(* Inversion lemma *)

  Fact subcode_sss_step_inv_1 P i st1 st2 : (fst st1,i::nil) <sc P -> P // st1 :1> st2 -> i // st1 -1> st2.(* Starting a computation in subcode ending outside of it
     can be cut in half *)

  Fact subcode_sss_subcode_inv P Q p k st1 st2 st3 :
           out_code (fst st3) P 
        -> P <sc Q
        -> P // st1 -[p]-> st2
        -> Q // st1 -[k]-> st3
        -> exists q, k = p+q /\ Q // st2 -[q]-> st3.Fact subcode_sss_terminates_inv P Q st st1 :
           Q // st ↓
        -> P <sc Q
        -> P // st ~~> st1
        -> Q // st1 ↓.Fact subcode_sss_progress_inv P Q p st1 st2 st3 :
           out_code (fst st3) P 
        -> P <sc Q
        -> P // st1 -+> st2
        -> Q // st1 -[p]-> st3
        -> exists q, q < p /\ Q // st2 -[q]-> st3.

(* Specifications: *)
Theorem sss_terminates_ind st : P // st ↓ -> R st.
Theorem sss_compute_max_ind st1 st3 : P // st1 -]] st3 -> R st1 st3.