theorem Th8:
  |.push(e,s).| = <*e*>^|.s.|
  proof
    not emp push(e,s) by Def12;
    hence |.push(e,s).| = <*top push(e,s)*>^|.pop push(e,s).| by Th6
    .= <*e*>^|.pop push(e,s).| by Def10
    .= <*e*>^|.s.| by Def11;
  end;
