[STATEMENT]
lemma "u = ()"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u = ()
[PROOF STEP]
nitpick [expect = none]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u = ()
[PROOF STEP]
sorry


[STATEMENT]
lemma "P (rec_nat zero suc x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (rec_nat zero suc x)
[PROOF STEP]
refute [expect = potential]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (rec_nat zero suc x)
[PROOF STEP]
oops


[STATEMENT]
lemma l3_dy_refines_dy_fake_msg_dy_fake_chan_skip:
   "{R23s \<inter> UNIV \<times> (l3_inv5 \<inter> l3_inv6 \<inter> l3_inv7 \<inter> l3_inv8 \<inter> l3_inv9)}
      l2_dy_fake_msg M \<union> (\<Union>M'. l2_dy_fake_chan M') \<union> Id, l3_dy M
    {>R23s}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {R23s \<inter> UNIV \<times> (l3_inv5 \<inter> l3_inv6 \<inter> l3_inv7 \<inter> l3_inv8 \<inter> l3_inv9)} (l2_dy_fake_msg M \<union> \<Union> (range l2_dy_fake_chan))\<^sup>=, l3_dy M {> R23s}
[PROOF STEP]
by (cases "M \<in> payload \<union> valid \<union> range LtK")
   (auto dest: l3_dy_payload_refines_dy_fake_msg l3_dy_valid_refines_dy_fake_chan_Un
         intro: l3_dy_isLtKey_refines_skip dest!: l3_dy_others_refines_skip)


[STATEMENT]
lemma has_white_path_to_eq_imp': \<comment> \<open>Complicated condition takes care of \<open>alloc\<close>: collapses no object and object with no fields\<close>
  assumes "(x has_white_path_to y) s'"
  assumes "\<forall>r'. \<Union>(ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union>(ran ` obj_fields ` set_option (sys_heap s r'))"
  assumes "\<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r')"
  assumes "sys_fM s' = sys_fM s"
  shows "(x has_white_path_to y) s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x has_white_path_to y) s
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
(x has_white_path_to y) s'
\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r'))
\<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r')
sys_fM s' = sys_fM s

goal (1 subgoal):
 1. (x has_white_path_to y) s
[PROOF STEP]
proof induct
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x. \<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to x) s
 2. \<And>x y z. \<lbrakk>(x has_white_path_to y) s'; \<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to y) s; (y points_to z) s'; white z s'; \<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to z) s
[PROOF STEP]
case (step x y z)
[PROOF STATE]
proof (state)
this:
(x has_white_path_to y) s'
\<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to y) s
(y points_to z) s'
white z s'
\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r'))
\<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r')
sys_fM s' = sys_fM s

goal (2 subgoals):
 1. \<And>x. \<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to x) s
 2. \<And>x y z. \<lbrakk>(x has_white_path_to y) s'; \<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to y) s; (y points_to z) s'; white z s'; \<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to z) s
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(x has_white_path_to y) s'
\<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to y) s
(y points_to z) s'
white z s'
\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r'))
\<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r')
sys_fM s' = sys_fM s
[PROOF STEP]
have "(y points_to z) s"
[PROOF STATE]
proof (prove)
using this:
(x has_white_path_to y) s'
\<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to y) s
(y points_to z) s'
white z s'
\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r'))
\<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r')
sys_fM s' = sys_fM s

goal (1 subgoal):
 1. (y points_to z) s
[PROOF STEP]
by (cases "sys_heap s y")
       (auto 10 10 simp: ran_def obj_at_def split: option.splits dest!: spec[where x=y])
[PROOF STATE]
proof (state)
this:
(y points_to z) s

goal (2 subgoals):
 1. \<And>x. \<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to x) s
 2. \<And>x y z. \<lbrakk>(x has_white_path_to y) s'; \<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to y) s; (y points_to z) s'; white z s'; \<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to z) s
[PROOF STEP]
with step
[PROOF STATE]
proof (chain)
picking this:
(x has_white_path_to y) s'
\<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to y) s
(y points_to z) s'
white z s'
\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r'))
\<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r')
sys_fM s' = sys_fM s
(y points_to z) s
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
(x has_white_path_to y) s'
\<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to y) s
(y points_to z) s'
white z s'
\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r'))
\<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r')
sys_fM s' = sys_fM s
(y points_to z) s

goal (1 subgoal):
 1. (x has_white_path_to z) s
[PROOF STEP]
apply -
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(x has_white_path_to y) s'; \<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to y) s; (y points_to z) s'; white z s'; \<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s; (y points_to z) s\<rbrakk> \<Longrightarrow> (x has_white_path_to z) s
[PROOF STEP]
apply (rule has_white_path_to_step, assumption, assumption)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(x has_white_path_to y) s'; \<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to y) s; (y points_to z) s'; white z s'; \<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s; (y points_to z) s\<rbrakk> \<Longrightarrow> white z s
[PROOF STEP]
apply (clarsimp simp: white_def split: obj_at_splits)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>obj obja objb. \<lbrakk>(x has_white_path_to y) s'; (x has_white_path_to y) s; sys_heap s' y = Some obj; z \<in> ran (obj_fields obj); sys_heap s' z = Some obja; obj_mark obja = (\<not> sys_fM s); \<forall>r'. (\<Union>a\<in>set_option (sys_heap s' r'). ran (obj_fields a)) = (\<Union>a\<in>set_option (sys_heap s r'). ran (obj_fields a)); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s; sys_heap s y = Some objb; z \<in> ran (obj_fields objb)\<rbrakk> \<Longrightarrow> (\<exists>y. sys_heap s z = Some y) \<and> (\<forall>obj. sys_heap s z = Some obj \<longrightarrow> obj_mark obj = (\<not> sys_fM s))
[PROOF STEP]
apply (metis map_option_eq_Some option.sel)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(x has_white_path_to z) s

goal (1 subgoal):
 1. \<And>x. \<lbrakk>\<forall>r'. \<Union> (ran ` obj_fields ` set_option (sys_heap s' r')) = \<Union> (ran ` obj_fields ` set_option (sys_heap s r')); \<forall>r'. map_option obj_mark (sys_heap s' r') = map_option obj_mark (sys_heap s r'); sys_fM s' = sys_fM s\<rbrakk> \<Longrightarrow> (x has_white_path_to x) s
[PROOF STEP]
qed simp


[STATEMENT]
lemma l3_skr_refines_skr:
  "{R23s} l2_skr R K, l3_skr R K {>R23s}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {R23s} l2_skr R K, l3_skr R K {> R23s}
[PROOF STEP]
apply (auto simp add: PO_rhoare_defs R23s_defs)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>b y. (y, b) \<in> l3_skr R K \<Longrightarrow> (\<lparr>ik = ik y \<inter> payload, secret = secret y, progress = progress y, signals = l1_state.signals y, chan = local.abs (ik y), bad = l3_state.bad y\<rparr>, \<lparr>ik = ik b \<inter> payload, secret = secret b, progress = progress b, signals = l1_state.signals b, chan = local.abs (ik b), bad = l3_state.bad b\<rparr>) \<in> l2_skr R K
[PROOF STEP]
apply (auto simp add: l3_defs l2_skr_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma strand_sem_subst_c:
  assumes "(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}"
  shows "\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>) \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>) \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}

goal (1 subgoal):
 1. \<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>) \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
proof (induction S arbitrary: \<delta> M rule: strand_sem_induct)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 4. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 5. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
case (ConsSnd M ts S)
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>c (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>c \<theta>
\<lbrakk>M; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (5 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 4. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 5. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
hence "\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>" "\<forall>t \<in> set ts. M \<turnstile>\<^sub>c t \<cdot> (\<delta> \<circ>\<^sub>s \<theta>)"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>c (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>c \<theta>
\<lbrakk>M; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (1 subgoal):
 1. \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta> &&& \<forall>t\<in>set ts. M \<turnstile>\<^sub>c t \<cdot> \<delta> \<circ>\<^sub>s \<theta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
\<forall>t\<in>set ts. M \<turnstile>\<^sub>c t \<cdot> \<delta> \<circ>\<^sub>s \<theta>

goal (5 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 4. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 5. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
hence "\<forall>t \<in> set ts. M \<turnstile>\<^sub>c (t \<cdot> \<delta>) \<cdot> \<theta>"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
\<forall>t\<in>set ts. M \<turnstile>\<^sub>c t \<cdot> \<delta> \<circ>\<^sub>s \<theta>

goal (1 subgoal):
 1. \<forall>t\<in>set ts. M \<turnstile>\<^sub>c t \<cdot> \<delta> \<cdot> \<theta>
[PROOF STEP]
using subst_comp_all[of \<delta> \<theta> M] subst_subst_compose[of _ \<delta> \<theta>]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
\<forall>t\<in>set ts. M \<turnstile>\<^sub>c t \<cdot> \<delta> \<circ>\<^sub>s \<theta>
M \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<circ>\<^sub>s \<theta> = M \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<cdot>\<^sub>s\<^sub>e\<^sub>t \<theta>
?t \<cdot> \<delta> \<circ>\<^sub>s \<theta> = ?t \<cdot> \<delta> \<cdot> \<theta>

goal (1 subgoal):
 1. \<forall>t\<in>set ts. M \<turnstile>\<^sub>c t \<cdot> \<delta> \<cdot> \<theta>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set ts. M \<turnstile>\<^sub>c t \<cdot> \<delta> \<cdot> \<theta>

goal (5 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 4. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 5. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
hence "\<forall>t \<in> set (ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>). M \<turnstile>\<^sub>c t \<cdot> \<theta>"
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set ts. M \<turnstile>\<^sub>c t \<cdot> \<delta> \<cdot> \<theta>

goal (1 subgoal):
 1. \<forall>t\<in>set (ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>). M \<turnstile>\<^sub>c t \<cdot> \<theta>
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set (ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>). M \<turnstile>\<^sub>c t \<cdot> \<theta>

goal (5 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 4. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 5. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set (ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>). M \<turnstile>\<^sub>c t \<cdot> \<theta>

goal (1 subgoal):
 1. \<lbrakk>M; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
using \<open>\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set (ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>). M \<turnstile>\<^sub>c t \<cdot> \<theta>
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>

goal (1 subgoal):
 1. \<lbrakk>M; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
unfolding subst_apply_strand_def
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set (ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>). M \<turnstile>\<^sub>c t \<cdot> \<theta>
\<lbrakk>M; map (\<lambda>x. x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>) S\<rbrakk>\<^sub>c \<theta>

goal (1 subgoal):
 1. \<lbrakk>M; map (\<lambda>x. x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>) (send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S)\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; send\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>

goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
case (ConsRcv M ts S)
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>c (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>c \<theta>
\<lbrakk>M; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
have *: "\<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<circ>\<^sub>s \<theta>) \<union> M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<circ>\<^sub>s \<theta>) \<union> M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>)
[PROOF STEP]
using ConsRcv.prems(1)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>M; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>)

goal (1 subgoal):
 1. \<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<circ>\<^sub>s \<theta>) \<union> M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<circ>\<^sub>s \<theta>) \<union> M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>)

goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
have "bvars\<^sub>s\<^sub>t (Receive ts#S) = bvars\<^sub>s\<^sub>t S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = bvars\<^sub>s\<^sub>t S
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = bvars\<^sub>s\<^sub>t S

goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
hence **: "(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}"
[PROOF STATE]
proof (prove)
using this:
bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = bvars\<^sub>s\<^sub>t S

goal (1 subgoal):
 1. (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}
[PROOF STEP]
using ConsRcv.prems(2)
[PROOF STATE]
proof (prove)
using this:
bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = bvars\<^sub>s\<^sub>t S
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (1 subgoal):
 1. (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}

goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
have "\<lbrakk>M; Receive (ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>)#(S \<cdot>\<^sub>s\<^sub>t \<delta>)\<rbrakk>\<^sub>c \<theta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>M; receive\<langle>ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t # (S \<cdot>\<^sub>s\<^sub>t \<delta>)\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
using ConsRcv.IH[OF * **]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>(set ts \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta> \<circ>\<^sub>s \<theta>) \<union> M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>

goal (1 subgoal):
 1. \<lbrakk>M; receive\<langle>ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t # (S \<cdot>\<^sub>s\<^sub>t \<delta>)\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
by (metis (no_types) image_set strand_sem_c.simps(3) subst_comp_all)
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; receive\<langle>ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t # (S \<cdot>\<^sub>s\<^sub>t \<delta>)\<rbrakk>\<^sub>c \<theta>

goal (4 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M ts S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 4. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>M; receive\<langle>ts \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t # (S \<cdot>\<^sub>s\<^sub>t \<delta>)\<rbrakk>\<^sub>c \<theta>

goal (1 subgoal):
 1. \<lbrakk>M; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; receive\<langle>ts\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
case (ConsIneq M X F S)
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>c (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>c \<theta>
\<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
hence *: "\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>" and
        ***: "(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> set X = {}"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>c (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>c \<theta>
\<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (1 subgoal):
 1. \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta> &&& (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> set X = {}
[PROOF STEP]
unfolding bvars\<^sub>s\<^sub>t_def ineq_model_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>c (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> \<Union> (set (map (set \<circ> bvars\<^sub>s\<^sub>t\<^sub>p) S)) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>c \<theta>
\<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> \<Union> (set (map (set \<circ> bvars\<^sub>s\<^sub>t\<^sub>p) (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S))) = {}

goal (1 subgoal):
 1. \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta> &&& (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> set X = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> set X = {}

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
have **: "ineq_model (\<delta> \<circ>\<^sub>s \<theta>) X F"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ineq_model (\<delta> \<circ>\<^sub>s \<theta>) X F
[PROOF STEP]
using ConsIneq
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<lbrakk>?M2; S\<rbrakk>\<^sub>c (?\<delta>2 \<circ>\<^sub>s \<theta>); (subst_domain ?\<delta>2 \<union> range_vars ?\<delta>2) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>?M2; S \<cdot>\<^sub>s\<^sub>t ?\<delta>2\<rbrakk>\<^sub>c \<theta>
\<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>)
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (1 subgoal):
 1. ineq_model (\<delta> \<circ>\<^sub>s \<theta>) X F
[PROOF STEP]
by (auto simp add: subst_compose_assoc ineq_model_def)
[PROOF STATE]
proof (state)
this:
ineq_model (\<delta> \<circ>\<^sub>s \<theta>) X F

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
have "\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>)
          \<longrightarrow> (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> (subst_domain \<gamma> \<union> range_vars \<gamma>) = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> (subst_domain \<gamma> \<union> range_vars \<gamma>) = {}
[PROOF STEP]
using * ** ***
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
ineq_model (\<delta> \<circ>\<^sub>s \<theta>) X F
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> set X = {}

goal (1 subgoal):
 1. \<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> (subst_domain \<gamma> \<union> range_vars \<gamma>) = {}
[PROOF STEP]
unfolding range_vars_alt_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
ineq_model (\<delta> \<circ>\<^sub>s \<theta>) X F
(subst_domain \<delta> \<union> fv\<^sub>s\<^sub>e\<^sub>t (subst_range \<delta>)) \<inter> set X = {}

goal (1 subgoal):
 1. \<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> (subst_domain \<delta> \<union> fv\<^sub>s\<^sub>e\<^sub>t (subst_range \<delta>)) \<inter> (subst_domain \<gamma> \<union> fv\<^sub>s\<^sub>e\<^sub>t (subst_range \<gamma>)) = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> (subst_domain \<gamma> \<union> range_vars \<gamma>) = {}

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
hence "\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> \<gamma> \<circ>\<^sub>s \<delta> = \<delta> \<circ>\<^sub>s \<gamma>"
[PROOF STATE]
proof (prove)
using this:
\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> (subst_domain \<gamma> \<union> range_vars \<gamma>) = {}

goal (1 subgoal):
 1. \<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> \<gamma> \<circ>\<^sub>s \<delta> = \<delta> \<circ>\<^sub>s \<gamma>
[PROOF STEP]
by (metis subst_comp_eq_if_disjoint_vars)
[PROOF STATE]
proof (state)
this:
\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> \<gamma> \<circ>\<^sub>s \<delta> = \<delta> \<circ>\<^sub>s \<gamma>

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
hence "ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)"
[PROOF STATE]
proof (prove)
using this:
\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> \<gamma> \<circ>\<^sub>s \<delta> = \<delta> \<circ>\<^sub>s \<gamma>

goal (1 subgoal):
 1. ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)
[PROOF STEP]
using ineq_model_subst[OF *** **]
[PROOF STATE]
proof (prove)
using this:
\<forall>\<gamma>. subst_domain \<gamma> = set X \<and> ground (subst_range \<gamma>) \<longrightarrow> \<gamma> \<circ>\<^sub>s \<delta> = \<delta> \<circ>\<^sub>s \<gamma>
ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)

goal (1 subgoal):
 1. ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
have "rm_vars (set X) \<delta> = \<delta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rm_vars (set X) \<delta> = \<delta>
[PROOF STEP]
using ConsIneq.prems(2)
[PROOF STATE]
proof (prove)
using this:
(subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}

goal (1 subgoal):
 1. rm_vars (set X) \<delta> = \<delta>
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
rm_vars (set X) \<delta> = \<delta>

goal (3 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 3. \<And>M X F S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)
rm_vars (set X) \<delta> = \<delta>
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)
rm_vars (set X) \<delta> = \<delta>

goal (1 subgoal):
 1. \<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
ineq_model \<theta> X (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s \<delta>)
rm_vars (set X) \<delta> = \<delta>
\<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>

goal (1 subgoal):
 1. \<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>M; \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>

goal (2 subgoals):
 1. \<And>M \<delta> Ma. \<lbrakk>\<lbrakk>Ma; []\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t [] = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; [] \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
 2. \<And>M uu_ t t' S \<delta> Ma. \<lbrakk>\<And>x \<delta> M. \<lbrakk>\<lbrakk>M; S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t S = {}\<rbrakk> \<Longrightarrow> \<lbrakk>M; S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>; \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S\<rbrakk>\<^sub>c (\<delta> \<circ>\<^sub>s \<theta>); (subst_domain \<delta> \<union> range_vars \<delta>) \<inter> bvars\<^sub>s\<^sub>t (\<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S) = {}\<rbrakk> \<Longrightarrow> \<lbrakk>Ma; \<langle>uu_: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S \<cdot>\<^sub>s\<^sub>t \<delta>\<rbrakk>\<^sub>c \<theta>
[PROOF STEP]
qed simp_all


[STATEMENT]
lemma PO_m1_step5_refines_a0_ri_commit:
  "{R_a0iim1_ri \<inter> UNIV \<times> (m1_inv1r_cache \<inter> m1_inv0_fin)}
     (a0i_commit [B, A] (Kab, Ts, Ta)), (m1_step5 Rb A B Kab Ts Ta)
   {> R_a0iim1_ri}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {R_a0iim1_ri \<inter> UNIV \<times> (m1_inv1r_cache \<inter> m1_inv0_fin)} a0i_commit [B, A] (Kab, Ts, Ta), m1_step5 Rb A B Kab Ts Ta {> R_a0iim1_ri}
[PROOF STEP]
apply (auto simp add: PO_rhoare_defs R_a0iim1_ri_defs a0i_defs m1_defs)
\<comment> \<open>2 subgoals\<close>
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>a y aa ab ac ba Rs Na Ra nl. \<lbrakk>signals a = ri_runs2sigs (runs y); corrupted a = {}; y \<in> m1_inv1r_cache; y \<in> m1_inv0_fin; runs y Rb = Some (Resp, [A, B], []); clk y < Ts + Ls; clk y < Ta + La; (B, sesK (Rs $ sk), Ta) \<notin> cache y; (sesK (Rs $ sk), aa, ab, ac, ba) \<in> m1_state.leak y; Kab = sesK (Rs $ sk); runs y Rs = Some (Serv, [A, B], [aNon Na, aNum Ts]); runs y Ra = Some (Init, [A, B], aKey (sesK (Rs $ sk)) # aNum Ts # aNum Ta # nl); B \<notin> bad; A \<notin> bad\<rbrakk> \<Longrightarrow> card (ri_commit (runs y) A B (sesK (Rs $ sk)) Ts Ta) < card (ri_running (runs y) A B (sesK (Rs $ sk)) Ts Ta)
 2. \<And>a y Rs Na Ra nl. \<lbrakk>signals a = ri_runs2sigs (runs y); corrupted a = {}; y \<in> m1_inv1r_cache; y \<in> m1_inv0_fin; runs y Rb = Some (Resp, [A, B], []); clk y < Ts + Ls; clk y < Ta + La; (B, sesK (Rs $ sk), Ta) \<notin> cache y; (sesK (Rs $ sk), B) \<in> azC (runs y); Kab = sesK (Rs $ sk); runs y Rs = Some (Serv, [A, B], [aNon Na, aNum Ts]); runs y Ra = Some (Init, [A, B], aKey (sesK (Rs $ sk)) # aNum Ts # aNum Ta # nl); B \<notin> bad; A \<notin> bad\<rbrakk> \<Longrightarrow> card (ri_commit (runs y) A B (sesK (Rs $ sk)) Ts Ta) < card (ri_running (runs y) A B (sesK (Rs $ sk)) Ts Ta)
[PROOF STEP]
apply (rename_tac s t aa ab ac ba Rs Na Ra nl,
       subgoal_tac
         "card (ri_commit (runs t) A B (sesK (Rs$sk)) Ts Ta) = 0 \<and>
          card (ri_running (runs t) A B (sesK (Rs$sk)) Ts Ta) > 0", auto)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a y Rs Na Ra nl. \<lbrakk>signals a = ri_runs2sigs (runs y); corrupted a = {}; y \<in> m1_inv1r_cache; y \<in> m1_inv0_fin; runs y Rb = Some (Resp, [A, B], []); clk y < Ts + Ls; clk y < Ta + La; (B, sesK (Rs $ sk), Ta) \<notin> cache y; (sesK (Rs $ sk), B) \<in> azC (runs y); Kab = sesK (Rs $ sk); runs y Rs = Some (Serv, [A, B], [aNon Na, aNum Ts]); runs y Ra = Some (Init, [A, B], aKey (sesK (Rs $ sk)) # aNum Ts # aNum Ta # nl); B \<notin> bad; A \<notin> bad\<rbrakk> \<Longrightarrow> card (ri_commit (runs y) A B (sesK (Rs $ sk)) Ts Ta) < card (ri_running (runs y) A B (sesK (Rs $ sk)) Ts Ta)
[PROOF STEP]
apply (rename_tac s t Rs Na Ra nl,
       subgoal_tac
         "card (ri_commit (runs t) A B (sesK (Rs$sk)) Ts Ta) = 0 \<and>
          card (ri_running (runs t) A B (sesK (Rs$sk)) Ts Ta) > 0", auto)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma PO_m3_inv4_ikk_init: "reach m3 \<subseteq> m3_inv4_ikk_init"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reach m3 \<subseteq> m3_inv4_ikk_init
[PROOF STEP]
proof (rule INV_from_Refinement_using_invariants [OF m3_refines_m2])
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. Range (R23 \<inter> (m2_inv3a_sesK_compr \<inter> m2_inv3b_sesK_compr_non) \<times> (m3_inv3_sesK_compr \<inter> m3_inv2_ticket \<inter> m3_inv1_lkeysec) \<inter> ?I \<times> ?J) \<subseteq> m3_inv4_ikk_init
 2. reach m2 \<subseteq> ?I
 3. reach m3 \<subseteq> ?J
[PROOF STEP]
show "Range (R23 \<inter> (m2_inv3a_sesK_compr \<inter> m2_inv3b_sesK_compr_non)
                   \<times> (m3_inv3_sesK_compr \<inter> m3_inv2_ticket \<inter> m3_inv1_lkeysec)
                   \<inter> m2_inv6_ikk_init \<times> UNIV)
      \<subseteq> m3_inv4_ikk_init"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Range (R23 \<inter> (m2_inv3a_sesK_compr \<inter> m2_inv3b_sesK_compr_non) \<times> (m3_inv3_sesK_compr \<inter> m3_inv2_ticket \<inter> m3_inv1_lkeysec) \<inter> m2_inv6_ikk_init \<times> UNIV) \<subseteq> m3_inv4_ikk_init
[PROOF STEP]
by (auto simp add: R23_def R23_pres_def intro!: m3_inv4_ikk_initI)
       (elim m2_inv6_ikk_initE, auto dest: R23_keys_dests)
[PROOF STATE]
proof (state)
this:
Range (R23 \<inter> (m2_inv3a_sesK_compr \<inter> m2_inv3b_sesK_compr_non) \<times> (m3_inv3_sesK_compr \<inter> m3_inv2_ticket \<inter> m3_inv1_lkeysec) \<inter> m2_inv6_ikk_init \<times> UNIV) \<subseteq> m3_inv4_ikk_init

goal (2 subgoals):
 1. reach m2 \<subseteq> m2_inv6_ikk_init
 2. reach m3 \<subseteq> UNIV
[PROOF STEP]
qed auto