[STATEMENT]
lemma noread_exists_change_respecting:
  assumes fin: "finite (X :: 'Var set)"
  assumes eval: "\<langle> c, mds, mem \<rangle> \<leadsto> \<langle> c', mds', mem' \<rangle>"
  assumes noread: "\<forall> x \<in> X. doesnt_read c x"
  shows "\<exists> (g :: ('Var \<rightharpoonup> 'Val) \<Rightarrow> ('Var \<rightharpoonup> 'Val)).  change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>g. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>g. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g
[PROOF STEP]
let ?lc = "\<langle>c, mds, mem\<rangle>" and ?lc' = "\<langle>c', mds', mem'\<rangle>"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<exists>g. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g
[PROOF STEP]
from fin eval noread
[PROOF STATE]
proof (chain)
picking this:
finite X
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
\<forall>x\<in>X. doesnt_read c x
[PROOF STEP]
show "\<exists> g. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g"
[PROOF STATE]
proof (prove)
using this:
finite X
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
\<forall>x\<in>X. doesnt_read c x

goal (1 subgoal):
 1. \<exists>g. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g
[PROOF STEP]
proof (induct "X" arbitrary: mem mem' rule: finite_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball {} (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> {})
 2. \<And>x F mem mem'. \<lbrakk>finite F; x \<notin> F; \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball F (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> F); \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball (insert x F) (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x F))
[PROOF STEP]
case empty
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
\<forall>a\<in>{}. doesnt_read c a

goal (2 subgoals):
 1. \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball {} (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> {})
 2. \<And>x F mem mem'. \<lbrakk>finite F; x \<notin> F; \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball F (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> F); \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball (insert x F) (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x F))
[PROOF STEP]
let ?g = "\<lambda> \<sigma>. Map.empty"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball {} (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> {})
 2. \<And>x F mem mem'. \<lbrakk>finite F; x \<notin> F; \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball F (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> F); \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball (insert x F) (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x F))
[PROOF STEP]
have "mem [\<mapsto> Map.empty] = mem" "mem' [\<mapsto> ?g Map.empty] = mem'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. subst Map.empty mem = mem &&& subst Map.empty mem' = mem'
[PROOF STEP]
unfolding subst_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. case None of None \<Rightarrow> mem x | Some v \<Rightarrow> v) = mem &&& (\<lambda>x. case None of None \<Rightarrow> mem' x | Some v \<Rightarrow> v) = mem'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
subst Map.empty mem = mem
subst Map.empty mem' = mem'

goal (2 subgoals):
 1. \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball {} (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> {})
 2. \<And>x F mem mem'. \<lbrakk>finite F; x \<notin> F; \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball F (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> F); \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball (insert x F) (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x F))
[PROOF STEP]
hence "change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> {} ?g"
[PROOF STATE]
proof (prove)
using this:
subst Map.empty mem = mem
subst Map.empty mem' = mem'

goal (1 subgoal):
 1. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> {} (\<lambda>\<sigma>. Map.empty)
[PROOF STEP]
using empty
[PROOF STATE]
proof (prove)
using this:
subst Map.empty mem = mem
subst Map.empty mem' = mem'
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
\<forall>a\<in>{}. doesnt_read c a

goal (1 subgoal):
 1. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> {} (\<lambda>\<sigma>. Map.empty)
[PROOF STEP]
unfolding change_respecting.simps func_le_def subst_def
[PROOF STATE]
proof (prove)
using this:
(\<lambda>x. case None of None \<Rightarrow> mem x | Some v \<Rightarrow> v) = mem
(\<lambda>x. case None of None \<Rightarrow> mem' x | Some v \<Rightarrow> v) = mem'
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
\<forall>a\<in>{}. doesnt_read c a

goal (1 subgoal):
 1. \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<and> (\<forall>\<sigma>. dom \<sigma> = {} \<longrightarrow> (\<forall>x\<in>dom Map.empty. None = \<sigma> x)) \<and> (\<forall>\<sigma> \<sigma>'. dom \<sigma> = {} \<and> dom \<sigma>' = {} \<longrightarrow> dom Map.empty = dom Map.empty) \<and> (\<forall>\<sigma>. dom \<sigma> = {} \<longrightarrow> \<langle>c, mds, \<lambda>x. case \<sigma> x of None \<Rightarrow> mem x | Some v \<Rightarrow> v\<rangle> \<leadsto> \<langle>c', mds', \<lambda>x. case None of None \<Rightarrow> mem' x | Some v \<Rightarrow> v\<rangle>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> {} (\<lambda>\<sigma>. Map.empty)

goal (2 subgoals):
 1. \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball {} (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> {})
 2. \<And>x F mem mem'. \<lbrakk>finite F; x \<notin> F; \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball F (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> F); \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball (insert x F) (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x F))
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> {} (\<lambda>\<sigma>. Map.empty)

goal (1 subgoal):
 1. \<exists>a. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> {} a
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>a. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> {} a

goal (1 subgoal):
 1. \<And>x F mem mem'. \<lbrakk>finite F; x \<notin> F; \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball F (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> F); \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball (insert x F) (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x F))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x F mem mem'. \<lbrakk>finite F; x \<notin> F; \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball F (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> F); \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball (insert x F) (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x F))
[PROOF STEP]
case (insert x X)
[PROOF STATE]
proof (state)
this:
finite X
x \<notin> X
\<lbrakk>\<langle>c, mds, ?mem5\<rangle> \<leadsto> \<langle>c', mds', ?mem'5\<rangle>; \<forall>a\<in>X. doesnt_read c a\<rbrakk> \<Longrightarrow> \<exists>a. change_respecting \<langle>c, mds, ?mem5\<rangle> \<langle>c', mds', ?mem'5\<rangle> X a
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
\<forall>a\<in>insert x X. doesnt_read c a

goal (1 subgoal):
 1. \<And>x F mem mem'. \<lbrakk>finite F; x \<notin> F; \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball F (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> F); \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball (insert x F) (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x F))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
finite X
x \<notin> X
\<lbrakk>\<langle>c, mds, ?mem5\<rangle> \<leadsto> \<langle>c', mds', ?mem'5\<rangle>; \<forall>a\<in>X. doesnt_read c a\<rbrakk> \<Longrightarrow> \<exists>a. change_respecting \<langle>c, mds, ?mem5\<rangle> \<langle>c', mds', ?mem'5\<rangle> X a
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
\<forall>a\<in>insert x X. doesnt_read c a
[PROOF STEP]
obtain g\<^sub>X where IH: "change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X"
[PROOF STATE]
proof (prove)
using this:
finite X
x \<notin> X
\<lbrakk>\<langle>c, mds, ?mem5\<rangle> \<leadsto> \<langle>c', mds', ?mem'5\<rangle>; \<forall>a\<in>X. doesnt_read c a\<rbrakk> \<Longrightarrow> \<exists>a. change_respecting \<langle>c, mds, ?mem5\<rangle> \<langle>c', mds', ?mem'5\<rangle> X a
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
\<forall>a\<in>insert x X. doesnt_read c a

goal (1 subgoal):
 1. (\<And>g\<^sub>X. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis insert_iff)
[PROOF STATE]
proof (state)
this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X

goal (1 subgoal):
 1. \<And>x F mem mem'. \<lbrakk>finite F; x \<notin> F; \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball F (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> F); \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball (insert x F) (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x F))
[PROOF STEP]
(* Unfortunately, it is necessary to define the required function in advance for
       all case distinctions we want to make. *)
[PROOF STATE]
proof (state)
this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X

goal (1 subgoal):
 1. \<And>x F mem mem'. \<lbrakk>finite F; x \<notin> F; \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball F (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> F); \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball (insert x F) (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x F))
[PROOF STEP]
define g where "g \<sigma> =
       (let \<sigma>' = \<sigma> |` X in
        (if (\<forall> v. \<langle>c, mds, mem [\<mapsto> \<sigma>'] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X \<sigma>'] (x := v)\<rangle>)
         then (\<lambda> y :: 'Var.
                    if x = y
                    then \<sigma> y
                    else g\<^sub>X \<sigma>' y)
         else (\<lambda> y. g\<^sub>X \<sigma>' y)))"
      for \<sigma> :: "'Var \<rightharpoonup> 'Val"
[PROOF STATE]
proof (state)
this:
g ?\<sigma> = (let \<sigma>' = ?\<sigma> |` X in if \<forall>v. \<langle>c, mds, (subst \<sigma>' mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X \<sigma>') mem')(x := v)\<rangle> then \<lambda>y. if x = y then ?\<sigma> y else g\<^sub>X \<sigma>' y else g\<^sub>X \<sigma>')

goal (1 subgoal):
 1. \<And>x F mem mem'. \<lbrakk>finite F; x \<notin> F; \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball F (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> F); \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball (insert x F) (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x F))
[PROOF STEP]
have "change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x X) g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x X) g
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
 2. \<And>f. dom f = insert x X \<Longrightarrow> g f \<preceq> f \<and> (\<forall>f'. dom f' = insert x X \<longrightarrow> dom (g f) = dom (g f')) \<and> \<langle>c, mds, subst f mem\<rangle> \<leadsto> \<langle>c', mds', subst (g f) mem'\<rangle>
[PROOF STEP]
show "\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
[PROOF STEP]
using insert
[PROOF STATE]
proof (prove)
using this:
finite X
x \<notin> X
\<lbrakk>\<langle>c, mds, ?mem5\<rangle> \<leadsto> \<langle>c', mds', ?mem'5\<rangle>; \<forall>a\<in>X. doesnt_read c a\<rbrakk> \<Longrightarrow> \<exists>a. change_respecting \<langle>c, mds, ?mem5\<rangle> \<langle>c', mds', ?mem'5\<rangle> X a
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
\<forall>a\<in>insert x X. doesnt_read c a

goal (1 subgoal):
 1. \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>

goal (1 subgoal):
 1. \<And>f. dom f = insert x X \<Longrightarrow> g f \<preceq> f \<and> (\<forall>f'. dom f' = insert x X \<longrightarrow> dom (g f) = dom (g f')) \<and> \<langle>c, mds, subst f mem\<rangle> \<leadsto> \<langle>c', mds', subst (g f) mem'\<rangle>
[PROOF STEP]
next \<comment> \<open>We first show that property (2) is satisfied.\<close>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>f. dom f = insert x X \<Longrightarrow> g f \<preceq> f \<and> (\<forall>f'. dom f' = insert x X \<longrightarrow> dom (g f) = dom (g f')) \<and> \<langle>c, mds, subst f mem\<rangle> \<leadsto> \<langle>c', mds', subst (g f) mem'\<rangle>
[PROOF STEP]
fix \<sigma> :: "'Var \<rightharpoonup> 'Val"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>f. dom f = insert x X \<Longrightarrow> g f \<preceq> f \<and> (\<forall>f'. dom f' = insert x X \<longrightarrow> dom (g f) = dom (g f')) \<and> \<langle>c, mds, subst f mem\<rangle> \<leadsto> \<langle>c', mds', subst (g f) mem'\<rangle>
[PROOF STEP]
let ?\<sigma>\<^sub>X = "\<sigma> |` X"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>f. dom f = insert x X \<Longrightarrow> g f \<preceq> f \<and> (\<forall>f'. dom f' = insert x X \<longrightarrow> dom (g f) = dom (g f')) \<and> \<langle>c, mds, subst f mem\<rangle> \<leadsto> \<langle>c', mds', subst (g f) mem'\<rangle>
[PROOF STEP]
assume "dom \<sigma> = insert x X"
[PROOF STATE]
proof (state)
this:
dom \<sigma> = insert x X

goal (1 subgoal):
 1. \<And>f. dom f = insert x X \<Longrightarrow> g f \<preceq> f \<and> (\<forall>f'. dom f' = insert x X \<longrightarrow> dom (g f) = dom (g f')) \<and> \<langle>c, mds, subst f mem\<rangle> \<leadsto> \<langle>c', mds', subst (g f) mem'\<rangle>
[PROOF STEP]
hence "dom ?\<sigma>\<^sub>X = X"
[PROOF STATE]
proof (prove)
using this:
dom \<sigma> = insert x X

goal (1 subgoal):
 1. dom (\<sigma> |` X) = X
[PROOF STEP]
by (metis dom_restrict inf_absorb2 subset_insertI)
[PROOF STATE]
proof (state)
this:
dom (\<sigma> |` X) = X

goal (1 subgoal):
 1. \<And>f. dom f = insert x X \<Longrightarrow> g f \<preceq> f \<and> (\<forall>f'. dom f' = insert x X \<longrightarrow> dom (g f) = dom (g f')) \<and> \<langle>c, mds, subst f mem\<rangle> \<leadsto> \<langle>c', mds', subst (g f) mem'\<rangle>
[PROOF STEP]
from insert
[PROOF STATE]
proof (chain)
picking this:
finite X
x \<notin> X
\<lbrakk>\<langle>c, mds, ?mem5\<rangle> \<leadsto> \<langle>c', mds', ?mem'5\<rangle>; \<forall>a\<in>X. doesnt_read c a\<rbrakk> \<Longrightarrow> \<exists>a. change_respecting \<langle>c, mds, ?mem5\<rangle> \<langle>c', mds', ?mem'5\<rangle> X a
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
\<forall>a\<in>insert x X. doesnt_read c a
[PROOF STEP]
have "doesnt_read c x"
[PROOF STATE]
proof (prove)
using this:
finite X
x \<notin> X
\<lbrakk>\<langle>c, mds, ?mem5\<rangle> \<leadsto> \<langle>c', mds', ?mem'5\<rangle>; \<forall>a\<in>X. doesnt_read c a\<rbrakk> \<Longrightarrow> \<exists>a. change_respecting \<langle>c, mds, ?mem5\<rangle> \<langle>c', mds', ?mem'5\<rangle> X a
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
\<forall>a\<in>insert x X. doesnt_read c a

goal (1 subgoal):
 1. doesnt_read c x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
doesnt_read c x

goal (1 subgoal):
 1. \<And>f. dom f = insert x X \<Longrightarrow> g f \<preceq> f \<and> (\<forall>f'. dom f' = insert x X \<longrightarrow> dom (g f) = dom (g f')) \<and> \<langle>c, mds, subst f mem\<rangle> \<leadsto> \<langle>c', mds', subst (g f) mem'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
doesnt_read c x

goal (1 subgoal):
 1. \<And>f. dom f = insert x X \<Longrightarrow> g f \<preceq> f \<and> (\<forall>f'. dom f' = insert x X \<longrightarrow> dom (g f) = dom (g f')) \<and> \<langle>c, mds, subst f mem\<rangle> \<leadsto> \<langle>c', mds', subst (g f) mem'\<rangle>
[PROOF STEP]
from IH
[PROOF STATE]
proof (chain)
picking this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X
[PROOF STEP]
have eval\<^sub>X: "\<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X]\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X]\<rangle>"
[PROOF STATE]
proof (prove)
using this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X

goal (1 subgoal):
 1. \<langle>c, mds, subst (\<sigma> |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>
[PROOF STEP]
using \<open>dom ?\<sigma>\<^sub>X = X\<close>
[PROOF STATE]
proof (prove)
using this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X
dom (\<sigma> |` X) = X

goal (1 subgoal):
 1. \<langle>c, mds, subst (\<sigma> |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>
[PROOF STEP]
unfolding change_respecting.simps
[PROOF STATE]
proof (prove)
using this:
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<and> (\<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> g\<^sub>X \<sigma> \<preceq> \<sigma>) \<and> (\<forall>\<sigma> \<sigma>'. dom \<sigma> = X \<and> dom \<sigma>' = X \<longrightarrow> dom (g\<^sub>X \<sigma>) = dom (g\<^sub>X \<sigma>')) \<and> (\<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X \<sigma>) mem'\<rangle>)
dom (\<sigma> |` X) = X

goal (1 subgoal):
 1. \<langle>c, mds, subst (\<sigma> |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, subst (\<sigma> |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>

goal (1 subgoal):
 1. \<And>f. dom f = insert x X \<Longrightarrow> g f \<preceq> f \<and> (\<forall>f'. dom f' = insert x X \<longrightarrow> dom (g f) = dom (g f')) \<and> \<langle>c, mds, subst f mem\<rangle> \<leadsto> \<langle>c', mds', subst (g f) mem'\<rangle>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
doesnt_read c x
\<langle>c, mds, subst (\<sigma> |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>
[PROOF STEP]
have
        noread\<^sub>x:
        "(\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X] (x := v) \<rangle>) \<or>
        (\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X]\<rangle>)"
[PROOF STATE]
proof (prove)
using this:
doesnt_read c x
\<langle>c, mds, subst (\<sigma> |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>)
[PROOF STEP]
unfolding doesnt_read_def
[PROOF STATE]
proof (prove)
using this:
\<forall>mds mem c' mds' mem'. \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<longrightarrow> (\<forall>v. \<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem'(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>)
\<langle>c, mds, subst (\<sigma> |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>)

goal (1 subgoal):
 1. \<And>f. dom f = insert x X \<Longrightarrow> g f \<preceq> f \<and> (\<forall>f'. dom f' = insert x X \<longrightarrow> dom (g f) = dom (g f')) \<and> \<langle>c, mds, subst f mem\<rangle> \<leadsto> \<langle>c', mds', subst (g f) mem'\<rangle>
[PROOF STEP]
show "g \<sigma> \<preceq> \<sigma> \<and>
            (\<forall> \<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')) \<and>
            \<langle>c, mds, mem [\<mapsto> \<sigma>]\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g \<sigma>]\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. g \<sigma> \<preceq> \<sigma> \<and> (\<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')) \<and> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
proof (rule conjI3)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. g \<sigma> \<preceq> \<sigma>
 2. \<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 3. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
from noread\<^sub>x
[PROOF STATE]
proof (chain)
picking this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>)
[PROOF STEP]
show "g \<sigma> \<preceq> \<sigma>"
[PROOF STATE]
proof (prove)
using this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>)

goal (1 subgoal):
 1. g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle> \<Longrightarrow> g \<sigma> \<preceq> \<sigma>
 2. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
assume nowrite: "\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto>
                 \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X] (x := v)\<rangle>"
[PROOF STATE]
proof (state)
this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>

goal (2 subgoals):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle> \<Longrightarrow> g \<sigma> \<preceq> \<sigma>
 2. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>
[PROOF STEP]
have g_simp [simp]: "g \<sigma> = (\<lambda> y. if y = x then \<sigma> y else g\<^sub>X ?\<sigma>\<^sub>X y)"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>

goal (1 subgoal):
 1. g \<sigma> = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y)
[PROOF STEP]
unfolding g_def
[PROOF STATE]
proof (prove)
using this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>

goal (1 subgoal):
 1. (let \<sigma>' = \<sigma> |` X in if \<forall>v. \<langle>c, mds, (subst \<sigma>' mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X \<sigma>') mem')(x := v)\<rangle> then \<lambda>y. if x = y then \<sigma> y else g\<^sub>X \<sigma>' y else g\<^sub>X \<sigma>') = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
g \<sigma> = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y)

goal (2 subgoals):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle> \<Longrightarrow> g \<sigma> \<preceq> \<sigma>
 2. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
thus "g \<sigma> \<preceq> \<sigma>"
[PROOF STATE]
proof (prove)
using this:
g \<sigma> = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y)

goal (1 subgoal):
 1. g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
using IH
[PROOF STATE]
proof (prove)
using this:
g \<sigma> = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y)
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X

goal (1 subgoal):
 1. g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
unfolding g_simp func_le_def
[PROOF STATE]
proof (prove)
using this:
(\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y) = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y)
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X

goal (1 subgoal):
 1. \<forall>xa\<in>dom (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y). (if xa = x then \<sigma> xa else g\<^sub>X (\<sigma> |` X) xa) = \<sigma> xa
[PROOF STEP]
by (auto, metis \<open>dom (\<sigma> |` X) = X\<close> domI func_le_def restrict_in)
[PROOF STATE]
proof (state)
this:
g \<sigma> \<preceq> \<sigma>

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
assume overwrites: "\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto>
            \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X]\<rangle>"
[PROOF STATE]
proof (state)
this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
hence
            "\<not> (\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X] (x := v)\<rangle>)"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>

goal (1 subgoal):
 1. \<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>)
[PROOF STEP]
by (metis \<open>doesnt_read c x\<close> doesnt_read_mutually_exclusive eval\<^sub>X)
[PROOF STATE]
proof (state)
this:
\<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>)

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
hence g_simp [simp]: "g \<sigma> = g\<^sub>X ?\<sigma>\<^sub>X"
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>)

goal (1 subgoal):
 1. g \<sigma> = g\<^sub>X (\<sigma> |` X)
[PROOF STEP]
unfolding g_def
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>)

goal (1 subgoal):
 1. (let \<sigma>' = \<sigma> |` X in if \<forall>v. \<langle>c, mds, (subst \<sigma>' mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X \<sigma>') mem')(x := v)\<rangle> then \<lambda>y. if x = y then \<sigma> y else g\<^sub>X \<sigma>' y else g\<^sub>X \<sigma>') = g\<^sub>X (\<sigma> |` X)
[PROOF STEP]
by (auto simp: Let_def)
[PROOF STATE]
proof (state)
this:
g \<sigma> = g\<^sub>X (\<sigma> |` X)

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
g \<sigma> = g\<^sub>X (\<sigma> |` X)

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
from IH
[PROOF STATE]
proof (chain)
picking this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X
[PROOF STEP]
have "g\<^sub>X ?\<sigma>\<^sub>X \<preceq> ?\<sigma>\<^sub>X"
[PROOF STATE]
proof (prove)
using this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X

goal (1 subgoal):
 1. g\<^sub>X (\<sigma> |` X) \<preceq> \<sigma> |` X
[PROOF STEP]
by (metis \<open>dom (\<sigma> |` X) = X\<close> change_respecting.simps)
[PROOF STATE]
proof (state)
this:
g\<^sub>X (\<sigma> |` X) \<preceq> \<sigma> |` X

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
g \<sigma> = g\<^sub>X (\<sigma> |` X)
g\<^sub>X (\<sigma> |` X) \<preceq> \<sigma> |` X
[PROOF STEP]
show "g \<sigma> \<preceq> \<sigma>"
[PROOF STATE]
proof (prove)
using this:
g \<sigma> = g\<^sub>X (\<sigma> |` X)
g\<^sub>X (\<sigma> |` X) \<preceq> \<sigma> |` X

goal (1 subgoal):
 1. g \<sigma> \<preceq> \<sigma>
[PROOF STEP]
unfolding func_le_def
[PROOF STATE]
proof (prove)
using this:
g \<sigma> = g\<^sub>X (\<sigma> |` X)
\<forall>x\<in>dom (g\<^sub>X (\<sigma> |` X)). g\<^sub>X (\<sigma> |` X) x = (\<sigma> |` X) x

goal (1 subgoal):
 1. \<forall>x\<in>dom (g \<sigma>). g \<sigma> x = \<sigma> x
[PROOF STEP]
by (auto, metis \<open>dom (\<sigma> |` X) = X\<close> domI restrict_in)
[PROOF STATE]
proof (state)
this:
g \<sigma> \<preceq> \<sigma>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
g \<sigma> \<preceq> \<sigma>

goal (2 subgoals):
 1. \<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 2. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
next \<comment> \<open>This part proves that the domain of the family is unique\<close>
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 2. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
{
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 2. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
fix \<sigma>' :: "'Var \<rightharpoonup> 'Val"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 2. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
assume "dom \<sigma>' = insert x X"
[PROOF STATE]
proof (state)
this:
dom \<sigma>' = insert x X

goal (2 subgoals):
 1. \<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 2. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
let ?\<sigma>'\<^sub>X = "\<sigma>' |` X"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 2. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
have "dom ?\<sigma>'\<^sub>X = X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dom (\<sigma>' |` X) = X
[PROOF STEP]
by (metis \<open>dom (\<sigma> |` X) = X\<close> \<open>dom \<sigma> = insert x X\<close> \<open>dom \<sigma>' = insert x X\<close> dom_restrict)
        \<comment> \<open>We first show, that we are always in the same case of the no read assumption:\<close>
[PROOF STATE]
proof (state)
this:
dom (\<sigma>' |` X) = X

goal (2 subgoals):
 1. \<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 2. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
have same_case:
          "((\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X] (x := v)\<rangle>) \<and>
            (\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>'\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>'\<^sub>X] (x := v)\<rangle>))
           \<or>
           ((\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X]\<rangle>) \<and>
            (\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>'\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>'\<^sub>X]\<rangle>))"
          (is "(?N \<and> ?N') \<or> (?O \<and> ?O')")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)
[PROOF STEP]
proof -
          \<comment> \<open>By deriving a contradiction under the assumption that we are in different cases:\<close>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)
[PROOF STEP]
have not_different:
            "\<And> h h'. \<lbrakk> dom h = insert x X; dom h' = insert x X;
                        \<forall> v. \<langle>c, mds, mem [\<mapsto> h |` X] (x := v)\<rangle> \<leadsto>
                             \<langle>c', mds', mem' [\<mapsto> g\<^sub>X (h |` X)] (x := v)\<rangle>;
                        \<forall> v. \<langle>c, mds, mem [\<mapsto> h' |` X] (x := v)\<rangle> \<leadsto>
                             \<langle>c', mds', mem' [\<mapsto> g\<^sub>X (h' |` X)]\<rangle> \<rbrakk>
                      \<Longrightarrow> False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
proof -
            \<comment> \<open>Introduce new names to avoid clashes with functions in the outer scope.\<close>
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
fix h h' :: "'Var \<rightharpoonup> 'Val"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume doms: "dom h = insert x X" "dom h' = insert x X"
[PROOF STATE]
proof (state)
this:
dom h = insert x X
dom h' = insert x X

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume nowrite: "\<forall> v. \<langle>c, mds, mem [\<mapsto> h |` X] (x := v)\<rangle> \<leadsto>
              \<langle>c', mds', mem' [\<mapsto> g\<^sub>X (h |` X)] (x := v)\<rangle>"
[PROOF STATE]
proof (state)
this:
\<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
assume overwrite: "\<forall> v. \<langle>c, mds, mem [\<mapsto> h' |` X] (x := v)\<rangle> \<leadsto>
              \<langle>c', mds', mem' [\<mapsto> g\<^sub>X (h' |` X)]\<rangle>"
[PROOF STATE]
proof (state)
this:
\<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
let ?h\<^sub>X = "h |` X"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
let ?h'\<^sub>X = "h' |` X"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
have "dom ?h\<^sub>X = X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dom (h |` X) = X
[PROOF STEP]
by (metis \<open>dom (\<sigma> |` X) = X\<close> \<open>dom \<sigma> = insert x X\<close> dom_restrict doms(1))
[PROOF STATE]
proof (state)
this:
dom (h |` X) = X

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
have "dom ?h'\<^sub>X = X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dom (h' |` X) = X
[PROOF STEP]
by (metis \<open>dom (\<sigma> |` X) = X\<close> \<open>dom \<sigma> = insert x X\<close> dom_restrict doms(2))
[PROOF STATE]
proof (state)
this:
dom (h' |` X) = X

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
with IH
[PROOF STATE]
proof (chain)
picking this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X
dom (h' |` X) = X
[PROOF STEP]
have eval\<^sub>X': "\<langle>c, mds, mem [\<mapsto> ?h'\<^sub>X]\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?h'\<^sub>X]\<rangle>"
[PROOF STATE]
proof (prove)
using this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X
dom (h' |` X) = X

goal (1 subgoal):
 1. \<langle>c, mds, subst (h' |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>
[PROOF STEP]
unfolding change_respecting.simps
[PROOF STATE]
proof (prove)
using this:
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<and> (\<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> g\<^sub>X \<sigma> \<preceq> \<sigma>) \<and> (\<forall>\<sigma> \<sigma>'. dom \<sigma> = X \<and> dom \<sigma>' = X \<longrightarrow> dom (g\<^sub>X \<sigma>) = dom (g\<^sub>X \<sigma>')) \<and> (\<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X \<sigma>) mem'\<rangle>)
dom (h' |` X) = X

goal (1 subgoal):
 1. \<langle>c, mds, subst (h' |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, subst (h' |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
with \<open>doesnt_read c x\<close>
[PROOF STATE]
proof (chain)
picking this:
doesnt_read c x
\<langle>c, mds, subst (h' |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>
[PROOF STEP]
have noread\<^sub>x':
             "(\<forall> v. \<langle>c, mds, mem [\<mapsto> ?h'\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?h'\<^sub>X] (x := v)\<rangle>) \<or>
              (\<forall> v. \<langle>c, mds, mem [\<mapsto> ?h'\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?h'\<^sub>X]\<rangle>)"
[PROOF STATE]
proof (prove)
using this:
doesnt_read c x
\<langle>c, mds, subst (h' |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>)
[PROOF STEP]
unfolding doesnt_read_def
[PROOF STATE]
proof (prove)
using this:
\<forall>mds mem c' mds' mem'. \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<longrightarrow> (\<forall>v. \<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem'(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>)
\<langle>c, mds, subst (h' |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>)

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
from overwrite
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>
[PROOF STEP]
obtain v where
              "\<not> (\<langle>c, mds, mem [\<mapsto> h' |` X] (x := v)\<rangle> \<leadsto>
              \<langle>c', mds', mem' [\<mapsto> g\<^sub>X (h' |` X)] (x := v)\<rangle>)"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>

goal (1 subgoal):
 1. (\<And>v. (\<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle>, \<langle>c', mds', (subst (g\<^sub>X (h' |` X)) mem')(x := v)\<rangle>) \<notin> eval \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis \<open>doesnt_read c x\<close> doesnt_read_mutually_exclusive fun_upd_triv)
[PROOF STATE]
proof (state)
this:
(\<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle>, \<langle>c', mds', (subst (g\<^sub>X (h' |` X)) mem')(x := v)\<rangle>) \<notin> eval

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(\<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle>, \<langle>c', mds', (subst (g\<^sub>X (h' |` X)) mem')(x := v)\<rangle>) \<notin> eval

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
have "x \<notin> dom (?h'\<^sub>X)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<notin> dom (h' |` X)
[PROOF STEP]
by (metis \<open>dom (h' |` X) = X\<close> insert(2))
[PROOF STATE]
proof (state)
this:
x \<notin> dom (h' |` X)

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
with IH
[PROOF STATE]
proof (chain)
picking this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X
x \<notin> dom (h' |` X)
[PROOF STEP]
have "x \<notin> dom (g\<^sub>X ?h'\<^sub>X)"
[PROOF STATE]
proof (prove)
using this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X
x \<notin> dom (h' |` X)

goal (1 subgoal):
 1. x \<notin> dom (g\<^sub>X (h' |` X))
[PROOF STEP]
by (metis \<open>dom (h' |` X) = X\<close> change_respecting.simps func_le_dom rev_subsetD)
[PROOF STATE]
proof (state)
this:
x \<notin> dom (g\<^sub>X (h' |` X))

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(\<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle>, \<langle>c', mds', (subst (g\<^sub>X (h' |` X)) mem')(x := v)\<rangle>) \<notin> eval
x \<notin> dom (g\<^sub>X (h' |` X))
[PROOF STEP]
have "mem' x \<noteq> v"
[PROOF STATE]
proof (prove)
using this:
(\<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle>, \<langle>c', mds', (subst (g\<^sub>X (h' |` X)) mem')(x := v)\<rangle>) \<notin> eval
x \<notin> dom (g\<^sub>X (h' |` X))

goal (1 subgoal):
 1. mem' x \<noteq> v
[PROOF STEP]
by (metis fun_upd_triv overwrite subst_not_in_dom)
[PROOF STATE]
proof (state)
this:
mem' x \<noteq> v

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
let ?mem\<^sub>v = "mem (x := v)"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
obtain mem\<^sub>v' where "\<langle>c, mds, ?mem\<^sub>v\<rangle> \<leadsto> \<langle>c', mds', mem\<^sub>v'\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>mem\<^sub>v'. \<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem\<^sub>v'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using insert \<open>doesnt_read c x\<close>
[PROOF STATE]
proof (prove)
using this:
finite X
x \<notin> X
\<lbrakk>\<langle>c, mds, ?mem5\<rangle> \<leadsto> \<langle>c', mds', ?mem'5\<rangle>; \<forall>a\<in>X. doesnt_read c a\<rbrakk> \<Longrightarrow> \<exists>a. change_respecting \<langle>c, mds, ?mem5\<rangle> \<langle>c', mds', ?mem'5\<rangle> X a
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
\<forall>a\<in>insert x X. doesnt_read c a
doesnt_read c x

goal (1 subgoal):
 1. (\<And>mem\<^sub>v'. \<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem\<^sub>v'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding doesnt_read_def
[PROOF STATE]
proof (prove)
using this:
finite X
x \<notin> X
\<lbrakk>\<langle>c, mds, ?mem5\<rangle> \<leadsto> \<langle>c', mds', ?mem'5\<rangle>; \<forall>a\<in>X. \<forall>mds mem c' mds' mem'. \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<longrightarrow> (\<forall>v. \<langle>c, mds, mem(a := v)\<rangle> \<leadsto> \<langle>c', mds', mem'(a := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, mem(a := v)\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>)\<rbrakk> \<Longrightarrow> \<exists>a. change_respecting \<langle>c, mds, ?mem5\<rangle> \<langle>c', mds', ?mem'5\<rangle> X a
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>
\<forall>a\<in>insert x X. \<forall>mds mem c' mds' mem'. \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<longrightarrow> (\<forall>v. \<langle>c, mds, mem(a := v)\<rangle> \<leadsto> \<langle>c', mds', mem'(a := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, mem(a := v)\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>)
\<forall>mds mem c' mds' mem'. \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<longrightarrow> (\<forall>v. \<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem'(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>)

goal (1 subgoal):
 1. (\<And>mem\<^sub>v'. \<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem\<^sub>v'\<rangle> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (auto, metis)
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem\<^sub>v'\<rangle>

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem\<^sub>v'\<rangle>

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
have "\<forall> x \<in> X. doesnt_read c x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>X. doesnt_read c x
[PROOF STEP]
by (metis insert(5) insert_iff)
[PROOF STATE]
proof (state)
this:
\<forall>x\<in>X. doesnt_read c x

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem\<^sub>v'\<rangle>
\<forall>x\<in>X. doesnt_read c x
[PROOF STEP]
obtain g\<^sub>v where
              IH\<^sub>v: "change_respecting \<langle>c, mds, ?mem\<^sub>v\<rangle> \<langle>c', mds', mem\<^sub>v'\<rangle> X g\<^sub>v"
[PROOF STATE]
proof (prove)
using this:
\<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem\<^sub>v'\<rangle>
\<forall>x\<in>X. doesnt_read c x

goal (1 subgoal):
 1. (\<And>g\<^sub>v. change_respecting \<langle>c, mds, mem(x := v)\<rangle> \<langle>c', mds', mem\<^sub>v'\<rangle> X g\<^sub>v \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis insert(3))
[PROOF STATE]
proof (state)
this:
change_respecting \<langle>c, mds, mem(x := v)\<rangle> \<langle>c', mds', mem\<^sub>v'\<rangle> X g\<^sub>v

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
hence eval\<^sub>v: "\<langle>c, mds, ?mem\<^sub>v [\<mapsto> ?h\<^sub>X]\<rangle> \<leadsto> \<langle>c', mds', mem\<^sub>v' [\<mapsto> g\<^sub>v ?h\<^sub>X]\<rangle>"
                         "\<langle>c, mds, ?mem\<^sub>v [\<mapsto> ?h'\<^sub>X]\<rangle> \<leadsto> \<langle>c', mds', mem\<^sub>v' [\<mapsto> g\<^sub>v ?h'\<^sub>X]\<rangle>"
[PROOF STATE]
proof (prove)
using this:
change_respecting \<langle>c, mds, mem(x := v)\<rangle> \<langle>c', mds', mem\<^sub>v'\<rangle> X g\<^sub>v

goal (1 subgoal):
 1. \<langle>c, mds, subst (h |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h |` X)) mem\<^sub>v'\<rangle> &&& \<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle>
[PROOF STEP]
apply (metis \<open>dom (h |` X) = X\<close> change_respecting.simps)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle>
[PROOF STEP]
by (metis IH\<^sub>v \<open>dom (h' |` X) = X\<close> change_respecting.simps)
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, subst (h |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h |` X)) mem\<^sub>v'\<rangle>
\<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle>

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
from eval\<^sub>v(1)
[PROOF STATE]
proof (chain)
picking this:
\<langle>c, mds, subst (h |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h |` X)) mem\<^sub>v'\<rangle>
[PROOF STEP]
have "mem\<^sub>v' x = v"
[PROOF STATE]
proof (prove)
using this:
\<langle>c, mds, subst (h |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h |` X)) mem\<^sub>v'\<rangle>

goal (1 subgoal):
 1. mem\<^sub>v' x = v
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<langle>c, mds, subst (h |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = v
[PROOF STEP]
assume "\<langle>c, mds, mem (x := v) [\<mapsto> ?h\<^sub>X]\<rangle> \<leadsto> \<langle>c', mds', mem\<^sub>v' [\<mapsto> g\<^sub>v ?h\<^sub>X]\<rangle>"
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, subst (h |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h |` X)) mem\<^sub>v'\<rangle>

goal (1 subgoal):
 1. \<langle>c, mds, subst (h |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = v
[PROOF STEP]
have "?mem\<^sub>v [\<mapsto> ?h\<^sub>X] = mem [\<mapsto> ?h\<^sub>X] (x := v)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. subst (h |` X) (mem(x := v)) = (subst (h |` X) mem)(x := v)
[PROOF STEP]
apply (rule ext, rename_tac y)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y. subst (h |` X) (mem(x := v)) y = ((subst (h |` X) mem)(x := v)) y
[PROOF STEP]
apply (case_tac "y = x")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>y. y = x \<Longrightarrow> subst (h |` X) (mem(x := v)) y = ((subst (h |` X) mem)(x := v)) y
 2. \<And>y. y \<noteq> x \<Longrightarrow> subst (h |` X) (mem(x := v)) y = ((subst (h |` X) mem)(x := v)) y
[PROOF STEP]
apply (auto simp: subst_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. (case (h |` X) x of None \<Rightarrow> (mem(x := v)) x | Some v \<Rightarrow> v) = v
 2. \<And>y. y \<noteq> x \<Longrightarrow> (case (h |` X) y of None \<Rightarrow> (mem(x := v)) y | Some v \<Rightarrow> v) = (case (h |` X) y of None \<Rightarrow> mem y | Some v \<Rightarrow> v)
[PROOF STEP]
apply (metis (full_types) \<open>dom (h |` X) = X\<close> fun_upd_def
                  insert(2) subst_def subst_not_in_dom)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y. y \<noteq> x \<Longrightarrow> (case (h |` X) y of None \<Rightarrow> (mem(x := v)) y | Some v \<Rightarrow> v) = (case (h |` X) y of None \<Rightarrow> mem y | Some v \<Rightarrow> v)
[PROOF STEP]
by (metis fun_upd_other)
[PROOF STATE]
proof (state)
this:
subst (h |` X) (mem(x := v)) = (subst (h |` X) mem)(x := v)

goal (1 subgoal):
 1. \<langle>c, mds, subst (h |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = v
[PROOF STEP]
with nowrite
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>
subst (h |` X) (mem(x := v)) = (subst (h |` X) mem)(x := v)
[PROOF STEP]
have "mem\<^sub>v' [\<mapsto> g\<^sub>v ?h\<^sub>X] = mem' [\<mapsto> g\<^sub>X ?h\<^sub>X] (x := v)"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>
subst (h |` X) (mem(x := v)) = (subst (h |` X) mem)(x := v)

goal (1 subgoal):
 1. subst (g\<^sub>v (h |` X)) mem\<^sub>v' = (subst (g\<^sub>X (h |` X)) mem')(x := v)
[PROOF STEP]
using deterministic
[PROOF STATE]
proof (prove)
using this:
\<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>
subst (h |` X) (mem(x := v)) = (subst (h |` X) mem)(x := v)
\<lbrakk>?lc \<leadsto> ?lc'; ?lc \<leadsto> ?lc''\<rbrakk> \<Longrightarrow> ?lc' = ?lc''

goal (1 subgoal):
 1. subst (g\<^sub>v (h |` X)) mem\<^sub>v' = (subst (g\<^sub>X (h |` X)) mem')(x := v)
[PROOF STEP]
by (erule_tac x = v in allE, auto, metis eval\<^sub>v(1))
[PROOF STATE]
proof (state)
this:
subst (g\<^sub>v (h |` X)) mem\<^sub>v' = (subst (g\<^sub>X (h |` X)) mem')(x := v)

goal (1 subgoal):
 1. \<langle>c, mds, subst (h |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = v
[PROOF STEP]
hence "mem\<^sub>v' [\<mapsto> g\<^sub>v ?h\<^sub>X] x = v"
[PROOF STATE]
proof (prove)
using this:
subst (g\<^sub>v (h |` X)) mem\<^sub>v' = (subst (g\<^sub>X (h |` X)) mem')(x := v)

goal (1 subgoal):
 1. subst (g\<^sub>v (h |` X)) mem\<^sub>v' x = v
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
subst (g\<^sub>v (h |` X)) mem\<^sub>v' x = v

goal (1 subgoal):
 1. \<langle>c, mds, subst (h |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = v
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
subst (g\<^sub>v (h |` X)) mem\<^sub>v' x = v

goal (1 subgoal):
 1. \<langle>c, mds, subst (h |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = v
[PROOF STEP]
have "x \<notin> dom (g\<^sub>v ?h\<^sub>X)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<notin> dom (g\<^sub>v (h |` X))
[PROOF STEP]
using IH\<^sub>v \<open>dom ?h\<^sub>X = X\<close> change_respecting_dom
[PROOF STATE]
proof (prove)
using this:
change_respecting \<langle>c, mds, mem(x := v)\<rangle> \<langle>c', mds', mem\<^sub>v'\<rangle> X g\<^sub>v
dom (h |` X) = X
\<lbrakk>change_respecting (?cms, ?mem) (?cms', ?mem') ?X ?g; dom ?\<sigma> = ?X\<rbrakk> \<Longrightarrow> dom (?g ?\<sigma>) \<subseteq> ?X

goal (1 subgoal):
 1. x \<notin> dom (g\<^sub>v (h |` X))
[PROOF STEP]
by (metis func_le_dom insert(2) rev_subsetD)
[PROOF STATE]
proof (state)
this:
x \<notin> dom (g\<^sub>v (h |` X))

goal (1 subgoal):
 1. \<langle>c, mds, subst (h |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = v
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
subst (g\<^sub>v (h |` X)) mem\<^sub>v' x = v
x \<notin> dom (g\<^sub>v (h |` X))
[PROOF STEP]
show "mem\<^sub>v' x = v"
[PROOF STATE]
proof (prove)
using this:
subst (g\<^sub>v (h |` X)) mem\<^sub>v' x = v
x \<notin> dom (g\<^sub>v (h |` X))

goal (1 subgoal):
 1. mem\<^sub>v' x = v
[PROOF STEP]
by (metis subst_not_in_dom)
[PROOF STATE]
proof (state)
this:
mem\<^sub>v' x = v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
mem\<^sub>v' x = v

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
mem\<^sub>v' x = v

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
from eval\<^sub>v(2)
[PROOF STATE]
proof (chain)
picking this:
\<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle>
[PROOF STEP]
have "mem\<^sub>v' x = mem' x"
[PROOF STATE]
proof (prove)
using this:
\<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle>

goal (1 subgoal):
 1. mem\<^sub>v' x = mem' x
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = mem' x
[PROOF STEP]
assume "\<langle>c, mds, ?mem\<^sub>v [\<mapsto> ?h'\<^sub>X]\<rangle> \<leadsto> \<langle>c', mds', mem\<^sub>v' [\<mapsto> g\<^sub>v ?h'\<^sub>X]\<rangle>"
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle>

goal (1 subgoal):
 1. \<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = mem' x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle>

goal (1 subgoal):
 1. \<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = mem' x
[PROOF STEP]
from overwrite
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>
[PROOF STEP]
have
                "\<langle>c, mds, mem [\<mapsto> ?h'\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?h'\<^sub>X]\<rangle>"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>

goal (1 subgoal):
 1. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>

goal (1 subgoal):
 1. \<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = mem' x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>

goal (1 subgoal):
 1. \<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = mem' x
[PROOF STEP]
have "?mem\<^sub>v [\<mapsto> ?h'\<^sub>X] = mem [\<mapsto> ?h'\<^sub>X] (x := v)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. subst (h' |` X) (mem(x := v)) = (subst (h' |` X) mem)(x := v)
[PROOF STEP]
apply (rule ext, rename_tac "y")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y. subst (h' |` X) (mem(x := v)) y = ((subst (h' |` X) mem)(x := v)) y
[PROOF STEP]
apply (case_tac "y = x")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>y. y = x \<Longrightarrow> subst (h' |` X) (mem(x := v)) y = ((subst (h' |` X) mem)(x := v)) y
 2. \<And>y. y \<noteq> x \<Longrightarrow> subst (h' |` X) (mem(x := v)) y = ((subst (h' |` X) mem)(x := v)) y
[PROOF STEP]
apply (metis \<open>x \<notin> dom (h' |` X)\<close> fun_upd_apply subst_not_in_dom)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y. y \<noteq> x \<Longrightarrow> subst (h' |` X) (mem(x := v)) y = ((subst (h' |` X) mem)(x := v)) y
[PROOF STEP]
apply (auto simp: subst_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y. y \<noteq> x \<Longrightarrow> (case (h' |` X) y of None \<Rightarrow> (mem(x := v)) y | Some v \<Rightarrow> v) = (case (h' |` X) y of None \<Rightarrow> mem y | Some v \<Rightarrow> v)
[PROOF STEP]
by (metis fun_upd_other)
[PROOF STATE]
proof (state)
this:
subst (h' |` X) (mem(x := v)) = (subst (h' |` X) mem)(x := v)

goal (1 subgoal):
 1. \<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = mem' x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle>
\<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>
subst (h' |` X) (mem(x := v)) = (subst (h' |` X) mem)(x := v)
[PROOF STEP]
have "mem' [\<mapsto> g\<^sub>X ?h'\<^sub>X] = mem\<^sub>v' [\<mapsto> g\<^sub>v ?h'\<^sub>X]"
[PROOF STATE]
proof (prove)
using this:
\<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle>
\<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>
subst (h' |` X) (mem(x := v)) = (subst (h' |` X) mem)(x := v)

goal (1 subgoal):
 1. subst (g\<^sub>X (h' |` X)) mem' = subst (g\<^sub>v (h' |` X)) mem\<^sub>v'
[PROOF STEP]
using deterministic
[PROOF STATE]
proof (prove)
using this:
\<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle>
\<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>
subst (h' |` X) (mem(x := v)) = (subst (h' |` X) mem)(x := v)
\<lbrakk>?lc \<leadsto> ?lc'; ?lc \<leadsto> ?lc''\<rbrakk> \<Longrightarrow> ?lc' = ?lc''

goal (1 subgoal):
 1. subst (g\<^sub>X (h' |` X)) mem' = subst (g\<^sub>v (h' |` X)) mem\<^sub>v'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
subst (g\<^sub>X (h' |` X)) mem' = subst (g\<^sub>v (h' |` X)) mem\<^sub>v'

goal (1 subgoal):
 1. \<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = mem' x
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
subst (g\<^sub>X (h' |` X)) mem' = subst (g\<^sub>v (h' |` X)) mem\<^sub>v'

goal (1 subgoal):
 1. \<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = mem' x
[PROOF STEP]
have "x \<notin> dom (g\<^sub>v ?h'\<^sub>X)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<notin> dom (g\<^sub>v (h' |` X))
[PROOF STEP]
using IH\<^sub>v \<open>dom ?h'\<^sub>X = X\<close> change_respecting_dom
[PROOF STATE]
proof (prove)
using this:
change_respecting \<langle>c, mds, mem(x := v)\<rangle> \<langle>c', mds', mem\<^sub>v'\<rangle> X g\<^sub>v
dom (h' |` X) = X
\<lbrakk>change_respecting (?cms, ?mem) (?cms', ?mem') ?X ?g; dom ?\<sigma> = ?X\<rbrakk> \<Longrightarrow> dom (?g ?\<sigma>) \<subseteq> ?X

goal (1 subgoal):
 1. x \<notin> dom (g\<^sub>v (h' |` X))
[PROOF STEP]
by (metis func_le_dom insert(2) subsetD)
[PROOF STATE]
proof (state)
this:
x \<notin> dom (g\<^sub>v (h' |` X))

goal (1 subgoal):
 1. \<langle>c, mds, subst (h' |` X) (mem(x := v))\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>v (h' |` X)) mem\<^sub>v'\<rangle> \<Longrightarrow> mem\<^sub>v' x = mem' x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
subst (g\<^sub>X (h' |` X)) mem' = subst (g\<^sub>v (h' |` X)) mem\<^sub>v'
x \<notin> dom (g\<^sub>v (h' |` X))
[PROOF STEP]
show "mem\<^sub>v' x = mem' x"
[PROOF STATE]
proof (prove)
using this:
subst (g\<^sub>X (h' |` X)) mem' = subst (g\<^sub>v (h' |` X)) mem\<^sub>v'
x \<notin> dom (g\<^sub>v (h' |` X))

goal (1 subgoal):
 1. mem\<^sub>v' x = mem' x
[PROOF STEP]
using \<open>x \<notin> dom (g\<^sub>X ?h'\<^sub>X)\<close>
[PROOF STATE]
proof (prove)
using this:
subst (g\<^sub>X (h' |` X)) mem' = subst (g\<^sub>v (h' |` X)) mem\<^sub>v'
x \<notin> dom (g\<^sub>v (h' |` X))
x \<notin> dom (g\<^sub>X (h' |` X))

goal (1 subgoal):
 1. mem\<^sub>v' x = mem' x
[PROOF STEP]
by (metis subst_not_in_dom)
[PROOF STATE]
proof (state)
this:
mem\<^sub>v' x = mem' x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
mem\<^sub>v' x = mem' x

goal (1 subgoal):
 1. \<And>h h'. \<lbrakk>dom h = insert x X; dom h' = insert x X; \<forall>v. \<langle>c, mds, (subst (h |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (h |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (h' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (h' |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
mem\<^sub>v' x = v
mem\<^sub>v' x = mem' x
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>v' x = v
mem\<^sub>v' x = mem' x

goal (1 subgoal):
 1. False
[PROOF STEP]
using \<open>mem' x \<noteq> v\<close>
[PROOF STATE]
proof (prove)
using this:
mem\<^sub>v' x = v
mem\<^sub>v' x = mem' x
mem' x \<noteq> v

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>dom ?h5 = insert x X; dom ?h'5 = insert x X; \<forall>v. \<langle>c, mds, (subst (?h5 |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (?h5 |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (?h'5 |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (?h'5 |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<lbrakk>dom ?h5 = insert x X; dom ?h'5 = insert x X; \<forall>v. \<langle>c, mds, (subst (?h5 |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (?h5 |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (?h'5 |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (?h'5 |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)
[PROOF STEP]
have "dom ?\<sigma>'\<^sub>X = X"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. dom (\<sigma>' |` X) = X
[PROOF STEP]
by (metis \<open>dom (\<sigma> |` X) = X\<close> \<open>dom \<sigma> = insert x X\<close> \<open>dom \<sigma>' = insert x X\<close> dom_restrict)
[PROOF STATE]
proof (state)
this:
dom (\<sigma>' |` X) = X

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)
[PROOF STEP]
with IH
[PROOF STATE]
proof (chain)
picking this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X
dom (\<sigma>' |` X) = X
[PROOF STEP]
have eval\<^sub>X': "\<langle>c, mds, mem [\<mapsto> ?\<sigma>'\<^sub>X]\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>'\<^sub>X]\<rangle>"
[PROOF STATE]
proof (prove)
using this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X
dom (\<sigma>' |` X) = X

goal (1 subgoal):
 1. \<langle>c, mds, subst (\<sigma>' |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>
[PROOF STEP]
unfolding change_respecting.simps
[PROOF STATE]
proof (prove)
using this:
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<and> (\<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> g\<^sub>X \<sigma> \<preceq> \<sigma>) \<and> (\<forall>\<sigma> \<sigma>'. dom \<sigma> = X \<and> dom \<sigma>' = X \<longrightarrow> dom (g\<^sub>X \<sigma>) = dom (g\<^sub>X \<sigma>')) \<and> (\<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X \<sigma>) mem'\<rangle>)
dom (\<sigma>' |` X) = X

goal (1 subgoal):
 1. \<langle>c, mds, subst (\<sigma>' |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, subst (\<sigma>' |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)
[PROOF STEP]
with \<open>doesnt_read c x\<close>
[PROOF STATE]
proof (chain)
picking this:
doesnt_read c x
\<langle>c, mds, subst (\<sigma>' |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>
[PROOF STEP]
have noread\<^sub>x':
             "(\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>'\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>'\<^sub>X] (x := v)\<rangle>)
              \<or>
              (\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>'\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>'\<^sub>X]\<rangle>)"
[PROOF STATE]
proof (prove)
using this:
doesnt_read c x
\<langle>c, mds, subst (\<sigma>' |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)
[PROOF STEP]
unfolding doesnt_read_def
[PROOF STATE]
proof (prove)
using this:
\<forall>mds mem c' mds' mem'. \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<longrightarrow> (\<forall>v. \<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem'(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, mem(x := v)\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>)
\<langle>c, mds, subst (\<sigma>' |` X) mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>dom ?h5 = insert x X; dom ?h'5 = insert x X; \<forall>v. \<langle>c, mds, (subst (?h5 |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (?h5 |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (?h'5 |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (?h'5 |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
(\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>dom ?h5 = insert x X; dom ?h'5 = insert x X; \<forall>v. \<langle>c, mds, (subst (?h5 |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (?h5 |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (?h'5 |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (?h'5 |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
(\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)
[PROOF STEP]
using noread\<^sub>x not_different \<open>dom \<sigma> = insert x X\<close> \<open>dom \<sigma>' = insert x X\<close>
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>dom ?h5 = insert x X; dom ?h'5 = insert x X; \<forall>v. \<langle>c, mds, (subst (?h5 |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (?h5 |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (?h'5 |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (?h'5 |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
(\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>)
\<lbrakk>dom ?h5 = insert x X; dom ?h'5 = insert x X; \<forall>v. \<langle>c, mds, (subst (?h5 |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (?h5 |` X)) mem')(x := v)\<rangle>; \<forall>v. \<langle>c, mds, (subst (?h'5 |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (?h'5 |` X)) mem'\<rangle>\<rbrakk> \<Longrightarrow> False
dom \<sigma> = insert x X
dom \<sigma>' = insert x X

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)

goal (2 subgoals):
 1. \<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 2. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
hence "dom (g \<sigma>) = dom (g \<sigma>')"
[PROOF STATE]
proof (prove)
using this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)

goal (1 subgoal):
 1. dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<Longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 2. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>) \<Longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
assume
            "(\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X] (x := v)\<rangle>) \<and>
            (\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>'\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>'\<^sub>X] (x := v)\<rangle>)"
[PROOF STATE]
proof (state)
this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>)

goal (2 subgoals):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<Longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 2. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>) \<Longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
hence g_simp [simp]: "g \<sigma> = (\<lambda> y. if y = x then \<sigma> y else g\<^sub>X ?\<sigma>\<^sub>X y) \<and>
                                g \<sigma>' = (\<lambda> y. if y = x then \<sigma>' y else g\<^sub>X ?\<sigma>'\<^sub>X y)"
[PROOF STATE]
proof (prove)
using this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>)

goal (1 subgoal):
 1. g \<sigma> = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y) \<and> g \<sigma>' = (\<lambda>y. if y = x then \<sigma>' y else g\<^sub>X (\<sigma>' |` X) y)
[PROOF STEP]
unfolding g_def
[PROOF STATE]
proof (prove)
using this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>)

goal (1 subgoal):
 1. (let \<sigma>' = \<sigma> |` X in if \<forall>v. \<langle>c, mds, (subst \<sigma>' mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X \<sigma>') mem')(x := v)\<rangle> then \<lambda>y. if x = y then \<sigma> y else g\<^sub>X \<sigma>' y else g\<^sub>X \<sigma>') = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y) \<and> (let \<sigma>'' = \<sigma>' |` X in if \<forall>v. \<langle>c, mds, (subst \<sigma>'' mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X \<sigma>'') mem')(x := v)\<rangle> then \<lambda>y. if x = y then \<sigma>' y else g\<^sub>X \<sigma>'' y else g\<^sub>X \<sigma>'') = (\<lambda>y. if y = x then \<sigma>' y else g\<^sub>X (\<sigma>' |` X) y)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
g \<sigma> = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y) \<and> g \<sigma>' = (\<lambda>y. if y = x then \<sigma>' y else g\<^sub>X (\<sigma>' |` X) y)

goal (2 subgoals):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>) \<Longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 2. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>) \<Longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
g \<sigma> = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y) \<and> g \<sigma>' = (\<lambda>y. if y = x then \<sigma>' y else g\<^sub>X (\<sigma>' |` X) y)

goal (1 subgoal):
 1. dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
using IH \<open>dom \<sigma> = insert x X\<close> \<open>dom \<sigma>' = insert x X\<close>
[PROOF STATE]
proof (prove)
using this:
g \<sigma> = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y) \<and> g \<sigma>' = (\<lambda>y. if y = x then \<sigma>' y else g\<^sub>X (\<sigma>' |` X) y)
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X
dom \<sigma> = insert x X
dom \<sigma>' = insert x X

goal (1 subgoal):
 1. dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
unfolding change_respecting.simps
[PROOF STATE]
proof (prove)
using this:
g \<sigma> = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y) \<and> g \<sigma>' = (\<lambda>y. if y = x then \<sigma>' y else g\<^sub>X (\<sigma>' |` X) y)
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<and> (\<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> g\<^sub>X \<sigma> \<preceq> \<sigma>) \<and> (\<forall>\<sigma> \<sigma>'. dom \<sigma> = X \<and> dom \<sigma>' = X \<longrightarrow> dom (g\<^sub>X \<sigma>) = dom (g\<^sub>X \<sigma>')) \<and> (\<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X \<sigma>) mem'\<rangle>)
dom \<sigma> = insert x X
dom \<sigma>' = insert x X

goal (1 subgoal):
 1. dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
apply (auto simp: domD)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>xa y. \<lbrakk>dom \<sigma> = insert x X; dom \<sigma>' = insert x X; \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; \<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> g\<^sub>X \<sigma> \<preceq> \<sigma>; \<forall>\<sigma> \<sigma>'. dom \<sigma> = X \<and> dom \<sigma>' = X \<longrightarrow> dom (g\<^sub>X \<sigma>) = dom (g\<^sub>X \<sigma>'); \<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X \<sigma>) mem'\<rangle>; g\<^sub>X (\<sigma> |` X) xa = Some y; xa \<noteq> x\<rbrakk> \<Longrightarrow> \<exists>y. g\<^sub>X (\<sigma>' |` X) xa = Some y
 2. \<And>xa y. \<lbrakk>dom \<sigma> = insert x X; dom \<sigma>' = insert x X; \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; \<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> g\<^sub>X \<sigma> \<preceq> \<sigma>; \<forall>\<sigma> \<sigma>'. dom \<sigma> = X \<and> dom \<sigma>' = X \<longrightarrow> dom (g\<^sub>X \<sigma>) = dom (g\<^sub>X \<sigma>'); \<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X \<sigma>) mem'\<rangle>; g\<^sub>X (\<sigma>' |` X) xa = Some y; xa \<noteq> x\<rbrakk> \<Longrightarrow> \<exists>y. g\<^sub>X (\<sigma> |` X) xa = Some y
[PROOF STEP]
apply (metis \<open>dom (\<sigma> |` X) = X\<close> \<open>dom (\<sigma>' |` X) = X\<close> domD domI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>xa y. \<lbrakk>dom \<sigma> = insert x X; dom \<sigma>' = insert x X; \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; \<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> g\<^sub>X \<sigma> \<preceq> \<sigma>; \<forall>\<sigma> \<sigma>'. dom \<sigma> = X \<and> dom \<sigma>' = X \<longrightarrow> dom (g\<^sub>X \<sigma>) = dom (g\<^sub>X \<sigma>'); \<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X \<sigma>) mem'\<rangle>; g\<^sub>X (\<sigma>' |` X) xa = Some y; xa \<noteq> x\<rbrakk> \<Longrightarrow> \<exists>y. g\<^sub>X (\<sigma> |` X) xa = Some y
[PROOF STEP]
by (metis \<open>dom (\<sigma> |` X) = X\<close> \<open>dom (\<sigma>' |` X) = X\<close> domD domI)
[PROOF STATE]
proof (state)
this:
dom (g \<sigma>) = dom (g \<sigma>')

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>) \<Longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>) \<Longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
assume
            "(\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X]\<rangle>) \<and>
            (\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>'\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>'\<^sub>X]\<rangle>)"
[PROOF STATE]
proof (state)
this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>) \<Longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
hence
            "\<not> (\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X] (x := v)\<rangle>)
            \<and>
            \<not> (\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>'\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>'\<^sub>X] (x := v)\<rangle>)"
[PROOF STATE]
proof (prove)
using this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>)

goal (1 subgoal):
 1. \<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> \<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>)
[PROOF STEP]
by (metis \<open>doesnt_read c x\<close> doesnt_read_mutually_exclusive' fun_upd_triv)
[PROOF STATE]
proof (state)
this:
\<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> \<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>)

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>) \<Longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
hence g_simp [simp]: "g \<sigma> = g\<^sub>X ?\<sigma>\<^sub>X \<and> g \<sigma>' = g\<^sub>X ?\<sigma>'\<^sub>X"
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> \<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>)

goal (1 subgoal):
 1. g \<sigma> = g\<^sub>X (\<sigma> |` X) \<and> g \<sigma>' = g\<^sub>X (\<sigma>' |` X)
[PROOF STEP]
unfolding g_def
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<and> \<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma>' |` X)) mem')(x := v)\<rangle>)

goal (1 subgoal):
 1. (let \<sigma>' = \<sigma> |` X in if \<forall>v. \<langle>c, mds, (subst \<sigma>' mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X \<sigma>') mem')(x := v)\<rangle> then \<lambda>y. if x = y then \<sigma> y else g\<^sub>X \<sigma>' y else g\<^sub>X \<sigma>') = g\<^sub>X (\<sigma> |` X) \<and> (let \<sigma>'' = \<sigma>' |` X in if \<forall>v. \<langle>c, mds, (subst \<sigma>'' mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X \<sigma>'') mem')(x := v)\<rangle> then \<lambda>y. if x = y then \<sigma>' y else g\<^sub>X \<sigma>'' y else g\<^sub>X \<sigma>'') = g\<^sub>X (\<sigma>' |` X)
[PROOF STEP]
by (auto simp: Let_def)
[PROOF STATE]
proof (state)
this:
g \<sigma> = g\<^sub>X (\<sigma> |` X) \<and> g \<sigma>' = g\<^sub>X (\<sigma>' |` X)

goal (1 subgoal):
 1. (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>) \<and> (\<forall>v. \<langle>c, mds, (subst (\<sigma>' |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma>' |` X)) mem'\<rangle>) \<Longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
with IH
[PROOF STATE]
proof (chain)
picking this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X
g \<sigma> = g\<^sub>X (\<sigma> |` X) \<and> g \<sigma>' = g\<^sub>X (\<sigma>' |` X)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g\<^sub>X
g \<sigma> = g\<^sub>X (\<sigma> |` X) \<and> g \<sigma>' = g\<^sub>X (\<sigma>' |` X)

goal (1 subgoal):
 1. dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
unfolding change_respecting.simps
[PROOF STATE]
proof (prove)
using this:
\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle> \<and> (\<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> g\<^sub>X \<sigma> \<preceq> \<sigma>) \<and> (\<forall>\<sigma> \<sigma>'. dom \<sigma> = X \<and> dom \<sigma>' = X \<longrightarrow> dom (g\<^sub>X \<sigma>) = dom (g\<^sub>X \<sigma>')) \<and> (\<forall>\<sigma>. dom \<sigma> = X \<longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X \<sigma>) mem'\<rangle>)
g \<sigma> = g\<^sub>X (\<sigma> |` X) \<and> g \<sigma>' = g\<^sub>X (\<sigma>' |` X)

goal (1 subgoal):
 1. dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
by (metis \<open>dom (\<sigma> |` X) = X\<close> \<open>dom (\<sigma>' |` X) = X\<close>)
[PROOF STATE]
proof (state)
this:
dom (g \<sigma>) = dom (g \<sigma>')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
dom (g \<sigma>) = dom (g \<sigma>')

goal (2 subgoals):
 1. \<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 2. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
dom ?\<sigma>'7 = insert x X \<Longrightarrow> dom (g \<sigma>) = dom (g ?\<sigma>'7)

goal (2 subgoals):
 1. \<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
 2. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
thus "\<forall> \<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')"
[PROOF STATE]
proof (prove)
using this:
dom ?\<sigma>'7 = insert x X \<Longrightarrow> dom (g \<sigma>) = dom (g ?\<sigma>'7)

goal (1 subgoal):
 1. \<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')

goal (1 subgoal):
 1. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
(* Do a case distinction on the no-read statement: *)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
from noread\<^sub>x
[PROOF STATE]
proof (chain)
picking this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>)
[PROOF STEP]
show "\<langle>c, mds, mem [\<mapsto> \<sigma>]\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g \<sigma>]\<rangle>"
[PROOF STATE]
proof (prove)
using this:
(\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>) \<or> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>)

goal (1 subgoal):
 1. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
 2. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
assume nowrite:
          "\<forall> v. \<langle>c, mds, mem[\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X] (x := v)\<rangle>"
[PROOF STATE]
proof (state)
this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>

goal (2 subgoals):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
 2. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>
[PROOF STEP]
have g_simp [simp]: "g \<sigma> = (\<lambda> y. if y = x then \<sigma> y else g\<^sub>X ?\<sigma>\<^sub>X y)"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>

goal (1 subgoal):
 1. g \<sigma> = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y)
[PROOF STEP]
unfolding g_def
[PROOF STATE]
proof (prove)
using this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>

goal (1 subgoal):
 1. (let \<sigma>' = \<sigma> |` X in if \<forall>v. \<langle>c, mds, (subst \<sigma>' mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X \<sigma>') mem')(x := v)\<rangle> then \<lambda>y. if x = y then \<sigma> y else g\<^sub>X \<sigma>' y else g\<^sub>X \<sigma>') = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
g \<sigma> = (\<lambda>y. if y = x then \<sigma> y else g\<^sub>X (\<sigma> |` X) y)

goal (2 subgoals):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
 2. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
obtain v where "\<sigma> x = Some v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>v. \<sigma> x = Some v \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis \<open>dom \<sigma> = insert x X\<close> domD insertI1)
[PROOF STATE]
proof (state)
this:
\<sigma> x = Some v

goal (2 subgoals):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
 2. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
from nowrite
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>
[PROOF STEP]
have
          "\<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X] (x := v)\<rangle>"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>

goal (1 subgoal):
 1. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>

goal (2 subgoals):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
 2. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>

goal (2 subgoals):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
 2. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
have "mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v) = mem [\<mapsto> \<sigma>]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (subst (\<sigma> |` X) mem)(x := v) = subst \<sigma> mem
[PROOF STEP]
apply (rule ext, rename_tac y)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y. ((subst (\<sigma> |` X) mem)(x := v)) y = subst \<sigma> mem y
[PROOF STEP]
apply (case_tac "y = x")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>y. y = x \<Longrightarrow> ((subst (\<sigma> |` X) mem)(x := v)) y = subst \<sigma> mem y
 2. \<And>y. y \<noteq> x \<Longrightarrow> ((subst (\<sigma> |` X) mem)(x := v)) y = subst \<sigma> mem y
[PROOF STEP]
apply (auto simp: subst_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. v = (case \<sigma> x of None \<Rightarrow> mem x | Some v \<Rightarrow> v)
 2. \<And>y. y \<noteq> x \<Longrightarrow> (case (\<sigma> |` X) y of None \<Rightarrow> mem y | Some v \<Rightarrow> v) = (case \<sigma> y of None \<Rightarrow> mem y | Some v \<Rightarrow> v)
[PROOF STEP]
apply (metis \<open>\<sigma> x = Some v\<close> option.simps(5))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y. y \<noteq> x \<Longrightarrow> (case (\<sigma> |` X) y of None \<Rightarrow> mem y | Some v \<Rightarrow> v) = (case \<sigma> y of None \<Rightarrow> mem y | Some v \<Rightarrow> v)
[PROOF STEP]
by (metis \<open>dom (\<sigma> |` X) = X\<close> \<open>dom \<sigma> = insert x X\<close> insertE
            restrict_in subst_def subst_not_in_dom)
[PROOF STATE]
proof (state)
this:
(subst (\<sigma> |` X) mem)(x := v) = subst \<sigma> mem

goal (2 subgoals):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
 2. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(subst (\<sigma> |` X) mem)(x := v) = subst \<sigma> mem

goal (2 subgoals):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
 2. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
have "mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X] (x := v) = mem' [\<mapsto> g \<sigma>]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v) = subst (g \<sigma>) mem'
[PROOF STEP]
apply (rule ext, rename_tac y)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y. ((subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)) y = subst (g \<sigma>) mem' y
[PROOF STEP]
apply (case_tac "y = x")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>y. y = x \<Longrightarrow> ((subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)) y = subst (g \<sigma>) mem' y
 2. \<And>y. y \<noteq> x \<Longrightarrow> ((subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)) y = subst (g \<sigma>) mem' y
[PROOF STEP]
by (auto simp: subst_def option.simps \<open>\<sigma> x = Some v\<close>)
[PROOF STATE]
proof (state)
this:
(subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v) = subst (g \<sigma>) mem'

goal (2 subgoals):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
 2. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>
(subst (\<sigma> |` X) mem)(x := v) = subst \<sigma> mem
(subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v) = subst (g \<sigma>) mem'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>
(subst (\<sigma> |` X) mem)(x := v) = subst \<sigma> mem
(subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v) = subst (g \<sigma>) mem'

goal (1 subgoal):
 1. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
assume overwrites:
          "\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X]\<rangle>"
[PROOF STATE]
proof (state)
this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
hence
          "\<not> (\<forall> v. \<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g\<^sub>X ?\<sigma>\<^sub>X] (x := v)\<rangle>)"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>

goal (1 subgoal):
 1. \<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>)
[PROOF STEP]
by (metis \<open>doesnt_read c x\<close> doesnt_read_mutually_exclusive' eval\<^sub>X)
[PROOF STATE]
proof (state)
this:
\<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>)

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
hence g_simp [simp]: "g \<sigma> = g\<^sub>X ?\<sigma>\<^sub>X"
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>)

goal (1 subgoal):
 1. g \<sigma> = g\<^sub>X (\<sigma> |` X)
[PROOF STEP]
unfolding g_def
[PROOF STATE]
proof (prove)
using this:
\<not> (\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X (\<sigma> |` X)) mem')(x := v)\<rangle>)

goal (1 subgoal):
 1. (let \<sigma>' = \<sigma> |` X in if \<forall>v. \<langle>c, mds, (subst \<sigma>' mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', (subst (g\<^sub>X \<sigma>') mem')(x := v)\<rangle> then \<lambda>y. if x = y then \<sigma> y else g\<^sub>X \<sigma>' y else g\<^sub>X \<sigma>') = g\<^sub>X (\<sigma> |` X)
[PROOF STEP]
by (auto simp: Let_def)
[PROOF STATE]
proof (state)
this:
g \<sigma> = g\<^sub>X (\<sigma> |` X)

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
obtain v where "\<sigma> x = Some v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>v. \<sigma> x = Some v \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis \<open>dom \<sigma> = insert x X\<close> domD insertI1)
[PROOF STATE]
proof (state)
this:
\<sigma> x = Some v

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
have "mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v) = mem [\<mapsto> \<sigma>]"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (subst (\<sigma> |` X) mem)(x := v) = subst \<sigma> mem
[PROOF STEP]
apply (rule ext, rename_tac y)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y. ((subst (\<sigma> |` X) mem)(x := v)) y = subst \<sigma> mem y
[PROOF STEP]
apply (case_tac "y = x")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>y. y = x \<Longrightarrow> ((subst (\<sigma> |` X) mem)(x := v)) y = subst \<sigma> mem y
 2. \<And>y. y \<noteq> x \<Longrightarrow> ((subst (\<sigma> |` X) mem)(x := v)) y = subst \<sigma> mem y
[PROOF STEP]
apply (auto simp: subst_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. v = (case \<sigma> x of None \<Rightarrow> mem x | Some v \<Rightarrow> v)
 2. \<And>y. y \<noteq> x \<Longrightarrow> (case (\<sigma> |` X) y of None \<Rightarrow> mem y | Some v \<Rightarrow> v) = (case \<sigma> y of None \<Rightarrow> mem y | Some v \<Rightarrow> v)
[PROOF STEP]
apply (metis \<open>\<sigma> x = Some v\<close> option.simps(5))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>y. y \<noteq> x \<Longrightarrow> (case (\<sigma> |` X) y of None \<Rightarrow> mem y | Some v \<Rightarrow> v) = (case \<sigma> y of None \<Rightarrow> mem y | Some v \<Rightarrow> v)
[PROOF STEP]
by (metis \<open>dom (\<sigma> |` X) = X\<close> \<open>dom \<sigma> = insert x X\<close> insertE
            restrict_in subst_def subst_not_in_dom)
[PROOF STATE]
proof (state)
this:
(subst (\<sigma> |` X) mem)(x := v) = subst \<sigma> mem

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(subst (\<sigma> |` X) mem)(x := v) = subst \<sigma> mem

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
from overwrites
[PROOF STATE]
proof (chain)
picking this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>
[PROOF STEP]
have "\<langle>c, mds, mem [\<mapsto> ?\<sigma>\<^sub>X] (x := v)\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g \<sigma>]\<rangle>"
[PROOF STATE]
proof (prove)
using this:
\<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle>

goal (1 subgoal):
 1. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
by (metis g_simp)
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>

goal (1 subgoal):
 1. \<forall>v. \<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g\<^sub>X (\<sigma> |` X)) mem'\<rangle> \<Longrightarrow> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(subst (\<sigma> |` X) mem)(x := v) = subst \<sigma> mem
\<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
show "\<langle>c, mds, mem [\<mapsto> \<sigma>]\<rangle> \<leadsto> \<langle>c', mds', mem' [\<mapsto> g \<sigma>]\<rangle>"
[PROOF STATE]
proof (prove)
using this:
(subst (\<sigma> |` X) mem)(x := v) = subst \<sigma> mem
\<langle>c, mds, (subst (\<sigma> |` X) mem)(x := v)\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>

goal (1 subgoal):
 1. \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
g \<sigma> \<preceq> \<sigma> \<and> (\<forall>\<sigma>'. dom \<sigma>' = insert x X \<longrightarrow> dom (g \<sigma>) = dom (g \<sigma>')) \<and> \<langle>c, mds, subst \<sigma> mem\<rangle> \<leadsto> \<langle>c', mds', subst (g \<sigma>) mem'\<rangle>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x X) g

goal (1 subgoal):
 1. \<And>x F mem mem'. \<lbrakk>finite F; x \<notin> F; \<And>mem mem'. \<lbrakk>\<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball F (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> F); \<langle>c, mds, mem\<rangle> \<leadsto> \<langle>c', mds', mem'\<rangle>; Ball (insert x F) (doesnt_read c)\<rbrakk> \<Longrightarrow> Ex (change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x F))
[PROOF STEP]
thus "\<exists> g. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x X) g"
[PROOF STATE]
proof (prove)
using this:
change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x X) g

goal (1 subgoal):
 1. \<exists>g. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x X) g
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
\<exists>g. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> (insert x X) g

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>g. change_respecting \<langle>c, mds, mem\<rangle> \<langle>c', mds', mem'\<rangle> X g

goal:
No subgoals!
[PROOF STEP]
qed