[STATEMENT]
lemma "\<exists>x. f x = x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>x. f x = x
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>x. f x = x
[PROOF STEP]
oops


[STATEMENT]
lemma get_curr_win2_low_equal: "low_equal s1 s2 \<Longrightarrow>
t1 = (snd (fst (get_curr_win () s1))) \<Longrightarrow>
t2 = (snd (fst (get_curr_win () s2))) \<Longrightarrow>
low_equal t1 t2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>low_equal s1 s2; t1 = snd (fst (get_curr_win () s1)); t2 = snd (fst (get_curr_win () s2))\<rbrakk> \<Longrightarrow> low_equal t1 t2
[PROOF STEP]
apply (simp add: low_equal_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cpu_reg s1 = cpu_reg s2 \<and> user_reg s1 = user_reg s2 \<and> sys_reg s1 = sys_reg s2 \<and> (\<forall>va. virt_to_phys va (mmu s1) (mem s1) = virt_to_phys va (mmu s2) (mem s2)) \<and> (\<forall>pa. user_accessible s1 pa \<longrightarrow> mem_equal s1 s2 pa) \<and> mmu s1 = mmu s2 \<and> state_var s1 = state_var s2 \<and> traps s1 = traps s2 \<and> undef s1 = undef s2; t1 = snd (fst (get_curr_win () s1)); t2 = snd (fst (get_curr_win () s2))\<rbrakk> \<Longrightarrow> cpu_reg (snd (fst (get_curr_win () s1))) = cpu_reg (snd (fst (get_curr_win () s2))) \<and> user_reg (snd (fst (get_curr_win () s1))) = user_reg (snd (fst (get_curr_win () s2))) \<and> sys_reg (snd (fst (get_curr_win () s1))) = sys_reg (snd (fst (get_curr_win () s2))) \<and> (\<forall>va. virt_to_phys va (mmu (snd (fst (get_curr_win () s1)))) (mem (snd (fst (get_curr_win () s1)))) = virt_to_phys va (mmu (snd (fst (get_curr_win () s2)))) (mem (snd (fst (get_curr_win () s2))))) \<and> (\<forall>pa. user_accessible (snd (fst (get_curr_win () s1))) pa \<longrightarrow> mem_equal (snd (fst (get_curr_win () s1))) (snd (fst (get_curr_win () s2))) pa) \<and> mmu (snd (fst (get_curr_win () s1))) = mmu (snd (fst (get_curr_win () s2))) \<and> state_var (snd (fst (get_curr_win () s1))) = state_var (snd (fst (get_curr_win () s2))) \<and> traps (snd (fst (get_curr_win () s1))) = traps (snd (fst (get_curr_win () s2))) \<and> undef (snd (fst (get_curr_win () s1))) = undef (snd (fst (get_curr_win () s2)))
[PROOF STEP]
apply (simp add: get_curr_win_def cpu_reg_val_def get_CWP_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cpu_reg s1 = cpu_reg s2 \<and> user_reg s1 = user_reg s2 \<and> sys_reg s1 = sys_reg s2 \<and> (\<forall>va. virt_to_phys va (mmu s1) (mem s1) = virt_to_phys va (mmu s2) (mem s2)) \<and> (\<forall>pa. user_accessible s1 pa \<longrightarrow> mem_equal s1 s2 pa) \<and> mmu s1 = mmu s2 \<and> state_var s1 = state_var s2 \<and> traps s1 = traps s2 \<and> undef s1 = undef s2; t1 = snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s1)); t2 = snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s2))\<rbrakk> \<Longrightarrow> cpu_reg (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s1))) = cpu_reg (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s2))) \<and> user_reg (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s1))) = user_reg (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s2))) \<and> sys_reg (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s1))) = sys_reg (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s2))) \<and> (\<forall>va. virt_to_phys va (mmu (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s1)))) (mem (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s1)))) = virt_to_phys va (mmu (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s2)))) (mem (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s2))))) \<and> (\<forall>pa. user_accessible (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s1))) pa \<longrightarrow> mem_equal (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s1))) (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s2))) pa) \<and> mmu (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s1))) = mmu (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s2))) \<and> state_var (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s1))) = state_var (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s2))) \<and> traps (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s1))) = traps (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s2))) \<and> undef (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s1))) = undef (snd (fst (gets (\<lambda>s. ucast (ucast (cpu_reg s PSR AND 31))) s2)))
[PROOF STEP]
by (auto simp add: simpler_gets_def)


[STATEMENT]
theorem (in labeled_stateful_typed_model) par_comp_constr_stateful_typed:
  assumes \: "par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ Sec" "fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {}"
  and \: "\ \<Turnstile>\<^sub>s unlabel \" "interpretation\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \" "wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \" "wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \)"
  shows "(\<forall>n. \ \<Turnstile>\<^sub>s proj_unl n \) \<or>
         (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> (\' leaks Sec under \))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
let ?P = "\<lambda>n A D.
       \<forall>(i, p) \<in> setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n A) \<union> set D.
       \<forall>(j, q) \<in> setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n A) \<union> set D.
          (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
have 1: "\<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (unlabel \) = {}"
          "fv\<^sub>s\<^sub>s\<^sub>t (unlabel \) \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (unlabel \) = {}" "ground {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {} &&& fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {} &&& ground {}
[PROOF STEP]
using \(2)
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {}

goal (1 subgoal):
 1. \<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {} &&& fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {} &&& ground {}
[PROOF STEP]
by simp_all
[PROOF STATE]
proof (state)
this:
\<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {}
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {}
ground {}

goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
have 2: "\<And>n. \<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (proj_unl n \) = {}"
          "\<And>n. fv\<^sub>s\<^sub>s\<^sub>t (proj_unl n \) \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (proj_unl n \) = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>n. \<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n \) = {}) &&& (\<And>n. fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n \) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n \) = {})
[PROOF STEP]
using 1 sst_vars_proj_subset[of _ \]
[PROOF STATE]
proof (prove)
using this:
\<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {}
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {}
ground {}
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n \) \<subseteq> fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n \) \<subseteq> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n \) \<subseteq> vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \

goal (1 subgoal):
 1. (\<And>n. \<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n \) = {}) &&& (\<And>n. fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n \) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n \) = {})
[PROOF STEP]
by fast+
[PROOF STATE]
proof (state)
this:
\<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n9 \) = {}
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n9 \) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n9 \) = {}

goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
note 3 = par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t_proj[OF \(1)]
[PROOF STATE]
proof (state)
this:
par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n \) Sec

goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
have 4:
      "\<lbrakk>{}; set (unlabel []) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \'; unlabel \\<rbrakk>\<^sub>s \' \<longleftrightarrow>
        (\<exists>B\<in>set (tr\<^sub>p\<^sub>c \ []). \<lbrakk>{}; unlabel B\<rbrakk>\<^sub>d \')"
    when \': "interpretation\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \'" for \'
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>{}; set (unlabel []) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \'; unlabel \\<rbrakk>\<^sub>s \' = (\<exists>B\<in>set (tr\<^sub>p\<^sub>c \ []). \<lbrakk>{}; unlabel B\<rbrakk>\<^sub>d \')
[PROOF STEP]
using tr_par_sem_equiv[OF 1 _ \'] \(1)
[PROOF STATE]
proof (prove)
using this:
\<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<union> set []. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<union> set []. (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j \<Longrightarrow> \<lbrakk>{}; set (unlabel []) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \'; unlabel \\<rbrakk>\<^sub>s \' = (\<exists>B\<in>set (tr\<^sub>p\<^sub>c \ []). \<lbrakk>{}; unlabel B\<rbrakk>\<^sub>d \')
par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ Sec

goal (1 subgoal):
 1. \<lbrakk>{}; set (unlabel []) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \'; unlabel \\<rbrakk>\<^sub>s \' = (\<exists>B\<in>set (tr\<^sub>p\<^sub>c \ []). \<lbrakk>{}; unlabel B\<rbrakk>\<^sub>d \')
[PROOF STEP]
unfolding par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t_def constr_sem_d_def
[PROOF STATE]
proof (prove)
using this:
\<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<union> set []. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<union> set []. (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j \<Longrightarrow> \<lbrakk>{}; set (unlabel []) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \'; unlabel \\<rbrakk>\<^sub>s \' = (\<exists>B\<in>set (tr\<^sub>p\<^sub>c \ []). \<lbrakk>{}; unlabel B\<rbrakk>\<^sub>d \')
(\<forall>l1 l2. l1 \<noteq> l2 \<longrightarrow> GSMP_disjoint (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj l1 \) \<union> pair ` setops\<^sub>s\<^sub>s\<^sub>t (proj_unl l1 \<A>)) (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj l2 \<A>) \<union> pair ` setops\<^sub>s\<^sub>s\<^sub>t (proj_unl l2 \)) Sec) \<and> (\<forall>s\<in>Sec. \<not> {} \<turnstile>\<^sub>c s) \<and> ground Sec \<and> (\<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t \. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t \. (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j)

goal (1 subgoal):
 1. \<lbrakk>{}; set (unlabel []) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \'; unlabel \\<rbrakk>\<^sub>s \' = (\<exists>B\<in>set (tr\<^sub>p\<^sub>c \ []). \<lbrakk>{}; unlabel B\<rbrakk>\<^sub>d \')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
subst_domain ?\'11 = \<V> \<and> ground (subst_range ?\'11) \<Longrightarrow> \<lbrakk>{}; set (unlabel []) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t ?\'11; unlabel \\<rbrakk>\<^sub>s ?\'11 = (\<exists>B\<in>set (tr\<^sub>p\<^sub>c \ []). \<lbrakk>{}; unlabel B\<rbrakk>\<^sub>d ?\'11)

goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
obtain \' where \': "\' \<in> set (tr\<^sub>p\<^sub>c \ [])" "\ \<Turnstile> \<langle>unlabel \'\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>\'. \<lbrakk>\' \<in> set (tr\<^sub>p\<^sub>c \ []); \ \<Turnstile> \<langle>unlabel \'\<rangle>\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using 4[OF \(2)] \(1)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>{}; set (unlabel []) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \; unlabel \\<rbrakk>\<^sub>s \ = (\<exists>B\<in>set (tr\<^sub>p\<^sub>c \ []). \<lbrakk>{}; unlabel B\<rbrakk>\<^sub>d \)
\<lbrakk>{}; {}; unlabel \\<rbrakk>\<^sub>s \

goal (1 subgoal):
 1. (\<And>\'. \<lbrakk>\' \<in> set (tr\<^sub>p\<^sub>c \ []); \ \<Turnstile> \<langle>unlabel \'\<rangle>\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding constr_sem_d_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>{}; set (unlabel []) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \; unlabel \\<rbrakk>\<^sub>s \ = (\<exists>B\<in>set (tr\<^sub>p\<^sub>c \ []). \<lbrakk>{}; unlabel B\<rbrakk>\<^sub>d \)
\<lbrakk>{}; {}; unlabel \\<rbrakk>\<^sub>s \

goal (1 subgoal):
 1. (\<And>\'. \<lbrakk>\' \<in> set (tr\<^sub>p\<^sub>c \ []); Var supports \ \<and> \<lbrakk>{}; unlabel \'\<rbrakk>\<^sub>d \\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by moura
[PROOF STATE]
proof (state)
this:
\' \<in> set (tr\<^sub>p\<^sub>c \ [])
\ \<Turnstile> \<langle>unlabel \'\<rangle>

goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
have \':
      "(\<forall>n. (\ \<Turnstile> \<langle>proj_unl n \'\<rangle>)) \<or>
        (\<exists>\'' l' ts. prefix \'' \' \<and> suffix [(l', receive\<langle>ts\<rangle>\<^sub>s\<^sub>t)] \'' \<and>
                    (strand_leaks\<^sub>l\<^sub>s\<^sub>t \'' Sec \))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<or> (\<exists>\'' l' ts. prefix \'' \' \<and> suffix [(l', receive\<langle>ts\<rangle>\<^sub>s\<^sub>t)] \'' \<and> strand_leaks\<^sub>l\<^sub>s\<^sub>t \'' Sec \)
[PROOF STEP]
using par_comp_constr_typed[OF tr_par_preserves_par_comp[OF \(1) \'(1)] \'(2) \(2-)]
[PROOF STATE]
proof (prove)
using this:
(\<forall>l. \ \<Turnstile> \<langle>proj_unl l \'\<rangle>) \<or> (\<exists>\'' l' t. prefix \'' \' \<and> suffix [(l', receive\<langle>t\<rangle>\<^sub>s\<^sub>t)] \'' \<and> strand_leaks\<^sub>l\<^sub>s\<^sub>t \'' Sec \)

goal (1 subgoal):
 1. (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<or> (\<exists>\'' l' ts. prefix \'' \' \<and> suffix [(l', receive\<langle>ts\<rangle>\<^sub>s\<^sub>t)] \'' \<and> strand_leaks\<^sub>l\<^sub>s\<^sub>t \'' Sec \)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<or> (\<exists>\'' l' ts. prefix \'' \' \<and> suffix [(l', receive\<langle>ts\<rangle>\<^sub>s\<^sub>t)] \'' \<and> strand_leaks\<^sub>l\<^sub>s\<^sub>t \'' Sec \)

goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
proof (cases "\<forall>n. (\ \<Turnstile> \<langle>proj_unl n \'\<rangle>)")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle> \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
 2. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>

goal (2 subgoals):
 1. \<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle> \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
 2. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>

goal (2 subgoals):
 1. \<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle> \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
 2. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
fix n
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle> \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
 2. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
assume "\ \<Turnstile> \<langle>proj_unl n \'\<rangle>"
[PROOF STATE]
proof (state)
this:
\ \<Turnstile> \<langle>proj_unl n \'\<rangle>

goal (2 subgoals):
 1. \<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle> \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
 2. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
hence "\<lbrakk>{}; {}; unlabel (proj n \)\<rbrakk>\<^sub>s \"
[PROOF STATE]
proof (prove)
using this:
\ \<Turnstile> \<langle>proj_unl n \'\<rangle>

goal (1 subgoal):
 1. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \
[PROOF STEP]
using tr_par_proj[OF \'(1), of n]
              tr_par_sem_equiv[OF 2(1,2) 1(3) _ \(2), of n] 3(1)
[PROOF STATE]
proof (prove)
using this:
\ \<Turnstile> \<langle>proj_unl n \'\<rangle>
proj n \' \<in> set (tr\<^sub>p\<^sub>c (proj n \) (proj n []))
\<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n \) \<union> set []. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n \) \<union> set []. (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j \<Longrightarrow> \<lbrakk>{}; set (unlabel []) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \; proj_unl n \\<rbrakk>\<^sub>s \ = (\<exists>B\<in>set (tr\<^sub>p\<^sub>c (proj n \) []). \<lbrakk>{}; unlabel B\<rbrakk>\<^sub>d \)
par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n \) Sec

goal (1 subgoal):
 1. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \
[PROOF STEP]
unfolding par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t_def proj_def constr_sem_d_def
[PROOF STATE]
proof (prove)
using this:
Var supports \ \<and> \<lbrakk>{}; unlabel (filter (\<lambda>s. has_LabelN n s \<or> has_LabelS s) \')\<rbrakk>\<^sub>d \
filter (\<lambda>s. has_LabelN n s \<or> has_LabelS s) \' \<in> set (tr\<^sub>p\<^sub>c (filter (\<lambda>s. has_LabelN n s \<or> has_LabelS s) \) (filter (\<lambda>s. has_LabelN n s \<or> has_LabelS s) []))
\<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (filter (\<lambda>s. has_LabelN n s \<or> has_LabelS s) \) \<union> set []. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (filter (\<lambda>s. has_LabelN n s \<or> has_LabelS s) \) \<union> set []. (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j \<Longrightarrow> \<lbrakk>{}; set (unlabel []) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \; unlabel (filter (\<lambda>s. has_LabelN n s \<or> has_LabelS s) \)\<rbrakk>\<^sub>s \ = (\<exists>B\<in>set (tr\<^sub>p\<^sub>c (filter (\<lambda>s. has_LabelN n s \<or> has_LabelS s) \) []). \<lbrakk>{}; unlabel B\<rbrakk>\<^sub>d \)
(\<forall>l1 l2. l1 \<noteq> l2 \<longrightarrow> GSMP_disjoint (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (filter (\<lambda>s. has_LabelN l1 s \<or> has_LabelS s) (filter (\<lambda>s. has_LabelN ?n s \<or> has_LabelS s) \)) \<union> pair ` setops\<^sub>s\<^sub>s\<^sub>t (unlabel (filter (\<lambda>s. has_LabelN l1 s \<or> has_LabelS s) (filter (\<lambda>s. has_LabelN ?n s \<or> has_LabelS s) \)))) (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (filter (\<lambda>s. has_LabelN l2 s \<or> has_LabelS s) (filter (\<lambda>s. has_LabelN ?n s \<or> has_LabelS s) \)) \<union> pair ` setops\<^sub>s\<^sub>s\<^sub>t (unlabel (filter (\<lambda>s. has_LabelN l2 s \<or> has_LabelS s) (filter (\<lambda>s. has_LabelN ?n s \<or> has_LabelS s) \)))) Sec) \<and> (\<forall>s\<in>Sec. \<not> {} \<turnstile>\<^sub>c s) \<and> ground Sec \<and> (\<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (filter (\<lambda>s. has_LabelN ?n s \<or> has_LabelS s) \). \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (filter (\<lambda>s. has_LabelN ?n s \<or> has_LabelS s) \). (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j)

goal (1 subgoal):
 1. \<lbrakk>{}; {}; unlabel (filter (\<lambda>s. has_LabelN n s \<or> has_LabelS s) \)\<rbrakk>\<^sub>s \
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
\<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \

goal (2 subgoals):
 1. \<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle> \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
 2. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\ \<Turnstile> \<langle>proj_unl ?n13 \'\<rangle> \<Longrightarrow> \<lbrakk>{}; {}; proj_unl ?n13 \\<rbrakk>\<^sub>s \

goal (2 subgoals):
 1. \<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle> \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
 2. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\ \<Turnstile> \<langle>proj_unl ?n13 \'\<rangle> \<Longrightarrow> \<lbrakk>{}; {}; proj_unl ?n13 \\<rbrakk>\<^sub>s \

goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
using True \(1,2,3) \(1)
[PROOF STATE]
proof (prove)
using this:
\ \<Turnstile> \<langle>proj_unl ?n13 \'\<rangle> \<Longrightarrow> \<lbrakk>{}; {}; proj_unl ?n13 \\<rbrakk>\<^sub>s \
\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>
\<lbrakk>{}; {}; unlabel \\<rbrakk>\<^sub>s \
subst_domain \ = \<V> \<and> ground (subst_range \)
wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \
\<lbrakk>{}; {}; unlabel \\<rbrakk>\<^sub>s \

goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
(\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>)

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>)
[PROOF STEP]
obtain \''::"('fun,'var,'lbl) labeled_strand" where \'':
        "prefix \'' \'" "strand_leaks\<^sub>l\<^sub>s\<^sub>t \'' Sec \"
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>)

goal (1 subgoal):
 1. (\<And>\''. \<lbrakk>prefix \'' \'; strand_leaks\<^sub>l\<^sub>s\<^sub>t \'' Sec \\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \'
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>)
(\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<or> (\<exists>\'' l' ts. prefix \'' \' \<and> suffix [(l', receive\<langle>ts\<rangle>\<^sub>s\<^sub>t)] \'' \<and> strand_leaks\<^sub>l\<^sub>s\<^sub>t \'' Sec \)

goal (1 subgoal):
 1. (\<And>\''. \<lbrakk>prefix \'' \'; strand_leaks\<^sub>l\<^sub>s\<^sub>t \'' Sec \\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
prefix \'' \'
strand_leaks\<^sub>l\<^sub>s\<^sub>t \'' Sec \

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
have "\<exists>t \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \. \<exists>l.
            (\ \<Turnstile> \<langle>unlabel (proj l \'')\<rangle>) \<and> ik\<^sub>s\<^sub>t (unlabel (proj l \'')) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>t\<in>Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \. \<exists>l. \ \<Turnstile> \<langle>proj_unl l \''\<rangle> \<and> ik\<^sub>s\<^sub>t (proj_unl l \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>t\<in>Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \. \<exists>l. \ \<Turnstile> \<langle>proj_unl l \''\<rangle> \<and> ik\<^sub>s\<^sub>t (proj_unl l \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
[PROOF STEP]
obtain s m where sm:
          "s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \" "\<lbrakk>{}; proj_unl m \''@[send\<langle>[s]\<rangle>\<^sub>s\<^sub>t]\<rbrakk>\<^sub>d \"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>s m. \<lbrakk>s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \; \<lbrakk>{}; proj_unl m \'' @ [Send1 s]\<rbrakk>\<^sub>d \\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \''
[PROOF STATE]
proof (prove)
using this:
prefix \'' \'
strand_leaks\<^sub>l\<^sub>s\<^sub>t \'' Sec \

goal (1 subgoal):
 1. (\<And>s m. \<lbrakk>s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \; \<lbrakk>{}; proj_unl m \'' @ [Send1 s]\<rbrakk>\<^sub>d \\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding strand_leaks\<^sub>l\<^sub>s\<^sub>t_def constr_sem_d_def
[PROOF STATE]
proof (prove)
using this:
prefix \'' \'
\<exists>t\<in>Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \. \<exists>l. Var supports \ \<and> \<lbrakk>{}; proj_unl l \'' @ [Send1 t]\<rbrakk>\<^sub>d \

goal (1 subgoal):
 1. (\<And>s m. \<lbrakk>s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \; \<lbrakk>{}; proj_unl m \'' @ [Send1 s]\<rbrakk>\<^sub>d \\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \
\<lbrakk>{}; proj_unl m \'' @ [Send1 s]\<rbrakk>\<^sub>d \

goal (1 subgoal):
 1. \<exists>t\<in>Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \. \<exists>l. \ \<Turnstile> \<langle>proj_unl l \''\<rangle> \<and> ik\<^sub>s\<^sub>t (proj_unl l \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>t\<in>Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \. \<exists>l. \ \<Turnstile> \<langle>proj_unl l \''\<rangle> \<and> ik\<^sub>s\<^sub>t (proj_unl l \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
[PROOF STEP]
using strand_sem_split(3,4)[OF sm(2)] sm(1)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>{}; proj_unl m \''\<rbrakk>\<^sub>d \
\<lbrakk>{} \<union> (ik\<^sub>s\<^sub>t (proj_unl m \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \); [Send1 s]\<rbrakk>\<^sub>d \
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \

goal (1 subgoal):
 1. \<exists>t\<in>Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \. \<exists>l. \ \<Turnstile> \<langle>proj_unl l \''\<rangle> \<and> ik\<^sub>s\<^sub>t (proj_unl l \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
[PROOF STEP]
unfolding constr_sem_d_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>{}; proj_unl m \''\<rbrakk>\<^sub>d \
\<lbrakk>{} \<union> (ik\<^sub>s\<^sub>t (proj_unl m \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \); [Send1 s]\<rbrakk>\<^sub>d \
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \

goal (1 subgoal):
 1. \<exists>t\<in>Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \. \<exists>l. (Var supports \ \<and> \<lbrakk>{}; proj_unl l \''\<rbrakk>\<^sub>d \) \<and> ik\<^sub>s\<^sub>t (proj_unl l \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>t\<in>Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \. \<exists>l. \ \<Turnstile> \<langle>proj_unl l \''\<rangle> \<and> ik\<^sub>s\<^sub>t (proj_unl l \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>t\<in>Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \. \<exists>l. \ \<Turnstile> \<langle>proj_unl l \''\<rangle> \<and> ik\<^sub>s\<^sub>t (proj_unl l \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>t\<in>Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \. \<exists>l. \ \<Turnstile> \<langle>proj_unl l \''\<rangle> \<and> ik\<^sub>s\<^sub>t (proj_unl l \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \
[PROOF STEP]
obtain s m where sm:
        "s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \"
        "\ \<Turnstile> \<langle>unlabel (proj m \'')\<rangle>"
        "ik\<^sub>s\<^sub>t (unlabel (proj m \'')) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \"
[PROOF STATE]
proof (prove)
using this:
\<exists>t\<in>Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \. \<exists>l. \ \<Turnstile> \<langle>proj_unl l \''\<rangle> \<and> ik\<^sub>s\<^sub>t (proj_unl l \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> t \<cdot> \

goal (1 subgoal):
 1. (\<And>s m. \<lbrakk>s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \; \ \<Turnstile> \<langle>proj_unl m \''\<rangle>; ik\<^sub>s\<^sub>t (proj_unl m \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by moura
[PROOF STATE]
proof (state)
this:
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \
\ \<Turnstile> \<langle>proj_unl m \''\<rangle>
ik\<^sub>s\<^sub>t (proj_unl m \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
hence s': "\<not>{} \<turnstile>\<^sub>c s \<cdot> \" "s \<cdot> \ = s"
[PROOF STATE]
proof (prove)
using this:
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \
\ \<Turnstile> \<langle>proj_unl m \''\<rangle>
ik\<^sub>s\<^sub>t (proj_unl m \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \

goal (1 subgoal):
 1. \<not> {} \<turnstile>\<^sub>c s \<cdot> \ &&& s \<cdot> \ = s
[PROOF STEP]
using \(1) subst_ground_ident[of s \]
[PROOF STATE]
proof (prove)
using this:
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \
\ \<Turnstile> \<langle>proj_unl m \''\<rangle>
ik\<^sub>s\<^sub>t (proj_unl m \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \
par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ Sec
fv s = {} \<Longrightarrow> s \<cdot> \ = s

goal (1 subgoal):
 1. \<not> {} \<turnstile>\<^sub>c s \<cdot> \ &&& s \<cdot> \ = s
[PROOF STEP]
unfolding par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t_def
[PROOF STATE]
proof (prove)
using this:
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \
\ \<Turnstile> \<langle>proj_unl m \''\<rangle>
ik\<^sub>s\<^sub>t (proj_unl m \'') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \
(\<forall>l1 l2. l1 \<noteq> l2 \<longrightarrow> GSMP_disjoint (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj l1 \) \<union> pair ` setops\<^sub>s\<^sub>s\<^sub>t (proj_unl l1 \<A>)) (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj l2 \<A>) \<union> pair ` setops\<^sub>s\<^sub>s\<^sub>t (proj_unl l2 \)) Sec) \<and> (\<forall>s\<in>Sec. \<not> {} \<turnstile>\<^sub>c s) \<and> ground Sec \<and> (\<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t \. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t \. (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j)
fv s = {} \<Longrightarrow> s \<cdot> \ = s

goal (1 subgoal):
 1. \<not> {} \<turnstile>\<^sub>c s \<cdot> \ &&& s \<cdot> \ = s
[PROOF STEP]
by auto

    \<comment> \<open>
      We now need to show that there is some prefix \<open>B\<close> of \<open>\''\<close> that also leaks
      and where \<open>B \<in> set (tr C D)\<close> for some prefix \<open>C\<close> of \<open>\\<close>
    \<close>
[PROOF STATE]
proof (state)
this:
\<not> {} \<turnstile>\<^sub>c s \<cdot> \
s \<cdot> \ = s

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
obtain B::"('fun,'var,'lbl) labeled_strand"
        and C G::"('fun,'var,'lbl) labeled_stateful_strand"
      where BC:
        "prefix B \'" "prefix C \" "B \<in> set (tr\<^sub>p\<^sub>c C [])"
        "ik\<^sub>s\<^sub>t (unlabel (proj m B)) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \"
        "prefix B \''" "\<exists>l t. suffix ((l, receive\<langle>t\<rangle>)#G) C"
      and G: "list_all (Not \<circ> is_Receive \<circ> snd) G"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>B C G. \<lbrakk>prefix B \'; prefix C \; B \<in> set (tr\<^sub>p\<^sub>c C []); ik\<^sub>s\<^sub>t (proj_unl m B) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \; prefix B \''; \<exists>l t. suffix ((l, receive\<langle>t\<rangle>) # G) C; list_all (Not \<circ> stateful_strand_step.is_Receive \<circ> snd) G\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using tr_leaking_prefix_exists[OF \'(1) \''(1) sm(3)]
            prefix_order.order_trans[OF _ \''(1)] s'
[PROOF STATE]
proof (prove)
using this:
\<exists>C D. prefix C \'' \<and> prefix D \ \<and> C \<in> set (tr\<^sub>p\<^sub>c D []) \<and> ik\<^sub>s\<^sub>t (proj_unl m C) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \ \<and> (\<not> {} \<turnstile>\<^sub>c s \<cdot> \ \<longrightarrow> (\<exists>l s G. suffix ((l, receive\<langle>s\<rangle>) # G) D \<and> list_all (Not \<circ> stateful_strand_step.is_Receive \<circ> snd) G))
prefix ?x \'' \<Longrightarrow> prefix ?x \'
\<not> {} \<turnstile>\<^sub>c s \<cdot> \
s \<cdot> \ = s

goal (1 subgoal):
 1. (\<And>B C G. \<lbrakk>prefix B \'; prefix C \; B \<in> set (tr\<^sub>p\<^sub>c C []); ik\<^sub>s\<^sub>t (proj_unl m B) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \; prefix B \''; \<exists>l t. suffix ((l, receive\<langle>t\<rangle>) # G) C; list_all (Not \<circ> stateful_strand_step.is_Receive \<circ> snd) G\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
prefix B \'
prefix C \
B \<in> set (tr\<^sub>p\<^sub>c C [])
ik\<^sub>s\<^sub>t (proj_unl m B) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \
prefix B \''
\<exists>l t. suffix ((l, receive\<langle>t\<rangle>) # G) C
list_all (Not \<circ> stateful_strand_step.is_Receive \<circ> snd) G

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
obtain C' where C': "C = C'@G" "\<exists>l t. suffix [(l, receive\<langle>t\<rangle>)] C'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>C'. \<lbrakk>C = C' @ G; \<exists>l t. suffix [(l, receive\<langle>t\<rangle>)] C'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using BC(6)
[PROOF STATE]
proof (prove)
using this:
\<exists>l t. suffix ((l, receive\<langle>t\<rangle>) # G) C

goal (1 subgoal):
 1. (\<And>C'. \<lbrakk>C = C' @ G; \<exists>l t. suffix [(l, receive\<langle>t\<rangle>)] C'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding suffix_def
[PROOF STATE]
proof (prove)
using this:
\<exists>l t zs. C = zs @ (l, receive\<langle>t\<rangle>) # G

goal (1 subgoal):
 1. (\<And>C'. \<lbrakk>C = C' @ G; \<exists>l t zs. C' = zs @ [(l, receive\<langle>t\<rangle>)]\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis append_Cons append_assoc append_self_conv2)
[PROOF STATE]
proof (state)
this:
C = C' @ G
\<exists>l t. suffix [(l, receive\<langle>t\<rangle>)] C'

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
have "\<lbrakk>{}; unlabel (proj m B)\<rbrakk>\<^sub>d \"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>{}; proj_unl m B\<rbrakk>\<^sub>d \
[PROOF STEP]
using sm(2) BC(5)
[PROOF STATE]
proof (prove)
using this:
\ \<Turnstile> \<langle>proj_unl m \''\<rangle>
prefix B \''

goal (1 subgoal):
 1. \<lbrakk>{}; proj_unl m B\<rbrakk>\<^sub>d \
[PROOF STEP]
unfolding prefix_def unlabel_def proj_def constr_sem_d_def
[PROOF STATE]
proof (prove)
using this:
Var supports \ \<and> \<lbrakk>{}; map snd (filter (\<lambda>s. has_LabelN m s \<or> has_LabelS s) \'')\<rbrakk>\<^sub>d \
\<exists>zs. \'' = B @ zs

goal (1 subgoal):
 1. \<lbrakk>{}; map snd (filter (\<lambda>s. has_LabelN m s \<or> has_LabelS s) B)\<rbrakk>\<^sub>d \
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>{}; proj_unl m B\<rbrakk>\<^sub>d \

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
hence BC': "\ \<Turnstile> \<langle>proj_unl m B@[send\<langle>[s]\<rangle>\<^sub>s\<^sub>t]\<rangle>"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>{}; proj_unl m B\<rbrakk>\<^sub>d \

goal (1 subgoal):
 1. \ \<Turnstile> \<langle>proj_unl m B @ [Send1 s]\<rangle>
[PROOF STEP]
using BC(4)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>{}; proj_unl m B\<rbrakk>\<^sub>d \
ik\<^sub>s\<^sub>t (proj_unl m B) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \

goal (1 subgoal):
 1. \ \<Turnstile> \<langle>proj_unl m B @ [Send1 s]\<rangle>
[PROOF STEP]
unfolding constr_sem_d_def
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>{}; proj_unl m B\<rbrakk>\<^sub>d \
ik\<^sub>s\<^sub>t (proj_unl m B) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \

goal (1 subgoal):
 1. Var supports \ \<and> \<lbrakk>{}; proj_unl m B @ [Send1 s]\<rbrakk>\<^sub>d \
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\ \<Turnstile> \<langle>proj_unl m B @ [Send1 s]\<rangle>

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
have BC'': "s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t B \"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t B \
[PROOF STEP]
using BC(5) sm(1) declassified_prefix_subset
[PROOF STATE]
proof (prove)
using this:
prefix B \''
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t \'' \
prefix ?A ?B \<Longrightarrow> declassified\<^sub>l\<^sub>s\<^sub>t ?A ?I \<subseteq> declassified\<^sub>l\<^sub>s\<^sub>t ?B ?I

goal (1 subgoal):
 1. s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t B \
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>t B \

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
have "\<exists>n. \ \<Turnstile>\<^sub>s (proj_unl n C'@[Send [s]])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
[PROOF STEP]
have 5: "par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) Sec" for n
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) Sec
[PROOF STEP]
using \(1) BC(2) par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t_split(1)[THEN par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t_proj]
[PROOF STATE]
proof (prove)
using this:
par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ Sec
prefix C \
par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t (?A @ ?B1) ?Sec \<Longrightarrow> par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n ?A) ?Sec

goal (1 subgoal):
 1. par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) Sec
[PROOF STEP]
unfolding prefix_def
[PROOF STATE]
proof (prove)
using this:
par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ Sec
\<exists>zs. \ = C @ zs
par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t (?A @ ?B1) ?Sec \<Longrightarrow> par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n ?A) ?Sec

goal (1 subgoal):
 1. par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) Sec
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n11 C) Sec

goal (1 subgoal):
 1. \<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
[PROOF STEP]
have "fv\<^sub>s\<^sub>s\<^sub>t (unlabel \) \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (unlabel \) = {}"
           "fv\<^sub>s\<^sub>s\<^sub>t (unlabel C) \<subseteq> fv\<^sub>s\<^sub>s\<^sub>t (unlabel \)"
           "bvars\<^sub>s\<^sub>s\<^sub>t (unlabel C) \<subseteq> bvars\<^sub>s\<^sub>s\<^sub>t (unlabel \)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {} &&& fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \<subseteq> fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ &&& bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \<subseteq> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
[PROOF STEP]
using \(2) BC(2) sst_vars_append_subset(1,2)[of "unlabel C"]
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {}
prefix C \
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \<subseteq> fv\<^sub>s\<^sub>s\<^sub>t (unlabel C @ ?B)
bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \<subseteq> bvars\<^sub>s\<^sub>s\<^sub>t (unlabel C @ ?B)

goal (1 subgoal):
 1. fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {} &&& fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \<subseteq> fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ &&& bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \<subseteq> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
[PROOF STEP]
unfolding prefix_def unlabel_def
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>s\<^sub>s\<^sub>t (map snd \) \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (map snd \) = {}
\<exists>zs. \ = C @ zs
fv\<^sub>s\<^sub>s\<^sub>t (map snd C) \<subseteq> fv\<^sub>s\<^sub>s\<^sub>t (map snd C @ ?B)
bvars\<^sub>s\<^sub>s\<^sub>t (map snd C) \<subseteq> bvars\<^sub>s\<^sub>s\<^sub>t (map snd C @ ?B)

goal (1 subgoal):
 1. fv\<^sub>s\<^sub>s\<^sub>t (map snd \) \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (map snd \) = {} &&& fv\<^sub>s\<^sub>s\<^sub>t (map snd C) \<subseteq> fv\<^sub>s\<^sub>s\<^sub>t (map snd \) &&& bvars\<^sub>s\<^sub>s\<^sub>t (map snd C) \<subseteq> bvars\<^sub>s\<^sub>s\<^sub>t (map snd \)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {}
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \<subseteq> fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \<subseteq> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \

goal (1 subgoal):
 1. \<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
[PROOF STEP]
hence "fv\<^sub>s\<^sub>s\<^sub>t (proj_unl n C) \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (proj_unl n C) = {}" for n
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {}
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \<subseteq> fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \<subseteq> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \

goal (1 subgoal):
 1. fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) = {}
[PROOF STEP]
using sst_vars_proj_subset[of _ C] sst_vars_proj_subset[of _ \]
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \ = {}
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \<subseteq> fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \<subseteq> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n C) \<subseteq> fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t C
bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n C) \<subseteq> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t C
vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n C) \<subseteq> vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t C
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n \) \<subseteq> fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n \) \<subseteq> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \
vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n \) \<subseteq> vars\<^sub>l\<^sub>s\<^sub>s\<^sub>t \

goal (1 subgoal):
 1. fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) = {}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n11 C) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n11 C) = {}

goal (1 subgoal):
 1. \<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
[PROOF STEP]
hence 6:
          "\<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (proj_unl n C) = {}"
          "fv\<^sub>s\<^sub>s\<^sub>t (proj_unl n C) \<inter> bvars\<^sub>s\<^sub>s\<^sub>t (proj_unl n C) = {}"
          "ground {}"
        for n
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n11 C) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n11 C) = {}

goal (1 subgoal):
 1. \<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) = {} &&& fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) = {} &&& ground {}
[PROOF STEP]
using 2
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n11 C) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n11 C) = {}
\<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n9 \) = {}
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n9 \) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n9 \) = {}

goal (1 subgoal):
 1. \<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) = {} &&& fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) = {} &&& ground {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>(l, t, t')\<in>set []. (fv t \<union> fv t') \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n12 C) = {}
fv\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n12 C) \<inter> bvars\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n12 C) = {}
ground {}

goal (1 subgoal):
 1. \<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
[PROOF STEP]
have 7: "?P n C []" for n
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<union> set []. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<union> set []. (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j
[PROOF STEP]
using 5
[PROOF STATE]
proof (prove)
using this:
par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n11 C) Sec

goal (1 subgoal):
 1. \<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<union> set []. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<union> set []. (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j
[PROOF STEP]
unfolding par_comp\<^sub>l\<^sub>s\<^sub>s\<^sub>t_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>l1 l2. l1 \<noteq> l2 \<longrightarrow> GSMP_disjoint (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj l1 (proj ?n11 C)) \<union> pair ` setops\<^sub>s\<^sub>s\<^sub>t (proj_unl l1 (proj ?n11 C))) (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj l2 (proj ?n11 C)) \<union> pair ` setops\<^sub>s\<^sub>s\<^sub>t (proj_unl l2 (proj ?n11 C))) Sec) \<and> (\<forall>s\<in>Sec. \<not> {} \<turnstile>\<^sub>c s) \<and> ground Sec \<and> (\<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n11 C). \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n11 C). (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j)

goal (1 subgoal):
 1. \<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<union> set []. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<union> set []. (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<forall>(i, p)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n12 C) \<union> set []. \<forall>(j, q)\<in>setops\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj ?n12 C) \<union> set []. (\<exists>\<delta>. Unifier \<delta> (pair p) (pair q)) \<longrightarrow> i = j

goal (1 subgoal):
 1. \<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
[PROOF STEP]
obtain n where n: "\ \<Turnstile>\<^sub>s proj_unl n C" "ik\<^sub>s\<^sub>s\<^sub>t (proj_unl n C) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>n. \<lbrakk>\<lbrakk>{}; {}; proj_unl n C\<rbrakk>\<^sub>s \; ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using s'(2) tr_par_proj[OF BC(3), of m] BC'(1)
              tr_par_sem_equiv[OF 6 7 \(2), of m]
              tr_par_deduct_iff[OF tr_par_proj(1)[OF BC(3)], of \ m s]
[PROOF STATE]
proof (prove)
using this:
s \<cdot> \ = s
proj m B \<in> set (tr\<^sub>p\<^sub>c (proj m C) (proj m []))
\ \<Turnstile> \<langle>proj_unl m B @ [Send1 s]\<rangle>
\<lbrakk>{}; set (unlabel []) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \; proj_unl m C\<rbrakk>\<^sub>s \ = (\<exists>B\<in>set (tr\<^sub>p\<^sub>c (proj m C) []). \<lbrakk>{}; unlabel B\<rbrakk>\<^sub>d \)
(ik\<^sub>s\<^sub>t (proj_unl m B) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s) = (ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj m C) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s)

goal (1 subgoal):
 1. (\<And>n. \<lbrakk>\<lbrakk>{}; {}; proj_unl n C\<rbrakk>\<^sub>s \; ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding proj_def constr_sem_d_def
[PROOF STATE]
proof (prove)
using this:
s \<cdot> \ = s
filter (\<lambda>s. has_LabelN m s \<or> has_LabelS s) B \<in> set (tr\<^sub>p\<^sub>c (filter (\<lambda>s. has_LabelN m s \<or> has_LabelS s) C) (filter (\<lambda>s. has_LabelN m s \<or> has_LabelS s) []))
Var supports \ \<and> \<lbrakk>{}; unlabel (filter (\<lambda>s. has_LabelN m s \<or> has_LabelS s) B) @ [Send1 s]\<rbrakk>\<^sub>d \
\<lbrakk>{}; set (unlabel []) \<cdot>\<^sub>p\<^sub>s\<^sub>e\<^sub>t \; unlabel (filter (\<lambda>s. has_LabelN m s \<or> has_LabelS s) C)\<rbrakk>\<^sub>s \ = (\<exists>B\<in>set (tr\<^sub>p\<^sub>c (filter (\<lambda>s. has_LabelN m s \<or> has_LabelS s) C) []). \<lbrakk>{}; unlabel B\<rbrakk>\<^sub>d \)
(ik\<^sub>s\<^sub>t (unlabel (filter (\<lambda>s. has_LabelN m s \<or> has_LabelS s) B)) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s) = (ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (filter (\<lambda>s. has_LabelN m s \<or> has_LabelS s) C) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s)

goal (1 subgoal):
 1. (\<And>n. \<lbrakk>\<lbrakk>{}; {}; unlabel (filter (\<lambda>s. has_LabelN n s \<or> has_LabelS s) C)\<rbrakk>\<^sub>s \; ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (filter (\<lambda>s. has_LabelN n s \<or> has_LabelS s) C) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>{}; {}; proj_unl n C\<rbrakk>\<^sub>s \
ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \

goal (1 subgoal):
 1. \<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
[PROOF STEP]
have "ik\<^sub>s\<^sub>s\<^sub>t (proj_unl n C) = ik\<^sub>s\<^sub>s\<^sub>t (proj_unl n C')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) = ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C')
[PROOF STEP]
using C'(1) G
[PROOF STATE]
proof (prove)
using this:
C = C' @ G
list_all (Not \<circ> stateful_strand_step.is_Receive \<circ> snd) G

goal (1 subgoal):
 1. ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) = ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C')
[PROOF STEP]
unfolding ik\<^sub>s\<^sub>s\<^sub>t_def unlabel_def proj_def list_all_iff
[PROOF STATE]
proof (prove)
using this:
C = C' @ G
Ball (set G) (Not \<circ> stateful_strand_step.is_Receive \<circ> snd)

goal (1 subgoal):
 1. {uu_. \<exists>t ts. uu_ = t \<and> receive\<langle>ts\<rangle> \<in> set (map snd (filter (\<lambda>s. has_LabelN n s \<or> has_LabelS s) C)) \<and> t \<in> set ts} = {uu_. \<exists>t ts. uu_ = t \<and> receive\<langle>ts\<rangle> \<in> set (map snd (filter (\<lambda>s. has_LabelN n s \<or> has_LabelS s) C')) \<and> t \<in> set ts}
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) = ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C')

goal (1 subgoal):
 1. \<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
[PROOF STEP]
hence 8: "ik\<^sub>s\<^sub>s\<^sub>t (proj_unl n C') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \"
[PROOF STATE]
proof (prove)
using this:
ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) = ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C')

goal (1 subgoal):
 1. ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \
[PROOF STEP]
using n(2)
[PROOF STATE]
proof (prove)
using this:
ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) = ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C')
ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C) \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \

goal (1 subgoal):
 1. ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \

goal (1 subgoal):
 1. \<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
[PROOF STEP]
have 9: "\ \<Turnstile>\<^sub>s proj_unl n C'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>{}; {}; proj_unl n C'\<rbrakk>\<^sub>s \
[PROOF STEP]
using n(1) C'(1) strand_sem_append_stateful
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>{}; {}; proj_unl n C\<rbrakk>\<^sub>s \
C = C' @ G
\<lbrakk>?M; ?D; ?A @ ?B\<rbrakk>\<^sub>s ?\ = (\<lbrakk>?M; ?D; ?A\<rbrakk>\<^sub>s ?\ \<and> \<lbrakk>?M \<union> (ik\<^sub>s\<^sub>s\<^sub>t ?A \<cdot>\<^sub>s\<^sub>e\<^sub>t ?\); dbupd\<^sub>s\<^sub>s\<^sub>t ?A ?\ ?D; ?B\<rbrakk>\<^sub>s ?\)

goal (1 subgoal):
 1. \<lbrakk>{}; {}; proj_unl n C'\<rbrakk>\<^sub>s \
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<lbrakk>{}; {}; proj_unl n C'\<rbrakk>\<^sub>s \

goal (1 subgoal):
 1. \<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
[PROOF STEP]
using 8 9 strand_sem_append_stateful
[PROOF STATE]
proof (prove)
using this:
ik\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n C') \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> s \<cdot> \
\<lbrakk>{}; {}; proj_unl n C'\<rbrakk>\<^sub>s \
\<lbrakk>?M; ?D; ?A @ ?B\<rbrakk>\<^sub>s ?\ = (\<lbrakk>?M; ?D; ?A\<rbrakk>\<^sub>s ?\ \<and> \<lbrakk>?M \<union> (ik\<^sub>s\<^sub>s\<^sub>t ?A \<cdot>\<^sub>s\<^sub>e\<^sub>t ?\); dbupd\<^sub>s\<^sub>s\<^sub>t ?A ?\ ?D; ?B\<rbrakk>\<^sub>s ?\)

goal (1 subgoal):
 1. \<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
have "s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \
[PROOF STEP]
by (metis tr_par_declassified_eq BC(3) BC'')
[PROOF STATE]
proof (state)
this:
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
hence "s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C' \"
[PROOF STATE]
proof (prove)
using this:
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \

goal (1 subgoal):
 1. s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C' \
[PROOF STEP]
using ideduct_mono[of
              "\<Union>{set ts |ts. \<langle>\<star>, receive\<langle>ts\<rangle>\<rangle> \<in> set C'} \<cdot>\<^sub>s\<^sub>e\<^sub>t \" _
              "\<Union>{set ts |ts. \<langle>\<star>, receive\<langle>ts\<rangle>\<rangle> \<in> set (C'@G)} \<cdot>\<^sub>s\<^sub>e\<^sub>t \"]
[PROOF STATE]
proof (prove)
using this:
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C \
\<lbrakk>\<Union> {set ts |ts. \<langle>\<star>, receive\<langle>ts\<rangle>\<rangle> \<in> set C'} \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> ?t; \<Union> {set ts |ts. \<langle>\<star>, receive\<langle>ts\<rangle>\<rangle> \<in> set C'} \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<subseteq> \<Union> {set ts |ts. \<langle>\<star>, receive\<langle>ts\<rangle>\<rangle> \<in> set (C' @ G)} \<cdot>\<^sub>s\<^sub>e\<^sub>t \\<rbrakk> \<Longrightarrow> \<Union> {set ts |ts. \<langle>\<star>, receive\<langle>ts\<rangle>\<rangle> \<in> set (C' @ G)} \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> ?t

goal (1 subgoal):
 1. s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C' \
[PROOF STEP]
unfolding declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t_alt_def C'(1)
[PROOF STATE]
proof (prove)
using this:
s \<in> Sec - Collect ((\<turnstile>) (\<Union> {set ts |ts. \<langle>\<star>, receive\<langle>ts\<rangle>\<rangle> \<in> set (C' @ G)} \<cdot>\<^sub>s\<^sub>e\<^sub>t \))
\<lbrakk>\<Union> {set ts |ts. \<langle>\<star>, receive\<langle>ts\<rangle>\<rangle> \<in> set C'} \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> ?t; \<Union> {set ts |ts. \<langle>\<star>, receive\<langle>ts\<rangle>\<rangle> \<in> set C'} \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<subseteq> \<Union> {set ts |ts. \<langle>\<star>, receive\<langle>ts\<rangle>\<rangle> \<in> set (C' @ G)} \<cdot>\<^sub>s\<^sub>e\<^sub>t \\<rbrakk> \<Longrightarrow> \<Union> {set ts |ts. \<langle>\<star>, receive\<langle>ts\<rangle>\<rangle> \<in> set (C' @ G)} \<cdot>\<^sub>s\<^sub>e\<^sub>t \ \<turnstile> ?t

goal (1 subgoal):
 1. s \<in> Sec - Collect ((\<turnstile>) (\<Union> {set ts |ts. \<langle>\<star>, receive\<langle>ts\<rangle>\<rangle> \<in> set C'} \<cdot>\<^sub>s\<^sub>e\<^sub>t \))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C' \

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C' \

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
have "prefix C' \"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. prefix C' \
[PROOF STEP]
using BC(2) C'
[PROOF STATE]
proof (prove)
using this:
prefix C \
C = C' @ G
\<exists>l t. suffix [(l, receive\<langle>t\<rangle>)] C'

goal (1 subgoal):
 1. prefix C' \
[PROOF STEP]
unfolding prefix_def
[PROOF STATE]
proof (prove)
using this:
\<exists>zs. \ = C @ zs
C = C' @ G
\<exists>l t. suffix [(l, receive\<langle>t\<rangle>)] C'

goal (1 subgoal):
 1. \<exists>zs. \ = C' @ zs
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
prefix C' \

goal (1 subgoal):
 1. \<not> (\<forall>n. \ \<Turnstile> \<langle>proj_unl n \'\<rangle>) \<Longrightarrow> (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C' \
prefix C' \
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C' \
prefix C' \

goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
using C'(2)
[PROOF STATE]
proof (prove)
using this:
\<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C' \
prefix C' \
\<exists>l t. suffix [(l, receive\<langle>t\<rangle>)] C'

goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)
[PROOF STEP]
unfolding strand_leaks\<^sub>l\<^sub>s\<^sub>s\<^sub>t_def
[PROOF STATE]
proof (prove)
using this:
\<exists>n. \<lbrakk>{}; {}; proj_unl n C' @ [send\<langle>[s]\<rangle>]\<rbrakk>\<^sub>s \
s \<in> Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t C' \
prefix C' \
\<exists>l t. suffix [(l, receive\<langle>t\<rangle>)] C'

goal (1 subgoal):
 1. (\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> (\<exists>t\<in>Sec - declassified\<^sub>l\<^sub>s\<^sub>s\<^sub>t \' \. \<exists>n. \<lbrakk>{}; {}; proj_unl n \' @ [send\<langle>[t]\<rangle>]\<rbrakk>\<^sub>s \))
[PROOF STEP]
by meson
[PROOF STATE]
proof (state)
this:
(\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<forall>n. \<lbrakk>{}; {}; proj_unl n \\<rbrakk>\<^sub>s \) \<or> (\<exists>\' l' ts. prefix \' \ \<and> suffix [(l', receive\<langle>ts\<rangle>)] \' \<and> \' leaks Sec under \)

goal:
No subgoals!
[PROOF STEP]
qed