proof (prove)
goal (3 subgoals):
 1. \<And>g x n fa sa t ga.
       \<lbrakk>A \<noteq> {}; fgmodule_condition R f i s A z;
        free_generator R (fgmodule R A z i f s) A; R module M;
        free_generator R M A; R module fgmodule R A z i f s;
        g \<in> mHom R M (fgmodule R A z i f s); \<forall>x\<in>A. g x = x;
        l_comb R M (card (fa ` {j. j \<le> n}) - Suc 0) t ga
        \<in> carrier M;
        g (l_comb R M (card (fa ` {j. j \<le> n}) - Suc 0) t ga) =
        \<zero>\<^bsub>fgmodule R A z i f s\<^esub>;
        A \<subseteq> carrier M; fa \<in> {j. j \<le> n} \<rightarrow> A;
        sa \<in> {j. j \<le> n} \<rightarrow> carrier R;
        x = l_comb R M (card (fa ` {j. j \<le> n}) - Suc 0) t ga;
        ideal R (carrier R);
        t \<in> {j. j \<le> card (fa ` {j. j \<le> n}) -
                            Suc 0} \<rightarrow>
                carrier R;
        ga \<in> {j. j \<le> card (fa ` {j. j \<le> n}) -
                             Suc 0} \<rightarrow>
                 fa ` {j. j \<le> n};
        surj_to ga {j. j \<le> card (fa ` {j. j \<le> n}) - Suc 0}
         (fa ` {j. j \<le> n});
        l_comb R M n sa fa =
        l_comb R M (card (fa ` {j. j \<le> n}) - Suc 0) t ga;
        l_comb R (fgmodule R A z i f s) (card (fa ` {j. j \<le> n}) - Suc 0)
         t ga =
        \<zero>\<^bsub>fgmodule R A z i f s\<^esub>;
        l_comb R (fgmodule R A z i f s) (card (fa ` {j. j \<le> n}) - Suc 0)
         t (cmp g ga) =
        \<zero>\<^bsub>fgmodule R A z i f s\<^esub>;
        finite {na. na \<le> n};
        finite {na. na \<le> card (fa ` {j. j \<le> n}) - Suc 0};
        finite (fa ` {j. j \<le> n}); fa 0 \<in> fa ` {j. j \<le> n};
        fa ` {j. j \<le> n} \<noteq> {}; 0 < card (fa ` {j. j \<le> n});
        inj_on ga {i. i \<le> card (fa ` {j. j \<le> n}) - Suc 0};
        A \<subseteq> carrier (fgmodule R A z i f s);
        \<forall>j\<in>{j. j \<le> card (fa ` {j. j \<le> n}) - Suc 0}.
           t j = \<zero>\<rbrakk>
       \<Longrightarrow> l_comb R M (card (fa ` {j. j \<le> n}) - Suc 0) t
                          ga =
                         \<zero>\<^bsub>M\<^esub>
 2. \<And>g.
       \<lbrakk>A \<noteq> {}; fgmodule_condition R f i s A z;
        free_generator R (fgmodule R A z i f s) A; R module M;
        free_generator R M A; R module fgmodule R A z i f s;
        g \<in> mHom R M (fgmodule R A z i f s);
        \<forall>x\<in>A. g x = x\<rbrakk>
       \<Longrightarrow> {\<zero>\<^bsub>M\<^esub>}
                         \<subseteq> ker\<^bsub>M,fgmodule R A z i f
             s\<^esub> g
 3. \<And>g.
       \<lbrakk>A \<noteq> {}; fgmodule_condition R f i s A z;
        free_generator R (fgmodule R A z i f s) A; R module M;
        free_generator R M A; R module fgmodule R A z i f s;
        g \<in> mHom R M (fgmodule R A z i f s);
        \<forall>x\<in>A. g x = x\<rbrakk>
       \<Longrightarrow> surjec\<^bsub>M,fgmodule R A z i f s\<^esub> g


proof (prove)
goal (1 subgoal):
 1. Col U Q P


proof (prove)
goal (1 subgoal):
 1. map (\<lambda>i. x) [0..<i] = replicate i x


proof (prove)
using this:
  matr_option (dim_row (M_mat_R signs subsets))
   (mat_inverse (M_mat_R signs subsets)) *\<^sub>v
  (M_mat_R signs subsets *\<^sub>v w_vec_R p qs signs) =
  w_vec_R p qs signs

goal (1 subgoal):
 1. w_vec_R p qs signs =
    matr_option (dim_row (M_mat_R signs subsets))
     (mat_inverse (M_mat_R signs subsets)) *\<^sub>v
    v_vec_R p qs subsets


proof (prove)
using this:
  rel_fun
   (rel_fun (BNF_Def.Grp UNIV id)
     (rel_fun (BNF_Def.Grp UNIV f)\<inverse>\<inverse>
       (rel_spmf (rel_prod (BNF_Def.Grp UNIV g) (BNF_Def.Grp UNIV id)))))
   (rel_fun (BNF_Def.Grp UNIV id)
     (rel_resource (BNF_Def.Grp UNIV f)\<inverse>\<inverse>
       (BNF_Def.Grp UNIV g)))
   resource_of_oracle resource_of_oracle

goal (1 subgoal):
 1. map_resource f g (resource_of_oracle oracle s) =
    resource_of_oracle
     (map_fun id (map_fun f (map_spmf (map_prod g id))) oracle) s


proof (prove)
goal (1 subgoal):
 1. (\<Sum>is1 | is1 \<lhd> input_sizes m1.
       (\<Prod>k<length inputs1. inputs1 ! k $ (is1 ! k)) *
       lookup (tensors_from_net m1 $ j) is1) *
    (\<Sum>is2 | is2 \<lhd> input_sizes m2.
       (\<Prod>k<length inputs2. inputs2 ! k $ (is2 ! k)) *
       lookup (tensors_from_net m2 $ j) is2) =
    evaluate_net m1 (take (length (input_sizes m1)) inputs) $ j *
    evaluate_net m2 (drop (length (input_sizes m1)) inputs) $ j


proof (prove)
goal (1 subgoal):
 1. near_ordered_set A r = near_ordered_set A r'


proof (prove)
goal (1 subgoal):
 1. {\<lambda>nl. nl = xs @ 0 \<up> (fp - arity) @ anything} ap
    {\<lambda>nl.
        nl =
        xs @ rec_exec (Mn n f) xs # 0 \<up> (fp - Suc arity) @ anything}


proof (prove)
goal (1 subgoal):
 1. nontriv_solution fund_sol &&&
    (nontriv_solution (a, b) \<Longrightarrow>
     pell_valuation (case fund_sol of (x, y) \<Rightarrow> (int x, int y))
     \<le> pell_valuation (int a, int b)) &&&
    (nontriv_solution z \<Longrightarrow>
     pell_valuation (case fund_sol of (x, y) \<Rightarrow> (int x, int y))
     \<le> pell_valuation (case z of (x, y) \<Rightarrow> (int x, int y)))


proof (prove)
goal (1 subgoal):
 1. inj undual


proof (prove)
goal (1 subgoal):
 1. int (N ^ m * 2 ^ (m - 1) * m) \<le> int (N ^ (2 * m) * 2 ^ m * m)


proof (prove)
goal (1 subgoal):
 1. card (f ` set_of_vector X) = card (set_of_vector X)


proof (prove)
goal (1 subgoal):
 1. pred.eval (Anno_code_i_i_i_o P E e) = Anno_code P E e


proof (prove)
goal (1 subgoal):
 1. \<E>.rank_of (insert x X) = rank_of (insert x X)


proof (prove)
using this:
  count (image_mset f A) x = sum (count A) (f -` {x} \<inter> set_mset A)
  (if x = ?y then Suc ?n else ?n) = ?n + (if x = ?y then 1 else 0)

goal (1 subgoal):
 1. count (image_mset f (add_mset x A)) x =
    sum (count (add_mset x A)) (f -` {x} \<inter> set_mset (add_mset x A))


proof (prove)
using this:
  P,a\<bullet>compareAndSwap(D\<bullet>F, i, e),h' \<turnstile> (e''\<bullet>compareAndSwap(D\<bullet>F, i, e),
                           xs'') \<leftrightarrow> (stk', loc', pc', xcp')
  no_call2 (a\<bullet>compareAndSwap(D\<bullet>F, i, e)) pc = no_call2 a pc
  if \<tau>move2 (compP2 P) h stk a pc xcp
  then h' = h \<and>
       (if xcp' = None \<longrightarrow> pc < pc' then \<tau>red1r
        else \<tau>red1t)
        P t h (a', xs) (e'', xs'')
  else \<exists>ta' e' xs'.
          \<tau>red1r P t h (a', xs) (e', xs') \<and>
          True,P,t \<turnstile>1 \<langle>e',
                                  (h, xs')\<rangle> -ta'\<rightarrow>
                                 \<langle>e'',(h', xs'')\<rangle> \<and>
          ta_bisim wbisim1 (extTA2J1 P ta') ta \<and>
          \<not> \<tau>move1 P h e' \<and>
          (call1 a' = None \<or>
           no_call2 a pc \<or> e' = a' \<and> xs' = xs)
  \<tau>move2 (compP2 P) h stk (a\<bullet>compareAndSwap(D\<bullet>F, i, e))
   pc xcp =
  \<tau>move2 (compP2 P) h stk a pc xcp

goal (1 subgoal):
 1. \<exists>e'' xs''.
       P,a\<bullet>compareAndSwap(D\<bullet>F, i, e),h' \<turnstile> (e'',
                                xs'') \<leftrightarrow> (stk', loc', pc',
                   xcp') \<and>
       (if \<tau>move2 (compP2 P) h stk
            (a\<bullet>compareAndSwap(D\<bullet>F, i, e)) pc xcp
        then h' = h \<and>
             (if xcp' = None \<longrightarrow> pc < pc' then \<tau>red1r
              else \<tau>red1t)
              P t h (a'\<bullet>compareAndSwap(D\<bullet>F, i, e), xs)
              (e'', xs'')
        else \<exists>ta' e' xs'.
                \<tau>red1r P t h
                 (a'\<bullet>compareAndSwap(D\<bullet>F, i, e), xs)
                 (e', xs') \<and>
                True,P,t \<turnstile>1 \<langle>e',
  (h, xs')\<rangle> -ta'\<rightarrow>
 \<langle>e'',(h', xs'')\<rangle> \<and>
                ta_bisim wbisim1 (extTA2J1 P ta') ta \<and>
                \<not> \<tau>move1 P h e' \<and>
                (call1 (a'\<bullet>compareAndSwap(D\<bullet>F, i, e)) =
                 None \<or>
                 no_call2 (a\<bullet>compareAndSwap(D\<bullet>F, i, e))
                  pc \<or>
                 e' = a'\<bullet>compareAndSwap(D\<bullet>F, i, e) \<and>
                 xs' = xs))


proof (prove)
goal (1 subgoal):
 1. design \<U> \<A>


proof (prove)
goal (1 subgoal):
 1. (f \<ominus> g) e \<le> capacity (residual_network g) e


proof (prove)
goal (1 subgoal):
 1. natural_transformation (\<cdot>\<^sub>A\<^sub>1\<^sub>x\<^sub>A\<^sub>2)
     (\<cdot>\<^sub>B) (uncurry F) (uncurry G) (uncurry \<tau>)


proof (prove)
goal (1 subgoal):
 1. mpoly_to_poly v (p1 + p2) = mpoly_to_poly v p1 + mpoly_to_poly v p2


proof (prove)
using this:
  a = Decomp t

goal (1 subgoal):
 1. (\<And>f T. t = Fun f T \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>M; map (\<lambda>d.
                        \<forall>X\<langle>\<or>\<noteq>: [(pair (t, s),
                      pair (snd d))]\<rangle>\<^sub>s\<^sub>t)
                 (filter (\<lambda>d. d \<notin> set Di)
                   (dl # D))\<rbrakk>\<^sub>d
     \<I>


proof (state)
this:
  x' = h \<otimes> x

goal (1 subgoal):
 1. x' \<in> H #> x


proof (prove)
using this:
  (\<And>f. f \<in> M \<Longrightarrow> f \<in> M) \<Longrightarrow>
  (\<Squnion>x\<in>M. \<Squnion> (x ` Y)) =
  (\<Squnion>x\<in>Y. \<Squnion>f\<in>M. f x)

goal (1 subgoal):
 1. fun_lub Sup M (\<Or> Y) = \<Squnion> (fun_lub Sup M ` Y)


proof (prove)
goal (1 subgoal):
 1. \<Gamma> \<turnstile> t\<^sub>1\<^sub>2[0 \<mapsto>\<^sub>\<tau> T\<^sub>2] : T


proof (state)
this:
  \<not> treach \<tau> ref k \<tau> ref l

goal (1 subgoal):
 1. \<And>l k.
       \<lbrakk>s\<turnstile> l reachable_from (s@@k);
        \<not> treach \<tau> s@@k \<tau> ref l \<Longrightarrow> False;
        ref k \<noteq> nullV;
        \<not> treach \<tau> ref k \<tau> ref l\<rbrakk>
       \<Longrightarrow> False


proof (prove)
goal (1 subgoal):
 1. distinct (map basis_enum_of_vec gs)


proof (prove)
using this:
  fst (exec_step P h stk loc C M pc ics frs sh) = \<lfloor>xcp\<rfloor>
  P \<turnstile> cname_of h xcp \<preceq>\<^sup>* D
  pc \<in> {f..<t}
  ins ! pc = Invokestatic x111_ x112_ x113_

goal (1 subgoal):
 1. is_relevant_entry P (ins ! pc) pc (f, t, D, pc', d')


proof (state)
this:
  (\<lambda>i. iterates body G i P s + iterates body G i Q s)
  \<longlonglongrightarrow> wp (\<mu>x.
                                   body ;;
                                   x \<^bsub>\<guillemotleft> G \<guillemotright>\<^esub>\<oplus> Skip)
                             P s +
                            wp (\<mu>x.
                                   body ;;
                                   x \<^bsub>\<guillemotleft> G \<guillemotright>\<^esub>\<oplus> Skip)
                             Q s

goal (1 subgoal):
 1. \<And>P Q s.
       \<lbrakk>sound P; sound Q\<rbrakk>
       \<Longrightarrow> wp (\<mu>x.
                                body ;;
                                x \<^bsub>\<guillemotleft> G \<guillemotright>\<^esub>\<oplus> Skip)
                          P s +
                         wp (\<mu>x.
                                body ;;
                                x \<^bsub>\<guillemotleft> G \<guillemotright>\<^esub>\<oplus> Skip)
                          Q s
                         \<le> wp (\<mu>x.
body ;; x \<^bsub>\<guillemotleft> G \<guillemotright>\<^esub>\<oplus> Skip)
                                (\<lambda>s'. P s' + Q s') s


proof (prove)
using this:
  a \<in> carrier G \<Longrightarrow> a \<in> Units G

goal (1 subgoal):
 1. a \<in> Units G


proof (prove)
goal (1 subgoal):
 1. \<And>s.
       k pfixGe g s \<Longrightarrow>
       {sa. g s \<le> f sa} \<subseteq> {s. k pfixGe f s}


proof (prove)
using this:
  ?k < j \<Longrightarrow> f' ?k = f ?k

goal (1 subgoal):
 1. matrix_sum d f j = matrix_sum d f' j


proof (prove)
goal (4 subgoals):
 1. \<And>X Y. (X, Y) \<in> rel \<Longrightarrow> qSkel Y = qSkel X
 2. \<And>xs x. chi (termIn (qVar xs x))
 3. \<And>delta inp binp.
       \<lbrakk>liftAll (\<lambda>a. chi (termIn a)) inp;
        liftAll (\<lambda>a. chi (absIn a)) binp\<rbrakk>
       \<Longrightarrow> chi (termIn (qOp delta inp binp))
 4. \<And>xs x X.
       (\<And>Y.
           (X, Y) \<in> rel \<Longrightarrow>
           chi (termIn Y)) \<Longrightarrow>
       chi (absIn (qAbs xs x X))


proof (prove)
goal (1 subgoal):
 1. category (set_cat U)


proof (prove)
using this:
  x = tau_steps y nx
  y = tau_steps x ny

goal (1 subgoal):
 1. ny + nx = 0


proof (prove)
goal (2 subgoals):
 1. \<And>clist xa.
       \<lbrakk>xs \<noteq> [];
        \<forall>i<length xs.
           rely \<union>
           (\<Union>j\<in>{j. j < length xs \<and> j \<noteq> i}.
               Guar (xs ! j))
           \<subseteq> Rely (xs ! i);
        pre \<subseteq> (\<Inter>i\<in>{i. i < length xs}. Pre (xs ! i));
        x \<in> par_cp (map (Some \<circ> fst) xs) s;
        x \<in> par_assum (pre, rely); All_None (fst (last x));
        length clist = length xs; xa < length xs;
        \<forall>i<length xs.
           clist ! i \<in> assum (Pre (xs ! i), Rely (xs ! i));
        clist ! xa \<in> cp (Some (fst (xs ! xa))) s; same_length x clist;
        \<forall>i.
           Suc i < length (clist ! xa) \<longrightarrow>
           clist ! xa !
           i -c\<rightarrow> clist ! xa ! Suc i \<longrightarrow>
           (snd (clist ! xa ! i), snd (clist ! xa ! Suc i))
           \<in> Guar (xs ! xa);
        fst (last (clist ! xa)) = None \<longrightarrow>
        snd (last (clist ! xa)) \<in> Post (xs ! xa);
        same_state x clist; compat_label x clist;
        length x - 1 < length x \<longrightarrow>
        fst (x ! (length x - 1)) =
        map (\<lambda>xa. fst (xa ! (length x - 1))) clist\<rbrakk>
       \<Longrightarrow> snd (last x) \<in> Post (xs ! xa)
 2. \<And>clist xa.
       \<lbrakk>xs \<noteq> [];
        \<forall>i<length xs.
           rely \<union>
           (\<Union>j\<in>{j. j < length xs \<and> j \<noteq> i}.
               Guar (xs ! j))
           \<subseteq> Rely (xs ! i);
        pre \<subseteq> (\<Inter>i\<in>{i. i < length xs}. Pre (xs ! i));
        \<forall>i<length xs.
           \<Turnstile> Com (xs !
                             i) sat [Pre
(xs ! i), Rely (xs ! i), Guar (xs ! i), Post (xs ! i)];
        x \<in> par_cp (map (Some \<circ> fst) xs) s;
        x \<in> par_assum (pre, rely); All_None (fst (last x));
        length clist = length xs;
        \<forall>i<length clist.
           clist ! i \<in> cp (map (Some \<circ> fst) xs ! i) s;
        x \<propto> clist; xa < length xs\<rbrakk>
       \<Longrightarrow> \<forall>i<length clist.
                            clist ! i
                            \<in> assum (Pre (xs ! i), Rely (xs ! i))


proof (prove)
goal (1 subgoal):
 1. \<lparr>poly_cmul c p\<rparr>\<^sub>p\<^bsup>bs\<^esup> =
    \<lparr>Mul (C c) p\<rparr>\<^sub>p\<^bsup>bs\<^esup>


proof (prove)
goal (1 subgoal):
 1. y ! index_of x y = x


proof (prove)
goal (1 subgoal):
 1. SAMS D' E' F' A B C


proof (prove)
goal (1 subgoal):
 1. (F1 \<^bold>\<rightarrow>
     F2, F1 \<^bold>\<rightarrow> F2, \<Gamma> \<Rightarrow>
     \<Delta> \<longrightarrow>
     F1 \<^bold>\<rightarrow> F2, \<Gamma> \<Rightarrow> \<Delta>) \<and>
    (\<Gamma> \<Rightarrow>
     F1 \<^bold>\<rightarrow>
     F2, F1 \<^bold>\<rightarrow> F2, \<Delta> \<longrightarrow>
     \<Gamma> \<Rightarrow> F1 \<^bold>\<rightarrow> F2, \<Delta>)


proof (prove)
using this:
  \<not> (cmod la = 1 \<and> k = m \<and> i = 0 \<and> j = k - 1)

goal (1 subgoal):
 1. \<lbrakk>la = 0 \<Longrightarrow> thesis;
     \<lbrakk>la \<noteq> 0; cmod la < 1\<rbrakk> \<Longrightarrow> thesis;
     \<lbrakk>cmod la = 1;
      k < m \<or> i \<noteq> 0 \<or> j \<noteq> k - 1\<rbrakk>
     \<Longrightarrow> thesis\<rbrakk>
    \<Longrightarrow> thesis


proof (prove)
using this:
  [\<phi> (y\<^sup>P) in dw]

goal (1 subgoal):
 1. [\<phi> (\<^bold>\<iota>x. \<phi> (x\<^sup>P)) in dw]


proof (prove)
goal (1 subgoal):
 1. f abs_summable_on A


proof (prove)
using this:
  P \<turnstile> C sees clinit, Static :  []\<rightarrow>Void = m' in C
  P \<turnstile> C sees clinit, Static :  []\<rightarrow>Void = m' in C
  wf_prog wf_md P

goal (1 subgoal):
 1. b = Static \<and> Ts = [] \<and> T = Void \<and> D = C


proof (prove)
goal (1 subgoal):
 1. poly_roots (\<Prod>x\<in>#A. [:- x, 1::'a:]) = A


proof (prove)
using this:
  m * m \<noteq> 0

goal (1 subgoal):
 1. N \<noteq> 0


proof (prove)
goal (1 subgoal):
 1. Col C X Y


proof (prove)
goal (1 subgoal):
 1. map_in_bicategory (\<cdot>) (\<star>) \<a> \<i> src trg u


proof (prove)
using this:
  t \<mapsto> t'

goal (1 subgoal):
 1. t[x::=v] \<mapsto> t'[x::=v]


proof (prove)
goal (1 subgoal):
 1. Rep_process
     (Abs_process
       ({(s, X). s = [] \<and> (s, X) \<in> F P \<inter> F Q} \<union>
        {(s, X).
         s \<noteq> [] \<and> (s, X) \<in> F P \<union> F Q} \<union>
        {(s, X). s = [] \<and> s \<in> D P \<union> D Q} \<union>
        {(s, X).
         s = [] \<and>
         tick \<notin> X \<and> [tick] \<in> T P \<union> T Q},
        D P \<union> D Q)) =
    ({(s, X). s = [] \<and> (s, X) \<in> F P \<inter> F Q} \<union>
     {(s, X). s \<noteq> [] \<and> (s, X) \<in> F P \<union> F Q} \<union>
     {(s, X). s = [] \<and> s \<in> D P \<union> D Q} \<union>
     {(s, X).
      s = [] \<and> tick \<notin> X \<and> [tick] \<in> T P \<union> T Q},
     D P \<union> D Q)


proof (prove)
goal (1 subgoal):
 1. hausdorff_distance (d ` {A..B}) {d A--d B}
    \<le> 92 * lambda\<^sup>2 * (C + deltaG TYPE('a))


proof (prove)
goal (1 subgoal):
 1. \<exists>x.
       (\<forall>(a, b, c)\<in>set eq. a * x\<^sup>2 + b * x + c = 0) \<and>
       (\<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0)


proof (prove)
using this:
  \<one> = r \<otimes> a \<oplus> i
  r \<in> carrier R
  a \<in> carrier R
  i \<in> carrier R

goal (1 subgoal):
 1. a \<otimes> r = \<ominus> i \<oplus> \<one>


proof (prove)
using this:
  isrlfm
   (foldr MIR.disj
     (map (\<lambda>(\<phi>, n, s). MIR.conj \<phi> (f n s)) (rsplit0 a)) F)
  rsplit ?f ?a \<equiv>
  foldr MIR.disj
   (map (\<lambda>(\<phi>, n, s). MIR.conj \<phi> (?f n s)) (rsplit0 ?a)) F

goal (1 subgoal):
 1. isrlfm (rsplit f a)


proof (prove)
using this:
  compP\<^sub>1
   P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs e,
                           (h, ls, sh)\<rangle> \<Rightarrow>
                          \<langle>fin\<^sub>1 (addr a),
                           (h', ls\<^sub>2, sh')\<rangle> \<and>
  l' \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>2]
  P \<turnstile> \<langle>e,(h, l, sh)\<rangle> \<Rightarrow>
                 \<langle>addr a,(h', l', sh')\<rangle>
  \<lbrakk>fv e \<subseteq> set ?Vs;
   l \<subseteq>\<^sub>m [?Vs [\<mapsto>] ?ls];
   length ?Vs + max_vars e \<le> length ?ls\<rbrakk>
  \<Longrightarrow> \<exists>ls'.
                       compP\<^sub>1
                        P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 ?Vs e,
          (h, ?ls, sh)\<rangle> \<Rightarrow>
         \<langle>fin\<^sub>1 (addr a),(h', ls', sh')\<rangle> \<and>
                       l' \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls']
  h' a = \<lfloor>(C, fs)\<rfloor>
  P \<turnstile> C has F,Static:t in D
  fv (e\<bullet>F{D}) \<subseteq> set Vs
  l \<subseteq>\<^sub>m [Vs [\<mapsto>] ls]
  length Vs + max_vars (e\<bullet>F{D}) \<le> length ls

goal (1 subgoal):
 1. \<exists>ls'.
       compP\<^sub>1
        P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs (e\<bullet>F{D}),
                                (h, ls, sh)\<rangle> \<Rightarrow>
                               \<langle>fin\<^sub>1
   (THROW IncompatibleClassChangeError),
                                (h', ls', sh')\<rangle> \<and>
       l' \<subseteq>\<^sub>m [Vs [\<mapsto>] ls']


proof (prove)
using this:
  gs \<subseteq> carrier G
  (\<forall>i\<in>gs. generate G {i} \<lhd> G) \<and>
  A = generate G (\<Union>g\<in>gs. generate G {g}) \<and>
  compl_fam (\<lambda>g. generate G {g}) gs
  ?A \<subseteq> carrier G \<Longrightarrow>
  generate G (\<Union>x\<in>?A. generate G {x}) = generate G ?A

goal (1 subgoal):
 1. A = generate G gs


proof (prove)
goal (1 subgoal):
 1. (\<And>d.
        induced_modulus d \<Longrightarrow> a \<le> d) \<Longrightarrow>
    a \<le> conductor


proof (prove)
goal (1 subgoal):
 1. finite {v. atom v \<in> supp e} \<Longrightarrow>
    (atom x \<notin> supp {v. atom v \<in> supp e}) =
    (atom x \<notin> supp e)


proof (prove)
goal (2 subgoals):
 1. \<And>n A form m na y.
       \<lbrakk>infinite (deriv s); init s; Suc (size form) = n;
        A = FAll form; contains f na (0, FAll form); m = 0;
        contains f (Suc (na + y))
         (0, finst form (newvar (sfv (s_of_ns (snd (f (na + y)))))));
        \<not> FEval mo
                (case_nat (ntou (newvar (sfv (s_of_ns (snd (f (na + y)))))))
                  ntou)
                form\<rbrakk>
       \<Longrightarrow> ntou (newvar (sfv (s_of_ns (snd (f (na + y))))))
                         \<in> fst mo
 2. \<And>n A x6.
       \<lbrakk>infinite (deriv s); init s;
        \<forall>m<n.
           \<forall>A.
              size A = m \<longrightarrow>
              (\<forall>m n.
                  contains f n (m, A) \<longrightarrow>
                  \<not> FEval mo ntou A);
        size A = n; A = FEx x6\<rbrakk>
       \<Longrightarrow> \<forall>m n.
                            contains f n (m, A) \<longrightarrow>
                            \<not> FEval mo ntou A


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>State_Idle localState output_fun trans_fun
              (localState
                (f_Exec_Comp trans_fun (xs @ NoMsg\<^bsup>m\<^esup>) c));
     m < n\<rbrakk>
    \<Longrightarrow> output_fun
                       (f_Exec_Comp trans_fun
                         ((xs @ NoMsg\<^bsup>m\<^esup>) @
                          NoMsg\<^bsup>n - m\<^esup>)
                         c) =
                      NoMsg


proof (prove)
goal (1 subgoal):
 1. final e \<Longrightarrow> compE1 Vs e = fin1 e


proof (prove)
goal (1 subgoal):
 1. n < length qs \<Longrightarrow>
    t_A' n = int (t (s_A' n) (qs ! n) (acts ! n))


proof (prove)
goal (1 subgoal):
 1. locally path_connected S


proof (prove)
goal (1 subgoal):
 1. (local.span (set ws) = local.span (set (rev us)) &&&
     corthogonal (rev us)) &&&
    set us \<subseteq> carrier_vec n &&&
    length us = length ws &&& distinct us


proof (state)
goal (1 subgoal):
 1. open (Proj ` X)


proof (state)
this:
  C.reachable (cs i)

goal (1 subgoal):
 1. \<And>n.
       \<forall>m<n.
          alstep (cl m) (arun cl cs m) (arun cl cs (Suc m)) \<and>
          A.reachable (arun cl cs m) \<and>
          R (arun cl cs (Suc m)) (cs (Suc m)) \<Longrightarrow>
       alstep (cl n) (arun cl cs n) (arun cl cs (Suc n)) \<and>
       A.reachable (arun cl cs n) \<and> R (arun cl cs (Suc n)) (cs (Suc n))


proof (prove)
goal (1 subgoal):
 1. (lcount 0 = 1 &&& lcount 1 = 1) &&& lcount 2 = 1 &&& lcount 3 = 2


proof (prove)
using this:
  0 < degree g \<Longrightarrow>
  \<exists>q r.
     irreducible\<^sub>d q \<and> g = q * r \<and> degree r < degree g
  i \<noteq> 0
  degree g = i
  \<not> irreducible g

goal (1 subgoal):
 1. (\<And>h1 h2.
        \<lbrakk>irreducible h1; g = h1 * h2; degree h2 < degree g\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (state)
goal (4 subgoals):
 1. \<And>C g f.
       local.bind_state (local.altc_state C g) f =
       local.altc_state C (\<lambda>c. local.bind_state (g c) f)
 2. \<And>x f. local.altc_state (csingle x) f = f x
 3. \<And>C f g.
       local.altc_state (cUnion (cimage f C)) g =
       local.altc_state C (\<lambda>x. local.altc_state (f x) g)
 4. \<And>R.
       bi_unique R \<Longrightarrow>
       (rel_cset R ===> (R ===> (=)) ===> (=)) local.altc_state
        local.altc_state


proof (prove)
goal (1 subgoal):
 1. \<And>c. ccompare = Some c \<Longrightarrow> comparator c


proof (prove)
goal (1 subgoal):
 1. cid \<noteq> cid'


proof (prove)
using this:
  l_new_document ShadowRootClass.type_wf
  l_get_shadow_root ShadowRootClass.type_wf get_shadow_root
   get_shadow_root_locs

goal (1 subgoal):
 1. l_new_document_get_shadow_root ShadowRootClass.type_wf get_shadow_root
     get_shadow_root_locs


proof (prove)
goal (1 subgoal):
 1. (f \<in> borel_measurable M) =
    (\<forall>a. {w \<in> space M. f w < a} \<in> sets M)


proof (prove)
goal (1 subgoal):
 1. s\<^sub>0 \<Turnstile> s \<Longrightarrow>
    pred_owner_iii n (run_asset_ii n s) (run_owner_iii n s)


proof (prove)
using this:
  bij_betw h (carrier H) (carrier G)

goal (1 subgoal):
 1. card (carrier H) = card (carrier G)


proof (prove)
goal (1 subgoal):
 1. irreflexive
     (prim_W w v e * (w \<sqinter> - prim_EP w v e)\<^sup>\<star> * e *
      prim_P w v e\<^sup>T\<^sup>\<star> *
      (w \<sqinter> - prim_EP w v e)\<^sup>\<star>)


proof (prove)
goal (4 subgoals):
 1. \<And>x. PP' x \<Longrightarrow> P x \<and> Q x
 2. \<And>x y. fst R x y \<Longrightarrow>\<^sub>t fst R x y
 3. \<And>x y. snd R x y \<Longrightarrow>\<^sub>t snd R x y
 4. \<And>x y. S x y \<Longrightarrow>\<^sub>t S x y


proof (prove)
goal (1 subgoal):
 1. distinct (map fst y) \<Longrightarrow>
    count_of y x = count (mset (ass_list_to_single_list y)) x


proof (prove)
using this:
  \<exists>K rev_K rev_H.
     subdivision (K, rev_K)
      (case (H, rev_H) of (x, y) \<Rightarrow> (with_proj x, y)) \<and>
     (K\<^bsub>3,3\<^esub> K \<or> K\<^bsub>5\<^esub> K)
  subgraph (with_proj H) (with_proj K)
  subgraph (with_proj K) (with_proj G)

goal (1 subgoal):
 1. \<not> (\<nexists>H.
               subgraph H (with_proj G) \<and>
               (\<exists>K rev_K rev_H.
                   subdivision (K, rev_K) (H, rev_H) \<and>
                   (K\<^bsub>3,3\<^esub> K \<or> K\<^bsub>5\<^esub> K)))


proof (prove)
goal (1 subgoal):
 1. phull (set (mat_to_polys ts (row_echelon (polys_to_mat ts ps)))) =
    phull (set ps)


proof (prove)
goal (1 subgoal):
 1. fetch (adjust0 ap) sa (read ra) = (ac, Suc (length ap div 2))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>x i vr vl.
                x \<in> ifex_var_set
                         (restrict_top i vr vl) \<Longrightarrow>
                x \<in> ifex_var_set i;
     x = a\<rbrakk>
    \<Longrightarrow> x \<in> ifex_var_set i \<or>
                      x \<in> ifex_var_set t \<or> x \<in> ifex_var_set e


proof (prove)
goal (1 subgoal):
 1. set_eq (RBT_set rbt1) (RBT_set rbt2) =
    (case ID ccompare of
     None \<Rightarrow>
       Code.abort STR ''set_eq RBT_set RBT_set: ccompare = None''
        (\<lambda>_. set_eq (RBT_set rbt1) (RBT_set rbt2))
     | Some c \<Rightarrow>
         case ID CEQ('b) of
         None \<Rightarrow>
           list_all2_fusion (\<lambda>x y. c x y = Eq) rbt_keys_generator
            rbt_keys_generator (RBT_Set2.init rbt1) (RBT_Set2.init rbt2)
         | Some eq \<Rightarrow>
             list_all2_fusion eq rbt_keys_generator rbt_keys_generator
              (RBT_Set2.init rbt1) (RBT_Set2.init rbt2))


proof (prove)
goal (1 subgoal):
 1. m \<le> LENGTH('a)


proof (prove)
goal (1 subgoal):
 1. (\<Sum>ys\<in>#YS1. {#y \<in># mset ys. y < x#}) +
    (\<Sum>ys\<in>#YS2. {#y \<in># mset ys. y < x#}) \<subseteq>#
    \<Sum>\<^sub># (image_mset mset YS1) +
    (\<Sum>ys\<in>#YS2. {#y \<in># mset ys. y < med ys#})


proof (prove)
goal (1 subgoal):
 1. xs \<in> Joints XS \<Longrightarrow>
    bounded_by xs (ivls_of_aforms prec XS)


proof (prove)
goal (1 subgoal):
 1. ([a]lst. x = [a']lst. x') = ([a]lst. y = [a']lst. y')


proof (state)
this:
  terminal_arrow_from_functor (\<cdot>\<^sub>D) (\<cdot>\<^sub>C) F (G x) x
   (\<epsilon> x)

goal (1 subgoal):
 1. \<And>y' f.
       arrow_from_functor (\<cdot>\<^sub>D) (\<cdot>\<^sub>C) F y' x
        f \<Longrightarrow>
       \<epsilon>x.the_coext y' f = \<phi> y' f


proof (prove)
goal (1 subgoal):
 1. sorted xs =
    (\<forall>i j.
        i \<le> j \<longrightarrow>
        j < length xs \<longrightarrow> xs ! i \<le> xs ! j)


proof (prove)
goal (1 subgoal):
 1. \<And>n. S (Suc n) = x * S n /\<^sub>R real (Suc n)


proof (prove)
using this:
  e1 \<in> isubexprs(e0)

goal (1 subgoal):
 1. \<And>C.
       CT;Map.empty \<turnstile> e0 : C \<Longrightarrow>
       \<exists>D. CT;Map.empty \<turnstile> e1 : D


proof (prove)
using this:
  trace (c \<cdot>\<^sub>m (f ?n - f 0))
  \<le> trace (c \<cdot>\<^sub>m (A - f 0))

goal (1 subgoal):
 1. trace (c \<cdot>\<^sub>m (f n - f 0)) < 1


proof (prove)
goal (4 subgoals):
 1. \<And>x1.
       \<lbrakk>\<And>t.
                   emb_step_at (p @ q) d2 (emb_step_at p d1 t) =
                   emb_step_at p d1 (emb_step_at (p @ [d1] @ q) d2 t);
        a = dir.Left;
        \<And>t.
           emb_step_at (p @ q) d2 (emb_step_at p d1 t) =
           emb_step_at p d1 (emb_step_at (p @ [d1] @ q) d2 t);
        t = Hd x1\<rbrakk>
       \<Longrightarrow> emb_step_at ((a # p) @ q) d2
                          (emb_step_at (a # p) d1 t) =
                         emb_step_at (a # p) d1
                          (emb_step_at ((a # p) @ [d1] @ q) d2 t)
 2. \<And>x21 x22.
       \<lbrakk>\<And>t.
                   emb_step_at (p @ q) d2 (emb_step_at p d1 t) =
                   emb_step_at p d1 (emb_step_at (p @ [d1] @ q) d2 t);
        a = dir.Left;
        \<And>t.
           emb_step_at (p @ q) d2 (emb_step_at p d1 t) =
           emb_step_at p d1 (emb_step_at (p @ [d1] @ q) d2 t);
        t = App x21 x22\<rbrakk>
       \<Longrightarrow> emb_step_at ((a # p) @ q) d2
                          (emb_step_at (a # p) d1 t) =
                         emb_step_at (a # p) d1
                          (emb_step_at ((a # p) @ [d1] @ q) d2 t)
 3. \<And>x1.
       \<lbrakk>\<And>t.
                   emb_step_at (p @ q) d2 (emb_step_at p d1 t) =
                   emb_step_at p d1 (emb_step_at (p @ [d1] @ q) d2 t);
        a = dir.Right;
        \<And>t.
           emb_step_at (p @ q) d2 (emb_step_at p d1 t) =
           emb_step_at p d1 (emb_step_at (p @ [d1] @ q) d2 t);
        t = Hd x1\<rbrakk>
       \<Longrightarrow> emb_step_at ((a # p) @ q) d2
                          (emb_step_at (a # p) d1 t) =
                         emb_step_at (a # p) d1
                          (emb_step_at ((a # p) @ [d1] @ q) d2 t)
 4. \<And>x21 x22.
       \<lbrakk>\<And>t.
                   emb_step_at (p @ q) d2 (emb_step_at p d1 t) =
                   emb_step_at p d1 (emb_step_at (p @ [d1] @ q) d2 t);
        a = dir.Right;
        \<And>t.
           emb_step_at (p @ q) d2 (emb_step_at p d1 t) =
           emb_step_at p d1 (emb_step_at (p @ [d1] @ q) d2 t);
        t = App x21 x22\<rbrakk>
       \<Longrightarrow> emb_step_at ((a # p) @ q) d2
                          (emb_step_at (a # p) d1 t) =
                         emb_step_at (a # p) d1
                          (emb_step_at ((a # p) @ [d1] @ q) d2 t)


proof (prove)
goal (1 subgoal):
 1. \<exists>F. (\<forall>n. compact (F n)) \<and> \<Union> (range F) = C m


proof (state)
this:
  \<lbrakk>rk {A, B, M} = 2; rk {C, D, M} = 2\<rbrakk>
  \<Longrightarrow> rk {A, B, C, D} \<le> 3

goal (1 subgoal):
 1. \<And>M. rk {A, B, M} \<noteq> 2 \<or> rk {C, D, M} \<noteq> 2


proof (prove)
using this:
  es_is_trap es

goal (1 subgoal):
 1. case (s, vs, ves, e) of
    (s, vs, ves, e) \<Rightarrow>
      \<lparr>s;vs;vs_to_es ves @
                   [e]\<rparr> \<leadsto>_ i \<lparr>s';vs';es'\<rparr>


proof (prove)
goal (1 subgoal):
 1. (f(i := x) \<longlongrightarrow> u j) (at_right j)


proof (prove)
goal (1 subgoal):
 1. fmapU\<cdot>f\<cdot>\<bottom> = \<bottom> &&&
    fmapU\<cdot>f\<cdot>(Writer\<cdot>w\<cdot>x) =
    Writer\<cdot>w\<cdot>(f\<cdot>x)


proof (prove)
using this:
  j (h ?x) = ?x
  h (j ?y) = ?y

goal (1 subgoal):
 1. {x. \<not> ((j \<circ> f \<circ> h) x = x \<and>
                (j \<circ> g \<circ> h) x = x)} =
    j ` {x. \<not> (f x = x \<and> g x = x)}


proof (prove)
using this:
  merge_guards c = Guard f' g' c'
  f = f'

goal (1 subgoal):
 1. merge_guards (Guard f g c) = Guard f (g \<inter> g') c'


proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x.
         (\<bar>g' x\<bar> *\<^sub>R f (g x)) $ i) absolutely_integrable_on
     S \<and>
     ((\<lambda>x. (\<bar>g' x\<bar> *\<^sub>R f (g x)) $ i) has_integral
      b $ i)
      S) =
    ((\<lambda>x. f x $ i) absolutely_integrable_on g ` S \<and>
     ((\<lambda>x. f x $ i) has_integral b $ i) (g ` S))


proof (prove)
goal (1 subgoal):
 1. StdOMap dflt_oops


proof (prove)
goal (1 subgoal):
 1. \<exists>e. res = RSCrash e


proof (prove)
using this:
  \<forall>x\<in>{0..1}. finite (\<phi> -` {x})

goal (1 subgoal):
 1. finite (\<phi> -` (s' \<inter> {0..1}))


proof (prove)
goal (1 subgoal):
 1. int (nat x choose 2) = x * (x - 1) div 2


proof (prove)
using this:
  path ?x = path (?x\<^sup>T)

goal (1 subgoal):
 1. no_start_points_path x = no_end_points_path (x\<^sup>T)


proof (prove)
using this:
  A.arr a
  J.arr j
  A_B.arr (\<tau> j)
  Curry.uncurry ?\<tau> ?f \<equiv>
  if JxA.arr ?f then E.map (?\<tau> (fst ?f), snd ?f) else B.null
  A_BxA.arr ?Fg \<Longrightarrow> E.map ?Fg = A_B.Map (fst ?Fg) (snd ?Fg)

goal (1 subgoal):
 1. at a \<tau> j = A_B.Map (\<tau> j) a


proof (prove)
goal (1 subgoal):
 1. poly_eval a (extend_indets p) = poly_eval (a \<circ> Some) p


proof (chain)
picking this:
  h \<turnstile> get_dom_component parent_ptr \<rightarrow>\<^sub>r c


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ts_ok wfx (thr (h.start_state f P C M vs)) h.start_heap;
     wf_syscls P;
     legal_execution P (h.\<E>_start f P C M vs status) (E, ws);
     enat a < llength E;
     action_obs E a = NormalAction (ReadMem ad al v)\<rbrakk>
    \<Longrightarrow> \<exists>T.
                         P \<turnstile> ad@al : T \<and>
                         P \<turnstile> v :\<le> T


proof (prove)
using this:
  healthy (iterates body ?G ?i)

goal (1 subgoal):
 1. le_trans
     (wp (body ;;
          Embed
           (iterates body G
             i) \<^bsub>\<guillemotleft> G \<guillemotright>\<^esub>\<oplus> Skip))
     (wp (body ;;
          Embed
           (iterates body G
             (Suc i)) \<^bsub>\<guillemotleft> G \<guillemotright>\<^esub>\<oplus> Skip))


proof (prove)
using this:
  mod_subset ?p ?X \<equiv> {(a, b). singular_chain ?p ?X (a - b)}
  singular_chain ?p ?X (- ?c) = singular_chain ?p ?X ?c

goal (1 subgoal):
 1. singular_chain p (subtopology X S) c \<Longrightarrow>
    \<exists>d.
       singular_chain (Suc p) X d \<and>
       (chain_boundary (Suc p) d, c) \<in> mod_subset p (subtopology X S)


proof (prove)
using this:
  ?v \<leadsto>?xs\<leadsto>\<^bsub>T\<^esub> ?w \<Longrightarrow>
  ?xs = ?v \<leadsto>\<^bsub>T\<^esub> ?w
  s \<leadsto>(x # xs)\<leadsto>\<^bsub>T\<^esub> t
  xs \<noteq> []

goal (1 subgoal):
 1. hd xs \<in> set (s \<leadsto>\<^bsub>T\<^esub> t)


proof (prove)
goal (1 subgoal):
 1. DF UNIV \<sqsubseteq>\<^sub>F\<^sub>D SYSTEM


proof (prove)
using this:
  VoV.seq (\<nu>, \<tau>) (\<mu>, \<sigma>)

goal (1 subgoal):
 1. \<nu> \<cdot> \<mu> \<star> \<tau> \<cdot> \<sigma> =
    (\<nu> \<star> \<tau>) \<cdot> (\<mu> \<star> \<sigma>)


proof (prove)
using this:
  \<not> isACT sys (PROC p)
  p' = solution sys (PROC p)
  isAction ?p \<or> isChoice ?p

goal (1 subgoal):
 1. isAction p = isAction p' \<and> isChoice p = isChoice p'


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hbt l; hbt r; height l \<noteq> height r + m + 1\<rbrakk>
    \<Longrightarrow> height (balL l a r) = 1 + max (height l) (height r)


proof (prove)
goal (1 subgoal):
 1. add_local_ring_at zero_local_ring_at a = a


proof (prove)
using this:
  X' \<sharp> T11
  X' \<sharp> X
  X' \<sharp> P
  X' \<sharp> (D' @ TVarB X Q # G)
  X' \<sharp> t1
  X' \<sharp> T2
  D' @ TVarB X Q # G \<turnstile> t1 : (\<forall>X'<:T11. T12)
  \<lbrakk>D' @ TVarB X Q # G = ?D @ TVarB ?b Q # G;
   G\<turnstile>?ba<:Q\<rbrakk>
  \<Longrightarrow> ?D[?b \<mapsto> ?ba]\<^sub>e @
                    G \<turnstile> t1[?b \<mapsto>\<^sub>\<tau> ?ba] : (\<forall>X'<:T11.
                                     T12)[?b \<mapsto> ?ba]\<^sub>\<tau>
  (D' @ TVarB X Q # G)\<turnstile>T2<:T11
  G\<turnstile>P<:Q
  D'[X \<mapsto> P]\<^sub>e @
  G \<turnstile> t1[X \<mapsto>\<^sub>\<tau> P] : (\<forall>X'<:T11.
                T12)[X \<mapsto> P]\<^sub>\<tau>

goal (1 subgoal):
 1. D'[X \<mapsto> P]\<^sub>e @
    G \<turnstile> (t1 \<cdot>\<^sub>\<tau>
                    T2)[X \<mapsto>\<^sub>\<tau> P] : T12[X' \<mapsto> T2]\<^sub>\<tau>[X \<mapsto> P]\<^sub>\<tau>


proof (prove)
using this:
  V \<noteq> {}
  \<Union> {bag t |t. t \<in> V\<^bsub>T\<^esub>} = V

goal (1 subgoal):
 1. \<exists>v\<in>V. \<exists>t\<in>V\<^bsub>T\<^esub>. v \<in> bag t


proof (prove)
goal (1 subgoal):
 1. linear (*s) (*s) g &&& \<forall>x\<in>set_of_vector X. g x = f x


proof (prove)
goal (1 subgoal):
 1. monoid_cancel G


proof (prove)
goal (1 subgoal):
 1. OFCLASS(Enum.finite_2, cenum_class)


proof (prove)
goal (1 subgoal):
 1. Quotient eq_fp64 fp64_of_float float_of_fp64 rel_fp64


proof (prove)
goal (1 subgoal):
 1. \<not> (IEEE.exponent 1 = emax TYPE(('a, 'b) IEEE.float) \<and>
            fraction 1 \<noteq> 0)


proof (prove)
goal (1 subgoal):
 1. \<exists>v. lookup \<rho> x = Some v \<and> v \<in> good A


proof (prove)
using this:
  ?x \<in> A \<Longrightarrow> integrable (count_space B) (f ?x)

goal (1 subgoal):
 1. integrable (count_space B) (\<lambda>y. \<Sum>x\<in>A. f x y)


proof (prove)
goal (1 subgoal):
 1. rel_spmf
     (\<lambda>(b'1, bad1, L1) (b'2, bad2, L2).
         bad1 = bad2 \<and> (\<not> bad2 \<longrightarrow> b'1 = b'2))
     (exec_gpv
       (\<dagger>(ind_cca'.oracle_encrypt k b) \<oplus>\<^sub>O
        oracle_decrypt1' k)
       \<A> (False, {}))
     (exec_gpv
       (\<dagger>(ind_cca'.oracle_encrypt k b) \<oplus>\<^sub>O
        oracle_decrypt0' k)
       \<A> (False, {}))


proof (prove)
using this:
  \<lbrakk>0 \<le> ?s''2; ?s''2 < s'\<rbrakk>
  \<Longrightarrow> flow0 x ?s''2 \<notin> {x. c \<le> x \<bullet> n}
  flow0 x s' \<in> {x. c \<le> x \<bullet> n}
  0 \<le> s'
  s' \<le> s
  flow0 x s' \<in> frontier {x. c \<le> x \<bullet> n}
  flowpipe X0 hl t CX Y
  fst ` X0 \<inter> {x. c \<le> x \<bullet> n} = {}
  n \<noteq> (0::'a)
  closed R
  R \<subseteq> plane n c
  \<lbrakk>(?x2, ?d2) \<in> CX; ?x2 \<bullet> n = c\<rbrakk>
  \<Longrightarrow> (?x2,
                     ?d2 -
                     (blinfun_scaleR_left (f ?x2) o\<^sub>L
                      (blinfun_scaleR_left
                        (inverse (f ?x2 \<bullet> n)) o\<^sub>L
                       (blinfun_inner_left n o\<^sub>L ?d2))))
                    \<in> PDP
  (?x2, ?d2) \<in> PDP \<Longrightarrow> f ?x2 \<bullet> n \<noteq> 0
  (?x2, ?d2) \<in> PDP \<Longrightarrow> ?x2 \<in> R
  (?x2, ?d2) \<in> PDP \<Longrightarrow>
  \<forall>\<^sub>F x in at ?x2 within plane n c. x \<in> R
  (x, d) \<in> X0
  0 \<le> s
  s \<le> t
  flow0 x s \<in> {x. c \<le> x \<bullet> n}
  t \<in> existence_ivl0 x
  \<lbrakk>0 \<le> ?s2; ?s2 \<le> t\<rbrakk>
  \<Longrightarrow> (flow0 x ?s2, Dflow x ?s2 o\<^sub>L d) \<in> CX
  (flow0 x t, Dflow x t o\<^sub>L d) \<in> Y
  0 < s'
  {0..t} \<subseteq> existence_ivl0 x
  frontier {x. c \<le> x \<bullet> n} \<subseteq> {x. c \<le> x \<bullet> n}

goal (1 subgoal):
 1. (x, d)
    \<in> {x \<in> X0.
           flowsto {x} {0<..t}
            (CX \<inter> {x. x \<bullet> n < c} \<times> UNIV)
            (CX \<inter> {x \<in> R. x \<bullet> n = c} \<times> UNIV)}


proof (prove)
goal (1 subgoal):
 1. D.iso
     (\<Phi> (g, f) \<cdot>\<^sub>D
      (F g \<star>\<^sub>D F f) \<cdot>\<^sub>D
      (\<mu> \<star>\<^sub>D F f) \<cdot>\<^sub>D
      \<phi> \<cdot>\<^sub>D D.inv (unit (src\<^sub>C f)))


proof (prove)
using this:
  K \<subseteq> carrier R
  polynomial ?K ?p \<Longrightarrow> set ?p \<subseteq> ?K
  polynomial K p

goal (1 subgoal):
 1. set p \<subseteq> carrier R


proof (prove)
goal (1 subgoal):
 1. shd (sdrop (LEAST n. enabled (shd (sdrop n rs)) s) rs) \<in> R &&&
    enabled (shd (sdrop (LEAST n. enabled (shd (sdrop n rs)) s) rs)) s &&&
    fair (sdrop (LEAST n. enabled (shd (sdrop n rs)) s) rs)


proof (prove)
using this:
  wtL l
  I.wtE (kE \<xi>)

goal (1 subgoal):
 1. I.satL (kE \<xi>) l = F.satL \<xi> l


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>P,E,s \<turnstile> e : T \<surd>;
     \<D> e \<lfloor>dom (lcl s)\<rfloor>;
     P,shp s \<turnstile>\<^sub>b (e,b) \<surd>; \<not> final e\<rbrakk>
    \<Longrightarrow> \<exists>e' s' b'.
                         P \<turnstile> \<langle>e,s,
   b\<rangle> \<rightarrow>
  \<langle>e',s',b'\<rangle>


proof (prove)
goal (2 subgoals):
 1. \<And>v \<phi> b.
       \<lbrakk>finite (dom (Mapping.lookup (phis'_code g next)));
        v \<in> snd ` dom (Mapping.lookup (phis g));
        snd next \<in> set (the (Mapping.lookup (phis g) \<phi>));
        Mapping.lookup (phis g) \<phi> = Some b\<rbrakk>
       \<Longrightarrow> (case Mapping.lookup
                                (uninst_code.nodes_of_phis' g next
                                  (uninst_code.substitution_code phis g
                                    next)
                                  nodes_of_phis)
                                v of
                          None \<Rightarrow> {}
                          | Some x \<Rightarrow> id x) =
                         (case if \<exists>n
     \<in>dom (Mapping.lookup (phis g)) - {v. snd v = snd next}.
                                     v \<in> set
        (the (if snd n = snd next then None
              else map_option
                    (map (\<lambda>v.
                             if v = snd next
                             then uninst_code.substitution_code phis g next
                             else v))
                    (Mapping.lookup (phis g) n)))
                               then Some
                                     {n
\<in> dom (Mapping.lookup (phis g)) - {v. snd v = snd next}.
v \<in> set (the (if snd n = snd next then None
                  else map_option
                        (map (\<lambda>v.
                                 if v = snd next
                                 then uninst_code.substitution_code phis g
 next
                                 else v))
                        (Mapping.lookup (phis g) n)))}
                               else None of
                          None \<Rightarrow> {} | Some x \<Rightarrow> id x)
 2. \<And>v.
       \<lbrakk>finite (dom (Mapping.lookup (phis'_code g next)));
        v \<in> snd ` dom (Mapping.lookup (phis g));
        \<not> (\<exists>\<phi>\<in>Mapping.keys (phis g).
                   snd next
                   \<in> set (the (Mapping.lookup (phis g)
                                    \<phi>)))\<rbrakk>
       \<Longrightarrow> (case Mapping.lookup
                                (uninst_code.nodes_of_phis' g next
                                  (uninst_code.substitution_code phis g
                                    next)
                                  nodes_of_phis)
                                v of
                          None \<Rightarrow> {}
                          | Some x \<Rightarrow> id x) =
                         (case if \<exists>n
     \<in>dom (Mapping.lookup (phis g)) - {v. snd v = snd next}.
                                     v \<in> set
        (the (if snd n = snd next then None
              else map_option
                    (map (\<lambda>v.
                             if v = snd next
                             then uninst_code.substitution_code phis g next
                             else v))
                    (Mapping.lookup (phis g) n)))
                               then Some
                                     {n
\<in> dom (Mapping.lookup (phis g)) - {v. snd v = snd next}.
v \<in> set (the (if snd n = snd next then None
                  else map_option
                        (map (\<lambda>v.
                                 if v = snd next
                                 then uninst_code.substitution_code phis g
 next
                                 else v))
                        (Mapping.lookup (phis g) n)))}
                               else None of
                          None \<Rightarrow> {} | Some x \<Rightarrow> id x)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<in> (\<lambda>xs.
                         wordinterval_sort
                          (wordinterval_compress
                            (foldr wordinterval_union xs
                              Empty_WordInterval))) `
                     set (groupWIs c rs);
     B \<in> (\<lambda>xs.
                 wordinterval_sort
                  (wordinterval_compress
                    (foldr wordinterval_union xs Empty_WordInterval))) `
             set (groupWIs c rs);
     A \<noteq> B\<rbrakk>
    \<Longrightarrow> \<forall>ip1\<in>wordinterval_to_set A.
                         \<forall>ip2\<in>wordinterval_to_set B.
                            \<not> same_fw_behaviour_one ip1 ip2 c rs


proof (prove)
using this:
  \<forall>y.
      |x\<rangle> y
     \<le>  |x\<rangle>  |x\<^sup>\<star>\<rangle> \<Omega> x y

goal (1 subgoal):
 1. \<forall>y.  |x\<rangle> y \<le>  |x\<rangle> \<Omega> x y


proof (prove)
goal (1 subgoal):
 1. LIM x F. f x * g x :> at_bot


proof (prove)
goal (1 subgoal):
 1. (\<Sum>i\<in>UNIV. (f i)\<^sup>2 * (x $ i)\<^sup>2)
    \<le> Max {(f i)\<^sup>2 |i. i \<in> UNIV} *
          (\<Sum>i\<in>UNIV. (x $ i)\<^sup>2)


proof (prove)
goal (1 subgoal):
 1. (\<lambda>n. \<mu>.expectation n (indicat_real A))
    \<longlonglongrightarrow> M.expectation (indicat_real A)


proof (prove)
goal (1 subgoal):
 1. w1 = basic [brick.under] \<circ> basic [over] \<and>
    w2 = basic [vert, vert] \<circ> basic [vert, vert] \<Longrightarrow>
    kauff_mat w1 = kauff_mat w2


proof (prove)
using this:
  i \<in> agents
  total_preorder_on alts Ri'
  finite_total_preorder_on alts Ri'

goal (1 subgoal):
 1. pref_profile_wf agents alts (R(i := Ri'))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sorted1 (inorder (Splay_Map.splay x t));
     Splay_Map.splay x t = \<langle>l, a, r\<rangle>\<rbrakk>
    \<Longrightarrow> Sorted_Less.sorted
                       (map fst (inorder l) @ x # map fst (inorder r))


proof (prove)
goal (1 subgoal):
 1. (mod_ring_rel32 ===> mod_ring_rel32) (inverse_p32 pp) inverse


proof (prove)
goal (1 subgoal):
 1. (f has_derivative
     (\<lambda>x.
         x *\<^sub>R
         (SOME f'. (f has_derivative (\<lambda>x. x *\<^sub>R f')) net)))
     net


proof (prove)
goal (1 subgoal):
 1. \<And>a b.
       \<lbrakk>(gx a b, gy a b) = 0; (a, b) \<in> trapG1;
        p1 a b \<le> 0\<rbrakk>
       \<Longrightarrow> False


proof (prove)
using this:
  ?i1 \<in> I \<Longrightarrow> H ?i1 \<subseteq> carrier (G ?i1)

goal (1 subgoal):
 1. subgroup (carrier (sum_group I G) \<inter> Pi\<^sub>E I H)
     (sum_group I G) \<Longrightarrow>
    {f \<in> \<Pi>\<^sub>E i\<in>I.
                carrier (subgroup_generated (G i) (H i)).
     finite {i \<in> I. f i \<noteq> \<one>\<^bsub>G i\<^esub>}} =
    carrier (sum_group I G) \<inter> Pi\<^sub>E I H


proof (prove)
goal (1 subgoal):
 1. homology_group 0 X \<cong>
    sum_group (path_components_of X)
     (\<lambda>S. homology_group 0 (subtopology X S))


proof (prove)
using this:
  v = - (w 0 - v)

goal (1 subgoal):
 1. v \<in> space\<^sub>N (\<LL> \<infinity> M)


proof (prove)
using this:
  (*f* (\<lambda>h. f (a + h))) (- star_of a + x) \<approx> star_of L

goal (1 subgoal):
 1. (*f* f) x \<approx> star_of L


proof (prove)
using this:
  S.inv (S.cmp\<^sub>U\<^sub>P (f, g)) \<cdot>\<^sub>S
  S.cmp\<^sub>U\<^sub>P (f, g) =
  S.UP f \<star>\<^sub>S S.UP g
  \<lbrakk>S.arr ?f; S.dom ?f = ?a\<rbrakk>
  \<Longrightarrow> ?f \<cdot>\<^sub>S ?a = ?f
  \<guillemotleft>\<xi>' : S.UP f \<star>\<^sub>S
                           S.UP
                            g \<Rightarrow>\<^sub>S S.trg
               (S.UP f)\<guillemotright>

goal (1 subgoal):
 1. \<xi>' \<cdot>\<^sub>S
    S.inv (S.cmp\<^sub>U\<^sub>P (f, g)) \<cdot>\<^sub>S
    S.cmp\<^sub>U\<^sub>P (f, g) =
    \<xi>'


proof (prove)
goal (1 subgoal):
 1. np f = (\<lambda>t. - f t) &&& pp f = (\<lambda>t. 0)


proof (prove)
goal (1 subgoal):
 1. Octonions.cnj q =
    Ree q *\<^sub>R e0 - Im1 q *\<^sub>R e1 - Im2 q *\<^sub>R e2 -
    Im3 q *\<^sub>R e3 -
    Im4 q *\<^sub>R e4 -
    Im5 q *\<^sub>R e5 -
    Im6 q *\<^sub>R e6 -
    Im7 q *\<^sub>R e7


proof (state)
goal (1 subgoal):
 1. the_elem (Set t) =
    (case rbt.impl_of t of
     rbt.Empty \<Rightarrow>
       Code.abort STR ''not_a_singleton_tree''
        (\<lambda>_. the_elem (Set t))
     | Branch color.R rbt1 x b rbt2 \<Rightarrow>
         Code.abort STR ''not_a_singleton_tree''
          (\<lambda>_. the_elem (Set t))
     | Branch color.B rbt.Empty x () rbt.Empty \<Rightarrow> x
     | Branch color.B rbt.Empty x ()
        (Branch color rbt1 aa b rbt2a) \<Rightarrow>
         Code.abort STR ''not_a_singleton_tree''
          (\<lambda>_. the_elem (Set t))
     | Branch color.B (Branch color rbt1a ab bb rbt2b) x b
        rbt2 \<Rightarrow>
         Code.abort STR ''not_a_singleton_tree''
          (\<lambda>_. the_elem (Set t)))


proof (prove)
using this:
  \<lbrakk>a' \<otimes> b' \<in> carrier G; a' \<otimes> b \<in> carrier G;
   set (as @ bs) \<subseteq> carrier G; a' \<otimes> b \<in> carrier G;
   a \<otimes> b \<in> carrier G;
   set (as @ bs) \<subseteq> carrier G\<rbrakk>
  \<Longrightarrow> wfactors G (as @ bs) (a \<otimes> b)

goal (1 subgoal):
 1. wfactors G (as @ bs) (a \<otimes> b)


proof (prove)
using this:
  (inv_msog (ms_of_greek s), inv_msog (ms_of_greek t))
  \<in> mult (letter_less r <*lex*> greek_less r)

goal (1 subgoal):
 1. (inv_greek s, inv_greek t) \<in> greek_less r


proof (prove)
goal (1 subgoal):
 1. fmap_of_list m \<circ>\<^sub>f fmap_of_list n =
    fmap_of_list (AList.compose n m)


proof (prove)
using this:
  \<forall>i\<le>n. \<not> FW M n i i < (0::'a)
  i_ \<le> n
  j_ \<le> n
  \<not> cycle_free ?m ?n \<Longrightarrow>
  \<exists>i\<le>?n. FW ?m ?n i i < (0::?'a)

goal (1 subgoal):
 1. FW M n i_ j_ = D M i_ j_ n


proof (prove)
goal (1 subgoal):
 1. AR S


proof (prove)
goal (1 subgoal):
 1. (\<And>A C B.
        \<lbrakk>M = zmset_of A + C; N = zmset_of B + C;
         A \<subset># B\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. Thm (Abs_idx (0, 0)) \<Phi>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>u'.
                (u', u) \<in> cf.E \<longrightarrow>
                l u' \<le> Suc (Min {l v |v. (u, v) \<in> cf.E});
     \<forall>v.
        (u, v) \<in> cf.E \<longrightarrow>
        Min {l v |v. (u, v) \<in> cf.E} \<le> l v\<rbrakk>
    \<Longrightarrow> (l(u := Suc (Min {l v |v. (u, v) \<in> cf.E}))) t = 0


proof (state)
this:
  negligible (S - \<Union> (range C))

goal (2 subgoals):
 1. \<And>n. compact (?C n)
 2. S = \<Union> (range ?C) \<union> (S - \<Union> (range C))


proof (prove)
goal (1 subgoal):
 1. 0 \<le> numgcdh t g


proof (prove)
using this:
  finite pid.reachable

goal (1 subgoal):
 1. finite (lih'.pid_step\<^sup>* `` {pid_init_gc})


proof (prove)
using this:
  p = [- a, 1::'a] *** q

goal (1 subgoal):
 1. poly p a = (0::'a)


proof (prove)
using this:
  \<forall>\<^sub>\<infinity>i.
     {\<psi> \<in> subformulas\<^sub>\<nu> \<phi>.
      suffix i w \<Turnstile>\<^sub>n F\<^sub>n (G\<^sub>n \<psi>)} =
     {\<psi> \<in> subformulas\<^sub>\<nu> \<phi>.
      suffix i w \<Turnstile>\<^sub>n G\<^sub>n \<psi>}

goal (1 subgoal):
 1. \<forall>\<^sub>\<infinity>j. \<nu>_stable \<phi> (suffix j w)


proof (prove)
using this:
  lt ox k (fst z)

goal (1 subgoal):
 1. le ox (fst (hd xs')) (fst z)


proof (prove)
goal (2 subgoals):
 1. \<And>l a aa b ab ac ba h v n2 k w.
       \<lbrakk>((a, aa, b), l, (ab, ac, ba), 0, h, v) \<in> Exec;
        ((a, aa, b), l, (ab, ac, ba), n2, k, w) \<in> Exec\<rbrakk>
       \<Longrightarrow> n2 = 0 \<and> h = k \<and> v = w
 2. \<And>n.
       (\<forall>n1 l M s l1 t.
           n1 \<le> n \<longrightarrow>
           (M, l, s, n1, l1, t) \<in> Step \<longrightarrow>
           (\<forall>n2 l2 r.
               (M, l, s, n2, l2, r) \<in> Step \<longrightarrow>
               n1 = n2 \<and> t = r \<and> l1 = l2)) \<and>
       (\<forall>n1 l M s h v.
           n1 \<le> n \<longrightarrow>
           (M, l, s, n1, h, v) \<in> Exec \<longrightarrow>
           (\<forall>n2 k w.
               (M, l, s, n2, k, w) \<in> Exec \<longrightarrow>
               n1 = n2 \<and> h = k \<and> v = w)) \<Longrightarrow>
       (\<forall>n1 l M s l1 t.
           n1 \<le> Suc n \<longrightarrow>
           (M, l, s, n1, l1, t) \<in> Step \<longrightarrow>
           (\<forall>n2 l2 r.
               (M, l, s, n2, l2, r) \<in> Step \<longrightarrow>
               n1 = n2 \<and> t = r \<and> l1 = l2)) \<and>
       (\<forall>n1 l M s h v.
           n1 \<le> Suc n \<longrightarrow>
           (M, l, s, n1, h, v) \<in> Exec \<longrightarrow>
           (\<forall>n2 k w.
               (M, l, s, n2, k, w) \<in> Exec \<longrightarrow>
               n1 = n2 \<and> h = k \<and> v = w))


proof (prove)
goal (1 subgoal):
 1. mod_exp_aux m y x 0 = y &&& mod_exp_aux m y x (Suc 0) = x * y mod m


proof (prove)
using this:
  wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s
   (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t A \<union>
    pair ` setops\<^sub>s\<^sub>s\<^sub>t (unlabel A))

goal (1 subgoal):
 1. wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s
     (trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj l A) \<union>
      pair ` setops\<^sub>s\<^sub>s\<^sub>t (proj_unl l A))


proof (prove)
goal (1 subgoal):
 1. pi \<bullet> t[X \<mapsto>\<^sub>\<tau> T] =
    (pi \<bullet> t)[pi \<bullet> X \<mapsto>\<^sub>\<tau> pi \<bullet> T]


proof (prove)
using this:
  extended_to_set p \<union> extended_to_set q
  \<subseteq> I ` insert_messages M
  create_insert s n \<sigma> new_id =
  Inr (Insert (InsertMessage p new_id q \<sigma>))
  Inr m = create_insert s n \<sigma> new_id

goal (1 subgoal):
 1. deps m \<subseteq> I ` insert_messages M


proof (prove)
using this:
  \<lbrakk>arr t; arr \<omega>.the_\<theta>;
   arr r\<^sub>0s\<^sub>1.p\<^sub>1; src t = trg \<omega>.the_\<theta>;
   src \<omega>.the_\<theta> = trg r\<^sub>0s\<^sub>1.p\<^sub>1\<rbrakk>
  \<Longrightarrow> \<a>[cod t, cod \<omega>.the_\<theta>, cod
                      r\<^sub>0s\<^sub>1.p\<^sub>1] \<cdot>
                    ((t \<star> \<omega>.the_\<theta>) \<star>
                     r\<^sub>0s\<^sub>1.p\<^sub>1) =
                    (t \<star>
                     \<omega>.the_\<theta> \<star>
                     r\<^sub>0s\<^sub>1.p\<^sub>1) \<cdot>
                    \<a>[local.dom
                          t, local.dom
                              \<omega>.the_\<theta>, local.dom
                r\<^sub>0s\<^sub>1.p\<^sub>1]
  trg \<omega>.the_\<theta> = src t
  hseq r\<^sub>1 r\<^sub>0s\<^sub>1.p\<^sub>1
  hseq ?\<nu> ?\<mu> =
  (arr ?\<mu> \<and> arr ?\<nu> \<and> src ?\<nu> = trg ?\<mu>)

goal (1 subgoal):
 1. (t \<star>
     \<omega>.the_\<theta> \<star> r\<^sub>0s\<^sub>1.p\<^sub>1) \<cdot>
    \<a>[t, t\<^sub>0 \<star>
            \<omega>.chine, r\<^sub>0s\<^sub>1.p\<^sub>1] =
    \<a>[t, r\<^sub>0, r\<^sub>0s\<^sub>1.p\<^sub>1] \<cdot>
    ((t \<star> \<omega>.the_\<theta>) \<star> r\<^sub>0s\<^sub>1.p\<^sub>1)


proof (prove)
using this:
  finite A
  x \<notin> A
  ?k \<le> card A \<Longrightarrow> \<exists>B\<subseteq>A. card B = ?k
  k \<le> card (insert x A)

goal (1 subgoal):
 1. \<exists>B\<subseteq>A. card B = k - 1


proof (state)
this:
  \<lbrakk>rel_sum boa bob ?x ?y; rel_sum boa bob ?y ?x;
   ?x \<in> {x. setl x \<subseteq> A \<and> setr x \<subseteq> B}\<rbrakk>
  \<Longrightarrow> ?x = ?y

goal (1 subgoal):
 1. rel_sum boa bob \<le> vimage2p (map_sum rha rhb) (map_sum rha rhb) (=)


proof (prove)
using this:
  S,kind \<turnstile> (m # ms,s) =as\<Rightarrow>\<^sub>\<tau> (m' # ms',s')
  as = as' @ [a']
  as' = asx @ ax # asx'

goal (1 subgoal):
 1. (\<And>msx sx.
        \<lbrakk>S,kind \<turnstile> (m #
ms,s) =asx\<Rightarrow>\<^sub>\<tau> (msx,sx);
         S,kind \<turnstile> (msx,sx) =ax #
 asx' @ [a']\<Rightarrow>\<^sub>\<tau> (m' # ms',s')\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Bseq X; monoseq X\<rbrakk> \<Longrightarrow> convergent X


proof (prove)
goal (1 subgoal):
 1. ffold f z (finsert x A) = f x (ffold f z A)


proof (prove)
goal (1 subgoal):
 1. P


proof (prove)
using this:
  \<integral>\<^sup>+ x. ennreal (pmf pq (None, x))
                     \<partial>count_space UNIV =
  ennreal (pmf p None) - ennreal (pmf q None) + ennreal (pmf q None)

goal (1 subgoal):
 1. \<integral>\<^sup>+ x. ennreal (pmf pq (i, x))
                       \<partial>count_space UNIV =
    ennreal (pmf p i)


proof (prove)
using this:
  dip \<in> kD rt
  dip \<in> kD (invalidate rt dests)

goal (1 subgoal):
 1. rt \<approx>\<^bsub>dip\<^esub> invalidate rt dests


proof (prove)
goal (1 subgoal):
 1. \<And>F.
       \<nu>\<upsilon> y = \<nu>\<upsilon> x \<and>
       [\<phi> (y\<^sup>P) in v] \<Longrightarrow>
       (\<exists>r o\<^sub>1.
           Some r = Semantics.d\<^sub>1 F \<and>
           Some o\<^sub>1 = Semantics.d\<^sub>\<kappa> (x\<^sup>P) \<and>
           o\<^sub>1 \<in> Semantics.ex1 r v) =
       (\<exists>r o\<^sub>1.
           Some r = Semantics.d\<^sub>1 F \<and>
           Some o\<^sub>1 = Semantics.d\<^sub>\<kappa> (y\<^sup>P) \<and>
           o\<^sub>1 \<in> Semantics.ex1 r v)


proof (prove)
using this:
  wf_matchF_invar \<sigma> V n R I r st (Suc i)
  to_mregex r = (mr, \<phi>s)
  st = (aux, X)
  ms \<in> LPDs mr

goal (1 subgoal):
 1. qtable n (fv_regex r) (mem_restr R)
     (\<lambda>v.
         Regex.match (Formula.sat \<sigma> V (map the v))
          (from_mregex ms \<phi>s) i (i + length aux))
     (l\<delta> (\<lambda>x. x) X rels ms)


proof (prove)
goal (1 subgoal):
 1. bisimulation trsys1 trsys2 bisim tlsim


proof (prove)
using this:
  ord_spmf (rel_generat (=) (=) (rel_fun (=) ord_gpv)) (the_gpv f)
   (the_gpv g)
  ord_spmf (rel_generat (=) (=) (rel_fun (=) ord_gpv)) (the_gpv g)
   (the_gpv f)

goal (1 subgoal):
 1. rel_spmf
     (rel_generat (=) (=) (rel_fun (=) ord_gpv) \<sqinter>
      (rel_generat (=) (=) (rel_fun (=) ord_gpv))\<inverse>\<inverse>)
     (the_gpv f) (the_gpv g)


proof (prove)
goal (1 subgoal):
 1. \<Gamma>\<turnstile> (c, s) \<rightarrow>\<^sup>* (Skip, Fault f)


proof (prove)
goal (1 subgoal):
 1. bij_on_trancl (\<sqsubset>) Bag


proof (prove)
using this:
  \<triangle> t
  \<triangle> t \<Longrightarrow>
  let s' = assert_bound_loop ats (init t)
  in \<triangle> (\<T> s') \<and>
     \<nabla> s' \<and>
     (\<not> \<U> s' \<longrightarrow>
      \<Turnstile>\<^sub>n\<^sub>o\<^sub>l\<^sub>h\<^sub>s s' \<and>
      \<diamond> s')
  \<lbrakk>\<not> \<U> ?s;
   \<Turnstile>\<^sub>n\<^sub>o\<^sub>l\<^sub>h\<^sub>s ?s; \<diamond> ?s;
   \<triangle> (\<T> ?s); \<nabla> ?s; \<not> \<U> (check ?s)\<rbrakk>
  \<Longrightarrow> \<Turnstile> (check ?s)
  \<U> ?s \<Longrightarrow> check ?s = ?s

goal (1 subgoal):
 1. \<not> \<U> (check (assert_bound_loop ats (init t))) \<Longrightarrow>
    \<Turnstile> (check (assert_bound_loop ats (init t)))


proof (prove)
goal (1 subgoal):
 1. vertical_composite B D (K \<circ> F) (L \<circ> G) (M \<circ> H)
     (\<sigma> \<circ> \<tau>) (\<mu> \<circ> \<nu>)


proof (prove)
using this:
  qSkel (X #[[y \<and> x]]_xs) = qSkel (X' #[[y \<and> x']]_xs)

goal (1 subgoal):
 1. qSkel X = qSkel X'


proof (prove)
goal (1 subgoal):
 1. \<exists>s\<in>setops\<^sub>s\<^sub>s\<^sub>t S.
       \<exists>X.
          set X \<subseteq> bvars\<^sub>s\<^sub>s\<^sub>t S \<and>
          p = s \<cdot>\<^sub>p rm_vars (set X) \<delta>


proof (prove)
goal (1 subgoal):
 1. \<bar>fs.gs.\<mu> i (i - 1)\<bar> \<le> inverse 2


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>s args.
                \<lbrakk>strip_comb pat = (Const s, args);
                 pat = s $$ args\<rbrakk>
                \<Longrightarrow> thesis;
     \<And>s.
        \<lbrakk>strip_comb pat = (Free s, []); pat = Free s\<rbrakk>
        \<Longrightarrow> thesis\<rbrakk>
    \<Longrightarrow> thesis


proof (prove)
using this:
  \<Gamma> \<turnstile> fs [:] fTs

goal (1 subgoal):
 1. (l, T) \<in> set fTs \<Longrightarrow>
    \<exists>t.
       fs\<langle>l\<rangle>\<^sub>? = \<lfloor>t\<rfloor> \<and>
       \<Gamma> \<turnstile> t : T


proof (prove)
goal (1 subgoal):
 1. \<forall>e\<in>edges.
       valid_out_port (fst e) \<and> valid_in_port (snd e)


proof (prove)
goal (1 subgoal):
 1. (\<And>C0'.
        B' Out A' C0' \<and> Cong B' C0' B C0 \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. smult s p = monom 0 s * p


proof (prove)
goal (1 subgoal):
 1. (typeof\<^bsub>h\<^esub> v = \<lfloor>Boolean\<rfloor>) =
    (\<exists>b. v = Bool b)


proof (prove)
goal (1 subgoal):
 1. (rel_blindable\<^sub>m (rel_prod (=) (list_all2 pcr_view\<^sub>m))
      (rel_prod (=) (list_all2 pcr_view\<^sub>h)) ===>
     pcr_view\<^sub>m)
     Tree\<^sub>m View\<^sub>m


proof (state)
this:
  J \<subseteq> gen P I

goal (2 subgoals):
 1. \<And>x.
       x \<in> gen P I \<Longrightarrow>
       x \<in> \<Union> {J \<in> P. J \<subseteq> gen P I}
 2. \<And>x X.
       \<lbrakk>x \<in> X; X \<in> P; X \<subseteq> gen P I\<rbrakk>
       \<Longrightarrow> x \<in> gen P I


proof (prove)
using this:
  Ball F is_monomial
  f0 \<in> F

goal (1 subgoal):
 1. is_monomial f0


proof (prove)
goal (1 subgoal):
 1. a_transform (ae, a, as) (\<Gamma>, App e x, S) \<Rightarrow>
    a_transform (ae, inc\<cdot>a, as) (\<Gamma>, e, Arg x # S)


proof (prove)
using this:
  C0 \<sim> D0
  f ` D0 = C0
  D0 \<in> folding_g.\<C> - f \<turnstile> folding_g.\<C>
  C0 \<in> folding_g.\<C> - g \<turnstile> folding_g.\<C>
  C0 \<in> folding_g.\<C> - g \<turnstile> folding_g.\<C> \<Longrightarrow>
  g \<turnstile> folding_g.\<C> =
  {B \<in> folding_g.\<C>.
   order.greater (chamber_distance B C0) (chamber_distance B D0)}
  C0 \<in> folding_g.\<C> - g \<turnstile> folding_g.\<C> \<Longrightarrow>
  folding_g.\<C> - g \<turnstile> folding_g.\<C> =
  {B \<in> folding_g.\<C>.
   order.greater (chamber_distance B D0) (chamber_distance B C0)}
  D0 \<in> folding_g.\<C> - f \<turnstile> folding_g.\<C> \<Longrightarrow>
  f \<turnstile> folding_g.\<C> =
  {B \<in> folding_g.\<C>.
   order.greater (chamber_distance B D0) (chamber_distance B (f ` D0))}
  D0 \<in> folding_g.\<C> - f \<turnstile> folding_g.\<C> \<Longrightarrow>
  folding_g.\<C> - f \<turnstile> folding_g.\<C> =
  {B \<in> folding_g.\<C>.
   order.greater (chamber_distance B (f ` D0)) (chamber_distance B D0)}
  C0 \<sim> D0 \<Longrightarrow> D0 \<sim> C0

goal (1 subgoal):
 1. folding_g.\<C> - f \<turnstile> folding_g.\<C> =
    g \<turnstile> folding_g.\<C>


proof (prove)
goal (1 subgoal):
 1. gcd (e - e') (order \<G>) = 1


proof (prove)
goal (1 subgoal):
 1. ((Out ===> (In ===> M) ===> M) ===>
     Out ===> (In ===> rel_stateT S M) ===> rel_stateT S M)
     pause_state pause_state


proof (prove)
using this:
  \<exists>e>0.
     \<forall>x\<in>S.
        \<forall>y\<in>S. dist x y < e \<longrightarrow> x = y

goal (1 subgoal):
 1. (\<And>e1.
        \<lbrakk>0 < e1;
         \<forall>x\<in>S.
            \<forall>y\<in>S. dist y x < e1 \<longrightarrow> y = x\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  \<rho> \<sqsubseteq> ub

goal (1 subgoal):
 1. \<^bold>\<N>\<lbrakk> \<Gamma> \<^bold>\<rbrakk>\<^bsub>\<rho>\<^esub> \<sqsubseteq>
    \<^bold>\<N>\<lbrakk> \<Gamma> \<^bold>\<rbrakk>\<^bsub>ub\<^esub>


proof (state)
this:
  ?y < xa \<Longrightarrow> hoare (p ?y) x q

goal (1 subgoal):
 1. \<And>xa.
       \<lbrakk>F x = x;
        \<And>w f.
           (\<And>v.
               v < w \<Longrightarrow> hoare (p v) f q) \<Longrightarrow>
           hoare (p w) (F f) q;
        \<And>y. y < xa \<Longrightarrow> hoare (p y) x q\<rbrakk>
       \<Longrightarrow> hoare (p xa) x q


proof (state)
goal (1 subgoal):
 1. M = uniform_measure (count_space (Pow (B \<times> B))) (linorders_on A)


proof (prove)
using this:
  (u expands_to const_expansion (- 1)) bs

goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. u x = - 1


proof (prove)
goal (1 subgoal):
 1. coprime (inv hom x') y = coprime x' (hom y)


proof (prove)
using this:
  k \<noteq> 0
  similarity I M1 = k *\<^sub>s\<^sub>m M2

goal (1 subgoal):
 1. moebius_cmat_eq M1 (moebius_mb_cmat (moebius_inv_cmat I) M2)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Subobjs\<^sub>R x xa xb;
     \<And>P C.
        \<lbrakk>x = P; xa = C; xb = [C]; is_class P C\<rbrakk>
        \<Longrightarrow> thesis;
     \<And>Pa_ Ca_ Cs_ D_.
        \<lbrakk>x = Pa_; xa = Ca_; xb = Ca_ # Cs_; subclsRp Pa_ Ca_ D_;
         Subobjs\<^sub>R Pa_ D_ Cs_\<rbrakk>
        \<Longrightarrow> thesis\<rbrakk>
    \<Longrightarrow> thesis


proof (prove)
using this:
  u \<cdot> r = r \<cdot> v
  u \<noteq> \<epsilon>

goal (1 subgoal):
 1. u \<sim> v


proof (prove)
using this:
  n \<le> 0

goal (1 subgoal):
 1. ennreal (prod (prob_component p x) {0..n}) =
    ennreal (prob_component p x 0)


proof (prove)
goal (1 subgoal):
 1. local.put_state s (local.put_state s' m) = local.put_state s' m


proof (prove)
using this:
  castAbs xs s (Abs xs x X) = (x', X')

goal (1 subgoal):
 1. absCase xs s f (Abs xs x X) = f x' X'


proof (prove)
goal (1 subgoal):
 1. (\<Union>U\<in>{{u..next_in A u} |u. u \<in> A - {b}}. U)
    \<subseteq> {a..b}


proof (prove)
using this:
  b = a + int n * k
  gauss_sum_int (a + of_int k * int n) = gauss_sum_int a

goal (1 subgoal):
 1. gauss_sum_int a = gauss_sum_int b


proof (state)
this:
  {x0} \<times> C \<subseteq> W

goal (1 subgoal):
 1. (\<And>X0.
        \<lbrakk>x0 \<in> X0; open X0;
         \<forall>x\<in>X0 \<inter> U.
            \<forall>t\<in>C. dist (fx (x, t)) (fx (x0, t)) \<le> e\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  \<sigma> \<doteq> \<theta> \<lozenge> \<eta>
  eligible_literal L1 P1 \<sigma>
  \<lbrakk>eligible_literal ?L ?C ?\<sigma>;
   ?\<sigma> \<doteq> ?\<theta> \<lozenge> ?\<eta>\<rbrakk>
  \<Longrightarrow> eligible_literal ?L ?C ?\<theta>

goal (1 subgoal):
 1. eligible_literal L1 P1 \<theta>


proof (prove)
using this:
  C.obj a
  C.obj a'
  \<guillemotleft>g : map\<^sub>0
                       a \<rightarrow>\<^sub>D map\<^sub>0
          a'\<guillemotright>
  C.obj ?a \<Longrightarrow> D.ide (\<tau>\<^sub>0 ?a)
  C.obj ?a \<Longrightarrow>
  trg\<^sub>D (\<sigma>'.map\<^sub>0 ?a) = F.map\<^sub>0 ?a
  C.obj ?a \<Longrightarrow> C.arr ?a
  C.obj ?a \<Longrightarrow> src\<^sub>C ?a = ?a
  C.obj ?a \<Longrightarrow> trg\<^sub>C ?a = ?a
  C.obj ?a \<Longrightarrow> C.dom ?a = ?a
  C.obj ?a \<Longrightarrow> C.cod ?a = ?a

goal (1 subgoal):
 1. \<guillemotleft>\<sigma>'.map\<^sub>0 a' \<star>\<^sub>D
                    g \<star>\<^sub>D
                    \<tau>\<^sub>0
                     a : F.map\<^sub>0
                          a \<rightarrow>\<^sub>D F.map\<^sub>0
             a'\<guillemotright>


proof (prove)
goal (1 subgoal):
 1. (pcr_stream A ===> rel_set A) lset sset


proof (prove)
using this:
  f \<cong>\<^sub>C
  F (\<eta>'.map\<^sub>0 b' \<star>\<^sub>D
     G f \<star>\<^sub>D \<eta>\<^sub>0 b)

goal (1 subgoal):
 1. \<exists>g.
       \<guillemotleft>g : b \<rightarrow>\<^sub>D b'\<guillemotright> \<and>
       D.ide g \<and> F g \<cong>\<^sub>C f


proof (prove)
goal (1 subgoal):
 1. natural_isomorphism (\<cdot>\<^sub>A) (\<cdot>\<^sub>B) G F \<tau>'


proof (prove)
using this:
  (?q1, ?ri1)
  \<in> set todo \<union> set ((q1, ri1) # old') \<Longrightarrow>
  ?q1 \<noteq> 0
  (?q1, ?ri1)
  \<in> set todo \<union> set ((q1, ri1) # old') \<Longrightarrow>
  root_info_cond ?ri1 ?q1
  (q2, ri2) \<in> set old'
  root_info.l_r ri2 l r \<noteq> 0

goal (1 subgoal):
 1. root_info_cond ri2 q2


proof (prove)
using this:
  finite (Units S)
  \<phi> (2, 1) \<in> Units S

goal (1 subgoal):
 1. card (generate S' {\<phi> (2, 1)}) \<le> card (carrier S')


proof (prove)
goal (1 subgoal):
 1. \<forall>x y z.
       x \<in> carrier rec_rng_of_frac \<longrightarrow>
       y \<in> carrier rec_rng_of_frac \<longrightarrow>
       z \<in> carrier rec_rng_of_frac \<longrightarrow>
       (x \<oplus>\<^bsub>rec_rng_of_frac\<^esub>
        y) \<otimes>\<^bsub>rec_rng_of_frac\<^esub>
       z =
       x \<otimes>\<^bsub>rec_rng_of_frac\<^esub>
       z \<oplus>\<^bsub>rec_rng_of_frac\<^esub>
       y \<otimes>\<^bsub>rec_rng_of_frac\<^esub> z


proof (prove)
using this:
  ((=) ===> pcr_word) of_int of_int

goal (1 subgoal):
 1. ((=) ===> pcr_word) (\<lambda>k. k) of_int


proof (prove)
goal (1 subgoal):
 1. R\<^sup>*\<^sup>* (\<pi>_Fbcb x) y \<Longrightarrow>
    \<exists>z. Ebc x z \<and> y = \<pi>_Fbcb z


proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F y in at x.
       \<lfloor>f y\<rfloor> = \<lfloor>f x\<rfloor>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fst instr = call_type CALL;
     \<not> snd (call_instr instr s1) \<and>
     \<not> snd (call_instr instr s2) \<and>
     snd (fst (dispatch_instruction instr s1)) =
     snd (fst (call_instr instr s1)) \<and>
     snd (fst (dispatch_instruction instr s2)) =
     snd (fst (call_instr instr s2));
     low_equal s1 s2 \<and>
     get_S (cpu_reg_val PSR s1) = 0 \<and>
     get_S (cpu_reg_val PSR s2) = 0 \<and>
     \<not> snd (dispatch_instruction instr s1) \<and>
     \<not> snd (dispatch_instruction instr s2) \<and>
     t1 = snd (fst (call_instr instr s1)) \<and>
     t2 = snd (fst (call_instr instr s2));
     get_trap_set s1 = {} \<and> get_trap_set s2 = {}\<rbrakk>
    \<Longrightarrow> low_equal (snd (fst (call_instr instr s1)))
                       (snd (fst (call_instr instr s2)))


proof (prove)
goal (1 subgoal):
 1. normal_form F 0 = 0


proof (prove)
using this:
  reduced_run ?q ?v\<^sub>1 ?v\<^sub>2 ?l ?w ?w\<^sub>1 ?w\<^sub>2
   ?u \<Longrightarrow>
  ?v\<^sub>1 @ ?l =\<^sub>F ?w\<^sub>1
  reduced_run q v\<^sub>1 v\<^sub>2 l w w\<^sub>1 w\<^sub>2 u

goal (1 subgoal):
 1. length v\<^sub>1 \<le> length w\<^sub>1


proof (prove)
using this:
  card (carrier G) = card (carrier H)

goal (1 subgoal):
 1. finite (carrier H)


proof (prove)
goal (1 subgoal):
 1. y.C 0 m (\<lambda>_. undefined) \<bind>
    (\<lambda>x.
        distr (y.eP m x) (Pi\<^sub>M {0..<Suc (Suc m)} (\<lambda>i. M))
         (case_nat y)) =
    distr (y.C 0 m (\<lambda>_. undefined) \<bind> y.eP m)
     (Pi\<^sub>M {0..<Suc (Suc m)} (\<lambda>i. M)) (case_nat y)


proof (prove)
goal (1 subgoal):
 1. false\<^sub>n \<notin> \<A> \<Longrightarrow>
    \<A> \<Turnstile>\<^sub>P \<phi>[X]\<^sub>\<nu> =
    {\<psi>. \<psi>[X]\<^sub>\<nu> \<in> \<A>} \<Turnstile>\<^sub>P \<phi>


proof (prove)
goal (1 subgoal):
 1. norm (x + y) \<le> norm x + norm y


proof (prove)
goal (1 subgoal):
 1. ((A ===> A ===> A) ===> (A ===> A ===> A) ===> (=))
     (semiring_ow (Collect (Domainp A))) class.semiring


proof (state)
this:
  \<lbrakk>?x \<in> carrier G; ?y \<in> carrier G;
   N #> ?x = N #> ?y\<rbrakk>
  \<Longrightarrow> h ?x = h ?y

goal (1 subgoal):
 1. (\<And>g.
        \<lbrakk>g \<in> hom (G Mod N) H;
         \<And>x.
            x \<in> carrier G \<Longrightarrow> g (N #> x) = h x\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (state)
this:
  k \<equiv> \<lambda>x. C x g

goal (1 subgoal):
 1. \<And>x y.
       resumption.le_fun x y \<Longrightarrow>
       resumption_ord (B x \<bind> (\<lambda>y. C y x))
        (B y \<bind> (\<lambda>ya. C ya y))


proof (prove)
goal (1 subgoal):
 1. rsquarefree p


proof (prove)
goal (1 subgoal):
 1. integrable (Pi\<^sub>M I (\<lambda>i. distr M borel (Y i)))
     (\<lambda>\<omega>. prod \<omega> I)


proof (prove)
using this:
  check_types P mxs mxl (map OK \<tau>s)
  length \<tau>s = length is

goal (1 subgoal):
 1. map OK \<tau>s \<in> list (length is) A


proof (prove)
using this:
  b \<in> \<K> s
  (x, a) \<in> set_pmf b
  b = return_pmf (l, R'_)
  s \<in> {(l, R).
           l \<in> L \<and>
           R \<in> \<R> \<and>
           R \<subseteq> {u. u \<turnstile> PTA.inv_of A l}}
  s = (l, R)
  R'_ \<in> Succ \<R> R
  R'_ \<subseteq> {v. v \<turnstile> PTA.inv_of A l}

goal (1 subgoal):
 1. (x, a)
    \<in> {(l, R).
           l \<in> L \<and>
           R \<in> \<R> \<and>
           R \<subseteq> {u. u \<turnstile> PTA.inv_of A l}}


proof (prove)
goal (2 subgoals):
 1. \<And>c c' x.
       \<lbrakk>finite X; strip c = strip c';
        \<forall>S\<in>set (annos c). domo S \<subseteq> X;
        \<forall>S\<in>set (annos c'). domo S \<subseteq> X;
        c' \<sqsubseteq> c; \<not> c \<sqsubseteq> c \<triangle>\<^sub>c c';
        length (annos c') = length (annos c); x < length (annos c)\<rbrakk>
       \<Longrightarrow> n_o (n_st n_ivl X)
                          (annos c ! x \<triangle> annos c' ! x)
                         \<le> n_o (n_st n_ivl X) (annos c ! x)
 2. \<And>c c'.
       \<lbrakk>finite X; strip c = strip c';
        \<forall>S\<in>set (annos c). domo S \<subseteq> X;
        \<forall>S\<in>set (annos c'). domo S \<subseteq> X;
        c' \<sqsubseteq> c; \<not> c \<sqsubseteq> c \<triangle>\<^sub>c c';
        length (annos c') = length (annos c)\<rbrakk>
       \<Longrightarrow> \<exists>a\<in>{0..<length (annos c)}.
                            n_o (n_st n_ivl X)
                             (annos c ! a \<triangle> annos c' ! a)
                            < n_o (n_st n_ivl X) (annos c ! a)


proof (prove)
using this:
  compare\<cdot>x\<cdot>y = EQ

goal (1 subgoal):
 1. x = y


proof (prove)
goal (1 subgoal):
 1. \<Delta> (ffact (Suc 0)) k = of_nat (Suc 0) * ffact 0 (of_int k)


proof (prove)
goal (1 subgoal):
 1. \<zero>\<^bsub>\<lparr>carrier = a_rcosets\<^bsub>poly_ring L\<^esub> (PIdl\<^bsub>poly_ring L\<^esub> q), monoid.mult = rcoset_mult (poly_ring L) (PIdl\<^bsub>poly_ring L\<^esub> q), one = L.rupture_surj (carrier L) q \<one>\<^bsub>poly_ring L\<^esub>, zero = PIdl\<^bsub>poly_ring L\<^esub> q, add = (<+>\<^bsub>poly_ring L\<^esub>)\<rparr>\<^esub> =
    L.rupture_surj (carrier L) q \<zero>\<^bsub>poly_ring L\<^esub>


proof (prove)
goal (1 subgoal):
 1. All ge_game_dom


proof (prove)
using this:
  (upd ^^ 0) init = ((L1, R1, SR1), L2, R2, SR2)
  g 0 = (L, R)

goal (1 subgoal):
 1. I L1 \<and>
    I L2 \<and>
    root_cond (p1, L1, R1) x \<and>
    root_cond (p2, L2, R2) y \<and>
    (\<exists>!a. root_cond (p1, L1, R1) a) \<and>
    (\<exists>!a. root_cond (p2, L2, R2) a) \<and>
    in_interval (L, R) (f x y) \<and>
    (0 = Suc j \<longrightarrow>
     sub_interval (g 0) (g j) \<and>
     R - L \<le> 3 / 4 * (snd (g j) - fst (g j))) \<and>
    SR1 = sgn (ipoly p1 R1) \<and> SR2 = sgn (ipoly p2 R2)


proof (prove)
using this:
  distinct ys
  inj_on fst (set ys)
  inj_on snd (set ys)

goal (1 subgoal):
 1. foldl (\<lambda>t' (x, p). ins x p t') \<langle>\<rangle> ys =
    treap_of (set ys)


proof (prove)
using this:
  x \<in>\<^sub>\<circ> (\<lambda>r\<in>\<^sub>\<circ>A.
                            set {\<langle>b, a\<rangle> |a b.
                                 \<langle>a, b\<rangle>
                                 \<in>\<^sub>\<circ> r})

goal (1 subgoal):
 1. (\<And>r.
        \<lbrakk>x =
                 \<langle>r, (\<lambda>r\<in>\<^sub>\<circ>set {r}.
                                 set {\<langle>b, a\<rangle> |a b.
\<langle>a, b\<rangle> \<in>\<^sub>\<circ> r})\<lparr>r\<rparr>\<rangle>;
         r \<in>\<^sub>\<circ> A\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. Col X Y Z


proof (prove)
using this:
  Formula.future_bounded (formula.Prev I \<phi>)
  dom P = S
  range_mapping i j P
  i \<le> Monitor.progress \<sigma> P \<phi> j

goal (1 subgoal):
 1. dom P = S \<and>
    range_mapping i (max i j) P \<and>
    i \<le> Monitor.progress \<sigma> P (formula.Prev I \<phi>) (max i j)


proof (prove)
using this:
  P \<in> {P. partition_on C P \<and> card P = j}
  B' \<in> {B'. B' \<subseteq> B \<and> card B' = k}

goal (1 subgoal):
 1. disjoint_family_on
     (\<lambda>Q.
         B - B' \<rightarrow>\<^sub>E P \<bind>
         (\<lambda>f.
             {(\<lambda>X. X \<union> {x \<in> B - B'. f x = X}) `
              P} \<bind>
             (\<lambda>P'. {P' \<union> Q})))
     {Q. partition_on B' Q}


proof (prove)
goal (1 subgoal):
 1. sat\<^sub>b \<AA> \<phi> = (\<AA> \<Turnstile>\<^sub>b RESTRICT \<phi>)


proof (prove)
goal (2 subgoals):
 1. \<lbrakk>a \<noteq> b;
     qs \<in> lang (seq [question (Atom a), Atom b, Atom b])\<rbrakk>
    \<Longrightarrow> real (T\<^sub>p [a, b] qs (OPT2 qs [a, b])) = ?opt
 2. qs \<in> lang
              (seq [question (Atom a), Atom b, Atom b]) \<Longrightarrow>
    2 / 10 * 2 + 8 / 10 * (15 / 10) \<le> 16 / 10 * ?opt


proof (prove)
using this:
  (f has_real_derivative D) (at x)

goal (1 subgoal):
 1. (\<lambda>h. (f (x + h) - f x) / h) \<midarrow>0\<rightarrow> D


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>I s; (ni, n) \<in> R s\<rbrakk>
    \<Longrightarrow> ospec (DESTRimpl ni s)
                       (\<lambda>r.
                           case n of Trueif \<Rightarrow> r = TD
                           | Falseif \<Rightarrow> r = FD
                           | IF v t e \<Rightarrow>
                               \<exists>tn en.
                                  r = IFD v tn en \<and>
                                  (tn, t) \<in> R s \<and>
                                  (en, e) \<in> R s)


proof (prove)
using this:
  Outside' {n}
   (the_elem
     (Outside' {seller} `
      (argmax \<circ> sum)
       (summedBidVector
         (pseudoAllocation
           (randomEl
             (takeAll
               (\<lambda>x.
                   winningAllocationRel (N \<union> {seller}) (set \<Omega>)
                    ((\<in>) x) b)
               (allAllocationsAlg (N \<union> {seller}) \<Omega>))
             r) <|
          ((N \<union> {seller}) \<times> finestpart (set \<Omega>)))
         (N \<union> {seller}) (set \<Omega>))
       ((argmax \<circ> sum) b
         (allAllocations (N \<union> {seller}) (set \<Omega>)))))
  \<in> soldAllocations (N - {n}) (set \<Omega>)
  finite (soldAllocations (N - {n}) (set \<Omega>))

goal (1 subgoal):
 1. sum b
     (Outside' {n}
       (the_elem
         (Outside' {seller} `
          (argmax \<circ> sum)
           (summedBidVector
             (pseudoAllocation
               (randomEl
                 (takeAll
                   (\<lambda>x.
                       winningAllocationRel (N \<union> {seller})
                        (set \<Omega>) ((\<in>) x) b)
                   (allAllocationsAlg (N \<union> {seller}) \<Omega>))
                 r) <|
              ((N \<union> {seller}) \<times> finestpart (set \<Omega>)))
             (N \<union> {seller}) (set \<Omega>))
           ((argmax \<circ> sum) b
             (allAllocations (N \<union> {seller}) (set \<Omega>))))))
    \<le> Max (sum b ` soldAllocations (N - {n}) (set \<Omega>))


proof (prove)
using this:
  xcpt_app i P pc m xt \<tau>\<^sub>2
  length (fst \<tau>\<^sub>1) = length (fst \<tau>\<^sub>2)

goal (1 subgoal):
 1. xcpt_app i P pc m xt \<tau>\<^sub>1


proof (prove)
using this:
  xs \<noteq> []
  last xs = t
  T.path xs
  hd xs \<in> vertex_subtree v
  \<lbrakk>v \<in> V; ?s \<in> vertex_subtree v; t \<in> vertex_subtree v;
   ?s \<leadsto>xs\<leadsto>\<^bsub>T\<^esub> t\<rbrakk>
  \<Longrightarrow> set xs \<subseteq> vertex_subtree v
  v \<in> V
  t \<in> vertex_subtree v

goal (1 subgoal):
 1. set xs \<subseteq> vertex_subtree v


proof (prove)
goal (1 subgoal):
 1. (h * M) Amic (h * N)


proof (prove)
goal (1 subgoal):
 1. \<forall>s\<in>{x. distinct x \<and> x \<noteq> []}.
       \<exists>b\<ge>0.
          \<forall>rs.
             set rs \<subseteq> set s \<longrightarrow>
             T\<^sub>p_on_rand' (COMB [])
              (fst (COMB []) s \<bind> (\<lambda>is. return_pmf (s, is))) rs
             \<le> real 8 / real 5 * real (T\<^sub>p_opt s rs) + b


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>binop_type op k \<tau> \<sigma> \<rho>\<^sub>1;
     binop_type op k \<tau> \<sigma> \<rho>\<^sub>2\<rbrakk>
    \<Longrightarrow> \<rho>\<^sub>1 = \<rho>\<^sub>2


proof (prove)
goal (1 subgoal):
 1. (\<guillemotleft>prj\<^sub>0 h
                      k : src (prj\<^sub>0 h
                                k) \<rightarrow> src h\<guillemotright> &&&
     \<guillemotleft>prj\<^sub>1 h
                      k : src (prj\<^sub>0 h
                                k) \<rightarrow> src k\<guillemotright>) &&&
    \<guillemotleft>prj\<^sub>0 h
                     k : prj\<^sub>0 h
                          k \<Rightarrow> prj\<^sub>0 h
     k\<guillemotright> &&&
    \<guillemotleft>prj\<^sub>1 h
                     k : prj\<^sub>1 h
                          k \<Rightarrow> prj\<^sub>1 h k\<guillemotright>


proof (state)
this:
  finprod G f {x} = f x \<otimes> finprod G f {}

goal (1 subgoal):
 1. f x = a


proof (state)
this:
  \<exists>t'. t' \<in>\<^sub>A frontier (c_imp c loc) \<and> t' \<le> t
  n \<noteq> 0

goal (1 subgoal):
 1. the_cm c loc t n = apply_cm c loc t n


proof (prove)
goal (1 subgoal):
 1. (\<And>g.
        \<lbrakk>continuous_on UNIV g; range g \<subseteq> sphere (0::'a) 1;
         \<And>x. x \<in> S \<Longrightarrow> g x = f x\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ly = layout_of aprog; abc_fetch as aprog = Some ins\<rbrakk>
    \<Longrightarrow> \<exists>tp1 tp2.
                         concat (tms_of aprog) =
                         tp1 @ ci ly (start_of ly as) ins @ tp2 \<and>
                         tp1 = concat (take as (tms_of aprog)) \<and>
                         tp2 = concat (drop (Suc as) (tms_of aprog))


proof (prove)
using this:
  p' = snd (mkVarChannel d (apsnd \<circ> pState.vars_update) g p)
  pState_inv prog p
  sidx = pState.idx p
  cl_inv (g, p)
  gState_inv prog g
  varDeclName ` set (d # ds)
  \<subseteq> process_names (states prog !! sidx) (processes prog !! sidx)

goal (1 subgoal):
 1. pState.idx p' = sidx


proof (prove)
goal (1 subgoal):
 1. Hom_FopxC.map gf =
    S.mkArr (HomC.set (F (D.cod (fst gf)), C.dom (snd gf)))
     (HomC.set (F (D.dom (fst gf)), C.cod (snd gf)))
     (\<phi>C (F (D.dom (fst gf)), C.cod (snd gf)) \<circ>
      (\<lambda>h.
          snd gf \<cdot>\<^sub>C h \<cdot>\<^sub>C F (fst gf)) \<circ>
      \<psi>C (F (D.cod (fst gf)), C.dom (snd gf)))


proof (prove)
goal (1 subgoal):
 1. GrdSymSystem init r = SymSystem init (inpt_st r) r


proof (prove)
goal (1 subgoal):
 1. inj_on (\<lambda>\<phi>. sat_models \<phi> \<inter> Pow P)
     {abs_ltln\<^sub>P \<phi> |\<phi>. prop_atoms \<phi> \<subseteq> P}


proof (prove)
goal (1 subgoal):
 1. null \<noteq> UML_Types.bot_class.bot


proof (prove)
using this:
  A B Lt C D \<or> B A Lt C D \<or> A B Lt D C \<or> B A Lt D C
  ?A ?B Lt ?C ?D \<Longrightarrow> ?B ?A Lt ?D ?C
  ?A ?B Lt ?C ?D \<Longrightarrow> ?B ?A Lt ?C ?D

goal (1 subgoal):
 1. A B Lt C D


proof (prove)
using this:
  Auth_PriK n = Auth_PriK m
  (Asset m, \<lbrace>Num 2, PubKey B\<rbrace>) \<in> u

goal (1 subgoal):
 1. Auth_PriKey m \<in> spied u \<and>
    (\<exists>C SK. (Asset m, Token m (Auth_PriK m) B C SK) \<in> u)


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       PRJ('b\<^sub>\<bottom>)\<cdot>(EMB('a\<^sub>\<bottom>)\<cdot>x) =
       u_map\<cdot>(PRJ('b) oo EMB('a))\<cdot>x


proof (prove)
using this:
  u \<in> RSpan us
  v \<in> RSpan vs

goal (1 subgoal):
 1. (\<And>as bs.
        \<lbrakk>length as = length us; u = as \<bullet>\<cdot> us;
         length bs = length vs; v = bs \<bullet>\<cdot> vs\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  0 < p x y n
  0 < p y x m
  \<lbrakk>0 < p ?xa6 ?ya6 ?na6; 0 < p ?ya6 ?xa6 ?ma6;
   G ?ya6 ?ya6 = \<infinity>\<rbrakk>
  \<Longrightarrow> G ?xa6 ?xa6 = \<infinity>

goal (1 subgoal):
 1. recurrent x = recurrent y


proof (prove)
using this:
  oalist_inv_raw ox xs'
  oalist_inv_raw ?ko (sort_oalist_aux ?ko ys)
  prod_ord_pair ox P xs' (sort_oalist_aux ox ys)
  k \<in> fst ` set xs' \<union> fst ` set (sort_oalist_aux ox ys)

goal (1 subgoal):
 1. P k (lookup_pair ox xs' k) (lookup_pair ox (sort_oalist_aux ox ys) k)


proof (prove)
goal (1 subgoal):
 1. (\<Sum>i = 0..<length Basis_list.
        \<bar>pdevs_apply (pdevs_of_ivl l u) i\<bar>) =
    (\<Sum>i = 0..<length Basis_list.
        \<bar>((u - l) \<bullet> Basis_list ! i / 2) *\<^sub>R
              Basis_list ! i\<bar>)


proof (prove)
using this:
  cfg' \<in> cont (repcs (l, u) cfg) ` set_pmf (action (repcs (l, u) cfg))
  state cfg' = (l', u')
  (l, u) \<in> S
  cfg \<in> R_G.valid_cfg
  abss (l, u) = state cfg
  action (repcs (l, u) cfg) \<in> K (l, u)
  action (repcs (l, u) cfg) = return_pmf (l, u \<oplus> t)
  (l, u) \<in> S
  (l, u) = (l, u)
  0 \<le> t
  u \<oplus> t \<turnstile> PTA.inv_of A l

goal (1 subgoal):
 1. u' \<in> [u']\<^sub>\<R>


proof (state)
this:
  dim ((+) (- a) ` S) \<le> dim U

goal (1 subgoal):
 1. \<lbrakk>\<And>T.
                \<lbrakk>subspace T; T \<subseteq> U;
                 S \<noteq> {} \<Longrightarrow> aff_dim T = aff_dim S;
                 rel_frontier S homeomorphic
                 sphere (0::'b) 1 \<inter> T\<rbrakk>
                \<Longrightarrow> thesis;
     S \<noteq> {}\<rbrakk>
    \<Longrightarrow> thesis


proof (prove)
using this:
  Extreme (\<lambda>i a. if a = b then 0 else 1) b
  b \<cdot>< F (\<lambda>_ a. if a = b then 0 else 1)

goal (1 subgoal):
 1. \<exists>i. pivotal i b


proof (prove)
goal (1 subgoal):
 1. ((\<lambda>t. pbernpoly 1 t *\<^sub>R f' t) has_integral
     S - I - (f (real_of_int b) - f (real_of_int a)) /\<^sub>R 2)
     {real_of_int a..real_of_int b}


proof (prove)
goal (3 subgoals):
 1. \<And>s.
       \<lbrakk>0 < l s \<and>
                l s \<le> carrots s \<and>
                (mu \<le> (carrots_total \<circ> carrots)
                           s \<longrightarrow>
                 l s \<le> lambda) \<and>
                (\<exists>x. carrots s = 2 ^ x) \<and>
                tortoise s =
                (seq \<circ> carrots_total \<circ> carrots) s \<and>
                hare s =
                (seq \<circ>
                 (\<lambda>s. l s + (carrots_total \<circ> carrots) s))
                 s;
        hare s \<noteq> tortoise s\<rbrakk>
       \<Longrightarrow> (((\<lambda>s.
                               if carrots s = l s
                               then s\<lparr>tortoise := hare s,
  carrots := 2 * carrots s, l := 0\<rparr>
                               else id s) ;;
                           (\<lambda>s. s
                               \<lparr>hare := f (hare s),
                                  l := Suc (l s)\<rparr>))
                           s,
                          s)
                         \<in> inv_image find_lambda_measures
                                (\<lambda>x. (l x, carrots x))
 2. \<lbrace>?R1\<rbrace>
    \<lambda>s. s
       \<lparr>carrots := Suc 0, l := Suc 0, tortoise := x0,
          hare := f x0\<rparr>
    \<lbrace>\<lambda>s.
                0 < l s \<and>
                l s \<le> carrots s \<and>
                (mu \<le> (carrots_total \<circ> carrots)
                           s \<longrightarrow>
                 l s \<le> lambda) \<and>
                (\<exists>x. carrots s = 2 ^ x) \<and>
                tortoise s =
                (seq \<circ> carrots_total \<circ> carrots) s \<and>
                hare s =
                (seq \<circ>
                 (\<lambda>s. l s + (carrots_total \<circ> carrots) s))
                 s\<rbrace>
 3. \<And>s. True \<Longrightarrow> ?R1 s


proof (prove)
goal (1 subgoal):
 1. restrict A X ! i = None


proof (prove)
using this:
  C' =
  (\<lambda>i j.
      if i \<in> S \<and> j \<in> S \<and> seq (\<phi> i) (\<phi> j)
      then \<psi> (\<phi> i \<cdot> \<phi> j) else n)
  i \<in> S
  bij_betw \<phi> S (Collect arr)
  n \<notin> S
  bij_betw \<psi> (Collect arr) S
  ?i \<in> S \<Longrightarrow> \<psi> (\<phi> ?i) = ?i
  \<psi> = (\<lambda>f. if arr f then inv_into S \<phi> f else n)
  bij_betw ?f ?A ?B = (inj_on ?f ?A \<and> ?f ` ?A = ?B)

goal (1 subgoal):
 1. C' (\<psi> (local.dom (\<phi> i))) (\<psi> (local.dom (\<phi> i))) =
    \<psi> (local.dom (\<phi> i))


proof (prove)
goal (1 subgoal):
 1. bit (sint w) n = (if n < l - 1 then w !! n else w !! (l - 1))


proof (prove)
goal (1 subgoal):
 1. {l2_inv8 \<inter> l2_inv1 \<inter> l2_inv3} TS.trans l2 {> l2_inv8}


proof (prove)
goal (1 subgoal):
 1. (A ===> pcr_stream A ===> pcr_stream A) LCons (##)


proof (prove)
goal (1 subgoal):
 1. rotater1 (rev xs) = rev (rotate1 xs)


proof (state)
this:
  subspace.dependent = dependent

goal (1 subgoal):
 1. subspace.subspace = subspace


proof (prove)
goal (1 subgoal):
 1. wp\<^sub>t (Do f) Q =
    (\<lambda>s. (\<forall>t\<in>f s. Q t) \<and> f s \<noteq> {})


proof (prove)
goal (1 subgoal):
 1. Product_Type.product (Set t1) (Set t2) =
    fold_keys (\<lambda>x. fold_keys (\<lambda>y. insert (x, y)) t2) t1 {}


proof (chain)
picking this:
  l = treap_of {p \<in> A. fst p < fst (arg_min_on snd A)}
  r = treap_of {p \<in> A. fst (arg_min_on snd A) < fst p}


proof (prove)
using this:
  invar (build ks l)
  invar (build ks r)
  \<forall>p\<in>set l. p $ k \<le> m
  \<forall>p\<in>set r. m < p $ k
  widest_spread_axis k UNIV (set l \<union> set r)
  build ks ps = Node k m (build ks l) (build ks r)
  set l = set_kdt (build ?ks l)
  set r = set_kdt (build ?ks r)

goal (1 subgoal):
 1. invar (build ks ps)


proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. exp (x *\<^sub>R - a)) has_integral
     exp (c *\<^sub>R - a) / a)
     {c..}


proof (prove)
goal (1 subgoal):
 1. (pcr_nonzero A ===> pcr_nonzero A ===> (=))
     (\<lambda>x a. \<exists>c. a = c *\<^sub>R x \<and> c \<noteq> 0)
     (\<lambda>x a. \<exists>c. a = c *\<^sub>R x \<and> c \<noteq> 0)


proof (prove)
using this:
  h \<turnstile> get_root_node ptr \<rightarrow>\<^sub>r root_ptr
  h \<turnstile> to_tree_order root_ptr \<rightarrow>\<^sub>r c
  heap_is_wellformed h
  type_wf h
  known_ptrs h
  h \<turnstile> get_dom_component ptr \<rightarrow>\<^sub>r c
  h \<turnstile> to_tree_order ptr'' \<rightarrow>\<^sub>r to''
  ptr'' \<in> set c
  h \<turnstile> get_dom_component ptr' \<rightarrow>\<^sub>r c'
  ptr' \<notin> set c
  \<lbrakk>heap_is_wellformed ?h; type_wf ?h; known_ptrs ?h;
   ?h \<turnstile> get_dom_component ?ptr \<rightarrow>\<^sub>r ?c;
   ?h \<turnstile> to_tree_order ?ptr \<rightarrow>\<^sub>r ?to;
   ?h \<turnstile> get_dom_component ?ptr' \<rightarrow>\<^sub>r ?c';
   ?ptr' \<notin> set ?c\<rbrakk>
  \<Longrightarrow> set ?to \<inter> set ?c' = {}
  \<lbrakk>heap_is_wellformed ?h; type_wf ?h; known_ptrs ?h;
   ?h \<turnstile> get_dom_component ?ptr \<rightarrow>\<^sub>r ?c;
   ?ptr' \<in> set ?c\<rbrakk>
  \<Longrightarrow> ?h \<turnstile> get_dom_component ?ptr'
                    \<rightarrow>\<^sub>r ?c

goal (1 subgoal):
 1. set to'' \<inter> set c' = {}


proof (prove)
goal (1 subgoal):
 1. \<Sqinter> range c ; \<Sqinter> range d =
    (\<Sqinter>(x::'b) y::'c. c x ; d y)
variables:
  d :: 'c \<Rightarrow> 'a
  c :: 'b \<Rightarrow> 'a
  (;) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
type variables:
  'a :: refinement_lattice
  'b, 'c :: type


proof (prove)
goal (1 subgoal):
 1. conv_radius f = c


proof (prove)
using this:
  p dvd smult (of_nat (Suc k)) (pderiv a)
  \<lbrakk>?p dvd smult ?a ?q; ?a \<noteq> (0::?'a)\<rbrakk>
  \<Longrightarrow> ?p dvd ?q
  (of_nat ?m = (0::?'a)) = (?m = 0)

goal (1 subgoal):
 1. p dvd pderiv a


proof (prove)
using this:
  0 < dim (sub.tangent_space p)

goal (1 subgoal):
 1. (\<And>basis.
        \<lbrakk>independent basis;
         span basis = span (sub.tangent_space p)\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. pivot_fun A (\<lambda>_. 0) 0


proof (prove)
using this:
  \<C> \<turnstile> [e] : [t] _> [arity_1_result e]

goal (1 subgoal):
 1. \<exists>tn.
       c_types_agree tn' tn \<and> \<C> \<turnstile> [e] : tn _> tm


proof (prove)
goal (1 subgoal):
 1. \<lfloor>2 ^ d\<rfloor> *
    \<lfloor>2 ^ m * enn2real (min (of_nat m) (u x))\<rfloor>
    \<le> \<lfloor>2 ^ d *
                   (2 ^ m * enn2real (min (of_nat m) (u x)))\<rfloor>


proof (prove)
using this:
  \<not> (a \<noteq> b \<and> b \<noteq> c \<and> a \<noteq> c)

goal (1 subgoal):
 1. \<exists>f. (\<Sum>i\<in>{a, b, c}. f i * i) = x * a + y * b + z * c


proof (prove)
using this:
  wp \<equiv>
  hom_induced (int n) (lsphere n) (equator n) (nsphere n) (upper n) id zp

goal (1 subgoal):
 1. wp \<in> carrier (relative_homology_group (int n) (nsphere n) (upper n))


proof (prove)
using this:
  \<lbrakk>cxt_to_stmt ?E ?c = ?c'; \<And>p q. ?c' \<noteq> p ;; q\<rbrakk>
  \<Longrightarrow> ?E = [] \<and> ?c' = ?c

goal (1 subgoal):
 1. cxt_to_stmt E c = c'@[mu] \<Longrightarrow> c = c'@[mu] \<and> E = []


proof (prove)
goal (2 subgoals):
 1. n \<noteq> length D \<Longrightarrow> is_word (take j b)
 2. n \<noteq> length D \<Longrightarrow> is_terminal (a ! i)


proof (prove)
using this:
  set (opaque x) \<subseteq> {0..<n}
  itrm_brackets vs x = Some y'

goal (1 subgoal):
 1. set (opaque y') \<subseteq> {0..<n}


proof (prove)
goal (1 subgoal):
 1. local.bind_state (local.altc_state C g) f =
    local.altc_state C (\<lambda>c. local.bind_state (g c) f)


proof (prove)
using this:
  \<lparr>prg = G, cls = accC,
     lcl =
       L\<rparr>\<turnstile> dom (locals
                                   (snd s0)) \<guillemotright>In1r
                         (Try c1 Catch(C vn) c2)\<guillemotright> E

goal (1 subgoal):
 1. (\<And>C1 C2.
        \<lbrakk>\<lparr>prg = G, cls = accC,
                    lcl =
                      L\<rparr>\<turnstile> dom
       (locals (snd s0)) \<guillemotright>In1r c1\<guillemotright> C1;
         \<lparr>prg = G, cls = accC,
            lcl = L(VName vn \<mapsto>
              Class
               C)\<rparr>\<turnstile> dom (locals (snd s0)) \<union>
{VName vn} \<guillemotright>In1r c2\<guillemotright> C2\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. (cod Zero = Zero &&& cod One = One) &&& cod j0 = One &&& cod j1 = One


proof (prove)
goal (1 subgoal):
 1. - part_circlepath 0 R (- pi / 2) (pi / 2) =
    part_circlepath 0 R (pi / 2) (3 * pi / 2)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sig_red sing_reg (=) F p q; rep_list q \<noteq> 0\<rbrakk>
    \<Longrightarrow> punit.lt (rep_list q) \<prec> punit.lt (rep_list p)


proof (prove)
goal (1 subgoal):
 1. \<lfloor>(\<lambda>w.
                 (\<exists>x.
                     \<forall>xa.
                        \<P> xa w =
                        (\<^bold>\<box>xa x) w) \<longrightarrow>
                 (\<^bold>\<box>(\<lambda>v.
                                    \<exists>x.
 existsAt x v \<and> (\<forall>xa. \<P> xa v = (\<^bold>\<box>xa x) v)))
                  w)\<rfloor>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>list_all2 (\<le>) [x] x; list_all2 (\<le>) x [y]\<rbrakk>
    \<Longrightarrow> x \<in> (\<lambda>x. [x]) ` {x..y}


proof (prove)
goal (1 subgoal):
 1. ((W ===> M ===> M) ===>
     W ===>
     Monomorphic_Monad.rel_envT R M ===> Monomorphic_Monad.rel_envT R M)
     (\<lambda>tell w m. EnvT (\<lambda>r. tell w (run_env m r)))
     (\<lambda>tell w m. EnvT (\<lambda>r. tell w (run_env m r)))


proof (state)
this:
  finite ({0, 1} \<union> S)

goal (1 subgoal):
 1. \<And>x.
       x \<in> {0..1} - ({0, 1} \<union> S) \<Longrightarrow>
       f (g x) * vector_derivative g (at x within {0..1}) =
       f (shiftpath (1 - a) (shiftpath a g) x) *
       vector_derivative (shiftpath (1 - a) (shiftpath a g))
        (at x within {0..1})


proof (state)
this:
  \<forall>m\<le>j - k. (sdrop k xs !! m) c1 \<noteq> 0

goal (1 subgoal):
 1. (xs !! j) c2 \<le> (xs !! j) c1


proof (prove)
using this:
  \<lbrakk>R \<in> constant_rules C \<Longrightarrow> ?thesis;
   R \<in> identity_rules L \<Longrightarrow> ?thesis;
   R = top_rule S_Top \<Longrightarrow> ?thesis;
   R = nonempty_rule \<Longrightarrow> ?thesis\<rbrakk>
  \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. maintained R G


proof (prove)
using this:
  [] \<turnstile> e \<Down> v
  FV e = {}
  \<lbrakk>[] \<turnstile> ?e \<Down> ?v; FV ?e = {}\<rbrakk>
  \<Longrightarrow> \<exists>v' ob.
                       ?e \<longrightarrow>* v' \<and>
                       isval v' \<and> observe v' ob \<and> bs_observe ?v ob

goal (1 subgoal):
 1. (\<And>v' ob.
        \<lbrakk>e \<longrightarrow>* v'; observe v' ob;
         bs_observe v ob\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (state)
this:
  bval b t1

goal (1 subgoal):
 1. \<And>b s\<^sub>1 c s\<^sub>2 s\<^sub>3 X t.
       \<lbrakk>bval b s\<^sub>1; (c, s\<^sub>1) \<Rightarrow> s\<^sub>2;
        \<And>X t.
           s\<^sub>1 = t on L c X \<Longrightarrow>
           \<exists>t'. (c, t) \<Rightarrow> t' \<and> s\<^sub>2 = t' on X;
        (WHILE b DO c, s\<^sub>2) \<Rightarrow> s\<^sub>3;
        \<And>X t.
           s\<^sub>2 = t on L (WHILE b DO c) X \<Longrightarrow>
           \<exists>t'.
              (WHILE b DO c, t) \<Rightarrow> t' \<and> s\<^sub>3 = t' on X;
        s\<^sub>1 = t on L (WHILE b DO c) X\<rbrakk>
       \<Longrightarrow> \<exists>t'.
                            (WHILE b DO c, t) \<Rightarrow> t' \<and>
                            s\<^sub>3 = t' on X


proof (prove)
goal (1 subgoal):
 1. subalgebra K (carrier R) R


proof (prove)
using this:
  Sup A = RES B

goal (1 subgoal):
 1. thesis