[STATEMENT]
lemma strand_sem_subst_d:
  assumes "(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}"
  shows "\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>) \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>) \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}

goal (1 subgoal):
 1. \<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>) \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
proof (induction S arbitrary: \<delta> M rule: strand_sem_induct)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 4. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 5. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
case (ConsSnd M ts S)
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>d (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>d \<theta>
\<lbrakk>M; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (5 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 4. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 5. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
hence "\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>" "\<forall>t \<in> set ts. M \<turnstile> t \<cdot> (\<delta> \<circ>\<^sub>s \<theta>)"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>d (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>d \<theta>
\<lbrakk>M; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (1 subgoal):
 1. \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta> &&& \<forall>t\<in>set ts. M \<turnstile> t \<cdot> \<delta> \<circ>\<^sub>s \<theta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
\<forall>t\<in>set ts. M \<turnstile> t \<cdot> \<delta> \<circ>\<^sub>s \<theta>

goal (5 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 4. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 5. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
hence "\<forall>t \<in> set ts. M \<turnstile> (t \<cdot> \<delta>) \<cdot> \<theta>"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
\<forall>t\<in>set ts. M \<turnstile> t \<cdot> \<delta> \<circ>\<^sub>s \<theta>

goal (1 subgoal):
 1. \<forall>t\<in>set ts. M \<turnstile> t \<cdot> \<delta> \<cdot> \<theta>
[PROOF STEP]
using subst_comp_all[of \<delta> \<theta> M] subst_subst_compose[of _ \<delta> \<theta>]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
\<forall>t\<in>set ts. M \<turnstile> t \<cdot> \<delta> \<circ>\<^sub>s \<theta>
M \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<circ>\<^sub>s \<theta> = M \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<cdot>\<^sub>s\<^sub>e\<^sub>t \<theta>
?t \<cdot> \<delta> \<circ>\<^sub>s \<theta> = ?t \<cdot> \<delta> \<cdot> \<theta>

goal (1 subgoal):
 1. \<forall>t\<in>set ts. M \<turnstile> t \<cdot> \<delta> \<cdot> \<theta>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set ts. M \<turnstile> t \<cdot> \<delta> \<cdot> \<theta>

goal (5 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 4. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 5. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
hence "\<forall>t \<in> set (ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>). M \<turnstile> t \<cdot> \<theta>"
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set ts. M \<turnstile> t \<cdot> \<delta> \<cdot> \<theta>

goal (1 subgoal):
 1. \<forall>t\<in>set (ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>). M \<turnstile> t \<cdot> \<theta>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set (ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>). M \<turnstile> t \<cdot> \<theta>

goal (5 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 4. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 5. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set (ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>). M \<turnstile> t \<cdot> \<theta>

goal (1 subgoal):
 1. \<lbrakk>M; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
using \<open>\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set (ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>). M \<turnstile> t \<cdot> \<theta>
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>

goal (1 subgoal):
 1. \<lbrakk>M; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>

goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
case (ConsRcv M ts S)
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>d (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>d \<theta>
\<lbrakk>M; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
have "\<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<circ>\<^sub>s \<theta>) \<union> M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<circ>\<^sub>s \<theta>) \<union> M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)
[PROOF STEP]
using ConsRcv.prems(1)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>M; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)

goal (1 subgoal):
 1. \<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<circ>\<^sub>s \<theta>) \<union> M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<circ>\<^sub>s \<theta>) \<union> M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)

goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
hence *: "\<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<cdot>\<^sub>s\<^sub>e\<^sub>t \<theta>) \<union> M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<circ>\<^sub>s \<theta>) \<union> M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)

goal (1 subgoal):
 1. \<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<cdot>\<^sub>s\<^sub>e\<^sub>t \<theta>) \<union> M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)
[PROOF STEP]
by (metis subst_comp_all)
[PROOF STATE]
proof (state)
this:
\<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<cdot>\<^sub>s\<^sub>e\<^sub>t \<theta>) \<union> M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)

goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
have "bvars\<^sub>s\<^sub>t (Receive ts#S) = bvars\<^sub>s\<^sub>t S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = bvars\<^sub>s\<^sub>t S
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = bvars\<^sub>s\<^sub>t S

goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
hence **: "(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}"
[PROOF STATE]
proof (prove)
using this:
bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = bvars\<^sub>s\<^sub>t S

goal (1 subgoal):
 1. (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}
[PROOF STEP]
using ConsRcv.prems(2)
[PROOF STATE]
proof (prove)
using this:
bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = bvars\<^sub>s\<^sub>t S
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (1 subgoal):
 1. (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}

goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
have "\<lbrakk>M; Receive (ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>)#(S \<cdot>\<^sub>s\<^sub>t \<delta>)\<rbrakk>\<^sub>d \<theta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>M; receive\<langle>ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t # (S \<cdot>\<^sub>s\<^sub>t \<delta>)\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
using ConsRcv.IH[OF * **]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<cdot>\<^sub>s\<^sub>e\<^sub>t \<theta>) \<union> M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>

goal (1 subgoal):
 1. \<lbrakk>M; receive\<langle>ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t # (S \<cdot>\<^sub>s\<^sub>t \<delta>)\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; receive\<langle>ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t # (S \<cdot>\<^sub>s\<^sub>t \<delta>)\<rbrakk>\<^sub>d \<theta>

goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>M; receive\<langle>ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t # (S \<cdot>\<^sub>s\<^sub>t \<delta>)\<rbrakk>\<^sub>d \<theta>

goal (1 subgoal):
 1. \<lbrakk>M; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
case (ConsIneq M X F S)
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>d (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>d \<theta>
\<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
hence *: "\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>" and
        ***: "(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> set X = {}"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>d (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>d \<theta>
\<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (1 subgoal):
 1. \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta> &&& (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> set X = {}
[PROOF STEP]
unfolding bvars\<^sub>s\<^sub>t_def ineq_model_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>d (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> \<Union> (set (map (set \<circ> bvars\<^sub>s\<^sub>t\<^sub>p) S)) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>d \<theta>
\<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> \<Union> (set (map (set \<circ> bvars\<^sub>s\<^sub>t\<^sub>p) (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S))) = {}

goal (1 subgoal):
 1. \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta> &&& (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> set X = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> set X = {}

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
have **: "ineq_model (\<delta> \<circ>\<^sub>s \<theta>) X F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ineq_model (\<delta> \<circ>\<^sub>s \<theta>) X F
[PROOF STEP]
using ConsIneq
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>d (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>d \<theta>
\<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (1 subgoal):
 1. ineq_model (\<delta> \<circ>\<^sub>s \<theta>) X F
[PROOF STEP]
by (auto simp add: subst_compose_assoc ineq_model_def)
[PROOF STATE]
proof (state)
this:
ineq_model (\<delta> \<circ>\<^sub>s \<theta>) X F

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
have "\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>)
          \<longrightarrow> (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> (subst_domain \<gamma> \<union> range_vars \<gamma>) = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> (subst_domain \<gamma> \<union> range_vars \<gamma>) = {}
[PROOF STEP]
using * ** ***
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
ineq_model (\<delta> \<circ>\<^sub>s \<theta>) X F
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> set X = {}

goal (1 subgoal):
 1. \<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> (subst_domain \<gamma> \<union> range_vars \<gamma>) = {}
[PROOF STEP]
unfolding range_vars_alt_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
ineq_model (\<delta> \<circ>\<^sub>s \<theta>) X F
(subst_domain \<delta> \<union> fv\<^sub>s\<^sub>e\<^sub>t (subst_range \<delta>)) \<inter> set X = {}

goal (1 subgoal):
 1. \<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> (subst_domain \<delta> \<union> fv\<^sub>s\<^sub>e\<^sub>t (subst_range \<delta>)) \<inter> (subst_domain \<gamma> \<union> fv\<^sub>s\<^sub>e\<^sub>t (subst_range \<gamma>)) = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> (subst_domain \<gamma> \<union> range_vars \<gamma>) = {}

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
hence "\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> \<gamma> \<circ>\<^sub>s \<delta> = \<delta> \<circ>\<^sub>s \<gamma>"
[PROOF STATE]
proof (prove)
using this:
\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> (subst_domain \<gamma> \<union> range_vars \<gamma>) = {}

goal (1 subgoal):
 1. \<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> \<gamma> \<circ>\<^sub>s \<delta> = \<delta> \<circ>\<^sub>s \<gamma>
[PROOF STEP]
by (metis subst_comp_eq_if_disjoint_vars)
[PROOF STATE]
proof (state)
this:
\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> \<gamma> \<circ>\<^sub>s \<delta> = \<delta> \<circ>\<^sub>s \<gamma>

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
hence "ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)"
[PROOF STATE]
proof (prove)
using this:
\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> \<gamma> \<circ>\<^sub>s \<delta> = \<delta> \<circ>\<^sub>s \<gamma>

goal (1 subgoal):
 1. ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)
[PROOF STEP]
using ineq_model_subst[OF *** **]
[PROOF STATE]
proof (prove)
using this:
\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> \<gamma> \<circ>\<^sub>s \<delta> = \<delta> \<circ>\<^sub>s \<gamma>
ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)

goal (1 subgoal):
 1. ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
have "rm_vars (set X) \<delta> = \<delta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rm_vars (set X) \<delta> = \<delta>
[PROOF STEP]
using ConsIneq.prems(2)
[PROOF STATE]
proof (prove)
using this:
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (1 subgoal):
 1. rm_vars (set X) \<delta> = \<delta>
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
rm_vars (set X) \<delta> = \<delta>

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)
rm_vars (set X) \<delta> = \<delta>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)
rm_vars (set X) \<delta> = \<delta>

goal (1 subgoal):
 1. \<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)
rm_vars (set X) \<delta> = \<delta>
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>

goal (1 subgoal):
 1. \<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>

goal (2 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
case ConsEq
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<lbrakk>?M2; S_\<rbrakk>\<^sub>d (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S_ = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S_ \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>d \<theta>
\<lbrakk>M; \<langle>uu_: t_ \<doteq> t'_\<rangle>\<^sub>s\<^sub>t # S_\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t_ \<doteq> t'_\<rangle>\<^sub>s\<^sub>t # S_) = {}

goal (2 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<lbrakk>?M2; S_\<rbrakk>\<^sub>d (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S_ = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S_ \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>d \<theta>
\<lbrakk>M; \<langle>uu_: t_ \<doteq> t'_\<rangle>\<^sub>s\<^sub>t # S_\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t_ \<doteq> t'_\<rangle>\<^sub>s\<^sub>t # S_) = {}

goal (1 subgoal):
 1. \<lbrakk>M; \<langle>uu_: t_ \<doteq> t'_\<rangle>\<^sub>s\<^sub>t # S_ \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
unfolding bvars\<^sub>s\<^sub>t_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<lbrakk>?M2; S_\<rbrakk>\<^sub>d (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> \<Union> (set (map (set \<circ> bvars\<^sub>s\<^sub>t\<^sub>p) S_)) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S_ \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>d \<theta>
\<lbrakk>M; \<langle>uu_: t_ \<doteq> t'_\<rangle>\<^sub>s\<^sub>t # S_\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> \<Union> (set (map (set \<circ> bvars\<^sub>s\<^sub>t\<^sub>p) (\<langle>uu_: t_ \<doteq> t'_\<rangle>\<^sub>s\<^sub>t # S_))) = {}

goal (1 subgoal):
 1. \<lbrakk>M; \<langle>uu_: t_ \<doteq> t'_\<rangle>\<^sub>s\<^sub>t # S_ \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; \<langle>uu_: t_ \<doteq> t'_\<rangle>\<^sub>s\<^sub>t # S_ \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>

goal (1 subgoal):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>d (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>d \<theta>
[PROOF STEP]
qed simp_all


[STATEMENT]
lemma NonceCCA_secrecy:
     "[|Cardholder k \<notin> bad;  CA i \<notin> bad;
        Gets (Cardholder k)
           (Crypt KC2
            \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce N, Agent(CA i), Nonce NonceCCA\<rbrace>,
              X, Y\<rbrace>) \<in> set evs;
        Says (Cardholder k) (CA i)
           \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, X'\<rbrace>, Y'\<rbrace> \<in> set evs;
        Gets A \<lbrace>Z, cert (CA i) EKi onlyEnc (priSK RCA),
                    cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs;
        KC2 \<in> symKeys;  evs \<in> set_cr|]
      ==> Nonce NonceCCA \<notin> analz (knows Spy evs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Cardholder k \<notin> bad; CA i \<notin> bad; Gets (Cardholder k) (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce N, Agent (CA i), Nonce NonceCCA\<rbrace>, X, Y\<rbrace>) \<in> set evs; Says (Cardholder k) (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, X'\<rbrace>, Y'\<rbrace> \<in> set evs; Gets A \<lbrace>Z, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs; KC2 \<in> symKeys; evs \<in> set_cr\<rbrakk> \<Longrightarrow> Nonce NonceCCA \<notin> analz (knows Spy evs)
[PROOF STEP]
apply (frule Gets_certificate_valid, assumption)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Cardholder k \<notin> bad; CA i \<notin> bad; Gets (Cardholder k) (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce N, Agent (CA i), Nonce NonceCCA\<rbrace>, X, Y\<rbrace>) \<in> set evs; Says (Cardholder k) (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, X'\<rbrace>, Y'\<rbrace> \<in> set evs; Gets A \<lbrace>Z, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs; KC2 \<in> symKeys; evs \<in> set_cr; EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Nonce NonceCCA \<notin> analz (knows Spy evs)
[PROOF STEP]
apply (subgoal_tac "Key KC2 \<notin> analz (knows Spy evs) ")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>Cardholder k \<notin> bad; CA i \<notin> bad; Gets (Cardholder k) (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce N, Agent (CA i), Nonce NonceCCA\<rbrace>, X, Y\<rbrace>) \<in> set evs; Says (Cardholder k) (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, X'\<rbrace>, Y'\<rbrace> \<in> set evs; Gets A \<lbrace>Z, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs; KC2 \<in> symKeys; evs \<in> set_cr; EKi = pubEK (CA i) \<and> SKi = pubSK (CA i); Key KC2 \<notin> analz (knows Spy evs)\<rbrakk> \<Longrightarrow> Nonce NonceCCA \<notin> analz (knows Spy evs)
 2. \<lbrakk>Cardholder k \<notin> bad; CA i \<notin> bad; Gets (Cardholder k) (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce N, Agent (CA i), Nonce NonceCCA\<rbrace>, X, Y\<rbrace>) \<in> set evs; Says (Cardholder k) (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, X'\<rbrace>, Y'\<rbrace> \<in> set evs; Gets A \<lbrace>Z, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs; KC2 \<in> symKeys; evs \<in> set_cr; EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Key KC2 \<notin> analz (knows Spy evs)
[PROOF STEP]
apply (blast dest: NonceCCA_secrecy_lemma)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Cardholder k \<notin> bad; CA i \<notin> bad; Gets (Cardholder k) (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce N, Agent (CA i), Nonce NonceCCA\<rbrace>, X, Y\<rbrace>) \<in> set evs; Says (Cardholder k) (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, X'\<rbrace>, Y'\<rbrace> \<in> set evs; Gets A \<lbrace>Z, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs; KC2 \<in> symKeys; evs \<in> set_cr; EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Key KC2 \<notin> analz (knows Spy evs)
[PROOF STEP]
apply (rule symKey_secrecy)
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<lbrakk>Cardholder k \<notin> bad; CA i \<notin> bad; Gets (Cardholder k) (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce N, Agent (CA i), Nonce NonceCCA\<rbrace>, X, Y\<rbrace>) \<in> set evs; Says (Cardholder k) (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, X'\<rbrace>, Y'\<rbrace> \<in> set evs; Gets A \<lbrace>Z, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs; KC2 \<in> symKeys; evs \<in> set_cr; EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> CA ?i53 \<notin> bad
 2. \<lbrakk>Cardholder k \<notin> bad; CA i \<notin> bad; Gets (Cardholder k) (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce N, Agent (CA i), Nonce NonceCCA\<rbrace>, X, Y\<rbrace>) \<in> set evs; Says (Cardholder k) (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, X'\<rbrace>, Y'\<rbrace> \<in> set evs; Gets A \<lbrace>Z, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs; KC2 \<in> symKeys; evs \<in> set_cr; EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> KC2 \<in> symKeys
 3. \<lbrakk>Cardholder k \<notin> bad; CA i \<notin> bad; Gets (Cardholder k) (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce N, Agent (CA i), Nonce NonceCCA\<rbrace>, X, Y\<rbrace>) \<in> set evs; Says (Cardholder k) (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, X'\<rbrace>, Y'\<rbrace> \<in> set evs; Gets A \<lbrace>Z, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs; KC2 \<in> symKeys; evs \<in> set_cr; EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> evs \<in> set_cr
 4. \<lbrakk>Cardholder k \<notin> bad; CA i \<notin> bad; Gets (Cardholder k) (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce N, Agent (CA i), Nonce NonceCCA\<rbrace>, X, Y\<rbrace>) \<in> set evs; Says (Cardholder k) (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, X'\<rbrace>, Y'\<rbrace> \<in> set evs; Gets A \<lbrace>Z, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs; KC2 \<in> symKeys; evs \<in> set_cr; EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Says (Cardholder ?c53) (CA ?i53) ?X53 \<in> set evs
 5. \<lbrakk>Cardholder k \<notin> bad; CA i \<notin> bad; Gets (Cardholder k) (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce N, Agent (CA i), Nonce NonceCCA\<rbrace>, X, Y\<rbrace>) \<in> set evs; Says (Cardholder k) (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, X'\<rbrace>, Y'\<rbrace> \<in> set evs; Gets A \<lbrace>Z, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs; KC2 \<in> symKeys; evs \<in> set_cr; EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Key KC2 \<in> parts {?X53}
 6. \<lbrakk>Cardholder k \<notin> bad; CA i \<notin> bad; Gets (Cardholder k) (Crypt KC2 \<lbrace>sign (priSK (CA i)) \<lbrace>Agent C, Nonce N, Agent (CA i), Nonce NonceCCA\<rbrace>, X, Y\<rbrace>) \<in> set evs; Says (Cardholder k) (CA i) \<lbrace>Crypt KC3 \<lbrace>Agent C, Nonce NC3, Key KC2, X'\<rbrace>, Y'\<rbrace> \<in> set evs; Gets A \<lbrace>Z, cert (CA i) EKi onlyEnc (priSK RCA), cert (CA i) SKi onlySig (priSK RCA)\<rbrace> \<in> set evs; KC2 \<in> symKeys; evs \<in> set_cr; EKi = pubEK (CA i) \<and> SKi = pubSK (CA i)\<rbrakk> \<Longrightarrow> Cardholder ?c53 \<notin> bad
[PROOF STEP]
apply (auto simp add: parts_insert2)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t [simp]:
  assumes "new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_document_ptr, h')"
  assumes "ptr \<noteq> new_document_ptr"
  shows "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. get ptr h = get ptr h'
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_document_ptr, h')
ptr \<noteq> new_document_ptr

goal (1 subgoal):
 1. get ptr h = get ptr h'
[PROOF STEP]
by(auto simp add: new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def)


[STATEMENT]
lemma "\<not> P (The P)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> P (The P)
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> P (The P)
[PROOF STEP]
oops