theorem
  s in coset push(e,s) & (not emp s implies s in coset pop s)
  proof
    pop push(e,s) = s & not emp push(e,s) & push(e,s) in coset push(e,s)
    by Def11,Def12,Def17;
    hence s in coset push(e,s) by Def17;
    assume not emp s; then
    push(top s, pop s) = s & pop s in coset pop s by Def9,Def17;
    hence thesis by Def17;
  end;
