\section{Traversal phase --- proofs}

For each operation called for by the traversal algorithms, we prove
that the commit generation preconditions are met.

WIP WHAT ABOUT PROVING ALL THE TRAVERSAL RESULTS

\subsection{Base Dependency Merge, Base Sibling Merge}

We do not prove that the preconditions are met.  Instead, we check
them at runtime.  If they turn out not to be met, we abandon
\alg{Merge-Base} and resort to \alg{Recreate-Base}.

TODO COMPLETE MERGE-BASE STUFF

WIP WHAT ABOUT PROVING ALL THE TRAVERSAL RESULTS

\subsection{Tip Base Merge}

$L = W$, $R = \tipcn$.

TODO TBD

Afterwards, $\baseof{W} = \tipcn$.

\subsection{Tip Source Merge}

In fact, we do this backwards: $L = S$, $R = W$.  Since $S \in \pcy$,
the resulting $C \in \pcy$ and the remaining properties of the Merge
commit construction are symmetrical in $L$ and $R$ so this is fine.

By the results of Tip Base Merge, $\baseof{W} = \tipcn$.

By Base Ends Supreme, $\tipcn \ge \baseof{S}$ i.e.
$\baseof{R} \ge \baseof{L}$.

Either $\baseof{L} = \baseof{M}$, or we must choose a different $M$ in
which case $M = \baseof{S}$ will suffice.

