\documentstyle[makeidx]{article}
\makeindex
%\setlength{\oddsidemargin}{.5in}
%\setlength{\evensidemargin}{.5in}
%\setlength{\textwidth}{5.8in}
\begin{document}
%\setlength{\parindent}{0pt}
%\newcounter{bean}
%\begin{list}{\arabic{bean}.}{\usecounter{bean}\setlength{\leftmargin}{0pt}\setlength{\rightmargin}{0pt}\setlength{\listparindent}{20pt}\setlength{\parsep}{5pt}}
%\item[]




\noindent{\sc Event}:   Start with the library {\tt{"interpreter"}}.

\addvspace{18pt}


\begin{verbatim};;;List Operations

\end{verbatim}\begin{tabbing}{\sc Theorem}:  car-append \\ \index{car-append}
\=\+{\rm{car}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}})) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{a\/}})$\;\;${\bf then }{\rm{car}}\,({\it{a\/}}) \\ 
{\bf else }{\rm{car}}\,({\it{b\/}})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  listp-append \\ \index{listp-append}
{\rm{listp}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}})) $=$ ({\rm{listp}}\,({\it{a\/}}) $\vee$ {\rm{listp}}\,({\it{b\/}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  length-append \\ \index{length-append}
{\rm{length}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}))\index{length} $=$ ({\rm{length}}\,({\it{a\/}})\index{length} $+$ {\rm{length}}\,({\it{b\/}})\index{length})
\end{tabbing}


\begin{tabbing}{\sc Definition}:\index{plistp} \\  
\=\+{\rm{plistp}}\,({\it{list\/}})\index{plistp} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{list\/}})$\;\;${\bf then }{\rm{plistp}}\,({\rm{cdr}}\,({\it{list\/}}))\index{plistp} \\ 
{\bf else }{\it{list\/}} $=$ {\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  plistp-append-plistp \\ \index{plistp-append-plistp}
{\rm{plistp}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}))\index{plistp} $=$ {\rm{plistp}}\,({\it{b\/}})\index{plistp}
\end{tabbing}



\begin{tabbing}{\sc Theorem}:  append-plistp-nil \\ \index{append-plistp-nil}
({\rm{append}}\,({\it{a\/}}, {\bf{nil}}) $=$ {\it{a\/}}) $=$ {\rm{plistp}}\,({\it{a\/}})\index{plistp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-lessp-count-append \\ \index{not-lessp-count-append}
({\rm{count}}\,({\it{x\/}}) $+$ {\rm{count}}\,({\it{y\/}})) $\not<$ {\rm{count}}\,({\rm{append}}\,({\it{x\/}}, {\it{y\/}}))
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{all-numberps} \\  
\=\+{\rm{all-numberps}}\,({\it{list\/}})\index{all-numberps} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{list\/}}) \\ 
{\bf then }\=\+{\bf if }{\rm{car}}\,({\it{list\/}}) $\in\;${\bf{N}}${}$$\;\;${\bf then }{\rm{all-numberps}}\,({\rm{cdr}}\,({\it{list\/}}))\index{all-numberps} \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  all-numberps-implies \\ \index{all-numberps-implies}
({\rm{all-numberps}}\,({\it{list\/}})\index{all-numberps} $\wedge$ ({\it{e\/}} $\in$ {\it{list\/}})) $\rightarrow$ ({\it{e\/}} $\in\;${\bf{N}}${}$)
\end{tabbing}




\begin{verbatim};;;Set Operations

\end{verbatim}\begin{tabbing}{\sc Definition}:\index{setp} \\  
\=\+{\rm{setp}}\,({\it{list\/}})\index{setp} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{list\/}}) \\ 
{\bf then }\=\+{\bf if }{\rm{car}}\,({\it{list\/}}) $\in$ {\rm{cdr}}\,({\it{list\/}})$\;\;${\bf then }{\bf{f}} \\ 
{\bf else }{\rm{setp}}\,({\rm{cdr}}\,({\it{list\/}}))\index{setp}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  setp-append \\ \index{setp-append}
(($\neg$ {\rm{setp}}\,({\it{a\/}})\index{setp}) $\vee$ ($\neg$ {\rm{setp}}\,({\it{b\/}})\index{setp})) $\rightarrow$ ($\neg$ {\rm{setp}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}))\index{setp})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  setp-member \\ \index{setp-member}
(({\it{x\/}} $\in$ {\it{a\/}}) $\wedge$ ({\it{x\/}} $\in$ {\it{b\/}})) $\rightarrow$ ($\neg$ {\rm{setp}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}))\index{setp})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  setp-append-cons \\ \index{setp-append-cons}
{\rm{setp}}\,({\rm{append}}\,({\it{a\/}}, {\rm{cons}}\,({\it{x\/}}, {\it{b\/}})))\index{setp} $=$ {\rm{setp}}\,({\rm{cons}}\,({\it{x\/}}, {\rm{append}}\,({\it{a\/}}, {\it{b\/}})))\index{setp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  setp-append-not-listp \\ \index{setp-append-not-listp}
($\neg$ {\rm{listp}}\,({\it{b\/}})) $\rightarrow$ ({\rm{setp}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}))\index{setp} $=$ {\rm{setp}}\,({\it{a\/}})\index{setp})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  setp-append-canonicalize \\ \index{setp-append-canonicalize}
{\rm{setp}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}))\index{setp} $=$ {\rm{setp}}\,({\rm{append}}\,({\it{b\/}}, {\it{a\/}}))\index{setp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  setp-member-1 \\ \index{setp-member-1}
({\rm{setp}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}))\index{setp} $\wedge$ ({\it{x\/}} $\in$ {\it{b\/}})) $\rightarrow$ ({\it{x\/}} $\not\in$ {\it{a\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  setp-member-2 \\ \index{setp-member-2}
({\rm{setp}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}))\index{setp} $\wedge$ ({\it{x\/}} $\in$ {\it{a\/}})) $\rightarrow$ ({\it{x\/}} $\not\in$ {\it{b\/}})
\end{tabbing}



\begin{verbatim};;;Subset Operations

\end{verbatim}\begin{tabbing}{\sc Definition}:\index{sublistp} \\  
\=\+{\rm{sublistp}}\,({\it{sub\/}}, {\it{list\/}})\index{sublistp} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{sub\/}})$\;\;${\bf then }({\rm{car}}\,({\it{sub\/}}) $\in$ {\it{list\/}}) $\wedge$ {\rm{sublistp}}\,({\rm{cdr}}\,({\it{sub\/}}), {\it{list\/}})\index{sublistp} \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sublistp-append \\ \index{sublistp-append}
{\rm{sublistp}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}), {\it{list\/}})\index{sublistp} $=$ ({\rm{sublistp}}\,({\it{a\/}}, {\it{list\/}})\index{sublistp} $\wedge$ {\rm{sublistp}}\,({\it{b\/}}, {\it{list\/}})\index{sublistp})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-of-sublistp-is-member \\ \index{member-of-sublistp-is-member}
(({\it{a\/}} $\in$ {\it{b\/}}) $\wedge$ {\rm{sublistp}}\,({\it{b\/}}, {\it{c\/}})\index{sublistp}) $\rightarrow$ ({\it{a\/}} $\in$ {\it{c\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sublistp-of-sublistp-is-sublistp \\ \index{sublistp-of-sublistp-is-sublistp}
({\rm{sublistp}}\,({\it{a\/}}, {\it{b\/}})\index{sublistp} $\wedge$ {\rm{sublistp}}\,({\it{b\/}}, {\it{c\/}})\index{sublistp}) $\rightarrow$ {\rm{sublistp}}\,({\it{a\/}}, {\it{c\/}})\index{sublistp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sublistp-normalize \\ \index{sublistp-normalize}
($\neg$ {\rm{plistp}}\,({\it{b\/}})\index{plistp}) $\rightarrow$ ({\rm{sublistp}}\,({\it{a\/}}, {\it{b\/}})\index{sublistp} $=$ {\rm{sublistp}}\,({\it{a\/}}, {\rm{append}}\,({\it{b\/}}, {\bf{nil}}))\index{sublistp})
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{sei} \\  
\=\+{\rm{sei}}\,({\it{a\/}}, {\it{b\/}})\index{sei} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{a\/}})$\;\;${\bf then }{\rm{sei}}\,({\rm{cdr}}\,({\it{a\/}}), {\rm{append}}\,({\it{b\/}}, {\rm{list}}\,({\rm{car}}\,({\it{a\/}}))))\index{sei} \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sublistp-easy \\ \index{sublistp-easy}
{\rm{sublistp}}\,({\it{a\/}}, {\rm{append}}\,({\it{b\/}}, {\it{a\/}}))\index{sublistp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sublistp-reflexive \\ \index{sublistp-reflexive}
{\rm{sublistp}}\,({\it{a\/}}, {\it{a\/}})\index{sublistp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sublistp-in-append \\ \index{sublistp-in-append}
({\rm{sublistp}}\,({\it{x\/}}, {\it{a\/}})\index{sublistp} $\vee$ {\rm{sublistp}}\,({\it{x\/}}, {\it{b\/}})\index{sublistp}) $\rightarrow$ {\rm{sublistp}}\,({\it{x\/}}, {\rm{append}}\,({\it{a\/}}, {\it{b\/}}))\index{sublistp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sublistp-in-cons \\ \index{sublistp-in-cons}
{\rm{sublistp}}\,({\it{a\/}}, {\it{y\/}})\index{sublistp} $\rightarrow$ {\rm{sublistp}}\,({\it{a\/}}, {\rm{cons}}\,({\it{x\/}}, {\it{y\/}}))\index{sublistp}
\end{tabbing}




\begin{verbatim};;;Tree Operations

\end{verbatim}\begin{tabbing}{\sc Definition}:\index{nodes-rec} \\  
\=\+{\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{tree\/}}) \\ 
{\bf then }\=\+{\bf if }{\it{flag\/}} $=$ {\tt{'}}{\tt{tree}} \\ 
{\bf then }{\rm{cons}}\,({\rm{car}}\,({\it{tree\/}}), {\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\rm{cdr}}\,({\it{tree\/}}))\index{nodes-rec}) \\ 
{\bf else }{\rm{append}}\,(\=\+{\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\rm{car}}\,({\it{tree\/}}))\index{nodes-rec}, \\ 
{\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\rm{cdr}}\,({\it{tree\/}}))\index{nodes-rec})\-$\;${\bf  endif}\- \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{nodes}$\;\;$
{\rm{nodes}}\,({\it{tree\/}})\index{nodes} $=$ {\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{roots} \\  
\=\+{\rm{roots}}\,({\it{forest\/}})\index{roots} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{forest\/}})$\;\;${\bf then }{\rm{cons}}\,({\rm{caar}}\,({\it{forest\/}}), {\rm{roots}}\,({\rm{cdr}}\,({\it{forest\/}}))\index{roots}) \\ 
{\bf else }{\it{forest\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{children-rec} \\  
\=\+{\rm{children-rec}}\,({\it{flag\/}}, {\it{node\/}}, {\it{tree\/}})\index{children-rec} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{tree\/}}) \\ 
{\bf then }\=\+{\bf if }{\it{flag\/}} $=$ {\tt{'}}{\tt{tree}} \\ 
{\bf then }\=\+{\bf if }{\rm{car}}\,({\it{tree\/}}) $=$ {\it{node\/}} \\ 
{\bf then }{\rm{append}}\,(\=\+{\rm{roots}}\,({\rm{cdr}}\,({\it{tree\/}}))\index{roots}, \\ 
{\rm{children-rec}}\,({\tt{'}}{\tt{forest}}, {\it{node\/}}, {\rm{cdr}}\,({\it{tree\/}}))\index{children-rec})\- \\ 
{\bf else }{\rm{children-rec}}\,({\tt{'}}{\tt{forest}}, {\it{node\/}}, {\rm{cdr}}\,({\it{tree\/}}))\index{children-rec}$\;${\bf  endif}\- \\ 
{\bf else }{\rm{append}}\,(\=\+{\rm{children-rec}}\,({\tt{'}}{\tt{tree}}, {\it{node\/}}, {\rm{car}}\,({\it{tree\/}}))\index{children-rec}, \\ 
{\rm{children-rec}}\,({\tt{'}}{\tt{forest}}, {\it{node\/}}, {\rm{cdr}}\,({\it{tree\/}}))\index{children-rec})\-$\;${\bf  endif}\- \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{children} \\  
{\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children} $=$ {\rm{children-rec}}\,({\tt{'}}{\tt{tree}}, {\it{node\/}}, {\it{tree\/}})\index{children-rec}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{parent-rec} \\  
\=\+{\rm{parent-rec}}\,({\it{flag\/}}, {\it{node\/}}, {\it{tree\/}})\index{parent-rec} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{tree\/}}) \\ 
{\bf then }\=\+{\bf if }{\it{flag\/}} $=$ {\tt{'}}{\tt{tree}} \\ 
{\bf then }\=\+{\bf if }{\it{node\/}} $\in$ {\rm{roots}}\,({\rm{cdr}}\,({\it{tree\/}}))\index{roots} \\ 
{\bf then }{\rm{cons}}\,({\rm{car}}\,({\it{tree\/}}), {\rm{parent-rec}}\,({\tt{'}}{\tt{forest}}, {\it{node\/}}, {\rm{cdr}}\,({\it{tree\/}}))\index{parent-rec}) \\ 
{\bf else }{\rm{parent-rec}}\,({\tt{'}}{\tt{forest}}, {\it{node\/}}, {\rm{cdr}}\,({\it{tree\/}}))\index{parent-rec}$\;${\bf  endif}\- \\ 
{\bf else }{\rm{append}}\,(\=\+{\rm{parent-rec}}\,({\tt{'}}{\tt{tree}}, {\it{node\/}}, {\rm{car}}\,({\it{tree\/}}))\index{parent-rec}, \\ 
{\rm{parent-rec}}\,({\tt{'}}{\tt{forest}}, {\it{node\/}}, {\rm{cdr}}\,({\it{tree\/}}))\index{parent-rec})\-$\;${\bf  endif}\- \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{parent} \\  
{\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent} $=$ {\rm{car}}\,({\rm{parent-rec}}\,({\tt{'}}{\tt{tree}}, {\it{node\/}}, {\it{tree\/}})\index{parent-rec})
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{proper-tree} \\  
\=\+{\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{flag\/}} $=$ {\tt{'}}{\tt{tree}} \\ 
{\bf then }\=\+{\bf if }{\rm{listp}}\,({\it{tree\/}})$\;\;${\bf then }{\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\rm{cdr}}\,({\it{tree\/}}))\index{proper-tree} \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\- \\ 
{\bf elseif }{\rm{listp}}\,({\it{tree\/}}) \\ 
{\bf then }\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\rm{car}}\,({\it{tree\/}}))\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\rm{cdr}}\,({\it{tree\/}}))\index{proper-tree}\- \\ 
{\bf else }{\it{tree\/}} $=$ {\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  canonicalize-nodes-rec-flag \\ \index{canonicalize-nodes-rec-flag}
\=\+{\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{flag\/}} $=$ {\tt{'}}{\tt{tree}}$\;\;${\bf then }{\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec} \\ 
{\bf else }{\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{tree\/}})\index{nodes-rec}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  canonicalize-proper-tree-flag \\ \index{canonicalize-proper-tree-flag}
\=\+{\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{flag\/}} $=$ {\tt{'}}{\tt{tree}}$\;\;${\bf then }{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
{\bf else }{\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{tree\/}})\index{proper-tree}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  canonicalize-parent-rec-flag \\ \index{canonicalize-parent-rec-flag}
\=\+{\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{flag\/}} $=$ {\tt{'}}{\tt{tree}}$\;\;${\bf then }{\rm{parent-rec}}\,({\tt{'}}{\tt{tree}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec} \\ 
{\bf else }{\rm{parent-rec}}\,({\tt{'}}{\tt{forest}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  canonicalize-children-rec-flag \\ \index{canonicalize-children-rec-flag}
\=\+{\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{flag\/}} $=$ {\tt{'}}{\tt{tree}}$\;\;${\bf then }{\rm{children-rec}}\,({\tt{'}}{\tt{tree}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec} \\ 
{\bf else }{\rm{children-rec}}\,({\tt{'}}{\tt{forest}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-flag-tree \\ \index{not-flag-tree}
\=\+(({\it{flag\/}} $\not=$ {\tt{'}}{\tt{tree}}) $\wedge$ ({\it{flag\/}} $\not=$ {\tt{'}}{\tt{forest}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec} $=$ {\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{tree\/}})\index{nodes-rec}) \\ 
$\wedge$$\;\;\;\;$({\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} $=$ {\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{tree\/}})\index{proper-tree}) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec} \\ 
$=$$\;\;\;\;${\rm{parent-rec}}\,({\tt{'}}{\tt{forest}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec} \\ 
$=$$\;\;\;\;${\rm{children-rec}}\,({\tt{'}}{\tt{forest}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  parent-rec-children-rec \\ \index{parent-rec-children-rec}
\=\+({\it{child\/}} $\in$ {\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec}) \\ 
$=$$\;\;\;\;$({\it{parent\/}} $\in$ {\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec})\-
\end{tabbing}


\noindent{\sc Event}:   Disable parent-rec-children-rec.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  plistp-children-rec \\ \index{plistp-children-rec}
{\rm{plistp}}\,({\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec})\index{plistp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  plistp-parent-rec \\ \index{plistp-parent-rec}
{\rm{plistp}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec})\index{plistp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  plistp-roots \\ \index{plistp-roots}
{\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{forest\/}})\index{proper-tree} $\rightarrow$ {\rm{plistp}}\,({\rm{roots}}\,({\it{forest\/}})\index{roots})\index{plistp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-roots-member-forest \\ \index{member-roots-member-forest}
\=\+({\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{forest\/}})\index{proper-tree} $\wedge$ ({\it{node\/}} $\in$ {\rm{roots}}\,({\it{forest\/}})\index{roots})) \\ 
$\rightarrow$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{forest\/}})\index{nodes-rec})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-member-no-parent \\ \index{not-member-no-parent}
\=\+({\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} $\wedge$ ({\it{node\/}} $\not\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{parent-rec}}\,({\it{flag\/}}, {\it{node\/}}, {\it{tree\/}})\index{parent-rec} $=$ {\bf{nil}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-child-tree \\ \index{member-child-tree}
\=\+({\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} $\wedge$ ({\it{child\/}} $\in$ {\rm{children-rec}}\,({\it{flag\/}}, {\it{node\/}}, {\it{tree\/}})\index{children-rec})) \\ 
$\rightarrow$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  setp-tree-unique-parent \\ \index{setp-tree-unique-parent}
\=\+({\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} $\wedge$ {\rm{setp}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{setp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{child\/}} $\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec} \\ 
{\bf then }\=\+{\bf if }\=\+(({\it{flag\/}} $=$ {\tt{'}}{\tt{tree}}) $\wedge$ ({\rm{car}}\,({\it{tree\/}}) $=$ {\it{child\/}})) \\ 
$\vee$$\;\;\;\;$(\=\+({\it{flag\/}} $\not=$ {\tt{'}}{\tt{tree}}) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{roots}}\,({\it{tree\/}})\index{roots}))\-\-$\;\;${\bf then }{\bf{nil}} \\ 
{\bf else }{\rm{list}}\,({\rm{car}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec}))$\;${\bf  endif}\- \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-)\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable setp-tree-unique-parent.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  member-parent-parent \\ \index{member-parent-parent}
\=\+(\=\+{\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\in$ {\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec} $=$ {\rm{list}}\,({\it{parent\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  parent-of-child \\ \index{parent-of-child}
\=\+(\=\+{\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec} $=$ {\rm{list}}\,({\it{parent\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-parent-member-tree \\ \index{member-parent-member-tree}
\=\+({\it{parent\/}} $\in$ {\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec}) \\ 
$\rightarrow$$\;\;\;\;$({\it{parent\/}} $\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\-
\end{tabbing} 

\begin{tabbing}{\sc Theorem}:  node-that-has-child-is-in-tree \\ \index{node-that-has-child-is-in-tree}
{\rm{listp}}\,({\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec}) $\rightarrow$ ({\it{parent\/}} $\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  node-that-has-parent-is-in-tree \\ \index{node-that-has-parent-is-in-tree}
\=\+({\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} $\wedge$ {\rm{listp}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec})) \\ 
$\rightarrow$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sublistp-children-generalized \\ \index{sublistp-children-generalized}
\=\+(\=\+{\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{sublistp}}\,({\it{children\/}}, {\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec})\index{sublistp})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{sublistp}}\,({\it{children\/}}, {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{sublistp}\-
\end{tabbing}


\noindent{\sc Event}:   Disable sublistp-children-generalized.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  sublistp-children \\ \index{sublistp-children}
\=\+{\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$\rightarrow$$\;\;\;\;${\rm{sublistp}}\,({\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec}, {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{sublistp}\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{subtreep} \\  
\=\+{\rm{subtreep}}\,({\it{flag\/}}, {\it{subtree\/}}, {\it{tree\/}})\index{subtreep} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{tree\/}}) $\wedge$ {\rm{listp}}\,({\it{subtree\/}}) \\ 
{\bf then }\=\+{\bf if }{\it{flag\/}} $=$ {\tt{'}}{\tt{tree}} \\ 
{\bf then }\=\+{\bf if }{\it{subtree\/}} $=$ {\it{tree\/}}$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }{\rm{subtreep}}\,({\tt{'}}{\tt{forest}}, {\it{subtree\/}}, {\rm{cdr}}\,({\it{tree\/}}))\index{subtreep}$\;${\bf  endif}\- \\ 
{\bf elseif }{\rm{subtreep}}\,({\tt{'}}{\tt{tree}}, {\it{subtree\/}}, {\rm{car}}\,({\it{tree\/}}))\index{subtreep}$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }{\rm{subtreep}}\,({\tt{'}}{\tt{forest}}, {\it{subtree\/}}, {\rm{cdr}}\,({\it{tree\/}}))\index{subtreep}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{subtrees} \\  
\=\+{\rm{subtrees}}\,({\it{flag\/}}, {\it{tree\/}})\index{subtrees} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{tree\/}}) \\ 
{\bf then }\=\+{\bf if }{\it{flag\/}} $=$ {\tt{'}}{\tt{tree}} \\ 
{\bf then }{\rm{cons}}\,({\it{tree\/}}, {\rm{subtrees}}\,({\tt{'}}{\tt{forest}}, {\rm{cdr}}\,({\it{tree\/}}))\index{subtrees}) \\ 
{\bf else }{\rm{append}}\,(\=\+{\rm{subtrees}}\,({\tt{'}}{\tt{tree}}, {\rm{car}}\,({\it{tree\/}}))\index{subtrees}, \\ 
{\rm{subtrees}}\,({\tt{'}}{\tt{forest}}, {\rm{cdr}}\,({\it{tree\/}}))\index{subtrees})\-$\;${\bf  endif}\- \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  subtreep-subtrees \\ \index{subtreep-subtrees}
({\it{subtree\/}} $\in$ {\rm{subtrees}}\,({\it{flag\/}}, {\it{tree\/}})\index{subtrees}) $\rightarrow$ {\rm{subtreep}}\,({\it{flag\/}}, {\it{subtree\/}}, {\it{tree\/}})\index{subtreep}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{next-level} \\  
\=\+{\rm{next-level}}\,({\it{subtrees\/}})\index{next-level} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{subtrees\/}}) \\ 
{\bf then }{\rm{append}}\,({\rm{cdar}}\,({\it{subtrees\/}}), {\rm{next-level}}\,({\rm{cdr}}\,({\it{subtrees\/}}))\index{next-level}) \\ 
{\bf else }{\it{subtrees\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  nodes-rec-forest-append \\ \index{nodes-rec-forest-append}
\=\+{\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\rm{append}}\,({\it{a\/}}, {\it{b\/}}))\index{nodes-rec} \\ 
$=$$\;\;\;\;${\rm{append}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{a\/}})\index{nodes-rec}, {\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{b\/}})\index{nodes-rec})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  next-level-reduces-count \\ \index{next-level-reduces-count}
{\rm{listp}}\,({\it{subtrees\/}}) $\rightarrow$ ({\rm{count}}\,({\rm{next-level}}\,({\it{subtrees\/}})\index{next-level}) $<$ {\rm{count}}\,({\it{subtrees\/}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  next-level-of-tree-in-subtrees \\ \index{next-level-of-tree-in-subtrees}
\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{forest\/}})\index{proper-tree} \\ 
$\rightarrow$$\;\;\;\;${\rm{sublistp}}\,({\it{forest\/}}, {\rm{subtrees}}\,({\tt{'}}{\tt{forest}}, {\it{forest\/}})\index{subtrees})\index{sublistp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  subtrees-of-subtree-in-complete-subtrees \\ \index{subtrees-of-subtree-in-complete!-subtrees}
\=\+({\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{subtree\/}})\index{proper-tree} $\wedge$ ({\it{subtree\/}} $\in$ {\rm{subtrees}}\,({\it{flag\/}}, {\it{tree\/}})\index{subtrees})) \\ 
$\rightarrow$$\;\;\;\;${\rm{sublistp}}\,({\rm{subtrees}}\,({\tt{'}}{\tt{tree}}, {\it{subtree\/}})\index{subtrees}, {\rm{subtrees}}\,({\it{flag\/}}, {\it{tree\/}})\index{subtrees})\index{sublistp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  subtrees-of-subtrees-in-complete-subtrees \\ \index{subtrees-of-subtrees-in-complete!-subtrees}
\=\+({\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{subtrees\/}})\index{proper-tree} $\wedge$ {\rm{sublistp}}\,({\it{subtrees\/}}, {\rm{subtrees}}\,({\it{flag\/}}, {\it{tree\/}})\index{subtrees})\index{sublistp}) \\ 
$\rightarrow$$\;\;\;\;${\rm{sublistp}}\,({\rm{subtrees}}\,({\tt{'}}{\tt{forest}}, {\it{subtrees\/}})\index{subtrees}, {\rm{subtrees}}\,({\it{flag\/}}, {\it{tree\/}})\index{subtrees})\index{sublistp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  next-level-in-subtrees-forest \\ \index{next-level-in-subtrees-forest}
\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{subtrees\/}})\index{proper-tree} \\ 
$\rightarrow$$\;\;\;\;${\rm{sublistp}}\,({\rm{next-level}}\,({\it{subtrees\/}})\index{next-level}, {\rm{subtrees}}\,({\tt{'}}{\tt{forest}}, {\it{subtrees\/}})\index{subtrees})\index{sublistp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  next-level-of-subtrees-in-complete-subtrees \\ \index{next-level-of-subtrees-in-complete!-subtrees}
\=\+({\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{subtrees\/}})\index{proper-tree} $\wedge$ {\rm{sublistp}}\,({\it{subtrees\/}}, {\rm{subtrees}}\,({\it{flag\/}}, {\it{tree\/}})\index{subtrees})\index{sublistp}) \\ 
$\rightarrow$$\;\;\;\;${\rm{sublistp}}\,({\rm{next-level}}\,({\it{subtrees\/}})\index{next-level}, {\rm{subtrees}}\,({\it{flag\/}}, {\it{tree\/}})\index{subtrees})\index{sublistp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  proper-tree-of-append \\ \index{proper-tree-of-append}
\=\+({\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{a\/}})\index{proper-tree} $\wedge$ {\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{b\/}})\index{proper-tree}) \\ 
$\rightarrow$$\;\;\;\;${\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\rm{append}}\,({\it{a\/}}, {\it{b\/}}))\index{proper-tree}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  proper-tree-next-level-of-proper-tree \\ \index{proper-tree-next-level-of-prope!r-tree}
\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{subtrees\/}})\index{proper-tree} \\ 
$\rightarrow$$\;\;\;\;${\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\rm{next-level}}\,({\it{subtrees\/}})\index{next-level})\index{proper-tree}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-member-subtrees \\ \index{not-member-subtrees}
\=\+({\it{root\/}} $\not\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{cons}}\,({\it{root\/}}, {\it{forest\/}}) $\not\in$ {\rm{subtrees}}\,({\it{flag\/}}, {\it{tree\/}})\index{subtrees})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-member-no-children \\ \index{not-member-no-children}
\=\+({\it{parent\/}} $\not\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec} $=$ {\bf{nil}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  no-children-in-rest-of-forest \\ \index{no-children-in-rest-of-forest}
\=\+(\=\+{\rm{setp}}\,({\rm{append}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec}, {\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{forest\/}})\index{nodes-rec}))\index{setp} \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\in$ {\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{children-rec}}\,({\tt{'}}{\tt{forest}}, {\it{parent\/}}, {\it{forest\/}})\index{children-rec} $=$ {\bf{nil}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  no-children-in-rest-of-tree \\ \index{no-children-in-rest-of-tree}
\=\+(\=\+{\rm{setp}}\,({\rm{append}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec}, {\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{forest\/}})\index{nodes-rec}))\index{setp} \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\in$ {\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{forest\/}})\index{nodes-rec}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{children-rec}}\,({\tt{'}}{\tt{tree}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec} $=$ {\bf{nil}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-subtree-member-tree \\ \index{member-subtree-member-tree}
\=\+({\rm{cons}}\,({\it{root\/}}, {\it{forest\/}}) $\in$ {\rm{subtrees}}\,({\it{flag\/}}, {\it{tree\/}})\index{subtrees}) \\ 
$\rightarrow$$\;\;\;\;$({\it{root\/}} $\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  children-of-setp-tree \\ \index{children-of-setp-tree}
\=\+(\=\+{\rm{setp}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;$({\rm{cons}}\,({\it{root\/}}, {\it{forest\/}}) $\in$ {\rm{subtrees}}\,({\it{flag\/}}, {\it{tree\/}})\index{subtrees}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{children-rec}}\,({\it{flag\/}}, {\it{root\/}}, {\it{tree\/}})\index{children-rec} $=$ {\rm{roots}}\,({\it{forest\/}})\index{roots})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  node-has-parent \\ \index{node-has-parent}
\=\+(\=\+({\it{node\/}} $\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec}) \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;$\=\+{\bf if }{\it{flag\/}} $=$ {\tt{'}}{\tt{tree}}$\;\;${\bf then }{\it{node\/}} $\not=$ {\rm{car}}\,({\it{tree\/}}) \\ 
{\bf else }{\it{node\/}} $\not\in$ {\rm{roots}}\,({\it{tree\/}})\index{roots}$\;${\bf  endif}\-)\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{car}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{node\/}}, {\it{tree\/}})\index{parent-rec}) $\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  parent-is-not-itself-generalized \\ \index{parent-is-not-itself-generalize!d}
\=\+(\=\+{\rm{setp}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec}))\- \\ 
$\rightarrow$$\;\;\;\;$({\it{child\/}} $\not=$ {\rm{car}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  parent-is-not-itself \\ \index{parent-is-not-itself}
\=\+(\=\+{\rm{setp}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{cdr}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})))\- \\ 
$\rightarrow$$\;\;\;\;$({\it{child\/}} $\not=$ {\rm{car}}\,({\rm{parent-rec}}\,({\tt{'}}{\tt{tree}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  listp-parent-rec-equals \\ \index{listp-parent-rec-equals}
\=\+({\rm{setp}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{setp} $\wedge$ {\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{listp}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec}) \\ 
$=$$\;\;\;\;$(\=\+({\it{child\/}} $\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec}) \\ 
$\wedge$$\;\;\;\;$\=\+{\bf if }{\it{flag\/}} $=$ {\tt{'}}{\tt{tree}}$\;\;${\bf then }{\it{child\/}} $\not=$ {\rm{car}}\,({\it{tree\/}}) \\ 
{\bf else }{\it{child\/}} $\not\in$ {\rm{roots}}\,({\it{tree\/}})\index{roots}$\;${\bf  endif}\-)\-)\-\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  parent-is-not-child \\ \index{parent-is-not-child}
\=\+(\=\+{\rm{setp}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{car}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec}) $\not\in$ {\rm{children-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{children-rec})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  parent-not-in-children \\ \index{parent-not-in-children}
\=\+(\=\+{\rm{setp}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\in$ {\rm{cdr}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})))\- \\ 
$\rightarrow$$\;\;\;\;$({\it{parent\/}} $\not\in$ {\rm{children-rec}}\,({\tt{'}}{\tt{tree}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec})\-
\end{tabbing}




\begin{verbatim};;; Variables and channel operations

\end{verbatim}\begin{tabbing}{\sc Definition}:\index{value}$\;\;$
{\rm{value}}\,({\it{key\/}}, {\it{state\/}})\index{value} $=$ {\rm{cdr}}\,({\rm{assoc}}\,({\it{key\/}}, {\it{state\/}}))
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{channel}$\;\;$
{\rm{channel}}\,({\it{name\/}}, {\it{state\/}})\index{channel} $=$ {\rm{value}}\,({\it{name\/}}, {\it{state\/}})\index{value}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{empty} \\  
{\rm{empty}}\,({\it{name\/}}, {\it{state\/}})\index{empty} $=$ ($\neg$ {\rm{listp}}\,({\rm{channel}}\,({\it{name\/}}, {\it{state\/}})\index{channel}))
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{head}$\;\;$
{\rm{head}}\,({\it{name\/}}, {\it{state\/}})\index{head} $=$ {\rm{car}}\,({\rm{channel}}\,({\it{name\/}}, {\it{state\/}})\index{channel})
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{send} \\  
\=\+{\rm{send}}\,({\it{channel\/}}, {\it{message\/}}, {\it{state\/}})\index{send} \\ 
$=$$\;\;\;\;${\rm{append}}\,({\rm{channel}}\,({\it{channel\/}}, {\it{state\/}})\index{channel}, {\rm{list}}\,({\it{message\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{receive} \\  
{\rm{receive}}\,({\it{channel\/}}, {\it{state\/}})\index{receive} $=$ {\rm{cdr}}\,({\rm{channel}}\,({\it{channel\/}}, {\it{state\/}})\index{channel})
\end{tabbing}

\begin{verbatim};;; Program Specific

\end{verbatim}\begin{tabbing}{\sc Definition}:\index{status} \\  
{\rm{status}}\,({\it{node\/}}, {\it{state\/}})\index{status} $=$ {\rm{value}}\,({\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{node\/}}), {\it{state\/}})\index{value}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{found-value} \\  
{\rm{found-value}}\,({\it{node\/}}, {\it{state\/}})\index{found-value} $=$ {\rm{value}}\,({\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{node\/}}), {\it{state\/}})\index{value}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{outstanding} \\  
{\rm{outstanding}}\,({\it{node\/}}, {\it{state\/}})\index{outstanding} $=$ {\rm{value}}\,({\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}), {\it{state\/}})\index{value}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{node-value} \\  
{\rm{node-value}}\,({\it{node\/}}, {\it{state\/}})\index{node-value} $=$ {\rm{value}}\,({\rm{cons}}\,({\tt{'}}{\tt{node-value}}, {\it{node\/}}), {\it{state\/}})\index{value}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{send-find} \\  
\=\+{\rm{send-find}}\,({\it{to-children\/}}, {\it{old\/}}, {\it{new\/}})\index{send-find} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{to-children\/}}) \\ 
{\bf then }\=\+(\=\+{\rm{channel}}\,({\rm{car}}\,({\it{to-children\/}}), {\it{new\/}})\index{channel} \\ 
$=$$\;\;\;\;${\rm{send}}\,({\rm{car}}\,({\it{to-children\/}}), {\tt{'}}{\tt{find}}, {\it{old\/}})\index{send})\- \\ 
$\wedge$$\;\;\;\;${\rm{send-find}}\,({\rm{cdr}}\,({\it{to-children\/}}), {\it{old\/}}, {\it{new\/}})\index{send-find}\- \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim};;; The four program statements

\end{verbatim}\begin{tabbing}{\sc Definition}:\index{receive-find} \\  
\=\+{\rm{receive-find}}\,({\it{old\/}}, {\it{new\/}}, {\it{node\/}}, {\it{from-parent\/}}, {\it{to-parent\/}}, {\it{to-children\/}})\index{receive-find} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{head}}\,({\it{from-parent\/}}, {\it{old\/}})\index{head} $=$ {\tt{'}}{\tt{find}} \\ 
{\bf then }\=\+({\rm{channel}}\,({\it{from-parent\/}}, {\it{new\/}})\index{channel} $=$ {\rm{receive}}\,({\it{from-parent\/}}, {\it{old\/}})\index{receive}) \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\it{node\/}}, {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\wedge$$\;\;\;\;$({\rm{found-value}}\,({\it{node\/}}, {\it{new\/}})\index{found-value} $=$ {\rm{node-value}}\,({\it{node\/}}, {\it{old\/}})\index{node-value}) \\ 
$\wedge$$\;\;\;\;$({\rm{outstanding}}\,({\it{node\/}}, {\it{new\/}})\index{outstanding} $=$ {\rm{length}}\,({\it{to-children\/}})\index{length}) \\ 
$\wedge$$\;\;\;\;${\rm{send-find}}\,({\it{to-children\/}}, {\it{old\/}}, {\it{new\/}})\index{send-find} \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{channel}}\,({\it{to-parent\/}}, {\it{new\/}})\index{channel} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{length}}\,({\it{to-children\/}})\index{length} $\simeq {\tt{0}}$ \\ 
{\bf then }{\rm{send}}\,({\it{to-parent\/}}, {\rm{node-value}}\,({\it{node\/}}, {\it{old\/}})\index{node-value}, {\it{old\/}})\index{send} \\ 
{\bf else }{\rm{channel}}\,({\it{to-parent\/}}, {\it{old\/}})\index{channel}$\;${\bf  endif}\-)\- \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{append}}\,(\=\+{\rm{list}}\,(\=\+{\it{from-parent\/}}, \\ 
{\it{to-parent\/}}, \\ 
{\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}))\-, \\ 
{\it{to-children\/}})\-)\-\index{changed}\- \\ 
{\bf else }{\rm{changed}}\,({\it{old\/}}, {\it{new\/}}, {\bf{nil}})\index{changed}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{min} \\  
\=\+{\rm{min}}\,({\it{x\/}}, {\it{y\/}})\index{min} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{x\/}} $<$ {\it{y\/}}$\;\;${\bf then }{\rm{fix}}\,({\it{x\/}}) \\ 
{\bf else }{\rm{fix}}\,({\it{y\/}})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{receive-report} \\  
\=\+{\rm{receive-report}}\,({\it{old\/}}, {\it{new\/}}, {\it{node\/}}, {\it{from-child\/}}, {\it{to-parent\/}})\index{receive-report} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{empty}}\,({\it{from-child\/}}, {\it{old\/}})\index{empty}$\;\;${\bf then }{\rm{changed}}\,({\it{old\/}}, {\it{new\/}}, {\bf{nil}})\index{changed} \\ 
{\bf else }\=\+({\rm{channel}}\,({\it{from-child\/}}, {\it{new\/}})\index{channel} $=$ {\rm{receive}}\,({\it{from-child\/}}, {\it{old\/}})\index{receive}) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{found-value}}\,({\it{node\/}}, {\it{new\/}})\index{found-value} \\ 
$=$$\;\;\;\;${\rm{min}}\,(\=\+{\rm{found-value}}\,({\it{node\/}}, {\it{old\/}})\index{found-value}, \\ 
{\rm{head}}\,({\it{from-child\/}}, {\it{old\/}})\index{head})\-\index{min})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{outstanding}}\,({\it{node\/}}, {\it{new\/}})\index{outstanding} \\ 
$=$$\;\;\;\;$({\rm{outstanding}}\,({\it{node\/}}, {\it{old\/}})\index{outstanding} $-\;1$))\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{channel}}\,({\it{to-parent\/}}, {\it{new\/}})\index{channel} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{outstanding}}\,({\it{node\/}}, {\it{new\/}})\index{outstanding} $\simeq {\tt{0}}$ \\ 
{\bf then }{\rm{send}}\,(\=\+{\it{to-parent\/}}, \\ 
{\rm{found-value}}\,({\it{node\/}}, {\it{new\/}})\index{found-value}, \\ 
{\it{old\/}})\-\index{send} \\ 
{\bf else }{\rm{channel}}\,({\it{to-parent\/}}, {\it{old\/}})\index{channel}$\;${\bf  endif}\-)\- \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,(\=\+{\it{from-child\/}}, \\ 
{\it{to-parent\/}}, \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{node\/}}))\-)\-\index{changed}\-$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{start} \\  
\=\+{\rm{start}}\,({\it{old\/}}, {\it{new\/}}, {\it{root\/}}, {\it{to-children\/}})\index{start} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{status}}\,({\it{root\/}}, {\it{old\/}})\index{status} $=$ {\tt{'}}{\tt{not-started}} \\ 
{\bf then }\=\+({\rm{status}}\,({\it{root\/}}, {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\wedge$$\;\;\;\;$({\rm{found-value}}\,({\it{root\/}}, {\it{new\/}})\index{found-value} $=$ {\rm{node-value}}\,({\it{root\/}}, {\it{old\/}})\index{node-value}) \\ 
$\wedge$$\;\;\;\;$({\rm{outstanding}}\,({\it{root\/}}, {\it{new\/}})\index{outstanding} $=$ {\rm{length}}\,({\it{to-children\/}})\index{length}) \\ 
$\wedge$$\;\;\;\;${\rm{send-find}}\,({\it{to-children\/}}, {\it{old\/}}, {\it{new\/}})\index{send-find} \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{append}}\,(\=\+{\rm{list}}\,(\=\+{\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{root\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{root\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{root\/}}))\-, \\ 
{\it{to-children\/}})\-)\-\index{changed}\- \\ 
{\bf else }{\rm{changed}}\,({\it{old\/}}, {\it{new\/}}, {\bf{nil}})\index{changed}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{root-receive-report} \\  
\=\+{\rm{root-receive-report}}\,({\it{old\/}}, {\it{new\/}}, {\it{root\/}}, {\it{from-child\/}})\index{root-receive-report} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{empty}}\,({\it{from-child\/}}, {\it{old\/}})\index{empty}$\;\;${\bf then }{\rm{changed}}\,({\it{old\/}}, {\it{new\/}}, {\bf{nil}})\index{changed} \\ 
{\bf else }\=\+({\rm{channel}}\,({\it{from-child\/}}, {\it{new\/}})\index{channel} $=$ {\rm{receive}}\,({\it{from-child\/}}, {\it{old\/}})\index{receive}) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{found-value}}\,({\it{root\/}}, {\it{new\/}})\index{found-value} \\ 
$=$$\;\;\;\;${\rm{min}}\,(\=\+{\rm{found-value}}\,({\it{root\/}}, {\it{old\/}})\index{found-value}, \\ 
{\rm{head}}\,({\it{from-child\/}}, {\it{old\/}})\index{head})\-\index{min})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{outstanding}}\,({\it{root\/}}, {\it{new\/}})\index{outstanding} \\ 
$=$$\;\;\;\;$({\rm{outstanding}}\,({\it{root\/}}, {\it{old\/}})\index{outstanding} $-\;1$))\- \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,(\=\+{\it{from-child\/}}, \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{root\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{root\/}}))\-)\-\index{changed}\-$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim};;; The Program

\end{verbatim}\begin{tabbing}{\sc Definition}:\index{rfp} \\  
\=\+{\rm{rfp}}\,({\it{node\/}}, {\it{children\/}})\index{rfp} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{children\/}}) \\ 
{\bf then }{\rm{cons}}\,({\rm{cons}}\,({\it{node\/}}, {\rm{car}}\,({\it{children\/}})), {\rm{rfp}}\,({\it{node\/}}, {\rm{cdr}}\,({\it{children\/}}))\index{rfp}) \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{receive-find-prg} \\  
\=\+{\rm{receive-find-prg}}\,({\it{nodes\/}}, {\it{tree\/}})\index{receive-find-prg} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{nodes\/}}) \\ 
{\bf then }{\rm{cons}}\,(\=\+{\rm{list}}\,(\=\+{\tt{'}}{\tt{receive-find}}, \\ 
{\rm{car}}\,({\it{nodes\/}}), \\ 
{\rm{cons}}\,({\rm{parent}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{tree\/}})\index{parent}, {\rm{car}}\,({\it{nodes\/}})), \\ 
{\rm{cons}}\,({\rm{car}}\,({\it{nodes\/}}), {\rm{parent}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{tree\/}})\index{parent}), \\ 
{\rm{rfp}}\,({\rm{car}}\,({\it{nodes\/}}), {\rm{children}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{tree\/}})\index{children})\index{rfp})\-, \\ 
{\rm{receive-find-prg}}\,({\rm{cdr}}\,({\it{nodes\/}}), {\it{tree\/}})\index{receive-find-prg})\- \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-receive-find-prg \\ \index{member-receive-find-prg}
\=\+({\it{statement\/}} $\in$ {\rm{receive-find-prg}}\,({\it{nodes\/}}, {\it{tree\/}})\index{receive-find-prg}) \\ 
$=$$\;\;\;\;$(\=\+({\rm{car}}\,({\it{statement\/}}) $=$ {\tt{'}}{\tt{receive-find}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cadr}}\,({\it{statement\/}}) $\in$ {\it{nodes\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{caddr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caaddr}}\,({\it{statement\/}}) $=$ {\rm{parent}}\,({\rm{cadr}}\,({\it{statement\/}}), {\it{tree\/}})\index{parent}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdaddr}}\,({\it{statement\/}}) $=$ {\rm{cadr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{cadddr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caadddr}}\,({\it{statement\/}}) $=$ {\rm{cadr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{cdadddr}}\,({\it{statement\/}}) $=$ {\rm{parent}}\,({\rm{cadr}}\,({\it{statement\/}}), {\it{tree\/}})\index{parent}) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{caddddr}}\,({\it{statement\/}}) \\ 
$=$$\;\;\;\;${\rm{rfp}}\,({\rm{cadr}}\,({\it{statement\/}}), {\rm{children}}\,({\rm{cadr}}\,({\it{statement\/}}), {\it{tree\/}})\index{children})\index{rfp})\- \\ 
$\wedge$$\;\;\;\;$({\rm{cdddddr}}\,({\it{statement\/}}) $=$ {\bf{nil}}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{rrp} \\  
\=\+{\rm{rrp}}\,({\it{node\/}}, {\it{children\/}}, {\it{parent\/}})\index{rrp} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{children\/}}) \\ 
{\bf then }{\rm{cons}}\,(\=\+{\rm{list}}\,(\=\+{\tt{'}}{\tt{receive-report}}, \\ 
{\it{node\/}}, \\ 
{\rm{cons}}\,({\rm{car}}\,({\it{children\/}}), {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\it{parent\/}}))\-, \\ 
{\rm{rrp}}\,({\it{node\/}}, {\rm{cdr}}\,({\it{children\/}}), {\it{parent\/}})\index{rrp})\- \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-rrp \\ \index{member-rrp}
\=\+({\it{statement\/}} $\in$ {\rm{rrp}}\,({\it{node\/}}, {\it{children\/}}, {\it{parent\/}})\index{rrp}) \\ 
$=$$\;\;\;\;$(\=\+({\rm{car}}\,({\it{statement\/}}) $=$ {\tt{'}}{\tt{receive-report}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cadr}}\,({\it{statement\/}}) $=$ {\it{node\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{caddr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caaddr}}\,({\it{statement\/}}) $\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdaddr}}\,({\it{statement\/}}) $=$ {\it{node\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{cadddr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caadddr}}\,({\it{statement\/}}) $=$ {\it{node\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdadddr}}\,({\it{statement\/}}) $=$ {\it{parent\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cddddr}}\,({\it{statement\/}}) $=$ {\bf{nil}}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{receive-report-prg} \\  
\=\+{\rm{receive-report-prg}}\,({\it{nodes\/}}, {\it{tree\/}})\index{receive-report-prg} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{nodes\/}}) \\ 
{\bf then }{\rm{append}}\,(\=\+{\rm{rrp}}\,(\=\+{\rm{car}}\,({\it{nodes\/}}), \\ 
{\rm{children}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{tree\/}})\index{children}, \\ 
{\rm{parent}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{tree\/}})\index{parent})\-\index{rrp}, \\ 
{\rm{receive-report-prg}}\,({\rm{cdr}}\,({\it{nodes\/}}), {\it{tree\/}})\index{receive-report-prg})\- \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-receive-report-prg \\ \index{member-receive-report-prg}
\=\+({\it{statement\/}} $\in$ {\rm{receive-report-prg}}\,({\it{nodes\/}}, {\it{tree\/}})\index{receive-report-prg}) \\ 
$=$$\;\;\;\;$(\=\+({\rm{car}}\,({\it{statement\/}}) $=$ {\tt{'}}{\tt{receive-report}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cadr}}\,({\it{statement\/}}) $\in$ {\it{nodes\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{caddr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caaddr}}\,({\it{statement\/}}) $\in$ {\rm{children}}\,({\rm{cadr}}\,({\it{statement\/}}), {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdaddr}}\,({\it{statement\/}}) $=$ {\rm{cadr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{cadddr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caadddr}}\,({\it{statement\/}}) $=$ {\rm{cadr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{cdadddr}}\,({\it{statement\/}}) $=$ {\rm{parent}}\,({\rm{cadr}}\,({\it{statement\/}}), {\it{tree\/}})\index{parent}) \\ 
$\wedge$$\;\;\;\;$({\rm{cddddr}}\,({\it{statement\/}}) $=$ {\bf{nil}}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{start-prg} \\  
\=\+{\rm{start-prg}}\,({\it{root\/}}, {\it{tree\/}})\index{start-prg} \\ 
$=$$\;\;\;\;${\rm{list}}\,({\rm{list}}\,({\tt{'}}{\tt{start}}, {\it{root\/}}, {\rm{rfp}}\,({\it{root\/}}, {\rm{children}}\,({\it{root\/}}, {\it{tree\/}})\index{children})\index{rfp}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-start-prg \\ \index{member-start-prg}
\=\+({\it{statement\/}} $\in$ {\rm{start-prg}}\,({\it{root\/}}, {\it{tree\/}})\index{start-prg}) \\ 
$=$$\;\;\;\;$(\=\+({\rm{car}}\,({\it{statement\/}}) $=$ {\tt{'}}{\tt{start}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cadr}}\,({\it{statement\/}}) $=$ {\it{root\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{caddr}}\,({\it{statement\/}}) $=$ {\rm{rfp}}\,({\it{root\/}}, {\rm{children}}\,({\it{root\/}}, {\it{tree\/}})\index{children})\index{rfp}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdddr}}\,({\it{statement\/}}) $=$ {\bf{nil}}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{rrrp} \\  
\=\+{\rm{rrrp}}\,({\it{root\/}}, {\it{children\/}})\index{rrrp} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{children\/}}) \\ 
{\bf then }{\rm{cons}}\,(\=\+{\rm{list}}\,(\=\+{\tt{'}}{\tt{root-receive-report}}, \\ 
{\it{root\/}}, \\ 
{\rm{cons}}\,({\rm{car}}\,({\it{children\/}}), {\it{root\/}}))\-, \\ 
{\rm{rrrp}}\,({\it{root\/}}, {\rm{cdr}}\,({\it{children\/}}))\index{rrrp})\- \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-rrrp \\ \index{member-rrrp}
\=\+({\it{statement\/}} $\in$ {\rm{rrrp}}\,({\it{root\/}}, {\it{children\/}})\index{rrrp}) \\ 
$=$$\;\;\;\;$(\=\+({\rm{car}}\,({\it{statement\/}}) $=$ {\tt{'}}{\tt{root-receive-report}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cadr}}\,({\it{statement\/}}) $=$ {\it{root\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{caddr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caaddr}}\,({\it{statement\/}}) $\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdaddr}}\,({\it{statement\/}}) $=$ {\it{root\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdddr}}\,({\it{statement\/}}) $=$ {\bf{nil}}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{root-receive-report-prg} \\  
{\rm{root-receive-report-prg}}\,({\it{root\/}}, {\it{tree\/}})\index{root-receive-report-prg} $=$ {\rm{rrrp}}\,({\it{root\/}}, {\rm{children}}\,({\it{root\/}}, {\it{tree\/}})\index{children})\index{rrrp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-root-receive-report-prg \\ \index{member-root-receive-report-prg}
\=\+({\it{statement\/}} $\in$ {\rm{root-receive-report-prg}}\,({\it{root\/}}, {\it{tree\/}})\index{root-receive-report-prg}) \\ 
$=$$\;\;\;\;$(\=\+({\rm{car}}\,({\it{statement\/}}) $=$ {\tt{'}}{\tt{root-receive-report}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cadr}}\,({\it{statement\/}}) $=$ {\it{root\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{caddr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caaddr}}\,({\it{statement\/}}) $\in$ {\rm{children}}\,({\it{root\/}}, {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdaddr}}\,({\it{statement\/}}) $=$ {\it{root\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdddr}}\,({\it{statement\/}}) $=$ {\bf{nil}}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{tree-prg} \\  
\=\+{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg} \\ 
$=$$\;\;\;\;${\rm{append}}\,(\=\+{\rm{start-prg}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{start-prg}, \\ 
{\rm{append}}\,(\=\+{\rm{root-receive-report-prg}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{root-receive-report-prg}, \\ 
{\rm{append}}\,(\=\+{\rm{receive-find-prg}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{receive-find-prg}, \\ 
{\rm{receive-report-prg}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{receive-report-prg})\-)\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  equal-if \\ \index{equal-if}
\=\+(\=\+\=\+{\bf if }{\it{test\/}}$\;\;${\bf then }{\it{p1\/}} \\ 
{\bf else }{\it{p2\/}}$\;${\bf  endif}\- \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{test\/}}$\;\;${\bf then }{\it{r1\/}} \\ 
{\bf else }{\it{r2\/}}$\;${\bf  endif}\-)\- \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{test\/}}$\;\;${\bf then }{\it{p1\/}} $=$ {\it{r1\/}} \\ 
{\bf else }{\it{p2\/}} $=$ {\it{r2\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-tree-prg \\ \index{member-tree-prg}
\=\+({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$=$$\;\;\;\;$(\=\+(\=\+({\rm{car}}\,({\it{statement\/}}) $=$ {\tt{'}}{\tt{start}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cadr}}\,({\it{statement\/}}) $=$ {\rm{car}}\,({\it{tree\/}})) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{caddr}}\,({\it{statement\/}}) \\ 
$=$$\;\;\;\;${\rm{rfp}}\,({\rm{car}}\,({\it{tree\/}}), {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children})\index{rfp})\- \\ 
$\wedge$$\;\;\;\;$({\rm{cdddr}}\,({\it{statement\/}}) $=$ {\bf{nil}}))\- \\ 
$\vee$$\;\;\;\;$(\=\+({\rm{car}}\,({\it{statement\/}}) $=$ {\tt{'}}{\tt{root-receive-report}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cadr}}\,({\it{statement\/}}) $=$ {\rm{car}}\,({\it{tree\/}})) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{caddr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caaddr}}\,({\it{statement\/}}) $\in$ {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdaddr}}\,({\it{statement\/}}) $=$ {\rm{car}}\,({\it{tree\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{cdddr}}\,({\it{statement\/}}) $=$ {\bf{nil}}))\- \\ 
$\vee$$\;\;\;\;$(\=\+({\rm{car}}\,({\it{statement\/}}) $=$ {\tt{'}}{\tt{receive-find}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cadr}}\,({\it{statement\/}}) $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{caddr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caaddr}}\,({\it{statement\/}}) $=$ {\rm{parent}}\,({\rm{cadr}}\,({\it{statement\/}}), {\it{tree\/}})\index{parent}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdaddr}}\,({\it{statement\/}}) $=$ {\rm{cadr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{cadddr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caadddr}}\,({\it{statement\/}}) $=$ {\rm{cadr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{cdadddr}}\,({\it{statement\/}}) $=$ {\rm{parent}}\,({\rm{cadr}}\,({\it{statement\/}}), {\it{tree\/}})\index{parent}) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{caddddr}}\,({\it{statement\/}}) \\ 
$=$$\;\;\;\;${\rm{rfp}}\,(\=\+{\rm{cadr}}\,({\it{statement\/}}), \\ 
{\rm{children}}\,({\rm{cadr}}\,({\it{statement\/}}), {\it{tree\/}})\index{children})\-\index{rfp})\- \\ 
$\wedge$$\;\;\;\;$({\rm{cdddddr}}\,({\it{statement\/}}) $=$ {\bf{nil}}))\- \\ 
$\vee$$\;\;\;\;$(\=\+({\rm{car}}\,({\it{statement\/}}) $=$ {\tt{'}}{\tt{receive-report}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cadr}}\,({\it{statement\/}}) $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{caddr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caaddr}}\,({\it{statement\/}}) $\in$ {\rm{children}}\,({\rm{cadr}}\,({\it{statement\/}}), {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdaddr}}\,({\it{statement\/}}) $=$ {\rm{cadr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{cadddr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caadddr}}\,({\it{statement\/}}) $=$ {\rm{cadr}}\,({\it{statement\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{cdadddr}}\,({\it{statement\/}}) $=$ {\rm{parent}}\,({\rm{cadr}}\,({\it{statement\/}}), {\it{tree\/}})\index{parent}) \\ 
$\wedge$$\;\;\;\;$({\rm{cddddr}}\,({\it{statement\/}}) $=$ {\bf{nil}}))\-)\-\-
\end{tabbing}

\begin{verbatim};;; Correctness

\end{verbatim}\begin{tabbing}{\sc Definition}:\index{treep} \\  
\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$=$$\;\;\;\;$(\=\+{\rm{setp}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{all-numberps}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{all-numberps} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree})\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{total-outstanding} \\  
\=\+{\rm{total-outstanding}}\,({\it{nodes\/}}, {\it{tree\/}}, {\it{state\/}})\index{total-outstanding} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{nodes\/}}) \\ 
{\bf then }\=\+{\rm{total-outstanding}}\,({\rm{cdr}}\,({\it{nodes\/}}), {\it{tree\/}}, {\it{state\/}})\index{total-outstanding} \\ 
$+$$\;\;\;\;$\=\+{\bf if }{\rm{status}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{started}} \\ 
{\bf then }{\rm{outstanding}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{state\/}})\index{outstanding} \\ 
{\bf else }$1\;+$ {\rm{length}}\,({\rm{children}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{tree\/}})\index{children})\index{length}$\;${\bf  endif}\-\- \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{dl} \\  
\=\+{\rm{dl}}\,({\it{down-links\/}}, {\it{state\/}})\index{dl} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{down-links\/}}) \\ 
{\bf then }\=\+(\=\+(\=\+{\rm{empty}}\,({\rm{car}}\,({\it{down-links\/}}), {\it{state\/}})\index{empty} \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{status}}\,({\rm{caar}}\,({\it{down-links\/}}), {\it{state\/}})\index{status} \\ 
$=$$\;\;\;\;${\rm{status}}\,({\rm{cdar}}\,({\it{down-links\/}}), {\it{state\/}})\index{status})\-)\- \\ 
$\vee$$\;\;\;\;$(\=\+({\rm{channel}}\,({\rm{car}}\,({\it{down-links\/}}), {\it{state\/}})\index{channel} $=$ {\rm{list}}\,({\tt{'}}{\tt{find}})) \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\rm{caar}}\,({\it{down-links\/}}), {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{status}}\,({\rm{cdar}}\,({\it{down-links\/}}), {\it{state\/}})\index{status} \\ 
$=$$\;\;\;\;${\tt{'}}{\tt{not-started}})\-)\-)\- \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{cdr}}\,({\it{down-links\/}}), {\it{state\/}})\index{dl}\- \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{done} \\  
\=\+{\rm{done}}\,({\it{node\/}}, {\it{state\/}})\index{done} \\ 
$=$$\;\;\;\;$(\=\+({\rm{status}}\,({\it{node\/}}, {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\wedge$$\;\;\;\;$({\rm{outstanding}}\,({\it{node\/}}, {\it{state\/}})\index{outstanding} $\simeq {\tt{0}}$))\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{ul} \\  
\=\+{\rm{ul}}\,({\it{up-links\/}}, {\it{state\/}})\index{ul} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{up-links\/}}) \\ 
{\bf then }\=\+(\=\+{\rm{empty}}\,({\rm{car}}\,({\it{up-links\/}}), {\it{state\/}})\index{empty} \\ 
$\vee$$\;\;\;\;$(\=\+(\=\+{\rm{channel}}\,({\rm{car}}\,({\it{up-links\/}}), {\it{state\/}})\index{channel} \\ 
$=$$\;\;\;\;${\rm{list}}\,({\rm{found-value}}\,({\rm{caar}}\,({\it{up-links\/}}), {\it{state\/}})\index{found-value}))\- \\ 
$\wedge$$\;\;\;\;${\rm{done}}\,({\rm{caar}}\,({\it{up-links\/}}), {\it{state\/}})\index{done})\-)\- \\ 
$\wedge$$\;\;\;\;${\rm{ul}}\,({\rm{cdr}}\,({\it{up-links\/}}), {\it{state\/}})\index{ul}\- \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{reported} \\  
\=\+{\rm{reported}}\,({\it{node\/}}, {\it{parent\/}}, {\it{state\/}})\index{reported} \\ 
$=$$\;\;\;\;$({\rm{done}}\,({\it{node\/}}, {\it{state\/}})\index{done} $\wedge$ {\rm{empty}}\,({\rm{cons}}\,({\it{node\/}}, {\it{parent\/}}), {\it{state\/}})\index{empty})\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{number-not-reported} \\  
\=\+{\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{state\/}})\index{number-not-reported} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{children\/}}) \\ 
{\bf then }\=\+{\bf if }{\rm{reported}}\,({\rm{car}}\,({\it{children\/}}), {\it{parent\/}}, {\it{state\/}})\index{reported} \\ 
{\bf then }{\rm{number-not-reported}}\,({\rm{cdr}}\,({\it{children\/}}), {\it{parent\/}}, {\it{state\/}})\index{number-not-reported} \\ 
{\bf else }$1\;+$ {\rm{number-not-reported}}\,({\rm{cdr}}\,({\it{children\/}}), {\it{parent\/}}, {\it{state\/}})\index{number-not-reported}$\;${\bf  endif}\- \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{min-of-reported} \\  
\=\+{\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{state\/}}, {\it{min\/}})\index{min-of-reported} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{children\/}}) \\ 
{\bf then }\=\+{\bf if }{\rm{reported}}\,({\rm{car}}\,({\it{children\/}}), {\it{parent\/}}, {\it{state\/}})\index{reported} \\ 
{\bf then }{\rm{min}}\,(\=\+{\rm{found-value}}\,({\rm{car}}\,({\it{children\/}}), {\it{state\/}})\index{found-value}, \\ 
{\rm{min-of-reported}}\,({\rm{cdr}}\,({\it{children\/}}), {\it{parent\/}}, {\it{state\/}}, {\it{min\/}})\index{min-of-reported})\-\index{min} \\ 
{\bf else }{\rm{min-of-reported}}\,({\rm{cdr}}\,({\it{children\/}}), {\it{parent\/}}, {\it{state\/}}, {\it{min\/}})\index{min-of-reported}$\;${\bf  endif}\- \\ 
{\bf else }{\it{min\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{no} \\  
\=\+{\rm{no}}\,({\it{nodes\/}}, {\it{tree\/}}, {\it{state\/}})\index{no} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{nodes\/}}) \\ 
{\bf then }\=\+\=\+{\bf if }{\rm{status}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{started}} \\ 
{\bf then }\=\+(\=\+{\rm{outstanding}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{state\/}})\index{outstanding} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,(\=\+{\rm{children}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{tree\/}})\index{children}, \\ 
{\rm{car}}\,({\it{nodes\/}}), \\ 
{\it{state\/}})\-\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{found-value}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{state\/}})\index{found-value} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,(\=\+{\rm{children}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{tree\/}})\index{children}, \\ 
{\rm{car}}\,({\it{nodes\/}}), \\ 
{\it{state\/}}, \\ 
{\rm{node-value}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{state\/}})\index{node-value})\-\index{min-of-reported})\-\- \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\- \\ 
$\wedge$$\;\;\;\;${\rm{no}}\,({\rm{cdr}}\,({\it{nodes\/}}), {\it{tree\/}}, {\it{state\/}})\index{no}\- \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{down-links-1} \\  
\=\+{\rm{down-links-1}}\,({\it{parent\/}}, {\it{children\/}})\index{down-links-1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{children\/}}) \\ 
{\bf then }{\rm{cons}}\,(\=\+{\rm{cons}}\,({\it{parent\/}}, {\rm{car}}\,({\it{children\/}})), \\ 
{\rm{down-links-1}}\,({\it{parent\/}}, {\rm{cdr}}\,({\it{children\/}}))\index{down-links-1})\- \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{down-links} \\  
\=\+{\rm{down-links}}\,({\it{nodes\/}}, {\it{tree\/}})\index{down-links} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{nodes\/}}) \\ 
{\bf then }{\rm{append}}\,(\=\+{\rm{down-links-1}}\,({\rm{car}}\,({\it{nodes\/}}), {\rm{children}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{tree\/}})\index{children})\index{down-links-1}, \\ 
{\rm{down-links}}\,({\rm{cdr}}\,({\it{nodes\/}}), {\it{tree\/}})\index{down-links})\- \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{up-links} \\  
\=\+{\rm{up-links}}\,({\it{nodes\/}}, {\it{tree\/}})\index{up-links} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{nodes\/}}) \\ 
{\bf then }{\rm{cons}}\,(\=\+{\rm{cons}}\,({\rm{car}}\,({\it{nodes\/}}), {\rm{parent}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{tree\/}})\index{parent}), \\ 
{\rm{up-links}}\,({\rm{cdr}}\,({\it{nodes\/}}), {\it{tree\/}})\index{up-links})\- \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{inv} \\  
\=\+{\rm{inv}}\,({\it{tree\/}}, {\it{state\/}})\index{inv} \\ 
$=$$\;\;\;\;$(\=\+{\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{state\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;${\rm{ul}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\it{state\/}})\index{ul} \\ 
$\wedge$$\;\;\;\;${\rm{no}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{state\/}})\index{no})\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{not-started} \\  
\=\+{\rm{not-started}}\,({\it{nodes\/}}, {\it{state\/}})\index{not-started} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{nodes\/}}) \\ 
{\bf then }\=\+({\rm{status}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{not-started}}) \\ 
$\wedge$$\;\;\;\;${\rm{not-started}}\,({\rm{cdr}}\,({\it{nodes\/}}), {\it{state\/}})\index{not-started}\- \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{all-channels} \\  
\=\+{\rm{all-channels}}\,({\it{tree\/}})\index{all-channels} \\ 
$=$$\;\;\;\;${\rm{append}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links})\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{all-empty} \\  
\=\+{\rm{all-empty}}\,({\it{channels\/}}, {\it{state\/}})\index{all-empty} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{channels\/}}) \\ 
{\bf then }{\rm{empty}}\,({\rm{car}}\,({\it{channels\/}}), {\it{state\/}})\index{empty} $\wedge$ {\rm{all-empty}}\,({\rm{cdr}}\,({\it{channels\/}}), {\it{state\/}})\index{all-empty} \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{min-node-value} \\  
\=\+{\rm{min-node-value}}\,({\it{nodes\/}}, {\it{state\/}}, {\it{min\/}})\index{min-node-value} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{nodes\/}}) \\ 
{\bf then }{\rm{min}}\,(\=\+{\rm{node-value}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{state\/}})\index{node-value}, \\ 
{\rm{min-node-value}}\,({\rm{cdr}}\,({\it{nodes\/}}), {\it{state\/}}, {\it{min\/}})\index{min-node-value})\-\index{min} \\ 
{\bf else }{\it{min\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{correct} \\  
\=\+{\rm{correct}}\,({\it{tree\/}}, {\it{state\/}})\index{correct} \\ 
$=$$\;\;\;\;$(\=\+{\rm{found-value}}\,({\rm{car}}\,({\it{tree\/}}), {\it{state\/}})\index{found-value} \\ 
$=$$\;\;\;\;${\rm{min-node-value}}\,(\=\+{\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), \\ 
{\it{state\/}}, \\ 
{\rm{node-value}}\,({\rm{car}}\,({\it{tree\/}}), {\it{state\/}})\index{node-value})\-\index{min-node-value})\-\-
\end{tabbing}

\begin{verbatim};;; Proof of Correctness

\end{verbatim}\begin{tabbing}{\sc Theorem}:  all-empty-implies-empty \\ \index{all-empty-implies-empty}
\=\+({\rm{all-empty}}\,({\it{channels\/}}, {\it{state\/}})\index{all-empty} $\wedge$ ({\it{channel\/}} $\in$ {\it{channels\/}})) \\ 
$\rightarrow$$\;\;\;\;$($\neg$ {\rm{listp}}\,({\rm{channel}}\,({\it{channel\/}}, {\it{state\/}})\index{channel}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-started-implies-not-started \\ \index{not-started-implies-not-started}
\=\+({\rm{not-started}}\,({\it{nodes\/}}, {\it{state\/}})\index{not-started} $\wedge$ ({\it{node\/}} $\in$ {\it{nodes\/}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{node\/}}), {\it{state\/}})) $=$ {\tt{'}}{\tt{not-started}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-empty-append \\ \index{all-empty-append}
\=\+{\rm{all-empty}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}), {\it{state\/}})\index{all-empty} \\ 
$=$$\;\;\;\;$({\rm{all-empty}}\,({\it{a\/}}, {\it{state\/}})\index{all-empty} $\wedge$ {\rm{all-empty}}\,({\it{b\/}}, {\it{state\/}})\index{all-empty})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-empty-implies-ul \\ \index{all-empty-implies-ul}
{\rm{all-empty}}\,({\it{up-links\/}}, {\it{state\/}})\index{all-empty} $\rightarrow$ {\rm{ul}}\,({\it{up-links\/}}, {\it{state\/}})\index{ul}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{nodes-in-channels} \\  
\=\+{\rm{nodes-in-channels}}\,({\it{channels\/}})\index{nodes-in-channels} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{channels\/}}) \\ 
{\bf then }{\rm{cons}}\,(\=\+{\rm{caar}}\,({\it{channels\/}}), \\ 
{\rm{cons}}\,({\rm{cdar}}\,({\it{channels\/}}), {\rm{nodes-in-channels}}\,({\rm{cdr}}\,({\it{channels\/}}))\index{nodes-in-channels}))\- \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-empty-not-started-implies-dl \\ \index{all-empty-not-started-implies-d!l}
\=\+(\=\+{\rm{all-empty}}\,({\it{down-links\/}}, {\it{state\/}})\index{all-empty} \\ 
$\wedge$$\;\;\;\;${\rm{not-started}}\,({\rm{nodes-in-channels}}\,({\it{down-links\/}})\index{nodes-in-channels}, {\it{state\/}})\index{not-started})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{dl}}\,({\it{down-links\/}}, {\it{state\/}})\index{dl}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-started-implies-no \\ \index{not-started-implies-no}
{\rm{not-started}}\,({\it{nodes\/}}, {\it{state\/}})\index{not-started} $\rightarrow$ {\rm{no}}\,({\it{nodes\/}}, {\it{tree\/}}, {\it{state\/}})\index{no}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  nodes-in-down-links-1-in-nodes \\ \index{nodes-in-down-links-1-in-nodes}
\=\+({\it{node\/}} $\in$ {\rm{nodes-in-channels}}\,({\rm{down-links-1}}\,({\it{parent\/}}, {\it{children\/}})\index{down-links-1})\index{nodes-in-channels}) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{children\/}})$\;\;${\bf then }{\it{node\/}} $\in$ {\rm{cons}}\,({\it{parent\/}}, {\it{children\/}}) \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  nodes-in-channels-append \\ \index{nodes-in-channels-append}
\=\+{\rm{nodes-in-channels}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}))\index{nodes-in-channels} \\ 
$=$$\;\;\;\;${\rm{append}}\,({\rm{nodes-in-channels}}\,({\it{a\/}})\index{nodes-in-channels}, {\rm{nodes-in-channels}}\,({\it{b\/}})\index{nodes-in-channels})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  nodes-in-down-links-in-nodes \\ \index{nodes-in-down-links-in-nodes}
\=\+(\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{nodes-in-channels}}\,({\rm{down-links}}\,({\it{nodes\/}}, {\it{tree\/}})\index{down-links})\index{nodes-in-channels}))\- \\ 
$\rightarrow$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sublistp-not-started \\ \index{sublistp-not-started}
({\rm{sublistp}}\,({\it{sub\/}}, {\it{list\/}})\index{sublistp} $\wedge$ {\rm{not-started}}\,({\it{list\/}}, {\it{state\/}})\index{not-started}) $\rightarrow$ {\rm{not-started}}\,({\it{sub\/}}, {\it{state\/}})\index{not-started}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sublistp-down-links-1 \\ \index{sublistp-down-links-1}
\=\+({\rm{sublistp}}\,({\it{children\/}}, {\it{nodes\/}})\index{sublistp} $\wedge$ ({\it{parent\/}} $\in$ {\it{nodes\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{sublistp}}\,({\rm{nodes-in-channels}}\,({\rm{down-links-1}}\,({\it{parent\/}}, {\it{children\/}})\index{down-links-1})\index{nodes-in-channels}, {\it{nodes\/}})\index{sublistp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  children-of-non-node \\ \index{children-of-non-node}
\=\+({\it{parent\/}} $\not\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec} $=$ {\bf{nil}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  down-links-is-sublistp \\ \index{down-links-is-sublistp}
\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\rightarrow$$\;\;\;\;${\rm{sublistp}}\,(\=\+{\rm{nodes-in-channels}}\,({\rm{down-links}}\,({\it{nodes\/}}, {\it{tree\/}})\index{down-links})\index{nodes-in-channels}, \\ 
{\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})\-\index{sublistp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  initial-conditions-imply-invariant \\ \index{initial-conditions-imply-invari!ant}
\=\+(\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{all-empty}}\,({\rm{all-channels}}\,({\it{tree\/}})\index{all-channels}, {\it{state\/}})\index{all-empty} \\ 
$\wedge$$\;\;\;\;${\rm{not-started}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{state\/}})\index{not-started})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{state\/}})\index{inv}\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{found-value-node-value} \\  
\=\+{\rm{found-value-node-value}}\,({\it{subtrees\/}}, {\it{state\/}})\index{found-value-node-value} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{subtrees\/}}) \\ 
{\bf then }\=\+(\=\+{\rm{found-value}}\,({\rm{caar}}\,({\it{subtrees\/}}), {\it{state\/}})\index{found-value} \\ 
$=$$\;\;\;\;${\rm{min-node-value}}\,(\=\+{\rm{cdr}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\rm{car}}\,({\it{subtrees\/}}))\index{nodes-rec}), \\ 
{\it{state\/}}, \\ 
{\rm{node-value}}\,({\rm{caar}}\,({\it{subtrees\/}}), {\it{state\/}})\index{node-value})\-\index{min-node-value})\- \\ 
$\wedge$$\;\;\;\;${\rm{found-value-node-value}}\,({\rm{cdr}}\,({\it{subtrees\/}}), {\it{state\/}})\index{found-value-node-value}\- \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{nati} \\  
\=\+{\rm{nati}}\,({\it{subtrees\/}})\index{nati} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{subtrees\/}})$\;\;${\bf then }{\rm{nati}}\,({\rm{next-level}}\,({\it{subtrees\/}})\index{next-level})\index{nati} \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  found-value-node-value-append \\ \index{found-value-node-value-append}
\=\+{\rm{found-value-node-value}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}), {\it{state\/}})\index{found-value-node-value} \\ 
$=$$\;\;\;\;$({\rm{found-value-node-value}}\,({\it{a\/}}, {\it{state\/}})\index{found-value-node-value} $\wedge$ {\rm{found-value-node-value}}\,({\it{b\/}}, {\it{state\/}})\index{found-value-node-value})\-
\end{tabbing}

\begin{verbatim};find-value-of-node-value for a subtree is true if
;find-value-of-node-value for the next-level of that subtree is true.

\end{verbatim}\begin{tabbing}{\sc Theorem}:  no-implies \\ \index{no-implies}
\=\+(\=\+{\rm{no}}\,({\it{nodes\/}}, {\it{tree\/}}, {\it{state\/}})\index{no} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\it{nodes\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\it{node\/}}, {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{started}}))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{number-not-reported}}\,({\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}, {\it{node\/}}, {\it{state\/}})\index{number-not-reported} \\ 
$=$$\;\;\;\;${\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}), {\it{state\/}})))\- \\ 
$\wedge$$\;\;\;\;$({\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}), {\it{state\/}})) $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{node\/}}), {\it{state\/}})) \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,(\=\+{\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}, \\ 
{\it{node\/}}, \\ 
{\it{state\/}}, \\ 
{\rm{node-value}}\,({\it{node\/}}, {\it{state\/}})\index{node-value})\-\index{min-of-reported})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  total-outstanding-0-implies \\ \index{total-outstanding-0-implies}
\=\+(\=\+(\=\+({\rm{total-outstanding}}\,({\it{nodes\/}}, {\it{tree\/}}, {\it{state\/}})\index{total-outstanding} $=$ {\tt{0}}) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\it{nodes\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}), {\it{state\/}})) $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}), {\it{state\/}})) $=$ {\tt{0}}))\- \\ 
$\wedge$$\;\;\;\;$(\=\+(({\rm{total-outstanding}}\,({\it{nodes\/}}, {\it{tree\/}}, {\it{state\/}})\index{total-outstanding} $=$ {\tt{0}}) $\wedge$ ({\it{node\/}} $\in$ {\it{nodes\/}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{node\/}}), {\it{state\/}})) $=$ {\tt{'}}{\tt{started}}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  number-not-reported-0-implies \\ \index{number-not-reported-0-implies}
\=\+(({\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{state\/}})\index{number-not-reported} $=$ {\tt{0}}) $\wedge$ ({\it{node\/}} $\in$ {\it{children\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{reported}}\,({\it{node\/}}, {\it{parent\/}}, {\it{state\/}})\index{reported}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  proper-tree-tree-implies-nodes-exists \\ \index{proper-tree-tree-implies-nodes-e!xists}
{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} $\rightarrow$ {\rm{listp}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  min-of-two-nodes-values \\ \index{min-of-two-nodes-values}
\=\+{\rm{min}}\,(\=\+{\rm{min-node-value}}\,(\=\+{\it{forest-1\/}}, \\ 
{\it{state\/}}, \\ 
{\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{node-value}}, {\it{root\/}}), {\it{state\/}})))\-\index{min-node-value}, \\ 
{\rm{min-node-value}}\,({\it{rest-of-forest\/}}, {\it{state\/}}, {\it{min\/}})\index{min-node-value})\-\index{min} \\ 
$=$$\;\;\;\;${\rm{min-node-value}}\,({\rm{cons}}\,({\it{root\/}}, {\rm{append}}\,({\it{forest-1\/}}, {\it{rest-of-forest\/}})), {\it{state\/}}, {\it{min\/}})\index{min-node-value}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  found-value-min-value-generalized \\ \index{found-value-min-value-generalize!d}
\=\+(\=\+{\rm{found-value-node-value}}\,({\it{forest\/}}, {\it{state\/}})\index{found-value-node-value} \\ 
$\wedge$$\;\;\;\;$({\rm{number-not-reported}}\,({\rm{roots}}\,({\it{forest\/}})\index{roots}, {\it{root\/}}, {\it{state\/}})\index{number-not-reported} $=$ {\tt{0}}) \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{forest\/}})\index{proper-tree})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{min-of-reported}}\,({\rm{roots}}\,({\it{forest\/}})\index{roots}, {\it{root\/}}, {\it{state\/}}, {\it{min\/}})\index{min-of-reported} \\ 
$=$$\;\;\;\;${\rm{min-node-value}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{forest\/}})\index{nodes-rec}, {\it{state\/}}, {\it{min\/}})\index{min-node-value})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  no-at-termination \\ \index{no-at-termination}
\=\+(\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{subtrees\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{no}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec}, {\it{tree\/}}, {\it{state\/}})\index{no} \\ 
$\wedge$$\;\;\;\;$({\rm{total-outstanding}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec}, {\it{tree\/}}, {\it{state\/}})\index{total-outstanding} $=$ {\tt{0}}) \\ 
$\wedge$$\;\;\;\;${\rm{sublistp}}\,({\it{subtrees\/}}, {\rm{subtrees}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{subtrees})\index{sublistp})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{found-value-node-value}}\,({\it{subtrees\/}}, {\it{state\/}})\index{found-value-node-value}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  inv-implies-augmented-correctness-condition \\ \index{inv-implies-augmented-correctne!ss-condition}
\=\+(\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{state\/}})\index{inv} \\ 
$\wedge$$\;\;\;\;$({\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{state\/}})\index{total-outstanding} $=$ {\tt{0}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{correct}}\,({\it{tree\/}}, {\it{state\/}})\index{correct}\-
\end{tabbing}


\begin{tabbing}{\sc Definition}:\index{send-find-func} \\  
\=\+{\rm{send-find-func}}\,({\it{to-children\/}}, {\it{old\/}})\index{send-find-func} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{to-children\/}}) \\ 
{\bf then }{\rm{update-assoc}}\,(\=\+{\rm{car}}\,({\it{to-children\/}}), \\ 
{\rm{send}}\,({\rm{car}}\,({\it{to-children\/}}), {\tt{'}}{\tt{find}}, {\it{old\/}})\index{send}, \\ 
{\rm{send-find-func}}\,({\rm{cdr}}\,({\it{to-children\/}}), {\it{old\/}})\index{send-find-func})\-\index{update-assoc} \\ 
{\bf else }{\it{old\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{receive-find-func} \\  
\=\+{\rm{receive-find-func}}\,({\it{old\/}}, {\it{node\/}}, {\it{from-parent\/}}, {\it{to-parent\/}}, {\it{to-children\/}})\index{receive-find-func} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{head}}\,({\it{from-parent\/}}, {\it{old\/}})\index{head} $=$ {\tt{'}}{\tt{find}} \\ 
{\bf then }{\rm{update-assoc}}\,(\=\+{\it{from-parent\/}}, \\ 
{\rm{receive}}\,({\it{from-parent\/}}, {\it{old\/}})\index{receive}, \\ 
{\rm{update-assoc}}\,(\=\+{\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{node\/}}), \\ 
{\tt{'}}{\tt{started}}, \\ 
{\rm{update-assoc}}\,(\=\+{\rm{cons}}\,(\=\+{\tt{'}}{\tt{found-value}}, \\ 
{\it{node\/}})\-, \\ 
{\rm{node-value}}\,({\it{node\/}}, {\it{old\/}})\index{node-value}, \\ 
{\rm{update-assoc}}\,(\=\+{\rm{cons}}\,(\=\+{\tt{'}}{\tt{outstanding}}, \\ 
{\it{node\/}})\-, \\ 
{\rm{length}}\,({\it{to-children\/}})\index{length}, \\ 
\=\+{\bf if }{\rm{length}}\,({\it{to-children\/}})\index{length} $\simeq {\tt{0}}$ \\ 
{\bf then }{\rm{update-assoc}}\,(\=\+{\it{to-parent\/}}, \\ 
{\rm{send}}\,(\=\+{\it{to-parent\/}}, \\ 
{\rm{node-value}}\,(\=\+{\it{node\/}}, \\ 
{\it{old\/}})\-\index{node-value}, \\ 
{\it{old\/}})\-\index{send}, \\ 
{\rm{send-find-func}}\,(\=\+{\it{to-children\/}}, \\ 
{\it{old\/}})\-\index{send-find-func})\-\index{update-assoc} \\ 
{\bf else }{\rm{send-find-func}}\,(\=\+{\it{to-children\/}}, \\ 
{\it{old\/}})\-\index{send-find-func}$\;${\bf  endif}\-)\-\index{update-assoc})\-\index{update-assoc})\-\index{update-assoc})\-\index{update-assoc} \\ 
{\bf else }{\it{old\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  send-find-func-implements-send-find \\ \index{send-find-func-implements-send-!find}
{\rm{send-find}}\,({\it{to-children\/}}, {\it{old\/}}, {\rm{send-find-func}}\,({\it{to-children\/}}, {\it{old\/}})\index{send-find-func})\index{send-find}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  nodes-are-not-litatoms \\ \index{nodes-are-not-litatoms}
\=\+({\rm{all-numberps}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{all-numberps} $\wedge$ ({\it{node\/}} $\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{pack}}\,({\it{x\/}}) $=$ {\it{node\/}}) $=$ {\bf{f}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  parent-is-not-a-litatom \\ \index{parent-is-not-a-litatom}
\=\+(\=\+{\rm{all-numberps}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})\index{all-numberps} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{cdr}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})))\- \\ 
$\rightarrow$$\;\;\;\;$(({\rm{pack}}\,({\it{x\/}}) $=$ {\rm{car}}\,({\rm{parent-rec}}\,({\tt{'}}{\tt{tree}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec})) $=$ {\bf{f}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  children-are-not-litatoms \\ \index{children-are-not-litatoms}
\=\+(\=\+{\rm{all-numberps}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{all-numberps} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec}))\- \\ 
$\rightarrow$$\;\;\;\;$(({\rm{pack}}\,({\it{x\/}}) $=$ {\it{child\/}}) $=$ {\bf{f}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  children-are-not-litatoms-member \\ \index{children-are-not-litatoms-membe!r}
\=\+({\rm{all-numberps}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{all-numberps} $\wedge$ {\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree}) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{pack}}\,({\it{x\/}}) $\in$ {\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec}) $=$ {\bf{f}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  send-find-of-update-assoc \\ \index{send-find-of-update-assoc}
\=\+({\it{key\/}} $\not\in$ {\it{to-children\/}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{send-find}}\,({\it{to-children\/}}, {\it{old\/}}, {\rm{update-assoc}}\,({\it{key\/}}, {\it{value\/}}, {\it{state\/}})\index{update-assoc})\index{send-find} \\ 
$=$$\;\;\;\;${\rm{send-find}}\,({\it{to-children\/}}, {\it{old\/}}, {\it{state\/}})\index{send-find})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  assoc-of-send-find-func \\ \index{assoc-of-send-find-func}
\=\+({\it{key\/}} $\not\in$ {\it{to-children\/}}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{assoc}}\,({\it{key\/}}, {\rm{send-find-func}}\,({\it{to-children\/}}, {\it{old\/}})\index{send-find-func}) $=$ {\rm{assoc}}\,({\it{key\/}}, {\it{old\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  about-rfp \\ \index{about-rfp}
({\it{p\/}} $\not\in$ {\it{c\/}}) $\rightarrow$ ({\rm{cons}}\,({\it{v\/}}, {\it{p\/}}) $\not\in$ {\rm{rfp}}\,({\it{v\/}}, {\it{c\/}})\index{rfp})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  about-rfp-numberp \\ \index{about-rfp-numberp}
({\it{a\/}} $\in\;${\bf{N}}${}$) $\rightarrow$ ({\rm{cons}}\,({\rm{pack}}\,({\it{x\/}}), {\it{y\/}}) $\not\in$ {\rm{rfp}}\,({\it{a\/}}, {\it{b\/}})\index{rfp})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  parent-not-in-rfp \\ \index{parent-not-in-rfp}
\=\+(\=\+{\rm{setp}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;$({\it{v\/}} $\in$ {\rm{cdr}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{cons}}\,({\it{v\/}}, {\rm{car}}\,({\rm{parent-rec}}\,({\tt{'}}{\tt{tree}}, {\it{v\/}}, {\it{tree\/}})\index{parent-rec})) \\ 
$\not\in$$\;\;\;\;${\rm{rfp}}\,({\it{v\/}}, {\rm{children-rec}}\,({\tt{'}}{\tt{tree}}, {\it{v\/}}, {\it{tree\/}})\index{children-rec})\index{rfp})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  to-node-not-in-rfp \\ \index{to-node-not-in-rfp}
({\it{node\/}} $\not\in$ {\it{children\/}}) $\rightarrow$ ({\rm{cons}}\,({\it{x\/}}, {\it{node\/}}) $\not\in$ {\rm{rfp}}\,({\it{node\/}}, {\it{children\/}})\index{rfp})
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  uc-of-send-find-func \\ \index{uc-of-send-find-func}
\=\+{\rm{sublistp}}\,({\it{to-children\/}}, {\it{excpt\/}})\index{sublistp} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{uc}}\,({\it{old\/}}, {\rm{send-find-func}}\,({\it{to-children\/}}, {\it{state\/}})\index{send-find-func}, {\it{keys\/}}, {\it{excpt\/}})\index{uc} \\ 
$=$$\;\;\;\;${\rm{uc}}\,({\it{old\/}}, {\it{state\/}}, {\it{keys\/}}, {\it{excpt\/}})\index{uc})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  receive-find-func-implements-receive-find \\ \index{receive-find-func-implements-re!ceive-find}
\=\+({\rm{treep}}\,({\it{tree\/}})\index{treep} $\wedge$ ({\it{statement\/}} $\in$ {\rm{receive-find-prg}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{receive-find-prg})) \\ 
$\rightarrow$$\;\;\;\;${\rm{n}}\,(\=\+{\it{old\/}}, \\ 
{\rm{receive-find-func}}\,(\=\+{\it{old\/}}, \\ 
{\rm{cadr}}\,({\it{statement\/}}), \\ 
{\rm{caddr}}\,({\it{statement\/}}), \\ 
{\rm{cadddr}}\,({\it{statement\/}}), \\ 
{\rm{caddddr}}\,({\it{statement\/}}))\-\index{receive-find-func}, \\ 
{\it{statement\/}})\-\index{n}\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{receive-report-func} \\  
\=\+{\rm{receive-report-func}}\,({\it{old\/}}, {\it{node\/}}, {\it{from-child\/}}, {\it{to-parent\/}})\index{receive-report-func} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{empty}}\,({\it{from-child\/}}, {\it{old\/}})\index{empty}$\;\;${\bf then }{\it{old\/}} \\ 
{\bf else }{\rm{update-assoc}}\,(\=\+{\it{from-child\/}}, \\ 
{\rm{receive}}\,({\it{from-child\/}}, {\it{old\/}})\index{receive}, \\ 
{\rm{update-assoc}}\,(\=\+{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{node\/}}), \\ 
{\rm{min}}\,(\=\+{\rm{found-value}}\,({\it{node\/}}, {\it{old\/}})\index{found-value}, \\ 
{\rm{head}}\,({\it{from-child\/}}, {\it{old\/}})\index{head})\-\index{min}, \\ 
{\rm{update-assoc}}\,(\=\+{\rm{cons}}\,(\=\+{\tt{'}}{\tt{outstanding}}, \\ 
{\it{node\/}})\-, \\ 
{\rm{outstanding}}\,(\=\+{\it{node\/}}, \\ 
{\it{old\/}})\-\index{outstanding} $-\;1$, \\ 
\=\+{\bf if }({\rm{outstanding}}\,(\=\+{\it{node\/}}, \\ 
{\it{old\/}})\-\index{outstanding} $-\;1$) $\simeq {\tt{0}}$ \\ 
{\bf then }{\rm{update-assoc}}\,(\=\+{\it{to-parent\/}}, \\ 
{\rm{send}}\,(\=\+{\it{to-parent\/}}, \\ 
{\rm{min}}\,(\=\+{\rm{found-value}}\,(\=\+{\it{node\/}}, \\ 
{\it{old\/}})\-\index{found-value}, \\ 
{\rm{head}}\,(\=\+{\it{from-child\/}}, \\ 
{\it{old\/}})\-\index{head})\-\index{min}, \\ 
{\it{old\/}})\-\index{send}, \\ 
{\it{old\/}})\-\index{update-assoc} \\ 
{\bf else }{\it{old\/}}$\;${\bf  endif}\-)\-\index{update-assoc})\-\index{update-assoc})\-\index{update-assoc}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  receive-report-func-implements-receive-report \\ \index{receive-report-func-implements-!receive-report}
\=\+({\rm{treep}}\,({\it{tree\/}})\index{treep} $\wedge$ ({\it{statement\/}} $\in$ {\rm{receive-report-prg}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{receive-report-prg})) \\ 
$\rightarrow$$\;\;\;\;${\rm{n}}\,(\=\+{\it{old\/}}, \\ 
{\rm{receive-report-func}}\,(\=\+{\it{old\/}}, \\ 
{\rm{cadr}}\,({\it{statement\/}}), \\ 
{\rm{caddr}}\,({\it{statement\/}}), \\ 
{\rm{cadddr}}\,({\it{statement\/}}))\-\index{receive-report-func}, \\ 
{\it{statement\/}})\-\index{n}\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{start-func} \\  
\=\+{\rm{start-func}}\,({\it{old\/}}, {\it{root\/}}, {\it{to-children\/}})\index{start-func} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{status}}\,({\it{root\/}}, {\it{old\/}})\index{status} $=$ {\tt{'}}{\tt{not-started}} \\ 
{\bf then }{\rm{update-assoc}}\,(\=\+{\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{root\/}}), \\ 
{\tt{'}}{\tt{started}}, \\ 
{\rm{update-assoc}}\,(\=\+{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{root\/}}), \\ 
{\rm{node-value}}\,({\it{root\/}}, {\it{old\/}})\index{node-value}, \\ 
{\rm{update-assoc}}\,(\=\+{\rm{cons}}\,(\=\+{\tt{'}}{\tt{outstanding}}, \\ 
{\it{root\/}})\-, \\ 
{\rm{length}}\,({\it{to-children\/}})\index{length}, \\ 
{\rm{send-find-func}}\,(\=\+{\it{to-children\/}}, \\ 
{\it{old\/}})\-\index{send-find-func})\-\index{update-assoc})\-\index{update-assoc})\-\index{update-assoc} \\ 
{\bf else }{\it{old\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  start-func-implements-start \\ \index{start-func-implements-start}
\=\+({\rm{treep}}\,({\it{tree\/}})\index{treep} $\wedge$ ({\it{statement\/}} $\in$ {\rm{start-prg}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{start-prg})) \\ 
$\rightarrow$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\rm{start-func}}\,({\it{old\/}}, {\rm{cadr}}\,({\it{statement\/}}), {\rm{caddr}}\,({\it{statement\/}}))\index{start-func}, {\it{statement\/}})\index{n}\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{root-receive-report-func} \\  
\=\+{\rm{root-receive-report-func}}\,({\it{old\/}}, {\it{root\/}}, {\it{from-child\/}})\index{root-receive-report-func} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{empty}}\,({\it{from-child\/}}, {\it{old\/}})\index{empty}$\;\;${\bf then }{\it{old\/}} \\ 
{\bf else }{\rm{update-assoc}}\,(\=\+{\it{from-child\/}}, \\ 
{\rm{receive}}\,({\it{from-child\/}}, {\it{old\/}})\index{receive}, \\ 
{\rm{update-assoc}}\,(\=\+{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{root\/}}), \\ 
{\rm{min}}\,(\=\+{\rm{found-value}}\,({\it{root\/}}, {\it{old\/}})\index{found-value}, \\ 
{\rm{head}}\,({\it{from-child\/}}, {\it{old\/}})\index{head})\-\index{min}, \\ 
{\rm{update-assoc}}\,(\=\+{\rm{cons}}\,(\=\+{\tt{'}}{\tt{outstanding}}, \\ 
{\it{root\/}})\-, \\ 
{\rm{outstanding}}\,(\=\+{\it{root\/}}, \\ 
{\it{old\/}})\-\index{outstanding} $-\;1$, \\ 
{\it{old\/}})\-\index{update-assoc})\-\index{update-assoc})\-\index{update-assoc}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  root-receive-report-func-implements-root-receive-report \\ \index{root-receive-report-func-impleme!nts-root-receive-report}
\=\+({\rm{treep}}\,({\it{tree\/}})\index{treep} $\wedge$ ({\it{statement\/}} $\in$ {\rm{root-receive-report-prg}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{root-receive-report-prg})) \\ 
$\rightarrow$$\;\;\;\;${\rm{n}}\,(\=\+{\it{old\/}}, \\ 
{\rm{root-receive-report-func}}\,({\it{old\/}}, {\rm{cadr}}\,({\it{statement\/}}), {\rm{caddr}}\,({\it{statement\/}}))\index{root-receive-report-func}, \\ 
{\it{statement\/}})\-\index{n}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  receive-find-prg-is-total \\ \index{receive-find-prg-is-total}
\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\rightarrow$$\;\;\;\;${\rm{total-sufficient}}\,(\=\+{\it{statement\/}}, \\ 
{\rm{receive-find-prg}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{receive-find-prg}, \\ 
{\it{old\/}}, \\ 
{\rm{receive-find-func}}\,(\=\+{\it{old\/}}, \\ 
{\rm{cadr}}\,({\it{statement\/}}), \\ 
{\rm{caddr}}\,({\it{statement\/}}), \\ 
{\rm{cadddr}}\,({\it{statement\/}}), \\ 
{\rm{caddddr}}\,({\it{statement\/}}))\-\index{receive-find-func})\-\index{total-sufficient}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  receive-report-prg-is-total \\ \index{receive-report-prg-is-total}
\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\rightarrow$$\;\;\;\;${\rm{total-sufficient}}\,(\=\+{\it{statement\/}}, \\ 
{\rm{receive-report-prg}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{receive-report-prg}, \\ 
{\it{old\/}}, \\ 
{\rm{receive-report-func}}\,(\=\+{\it{old\/}}, \\ 
{\rm{cadr}}\,({\it{statement\/}}), \\ 
{\rm{caddr}}\,({\it{statement\/}}), \\ 
{\rm{cadddr}}\,({\it{statement\/}}))\-\index{receive-report-func})\-\index{total-sufficient}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  start-prg-is-total \\ \index{start-prg-is-total}
\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\rightarrow$$\;\;\;\;${\rm{total-sufficient}}\,(\=\+{\it{statement\/}}, \\ 
{\rm{start-prg}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{start-prg}, \\ 
{\it{old\/}}, \\ 
{\rm{start-func}}\,({\it{old\/}}, {\rm{cadr}}\,({\it{statement\/}}), {\rm{caddr}}\,({\it{statement\/}}))\index{start-func})\-\index{total-sufficient}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  root-receive-report-prg-is-total \\ \index{root-receive-report-prg-is-tota!l}
\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\rightarrow$$\;\;\;\;${\rm{total-sufficient}}\,(\=\+{\it{statement\/}}, \\ 
{\rm{root-receive-report-prg}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{root-receive-report-prg}, \\ 
{\it{old\/}}, \\ 
{\rm{root-receive-report-func}}\,(\=\+{\it{old\/}}, \\ 
{\rm{cadr}}\,({\it{statement\/}}), \\ 
{\rm{caddr}}\,({\it{statement\/}}))\-\index{root-receive-report-func})\-\index{total-sufficient}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  total-tree-prg \\ \index{total-tree-prg}
{\rm{treep}}\,({\it{tree\/}})\index{treep} $\rightarrow$ {\rm{total}}\,({\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\index{total}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  listp-tree-prg \\ \index{listp-tree-prg}
{\rm{listp}}\,({\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  node-values-constant-unless-sufficient \\ \index{node-values-constant-unless-suf!ficient}
\=\+({\rm{treep}}\,({\it{tree\/}})\index{treep} $\wedge$ ({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\rightarrow$$\;\;\;\;${\rm{unless-sufficient}}\,(\=\+{\it{statement\/}}, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}, \\ 
{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\tt{`}}{\tt{(}}{\tt{equal}}{\tt{ }}{\tt{(}}{\tt{node-value}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{node}}{\tt{ }}{\tt{state}}{\tt{)}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{k}}{\tt{)}}, \\ 
{\tt{'}}{\tt{(}}{\tt{false}}{\tt{)}})\-\index{unless-sufficient}\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  node-values-constant-invariant \\ \index{node-values-constant-invariant}
\=\+(\=\+{\rm{initial-condition}}\,(\=\+{\tt{`}}{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}{\tt{all-empty}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{all-channels}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}} \\ 
{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}{\tt{not-started}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}} \\ 
{\tt{(}}{\tt{equal}}{\tt{ }}{\tt{(}}{\tt{node-value}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{node}}{\tt{ }}{\tt{state}}{\tt{)}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{k}}{\tt{)}}{\tt{)}}\-{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{initial-condition} \\ 
$\wedge$$\;\;\;\;${\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{invariant}}\,(\=\+{\tt{`}}{\tt{(}}{\tt{equal}}{\tt{ }}{\tt{(}}{\tt{node-value}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{node}}{\tt{ }}{\tt{state}}{\tt{)}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{k}}{\tt{)}}, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{invariant}\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  dl-implies-instance-of-dl \\ \index{dl-implies-instance-of-dl}
\=\+({\rm{dl}}\,({\it{down-links\/}}, {\it{state\/}})\index{dl} $\wedge$ ({\it{down-link\/}} $\in$ {\it{down-links\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{empty}}\,({\it{down-link\/}}, {\it{state\/}})\index{empty} \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{status}}\,({\rm{car}}\,({\it{down-link\/}}), {\it{state\/}})\index{status} \\ 
$=$$\;\;\;\;${\rm{status}}\,({\rm{cdr}}\,({\it{down-link\/}}), {\it{state\/}})\index{status})\-)\- \\ 
$\vee$$\;\;\;\;$(\=\+({\rm{channel}}\,({\it{down-link\/}}, {\it{state\/}})\index{channel} $=$ {\rm{list}}\,({\tt{'}}{\tt{find}})) \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\rm{car}}\,({\it{down-link\/}}), {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\rm{cdr}}\,({\it{down-link\/}}), {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{not-started}}))\-)\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable dl-implies-instance-of-dl.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  ul-implies-instance-of-ul \\ \index{ul-implies-instance-of-ul}
\=\+({\rm{ul}}\,({\it{uplinks\/}}, {\it{state\/}})\index{ul} $\wedge$ ({\it{uplink\/}} $\in$ {\it{uplinks\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{empty}}\,({\it{uplink\/}}, {\it{state\/}})\index{empty} \\ 
$\vee$$\;\;\;\;$(\=\+(\=\+{\rm{channel}}\,({\it{uplink\/}}, {\it{state\/}})\index{channel} \\ 
$=$$\;\;\;\;${\rm{list}}\,({\rm{found-value}}\,({\rm{car}}\,({\it{uplink\/}}), {\it{state\/}})\index{found-value}))\- \\ 
$\wedge$$\;\;\;\;${\rm{done}}\,({\rm{car}}\,({\it{uplink\/}}), {\it{state\/}})\index{done})\-)\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable ul-implies-instance-of-ul.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  ul-implies-instance-of-ul-not-empty-uplink \\ \index{ul-implies-instance-of-ul-not-e!mpty-uplink}
\=\+({\rm{ul}}\,({\it{uplinks\/}}, {\it{state\/}})\index{ul} $\wedge$ ({\it{uplink\/}} $\in$ {\it{uplinks\/}}) $\wedge$ ($\neg$ {\rm{empty}}\,({\it{uplink\/}}, {\it{state\/}})\index{empty})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+({\rm{cdr}}\,({\rm{assoc}}\,({\it{uplink\/}}, {\it{state\/}})) $=$ {\rm{list}}\,({\rm{found-value}}\,({\rm{car}}\,({\it{uplink\/}}), {\it{state\/}})\index{found-value})) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{status}}, {\rm{car}}\,({\it{uplink\/}})), {\it{state\/}})) \\ 
$=$$\;\;\;\;${\tt{'}}{\tt{started}})\- \\ 
$\wedge$$\;\;\;\;$({\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\rm{car}}\,({\it{uplink\/}})), {\it{state\/}})) $\simeq {\tt{0}}$))\-\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  no-implies-instance-of-no \\ \index{no-implies-instance-of-no}
\=\+(\=\+{\rm{no}}\,({\it{nodes\/}}, {\it{tree\/}}, {\it{state\/}})\index{no} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\it{nodes\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\it{node\/}}, {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{started}}))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}), {\it{state\/}})) \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,(\=\+{\rm{children-rec}}\,({\tt{'}}{\tt{tree}}, {\it{node\/}}, {\it{tree\/}})\index{children-rec}, \\ 
{\it{node\/}}, \\ 
{\it{state\/}})\-\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{node\/}}), {\it{state\/}})) \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,(\=\+{\rm{children-rec}}\,({\tt{'}}{\tt{tree}}, {\it{node\/}}, {\it{tree\/}})\index{children-rec}, \\ 
{\it{node\/}}, \\ 
{\it{state\/}}, \\ 
{\rm{node-value}}\,({\it{node\/}}, {\it{state\/}})\index{node-value})\-\index{min-of-reported})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-down-links-1 \\ \index{member-down-links-1}
\=\+({\it{down-link\/}} $\in$ {\rm{down-links-1}}\,({\it{parent\/}}, {\it{children\/}})\index{down-links-1}) \\ 
$=$$\;\;\;\;$(\=\+({\rm{car}}\,({\it{down-link\/}}) $=$ {\it{parent\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdr}}\,({\it{down-link\/}}) $\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\it{down-link\/}}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-down-links \\ \index{member-down-links}
\=\+({\it{down-link\/}} $\in$ {\rm{down-links}}\,({\it{nodes\/}}, {\it{tree\/}})\index{down-links}) \\ 
$=$$\;\;\;\;$(\=\+({\rm{car}}\,({\it{down-link\/}}) $\in$ {\it{nodes\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdr}}\,({\it{down-link\/}}) $\in$ {\rm{children}}\,({\rm{car}}\,({\it{down-link\/}}), {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\it{down-link\/}}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  parent-not-child \\ \index{parent-not-child}
\=\+({\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} $\wedge$ {\rm{setp}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{setp}) \\ 
$\rightarrow$$\;\;\;\;$({\it{parent\/}} $\not\in$ {\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  parent-not-grandchild \\ \index{parent-not-grandchild}
\=\+(\=\+{\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec}))\- \\ 
$\rightarrow$$\;\;\;\;$({\it{parent\/}} $\not\in$ {\rm{children-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{children-rec})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  parent-of-parent-not-node \\ \index{parent-of-parent-not-node}
\=\+(\=\+{\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{node\/}}, {\it{tree\/}})\index{parent-rec}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\rm{car}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{node\/}}, {\it{tree\/}})\index{parent-rec}), {\it{tree\/}})\index{parent-rec}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{car}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\rm{car}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{node\/}}, {\it{tree\/}})\index{parent-rec}), {\it{tree\/}})\index{parent-rec}) $\not=$ {\it{node\/}})\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  member-rfp \\ \index{member-rfp}
\=\+({\it{channel\/}} $\in$ {\rm{rfp}}\,({\it{parent\/}}, {\it{children\/}})\index{rfp}) \\ 
$=$$\;\;\;\;$(\=\+({\rm{car}}\,({\it{channel\/}}) $=$ {\it{parent\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdr}}\,({\it{channel\/}}) $\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\it{channel\/}}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  send-find-implies \\ \index{send-find-implies}
\=\+({\rm{send-find}}\,({\it{channels\/}}, {\it{old\/}}, {\it{new\/}})\index{send-find} $\wedge$ ({\it{key\/}} $\in$ {\it{channels\/}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{cdr}}\,({\rm{assoc}}\,({\it{key\/}}, {\it{new\/}})) $=$ {\rm{send}}\,({\it{key\/}}, {\tt{'}}{\tt{find}}, {\it{old\/}})\index{send})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  assoc-of-channel-preserved-root-receive-report \\ \index{assoc-of-channel-preserved-root!-receive-report}
\=\+(\=\+({\it{w\/}} $\not\in$ {\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{d\/}})\index{nodes-rec}) \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{d\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;$({\it{z\/}} $\in$ {\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{d\/}})\index{nodes-rec}) \\ 
$\wedge$$\;\;\;\;${\rm{uc}}\,(\=\+{\it{new\/}}, \\ 
{\it{old\/}}, \\ 
{\rm{append}}\,({\rm{strip-cars}}\,({\it{new\/}}), {\rm{strip-cars}}\,({\it{old\/}})), \\ 
{\rm{list}}\,({\rm{cons}}\,({\it{v\/}}, {\it{w\/}}), {\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{w\/}}), {\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{w\/}})))\-\index{uc})\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{assoc}}\,({\rm{cons}}\,({\it{x\/}}, {\it{z\/}}), {\it{new\/}}) $=$ {\rm{assoc}}\,({\rm{cons}}\,({\it{x\/}}, {\it{z\/}}), {\it{old\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  assoc-equal-cons \\ \index{assoc-equal-cons}
\=\+({\rm{assoc}}\,({\it{key\/}}, {\it{alist\/}}) $=$ {\rm{cons}}\,({\it{key\/}}, {\it{value\/}})) \\ 
$=$$\;\;\;\;$({\rm{listp}}\,({\rm{assoc}}\,({\it{key\/}}, {\it{alist\/}})) $\wedge$ ({\rm{cdr}}\,({\rm{assoc}}\,({\it{key\/}}, {\it{alist\/}})) $=$ {\it{value\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  send-find-general \\ \index{send-find-general}
\=\+({\rm{send-find}}\,({\it{channels\/}}, {\it{old\/}}, {\it{new\/}})\index{send-find} $\wedge$ ({\it{key\/}} $\in$ {\it{channels\/}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{assoc}}\,({\it{key\/}}, {\it{new\/}}) $=$ {\rm{cons}}\,({\it{key\/}}, {\rm{send}}\,({\it{key\/}}, {\tt{'}}{\tt{find}}, {\it{old\/}})\index{send}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-numberps-do-not-contain-litatom \\ \index{all-numberps-do-not-contain-lit!atom}
{\rm{all-numberps}}\,({\it{list\/}})\index{all-numberps} $\rightarrow$ ({\rm{pack}}\,({\it{x\/}}) $\not\in$ {\it{list\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-numberps-append \\ \index{all-numberps-append}
{\rm{all-numberps}}\,({\rm{append}}\,({\it{x\/}}, {\it{y\/}}))\index{all-numberps} $=$ ({\rm{all-numberps}}\,({\it{x\/}})\index{all-numberps} $\wedge$ {\rm{all-numberps}}\,({\it{y\/}})\index{all-numberps})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-numberps-nodes-implies-all-numberps-parent \\ \index{all-numberps-nodes-implies-all-!numberps-parent}
\=\+{\rm{all-numberps}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{all-numberps} \\ 
$\rightarrow$$\;\;\;\;${\rm{all-numberps}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec})\index{all-numberps}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-numberps-nodes-implies-all-numberps-car-parent \\ \index{all-numberps-nodes-implies-all-!numberps-car-parent}
\=\+{\rm{all-numberps}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{all-numberps} \\ 
$\rightarrow$$\;\;\;\;$({\rm{car}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec}) $\in\;${\bf{N}}${}$)\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  parent-not-litatom \\ \index{parent-not-litatom}
\=\+{\rm{all-numberps}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{all-numberps} \\ 
$\rightarrow$$\;\;\;\;$(({\rm{pack}}\,({\it{x\/}}) $=$ {\rm{car}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{child\/}}, {\it{tree\/}})\index{parent-rec})) $=$ {\bf{f}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-numberps-forest-implies-all-numberps-roots \\ \index{all-numberps-forest-implies-all!-numberps-roots}
{\rm{all-numberps}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{forest\/}})\index{nodes-rec})\index{all-numberps} $\rightarrow$ {\rm{all-numberps}}\,({\rm{roots}}\,({\it{forest\/}})\index{roots})\index{all-numberps}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-numberps-nodes-implies-all-numberps-children \\ \index{all-numberps-nodes-implies-all-!numberps-children}
\=\+{\rm{all-numberps}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{all-numberps} \\ 
$\rightarrow$$\;\;\;\;${\rm{all-numberps}}\,({\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec})\index{all-numberps}\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  dl-preserves-instance-of-dl \\ \index{dl-preserves-instance-of-dl}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{down-link\/}} $\in$ {\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{empty}}\,({\it{down-link\/}}, {\it{new\/}})\index{empty} \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\rm{car}}\,({\it{down-link\/}}), {\it{new\/}})\index{status} $=$ {\rm{status}}\,({\rm{cdr}}\,({\it{down-link\/}}), {\it{new\/}})\index{status}))\- \\ 
$\vee$$\;\;\;\;$(\=\+({\rm{channel}}\,({\it{down-link\/}}, {\it{new\/}})\index{channel} $=$ {\rm{list}}\,({\tt{'}}{\tt{find}})) \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\rm{car}}\,({\it{down-link\/}}), {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\rm{cdr}}\,({\it{down-link\/}}), {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{not-started}}))\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  dl-preserves-sublist \\ \index{dl-preserves-sublist}
\=\+(\=\+{\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;${\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{sublistp}}\,({\it{sublist\/}}, {\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links})\index{sublistp})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{dl}}\,({\it{sublist\/}}, {\it{new\/}})\index{dl}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  dl-preserves-dl \\ \index{dl-preserves-dl}
\=\+(\=\+{\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;${\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{new\/}})\index{dl}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-up-links \\ \index{member-up-links}
\=\+({\it{up-link\/}} $\in$ {\rm{up-links}}\,({\it{nodes\/}}, {\it{tree\/}})\index{up-links}) \\ 
$=$$\;\;\;\;$(\=\+({\rm{car}}\,({\it{up-link\/}}) $\in$ {\it{nodes\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cdr}}\,({\it{up-link\/}}) $=$ {\rm{parent}}\,({\rm{car}}\,({\it{up-link\/}}), {\it{tree\/}})\index{parent}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\it{up-link\/}}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  zero-not-reported-implies-children-reported \\ \index{zero-not-reported-implies-child!ren-reported}
\=\+(({\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{state\/}})\index{number-not-reported} $\simeq {\tt{0}}$) $\wedge$ ({\it{child\/}} $\in$ {\it{children\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+({\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{child\/}}), {\it{state\/}})) $=$ {\tt{'}}{\tt{started}}) \\ 
$\wedge$$\;\;\;\;$({\rm{outstanding}}\,({\it{child\/}}, {\it{state\/}})\index{outstanding} $\simeq {\tt{0}}$) \\ 
$\wedge$$\;\;\;\;$($\neg$ {\rm{listp}}\,({\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\it{child\/}}, {\it{parent\/}}), {\it{state\/}})))))\-\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  dl-ul-no-preserves-instance-of-ul \\ \index{dl-ul-no-preserves-instance-of-!ul}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{up-link\/}} $\in$ {\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;${\rm{ul}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\it{old\/}})\index{ul} \\ 
$\wedge$$\;\;\;\;${\rm{no}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{no})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{empty}}\,({\it{up-link\/}}, {\it{new\/}})\index{empty} \\ 
$\vee$$\;\;\;\;$(\=\+(\=\+{\rm{channel}}\,({\it{up-link\/}}, {\it{new\/}})\index{channel} \\ 
$=$$\;\;\;\;${\rm{list}}\,({\rm{found-value}}\,({\rm{car}}\,({\it{up-link\/}}), {\it{new\/}})\index{found-value}))\- \\ 
$\wedge$$\;\;\;\;${\rm{done}}\,({\rm{car}}\,({\it{up-link\/}}), {\it{new\/}})\index{done})\-)\-\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  dl-ul-no-preserves-ul-sublist \\ \index{dl-ul-no-preserves-ul-sublist}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;${\rm{ul}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\it{old\/}})\index{ul} \\ 
$\wedge$$\;\;\;\;${\rm{no}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{no} \\ 
$\wedge$$\;\;\;\;${\rm{sublistp}}\,({\it{sublist\/}}, {\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links})\index{sublistp})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{ul}}\,({\it{sublist\/}}, {\it{new\/}})\index{ul}\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  dl-ul-no-preserves-ul \\ \index{dl-ul-no-preserves-ul}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;${\rm{ul}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\it{old\/}})\index{ul} \\ 
$\wedge$$\;\;\;\;${\rm{no}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{no})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{ul}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\it{new\/}})\index{ul}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  parent-not-started-implies-all-empty-and-not-started \\ \index{parent-not-started-implies-all-e!mpty-and-not-started}
\=\+(\=\+({\rm{status}}\,({\it{parent\/}}, {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{not-started}}) \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{rfp}}\,({\it{parent\/}}, {\it{children\/}})\index{rfp}, {\it{state\/}})\index{dl})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{all-empty}}\,({\rm{rfp}}\,({\it{parent\/}}, {\it{children\/}})\index{rfp}, {\it{state\/}})\index{all-empty} \\ 
$\wedge$$\;\;\;\;${\rm{not-started}}\,({\it{children\/}}, {\it{state\/}})\index{not-started})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  start-preserves-no-for-parent \\ \index{start-preserves-no-for-parent}
\=\+(\=\+({\it{parent\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\not\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{not-started}}\,({\it{children\/}}, {\it{old\/}})\index{not-started} \\ 
$\wedge$$\;\;\;\;${\rm{sublistp}}\,({\rm{rfp}}\,({\it{parent\/}}, {\it{children\/}})\index{rfp}, {\rm{rfp}}\,({\it{parent\/}}, {\it{excpt\/}})\index{rfp})\index{sublistp} \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{append}}\,(\=\+{\rm{list}}\,(\=\+{\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{parent\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{parent\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{parent\/}}))\-, \\ 
{\rm{rfp}}\,({\it{parent\/}}, {\it{excpt\/}})\index{rfp})\-)\-\index{changed})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+({\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}})\index{number-not-reported} $=$ {\rm{length}}\,({\it{children\/}})\index{length}) \\ 
$\wedge$$\;\;\;\;$({\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}}, {\it{value\/}})\index{min-of-reported} $=$ {\it{value\/}}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  unchanged-preserves-no \\ \index{unchanged-preserves-no}
\=\+{\rm{changed}}\,({\it{old\/}}, {\it{new\/}}, {\bf{nil}})\index{changed} \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}})\index{number-not-reported} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}})\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}}, {\it{value\/}})\index{min-of-reported} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}}, {\it{value\/}})\index{min-of-reported})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  start-preserves-no-for-rest-of-tree \\ \index{start-preserves-no-for-rest-of-t!ree}
\=\+(\=\+({\it{root\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\not\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{root\/}} $\not\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{root\/}} $\not=$ {\it{parent\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{append}}\,(\=\+{\rm{list}}\,(\=\+{\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{root\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{root\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{root\/}}))\-, \\ 
{\rm{rfp}}\,({\it{root\/}}, {\it{excpt\/}})\index{rfp})\-)\-\index{changed})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}})\index{number-not-reported} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}})\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}}, {\it{value\/}})\index{min-of-reported} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}}, {\it{value\/}})\index{min-of-reported})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  length-rfp \\ \index{length-rfp}
{\rm{length}}\,({\rm{rfp}}\,({\it{parent\/}}, {\it{children\/}})\index{rfp})\index{length} $=$ {\rm{length}}\,({\it{children\/}})\index{length}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  start-preserves-instance-of-no \\ \index{start-preserves-instance-of-no}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{start}}\,({\it{old\/}}, {\it{new\/}}, {\rm{car}}\,({\it{tree\/}}), {\rm{rfp}}\,({\rm{car}}\,({\it{tree\/}}), {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children})\index{rfp})\index{start} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}) \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{rfp}}\,({\rm{car}}\,({\it{tree\/}}), {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children})\index{rfp}, {\it{old\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\it{node\/}}, {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\wedge$$\;\;\;\;$(\=\+({\rm{status}}\,({\it{node\/}}, {\it{old\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{outstanding}}\,({\it{node\/}}, {\it{old\/}})\index{outstanding} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,({\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}, {\it{node\/}}, {\it{old\/}})\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{found-value}}\,({\it{node\/}}, {\it{old\/}})\index{found-value} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,(\=\+{\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}, \\ 
{\it{node\/}}, \\ 
{\it{old\/}}, \\ 
{\rm{node-value}}\,({\it{node\/}}, {\it{old\/}})\index{node-value})\-\index{min-of-reported})\-)\-)\-)\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{outstanding}}\,({\it{node\/}}, {\it{new\/}})\index{outstanding} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,({\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}, {\it{node\/}}, {\it{new\/}})\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{found-value}}\,({\it{node\/}}, {\it{new\/}})\index{found-value} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,(\=\+{\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}, \\ 
{\it{node\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{node-value}}\,({\it{node\/}}, {\it{new\/}})\index{node-value})\-\index{min-of-reported})\-)\-\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  min-commutative \\ \index{min-commutative}
{\rm{min}}\,({\it{a\/}}, {\it{b\/}})\index{min} $=$ {\rm{min}}\,({\it{b\/}}, {\it{a\/}})\index{min}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  min-associative \\ \index{min-associative}
{\rm{min}}\,({\rm{min}}\,({\it{a\/}}, {\it{b\/}})\index{min}, {\it{c\/}})\index{min} $=$ {\rm{min}}\,({\it{a\/}}, {\rm{min}}\,({\it{b\/}}, {\it{c\/}})\index{min})\index{min}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  min-commutative-1 \\ \index{min-commutative-1}
{\rm{min}}\,({\it{a\/}}, {\rm{min}}\,({\it{b\/}}, {\it{c\/}})\index{min})\index{min} $=$ {\rm{min}}\,({\it{b\/}}, {\rm{min}}\,({\it{a\/}}, {\it{c\/}})\index{min})\index{min}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  min-of-reported-of-min \\ \index{min-of-reported-of-min}
\=\+{\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{state\/}}, {\rm{min}}\,({\it{value\/}}, {\it{x\/}})\index{min})\index{min-of-reported} \\ 
$=$$\;\;\;\;${\rm{min}}\,({\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{state\/}}, {\it{value\/}})\index{min-of-reported}, {\it{x\/}})\index{min}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  update-min-of-reported \\ \index{update-min-of-reported}
\=\+(\=\+({\it{parent\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\not=$ {\it{child\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{all-numberps}}\,({\it{children\/}})\index{all-numberps} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\it{children\/}})\index{setp} \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\not\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\it{parent\/}}), {\it{old\/}})\index{channel} $=$ {\rm{list}}\,({\rm{found-value}}\,({\it{child\/}}, {\it{old\/}})\index{found-value})) \\ 
$\wedge$$\;\;\;\;${\rm{done}}\,({\it{child\/}}, {\it{old\/}})\index{done} \\ 
$\wedge$$\;\;\;\;$({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\it{parent\/}}), {\it{new\/}})\index{channel} $=$ {\rm{receive}}\,({\rm{cons}}\,({\it{child\/}}, {\it{parent\/}}), {\it{old\/}})\index{receive}) \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,(\=\+{\rm{cons}}\,({\it{child\/}}, {\it{parent\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{parent\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{parent\/}}))\-)\-\index{changed})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}}, {\it{value\/}})\index{min-of-reported} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{child\/}} $\in$ {\it{children\/}} \\ 
{\bf then }{\rm{min}}\,(\=\+{\rm{found-value}}\,({\it{child\/}}, {\it{old\/}})\index{found-value}, \\ 
{\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}}, {\it{value\/}})\index{min-of-reported})\-\index{min} \\ 
{\bf else }{\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}}, {\it{value\/}})\index{min-of-reported}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  min-of-reported-of-non-root \\ \index{min-of-reported-of-non-root}
\=\+(\=\+({\it{root\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;${\rm{all-numberps}}\,({\it{children\/}})\index{all-numberps} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\it{children\/}})\index{setp} \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\not\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{root\/}} $\not=$ {\it{parent\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{root\/}} $\not\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,(\=\+{\rm{cons}}\,({\it{child\/}}, {\it{root\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{root\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{root\/}}))\-)\-\index{changed})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}}, {\it{value\/}})\index{min-of-reported} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}}, {\it{value\/}})\index{min-of-reported})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  number-not-reported-of-non-root \\ \index{number-not-reported-of-non-root}
\=\+(\=\+({\it{root\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;${\rm{all-numberps}}\,({\it{children\/}})\index{all-numberps} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\it{children\/}})\index{setp} \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\not\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{root\/}} $\not=$ {\it{parent\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{root\/}} $\not\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,(\=\+{\rm{cons}}\,({\it{child\/}}, {\it{root\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{root\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{root\/}}))\-)\-\index{changed})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}})\index{number-not-reported} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}})\index{number-not-reported})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  number-not-reported-of-root \\ \index{number-not-reported-of-root}
\=\+(\=\+({\it{parent\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\not=$ {\it{child\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{all-numberps}}\,({\it{children\/}})\index{all-numberps} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\it{children\/}})\index{setp} \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\not\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\it{parent\/}}), {\it{old\/}})\index{channel} $=$ {\rm{list}}\,({\rm{found-value}}\,({\it{child\/}}, {\it{old\/}})\index{found-value})) \\ 
$\wedge$$\;\;\;\;${\rm{done}}\,({\it{child\/}}, {\it{old\/}})\index{done} \\ 
$\wedge$$\;\;\;\;$({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\it{parent\/}}), {\it{new\/}})\index{channel} $=$ {\rm{receive}}\,({\rm{cons}}\,({\it{child\/}}, {\it{parent\/}}), {\it{old\/}})\index{receive}) \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,(\=\+{\rm{cons}}\,({\it{child\/}}, {\it{parent\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{parent\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{parent\/}}))\-)\-\index{changed})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}})\index{number-not-reported} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{child\/}} $\in$ {\it{children\/}} \\ 
{\bf then }{\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}})\index{number-not-reported} $-\;1$ \\ 
{\bf else }{\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}})\index{number-not-reported}$\;${\bf  endif}\-)\-\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  setp-nodes-implies-setp-roots \\ \index{setp-nodes-implies-setp-roots}
\=\+({\rm{proper-tree}}\,({\tt{'}}{\tt{forest}}, {\it{forest\/}})\index{proper-tree} $\wedge$ {\rm{setp}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{forest}}, {\it{forest\/}})\index{nodes-rec})\index{setp}) \\ 
$\rightarrow$$\;\;\;\;${\rm{setp}}\,({\rm{roots}}\,({\it{forest\/}})\index{roots})\index{setp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  setp-nodes-setp-children \\ \index{setp-nodes-setp-children}
\=\+({\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} $\wedge$ {\rm{setp}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{setp}) \\ 
$\rightarrow$$\;\;\;\;${\rm{setp}}\,({\rm{children-rec}}\,({\it{flag\/}}, {\it{parent\/}}, {\it{tree\/}})\index{children-rec})\index{setp}\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  root-receive-report-preserves-instance-of-no \\ \index{root-receive-report-preserves-i!nstance-of-no}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;${\rm{root-receive-report}}\,({\it{old\/}}, {\it{new\/}}, {\rm{car}}\,({\it{tree\/}}), {\rm{cons}}\,({\it{child\/}}, {\rm{car}}\,({\it{tree\/}})))\index{root-receive-report} \\ 
$\wedge$$\;\;\;\;${\rm{ul}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\it{old\/}})\index{ul} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}) \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\it{node\/}}, {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\wedge$$\;\;\;\;$(\=\+({\rm{status}}\,({\it{node\/}}, {\it{old\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{outstanding}}\,({\it{node\/}}, {\it{old\/}})\index{outstanding} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,({\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}, {\it{node\/}}, {\it{old\/}})\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{found-value}}\,({\it{node\/}}, {\it{old\/}})\index{found-value} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,(\=\+{\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}, \\ 
{\it{node\/}}, \\ 
{\it{old\/}}, \\ 
{\rm{node-value}}\,({\it{node\/}}, {\it{old\/}})\index{node-value})\-\index{min-of-reported})\-)\-)\-)\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{outstanding}}\,({\it{node\/}}, {\it{new\/}})\index{outstanding} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,({\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}, {\it{node\/}}, {\it{new\/}})\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{found-value}}\,({\it{node\/}}, {\it{new\/}})\index{found-value} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,(\=\+{\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}, \\ 
{\it{node\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{node-value}}\,({\it{node\/}}, {\it{new\/}})\index{node-value})\-\index{min-of-reported})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  receive-find-preserves-no-for-rest-of-tree \\ \index{receive-find-preserves-no-for-re!st-of-tree}
\=\+(\=\+({\it{node\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent-of-node\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\not=$ {\it{node\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\not\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{append}}\,(\=\+{\rm{list}}\,(\=\+{\rm{cons}}\,({\it{parent-of-node\/}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\it{parent-of-node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}))\-, \\ 
{\rm{rfp}}\,({\it{node\/}}, {\it{excpt\/}})\index{rfp})\-)\-\index{changed})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}})\index{number-not-reported} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}})\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}}, {\it{value\/}})\index{min-of-reported} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}}, {\it{value\/}})\index{min-of-reported})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  receive-find-preserves-no-for-node \\ \index{receive-find-preserves-no-for-n!ode}
\=\+(\=\+({\it{node\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent-of-node\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\not\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{not-started}}\,({\it{children\/}}, {\it{old\/}})\index{not-started} \\ 
$\wedge$$\;\;\;\;${\rm{sublistp}}\,({\rm{rfp}}\,({\it{node\/}}, {\it{children\/}})\index{rfp}, {\rm{rfp}}\,({\it{node\/}}, {\it{excpt\/}})\index{rfp})\index{sublistp} \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{append}}\,(\=\+{\rm{list}}\,(\=\+{\rm{cons}}\,({\it{parent-of-node\/}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\it{parent-of-node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}))\-, \\ 
{\rm{rfp}}\,({\it{node\/}}, {\it{excpt\/}})\index{rfp})\-)\-\index{changed})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+({\rm{number-not-reported}}\,({\it{children\/}}, {\it{node\/}}, {\it{new\/}})\index{number-not-reported} $=$ {\rm{length}}\,({\it{children\/}})\index{length}) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{min-of-reported}}\,({\it{children\/}}, {\it{node\/}}, {\it{new\/}}, {\it{value\/}})\index{min-of-reported} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,({\it{children\/}}, {\it{node\/}}, {\it{old\/}}, {\it{value\/}})\index{min-of-reported})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  receive-find-preserves-no-for-parent-of-node \\ \index{receive-find-preserves-no-for-p!arent-of-node}
\=\+(\=\+({\it{node\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent-of-node\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\not=$ {\it{parent-of-node\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\it{node\/}}, {\it{old\/}})\index{status} $\not=$ {\tt{'}}{\tt{started}}) \\ 
$\wedge$$\;\;\;\;$(\=\+({\rm{outstanding}}\,({\it{node\/}}, {\it{new\/}})\index{outstanding} $\simeq {\tt{0}}$) \\ 
$\rightarrow$$\;\;\;\;$($\neg$ {\rm{empty}}\,({\rm{cons}}\,({\it{node\/}}, {\it{parent-of-node\/}}), {\it{new\/}})\index{empty}))\- \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{append}}\,(\=\+{\rm{list}}\,(\=\+{\rm{cons}}\,({\it{parent-of-node\/}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\it{parent-of-node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}))\-, \\ 
{\rm{rfp}}\,({\it{node\/}}, {\it{excpt\/}})\index{rfp})\-)\-\index{changed})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent-of-node\/}}, {\it{new\/}})\index{number-not-reported} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent-of-node\/}}, {\it{old\/}})\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent-of-node\/}}, {\it{new\/}}, {\it{value\/}})\index{min-of-reported} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent-of-node\/}}, {\it{old\/}}, {\it{value\/}})\index{min-of-reported})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  dl-of-append \\ \index{dl-of-append}
{\rm{dl}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}), {\it{state\/}})\index{dl} $=$ ({\rm{dl}}\,({\it{a\/}}, {\it{state\/}})\index{dl} $\wedge$ {\rm{dl}}\,({\it{b\/}}, {\it{state\/}})\index{dl})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  down-links-1-rfp \\ \index{down-links-1-rfp}
{\rm{down-links-1}}\,({\it{parent\/}}, {\it{children\/}})\index{down-links-1} $=$ {\rm{rfp}}\,({\it{parent\/}}, {\it{children\/}})\index{rfp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  dl-down-links-implies-dl-rfp \\ \index{dl-down-links-implies-dl-rfp}
\=\+({\rm{dl}}\,({\rm{down-links}}\,({\it{nodes\/}}, {\it{tree\/}})\index{down-links}, {\it{state\/}})\index{dl} $\wedge$ ({\it{node\/}} $\in$ {\it{nodes\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{dl}}\,({\rm{rfp}}\,({\it{node\/}}, {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})\index{rfp}, {\it{state\/}})\index{dl}\-
\end{tabbing}


\noindent{\sc Event}:   Disable dl-down-links-implies-dl-rfp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable down-links-1-rfp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl-of-append.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  receive-find-preserves-instance-of-no \\ \index{receive-find-preserves-instance!-of-no}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\wedge$$\;\;\;\;${\rm{receive-find}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\it{node\/}}, \\ 
{\rm{cons}}\,({\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}), \\ 
{\rm{rfp}}\,({\it{node\/}}, {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})\index{rfp})\-\index{receive-find} \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;$({\it{n\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}) \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\it{n\/}}, {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\wedge$$\;\;\;\;$(\=\+({\rm{status}}\,({\it{n\/}}, {\it{old\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{outstanding}}\,({\it{n\/}}, {\it{old\/}})\index{outstanding} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,({\rm{children}}\,({\it{n\/}}, {\it{tree\/}})\index{children}, {\it{n\/}}, {\it{old\/}})\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{found-value}}\,({\it{n\/}}, {\it{old\/}})\index{found-value} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,(\=\+{\rm{children}}\,({\it{n\/}}, {\it{tree\/}})\index{children}, \\ 
{\it{n\/}}, \\ 
{\it{old\/}}, \\ 
{\rm{node-value}}\,({\it{n\/}}, {\it{old\/}})\index{node-value})\-\index{min-of-reported})\-)\-)\-)\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+({\rm{outstanding}}\,({\it{n\/}}, {\it{new\/}})\index{outstanding} $=$ {\rm{number-not-reported}}\,({\rm{children}}\,({\it{n\/}}, {\it{tree\/}})\index{children}, {\it{n\/}}, {\it{new\/}})\index{number-not-reported}) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{found-value}}\,({\it{n\/}}, {\it{new\/}})\index{found-value} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,(\=\+{\rm{children}}\,({\it{n\/}}, {\it{tree\/}})\index{children}, \\ 
{\it{n\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{node-value}}\,({\it{n\/}}, {\it{new\/}})\index{node-value})\-\index{min-of-reported})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  receive-report-preserves-no-for-rest-of-tree \\ \index{receive-report-preserves-no-for!-rest-of-tree}
\=\+(\=\+({\it{node\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent-of-node\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{child-of-node\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\not=$ {\it{node\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\not\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,(\=\+{\rm{cons}}\,({\it{child-of-node\/}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\it{parent-of-node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{node\/}}))\-)\-\index{changed})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}})\index{number-not-reported} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}})\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}}, {\it{value\/}})\index{min-of-reported} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}}, {\it{value\/}})\index{min-of-reported})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  receive-report-preserves-no-for-node \\ \index{receive-report-preserves-no-for!-node}
\=\+(\=\+({\it{node\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\not\in$ {\it{children\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{all-numberps}}\,({\it{children\/}})\index{all-numberps} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\it{children\/}})\index{setp} \\ 
$\wedge$$\;\;\;\;$({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), {\it{old\/}})\index{channel} $=$ {\rm{list}}\,({\rm{found-value}}\,({\it{child\/}}, {\it{old\/}})\index{found-value})) \\ 
$\wedge$$\;\;\;\;${\rm{done}}\,({\it{child\/}}, {\it{old\/}})\index{done} \\ 
$\wedge$$\;\;\;\;$({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), {\it{new\/}})\index{channel} $=$ {\rm{receive}}\,({\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), {\it{old\/}})\index{receive}) \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,(\=\+{\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\it{parent\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{node\/}}))\-)\-\index{changed})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{number-not-reported}}\,({\it{children\/}}, {\it{node\/}}, {\it{new\/}})\index{number-not-reported} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{child\/}} $\in$ {\it{children\/}} \\ 
{\bf then }{\rm{number-not-reported}}\,({\it{children\/}}, {\it{node\/}}, {\it{old\/}})\index{number-not-reported} $-\;1$ \\ 
{\bf else }{\rm{number-not-reported}}\,({\it{children\/}}, {\it{node\/}}, {\it{old\/}})\index{number-not-reported}$\;${\bf  endif}\-)\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{min-of-reported}}\,({\it{children\/}}, {\it{node\/}}, {\it{new\/}}, {\it{value\/}})\index{min-of-reported} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{child\/}} $\in$ {\it{children\/}} \\ 
{\bf then }{\rm{min}}\,(\=\+{\rm{found-value}}\,({\it{child\/}}, {\it{old\/}})\index{found-value}, \\ 
{\rm{min-of-reported}}\,({\it{children\/}}, {\it{node\/}}, {\it{old\/}}, {\it{value\/}})\index{min-of-reported})\-\index{min} \\ 
{\bf else }{\rm{min-of-reported}}\,({\it{children\/}}, {\it{node\/}}, {\it{old\/}}, {\it{value\/}})\index{min-of-reported}$\;${\bf  endif}\-)\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  receive-report-preserves-no-for-parent \\ \index{receive-report-preserves-no-for!-parent}
\=\+(\=\+({\it{node\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{parent\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\not=$ {\it{parent\/}}) \\ 
$\wedge$$\;\;\;\;$(({\rm{outstanding}}\,({\it{node\/}}, {\it{new\/}})\index{outstanding} $\simeq {\tt{0}}$) $\rightarrow$ ($\neg$ {\rm{empty}}\,({\rm{cons}}\,({\it{node\/}}, {\it{parent\/}}), {\it{new\/}})\index{empty})) \\ 
$\wedge$$\;\;\;\;$({\rm{outstanding}}\,({\it{node\/}}, {\it{old\/}})\index{outstanding} $\not\simeq {\tt{0}}$) \\ 
$\wedge$$\;\;\;\;${\rm{changed}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,(\=\+{\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\it{parent\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{outstanding}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\tt{'}}{\tt{found-value}}, {\it{node\/}}))\-)\-\index{changed})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}})\index{number-not-reported} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}})\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{new\/}}, {\it{value\/}})\index{min-of-reported} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{old\/}}, {\it{value\/}})\index{min-of-reported})\-)\-\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  child-member-cdr-nodes \\ \index{child-member-cdr-nodes}
\=\+(\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children-rec}}\,({\tt{'}}{\tt{tree}}, {\it{node\/}}, {\it{tree\/}})\index{children-rec}))\- \\ 
$\rightarrow$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{cdr}}\,({\rm{nodes-rec}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{nodes-rec}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  receive-report-preserves-instance-of-no \\ \index{receive-report-preserves-instan!ce-of-no}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;$({\it{n\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}) \\ 
$\wedge$$\;\;\;\;${\rm{receive-report}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\it{node\/}}, \\ 
{\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}))\-\index{receive-report} \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\it{n\/}}, {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\wedge$$\;\;\;\;${\rm{ul}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\it{old\/}})\index{ul} \\ 
$\wedge$$\;\;\;\;${\rm{no}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{no} \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+({\rm{outstanding}}\,({\it{n\/}}, {\it{new\/}})\index{outstanding} $=$ {\rm{number-not-reported}}\,({\rm{children}}\,({\it{n\/}}, {\it{tree\/}})\index{children}, {\it{n\/}}, {\it{new\/}})\index{number-not-reported}) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{found-value}}\,({\it{n\/}}, {\it{new\/}})\index{found-value} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,(\=\+{\rm{children}}\,({\it{n\/}}, {\it{tree\/}})\index{children}, \\ 
{\it{n\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{node-value}}\,({\it{n\/}}, {\it{new\/}})\index{node-value})\-\index{min-of-reported})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  dl-ul-no-preserves-instance-of-no \\ \index{dl-ul-no-preserves-instance-of-!no}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;${\rm{ul}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\it{old\/}})\index{ul} \\ 
$\wedge$$\;\;\;\;${\rm{no}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{no} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}) \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\it{node\/}}, {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{started}}))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{outstanding}}\,({\it{node\/}}, {\it{new\/}})\index{outstanding} \\ 
$=$$\;\;\;\;${\rm{number-not-reported}}\,({\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}, {\it{node\/}}, {\it{new\/}})\index{number-not-reported})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{found-value}}\,({\it{node\/}}, {\it{new\/}})\index{found-value} \\ 
$=$$\;\;\;\;${\rm{min-of-reported}}\,(\=\+{\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}, \\ 
{\it{node\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{node-value}}\,({\it{node\/}}, {\it{new\/}})\index{node-value})\-\index{min-of-reported})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  dl-ul-no-preserves-no-sublist \\ \index{dl-ul-no-preserves-no-sublist}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;${\rm{ul}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\it{old\/}})\index{ul} \\ 
$\wedge$$\;\;\;\;${\rm{no}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{no} \\ 
$\wedge$$\;\;\;\;${\rm{sublistp}}\,({\it{sublist\/}}, {\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{sublistp})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{no}}\,({\it{sublist\/}}, {\it{tree\/}}, {\it{new\/}})\index{no}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  inv-preserves-inv \\ \index{inv-preserves-inv}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{old\/}})\index{inv})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{new\/}})\index{inv}\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  inv-is-invariant \\ \index{inv-is-invariant}
\=\+(\=\+{\rm{initial-condition}}\,(\=\+{\tt{`}}{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}{\tt{all-empty}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{all-channels}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}} \\ 
{\tt{(}}{\tt{not-started}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}}{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{initial-condition} \\ 
$\wedge$$\;\;\;\;${\rm{treep}}\,({\it{tree\/}})\index{treep})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{invariant}}\,({\tt{`}}{\tt{(}}{\tt{inv}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{tree}}{\tt{ }}{\tt{state}}{\tt{)}}, {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\index{invariant}\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  outstanding-non-increasing \\ \index{outstanding-non-increasing}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+\=\+{\bf if }{\rm{status}}\,({\it{node\/}}, {\it{old\/}})\index{status} $=$ {\tt{'}}{\tt{started}}$\;\;${\bf then }{\rm{outstanding}}\,({\it{node\/}}, {\it{old\/}})\index{outstanding} \\ 
{\bf else }$1\;+$ {\rm{length}}\,({\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})\index{length}$\;${\bf  endif}\- \\ 
$\not<$$\;\;\;\;$\=\+{\bf if }{\rm{status}}\,({\it{node\/}}, {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{started}} \\ 
{\bf then }{\rm{outstanding}}\,({\it{node\/}}, {\it{new\/}})\index{outstanding} \\ 
{\bf else }$1\;+$ {\rm{length}}\,({\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})\index{length}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  total-outstanding-non-increasing-sublist \\ \index{total-outstanding-non-increasin!g-sublist}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;${\rm{sublistp}}\,({\it{sublist\/}}, {\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{sublistp})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{total-outstanding}}\,({\it{sublist\/}}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding} \\ 
$\not<$$\;\;\;\;${\rm{total-outstanding}}\,({\it{sublist\/}}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  total-outstanding-non-increasing \\ \index{total-outstanding-non-increasin!g}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding} \\ 
$\not<$$\;\;\;\;${\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  position-append \\ \index{position-append}
\=\+{\rm{position}}\,({\rm{append}}\,({\it{a\/}}, {\it{b\/}}), {\it{e\/}})\index{position} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{e\/}} $\in$ {\it{a\/}}$\;\;${\bf then }{\rm{position}}\,({\it{a\/}}, {\it{e\/}})\index{position} \\ 
{\bf else }{\rm{length}}\,({\it{a\/}})\index{length} $+$ {\rm{position}}\,({\it{b\/}}, {\it{e\/}})\index{position}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  parents-position-decreases \\ \index{parents-position-decreases}
\=\+(\=\+({\it{node\/}} $\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec}) \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;$\=\+{\bf if }{\it{flag\/}} $=$ {\tt{'}}{\tt{tree}}$\;\;${\bf then }{\rm{car}}\,({\it{tree\/}}) $\not=$ {\it{node\/}} \\ 
{\bf else }{\it{node\/}} $\not\in$ {\rm{roots}}\,({\it{tree\/}})\index{roots}$\;${\bf  endif}\-)\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{position}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec}, {\rm{car}}\,({\rm{parent-rec}}\,({\it{flag\/}}, {\it{node\/}}, {\it{tree\/}})\index{parent-rec}))\index{position} \\ 
$<$$\;\;\;\;${\rm{position}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec}, {\it{node\/}})\index{position})\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{parent-to-root-induction} \\  
\=\+{\rm{parent-to-root-induction}}\,({\it{node\/}}, {\it{tree\/}})\index{parent-to-root-induction} \\ 
$=$$\;\;\;\;$\=\+{\bf if }\=\+({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}) \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree}\- \\ 
{\bf then }\=\+{\bf if }{\rm{car}}\,({\it{tree\/}}) $=$ {\it{node\/}}$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }{\rm{parent-to-root-induction}}\,({\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}, {\it{tree\/}})\index{parent-to-root-induction}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  dl-and-all-empty-implies-root-defines-status \\ \index{dl-and-all-empty-implies-root-de!fines-status}
\=\+(\=\+{\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{state\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;${\rm{all-empty}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{state\/}})\index{all-empty} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{status}}, {\it{node\/}}), {\it{state\/}})) $=$ {\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{state\/}})\index{status})\-
\end{tabbing}


\begin{tabbing}{\sc Definition}:\index{suffix} \\  
\=\+{\rm{suffix}}\,({\it{s\/}}, {\it{l\/}})\index{suffix} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{l\/}}) \\ 
{\bf then }\=\+{\bf if }{\it{s\/}} $=$ {\it{l\/}}$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }{\rm{suffix}}\,({\it{s\/}}, {\rm{cdr}}\,({\it{l\/}}))\index{suffix}$\;${\bf  endif}\- \\ 
{\bf else }$\neg$ {\rm{listp}}\,({\it{s\/}})$\;${\bf  endif}\-\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  suffix-implies-suffix-cdr \\ \index{suffix-implies-suffix-cdr}
{\rm{suffix}}\,({\it{s\/}}, {\it{l\/}})\index{suffix} $\rightarrow$ {\rm{suffix}}\,({\rm{cdr}}\,({\it{s\/}}), {\it{l\/}})\index{suffix}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-suffix-member-list \\ \index{member-suffix-member-list}
(({\it{e\/}} $\in$ {\it{s\/}}) $\wedge$ {\rm{suffix}}\,({\it{s\/}}, {\it{l\/}})\index{suffix}) $\rightarrow$ ({\it{e\/}} $\in$ {\it{l\/}})
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  childs-position-increases \\ \index{childs-position-increases}
\=\+(\=\+({\it{node\/}} $\in$ {\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec}) \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{proper-tree}}\,({\it{flag\/}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children-rec}}\,({\it{flag\/}}, {\it{node\/}}, {\it{tree\/}})\index{children-rec}))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{position}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec}, {\it{node\/}})\index{position} \\ 
$<$$\;\;\;\;${\rm{position}}\,({\rm{nodes-rec}}\,({\it{flag\/}}, {\it{tree\/}})\index{nodes-rec}, {\it{child\/}})\index{position})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  setp-list-setp-suffix \\ \index{setp-list-setp-suffix}
({\rm{setp}}\,({\it{l\/}})\index{setp} $\wedge$ {\rm{suffix}}\,({\it{s\/}}, {\it{l\/}})\index{suffix}) $\rightarrow$ {\rm{setp}}\,({\it{s\/}})\index{setp}
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  later-positions-are-in-suffix \\ \index{later-positions-are-in-suffix}
\=\+(\=\+{\rm{setp}}\,({\it{l\/}})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{suffix}}\,({\it{s\/}}, {\it{l\/}})\index{suffix} \\ 
$\wedge$$\;\;\;\;$({\it{x\/}} $\in$ {\it{s\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{y\/}} $\in$ {\it{l\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{position}}\,({\it{l\/}}, {\it{x\/}})\index{position} $<$ {\rm{position}}\,({\it{l\/}}, {\it{y\/}})\index{position}))\- \\ 
$\rightarrow$$\;\;\;\;$({\it{y\/}} $\in$ {\it{s\/}})\-
\end{tabbing}




\begin{tabbing}{\sc Definition}:\index{all-done} \\  
\=\+{\rm{all-done}}\,({\it{nodes\/}}, {\it{state\/}})\index{all-done} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{nodes\/}}) \\ 
{\bf then }\=\+{\bf if }{\rm{done}}\,({\rm{car}}\,({\it{nodes\/}}), {\it{state\/}})\index{done}$\;\;${\bf then }{\rm{all-done}}\,({\rm{cdr}}\,({\it{nodes\/}}), {\it{state\/}})\index{all-done} \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-done-implies-done \\ \index{all-done-implies-done}
({\rm{all-done}}\,({\it{nodes\/}}, {\it{state\/}})\index{all-done} $\wedge$ ({\it{node\/}} $\in$ {\it{nodes\/}})) $\rightarrow$ {\rm{done}}\,({\it{node\/}}, {\it{state\/}})\index{done}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-done-implies-all-done-sublist \\ \index{all-done-implies-all-done-subli!st}
\=\+({\rm{all-done}}\,({\it{nodes\/}}, {\it{state\/}})\index{all-done} $\wedge$ {\rm{sublistp}}\,({\it{sublist\/}}, {\it{nodes\/}})\index{sublistp}) \\ 
$\rightarrow$$\;\;\;\;${\rm{all-done}}\,({\it{sublist\/}}, {\it{state\/}})\index{all-done}\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{ulnks} \\  
\=\+{\rm{ulnks}}\,({\it{children\/}}, {\it{parent\/}})\index{ulnks} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{children\/}}) \\ 
{\bf then }{\rm{cons}}\,({\rm{cons}}\,({\rm{car}}\,({\it{children\/}}), {\it{parent\/}}), {\rm{ulnks}}\,({\rm{cdr}}\,({\it{children\/}}), {\it{parent\/}})\index{ulnks}) \\ 
{\bf else }{\bf{nil}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-done-and-all-empty-implies-number-not-reported-0 \\ \index{all-done-and-all-empty-implies-!number-not-reported-0}
\=\+({\rm{all-done}}\,({\it{children\/}}, {\it{state\/}})\index{all-done} $\wedge$ {\rm{all-empty}}\,({\rm{ulnks}}\,({\it{children\/}}, {\it{parent\/}})\index{ulnks}, {\it{state\/}})\index{all-empty}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{number-not-reported}}\,({\it{children\/}}, {\it{parent\/}}, {\it{state\/}})\index{number-not-reported} $=$ {\tt{0}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-empty-implies-all-empty-sublist \\ \index{all-empty-implies-all-empty-sub!list}
\=\+({\rm{all-empty}}\,({\it{channels\/}}, {\it{state\/}})\index{all-empty} $\wedge$ {\rm{sublistp}}\,({\it{sublist\/}}, {\it{channels\/}})\index{sublistp}) \\ 
$\rightarrow$$\;\;\;\;${\rm{all-empty}}\,({\it{sublist\/}}, {\it{state\/}})\index{all-empty}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sublist-ulnks \\ \index{sublist-ulnks}
\=\+(\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{sublistp}}\,({\it{sublist\/}}, {\rm{children}}\,({\it{parent\/}}, {\it{tree\/}})\index{children})\index{sublistp} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{setp})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{sublistp}}\,({\rm{ulnks}}\,({\it{sublist\/}}, {\it{parent\/}})\index{ulnks}, {\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links})\index{sublistp}\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  child-of-node-in-suffix-is-in-suffix \\ \index{child-of-node-in-suffix-is-in-s!uffix}
\=\+(\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{setp} \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;${\rm{suffix}}\,({\it{nodes\/}}, {\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{suffix} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\it{nodes\/}}))\- \\ 
$\rightarrow$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{cdr}}\,({\it{nodes\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  children-are-suffix-of-sublist-generalized \\ \index{children-are-suffix-of-sublist-!generalized}
\=\+(\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{suffix}}\,({\it{nodes\/}}, {\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{suffix} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\it{nodes\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{sublistp}}\,({\it{sublist\/}}, {\rm{children-rec}}\,({\tt{'}}{\tt{tree}}, {\it{node\/}}, {\it{tree\/}})\index{children-rec})\index{sublistp})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{sublistp}}\,({\it{sublist\/}}, {\rm{cdr}}\,({\it{nodes\/}}))\index{sublistp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-nodes-are-done \\ \index{all-nodes-are-done}
\=\+(\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{all-empty}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{state\/}})\index{all-empty} \\ 
$\wedge$$\;\;\;\;${\rm{all-empty}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\it{state\/}})\index{all-empty} \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{state\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;${\rm{ul}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\it{state\/}})\index{ul} \\ 
$\wedge$$\;\;\;\;${\rm{no}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{state\/}})\index{no} \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\wedge$$\;\;\;\;${\rm{suffix}}\,({\it{nodes\/}}, {\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{suffix})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{all-done}}\,({\it{nodes\/}}, {\it{state\/}})\index{all-done}\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  all-done-implies-total-outstanding-0 \\ \index{all-done-implies-total-outstandi!ng-0}
{\rm{all-done}}\,({\it{nodes\/}}, {\it{state\/}})\index{all-done} $\rightarrow$ ({\rm{total-outstanding}}\,({\it{nodes\/}}, {\it{tree\/}}, {\it{state\/}})\index{total-outstanding} $=$ {\tt{0}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  all-empty-root-started-implies-total-outstanding-0 \\ \index{all-empty-root-started-implies-t!otal-outstanding-0}
\=\+(\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{state\/}})\index{inv} \\ 
$\wedge$$\;\;\;\;${\rm{all-empty}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{state\/}})\index{all-empty} \\ 
$\wedge$$\;\;\;\;${\rm{all-empty}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\it{state\/}})\index{all-empty} \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{started}}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{state\/}})\index{total-outstanding} $=$ {\tt{0}})\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{full-channel} \\  
\=\+{\rm{full-channel}}\,({\it{channels\/}}, {\it{state\/}})\index{full-channel} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{channels\/}}) \\ 
{\bf then }\=\+{\bf if }{\rm{empty}}\,({\rm{car}}\,({\it{channels\/}}), {\it{state\/}})\index{empty} \\ 
{\bf then }{\rm{full-channel}}\,({\rm{cdr}}\,({\it{channels\/}}), {\it{state\/}})\index{full-channel} \\ 
{\bf else }{\rm{car}}\,({\it{channels\/}})$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-all-empty-implies-full-channel-full \\ \index{not-all-empty-implies-full-chan!nel-full}
\=\+(($\neg$ {\rm{all-empty}}\,({\it{channels\/}}, {\it{state\/}})\index{all-empty}) $\wedge$ ({\bf{f}} $\not\in$ {\it{channels\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{listp}}\,({\rm{cdr}}\,({\rm{assoc}}\,({\rm{full-channel}}\,({\it{channels\/}}, {\it{state\/}})\index{full-channel}, {\it{state\/}}))) \\ 
$\wedge$$\;\;\;\;$({\rm{full-channel}}\,({\it{channels\/}}, {\it{state\/}})\index{full-channel} $\in$ {\it{channels\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{full-channel}}\,({\it{channels\/}}, {\it{state\/}})\index{full-channel})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-total-outstanding-0-implies-full-channel \\ \index{not-total-outstanding-0-implies!-full-channel}
\=\+(\=\+{\rm{proper-tree}}\,({\tt{'}}{\tt{tree}}, {\it{tree\/}})\index{proper-tree} \\ 
$\wedge$$\;\;\;\;${\rm{setp}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{setp} \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{state\/}})\index{inv} \\ 
$\wedge$$\;\;\;\;$(\=\+({\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\vee$$\;\;\;\;$({\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{not-started}}))\- \\ 
$\wedge$$\;\;\;\;$({\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{state\/}})\index{total-outstanding} $\not=$ {\tt{0}}))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+({\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{state\/}})\index{status} $=$ {\tt{'}}{\tt{not-started}}) \\ 
$\vee$$\;\;\;\;${\rm{full-channel}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{state\/}})\index{full-channel} \\ 
$\vee$$\;\;\;\;${\rm{full-channel}}\,({\rm{up-links}}\,({\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}), {\it{tree\/}})\index{up-links}, {\it{state\/}})\index{full-channel})\-\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  status-root-becomes-started-or-unchanged \\ \index{status-root-becomes-started-or-!unchanged}
\=\+({\rm{treep}}\,({\it{tree\/}})\index{treep} $\wedge$ ({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) $\wedge$ {\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+({\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{started}}) \\ 
$\vee$$\;\;\;\;$({\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{new\/}})\index{status} $=$ {\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{old\/}})\index{status}))\-\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  root-started-or-not-started-is-invariant \\ \index{root-started-or-not-started-is-i!nvariant}
\=\+(\=\+{\rm{initial-condition}}\,(\=\+{\tt{`}}{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}{\tt{all-empty}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{all-channels}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}} \\ 
{\tt{(}}{\tt{not-started}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}}{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{initial-condition} \\ 
$\wedge$$\;\;\;\;${\rm{treep}}\,({\it{tree\/}})\index{treep})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{invariant}}\,(\=\+{\tt{`}}{\tt{(}}\=\+{\tt{or}} \\ 
{\tt{(}}\=\+{\tt{equal}} \\ 
{\tt{(}}{\tt{status}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{car}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}} \\ 
{\tt{'}}{\tt{started}}{\tt{)}}\- \\ 
{\tt{(}}\=\+{\tt{equal}} \\ 
{\tt{(}}{\tt{status}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{car}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}} \\ 
{\tt{'}}{\tt{not-started}}{\tt{)}}\-{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{invariant}\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  total-outstanding-decreases-sublist \\ \index{total-outstanding-decreases-sub!list}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{sublistp}}\,({\it{nodes\/}}, {\rm{nodes}}\,({\it{tree\/}})\index{nodes})\index{sublistp} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\it{nodes\/}}) \\ 
$\wedge$$\;\;\;\;$(\=\+\=\+{\bf if }{\rm{status}}\,({\it{node\/}}, {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{started}}$\;\;${\bf then }{\rm{outstanding}}\,({\it{node\/}}, {\it{new\/}})\index{outstanding} \\ 
{\bf else }$1\;+$ {\rm{length}}\,({\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})\index{length}$\;${\bf  endif}\- \\ 
$<$$\;\;\;\;$\=\+{\bf if }{\rm{status}}\,({\it{node\/}}, {\it{old\/}})\index{status} $=$ {\tt{'}}{\tt{started}} \\ 
{\bf then }{\rm{outstanding}}\,({\it{node\/}}, {\it{old\/}})\index{outstanding} \\ 
{\bf else }$1\;+$ {\rm{length}}\,({\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})\index{length}$\;${\bf  endif}\-)\-)\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{total-outstanding}}\,({\it{nodes\/}}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding} \\ 
$<$$\;\;\;\;${\rm{total-outstanding}}\,({\it{nodes\/}}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding})\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{tou} \\  
\=\+{\rm{tou}}\,({\it{old\/}}, {\it{new\/}}, {\it{node\/}}, {\it{tree\/}})\index{tou} \\ 
$=$$\;\;\;\;$(\=\+\=\+{\bf if }{\rm{status}}\,({\it{node\/}}, {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{started}}$\;\;${\bf then }{\rm{outstanding}}\,({\it{node\/}}, {\it{new\/}})\index{outstanding} \\ 
{\bf else }$1\;+$ {\rm{length}}\,({\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})\index{length}$\;${\bf  endif}\- \\ 
$<$$\;\;\;\;$\=\+{\bf if }{\rm{status}}\,({\it{node\/}}, {\it{old\/}})\index{status} $=$ {\tt{'}}{\tt{started}} \\ 
{\bf then }{\rm{outstanding}}\,({\it{node\/}}, {\it{old\/}})\index{outstanding} \\ 
{\bf else }$1\;+$ {\rm{length}}\,({\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})\index{length}$\;${\bf  endif}\-)\-\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  total-outstanding-decreases \\ \index{total-outstanding-decreases}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{dl}}\,({\rm{down-links}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}})\index{down-links}, {\it{old\/}})\index{dl} \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}) \\ 
$\wedge$$\;\;\;\;${\rm{tou}}\,({\it{old\/}}, {\it{new\/}}, {\it{node\/}}, {\it{tree\/}})\index{tou})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding} \\ 
$<$$\;\;\;\;${\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  start-decreases-tou \\ \index{start-decreases-tou}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{old\/}})\index{status} $=$ {\tt{'}}{\tt{not-started}}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,({\tt{'}}{\tt{start}}, {\rm{car}}\,({\it{tree\/}}), {\rm{rfp}}\,({\rm{car}}\,({\it{tree\/}}), {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children})\index{rfp}))\-\index{n})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{tou}}\,({\it{old\/}}, {\it{new\/}}, {\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{tou}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  others-preserve-root-not-started \\ \index{others-preserve-root-not-starte!d}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\not=$ {\rm{list}}\,(\=\+{\tt{'}}{\tt{start}}, \\ 
{\rm{car}}\,({\it{tree\/}}), \\ 
{\rm{rfp}}\,({\rm{car}}\,({\it{tree\/}}), {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children})\index{rfp})\-))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\tt{'}}{\tt{status}}, {\rm{car}}\,({\it{tree\/}})), {\it{new\/}})) $=$ {\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{old\/}})\index{status})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  root-receive-report-decreases-tou \\ \index{root-receive-report-decreases-t!ou}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\rm{car}}\,({\it{tree\/}})), {\it{old\/}})\index{channel}) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,({\tt{'}}{\tt{root-receive-report}}, {\rm{car}}\,({\it{tree\/}}), {\rm{cons}}\,({\it{child\/}}, {\rm{car}}\,({\it{tree\/}}))))\-\index{n} \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{old\/}})\index{inv})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{tou}}\,({\it{old\/}}, {\it{new\/}}, {\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{tou}\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  others-preserve-up-to-root-full \\ \index{others-preserve-up-to-root-full}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\rm{car}}\,({\it{tree\/}})), {\it{old\/}})\index{channel}) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\not=$ {\rm{list}}\,(\=\+{\tt{'}}{\tt{root-receive-report}}, \\ 
{\rm{car}}\,({\it{tree\/}}), \\ 
{\rm{cons}}\,({\it{child\/}}, {\rm{car}}\,({\it{tree\/}})))\-) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{listp}}\,({\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\it{child\/}}, {\rm{car}}\,({\it{tree\/}})), {\it{new\/}})))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  receive-find-decreases-tou \\ \index{receive-find-decreases-tou}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}, {\it{node\/}}), {\it{old\/}})\index{channel}) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,(\=\+{\tt{'}}{\tt{receive-find}}, \\ 
{\it{node\/}}, \\ 
{\rm{cons}}\,({\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}), \\ 
{\rm{rfp}}\,({\it{node\/}}, {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})\index{rfp})\-)\-\index{n} \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{old\/}})\index{inv})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{tou}}\,({\it{old\/}}, {\it{new\/}}, {\it{node\/}}, {\it{tree\/}})\index{tou}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  others-preserve-down-to-node-full \\ \index{others-preserve-down-to-node-fu!ll}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}, {\it{node\/}}), {\it{old\/}})\index{channel}) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\not=$ {\rm{list}}\,(\=\+{\tt{'}}{\tt{receive-find}}, \\ 
{\it{node\/}}, \\ 
{\rm{cons}}\,({\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}), \\ 
{\rm{rfp}}\,({\it{node\/}}, {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})\index{rfp})\-) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{listp}}\,({\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\rm{car}}\,({\rm{parent-rec}}\,({\tt{'}}{\tt{tree}}, {\it{node\/}}, {\it{tree\/}})\index{parent-rec}), {\it{node\/}}), {\it{new\/}})))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  receive-report-decreases-tou \\ \index{receive-report-decreases-tou}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), {\it{old\/}})\index{channel}) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,(\=\+{\tt{'}}{\tt{receive-report}}, \\ 
{\it{node\/}}, \\ 
{\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}))\-)\-\index{n} \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{old\/}})\index{inv})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{tou}}\,({\it{old\/}}, {\it{new\/}}, {\it{node\/}}, {\it{tree\/}})\index{tou}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  others-preserve-up-to-node-full \\ \index{others-preserve-up-to-node-full}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), {\it{old\/}})\index{channel}) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\not=$ {\rm{list}}\,(\=\+{\tt{'}}{\tt{receive-report}}, \\ 
{\it{node\/}}, \\ 
{\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}))\-) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{listp}}\,({\rm{cdr}}\,({\rm{assoc}}\,({\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), {\it{new\/}})))\-
\end{tabbing}


\noindent{\sc Event}:   Disable total-outstanding-decreases.

\addvspace{18pt}

\noindent{\sc Event}:   Disable tou.

\addvspace{18pt}

\noindent{\sc Event}:   Disable total-outstanding-decreases-sublist.

\addvspace{18pt}

\noindent{\sc Event}:   Disable status-root-becomes-started-or-unchanged.

\addvspace{18pt}

\noindent{\sc Event}:   Disable not-total-outstanding-0-implies-full-channel.

\addvspace{18pt}

\noindent{\sc Event}:   Disable not-all-empty-implies-full-channel-full.

\addvspace{18pt}

\noindent{\sc Event}:   Disable full-channel.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-empty-root-started-implies-total-outstanding-0.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-done-implies-total-outstanding-0.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-nodes-are-done.

\addvspace{18pt}

\noindent{\sc Event}:   Disable children-are-suffix-of-sublist-generalized.

\addvspace{18pt}

\noindent{\sc Event}:   Disable child-of-node-in-suffix-is-in-suffix.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sublist-ulnks.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-empty-implies-all-empty-sublist.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-done-and-all-empty-implies-number-not-reported-0.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ulnks.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-done-implies-all-done-sublist.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-done-implies-done.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-done.

\addvspace{18pt}

\noindent{\sc Event}:   Disable later-positions-are-in-suffix.

\addvspace{18pt}

\noindent{\sc Event}:   Disable setp-list-setp-suffix.

\addvspace{18pt}

\noindent{\sc Event}:   Disable childs-position-increases.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-suffix-member-list.

\addvspace{18pt}

\noindent{\sc Event}:   Disable suffix-implies-suffix-cdr.

\addvspace{18pt}

\noindent{\sc Event}:   Disable suffix.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl-and-all-empty-implies-root-defines-status.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-to-root-induction.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parents-position-decreases.

\addvspace{18pt}

\noindent{\sc Event}:   Disable position-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable total-outstanding-non-increasing.

\addvspace{18pt}

\noindent{\sc Event}:   Disable total-outstanding-non-increasing-sublist.

\addvspace{18pt}

\noindent{\sc Event}:   Disable outstanding-non-increasing.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl-ul-no-preserves-no-sublist.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl-ul-no-preserves-instance-of-no.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-report-preserves-instance-of-no.

\addvspace{18pt}

\noindent{\sc Event}:   Disable child-member-cdr-nodes.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-report-preserves-no-for-parent.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-report-preserves-no-for-node.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-report-preserves-no-for-rest-of-tree.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-find-preserves-instance-of-no.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl-down-links-implies-dl-rfp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable down-links-1-rfp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl-of-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-find-preserves-no-for-parent-of-node.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-find-preserves-no-for-node.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-find-preserves-no-for-rest-of-tree.

\addvspace{18pt}

\noindent{\sc Event}:   Disable root-receive-report-preserves-instance-of-no.

\addvspace{18pt}

\noindent{\sc Event}:   Disable setp-nodes-setp-children.

\addvspace{18pt}

\noindent{\sc Event}:   Disable setp-nodes-implies-setp-roots.

\addvspace{18pt}

\noindent{\sc Event}:   Disable number-not-reported-of-root.

\addvspace{18pt}

\noindent{\sc Event}:   Disable number-not-reported-of-non-root.

\addvspace{18pt}

\noindent{\sc Event}:   Disable min-of-reported-of-non-root.

\addvspace{18pt}

\noindent{\sc Event}:   Disable update-min-of-reported.

\addvspace{18pt}

\noindent{\sc Event}:   Disable min-of-reported-of-min.

\addvspace{18pt}

\noindent{\sc Event}:   Disable min-commutative-1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable min-associative.

\addvspace{18pt}

\noindent{\sc Event}:   Disable min-commutative.

\addvspace{18pt}

\noindent{\sc Event}:   Disable start-preserves-instance-of-no.

\addvspace{18pt}

\noindent{\sc Event}:   Disable length-rfp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable start-preserves-no-for-rest-of-tree.

\addvspace{18pt}

\noindent{\sc Event}:   Disable unchanged-preserves-no.

\addvspace{18pt}

\noindent{\sc Event}:   Disable start-preserves-no-for-parent.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-not-started-implies-all-empty-and-not-started.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl-ul-no-preserves-ul.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl-ul-no-preserves-ul-sublist.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl-ul-no-preserves-instance-of-ul.

\addvspace{18pt}

\noindent{\sc Event}:   Disable zero-not-reported-implies-children-reported.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-up-links.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl-preserves-dl.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl-preserves-sublist.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl-preserves-instance-of-dl.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-numberps-nodes-implies-all-numberps-children.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-numberps-forest-implies-all-numberps-roots.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-not-litatom.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-numberps-nodes-implies-all-numberps-car-parent.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-numberps-nodes-implies-all-numberps-parent.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-numberps-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable send-find-general.

\addvspace{18pt}

\noindent{\sc Event}:   Disable assoc-equal-cons.

\addvspace{18pt}

\noindent{\sc Event}:   Disable send-find-implies.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-rfp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-of-parent-not-node.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-not-grandchild.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-not-child.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-down-links.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-down-links-1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ul-implies-instance-of-ul-not-empty-uplink.

\addvspace{18pt}

\noindent{\sc Event}:   Disable no-implies-instance-of-no.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ul-implies-instance-of-ul.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl-implies-instance-of-dl.

\addvspace{18pt}

\noindent{\sc Event}:   Disable inv-implies-augmented-correctness-condition.

\addvspace{18pt}

\noindent{\sc Event}:   Disable initial-conditions-imply-invariant.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-empty-not-started-implies-dl.

\addvspace{18pt}

\noindent{\sc Event}:   Disable inv.

\addvspace{18pt}

\noindent{\sc Event}:   Disable dl.

\addvspace{18pt}

\noindent{\sc Event}:   Disable node-values-constant-invariant.

\addvspace{18pt}

\noindent{\sc Event}:   Disable node-values-constant-unless-sufficient.

\addvspace{18pt}

\noindent{\sc Event}:   Disable listp-tree-prg.

\addvspace{18pt}

\noindent{\sc Event}:   Disable root-receive-report-prg-is-total.

\addvspace{18pt}

\noindent{\sc Event}:   Disable start-prg-is-total.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-report-prg-is-total.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-find-prg-is-total.

\addvspace{18pt}

\noindent{\sc Event}:   Disable root-receive-report-func-implements-root-receive-report.

\addvspace{18pt}

\noindent{\sc Event}:   Disable root-receive-report-func.

\addvspace{18pt}

\noindent{\sc Event}:   Disable start-func-implements-start.

\addvspace{18pt}

\noindent{\sc Event}:   Disable start-func.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-report-func-implements-receive-report.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-report-func.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-find-func-implements-receive-find.

\addvspace{18pt}

\noindent{\sc Event}:   Disable uc-of-send-find-func.

\addvspace{18pt}

\noindent{\sc Event}:   Disable to-node-not-in-rfp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-not-in-rfp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable about-rfp-numberp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable about-rfp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable assoc-of-send-find-func.

\addvspace{18pt}

\noindent{\sc Event}:   Disable send-find-of-update-assoc.

\addvspace{18pt}

\noindent{\sc Event}:   Disable children-are-not-litatoms-member.

\addvspace{18pt}

\noindent{\sc Event}:   Disable children-are-not-litatoms.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-is-not-a-litatom.

\addvspace{18pt}

\noindent{\sc Event}:   Disable nodes-are-not-litatoms.

\addvspace{18pt}

\noindent{\sc Event}:   Disable send-find-func-implements-send-find.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-find-func.

\addvspace{18pt}

\noindent{\sc Event}:   Disable send-find-func.

\addvspace{18pt}

\noindent{\sc Event}:   Disable no-at-termination.

\addvspace{18pt}

\noindent{\sc Event}:   Disable found-value-min-value-generalized.

\addvspace{18pt}

\noindent{\sc Event}:   Disable min-of-two-nodes-values.

\addvspace{18pt}

\noindent{\sc Event}:   Disable proper-tree-tree-implies-nodes-exists.

\addvspace{18pt}

\noindent{\sc Event}:   Disable number-not-reported-0-implies.

\addvspace{18pt}

\noindent{\sc Event}:   Disable total-outstanding-0-implies.

\addvspace{18pt}

\noindent{\sc Event}:   Disable no-implies.

\addvspace{18pt}

\noindent{\sc Event}:   Disable found-value-node-value-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable nati.

\addvspace{18pt}

\noindent{\sc Event}:   Disable found-value-node-value.

\addvspace{18pt}

\noindent{\sc Event}:   Disable down-links-is-sublistp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable children-of-non-node.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sublistp-down-links-1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sublistp-not-started.

\addvspace{18pt}

\noindent{\sc Event}:   Disable nodes-in-down-links-in-nodes.

\addvspace{18pt}

\noindent{\sc Event}:   Disable nodes-in-channels-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable nodes-in-down-links-1-in-nodes.

\addvspace{18pt}

\noindent{\sc Event}:   Disable not-started-implies-no.

\addvspace{18pt}

\noindent{\sc Event}:   Disable nodes-in-channels.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-empty-implies-ul.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-empty-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable not-started-implies-not-started.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-empty-implies-empty.

\addvspace{18pt}

\noindent{\sc Event}:   Disable correct.

\addvspace{18pt}

\noindent{\sc Event}:   Disable min-node-value.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-empty.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-channels.

\addvspace{18pt}

\noindent{\sc Event}:   Disable not-started.

\addvspace{18pt}

\noindent{\sc Event}:   Disable up-links.

\addvspace{18pt}

\noindent{\sc Event}:   Disable down-links.

\addvspace{18pt}

\noindent{\sc Event}:   Disable down-links-1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable no.

\addvspace{18pt}

\noindent{\sc Event}:   Disable min-of-reported.

\addvspace{18pt}

\noindent{\sc Event}:   Disable number-not-reported.

\addvspace{18pt}

\noindent{\sc Event}:   Disable reported.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ul.

\addvspace{18pt}

\noindent{\sc Event}:   Disable done.

\addvspace{18pt}

\noindent{\sc Event}:   Disable total-outstanding.

\addvspace{18pt}

\noindent{\sc Event}:   Disable treep.

\addvspace{18pt} 

\noindent{\sc Event}:   Disable member-tree-prg.

\addvspace{18pt}

\noindent{\sc Event}:   Disable equal-if.

\addvspace{18pt}

\noindent{\sc Event}:   Disable tree-prg.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-root-receive-report-prg.

\addvspace{18pt}

\noindent{\sc Event}:   Disable root-receive-report-prg.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-rrrp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable rrrp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-start-prg.

\addvspace{18pt}

\noindent{\sc Event}:   Disable start-prg.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-receive-report-prg.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-report-prg.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-rrp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable rrp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-receive-find-prg.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-find-prg.

\addvspace{18pt}

\noindent{\sc Event}:   Disable rfp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable root-receive-report.

\addvspace{18pt}

\noindent{\sc Event}:   Disable start.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-report.

\addvspace{18pt}

\noindent{\sc Event}:   Disable min.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive-find.

\addvspace{18pt}

\noindent{\sc Event}:   Disable send-find.

\addvspace{18pt}

\noindent{\sc Event}:   Disable node-value.

\addvspace{18pt}

\noindent{\sc Event}:   Disable outstanding.

\addvspace{18pt}

\noindent{\sc Event}:   Disable found-value.

\addvspace{18pt}

\noindent{\sc Event}:   Disable status.

\addvspace{18pt}

\noindent{\sc Event}:   Disable receive.

\addvspace{18pt}

\noindent{\sc Event}:   Disable send.

\addvspace{18pt}

\noindent{\sc Event}:   Disable head.

\addvspace{18pt}

\noindent{\sc Event}:   Disable empty.

\addvspace{18pt}

\noindent{\sc Event}:   Disable channel.

\addvspace{18pt}

\noindent{\sc Event}:   Disable value.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-not-in-children.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-is-not-child.

\addvspace{18pt}

\noindent{\sc Event}:   Disable listp-parent-rec-equals.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-is-not-itself.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-is-not-itself-generalized.

\addvspace{18pt}

\noindent{\sc Event}:   Disable node-has-parent.

\addvspace{18pt}

\noindent{\sc Event}:   Disable children-of-setp-tree.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-subtree-member-tree.

\addvspace{18pt}

\noindent{\sc Event}:   Disable no-children-in-rest-of-tree.

\addvspace{18pt}

\noindent{\sc Event}:   Disable no-children-in-rest-of-forest.

\addvspace{18pt}

\noindent{\sc Event}:   Disable not-member-no-children.

\addvspace{18pt}

\noindent{\sc Event}:   Disable not-member-subtrees.

\addvspace{18pt}

\noindent{\sc Event}:   Disable proper-tree-next-level-of-proper-tree.

\addvspace{18pt}

\noindent{\sc Event}:   Disable proper-tree-of-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable next-level-of-subtrees-in-complete-subtrees.

\addvspace{18pt}

\noindent{\sc Event}:   Disable next-level-in-subtrees-forest.

\addvspace{18pt}

\noindent{\sc Event}:   Disable subtrees-of-subtrees-in-complete-subtrees.

\addvspace{18pt}

\noindent{\sc Event}:   Disable subtrees-of-subtree-in-complete-subtrees.

\addvspace{18pt}

\noindent{\sc Event}:   Disable next-level-of-tree-in-subtrees.

\addvspace{18pt}

\noindent{\sc Event}:   Disable next-level-reduces-count.

\addvspace{18pt}

\noindent{\sc Event}:   Disable nodes-rec-forest-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable next-level.

\addvspace{18pt}

\noindent{\sc Event}:   Disable subtreep-subtrees.

\addvspace{18pt}

\noindent{\sc Event}:   Disable subtrees.

\addvspace{18pt}

\noindent{\sc Event}:   Disable subtreep.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sublistp-children.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sublistp-children-generalized.

\addvspace{18pt}

\noindent{\sc Event}:   Disable node-that-has-parent-is-in-tree.

\addvspace{18pt}

\noindent{\sc Event}:   Disable node-that-has-child-is-in-tree.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-parent-member-tree.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-of-child.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-parent-parent.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-child-tree.

\addvspace{18pt}

\noindent{\sc Event}:   Disable not-member-no-parent.

\addvspace{18pt}

\noindent{\sc Event}:   Disable plistp-roots.

\addvspace{18pt}

\noindent{\sc Event}:   Disable plistp-parent-rec.

\addvspace{18pt}

\noindent{\sc Event}:   Disable plistp-children-rec.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-roots-member-forest.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-rec-children-rec.

\addvspace{18pt}

\noindent{\sc Event}:   Disable not-flag-tree.

\addvspace{18pt}

\noindent{\sc Event}:   Disable canonicalize-children-rec-flag.

\addvspace{18pt}

\noindent{\sc Event}:   Disable canonicalize-parent-rec-flag.

\addvspace{18pt}

\noindent{\sc Event}:   Disable canonicalize-proper-tree-flag.

\addvspace{18pt}

\noindent{\sc Event}:   Disable canonicalize-nodes-rec-flag.

\addvspace{18pt}

\noindent{\sc Event}:   Disable proper-tree.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent.

\addvspace{18pt}

\noindent{\sc Event}:   Disable parent-rec.

\addvspace{18pt}

\noindent{\sc Event}:   Disable children.

\addvspace{18pt}

\noindent{\sc Event}:   Disable children-rec.

\addvspace{18pt}

\noindent{\sc Event}:   Disable roots.

\addvspace{18pt}

\noindent{\sc Event}:   Disable nodes.

\addvspace{18pt}

\noindent{\sc Event}:   Disable nodes-rec.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sublistp-in-cons.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sublistp-in-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sublistp-reflexive.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sublistp-easy.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sei.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sublistp-normalize.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sublistp-of-sublistp-is-sublistp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable member-of-sublistp-is-member.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sublistp-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sublistp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable setp-member-2.

\addvspace{18pt}

\noindent{\sc Event}:   Disable setp-member-1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable setp-append-canonicalize.

\addvspace{18pt}

\noindent{\sc Event}:   Disable setp-append-not-listp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable setp-append-cons.

\addvspace{18pt}

\noindent{\sc Event}:   Disable setp-member.

\addvspace{18pt}

\noindent{\sc Event}:   Disable setp-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable setp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-numberps-implies.

\addvspace{18pt}

\noindent{\sc Event}:   Disable all-numberps.

\addvspace{18pt}

\noindent{\sc Event}:   Disable not-lessp-count-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable append-plistp-nil.

\addvspace{18pt}

\noindent{\sc Event}:   Disable plistp-append-plistp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable plistp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable length-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable listp-append.

\addvspace{18pt}

\noindent{\sc Event}:   Disable car-append.

\addvspace{18pt}


\noindent{\sc Event}:   Disable n.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  member-cdr-nodes-member-nodes \\ \index{member-cdr-nodes-member-nodes}
(({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) $\wedge$ {\rm{treep}}\,({\it{tree\/}})\index{treep}) $\rightarrow$ ({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  total-outstanding-decreases-expanded \\ \index{total-outstanding-decreases-exp!anded}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{old\/}})\index{inv} \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}) \\ 
$\wedge$$\;\;\;\;${\rm{tou}}\,({\it{old\/}}, {\it{new\/}}, {\it{node\/}}, {\it{tree\/}})\index{tou})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+(\=\+{\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding} \\ 
$<$$\;\;\;\;${\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding})\- \\ 
$=$$\;\;\;\;${\bf{t}})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding} \\ 
$<$$\;\;\;\;${\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  total-outstanding-decreases-expanded-count \\ \index{total-outstanding-decreases-exp!anded-count}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{old\/}})\index{inv} \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}) \\ 
$\wedge$$\;\;\;\;${\rm{tou}}\,({\it{old\/}}, {\it{new\/}}, {\it{node\/}}, {\it{tree\/}})\index{tou} \\ 
$\wedge$$\;\;\;\;$({\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding} $=$ ($1\;+$ {\it{count\/}})))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(({\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding} $<$ ($1\;+$ {\it{count\/}})) $=$ {\bf{t}}) \\ 
$\wedge$$\;\;\;\;$({\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding} $<$ ($1\;+$ {\it{count\/}})))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  total-outstanding-non-increasing-expanded \\ \index{total-outstanding-non-increasin!g-expanded}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{old\/}})\index{inv})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+(\=\+{\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding} \\ 
$<$$\;\;\;\;${\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding})\- \\ 
$=$$\;\;\;\;${\bf{f}})\- \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding} \\ 
$\not<$$\;\;\;\;${\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  total-outstanding-non-increasing-expanded-count \\ \index{total-outstanding-non-increasin!g-expanded-count}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n} \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{old\/}})\index{inv} \\ 
$\wedge$$\;\;\;\;$({\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding} $=$ ($1\;+$ {\it{count\/}})))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+((($1\;+$ {\it{count\/}}) $<$ {\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding}) $=$ {\bf{f}}) \\ 
$\wedge$$\;\;\;\;$(($1\;+$ {\it{count\/}}) $\not<$ {\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  key-statements-member-tree-prg \\ \index{key-statements-member-tree-prg}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{list}}\,({\tt{'}}{\tt{start}}, {\rm{car}}\,({\it{tree\/}}), {\rm{rfp}}\,({\rm{car}}\,({\it{tree\/}}), {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children})\index{rfp}) \\ 
$\in$$\;\;\;\;${\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-)\- \\ 
$\wedge$$\;\;\;\;$(\=\+({\rm{treep}}\,({\it{tree\/}})\index{treep} $\wedge$ ({\it{child\/}} $\in$ {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{list}}\,(\=\+{\tt{'}}{\tt{root-receive-report}}, \\ 
{\rm{car}}\,({\it{tree\/}}), \\ 
{\rm{cons}}\,({\it{child\/}}, {\rm{car}}\,({\it{tree\/}})))\- \\ 
$\in$$\;\;\;\;${\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-)\- \\ 
$\wedge$$\;\;\;\;$(\=\+({\rm{treep}}\,({\it{tree\/}})\index{treep} $\wedge$ ({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}))) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{list}}\,(\=\+{\tt{'}}{\tt{receive-find}}, \\ 
{\it{node\/}}, \\ 
{\rm{cons}}\,({\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}), \\ 
{\rm{rfp}}\,({\it{node\/}}, {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})\index{rfp})\- \\ 
$\in$$\;\;\;\;${\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-)\- \\ 
$\wedge$$\;\;\;\;$(\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{list}}\,(\=\+{\tt{'}}{\tt{receive-report}}, \\ 
{\it{node\/}}, \\ 
{\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}))\- \\ 
$\in$$\;\;\;\;${\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  down-link-full-decreases-total-outstanding-ensures \\ \index{down-link-full-decreases-total-!outstanding-ensures}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{old\/}})\index{inv} \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}, {\it{node\/}}), {\it{old\/}})\index{channel}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,(\=\+{\tt{'}}{\tt{receive-find}}, \\ 
{\it{node\/}}, \\ 
{\rm{cons}}\,({\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}), \\ 
{\rm{rfp}}\,({\it{node\/}}, {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})\index{rfp})\-)\-\index{n})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding} \\ 
$<$$\;\;\;\;${\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  down-link-full-unless \\ \index{down-link-full-unless}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}, {\it{node\/}}), {\it{old\/}})\index{channel}) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\not=$ {\rm{list}}\,(\=\+{\tt{'}}{\tt{receive-find}}, \\ 
{\it{node\/}}, \\ 
{\rm{cons}}\,({\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}), \\ 
{\rm{rfp}}\,({\it{node\/}}, {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})\index{rfp})\-) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}, {\it{node\/}}), {\it{new\/}})\index{channel})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  down-link-full-decreases-total-outstanding \\ \index{down-link-full-decreases-total-!outstanding}
\=\+({\rm{treep}}\,({\it{tree\/}})\index{treep} $\wedge$ ({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}))) \\ 
$\rightarrow$$\;\;\;\;${\rm{leads-to}}\,(\=\+{\tt{`}}{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}{\tt{inv}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{tree}}{\tt{ }}{\tt{state}}{\tt{)}} \\ 
{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}\=\+{\tt{listp}} \\ 
{\tt{(}}\=\+{\tt{channel}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{cons}}{\tt{ }}{\tt{(}}{\tt{parent}}{\tt{ }}{\tt{node}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{node}}{\tt{)}} \\ 
{\tt{state}}{\tt{)}}\-{\tt{)}}\- \\ 
{\tt{(}}\=\+{\tt{equal}} \\ 
{\tt{(}}\=\+{\tt{total-outstanding}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{'}}{\tt{,}}{\tt{tree}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{add1}}{\tt{ }}{\tt{count}}{\tt{)}}{\tt{)}}\-{\tt{)}}\-{\tt{)}}\-, \\ 
{\tt{`}}{\tt{(}}\=\+{\tt{lessp}} \\ 
{\tt{(}}\=\+{\tt{total-outstanding}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{'}}{\tt{,}}{\tt{tree}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{add1}}{\tt{ }}{\tt{count}}{\tt{)}}{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{leads-to}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-car-tree-nodes-tree \\ \index{member-car-tree-nodes-tree}
{\rm{treep}}\,({\it{tree\/}})\index{treep} $\rightarrow$ ({\rm{car}}\,({\it{tree\/}}) $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes})
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  root-up-link-full-decreases-total-outstanding-ensures \\ \index{root-up-link-full-decreases-tot!al-outstanding-ensures}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{old\/}})\index{inv} \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\rm{car}}\,({\it{tree\/}})), {\it{old\/}})\index{channel}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,({\tt{'}}{\tt{root-receive-report}}, {\rm{car}}\,({\it{tree\/}}), {\rm{cons}}\,({\it{child\/}}, {\rm{car}}\,({\it{tree\/}}))))\-\index{n})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding} \\ 
$<$$\;\;\;\;${\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  root-up-link-full-unless \\ \index{root-up-link-full-unless}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\rm{car}}\,({\it{tree\/}})), {\it{old\/}})\index{channel}) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\not=$ {\rm{list}}\,(\=\+{\tt{'}}{\tt{root-receive-report}}, \\ 
{\rm{car}}\,({\it{tree\/}}), \\ 
{\rm{cons}}\,({\it{child\/}}, {\rm{car}}\,({\it{tree\/}})))\-) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\rm{car}}\,({\it{tree\/}})), {\it{new\/}})\index{channel})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  up-link-full-decreases-total-outstanding-ensures \\ \index{up-link-full-decreases-total-out!standing-ensures}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{old\/}})\index{inv} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), {\it{old\/}})\index{channel}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,(\=\+{\tt{'}}{\tt{receive-report}}, \\ 
{\it{node\/}}, \\ 
{\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}))\-)\-\index{n})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding} \\ 
$<$$\;\;\;\;${\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  up-link-full-unless \\ \index{up-link-full-unless}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})) \\ 
$\wedge$$\;\;\;\;$({\it{child\/}} $\in$ {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), {\it{old\/}})\index{channel}) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\not=$ {\rm{list}}\,(\=\+{\tt{'}}{\tt{receive-report}}, \\ 
{\it{node\/}}, \\ 
{\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), \\ 
{\rm{cons}}\,({\it{node\/}}, {\rm{parent}}\,({\it{node\/}}, {\it{tree\/}})\index{parent}))\-) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{cons}}\,({\it{child\/}}, {\it{node\/}}), {\it{new\/}})\index{channel})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  member-cdr-nodes-equals \\ \index{member-cdr-nodes-equals}
\=\+({\rm{treep}}\,({\it{tree\/}})\index{treep} $\wedge$ ({\it{node\/}} $\not=$ {\rm{car}}\,({\it{tree\/}}))) \\ 
$\rightarrow$$\;\;\;\;$(({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}) $=$ ({\it{node\/}} $\in$ {\rm{cdr}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes})))\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  up-link-full-decreases-total-outstanding \\ \index{up-link-full-decreases-total-out!standing}
\=\+({\rm{treep}}\,({\it{tree\/}})\index{treep} $\wedge$ ({\it{node\/}} $\in$ {\rm{nodes}}\,({\it{tree\/}})\index{nodes}) $\wedge$ ({\it{child\/}} $\in$ {\rm{children}}\,({\it{node\/}}, {\it{tree\/}})\index{children})) \\ 
$\rightarrow$$\;\;\;\;${\rm{leads-to}}\,(\=\+{\tt{`}}{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}{\tt{inv}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{tree}}{\tt{ }}{\tt{state}}{\tt{)}} \\ 
{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}\=\+{\tt{listp}} \\ 
{\tt{(}}{\tt{channel}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{cons}}{\tt{ }}{\tt{child}}{\tt{ }}{\tt{node}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}}{\tt{)}}\- \\ 
{\tt{(}}\=\+{\tt{equal}} \\ 
{\tt{(}}\=\+{\tt{total-outstanding}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{'}}{\tt{,}}{\tt{tree}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{add1}}{\tt{ }}{\tt{count}}{\tt{)}}{\tt{)}}\-{\tt{)}}\-{\tt{)}}\-, \\ 
{\tt{`}}{\tt{(}}\=\+{\tt{lessp}} \\ 
{\tt{(}}\=\+{\tt{total-outstanding}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{'}}{\tt{,}}{\tt{tree}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{add1}}{\tt{ }}{\tt{count}}{\tt{)}}{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{leads-to}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-started-root-decreases-total-outstanding-ensures \\ \index{not-started-root-decreases-tota!l-outstanding-ensures}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{inv}}\,({\it{tree\/}}, {\it{old\/}})\index{inv} \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{old\/}})\index{status} $=$ {\tt{'}}{\tt{not-started}}) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,(\=\+{\it{old\/}}, \\ 
{\it{new\/}}, \\ 
{\rm{list}}\,({\tt{'}}{\tt{start}}, {\rm{car}}\,({\it{tree\/}}), {\rm{rfp}}\,({\rm{car}}\,({\it{tree\/}}), {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children})\index{rfp}))\-\index{n})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{new\/}})\index{total-outstanding} \\ 
$<$$\;\;\;\;${\rm{total-outstanding}}\,({\rm{nodes}}\,({\it{tree\/}})\index{nodes}, {\it{tree\/}}, {\it{old\/}})\index{total-outstanding})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-started-root-unless \\ \index{not-started-root-unless}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;$({\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{old\/}})\index{status} $=$ {\tt{'}}{\tt{not-started}}) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\in$ {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg}) \\ 
$\wedge$$\;\;\;\;$({\it{statement\/}} $\not=$ {\rm{list}}\,(\=\+{\tt{'}}{\tt{start}}, \\ 
{\rm{car}}\,({\it{tree\/}}), \\ 
{\rm{rfp}}\,({\rm{car}}\,({\it{tree\/}}), {\rm{children}}\,({\rm{car}}\,({\it{tree\/}}), {\it{tree\/}})\index{children})\index{rfp})\-) \\ 
$\wedge$$\;\;\;\;${\rm{n}}\,({\it{old\/}}, {\it{new\/}}, {\it{statement\/}})\index{n})\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{status}}\,({\rm{car}}\,({\it{tree\/}}), {\it{new\/}})\index{status} $=$ {\tt{'}}{\tt{not-started}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-started-root-decreases-total-outstanding \\ \index{not-started-root-decreases-tota!l-outstanding}
\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\rightarrow$$\;\;\;\;${\rm{leads-to}}\,(\=\+{\tt{`}}{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}{\tt{inv}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{tree}}{\tt{ }}{\tt{state}}{\tt{)}} \\ 
{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}\=\+{\tt{equal}} \\ 
{\tt{(}}{\tt{status}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{car}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}} \\ 
{\tt{'}}{\tt{not-started}}{\tt{)}}\- \\ 
{\tt{(}}\=\+{\tt{equal}} \\ 
{\tt{(}}\=\+{\tt{total-outstanding}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{'}}{\tt{,}}{\tt{tree}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{add1}}{\tt{ }}{\tt{count}}{\tt{)}}{\tt{)}}\-{\tt{)}}\-{\tt{)}}\-, \\ 
{\tt{`}}{\tt{(}}\=\+{\tt{lessp}} \\ 
{\tt{(}}\=\+{\tt{total-outstanding}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{'}}{\tt{,}}{\tt{tree}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{add1}}{\tt{ }}{\tt{count}}{\tt{)}}{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{leads-to}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  full-channel-not-f-implies \\ \index{full-channel-not-f-implies}
\=\+{\rm{full-channel}}\,({\it{channels\/}}, {\it{state\/}})\index{full-channel} \\ 
$\rightarrow$$\;\;\;\;$(\=\+({\rm{full-channel}}\,({\it{channels\/}}, {\it{state\/}})\index{full-channel} $\in$ {\it{channels\/}}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{channel}}\,({\rm{full-channel}}\,({\it{channels\/}}, {\it{state\/}})\index{full-channel}, {\it{state\/}})\index{channel}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  total-outstanding-decreases-leads-to \\ \index{total-outstanding-decreases-lea!ds-to}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{initial-condition}}\,(\=\+{\tt{`}}{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}\=\+{\tt{all-empty}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{all-channels}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{(}}{\tt{not-started}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}}{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{initial-condition})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{leads-to}}\,(\=\+{\tt{`}}{\tt{(}}\=\+{\tt{equal}} \\ 
{\tt{(}}\=\+{\tt{total-outstanding}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{'}}{\tt{,}}{\tt{tree}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{add1}}{\tt{ }}{\tt{count}}{\tt{)}}{\tt{)}}\-, \\ 
{\tt{`}}{\tt{(}}\=\+{\tt{lessp}} \\ 
{\tt{(}}\=\+{\tt{total-outstanding}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{'}}{\tt{,}}{\tt{tree}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{add1}}{\tt{ }}{\tt{count}}{\tt{)}}{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{leads-to}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  termination-induction \\ \index{termination-induction}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{initial-condition}}\,(\=\+{\tt{`}}{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}\=\+{\tt{all-empty}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{all-channels}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{(}}{\tt{not-started}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}}{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{initial-condition})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{leads-to}}\,(\=\+{\tt{`}}{\tt{(}}\=\+{\tt{lessp}} \\ 
{\tt{(}}\=\+{\tt{total-outstanding}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{'}}{\tt{,}}{\tt{tree}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{add1}}{\tt{ }}{\tt{count}}{\tt{)}}{\tt{)}}\-, \\ 
{\tt{`}}{\tt{(}}\=\+{\tt{equal}} \\ 
{\tt{(}}\=\+{\tt{total-outstanding}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{'}}{\tt{,}}{\tt{tree}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{0}}{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{leads-to}\-
\end{tabbing}


\begin{tabbing}{\sc Theorem}:  termination \\ \index{termination}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{initial-condition}}\,(\=\+{\tt{`}}{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}\=\+{\tt{all-empty}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{all-channels}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{(}}{\tt{not-started}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}}{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{initial-condition})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{leads-to}}\,(\=\+{\tt{'}}{\tt{(}}{\tt{true}}{\tt{)}}, \\ 
{\tt{`}}{\tt{(}}\=\+{\tt{equal}} \\ 
{\tt{(}}\=\+{\tt{total-outstanding}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{'}}{\tt{,}}{\tt{tree}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{0}}{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{leads-to}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  correctness-condition \\ \index{correctness-condition}
\=\+(\=\+{\rm{treep}}\,({\it{tree\/}})\index{treep} \\ 
$\wedge$$\;\;\;\;${\rm{initial-condition}}\,(\=\+{\tt{`}}{\tt{(}}\=\+{\tt{and}} \\ 
{\tt{(}}\=\+{\tt{all-empty}} \\ 
{\tt{'}}{\tt{,}}{\tt{(}}{\tt{all-channels}}{\tt{ }}{\tt{tree}}{\tt{)}} \\ 
{\tt{state}}{\tt{)}}\- \\ 
{\tt{(}}{\tt{not-started}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{(}}{\tt{nodes}}{\tt{ }}{\tt{tree}}{\tt{)}}{\tt{ }}{\tt{state}}{\tt{)}}{\tt{)}}\-, \\ 
{\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\-\index{initial-condition})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{leads-to}}\,({\tt{'}}{\tt{(}}{\tt{true}}{\tt{)}}, {\tt{`}}{\tt{(}}{\tt{correct}}{\tt{ }}{\tt{'}}{\tt{,}}{\tt{tree}}{\tt{ }}{\tt{state}}{\tt{)}}, {\rm{tree-prg}}\,({\it{tree\/}})\index{tree-prg})\index{leads-to}\-
\end{tabbing}

%\end{list}
\printindex
\end{document}
