1 # bend-mathlib/perm.bend: step-list permutations over bendlib-kernel-list, plus sort value defs and proofs. 2 # Resolves the unpublished kernel by its real content hash (devlib); see packages/bendlib-kernel-list/README.md. 3 import Base 4 import 0xb5c8145e53a6a127d611f45f602666ec/list.bend as K 5 6 def internal_shift(+s: List<&2, Nat>) -> List<&2, Nat>: 7 match s: 8 case Nil{}: 9 Nil{} 10 case +i <> rest: 11 (1n+i) <> internal_shift(rest) 12 13 def internal_apply_app(-A: Data, +s1: List<&2, Nat>, +s2: List<&2, Nat>, +xs: List<&2, A>) -> {K.apply(A, List.append(&2, Nat, s1, s2), xs) == K.apply(A, s2, K.apply(A, s1, xs)) : List<&2, A>}: 14 match s1: 15 case Nil{}: 16 {==} 17 case +i <> rest: 18 internal_apply_app(A, rest, s2, K.swap_at(A, i, xs)) 19 20 def internal_apply_shift(-A: Data, +s: List<&2, Nat>, +x: A, +xs: List<&2, A>) -> {K.apply(A, internal_shift(s), x <> xs) == x <> K.apply(A, s, xs) : List<&2, A>}: 21 match s: 22 case Nil{}: 23 {==} 24 case +i <> rest: 25 internal_apply_shift(A, rest, x, K.swap_at(A, i, xs)) 26 27 # Permutation is reflexive. 28 def perm_refl(-A: Data, -xs: List<&2, A>) -> K.perm(A, xs, xs): 29 (Nil{}, {==}) 30 31 # The empty list is a permutation of itself. 32 def perm_nil(-A: Data) -> K.perm(A, Nil{}, Nil{}): 33 (Nil{}, {==}) 34 35 # Swapping the two leading elements is a permutation. 36 def perm_swap(-A: Data, -x: A, -y: A, -t: List<&2, A>) -> K.perm(A, x <> y <> t, y <> x <> t): 37 (0n <> Nil{}, {==}) 38 39 def internal_trans_eq(-A: Data, +s1: List<&2, Nat>, +s2: List<&2, Nat>, +xs: List<&2, A>, -ys: List<&2, A>, -zs: List<&2, A>, e1: K.perm_steps(A, s1, xs, ys), e2: K.perm_steps(A, s2, ys, zs)) -> K.perm_steps(A, List.append(&2, Nat, s1, s2), xs, zs): 40 %Equal.sym(List<&2, A>, K.apply(A, List.append(&2, Nat, s1, s2), xs), K.apply(A, s2, K.apply(A, s1, xs)), internal_apply_app(A, s1, s2, xs)) : {_ == zs : List<&2, A>} 41 %Equal.sym(List<&2, A>, K.apply(A, s1, xs), ys, e1) : {K.apply(A, s2, _) == zs : List<&2, A>} 42 e2 43 44 # Permutation is transitive. 45 def perm_trans(-A: Data, +xs: List<&2, A>, -ys: List<&2, A>, -zs: List<&2, A>, h1: K.perm(A, xs, ys), h2: K.perm(A, ys, zs)) -> K.perm(A, xs, zs): 46 (s1, e1) = h1 47 (s2, e2) = h2 48 +s1 = s1 49 +s2 = s2 50 (List.append(&2, Nat, s1, s2), internal_trans_eq(A, s1, s2, xs, ys, zs, e1, e2)) 51 52 def internal_cons_eq(-A: Data, +s: List<&2, Nat>, +x: A, +xs: List<&2, A>, -ys: List<&2, A>, e: K.perm_steps(A, s, xs, ys)) -> K.perm_steps(A, internal_shift(s), x <> xs, x <> ys): 53 %Equal.sym(List<&2, A>, K.apply(A, internal_shift(s), x <> xs), x <> K.apply(A, s, xs), internal_apply_shift(A, s, x, xs)) : {_ == x <> ys : List<&2, A>} 54 %Equal.sym(List<&2, A>, K.apply(A, s, xs), ys, e) : {x <> _ == x <> ys : List<&2, A>} 55 {==} 56 57 # Prepending the same element preserves permutation. 58 def perm_cons(-A: Data, +x: A, +xs: List<&2, A>, -ys: List<&2, A>, h: K.perm(A, xs, ys)) -> K.perm(A, x <> xs, x <> ys): 59 (s, e) = h 60 +s = s 61 (internal_shift(s), internal_cons_eq(A, s, x, xs, ys, e)) 62 63 # A Perm hypothesis in existential form is reusable. 64 def perm_dup(-A: Data, -xs: List<&2, A>, -ys: List<&2, A>, +h: K.perm(A, xs, ys)) -> K.perm(A, xs, ys) & K.perm(A, xs, ys): 65 (h, h) 66 67 # Insertion into a list, generic comparator (structural, Base-only branching via Bool.pick). 68 def insert_by(~A: Data, ~le: A -> A -> Bool, +x: A, xs: List<&2, A>) -> List<&2, A>: 69 match xs: 70 case Nil{}: 71 x <> Nil{} 72 case +y <> +t: 73 Bool.pick(List<&2, A>, le(x, y), x <> y <> t, y <> insert_by(~A, ~le, x, t)) 74 75 def isort_by(~A: Data, ~le: A -> A -> Bool, xs: List<&2, A>) -> List<&2, A>: 76 match xs: 77 case Nil{}: 78 Nil{} 79 case +x <> t: 80 insert_by(~A, ~le, x, isort_by(~A, ~le, t)) 81 82 def internal_ins_pick(-A: Data, b: Bool, +x: A, +y: A, +t: List<&2, A>, -r: List<&2, A>, ih: K.perm(A, x <> t, r)) -> K.perm(A, x <> y <> t, Bool.pick(List<&2, A>, b, x <> y <> t, y <> r)): 83 match b: 84 case True{}: 85 perm_refl(A, x <> y <> t) 86 case False{}: 87 perm_trans(A, x <> y <> t, y <> x <> t, y <> r, perm_swap(A, x, y, t), perm_cons(A, y, x <> t, r, ih)) 88 89 # Inserting x into xs permutes x <> xs. 90 def insert_by_perm(~A: Data, ~le: A -> A -> Bool, +x: A, +xs: List<&2, A>) -> K.perm(A, x <> xs, insert_by(~A, ~le, x, xs)): 91 match xs: 92 case Nil{}: 93 perm_refl(A, x <> Nil{}) 94 case +y <> t: 95 internal_ins_pick(A, le(x, y), x, y, t, insert_by(~A, ~le, x, t), insert_by_perm(~A, ~le, x, t)) 96 97 # Insertion sort permutes its input. 98 def isort_by_perm(~A: Data, ~le: A -> A -> Bool, +xs: List<&2, A>) -> K.perm(A, xs, isort_by(~A, ~le, xs)): 99 match xs: 100 case Nil{}: 101 perm_refl(A, Nil{}) 102 case +x <> t: 103 perm_trans(A, x <> t, x <> isort_by(~A, ~le, t), isort_by(~A, ~le, x <> t), perm_cons(A, x, t, isort_by(~A, ~le, t), isort_by_perm(~A, ~le, t)), insert_by_perm(~A, ~le, x, isort_by(~A, ~le, t))) 104 105 # Closed instance: instantiate at Nat and at String. 106 def isort_by_perm_nat(+xs: List<&2, Nat>) -> K.perm(Nat, xs, isort_by(~Nat, ~Nat.is_le, xs)): 107 isort_by_perm(~Nat, ~Nat.is_le, xs) 108 109 def internal_append_nil(-A: Data, +ys: List<&2, A>) -> {List.append(&2, A, ys, Nil{}) == ys : List<&2, A>}: 110 match ys: 111 case Nil{}: 112 {==} 113 case +y <> t: 114 %Equal.sym(List<&2, A>, List.append(&2, A, t, Nil{}), t, internal_append_nil(A, t)) : {y <> _ == y <> t : List<&2, A>} 115 {==} 116 117 # Appending Nil is a permutation (steps: none). 118 def perm_append_nil(-A: Data, +xs: List<&2, A>) -> K.perm(A, List.append(&2, A, xs, Nil{}), xs): 119 (Nil{}, internal_append_nil(A, xs)) 120 121 # Moving an element from the middle to the front is a permutation. 122 def perm_move(-A: Data, +xs: List<&2, A>, +y: A, +t: List<&2, A>) -> K.perm(A, List.append(&2, A, xs, y <> t), y <> List.append(&2, A, xs, t)): 123 match xs: 124 case Nil{}: 125 perm_refl(A, y <> t) 126 case +x <> r: 127 perm_trans(A, x <> List.append(&2, A, r, y <> t), x <> y <> List.append(&2, A, r, t), y <> x <> List.append(&2, A, r, t), perm_cons(A, x, List.append(&2, A, r, y <> t), y <> List.append(&2, A, r, t), perm_move(A, r, y, t)), perm_swap(A, x, y, List.append(&2, A, r, t))) 128 129 def merge_by(~A: Data, ~le: A -> A -> Bool, xs: List<&2, A>, ys: List<&2, A>) -> List<&2, A>: 130 match xs ys: 131 case Nil{} _: 132 ys 133 case +x <> +xt Nil{}: 134 x <> xt 135 case +x <> +xt +y <> +yt: 136 Bool.pick(List<&2, A>, le(x, y), x <> merge_by(~A, ~le, xt, y <> yt), y <> merge_by(~A, ~le, x <> xt, yt)) 137 138 def internal_merge_pick(-A: Data, b: Bool, +x: A, +xt: List<&2, A>, +y: A, +yt: List<&2, A>, -m1: List<&2, A>, -m2: List<&2, A>, ih1: K.perm(A, List.append(&2, A, xt, y <> yt), m1), ih2: K.perm(A, x <> List.append(&2, A, xt, yt), m2)) -> K.perm(A, x <> List.append(&2, A, xt, y <> yt), Bool.pick(List<&2, A>, b, x <> m1, y <> m2)): 139 match b: 140 case True{}: 141 perm_cons(A, x, List.append(&2, A, xt, y <> yt), m1, ih1) 142 case False{}: 143 perm_trans(A, x <> List.append(&2, A, xt, y <> yt), y <> x <> List.append(&2, A, xt, yt), y <> m2, perm_move(A, x <> xt, y, yt), perm_cons(A, y, x <> List.append(&2, A, xt, yt), m2, ih2)) 144 145 # Merging permutes the concatenation. 146 def merge_by_perm(~A: Data, ~le: A -> A -> Bool, +xs: List<&2, A>, +ys: List<&2, A>) -> K.perm(A, List.append(&2, A, xs, ys), merge_by(~A, ~le, xs, ys)): 147 match xs ys: 148 case Nil{} _: 149 perm_refl(A, ys) 150 case +x <> +xt Nil{}: 151 perm_cons(A, x, List.append(&2, A, xt, Nil{}), xt, perm_append_nil(A, xt)) 152 case +x <> +xt +y <> +yt: 153 internal_merge_pick(A, le(x, y), x, xt, y, yt, merge_by(~A, ~le, xt, y <> yt), merge_by(~A, ~le, x <> xt, yt), merge_by_perm(~A, ~le, xt, y <> yt), merge_by_perm(~A, ~le, x <> xt, yt)) 154 155 def merge_by_perm_nat(+xs: List<&2, Nat>, +ys: List<&2, Nat>) -> K.perm(Nat, List.append(&2, Nat, xs, ys), merge_by(~Nat, ~Nat.is_le, xs, ys)): 156 merge_by_perm(~Nat, ~Nat.is_le, xs, ys) 157 158 # Moving the front element into the middle is a permutation. 159 def perm_move_rev(-A: Data, +xs: List<&2, A>, +y: A, +t: List<&2, A>) -> K.perm(A, y <> List.append(&2, A, xs, t), List.append(&2, A, xs, y <> t)): 160 match xs: 161 case Nil{}: 162 perm_refl(A, y <> t) 163 case +x <> r: 164 perm_trans(A, y <> x <> List.append(&2, A, r, t), x <> y <> List.append(&2, A, r, t), x <> List.append(&2, A, r, y <> t), perm_swap(A, y, x, List.append(&2, A, r, t)), perm_cons(A, x, y <> List.append(&2, A, r, t), List.append(&2, A, r, y <> t), perm_move_rev(A, r, y, t))) 165 166 # Appending commutes up to permutation (derived without symmetry). 167 def perm_append_comm(-A: Data, +xs: List<&2, A>, +ys: List<&2, A>) -> K.perm(A, List.append(&2, A, xs, ys), List.append(&2, A, ys, xs)): 168 match xs: 169 case Nil{}: 170 (Nil{}, Equal.sym(List<&2, A>, List.append(&2, A, ys, Nil{}), ys, internal_append_nil(A, ys))) 171 case +x <> r: 172 perm_trans(A, x <> List.append(&2, A, r, ys), x <> List.append(&2, A, ys, r), List.append(&2, A, ys, x <> r), perm_cons(A, x, List.append(&2, A, r, ys), List.append(&2, A, ys, r), perm_append_comm(A, r, ys)), perm_move_rev(A, ys, x, r)) 173 174 # Permuting the right operand of an append. 175 def perm_append_right(-A: Data, +xs: List<&2, A>, +ys: List<&2, A>, -zs: List<&2, A>, h: K.perm(A, ys, zs)) -> K.perm(A, List.append(&2, A, xs, ys), List.append(&2, A, xs, zs)): 176 match xs: 177 case Nil{}: 178 h 179 case +x <> r: 180 perm_cons(A, x, List.append(&2, A, r, ys), List.append(&2, A, r, zs), perm_append_right(A, r, ys, zs, h)) 181 182 # Permuting both operands of an append. 183 def perm_append(-A: Data, +xs: List<&2, A>, +xs2: List<&2, A>, +ys: List<&2, A>, -ys2: List<&2, A>, p: K.perm(A, xs, xs2), q: K.perm(A, ys, ys2)) -> K.perm(A, List.append(&2, A, xs, ys), List.append(&2, A, xs2, ys2)): 184 perm_trans(A, List.append(&2, A, xs, ys), List.append(&2, A, ys, xs), List.append(&2, A, xs2, ys2), perm_append_comm(A, xs, ys), perm_trans(A, List.append(&2, A, ys, xs), List.append(&2, A, ys, xs2), List.append(&2, A, xs2, ys2), perm_append_right(A, ys, xs, xs2, p), perm_trans(A, List.append(&2, A, ys, xs2), List.append(&2, A, xs2, ys), List.append(&2, A, xs2, ys2), perm_append_comm(A, ys, xs2), perm_append_right(A, xs2, ys, ys2, q)))) 185 186 def evens(-A: Data, xs: List<&2, A>) -> List<&2, A>: 187 match xs: 188 case Nil{}: 189 Nil{} 190 case +x <> r: 191 match r: 192 case Nil{}: 193 x <> Nil{} 194 case +y <> t: 195 x <> evens(A, t) 196 197 def odds(-A: Data, xs: List<&2, A>) -> List<&2, A>: 198 match xs: 199 case Nil{}: 200 Nil{} 201 case +x <> r: 202 match r: 203 case Nil{}: 204 Nil{} 205 case +y <> t: 206 y <> odds(A, t) 207 208 # Splitting into evens and odds is a permutation. 209 def split_perm(-A: Data, +xs: List<&2, A>) -> K.perm(A, xs, List.append(&2, A, evens(A, xs), odds(A, xs))): 210 match xs: 211 case Nil{}: 212 perm_refl(A, Nil{}) 213 case +x <> r: 214 match r: 215 case Nil{}: 216 perm_refl(A, x <> Nil{}) 217 case +y <> t: 218 perm_cons(A, x, y <> t, List.append(&2, A, evens(A, t), y <> odds(A, t)), perm_trans(A, y <> t, y <> List.append(&2, A, evens(A, t), odds(A, t)), List.append(&2, A, evens(A, t), y <> odds(A, t)), perm_cons(A, y, t, List.append(&2, A, evens(A, t), odds(A, t)), split_perm(A, t)), perm_move_rev(A, evens(A, t), y, odds(A, t)))) 219 220 # Merge sort with fuel (the fuel only bounds recursion; it never affects the permutation). 221 def msort_by(~A: Data, ~le: A -> A -> Bool, fuel: Nat, +xs: List<&2, A>) -> List<&2, A>: 222 match fuel: 223 case 0n: 224 xs 225 case 1n++f: 226 merge_by(~A, ~le, msort_by(~A, ~le, f, evens(A, xs)), msort_by(~A, ~le, f, odds(A, xs))) 227 228 # Merge sort permutes its input, for any fuel. 229 def msort_by_perm(~A: Data, ~le: A -> A -> Bool, fuel: Nat, +xs: List<&2, A>) -> K.perm(A, xs, msort_by(~A, ~le, fuel, xs)): 230 match fuel: 231 case 0n: 232 perm_refl(A, xs) 233 case 1n++f: 234 perm_trans(A, xs, List.append(&2, A, evens(A, xs), odds(A, xs)), msort_by(~A, ~le, 1n+f, xs), split_perm(A, xs), perm_trans(A, List.append(&2, A, evens(A, xs), odds(A, xs)), List.append(&2, A, msort_by(~A, ~le, f, evens(A, xs)), msort_by(~A, ~le, f, odds(A, xs))), msort_by(~A, ~le, 1n+f, xs), perm_append(A, evens(A, xs), msort_by(~A, ~le, f, evens(A, xs)), odds(A, xs), msort_by(~A, ~le, f, odds(A, xs)), msort_by_perm(~A, ~le, f, evens(A, xs)), msort_by_perm(~A, ~le, f, odds(A, xs))), merge_by_perm(~A, ~le, msort_by(~A, ~le, f, evens(A, xs)), msort_by(~A, ~le, f, odds(A, xs))))) 235 236 def sort_by(~A: Data, ~le: A -> A -> Bool, +xs: List<&2, A>) -> List<&2, A>: 237 msort_by(~A, ~le, List.length(&2, A, xs), xs) 238 239 # The sort permutes its input. 240 def sort_by_perm(~A: Data, ~le: A -> A -> Bool, +xs: List<&2, A>) -> K.perm(A, xs, sort_by(~A, ~le, xs)): 241 msort_by_perm(~A, ~le, List.length(&2, A, xs), xs) 242 243 def sort_by_perm_nat(+xs: List<&2, Nat>) -> K.perm(Nat, xs, sort_by(~Nat, ~Nat.is_le, xs)): 244 sort_by_perm(~Nat, ~Nat.is_le, xs) 245 246 def internal_sort_nat_test() -> {sort_by(~Nat, ~Nat.is_le, [5n, 1n, 4n, 2n, 3n, 1n]) == [1n, 1n, 2n, 3n, 4n, 5n] : List<&2, Nat>}: 247 {==} 248 249 def internal_swap_head_invol(-A: Data, xs: List<&2, A>) -> {K.swap_head(A, K.swap_head(A, xs)) == xs : List<&2, A>}: 250 match xs: 251 case Nil{}: 252 {==} 253 case +x <> t: 254 match t: 255 case Nil{}: 256 {==} 257 case +y <> u: 258 {==} 259 260 def internal_swap_at_invol(-A: Data, +i: Nat, +xs: List<&2, A>) -> {K.swap_at(A, i, K.swap_at(A, i, xs)) == xs : List<&2, A>}: 261 match i: 262 case 0n: 263 internal_swap_head_invol(A, xs) 264 case 1n+p: 265 match xs: 266 case Nil{}: 267 {==} 268 case +x <> t: 269 %Equal.sym(List<&2, A>, K.swap_at(A, p, K.swap_at(A, p, t)), t, internal_swap_at_invol(A, p, t)) : {x <> _ == x <> t : List<&2, A>} 270 {==} 271 272 def internal_invert(+s: List<&2, Nat>) -> List<&2, Nat>: 273 match s: 274 case Nil{}: 275 Nil{} 276 case +i <> rest: 277 List.append(&2, Nat, internal_invert(rest), i <> Nil{}) 278 279 def internal_apply_invert(-A: Data, +s: List<&2, Nat>, +xs: List<&2, A>) -> {K.apply(A, internal_invert(s), K.apply(A, s, xs)) == xs : List<&2, A>}: 280 match s: 281 case Nil{}: 282 {==} 283 case +i <> rest: 284 %Equal.sym(List<&2, A>, K.apply(A, List.append(&2, Nat, internal_invert(rest), i <> Nil{}), K.apply(A, rest, K.swap_at(A, i, xs))), K.apply(A, i <> Nil{}, K.apply(A, internal_invert(rest), K.apply(A, rest, K.swap_at(A, i, xs)))), internal_apply_app(A, internal_invert(rest), i <> Nil{}, K.apply(A, rest, K.swap_at(A, i, xs)))) : {_ == xs : List<&2, A>} 285 %Equal.sym(List<&2, A>, K.apply(A, internal_invert(rest), K.apply(A, rest, K.swap_at(A, i, xs))), K.swap_at(A, i, xs), internal_apply_invert(A, rest, K.swap_at(A, i, xs))) : {K.apply(A, i <> Nil{}, _) == xs : List<&2, A>} 286 internal_swap_at_invol(A, i, xs) 287 288 def internal_sym_eq(-A: Data, +s: List<&2, Nat>, +xs: List<&2, A>, -ys: List<&2, A>, e: K.perm_steps(A, s, xs, ys)) -> K.perm_steps(A, internal_invert(s), ys, xs): 289 %e : {K.apply(A, internal_invert(s), _) == xs : List<&2, A>} 290 internal_apply_invert(A, s, xs) 291 292 # Permutation is symmetric. 293 def perm_sym(-A: Data, +xs: List<&2, A>, -ys: List<&2, A>, h: K.perm(A, xs, ys)) -> K.perm(A, ys, xs): 294 (s, e) = h 295 +s = s 296 (internal_invert(s), internal_sym_eq(A, s, xs, ys, e)) 297 298 # Permutation preserves length. 299 def internal_swap_head_length(-A: Data, xs: List<&2, A>) -> {List.length(&2, A, K.swap_head(A, xs)) == List.length(&2, A, xs) : Nat}: 300 match xs: 301 case Nil{}: 302 {==} 303 case +x <> t: 304 match t: 305 case Nil{}: 306 {==} 307 case +y <> u: 308 {==} 309 310 def internal_swap_at_length(-A: Data, +i: Nat, +xs: List<&2, A>) -> {List.length(&2, A, K.swap_at(A, i, xs)) == List.length(&2, A, xs) : Nat}: 311 match i: 312 case 0n: 313 internal_swap_head_length(A, xs) 314 case 1n+p: 315 match xs: 316 case Nil{}: 317 {==} 318 case +x <> t: 319 %Equal.sym(Nat, List.length(&2, A, K.swap_at(A, p, t)), List.length(&2, A, t), internal_swap_at_length(A, p, t)) : {1n+_ == 1n+List.length(&2, A, t) : Nat} 320 {==} 321 322 def internal_apply_length(-A: Data, +s: List<&2, Nat>, +xs: List<&2, A>) -> {List.length(&2, A, K.apply(A, s, xs)) == List.length(&2, A, xs) : Nat}: 323 match s: 324 case Nil{}: 325 {==} 326 case +i <> rest: 327 Equal.trans(Nat, List.length(&2, A, K.apply(A, rest, K.swap_at(A, i, xs))), List.length(&2, A, K.swap_at(A, i, xs)), List.length(&2, A, xs), internal_apply_length(A, rest, K.swap_at(A, i, xs)), internal_swap_at_length(A, i, xs)) 328 329 def internal_length_eq(-A: Data, +s: List<&2, Nat>, +xs: List<&2, A>, -ys: List<&2, A>, e: K.perm_steps(A, s, xs, ys)) -> {List.length(&2, A, ys) == List.length(&2, A, xs) : Nat}: 330 %e : {List.length(&2, A, _) == List.length(&2, A, xs) : Nat} 331 internal_apply_length(A, s, xs) 332 333 def perm_length(-A: Data, +xs: List<&2, A>, -ys: List<&2, A>, h: K.perm(A, xs, ys)) -> {List.length(&2, A, ys) == List.length(&2, A, xs) : Nat}: 334 (s, e) = h 335 internal_length_eq(A, s, xs, ys, e) 336 337 def internal_perm_nil_nat() -> K.perm(Nat, Nil{}, Nil{}): 338 perm_nil(Nat) 339 340 def internal_perm_dup_nat(+xs: List<&2, Nat>, -ys: List<&2, Nat>, h: K.perm(Nat, xs, ys)) -> K.perm(Nat, xs, ys) & K.perm(Nat, xs, ys): 341 perm_dup(Nat, xs, ys, h) 342 343 def internal_perm_sym_nat(+xs: List<&2, Nat>, -ys: List<&2, Nat>, h: K.perm(Nat, xs, ys)) -> K.perm(Nat, ys, xs): 344 perm_sym(Nat, xs, ys, h) 345 346 def internal_perm_length_nat(+xs: List<&2, Nat>, -ys: List<&2, Nat>, h: K.perm(Nat, xs, ys)) -> {List.length(&2, Nat, ys) == List.length(&2, Nat, xs) : Nat}: 347 perm_length(Nat, xs, ys, h)