[STATEMENT]
lemma pts_symbolic_to_pts_symbolic_c:
  assumes "(\<S>,to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)) \<Rightarrow>\<^sup>\<bullet>\<^sup>* (\<S>',\')" "sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \')" "sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d"
  and wf: "wf\<^sub>s\<^sub>t\<^sub>s' \<S> (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)" "wf\<^sub>e\<^sub>s\<^sub>t {} \\<^sub>d"
  and tar: "Ana_invar_subst ((\<Union>(ik\<^sub>s\<^sub>t` dual\<^sub>s\<^sub>t` \<S>) \<union> (ik\<^sub>e\<^sub>s\<^sub>t \\<^sub>d))
                            \<union> (\<Union>(assignment_rhs\<^sub>s\<^sub>t` \<S>) \<union> (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)))"
  and wa: "well_analyzed \\<^sub>d"
  and \: "interpretation\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \"
  shows "\<exists>\\<^sub>d'. \' = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>,\\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>',\\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>\\<^sub>d'. \' = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>', \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
using assms(1,2)
[PROOF STATE]
proof (prove)
using this:
(\<S>, to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)) \<Rightarrow>\<^sup>\<bullet>\<^sup>* (\<S>', \')
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \')

goal (1 subgoal):
 1. \<exists>\\<^sub>d'. \' = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>', \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
proof (induction rule: rtranclp_induct2)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est (to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d))) \<Longrightarrow> \<exists>\\<^sub>d'. to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d) = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>a b aa ba. \<lbrakk>(\<S>, to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)) \<Rightarrow>\<^sup>\<bullet>\<^sup>* (a, b); (a, b) \<Rightarrow>\<^sup>\<bullet> (aa, ba); sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est b) \<Longrightarrow> \<exists>\\<^sub>d'. b = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (a, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'; sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est ba)\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. ba = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (aa, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
case refl
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est (to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)))

goal (2 subgoals):
 1. sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est (to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d))) \<Longrightarrow> \<exists>\\<^sub>d'. to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d) = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>a b aa ba. \<lbrakk>(\<S>, to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)) \<Rightarrow>\<^sup>\<bullet>\<^sup>* (a, b); (a, b) \<Rightarrow>\<^sup>\<bullet> (aa, ba); sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est b) \<Longrightarrow> \<exists>\\<^sub>d'. b = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (a, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'; sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est ba)\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. ba = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (aa, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est (to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)))

goal (1 subgoal):
 1. \<exists>\\<^sub>d'. to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d) = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est (to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)))
(\<S>, to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)) \<Rightarrow>\<^sup>\<bullet>\<^sup>* (\<S>', \')
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \')
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d
wf\<^sub>s\<^sub>t\<^sub>s' \<S> (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)
wf\<^sub>e\<^sub>s\<^sub>t {} \\<^sub>d
Ana_invar_subst (\<Union> (ik\<^sub>s\<^sub>t ` dual\<^sub>s\<^sub>t ` \<S>) \<union> ik\<^sub>e\<^sub>s\<^sub>t \\<^sub>d \<union> (\<Union> (assignment_rhs\<^sub>s\<^sub>t ` \<S>) \<union> assignment_rhs\<^sub>e\<^sub>s\<^sub>t \\<^sub>d))
well_analyzed \\<^sub>d
subst_domain \ = \<V> \<and> ground (subst_range \)

goal (1 subgoal):
 1. \<exists>\\<^sub>d'. to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d) = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>\\<^sub>d'. to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d) = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'

goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>(\<S>, to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)) \<Rightarrow>\<^sup>\<bullet>\<^sup>* (a, b); (a, b) \<Rightarrow>\<^sup>\<bullet> (aa, ba); sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est b) \<Longrightarrow> \<exists>\\<^sub>d'. b = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (a, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'; sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est ba)\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. ba = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (aa, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>(\<S>, to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)) \<Rightarrow>\<^sup>\<bullet>\<^sup>* (a, b); (a, b) \<Rightarrow>\<^sup>\<bullet> (aa, ba); sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est b) \<Longrightarrow> \<exists>\\<^sub>d'. b = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (a, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'; sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est ba)\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. ba = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (aa, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
case (step \<S>1 \1 \<S>2 \2)
[PROOF STATE]
proof (state)
this:
(\<S>, to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)) \<Rightarrow>\<^sup>\<bullet>\<^sup>* (\<S>1, \1)
(\<S>1, \1) \<Rightarrow>\<^sup>\<bullet> (\<S>2, \2)
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \1) \<Longrightarrow> \<exists>\\<^sub>d'. \1 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \2)

goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>(\<S>, to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)) \<Rightarrow>\<^sup>\<bullet>\<^sup>* (a, b); (a, b) \<Rightarrow>\<^sup>\<bullet> (aa, ba); sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est b) \<Longrightarrow> \<exists>\\<^sub>d'. b = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (a, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'; sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est ba)\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. ba = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (aa, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \1)
[PROOF STEP]
using step.hyps(2) step.prems
[PROOF STATE]
proof (prove)
using this:
(\<S>1, \1) \<Rightarrow>\<^sup>\<bullet> (\<S>2, \2)
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \2)

goal (1 subgoal):
 1. sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \1)
[PROOF STEP]
by (induct rule: pts_symbolic_induct, metis, (metis sem\<^sub>e\<^sub>s\<^sub>t_d_split_left to_est_append)+)
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \1)

goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>(\<S>, to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)) \<Rightarrow>\<^sup>\<bullet>\<^sup>* (a, b); (a, b) \<Rightarrow>\<^sup>\<bullet> (aa, ba); sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est b) \<Longrightarrow> \<exists>\\<^sub>d'. b = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (a, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'; sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est ba)\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. ba = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (aa, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \1)
[PROOF STEP]
obtain \1d where
      \1d: "\1 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \1d)" "(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d)" "sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \1d"
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \1)

goal (1 subgoal):
 1. (\<And>\1d. \<lbrakk>\1 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \1d); (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d); sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \1d\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using step.IH
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \1)
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \1) \<Longrightarrow> \<exists>\\<^sub>d'. \1 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'

goal (1 subgoal):
 1. (\<And>\1d. \<lbrakk>\1 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \1d); (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d); sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \1d\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by moura
[PROOF STATE]
proof (state)
this:
\1 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \1d)
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d)
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \1d

goal (1 subgoal):
 1. \<And>a b aa ba. \<lbrakk>(\<S>, to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d)) \<Rightarrow>\<^sup>\<bullet>\<^sup>* (a, b); (a, b) \<Rightarrow>\<^sup>\<bullet> (aa, ba); sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est b) \<Longrightarrow> \<exists>\\<^sub>d'. b = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (a, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'; sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est ba)\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. ba = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (aa, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
using step.hyps(2)
[PROOF STATE]
proof (prove)
using this:
(\<S>1, \1) \<Rightarrow>\<^sup>\<bullet> (\<S>2, \2)

goal (1 subgoal):
 1. \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
proof (induction rule: pts_symbolic_induct)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<lbrakk>[] \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 []; \2 = \1\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>t S. \<lbrakk>send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 4. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 5. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
[] \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 []
\2 = \1

goal (5 subgoals):
 1. \<lbrakk>[] \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 []; \2 = \1\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>t S. \<lbrakk>send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 4. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 5. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
hence "(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \1d)"
[PROOF STATE]
proof (prove)
using this:
[] \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 []
\2 = \1

goal (1 subgoal):
 1. (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \1d)
[PROOF STEP]
using \1d pts_symbolic_c.Nil[OF Nil.hyps(1), of \1d]
[PROOF STATE]
proof (prove)
using this:
[] \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 []
\2 = \1
\1 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \1d)
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d)
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \1d
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (update\<^sub>s\<^sub>t \<S>1 [], \1d)

goal (1 subgoal):
 1. (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \1d)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \1d)

goal (5 subgoals):
 1. \<lbrakk>[] \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 []; \2 = \1\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>t S. \<lbrakk>send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 4. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 5. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \1d)

goal (1 subgoal):
 1. \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
using \1d Nil
[PROOF STATE]
proof (prove)
using this:
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \1d)
\1 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \1d)
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d)
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \1d
[] \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 []
\2 = \1

goal (1 subgoal):
 1. \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'

goal (4 subgoals):
 1. \<And>t S. \<lbrakk>send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 4. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>t S. \<lbrakk>send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 4. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
case (Send t S)
[PROOF STATE]
proof (state)
this:
send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S)
\2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]

goal (4 subgoals):
 1. \<And>t S. \<lbrakk>send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 4. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
hence "sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d@[Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])"
[PROOF STATE]
proof (prove)
using this:
send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S)
\2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]

goal (1 subgoal):
 1. sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])
[PROOF STEP]
using sem\<^sub>e\<^sub>s\<^sub>t_c.Receive[OF \1d(3)]
[PROOF STATE]
proof (prove)
using this:
send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S)
\2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step (receive\<langle>?t\<rangle>\<^sub>s\<^sub>t)])

goal (1 subgoal):
 1. sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])

goal (4 subgoals):
 1. \<And>t S. \<lbrakk>send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 4. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])

goal (4 subgoals):
 1. \<And>t S. \<lbrakk>send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 4. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d@[Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])
[PROOF STEP]
using Send.hyps(2) pts_symbolic_c.Send[OF Send.hyps(1), of \1d]
[PROOF STATE]
proof (prove)
using this:
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S)
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S), \1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])

goal (1 subgoal):
 1. (\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])

goal (4 subgoals):
 1. \<And>t S. \<lbrakk>send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 4. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])

goal (4 subgoals):
 1. \<And>t S. \<lbrakk>send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 4. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d@[Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) = \2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) = \2
[PROOF STEP]
using Send.hyps(3) decomp_rm\<^sub>e\<^sub>s\<^sub>t_append \1d(1)
[PROOF STATE]
proof (prove)
using this:
\2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]
decomp_rm\<^sub>e\<^sub>s\<^sub>t (?S @ ?S') = decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S @ decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S'
\1 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \1d)

goal (1 subgoal):
 1. to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) = \2
[PROOF STEP]
by (simp add: to_st_append)
[PROOF STATE]
proof (state)
this:
to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) = \2

goal (4 subgoals):
 1. \<And>t S. \<lbrakk>send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [receive\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 4. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])
to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) = \2
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])
to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) = \2

goal (1 subgoal):
 1. \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
using \1d(2)
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])
to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)])) = \2
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d)

goal (1 subgoal):
 1. \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'

goal (3 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
case (Equality a t t' S)
[PROOF STATE]
proof (state)
this:
\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S)
\2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]

goal (3 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
hence "t \<cdot> \ = t' \<cdot> \"
[PROOF STATE]
proof (prove)
using this:
\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S)
\2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]

goal (1 subgoal):
 1. Unifier \ t t'
[PROOF STEP]
using step.prems sem\<^sub>e\<^sub>s\<^sub>t_d_eq_sem_st[of "{}" \ "to_est \2"]
            to_st_append to_est_append to_st_to_est_inv
[PROOF STATE]
proof (prove)
using this:
\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S)
\2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \2)
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \2) = \<lbrakk>{}; to_st (to_est \2)\<rbrakk>\<^sub>d' \
to_st (?A @ ?B) = to_st ?A @ to_st ?B
to_est (?A @ ?B) = to_est ?A @ to_est ?B
to_st (to_est ?A) = ?A

goal (1 subgoal):
 1. Unifier \ t t'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Unifier \ t t'

goal (3 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
hence "sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d@[Step (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t)])"
[PROOF STATE]
proof (prove)
using this:
Unifier \ t t'

goal (1 subgoal):
 1. sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])
[PROOF STEP]
using sem\<^sub>e\<^sub>s\<^sub>t_c.Equality[OF \1d(3)]
[PROOF STATE]
proof (prove)
using this:
Unifier \ t t'
Unifier \ ?t ?t' \<Longrightarrow> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<langle>?a: ?t \<doteq> ?t'\<rangle>\<^sub>s\<^sub>t])

goal (1 subgoal):
 1. sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])

goal (3 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])

goal (3 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d@[Step (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t)])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])
[PROOF STEP]
using Equality.hyps(2) pts_symbolic_c.Equality[OF Equality.hyps(1), of \1d]
[PROOF STATE]
proof (prove)
using this:
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S)
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S), \1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])

goal (1 subgoal):
 1. (\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])

goal (3 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])

goal (3 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d@[Step (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t)])) = \2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) = \2
[PROOF STEP]
using Equality.hyps(3) decomp_rm\<^sub>e\<^sub>s\<^sub>t_append \1d(1)
[PROOF STATE]
proof (prove)
using this:
\2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]
decomp_rm\<^sub>e\<^sub>s\<^sub>t (?S @ ?S') = decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S @ decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S'
\1 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \1d)

goal (1 subgoal):
 1. to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) = \2
[PROOF STEP]
by (simp add: to_st_append)
[PROOF STATE]
proof (state)
this:
to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) = \2

goal (3 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>a t t' S. \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 3. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])
to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) = \2
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])
to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) = \2

goal (1 subgoal):
 1. \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
using \1d(2)
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])
to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t])) = \2
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d)

goal (1 subgoal):
 1. \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'

goal (2 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
case (Inequality X F S)
[PROOF STATE]
proof (state)
this:
\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S)
\2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]

goal (2 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
hence "ineq_model \ X F"
[PROOF STATE]
proof (prove)
using this:
\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S)
\2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]

goal (1 subgoal):
 1. ineq_model \ X F
[PROOF STEP]
using step.prems sem\<^sub>e\<^sub>s\<^sub>t_d_eq_sem_st[of "{}" \ "to_est \2"]
            to_st_append to_est_append to_st_to_est_inv
[PROOF STATE]
proof (prove)
using this:
\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S)
\2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \2)
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \2) = \<lbrakk>{}; to_st (to_est \2)\<rbrakk>\<^sub>d' \
to_st (?A @ ?B) = to_st ?A @ to_st ?B
to_est (?A @ ?B) = to_est ?A @ to_est ?B
to_st (to_est ?A) = ?A

goal (1 subgoal):
 1. ineq_model \ X F
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ineq_model \ X F

goal (2 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
hence "sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d@[Step (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t)])"
[PROOF STATE]
proof (prove)
using this:
ineq_model \ X F

goal (1 subgoal):
 1. sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])
[PROOF STEP]
using sem\<^sub>e\<^sub>s\<^sub>t_c.Inequality[OF \1d(3)]
[PROOF STATE]
proof (prove)
using this:
ineq_model \ X F
ineq_model \ ?X ?F \<Longrightarrow> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<forall>?X\<langle>\<or>\<noteq>: ?F\<rangle>\<^sub>s\<^sub>t])

goal (1 subgoal):
 1. sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])

goal (2 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])

goal (2 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d@[Step (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t)])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])
[PROOF STEP]
using Inequality.hyps(2) pts_symbolic_c.Inequality[OF Inequality.hyps(1), of \1d]
[PROOF STATE]
proof (prove)
using this:
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S)
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S), \1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])

goal (1 subgoal):
 1. (\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])

goal (2 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])

goal (2 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d@[Step (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t)])) = \2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) = \2
[PROOF STEP]
using Inequality.hyps(3) decomp_rm\<^sub>e\<^sub>s\<^sub>t_append \1d(1)
[PROOF STATE]
proof (prove)
using this:
\2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]
decomp_rm\<^sub>e\<^sub>s\<^sub>t (?S @ ?S') = decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S @ decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S'
\1 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \1d)

goal (1 subgoal):
 1. to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) = \2
[PROOF STEP]
by (simp add: to_st_append)
[PROOF STATE]
proof (state)
this:
to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) = \2

goal (2 subgoals):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
 2. \<And>X F S. \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])
to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) = \2
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])
to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) = \2

goal (1 subgoal):
 1. \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
using \1d(2)
[PROOF STATE]
proof (prove)
using this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (\<S>2, \1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])
to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t])) = \2
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d)

goal (1 subgoal):
 1. \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
case (Receive ts S)
[PROOF STATE]
proof (state)
this:
receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S)
\2 = \1 @ [send\<langle>ts\<rangle>\<^sub>s\<^sub>t]

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
hence "\<forall>t \<in> set ts. ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \"
[PROOF STATE]
proof (prove)
using this:
receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S)
\2 = \1 @ [send\<langle>ts\<rangle>\<^sub>s\<^sub>t]

goal (1 subgoal):
 1. \<forall>t\<in>set ts. ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
[PROOF STEP]
using step.prems sem\<^sub>e\<^sub>s\<^sub>t_d_eq_sem_st[of "{}" \ "to_est \2"]
            strand_sem_split(4)[of "{}" \1 "[send\<langle>ts\<rangle>\<^sub>s\<^sub>t]" \]
            to_st_append to_est_append to_st_to_est_inv
[PROOF STATE]
proof (prove)
using this:
receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S)
\2 = \1 @ [send\<langle>ts\<rangle>\<^sub>s\<^sub>t]
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \2)
sem\<^sub>e\<^sub>s\<^sub>t_d {} \ (to_est \2) = \<lbrakk>{}; to_st (to_est \2)\<rbrakk>\<^sub>d' \
\<lbrakk>{}; \1 @ [send\<langle>ts\<rangle>\<^sub>s\<^sub>t]\<rbrakk>\<^sub>d \ \<Longrightarrow> \<lbrakk>{} \<union> (ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \); [send\<langle>ts\<rangle>\<^sub>s\<^sub>t]\<rbrakk>\<^sub>d \
to_st (?A @ ?B) = to_st ?A @ to_st ?B
to_est (?A @ ?B) = to_est ?A @ to_est ?B
to_st (to_est ?A) = ?A

goal (1 subgoal):
 1. \<forall>t\<in>set ts. ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set ts. ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set ts. ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<subseteq> ik\<^sub>e\<^sub>s\<^sub>t \1d \<cdot>\<^sub>s\<^sub>e\<^sub>t \"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<subseteq> ik\<^sub>e\<^sub>s\<^sub>t \1d \<cdot>\<^sub>s\<^sub>e\<^sub>t \
[PROOF STEP]
using \1d(1) decomp_rm\<^sub>e\<^sub>s\<^sub>t_ik_subset
[PROOF STATE]
proof (prove)
using this:
\1 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \1d)
ik\<^sub>e\<^sub>s\<^sub>t (decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S) \<subseteq> ik\<^sub>e\<^sub>s\<^sub>t ?S

goal (1 subgoal):
 1. ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<subseteq> ik\<^sub>e\<^sub>s\<^sub>t \1d \<cdot>\<^sub>s\<^sub>e\<^sub>t \
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<subseteq> ik\<^sub>e\<^sub>s\<^sub>t \1d \<cdot>\<^sub>s\<^sub>e\<^sub>t \

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<forall>t\<in>set ts. ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<subseteq> ik\<^sub>e\<^sub>s\<^sub>t \1d \<cdot>\<^sub>s\<^sub>e\<^sub>t \
[PROOF STEP]
have *: "\<forall>t \<in> set ts. ik\<^sub>e\<^sub>s\<^sub>t \1d \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \"
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set ts. ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<subseteq> ik\<^sub>e\<^sub>s\<^sub>t \1d \<cdot>\<^sub>s\<^sub>e\<^sub>t \

goal (1 subgoal):
 1. \<forall>t\<in>set ts. ik\<^sub>e\<^sub>s\<^sub>t \1d \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
[PROOF STEP]
using ideduct_mono
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set ts. ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
ik\<^sub>s\<^sub>t \1 \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<subseteq> ik\<^sub>e\<^sub>s\<^sub>t \1d \<cdot>\<^sub>s\<^sub>e\<^sub>t \
\<lbrakk>?M \<turnstile> ?t; ?M \<subseteq> ?M'\<rbrakk> \<Longrightarrow> ?M' \<turnstile> ?t

goal (1 subgoal):
 1. \<forall>t\<in>set ts. ik\<^sub>e\<^sub>s\<^sub>t \1d \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set ts. ik\<^sub>e\<^sub>s\<^sub>t \1d \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "wf\<^sub>s\<^sub>t\<^sub>s' \<S> \\<^sub>d"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t\<^sub>s' \<S> \\<^sub>d
[PROOF STEP]
by (rule wf\<^sub>s\<^sub>t\<^sub>s'_decomp_rm[OF wa assms(4)])
[PROOF STATE]
proof (state)
this:
wf\<^sub>s\<^sub>t\<^sub>s' \<S> \\<^sub>d

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
hence **: "wf\<^sub>e\<^sub>s\<^sub>t {} \1d"
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>s\<^sub>t\<^sub>s' \<S> \\<^sub>d

goal (1 subgoal):
 1. wf\<^sub>e\<^sub>s\<^sub>t {} \1d
[PROOF STEP]
by (rule pts_symbolic_c_preserves_wf_is[OF \1d(2) _ assms(5)])
[PROOF STATE]
proof (state)
this:
wf\<^sub>e\<^sub>s\<^sub>t {} \1d

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "Ana_invar_subst (\<Union>(ik\<^sub>s\<^sub>t`dual\<^sub>s\<^sub>t`\<S>1) \<union> (ik\<^sub>e\<^sub>s\<^sub>t \1d) \<union>
                           (\<Union>(assignment_rhs\<^sub>s\<^sub>t`\<S>1) \<union> (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Ana_invar_subst (\<Union> (ik\<^sub>s\<^sub>t ` dual\<^sub>s\<^sub>t ` \<S>1) \<union> ik\<^sub>e\<^sub>s\<^sub>t \1d \<union> (\<Union> (assignment_rhs\<^sub>s\<^sub>t ` \<S>1) \<union> assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d))
[PROOF STEP]
using tar \1d(2) pts_symbolic_c_preserves_Ana_invar_subst
[PROOF STATE]
proof (prove)
using this:
Ana_invar_subst (\<Union> (ik\<^sub>s\<^sub>t ` dual\<^sub>s\<^sub>t ` \<S>) \<union> ik\<^sub>e\<^sub>s\<^sub>t \\<^sub>d \<union> (\<Union> (assignment_rhs\<^sub>s\<^sub>t ` \<S>) \<union> assignment_rhs\<^sub>e\<^sub>s\<^sub>t \\<^sub>d))
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d)
\<lbrakk>(?\<S>, ?\) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (?\<S>', ?\'); Ana_invar_subst (\<Union> (ik\<^sub>s\<^sub>t ` dual\<^sub>s\<^sub>t ` ?\<S>) \<union> ik\<^sub>e\<^sub>s\<^sub>t ?\ \<union> (\<Union> (assignment_rhs\<^sub>s\<^sub>t ` ?\<S>) \<union> assignment_rhs\<^sub>e\<^sub>s\<^sub>t ?\<A>))\<rbrakk> \<Longrightarrow> Ana_invar_subst (\<Union> (ik\<^sub>s\<^sub>t ` dual\<^sub>s\<^sub>t ` ?\<S>') \<union> ik\<^sub>e\<^sub>s\<^sub>t ?\<A>' \<union> (\<Union> (assignment_rhs\<^sub>s\<^sub>t ` ?\<S>') \<union> assignment_rhs\<^sub>e\<^sub>s\<^sub>t ?\'))

goal (1 subgoal):
 1. Ana_invar_subst (\<Union> (ik\<^sub>s\<^sub>t ` dual\<^sub>s\<^sub>t ` \<S>1) \<union> ik\<^sub>e\<^sub>s\<^sub>t \1d \<union> (\<Union> (assignment_rhs\<^sub>s\<^sub>t ` \<S>1) \<union> assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
Ana_invar_subst (\<Union> (ik\<^sub>s\<^sub>t ` dual\<^sub>s\<^sub>t ` \<S>1) \<union> ik\<^sub>e\<^sub>s\<^sub>t \1d \<union> (\<Union> (assignment_rhs\<^sub>s\<^sub>t ` \<S>1) \<union> assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d))

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
hence "Ana_invar_subst (ik\<^sub>e\<^sub>s\<^sub>t \1d)" "Ana_invar_subst (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d)"
[PROOF STATE]
proof (prove)
using this:
Ana_invar_subst (\<Union> (ik\<^sub>s\<^sub>t ` dual\<^sub>s\<^sub>t ` \<S>1) \<union> ik\<^sub>e\<^sub>s\<^sub>t \1d \<union> (\<Union> (assignment_rhs\<^sub>s\<^sub>t ` \<S>1) \<union> assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d))

goal (1 subgoal):
 1. Ana_invar_subst (ik\<^sub>e\<^sub>s\<^sub>t \1d) &&& Ana_invar_subst (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d)
[PROOF STEP]
using Ana_invar_subst_subset
[PROOF STATE]
proof (prove)
using this:
Ana_invar_subst (\<Union> (ik\<^sub>s\<^sub>t ` dual\<^sub>s\<^sub>t ` \<S>1) \<union> ik\<^sub>e\<^sub>s\<^sub>t \1d \<union> (\<Union> (assignment_rhs\<^sub>s\<^sub>t ` \<S>1) \<union> assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d))
\<lbrakk>Ana_invar_subst ?M; ?N \<subseteq> ?M\<rbrakk> \<Longrightarrow> Ana_invar_subst ?N

goal (1 subgoal):
 1. Ana_invar_subst (ik\<^sub>e\<^sub>s\<^sub>t \1d) &&& Ana_invar_subst (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d)
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
Ana_invar_subst (ik\<^sub>e\<^sub>s\<^sub>t \1d)
Ana_invar_subst (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d)

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Ana_invar_subst (ik\<^sub>e\<^sub>s\<^sub>t \1d)
Ana_invar_subst (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d)

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "well_analyzed \1d"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. well_analyzed \1d
[PROOF STEP]
using pts_symbolic_c_preserves_well_analyzed[OF \1d(2) wa]
[PROOF STATE]
proof (prove)
using this:
well_analyzed \1d

goal (1 subgoal):
 1. well_analyzed \1d
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
well_analyzed \1d

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Ana_invar_subst (ik\<^sub>e\<^sub>s\<^sub>t \1d)
Ana_invar_subst (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d)
well_analyzed \1d
[PROOF STEP]
obtain D where D:
        "D \<in> decomps\<^sub>e\<^sub>s\<^sub>t (ik\<^sub>e\<^sub>s\<^sub>t \1d) (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d) \"
        "\<forall>t \<in> set ts. ik\<^sub>e\<^sub>s\<^sub>t (\1d@D) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile>\<^sub>c t \<cdot> \"
[PROOF STATE]
proof (prove)
using this:
Ana_invar_subst (ik\<^sub>e\<^sub>s\<^sub>t \1d)
Ana_invar_subst (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d)
well_analyzed \1d

goal (1 subgoal):
 1. (\<And>D. \<lbrakk>D \<in> decomps\<^sub>e\<^sub>s\<^sub>t (ik\<^sub>e\<^sub>s\<^sub>t \1d) (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d) \; \<forall>t\<in>set ts. ik\<^sub>e\<^sub>s\<^sub>t (\1d @ D) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile>\<^sub>c t \<cdot> \\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using decomps\<^sub>e\<^sub>s\<^sub>t_exist_subst_list[OF * \1d(3) ** assms(8)]
[PROOF STATE]
proof (prove)
using this:
Ana_invar_subst (ik\<^sub>e\<^sub>s\<^sub>t \1d)
Ana_invar_subst (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d)
well_analyzed \1d
\<lbrakk>Ana_invar_subst (ik\<^sub>e\<^sub>s\<^sub>t \1d \<union> assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d); well_analyzed \1d\<rbrakk> \<Longrightarrow> \<exists>D\<in>decomps\<^sub>e\<^sub>s\<^sub>t (ik\<^sub>e\<^sub>s\<^sub>t \1d) (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d) \. \<forall>t\<in>set ts. ik\<^sub>e\<^sub>s\<^sub>t (\1d @ D) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile>\<^sub>c t \<cdot> \

goal (1 subgoal):
 1. (\<And>D. \<lbrakk>D \<in> decomps\<^sub>e\<^sub>s\<^sub>t (ik\<^sub>e\<^sub>s\<^sub>t \1d) (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d) \; \<forall>t\<in>set ts. ik\<^sub>e\<^sub>s\<^sub>t (\1d @ D) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile>\<^sub>c t \<cdot> \\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding Ana_invar_subst_def
[PROOF STATE]
proof (prove)
using this:
\<forall>f T K M \<delta>. Fun f T \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>e\<^sub>s\<^sub>t \1d \<longrightarrow> Ana (Fun f T) = (K, M) \<longrightarrow> Ana (Fun f T \<cdot> \<delta>) = (K \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>, M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>)
\<forall>f T K M \<delta>. Fun f T \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d \<longrightarrow> Ana (Fun f T) = (K, M) \<longrightarrow> Ana (Fun f T \<cdot> \<delta>) = (K \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>, M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>)
well_analyzed \1d
\<lbrakk>\<forall>f T K M \<delta>. Fun f T \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t ik\<^sub>e\<^sub>s\<^sub>t \1d \<union> assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d \<longrightarrow> Ana (Fun f T) = (K, M) \<longrightarrow> Ana (Fun f T \<cdot> \<delta>) = (K \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>, M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>); well_analyzed \1d\<rbrakk> \<Longrightarrow> \<exists>D\<in>decomps\<^sub>e\<^sub>s\<^sub>t (ik\<^sub>e\<^sub>s\<^sub>t \1d) (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d) \. \<forall>t\<in>set ts. ik\<^sub>e\<^sub>s\<^sub>t (\1d @ D) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile>\<^sub>c t \<cdot> \

goal (1 subgoal):
 1. (\<And>D. \<lbrakk>D \<in> decomps\<^sub>e\<^sub>s\<^sub>t (ik\<^sub>e\<^sub>s\<^sub>t \1d) (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d) \; \<forall>t\<in>set ts. ik\<^sub>e\<^sub>s\<^sub>t (\1d @ D) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile>\<^sub>c t \<cdot> \\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
D \<in> decomps\<^sub>e\<^sub>s\<^sub>t (ik\<^sub>e\<^sub>s\<^sub>t \1d) (assignment_rhs\<^sub>e\<^sub>s\<^sub>t \1d) \
\<forall>t\<in>set ts. ik\<^sub>e\<^sub>s\<^sub>t (\1d @ D) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile>\<^sub>c t \<cdot> \

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d@D)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d @ D)
[PROOF STEP]
using \1d(2) decomps\<^sub>e\<^sub>s\<^sub>t_pts_symbolic_c[OF D(1), of \<S>1]
[PROOF STATE]
proof (prove)
using this:
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d)
(\<S>1, \1d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d @ D)

goal (1 subgoal):
 1. (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d @ D)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d @ D)

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
hence "(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \1d@D@[Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])"
[PROOF STATE]
proof (prove)
using this:
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d @ D)

goal (1 subgoal):
 1. (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])
[PROOF STEP]
using Receive(2) pts_symbolic_c.Receive[OF Receive.hyps(1), of "\1d@D"]
[PROOF STATE]
proof (prove)
using this:
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>1, \1d @ D)
\<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S)
(\<S>1, \1d @ D) \<Rightarrow>\<^sup>\<bullet>\<^sub>c (update\<^sub>s\<^sub>t \<S>1 (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S), (\1d @ D) @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])

goal (1 subgoal):
 1. (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "\2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d@D@[Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)]))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)]))
[PROOF STEP]
using Receive.hyps(3) \1d(1) decomps\<^sub>e\<^sub>s\<^sub>t_decomp_rm\<^sub>e\<^sub>s\<^sub>t_empty[OF D(1)]
            decomp_rm\<^sub>e\<^sub>s\<^sub>t_append to_st_append
[PROOF STATE]
proof (prove)
using this:
\2 = \1 @ [send\<langle>ts\<rangle>\<^sub>s\<^sub>t]
\1 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \1d)
decomp_rm\<^sub>e\<^sub>s\<^sub>t D = []
decomp_rm\<^sub>e\<^sub>s\<^sub>t (?S @ ?S') = decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S @ decomp_rm\<^sub>e\<^sub>s\<^sub>t ?S'
to_st (?A @ ?B) = to_st ?A @ to_st ?B

goal (1 subgoal):
 1. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)]))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)]))

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)]))

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
have "sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d@D@[Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])
[PROOF STEP]
using D(2) sem\<^sub>e\<^sub>s\<^sub>t_c.Send[OF sem\<^sub>e\<^sub>s\<^sub>t_c_decomps\<^sub>e\<^sub>s\<^sub>t_append[OF \1d(3) D(1)]]
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set ts. ik\<^sub>e\<^sub>s\<^sub>t (\1d @ D) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile>\<^sub>c t \<cdot> \
\<forall>t\<in>set ?ts. ik\<^sub>e\<^sub>s\<^sub>t (\1d @ D) \<union> {} \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile>\<^sub>c t \<cdot> \ \<Longrightarrow> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ ((\1d @ D) @ [Step (send\<langle>?ts\<rangle>\<^sub>s\<^sub>t)])

goal (1 subgoal):
 1. sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])

goal (1 subgoal):
 1. \<And>t S. \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1; \<S>2 = update\<^sub>s\<^sub>t \<S>1 (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S); \2 = \1 @ [send\<langle>t\<rangle>\<^sub>s\<^sub>t]\<rbrakk> \<Longrightarrow> \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])
\2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)]))
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])
\2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t (\1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)]))
sem\<^sub>e\<^sub>s\<^sub>t_c {} \ (\1d @ D @ [Step (send\<langle>ts\<rangle>\<^sub>s\<^sub>t)])

goal (1 subgoal):
 1. \<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>\\<^sub>d'. \2 = to_st (decomp_rm\<^sub>e\<^sub>s\<^sub>t \\<^sub>d') \<and> (\<S>, \\<^sub>d) \<Rightarrow>\<^sup>\<bullet>\<^sub>c\<^sup>* (\<S>2, \\<^sub>d') \<and> sem\<^sub>e\<^sub>s\<^sub>t_c {} \ \\<^sub>d'

goal:
No subgoals!
[PROOF STEP]
qed