(* Inversion lemma *)
Fact subcode_sss_step_inv_1 P i st1 st2 : (fst st1,i::nil) <sc P -> P // st1 :1> st2 -> i // st1 -1> st2.
(* Starting a computation in subcode ending outside of it can be cut in half *)
Fact subcode_sss_subcode_inv P Q p k st1 st2 st3 :
out_code (fst st3) P
-> P <sc Q
-> P // st1 -[p]-> st2
-> Q // st1 -[k]-> st3
-> exists q, k = p+q /\ Q // st2 -[q]-> st3.
Fact subcode_sss_terminates_inv P Q st st1 :
Q // st ↓
-> P <sc Q
-> P // st ~~> st1
-> Q // st1 ↓.
Fact subcode_sss_progress_inv P Q p st1 st2 st3 :
out_code (fst st3) P
-> P <sc Q
-> P // st1 -+> st2
-> Q // st1 -[p]-> st3
-> exists q, q < p /\ Q // st2 -[q]-> st3.
Section sss_terminates_ind.
Variable (P : code) (R : state -> Prop).
Hypothesis (HR0 : forall st, out_code (fst st) P -> R st)
(HR1 : forall st1, (forall Q st2, Q <sc P -> Q // st1 -+> st2 -> P // st2 ↓ -> R st2) -> R st1).

(* Specifications: *)
Theorem sss_terminates_ind st : P // st ↓ -> R st.
End sss_terminates_ind.