[STATEMENT]
lemma (in sigma_finite_measure) RN_deriv_finite:
  assumes N: "sigma_finite_measure N" and ac: "absolutely_continuous M N" "sets N = sets M"
  shows "AE x in M. RN_deriv M N x \<noteq> \<infinity>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. AE x in M. RN_deriv M N x \<noteq> \<infinity>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. AE x in M. RN_deriv M N x \<noteq> \<infinity>
[PROOF STEP]
interpret N: sigma_finite_measure N
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sigma_finite_measure N
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. AE x in M. RN_deriv M N x \<noteq> \<infinity>
[PROOF STEP]
from N
[PROOF STATE]
proof (chain)
picking this:
sigma_finite_measure N
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
sigma_finite_measure N

goal (1 subgoal):
 1. AE x in M. RN_deriv M N x \<noteq> \<infinity>
[PROOF STEP]
using sigma_finite_iff_density_finite[OF borel_measurable_RN_deriv, of N] density_RN_deriv[OF ac]
[PROOF STATE]
proof (prove)
using this:
sigma_finite_measure N
sigma_finite_measure (density M (RN_deriv M N)) = (AE x in M. RN_deriv M N x \<noteq> \<infinity>)
density M (RN_deriv M N) = N

goal (1 subgoal):
 1. AE x in M. RN_deriv M N x \<noteq> \<infinity>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
AE x in M. RN_deriv M N x \<noteq> \<infinity>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma map_of_zip_is_Some:
  assumes "length xs = length ys"
  shows "x \<in> set xs \<longleftrightarrow> (\<exists>y. map_of (zip xs ys) x = Some y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x \<in> set xs) = (\<exists>y. map_of (zip xs ys) x = Some y)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
length xs = length ys

goal (1 subgoal):
 1. (x \<in> set xs) = (\<exists>y. map_of (zip xs ys) x = Some y)
[PROOF STEP]
by (induct rule: list_induct2) simp_all


[STATEMENT]
theorem SubstFormP_Disj:
  "{SubstFormP v i x x', SubstFormP v i y y'} \<turnstile> SubstFormP v i (Q_Disj x y) (Q_Disj x' y')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {SubstFormP v i x x', SubstFormP v i y y'} \<turnstile> SubstFormP v i (Q_Disj x y) (Q_Disj x' y')
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. {SubstFormP v i x x', SubstFormP v i y y'} \<turnstile> SubstFormP v i (Q_Disj x y) (Q_Disj x' y')
[PROOF STEP]
obtain k1::name and s1::name and k2::name and s2::name and k::name and s::name
    where "atom s1 \<sharp> (v,i,x,y,x',y')"        "atom k1 \<sharp> (v,i,x,y,x',y',s1)"
          "atom s2 \<sharp> (v,i,x,y,x',y',k1,s1)"  "atom k2 \<sharp> (v,i,x,y,x',y',s2,k1,s1)"
          "atom s  \<sharp> (v,i,x,y,x',y',k2,s2,k1,s1)" "atom k  \<sharp> (v,i,x,y,x',y',s,k2,s2,k1,s1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>s1 k1 s2 k2 s k. \<lbrakk>atom s1 \<sharp> (v, i, x, y, x', y'); atom k1 \<sharp> (v, i, x, y, x', y', s1); atom s2 \<sharp> (v, i, x, y, x', y', k1, s1); atom k2 \<sharp> (v, i, x, y, x', y', s2, k1, s1); atom s \<sharp> (v, i, x, y, x', y', k2, s2, k1, s1); atom k \<sharp> (v, i, x, y, x', y', s, k2, s2, k1, s1)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis obtain_fresh)
[PROOF STATE]
proof (state)
this:
atom s1 \<sharp> (v, i, x, y, x', y')
atom k1 \<sharp> (v, i, x, y, x', y', s1)
atom s2 \<sharp> (v, i, x, y, x', y', k1, s1)
atom k2 \<sharp> (v, i, x, y, x', y', s2, k1, s1)
atom s \<sharp> (v, i, x, y, x', y', k2, s2, k1, s1)
atom k \<sharp> (v, i, x, y, x', y', s, k2, s2, k1, s1)

goal (1 subgoal):
 1. {SubstFormP v i x x', SubstFormP v i y y'} \<turnstile> SubstFormP v i (Q_Disj x y) (Q_Disj x' y')
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
atom s1 \<sharp> (v, i, x, y, x', y')
atom k1 \<sharp> (v, i, x, y, x', y', s1)
atom s2 \<sharp> (v, i, x, y, x', y', k1, s1)
atom k2 \<sharp> (v, i, x, y, x', y', s2, k1, s1)
atom s \<sharp> (v, i, x, y, x', y', k2, s2, k1, s1)
atom k \<sharp> (v, i, x, y, x', y', s, k2, s2, k1, s1)

goal (1 subgoal):
 1. {SubstFormP v i x x', SubstFormP v i y y'} \<turnstile> SubstFormP v i (Q_Disj x y) (Q_Disj x' y')
[PROOF STEP]
by (force simp: SubstFormP.simps [of s v i "Q_Disj x y" _ k]
                     SubstFormP.simps [of s1 v i x x' k1]
                     SubstFormP.simps [of s2 v i y y' k2]
               intro: SeqSubstFormP_Disj [THEN cut4])
[PROOF STATE]
proof (state)
this:
{SubstFormP v i x x', SubstFormP v i y y'} \<turnstile> SubstFormP v i (Q_Disj x y) (Q_Disj x' y')

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma UN_space_closed: "\<Union>(sets ` S) \<subseteq> Pow (\<Union>(space ` S))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Union> (sets ` S) \<subseteq> Pow (\<Union> (space ` S))
[PROOF STEP]
using sets.space_closed
[PROOF STATE]
proof (prove)
using this:
sets ?M \<subseteq> Pow (space ?M)

goal (1 subgoal):
 1. \<Union> (sets ` S) \<subseteq> Pow (\<Union> (space ` S))
[PROOF STEP]
by auto


[STATEMENT]
lemma scaler_column_fst_QR_decomposition:
  fixes A::"real^'n::{mod_type}^'m::{mod_type}"
  assumes i: "i>j"
  and r: "rank A = ncols A"
  shows "column i (fst (QR_decomposition A)) \<bullet> column j A = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> column j A = 0
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> column j A = 0
[PROOF STEP]
have "column i (fst(QR_decomposition A)) \<bullet> column j A
    = column i (fst (QR_decomposition A)) \<bullet> (\<Sum>x\<in>{column i (fst (QR_decomposition A))|i. i \<le> j}. (x \<bullet> (column j A)) *\<^sub>R x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> column j A = column i (fst (QR_decomposition A)) \<bullet> (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. (x \<bullet> column j A) *\<^sub>R x)
[PROOF STEP]
using column_QR_decomposition2[OF r]
[PROOF STATE]
proof (prove)
using this:
column ?k A = (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> ?k}. (x \<bullet> column ?k A) *\<^sub>R x)

goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> column j A = column i (fst (QR_decomposition A)) \<bullet> (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. (x \<bullet> column j A) *\<^sub>R x)
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
column i (fst (QR_decomposition A)) \<bullet> column j A = column i (fst (QR_decomposition A)) \<bullet> (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. (x \<bullet> column j A) *\<^sub>R x)

goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> column j A = 0
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
column i (fst (QR_decomposition A)) \<bullet> column j A = column i (fst (QR_decomposition A)) \<bullet> (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. (x \<bullet> column j A) *\<^sub>R x)

goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> column j A = 0
[PROOF STEP]
have "... = (\<Sum>x\<in>{column i (fst (QR_decomposition A))|i. i \<le> j}.
    column i (fst (QR_decomposition A)) \<bullet> (x \<bullet> (column j A)) *\<^sub>R x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. (x \<bullet> column j A) *\<^sub>R x) = (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. column i (fst (QR_decomposition A)) \<bullet> (x \<bullet> column j A) *\<^sub>R x)
[PROOF STEP]
unfolding real_inner_class.inner_sum_right
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>y\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. column i (fst (QR_decomposition A)) \<bullet> (y \<bullet> column j A) *\<^sub>R y) = (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. column i (fst (QR_decomposition A)) \<bullet> (x \<bullet> column j A) *\<^sub>R x)
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
column i (fst (QR_decomposition A)) \<bullet> (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. (x \<bullet> column j A) *\<^sub>R x) = (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. column i (fst (QR_decomposition A)) \<bullet> (x \<bullet> column j A) *\<^sub>R x)

goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> column j A = 0
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
column i (fst (QR_decomposition A)) \<bullet> (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. (x \<bullet> column j A) *\<^sub>R x) = (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. column i (fst (QR_decomposition A)) \<bullet> (x \<bullet> column j A) *\<^sub>R x)

goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> column j A = 0
[PROOF STEP]
have "... = (\<Sum>x\<in>{column i (fst (QR_decomposition A))|i. i \<le> j}.
    (x \<bullet> (column j A)) *(column i (fst (QR_decomposition A)) \<bullet> x))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. column i (fst (QR_decomposition A)) \<bullet> (x \<bullet> column j A) *\<^sub>R x) = (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. x \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> x))
[PROOF STEP]
unfolding real_inner_class.inner_scaleR_right
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. x \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> x)) = (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. x \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> x))
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
(\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. column i (fst (QR_decomposition A)) \<bullet> (x \<bullet> column j A) *\<^sub>R x) = (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. x \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> x))

goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> column j A = 0
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. column i (fst (QR_decomposition A)) \<bullet> (x \<bullet> column j A) *\<^sub>R x) = (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. x \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> x))

goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> column j A = 0
[PROOF STEP]
have "... = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. x \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> x)) = 0
[PROOF STEP]
proof (rule sum.neutral, clarify)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x ia. ia \<le> j \<Longrightarrow> column ia (fst (QR_decomposition A)) \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> column ia (fst (QR_decomposition A))) = 0
[PROOF STEP]
fix ia
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x ia. ia \<le> j \<Longrightarrow> column ia (fst (QR_decomposition A)) \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> column ia (fst (QR_decomposition A))) = 0
[PROOF STEP]
assume ia: "ia \<le> j"
[PROOF STATE]
proof (state)
this:
ia \<le> j

goal (1 subgoal):
 1. \<And>x ia. ia \<le> j \<Longrightarrow> column ia (fst (QR_decomposition A)) \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> column ia (fst (QR_decomposition A))) = 0
[PROOF STEP]
have i_not_ia: "i \<noteq> ia"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. i \<noteq> ia
[PROOF STEP]
using i ia
[PROOF STATE]
proof (prove)
using this:
j < i
ia \<le> j

goal (1 subgoal):
 1. i \<noteq> ia
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
i \<noteq> ia

goal (1 subgoal):
 1. \<And>x ia. ia \<le> j \<Longrightarrow> column ia (fst (QR_decomposition A)) \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> column ia (fst (QR_decomposition A))) = 0
[PROOF STEP]
hence "(column i (fst (QR_decomposition A)) \<noteq> column ia (fst (QR_decomposition A)))"
[PROOF STATE]
proof (prove)
using this:
i \<noteq> ia

goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<noteq> column ia (fst (QR_decomposition A))
[PROOF STEP]
by (metis column_eq_fst_QR_decomposition r)
[PROOF STATE]
proof (state)
this:
column i (fst (QR_decomposition A)) \<noteq> column ia (fst (QR_decomposition A))

goal (1 subgoal):
 1. \<And>x ia. ia \<le> j \<Longrightarrow> column ia (fst (QR_decomposition A)) \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> column ia (fst (QR_decomposition A))) = 0
[PROOF STEP]
hence "(column i (fst (QR_decomposition A)) \<bullet> column ia (fst (QR_decomposition A))) = 0"
[PROOF STATE]
proof (prove)
using this:
column i (fst (QR_decomposition A)) \<noteq> column ia (fst (QR_decomposition A))

goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> column ia (fst (QR_decomposition A)) = 0
[PROOF STEP]
by (rule orthogonal_columns_fst_QR_decomposition)
[PROOF STATE]
proof (state)
this:
column i (fst (QR_decomposition A)) \<bullet> column ia (fst (QR_decomposition A)) = 0

goal (1 subgoal):
 1. \<And>x ia. ia \<le> j \<Longrightarrow> column ia (fst (QR_decomposition A)) \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> column ia (fst (QR_decomposition A))) = 0
[PROOF STEP]
thus "column ia (fst (QR_decomposition A)) \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> column ia (fst (QR_decomposition A))) = 0"
[PROOF STATE]
proof (prove)
using this:
column i (fst (QR_decomposition A)) \<bullet> column ia (fst (QR_decomposition A)) = 0

goal (1 subgoal):
 1. column ia (fst (QR_decomposition A)) \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> column ia (fst (QR_decomposition A))) = 0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
column ia (fst (QR_decomposition A)) \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> column ia (fst (QR_decomposition A))) = 0

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<Sum>x\<in>{column i (fst (QR_decomposition A)) |i. i \<le> j}. x \<bullet> column j A * (column i (fst (QR_decomposition A)) \<bullet> x)) = 0

goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> column j A = 0
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
column i (fst (QR_decomposition A)) \<bullet> column j A = 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
column i (fst (QR_decomposition A)) \<bullet> column j A = 0

goal (1 subgoal):
 1. column i (fst (QR_decomposition A)) \<bullet> column j A = 0
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
column i (fst (QR_decomposition A)) \<bullet> column j A = 0

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma sort_map_perm:
  fixes f :: "nat \<Rightarrow> 'b :: linorder"
  shows "image_mset (sort_map f n) (mset [0..<n]) = image_mset f (mset [0..<n])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. image_mset (sort_map f n) (mset [0..<n]) = image_mset f (mset [0..<n])
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. image_mset (sort_map f n) (mset [0..<n]) = image_mset f (mset [0..<n])
[PROOF STEP]
define is_swap where "is_swap = (\<lambda>(ts :: ((nat \<Rightarrow> 'b) \<Rightarrow> nat \<Rightarrow> 'b)). \<exists>i < n. \<exists>j < n. ts = sort_primitive i j)"
[PROOF STATE]
proof (state)
this:
is_swap = (\<lambda>ts. \<exists>i<n. \<exists>j<n. ts = sort_primitive i j)

goal (1 subgoal):
 1. image_mset (sort_map f n) (mset [0..<n]) = image_mset f (mset [0..<n])
[PROOF STEP]
define t :: "((nat \<Rightarrow> 'b) \<Rightarrow> nat \<Rightarrow> 'b) list"
    where "t = [sort_primitive j i. i <- [0..<n], j <- [0..<i]]"
[PROOF STATE]
proof (state)
this:
t = concat (map (\<lambda>i. map (\<lambda>j. sort_primitive j i) [0..<i]) [0..<n])

goal (1 subgoal):
 1. image_mset (sort_map f n) (mset [0..<n]) = image_mset f (mset [0..<n])
[PROOF STEP]
have a: "\<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
fix x
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
fix f :: "nat \<Rightarrow> 'b :: linorder"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
assume "is_swap x"
[PROOF STATE]
proof (state)
this:
is_swap x

goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
is_swap x
[PROOF STEP]
obtain i j where x_def: "x = sort_primitive i j" and i_bound: "i < n" and j_bound:"j < n"
[PROOF STATE]
proof (prove)
using this:
is_swap x

goal (1 subgoal):
 1. (\<And>i j. \<lbrakk>x = sort_primitive i j; i < n; j < n\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using is_swap_def
[PROOF STATE]
proof (prove)
using this:
is_swap x
is_swap = (\<lambda>ts. \<exists>i<n. \<exists>j<n. ts = sort_primitive i j)

goal (1 subgoal):
 1. (\<And>i j. \<lbrakk>x = sort_primitive i j; i < n; j < n\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
x = sort_primitive i j
i < n
j < n

goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
define inv where "inv = mset_set {k. k < n \<and> k \<noteq> i \<and> k \<noteq> j}"
[PROOF STATE]
proof (state)
this:
inv = mset_set {k. k < n \<and> k \<noteq> i \<and> k \<noteq> j}

goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
have b:"{0..<n} = {k. k < n \<and> k \<noteq> i \<and> k \<noteq> j} \<union> {i,j}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {0..<n} = {k. k < n \<and> k \<noteq> i \<and> k \<noteq> j} \<union> {i, j}
[PROOF STEP]
apply (rule order_antisym, rule subsetI, simp, blast, rule subsetI, simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. x = i \<or> x = j \<or> x < n \<and> x \<noteq> i \<and> x \<noteq> j \<Longrightarrow> x < n
[PROOF STEP]
using i_bound j_bound
[PROOF STATE]
proof (prove)
using this:
i < n
j < n

goal (1 subgoal):
 1. \<And>x. x = i \<or> x = j \<or> x < n \<and> x \<noteq> i \<and> x \<noteq> j \<Longrightarrow> x < n
[PROOF STEP]
by meson
[PROOF STATE]
proof (state)
this:
{0..<n} = {k. k < n \<and> k \<noteq> i \<and> k \<noteq> j} \<union> {i, j}

goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
have c:"\<And>k. k \<in># inv \<Longrightarrow> (x f) k = f k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>k. k \<in># inv \<Longrightarrow> x f k = f k
[PROOF STEP]
by (simp add:x_def inv_def)
[PROOF STATE]
proof (state)
this:
?k \<in># inv \<Longrightarrow> x f ?k = f ?k

goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
have "image_mset (x f) inv = image_mset f inv"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. image_mset (x f) inv = image_mset f inv
[PROOF STEP]
apply (rule multiset_eqI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xa. count (image_mset (x f) inv) xa = count (image_mset f inv) xa
[PROOF STEP]
using c multiset.map_cong0
[PROOF STATE]
proof (prove)
using this:
?k \<in># inv \<Longrightarrow> x f ?k = f ?k
(\<And>z. z \<in># ?x \<Longrightarrow> ?f z = ?g z) \<Longrightarrow> image_mset ?f ?x = image_mset ?g ?x

goal (1 subgoal):
 1. \<And>xa. count (image_mset (x f) inv) xa = count (image_mset f inv) xa
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
image_mset (x f) inv = image_mset f inv

goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
image_mset (x f) inv = image_mset f inv

goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
have "image_mset (x f) (mset_set {i,j}) = image_mset f (mset_set {i,j})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. image_mset (x f) (mset_set {i, j}) = image_mset f (mset_set {i, j})
[PROOF STEP]
apply (cases "i = j")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. i = j \<Longrightarrow> image_mset (x f) (mset_set {i, j}) = image_mset f (mset_set {i, j})
 2. i \<noteq> j \<Longrightarrow> image_mset (x f) (mset_set {i, j}) = image_mset f (mset_set {i, j})
[PROOF STEP]
by (simp add:x_def max_def min_def)+
[PROOF STATE]
proof (state)
this:
image_mset (x f) (mset_set {i, j}) = image_mset f (mset_set {i, j})

goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
image_mset (x f) (mset_set {i, j}) = image_mset f (mset_set {i, j})

goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
have "mset_set {0..<n} = inv + mset_set {i,j}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mset_set {0..<n} = inv + mset_set {i, j}
[PROOF STEP]
by (simp only:inv_def b, rule mset_set_Union, simp, simp, simp)
[PROOF STATE]
proof (state)
this:
mset_set {0..<n} = inv + mset_set {i, j}

goal (1 subgoal):
 1. \<And>x f. is_swap x \<Longrightarrow> image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
image_mset (x f) inv = image_mset f inv
image_mset (x f) (mset_set {i, j}) = image_mset f (mset_set {i, j})
mset_set {0..<n} = inv + mset_set {i, j}
[PROOF STEP]
show "image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})"
[PROOF STATE]
proof (prove)
using this:
image_mset (x f) inv = image_mset f inv
image_mset (x f) (mset_set {i, j}) = image_mset f (mset_set {i, j})
mset_set {0..<n} = inv + mset_set {i, j}

goal (1 subgoal):
 1. image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
image_mset (x f) (mset_set {0..<n}) = image_mset f (mset_set {0..<n})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
is_swap ?x \<Longrightarrow> image_mset (?x ?f) (mset_set {0..<n}) = image_mset ?f (mset_set {0..<n})

goal (1 subgoal):
 1. image_mset (sort_map f n) (mset [0..<n]) = image_mset f (mset [0..<n])
[PROOF STEP]
have "(\<forall>x \<in> set t. is_swap x) \<Longrightarrow> image_mset (fold id t f) (mset [0..<n]) = image_mset f (mset [0..<n])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>set t. is_swap x \<Longrightarrow> image_mset (fold id t f) (mset [0..<n]) = image_mset f (mset [0..<n])
[PROOF STEP]
by (induction t arbitrary:f, simp, simp add:a)
[PROOF STATE]
proof (state)
this:
\<forall>x\<in>set t. is_swap x \<Longrightarrow> image_mset (fold id t f) (mset [0..<n]) = image_mset f (mset [0..<n])

goal (1 subgoal):
 1. image_mset (sort_map f n) (mset [0..<n]) = image_mset f (mset [0..<n])
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>x\<in>set t. is_swap x \<Longrightarrow> image_mset (fold id t f) (mset [0..<n]) = image_mset f (mset [0..<n])

goal (1 subgoal):
 1. image_mset (sort_map f n) (mset [0..<n]) = image_mset f (mset [0..<n])
[PROOF STEP]
have "\<And>x. x \<in> set t \<Longrightarrow> is_swap x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. x \<in> set t \<Longrightarrow> is_swap x
[PROOF STEP]
apply (simp add:t_def is_swap_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<exists>xa\<in>{0..<n}. x \<in> (\<lambda>x. sort_primitive x xa) ` {0..<xa} \<Longrightarrow> \<exists>i<n. \<exists>j<n. x = sort_primitive i j
[PROOF STEP]
by (meson atLeastLessThan_iff imageE less_imp_le less_le_trans)
[PROOF STATE]
proof (state)
this:
?x \<in> set t \<Longrightarrow> is_swap ?x

goal (1 subgoal):
 1. image_mset (sort_map f n) (mset [0..<n]) = image_mset f (mset [0..<n])
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<forall>x\<in>set t. is_swap x \<Longrightarrow> image_mset (fold id t f) (mset [0..<n]) = image_mset f (mset [0..<n])
?x \<in> set t \<Longrightarrow> is_swap ?x
[PROOF STEP]
have "image_mset (fold id t f) (mset [0..<n]) = image_mset f (mset [0..<n])"
[PROOF STATE]
proof (prove)
using this:
\<forall>x\<in>set t. is_swap x \<Longrightarrow> image_mset (fold id t f) (mset [0..<n]) = image_mset f (mset [0..<n])
?x \<in> set t \<Longrightarrow> is_swap ?x

goal (1 subgoal):
 1. image_mset (fold id t f) (mset [0..<n]) = image_mset f (mset [0..<n])
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
image_mset (fold id t f) (mset [0..<n]) = image_mset f (mset [0..<n])

goal (1 subgoal):
 1. image_mset (sort_map f n) (mset [0..<n]) = image_mset f (mset [0..<n])
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
image_mset (fold id t f) (mset [0..<n]) = image_mset f (mset [0..<n])
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
image_mset (fold id t f) (mset [0..<n]) = image_mset f (mset [0..<n])

goal (1 subgoal):
 1. image_mset (sort_map f n) (mset [0..<n]) = image_mset f (mset [0..<n])
[PROOF STEP]
by (simp add:t_def)
[PROOF STATE]
proof (state)
this:
image_mset (sort_map f n) (mset [0..<n]) = image_mset f (mset [0..<n])

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma le_of_int_ceiling [simp]: "x \<le> of_int \<lceil>x\<rceil>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<le> of_int \<lceil>x\<rceil>
[PROOF STEP]
using ceiling_correct
[PROOF STATE]
proof (prove)
using this:
of_int \<lceil>?x\<rceil> - (1::?'a) < ?x \<and> ?x \<le> of_int \<lceil>?x\<rceil>

goal (1 subgoal):
 1. x \<le> of_int \<lceil>x\<rceil>
[PROOF STEP]
..


[STATEMENT]
lemma iia_f_idem:
  assumes "f_range_on A f"
  assumes "iia_on A f"
  assumes "B \<subseteq> A"
  shows "f (f B) = f B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f (f B) = f B
[PROOF STEP]
using %invisible assms
[PROOF STATE]
proof (prove)
using this:
f_range_on A f
iia_on A f
B \<subseteq> A

goal (1 subgoal):
 1. f (f B) = f B
[PROOF STEP]
unfolding iia_on_def
[PROOF STATE]
proof (prove)
using this:
f_range_on A f
\<forall>B\<subseteq>A. \<forall>C\<subseteq>B. \<forall>a\<in>C. a \<in> f B \<longrightarrow> a \<in> f C
B \<subseteq> A

goal (1 subgoal):
 1. f (f B) = f B
[PROOF STEP]
by (meson f_range_onD f_range_on_antimono subset_antisym subset_eq)


[STATEMENT]
lemma ZFZero: "Nat2nat Empty = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Nat2nat Empty = 0
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. Nat2nat Empty = 0
[PROOF STEP]
have "nat2Nat 0 = Empty"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. nat2Nat 0 = Empty
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
nat2Nat 0 = Empty

goal (1 subgoal):
 1. Nat2nat Empty = 0
[PROOF STEP]
hence "Nat2nat Empty = Nat2nat (nat2Nat 0)"
[PROOF STATE]
proof (prove)
using this:
nat2Nat 0 = Empty

goal (1 subgoal):
 1. Nat2nat Empty = Nat2nat (nat2Nat 0)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
Nat2nat Empty = Nat2nat (nat2Nat 0)

goal (1 subgoal):
 1. Nat2nat Empty = 0
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
Nat2nat Empty = Nat2nat (nat2Nat 0)

goal (1 subgoal):
 1. Nat2nat Empty = 0
[PROOF STEP]
using Nat2nat_nat2Nat[of "0"]
[PROOF STATE]
proof (prove)
using this:
Nat2nat Empty = Nat2nat (nat2Nat 0)
Nat2nat (nat2Nat 0) = 0

goal (1 subgoal):
 1. Nat2nat Empty = 0
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
Nat2nat Empty = 0

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Inf_islimpt: "bdd_below S \<Longrightarrow> Inf S \<notin> S \<Longrightarrow> S \<noteq> {} \<Longrightarrow> Inf S islimpt S" for S::"real set"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>bdd_below S; Inf S \<notin> S; S \<noteq> {}\<rbrakk> \<Longrightarrow> Inf S islimpt S
[PROOF STEP]
by (auto simp: islimpt_in_closure intro!: closure_contains_Inf)


[STATEMENT]
lemma enn2real_nn_integral_eq_integral:
  assumes eq: "AE x in M. f x = ennreal (g x)" and nn: "AE x in M. 0 \<le> g x"
    and fin: "(\<integral>\<^sup>+x. f x \<partial>M) < top"
    and [measurable]: "g \<in> M \<rightarrow>\<^sub>M borel"
  shows "enn2real (\<integral>\<^sup>+x. f x \<partial>M) = (\<integral>x. g x \<partial>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. enn2real (integral\<^sup>N M f) = integral\<^sup>L M g
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. enn2real (integral\<^sup>N M f) = integral\<^sup>L M g
[PROOF STEP]
have "ennreal (enn2real (\<integral>\<^sup>+x. f x \<partial>M)) = (\<integral>\<^sup>+x. f x \<partial>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ennreal (enn2real (integral\<^sup>N M f)) = integral\<^sup>N M f
[PROOF STEP]
using fin
[PROOF STATE]
proof (prove)
using this:
integral\<^sup>N M f < top

goal (1 subgoal):
 1. ennreal (enn2real (integral\<^sup>N M f)) = integral\<^sup>N M f
[PROOF STEP]
by (intro ennreal_enn2real) auto
[PROOF STATE]
proof (state)
this:
ennreal (enn2real (integral\<^sup>N M f)) = integral\<^sup>N M f

goal (1 subgoal):
 1. enn2real (integral\<^sup>N M f) = integral\<^sup>L M g
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
ennreal (enn2real (integral\<^sup>N M f)) = integral\<^sup>N M f

goal (1 subgoal):
 1. enn2real (integral\<^sup>N M f) = integral\<^sup>L M g
[PROOF STEP]
have "\<dots> = (\<integral>\<^sup>+x. g x \<partial>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integral\<^sup>N M f = \<integral>\<^sup>+ x. ennreal (g x) \<partial>M
[PROOF STEP]
using eq
[PROOF STATE]
proof (prove)
using this:
AE x in M. f x = ennreal (g x)

goal (1 subgoal):
 1. integral\<^sup>N M f = \<integral>\<^sup>+ x. ennreal (g x) \<partial>M
[PROOF STEP]
by (rule nn_integral_cong_AE)
[PROOF STATE]
proof (state)
this:
integral\<^sup>N M f = \<integral>\<^sup>+ x. ennreal (g x) \<partial>M

goal (1 subgoal):
 1. enn2real (integral\<^sup>N M f) = integral\<^sup>L M g
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
integral\<^sup>N M f = \<integral>\<^sup>+ x. ennreal (g x) \<partial>M

goal (1 subgoal):
 1. enn2real (integral\<^sup>N M f) = integral\<^sup>L M g
[PROOF STEP]
have "\<dots> = (\<integral>x. g x \<partial>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<integral>\<^sup>+ x. ennreal (g x) \<partial>M = ennreal (integral\<^sup>L M g)
[PROOF STEP]
proof (rule nn_integral_eq_integral)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. integrable M g
 2. AE x in M. 0 \<le> g x
[PROOF STEP]
show "integrable M g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable M g
[PROOF STEP]
proof (rule integrableI_bounded)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. g \<in> borel_measurable M
 2. \<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M < \<infinity>
[PROOF STEP]
have "(\<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M) = (\<integral>\<^sup>+ x. f x \<partial>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M = integral\<^sup>N M f
[PROOF STEP]
using eq nn
[PROOF STATE]
proof (prove)
using this:
AE x in M. f x = ennreal (g x)
AE x in M. 0 \<le> g x

goal (1 subgoal):
 1. \<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M = integral\<^sup>N M f
[PROOF STEP]
by (auto intro!: nn_integral_cong_AE elim!: eventually_elim2)
[PROOF STATE]
proof (state)
this:
\<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M = integral\<^sup>N M f

goal (2 subgoals):
 1. g \<in> borel_measurable M
 2. \<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M < \<infinity>
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M = integral\<^sup>N M f

goal (2 subgoals):
 1. g \<in> borel_measurable M
 2. \<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M < \<infinity>
[PROOF STEP]
note fin
[PROOF STATE]
proof (state)
this:
integral\<^sup>N M f < top

goal (2 subgoals):
 1. g \<in> borel_measurable M
 2. \<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M < \<infinity>
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
\<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M < top
[PROOF STEP]
show "(\<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M) < \<infinity>"
[PROOF STATE]
proof (prove)
using this:
\<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M < top

goal (1 subgoal):
 1. \<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M < \<infinity>
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<integral>\<^sup>+ x. ennreal (norm (g x)) \<partial>M < \<infinity>

goal (1 subgoal):
 1. g \<in> borel_measurable M
[PROOF STEP]
qed simp
[PROOF STATE]
proof (state)
this:
integrable M g

goal (1 subgoal):
 1. AE x in M. 0 \<le> g x
[PROOF STEP]
qed fact
[PROOF STATE]
proof (state)
this:
\<integral>\<^sup>+ x. ennreal (g x) \<partial>M = ennreal (integral\<^sup>L M g)

goal (1 subgoal):
 1. enn2real (integral\<^sup>N M f) = integral\<^sup>L M g
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
ennreal (enn2real (integral\<^sup>N M f)) = ennreal (integral\<^sup>L M g)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ennreal (enn2real (integral\<^sup>N M f)) = ennreal (integral\<^sup>L M g)

goal (1 subgoal):
 1. enn2real (integral\<^sup>N M f) = integral\<^sup>L M g
[PROOF STEP]
using nn
[PROOF STATE]
proof (prove)
using this:
ennreal (enn2real (integral\<^sup>N M f)) = ennreal (integral\<^sup>L M g)
AE x in M. 0 \<le> g x

goal (1 subgoal):
 1. enn2real (integral\<^sup>N M f) = integral\<^sup>L M g
[PROOF STEP]
by (simp add: integral_nonneg_AE)
[PROOF STATE]
proof (state)
this:
enn2real (integral\<^sup>N M f) = integral\<^sup>L M g

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma pdevs_val_pdevs_inner[simp]: "pdevs_val e (pdevs_inner p a) = pdevs_val e p \<bullet> a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pdevs_val e (pdevs_inner p a) = pdevs_val e p \<bullet> a
[PROOF STEP]
by (auto simp add: inner_sum_left pdevs_val_pdevs_domain intro!: sum.mono_neutral_cong_left)


[STATEMENT]
lemma ts_Least_0:
  assumes "ts x"
  shows    "(LEAST i. (x i) \<noteq> [] ) = (0::nat)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (LEAST i. x i \<noteq> []) = 0
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (LEAST i. x i \<noteq> []) = 0
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
ts x
[PROOF STEP]
have sg1:"x 0 \<noteq> []"
[PROOF STATE]
proof (prove)
using this:
ts x

goal (1 subgoal):
 1. x 0 \<noteq> []
[PROOF STEP]
by (rule ts_length_hint1)
[PROOF STATE]
proof (state)
this:
x 0 \<noteq> []

goal (1 subgoal):
 1. (LEAST i. x i \<noteq> []) = 0
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
x 0 \<noteq> []

goal (1 subgoal):
 1. (LEAST i. x i \<noteq> []) = 0
[PROOF STEP]
apply (simp add: Least_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x 0 \<noteq> [] \<Longrightarrow> (THE xa. x xa \<noteq> [] \<and> (\<forall>y. x y \<noteq> [] \<longrightarrow> xa \<le> y)) = 0
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(LEAST i. x i \<noteq> []) = 0

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma integrable_mono_on_nonneg:
  fixes f :: "real \<Rightarrow> real"
  assumes mon: "mono_on {a..b} f" and 0: "\<And>x. 0 \<le> f x"
  shows "integrable (lebesgue_on {a..b}) f"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable (lebesgue_on {a..b}) f
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. integrable (lebesgue_on {a..b}) f
[PROOF STEP]
have "space lborel = space lebesgue" "sets borel \<subseteq> sets lebesgue"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. space lborel = space lebesgue &&& sets borel \<subseteq> sets lebesgue
[PROOF STEP]
by force+
[PROOF STATE]
proof (state)
this:
space lborel = space lebesgue
sets borel \<subseteq> sets lebesgue

goal (1 subgoal):
 1. integrable (lebesgue_on {a..b}) f
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
space lborel = space lebesgue
sets borel \<subseteq> sets lebesgue
[PROOF STEP]
have fborel: "f \<in> borel_measurable (lebesgue_on {a..b})"
[PROOF STATE]
proof (prove)
using this:
space lborel = space lebesgue
sets borel \<subseteq> sets lebesgue

goal (1 subgoal):
 1. f \<in> borel_measurable (lebesgue_on {a..b})
[PROOF STEP]
by (metis mon borel_measurable_mono_on_fnc borel_measurable_subalgebra mono_restrict_space
              space_lborel space_restrict_space)
[PROOF STATE]
proof (state)
this:
f \<in> borel_measurable (lebesgue_on {a..b})

goal (1 subgoal):
 1. integrable (lebesgue_on {a..b}) f
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
f \<in> borel_measurable (lebesgue_on {a..b})
[PROOF STEP]
obtain g where g: "incseq g" and simple: "\<And>i. simple_function (lebesgue_on {a..b}) (g i)"
                and bdd: " (\<forall>x. bdd_above (range (\<lambda>i. g i x)))" and nonneg: "\<forall>i x. 0 \<le> g i x"
                and fsup: "f = (SUP i. g i)"
[PROOF STATE]
proof (prove)
using this:
f \<in> borel_measurable (lebesgue_on {a..b})

goal (1 subgoal):
 1. (\<And>g. \<lbrakk>incseq g; \<And>i. simple_function (lebesgue_on {a..b}) (g i); \<forall>x. bdd_above (range (\<lambda>i. g i x)); \<forall>i x. 0 \<le> g i x; f = Sup (range g)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis borel_measurable_implies_simple_function_sequence_real 0)
[PROOF STATE]
proof (state)
this:
incseq g
simple_function (lebesgue_on {a..b}) (g ?i1)
\<forall>x. bdd_above (range (\<lambda>i. g i x))
\<forall>i x. 0 \<le> g i x
f = Sup (range g)

goal (1 subgoal):
 1. integrable (lebesgue_on {a..b}) f
[PROOF STEP]
have "f ` {a..b} \<subseteq> {f a..f b}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f ` {a..b} \<subseteq> {f a..f b}
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
mono_on {a..b} f
0 \<le> f ?x

goal (1 subgoal):
 1. f ` {a..b} \<subseteq> {f a..f b}
[PROOF STEP]
by (auto simp: mono_on_def)
[PROOF STATE]
proof (state)
this:
f ` {a..b} \<subseteq> {f a..f b}

goal (1 subgoal):
 1. integrable (lebesgue_on {a..b}) f
[PROOF STEP]
have g_le_f: "g i x \<le> f x" for i x
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. g i x \<le> f x
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. g i x \<le> f x
[PROOF STEP]
have "bdd_above ((\<lambda>h. h x) ` range g)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bdd_above ((\<lambda>h. h x) ` range g)
[PROOF STEP]
using bdd cSUP_lessD linorder_not_less
[PROOF STATE]
proof (prove)
using this:
\<forall>x. bdd_above (range (\<lambda>i. g i x))
\<lbrakk>bdd_above (?f ` ?A); Sup (?f ` ?A) < ?y; ?i \<in> ?A\<rbrakk> \<Longrightarrow> ?f ?i < ?y
(\<not> ?x < ?y) = (?y \<le> ?x)

goal (1 subgoal):
 1. bdd_above ((\<lambda>h. h x) ` range g)
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
bdd_above ((\<lambda>h. h x) ` range g)

goal (1 subgoal):
 1. g i x \<le> f x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
bdd_above ((\<lambda>h. h x) ` range g)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
bdd_above ((\<lambda>h. h x) ` range g)

goal (1 subgoal):
 1. g i x \<le> f x
[PROOF STEP]
by (metis SUP_apply UNIV_I bdd cSUP_upper fsup)
[PROOF STATE]
proof (state)
this:
g i x \<le> f x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
g ?i1 ?x1 \<le> f ?x1

goal (1 subgoal):
 1. integrable (lebesgue_on {a..b}) f
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
g ?i1 ?x1 \<le> f ?x1
[PROOF STEP]
have gfb: "g i x \<le> f b" if "x \<in> {a..b}" for i x
[PROOF STATE]
proof (prove)
using this:
g ?i1 ?x1 \<le> f ?x1

goal (1 subgoal):
 1. g i x \<le> f b
[PROOF STEP]
by (smt (verit, best) mon atLeastAtMost_iff mono_on_def that)
[PROOF STATE]
proof (state)
this:
?x1 \<in> {a..b} \<Longrightarrow> g ?i1 ?x1 \<le> f b

goal (1 subgoal):
 1. integrable (lebesgue_on {a..b}) f
[PROOF STEP]
have g_le: "g i x \<le> g j x" if "i\<le>j"  for i j x
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. g i x \<le> g j x
[PROOF STEP]
using g
[PROOF STATE]
proof (prove)
using this:
incseq g

goal (1 subgoal):
 1. g i x \<le> g j x
[PROOF STEP]
by (simp add: incseq_def le_funD that)
[PROOF STATE]
proof (state)
this:
?i1 \<le> ?j1 \<Longrightarrow> g ?i1 ?x1 \<le> g ?j1 ?x1

goal (1 subgoal):
 1. integrable (lebesgue_on {a..b}) f
[PROOF STEP]
show "integrable (lebesgue_on {a..b}) ( f)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable (lebesgue_on {a..b}) f
[PROOF STEP]
proof (rule integrable_dominated_convergence)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. f \<in> borel_measurable (lebesgue_on {a..b})
 2. \<And>i. ?s i \<in> borel_measurable (lebesgue_on {a..b})
 3. integrable (lebesgue_on {a..b}) ?w
 4. AE x in lebesgue_on {a..b}. (\<lambda>i. ?s i x) \<longlonglongrightarrow> f x
 5. \<And>i. AE x in lebesgue_on {a..b}. norm (?s i x) \<le> ?w x
[PROOF STEP]
show "f \<in> borel_measurable (lebesgue_on {a..b})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f \<in> borel_measurable (lebesgue_on {a..b})
[PROOF STEP]
using fborel
[PROOF STATE]
proof (prove)
using this:
f \<in> borel_measurable (lebesgue_on {a..b})

goal (1 subgoal):
 1. f \<in> borel_measurable (lebesgue_on {a..b})
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
f \<in> borel_measurable (lebesgue_on {a..b})

goal (4 subgoals):
 1. \<And>i. ?s i \<in> borel_measurable (lebesgue_on {a..b})
 2. integrable (lebesgue_on {a..b}) ?w
 3. AE x in lebesgue_on {a..b}. (\<lambda>i. ?s i x) \<longlonglongrightarrow> f x
 4. \<And>i. AE x in lebesgue_on {a..b}. norm (?s i x) \<le> ?w x
[PROOF STEP]
have "\<And>x. (\<lambda>i. g i x) \<longlonglongrightarrow> (SUP h \<in> range g. h  x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. (\<lambda>i. g i x) \<longlonglongrightarrow> (SUP h\<in>range g. h x)
[PROOF STEP]
proof (rule order_tendstoI)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x a. a < (SUP h\<in>range g. h x) \<Longrightarrow> \<forall>\<^sub>F xa in sequentially. a < g xa x
 2. \<And>x a. (SUP h\<in>range g. h x) < a \<Longrightarrow> \<forall>\<^sub>F xa in sequentially. g xa x < a
[PROOF STEP]
show "\<forall>\<^sub>F i in sequentially. y < g i x"
        if "y < (SUP h\<in>range g. h x)" for x y
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F i in sequentially. y < g i x
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<forall>\<^sub>F i in sequentially. y < g i x
[PROOF STEP]
from that
[PROOF STATE]
proof (chain)
picking this:
y < (SUP h\<in>range g. h x)
[PROOF STEP]
obtain h where h: "h \<in> range g" "y < h x"
[PROOF STATE]
proof (prove)
using this:
y < (SUP h\<in>range g. h x)

goal (1 subgoal):
 1. (\<And>h. \<lbrakk>h \<in> range g; y < h x\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using g_le_f
[PROOF STATE]
proof (prove)
using this:
y < (SUP h\<in>range g. h x)
g ?i1 ?x1 \<le> f ?x1

goal (1 subgoal):
 1. (\<And>h. \<lbrakk>h \<in> range g; y < h x\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (subst (asm)less_cSUP_iff) fastforce+
[PROOF STATE]
proof (state)
this:
h \<in> range g
y < h x

goal (1 subgoal):
 1. \<forall>\<^sub>F i in sequentially. y < g i x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
h \<in> range g
y < h x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
h \<in> range g
y < h x

goal (1 subgoal):
 1. \<forall>\<^sub>F i in sequentially. y < g i x
[PROOF STEP]
by (smt (verit, ccfv_SIG) eventually_sequentially g_le imageE)
[PROOF STATE]
proof (state)
this:
\<forall>\<^sub>F i in sequentially. y < g i x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?y1 < (SUP h\<in>range g. h ?x1) \<Longrightarrow> \<forall>\<^sub>F i in sequentially. ?y1 < g i ?x1

goal (1 subgoal):
 1. \<And>x a. (SUP h\<in>range g. h x) < a \<Longrightarrow> \<forall>\<^sub>F xa in sequentially. g xa x < a
[PROOF STEP]
show "\<forall>\<^sub>F i in sequentially. g i x < y"
        if "(SUP h\<in>range g. h x) < y" for x y
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F i in sequentially. g i x < y
[PROOF STEP]
by (smt (verit, best) that Sup_apply g_le_f always_eventually fsup image_cong)
[PROOF STATE]
proof (state)
this:
(SUP h\<in>range g. h ?x1) < ?y1 \<Longrightarrow> \<forall>\<^sub>F i in sequentially. g i ?x1 < ?y1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<lambda>i. g i ?x1) \<longlonglongrightarrow> (SUP h\<in>range g. h ?x1)

goal (4 subgoals):
 1. \<And>i. ?s i \<in> borel_measurable (lebesgue_on {a..b})
 2. integrable (lebesgue_on {a..b}) ?w
 3. AE x in lebesgue_on {a..b}. (\<lambda>i. ?s i x) \<longlonglongrightarrow> f x
 4. \<And>i. AE x in lebesgue_on {a..b}. norm (?s i x) \<le> ?w x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<lambda>i. g i ?x1) \<longlonglongrightarrow> (SUP h\<in>range g. h ?x1)
[PROOF STEP]
show "AE x in lebesgue_on {a..b}. (\<lambda>i. g i x) \<longlonglongrightarrow> f x"
[PROOF STATE]
proof (prove)
using this:
(\<lambda>i. g i ?x1) \<longlonglongrightarrow> (SUP h\<in>range g. h ?x1)

goal (1 subgoal):
 1. AE x in lebesgue_on {a..b}. (\<lambda>i. g i x) \<longlonglongrightarrow> f x
[PROOF STEP]
by (simp add: fsup)
[PROOF STATE]
proof (state)
this:
AE x in lebesgue_on {a..b}. (\<lambda>i. g i x) \<longlonglongrightarrow> f x

goal (3 subgoals):
 1. \<And>i. g i \<in> borel_measurable (lebesgue_on {a..b})
 2. integrable (lebesgue_on {a..b}) ?w
 3. \<And>i. AE x in lebesgue_on {a..b}. norm (g i x) \<le> ?w x
[PROOF STEP]
fix i
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>i. g i \<in> borel_measurable (lebesgue_on {a..b})
 2. integrable (lebesgue_on {a..b}) ?w
 3. \<And>i. AE x in lebesgue_on {a..b}. norm (g i x) \<le> ?w x
[PROOF STEP]
show "g i \<in> borel_measurable (lebesgue_on {a..b})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. g i \<in> borel_measurable (lebesgue_on {a..b})
[PROOF STEP]
using borel_measurable_simple_function simple
[PROOF STATE]
proof (prove)
using this:
simple_function ?M ?f \<Longrightarrow> ?f \<in> borel_measurable ?M
simple_function (lebesgue_on {a..b}) (g ?i1)

goal (1 subgoal):
 1. g i \<in> borel_measurable (lebesgue_on {a..b})
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
g i \<in> borel_measurable (lebesgue_on {a..b})

goal (2 subgoals):
 1. integrable (lebesgue_on {a..b}) ?w
 2. \<And>i. AE x in lebesgue_on {a..b}. norm (g i x) \<le> ?w x
[PROOF STEP]
show "AE x in lebesgue_on {a..b}. norm (g i x) \<le> f b"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. AE x in lebesgue_on {a..b}. norm (g i x) \<le> f b
[PROOF STEP]
by (simp add: gfb nonneg Measure_Space.AE_I' [of "{}"])
[PROOF STATE]
proof (state)
this:
AE x in lebesgue_on {a..b}. norm (g i x) \<le> f b

goal (1 subgoal):
 1. integrable (lebesgue_on {a..b}) (\<lambda>x. f b)
[PROOF STEP]
qed auto
[PROOF STATE]
proof (state)
this:
integrable (lebesgue_on {a..b}) f

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma lift_set_Un_distrib: "lift_set i (A \<union> B) = lift_set i A \<union> lift_set i B"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. lift_set i (A \<union> B) = lift_set i A \<union> lift_set i B
[PROOF STEP]
by (simp add: lift_set_def image_Un)


[STATEMENT]
lemma closed_Int_compact [intro]:
  assumes "closed s"
    and "compact t"
  shows "compact (s \<inter> t)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. compact (s \<inter> t)
[PROOF STEP]
using compact_Int_closed [of t s] assms
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>compact t; closed s\<rbrakk> \<Longrightarrow> compact (t \<inter> s)
closed s
compact t

goal (1 subgoal):
 1. compact (s \<inter> t)
[PROOF STEP]
by (simp add: Int_commute)


[STATEMENT]
lemma join_le_iff[simp]: "x \<squnion> y \<sqsubseteq> z \<longleftrightarrow> x \<sqsubseteq> z \<and> y \<sqsubseteq> z"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (x \<squnion> y \<sqsubseteq> z) = (x \<sqsubseteq> z \<and> y \<sqsubseteq> z)
[PROOF STEP]
by (metis join_ge1 join_ge2 join_least le_trans)


[STATEMENT]
lemma complex_of_real_of:
  "(complex_of \<circ> real_of) = id"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. complex_of \<circ> real_of = id
[PROOF STEP]
unfolding complex_of_def real_of_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. complex_of_real (x $\<^sub>e 0) + \<i> * complex_of_real (x $\<^sub>e 1)) \<circ> (\<lambda>x. eucl_of_list [Re x, Im x]) = id
[PROOF STEP]
using complex_eq
[PROOF STATE]
proof (prove)
using this:
?a = complex_of_real (Re ?a) + \<i> * complex_of_real (Im ?a)

goal (1 subgoal):
 1. (\<lambda>x. complex_of_real (x $\<^sub>e 0) + \<i> * complex_of_real (x $\<^sub>e 1)) \<circ> (\<lambda>x. eucl_of_list [Re x, Im x]) = id
[PROOF STEP]
by (auto simp add:vec_simps)


[STATEMENT]
lemma norm_divide_numeral [simp]: "norm (a / numeral w) = norm a / numeral w"
  for a b :: "'a::{real_normed_field,field}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. norm (a / numeral w) = norm a / numeral w
[PROOF STEP]
by (simp add: norm_divide)


[STATEMENT]
lemma higher_zero [simp]: "higher 0 t = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. higher 0 t = 0
[PROOF STEP]
by (rule poly_mapping_eqI, simp add: lookup_higher)


[STATEMENT]
lemma rbt_comp_delete: "rbt_comp_delete = ord.rbt_delete (lt_of_comp c)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. local.rbt_comp_delete = ord.rbt_delete (lt_of_comp c)
[PROOF STEP]
unfolding rbt_comp_delete_def[abs_def] ord.rbt_delete_def[abs_def]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>k t. paint color.B (local.rbt_comp_del k t)) = (\<lambda>k t. paint color.B (ord.rbt_del (lt_of_comp c) k t))
[PROOF STEP]
unfolding rbt_comp_del
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>k t. paint color.B (ord.rbt_del (lt_of_comp c) k t)) = (\<lambda>k t. paint color.B (ord.rbt_del (lt_of_comp c) k t))
[PROOF STEP]
..


[STATEMENT]
lemma vrange_vintersection_vsubset: "\<R>\<^sub>\<circ> (r \<inter>\<^sub>\<circ> s) \<subseteq>\<^sub>\<circ> \<R>\<^sub>\<circ> r \<inter>\<^sub>\<circ> \<R>\<^sub>\<circ> s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<R>\<^sub>\<circ> (r \<inter>\<^sub>\<circ> s) \<subseteq>\<^sub>\<circ> \<R>\<^sub>\<circ> r \<inter>\<^sub>\<circ> \<R>\<^sub>\<circ> s
[PROOF STEP]
by auto


[STATEMENT]
lemma is_K33_component_size_last:
  assumes "k = ig_verts_cnt G"
  shows "is_K33_component_size_inv G k blue cnt \<longleftrightarrow> card {u \<in> set (ig_verts G). blue u} = cnt"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. is_K33_component_size_inv G k blue cnt = (card {u \<in> set (ig_verts G). blue u} = cnt)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. is_K33_component_size_inv G k blue cnt = (card {u \<in> set (ig_verts G). blue u} = cnt)
[PROOF STEP]
have *: "{u \<in> set (ig_verts G). blue u} = (\<lambda>n. ig_verts G ! n) ` {i. i < ig_verts_cnt G \<and> blue (ig_verts G ! i)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {u \<in> set (ig_verts G). blue u} = (!) (ig_verts G) ` {i. i < ig_verts_cnt G \<and> blue (ig_verts G ! i)}
[PROOF STEP]
by (auto simp: in_set_conv_nth )
[PROOF STATE]
proof (state)
this:
{u \<in> set (ig_verts G). blue u} = (!) (ig_verts G) ` {i. i < ig_verts_cnt G \<and> blue (ig_verts G ! i)}

goal (1 subgoal):
 1. is_K33_component_size_inv G k blue cnt = (card {u \<in> set (ig_verts G). blue u} = cnt)
[PROOF STEP]
have "inj_on (\<lambda>n. ig_verts G ! n) {i. i < ig_verts_cnt G \<and> blue (ig_verts G ! i)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. inj_on ((!) (ig_verts G)) {i. i < ig_verts_cnt G \<and> blue (ig_verts G ! i)}
[PROOF STEP]
using distinct_ig_verts
[PROOF STATE]
proof (prove)
using this:
distinct (ig_verts ?G)

goal (1 subgoal):
 1. inj_on ((!) (ig_verts G)) {i. i < ig_verts_cnt G \<and> blue (ig_verts G ! i)}
[PROOF STEP]
by (auto simp: nth_eq_iff_index_eq intro: inj_onI)
[PROOF STATE]
proof (state)
this:
inj_on ((!) (ig_verts G)) {i. i < ig_verts_cnt G \<and> blue (ig_verts G ! i)}

goal (1 subgoal):
 1. is_K33_component_size_inv G k blue cnt = (card {u \<in> set (ig_verts G). blue u} = cnt)
[PROOF STEP]
with assms
[PROOF STATE]
proof (chain)
picking this:
k = ig_verts_cnt G
inj_on ((!) (ig_verts G)) {i. i < ig_verts_cnt G \<and> blue (ig_verts G ! i)}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
k = ig_verts_cnt G
inj_on ((!) (ig_verts G)) {i. i < ig_verts_cnt G \<and> blue (ig_verts G ! i)}

goal (1 subgoal):
 1. is_K33_component_size_inv G k blue cnt = (card {u \<in> set (ig_verts G). blue u} = cnt)
[PROOF STEP]
unfolding * is_K33_component_size_inv_def
[PROOF STATE]
proof (prove)
using this:
k = ig_verts_cnt G
inj_on ((!) (ig_verts G)) {i. i < ig_verts_cnt G \<and> blue (ig_verts G ! i)}

goal (1 subgoal):
 1. (cnt = card {i. i < k \<and> blue (ig_verts G ! i)}) = (card ((!) (ig_verts G) ` {i. i < ig_verts_cnt G \<and> blue (ig_verts G ! i)}) = cnt)
[PROOF STEP]
by (auto intro: card_image)
[PROOF STATE]
proof (state)
this:
is_K33_component_size_inv G k blue cnt = (card {u \<in> set (ig_verts G). blue u} = cnt)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma abs_\<nu>_trace_fin_le: "\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i < N. l^i * r\<^sub>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
have "\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i < N. \<bar>l ^ i * r (t !! i)\<bar>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. \<bar>l ^ i * r (t !! i)\<bar>)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. \<bar>l ^ i * r (t !! i)\<bar>)

goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. \<bar>l ^ i * r (t !! i)\<bar>)

goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
have "\<dots> \<le> (\<Sum>i < N. l ^ i * r\<^sub>M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>i<N. \<bar>l ^ i * r (t !! i)\<bar>) \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
by (auto intro: sum_mono simp: mult_left_mono abs_r_le_r\<^sub>M)
[PROOF STATE]
proof (state)
this:
(\<Sum>i<N. \<bar>l ^ i * r (t !! i)\<bar>) \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)

goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)

goal (1 subgoal):
 1. \<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
\<bar>\<nu>_trace_fin t N\<bar> \<le> (\<Sum>i<N. l ^ i * r\<^sub>M)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma vE_push: "\<lbrakk> (u,v)\<in>pE; u\<in>last p; v\<notin>\<Union>(set p); v\<notin>D \<rbrakk>
    \<Longrightarrow> vE (p @ [{v}]) D ((pE - {(u,v)}) \<union> E\<inter>{v}\<times>UNIV) = insert (u,v) lvE"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(u, v) \<in> pE; u \<in> last p; v \<notin> \<Union> (set p); v \<notin> D\<rbrakk> \<Longrightarrow> vE (p @ [{v}]) D (pE - {(u, v)} \<union> E \<inter> {v} \<times> UNIV) = insert (u, v) lvE
[PROOF STEP]
unfolding vE_def touched_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(u, v) \<in> pE; u \<in> last p; v \<notin> \<Union> (set p); v \<notin> D\<rbrakk> \<Longrightarrow> E \<inter> (D \<union> \<Union> (set (p @ [{v}]))) \<times> UNIV - (pE - {(u, v)} \<union> E \<inter> {v} \<times> UNIV) = insert (u, v) (E \<inter> (D \<union> \<Union> (set p)) \<times> UNIV - pE)
[PROOF STEP]
using pE_E_from_p
[PROOF STATE]
proof (prove)
using this:
pE \<subseteq> E \<inter> \<Union> (set p) \<times> UNIV

goal (1 subgoal):
 1. \<lbrakk>(u, v) \<in> pE; u \<in> last p; v \<notin> \<Union> (set p); v \<notin> D\<rbrakk> \<Longrightarrow> E \<inter> (D \<union> \<Union> (set (p @ [{v}]))) \<times> UNIV - (pE - {(u, v)} \<union> E \<inter> {v} \<times> UNIV) = insert (u, v) (E \<inter> (D \<union> \<Union> (set p)) \<times> UNIV - pE)
[PROOF STEP]
by auto


[STATEMENT]
lemma del_Node[simp]: "del x (Node l y r) =
  (case cmp x y of
     LT \<Rightarrow> let l' = del x l in up_d y r False l' |
     EQ \<Rightarrow> if r = Leaf then Some l
           else let (a',r') = split_min r in Some(Node l a' r') |
     GT \<Rightarrow> let r' = del x r in up_d y l True r')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. del x \<langle>l, y, r\<rangle> = (case cmp x y of LT \<Rightarrow> Let (del x l) (up_d y r False) | EQ \<Rightarrow> if r = \<langle>\<rangle> then Some l else let (a', r') = Root_Balanced_Tree.split_min r in Some \<langle>l, a', r'\<rangle> | GT \<Rightarrow> Let (del x r) (up_d y l True))
[PROOF STEP]
using val_cong[OF del_tm.simps(2)]
[PROOF STATE]
proof (prove)
using this:
Time_Monad.val (del_tm ?x1 \<langle>?l1, ?y1, ?r1\<rangle>) = Time_Monad.val ((case cmp ?x1 ?y1 of LT \<Rightarrow> del_tm ?x1 ?l1 \<bind> (\<lambda>l'. return (up_d ?y1 ?r1 False l')) | EQ \<Rightarrow> if ?r1 = \<langle>\<rangle> then return (Some ?l1) else split_min_tm ?r1 \<bind> (\<lambda>(a', r'). return (Some \<langle>?l1, a', r'\<rangle>)) | GT \<Rightarrow> del_tm ?x1 ?r1 \<bind> (\<lambda>r'. return (up_d ?y1 ?l1 True r'))) \<bind> tick)

goal (1 subgoal):
 1. del x \<langle>l, y, r\<rangle> = (case cmp x y of LT \<Rightarrow> Let (del x l) (up_d y r False) | EQ \<Rightarrow> if r = \<langle>\<rangle> then Some l else let (a', r') = Root_Balanced_Tree.split_min r in Some \<langle>l, a', r'\<rangle> | GT \<Rightarrow> Let (del x r) (up_d y l True))
[PROOF STEP]
by(simp only: del_def split_min_def val_simps cmp_val.case_distrib[of val])


[STATEMENT]
lemma fund_sol_code:
  assumes "\<not>is_square (D :: nat)"
  shows   "pell.fund_sol D = sum.projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pell.fund_sol D = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. pell.fund_sol D = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
from assms
[PROOF STATE]
proof (chain)
picking this:
\<not> is_square D
[PROOF STEP]
interpret pell D
[PROOF STATE]
proof (prove)
using this:
\<not> is_square D

goal (1 subgoal):
 1. pell D
[PROOF STEP]
by unfold_locales
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
note [simp] = find_fund_sol_step_def
[PROOF STATE]
proof (state)
this:
find_fund_sol_step ?D = (\<lambda>x. case x of Inl (y, y') \<Rightarrow> case get_nat_sqrt y' of None \<Rightarrow> Inl (y + 1, y' + ?D * (2 * y + 1)) | Some x \<Rightarrow> Inr (x, y))

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
define f where "f = find_fund_sol_step D"
[PROOF STATE]
proof (state)
this:
f = find_fund_sol_step D

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
define P :: "nat \<Rightarrow> bool" where "P = (\<lambda>y. y > 0 \<and> is_square (y^2 * D + 1))"
[PROOF STATE]
proof (state)
this:
P = (\<lambda>y. 0 < y \<and> is_square (y\<^sup>2 * D + 1))

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
define Q :: "nat \<times> nat \<Rightarrow> bool" where
    "Q = (\<lambda>(x,y). P y \<and> (\<forall>y'\<in>{0<..<y}. \<not>P y') \<and> x = Discrete.sqrt (y^2 * D + 1))"
[PROOF STATE]
proof (state)
this:
Q = (\<lambda>(x, y). P y \<and> (\<forall>y'\<in>{0<..<y}. \<not> P y') \<and> x = Discrete.sqrt (y\<^sup>2 * D + 1))

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
define R :: "nat \<times> nat + nat \<times> nat \<Rightarrow> bool"
    where "R = (\<lambda>s. case s of
                      Inl (m, m') \<Rightarrow> m > 0 \<and> (m' = m^2 * D + 1) \<and> (\<forall>y\<in>{0<..<m}. \<not>is_square (y^2 * D + 1))
                    | Inr x \<Rightarrow> Q x)"
[PROOF STATE]
proof (state)
this:
R = (\<lambda>s. case s of Inl (m, m') \<Rightarrow> 0 < m \<and> m' = m\<^sup>2 * D + 1 \<and> (\<forall>y\<in>{0<..<m}. \<not> is_square (y\<^sup>2 * D + 1)) | Inr x \<Rightarrow> Q x)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
define rel :: "((nat \<times> nat + nat \<times> nat) \<times> (nat \<times> nat + nat \<times> nat)) set"
    where "rel = {(A,B). (case (A, B) of
                           (Inl (m, _), Inl (m', _)) \<Rightarrow> m' > 0 \<and> m > m' \<and> m \<le> snd fund_sol
                         | (Inr _, Inl (m', _)) \<Rightarrow> m' \<le> snd fund_sol
                         | _ \<Rightarrow> False) \<and> A = f B}"
[PROOF STATE]
proof (state)
this:
rel = {(A, B). (case (A, B) of (Inl (m, x), Inl (m', xa)) \<Rightarrow> 0 < m' \<and> m' < m \<and> m \<le> snd fund_sol | (Inl (m, x), Inr ba) \<Rightarrow> False | (Inr x, Inl (m', xa)) \<Rightarrow> m' \<le> snd fund_sol | (Inr x, Inr ba) \<Rightarrow> False) \<and> A = f B}

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
obtain x y where xy: "sum.projr (while isl f (Inl (Suc 0, Suc D))) = (x, y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>x y. projr (while isl f (Inl (Suc 0, Suc D))) = (x, y) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases "sum.projr (while isl f (Inl (Suc 0, Suc D)))")
[PROOF STATE]
proof (state)
this:
projr (while isl f (Inl (Suc 0, Suc D))) = (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
have neq_fund_solI: "y \<noteq> snd fund_sol" if "\<not> is_square (Suc (y\<^sup>2 * D))" for y
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<noteq> snd fund_sol
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. y = snd fund_sol \<Longrightarrow> False
[PROOF STEP]
assume "y = snd fund_sol"
[PROOF STATE]
proof (state)
this:
y = snd fund_sol

goal (1 subgoal):
 1. y = snd fund_sol \<Longrightarrow> False
[PROOF STEP]
with fund_sol_is_nontriv_solution
[PROOF STATE]
proof (chain)
picking this:
nontriv_solution fund_sol
y = snd fund_sol
[PROOF STEP]
have "Suc (y\<^sup>2 * D) = fst fund_sol ^ 2"
[PROOF STATE]
proof (prove)
using this:
nontriv_solution fund_sol
y = snd fund_sol

goal (1 subgoal):
 1. Suc (y\<^sup>2 * D) = (fst fund_sol)\<^sup>2
[PROOF STEP]
by (simp add: nontriv_solution_def case_prod_unfold)
[PROOF STATE]
proof (state)
this:
Suc (y\<^sup>2 * D) = (fst fund_sol)\<^sup>2

goal (1 subgoal):
 1. y = snd fund_sol \<Longrightarrow> False
[PROOF STEP]
hence "is_square (Suc (y\<^sup>2 * D))"
[PROOF STATE]
proof (prove)
using this:
Suc (y\<^sup>2 * D) = (fst fund_sol)\<^sup>2

goal (1 subgoal):
 1. is_square (Suc (y\<^sup>2 * D))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
is_square (Suc (y\<^sup>2 * D))

goal (1 subgoal):
 1. y = snd fund_sol \<Longrightarrow> False
[PROOF STEP]
with that
[PROOF STATE]
proof (chain)
picking this:
\<not> is_square (Suc (y\<^sup>2 * D))
is_square (Suc (y\<^sup>2 * D))
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (y\<^sup>2 * D))
is_square (Suc (y\<^sup>2 * D))

goal (1 subgoal):
 1. False
[PROOF STEP]
by contradiction
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
have "case_sum (\<lambda>_. False) Q (while sum.isl f (Inl (m, m^2 * D + 1)))"
    if "\<forall>y\<in>{0<..<m}. \<not>is_square (y^2 * D + 1)" "m > 0" for m
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. case while isl f (Inl (m, m\<^sup>2 * D + 1)) of Inl uu_ \<Rightarrow> False | Inr x \<Rightarrow> Q x
[PROOF STEP]
proof (rule while_rule[where b = sum.isl])
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. ?P (Inl (m, m\<^sup>2 * D + 1))
 2. \<And>s. \<lbrakk>?P s; isl s\<rbrakk> \<Longrightarrow> ?P (f s)
 3. \<And>s. \<lbrakk>?P s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 4. wf ?r
 5. \<And>s. \<lbrakk>?P s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
show "R (Inl (m, m\<^sup>2 * D + 1))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. R (Inl (m, m\<^sup>2 * D + 1))
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
\<forall>y\<in>{0<..<m}. \<not> is_square (y\<^sup>2 * D + 1)
0 < m

goal (1 subgoal):
 1. R (Inl (m, m\<^sup>2 * D + 1))
[PROOF STEP]
by (auto simp: R_def)
[PROOF STATE]
proof (state)
this:
R (Inl (m, m\<^sup>2 * D + 1))

goal (4 subgoals):
 1. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> R (f s)
 2. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 3. wf ?r
 4. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> R (f s)
 2. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 3. wf ?r
 4. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
fix s
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> R (f s)
 2. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 3. wf ?r
 4. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
assume "R s" "isl s"
[PROOF STATE]
proof (state)
this:
R s
isl s

goal (4 subgoals):
 1. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> R (f s)
 2. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 3. wf ?r
 4. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
thus "R (f s)"
[PROOF STATE]
proof (prove)
using this:
R s
isl s

goal (1 subgoal):
 1. R (f s)
[PROOF STEP]
by (auto simp: not_less_less_Suc_eq Q_def P_def R_def f_def get_nat_sqrt_def
                     power2_eq_square algebra_simps split: sum.splits prod.splits)
[PROOF STATE]
proof (state)
this:
R (f s)

goal (3 subgoals):
 1. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 2. wf ?r
 3. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 2. wf ?r
 3. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
fix s
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 2. wf ?r
 3. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
assume "R s" "\<not>isl s"
[PROOF STATE]
proof (state)
this:
R s
\<not> isl s

goal (3 subgoals):
 1. \<And>s. \<lbrakk>R s; \<not> isl s\<rbrakk> \<Longrightarrow> case s of Inl uu_ \<Rightarrow> False | Inr a \<Rightarrow> Q a
 2. wf ?r
 3. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
thus "case s of Inl _ \<Rightarrow> False | Inr x \<Rightarrow> Q x"
[PROOF STATE]
proof (prove)
using this:
R s
\<not> isl s

goal (1 subgoal):
 1. case s of Inl x \<Rightarrow> False | Inr x \<Rightarrow> Q x
[PROOF STEP]
by (auto simp: R_def split: sum.splits)
[PROOF STATE]
proof (state)
this:
case s of Inl x \<Rightarrow> False | Inr x \<Rightarrow> Q x

goal (2 subgoals):
 1. wf ?r
 2. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. wf ?r
 2. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
fix s
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. wf ?r
 2. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
assume s: "R s" "isl s"
[PROOF STATE]
proof (state)
this:
R s
isl s

goal (2 subgoals):
 1. wf ?r
 2. \<And>s. \<lbrakk>R s; isl s\<rbrakk> \<Longrightarrow> (f s, s) \<in> ?r
[PROOF STEP]
show "(f s, s) \<in> rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (f s, s) \<in> rel
[PROOF STEP]
proof (cases s)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
case [simp]: (Inl s')
[PROOF STATE]
proof (state)
this:
s = Inl s'

goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
obtain a b where [simp]: "s' = (a, b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>a b. s' = (a, b) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases s')
[PROOF STATE]
proof (state)
this:
s' = (a, b)

goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
from s
[PROOF STATE]
proof (chain)
picking this:
R s
isl s
[PROOF STEP]
have *: "a > 0" "b = Suc (a\<^sup>2 * D)" "\<And>y. y \<in> {0<..<a} \<Longrightarrow> \<not> is_square (Suc (y\<^sup>2 * D))"
[PROOF STATE]
proof (prove)
using this:
R s
isl s

goal (1 subgoal):
 1. 0 < a &&& b = Suc (a\<^sup>2 * D) &&& (\<And>y. y \<in> {0<..<a} \<Longrightarrow> \<not> is_square (Suc (y\<^sup>2 * D)))
[PROOF STEP]
by (auto simp: R_def)
[PROOF STATE]
proof (state)
this:
0 < a
b = Suc (a\<^sup>2 * D)
?y1 \<in> {0<..<a} \<Longrightarrow> \<not> is_square (Suc (?y1\<^sup>2 * D))

goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
have "a < snd fund_sol" if **: "\<not> is_square (Suc (a\<^sup>2 * D))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
from neq_fund_solI
[PROOF STATE]
proof (chain)
picking this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol
[PROOF STEP]
have "y' \<noteq> snd fund_sol" if "y' \<in> {0<..<Suc a}" for y'
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol

goal (1 subgoal):
 1. y' \<noteq> snd fund_sol
[PROOF STEP]
using * ** that
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol
0 < a
b = Suc (a\<^sup>2 * D)
?y1 \<in> {0<..<a} \<Longrightarrow> \<not> is_square (Suc (?y1\<^sup>2 * D))
\<not> is_square (Suc (a\<^sup>2 * D))
y' \<in> {0<..<Suc a}

goal (1 subgoal):
 1. y' \<noteq> snd fund_sol
[PROOF STEP]
by (cases "y' = a") auto
[PROOF STATE]
proof (state)
this:
?y'1 \<in> {0<..<Suc a} \<Longrightarrow> ?y'1 \<noteq> snd fund_sol

goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
?y'1 \<in> {0<..<Suc a} \<Longrightarrow> ?y'1 \<noteq> snd fund_sol

goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
have "snd fund_sol \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd fund_sol \<noteq> 0
[PROOF STEP]
using fund_sol_is_nontriv_solution
[PROOF STATE]
proof (prove)
using this:
nontriv_solution fund_sol

goal (1 subgoal):
 1. snd fund_sol \<noteq> 0
[PROOF STEP]
by (intro notI, cases fund_sol) (auto simp: nontriv_solution_altdef)
[PROOF STATE]
proof (state)
this:
snd fund_sol \<noteq> 0

goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
?y'1 \<in> {0<..<Suc a} \<Longrightarrow> ?y'1 \<noteq> snd fund_sol
snd fund_sol \<noteq> 0
[PROOF STEP]
have "\<forall>y'\<le>a. y' \<noteq> snd fund_sol"
[PROOF STATE]
proof (prove)
using this:
?y'1 \<in> {0<..<Suc a} \<Longrightarrow> ?y'1 \<noteq> snd fund_sol
snd fund_sol \<noteq> 0

goal (1 subgoal):
 1. \<forall>y'\<le>a. y' \<noteq> snd fund_sol
[PROOF STEP]
by (auto simp: less_Suc_eq_le)
[PROOF STATE]
proof (state)
this:
\<forall>y'\<le>a. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
thus "snd fund_sol > a"
[PROOF STATE]
proof (prove)
using this:
\<forall>y'\<le>a. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. a < snd fund_sol
[PROOF STEP]
by (cases "a < snd fund_sol") (auto simp: not_less)
[PROOF STATE]
proof (state)
this:
a < snd fund_sol

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<not> is_square (Suc (a\<^sup>2 * D)) \<Longrightarrow> a < snd fund_sol

goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<not> is_square (Suc (a\<^sup>2 * D)) \<Longrightarrow> a < snd fund_sol

goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
have "a \<le> snd fund_sol"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
have "\<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol
[PROOF STEP]
using neq_fund_solI *
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol
0 < a
b = Suc (a\<^sup>2 * D)
?y1 \<in> {0<..<a} \<Longrightarrow> \<not> is_square (Suc (?y1\<^sup>2 * D))

goal (1 subgoal):
 1. \<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol
[PROOF STEP]
by (auto simp: less_Suc_eq_le)
[PROOF STATE]
proof (state)
this:
\<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
have "snd fund_sol \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd fund_sol \<noteq> 0
[PROOF STEP]
using fund_sol_is_nontriv_solution
[PROOF STATE]
proof (prove)
using this:
nontriv_solution fund_sol

goal (1 subgoal):
 1. snd fund_sol \<noteq> 0
[PROOF STEP]
by (intro notI, cases fund_sol) (auto simp: nontriv_solution_altdef)
[PROOF STATE]
proof (state)
this:
snd fund_sol \<noteq> 0

goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol
snd fund_sol \<noteq> 0
[PROOF STEP]
have "\<forall>y'<a. y' \<noteq> snd fund_sol"
[PROOF STATE]
proof (prove)
using this:
\<forall>y'\<in>{0<..<a}. y' \<noteq> snd fund_sol
snd fund_sol \<noteq> 0

goal (1 subgoal):
 1. \<forall>y'<a. y' \<noteq> snd fund_sol
[PROOF STEP]
by (auto simp: less_Suc_eq_le)
[PROOF STATE]
proof (state)
this:
\<forall>y'<a. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
thus "snd fund_sol \<ge> a"
[PROOF STATE]
proof (prove)
using this:
\<forall>y'<a. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. a \<le> snd fund_sol
[PROOF STEP]
by (cases "a \<le> snd fund_sol") (auto simp: not_less)
[PROOF STATE]
proof (state)
this:
a \<le> snd fund_sol

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
a \<le> snd fund_sol

goal (2 subgoals):
 1. \<And>a. s = Inl a \<Longrightarrow> (f s, s) \<in> rel
 2. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<not> is_square (Suc (a\<^sup>2 * D)) \<Longrightarrow> a < snd fund_sol
a \<le> snd fund_sol
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (a\<^sup>2 * D)) \<Longrightarrow> a < snd fund_sol
a \<le> snd fund_sol

goal (1 subgoal):
 1. (f s, s) \<in> rel
[PROOF STEP]
using *
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (a\<^sup>2 * D)) \<Longrightarrow> a < snd fund_sol
a \<le> snd fund_sol
0 < a
b = Suc (a\<^sup>2 * D)
?y1 \<in> {0<..<a} \<Longrightarrow> \<not> is_square (Suc (?y1\<^sup>2 * D))

goal (1 subgoal):
 1. (f s, s) \<in> rel
[PROOF STEP]
by (auto simp: f_def get_nat_sqrt_def rel_def)
[PROOF STATE]
proof (state)
this:
(f s, s) \<in> rel

goal (1 subgoal):
 1. \<And>b. s = Inr b \<Longrightarrow> (f s, s) \<in> rel
[PROOF STEP]
qed (insert s, auto)
[PROOF STATE]
proof (state)
this:
(f s, s) \<in> rel

goal (1 subgoal):
 1. wf rel
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. wf rel
[PROOF STEP]
define rel'
      where "rel' = {(y, x). (case x of Inl (m, _) \<Rightarrow> m \<le> snd fund_sol | Inr _ \<Rightarrow> False) \<and> y = f x}"
[PROOF STATE]
proof (state)
this:
rel' = {(y, x). (case x of Inl (m, x) \<Rightarrow> m \<le> snd fund_sol | Inr x \<Rightarrow> False) \<and> y = f x}

goal (1 subgoal):
 1. wf rel
[PROOF STEP]
have "wf rel'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf rel'
[PROOF STEP]
unfolding rel'_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf {(y, x). (case x of Inl (m, xa) \<Rightarrow> m \<le> snd fund_sol | Inr x \<Rightarrow> False) \<and> y = f x}
[PROOF STEP]
by (rule wf_if_measure[where f = "\<lambda>z. case z of Inl (m, _) \<Rightarrow> Suc (snd fund_sol) - m | _ \<Rightarrow> 0"])
         (auto split: prod.splits sum.splits simp: f_def get_nat_sqrt_def)
[PROOF STATE]
proof (state)
this:
wf rel'

goal (1 subgoal):
 1. wf rel
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
wf rel'

goal (1 subgoal):
 1. wf rel
[PROOF STEP]
have "rel \<subseteq> rel'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel \<subseteq> rel'
[PROOF STEP]
proof safe
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a b. (a, b) \<in> rel \<Longrightarrow> (a, b) \<in> rel'
[PROOF STEP]
fix w z
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a b. (a, b) \<in> rel \<Longrightarrow> (a, b) \<in> rel'
[PROOF STEP]
assume "(w, z) \<in> rel"
[PROOF STATE]
proof (state)
this:
(w, z) \<in> rel

goal (1 subgoal):
 1. \<And>a b. (a, b) \<in> rel \<Longrightarrow> (a, b) \<in> rel'
[PROOF STEP]
thus "(w, z) \<in> rel'"
[PROOF STATE]
proof (prove)
using this:
(w, z) \<in> rel

goal (1 subgoal):
 1. (w, z) \<in> rel'
[PROOF STEP]
by (cases w; cases z) (auto simp: rel_def rel'_def)
[PROOF STATE]
proof (state)
this:
(w, z) \<in> rel'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
rel \<subseteq> rel'

goal (1 subgoal):
 1. wf rel
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
wf rel'
rel \<subseteq> rel'
[PROOF STEP]
show "wf rel"
[PROOF STATE]
proof (prove)
using this:
wf rel'
rel \<subseteq> rel'

goal (1 subgoal):
 1. wf rel
[PROOF STEP]
by (rule wf_subset)
[PROOF STATE]
proof (state)
this:
wf rel

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>\<forall>y\<in>{0<..<?m1}. \<not> is_square (y\<^sup>2 * D + 1); 0 < ?m1\<rbrakk> \<Longrightarrow> case while isl f (Inl (?m1, ?m1\<^sup>2 * D + 1)) of Inl uu_ \<Rightarrow> False | Inr x \<Rightarrow> Q x

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
from this[of 1] and xy
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>\<forall>y\<in>{0<..<1}. \<not> is_square (y\<^sup>2 * D + 1); 0 < 1\<rbrakk> \<Longrightarrow> case while isl f (Inl (1, 1\<^sup>2 * D + 1)) of Inl uu_ \<Rightarrow> False | Inr x \<Rightarrow> Q x
projr (while isl f (Inl (Suc 0, Suc D))) = (x, y)
[PROOF STEP]
have *: "Q (x, y)"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<forall>y\<in>{0<..<1}. \<not> is_square (y\<^sup>2 * D + 1); 0 < 1\<rbrakk> \<Longrightarrow> case while isl f (Inl (1, 1\<^sup>2 * D + 1)) of Inl uu_ \<Rightarrow> False | Inr x \<Rightarrow> Q x
projr (while isl f (Inl (Suc 0, Suc D))) = (x, y)

goal (1 subgoal):
 1. Q (x, y)
[PROOF STEP]
by (auto split: sum.splits)
[PROOF STATE]
proof (state)
this:
Q (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
from *
[PROOF STATE]
proof (chain)
picking this:
Q (x, y)
[PROOF STEP]
have "is_square (Suc (y\<^sup>2 * D))"
[PROOF STATE]
proof (prove)
using this:
Q (x, y)

goal (1 subgoal):
 1. is_square (Suc (y\<^sup>2 * D))
[PROOF STEP]
by (simp add: Q_def P_def)
[PROOF STATE]
proof (state)
this:
is_square (Suc (y\<^sup>2 * D))

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
with *
[PROOF STATE]
proof (chain)
picking this:
Q (x, y)
is_square (Suc (y\<^sup>2 * D))
[PROOF STEP]
have "x\<^sup>2 = Suc (y\<^sup>2 * D)" "y > 0"
[PROOF STATE]
proof (prove)
using this:
Q (x, y)
is_square (Suc (y\<^sup>2 * D))

goal (1 subgoal):
 1. x\<^sup>2 = Suc (y\<^sup>2 * D) &&& 0 < y
[PROOF STEP]
by (auto simp: Q_def P_def Discrete_sqrt_square_is_square)
[PROOF STATE]
proof (state)
this:
x\<^sup>2 = Suc (y\<^sup>2 * D)
0 < y

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
hence "nontriv_solution (x, y)"
[PROOF STATE]
proof (prove)
using this:
x\<^sup>2 = Suc (y\<^sup>2 * D)
0 < y

goal (1 subgoal):
 1. nontriv_solution (x, y)
[PROOF STEP]
by (auto simp: nontriv_solution_def)
[PROOF STATE]
proof (state)
this:
nontriv_solution (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
from this
[PROOF STATE]
proof (chain)
picking this:
nontriv_solution (x, y)
[PROOF STEP]
have "snd fund_sol \<le> snd (x, y)"
[PROOF STATE]
proof (prove)
using this:
nontriv_solution (x, y)

goal (1 subgoal):
 1. snd fund_sol \<le> snd (x, y)
[PROOF STEP]
by (rule fund_sol_minimal'')
[PROOF STATE]
proof (state)
this:
snd fund_sol \<le> snd (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
snd fund_sol \<le> snd (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
have "snd fund_sol \<ge> y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
from *
[PROOF STATE]
proof (chain)
picking this:
Q (x, y)
[PROOF STEP]
have "(\<forall>y'\<in>{0<..<y}. \<not> is_square (Suc (y'\<^sup>2 * D)))"
[PROOF STATE]
proof (prove)
using this:
Q (x, y)

goal (1 subgoal):
 1. \<forall>y'\<in>{0<..<y}. \<not> is_square (Suc (y'\<^sup>2 * D))
[PROOF STEP]
by (simp add: Q_def P_def)
[PROOF STATE]
proof (state)
this:
\<forall>y'\<in>{0<..<y}. \<not> is_square (Suc (y'\<^sup>2 * D))

goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
with neq_fund_solI
[PROOF STATE]
proof (chain)
picking this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol
\<forall>y'\<in>{0<..<y}. \<not> is_square (Suc (y'\<^sup>2 * D))
[PROOF STEP]
have "(\<forall>y'\<in>{0<..<y}. y' \<noteq> snd fund_sol)"
[PROOF STATE]
proof (prove)
using this:
\<not> is_square (Suc (?y1\<^sup>2 * D)) \<Longrightarrow> ?y1 \<noteq> snd fund_sol
\<forall>y'\<in>{0<..<y}. \<not> is_square (Suc (y'\<^sup>2 * D))

goal (1 subgoal):
 1. \<forall>y'\<in>{0<..<y}. y' \<noteq> snd fund_sol
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>y'\<in>{0<..<y}. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<forall>y'\<in>{0<..<y}. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
have "snd fund_sol \<noteq> 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. snd fund_sol \<noteq> 0
[PROOF STEP]
using fund_sol_is_nontriv_solution
[PROOF STATE]
proof (prove)
using this:
nontriv_solution fund_sol

goal (1 subgoal):
 1. snd fund_sol \<noteq> 0
[PROOF STEP]
by (cases fund_sol) (auto intro!: Nat.gr0I simp: nontriv_solution_altdef)
[PROOF STATE]
proof (state)
this:
snd fund_sol \<noteq> 0

goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<forall>y'\<in>{0<..<y}. y' \<noteq> snd fund_sol
snd fund_sol \<noteq> 0
[PROOF STEP]
have "(\<forall>y'<y. y' \<noteq> snd fund_sol)"
[PROOF STATE]
proof (prove)
using this:
\<forall>y'\<in>{0<..<y}. y' \<noteq> snd fund_sol
snd fund_sol \<noteq> 0

goal (1 subgoal):
 1. \<forall>y'<y. y' \<noteq> snd fund_sol
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>y'<y. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
thus "snd fund_sol \<ge> y"
[PROOF STATE]
proof (prove)
using this:
\<forall>y'<y. y' \<noteq> snd fund_sol

goal (1 subgoal):
 1. y \<le> snd fund_sol
[PROOF STEP]
by (cases "snd fund_sol \<ge> y") (auto simp: not_less)
[PROOF STATE]
proof (state)
this:
y \<le> snd fund_sol

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
y \<le> snd fund_sol

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
snd fund_sol \<le> snd (x, y)
y \<le> snd fund_sol
[PROOF STEP]
have "snd fund_sol = y"
[PROOF STATE]
proof (prove)
using this:
snd fund_sol \<le> snd (x, y)
y \<le> snd fund_sol

goal (1 subgoal):
 1. snd fund_sol = y
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
snd fund_sol = y

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
with solutions_linorder_strict[of x y "fst fund_sol" "snd fund_sol"]
       fund_sol_is_nontriv_solution \<open>nontriv_solution (x, y)\<close>
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>solution (x, y); solution (fst fund_sol, snd fund_sol)\<rbrakk> \<Longrightarrow> (x, y) = (fst fund_sol, snd fund_sol) \<or> x < fst fund_sol \<and> y < snd fund_sol \<or> fst fund_sol < x \<and> snd fund_sol < y
nontriv_solution fund_sol
nontriv_solution (x, y)
snd fund_sol = y
[PROOF STEP]
have "fst fund_sol = x"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>solution (x, y); solution (fst fund_sol, snd fund_sol)\<rbrakk> \<Longrightarrow> (x, y) = (fst fund_sol, snd fund_sol) \<or> x < fst fund_sol \<and> y < snd fund_sol \<or> fst fund_sol < x \<and> snd fund_sol < y
nontriv_solution fund_sol
nontriv_solution (x, y)
snd fund_sol = y

goal (1 subgoal):
 1. fst fund_sol = x
[PROOF STEP]
by (cases fund_sol) (auto simp: nontriv_solution_altdef)
[PROOF STATE]
proof (state)
this:
fst fund_sol = x

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
with \<open>snd fund_sol = y\<close>
[PROOF STATE]
proof (chain)
picking this:
snd fund_sol = y
fst fund_sol = x
[PROOF STEP]
have "fund_sol = (x, y)"
[PROOF STATE]
proof (prove)
using this:
snd fund_sol = y
fst fund_sol = x

goal (1 subgoal):
 1. fund_sol = (x, y)
[PROOF STEP]
by (cases fund_sol) simp
[PROOF STATE]
proof (state)
this:
fund_sol = (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
with xy
[PROOF STATE]
proof (chain)
picking this:
projr (while isl f (Inl (Suc 0, Suc D))) = (x, y)
fund_sol = (x, y)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
projr (while isl f (Inl (Suc 0, Suc D))) = (x, y)
fund_sol = (x, y)

goal (1 subgoal):
 1. fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))
[PROOF STEP]
by (simp add: f_def)
[PROOF STATE]
proof (state)
this:
fund_sol = projr (while isl (find_fund_sol_step D) (Inl (Suc 0, Suc D)))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma Conjunctive_conj:
  assumes "Conjunctive(HC)"
  shows "HC(P \<and> Q) = (HC(P) \<and> Q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. HC (P \<and> Q) = (HC P \<and> Q)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
Conjunctive HC

goal (1 subgoal):
 1. HC (P \<and> Q) = (HC P \<and> Q)
[PROOF STEP]
unfolding Conjunctive_def
[PROOF STATE]
proof (prove)
using this:
\<exists>Q. \<forall>P. HC P = (P \<and> Q)

goal (1 subgoal):
 1. HC (P \<and> Q) = (HC P \<and> Q)
[PROOF STEP]
by (metis utp_pred_laws.inf.assoc utp_pred_laws.inf.commute)


[STATEMENT]
lemma Nil_in_Prefixes_iff [simp]: "[] \<in> Prefixes A \<longleftrightarrow> A \<noteq> {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ([] \<in> Prefixes A) = (A \<noteq> {})
[PROOF STEP]
by (auto simp: Prefixes_def)


[STATEMENT]
lemma sum_mset_image_mset_singleton: "sum_mset (image_mset (\<lambda>x. {#f x#}) A) = image_mset f A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<Sum>x\<in>#A. {#f x#}) = image_mset f A
[PROOF STEP]
by (induction A) auto


[STATEMENT]
lemma Rep_formula_inf:
  "Rep_formula (x \<sqinter> y) = Rep_formula x \<inter> Rep_formula y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Rep_formula (x \<sqinter> y) = Rep_formula x \<inter> Rep_formula y
[PROOF STEP]
unfolding inf_formula_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Rep_formula (Abs_formula (Rep_formula x \<inter> Rep_formula y)) = Rep_formula x \<inter> Rep_formula y
[PROOF STEP]
by (intro Abs_formula_inverse fba.inter Rep_formula)


[STATEMENT]
lemma (in group_action) stabilizer_subset:
  "stabilizer G \<phi> x \<subseteq> carrier G"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. stabilizer G \<phi> x \<subseteq> carrier G
[PROOF STEP]
by (metis (no_types, lifting) mem_Collect_eq stabilizer_def subsetI)


[STATEMENT]
lemma uminus_mult_right_mat[simp]: "(A * - B) = - (A * B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A * - B = - (A * B)
[PROOF STEP]
by (intro eq_matI, insert dim, auto)


[STATEMENT]
lemma leadsTo_UN_distrib:
     "F \<in> (\<Union>i \<in> I. A i) leadsTo B  =  (\<forall>i \<in> I. F \<in> (A i) leadsTo B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (F \<in> \<Union> (A ` I) \<longmapsto> B) = (\<forall>i\<in>I. F \<in> A i \<longmapsto> B)
[PROOF STEP]
by (blast intro: leadsTo_UN leadsTo_weaken_L)


[STATEMENT]
lemma simplex_map_compose:
   "simplex_map p (h \<circ> g) = simplex_map p h \<circ> simplex_map p g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. simplex_map p (h \<circ> g) = simplex_map p h \<circ> simplex_map p g
[PROOF STEP]
unfolding simplex_map_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>c. restrict (h \<circ> g \<circ> c) (standard_simplex p)) = (\<lambda>c. restrict (h \<circ> c) (standard_simplex p)) \<circ> (\<lambda>c. restrict (g \<circ> c) (standard_simplex p))
[PROOF STEP]
by force


[STATEMENT]
lemma bounded_integrable:
  assumes "bounded (range v)" "v \<in> borel_measurable (measure_pmf p)"
  shows "integrable (measure_pmf p) (v :: 'c \<Rightarrow> real)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. integrable (measure_pmf p) v
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
bounded (range v)
measure_pmf.random_variable p borel v

goal (1 subgoal):
 1. integrable (measure_pmf p) v
[PROOF STEP]
by (auto simp: bounded_iff AE_measure_pmf_iff intro!: measure_pmf.integrable_const_bound)


[STATEMENT]
lemma list_assn_mono:
  "\<lbrakk>\<And>x x'. P x x'\<Longrightarrow>\<^sub>AP' x x'\<rbrakk> \<Longrightarrow> list_assn P l l' \<Longrightarrow>\<^sub>A list_assn P' l l'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>x x'. P x x' \<Longrightarrow>\<^sub>A P' x x') \<Longrightarrow> list_assn P l l' \<Longrightarrow>\<^sub>A list_assn P' l l'
[PROOF STEP]
apply (induct P l l' rule: list_assn.induct)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>P. (\<And>x x'. P x x' \<Longrightarrow>\<^sub>A P' x x') \<Longrightarrow> list_assn P [] [] \<Longrightarrow>\<^sub>A list_assn P' [] []
 2. \<And>P a as c cs. \<lbrakk>(\<And>x x'. P x x' \<Longrightarrow>\<^sub>A P' x x') \<Longrightarrow> list_assn P as cs \<Longrightarrow>\<^sub>A list_assn P' as cs; \<And>x x'. P x x' \<Longrightarrow>\<^sub>A P' x x'\<rbrakk> \<Longrightarrow> list_assn P (a # as) (c # cs) \<Longrightarrow>\<^sub>A list_assn P' (a # as) (c # cs)
 3. \<And>uu_ v va. (\<And>x x'. uu_ x x' \<Longrightarrow>\<^sub>A P' x x') \<Longrightarrow> list_assn uu_ (v # va) [] \<Longrightarrow>\<^sub>A list_assn P' (v # va) []
 4. \<And>uu_ v va. (\<And>x x'. uu_ x x' \<Longrightarrow>\<^sub>A P' x x') \<Longrightarrow> list_assn uu_ [] (v # va) \<Longrightarrow>\<^sub>A list_assn P' [] (v # va)
[PROOF STEP]
by (auto intro: ent_star_mono)


[STATEMENT]
lemma differentiable_at_imp_differentiable_on:
  "(\<And>x. x \<in> s \<Longrightarrow> f differentiable at x) \<Longrightarrow> f differentiable_on s"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>x. x \<in> s \<Longrightarrow> f differentiable at x) \<Longrightarrow> f differentiable_on s
[PROOF STEP]
by (metis differentiable_at_withinI differentiable_on_def)


[STATEMENT]
lemma icard_insert_le: "icard A \<le> icard (insert x A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. icard A \<le> icard (insert x A)
[PROOF STEP]
by (simp add: icard_insert_if)


[STATEMENT]
lemma monom_mult_atomize:
  "monom_mult c t (atomize_poly p) = atomize_poly (MPoly_Type_Class.punit.monom_mult (monomial c t) 0 p)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. monom_mult c t (atomize_poly p) = atomize_poly (MPoly_Type_Class.punit.monom_mult (monomial c t) 0 p)
[PROOF STEP]
by (rule poly_mapping_eqI_proj, simp add: proj_monom_mult proj_atomize_poly
      MPoly_Type_Class.punit.lookup_monom_mult times_monomial_left)


[STATEMENT]
lemma (in semilattice_inf) residuated_inf: "residuated f \<Longrightarrow> residual f (x \<sqinter> y) = residual f x \<sqinter> residual f y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. residuated f \<Longrightarrow> residual f (x \<sqinter> y) = residual f x \<sqinter> residual f y
[PROOF STEP]
proof (rule order.antisym)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. residuated f \<Longrightarrow> residual f (x \<sqinter> y) \<le> residual f x \<sqinter> residual f y
 2. residuated f \<Longrightarrow> residual f x \<sqinter> residual f y \<le> residual f (x \<sqinter> y)
[PROOF STEP]
assume assm: "residuated f"
[PROOF STATE]
proof (state)
this:
residuated f

goal (2 subgoals):
 1. residuated f \<Longrightarrow> residual f (x \<sqinter> y) \<le> residual f x \<sqinter> residual f y
 2. residuated f \<Longrightarrow> residual f x \<sqinter> residual f y \<le> residual f (x \<sqinter> y)
[PROOF STEP]
thus "residual f (x \<sqinter> y) \<le> residual f x \<sqinter> residual f y"
[PROOF STATE]
proof (prove)
using this:
residuated f

goal (1 subgoal):
 1. residual f (x \<sqinter> y) \<le> residual f x \<sqinter> residual f y
[PROOF STEP]
by (metis local.inf.boundedI local.inf.cobounded1 local.inf.cobounded2 local.res_residual_iso)
[PROOF STATE]
proof (state)
this:
residual f (x \<sqinter> y) \<le> residual f x \<sqinter> residual f y

goal (1 subgoal):
 1. residuated f \<Longrightarrow> residual f x \<sqinter> residual f y \<le> residual f (x \<sqinter> y)
[PROOF STEP]
show "residual f x \<sqinter> residual f y \<le> residual f (x \<sqinter> y)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. residual f x \<sqinter> residual f y \<le> residual f (x \<sqinter> y)
[PROOF STEP]
by (metis assm local.inf.bounded_iff local.inf.cobounded1 local.inf.cobounded2 local.residual_galoisI1 local.residual_galoisI2)
[PROOF STATE]
proof (state)
this:
residual f x \<sqinter> residual f y \<le> residual f (x \<sqinter> y)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma has_field_derivative_complex_powr_right:
  "w \<noteq> 0 \<Longrightarrow> ((\<lambda>z. w powr z) has_field_derivative Ln w * w powr z) (at z within A)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. w \<noteq> 0 \<Longrightarrow> ((powr) w has_field_derivative Ln w * w powr z) (at z within A)
[PROOF STEP]
by (rule DERIV_subset, rule has_field_derivative_powr_right) auto