[STATEMENT]
lemma class_add_sees_methods_rev_Obj:
assumes "class_add P (C, cdec) \<turnstile> Object sees_methods Mm" and nObj: "C \<noteq> Object"
shows "P \<turnstile> Object sees_methods Mm"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<turnstile> Object sees_methods Mm
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. P \<turnstile> Object sees_methods Mm
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
class_add P (C, cdec) \<turnstile> Object sees_methods Mm
C \<noteq> Object
[PROOF STEP]
obtain C' fs ms where cls: "class (class_add P (C, cdec)) Object = Some(C',fs,ms)"
[PROOF STATE]
proof (prove)
using this:
class_add P (C, cdec) \<turnstile> Object sees_methods Mm
C \<noteq> Object

goal (1 subgoal):
 1. (\<And>C' fs ms. class (class_add P (C, cdec)) Object = \<lfloor>(C', fs, ms)\<rfloor> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(auto elim!: Methods.cases)
[PROOF STATE]
proof (state)
this:
class (class_add P (C, cdec)) Object = \<lfloor>(C', fs, ms)\<rfloor>

goal (1 subgoal):
 1. P \<turnstile> Object sees_methods Mm
[PROOF STEP]
with nObj
[PROOF STATE]
proof (chain)
picking this:
C \<noteq> Object
class (class_add P (C, cdec)) Object = \<lfloor>(C', fs, ms)\<rfloor>
[PROOF STEP]
have cls': "class P Object = Some(C',fs,ms)"
[PROOF STATE]
proof (prove)
using this:
C \<noteq> Object
class (class_add P (C, cdec)) Object = \<lfloor>(C', fs, ms)\<rfloor>

goal (1 subgoal):
 1. class P Object = \<lfloor>(C', fs, ms)\<rfloor>
[PROOF STEP]
by(simp add: class_def fun_upd_apply)
[PROOF STATE]
proof (state)
this:
class P Object = \<lfloor>(C', fs, ms)\<rfloor>

goal (1 subgoal):
 1. P \<turnstile> Object sees_methods Mm
[PROOF STEP]
from assms cls
[PROOF STATE]
proof (chain)
picking this:
class_add P (C, cdec) \<turnstile> Object sees_methods Mm
C \<noteq> Object
class (class_add P (C, cdec)) Object = \<lfloor>(C', fs, ms)\<rfloor>
[PROOF STEP]
have "Mm = map_option (\<lambda>m. (m, Object)) \<circ> map_of ms"
[PROOF STATE]
proof (prove)
using this:
class_add P (C, cdec) \<turnstile> Object sees_methods Mm
C \<noteq> Object
class (class_add P (C, cdec)) Object = \<lfloor>(C', fs, ms)\<rfloor>

goal (1 subgoal):
 1. Mm = map_option (\<lambda>m. (m, Object)) \<circ> map_of ms
[PROOF STEP]
by(auto elim!: Methods.cases)
[PROOF STATE]
proof (state)
this:
Mm = map_option (\<lambda>m. (m, Object)) \<circ> map_of ms

goal (1 subgoal):
 1. P \<turnstile> Object sees_methods Mm
[PROOF STEP]
with assms cls'
[PROOF STATE]
proof (chain)
picking this:
class_add P (C, cdec) \<turnstile> Object sees_methods Mm
C \<noteq> Object
class P Object = \<lfloor>(C', fs, ms)\<rfloor>
Mm = map_option (\<lambda>m. (m, Object)) \<circ> map_of ms
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
class_add P (C, cdec) \<turnstile> Object sees_methods Mm
C \<noteq> Object
class P Object = \<lfloor>(C', fs, ms)\<rfloor>
Mm = map_option (\<lambda>m. (m, Object)) \<circ> map_of ms

goal (1 subgoal):
 1. P \<turnstile> Object sees_methods Mm
[PROOF STEP]
by(auto simp: is_class_def fun_upd_apply intro!: sees_methods_Object)
[PROOF STATE]
proof (state)
this:
P \<turnstile> Object sees_methods Mm

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma RelS_Eg1Eg2_secure_refinement_simple_\<R>:
  "secure_refinement_simple (A.\<R> \<Gamma> \<S> P) RelS_Eg1Eg2 abs_steps"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. secure_refinement_simple (A.\<R> \<Gamma> \<S> P) RelS_Eg1Eg2 abs_steps
[PROOF STEP]
apply(unfold secure_refinement_simple_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. closed_others RelS_Eg1Eg2 \<and> preserves_modes_mem RelS_Eg1Eg2 \<and> new_vars_private RelS_Eg1Eg2 \<and> simple_refinement_safe (A.\<R> \<Gamma> \<S> P) RelS_Eg1Eg2 abs_steps \<and> bisim_simple (A.\<R> \<Gamma> \<S> P) \<and> (\<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2 \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2)))
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. closed_others RelS_Eg1Eg2
 2. preserves_modes_mem RelS_Eg1Eg2 \<and> new_vars_private RelS_Eg1Eg2 \<and> simple_refinement_safe (A.\<R> \<Gamma> \<S> P) RelS_Eg1Eg2 abs_steps \<and> bisim_simple (A.\<R> \<Gamma> \<S> P) \<and> (\<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2 \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2)))
[PROOF STEP]
apply(rule closed_others_RelS_Eg1Eg2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_modes_mem RelS_Eg1Eg2 \<and> new_vars_private RelS_Eg1Eg2 \<and> simple_refinement_safe (A.\<R> \<Gamma> \<S> P) RelS_Eg1Eg2 abs_steps \<and> bisim_simple (A.\<R> \<Gamma> \<S> P) \<and> (\<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2 \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2)))
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. preserves_modes_mem RelS_Eg1Eg2
 2. new_vars_private RelS_Eg1Eg2 \<and> simple_refinement_safe (A.\<R> \<Gamma> \<S> P) RelS_Eg1Eg2 abs_steps \<and> bisim_simple (A.\<R> \<Gamma> \<S> P) \<and> (\<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2 \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2)))
[PROOF STEP]
apply(rule preserves_modes_mem_RelS_Eg1Eg2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. new_vars_private RelS_Eg1Eg2 \<and> simple_refinement_safe (A.\<R> \<Gamma> \<S> P) RelS_Eg1Eg2 abs_steps \<and> bisim_simple (A.\<R> \<Gamma> \<S> P) \<and> (\<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2 \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2)))
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. new_vars_private RelS_Eg1Eg2
 2. simple_refinement_safe (A.\<R> \<Gamma> \<S> P) RelS_Eg1Eg2 abs_steps \<and> bisim_simple (A.\<R> \<Gamma> \<S> P) \<and> (\<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2 \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2)))
[PROOF STEP]
apply(rule new_vars_private_RelS_Eg1Eg2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. simple_refinement_safe (A.\<R> \<Gamma> \<S> P) RelS_Eg1Eg2 abs_steps \<and> bisim_simple (A.\<R> \<Gamma> \<S> P) \<and> (\<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2 \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2)))
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. simple_refinement_safe (A.\<R> \<Gamma> \<S> P) RelS_Eg1Eg2 abs_steps
 2. bisim_simple (A.\<R> \<Gamma> \<S> P) \<and> (\<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2 \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2)))
[PROOF STEP]
apply(rule simple_refinement_safe_RelS_Eg1Eg2)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>c mds mem mem'. A.\<R>_abv \<langle>c, mds, mem\<rangle>\<^sub>A \<Gamma> \<S> P \<langle>c, mds, mem'\<rangle>\<^sub>A \<Longrightarrow> A.low_mds_eq mds mem mem'
 2. bisim_simple (A.\<R> \<Gamma> \<S> P) \<and> (\<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2 \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2)))
[PROOF STEP]
using A.\<R>_to_\<R>\<^sub>3 A.\<R>\<^sub>3_mem_eq
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>A.\<R>_abv \<langle>?c\<^sub>1, ?mds, ?mem\<^sub>1\<rangle>\<^sub>A ?\<Gamma> ?\<S> ?P \<langle>?c\<^sub>2, ?mds, ?mem\<^sub>2\<rangle>\<^sub>A; A.has_type ?\<Gamma> ?\<S> ?P ?c ?\<Gamma>' ?\<S>' ?P'\<rbrakk> \<Longrightarrow> A.\<R>\<^sub>3_aux \<langle>?c\<^sub>1 ;; ?c, ?mds, ?mem\<^sub>1\<rangle>\<^sub>A ?\<Gamma>' ?\<S>' ?P' \<langle>?c\<^sub>2 ;; ?c, ?mds, ?mem\<^sub>2\<rangle>\<^sub>A
A.\<R>\<^sub>3_aux \<langle>?c\<^sub>1, ?mds, ?mem\<^sub>1\<rangle>\<^sub>A ?\<Gamma>' ?\<S>' ?P' \<langle>?c\<^sub>2, ?mds, ?mem\<^sub>2\<rangle>\<^sub>A \<Longrightarrow> A.low_mds_eq ?mds ?mem\<^sub>1 ?mem\<^sub>2

goal (2 subgoals):
 1. \<And>c mds mem mem'. A.\<R>_abv \<langle>c, mds, mem\<rangle>\<^sub>A \<Gamma> \<S> P \<langle>c, mds, mem'\<rangle>\<^sub>A \<Longrightarrow> A.low_mds_eq mds mem mem'
 2. bisim_simple (A.\<R> \<Gamma> \<S> P) \<and> (\<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2 \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2)))
[PROOF STEP]
apply fast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bisim_simple (A.\<R> \<Gamma> \<S> P) \<and> (\<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2 \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2)))
[PROOF STEP]
apply(rule conjI)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. bisim_simple (A.\<R> \<Gamma> \<S> P)
 2. \<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2 \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2))
[PROOF STEP]
apply(rule bisim_simple_\<R>)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C. (\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2 \<longrightarrow> (\<forall>c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C \<longrightarrow> (\<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2))
[PROOF STEP]
apply safe
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>c\<^sub>1\<^sub>A mds\<^sub>A mem\<^sub>1\<^sub>A c\<^sub>1\<^sub>C mds\<^sub>C mem\<^sub>1\<^sub>C c\<^sub>1\<^sub>C' mds\<^sub>C' mem\<^sub>1\<^sub>C'. \<lbrakk>(\<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2; eval_abv\<^sub>C \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C\<rbrakk> \<Longrightarrow> \<exists>c\<^sub>1\<^sub>A' mds\<^sub>A' mem\<^sub>1\<^sub>A'. A.neval \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A (abs_steps \<langle>c\<^sub>1\<^sub>A, mds\<^sub>A, mem\<^sub>1\<^sub>A\<rangle>\<^sub>A \<langle>c\<^sub>1\<^sub>C, mds\<^sub>C, mem\<^sub>1\<^sub>C\<rangle>\<^sub>C) \<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A \<and> (\<langle>c\<^sub>1\<^sub>A', mds\<^sub>A', mem\<^sub>1\<^sub>A'\<rangle>\<^sub>A, \<langle>c\<^sub>1\<^sub>C', mds\<^sub>C', mem\<^sub>1\<^sub>C'\<rangle>\<^sub>C) \<in> RelS_Eg1Eg2
[PROOF STEP]
apply(drule (1) induction_RelS_Eg1Eg2, clarify)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "x = f5 x opt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = f5 x opt
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x = f5 x opt
[PROOF STEP]
oops


[STATEMENT]
lemma remove_child_removes_first_child:
  "heap_is_wellformed h \<Longrightarrow> type_wf h \<Longrightarrow> known_ptrs h \<Longrightarrow> h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r node_ptr # children \<Longrightarrow>
h \<turnstile> remove_child ptr node_ptr \<rightarrow>\<^sub>h h' \<Longrightarrow> h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>heap_is_wellformed h; type_wf h; known_ptrs h; h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r node_ptr # children; h \<turnstile> remove_child ptr node_ptr \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
[PROOF STEP]
using CD.remove_child_removes_first_child local.heap_is_wellformed_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M ?h; type_wf ?h; known_ptrs ?h; ?h \<turnstile> get_child_nodes ?ptr \<rightarrow>\<^sub>r ?node_ptr # ?children; ?h \<turnstile> remove_child ?ptr ?node_ptr \<rightarrow>\<^sub>h ?h'\<rbrakk> \<Longrightarrow> ?h' \<turnstile> get_child_nodes ?ptr \<rightarrow>\<^sub>r ?children
heap_is_wellformed = (\<lambda>h. heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M h \<and> acyclic (parent_child_rel h \<union> local.a_host_shadow_root_rel h \<union> local.a_ptr_disconnected_node_rel h) \<and> local.a_all_ptrs_in_heap h \<and> local.a_distinct_lists h \<and> local.a_shadow_root_valid h)

goal (1 subgoal):
 1. \<lbrakk>heap_is_wellformed h; type_wf h; known_ptrs h; h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r node_ptr # children; h \<turnstile> remove_child ptr node_ptr \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> h' \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
[PROOF STEP]
by blast


[STATEMENT]
lemma transaction_strand_subst_subsets[simp]:
  "set (transaction_receive T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>) \<subseteq> set (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)"
  "set (transaction_checks T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>) \<subseteq> set (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)"
  "set (transaction_updates T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>) \<subseteq> set (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)"
  "set (transaction_send T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>) \<subseteq> set (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)"
  "set (unlabel (transaction_receive T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)) \<subseteq> set (unlabel (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))"
  "set (unlabel (transaction_checks T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)) \<subseteq> set (unlabel (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))"
  "set (unlabel (transaction_updates T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)) \<subseteq> set (unlabel (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))"
  "set (unlabel (transaction_send T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)) \<subseteq> set (unlabel (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((set (transaction_receive T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>) \<subseteq> set (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>) &&& set (transaction_checks T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>) \<subseteq> set (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)) &&& set (transaction_updates T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>) \<subseteq> set (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>) &&& set (transaction_send T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>) \<subseteq> set (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)) &&& (set (unlabel (transaction_receive T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)) \<subseteq> set (unlabel (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)) &&& set (unlabel (transaction_checks T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)) \<subseteq> set (unlabel (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))) &&& set (unlabel (transaction_updates T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)) \<subseteq> set (unlabel (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)) &&& set (unlabel (transaction_send T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)) \<subseteq> set (unlabel (transaction_strand T \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>))
[PROOF STEP]
unfolding transaction_strand_def unlabel_def subst_apply_labeled_stateful_strand_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((set (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_receive T)) \<subseteq> set (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_receive T @ transaction_checks T @ transaction_updates T @ transaction_send T)) &&& set (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_checks T)) \<subseteq> set (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_receive T @ transaction_checks T @ transaction_updates T @ transaction_send T))) &&& set (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_updates T)) \<subseteq> set (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_receive T @ transaction_checks T @ transaction_updates T @ transaction_send T)) &&& set (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_send T)) \<subseteq> set (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_receive T @ transaction_checks T @ transaction_updates T @ transaction_send T))) &&& (set (map snd (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_receive T))) \<subseteq> set (map snd (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_receive T @ transaction_checks T @ transaction_updates T @ transaction_send T))) &&& set (map snd (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_checks T))) \<subseteq> set (map snd (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_receive T @ transaction_checks T @ transaction_updates T @ transaction_send T)))) &&& set (map snd (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_updates T))) \<subseteq> set (map snd (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_receive T @ transaction_checks T @ transaction_updates T @ transaction_send T))) &&& set (map snd (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_send T))) \<subseteq> set (map snd (map (\<lambda>x. x \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>) (transaction_receive T @ transaction_checks T @ transaction_updates T @ transaction_send T)))
[PROOF STEP]
by force+