[STATEMENT]
lemma "Fr_3 \<F>'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Fr_3 \<F>'
[PROOF STEP]
nitpick
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Fr_3 \<F>'
[PROOF STEP]
oops


[STATEMENT]
lemma P_ltl_step_1:
  assumes invalid: "P (None, [], r)"
  assumes coin: "l = STR ''coin'' \<longrightarrow> P (Some 1, [value_plus (r $ 2) (Some (hd i))], r(2 $:= value_plus (r $ 2) (Some (i ! 0))))"
  assumes vend_fail: "value_gt (Some (Num 100)) (r $ 2) = trilean.true \<longrightarrow> P (Some 1, [],r)"
  assumes vend: "\<not>? value_gt (Some (Num 100)) (r $ 2) = trilean.true \<longrightarrow> P (Some 2, [r$1], r)"
  shows "P (ltl_step drinks (Some 1) r (l, i))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
have length_i: "\<And>s. \<exists>d. (l, i) = (s, [d]) \<Longrightarrow> length i = 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>s. \<exists>d. (l, i) = (s, [d]) \<Longrightarrow> length i = 1
[PROOF STEP]
by (induct i, auto)
[PROOF STATE]
proof (state)
this:
\<exists>d. (l, i) = (?s, [d]) \<Longrightarrow> length i = 1

goal (1 subgoal):
 1. P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
have length_i_2: "\<forall>d. i \<noteq> [d] \<Longrightarrow> length i \<noteq> 1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>d. i \<noteq> [d] \<Longrightarrow> length i \<noteq> 1
[PROOF STEP]
by (induct i, auto)
[PROOF STATE]
proof (state)
this:
\<forall>d. i \<noteq> [d] \<Longrightarrow> length i \<noteq> 1

goal (1 subgoal):
 1. P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
apply (case_tac "\<exists>d. (l, i) = (STR ''coin'', [d])")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<exists>d. (l, i) = (STR ''coin'', [d]) \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
 2. \<nexists>d. (l, i) = (STR ''coin'', [d]) \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
apply (simp add: possible_steps_1_coin length_i coin_def apply_outputs_def apply_updates_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. l = STR ''coin'' \<and> (\<exists>d. i = [d]) \<Longrightarrow> P (Some 1, [value_plus (r $ 2) (Some (i ! 0))], r(2 $:= value_plus (r $ 2) (Some (i ! 0))))
 2. \<nexists>d. (l, i) = (STR ''coin'', [d]) \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
using coin
[PROOF STATE]
proof (prove)
using this:
l = STR ''coin'' \<longrightarrow> P (Some 1, [value_plus (r $ 2) (Some (hd i))], r(2 $:= value_plus (r $ 2) (Some (i ! 0))))

goal (2 subgoals):
 1. l = STR ''coin'' \<and> (\<exists>d. i = [d]) \<Longrightarrow> P (Some 1, [value_plus (r $ 2) (Some (i ! 0))], r(2 $:= value_plus (r $ 2) (Some (i ! 0))))
 2. \<nexists>d. (l, i) = (STR ''coin'', [d]) \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
apply auto[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<nexists>d. (l, i) = (STR ''coin'', [d]) \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
apply (case_tac "(l, i) = (STR ''vend'', [])")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<nexists>d. (l, i) = (STR ''coin'', [d]); (l, i) = (STR ''vend'', [])\<rbrakk> \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
 2. \<lbrakk>\<nexists>d. (l, i) = (STR ''coin'', [d]); (l, i) \<noteq> (STR ''vend'', [])\<rbrakk> \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
apply (case_tac "\<exists>n. r $ 2 = Some (Num n)")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<nexists>d. (l, i) = (STR ''coin'', [d]); (l, i) = (STR ''vend'', []); \<exists>n. r $ 2 = Some (Num n)\<rbrakk> \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
 2. \<lbrakk>\<nexists>d. (l, i) = (STR ''coin'', [d]); (l, i) = (STR ''vend'', []); \<nexists>n. r $ 2 = Some (Num n)\<rbrakk> \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
 3. \<lbrakk>\<nexists>d. (l, i) = (STR ''coin'', [d]); (l, i) \<noteq> (STR ''vend'', [])\<rbrakk> \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>n. \<lbrakk>r $ 2 = Some (Num n); l = STR ''vend''; i = []\<rbrakk> \<Longrightarrow> P (let possibilities = possible_steps drinks 1 r STR ''vend'' [] in if possibilities = {||} then (None, [], r) else let (s', t) = SOME x. x |\<in>| possibilities in (Some s', evaluate_outputs t [] r, evaluate_updates t [] r))
 2. \<lbrakk>\<nexists>d. (l, i) = (STR ''coin'', [d]); (l, i) = (STR ''vend'', []); \<nexists>n. r $ 2 = Some (Num n)\<rbrakk> \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
 3. \<lbrakk>\<nexists>d. (l, i) = (STR ''coin'', [d]); (l, i) \<noteq> (STR ''vend'', [])\<rbrakk> \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
subgoal for n
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>r $ 2 = Some (Num n); l = STR ''vend''; i = []\<rbrakk> \<Longrightarrow> P (let possibilities = possible_steps drinks 1 r STR ''vend'' [] in if possibilities = {||} then (None, [], r) else let (s', t) = SOME x. x |\<in>| possibilities in (Some s', evaluate_outputs t [] r, evaluate_updates t [] r))
[PROOF STEP]
apply (case_tac "n \<ge> 100")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>r $ 2 = Some (Num n); l = STR ''vend''; i = []; 100 \<le> n\<rbrakk> \<Longrightarrow> P (let possibilities = possible_steps drinks 1 r STR ''vend'' [] in if possibilities = {||} then (None, [], r) else let (s', t) = SOME x. x |\<in>| possibilities in (Some s', evaluate_outputs t [] r, evaluate_updates t [] r))
 2. \<lbrakk>r $ 2 = Some (Num n); l = STR ''vend''; i = []; \<not> 100 \<le> n\<rbrakk> \<Longrightarrow> P (let possibilities = possible_steps drinks 1 r STR ''vend'' [] in if possibilities = {||} then (None, [], r) else let (s', t) = SOME x. x |\<in>| possibilities in (Some s', evaluate_outputs t [] r, evaluate_updates t [] r))
[PROOF STEP]
apply (simp add: drinks_vend_sufficient vend_def apply_updates_def apply_outputs_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>r $ 2 = Some (Num n); l = STR ''vend''; i = []; 100 \<le> n\<rbrakk> \<Longrightarrow> P (Some 2, [r $ 1], r(2 $:= Some (Num n)))
 2. \<lbrakk>r $ 2 = Some (Num n); l = STR ''vend''; i = []; \<not> 100 \<le> n\<rbrakk> \<Longrightarrow> P (let possibilities = possible_steps drinks 1 r STR ''vend'' [] in if possibilities = {||} then (None, [], r) else let (s', t) = SOME x. x |\<in>| possibilities in (Some s', evaluate_outputs t [] r, evaluate_updates t [] r))
[PROOF STEP]
apply (metis finfun_upd_triv possible_steps_2_vend vend vend_ge_100)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>r $ 2 = Some (Num n); l = STR ''vend''; i = []; \<not> 100 \<le> n\<rbrakk> \<Longrightarrow> P (let possibilities = possible_steps drinks 1 r STR ''vend'' [] in if possibilities = {||} then (None, [], r) else let (s', t) = SOME x. x |\<in>| possibilities in (Some s', evaluate_outputs t [] r, evaluate_updates t [] r))
[PROOF STEP]
apply (simp add: drinks_vend_insufficient vend_fail_def apply_updates_def apply_outputs_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>r $ 2 = Some (Num n); l = STR ''vend''; i = []; \<not> 100 \<le> n\<rbrakk> \<Longrightarrow> P (Some 1, [], r(2 $:= Some (Num n)))
[PROOF STEP]
apply (metis MaybeBoolInt.simps(1) finfun_upd_triv not_less value_gt_def vend_fail)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<nexists>d. (l, i) = (STR ''coin'', [d]); (l, i) = (STR ''vend'', []); \<nexists>n. r $ 2 = Some (Num n)\<rbrakk> \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
 2. \<lbrakk>\<nexists>d. (l, i) = (STR ''coin'', [d]); (l, i) \<noteq> (STR ''vend'', [])\<rbrakk> \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
apply (simp add: drinks_vend_invalid invalid)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<nexists>d. (l, i) = (STR ''coin'', [d]); (l, i) \<noteq> (STR ''vend'', [])\<rbrakk> \<Longrightarrow> P (ltl_step drinks (Some 1) r (l, i))
[PROOF STEP]
by (simp add: drinks_no_possible_steps_1 length_i_2 invalid)
[PROOF STATE]
proof (state)
this:
P (ltl_step drinks (Some 1) r (l, i))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma fresh_fun_ImpR[eqvt_force]:
  fixes pi1::"name prm"
  and   pi2::"coname prm"
  shows "pi1\<bullet>fresh_fun (\<lambda>a'. Cut <a'>.(ImpR (y).<b>.M a') (x).P)=
             fresh_fun (pi1\<bullet>(\<lambda>a'. Cut <a'>.(ImpR (y).<b>.M  a') (x).P))"
  and   "pi2\<bullet>fresh_fun (\<lambda>a'. Cut <a'>.(ImpR (y).<b>.M a') (x).P)=
             fresh_fun (pi2\<bullet>(\<lambda>a'. Cut <a'>.(ImpR (y).<b>.M a') (x).P))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pi1 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (pi1 \<bullet> (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P)) &&& pi2 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (pi2 \<bullet> (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P))
[PROOF STEP]
apply -
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. pi1 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (pi1 \<bullet> (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P))
 2. pi2 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (pi2 \<bullet> (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P))
[PROOF STEP]
apply(perm_simp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. pi1 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (\<lambda>xa. Cut <xa>.ImpR (pi1 \<bullet> y).<b>.(pi1 \<bullet> M) xa (pi1 \<bullet> x).(pi1 \<bullet> P))
 2. pi2 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (pi2 \<bullet> (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P))
[PROOF STEP]
apply(subgoal_tac "\<exists>n::coname. n\<sharp>(P,M,b,pi1\<bullet>P,pi1\<bullet>M,pi1\<bullet>b,pi1)")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<exists>n. n \<sharp> (P, M, b, pi1 \<bullet> P, pi1 \<bullet> M, pi1 \<bullet> b, pi1) \<Longrightarrow> pi1 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (\<lambda>xa. Cut <xa>.ImpR (pi1 \<bullet> y).<b>.(pi1 \<bullet> M) xa (pi1 \<bullet> x).(pi1 \<bullet> P))
 2. \<exists>n. n \<sharp> (P, M, b, pi1 \<bullet> P, pi1 \<bullet> M, pi1 \<bullet> b, pi1)
 3. pi2 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (pi2 \<bullet> (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P))
[PROOF STEP]
apply(simp add: fresh_prod)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<exists>n. n \<sharp> P \<and> n \<sharp> M \<and> n \<sharp> b \<and> n \<sharp> pi1 \<bullet> P \<and> n \<sharp> pi1 \<bullet> M \<and> n \<sharp> pi1 \<bullet> b \<and> n \<sharp> pi1 \<Longrightarrow> pi1 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (\<lambda>xa. Cut <xa>.ImpR (pi1 \<bullet> y).<b>.(pi1 \<bullet> M) xa (pi1 \<bullet> x).(pi1 \<bullet> P))
 2. \<exists>n. n \<sharp> (P, M, b, pi1 \<bullet> P, pi1 \<bullet> M, pi1 \<bullet> b, pi1)
 3. pi2 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (pi2 \<bullet> (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P))
[PROOF STEP]
apply(auto)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>n. \<lbrakk>n \<sharp> P; n \<sharp> M; n \<sharp> b; n \<sharp> pi1 \<bullet> P; n \<sharp> pi1 \<bullet> M; n \<sharp> pi1 \<bullet> b; n \<sharp> pi1\<rbrakk> \<Longrightarrow> pi1 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (\<lambda>xa. Cut <xa>.ImpR (pi1 \<bullet> y).<b>.(pi1 \<bullet> M) xa (pi1 \<bullet> x).(pi1 \<bullet> P))
 2. \<exists>n. n \<sharp> (P, M, b, pi1 \<bullet> P, pi1 \<bullet> M, pi1 \<bullet> b, pi1)
 3. pi2 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (pi2 \<bullet> (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P))
[PROOF STEP]
apply(simp add: fresh_fun_simp_ImpR calc_atm)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<exists>n. n \<sharp> (P, M, b, pi1 \<bullet> P, pi1 \<bullet> M, pi1 \<bullet> b, pi1)
 2. pi2 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (pi2 \<bullet> (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P))
[PROOF STEP]
apply(rule exists_fresh')
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. finite (supp (P, M, b, pi1 \<bullet> P, pi1 \<bullet> M, pi1 \<bullet> b, pi1))
 2. pi2 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (pi2 \<bullet> (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P))
[PROOF STEP]
apply(simp add: fin_supp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pi2 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (pi2 \<bullet> (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P))
[PROOF STEP]
apply(perm_simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pi2 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (\<lambda>xa. Cut <xa>.ImpR y.<(pi2 \<bullet> b)>.(pi2 \<bullet> M) xa x.(pi2 \<bullet> P))
[PROOF STEP]
apply(subgoal_tac "\<exists>n::coname. n\<sharp>(P,M,b,pi2\<bullet>P,pi2\<bullet>M,pi2\<bullet>b,pi2)")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<exists>n. n \<sharp> (P, M, b, pi2 \<bullet> P, pi2 \<bullet> M, pi2 \<bullet> b, pi2) \<Longrightarrow> pi2 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (\<lambda>xa. Cut <xa>.ImpR y.<(pi2 \<bullet> b)>.(pi2 \<bullet> M) xa x.(pi2 \<bullet> P))
 2. \<exists>n. n \<sharp> (P, M, b, pi2 \<bullet> P, pi2 \<bullet> M, pi2 \<bullet> b, pi2)
[PROOF STEP]
apply(simp add: fresh_prod)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<exists>n. n \<sharp> P \<and> n \<sharp> M \<and> n \<sharp> b \<and> n \<sharp> pi2 \<bullet> P \<and> n \<sharp> pi2 \<bullet> M \<and> n \<sharp> pi2 \<bullet> b \<and> n \<sharp> pi2 \<Longrightarrow> pi2 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (\<lambda>xa. Cut <xa>.ImpR y.<(pi2 \<bullet> b)>.(pi2 \<bullet> M) xa x.(pi2 \<bullet> P))
 2. \<exists>n. n \<sharp> (P, M, b, pi2 \<bullet> P, pi2 \<bullet> M, pi2 \<bullet> b, pi2)
[PROOF STEP]
apply(auto)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>n. \<lbrakk>n \<sharp> P; n \<sharp> M; n \<sharp> b; n \<sharp> pi2 \<bullet> P; n \<sharp> pi2 \<bullet> M; n \<sharp> pi2 \<bullet> b; n \<sharp> pi2\<rbrakk> \<Longrightarrow> pi2 \<bullet> fresh_fun (\<lambda>a'. Cut <a'>.ImpR y.<b>.M a' x.P) = fresh_fun (\<lambda>xa. Cut <xa>.ImpR y.<(pi2 \<bullet> b)>.(pi2 \<bullet> M) xa x.(pi2 \<bullet> P))
 2. \<exists>n. n \<sharp> (P, M, b, pi2 \<bullet> P, pi2 \<bullet> M, pi2 \<bullet> b, pi2)
[PROOF STEP]
apply(simp add: fresh_fun_simp_ImpR at_prm_fresh[OF at_coname_inst] swap_simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>n. n \<sharp> (P, M, b, pi2 \<bullet> P, pi2 \<bullet> M, pi2 \<bullet> b, pi2)
[PROOF STEP]
apply(rule exists_fresh')
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. finite (supp (P, M, b, pi2 \<bullet> P, pi2 \<bullet> M, pi2 \<bullet> b, pi2))
[PROOF STEP]
apply(simp add: fin_supp)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma get_child_nodes_get_dom_component:
  assumes "heap_is_wellformed h" and "type_wf h" and "known_ptrs h"
  assumes "h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c"
  assumes "h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children"
  shows "cast ` set children \<subseteq> set c"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ` set children \<subseteq> set c
[PROOF STEP]
using assms get_child_nodes_is_strongly_dom_component_safe
[PROOF STATE]
proof (prove)
using this:
heap_is_wellformed h
type_wf h
known_ptrs h
h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c
h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
\<lbrakk>heap_is_wellformed ?h; type_wf ?h; known_ptrs ?h; ?h \<turnstile> get_dom_component ?ptr \<rightarrow>\<^sub>r ?c; ?h \<turnstile> get_child_nodes ?ptr' \<rightarrow>\<^sub>r ?children; ?child \<in> set ?children\<rbrakk> \<Longrightarrow> (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?child \<in> set ?c) = (?ptr' \<in> set ?c)

goal (1 subgoal):
 1. cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ` set children \<subseteq> set c
[PROOF STEP]
using local.get_dom_component_ptr
[PROOF STATE]
proof (prove)
using this:
heap_is_wellformed h
type_wf h
known_ptrs h
h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c
h \<turnstile> get_child_nodes ptr \<rightarrow>\<^sub>r children
\<lbrakk>heap_is_wellformed ?h; type_wf ?h; known_ptrs ?h; ?h \<turnstile> get_dom_component ?ptr \<rightarrow>\<^sub>r ?c; ?h \<turnstile> get_child_nodes ?ptr' \<rightarrow>\<^sub>r ?children; ?child \<in> set ?children\<rbrakk> \<Longrightarrow> (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?child \<in> set ?c) = (?ptr' \<in> set ?c)
\<lbrakk>heap_is_wellformed ?h; type_wf ?h; known_ptrs ?h; ?h \<turnstile> get_dom_component ?ptr \<rightarrow>\<^sub>r ?c\<rbrakk> \<Longrightarrow> ?ptr \<in> set ?c

goal (1 subgoal):
 1. cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ` set children \<subseteq> set c
[PROOF STEP]
by auto


[STATEMENT]
lemma disjoint_darcs_aux1_aux1:
  assumes "disjoint_darcs xs"
      and "wf_dverts (Node r xs)"
      and "v \<notin> dverts (Node r xs)"
      and "e \<notin> darcs (Node r xs)"
      and "(t1,e1) \<in> fset (insert_before v e y xs)"
      and "(t2,e2) \<in> fset (insert_before v e y xs)"
      and "(t1,e1) \<noteq> (t2,e2)"
    shows "(darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
consider "(t1,e1) \<in> fset xs" "(t2,e2) \<in> fset xs"
        | "(t1,e1) \<notin> fset xs" "(t2,e2) \<in> fset xs"
        | "(t1,e1) \<in> fset xs" "(t2,e2) \<notin> fset xs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> thesis; \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> thesis; \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
using insert_before_only1_new assms(2,5-7)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<forall>(x, e1)\<in>fset ?xs. \<forall>(y, e2)\<in>fset ?xs. dverts x \<inter> dverts y = {} \<or> (x, e1) = (y, e2); (?t1.0, ?e1.0) \<noteq> (?t2.0, ?e2.0); (?t1.0, ?e1.0) \<in> fset (insert_before ?v ?e ?y ?xs); (?t2.0, ?e2.0) \<in> fset (insert_before ?v ?e ?y ?xs)\<rbrakk> \<Longrightarrow> (?t1.0, ?e1.0) \<in> fset ?xs \<or> (?t2.0, ?e2.0) \<in> fset ?xs
wf_dverts (Node r xs)
(t1, e1) \<in> fset (insert_before v e y xs)
(t2, e2) \<in> fset (insert_before v e y xs)
(t1, e1) \<noteq> (t2, e2)

goal (1 subgoal):
 1. \<lbrakk>\<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> thesis; \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> thesis; \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by (fastforce simp: wf_dverts_iff_dverts')
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> ?thesis; \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> ?thesis; \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> ?thesis; \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> ?thesis; \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> ?thesis; \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> ?thesis; \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
proof(cases)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
 2. \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
 3. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
(t1, e1) \<in> fset xs
(t2, e2) \<in> fset xs

goal (3 subgoals):
 1. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
 2. \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
 3. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(t1, e1) \<in> fset xs
(t2, e2) \<in> fset xs
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(t1, e1) \<in> fset xs
(t2, e2) \<in> fset xs

goal (1 subgoal):
 1. (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
using assms(1,7)
[PROOF STATE]
proof (prove)
using this:
(t1, e1) \<in> fset xs
(t2, e2) \<in> fset xs
disjoint_darcs xs
(t1, e1) \<noteq> (t2, e2)

goal (1 subgoal):
 1. (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
(darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}

goal (2 subgoals):
 1. \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
 2. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
 2. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
(t1, e1) \<notin> fset xs
(t2, e2) \<in> fset xs

goal (2 subgoals):
 1. \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
 2. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
obtain t3 e3 where t3_def: "(t3, e3)\<in>fset xs" "Node v {|(t3, e3)|} = t1" "root t3 = y" "e1=e"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>t3 e3. \<lbrakk>(t3, e3) \<in> fset xs; Node v {|(t3, e3)|} = t1; dtree.root t3 = y; e1 = e\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using in_insert_before_child_in_orig assms(5) 2
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>(?t1.0, ?e1.0) \<in> fset (insert_before ?v ?e ?y ?xs); (?t1.0, ?e1.0) \<notin> fset ?xs\<rbrakk> \<Longrightarrow> \<exists>(t2, e2)\<in>fset ?xs. Node ?v {|(t2, e2)|} = ?t1.0 \<and> dtree.root t2 = ?y \<and> ?e1.0 = ?e
(t1, e1) \<in> fset (insert_before v e y xs)
(t1, e1) \<notin> fset xs
(t2, e2) \<in> fset xs

goal (1 subgoal):
 1. (\<And>t3 e3. \<lbrakk>(t3, e3) \<in> fset xs; Node v {|(t3, e3)|} = t1; dtree.root t3 = y; e1 = e\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
(t3, e3) \<in> fset xs
Node v {|(t3, e3)|} = t1
dtree.root t3 = y
e1 = e

goal (2 subgoals):
 1. \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
 2. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(t3, e3) \<in> fset xs
Node v {|(t3, e3)|} = t1
dtree.root t3 = y
e1 = e
[PROOF STEP]
have "v\<noteq>y"
[PROOF STATE]
proof (prove)
using this:
(t3, e3) \<in> fset xs
Node v {|(t3, e3)|} = t1
dtree.root t3 = y
e1 = e

goal (1 subgoal):
 1. v \<noteq> y
[PROOF STEP]
using assms(3) dtree.set_sel(1)
[PROOF STATE]
proof (prove)
using this:
(t3, e3) \<in> fset xs
Node v {|(t3, e3)|} = t1
dtree.root t3 = y
e1 = e
v \<notin> dverts (Node r xs)
dtree.root ?a \<in> dverts ?a

goal (1 subgoal):
 1. v \<noteq> y
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
v \<noteq> y

goal (2 subgoals):
 1. \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
 2. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
v \<noteq> y
[PROOF STEP]
have "(t3,e3) \<noteq> (t2,e2)"
[PROOF STATE]
proof (prove)
using this:
v \<noteq> y

goal (1 subgoal):
 1. (t3, e3) \<noteq> (t2, e2)
[PROOF STEP]
using assms(6) t3_def(3) root_noty_if_in_insert_before
[PROOF STATE]
proof (prove)
using this:
v \<noteq> y
(t2, e2) \<in> fset (insert_before v e y xs)
dtree.root t3 = y
\<lbrakk>(?t1.0, ?e1.0) \<in> fset (insert_before ?v ?e ?y ?xs); ?v \<noteq> ?y\<rbrakk> \<Longrightarrow> dtree.root ?t1.0 \<noteq> ?y

goal (1 subgoal):
 1. (t3, e3) \<noteq> (t2, e2)
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
(t3, e3) \<noteq> (t2, e2)

goal (2 subgoals):
 1. \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
 2. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(t3, e3) \<noteq> (t2, e2)
[PROOF STEP]
have "(darcs t3 \<union> {e3}) \<inter> (darcs t2 \<union> {e2}) = {}"
[PROOF STATE]
proof (prove)
using this:
(t3, e3) \<noteq> (t2, e2)

goal (1 subgoal):
 1. (darcs t3 \<union> {e3}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
using assms(1) 2(2) t3_def(1)
[PROOF STATE]
proof (prove)
using this:
(t3, e3) \<noteq> (t2, e2)
disjoint_darcs xs
(t2, e2) \<in> fset xs
(t3, e3) \<in> fset xs

goal (1 subgoal):
 1. (darcs t3 \<union> {e3}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
(darcs t3 \<union> {e3}) \<inter> (darcs t2 \<union> {e2}) = {}

goal (2 subgoals):
 1. \<lbrakk>(t1, e1) \<notin> fset xs; (t2, e2) \<in> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
 2. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(darcs t3 \<union> {e3}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(darcs t3 \<union> {e3}) \<inter> (darcs t2 \<union> {e2}) = {}

goal (1 subgoal):
 1. (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
using assms(4) t3_def(4) 2(2) t3_def(2)
[PROOF STATE]
proof (prove)
using this:
(darcs t3 \<union> {e3}) \<inter> (darcs t2 \<union> {e2}) = {}
e \<notin> darcs (Node r xs)
e1 = e
(t2, e2) \<in> fset xs
Node v {|(t3, e3)|} = t1

goal (1 subgoal):
 1. (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
(darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}

goal (1 subgoal):
 1. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
case 3
[PROOF STATE]
proof (state)
this:
(t1, e1) \<in> fset xs
(t2, e2) \<notin> fset xs

goal (1 subgoal):
 1. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
obtain t3 e3 where t3_def: "(t3, e3)\<in>fset xs" "Node v {|(t3, e3)|} = t2" "root t3 = y" "e2=e"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>t3 e3. \<lbrakk>(t3, e3) \<in> fset xs; Node v {|(t3, e3)|} = t2; dtree.root t3 = y; e2 = e\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using in_insert_before_child_in_orig assms(6) 3
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>(?t1.0, ?e1.0) \<in> fset (insert_before ?v ?e ?y ?xs); (?t1.0, ?e1.0) \<notin> fset ?xs\<rbrakk> \<Longrightarrow> \<exists>(t2, e2)\<in>fset ?xs. Node ?v {|(t2, e2)|} = ?t1.0 \<and> dtree.root t2 = ?y \<and> ?e1.0 = ?e
(t2, e2) \<in> fset (insert_before v e y xs)
(t1, e1) \<in> fset xs
(t2, e2) \<notin> fset xs

goal (1 subgoal):
 1. (\<And>t3 e3. \<lbrakk>(t3, e3) \<in> fset xs; Node v {|(t3, e3)|} = t2; dtree.root t3 = y; e2 = e\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
(t3, e3) \<in> fset xs
Node v {|(t3, e3)|} = t2
dtree.root t3 = y
e2 = e

goal (1 subgoal):
 1. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(t3, e3) \<in> fset xs
Node v {|(t3, e3)|} = t2
dtree.root t3 = y
e2 = e
[PROOF STEP]
have "v\<noteq>y"
[PROOF STATE]
proof (prove)
using this:
(t3, e3) \<in> fset xs
Node v {|(t3, e3)|} = t2
dtree.root t3 = y
e2 = e

goal (1 subgoal):
 1. v \<noteq> y
[PROOF STEP]
using assms(3) dtree.set_sel(1)
[PROOF STATE]
proof (prove)
using this:
(t3, e3) \<in> fset xs
Node v {|(t3, e3)|} = t2
dtree.root t3 = y
e2 = e
v \<notin> dverts (Node r xs)
dtree.root ?a \<in> dverts ?a

goal (1 subgoal):
 1. v \<noteq> y
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
v \<noteq> y

goal (1 subgoal):
 1. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
v \<noteq> y
[PROOF STEP]
have "(t3,e3) \<noteq> (t1,e1)"
[PROOF STATE]
proof (prove)
using this:
v \<noteq> y

goal (1 subgoal):
 1. (t3, e3) \<noteq> (t1, e1)
[PROOF STEP]
using assms(5) t3_def(3) root_noty_if_in_insert_before
[PROOF STATE]
proof (prove)
using this:
v \<noteq> y
(t1, e1) \<in> fset (insert_before v e y xs)
dtree.root t3 = y
\<lbrakk>(?t1.0, ?e1.0) \<in> fset (insert_before ?v ?e ?y ?xs); ?v \<noteq> ?y\<rbrakk> \<Longrightarrow> dtree.root ?t1.0 \<noteq> ?y

goal (1 subgoal):
 1. (t3, e3) \<noteq> (t1, e1)
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
(t3, e3) \<noteq> (t1, e1)

goal (1 subgoal):
 1. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(t3, e3) \<noteq> (t1, e1)
[PROOF STEP]
have "(darcs t3 \<union> {e3}) \<inter> (darcs t1 \<union> {e1}) = {}"
[PROOF STATE]
proof (prove)
using this:
(t3, e3) \<noteq> (t1, e1)

goal (1 subgoal):
 1. (darcs t3 \<union> {e3}) \<inter> (darcs t1 \<union> {e1}) = {}
[PROOF STEP]
using assms(1) 3(1) t3_def(1)
[PROOF STATE]
proof (prove)
using this:
(t3, e3) \<noteq> (t1, e1)
disjoint_darcs xs
(t1, e1) \<in> fset xs
(t3, e3) \<in> fset xs

goal (1 subgoal):
 1. (darcs t3 \<union> {e3}) \<inter> (darcs t1 \<union> {e1}) = {}
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
(darcs t3 \<union> {e3}) \<inter> (darcs t1 \<union> {e1}) = {}

goal (1 subgoal):
 1. \<lbrakk>(t1, e1) \<in> fset xs; (t2, e2) \<notin> fset xs\<rbrakk> \<Longrightarrow> (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(darcs t3 \<union> {e3}) \<inter> (darcs t1 \<union> {e1}) = {}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(darcs t3 \<union> {e3}) \<inter> (darcs t1 \<union> {e1}) = {}

goal (1 subgoal):
 1. (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
using assms(4) t3_def(4) 3(1) t3_def(2)
[PROOF STATE]
proof (prove)
using this:
(darcs t3 \<union> {e3}) \<inter> (darcs t1 \<union> {e1}) = {}
e \<notin> darcs (Node r xs)
e2 = e
(t1, e1) \<in> fset xs
Node v {|(t3, e3)|} = t2

goal (1 subgoal):
 1. (darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
(darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(darcs t1 \<union> {e1}) \<inter> (darcs t2 \<union> {e2}) = {}

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma ord_resolve_unique:
  assumes
    "ord_resolve CAs DA AAs As \<sigma> E" and
    "ord_resolve CAs DA AAs As \<sigma>' E'"
  shows "\<sigma> = \<sigma>' \<and> E = E'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<sigma> = \<sigma>' \<and> E = E'
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
ord_resolve CAs DA AAs As \<sigma> E
ord_resolve CAs DA AAs As \<sigma>' E'

goal (1 subgoal):
 1. \<sigma> = \<sigma>' \<and> E = E'
[PROOF STEP]
proof (cases rule: ord_resolve.cases[case_product ord_resolve.cases], intro conjI)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>CAsa__ n__ Cs__ AAsa__ Asa__ \<sigma>''__ D__ CAsb__ na__ Csa__ AAsb__ Asb__ \<sigma>'''__ Da__. \<lbrakk>CAs = CAsa__; DA = D__ + negs (mset Asa__); AAs = AAsa__; As = Asa__; \<sigma> = \<sigma>''__; E = (\<Sum>\<^sub># (mset Cs__) + D__) \<cdot> \<sigma>''__; length CAsa__ = n__; length Cs__ = n__; length AAsa__ = n__; length Asa__ = n__; n__ \<noteq> 0; \<forall>i<n__. CAsa__ ! i = Cs__ ! i + poss (AAsa__ ! i); \<forall>i<n__. AAsa__ ! i \<noteq> {#}; Some \<sigma>''__ = mgu (set_mset ` set (Map2.map2 add_mset Asa__ AAsa__)); eligible \<sigma>''__ Asa__ (D__ + negs (mset Asa__)); \<forall>i<n__. strictly_maximal_wrt (Asa__ ! i \<cdot>a \<sigma>''__) (Cs__ ! i \<cdot> \<sigma>''__); \<forall>i<n__. S (CAsa__ ! i) = {#}; CAs = CAsb__; DA = Da__ + negs (mset Asb__); AAs = AAsb__; As = Asb__; \<sigma>' = \<sigma>'''__; E' = (\<Sum>\<^sub># (mset Csa__) + Da__) \<cdot> \<sigma>'''__; length CAsb__ = na__; length Csa__ = na__; length AAsb__ = na__; length Asb__ = na__; na__ \<noteq> 0; \<forall>i<na__. CAsb__ ! i = Csa__ ! i + poss (AAsb__ ! i); \<forall>i<na__. AAsb__ ! i \<noteq> {#}; Some \<sigma>'''__ = mgu (set_mset ` set (Map2.map2 add_mset Asb__ AAsb__)); eligible \<sigma>'''__ Asb__ (Da__ + negs (mset Asb__)); \<forall>i<na__. strictly_maximal_wrt (Asb__ ! i \<cdot>a \<sigma>'''__) (Csa__ ! i \<cdot> \<sigma>'''__); \<forall>i<na__. S (CAsb__ ! i) = {#}; ord_resolve CAs DA AAs As \<sigma> E; ord_resolve CAs DA AAs As \<sigma>' E'\<rbrakk> \<Longrightarrow> \<sigma> = \<sigma>'
 2. \<And>CAsa__ n__ Cs__ AAsa__ Asa__ \<sigma>''__ D__ CAsb__ na__ Csa__ AAsb__ Asb__ \<sigma>'''__ Da__. \<lbrakk>CAs = CAsa__; DA = D__ + negs (mset Asa__); AAs = AAsa__; As = Asa__; \<sigma> = \<sigma>''__; E = (\<Sum>\<^sub># (mset Cs__) + D__) \<cdot> \<sigma>''__; length CAsa__ = n__; length Cs__ = n__; length AAsa__ = n__; length Asa__ = n__; n__ \<noteq> 0; \<forall>i<n__. CAsa__ ! i = Cs__ ! i + poss (AAsa__ ! i); \<forall>i<n__. AAsa__ ! i \<noteq> {#}; Some \<sigma>''__ = mgu (set_mset ` set (Map2.map2 add_mset Asa__ AAsa__)); eligible \<sigma>''__ Asa__ (D__ + negs (mset Asa__)); \<forall>i<n__. strictly_maximal_wrt (Asa__ ! i \<cdot>a \<sigma>''__) (Cs__ ! i \<cdot> \<sigma>''__); \<forall>i<n__. S (CAsa__ ! i) = {#}; CAs = CAsb__; DA = Da__ + negs (mset Asb__); AAs = AAsb__; As = Asb__; \<sigma>' = \<sigma>'''__; E' = (\<Sum>\<^sub># (mset Csa__) + Da__) \<cdot> \<sigma>'''__; length CAsb__ = na__; length Csa__ = na__; length AAsb__ = na__; length Asb__ = na__; na__ \<noteq> 0; \<forall>i<na__. CAsb__ ! i = Csa__ ! i + poss (AAsb__ ! i); \<forall>i<na__. AAsb__ ! i \<noteq> {#}; Some \<sigma>'''__ = mgu (set_mset ` set (Map2.map2 add_mset Asb__ AAsb__)); eligible \<sigma>'''__ Asb__ (Da__ + negs (mset Asb__)); \<forall>i<na__. strictly_maximal_wrt (Asb__ ! i \<cdot>a \<sigma>'''__) (Csa__ ! i \<cdot> \<sigma>'''__); \<forall>i<na__. S (CAsb__ ! i) = {#}; ord_resolve CAs DA AAs As \<sigma> E; ord_resolve CAs DA AAs As \<sigma>' E'\<rbrakk> \<Longrightarrow> E = E'
[PROOF STEP]
case (ord_resolve_ord_resolve CAs n Cs AAs As \<sigma>'' DA CAs' n' Cs' AAs' As' \<sigma>''' DA')
[PROOF STATE]
proof (state)
this:
CAs = CAs
DA = DA + negs (mset As)
AAs = AAs
As = As
\<sigma> = \<sigma>''
E = (\<Sum>\<^sub># (mset Cs) + DA) \<cdot> \<sigma>''
length CAs = n
length Cs = n
length AAs = n
length As = n
n \<noteq> 0
\<forall>i<n. CAs ! i = Cs ! i + poss (AAs ! i)
\<forall>i<n. AAs ! i \<noteq> {#}
Some \<sigma>'' = mgu (set_mset ` set (Map2.map2 add_mset As AAs))
eligible \<sigma>'' As (DA + negs (mset As))
\<forall>i<n. strictly_maximal_wrt (As ! i \<cdot>a \<sigma>'') (Cs ! i \<cdot> \<sigma>'')
\<forall>i<n. S (CAs ! i) = {#}
CAs = CAs'
DA = DA' + negs (mset As')
AAs = AAs'
As = As'
\<sigma>' = \<sigma>'''
E' = (\<Sum>\<^sub># (mset Cs') + DA') \<cdot> \<sigma>'''
length CAs' = n'
length Cs' = n'
length AAs' = n'
length As' = n'
n' \<noteq> 0
\<forall>i<n'. CAs' ! i = Cs' ! i + poss (AAs' ! i)
\<forall>i<n'. AAs' ! i \<noteq> {#}
Some \<sigma>''' = mgu (set_mset ` set (Map2.map2 add_mset As' AAs'))
eligible \<sigma>''' As' (DA' + negs (mset As'))
\<forall>i<n'. strictly_maximal_wrt (As' ! i \<cdot>a \<sigma>''') (Cs' ! i \<cdot> \<sigma>''')
\<forall>i<n'. S (CAs' ! i) = {#}

goal (2 subgoals):
 1. \<And>CAsa__ n__ Cs__ AAsa__ Asa__ \<sigma>''__ D__ CAsb__ na__ Csa__ AAsb__ Asb__ \<sigma>'''__ Da__. \<lbrakk>CAs = CAsa__; DA = D__ + negs (mset Asa__); AAs = AAsa__; As = Asa__; \<sigma> = \<sigma>''__; E = (\<Sum>\<^sub># (mset Cs__) + D__) \<cdot> \<sigma>''__; length CAsa__ = n__; length Cs__ = n__; length AAsa__ = n__; length Asa__ = n__; n__ \<noteq> 0; \<forall>i<n__. CAsa__ ! i = Cs__ ! i + poss (AAsa__ ! i); \<forall>i<n__. AAsa__ ! i \<noteq> {#}; Some \<sigma>''__ = mgu (set_mset ` set (Map2.map2 add_mset Asa__ AAsa__)); eligible \<sigma>''__ Asa__ (D__ + negs (mset Asa__)); \<forall>i<n__. strictly_maximal_wrt (Asa__ ! i \<cdot>a \<sigma>''__) (Cs__ ! i \<cdot> \<sigma>''__); \<forall>i<n__. S (CAsa__ ! i) = {#}; CAs = CAsb__; DA = Da__ + negs (mset Asb__); AAs = AAsb__; As = Asb__; \<sigma>' = \<sigma>'''__; E' = (\<Sum>\<^sub># (mset Csa__) + Da__) \<cdot> \<sigma>'''__; length CAsb__ = na__; length Csa__ = na__; length AAsb__ = na__; length Asb__ = na__; na__ \<noteq> 0; \<forall>i<na__. CAsb__ ! i = Csa__ ! i + poss (AAsb__ ! i); \<forall>i<na__. AAsb__ ! i \<noteq> {#}; Some \<sigma>'''__ = mgu (set_mset ` set (Map2.map2 add_mset Asb__ AAsb__)); eligible \<sigma>'''__ Asb__ (Da__ + negs (mset Asb__)); \<forall>i<na__. strictly_maximal_wrt (Asb__ ! i \<cdot>a \<sigma>'''__) (Csa__ ! i \<cdot> \<sigma>'''__); \<forall>i<na__. S (CAsb__ ! i) = {#}; ord_resolve CAs DA AAs As \<sigma> E; ord_resolve CAs DA AAs As \<sigma>' E'\<rbrakk> \<Longrightarrow> \<sigma> = \<sigma>'
 2. \<And>CAsa__ n__ Cs__ AAsa__ Asa__ \<sigma>''__ D__ CAsb__ na__ Csa__ AAsb__ Asb__ \<sigma>'''__ Da__. \<lbrakk>CAs = CAsa__; DA = D__ + negs (mset Asa__); AAs = AAsa__; As = Asa__; \<sigma> = \<sigma>''__; E = (\<Sum>\<^sub># (mset Cs__) + D__) \<cdot> \<sigma>''__; length CAsa__ = n__; length Cs__ = n__; length AAsa__ = n__; length Asa__ = n__; n__ \<noteq> 0; \<forall>i<n__. CAsa__ ! i = Cs__ ! i + poss (AAsa__ ! i); \<forall>i<n__. AAsa__ ! i \<noteq> {#}; Some \<sigma>''__ = mgu (set_mset ` set (Map2.map2 add_mset Asa__ AAsa__)); eligible \<sigma>''__ Asa__ (D__ + negs (mset Asa__)); \<forall>i<n__. strictly_maximal_wrt (Asa__ ! i \<cdot>a \<sigma>''__) (Cs__ ! i \<cdot> \<sigma>''__); \<forall>i<n__. S (CAsa__ ! i) = {#}; CAs = CAsb__; DA = Da__ + negs (mset Asb__); AAs = AAsb__; As = Asb__; \<sigma>' = \<sigma>'''__; E' = (\<Sum>\<^sub># (mset Csa__) + Da__) \<cdot> \<sigma>'''__; length CAsb__ = na__; length Csa__ = na__; length AAsb__ = na__; length Asb__ = na__; na__ \<noteq> 0; \<forall>i<na__. CAsb__ ! i = Csa__ ! i + poss (AAsb__ ! i); \<forall>i<na__. AAsb__ ! i \<noteq> {#}; Some \<sigma>'''__ = mgu (set_mset ` set (Map2.map2 add_mset Asb__ AAsb__)); eligible \<sigma>'''__ Asb__ (Da__ + negs (mset Asb__)); \<forall>i<na__. strictly_maximal_wrt (Asb__ ! i \<cdot>a \<sigma>'''__) (Csa__ ! i \<cdot> \<sigma>'''__); \<forall>i<na__. S (CAsb__ ! i) = {#}; ord_resolve CAs DA AAs As \<sigma> E; ord_resolve CAs DA AAs As \<sigma>' E'\<rbrakk> \<Longrightarrow> E = E'
[PROOF STEP]
note res = this(1-17) and res' = this(18-34)
[PROOF STATE]
proof (state)
this:
CAs = CAs
DA = DA + negs (mset As)
AAs = AAs
As = As
\<sigma> = \<sigma>''
E = (\<Sum>\<^sub># (mset Cs) + DA) \<cdot> \<sigma>''
length CAs = n
length Cs = n
length AAs = n
length As = n
n \<noteq> 0
\<forall>i<n. CAs ! i = Cs ! i + poss (AAs ! i)
\<forall>i<n. AAs ! i \<noteq> {#}
Some \<sigma>'' = mgu (set_mset ` set (Map2.map2 add_mset As AAs))
eligible \<sigma>'' As (DA + negs (mset As))
\<forall>i<n. strictly_maximal_wrt (As ! i \<cdot>a \<sigma>'') (Cs ! i \<cdot> \<sigma>'')
\<forall>i<n. S (CAs ! i) = {#}
CAs = CAs'
DA = DA' + negs (mset As')
AAs = AAs'
As = As'
\<sigma>' = \<sigma>'''
E' = (\<Sum>\<^sub># (mset Cs') + DA') \<cdot> \<sigma>'''
length CAs' = n'
length Cs' = n'
length AAs' = n'
length As' = n'
n' \<noteq> 0
\<forall>i<n'. CAs' ! i = Cs' ! i + poss (AAs' ! i)
\<forall>i<n'. AAs' ! i \<noteq> {#}
Some \<sigma>''' = mgu (set_mset ` set (Map2.map2 add_mset As' AAs'))
eligible \<sigma>''' As' (DA' + negs (mset As'))
\<forall>i<n'. strictly_maximal_wrt (As' ! i \<cdot>a \<sigma>''') (Cs' ! i \<cdot> \<sigma>''')
\<forall>i<n'. S (CAs' ! i) = {#}

goal (2 subgoals):
 1. \<And>CAsa__ n__ Cs__ AAsa__ Asa__ \<sigma>''__ D__ CAsb__ na__ Csa__ AAsb__ Asb__ \<sigma>'''__ Da__. \<lbrakk>CAs = CAsa__; DA = D__ + negs (mset Asa__); AAs = AAsa__; As = Asa__; \<sigma> = \<sigma>''__; E = (\<Sum>\<^sub># (mset Cs__) + D__) \<cdot> \<sigma>''__; length CAsa__ = n__; length Cs__ = n__; length AAsa__ = n__; length Asa__ = n__; n__ \<noteq> 0; \<forall>i<n__. CAsa__ ! i = Cs__ ! i + poss (AAsa__ ! i); \<forall>i<n__. AAsa__ ! i \<noteq> {#}; Some \<sigma>''__ = mgu (set_mset ` set (Map2.map2 add_mset Asa__ AAsa__)); eligible \<sigma>''__ Asa__ (D__ + negs (mset Asa__)); \<forall>i<n__. strictly_maximal_wrt (Asa__ ! i \<cdot>a \<sigma>''__) (Cs__ ! i \<cdot> \<sigma>''__); \<forall>i<n__. S (CAsa__ ! i) = {#}; CAs = CAsb__; DA = Da__ + negs (mset Asb__); AAs = AAsb__; As = Asb__; \<sigma>' = \<sigma>'''__; E' = (\<Sum>\<^sub># (mset Csa__) + Da__) \<cdot> \<sigma>'''__; length CAsb__ = na__; length Csa__ = na__; length AAsb__ = na__; length Asb__ = na__; na__ \<noteq> 0; \<forall>i<na__. CAsb__ ! i = Csa__ ! i + poss (AAsb__ ! i); \<forall>i<na__. AAsb__ ! i \<noteq> {#}; Some \<sigma>'''__ = mgu (set_mset ` set (Map2.map2 add_mset Asb__ AAsb__)); eligible \<sigma>'''__ Asb__ (Da__ + negs (mset Asb__)); \<forall>i<na__. strictly_maximal_wrt (Asb__ ! i \<cdot>a \<sigma>'''__) (Csa__ ! i \<cdot> \<sigma>'''__); \<forall>i<na__. S (CAsb__ ! i) = {#}; ord_resolve CAs DA AAs As \<sigma> E; ord_resolve CAs DA AAs As \<sigma>' E'\<rbrakk> \<Longrightarrow> \<sigma> = \<sigma>'
 2. \<And>CAsa__ n__ Cs__ AAsa__ Asa__ \<sigma>''__ D__ CAsb__ na__ Csa__ AAsb__ Asb__ \<sigma>'''__ Da__. \<lbrakk>CAs = CAsa__; DA = D__ + negs (mset Asa__); AAs = AAsa__; As = Asa__; \<sigma> = \<sigma>''__; E = (\<Sum>\<^sub># (mset Cs__) + D__) \<cdot> \<sigma>''__; length CAsa__ = n__; length Cs__ = n__; length AAsa__ = n__; length Asa__ = n__; n__ \<noteq> 0; \<forall>i<n__. CAsa__ ! i = Cs__ ! i + poss (AAsa__ ! i); \<forall>i<n__. AAsa__ ! i \<noteq> {#}; Some \<sigma>''__ = mgu (set_mset ` set (Map2.map2 add_mset Asa__ AAsa__)); eligible \<sigma>''__ Asa__ (D__ + negs (mset Asa__)); \<forall>i<n__. strictly_maximal_wrt (Asa__ ! i \<cdot>a \<sigma>''__) (Cs__ ! i \<cdot> \<sigma>''__); \<forall>i<n__. S (CAsa__ ! i) = {#}; CAs = CAsb__; DA = Da__ + negs (mset Asb__); AAs = AAsb__; As = Asb__; \<sigma>' = \<sigma>'''__; E' = (\<Sum>\<^sub># (mset Csa__) + Da__) \<cdot> \<sigma>'''__; length CAsb__ = na__; length Csa__ = na__; length AAsb__ = na__; length Asb__ = na__; na__ \<noteq> 0; \<forall>i<na__. CAsb__ ! i = Csa__ ! i + poss (AAsb__ ! i); \<forall>i<na__. AAsb__ ! i \<noteq> {#}; Some \<sigma>'''__ = mgu (set_mset ` set (Map2.map2 add_mset Asb__ AAsb__)); eligible \<sigma>'''__ Asb__ (Da__ + negs (mset Asb__)); \<forall>i<na__. strictly_maximal_wrt (Asb__ ! i \<cdot>a \<sigma>'''__) (Csa__ ! i \<cdot> \<sigma>'''__); \<forall>i<na__. S (CAsb__ ! i) = {#}; ord_resolve CAs DA AAs As \<sigma> E; ord_resolve CAs DA AAs As \<sigma>' E'\<rbrakk> \<Longrightarrow> E = E'
[PROOF STEP]
show \<sigma>: "\<sigma> = \<sigma>'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<sigma> = \<sigma>'
[PROOF STEP]
using res(3-5,14) res'(3-5,14)
[PROOF STATE]
proof (prove)
using this:
AAs = AAs
As = As
\<sigma> = \<sigma>''
Some \<sigma>'' = mgu (set_mset ` set (Map2.map2 add_mset As AAs))
AAs = AAs'
As = As'
\<sigma>' = \<sigma>'''
Some \<sigma>''' = mgu (set_mset ` set (Map2.map2 add_mset As' AAs'))

goal (1 subgoal):
 1. \<sigma> = \<sigma>'
[PROOF STEP]
by (metis option.inject)
[PROOF STATE]
proof (state)
this:
\<sigma> = \<sigma>'

goal (1 subgoal):
 1. \<And>CAsa__ n__ Cs__ AAsa__ Asa__ \<sigma>''__ D__ CAsb__ na__ Csa__ AAsb__ Asb__ \<sigma>'''__ Da__. \<lbrakk>CAs = CAsa__; DA = D__ + negs (mset Asa__); AAs = AAsa__; As = Asa__; \<sigma> = \<sigma>''__; E = (\<Sum>\<^sub># (mset Cs__) + D__) \<cdot> \<sigma>''__; length CAsa__ = n__; length Cs__ = n__; length AAsa__ = n__; length Asa__ = n__; n__ \<noteq> 0; \<forall>i<n__. CAsa__ ! i = Cs__ ! i + poss (AAsa__ ! i); \<forall>i<n__. AAsa__ ! i \<noteq> {#}; Some \<sigma>''__ = mgu (set_mset ` set (Map2.map2 add_mset Asa__ AAsa__)); eligible \<sigma>''__ Asa__ (D__ + negs (mset Asa__)); \<forall>i<n__. strictly_maximal_wrt (Asa__ ! i \<cdot>a \<sigma>''__) (Cs__ ! i \<cdot> \<sigma>''__); \<forall>i<n__. S (CAsa__ ! i) = {#}; CAs = CAsb__; DA = Da__ + negs (mset Asb__); AAs = AAsb__; As = Asb__; \<sigma>' = \<sigma>'''__; E' = (\<Sum>\<^sub># (mset Csa__) + Da__) \<cdot> \<sigma>'''__; length CAsb__ = na__; length Csa__ = na__; length AAsb__ = na__; length Asb__ = na__; na__ \<noteq> 0; \<forall>i<na__. CAsb__ ! i = Csa__ ! i + poss (AAsb__ ! i); \<forall>i<na__. AAsb__ ! i \<noteq> {#}; Some \<sigma>'''__ = mgu (set_mset ` set (Map2.map2 add_mset Asb__ AAsb__)); eligible \<sigma>'''__ Asb__ (Da__ + negs (mset Asb__)); \<forall>i<na__. strictly_maximal_wrt (Asb__ ! i \<cdot>a \<sigma>'''__) (Csa__ ! i \<cdot> \<sigma>'''__); \<forall>i<na__. S (CAsb__ ! i) = {#}; ord_resolve CAs DA AAs As \<sigma> E; ord_resolve CAs DA AAs As \<sigma>' E'\<rbrakk> \<Longrightarrow> E = E'
[PROOF STEP]
have "Cs = Cs'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Cs = Cs'
[PROOF STEP]
using res(1,3,7,8,12) res'(1,3,7,8,12)
[PROOF STATE]
proof (prove)
using this:
CAs = CAs
AAs = AAs
length CAs = n
length Cs = n
\<forall>i<n. CAs ! i = Cs ! i + poss (AAs ! i)
CAs = CAs'
AAs = AAs'
length CAs' = n'
length Cs' = n'
\<forall>i<n'. CAs' ! i = Cs' ! i + poss (AAs' ! i)

goal (1 subgoal):
 1. Cs = Cs'
[PROOF STEP]
by (metis add_right_imp_eq nth_equalityI)
[PROOF STATE]
proof (state)
this:
Cs = Cs'

goal (1 subgoal):
 1. \<And>CAsa__ n__ Cs__ AAsa__ Asa__ \<sigma>''__ D__ CAsb__ na__ Csa__ AAsb__ Asb__ \<sigma>'''__ Da__. \<lbrakk>CAs = CAsa__; DA = D__ + negs (mset Asa__); AAs = AAsa__; As = Asa__; \<sigma> = \<sigma>''__; E = (\<Sum>\<^sub># (mset Cs__) + D__) \<cdot> \<sigma>''__; length CAsa__ = n__; length Cs__ = n__; length AAsa__ = n__; length Asa__ = n__; n__ \<noteq> 0; \<forall>i<n__. CAsa__ ! i = Cs__ ! i + poss (AAsa__ ! i); \<forall>i<n__. AAsa__ ! i \<noteq> {#}; Some \<sigma>''__ = mgu (set_mset ` set (Map2.map2 add_mset Asa__ AAsa__)); eligible \<sigma>''__ Asa__ (D__ + negs (mset Asa__)); \<forall>i<n__. strictly_maximal_wrt (Asa__ ! i \<cdot>a \<sigma>''__) (Cs__ ! i \<cdot> \<sigma>''__); \<forall>i<n__. S (CAsa__ ! i) = {#}; CAs = CAsb__; DA = Da__ + negs (mset Asb__); AAs = AAsb__; As = Asb__; \<sigma>' = \<sigma>'''__; E' = (\<Sum>\<^sub># (mset Csa__) + Da__) \<cdot> \<sigma>'''__; length CAsb__ = na__; length Csa__ = na__; length AAsb__ = na__; length Asb__ = na__; na__ \<noteq> 0; \<forall>i<na__. CAsb__ ! i = Csa__ ! i + poss (AAsb__ ! i); \<forall>i<na__. AAsb__ ! i \<noteq> {#}; Some \<sigma>'''__ = mgu (set_mset ` set (Map2.map2 add_mset Asb__ AAsb__)); eligible \<sigma>'''__ Asb__ (Da__ + negs (mset Asb__)); \<forall>i<na__. strictly_maximal_wrt (Asb__ ! i \<cdot>a \<sigma>'''__) (Csa__ ! i \<cdot> \<sigma>'''__); \<forall>i<na__. S (CAsb__ ! i) = {#}; ord_resolve CAs DA AAs As \<sigma> E; ord_resolve CAs DA AAs As \<sigma>' E'\<rbrakk> \<Longrightarrow> E = E'
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
Cs = Cs'

goal (1 subgoal):
 1. \<And>CAsa__ n__ Cs__ AAsa__ Asa__ \<sigma>''__ D__ CAsb__ na__ Csa__ AAsb__ Asb__ \<sigma>'''__ Da__. \<lbrakk>CAs = CAsa__; DA = D__ + negs (mset Asa__); AAs = AAsa__; As = Asa__; \<sigma> = \<sigma>''__; E = (\<Sum>\<^sub># (mset Cs__) + D__) \<cdot> \<sigma>''__; length CAsa__ = n__; length Cs__ = n__; length AAsa__ = n__; length Asa__ = n__; n__ \<noteq> 0; \<forall>i<n__. CAsa__ ! i = Cs__ ! i + poss (AAsa__ ! i); \<forall>i<n__. AAsa__ ! i \<noteq> {#}; Some \<sigma>''__ = mgu (set_mset ` set (Map2.map2 add_mset Asa__ AAsa__)); eligible \<sigma>''__ Asa__ (D__ + negs (mset Asa__)); \<forall>i<n__. strictly_maximal_wrt (Asa__ ! i \<cdot>a \<sigma>''__) (Cs__ ! i \<cdot> \<sigma>''__); \<forall>i<n__. S (CAsa__ ! i) = {#}; CAs = CAsb__; DA = Da__ + negs (mset Asb__); AAs = AAsb__; As = Asb__; \<sigma>' = \<sigma>'''__; E' = (\<Sum>\<^sub># (mset Csa__) + Da__) \<cdot> \<sigma>'''__; length CAsb__ = na__; length Csa__ = na__; length AAsb__ = na__; length Asb__ = na__; na__ \<noteq> 0; \<forall>i<na__. CAsb__ ! i = Csa__ ! i + poss (AAsb__ ! i); \<forall>i<na__. AAsb__ ! i \<noteq> {#}; Some \<sigma>'''__ = mgu (set_mset ` set (Map2.map2 add_mset Asb__ AAsb__)); eligible \<sigma>'''__ Asb__ (Da__ + negs (mset Asb__)); \<forall>i<na__. strictly_maximal_wrt (Asb__ ! i \<cdot>a \<sigma>'''__) (Csa__ ! i \<cdot> \<sigma>'''__); \<forall>i<na__. S (CAsb__ ! i) = {#}; ord_resolve CAs DA AAs As \<sigma> E; ord_resolve CAs DA AAs As \<sigma>' E'\<rbrakk> \<Longrightarrow> E = E'
[PROOF STEP]
have "DA = DA'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. DA = DA'
[PROOF STEP]
using res(2,4) res'(2,4)
[PROOF STATE]
proof (prove)
using this:
DA = DA + negs (mset As)
As = As
DA = DA' + negs (mset As')
As = As'

goal (1 subgoal):
 1. DA = DA'
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
DA = DA'

goal (1 subgoal):
 1. \<And>CAsa__ n__ Cs__ AAsa__ Asa__ \<sigma>''__ D__ CAsb__ na__ Csa__ AAsb__ Asb__ \<sigma>'''__ Da__. \<lbrakk>CAs = CAsa__; DA = D__ + negs (mset Asa__); AAs = AAsa__; As = Asa__; \<sigma> = \<sigma>''__; E = (\<Sum>\<^sub># (mset Cs__) + D__) \<cdot> \<sigma>''__; length CAsa__ = n__; length Cs__ = n__; length AAsa__ = n__; length Asa__ = n__; n__ \<noteq> 0; \<forall>i<n__. CAsa__ ! i = Cs__ ! i + poss (AAsa__ ! i); \<forall>i<n__. AAsa__ ! i \<noteq> {#}; Some \<sigma>''__ = mgu (set_mset ` set (Map2.map2 add_mset Asa__ AAsa__)); eligible \<sigma>''__ Asa__ (D__ + negs (mset Asa__)); \<forall>i<n__. strictly_maximal_wrt (Asa__ ! i \<cdot>a \<sigma>''__) (Cs__ ! i \<cdot> \<sigma>''__); \<forall>i<n__. S (CAsa__ ! i) = {#}; CAs = CAsb__; DA = Da__ + negs (mset Asb__); AAs = AAsb__; As = Asb__; \<sigma>' = \<sigma>'''__; E' = (\<Sum>\<^sub># (mset Csa__) + Da__) \<cdot> \<sigma>'''__; length CAsb__ = na__; length Csa__ = na__; length AAsb__ = na__; length Asb__ = na__; na__ \<noteq> 0; \<forall>i<na__. CAsb__ ! i = Csa__ ! i + poss (AAsb__ ! i); \<forall>i<na__. AAsb__ ! i \<noteq> {#}; Some \<sigma>'''__ = mgu (set_mset ` set (Map2.map2 add_mset Asb__ AAsb__)); eligible \<sigma>'''__ Asb__ (Da__ + negs (mset Asb__)); \<forall>i<na__. strictly_maximal_wrt (Asb__ ! i \<cdot>a \<sigma>'''__) (Csa__ ! i \<cdot> \<sigma>'''__); \<forall>i<na__. S (CAsb__ ! i) = {#}; ord_resolve CAs DA AAs As \<sigma> E; ord_resolve CAs DA AAs As \<sigma>' E'\<rbrakk> \<Longrightarrow> E = E'
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
Cs = Cs'
DA = DA'
[PROOF STEP]
show "E = E'"
[PROOF STATE]
proof (prove)
using this:
Cs = Cs'
DA = DA'

goal (1 subgoal):
 1. E = E'
[PROOF STEP]
using res(5,6) res'(5,6) \<sigma>
[PROOF STATE]
proof (prove)
using this:
Cs = Cs'
DA = DA'
\<sigma> = \<sigma>''
E = (\<Sum>\<^sub># (mset Cs) + DA) \<cdot> \<sigma>''
\<sigma>' = \<sigma>'''
E' = (\<Sum>\<^sub># (mset Cs') + DA') \<cdot> \<sigma>'''
\<sigma> = \<sigma>'

goal (1 subgoal):
 1. E = E'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
E = E'

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma call_instr_result: "(fst i) = call_type CALL \<Longrightarrow>
  snd (call_instr i s) = False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fst i = call_type CALL \<Longrightarrow> snd (call_instr i s) = False
[PROOF STEP]
apply (simp add: call_instr_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fst i = call_type CALL \<Longrightarrow> \<not> snd ((do curr_win \<leftarrow> get_curr_win ();
pc_val \<leftarrow> gets (cpu_reg_val PC);
npc_val \<leftarrow> gets (cpu_reg_val nPC);
y \<leftarrow> write_reg pc_val curr_win 15;
y \<leftarrow> write_cpu npc_val PC;
write_cpu (pc_val + (ucast (get_operand_w30 (snd i ! 0)) << 2)) nPC
od) s)
[PROOF STEP]
apply (simp add: simpler_gets_def bind_def h1_def h2_def case_prod_unfold)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fst i = call_type CALL \<Longrightarrow> \<not> snd (let fs = get_curr_win () s; v = let p = fst fs; fs = write_reg (cpu_reg_val PC (snd p)) (fst p) 15 (snd p); v = let fs = write_cpu (cpu_reg_val nPC (snd p)) PC (snd (fst fs)); v = write_cpu (cpu_reg_val PC (snd p) + (ucast (get_operand_w30 (snd i ! 0)) << 2)) nPC (snd (fst fs)) in (fst v, snd v \<or> snd fs) in (fst v, snd v \<or> snd fs) in (fst v, snd v \<or> snd fs))
[PROOF STEP]
apply (simp add: write_cpu_def write_reg_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fst i = call_type CALL \<Longrightarrow> \<not> snd (let fs = get_curr_win () s; v = let p = fst fs; fs = modify (user_reg_mod (cpu_reg_val PC (snd p)) (fst p) 15) (snd p); v = let fs = modify (cpu_reg_mod (cpu_reg_val nPC (snd p)) PC) (snd (fst fs)); v = modify (cpu_reg_mod (cpu_reg_val PC (snd p) + (ucast (get_operand_w30 (snd i ! 0)) << 2)) nPC) (snd (fst fs)) in (fst v, snd v \<or> snd fs) in (fst v, snd v \<or> snd fs) in (fst v, snd v \<or> snd fs))
[PROOF STEP]
apply (simp add: get_curr_win_def get_CWP_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fst i = call_type CALL \<Longrightarrow> \<not> snd (let fs = gets (\<lambda>s. ucast (ucast (cpu_reg_val PSR s AND 31))) s; v = let p = fst fs; fs = modify (user_reg_mod (cpu_reg_val PC (snd p)) (fst p) 15) (snd p); v = let fs = modify (cpu_reg_mod (cpu_reg_val nPC (snd p)) PC) (snd (fst fs)); v = modify (cpu_reg_mod (cpu_reg_val PC (snd p) + (ucast (get_operand_w30 (snd i ! 0)) << 2)) nPC) (snd (fst fs)) in (fst v, snd v \<or> snd fs) in (fst v, snd v \<or> snd fs) in (fst v, snd v \<or> snd fs))
[PROOF STEP]
by (simp add: simpler_modify_def simpler_gets_def)


[STATEMENT]
lemma delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M_ptr_in_heap:
  assumes "h \<turnstile> delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M shadow_root_ptr \<rightarrow>\<^sub>h h'"
  shows "shadow_root_ptr |\<in>| shadow_root_ptr_kinds h"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. shadow_root_ptr |\<in>| shadow_root_ptr_kinds h
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
h \<turnstile> delete_M shadow_root_ptr \<rightarrow>\<^sub>h h'

goal (1 subgoal):
 1. shadow_root_ptr |\<in>| shadow_root_ptr_kinds h
[PROOF STEP]
by(auto simp add: delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M_def delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_def delete\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t_def split: if_splits)


[STATEMENT]
lemma a_consistent_app\<^sub>2:
  assumes "a_consistent (ae, a, as) (\<Gamma>, (Lam [y]. e), Arg x # S)"
  shows "a_consistent (ae, (pred\<cdot>a), as) (\<Gamma>, e[y::=x], S)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
have "Aexp (e[y::=x])\<cdot>(pred\<cdot>a) f|` (domA \<Gamma> \<union> upds S)  \<sqsubseteq> (env_delete y ((Aexp e)\<cdot>(pred\<cdot>a)) \<squnion> esing x\<cdot>(up\<cdot>0)) f|` (domA \<Gamma> \<union> upds S)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<A>\<^bsub>pred\<cdot>a\<^esub> e[y::=x] f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> (env_delete y (\<A>\<^bsub>pred\<cdot>a\<^esub> e) \<squnion> esing x\<cdot>(up\<cdot>0)) f|` (domA \<Gamma> \<union> upds S)
[PROOF STEP]
by (rule env_restr_mono[OF Aexp_subst])
[PROOF STATE]
proof (state)
this:
\<A>\<^bsub>pred\<cdot>a\<^esub> e[y::=x] f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> (env_delete y (\<A>\<^bsub>pred\<cdot>a\<^esub> e) \<squnion> esing x\<cdot>(up\<cdot>0)) f|` (domA \<Gamma> \<union> upds S)

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<A>\<^bsub>pred\<cdot>a\<^esub> e[y::=x] f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> (env_delete y (\<A>\<^bsub>pred\<cdot>a\<^esub> e) \<squnion> esing x\<cdot>(up\<cdot>0)) f|` (domA \<Gamma> \<union> upds S)

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
have "\<dots> =  env_delete y ((Aexp e)\<cdot>(pred\<cdot>a)) f|` (domA \<Gamma> \<union> upds S) \<squnion> esing x\<cdot>(up\<cdot>0) f|` (domA \<Gamma> \<union> upds S)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (env_delete y (\<A>\<^bsub>pred\<cdot>a\<^esub> e) \<squnion> esing x\<cdot>(up\<cdot>0)) f|` (domA \<Gamma> \<union> upds S) = env_delete y (\<A>\<^bsub>pred\<cdot>a\<^esub> e) f|` (domA \<Gamma> \<union> upds S) \<squnion> esing x\<cdot>(up\<cdot>0) f|` (domA \<Gamma> \<union> upds S)
[PROOF STEP]
by (simp add: env_restr_join)
[PROOF STATE]
proof (state)
this:
(env_delete y (\<A>\<^bsub>pred\<cdot>a\<^esub> e) \<squnion> esing x\<cdot>(up\<cdot>0)) f|` (domA \<Gamma> \<union> upds S) = env_delete y (\<A>\<^bsub>pred\<cdot>a\<^esub> e) f|` (domA \<Gamma> \<union> upds S) \<squnion> esing x\<cdot>(up\<cdot>0) f|` (domA \<Gamma> \<union> upds S)

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(env_delete y (\<A>\<^bsub>pred\<cdot>a\<^esub> e) \<squnion> esing x\<cdot>(up\<cdot>0)) f|` (domA \<Gamma> \<union> upds S) = env_delete y (\<A>\<^bsub>pred\<cdot>a\<^esub> e) f|` (domA \<Gamma> \<union> upds S) \<squnion> esing x\<cdot>(up\<cdot>0) f|` (domA \<Gamma> \<union> upds S)

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
have "env_delete y ((Aexp e)\<cdot>(pred\<cdot>a)) \<sqsubseteq> Aexp (Lam [y]. e)\<cdot>a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. env_delete y (\<A>\<^bsub>pred\<cdot>a\<^esub> e) \<sqsubseteq> \<A>\<^bsub>a\<^esub> (Lam [y]. e)
[PROOF STEP]
by (rule Aexp_Lam)
[PROOF STATE]
proof (state)
this:
env_delete y (\<A>\<^bsub>pred\<cdot>a\<^esub> e) \<sqsubseteq> \<A>\<^bsub>a\<^esub> (Lam [y]. e)

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
env_delete y (\<A>\<^bsub>pred\<cdot>a\<^esub> e) \<sqsubseteq> \<A>\<^bsub>a\<^esub> (Lam [y]. e)

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
have "\<dots> f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<A>\<^bsub>a\<^esub> (Lam [y]. e) f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
a_consistent (ae, a, as) (\<Gamma>, Lam [y]. e, Arg x # S)

goal (1 subgoal):
 1. \<A>\<^bsub>a\<^esub> (Lam [y]. e) f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae
[PROOF STEP]
by (auto simp add: join_below_iff env_restr_join a_consistent.simps)
[PROOF STATE]
proof (state)
this:
\<A>\<^bsub>a\<^esub> (Lam [y]. e) f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<A>\<^bsub>a\<^esub> (Lam [y]. e) f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
have "esing x\<cdot>(up\<cdot>0) f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. esing x\<cdot>(up\<cdot>0) f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
a_consistent (ae, a, as) (\<Gamma>, Lam [y]. e, Arg x # S)

goal (1 subgoal):
 1. esing x\<cdot>(up\<cdot>0) f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae
[PROOF STEP]
by (cases "x\<in>edom ae") (auto simp add: env_restr_join join_below_iff a_consistent.simps)
[PROOF STATE]
proof (state)
this:
esing x\<cdot>(up\<cdot>0) f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
esing x\<cdot>(up\<cdot>0) f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
have "ae \<squnion> ae = ae"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ae \<squnion> ae = ae
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
ae \<squnion> ae = ae

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>cont (\<lambda>a. a f|` (domA \<Gamma> \<union> upds S) \<squnion> esing x\<cdot>(up\<cdot>0) f|` (domA \<Gamma> \<union> upds S)); cont (\<lambda>a. a \<squnion> esing x\<cdot>(up\<cdot>0) f|` (domA \<Gamma> \<union> upds S)); cont ((\<squnion>) ae)\<rbrakk> \<Longrightarrow> \<A>\<^bsub>pred\<cdot>a\<^esub> e[y::=x] f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae
[PROOF STEP]
have "Aexp (e[y::=x])\<cdot>(pred\<cdot>a) f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>cont (\<lambda>a. a f|` (domA \<Gamma> \<union> upds S) \<squnion> esing x\<cdot>(up\<cdot>0) f|` (domA \<Gamma> \<union> upds S)); cont (\<lambda>a. a \<squnion> esing x\<cdot>(up\<cdot>0) f|` (domA \<Gamma> \<union> upds S)); cont ((\<squnion>) ae)\<rbrakk> \<Longrightarrow> \<A>\<^bsub>pred\<cdot>a\<^esub> e[y::=x] f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae

goal (1 subgoal):
 1. \<A>\<^bsub>pred\<cdot>a\<^esub> e[y::=x] f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae
[PROOF STEP]
by this simp_all
[PROOF STATE]
proof (state)
this:
\<A>\<^bsub>pred\<cdot>a\<^esub> e[y::=x] f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<A>\<^bsub>pred\<cdot>a\<^esub> e[y::=x] f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
\<A>\<^bsub>pred\<cdot>a\<^esub> e[y::=x] f|` (domA \<Gamma> \<union> upds S) \<sqsubseteq> ae
a_consistent (ae, a, as) (\<Gamma>, Lam [y]. e, Arg x # S)

goal (1 subgoal):
 1. a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)
[PROOF STEP]
by (auto elim: below_trans edom_mono  simp add: join_below_iff env_restr_join a_consistent.simps)
[PROOF STATE]
proof (state)
this:
a_consistent (ae, pred\<cdot>a, as) (\<Gamma>, e[y::=x], S)

goal:
No subgoals!
[PROOF STEP]
qed