[STATEMENT]
lemma local_quality_increases:
  "paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, _), _, (\<xi>', _)). quality_increases \<xi> \<xi>')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. paodv i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). quality_increases \<xi> \<xi>')
[PROOF STEP]
proof (rule step_invariantI)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>s a s'. \<lbrakk>s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn); (s, a, s') \<in> automaton.trans (paodv i); recvmsg rreq_rrep_sn a\<rbrakk> \<Longrightarrow> onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). quality_increases \<xi> \<xi>') (s, a, s')
[PROOF STEP]
fix s a s'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>s a s'. \<lbrakk>s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn); (s, a, s') \<in> automaton.trans (paodv i); recvmsg rreq_rrep_sn a\<rbrakk> \<Longrightarrow> onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). quality_increases \<xi> \<xi>') (s, a, s')
[PROOF STEP]
assume sr: "s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn)"
       and tr: "(s, a, s') \<in> trans (paodv i)"
       and rm: "recvmsg rreq_rrep_sn a"
[PROOF STATE]
proof (state)
this:
s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn)
(s, a, s') \<in> automaton.trans (paodv i)
recvmsg rreq_rrep_sn a

goal (1 subgoal):
 1. \<And>s a s'. \<lbrakk>s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn); (s, a, s') \<in> automaton.trans (paodv i); recvmsg rreq_rrep_sn a\<rbrakk> \<Longrightarrow> onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). quality_increases \<xi> \<xi>') (s, a, s')
[PROOF STEP]
from sr
[PROOF STATE]
proof (chain)
picking this:
s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn)
[PROOF STEP]
have srTT: "s \<in> reachable (paodv i) TT"
[PROOF STATE]
proof (prove)
using this:
s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn)

goal (1 subgoal):
 1. s \<in> reachable (paodv i) TT
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
s \<in> reachable (paodv i) TT

goal (1 subgoal):
 1. \<And>s a s'. \<lbrakk>s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn); (s, a, s') \<in> automaton.trans (paodv i); recvmsg rreq_rrep_sn a\<rbrakk> \<Longrightarrow> onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). quality_increases \<xi> \<xi>') (s, a, s')
[PROOF STEP]
from route_tables_fresher sr tr rm
[PROOF STATE]
proof (chain)
picking this:
paodv ?i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). \<forall>dip\<in>kD (rt \<xi>). rt \<xi> \<sqsubseteq>\<^bsub>dip\<^esub> rt \<xi>')
s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn)
(s, a, s') \<in> automaton.trans (paodv i)
recvmsg rreq_rrep_sn a
[PROOF STEP]
have "onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, _), _, (\<xi>', _)). \<forall>dip\<in>kD (rt \<xi>). rt \<xi> \<sqsubseteq>\<^bsub>dip\<^esub> rt \<xi>') (s, a, s')"
[PROOF STATE]
proof (prove)
using this:
paodv ?i \<TTurnstile>\<^sub>A (recvmsg rreq_rrep_sn \<rightarrow>) onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). \<forall>dip\<in>kD (rt \<xi>). rt \<xi> \<sqsubseteq>\<^bsub>dip\<^esub> rt \<xi>')
s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn)
(s, a, s') \<in> automaton.trans (paodv i)
recvmsg rreq_rrep_sn a

goal (1 subgoal):
 1. onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). \<forall>dip\<in>kD (rt \<xi>). rt \<xi> \<sqsubseteq>\<^bsub>dip\<^esub> rt \<xi>') (s, a, s')
[PROOF STEP]
by (rule step_invariantD)
[PROOF STATE]
proof (state)
this:
onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). \<forall>dip\<in>kD (rt \<xi>). rt \<xi> \<sqsubseteq>\<^bsub>dip\<^esub> rt \<xi>') (s, a, s')

goal (1 subgoal):
 1. \<And>s a s'. \<lbrakk>s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn); (s, a, s') \<in> automaton.trans (paodv i); recvmsg rreq_rrep_sn a\<rbrakk> \<Longrightarrow> onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). quality_increases \<xi> \<xi>') (s, a, s')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). \<forall>dip\<in>kD (rt \<xi>). rt \<xi> \<sqsubseteq>\<^bsub>dip\<^esub> rt \<xi>') (s, a, s')

goal (1 subgoal):
 1. \<And>s a s'. \<lbrakk>s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn); (s, a, s') \<in> automaton.trans (paodv i); recvmsg rreq_rrep_sn a\<rbrakk> \<Longrightarrow> onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). quality_increases \<xi> \<xi>') (s, a, s')
[PROOF STEP]
from known_destinations_increase srTT tr TT_True
[PROOF STATE]
proof (chain)
picking this:
paodv ?i \<TTurnstile>\<^sub>A onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). kD (rt \<xi>) \<subseteq> kD (rt \<xi>'))
s \<in> reachable (paodv i) TT
(s, a, s') \<in> automaton.trans (paodv i)
TT ?a
[PROOF STEP]
have "onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, _), _, (\<xi>', _)). kD (rt \<xi>) \<subseteq> kD (rt \<xi>')) (s, a, s')"
[PROOF STATE]
proof (prove)
using this:
paodv ?i \<TTurnstile>\<^sub>A onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). kD (rt \<xi>) \<subseteq> kD (rt \<xi>'))
s \<in> reachable (paodv i) TT
(s, a, s') \<in> automaton.trans (paodv i)
TT ?a

goal (1 subgoal):
 1. onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). kD (rt \<xi>) \<subseteq> kD (rt \<xi>')) (s, a, s')
[PROOF STEP]
by (rule step_invariantD)
[PROOF STATE]
proof (state)
this:
onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). kD (rt \<xi>) \<subseteq> kD (rt \<xi>')) (s, a, s')

goal (1 subgoal):
 1. \<And>s a s'. \<lbrakk>s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn); (s, a, s') \<in> automaton.trans (paodv i); recvmsg rreq_rrep_sn a\<rbrakk> \<Longrightarrow> onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). quality_increases \<xi> \<xi>') (s, a, s')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). kD (rt \<xi>) \<subseteq> kD (rt \<xi>')) (s, a, s')

goal (1 subgoal):
 1. \<And>s a s'. \<lbrakk>s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn); (s, a, s') \<in> automaton.trans (paodv i); recvmsg rreq_rrep_sn a\<rbrakk> \<Longrightarrow> onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). quality_increases \<xi> \<xi>') (s, a, s')
[PROOF STEP]
from sqns_increase srTT tr TT_True
[PROOF STATE]
proof (chain)
picking this:
paodv ?i \<TTurnstile>\<^sub>A onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). \<forall>ip. sqn (rt \<xi>) ip \<le> sqn (rt \<xi>') ip)
s \<in> reachable (paodv i) TT
(s, a, s') \<in> automaton.trans (paodv i)
TT ?a
[PROOF STEP]
have "onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, _), _, (\<xi>', _)). \<forall>ip. sqn (rt \<xi>) ip \<le> sqn (rt \<xi>') ip) (s, a, s')"
[PROOF STATE]
proof (prove)
using this:
paodv ?i \<TTurnstile>\<^sub>A onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). \<forall>ip. sqn (rt \<xi>) ip \<le> sqn (rt \<xi>') ip)
s \<in> reachable (paodv i) TT
(s, a, s') \<in> automaton.trans (paodv i)
TT ?a

goal (1 subgoal):
 1. onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). \<forall>ip. sqn (rt \<xi>) ip \<le> sqn (rt \<xi>') ip) (s, a, s')
[PROOF STEP]
by (rule step_invariantD)
[PROOF STATE]
proof (state)
this:
onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). \<forall>ip. sqn (rt \<xi>) ip \<le> sqn (rt \<xi>') ip) (s, a, s')

goal (1 subgoal):
 1. \<And>s a s'. \<lbrakk>s \<in> reachable (paodv i) (recvmsg rreq_rrep_sn); (s, a, s') \<in> automaton.trans (paodv i); recvmsg rreq_rrep_sn a\<rbrakk> \<Longrightarrow> onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). quality_increases \<xi> \<xi>') (s, a, s')
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). \<forall>dip\<in>kD (rt \<xi>). rt \<xi> \<sqsubseteq>\<^bsub>dip\<^esub> rt \<xi>') (s, a, s')
onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). kD (rt \<xi>) \<subseteq> kD (rt \<xi>')) (s, a, s')
onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). \<forall>ip. sqn (rt \<xi>) ip \<le> sqn (rt \<xi>') ip) (s, a, s')
[PROOF STEP]
show "onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, _), _, (\<xi>', _)). quality_increases \<xi> \<xi>') (s, a, s')"
[PROOF STATE]
proof (prove)
using this:
onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). \<forall>dip\<in>kD (rt \<xi>). rt \<xi> \<sqsubseteq>\<^bsub>dip\<^esub> rt \<xi>') (s, a, s')
onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). kD (rt \<xi>) \<subseteq> kD (rt \<xi>')) (s, a, s')
onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). \<forall>ip. sqn (rt \<xi>) ip \<le> sqn (rt \<xi>') ip) (s, a, s')

goal (1 subgoal):
 1. onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). quality_increases \<xi> \<xi>') (s, a, s')
[PROOF STEP]
unfolding onll_def
[PROOF STATE]
proof (prove)
using this:
case (s, a, s') of (x, xa) \<Rightarrow> (case x of (\<xi>, p) \<Rightarrow> \<lambda>(a, \<xi>', p'). \<forall>l\<in>labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p. \<forall>l'\<in>labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p'. case ((\<xi>, l), a, \<xi>', l') of (x, xa) \<Rightarrow> (case x of (\<xi>, uu_) \<Rightarrow> \<lambda>(uu_, \<xi>', uu_). \<forall>dip\<in>kD (rt \<xi>). rt \<xi> \<sqsubseteq>\<^bsub>dip\<^esub> rt \<xi>') xa) xa
case (s, a, s') of (x, xa) \<Rightarrow> (case x of (\<xi>, p) \<Rightarrow> \<lambda>(a, \<xi>', p'). \<forall>l\<in>labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p. \<forall>l'\<in>labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p'. case ((\<xi>, l), a, \<xi>', l') of (x, xa) \<Rightarrow> (case x of (\<xi>, uu_) \<Rightarrow> \<lambda>(uu_, \<xi>', uu_). kD (rt \<xi>) \<subseteq> kD (rt \<xi>')) xa) xa
case (s, a, s') of (x, xa) \<Rightarrow> (case x of (\<xi>, p) \<Rightarrow> \<lambda>(a, \<xi>', p'). \<forall>l\<in>labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p. \<forall>l'\<in>labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p'. case ((\<xi>, l), a, \<xi>', l') of (x, xa) \<Rightarrow> (case x of (\<xi>, uu_) \<Rightarrow> \<lambda>(uu_, \<xi>', uu_). \<forall>ip. sqn (rt \<xi>) ip \<le> sqn (rt \<xi>') ip) xa) xa

goal (1 subgoal):
 1. case (s, a, s') of (x, xa) \<Rightarrow> (case x of (\<xi>, p) \<Rightarrow> \<lambda>(a, \<xi>', p'). \<forall>l\<in>labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p. \<forall>l'\<in>labels \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V p'. case ((\<xi>, l), a, \<xi>', l') of (x, xa) \<Rightarrow> (case x of (\<xi>, uu_) \<Rightarrow> \<lambda>(uu_, \<xi>', uu_). quality_increases \<xi> \<xi>') xa) xa
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
onll \<Gamma>\<^sub>A\<^sub>O\<^sub>D\<^sub>V (\<lambda>((\<xi>, uu_), uu_, \<xi>', uu_). quality_increases \<xi> \<xi>') (s, a, s')

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma eq_\<I>_gpv_inline1:
  includes lifting_syntax
  assumes "S s1 s2" "eq_\<I>_gpv A \<I> gpv1 gpv2"
  shows "rel_spmf (rel_sum (rel_prod A S)
      (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q'' \<in> outs_\<I> \<I>.
          (\<forall>r \<in> responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and>
          (\<forall>r' \<in> responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r')))))
     (inline1 callee1 gpv1 s1) (inline1 callee2 gpv2 s2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (inline1 callee1 gpv1 s1) (inline1 callee2 gpv2 s2)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
S s1 s2
eq_\<I>_gpv A \<I> gpv1 gpv2

goal (1 subgoal):
 1. rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (inline1 callee1 gpv1 s1) (inline1 callee2 gpv2 s2)
[PROOF STEP]
proof(induction arbitrary: gpv1 gpv2 s1 s2 rule: parallel_fixp_induct_2_2[OF partial_function_definitions_spmf partial_function_definitions_spmf inline1.mono inline1.mono inline1_def inline1_def, unfolded lub_spmf_empty, case_names adm bottom step])
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. ccpo.admissible (prod_lub spmf.lub_fun spmf.lub_fun) (rel_prod spmf.le_fun spmf.le_fun) (\<lambda>x. \<forall>xa xb xc xd. S xc xd \<longrightarrow> eq_\<I>_gpv A \<I> xa xb \<longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (curry (fst x) xa xc) (curry (snd x) xb xd))
 2. \<And>gpv1 gpv2 s1 s2. \<lbrakk>S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (return_pmf None) (return_pmf None)
 3. \<And>f g gpv1 gpv2 s1 s2. \<lbrakk>\<And>gpv1 gpv2 s1 s2. \<lbrakk>S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (f gpv1 s1) (g gpv2 s2); S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (the_gpv gpv1 \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s1))) (\<lambda>out rpv. the_gpv (callee1 s1 out) \<bind> case_generat (\<lambda>(x, y). f (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv))))) (the_gpv gpv2 \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s2))) (\<lambda>out rpv. the_gpv (callee2 s2 out) \<bind> case_generat (\<lambda>(x, y). g (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv)))))
[PROOF STEP]
case adm
[PROOF STATE]
proof (state)
this:

goal (3 subgoals):
 1. ccpo.admissible (prod_lub spmf.lub_fun spmf.lub_fun) (rel_prod spmf.le_fun spmf.le_fun) (\<lambda>x. \<forall>xa xb xc xd. S xc xd \<longrightarrow> eq_\<I>_gpv A \<I> xa xb \<longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (curry (fst x) xa xc) (curry (snd x) xb xd))
 2. \<And>gpv1 gpv2 s1 s2. \<lbrakk>S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (return_pmf None) (return_pmf None)
 3. \<And>f g gpv1 gpv2 s1 s2. \<lbrakk>\<And>gpv1 gpv2 s1 s2. \<lbrakk>S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (f gpv1 s1) (g gpv2 s2); S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (the_gpv gpv1 \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s1))) (\<lambda>out rpv. the_gpv (callee1 s1 out) \<bind> case_generat (\<lambda>(x, y). f (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv))))) (the_gpv gpv2 \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s2))) (\<lambda>out rpv. the_gpv (callee2 s2 out) \<bind> case_generat (\<lambda>(x, y). g (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv)))))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ccpo.admissible (prod_lub spmf.lub_fun spmf.lub_fun) (rel_prod spmf.le_fun spmf.le_fun) (\<lambda>x. \<forall>xa xb xc xd. S xc xd \<longrightarrow> eq_\<I>_gpv A \<I> xa xb \<longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>a. case a of (q, a) \<Rightarrow> case a of (rpv1, rpv2) \<Rightarrow> \<lambda>a. case a of (q', rpv1', rpv2') \<Rightarrow> q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (curry (fst x) xa xc) (curry (snd x) xb xd))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
ccpo.admissible (prod_lub spmf.lub_fun spmf.lub_fun) (rel_prod spmf.le_fun spmf.le_fun) (\<lambda>x. \<forall>xa xb xc xd. S xc xd \<longrightarrow> eq_\<I>_gpv A \<I> xa xb \<longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>a. case a of (q, a) \<Rightarrow> case a of (rpv1, rpv2) \<Rightarrow> \<lambda>a. case a of (q', rpv1', rpv2') \<Rightarrow> q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (curry (fst x) xa xc) (curry (snd x) xb xd))

goal (2 subgoals):
 1. \<And>gpv1 gpv2 s1 s2. \<lbrakk>S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (return_pmf None) (return_pmf None)
 2. \<And>f g gpv1 gpv2 s1 s2. \<lbrakk>\<And>gpv1 gpv2 s1 s2. \<lbrakk>S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (f gpv1 s1) (g gpv2 s2); S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (the_gpv gpv1 \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s1))) (\<lambda>out rpv. the_gpv (callee1 s1 out) \<bind> case_generat (\<lambda>(x, y). f (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv))))) (the_gpv gpv2 \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s2))) (\<lambda>out rpv. the_gpv (callee2 s2 out) \<bind> case_generat (\<lambda>(x, y). g (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv)))))
[PROOF STEP]
case bottom
[PROOF STATE]
proof (state)
this:
S s1 s2
eq_\<I>_gpv A \<I> gpv1 gpv2

goal (2 subgoals):
 1. \<And>gpv1 gpv2 s1 s2. \<lbrakk>S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (return_pmf None) (return_pmf None)
 2. \<And>f g gpv1 gpv2 s1 s2. \<lbrakk>\<And>gpv1 gpv2 s1 s2. \<lbrakk>S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (f gpv1 s1) (g gpv2 s2); S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (the_gpv gpv1 \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s1))) (\<lambda>out rpv. the_gpv (callee1 s1 out) \<bind> case_generat (\<lambda>(x, y). f (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv))))) (the_gpv gpv2 \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s2))) (\<lambda>out rpv. the_gpv (callee2 s2 out) \<bind> case_generat (\<lambda>(x, y). g (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv)))))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_spmf (rel_sum (rel_prod A S) (\<lambda>a. case a of (q, a) \<Rightarrow> case a of (rpv1, rpv2) \<Rightarrow> \<lambda>a. case a of (q', rpv1', rpv2') \<Rightarrow> q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (return_pmf None) (return_pmf None)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_sum (rel_prod A S) (\<lambda>a. case a of (q, a) \<Rightarrow> case a of (rpv1, rpv2) \<Rightarrow> \<lambda>a. case a of (q', rpv1', rpv2') \<Rightarrow> q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (return_pmf None) (return_pmf None)

goal (1 subgoal):
 1. \<And>f g gpv1 gpv2 s1 s2. \<lbrakk>\<And>gpv1 gpv2 s1 s2. \<lbrakk>S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (f gpv1 s1) (g gpv2 s2); S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (the_gpv gpv1 \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s1))) (\<lambda>out rpv. the_gpv (callee1 s1 out) \<bind> case_generat (\<lambda>(x, y). f (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv))))) (the_gpv gpv2 \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s2))) (\<lambda>out rpv. the_gpv (callee2 s2 out) \<bind> case_generat (\<lambda>(x, y). g (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv)))))
[PROOF STEP]
case (step inline1' inline1'')
[PROOF STATE]
proof (state)
this:
\<lbrakk>S ?s1.0 ?s2.0; eq_\<I>_gpv A \<I> ?gpv1.0 ?gpv2.0\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>a. case a of (q, a) \<Rightarrow> case a of (rpv1, rpv2) \<Rightarrow> \<lambda>a. case a of (q', rpv1', rpv2') \<Rightarrow> q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (inline1' ?gpv1.0 ?s1.0) (inline1'' ?gpv2.0 ?s2.0)
S s1 s2
eq_\<I>_gpv A \<I> gpv1 gpv2

goal (1 subgoal):
 1. \<And>f g gpv1 gpv2 s1 s2. \<lbrakk>\<And>gpv1 gpv2 s1 s2. \<lbrakk>S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (f gpv1 s1) (g gpv2 s2); S s1 s2; eq_\<I>_gpv A \<I> gpv1 gpv2\<rbrakk> \<Longrightarrow> rel_spmf (rel_sum (rel_prod A S) (\<lambda>(q, rpv1, rpv2) (q', rpv1', rpv2'). q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (the_gpv gpv1 \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s1))) (\<lambda>out rpv. the_gpv (callee1 s1 out) \<bind> case_generat (\<lambda>(x, y). f (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv))))) (the_gpv gpv2 \<bind> case_generat (\<lambda>x. return_spmf (Inl (x, s2))) (\<lambda>out rpv. the_gpv (callee2 s2 out) \<bind> case_generat (\<lambda>(x, y). g (rpv x) y) (\<lambda>out rpv'. return_spmf (Inr (out, rpv', rpv)))))
[PROOF STEP]
from step.prems
[PROOF STATE]
proof (chain)
picking this:
S s1 s2
eq_\<I>_gpv A \<I> gpv1 gpv2
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
S s1 s2
eq_\<I>_gpv A \<I> gpv1 gpv2

goal (1 subgoal):
 1. rel_spmf (rel_sum (rel_prod A S) (\<lambda>a. case a of (q, a) \<Rightarrow> case a of (rpv1, rpv2) \<Rightarrow> \<lambda>a. case a of (q', rpv1', rpv2') \<Rightarrow> q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (the_gpv gpv1 \<bind> (\<lambda>a. case a of Pure x \<Rightarrow> return_spmf (Inl (x, s1)) | IO out rpv \<Rightarrow> the_gpv (callee1 s1 out) \<bind> (\<lambda>a. case a of Pure (x, y) \<Rightarrow> inline1' (rpv x) y | IO out rpv' \<Rightarrow> return_spmf (Inr (out, rpv', rpv))))) (the_gpv gpv2 \<bind> (\<lambda>a. case a of Pure x \<Rightarrow> return_spmf (Inl (x, s2)) | IO out rpv \<Rightarrow> the_gpv (callee2 s2 out) \<bind> (\<lambda>a. case a of Pure (x, y) \<Rightarrow> inline1'' (rpv x) y | IO out rpv' \<Rightarrow> return_spmf (Inr (out, rpv', rpv)))))
[PROOF STEP]
by - (erule eq_\<I>_gpvD[THEN rel_spmf_bindI]
        , clarsimp split!: generat.split
        , erule eq_\<I>_gpvD[OF callee(1), THEN rel_spmf_bindI]
        , auto simp add: eq_onp_def intro: step.IH[THEN rel_spmf_mono] elim: eq_\<I>_gpvD[OF callee(1), THEN rel_spmf_bindI] split!: generat.split)
[PROOF STATE]
proof (state)
this:
rel_spmf (rel_sum (rel_prod A S) (\<lambda>a. case a of (q, a) \<Rightarrow> case a of (rpv1, rpv2) \<Rightarrow> \<lambda>a. case a of (q', rpv1', rpv2') \<Rightarrow> q = q' \<and> q' \<in> outs_\<I> \<I>' \<and> (\<exists>q''\<in>outs_\<I> \<I>. (\<forall>r\<in>responses_\<I> \<I>' q'. eq_\<I>_gpv (rel_prod (eq_onp (\<lambda>r'. r' \<in> responses_\<I> \<I> q'')) S) \<I>' (rpv1 r) (rpv1' r)) \<and> (\<forall>r'\<in>responses_\<I> \<I> q''. eq_\<I>_gpv A \<I> (rpv2 r') (rpv2' r'))))) (the_gpv gpv1 \<bind> (\<lambda>a. case a of Pure x \<Rightarrow> return_spmf (Inl (x, s1)) | IO out rpv \<Rightarrow> the_gpv (callee1 s1 out) \<bind> (\<lambda>a. case a of Pure (x, y) \<Rightarrow> inline1' (rpv x) y | IO out rpv' \<Rightarrow> return_spmf (Inr (out, rpv', rpv))))) (the_gpv gpv2 \<bind> (\<lambda>a. case a of Pure x \<Rightarrow> return_spmf (Inl (x, s2)) | IO out rpv \<Rightarrow> the_gpv (callee2 s2 out) \<bind> (\<lambda>a. case a of Pure (x, y) \<Rightarrow> inline1'' (rpv x) y | IO out rpv' \<Rightarrow> return_spmf (Inr (out, rpv', rpv)))))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma shadow_root_get_put_6 [simp]:
  "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr (put\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t shadow_root_ptr f h) = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. get document_ptr (put shadow_root_ptr f h) = get document_ptr h
[PROOF STEP]
by(auto simp add: get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def)


[STATEMENT]
lemma leq_path_asym2:"\<lbrakk>P,C \<turnstile> Cs \<sqsubseteq> Cs'; P,C \<turnstile> Cs' \<sqsubseteq> Cs; wf_prog wf_md P\<rbrakk> \<Longrightarrow> Cs = Cs'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>P,C \<turnstile> Cs \<sqsubseteq> Cs'; P,C \<turnstile> Cs' \<sqsubseteq> Cs; wf_prog wf_md P\<rbrakk> \<Longrightarrow> Cs = Cs'
[PROOF STEP]
apply (induct rule:rtrancl.induct)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>P,C \<turnstile> a \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> a = a
 2. \<And>a b c. \<lbrakk>P,C \<turnstile> a \<sqsubseteq> b; \<lbrakk>P,C \<turnstile> b \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> a = b; P,C \<turnstile> b \<sqsubset>\<^sup>1 c; P,C \<turnstile> c \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> a = c
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b c. \<lbrakk>P,C \<turnstile> a \<sqsubseteq> b; \<lbrakk>P,C \<turnstile> b \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> a = b; P,C \<turnstile> b \<sqsubset>\<^sup>1 c; P,C \<turnstile> c \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> a = c
[PROOF STEP]
apply (drule rtrancl_into_trancl1)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b c. \<lbrakk>\<lbrakk>P,C \<turnstile> b \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> a = b; P,C \<turnstile> b \<sqsubset>\<^sup>1 c; P,C \<turnstile> c \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> P,C \<turnstile> b \<sqsubset>\<^sup>1 ?c2 a b c
 2. \<And>a b c. \<lbrakk>\<lbrakk>P,C \<turnstile> b \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> a = b; P,C \<turnstile> b \<sqsubset>\<^sup>1 c; P,C \<turnstile> c \<sqsubseteq> a; wf_prog wf_md P; (a, ?c2 a b c) \<in> (leq_path1 P C)\<^sup>+\<rbrakk> \<Longrightarrow> a = c
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b c. \<lbrakk>\<lbrakk>P,C \<turnstile> b \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> a = b; P,C \<turnstile> b \<sqsubset>\<^sup>1 c; P,C \<turnstile> c \<sqsubseteq> a; wf_prog wf_md P; (a, c) \<in> (leq_path1 P C)\<^sup>+\<rbrakk> \<Longrightarrow> a = c
[PROOF STEP]
apply (drule leq_path_asym)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a b c. \<lbrakk>\<lbrakk>P,C \<turnstile> b \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> a = b; P,C \<turnstile> b \<sqsubset>\<^sup>1 c; P,C \<turnstile> c \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> wf_prog (?wf_md5 a b c) P
 2. \<And>a b c. \<lbrakk>\<lbrakk>P,C \<turnstile> b \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> a = b; P,C \<turnstile> b \<sqsubset>\<^sup>1 c; P,C \<turnstile> c \<sqsubseteq> a; wf_prog wf_md P; (c, a) \<notin> (leq_path1 P C)\<^sup>+\<rbrakk> \<Longrightarrow> a = c
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b c. \<lbrakk>\<lbrakk>P,C \<turnstile> b \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> a = b; P,C \<turnstile> b \<sqsubset>\<^sup>1 c; P,C \<turnstile> c \<sqsubseteq> a; wf_prog wf_md P; (c, a) \<notin> (leq_path1 P C)\<^sup>+\<rbrakk> \<Longrightarrow> a = c
[PROOF STEP]
apply (drule_tac a="c" and b="a" in rtranclD)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a b c. \<lbrakk>\<lbrakk>P,C \<turnstile> b \<sqsubseteq> a; wf_prog wf_md P\<rbrakk> \<Longrightarrow> a = b; P,C \<turnstile> b \<sqsubset>\<^sup>1 c; wf_prog wf_md P; (c, a) \<notin> (leq_path1 P C)\<^sup>+; c = a \<or> c \<noteq> a \<and> (c, a) \<in> (leq_path1 P C)\<^sup>+\<rbrakk> \<Longrightarrow> a = c
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma prj_simps [simp]:
    shows "C.arr Prj\<^sub>1\<^sub>1"
    and "C.arr Prj\<^sub>0\<^sub>1"
    and "C.arr Prj\<^sub>0"
    and "C.dom Prj\<^sub>1\<^sub>1 = \<mu>\<nu>_\<pi>.chine"
    and "C.dom Prj\<^sub>0\<^sub>1 = \<mu>\<nu>_\<pi>.chine"
    and "C.dom Prj\<^sub>0 = \<mu>\<nu>_\<pi>.chine"
    and "C.cod Prj\<^sub>1\<^sub>1 = \<mu>.apex"
    and "C.cod Prj\<^sub>0\<^sub>1 = \<nu>.apex"
    and "C.cod Prj\<^sub>0 = \<pi>.apex"
    and "C.arr Prj\<^sub>1"
    and "C.arr Prj\<^sub>1\<^sub>0"
    and "C.arr Prj\<^sub>0\<^sub>0"
    and "C.dom Prj\<^sub>1 = \<mu>\<nu>\<pi>.chine"
    and "C.dom Prj\<^sub>1\<^sub>0 = \<mu>\<nu>\<pi>.chine"
    and "C.dom Prj\<^sub>0\<^sub>0 = \<mu>\<nu>\<pi>.chine"
    and "C.cod Prj\<^sub>1 = \<mu>.apex"
    and "C.cod Prj\<^sub>1\<^sub>0 = \<nu>.apex"
    and "C.cod Prj\<^sub>0\<^sub>0 = \<pi>.apex"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (((C.seq \<mu>\<nu>.prj\<^sub>1 \<p>\<^sub>1[\<nu>.leg0 \<cdot> \<mu>\<nu>.prj\<^sub>0, \<pi>.leg1] &&& C.seq \<mu>\<nu>.prj\<^sub>0 \<p>\<^sub>1[\<nu>.leg0 \<cdot> \<mu>\<nu>.prj\<^sub>0, \<pi>.leg1]) &&& C.arr Prj\<^sub>0 &&& C.dom Prj\<^sub>1\<^sub>1 = \<mu>\<nu>_\<pi>.chine) &&& (C.dom Prj\<^sub>0\<^sub>1 = \<mu>\<nu>_\<pi>.chine &&& C.dom Prj\<^sub>0 = \<mu>\<nu>_\<pi>.chine) &&& C.cod Prj\<^sub>1\<^sub>1 = \<mu>.apex &&& C.cod Prj\<^sub>0\<^sub>1 = \<nu>.apex &&& C.cod Prj\<^sub>0 = \<pi>.apex) &&& ((C.arr Prj\<^sub>1 &&& C.seq \<nu>\<pi>.prj\<^sub>1 \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1]) &&& C.seq \<nu>\<pi>.prj\<^sub>0 \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] &&& C.dom Prj\<^sub>1 = \<mu>\<nu>\<pi>.chine) &&& (C.dom Prj\<^sub>1\<^sub>0 = \<mu>\<nu>\<pi>.chine &&& C.dom Prj\<^sub>0\<^sub>0 = \<mu>\<nu>\<pi>.chine) &&& C.cod Prj\<^sub>1 = \<mu>.apex &&& C.cod Prj\<^sub>1\<^sub>0 = \<nu>.apex &&& C.cod Prj\<^sub>0\<^sub>0 = \<pi>.apex
[PROOF STEP]
using prj_in_hom
[PROOF STATE]
proof (prove)
using this:
\<guillemotleft>Prj\<^sub>1\<^sub>1 : \<mu>\<nu>_\<pi>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>
\<guillemotleft>Prj\<^sub>0\<^sub>1 : \<mu>\<nu>_\<pi>.chine \<rightarrow>\<^sub>C \<nu>.apex\<guillemotright>
\<guillemotleft>Prj\<^sub>0 : \<mu>\<nu>_\<pi>.chine \<rightarrow>\<^sub>C \<pi>.apex\<guillemotright>
\<guillemotleft>Prj\<^sub>1 : \<mu>\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>
\<guillemotleft>Prj\<^sub>1\<^sub>0 : \<mu>\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>.apex\<guillemotright>
\<guillemotleft>Prj\<^sub>0\<^sub>0 : \<mu>\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<pi>.apex\<guillemotright>

goal (1 subgoal):
 1. (((C.seq \<mu>\<nu>.prj\<^sub>1 \<p>\<^sub>1[\<nu>.leg0 \<cdot> \<mu>\<nu>.prj\<^sub>0, \<pi>.leg1] &&& C.seq \<mu>\<nu>.prj\<^sub>0 \<p>\<^sub>1[\<nu>.leg0 \<cdot> \<mu>\<nu>.prj\<^sub>0, \<pi>.leg1]) &&& C.arr Prj\<^sub>0 &&& C.dom Prj\<^sub>1\<^sub>1 = \<mu>\<nu>_\<pi>.chine) &&& (C.dom Prj\<^sub>0\<^sub>1 = \<mu>\<nu>_\<pi>.chine &&& C.dom Prj\<^sub>0 = \<mu>\<nu>_\<pi>.chine) &&& C.cod Prj\<^sub>1\<^sub>1 = \<mu>.apex &&& C.cod Prj\<^sub>0\<^sub>1 = \<nu>.apex &&& C.cod Prj\<^sub>0 = \<pi>.apex) &&& ((C.arr Prj\<^sub>1 &&& C.seq \<nu>\<pi>.prj\<^sub>1 \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1]) &&& C.seq \<nu>\<pi>.prj\<^sub>0 \<p>\<^sub>0[\<mu>.leg0, \<nu>.leg1 \<cdot> \<nu>\<pi>.prj\<^sub>1] &&& C.dom Prj\<^sub>1 = \<mu>\<nu>\<pi>.chine) &&& (C.dom Prj\<^sub>1\<^sub>0 = \<mu>\<nu>\<pi>.chine &&& C.dom Prj\<^sub>0\<^sub>0 = \<mu>\<nu>\<pi>.chine) &&& C.cod Prj\<^sub>1 = \<mu>.apex &&& C.cod Prj\<^sub>1\<^sub>0 = \<nu>.apex &&& C.cod Prj\<^sub>0\<^sub>0 = \<pi>.apex
[PROOF STEP]
by auto


[STATEMENT]
lemma mimicking:
  assumes
    step: "revision_step r s s'" and
    bij_\<alpha>: "bij \<alpha>" and
    bij_\<beta>: "bij \<beta>"
  shows "revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
proof (use step in \<open>cases rule: revision_stepE\<close>)
[PROOF STATE]
proof (state)
goal (9 subgoals):
 1. \<And>\<sigma> \<tau> \<E> x e v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [subst (VE v) x e])); s r = Some (\<sigma>, \<tau>, \<E> [Apply (VE (Lambda x e)) (VE v)])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 2. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e1])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV T)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 3. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e2])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV F)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 4. \<And>\<sigma> \<tau> \<E> v l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (Loc l)])); s r = Some (\<sigma>, \<tau>, \<E> [Ref (VE v)]); l \<notin> LID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 5. \<And>\<sigma> \<tau> \<E> l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (the (if \<tau> l = None then \<sigma> l else \<tau> l))])); s r = Some (\<sigma>, \<tau>, \<E> [Read (VE (Loc l))]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 6. \<And>\<sigma> \<tau> \<E> l v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (CV Unit)])); s r = Some (\<sigma>, \<tau>, \<E> [Assign (VE (Loc l)) (VE v)]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 7. \<And>\<sigma> \<tau> \<E> e r'. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e)); s r = Some (\<sigma>, \<tau>, \<E> [Rfork e]); r' \<notin> RID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 8. \<And>\<sigma> \<tau> \<E> r' \<sigma>' \<tau>' v. \<lbrakk>s' = (s(r \<mapsto> (\<sigma>, \<tau>;;\<tau>', \<E> [VE (CV Unit)])))(r' := None); s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = Some (\<sigma>', \<tau>', VE v)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 9. \<And>\<sigma> \<tau> \<E> r'. \<lbrakk>s' = \<epsilon>; s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = None\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
case app
[PROOF STATE]
proof (state)
this:
s' = s(r \<mapsto> (\<sigma>_, \<tau>_, \<E>_ [subst (VE v_) x_ e_]))
s r = Some (\<sigma>_, \<tau>_, \<E>_ [Apply (VE (Lambda x_ e_)) (VE v_)])

goal (9 subgoals):
 1. \<And>\<sigma> \<tau> \<E> x e v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [subst (VE v) x e])); s r = Some (\<sigma>, \<tau>, \<E> [Apply (VE (Lambda x e)) (VE v)])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 2. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e1])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV T)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 3. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e2])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV F)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 4. \<And>\<sigma> \<tau> \<E> v l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (Loc l)])); s r = Some (\<sigma>, \<tau>, \<E> [Ref (VE v)]); l \<notin> LID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 5. \<And>\<sigma> \<tau> \<E> l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (the (if \<tau> l = None then \<sigma> l else \<tau> l))])); s r = Some (\<sigma>, \<tau>, \<E> [Read (VE (Loc l))]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 6. \<And>\<sigma> \<tau> \<E> l v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (CV Unit)])); s r = Some (\<sigma>, \<tau>, \<E> [Assign (VE (Loc l)) (VE v)]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 7. \<And>\<sigma> \<tau> \<E> e r'. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e)); s r = Some (\<sigma>, \<tau>, \<E> [Rfork e]); r' \<notin> RID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 8. \<And>\<sigma> \<tau> \<E> r' \<sigma>' \<tau>' v. \<lbrakk>s' = (s(r \<mapsto> (\<sigma>, \<tau>;;\<tau>', \<E> [VE (CV Unit)])))(r' := None); s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = Some (\<sigma>', \<tau>', VE v)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 9. \<And>\<sigma> \<tau> \<E> r'. \<lbrakk>s' = \<epsilon>; s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = None\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
s' = s(r \<mapsto> (\<sigma>_, \<tau>_, \<E>_ [subst (VE v_) x_ e_]))
s r = Some (\<sigma>_, \<tau>_, \<E>_ [Apply (VE (Lambda x_ e_)) (VE v_)])
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
s' = s(r \<mapsto> (\<sigma>_, \<tau>_, \<E>_ [subst (VE v_) x_ e_]))
s r = Some (\<sigma>_, \<tau>_, \<E>_ [Apply (VE (Lambda x_ e_)) (VE v_)])

goal (1 subgoal):
 1. revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
by (auto simp add: bij_\<alpha> bij_\<beta> bijection.intro bijection.inv_left renaming_distr_subst)
[PROOF STATE]
proof (state)
this:
revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')

goal (8 subgoals):
 1. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e1])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV T)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 2. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e2])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV F)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 3. \<And>\<sigma> \<tau> \<E> v l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (Loc l)])); s r = Some (\<sigma>, \<tau>, \<E> [Ref (VE v)]); l \<notin> LID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 4. \<And>\<sigma> \<tau> \<E> l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (the (if \<tau> l = None then \<sigma> l else \<tau> l))])); s r = Some (\<sigma>, \<tau>, \<E> [Read (VE (Loc l))]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 5. \<And>\<sigma> \<tau> \<E> l v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (CV Unit)])); s r = Some (\<sigma>, \<tau>, \<E> [Assign (VE (Loc l)) (VE v)]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 6. \<And>\<sigma> \<tau> \<E> e r'. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e)); s r = Some (\<sigma>, \<tau>, \<E> [Rfork e]); r' \<notin> RID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 7. \<And>\<sigma> \<tau> \<E> r' \<sigma>' \<tau>' v. \<lbrakk>s' = (s(r \<mapsto> (\<sigma>, \<tau>;;\<tau>', \<E> [VE (CV Unit)])))(r' := None); s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = Some (\<sigma>', \<tau>', VE v)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 8. \<And>\<sigma> \<tau> \<E> r'. \<lbrakk>s' = \<epsilon>; s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = None\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e1])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV T)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 2. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e2])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV F)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 3. \<And>\<sigma> \<tau> \<E> v l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (Loc l)])); s r = Some (\<sigma>, \<tau>, \<E> [Ref (VE v)]); l \<notin> LID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 4. \<And>\<sigma> \<tau> \<E> l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (the (if \<tau> l = None then \<sigma> l else \<tau> l))])); s r = Some (\<sigma>, \<tau>, \<E> [Read (VE (Loc l))]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 5. \<And>\<sigma> \<tau> \<E> l v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (CV Unit)])); s r = Some (\<sigma>, \<tau>, \<E> [Assign (VE (Loc l)) (VE v)]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 6. \<And>\<sigma> \<tau> \<E> e r'. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e)); s r = Some (\<sigma>, \<tau>, \<E> [Rfork e]); r' \<notin> RID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 7. \<And>\<sigma> \<tau> \<E> r' \<sigma>' \<tau>' v. \<lbrakk>s' = (s(r \<mapsto> (\<sigma>, \<tau>;;\<tau>', \<E> [VE (CV Unit)])))(r' := None); s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = Some (\<sigma>', \<tau>', VE v)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 8. \<And>\<sigma> \<tau> \<E> r'. \<lbrakk>s' = \<epsilon>; s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = None\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
case (new _ _ _ _ l)
[PROOF STATE]
proof (state)
this:
s' = s(r \<mapsto> (\<sigma>_, \<tau>_(l \<mapsto> v_), \<E>_ [VE (Loc l)]))
s r = Some (\<sigma>_, \<tau>_, \<E>_ [Ref (VE v_)])
l \<notin> LID\<^sub>G s

goal (8 subgoals):
 1. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e1])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV T)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 2. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e2])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV F)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 3. \<And>\<sigma> \<tau> \<E> v l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (Loc l)])); s r = Some (\<sigma>, \<tau>, \<E> [Ref (VE v)]); l \<notin> LID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 4. \<And>\<sigma> \<tau> \<E> l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (the (if \<tau> l = None then \<sigma> l else \<tau> l))])); s r = Some (\<sigma>, \<tau>, \<E> [Read (VE (Loc l))]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 5. \<And>\<sigma> \<tau> \<E> l v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (CV Unit)])); s r = Some (\<sigma>, \<tau>, \<E> [Assign (VE (Loc l)) (VE v)]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 6. \<And>\<sigma> \<tau> \<E> e r'. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e)); s r = Some (\<sigma>, \<tau>, \<E> [Rfork e]); r' \<notin> RID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 7. \<And>\<sigma> \<tau> \<E> r' \<sigma>' \<tau>' v. \<lbrakk>s' = (s(r \<mapsto> (\<sigma>, \<tau>;;\<tau>', \<E> [VE (CV Unit)])))(r' := None); s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = Some (\<sigma>', \<tau>', VE v)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 8. \<And>\<sigma> \<tau> \<E> r'. \<lbrakk>s' = \<epsilon>; s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = None\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
have \<beta>l_fresh: "\<beta> l \<notin> LID\<^sub>G (\<R>\<^sub>G \<alpha> \<beta> s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<beta> l \<notin> LID\<^sub>G (\<R>\<^sub>G \<alpha> \<beta> s)
[PROOF STEP]
by (simp add: bij_\<alpha> bij_\<beta> in_renamed_in_unlabelled_global(2) new(3))
[PROOF STATE]
proof (state)
this:
\<beta> l \<notin> LID\<^sub>G (\<R>\<^sub>G \<alpha> \<beta> s)

goal (8 subgoals):
 1. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e1])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV T)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 2. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e2])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV F)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 3. \<And>\<sigma> \<tau> \<E> v l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (Loc l)])); s r = Some (\<sigma>, \<tau>, \<E> [Ref (VE v)]); l \<notin> LID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 4. \<And>\<sigma> \<tau> \<E> l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (the (if \<tau> l = None then \<sigma> l else \<tau> l))])); s r = Some (\<sigma>, \<tau>, \<E> [Read (VE (Loc l))]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 5. \<And>\<sigma> \<tau> \<E> l v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (CV Unit)])); s r = Some (\<sigma>, \<tau>, \<E> [Assign (VE (Loc l)) (VE v)]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 6. \<And>\<sigma> \<tau> \<E> e r'. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e)); s r = Some (\<sigma>, \<tau>, \<E> [Rfork e]); r' \<notin> RID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 7. \<And>\<sigma> \<tau> \<E> r' \<sigma>' \<tau>' v. \<lbrakk>s' = (s(r \<mapsto> (\<sigma>, \<tau>;;\<tau>', \<E> [VE (CV Unit)])))(r' := None); s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = Some (\<sigma>', \<tau>', VE v)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 8. \<And>\<sigma> \<tau> \<E> r'. \<lbrakk>s' = \<epsilon>; s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = None\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
using \<beta>l_fresh new
[PROOF STATE]
proof (prove)
using this:
\<beta> l \<notin> LID\<^sub>G (\<R>\<^sub>G \<alpha> \<beta> s)
s' = s(r \<mapsto> (\<sigma>_, \<tau>_(l \<mapsto> v_), \<E>_ [VE (Loc l)]))
s r = Some (\<sigma>_, \<tau>_, \<E>_ [Ref (VE v_)])
l \<notin> LID\<^sub>G s

goal (1 subgoal):
 1. revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
by (auto simp add: bij_\<alpha> bij_\<beta> bijection.intro bijection.inv_left)
[PROOF STATE]
proof (state)
this:
revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')

goal (7 subgoals):
 1. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e1])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV T)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 2. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e2])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV F)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 3. \<And>\<sigma> \<tau> \<E> l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (the (if \<tau> l = None then \<sigma> l else \<tau> l))])); s r = Some (\<sigma>, \<tau>, \<E> [Read (VE (Loc l))]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 4. \<And>\<sigma> \<tau> \<E> l v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (CV Unit)])); s r = Some (\<sigma>, \<tau>, \<E> [Assign (VE (Loc l)) (VE v)]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 5. \<And>\<sigma> \<tau> \<E> e r'. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e)); s r = Some (\<sigma>, \<tau>, \<E> [Rfork e]); r' \<notin> RID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 6. \<And>\<sigma> \<tau> \<E> r' \<sigma>' \<tau>' v. \<lbrakk>s' = (s(r \<mapsto> (\<sigma>, \<tau>;;\<tau>', \<E> [VE (CV Unit)])))(r' := None); s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = Some (\<sigma>', \<tau>', VE v)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 7. \<And>\<sigma> \<tau> \<E> r'. \<lbrakk>s' = \<epsilon>; s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = None\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (7 subgoals):
 1. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e1])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV T)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 2. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e2])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV F)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 3. \<And>\<sigma> \<tau> \<E> l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (the (if \<tau> l = None then \<sigma> l else \<tau> l))])); s r = Some (\<sigma>, \<tau>, \<E> [Read (VE (Loc l))]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 4. \<And>\<sigma> \<tau> \<E> l v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (CV Unit)])); s r = Some (\<sigma>, \<tau>, \<E> [Assign (VE (Loc l)) (VE v)]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 5. \<And>\<sigma> \<tau> \<E> e r'. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e)); s r = Some (\<sigma>, \<tau>, \<E> [Rfork e]); r' \<notin> RID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 6. \<And>\<sigma> \<tau> \<E> r' \<sigma>' \<tau>' v. \<lbrakk>s' = (s(r \<mapsto> (\<sigma>, \<tau>;;\<tau>', \<E> [VE (CV Unit)])))(r' := None); s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = Some (\<sigma>', \<tau>', VE v)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 7. \<And>\<sigma> \<tau> \<E> r'. \<lbrakk>s' = \<epsilon>; s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = None\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
case (fork \<sigma> \<tau> \<E> e r')
[PROOF STATE]
proof (state)
this:
s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e))
s r = Some (\<sigma>, \<tau>, \<E> [Rfork e])
r' \<notin> RID\<^sub>G s

goal (7 subgoals):
 1. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e1])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV T)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 2. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e2])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV F)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 3. \<And>\<sigma> \<tau> \<E> l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (the (if \<tau> l = None then \<sigma> l else \<tau> l))])); s r = Some (\<sigma>, \<tau>, \<E> [Read (VE (Loc l))]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 4. \<And>\<sigma> \<tau> \<E> l v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (CV Unit)])); s r = Some (\<sigma>, \<tau>, \<E> [Assign (VE (Loc l)) (VE v)]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 5. \<And>\<sigma> \<tau> \<E> e r'. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e)); s r = Some (\<sigma>, \<tau>, \<E> [Rfork e]); r' \<notin> RID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 6. \<And>\<sigma> \<tau> \<E> r' \<sigma>' \<tau>' v. \<lbrakk>s' = (s(r \<mapsto> (\<sigma>, \<tau>;;\<tau>', \<E> [VE (CV Unit)])))(r' := None); s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = Some (\<sigma>', \<tau>', VE v)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 7. \<And>\<sigma> \<tau> \<E> r'. \<lbrakk>s' = \<epsilon>; s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = None\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
have \<alpha>r'_fresh: "\<alpha> r' \<notin> RID\<^sub>G (\<R>\<^sub>G \<alpha> \<beta> s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<alpha> r' \<notin> RID\<^sub>G (\<R>\<^sub>G \<alpha> \<beta> s)
[PROOF STEP]
by (simp add: bij_\<alpha> bij_\<beta> in_renamed_in_unlabelled_global(1) fork(3))
[PROOF STATE]
proof (state)
this:
\<alpha> r' \<notin> RID\<^sub>G (\<R>\<^sub>G \<alpha> \<beta> s)

goal (7 subgoals):
 1. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e1])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV T)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 2. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e2])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV F)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 3. \<And>\<sigma> \<tau> \<E> l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (the (if \<tau> l = None then \<sigma> l else \<tau> l))])); s r = Some (\<sigma>, \<tau>, \<E> [Read (VE (Loc l))]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 4. \<And>\<sigma> \<tau> \<E> l v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (CV Unit)])); s r = Some (\<sigma>, \<tau>, \<E> [Assign (VE (Loc l)) (VE v)]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 5. \<And>\<sigma> \<tau> \<E> e r'. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e)); s r = Some (\<sigma>, \<tau>, \<E> [Rfork e]); r' \<notin> RID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 6. \<And>\<sigma> \<tau> \<E> r' \<sigma>' \<tau>' v. \<lbrakk>s' = (s(r \<mapsto> (\<sigma>, \<tau>;;\<tau>', \<E> [VE (CV Unit)])))(r' := None); s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = Some (\<sigma>', \<tau>', VE v)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 7. \<And>\<sigma> \<tau> \<E> r'. \<lbrakk>s' = \<epsilon>; s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = None\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
have s_r_as_upd: "s = (s(r \<mapsto> (\<sigma>, \<tau>, \<E> [Rfork e])))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [Rfork e]))
[PROOF STEP]
using fork(2)
[PROOF STATE]
proof (prove)
using this:
s r = Some (\<sigma>, \<tau>, \<E> [Rfork e])

goal (1 subgoal):
 1. s = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [Rfork e]))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
s = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [Rfork e]))

goal (7 subgoals):
 1. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e1])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV T)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 2. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e2])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV F)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 3. \<And>\<sigma> \<tau> \<E> l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (the (if \<tau> l = None then \<sigma> l else \<tau> l))])); s r = Some (\<sigma>, \<tau>, \<E> [Read (VE (Loc l))]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 4. \<And>\<sigma> \<tau> \<E> l v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (CV Unit)])); s r = Some (\<sigma>, \<tau>, \<E> [Assign (VE (Loc l)) (VE v)]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 5. \<And>\<sigma> \<tau> \<E> e r'. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e)); s r = Some (\<sigma>, \<tau>, \<E> [Rfork e]); r' \<notin> RID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 6. \<And>\<sigma> \<tau> \<E> r' \<sigma>' \<tau>' v. \<lbrakk>s' = (s(r \<mapsto> (\<sigma>, \<tau>;;\<tau>', \<E> [VE (CV Unit)])))(r' := None); s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = Some (\<sigma>', \<tau>', VE v)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 7. \<And>\<sigma> \<tau> \<E> r'. \<lbrakk>s' = \<epsilon>; s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = None\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
have src: "\<R>\<^sub>G \<alpha> \<beta> s (\<alpha> r) = Some (\<R>\<^sub>S \<alpha> \<beta> \<sigma>, \<R>\<^sub>S \<alpha> \<beta> \<tau>, (\<R>\<^sub>C \<alpha> \<beta> \<E>) [Rfork (\<R>\<^sub>E \<alpha> \<beta> e)])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<R>\<^sub>G \<alpha> \<beta> s (\<alpha> r) = Some (\<R>\<^sub>S \<alpha> \<beta> \<sigma>, \<R>\<^sub>S \<alpha> \<beta> \<tau>, (\<R>\<^sub>C \<alpha> \<beta> \<E>) [Rfork (\<R>\<^sub>E \<alpha> \<beta> e)])
[PROOF STEP]
by (subst s_r_as_upd, simp add: bij_\<alpha>)
[PROOF STATE]
proof (state)
this:
\<R>\<^sub>G \<alpha> \<beta> s (\<alpha> r) = Some (\<R>\<^sub>S \<alpha> \<beta> \<sigma>, \<R>\<^sub>S \<alpha> \<beta> \<tau>, (\<R>\<^sub>C \<alpha> \<beta> \<E>) [Rfork (\<R>\<^sub>E \<alpha> \<beta> e)])

goal (7 subgoals):
 1. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e1])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV T)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 2. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e2])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV F)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 3. \<And>\<sigma> \<tau> \<E> l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (the (if \<tau> l = None then \<sigma> l else \<tau> l))])); s r = Some (\<sigma>, \<tau>, \<E> [Read (VE (Loc l))]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 4. \<And>\<sigma> \<tau> \<E> l v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (CV Unit)])); s r = Some (\<sigma>, \<tau>, \<E> [Assign (VE (Loc l)) (VE v)]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 5. \<And>\<sigma> \<tau> \<E> e r'. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e)); s r = Some (\<sigma>, \<tau>, \<E> [Rfork e]); r' \<notin> RID\<^sub>G s\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 6. \<And>\<sigma> \<tau> \<E> r' \<sigma>' \<tau>' v. \<lbrakk>s' = (s(r \<mapsto> (\<sigma>, \<tau>;;\<tau>', \<E> [VE (CV Unit)])))(r' := None); s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = Some (\<sigma>', \<tau>', VE v)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 7. \<And>\<sigma> \<tau> \<E> r'. \<lbrakk>s' = \<epsilon>; s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = None\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
using \<alpha>r'_fresh src revision_step.fork fork(1) bij_\<alpha>
[PROOF STATE]
proof (prove)
using this:
\<alpha> r' \<notin> RID\<^sub>G (\<R>\<^sub>G \<alpha> \<beta> s)
\<R>\<^sub>G \<alpha> \<beta> s (\<alpha> r) = Some (\<R>\<^sub>S \<alpha> \<beta> \<sigma>, \<R>\<^sub>S \<alpha> \<beta> \<tau>, (\<R>\<^sub>C \<alpha> \<beta> \<E>) [Rfork (\<R>\<^sub>E \<alpha> \<beta> e)])
\<lbrakk>?s ?r = Some (?\<sigma>, ?\<tau>, ?\<E> [Rfork ?e]); ?r' \<notin> RID\<^sub>G ?s\<rbrakk> \<Longrightarrow> revision_step ?r ?s (?s(?r \<mapsto> (?\<sigma>, ?\<tau>, ?\<E> [VE (Rid ?r')]), ?r' \<mapsto> (?\<sigma>;;?\<tau>, \<epsilon>, ?e)))
s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (Rid r')]), r' \<mapsto> (\<sigma>;;\<tau>, \<epsilon>, e))
bij \<alpha>

goal (1 subgoal):
 1. revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')

goal (6 subgoals):
 1. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e1])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV T)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 2. \<And>\<sigma> \<tau> \<E> e1 e2. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [e2])); s r = Some (\<sigma>, \<tau>, \<E> [Ite (VE (CV F)) e1 e2])\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 3. \<And>\<sigma> \<tau> \<E> l. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>, \<E> [VE (the (if \<tau> l = None then \<sigma> l else \<tau> l))])); s r = Some (\<sigma>, \<tau>, \<E> [Read (VE (Loc l))]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 4. \<And>\<sigma> \<tau> \<E> l v. \<lbrakk>s' = s(r \<mapsto> (\<sigma>, \<tau>(l \<mapsto> v), \<E> [VE (CV Unit)])); s r = Some (\<sigma>, \<tau>, \<E> [Assign (VE (Loc l)) (VE v)]); l \<in> dom (\<sigma>;;\<tau>)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 5. \<And>\<sigma> \<tau> \<E> r' \<sigma>' \<tau>' v. \<lbrakk>s' = (s(r \<mapsto> (\<sigma>, \<tau>;;\<tau>', \<E> [VE (CV Unit)])))(r' := None); s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = Some (\<sigma>', \<tau>', VE v)\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
 6. \<And>\<sigma> \<tau> \<E> r'. \<lbrakk>s' = \<epsilon>; s r = Some (\<sigma>, \<tau>, \<E> [Rjoin (VE (Rid r'))]); s r' = None\<rbrakk> \<Longrightarrow> revision_step (\<alpha> r) (\<R>\<^sub>G \<alpha> \<beta> s) (\<R>\<^sub>G \<alpha> \<beta> s')
[PROOF STEP]
qed (auto simp add: bij_\<alpha> bij_\<beta> bijection.intro bijection.inv_left)


[STATEMENT]
lemma seq_comp_secure_aux_2 [rule_format]:
  assumes
    A: "secure_termination I D" and
    B: "ref_union_closed P" and
    C: "sequential P" and
    D: "secure P I D" and
    E: "secure Q I D"
  shows "(ws, Z) \<in> seq_comp_failures P Q \<Longrightarrow>
    ws = xs @ zs \<longrightarrow>
    (xs @ [y], {}) \<in> seq_comp_failures P Q \<longrightarrow>
    (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Z)
      \<in> seq_comp_failures P Q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (ws, Z) \<in> seq_comp_failures P Q \<Longrightarrow> ws = xs @ zs \<longrightarrow> (xs @ [y], {}) \<in> seq_comp_failures P Q \<longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Z) \<in> seq_comp_failures P Q
[PROOF STEP]
proof (erule seq_comp_failures.induct, (rule_tac [!] impI)+, simp_all, (erule conjE)+)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>xsa X. \<lbrakk>xs @ zs \<notin> sentences P; (xs @ zs, X) \<in> failures P; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q; None \<notin> set xs; None \<notin> set zs\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q
 2. \<And>xsa X Y. \<lbrakk>xs @ zs \<in> sentences P; (xs @ zs, X) \<in> failures P; ([], Y) \<in> failures Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (insert None X \<inter> Y)) \<in> seq_comp_failures P Q
 3. \<And>xsa ys Y. \<lbrakk>xsa \<in> sentences P; (ys, Y) \<in> failures Q; ys \<noteq> []; xsa @ ys = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q
 4. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
fix X
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>xsa X. \<lbrakk>xs @ zs \<notin> sentences P; (xs @ zs, X) \<in> failures P; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q; None \<notin> set xs; None \<notin> set zs\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q
 2. \<And>xsa X Y. \<lbrakk>xs @ zs \<in> sentences P; (xs @ zs, X) \<in> failures P; ([], Y) \<in> failures Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (insert None X \<inter> Y)) \<in> seq_comp_failures P Q
 3. \<And>xsa ys Y. \<lbrakk>xsa \<in> sentences P; (ys, Y) \<in> failures Q; ys \<noteq> []; xsa @ ys = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q
 4. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
assume
   "xs @ zs \<notin> sentences P" and
   "(xs @ zs, X) \<in> failures P" and
   "None \<notin> set xs" and
   "None \<notin> set zs" and
   "(xs @ [y], {}) \<in> seq_comp_failures P Q"
[PROOF STATE]
proof (state)
this:
xs @ zs \<notin> sentences P
(xs @ zs, X) \<in> failures P
None \<notin> set xs
None \<notin> set zs
(xs @ [y], {}) \<in> seq_comp_failures P Q

goal (4 subgoals):
 1. \<And>xsa X. \<lbrakk>xs @ zs \<notin> sentences P; (xs @ zs, X) \<in> failures P; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q; None \<notin> set xs; None \<notin> set zs\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q
 2. \<And>xsa X Y. \<lbrakk>xs @ zs \<in> sentences P; (xs @ zs, X) \<in> failures P; ([], Y) \<in> failures Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (insert None X \<inter> Y)) \<in> seq_comp_failures P Q
 3. \<And>xsa ys Y. \<lbrakk>xsa \<in> sentences P; (ys, Y) \<in> failures Q; ys \<noteq> []; xsa @ ys = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q
 4. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
thus "(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X)
    \<in> seq_comp_failures P Q"
[PROOF STATE]
proof (prove)
using this:
xs @ zs \<notin> sentences P
(xs @ zs, X) \<in> failures P
None \<notin> set xs
None \<notin> set zs
(xs @ [y], {}) \<in> seq_comp_failures P Q

goal (1 subgoal):
 1. (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q
[PROOF STEP]
by (rule seq_comp_secure_aux_2_case_1 [OF A C D])
[PROOF STATE]
proof (state)
this:
(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q

goal (3 subgoals):
 1. \<And>xsa X Y. \<lbrakk>xs @ zs \<in> sentences P; (xs @ zs, X) \<in> failures P; ([], Y) \<in> failures Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (insert None X \<inter> Y)) \<in> seq_comp_failures P Q
 2. \<And>xsa ys Y. \<lbrakk>xsa \<in> sentences P; (ys, Y) \<in> failures Q; ys \<noteq> []; xsa @ ys = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q
 3. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>xsa X Y. \<lbrakk>xs @ zs \<in> sentences P; (xs @ zs, X) \<in> failures P; ([], Y) \<in> failures Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (insert None X \<inter> Y)) \<in> seq_comp_failures P Q
 2. \<And>xsa ys Y. \<lbrakk>xsa \<in> sentences P; (ys, Y) \<in> failures Q; ys \<noteq> []; xsa @ ys = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q
 3. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
fix X Y
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>xsa X Y. \<lbrakk>xs @ zs \<in> sentences P; (xs @ zs, X) \<in> failures P; ([], Y) \<in> failures Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (insert None X \<inter> Y)) \<in> seq_comp_failures P Q
 2. \<And>xsa ys Y. \<lbrakk>xsa \<in> sentences P; (ys, Y) \<in> failures Q; ys \<noteq> []; xsa @ ys = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q
 3. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
assume
   "xs @ zs \<in> sentences P" and
   "(xs @ zs, X) \<in> failures P" and
   "([], Y) \<in> failures Q" and
   "(xs @ [y], {}) \<in> seq_comp_failures P Q"
[PROOF STATE]
proof (state)
this:
xs @ zs \<in> sentences P
(xs @ zs, X) \<in> failures P
([], Y) \<in> failures Q
(xs @ [y], {}) \<in> seq_comp_failures P Q

goal (3 subgoals):
 1. \<And>xsa X Y. \<lbrakk>xs @ zs \<in> sentences P; (xs @ zs, X) \<in> failures P; ([], Y) \<in> failures Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (insert None X \<inter> Y)) \<in> seq_comp_failures P Q
 2. \<And>xsa ys Y. \<lbrakk>xsa \<in> sentences P; (ys, Y) \<in> failures Q; ys \<noteq> []; xsa @ ys = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q
 3. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
thus "(xs @ y # ipurge_tr I D (D y) zs,
    ipurge_ref I D (D y) zs (insert None X \<inter> Y)) \<in> seq_comp_failures P Q"
[PROOF STATE]
proof (prove)
using this:
xs @ zs \<in> sentences P
(xs @ zs, X) \<in> failures P
([], Y) \<in> failures Q
(xs @ [y], {}) \<in> seq_comp_failures P Q

goal (1 subgoal):
 1. (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (insert None X \<inter> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
by (rule seq_comp_secure_aux_2_case_2 [OF A C D E])
[PROOF STATE]
proof (state)
this:
(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (insert None X \<inter> Y)) \<in> seq_comp_failures P Q

goal (2 subgoals):
 1. \<And>xsa ys Y. \<lbrakk>xsa \<in> sentences P; (ys, Y) \<in> failures Q; ys \<noteq> []; xsa @ ys = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q
 2. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>xsa ys Y. \<lbrakk>xsa \<in> sentences P; (ys, Y) \<in> failures Q; ys \<noteq> []; xsa @ ys = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q
 2. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
fix ws ys Y
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>xsa ys Y. \<lbrakk>xsa \<in> sentences P; (ys, Y) \<in> failures Q; ys \<noteq> []; xsa @ ys = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q
 2. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
assume
   "ws \<in> sentences P" and
   "(ys, Y) \<in> failures Q" and
   "ys \<noteq> []" and
   "ws @ ys = xs @ zs" and
   "(xs @ [y], {}) \<in> seq_comp_failures P Q"
[PROOF STATE]
proof (state)
this:
ws \<in> sentences P
(ys, Y) \<in> failures Q
ys \<noteq> []
ws @ ys = xs @ zs
(xs @ [y], {}) \<in> seq_comp_failures P Q

goal (2 subgoals):
 1. \<And>xsa ys Y. \<lbrakk>xsa \<in> sentences P; (ys, Y) \<in> failures Q; ys \<noteq> []; xsa @ ys = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q
 2. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
thus "(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y)
    \<in> seq_comp_failures P Q"
[PROOF STATE]
proof (prove)
using this:
ws \<in> sentences P
(ys, Y) \<in> failures Q
ys \<noteq> []
ws @ ys = xs @ zs
(xs @ [y], {}) \<in> seq_comp_failures P Q

goal (1 subgoal):
 1. (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q
[PROOF STEP]
by (rule seq_comp_secure_aux_2_case_3 [OF A B C D E])
[PROOF STATE]
proof (state)
this:
(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q

goal (1 subgoal):
 1. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
fix X Y
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
assume
   "(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X)
      \<in> seq_comp_failures P Q" and
   "(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y)
      \<in> seq_comp_failures P Q"
[PROOF STATE]
proof (state)
this:
(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q
(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q

goal (1 subgoal):
 1. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
hence "(xs @ y # ipurge_tr I D (D y) zs,
    ipurge_ref I D (D y) zs X \<union> ipurge_ref I D (D y) zs Y)
    \<in> seq_comp_failures P Q"
[PROOF STATE]
proof (prove)
using this:
(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q
(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q

goal (1 subgoal):
 1. (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X \<union> ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q
[PROOF STEP]
by (rule SCF_R4)
[PROOF STATE]
proof (state)
this:
(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X \<union> ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q

goal (1 subgoal):
 1. \<And>xsa X Y. \<lbrakk>(xs @ zs, X) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X) \<in> seq_comp_failures P Q; (xs @ zs, Y) \<in> seq_comp_failures P Q; (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q; xsa = xs @ zs; (xs @ [y], {}) \<in> seq_comp_failures P Q\<rbrakk> \<Longrightarrow> (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
thus "(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y))
    \<in> seq_comp_failures P Q"
[PROOF STATE]
proof (prove)
using this:
(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs X \<union> ipurge_ref I D (D y) zs Y) \<in> seq_comp_failures P Q

goal (1 subgoal):
 1. (xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q
[PROOF STEP]
by (simp add: ipurge_ref_distrib_union)
[PROOF STATE]
proof (state)
this:
(xs @ y # ipurge_tr I D (D y) zs, ipurge_ref I D (D y) zs (X \<union> Y)) \<in> seq_comp_failures P Q

goal:
No subgoals!
[PROOF STEP]
qed