+\subsection{Reachability and coverage}
+
+We ensure Tip Covers Reachable as follows:
+
+\begin{itemize}
+\item We do not generate any commits $\in \py$ other than
+ during $\alg{Merge-Tip}(\py)$;
+\item So at the start of $\alg{Merge-Tip}(\py)$,
+ $ \pendsof{\allreach}{\py} = \pendsof{\allsrcs}{\py} $
+\item $\alg{Merge-tip}$ arranges that when it is done
+ $\tippy \ge \pendsof{\allreach}{\py}$ --- see below.
+\end{itemize}
+
+A corrolary is as follows:
+\statement{Tip Covers Superior Reachable} {
+ \bigforall_{\pd \isdep \pc}
+ \tipdy \ge \pendsof{\allreachof{\pcy}}{\pdy}
+}
+\proof{
+ No commits $\in \pdy$ are created other than during
+ $\alg{Merge-Tip}(\pd)$, which runs (and has thus completed)
+ before $\alg{Merge-Tip}(\pcy)$
+ So $\pendsof{\allreachof{\pcy}}{\pdy} =
+ \pendsof{\allreachof{\pdy}}{\pdy}$.
+}
+
+\subsection{Traversal Lemmas}
+
+\statement{Tip Correct Contents}{
+ \tipcy \haspatch \pa E
+ \equiv
+ \pa E = \pc \lor \pa E \isdep \pc
+}
+\proof{
+ For $\pc = \pa E$, Tip Own Contents suffices.
+ For $\pc \neq \pa E$, Exclusive Tip Contents
+ gives $D \isin \tipcy \equiv D \isin \baseof{\tipcy}$
+ which by Correct Base $\equiv D \isin \tipcn$.
+}
+