[STATEMENT]
lemma class_add_wf_cdecl:
assumes wfcd: "wf_cdecl wf_md P cd" and cdP: "cd \<in> set P"
 and ncp: "\<not> P \<turnstile> fst cd \<preceq>\<^sup>* C" and dist: "distinct_fst P"
 and wfmd: "\<And>C\<^sub>0 md. wf_md P C\<^sub>0 md \<Longrightarrow> wf_md (class_add P (C, cdec)) C\<^sub>0 md"
 and nclass: "\<not> is_class P C"
shows "wf_cdecl wf_md (class_add P (C, cdec)) cd"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf_cdecl wf_md (class_add P (C, cdec)) cd
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. wf_cdecl wf_md (class_add P (C, cdec)) cd
[PROOF STEP]
let ?P = "class_add P (C, cdec)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. wf_cdecl wf_md (class_add P (C, cdec)) cd
[PROOF STEP]
obtain C1 D fs ms where [simp]: "cd = (C1,(D,fs,ms))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>C1 D fs ms. cd = (C1, D, fs, ms) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(cases cd)
[PROOF STATE]
proof (state)
this:
cd = (C1, D, fs, ms)

goal (1 subgoal):
 1. wf_cdecl wf_md (class_add P (C, cdec)) cd
[PROOF STEP]
from wfcd
[PROOF STATE]
proof (chain)
picking this:
wf_cdecl wf_md P cd
[PROOF STEP]
have "\<forall>f\<in>set fs. wf_fdecl ?P f"
[PROOF STATE]
proof (prove)
using this:
wf_cdecl wf_md P cd

goal (1 subgoal):
 1. \<forall>f\<in>set fs. wf_fdecl (class_add P (C, cdec)) f
[PROOF STEP]
by(auto simp: wf_cdecl_def wf_fdecl_def class_add_is_type)
[PROOF STATE]
proof (state)
this:
\<forall>f\<in>set fs. wf_fdecl (class_add P (C, cdec)) f

goal (1 subgoal):
 1. wf_cdecl wf_md (class_add P (C, cdec)) cd
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>f\<in>set fs. wf_fdecl (class_add P (C, cdec)) f

goal (1 subgoal):
 1. wf_cdecl wf_md (class_add P (C, cdec)) cd
[PROOF STEP]
from wfcd wfmd class_add_wf_mdecl
[PROOF STATE]
proof (chain)
picking this:
wf_cdecl wf_md P cd
wf_md P ?C\<^sub>0 ?md \<Longrightarrow> wf_md (class_add P (C, cdec)) ?C\<^sub>0 ?md
\<lbrakk>wf_mdecl ?wf_md ?P ?C\<^sub>0 ?md; \<And>C\<^sub>0 md. ?wf_md ?P C\<^sub>0 md \<Longrightarrow> ?wf_md (class_add ?P (?C, ?cdec)) C\<^sub>0 md\<rbrakk> \<Longrightarrow> wf_mdecl ?wf_md (class_add ?P (?C, ?cdec)) ?C\<^sub>0 ?md
[PROOF STEP]
have "\<forall>m\<in>set ms. wf_mdecl wf_md ?P C1 m"
[PROOF STATE]
proof (prove)
using this:
wf_cdecl wf_md P cd
wf_md P ?C\<^sub>0 ?md \<Longrightarrow> wf_md (class_add P (C, cdec)) ?C\<^sub>0 ?md
\<lbrakk>wf_mdecl ?wf_md ?P ?C\<^sub>0 ?md; \<And>C\<^sub>0 md. ?wf_md ?P C\<^sub>0 md \<Longrightarrow> ?wf_md (class_add ?P (?C, ?cdec)) C\<^sub>0 md\<rbrakk> \<Longrightarrow> wf_mdecl ?wf_md (class_add ?P (?C, ?cdec)) ?C\<^sub>0 ?md

goal (1 subgoal):
 1. \<forall>m\<in>set ms. wf_mdecl wf_md (class_add P (C, cdec)) C1 m
[PROOF STEP]
by(auto simp: wf_cdecl_def)
[PROOF STATE]
proof (state)
this:
\<forall>m\<in>set ms. wf_mdecl wf_md (class_add P (C, cdec)) C1 m

goal (1 subgoal):
 1. wf_cdecl wf_md (class_add P (C, cdec)) cd
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>m\<in>set ms. wf_mdecl wf_md (class_add P (C, cdec)) C1 m

goal (1 subgoal):
 1. wf_cdecl wf_md (class_add P (C, cdec)) cd
[PROOF STEP]
have "C1 \<noteq> Object \<Longrightarrow> is_class ?P D \<and> \<not> ?P \<turnstile> D \<preceq>\<^sup>* C1
    \<and> (\<forall>(M,b,Ts,T,m)\<in>set ms.
        \<forall>D' b' Ts' T' m'. ?P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D' \<longrightarrow>
                       b = b' \<and> ?P \<turnstile> Ts' [\<le>] Ts \<and> ?P \<turnstile> T \<le> T')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')
[PROOF STEP]
assume nObj[simp]: "C1 \<noteq> Object"
[PROOF STATE]
proof (state)
this:
C1 \<noteq> Object

goal (1 subgoal):
 1. C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')
[PROOF STEP]
with cdP dist
[PROOF STATE]
proof (chain)
picking this:
cd \<in> set P
distinct_fst P
C1 \<noteq> Object
[PROOF STEP]
have sub1: "P \<turnstile> C1 \<prec>\<^sup>1 D"
[PROOF STATE]
proof (prove)
using this:
cd \<in> set P
distinct_fst P
C1 \<noteq> Object

goal (1 subgoal):
 1. P \<turnstile> C1 \<prec>\<^sup>1 D
[PROOF STEP]
by(auto simp: class_def intro!: subcls1I map_of_SomeI)
[PROOF STATE]
proof (state)
this:
P \<turnstile> C1 \<prec>\<^sup>1 D

goal (1 subgoal):
 1. C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')
[PROOF STEP]
with ncp
[PROOF STATE]
proof (chain)
picking this:
(fst cd, C) \<notin> (subcls1 P)\<^sup>*
P \<turnstile> C1 \<prec>\<^sup>1 D
[PROOF STEP]
have ncp': "\<not> P \<turnstile> D \<preceq>\<^sup>* C"
[PROOF STATE]
proof (prove)
using this:
(fst cd, C) \<notin> (subcls1 P)\<^sup>*
P \<turnstile> C1 \<prec>\<^sup>1 D

goal (1 subgoal):
 1. (D, C) \<notin> (subcls1 P)\<^sup>*
[PROOF STEP]
by(auto simp: converse_rtrancl_into_rtrancl)
[PROOF STATE]
proof (state)
this:
(D, C) \<notin> (subcls1 P)\<^sup>*

goal (1 subgoal):
 1. C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')
[PROOF STEP]
with wfcd
[PROOF STATE]
proof (chain)
picking this:
wf_cdecl wf_md P cd
(D, C) \<notin> (subcls1 P)\<^sup>*
[PROOF STEP]
have clsD: "is_class ?P D"
[PROOF STATE]
proof (prove)
using this:
wf_cdecl wf_md P cd
(D, C) \<notin> (subcls1 P)\<^sup>*

goal (1 subgoal):
 1. is_class (class_add P (C, cdec)) D
[PROOF STEP]
by(auto simp: wf_cdecl_def is_class_def class_def fun_upd_apply)
[PROOF STATE]
proof (state)
this:
is_class (class_add P (C, cdec)) D

goal (1 subgoal):
 1. C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
is_class (class_add P (C, cdec)) D

goal (1 subgoal):
 1. C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')
[PROOF STEP]
from wfcd sub1
[PROOF STATE]
proof (chain)
picking this:
wf_cdecl wf_md P cd
P \<turnstile> C1 \<prec>\<^sup>1 D
[PROOF STEP]
have "\<not> ?P \<turnstile> D \<preceq>\<^sup>* C1"
[PROOF STATE]
proof (prove)
using this:
wf_cdecl wf_md P cd
P \<turnstile> C1 \<prec>\<^sup>1 D

goal (1 subgoal):
 1. (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>*
[PROOF STEP]
by(auto simp: wf_cdecl_def dest!: class_add_subcls_rev[OF _ ncp'])
[PROOF STATE]
proof (state)
this:
(D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>*

goal (1 subgoal):
 1. C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>*

goal (1 subgoal):
 1. C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')
[PROOF STEP]
have "\<And>M b Ts T m D' b' Ts' T' m'. (M,b,Ts,T,m) \<in> set ms
            \<Longrightarrow> ?P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D'
            \<Longrightarrow> b = b' \<and> ?P \<turnstile> Ts' [\<le>] Ts \<and> ?P \<turnstile> T \<le> T'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>M b Ts T m D' b' Ts' T' m'. \<lbrakk>(M, b, Ts, T, m) \<in> set ms; class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'\<rbrakk> \<Longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T'
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>M b Ts T m D' b' Ts' T' m'. \<lbrakk>(M, b, Ts, T, m) \<in> set ms; class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'\<rbrakk> \<Longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T'
[PROOF STEP]
fix M b Ts T m D' b' Ts' T' m'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>M b Ts T m D' b' Ts' T' m'. \<lbrakk>(M, b, Ts, T, m) \<in> set ms; class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'\<rbrakk> \<Longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T'
[PROOF STEP]
assume ms: "(M,b,Ts,T,m) \<in> set ms" and meth': "?P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D'"
[PROOF STATE]
proof (state)
this:
(M, b, Ts, T, m) \<in> set ms
class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'

goal (1 subgoal):
 1. \<And>M b Ts T m D' b' Ts' T' m'. \<lbrakk>(M, b, Ts, T, m) \<in> set ms; class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'\<rbrakk> \<Longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T'
[PROOF STEP]
with sub1
[PROOF STATE]
proof (chain)
picking this:
P \<turnstile> C1 \<prec>\<^sup>1 D
(M, b, Ts, T, m) \<in> set ms
class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'
[PROOF STEP]
have "P \<turnstile> D sees M,b':Ts' \<rightarrow> T' = m' in D'"
[PROOF STATE]
proof (prove)
using this:
P \<turnstile> C1 \<prec>\<^sup>1 D
(M, b, Ts, T, m) \<in> set ms
class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'

goal (1 subgoal):
 1. P \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'
[PROOF STEP]
by(fastforce dest!: class_add_sees_method_rev[OF _ ncp'])
[PROOF STATE]
proof (state)
this:
P \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'

goal (1 subgoal):
 1. \<And>M b Ts T m D' b' Ts' T' m'. \<lbrakk>(M, b, Ts, T, m) \<in> set ms; class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'\<rbrakk> \<Longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
P \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'

goal (1 subgoal):
 1. \<And>M b Ts T m D' b' Ts' T' m'. \<lbrakk>(M, b, Ts, T, m) \<in> set ms; class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'\<rbrakk> \<Longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T'
[PROOF STEP]
with wfcd ms meth'
[PROOF STATE]
proof (chain)
picking this:
wf_cdecl wf_md P cd
(M, b, Ts, T, m) \<in> set ms
class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'
P \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'
[PROOF STEP]
have "b = b' \<and> P \<turnstile> Ts' [\<le>] Ts \<and> P \<turnstile> T \<le> T'"
[PROOF STATE]
proof (prove)
using this:
wf_cdecl wf_md P cd
(M, b, Ts, T, m) \<in> set ms
class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'
P \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'

goal (1 subgoal):
 1. b = b' \<and> P \<turnstile> Ts' [\<le>] Ts \<and> subtype P T T'
[PROOF STEP]
by(cases m', fastforce simp: wf_cdecl_def elim!: ballE[where x="(M,b,Ts,T,m)"])
[PROOF STATE]
proof (state)
this:
b = b' \<and> P \<turnstile> Ts' [\<le>] Ts \<and> subtype P T T'

goal (1 subgoal):
 1. \<And>M b Ts T m D' b' Ts' T' m'. \<lbrakk>(M, b, Ts, T, m) \<in> set ms; class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'\<rbrakk> \<Longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
P \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'
b = b' \<and> P \<turnstile> Ts' [\<le>] Ts \<and> subtype P T T'
[PROOF STEP]
show "b = b' \<and> ?P \<turnstile> Ts' [\<le>] Ts \<and> ?P \<turnstile> T \<le> T'"
[PROOF STATE]
proof (prove)
using this:
P \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D'
b = b' \<and> P \<turnstile> Ts' [\<le>] Ts \<and> subtype P T T'

goal (1 subgoal):
 1. b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T'
[PROOF STEP]
by(auto dest!: class_add_subtype[OF _ nclass] class_add_widens[OF _ nclass])
[PROOF STATE]
proof (state)
this:
b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>(?M, ?b, ?Ts, ?T, ?m) \<in> set ms; class_add P (C, cdec) \<turnstile> D sees ?M, ?b' :  ?Ts'\<rightarrow>?T' = ?m' in ?D'\<rbrakk> \<Longrightarrow> ?b = ?b' \<and> class_add P (C, cdec) \<turnstile> ?Ts' [\<le>] ?Ts \<and> subtype (class_add P (C, cdec)) ?T ?T'

goal (1 subgoal):
 1. C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
is_class (class_add P (C, cdec)) D
(D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>*
\<lbrakk>(?M, ?b, ?Ts, ?T, ?m) \<in> set ms; class_add P (C, cdec) \<turnstile> D sees ?M, ?b' :  ?Ts'\<rightarrow>?T' = ?m' in ?D'\<rbrakk> \<Longrightarrow> ?b = ?b' \<and> class_add P (C, cdec) \<turnstile> ?Ts' [\<le>] ?Ts \<and> subtype (class_add P (C, cdec)) ?T ?T'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
is_class (class_add P (C, cdec)) D
(D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>*
\<lbrakk>(?M, ?b, ?Ts, ?T, ?m) \<in> set ms; class_add P (C, cdec) \<turnstile> D sees ?M, ?b' :  ?Ts'\<rightarrow>?T' = ?m' in ?D'\<rbrakk> \<Longrightarrow> ?b = ?b' \<and> class_add P (C, cdec) \<turnstile> ?Ts' [\<le>] ?Ts \<and> subtype (class_add P (C, cdec)) ?T ?T'

goal (1 subgoal):
 1. is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')
[PROOF STEP]
by clarsimp
[PROOF STATE]
proof (state)
this:
is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')

goal (1 subgoal):
 1. wf_cdecl wf_md (class_add P (C, cdec)) cd
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')

goal (1 subgoal):
 1. wf_cdecl wf_md (class_add P (C, cdec)) cd
[PROOF STEP]
note wfcd
[PROOF STATE]
proof (state)
this:
wf_cdecl wf_md P cd

goal (1 subgoal):
 1. wf_cdecl wf_md (class_add P (C, cdec)) cd
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<forall>f\<in>set fs. wf_fdecl (class_add P (C, cdec)) f
\<forall>m\<in>set ms. wf_mdecl wf_md (class_add P (C, cdec)) C1 m
C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')
wf_cdecl wf_md P cd
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<forall>f\<in>set fs. wf_fdecl (class_add P (C, cdec)) f
\<forall>m\<in>set ms. wf_mdecl wf_md (class_add P (C, cdec)) C1 m
C1 \<noteq> Object \<Longrightarrow> is_class (class_add P (C, cdec)) D \<and> (D, C1) \<notin> (subcls1 (class_add P (C, cdec)))\<^sup>* \<and> (\<forall>(M, b, Ts, T, m)\<in>set ms. \<forall>D' b' Ts' T' m'. class_add P (C, cdec) \<turnstile> D sees M, b' :  Ts'\<rightarrow>T' = m' in D' \<longrightarrow> b = b' \<and> class_add P (C, cdec) \<turnstile> Ts' [\<le>] Ts \<and> subtype (class_add P (C, cdec)) T T')
wf_cdecl wf_md P cd

goal (1 subgoal):
 1. wf_cdecl wf_md (class_add P (C, cdec)) cd
[PROOF STEP]
by(simp add: wf_cdecl_def)
[PROOF STATE]
proof (state)
this:
wf_cdecl wf_md (class_add P (C, cdec)) cd

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma retrieve_stored_tval_u8:
  assumes "val = Uint8_v v"
  shows "retrieve_tval (store_tval obj off val) off (memval_type val) b = val"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. retrieve_tval (store_tval obj off val) off (memval_type val) b = val
[PROOF STEP]
unfolding retrieve_tval_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if is_contiguous_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau> then case memval_type val of Uint8 \<Rightarrow> Uint8_v (decode_u8_list (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Sint8 \<Rightarrow> Sint8_v (UCAST(8 \<rightarrow> 8 signed) (decode_u8_list (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>))) | Uint16 \<Rightarrow> Uint16_v (cat_u16 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Sint16 \<Rightarrow> Sint16_v (cat_s16 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Uint32 \<Rightarrow> Uint32_v (cat_u32 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Sint32 \<Rightarrow> Sint32_v (cat_s32 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Uint64 \<Rightarrow> Uint64_v (cat_u64 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Sint64 \<Rightarrow> Sint64_v (cat_s64 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Cap \<Rightarrow> if is_contiguous_zeros (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau> then Cap_v NULL else Undef else if is_cap (content (store_tval obj off val)) off then let cap = get_cap (content (store_tval obj off val)) off; tv = the (Mapping.lookup (tags (store_tval obj off val)) (cap_offset off)); t = case b of True \<Rightarrow> tv | False \<Rightarrow> False; cv = mem_capability.extend cap \<lparr>tag = t\<rparr>; nth_frag = of_nth (the (Mapping.lookup (content (store_tval obj off val)) off)) in case memval_type val of Uint8 \<Rightarrow> Cap_v_frag (mem_capability.extend cap \<lparr>tag = False\<rparr>) nth_frag | Sint8 \<Rightarrow> Cap_v_frag (mem_capability.extend cap \<lparr>tag = False\<rparr>) nth_frag | Cap \<Rightarrow> if is_contiguous_cap (content (store_tval obj off val)) cap off |memval_type val|\<^sub>\<tau> then Cap_v cv else Undef | _ \<Rightarrow> Undef else Undef) = val
[PROOF STEP]
proof (clarsimp simp add: assms stored_tval_contiguous_bytes; safe)
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint8_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 2. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint8_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
 3. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 4. off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
 5. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 6. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
show "\<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint8_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off));
     is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk>
     \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint8_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
[PROOF STEP]
by (simp add: sizeof_def)
[PROOF STATE]
proof (state)
this:
\<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint8_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v

goal (5 subgoals):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint8_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
 2. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 3. off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
 4. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 5. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint8_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
 2. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 3. off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
 4. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 5. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
show "\<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint8_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off))\<rbrakk>
    \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint8_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
by (metis One_nat_def ccval.distinct(15) ccval.distinct(17) ccval.distinct(19) is_contiguous_bytes.simps(2) memval_size_u8 stored_tval_contiguous_bytes)
[PROOF STATE]
proof (state)
this:
\<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint8_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>

goal (4 subgoals):
 1. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 2. off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
 3. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 4. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 2. off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
 3. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 4. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
show "\<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk>
    \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
[PROOF STEP]
by (simp add: sizeof_def)
[PROOF STATE]
proof (state)
this:
\<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v

goal (3 subgoals):
 1. off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
 2. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 3. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
 2. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 3. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
show "off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
by (metis cctype.simps(73) ccval.distinct(15) ccval.distinct(17) ccval.distinct(19) memval_size_u8 sizeof_def stored_tval_contiguous_bytes)
[PROOF STATE]
proof (state)
this:
off \<notin> Mapping.keys (content (store_tval obj off (Uint8_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>

goal (2 subgoals):
 1. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 2. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
 2. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
show "\<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk>
    \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v
[PROOF STEP]
by (clarsimp simp add: sizeof_def store_tval_def)
[PROOF STATE]
proof (state)
this:
\<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> decode_u8_list (retrieve_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>) = v

goal (1 subgoal):
 1. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
show "memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau> "
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>
[PROOF STEP]
by (metis cctype.simps(73) ccval.distinct(15) ccval.distinct(17) ccval.distinct(19) memval_size_u8 sizeof_def stored_tval_contiguous_bytes)
[PROOF STATE]
proof (state)
this:
memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint8_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint8_v v))) off |Uint8|\<^sub>\<tau>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "P (x::nat) \<Longrightarrow> P (The P)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P x \<Longrightarrow> P (The P)
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P x \<Longrightarrow> P (The P)
[PROOF STEP]
oops


[STATEMENT]
lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_tag_name_type_wf_preserved [simp]:
  assumes "h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h'"
  shows "type_wf h = type_wf h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ShadowRootClass.type_wf h = ShadowRootClass.type_wf h'
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ShadowRootClass.type_wf h = ShadowRootClass.type_wf h'
[PROOF STEP]
have "object_ptr_kinds h = object_ptr_kinds h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. object_ptr_kinds h = object_ptr_kinds h'
[PROOF STEP]
using writes_singleton assms object_ptr_kinds_preserved
[PROOF STATE]
proof (prove)
using this:
writes (all_args ?f) (?f ?a) ?h ?h'
h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h'
\<lbrakk>writes ?SW ?setter ?h ?h'; ?h \<turnstile> ?setter \<rightarrow>\<^sub>h ?h'; \<And>h h' w object_ptr. \<lbrakk>w \<in> ?SW; h \<turnstile> w \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> preserved (get_M object_ptr RObject.nothing) h h'\<rbrakk> \<Longrightarrow> object_ptr_kinds ?h = object_ptr_kinds ?h'

goal (1 subgoal):
 1. object_ptr_kinds h = object_ptr_kinds h'
[PROOF STEP]
unfolding all_args_def
[PROOF STATE]
proof (prove)
using this:
writes (\<Union>arg. {?f arg}) (?f ?a) ?h ?h'
h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h'
\<lbrakk>writes ?SW ?setter ?h ?h'; ?h \<turnstile> ?setter \<rightarrow>\<^sub>h ?h'; \<And>h h' w object_ptr. \<lbrakk>w \<in> ?SW; h \<turnstile> w \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> preserved (get_M object_ptr RObject.nothing) h h'\<rbrakk> \<Longrightarrow> object_ptr_kinds ?h = object_ptr_kinds ?h'

goal (1 subgoal):
 1. object_ptr_kinds h = object_ptr_kinds h'
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
object_ptr_kinds h = object_ptr_kinds h'

goal (1 subgoal):
 1. ShadowRootClass.type_wf h = ShadowRootClass.type_wf h'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
object_ptr_kinds h = object_ptr_kinds h'
[PROOF STEP]
have "shadow_root_ptr_kinds h = shadow_root_ptr_kinds h'"
[PROOF STATE]
proof (prove)
using this:
object_ptr_kinds h = object_ptr_kinds h'

goal (1 subgoal):
 1. shadow_root_ptr_kinds h = shadow_root_ptr_kinds h'
[PROOF STEP]
by(auto simp add: shadow_root_ptr_kinds_def document_ptr_kinds_def)
[PROOF STATE]
proof (state)
this:
shadow_root_ptr_kinds h = shadow_root_ptr_kinds h'

goal (1 subgoal):
 1. ShadowRootClass.type_wf h = ShadowRootClass.type_wf h'
[PROOF STEP]
with assms
[PROOF STATE]
proof (chain)
picking this:
h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h'
shadow_root_ptr_kinds h = shadow_root_ptr_kinds h'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
h \<turnstile> put_M element_ptr tag_name_update v \<rightarrow>\<^sub>h h'
shadow_root_ptr_kinds h = shadow_root_ptr_kinds h'

goal (1 subgoal):
 1. ShadowRootClass.type_wf h = ShadowRootClass.type_wf h'
[PROOF STEP]
by(auto simp add: ElementMonad.put_M_defs type_wf_defs)
[PROOF STATE]
proof (state)
this:
ShadowRootClass.type_wf h = ShadowRootClass.type_wf h'

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "\<lbrakk> (A ** B) sa ; (A ** Y) s \<rbrakk> \<Longrightarrow> (A ** X) s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(A \<and>* B) sa; (A \<and>* Y) s\<rbrakk> \<Longrightarrow> (A \<and>* X) s
[PROOF STEP]
apply (sep_cancel)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>h. \<lbrakk>(A \<and>* B) sa; Y h\<rbrakk> \<Longrightarrow> X h
[PROOF STEP]
oops


[STATEMENT]
lemma get_root_node_si_is_component_unsafe:
  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
  assumes "h \<turnstile> get_root_node_si ptr' \<rightarrow>\<^sub>r root"
  shows "set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = set |h \<turnstile> get_scdom_component root|\<^sub>r \<or>
set |h \<turnstile> get_scdom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component root|\<^sub>r = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = set |h \<turnstile> get_scdom_component root|\<^sub>r \<or> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component root|\<^sub>r = {}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = set |h \<turnstile> get_scdom_component root|\<^sub>r \<or> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component root|\<^sub>r = {}
[PROOF STEP]
have "ptr' |\<in>| object_ptr_kinds h"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ptr' |\<in>| object_ptr_kinds h
[PROOF STEP]
using get_ancestors_si_ptr_in_heap assms(4)
[PROOF STATE]
proof (prove)
using this:
?h \<turnstile> ok get_ancestors_si ?ptr \<Longrightarrow> ?ptr |\<in>| object_ptr_kinds ?h
h \<turnstile> get_root_node_si ptr' \<rightarrow>\<^sub>r root

goal (1 subgoal):
 1. ptr' |\<in>| object_ptr_kinds h
[PROOF STEP]
by(auto simp add: get_root_node_si_def elim!: bind_returns_result_E2)
[PROOF STATE]
proof (state)
this:
ptr' |\<in>| object_ptr_kinds h

goal (1 subgoal):
 1. set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = set |h \<turnstile> get_scdom_component root|\<^sub>r \<or> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component root|\<^sub>r = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
ptr' |\<in>| object_ptr_kinds h
[PROOF STEP]
obtain sc where "h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc"
[PROOF STATE]
proof (prove)
using this:
ptr' |\<in>| object_ptr_kinds h

goal (1 subgoal):
 1. (\<And>sc. h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (meson assms(1) assms(2) assms(3) local.get_scdom_component_ok select_result_I)
[PROOF STATE]
proof (state)
this:
h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc

goal (1 subgoal):
 1. set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = set |h \<turnstile> get_scdom_component root|\<^sub>r \<or> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component root|\<^sub>r = {}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc

goal (1 subgoal):
 1. set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = set |h \<turnstile> get_scdom_component root|\<^sub>r \<or> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component root|\<^sub>r = {}
[PROOF STEP]
have "root |\<in>| object_ptr_kinds h"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. root |\<in>| object_ptr_kinds h
[PROOF STEP]
using get_ancestors_si_ptr assms(4)
[PROOF STATE]
proof (prove)
using this:
?h \<turnstile> get_ancestors_si ?ptr \<rightarrow>\<^sub>r ?ancestors \<Longrightarrow> ?ptr \<in> set ?ancestors
h \<turnstile> get_root_node_si ptr' \<rightarrow>\<^sub>r root

goal (1 subgoal):
 1. root |\<in>| object_ptr_kinds h
[PROOF STEP]
apply(auto simp add: get_root_node_si_def elim!: bind_returns_result_E2)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>\<And>h ptr ancestors. h \<turnstile> get_ancestors_si ptr \<rightarrow>\<^sub>r ancestors \<Longrightarrow> ptr \<in> set ancestors; h \<turnstile> get_ancestors_si ptr' \<rightarrow>\<^sub>r x; root = last x\<rbrakk> \<Longrightarrow> last x |\<in>| object_ptr_kinds h
[PROOF STEP]
by (metis (no_types, lifting) assms(1) assms(2) assms(3) empty_iff empty_set
        get_ancestors_si_ptrs_in_heap last_in_set)
[PROOF STATE]
proof (state)
this:
root |\<in>| object_ptr_kinds h

goal (1 subgoal):
 1. set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = set |h \<turnstile> get_scdom_component root|\<^sub>r \<or> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component root|\<^sub>r = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
root |\<in>| object_ptr_kinds h
[PROOF STEP]
obtain sc' where "h \<turnstile> get_scdom_component root \<rightarrow>\<^sub>r sc'"
[PROOF STATE]
proof (prove)
using this:
root |\<in>| object_ptr_kinds h

goal (1 subgoal):
 1. (\<And>sc'. h \<turnstile> get_scdom_component root \<rightarrow>\<^sub>r sc' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (meson assms(1) assms(2) assms(3) local.get_scdom_component_ok select_result_I)
[PROOF STATE]
proof (state)
this:
h \<turnstile> get_scdom_component root \<rightarrow>\<^sub>r sc'

goal (1 subgoal):
 1. set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = set |h \<turnstile> get_scdom_component root|\<^sub>r \<or> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component root|\<^sub>r = {}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc
h \<turnstile> get_scdom_component root \<rightarrow>\<^sub>r sc'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc
h \<turnstile> get_scdom_component root \<rightarrow>\<^sub>r sc'

goal (1 subgoal):
 1. set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = set |h \<turnstile> get_scdom_component root|\<^sub>r \<or> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component root|\<^sub>r = {}
[PROOF STEP]
by (metis (no_types, opaque_lifting) IntE \<open>\<And>thesis. (\<And>sc'. h \<turnstile> get_scdom_component root \<rightarrow>\<^sub>r sc' \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close>
        \<open>\<And>thesis. (\<And>sc. h \<turnstile> get_scdom_component ptr' \<rightarrow>\<^sub>r sc \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> assms(1) assms(2) assms(3) empty_subsetI
        local.get_scdom_component_ptrs_same_scope_component returns_result_eq select_result_I2 subsetI subset_antisym)
[PROOF STATE]
proof (state)
this:
set |h \<turnstile> get_scdom_component ptr'|\<^sub>r = set |h \<turnstile> get_scdom_component root|\<^sub>r \<or> set |h \<turnstile> get_scdom_component ptr'|\<^sub>r \<inter> set |h \<turnstile> get_scdom_component root|\<^sub>r = {}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma WT_callee_real2: "(\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>c
  fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s \<surd>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full) \<turnstile>c fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s \<surd>
[PROOF STEP]
apply(rule WT_calleeI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>call ret sa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call)\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
[PROOF STEP]
apply(cases s)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>call ret sa a b c. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c)\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
[PROOF STEP]
apply(case_tac call)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>call ret sa a b c aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 2. \<And>call ret sa a b c ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
[PROOF STEP]
apply(rename_tac [!] x)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>call ret sa a b c x. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 2. \<And>call ret sa a b c x. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
[PROOF STEP]
apply(case_tac [!] x)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>call ret sa a b c x aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 2. \<And>call ret sa a b c x ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 3. \<And>call ret sa a b c x aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 4. \<And>call ret sa a b c x ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
[PROOF STEP]
apply(rename_tac [!] y)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>call ret sa a b c x y. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 2. \<And>call ret sa a b c x y. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 3. \<And>call ret sa a b c x y. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 4. \<And>call ret sa a b c x y. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
[PROOF STEP]
apply(case_tac [!] y)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 2. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 3. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 4. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 5. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 6. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 7. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 8. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
[PROOF STEP]
apply(rename_tac [5] z)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 2. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 3. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 4. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 5. \<And>call ret sa a b c x y z. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inl z\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 6. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 7. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 8. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
[PROOF STEP]
apply(rename_tac [6] z)
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 2. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 3. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 4. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 5. \<And>call ret sa a b c x y z. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inl z\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 6. \<And>call ret sa a b c x y z. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inr z\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 7. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 8. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
[PROOF STEP]
apply(case_tac [5] z)
[PROOF STATE]
proof (prove)
goal (9 subgoals):
 1. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 2. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 3. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 4. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 5. \<And>call ret sa a b c x y z aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inl z; z = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 6. \<And>call ret sa a b c x y z ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inl z; z = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 7. \<And>call ret sa a b c x y z. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inr z\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 8. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 9. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
[PROOF STEP]
apply(case_tac [7] z)
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 2. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inl y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 3. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 4. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inl x; x = Inr y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 5. \<And>call ret sa a b c x y z aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inl z; z = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 6. \<And>call ret sa a b c x y z ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inl z; z = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 7. \<And>call ret sa a b c x y z aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inr z; z = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 8. \<And>call ret sa a b c x y z ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inl y; y = Inr z; z = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 9. \<And>call ret sa a b c x y aa. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y; y = Inl aa\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
 10. \<And>call ret sa a b c x y ba. \<lbrakk>call \<in> outs_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)); (ret, sa) \<in> set_spmf (fused_resource.fuse (parallel_core key.core auth.core) (parallel_rest key_rest auth_rest) s call); s = (a, b, c); call = Inr x; x = Inr y; y = Inr ba\<rbrakk> \<Longrightarrow> ret \<in> responses_\<I> ((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (((\<I>_full \<oplus>\<^sub>\<I> \<I>_full) \<oplus>\<^sub>\<I> (\<I>_full \<oplus>\<^sub>\<I> \<I>_full)) \<oplus>\<^sub>\<I> \<I>_full)) call
[PROOF STEP]
by(auto simp add: fused_resource.fuse.simps)


[STATEMENT]
lemma sc_completionI:
  "(\<And>ttas s' t x ta x' m'.
     \<lbrakk> s -\<triangleright>ttas\<rightarrow>* s'; ta_seq_consist P vs (llist_of (concat (map (\<lambda>(t, ta). \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>) ttas)));
       thr s' t = \<lfloor>(x, no_wait_locks)\<rfloor>; t \<turnstile> (x, shr s') -ta\<rightarrow> (x', m'); actions_ok s' t ta \<rbrakk>
     \<Longrightarrow> \<exists>ta' x'' m''. t \<turnstile> (x, shr s') -ta'\<rightarrow> (x'', m'') \<and> actions_ok s' t ta' \<and>
                   ta_seq_consist P (mrw_values P vs (concat (map (\<lambda>(t, ta). \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>) ttas))) (llist_of \<lbrace>ta'\<rbrace>\<^bsub>o\<^esub>))
  \<Longrightarrow> sc_completion s vs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ttas s' t x ta x' m'. \<lbrakk>s -\<triangleright>ttas\<rightarrow>* s'; ta_seq_consist P vs (llist_of (concat (map (\<lambda>(t, ta). \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>) ttas))); thr s' t = \<lfloor>(x, no_wait_locks)\<rfloor>; t \<turnstile> \<langle>x, shr s'\<rangle> -ta\<rightarrow> \<langle>x', m'\<rangle>; actions_ok s' t ta\<rbrakk> \<Longrightarrow> \<exists>ta' x'' m''. t \<turnstile> \<langle>x, shr s'\<rangle> -ta'\<rightarrow> \<langle>x'', m''\<rangle> \<and> actions_ok s' t ta' \<and> ta_seq_consist P (mrw_values P vs (concat (map (\<lambda>(t, ta). \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>) ttas))) (llist_of \<lbrace>ta'\<rbrace>\<^bsub>o\<^esub>)) \<Longrightarrow> sc_completion s vs
[PROOF STEP]
unfolding sc_completion_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ttas s' t x ta x' m'. \<lbrakk>s -\<triangleright>ttas\<rightarrow>* s'; ta_seq_consist P vs (llist_of (concat (map (\<lambda>(t, ta). \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>) ttas))); thr s' t = \<lfloor>(x, no_wait_locks)\<rfloor>; t \<turnstile> \<langle>x, shr s'\<rangle> -ta\<rightarrow> \<langle>x', m'\<rangle>; actions_ok s' t ta\<rbrakk> \<Longrightarrow> \<exists>ta' x'' m''. t \<turnstile> \<langle>x, shr s'\<rangle> -ta'\<rightarrow> \<langle>x'', m''\<rangle> \<and> actions_ok s' t ta' \<and> ta_seq_consist P (mrw_values P vs (concat (map (\<lambda>(t, ta). \<lbrace>ta\<rbrace>\<^bsub>o\<^esub>) ttas))) (llist_of \<lbrace>ta'\<rbrace>\<^bsub>o\<^esub>)) \<Longrightarrow> \<forall>ttas s' t x ta x' m'. s -\<triangleright>ttas\<rightarrow>* s' \<longrightarrow> ta_seq_consist P vs (llist_of (concat (map (\<lambda>(t, y). \<lbrace>y\<rbrace>\<^bsub>o\<^esub>) ttas))) \<longrightarrow> thr s' t = \<lfloor>(x, no_wait_locks)\<rfloor> \<longrightarrow> t \<turnstile> \<langle>x, shr s'\<rangle> -ta\<rightarrow> \<langle>x', m'\<rangle> \<longrightarrow> actions_ok s' t ta \<longrightarrow> (\<exists>ta' x'' m''. t \<turnstile> \<langle>x, shr s'\<rangle> -ta'\<rightarrow> \<langle>x'', m''\<rangle> \<and> actions_ok s' t ta' \<and> ta_seq_consist P (mrw_values P vs (concat (map (\<lambda>(t, y). \<lbrace>y\<rbrace>\<^bsub>o\<^esub>) ttas))) (llist_of \<lbrace>ta'\<rbrace>\<^bsub>o\<^esub>))
[PROOF STEP]
by blast