[STATEMENT]
lemma wf_unify:
  assumes wf: "wf\<^sub>s\<^sub>t V (S@Send [Fun f X]#S')"
  and g_in_ik: "t \<in> ik\<^sub>s\<^sub>t S"
  and \<delta>: "Unifier \<delta> (Fun f X) t"
  and disj: "bvars\<^sub>s\<^sub>t (S@Send [Fun f X]#S') \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}"
  shows "wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S@S') \<cdot>\<^sub>s\<^sub>t \<delta>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S')
t \<in> ik\<^sub>s\<^sub>t S
Unifier \<delta> (Fun f X) t
bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S') \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
proof (induction S' arbitrary: V rule: List.rev_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ [Send1 (Fun f X)]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ [Send1 (Fun f X)]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ [] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x xs V. \<lbrakk>\<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs \<cdot>\<^sub>s\<^sub>t \<delta>); wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs @ [x]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
case (snoc x S' V)
[PROOF STATE]
proof (state)
this:
\<lbrakk>wf\<^sub>s\<^sub>t ?V (S @ Send1 (Fun f X) # S'); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S') \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` ?V)) (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S' @ [x])
t \<in> ik\<^sub>s\<^sub>t S
Unifier \<delta> (Fun f X) t
bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S' @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}

goal (2 subgoals):
 1. \<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ [Send1 (Fun f X)]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ [Send1 (Fun f X)]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ [] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x xs V. \<lbrakk>\<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs \<cdot>\<^sub>s\<^sub>t \<delta>); wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs @ [x]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
have fun_fv_bound: "fv (Fun f X \<cdot> \<delta>) \<subseteq> \<Union>(set (map fv\<^sub>r\<^sub>c\<^sub>v (S \<cdot>\<^sub>s\<^sub>t \<delta>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fv (Fun f X \<cdot> \<delta>) \<subseteq> \<Union> (set (map fv\<^sub>r\<^sub>c\<^sub>v (S \<cdot>\<^sub>s\<^sub>t \<delta>)))
[PROOF STEP]
using snoc.prems(4) bvars\<^sub>s\<^sub>t_split Unifier_strand_fv_subset[OF g_in_ik \<delta>]
[PROOF STATE]
proof (prove)
using this:
bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S' @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}
bvars\<^sub>s\<^sub>t (?S @ ?S') = bvars\<^sub>s\<^sub>t ?S \<union> bvars\<^sub>s\<^sub>t ?S'
bvars\<^sub>s\<^sub>t S \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {} \<Longrightarrow> fv (Fun f X \<cdot> \<delta>) \<subseteq> \<Union> (set (map fv\<^sub>r\<^sub>c\<^sub>v (S \<cdot>\<^sub>s\<^sub>t \<delta>)))

goal (1 subgoal):
 1. fv (Fun f X \<cdot> \<delta>) \<subseteq> \<Union> (set (map fv\<^sub>r\<^sub>c\<^sub>v (S \<cdot>\<^sub>s\<^sub>t \<delta>)))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fv (Fun f X \<cdot> \<delta>) \<subseteq> \<Union> (set (map fv\<^sub>r\<^sub>c\<^sub>v (S \<cdot>\<^sub>s\<^sub>t \<delta>)))

goal (2 subgoals):
 1. \<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ [Send1 (Fun f X)]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ [Send1 (Fun f X)]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ [] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x xs V. \<lbrakk>\<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs \<cdot>\<^sub>s\<^sub>t \<delta>); wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs @ [x]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "fv (Fun f X \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (ik\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>))"
[PROOF STATE]
proof (prove)
using this:
fv (Fun f X \<cdot> \<delta>) \<subseteq> \<Union> (set (map fv\<^sub>r\<^sub>c\<^sub>v (S \<cdot>\<^sub>s\<^sub>t \<delta>)))

goal (1 subgoal):
 1. fv (Fun f X \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (ik\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>))
[PROOF STEP]
using fv_ik_is_fv_rcv
[PROOF STATE]
proof (prove)
using this:
fv (Fun f X \<cdot> \<delta>) \<subseteq> \<Union> (set (map fv\<^sub>r\<^sub>c\<^sub>v (S \<cdot>\<^sub>s\<^sub>t \<delta>)))
fv\<^sub>s\<^sub>e\<^sub>t (ik\<^sub>s\<^sub>t ?S) = \<Union> (set (map fv\<^sub>r\<^sub>c\<^sub>v ?S))

goal (1 subgoal):
 1. fv (Fun f X \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (ik\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
fv (Fun f X \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (ik\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>))

goal (2 subgoals):
 1. \<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ [Send1 (Fun f X)]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ [Send1 (Fun f X)]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ [] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x xs V. \<lbrakk>\<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs \<cdot>\<^sub>s\<^sub>t \<delta>); wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs @ [x]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "fv (Fun f X \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>)"
[PROOF STATE]
proof (prove)
using this:
fv (Fun f X \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (ik\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>))

goal (1 subgoal):
 1. fv (Fun f X \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
using fv_ik_subset_fv_st[of "S \<cdot>\<^sub>s\<^sub>t \<delta>"]
[PROOF STATE]
proof (prove)
using this:
fv (Fun f X \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (ik\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>))
fv\<^sub>s\<^sub>e\<^sub>t (ik\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>)) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (1 subgoal):
 1. fv (Fun f X \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
fv (Fun f X \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (2 subgoals):
 1. \<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ [Send1 (Fun f X)]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ [Send1 (Fun f X)]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ [] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x xs V. \<lbrakk>\<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs \<cdot>\<^sub>s\<^sub>t \<delta>); wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs @ [x]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence *: "fv ((Fun f X) \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t ((S@S') \<cdot>\<^sub>s\<^sub>t \<delta>)"
[PROOF STATE]
proof (prove)
using this:
fv (Fun f X \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (1 subgoal):
 1. fv (Fun f X \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
fv (Fun f X \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (2 subgoals):
 1. \<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ [Send1 (Fun f X)]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ [Send1 (Fun f X)]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ [] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x xs V. \<lbrakk>\<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs \<cdot>\<^sub>s\<^sub>t \<delta>); wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs @ [x]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
from snoc.prems(1)
[PROOF STATE]
proof (chain)
picking this:
wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S' @ [x])
[PROOF STEP]
have "wf\<^sub>s\<^sub>t V (S@Send [Fun f X]#S')"
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S' @ [x])

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S')
[PROOF STEP]
using wf_prefix[of V "S@Send [Fun f X]#S'" "[x]"]
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S' @ [x])
wf\<^sub>s\<^sub>t V ((S @ Send1 (Fun f X) # S') @ [x]) \<Longrightarrow> wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S')

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S')
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S')

goal (2 subgoals):
 1. \<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ [Send1 (Fun f X)]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ [Send1 (Fun f X)]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ [] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x xs V. \<lbrakk>\<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs \<cdot>\<^sub>s\<^sub>t \<delta>); wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs @ [x]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence **: "wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S@S') \<cdot>\<^sub>s\<^sub>t \<delta>)"
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S')

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
using snoc.IH[OF _ snoc.prems(2,3)] snoc.prems(4)
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S')
\<lbrakk>wf\<^sub>s\<^sub>t ?V (S @ Send1 (Fun f X) # S'); bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S') \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` ?V)) (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S' @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (2 subgoals):
 1. \<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ [Send1 (Fun f X)]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ [Send1 (Fun f X)]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ [] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x xs V. \<lbrakk>\<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs \<cdot>\<^sub>s\<^sub>t \<delta>); wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs @ [x]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
from snoc.prems(1)
[PROOF STATE]
proof (chain)
picking this:
wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S' @ [x])
[PROOF STEP]
have ***: "wf\<^sub>s\<^sub>t (V \<union> wfvarsoccs\<^sub>s\<^sub>t (S@Send [Fun f X]#S')) [x]"
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S' @ [x])

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')) [x]
[PROOF STEP]
using wf_append_exec[of V "(S@Send [Fun f X]#S')" "[x]"]
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # S' @ [x])
wf\<^sub>s\<^sub>t V ((S @ Send1 (Fun f X) # S') @ [x]) \<Longrightarrow> wf\<^sub>s\<^sub>t (V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')) [x]

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')) [x]
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
wf\<^sub>s\<^sub>t (V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')) [x]

goal (2 subgoals):
 1. \<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ [Send1 (Fun f X)]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ [Send1 (Fun f X)]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ [] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x xs V. \<lbrakk>\<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs \<cdot>\<^sub>s\<^sub>t \<delta>); wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs @ [x]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
from snoc.prems(4)
[PROOF STATE]
proof (chain)
picking this:
bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S' @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}
[PROOF STEP]
have disj':
      "bvars\<^sub>s\<^sub>t (S@S') \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}"
      "set (bvars\<^sub>s\<^sub>t\<^sub>p x) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}"
[PROOF STATE]
proof (prove)
using this:
bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S' @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}

goal (1 subgoal):
 1. bvars\<^sub>s\<^sub>t (S @ S') \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {} &&& set (bvars\<^sub>s\<^sub>t\<^sub>p x) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
bvars\<^sub>s\<^sub>t (S @ S') \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}
set (bvars\<^sub>s\<^sub>t\<^sub>p x) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}

goal (2 subgoals):
 1. \<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ [Send1 (Fun f X)]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ [Send1 (Fun f X)]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ [] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x xs V. \<lbrakk>\<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs \<cdot>\<^sub>s\<^sub>t \<delta>); wf\<^sub>s\<^sub>t V (S @ Send1 (Fun f X) # xs @ [x]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # xs @ [x]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ xs @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
proof (cases x)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>x1. x = send\<langle>x1\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x2. x = receive\<langle>x2\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 3. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 4. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
case (Send t)
[PROOF STATE]
proof (state)
this:
x = send\<langle>t\<rangle>\<^sub>s\<^sub>t

goal (4 subgoals):
 1. \<And>x1. x = send\<langle>x1\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x2. x = receive\<langle>x2\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 3. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 4. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
x = send\<langle>t\<rangle>\<^sub>s\<^sub>t

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
using wf_snd_append[of "fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)" "(S@S') \<cdot>\<^sub>s\<^sub>t \<delta>"] **
[PROOF STATE]
proof (prove)
using this:
x = send\<langle>t\<rangle>\<^sub>s\<^sub>t
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [send\<langle>?t\<rangle>\<^sub>s\<^sub>t]) = wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (3 subgoals):
 1. \<And>x2. x = receive\<langle>x2\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 3. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x2. x = receive\<langle>x2\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 3. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
case (Receive t)
[PROOF STATE]
proof (state)
this:
x = receive\<langle>t\<rangle>\<^sub>s\<^sub>t

goal (3 subgoals):
 1. \<And>x2. x = receive\<langle>x2\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 3. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> wfvarsoccs\<^sub>s\<^sub>t (S@Send [Fun f X]#S')"
[PROOF STATE]
proof (prove)
using this:
x = receive\<langle>t\<rangle>\<^sub>s\<^sub>t

goal (1 subgoal):
 1. fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')
[PROOF STEP]
using ***
[PROOF STATE]
proof (prove)
using this:
x = receive\<langle>t\<rangle>\<^sub>s\<^sub>t
wf\<^sub>s\<^sub>t (V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')) [x]

goal (1 subgoal):
 1. fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')

goal (3 subgoals):
 1. \<And>x2. x = receive\<langle>x2\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 3. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> wfrestrictedvars\<^sub>s\<^sub>t (S@Send [Fun f X]#S')"
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')

goal (1 subgoal):
 1. fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')
[PROOF STEP]
using vars_snd_rcv_strand_subset2(4)[of "S@Send [Fun f X]#S'"]
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')
wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S') \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')

goal (1 subgoal):
 1. fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')

goal (3 subgoals):
 1. \<And>x2. x = receive\<langle>x2\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 3. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> fv (Fun f X) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S@S')"
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')

goal (1 subgoal):
 1. fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> fv (Fun f X) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> fv (Fun f X) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S')

goal (3 subgoals):
 1. \<And>x2. x = receive\<langle>x2\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 3. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "fv\<^sub>s\<^sub>t\<^sub>p (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> fv ((Fun f X) \<cdot> \<delta>) \<union> wfrestrictedvars\<^sub>s\<^sub>t ((S@S') \<cdot>\<^sub>s\<^sub>t \<delta>)"
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>s\<^sub>t\<^sub>p x \<subseteq> V \<union> fv (Fun f X) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S')

goal (1 subgoal):
 1. fv\<^sub>s\<^sub>t\<^sub>p (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> fv (Fun f X \<cdot> \<delta>) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
by (metis (no_types) inf_sup_aci(5) subst_apply_fv_subset_strand2 subst_apply_fv_union disj')
[PROOF STATE]
proof (state)
this:
fv\<^sub>s\<^sub>t\<^sub>p (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> fv (Fun f X \<cdot> \<delta>) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (3 subgoals):
 1. \<And>x2. x = receive\<langle>x2\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 3. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "fv\<^sub>s\<^sub>t\<^sub>p (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> wfrestrictedvars\<^sub>s\<^sub>t ((S@S') \<cdot>\<^sub>s\<^sub>t \<delta>)"
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>s\<^sub>t\<^sub>p (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> fv (Fun f X \<cdot> \<delta>) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (1 subgoal):
 1. fv\<^sub>s\<^sub>t\<^sub>p (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>s\<^sub>t\<^sub>p (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> fv (Fun f X \<cdot> \<delta>) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
fv (Fun f X \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (1 subgoal):
 1. fv\<^sub>s\<^sub>t\<^sub>p (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
fv\<^sub>s\<^sub>t\<^sub>p (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (3 subgoals):
 1. \<And>x2. x = receive\<langle>x2\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 3. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "fv\<^sub>s\<^sub>e\<^sub>t (set t \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t ((S@S') \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) "
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>s\<^sub>t\<^sub>p (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (1 subgoal):
 1. fv\<^sub>s\<^sub>e\<^sub>t (set t \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)
[PROOF STEP]
using \<open>x = Receive t\<close>
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>s\<^sub>t\<^sub>p (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
x = receive\<langle>t\<rangle>\<^sub>s\<^sub>t

goal (1 subgoal):
 1. fv\<^sub>s\<^sub>e\<^sub>t (set t \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fv\<^sub>s\<^sub>e\<^sub>t (set t \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)

goal (3 subgoals):
 1. \<And>x2. x = receive\<langle>x2\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 3. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (((S@S') \<cdot>\<^sub>s\<^sub>t \<delta>)@[Receive (t \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>)])"
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>s\<^sub>e\<^sub>t (set t \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [receive\<langle>t \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t])
[PROOF STEP]
using wf_rcv_append'''[OF **, of "t \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>"]
[PROOF STATE]
proof (prove)
using this:
fv\<^sub>s\<^sub>e\<^sub>t (set t \<cdot>\<^sub>s\<^sub>e\<^sub>t \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)
fv\<^sub>s\<^sub>e\<^sub>t (set (t \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>)) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [receive\<langle>t \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t])

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [receive\<langle>t \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t])
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [receive\<langle>t \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t])

goal (3 subgoals):
 1. \<And>x2. x = receive\<langle>x2\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 3. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [receive\<langle>t \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t])

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
using \<open>x = Receive t\<close>
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [receive\<langle>t \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rangle>\<^sub>s\<^sub>t])
x = receive\<langle>t\<rangle>\<^sub>s\<^sub>t

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (2 subgoals):
 1. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
case (Equality ac s s')
[PROOF STATE]
proof (state)
this:
x = \<langle>ac: s \<doteq> s'\<rangle>\<^sub>s\<^sub>t

goal (2 subgoals):
 1. \<And>x31 x32 x33. x = \<langle>x31: x32 \<doteq> x33\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
proof (cases ac)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. ac = assign \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
case Assign
[PROOF STATE]
proof (state)
this:
ac = assign

goal (2 subgoals):
 1. ac = assign \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "fv s' \<subseteq> V \<union> wfvarsoccs\<^sub>s\<^sub>t (S@Send [Fun f X]#S')"
[PROOF STATE]
proof (prove)
using this:
ac = assign

goal (1 subgoal):
 1. fv s' \<subseteq> V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')
[PROOF STEP]
using Equality ***
[PROOF STATE]
proof (prove)
using this:
ac = assign
x = \<langle>ac: s \<doteq> s'\<rangle>\<^sub>s\<^sub>t
wf\<^sub>s\<^sub>t (V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')) [x]

goal (1 subgoal):
 1. fv s' \<subseteq> V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fv s' \<subseteq> V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')

goal (2 subgoals):
 1. ac = assign \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "fv s' \<subseteq> V \<union> wfrestrictedvars\<^sub>s\<^sub>t (S@Send [Fun f X]#S')"
[PROOF STATE]
proof (prove)
using this:
fv s' \<subseteq> V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')

goal (1 subgoal):
 1. fv s' \<subseteq> V \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')
[PROOF STEP]
using vars_snd_rcv_strand_subset2(4)[of "S@Send [Fun f X]#S'"]
[PROOF STATE]
proof (prove)
using this:
fv s' \<subseteq> V \<union> wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')
wfvarsoccs\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S') \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')

goal (1 subgoal):
 1. fv s' \<subseteq> V \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
fv s' \<subseteq> V \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')

goal (2 subgoals):
 1. ac = assign \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "fv s' \<subseteq> V \<union> fv (Fun f X) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S@S')"
[PROOF STATE]
proof (prove)
using this:
fv s' \<subseteq> V \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ Send1 (Fun f X) # S')

goal (1 subgoal):
 1. fv s' \<subseteq> V \<union> fv (Fun f X) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fv s' \<subseteq> V \<union> fv (Fun f X) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S')

goal (2 subgoals):
 1. ac = assign \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
fv s' \<subseteq> V \<union> fv (Fun f X) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S')

goal (2 subgoals):
 1. ac = assign \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
have "fv s' = fv_r\<^sub>e\<^sub>q ac x" "fv (s' \<cdot> \<delta>) = fv_r\<^sub>e\<^sub>q ac (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fv s' = fv_r\<^sub>e\<^sub>q ac x &&& fv (s' \<cdot> \<delta>) = fv_r\<^sub>e\<^sub>q ac (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>)
[PROOF STEP]
using Equality
[PROOF STATE]
proof (prove)
using this:
x = \<langle>ac: s \<doteq> s'\<rangle>\<^sub>s\<^sub>t

goal (1 subgoal):
 1. fv s' = fv_r\<^sub>e\<^sub>q ac x &&& fv (s' \<cdot> \<delta>) = fv_r\<^sub>e\<^sub>q ac (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>)
[PROOF STEP]
by simp_all
[PROOF STATE]
proof (state)
this:
fv s' = fv_r\<^sub>e\<^sub>q ac x
fv (s' \<cdot> \<delta>) = fv_r\<^sub>e\<^sub>q ac (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>)

goal (2 subgoals):
 1. ac = assign \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
fv s' \<subseteq> V \<union> fv (Fun f X) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S')
fv s' = fv_r\<^sub>e\<^sub>q ac x
fv (s' \<cdot> \<delta>) = fv_r\<^sub>e\<^sub>q ac (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>)
[PROOF STEP]
have "fv (s' \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> fv (Fun f X \<cdot> \<delta>) \<union> wfrestrictedvars\<^sub>s\<^sub>t ((S@S') \<cdot>\<^sub>s\<^sub>t \<delta>)"
[PROOF STATE]
proof (prove)
using this:
fv s' \<subseteq> V \<union> fv (Fun f X) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S')
fv s' = fv_r\<^sub>e\<^sub>q ac x
fv (s' \<cdot> \<delta>) = fv_r\<^sub>e\<^sub>q ac (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>)

goal (1 subgoal):
 1. fv (s' \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> fv (Fun f X \<cdot> \<delta>) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
using subst_apply_fv_subset_strand2[of "fv\<^sub>e\<^sub>q ac" ac x]
[PROOF STATE]
proof (prove)
using this:
fv s' \<subseteq> V \<union> fv (Fun f X) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S')
fv s' = fv_r\<^sub>e\<^sub>q ac x
fv (s' \<cdot> \<delta>) = fv_r\<^sub>e\<^sub>q ac (x \<cdot>\<^sub>s\<^sub>t\<^sub>p \<delta>)
\<lbrakk>fv\<^sub>e\<^sub>q ac = fv\<^sub>s\<^sub>t\<^sub>p \<or> fv\<^sub>e\<^sub>q ac = fv\<^sub>r\<^sub>c\<^sub>v \<or> fv\<^sub>e\<^sub>q ac = fv\<^sub>s\<^sub>n\<^sub>d \<or> fv\<^sub>e\<^sub>q ac = fv\<^sub>e\<^sub>q ac \<or> fv\<^sub>e\<^sub>q ac = fv\<^sub>i\<^sub>n\<^sub>e\<^sub>q \<or> fv\<^sub>e\<^sub>q ac = fv_r\<^sub>e\<^sub>q ac; fv\<^sub>e\<^sub>q ac x \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t ?S \<union> ?V; bvars\<^sub>s\<^sub>t ?S \<inter> (subst_domain ?\<delta> \<union> range_vars ?\<delta>) = {}; set (bvars\<^sub>s\<^sub>t\<^sub>p x) \<inter> (subst_domain ?\<delta> \<union> range_vars ?\<delta>) = {}\<rbrakk> \<Longrightarrow> fv\<^sub>e\<^sub>q ac (x \<cdot>\<^sub>s\<^sub>t\<^sub>p ?\<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (?S \<cdot>\<^sub>s\<^sub>t ?\<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (?\<delta> ` ?V)

goal (1 subgoal):
 1. fv (s' \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> fv (Fun f X \<cdot> \<delta>) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
by (metis disj'(1) subst_apply_fv_subset_strand_trm2 subst_apply_fv_union sup_commute)
[PROOF STATE]
proof (state)
this:
fv (s' \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> fv (Fun f X \<cdot> \<delta>) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (2 subgoals):
 1. ac = assign \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "fv (s' \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> wfrestrictedvars\<^sub>s\<^sub>t ((S@S') \<cdot>\<^sub>s\<^sub>t \<delta>)"
[PROOF STATE]
proof (prove)
using this:
fv (s' \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> fv (Fun f X \<cdot> \<delta>) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (1 subgoal):
 1. fv (s' \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
fv (s' \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> fv (Fun f X \<cdot> \<delta>) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
fv (Fun f X \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (1 subgoal):
 1. fv (s' \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
fv (s' \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (2 subgoals):
 1. ac = assign \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "fv (s' \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t ((S@S') \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)"
[PROOF STATE]
proof (prove)
using this:
fv (s' \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (1 subgoal):
 1. fv (s' \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)
[PROOF STEP]
using \<open>x = Equality ac s s'\<close>
[PROOF STATE]
proof (prove)
using this:
fv (s' \<cdot> \<delta>) \<subseteq> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<union> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>)
x = \<langle>ac: s \<doteq> s'\<rangle>\<^sub>s\<^sub>t

goal (1 subgoal):
 1. fv (s' \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
fv (s' \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)

goal (2 subgoals):
 1. ac = assign \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
hence "wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (((S@S') \<cdot>\<^sub>s\<^sub>t \<delta>)@[Equality ac (s \<cdot> \<delta>) (s' \<cdot> \<delta>)])"
[PROOF STATE]
proof (prove)
using this:
fv (s' \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [\<langle>ac: (s \<cdot> \<delta>) \<doteq> s' \<cdot> \<delta>\<rangle>\<^sub>s\<^sub>t])
[PROOF STEP]
using wf_eq_append'''[OF **]
[PROOF STATE]
proof (prove)
using this:
fv (s' \<cdot> \<delta>) \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)
fv ?t' \<subseteq> wfrestrictedvars\<^sub>s\<^sub>t (S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) \<union> fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V) \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [\<langle>?a: ?t \<doteq> ?t'\<rangle>\<^sub>s\<^sub>t])

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [\<langle>ac: (s \<cdot> \<delta>) \<doteq> s' \<cdot> \<delta>\<rangle>\<^sub>s\<^sub>t])
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [\<langle>ac: (s \<cdot> \<delta>) \<doteq> s' \<cdot> \<delta>\<rangle>\<^sub>s\<^sub>t])

goal (2 subgoals):
 1. ac = assign \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
 2. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [\<langle>ac: (s \<cdot> \<delta>) \<doteq> s' \<cdot> \<delta>\<rangle>\<^sub>s\<^sub>t])

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
using \<open>x = Equality ac s s'\<close>
[PROOF STATE]
proof (prove)
using this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [\<langle>ac: (s \<cdot> \<delta>) \<doteq> s' \<cdot> \<delta>\<rangle>\<^sub>s\<^sub>t])
x = \<langle>ac: s \<doteq> s'\<rangle>\<^sub>s\<^sub>t

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (1 subgoal):
 1. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
case Check
[PROOF STATE]
proof (state)
this:
ac = check

goal (1 subgoal):
 1. ac = check \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
ac = check

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
using wf_eq_check_append''[OF **] Equality
[PROOF STATE]
proof (prove)
using this:
ac = check
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [\<langle>check: ?t \<doteq> ?t'\<rangle>\<^sub>s\<^sub>t])
x = \<langle>ac: s \<doteq> s'\<rangle>\<^sub>s\<^sub>t

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (1 subgoal):
 1. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
case (Inequality t t')
[PROOF STATE]
proof (state)
this:
x = \<forall>t\<langle>\<or>\<noteq>: t'\<rangle>\<^sub>s\<^sub>t

goal (1 subgoal):
 1. \<And>x41 x42. x = \<forall>x41\<langle>\<or>\<noteq>: x42\<rangle>\<^sub>s\<^sub>t \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
x = \<forall>t\<langle>\<or>\<noteq>: t'\<rangle>\<^sub>s\<^sub>t

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
using wf_ineq_append''[OF **]
[PROOF STATE]
proof (prove)
using this:
x = \<forall>t\<langle>\<or>\<noteq>: t'\<rangle>\<^sub>s\<^sub>t
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) ((S @ S' \<cdot>\<^sub>s\<^sub>t \<delta>) @ [\<forall>?X\<langle>\<or>\<noteq>: ?F\<rangle>\<^sub>s\<^sub>t])

goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ S' @ [x] \<cdot>\<^sub>s\<^sub>t \<delta>)

goal (1 subgoal):
 1. \<And>V. \<lbrakk>wf\<^sub>s\<^sub>t V (S @ [Send1 (Fun f X)]); t \<in> ik\<^sub>s\<^sub>t S; Unifier \<delta> (Fun f X) t; bvars\<^sub>s\<^sub>t (S @ [Send1 (Fun f X)]) \<inter> (subst_domain \<delta> \<union> range_vars \<delta>) = {}\<rbrakk> \<Longrightarrow> wf\<^sub>s\<^sub>t (fv\<^sub>s\<^sub>e\<^sub>t (\<delta> ` V)) (S @ [] \<cdot>\<^sub>s\<^sub>t \<delta>)
[PROOF STEP]
qed (auto dest: wf_subst_apply)


[STATEMENT]
lemma the_elem_code [code]:
  fixes dxs :: "'a :: ceq set_dlist"
  and rbt :: "'b :: ccompare set_rbt" shows
  "the_elem (Set_Monad [x]) = x"
  "the_elem (DList_set dxs) =
  (case ID CEQ('a) of None \<Rightarrow> Code.abort (STR ''the_elem DList_set: ceq = None'') (\<lambda>_. the_elem (DList_set dxs))
                  | Some _ \<Rightarrow>
     case list_of_dlist dxs of [x] \<Rightarrow> x
       | _ \<Rightarrow> Code.abort (STR ''the_elem DList_set: not unique'') (\<lambda>_. the_elem (DList_set dxs)))"
  "the_elem (RBT_set rbt) =
  (case ID CCOMPARE('b) of None \<Rightarrow> Code.abort (STR ''the_elem RBT_set: ccompare = None'') (\<lambda>_. the_elem (RBT_set rbt))
                     | Some _ \<Rightarrow>
     case RBT_Mapping2.impl_of rbt of RBT_Impl.Branch _ RBT_Impl.Empty x _ RBT_Impl.Empty \<Rightarrow> x
       | _ \<Rightarrow> Code.abort (STR ''the_elem RBT_set: not unique'') (\<lambda>_. the_elem (RBT_set rbt)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. the_elem (Set_Monad [x]) = x &&& the_elem (DList_set dxs) = (case ID CEQ('a) of None \<Rightarrow> Code.abort STR ''the_elem DList_set: ceq = None'' (\<lambda>_. the_elem (DList_set dxs)) | Some x \<Rightarrow> case list_of_dlist dxs of [] \<Rightarrow> Code.abort STR ''the_elem DList_set: not unique'' (\<lambda>_. the_elem (DList_set dxs)) | [x] \<Rightarrow> x | x # aa # lista \<Rightarrow> Code.abort STR ''the_elem DList_set: not unique'' (\<lambda>_. the_elem (DList_set dxs))) &&& the_elem (RBT_set rbt) = (case ID ccompare of None \<Rightarrow> Code.abort STR ''the_elem RBT_set: ccompare = None'' (\<lambda>_. the_elem (RBT_set rbt)) | Some x \<Rightarrow> case mapping_rbt.impl_of rbt of rbt.Empty \<Rightarrow> Code.abort STR ''the_elem RBT_set: not unique'' (\<lambda>_. the_elem (RBT_set rbt)) | Branch xa rbt.Empty x xb rbt.Empty \<Rightarrow> x | Branch xa rbt.Empty x xb (Branch colora rbt1 aa ba rbt2a) \<Rightarrow> Code.abort STR ''the_elem RBT_set: not unique'' (\<lambda>_. the_elem (RBT_set rbt)) | Branch xa (Branch colora rbt1a ab bb rbt2b) x xb rbt2 \<Rightarrow> Code.abort STR ''the_elem RBT_set: not unique'' (\<lambda>_. the_elem (RBT_set rbt)))
[PROOF STEP]
by(auto simp add: RBT_set_def DList_set_def DList_Set.Collect_member the_elem_def member_conv_keys split: option.split list.split rbt.split)(simp add: RBT_Set2.keys_def)


[STATEMENT]
lemma "normalized_src_ports m \<Longrightarrow> normalized_nnf_match m"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. normalized_src_ports m \<Longrightarrow> normalized_nnf_match m
[PROOF STEP]
apply(induction m rule: normalized_src_ports.induct)
[PROOF STATE]
proof (prove)
goal (29 subgoals):
 1. normalized_src_ports MatchAny \<Longrightarrow> normalized_nnf_match MatchAny
 2. \<And>uu_. normalized_src_ports (Match (Src_Ports (L4Ports uu_ []))) \<Longrightarrow> normalized_nnf_match (Match (Src_Ports (L4Ports uu_ [])))
 3. \<And>uv_ uw_. normalized_src_ports (Match (Src_Ports (L4Ports uv_ [uw_]))) \<Longrightarrow> normalized_nnf_match (Match (Src_Ports (L4Ports uv_ [uw_])))
 4. \<And>v vb va vd. normalized_src_ports (Match (Src_Ports (L4Ports v (vb # va # vd)))) \<Longrightarrow> normalized_nnf_match (Match (Src_Ports (L4Ports v (vb # va # vd))))
 5. \<And>v. normalized_src_ports (Match (Src v)) \<Longrightarrow> normalized_nnf_match (Match (Src v))
 6. \<And>v. normalized_src_ports (Match (Dst v)) \<Longrightarrow> normalized_nnf_match (Match (Dst v))
 7. \<And>v. normalized_src_ports (Match (IIface v)) \<Longrightarrow> normalized_nnf_match (Match (IIface v))
 8. \<And>v. normalized_src_ports (Match (OIface v)) \<Longrightarrow> normalized_nnf_match (Match (OIface v))
 9. \<And>v. normalized_src_ports (Match (Prot v)) \<Longrightarrow> normalized_nnf_match (Match (Prot v))
 10. \<And>v. normalized_src_ports (Match (Dst_Ports v)) \<Longrightarrow> normalized_nnf_match (Match (Dst_Ports v))
A total of 29 subgoals...
[PROOF STEP]
apply(simp_all)[15]
[PROOF STATE]
proof (prove)
goal (14 subgoals):
 1. \<And>v. normalized_src_ports (MatchNot (Match (Src v))) \<Longrightarrow> normalized_nnf_match (MatchNot (Match (Src v)))
 2. \<And>v. normalized_src_ports (MatchNot (Match (Dst v))) \<Longrightarrow> normalized_nnf_match (MatchNot (Match (Dst v)))
 3. \<And>v. normalized_src_ports (MatchNot (Match (IIface v))) \<Longrightarrow> normalized_nnf_match (MatchNot (Match (IIface v)))
 4. \<And>v. normalized_src_ports (MatchNot (Match (OIface v))) \<Longrightarrow> normalized_nnf_match (MatchNot (Match (OIface v)))
 5. \<And>v. normalized_src_ports (MatchNot (Match (Prot v))) \<Longrightarrow> normalized_nnf_match (MatchNot (Match (Prot v)))
 6. \<And>v. normalized_src_ports (MatchNot (Match (Dst_Ports v))) \<Longrightarrow> normalized_nnf_match (MatchNot (Match (Dst_Ports v)))
 7. \<And>v. normalized_src_ports (MatchNot (Match (MultiportPorts v))) \<Longrightarrow> normalized_nnf_match (MatchNot (Match (MultiportPorts v)))
 8. \<And>v. normalized_src_ports (MatchNot (Match (L4_Flags v))) \<Longrightarrow> normalized_nnf_match (MatchNot (Match (L4_Flags v)))
 9. \<And>v. normalized_src_ports (MatchNot (Match (CT_State v))) \<Longrightarrow> normalized_nnf_match (MatchNot (Match (CT_State v)))
 10. \<And>v. normalized_src_ports (MatchNot (Match (Extra v))) \<Longrightarrow> normalized_nnf_match (MatchNot (Match (Extra v)))
A total of 14 subgoals...
[PROOF STEP]
oops


[STATEMENT]
lemma get_parent_wf_is_l_get_parent_wf [instances]:
  "l_get_parent_wf ShadowRootClass.type_wf ShadowRootClass.known_ptr ShadowRootClass.known_ptrs
  heap_is_wellformed parent_child_rel Shadow_DOM.get_child_nodes Shadow_DOM.get_parent"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. l_get_parent_wf ShadowRootClass.type_wf ShadowRootClass.known_ptr ShadowRootClass.known_ptrs Shadow_DOM.heap_is_wellformed Shadow_DOM.parent_child_rel Shadow_DOM.get_child_nodes Shadow_DOM.get_parent
[PROOF STEP]
apply(auto simp add: l_get_parent_wf_def l_get_parent_wf_axioms_def instances)[1]
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>h ptr children child. \<lbrakk>Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_child_nodes ptr \<rightarrow>\<^sub>r children; child \<in> set children\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr
 2. \<And>h P x. \<lbrakk>Shadow_DOM.heap_is_wellformed h; \<forall>parent. (\<forall>children. h \<turnstile> Shadow_DOM.get_child_nodes parent \<rightarrow>\<^sub>r children \<longrightarrow> (\<forall>child. child \<in> set children \<longrightarrow> P (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child))) \<longrightarrow> P parent\<rbrakk> \<Longrightarrow> P x
 3. \<And>h P x. \<lbrakk>Shadow_DOM.heap_is_wellformed h; \<forall>child. (\<forall>parent child_node. cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node = child \<longrightarrow> h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent \<longrightarrow> P parent) \<longrightarrow> P child\<rbrakk> \<Longrightarrow> P x
 4. \<And>h child_node parent. \<lbrakk>Shadow_DOM.heap_is_wellformed h; h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent\<rbrakk> \<Longrightarrow> (parent, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node) \<in> Shadow_DOM.parent_child_rel h
[PROOF STEP]
using child_parent_dual
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Shadow_DOM.heap_is_wellformed ?h; ?h \<turnstile> Shadow_DOM.get_child_nodes ?ptr \<rightarrow>\<^sub>r ?children; ?child \<in> set ?children; ShadowRootClass.known_ptrs ?h; ShadowRootClass.type_wf ?h\<rbrakk> \<Longrightarrow> ?h \<turnstile> Shadow_DOM.get_parent ?child \<rightarrow>\<^sub>r Some ?ptr

goal (4 subgoals):
 1. \<And>h ptr children child. \<lbrakk>Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_child_nodes ptr \<rightarrow>\<^sub>r children; child \<in> set children\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr
 2. \<And>h P x. \<lbrakk>Shadow_DOM.heap_is_wellformed h; \<forall>parent. (\<forall>children. h \<turnstile> Shadow_DOM.get_child_nodes parent \<rightarrow>\<^sub>r children \<longrightarrow> (\<forall>child. child \<in> set children \<longrightarrow> P (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child))) \<longrightarrow> P parent\<rbrakk> \<Longrightarrow> P x
 3. \<And>h P x. \<lbrakk>Shadow_DOM.heap_is_wellformed h; \<forall>child. (\<forall>parent child_node. cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node = child \<longrightarrow> h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent \<longrightarrow> P parent) \<longrightarrow> P child\<rbrakk> \<Longrightarrow> P x
 4. \<And>h child_node parent. \<lbrakk>Shadow_DOM.heap_is_wellformed h; h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent\<rbrakk> \<Longrightarrow> (parent, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node) \<in> Shadow_DOM.parent_child_rel h
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>h P x. \<lbrakk>Shadow_DOM.heap_is_wellformed h; \<forall>parent. (\<forall>children. h \<turnstile> Shadow_DOM.get_child_nodes parent \<rightarrow>\<^sub>r children \<longrightarrow> (\<forall>child. child \<in> set children \<longrightarrow> P (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child))) \<longrightarrow> P parent\<rbrakk> \<Longrightarrow> P x
 2. \<And>h P x. \<lbrakk>Shadow_DOM.heap_is_wellformed h; \<forall>child. (\<forall>parent child_node. cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node = child \<longrightarrow> h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent \<longrightarrow> P parent) \<longrightarrow> P child\<rbrakk> \<Longrightarrow> P x
 3. \<And>h child_node parent. \<lbrakk>Shadow_DOM.heap_is_wellformed h; h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent\<rbrakk> \<Longrightarrow> (parent, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node) \<in> Shadow_DOM.parent_child_rel h
[PROOF STEP]
using heap_wellformed_induct
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Shadow_DOM.heap_is_wellformed ?h; \<And>parent. (\<And>children child. \<lbrakk>?h \<turnstile> Shadow_DOM.get_child_nodes parent \<rightarrow>\<^sub>r children; child \<in> set children\<rbrakk> \<Longrightarrow> ?P (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child)) \<Longrightarrow> ?P parent\<rbrakk> \<Longrightarrow> ?P ?ptr

goal (3 subgoals):
 1. \<And>h P x. \<lbrakk>Shadow_DOM.heap_is_wellformed h; \<forall>parent. (\<forall>children. h \<turnstile> Shadow_DOM.get_child_nodes parent \<rightarrow>\<^sub>r children \<longrightarrow> (\<forall>child. child \<in> set children \<longrightarrow> P (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child))) \<longrightarrow> P parent\<rbrakk> \<Longrightarrow> P x
 2. \<And>h P x. \<lbrakk>Shadow_DOM.heap_is_wellformed h; \<forall>child. (\<forall>parent child_node. cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node = child \<longrightarrow> h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent \<longrightarrow> P parent) \<longrightarrow> P child\<rbrakk> \<Longrightarrow> P x
 3. \<And>h child_node parent. \<lbrakk>Shadow_DOM.heap_is_wellformed h; h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent\<rbrakk> \<Longrightarrow> (parent, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node) \<in> Shadow_DOM.parent_child_rel h
[PROOF STEP]
apply metis
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>h P x. \<lbrakk>Shadow_DOM.heap_is_wellformed h; \<forall>child. (\<forall>parent child_node. cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node = child \<longrightarrow> h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent \<longrightarrow> P parent) \<longrightarrow> P child\<rbrakk> \<Longrightarrow> P x
 2. \<And>h child_node parent. \<lbrakk>Shadow_DOM.heap_is_wellformed h; h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent\<rbrakk> \<Longrightarrow> (parent, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node) \<in> Shadow_DOM.parent_child_rel h
[PROOF STEP]
using heap_wellformed_induct_rev
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Shadow_DOM.heap_is_wellformed ?h; \<And>child. (\<And>parent child_node. \<lbrakk>cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node = child; ?h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent\<rbrakk> \<Longrightarrow> ?P parent) \<Longrightarrow> ?P child\<rbrakk> \<Longrightarrow> ?P ?ptr

goal (2 subgoals):
 1. \<And>h P x. \<lbrakk>Shadow_DOM.heap_is_wellformed h; \<forall>child. (\<forall>parent child_node. cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node = child \<longrightarrow> h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent \<longrightarrow> P parent) \<longrightarrow> P child\<rbrakk> \<Longrightarrow> P x
 2. \<And>h child_node parent. \<lbrakk>Shadow_DOM.heap_is_wellformed h; h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent\<rbrakk> \<Longrightarrow> (parent, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node) \<in> Shadow_DOM.parent_child_rel h
[PROOF STEP]
apply metis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>h child_node parent. \<lbrakk>Shadow_DOM.heap_is_wellformed h; h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent\<rbrakk> \<Longrightarrow> (parent, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node) \<in> Shadow_DOM.parent_child_rel h
[PROOF STEP]
using parent_child_rel_parent
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Shadow_DOM.heap_is_wellformed ?h; ?h \<turnstile> Shadow_DOM.get_parent ?child_node \<rightarrow>\<^sub>r Some ?parent\<rbrakk> \<Longrightarrow> (?parent, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?child_node) \<in> Shadow_DOM.parent_child_rel ?h

goal (1 subgoal):
 1. \<And>h child_node parent. \<lbrakk>Shadow_DOM.heap_is_wellformed h; h \<turnstile> Shadow_DOM.get_parent child_node \<rightarrow>\<^sub>r Some parent\<rbrakk> \<Longrightarrow> (parent, cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child_node) \<in> Shadow_DOM.parent_child_rel h
[PROOF STEP]
apply metis
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma get_shadow_root_ptr_simp7 [simp]:
  "get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr (put\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t shadow_root_ptr f h) = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. get document_ptr (put shadow_root_ptr f h) = get document_ptr h
[PROOF STEP]
by(auto simp add: get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def put\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def)


[STATEMENT]
lemma add_lemma_one_arg:
  "rec_eval rec_add [x] =  undefined"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rec_eval rec_add [x] = undefined
[PROOF STEP]
proof (induct x)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. rec_eval rec_add [0] = undefined
 2. \<And>x. rec_eval rec_add [x] = undefined \<Longrightarrow> rec_eval rec_add [Suc x] = undefined
[PROOF STEP]
case 0
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. rec_eval rec_add [0] = undefined
 2. \<And>x. rec_eval rec_add [x] = undefined \<Longrightarrow> rec_eval rec_add [Suc x] = undefined
[PROOF STEP]
(*
  then show ?case by (auto simp add: rec_add_def)

goal (1 subgoal):
 1. \<And>x. rec_eval rec_add [x] = undefined \<Longrightarrow> rec_eval rec_add [Suc x] = undefined
Failed to finish proof\<^here>:
goal (1 subgoal):
 1. [] ! 0 = undefined
*)
[PROOF STATE]
proof (state)
this:

goal (2 subgoals):
 1. rec_eval rec_add [0] = undefined
 2. \<And>x. rec_eval rec_add [x] = undefined \<Longrightarrow> rec_eval rec_add [Suc x] = undefined
[PROOF STEP]
oops


[STATEMENT]
lemma PMS_Crypt_sessionK_not_spied:
     "[| Crypt (sessionK((Na, Nb, PRF(PMS,NA,NB)), role)) Y
           \<in> parts (spies evs);  evs \<in> tls |]
      ==> Nonce PMS \<in> parts (spies evs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Crypt (sessionK ((Na, Nb, PRF (PMS, NA, NB)), role)) Y \<in> parts (knows Spy evs); evs \<in> tls\<rbrakk> \<Longrightarrow> Nonce PMS \<in> parts (knows Spy evs)
[PROOF STEP]
by (blast dest: PMS_lemma)