E, X1, X2:Type, dE:EqDecider(E), dL:EqDecider(IdLnk), pred?:(E(E+Unit)),
info:(E(IdX1+(IdLnkE)X2)),
p:(e:E, l:IdLnk.
p:(e':E.
p:(e'':E.
p:(rcv?(e'')
p:( sender(e'') = e
p:( link(e'') = l
p:( e'' = e'  e'' < e' & loc(e') = destination(l)  Id), e:E, l:IdLnk.
SWellFounded(pred!(e;e'))
 (e:E. first(e)  loc(pred(e)) = loc(e)  Id)
 (e, e':E. loc(e) = loc(e')  Id  pred?(e) = pred?(e')  e = e')
 (r:E. (r  receives(dE;dL;pred?;info;p;e;l))  rcv?(r) & sender(r) = e & link(r) = l) 

latex

Definitions	False, x f y, R^*, eventlist(pred?;e), sends-bound(p;e;l), P  Q, (x  l), receives(dE;dL;pred?;info;p;e;l), S  T, rcv-from-on(dE;dL;info;e;l;r), P  Q, , SWellFounded(R(x;y)), A & B, A, b, first(e), pred(e), x,y. t(x;y), pred!(e;e'), x:A. B(x), rcv?(e), sender(e), link(e), P  Q, P & Q, P  Q, e < e', Prop, loc(e), destination(l), Id, Unit, IdLnk, EqDecider(T), x:A. B(x), t  T
Lemmas	deq wf, IdLnk wf, unit wf, Id wf, ldst wf, loc wf, cless wf, link wf, sender wf, rcv? wf, assert wf, pred! wf, strongwellfounded wf, pred wf, first wf, not wf, nat wf, rcv-from-on wf, receives wf, l member wf, sends-bound wf, eventlist wf, member filter, assert-rcv-from-on, member eventlist, rel star wf, strong-sends-bound-property