[STATEMENT]
lemma flush_all_until_volatile_write_update_other:
"\<And>m. \<forall>j < length ts.
                (let (_,_,_,sb\<^sub>j,_,_,_) = ts!j
                 in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))
  \<Longrightarrow>
  flush_all_until_volatile_write ts (m(a := v)) =
    (flush_all_until_volatile_write ts m)(a := v)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>m. \<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write ts (m(a := v)) = (flush_all_until_volatile_write ts m)(a := v)
[PROOF STEP]
proof (induct ts)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>m. \<forall>j<length []. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = [] ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write [] (m(a := v)) = (flush_all_until_volatile_write [] m)(a := v)
 2. \<And>aa ts m. \<lbrakk>\<And>m. \<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write ts (m(a := v)) = (flush_all_until_volatile_write ts m)(a := v); \<forall>j<length (aa # ts). let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (aa # ts) ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> flush_all_until_volatile_write (aa # ts) (m(a := v)) = (flush_all_until_volatile_write (aa # ts) m)(a := v)
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
\<forall>j<length []. let b = [] ! j in case b of (uu_, uua_, uub_, sb\<^sub>j, uuc_, uud_, uue_) \<Rightarrow> a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (2 subgoals):
 1. \<And>m. \<forall>j<length []. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = [] ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write [] (m(a := v)) = (flush_all_until_volatile_write [] m)(a := v)
 2. \<And>aa ts m. \<lbrakk>\<And>m. \<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write ts (m(a := v)) = (flush_all_until_volatile_write ts m)(a := v); \<forall>j<length (aa # ts). let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (aa # ts) ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> flush_all_until_volatile_write (aa # ts) (m(a := v)) = (flush_all_until_volatile_write (aa # ts) m)(a := v)
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<forall>j<length []. let b = [] ! j in case b of (uu_, uua_, uub_, sb\<^sub>j, uuc_, uud_, uue_) \<Rightarrow> a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. flush_all_until_volatile_write [] (m(a := v)) = (flush_all_until_volatile_write [] m)(a := v)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
flush_all_until_volatile_write [] (m(a := v)) = (flush_all_until_volatile_write [] m)(a := v)

goal (1 subgoal):
 1. \<And>aa ts m. \<lbrakk>\<And>m. \<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write ts (m(a := v)) = (flush_all_until_volatile_write ts m)(a := v); \<forall>j<length (aa # ts). let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (aa # ts) ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> flush_all_until_volatile_write (aa # ts) (m(a := v)) = (flush_all_until_volatile_write (aa # ts) m)(a := v)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>aa ts m. \<lbrakk>\<And>m. \<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write ts (m(a := v)) = (flush_all_until_volatile_write ts m)(a := v); \<forall>j<length (aa # ts). let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (aa # ts) ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> flush_all_until_volatile_write (aa # ts) (m(a := v)) = (flush_all_until_volatile_write (aa # ts) m)(a := v)
[PROOF STEP]
case (Cons t ts)
[PROOF STATE]
proof (state)
this:
\<forall>j<length ts. let b = ts ! j in case b of (uu_, uua_, uub_, sb\<^sub>j, uuc_, uud_, uue_) \<Rightarrow> a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write ts (?m(a := v)) = (flush_all_until_volatile_write ts ?m)(a := v)
\<forall>j<length (t # ts). let b = (t # ts) ! j in case b of (uu_, uua_, uub_, sb\<^sub>j, uuc_, uud_, uue_) \<Rightarrow> a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. \<And>aa ts m. \<lbrakk>\<And>m. \<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write ts (m(a := v)) = (flush_all_until_volatile_write ts m)(a := v); \<forall>j<length (aa # ts). let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (aa # ts) ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> flush_all_until_volatile_write (aa # ts) (m(a := v)) = (flush_all_until_volatile_write (aa # ts) m)(a := v)
[PROOF STEP]
note notin = \<open>\<forall>j < length (t#ts).
                (let (_,_,_,sb\<^sub>j,_,_,_) = (t#ts)!j
                 in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))\<close>
[PROOF STATE]
proof (state)
this:
\<forall>j<length (t # ts). let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (t # ts) ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. \<And>aa ts m. \<lbrakk>\<And>m. \<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write ts (m(a := v)) = (flush_all_until_volatile_write ts m)(a := v); \<forall>j<length (aa # ts). let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (aa # ts) ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> flush_all_until_volatile_write (aa # ts) (m(a := v)) = (flush_all_until_volatile_write (aa # ts) m)(a := v)
[PROOF STEP]
hence notin': "\<forall>j < length ts.
                (let (_,_,_,sb\<^sub>j,_,_,_) = ts!j
                 in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j))"
[PROOF STATE]
proof (prove)
using this:
\<forall>j<length (t # ts). let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (t # ts) ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. \<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)

goal (1 subgoal):
 1. \<And>aa ts m. \<lbrakk>\<And>m. \<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write ts (m(a := v)) = (flush_all_until_volatile_write ts m)(a := v); \<forall>j<length (aa # ts). let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (aa # ts) ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> flush_all_until_volatile_write (aa # ts) (m(a := v)) = (flush_all_until_volatile_write (aa # ts) m)(a := v)
[PROOF STEP]
obtain p\<^sub>l "is\<^sub>l" \<O>\<^sub>l \<R>\<^sub>l \<D>\<^sub>l xs\<^sub>l sb\<^sub>l where t: "t = (p\<^sub>l,is\<^sub>l,xs\<^sub>l,sb\<^sub>l,\<D>\<^sub>l,\<O>\<^sub>l,\<R>\<^sub>l)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>p\<^sub>l is\<^sub>l xs\<^sub>l sb\<^sub>l \<D>\<^sub>l \<O>\<^sub>l \<R>\<^sub>l. t = (p\<^sub>l, is\<^sub>l, xs\<^sub>l, sb\<^sub>l, \<D>\<^sub>l, \<O>\<^sub>l, \<R>\<^sub>l) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases t)
[PROOF STATE]
proof (state)
this:
t = (p\<^sub>l, is\<^sub>l, xs\<^sub>l, sb\<^sub>l, \<D>\<^sub>l, \<O>\<^sub>l, \<R>\<^sub>l)

goal (1 subgoal):
 1. \<And>aa ts m. \<lbrakk>\<And>m. \<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write ts (m(a := v)) = (flush_all_until_volatile_write ts m)(a := v); \<forall>j<length (aa # ts). let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (aa # ts) ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> flush_all_until_volatile_write (aa # ts) (m(a := v)) = (flush_all_until_volatile_write (aa # ts) m)(a := v)
[PROOF STEP]
have no_write:
    "outstanding_refs (is_volatile_Write\<^sub>s\<^sub>b) (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) = {}
[PROOF STEP]
by (auto simp add: outstanding_refs_conv dest: set_takeWhileD)
[PROOF STATE]
proof (state)
this:
outstanding_refs is_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) = {}

goal (1 subgoal):
 1. \<And>aa ts m. \<lbrakk>\<And>m. \<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write ts (m(a := v)) = (flush_all_until_volatile_write ts m)(a := v); \<forall>j<length (aa # ts). let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (aa # ts) ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> flush_all_until_volatile_write (aa # ts) (m(a := v)) = (flush_all_until_volatile_write (aa # ts) m)(a := v)
[PROOF STEP]
from notin [rule_format, of 0] t
[PROOF STATE]
proof (chain)
picking this:
0 < length (t # ts) \<Longrightarrow> let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (t # ts) ! 0 in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
t = (p\<^sub>l, is\<^sub>l, xs\<^sub>l, sb\<^sub>l, \<D>\<^sub>l, \<O>\<^sub>l, \<R>\<^sub>l)
[PROOF STEP]
have a_notin:
    "a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l)"
[PROOF STATE]
proof (prove)
using this:
0 < length (t # ts) \<Longrightarrow> let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (t # ts) ! 0 in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)
t = (p\<^sub>l, is\<^sub>l, xs\<^sub>l, sb\<^sub>l, \<D>\<^sub>l, \<O>\<^sub>l, \<R>\<^sub>l)

goal (1 subgoal):
 1. a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l)
[PROOF STEP]
by (auto )
[PROOF STATE]
proof (state)
this:
a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l)

goal (1 subgoal):
 1. \<And>aa ts m. \<lbrakk>\<And>m. \<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write ts (m(a := v)) = (flush_all_until_volatile_write ts m)(a := v); \<forall>j<length (aa # ts). let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (aa # ts) ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> flush_all_until_volatile_write (aa # ts) (m(a := v)) = (flush_all_until_volatile_write (aa # ts) m)(a := v)
[PROOF STEP]
from flush_update_other' [OF a_notin no_write]
[PROOF STATE]
proof (chain)
picking this:
flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) (?m(a := ?v)) = (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) ?m)(a := ?v)
[PROOF STEP]
have "(flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) (m(a := v))) =
          (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) m)(a := v)"
[PROOF STATE]
proof (prove)
using this:
flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) (?m(a := ?v)) = (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) ?m)(a := ?v)

goal (1 subgoal):
 1. flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) (m(a := v)) = (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) m)(a := v)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) (m(a := v)) = (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) m)(a := v)

goal (1 subgoal):
 1. \<And>aa ts m. \<lbrakk>\<And>m. \<forall>j<length ts. let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = ts ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j) \<Longrightarrow> flush_all_until_volatile_write ts (m(a := v)) = (flush_all_until_volatile_write ts m)(a := v); \<forall>j<length (aa # ts). let (uu_, uu_, uu_, sb\<^sub>j, uu_, uu_, uu_) = (aa # ts) ! j in a \<notin> outstanding_refs is_non_volatile_Write\<^sub>s\<^sub>b (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>j)\<rbrakk> \<Longrightarrow> flush_all_until_volatile_write (aa # ts) (m(a := v)) = (flush_all_until_volatile_write (aa # ts) m)(a := v)
[PROOF STEP]
with Cons.hyps [OF notin', of "(flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) m)"]
[PROOF STATE]
proof (chain)
picking this:
flush_all_until_volatile_write ts ((flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) m)(a := v)) = (flush_all_until_volatile_write ts (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) m))(a := v)
flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) (m(a := v)) = (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) m)(a := v)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
flush_all_until_volatile_write ts ((flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) m)(a := v)) = (flush_all_until_volatile_write ts (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) m))(a := v)
flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) (m(a := v)) = (flush (takeWhile (Not \<circ> is_volatile_Write\<^sub>s\<^sub>b) sb\<^sub>l) m)(a := v)

goal (1 subgoal):
 1. flush_all_until_volatile_write (t # ts) (m(a := v)) = (flush_all_until_volatile_write (t # ts) m)(a := v)
[PROOF STEP]
by (simp add: t del: fun_upd_apply)
[PROOF STATE]
proof (state)
this:
flush_all_until_volatile_write (t # ts) (m(a := v)) = (flush_all_until_volatile_write (t # ts) m)(a := v)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma set_child_nodes_get_tag_name_is_l_set_child_nodes_get_tag_name [instances]:
  "l_set_child_nodes_get_tag_name type_wf set_child_nodes set_child_nodes_locs get_tag_name
  get_tag_name_locs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. l_set_child_nodes_get_tag_name ShadowRootClass.type_wf Shadow_DOM.set_child_nodes Shadow_DOM.set_child_nodes_locs get_tag_name get_tag_name_locs
[PROOF STEP]
apply(auto simp add: l_set_child_nodes_get_tag_name_def l_set_child_nodes_get_tag_name_axioms_def
      instances)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ptr h h' w ptr' r. \<lbrakk>w \<in> Shadow_DOM.set_child_nodes_locs ptr; h \<turnstile> w \<rightarrow>\<^sub>h h'; r \<in> get_tag_name_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
using set_child_nodes_get_tag_name
[PROOF STATE]
proof (prove)
using this:
\<forall>w\<in>Shadow_DOM.set_child_nodes_locs ?ptr. ?h \<turnstile> w \<rightarrow>\<^sub>h ?h' \<longrightarrow> (\<forall>r\<in>get_tag_name_locs ?ptr'. r ?h ?h')

goal (1 subgoal):
 1. \<And>ptr h h' w ptr' r. \<lbrakk>w \<in> Shadow_DOM.set_child_nodes_locs ptr; h \<turnstile> w \<rightarrow>\<^sub>h h'; r \<in> get_tag_name_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
by fast


[STATEMENT]
lemma "P (The P)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (The P)
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (The P)
[PROOF STEP]
oops


[STATEMENT]
lemma constructive_security_obsf'_into_constructive_security:
  assumes "\<And>\<A> :: security \<Rightarrow> ('a + 'b, 'c + 'd) distinguisher_obsf.
   \<lbrakk>  \<And>\<eta>. interaction_bounded_by (\<lambda>_. True) (\<A> \<eta>) (bound \<eta>);
      \<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (exception_\<I> (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>)) (\<A> \<eta>) \<rbrakk>
   \<Longrightarrow> constructive_security_obsf' real_resource ideal_resource sim \<I>_real \<I>_ideal \<I>_common \<A>"
    and correct: "\<exists>cnv. \<forall>\<D>. (\<forall>\<eta>. \<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<D> \<eta> \<surd>) \<longrightarrow>
               (\<forall>\<eta>. interaction_any_bounded_by (\<D> \<eta>) (bound \<eta>)) \<longrightarrow>
               (\<forall>\<eta>. lossless \<longrightarrow> plossless_gpv (\<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<D> \<eta>)) \<longrightarrow>
               (\<forall>\<eta>. wiring (\<I>_ideal \<eta>) (\<I>_real \<eta>) (cnv \<eta>) (w \<eta>)) \<and>
               Negligible.negligible (\<lambda>\<eta>. advantage (\<D> \<eta>) (ideal_resource \<eta>) (cnv \<eta> |\<^sub>= 1\<^sub>C \<rhd> real_resource \<eta>))"
  shows "constructive_security real_resource ideal_resource sim \<I>_real \<I>_ideal \<I>_common bound lossless w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. constructive_security real_resource ideal_resource sim \<I>_real \<I>_ideal \<I>_common bound lossless w
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>\<eta>. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>res real_resource \<eta> \<surd>
 2. \<And>\<eta>. \<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>res ideal_resource \<eta> \<surd>
 3. \<And>\<eta>. \<I>_real \<eta>, \<I>_ideal \<eta> \<turnstile>\<^sub>C sim \<eta> \<surd>
 4. \<And>\<A>. \<lbrakk>\<And>\<eta>. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<A> \<eta> \<surd>; \<And>\<eta>. interaction_any_bounded_by (\<A> \<eta>) (bound \<eta>); \<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<A> \<eta>)\<rbrakk> \<Longrightarrow> Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))
 5. \<exists>cnv. \<forall>\<D>. (\<forall>\<eta>. \<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<D> \<eta> \<surd>) \<longrightarrow> (\<forall>\<eta>. interaction_any_bounded_by (\<D> \<eta>) (bound \<eta>)) \<longrightarrow> (\<forall>\<eta>. lossless \<longrightarrow> plossless_gpv (\<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<D> \<eta>)) \<longrightarrow> (\<forall>\<eta>. wiring (\<I>_ideal \<eta>) (\<I>_real \<eta>) (cnv \<eta>) (w \<eta>)) \<and> Negligible.negligible (\<lambda>\<eta>. advantage (\<D> \<eta>) (ideal_resource \<eta>) (cnv \<eta> |\<^sub>= 1\<^sub>C \<rhd> real_resource \<eta>))
[PROOF STEP]
interpret constructive_security_obsf' real_resource ideal_resource sim \<I>_real \<I>_ideal \<I>_common \<open>\<lambda>_. Done undefined\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. constructive_security_obsf' real_resource ideal_resource sim \<I>_real \<I>_ideal \<I>_common (\<lambda>_. Done undefined)
[PROOF STEP]
by(rule assms) simp_all
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>\<eta>. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>res real_resource \<eta> \<surd>
 2. \<And>\<eta>. \<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>res ideal_resource \<eta> \<surd>
 3. \<And>\<eta>. \<I>_real \<eta>, \<I>_ideal \<eta> \<turnstile>\<^sub>C sim \<eta> \<surd>
 4. \<And>\<A>. \<lbrakk>\<And>\<eta>. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<A> \<eta> \<surd>; \<And>\<eta>. interaction_any_bounded_by (\<A> \<eta>) (bound \<eta>); \<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<A> \<eta>)\<rbrakk> \<Longrightarrow> Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))
 5. \<exists>cnv. \<forall>\<D>. (\<forall>\<eta>. \<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<D> \<eta> \<surd>) \<longrightarrow> (\<forall>\<eta>. interaction_any_bounded_by (\<D> \<eta>) (bound \<eta>)) \<longrightarrow> (\<forall>\<eta>. lossless \<longrightarrow> plossless_gpv (\<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<D> \<eta>)) \<longrightarrow> (\<forall>\<eta>. wiring (\<I>_ideal \<eta>) (\<I>_real \<eta>) (cnv \<eta>) (w \<eta>)) \<and> Negligible.negligible (\<lambda>\<eta>. advantage (\<D> \<eta>) (ideal_resource \<eta>) (cnv \<eta> |\<^sub>= 1\<^sub>C \<rhd> real_resource \<eta>))
[PROOF STEP]
show "\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>res real_resource \<eta> \<surd>"
    and "\<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>res ideal_resource \<eta> \<surd>"
    and "\<I>_real \<eta>, \<I>_ideal \<eta> \<turnstile>\<^sub>C sim \<eta> \<surd>" for \<eta>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>res real_resource \<eta> \<surd> &&& \<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>res ideal_resource \<eta> \<surd> &&& \<I>_real \<eta>, \<I>_ideal \<eta> \<turnstile>\<^sub>C sim \<eta> \<surd>
[PROOF STEP]
by(rule WT_intro)+
[PROOF STATE]
proof (state)
this:
\<I>_real ?\<eta> \<oplus>\<^sub>\<I> \<I>_common ?\<eta> \<turnstile>res real_resource ?\<eta> \<surd>
\<I>_ideal ?\<eta> \<oplus>\<^sub>\<I> \<I>_common ?\<eta> \<turnstile>res ideal_resource ?\<eta> \<surd>
\<I>_real ?\<eta>, \<I>_ideal ?\<eta> \<turnstile>\<^sub>C sim ?\<eta> \<surd>

goal (2 subgoals):
 1. \<And>\<A>. \<lbrakk>\<And>\<eta>. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<A> \<eta> \<surd>; \<And>\<eta>. interaction_any_bounded_by (\<A> \<eta>) (bound \<eta>); \<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<A> \<eta>)\<rbrakk> \<Longrightarrow> Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))
 2. \<exists>cnv. \<forall>\<D>. (\<forall>\<eta>. \<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<D> \<eta> \<surd>) \<longrightarrow> (\<forall>\<eta>. interaction_any_bounded_by (\<D> \<eta>) (bound \<eta>)) \<longrightarrow> (\<forall>\<eta>. lossless \<longrightarrow> plossless_gpv (\<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<D> \<eta>)) \<longrightarrow> (\<forall>\<eta>. wiring (\<I>_ideal \<eta>) (\<I>_real \<eta>) (cnv \<eta>) (w \<eta>)) \<and> Negligible.negligible (\<lambda>\<eta>. advantage (\<D> \<eta>) (ideal_resource \<eta>) (cnv \<eta> |\<^sub>= 1\<^sub>C \<rhd> real_resource \<eta>))
[PROOF STEP]
show "\<exists>cnv. \<forall>\<D>. (\<forall>\<eta>. \<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<D> \<eta> \<surd>) \<longrightarrow>
               (\<forall>\<eta>. interaction_any_bounded_by (\<D> \<eta>) (bound \<eta>)) \<longrightarrow>
               (\<forall>\<eta>. lossless \<longrightarrow> plossless_gpv (\<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<D> \<eta>)) \<longrightarrow>
               (\<forall>\<eta>. wiring (\<I>_ideal \<eta>) (\<I>_real \<eta>) (cnv \<eta>) (w \<eta>)) \<and>
               Negligible.negligible (\<lambda>\<eta>. advantage (\<D> \<eta>) (ideal_resource \<eta>) (cnv \<eta> |\<^sub>= 1\<^sub>C \<rhd> real_resource \<eta>))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>cnv. \<forall>\<D>. (\<forall>\<eta>. \<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<D> \<eta> \<surd>) \<longrightarrow> (\<forall>\<eta>. interaction_any_bounded_by (\<D> \<eta>) (bound \<eta>)) \<longrightarrow> (\<forall>\<eta>. lossless \<longrightarrow> plossless_gpv (\<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<D> \<eta>)) \<longrightarrow> (\<forall>\<eta>. wiring (\<I>_ideal \<eta>) (\<I>_real \<eta>) (cnv \<eta>) (w \<eta>)) \<and> Negligible.negligible (\<lambda>\<eta>. advantage (\<D> \<eta>) (ideal_resource \<eta>) (cnv \<eta> |\<^sub>= 1\<^sub>C \<rhd> real_resource \<eta>))
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
this:
\<exists>cnv. \<forall>\<D>. (\<forall>\<eta>. \<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<D> \<eta> \<surd>) \<longrightarrow> (\<forall>\<eta>. interaction_any_bounded_by (\<D> \<eta>) (bound \<eta>)) \<longrightarrow> (\<forall>\<eta>. lossless \<longrightarrow> plossless_gpv (\<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<D> \<eta>)) \<longrightarrow> (\<forall>\<eta>. wiring (\<I>_ideal \<eta>) (\<I>_real \<eta>) (cnv \<eta>) (w \<eta>)) \<and> Negligible.negligible (\<lambda>\<eta>. advantage (\<D> \<eta>) (ideal_resource \<eta>) (cnv \<eta> |\<^sub>= 1\<^sub>C \<rhd> real_resource \<eta>))

goal (1 subgoal):
 1. \<And>\<A>. \<lbrakk>\<And>\<eta>. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<A> \<eta> \<surd>; \<And>\<eta>. interaction_any_bounded_by (\<A> \<eta>) (bound \<eta>); \<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<A> \<eta>)\<rbrakk> \<Longrightarrow> Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<A>. \<lbrakk>\<And>\<eta>. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<A> \<eta> \<surd>; \<And>\<eta>. interaction_any_bounded_by (\<A> \<eta>) (bound \<eta>); \<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<A> \<eta>)\<rbrakk> \<Longrightarrow> Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))
[PROOF STEP]
fix \<A> :: "security \<Rightarrow> ('a + 'b, 'c + 'd) distinguisher"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<A>. \<lbrakk>\<And>\<eta>. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<A> \<eta> \<surd>; \<And>\<eta>. interaction_any_bounded_by (\<A> \<eta>) (bound \<eta>); \<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<A> \<eta>)\<rbrakk> \<Longrightarrow> Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))
[PROOF STEP]
assume WT_adv [WT_intro]: "\<And>\<eta>. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<A> \<eta> \<surd>"
    and bound [interaction_bound]: "\<And>\<eta>. interaction_any_bounded_by (\<A> \<eta>) (bound \<eta>)"
    and lossless: "\<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<A> \<eta>)"
[PROOF STATE]
proof (state)
this:
\<I>_real ?\<eta> \<oplus>\<^sub>\<I> \<I>_common ?\<eta> \<turnstile>g \<A> ?\<eta> \<surd>
interaction_any_bounded_by (\<A> ?\<eta>) (bound ?\<eta>)
lossless \<Longrightarrow> plossless_gpv (\<I>_real ?\<eta> \<oplus>\<^sub>\<I> \<I>_common ?\<eta>) (\<A> ?\<eta>)

goal (1 subgoal):
 1. \<And>\<A>. \<lbrakk>\<And>\<eta>. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<A> \<eta> \<surd>; \<And>\<eta>. interaction_any_bounded_by (\<A> \<eta>) (bound \<eta>); \<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<A> \<eta>)\<rbrakk> \<Longrightarrow> Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))
[PROOF STEP]
let ?\<A> = "\<lambda>\<eta>. obsf_distinguisher (\<A> \<eta>)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<A>. \<lbrakk>\<And>\<eta>. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<A> \<eta> \<surd>; \<And>\<eta>. interaction_any_bounded_by (\<A> \<eta>) (bound \<eta>); \<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<A> \<eta>)\<rbrakk> \<Longrightarrow> Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))
[PROOF STEP]
interpret constructive_security_obsf' real_resource ideal_resource sim \<I>_real \<I>_ideal \<I>_common ?\<A>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. constructive_security_obsf' real_resource ideal_resource sim \<I>_real \<I>_ideal \<I>_common (\<lambda>\<eta>. obsf_distinguisher (\<A> \<eta>))
[PROOF STEP]
proof(rule assms)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<eta>. interaction_any_bounded_by (obsf_distinguisher (\<A> \<eta>)) (bound \<eta>)
 2. \<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (exception_\<I> (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>)) (obsf_distinguisher (\<A> \<eta>))
[PROOF STEP]
show "interaction_any_bounded_by (?\<A> \<eta>) (bound \<eta>)" for \<eta>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. interaction_any_bounded_by (obsf_distinguisher (\<A> \<eta>)) (bound \<eta>)
[PROOF STEP]
by(rule interaction_bound)+
[PROOF STATE]
proof (state)
this:
interaction_any_bounded_by (obsf_distinguisher (\<A> ?\<eta>)) (bound ?\<eta>)

goal (1 subgoal):
 1. \<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (exception_\<I> (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>)) (obsf_distinguisher (\<A> \<eta>))
[PROOF STEP]
show "plossless_gpv (exception_\<I> (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>)) (?\<A> \<eta>)" if lossless for \<eta>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. plossless_gpv (exception_\<I> (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>)) (obsf_distinguisher (\<A> \<eta>))
[PROOF STEP]
using WT_adv[of \<eta>] lossless that
[PROOF STATE]
proof (prove)
using this:
\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<A> \<eta> \<surd>
lossless \<Longrightarrow> plossless_gpv (\<I>_real ?\<eta> \<oplus>\<^sub>\<I> \<I>_common ?\<eta>) (\<A> ?\<eta>)
lossless

goal (1 subgoal):
 1. plossless_gpv (exception_\<I> (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>)) (obsf_distinguisher (\<A> \<eta>))
[PROOF STEP]
by(simp)
[PROOF STATE]
proof (state)
this:
lossless \<Longrightarrow> plossless_gpv (exception_\<I> (\<I>_real ?\<eta> \<oplus>\<^sub>\<I> \<I>_common ?\<eta>)) (obsf_distinguisher (\<A> ?\<eta>))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>\<A>. \<lbrakk>\<And>\<eta>. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<A> \<eta> \<surd>; \<And>\<eta>. interaction_any_bounded_by (\<A> \<eta>) (bound \<eta>); \<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<A> \<eta>)\<rbrakk> \<Longrightarrow> Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))
[PROOF STEP]
have "negligible (\<lambda>\<eta>. advantage (?\<A> \<eta>) (obsf_resource (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>)) (obsf_resource (real_resource \<eta>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Negligible.negligible (\<lambda>\<eta>. advantage (obsf_distinguisher (\<A> \<eta>)) (obsf_resource (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>)) (obsf_resource (real_resource \<eta>)))
[PROOF STEP]
by(rule adv)(rule WT_intro)+
[PROOF STATE]
proof (state)
this:
Negligible.negligible (\<lambda>\<eta>. advantage (obsf_distinguisher (\<A> \<eta>)) (obsf_resource (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>)) (obsf_resource (real_resource \<eta>)))

goal (1 subgoal):
 1. \<And>\<A>. \<lbrakk>\<And>\<eta>. \<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta> \<turnstile>g \<A> \<eta> \<surd>; \<And>\<eta>. interaction_any_bounded_by (\<A> \<eta>) (bound \<eta>); \<And>\<eta>. lossless \<Longrightarrow> plossless_gpv (\<I>_real \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>) (\<A> \<eta>)\<rbrakk> \<Longrightarrow> Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Negligible.negligible (\<lambda>\<eta>. advantage (obsf_distinguisher (\<A> \<eta>)) (obsf_resource (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>)) (obsf_resource (real_resource \<eta>)))
[PROOF STEP]
show "negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))"
[PROOF STATE]
proof (prove)
using this:
Negligible.negligible (\<lambda>\<eta>. advantage (obsf_distinguisher (\<A> \<eta>)) (obsf_resource (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>)) (obsf_resource (real_resource \<eta>)))

goal (1 subgoal):
 1. Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))
[PROOF STEP]
unfolding advantage_obsf_distinguisher
[PROOF STATE]
proof (prove)
using this:
Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))

goal (1 subgoal):
 1. Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
Negligible.negligible (\<lambda>\<eta>. advantage (\<A> \<eta>) (sim \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal_resource \<eta>) (real_resource \<eta>))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma edka3_refine: "edka3 \<le> \<Down>Id edka2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. edka3 \<le> \<Down> Id edka2
[PROOF STEP]
unfolding edka3_def edka2_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (let cf = c in while\<^sub>T (\<lambda>(cf, brk). \<not> brk) (\<lambda>(cf, uu_). assert (RGraph c s t cf) \<bind> (\<lambda>_. find_shortest_augmenting_spec_cf cf \<bind> (\<lambda>p. case p of None \<Rightarrow> return (cf, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (Graph.isShortestPath cf s p t) \<bind> (\<lambda>_. resCap_cf_impl cf p \<bind> (\<lambda>bn. augment_cf_impl cf p bn \<bind> (\<lambda>cf. assert (RGraph c s t cf) \<bind> (\<lambda>_. return (cf, False))))))))) (cf, False) \<bind> (\<lambda>(cf, uu_). assert (RGraph c s t cf) \<bind> (\<lambda>_. Let (flow_of_cf cf) return))) \<le> \<Down> Id (let cf = c in while\<^sub>T (\<lambda>(cf, brk). \<not> brk) (\<lambda>(cf, uu_). assert (RGraph c s t cf) \<bind> (\<lambda>_. find_shortest_augmenting_spec_cf cf \<bind> (\<lambda>p. case p of None \<Rightarrow> return (cf, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (Graph.isShortestPath cf s p t) \<bind> (\<lambda>_. let cf = Graph.augment_cf cf (set p) (resCap_cf cf p) in assert (RGraph c s t cf) \<bind> (\<lambda>_. return (cf, False))))))) (cf, False) \<bind> (\<lambda>(cf, uu_). assert (RGraph c s t cf) \<bind> (\<lambda>_. Let (flow_of_cf cf) return)))
[PROOF STEP]
apply (rewrite in "let cf = Graph.augment_cf _ _ _ in _" Let_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (let cf = c in while\<^sub>T (\<lambda>(cf, brk). \<not> brk) (\<lambda>(cf, uu_). assert (RGraph c s t cf) \<bind> (\<lambda>_. find_shortest_augmenting_spec_cf cf \<bind> (\<lambda>p. case p of None \<Rightarrow> return (cf, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (Graph.isShortestPath cf s p t) \<bind> (\<lambda>_. resCap_cf_impl cf p \<bind> (\<lambda>bn. augment_cf_impl cf p bn \<bind> (\<lambda>cf. assert (RGraph c s t cf) \<bind> (\<lambda>_. return (cf, False))))))))) (cf, False) \<bind> (\<lambda>(cf, uu_). assert (RGraph c s t cf) \<bind> (\<lambda>_. Let (flow_of_cf cf) return))) \<le> \<Down> Id (let cf = c in while\<^sub>T (\<lambda>(cf, brk). \<not> brk) (\<lambda>(cf, uu_). assert (RGraph c s t cf) \<bind> (\<lambda>_. find_shortest_augmenting_spec_cf cf \<bind> (\<lambda>p. case p of None \<Rightarrow> return (cf, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (Graph.isShortestPath cf s p t) \<bind> (\<lambda>_. assert (RGraph c s t (Graph.augment_cf cf (set p) (resCap_cf cf p))) \<bind> (\<lambda>_. return (Graph.augment_cf cf (set p) (resCap_cf cf p), False))))))) (cf, False) \<bind> (\<lambda>(cf, uu_). assert (RGraph c s t cf) \<bind> (\<lambda>_. Let (flow_of_cf cf) return)))
[PROOF STEP]
apply refine_rcg
[PROOF STATE]
proof (prove)
goal (11 subgoals):
 1. ((c, False), c, False) \<in> ?R'4
 2. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> ?R'4; x = (x1, x2); x' = (x1a, x2a)\<rbrakk> \<Longrightarrow> (\<not> x2) = (\<not> x2a)
 3. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> ?R'4; case x of (cf, brk) \<Rightarrow> \<not> brk; case x' of (cf, brk) \<Rightarrow> \<not> brk; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1\<rbrakk> \<Longrightarrow> RGraph c s t x1a
 4. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> ?R'4; case x of (cf, brk) \<Rightarrow> \<not> brk; case x' of (cf, brk) \<Rightarrow> \<not> brk; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1; RGraph c s t x1a\<rbrakk> \<Longrightarrow> find_shortest_augmenting_spec_cf x1a \<le> \<Down> (?R'36 x x' x1 x2 x1a x2a) (find_shortest_augmenting_spec_cf x1)
 5. \<And>x x' x1 x2 x1a x2a p pa. \<lbrakk>(x, x') \<in> ?R'4; case x of (cf, brk) \<Rightarrow> \<not> brk; case x' of (cf, brk) \<Rightarrow> \<not> brk; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1; RGraph c s t x1a; (p, pa) \<in> ?R'36 x x' x1 x2 x1a x2a\<rbrakk> \<Longrightarrow> (p, pa) \<in> \<langle>?Ra37 x x' x1 x2 x1a x2a p pa\<rangle>option_rel
 6. \<And>x x' x1 x2 x1a x2a p pa. \<lbrakk>(x, x') \<in> ?R'4; case x of (cf, brk) \<Rightarrow> \<not> brk; case x' of (cf, brk) \<Rightarrow> \<not> brk; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1; RGraph c s t x1a; (p, pa) \<in> ?R'36 x x' x1 x2 x1a x2a; p = None; pa = None\<rbrakk> \<Longrightarrow> ((x1a, True), x1, True) \<in> ?R'4
 7. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> ?R'4; case x of (cf, brk) \<Rightarrow> \<not> brk; case x' of (cf, brk) \<Rightarrow> \<not> brk; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1; RGraph c s t x1a; (p, pa) \<in> ?R'36 x x' x1 x2 x1a x2a; p = Some xa; pa = Some x'a; (xa, x'a) \<in> ?Ra37 x x' x1 x2 x1a x2a p pa; x'a \<noteq> []; Graph.isShortestPath x1 s x'a t; RGraph c s t (Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a))\<rbrakk> \<Longrightarrow> xa \<noteq> []
 8. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> ?R'4; case x of (cf, brk) \<Rightarrow> \<not> brk; case x' of (cf, brk) \<Rightarrow> \<not> brk; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1; RGraph c s t x1a; (p, pa) \<in> ?R'36 x x' x1 x2 x1a x2a; p = Some xa; pa = Some x'a; (xa, x'a) \<in> ?Ra37 x x' x1 x2 x1a x2a p pa; x'a \<noteq> []; Graph.isShortestPath x1 s x'a t; RGraph c s t (Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a)); xa \<noteq> []\<rbrakk> \<Longrightarrow> Graph.isShortestPath x1a s xa t
 9. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> ?R'4; case x of (cf, brk) \<Rightarrow> \<not> brk; case x' of (cf, brk) \<Rightarrow> \<not> brk; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1; RGraph c s t x1a; (p, pa) \<in> ?R'36 x x' x1 x2 x1a x2a; p = Some xa; pa = Some x'a; (xa, x'a) \<in> ?Ra37 x x' x1 x2 x1a x2a p pa; x'a \<noteq> []; Graph.isShortestPath x1 s x'a t; RGraph c s t (Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a)); xa \<noteq> []; Graph.isShortestPath x1a s xa t\<rbrakk> \<Longrightarrow> resCap_cf_impl x1a xa \<bind> (\<lambda>bn. augment_cf_impl x1a xa bn \<bind> (\<lambda>cf. assert (RGraph c s t cf) \<bind> (\<lambda>_. return (cf, False)))) \<le> (spec c. (c, Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a), False) \<in> ?R'4)
 10. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> ?R'4; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1\<rbrakk> \<Longrightarrow> RGraph c s t x1a
A total of 11 subgoals...
[PROOF STEP]
apply refine_dref_type
[PROOF STATE]
proof (prove)
goal (10 subgoals):
 1. ((c, False), c, False) \<in> Id \<times>\<^sub>r bool_rel
 2. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; x = (x1, x2); x' = (x1a, x2a)\<rbrakk> \<Longrightarrow> (\<not> x2) = (\<not> x2a)
 3. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (cf, brk) \<Rightarrow> \<not> brk; case x' of (cf, brk) \<Rightarrow> \<not> brk; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1\<rbrakk> \<Longrightarrow> RGraph c s t x1a
 4. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (cf, brk) \<Rightarrow> \<not> brk; case x' of (cf, brk) \<Rightarrow> \<not> brk; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1; RGraph c s t x1a\<rbrakk> \<Longrightarrow> find_shortest_augmenting_spec_cf x1a \<le> \<Down> (\<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel) (find_shortest_augmenting_spec_cf x1)
 5. \<And>x x' x1 x2 x1a x2a p pa. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (cf, brk) \<Rightarrow> \<not> brk; case x' of (cf, brk) \<Rightarrow> \<not> brk; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1; RGraph c s t x1a; (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; p = None; pa = None\<rbrakk> \<Longrightarrow> ((x1a, True), x1, True) \<in> Id \<times>\<^sub>r bool_rel
 6. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (cf, brk) \<Rightarrow> \<not> brk; case x' of (cf, brk) \<Rightarrow> \<not> brk; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1; RGraph c s t x1a; (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; Graph.isShortestPath x1 s x'a t; RGraph c s t (Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a))\<rbrakk> \<Longrightarrow> xa \<noteq> []
 7. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (cf, brk) \<Rightarrow> \<not> brk; case x' of (cf, brk) \<Rightarrow> \<not> brk; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1; RGraph c s t x1a; (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; Graph.isShortestPath x1 s x'a t; RGraph c s t (Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a)); xa \<noteq> []\<rbrakk> \<Longrightarrow> Graph.isShortestPath x1a s xa t
 8. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (cf, brk) \<Rightarrow> \<not> brk; case x' of (cf, brk) \<Rightarrow> \<not> brk; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1; RGraph c s t x1a; (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; Graph.isShortestPath x1 s x'a t; RGraph c s t (Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a)); xa \<noteq> []; Graph.isShortestPath x1a s xa t\<rbrakk> \<Longrightarrow> resCap_cf_impl x1a xa \<bind> (\<lambda>bn. augment_cf_impl x1a xa bn \<bind> (\<lambda>cf. assert (RGraph c s t cf) \<bind> (\<lambda>_. return (cf, False)))) \<le> (spec c. (c, Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a), False) \<in> Id \<times>\<^sub>r bool_rel)
 9. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1\<rbrakk> \<Longrightarrow> RGraph c s t x1a
 10. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; x' = (x1, x2); x = (x1a, x2a); RGraph c s t x1; RGraph c s t x1a\<rbrakk> \<Longrightarrow> (flow_of_cf x1a, flow_of_cf x1) \<in> Id
[PROOF STEP]
apply (vc_solve)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x2a x'a. \<lbrakk>\<not> x2a; \<not> x2; RGraph c s t x1; x'a \<noteq> []; Graph.isShortestPath x1 s x'a t; RGraph c s t (Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a))\<rbrakk> \<Longrightarrow> resCap_cf_impl x1 x'a \<bind> (\<lambda>bn. augment_cf_impl x1 x'a bn \<bind> (\<lambda>cf. assert (RGraph c s t cf) \<bind> (\<lambda>_. return (cf, False)))) \<le> RES {(Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a), False)}
[PROOF STEP]
apply (drule Graph.shortestPath_is_simple)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x2a x'a. \<lbrakk>\<not> x2a; \<not> x2; RGraph c s t x1; x'a \<noteq> []; RGraph c s t (Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a)); Graph.isSimplePath x1 s x'a t\<rbrakk> \<Longrightarrow> resCap_cf_impl x1 x'a \<bind> (\<lambda>bn. augment_cf_impl x1 x'a bn \<bind> (\<lambda>cf. assert (RGraph c s t cf) \<bind> (\<lambda>_. return (cf, False)))) \<le> RES {(Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a), False)}
[PROOF STEP]
apply (frule (1) RGraph.resCap_cf_impl_refine)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x2a x'a. \<lbrakk>\<not> x2a; \<not> x2; RGraph c s t x1; x'a \<noteq> []; RGraph c s t (Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a)); Graph.isSimplePath x1 s x'a t; resCap_cf_impl x1 x'a \<le> (spec r. r = resCap_cf x1 x'a)\<rbrakk> \<Longrightarrow> resCap_cf_impl x1 x'a \<bind> (\<lambda>bn. augment_cf_impl x1 x'a bn \<bind> (\<lambda>cf. assert (RGraph c s t cf) \<bind> (\<lambda>_. return (cf, False)))) \<le> RES {(Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a), False)}
[PROOF STEP]
apply (frule (1) RGraph.augment_cf_impl_refine)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 x2a x'a. \<lbrakk>\<not> x2a; \<not> x2; RGraph c s t x1; x'a \<noteq> []; RGraph c s t (Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a)); Graph.isSimplePath x1 s x'a t; resCap_cf_impl x1 x'a \<le> (spec r. r = resCap_cf x1 x'a); augment_cf_impl x1 x'a (?x97 x1 x2 x2a x'a) \<le> return (Graph.augment_cf x1 (set x'a) (?x97 x1 x2 x2a x'a))\<rbrakk> \<Longrightarrow> resCap_cf_impl x1 x'a \<bind> (\<lambda>bn. augment_cf_impl x1 x'a bn \<bind> (\<lambda>cf. assert (RGraph c s t cf) \<bind> (\<lambda>_. return (cf, False)))) \<le> RES {(Graph.augment_cf x1 (set x'a) (resCap_cf x1 x'a), False)}
[PROOF STEP]
apply (auto simp: pw_le_iff refine_pw_simps)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "x \<cdot> ad 1 = ad 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<cdot> ad (1::'a) = ad (1::'a)
[PROOF STEP]
(*nitpick [expect=genuine]*)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<cdot> ad (1::'a) = ad (1::'a)
[PROOF STEP]
oops


[STATEMENT]
lemma vebt_predi_refines: "refines (vebt_predi ti  x) (vebt_predi' t ti x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. refines (vebt_predi ti x) (vebt_predi' t ti x)
[PROOF STEP]
apply (induction arbitrary: t ti x rule: vebt_predi'.fixp_induct)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. heap.admissible (\<lambda>vebt_predi'. \<forall>x xa xb. refines (vebt_predi xa xb) (curry (curry vebt_predi') x xa xb))
 2. \<And>t ti x. refines (vebt_predi ti x) (Heap.Heap Map.empty)
 3. \<And>f t ti x. (\<And>t ti x. refines (vebt_predi ti x) (f t ti x)) \<Longrightarrow> refines (vebt_predi ti x) (case ti of Nodei info deg treeArray summary \<Rightarrow> assert' (is_Node t) \<bind> (\<lambda>_. let (info', deg', treeList, summary') = case t of Node info' deg' treeList summary' \<Rightarrow> (info', deg', treeList, summary') in assert' (info' = info \<and> deg' = deg \<and> is_Node t) \<bind> (\<lambda>_. case info of None \<Rightarrow> return None | Some mima \<Rightarrow> if deg \<le> 1 then return None else if snd mima < x then return (Some (snd mima)) else lowi x (deg div 2) \<bind> (\<lambda>l. highi x (deg div 2) \<bind> (\<lambda>h. assert' (l = low x (deg div 2)) \<bind> (\<lambda>_. assert' (h = high x (deg div 2)) \<bind> (\<lambda>_. assert' (h < length treeList) \<bind> (\<lambda>_. Array_Time.nth treeArray h \<bind> (\<lambda>aktnode. let aktnode' = treeList ! h in vebt_minti aktnode \<bind> (\<lambda>minlow. assert' (minlow = vebt_mint aktnode') \<bind> (\<lambda>_. if minlow \<noteq> None \<and> Some l >\<^sub>o minlow then f aktnode' aktnode l \<bind> (\<lambda>predy. return (Some (2 ^ (deg div 2)) *\<^sub>o Some h +\<^sub>o predy)) else f summary' summary h \<bind> (\<lambda>predsum. assert' ((predsum = None) = (vebt_pred summary' h = None)) \<bind> (\<lambda>_. if predsum = None then if fst mima < x then return (Some (fst mima)) else return None else Array_Time.nth treeArray (the predsum) \<bind> (\<lambda>nextnode. vebt_maxti nextnode \<bind> (\<lambda>maxnext. return (Some (2 ^ (deg div 2)) *\<^sub>o predsum +\<^sub>o maxnext))))))))))))))) | Leafi a b \<Rightarrow> if 2 \<le> x then if b then return (Some 1) else if a then return (Some 0) else return None else if x = 1 then if a then return (Some 0) else return None else return None)
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. heap.admissible (\<lambda>vebt_predi'. \<forall>x xa xb. refines (vebt_predi xa xb) (curry (curry vebt_predi') x xa xb))
[PROOF STEP]
using refines_adm[where t = "\<lambda> arg. vebt_predi (snd (fst arg)) (snd arg)"]
[PROOF STATE]
proof (prove)
using this:
heap.admissible (\<lambda>f. \<forall>x. refines (vebt_predi (snd (fst x)) (snd x)) (f x))

goal (1 subgoal):
 1. heap.admissible (\<lambda>vebt_predi'. \<forall>x xa xb. refines (vebt_predi xa xb) (curry (curry vebt_predi') x xa xb))
[PROOF STEP]
by simp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>t ti x. refines (vebt_predi ti x) (Heap.Heap Map.empty)
 2. \<And>f t ti x. (\<And>t ti x. refines (vebt_predi ti x) (f t ti x)) \<Longrightarrow> refines (vebt_predi ti x) (case ti of Nodei info deg treeArray summary \<Rightarrow> assert' (is_Node t) \<bind> (\<lambda>_. let (info', deg', treeList, summary') = case t of Node info' deg' treeList summary' \<Rightarrow> (info', deg', treeList, summary') in assert' (info' = info \<and> deg' = deg \<and> is_Node t) \<bind> (\<lambda>_. case info of None \<Rightarrow> return None | Some mima \<Rightarrow> if deg \<le> 1 then return None else if snd mima < x then return (Some (snd mima)) else lowi x (deg div 2) \<bind> (\<lambda>l. highi x (deg div 2) \<bind> (\<lambda>h. assert' (l = low x (deg div 2)) \<bind> (\<lambda>_. assert' (h = high x (deg div 2)) \<bind> (\<lambda>_. assert' (h < length treeList) \<bind> (\<lambda>_. Array_Time.nth treeArray h \<bind> (\<lambda>aktnode. let aktnode' = treeList ! h in vebt_minti aktnode \<bind> (\<lambda>minlow. assert' (minlow = vebt_mint aktnode') \<bind> (\<lambda>_. if minlow \<noteq> None \<and> Some l >\<^sub>o minlow then f aktnode' aktnode l \<bind> (\<lambda>predy. return (Some (2 ^ (deg div 2)) *\<^sub>o Some h +\<^sub>o predy)) else f summary' summary h \<bind> (\<lambda>predsum. assert' ((predsum = None) = (vebt_pred summary' h = None)) \<bind> (\<lambda>_. if predsum = None then if fst mima < x then return (Some (fst mima)) else return None else Array_Time.nth treeArray (the predsum) \<bind> (\<lambda>nextnode. vebt_maxti nextnode \<bind> (\<lambda>maxnext. return (Some (2 ^ (deg div 2)) *\<^sub>o predsum +\<^sub>o maxnext))))))))))))))) | Leafi a b \<Rightarrow> if 2 \<le> x then if b then return (Some 1) else if a then return (Some 0) else return None else if x = 1 then if a then return (Some 0) else return None else return None)
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. refines (vebt_predi ti_ x_) (Heap.Heap Map.empty)
[PROOF STEP]
by simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>f t ti x. (\<And>t ti x. refines (vebt_predi ti x) (f t ti x)) \<Longrightarrow> refines (vebt_predi ti x) (case ti of Nodei info deg treeArray summary \<Rightarrow> assert' (is_Node t) \<bind> (\<lambda>_. let (info', deg', treeList, summary') = case t of Node info' deg' treeList summary' \<Rightarrow> (info', deg', treeList, summary') in assert' (info' = info \<and> deg' = deg \<and> is_Node t) \<bind> (\<lambda>_. case info of None \<Rightarrow> return None | Some mima \<Rightarrow> if deg \<le> 1 then return None else if snd mima < x then return (Some (snd mima)) else lowi x (deg div 2) \<bind> (\<lambda>l. highi x (deg div 2) \<bind> (\<lambda>h. assert' (l = low x (deg div 2)) \<bind> (\<lambda>_. assert' (h = high x (deg div 2)) \<bind> (\<lambda>_. assert' (h < length treeList) \<bind> (\<lambda>_. Array_Time.nth treeArray h \<bind> (\<lambda>aktnode. let aktnode' = treeList ! h in vebt_minti aktnode \<bind> (\<lambda>minlow. assert' (minlow = vebt_mint aktnode') \<bind> (\<lambda>_. if minlow \<noteq> None \<and> Some l >\<^sub>o minlow then f aktnode' aktnode l \<bind> (\<lambda>predy. return (Some (2 ^ (deg div 2)) *\<^sub>o Some h +\<^sub>o predy)) else f summary' summary h \<bind> (\<lambda>predsum. assert' ((predsum = None) = (vebt_pred summary' h = None)) \<bind> (\<lambda>_. if predsum = None then if fst mima < x then return (Some (fst mima)) else return None else Array_Time.nth treeArray (the predsum) \<bind> (\<lambda>nextnode. vebt_maxti nextnode \<bind> (\<lambda>maxnext. return (Some (2 ^ (deg div 2)) *\<^sub>o predsum +\<^sub>o maxnext))))))))))))))) | Leafi a b \<Rightarrow> if 2 \<le> x then if b then return (Some 1) else if a then return (Some 0) else return None else if x = 1 then if a then return (Some 0) else return None else return None)
[PROOF STEP]
subgoal for f t ti x
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>t ti x. refines (vebt_predi ti x) (f t ti x)) \<Longrightarrow> refines (vebt_predi ti x) (case ti of Nodei info deg treeArray summary \<Rightarrow> assert' (is_Node t) \<bind> (\<lambda>_. let (info', deg', treeList, summary') = case t of Node info' deg' treeList summary' \<Rightarrow> (info', deg', treeList, summary') in assert' (info' = info \<and> deg' = deg \<and> is_Node t) \<bind> (\<lambda>_. case info of None \<Rightarrow> return None | Some mima \<Rightarrow> if deg \<le> 1 then return None else if snd mima < x then return (Some (snd mima)) else lowi x (deg div 2) \<bind> (\<lambda>l. highi x (deg div 2) \<bind> (\<lambda>h. assert' (l = low x (deg div 2)) \<bind> (\<lambda>_. assert' (h = high x (deg div 2)) \<bind> (\<lambda>_. assert' (h < length treeList) \<bind> (\<lambda>_. Array_Time.nth treeArray h \<bind> (\<lambda>aktnode. let aktnode' = treeList ! h in vebt_minti aktnode \<bind> (\<lambda>minlow. assert' (minlow = vebt_mint aktnode') \<bind> (\<lambda>_. if minlow \<noteq> None \<and> Some l >\<^sub>o minlow then f aktnode' aktnode l \<bind> (\<lambda>predy. return (Some (2 ^ (deg div 2)) *\<^sub>o Some h +\<^sub>o predy)) else f summary' summary h \<bind> (\<lambda>predsum. assert' ((predsum = None) = (vebt_pred summary' h = None)) \<bind> (\<lambda>_. if predsum = None then if fst mima < x then return (Some (fst mima)) else return None else Array_Time.nth treeArray (the predsum) \<bind> (\<lambda>nextnode. vebt_maxti nextnode \<bind> (\<lambda>maxnext. return (Some (2 ^ (deg div 2)) *\<^sub>o predsum +\<^sub>o maxnext))))))))))))))) | Leafi a b \<Rightarrow> if 2 \<le> x then if b then return (Some 1) else if a then return (Some 0) else return None else if x = 1 then if a then return (Some 0) else return None else return None)
[PROOF STEP]
apply(subst vebt_predi.simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>t ti x. refines (vebt_predi ti x) (f t ti x)) \<Longrightarrow> refines (case ti of Nodei None deg treeArray summary \<Rightarrow> return None | Nodei (Some mima) deg treeArray summary \<Rightarrow> if deg \<le> 1 then return None else if snd mima < x then return (Some (snd mima)) else lowi x (deg div 2) \<bind> (\<lambda>l. highi x (deg div 2) \<bind> (\<lambda>h. Array_Time.nth treeArray h \<bind> (\<lambda>aktnode. vebt_minti aktnode \<bind> (\<lambda>minlow. if minlow \<noteq> None \<and> Some l >\<^sub>o minlow then vebt_predi aktnode l \<bind> (\<lambda>predy. return (Some (2 ^ (deg div 2)) *\<^sub>o Some h +\<^sub>o predy)) else vebt_predi summary h \<bind> (\<lambda>predsum. if predsum = None then if fst mima < x then return (Some (fst mima)) else return None else Array_Time.nth treeArray (the predsum) \<bind> (\<lambda>nextnode. vebt_maxti nextnode \<bind> (\<lambda>maxnext. return (Some (2 ^ (deg div 2)) *\<^sub>o predsum +\<^sub>o maxnext)))))))) | Leafi a b \<Rightarrow> if 2 \<le> x then if b then return (Some 1) else if a then return (Some 0) else return None else if x = 1 then if a then return (Some 0) else return None else return None) (case ti of Nodei info deg treeArray summary \<Rightarrow> assert' (is_Node t) \<bind> (\<lambda>_. let (info', deg', treeList, summary') = case t of Node info' deg' treeList summary' \<Rightarrow> (info', deg', treeList, summary') in assert' (info' = info \<and> deg' = deg \<and> is_Node t) \<bind> (\<lambda>_. case info of None \<Rightarrow> return None | Some mima \<Rightarrow> if deg \<le> 1 then return None else if snd mima < x then return (Some (snd mima)) else lowi x (deg div 2) \<bind> (\<lambda>l. highi x (deg div 2) \<bind> (\<lambda>h. assert' (l = low x (deg div 2)) \<bind> (\<lambda>_. assert' (h = high x (deg div 2)) \<bind> (\<lambda>_. assert' (h < length treeList) \<bind> (\<lambda>_. Array_Time.nth treeArray h \<bind> (\<lambda>aktnode. let aktnode' = treeList ! h in vebt_minti aktnode \<bind> (\<lambda>minlow. assert' (minlow = vebt_mint aktnode') \<bind> (\<lambda>_. if minlow \<noteq> None \<and> Some l >\<^sub>o minlow then f aktnode' aktnode l \<bind> (\<lambda>predy. return (Some (2 ^ (deg div 2)) *\<^sub>o Some h +\<^sub>o predy)) else f summary' summary h \<bind> (\<lambda>predsum. assert' ((predsum = None) = (vebt_pred summary' h = None)) \<bind> (\<lambda>_. if predsum = None then if fst mima < x then return (Some (fst mima)) else return None else Array_Time.nth treeArray (the predsum) \<bind> (\<lambda>nextnode. vebt_maxti nextnode \<bind> (\<lambda>maxnext. return (Some (2 ^ (deg div 2)) *\<^sub>o predsum +\<^sub>o maxnext))))))))))))))) | Leafi a b \<Rightarrow> if 2 \<le> x then if b then return (Some 1) else if a then return (Some 0) else return None else if x = 1 then if a then return (Some 0) else return None else return None)
[PROOF STEP]
apply refines
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma MC: "[\<forall>(\<lambda>\<Phi>.(\<Phi> m\<rightarrow> (\<box> \<Phi>)))]"
  \<comment> \<open>sledgehammer [provers = remote\_satallax]\<close>
  \<comment> \<open>by (metis T2 T3 ess\_def)\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [\<lambda>w. \<forall>x. (x m\<rightarrow> \<box> x) w]
[PROOF STEP]
oops


[STATEMENT]
lemma Act_eq_iff_perm_renaming: "Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2 \<longleftrightarrow>
  f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)"
  (is "?l \<longleftrightarrow> ?r")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2) = (f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1))
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2 \<Longrightarrow> f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
 2. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
assume "?l"
[PROOF STATE]
proof (state)
this:
Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2

goal (2 subgoals):
 1. Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2 \<Longrightarrow> f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
 2. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
have "f1 = f2"
[PROOF STATE]
proof (prove)
using this:
Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2

goal (1 subgoal):
 1. f1 = f2
[PROOF STEP]
by (metis Act_eq_iff_perm)
[PROOF STATE]
proof (state)
this:
f1 = f2

goal (2 subgoals):
 1. Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2 \<Longrightarrow> f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
 2. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
f1 = f2

goal (2 subgoals):
 1. Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2 \<Longrightarrow> f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
 2. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
from \<open>?l\<close>
[PROOF STATE]
proof (chain)
picking this:
Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
obtain p where p: "supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2"
[PROOF STATE]
proof (prove)
using this:
Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2

goal (1 subgoal):
 1. (\<And>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis Act_eq_iff_perm)
[PROOF STATE]
proof (state)
this:
supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2

goal (2 subgoals):
 1. Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2 \<Longrightarrow> f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
 2. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2

goal (2 subgoals):
 1. Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2 \<Longrightarrow> f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
 2. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
obtain q where q_p: "\<forall>b\<in>bn \<alpha>1. q \<bullet> b = p \<bullet> b" and supp_q: "supp q \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>q. \<lbrakk>\<forall>b\<in>bn \<alpha>1. q \<bullet> b = p \<bullet> b; supp q \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis set_renaming_perm2)
[PROOF STATE]
proof (state)
this:
\<forall>b\<in>bn \<alpha>1. q \<bullet> b = p \<bullet> b
supp q \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1

goal (2 subgoals):
 1. Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2 \<Longrightarrow> f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
 2. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
have "supp q \<subseteq> supp p"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. supp q \<subseteq> supp p
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> supp q \<Longrightarrow> x \<in> supp p
[PROOF STEP]
fix a
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x. x \<in> supp q \<Longrightarrow> x \<in> supp p
[PROOF STEP]
assume *: "a \<in> supp q"
[PROOF STATE]
proof (state)
this:
a \<in> supp q

goal (1 subgoal):
 1. \<And>x. x \<in> supp q \<Longrightarrow> x \<in> supp p
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
a \<in> supp q
[PROOF STEP]
show "a \<in> supp p"
[PROOF STATE]
proof (prove)
using this:
a \<in> supp q

goal (1 subgoal):
 1. a \<in> supp p
[PROOF STEP]
proof (cases "a \<in> bn \<alpha>1")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>a \<in> supp q; a \<in> bn \<alpha>1\<rbrakk> \<Longrightarrow> a \<in> supp p
 2. \<lbrakk>a \<in> supp q; a \<notin> bn \<alpha>1\<rbrakk> \<Longrightarrow> a \<in> supp p
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
a \<in> bn \<alpha>1

goal (2 subgoals):
 1. \<lbrakk>a \<in> supp q; a \<in> bn \<alpha>1\<rbrakk> \<Longrightarrow> a \<in> supp p
 2. \<lbrakk>a \<in> supp q; a \<notin> bn \<alpha>1\<rbrakk> \<Longrightarrow> a \<in> supp p
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
a \<in> bn \<alpha>1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
a \<in> bn \<alpha>1

goal (1 subgoal):
 1. a \<in> supp p
[PROOF STEP]
using "*" q_p
[PROOF STATE]
proof (prove)
using this:
a \<in> bn \<alpha>1
a \<in> supp q
\<forall>b\<in>bn \<alpha>1. q \<bullet> b = p \<bullet> b

goal (1 subgoal):
 1. a \<in> supp p
[PROOF STEP]
by (metis mem_Collect_eq supp_perm)
[PROOF STATE]
proof (state)
this:
a \<in> supp p

goal (1 subgoal):
 1. \<lbrakk>a \<in> supp q; a \<notin> bn \<alpha>1\<rbrakk> \<Longrightarrow> a \<in> supp p
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>a \<in> supp q; a \<notin> bn \<alpha>1\<rbrakk> \<Longrightarrow> a \<in> supp p
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
a \<notin> bn \<alpha>1

goal (1 subgoal):
 1. \<lbrakk>a \<in> supp q; a \<notin> bn \<alpha>1\<rbrakk> \<Longrightarrow> a \<in> supp p
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
a \<notin> bn \<alpha>1
[PROOF STEP]
have "a \<in> p \<bullet> bn \<alpha>1"
[PROOF STATE]
proof (prove)
using this:
a \<notin> bn \<alpha>1

goal (1 subgoal):
 1. a \<in> p \<bullet> bn \<alpha>1
[PROOF STEP]
using "*" supp_q
[PROOF STATE]
proof (prove)
using this:
a \<notin> bn \<alpha>1
a \<in> supp q
supp q \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1

goal (1 subgoal):
 1. a \<in> p \<bullet> bn \<alpha>1
[PROOF STEP]
using UnE subsetCE
[PROOF STATE]
proof (prove)
using this:
a \<notin> bn \<alpha>1
a \<in> supp q
supp q \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1
\<lbrakk>?c \<in> ?A \<union> ?B; ?c \<in> ?A \<Longrightarrow> ?P; ?c \<in> ?B \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P
\<lbrakk>?A \<subseteq> ?B; ?c \<notin> ?A \<Longrightarrow> ?P; ?c \<in> ?B \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P

goal (1 subgoal):
 1. a \<in> p \<bullet> bn \<alpha>1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
a \<in> p \<bullet> bn \<alpha>1

goal (1 subgoal):
 1. \<lbrakk>a \<in> supp q; a \<notin> bn \<alpha>1\<rbrakk> \<Longrightarrow> a \<in> supp p
[PROOF STEP]
with False
[PROOF STATE]
proof (chain)
picking this:
a \<notin> bn \<alpha>1
a \<in> p \<bullet> bn \<alpha>1
[PROOF STEP]
have "p \<bullet> a \<noteq> a"
[PROOF STATE]
proof (prove)
using this:
a \<notin> bn \<alpha>1
a \<in> p \<bullet> bn \<alpha>1

goal (1 subgoal):
 1. p \<bullet> a \<noteq> a
[PROOF STEP]
by (metis mem_permute_iff)
[PROOF STATE]
proof (state)
this:
p \<bullet> a \<noteq> a

goal (1 subgoal):
 1. \<lbrakk>a \<in> supp q; a \<notin> bn \<alpha>1\<rbrakk> \<Longrightarrow> a \<in> supp p
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
p \<bullet> a \<noteq> a
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
p \<bullet> a \<noteq> a

goal (1 subgoal):
 1. a \<in> supp p
[PROOF STEP]
using fresh_def fresh_perm
[PROOF STATE]
proof (prove)
using this:
p \<bullet> a \<noteq> a
?a \<sharp> ?x \<equiv> ?a \<notin> supp ?x
?a \<sharp> ?p = (?p \<bullet> ?a = ?a)

goal (1 subgoal):
 1. a \<in> supp p
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
a \<in> supp p

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
a \<in> supp p

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
supp q \<subseteq> supp p

goal (2 subgoals):
 1. Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2 \<Longrightarrow> f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
 2. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
with p
[PROOF STATE]
proof (chain)
picking this:
supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2
supp q \<subseteq> supp p
[PROOF STEP]
have "(supp x1 - bn \<alpha>1) \<sharp>* q" and "(supp \<alpha>1 - bn \<alpha>1) \<sharp>* q"
[PROOF STATE]
proof (prove)
using this:
supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2
supp q \<subseteq> supp p

goal (1 subgoal):
 1. (supp x1 - bn \<alpha>1) \<sharp>* q &&& (supp \<alpha>1 - bn \<alpha>1) \<sharp>* q
[PROOF STEP]
by (meson fresh_def fresh_star_def subset_iff)+
[PROOF STATE]
proof (state)
this:
(supp x1 - bn \<alpha>1) \<sharp>* q
(supp \<alpha>1 - bn \<alpha>1) \<sharp>* q

goal (2 subgoals):
 1. Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2 \<Longrightarrow> f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
 2. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(supp x1 - bn \<alpha>1) \<sharp>* q
(supp \<alpha>1 - bn \<alpha>1) \<sharp>* q

goal (2 subgoals):
 1. Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2 \<Longrightarrow> f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
 2. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
with p and q_p
[PROOF STATE]
proof (chain)
picking this:
supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2
\<forall>b\<in>bn \<alpha>1. q \<bullet> b = p \<bullet> b
(supp x1 - bn \<alpha>1) \<sharp>* q
(supp \<alpha>1 - bn \<alpha>1) \<sharp>* q
[PROOF STEP]
have "\<And>a. a \<in> supp \<alpha>1 \<Longrightarrow> q \<bullet> a = p \<bullet> a" and "\<And>a. a \<in> supp x1 \<Longrightarrow> q \<bullet> a = p \<bullet> a"
[PROOF STATE]
proof (prove)
using this:
supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2
\<forall>b\<in>bn \<alpha>1. q \<bullet> b = p \<bullet> b
(supp x1 - bn \<alpha>1) \<sharp>* q
(supp \<alpha>1 - bn \<alpha>1) \<sharp>* q

goal (1 subgoal):
 1. (\<And>a. a \<in> supp \<alpha>1 \<Longrightarrow> q \<bullet> a = p \<bullet> a) &&& (\<And>a. a \<in> supp x1 \<Longrightarrow> q \<bullet> a = p \<bullet> a)
[PROOF STEP]
by (metis Diff_iff fresh_perm fresh_star_def)+
[PROOF STATE]
proof (state)
this:
?a \<in> supp \<alpha>1 \<Longrightarrow> q \<bullet> ?a = p \<bullet> ?a
?a \<in> supp x1 \<Longrightarrow> q \<bullet> ?a = p \<bullet> ?a

goal (2 subgoals):
 1. Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2 \<Longrightarrow> f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
 2. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?a \<in> supp \<alpha>1 \<Longrightarrow> q \<bullet> ?a = p \<bullet> ?a
?a \<in> supp x1 \<Longrightarrow> q \<bullet> ?a = p \<bullet> ?a
[PROOF STEP]
have "q \<bullet> \<alpha>1 = p \<bullet> \<alpha>1" and "q \<bullet> x1 = p \<bullet> x1"
[PROOF STATE]
proof (prove)
using this:
?a \<in> supp \<alpha>1 \<Longrightarrow> q \<bullet> ?a = p \<bullet> ?a
?a \<in> supp x1 \<Longrightarrow> q \<bullet> ?a = p \<bullet> ?a

goal (1 subgoal):
 1. q \<bullet> \<alpha>1 = p \<bullet> \<alpha>1 &&& q \<bullet> x1 = p \<bullet> x1
[PROOF STEP]
by (metis supp_perm_perm_eq)+
[PROOF STATE]
proof (state)
this:
q \<bullet> \<alpha>1 = p \<bullet> \<alpha>1
q \<bullet> x1 = p \<bullet> x1

goal (2 subgoals):
 1. Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2 \<Longrightarrow> f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
 2. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
f1 = f2
supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2
(supp x1 - bn \<alpha>1) \<sharp>* q
(supp \<alpha>1 - bn \<alpha>1) \<sharp>* q
q \<bullet> \<alpha>1 = p \<bullet> \<alpha>1
q \<bullet> x1 = p \<bullet> x1
[PROOF STEP]
show "?r"
[PROOF STATE]
proof (prove)
using this:
f1 = f2
supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2
(supp x1 - bn \<alpha>1) \<sharp>* q
(supp \<alpha>1 - bn \<alpha>1) \<sharp>* q
q \<bullet> \<alpha>1 = p \<bullet> \<alpha>1
q \<bullet> x1 = p \<bullet> x1

goal (1 subgoal):
 1. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
[PROOF STEP]
using supp_q
[PROOF STATE]
proof (prove)
using this:
f1 = f2
supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2
(supp x1 - bn \<alpha>1) \<sharp>* q
(supp \<alpha>1 - bn \<alpha>1) \<sharp>* q
q \<bullet> \<alpha>1 = p \<bullet> \<alpha>1
q \<bullet> x1 = p \<bullet> x1
supp q \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1

goal (1 subgoal):
 1. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
[PROOF STEP]
by (metis bn_eqvt)
[PROOF STATE]
proof (state)
this:
f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)

goal (1 subgoal):
 1. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
assume "?r"
[PROOF STATE]
proof (state)
this:
f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)

goal (1 subgoal):
 1. f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1) \<Longrightarrow> Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)
[PROOF STEP]
show "?l"
[PROOF STATE]
proof (prove)
using this:
f1 = f2 \<and> (\<exists>p. supp x1 - bn \<alpha>1 = supp x2 - bn \<alpha>2 \<and> (supp x1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> x1 = x2 \<and> supp \<alpha>1 - bn \<alpha>1 = supp \<alpha>2 - bn \<alpha>2 \<and> (supp \<alpha>1 - bn \<alpha>1) \<sharp>* p \<and> p \<bullet> \<alpha>1 = \<alpha>2 \<and> supp p \<subseteq> bn \<alpha>1 \<union> p \<bullet> bn \<alpha>1)

goal (1 subgoal):
 1. Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2
[PROOF STEP]
by (meson Act_eq_iff_perm)
[PROOF STATE]
proof (state)
this:
Act f1 \<alpha>1 x1 = Act f2 \<alpha>2 x2

goal:
No subgoals!
[PROOF STEP]
qed