c}), u in v}) & Stat6: (a notin {u: v in x0, u in v})
		(v1,u1)-->Stat5(Stat5*) ==> Stat7: ((v1 = {h0}) or (v1 in {c - {tog(h0)}: c in x0 | h0 notin c})) & (a in v1)
--
-- Since $h0 in Un(x0)$, whereas $a notin Un(x0)$, we can discard the possibility $a = h0$,
-- $v1 = {h0}$.
--
		(Stat2*)ELEM ==> Stat8: v1 in {c - {tog(h0)}: c in x0 | h0 notin c}
		c-->Stat8(Stat7*) ==> Stat9: (c in x0) & (a in c)
		(c,a)-->Stat6(Stat9*) ==> false
	Discharge ==> AUTO
--
-- It readily follows, by virtue of Theorem davisPutnam3, that $y0$ in a set of clauses:
--
	(x0,y0)-->TdavisPutnam3(*) ==> Stat10: y0 in clauSets_thryvar
--
-- In order to see that $Un(y0 - settled(y0)) /= Un(x0 - settled(x0))$,
-- we will now show that a known member of $Un(x0 - settled(x0))$,
-- namely $h0$, does not belong to $Un(y0 - settled(y0))$.
--
	Use_def(Un(y0 - settled_thryvar(y0))) ==> AUTO
	Suppose ==> h0 in Un(y0 - settled_thryvar(y0))
		(Stat10*)ELEM ==> Stat11: h0 in {u: v in (y0 - settled_thryvar(y0)), u in v}
		(v2,u2)-->Stat11(Stat11*) ==> Stat12: (v2 in y0) & (v2 notin settled_thryvar(y0)) & (h0 in v2)
		EQUAL ==> v2 in ({{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c})
		Suppose ==> v2 /= {h0}
			(Stat12*)ELEM ==> Stat13: v2 in {c - {tog(h0)}: c in x0 | h0 notin c}
			c1-->Stat13(Stat12*) ==> false
		Discharge ==> AUTO
		Use_def(settled_thryvar(y0)) ==> AUTO
		(Stat12*)ELEM ==> Stat14: {h0} notin {u: u in y0, h in u | (u = {h}) & ({h,tog(h)} * Un(y0 - {u}) = 0)}
		({h0},h0)-->Stat14(*) ==> {h0,tog(h0)} * Un(y0 - {{h0}}) /= 0
		Suppose ==> y0 - {{h0}} /= {c - {tog(h0)}: c in x0 | h0 notin c}
			ELEM ==> Stat15: {h0} in {c - {tog(h0)}: c in x0 | h0 notin c}
			c3-->Stat15(Stat15*) ==> false
		Discharge ==> y0 - {{h0}} = {c - {tog(h0)}: c in x0 | h0 notin c}
		EQUAL(Stat14) ==> Stat16: {h0,tog(h0)} * Un({c - {tog(h0)}: c in x0 | h0 notin c}) /= 0
		Use_def(Un({c - {tog(h0)}: c in x0 | h0 notin c})) ==> AUTO
		h1-->Stat16(Stat16*) ==> Stat17: ((h1 = h0) or (h1 = tog(h0))) & (h1 in {u: v in {c - {tog(h0)}: c in x0 | h0 notin c}, u in v})
		SIMPLF(Stat17*) ==> Stat18: h1 in {u: c in x0, u in (c - {tog(h0)}) | h0 notin c}
		(c4,u4)-->Stat18(Stat17*) ==> false
--
-- Therefore, if any of the three claims of this theorem could be false, it would
-- be the third. To get the desired contradiction, we will hence seek one
-- ensuing from the negation of such claim, which is
--		$Un(y0 - settled(y0)) nincin Un(x0 - settled(x0))$.
--
	Discharge ==> Stat19: (Un(y0 - settled_thryvar(y0)) nincin Un(x0 - settled_thryvar(x0))) &
			(h0 notin Un(y0 - settled_thryvar(y0)))
	h5-->Stat19(Stat19*) ==> Stat20: (h5 in Un(y0 - settled_thryvar(y0))) &
			(h5 notin Un(x0 - settled_thryvar(x0)))
	Use_def(Un)(Stat20,Stat20*) ==> Stat21: (h5 in {u: v in (y0 - settled_thryvar(y0)), u in v}) &
			Stat22: (h5 notin {u: v in (x0 - settled_thryvar(x0)), u in v})
	(v5,u5)-->Stat21(Stat21,Stat1*) ==> Stat23: (v5 in y0) &
			(v5 in ({{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c})) &
			(v5 notin settled_thryvar(y0)) & (h5 in v5)
	(Stat19*)ELEM ==> (h5 /= h0) & (v5 /= {h0})
	(Stat23*)ELEM ==> Stat24: v5 in {c - {tog(h0)}: c in x0 | h0 notin c}
	c0-->Stat24(Stat23,Stat23*) ==> (v5 = c0 - {tog(h0)}) & (c0 in x0) & (h0 notin c0)
--
-- It follows from the above that $c0 in settled(x0)$. Hence $c0 = {h5}$, and
-- therefore $c0 - {tog(h0)} = c0$ because we know that this set has a member.
--
	Use_def(settled_thryvar(x0)) ==> AUTO
	(c0,h5)-->Stat22(Stat23*) ==> Stat25: c0 in {u: u in x0, h in u | (u = {h}) & ({h,tog(h)} * Un(x0 - {u}) = 0)}
	(u7,h7)-->Stat25(Stat23*) ==> (h5 = h7) & (c0 = u7) & (u7 in x0) & (h7 in u7) & (u7 = {h7}) & ({h7,tog(h7)} * Un(x0 - {u7}) = 0)
	EQUAL(Stat25) ==> Stat26: (c0 = {h5}) & (c0 in x0) & (h5 in c0) & ({h5,tog(h5)} * Un(x0 - {c0}) = 0)
	(Stat23*)ELEM ==> v5 = c0
--
-- Observe that $c0 - {tog(h0)} = c0$ belongs to $y0 - settled(y0)$.
-- However, this is easily shown to conflict with the fact that $c0 in settled(x0)$.
--
	Use_def(settled_thryvar) ==> settled_thryvar(y0) = {u: u in y0, h in u | (u = {h}) & ({h,tog(h)} * Un(y0 - {u}) = 0)}
	EQUAL(Stat10) ==> Stat27: c0 notin {u: u in y0, h in u | (u = {h}) & ({h,tog(h)} * Un(y0 - {u}) = 0)}
	(c0,h5)-->Stat27(Stat23*) ==> Stat28: {h5,tog(h5)} * Un(y0 - {c0}) /= 0
	h8-->Stat28(Stat25*) ==> Stat29: (h8 in {h5,tog(h5)}) & (h8 in Un(y0 - {c0})) & (h8 notin Un(x0 - {c0}))
	EQUAL(Stat1,Stat29) ==> Stat30: (h8 in Un(({{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c}) - {c0})) & (h8 notin Un(x0 - {c0}))
	Use_def(Un)(Stat30*) ==> Stat31: (h8 in {u: v in (({{h0}} + {c - {tog(h0)}: c in x0 | h0 notin c}) - {c0}), u in v}) &
			Stat32: (h8 notin {u: v in (x0 - {c0}), u in v})
	(v8,u8)-->Stat31(Stat31*) ==> Stat33: ((v8 = {h0}) or (v8 in {c - {tog(h0)}: c in x0 | h0 notin c})) & (v8 /= c0) & (h8 in v8)
--
-- We can discard the possibility $v8 = {h0}$, because $h0$ belongs to some clause in $x0$
-- which cannot be $c0$.
--
	Suppose ==> v8 = {h0}
		(Stat29*)ELEM ==> h0 notin Un(x0 - {c0})
		(Stat2,Stat2*)ELEM ==> h0 in Un(x0)
		Use_def(Un)(Stat33*) ==> Stat34: (h0 in {u: v in x0, u in v}) &
				(h0 notin {u: v in (x0 - {c0}), u in v})
		(v9,u9,v9,h0)-->Stat34(Stat34*) ==> h0 in c0
	(Stat23*)Discharge ==> AUTO
--
-- The other possibility, $v8 in {c - {tog(h0)}: c in x0 | h0 notin c}$, is easily
-- discarded too, because it would imply that $v8$ (which is nonnull) results from the
-- difference $c0 - {tog(h0)}$, where $c0$ is singleton, and hence equality
-- between $v8$ and $c0$.
--
	(Stat33*)ELEM ==> Stat35: v8 in {c - {tog(h0)}: c in x0 | h0 notin c}
	c9-->Stat35(Stat35*) ==> Stat36: (v8 = c9 - {tog(h0)}) & (c9 in x0) & (h0 notin c9)
	(c9,h8)-->Stat32(Stat31*) ==> Stat37: c9 = c0
--
--
--
	(Stat26,Stat33,Stat36,Stat37*)Discharge ==> QED
--
--
--
Theorem davisPutnam9: ((S in clauSets_thryvar) & (0 notin S) &
		(S nincin settled_thryvar(S))) imp
		(((pk_thryvar~[S]) in Un(S - settled_thryvar(S))) &
		((pk_thryvar~[S]) /= fail) & (tog(pk_thryvar~[S]) /= fail) &
		((tog(pk_thryvar~[S]) in Un(S)) imp
		(tog(pk_thryvar~[S]) in Un(S - settled_thryvar(S))))). Proof:
Suppose_not(s0) ==> AUTO
	ELEM ==> Stat1: s0 in clauSets_thryvar
	Suppose ==> Stat2: (pk_thryvar~[s0]) notin Un(s0 - settled_thryvar(s0))
		Use_def(pk_thryvar) ==> pk_thryvar = {[x,sl(x - settled_thryvar(x))]: x in clauSets_thryvar}
		(Stat2)ELEM ==> Svm({[x,sl(x - settled_thryvar(x))]: x in clauSets_thryvar})
		Suppose ==> Stat3: [s0,sl(s0 - settled_thryvar(s0))] notin {[x,sl(x - settled_thryvar(x))]: x in clauSets_thryvar}
		s0-->Stat3(Stat1,Stat1*) ==> false; Discharge ==> [s0,sl(s0 - settled_thryvar(s0))] in {[x,sl(x - settled_thryvar(x))]: x in clauSets_thryvar}
		EQUAL(Stat2) ==> Svm(pk_thryvar) & ([s0,sl(s0 - settled_thryvar(s0))] in pk_thryvar)
		(pk_thryvar,[s0,sl(s0 - settled_thryvar(s0))])-->T74(Stat2*) ==> (pk_thryvar~[car([s0,sl(s0 - settled_thryvar(s0))])]) = cdr([s0,sl(s0 - settled_thryvar(s0))])
 		(s0,sl(s0 - settled_thryvar(s0)))-->T9(*) ==> (car([s0,sl(s0 - settled_thryvar(s0))]) = s0) & (cdr([s0,sl(s0 - settled_thryvar(s0))]) = sl(s0 - settled_thryvar(s0)))
		EQUAL(Stat2) ==> (pk_thryvar~[s0]) = sl(s0 - settled_thryvar(s0))
		Assump ==> Stat4: (FORALL s | ((s /= 0) & (0 notin s)) imp (sl(s) in Un(s)))
	(s0 - settled_thryvar(s0))-->Stat4(*) ==> false; Discharge ==> Stat5:
			((pk_thryvar~[s0]) in Un(s0 - settled_thryvar(s0)))
	(s0 - settled_thryvar(s0),s0)-->T276 ==> AUTO
	s0-->TdavisPutnam1(Stat1*) ==> ((pk_thryvar~[s0]) /= fail) & (tog(fail) /= (pk_thryvar~[s0]))
	(pk_thryvar~[s0])-->TdavisPutnam0(Stat5*) ==> tog(tog(pk_thryvar~[s0])) = (pk_thryvar~[s0])
	Suppose ==> tog(pk_thryvar~[s0]) = fail
		EQUAL(Stat5) ==> false
	Discharge ==> AUTO
	ELEM ==> (tog(pk_thryvar~[s0]) in Un(s0)) & (tog(pk_thryvar~[s0]) notin Un(s0 - settled_thryvar(s0)))
	Use_def(Un)(Stat5*) ==> Stat6: (tog(pk_thryvar~[s0]) in {h: c in s0, h in c}) &
		(tog(pk_thryvar~[s0]) notin {h: c in (s0 - settled_thryvar(s0)), h in c}) &
		((pk_thryvar~[s0]) in {h: c in (s0 - settled_thryvar(s0)), h in c})
	(c0,h0,c0,h0,c2,h2)-->Stat6(Stat6*) ==> Stat7: (tog(pk_thryvar~[s0]) in c0) & (c0 in settled_thryvar(s0)) &
		(c2 in s0) & ((pk_thryvar~[s0]) in c2)
	Use_def(settled_thryvar) ==> Stat8: c0 in {u: u in s0, h in u | (u = {h}) & ({h,tog(h)} * Un(s0 - {u}) = 0)}
	(u1,h1)-->Stat8(Stat7*) ==> (c0 = u1) & (c0 in s0) & (c0 = {h1}) & (h1 = tog(pk_thryvar~[s0])) & (tog(h1) notin Un(s0 - {u1}))
	EQUAL(Stat5) ==> Stat9: (c0 = {tog(pk_thryvar~[s0])}) & ((pk_thryvar~[s0]) notin Un(s0 - {c0}))
	(Stat5*)ELEM ==> c2 /= c0
	Use_def(Un)(Stat9*) ==> Stat10: (pk_thryvar~[s0]) notin {h: c in (s0 - {c0}), h in c}
	(c2,pk_thryvar~[s0])-->Stat10(Stat7*) ==> false
	Discharge ==> QED
--
Theorem davisPutnam10: ((S in clauSets_thryvar) & ((0 in S) or (S incin settled_thryvar(S)) or (#Un(S - settled_thryvar(S)) = 0))) imp
(if fail in dp0_thryvar(S,pk_thryvar) then (not Is_dpSat_thryvar(S)) else Has_dpModel_thryvar(S,dp0_thryvar(S,pk_thryvar)) end if). Proof:
Suppose_not(s0) ==> AUTO
	Loc_def ==> n0 = #Un(s0 - settled_thryvar(s0))
	ELEM ==> Stat1: (s0 in clauSets_thryvar) & (#Un(s0 - settled_thryvar(s0)) = n0) &
			(not if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if)
--
-- Let us recall how the value of $dp0_thryvar(s0,pk_thryvar)$ is determined:
--
	TdavisPutnam6 ==> Stat2: (FORALL x, p | (x in clauSets_thryvar) imp (dp0_thryvar(x,p) =
		f3_dp_thryvar(x,{dp0_thryvar(y,p): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) incin Un(x - settled_thryvar(x))) &
		 (Un(y - settled_thryvar(y)) /= Un(x - settled_thryvar(x)))) &
		P3_dp_thryvar(x,y,p)},p)))
	(s0,pk_thryvar)-->Stat2(Stat1*) ==> dp0_thryvar(s0,pk_thryvar) =
		f3_dp_thryvar(s0,{dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) incin Un(s0 - settled_thryvar(s0))) &
		 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
		P3_dp_thryvar(s0,y,pk_thryvar)},pk_thryvar)
	Loc_def ==> Stat3: m0 = {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) incin Un(s0 - settled_thryvar(s0))) &
		 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
		P3_dp_thryvar(s0,y,pk_thryvar)}
	EQUAL(Stat2) ==> dp0_thryvar(s0,pk_thryvar) = f3_dp_thryvar(s0,m0,pk_thryvar)
	Use_def(f3_dp_thryvar(s0,m0,pk_thryvar)) ==> AUTO
--
-- Recall also that $fail notin Un(s0)$:
--
	s0-->TdavisPutnam1(Stat1,Stat1*) ==> fail notin Un(s0)
--
-- It is quickly seen that $0 notin s0$ and that $s0 /= settled_thryvar(s0)$;
-- therefore $n0 /= 0$, which leads to a contradiction.
--
	Suppose ==> Stat4: 0 in s0
--		Then we have $dp0_thryvar(s0,pk_thryvar) = {fail}$
		(Stat3)ELEM ==> (if dp0_thryvar(s0,pk_thryvar) = {fail} then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if) eq (not Is_dpSat_thryvar(s0))
		(Stat1*)ELEM ==> Is_dpSat_thryvar(s0)
		TdavisPutnam4 ==> Stat5: (FORALL s | Has_dpModel_thryvar(0,0) & Is_dpSat_thryvar(0) & ((0 in s) imp (not(Is_dpSat_thryvar(s)))))
	s0-->Stat5(Stat4*) ==> false; Discharge ==> AUTO
	Suppose ==> Stat6: settled_thryvar(s0) incs s0
		(Stat3*)ELEM ==> dp0_thryvar(s0,pk_thryvar) = Un(s0)
		(Stat3)ELEM ==> (if dp0_thryvar(s0,pk_thryvar) = {fail} then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if) eq Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
		(Stat1*)ELEM ==> (not Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)))
		EQUAL(Stat6) ==> (not Has_dpModel_thryvar(s0,Un(s0)))
		TdavisPutnam4 ==> Stat7: (FORALL s | ({u: u in s, h in u | (u = {h}) & ({h,tog(h)} * Un(s - {u}) = 0)} incs s) imp (Has_dpModel_thryvar(s,Un(s)) & Is_dpSat_thryvar(s)))
		s0-->Stat7(Stat6*) ==> not({u: u in s0, h in u | (u = {h}) & ({h,tog(h)} * Un(s0 - {u}) = 0)} incs s0)
	Use_def(settled_thryvar)(Stat7*) ==> false; Discharge ==> AUTO
	ELEM ==> Stat8: n0 = 0
	EQUAL(Stat1,Stat8) ==> #Un(s0 - settled_thryvar(s0)) = 0
	(Un(s0 - settled_thryvar(s0)))-->T162(Stat8*) ==> Un(s0 - settled_thryvar(s0)) = 0
	(s0 - settled_thryvar(s0))-->T275(Stat3*) ==> false
	Discharge ==> QED
--
Theorem davisPutnam11: (S in clauSets_thryvar) imp
(if fail in dp0_thryvar(S,pk_thryvar) then (not Is_dpSat_thryvar(S)) else Has_dpModel_thryvar(S,dp0_thryvar(S,pk_thryvar)) end if). Proof:
Suppose_not(s) ==> AUTO
--
-- The assertion will be proved by mathematical induction on the number
--	$n = #Un(s - settled_thryvar(s))$.
-- If $n = 0$, then
--	$((s - settled_thryvar(s)) = 0) or ((s - settled_thryvar(s)) = {0})$.
-- If the former alternative holds, then the value returned by $dp0_thryvar$ will be
-- $Un(s)$, and actually we know by Theorem $davisPutnam3$ (recalling the definition
-- of $settled_thryvar$) that this is a correct answer, namely a model of $s$.
-- If the latter alternative holds, then $dp0_thryvar$ will return the answer
-- ${fail}$, which is again correct by Theorem $davisPutnam3$, since $0$ belongs to
-- $s$ in this case. If $0 in n$, then $pk_thryvar$ will pick a literal $h$ from one of
-- the clauses in $s - settled_thryvar(s)$, and one or two sets of clauses whose
-- unsettled part involves one or two fewer literals will be passed over to the recursive
-- treatment. Being smaller, these sets of clauses will satisfy the induction
-- hypothesis and we can exploit the splitting rule appearing within Theorem $davisPutnam3$
-- in order to perform the induction step.
--
	Loc_def ==> Stat1: n = #Un(s - settled_thryvar(s))
--
-- To enable the mathematical induction argument, we must first show that
-- $n$, as just defined, is an unsigned integer, and that there is a set
-- $s$ of clauses satisfying the relationship $Stat2 and contradicting the hypothesis
-- of the theorem (this follows readily from the Suppose_not line with which our
-- argument by contradiction has begun).
--
	s-->TdavisPutnam7(*) ==> n in Za
	Suppose ==> Stat3: (FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = n) imp
			if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if)
		s-->Stat3 ==> false
	Discharge ==> AUTO
--
-- We now assume that $n0$ is the minimum cardinality for which a set $s0$ of clauses
-- exists having $#Un(s0 - settled_thryvar(s0))=n0$ and contradicting the assertion of the
-- present theorem.
--
	APPLY(m2_thryvar:n0) mathematical_induction(n->n,P(x)->(not(FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = x) imp if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if))) ==>
		Stat4: (n0 in Za) & Stat5: (not(FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = n0) imp
			if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if)) &
			(FORALL n in n0 | not(not(FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = n) imp
			if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if)))
	s0-->Stat5(Stat4*) ==> Stat6: (s0 in clauSets_thryvar) & (#Un(s0 - settled_thryvar(s0)) = n0) &
			(not if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if) &
		Stat7: (FORALL n in n0 | FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = n) imp
			if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if)
--
-- It is quickly seen that $0 notin s0$ and that $s0 /= settled_thryvar(s0)$; therefore
-- $n0 /= 0$ and the response $dp0_thryvar(s0,pk_thryvar)$ concerning $s0$ is determined by
-- use of $pk_thryvar$ to select a literal from $s0 - settled_thryvar(s0)$ and by means of
-- either the splitting rule or the pure literal rule, as recalled below.
--
	s0-->TdavisPutnam10(Stat6*) ==> Stat8: (not(0 in s0)) & (not(settled_thryvar(s0) incs s0)) & (n0 /= 0)
--
	s0-->TdavisPutnam9(Stat6*) ==> Stat9: ((pk_thryvar~[s0]) in Un(s0 - settled_thryvar(s0))) &
		((tog(pk_thryvar~[s0]) in Un(s0)) imp (tog(pk_thryvar~[s0]) in Un(s0 - settled_thryvar(s0)))) &
		((pk_thryvar~[s0]) /= fail) & (tog(pk_thryvar~[s0]) /= fail)
--
	TdavisPutnam6 ==> Stat10: (FORALL x, p | (x in clauSets_thryvar) imp (dp0_thryvar(x,p) =
		f3_dp_thryvar(x,{dp0_thryvar(y,p): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) incin Un(x - settled_thryvar(x))) &
		 (Un(y - settled_thryvar(y)) /= Un(x - settled_thryvar(x)))) &
		P3_dp_thryvar(x,y,p)},p)))
--
	(s0,pk_thryvar)-->Stat10(Stat6*) ==> dp0_thryvar(s0,pk_thryvar) =
		f3_dp_thryvar(s0,{dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) incin Un(s0 - settled_thryvar(s0))) &
		 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
		P3_dp_thryvar(s0,y,pk_thryvar)},pk_thryvar)
--
-- The collection $m0$ of models from which the model of $s0$ (if any) will be extracted
-- is constructed as follows:
--
	Loc_def ==> Stat11: m0 = {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
		((Un(y - settled_thryvar(y)) incin Un(s0 - settled_thryvar(s0))) &
		 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
		P3_dp_thryvar(s0,y,pk_thryvar)}
--
	Use_def(f3_dp_thryvar)(Stat8,Stat8*) ==> f3_dp_thryvar(s0,m0,pk_thryvar) = arb({ w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) })
--
	EQUAL(Stat10) ==> Stat12: dp0_thryvar(s0,pk_thryvar) = arb({ w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) })
--
	(s0, s0 - settled_thryvar(s0))-->TdavisPutnam3(Stat6,Stat6*) ==> Stat13: (s0 - settled_thryvar(s0)) in clauSets_thryvar
	(s0 - settled_thryvar(s0))-->TdavisPutnam1(Stat13*) ==> Finite(Un(s0 - settled_thryvar(s0)))
--
-- Whichever of the splitting rule and the pure literal rule is applied, $s0$ gets
-- reduced, relative to the literal $pk_thryvar~[s0]$, to the following set
-- $s1$ whose models (if any) will also be models for $s0$:
--
	Loc_def ==> Stat14: (s1 = {{pk_thryvar~[s0]}} + {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c}) &
		(m1 = dp0_thryvar(s1,pk_thryvar))
--
-- This set $s1$ is "smaller" that $s0$, in the sense of having fewer unsettled literals;
-- therefore it meets the induction hypothesis:
--
	(s0,(pk_thryvar~[s0]),s1)-->TdavisPutnam8(Stat6, Stat9, Stat14*) ==>
			(s1 in clauSets_thryvar) &
			(Un(s1 - settled_thryvar(s1)) incin Un(s0 - settled_thryvar(s0))) &
			(Un(s1 - settled_thryvar(s1)) /= Un(s0 - settled_thryvar(s0)))
	Suppose ==> (not if fail in m1 then (not Is_dpSat_thryvar(s1)) else Has_dpModel_thryvar(s1,dp0_thryvar(s1,pk_thryvar)) end if)
		(s1, s1 - settled_thryvar(s1))-->TdavisPutnam3(Stat14*) ==> (s1 - settled_thryvar(s1)) in clauSets_thryvar
		(s1 - settled_thryvar(s1))-->TdavisPutnam1(Stat14*) ==> Finite(Un(s1 - settled_thryvar(s1)))
		(Un(s0 - settled_thryvar(s0)),Un(s1 - settled_thryvar(s1)))-->T194(Stat6*) ==> #Un(s1 - settled_thryvar(s1)) in n0
		(#Un(s1 - settled_thryvar(s1)))-->Stat7(Stat14*) ==> Stat15: (FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = #Un(s1 - settled_thryvar(s1))) imp
			if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if)
		s1-->Stat15(Stat14*) ==> false
	Discharge ==> AUTO
	(Stat14*)ELEM ==> Stat16: if fail in m1 then (not Is_dpSat_thryvar(s1)) else Has_dpModel_thryvar(s1,dp0_thryvar(s1,pk_thryvar)) end if
	EQUAL(Stat14) ==> Stat17: if fail in m1 then (not Is_dpSat_thryvar(s1)) else Has_dpModel_thryvar(s1,m1) end if
--
-- When $s0$ meets the condition for applying the splitting rule, $s2$ is obtained from $s0$
-- in a way analogous to $s1$, but reducing relative to $tog(pk_thryvar~[s0])$.
--
	(pk_thryvar~[s0])-->TdavisPutnam0(Stat18*) ==> Stat18: tog(tog(pk_thryvar~[s0])) = (pk_thryvar~[s0])
--
	Loc_def ==> Stat19: (s2 = {{tog(pk_thryvar~[s0])}} + {c - {pk_thryvar~[s0]}: c in s0 | tog(pk_thryvar~[s0]) notin c}) &
		(m2 = dp0_thryvar(s2,pk_thryvar))
	EQUAL(Stat18) ==> Stat20: s2 = {{tog(pk_thryvar~[s0])}} + {c - {tog(tog(pk_thryvar~[s0]))}: c in s0 | tog(pk_thryvar~[s0]) notin c}
--
	Suppose ==> not((tog(pk_thryvar~[s0]) in Un(s0)) imp ((s2 in clauSets_thryvar) &
				(Un(s2 - settled_thryvar(s2)) incin Un(s0 - settled_thryvar(s0))) &
				(Un(s2 - settled_thryvar(s2)) /= Un(s0 - settled_thryvar(s0))) &
				(if fail in m2 then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar)) end if)))
--
-- This set $s2$ is "smaller" that $s0$, in the sense of having fewer unsettled literals;
-- therefore it meets the induction hypothesis:
--
		s0-->TdavisPutnam9(Stat9*) ==> Stat21: tog(pk_thryvar~[s0]) in Un(s0 - settled_thryvar(s0))
		(s0,tog(pk_thryvar~[s0]),s2)-->TdavisPutnam8(Stat6, Stat9, Stat21, Stat20*) ==>
				(s2 in clauSets_thryvar) &
				(Un(s2 - settled_thryvar(s2)) incin Un(s0 - settled_thryvar(s0))) &
				(Un(s2 - settled_thryvar(s2)) /= Un(s0 - settled_thryvar(s0)))
		(Stat19*)ELEM ==> (not if fail in dp0_thryvar(s2,pk_thryvar) then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar)) end if)
		(s2, s2 - settled_thryvar(s2))-->TdavisPutnam3(Stat19*) ==> (s2 - settled_thryvar(s2)) in clauSets_thryvar
		(s2 - settled_thryvar(s2))-->TdavisPutnam1(Stat19*) ==> Finite(Un(s2 - settled_thryvar(s2)))
		(Un(s0 - settled_thryvar(s0)),Un(s2 - settled_thryvar(s2)))-->T194(Stat6*) ==> #Un(s2 - settled_thryvar(s2)) in n0
		(#Un(s2 - settled_thryvar(s2)))-->Stat7(Stat19*) ==> Stat22: (FORALL s in clauSets_thryvar | (#Un(s - settled_thryvar(s)) = #Un(s2 - settled_thryvar(s2))) imp
			if fail in dp0_thryvar(s,pk_thryvar) then (not Is_dpSat_thryvar(s)) else Has_dpModel_thryvar(s,dp0_thryvar(s,pk_thryvar)) end if)
		s2-->Stat22(Stat19*) ==> false
	Discharge ==> AUTO
--
-- One sees that $m0 = {m1}$ or $m0 = {m1,m2}$ depending on whether the pure
-- literal rule or the splitting rule is exploited.
--
	Suppose ==> Stat23: m0 /= if (tog(pk_thryvar~[s0]) in Un(s0)) then {m1,m2} else {m1} end if
--
		EQUAL(Stat11,Stat23) ==> Stat24: {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
			((Un(y - settled_thryvar(y)) incin Un(s0 - settled_thryvar(s0))) &
			 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
			P3_dp_thryvar(s0,y,pk_thryvar)}  /= if tog(pk_thryvar~[s0]) in Un(s0) then {m1,m2} else {m1} end if
--
-- Since $m1$ certainly belongs to the right-hand side of this inequality,
-- we want to establish that it also belongs to its left-hand side.
--
		Suppose ==> Stat25: m1 notin {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
				((Un(y - settled_thryvar(y)) incin Un(s0 - settled_thryvar(s0))) &
				 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
				P3_dp_thryvar(s0,y,pk_thryvar)}
--
			Use_def(P3_dp_thryvar)(Stat13*) ==> P3_dp_thryvar(s0,s1,pk_thryvar)
			s1-->Stat25(Stat14*) ==> false
		Discharge ==> AUTO
--
		Suppose ==> Stat26: tog(pk_thryvar~[s0]) in Un(s0)
--
-- Since $m2$ certainly belongs to the right-hand side of the supposed equality,
-- we want to establish that it also belongs to its left-hand side...
--
			Suppose ==> Stat27: m2 notin {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
				((Un(y - settled_thryvar(y)) incin Un(s0 - settled_thryvar(s0))) &
				 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
				P3_dp_thryvar(s0,y,pk_thryvar)}
--
				Use_def(P3_dp_thryvar)(Stat13*) ==> P3_dp_thryvar(s0,s2,pk_thryvar)
				s2-->Stat27(Stat19*) ==> false
			Discharge ==> AUTO
--
-- ...so that it is the left-hand side which is not included in the right-hand side.
--
			(Stat24*)ELEM ==> Stat28: {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
				((Un(y - settled_thryvar(y)) incin Un(s0 - settled_thryvar(s0))) &
				 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
				P3_dp_thryvar(s0,y,pk_thryvar)} nincin {m1,m2}
--
			m3-->Stat28(Stat28*) ==> Stat29: (m3 in {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
				((Un(y - settled_thryvar(y)) incin Un(s0 - settled_thryvar(s0))) &
				 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
				P3_dp_thryvar(s0,y,pk_thryvar)}) & (m3 /= m1) & (m3 /= m2)
			s3-->Stat29(Stat14,Stat19*) ==> Stat30: P3_dp_thryvar(s0,s3,pk_thryvar) &
				(dp0_thryvar(s3,pk_thryvar) /= dp0_thryvar(s1,pk_thryvar)) &
				(dp0_thryvar(s3,pk_thryvar) /= dp0_thryvar(s2,pk_thryvar))
--
			Use_def(P3_dp_thryvar)(Stat30,Stat26*) ==> Stat31:
		(s3 = {{tog(pk_thryvar~[s0])}} + {c - {pk_thryvar~[s0]}: c in s0 | tog(pk_thryvar~[s0]) notin c}) or
		(s3 = {{pk_thryvar~[s0]}} + {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c})
--
			(Stat31,Stat14,Stat19*)ELEM ==> (s3 = s1) or (s3 = s2)
			Suppose ==> s3 = s1
				EQUAL(Stat30) ==> false
			Discharge ==> s3 = s2
			EQUAL(Stat30) ==> false
		Discharge ==> Stat32: not(tog(pk_thryvar~[s0]) in Un(s0))
		(Stat24*)ELEM ==> Stat33: {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
				((Un(y - settled_thryvar(y)) incin Un(s0 - settled_thryvar(s0))) &
				 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
				P3_dp_thryvar(s0,y,pk_thryvar)} nincin {m1}
		m4-->Stat33(Stat33*) ==> Stat34: (m4 in {dp0_thryvar(y,pk_thryvar): y in clauSets_thryvar |
				((Un(y - settled_thryvar(y)) incin Un(s0 - settled_thryvar(s0))) &
				 (Un(y - settled_thryvar(y)) /= Un(s0 - settled_thryvar(s0)))) &
				P3_dp_thryvar(s0,y,pk_thryvar)}) & (m4 /= m1)
		s4-->Stat34(Stat14,Stat14*) ==> Stat35: P3_dp_thryvar(s0,s4,pk_thryvar) &
				(dp0_thryvar(s4,pk_thryvar) /= dp0_thryvar(s1,pk_thryvar))
--
		Use_def(P3_dp_thryvar)(Stat35,Stat32,Stat14*) ==> s4 = s1
		EQUAL(Stat35) ==> false
--
	Discharge ==> Stat36: not(m0 /= if (tog(pk_thryvar~[s0]) in Un(s0)) then {m1,m2} else {m1} end if)
	(Stat36*)ELEM ==> Stat37: m0 = if (tog(pk_thryvar~[s0]) in Un(s0)) then {m1,m2} else {m1} end if
--
--
--
	TdavisPutnam4 ==>
Stat38:	(FORALL h, s | (tog(h) notin Un(s)) imp
			(Is_dpSat_thryvar(s) eq Is_dpSat_thryvar({{h}} + {c in s | h notin c}))) &
Stat39:	(FORALL s, h | Is_dpSat_thryvar(s) eq
			(Is_dpSat_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}) or
			 Is_dpSat_thryvar({{tog(h)}} + {c - {h}: c in s | tog(h) notin c}))) &
Stat40:	(FORALL h, s, m | Has_dpModel_thryvar({{h}} + {c - {tog(h)}: c in s | h notin c}, m) imp
			Has_dpModel_thryvar(s,m)) &
Stat41:	(FORALL h, s, m | (({h} in s) & Has_dpModel_thryvar(s,m)) imp ((h in m) & (tog(h) notin m)))
--
-- We now begin to analyze the various possibilities arising:
--
	Suppose ==> not((m0 = {m1}) or (m0 = {m1,m2}))
		(Stat37)ELEM ==> false
	Discharge ==> AUTO
	(Stat38*)ELEM ==> Stat42: ((m0 = {m1}) or (m0 = {m1,m2})) & (m1 in m0)
--
-- The possibility that $fail notin m1$ gets easily discarded, arguing as follows:
--
	Suppose ==> not(fail in m1)
		(Stat42*)ELEM ==> if fail in m1 then (not Is_dpSat_thryvar(s1)) else Has_dpModel_thryvar(s1,dp0_thryvar(s1,pk_thryvar)) end if eq Has_dpModel_thryvar(s1,dp0_thryvar(s1,pk_thryvar))
		(Stat14*)ELEM ==> Stat43: Has_dpModel_thryvar(s1,dp0_thryvar(s1,pk_thryvar))
		EQUAL(Stat14,Stat43) ==> Stat44:
			Has_dpModel_thryvar({{pk_thryvar~[s0]}} + {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c},m1)
		Suppose ==> Stat45: dp0_thryvar(s0,pk_thryvar) /= m1
			EQUAL(Stat12,Stat45) ==> arb({ w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) }) /= m1
			Suppose ==> Stat46: m1 notin { w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) }
				(pk_thryvar~[s0],{{pk_thryvar~[s0]}} + {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c},m1)-->Stat41(Stat44*) ==> (pk_thryvar~[s0]) in m1
				m1-->Stat46(Stat42*) ==> false
			Discharge ==> AUTO
			(Stat45)ELEM ==> Stat47: { w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) } nincin {m1}
			w5-->Stat47(Stat47*) ==> Stat48: (w5 in { w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) }) & (w5 /= m1)
			Suppose ==> Stat49: not(tog(pk_thryvar~[s0]) in Un(s0))
				(Stat37,Stat49)ELEM ==> m0 = {m1}
				()-->Stat48(Stat48*) ==> false
			Discharge ==> AUTO
			Suppose ==> Stat50: (FORALL v in m0 | fail in v)
				m1-->Stat50(Stat42*) ==> false
			Discharge ==> AUTO
			()-->Stat48(Stat42*) ==> (m2 in m0) & ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in m2)) & (fail notin m2)
			(m1,m2)-->T106 ==> AUTO
			(m0,{m1,m2})-->T276(Stat42*) ==> Stat51: (pk_thryvar~[s0]) in m2
			(Stat19*)ELEM ==> Stat52: if fail in m2 then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar)) end if eq Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar))
			(Stat19*)ELEM ==> Stat53: Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar))
			EQUAL(Stat19,Stat53) ==> Stat54:
					Has_dpModel_thryvar({{tog(pk_thryvar~[s0])}} + {c - {pk_thryvar~[s0]}: c in s0 | tog(pk_thryvar~[s0]) notin c},m2)
			(tog(pk_thryvar~[s0]),{{tog(pk_thryvar~[s0])}} + {c - {pk_thryvar~[s0]}: c in s0 | tog(pk_thryvar~[s0]) notin c},m2)-->Stat41(Stat19,Stat54,Stat18,Stat51*) ==> false
		Discharge ==> Stat55: dp0_thryvar(s0,pk_thryvar) = m1
--
		EQUAL(Stat44) ==> Has_dpModel_thryvar({{pk_thryvar~[s0]}} + {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c},dp0_thryvar(s0,pk_thryvar))
		(pk_thryvar~[s0],s0,dp0_thryvar(s0,pk_thryvar))-->Stat40(Stat55*) ==> Stat56: Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
		(Stat42*)ELEM ==> fail notin dp0_thryvar(s0,pk_thryvar)
		(Stat44)ELEM ==> Stat57: (not if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if) eq (not Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)))
		(Stat6,Stat56,Stat57*)ELEM ==> false
	Discharge ==> AUTO
--
	(Stat42*)ELEM ==> Stat58: if fail in m1 then (not Is_dpSat_thryvar(s1)) else Has_dpModel_thryvar(s1,dp0_thryvar(s1,pk_thryvar)) end if eq (not Is_dpSat_thryvar(s1))
	(Stat58,Stat16*)ELEM ==> Stat59: (not Is_dpSat_thryvar(s1))
--
-- Knowing now that $fail in m1$, we have two more cases to examine: the one
-- when the pure literal case applies to $pk_thryvar~[s0]$, and the one when
-- the splitting rule applies to it. Consider the pure literal case first.
--
	Suppose ==> Stat60: not(tog(pk_thryvar~[s0]) in Un(s0))
		(Stat37,Stat60*)ELEM ==> Stat61: m0 = {m1}
		(s0 - settled_thryvar(s0),s0)-->T276(Stat9,Stat9*) ==>
			(pk_thryvar~[s0]) in Un(s0)
		(pk_thryvar~[s0],s0)-->Stat38(Stat60,Stat60*) ==> Stat62:
			Is_dpSat_thryvar(s0) eq Is_dpSat_thryvar({{pk_thryvar~[s0]}} + {c in s0 | (pk_thryvar~[s0]) notin c})
		(pk_thryvar~[s0],s0)-->TdavisPutnam0(Stat60*) ==> Stat63:
			{c in s0 | (pk_thryvar~[s0]) notin c} = {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c}
		EQUAL(Stat14,Stat58,Stat62,Stat63) ==> Stat64: (not Is_dpSat_thryvar(s0)) eq (not Is_dpSat_thryvar(s1))
--
		Suppose ==> Stat65: dp0_thryvar(s0,pk_thryvar) /= m1
			EQUAL(Stat12,Stat61,Stat65) ==> arb({ w in {m1} | ((fail notin Un({m1})) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in {m1} | fail in v)) }) /= m1
			Suppose ==> Stat66: { w in {m1} | ((fail notin Un({m1})) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in {m1} | fail in v)) } nincin {m1}
				w6-->Stat66(Stat66*) ==> Stat67: (w6 in { w in {m1} | ((fail notin Un({m1})) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in {m1} | fail in v)) }) & (w6 /= m1)
				()-->Stat67(Stat67*) ==> false
			Discharge ==> AUTO
			(Stat65)ELEM ==> Stat68: m1 notin { w in {m1} | ((fail notin Un({m1})) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in {m1} | fail in v)) }
			m1-->T107(Stat68*) ==> Un({m1}) = m1
			m1-->Stat68(Stat42*) ==> Stat69: not(FORALL v in {m1} | fail in v)
			m5-->Stat69(Stat42*) ==> false
		Discharge ==> Stat70: dp0_thryvar(s0,pk_thryvar) = m1
		EQUAL(Stat6,Stat70,Stat64) ==> Stat71: (not if fail in m1 then (not Is_dpSat_thryvar(s1)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if)
		(Stat42*)ELEM ==> false
--
-- Consider last the splitting rule when $fail in m1$.
--
	Discharge ==> tog(pk_thryvar~[s0]) in Un(s0)
	(Stat37*)ELEM ==> Stat72: (m0 = {m1,m2}) & (fail in m1)
	Suppose ==> fail notin Un(m0)
		(fail,m0)-->T105(Stat72*) ==> Stat73: m1 notin {c in m0 | fail in c}
		m1-->Stat73(Stat72*) ==> false
	Discharge ==> AUTO
--
	Suppose ==> Stat74: fail in m2
--
-- If $fail in m2$ too, then $fail in m0$, consistent with the fact that $s0$ is unsatisfiable,
-- but conflicting with the initial assumption Stat75
--
		(Stat74*)ELEM ==> if fail in m2 then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar)) end if eq (not Is_dpSat_thryvar(s2))
--
-- Firstly, we have $not Is_dpSat_thryvar(s2)$:
--
		(Stat19*)ELEM ==> Stat76: (not Is_dpSat_thryvar(s2))
--
-- Moreover, by the splitting rule, we have $not Is_dpSat_thryvar(s0)$:
--
		(s0,pk_thryvar~[s0])-->Stat39(Stat76*) ==> Stat77: Is_dpSat_thryvar(s0) eq
			(Is_dpSat_thryvar({{pk_thryvar~[s0]}} + {c - {tog(pk_thryvar~[s0])}: c in s0 | (pk_thryvar~[s0]) notin c}) or
			 Is_dpSat_thryvar({{tog(pk_thryvar~[s0])}} + {c - {pk_thryvar~[s0]}: c in s0 | tog(pk_thryvar~[s0]) notin c}))
		EQUAL(Stat77,Stat14,Stat19) ==> Stat78: Is_dpSat_thryvar(s0) eq
			(Is_dpSat_thryvar(s1) or Is_dpSat_thryvar(s2))
		(Stat59,Stat76,Stat78*)ELEM ==> Stat79: (not Is_dpSat_thryvar(s0))
--
-- Then we have $fail in dp0_thryvar(s0,pk_thryvar)$, since all potential elements
-- of the nonnull set $m$ for which $dp0_thryvar(s0,pk_thryvar) = arb(m)$ holds have
-- $fail$ as a member.
--
		Suppose ==> Stat80: m1 notin { w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) }
			m1-->Stat80(Stat72*) ==> Stat81: not(FORALL v in m0 | fail in v)
			w7-->Stat81(Stat72,Stat74*) ==> false
		Discharge ==> AUTO
		({ w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) })-->T0(Stat79*) ==>
			Stat82: arb({ w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) }) in { w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) }
		()-->Stat82(Stat72,Stat74*) ==> fail in arb({ w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) })
		EQUAL(Stat12) ==> Stat83: fail in dp0_thryvar(s0,pk_thryvar)
--
-- All of this enters into conflict with the induction hypothesis:
--
		(Stat83*)ELEM ==> Stat84: if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if eq (not Is_dpSat_thryvar(s0))
		EQUAL(Stat6,Stat79,Stat84) ==> false
	Discharge ==> AUTO
--
-- If $fail notin m2$ too, then $m2 = m0$, consistent with the fact that $m2$ models $s2$ and
-- hence mdels $s2$, but conflicting with the initial assumption Stat75
--
	(Stat20*)ELEM ==> Stat85: if fail in m2 then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar)) end if
	EQUAL(Stat19,Stat85) ==> Stat86: if fail in m2 then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,m2) end if
	(Stat72*)ELEM ==> Stat87: if fail in m2 then (not Is_dpSat_thryvar(s2)) else Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar)) end if eq Has_dpModel_thryvar(s2,dp0_thryvar(s2,pk_thryvar))
	(tog(pk_thryvar~[s0]),s0,m2)-->Stat40(Stat72*) ==> Stat88:
			Has_dpModel_thryvar({{tog(pk_thryvar~[s0])}} + {c - {tog(tog(pk_thryvar~[s0]))}: c in s0 | tog(pk_thryvar~[s0]) notin c}, m2) imp
			Has_dpModel_thryvar(s0,m2)
	EQUAL(Stat85,Stat87,Stat19,Stat20,Stat18) ==> Stat89: Has_dpModel_thryvar({{tog(pk_thryvar~[s0])}} + {c - {tog(tog(pk_thryvar~[s0]))}: c in s0 | tog(pk_thryvar~[s0]) notin c}, m2)
	(Stat88*)ELEM ==> Stat90: Has_dpModel_thryvar(s0,m2)
	Suppose ==> Stat91: m1 in { w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) }
		()-->Stat91(Stat72*) ==> Stat92: (FORALL v in m0 | fail in v)
			m2-->Stat92(Stat72*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat93: m2 notin { w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) }
		m2-->Stat93(Stat72*) ==> Stat94: (pk_thryvar~[s0]) in m2
		(tog(pk_thryvar~[s0]),{{tog(pk_thryvar~[s0])}} + {c - {tog(tog(pk_thryvar~[s0]))}: c in s0 | tog(pk_thryvar~[s0]) notin c}, m2)-->Stat41(Stat89,Stat18,Stat94*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat95: m2 /= arb({ w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) })
		({ w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) })-->T0(Stat90*) ==> Stat96:
			{ w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) } nincin {m2}
		w9-->Stat96(Stat72*) ==> Stat97: (w9 in { w in m0 | ((fail notin Un(m0)) imp ((pk_thryvar~[s0]) in w)) & ((fail in w) imp (FORALL v in m0 | fail in v)) }) & (w9 /= m2)
		()-->Stat97(Stat72*) ==> false
	Discharge ==> AUTO
	EQUAL(Stat12) ==> Stat98: (m2 = dp0_thryvar(s0,pk_thryvar)) & (fail notin dp0_thryvar(s0,pk_thryvar))
	(Stat98*)ELEM ==> Stat99: if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if eq Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
	EQUAL(Stat6,Stat98,Stat99,Stat90) ==> false
	Discharge ==> QED
--
-- Assuming that $M$ is a model for the non-tautological clauses in $S$ (or the pseudo-model if
-- $S$ is unsatisfiable), we can readjust it to the entire $S$ as follows:
--
Def davisPutnam5: modelTaut_thryvar(S,M) := if fail in M then {fail} else
			M + {arb({h,tog(h)}): c in S, h in (c - M) | tog(h) in (c - M)} end if
--
-- In particular, we can exploit the preceding construct to introduce an optimization to the
-- above-specified Davis-Putnam algorithm:
--
Def davisPutnam6: dp_thryvar(S) := modelTaut_thryvar(S,dp0_thryvar(S - {c: c in S, h in c | tog(h) in c},pk_thryvar))
--
--
--
Theorem davisPutnam12: (S in clauSets_thryvar) imp (Is_dpSat_thryvar(S) eq (fail notin dp_thryvar(S))). Proof:
Suppose_not(s) ==> AUTO
	Loc_def ==> Stat1: s0 = s - {c: c in s, h in c | tog(h) in c}
	(s,s0)-->TdavisPutnam3(*) ==> s0 in clauSets_thryvar
	Use_def(dp_thryvar(s)) ==> AUTO
	Use_def(modelTaut_thryvar(s, dp0_thryvar(s - {c: c in S, h in c | tog(h) in c},pk_thryvar))) ==> AUTO
	EQUAL ==> dp_thryvar(s) = if fail in dp0_thryvar(s0,pk_thryvar) then {fail}
					else (dp0_thryvar(s0,pk_thryvar) +
						{arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})
				end if
--
-- the direct implication
--
	Suppose ==> Stat2: (Is_dpSat_thryvar(s)) & (fail in dp_thryvar(s))
--
-- we have two cases: $({fail} = dp0_thryvar(s0,pk_thryvar)) or ({fail} = {arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})$
--
-- consider the first case
--
		Suppose ==> Stat3: fail in dp0_thryvar(s0,pk_thryvar)
			(Stat3)ELEM ==> if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if eq (not Is_dpSat_thryvar(s0))
			(s0)-->TdavisPutnam11(*) ==> (not Is_dpSat_thryvar(s0))
			TdavisPutnam4(*) ==> Stat4: (FORALL t,s | ((t incin s) & Is_dpSat_thryvar(s)) imp Is_dpSat_thryvar(t))
			(s0, s)-->Stat4(*) ==> false
		Discharge ==> Stat5: fail in {arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))}
--
-- the second case
--
		(c1,h1)-->Stat5 ==> Stat6: (c1 in s) & (h1 in c1) & (fail = arb({h1,tog(h1)}))
--
-- we have $fail in {h1,tog(h1)}$ and hence $(fail = h1) or (fail = tog(h1))$
--
		Use_def(clauSets_thryvar) ==> Stat7: s in { s incin pow(lits) | Finite(Un(s)) }
		()-->Stat7(Stat5*) ==> c1 in pow(lits)
		Use_def(pow) ==> Stat8: c1 in {x: x incin lits}
		x1-->Stat8(Stat6,Stat6*) ==> Stat9: h1 in lits
--
-- as $c1 incin lits$ and $h1 in c1$, we have $h1 in lists$ and we discard the case $fail = h1$
--
		Assump ==> fail notin lits
		(Stat5)ELEM ==> fail = tog(h1)
		Assump ==> Stat10: {tog(x): x in lits} = lits
		Suppose ==> Stat11: tog(h1) notin {tog(x): x in lits}
			h1-->Stat11(Stat9,Stat9*) ==> false
		Discharge ==> AUTO
		EQUAL(Stat5*) ==> false
	Discharge ==> Stat12: (not Is_dpSat_thryvar(s)) & (fail notin dp_thryvar(s))
--
-- the reverse implication
--
	TdavisPutnam4 ==> Stat13: (FORALL s | Is_dpSat_thryvar(s) = (EXISTS m | Has_dpModel_thryvar(s,m)))
	s-->Stat13(Stat13*) ==> Is_dpSat_thryvar(s) = (EXISTS m | Has_dpModel_thryvar(s,m))
	EQUAL(Stat12) ==> Stat14: not (EXISTS m | Has_dpModel_thryvar(s,m))
	(s0)-->TdavisPutnam11(Stat1*) ==> Stat15: if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else (Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))) end if
--
-- first case, ${fail} = dp0_thryvar(s0,pk_thryvar)$
--
	Suppose ==> Stat16: fail notin dp0_thryvar(s0,pk_thryvar)
--
-- we obtain that $dp0_thryvar(s0,pk_thryvar)$ is a model for $s0$, and therefore for $s$
--
		(Stat16)ELEM ==> if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else (Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))) end if eq Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
		(Stat15)ELEM ==> Stat17: Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
		TdavisPutnam4(*) ==> Stat18: (FORALL s, m, t | Has_dpModel_thryvar(s,m) imp Has_dpModel_thryvar(s + {c: c in t, h in c | tog(h) in c}, m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}))
--
-- we show that $s0 + {c: c in s, h in c | tog(h) in c} = s$ to be able to apply the above corollary
--
		Suppose ==> Stat19: not ({c: c in s, h in c | tog(h) in c} incin s)
			(c2)-->Stat19(Stat19*) ==> Stat20: (c2 in {c: c in s, h in c | tog(h) in c}) & (c2 notin s)
			(c3,h3)-->Stat20(Stat20*) ==> false
		Discharge ==> Stat21: AUTO
		(Stat1, Stat21*)ELEM ==> Stat22: s0 + {c: c in s, h in c | tog(h) in c} = s

		(s0, dp0_thryvar(s0,pk_thryvar), s)-->Stat18(Stat18*) ==> Stat23: Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) imp Has_dpModel_thryvar(s0 + {c: c in s, h in c | tog(h) in c}, dp0_thryvar(s0,pk_thryvar) + {arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})

		EQUAL(Stat17, Stat22, Stat23) ==> Stat24: Has_dpModel_thryvar(s, dp0_thryvar(s0,pk_thryvar) + {arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})
--
-- we have obtained a model for $s$, contradiction
--
		(dp0_thryvar(s0,pk_thryvar) + {arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})-->Stat14(Stat24*) ==> false
	Discharge ==> false
	Discharge ==> QED
--
--
--
Theorem davisPutnam13: (S in clauSets_thryvar) imp
		(Is_dpSat_thryvar(S) eq Has_dpModel_thryvar(S,dp_thryvar(S))). Proof:
Suppose_not(s) ==> AUTO
--
-- the reverse implication
--
	Suppose ==> Has_dpModel_thryvar(s,dp_thryvar(s)) & (not Is_dpSat_thryvar(s))
		TdavisPutnam4 ==> Stat1: (FORALL s | Is_dpSat_thryvar(s) = (EXISTS m | Has_dpModel_thryvar(s,m)))
		s-->Stat1(Stat1) ==> Is_dpSat_thryvar(s) = (EXISTS m | Has_dpModel_thryvar(s,m))
		EQUAL ==> Stat2: not (EXISTS m | Has_dpModel_thryvar(s,m))
		(dp_thryvar(s))-->Stat2(*) ==> false
	Discharge ==> Stat3: Is_dpSat_thryvar(s) & (not Has_dpModel_thryvar(s,dp_thryvar(s)))
--
-- the direct implication
--
	Loc_def ==> Stat4: s0 = s - {c: c in s, h in c | tog(h) in c}
	(s,s0)-->TdavisPutnam3(*) ==> Stat5: s0 in clauSets_thryvar
	s-->TdavisPutnam12(*) ==> Stat6: fail notin dp_thryvar(s)
	Use_def(dp_thryvar(s)) ==> AUTO
	Use_def(modelTaut_thryvar(s, dp0_thryvar(s - {c: c in S, h in c | tog(h) in c},pk_thryvar))) ==> AUTO
	EQUAL(Stat4) ==> Stat7: dp_thryvar(s) = if fail in dp0_thryvar(s0,pk_thryvar) then {fail}
					else (dp0_thryvar(s0,pk_thryvar) +
						{arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})
				end if
	(Stat6,Stat7)ELEM ==> Stat8: {fail} /= if fail in dp0_thryvar(s0,pk_thryvar) then {fail}
					else (dp0_thryvar(s0,pk_thryvar) +
						{arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})
				end if
	Suppose ==> Stat9: fail in dp0_thryvar(s0,pk_thryvar)
		(s0)-->TdavisPutnam11(*) ==> if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if
		(Stat9)ELEM ==> if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if eq (not Is_dpSat_thryvar(s0))
		EQUAL(Stat9) ==> (not Is_dpSat_thryvar(s0))
		TdavisPutnam4(*) ==> Stat10: (FORALL t,s | ((t incin s) & Is_dpSat_thryvar(s)) imp Is_dpSat_thryvar(t))
		(s0, s)-->Stat10(Stat3*) ==> false
	Discharge ==> Stat11: fail notin dp0_thryvar(s0,pk_thryvar)
	(Stat7,Stat11)ELEM ==> Stat12: dp_thryvar(s) = (dp0_thryvar(s0,pk_thryvar) +
						{arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})
--
-- we can apply Theorem davisPutnam11 and arrive at a contradiction
--
	(s0)-->TdavisPutnam11(Stat4*) ==> if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if
	(Stat11)ELEM ==> (if fail in dp0_thryvar(s0,pk_thryvar) then (not Is_dpSat_thryvar(s0)) else Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar)) end if) eq Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
	(Stat11*)ELEM ==> Stat13: Has_dpModel_thryvar(s0,dp0_thryvar(s0,pk_thryvar))
	TdavisPutnam4(Stat13*) ==> Stat14: (FORALL s, m, t | Has_dpModel_thryvar(s,m) imp Has_dpModel_thryvar(s + {c: c in t, h in c | tog(h) in c}, m + {arb({h,tog(h)}): c in t, h in (c - m) | tog(h) in (c - m)}))
--
-- we show that $s0 + {c: c in s, h in c | tog(h) in c} = s$ to be able to apply the above corollary
--
	Suppose ==> Stat15: not ({c: c in s, h in c | tog(h) in c} incin s)
		(c1)-->Stat15(Stat15*) ==> Stat16: (c1 in {c: c in s, h in c | tog(h) in c}) & (c1 notin s)
		(c2,h2)-->Stat16(Stat16*) ==> false
	Discharge ==> Stat17: AUTO
	(Stat4, Stat17*)ELEM ==> Stat18: s0 + {c: c in s, h in c | tog(h) in c} = s
	(s0,dp0_thryvar(s0,pk_thryvar),s)-->Stat14(Stat13,Stat13*) ==> Stat19: Has_dpModel_thryvar(s0 + {c: c in s, h in c | tog(h) in c}, dp0_thryvar(s0,pk_thryvar) + {arb({h,tog(h)}): c in s, h in (c - dp0_thryvar(s0,pk_thryvar)) | tog(h) in (c - dp0_thryvar(s0,pk_thryvar))})
	EQUAL(Stat4, Stat19, Stat18, Stat12, Stat3) ==> false
	Discharge ==> QED
--
ENTER_THEORY Set_theory
--
-- DISPLAY davisPutnam
--
--
-- THEORY davisPutnam(tog(x),lits,fail,sl(x))
--
--	(FORALL x | (tog(tog(x)) = x) & (tog(x) /= x))
--
--	{tog(x): x in lits} = lits
--
--	fail notin lits
--
--	(FORALL s | ((s /= 0) & (0 notin s)) imp (sl(s) in Un(s)))
--
-- ==> (clauSets_thryvar, Has_dpModel_thryvar, Is_dpSat_thryvar, dpModel_thryvar)
--
--	(FORALL s, m | Has_dpModel_thryvar(s,m) eq ({h in m | tog(h) in m} = 0) & ({c in s | (m * c) = 0} = 0))
--
--	(FORALL s | Is_dpSat_thryvar(s) eq (EXISTS m | Has_dpModel_thryvar(s,m)))
--
--	(FORALL s | clauSets_thryvar = { s incin pow(lits) | Finite(Un(s)) })
--
--	(FORALL s | dp_thryvar(s) = dp_thryvar(s))
--
--	(FORALL s | (s in clauSets_thryvar) imp (Is_dpSat_thryvar(s) eq (fail notin dp_thryvar(s))))
--
--	(FORALL s | (s in clauSets_thryvar) imp (Is_dpSat_thryvar(s) eq Has_dpModel_thryvar(s,dpModel_thryvar(s))))
--
--END davisPutnam
--
--
--
--PAUSE HERE
--
--BEGIN HERE
--
-- ************************************************************************************************
--			Section 21: Simulations and bisimulations
-- ************************************************************************************************
--
-- Basic graph-related notions:
--
Def 10044: [permutation of a finite set] Is_perm(P) := Svm(P) & Finite(P) & (range(P) = domain(P))
--
Def 10045: [simple cyclic permutation] Scycle(C) := {p incin C | (p /= 0) & Is_perm(p)} = {C}
--
Def 10046: [acyclicity property of a map] Acyclic(A) := {c incin A | Is_perm(c)} = {0}
--
Def 10047: [cycle-free path connecting two nodes, or empty path] Straight(P,X,Y) := Scycle(P + {[Y,X]}) & ([Y,X] notin P)
--
Def 10047a: [prefix of cycle-free path] prefix(Q,Z) := {w: w in Q, p incin ((Q - {w}) + {[arb(range(Q) - domain(Q)),cdr(w)]}) | Is_perm(p) & (Z in domain(p))}
--
Def 10047b: [prefixed simple path in a map] segm(N,P,S) := S + {[x,P~[x]]: i in N, x in (range(segm(i,P,S)) * domain(P))}
--
Def 10047c: [designated source in a map] start(P) := arb(domain(P) - range(P))
--
Def 10048: [restriction of a multi-valued map] on(R,N) := R * (N PROD N)
--
Def 10049: [transitive closure of a map] transCl(R) := {[x,y]: q incin R, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}
--
Def 10050: [transitive-reflexive closure of a map] trans_reflCl(R,N) := transCl(on(R,N)) + ident(N)
--
Def 10050a: [self-loops] selfLoops(R) := {p in R | p = [car(p),car(p)]}
--
-- Our first theorem shows that one of the clauses in the definition
-- of finite permutations could be weakened: namely, inclusion
-- of the domain in the range could supersede equality between
-- domain and range.
--
Theorem 901: (Svm(P) & Finite(P) & (range(P) incs domain(P))) imp Is_perm(P). Proof:
Suppose_not(p) ==> AUTO
	Use_def(Is_perm) ==> range(p) /= domain(p)
	(domain(p),range(p))-->T170(*) ==> #domain(p) incin #range(p)
	p-->T171(*) ==> #domain(p) = #range(p)
	APPLY() finite_image(e(x)->cdr(x),s0->p) ==>
		Stat1: Finite({cdr(x): x in p})
	Use_def(range)(Stat1*) ==> Finite(range(p))
(range(p),domain(p))-->T194(*) ==> false; Discharge ==> QED
--
Theorem 902: (Scycle(P) imp ((P /= 0) & Is_perm(P) & Svm(P) & Finite(P))) & (Straight(P,X,Y) imp (Svm(P) & Finite(P))). Proof:
Suppose_not(q,x0,y0) ==> AUTO
	Suppose ==> Scycle(q)
		Use_def(Scycle) ==> Stat1: q in {p incin q | (p /= 0) & Is_perm(p)}
		()-->Stat1(Stat1*) ==> (q /= 0) & Is_perm(q)
	Use_def(Is_perm) ==> false; Discharge ==> Stat2: Straight(q,x0,y0) & (not (Svm(q) & Finite(q)))
	Use_def(Straight)(Stat2*) ==> Stat3: Scycle(q + {[y0,x0]})
	Use_def(Scycle)(Stat3*) ==> Stat4: (q + {[y0,x0]}) in {p incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)}
	()-->Stat4(Stat4*) ==> Stat5: Is_perm(q + {[y0,x0]})
	Use_def(Is_perm)(Stat5*) ==> Svm(q + {[y0,x0]}) & Finite(q + {[y0,x0]})
	(q,q + {[y0,x0]})-->T53(*) ==> (not Finite(q))
(q + {[y0,x0]},q)-->T189(*) ==> false; Discharge ==> QED
--
-- Our next theorem is a special case of the one which follows it; nevertheless it is
-- included, because its proof introduces the main points of the other proof.
--
Theorem 903: (Is_perm(P) & (P /= 0)) imp (EXISTS c incin P | Scycle(c)). Proof:
Suppose_not(q) ==> AUTO
	ELEM ==> Stat1: not(EXISTS c incin q | Scycle(c))
	Use_def(Is_perm)(*) ==> Finite(q)
	APPLY(m1_thryvar:m) finite_induction(n->q,P(x)->((x /= 0) & Is_perm(x))) ==>
		Stat2: (m incin q) & ((m /= 0) & Is_perm(m)) & Stat3: (FORALL k incin m | (k /= m) imp (not((k /= 0) & Is_perm(k))))
	m-->Stat1(Stat2*) ==> Stat4: (not Scycle(m))
	Use_def(Scycle)(Stat4*) ==> {p incin m | (p /= 0) & Is_perm(p)} /= {m}
	Suppose ==> Stat5: m notin {p incin m | (p /= 0) & Is_perm(p)}
	m-->Stat5(Stat2*) ==> false; Discharge ==> Stat6: not({p incin m | (p /= 0) & Is_perm(p)} incin {m})
	k-->Stat6(Stat6*) ==> Stat7: (k in {p incin m | (p /= 0) & Is_perm(p)}) & (k /= m)
	()-->Stat7(Stat7*) ==> (k incin m) & (k /= 0) & Is_perm(k)
k-->Stat3(Stat2*) ==> false; Discharge ==> QED
--
--
--
Theorem 904: (Is_map(P) & Finite(P) & (range(P) incin domain(P)) & (P /= 0)) imp (EXISTS c incin P | Scycle(c)). Proof:
Suppose_not(q) ==> AUTO
	ELEM ==> Stat1: not(EXISTS c incin q | Scycle(c))
	APPLY(m1_thryvar:m) finite_induction(n->q,P(x)->((x /= 0) & (range(x) incin domain(x)))) ==>
		Stat2: (m incin q) & ((m /= 0) & (range(m) incin domain(m))) & Stat3: (FORALL k incin m | (k /= m) imp (not((k /= 0) & (range(k) incin domain(k)))))
	m-->Stat1(Stat2*) ==> Stat4: (not Scycle(m))
	Use_def(Scycle)(Stat4*) ==> {p incin m | (p /= 0) & Is_perm(p)} /= {m}
	Suppose ==> Stat5: m notin {p incin m | (p /= 0) & Is_perm(p)}
		m-->Stat5(Stat2,Stat2*) ==> (not Is_perm(m))
		Use_def(Is_perm)(Stat5*) ==> (not Svm(m)) or (not Finite(m)) or (range(m) /= domain(m))
		(q,m)-->T189(*) ==> Finite(m)
		(m,q)-->T52(*) ==> Stat6: Is_map(m)
		Suppose ==> (not Svm(m))
			Use_def(Svm)(Stat5*) ==> Stat7: not(FORALL x in m, y in m | (car(x) = car(y)) imp (x = y))
			(x0,y0)-->Stat7(Stat7*) ==> (x0 in m) & (y0 in m) & (car(x0) = car(y0)) & (x0 /= y0)
			Suppose ==> range(m - {x0}) nincin domain(m - {x0})
				(m - {x0},m)-->T65(Stat7*) ==> range(m) nincin domain(m - {x0})
				(m - {x0},{x0})-->T78(Stat7*) ==> Stat8: ((domain(m - {x0}) + domain({x0})) = domain((m - {x0}) + {x0})) & (((m - {x0}) + {x0}) = m)
				EQUAL(Stat8) ==> (domain(m - {x0}) + domain({x0})) = domain(m)
				(Stat2*)ELEM ==> domain({x0}) nincin domain(m - {x0})
				({y0},m - {x0})-->T65(Stat7*) ==> domain({x0}) nincin domain({y0})
				(m,x0)-->T51(Stat5*) ==> x0 = [car(x0),cdr(x0)]
				(car(x0),cdr(x0))-->T114(Stat7*) ==> domain({[car(x0),cdr(x0)]}) = {car(x0)}
				EQUAL(Stat7) ==> {car(x0)} nincin domain({y0})
				(m,y0)-->T51(Stat5*) ==> y0 = [car(y0),cdr(y0)]
				(car(y0),cdr(y0))-->T114(Stat7*) ==> domain({[car(y0),cdr(y0)]}) = {car(y0)}
				EQUAL(Stat7) ==> Stat9: {car(x0)} nincin {car(x0)}
			(Stat9*)Discharge ==> range(m - {x0}) incin domain(m - {x0})
			(m - {x0})-->Stat3(Stat7*) ==> (not Is_map(m - {x0}))
		(m - {x0},m)-->T52(Stat5*) ==> false; Discharge ==> Stat10: not(domain(m) incin range(m))
		c-->Stat10(Stat10*) ==> (c in domain(m)) & (c notin range(m))
		Use_def(domain)(Stat10*) ==> Stat11: c in {car(x): x in m}
		x1-->Stat11(Stat11*) ==> Stat12: (c = car(x1)) & (x1 in m)
		(m - {x1})-->Stat3(Stat11*) ==> (m = {x1}) or (range(m - {x1}) nincin domain(m - {x1}))
		(m,x1)-->T51(Stat12,Stat6*) ==> x1 = [car(x1),cdr(x1)]
		(car(x1),cdr(x1))-->T114(Stat12*) ==> (domain({[car(x1),cdr(x1)]}) = {car(x1)}) & (range({[car(x1),cdr(x1)]}) = {cdr(x1)})
		Suppose ==> m = {x1}
			EQUAL(Stat2) ==> Stat13: (not({car(x1)} incin {cdr(x1)})) & ({cdr(x1)} incin {car(x1)})
		(Stat13*)Discharge ==> range(m - {x1}) nincin domain(m - {x1})
		(m - {x1},m)-->T65(Stat12*) ==> range(m) nincin domain(m - {x1})
		(m - {x1},{x1})-->T78(Stat12*) ==> Stat14: ((domain(m - {x1}) + domain({x1})) = domain((m - {x1}) + {x1})) & (((m - {x1}) + {x1}) = m)
		EQUAL(Stat14) ==> (domain(m - {x1}) + domain({x1})) = domain(m)
		(Stat2*)ELEM ==> (domain({x1}) * range(m)) /= 0
		EQUAL(Stat12) ==> ({c} * range(m)) /= 0
	(Stat10*)Discharge ==> Stat15: not({p incin m | (p /= 0) & Is_perm(p)} incin {m})
	k-->Stat15(Stat15*) ==> Stat16: (k in {p incin m | (p /= 0) & Is_perm(p)}) & (k /= m)
	()-->Stat16(Stat16*) ==> Stat17: (k incin m) & (k /= 0) & Is_perm(k)
	k-->Stat3(Stat16*) ==> range(k) nincin domain(k)
Use_def(Is_perm)(Stat17*) ==> false; Discharge ==> QED
--
-- Our next theorem shows that finite permutations enjoy one-one-ness.
--
Theorem 905: Is_perm(0) & (Is_perm(P) imp one_1_map(P)). Proof:
Suppose_not(g) ==> AUTO
--
-- The first part of the statement is trivial.
--
	Suppose ==> Stat1: (not Is_perm(0))
		T59 ==> Svm(0) & (domain(0) = range(0))
		T188 ==> Finite(0)
	Use_def(Is_perm) ==> false; Discharge ==> Stat2: Is_perm(g) & (not one_1_map(g))
--
-- If a counterexample to the second part of the statement existed, then we could pick one, $g$, within which
-- we would find distinct pairs $v,w$ with the same first component.
--
	Use_def(Is_perm)(Stat2*) ==> Stat3: Svm(g) & Finite(g) & (range(g) = domain(g)) & (not one_1_map(g))
	Use_def(one_1_map)(Stat3*) ==> Stat4: not(FORALL x in g, y in g | (cdr(x) = cdr(y)) imp (x = y))
	(v,w)-->Stat4(Stat4*) ==> Stat5: (v in g) & (w in g) & (cdr(v) = cdr(w)) & (v /= w)
--
-- Consider now the mapping $g - {v}$, whose single-valuedness and finiteness
-- are obvious.
--
	(g - {v},g)-->T53(Stat3,Stat3*) ==> Stat6: Svm(g - {v})
	(g,g - {v})-->T189(Stat3,Stat3*) ==> Finite(g - {v})
--
-- It is easily seen that $g - {v}$ has the same range as $g$,
-- and that its domain and range are the same set (so that $g - {v}$
-- is a permutation too).
--
	Suppose ==> Stat7: range(g - {v}) /= range(g)
		(Stat5*)ELEM ==> Stat8: ((g - {v}) + {v}) = g
		(g - {v},{v})-->T79(Stat8*) ==> (range((g - {v}) + {v}) = (range(g - {v}) + range({v})))
		Use_def(range)(Stat9*) ==> Stat9: range({v}) = {cdr(x): x in {v}}
 		SIMPLF(Stat9) ==> range({v}) = {cdr(v)}
		Use_def(range)(Stat10*) ==> Stat10: range({w}) = {cdr(x): x in {w}}
		SIMPLF(Stat10) ==> Stat11: range({w}) = {cdr(w)}
		EQUAL(Stat5) ==> Stat12: range(g) = (range(g - {v}) + {cdr(w)})
	({w},g - {v})-->T65(Stat11,Stat12,Stat7,Stat5*) ==> false; Discharge ==> Stat13: range(g - {v}) = range(g)
	Suppose ==> Stat14: domain(g - {v}) /= range(g - {v})
		APPLY() finite_image(e(x)->cdr(x),s0->(g - {v})) ==>
			Stat15: Finite({cdr(x): x in (g - {v})})
		Use_def(range)(Stat15*) ==> Stat16: Finite(range(g - {v}))
		(g - {v},g)-->T65(Stat17*) ==> Stat17: domain(g - {v}) incin domain(g)
		(range(g - {v}))-->T195(Stat16*) ==> Stat18: (not(EXISTS f in OM | (Svm(f) & (range(f) = range(g - {v})) & (domain(f) incin range(g - {v})) & (range(g - {v}) /= domain(f)))))
	(g - {v})-->Stat18(Stat14,Stat17,Stat3,Stat13,Stat6*) ==> false; Discharge ==> Stat19: domain(g - {v}) = range(g - {v})
--
-- There is hence a pair in $g - {v}$ which shares the first component with $v$.
-- This implies that there are two pairs with the same first component in $g$,
-- which conflicts with the single-valuedness of $g$.
--
	Use_def(Svm)(Stat3,Stat3*) ==> Stat20: Is_map(g)
	Suppose ==> [car(v),(g - {v})~[car(v)]] notin (g - {v})
		Use_def(Svm)(Stat6,Stat6*) ==> Is_map(g - {v})
		(g - {v},car(v))-->T77(Stat20*) ==> Stat21: car(v) notin domain(g - {v})
		(Stat21,Stat19,Stat13,Stat3*)ELEM ==> car(v) notin domain(g)
		Use_def(domain)(Stat21*) ==> Stat22: car(v) notin {car(x): x in g}
	v-->Stat22(Stat5*) ==> false; Discharge ==> Stat23: [car(v),(g - {v})~[car(v)]] in (g - {v})
	(g,v)-->T76(Stat5,Stat20*) ==> (v = [car(v),cdr(v)]) & ([car(v),cdr(v)] in g)
	Use_def(Svm)(Stat3*) ==> Stat24: (FORALL x in g, y in g | (car(x) = car(y)) imp (x = y))
	([car(v),cdr(v)],[car(v),(g - {v})~[car(v)]])-->Stat24(Stat23*) ==> Stat25: car([car(v),cdr(v)]) /= car([car(v),(g - {v})~[car(v)]])
--
-- This contradiction leads us to the desired result.
--
(Stat25)Discharge ==> QED
--
-- The eight theorems which follow relate the notion of
-- acyclicity, just introduced, with the notions of
-- simple cycle, on the one hand, and of straigth path on
-- the other hand.
--
Theorem 906: Acyclic(A) imp (not Scycle(A)). Proof:
Suppose_not(a) ==> AUTO
--
-- For, if we assume $a$ to contradict the statement, then by
-- making setformers explicit in the definitions of $Acyclic$ and of $Scycle$,
-- and observing that one is included in the other, we get $a=0$.
--
	Use_def(Scycle(a)) ==> AUTO
	Use_def(Acyclic(a)) ==> AUTO
	Set_monot ==> ({p incin a | (p /= 0) & Is_perm(p)} incin {p incin a | Is_perm(p)})
--
-- But then, $0$ must belong to a set whose elements cannot be null:
-- a contradiction which gives is the desired result.
--
	ELEM ==> Stat1: 0 in {p incin a | (p /= 0) & Is_perm(p)}
()-->Stat1(Stat1*) ==> false; Discharge ==> QED
--
Theorem 907: ((B incs A) & Acyclic(B)) imp Acyclic(A). Proof:
Suppose_not(b,a) ==> Stat1: (b incs a) & Acyclic(b) & (not Acyclic(a))
	Use_def(Acyclic(b)) ==> AUTO
	Use_def(Acyclic(a)) ==> AUTO
	Set_monot ==> {p incin a | Is_perm(p)} incin {p incin b | Is_perm(p)}
	ELEM ==> Stat2: {p incin a | Is_perm(p)} = 0
	0-->Stat2 ==> (not Is_perm(0))
0-->T905(Stat2*) ==> false; Discharge ==> QED
--
Theorem 908: Acyclic(0) & Is_perm({[X,X]}) & Scycle({[X,X]}) & ((X /= Y) eq Acyclic({[X,Y]})). Proof:
Suppose_not(u,v) ==> AUTO
	0-->T905 ==> Stat1: Is_perm(0)
	Suppose ==> not Acyclic(0)
		Use_def(Acyclic) ==> {p incin 0 | Is_perm(p)} /= {0}
		Suppose ==> Stat2: 0 notin {p incin 0 | Is_perm(p)}
		0-->Stat2(Stat1*) ==> false; Discharge ==> Stat3: not({p incin 0 | Is_perm(p)} incin {0})
		c-->Stat3 ==> Stat4: (c in {p incin 0 | Is_perm(p)}) & (c /= 0)
	()-->Stat4(Stat4*) ==> false; Discharge ==> Acyclic(0)
	Suppose ==> Stat5: (not Is_perm({[u,u]}))
		(u,u)-->T91(Stat5*) ==> Svm({[u,u]})
		(Stat6*)ELEM ==> Stat6: domain({[u,u]}) = range({[u,u]})
		([u,u])-->T201(Stat6*)==> Finite({[u,u]})
	Use_def(Is_perm)(Stat5*) ==> false; Discharge ==> Stat7: Is_perm({[u,u]})
	Suppose ==> (not Scycle({[u,u]}))
		Use_def(Scycle) ==> {p incin {[u,u]} | (p /= 0) & Is_perm(p)} /= {{[u,u]}}
		Suppose ==> Stat8: {[u,u]} notin {p incin {[u,u]} | (p /= 0) & Is_perm(p)}
		({[u,u]})-->Stat8(Stat7*) ==> false; Discharge ==> Stat9: not({p incin {[u,u]} | (p /= 0) & Is_perm(p)} incin {{[u,u]}})
		p0-->Stat9(Stat9*) ==> Stat10: (p0 in {p incin {[u,u]} | (p /= 0) & Is_perm(p)}) & (p0 /= {[u,u]})
	()-->Stat10(Stat10*) ==> false; Discharge ==> (u /= v) neq Acyclic({[u,v]})
	Suppose ==> Stat11: (u /= v) & (not Acyclic({[u,v]}))
		Use_def(Acyclic)(Stat11*) ==> Stat12: {p incin {[u,v]} | Is_perm(p)} /= {0}
		Suppose ==> Stat13: 0 notin {p incin {[u,v]} | Is_perm(p)}
			0-->Stat13(Stat13*) ==> (not Is_perm(0))
		0-->T905(Stat13*) ==> false; Discharge ==> Stat14: not({p incin {[u,v]} | Is_perm(p)} incin {0})
		p-->Stat14(Stat14*) ==> Stat15: (p in {p incin {[u,v]} | Is_perm(p)}) & (p /= 0)
		()-->Stat15(Stat15*) ==> (p = {[u,v]}) & Is_perm(p)
		EQUAL(Stat14) ==> Is_perm({[u,v]})
		Use_def(Is_perm)(Stat14*) ==> Stat16: range({[u,v]}) = domain({[u,v]})
	(u,v,u,v)-->T114(Stat16,Stat11*) ==> false; Discharge ==> Stat17: (u = v) & Acyclic({[u,v]})
	Use_def(Acyclic)(Stat17*) ==> {p incin {[u,v]} | Is_perm(p)} = {0}
	EQUAL(Stat17) ==> Stat18: {p incin {[u,u]} | Is_perm(p)} = {0}
	(Stat18*)ELEM ==> Stat19: {[u,u]} notin {p incin {[u,u]} | Is_perm(p)}
({[u,u]})-->Stat19(Stat7*) ==> false; Discharge ==> QED
--
--
--
Theorem 909: Is_perm({[X,Y],[Y,X]}) & Scycle({[X,Y],[Y,X]}) & ((X /= Y) imp Straight({[X,Y]},X,Y)). Proof:
Suppose_not(u,v) ==> AUTO
	Suppose ==> u = v
		EQUAL ==> Stat1: ([u,v] = [u,u]) & ([v,u] = [u,u])
		(Stat1*)ELEM ==> {[u,v],[v,u]} = {[u,u]}
		EQUAL ==> Stat2: not(Is_perm({[u,u]}) & Scycle({[u,u]}))
	(u,u)-->T908(Stat2*) ==> false; Discharge ==> Stat3: u /= v
	Suppose ==> (not Is_perm({[u,v],[v,u]}))
		Use_def(Is_perm)(Stat3*) ==> not(Svm({[u,v],[v,u]}) & Finite({[u,v],[v,u]}) & (range({[u,v],[v,u]}) = domain({[u,v],[v,u]})))
		([u,v],[v,u])-->T202(Stat3*) ==> Finite({[u,v],[v,u]})
		TELEM ==> (domain({[u,v],[v,u]}) = {u,v}) & (range({[u,v],[v,u]}) = {v,u})
		(Stat3*)ELEM ==> Stat4: (not Svm({[u,v],[v,u]}))
		(u,v,v,u)-->T92(Stat3,Stat4*) ==> false
	Discharge ==> Stat5: Is_perm({[u,v],[v,u]})
	Suppose ==> (not Scycle({[u,v],[v,u]}))
		Use_def(Scycle) ==> Stat6: {p incin {[u,v],[v,u]} | (p /= 0) & Is_perm(p)} /= {{[u,v],[v,u]}}
		pp-->Stat6(Stat6*) ==> Stat7: (pp in {p incin {[u,v],[v,u]} | (p /= 0) & Is_perm(p)}) neq (pp in {{[u,v],[v,u]}})
		Suppose ==> Stat8: pp = {[u,v],[v,u]}
			EQUAL(Stat5) ==> Is_perm(pp)
			(Stat7*)ELEM ==> Stat9: (pp notin {p incin {[u,v],[v,u]} | (p /= 0) & Is_perm(p)})
		pp-->Stat9(Stat8*) ==> false; Discharge ==> Stat10: (pp in {p incin {[u,v],[v,u]} | (p /= 0) & Is_perm(p)}) & (pp /= {[u,v],[v,u]})
		()-->Stat10(Stat10*) ==> Stat11: ((pp = {[u,v]}) or (pp = {[v,u]})) & Is_perm(pp)
		Use_def(Is_perm)(Stat11*) ==> Stat12: domain(pp) = range(pp)
		Suppose ==> pp = {[u,v]}
			TELEM ==> (domain({[u,v]}) = {u}) & (range({[u,v]}) = {v})
			EQUAL(Stat12) ==> Stat13: (domain(pp) = {u}) & (range(pp) = {v})
		(Stat13,Stat12,Stat3*)Discharge ==> Stat14: pp = {[v,u]}
		TELEM ==> (domain({[v,u]}) = {v}) & (range({[v,u]}) = {u})
		EQUAL(Stat14) ==> Stat15: (domain(pp) = {v}) & (range(pp) = {u})
	(Stat15,Stat12,Stat3*)Discharge ==> Stat16: Scycle({[u,v],[v,u]}) & (u /= v) & (not Straight({[u,v]},u,v))
	Use_def(Straight)(Stat16*) ==> (not Scycle({[u,v]} + {[v,u]}))
	TELEM ==> ({[u,v]} + {[v,u]}) = {[u,v],[v,u]}
EQUAL(Stat16) ==> false; Discharge ==> QED
--
-- It is generally agreed that the empty path connects
-- any vertex with itself in any graph.
-- We show that this convention is captured by our
-- definition of the $Straight$ predicate.
--
Theorem 910: Straight(0,X,Y) eq (Y = X). Proof:
Suppose_not(u,v) ==> AUTO
	Use_def(Straight) ==> Stat1: Scycle(0 + {[v,u]}) eq (v /= u)
	TELEM ==> 0 + {[v,u]} = {[v,u]}
	EQUAL(Stat1) ==> Scycle({[v,u]}) eq (v /= u)
	({[v,u]})-->T906 ==> AUTO
	(v,u)-->T908(Stat1*) ==> Stat2: (not Scycle({[v,u]})) & (v = u)
	EQUAL(Stat2) ==> (not Scycle({[u,u]}))
(u,u)-->T908(Stat2*) ==> false; Discharge ==> QED
--
Theorem 911: ((X /= Y) & (Y /= Z)) imp ((X /= Z) eq Acyclic({[X,Y],[Y,Z]})). Proof:
Suppose_not(x,y,z) ==> AUTO
	Suppose ==> Stat1: x = z
		(x,y)-->T909(Stat1*) ==> Scycle({[x,y],[y,x]})
		EQUAL(Stat1) ==> Scycle({[x,y],[y,z]})
	({[x,y],[y,z]})-->T906(*) ==> false; Discharge ==> Stat2: (x /= y) & (y /= z) & (x /= z) & (not Acyclic({[x,y],[y,z]}))
	Use_def(Acyclic) ==> {p incin {[x,y],[y,z]} | Is_perm(p)} /= {0}
	0-->T905 ==> Stat3: Is_perm(0)
	Suppose ==> Stat4: 0 notin {p incin {[x,y],[y,z]} | Is_perm(p)}
	0-->Stat4(Stat3*) ==> false; Discharge ==> Stat5: not({p incin {[x,y],[y,z]} | Is_perm(p)} incin {0})
	q-->Stat5(Stat5*) ==> Stat6: (q in {p incin {[x,y],[y,z]} | Is_perm(p)}) & (q /= 0)
	()-->Stat6(Stat6*) ==> Stat7: ((q = {[x,y]}) or (q = {[y,z]}) or (q = {[x,y],[y,z]})) & Is_perm(q)
	Suppose ==> q = {[x,y]}
		(x,y)-->T908(Stat2,Stat2*) ==> Acyclic({[x,y]})
		Use_def(Acyclic) ==> Stat8: {[x,y]} notin {p incin {[x,y]} | Is_perm(p)}
		EQUAL(Stat7) ==> Is_perm({[x,y]})
	({[x,y]})-->Stat8(Stat8*) ==> false; Discharge ==> q /= {[x,y]}
	Suppose ==> q = {[y,z]}
		(y,z)-->T908(Stat2,Stat2*) ==> Acyclic({[y,z]})
		Use_def(Acyclic) ==> Stat9: {[y,z]} notin {p incin {[y,z]} | Is_perm(p)}
		EQUAL(Stat7) ==> Is_perm({[y,z]})
	({[y,z]})-->Stat9(Stat9*) ==> false; Discharge ==> q = {[x,y],[y,z]}
	EQUAL(Stat7) ==> Stat10: Is_perm({[x,y],[y,z]})
	Use_def(Is_perm)(Stat10*) ==> Stat11: domain({[x,y],[y,z]}) = range({[x,y],[y,z]})
	TELEM ==> Stat12: (domain({[x,y],[y,z]}) = {x,y}) & (range({[x,y],[y,z]}) = {y,z})
(Stat2,Stat11,Stat12*)Discharge ==> QED
--
-- It readily follows from the definitions of the 'Straight' and 'Scycle' predicates
-- that an acyclic path cannot include a non-void permutation.
--
Theorem 912: (Straight(Q,X,Y) & Is_perm(P) & (P /= 0)) imp (P nincin Q). Proof:
Suppose_not(q,x0,y0,p) ==> AUTO
	Use_def(Straight(q,x0,y0)) ==> AUTO
	Use_def(Scycle(q + {[y0,x0]})) ==> AUTO
	Suppose ==> Stat1: p notin {p incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)}
	p-->Stat1(*) ==> false; Discharge ==> false
Discharge ==> QED
--
--
--
Theorem 913: Acyclic({[X,Y],[Y,Z]}) imp Straight({[X,Y],[Y,Z]},X,Z). Proof:
Suppose_not(u,v,z) ==> AUTO
	Use_def(Straight) ==> Stat1: not(Scycle({[u,v],[v,z]} + {[z,u]}) & ([z,u] notin {[u,v],[v,z]}))
	Suppose ==> Stat2: [z,u] = [u,v]
		(Stat2)ELEM ==> u = v
		EQUAL ==> Stat3: Acyclic({[z,u],[u,z]})
		(z,u)-->T909(Stat3*) ==> Scycle({[z,u],[u,z]})
	({[z,u],[u,z]})-->T906(Stat3*) ==> false; Discharge ==> [z,u] /= [u,v]
	Suppose ==> Stat4: [z,u] = [v,z]
		(Stat4)ELEM ==> u = z
		EQUAL ==> Stat5: Acyclic({[z,v],[v,z]})
		(z,v)-->T909(Stat5*) ==> Scycle({[z,v],[v,z]})
	({[z,v],[v,z]})-->T906(Stat5*) ==> false; Discharge ==> [z,u] /= [v,z]
	(Stat1*)ELEM ==> Stat6: (not Scycle({[u,v],[v,z]} + {[z,u]})) & (({[u,v],[v,z]} + {[z,u]}) = {[u,v],[v,z],[z,u]})
	EQUAL(Stat6) ==> Stat7: (not Scycle({[u,v],[v,z],[z,u]}))
	Use_def(Scycle)(Stat7*) ==> Stat8: {p incin {[u,v],[v,z],[z,u]} | (p /= 0) & Is_perm(p)} /= {{[u,v],[v,z],[z,u]}}
	p-->Stat8(Stat8*) ==> (p in {p incin {[u,v],[v,z],[z,u]} | (p /= 0) & Is_perm(p)}) neq (p = {[u,v],[v,z],[z,u]})
--
-- Let us observe that $u /= z$, $v /= z$, and $u /= v$.
--
	Suppose ==> Stat9: u = z
		EQUAL ==> Acyclic({[u,v],[v,u]})
		(u,v)-->T909(Stat9*) ==> Scycle({[u,v],[v,u]})
	({[u,v],[v,u]})-->T906(Stat9*) ==> false; Discharge ==> Stat10: u /= z
	Suppose ==> Stat11: v = z
		EQUAL ==> Acyclic({[u,v],[z,z]})
		Use_def(Acyclic)(Stat11*) ==> Stat12: {[z,z]} notin {c incin {[u,v],[z,z]} | Is_perm(c)}
		(z,z)-->T908(Stat11*) ==> Is_perm({[z,z]})
	({[z,z]})-->Stat12(Stat12*) ==> false; Discharge ==> Stat13: v /= z
	Suppose ==> Stat14: u = v
		EQUAL ==> Acyclic({[u,u],[v,z]})
		Use_def(Acyclic)(Stat14*) ==> Stat15: {[u,u]} notin {c incin {[u,u],[v,z]} | Is_perm(c)}
		(u,u)-->T908(Stat14*) ==> Is_perm({[u,u]})
	({[u,u]})-->Stat15(Stat15*) ==> false; Discharge ==> Stat16: u /= v
--
--
--
	Suppose ==> Stat17: {[u,v],[v,z],[z,u]} notin {p incin {[u,v],[v,z],[z,u]} | (p /= 0) & Is_perm(p)}
		({[u,v],[v,z],[z,u]})-->Stat17(Stat17*) ==> (not Is_perm({[u,v],[v,z],[z,u]}))
		Use_def(Is_perm)(Stat17*) ==> not(Svm({[u,v],[v,z],[z,u]}) & Finite({[u,v],[v,z],[z,u]}) & (range({[u,v],[v,z],[z,u]}) = domain({[u,v],[v,z],[z,u]})))
		Suppose ==> Stat18: (not Finite({[u,v],[v,z],[z,u]}))
			EQUAL(Stat6) ==> (not Finite({[u,v],[v,z]} + {[z,u]}))
			({[u,v],[v,z]},[z,u])-->T199(Stat18*) ==> (not Finite({[u,v],[v,z]}))
		([u,v],[v,z])-->T202(Stat18*) ==> false; Discharge ==> Finite({[u,v],[v,z],[z,u]})
		Suppose ==> Stat19: range({[u,v],[v,z],[z,u]}) /= domain({[u,v],[v,z],[z,u]})
			TELEM ==> range({[u,v],[v,z],[z,u]}) = {u,v,z}
			TELEM ==> domain({[u,v],[v,z],[z,u]}) = {v,z,u}
		(Stat19*)Discharge ==> Stat20: (not Svm({[u,v],[v,z],[z,u]}))
		TELEM ==> Is_map({[u,v],[v,z],[z,u]})
		Use_def(Svm)(Stat20*) ==> Stat21: not(FORALL x in {[u,v],[v,z],[z,u]}, y in {[u,v],[v,z],[z,u]} | (car(x) = car(y)) imp (x = y))
		(q,r)-->Stat21(Stat21*) ==> Stat22: (q in {[u,v],[v,z],[z,u]}) & (r in {[u,v],[v,z],[z,u]}) & (q /= r) & (car(q) = car(r))
		(Stat22,Stat22*)ELEM ==> Stat23: car(q) = car(r)
		(Stat22,Stat22*)ELEM ==> Stat24: (((q = [u,v]) & (r = [v,z])) or ((q = [u,v]) & (r = [z,u])) or ((q = [v,z]) & (r = [z,u])) or ((r = [u,v]) & (q = [v,z])) or ((r = [u,v]) & (q = [z,u])) or ((r = [v,z]) & (q = [z,u])))
		Suppose ==> Stat25: (q = [u,v]) & (r = [v,z])
			(Stat23,Stat25)ELEM ==> Stat26: u = v
		(Stat26,Stat16*)Discharge ==> not((q = [u,v]) & (r = [v,z]))
		Suppose ==> Stat27: (q = [u,v]) & (r = [z,u])
			(Stat23,Stat27,Stat10)ELEM ==> Stat28: u = z
		(Stat28,Stat10*)Discharge ==> not((q = [u,v]) & (r = [z,u]))
		Suppose ==> Stat29: (q = [v,z]) & (r = [z,u])
			(Stat23,Stat29)ELEM ==> Stat30: v = z
		(Stat30,Stat13*)Discharge ==> not((q = [v,z]) & (r = [z,u]))
		Suppose ==> Stat31: (r = [u,v]) & (q = [v,z])
			(Stat23,Stat31)ELEM ==> Stat32: u = v
		(Stat32,Stat16*)Discharge ==> not((r = [u,v]) & (q = [v,z]))
		Suppose ==> Stat33: (r = [u,v]) & (q = [z,u])
			(Stat23,Stat33)ELEM ==> Stat34: u = z
		(Stat34,Stat10*)Discharge ==> Stat35: (r = [v,z]) & (q = [z,u])
		(Stat23,Stat35)ELEM ==> Stat36: v = z
	(Stat36,Stat13*)Discharge ==> Stat37: (p in {p incin {[u,v],[v,z],[z,u]} | (p /= 0) & Is_perm(p)}) & (p /= {[u,v],[v,z],[z,u]})
	()-->Stat37(Stat37*) ==> Stat38: (p incin {[u,v],[v,z],[z,u]}) & (p /= 0) & Is_perm(p)
	Suppose ==> p incin {[u,v],[v,z]}
		Use_def(Acyclic)(Stat38*) ==> Stat39: p notin {c incin {[u,v],[v,z]} | Is_perm(c) }
	p-->Stat39(Stat38*) ==> false; Discharge ==> p nincin {[u,v],[v,z]}
	(Stat37*)ELEM ==> (p = {[z,u]}) or (p = {[u,v],[z,u]}) or (p = {[v,z],[z,u]})
	Use_def(Is_perm)(Stat38,Stat38*) ==> Stat40: range(p) = domain(p)
	Suppose ==> p = {[z,u]}
		TELEM ==> (range({[z,u]}) = {u}) & (domain({[z,u]}) = {z})
		EQUAL(Stat40) ==> Stat41: {u} = {z}
		(Stat41*)ELEM ==> Stat42: u = z
	(Stat42,Stat10*)Discharge ==> p /= {[z,u]}
	Suppose ==> p = {[u,v],[z,u]}
		TELEM ==> (range({[u,v],[z,u]}) = {v,u}) & (domain({[u,v],[z,u]}) = {u,z})
		EQUAL(Stat40) ==> Stat43: {v,u} = {u,z}
		(Stat43*)ELEM ==> Stat44: v = z
	(Stat44,Stat13*)Discharge ==> p = {[v,z],[z,u]}
	TELEM ==> (range({[v,z],[z,u]}) = {z,u}) & (domain({[v,z],[z,u]}) = {v,z})
	EQUAL(Stat40) ==> Stat45: {z,u} = {v,z}
	(Stat45*)ELEM ==> Stat46: u = v
(Stat46,Stat16*)Discharge ==> QED
--
-- The following proof states that removal of an arc from a simple cycle yields
-- a straight path of known endpoints.
--
Theorem 914: (Scycle(C) & (X in domain(C))) imp Straight(C - {[X,C~[X]]}, C~[X], X). Proof:
Suppose_not(k,x0) ==> AUTO
--
-- Reasoning by contradiction, suppose that $k$ is a simple cycle passing
-- through $x0$, namely a minimal permutation with $x0$ in its domain, and assume
-- that $k - {[x0,k~[x0]]}$ is not a simple path connecting $k~[x0]$ to $x0$.
--
	Use_def(Scycle) ==> Stat1: k in {p incin k | (p /= 0) & Is_perm(p)}
	()-->Stat1(Stat1*) ==> Is_perm(k)
	Use_def(Is_perm) ==> Svm(k)
	Use_def(Svm) ==> Is_map(k)
	(k,x0)-->T77 ==> ((k - {[x0,k~[x0]]}) + {[x0,k~[x0]]}) = k
	Use_def(Straight) ==> not(Scycle((k - {[x0,k~[x0]]}) + {[x0,k~[x0]]}))
EQUAL ==> false; Discharge ==> QED
--
--
--
Theorem 915: (Straight(P,X,Y) & (P /= 0)) imp ((X in (domain(P) - range(P))) & (Y in (range(P) - domain(P)))). Proof:
Suppose_not(q,x0,y0) ==> AUTO
--
-- Assuming that $q,x0,y0$ are a counterexample, we are led to a
-- contradiction arguing as follows. From the definitions
-- of the predicates $Straight$ and $Scycle$, it follows that
-- $q + {[y0,x0]}$ is a permutation, and hence has domain coinciding
-- with its range, whereas ${[y0,x0]}$ fails to be a permutation,
-- so that $x0$ and $y0$ must differ.
--
	Use_def(Straight) ==> Stat1: Scycle(q + {[y0,x0]}) & ([y0,x0] notin q)
	Use_def(Scycle)(Stat1*) ==> Stat2: ((q + {[y0,x0]}) in {p incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)}) & Stat3: ({[y0,x0]} notin {p incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)})
	()-->Stat2(Stat2*) ==> Stat4: Is_perm(q + {[y0,x0]})
	Use_def(Is_perm)(Stat4*) ==> Stat5: domain(q + {[y0,x0]}) = range(q + {[y0,x0]})
	TELEM ==> Stat6: (range({[y0,x0]}) = {x0}) & (domain({[y0,x0]}) = {y0})
	({[y0,x0]})-->Stat3(Stat2,Stat2*) ==> Stat7: (not Is_perm({[y0,x0]}))
	Suppose ==> x0 = y0
		(y0,x0)-->T91(Stat7*) ==> Svm({[y0,x0]})
		([y0,x0])-->T201(Stat7*) ==> Finite({[y0,x0]})
	Use_def(Is_perm)(Stat6*) ==> false; Discharge ==> Stat8: x0 /= y0
--
-- Since the $domain$ and $range$ operators are additive, we can decompose
-- $domain(q + {[y0,x0]})$ in the manner shown below:
--
	(q,{[y0,x0]})-->T78(Stat6,Stat6*) ==> Stat9: domain(q + {[y0,x0]}) = (domain(q) + {y0})
	(q,{[y0,x0]})-->T79(Stat6,Stat6*) ==> Stat10: range(q + {[y0,x0]}) = (range(q) + {x0})
--
-- It follows, if we assume that $x0 notin (domain(q) - range(q))$, that
-- $x0$ belongs to $range(q)$,...
--
	Suppose ==> Stat11: x0 notin (domain(q) - range(q))
		(Stat11,Stat5,Stat8,Stat9,Stat10*)ELEM ==> Stat12: x0 in range(q)
		Use_def(range)(Stat12,Stat12*) ==> Stat13: x0 in {cdr(x): x in q}
--
-- a fact which would conflict with the one-one-ness of $q + {[y0,x0]}$
-- (which, recall, is a permutation).
--
		(q + {[y0,x0]})-->T905(Stat4,Stat4*) ==> Stat14: one_1_map(q + {[y0,x0]})
		Use_def(one_1_map)(Stat14*) ==> Stat15: (FORALL x in (q + {[y0,x0]}), y in (q + {[y0,x0]}) | (cdr(x) = cdr(y)) imp (x = y)) & (x0 = cdr([y0,x0]))
		w-->Stat13(Stat1,Stat1*) ==> (x0 = cdr(w)) & (w in q) & ([y0,x0] notin q)
	(w,[y0,x0])-->Stat15(Stat15*) ==> false; Discharge ==> Stat16: y0 notin (range(q) - domain(q))
--
-- Likewise, if we assume that $y0 notin (range(q) - domain(q))$, then
-- $y0$ must belong to $domain(q)$,...
--
	(Stat16,Stat5,Stat8,Stat9,Stat10*)ELEM ==> Stat17: y0 in domain(q)
	Use_def(domain)(Stat12,Stat12*) ==> Stat18: y0 in {car(x): x in q}
--
-- a fact which conflicting with the one-one-ness of $q + {[y0,x0]}$
-- (which, recall, is a permutation). Having reached
-- a contradiction in either case, we get the desired conclusion.
--
	Use_def(Is_perm)(Stat4,Stat4*) ==> Stat19: Svm(q + {[y0,x0]})
	Use_def(Svm)(Stat19*) ==> Stat20: (FORALL x in (q + {[y0,x0]}), y in (q + {[y0,x0]}) | (car(x) = car(y)) imp (x = y)) & (y0 = car([y0,x0]))
	u-->Stat18(Stat1,Stat1*) ==> (y0 = car(u)) & (u in q) & ([y0,x0] notin q)
(u,[y0,x0])-->Stat20(Stat20*) ==> false; Discharge ==> QED
--
-- The following corollary of Theorem 915 sharpens it considerably.
--
Theorem 916: (Straight(P,X,Y) & (P /= 0)) imp (({Y} = (range(P) - domain(P))) & ({X} = (domain(P) - range(P)))). Proof:
Suppose_not(q,x0,y0) ==> AUTO
	(q,x0,y0)-->T915 ==> Stat1: (y0 in (range(q) - domain(q))) & (x0 in (domain(q) - range(q)))
	Use_def(Straight) ==> Stat2: Scycle(q + {[y0,x0]}) & ([y0,x0] notin q)
	Use_def(Scycle) ==> Stat3: (q + {[y0,x0]}) in {p incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)}
	()-->Stat3(Stat3*) ==> Stat4: Is_perm(q + {[y0,x0]})
	Use_def(Is_perm)(Stat3*) ==> Stat5: (range(q + {[y0,x0]}) = domain(q + {[y0,x0]}))
	(q + {[y0,x0]})-->T905(Stat4*) ==> Stat6: one_1_map(q + {[y0,x0]}) & (({[y0,x0]} + q) = (q + {[y0,x0]}))
	EQUAL(Stat6) ==> Stat7: one_1_map({[y0,x0]} + q)
	({[y0,x0]},q)-->T89(Stat7,Stat2*) ==> Stat8: (domain(q) = (domain({[y0,x0]} + q) - domain({[y0,x0]}))) & (range(q) = (range({[y0,x0]} + q) - range({[y0,x0]})))
	(y0,x0,y0,x0)-->T114(Stat9*) ==> Stat9: (domain({[y0,x0]}) = {y0}) & (range({[y0,x0]}) = {x0})
	EQUAL(Stat8,Stat9,Stat6) ==> Stat10: (domain(q) = (domain(q + {[y0,x0]}) - {y0})) & (range(q) = (range(q + {[y0,x0]}) - {x0}))
Discharge ==> QED
--
Theorem 917: Ord(N) imp (segm(N,P,S) incin segm(next(N),P,S)). Proof:
Suppose_not(n,p,s) ==> AUTO
	Use_def(segm(n,p,s)) ==> AUTO
	Use_def(segm(next(n),p,s)) ==> AUTO
	Use_def(next(n)) ==> AUTO
	EQUAL ==> segm(next(n),p,s) = (s + {[x,p~[x]]: i in (n + {n}), x in (range(segm(i,p,s)) * domain(p))})
	Set_monot ==> {[x,p~[x]]: i in n, x in (range(segm(i,p,s)) * domain(p))} incin {[x,p~[x]]: i in (n + {n}), x in (range(segm(i,p,s)) * domain(p))}
Discharge ==> QED
--
Theorem 918: (Is_perm(C) & (S incin C) & Ord(Y)) imp (segm(Y,C,S) incin C). Proof:
Suppose_not(c,s,y0) ==> AUTO
--
-- Assuming that $c,s,y0$ is a counterexample, we reach a
-- contradiction arguing as follows. We consider the first
-- ordinal $y1$, less than or equal to $y0$ which, like $y0$,
-- forms a  counterexample $c,s,y1$.
--
	ELEM ==> Stat1: s incin c
	Suppose ==> Stat2: {y in next(y0) | not(segm(y,c,s) incin c)} = 0
		Use_def(next) ==> y0 in next(y0)
	y0-->Stat2 ==> false; Discharge ==> Stat3: {y in next(y0) | not(segm(y,c,s) incin c)} /= 0
	Loc_def ==> y1 = arb({y in next(y0) | not(segm(y,c,s) incin c)})
	({y in next(y0) | not(segm(y,c,s) incin c)})-->T0(Stat3*) ==> Stat4: (y1 in {y in next(y0) | not(segm(y,c,s) incin c)}) & ((y1 * {y in next(y0) | not(segm(y,c,s) incin c)}) = 0)
 	()-->Stat4(Stat4*) ==> (y1 in next(y0)) & Stat5: (not(segm(y1,c,s) incin c))
--
-- It is plain that $segm(i,c,s) incin c$ holds for all elements $i$ of $y1$.
-- Consequently $range(segm(i,c,s)) incin range(c)$, for all $i in y1$,
-- where $range(c) = domain(c)$ holds by hypothesis.
--
	Suppose ==> Stat6: not(FORALL i in y1 | segm(i,c,s) incin c)
		i0-->Stat6(Stat6*) ==> (i0 in y1) & (not(segm(i0,c,s) incin c))
		y0-->T32(*) ==> Ord(next(y0))
		(next(y0),y1)-->T13(Stat4*) ==> i0 in next(y0)
		(Stat4*)ELEM ==> Stat7: i0 notin {y in next(y0) | not(segm(y,c,s) incin c)}
	i0-->Stat7(Stat6*) ==> false; Discharge ==> Stat8: (FORALL i in y1 | segm(i,c,s) incin c)
--
-- But then, if we designate by $a$ an element of $y1$ which does not belong to $c$,
-- such an $a$ should be of the form $[x1,c~[x1]]$ for some
-- $x1 in range(segm(i1,c,s))$, with $i1 in y1$. It follows from the above remarks
-- that $x1 in domain(c)$.

	a-->Stat5(Stat4,Stat4*) ==> Stat9: (a in segm(y1,c,s)) & (a notin c)
	Use_def(segm)(Stat10*) ==> Stat10: segm(y1,c,s) = (s + {[x,c~[x]]: i in y1, x in (range(segm(i,c,s)) * domain(c))})
	(Stat1,Stat9,Stat10*)ELEM ==> Stat11: a in {[x,c~[x]]: i in y1, x in (range(segm(i,c,s)) * domain(c))}
	(i1,x1)-->Stat11(Stat11*) ==> Stat12: (a = [x1,c~[x1]]) & (i1 in y1) & (x1 in range(segm(i1,c,s)))
	i1-->Stat8(Stat12*) ==> segm(i1,c,s) incin c
	Use_def(Is_perm)(*) ==> Stat13: Svm(c) & (range(c) = domain(c))
	(segm(i1,c,s),c)-->T65(Stat12*) ==> x1 in domain(c)
--
-- This leads to the conclusion that $[x1,c~[x1]]$ belongs to $c$,
-- from which the desired contradiction follows immediately.
--
	Use_def(Svm)(Stat13*) ==> Is_map(c)
(c,x1)-->T77(Stat9*) ==> false; Discharge ==> QED
--
--Theorem OM: (Scycle(C) & (E in C)) imp (EXISTS m in Za | Scycle(segm(m,C,{E})))
--Suppose_not(q,e) ==> AUTO
-- --
-- -- Reasoning by contradiction, suppose that $q,e$ is a counterexample.
-- --
--	ELEM ==> Stat1: not(EXISTS m in Za | Scycle(segm(m,q,{e})))
--	q-->T902(*) ==> Is_perm(q)
-- --
-- -- Now consider $segm(N,q,{e})$ with increasing integer values of $N$.
-- -- Since $c$ is a permutation, and hence a map, all of these segments
-- -- are included in $c$, as readily yielded by Theorem T10072.
-- -- Their size cannot increase forever, because they are confined in $q$,
-- -- which is finite. We can hence pick the first value $m$
-- -- for which $segm(next(m),q,{e}) = segm(m,q,{e})$.
-- --
--	Suppose ==> Stat2: not(FORALL i in Za | segm(i,q,{e}) incin (segm(next(i),q,{e}) * q))
--		n0-->Stat2(Stat2*) ==> (n0 in Za) & (not segm(n0,q,{e}) incin (segm(next(n0),q,{e}) * q))
--		n0-->T207(Stat2*) ==> Ord(n0)
--		(n0,q,{e})-->T917(Stat2*) ==> segm(n0,q,{e}) incin segm(next(n0),q,{e})
--	(q,{e},n0)-->T918(*) ==> false; Discharge ==> Stat3: (FORALL i in Za | segm(i,q,{e}) incin (segm(next(i),q,{e}) * q))
-- 	Use_def(Is_perm)(*) ==> Finite(q) & Svm(q)
--	APPLY(m5_thryvar:m) confinedIncrSeq(e(x)->segm(x,q,{e}),s0->q) ==>
--		Stat4: (FORALL i, j | ((i in j) & (j in Za)) imp (segm(i,q,{e}) incin segm(j,q,{e}))) &
--		(m in Za) & (segm(next(m),q,{e}) = segm(m,q,{e})) & ((m * {i in Za | segm(next(i),q,{e}) incin segm(i,q,{e})}) = 0)
-- --
-- -- Since $segm(m,q,{e})$ is included in $q$, which is a finite map,
-- -- this segment is a finite map in its turn.
-- --
--	m-->T207(Stat4*) ==> Ord(m)
--	(q,{e},m)-->T918(*) ==> segm(m,q,{e}) incin q
--	(segm(m,q,{e}),q)-->T53(Stat3*) ==> Svm(segm(m,q,{e}))
--	(q,segm(m,q,{e}))-->T189(Stat3*) ==> Finite(segm(m,q,{e}))
-- --
-- -- Moreover, $domain(segm(m,q,{e}))$ and $range(segm(m,q,{e}))$ cannot differ.
-- -- Therefore, $segm(m,q,{e})$ is a permutation.
-- --
--	Suppose ==> Stat5: (not Is_perm(segm(m,q,{e})))
--		(segm(m,q,{e}))-->T901(Stat4*) ==> Stat6: not(range(segm(m,q,{e})) incs domain(segm(m,q,{e})))
--		a-->Stat6(Stat6*) ==> (a in domain(segm(m,q,{e}))) & (a notin range(segm(m,q,{e})))
--		Use_def(segm(next(m),q,{e})) ==> AUTO
--	Tsomehow ==> false; Discharge ==> Is_perm(segm(m,q,{e}))
-- --
-- -- By applying the initial hypothesis, we hence get that $domain(segm(m,q,{e}))$
-- -- and $range(segm(m,q,{e}))$ must differ.
-- --
--	m-->Stat1(Stat4,Stat4*) ==> Stat7: (not Scycle(segm(m,q,{e})))
--	Use_def(segm(m,q,{e})) ==> AUTO
--	(Stat7*)ELEM ==> segm(m,q,{e}) /= 0
--	Use_def(Scycle)(Stat7*) ==> {p incin segm(m,q,{e}) | (p /= 0) & Is_perm(p)} /= {segm(m,q,{e})}
-- --
--Tsomehow ==> false; Discharge ==>
--
--
--
Theorem 919: (Straight(Q,X,Y) & (Q /= 0)) imp ([X,Q~[X]] in prefix(Q,Q~[X])). Proof:
Suppose_not(q,x0,y0) ==> AUTO
--
-- Assuming that $q,x0,y0$ are a counterexample to the statement
-- of this theorem, we easily get to the conclusion that either
-- $(q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})$
-- or $(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}$ fails to be a permutation.
--
	(q,x0,y0)-->T916(*) ==> Stat1: ({y0} = (range(q) - domain(q))) & (x0 in domain(q)) & (x0 notin range(q))
	(range(q) - domain(q))-->T0(Stat1*) ==> Stat2: arb(range(q) - domain(q)) = y0
	Use_def(prefix)(*) ==> ([x0,q~[x0]] notin {w: w in q, p incin ((q - {w}) + {[arb(range(q) - domain(q)),cdr(w)]}) | Is_perm(p) & ((q~[x0]) in domain(p))}) & Straight(q,x0,y0) & (q /= 0)
	EQUAL(Stat2) ==> Stat3: ([x0,q~[x0]] notin {w: w in q, p incin ((q - {w}) + {[y0,cdr(w)]}) | Is_perm(p) & ((q~[x0]) in domain(p))}) & Straight(q,x0,y0) & (q /= 0)
	([x0,q~[x0]],(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})-->Stat3(Stat3*) ==> Stat4: ([x0,q~[x0]] notin q) or (not(((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) incin ((q - {[x0,q~[x0]]}) + {[y0,cdr([x0,q~[x0]])]}))) or (not Is_perm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or ((q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
	TELEM ==> cdr([x0,q~[x0]]) = (q~[x0])
	EQUAL(Stat4) ==> Stat5: ([x0,q~[x0]] notin q) or (not(((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))) or (not Is_perm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or ((q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
	(Stat3,Stat5*)ELEM ==> Stat6: Straight(q,x0,y0) & (q /= 0) & (([x0,q~[x0]] notin q) or (not Is_perm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or ((q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})))
	Use_def(Straight)(Stat6*) ==> Stat7: Scycle(q + {[y0,x0]}) & ([y0,x0] notin q)
	(q + {[y0,x0]},x0,y0)-->T902(Stat7*) ==> Stat8: Is_perm(q + {[y0,x0]}) & Svm(q + {[y0,x0]}) & Finite(q + {[y0,x0]})
	(q,q + {[y0,x0]})-->T53(Stat8*) ==> Svm(q)
	Use_def(Svm)(Stat7*) ==> Stat9: Is_map(q)
	(x0,q)-->T71(Stat1*) ==> Stat10: (q~[x0]) in range(q)
	(q,x0)-->T77(Stat9,Stat1,Stat6*) ==> Stat11: ({[x0,q~[x0]]} incin q) & (q = ((q - {[x0,q~[x0]]}) + {[x0,q~[x0]]})) & ((not Is_perm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or ((q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})))
--
-- Suppose first that $(q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})$.
-- Then, since $x0 in domain(q0)$, we have $q~[x0] in range(q0)$
-- and $(q~[x0]) notin domain(q)$ and $(q~[x0]) /= y0$, which
-- conflicts with Theorem 916. We must hence discharge this
-- possibility.
--
	Suppose ==> Stat12: (q~[x0]) notin domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})
		(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T78(Stat12*) ==> ((q~[x0]) notin domain(q - {[x0,q~[x0]]})) & ((q~[x0]) notin domain({[y0,q~[x0]]}))
		EQUAL(Stat11) ==> domain(q) = domain((q - {[x0,q~[x0]]}) + {[x0,q~[x0]]})
		(q - {[x0,q~[x0]]},{[x0,q~[x0]]})-->T78(Stat12*) ==> domain(q) = domain(q - {[x0,q~[x0]]}) + domain({[x0,q~[x0]]})
		(x0,q~[x0],x0,q~[x0])-->T114(Stat12*) ==> domain(q) = (domain(q - {[x0,q~[x0]]}) + {x0})
		Suppose ==> (q~[x0]) in domain(q)
			(Stat12*)ELEM ==> (q~[x0]) = x0
			EQUAL(Stat11) ==> Stat13: {[x0,x0]} incin q
			(x0,x0)-->T908(Stat13) ==> Stat14: ({[x0,x0]} /= 0) & Is_perm({[x0,x0]})
		(q,x0,y0,{[x0,x0]})-->T912(Stat6,Stat14,Stat13*) ==> false; Discharge ==> (q~[x0]) notin domain(q)
		(y0,q~[x0],y0,q~[x0])-->T114(Stat12*) ==> (q~[x0]) /= y0
	(Stat1*)Discharge ==> Stat15: (not Is_perm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
--
-- We now must analyze the three cases into which
-- the assumption that $(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}$
-- is not a permutation breaks down.
-- We easily discharge the cases that this case be infinite
-- or be not a single-valued map.
--
	Use_def(Is_perm)(Stat15*) ==> (not Svm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or (not Finite((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or (range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) /= domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
	Suppose ==> Stat16: (not Finite((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
		(q + {[y0,x0]},q - {[x0,q~[x0]]})-->T189(Stat8,Stat8*) ==> Finite(q - {[x0,q~[x0]]})
	(q - {[x0,q~[x0]]},[y0,q~[x0]])-->T199(Stat16*) ==> false; Discharge ==> Finite((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})
	Suppose ==> Stat17: (not Svm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
		(q - {[x0,q~[x0]]},q + {[y0,x0]})-->T53(Stat8,Stat8*) ==> Stat18: Svm(q - {[x0,q~[x0]]})
		(q - {[x0,q~[x0]]},q)-->T65(Stat18,Stat1*) ==> y0 notin domain(q - {[x0,q~[x0]]})
		(y0,q~[x0])-->T91(Stat19*) ==> Stat19: Svm({[y0,q~[x0]]})
		(y0,q~[x0],y0,q~[x0])-->T114(Stat19*) ==> domain({[y0,q~[x0]]}) = {y0}
	(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T87(Stat17*) ==> false; Discharge ==> Stat20: range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) /= domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})
--
--
--
	Suppose ==> Stat21: ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) in {p incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)}
	()-->Stat21(Stat15,Stat15*) ==> false; Discharge ==> ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) notin {p incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)}
--
	(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T78(Stat20*) ==> range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) /= (domain(q - {[x0,q~[x0]]}) + domain({[y0,q~[x0]]}))
	(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T79(Stat20*) ==> Stat22: (range(q - {[x0,q~[x0]]}) + range({[y0,q~[x0]]})) /= (domain(q - {[x0,q~[x0]]}) + domain({[y0,q~[x0]]}))
	(y0,q~[x0],y0,q~[x0])-->T114(Stat22*) ==> Stat23: (range(q - {[x0,q~[x0]]}) + {q~[x0]}) /= (domain(q - {[x0,q~[x0]]}) + {y0})
	(q + {[y0,x0]})-->T905(Stat8,Stat8*) ==> Stat24: one_1_map(q + {[y0,x0]})
	Suppose ==> (range(q - {[x0,q~[x0]]}) /= (range(q + {[y0,x0]}) - range({[y0,x0],[x0,q~[x0]]}))) or (domain(q - {[x0,q~[x0]]}) /= (domain(q + {[y0,x0]}) - domain({[y0,x0],[x0,q~[x0]]})))
		(Stat7,Stat11*)ELEM ==> Stat25: ((q + {[y0,x0]}) = ({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))) &
			(((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}) = (q - {[x0,q~[x0]]}))
		EQUAL(Stat25,Stat25) ==> range((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}) = range(q - {[x0,q~[x0]]})
		EQUAL(Stat25,Stat25) ==> domain((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}) = domain(q - {[x0,q~[x0]]})
		EQUAL(Stat25,Stat25) ==> domain(q + {[y0,x0]}) = domain({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))
		EQUAL(Stat25,Stat25) ==> range(q + {[y0,x0]}) = range({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))
		EQUAL(Stat24) ==> one_1_map({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))
	({[y0,x0],[x0,q~[x0]]},(q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]})-->T89(Stat24*) ==> false; Discharge ==> Stat26: not((range(q - {[x0,q~[x0]]}) /= (range(q + {[y0,x0]}) - range({[y0,x0],[x0,q~[x0]]}))) or (domain(q - {[x0,q~[x0]]}) /= (domain(q + {[y0,x0]}) - domain({[y0,x0],[x0,q~[x0]]}))))
	Use_def(Is_perm)(Stat8,Stat8*) ==> Stat27: range(q + {[y0,x0]}) = domain(q + {[y0,x0]})
	(y0,x0,x0,(q~[x0]))-->T114(Stat26*) ==> (range(q - {[x0,q~[x0]]}) = (domain(q + {[y0,x0]}) - {x0,q~[x0]})) & (domain(q - {[x0,q~[x0]]}) = (domain(q + {[y0,x0]}) - {y0,x0}))
	(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T78(Stat26*) ==> domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) = (domain(q - {[x0,q~[x0]]}) + domain({[y0,q~[x0]]}))
	(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T79(Stat26*) ==> range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) = (range(q - {[x0,q~[x0]]}) + range({[y0,q~[x0]]}))
	(y0,q~[x0],y0,q~[x0])-->T114(Stat20*) ==> Stat28: ((domain(q + {[y0,x0]}) - {y0,x0}) + {y0}) /= ((domain(q + {[y0,x0]}) - {x0,q~[x0]}) + {q~[x0]})
	(q,q+{[y0,x0]})-->T65(Stat27,Stat10,Stat1*) ==> Stat29: ((q~[x0]) in domain(q + {[y0,x0]})) & (y0 in domain(q + {[y0,x0]}))
(Stat1,Stat10,Stat28,Stat29*)ELEM ==> false; Discharge ==> QED
--
--
--
Theorem 920: (Straight(Q,X,Y) & (Q /= 0)) imp (EXISTS p incin (Q - {[X,Q~[X]]}) | Straight(p, Q~[X], Y)). Proof:
Suppose_not(q,x0,y0) ==> AUTO
	ELEM ==> Stat1: not(EXISTS p incin (q - {[x0,q~[x0]]}) | Straight(p, q~[x0], y0))
	(q,x0,y0)-->T919(*) ==> [x0,q~[x0]] in prefix(q,q~[x0])
	Use_def(prefix)(Stat1*) ==> [x0,q~[x0]] in {w: w in q, p incin ((q - {w}) + {[arb(range(q) - domain(q)),cdr(w)]}) | Is_perm(p) & ((q~[x0]) in domain(p))}
	(q,x0,y0)-->T916(*) ==> {y0} = (range(q) - domain(q))
	(range(q) - domain(q))-->T0(Stat1*) ==> arb(range(q) - domain(q)) = y0
	EQUAL(Stat1) ==> Stat2: [x0,q~[x0]] in {w: w in q, p incin ((q - {w}) + {[y0,cdr(w)]}) | Is_perm(p) & ((q~[x0]) in domain(p))}
	(w,p)-->Stat2(Stat2*) ==> ([x0,q~[x0]] = w) & (p incin ((q - {w}) + {[y0,cdr(w)]})) & Is_perm(p) & ((q~[x0]) in domain(p))
	TELEM ==> cdr([x0,q~[x0]]) = (q~[x0])
	EQUAL(Stat2) ==> Stat3: p incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})
	Suppose ==> p = 0
		EQUAL(Stat2) ==> (q~[x0]) in domain(0)
	T59(Stat3*) ==> false; Discharge ==> p /= 0
	p-->T903(Stat2*) ==> Stat4: (EXISTS c incin p | Scycle(c))
	c-->Stat4(Stat3*) ==> (c incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) & Scycle(c)
	c-->T902(Stat4*) ==> (c /= 0) & Is_perm(c)
	(q,x0,y0,c)-->T912(*) ==> c = ((c - {[y0,q~[x0]]}) + {[y0,q~[x0]]})
	EQUAL(Stat4) ==> Stat5: Scycle((c - {[y0,q~[x0]]}) + {[y0,q~[x0]]})
	Use_def(Straight)(Stat5*) ==> Straight(c - {[y0,q~[x0]]},q~[x0],y0)
(c - {[y0,q~[x0]]})-->Stat1(Stat4*) ==> false; Discharge ==> QED
--
--Suppose_not(q,x0,y0) ==> AUTO
--	ELEM ==> Stat0: not(EXISTS p incin (q - {[x0,q~[x0]]}) | Straight(p, q~[x0], y0))
--	(q - {[x0,q~[x0]]})-->Stat0(Stat0*) ==> (not Straight(q - {[x0,q~[x0]]}, q~[x0], y0))
-- --
-- -- Reasoning by contradiction, suppose that $q$ is a simple path connecting
-- -- $x0$ to $y0$, namely a finite single-valued map devoid of cycles whose
-- -- domain and range differ by ${x0}$ and ${y0}$ respectively, and assume that
-- -- $p - {[x0,p~[x0]]}$ is not a path connecting $p~[x0]$ to $y0$.
-- --
--	Use_def(Straight) ==> Stat1: Scycle(q + {[y0,x0]}) & ([y0,x0] notin q) & (not(Scycle((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) & ([y0,q~[x0]] notin (q - {[x0,q~[x0]]}))))
--	(q + {[y0,x0]},x0,y0)-->T902 ==> Stat0a: Is_perm(q + {[y0,x0]}) & Svm(q + {[y0,x0]})
--	Use_def(Is_perm)(Stat1*) ==> Stat1a: range(q + {[y0,x0]}) = domain(q + {[y0,x0]})
--	Use_def(Scycle) ==> ({p incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)} = {q + {[y0,x0]}}) & (({p incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)} /= {(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}}) or ([y0,q~[x0]] in (q - {[x0,q~[x0]]})))
--	(q,x0,y0)-->T915(*) ==> Stat6: (y0 in range(q)) & (y0 notin domain(q)) & (x0 /= y0) & (x0 in (domain(q) - range(q)))
--	(q,q + {[y0,x0]})-->T53(Stat1*) ==> Svm(q)
--	Use_def(Svm)(Stat6*) ==> Is_map(q)
--	(q,x0)-->T77(Stat6*) ==> Stat2: [x0,q~[x0]] in q
--	Suppose ==> (q~[x0]) notin range(q)
--		q-->T73(Stat6*) ==> Stat2a: (q~[x0]) notin {q~[x]: x in domain(q)}
--	x0-->Stat2a(Stat6*) ==> false; Discharge ==> Stat3a: (q~[x0]) in range(q)
-- --
-- -- After having drawn from the hypothesis $Straight(q,x0,y0) & (q /= 0)$
-- -- that $q$ is a permutation, a cycle, and a single-valued map,
-- -- whose range comprises $q~[x0]$ as a member, we infer from
-- -- $not Straight(q - {[x0,q~[x0]]}, q~[x0], y0)$ and from
-- -- the observation that $[y0,q~[x0]] notin (q - {[x0,q~[x0]]})$...
-- --
--	Suppose ==> [y0,q~[x0]] in (q - {[x0,q~[x0]]})
--		Use_def(Svm) ==> Stat3: (FORALL x in q + {[y0,x0]}, y in q + {[y0,x0]} | (car(x) = car(y)) imp (x = y))
--		TELEM ==> car([y0,q~[x0]]) = car([y0,x0])
--		([y0,q~[x0]],[y0,x0])-->Stat3(Stat2*) ==> Stat4: [y0,q~[x0]] = [y0,x0]
--		(Stat4)ELEM ==> (q~[x0]) = x0
--		(Stat6,Stat6)ELEM ==> (q + {[y0,x0]}) /= {[x0,x0]}
--		(Stat1a*)ELEM ==> Stat7: {[x0,x0]} notin {p incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)}
--		(x0,y0)-->T908(Stat5*) ==> Stat5: Is_perm({[x0,x0]})
--		EQUAL(Stat2) ==> [x0,x0] in q
--	({[x0,x0]})-->Stat7(Stat5*) ==> false; Discharge ==> ([y0,q~[x0]] notin (q - {[x0,q~[x0]]})) & ({p incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)} /= {(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}})
--
-- -- ...the fact that
-- -- $(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}$ has a strict
-- -- non-void subset $p$ which is a permutation.
-- --
--	Suppose ==> Stat8: ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) notin {p incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)}
--		((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})-->Stat8(Stat8*) ==> (not Is_perm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
--		Use_def(Is_perm)(Stat8*) ==> Stat9: (not Svm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or (not Finite((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) or (range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) /= domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
--		(q - {[x0,q~[x0]]},q + {[y0,x0]})-->T53(Stat1*) ==> Svm(q - {[x0,q~[x0]]})
--		(q - {[x0,q~[x0]]},q)-->T65(Stat6,Stat6*) ==> y0 notin domain(q - {[x0,q~[x0]]})
--		(y0,q~[x0])-->T91(Stat10) ==> Stat10: Svm({[y0,q~[x0]]})
--		(y0,q~[x0],y0,q~[x0])-->T114(Stat10) ==> domain({[y0,q~[x0]]}) = {y0}
--		(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T87(Stat9*) ==> Svm((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})
--		Use_def(Is_perm)(Stat0a,Stat0a*) ==> Finite(q + {[y0,x0]})
--		(q + {[y0,x0]},q - {[x0,q~[x0]]})-->T189(Stat10*) ==> Finite(q - {[x0,q~[x0]]})
--		(q - {[x0,q~[x0]]},[y0,q~[x0]])-->T199(Stat9*) ==> Stat11: range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) /= domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})
--		(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T78(Stat11*) ==> range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) /= (domain(q - {[x0,q~[x0]]}) + domain({[y0,q~[x0]]}))
--		(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T79(Stat11*) ==> Stat12: (range(q - {[x0,q~[x0]]}) + range({[y0,q~[x0]]})) /= (domain(q - {[x0,q~[x0]]}) + domain({[y0,q~[x0]]}))
--		(y0,q~[x0],y0,q~[x0])-->T114(Stat12*) ==> Stat11a: (range(q - {[x0,q~[x0]]}) + {q~[x0]}) /= (domain(q - {[x0,q~[x0]]}) + {y0})
--		(q + {[y0,x0]})-->T905(Stat1*) ==> Stat12a: one_1_map(q + {[y0,x0]})
--		Suppose ==> (range(q - {[x0,q~[x0]]}) /= (range(q + {[y0,x0]}) - range({[y0,x0],[x0,q~[x0]]}))) or (domain(q - {[x0,q~[x0]]}) /= (domain(q + {[y0,x0]}) - domain({[y0,x0],[x0,q~[x0]]})))
--			(Stat1,Stat2*)ELEM ==> Stat13a: ((q + {[y0,x0]}) = ({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))) &
--				(((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}) = (q - {[x0,q~[x0]]}))
--			EQUAL(Stat13a,Stat13a) ==> range((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}) = range(q - {[x0,q~[x0]]})
--			EQUAL(Stat13a,Stat13a) ==> domain((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}) = domain(q - {[x0,q~[x0]]})
--			EQUAL(Stat13a,Stat13a) ==> domain(q + {[y0,x0]}) = domain({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))
--			EQUAL(Stat13a,Stat13a) ==> range(q + {[y0,x0]}) = range({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))
--			EQUAL(Stat12a) ==> one_1_map({[y0,x0],[x0,q~[x0]]} + ((q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]}))
--		({[y0,x0],[x0,q~[x0]]},(q + {[y0,x0]}) - {[y0,x0],[x0,q~[x0]]})-->T89(Stat12a*) ==> false; Discharge ==> Stat13: not((range(q - {[x0,q~[x0]]}) /= (range(q + {[y0,x0]}) - range({[y0,x0],[x0,q~[x0]]}))) or (domain(q - {[x0,q~[x0]]}) /= (domain(q + {[y0,x0]}) - domain({[y0,x0],[x0,q~[x0]]}))))
--		(y0,x0,x0,(q~[x0]))-->T114(Stat13,Stat1a*) ==> (range(q - {[x0,q~[x0]]}) = (domain(q + {[y0,x0]}) - {x0,q~[x0]})) & (domain(q - {[x0,q~[x0]]}) = (domain(q + {[y0,x0]}) - {y0,x0}))
--		(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T78(Stat13*) ==> domain((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) = (domain(q - {[x0,q~[x0]]}) + domain({[y0,q~[x0]]}))
--		(q - {[x0,q~[x0]]},{[y0,q~[x0]]})-->T79(Stat13*) ==> range((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) = (range(q - {[x0,q~[x0]]}) + range({[y0,q~[x0]]}))
--		(y0,q~[x0],y0,q~[x0])-->T114(Stat11*) ==> Stat15: ((domain(q + {[y0,x0]}) - {y0,x0}) + {y0}) /= ((domain(q + {[y0,x0]}) - {x0,q~[x0]}) + {q~[x0]})
--		(q,q+{[y0,x0]})-->T65(Stat1a,Stat3a,Stat6*) ==> Stat14: ((q~[x0]) in domain(q + {[y0,x0]})) & (y0 in domain(q + {[y0,x0]}))
--	(Stat6,Stat3a,Stat15,Stat14*)ELEM ==> false; Discharge ==> Stat20: not({p incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)} incin {(q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}})
--	p-->Stat20(Stat20*) ==> Stat21: (p in {p incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}) | (p /= 0) & Is_perm(p)}) & (p /= ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]}))
--	()-->Stat21(Stat21*) ==> Stat21a: (p incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) & (p /= 0) & Is_perm(p)
-- --
-- -- It follows from the definition of permutation that
-- -- such a set $p$ includes a simple cycle $c$, which
-- -- obviously is a non-void permutation.
-- --
--	p-->T903(Stat21a*) ==> Stat20a: (EXISTS c incin p | Scycle(c))
--	c-->Stat20a(Stat21a*) ==> Stat22: (c incin ((q - {[x0,q~[x0]]}) + {[y0,q~[x0]]})) & Scycle(c)
--	c-->T902(Stat22*) ==> (c /= 0) & Is_perm(c)
-- --
-- -- Notice that $c$ must have $[y0,q~[x0]]$ as a member; since otherwise
-- -- $c$ would be a permutation contained in the straight path $q$, which is
-- -- impossible.
-- --
--	Suppose ==> [y0,q~[x0]] notin c
--		(Stat22*)ELEM ==> c incin (q - {[x0,q~[x0]]})
--		Use_def(Straight)(*) ==> Scycle(q + {[y0,x0]})
--		Use_def(Scycle)(Stat2*) ==> Stat22a: c notin {p incin (q + {[y0,x0]}) | (p /= 0) & Is_perm(p)}
--	c-->Stat22a(Stat22*) ==> false; Discharge ==> [y0,q~[x0]] in c
--	({[y0,q~[x0]]},c)-->T65(Stat22*) ==> domain({[y0,q~[x0]]}) incin domain(c)
--	(y0,q~[x0],0,0)-->T114(Stat22*) ==> y0 in domain(c)
-- --
-- -- Thus it turns out that $c-{[y0,q~[x0]]}$ is a simple path
-- -- leading from $q~[x0]$ to $y0$ within $q - {[x0,q~[x0]]}$,
-- -- contrary to one of our initial assumptions. This
-- -- contradiction proves the desired statement.
-- --
--	(c,y0)-->T914(Stat22*) ==> Stat23: Straight(c - {[y0,c~[y0]]}, c~[y0], y0)
--	Suppose ==> (q~[x0]) /= (c~[y0])
--		c-->T902(Stat21a*) ==> Svm(c)
--		(c,[y0,q~[x0]])-->T74(Stat22*) ==> (c~[car([y0,q~[x0]])]) = cdr([y0,q~[x0]])
--		TELEM ==> car([y0,q~[x0]]) = y0
--		TELEM ==> cdr([y0,q~[x0]]) = q~[x0]
--	EQUAL(Stat23) ==> false; Discharge ==> (q~[x0]) = (c~[y0])
--	EQUAL(Stat23) ==> Straight(c - {[y0,q~[x0]]}, q~[x0], y0)
--(c - {[y0,q~[x0]]})-->Stat0(Stat22*) ==> false; Discharge ==> QED
--
Theorem 921: not(Acyclic(R) & Straight(P,Z,Y) & Straight(Q,Y,Z) & ((P + Q) incin R) & ((P + Q) /= 0)). Proof:
Suppose_not(r0,q0,z0,y0,q1) ==> AUTO
--
-- Assuming that a counterexample $r0,q0,z0,y0,q1,x0$ can exist, we will reach a contradiction by
-- finding a cycle $s$ included in $q0+q1$ by means of the following construction.
--
-- We begin by noting that neither $q0$ nor $q1$ can be void.
	Suppose ==> q0 = 0
		EQUAL ==> Straight(0,z0,y0)
		(z0,y0)-->T910(*) ==> z0 = y0
	(q1,y0,z0)-->T915(*) ==> false; Discharge ==> q0 /= 0
	Suppose ==> q1 = 0
		EQUAL ==> Straight(0,y0,z0)
		(y0,z0)-->T910(*) ==> y0 = z0
	(q0,z0,y0)-->T915(*) ==> false; Discharge ==> q1 /= 0
--
-- Next we note that the set $q0 + q1$ meets the property of being a finite map whose
-- domain includes its range.
--
	(q0,z0,y0)-->T902(*) ==> Stat1: Svm(q0) & Finite(q0)
	(q1,y0,z0)-->T902(*) ==> Svm(q1) & Finite(q1)
	Use_def(Svm)(Stat1*) ==> Is_map(q0) & Is_map(q1)
	(q0,q1)-->T62(*) ==> Stat2: Is_map(q0 + q1) & ((q0 + q1) /= 0)
	(q0,q1)-->T236(Stat1*) ==> Finite(q0 + q1)
	Suppose ==> Stat3: range(q0 + q1) nincin domain(q0 + q1)
		(q0,q1)-->T78(Stat3*) ==> domain(q0 + q1) = (domain(q0) + domain(q1))
		(q0,q1)-->T79(Stat3*) ==> range(q0 + q1) = (range(q0) + range(q1))
		(q0,z0,y0)-->T916(*) ==> ({y0} = (range(q0) - domain(q0))) & ({z0} = (domain(q0) - range(q0)))
		(q1,y0,z0)-->T916(*) ==> ({z0} = (range(q1) - domain(q1))) & ({y0} = (domain(q1) - range(q1)))
	Discharge ==> range(q0 + q1) incin domain(q0 + q1)
--
-- Hence, by Theorem 904, the said map $q0+q1$ must include a cycle.
--
	(q0 + q1)-->T904(Stat2*) ==> Stat4: (EXISTS c incin (q0 + q1) | Scycle(c))
--
-- Such a cycle $c$ must be included in $r0$, which contradicts the assumed acyclicity of $r0$,
-- and hence leads to the desired contradiction.
--
	c-->Stat4(*) ==> (c incin r0) & Scycle(c)
	c-->T902(Stat4*) ==> (c /= 0) & Is_perm(c)
	Use_def(Acyclic)(*) ==> Stat5: c notin {c incin r0 | Is_perm(c)}
c-->Stat5(Stat4*) ==> false; Discharge ==> QED
--
Theorem 922: (Acyclic(R) & Straight(P,Z,Y) & Straight(Q,X,Z) & ((P + Q) incin R)) imp (EXISTS s incin (P + Q) | Straight(s,X,Y)). Proof:
Suppose_not(r0,q0,z0,y0,q1,x0) ==> AUTO
--
-- Assuming that a counterexample $r0,q0,z0,y0,q1,x0$ can exist, we will reach a contradiction by
-- finding a straight path $s$ leading from $x0$ to $y0$ by the following construction.
--
	ELEM ==> Stat1: not(EXISTS s incin (q0 + q1) | Straight(s,x0,y0))
	Suppose ==> Stat2: q0 = 0
		EQUAL ==> Straight(0,z0,y0)
		(z0,y0)-->T910(Stat2*) ==> y0 = z0
		(Stat2,Stat2*)ELEM ==> q0 + q1 = q1
		EQUAL(Stat1) ==> Stat3: not(EXISTS s incin q1 | Straight(s,x0,z0))
	q1-->Stat3(*) ==> false; Discharge ==> Stat4: q0 /= 0
	Suppose ==> Stat5: q1 = 0
		EQUAL ==> Straight(0,x0,z0)
		(x0,z0)-->T910(Stat5*) ==> z0 = x0
		(Stat5,Stat5*)ELEM ==> q0 + q1 = q0
		EQUAL(Stat1) ==> Stat6: not(EXISTS s incin q0 | Straight(s,z0,y0))
	q0-->Stat6(*) ==> false; Discharge ==> Stat7: (q1 /= 0) & ((q0 + q1) incin r0)
--
-- After the technical remark that neither $q0$ nor $q1$ can be null, we show that the set
-- $q0 + q1 + {[y0,x0]}$ meets the property of being a finite map whose domain includes
-- its range, so that by Theorem 904 this map must include a cycle.
--
	(q0,z0,y0)-->T902(*) ==> Stat8: Svm(q0) & Finite(q0)
	(q1,x0,z0)-->T902(*) ==> Svm(q1) & Finite(q1)
	Use_def(Svm)(Stat8*) ==> Is_map(q0) & Is_map(q1)
	(q0,q1)-->T62(Stat8*) ==> Is_map(q0 + q1)
	(q0,q1)-->T236(Stat8*) ==> Finite(q0 + q1)
 	TELEM ==> Is_map({[y0,x0]})
	(q0 + q1,{[y0,x0]})-->T62(Stat8*) ==> Stat9: Is_map((q0 + q1) + {[y0,x0]})
	(q0 + q1,[y0,x0])-->T199(Stat8*) ==> Finite((q0 + q1) + {[y0,x0]})
	Suppose ==> Stat10: range((q0 + q1) + {[y0,x0]}) nincin domain((q0 + q1) + {[y0,x0]})
		(q0,q1)-->T78(Stat10*) ==> domain(q0 + q1) = (domain(q0) + domain(q1))
		(q0,q1)-->T79(Stat10*) ==> range(q0 + q1) = (range(q0) + range(q1))
		(y0,x0,0,0)-->T114(Stat10*) ==> (domain({[y0,x0]}) = {y0}) & (range({[y0,x0]}) = {x0})
		(q0 + q1,{[y0,x0]})-->T78(Stat10*) ==> domain((q0 + q1) + {[y0,x0]}) = (domain(q0) + domain(q1) + {y0})
		(q0 + q1,{[y0,x0]})-->T79(Stat10*) ==> range((q0 + q1) + {[y0,x0]}) = (range(q0) + range(q1) + {x0})
		(q0,z0,y0)-->T916(*) ==> ({y0} = (range(q0) - domain(q0))) & ({z0} = (domain(q0) - range(q0)))
		(q1,x0,z0)-->T916(*) ==> ({z0} = (range(q1) - domain(q1))) & ({x0} = (domain(q1) - range(q1)))
	Discharge ==> range((q0 + q1) + {[y0,x0]}) incin domain((q0 + q1) + {[y0,x0]})
	((q0 + q1) + {[y0,x0]})-->T904(Stat9*) ==> Stat11: (EXISTS c incin ((q0 + q1)  + {[y0,x0]}) | Scycle(c))
--
-- Such a cycle $c$ must own $[y0,x0]$ as an element, else the assumed acyclicity of $r0$ would
-- be contradicted.
--
	c-->Stat11(Stat11*) ==> (c incin ((q0 + q1)  + {[y0,x0]})) & Scycle(c)
	c-->T902(Stat11*) ==> Stat12: (c /= 0) & Is_perm(c) & Svm(c)
	Suppose ==> [y0,x0] notin c
		(Stat7*)ELEM ==> c incin r0
		Use_def(Acyclic)(*) ==> Stat13: c notin {c incin r0 | Is_perm(c)}
	c-->Stat13(Stat7*) ==> false; Discharge ==> [y0,x0] in c
--
-- But then, removal of $[y0,x0]$ from $c$ will give us simple path leading
-- from $x0$ to $y0$, included in $q0+q1$. This conflicts with one of our initial
-- assumptions, and hence leads us to the sought conclusion.
--
	({[y0,x0]},c)-->T65(Stat11*) ==> domain({[y0,x0]}) incin domain(c)
	(y0,x0,0,0)-->T114(Stat11*) ==> y0 in domain(c)
	(c,y0)-->T914(Stat11*) ==> Stat14: Straight(c - {[y0,c~[y0]]},c~[y0],y0)
	Suppose ==> (c~[y0]) /= x0
		(c,[y0,x0])-->T74(Stat11*) ==> (c~[car([y0,x0])]) = cdr([y0,x0])
		TELEM ==> car([y0,x0]) = y0
		TELEM ==> cdr([y0,x0]) = x0
	EQUAL(Stat14) ==> false; Discharge ==> (c~[y0]) = x0
	EQUAL(Stat14) ==> Straight(c - {[y0,x0]}, x0, y0)
(c - {[y0,x0]})-->Stat1(Stat11*) ==> false; Discharge ==> QED
--
-- Of the next three statements, the first is a special case of the second, and
-- the third provides a situation in which the second is applicable.
--
--Theorem 921: (Straight(P,Z,Y) & (X notin range(P)) & (X /= Z)) imp Straight(P + {[X,Z]},X,Y)
--Suppose_not(q,z0,y0,x0) ==> AUTO
--Tsomehow ==> false; Discharge ==>
--Suppose_not(q,z0,y0,x0) ==> AUTO
--	Suppose ==> q = 0
--		ELEM ==> (q + {[x0,z0]}) = {[x0,z0]}
--		EQUAL ==> Stat90: Straight(0,z0,y0)
--		(z0,y0)-->T910(Stat90*) ==> z0 = y0
--		EQUAL ==> (not Straight({[x0,z0]},x0,z0))
--	(x0,z0)-->T909(*) ==> false; Discharge ==> q /= 0
--	Use_def(Straight) ==> Stat0: Scycle(q + {[y0,z0]}) & ([y0,z0] notin q) & (not(Scycle((q + {[x0,z0]}) + {[y0,x0]}) & ([y0,x0] notin (q + {[x0,z0]})))) & (x0 notin range(q)) & (x0 /= z0)
--	Suppose ==> [y0,x0] in (q + {[x0,z0]})
--		Suppose ==> Stat1: [y0,x0] = [x0,z0]
--			(Stat1)ELEM ==> x0 = z0
--		(Stat0*)Discharge ==> [y0,x0] /= [x0,z0]
--		(Stat0*)ELEM ==> Stat2: [y0,x0] in q
--		Use_def(range)(Stat0*) ==> Stat3: x0 notin {cdr(x): x in q}
--		([y0,x0])-->Stat3(Stat2*) ==> Stat4a: x0 /= cdr([y0,x0])
--	(Stat4a)Discharge ==> Stat4: (not Scycle((q + {[x0,z0]}) + {[y0,x0]}))
--	Use_def(Scycle)(Stat4*) ==> {p incin ((q + {[x0,z0]}) + {[y0,x0]}) | (p /= 0) & Is_perm(p)} /= {(q + {[x0,z0]}) + {[y0,x0]}}
--	Suppose ==> Stat5: ((q + {[x0,z0]}) + {[y0,x0]}) notin {p incin ((q + {[x0,z0]}) + {[y0,x0]}) | (p /= 0) & Is_perm(p)}
--		((q + {[x0,z0]}) + {[y0,x0]})-->Stat5(Stat5*) ==> Stat13: (not Is_perm((q + {[x0,z0]}) + {[y0,x0]}))
--		Use_def(Is_perm((q + {[x0,z0]}) + {[y0,x0]})) ==> AUTO
--		(q,{[x0,z0]})-->T78(Stat7*) ==> Stat7: domain(q + {[x0,z0]}) = (domain(q) + domain({[x0,z0]}))
--		(q,{[x0,z0]})-->T79(Stat8*) ==> Stat8: range(q + {[x0,z0]}) = (range(q) + range({[x0,z0]}))
--		(q + {[x0,z0]},{[y0,x0]})-->T78(Stat7*) ==> Stat9: domain((q + {[x0,z0]}) + {[y0,x0]}) = ((domain(q) + domain({[x0,z0]})) + domain({[y0,x0]}))
--		(q + {[x0,z0]},{[y0,x0]})-->T79(Stat8*) ==> Stat10: range((q + {[x0,z0]}) + {[y0,x0]}) = ((range(q) + range({[x0,z0]})) + range({[y0,x0]}))
--		(x0,z0,0,0)-->T114(Stat11*) ==> Stat11: (domain({[x0,z0]}) = {x0}) & (range({[x0,z0]}) = {z0})
--		(y0,x0,0,0)-->T114(Stat9*) ==> Stat12: (domain((q + {[x0,z0]}) + {[y0,x0]}) = ((domain(q) + {x0}) + {y0})) & (range((q + {[x0,z0]}) + {[y0,x0]}) = ((range(q) + {z0}) + {x0}))
--		(q,z0,y0)-->T916(*) ==> ({y0} = (range(q) - domain(q))) & ({z0} = (domain(q) - range(q)))
--		(Stat12*)ELEM ==> domain((q + {[x0,z0]}) + {[y0,x0]}) = range((q + {[x0,z0]}) + {[y0,x0]})
--		(q,z0,y0)-->T902(*) ==> Stat14: Svm(q) & Finite(q)
--		(q,[x0,z0])-->T199(Stat14*) ==> Finite(q + {[x0,z0]})
--		(q + {[x0,z0]},[y0,x0])-->T199 ==> Finite((q + {[x0,z0]}) + {[y0,x0]})
--		Use_def(Is_perm)(Stat13*) ==> Stat16a: (not Svm((q + {[x0,z0]}) + {[y0,x0]}))
--		(Stat0*)ELEM ==> Stat15: x0 notin domain(q)
--		(x0,z0)-->T91(Stat16*) ==> Stat16: Svm({[x0,z0]})
--		(x0,z0,0,0)-->T114(Stat16*) ==> Stat17: domain({[x0,z0]}) = {x0}
--		(q,{[x0,z0]})-->T87(Stat14*) ==> Svm(q + {[x0,z0]})
--		(q,{[x0,z0]})-->T78(Stat17*) ==> domain(q + {[x0,z0]}) = (domain(q) + {x0})
--		(Stat0*)ELEM ==> Stat18: y0 notin domain(q + {[x0,z0]})
--		(y0,x0)-->T91(Stat16*) ==> Stat19: Svm({[y0,x0]})
--		(y0,x0,0,0)-->T114(Stat19*) ==> domain({[y0,x0]}) = {y0}
--	(q + {[x0,z0]},{[y0,x0]})-->T87(Stat16a*) ==> false; Discharge ==> Stat30: not({p incin ((q + {[x0,z0]}) + {[y0,x0]}) | (p /= 0) & Is_perm(p)} incin {(q + {[x0,z0]}) + {[y0,x0]}})
--	p-->Stat30(Stat30*) ==> Stat31: (p in {p incin ((q + {[x0,z0]}) + {[y0,x0]}) | (p /= 0) & Is_perm(p)}) & (p /= ((q + {[x0,z0]}) + {[y0,x0]}))
--	()-->Stat31(Stat31*) ==> (p incin ((q + {[x0,z0]}) + {[y0,x0]})) & (p /= 0) & Is_perm(p)
--Tsomehow ==> false; Discharge ==>
--
--
--
--Theorem 922: (Straight(P,Z,Y) & Straight(Q,X,Z) & ((range(P) * domain(Q)) = 0)) imp Straight(P + Q,X,Y)
--Suppose_not(q0,z0,y0,q1,x0) ==> AUTO
--Tsomehow ==> false; Discharge ==>
--
--
--
--Theorem OM: (Acyclic(R) & Straight(P,Z,Y) & Straight(Q,X,Z) & ((P + Q) incin R)) imp ((range(P) * domain(Q)) = 0)
--Suppose_not(r0,q0,z0,y0,q1,x0) ==> AUTO
--Tsomehow ==> false; Discharge ==>
--
--
--
Theorem 923: Is_map(on(R,V)) & (on(R,V) incin R) & (Is_map(R) imp (on(R + inv(R),V) = (on(R,V) + inv(on(R,V))))). Proof:
Suppose_not(r,v) ==> AUTO
	Use_def(on) ==> Stat1: not(Is_map(r * (v PROD v)) & (Is_map(r) imp (((r * (v PROD v)) + (inv(r) * (v PROD v))) = ((r * (v PROD v)) + inv(r * (v PROD v))))))
	(r * (v PROD v),v,v)-->T141(Stat2*) ==> Stat2: Is_map(r * (v PROD v))
	(Stat1*)ELEM ==> Stat3: Is_map(r) & Stat4: ((inv(r) * (v PROD v)) /= inv(r * (v PROD v)))
	c-->Stat4(Stat3*) ==> Stat5: (c in (inv(r) * (v PROD v))) neq (c in inv(r * (v PROD v)))
	(inv(r) * (v PROD v),v,v)-->T141(Stat6*) ==> Stat6: Is_map(inv(r) * (v PROD v))
	(r * (v PROD v))-->T99(Stat7*) ==> Stat7: Is_map(inv(r * (v PROD v)))
	Suppose ==> Stat8: c /= [car(c),cdr(c)]
		Suppose ==> Stat9: c in (inv(r) * (v PROD v))
		(inv(r) * (v PROD v),c)-->T76(Stat6,Stat9,Stat8*) ==> false; Discharge ==> Stat10: c in inv(r * (v PROD v))
	(inv(r * (v PROD v)),c)-->T76(Stat7,Stat10,Stat8*) ==> false; Discharge ==> Stat11: c = [car(c),cdr(c)]
	EQUAL(Stat11,Stat5) ==> Stat12: ([car(c),cdr(c)] in (inv(r) * (v PROD v))) neq ([car(c),cdr(c)] in inv(r * (v PROD v)))
	Suppose ==> [car(c),cdr(c)] in (inv(r) * (v PROD v))
		EQUAL(Stat11) ==> Stat13: c in (inv(r) * (v PROD v))
		(c,v,v)-->T140(Stat13*) ==> Stat14: (car(c) in v) & (cdr(c) in v)
		(Stat11*)ELEM ==> Stat15: [car(c),cdr(c)] notin inv(r * (v PROD v))
		(r * (v PROD v),cdr(c),car(c))-->T90(Stat15,Stat2*) ==> Stat16: [cdr(c),car(c)] notin (r * (v PROD v))
		Suppose ==> [cdr(c),car(c)] notin (v PROD v)
			Use_def(PROD)(Stat17*) ==> Stat17: [cdr(c),car(c)] notin {[x,y]: x in v, y in v}
		(cdr(c),car(c))-->Stat17(Stat14,Stat14*) ==> false; Discharge ==> Stat18: [cdr(c),car(c)] in (v PROD v)
		(Stat16*)ELEM ==> Stat19: [cdr(c),car(c)] notin r
	(r,cdr(c),car(c))-->T90(Stat3,Stat19,Stat18,Stat11,Stat13*) ==> false; Discharge ==> Stat20: [car(c),cdr(c)] in inv(r * (v PROD v))
	(r * (v PROD v),cdr(c),car(c))-->T90(Stat2,Stat20*) ==> Stat21: [cdr(c),car(c)] in (r * (v PROD v))
	(r,cdr(c),car(c))-->T90(Stat3,Stat21,Stat20,Stat12*) ==> Stat22: [car(c),cdr(c)] notin (v PROD v)
	Use_def(PROD)(Stat21,Stat21*) ==> Stat23: [cdr(c),car(c)] in {[x,y]: x in v, y in v}
	(x,y)-->Stat23(Stat23*) ==> Stat24: ([cdr(c),car(c)] = [x,y]) & (x in v) & (y in v)
	(Stat24*)ELEM ==> Stat25: [cdr(c),car(c)] = [x,y]
	(Stat25)ELEM ==> (x = cdr(c)) & (y = car(c))
	EQUAL(Stat24) ==> Stat26: (car(c) in v) & (cdr(c) in v)
	Use_def(PROD)(Stat22,Stat22*) ==> Stat27: [car(c),cdr(c)] notin {[x,y]: x in v, y in v}
(car(c),cdr(c))-->Stat27(Stat21*) ==> false; Discharge ==> QED
--
--
--
Theorem 924: Is_map(transCl(R)) & Is_map(trans_reflCl(R,V)) & (trans_reflCl(R,V) incin (V PROD V)). Proof:
Suppose_not(r,v) ==> AUTO
	Suppose ==> Stat1: (not Is_map(transCl(r)))
	Use_def(transCl)(Stat1*) ==> false; Discharge ==> Is_map(transCl(r))
	Use_def(trans_reflCl)(Stat2*) ==> (not Is_map(transCl(on(r,v)) + ident(v))) or ((transCl(on(r,v)) + ident(v)) nincin (v PROD v))
	Suppose ==> Stat2: (not Is_map(transCl(on(r,v)) + ident(v)))
		(transCl(on(r,v)),ident(v))-->T62(*) ==> Stat3: (not Is_map(transCl(on(r,v)))) or (not Is_map(ident(v)))
		(v,0,0)-->T115(*) ==> one_1_map(ident(v))
		Use_def(one_1_map)(Stat3*) ==> Svm(ident(v))
		Use_def(Svm)(Stat3*) ==> Is_map(ident(v))
		(Stat3*)ELEM ==> Stat4: (not Is_map(transCl(on(r,v))))
	Use_def(transCl)(Stat4*) ==> false; Discharge ==> Stat5: (transCl(on(r,v)) + ident(v)) nincin (v PROD v)
	Suppose ==> Stat6: not({[x,x]: x in v} incin {[x,y]: x in v, y in v})
		c-->Stat6(Stat6*) ==> Stat7: (c in {[x,x]: x in v}) & (c notin {[x,y]: x in v, y in v})
	(x,x,x)-->Stat7(Stat7*) ==> false; Discharge ==> Stat8: {[x,x]: x in v} incin {[x,y]: x in v, y in v}
	Use_def(ident)(Stat8*) ==> ident(v) incin {[x,y]: x in v, y in v}
	Use_def(PROD)(Stat8*) ==> Stat9: transCl(on(r,v)) nincin (v PROD v)
	Use_def(transCl)(Stat9*) ==> Stat10: not(({[x,y]: q incin on(r,v), x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}) incin (v PROD v))
	d-->Stat10(Stat10*) ==> Stat11: (d in {[x,y]: q incin on(r,v), x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}) & (d notin (v PROD v))
	(q,x1,y1)-->Stat11(Stat11*) ==> Stat12: (d = [x1,y1]) & (q incin on(r,v)) & (x1 in domain(q)) & (y1 in range(q))
	Use_def(on)(Stat12*) ==> q incin (v PROD v)
	(q,v,v)-->T141(Stat12*) ==> Stat13: (x1 in v) & (y1 in v) & (d = [x1,y1])
	(Stat13)ELEM ==> Stat14: (car(d) in v) & (cdr(d) in v)
	Use_def(PROD)(Stat11*) ==> Stat15: d notin {[x,y]: x in v, y in v}
	(Stat12*)ELEM ==> Stat16: d = [x1,y1]
	(Stat16)ELEM ==> d = [car(d),cdr(d)]
(car(d),cdr(d))-->Stat15(Stat14*) ==> false; Discharge ==> QED
--
--
--
Theorem 925: Is_map(R) imp (R incin transCl(R)). Proof:
Suppose_not(r) ==> AUTO
	Use_def(transCl) ==> Stat1: not(r incin {[x,y]: q incin r, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or((x /= y) & Straight(q,x,y))})
	c-->Stat1(Stat1*) ==> Stat2: (c notin {[x,y]: q incin r, x in domain(q), y in range(q) |  ((x = y) & Scycle(q)) or((x /= y) & Straight(q,x,y))}) & (c in r)
	(r,c)-->T51 ==> c = [car(c),cdr(c)]
	({[car(c),cdr(c)]},car(c),cdr(c))-->Stat2(Stat2*) ==> Stat3: (car(c) notin domain({[car(c),cdr(c)]})) or (cdr(c) notin range({[car(c),cdr(c)]})) or (not(((car(c) = cdr(c)) & Scycle({[car(c),cdr(c)]})) or ((car(c) /= cdr(c)) & Straight({[car(c),cdr(c)]},car(c),cdr(c)))))
	(car(c),cdr(c),0,0)-->T114(Stat3*) ==> Stat4: not(((car(c) = cdr(c)) & Scycle({[car(c),cdr(c)]})) or ((car(c) /= cdr(c)) & Straight({[car(c),cdr(c)]},car(c),cdr(c))))
	(car(c),cdr(c))-->T909(Stat4) ==> car(c) = cdr(c)
	(Stat4*)ELEM ==> (not Scycle({[car(c),cdr(c)]}))
	EQUAL(Stat4) ==> Stat5: (not Scycle({[car(c),car(c)]}))
(car(c),0)-->T908(Stat5*) ==> false; Discharge ==> QED
--
--
--
Theorem 926: (R incin S) imp (transCl(R) incin transCl(S)). Proof:
Suppose_not(r,s) ==> AUTO
	Set_monot ==> {[x,y]: q incin r, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))} incin {[x,y]: q incin s, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}
Use_def(transCl) ==> false; Discharge ==> QED
--
--
--
Theorem 927: ((R incin S) & (N incin M)) imp (trans_reflCl(R,N) incin trans_reflCl(S,M)). Proof:
Suppose_not(r,s,n,m) ==> AUTO
	(n,m,n,m)-->T256 ==> (n PROD n) incin (m PROD m)
	Use_def(on) ==> on(r,n) incin on(s,m)
	(on(r,n),on(s,m))-->T926 ==> transCl(on(r,n)) incin transCl(on(s,m))
	Set_monot ==> {[x,x]: x in n} incin {[x,x]: x in m}
	Use_def(ident) ==> ident(n) incin ident(m)
Use_def(trans_reflCl) ==> false; Discharge ==> QED
--
--
--
Theorem 928: (transCl(R) incin (domain(R) PROD range(R))) & (Finite(R) imp Finite(transCl(R))). Proof:
Suppose_not(r) ==> AUTO
--
-- For, the transitive closure of $r$ is contained in the Cartesian product of
-- $domain(r)$ by $range(r)$,...
--
	Suppose ==> Stat1: not(transCl(R) incin (domain(R) PROD range(R)))
		d-->Stat1(Stat1*) ==> Stat2: (d in transCl(r)) & (d notin (domain(r) PROD range(r)))
		Use_def(transCl)(Stat2*) ==> Stat3: d in {[x,y]: q incin r, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}
		(q1,x1,y1)-->Stat3(Stat3*) ==> Stat4: (d = [x1,y1]) & (q1 incin r) & (x1 in domain(q1)) & (y1 in range(q1))
		(q1,r)-->T65(Stat4*) ==> (x1 in domain(r)) & (y1 in range(r))
		Use_def(PROD)(Stat2,Stat2*) ==> Stat5: d notin {[x,y]: x in domain(r), y in range(r)}
	(x1,y1)-->Stat5(Stat4*) ==> false; Discharge ==> Stat6: (transCl(r) incin (domain(r) PROD range(r))) & Finite(r) & (not Finite(transCl(r)))
--
-- ... which is finite when $r$ is finite.
--
	APPLY() finite_image(e(x)->car(x),s0->r) ==> Finite({car(x): x in r})
	Use_def(domain)(*) ==> Stat7: Finite(domain(r))
	APPLY() finite_image(e(x)->cdr(x),s0->r) ==> Finite({cdr(x): x in r})
	Use_def(range)(*) ==> Finite(range(r))
	(domain(r),range(r))-->T262(Stat7*) ==> Stat8: Finite(domain(r) PROD range(r))
(domain(r) PROD range(r),transCl(r))-->T189(Stat6*) ==> false; Discharge ==> QED
--
--
--
Theorem 929: Acyclic(A) imp (([X,X] notin transCl(A)) & (({[X,Y],[Y,Z]} incin transCl(A)) imp ([X,Z] in transCl(A)))). Proof:
Suppose_not(a,x0,y0,z0) ==> AUTO
	ELEM ==> Stat1: Acyclic(a)
	Suppose ==> [x0,x0] in transCl(a)
		Use_def(transCl) ==> Stat2: [x0,x0] in {[x,y]: q incin a, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}
		(q1,x1,y1)-->Stat2(Stat2*) ==> Stat3: ([x0,x0] = [x1,y1]) & (q1 incin a) & (((x1 = y1) & Scycle(q1)) or ((x1 /= y1) & Straight(q1,x1,y1)))
		(Stat3)ELEM ==> Scycle(q1)
		(q1,0,0)-->T902(Stat3*) ==> (q1 /= 0) & Is_perm(q1)
		Use_def(Acyclic)(Stat3*) ==> Stat4: q1 notin {c incin a | Is_perm(c)}
	q1-->Stat4(Stat3*) ==> false; Discharge ==> Stat5: ({[x0,y0],[y0,z0]} incin transCl(a)) & ([x0,z0] notin transCl(a))
	Suppose ==> Stat6: {[x,x]: q incin a, x in domain(q) | Scycle(q)} /= 0
		(q3,x3)-->Stat6(Stat6*) ==> (q3 incin a) & Scycle(q3)
		q3-->T906(Stat6*) ==> (not Acyclic(q3))
	(a,q3)-->T907(*) ==> false; Discharge ==> Stat7: {[x,x]: q incin a, x in domain(q) | Scycle(q)} = 0
	Use_def(transCl) ==> Stat8: ([x0,y0] in {[x,y]: q incin a, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}) & Stat9: ([y0,z0] in {[x,y]: q incin a, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}) &
		Stat10: ([x0,z0] notin {[x,y]: q incin a, x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))})
	(q5,x5,y5)-->Stat8(Stat8,Stat8*) ==> Stat11: ([x0,y0] = [x5,y5]) & (q5 incin a) & (x5 in domain(q5)) & (((x5 = y5) & Scycle(q5)) or ((x5 /= y5) & Straight(q5,x5,y5)))
	Suppose ==> x5 = y5
	(q5,x5)-->Stat7(Stat11*) ==> false; Discharge ==> Straight(q5,x5,y5)
	(Stat11*)ELEM ==> Stat12: [x0,y0] = [x5,y5]
	(Stat12)ELEM ==> (x0 = x5) & (y0 = y5)
	EQUAL(Stat11) ==> Stat13: (q5 incin a) & Straight(q5,x0,y0)
	(q6,x6,y6)-->Stat9(Stat13,Stat13*) ==> Stat14: ([y0,z0] = [x6,y6]) & (q6 incin a) & (x6 in domain(q6)) & (((x6 = y6) & Scycle(q6)) or ((x6 /= y6) & Straight(q6,x6,y6)))
	Suppose ==> x6 = y6
	(q6,x6)-->Stat7(Stat14*) ==> false; Discharge ==> Straight(q6,x6,y6)
	(Stat14*)ELEM ==> Stat15: [y0,z0] = [x6,y6]
	(Stat15)ELEM ==> (y0 = x6) & (z0 = y6)
	EQUAL(Stat14) ==> Stat16: (q6 incin a) & Straight(q6,y0,z0)
	(a,q6,y0,z0,q5,x0)-->T922(Stat13,Stat16,Stat1*) ==> Stat17: (EXISTS s incin (q6 + q5) | Straight(s,x0,z0))
	s-->Stat17(Stat13,Stat16*) ==> (s incin a) & (Straight(s,x0,z0))
	Suppose ==> s = 0
		EQUAL(Stat17) ==> Straight(0,x0,z0)
		(x0,z0)-->T910(Stat5*) ==> x0 = z0
		EQUAL(Stat16) ==> Straight(q6,y0,x0)
		T59(Stat18*) ==> Stat18: domain(0) = 0
		Suppose ==> q5 = 0
			EQUAL(Stat11) ==> x5 in domain(0)
		(Stat18*)Discharge ==> q5 /= 0
		Suppose ==> q6 = 0
			EQUAL(Stat14) ==> x6 in domain(0)
		(Stat18*)Discharge ==> q6 /= 0
	(a,q5,x0,y0,q6)-->T921(Stat1*) ==> false; Discharge ==> s /= 0
	(s,x0,z0)-->T915(Stat17*) ==> (x0 in domain(s)) & (z0 in range(s)) & (x0 /= z0)
(s,x0,z0)-->Stat10(Stat17*) ==> false; Discharge ==> QED
--
Theorem 930: (Acyclic(F) & Finite(T) & (T /= 0)) imp (EXISTS w in T | (FORALL v in T | [v,w] notin transCl(F))). Proof:
Suppose_not(f,t0) ==> AUTO
--
-- If a counterexample $f,t$ existed, we could take one in which $t$ is
-- inclusion-minimal.
--
	APPLY(m1_thryvar:t) finite_induction(n->t0,P(x)->((x /= 0) & (not(EXISTS w in x | (FORALL v in x | [v,w] notin transCl(f)))))) ==>
		Stat1: (t incin t0) & (t /= 0) & Stat2: (not(EXISTS w in t | (FORALL v in t | [v,w] notin transCl(f)))) & Stat3: (FORALL k incin t | ((k /= t) imp (not ((k /= 0) & (not(EXISTS w in k | (FORALL v in k | [v,w] notin transCl(f))))))))
--
-- Such $t$ would have at least two elements. Therefore, if we remove one
-- element, the left-over must have a minimal element $w$ relative to $transCl(f)$.
--
	Suppose ==> Stat4: t = {arb(t)}
		(arb(t))-->Stat2(Stat4*) ==> Stat5: not(FORALL v in t | [v,arb(t)] notin transCl(f))
		v0-->Stat5(Stat4*) ==> (v0 = arb(t)) & ([v0,arb(t)] in transCl(f))
		EQUAL(Stat5) ==> [arb(t),arb(t)] in transCl(f)
	(f,arb(t),0,0)-->T929(*) ==> false; Discharge ==> (t - {arb(t)}) /= 0
	(t - {arb(t)})-->Stat3 ==> Stat6: (EXISTS w in (t - {arb(t)}) | (FORALL v in (t - {arb(t)}) | [v,w] notin transCl(f)))
	w-->Stat6(Stat6*) ==> Stat7: (w in (t - {arb(t)})) & Stat8: (FORALL v in (t - {arb(t)}) | [v,w] notin transCl(f))
	(Stat7)ELEM ==> arb(t) in t
--
-- Now compare $arb(t)$ and $w$. We must have $[arb(t),w] in transCl(f)$, for otherwise
-- $w$ would be minimal in $t$.
--
	Suppose ==> Stat9: [arb(t),w] notin transCl(f)
		w-->Stat2(Stat7*) ==> Stat10: not(FORALL v in t | [v,w] notin transCl(f))
		v1-->Stat10(Stat10*) ==> (v1 in t) & ([v1,w] in transCl(f))
		Suppose ==> v1 /= arb(t)
		v1-->Stat8(Stat10*) ==> false; Discharge ==> v1 = arb(t)
	EQUAL(Stat9) ==> false; Discharge ==> [arb(t),w] in transCl(f)
--
-- But then $arb(t)$ is minimal in $t$; for, if not, then either
-- $[w,arb(t)] in transCl(f)$ would hold, in which case ${w,arb(t)}$
-- woud be a cycle in $f$, or $[v,arb(t)] in transCl(f)$ would hold
-- for some $v in (t - {arb(t),w})$, in which case we would have
-- $[v,w] in transCl(f)$ by transitivity.
--
	(arb(t))-->Stat2(Stat1) ==> Stat11: not(FORALL v in t | [v,arb(t)] notin transCl(f))
	v-->Stat11(Stat11*) ==> (v in t) & ([v,arb(t)] in transCl(f))
	Suppose ==> v = arb(t)
		EQUAL(Stat11) ==> [arb(t),arb(t)] in transCl(f)
	(f,arb(t),0,0)-->T929(*) ==> false; Discharge ==> v /= arb(t)
	(Stat11*)ELEM ==> Stat12: v in (t - {arb(t)})
	v-->Stat8(Stat12*) ==> [v,w] notin transCl(f)
(f,v,arb(t),w)-->T929(*) ==> false; Discharge ==> QED
--
-- Every partitioning property $T$ can be converted into a unary predicate
-- $Is_tag$ suitable for being passed as third parameter to the following THEORY,
-- by means of the following construct $X_Tag$:
--
Def 10028a: [formal extension of tagging property] X_Tag(T,X) := T(X) or (X = {arb(X)})
--
-- The following THEORY starts with a graph whose vertices may even
-- form a proper class, each vertex bearing a unique tag, and proceeds
-- to construct a global equivalence relation.
--
THEORY taggedGraph(Is_vertex(V),Is_edge(E),Is_tag(X))
	(FORALL e | Is_edge(e) imp ((e = [car(e),cdr(e)]) & Is_vertex(car(e)) & Is_vertex(cdr(e))))
	(FORALL v | (EXISTS y | Is_vertex(v) imp (Is_tag(y) & (v in y))))
	(FORALL x,y | (Is_tag(x) & Is_tag(y) & (x /= y)) imp ((x * y) = 0))
END taggedGraph
--
ENTER_THEORY taggedGraph
--
APPLY(v1_thryvar:tag1_thryvar) Skolem() ==>
Theorem taggedGraph0: [association of its tag to each vertex] (FORALL v | Is_vertex(v) imp (Is_tag(tag1_thryvar(v)) & (v in tag1_thryvar(v))))
--
Def 10028: [block consisting of all vertices which bear the same tag] block_thryvar(V) :=
	if Is_vertex(V) then {w in tag1_thryvar(V) | Is_vertex(w)} else 0 end if
--
Def 10029: [equivalence between vertices which bear the same tag] SameTag_thryvar(V,W) :=
	block_thryvar(V) = block_thryvar(W)
--
-- The following two theorems prove the trivial fact that
-- the relation 'SameTag' just defined is an equivalence relation.
--
Theorem taggedGraph1: SameTag_thryvar(X,X). Proof:
Suppose_not(x) ==> AUTO
Use_def(SameTag_thryvar) ==> false; Discharge ==> QED
--
Theorem taggedGraph2: (SameTag_thryvar(X,Y) & SameTag_thryvar(Y,Z)) imp SameTag_thryvar(Z,X). Proof:
Suppose_not(x,y,z) ==> AUTO
Use_def(SameTag_thryvar) ==> false; Discharge ==> QED
--
Theorem taggedGraph3: ((Q incin (R + inv(R))) & Is_map(R) & (FORALL e in R | SameTag_thryvar(car(e),cdr(e))) & (X in domain(Q))) imp SameTag_thryvar(X,(Q~[X])). Proof:
Suppose_not(q,r,x) ==> AUTO
	r-->T99 ==> Is_map(inv(r))
	(r,inv(r))-->T62 ==> Is_map(r + inv(r))
	(q,r + inv(r))-->T52 ==> Stat1: Is_map(q) & Is_map(r) & (not SameTag_thryvar(x,(q~[x]))) & Stat2: (FORALL e in r | SameTag_thryvar(car(e),cdr(e)))
--
-- Reasoning by contradiction, let us consider a counterexample
-- $q,r,x$.
--
	(q,x)-->T77 ==> Stat3: [x,q~[x]] in (r + inv(r))
	Suppose ==> [x,q~[x]] in r
		([x,q~[x]])-->Stat2(Stat3*) ==> SameTag_thryvar(car([x,q~[x]]),cdr([x,q~[x]]))
		TELEM ==> (car([x,q~[x]]) = x) & (cdr([x,q~[x]]) = (q~[x]))
	EQUAL ==> false; Discharge ==> [x,q~[x]] notin r
	(r,q~[x],x)-->T90(Stat1*) ==> [q~[x],x] in r
	TELEM ==> (car([q~[x],x]) = (q~[x])) & (cdr([q~[x],x]) = x)
	([q~[x],x])-->Stat2(Stat3*) ==> SameTag_thryvar(car([q~[x],x]),cdr([q~[x],x]))
	EQUAL(Stat3) ==> Stat4: SameTag_thryvar((q~[x]),x)
Use_def(SameTag_thryvar)(Stat1,Stat4*) ==> false; Discharge ==> QED
--
Theorem taggedGraph4: ((Q incin (R + inv(R))) & Is_map(R) & (FORALL e in R | SameTag_thryvar(car(e),cdr(e))) & Straight(Q,X,Y)) imp SameTag_thryvar(X,Y). Proof:
Suppose_not(q0,r,x0,y0) ==> AUTO
	(q0,x0,y0)-->T902 ==> Stat1: (q0 incin (r + inv(r))) & Svm(q0) & Finite(q0)
	Use_def(Svm) ==> Is_map(q0)
	Suppose ==> Stat2: not(EXISTS u | Straight(q0,u,y0) & (not SameTag_thryvar(u,y0)))
	x0-->Stat2 ==> false; Discharge ==> (EXISTS w | Straight(q0,w,y0) & (not SameTag_thryvar(w,y0)))
--
-- Reasoning by contradiction, let us consider a counterexample
-- $q,r,w,y0$ such that no counterexample $qp,r,wp,y0$ exists which has
-- $qp$ strictly included in $q$.
--
	APPLY(m1_thryvar:q) finite_induction(n->q0,P(x)->(EXISTS u | Straight(x,u,y0) & (not SameTag_thryvar(u,y0)))) ==>
		Stat3: (q incin q0) & Stat4: (EXISTS u | Straight(q,u,y0) & (not SameTag_thryvar(u,y0))) &
		Stat5: (FORALL qp incin q | (qp /= q) imp (not (EXISTS u | Straight(qp,u,y0) & (not SameTag_thryvar(u,y0)))))
	(q,q0)-->T52(Stat1*) ==> (q incin (r + inv(r))) & Is_map(q)
	w-->Stat4(Stat3*) ==> Stat6: Straight(q,w,y0) & (not SameTag_thryvar(w,y0))
--
-- One readily sees that $q = 0$ cannot hold.
--
	Suppose ==> q = 0
		EQUAL(Stat6) ==> Straight(0,w,y0)
		(w,y0)-->T910(Stat6*) ==> w = y0
		EQUAL(Stat6) ==> (not SameTag_thryvar(w,w))
	w-->TtaggedGraph1(Stat6*) ==> false; Discharge ==> q /= 0
--
-- But then if we remove the initial edge from $q$ we get
-- a shorter path ending in $y0$, which shows that
-- $q~[w]$ has the same tag as $y0$. Moreover, by the
-- preceding Theorem taggedGraph3, $w$ and $q~[w]$ bear the
-- same tag. Hence, by transitivity, we get that $w$ and $y0$
-- bear the same tag, which conflicts with our initial hypothesis
-- and hence provides the desired conclusion.
--
	(q,w,y0)-->T920(Stat6*) ==> Stat7: (EXISTS qp incin (q - {[w,q~[w]]}) | Straight(qp, q~[w], y0))
	qp-->Stat7(Stat7*) ==> (qp incin (q - {[w,q~[w]]})) & Straight(qp, q~[w], y0)
	(q,w,y0)-->T915(Stat6*) ==> w in domain(q)
	(q,w)-->T77(Stat3*) ==> [w,q~[w]] in q
	qp-->Stat5(Stat3*) ==> Stat8: not(EXISTS u | Straight(qp,u,y0) & (not SameTag_thryvar(u,y0)))
	(q~[w])-->Stat8(Stat6*) ==> SameTag_thryvar((q~[w]),y0)
	(q,r,w)-->TtaggedGraph3(*) ==> SameTag_thryvar(w,(q~[w]))
	Use_def(SameTag_thryvar)(Stat8*) ==> SameTag_thryvar(w,y0)
(Stat6*)ELEM ==> false; Discharge ==> QED
--
Theorem taggedGraph5: (Is_map(R) & (FORALL e in R | SameTag_thryvar(car(e),cdr(e))) & ([X,Y] in trans_reflCl(R + inv(R),V))) imp SameTag_thryvar(X,Y). Proof:
Suppose_not(r,x,y,v) ==> Stat1: ([x,y] in trans_reflCl(r + inv(r),v)) & (not SameTag_thryvar(x,y)) & Is_map(r) & Stat2: (FORALL e in r | SameTag_thryvar(car(e),cdr(e)))
	Use_def(trans_reflCl) ==> [x,y] in (transCl(on(r + inv(r),v)) + ident(v))
	Suppose ==> [x,y] in ident(v)
		Use_def(ident) ==> Stat3: [x,y] in {[w,w]: w in v}
		w-->Stat3(Stat3) ==> x = y
		x-->TtaggedGraph1(Stat1*) ==> SameTag_thryvar(x,x)
	EQUAL(Stat1*) ==> false; Discharge ==> Stat4: ([x,y] notin ident(v)) & ([x,y] in transCl(on(r + inv(r),v)))
	Use_def(transCl)(Stat4*) ==> Stat5: [x,y] in {[u,w]: q incin on(r + inv(r),v), u in domain(q), w in range(q) | ((u = w) & Scycle(q)) or ((u /= w) & Straight(q,u,w))}
	(q,x0,y0)-->Stat5(Stat5*) ==> Stat6: ([x,y] = [x0,y0]) & (q incin on(r + inv(r),v)) & (((x0 = y0) & Scycle(q)) or ((x0 /= y0) & Straight(q,x0,y0)))
	(Stat6*)ELEM ==> Stat7: [x,y] = [x0,y0]
	(Stat7)ELEM ==> (x = x0) & (y = y0)
	Suppose ==> x0 = y0
		EQUAL ==> not SameTag_thryvar(x,x)
	x-->TtaggedGraph1(Stat7*) ==> false; Discharge ==> Straight(q,x0,y0)
	(r,v)-->T923(Stat1,Stat1*) ==> (on(r + inv(r),v) = (on(r,v) + inv(on(r,v)))) & Is_map(on(r,v)) & (on(r,v) incin r)
	EQUAL(Stat1) ==> (q incin (on(r,v) + inv(on(r,v)))) & Straight(q,x,y) & (not SameTag_thryvar(x,y))
	Suppose ==> Stat8: not(FORALL e in on(r,v) | SameTag_thryvar(car(e),cdr(e)))
		e-->Stat8(Stat8*) ==> (e in on(r,v)) & (not SameTag_thryvar(car(e),cdr(e)))
	e-->Stat2(Stat7*) ==> false; Discharge ==> (FORALL e in on(r,v) | SameTag_thryvar(car(e),cdr(e)))
(q,on(r,v),x,y)-->TtaggedGraph4(Stat7*) ==> false; Discharge ==> QED
--
--DISPLAY taggedGraph
--
--THEORY taggedGraph(Is_vertex(V),Is_edge(E),Is_tag(X))
--	(FORALL e | Is_edge(e) imp ((e = [car(e),cdr(e)]) & Is_vertex(car(e)) & Is_vertex(cdr(e))))
--	(FORALL v | (EXISTS y | Is_vertex(v) imp (Is_tag(y) & (v in y))))
--	(FORALL x,y | (Is_tag(x) & Is_tag(y) & (x /= y)) imp ((x * y) = 0))
--==>(tag1_thryvar,block_thryvar,SameTag_thryvar)
--	(FORALL v | Is_vertex(v) imp (Is_tag(tag1_thryvar(v)) & (v in tag1_thryvar(v))))
--	(FORALL v | block_thryvar(v) = if Is_vertex(v) then {w in tag1_thryvar(v) | Is_vertex(w)} else 0 end if)
--	(FORALL v, w | SameTag_thryvar(v,w) eq (block_thryvar(v) = block_thryvar(w)))
--	(FORALL x | SameTag_thryvar(x,x))
--	(FORALL x, y, z | (SameTag_thryvar(x,y) & SameTag_thryvar(y,z)) imp SameTag_thryvar(z,x))
--	(FORALL q, r, x | ((q incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & (x in domain(q))) imp SameTag_thryvar(x,(q~[x])))
--	(FORALL q, r, x, y | ((q incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & Straight(q,x,y)) imp SameTag_thryvar(x,y))
--	(FORALL r, x, y, v | (Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & ([x,y] in trans_reflCl(r + inv(r),v))) imp SameTag_thryvar(x,y))
--END taggedGraph
--
ENTER_THEORY Set_theory
--
--
--
THEORY acyclicFiniteGraph(vertices,edges)
	edges incin (vertices PROD vertices)
	Finite(edges)
	Acyclic(edges)
END acyclicFiniteGraph
--
ENTER_THEORY acyclicFiniteGraph
--
Theorem acyclicFiniteGraph1: (FORALL t | ((t incin vertices) & (t /= 0)) imp (EXISTS w in t | (FORALL v in t | not([v,w] in transCl(edges))))). Proof:
Suppose_not ==> Stat1: not(FORALL t | ((t incin vertices) & (t /= 0)) imp (EXISTS w in t | (FORALL v in t | not([v,w] in transCl(edges)))))
--
-- For, assume $t$ to be a non-empty set of vertices which is devoid of minimal elements w.r.t. the
-- transitive closure of the graph. Such set must be included in $range(edges)$, i.e., every one
-- of its elements must have an incident edge.
--
	Assump ==> Stat2: Acyclic(edges) & Finite(edges)
	t0-->Stat1(*) ==> Stat3: (t0 incin vertices) & (t0 /= 0) & Stat4: (not(EXISTS w in t0 | (FORALL v in t0 | not([v,w] in transCl(edges)))))
	Suppose ==> Stat5: not(t0 incin range(edges))
		c-->Stat5(Stat5*) ==> Stat6: (c in t0) & (c notin range(edges))
		c-->Stat4(Stat3*) ==> Stat7: not(FORALL v in t0 | not([v,c] in transCl(edges)))
		v0-->Stat7(Stat7*) ==> Stat8: (v0 in t0) & ([v0,c] in transCl(edges))
		edges-->T928(Stat8,Stat2*) ==> [v0,c] in (domain(edges) PROD range(edges))
		({[v0,c]},domain(edges),range(edges))-->T141(Stat8*) ==> range({[v0,c]}) incin range(edges)
	(v0,c,0,0)-->T114(Stat6*) ==> false; Discharge ==> Stat9: t0 incin range(edges)
--
-- Accordingly, $t0$ must be finite.
--
	APPLY() finite_image(e(x)->cdr(x),s0->edges) ==> Finite({cdr(x): x in edges})
	Use_def(range)(*) ==> Finite(range(edges))
	(range(edges),t0)-->T189(Stat9*) ==> Finite(t0)
--
-- But then, by the Theorem 930 proved above, it must have a minimal element,
-- contrary to our initial hypothesis. This contradiction proves the desired statement.
--
	(edges,t0)-->T930(Stat2*) ==> Stat10: (EXISTS w in t0 | (FORALL v in t0 | [v,w] notin transCl(edges)))
	w0-->Stat10(Stat10*) ==> Stat11: (w0 in t0) & Stat12: (FORALL v in t0 | [v,w0] notin transCl(edges))
	w0-->Stat4(Stat11*) ==> Stat13: not(FORALL v in t0 | not([v,w0] in transCl(edges)))
	v1-->Stat13(Stat13*) ==> (v1 in t0) & ([v1,w0] in transCl(edges))
v1-->Stat12(Stat13*) ==> false; Discharge ==> QED
--
APPLY(rk_thryvar:rk2) wellfounded_recursive_fcn(s->vertices,arg1_bef_arg2(y,x)->([y,x] in transCl(edges)),f3(b,x,t)->0,g4(a,y,x,t)->0,P4(a,y,x,t)->(a = a)) ==>
	Theorem acyclicFiniteGraph2: (FORALL x, t | (x in vertices) imp (rk2(x,t) = Un({next(rk2(y,t)): y in vertices | ([y,x] in transCl(edges)) & ([y,x] in t)})))
--
Def 10083: [height of vertex in finite acyclic graph] height_thryvar(X) := rk2(X,edges)
--
Theorem acyclicFiniteGraph3: (X in vertices) imp (height_thryvar(X) = Un({next(height_thryvar(y)): y in vertices | [y,X] in edges})). Proof:
Suppose_not(x0) ==> AUTO
	TacyclicFiniteGraph2 ==> Stat1: (FORALL x, t | (x in vertices) imp (rk2(x,t) = Un({next(rk2(y,t)): y in vertices | ([y,x] in transCl(edges)) & ([y,x] in t)})))
	(x0,edges)-->Stat1(*) ==> rk2(x0,edges) = Un({next(rk2(y,edges)): y in vertices | ([y,x0] in transCl(edges)) & ([y,x0] in edges)})
	Use_def(height_thryvar) ==> Stat2: Un({next(height_thryvar(y)): y in vertices | ([y,x0] in transCl(edges)) & ([y,x0] in edges)}) /= Un({next(height_thryvar(y)): y in vertices | [y,x0] in edges})
	Suppose ==> {next(height_thryvar(y)): y in vertices | ([y,x0] in transCl(edges)) & ([y,x0] in edges)} = {next(height_thryvar(y)): y in vertices | [y,x0] in edges}
	EQUAL(Stat2) ==> false; Discharge ==> Stat3: {next(height_thryvar(y)): y in vertices | ([y,x0] in transCl(edges)) & ([y,x0] in edges)} /= {next(height_thryvar(y)): y in vertices | [y,x0] in edges}
	y0-->Stat3(Stat3*) ==> Stat4: (([y0,x0] in transCl(edges)) & ([y0,x0] in edges)) neq ([y0,x0] in edges)
	Assump ==> Stat5: edges incin (vertices PROD vertices)
	(edges,vertices,vertices)-->T141(Stat5*) ==> Is_map(edges)
edges-->T925(Stat4*) ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--
--DISPLAY acyclicFiniteGraph
--
--THEORY acyclicFiniteGraph(vertices,edges)
--	edges incin (vertices PROD vertices)
--	Finite(edges)
--	Acyclic(edges)
--==>(height_thryvar)
--	(FORALL t | ((t incin vertices) & (t /= 0)) imp (EXISTS w in t | (FORALL v in t | not([v,w] in transCl(edges)))))
--	(FORALL x | (x in vertices) imp (height_thryvar(x) = Un({next(height_thryvar(y)): y in vertices | [y,x] in edges})))
--END acyclicFiniteGraph
--
--
Def 10051: [transitivity of a multi-valued map] Transitive(R) := (R @ R) incin R
--
Def 10052: [symmetricity of a multi-valued map] Symmetric(R) := inv(R) incin R
--
Def 10053: [reflexivity of a multi-valued map on a set] Reflexive(R,N) := R incs ident(N)
--
Def 10054: [irreflexivity, aka strictness, of a multi-valued map] Strict(R,N) := (R * ident(N)) = 0
--
Def 10055: [asymmetricity of a multi-valued map] Asymmetric(R,N) := on((R * inv(R)),N) in {0,ident(N)}
--
Def 10056: [quasi-order, aka preorder, of a set] Is_qo(R,N) := Is_map(R) & Transitive(on(R,N)) & ((R * ident(N)) in {0,ident(N)})
--
Def 10057: [partial ordering of a set] Is_po(R,N) := Is_map(R) & Transitive(on(R,N)) & Asymmetric(R,N)
--
Def 10058: [stability of a partition w.r.t. a set] Stable(P,A) := (FORALL b in P | ((b * A) = 0) or (b incin A))
--
--
THEORY labeledGraph(vertices,edges,tags)
	edges incin (vertices PROD vertices)
	vertices incin Un(tags)
	(FORALL x in tags, y in tags | (x /= y) imp ((x * y) = 0))
END labeledGraph
--
ENTER_THEORY labeledGraph
--
Theorem labeledGraph0: (E in edges) imp ((E = [car(E),cdr(E)]) & (car(E) in vertices) & (cdr(E) in vertices)). Proof:
Suppose_not(e) ==> Stat1: (e in edges) & ((e /= [car(e),cdr(e)]) or (car(e) notin vertices) or (cdr(e) notin vertices))
	Assump ==> edges incin (vertices PROD vertices)
	Use_def(PROD) ==> Stat2: e in {[x,y]: x in vertices, y in vertices}
	(x1,y1)-->Stat2(Stat2*) ==> Stat3: (e = [x1,y1]) & (x1 in vertices) & (y1 in vertices)
	(Stat3)ELEM ==> (x1 = car(e)) & (y1 = cdr(e)) & (e = [car(e),cdr(e)])
(Stat1*)Discharge ==> QED
--
Theorem labeledGraph1: (EXISTS y | (V in vertices) imp ((y in tags) & (V in y))). Proof:
Suppose_not(v) ==> Stat1: not(EXISTS y | (v in vertices) imp ((y in tags) & (v in y)))
	Suppose ==> v notin vertices
	0-->Stat1 ==> false; Discharge ==> v in vertices
	Assump ==> vertices incin Un(tags)
	Use_def(Un) ==> Stat2: v in {x: y in tags, x in y}
	(y,x)-->Stat2(Stat2*) ==> (y in tags) & (v in y)
y-->Stat1 ==> false; Discharge ==> QED
--
Theorem labeledGraph2: ((X in tags) & (Y in tags) & (X /= Y)) imp ((X * Y) = 0). Proof:
Suppose_not(x,y) ==> AUTO
	Assump ==> Stat1: (FORALL x in tags, y in tags | (x /= y) imp ((x * y) = 0))
(x,y)-->Stat1 ==> false; Discharge ==> QED
--
APPLY(tag1_thryvar:tag2_thryvar,block_thryvar:block_thryvar,SameTag_thryvar:SameTag_thryvar) taggedGraph(Is_vertex(V)->(V in vertices),Is_edge(E)->(E in edges),Is_tag(V)->(V in tags)) ==>
Theorem labeledGraph3: [properties of labeled graphs inherited from tagged graphs] (FORALL v | (v in vertices) imp ((tag2_thryvar(v) in tags) & (v in tag2_thryvar(v)))) &
	(FORALL v | block_thryvar(v) = if v in vertices then {w in tag2_thryvar(v) | w in vertices} else 0 end if) &
	(FORALL v, w | SameTag_thryvar(v,w) eq (block_thryvar(v) = block_thryvar(w))) &
	(FORALL v | SameTag_thryvar(v,v)) &
	(FORALL q, r, x | ((q incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & (x in domain(q))) imp SameTag_thryvar(x,(q~[x]))) &
	(FORALL q, r, x, y | ((q incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & Straight(q,x,y)) imp SameTag_thryvar(x,y)) &
	(FORALL r, x, y, v | (Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & ([x,y] in trans_reflCl(r + inv(r),v))) imp SameTag_thryvar(x,y))
--
Def 10133: [set of all bisimulations over the labeled graph] bisim_thryvar := {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
--
Def 10134: [bisimilarity equivalence relation] bisimilar_thryvar := Un(bisim_thryvar)
--
Def 10135: [set of all simulations over the labeled graph] sim_thryvar := {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) }
--
Def 10136: [similarity equivalence relation] similar_thryvar := Un(sim_thryvar) * inv(Un(sim_thryvar))
--
Theorem labeledGraph4: (0 in bisim_thryvar) & (bisim_thryvar incin sim_thryvar) & ((X in bisim_thryvar) imp (X incin (vertices PROD vertices))). Proof:
Suppose_not(r) ==> AUTO
	Suppose ==> Stat1: 0 notin bisim_thryvar
		Use_def(bisim_thryvar)(Stat2,Stat2*) ==> Stat3: 0 notin {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
		()-->Stat3(Stat3*) ==> not(((edges @ inv(0)) = (inv(0) @ edges)) & ((edges @ 0) = (0 @ edges)))
		Use_def(inv)(Stat1,Stat1*) ==> Stat4: inv(0) = {[cdr(x),car(x)]: x in 0}
		(Stat4)ELEM ==> inv(0) = 0
		Use_def(@)(Stat1,Stat1*) ==> Stat5: ((edges @ 0) = {[car(x),cdr(y)]: x in 0, y in edges | cdr(x) = car(y)}) &
			((0 @ edges) = {[car(x),cdr(y)]: x in edges, y in 0 | cdr(x) = car(y)})
		Suppose ==> Stat6: {[car(x),cdr(y)]: x in 0, y in edges | cdr(x) = car(y)} /= 0
		(x1,y1)-->Stat6(Stat6*) ==> false; Discharge ==> {[car(x),cdr(y)]: x in 0, y in edges | cdr(x) = car(y)} = 0
		Suppose ==> Stat7: {[car(x),cdr(y)]: x in edges, y in 0 | cdr(x) = car(y)} /= 0
		(x2,y2)-->Stat7(Stat7*) ==> false; Discharge ==> {[car(x),cdr(y)]: x in edges, y in 0 | cdr(x) = car(y)} = 0
		(Stat5*)ELEM ==> ((edges @ 0) = 0) & ((0 @ edges) = 0)
	EQUAL(Stat3*) ==> false; Discharge ==> 0 in bisim_thryvar
	Suppose ==> Stat8: (r in bisim_thryvar) & Stat9: (not(r incin (vertices PROD vertices)))
		x-->Stat9(Stat8*) ==> (x in r) & (x notin (vertices PROD vertices))
		Use_def(bisim_thryvar)(Stat8*) ==> Stat10: r in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
		()-->Stat10(Stat10*) ==> r incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}
		Set_monot(Stat10) ==> {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} incin {[v,w]: v in vertices, w in vertices}
	Use_def(PROD)(Stat8*) ==> false; Discharge ==> Stat11: not(bisim_thryvar incin sim_thryvar)
	b-->Stat11(Stat11*) ==> Stat2: (b in bisim_thryvar) & (b notin sim_thryvar)
	Use_def(sim_thryvar)(Stat12,Stat12*) ==> Stat13: b notin {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) }
	Use_def(bisim_thryvar)(Stat2,Stat2*) ==> Stat14: b in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
	()-->Stat14(Stat14*) ==> (b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & (((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)))
b-->Stat13(Stat13*) ==> false; Discharge ==> QED
--
--
Theorem labeledGraph5: (B in bisim_thryvar) imp (B incin bisimilar_thryvar). Proof:
Suppose_not(b) ==> AUTO
	Use_def(bisimilar_thryvar) ==> b nincin Un(bisim_thryvar)
	(bisim_thryvar,0)-->T274 ==> Stat1: (FORALL x in bisim_thryvar | x incin Un(bisim_thryvar))
b-->Stat1 ==> false; Discharge ==> QED
--
Theorem labeledGraph6: (B in bisim_thryvar) imp (inv(B) in bisim_thryvar). Proof:
Suppose_not(b) ==> AUTO
	Use_def(bisim_thryvar) ==> Stat1: (b in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) &
		Stat2: (inv(b) notin {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
	()-->Stat1(Stat1*) ==> Stat3: (b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges))
	()-->Stat2(Stat3*) ==> Stat4: (not(inv(b) incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})) or ((edges @ inv(inv(b))) /= (inv(inv(b)) @ edges))
	Suppose ==> Stat5: (not(inv(b) incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}))
		c-->Stat5(Stat5*) ==> Stat6: (c in inv(b)) & (c notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		Use_def(inv)(Stat6*) ==> Stat7: c in {[cdr(x),car(x)]: x in b}
		x0-->Stat7(Stat7*) ==> Stat8: (x0 in b) & (c = [cdr(x0),car(x0)])
		EQUAL(Stat6*) ==> Stat9: [cdr(x0),car(x0)] notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}
		(cdr(x0),car(x0))-->Stat9(Stat9*) ==> Stat10: (cdr(x0) notin vertices) or (car(x0) notin vertices) or (not(SameTag_thryvar(cdr(x0),car(x0))))
		(Stat8,Stat3*)ELEM ==> Stat11: x0 in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}
		(v0,w0)-->Stat11(Stat11*) ==> Stat12: (x0 = [v0,w0]) &  (v0 in vertices) & (w0 in vertices) & SameTag_thryvar(v0,w0)
		(Stat10,Stat12)ELEM ==> (v0 = car(x0)) & (w0 = cdr(x0)) & (not(SameTag_thryvar(cdr(x0),car(x0))))
		EQUAL(Stat12) ==> Stat13: not(SameTag_thryvar(w0,v0))
		TlabeledGraph3 ==> Stat14: (FORALL v, w | SameTag_thryvar(v,w) eq (block_thryvar(v) = block_thryvar(w)))
		(v0,w0)-->Stat14(Stat12,Stat12*) ==> block_thryvar(v0) = block_thryvar(w0)
	(w0,v0)-->Stat14(Stat13*) ==> false; Discharge ==> Stat15: (edges @ inv(inv(b))) /= (inv(inv(b)) @ edges)
	TELEM ==> Stat16: Is_map({[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
	(b,{[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})-->T52(Stat3,Stat16) ==> Is_map(b) & ((edges @ b) = (b @ edges))
	b-->T100(Stat16*) ==> b = inv(inv(b))
EQUAL(Stat15*) ==> false; Discharge ==> QED
--
Theorem labeledGraph7: bisimilar_thryvar incin similar_thryvar. Proof:
Suppose_not ==> AUTO
	Use_def(bisimilar_thryvar) ==> not(Un(bisim_thryvar) incin similar_thryvar)
	Use_def(similar_thryvar) ==> Stat1: not(Un(bisim_thryvar) incin (Un(sim_thryvar) * inv(Un(sim_thryvar))))
	p-->Stat1(Stat1*) ==> (p in Un(bisim_thryvar)) & (p notin (Un(sim_thryvar) * inv(Un(sim_thryvar))))
	TlabeledGraph4(Stat1*) ==> Stat2: bisim_thryvar incin sim_thryvar
	(bisim_thryvar,sim_thryvar)-->T276(Stat1*) ==> Stat3: (p in Un(sim_thryvar)) & (p notin inv(Un(sim_thryvar)))
	Use_def(Un)(Stat1*) ==> Stat4: p in {x: y in bisim_thryvar, x in y}
	(b,q)-->Stat4(Stat4*) ==> Stat5: (b in bisim_thryvar) & (p in b)
	b-->TlabeledGraph6(Stat5*) ==> Stat6: inv(b) in bisim_thryvar
	TlabeledGraph4(Stat6*) ==> inv(b) in sim_thryvar
	Use_def(bisim_thryvar)(Stat5,Stat5*) ==> Stat7: b in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
	()-->Stat7(Stat7,Stat5*) ==>Stat8: p in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}
	(v,w)-->Stat8(Stat8*) ==> Stat9: p = [v,w]
	Use_def(inv)(Stat3,Stat3*) ==> Stat10: p notin {[cdr(x),car(x)]: x in Un(sim_thryvar)}
	([w,v])-->Stat10(Stat9) ==> Stat11: [w,v] notin Un(sim_thryvar)
	(bisim_thryvar,sim_thryvar)-->T276(Stat2,Stat11*) ==> Stat12: [w,v] notin Un(bisim_thryvar)
	(bisim_thryvar,0)-->T274(Stat11*) ==> Stat13: (FORALL x in bisim_thryvar | x incin Un(bisim_thryvar))
	(inv(b))-->Stat13(Stat6,Stat12*) ==> [w,v] notin inv(b)
	Use_def(inv)(Stat13*) ==> Stat14: [w,v] notin {[cdr(x),car(x)]: x in b}
p-->Stat14(Stat5,Stat9) ==> false; Discharge ==> QED
--
Theorem labeledGraph8: (B in sim_thryvar) imp (trans_reflCl(B,vertices) in sim_thryvar). Proof:
Suppose_not(b0) ==> AUTO
	Use_def(sim_thryvar) ==> Stat1: (b0 in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) }) &
		Stat2: (trans_reflCl(b0,vertices) notin {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) })
	()-->Stat1(Stat1*) ==> Stat3: (b0 incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(b0)) = (inv(b0) @ edges))
	(trans_reflCl(b0,vertices))-->Stat2(Stat1,Stat1*) ==> (not(trans_reflCl(b0,vertices) incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})) or ((edges @ inv(trans_reflCl(b0,vertices))) /= (inv(trans_reflCl(b0,vertices)) @ edges))
	Suppose ==> Stat4: not(trans_reflCl(b0,vertices) incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		c-->Stat4(Stat4*) ==> (c in trans_reflCl(b0,vertices)) & (c notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		(b0,vertices)-->T924(Stat4*) ==> Is_map(trans_reflCl(b0,vertices))
		(trans_reflCl(b0,vertices),c)-->T51(Stat4*) ==> (c = [car(c),cdr(c)])
		EQUAL(Stat4) ==> Stat5: ([car(c),cdr(c)] in trans_reflCl(b0,vertices)) & Stat6: ([car(c),cdr(c)] notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		TlabeledGraph3(*) ==> Stat7: (FORALL r, x, y, v | (Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & ([x,y] in trans_reflCl(r + inv(r),v))) imp SameTag_thryvar(x,y))
		(b0,b0 + inv(b0),vertices,vertices)-->T927(Stat4*) ==> [car(c),cdr(c)] in trans_reflCl(b0 + inv(b0),vertices)
		(b0,{[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})-->T52(Stat3,Stat3) ==> Is_map(b0)
		Suppose ==> Stat8: not(FORALL e in b0 | SameTag_thryvar(car(e),cdr(e)))
			e-->Stat8(Stat3*) ==> Stat9: (e in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & (not SameTag_thryvar(car(e),cdr(e)))
			(v,w)-->Stat9(Stat9*) ==> Stat10: (e = [v,w]) & SameTag_thryvar(v,w)
			(Stat10)ELEM ==> (v = car(e)) & (w = cdr(e))
		EQUAL(Stat9) ==> false; Discharge ==> (FORALL e in b0 | SameTag_thryvar(car(e),cdr(e)))
		(b0,car(c),cdr(c),vertices)-->Stat7(Stat7*) ==> Stat11: SameTag_thryvar(car(c),cdr(c))
		(b0,vertices)-->T924(Stat5*) ==> [car(c),cdr(c)] in (vertices PROD vertices)
		({[car(c),cdr(c)]},vertices,vertices)-->T141(Stat11*) ==> (domain({[car(c),cdr(c)]}) incin vertices) & (range({[car(c),cdr(c)]}) incin vertices)
		(car(c),cdr(c))-->T114(Stat11*) ==> (car(c) in vertices) & (cdr(c) in vertices)
	(car(c),cdr(c))-->Stat6(Stat11*) ==> false; Discharge ==> (edges @ inv(trans_reflCl(b0,vertices))) /= (inv(trans_reflCl(b0,vertices)) @ edges)
	Use_def(trans_reflCl) ==> (edges @ inv(transCl(on(b0,vertices)) + ident(vertices))) /= (inv(transCl(on(b0,vertices)) + ident(vertices)) @ edges)
	Use_def(transCl) ==> Stat12: (edges @ inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices))) /= (inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges)
	Suppose ==> Stat13: ({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) /= ({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices))
		Set_monot(Stat13) ==> {[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} incs {[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}
		a-->Stat13(Stat13*) ==> Stat14: (a in {[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))}) & (a notin ({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices)))
		(q1,u1,v1)-->Stat14(Stat14*) ==> Stat15: (q1 incin on(b0,vertices)) & (u1 in domain(q1)) & (v1 in range(q1)) & (((u1 = v1) & Scycle(q1)) or ((u1 /= v1) & Straight(q1,u1,v1))) & ([u1,v1] notin ident(vertices)) & Stat16: ([u1,v1] notin {[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)})
		(q1,u1,v1)-->Stat16(Stat15*) ==> (u1 = v1) & Scycle(q1) & ([u1,v1] notin ident(vertices))
		Use_def(on)(Stat15*) ==> q1 incin (vertices PROD vertices)
		(q1,vertices,vertices)-->T141(Stat15*) ==> Stat17: (u1 = v1) & (u1 in vertices)
		Use_def(ident)(Stat15*) ==> Stat18: [u1,v1] notin {[x,x]: x in vertices}
	u1-->Stat18(Stat17) ==> false; Discharge ==> ({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) = ({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices))
	EQUAL(Stat12) ==> Stat19: (edges @ inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices))) /= (inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices)) @ edges)
	Suppose ==> Stat20: inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices)) /= inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) + ident(vertices)
		({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)},ident(vertices))-->T106 ==> AUTO
		EQUAL(Stat20) ==> inv(Un({{[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)},ident(vertices)})) = inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices))
		({{[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)},ident(vertices)})-->T110(Stat20*) ==> inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices)) = Un({inv(f): f in {{[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)},ident(vertices)}})
		APPLY() unionset_commuter(e(f)->inv(f),s->{[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) ==>
			Stat21: (FORALL t | {inv(f): f in {{[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)},t}} = {inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}),inv(t)})
		(ident(vertices))-->Stat21(Stat21*) ==> {inv(f): f in {{[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)},ident(vertices)}} = {inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}),inv(ident(vertices))}
		vertices-->T115(Stat20*) ==> inv(ident(vertices)) = ident(vertices)
		(inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}),ident(vertices))-->T106 ==> AUTO
	EQUAL(Stat20) ==> false; Discharge ==> inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)} + ident(vertices)) = inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) + ident(vertices)
	(edges,inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}),ident(vertices))-->T137 ==> AUTO
	(inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}),ident(vertices),edges)-->T136 ==> AUTO
	Assump ==> Stat22: edges incin (vertices PROD vertices)
	(edges,vertices,vertices)-->T141(Stat22*) ==> Is_map(edges) & (domain(edges) incin vertices) & (range(edges) incin vertices)
	(vertices,0,edges)-->T115(Stat22*) ==> ((edges @ ident(vertices)) = edges) & ((ident(vertices) @ edges)= edges)
--??	EQUAL(Stat19) ==> Stat23: (edges @ inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)})) /= (inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) @ edges)
	EQUAL(Stat19) ==> Stat24: ((edges @ inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)})) + edges) /= ((inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) @ edges) + edges)
	(Stat24*)ELEM ==> Stat23: (edges @ inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)})) /= (inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) @ edges)
	d-->Stat23(Stat23*) ==> (d in (edges @ inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}))) neq (d in (inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) @ edges))
	Suppose ==> Stat25: (d in (edges @ inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}))) & (d notin (inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) @ edges))
		Use_def(@)(Stat25*) ==> Stat26: (d in {[car(x),cdr(y)]: x in inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}), y in edges | cdr(x) = car(y)}) & Stat27: (d notin {[car(x),cdr(y)]: x in edges, y in inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) | cdr(x) = car(y)})
		(x0,y0)-->Stat26(Stat26*) ==> (d = [car(x0),cdr(y0)]) & (x0 in inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)})) & (y0 in edges)
	Tsomehow ==> false; Discharge ==> Stat28: (d in (inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)}) @ edges)) & (d notin (edges @ inv({[u,v]: q incin on(b0,vertices), u in domain(q), v in range(q) | (u /= v) & Straight(q,u,v)})))
Tsomehow ==> false; Discharge ==> QED
--
Theorem labeledGraph9: (B in bisim_thryvar) imp (trans_reflCl(B + inv(B), vertices) in bisim_thryvar). Proof:
Suppose_not(b0) ==> AUTO
	Use_def(bisim_thryvar) ==> Stat1: (b0 in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) &
		Stat2: (trans_reflCl(b0 + inv(b0),vertices) notin {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
	()-->Stat1(Stat1*) ==> Stat3: (b0 incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(b0)) = (inv(b0) @ edges)) & ((edges @ b0) = (b0 @ edges))
	(trans_reflCl(b0 + inv(b0),vertices))-->Stat2(Stat1,Stat1*) ==> (not(trans_reflCl(b0 + inv(b0),vertices) incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})) or (not(((edges @ inv(trans_reflCl(b0 + inv(b0),vertices))) = (inv(trans_reflCl(b0 + inv(b0),vertices)) @ edges)) & ((edges @ (trans_reflCl(b0 + inv(b0),vertices))) = ((trans_reflCl(b0 + inv(b0),vertices)) @ edges))))
	Suppose ==> Stat4: not(trans_reflCl(b0 + inv(b0),vertices) incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		c-->Stat4(Stat4*) ==> (c in trans_reflCl(b0 + inv(b0),vertices)) & (c notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		(b0 + inv(b0),vertices)-->T924(Stat4*) ==> Is_map(trans_reflCl(b0 + inv(b0),vertices))
		(trans_reflCl(b0 + inv(b0),vertices),c)-->T51(Stat4*) ==> (c = [car(c),cdr(c)])
		EQUAL(Stat4) ==> Stat5: ([car(c),cdr(c)] in trans_reflCl(b0 + inv(b0),vertices)) & Stat6: ([car(c),cdr(c)] notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		TlabeledGraph3(*) ==> Stat7: (FORALL r, x, y, v | (Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & ([x,y] in trans_reflCl(r + inv(r),v))) imp SameTag_thryvar(x,y))
		(b0,b0 + inv(b0),vertices,vertices)-->T927(Stat4*) ==> [car(c),cdr(c)] in trans_reflCl(b0 + inv(b0),vertices)
		(b0,{[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})-->T52(Stat3,Stat3) ==> Is_map(b0)
		Suppose ==> Stat8: not(FORALL e in b0 | SameTag_thryvar(car(e),cdr(e)))
			e-->Stat8(Stat3*) ==> Stat9: (e in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & (not SameTag_thryvar(car(e),cdr(e)))
			(v,w)-->Stat9(Stat9*) ==> Stat10: (e = [v,w]) & SameTag_thryvar(v,w)
			(Stat10)ELEM ==> (v = car(e)) & (w = cdr(e))
		EQUAL(Stat9) ==> false; Discharge ==> (FORALL e in b0 | SameTag_thryvar(car(e),cdr(e)))
		(b0,car(c),cdr(c),vertices)-->Stat7(Stat7*) ==> Stat11: SameTag_thryvar(car(c),cdr(c))
		(b0 + inv(b0),vertices)-->T924(Stat5*) ==> [car(c),cdr(c)] in (vertices PROD vertices)
		({[car(c),cdr(c)]},vertices,vertices)-->T141(Stat11*) ==> (domain({[car(c),cdr(c)]}) incin vertices) & (range({[car(c),cdr(c)]}) incin vertices)
		(car(c),cdr(c))-->T114(Stat11*) ==> (car(c) in vertices) & (cdr(c) in vertices)
	(car(c),cdr(c))-->Stat6(Stat11*) ==> false; Discharge ==> not(((edges @ inv(trans_reflCl(b0 + inv(b0),vertices))) = (inv(trans_reflCl(b0 + inv(b0),vertices)) @ edges)) & ((edges @ (trans_reflCl(b0 + inv(b0),vertices))) = ((trans_reflCl(b0 + inv(b0),vertices)) @ edges)))
	Use_def(trans_reflCl) ==> not(((edges @ inv(transCl(on(b0 + inv(b0),vertices)) + ident(vertices))) = (inv(transCl(on(b0 + inv(b0),vertices)) + ident(vertices)) @ edges)) & ((edges @ (transCl(on(b0 + inv(b0),vertices)) + ident(vertices))) = ((transCl(on(b0 + inv(b0),vertices)) + ident(vertices)) @ edges)))
	Use_def(transCl) ==> Stat12: ((edges @ inv({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices))) /= (inv({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges)) or
		((edges @ ({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices))) /= (({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges))
	Suppose ==> Stat13: (edges @ inv({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices))) /= (inv({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges)
		d-->Stat13(Stat13*) ==> (d in (edges @ inv({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)))) neq (d in (inv({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges))
		Suppose ==> Stat14: (d in (edges @ inv({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)))) & (d notin (inv({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges))
			Use_def(@)(Stat14*) ==> Stat15: (d in {[car(x),cdr(y)]: x in inv({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)), y in edges | cdr(x) = car(y)}) & Stat16: (d notin {[car(x),cdr(y)]: x in edges, y in inv({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) | cdr(x) = car(y)})
		Tsomehow ==> false; Discharge ==> Stat17: (d in (inv({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges)) & (d notin (edges @ inv({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices))))
	Tsomehow ==> false; Discharge ==> Stat18: (edges @ ({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices))) /= (({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges)
	d1-->Stat18(Stat18*) ==> (d1 in (edges @ ({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)))) neq (d1 in (({[u,v]: q incin on(b0 + inv(b0),vertices), u in domain(q), v in range(q) | ((u = v) & Scycle(q)) or ((u /= v) & Straight(q,u,v))} + ident(vertices)) @ edges))
Tsomehow ==> false; Discharge ==> QED
--
Theorem labeledGraph10: ((R in sim_thryvar) & (S in sim_thryvar)) imp ((R + S) in sim_thryvar). Proof:
Suppose_not(r,t) ==> AUTO
	Use_def(sim_thryvar) ==> Stat1: (r in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) }) &
		Stat2: (t in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) }) &
		Stat3: ((r + t) notin {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) })
	()-->Stat1(Stat1*) ==> Stat4: (r incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(r)) = (inv(r) @ edges))
	()-->Stat2(Stat1*) ==> Stat5: (t incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(t)) = (inv(t) @ edges))
	()-->Stat3(Stat1*) ==> Stat6: ((edges @ inv(r + t)) /= (inv(r + t) @ edges))
	({r,t})-->T110(Stat6*) ==> inv(Un({r,t})) = Un({inv(f): f in {r,t}})
	APPLY() unionset_commuter(e(x)->inv(x),s->r) ==>
		Stat7: (FORALL t | {inv(f): f in {r,t}} = {inv(r),inv(t)})
	t-->Stat7 ==> {inv(f): f in {r,t}} = {inv(r),inv(t)}
	(r,t)-->T106(Stat6*) ==> Un({r,t}) = (r + t)
	(inv(r),inv(t))-->T106(Stat6*) ==> Un({inv(r),inv(t)}) = (inv(r) + inv(t))
	EQUAL(Stat6) ==> Stat8: inv(r + t) = (inv(r) + inv(t))
	(edges,inv(r),inv(t))-->T137(Stat6*) ==> Stat9: (edges @ (inv(r) + inv(t))) = ((edges @ inv(r)) + (edges @ inv(t)))
	(inv(r),inv(t),edges)-->T136(Stat6*) ==> Stat10: ((inv(r) + inv(t)) @ edges) = ((inv(r) @ edges) + (inv(t) @ edges))
EQUAL(Stat9,Stat10,Stat4,Stat5,Stat8,Stat6*) ==> false; Discharge ==> QED
--
Theorem labeledGraph11: ((R in bisim_thryvar) & (S in bisim_thryvar)) imp ((R + S) in bisim_thryvar). Proof:
Suppose_not(r,t) ==> AUTO
	Use_def(bisim_thryvar) ==> Stat1: (r in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) &
		Stat2: (t in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) &
		Stat3: ((r + t) notin {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
	()-->Stat1(Stat1*) ==> Stat4: (r incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(r)) = (inv(r) @ edges)) & ((edges @ r) = (r @ edges))
	()-->Stat2(Stat1*) ==> Stat5: (t incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(t)) = (inv(t) @ edges)) & ((edges @ t) = (t @ edges))
	()-->Stat3(Stat1*) ==> ((edges @ inv(r + t)) /= (inv(r + t) @ edges)) or ((edges @ (r + t)) /= ((r + t) @ edges))
	Suppose ==> Stat6: (edges @ inv(r + t)) /= (inv(r + t) @ edges)
		({r,t})-->T110(Stat6*) ==> inv(Un({r,t})) = Un({inv(f): f in {r,t}})
		APPLY() unionset_commuter(e(x)->inv(x),s->r) ==>
			Stat7: (FORALL t | {inv(f): f in {r,t}} = {inv(r),inv(t)})
		t-->Stat7 ==> {inv(f): f in {r,t}} = {inv(r),inv(t)}
		(r,t)-->T106(Stat6*) ==> Un({r,t}) = (r + t)
		(inv(r),inv(t))-->T106(Stat6*) ==> Un({inv(r),inv(t)}) = (inv(r) + inv(t))
		EQUAL(Stat6) ==> Stat8: inv(r + t) = (inv(r) + inv(t))
		(edges,inv(r),inv(t))-->T137(Stat6*) ==> Stat9: (edges @ (inv(r) + inv(t))) = ((edges @ inv(r)) + (edges @ inv(t)))
		(inv(r),inv(t),edges)-->T136(Stat6*) ==> Stat10: ((inv(r) + inv(t)) @ edges) = ((inv(r) @ edges) + (inv(t) @ edges))
	EQUAL(Stat9,Stat10,Stat4,Stat5,Stat8,Stat6*) ==> false; Discharge ==> Stat11: (edges @ (r + t)) /= ((r + t) @ edges)
	(edges,r,t)-->T137(Stat11*) ==> Stat12: (edges @ (r + t)) = ((edges @ r) + (edges @ t))
	(r,t,edges)-->T136(Stat11*) ==> Stat13: ((r + t) @ edges) = ((r @ edges) + (t @ edges))
EQUAL(Stat12,Stat13,Stat4,Stat5,Stat11*) ==> false; Discharge ==> QED
--
Theorem labeledGraph12: (R in bisim_thryvar) imp (inv(R) in bisim_thryvar). Proof:
Suppose_not(r) ==> AUTO
	Use_def(bisim_thryvar) ==> Stat1: (r in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) &
		Stat2: (inv(r) notin {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
	()-->Stat1(Stat1*) ==> Stat3: (r incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(r)) = (inv(r) @ edges)) & ((edges @ r) = (r @ edges))
	()-->Stat2(Stat1*) ==> (not(inv(r) incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})) or ((edges @ inv(inv(r))) /= (inv(inv(r)) @ edges))
	Suppose ==> Stat4: (edges @ inv(inv(r))) /= (inv(inv(r)) @ edges)
		TELEM ==> Is_map({[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		(r,{[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})-->T52(Stat3*) ==> Is_map(r)
		r-->T100(Stat4*) ==> inv(inv(r)) = r
	EQUAL(Stat3*) ==> false; Discharge ==> Stat5: not(inv(r) incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
	p-->Stat5(Stat5*) ==> Stat6: (p in inv(r)) & Stat7: (p notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
	Use_def(inv)(Stat5*) ==> Stat8: p in {[cdr(x),car(x)]: x in r}
	x1-->Stat8(Stat8,Stat3*) ==> Stat9: (x1 in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & (p = [cdr(x1),car(x1)])
	(v1,w1)-->Stat9(Stat9*) ==> (x1 = [v1,w1]) & (v1 in vertices) & (w1 in vertices) & SameTag_thryvar(v1,w1)
	(Stat9*)ELEM ==> Stat10: (p = [cdr(x1),car(x1)]) & (x1 = [v1,w1])
	(Stat10)ELEM ==> p = [w1,v1]
	TlabeledGraph3(Stat10*) ==> Stat11: (FORALL v, w | SameTag_thryvar(v,w) eq (block_thryvar(v) = block_thryvar(w)))
	(v1,w1)-->Stat11(Stat9*) ==> block_thryvar(v1) = block_thryvar(w1)
	(w1,v1)-->Stat11(Stat9*) ==> SameTag_thryvar(w1,v1)
(w1,v1)-->Stat7(Stat9*) ==> false; Discharge ==> QED
--
Theorem labeledGraph13: Transitive(bisimilar_thryvar) & Symmetric(bisimilar_thryvar) & Reflexive(bisimilar_thryvar,vertices). Proof:
Suppose_not ==> AUTO
	Suppose ==> not(Transitive(bisimilar_thryvar))
--
-- To see that $bisimilar_thryvar$ is a transitive relation,
-- we argue as follows. If it were not, then there would exist
-- bisimulations $b3$, $b4$ and pairs $x1=[v,xy],y1=[xy,w]$
-- of vertices with $x1 in b3$, $y1 in b4$ such that the pair
-- $r=[v,w]$ belongs to no bisimulations. It is easily
-- recognized that $v /= xy$ and $w /= xy$.
--
 		Use_def(Transitive) ==> Stat1: not((bisimilar_thryvar @ bisimilar_thryvar) incin bisimilar_thryvar)
		r-->Stat1(Stat1*) ==> Stat2: (r in (bisimilar_thryvar @ bisimilar_thryvar)) & (r notin bisimilar_thryvar)
		Use_def(bisimilar_thryvar)(Stat2*) ==> Stat3: (r in (Un(bisim_thryvar) @ Un(bisim_thryvar))) & (r notin Un(bisim_thryvar))
		Use_def(@) ==> Stat4: r in {[car(x),cdr(y)]: x in Un(bisim_thryvar), y in Un(bisim_thryvar) | cdr(x) = car(y)}
		(x1,y1)-->Stat4(Stat4*) ==> Stat5: (r = [car(x1),cdr(y1)]) & (x1 in Un(bisim_thryvar)) & (y1 in Un(bisim_thryvar)) & (cdr(x1) = car(y1))
		Use_def(Un)(Stat3*) ==> Stat6: ([car(x1),cdr(y1)] notin {p: b in bisim_thryvar, p in b}) & Stat7: (x1 in {p: b in bisim_thryvar, p in b}) & Stat8: (y1 in {p: b in bisim_thryvar, p in b})
		(b3,p3)-->Stat7(Stat6*) ==> Stat9: (x1 in b3) & (b3 in bisim_thryvar)
		(b4,p4)-->Stat8(Stat6*) ==> Stat10: (y1 in b4) & (b4 in bisim_thryvar)
		b3-->TlabeledGraph4(Stat9,Stat9*) ==> Stat11: x1 in (vertices PROD vertices)
		b4-->TlabeledGraph4(Stat10,Stat10*) ==> y1 in (vertices PROD vertices)
		({x1,y1},vertices,vertices)-->T141(Stat11*) ==> Is_map({x1,y1}) & (domain({x1,y1}) incin vertices) & (range({x1,y1}) incin vertices)
		({x1,y1},x1)-->T51(Stat11*) ==> Stat12: x1 = [car(x1),cdr(x1)]
		({x1,y1},y1)-->T51(Stat11*) ==> Stat13: y1 = [car(y1),cdr(y1)]
		Suppose ==> car(y1) = cdr(y1)
			EQUAL(Stat4*) ==> Stat14: x1 notin {p: b in bisim_thryvar, p in b}
		(b3,x1)-->Stat14(Stat9*) ==> false; Discharge ==> Stat15: car(y1) /= cdr(y1)
		Suppose ==> car(x1) = cdr(x1)
			EQUAL(Stat4*) ==> Stat16: y1 notin {p: b in bisim_thryvar, p in b}
		(b4,y1)-->Stat16(Stat10*) ==> false; Discharge ==> Stat17: car(x1) /= cdr(x1)
--
-- Then, since the transitive-reflexive closure of $b3+b4$ is a bisimulation,
-- the pair $r = [car(x1),cdr(y1)]$ does not belong to such set.
--
		(b3,b4)-->TlabeledGraph11(Stat6*) ==> (b3 + b4) in bisim_thryvar
		(b3 + b4)-->TlabeledGraph9(Stat6*) ==> Stat18: trans_reflCl((b3 + b4) + inv(b3 + b4), vertices) in bisim_thryvar
		(trans_reflCl((b3 + b4) + inv(b3 + b4), vertices),[car(x1),cdr(y1)])-->Stat6(Stat6,Stat18*) ==> [car(x1),cdr(y1)] notin (trans_reflCl((b3 + b4) + inv(b3 + b4), vertices))
		Use_def(trans_reflCl)(Stat18*) ==> [car(x1),cdr(y1)] notin (transCl(on((b3 + b4) + inv(b3 + b4),vertices)) + ident(vertices))
		Use_def(transCl)(Stat18*) ==> Stat19: ([car(x1),cdr(y1)] notin {[x,y]: q incin on((b3 + b4) + inv(b3 + b4),vertices), x in domain(q), y in range(q) | ((x = y) & Scycle(q)) or ((x /= y) & Straight(q,x,y))}) & ([car(x1),cdr(y1)] notin ident(vertices))
--
-- This implies, since $car(x1) in vertices$ and $cdr(y1) in vertices$,
-- that ${x1,y1}$ is neither a cycle nor a straight path leading from
-- $car(x1)$ to $cdr(y1)$. In brief, this path is not acyclic.
--
		Suppose ==> Stat20: car(x1) = cdr(y1)
			EQUAL(Stat20,Stat19) ==> [car(x1),car(x1)] notin ident(vertices)
			Use_def(ident)(Stat20*) ==> Stat21: [car(x1),car(x1)] notin {[x,x]: x in vertices}
			Suppose ==> Stat22: car(x1) notin domain({x1,y1})
				Use_def(domain)(Stat22*) ==> Stat23: car(x1) notin {car(x): x in {x1,y1}}
			x1-->Stat23(Stat23*) ==> false; Discharge ==> car(x1) in vertices
		(car(x1))-->Stat21(Stat21*) ==> false; Discharge ==> Stat24: car(x1) /= cdr(y1)
--
		({x1,y1},car(x1),cdr(y1))-->Stat19(Stat19*) ==> Stat25: (not({x1,y1} incin on((b3 + b4) + inv(b3 + b4),vertices))) or (car(x1) notin domain({x1,y1})) or (cdr(y1) notin range({x1,y1})) or (not(((car(x1) = cdr(y1)) & Scycle({x1,y1})) or ((car(x1) /= cdr(y1)) & Straight({x1,y1},car(x1),cdr(y1)))))
		Suppose ==> car(x1) notin domain({x1,y1})
			Use_def(domain)(Stat19*) ==> Stat26: car(x1) notin {car(x): x in {x1,y1}}
		x1-->Stat26(Stat26*) ==> false; Discharge ==> car(x1) in domain({x1,y1})
		Suppose ==> cdr(y1) notin range({x1,y1})
			Use_def(range)(Stat19*) ==> Stat27: cdr(y1) notin {cdr(x): x in {x1,y1}}
		y1-->Stat27(Stat27*) ==> false; Discharge ==> cdr(y1) in range({x1,y1})
		Suppose ==> Stat28: not({x1,y1} incin on((b3 + b4) + inv(b3 + b4),vertices))
			z-->Stat28(Stat28*) ==> (z in {x1,y1}) & (z notin on((b3 + b4) + inv(b3 + b4),vertices))
			Use_def(on)(Stat28*) ==> (z notin (b3 + b4) + inv(b3 + b4)) or (z notin (vertices PROD vertices))
			(Stat6*)ELEM ==> z notin (vertices PROD vertices)
			b3-->TlabeledGraph4(Stat9,Stat9*) ==> x1 in (vertices PROD vertices)
		b4-->TlabeledGraph4(Stat10*) ==> false; Discharge ==> {x1,y1} incin on((b3 + b4) + inv(b3 + b4),vertices)
		(Stat24*)ELEM ==> Stat29: (not Straight({x1,y1},car(x1),cdr(y1)))
--
-- However, the acyclicity of the said path follows readily from Theorem 911,
-- which leads to a contradiction proving that $bisimilar_thryvar$ is a
-- transitive relation. We are then left with the tasks of showing that
-- $bisimilar_thryvar$ is also symmetric and reflexive.
--
		EQUAL(Stat13,Stat12,Stat5,Stat29) ==> (not(Straight({[car(x1),cdr(x1)],[cdr(x1),cdr(y1)]},car(x1),cdr(y1))))
		(car(x1),cdr(x1),cdr(y1))-->T913(Stat25*) ==> Stat30: (not Acyclic({[car(x1),cdr(x1)],[cdr(x1),cdr(y1)]}))
--		Suppose ==> Stat20: car(x1) = cdr(y1)
--			EQUAL(Stat20,Stat19) ==> [car(x1),car(x1)] notin ident(vertices)
--			Use_def(ident)(Stat20*) ==> Stat21: [car(x1),car(x1)] notin {[x,x]: x in vertices}
--			Suppose ==> Stat22: car(x1) notin domain({x1,y1})
--				Use_def(domain)(Stat22*) ==> Stat23: car(x1) notin {car(x): x in {x1,y1}}
--			x1-->Stat23(Stat23*) ==> false; Discharge ==> car(x1) in vertices
--		(car(x1))-->Stat21(Stat21*) ==> false; Discharge ==> Stat24: car(x1) /= cdr(y1)
	(car(x1),cdr(x1),cdr(y1))-->T911(Stat15,Stat17,Stat5,Stat24,Stat30*) ==> false; Discharge ==> not(Symmetric(bisimilar_thryvar) & Reflexive(bisimilar_thryvar,vertices))
	Suppose ==> Stat31: not(Symmetric(bisimilar_thryvar))
		Use_def(Symmetric)(Stat31*) ==> Stat32: not(inv(bisimilar_thryvar) incin bisimilar_thryvar)
		s-->Stat32(Stat32*) ==> Stat33: (s in inv(bisimilar_thryvar)) & (s notin bisimilar_thryvar)
		Use_def(bisimilar_thryvar)(Stat33*) ==> Stat34: (s in inv(Un(bisim_thryvar))) & (s notin Un(bisim_thryvar))
		Use_def(bisim_thryvar)(Stat34*) ==> Stat35: (s in inv(Un({b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }))) &
			Stat36: (s notin Un({b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }))
		Suppose ==> inv(Un({b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })) = Un({b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
		EQUAL(Stat35*) ==> false; Discharge ==> Stat37: inv(Un({b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })) /= Un({b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
		({b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })-->T110(Stat37*) ==> Stat38: Un({inv(b): b in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }}) /= Un({b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
		Suppose ==> {inv(b): b in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }} = {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
		EQUAL(Stat38) ==> false; Discharge ==> Stat39: {inv(b): b in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }} /= {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
		b1-->Stat39(Stat39*) ==> (b1 in {inv(b): b in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }}) eq (b1 notin {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
		SIMPLF ==> (b1 in {inv(b): b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) eq (b1 notin {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
		TELEM ==> Stat40: Is_map({[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		TlabeledGraph3(Stat40,Stat40*) ==> Stat41: (FORALL v, w | SameTag_thryvar(v,w) eq (block_thryvar(v) = block_thryvar(w)))
		Suppose ==> Stat42: (b1 in {inv(b): b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) & Stat43: (b1 notin {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
			b2-->Stat42(Stat42*) ==> Stat44: (b1 = inv(b2)) & (b2 incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(b2)) = (inv(b2) @ edges)) & ((edges @ b2) = (b2 @ edges))
			(b2,{[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})-->T52(Stat40,Stat44*) ==> Is_map(b2)
			b2-->T100(Stat44*) ==> inv(inv(b2)) = b2
			()-->Stat43(Stat42*) ==> (not(b1 incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})) or ((edges @ inv(b1)) /= (inv(b1) @ edges)) or ((edges @ b1) /= (b1 @ edges))
			Suppose ==> (edges @ inv(b1)) /= (inv(b1) @ edges)
			EQUAL(Stat42*) ==> false; Discharge ==> (edges @ inv(b1)) = (inv(b1) @ edges)
			Suppose ==> (edges @ b1) /= (b1 @ edges)
			EQUAL(Stat42*) ==> false; Discharge ==> (edges @ b1) = (b1 @ edges)
			(Stat42*)ELEM ==> Stat45: not(b1 incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
			p-->Stat45(Stat45*) ==> Stat46: (p in b1) & Stat47: (p notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
			Use_def(inv)(Stat44,Stat46*) ==> Stat48: p in {[cdr(x),car(x)]: x in b2}
			xp-->Stat48(Stat44*) ==> Stat49: (p = [cdr(xp),car(xp)]) & Stat50: (xp in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
			(v1,w1)-->Stat50(Stat49*) ==> (xp = [v1,w1]) & (v1 in vertices) & (w1 in vertices) & SameTag_thryvar(v1,w1)
			(Stat49*)ELEM ==> Stat51: (p = [cdr(xp),car(xp)]) & (xp = [v1,w1])
			(Stat51)ELEM ==> p = [w1,v1]
			(w1,v1)-->Stat47(Stat46*) ==> not(SameTag_thryvar(w1,v1))
			(w1,v1)-->Stat41(Stat49*) ==> block_thryvar(v1) /= block_thryvar(w1)
		(v1,w1)-->Stat41(Stat49*) ==> false; Discharge ==> Stat52: (b1 in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }) & Stat53: (b1 notin {inv(b): b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) })
		()-->Stat52(Stat52*) ==> Stat54: (b1 incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}) & ((edges @ inv(b1)) = (inv(b1) @ edges)) & ((edges @ b1) = (b1 @ edges))
		(b1,{[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})-->T52(Stat40,Stat54*) ==> Is_map(b1)
		b1-->T100(Stat54*) ==> inv(inv(b1)) = b1
		(inv(b1))-->Stat53(Stat52*) ==> (not(inv(b1) incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})) or ((edges @ inv(inv(b1))) /= (inv(inv(b1)) @ edges))
		Suppose ==> (edges @ inv(inv(b1))) /= (inv(inv(b1)) @ edges)
		EQUAL(Stat54*) ==> false; Discharge ==> Stat55: not(inv(b1) incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		q-->Stat55(Stat55*) ==> Stat56: (q in inv(b1)) & Stat57: (q notin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		Use_def(inv)(Stat56*) ==> Stat58: q in {[cdr(x),car(x)]: x in b1}
		x2-->Stat58(Stat54*) ==> Stat59: (q = [cdr(x2),car(x2)]) & Stat60: (x2 in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)})
		(v2,w2)-->Stat60(Stat59*) ==> (x2 = [v2,w2]) & (v2 in vertices) & (w2 in vertices) & SameTag_thryvar(v2,w2)
		(Stat59*)ELEM ==> Stat61: (q = [cdr(x2),car(x2)]) & (x2 = [v2,w2])
		(Stat61)ELEM ==> q = [w2,v2]
		(w2,v2)-->Stat57(Stat56*) ==> not(SameTag_thryvar(w2,v2))
		(w2,v2)-->Stat41(Stat59*) ==> block_thryvar(v2) /= block_thryvar(w2)
	(v2,w2)-->Stat41(Stat59*) ==> false; Discharge ==> Stat62: not(Reflexive(bisimilar_thryvar,vertices))
	Use_def(Reflexive)(Stat62*) ==> Stat63: not(bisimilar_thryvar incs ident(vertices))
	t-->Stat63(Stat63*) ==> Stat64: (t in ident(vertices)) & (t notin bisimilar_thryvar)
	Use_def(ident)(Stat64*) ==> Stat65: t in {[x,x]: x in vertices}
	x0-->Stat65(Stat65*) ==> Stat66: (x0 in vertices) & (t = [x0,x0])
	TlabeledGraph4(Stat65*) ==> 0 in bisim_thryvar
	0-->TlabeledGraph9(Stat65*) ==> trans_reflCl(0 + inv(0), vertices) in bisim_thryvar
	Use_def(trans_reflCl)(Stat66*) ==> ident(vertices) incin trans_reflCl(0 + inv(0), vertices)
	bisim_thryvar-->T274(Stat65*) ==> Stat67: (FORALL x in bisim_thryvar | x incin Un(bisim_thryvar))
	(trans_reflCl(0 + inv(0),vertices))-->Stat67(Stat64*) ==> Stat68: [x0,x0] in Un(bisim_thryvar)
Use_def(bisimilar_thryvar)(Stat64,Stat66,Stat68*) ==> false; Discharge ==> QED
--
Theorem labeledGraph14: Transitive(similar_thryvar) & Symmetric(similar_thryvar) & Reflexive(similar_thryvar,vertices). Proof:
Suppose_not ==> AUTO
	Suppose ==> not(Transitive(similar_thryvar))
--
-- To see that $similar_thryvar$ is a transitive relation,
-- we argue as follows. If it were not, then there would exist
-- bisimulations $b3$, $b4$ and pairs $x1=[v,xy],y1=[xy,w]$
-- of vertices with $x0 in b3$, $y0 in b4$ such that the pair
-- $r=[v,w]$ belongs to no simulations. It is easily
-- recognized that $v /= xy$ and $w /= xy$.
--
		Use_def(Transitive) ==> Stat1: not((similar_thryvar @ similar_thryvar) incin similar_thryvar)
		r-->Stat1(Stat1*) ==> Stat2: (r in (similar_thryvar @ similar_thryvar)) & (r notin similar_thryvar)
		Use_def(similar_thryvar)(Stat2*) ==> Stat3: (r in ((Un(sim_thryvar) * inv(Un(sim_thryvar))) @ (Un(sim_thryvar) * inv(Un(sim_thryvar))))) & (r notin (Un(sim_thryvar) * inv(Un(sim_thryvar))))
		Use_def(@) ==> Stat4: r in {[car(x),cdr(y)]: x in (Un(sim_thryvar) * inv(Un(sim_thryvar))), y in (Un(sim_thryvar) * inv(Un(sim_thryvar))) | cdr(x) = car(y)}
		(x0,y0)-->Stat4(Stat4*) ==> Stat5: (r = [car(x0),cdr(y0)]) & (x0 in (Un(sim_thryvar) * inv(Un(sim_thryvar)))) & (y0 in (Un(sim_thryvar) * inv(Un(sim_thryvar)))) & (cdr(x0) = car(y0))
		Use_def(Un)(Stat3*) ==> Stat6: ([car(x0),cdr(y0)] notin ({p: b in sim_thryvar, p in b} * inv({p: b in sim_thryvar, p in b}))) & Stat7: (x0 in ({p: b in sim_thryvar, p in b} * inv({p: b in sim_thryvar, p in b}))) & Stat8: (y0 in ({p: b in sim_thryvar, p in b} * inv({p: b in sim_thryvar, p in b})))
	Tsomehow ==> false; Discharge ==> not(Symmetric(similar_thryvar) & Reflexive(similar_thryvar,vertices))
	Suppose ==> Stat9: not(Symmetric(similar_thryvar))
		Use_def(Symmetric)(Stat9*) ==> Stat10: not(inv(similar_thryvar) incin similar_thryvar)
		s-->Stat10(Stat10*) ==> Stat11: (s in inv(similar_thryvar)) & (s notin similar_thryvar)
		Use_def(inv)(Stat11*) ==> s in {[cdr(p),car(p)]: p in similar_thryvar}
		Use_def(similar_thryvar)(Stat11*) ==> Stat12: (s in {[cdr(p),car(p)]: p in (Un(sim_thryvar) * inv(Un(sim_thryvar)))}) & (s notin (Un(sim_thryvar) * inv(Un(sim_thryvar))))
		p-->Stat12(Stat12*) ==> (p in (Un(sim_thryvar) * inv(Un(sim_thryvar)))) & ([cdr(p),car(p)] notin (Un(sim_thryvar) * inv(Un(sim_thryvar))))
		sim_thryvar-->T110(Stat12*) ==> (p in (Un(sim_thryvar) * Un({inv(f): f in sim_thryvar}))) & ([cdr(p),car(p)] notin (Un(sim_thryvar) * Un({inv(f): f in sim_thryvar})))
		Use_def(Un)(Stat12*) ==> Stat13: (p in {x: y in sim_thryvar, x in y}) & (p in {x: y in {inv(f): f in sim_thryvar}, x in y}) & (([cdr(p),car(p)] notin {x: y in sim_thryvar, x in y}) or ([cdr(p),car(p)] notin {x: y in {inv(f): f in sim_thryvar}, x in y}))
		(r1,x1,t,x2)-->Stat13(Stat13*) ==> Stat14: (r1 in sim_thryvar) & (p in r1) & (p in t) & Stat15: (t in {inv(f): f in sim_thryvar})
		Suppose ==> Stat16: [cdr(p),car(p)] notin {x: y in sim_thryvar, x in y}
			r2-->Stat15(Stat14*) ==> Stat17: (r2 in sim_thryvar) & (t = inv(r2))
			Use_def(inv)(Stat14*) ==> Stat18: p in {[cdr(q),car(q)]: q in r2}
			q-->Stat18(Stat18) ==> ([cdr(p),car(p)] = [car(q),cdr(q)]) & (q in r2)
			Use_def(sim_thryvar)(Stat14*) ==> Stat19: r2 in {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) }
			()-->Stat19(Stat14*) ==> Stat20: q in {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)}
			(v,w)-->Stat20(Stat20) ==> q = [car(q),cdr(q)]
		(r2,q)-->Stat16(Stat17*) ==> false; Discharge ==> [cdr(p),car(p)] in {x: y in sim_thryvar, x in y}
		(Stat13*)ELEM ==> Stat21: [cdr(p),car(p)] notin {x: y in {inv(f): f in sim_thryvar}, x in y}
		SIMPLF(Stat21*) ==> Stat22: [cdr(p),car(p)] notin {x: f in sim_thryvar, x in inv(f)}
		(r1,[cdr(p),car(p)])-->Stat22(Stat14*) ==> [cdr(p),car(p)] notin inv(r1)
		Use_def(inv)(Stat22*) ==> Stat23: [cdr(p),car(p)] notin {[cdr(q),car(q)]: q in r1}
	p-->Stat23(Stat14*) ==> false; Discharge ==> Stat24: not(Reflexive(similar_thryvar,vertices))
	TlabeledGraph13(Stat24*) ==> Reflexive(bisimilar_thryvar,vertices)
	Use_def(Reflexive)(Stat24*) ==> Stat25: (not(similar_thryvar incs ident(vertices))) & (bisimilar_thryvar incs ident(vertices))
TlabeledGraph7(Stat25*) ==> false; Discharge ==> QED
--
--
--DISPLAY labeledGraph
--
--THEORY labeledGraph(vertices,edges,tags)
--	edges incin (vertices PROD vertices)
--	vertices incin Un(tags)
--	(FORALL x in tags, y in tags | (x /= y) imp ((x * y) = 0))
--==>(tag2_thryvar,block_thryvar,SameTag_thryvar,bisim_thryvar,bisimilar_thryvar,sim_thryvar,similar_thryvar)
--	(FORALL e | (e in edges) imp ((e = [car(e),cdr(e)]) & (car(e) in vertices) & (cdr(e) in vertices)))
--	(FORALL v | (EXISTS y | (v in vertices) imp ((y in tags) & (v in y))))
--	(FORALL x, y | ((x in tags) & (y in tags) & (x /= y)) imp ((x * y) = 0))
--	(FORALL v | Is_vertex(v) imp (Is_tag(tag2_thryvar(v)) & (v in tag2_thryvar(v))))
--	(FORALL v | block_thryvar(v) = if Is_vertex(v) then {w in tag2_thryvar(v) | Is_vertex(w)} else 0 end if)
--	(FORALL v, w | SameTag_thryvar(v,w) eq (block_thryvar(v) = block_thryvar(w)))
--	(FORALL v | SameTag_thryvar(v,v))
--	(FORALL q, r, x | ((q incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & (x in domain(q))) imp SameTag_thryvar(x,(q~[x])))
--	(FORALL q, r, x, y | ((q incin (r + inv(r))) & Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & Straight(q,x,y)) imp SameTag_thryvar(x,y))
--	(FORALL r, x, y, v | (Is_map(r) & (FORALL e in r | SameTag_thryvar(car(e),cdr(e))) & ([x,y] in trans_reflCl(r + inv(r),v))) imp SameTag_thryvar(x,y))
--	bisim_thryvar = {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | ((edges @ inv(b)) = (inv(b) @ edges)) & ((edges @ b) = (b @ edges)) }
--	bisimilar_thryvar := Un(bisim_thryvar)
--	sim_thryvar := {b incin {[v,w]: v in vertices, w in vertices | SameTag_thryvar(v,w)} | (edges @ inv(b)) = (inv(b) @ edges) }
--	similar_thryvar := Un(sim_thryvar) * inv(Un(sim_thryvar))
--
--	(FORALL x | (0 in bisim_thryvar) & (bisim_thryvar incin sim_thryvar) & ((x in bisim_thryvar) imp (x incin (vertices PROD vertices))))
--	(FORALL b | (b in bisim_thryvar) imp (b incin bisimilar_thryvar))
--	(FORALL b | (b in bisim_thryvar) imp (inv(b) in bisim_thryvar))
--	bisimilar_thryvar incin similar_thryvar
--	(FORALL b | (b in sim_thryvar) imp (trans_reflCl(b,vertices) in sim_thryvar))
--	(FORALL b | (b in bisim_thryvar) imp (trans_reflCl(b + inv(b), vertices) in bisim_thryvar))
--	(FORALL r, s | ((r in sim_thryvar) & (s in sim_thryvar)) imp ((r + s) in sim_thryvar))
--	(FORALL r, s | ((r in bisim_thryvar) & (s in bisim_thryvar)) imp ((r + s) in bisim_thryvar))
--	(FORALL r | (r in bisim_thryvar) imp (inv(r) in bisim_thryvar))
--	Transitive(bisimilar_thryvar) & Symmetric(bisimilar_thryvar) & Reflexive(bisimilar_thryvar,vertices)
--	Transitive(similar_thryvar) & Symmetric(similar_thryvar) & Reflexive(similar_thryvar,vertices)
--END labeledGraph
--
ENTER_THEORY Set_theory
--
--
--
--
Def 10061: [Map Image] Def(G IM D) := {cdr(p): p in G | car(p) in D}
--
Theorem 931: [Domains and ranges of direct image] range(G)=(G IM D) + (G IM (domain(G)-D)). Proof:
Suppose_not(g,d) ==> AUTO
        Use_def(range(g)) ==> AUTO
        Use_def(IM) ==> Stat1: {cdr(p): p in g} /= {cdr(p): p in g | car(p) in d} + {cdr(p): p in g | car(p) in (domain(g)-d)}
        Set_monot ==> {cdr(p): p in g} incs ({cdr(p): p in g | car(p) in d} + {cdr(p): p in g | car(p) in (domain(g)-d)})
--
-- For, supposing the contrary of the desired statement, we reach a contradiction as follows.
-- Observe that the supposed inequality, can only be satisfied as the negated inclusion shown below,
-- because monotonicity insures us that ${cdr(p): p in g}$ includes both
-- ${cdr(p): p in g | car(p) in d}$
-- and ${cdr(p): p in g} incs {cdr(p): p in g | car(p) in (domain(g)-d)}$.
--
        (Stat1*)ELEM ==> Stat2: {cdr(p): p in g} nincin
                        ({cdr(p): p in g | car(p) in d} + {cdr(p): p in g | car(p) in (domain(g)-d)})
--
-- But then we can pick an element $q$ in the right-hand side of this negated inclusion which
-- does not belong to the right-hand side...
--
        q-->Stat2(Stat2*) ==> Stat3: (q in {cdr(p): p in g}) &
                                Stat4: (q notin {cdr(p): p in g | car(p) in d}) &
                                        Stat5: (q notin {cdr(p): p in g | car(p) in (domain(g)-d)})
--
-- ...and then, by the suitable replacements within set-formers, and by resorting to
-- the definition of domain, we get a contradiction which concludes our proof.
--
        Use_def(domain(g)) ==> AUTO
        (p,p,p)-->Stat3(Stat3*) ==> Stat6: (p in g) & (car(p) notin d) & Stat7: (car(p) notin {car(p): p in g})
p-->Stat7(Stat6*) ==> false; Discharge ==> QED
--
Def 10069: [Injective map predicate] Inj(F) := (FORALL x in F, y in F | (cdr(x)=cdr(y)) imp (x=y))
--
Theorem 932: [Domain decomposition of a map range] ((D*E=0) & Inj(G)) imp ((G IM D) * (G IM E) = 0). Proof:
Suppose_not(d,e,g) ==> (d*e=0) & Inj(g) & ((g IM d) * (g IM e) /= 0)
	Use_def(Inj) ==> Stat1: (d*e=0) & (FORALL x in g, y in g | (cdr(x)=cdr(y)) imp (x=y)) & ((g IM d) * (g IM e) /= 0)
	Use_def(IM) ==> Stat2: (d*e=0) &
			Stat3: (FORALL x in g, y in g | (cdr(x)=cdr(y)) imp (x=y)) &
			Stat4: ({cdr(x): x in g | car(x) in d} * {cdr(y): y in g | car(y) in e} /= 0)
	q-->Stat4(Stat2*) ==> Stat5: (q in {cdr(x): x in g | car(x) in d}) & (q in {cdr(y): y in g | car(y) in e})
	(x0,y0)-->Stat5(Stat5*) ==> Stat6: (x0 in g) & (y0 in g) & (car(x0) in d) & (car(y0) in e) &
			(cdr(x0) = cdr(y0))
	(x0,y0)-->Stat3(Stat6,Stat6) ==> Stat7: car(x0) = car(y0)
(Stat2,Stat6,Stat7*)Discharge ==>QED
--
Theorem 933: [Direct image of a domain element] (X in domain(G)) imp (G IM {X} /=0). Proof:
Suppose_not(a,g) ==> AUTO
--
-- For, assuming the contrary would openly contradict the definitions.
--
        Use_def(domain(g)) ==> AUTO
        Use_def(IM) ==> Stat1: (a in {car(x): x in g}) & ({cdr(x): x in g | car(x) in {a}} = 0)
(x,x)-->Stat1 ==> false; Discharge ==>QED
--
Theorem 934: [Range of a restricted direct map] G IM D = range(G ON D). Proof:
Suppose_not(g,d) ==> AUTO
	Use_def(range(g ON d)) ==> AUTO
	Use_def(ON) ==> (g IM d) /= {cdr(x): x in {p in g | car(p) in d}}
	SIMPLF ==> (g IM d) /= {cdr(p): p in g | car(p) in d}
Use_def(IM) ==> false; Discharge ==> QED
--
Theorem 935: [Monotonicity of direct image] (B incin A) imp ((G IM B) incin (G IM A)). Proof:
Suppose_not(b,a,g) ==> AUTO
	Set_monot ==> {cdr(p): p in g | car(p) in b} incin {cdr(p): p in g | car(p) in a}
Use_def(IM) ==> false; Discharge ==> QED
--
Def modal1: [single step in the evaluation of a modal proposition] m_value(Op,U,W,R) := if Op = 0 then U elseif Op = 1 then W - U else {x in W | U incs (R IM {x})} end if
--
Def modal2: [recursive evaluation of modal proposition] m_eval(E,W,R,M) := if E in domain(M) then M~[E] else m_value(arb(E * cumstr(0,Za)),Un({m_eval(y,W,R,M): y in E | y notin cumstr(0,Za)}),W,R,M) end if
--

--
Def 16100: [intersection of a nonnull family of sets] int(X) := {u in arb(X) | (FORALL v in X | u in v)}
--
Def 16101: [property of being and odd ordinal] Odd(X) := (EXISTS v in X | (not Odd(v)) & (X = v + {v}))
--
Theorem 936: (0 in Za) &
	(FORALL x | (x in Za) imp ((x PLUS 0) = x)) &
	(FORALL x,y | ((x in Za) & (y in Za)) imp ((x PLUS y) = (y PLUS x))) &
	(FORALL x,y | ((x in Za) & (y in Za)) imp ((x PLUS y) in Za)) &
	(FORALL x,y,z | ((x in Za) & (y in Za) & (z in Za)) imp (((x PLUS y) PLUS z) = (x PLUS (y PLUS z)))). Proof:
Suppose_not ==> AUTO
	ALGEBRA ==> 0 in Za
	Suppose ==> Stat1: not(FORALL x | (x in Za) imp ((x PLUS 0) = x))
		x1-->Stat1(Stat1*) ==> (x1 in Za) & ((x1 PLUS 0) /= x1)
	ALGEBRA(Stat1) ==> (x1 PLUS 0) = x1; Discharge ==> AUTO
	Suppose ==> Stat2: not(FORALL x,y | ((x in Za) & (y in Za)) imp ((x PLUS y) = (y PLUS x)))
		(x2,y2)-->Stat2(Stat2*) ==> (x2 in Za) & (y2 in Za) & ((x2 PLUS y2) /= (y2 PLUS x2))
	ALGEBRA(Stat2) ==> (x2 PLUS y2) = (y2 PLUS x2); Discharge ==> AUTO
	Suppose ==> Stat3: not(FORALL x,y | ((x in Za) & (y in Za)) imp ((x PLUS y) in Za))
		(x3,y3)-->Stat3(Stat3*) ==> (x3 in Za) & (y3 in Za) & ((x3 PLUS y3) notin Za)
	ALGEBRA(Stat3) ==> (x3 PLUS y3) in Za; Discharge ==> Stat4:
		not(FORALL x,y,z | ((x in Za) & (y in Za) & (z in Za)) imp (((x PLUS y) PLUS z) = (x PLUS (y PLUS z))))
	(x4,y4,z4)-->Stat4(Stat4*) ==> (x4 in Za) & (y4 in Za) & (z4 in Za) & (((x4 PLUS y4) PLUS z4) /= (x4 PLUS (y4 PLUS z4)))
	ALGEBRA(Stat4) ==> ((x4 PLUS y4) PLUS z4) = (x4 PLUS (y4 PLUS z4)); Discharge ==> QED
--
APPLY(sigma_thryvar:sumZa) sigma_theory(s->Za,pluz(i,j)->(i PLUS j),e->0) ==>
Theorem 937: (FORALL f | (Finite(f) & (range(f) incin Za)) imp (sumZa(f) in Za)) &
	(FORALL x | (cdr(x) in Za) imp (sumZa({x}) = cdr(x))) &
	(FORALL f,t | (Finite(f) & Is_map(f) & (range(f) incin Za)) imp (sumZa(f) = (sumZa(f ON (domain(f) * t)) PLUS sumZa(f ON (domain(f) - t))))) &
	(FORALL c,f | ((c in f) & Finite(f) & (range(f) incin Za)) imp (sumZa(f) = (sumZa(f - {c}) PLUS cdr(c)))) &
	(FORALL f,g | (Finite(f) & Svm(f) & Svm(g) & (domain(f) = domain(g)) & (range(f) incin Za)) imp
		(sumZa(f) = sumZa({[y,sumZa(f ON (g INV_IM {y}))]: y in range(g)}))) &
	(FORALL f,g | (Finite(f) & Svm(f) & one_1_map(g) & (domain(f) = domain(g)) & (range(f) incin Za)) imp
		(sumZa(f) = sumZa({[y,f~[inv(g)~[y]]]: y in range(g)})))
--
Theorem 938: [basic inclusion-exclusion lemma for two sets] (Finite(X + Y) imp (#(X + Y) = ((#X PLUS #Y) MINUS #(X * Y)))) &
	((#(X + Y) PLUS #(X * Y)) = (#X PLUS #Y)). Proof+:
Suppose_not(x0,y0) ==> AUTO
--
-- The second part of the assertion can be directly read off the Venn's diagram
-- of any two given sets $x0,y0$.
--
	(x0-y0,x0*y0)-->T222(*) ==> #(x0 - y0) PLUS #(x0 * y0) = #((x0 - y0) + (x0 * y0))
	(y0-x0,x0*y0)-->T222(*) ==> #(y0 - x0) PLUS #(x0 * y0) = #((y0 - x0) + (x0 * y0))
	((x0 - y0) + (x0 * y0),(y0 - x0))-->T222(*) ==> #((x0 - y0) + (x0 * y0)) PLUS #(y0 - x0) = #(((x0 - y0) + (x0 * y0)) + (y0 - x0))
	TELEM ==> (x0 = (x0 - y0) + (x0 * y0)) & (y0 = (y0 - x0) + (x0 * y0)) & (x0 + y0 = ((x0 - y0) + (x0 * y0)) + (y0 - x0)) & (x0 + y0 = ((x0 - y0) + (x0 * y0)) + (y0 - x0))
	EQUAL ==> Stat1: ((#(x0 - y0) PLUS #(x0 * y0)) PLUS (#(y0 - x0) PLUS #(x0 * y0))) = (#x0 PLUS #y0)
	(#(x0 - y0) PLUS #(x0 * y0),#(y0 - x0),#(x0 * y0))-->T258(Stat1*) ==> (((#(x0 - y0) PLUS #(x0 * y0)) PLUS #(y0 - x0)) PLUS #(x0 * y0)) = (#x0 PLUS #y0)
	EQUAL ==> Stat2: (#(x0 + y0) PLUS #(x0 * y0)) = (#x0 PLUS #y0)
--
-- Therefore, if a counterexample to the desired statement could exist, it would consist
-- of finite sets $x0,y0$ which do not satisfy the equality
--	$(#(x0 + y0) = ((#x0 PLUS #y0) MINUS #(x0 * y0))$.
-- However the latter equality follows from the former, in view of the fact that
-- finite cardinals are unsigned integers, and hence satisfy cancellation.
--
	ELEM ==> Stat3: Finite(#(x0 + y0)) & ((#(x0 + y0) /= ((#x0 PLUS #y0) MINUS #(x0 * y0))))
	(x0 + y0)-->T156(Stat3*) ==> #(x0 + y0) in Za
	(x0 + y0, x0 * y0)-->T189(Stat3,Stat3*) ==> Stat4: Finite(#(x0 * y0))
	(x0 * y0)-->T156(Stat4,Stat4*) ==> #(x0 * y0) in Za
	(#(x0 + y0),#(x0 * y0))-->T304(Stat3*) ==> Stat5: ((#(x0 + y0) PLUS #(x0 * y0)) MINUS #(x0 * y0)) = #(x0 + y0)
	EQUAL(Stat2,Stat3,Stat5) ==> false
	Discharge ==> QED
--
Theorem 939: [basic inclusion-exclusion lemma for tuples of finite sets] ((domain(A) in Za) & Svm(A) & Finite(Un(range(A)))) imp
	(#Un(range(A)) = sumZa({[g,#int(A IM g)]: g incin domain(A) | Odd(#g)}) MINUS sumZa({[g,#int(A IM g)]: g incin domain(A) | (g /= 0) & (not Odd(#g))})). Proof:
Suppose_not(ap) ==> AUTO
--
-- Reasoning by contradiction, assume that the tuple $ap$ is a counterexample to the theorem's claim.
-- Then we can choose a minimum-length tuple $aa$ contradicting the theorem's assertion.
--
	Suppose ==> Stat1: not(EXISTS a | (domain(a) = domain(ap)) & Finite(Un(range(a))) & (#Un(range(a)) /= sumZa({[g,#int(a IM g)]: g incin domain(ap) | Odd(#g)}) MINUS sumZa({[g,#int(a IM g)]: g incin domain(ap) | (g /= 0) & (not Odd(#g))})))
	ap-->Stat1(*) ==> false; Discharge ==> AUTO
	APPLY(m2_thryvar:n) mathematical_induction(n->domain(ap),P(x)->(EXISTS a | (domain(a) = x) & Finite(Un(range(a))) & (#Un(range(a)) /= sumZa({[g,#int(a IM g)]: g incin x | Odd(#g)}) MINUS sumZa({[g,#int(a IM g)]: g incin x | (g /= 0) & (not Odd(#g))})))) ==>
		Stat2: (n in Za) &
		Stat3: (EXISTS a | (domain(a) = n) & Finite(Un(range(a))) & (#Un(range(a)) /= sumZa({[g,#int(a IM g)]: g incin n | Odd(#g)}) MINUS sumZa({[g,#int(a IM g)]: g incin n | (g /= 0) & (not Odd(#g))}))) &
		Stat4: (FORALL m in n | not(EXISTS a | (domain(a) = m) & Finite(Un(range(a))) & (#Un(range(a)) /= sumZa({[g,#int(a IM g)]: g incin m | Odd(#g)}) MINUS sumZa({[g,#int(a IM g)]: g incin m | (g /= 0) & (not Odd(#g))}))))
	aa-->Stat3(Stat2*) ==> Stat5: (domain(aa) = n) & Finite(Un(range(aa))) & (#Un(range(aa)) /= sumZa({[g,#int(aa IM g)]: g incin n | Odd(#g)}) MINUS sumZa({[g,#int(aa IM g)]: g incin n | (g /= 0) & (not Odd(#g))}))
--
-- Observe that $aa /= 0$, because $Un(0) = 0$ and the null set has neither odd-cardinality
-- subsets nor non-null subsets, and therefore both summations have value $0$ and their
-- difference is also 0. Therefore, in view of the minimality of $aa$, its proper
-- subtuple $aa ON (n MINUS 1)$ meets the theorem's assertion, and the same holds for
-- the tuple ${[i,(aa~[i]) * (aa~[n MINUS 1])]: i in (n MINUS 1)}$, whose length is $n MINUS 1$.
--
	Tsomehow ==>Stat6: (domain(aa ON (n MINUS 1)) = (n MINUS 1)) & ((n MINUS 1) in n) &
		Finite(Un(range(aa ON (n MINUS 1))))
	(n MINUS 1)-->Stat4(Stat6*) ==> Stat7: not(EXISTS a | (domain(a) = (n MINUS 1)) & Finite(Un(range(a))) & (#Un(range(a)) /= sumZa({[g,#int(a IM g)]: g incin (n MINUS 1) | Odd(#g)}) MINUS sumZa({[g,#int(a IM g)]: g incin (n MINUS 1) | (g /= 0) & (not Odd(#g))})))
	(aa ON (n MINUS 1))-->Stat7(Stat6*) ==> Stat8: #Un(range(aa ON (n MINUS 1))) = sumZa({[g,#int((aa ON (n MINUS 1)) IM g)]: g incin (n MINUS 1) | Odd(#g)}) MINUS sumZa({[g,#int((aa ON (n MINUS 1)) IM g)]: g incin (n MINUS 1) | (g /= 0) & (not Odd(#g))})
	Tsomehow ==> (domain({[i,(aa~[i]) * (aa~[n MINUS 1])]: i in (n MINUS 1)}) = (n MINUS 1)) & Finite(Un(range({[i,(aa~[i]) * (aa~[n MINUS 1])]: i in (n MINUS 1)})))
	({[i,(aa~[i]) * (aa~[n MINUS 1])]: i in (n MINUS 1)})-->Stat7(Stat7*) ==> #Un(range({[i,(aa~[i]) * (aa~[n MINUS 1])]: i in (n MINUS 1)})) = sumZa({[g,#int({[i,(aa~[i]) * (aa~[n MINUS 1])]: i in (n MINUS 1)} IM g)]: g incin (n MINUS 1) | Odd(#g)}) MINUS sumZa({[g,#int({[i,(aa~[i]) * (aa~[n MINUS 1])]: i in (n MINUS 1)} IM g)]: g incin (n MINUS 1) | (g /= 0) & (not Odd(#g))})
--
-- Having isolated the final element $(aa~[n MINUS 1])$ of the tuple $aa$ of finite sets,
-- we can split the unionset $Un(range(aa))$ as
--	$Un(range(aa)) = Un(range(aa ON (n MINUS 1))) + (aa~[n MINUS 1])$,
-- and recall the basic inclusion-exclusion lemma for two sets to rewrite $#Un(range(aa))$ as follows:
--
	Tsomehow ==> Un(range(aa)) = Un(range(aa ON (n MINUS 1))) + (aa~[n MINUS 1])
	EQUAL(Stat5) ==> Finite(Un(range(aa ON (n MINUS 1))) + (aa~[n MINUS 1]))
	(Un(range(aa ON (n MINUS 1))),aa~[n MINUS 1])-->T938(Stat8*) ==> #(Un(range(aa ON (n MINUS 1))) + (aa~[n MINUS 1])) = (#Un(range(aa ON (n MINUS 1))) PLUS #(aa~[n MINUS 1])) MINUS #(Un(range(aa ON (n MINUS 1))) * (aa~[n MINUS 1]))
	EQUAL(Stat8) ==> #Un(range(aa)) = ((sumZa({[g,#int((aa ON (n MINUS 1)) IM g)]: g incin (n MINUS 1) | Odd(#g)}) MINUS sumZa({[g,#int((aa ON (n MINUS 1)) IM g)]: g incin (n MINUS 1) | (g /= 0) & (not Odd(#g))})) PLUS #(aa~[n MINUS 1])) MINUS #(Un(range(aa ON (n MINUS 1))) * (aa~[n MINUS 1]))
--
-- Then we can distribute intersection over unionset, and rewrite:
--
	(range(aa ON (n MINUS 1)),aa~[n MINUS 1])-->T99999(*) ==> Un(range(aa ON (n MINUS 1))) * (aa~[n MINUS 1]) = Un({x * (aa~[n MINUS 1]): x in range(aa ON (n MINUS 1))})
	Tsomehow ==> {x * (aa~[n MINUS 1]): x in range(aa ON (n MINUS 1))} = range({[i,(aa~[i]) * (aa~[n MINUS 1])]: i in (n MINUS 1)})
	EQUAL(Stat8) ==> #Un(range(aa)) = ((sumZa({[g,#int((aa ON (n MINUS 1)) IM g)]: g incin (n MINUS 1) | Odd(#g)}) MINUS sumZa({[g,#int((aa ON (n MINUS 1)) IM g)]: g incin (n MINUS 1) | (g /= 0) & (not Odd(#g))})) PLUS #(aa~[n MINUS 1])) MINUS (sumZa({[g,#int({[i,(aa~[i]) * (aa~[n MINUS 1])]: i in (n MINUS 1)} IM g)]: g incin (n MINUS 1) | Odd(#g)}) MINUS sumZa({[g,#int({[i,(aa~[i]) * (aa~[n MINUS 1])]: i in (n MINUS 1)} IM g)]: g incin (n MINUS 1) | (g /= 0) & (not Odd(#g))}))
--
-- etc.
--
Tsomehow ==> false; Discharge ==> QED
--
--
Theorem 940: [basic inclusion-exclusion lemma for finitely many finite sets] (Finite(F) & Finite(Un(F))) imp
	(#Un(F) = sumZa({[g,#int(g)]: g incin F | Odd(#g)}) MINUS sumZa({[g,#int(g)]: g incin F | (g /= 0) & (not Odd(#g))})). Proof:
Suppose_not(f0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
--
--
-- Consider real-valued functions f on a finite set S whose points p carry weights w(p)
-- (which can be positive or negative.) Let J(f) be the sum Sigma(f(p)w(p)). For any finite
-- tuple F of functions f, let MAX(F) and MIN(F) be respectively the pointwise maximum and
-- minimum over the f in F. Then
--
-- Theorem A: J(MAX(F)) = Sigma([J(MIN(G)): G incin F | G odd])  - Sigma([J(MIN(G)): G incin F | G even]).
--
-- Inclusion-exclusion for characteristic functions (and hence for sets) is the special case
-- of this in which the functions f are restricted to have values 0 and 1. But since the
-- functional J is obviously additive over functions, Theorem A follows immediately from
--
-- Theorem B: MAX(F) = Sigma([MIN(G): G incin F | G odd]) - Sigma([MIN(G): G incin F | G even]).
--
-- And since MAX, MIN, and Sigma (for functions) are all pointwise, Theorem B follows immediately from
--
-- Theorem C: MAX(F) = Sigma([MIN(G): G incin F | G odd]) - Sigma([MIN(G): G incin F | G even]),
--
-- where now F is simply a finite tuple of real values.
--
-- To prove Theorem C, proceed inductively. Arrange the values in F in order, with minimum m.
-- Divide the G incin F into those G having m as a member and those incin F - {m}. Then
-- Theorem C reduces to
--
-- Version D: MAX(F) = MAX(F - {m}) = #[m: G incin F - {m} | G even] - #[m: G incin F - {m} | G odd] +
-- Sigma([MIN(G): G incin F - {m} | G odd]) - Sigma([MIN(G): G incin F - {m} | G even])
--
-- (here the first 2 terms on the right simply recast SIGMA([MIN(G): G incin F | G odd & m in G]) and
-- SIGMA([MIN(G): G incin F | G even & m in G]) respectively. But now Version D
-- follows immediately by induction and the simple identity #[G incin F: G even] - #[G incin F: G odd] = 0,
-- which is just the Binomial identity Sigma(Combinations(#F,n)(-1)**n) = (1 - 1)**n = 0.
--
--
--
APPLY(h1_thryvar:oddity) finite_tailrecursive_fcn2(f0->R_0,g2(a,x)->if a /= R_1 then R_1 else R_Rev(R_1) end if) ==>
	Theorem 941: [oddity-characterizing assertion] (FORALL s | Finite(s) imp (oddity(s) = if s = 0 then R_0 elseif oddity(s - {arb(s)}) /= R_1 then R_1 else R_Rev(R_1) end if))
--
Theorem 942: [basic inclusion-exclusion lemma for finite real-valued maps] (Svm(F) & (F /= 0) & (range(F) incin Re)) imp
	(max_over_Re(F) = sumRe({[g,min_over_Re(g)]: g incin F | oddity(g) = R_1}) R_MINUS sumRe({[g,min_over_Re(g)]: g incin F | oddity(g) = R_Rev(R_1)})). Proof:
Suppose_not(f0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem 943: [basic inclusion-exclusion lemma for finite real-valued maps, 2] (Svm(F) & (F /= 0) & (range(F) incin Re)) imp
	(max_over_Re(F) = sumRe({[g,oddity(g) R_TIMES min_over_Re(g)]: g incin F | g /= 0})). Proof:
Suppose_not(f0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
--Theorem OM: [basic inclusion-exclusion lemma for finite real-valued maps, 2] (Svm(F) & (F /= 0) & (range(F) incin Re)) imp
--	(max_over_Re(F) = sumRe([oddity(g) R_TIMES min_over_Re(g): g incin F | g /= 0]))
--Suppose_not(f0) ==> AUTO
--Tsomehow ==> false; Discharge ==>
--
--
-- The following theorem shows that the powerset of a set $f$ can be decomposed
-- with respect to any member $p$ of $f$ into the form
--	$pow(f - {p}) + {g + {p}: g in pow(f - {p})}$.
--
Theorem 944: (P in F) imp (pow(F) = {0,{P}} + {g incin (F - {P}) | g /= 0} +
				{g + {P} : g incin (F - {P}) | g /= 0}). Proof:
Suppose_not(p,f) ==> AUTO

	Use_def(pow) ==> Stat1: ({s: s incin f} /= {0,{p}} + {g incin (f-{p}) | g /= 0} + {g + {p}: g incin (f - {p})| g /= 0}) & (p in f)

	x-->Stat1(Stat1*) ==> (x in {s: s incin f}) eq (x notin ({0,{p}} + {g incin (f-{p}) | g /= 0} + {g + {p}: g incin (f - {p})| g /= 0}))

	Suppose ==> Stat2: x notin {s: s incin f}

--
-- On the one hand, if we assume that $x$ makes the left-hand side of the above logical
-- equivalence true, then it must make the right-hand side true also: however, being not
-- included in $f$, $x$ cannot equal $0$ or the singleton ${p}$; moreover, it cannot belong
-- to the set ${g : g incin (f-{p}) | g /= 0}$. Therefore, it must belong to the set
-- ${g +{p}:g incin (f-{p})| g /= 0}$.
--
		x-->Stat2(Stat1,Stat1*) ==> Stat3: (x nincin f) & (x /= 0) & (x /= {p})

		Suppose ==> Stat4: x in {g incin (f - {p}) | g /= 0}
			()-->Stat4(Stat3,Stat3*) ==> false
		Discharge ==> Stat5: (x in {g  + {p} : g incin (f - {p}) | g /= 0}) & (p in f)

--
-- However, it is readily seen that this situation again conflicts with $x nincin f$.
--

		x0-->Stat5(Stat3*) ==> false

	Discharge ==> Stat6: (x in {s: s incin f}) &
			(x notin {g incin (f - {p}) | g /= 0}) &
			(x notin {g + {p}:g incin (f - {p})| g /= 0}) &
			(x /= 0) & (x /= {p})
--
-- On the other hand, assuming that both sides of the above logical equivalence are false
-- would likewise imply $x nincin f$. Whichever of $p notin x$, $p in x$ holds,
-- we reach a contradiction: hence the initial assumption that a couterexample to the
-- desired conclusion exists is contradicted.
--

	(xp,xp,xp-{p})--> Stat6(Stat6*) ==> false

Discharge ==> QED
--
-- A simplified variant of the preceding theorem is as follows:
--
Theorem 945: (P in F) imp (pow(F) = {g: g incin (F - {P})} +
				{g + {P} : g incin (F - {P})}). Proof:
Suppose_not(p,f) ==> AUTO
	(p,f)-->T944(*) ==> Stat1: not(({g: g incin (f - {p})} = {0} + {g incin (f - {p}) | g /= 0}) &
		({g + {p} : g incin (f - {p})} = {{p}} + {g + {p} : g incin (f - {p}) | g /= 0}))
	Suppose ==> {g: g incin (f - {p})} /= {0} + {g incin (f - {p}) | g /= 0}
		Set_monot ==> {g incin (f - {p}) | g /= 0} incin {g: g incin (f - {p})}
		Suppose ==> Stat2: 0 notin {g: g incin (f - {p})}
		0-->Stat2(Stat2*) ==> false; Discharge ==> Stat3: {g: g incin (f - {p})} nincin ({0} + {g incin (f - {p}) | g /= 0})
		g0-->Stat3(Stat3*) ==> Stat4: (g0 in {g: g incin (f - {p})}) & (g0 notin {g: g incin (f - {p}) | g /= 0}) & (g0 /= 0)
	(g2,g0)-->Stat4(Stat4*) ==> false; Discharge ==> {g + {p} : g incin (f - {p})} /= {{p}} + {g + {p} : g incin (f - {p}) | g /= 0}
	Set_monot ==> {g + {p}: g incin (f - {p}) | g /= 0} incin {g + {p}: g incin (f - {p})}
	Suppose ==> Stat5: {p} notin {g + {p}: g incin (f - {p})}
	0-->Stat5(Stat5*) ==> false; Discharge ==> Stat6: {g + {p}: g incin (f - {p})} nincin ({{p}} + {g + {p}: g incin (f - {p}) | g /= 0})
	g1-->Stat6(Stat6*) ==> Stat7: (g1 in {g + {p}: g incin (f - {p})}) & (g1 notin {g + {p}: g incin (f - {p}) | g /= 0}) & (g1 /= {p})
	(g3,g3)-->Stat7(Stat7*) ==> false
	Discharge ==> QED
--
--
--
Def 10060: [nodes of a map] nodes(G) := domain(G) + range(G)
Def 10062: [Roots of a map] roots(G) := domain(G) - range(G - ident(range(G)))
Def 10063: [Well-founded relation] Well_founded(G) := (FORALL d incin nodes(G) | ((d - (G IM d)) = 0) imp (d = 0))
Def 10064: [Forest] Is_forest(F,R) := Well_founded(F) & (roots(F) = R * nodes(F)) & (FORALL p in F, q in F | (cdr(p) = cdr(q)) imp (p = q)) & Is_map(F)
Def 10065: [Tree] Is_tree(T,R) := Is_forest(T,{R})
--
-- The definition of an 'almost-tree' differs from that of a tree
-- insofar as leaves (namely, nodes devoid of outcoming edges) may have
-- multiple immediate predecessors. By 'term' we mean an almost-tree
-- with a function labeling its nodes save possibly the ones which
-- have multiple immediate predecessors (or the root, when it is
-- the only node of the tree).
--
Def 10066: Almostree(T,R) := Well_founded(T) & ((domain(T) - range(T)) incin {R}) & (FORALL p in T, q in T | (cdr(p) = cdr(q)) imp ((p = q) or (cdr(p) notin domain(T)))) & Is_map(T)
Def 10067: Is_term(T,R,L) := Almostree(T,R) & Svm(L) & (domain(T) incin domain(L)) & (({ cdr(p) : p in T, q in T | (p /= q) & (cdr(p) = cdr(q)) } * domain(L)) = 0)
Def 10068: leaves(T,R) := if (T = 0) then {R} else (range(T) - domain(T)) end if
--
--PAUSE HERE
--
-- ************************************************************************************************
--								Section 22: Applications of string rewriting
-- ************************************************************************************************
--
--BEGIN HERE
--
-- A finite sequence consisting of elements of $s$ can be reduced by
-- pruning a loop out of it.
--
Def 894: redexLoops(S) := {[f,concat(f ON i,shifted_seq(f,j))]: f in Fin_seqs(S), j in #f, i in j | (f~[i]) = (f~[j])}
--
-- The equivalence relation between finite sequences over $s$ (whose meaning
-- is as explained above) is the smallest among all the equivalence relations which
-- contain all loop-redex pairs.
--
Def 891: eqRels(X) := {r incin (X PROD X) | (ident(X) incin r) & ((r @ inv(r)) incin r) }
--
Def 895: samePath(S) := {p in (Fin_seqs(S) PROD Fin_seqs(S)) | 0 =
		{r in eqRels(Fin_seqs(S)) | (redexLoops(S) incin r) & (p notin r)} }
--
-- By concatenating equivalent paths, one gets equivalent paths:
--
Theorem 946: ({[F,Fp],[G,Gp]} incin samePath(S)) imp ([concat(F,G),concat(Fp,Gp)] in samePath(S)). Proof:
Suppose_not(f0,fp,g0,gp,s0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem 947: (F in Fin_seqs(S) - {0}) imp (Is_perm({[F~[i],F~[i PLUS 1]]: i in #F MINUS 1} + {[F~[#F MINUS 1],F~[0]]}) eq (0 = {p in redexLoops | car(p) = F})). Proof:
Suppose_not(f0,s0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
--PAUSE HERE
--BEGIN HERE
--
-- A finite sequence consisting of pairs $[b,e]$ with $b in s$ ($s$ being the set of generators)
-- and $e in Si$ ($e$ being the exponent to which $b$ is raised) can be reduced either by
-- elimination of a pair $[b,0]$ or by replacement of two consecutive pairs $[b,e],[b,ep]$ by
-- the single pair $[b, e PLUS ep]$.
--
Def 890: redexWords(S) := {[f,g]: f in Fin_seqs(S PROD Si), g in Fin_seqs(S PROD Si), k in #f |
	(#f = #g PLUS 1) & (f ON k = g  ON k) &
		if cdr(f~[k]) = [0,0] then shifted_seq(f,k PLUS 1) = shifted_seq(g,k) else
		  ((k PLUS 1) in #f) & (car(f~[k]) = car(f~[k PLUS 1])) &
		  (shifted_seq(f,k PLUS 2) = shifted_seq(g,k PLUS 1)) &
		  (g~[k] = [car(f~[k]),cdr(f~[k]) PLUS cdr(f~[k PLUS 1])]) end if}
--
-- The equivalence relation between finite sequences over $s PROD Si$ (whose meaning
-- is as explained above) is the smallest among all the equivalence relations which
-- contain all word-redex pairs.
--
Def 892: sameWord(S) := {p in (Fin_seqs(S PROD Si) PROD Fin_seqs(S PROD Si)) | 0 =
		{r in eqRels(Fin_seqs(S PROD Si)) | (redexWords(S) incin r) & (p notin r)} }
--
-- By concatenating equivalent words, one gets equivalent words:
--
Theorem 948: ({[F,Fp],[G,Gp]} incin sameWord(S)) imp ([concat(F,G),concat(Fp,Gp)] in sameWord(S)). Proof:
Suppose_not(f0,fp,g0,gp,s0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
-- The support domain of the group originating from a set $s$ of free generators is
-- the quotient of $Fin_seqs(s PROD Si)$ by the equivalence relation $sameWord(S)$;
-- Its multiplication operation is induced by concatenation of finite strings,
-- its unit is the equivalence class of the void string $0$, its inverse operation is induced
-- by the following string reversing operation:
--
Def 893: reverse(S) := {[f,{[#f MINUS 1 MINUS i,f~[i]]: i in #f}]: f in Fin_seqs(S PROD Si)}
--
-- ... AFTER EXPANDING ALL TECHNICAL ASPECTS, WE WILL END UP WITH THE FOLLOWING THEORY:
--
-- DISPLAY freeGroup
--
-- THEORY freeGroup(s)
-- ==>(embed_thryvar,support_thryvar,times_thryvar,one_thryvar,inv_thryvar)
--	one_1_map(embed_thryvar) & (domain(embed_thryvar) = s) & (range(embed_thryvar) = support_thryvar)
--	one_thryvar in support_thryvar
--	(FORALL x in support_thryvar | (inv_thryvar(x) in support_thryvar) &
--		(times_thryvar(inv_thryvar(x),x) = one_thryvar) &
--		(times_thryvar(one_thryvar,x) = x))
--	(FORALL x in support_thryvar, y in support_thryvar | (times_thryvar(x,y) in support_thryvar))
--	(FORALL x in support_thryvar, y in support_thryvar, z in support_thryvar |
--		times_thryvar(times_thryvar(x,y),z) = times_thryvar(x,times_thryvar(y,z)))
-- END freeGroup
--
--PAUSE HERE
--BEGIN HERE
--
-- ************************************************************************************************
--								Section 23: Additional theorems under development
-- ************************************************************************************************
--
--
-- The following recursive definitions of a lexicographic order for hereditarily finite sets play a role in the
-- 'mirroring lemma' discussion preparatory to the proof of Goedel's theorem in the book associated with this
-- collection of formal proofs.
--
--	$Def xxx: [Lexicographic discriminant] discr(p,q) := {v in p | q incs {w in p | discr(v + w,v * w) * w /= 0}} - q$
--	$Def yyy: [Lexicographic ordering] Smaller(x,y) := discr(x + y, x * y) * y /= 0$
--
--
Def 10001: [Integer divisibility] divides(K,N) := (EXISTS j | N = K TIMES j)
--
Def 10002: [Primality criterion for unsigned integers] Is_prime(P) := (1 in P) & (not(EXISTS k in P | (1 in k) & divides(k,P)))
--
Def 10003: [Smallest factor of an unsigned integer] smallest_factor(N) := arb({k in next(N) | (1 in k) & divides(k,N)})
--
Def 10004: [Increasing sequence of unsigned prime integers factors of an unsigned integer] standard_factorization(N) := concat({[0,smallest_factor(N)]}, arb({standard_factorization(m): m in N | m TIMES smallest_factor(N) = N}))
--
Theorem 949: Ord(K) imp divides(K,0). Proof:
    Suppose_not(k) ==> Ord(k) & (not(divides(k,0)))
        Use_def(divides) ==> Stat1: not(EXISTS j | 0 = k TIMES j)
        k-->T245 ==> 0 = k TIMES 0
    0-->Stat1 ==> false; Discharge ==> QED
--
Theorem 950: (Card(M) or (M in Za)) imp (divides(1,M) & divides(M,M)). Proof:
    Suppose_not(m) ==> (Card(m) or (m in Za)) & ((not divides(1,m)) or (not divides(m,m)))
        m-->T206 ==> Card(m)
        m-->T164 ==> m = #m
        Suppose ==> (not divides(1,m))
            Use_def(divides) ==> Stat1: not(EXISTS j | m = 1 TIMES j)
            m-->T248 ==> m = 1 TIMES m
        m-->Stat1 ==> false; Discharge ==> (not divides(m,m))
        Use_def(divides) ==> Stat2: not(EXISTS j | m = m TIMES j)
        m-->T249 ==> m = m TIMES 1
    1-->Stat2 ==> false; Discharge ==> QED
--
Theorem 951: (divides(K,I) & divides(I,N)) imp divides(K,N). Proof:
    Suppose_not(k,i,n) ==> divides(k,i) & divides(i,n) & (not divides(k,n))
        Use_def(divides) ==> Stat1: (EXISTS j | i = k TIMES j) & Stat2: (EXISTS j | n = i TIMES j) & Stat3: (not(EXISTS j | n = k TIMES j))
        j-->Stat1 ==> i = k TIMES j
        jp-->Stat2 ==> n = i TIMES jp
        EQUAL ==> n = (k TIMES j) TIMES jp
        (k,j,jp)-->T259 ==> n = k TIMES (j TIMES jp)
    (j TIMES jp)-->Stat3 ==> false; Discharge ==> QED
--
--Theorem OM: ((M /= 0) & (M in Za) & (D in Za) & divides(D,M)) imp (D in next(M))
--    Suppose_not(m,d) ==> (m /= 0) & (m in Za) & (d in Za) & divides(d,m) & (d notin next(m))
--    TOBECOMPLETED ==> false; Discharge ==>
--
Theorem 952: ((M in Za) & (1 in M)) imp (Is_prime(smallest_factor(M)) & divides(smallest_factor(M),M)). Proof:
    Suppose_not(m) ==> (m in Za) & (1 in m) & ((not(Is_prime(smallest_factor(m)))) or (not divides(smallest_factor(m),m)))
        Use_def(next) ==> m in next(m)
        m-->T950 ==> divides(m,m)
        Suppose ==> Stat1: {k : k in next(m) | (1 in k) & divides(k,m)} = 0
        m-->Stat1 ==> false; Discharge ==> (arb({k : k in next(m) | (1 in k) & divides(k,m)}) in {k: k in next(m) | (1 in k) & divides(k,m)}) & (arb({k : k in next(m) | (1 in k) & divides(k,m)}) * {k: k in next(m) | (1 in k) & divides(k,m)} = 0)
        Use_def(smallest_factor) ==> Stat2: (smallest_factor(m) in {k: k in next(m) | (1 in k) & divides(k,m)}) & (smallest_factor(m) * {k: k in next(m) | (1 in k) & divides(k,m)} = 0)
        k0-->Stat2 ==> (k0 = smallest_factor(m)) & (k0 in next(m)) & (1 in k0) & divides(k0,m)
        EQUAL ==> (smallest_factor(m) in next(m)) & (1 in smallest_factor(m)) & divides(smallest_factor(m),m)
        ELEM ==>  not(Is_prime(smallest_factor(m)))
        Use_def(Is_prime) ==> Stat3: (EXISTS k in smallest_factor(m) | (1 in k) & divides(k,smallest_factor(m)))
        k-->Stat3 ==> (k in smallest_factor(m)) & (1 in k) & divides(k,smallest_factor(m))
        (k,smallest_factor(m),m)-->T951 ==> divides(k,m)
        Suppose ==> Stat4: k notin {k: k in next(m) | (1 in k) & divides(k,m)}
            k-->Stat4 ==> k notin next(m)
            T206 ==> Ord(Za)
            (Za,m)-->T12 ==> Ord(m)
            m-->T32 ==> Ord(next(m))
        (next(m),smallest_factor(m))-->T13 ==> false; Discharge ==> k in {k: k in next(m) | (1 in k) & divides(k,m)}
    Discharge ==> QED
--
--Theorem OM: ((M in Za) & (not Is_prime(M))) imp (standard_factorization(M) = concat({[0,smallest_factor(M)]}, standard_factorization(M OVER smallest_factor(M))))
--    TOBECOMPLETED

--BEGIN HERE
--
Def 993: Is_oddPow(F) := Svm(F) & (range(F) incin Re) & (FORALL p in domain(F), d in p | F~[p] = R_Rev(F~[p - {d}]))
--
Theorem 16500: (D in F) imp (pow(F) = {g: g incin (F - {D})} + {g + {D} : g incin (F - {D})}). Proof:
Suppose_not(p,f) ==> AUTO
	Set_monot ==> {s: s incin f} incs ({g : g incin (f - {p})} + {g + {p}: g incin (f - {p})})
	Set_monot ==> {g: g incin (f-{p})} + {g + {p}: g incin (f - {p})} incs {s: s incin f}
	Use_def(pow) ==> false
	Discharge ==> QED
--
THEORY halvesPow(s0)
	Finite(s0) & (s0 /= 0)
END halvesPow
--
ENTER_THEORY halvesPow
--
--
--
Theorem halvesPow1: ((D in s0) & (domain(F) = pow(s0 - {D})) & Is_oddPow(F) & (G = F + {[q + {D},R_Rev(F~[q])]: q in pow(s0 - {D})})) imp
		((domain(G) = pow(s0)) & Is_oddPow(G)). Proof:
Suppose_not(d0,f0,f1) ==> AUTO
--
-- Arguing by contradiction, assume that $d0,f0,f1$ form a counterexample to the claim of this theorem.
-- We readily find that $domain(f1) = pow(s0)$, and hence $not Is_oddPow(f1)$.
--
	(d0,s0)-->T16500 ==> pow(s0) = {g: g incin (s0 - {d0})} + {g + {d0} : g incin (s0 - {d0})}
	(f0,{[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})})-->T78(*) ==> domain(f0 + {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) = domain(f0) + domain({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})})
	TELEM ==> domain({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) = {q + {d0}: q in pow(s0 - {d0})}
	EQUAL ==> Stat2: domain(f1) = pow(s0 - {d0}) + {q + {d0}: q in pow(s0 - {d0})}
	Use_def(pow)(Stat2*) ==> Stat3: domain(f1) = {q: q incin (s0 - {d0})} + {q + {d0}: q in {x: x incin (s0 - {d0})}}
	SIMPLF(Stat3*) ==> Stat4: domain(f1) = {q: q incin (s0 - {d0})} + {q + {d0}: q incin (s0 - {d0})}
--
-- By the definition of $Is_oddPow$, either $range(f1) nincin Re$ or $not Svm(f1)$ or
--	$not(FORALL p in domain(f1), d in p | f1~[p] = R_Rev(f1~[p - {d}]))$
-- holds. One by one, we will exclude all three possibilities.
--
	Suppose ==> range(f1) nincin Re
		(f0,{[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})})-->T79(*) ==> range(f0 + {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) = range(f0) + range({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})})
		TELEM ==> range({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) = {R_Rev(f0~[q]): q in pow(s0 - {d0})}
		EQUAL ==> range(f1) = range(f0) + {R_Rev(f0~[q]): q in pow(s0 - {d0})}
		Use_def(Is_oddPow) ==> range(f0) incin Re
		(Stat4*)ELEM ==> Stat14: {R_Rev(f0~[q]): q in pow(s0 - {d0})} nincin Re
		r-->Stat14(Stat14*) ==> Stat15: (r in {R_Rev(f0~[q]): q in pow(s0 - {d0})}) & (r notin Re)
		q1-->Stat15(Stat15*) ==> (q1 in pow(s0 - {d0})) & (R_Rev(f0~[q1]) notin Re)
		(q1,f0)-->T71(*) ==> (f0~[q1]) in Re
		(f0~[q1],f0~[q1])-->T613(Stat15*) ==> false
	Discharge ==> AUTO
--
-- After easily discarding the possibility that $range(f1) nincin Re$, we see that
-- $Svm(f1)$ because $f1 = f0 + {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}$, where
-- the union is made of two single-valued maps which have disjoint domains.
--
	Suppose ==> Stat22: (not Svm(f1))
		EQUAL ==> (not Svm(f0 + {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}))
		Suppose ==> Stat16: (not Svm({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}))
			TELEM ==> Is_map({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})})
			Use_def(Svm)(Stat16*) ==> Stat17: not(FORALL x in {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}, y in {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})} | (car(x) = car(y)) imp (x = y))
			(x1,y1)-->Stat17(Stat17*) ==> Stat18: (x1 in {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) & (y1 in {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) & (car(x1) = car(y1)) & (x1 /= y1)
			(q8,q9)-->Stat18(Stat18*) ==> (x1 = [q8 + {d0},R_Rev(f0~[q8])]) & (y1 = [q9 + {d0},R_Rev(f0~[q9])]) & (car(x1) = car(y1)) & (x1 /= y1)
					& (q8 in pow(s0 - {d0})) & (q9 in pow(s0 - {d0}))
			TELEM ==> (car([q8 + {d0},R_Rev(f0~[q8])]) = q8 + {d0}) & (car([q9 + {d0},R_Rev(f0~[q9])]) = q9 + {d0})
			EQUAL(Stat18) ==> Stat19: (q8 + {d0} = q9 + {d0}) &  ([q8 + {d0},R_Rev(f0~[q8])] /= [q9 + {d0},R_Rev(f0~[q9])])
			(Stat19)ELEM ==> R_Rev(f0~[q8]) /= R_Rev(f0~[q9])
			Suppose ==> (d0 in q8) or (d0 in q9)
				Use_def(pow)(Stat18*) ==> Stat20: (q8 in {z: z incin  (s0 - {d0})}) & (q9 in {w: w incin  (s0 - {d0})})
				(w8,w9)-->Stat20(Stat19*) ==> false
			Discharge ==> AUTO
			(Stat19*)ELEM ==> q8 = q9
			EQUAL(Stat19) ==> false
		Discharge ==> AUTO
		Use_def(Is_oddPow) ==> Svm(f0)
		(f0,{[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})})-->T87(Stat22*) ==> Stat23: (domain(f0) * domain({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) /= 0)
		TELEM ==> domain({[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}) = {q + {d0}: q in pow(s0 - {d0})}
		q7-->Stat23(*) ==> Stat24: (q7 in {q + {d0}: q in pow(s0 - {d0})}) & (q7 in pow(s0 - {d0}))
		Use_def(pow(s0 - {d0})) ==> AUTO
		q6-->Stat24(Stat24*) ==> Stat25: (q7 in {w: w incin (s0 - {d0})}) & (d0 in q7)
		w7-->Stat25(Stat25*) ==> false
	Discharge ==> AUTO
--
-- Therefore, the condition
--	$(p1 in domain(f1)) & (d1 in p1) & (f1~[p1] /= R_Rev(f1~[p1 - {d1}]))$
-- is met by suitable chosen $p1,d1$; and it is plain that $p1$
-- cannot belong to the domain $pow(s0 - {d0})$ of $f0$. Instead,
-- $p1$ will be of the form $q0 + {d0}$, where $q0 in pow(s0 - {d0})$.
--
	Use_def(Is_oddPow)(*) ==> Stat6: not(FORALL p in domain(f1), d in p | f1~[p] = R_Rev(f1~[p - {d}])) &
		(FORALL p in domain(f0), d in p | f0~[p] = R_Rev(f0~[p - {d}]))
	EQUAL ==> Stat7: (FORALL p in pow(s0 - {d0}), d in p | f0~[p] = R_Rev(f0~[p - {d}]))
	(p1,d1)-->Stat6(Stat4*) ==> ((p1 in {q: q incin (s0 - {d0})}) or (p1 in {q + {d0}: q incin (s0 - {d0})})) &
		(d1 in p1) & (f1~[p1] /= R_Rev(f1~[p1 - {d1}]))
	Suppose ==> Stat6a: p1 in {q: q incin (s0 - {d0})}
		Use_def(pow)(Stat6a*) ==> p1 in pow(s0 - {d0})
		(p1,d1)-->Stat7(Stat6*) ==> f0~[p1] = R_Rev(f0~[p1 - {d1}])
		(f1,f0,p1)-->T131(*) ==> f1~[p1] = R_Rev(f0~[p1 - {d1}])
		Suppose ==> Stat7a: (p1 - {d1}) notin pow(s0 - {d0})
			Use_def(pow)(Stat7a*) ==> Stat8a: (p1 - {d1}) notin {w: w incin (s0 - {d0})}
			(p1 - {d1})-->Stat8a(Stat8a*) ==> (p1 - {d1}) nincin (s0 - {d0})
			(Stat8a*)ELEM ==> p1 nincin (s0 - {d0})
			p2-->Stat6a(Stat7*) ==> false
		Discharge ==> (p1 - {d1}) in domain(f0)
		(f1,f0,p1 - {d1})-->T131(*) ==> f1~[p1 - {d1}] = f0~[p1 - {d1}]
		EQUAL(Stat6) ==> false
	Discharge ==> Stat8: p1 in {q + {d0}: q incin (s0 - {d0})}
	q0-->Stat8(Stat8*) ==> Stat9: (p1 = q0 + {d0}) & (q0 incin (s0 - {d0}))
	Suppose ==> Stat10a: q0 notin pow(s0 - {d0})
		Use_def(pow(s0 - {d0})) ==> AUTO
		(Stat10a*)ELEM ==> Stat12: q0 notin {x: x incin (s0 - {d0})}
		q0-->Stat12(Stat9*) ==> false
	Discharge ==> Stat10: q0 in pow(s0 - {d0})
--
-- Observe that $f1~[p1 - {d1}] /= f0~[q0]$.
--
	Suppose ==> f1~[p1 - {d1}] = f0~[q0]
		Suppose ==> Stat11: [p1,R_Rev(f0~[q0])] notin {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}
			q0-->Stat11(Stat10*) ==> [p1,R_Rev(f0~[q0])] /= [q0 + {d0},R_Rev(f0~[q0])]
			TELEM ==> (p1 = q0 + {d0}) imp ([p1,R_Rev(f0~[q0])] = [q0 + {d0},R_Rev(f0~[q0])])
		(Stat9*)Discharge ==> [p1,R_Rev(f0~[q0])] in f1
		(f1,[p1,R_Rev(f0~[q0])])-->T74(Stat4*) ==> (f1~[car([p1,R_Rev(f0~[q0])])]) = cdr([p1,R_Rev(f0~[q0])])
		(p1,R_Rev(f0~[q0]))-->T9(Stat10*) ==> (car([p1,R_Rev(f0~[q0])]) = p1) & (cdr([p1,R_Rev(f0~[q0])]) = R_Rev(f0~[q0]))
		EQUAL(Stat6) ==> false
	Discharge ==> Stat14a: f1~[p1 - {d1}] /= f0~[q0]
--
-- If $d0 = d1$, then $f1~[p1 - {d1}] = f0~[p1 - {d1}]$ and
-- $f1~[p1] = R_Rev(f0~[p1 - {d1}])$, so that
-- $f1~[p1] = R_Rev(f1~[p1 - {d1}])$. We get into a contradiction.
--
	Suppose ==> d1 = d0
		(Stat9*)ELEM ==> p1 - {d1} = q0
		(f1,f0,q0)-->T131(*) ==> f1~[q0] = f0~[q0]
		EQUAL(Stat14a) ==> false
	Discharge ==> AUTO
--
-- Therefore $d0 /= d1$ and
-- $f1~[p1 - {d1}] = R_Rev(f0~[p1 - {d0,d1}])$,
-- $f0~[p1 - {d0}] = R_Rev(f0~[p1 - {d0,d1}])$,
-- and hence $f1~[p1 - {d1}] = f0~[q0])$,
-- contradicting Stat14a and thus leading us to the desired conclusion.
--
	Suppose ==> Stat30a: not((p1 - {d0,d1} in pow(s0 - {d0})) & (p1 - {d0} in pow(s0 - {d0})))
		Use_def(pow(s0 - {d0})) ==> AUTO
		(Stat30a*)ELEM ==> Stat32: ((p1 - {d0,d1}) notin {x: x incin (s0 - {d0})}) or ((p1 - {d0}) notin {y: y incin (s0 - {d0})})
		(p1 - {d0,d1},p1 - {d0})-->Stat32(Stat9*) ==> false
	Discharge ==> AUTO
	Suppose ==> Stat31: [(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])] notin {[q + {d0},R_Rev(f0~[q])]: q in pow(s0 - {d0})}
		(p1 - {d0,d1})-->Stat31(Stat14a*) ==> false
	Discharge ==> [(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])] in f1
	Suppose ==> f1~[(p1 - {d0,d1}) + {d0}] /= R_Rev(f0~[p1 - {d0,d1}])
		(f1,[(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])])-->T74(*) ==> f1~[car([(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])])] = cdr([(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])])
		((p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}]))-->T9(Stat14a*) ==> (car([(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])]) = (p1 - {d0,d1}) + {d0}) & (cdr([(p1 - {d0,d1}) + {d0},R_Rev(f0~[p1 - {d0,d1}])]) = R_Rev(f0~[p1 - {d0,d1}]))
		EQUAL(Stat14a) ==> false
	Discharge ==> AUTO
	(Stat6*)ELEM ==> Stat33: ((p1 - {d0,d1}) + {d0} = p1 - {d1}) & (f1~[(p1 - {d0,d1}) + {d0}] = R_Rev(f0~[p1 - {d0,d1}])) & (q0 = p1 - {d0}) & (d1 in p1 - {d0}) & (p1 - {d0,d1} = (p1 - {d0}) - {d1})
	EQUAL(Stat14a,Stat33) ==> R_Rev(f0~[(p1 - {d0}) - {d1}]) /= f0~[p1 - {d0}]
	(p1 - {d0},d1)-->Stat7(Stat14a*) ==> false
	Discharge ==> QED
--
--
--
Theorem halvesPow2: ((domain(F) = pow(s0)) & Is_oddPow(F) & (R_0 notin range(F))) imp
		(#{q: q incin s0 | F~[q] R_GT R_0} = #{q: q incin s0 | F~[q] R_LT R_0}). Proof:
Suppose_not(f0) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
--
ENTER_THEORY Set_theory
--
--PAUSE HERE
--BEGIN HERE
--
Def 990: switch(P) := [cdr(P),car(P)]
--
Def 991: Is_odd(F) := Svm(F) & (range(F) incin Re) & (FORALL p in domain(F) | F~[switch(p)] = R_Rev(F~[p]))
--
Def 992: Is_even(F) := Svm(F) & (range(F) incin Re) & (FORALL p in domain(F) | F~[switch(p)] = F~[p])
--
THEORY halves(s0)
	Finite(s0)
END halves
--
ENTER_THEORY halves
--
Def halves1: wholeP_thryvar := (s0 PROD s0) - ident(s0)
--
Theorem halves0: Is_map(wholeP_thryvar) & Finite(wholeP_thryvar). Proof:
Suppose_not ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Def halves2: halvesP_thryvar := {q incin wholeP_thryvar | (FORALL p in wholeP_thryvar | (p in q) eq (switch(p) notin q))}
--
Def halves3: oddFcn_thryvar := {f incin (wholeP_thryvar PROD Re) | Is_odd(f)}
--
Def halves4: evenFcn_thryvar := {f incin (wholeP_thryvar PROD Re) | Is_even(f)}
--
Def halves5: sgg_thryvar(H) := {[p, if p in H then R_1 else R_Rev(R_1) end if]: p in wholeP_thryvar}
--
Theorem halves1: (H in halvesP_thryvar) imp (sgg_thryvar(H) in oddFcn_thryvar). Proof:
Suppose_not(h) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem halves2: (({H,G} incin halvesP_thryvar) & (Q in wholeP_thryvar)) imp ((sgg_thryvar(H)~[Q]) R_OVER (sgg_thryvar(G)~[Q]) = (sgg_thryvar(H)~[Q]) R_TIMES (sgg_thryvar(G)~[Q])). Proof:
Suppose_not(h,g,q) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem halves3: ({H,G} incin halvesP_thryvar) imp ({[p,(sgg_thryvar(H)~[p]) R_OVER (sgg_thryvar(G)~[p])]: p in wholeP_thryvar} in evenFcn_thryvar). Proof:
Suppose_not(h,g) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Def halves6: Def(E H_TIMES H) := R_PROD({[p,E~[p]]: p in H})
--
Theorem halves4: (({H,G} incin halvesP_thryvar) & Is_even(E) & (domain(E) = wholeP_thryvar)) imp (E H_TIMES H = E H_TIMES G). Proof:
Suppose_not(h,g,e) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Def halves7: sign_thryvar := {[[G,H],sgg_thryvar(H) H_TIMES G]: G in halvesP_thryvar, H in halvesP_thryvar}
--
Theorem halves5: ({H,G} incin halvesP_thryvar) imp ((sign_thryvar~[[G,H]] in {R_1,R_Rev(R_1)}) & (sign_thryvar~[[G,H]] = R_1)). Proof:
Suppose_not(g,h) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Def halves8: Def(F H_PROD H) := {[F~[car(p)],F~[cdr(p)]]: p in H}
-- 
Theorem halves6: (Is_perm(F) & (domain(F) = s0) & (H in halvesP_thryvar)) imp ((F H_PROD H) in halvesP_thryvar). Proof:
Suppose_not(f,h) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem halves7: (Is_perm(F) & (domain(F) = s0) & ({H,G} incin halvesP_thryvar)) imp (sign_thryvar~[[F H_PROD G,F H_PROD H]] = sign_thryvar~[[G,H]]). Proof:
Suppose_not(f,h,g) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Def halves9: sgn_thryvar := {[f,arb({sign_thryvar~[[f H_PROD h,h]]: h in halvesP_thryvar})]: f incin (s0 PROD s0) | Is_perm(f) & (domain(f) = s0)}
--
Theorem halves8: (Is_perm(F) & (domain(F) = s0) & (H in halvesP_thryvar)) imp ((sgn_thryvar~[F] in {R_1,R_Rev(R_1)}) & (sgn_thryvar~[F] = sign_thryvar~[[F H_PROD H,H]])). Proof:
Suppose_not(f,h) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem halves9: (Is_perm(D) & Is_perm(F) & (domain(D) = s0) & (domain(F) = s0) & (H in halvesP_thryvar)) imp (Is_perm(D @ F) & (domain(D @ F) = s0) & ((D @ F) H_PROD H) = (D H_PROD (F H_PROD H))). Proof:
Suppose_not(d,f,h) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
Theorem halves10: (Is_perm(D) & Is_perm(F) & (domain(D) = s0) & (domain(F) = s0)) imp (sgn_thryvar~[D @ F] = (sgn_thryvar~[D]) R_TIMES (sgn_thryvar~[F])). Proof:
Suppose_not(d,f) ==> AUTO
Tsomehow ==> false; Discharge ==> QED
--
ENTER_THEORY Set_theory
--PAUSE HERE ------------
