[STATEMENT]
lemma par_rreq_rrep_sn_quality_increases:
  "opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>)
                            globala (\<lambda>(\<sigma>, _, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
have "opaodv i \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>)
                globala (\<lambda>(\<sigma>, _, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. opaodv i \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
by (rule ostep_invariant_weakenE [OF olocal_quality_increases])
         (auto dest!: onllD seqllD elim!: aodv_ex_labelE)
[PROOF STATE]
proof (state)
this:
opaodv i \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))

goal (1 subgoal):
 1. opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
hence "opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>)
                                   globala (\<lambda>(\<sigma>, _, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))"
[PROOF STATE]
proof (prove)
using this:
opaodv i \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))

goal (1 subgoal):
 1. opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
by (rule lift_step_into_qmsg_statelessassm) simp_all
[PROOF STATE]
proof (state)
this:
opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))

goal (1 subgoal):
 1. opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))

goal (1 subgoal):
 1. opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))
[PROOF STEP]
by rule auto
[PROOF STATE]
proof (state)
this:
opaodv i \<langle>\<langle>\<^bsub>i\<^esub> qmsg \<Turnstile>\<^sub>A (\<lambda>\<sigma> _. orecvmsg (\<lambda>_. rreq_rrep_sn) \<sigma>, other (\<lambda>_ _. True) {i} \<rightarrow>) globala (\<lambda>(\<sigma>, uu_, \<sigma>'). quality_increases (\<sigma> i) (\<sigma>' i))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma sp_assigns_r [sp]:
  "vwb_lens x \<Longrightarrow> (p sp x := e ) = (\<^bold>\<exists>v \<bullet> p\<lbrakk>\<guillemotleft>v\<guillemotright>/x\<rbrakk> \<and> &x =\<^sub>u e\<lbrakk>\<guillemotleft>v\<guillemotright>/x\<rbrakk>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vwb_lens x \<Longrightarrow> p sp x := e = (\<^bold>\<exists> v \<bullet> p\<lbrakk>\<guillemotleft>v\<guillemotright>/x\<rbrakk> \<and> &x =\<^sub>u e\<lbrakk>\<guillemotleft>v\<guillemotright>/x\<rbrakk>)
[PROOF STEP]
by (rel_auto, metis vwb_lens_wb wb_lens.get_put, metis vwb_lens.put_eq)


[STATEMENT]
lemma T_eq_prod: "T = (\<lambda>(x1, x2). do { \<omega>1 \<leftarrow> K1.T x1 ; \<omega>2 \<leftarrow> K2.T x2 ; return S (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2)) })"
  (is "_ = ?B")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. T = (\<lambda>(x1, x2). K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2)))))
[PROOF STEP]
proof (rule T_bisim)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x. prob_space (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2)))))
 2. \<And>x. sets (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = sets (stream_space (count_space UNIV))
 3. \<And>x. (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp x) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))
[PROOF STEP]
have T1x: "\<And>x. subprob_space (K1.T x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. subprob_space (K1.T x)
[PROOF STEP]
by (rule prob_space_imp_subprob_space) unfold_locales
[PROOF STATE]
proof (state)
this:
subprob_space (K1.T ?x1)

goal (3 subgoals):
 1. \<And>x. prob_space (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2)))))
 2. \<And>x. sets (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = sets (stream_space (count_space UNIV))
 3. \<And>x. (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp x) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))
[PROOF STEP]
interpret T12: pair_prob_space "K1.T x" "K2.T y" for x y
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pair_prob_space (K1.T x) (K2.T y)
[PROOF STEP]
by unfold_locales
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x. prob_space (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2)))))
 2. \<And>x. sets (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = sets (stream_space (count_space UNIV))
 3. \<And>x. (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp x) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))
[PROOF STEP]
interpret T1K2: pair_prob_space "K1.T x" "K2 y" for x y
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pair_prob_space (K1.T x) (measure_pmf (K2 y))
[PROOF STEP]
by unfold_locales
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x. prob_space (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2)))))
 2. \<And>x. sets (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = sets (stream_space (count_space UNIV))
 3. \<And>x. (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp x) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))
[PROOF STEP]
let ?P = "\<lambda>x1 x2. K1.T x1 \<Otimes>\<^sub>M K2.T x2"
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x. prob_space (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2)))))
 2. \<And>x. sets (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = sets (stream_space (count_space UNIV))
 3. \<And>x. (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp x) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x. prob_space (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2)))))
 2. \<And>x. sets (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = sets (stream_space (count_space UNIV))
 3. \<And>x. (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp x) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))
[PROOF STEP]
show "prob_space (?B x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prob_space (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2)))))
[PROOF STEP]
by (auto simp: space_stream_space split: prod.splits
                intro!: prob_space.prob_space_bind prob_space_return
                        measurable_bind[where N=S] measurable_compose[OF _ return_measurable] AE_I2)
       unfold_locales
[PROOF STATE]
proof (state)
this:
prob_space (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2)))))

goal (2 subgoals):
 1. \<And>x. sets (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = sets (stream_space (count_space UNIV))
 2. \<And>x. (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp x) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))
[PROOF STEP]
show "sets (?B x) = sets S"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sets (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = sets (stream_space (count_space UNIV))
[PROOF STEP]
by (simp split: prod.splits add: measurable_bind[where N=S] sets_bind[where N=S] space_stream_space)
[PROOF STATE]
proof (state)
this:
sets (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = sets (stream_space (count_space UNIV))

goal (1 subgoal):
 1. \<And>x. (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp x) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))
[PROOF STEP]
obtain a b where x_eq: "x = (a, b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>a b. x = (a, b) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases x) auto
[PROOF STATE]
proof (state)
this:
x = (a, b)

goal (1 subgoal):
 1. \<And>x. (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp x) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))
[PROOF STEP]
show "?B x = (measure_pmf (Kp x) \<bind> (\<lambda>s. distr (?B s) S ((##) s)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp x) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))
[PROOF STEP]
unfolding x_eq
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (case (a, b) of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp (a, b)) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))
[PROOF STEP]
apply (subst K1.T_eq_bind')
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (case (a, b) of (x1, x2) \<Rightarrow> measure_pmf (K1 x1) \<bind> (\<lambda>y. K1.T y \<bind> (\<lambda>\<omega>. return (stream_space (count_space UNIV)) (y ## \<omega>))) \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp (a, b)) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))
[PROOF STEP]
apply (subst K2.T_eq_bind')
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (case (a, b) of (x1, x2) \<Rightarrow> measure_pmf (K1 x1) \<bind> (\<lambda>y. K1.T y \<bind> (\<lambda>\<omega>. return (stream_space (count_space UNIV)) (y ## \<omega>))) \<bind> (\<lambda>\<omega>1. measure_pmf (K2 x2) \<bind> (\<lambda>y. K2.T y \<bind> (\<lambda>\<omega>. return (stream_space (count_space UNIV)) (y ## \<omega>))) \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp (a, b)) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))
[PROOF STEP]
apply (auto
         simp add: space_stream_space bind_assoc[where R=S and N=S] bind_return_distr[symmetric]
                   Kp_def T1K2.bind_rotate[where N=S] split_beta' set_pair_pmf space_subprob_algebra
                   bind_pair_pmf[of "case_prod M" for M, unfolded split, symmetric, where N=S] szip\<^sub>E_def
                   stream_eq_Stream_iff bind_return[where N=S] space_bind[where N=S]
         simp del: measurable_pmf_measure1
         intro!: bind_measure_pmf_cong[where N=S] subprob_space_bind[where N=S] subprob_space_measure_pmf
                 T1x bind_cong[where M="MC_syntax.T K x" for K x] arg_cong2[where f=return])
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
(case x of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) = measure_pmf (Kp x) \<bind> (\<lambda>s. distr (case s of (x1, x2) \<Rightarrow> K1.T x1 \<bind> (\<lambda>\<omega>1. K2.T x2 \<bind> (\<lambda>\<omega>2. return (stream_space (count_space UNIV)) (szip\<^sub>E x1 x2 (\<omega>1, \<omega>2))))) (stream_space (count_space UNIV)) ((##) s))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma cast_document_disconnected_nodes_shadow_root_child_nodes [simp]:
  "is_shadow_root_kind x \<Longrightarrow>
disconnected_nodes (cast (the (cast x)\<lparr>RShadowRoot.child_nodes := arg\<rparr>)) = disconnected_nodes x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_shadow_root_kind x \<Longrightarrow> disconnected_nodes (cast (the (cast x)\<lparr>RShadowRoot.child_nodes := arg\<rparr>)) = disconnected_nodes x
[PROOF STEP]
by(auto simp add: is_shadow_root_kind_def cast\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>2\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def cast\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t\<^sub>2\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def
      RDocument.extend_def RDocument.truncate_def split: option.splits sum.splits)


[STATEMENT]
lemma load_nonexistant_obj:
  assumes "tag c = True"
    and "perm_load c = True"
    and "offset c + |t|\<^sub>\<tau> \<le> base c + len c"
    and "offset c \<ge> base c"
    and "offset c mod |t|\<^sub>\<tau> = 0"
    and "Mapping.lookup (heap_map h) (block_id c) = None"
  shows "load h c t = Error (LogicErr MissingResource)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. load h c t = Error (LogicErr MissingResource)
[PROOF STEP]
unfolding load_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (if tag c = False then Error (C2Err TagViolation) else if perm_load c = False then Error (C2Err PermitLoadViolation) else if int (base c + len c) < offset c + int |t|\<^sub>\<tau> then Error (C2Err LengthViolation) else if offset c < int (base c) then Error (C2Err LengthViolation) else if offset c mod int |t|\<^sub>\<tau> \<noteq> 0 then Error (C2Err BadAddressViolation) else let obj = Mapping.lookup (heap_map h) (block_id c) in case obj of None \<Rightarrow> Error (LogicErr MissingResource) | Some Freed \<Rightarrow> Error (LogicErr UseAfterFree) | Some (Map m) \<Rightarrow> if offset c < int (fst (bounds m)) \<or> int (snd (bounds m)) < offset c + int |t|\<^sub>\<tau> then Error (LogicErr BufferOverrun) else Success (retrieve_tval m (nat (offset c)) t (perm_cap_load c))) = Error (LogicErr MissingResource)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
tag c = True
perm_load c = True
offset c + int |t|\<^sub>\<tau> \<le> int (base c + len c)
int (base c) \<le> offset c
offset c mod int |t|\<^sub>\<tau> = 0
Mapping.lookup (heap_map h) (block_id c) = None

goal (1 subgoal):
 1. (if tag c = False then Error (C2Err TagViolation) else if perm_load c = False then Error (C2Err PermitLoadViolation) else if int (base c + len c) < offset c + int |t|\<^sub>\<tau> then Error (C2Err LengthViolation) else if offset c < int (base c) then Error (C2Err LengthViolation) else if offset c mod int |t|\<^sub>\<tau> \<noteq> 0 then Error (C2Err BadAddressViolation) else let obj = Mapping.lookup (heap_map h) (block_id c) in case obj of None \<Rightarrow> Error (LogicErr MissingResource) | Some Freed \<Rightarrow> Error (LogicErr UseAfterFree) | Some (Map m) \<Rightarrow> if offset c < int (fst (bounds m)) \<or> int (snd (bounds m)) < offset c + int |t|\<^sub>\<tau> then Error (LogicErr BufferOverrun) else Success (retrieve_tval m (nat (offset c)) t (perm_cap_load c))) = Error (LogicErr MissingResource)
[PROOF STEP]
by auto


[STATEMENT]
lemma (in simplification) split_step_in_mult:
  assumes "(Qfin, Qeq) \<in> \<Q>fin" "finite \<Q>fin" "x \<in> nongens Qfin" "cov x Qfin G" "fv Qfin \<subseteq> F"
  shows "((nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)),
          (nongens \<circ> fst) `# mset_set \<Q>fin) \<in> mult {(X, Y). X \<subset> Y \<and> Y \<subseteq> F}"
    (is "(?f (insert ?Q (?A \<union> ?B)), ?C) \<in> mult ?R")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)), (nongens \<circ> fst) `# mset_set \<Q>fin) \<in> mult {(X, Y). X \<subset> Y \<and> Y \<subseteq> F}
[PROOF STEP]
proof (subst preorder.mult\<^sub>D\<^sub>M[where less_eq = "(in_rel ?R)\<^sup>=\<^sup>="])
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
define X where "X = {(Qfin, Qeq)}"
[PROOF STATE]
proof (state)
this:
X = {(Qfin, Qeq)}

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
define Y where "Y = insert ?Q ?B - (?A \<inter> insert ?Q ?B)"
[PROOF STATE]
proof (state)
this:
Y = insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G) - (\<Q>fin - {(Qfin, Qeq)}) \<inter> insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
have "?f X \<noteq> {#}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (nongens \<circ> fst) `# mset_set X \<noteq> {#}
[PROOF STEP]
unfolding X_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (nongens \<circ> fst) `# mset_set {(Qfin, Qeq)} \<noteq> {#}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(nongens \<circ> fst) `# mset_set X \<noteq> {#}

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(nongens \<circ> fst) `# mset_set X \<noteq> {#}

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
from assms(1,2)
[PROOF STATE]
proof (chain)
picking this:
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
[PROOF STEP]
have "?f X \<subseteq># ?C"
[PROOF STATE]
proof (prove)
using this:
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin

goal (1 subgoal):
 1. (nongens \<circ> fst) `# mset_set X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin
[PROOF STEP]
unfolding X_def
[PROOF STATE]
proof (prove)
using this:
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin

goal (1 subgoal):
 1. (nongens \<circ> fst) `# mset_set {(Qfin, Qeq)} \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin
[PROOF STEP]
by (auto intro!: image_eqI[where x = "(Qfin, Qeq)"])
[PROOF STATE]
proof (state)
this:
(nongens \<circ> fst) `# mset_set X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(nongens \<circ> fst) `# mset_set X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
from assms(1,2,4)
[PROOF STATE]
proof (chain)
picking this:
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
cov x Qfin G
[PROOF STEP]
have XY:
    "insert ?Q (?A \<union> ?B) = \<Q>fin - X \<union> Y" "X \<subseteq> \<Q>fin" "(\<Q>fin - X) \<inter> Y = {}" "finite X" "finite Y"
[PROOF STATE]
proof (prove)
using this:
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
cov x Qfin G

goal (1 subgoal):
 1. (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G) = \<Q>fin - X \<union> Y &&& X \<subseteq> \<Q>fin) &&& (\<Q>fin - X) \<inter> Y = {} &&& finite X &&& finite Y
[PROOF STEP]
unfolding X_def Y_def
[PROOF STATE]
proof (prove)
using this:
(Qfin, Qeq) \<in> \<Q>fin
finite \<Q>fin
cov x Qfin G

goal (1 subgoal):
 1. (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G) = \<Q>fin - {(Qfin, Qeq)} \<union> (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G) - (\<Q>fin - {(Qfin, Qeq)}) \<inter> insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) &&& {(Qfin, Qeq)} \<subseteq> \<Q>fin) &&& (\<Q>fin - {(Qfin, Qeq)}) \<inter> (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G) - (\<Q>fin - {(Qfin, Qeq)}) \<inter> insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = {} &&& finite {(Qfin, Qeq)} &&& finite (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G) - (\<Q>fin - {(Qfin, Qeq)}) \<inter> insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G) = \<Q>fin - X \<union> Y
X \<subseteq> \<Q>fin
(\<Q>fin - X) \<inter> Y = {}
finite X
finite Y

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
with assms(2)
[PROOF STATE]
proof (chain)
picking this:
finite \<Q>fin
insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G) = \<Q>fin - X \<union> Y
X \<subseteq> \<Q>fin
(\<Q>fin - X) \<inter> Y = {}
finite X
finite Y
[PROOF STEP]
have "?f (insert ?Q (?A \<union> ?B)) = ?C - ?f X + ?f Y"
[PROOF STATE]
proof (prove)
using this:
finite \<Q>fin
insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G) = \<Q>fin - X \<union> Y
X \<subseteq> \<Q>fin
(\<Q>fin - X) \<inter> Y = {}
finite X
finite Y

goal (1 subgoal):
 1. (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - (nongens \<circ> fst) `# mset_set X + (nongens \<circ> fst) `# mset_set Y
[PROOF STEP]
by (force simp: mset_set_Union mset_set_Diff multiset.map_comp o_def
        dest: subset_imp_msubset_mset_set elim: subset_mset.trans
        intro!: subset_imp_msubset_mset_set image_mset_subseteq_mono subset_mset.diff_add_assoc2
        trans[OF image_mset_Diff])
[PROOF STATE]
proof (state)
this:
(nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - (nongens \<circ> fst) `# mset_set X + (nongens \<circ> fst) `# mset_set Y

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - (nongens \<circ> fst) `# mset_set X + (nongens \<circ> fst) `# mset_set Y

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
(nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - (nongens \<circ> fst) `# mset_set X + (nongens \<circ> fst) `# mset_set Y

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
fix A
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
assume "A \<in> Y"
[PROOF STATE]
proof (state)
this:
A \<in> Y

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
A \<in> Y
[PROOF STEP]
have "A \<in> insert ?Q ?B"
[PROOF STATE]
proof (prove)
using this:
A \<in> Y

goal (1 subgoal):
 1. A \<in> insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)
[PROOF STEP]
unfolding Y_def
[PROOF STATE]
proof (prove)
using this:
A \<in> insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G) - (\<Q>fin - {(Qfin, Qeq)}) \<inter> insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)

goal (1 subgoal):
 1. A \<in> insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
A \<in> insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
with assms(3,4)
[PROOF STATE]
proof (chain)
picking this:
x \<in> nongens Qfin
cov x Qfin G
A \<in> insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)
[PROOF STEP]
have "nongens (fst A) \<subseteq> nongens Qfin - {x}"
[PROOF STATE]
proof (prove)
using this:
x \<in> nongens Qfin
cov x Qfin G
A \<in> insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)

goal (1 subgoal):
 1. nongens (fst A) \<subseteq> nongens Qfin - {x}
[PROOF STEP]
using Gen_cp_subst[of _ Qfin x] Gen_simp[OF cov_Gen_qps[OF assms(4)]]
        gen_Gen_simp[OF gen.intros(7)[OF disjI1], of _ Qfin _ "DISJ (qps G)"]
[PROOF STATE]
proof (prove)
using this:
x \<in> nongens Qfin
cov x Qfin G
A \<in> insert (simp (Conj Qfin (DISJ (qps G))), Qeq) ((\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)
\<lbrakk>Gen ?z Qfin; ?z \<noteq> x\<rbrakk> \<Longrightarrow> Gen ?z (cp (Qfin[x \<^bold>\<rightarrow> ?y]))
x \<in> fv Qfin \<Longrightarrow> Gen x (simp (Conj Qfin (DISJ (qps G))))
gen ?x Qfin ?G \<Longrightarrow> Gen ?x (simp (Conj Qfin (DISJ (qps G))))

goal (1 subgoal):
 1. nongens (fst A) \<subseteq> nongens Qfin - {x}
[PROOF STEP]
by (fastforce simp: nongens_def fv_subst simp del: cp.simps
          intro!: gen.intros(7) dest!: fv_cp[THEN set_mp] fv_simp[THEN set_mp] fv_DISJ[THEN set_mp, rotated 1]
          elim: cov_fv[OF assms(4) _ qps_in, THEN conjunct2, THEN set_mp]
          cov_fv[OF assms(4) _ eqs_in, THEN conjunct2, THEN set_mp])
[PROOF STATE]
proof (state)
this:
nongens (fst A) \<subseteq> nongens Qfin - {x}

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
with assms(3)
[PROOF STATE]
proof (chain)
picking this:
x \<in> nongens Qfin
nongens (fst A) \<subseteq> nongens Qfin - {x}
[PROOF STEP]
have "nongens (fst A) \<subset> nongens Qfin"
[PROOF STATE]
proof (prove)
using this:
x \<in> nongens Qfin
nongens (fst A) \<subseteq> nongens Qfin - {x}

goal (1 subgoal):
 1. nongens (fst A) \<subset> nongens Qfin
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
nongens (fst A) \<subset> nongens Qfin

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
with assms(5)
[PROOF STATE]
proof (chain)
picking this:
fv Qfin \<subseteq> F
nongens (fst A) \<subset> nongens Qfin
[PROOF STEP]
have "\<exists>B \<in> X. nongens (fst A) \<subset> nongens (fst B) \<and> nongens (fst B) \<subseteq> F"
[PROOF STATE]
proof (prove)
using this:
fv Qfin \<subseteq> F
nongens (fst A) \<subset> nongens Qfin

goal (1 subgoal):
 1. \<exists>B\<in>X. nongens (fst A) \<subset> nongens (fst B) \<and> nongens (fst B) \<subseteq> F
[PROOF STEP]
by (auto simp: X_def nongens_def)
[PROOF STATE]
proof (state)
this:
\<exists>B\<in>X. nongens (fst A) \<subset> nongens (fst B) \<and> nongens (fst B) \<subseteq> F

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
?A3 \<in> Y \<Longrightarrow> \<exists>B\<in>X. nongens (fst ?A3) \<subset> nongens (fst B) \<and> nongens (fst B) \<subseteq> F

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
with XY
[PROOF STATE]
proof (chain)
picking this:
insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G) = \<Q>fin - X \<union> Y
X \<subseteq> \<Q>fin
(\<Q>fin - X) \<inter> Y = {}
finite X
finite Y
?A3 \<in> Y \<Longrightarrow> \<exists>B\<in>X. nongens (fst ?A3) \<subset> nongens (fst B) \<and> nongens (fst B) \<subseteq> F
[PROOF STEP]
have "\<And>A. A \<in># ?f Y \<Longrightarrow> \<exists>B. B \<in># ?f X \<and> A \<subset> B \<and> B \<subseteq> F"
[PROOF STATE]
proof (prove)
using this:
insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G) = \<Q>fin - X \<union> Y
X \<subseteq> \<Q>fin
(\<Q>fin - X) \<inter> Y = {}
finite X
finite Y
?A3 \<in> Y \<Longrightarrow> \<exists>B\<in>X. nongens (fst ?A3) \<subset> nongens (fst B) \<and> nongens (fst B) \<subseteq> F

goal (1 subgoal):
 1. \<And>A. A \<in># (nongens \<circ> fst) `# mset_set Y \<Longrightarrow> \<exists>B. B \<in># (nongens \<circ> fst) `# mset_set X \<and> A \<subset> B \<and> B \<subseteq> F
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?A1 \<in># (nongens \<circ> fst) `# mset_set Y \<Longrightarrow> \<exists>B. B \<in># (nongens \<circ> fst) `# mset_set X \<and> ?A1 \<subset> B \<and> B \<subseteq> F

goal (2 subgoals):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
 2. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(nongens \<circ> fst) `# mset_set X \<noteq> {#}
(nongens \<circ> fst) `# mset_set X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin
(nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - (nongens \<circ> fst) `# mset_set X + (nongens \<circ> fst) `# mset_set Y
?A1 \<in># (nongens \<circ> fst) `# mset_set Y \<Longrightarrow> \<exists>B. B \<in># (nongens \<circ> fst) `# mset_set X \<and> ?A1 \<subset> B \<and> B \<subseteq> F
[PROOF STEP]
show "\<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># ?C \<and> ?f (insert ?Q (?A \<union> ?B)) = ?C - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))"
[PROOF STATE]
proof (prove)
using this:
(nongens \<circ> fst) `# mset_set X \<noteq> {#}
(nongens \<circ> fst) `# mset_set X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin
(nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - (nongens \<circ> fst) `# mset_set X + (nongens \<circ> fst) `# mset_set Y
?A1 \<in># (nongens \<circ> fst) `# mset_set Y \<Longrightarrow> \<exists>B. B \<in># (nongens \<circ> fst) `# mset_set X \<and> ?A1 \<subset> B \<and> B \<subseteq> F

goal (1 subgoal):
 1. \<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>X Y. X \<noteq> {#} \<and> X \<subseteq># (nongens \<circ> fst) `# mset_set \<Q>fin \<and> (nongens \<circ> fst) `# mset_set (insert (simp (Conj Qfin (DISJ (qps G))), Qeq) (\<Q>fin - {(Qfin, Qeq)} \<union> (\<lambda>y. (cp (Qfin[x \<^bold>\<rightarrow> y]), insert (x, y) Qeq)) ` eqs x G)) = (nongens \<circ> fst) `# mset_set \<Q>fin - X + Y \<and> (\<forall>k. k \<in># Y \<longrightarrow> (\<exists>a. a \<in># X \<and> k \<subset> a \<and> a \<subseteq> F))

goal (1 subgoal):
 1. class.preorder (in_rel {(X, Y). X \<subset> Y \<and> Y \<subseteq> F})\<^sup>=\<^sup>= (\<lambda>X Y. X \<subset> Y \<and> Y \<subseteq> F)
[PROOF STEP]
qed (unfold_locales, auto)


[STATEMENT]
lemma new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t [simp]:
  assumes "new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_document_ptr, h')"
  assumes "ptr \<noteq> new_document_ptr"
  shows "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t ptr h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. get ptr h = get ptr h'
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t h = (new_document_ptr, h')
ptr \<noteq> new_document_ptr

goal (1 subgoal):
 1. get ptr h = get ptr h'
[PROOF STEP]
by(auto simp add: new\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def Let_def)


[STATEMENT]
lemma update_cases_kD:
  assumes "(\<pi>\<^sub>2(r) = 0) = (\<pi>\<^sub>3(r) = unk)"
      and "ip \<in> kD(rt)"
      and c2: "sqn rt ip < \<pi>\<^sub>2(r) \<Longrightarrow> P (rt (ip \<mapsto> r ))"
      and c3: "\<lbrakk>sqn rt ip = \<pi>\<^sub>2(r); the (dhops rt ip) > \<pi>\<^sub>5(r)\<rbrakk>
                \<Longrightarrow> P (rt (ip \<mapsto> r ))"
      and c4: "\<lbrakk>sqn rt ip = \<pi>\<^sub>2(r); the (flag rt ip) = inv\<rbrakk>
                \<Longrightarrow> P (rt (ip \<mapsto> r ))"
      and c5: "\<pi>\<^sub>3(r) = unk \<Longrightarrow> P (rt (ip \<mapsto> (\<pi>\<^sub>2(the \<sigma>\<^bsub>route\<^esub>(rt, ip)), \<pi>\<^sub>3(r),
                                            \<pi>\<^sub>4(r), \<pi>\<^sub>5(r), \<pi>\<^sub>6(r))))"
      and c6: "\<lbrakk>sqn rt ip \<ge> \<pi>\<^sub>2(r); \<pi>\<^sub>3(r) = kno;
                sqn rt ip = \<pi>\<^sub>2(r) \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5(r) \<and> the (flag rt ip) = val\<rbrakk>
                \<Longrightarrow> P (rt (ip \<mapsto> the \<sigma>\<^bsub>route\<^esub>(rt, ip)))"
  shows "(P (update rt ip r))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (update rt ip r)
[PROOF STEP]
using assms(1)
[PROOF STATE]
proof (prove)
using this:
(\<pi>\<^sub>2 r = 0) = (\<pi>\<^sub>3 r = unk)

goal (1 subgoal):
 1. P (update rt ip r)
[PROOF STEP]
proof (rule update_cases)
[PROOF STATE]
proof (state)
goal (6 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; sqn rt ip < \<pi>\<^sub>2 r\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 3. \<lbrakk>ip \<in> kD rt; sqn rt ip = \<pi>\<^sub>2 r; \<pi>\<^sub>5 r < the (dhops rt ip)\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 4. \<lbrakk>ip \<in> kD rt; sqn rt ip = \<pi>\<^sub>2 r; the (flag rt ip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 5. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>3 r = unk\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> (\<pi>\<^sub>2 (the (rt ip)), \<pi>\<^sub>3 r, \<pi>\<^sub>4 r, \<pi>\<^sub>5 r, \<pi>\<^sub>6 r)))
 6. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
assume "sqn rt ip < \<pi>\<^sub>2(r)"
[PROOF STATE]
proof (state)
this:
sqn rt ip < \<pi>\<^sub>2 r

goal (6 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; sqn rt ip < \<pi>\<^sub>2 r\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 3. \<lbrakk>ip \<in> kD rt; sqn rt ip = \<pi>\<^sub>2 r; \<pi>\<^sub>5 r < the (dhops rt ip)\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 4. \<lbrakk>ip \<in> kD rt; sqn rt ip = \<pi>\<^sub>2 r; the (flag rt ip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 5. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>3 r = unk\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> (\<pi>\<^sub>2 (the (rt ip)), \<pi>\<^sub>3 r, \<pi>\<^sub>4 r, \<pi>\<^sub>5 r, \<pi>\<^sub>6 r)))
 6. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
thus "P (rt(ip \<mapsto> r))"
[PROOF STATE]
proof (prove)
using this:
sqn rt ip < \<pi>\<^sub>2 r

goal (1 subgoal):
 1. P (rt(ip \<mapsto> r))
[PROOF STEP]
by (rule c2)
[PROOF STATE]
proof (state)
this:
P (rt(ip \<mapsto> r))

goal (5 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; sqn rt ip = \<pi>\<^sub>2 r; \<pi>\<^sub>5 r < the (dhops rt ip)\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 3. \<lbrakk>ip \<in> kD rt; sqn rt ip = \<pi>\<^sub>2 r; the (flag rt ip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 4. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>3 r = unk\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> (\<pi>\<^sub>2 (the (rt ip)), \<pi>\<^sub>3 r, \<pi>\<^sub>4 r, \<pi>\<^sub>5 r, \<pi>\<^sub>6 r)))
 5. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; sqn rt ip = \<pi>\<^sub>2 r; \<pi>\<^sub>5 r < the (dhops rt ip)\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 3. \<lbrakk>ip \<in> kD rt; sqn rt ip = \<pi>\<^sub>2 r; the (flag rt ip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 4. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>3 r = unk\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> (\<pi>\<^sub>2 (the (rt ip)), \<pi>\<^sub>3 r, \<pi>\<^sub>4 r, \<pi>\<^sub>5 r, \<pi>\<^sub>6 r)))
 5. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
assume "sqn rt ip = \<pi>\<^sub>2(r)"
       and "the (dhops rt ip) > \<pi>\<^sub>5(r)"
[PROOF STATE]
proof (state)
this:
sqn rt ip = \<pi>\<^sub>2 r
\<pi>\<^sub>5 r < the (dhops rt ip)

goal (5 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; sqn rt ip = \<pi>\<^sub>2 r; \<pi>\<^sub>5 r < the (dhops rt ip)\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 3. \<lbrakk>ip \<in> kD rt; sqn rt ip = \<pi>\<^sub>2 r; the (flag rt ip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 4. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>3 r = unk\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> (\<pi>\<^sub>2 (the (rt ip)), \<pi>\<^sub>3 r, \<pi>\<^sub>4 r, \<pi>\<^sub>5 r, \<pi>\<^sub>6 r)))
 5. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
thus "P (rt(ip \<mapsto> r))"
[PROOF STATE]
proof (prove)
using this:
sqn rt ip = \<pi>\<^sub>2 r
\<pi>\<^sub>5 r < the (dhops rt ip)

goal (1 subgoal):
 1. P (rt(ip \<mapsto> r))
[PROOF STEP]
by (rule c3)
[PROOF STATE]
proof (state)
this:
P (rt(ip \<mapsto> r))

goal (4 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; sqn rt ip = \<pi>\<^sub>2 r; the (flag rt ip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 3. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>3 r = unk\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> (\<pi>\<^sub>2 (the (rt ip)), \<pi>\<^sub>3 r, \<pi>\<^sub>4 r, \<pi>\<^sub>5 r, \<pi>\<^sub>6 r)))
 4. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; sqn rt ip = \<pi>\<^sub>2 r; the (flag rt ip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 3. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>3 r = unk\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> (\<pi>\<^sub>2 (the (rt ip)), \<pi>\<^sub>3 r, \<pi>\<^sub>4 r, \<pi>\<^sub>5 r, \<pi>\<^sub>6 r)))
 4. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
assume "sqn rt ip = \<pi>\<^sub>2(r)"
       and "the (flag rt ip) = inv"
[PROOF STATE]
proof (state)
this:
sqn rt ip = \<pi>\<^sub>2 r
the (flag rt ip) = Aodv_Basic.inv

goal (4 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; sqn rt ip = \<pi>\<^sub>2 r; the (flag rt ip) = Aodv_Basic.inv\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> r))
 3. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>3 r = unk\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> (\<pi>\<^sub>2 (the (rt ip)), \<pi>\<^sub>3 r, \<pi>\<^sub>4 r, \<pi>\<^sub>5 r, \<pi>\<^sub>6 r)))
 4. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
thus "P (rt(ip \<mapsto> r))"
[PROOF STATE]
proof (prove)
using this:
sqn rt ip = \<pi>\<^sub>2 r
the (flag rt ip) = Aodv_Basic.inv

goal (1 subgoal):
 1. P (rt(ip \<mapsto> r))
[PROOF STEP]
by (rule c4)
[PROOF STATE]
proof (state)
this:
P (rt(ip \<mapsto> r))

goal (3 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>3 r = unk\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> (\<pi>\<^sub>2 (the (rt ip)), \<pi>\<^sub>3 r, \<pi>\<^sub>4 r, \<pi>\<^sub>5 r, \<pi>\<^sub>6 r)))
 3. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>3 r = unk\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> (\<pi>\<^sub>2 (the (rt ip)), \<pi>\<^sub>3 r, \<pi>\<^sub>4 r, \<pi>\<^sub>5 r, \<pi>\<^sub>6 r)))
 3. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
assume "\<pi>\<^sub>3(r) = unk"
[PROOF STATE]
proof (state)
this:
\<pi>\<^sub>3 r = unk

goal (3 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>3 r = unk\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> (\<pi>\<^sub>2 (the (rt ip)), \<pi>\<^sub>3 r, \<pi>\<^sub>4 r, \<pi>\<^sub>5 r, \<pi>\<^sub>6 r)))
 3. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
thus "P (rt (ip \<mapsto> (\<pi>\<^sub>2(the \<sigma>\<^bsub>route\<^esub>(rt, ip)), \<pi>\<^sub>3(r), \<pi>\<^sub>4(r), \<pi>\<^sub>5(r), \<pi>\<^sub>6(r))))"
[PROOF STATE]
proof (prove)
using this:
\<pi>\<^sub>3 r = unk

goal (1 subgoal):
 1. P (rt(ip \<mapsto> (\<pi>\<^sub>2 (the (rt ip)), \<pi>\<^sub>3 r, \<pi>\<^sub>4 r, \<pi>\<^sub>5 r, \<pi>\<^sub>6 r)))
[PROOF STEP]
by (rule c5)
[PROOF STATE]
proof (state)
this:
P (rt(ip \<mapsto> (\<pi>\<^sub>2 (the (rt ip)), \<pi>\<^sub>3 r, \<pi>\<^sub>4 r, \<pi>\<^sub>5 r, \<pi>\<^sub>6 r)))

goal (2 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
assume "sqn rt ip \<ge> \<pi>\<^sub>2(r)"
       and "\<pi>\<^sub>3(r) = kno"
       and "sqn rt ip = \<pi>\<^sub>2(r) \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5(r) \<and> the (flag rt ip) = val"
[PROOF STATE]
proof (state)
this:
\<pi>\<^sub>2 r \<le> sqn rt ip
\<pi>\<^sub>3 r = kno
sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val

goal (2 subgoals):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
 2. \<lbrakk>ip \<in> kD rt; \<pi>\<^sub>2 r \<le> sqn rt ip; \<pi>\<^sub>3 r = kno; sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val\<rbrakk> \<Longrightarrow> P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
thus "P (rt (ip \<mapsto> the (rt ip)))"
[PROOF STATE]
proof (prove)
using this:
\<pi>\<^sub>2 r \<le> sqn rt ip
\<pi>\<^sub>3 r = kno
sqn rt ip = \<pi>\<^sub>2 r \<Longrightarrow> the (dhops rt ip) \<le> \<pi>\<^sub>5 r \<and> the (flag rt ip) = val

goal (1 subgoal):
 1. P (rt(ip \<mapsto> the (rt ip)))
[PROOF STEP]
by (rule c6)
[PROOF STATE]
proof (state)
this:
P (rt(ip \<mapsto> the (rt ip)))

goal (1 subgoal):
 1. ip \<notin> kD rt \<Longrightarrow> P (rt(ip \<mapsto> r))
[PROOF STEP]
qed (simp add: \<open>ip \<in> kD(rt)\<close>)