theorem
  f just_once_values y implies f is_one-to-one_at f <- y
proof
  assume
A1: f just_once_values y;
A2: now
    let x;
    assume x in dom f & x <> f <- y;
    then f.x <> y by A1,Def3;
    hence f.x <> f.(f <- y) by A1,Def3;
  end;
  f <- y in dom f by A1,Def3;
  hence thesis by A2,Th3;
end;
