[STATEMENT]
lemma "p4 = q4"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p4 = q4
[PROOF STEP]
nitpick [expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p4 = q4
[PROOF STEP]
nitpick [non_wf, expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. p4 = q4
[PROOF STEP]
sorry


[STATEMENT]
lemma "\<lbrakk> (A ** B) sa ; (A ** Y) s \<rbrakk> \<Longrightarrow> (\<lambda>s. (A ** X) s) s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(A \<and>* B) sa; (A \<and>* Y) s\<rbrakk> \<Longrightarrow> (A \<and>* X) s
[PROOF STEP]
apply (sep_cancel)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>h. \<lbrakk>(A \<and>* B) sa; Y h\<rbrakk> \<Longrightarrow> X h
[PROOF STEP]
oops


[STATEMENT]
lemma "fs (Pd p) = fst p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fs (Pd p) = fst p
[PROOF STEP]
nitpick [card = 12, expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fs (Pd p) = fst p
[PROOF STEP]
sorry


[STATEMENT]
lemma "The P"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. The P
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. The P
[PROOF STEP]
oops


[STATEMENT]
lemma prj_in_homs [intro, simp]:
    shows "\<guillemotleft>\<p>\<^sub>0[\<mu>.leg0, HH\<nu>\<pi>\<rho>.leg1] : H\<mu>HH\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<nu>\<pi>\<rho>.chine\<guillemotright>"
    and "\<guillemotleft>\<p>\<^sub>1[\<mu>.leg0, H\<nu>H\<pi>\<rho>.leg1] : H\<mu>H\<nu>H\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>"
    and "\<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.cod.leg0, \<rho>.cod.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>"
    and "\<guillemotleft>\<p>\<^sub>0[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<rho>.chine\<guillemotright>"
    and "\<guillemotleft>\<p>\<^sub>1[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>"
    and "\<guillemotleft>\<p>\<^sub>1[\<nu>\<pi>.leg0 \<cdot> \<mu>_\<nu>\<pi>.prj\<^sub>0, \<rho>.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>"
    and "\<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.dom.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>"
    and "\<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((\<guillemotleft>\<p>\<^sub>0[\<mu>.leg0, HH\<nu>\<pi>\<rho>.leg1] : H\<mu>HH\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<nu>\<pi>\<rho>.chine\<guillemotright> &&& \<guillemotleft>\<p>\<^sub>1[\<mu>.leg0, H\<nu>H\<pi>\<rho>.leg1] : H\<mu>H\<nu>H\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>) &&& \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.cod.leg0, \<rho>.cod.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright> &&& \<guillemotleft>\<p>\<^sub>0[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<rho>.chine\<guillemotright>) &&& (\<guillemotleft>\<p>\<^sub>1[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright> &&& \<guillemotleft>\<p>\<^sub>1[\<nu>\<pi>.leg0 \<cdot> \<mu>_\<nu>\<pi>.prj\<^sub>0, \<rho>.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>) &&& \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.dom.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright> &&& \<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (8 subgoals):
 1. \<guillemotleft>\<p>\<^sub>0[\<mu>.leg0, HH\<nu>\<pi>\<rho>.leg1] : H\<mu>HH\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<nu>\<pi>\<rho>.chine\<guillemotright>
 2. \<guillemotleft>\<p>\<^sub>1[\<mu>.leg0, H\<nu>H\<pi>\<rho>.leg1] : H\<mu>H\<nu>H\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>
 3. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.cod.leg0, \<rho>.cod.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>
 4. \<guillemotleft>\<p>\<^sub>0[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<rho>.chine\<guillemotright>
 5. \<guillemotleft>\<p>\<^sub>1[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
 6. \<guillemotleft>\<p>\<^sub>1[\<nu>\<pi>.leg0 \<cdot> \<mu>_\<nu>\<pi>.prj\<^sub>0, \<rho>.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>
 7. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.dom.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
 8. \<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>\<p>\<^sub>0[\<mu>.leg0, HH\<nu>\<pi>\<rho>.leg1] : H\<mu>HH\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<nu>\<pi>\<rho>.chine\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<p>\<^sub>0[\<mu>.leg0, HH\<nu>\<pi>\<rho>.leg1] : H\<mu>HH\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<nu>\<pi>\<rho>.chine\<guillemotright>
[PROOF STEP]
by (metis C.dom_comp C.prj0_in_hom' C.prj1_simps_arr HH\<nu>\<pi>\<rho>.chine_eq_apex
            HH\<nu>\<pi>\<rho>.cod.apex_def HH\<nu>\<pi>\<rho>.cod.is_span HH\<nu>\<pi>\<rho>.cod_simps(1) HH\<nu>\<pi>\<rho>.cod_simps(3)
            \<mu>_\<nu>\<pi>_\<rho>.prj_simps(10) \<mu>_\<nu>\<pi>_\<rho>.prj_simps(11) \<mu>_\<nu>\<pi>_\<rho>.prj_simps(14) \<nu>\<pi>_\<rho>.leg1_composite)
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<p>\<^sub>0[\<mu>.leg0, HH\<nu>\<pi>\<rho>.leg1] : H\<mu>HH\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<nu>\<pi>\<rho>.chine\<guillemotright>

goal (7 subgoals):
 1. \<guillemotleft>\<p>\<^sub>1[\<mu>.leg0, H\<nu>H\<pi>\<rho>.leg1] : H\<mu>H\<nu>H\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>
 2. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.cod.leg0, \<rho>.cod.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>
 3. \<guillemotleft>\<p>\<^sub>0[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<rho>.chine\<guillemotright>
 4. \<guillemotleft>\<p>\<^sub>1[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
 5. \<guillemotleft>\<p>\<^sub>1[\<nu>\<pi>.leg0 \<cdot> \<mu>_\<nu>\<pi>.prj\<^sub>0, \<rho>.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>
 6. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.dom.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
 7. \<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.cod.leg0, \<rho>.cod.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.cod.leg0, \<rho>.cod.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>
[PROOF STEP]
using \<mu>\<nu>\<pi>.leg0_composite(1) \<mu>\<nu>_\<pi>_\<rho>.prj_simps(3) \<mu>_\<nu>\<pi>.leg0_composite
              \<mu>_\<nu>\<pi>_\<rho>.prj_simps(6)
[PROOF STATE]
proof (prove)
using this:
H\<mu>H\<nu>\<pi>.leg0 = \<pi>.leg0 \<cdot> \<mu>\<nu>\<pi>.Prj\<^sub>0\<^sub>0
C.arr \<mu>\<nu>_\<pi>_\<rho>.Prj\<^sub>0
H\<mu>H\<nu>\<pi>.leg0 = \<nu>\<pi>.leg0 \<cdot> \<mu>_\<nu>\<pi>.prj\<^sub>0
C.dom \<mu>_\<nu>\<pi>_\<rho>.Prj\<^sub>0 = HH\<mu>H\<nu>\<pi>\<rho>.chine

goal (1 subgoal):
 1. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.cod.leg0, \<rho>.cod.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.cod.leg0, \<rho>.cod.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>

goal (6 subgoals):
 1. \<guillemotleft>\<p>\<^sub>1[\<mu>.leg0, H\<nu>H\<pi>\<rho>.leg1] : H\<mu>H\<nu>H\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>
 2. \<guillemotleft>\<p>\<^sub>0[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<rho>.chine\<guillemotright>
 3. \<guillemotleft>\<p>\<^sub>1[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
 4. \<guillemotleft>\<p>\<^sub>1[\<nu>\<pi>.leg0 \<cdot> \<mu>_\<nu>\<pi>.prj\<^sub>0, \<rho>.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>
 5. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.dom.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
 6. \<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>\<p>\<^sub>0[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<rho>.chine\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<p>\<^sub>0[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<rho>.chine\<guillemotright>
[PROOF STEP]
by (simp add: \<mu>\<nu>_\<pi>.leg0_composite \<mu>\<nu>_\<pi>_\<rho>.prj_in_hom(3))
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<p>\<^sub>0[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<rho>.chine\<guillemotright>

goal (5 subgoals):
 1. \<guillemotleft>\<p>\<^sub>1[\<mu>.leg0, H\<nu>H\<pi>\<rho>.leg1] : H\<mu>H\<nu>H\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>
 2. \<guillemotleft>\<p>\<^sub>1[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
 3. \<guillemotleft>\<p>\<^sub>1[\<nu>\<pi>.leg0 \<cdot> \<mu>_\<nu>\<pi>.prj\<^sub>0, \<rho>.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>
 4. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.dom.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
 5. \<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>\<p>\<^sub>1[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<p>\<^sub>1[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
[PROOF STEP]
using \<mu>\<nu>.leg0_composite \<mu>\<nu>_\<pi>.leg0_composite \<mu>\<nu>_\<pi>_\<rho>.prj_in_hom(2)
[PROOF STATE]
proof (prove)
using this:
\<mu>\<nu>.leg0 = \<nu>.leg0 \<cdot> \<mu>\<nu>.prj\<^sub>0
HH\<mu>\<nu>\<pi>.leg0 = \<pi>.leg0 \<cdot> \<mu>\<nu>_\<pi>.prj\<^sub>0
\<guillemotleft>\<mu>\<nu>_\<pi>_\<rho>.Prj\<^sub>0\<^sub>1 : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<pi>.apex\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>\<p>\<^sub>1[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<p>\<^sub>1[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>

goal (4 subgoals):
 1. \<guillemotleft>\<p>\<^sub>1[\<mu>.leg0, H\<nu>H\<pi>\<rho>.leg1] : H\<mu>H\<nu>H\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>
 2. \<guillemotleft>\<p>\<^sub>1[\<nu>\<pi>.leg0 \<cdot> \<mu>_\<nu>\<pi>.prj\<^sub>0, \<rho>.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>
 3. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.dom.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
 4. \<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>\<p>\<^sub>1[\<nu>\<pi>.leg0 \<cdot> \<mu>_\<nu>\<pi>.prj\<^sub>0, \<rho>.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<p>\<^sub>1[\<nu>\<pi>.leg0 \<cdot> \<mu>_\<nu>\<pi>.prj\<^sub>0, \<rho>.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>
[PROOF STEP]
using \<mu>\<nu>\<pi>.leg0_composite(1) \<mu>_\<nu>\<pi>.leg0_composite \<mu>_\<nu>\<pi>_\<rho>.prj_simps(3)
              \<mu>_\<nu>\<pi>_\<rho>.prj_simps(6)
[PROOF STATE]
proof (prove)
using this:
H\<mu>H\<nu>\<pi>.leg0 = \<pi>.leg0 \<cdot> \<mu>\<nu>\<pi>.Prj\<^sub>0\<^sub>0
H\<mu>H\<nu>\<pi>.leg0 = \<nu>\<pi>.leg0 \<cdot> \<mu>_\<nu>\<pi>.prj\<^sub>0
C.arr \<mu>_\<nu>\<pi>_\<rho>.Prj\<^sub>0
C.dom \<mu>_\<nu>\<pi>_\<rho>.Prj\<^sub>0 = HH\<mu>H\<nu>\<pi>\<rho>.chine

goal (1 subgoal):
 1. \<guillemotleft>\<p>\<^sub>1[\<nu>\<pi>.leg0 \<cdot> \<mu>_\<nu>\<pi>.prj\<^sub>0, \<rho>.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<p>\<^sub>1[\<nu>\<pi>.leg0 \<cdot> \<mu>_\<nu>\<pi>.prj\<^sub>0, \<rho>.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>

goal (3 subgoals):
 1. \<guillemotleft>\<p>\<^sub>1[\<mu>.leg0, H\<nu>H\<pi>\<rho>.leg1] : H\<mu>H\<nu>H\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>
 2. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.dom.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
 3. \<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.dom.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.dom.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
[PROOF STEP]
using \<open>\<guillemotleft>\<p>\<^sub>1[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>\<close>
[PROOF STATE]
proof (prove)
using this:
\<guillemotleft>\<p>\<^sub>1[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.dom.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.dom.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>

goal (2 subgoals):
 1. \<guillemotleft>\<p>\<^sub>1[\<mu>.leg0, H\<nu>H\<pi>\<rho>.leg1] : H\<mu>H\<nu>H\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>
 2. \<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>\<p>\<^sub>1[\<mu>.leg0, H\<nu>H\<pi>\<rho>.leg1] : H\<mu>H\<nu>H\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<p>\<^sub>1[\<mu>.leg0, H\<nu>H\<pi>\<rho>.leg1] : H\<mu>H\<nu>H\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>
[PROOF STEP]
by (simp add: \<mu>_\<nu>_\<pi>\<rho>.prj_in_hom(4) \<nu>_\<pi>\<rho>.leg1_composite)
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<p>\<^sub>1[\<mu>.leg0, H\<nu>H\<pi>\<rho>.leg1] : H\<mu>H\<nu>H\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>
[PROOF STEP]
using \<mu>_\<nu>\<pi>.chine_composite \<mu>_\<nu>\<pi>.prj_in_hom(2)
[PROOF STATE]
proof (prove)
using this:
H\<mu>H\<nu>\<pi>.chine = \<mu>.leg0 \<down>\<down> \<nu>\<pi>.leg1
\<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : \<mu>.leg0 \<down>\<down> \<nu>\<pi>.leg1 \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma (in kat) "test p \<Longrightarrow> p \<cdot> x\<^sup>\<star> \<le> x\<^sup>\<star> \<cdot> p \<Longrightarrow> p \<cdot> x \<le> x \<cdot> p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>test p; \<lbrace>p\<rbrace>x\<^sup>\<star>\<lbrace>p\<rbrace>\<rbrakk> \<Longrightarrow> \<lbrace>p\<rbrace>x\<lbrace>p\<rbrace>
[PROOF STEP]
oops


[STATEMENT]
lemma valid_refs_inv_dequeue_Mutate:
  fixes s :: "('field, 'mut, 'payload, 'ref) lsts"
  assumes vri: "valid_refs_inv s"
  assumes sb: "sys_mem_store_buffers (mutator m') s = mw_Mutate r f opt_r' # ws"
  shows "valid_refs_inv (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)),
                                        mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))" (is "valid_refs_inv ?s'")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. valid_refs_inv (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
[PROOF STEP]
proof(rule valid_refs_invI)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>m x y. \<lbrakk>(x reaches y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> mut_m.tso_store_refs m (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
[PROOF STEP]
fix m
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>m x y. \<lbrakk>(x reaches y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> mut_m.tso_store_refs m (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
[PROOF STEP]
let ?root = "\<lambda>m x. mut_m.root m x \<^bold>\<or> grey x"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>m x y. \<lbrakk>(x reaches y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> mut_m.tso_store_refs m (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
[PROOF STEP]
fix x y
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>m x y. \<lbrakk>(x reaches y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> mut_m.tso_store_refs m (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
[PROOF STEP]
assume xy: "(x reaches y) ?s'" and x: "?root m x ?s'"
[PROOF STATE]
proof (state)
this:
(x reaches y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> mut_m.tso_store_refs m (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))

goal (1 subgoal):
 1. \<And>m x y. \<lbrakk>(x reaches y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> mut_m.tso_store_refs m (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
[PROOF STEP]
from xy
[PROOF STATE]
proof (chain)
picking this:
(x reaches y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
[PROOF STEP]
have "(\<exists>m x. ?root m x s \<and> (x reaches y) s) \<and> valid_ref y ?s'"
[PROOF STATE]
proof (prove)
using this:
(x reaches y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))

goal (1 subgoal):
 1. (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (x reaches y) s) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
[PROOF STEP]
unfolding reaches_def
[PROOF STATE]
proof (prove)
using this:
(\<lambda>x y. (x points_to y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)))\<^sup>*\<^sup>* x y

goal (1 subgoal):
 1. (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x y) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
[PROOF STEP]
proof induct
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. (\<exists>m xa. (xa \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey xa s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* xa x) \<and> obj_at (\<lambda>s. True) x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))
 2. \<And>y z. \<lbrakk>(\<lambda>x y. (x points_to y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)))\<^sup>*\<^sup>* x y; (y points_to z) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x y) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x z) \<and> obj_at (\<lambda>s. True) z (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))
[PROOF STEP]
case base
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. (\<exists>m xa. (xa \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey xa s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* xa x) \<and> obj_at (\<lambda>s. True) x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))
 2. \<And>y z. \<lbrakk>(\<lambda>x y. (x points_to y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)))\<^sup>*\<^sup>* x y; (y points_to z) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x y) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x z) \<and> obj_at (\<lambda>s. True) z (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))
[PROOF STEP]
with x sb vri
[PROOF STATE]
proof (chain)
picking this:
x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> mut_m.tso_store_refs m (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
sys_mem_store_buffers (mutator m') s = mw_Mutate r f opt_r' # ws
valid_refs_inv s
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> mut_m.tso_store_refs m (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
sys_mem_store_buffers (mutator m') s = mw_Mutate r f opt_r' # ws
valid_refs_inv s

goal (1 subgoal):
 1. (\<exists>m xa. (xa \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey xa s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* xa x) \<and> obj_at (\<lambda>s. True) x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))
[PROOF STEP]
apply -
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> mut_m.tso_store_refs m (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); sys_mem_store_buffers (mutator m') s = mw_Mutate r f opt_r' # ws; valid_refs_inv s\<rbrakk> \<Longrightarrow> (\<exists>m xa. (xa \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey xa s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* xa x) \<and> obj_at (\<lambda>s. True) x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))
[PROOF STEP]
apply (subst obj_at_fun_upd)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> mut_m.tso_store_refs m (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); sys_mem_store_buffers (mutator m') s = mw_Mutate r f opt_r' # ws; valid_refs_inv s\<rbrakk> \<Longrightarrow> map_option (\<lambda>s. True) (sys_heap (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) x) = map_option (\<lambda>s. True) (sys_heap s x)
 2. \<lbrakk>x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> mut_m.tso_store_refs m (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); sys_mem_store_buffers (mutator m') s = mw_Mutate r f opt_r' # ws; valid_refs_inv s\<rbrakk> \<Longrightarrow> (\<exists>m xa. (xa \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey xa s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* xa x) \<and> obj_at (\<lambda>s. True) x s
[PROOF STEP]
apply (auto simp: mut_m.tso_store_refs_def reaches_def fun_upd_apply split: if_splits intro: valid_refs_invD(5)[where m=m])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xa. \<lbrakk>sys_mem_store_buffers (mutator m') s = mw_Mutate r f opt_r' # ws; valid_refs_inv s; m = m'; xa \<in> set ws; x \<in> (case xa of mw_Mutate r f r' \<Rightarrow> insert r (set_option r') | mw_Mutate_Payload r f pl \<Rightarrow> {r} | _ \<Rightarrow> {})\<rbrakk> \<Longrightarrow> \<exists>m xa. (xa \<in> roots (s (mutator m)) \<or> xa \<in> ghost_honorary_root (s (mutator m)) \<or> (\<exists>xaa\<in>set (sys_mem_store_buffers (mutator m) s). xa \<in> (case xaa of mw_Mutate r f r' \<Rightarrow> insert r (set_option r') | mw_Mutate_Payload r f pl \<Rightarrow> {r} | _ \<Rightarrow> {})) \<or> grey xa s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* xa x
[PROOF STEP]
apply (metis list.set_intros(2) rtranclp.rtrancl_refl)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<exists>m xa. (xa \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey xa s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* xa x) \<and> obj_at (\<lambda>s. True) x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))

goal (1 subgoal):
 1. \<And>y z. \<lbrakk>(\<lambda>x y. (x points_to y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)))\<^sup>*\<^sup>* x y; (y points_to z) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x y) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x z) \<and> obj_at (\<lambda>s. True) z (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))
[PROOF STEP]
(* FIXME rules *)
[PROOF STATE]
proof (state)
this:
(\<exists>m xa. (xa \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey xa s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* xa x) \<and> obj_at (\<lambda>s. True) x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))

goal (1 subgoal):
 1. \<And>y z. \<lbrakk>(\<lambda>x y. (x points_to y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)))\<^sup>*\<^sup>* x y; (y points_to z) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x y) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x z) \<and> obj_at (\<lambda>s. True) z (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>y z. \<lbrakk>(\<lambda>x y. (x points_to y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)))\<^sup>*\<^sup>* x y; (y points_to z) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x y) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x z) \<and> obj_at (\<lambda>s. True) z (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))
[PROOF STEP]
case (step y z)
[PROOF STATE]
proof (state)
this:
(\<lambda>x y. (x points_to y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)))\<^sup>*\<^sup>* x y
(y points_to z) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
(\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x y) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))

goal (1 subgoal):
 1. \<And>y z. \<lbrakk>(\<lambda>x y. (x points_to y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)))\<^sup>*\<^sup>* x y; (y points_to z) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x y) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x z) \<and> obj_at (\<lambda>s. True) z (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))
[PROOF STEP]
with sb vri
[PROOF STATE]
proof (chain)
picking this:
sys_mem_store_buffers (mutator m') s = mw_Mutate r f opt_r' # ws
valid_refs_inv s
(\<lambda>x y. (x points_to y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)))\<^sup>*\<^sup>* x y
(y points_to z) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
(\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x y) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
sys_mem_store_buffers (mutator m') s = mw_Mutate r f opt_r' # ws
valid_refs_inv s
(\<lambda>x y. (x points_to y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)))\<^sup>*\<^sup>* x y
(y points_to z) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
(\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x y) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))

goal (1 subgoal):
 1. (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x z) \<and> obj_at (\<lambda>s. True) z (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))
[PROOF STEP]
apply -
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sys_mem_store_buffers (mutator m') s = mw_Mutate r f opt_r' # ws; valid_refs_inv s; (\<lambda>x y. (x points_to y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)))\<^sup>*\<^sup>* x y; (y points_to z) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x y) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x z) \<and> obj_at (\<lambda>s. True) z (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))
[PROOF STEP]
apply (subst obj_at_fun_upd, clarsimp simp: fun_upd_apply)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sys_mem_store_buffers (mutator m') s = mw_Mutate r f opt_r' # ws; valid_refs_inv s; (\<lambda>x y. (x points_to y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)))\<^sup>*\<^sup>* x y; (y points_to z) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x y) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x z) \<and> obj_at (\<lambda>s. True) z s
[PROOF STEP]
apply (subst (asm) obj_at_fun_upd, fastforce simp: fun_upd_apply)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sys_mem_store_buffers (mutator m') s = mw_Mutate r f opt_r' # ws; valid_refs_inv s; (\<lambda>x y. (x points_to y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)))\<^sup>*\<^sup>* x y; (y points_to z) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x y) \<and> obj_at (\<lambda>s. True) y s\<rbrakk> \<Longrightarrow> (\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x z) \<and> obj_at (\<lambda>s. True) z s
[PROOF STEP]
apply (clarsimp simp: points_to_Mutate fun_upd_apply)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>m xa. \<lbrakk>sys_mem_store_buffers (mutator m') s = mw_Mutate r f opt_r' # ws; valid_refs_inv s; (\<lambda>x y. r \<noteq> x \<and> (x points_to y) s \<or> r = x \<and> obj_at (\<lambda>s. True) r s \<and> (opt_r' = Some y \<or> (x points_to y) s \<and> obj_at (\<lambda>obj. \<exists>f'. obj_fields obj f' = Some y \<and> f \<noteq> f') r s))\<^sup>*\<^sup>* x y; r \<noteq> y \<and> (y points_to z) s \<or> r = y \<and> obj_at (\<lambda>s. True) r s \<and> (opt_r' = Some z \<or> (y points_to z) s \<and> obj_at (\<lambda>obj. \<exists>f'. obj_fields obj f' = Some z \<and> f \<noteq> f') r s); obj_at (\<lambda>s. True) y s; xa \<in> roots (s (mutator m)) \<or> xa \<in> ghost_honorary_root (s (mutator m)) \<or> xa \<in> mut_m.tso_store_refs m s \<or> grey xa s; (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* xa y\<rbrakk> \<Longrightarrow> (\<exists>m x. (x \<in> roots (s (mutator m)) \<or> x \<in> ghost_honorary_root (s (mutator m)) \<or> x \<in> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x z) \<and> obj_at (\<lambda>s. True) z s
[PROOF STEP]
apply (fastforce elim: rtranclp.intros(2) simp: mut_m.tso_store_refs_def reaches_def fun_upd_apply intro: exI[where x=m'] valid_refs_invD(5)[where m=m'])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (\<lambda>x y. (x points_to y) s)\<^sup>*\<^sup>* x z) \<and> obj_at (\<lambda>s. True) z (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (\<lambda>a. sys_mem_store_buffers a s)(mutator m' := ws)\<rparr>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (x reaches y) s) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))

goal (1 subgoal):
 1. \<And>m x y. \<lbrakk>(x reaches y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)); x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) (mutator m)) \<union> mut_m.tso_store_refs m (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))\<rbrakk> \<Longrightarrow> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (x reaches y) s) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
[PROOF STEP]
show "valid_ref y ?s'"
[PROOF STATE]
proof (prove)
using this:
(\<exists>m x. (x \<in> roots (s (mutator m)) \<union> ghost_honorary_root (s (mutator m)) \<union> mut_m.tso_store_refs m s \<or> grey x s) \<and> (x reaches y) s) \<and> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))

goal (1 subgoal):
 1. obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_fields := (obj_fields obj)(f := opt_r')\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m' := ws)\<rparr>))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma retrieve_stored_tval_u64:
  assumes "val = Uint64_v v"
  shows "retrieve_tval (store_tval obj off val) off (memval_type val) b = val"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. retrieve_tval (store_tval obj off val) off (memval_type val) b = val
[PROOF STEP]
unfolding retrieve_tval_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if is_contiguous_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau> then case memval_type val of Uint8 \<Rightarrow> Uint8_v (decode_u8_list (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Sint8 \<Rightarrow> Sint8_v (UCAST(8 \<rightarrow> 8 signed) (decode_u8_list (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>))) | Uint16 \<Rightarrow> Uint16_v (cat_u16 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Sint16 \<Rightarrow> Sint16_v (cat_s16 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Uint32 \<Rightarrow> Uint32_v (cat_u32 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Sint32 \<Rightarrow> Sint32_v (cat_s32 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Uint64 \<Rightarrow> Uint64_v (cat_u64 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Sint64 \<Rightarrow> Sint64_v (cat_s64 (retrieve_bytes (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau>)) | Cap \<Rightarrow> if is_contiguous_zeros (content (store_tval obj off val)) off |memval_type val|\<^sub>\<tau> then Cap_v NULL else Undef else if is_cap (content (store_tval obj off val)) off then let cap = get_cap (content (store_tval obj off val)) off; tv = the (Mapping.lookup (tags (store_tval obj off val)) (cap_offset off)); t = case b of True \<Rightarrow> tv | False \<Rightarrow> False; cv = mem_capability.extend cap \<lparr>tag = t\<rparr>; nth_frag = of_nth (the (Mapping.lookup (content (store_tval obj off val)) off)) in case memval_type val of Uint8 \<Rightarrow> Cap_v_frag (mem_capability.extend cap \<lparr>tag = False\<rparr>) nth_frag | Sint8 \<Rightarrow> Cap_v_frag (mem_capability.extend cap \<lparr>tag = False\<rparr>) nth_frag | Cap \<Rightarrow> if is_contiguous_cap (content (store_tval obj off val)) cap off |memval_type val|\<^sub>\<tau> then Cap_v cv else Undef | _ \<Rightarrow> Undef else Undef) = val
[PROOF STEP]
proof (clarsimp simp add: assms stored_tval_contiguous_bytes; safe)
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint64_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 2. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint64_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
 3. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 4. off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
 5. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 6. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
show "\<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint64_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off));
     is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk>
    \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint64_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
[PROOF STEP]
by (presburger add: decode_encoded_u64_in_mem)
[PROOF STATE]
proof (state)
this:
\<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint64_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v

goal (5 subgoals):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint64_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
 2. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 3. off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
 4. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 5. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint64_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
 2. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 3. off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
 4. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 5. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
show "\<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint64_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off))\<rbrakk>
    \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint64_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
by (metis cctype.simps(79) ccval.distinct(93) ccval.distinct(95) ccval.distinct(97) memval_size_u64 sizeof_def stored_tval_contiguous_bytes)
[PROOF STATE]
proof (state)
this:
\<lbrakk>off \<in> Mapping.keys (content (store_tval obj off (Uint64_v v))); memval_is_cap (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off))\<rbrakk> \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>

goal (4 subgoals):
 1. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 2. off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
 3. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 4. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 2. off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
 3. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 4. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
show "\<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk>
    \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
[PROOF STEP]
by (presburger add: decode_encoded_u64_in_mem)
[PROOF STATE]
proof (state)
this:
\<lbrakk>off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v

goal (3 subgoals):
 1. off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
 2. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 3. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
 2. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 3. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
show "off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
by (metis cctype.simps(79) ccval.distinct(95) ccval.distinct(97) is_cap.elims(1) memval_size_u64 sizeof_def stored_tval_contiguous_bytes stored_tval_is_cap)
[PROOF STATE]
proof (state)
this:
off \<notin> Mapping.keys (content (store_tval obj off (Uint64_v v))) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>

goal (2 subgoals):
 1. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 2. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
 2. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
show "\<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk>
    \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v
[PROOF STEP]
by (presburger add: decode_encoded_u64_in_mem)
[PROOF STATE]
proof (state)
this:
\<lbrakk>memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)); is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>\<rbrakk> \<Longrightarrow> cat_u64 (retrieve_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>) = v

goal (1 subgoal):
 1. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
show "memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>
[PROOF STEP]
by (metis cctype.simps(79) ccval.distinct(93) ccval.distinct(95) ccval.distinct(97) memval_size_u64 sizeof_def stored_tval_contiguous_bytes)
[PROOF STATE]
proof (state)
this:
memval_is_byte (the (Mapping.lookup (content (store_tval obj off (Uint64_v v))) off)) \<Longrightarrow> is_contiguous_bytes (content (store_tval obj off (Uint64_v v))) off |Uint64|\<^sub>\<tau>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "inf_dual fb\<^sub>\<R>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inf_dual fb\<^sub>\<R>
[PROOF STEP]
(*nitpick*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inf_dual fb\<^sub>\<R>
[PROOF STEP]
oops