[STATEMENT]
lemma resCases'[consumes 7, case_names cOpen cRes]:
  fixes \<Psi>    :: 'b
  and   x    :: name
  and   P    :: "('a, 'b, 'c) psi"
  and   \<alpha>    :: "'a action"
  and   P'   :: "('a, 'b, 'c) psi"
  and   C    :: "'d::fs_name"

  assumes Trans: "\<Psi> \<rhd> \<lparr>\<nu>x\<rparr>P \<longmapsto>x\<alpha> \<prec> xP'"
  and     "x \<sharp> \<Psi>"
  and     "x \<sharp> x\<alpha>"
  and     "x \<sharp> xP'"
  and     "bn x\<alpha> \<sharp>* \<Psi>"
  and     "bn x\<alpha> \<sharp>* P"
  and     "bn x\<alpha> \<sharp>* subject x\<alpha>"
  and     rOpen: "\<And>M xvec yvec y N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto>M\<lparr>\<nu>*(xvec@yvec)\<rparr>\<langle>([(x, y)] \<bullet> N)\<rangle> \<prec> ([(x, y)] \<bullet> P'); y \<in> supp N;
                                         x \<sharp> N; x \<sharp> P'; x \<noteq> y; y \<sharp> xvec; y \<sharp> yvec; y \<sharp> M; distinct xvec; distinct yvec;
                                         xvec \<sharp>* \<Psi>; y \<sharp> \<Psi>; yvec \<sharp>* \<Psi>; xvec \<sharp>* P; y \<sharp> P; yvec \<sharp>* P; xvec \<sharp>* M; y \<sharp> M;
                                         yvec \<sharp>* M; xvec \<sharp>* yvec; x\<alpha> = M\<lparr>\<nu>*(xvec@y#yvec)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow>
                                         Prop"
  and     rScope:  "\<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto>x\<alpha> \<prec> P'; xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop"

  shows "Prop"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prop
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Prop
[PROOF STEP]
from Trans
[PROOF STATE]
proof (chain)
picking this:
\<Psi> \<rhd> \<lparr>\<nu>x\<rparr>P \<longmapsto> x\<alpha> \<prec> xP'
[PROOF STEP]
have "distinct(bn x\<alpha>)"
[PROOF STATE]
proof (prove)
using this:
\<Psi> \<rhd> \<lparr>\<nu>x\<rparr>P \<longmapsto> x\<alpha> \<prec> xP'

goal (1 subgoal):
 1. distinct (bn x\<alpha>)
[PROOF STEP]
by(auto dest: boundOutputDistinct)
[PROOF STATE]
proof (state)
this:
distinct (bn x\<alpha>)

goal (1 subgoal):
 1. Prop
[PROOF STEP]
have "length(bn x\<alpha>) = residualLength(x\<alpha> \<prec> xP')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')

goal (1 subgoal):
 1. Prop
[PROOF STEP]
note Trans
[PROOF STATE]
proof (state)
this:
\<Psi> \<rhd> \<lparr>\<nu>x\<rparr>P \<longmapsto> x\<alpha> \<prec> xP'

goal (1 subgoal):
 1. Prop
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<Psi> \<rhd> \<lparr>\<nu>x\<rparr>P \<longmapsto> x\<alpha> \<prec> xP'

goal (1 subgoal):
 1. Prop
[PROOF STEP]
have "length [] = inputLength(\<lparr>\<nu>x\<rparr>P)" and "distinct []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length [] = inputLength (\<lparr>\<nu>x\<rparr>P) &&& distinct []
[PROOF STEP]
by(auto simp add: inputLength_inputLength'_inputLength''.simps)
[PROOF STATE]
proof (state)
this:
length [] = inputLength (\<lparr>\<nu>x\<rparr>P)
distinct []

goal (1 subgoal):
 1. Prop
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
length [] = inputLength (\<lparr>\<nu>x\<rparr>P)
distinct []

goal (1 subgoal):
 1. Prop
[PROOF STEP]
note \<open>length(bn x\<alpha>) = residualLength(x\<alpha> \<prec> xP')\<close> \<open>distinct(bn x\<alpha>)\<close>
[PROOF STATE]
proof (state)
this:
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)

goal (1 subgoal):
 1. Prop
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)

goal (1 subgoal):
 1. Prop
[PROOF STEP]
note \<open>length(bn x\<alpha>) = residualLength(x\<alpha> \<prec> xP')\<close> \<open>distinct(bn x\<alpha>)\<close>
[PROOF STATE]
proof (state)
this:
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)

goal (1 subgoal):
 1. Prop
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)

goal (1 subgoal):
 1. Prop
[PROOF STEP]
note \<open>length(bn x\<alpha>) = residualLength(x\<alpha> \<prec> xP')\<close> \<open>distinct(bn x\<alpha>)\<close>
[PROOF STATE]
proof (state)
this:
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)

goal (1 subgoal):
 1. Prop
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)

goal (1 subgoal):
 1. Prop
[PROOF STEP]
note \<open>length(bn x\<alpha>) = residualLength(x\<alpha> \<prec> xP')\<close> \<open>distinct(bn x\<alpha>)\<close>
[PROOF STATE]
proof (state)
this:
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)

goal (1 subgoal):
 1. Prop
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<Psi> \<rhd> \<lparr>\<nu>x\<rparr>P \<longmapsto> x\<alpha> \<prec> xP'
length [] = inputLength (\<lparr>\<nu>x\<rparr>P)
distinct []
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<Psi> \<rhd> \<lparr>\<nu>x\<rparr>P \<longmapsto> x\<alpha> \<prec> xP'
length [] = inputLength (\<lparr>\<nu>x\<rparr>P)
distinct []
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)

goal (1 subgoal):
 1. Prop
[PROOF STEP]
using \<open>bn x\<alpha> \<sharp>* \<Psi>\<close> \<open>bn x\<alpha> \<sharp>* P\<close> \<open>bn x\<alpha> \<sharp>* subject x\<alpha>\<close> \<open>x \<sharp> \<Psi>\<close> \<open>x \<sharp> x\<alpha>\<close> \<open>x \<sharp> xP'\<close> \<open>distinct(bn x\<alpha>)\<close> rScope rOpen
[PROOF STATE]
proof (prove)
using this:
\<Psi> \<rhd> \<lparr>\<nu>x\<rparr>P \<longmapsto> x\<alpha> \<prec> xP'
length [] = inputLength (\<lparr>\<nu>x\<rparr>P)
distinct []
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)
length (bn x\<alpha>) = residualLength (x\<alpha> \<prec> xP')
distinct (bn x\<alpha>)
bn x\<alpha> \<sharp>* \<Psi>
bn x\<alpha> \<sharp>* P
bn x\<alpha> \<sharp>* subject x\<alpha>
x \<sharp> \<Psi>
x \<sharp> x\<alpha>
x \<sharp> xP'
distinct (bn x\<alpha>)
\<lbrakk>\<Psi> \<rhd> P \<longmapsto> x\<alpha> \<prec> ?P'; xP' = \<lparr>\<nu>x\<rparr>?P'\<rbrakk> \<Longrightarrow> Prop
\<lbrakk>\<Psi> \<rhd> P \<longmapsto> ?M\<lparr>\<nu>*(?xvec @ ?yvec)\<rparr>\<langle>([(x, ?y)] \<bullet> ?N)\<rangle> \<prec> [(x, ?y)] \<bullet> ?P'; ?y \<in> supp ?N; x \<sharp> ?N; x \<sharp> ?P'; x \<noteq> ?y; ?y \<sharp> ?xvec; ?y \<sharp> ?yvec; ?y \<sharp> ?M; distinct ?xvec; distinct ?yvec; ?xvec \<sharp>* \<Psi>; ?y \<sharp> \<Psi>; ?yvec \<sharp>* \<Psi>; ?xvec \<sharp>* P; ?y \<sharp> P; ?yvec \<sharp>* P; ?xvec \<sharp>* ?M; ?y \<sharp> ?M; ?yvec \<sharp>* ?M; ?xvec \<sharp>* ?yvec; x\<alpha> = ?M\<lparr>\<nu>*(?xvec @ ?y # ?yvec)\<rparr>\<langle>?N\<rangle>; xP' = ?P'\<rbrakk> \<Longrightarrow> Prop

goal (1 subgoal):
 1. Prop
[PROOF STEP]
apply(cases rule: semanticsCases[of _ _ _ _ _ _ _ _ _ _ x x])
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. \<And>M K N Tvec Pa. \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* P; bn x\<alpha> \<sharp>* subject x\<alpha>; x \<sharp> \<Psi>; x \<sharp> x\<alpha>; x \<sharp> xP'; distinct (bn x\<alpha>); \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> x\<alpha> \<prec> P'; xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>M xvec yvec y N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> M\<lparr>\<nu>*(xvec @ yvec)\<rparr>\<langle>([(x, y)] \<bullet> N)\<rangle> \<prec> [(x, y)] \<bullet> P'; y \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> y; y \<sharp> xvec; y \<sharp> yvec; y \<sharp> M; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; y \<sharp> \<Psi>; yvec \<sharp>* \<Psi>; xvec \<sharp>* P; y \<sharp> P; yvec \<sharp>* P; xvec \<sharp>* M; y \<sharp> M; yvec \<sharp>* M; xvec \<sharp>* yvec; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; \<lbrakk>[] \<sharp>* \<Psi>; [] \<sharp>* \<lparr>\<nu>x\<rparr>P; [] \<sharp>* (x\<alpha> \<prec> xP')\<rbrakk> \<Longrightarrow> \<lparr>\<nu>x\<rparr>P = M\<lparr>\<lambda>*[] N\<rparr>.Pa \<and> x\<alpha> \<prec> xP' = K\<lparr>N[[]::=Tvec]\<rparr> \<prec> Pa[[]::=Tvec] \<and> \<Psi> \<turnstile> M \<leftrightarrow> K \<and> distinct [] \<and> set [] \<subseteq> supp N \<and> length [] = length Tvec \<and> [] \<sharp>* Tvec \<and> [] \<sharp>* \<Psi> \<and> [] \<sharp>* M \<and> [] \<sharp>* K\<rbrakk> \<Longrightarrow> Prop
 2. \<And>M K N Pa. \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* P; bn x\<alpha> \<sharp>* subject x\<alpha>; x \<sharp> \<Psi>; x \<sharp> x\<alpha>; x \<sharp> xP'; distinct (bn x\<alpha>); \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> x\<alpha> \<prec> P'; xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>M xvec yvec y N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> M\<lparr>\<nu>*(xvec @ yvec)\<rparr>\<langle>([(x, y)] \<bullet> N)\<rangle> \<prec> [(x, y)] \<bullet> P'; y \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> y; y \<sharp> xvec; y \<sharp> yvec; y \<sharp> M; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; y \<sharp> \<Psi>; yvec \<sharp>* \<Psi>; xvec \<sharp>* P; y \<sharp> P; yvec \<sharp>* P; xvec \<sharp>* M; y \<sharp> M; yvec \<sharp>* M; xvec \<sharp>* yvec; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; \<lparr>\<nu>x\<rparr>P = M\<langle>N\<rangle>.Pa; x\<alpha> \<prec> xP' = K\<langle>N\<rangle> \<prec> Pa; \<Psi> \<turnstile> M \<leftrightarrow> K\<rbrakk> \<Longrightarrow> Prop
 3. \<And>Cs Pa \<phi>. \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* P; bn x\<alpha> \<sharp>* subject x\<alpha>; x \<sharp> \<Psi>; x \<sharp> x\<alpha>; x \<sharp> xP'; distinct (bn x\<alpha>); \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> x\<alpha> \<prec> P'; xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>M xvec yvec y N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> M\<lparr>\<nu>*(xvec @ yvec)\<rparr>\<langle>([(x, y)] \<bullet> N)\<rangle> \<prec> [(x, y)] \<bullet> P'; y \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> y; y \<sharp> xvec; y \<sharp> yvec; y \<sharp> M; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; y \<sharp> \<Psi>; yvec \<sharp>* \<Psi>; xvec \<sharp>* P; y \<sharp> P; yvec \<sharp>* P; xvec \<sharp>* M; y \<sharp> M; yvec \<sharp>* M; xvec \<sharp>* yvec; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; \<lparr>\<nu>x\<rparr>P = Cases Cs; \<Psi> \<rhd> Pa \<longmapsto> x\<alpha> \<prec> xP'; (\<phi>, Pa) mem Cs; \<Psi> \<turnstile> \<phi>; guarded Pa\<rbrakk> \<Longrightarrow> Prop
 4. \<And>\<Psi>\<^sub>Q Pa \<alpha> P' Q A\<^sub>Q. \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* P; bn x\<alpha> \<sharp>* subject x\<alpha>; x \<sharp> \<Psi>; x \<sharp> x\<alpha>; x \<sharp> xP'; distinct (bn x\<alpha>); \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> x\<alpha> \<prec> P'; xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>M xvec yvec y N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> M\<lparr>\<nu>*(xvec @ yvec)\<rparr>\<langle>([(x, y)] \<bullet> N)\<rangle> \<prec> [(x, y)] \<bullet> P'; y \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> y; y \<sharp> xvec; y \<sharp> yvec; y \<sharp> M; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; y \<sharp> \<Psi>; yvec \<sharp>* \<Psi>; xvec \<sharp>* P; y \<sharp> P; yvec \<sharp>* P; xvec \<sharp>* M; y \<sharp> M; yvec \<sharp>* M; xvec \<sharp>* yvec; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* \<lparr>\<nu>x\<rparr>P; bn x\<alpha> \<sharp>* (x\<alpha> \<prec> xP')\<rbrakk> \<Longrightarrow> \<lparr>\<nu>x\<rparr>P = Pa \<parallel> Q \<and> x\<alpha> \<prec> xP' = \<alpha> \<prec> P' \<parallel> Q \<and> bn x\<alpha> = bn \<alpha> \<and> \<Psi> \<otimes> \<Psi>\<^sub>Q \<rhd> Pa \<longmapsto> \<alpha> \<prec> P' \<and> extractFrame Q = \<langle>A\<^sub>Q, \<Psi>\<^sub>Q\<rangle> \<and> distinct A\<^sub>Q \<and> A\<^sub>Q \<sharp>* Pa \<and> A\<^sub>Q \<sharp>* Q \<and> A\<^sub>Q \<sharp>* \<Psi> \<and> A\<^sub>Q \<sharp>* \<alpha> \<and> A\<^sub>Q \<sharp>* P' \<and> A\<^sub>Q \<sharp>* ?C11\<rbrakk> \<Longrightarrow> Prop
 5. \<And>\<Psi>\<^sub>P Q \<alpha> Q' Pa A\<^sub>P. \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* P; bn x\<alpha> \<sharp>* subject x\<alpha>; x \<sharp> \<Psi>; x \<sharp> x\<alpha>; x \<sharp> xP'; distinct (bn x\<alpha>); \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> x\<alpha> \<prec> P'; xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>M xvec yvec y N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> M\<lparr>\<nu>*(xvec @ yvec)\<rparr>\<langle>([(x, y)] \<bullet> N)\<rangle> \<prec> [(x, y)] \<bullet> P'; y \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> y; y \<sharp> xvec; y \<sharp> yvec; y \<sharp> M; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; y \<sharp> \<Psi>; yvec \<sharp>* \<Psi>; xvec \<sharp>* P; y \<sharp> P; yvec \<sharp>* P; xvec \<sharp>* M; y \<sharp> M; yvec \<sharp>* M; xvec \<sharp>* yvec; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* \<lparr>\<nu>x\<rparr>P; bn x\<alpha> \<sharp>* (x\<alpha> \<prec> xP')\<rbrakk> \<Longrightarrow> \<lparr>\<nu>x\<rparr>P = Pa \<parallel> Q \<and> x\<alpha> \<prec> xP' = \<alpha> \<prec> Pa \<parallel> Q' \<and> bn x\<alpha> = bn \<alpha> \<and> \<Psi> \<otimes> \<Psi>\<^sub>P \<rhd> Q \<longmapsto> \<alpha> \<prec> Q' \<and> extractFrame Pa = \<langle>A\<^sub>P, \<Psi>\<^sub>P\<rangle> \<and> distinct A\<^sub>P \<and> A\<^sub>P \<sharp>* Pa \<and> A\<^sub>P \<sharp>* Q \<and> A\<^sub>P \<sharp>* \<Psi> \<and> A\<^sub>P \<sharp>* \<alpha> \<and> A\<^sub>P \<sharp>* Q' \<and> A\<^sub>P \<sharp>* ?C11\<rbrakk> \<Longrightarrow> Prop
 6. \<And>\<Psi>\<^sub>Q Pa M N P' A\<^sub>P \<Psi>\<^sub>P Q K xvec Q' A\<^sub>Q. \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* P; bn x\<alpha> \<sharp>* subject x\<alpha>; x \<sharp> \<Psi>; x \<sharp> x\<alpha>; x \<sharp> xP'; distinct (bn x\<alpha>); \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> x\<alpha> \<prec> P'; xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>M xvec yvec y N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> M\<lparr>\<nu>*(xvec @ yvec)\<rparr>\<langle>([(x, y)] \<bullet> N)\<rangle> \<prec> [(x, y)] \<bullet> P'; y \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> y; y \<sharp> xvec; y \<sharp> yvec; y \<sharp> M; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; y \<sharp> \<Psi>; yvec \<sharp>* \<Psi>; xvec \<sharp>* P; y \<sharp> P; yvec \<sharp>* P; xvec \<sharp>* M; y \<sharp> M; yvec \<sharp>* M; xvec \<sharp>* yvec; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; \<lparr>\<nu>x\<rparr>P = Pa \<parallel> Q; x\<alpha> \<prec> xP' = \<tau> \<prec> \<lparr>\<nu>*xvec\<rparr>P' \<parallel> Q'; \<Psi> \<otimes> \<Psi>\<^sub>Q \<rhd> Pa \<longmapsto> M\<lparr>N\<rparr> \<prec> P'; extractFrame Pa = \<langle>A\<^sub>P, \<Psi>\<^sub>P\<rangle>; distinct A\<^sub>P; \<Psi> \<otimes> \<Psi>\<^sub>P \<rhd> Q \<longmapsto> K\<lparr>\<nu>*xvec\<rparr>\<langle>N\<rangle> \<prec> Q'; extractFrame Q = \<langle>A\<^sub>Q, \<Psi>\<^sub>Q\<rangle>; distinct A\<^sub>Q; \<Psi> \<otimes> \<Psi>\<^sub>P \<otimes> \<Psi>\<^sub>Q \<turnstile> M \<leftrightarrow> K; A\<^sub>P \<sharp>* \<Psi>; A\<^sub>P \<sharp>* \<Psi>\<^sub>Q; A\<^sub>P \<sharp>* Pa; A\<^sub>P \<sharp>* M; A\<^sub>P \<sharp>* N; A\<^sub>P \<sharp>* P'; A\<^sub>P \<sharp>* Q; A\<^sub>P \<sharp>* Q'; A\<^sub>P \<sharp>* A\<^sub>Q; A\<^sub>P \<sharp>* xvec; A\<^sub>Q \<sharp>* \<Psi>; A\<^sub>Q \<sharp>* \<Psi>\<^sub>P; A\<^sub>Q \<sharp>* Pa; A\<^sub>Q \<sharp>* K; A\<^sub>Q \<sharp>* N; A\<^sub>Q \<sharp>* P'; A\<^sub>Q \<sharp>* Q; A\<^sub>Q \<sharp>* Q'; A\<^sub>Q \<sharp>* xvec; xvec \<sharp>* \<Psi>; xvec \<sharp>* \<Psi>\<^sub>P; xvec \<sharp>* \<Psi>\<^sub>Q; xvec \<sharp>* Pa; xvec \<sharp>* M; xvec \<sharp>* Q; xvec \<sharp>* K; A\<^sub>P \<sharp>* ?C11; A\<^sub>Q \<sharp>* ?C11; xvec \<sharp>* ?C11; distinct xvec\<rbrakk> \<Longrightarrow> Prop
 7. \<And>\<Psi>\<^sub>Q Pa M xvec N P' A\<^sub>P \<Psi>\<^sub>P Q K Q' A\<^sub>Q. \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* P; bn x\<alpha> \<sharp>* subject x\<alpha>; x \<sharp> \<Psi>; x \<sharp> x\<alpha>; x \<sharp> xP'; distinct (bn x\<alpha>); \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> x\<alpha> \<prec> P'; xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>M xvec yvec y N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> M\<lparr>\<nu>*(xvec @ yvec)\<rparr>\<langle>([(x, y)] \<bullet> N)\<rangle> \<prec> [(x, y)] \<bullet> P'; y \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> y; y \<sharp> xvec; y \<sharp> yvec; y \<sharp> M; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; y \<sharp> \<Psi>; yvec \<sharp>* \<Psi>; xvec \<sharp>* P; y \<sharp> P; yvec \<sharp>* P; xvec \<sharp>* M; y \<sharp> M; yvec \<sharp>* M; xvec \<sharp>* yvec; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; \<lparr>\<nu>x\<rparr>P = Pa \<parallel> Q; x\<alpha> \<prec> xP' = \<tau> \<prec> \<lparr>\<nu>*xvec\<rparr>P' \<parallel> Q'; \<Psi> \<otimes> \<Psi>\<^sub>Q \<rhd> Pa \<longmapsto> M\<lparr>\<nu>*xvec\<rparr>\<langle>N\<rangle> \<prec> P'; extractFrame Pa = \<langle>A\<^sub>P, \<Psi>\<^sub>P\<rangle>; distinct A\<^sub>P; \<Psi> \<otimes> \<Psi>\<^sub>P \<rhd> Q \<longmapsto> K\<lparr>N\<rparr> \<prec> Q'; extractFrame Q = \<langle>A\<^sub>Q, \<Psi>\<^sub>Q\<rangle>; distinct A\<^sub>Q; \<Psi> \<otimes> \<Psi>\<^sub>P \<otimes> \<Psi>\<^sub>Q \<turnstile> M \<leftrightarrow> K; A\<^sub>P \<sharp>* \<Psi>; A\<^sub>P \<sharp>* \<Psi>\<^sub>Q; A\<^sub>P \<sharp>* Pa; A\<^sub>P \<sharp>* M; A\<^sub>P \<sharp>* N; A\<^sub>P \<sharp>* P'; A\<^sub>P \<sharp>* Q; A\<^sub>P \<sharp>* Q'; A\<^sub>P \<sharp>* A\<^sub>Q; A\<^sub>P \<sharp>* xvec; A\<^sub>Q \<sharp>* \<Psi>; A\<^sub>Q \<sharp>* \<Psi>\<^sub>P; A\<^sub>Q \<sharp>* Pa; A\<^sub>Q \<sharp>* K; A\<^sub>Q \<sharp>* N; A\<^sub>Q \<sharp>* P'; A\<^sub>Q \<sharp>* Q; A\<^sub>Q \<sharp>* Q'; A\<^sub>Q \<sharp>* xvec; xvec \<sharp>* \<Psi>; xvec \<sharp>* \<Psi>\<^sub>P; xvec \<sharp>* \<Psi>\<^sub>Q; xvec \<sharp>* Pa; xvec \<sharp>* M; xvec \<sharp>* Q; xvec \<sharp>* K; A\<^sub>P \<sharp>* ?C11; A\<^sub>Q \<sharp>* ?C11; xvec \<sharp>* ?C11; distinct xvec\<rbrakk> \<Longrightarrow> Prop
 8. \<And>Pa M xvec y yvec N P'. \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* P; bn x\<alpha> \<sharp>* subject x\<alpha>; x \<sharp> \<Psi>; x \<sharp> x\<alpha>; x \<sharp> xP'; distinct (bn x\<alpha>); \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> x\<alpha> \<prec> P'; xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>M xvec yvec y N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> M\<lparr>\<nu>*(xvec @ yvec)\<rparr>\<langle>([(x, y)] \<bullet> N)\<rangle> \<prec> [(x, y)] \<bullet> P'; y \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> y; y \<sharp> xvec; y \<sharp> yvec; y \<sharp> M; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; y \<sharp> \<Psi>; yvec \<sharp>* \<Psi>; xvec \<sharp>* P; y \<sharp> P; yvec \<sharp>* P; xvec \<sharp>* M; y \<sharp> M; yvec \<sharp>* M; xvec \<sharp>* yvec; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* \<lparr>\<nu>x\<rparr>P; bn x\<alpha> \<sharp>* (x\<alpha> \<prec> xP'); x \<sharp> \<Psi>; x \<sharp> \<lparr>\<nu>x\<rparr>P; x \<sharp> x\<alpha> \<prec> xP'; x \<sharp> bn x\<alpha>\<rbrakk> \<Longrightarrow> \<lparr>\<nu>x\<rparr>P = \<lparr>\<nu>x\<rparr>Pa \<and> x\<alpha> \<prec> xP' = M\<lparr>\<nu>*(xvec @ x # yvec)\<rparr>\<langle>N\<rangle> \<prec> P' \<and> bn x\<alpha> = xvec @ y # yvec \<and> \<Psi> \<rhd> Pa \<longmapsto> M\<lparr>\<nu>*(xvec @ yvec)\<rparr>\<langle>N\<rangle> \<prec> P' \<and> x \<in> supp N \<and> x \<sharp> xvec \<and> x \<sharp> yvec \<and> distinct xvec \<and> distinct yvec \<and> xvec \<sharp>* \<Psi> \<and> xvec \<sharp>* Pa \<and> xvec \<sharp>* M \<and> xvec \<sharp>* yvec \<and> yvec \<sharp>* \<Psi> \<and> yvec \<sharp>* Pa \<and> yvec \<sharp>* M\<rbrakk> \<Longrightarrow> Prop
 9. \<And>Pa \<alpha> P'. \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* P; bn x\<alpha> \<sharp>* subject x\<alpha>; x \<sharp> \<Psi>; x \<sharp> x\<alpha>; x \<sharp> xP'; distinct (bn x\<alpha>); \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> x\<alpha> \<prec> P'; xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>M xvec yvec y N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> M\<lparr>\<nu>*(xvec @ yvec)\<rparr>\<langle>([(x, y)] \<bullet> N)\<rangle> \<prec> [(x, y)] \<bullet> P'; y \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> y; y \<sharp> xvec; y \<sharp> yvec; y \<sharp> M; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; y \<sharp> \<Psi>; yvec \<sharp>* \<Psi>; xvec \<sharp>* P; y \<sharp> P; yvec \<sharp>* P; xvec \<sharp>* M; y \<sharp> M; yvec \<sharp>* M; xvec \<sharp>* yvec; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* \<lparr>\<nu>x\<rparr>P; bn x\<alpha> \<sharp>* (x\<alpha> \<prec> xP'); x \<sharp> \<Psi>; x \<sharp> \<lparr>\<nu>x\<rparr>P; x \<sharp> x\<alpha> \<prec> xP'; x \<sharp> bn x\<alpha>\<rbrakk> \<Longrightarrow> \<lparr>\<nu>x\<rparr>P = \<lparr>\<nu>x\<rparr>Pa \<and> x\<alpha> \<prec> xP' = \<alpha> \<prec> \<lparr>\<nu>x\<rparr>P' \<and> bn x\<alpha> = bn \<alpha> \<and> \<Psi> \<rhd> Pa \<longmapsto> \<alpha> \<prec> P' \<and> x \<sharp> \<Psi> \<and> x \<sharp> \<alpha> \<and> bn \<alpha> \<sharp>* subject \<alpha> \<and> distinct (bn \<alpha>)\<rbrakk> \<Longrightarrow> Prop
 10. \<And>Pa. \<lbrakk>bn x\<alpha> \<sharp>* \<Psi>; bn x\<alpha> \<sharp>* P; bn x\<alpha> \<sharp>* subject x\<alpha>; x \<sharp> \<Psi>; x \<sharp> x\<alpha>; x \<sharp> xP'; distinct (bn x\<alpha>); \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> x\<alpha> \<prec> P'; xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>M xvec yvec y N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> M\<lparr>\<nu>*(xvec @ yvec)\<rparr>\<langle>([(x, y)] \<bullet> N)\<rangle> \<prec> [(x, y)] \<bullet> P'; y \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> y; y \<sharp> xvec; y \<sharp> yvec; y \<sharp> M; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; y \<sharp> \<Psi>; yvec \<sharp>* \<Psi>; xvec \<sharp>* P; y \<sharp> P; yvec \<sharp>* P; xvec \<sharp>* M; y \<sharp> M; yvec \<sharp>* M; xvec \<sharp>* yvec; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; \<lparr>\<nu>x\<rparr>P = !Pa; \<Psi> \<rhd> Pa \<parallel> !Pa \<longmapsto> x\<alpha> \<prec> xP'; guarded Pa\<rbrakk> \<Longrightarrow> Prop
[PROOF STEP]
apply(auto simp add: psi.inject alpha abs_fresh residualInject boundOutputApp boundOutput.inject eqvts)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>M xvec y yvec Na. \<lbrakk>y \<sharp> \<Psi>; y \<sharp> P; x \<sharp> \<Psi>; x \<sharp> xP'; \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> ROut M (\<lparr>\<nu>*xvec\<rparr>\<lparr>\<nu>y\<rparr>(\<lparr>\<nu>*yvec\<rparr>Na \<prec>' P')); xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>Ma xveca yveca ya N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> ROut Ma (\<lparr>\<nu>*xveca\<rparr>\<lparr>\<nu>*yveca\<rparr>([(x, ya)] \<bullet> N) \<prec>' ([(x, ya)] \<bullet> P')); ya \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> ya; ya \<sharp> xveca; ya \<sharp> yveca; distinct xveca; distinct yveca; xveca \<sharp>* \<Psi>; ya \<sharp> \<Psi>; yveca \<sharp>* \<Psi>; xveca \<sharp>* P; ya \<sharp> P; yveca \<sharp>* P; xveca \<sharp>* Ma; ya \<sharp> Ma; yveca \<sharp>* Ma; xveca \<sharp>* yveca; M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>Na\<rangle> = Ma\<lparr>\<nu>*(xveca @ ya # yveca)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; x \<sharp> M; y \<sharp> yvec; y \<sharp> xvec; y \<sharp> M; x \<noteq> y; x \<sharp> Na; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>Na\<rangle>; \<Psi> \<rhd> P \<longmapsto> ROut M (\<lparr>\<nu>*xvec\<rparr>\<lparr>\<nu>*yvec\<rparr>([(x, y)] \<bullet> Na) \<prec>' ([(x, y)] \<bullet> xP')); x \<in> supp ([(x, y)] \<bullet> Na); x \<sharp> xvec; x \<sharp> yvec; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; xvec \<sharp>* P; xvec \<sharp>* M; xvec \<sharp>* yvec; yvec \<sharp>* \<Psi>; yvec \<sharp>* P; yvec \<sharp>* M\<rbrakk> \<Longrightarrow> Prop
[PROOF STEP]
apply(subgoal_tac "y \<in> supp Na")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>M xvec y yvec Na. \<lbrakk>y \<sharp> \<Psi>; y \<sharp> P; x \<sharp> \<Psi>; x \<sharp> xP'; \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> ROut M (\<lparr>\<nu>*xvec\<rparr>\<lparr>\<nu>y\<rparr>(\<lparr>\<nu>*yvec\<rparr>Na \<prec>' P')); xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>Ma xveca yveca ya N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> ROut Ma (\<lparr>\<nu>*xveca\<rparr>\<lparr>\<nu>*yveca\<rparr>([(x, ya)] \<bullet> N) \<prec>' ([(x, ya)] \<bullet> P')); ya \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> ya; ya \<sharp> xveca; ya \<sharp> yveca; distinct xveca; distinct yveca; xveca \<sharp>* \<Psi>; ya \<sharp> \<Psi>; yveca \<sharp>* \<Psi>; xveca \<sharp>* P; ya \<sharp> P; yveca \<sharp>* P; xveca \<sharp>* Ma; ya \<sharp> Ma; yveca \<sharp>* Ma; xveca \<sharp>* yveca; M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>Na\<rangle> = Ma\<lparr>\<nu>*(xveca @ ya # yveca)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; x \<sharp> M; y \<sharp> yvec; y \<sharp> xvec; y \<sharp> M; x \<noteq> y; x \<sharp> Na; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>Na\<rangle>; \<Psi> \<rhd> P \<longmapsto> ROut M (\<lparr>\<nu>*xvec\<rparr>\<lparr>\<nu>*yvec\<rparr>([(x, y)] \<bullet> Na) \<prec>' ([(x, y)] \<bullet> xP')); x \<in> supp ([(x, y)] \<bullet> Na); x \<sharp> xvec; x \<sharp> yvec; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; xvec \<sharp>* P; xvec \<sharp>* M; xvec \<sharp>* yvec; yvec \<sharp>* \<Psi>; yvec \<sharp>* P; yvec \<sharp>* M; y \<in> supp Na\<rbrakk> \<Longrightarrow> Prop
 2. \<And>M xvec y yvec Na. \<lbrakk>y \<sharp> \<Psi>; y \<sharp> P; x \<sharp> \<Psi>; x \<sharp> xP'; \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> ROut M (\<lparr>\<nu>*xvec\<rparr>\<lparr>\<nu>y\<rparr>(\<lparr>\<nu>*yvec\<rparr>Na \<prec>' P')); xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>Ma xveca yveca ya N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> ROut Ma (\<lparr>\<nu>*xveca\<rparr>\<lparr>\<nu>*yveca\<rparr>([(x, ya)] \<bullet> N) \<prec>' ([(x, ya)] \<bullet> P')); ya \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> ya; ya \<sharp> xveca; ya \<sharp> yveca; distinct xveca; distinct yveca; xveca \<sharp>* \<Psi>; ya \<sharp> \<Psi>; yveca \<sharp>* \<Psi>; xveca \<sharp>* P; ya \<sharp> P; yveca \<sharp>* P; xveca \<sharp>* Ma; ya \<sharp> Ma; yveca \<sharp>* Ma; xveca \<sharp>* yveca; M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>Na\<rangle> = Ma\<lparr>\<nu>*(xveca @ ya # yveca)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; x \<sharp> M; y \<sharp> yvec; y \<sharp> xvec; y \<sharp> M; x \<noteq> y; x \<sharp> Na; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>Na\<rangle>; \<Psi> \<rhd> P \<longmapsto> ROut M (\<lparr>\<nu>*xvec\<rparr>\<lparr>\<nu>*yvec\<rparr>([(x, y)] \<bullet> Na) \<prec>' ([(x, y)] \<bullet> xP')); x \<in> supp ([(x, y)] \<bullet> Na); x \<sharp> xvec; x \<sharp> yvec; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; xvec \<sharp>* P; xvec \<sharp>* M; xvec \<sharp>* yvec; yvec \<sharp>* \<Psi>; yvec \<sharp>* P; yvec \<sharp>* M\<rbrakk> \<Longrightarrow> y \<in> supp Na
[PROOF STEP]
apply(auto simp add: residualInject boundOutputApp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>M xvec y yvec Na. \<lbrakk>y \<sharp> \<Psi>; y \<sharp> P; x \<sharp> \<Psi>; x \<sharp> xP'; \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> ROut M (\<lparr>\<nu>*xvec\<rparr>\<lparr>\<nu>y\<rparr>(\<lparr>\<nu>*yvec\<rparr>Na \<prec>' P')); xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>Ma xveca yveca ya N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> ROut Ma (\<lparr>\<nu>*xveca\<rparr>\<lparr>\<nu>*yveca\<rparr>([(x, ya)] \<bullet> N) \<prec>' ([(x, ya)] \<bullet> P')); ya \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> ya; ya \<sharp> xveca; ya \<sharp> yveca; distinct xveca; distinct yveca; xveca \<sharp>* \<Psi>; ya \<sharp> \<Psi>; yveca \<sharp>* \<Psi>; xveca \<sharp>* P; ya \<sharp> P; yveca \<sharp>* P; xveca \<sharp>* Ma; ya \<sharp> Ma; yveca \<sharp>* Ma; xveca \<sharp>* yveca; M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>Na\<rangle> = Ma\<lparr>\<nu>*(xveca @ ya # yveca)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; x \<sharp> M; y \<sharp> yvec; y \<sharp> xvec; y \<sharp> M; x \<noteq> y; x \<sharp> Na; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>Na\<rangle>; \<Psi> \<rhd> P \<longmapsto> ROut M (\<lparr>\<nu>*xvec\<rparr>\<lparr>\<nu>*yvec\<rparr>([(x, y)] \<bullet> Na) \<prec>' ([(x, y)] \<bullet> xP')); x \<in> supp ([(x, y)] \<bullet> Na); x \<sharp> xvec; x \<sharp> yvec; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; xvec \<sharp>* P; xvec \<sharp>* M; xvec \<sharp>* yvec; yvec \<sharp>* \<Psi>; yvec \<sharp>* P; yvec \<sharp>* M\<rbrakk> \<Longrightarrow> y \<in> supp Na
[PROOF STEP]
apply(drule_tac pi="[(x, y)]" in pt_set_bij2[OF pt_name_inst, OF at_name_inst])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>M xvec y yvec Na. \<lbrakk>y \<sharp> \<Psi>; y \<sharp> P; x \<sharp> \<Psi>; x \<sharp> xP'; \<And>P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> ROut M (\<lparr>\<nu>*xvec\<rparr>\<lparr>\<nu>y\<rparr>(\<lparr>\<nu>*yvec\<rparr>Na \<prec>' P')); xP' = \<lparr>\<nu>x\<rparr>P'\<rbrakk> \<Longrightarrow> Prop; \<And>Ma xveca yveca ya N P'. \<lbrakk>\<Psi> \<rhd> P \<longmapsto> ROut Ma (\<lparr>\<nu>*xveca\<rparr>\<lparr>\<nu>*yveca\<rparr>([(x, ya)] \<bullet> N) \<prec>' ([(x, ya)] \<bullet> P')); ya \<in> supp N; x \<sharp> N; x \<sharp> P'; x \<noteq> ya; ya \<sharp> xveca; ya \<sharp> yveca; distinct xveca; distinct yveca; xveca \<sharp>* \<Psi>; ya \<sharp> \<Psi>; yveca \<sharp>* \<Psi>; xveca \<sharp>* P; ya \<sharp> P; yveca \<sharp>* P; xveca \<sharp>* Ma; ya \<sharp> Ma; yveca \<sharp>* Ma; xveca \<sharp>* yveca; M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>Na\<rangle> = Ma\<lparr>\<nu>*(xveca @ ya # yveca)\<rparr>\<langle>N\<rangle>; xP' = P'\<rbrakk> \<Longrightarrow> Prop; x \<sharp> M; y \<sharp> yvec; y \<sharp> xvec; y \<sharp> M; x \<noteq> y; x \<sharp> Na; x\<alpha> = M\<lparr>\<nu>*(xvec @ y # yvec)\<rparr>\<langle>Na\<rangle>; \<Psi> \<rhd> P \<longmapsto> ROut M (\<lparr>\<nu>*xvec\<rparr>\<lparr>\<nu>*yvec\<rparr>([(x, y)] \<bullet> Na) \<prec>' ([(x, y)] \<bullet> xP')); x \<sharp> xvec; x \<sharp> yvec; distinct xvec; distinct yvec; xvec \<sharp>* \<Psi>; xvec \<sharp>* P; xvec \<sharp>* M; xvec \<sharp>* yvec; yvec \<sharp>* \<Psi>; yvec \<sharp>* P; yvec \<sharp>* M; [(x, y)] \<bullet> x \<in> [(x, y)] \<bullet> supp ([(x, y)] \<bullet> Na)\<rbrakk> \<Longrightarrow> y \<in> supp Na
[PROOF STEP]
by(simp add: calc_atm eqvts)
[PROOF STATE]
proof (state)
this:
Prop

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma class_add_sees_method_rev_Obj:
 "\<lbrakk> class_add P (C, cdec) \<turnstile> Object sees M\<^sub>0, b : Ts\<rightarrow>T = m in D; C \<noteq> Object \<rbrakk>
  \<Longrightarrow> P \<turnstile> Object sees M\<^sub>0, b : Ts\<rightarrow>T = m in D"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>class_add P (C, cdec) \<turnstile> Object sees M\<^sub>0, b :  Ts\<rightarrow>T = m in D; C \<noteq> Object\<rbrakk> \<Longrightarrow> P \<turnstile> Object sees M\<^sub>0, b :  Ts\<rightarrow>T = m in D
[PROOF STEP]
by(auto simp: Method_def dest!: class_add_sees_methods_rev_Obj[where P=P])


[STATEMENT]
lemma dom_mdeg_le1_aux:
  assumes "max_deg t \<le> 1"
      and "is_subtree (Node v {|(t2, e2)|}) t"
      and "rank (rev (Dtree.root t2)) < rank (rev v)"
      and "t1 \<in> fst ` fset (sucs t)"
      and "x \<in> dverts t1"
    shows "\<exists>r\<in>set (Dtree.root t) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>r\<in>set (dtree.root t) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
using assms ranked_dtree_with_orig_axioms
[PROOF STATE]
proof (prove)
using this:
max_deg t \<le> 1
is_subtree (Node v {|(t2, e2)|}) t
rank (rev (dtree.root t2)) < rank (rev v)
t1 \<in> fst ` fset (sucs t)
x \<in> dverts t1
ranked_dtree_with_orig t rank cost cmp T root

goal (1 subgoal):
 1. \<exists>r\<in>set (dtree.root t) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
proof(induction t arbitrary: t1)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x1a x2a t1. \<lbrakk>\<And>x2aa x2aaa t1. \<lbrakk>x2aa \<in> fset x2a; x2aaa \<in> Basic_BNFs.fsts x2aa; max_deg x2aaa \<le> 1; is_subtree (Node v {|(t2, e2)|}) x2aaa; rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs x2aaa); x \<in> dverts t1; ranked_dtree_with_orig x2aaa rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root x2aaa) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x; max_deg (Node x1a x2a) \<le> 1; is_subtree (Node v {|(t2, e2)|}) (Node x1a x2a); rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs (Node x1a x2a)); x \<in> dverts t1; ranked_dtree_with_orig (Node x1a x2a) rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node x1a x2a)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
case (Node r xs)
[PROOF STATE]
proof (state)
this:
\<lbrakk>?x2aa2 \<in> fset xs; ?x2aaa2 \<in> Basic_BNFs.fsts ?x2aa2; max_deg ?x2aaa2 \<le> 1; is_subtree (Node v {|(t2, e2)|}) ?x2aaa2; rank (rev (dtree.root t2)) < rank (rev v); ?t1.2 \<in> fst ` fset (sucs ?x2aaa2); x \<in> dverts ?t1.2; ranked_dtree_with_orig ?x2aaa2 rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root ?x2aaa2) \<union> path_lverts ?t1.2 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
max_deg (Node r xs) \<le> 1
is_subtree (Node v {|(t2, e2)|}) (Node r xs)
rank (rev (dtree.root t2)) < rank (rev v)
t1 \<in> fst ` fset (sucs (Node r xs))
x \<in> dverts t1
ranked_dtree_with_orig (Node r xs) rank cost cmp T root

goal (1 subgoal):
 1. \<And>x1a x2a t1. \<lbrakk>\<And>x2aa x2aaa t1. \<lbrakk>x2aa \<in> fset x2a; x2aaa \<in> Basic_BNFs.fsts x2aa; max_deg x2aaa \<le> 1; is_subtree (Node v {|(t2, e2)|}) x2aaa; rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs x2aaa); x \<in> dverts t1; ranked_dtree_with_orig x2aaa rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root x2aaa) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x; max_deg (Node x1a x2a) \<le> 1; is_subtree (Node v {|(t2, e2)|}) (Node x1a x2a); rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs (Node x1a x2a)); x \<in> dverts t1; ranked_dtree_with_orig (Node x1a x2a) rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node x1a x2a)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?x2aa2 \<in> fset xs; ?x2aaa2 \<in> Basic_BNFs.fsts ?x2aa2; max_deg ?x2aaa2 \<le> 1; is_subtree (Node v {|(t2, e2)|}) ?x2aaa2; rank (rev (dtree.root t2)) < rank (rev v); ?t1.2 \<in> fst ` fset (sucs ?x2aaa2); x \<in> dverts ?t1.2; ranked_dtree_with_orig ?x2aaa2 rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root ?x2aaa2) \<union> path_lverts ?t1.2 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
max_deg (Node r xs) \<le> 1
is_subtree (Node v {|(t2, e2)|}) (Node r xs)
rank (rev (dtree.root t2)) < rank (rev v)
t1 \<in> fst ` fset (sucs (Node r xs))
x \<in> dverts t1
ranked_dtree_with_orig (Node r xs) rank cost cmp T root
[PROOF STEP]
interpret R: ranked_dtree_with_orig "Node r xs"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?x2aa2 \<in> fset xs; ?x2aaa2 \<in> Basic_BNFs.fsts ?x2aa2; max_deg ?x2aaa2 \<le> 1; is_subtree (Node v {|(t2, e2)|}) ?x2aaa2; rank (rev (dtree.root t2)) < rank (rev v); ?t1.2 \<in> fst ` fset (sucs ?x2aaa2); x \<in> dverts ?t1.2; ranked_dtree_with_orig ?x2aaa2 rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root ?x2aaa2) \<union> path_lverts ?t1.2 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
max_deg (Node r xs) \<le> 1
is_subtree (Node v {|(t2, e2)|}) (Node r xs)
rank (rev (dtree.root t2)) < rank (rev v)
t1 \<in> fst ` fset (sucs (Node r xs))
x \<in> dverts t1
ranked_dtree_with_orig (Node r xs) rank cost cmp T root

goal (1 subgoal):
 1. ranked_dtree_with_orig (Node r xs) rank cost cmp T root
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x1a x2a t1. \<lbrakk>\<And>x2aa x2aaa t1. \<lbrakk>x2aa \<in> fset x2a; x2aaa \<in> Basic_BNFs.fsts x2aa; max_deg x2aaa \<le> 1; is_subtree (Node v {|(t2, e2)|}) x2aaa; rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs x2aaa); x \<in> dverts t1; ranked_dtree_with_orig x2aaa rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root x2aaa) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x; max_deg (Node x1a x2a) \<le> 1; is_subtree (Node v {|(t2, e2)|}) (Node x1a x2a); rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs (Node x1a x2a)); x \<in> dverts t1; ranked_dtree_with_orig (Node x1a x2a) rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node x1a x2a)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
interpret T1: ranked_dtree_with_orig t1
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ranked_dtree_with_orig t1 rank cost cmp T root
[PROOF STEP]
using Node.prems(4) R.ranked_dtree_orig_rec
[PROOF STATE]
proof (prove)
using this:
t1 \<in> fst ` fset (sucs (Node r xs))
\<lbrakk>Node ?r ?xs = Node r xs; (?x, ?e) \<in> fset ?xs\<rbrakk> \<Longrightarrow> ranked_dtree_with_orig ?x rank cost cmp T root

goal (1 subgoal):
 1. ranked_dtree_with_orig t1 rank cost cmp T root
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x1a x2a t1. \<lbrakk>\<And>x2aa x2aaa t1. \<lbrakk>x2aa \<in> fset x2a; x2aaa \<in> Basic_BNFs.fsts x2aa; max_deg x2aaa \<le> 1; is_subtree (Node v {|(t2, e2)|}) x2aaa; rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs x2aaa); x \<in> dverts t1; ranked_dtree_with_orig x2aaa rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root x2aaa) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x; max_deg (Node x1a x2a) \<le> 1; is_subtree (Node v {|(t2, e2)|}) (Node x1a x2a); rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs (Node x1a x2a)); x \<in> dverts t1; ranked_dtree_with_orig (Node x1a x2a) rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node x1a x2a)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
have "fcard xs > 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < fcard xs
[PROOF STEP]
using Node.prems(4) fcard_seteq
[PROOF STATE]
proof (prove)
using this:
t1 \<in> fst ` fset (sucs (Node r xs))
\<lbrakk>?A |\<subseteq>| ?B; fcard ?B \<le> fcard ?A\<rbrakk> \<Longrightarrow> ?A = ?B

goal (1 subgoal):
 1. 0 < fcard xs
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
0 < fcard xs

goal (1 subgoal):
 1. \<And>x1a x2a t1. \<lbrakk>\<And>x2aa x2aaa t1. \<lbrakk>x2aa \<in> fset x2a; x2aaa \<in> Basic_BNFs.fsts x2aa; max_deg x2aaa \<le> 1; is_subtree (Node v {|(t2, e2)|}) x2aaa; rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs x2aaa); x \<in> dverts t1; ranked_dtree_with_orig x2aaa rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root x2aaa) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x; max_deg (Node x1a x2a) \<le> 1; is_subtree (Node v {|(t2, e2)|}) (Node x1a x2a); rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs (Node x1a x2a)); x \<in> dverts t1; ranked_dtree_with_orig (Node x1a x2a) rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node x1a x2a)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
0 < fcard xs
[PROOF STEP]
have "fcard xs = 1"
[PROOF STATE]
proof (prove)
using this:
0 < fcard xs

goal (1 subgoal):
 1. fcard xs = 1
[PROOF STEP]
using mdeg_ge_fcard[of xs] Node.prems(1)
[PROOF STATE]
proof (prove)
using this:
0 < fcard xs
fcard xs \<le> max_deg (Node ?r xs)
max_deg (Node r xs) \<le> 1

goal (1 subgoal):
 1. fcard xs = 1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
fcard xs = 1

goal (1 subgoal):
 1. \<And>x1a x2a t1. \<lbrakk>\<And>x2aa x2aaa t1. \<lbrakk>x2aa \<in> fset x2a; x2aaa \<in> Basic_BNFs.fsts x2aa; max_deg x2aaa \<le> 1; is_subtree (Node v {|(t2, e2)|}) x2aaa; rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs x2aaa); x \<in> dverts t1; ranked_dtree_with_orig x2aaa rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root x2aaa) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x; max_deg (Node x1a x2a) \<le> 1; is_subtree (Node v {|(t2, e2)|}) (Node x1a x2a); rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs (Node x1a x2a)); x \<in> dverts t1; ranked_dtree_with_orig (Node x1a x2a) rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node x1a x2a)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fcard xs = 1
[PROOF STEP]
obtain e1 where e1_def: "xs = {|(t1,e1)|}"
[PROOF STATE]
proof (prove)
using this:
fcard xs = 1

goal (1 subgoal):
 1. (\<And>e1. xs = {|(t1, e1)|} \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using Node.prems(4) fcard_single_1_iff[of xs]
[PROOF STATE]
proof (prove)
using this:
fcard xs = 1
t1 \<in> fst ` fset (sucs (Node r xs))
(fcard xs = 1) = (\<exists>x. xs = {|x|})

goal (1 subgoal):
 1. (\<And>e1. xs = {|(t1, e1)|} \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
xs = {|(t1, e1)|}

goal (1 subgoal):
 1. \<And>x1a x2a t1. \<lbrakk>\<And>x2aa x2aaa t1. \<lbrakk>x2aa \<in> fset x2a; x2aaa \<in> Basic_BNFs.fsts x2aa; max_deg x2aaa \<le> 1; is_subtree (Node v {|(t2, e2)|}) x2aaa; rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs x2aaa); x \<in> dverts t1; ranked_dtree_with_orig x2aaa rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root x2aaa) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x; max_deg (Node x1a x2a) \<le> 1; is_subtree (Node v {|(t2, e2)|}) (Node x1a x2a); rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs (Node x1a x2a)); x \<in> dverts t1; ranked_dtree_with_orig (Node x1a x2a) rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node x1a x2a)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
have mdeg1: "max_deg (Node r xs) = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. max_deg (Node r xs) = 1
[PROOF STEP]
using Node.prems(1) mdeg_ge_fcard[of xs] \<open>fcard xs = 1\<close>
[PROOF STATE]
proof (prove)
using this:
max_deg (Node r xs) \<le> 1
fcard xs \<le> max_deg (Node ?r xs)
fcard xs = 1

goal (1 subgoal):
 1. max_deg (Node r xs) = 1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
max_deg (Node r xs) = 1

goal (1 subgoal):
 1. \<And>x1a x2a t1. \<lbrakk>\<And>x2aa x2aaa t1. \<lbrakk>x2aa \<in> fset x2a; x2aaa \<in> Basic_BNFs.fsts x2aa; max_deg x2aaa \<le> 1; is_subtree (Node v {|(t2, e2)|}) x2aaa; rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs x2aaa); x \<in> dverts t1; ranked_dtree_with_orig x2aaa rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root x2aaa) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x; max_deg (Node x1a x2a) \<le> 1; is_subtree (Node v {|(t2, e2)|}) (Node x1a x2a); rank (rev (dtree.root t2)) < rank (rev v); t1 \<in> fst ` fset (sucs (Node x1a x2a)); x \<in> dverts t1; ranked_dtree_with_orig (Node x1a x2a) rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node x1a x2a)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
proof(cases "Node v {|(t2, e2)|} = Node r xs")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. Node v {|(t2, e2)|} = Node r xs \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
 2. Node v {|(t2, e2)|} \<noteq> Node r xs \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
Node v {|(t2, e2)|} = Node r xs

goal (2 subgoals):
 1. Node v {|(t2, e2)|} = Node r xs \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
 2. Node v {|(t2, e2)|} \<noteq> Node r xs \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Node v {|(t2, e2)|} = Node r xs
[PROOF STEP]
have "dom_children (Node r xs) T"
[PROOF STATE]
proof (prove)
using this:
Node v {|(t2, e2)|} = Node r xs

goal (1 subgoal):
 1. dom_children (Node r xs) T
[PROOF STEP]
using mdeg1 Node.prems(2,3) R.dom_contr_subtree
[PROOF STATE]
proof (prove)
using this:
Node v {|(t2, e2)|} = Node r xs
max_deg (Node r xs) = 1
is_subtree (Node v {|(t2, e2)|}) (Node r xs)
rank (rev (dtree.root t2)) < rank (rev v)
\<lbrakk>is_subtree ?tn (Node r xs); is_subtree (Node ?r {|(?t1.0, ?e1.0)|}) ?tn; rank (rev (dtree.root ?t1.0)) < rank (rev ?r); max_deg (Node ?r {|(?t1.0, ?e1.0)|}) = 1\<rbrakk> \<Longrightarrow> dom_children (Node ?r {|(?t1.0, ?e1.0)|}) T

goal (1 subgoal):
 1. dom_children (Node r xs) T
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
dom_children (Node r xs) T

goal (2 subgoals):
 1. Node v {|(t2, e2)|} = Node r xs \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
 2. Node v {|(t2, e2)|} \<noteq> Node r xs \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
dom_children (Node r xs) T
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
dom_children (Node r xs) T

goal (1 subgoal):
 1. \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
unfolding dom_children_def
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>fst ` fset (sucs (Node r xs)). \<forall>x\<in>dverts t. \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x

goal (1 subgoal):
 1. \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
using e1_def Node.prems(5)
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>fst ` fset (sucs (Node r xs)). \<forall>x\<in>dverts t. \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
xs = {|(t1, e1)|}
x \<in> dverts t1

goal (1 subgoal):
 1. \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x

goal (1 subgoal):
 1. Node v {|(t2, e2)|} \<noteq> Node r xs \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Node v {|(t2, e2)|} \<noteq> Node r xs \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
Node v {|(t2, e2)|} \<noteq> Node r xs

goal (1 subgoal):
 1. Node v {|(t2, e2)|} \<noteq> Node r xs \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Node v {|(t2, e2)|} \<noteq> Node r xs
[PROOF STEP]
have sub_t1: "is_subtree (Node v {|(t2, e2)|}) t1"
[PROOF STATE]
proof (prove)
using this:
Node v {|(t2, e2)|} \<noteq> Node r xs

goal (1 subgoal):
 1. is_subtree (Node v {|(t2, e2)|}) t1
[PROOF STEP]
using Node.prems(2) e1_def is_subtree.simps[of "Node v {|(t2, e2)|}"]
[PROOF STATE]
proof (prove)
using this:
Node v {|(t2, e2)|} \<noteq> Node r xs
is_subtree (Node v {|(t2, e2)|}) (Node r xs)
xs = {|(t1, e1)|}
is_subtree (Node v {|(t2, e2)|}) (Node ?r ?xs) = (Node v {|(t2, e2)|} = Node ?r ?xs \<or> (\<exists>(y, e)\<in>fset ?xs. is_subtree (Node v {|(t2, e2)|}) y))

goal (1 subgoal):
 1. is_subtree (Node v {|(t2, e2)|}) t1
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
is_subtree (Node v {|(t2, e2)|}) t1

goal (1 subgoal):
 1. Node v {|(t2, e2)|} \<noteq> Node r xs \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
proof(cases "x = Dtree.root t1")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. x = dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
 2. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
x = dtree.root t1

goal (2 subgoals):
 1. x = dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
 2. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x = dtree.root t1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
x = dtree.root t1

goal (1 subgoal):
 1. \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
using R.dom_sub_contr[OF self_subtree] Node.prems(3) e1_def sub_t1
[PROOF STATE]
proof (prove)
using this:
x = dtree.root t1
\<lbrakk>?t1.0 \<in> fst ` fset xs; \<exists>v t2 e2. is_subtree (Node v {|(t2, e2)|}) (Node r xs) \<and> rank (rev (dtree.root t2)) < rank (rev v)\<rbrakk> \<Longrightarrow> \<exists>v\<in>set r. v \<rightarrow>\<^bsub>T\<^esub> hd (dtree.root ?t1.0)
rank (rev (dtree.root t2)) < rank (rev v)
xs = {|(t1, e1)|}
is_subtree (Node v {|(t2, e2)|}) t1

goal (1 subgoal):
 1. \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x

goal (1 subgoal):
 1. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
x \<noteq> dtree.root t1

goal (1 subgoal):
 1. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
x \<noteq> dtree.root t1
[PROOF STEP]
obtain t3 where t3_def: "t3 \<in> fst ` fset (sucs t1)" "x \<in> dverts t3"
[PROOF STATE]
proof (prove)
using this:
x \<noteq> dtree.root t1

goal (1 subgoal):
 1. (\<And>t3. \<lbrakk>t3 \<in> fst ` fset (sucs t1); x \<in> dverts t3\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using Node.prems(5) dverts_root_or_child[of x "Dtree.root t1" "sucs t1"]
[PROOF STATE]
proof (prove)
using this:
x \<noteq> dtree.root t1
x \<in> dverts t1
x \<in> dverts (Node (dtree.root t1) (sucs t1)) \<Longrightarrow> x = dtree.root t1 \<or> x \<in> (\<Union>(t, e)\<in>fset (sucs t1). dverts t)

goal (1 subgoal):
 1. (\<And>t3. \<lbrakk>t3 \<in> fst ` fset (sucs t1); x \<in> dverts t3\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
t3 \<in> fst ` fset (sucs t1)
x \<in> dverts t3

goal (1 subgoal):
 1. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
have mdeg_t1: "max_deg t1 \<le> 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. max_deg t1 \<le> 1
[PROOF STEP]
using mdeg_ge_child[of t1 e1 xs] e1_def mdeg1
[PROOF STATE]
proof (prove)
using this:
(t1, e1) \<in> fset xs \<Longrightarrow> max_deg t1 \<le> max_deg (Node ?r xs)
xs = {|(t1, e1)|}
max_deg (Node r xs) = 1

goal (1 subgoal):
 1. max_deg t1 \<le> 1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
max_deg t1 \<le> 1

goal (1 subgoal):
 1. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
max_deg t1 \<le> 1

goal (1 subgoal):
 1. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
have "fcard (sucs t1) > 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < fcard (sucs t1)
[PROOF STEP]
using t3_def fcard_seteq
[PROOF STATE]
proof (prove)
using this:
t3 \<in> fst ` fset (sucs t1)
x \<in> dverts t3
\<lbrakk>?A |\<subseteq>| ?B; fcard ?B \<le> fcard ?A\<rbrakk> \<Longrightarrow> ?A = ?B

goal (1 subgoal):
 1. 0 < fcard (sucs t1)
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
0 < fcard (sucs t1)

goal (1 subgoal):
 1. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
max_deg t1 \<le> 1
0 < fcard (sucs t1)
[PROOF STEP]
have "fcard (sucs t1) = 1"
[PROOF STATE]
proof (prove)
using this:
max_deg t1 \<le> 1
0 < fcard (sucs t1)

goal (1 subgoal):
 1. fcard (sucs t1) = 1
[PROOF STEP]
using mdeg_ge_fcard[of "sucs t1" "Dtree.root t1"]
[PROOF STATE]
proof (prove)
using this:
max_deg t1 \<le> 1
0 < fcard (sucs t1)
fcard (sucs t1) \<le> max_deg (Node (dtree.root t1) (sucs t1))

goal (1 subgoal):
 1. fcard (sucs t1) = 1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
fcard (sucs t1) = 1

goal (1 subgoal):
 1. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
fcard (sucs t1) = 1
[PROOF STEP]
obtain e3 where e3_def: "sucs t1 = {|(t3, e3)|}"
[PROOF STATE]
proof (prove)
using this:
fcard (sucs t1) = 1

goal (1 subgoal):
 1. (\<And>e3. sucs t1 = {|(t3, e3)|} \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using t3_def fcard_single_1_iff[of "sucs t1"]
[PROOF STATE]
proof (prove)
using this:
fcard (sucs t1) = 1
t3 \<in> fst ` fset (sucs t1)
x \<in> dverts t3
(fcard (sucs t1) = 1) = (\<exists>x. sucs t1 = {|x|})

goal (1 subgoal):
 1. (\<And>e3. sucs t1 = {|(t3, e3)|} \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
sucs t1 = {|(t3, e3)|}

goal (1 subgoal):
 1. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
have ind: "\<exists>r\<in>set (Dtree.root t1) \<union> path_lverts t3 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>r\<in>set (dtree.root t1) \<union> path_lverts t3 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
using Node.IH mdeg_t1 e1_def sub_t1 Node.prems(3) t3_def T1.ranked_dtree_with_orig_axioms
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?x2aa2 \<in> fset xs; ?x2aaa2 \<in> Basic_BNFs.fsts ?x2aa2; max_deg ?x2aaa2 \<le> 1; is_subtree (Node v {|(t2, e2)|}) ?x2aaa2; rank (rev (dtree.root t2)) < rank (rev v); ?t1.2 \<in> fst ` fset (sucs ?x2aaa2); x \<in> dverts ?t1.2; ranked_dtree_with_orig ?x2aaa2 rank cost cmp T root\<rbrakk> \<Longrightarrow> \<exists>r\<in>set (dtree.root ?x2aaa2) \<union> path_lverts ?t1.2 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
max_deg t1 \<le> 1
xs = {|(t1, e1)|}
is_subtree (Node v {|(t2, e2)|}) t1
rank (rev (dtree.root t2)) < rank (rev v)
t3 \<in> fst ` fset (sucs t1)
x \<in> dverts t3
ranked_dtree_with_orig t1 rank cost cmp T root

goal (1 subgoal):
 1. \<exists>r\<in>set (dtree.root t1) \<union> path_lverts t3 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>r\<in>set (dtree.root t1) \<union> path_lverts t3 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x

goal (1 subgoal):
 1. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
have "hd x \<in> dlverts t3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. hd x \<in> dlverts t3
[PROOF STEP]
using t3_def hd_in_lverts_if_wf T1.wf_lverts wf_dlverts_suc
[PROOF STATE]
proof (prove)
using this:
t3 \<in> fst ` fset (sucs t1)
x \<in> dverts t3
\<lbrakk>wf_dlverts ?t; ?v \<in> dverts ?t\<rbrakk> \<Longrightarrow> hd ?v \<in> dlverts ?t
wf_dlverts t1
\<lbrakk>wf_dlverts ?t; ?t1.0 \<in> fst ` fset (sucs ?t)\<rbrakk> \<Longrightarrow> wf_dlverts ?t1.0

goal (1 subgoal):
 1. hd x \<in> dlverts t3
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
hd x \<in> dlverts t3

goal (1 subgoal):
 1. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
hd x \<in> dlverts t3
[PROOF STEP]
have "hd x \<notin> set (Dtree.root t1)"
[PROOF STATE]
proof (prove)
using this:
hd x \<in> dlverts t3

goal (1 subgoal):
 1. hd x \<notin> set (dtree.root t1)
[PROOF STEP]
using t3_def dlverts_notin_root_sucs[OF T1.wf_lverts]
[PROOF STATE]
proof (prove)
using this:
hd x \<in> dlverts t3
t3 \<in> fst ` fset (sucs t1)
x \<in> dverts t3
\<lbrakk>?t1.0 \<in> fst ` fset (sucs t1); ?x \<in> dlverts ?t1.0\<rbrakk> \<Longrightarrow> ?x \<notin> set (dtree.root t1)

goal (1 subgoal):
 1. hd x \<notin> set (dtree.root t1)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
hd x \<notin> set (dtree.root t1)

goal (1 subgoal):
 1. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
hd x \<notin> set (dtree.root t1)
[PROOF STEP]
have "path_lverts t1 (hd x) = set (Dtree.root t1) \<union> path_lverts t3 (hd x)"
[PROOF STATE]
proof (prove)
using this:
hd x \<notin> set (dtree.root t1)

goal (1 subgoal):
 1. path_lverts t1 (hd x) = set (dtree.root t1) \<union> path_lverts t3 (hd x)
[PROOF STEP]
using path_lverts_simps1_sucs e3_def
[PROOF STATE]
proof (prove)
using this:
hd x \<notin> set (dtree.root t1)
\<lbrakk>?x \<notin> set (dtree.root ?t1.0); sucs ?t1.0 = {|(?t2.0, ?e2.0)|}\<rbrakk> \<Longrightarrow> set (dtree.root ?t1.0) \<union> path_lverts ?t2.0 ?x = path_lverts ?t1.0 ?x
sucs t1 = {|(t3, e3)|}

goal (1 subgoal):
 1. path_lverts t1 (hd x) = set (dtree.root t1) \<union> path_lverts t3 (hd x)
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
path_lverts t1 (hd x) = set (dtree.root t1) \<union> path_lverts t3 (hd x)

goal (1 subgoal):
 1. x \<noteq> dtree.root t1 \<Longrightarrow> \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
path_lverts t1 (hd x) = set (dtree.root t1) \<union> path_lverts t3 (hd x)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
path_lverts t1 (hd x) = set (dtree.root t1) \<union> path_lverts t3 (hd x)

goal (1 subgoal):
 1. \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
using ind
[PROOF STATE]
proof (prove)
using this:
path_lverts t1 (hd x) = set (dtree.root t1) \<union> path_lverts t3 (hd x)
\<exists>r\<in>set (dtree.root t1) \<union> path_lverts t3 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x

goal (1 subgoal):
 1. \<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>r\<in>set (dtree.root (Node r xs)) \<union> path_lverts t1 (hd x). r \<rightarrow>\<^bsub>T\<^esub> hd x

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma heap_is_wellformed_children_disc_nodes:
  "heap_is_wellformed h \<Longrightarrow> node_ptr |\<in>| node_ptr_kinds h \<Longrightarrow>
  \<not>(\<exists>parent \<in> fset (object_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r) \<Longrightarrow>
  (\<exists>document_ptr \<in> fset (document_ptr_kinds h).
    node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>heap_is_wellformed h; node_ptr |\<in>| node_ptr_kinds h; \<not> (\<exists>parent\<in>fset (object_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)\<rbrakk> \<Longrightarrow> \<exists>document_ptr\<in>fset (document_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r
[PROOF STEP]
using CD.heap_is_wellformed_children_disc_nodes local.heap_is_wellformed_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M ?h; ?node_ptr |\<in>| node_ptr_kinds ?h; \<not> (\<exists>parent\<in>fset (object_ptr_kinds ?h). ?node_ptr \<in> set |?h \<turnstile> get_child_nodes parent|\<^sub>r)\<rbrakk> \<Longrightarrow> \<exists>document_ptr\<in>fset (document_ptr_kinds ?h). ?node_ptr \<in> set |?h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r
heap_is_wellformed = (\<lambda>h. heap_is_wellformed\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M h \<and> acyclic (parent_child_rel h \<union> local.a_host_shadow_root_rel h) \<and> local.a_all_ptrs_in_heap h \<and> local.a_distinct_lists h \<and> local.a_shadow_root_valid h)

goal (1 subgoal):
 1. \<lbrakk>heap_is_wellformed h; node_ptr |\<in>| node_ptr_kinds h; \<not> (\<exists>parent\<in>fset (object_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_child_nodes parent|\<^sub>r)\<rbrakk> \<Longrightarrow> \<exists>document_ptr\<in>fset (document_ptr_kinds h). node_ptr \<in> set |h \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r
[PROOF STEP]
by blast


[STATEMENT]
lemma (in antisym)
  "R x y --> R y z --> R x z"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. R x y \<longrightarrow> R y z \<longrightarrow> R x z
[PROOF STEP]
quickcheck[exhaustive, finite_type_size = 2, expect = no_counterexample]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. R x y \<longrightarrow> R y z \<longrightarrow> R x z
[PROOF STEP]
quickcheck[exhaustive, expect = counterexample]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. R x y \<longrightarrow> R y z \<longrightarrow> R x z
[PROOF STEP]
oops