proof (prove)
using this:
  punit.lt (local.punit.monom_mult ?c ?t ?p) \<preceq> ?t + punit.lt ?p
  t + punit.lt (rep_list f) \<prec> punit.lt (rep_list p)

goal (1 subgoal):
 1. punit.lt
     (local.punit.monom_mult
       (lookup (rep_list p) (t + punit.lt (rep_list f)) /
        punit.lc (rep_list f))
       t (rep_list f)) \<prec>
    punit.lt (rep_list p)


proof (prove)
using this:
  \<forall>p\<in>P - {p}. env p < length \<pi>l
  \<forall>p\<in>P - {p}. env1 p < length \<pi>l1

goal (1 subgoal):
 1. (\<forall>pa.
        pa \<in> P \<longrightarrow>
        (\<pi>l @ [\<pi>]) ! (env(p := length \<pi>l)) pa =
        (\<pi>l1 @ [\<pi>]) ! (env1(p := length \<pi>l1)) pa) =
    (\<forall>pa.
        pa \<in> P - {p} \<longrightarrow>
        \<pi>l ! env pa = \<pi>l1 ! env1 pa)


proof (prove)
goal (4 subgoals):
 1. \<And>x xa.
       \<lbrakk>F1set1 x \<subseteq> UNIV;
        F1set2 x \<subseteq> min_alg1 s1 s2;
        F1set3 x \<subseteq> min_alg2 s1 s2; xa \<in> Field SucFbd;
        F1set2 x \<subseteq> fst (min_algs s1 s2 xa)\<rbrakk>
       \<Longrightarrow> |F1set3 x| \<le>o ?r'52 x xa
 2. \<And>x xa.
       \<lbrakk>F1set1 x \<subseteq> UNIV;
        F1set2 x \<subseteq> min_alg1 s1 s2;
        F1set3 x \<subseteq> min_alg2 s1 s2; xa \<in> Field SucFbd;
        F1set2 x \<subseteq> fst (min_algs s1 s2 xa)\<rbrakk>
       \<Longrightarrow> ?r'52 x xa \<le>o F1bd' +c F2bd'
 3. \<And>x xa xb.
       \<lbrakk>F1set1 x \<subseteq> UNIV;
        F1set2 x \<subseteq> min_alg1 s1 s2;
        F1set3 x \<subseteq> min_alg2 s1 s2; xa \<in> Field SucFbd;
        F1set2 x \<subseteq> fst (min_algs s1 s2 xa); xb \<in> Field SucFbd;
        F1set3 x \<subseteq> snd (min_algs s1 s2 xb)\<rbrakk>
       \<Longrightarrow> s1 x \<in> min_alg1 s1 s2
 4. \<forall>y\<in>F2in UNIV (min_alg1 s1 s2) (min_alg2 s1 s2).
       s2 y \<in> min_alg2 s1 s2


proof (prove)
using this:
  (map_of ts(k \<mapsto> delete_trie ks t)) k' = Some t'

goal (1 subgoal):
 1. (map_of ts(k \<mapsto> delete_trie ks t)) k' = Some t'


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       \<lbrakk>distinct p; all_in_list p l; singleCombinators p;
        wellformed_policy1_strong p; wellformed_policy3 p;
        allNetsDistinct p\<rbrakk>
       \<Longrightarrow> C (list2FWpolicy (FWNormalisationCore.sort p l))
                          x =
                         C (list2FWpolicy p) x


proof (prove)
using this:
  share sb
   ((\<S> \<oplus>\<^bsub>W'\<^esub> R' \<ominus>\<^bsub>A'\<^esub> L') \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) =
  share sb
   (\<S> \<oplus>\<^bsub>W'\<^esub> R' \<ominus>\<^bsub>A'\<^esub> L') \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L

goal (1 subgoal):
 1. share sb
     ((\<S> \<oplus>\<^bsub>W'\<^esub> R' \<ominus>\<^bsub>A'\<^esub> L') \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) =
    share sb
     (\<S> \<oplus>\<^bsub>W'\<^esub> R' \<ominus>\<^bsub>A'\<^esub> L') \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L


proof (prove)
using this:
  \<Gamma>, \<Theta> \<turnstile>\<^bsub>/F\<^esub> P\<^sub>1 c\<^sub>1 Q, A
  \<forall>s t c'.
     \<Gamma> \<turnstile> (c\<^sub>1, s) \<rightarrow>\<^sup>*
                           (c', t) \<longrightarrow>
     final (c', t) \<longrightarrow>
     s \<in> Normal ` pre P\<^sub>1 \<longrightarrow>
     t \<notin> Fault ` F \<longrightarrow>
     c' = Skip \<and> t \<in> Normal ` Q \<or>
     c' = Throw \<and> t \<in> Normal ` A
  \<Gamma>, \<Theta> \<turnstile>\<^bsub>/F\<^esub> P\<^sub>2 c\<^sub>2 Q, A
  \<forall>s t c'.
     \<Gamma> \<turnstile> (c\<^sub>2, s) \<rightarrow>\<^sup>*
                           (c', t) \<longrightarrow>
     final (c', t) \<longrightarrow>
     s \<in> Normal ` pre P\<^sub>2 \<longrightarrow>
     t \<notin> Fault ` F \<longrightarrow>
     c' = Skip \<and> t \<in> Normal ` Q \<or>
     c' = Throw \<and> t \<in> Normal ` A
  r \<inter> b \<subseteq> pre P\<^sub>1
  r \<inter> - b \<subseteq> pre P\<^sub>2

goal (1 subgoal):
 1. \<forall>s t c'.
       \<Gamma> \<turnstile> (Cond b c\<^sub>1 c\<^sub>2,
                              s) \<rightarrow>\<^sup>*
                             (c', t) \<longrightarrow>
       final (c', t) \<longrightarrow>
       s \<in> Normal ` pre (AnnBin r P\<^sub>1 P\<^sub>2) \<longrightarrow>
       t \<notin> Fault ` F \<longrightarrow>
       c' = Skip \<and> t \<in> Normal ` Q \<or>
       c' = Throw \<and> t \<in> Normal ` A


proof (prove)
goal (1 subgoal):
 1. (s * l - b1) * (k * l * t - t + a1 * k) +
    (t * l + a1) * (s - k * l * s + b1 * k) =
    s * l * (k * l * t - t + a1 * k) - b1 * (k * l * t - t + a1 * k) +
    t * l * (s - k * l * s + b1 * k) +
    a1 * (s - k * l * s + b1 * k)


proof (prove)
goal (1 subgoal):
 1. \<Union>
     (get_offending_flows (get_ACS M)
       \<lparr>nodes = V,
          edges = E \<union> backflows (stateful \<union> {x})\<rparr>)
    \<subseteq> backflows
                 (filternew_flows_state
                   \<lparr>hosts = V, flows_fix = E,
                      flows_state =
                        stateful \<union> {x}\<rparr>) \<Longrightarrow>
    \<Union>
     (get_offending_flows (get_ACS M)
       \<lparr>nodes = V,
          edges =
            E \<union> (stateful \<union> {x}) \<union>
            backflows (stateful \<union> {x})\<rparr>)
    \<subseteq> backflows
                 (filternew_flows_state
                   \<lparr>hosts = V, flows_fix = E,
                      flows_state = stateful \<union> {x}\<rparr>)


proof (prove)
goal (1 subgoal):
 1. \<exists>a. has_as_product J D a


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>morphism_presheaves_of_rings Spec is_zariski_open
              im_sheafXS.im_sheaf im_sheafXS.im_sheaf_morphisms b
              im_sheafXS.add_im_sheaf im_sheafXS.mult_im_sheaf
              im_sheafXS.zero_im_sheaf im_sheafXS.one_im_sheaf sheaf_spec
              sheaf_spec_morphisms \<O>b add_sheaf_spec mult_sheaf_spec
              zero_sheaf_spec one_sheaf_spec \<psi>;
     \<forall>U.
        is_zariski_open U \<longrightarrow>
        (\<forall>x\<in>im_sheafXS.im_sheaf U.
            \<phi>\<^sub>f U (\<psi> U x) = x) \<and>
        (\<forall>x\<in>\<O> U. \<psi> U (\<phi>\<^sub>f U x) = x);
     homeomorphism X is_open Spec is_zariski_open f\<rbrakk>
    \<Longrightarrow> morphism_presheaves_of_rings Spec is_zariski_open
                       sheaf_spec sheaf_spec_morphisms \<O>b add_sheaf_spec
                       mult_sheaf_spec zero_sheaf_spec one_sheaf_spec
                       im_sheafXS.im_sheaf im_sheafXS.im_sheaf_morphisms b
                       im_sheafXS.add_im_sheaf im_sheafXS.mult_im_sheaf
                       im_sheafXS.zero_im_sheaf im_sheafXS.one_im_sheaf
                       \<phi>\<^sub>f


proof (prove)
using this:
  finite A
  OrderingSetIso dual_order.greater_eq dual_order.greater
   dual_order.greater_eq dual_order.greater (Pow A) ((`) f)
  ?f \<turnstile> Pow ?A = Pow (?f ` ?A)

goal (1 subgoal):
 1. order.simplex_like (Pow A)


proof (prove)
using this:
  \<exists>y. y \<sqsubset> ?x

goal (1 subgoal):
 1. (\<And>z.
        z \<sqsubset> ord.min (\<sqsubseteq>) z1 z2 \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<And>nodes edges.
       \<lbrakk>valid_reqs (get_IFS M);
        wf_graph \<lparr>nodes = nodes, edges = edges\<rparr>;
        all_security_requirements_fulfilled (get_IFS M)
         \<lparr>nodes = nodes, edges = edges\<rparr>;
        set edgesList \<subseteq> edges;
        G = \<lparr>nodes = nodes, edges = edges\<rparr>\<rbrakk>
       \<Longrightarrow> all_security_requirements_fulfilled (get_IFS M)
                          (stateful_policy_to_network_graph
                            \<lparr>hosts = nodes, flows_fix = edges,
                               flows_state =
                                 set (filter_IFS_no_violations_accu
 \<lparr>nodes = nodes, edges = edges\<rparr> M [] edgesList)\<rparr>)


proof (prove)
goal (1 subgoal):
 1. Limit \<gamma> \<Longrightarrow>
    \<aleph>\<gamma> = \<Squnion> (Aleph ` elts \<gamma>)


proof (prove)
goal (1 subgoal):
 1. (\<And>v\<^sub>1 v\<^sub>2.
        \<lbrakk>v = v\<^sub>1 @ [a] @ v\<^sub>2;
         a \<notin> set v\<^sub>1\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. trms\<^sub>s\<^sub>t (a # A \<cdot>\<^sub>s\<^sub>t \<theta>) =
    trms\<^sub>s\<^sub>t (a # A) \<cdot>\<^sub>s\<^sub>e\<^sub>t \<theta>


proof (prove)
goal (2 subgoals):
 1. \<exists>x\<in>set (Guards t).
       \<exists>y\<in>set (Guards t'). mutex x y \<Longrightarrow>
    \<forall>i r. \<not> apply_guards (Guards t @ Guards t') (join_ir i r)
 2. \<not> (\<exists>x\<in>set (map (\<lambda>(x, y). mutex x y)
                                 (List.product (Guards t) (Guards t'))).
               x) \<Longrightarrow>
    choice_alt t t' =
    (if \<exists>(x, y)\<in>set (List.product (Guards t) (Guards t')).
           mutex x y
     then False
     else if Guards t = Guards t'
          then satisfiable (fold gAnd (rev (Guards t)) (Bc True))
          else satisfiable
                (fold gAnd (rev (Guards t @ Guards t')) (Bc True)))


proof (prove)
goal (1 subgoal):
 1. \<And>x. - - - x = - x


proof (prove)
using this:
  finite \<Gamma>
  \<forall>A\<in>\<Gamma>. term_ok \<Theta> A
  \<forall>A\<in>\<Gamma>. typ_of A = Some propT

goal (1 subgoal):
 1. \<Theta>,\<Gamma> \<turnstile> mk_eq t u


proof (prove)
goal (1 subgoal):
 1. Domainp HMA_M3 x


proof (prove)
goal (1 subgoal):
 1. appFLv f args \<in> R


proof (prove)
using this:
  Inv2a_inner s' q
  bal (dblock s' q) = 0

goal (1 subgoal):
 1. inp (dblock s' q) = NotAnInput


proof (prove)
goal (1 subgoal):
 1. \<lbrace>p\<rbrace> \<nu> F \<lbrace>q\<rbrace>\<^sub>u


proof (prove)
using this:
  KD_Tree.complete (build ?k ps)
  0 < length ps \<Longrightarrow>
  KD_Tree.size_kdt (build ?ks ps) = length ps

goal (1 subgoal):
 1. h = height (build k ps)


proof (state)
this:
  leaves i l \<inter> leaves (k + 1) r = {}

goal (1 subgoal):
 1. \<And>t1 x2 t2 i j.
       \<lbrakk>\<And>i j.
                   inorder t1 = [i..j] \<Longrightarrow>
                   wpl i j t1 = Wpl i t1;
        \<And>i j.
           inorder t2 = [i..j] \<Longrightarrow> wpl i j t2 = Wpl i t2;
        inorder \<langle>t1, x2, t2\<rangle> = [i..j]\<rbrakk>
       \<Longrightarrow> wpl i j \<langle>t1, x2, t2\<rangle> =
                         Wpl i \<langle>t1, x2, t2\<rangle>


proof (prove)
goal (1 subgoal):
 1. (\<lambda>t. \<phi> t s) \<in> Sols (\<lambda>t. f) U S 0 s


proof (prove)
goal (2 subgoals):
 1. ?A3 \<le> check_extension B \<V>' i' x' r'
 2. (let b = i \<notin># dom_m A \<and>
             x \<notin> \<V> \<and> ([x], - 1) \<in> set r
     in if \<not> b
        then SPEC (\<lambda>_. True) \<bind>
             (\<lambda>c. RETURN (error_msg i c))
        else let p' = remove1 ([x], - 1) r;
                 b = vars_llist p' \<subseteq> \<V>
             in if \<not> b
                then SPEC (\<lambda>_. True) \<bind>
                     (\<lambda>c. RETURN (error_msg i c))
                else mult_poly_full p' p' \<bind>
                     (\<lambda>p2.
                         let p' = map (\<lambda>(a, b). (a, - b)) p'
                         in add_poly_l (p2, p') \<bind>
                            (\<lambda>q.
                                weak_equality_l q [] \<bind>
                                (\<lambda>eq.
                                    if eq then RETURN CSUCCESS
                                    else SPEC (\<lambda>_. True) \<bind>
   (\<lambda>c. RETURN (error_msg i c))))))
    \<le> \<Down>
           {(st, b).
            (\<not> is_cfailed st) = b \<and>
            (is_cfound st \<longrightarrow> spec = r)}
           ?A3


proof (prove)
goal (1 subgoal):
 1. - x \<squnion> (x \<squnion> y) = \<top>


proof (prove)
using this:
  finite (J ?n)
  J ?n \<subseteq> I
  B ?n \<in> sets (Pi\<^sub>M (J ?n) (\<lambda>i. borel))
  incseq J

goal (1 subgoal):
 1. emeasure (P (J n)) (B n) = emeasure (P' n) (fm n ` B n)


proof (prove)
using this:
  random_variable MX X

goal (1 subgoal):
 1. prob_space (distr M MX X)


proof (prove)
goal (1 subgoal):
 1. infs (gaccepting A)
     (gtrace (stake n (fromN 1 ||| r) @- sdrop n (fromN 1 ||| r)) (0, p))


proof (prove)
goal (1 subgoal):
 1. to_bl (NOT w) = map Not (to_bl w)


proof (prove)
goal (1 subgoal):
 1. fset_of_fmap (fmap_of_list x) = fset_of_list (AList.clearjunk x)


proof (prove)
goal (1 subgoal):
 1. list_emb P xs xs


proof (prove)
goal (1 subgoal):
 1. \<And>xa.
       \<lbrakk>\<forall>xa\<in>set (Abs_State.dom y_).
                   lookup x_ xa \<sqsubseteq> fun y_ xa;
        \<forall>x\<in>set (Abs_State.dom z_).
           lookup y_ x \<sqsubseteq> fun z_ x;
        xa \<in> set (Abs_State.dom z_)\<rbrakk>
       \<Longrightarrow> lookup x_ xa \<sqsubseteq> fun z_ xa


proof (prove)
using this:
  filter_pdevs P b = filter_pdevs Q d
  filter_pdevs (\<lambda>a b. \<not> P a b) b =
  filter_pdevs (\<lambda>a b. \<not> Q a b) d

goal (1 subgoal):
 1. summarize_pdevs p P a b = summarize_pdevs q Q c d


proof (prove)
goal (1 subgoal):
 1. \<bar>a\<bar> \<in>\<^sub>r abs_interval A


proof (prove)
using this:
  h x \<in> h ` (a_kernel R S h +> x)

goal (1 subgoal):
 1. the_elem (h ` (a_kernel R S h +> x)) = h x


proof (prove)
using this:
  low_equal s1 s2
  low_equal ?s1.0 ?s2.0 \<Longrightarrow>
  get_operand2 ?op_list ?s1.0 = get_operand2 ?op_list ?s2.0

goal (1 subgoal):
 1. \<forall>is. get_operand2 is s1 = get_operand2 is s2


proof (prove)
using this:
  G Mod kernel G (H\<lparr>carrier := h ` carrier G\<rparr>) h \<cong> H
  \<lparr>carrier := h ` carrier G\<rparr>

goal (1 subgoal):
 1. card (h ` carrier G) =
    order (G Mod kernel G (H\<lparr>carrier := h ` carrier G\<rparr>) h)


proof (state)
this:
  \<forall>\<^sub>F x in at_top. (powser cs \<circ> g) x = (f \<circ> g) x

goal (1 subgoal):
 1. is_expansion_aux (powser_ms_aux cs G) (powser cs \<circ> g) basis


proof (prove)
goal (1 subgoal):
 1. fst ` (set gs \<union> set bs) \<subseteq> dgrad_p_set d m


proof (prove)
using this:
  check_eqv as r s

goal (1 subgoal):
 1. (\<And>ps.
        \<lbrakk>closure as ([(norm r, norm s)], []) = Some ([], ps);
         atoms r \<union> atoms s \<subseteq> set as\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. product_prob_space (\<lambda>x. measure_pmf (K x))


proof (prove)
goal (1 subgoal):
 1. get_S (cpu_reg_val PSR s') = 0


proof (prove)
using this:
  Option.is_none (devBC t n nid (n\<^sub>s + Suc (n'''' - n\<^sub>s)))

goal (1 subgoal):
 1. devExt t n nid n\<^sub>s (Suc (n'''' - n\<^sub>s)) =
    devExt t n nid n\<^sub>s (n'''' - n\<^sub>s)


proof (prove)
using this:
  is_sum2sq_nat ?n =
  (\<forall>k.
      prime (4 * k + 3) \<longrightarrow>
      even (multiplicity (4 * k + 3) ?n))
  (\<forall>p. prime p \<and> [p = 3] (mod 4) \<longrightarrow> ?P p) =
  (\<forall>k. prime (4 * k + 3) \<longrightarrow> ?P (4 * k + 3))

goal (1 subgoal):
 1. is_sum2sq_nat n =
    (\<forall>p.
        prime p \<and> [p = 3] (mod 4) \<longrightarrow>
        even (multiplicity p n))


proof (prove)
using this:
  min_gallery (C # Cs @ [D])
  Bs = Fs @ [F]
  As = []
  C # Cs @ [D] = As @ [A, B] @ Bs
  D \<in> f \<turnstile> \<C>

goal (1 subgoal):
 1. H \<in> walls_betw C D


proof (prove)
goal (1 subgoal):
 1. Data (DataValue D) (Data.DataSpace D)


proof (prove)
goal (1 subgoal):
 1. DD ars r
     (\<tau>, (s, [\<alpha>_step]), \<kappa>', fst \<mu>,
      snd \<mu> @ snd \<upsilon>')


proof (prove)
goal (1 subgoal):
 1. r = AllowPortFromTo a b po \<or> r = DenyAllFromTo a b \<or> r = DenyAll


proof (prove)
goal (1 subgoal):
 1. \<theta><gen T Xs> = gen (\<theta><T>) Xs


proof (prove)
using this:
  sup_continuous
   (\<lambda>F x.
       case x of
       (t, s, (t', s') ## \<omega>) \<Rightarrow>
         if t < t' then s \<in> ss else F (t, s', \<omega>))

goal (1 subgoal):
 1. Measurable.pred
     (borel \<Otimes>\<^sub>M
      count_space UNIV \<Otimes>\<^sub>M stream_space S)
     (\<lambda>(t, s, \<omega>). trace_in ss t s \<omega>)


proof (prove)
goal (1 subgoal):
 1. \<S>\<bullet>\<C> \<turnstile> es' : [] _> ts \<and>
    map typeof vs = map typeof vs'


proof (prove)
using this:
  pred_stream (\<lambda>x. x \<in> S) (smap state \<omega>)

goal (1 subgoal):
 1. pred_stream (\<lambda>u. u \<in> V) (smap (snd \<circ> state) \<omega>)


proof (prove)
goal (1 subgoal):
 1. run_nondet (Monad_Overloading.bind m f) =
    Monad_Overloading.bind (run_nondet m)
     (\<lambda>A. mUnionMT TYPE('a) (image_mset (run_nondet \<circ> f) A))


proof (prove)
using this:
  edges g = {}

goal (1 subgoal):
 1. is_tree g


proof (prove)
using this:
  \<exists>k. a = gcd a b * k

goal (1 subgoal):
 1. (\<And>c. a = gcd a b * c \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  \<lbrakk>ide t\<^sub>0; ide \<omega>.chine;
   ide r\<^sub>0s\<^sub>1.p\<^sub>1; src t\<^sub>0 = trg \<omega>.chine;
   src \<omega>.chine = trg r\<^sub>0s\<^sub>1.p\<^sub>1\<rbrakk>
  \<Longrightarrow> \<guillemotleft>\<a>\<^sup>-\<^sup>1[t\<^sub>0, \<omega>.chine, r\<^sub>0s\<^sub>1.p\<^sub>1] : src
   r\<^sub>0s\<^sub>1.p\<^sub>1 \<rightarrow> trg t\<^sub>0\<guillemotright>
  \<lbrakk>ide t\<^sub>0; ide \<omega>.chine;
   ide r\<^sub>0s\<^sub>1.p\<^sub>1; src t\<^sub>0 = trg \<omega>.chine;
   src \<omega>.chine = trg r\<^sub>0s\<^sub>1.p\<^sub>1\<rbrakk>
  \<Longrightarrow> \<guillemotleft>\<a>\<^sup>-\<^sup>1[t\<^sub>0, \<omega>.chine, r\<^sub>0s\<^sub>1.p\<^sub>1] : local.dom
   t\<^sub>0 \<star>
  local.dom \<omega>.chine \<star>
  local.dom
   r\<^sub>0s\<^sub>1.p\<^sub>1 \<Rightarrow> (cod t\<^sub>0 \<star>
         cod \<omega>.chine) \<star>
        cod r\<^sub>0s\<^sub>1.p\<^sub>1\<guillemotright>
  \<lbrakk>ide ?f; ide ?g; ide ?h; src ?f = trg ?g; src ?g = trg ?h\<rbrakk>
  \<Longrightarrow> local.iso \<a>\<^sup>-\<^sup>1[?f, ?g, ?h]
  (?a \<cong> ?a') =
  (\<exists>f.
      \<guillemotleft>f : ?a \<Rightarrow> ?a'\<guillemotright> \<and>
      local.iso f)
  trg r\<^sub>0s\<^sub>1.p\<^sub>1 = src r\<^sub>0

goal (1 subgoal):
 1. t\<^sub>0 \<star>
    \<omega>.chine \<star> r\<^sub>0s\<^sub>1.p\<^sub>1 \<cong>
    (t\<^sub>0 \<star> \<omega>.chine) \<star> r\<^sub>0s\<^sub>1.p\<^sub>1


proof (prove)
goal (1 subgoal):
 1. mcont Sup (\<le>) Sup (\<le>) (\<lambda>x. max x y)


proof (prove)
using this:
  src f = trg g
  src g = trg h
  trg fg\<^sub>0h\<^sub>1.p\<^sub>0 = src (tab\<^sub>1 h)
  trg fg\<^sub>0h\<^sub>1.p\<^sub>1 =
  src (tab\<^sub>0 g \<star> f\<^sub>0g\<^sub>1.p\<^sub>0)
  \<guillemotleft>f\<^sub>0g\<^sub>1.\<phi> : src
         f\<^sub>0g\<^sub>1.p\<^sub>0 \<rightarrow> trg
               (tab\<^sub>1 g)\<guillemotright>
  \<guillemotleft>f\<^sub>0g\<^sub>1.\<phi> : tab\<^sub>0 f \<star>
        f\<^sub>0g\<^sub>1.p\<^sub>1 \<rightarrow> tab\<^sub>1 g \<star>
             f\<^sub>0g\<^sub>1.p\<^sub>0\<guillemotright>
  \<lbrakk>arr f; arr f\<^sub>0g\<^sub>1.\<phi>;
   arr fg\<^sub>0h\<^sub>1.p\<^sub>1; src f = trg f\<^sub>0g\<^sub>1.\<phi>;
   src f\<^sub>0g\<^sub>1.\<phi> =
   trg fg\<^sub>0h\<^sub>1.p\<^sub>1\<rbrakk>
  \<Longrightarrow> \<a>[cod f, cod f\<^sub>0g\<^sub>1.\<phi>, cod
                          fg\<^sub>0h\<^sub>1.p\<^sub>1] \<cdot>
                    ((f \<star> f\<^sub>0g\<^sub>1.\<phi>) \<star>
                     fg\<^sub>0h\<^sub>1.p\<^sub>1) =
                    (f \<star>
                     f\<^sub>0g\<^sub>1.\<phi> \<star>
                     fg\<^sub>0h\<^sub>1.p\<^sub>1) \<cdot>
                    \<a>[local.dom
                          f, local.dom
                              f\<^sub>0g\<^sub>1.\<phi>, local.dom
                    fg\<^sub>0h\<^sub>1.p\<^sub>1]

goal (1 subgoal):
 1. (f \<star>
     f\<^sub>0g\<^sub>1.\<phi> \<star>
     fg\<^sub>0h\<^sub>1.p\<^sub>1) \<cdot>
    \<a>[f, tab\<^sub>0 f \<star>
            f\<^sub>0g\<^sub>1.p\<^sub>1, fg\<^sub>0h\<^sub>1.p\<^sub>1] =
    \<a>[f, tab\<^sub>1 g \<star>
            f\<^sub>0g\<^sub>1.p\<^sub>0, fg\<^sub>0h\<^sub>1.p\<^sub>1] \<cdot>
    ((f \<star> f\<^sub>0g\<^sub>1.\<phi>) \<star>
     fg\<^sub>0h\<^sub>1.p\<^sub>1)


proof (prove)
goal (1 subgoal):
 1. F (img x) \<in> local.set b


proof (prove)
using this:
  chain (\<lambda>x. S x ?xa)

goal (1 subgoal):
 1. Lub S c = lim_proc (range (\<lambda>x. S x c))


proof (prove)
using this:
  (\<And>xa y.
      xa \<le> y \<Longrightarrow>
      xa + weight \<Gamma> x \<le> y + weight \<Gamma> x) \<Longrightarrow>
  d_OUT cap \<langle>x\<rangle> \<le> weight \<Gamma> x + weight \<Gamma> x

goal (1 subgoal):
 1. d_OUT cap \<langle>x\<rangle> \<le> 2 * weight \<Gamma> x


proof (prove)
using this:
  \<forall>p\<in>X. (a = p \<or> p = c) \<or> [[a p c]]

goal (1 subgoal):
 1. a = x \<and> c = z \<or> a = z \<and> c = x


proof (prove)
using this:
  x \<noteq> (0::'a)

goal (1 subgoal):
 1. \<Prod>\<^sub># (prime_factorization x) = normalize x


proof (prove)
goal (1 subgoal):
 1. rel_fun
     (rel_fun (=)\<inverse>\<inverse>\<inverse>\<inverse>
       (rel_fun (BNF_Def.Grp UNIV g)\<inverse>\<inverse>
         (BNF_Def.Grp UNIV (map_spmf (map_prod h id))))\<inverse>\<inverse>)
     (rel_fun (BNF_Def.Grp UNIV (map_gpv' f g h))
       (rel_fun (=) (rel_spmf (BNF_Def.Grp UNIV (map_prod f id)))))
     exec_gpv exec_gpv \<Longrightarrow>
    exec_gpv callee (map_gpv' f g h gpv) s =
    map_spmf (map_prod f id)
     (exec_gpv (map_fun id (map_fun g (map_spmf (map_prod h id))) callee)
       gpv s)


proof (prove)
goal (1 subgoal):
 1. is_unit n \<Longrightarrow> squarefree_part n = n


proof (prove)
using this:
  Max {dist (u k (from_nat n)) (x (from_nat n)) |n. n \<le> N} \<le> e / 4
  4 / e < 2 ^ N
  ?x < ?y \<Longrightarrow> ?x \<le> ?y

goal (2 subgoals):
 1. 2 * Max {dist (u k (from_nat n)) (x (from_nat n)) |n. n \<le> N}
    \<le> 2 * e / 4
 2. (1 / 2) ^ N \<le> e / 4


proof (prove)
goal (1 subgoal):
 1. \<exists>r\<in>R. - a = r \<cdot> x


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<le>\<^sub>n SPEC \<Phi>; m \<le> SPEC gen_rwof'\<rbrakk>
    \<Longrightarrow> m \<le> SPEC (\<lambda>s. gen_rwof' s \<and> \<Phi> s)


proof (prove)
goal (1 subgoal):
 1. case partition_by_biflows E of
    (biflows, uniflows) \<Rightarrow>
      set biflows \<union> set (backlinks biflows) \<union> set uniflows =
      set E


proof (prove)
using this:
  wf R

goal (1 subgoal):
 1. s \<in> terminates_on g


proof (prove)
goal (1 subgoal):
 1. (\<Sqinter> x \<bullet> P x) = ushEx P


proof (prove)
using this:
  P,E,hp s \<turnstile> map Val vs [:] Ts'
  P \<turnstile> Ts' [\<le>] Ts

goal (1 subgoal):
 1. length vs = length Ts


proof (prove)
goal (1 subgoal):
 1. \<And>a A.
       bounded_clinear A \<Longrightarrow>
       (\<lambda>x. a *\<^sub>C A x)\<^sup>\<dagger> =
       (\<lambda>x. cnj a *\<^sub>C (A\<^sup>\<dagger>) x)


proof (prove)
goal (1 subgoal):
 1. \<nu>\<^sup>\<natural> (\<Sqinter> (\<nu>\<^sup>\<natural> ` X)) =
    \<Sqinter> (\<nu>\<^sup>\<natural> ` X)


proof (prove)
using this:
  LeftDerives1 (Derive a (take (N - 1) D)) (fst (D ! (N - 1)))
   (snd (D ! (N - 1))) (\<beta>_1 @ [X] @ \<beta>_2)
  splits_at (Derive a (take (N - 1) D)) (fst (D ! (N - 1))) \<delta>_1 Y
   \<delta>_2

goal (1 subgoal):
 1. \<exists>u v.
       \<beta>_1 = \<delta>_1 @ u \<and>
       \<beta>_2 = v @ \<delta>_2 \<and>
       snd (snd (D ! (N - 1))) = u @ [X] @ v


proof (prove)
goal (1 subgoal):
 1. \<And>xa.
       RETURN xa \<le> f x \<Longrightarrow>
       WHILE\<^sub>T\<^bsup>I\<^esup> b f xa
       \<le> WHILE\<^bsup>I\<^esup> b f xa


proof (state)
this:
  cfg \<in> cfg_on_div s
  cfg \<in> Collect alternating

goal (2 subgoals):
 1. \<And>i.
       \<lbrakk>i \<in> cfg_on_div s;
        i \<in> {cfg. alternating cfg}\<rbrakk>
       \<Longrightarrow> ?j11 i
                         \<in> R_G_cfg_on_div s' \<inter>
                               {cfg. alternating cfg}
 2. \<And>i.
       \<lbrakk>i \<in> cfg_on_div s;
        i \<in> {cfg. alternating cfg}\<rbrakk>
       \<Longrightarrow> emeasure (MDP.T i)
                          {x \<in> space MDP.St.
                           (holds \<phi> suntil holds \<psi>) (s ## x)} =
                         emeasure (R_G.T (?j11 i))
                          {x \<in> space R_G.St.
                           (holds \<phi>' suntil holds \<psi>') (s' ## x)}


proof (prove)
using this:
  negligible S

goal (1 subgoal):
 1. f absolutely_integrable_on S


proof (prove)
using this:
  distinct xs

goal (1 subgoal):
 1. size (bst_of_list xs) = length xs


proof (prove)
using this:
  \<exists>ln rn.
     b = Oc # ires \<and>
     tl (Bk # ba) = Bk \<up> ln @ Bk # Bk # Oc \<up> Suc rs @ Bk \<up> rn
  Bk # b = aa \<and> list = ba
  c = Bk # ba

goal (1 subgoal):
 1. (\<And>ln rn.
        \<lbrakk>b = Oc # ires;
         tl (Bk # ba) =
         Bk \<up> ln @ Bk # Bk # Oc \<up> Suc rs @ Bk \<up> rn\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. XD = {} \<and> XH = {Xd1, Xd1', Xd2, Xd2'} \<Longrightarrow>
    \<not> StableNoDecomp.stable_on UNIV (XD \<inter> XH)


proof (prove)
goal (1 subgoal):
 1. adjoint P * P = 1\<^sub>m n


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>R \<in> {region X I J r |I J r. valid_region X k I J r};
     v \<in> R; R' \<in> {region X I J r |I J r. valid_region X k I J r};
     R \<noteq> R'\<rbrakk>
    \<Longrightarrow> v \<notin> R'


proof (prove)
goal (1 subgoal):
 1. \<And>h.
       \<lbrakk>sorted_less (separators ts);
        h \<Turnstile>
        is_pfa c tsi (a, n) *
        list_assn (A \<times>\<^sub>a id_assn) ts tsi\<rbrakk>
       \<Longrightarrow> <is_pfa c tsi (a, n) *
                          list_assn (A \<times>\<^sub>a id_assn) ts
                           tsi> split_fun (a, n)
                                 p <\<lambda>r.
 is_pfa c tsi (a, n) * list_assn (A \<times>\<^sub>a id_assn) ts tsi *
 \<up> (split_relation ts (abs_split ts p) r)>\<^sub>t


proof (prove)
goal (1 subgoal):
 1. m1 \<in> (\<Union>h\<in>kernel G H f.
                 {h \<otimes>\<^bsub>G\<^esub> a}) &&&
    m2 \<in> (\<Union>h\<in>kernel G H f. {h \<otimes>\<^bsub>G\<^esub> a})


proof (prove)
goal (2 subgoals):
 1. \<lbrakk>p \<in> carrier R; deg R S X p \<le> an (Suc d); Subring R S;
     Ring S; p = \<zero>\<rbrakk>
    \<Longrightarrow> deg R S X (ldeg_p R S X d p) \<le> an d
 2. \<lbrakk>p \<in> carrier R; deg R S X p \<le> an (Suc d); Subring R S;
     Ring S; p \<noteq> \<zero>\<rbrakk>
    \<Longrightarrow> deg R S X (ldeg_p R S X d p) \<le> an d


proof (prove)
goal (1 subgoal):
 1. constant_rep_design \<V> (multiple_blocks n) (\<r> * int n)


proof (prove)
using this:
  ko_ntm.oalist_inv (sort_oalist_ko_ntm' ox xs', ox)

goal (1 subgoal):
 1. list_of_oalist_ntm (OAlist_ntm xs) = sort_oalist_ko_ntm xs


proof (prove)
using this:
  f (\<Union> (range A)) = f (\<Union> (range A) - A i) + f (A i)

goal (1 subgoal):
 1. f (\<Union> (range A) - A i) = f (\<Union> (range A)) - f (A i)


proof (prove)
using this:
  \<i>[?a] \<equiv>
  \<lparr>Chn = \<p>\<^sub>0[Chn ?a, Chn ?a], Dom = Dom (?a \<star> ?a),
     Cod = Cod ?a\<rparr>
  src ?\<mu> \<equiv>
  if arr ?\<mu> then mkObj (C.cod (Leg0 (Dom ?\<mu>))) else null
  trg ?\<mu> \<equiv>
  if arr ?\<mu> then mkObj (C.cod (Leg1 (Dom ?\<mu>))) else null
  ?\<nu> \<star> ?\<mu> \<equiv>
  if arr ?\<mu> \<and> arr ?\<nu> \<and> src ?\<nu> = trg ?\<mu>
  then \<lparr>Chn = chine_hcomp ?\<nu> ?\<mu>,
          Dom =
            \<lparr>Leg0 =
                      Leg0 (Dom ?\<mu>) \<cdot>
                      \<p>\<^sub>0[Leg0 (Dom ?\<nu>), Leg1 (Dom ?\<mu>)],
               Leg1 =
                 Leg1 (Dom ?\<nu>) \<cdot>
                 \<p>\<^sub>1[Leg0 (Dom ?\<nu>), Leg1 (Dom ?\<mu>)]\<rparr>,
          Cod =
            \<lparr>Leg0 =
                      Leg0 (Cod ?\<mu>) \<cdot>
                      \<p>\<^sub>0[Leg0 (Cod ?\<nu>), Leg1 (Cod ?\<mu>)],
               Leg1 =
                 Leg1 (Cod ?\<nu>) \<cdot>
                 \<p>\<^sub>1[Leg0
                               (Cod ?\<nu>), Leg1
        (Cod ?\<mu>)]\<rparr>\<rparr>
  else null
  arrow_of_spans (\<cdot>) (src f)
  arr ?\<mu> = arrow_of_spans (\<cdot>) ?\<mu>
  arrow_of_spans (\<cdot>) f
  \<lbrakk>C.arr ?f; C.cod ?f = ?b\<rbrakk>
  \<Longrightarrow> ?b \<cdot> ?f = ?f

goal (1 subgoal):
 1. \<i>[src f] =
    \<lparr>Chn = \<p>\<^sub>1[f.dsrc, f.dsrc],
       Dom =
         \<lparr>Leg0 = \<p>\<^sub>1[f.dsrc, f.dsrc],
            Leg1 = \<p>\<^sub>1[f.dsrc, f.dsrc]\<rparr>,
       Cod = \<lparr>Leg0 = f.dsrc, Leg1 = f.dsrc\<rparr>\<rparr>


proof (prove)
goal (1 subgoal):
 1. rel_optionT (BNF_Def.Grp A f) =
    BNF_Def.Grp {x. set_optionT x \<subseteq> A} (map_optionT f)


proof (prove)
using this:
  {i. f 0 \<le> i \<and> i < f n \<and> hamlet (Rep_run r i c)} =
  f ` {i. 0 \<le> i \<and> i < n \<and> hamlet (Rep_run r (f i) c)}
  f 0 = 0

goal (1 subgoal):
 1. {i. i < f n \<and> hamlet (Rep_run r i c)} =
    f ` {i. i < n \<and> hamlet (Rep_run r (f i) c)}


proof (prove)
using this:
  is_minimal_basis (set (a # xs @ ys))
  a \<notin> set (xs @ ys)

goal (1 subgoal):
 1. is_minimal_basis (set (trd (xs @ ys) a # xs @ ys))


proof (state)
this:
  (Q, W, \<delta>d) \<in> frp_invar T1 T2 \<and>
  (Q, W, \<delta>d) \<notin> frp_cond

goal (1 subgoal):
 1. \<And>s a b c.
       \<lbrakk>(a, b, c) \<in> frp_invar T1 T2 \<and>
                (a, b, c) \<notin> frp_cond;
        s = (a, b, c)\<rbrakk>
       \<Longrightarrow> c =
                         reduce_rules
                          (\<delta>_prod (ta_rules T1) (ta_rules T2))
                          (f_accessible
                            (\<delta>_prod (ta_rules T1) (ta_rules T2))
                            (ta_initial T1 \<times> ta_initial T2))


proof (state)
this:
  graph_homomorphism (LG (edges (fst R)) (vertices (fst R))) (chain_sup S) f

goal (1 subgoal):
 1. consequence_graph Rs (chain_sup S)


proof (prove)
using this:
  compile_fundef \<A> (\<O> g) fd1 = Ok fd2
  rel_option (\<lambda>fd1 fd2. compile_fundef \<A> (\<O> f) fd1 = Ok fd2)
   (map_of xs f) (map_of ys' f)

goal (1 subgoal):
 1. rel_option (\<lambda>fd1 fd2. compile_fundef \<A> (\<O> f) fd1 = Ok fd2)
     (map_of ((g, fd1) # xs) f) (map_of ((g, fd2) # ys') f)


proof (prove)
goal (1 subgoal):
 1. Pow (Set t) = fold_keys (\<lambda>x A. A \<union> insert x ` A) t {{}}


proof (prove)
using this:
  (\<Sum>n. g n * (a * z) ^ n) \<noteq> 0
  1 - z \<notin> \<int>\<^sub>\<le>\<^sub>0
  1 + z \<notin> \<int>\<^sub>\<le>\<^sub>0

goal (1 subgoal):
 1. isCont
     (\<lambda>z.
         a *
         ((\<Sum>n. g n * (a * z) ^ n) *
          (\<Sum>n. diffs f n * (a * z) ^ n) -
          (\<Sum>n. f n * (a * z) ^ n) *
          (\<Sum>n. diffs g n * (a * z) ^ n)) /
         (\<Sum>n. g n * (a * z) ^ n)\<^sup>2 +
         Polygamma 1 (1 + z) +
         Polygamma 1 (1 - z))
     z


proof (prove)
goal (1 subgoal):
 1. (c *\<^sub>R a \<le> c *\<^sub>R b) =
    ((0 < c \<longrightarrow> a \<le> b) \<and>
     (c < 0 \<longrightarrow> b \<le> a))


proof (prove)
using this:
  \<lbrakk>0 < ?e2; ?t2 \<in> S \<inter> V\<rbrakk>
  \<Longrightarrow> 1 - q (NN ?e2) ?t2 < ?e2
  \<lbrakk>0 < ?e2; ?t2 \<in> S - U\<rbrakk>
  \<Longrightarrow> q (NN ?e2) ?t2 < ?e2

goal (1 subgoal):
 1. \<And>e.
       0 < e \<Longrightarrow>
       \<exists>f\<in>R.
          f ` S \<subseteq> {0..1} \<and>
          (\<forall>t\<in>S \<inter> V. f t < e) \<and>
          (\<forall>t\<in>S - U. 1 - e < f t)


proof (prove)
goal (1 subgoal):
 1. F.unit a \<cdot>\<^sub>D \<i>\<^sub>D[F.map\<^sub>0 a] =
    (F \<i>\<^sub>C[a] \<cdot>\<^sub>D \<Phi> (a, a)) \<cdot>\<^sub>D
    (F.unit a \<star>\<^sub>D F.unit a)


proof (prove)
goal (1 subgoal):
 1. bij_betw Suc {..n'} {Suc 0..n}


proof (prove)
using this:
  f \<cdot> g \<le> g \<longrightarrow> f\<^sup>\<star> \<cdot> g \<le> g

goal (1 subgoal):
 1. h + f \<cdot> g \<le> g \<Longrightarrow>
    f\<^sup>\<star> \<cdot> h \<le> g


proof (prove)
using this:
  subterms\<^sub>s\<^sub>e\<^sub>t
   (ik\<^sub>s\<^sub>t (unlabel \<A>) \<union>
    assignment_rhs\<^sub>s\<^sub>t (unlabel \<A>))
  \<subseteq> subterms\<^sub>s\<^sub>e\<^sub>t
               (\<Union> (ik\<^sub>s\<^sub>t ` unlabel ` \<P>) \<union>
                \<Union> (assignment_rhs\<^sub>s\<^sub>t ` unlabel ` \<P>))
  wf\<^sub>l\<^sub>s\<^sub>t\<^sub>s \<P> \<and>
  tfr\<^sub>s\<^sub>e\<^sub>t
   (\<Union> (trms\<^sub>l\<^sub>s\<^sub>t ` \<P>)) \<and>
  wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s
   (\<Union> (trms\<^sub>l\<^sub>s\<^sub>t ` \<P>)) \<and>
  (\<forall>\<A>\<in>\<P>.
      list_all tfr\<^sub>s\<^sub>t\<^sub>p (unlabel \<A>)) \<and>
  (\<forall>f T K M \<delta>.
      Fun f T \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t
      \<Union> (ik\<^sub>s\<^sub>t ` unlabel ` \<P>) \<union>
      \<Union>
       (assignment_rhs\<^sub>s\<^sub>t ` unlabel ` \<P>) \<longrightarrow>
      Ana (Fun f T) = (K, M) \<longrightarrow>
      Ana (Fun f T \<cdot> \<delta>) =
      (K \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>,
       M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>))
  \<A> \<in> \<P>
  ?A \<subseteq> ?B \<Longrightarrow> SMP ?A \<subseteq> SMP ?B

goal (1 subgoal):
 1. \<forall>f T K M \<delta>.
       Fun f T \<sqsubseteq>\<^sub>s\<^sub>e\<^sub>t
       ik\<^sub>s\<^sub>t (unlabel \<A>) \<union>
       assignment_rhs\<^sub>s\<^sub>t (unlabel \<A>) \<longrightarrow>
       Ana (Fun f T) = (K, M) \<longrightarrow>
       Ana (Fun f T \<cdot> \<delta>) =
       (K \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>,
        M \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>)


proof (prove)
goal (1 subgoal):
 1. (\<sigma>, fst \<zeta>)
    \<in> oreachable A (otherwith S {i} (orecvmsg R)) (other U {i}) \<and>
    snd \<zeta> \<in> reachable qmsg (recvmsg (R \<sigma>)) \<and>
    (\<forall>m\<in>set (fst (snd \<zeta>)). R \<sigma> m)


proof (prove)
using this:
  f \<in> Ar
  g \<in> Ar

goal (1 subgoal):
 1. set_func
     (Hom(A,_) \<^bsub>\<a>\<^esub> g \<odot>
      Hom(A,_) \<^bsub>\<a>\<^esub> f) =
    compose (Hom A (Dom f)) (restrict ((\<bullet>) g) (Hom A (Dom g)))
     (restrict ((\<bullet>) f) (Hom A (Dom f)))


proof (prove)
goal (5 subgoals):
 1. \<And>s.
       \<lbrakk>s \<in> br'_invar \<delta>; s \<in> br'_cond\<rbrakk>
       \<Longrightarrow> br'_\<alpha> s \<in> br_cond
 2. \<And>s s'.
       \<lbrakk>s \<in> br'_invar \<delta>; s \<in> br'_cond;
        (s, s') \<in> br'_step \<delta>\<rbrakk>
       \<Longrightarrow> (br'_\<alpha> s, br'_\<alpha> s')
                         \<in> br_step \<delta>
 3. br'_\<alpha> ` br'_initial \<delta> \<subseteq> {br_initial \<delta>}
 4. br'_\<alpha> ` br'_invar \<delta> \<subseteq> br_invar \<delta>
 5. \<forall>a aa b.
       (a, aa, b) \<in> br'_invar \<delta> \<and>
       br'_\<alpha> (a, aa, b) \<in> br_cond \<longrightarrow>
       (a, aa, b) \<in> br'_cond


proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<nu> : f \<star>\<^sub>B
                            src\<^sub>B
                             f \<rightarrow>\<^sub>B f' \<star>\<^sub>B
               src\<^sub>B f'\<guillemotright>


proof (prove)
using this:
  design_isomorphism \<V>' \<B>' \<V> \<B> (inv_into \<V> \<pi>)
  \<lbrakk>design_isomorphism ?\<V> ?\<B> ?\<V>' ?\<B>' ?bij_map;
   ?x \<in> incidence_system.intersection_numbers ?\<B>\<rbrakk>
  \<Longrightarrow> ?x \<in> incidence_system.intersection_numbers ?\<B>'
  ?x \<in> source.intersection_numbers \<Longrightarrow>
  ?x \<in> target.intersection_numbers

goal (1 subgoal):
 1. source.intersection_numbers = target.intersection_numbers


proof (state)
this:
  arr g \<and>
  arr f \<and>
  (f = Zero \<and> g \<noteq> One \<or> f \<noteq> Zero \<and> g = One)

goal (2 subgoals):
 1. seq g f \<Longrightarrow>
    arr g \<and>
    arr f \<and>
    (f = Zero \<and> g \<noteq> One \<or> f \<noteq> Zero \<and> g = One)
 2. arr g \<and>
    arr f \<and>
    (f = Zero \<and> g \<noteq> One \<or>
     f \<noteq> Zero \<and> g = One) \<Longrightarrow>
    seq g f


proof (prove)
using this:
  finite V

goal (1 subgoal):
 1. wf (inv_image
         (less_than_bool <*lex*>
          greater_bounded (max_dist src + 1) <*lex*> finite_psubset)
         (\<lambda>(f, PRED, C, N, d). (\<not> f, d, C)))


proof (prove)
goal (5 subgoals):
 1. \<And>P pre rely guar mid Q post.
       \<lbrakk>\<turnstile> P sat [pre, rely, guar, mid];
        \<Turnstile> P sat [pre, rely, guar, mid];
        \<turnstile> Q sat [mid, rely, guar, post];
        \<Turnstile> Q sat [mid, rely, guar, post]\<rbrakk>
       \<Longrightarrow> \<Turnstile> Seq P Q sat [pre, rely, guar, post]
 2. \<And>pre rely P1 b guar post P2.
       \<lbrakk>stable pre rely;
        \<turnstile> P1 sat [pre \<inter> b, rely, guar, post];
        \<Turnstile> P1 sat [pre \<inter> b, rely, guar, post];
        \<turnstile> P2 sat [pre \<inter> - b, rely, guar, post];
        \<Turnstile> P2 sat [pre \<inter> - b, rely, guar, post];
        \<forall>s. (s, s) \<in> guar\<rbrakk>
       \<Longrightarrow> \<Turnstile> Cond b P1
 P2 sat [pre, rely, guar, post]
 3. \<And>pre rely b post P guar.
       \<lbrakk>stable pre rely; pre \<inter> - b \<subseteq> post;
        stable post rely;
        \<turnstile> P sat [pre \<inter> b, rely, guar, pre];
        \<Turnstile> P sat [pre \<inter> b, rely, guar, pre];
        \<forall>s. (s, s) \<in> guar\<rbrakk>
       \<Longrightarrow> \<Turnstile> While b P sat [pre, rely, guar, post]
 4. \<And>pre rely post P b guar.
       \<lbrakk>stable pre rely; stable post rely;
        \<forall>V.
           \<turnstile> P sat [pre \<inter> b \<inter>
                               {V}, {(x, y).
                                     x =
                                     y}, UNIV, {s.
          (V, s) \<in> guar} \<inter>
         post] \<and>
           \<Turnstile> P sat [pre \<inter> b \<inter>
                               {V}, {(x, y).
                                     x =
                                     y}, UNIV, {s.
          (V, s) \<in> guar} \<inter>
         post]\<rbrakk>
       \<Longrightarrow> \<Turnstile> Await b P sat [pre, rely, guar, post]
 5. \<And>pre pre' rely rely' guar' guar post' post P.
       \<lbrakk>pre \<subseteq> pre'; rely \<subseteq> rely';
        guar' \<subseteq> guar; post' \<subseteq> post;
        \<turnstile> P sat [pre', rely', guar', post'];
        \<Turnstile> P sat [pre', rely', guar', post']\<rbrakk>
       \<Longrightarrow> \<Turnstile> P sat [pre, rely, guar, post]


proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x.
         2 * f (g1 (2 * x)) *
         vector_derivative g1 (at (2 * x))) has_integral
     i1)
     {0..1 / 2} &&&
    ((\<lambda>x.
         2 * f (g2 (2 * x - 1)) *
         vector_derivative g2 (at (2 * x - 1))) has_integral
     i2)
     {1 / 2..1}


proof (prove)
goal (1 subgoal):
 1. \<And>x. x \<in> Abs_atMost ` {..<LENGTH('a)}


proof (prove)
using this:
  \<lbrakk>class ?P Object = \<lfloor>(?D, ?fs, ?ms)\<rfloor>;
   ?Mm = map_option (\<lambda>m. (m, Object)) \<circ> map_of ?ms\<rbrakk>
  \<Longrightarrow> ?P \<turnstile> Object sees_methods ?Mm
  is_class P Object

goal (1 subgoal):
 1. (\<And>Mm.
        P \<turnstile> Object sees_methods Mm \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (chain)
picking this:
  has_products (Collect J.ide)
  has_products (Collect J.arr)


proof (prove)
goal (1 subgoal):
 1. \<And>x y. of_hypreal (x / y) = of_hypreal x / of_hypreal y


proof (prove)
using this:
  n = Actual_out (m, x)
  targetnode a = m
  valid_edge a
  V \<in> set (ParamDefs (targetnode a))

goal (1 subgoal):
 1. V \<in> Def (parent_node n)


proof (prove)
goal (1 subgoal):
 1. transform_syn 1 (let y be App (Var f) g in let x be e in Var x  ) =
    let y be Lam [z]. App (App (Var f) g)
                       z in let x be Lam [z]. App e z in Var x


proof (prove)
goal (1 subgoal):
 1. (P \<longleftrightarrow> true) = P


proof (prove)
using this:
  is_quantum_predicate (adjoint (exexH_k (n - 1)) * Q2 * exexH_k (n - 1))
  is_quantum_predicate (adjoint (exexH_k (n - 1)) * Q2 * exexH_k (n - 1))
  Utrans_P vars1 ?A = Utrans (tensor_P ?A (1\<^sub>m K))
  is_quantum_predicate ?P \<Longrightarrow>
  \<turnstile>\<^sub>p {?P} SKIP {?P}
  is_quantum_predicate ?P \<Longrightarrow>
  \<turnstile>\<^sub>p {adjoint ?U * ?P * ?U} Utrans ?U {?P}
  \<lbrakk>is_quantum_predicate ?P; is_quantum_predicate ?Q;
   is_quantum_predicate ?R; \<turnstile>\<^sub>p {?P} ?S1.0 {?Q};
   \<turnstile>\<^sub>p {?Q} ?S2.0 {?R}\<rbrakk>
  \<Longrightarrow> \<turnstile>\<^sub>p {?P} ?S1.0;; ?S2.0 {?R}
  \<lbrakk>\<And>k. k < ?n \<Longrightarrow> is_quantum_predicate (?P k);
   is_quantum_predicate ?Q;
   \<And>k.
      k < ?n \<Longrightarrow>
      \<turnstile>\<^sub>p {?P k} ?S ! k {?Q}\<rbrakk>
  \<Longrightarrow> \<turnstile>\<^sub>p {matrix_sum d
     (\<lambda>k. adjoint (?M k) * ?P k * ?M k) ?n}
   Measure ?n ?M ?S {?Q}
  \<lbrakk>is_quantum_predicate ?P; is_quantum_predicate ?Q;
   \<turnstile>\<^sub>p {?Q} ?S
                        {adjoint (?M 0) * ?P * ?M 0 +
                         adjoint (?M 1) * ?Q * ?M 1}\<rbrakk>
  \<Longrightarrow> \<turnstile>\<^sub>p {adjoint (?M 0) * ?P * ?M 0 +
    adjoint (?M 1) * ?Q * ?M 1}
   While ?M ?S {?P}
  \<lbrakk>is_quantum_predicate ?P; is_quantum_predicate ?Q;
   is_quantum_predicate ?P'; is_quantum_predicate ?Q'; ?P \<le>\<^sub>L ?P';
   \<turnstile>\<^sub>p {?P'} ?S {?Q'}; ?Q' \<le>\<^sub>L ?Q\<rbrakk>
  \<Longrightarrow> \<turnstile>\<^sub>p {?P} ?S {?Q}

goal (1 subgoal):
 1. \<turnstile>\<^sub>p {adjoint (tensor_P mat_Ph (1\<^sub>m K)) *
                          (adjoint (exexH_k (n - 1)) * Q2 *
                           exexH_k (n - 1)) *
                          tensor_P mat_Ph (1\<^sub>m K)}
                         Utrans_P vars1 mat_Ph
                         {adjoint (exexH_k (n - 1)) * Q2 * exexH_k (n - 1)}


proof (prove)
goal (1 subgoal):
 1. of_int_poly rg * of_int_poly sh =
    smult (inverse (r * s)) (of_int_poly p)


proof (state)
this:

goal (1 subgoal):
 1. list_all (\<lambda>m. oiface (fst (snd m)) = ifaceAny)
     (map (apfst of_nat) (annotate_rlen (lr_of_tran_fbs rt fw ifs)))


proof (prove)
using this:
  irreducible (\<Prod>\<^sub># A)
  \<Prod>\<^sub># A dvd \<Prod>\<^sub># B * \<Prod>\<^sub># C

goal (1 subgoal):
 1. \<Prod>\<^sub># A dvd \<Prod>\<^sub># B \<or>
    \<Prod>\<^sub># A dvd \<Prod>\<^sub># C


proof (prove)
goal (1 subgoal):
 1. A B OS P Q \<and> C B OS P Q


proof (prove)
using this:
  \<lbrakk>arev b \<noteq> b; b \<noteq> arev a; b \<noteq> a\<rbrakk>
  \<Longrightarrow> perm_restrict arev (arcs G - {a, arev a}) (arev b) = b

goal (1 subgoal):
 1. perm_restrict arev (arcs G - {a, arev a})
     (perm_restrict arev (arcs G - {a, arev a}) b) =
    b


proof (prove)
goal (1 subgoal):
 1. \<not> A B C CongA A' B' C'


proof (prove)
using this:
  \<lbrakk>finite (Set.insert (priority t) (set (bts_dfs priority rs)));
   Set.insert (priority t) (set (bts_dfs priority rs)) \<noteq> {};
   finite (set (bt_dfs priority r));
   set (bt_dfs priority r) \<noteq> {}\<rbrakk>
  \<Longrightarrow> Min (Set.insert (priority t)
                          (set (bts_dfs priority rs)) \<union>
                         set (bt_dfs priority r)) =
                    ord_class.min
                     (Min (Set.insert (priority t)
                            (set (bts_dfs priority rs))))
                     (Min (set (bt_dfs priority r)))
  Min (set (bt_dfs priority t)) =
  Min (Set.insert (priority t) (set (bts_dfs priority rs)) \<union>
       set (bt_dfs priority r))

goal (1 subgoal):
 1. Min (set (bt_dfs priority t)) =
    ord_class.min
     (Min (Set.insert (priority t) (set (bts_dfs priority rs))))
     (Min (set (bt_dfs priority r)))


proof (prove)
goal (1 subgoal):
 1. (\<rho> ++\<^bsub>domA
                       \<Gamma>\<^esub> \<^bold>\<N>\<lbrakk> \<Gamma> \<^bold>\<rbrakk>\<^bsub>\<rho>\<^sub>1\<^esub>)|\<^sup>\<circ>\<^bsub>r\<^esub> =
    (\<rho>|\<^sup>\<circ>\<^bsub>r\<^esub> ++\<^bsub>domA
                 \<Gamma>\<^esub> \<^bold>\<N>\<lbrakk> \<Gamma> \<^bold>\<rbrakk>\<^bsub>\<rho>\<^sub>2\<^esub>)|\<^sup>\<circ>\<^bsub>r\<^esub>


proof (prove)
goal (1 subgoal):
 1. hom_induced p (subtopology X S) {} X T id
    \<in> Group.iso (homology_group p (subtopology X S))
           (relative_homology_group p X T) &&&
    hom_induced p (subtopology X T) {} X S id
    \<in> Group.iso (homology_group p (subtopology X T))
           (relative_homology_group p X S)


proof (prove)
using this:
  \<theta> supports \<delta>

goal (1 subgoal):
 1. \<theta> supports \<delta> \<circ>\<^sub>s \<sigma> &&&
    (\<sigma> supports \<delta> \<Longrightarrow>
     \<theta> supports \<sigma> \<circ>\<^sub>s \<delta>)


proof (prove)
goal (1 subgoal):
 1. coprime = algebraic_semidom_class.coprime


proof (prove)
using this:
  Inf_from (Liminf_llist Ns - Red_F (Liminf_llist Ns))
  \<subseteq> Inf_from (Liminf_llist Ns - Sup_llist (lmap Red_F Ns))
  Inf_from (Liminf_llist Ns - Sup_llist (lmap Red_F Ns))
  \<subseteq> Sup_llist (lmap Red_I Ns)

goal (1 subgoal):
 1. Inf_from (Liminf_llist Ns - Red_F (Liminf_llist Ns))
    \<subseteq> Sup_llist (lmap Red_I Ns)


proof (state)
this:
  (\<lambda>x. min (max (- h x) (f ?k x)) (h x)) integrable_on S

goal (3 subgoals):
 1. h integrable_on S
 2. \<And>k x.
       x \<in> S \<Longrightarrow>
       norm (min (max (- h x) (f k x)) (h x)) \<le> h x
 3. \<And>x.
       x \<in> S \<Longrightarrow>
       (\<lambda>k. min (max (- h x) (f k x)) (h x))
       \<longlonglongrightarrow> g x


proof (prove)
goal (1 subgoal):
 1. subst x (F x) (subst y (F y) t) = subst y (F y) (subst x (F x) t)


proof (prove)
goal (3 subgoals):
 1. \<And>x it \<sigma> x' it' \<sigma>'.
       \<lbrakk>it \<subseteq> S; \<alpha> ` it \<subseteq> \<alpha> ` S;
        \<Phi> it \<sigma>; \<Phi>' (\<alpha> ` it) \<sigma>';
        \<forall>x\<in>S - it. \<forall>y\<in>it. RR x y;
        \<forall>x\<in>\<alpha> ` S - \<alpha> ` it.
           \<forall>xa\<in>it. RR' x (\<alpha> xa);
        x' = \<alpha> x; it' = \<alpha> ` it;
        ((it, \<sigma>), \<alpha> ` it, \<sigma>') \<in> R; x \<in> it;
        \<forall>y\<in>it - {x}. RR x y;
        \<forall>xa\<in>\<alpha> ` it - {\<alpha> x}.
           RR' (\<alpha> x) xa\<rbrakk>
       \<Longrightarrow> f x \<sigma>
                         \<le> \<Down>
                                {(\<sigma>, \<sigma>').
                                 ((it - {x}, \<sigma>),
                                  \<alpha> ` it - {\<alpha> x}, \<sigma>')
                                 \<in> R}
                                (f' (\<alpha> x) \<sigma>')
 2. \<And>\<sigma> \<sigma>'.
       \<lbrakk>\<Phi> {} \<sigma>; \<Phi>' {} \<sigma>';
        (({}, \<sigma>), {}, \<sigma>') \<in> R\<rbrakk>
       \<Longrightarrow> (\<sigma>, \<sigma>') \<in> R'
 3. \<And>it \<sigma> it' \<sigma>'.
       \<lbrakk>it \<subseteq> S; it' \<subseteq> S'; \<Phi> it \<sigma>;
        \<Phi>' it' \<sigma>';
        \<forall>x\<in>S - it. \<forall>y\<in>it. RR x y;
        \<forall>x\<in>S' - it'. \<forall>y\<in>it'. RR' x y;
        it' = \<alpha> ` it; ((it, \<sigma>), it', \<sigma>') \<in> R;
        it \<noteq> {}; it' \<noteq> {}; \<not> True; \<not> True\<rbrakk>
       \<Longrightarrow> (\<sigma>, \<sigma>') \<in> R'


proof (prove)
goal (1 subgoal):
 1. \<bar>spmf (R1 m1 m2 \<bind> D) True -
          spmf
           (funct m1 m2 \<bind>
            (\<lambda>(out1, out2).
                S1 m1 out1 \<bind>
                (\<lambda>sview.
                    D sview \<bind>
                    (\<lambda>b'. return_spmf (\<not> b')))))
           False\<bar> =
    \<bar>spmf (R1 m1 m2 \<bind> D) True -
          spmf (funct m1 m2 \<bind> (\<lambda>(o1, o2). S1 m1 o1 \<bind> D))
           True\<bar>


proof (prove)
goal (1 subgoal):
 1. pn.eq_m (pn.Mp C) (prod_list Gs) \<and>
    mset Fs = mset (map Mp Gs) \<and>
    (\<forall>G.
        G \<in> set Gs \<longrightarrow> monic G \<and> pn.Mp G = G)


proof (prove)
goal (1 subgoal):
 1. x |\<in>| A \<Longrightarrow> x \<^bold>* F A = F A


proof (prove)
goal (1 subgoal):
 1. emeasure lborel ((\<lambda>x. (fst x, - snd x)) -` A) =
    emeasure (distr lborel lborel (\<lambda>(x, y). (x, - y))) A


proof (state)
goal (2 subgoals):
 1. \<forall>\<^sub>F i in sequentially.
       G x \<le> Gamma_series x i * (1 + x / real i)
 2. sequentially \<noteq> bot


proof (prove)
goal (1 subgoal):
 1. fst (strip_comb (app t u)) = fst (strip_comb t)


proof (prove)
goal (1 subgoal):
 1. isodefl (cast\<cdot>t) t


proof (prove)
goal (1 subgoal):
 1. G|-{P}. the (body pn) .{Q} \<Longrightarrow>
    insert ({P}. BODY pn .{Q}) G|-{P}. the (body pn) .{Q}


proof (prove)
goal (1 subgoal):
 1. currentLevel (prefixToLevel_aux M l i) \<le> l - i


proof (prove)
using this:
  (\<exists>n''\<ge>n.
      \<gamma> t n'' \<and>
      (\<forall>n'\<ge>n. n' < n'' \<longrightarrow> \<gamma>' t n')) \<or>
  (\<forall>n'\<ge>n. \<gamma>' t n')
  ?\<gamma>' \<WW>\<^sub>c ?\<gamma> \<equiv>
  ?\<gamma>' \<UU>\<^sub>c ?\<gamma> \<or>\<^sup>c \<box>\<^sub>c?\<gamma>'

goal (1 subgoal):
 1. (\<gamma>' \<WW>\<^sub>c \<gamma>) t n


proof (state)
this:
  graph H h = graph H' h'

goal (1 subgoal):
 1. graph H h = graph H' h' \<Longrightarrow> False


proof (prove)
using this:
  dgrad_set_le d (pp_of_term ` Keys F) (pp_of_term ` Keys G)
  dgrad_set_le d (pp_of_term ` Keys G) (pp_of_term ` Keys H)

goal (1 subgoal):
 1. dgrad_set_le d (pp_of_term ` Keys F) (pp_of_term ` Keys H)


proof (prove)
goal (1 subgoal):
 1. k \<noteq> 0 \<Longrightarrow>
    (\<forall>x. (f' \<div> k) x = f x) =
    (\<forall>i.
        (f i = NoMsg \<longrightarrow>
         (\<forall>j<k. f' (i * k + j) = NoMsg)) \<and>
        (f i \<noteq> NoMsg \<longrightarrow>
         (\<exists>n<k.
             f' (i * k + n) = f i \<and>
             (\<forall>j<k.
                 n < j \<longrightarrow> f' (i * k + j) = NoMsg))))


proof (prove)
goal (2 subgoals):
 1. \<And>a. Pre FIG.Out (Sim a) \<Longrightarrow> Pre DFIG.Out a
 2. \<And>a b.
       \<lbrakk>Pre FIG.Out (Sim a); DFIG.Out (a, b)\<rbrakk>
       \<Longrightarrow> FIG.Out (Sim a, Sim b)


proof (prove)
goal (1 subgoal):
 1. \<exists>x. x \<in> {(s, a). stk_strict_subs s}


proof (prove)
goal (1 subgoal):
 1. let s' = \<T>_update (pivot_tableau x\<^sub>i x\<^sub>j (\<T> s)) s
    in \<V> s' = \<V> s \<and>
       \<B>\<^sub>i s' = \<B>\<^sub>i s \<and>
       \<U> s' = \<U> s \<and> \<U>\<^sub>c s' = \<U>\<^sub>c s


proof (prove)
using this:
  y \<in>\<^sub>\<circ> \<R>\<^sub>\<circ> vreal_uminus

goal (1 subgoal):
 1. (\<And>x.
        \<lbrakk>x \<in>\<^sub>\<circ> \<D>\<^sub>\<circ> vreal_uminus;
         y = -\<^sub>\<real> x\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. pathsCard
     (paths
       (substitute (FBinds \<Gamma>\<cdot>ae) (thunks \<Gamma>)
         (substitute (FBinds \<Delta>\<cdot>(Aheap \<Delta> e\<cdot>a))
           (thunks \<Delta>) (Texp e\<cdot>a) \<otimes>\<otimes>
          Fstack as S))) f|`
    (- domA \<Delta>) =
    pathsCard
     (paths
       (substitute (FBinds \<Gamma>\<cdot>ae) (thunks \<Gamma>)
         (ttree_restr (- domA \<Delta>)
           (substitute (FBinds \<Delta>\<cdot>(Aheap \<Delta> e\<cdot>a))
             (thunks \<Delta>) (Texp e\<cdot>a)) \<otimes>\<otimes>
          Fstack as S)))


proof (prove)
using this:
  \<lbrakk>N \<noteq> M; M - M \<inter># N = {#}\<rbrakk>
  \<Longrightarrow> \<exists>y. count M y < count N y

goal (1 subgoal):
 1. multeqp P N M = (multp P N M \<or> N = M)


proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. value (t x))
    \<in> restrict_space B
           (t -`
            trees_cyl
             (map_tree (\<lambda>_. space M)
               \<langle>ls, u, rs\<rangle>)) \<rightarrow>\<^sub>M
          M


proof (prove)
goal (1 subgoal):
 1. countable A \<Longrightarrow> countable (trees A)


proof (prove)
goal (1 subgoal):
 1. complex_of_real ((norm A)\<^sup>2 * \<epsilon>) =
    complex_of_real ((norm (A*) * sqrt \<epsilon>)\<^sup>2)


proof (prove)
goal (1 subgoal):
 1. dnf_to_bool \<gamma> (dnf_and d1 d2) =
    (dnf_to_bool \<gamma> d1 \<and> dnf_to_bool \<gamma> d2)


proof (prove)
using this:
  f : a' \<mapsto>\<^bsub>\<AA>\<^esub> b'
  a = \<AA>\<lparr>Dom\<rparr>\<lparr>f\<rparr>
  b = \<AA>\<lparr>Cod\<rparr>\<lparr>f\<rparr>

goal (1 subgoal):
 1. g \<in>\<^sub>\<circ> \<FF>\<lparr>ArrMap\<rparr> `\<^sub>\<circ>
                          Hom \<AA> a b


proof (prove)
goal (2 subgoals):
 1. \<And>x esf xa esfa.
       \<lbrakk>envObsC esf = envObsC esfa;
        x \<in> set (listToFuns (snd envInitBits) agents);
        esf \<in> set (fst envInitBits);
        s =
        \<lparr>es = esf, ps = x,
           pubActs = (default, \<lambda>_. default)\<rparr>;
        xa \<in> set (listToFuns (snd envInitBits) agents);
        esfa \<in> set (fst envInitBits);
        s' =
        \<lparr>es = esfa, ps = xa,
           pubActs = (default, \<lambda>_. default)\<rparr>\<rbrakk>
       \<Longrightarrow> \<lparr>es = esf, ps = x(a := xa a),
                            pubActs = (default, \<lambda>_. default)\<rparr>
                         \<in> (\<lambda>esf.
                                   \<lparr>es = esf, ps = x(a := xa a),
pubActs = (default, \<lambda>_. default)\<rparr>) `
                               set (fst envInitBits)
 2. \<And>x esf xa esfa.
       \<lbrakk>envObsC esf = envObsC esfa;
        x \<in> set (listToFuns (snd envInitBits) agents);
        esf \<in> set (fst envInitBits);
        s =
        \<lparr>es = esf, ps = x,
           pubActs = (default, \<lambda>_. default)\<rparr>;
        xa \<in> set (listToFuns (snd envInitBits) agents);
        esfa \<in> set (fst envInitBits);
        s' =
        \<lparr>es = esfa, ps = xa,
           pubActs = (default, \<lambda>_. default)\<rparr>\<rbrakk>
       \<Longrightarrow> x(a := xa a)
                         \<in> set (listToFuns (snd envInitBits) agents)


proof (prove)
using this:
  Ide t \<and>
  Arr t \<and>
  Dom t = t \<and>
  Cod t = t \<and>
  ide \<lbrace>t\<rbrace> \<and>
  ide \<lbrace>\<^bold>\<lfloor>t\<^bold>\<rfloor>\<rbrace> \<and>
  \<lbrace>t\<^bold>\<down>\<rbrace>
  \<in> hom \<lbrace>t\<rbrace>
         \<lbrace>\<^bold>\<lfloor>t\<^bold>\<rfloor>\<rbrace>
  Arr ?t \<Longrightarrow>
  \<^bold>\<lfloor>Src ?t\<^bold>\<rfloor> =
  Src \<^bold>\<lfloor>?t\<^bold>\<rfloor>
  Arr ?t \<Longrightarrow> \<^bold>\<lfloor>Src ?t\<^bold>\<rfloor> = Src ?t
  obj ?a \<Longrightarrow> \<l>[?a] = \<i>[?a]
  obj ?a \<Longrightarrow> \<r>[?a] = \<i>[?a]
  C.obj ?a \<Longrightarrow> obj (E ?a)

goal (1 subgoal):
 1. \<And>x1 x1a x1b.
       \<lbrakk>C.obj x1; x1b = x1;
        \<^bold>\<lfloor>Src t\<^bold>\<rfloor> =
        \<^bold>\<langle>x1a\<^bold>\<rangle>\<^sub>0;
        ide (E x1) \<and>
        \<guillemotleft>\<lbrace>t\<^bold>\<down>\<rbrace> : \<lbrace>t\<rbrace> \<Rightarrow> E
                    x1\<guillemotright>;
        \<And>a. obj a \<Longrightarrow> \<l>[a] = \<i>[a];
        \<And>a. obj a \<Longrightarrow> \<r>[a] = \<i>[a];
        \<And>f. ide f \<Longrightarrow> \<ll> f = \<l>[f];
        \<And>f. ide f \<Longrightarrow> \<rr> f = \<r>[f];
        \<And>t.
           Arr t \<Longrightarrow>
           Arr \<^bold>\<lfloor>t\<^bold>\<rfloor> \<and>
           Src \<^bold>\<lfloor>t\<^bold>\<rfloor> = Src t \<and>
           Trg \<^bold>\<lfloor>t\<^bold>\<rfloor> = Trg t;
        \<And>t.
           Arr t \<Longrightarrow>
           Dom \<^bold>\<lfloor>t\<^bold>\<rfloor> =
           \<^bold>\<lfloor>Dom t\<^bold>\<rfloor> \<and>
           Cod \<^bold>\<lfloor>t\<^bold>\<rfloor> =
           \<^bold>\<lfloor>Cod t\<^bold>\<rfloor>;
        \<^bold>\<lfloor>t\<^bold>\<rfloor> =
        \<^bold>\<langle>x1\<^bold>\<rangle>\<^sub>0;
        Ide t \<and>
        Arr t \<and>
        Dom t = t \<and> Cod t = t \<and> ide \<lbrace>t\<rbrace>;
        \<And>t. is_Prim\<^sub>0 (Src t)\<rbrakk>
       \<Longrightarrow> \<ll> (E x1a) = \<r>[E x1]


proof (prove)
using this:
  indexed_eval_aux (Qs @ [P]) i m \<in> carrier R
  count m i = length Qs + k
  indexed_eval_aux (Qs @ [P]) i m \<noteq> \<zero>

goal (1 subgoal):
 1. (if i \<in># m + {#i#}
     then indexed_eval_aux (Qs @ [P]) i (m + {#i#} - {#i#}) else \<zero>)
    \<in> carrier R - {\<zero>}


proof (prove)
goal (1 subgoal):
 1. cxt_to_stmt E c = Skip \<Longrightarrow> c = Skip \<and> E = []


proof (prove)
using this:
  prefix_of \<pi>' \<sigma> \<and> i < progress \<pi>'
  prefix_of \<pi> \<sigma>
  \<lbrakk>prefix_of ?\<pi> ?\<sigma>; prefix_of ?\<pi>' ?\<sigma>\<rbrakk>
  \<Longrightarrow> ?\<pi> \<le> ?\<pi>' \<or> ?\<pi>' \<le> ?\<pi>
  \<not> i < progress \<pi>
  ?\<pi> \<le> ?\<pi>' \<Longrightarrow>
  progress ?\<pi> \<le> progress ?\<pi>'

goal (1 subgoal):
 1. \<pi> \<le> \<pi>'


proof (prove)
goal (1 subgoal):
 1. t \<noteq> Zero \<Longrightarrow>
    pnPlus (Plus r s) t = pnPlus r (pnPlus s t)


proof (prove)
goal (1 subgoal):
 1. f \<le> \<eta> \<Longrightarrow> kstar f \<le> \<eta>


proof (prove)
goal (1 subgoal):
 1. (\<Prod>k. f k ^ lookup x k) = (\<Prod>k\<in>keys x. f k ^ lookup x k)


proof (prove)
using this:
  F \<in>\<^sub>\<circ> (\<AA> \<times>\<^sub>D\<^sub>G\<^sub>3 \<BB> \<times>\<^sub>D\<^sub>G\<^sub>3 \<CC>)\<lparr>Arr\<rparr>

goal (1 subgoal):
 1. (\<And>f f' f''.
        \<lbrakk>F = [f, f', f'']\<^sub>\<circ>;
         f \<in>\<^sub>\<circ> \<AA>\<lparr>Arr\<rparr>;
         f' \<in>\<^sub>\<circ> \<BB>\<lparr>Arr\<rparr>;
         f'' \<in>\<^sub>\<circ> \<CC>\<lparr>Arr\<rparr>\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. x \<le> y \<Longrightarrow> oLog b x \<le> oLog b y


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>P \<turnstile> h \<surd>; h a = \<lfloor>(C, fs)\<rfloor>;
     P,h \<turnstile> (C, fs') \<surd>\<rbrakk>
    \<Longrightarrow> P \<turnstile> h(a \<mapsto> (C, fs')) \<surd>


proof (prove)
using this:
  finite gen

goal (1 subgoal):
 1. finite ((*\<^sub>v) B ` gen)


proof (prove)
using this:
  prv (dsj (eql t zer) (exi x' (eql t (suc (Var x')))))
  prv (imp (exi x' (eql t (suc (Var x')))) (exi x (eql t (suc (Var x)))))

goal (1 subgoal):
 1. prv (dsj (eql t zer) (exi x (eql t (suc (Var x)))))


proof (prove)
using this:
  1 < length l

goal (1 subgoal):
 1. hd (tl l) = l ! 1


proof (prove)
using this:
  \<F>C.arr f
  local.map ?f \<equiv>
  if \<F>C.arr ?f then \<lbrace>\<F>C.rep ?f\<rbrace> else D.null
  Arr ?t \<Longrightarrow>
  \<lbrace>\<^bold>\<parallel>?t\<^bold>\<parallel>\<rbrace> =
  \<lbrace>?t\<rbrace>
  \<F>C.arr ?f \<Longrightarrow>
  \<F>C.rep (\<F>C.dom ?f) =
  \<^bold>\<parallel>\<F>C.DOM ?f\<^bold>\<parallel>
  Arr ?t \<Longrightarrow> Ide (Dom ?t)

goal (1 subgoal):
 1. D.dom (local.map f) = local.map (\<F>C.dom f)


proof (prove)
goal (1 subgoal):
 1. ((A ===> A ===> A) ===> A ===> (A ===> A ===> A) ===> A ===> (=))
     (comm_semiring_1_ow (Collect (Domainp A))) class.comm_semiring_1


proof (prove)
goal (1 subgoal):
 1. (P x y \<or> Q x y)\<lbrakk>(x, y)\<rightarrow>v\<rbrakk> =
    (P x y\<lbrakk>(x, y)\<rightarrow>v\<rbrakk> \<or>
     Q x y\<lbrakk>(x, y)\<rightarrow>v\<rbrakk>)


proof (prove)
goal (1 subgoal):
 1. ((((((\<forall>g.
             True \<longrightarrow>
             finite (nodes (gen_wf.\<alpha> gen_cfg_wf))) \<and>
         (\<forall>g.
             True \<longrightarrow>
             finite (edges (gen_wf.\<alpha> gen_cfg_wf))) \<and>
         (\<forall>g.
             True \<longrightarrow>
             valid_graph (gen_wf.\<alpha> gen_cfg_wf))) \<and>
        (((\<forall>g.
              True \<longrightarrow>
              finite (nodes (gen_wf.\<alpha> gen_cfg_wf))) \<and>
          (\<forall>g.
              True \<longrightarrow>
              finite (edges (gen_wf.\<alpha> gen_cfg_wf))) \<and>
          (\<forall>g.
              True \<longrightarrow>
              valid_graph (gen_wf.\<alpha> gen_cfg_wf))) \<and>
         (\<forall>g.
             True \<longrightarrow>
             set_iterator (foldri (gen_wf_\<alpha>n gen_cfg_wf))
              (nodes (gen_wf.\<alpha> gen_cfg_wf)))) \<and>
        ((\<forall>g.
             True \<longrightarrow>
             finite (nodes (gen_wf.\<alpha> gen_cfg_wf))) \<and>
         (\<forall>g.
             True \<longrightarrow>
             finite (edges (gen_wf.\<alpha> gen_cfg_wf))) \<and>
         (\<forall>g.
             True \<longrightarrow>
             valid_graph (gen_wf.\<alpha> gen_cfg_wf))) \<and>
        (\<forall>g v.
            True \<longrightarrow>
            set_iterator (foldri (gen_wf_inEdges' gen_cfg_wf v))
             (pred (gen_wf.\<alpha> gen_cfg_wf) v))) \<and>
       (\<forall>g.
           gen_wf_Entry gen_cfg_wf
           \<in> set (gen_wf_\<alpha>n gen_cfg_wf)) \<and>
       (\<forall>g.
           True \<longrightarrow>
           graph_path_base.inEdges (\<lambda>_. gen_wf_inEdges' gen_cfg_wf)
            g (gen_wf_Entry gen_cfg_wf) =
           []) \<and>
       (\<forall>n g.
           n \<in> set (gen_wf_\<alpha>n gen_cfg_wf) \<longrightarrow>
           True \<longrightarrow>
           (\<exists>ns.
               graph_path_base.path2
                (\<lambda>_. gen_wf_\<alpha>n gen_cfg_wf) (\<lambda>_. True)
                (\<lambda>_. gen_wf_inEdges' gen_cfg_wf) g
                (gen_wf_Entry gen_cfg_wf) ns n))) \<and>
      ((\<forall>n g.
           n \<in> set (gen_wf_\<alpha>n gen_cfg_wf) \<longrightarrow>
           gen_wf_defs gen_cfg_wf n \<inter> gen_wf_uses gen_cfg_wf n =
           {}) \<and>
       (\<forall>g n. finite (gen_wf_defs gen_cfg_wf n))) \<and>
      (\<forall>v g n.
          v \<in> gen_wf_uses gen_cfg_wf n \<longrightarrow>
          n \<in> set (gen_wf_\<alpha>n gen_cfg_wf)) \<and>
      (\<forall>g n. finite (gen_wf_uses gen_cfg_wf n)) \<and>
      (\<forall>g. True)) \<and>
     (\<forall>g.
         \<forall>m\<in>set (gen_wf_\<alpha>n gen_cfg_wf).
            \<forall>v\<in>gen_wf_uses gen_cfg_wf m.
               CFG_base.defAss' (\<lambda>_. gen_wf_\<alpha>n gen_cfg_wf)
                (\<lambda>_. True) (\<lambda>_. gen_wf_inEdges' gen_cfg_wf)
                (\<lambda>_. gen_wf_Entry gen_cfg_wf)
                (\<lambda>_. gen_wf_defs gen_cfg_wf) g m v)) \<and>
    (((((((\<forall>g.
              True \<longrightarrow>
              finite (nodes (gen_wf.\<alpha> gen_cfg_wf))) \<and>
          (\<forall>g.
              True \<longrightarrow>
              finite (edges (gen_wf.\<alpha> gen_cfg_wf))) \<and>
          (\<forall>g.
              True \<longrightarrow>
              valid_graph (gen_wf.\<alpha> gen_cfg_wf))) \<and>
         (((\<forall>g.
               True \<longrightarrow>
               finite (nodes (gen_wf.\<alpha> gen_cfg_wf))) \<and>
           (\<forall>g.
               True \<longrightarrow>
               finite (edges (gen_wf.\<alpha> gen_cfg_wf))) \<and>
           (\<forall>g.
               True \<longrightarrow>
               valid_graph (gen_wf.\<alpha> gen_cfg_wf))) \<and>
          (\<forall>g.
              True \<longrightarrow>
              set_iterator (foldri (gen_wf_\<alpha>n gen_cfg_wf))
               (nodes (gen_wf.\<alpha> gen_cfg_wf)))) \<and>
         ((\<forall>g.
              True \<longrightarrow>
              finite (nodes (gen_wf.\<alpha> gen_cfg_wf))) \<and>
          (\<forall>g.
              True \<longrightarrow>
              finite (edges (gen_wf.\<alpha> gen_cfg_wf))) \<and>
          (\<forall>g.
              True \<longrightarrow>
              valid_graph (gen_wf.\<alpha> gen_cfg_wf))) \<and>
         (\<forall>g v.
             True \<longrightarrow>
             set_iterator (foldri (gen_wf_inEdges' gen_cfg_wf v))
              (pred (gen_wf.\<alpha> gen_cfg_wf) v))) \<and>
        (\<forall>g.
            gen_wf_Entry gen_cfg_wf
            \<in> set (gen_wf_\<alpha>n gen_cfg_wf)) \<and>
        (\<forall>g.
            True \<longrightarrow>
            graph_path_base.inEdges (\<lambda>_. gen_wf_inEdges' gen_cfg_wf)
             g (gen_wf_Entry gen_cfg_wf) =
            []) \<and>
        (\<forall>n g.
            n \<in> set (gen_wf_\<alpha>n gen_cfg_wf) \<longrightarrow>
            True \<longrightarrow>
            (\<exists>ns.
                graph_path_base.path2
                 (\<lambda>_. gen_wf_\<alpha>n gen_cfg_wf)
                 (\<lambda>_. True) (\<lambda>_. gen_wf_inEdges' gen_cfg_wf)
                 g (gen_wf_Entry gen_cfg_wf) ns n))) \<and>
       ((\<forall>n g.
            n \<in> set (gen_wf_\<alpha>n gen_cfg_wf) \<longrightarrow>
            gen_wf_defs' gen_cfg_wf n \<inter> gen_wf.uses' gen_cfg_wf n =
            {}) \<and>
        (\<forall>g n. finite (gen_wf_defs' gen_cfg_wf n))) \<and>
       (\<forall>v g n.
           v \<in> gen_wf.uses' gen_cfg_wf n \<longrightarrow>
           n \<in> set (gen_wf_\<alpha>n gen_cfg_wf)) \<and>
       (\<forall>g n. finite (gen_wf.uses' gen_cfg_wf n)) \<and>
       (\<forall>g. True)) \<and>
      ((\<forall>g. finite (dom (gen_wf.phis' gen_cfg_wf))) \<and>
       (\<forall>g n v vs.
           gen_wf.phis' gen_cfg_wf (n, v) = Some vs \<longrightarrow>
           n \<in> set (gen_wf_\<alpha>n gen_cfg_wf))) \<and>
      (\<forall>g n v args.
          gen_wf.phis' gen_cfg_wf (n, v) = Some args \<longrightarrow>
          length
           (graph_path_base.predecessors
             (\<lambda>_. gen_wf_inEdges' gen_cfg_wf) g n) =
          length args) \<and>
      (\<forall>n g.
          n \<in> set (gen_wf_\<alpha>n gen_cfg_wf) \<longrightarrow>
          gen_wf_defs' gen_cfg_wf n \<inter>
          CFG_SSA_base.phiDefs (\<lambda>_. gen_wf.phis' gen_cfg_wf) g n =
          {}) \<and>
      (\<forall>n g m.
          n \<in> set (gen_wf_\<alpha>n gen_cfg_wf) \<longrightarrow>
          m \<in> set (gen_wf_\<alpha>n gen_cfg_wf) \<longrightarrow>
          n \<noteq> m \<longrightarrow>
          CFG_SSA_base.allDefs (\<lambda>_. gen_wf_defs' gen_cfg_wf)
           (\<lambda>_. gen_wf.phis' gen_cfg_wf) g n \<inter>
          CFG_SSA_base.allDefs (\<lambda>_. gen_wf_defs' gen_cfg_wf)
           (\<lambda>_. gen_wf.phis' gen_cfg_wf) g m =
          {})) \<and>
     (\<forall>v g n.
         v \<in> CFG_SSA_base.allUses
                  (\<lambda>_. gen_wf_\<alpha>n gen_cfg_wf)
                  (\<lambda>_. gen_wf_inEdges' gen_cfg_wf)
                  (\<lambda>_. gen_wf.uses' gen_cfg_wf)
                  (\<lambda>_. gen_wf.phis' gen_cfg_wf) g
                  n \<longrightarrow>
         n \<in> set (gen_wf_\<alpha>n gen_cfg_wf) \<longrightarrow>
         CFG_SSA_base.defAss (\<lambda>_. gen_wf_\<alpha>n gen_cfg_wf)
          (\<lambda>_. True) (\<lambda>_. gen_wf_inEdges' gen_cfg_wf)
          (\<lambda>_. gen_wf_Entry gen_cfg_wf)
          (\<lambda>_. gen_wf_defs' gen_cfg_wf)
          (\<lambda>_. gen_wf.phis' gen_cfg_wf) g n v) \<and>
     (\<forall>g v.
         gen_wf.phis' gen_cfg_wf (gen_wf_Entry gen_cfg_wf, v) =
         None)) \<and>
    ((\<forall>g n.
         gen_wf_defs gen_cfg_wf n =
         gen_wf_var gen_cfg_wf ` gen_wf_defs' gen_cfg_wf n) \<and>
     (\<forall>n g.
         n \<in> set (gen_wf_\<alpha>n gen_cfg_wf) \<longrightarrow>
         gen_wf_uses gen_cfg_wf n =
         gen_wf_var gen_cfg_wf ` gen_wf.uses' gen_cfg_wf n)) \<and>
    (\<forall>g n ns m v x v'.
        graph_path_base.path2 (\<lambda>_. gen_wf_\<alpha>n gen_cfg_wf)
         (\<lambda>_. True) (\<lambda>_. gen_wf_inEdges' gen_cfg_wf) g n ns
         m \<longrightarrow>
        n \<notin> set (tl ns) \<longrightarrow>
        v \<in> CFG_SSA_base.allDefs (\<lambda>_. gen_wf_defs' gen_cfg_wf)
                 (\<lambda>_. gen_wf.phis' gen_cfg_wf) g n \<longrightarrow>
        v \<in> CFG_SSA_base.allUses
                 (\<lambda>_. gen_wf_\<alpha>n gen_cfg_wf)
                 (\<lambda>_. gen_wf_inEdges' gen_cfg_wf)
                 (\<lambda>_. gen_wf.uses' gen_cfg_wf)
                 (\<lambda>_. gen_wf.phis' gen_cfg_wf) g m \<longrightarrow>
        x \<in> set (tl ns) \<longrightarrow>
        v' \<in> CFG_SSA_base.allDefs (\<lambda>_. gen_wf_defs' gen_cfg_wf)
                  (\<lambda>_. gen_wf.phis' gen_cfg_wf) g
                  x \<longrightarrow>
        gen_wf_var gen_cfg_wf v' \<noteq> gen_wf_var gen_cfg_wf v) \<and>
    (\<forall>g n v vs v'.
        gen_wf.phis' gen_cfg_wf (n, v) = Some vs \<longrightarrow>
        v' \<in> set vs \<longrightarrow>
        gen_wf_var gen_cfg_wf v' = gen_wf_var gen_cfg_wf v) \<and>
    (\<forall>n g v v'.
        n \<in> set (gen_wf_\<alpha>n gen_cfg_wf) \<longrightarrow>
        v \<in> CFG_SSA_base.allDefs (\<lambda>_. gen_wf_defs' gen_cfg_wf)
                 (\<lambda>_. gen_wf.phis' gen_cfg_wf) g n \<longrightarrow>
        v' \<in> CFG_SSA_base.allDefs (\<lambda>_. gen_wf_defs' gen_cfg_wf)
                  (\<lambda>_. gen_wf.phis' gen_cfg_wf) g
                  n \<longrightarrow>
        v \<noteq> v' \<longrightarrow>
        gen_wf_var gen_cfg_wf v' \<noteq> gen_wf_var gen_cfg_wf v)


proof (prove)
goal (1 subgoal):
 1. \<And>c x.
       complex_of_real ((c *\<^sub>R x) $\<^sub>e 0) +
       \<i> * complex_of_real ((c *\<^sub>R x) $\<^sub>e Suc 0) =
       c *\<^sub>R
       (complex_of_real (x $\<^sub>e 0) +
        \<i> * complex_of_real (x $\<^sub>e Suc 0))


proof (prove)
using this:
  a \<in> {0..1}

goal (1 subgoal):
 1. x_ \<in> {0..1 - a} -
             ({1 - a} \<union> (\<lambda>x. x - a) ` S) \<Longrightarrow>
    f (shiftpath a g x_) * vector_derivative (shiftpath a g) (at x_) =
    f (g (a + x_)) * vector_derivative g (at (a + x_))


proof (prove)
goal (1 subgoal):
 1. openin (final_topology X Y f) =
    (\<lambda>U.
        U \<subseteq> X \<and>
        (\<forall>i. openin (Y i) (f i -` U \<inter> topspace (Y i))))


proof (prove)
goal (1 subgoal):
 1. cyclic_group (\<G> \<eta>)


proof (prove)
using this:
  equiv ?A ?r \<Longrightarrow> equiv (?A \<inter> ?B) (Restr ?r ?B)
  equiv non_zero_vectors proportionality

goal (1 subgoal):
 1. equiv (non_zero_vectors \<inter> Collect invertible)
     (Restr proportionality (Collect invertible))


proof (prove)
goal (1 subgoal):
 1. ((map (\<lambda>x. x \<in> id RRR) [1, 2, 3, 4, 6] =
      [False, False, True, False, True] &&&
      map (\<lambda>x. x \<in> - RRR) [1, 2, 3, 4, 6] =
      [True, True, False, True, False] &&&
      map (\<lambda>x. x \<in> closure RRR) [1, 2, 3, 4, 6] =
      [True, True, True, False, True]) &&&
     (map (\<lambda>x. x \<in> (closure \<circ> uminus) RRR)
       [1, 2, 3, 4, 6] =
      [True, True, True, True, True] &&&
      map (\<lambda>x. x \<in> (uminus \<circ> closure) RRR)
       [1, 2, 3, 4, 6] =
      [False, False, False, True, False]) &&&
     map (\<lambda>x. x \<in> (uminus \<circ> closure \<circ> uminus) RRR)
      [1, 2, 3, 4, 6] =
     [False, False, False, False, False] &&&
     map (\<lambda>x. x \<in> (closure \<circ> uminus \<circ> closure) RRR)
      [1, 2, 3, 4, 6] =
     [False, True, True, True, False]) &&&
    (map (\<lambda>x.
             x \<in> (uminus \<circ> closure \<circ> uminus \<circ> closure)
                      RRR)
      [1, 2, 3, 4, 6] =
     [True, False, False, False, True] &&&
     map (\<lambda>x.
             x \<in> (closure \<circ> uminus \<circ> closure \<circ> uminus)
                      RRR)
      [1, 2, 3, 4, 6] =
     [True, True, False, False, False] &&&
     map (\<lambda>x.
             x \<in> (uminus \<circ> closure \<circ> uminus \<circ>
                      closure \<circ>
                      uminus)
                      RRR)
      [1, 2, 3, 4, 6] =
     [False, False, True, True, True]) &&&
    (map (\<lambda>x.
             x \<in> (closure \<circ> uminus \<circ> closure \<circ>
                      uminus \<circ>
                      closure)
                      RRR)
      [1, 2, 3, 4, 6] =
     [True, True, False, False, True] &&&
     map (\<lambda>x.
             x \<in> (uminus \<circ> closure \<circ> uminus \<circ>
                      closure \<circ>
                      uminus \<circ>
                      closure)
                      RRR)
      [1, 2, 3, 4, 6] =
     [False, False, True, True, False]) &&&
    map (\<lambda>x.
            x \<in> (closure \<circ> uminus \<circ> closure \<circ>
                     uminus \<circ>
                     closure \<circ>
                     uminus)
                     RRR)
     [1, 2, 3, 4, 6] =
    [False, True, True, True, True] &&&
    map (\<lambda>x.
            x \<in> (uminus \<circ> closure \<circ> uminus \<circ>
                     closure \<circ>
                     uminus \<circ>
                     closure \<circ>
                     uminus)
                     RRR)
     [1, 2, 3, 4, 6] =
    [True, False, False, False, False]


proof (prove)
goal (1 subgoal):
 1. bijective (inv hom)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite \<F>; open S;
     \<And>T. T \<in> \<F> \<Longrightarrow> \<exists>a b. T = cbox a b;
     \<And>T.
        T \<in> \<F> \<Longrightarrow> S \<inter> interior T = {}\<rbrakk>
    \<Longrightarrow> S \<inter> interior (\<Union> \<F>) = {}


proof (prove)
goal (1 subgoal):
 1. poly.coeff Q' k = (if n < k then 0 else (- 1) ^ (n - k) * e' (n - k))


proof (prove)
goal (1 subgoal):
 1. n dvd j


proof (prove)
goal (1 subgoal):
 1. fix\<cdot>ValK_copy_rec = (ID, ID)


proof (prove)
using this:
  i < length (map (\<lambda>i. S (Suc i)) [0..<n])

goal (1 subgoal):
 1. ((s # map (\<lambda>i. S (Suc i)) [0..<n]) ! i,
     (s # map (\<lambda>i. S (Suc i)) [0..<n]) ! Suc i)
    \<in> R


proof (prove)
goal (1 subgoal):
 1. \<And>x Y.
       \<lbrakk>cont g; chain Y; chain (\<lambda>i. Y i `;` g x)\<rbrakk>
       \<Longrightarrow> ((\<Squnion>i. Y i) `;` g x) \<sqsubseteq>
                         (\<Squnion>i. Y i `;` g x)


proof (prove)
goal (1 subgoal):
 1. class.Sup_lattice smap sleq


proof (prove)
using this:
  \<guillemotleft>\<xi>' \<star>\<^sub>S
                  S.UP
                   f : (S.UP f \<star>\<^sub>S S.UP g) \<star>\<^sub>S
                       S.UP
                        f \<Rightarrow>\<^sub>S S.trg
           (S.UP f) \<star>\<^sub>S
          S.UP f\<guillemotright>
  \<guillemotleft>S.\<a>' (S.UP f) (S.UP g)
                   (S.UP
                     f) : S.UP f \<star>\<^sub>S
                          S.UP g \<star>\<^sub>S
                          S.UP
                           f \<Rightarrow>\<^sub>S (S.UP f \<star>\<^sub>S
              S.UP g) \<star>\<^sub>S
             S.UP f\<guillemotright>

goal (1 subgoal):
 1. (\<xi>' \<star>\<^sub>S S.UP f) \<cdot>\<^sub>S
    S.\<a>' (S.UP f) (S.UP g) (S.UP f) =
    \<xi>' \<star>\<^sub>S S.UP f


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a_ \<in> U; b_ \<in> U\<rbrakk>
    \<Longrightarrow> (b_ <\<^sub>o\<^sub>w a_) =
                      (a_ =
                       (if a_ \<le>\<^sub>o\<^sub>w b_ then b_
                        else a_) \<and>
                       a_ \<noteq> b_)


proof (prove)
using this:
  ?A \<in> carrier_mat ?n ?n \<Longrightarrow>
  \<exists>as.
     char_poly ?A = (\<Prod>a\<leftarrow>as. [:- a, 1:]) \<and>
     length as = ?n
  A \<in> carrier_mat n n

goal (1 subgoal):
 1. (\<And>es.
        char_poly A = (\<Prod>e\<leftarrow>es. [:- e, 1:]) \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<And>evs3 T1 Kas' Ta.
       \<lbrakk>A \<notin> bad; evs3 \<in> kerbIV;
        Says A Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace>
        \<in> set evs3;
        Says Kas' A
         (Crypt (shrK A)
           \<lbrace>Key authK, Agent Tgs, Number Ta, authTicket\<rbrace>)
        \<in> set evs3;
        valid Ta wrt T1; Key authK \<notin> analz (knows Spy evs3);
        authTicket \<in> parts (knows Spy evs3); T2 = CT evs3;
        Says A Tgs
         \<lbrace>authTicket,
           Crypt authK \<lbrace>Agent A, Number (CT evs3)\<rbrace>,
           Agent B\<rbrace>
        \<notin> set evs3;
        \<exists>B X.
           Says A Tgs
            \<lbrace>X,
              Crypt authK \<lbrace>Agent A, Number (CT evs3)\<rbrace>,
              Agent B\<rbrace>
           \<in> set evs3 \<or>
           Says A B
            \<lbrace>X,
              Crypt authK
               \<lbrace>Agent A, Number (CT evs3)\<rbrace>\<rbrace>
           \<in> set evs3\<rbrakk>
       \<Longrightarrow> False


proof (prove)
goal (1 subgoal):
 1. {s'. (s, s') \<in> E} \<subseteq> S


proof (prove)
using this:
  infer ?\<Gamma> P = Some ?\<tau> \<Longrightarrow>
  ?\<Gamma> \<turnstile> P : ?\<tau>
  infer \<Gamma> (Snd P) = Some \<tau>

goal (1 subgoal):
 1. \<Gamma> \<turnstile> Snd P : \<tau>


proof (prove)
goal (1 subgoal):
 1. \<And>ys clist.
       \<lbrakk>xs \<noteq> []; length clist = length xs;
        (xs, s) #
        ys \<propto> map (\<lambda>i. (fst i, s) # snd i) (zip xs clist);
        \<forall>i<length xs. (xs ! i, s) # clist ! i \<in> cptn\<rbrakk>
       \<Longrightarrow> (xs, s) # ys \<in> par_cptn


proof (prove)
goal (1 subgoal):
 1. rell_FGf L1' L2' x y


proof (prove)
using this:
  p \<in> carrier P
  ?p \<in> carrier P \<Longrightarrow> coeff P ?p ?n \<in> carrier R
  ?p \<in> carrier P \<Longrightarrow>
  \<ominus>\<^bsub>P\<^esub> ?p \<in> carrier P

goal (1 subgoal):
 1. coeff P (\<ominus>\<^bsub>P\<^esub> p) n =
    \<ominus> coeff P p n \<oplus>
    (coeff P p n \<oplus> coeff P (\<ominus>\<^bsub>P\<^esub> p) n)


proof (prove)
goal (1 subgoal):
 1. eval_fps (G1 * G2) (s - 1) = g s


proof (prove)
goal (1 subgoal):
 1. lookup (update_by_fun k f xs) k' =
    (if k = k' then f else id) (lookup xs k')


proof (prove)
goal (1 subgoal):
 1. (z \<noteq> 0 \<and> arg z = pi / 2) = (is_imag z \<and> 0 < Im z)


proof (state)
this:
  0 \<le> ?x \<Longrightarrow> ?x * A ?x - T ?x \<in> {0..c1 * ?x}

goal (4 subgoals):
 1. \<exists>c\<ge>0. \<forall>x\<ge>0. x * A x - T x \<in> {0..c * x}
 2. (\<lambda>x. A x - ln x) \<in> O(\<lambda>_. 1)
 3. \<exists>c>0. \<forall>x\<ge>1 / c. c * x \<le> S x
 4. S \<in> \<Theta>(\<lambda>x. x)


proof (prove)
goal (1 subgoal):
 1. delete_index n (x # xs) =
    (if n = 0 then xs else x # delete_index (n - 1) xs)


proof (prove)
goal (1 subgoal):
 1. divisor_count n = divisor_sigma 0 n


proof (prove)
goal (1 subgoal):
 1. P \<turnstile> \<langle>C\<bullet>\<^sub>sM(map Val vs),
                    (h\<^sub>1, l\<^sub>1, sh\<^sub>1),
                    False\<rangle> \<rightarrow>
                   \<langle>INIT D ([D],False) \<leftarrow> C\<bullet>\<^sub>sM(map
     Val vs),
                    (h\<^sub>1, l\<^sub>1, sh\<^sub>1),False\<rangle>


proof (prove)
using this:
  S \<subseteq> {0..card Y}
  \<lbrakk>?A \<subseteq> ?B; finite ?B\<rbrakk> \<Longrightarrow> finite ?A

goal (1 subgoal):
 1. finite S


proof (prove)
goal (2 subgoals):
 1. rs, \<Gamma>\<^sub>1 \<turnstile>\<^sub>v Sconst name \<down> ?v\<^sub>1
 2. \<turnstile>\<^sub>v ?v\<^sub>1 \<approx> val\<^sub>2


proof (prove)
using this:
  a \<otimes> b \<otimes> c =
  \<^bold>g [^] n \<otimes> \<^bold>g [^] k \<otimes> \<^bold>g [^] j

goal (1 subgoal):
 1. \<^bold>g [^] n \<otimes> \<^bold>g [^] k \<otimes> \<^bold>g [^] j =
    \<^bold>g [^] (n + (k + j))


proof (prove)
goal (1 subgoal):
 1. local.iso (Left_a.lunit a') \<and>
    \<guillemotleft>Left_a.lunit
                     a' : a \<star> a' \<rightarrow> a'\<guillemotright>


proof (prove)
goal (1 subgoal):
 1. Ball (Set_Monad xs) P = list_all P xs &&&
    Ball (DList_set dxs) P' =
    (case ID CEQ('b) of
     None \<Rightarrow>
       Code.abort STR ''Ball DList_set: ceq = None''
        (\<lambda>_. Ball (DList_set dxs) P')
     | Some x \<Rightarrow> DList_Set.dlist_all P' dxs) &&&
    Ball (RBT_set rbt) P'' =
    (case ID ccompare of
     None \<Rightarrow>
       Code.abort STR ''Ball RBT_set: ccompare = None''
        (\<lambda>_. Ball (RBT_set rbt) P'')
     | Some x \<Rightarrow> RBT_Set2.all P'' rbt)


proof (prove)
using this:
  x \<in> {x. A *v x = b}
  A *v p = b

goal (1 subgoal):
 1. A *v x - A *v p = 0


proof (prove)
goal (1 subgoal):
 1. (\<parallel>factor\<parallel>\<^sup>2 *
     \<parallel>local.g\<parallel>\<^sup>2) ^
    j'
    \<le> (\<parallel>factor\<parallel>\<^sup>2 *
           (2 ^ j' * \<parallel>factor\<parallel>\<^sup>2)) ^
          j'


proof (prove)
goal (1 subgoal):
 1. \<Union> \<F>
    \<subseteq> \<Union>
                 {S \<in> \<B>.
                  \<exists>U. U \<in> \<F> \<and> S \<subseteq> U}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>wf_graph \<lparr>nodes = N, edges = E\<rparr>;
     E' \<subseteq> E\<rbrakk>
    \<Longrightarrow> num_reachable_norefl
                       \<lparr>nodes = N, edges = E'\<rparr> v
                      \<le> num_reachable_norefl
                             \<lparr>nodes = N, edges = E\<rparr> v


proof (prove)
goal (1 subgoal):
 1. prob_space (exponential (escape_rate s))


proof (prove)
goal (1 subgoal):
 1. natural_transformation C'.VV.comp (\<cdot>\<^sub>D)
     H\<^sub>D\<^sub>'oFF.map FoH\<^sub>C\<^sub>'.map cmp


proof (prove)
goal (1 subgoal):
 1. inf x_ y_ \<le> x_


proof (prove)
using this:
  fv (\<Gamma>, scrut, Alts e\<^sub>1 e\<^sub>2 # S)
  \<subseteq> set L \<union> domA \<Gamma>
  fv (\<Gamma>, scrut)
  \<subseteq> set L \<union> domA \<Gamma> \<Longrightarrow>
  fv (\<Delta>, Bool b) \<subseteq> set L \<union> domA \<Delta>
  domA \<Gamma> \<subseteq> domA \<Delta>

goal (1 subgoal):
 1. fv (\<Delta>, if b then e\<^sub>1 else e\<^sub>2, S)
    \<subseteq> set L \<union> domA \<Delta>


proof (prove)
using this:
  prob_space N \<and>
  (\<forall>asset\<in>stocks Mkt.
      Filtration.filtration N F \<and>
      (\<forall>t.
          integrable N (discounted_value r (prices Mkt asset) t)) \<and>
      borel_adapt_stoch_proc F
       (discounted_value r (prices Mkt asset)) \<and>
      (\<forall>t s.
          t \<le> s \<longrightarrow>
          AEeq N
           (real_cond_exp N (F t) (discounted_value r (prices Mkt asset) s))
           (discounted_value r (prices Mkt asset) t)))
  trading_strategy pf
  space M = space N \<and> events \<subseteq> sets N
  support_set pf \<subseteq> stocks Mkt
  \<forall>n.
     \<forall>asset\<in>support_set pf.
        integrable N
         (\<lambda>w. prices Mkt asset (Suc n) w * pf asset (Suc n) w)

goal (1 subgoal):
 1. \<forall>n. sigma_finite_subalgebra N (F n)


proof (prove)
goal (1 subgoal):
 1. (sign l\<^sub>1 \<noteq> sign l\<^sub>2 \<and>
     get_pred l\<^sub>1 = get_pred l\<^sub>2 \<and>
     get_terms l\<^sub>1 = get_terms l\<^sub>2) =
    (l\<^sub>2 = l\<^sub>1\<^sup>c)


proof (prove)
goal (1 subgoal):
 1. (\<Sum>i = 0..<dim_vec w. u $ i * w $ i)
    \<le> (\<Sum>i = 0..<dim_vec w. u $ i * v $ i)


proof (state)
goal (1 subgoal):
 1. hindered \<Gamma>


proof (prove)
using this:
  ?y \<in> set_spmf p \<Longrightarrow> spmf (f ?y) x \<le> r
  0 \<le> r
  emeasure (measure_spmf ?p) (space (measure_spmf ?p)) \<le> 1

goal (1 subgoal):
 1. \<integral>\<^sup>+ x. ennreal r \<partial>measure_spmf p
    \<le> ennreal r


proof (prove)
goal (1 subgoal):
 1. l = liminf (\<lambda>n. ereal (f n / f (Suc n) - 1)) + 1


proof (prove)
goal (1 subgoal):
 1. local.iso f


proof (prove)
goal (1 subgoal):
 1. f ` carrier G \<inter> kernel H K g = {\<one>\<^bsub>H\<^esub>} &&&
    f ` carrier G <#>\<^bsub>H\<^esub> kernel H K g = carrier H


proof (prove)
goal (1 subgoal):
 1. mutex x y \<Longrightarrow> gval (gAnd y x) s \<noteq> true


proof (prove)
goal (1 subgoal):
 1. (out \<in> outs'_rpv rpv) =
    (\<exists>input. out \<in> outs'_gpv (rpv input))


proof (prove)
using this:
  a \<in> carrier R
  a \<noteq> \<zero>
  f = monom P a n
  g \<in> carrier P
  a \<otimes> g (deg R g) [^] n \<noteq> \<zero>

goal (1 subgoal):
 1. to_polynomial R a (deg R (to_polynomial R a)) \<otimes>
    (g [^]\<^bsub>P\<^esub> n) (deg R (g [^]\<^bsub>P\<^esub> n)) \<noteq>
    \<zero>


proof (prove)
using this:
  prv (neg (neg (PP \<langle>\<phi>G\<rangle>)))
  \<lbrakk>?\<phi> \<in> fmla; Fvars ?\<phi> = {};
   prv (neg (neg (PP \<langle>?\<phi>\<rangle>)))\<rbrakk>
  \<Longrightarrow> prv (PP \<langle>?\<phi>\<rangle>)

goal (1 subgoal):
 1. prv (PP \<langle>\<phi>G\<rangle>)


proof (prove)
using this:
  \<not> \<U> s
  min_lvar_not_in_bounds s = Some x\<^sub>i
  \<lhd>\<^sub>l\<^sub>b
   (lt (if \<langle>\<V> s\<rangle> x\<^sub>i <\<^sub>l\<^sub>b
           \<B>\<^sub>l s x\<^sub>i
        then Positive else Negative))
   (\<langle>\<V> s\<rangle> x\<^sub>i)
   (LB (if \<langle>\<V> s\<rangle> x\<^sub>i <\<^sub>l\<^sub>b
           \<B>\<^sub>l s x\<^sub>i
        then Positive else Negative)
     s x\<^sub>i)

goal (2 subgoals):
 1. \<And>I.
       \<lbrakk>min_rvar_incdec
                 (if \<langle>\<V> s\<rangle> x\<^sub>i <\<^sub>l\<^sub>b
                     \<B>\<^sub>l s x\<^sub>i
                  then Positive else Negative)
                 s x\<^sub>i =
                Inl I;
        check'
         (if \<langle>\<V> s\<rangle> x\<^sub>i <\<^sub>l\<^sub>b
             \<B>\<^sub>l s x\<^sub>i
          then Positive else Negative)
         x\<^sub>i s =
        set_unsat I s\<rbrakk>
       \<Longrightarrow> P (check (set_unsat I s))
 2. \<And>x\<^sub>j l\<^sub>i.
       \<lbrakk>min_rvar_incdec
                 (if \<langle>\<V> s\<rangle> x\<^sub>i <\<^sub>l\<^sub>b
                     \<B>\<^sub>l s x\<^sub>i
                  then Positive else Negative)
                 s x\<^sub>i =
                Inr x\<^sub>j;
        l\<^sub>i =
        the (LB (if \<langle>\<V> s\<rangle> x\<^sub>i <\<^sub>l\<^sub>b
                    \<B>\<^sub>l s x\<^sub>i
                 then Positive else Negative)
              s x\<^sub>i);
        check'
         (if \<langle>\<V> s\<rangle> x\<^sub>i <\<^sub>l\<^sub>b
             \<B>\<^sub>l s x\<^sub>i
          then Positive else Negative)
         x\<^sub>i s =
        pivot_and_update x\<^sub>i x\<^sub>j l\<^sub>i s\<rbrakk>
       \<Longrightarrow> P (check
                             (pivot_and_update x\<^sub>i x\<^sub>j l\<^sub>i
                               s))


proof (prove)
goal (1 subgoal):
 1. Bernstein_changes_01 p P =
    changes (coeffs (reciprocal_poly p P \<circ>\<^sub>p [:1, 1:]))


proof (chain)
picking this:
  \<lbrakk> u \<longrightarrow>\<^sub>\<beta> ?u';
   ?u' \<in> RED \<tau>\<rbrakk>
  \<Longrightarrow> App t ?u' \<in> RED \<sigma>
  u' \<in> RED \<tau>


proof (state)
this:
  0 = (b1 - B1) * x1 + (b2 - B2) * y1 + c - C

goal (1 subgoal):
 1. (x, y) = (x1, y1) \<or> (x, y) = (x2, y2)


proof (prove)
using this:
  - (1::'a) \<noteq> (0::'a) \<Longrightarrow>
  poly_roots (Polynomial.smult (- (1::'a)) p) = poly_roots p

goal (1 subgoal):
 1. poly_roots (- p) = poly_roots p


proof (prove)
goal (1 subgoal):
 1. EVAL (E.Src (Dom a)) =
    EVAL \<^bold>\<langle>Map a\<^bold>\<rangle>\<^sub>0


proof (prove)
using this:
  f \<in> A \<rightarrow>\<^sub>E B
  (\<lambda>x. f' (inv p\<^sub>A x)) \<in> A \<rightarrow>\<^sub>E B
  finite B
  \<lbrakk>f \<in> A \<rightarrow>\<^sub>E B;
   (\<lambda>x. f' (inv p\<^sub>A x)) \<in> A \<rightarrow>\<^sub>E B;
   finite B\<rbrakk>
  \<Longrightarrow> \<exists>p.
                       p permutes B \<and>
                       (\<forall>x\<in>A. f x = p (f' (inv p\<^sub>A x)))

goal (1 subgoal):
 1. (\<And>p\<^sub>B.
        \<lbrakk>p\<^sub>B permutes B;
         \<forall>x\<in>A. f x = p\<^sub>B (f' (inv p\<^sub>A x))\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. f (g x) i) \<in> L \<rightarrow>\<^sub>M M i


proof (prove)
goal (1 subgoal):
 1. x ^ o * \<bottom> \<squnion> (1::'a) = x ^ o


proof (state)
this:
  0 < r

goal (1 subgoal):
 1. \<And>r.
       0 < r \<Longrightarrow>
       \<exists>k.
          \<forall>n\<ge>k. \<bar>inverse (X n) - inverse (Y n)\<bar> < r


proof (prove)
using this:
  A.ide a
  A.ide ?x \<Longrightarrow>
  transformation_by_components.map (\<cdot>\<^sub>A) (\<cdot>\<^sub>A)
   FG.map \<epsilon>o ?x =
  F (G ?x)
  \<epsilon> \<equiv>
  transformation_by_components.map (\<cdot>\<^sub>A) (\<cdot>\<^sub>A)
   FG.map \<epsilon>o

goal (1 subgoal):
 1. \<epsilon> a = FG.map a


proof (prove)
goal (1 subgoal):
 1. param_opt i t e = None \<Longrightarrow>
    \<exists>y. lowest_tops [i, t, e] = Some y


proof (prove)
using this:
  a = SK_EV_SIGNAL x31_ x32_

goal (1 subgoal):
 1. atomic_step_invariant
     (case a of
      SK_IPC dir stage partner page \<Rightarrow>
        atomic_step_ipc (current s) dir stage partner page s
      | SK_EV_WAIT EV_FINISH EV_CONSUME_ALL \<Rightarrow>
          atomic_step_ev_wait_all (current s) s
      | SK_EV_WAIT EV_FINISH EV_CONSUME_ONE \<Rightarrow>
          atomic_step_ev_wait_one (current s) s
      | SK_EV_WAIT _ consume \<Rightarrow> s
      | SK_EV_SIGNAL EV_SIGNAL_PREP partner \<Rightarrow> s
      | SK_EV_SIGNAL EV_SIGNAL_FINISH partner \<Rightarrow>
          atomic_step_ev_signal (current s) partner s
      | NONE \<Rightarrow> s)


proof (prove)
goal (1 subgoal):
 1. (\<langle>\<rangle> = map_tree f t) = (t = \<langle>\<rangle>)


proof (prove)
goal (1 subgoal):
 1. for_rec3 f a n n n n =
    nfoldli [0..<n + 1] (\<lambda>x. True)
     (\<lambda>k.
         nfoldli [0..<n + 1] (\<lambda>x. True)
          (\<lambda>i.
              nfoldli [0..<n + 1] (\<lambda>x. True)
               (\<lambda>j a. f a k i j)))
     a


proof (chain)
picking this:
  x = \<langle>x1, x2\<rangle>


proof (prove)
goal (1 subgoal):
 1. isolate_variable_sparse p x (i + 1) \<noteq> 0 \<longrightarrow>
    MPoly_Type.degree (f i) x = i


proof (prove)
goal (1 subgoal):
 1. move =
    filter (\<lambda>(t, X). left I \<le> nt - t) (linearize data_prev)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>type_wf h; document_ptr |\<in>| document_ptr_kinds h\<rbrakk>
    \<Longrightarrow> h \<turnstile> ok get_disconnected_nodes document_ptr


proof (state)
this:
  N' = fmdrop C N

goal (1 subgoal):
 1. ran_m (fmupd C C' N) =
    add_mset C' (remove1_mset (the (fmlookup N C)) (ran_m N))


proof (prove)
goal (1 subgoal):
 1. Group.group (G \<times>\<times> H)


proof (state)
goal (1 subgoal):
 1. similar M1 M3


proof (prove)
goal (1 subgoal):
 1. r \<in> field_char_0.Rats (/) (1::'a) (+) (0::'a) (-) \<Longrightarrow>
    \<exists>n.
       r =
       field_char_0.of_rat (/) (1::'a) (+) (0::'a) (-) (nat_to_rat_surj n)


proof (prove)
goal (1 subgoal):
 1. arity (generalize_fundef fd2) = arity fd2


proof (prove)
goal (2 subgoals):
 1. \<And>h2.
       \<lbrakk>h2 \<Turnstile> F; hn_invalid (list_assn P) [] [] = true;
        p = []; p' = []\<rbrakk>
       \<Longrightarrow> hn_refine F f1' \<Gamma>' R f1
 2. \<And>h2 a list aa lista.
       \<lbrakk>h2 \<Turnstile> F;
        hn_invalid (list_assn P) (a # list) (aa # lista) = true;
        p = a # list; p' = aa # lista\<rbrakk>
       \<Longrightarrow> hn_refine
                          (hn_ctxt P a aa *
                           hn_ctxt (list_assn P) list lista *
                           F)
                          (f2' aa lista)
                          (hn_ctxt P' a aa *
                           hn_ctxt (list_assn P') list lista *
                           \<Gamma>')
                          R (f2 a list)


proof (prove)
goal (1 subgoal):
 1. oracle_flag key = eval_oracle key ()


proof (prove)
goal (1 subgoal):
 1. P (sum_case f g a) =
    (\<not> ((\<exists>x.
                 a = ZFC_Cardinals.Inl x \<and> \<not> P (f x)) \<or>
             (\<exists>y.
                 a = ZFC_Cardinals.Inr y \<and> \<not> P (g y)) \<or>
             \<not> is_sum a \<and> \<not> P undefined))


proof (prove)
using this:
  Suc 0 < f (Suc 0)
  mono f

goal (1 subgoal):
 1. \<And>i. Suc 0 < f (Suc i)


proof (prove)
using this:
  h \<turnstile> attach_shadow_root element_ptr shadow_root_mode
  \<rightarrow>\<^sub>r new_shadow_root_ptr
  h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M
  \<rightarrow>\<^sub>h h2
  \<lbrakk>?h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M
           \<rightarrow>\<^sub>h ?h';
   ?h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M
   \<rightarrow>\<^sub>r ?new_shadow_root_ptr\<rbrakk>
  \<Longrightarrow> object_ptr_kinds ?h' =
                    object_ptr_kinds ?h |\<union>|
                    {|cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r
                       ?new_shadow_root_ptr|}
  h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M
  \<rightarrow>\<^sub>r new_shadow_root_ptr
  h \<turnstile> attach_shadow_root element_ptr shadow_root_mode
  \<rightarrow>\<^sub>r result

goal (1 subgoal):
 1. object_ptr_kinds h2 =
    {|cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r
       result|} |\<union>|
    object_ptr_kinds h


proof (prove)
goal (1 subgoal):
 1. (\<And>c.
        singular_chain p
         (subtopology (powertop_real UNIV) (standard_simplex p))
         c \<Longrightarrow>
        chain_boundary p (chain_map p f c) =
        chain_map (p - Suc 0) f (chain_boundary p c)) \<Longrightarrow>
    singular_subdivision (p - Suc 0)
     (chain_map (p - Suc 0) f
       (chain_boundary p (frag_of (restrict id (standard_simplex p))))) =
    frag_extend
     (\<lambda>f.
         chain_map (p - Suc 0) f
          (simplicial_subdivision (p - Suc 0)
            (frag_of (restrict id (standard_simplex (p - Suc 0))))))
     (chain_boundary p (frag_of f))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>countable A; inj f\<rbrakk>
    \<Longrightarrow> countable {x. f x \<in> A}


proof (state)
this:
  dim_row C = n

goal (1 subgoal):
 1. jordan_nf A (triangular_to_jnf_vector A)


proof (prove)
goal (1 subgoal):
 1. \<And>n f s.
       \<lbrakk>ideal R A; H \<subseteq> carrier M; r \<in> carrier R;
        H \<noteq> {}; f \<in> {j. j \<le> n} \<rightarrow> H;
        s \<in> {j. j \<le> n} \<rightarrow> A;
        x =
        \<Sigma>\<^sub>e M (\<lambda>j. s j \<cdot>\<^sub>s f j) n\<rbrakk>
       \<Longrightarrow> \<exists>na.
                            \<exists>fa\<in>{j. j \<le> na} \<rightarrow> H.
                               \<exists>sa
  \<in>{j. j \<le> na} \<rightarrow> A.
                                  r \<cdot>\<^sub>s
                                  \<Sigma>\<^sub>e M (\<lambda>j.
                   s j \<cdot>\<^sub>s f j) n =
                                  \<Sigma>\<^sub>e M (\<lambda>j.
                   sa j \<cdot>\<^sub>s fa j) na


proof (prove)
using this:
  P \<turnstile> \<langle>blocks
                           (this # pns, Class D # Ts, Addr a # vs, body),
                  s\<rangle> \<Rightarrow>
                 \<langle>e',s'\<rangle>
  fv body \<subseteq> {this} \<union> set pns
  s = (h\<^sub>2, l\<^sub>2)
  s' = (h\<^sub>3, l\<^sub>3)
  length Ts = length pns
  length vs = length pns

goal (1 subgoal):
 1. l\<^sub>3 = l\<^sub>2


proof (prove)
goal (1 subgoal):
 1. (i < DIM('a) \<Longrightarrow>
     isDERIV i fa (list_of_eucl x @ params)) &&&
    interpret_floatarith fa (list_of_eucl x @ params) \<notin> \<int>


proof (prove)
goal (1 subgoal):
 1. l \<le> u \<Longrightarrow>
    (Abstract_Rigorous_Numerics.cfuncset l u X = {}) = (X = {})


proof (prove)
goal (1 subgoal):
 1. lex_ord_pair ko f (sort_oalist_aux ko xs) (sort_oalist_aux ko ys) =
    Some Eq


proof (prove)
goal (1 subgoal):
 1. M = N


proof (prove)
using this:
  evaluate True ?env ?st ?e ?r = (?r = eval ?env ?e ?st)
  evaluate_list True ?env ?st ?es ?r' = (?r' = eval_list ?env ?es ?st)
  evaluate_match True ?env ?st ?v ?pes ?v' ?r =
  (?r = eval_match ?env ?v ?pes ?v' ?st)
  evaluate True ?env ?st ?e ?r = (?r = eval' ?env ?e ?st)
  evaluate_list True ?env ?st ?es ?r' = (?r' = eval_list' ?env ?es ?st)
  evaluate_match True ?env ?st ?v ?pes ?v' ?r =
  (?r = eval_match' ?env ?v ?pes ?v' ?st)

goal (1 subgoal):
 1. \<And>x xa xb. eval' x xa xb = eval x xa xb


proof (prove)
goal (1 subgoal):
 1. (\<Sum>(term, i)\<leftarrow>a. insertion f term * f v ^ i) = 0


proof (prove)
goal (1 subgoal):
 1. content (ball c r) = unit_ball_vol (real DIM('a)) * r ^ DIM('a)


proof (prove)
using this:
  At = LeqUni p
  \<forall>x.
     aEvalUni (LeqUni p) x = aEvalUni (EqUni p) x \<or>
     aEvalUni (LessUni p) x
  aEvalUni (LessUni (?a, ?b, ?c)) ?x = (?a * ?x\<^sup>2 + ?b * ?x + ?c < 0)
  aEvalUni (LeqUni (?a, ?b, ?c)) ?x =
  (?a * ?x\<^sup>2 + ?b * ?x + ?c \<le> 0)
  p = (a__, b__, c__)
  (?x \<le> ?y) = (?x < ?y \<or> ?x = ?y)

goal (1 subgoal):
 1. (\<exists>y'>(A + B * sqrt C) / D.
        \<forall>x\<in>{(A + B * sqrt C) / D<..y'}. aEvalUni At x) =
    (\<exists>y'>(A + B * sqrt C) / D.
        \<forall>x\<in>{(A + B * sqrt C) / D<..y'}.
           aEvalUni (EqUni p) x \<or> aEvalUni (LessUni p) x)


proof (prove)
using this:
  p \<in># prime_factorization N
  x \<in># prime_factorization (of_nat p)
  prime_factors (of_nat p) = {of_nat p}

goal (1 subgoal):
 1. thesis


proof (prove)
goal (1 subgoal):
 1. Sigma_Algebra.measure M {..x} \<le> Sigma_Algebra.measure M (space M)


proof (prove)
goal (1 subgoal):
 1. A * Ba + B * Aa < A * B + Aa * Ba


proof (prove)
using this:
  Per A' B' C' \<and> A B C LtA A' B' C'
  Acute ?A ?B ?C \<Longrightarrow> ?A \<noteq> ?B \<and> ?C \<noteq> ?B
  \<lbrakk>Acute ?A ?B ?C; ?D \<noteq> ?E; ?E \<noteq> ?F;
   Per ?D ?E ?F\<rbrakk>
  \<Longrightarrow> ?A ?B ?C LtA ?D ?E ?F
  Acute A B C
  \<not> ?A ?B ?C LtA ?A ?B ?C

goal (1 subgoal):
 1. \<not> Per A B C


proof (state)
this:
  on_triple f `` E \<subseteq> edges (S (max i j))
  f `` V \<subseteq> vertices (S (max i j))

goal (1 subgoal):
 1. \<exists>i. graph_homomorphism (LG E V) (S i) f


proof (prove)
goal (1 subgoal):
 1. Cong A Q' X' P'


proof (prove)
goal (1 subgoal):
 1. update_field_1 (\<lambda>_. y) (make_foo a b) = make_foo y b


proof (prove)
using this:
  t \<longmapsto> t'
  \<Gamma> \<turnstile> t : T

goal (1 subgoal):
 1. \<Gamma> \<turnstile> t' : T


proof (prove)
goal (1 subgoal):
 1. interaction_bound consider (gpv_stop gpv) =
    interaction_bound consider gpv


proof (prove)
goal (3 subgoals):
 1. \<And>x y xa.
       x < y \<Longrightarrow>
       uniformly_continuous_on (?s3 x y xa) (cts_step x y)
 2. \<And>x y xa. x < y \<Longrightarrow> xa \<in> interior (?s3 x y xa)
 3. \<And>x y xa.
       x < y \<Longrightarrow> \<bar>cts_step x y xa\<bar> \<le> 1


proof (prove)
goal (1 subgoal):
 1. redundant g = redundant_code g