proof (prove)
using this:
  isInBar (xs, s)
  wls s X
  wlsSEM SEM
  wlsSEM SEM \<Longrightarrow>
  termFSwSbImorph (semInt SEM) (semIntAbs SEM) (asIMOD SEM)

goal (1 subgoal):
 1. semIntAbs SEM (Abs xs x X) = igAbs (asIMOD SEM) xs x (semInt SEM X)


proof (prove)
using this:
  C.ide a'
  \<iota> \<chi>' \<in> Cones.SET a'
  C.ide ?a \<Longrightarrow> Cones.map ?a = S.mkIde (\<iota> ` D.cones ?a)
  Cop.in_hom a' a' a' \<Longrightarrow>
  \<guillemotleft>\<Psi>.map
                   a' : Cones.map
                         a' \<rightarrow>\<^sub>S Y a a'\<guillemotright>

goal (1 subgoal):
 1. \<Phi>.FUN a' (\<Psi>.FUN a' (\<iota> \<chi>')) =
    compose (\<Psi>.DOM a') (\<Phi>.FUN a') (\<Psi>.FUN a')
     (\<iota> \<chi>')


proof (state)
goal (1 subgoal):
 1. wa_precise_refine WC WA (\<alpha>2 \<circ> \<alpha>1)


proof (prove)
using this:
  \<nexists>x y z.
     x \<noteq> y \<and>
     x \<noteq> z \<and>
     y \<noteq> z \<and> x \<in> A \<and> y \<in> A \<and> z \<in> A

goal (1 subgoal):
 1. card A = 2


proof (prove)
goal (1 subgoal):
 1. pathVertices u p = u # map snd p


proof (state)
this:
  qi \<in> s
  qi \<in> Qi

goal (2 subgoals):
 1. \<And>x q.
       \<lbrakk>q \<subseteq> Q \<and> q \<inter> Qi \<noteq> {};
        accs \<delta>ss x q\<rbrakk>
       \<Longrightarrow> \<exists>q\<in>Qi. accs \<delta> x q
 2. \<And>x q.
       \<lbrakk>q \<in> Qi; accs \<delta> x q\<rbrakk>
       \<Longrightarrow> \<exists>xa\<subseteq>Q.
                            xa \<inter> Qi \<noteq> {} \<and>
                            accs \<delta>ss x xa


proof (prove)
using this:
  indicator {x \<in> space St. P x}
  \<in> borel_measurable St \<Longrightarrow>
  E_inf s (indicator {x \<in> space St. P x}) =
  (\<Sqinter>D\<in>K s.
      \<integral>\<^sup>+ t. E_inf t
                              (\<lambda>\<omega>.
                                  indicator {x \<in> space St. P x}
                                   (t ## \<omega>))
                         \<partial>measure_pmf D)

goal (1 subgoal):
 1. P_inf s P =
    (\<Sqinter>D\<in>K s.
        \<integral>\<^sup>+ t. P_inf t
                                (\<lambda>\<omega>. P (t ## \<omega>))
                           \<partial>measure_pmf D)


proof (prove)
goal (1 subgoal):
 1. S homeomorphic T \<Longrightarrow> locally compact S = locally compact T


proof (prove)
using this:
  distinct (map fst xs)
  fst x \<notin> set (map fst xs)

goal (1 subgoal):
 1. distinct (map fst (xs @ [x]))


proof (prove)
using this:
  p \<in> carrier P
  q \<in> carrier P
  deg R q < n
  P \<equiv> UP R
  \<lbrakk>UP_ring ?R; deg ?R ?p < ?m; ?p \<in> carrier (UP ?R)\<rbrakk>
  \<Longrightarrow> coeff (UP ?R) ?p ?m = \<zero>\<^bsub>?R\<^esub>
  UP_ring R
  \<lbrakk>?p \<in> carrier P; ?q \<in> carrier P\<rbrakk>
  \<Longrightarrow> (?p \<oplus>\<^bsub>P\<^esub> ?q) ?n =
                    ?p ?n \<oplus> ?q ?n
  ?f \<in> carrier P \<Longrightarrow> coeff (UP R) ?f = ?f
  ?f \<in> carrier P \<Longrightarrow> ?f ?n \<in> carrier R
  \<lbrakk>deg R ?p < ?m; ?p \<in> carrier P\<rbrakk>
  \<Longrightarrow> coeff P ?p ?m = \<zero>

goal (1 subgoal):
 1. (p \<oplus>\<^bsub>P\<^esub> q) n = p n


proof (prove)
goal (1 subgoal):
 1. degree (nlex_pdevs x) = degree x


proof (prove)
goal (1 subgoal):
 1. tarski_absolute real_hyp2_C real_hyp2_B


proof (prove)
goal (1 subgoal):
 1. G,A\<turnstile>{Normal
                     ((\<lambda>Y' s' s. s' = s \<and> fst s = None) \<and>.
                      G\<turnstile>init\<le>n \<and>.
                      (\<lambda>s. s\<Colon>\<preceq>(G, L)) \<and>.
                      (\<lambda>s.
                          \<lparr>prg = G, cls = accC,
                             lcl =
                               L\<rparr>\<turnstile> dom
                (locals
                  (snd s)) \<guillemotright>In1r
       (c1 Finally c2)\<guillemotright> C))}
    .c1 Finally c2.
    {\<lambda>Y s' s.
        Y = \<diamondsuit> \<and>
        G\<turnstile>s \<midarrow>c1 Finally c2\<rightarrow> s'}


proof (prove)
using this:
  x \<in> carrier
           \<lparr>carrier =
                     Pi I (carrier \<circ> (f \<circ> Gs)) \<inter>
                     {f. \<forall>x.
                            x \<notin> I \<longrightarrow> f x = undefined},
              monoid.mult =
                \<lambda>x y.
                   \<lambda>i\<in>I.
                      x i \<otimes>\<^bsub>(f \<circ> Gs) i\<^esub> y i,
              one =
                \<lambda>i\<in>I.
                   \<one>\<^bsub>(f \<circ> Gs) i\<^esub>\<rparr>
  i \<notin> I

goal (1 subgoal):
 1. (if i \<in> I then J i else (\<lambda>_. undefined)) (K i (x i)) = x i


proof (prove)
using this:
  \<lbrakk>\<And>\<rho>.
              \<rho> \<in> carrier_mat d d \<and>
              partial_density_operator \<rho> \<Longrightarrow>
              partial_density_operator (?DS \<rho>);
   \<And>\<rho>.
      \<rho> \<in> carrier_mat d d \<and>
      partial_density_operator \<rho> \<Longrightarrow>
      ?DS \<rho> \<in> carrier_mat d d\<rbrakk>
  \<Longrightarrow> partial_density_operator
                     (denote_while_n_iter ?M0.0 M1 ?DS ?n \<rho>)
  \<lbrakk>?\<rho> \<in> carrier_mat d d;
   partial_density_operator ?\<rho>\<rbrakk>
  \<Longrightarrow> DS ?\<rho> \<in> carrier_mat d d \<and>
                    partial_density_operator (DS ?\<rho>)
  M0 \<in> carrier_mat d d
  M1 \<in> carrier_mat d d

goal (1 subgoal):
 1. partial_density_operator (denote_while_n_iter M0 M1 DS k \<rho>)


proof (prove)
using this:
  ennreal (pmf p x) = 1

goal (1 subgoal):
 1. pmf p i = pmf (return_pmf x) i


proof (prove)
goal (1 subgoal):
 1. enat n < llength (ltl xs) \<Longrightarrow> enat (Suc n) < llength xs


proof (prove)
using this:
  n = 0
  natToVertexList v f es ! n = Some v'
  nths (take (Suc (es ! (n - Suc 0))) (verticesFrom f v))
   (set (take n es)) =
  removeNones (take n (natToVertexList v f es))
  distinct (vertices f)
  v \<in> \<V> f
  vs = verticesFrom f v
  incrIndexList es |es| |verticesFrom f v|
  Suc n \<le> |es|
  |vs| = |vertices f|
  nths (verticesFrom f v) {0} = [v]
  vs \<noteq> []
  es ! 0 = 0

goal (1 subgoal):
 1. nths (take (Suc (es ! (Suc n - 1))) vs) (set (take (Suc n) es)) =
    removeNones (take (Suc n) (natToVertexList v f es))


proof (state)
this:
  i = 0

goal (1 subgoal):
 1. i = 0 \<Longrightarrow> False


proof (prove)
goal (1 subgoal):
 1. higher_differentiable_on S (\<lambda>x. (f x, g x)) n


proof (prove)
goal (1 subgoal):
 1. \<And>x y.
       \<lbrakk>Idomain R; PolynRg A B Y; h \<in> rHom S B; Ring S;
        Subring R S; Idomain S; Subring A B; Ring A; Ring B; aGroup R;
        aGroup A; x \<in> carrier R; y \<in> carrier R\<rbrakk>
       \<Longrightarrow> erH R S X A B Y h (x \<cdot>\<^sub>r y) =
                         erH R S X A B Y h
                          x \<cdot>\<^sub>r\<^bsub>A\<^esub>
                         erH R S X A B Y h y


proof (prove)
using this:
  f \<in> F
  F \<subseteq> FINFUNC
  x0 \<in> {f z |f. f \<in> F \<and> z = s.maxim (SUPP f)} \<and>
  (\<forall>a\<in>{f z |f. f \<in> F \<and> z = s.maxim (SUPP f)}.
      (x0, a) \<in> r)
  s.maxim (SUPP f) = z \<and> f z = x0
  (f0(z := r.zero, z := x0), f(z := r.zero, z := x0)) \<in> oexp

goal (1 subgoal):
 1. (f(z := x0), f) \<in> oexp


proof (prove)
goal (1 subgoal):
 1. M *v axis i 1 = f i - x0


proof (state)
this:
  True

goal (1 subgoal):
 1. (\<And>f.
        \<lbrakk>orthogonal_transformation f; det (matrix f) = 1;
         f a = b\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>bst_wrt (\<le>) t; Splay_Heap.partition p t = (l', r')\<rbrakk>
    \<Longrightarrow> set_tree t = set_tree l' \<union> set_tree r'


proof (prove)
goal (1 subgoal):
 1. dens_ctxt_\<alpha> (vs, vs', \<Gamma>, \<delta>) \<turnstile>\<^sub>d
     e \<Rightarrow>
     (\<lambda>\<rho> x. ennreal (eval_cexpr f \<rho> x)) &&&
    is_density_expr (vs, vs', \<Gamma>, \<delta>) REAL f


proof (prove)
using this:
  convergent (\<lambda>n. sum f {..<n}) =
  convergent (\<lambda>n. C + sum g {..<n})

goal (1 subgoal):
 1. summable f = summable g


proof (prove)
goal (1 subgoal):
 1. (if a \<le> b \<and> p \<noteq> 0
     then sign_changes (sturm_squarefree p) a -
          sign_changes (sturm_squarefree p) b
     else 0) =
    card {x. a < x \<and> x \<le> b \<and> poly p' x = 0}


proof (prove)
goal (1 subgoal):
 1. fcard A - fcard B \<le> fcard (A |-| B)


proof (prove)
goal (1 subgoal):
 1. \<And>a b aa ba.
       \<lbrakk>P \<turnstile> \<langle>e,s\<rangle> \<rightarrow>*
                               \<langle>a,b\<rangle>;
        P \<turnstile> \<langle>a,b\<rangle> \<rightarrow>
                       \<langle>aa,ba\<rangle>\<rbrakk>
       \<Longrightarrow> P \<turnstile> \<langle>V:=a,
   b\<rangle> \<rightarrow>
  \<langle>V:=aa,ba\<rangle>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>infinite C; |A| \<le>o |C|; |B| \<le>o |C|\<rbrakk>
    \<Longrightarrow> |A \<times> B| \<le>o |C|


proof (prove)
using this:
  t2 \<in> keys
            (punit.monom_mult (1::'a) (l - i.lpp (focus X h))
              (flatten (i.punit.tail (focus X h))))

goal (1 subgoal):
 1. (\<And>t3.
        \<lbrakk>t3 \<in> keys (flatten (i.punit.tail (focus X h)));
         t2 = l - i.lpp (focus X h) + t3\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  open U
  topological_basis K

goal (1 subgoal):
 1. (\<And>B.
        \<lbrakk>B \<subseteq> K; U = \<Union> B\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  \<exists>n. (nxt ^^ n) \<phi> xs

goal (1 subgoal):
 1. (LEAST n. (nxt ^^ n) \<phi> xs) \<le> n


proof (prove)
using this:
  P[<(rev p \<bullet> s)>] \<simeq> Q[<(rev p \<bullet> s)>]

goal (1 subgoal):
 1. (p \<bullet> P)[<s>] \<simeq> (p \<bullet> Q)[<s>]


proof (prove)
goal (1 subgoal):
 1. (\<And>\<epsilon>.
        \<guillemotleft>\<epsilon> : f \<star>\<^sub>C
                                     g \<Rightarrow>\<^sub>C src\<^sub>C
                        g\<guillemotright> \<and>
        F \<epsilon> =
        unit (src\<^sub>C g) \<cdot>\<^sub>D
        \<psi> \<cdot>\<^sub>D
        (D.inv (F f) \<star>\<^sub>D g') \<cdot>\<^sub>D
        (F f \<star>\<^sub>D D.inv \<mu>) \<cdot>\<^sub>D
        D.inv (\<Phi> (f, g)) \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. upper (A + B) = upper A + upper B


proof (state)
this:
  \<turnstile> \<box>P \<and>
               \<diamond>\<langle>A\<rangle>_v \<longrightarrow>
               \<diamond>Q

goal (1 subgoal):
 1. \<turnstile> \<box>(\<box>P \<longrightarrow>
                        \<diamond>\<langle>A\<rangle>_v) \<longrightarrow>
                 P \<leadsto> Q


proof (prove)
goal (1 subgoal):
 1. complex_of_real
     ((LBINT t=ereal 0..ereal T. 2 * (sin (t * (x - a)) / t)) -
      (LBINT t=ereal 0..ereal T. 2 * (sin (t * (x - b)) / t))) =
    complex_of_real
     (2 *
      (sgn (x - a) * Si (T * \<bar>x - a\<bar>) -
       sgn (x - b) * Si (T * \<bar>x - b\<bar>)))


proof (prove)
using this:
  wfactors G cs c
  c \<notin> Units G

goal (1 subgoal):
 1. 0 < length cs


proof (prove)
goal (3 subgoals):
 1. \<And>x1 x1a x1b x1c x1d x1e a b r x1f x2.
       \<lbrakk>I s; (ii, i) \<in> R s; (ti, t) \<in> R s;
        (ei, e) \<in> R s; (x1, restrict_top i lv True) \<in> R s;
        (x1a, restrict_top t lv True) \<in> R s;
        (x1b, restrict_top e lv True) \<in> R s;
        (x1c, restrict_top i lv False) \<in> R s;
        (x1d, restrict_top t lv False) \<in> R s;
        (x1e, restrict_top e lv False) \<in> R s;
        (a, case lowest_tops
                  [restrict_top i lv True, restrict_top t lv True,
                   restrict_top e lv True] of
            None \<Rightarrow>
              case restrict_top i lv True of
              Trueif \<Rightarrow> restrict_top t lv True
              | Falseif \<Rightarrow> restrict_top e lv True
            | Some x \<Rightarrow>
                IFC x
                 (ifex_ite (restrict_top (restrict_top i lv True) x True)
                   (restrict_top (restrict_top t lv True) x True)
                   (restrict_top (restrict_top e lv True) x True))
                 (ifex_ite (restrict_top (restrict_top i lv True) x False)
                   (restrict_top (restrict_top t lv True) x False)
                   (restrict_top (restrict_top e lv True) x False)))
        \<in> R b;
        I b; les s b; r = (x1f, x2);
        (x1f,
         case lowest_tops
               [restrict_top i lv False, restrict_top t lv False,
                restrict_top e lv False] of
         None \<Rightarrow>
           case restrict_top i lv False of
           Trueif \<Rightarrow> restrict_top t lv False
           | Falseif \<Rightarrow> restrict_top e lv False
         | Some x \<Rightarrow>
             IFC x
              (ifex_ite (restrict_top (restrict_top i lv False) x True)
                (restrict_top (restrict_top t lv False) x True)
                (restrict_top (restrict_top e lv False) x True))
              (ifex_ite (restrict_top (restrict_top i lv False) x False)
                (restrict_top (restrict_top t lv False) x False)
                (restrict_top (restrict_top e lv False) x False)))
        \<in> R x2 \<and>
        I x2 \<and> les b x2\<rbrakk>
       \<Longrightarrow> (a, ?n1.243 x1 x1a x1b x1c x1d x1e a b r x1f x2)
                         \<in> R x2
 2. \<And>x1 x1a x1b x1c x1d x1e a b r x1f x2.
       \<lbrakk>I s; (ii, i) \<in> R s; (ti, t) \<in> R s;
        (ei, e) \<in> R s; (x1, restrict_top i lv True) \<in> R s;
        (x1a, restrict_top t lv True) \<in> R s;
        (x1b, restrict_top e lv True) \<in> R s;
        (x1c, restrict_top i lv False) \<in> R s;
        (x1d, restrict_top t lv False) \<in> R s;
        (x1e, restrict_top e lv False) \<in> R s;
        (a, case lowest_tops
                  [restrict_top i lv True, restrict_top t lv True,
                   restrict_top e lv True] of
            None \<Rightarrow>
              case restrict_top i lv True of
              Trueif \<Rightarrow> restrict_top t lv True
              | Falseif \<Rightarrow> restrict_top e lv True
            | Some x \<Rightarrow>
                IFC x
                 (ifex_ite (restrict_top (restrict_top i lv True) x True)
                   (restrict_top (restrict_top t lv True) x True)
                   (restrict_top (restrict_top e lv True) x True))
                 (ifex_ite (restrict_top (restrict_top i lv True) x False)
                   (restrict_top (restrict_top t lv True) x False)
                   (restrict_top (restrict_top e lv True) x False)))
        \<in> R b;
        I b; les s b; r = (x1f, x2);
        (x1f,
         case lowest_tops
               [restrict_top i lv False, restrict_top t lv False,
                restrict_top e lv False] of
         None \<Rightarrow>
           case restrict_top i lv False of
           Trueif \<Rightarrow> restrict_top t lv False
           | Falseif \<Rightarrow> restrict_top e lv False
         | Some x \<Rightarrow>
             IFC x
              (ifex_ite (restrict_top (restrict_top i lv False) x True)
                (restrict_top (restrict_top t lv False) x True)
                (restrict_top (restrict_top e lv False) x True))
              (ifex_ite (restrict_top (restrict_top i lv False) x False)
                (restrict_top (restrict_top t lv False) x False)
                (restrict_top (restrict_top e lv False) x False)))
        \<in> R x2 \<and>
        I x2 \<and> les b x2\<rbrakk>
       \<Longrightarrow> (x1f, ?n2.243 x1 x1a x1b x1c x1d x1e a b r x1f x2)
                         \<in> R x2
 3. \<And>x1 x1a x1b x1c x1d x1e a b r x1f x2 ra.
       \<lbrakk>I s; (ii, i) \<in> R s; (ti, t) \<in> R s;
        (ei, e) \<in> R s; (x1, restrict_top i lv True) \<in> R s;
        (x1a, restrict_top t lv True) \<in> R s;
        (x1b, restrict_top e lv True) \<in> R s;
        (x1c, restrict_top i lv False) \<in> R s;
        (x1d, restrict_top t lv False) \<in> R s;
        (x1e, restrict_top e lv False) \<in> R s;
        (a, case lowest_tops
                  [restrict_top i lv True, restrict_top t lv True,
                   restrict_top e lv True] of
            None \<Rightarrow>
              case restrict_top i lv True of
              Trueif \<Rightarrow> restrict_top t lv True
              | Falseif \<Rightarrow> restrict_top e lv True
            | Some x \<Rightarrow>
                IFC x
                 (ifex_ite (restrict_top (restrict_top i lv True) x True)
                   (restrict_top (restrict_top t lv True) x True)
                   (restrict_top (restrict_top e lv True) x True))
                 (ifex_ite (restrict_top (restrict_top i lv True) x False)
                   (restrict_top (restrict_top t lv True) x False)
                   (restrict_top (restrict_top e lv True) x False)))
        \<in> R b;
        I b; les s b; r = (x1f, x2);
        (x1f,
         case lowest_tops
               [restrict_top i lv False, restrict_top t lv False,
                restrict_top e lv False] of
         None \<Rightarrow>
           case restrict_top i lv False of
           Trueif \<Rightarrow> restrict_top t lv False
           | Falseif \<Rightarrow> restrict_top e lv False
         | Some x \<Rightarrow>
             IFC x
              (ifex_ite (restrict_top (restrict_top i lv False) x True)
                (restrict_top (restrict_top t lv False) x True)
                (restrict_top (restrict_top e lv False) x True))
              (ifex_ite (restrict_top (restrict_top i lv False) x False)
                (restrict_top (restrict_top t lv False) x False)
                (restrict_top (restrict_top e lv False) x False)))
        \<in> R x2 \<and>
        I x2 \<and> les b x2;
        case ra of
        (ni, s') \<Rightarrow>
          (ni,
           IFC lv (?n1.243 x1 x1a x1b x1c x1d x1e a b r x1f x2)
            (?n2.243 x1 x1a x1b x1c x1d x1e a b r x1f x2))
          \<in> R s' \<and>
          I s' \<and> les x2 s'\<rbrakk>
       \<Longrightarrow> case ra of
                         (r, s') \<Rightarrow>
                           (r, IFC lv
                                (case lowest_tops
 [restrict_top i lv True, restrict_top t lv True, restrict_top e lv True] of
                                 None \<Rightarrow>
                                   case restrict_top i lv True of
                                   Trueif \<Rightarrow>
                                     restrict_top t lv True
                                   | Falseif \<Rightarrow>
 restrict_top e lv True
                                 | Some x \<Rightarrow>
                                     IFC x
(ifex_ite (restrict_top (restrict_top i lv True) x True)
  (restrict_top (restrict_top t lv True) x True)
  (restrict_top (restrict_top e lv True) x True))
(ifex_ite (restrict_top (restrict_top i lv True) x False)
  (restrict_top (restrict_top t lv True) x False)
  (restrict_top (restrict_top e lv True) x False)))
                                (case lowest_tops
 [restrict_top i lv False, restrict_top t lv False,
  restrict_top e lv False] of
                                 None \<Rightarrow>
                                   case restrict_top i lv False of
                                   Trueif \<Rightarrow>
                                     restrict_top t lv False
                                   | Falseif \<Rightarrow>
 restrict_top e lv False
                                 | Some x \<Rightarrow>
                                     IFC x
(ifex_ite (restrict_top (restrict_top i lv False) x True)
  (restrict_top (restrict_top t lv False) x True)
  (restrict_top (restrict_top e lv False) x True))
(ifex_ite (restrict_top (restrict_top i lv False) x False)
  (restrict_top (restrict_top t lv False) x False)
  (restrict_top (restrict_top e lv False) x False))))
                           \<in> R s' \<and>
                           I s' \<and> les s s'


proof (prove)
goal (1 subgoal):
 1. \<And>n.
       \<lbrakk>\<lbrakk>(shiftr1 ^^ n) u \<le> (shiftr1 ^^ n) v;
                 (shiftr1 ^^ n) u \<noteq> (shiftr1 ^^ n) v\<rbrakk>
                \<Longrightarrow> u \<le> v;
        shiftr1 ((shiftr1 ^^ n) u) \<le> shiftr1 ((shiftr1 ^^ n) v);
        shiftr1 ((shiftr1 ^^ n) u) \<noteq> shiftr1 ((shiftr1 ^^ n) v);
        (shiftr1 ^^ n) u \<noteq> (shiftr1 ^^ n) v\<rbrakk>
       \<Longrightarrow> u \<le> v


proof (prove)
goal (5 subgoals):
 1. \<And>x C1.
       strip C1 = strip (SKIP {x}) \<Longrightarrow>
       length (annos C1) = length (annos (SKIP {x}))
 2. \<And>x1a x2 x3 C1.
       strip C1 = strip (x1a ::= x2 {x3}) \<Longrightarrow>
       length (annos C1) = length (annos (x1a ::= x2 {x3}))
 3. \<And>C21 C22 C1.
       \<lbrakk>\<And>C1.
                   strip C1 = strip C21 \<Longrightarrow>
                   length (annos C1) = length (annos C21);
        \<And>C1.
           strip C1 = strip C22 \<Longrightarrow>
           length (annos C1) = length (annos C22);
        strip C1 = strip (C21;;
                          C22)\<rbrakk>
       \<Longrightarrow> length (annos C1) = length (annos (C21;;
                      C22))
 4. \<And>x1a C21 C22 x4 C1.
       \<lbrakk>\<And>C1.
                   strip C1 = strip C21 \<Longrightarrow>
                   length (annos C1) = length (annos C21);
        \<And>C1.
           strip C1 = strip C22 \<Longrightarrow>
           length (annos C1) = length (annos C22);
        strip C1 = strip (IF x1a THEN C21 ELSE C22
                          {x4})\<rbrakk>
       \<Longrightarrow> length (annos C1) =
                         length (annos (IF x1a THEN C21 ELSE C22
  {x4}))
 5. \<And>x1a x2 C2 x4 C1.
       \<lbrakk>\<And>C1.
                   strip C1 = strip C2 \<Longrightarrow>
                   length (annos C1) = length (annos C2);
        strip C1 = strip ({x1a}
                          WHILE x2 DO C2
                          {x4})\<rbrakk>
       \<Longrightarrow> length (annos C1) = length (annos ({x1a}
                      WHILE x2 DO C2
                      {x4}))


proof (prove)
using this:
  x \<in> (\<Pi>' i\<in>domain y. ball ((y)\<^sub>F i) (e y))
  ?x \<in> S \<Longrightarrow> 0 < e ?x
  y \<in> S

goal (1 subgoal):
 1. dist x y < e y


proof (prove)
using this:
  rel_sum boa bob x y
  rel_sum boa bob y x
  x \<in> {x. setl x \<subseteq> A \<and> setr x \<subseteq> B}

goal (1 subgoal):
 1. x = y


proof (prove)
using this:
  c \<noteq> 0 \<Longrightarrow> integrable (count_space A) f

goal (1 subgoal):
 1. integrable (count_space A) (\<lambda>x. c *\<^sub>R f x)


proof (prove)
goal (1 subgoal):
 1. argmax
     (sum (summedBidVector
            (pseudoAllocation
              (randomEl
                (takeAll
                  (\<lambda>x.
                      x \<in> maximalStrictAllocations N (set \<Omega>) b)
                  (allAllocationsAlg ({seller} \<union> N) \<Omega>))
                r) <|
             (({seller} \<union> N) \<times> finestpart (set \<Omega>)))
            ({seller} \<union> N) (set \<Omega>)))
     (maximalStrictAllocations N (set \<Omega>) b) =
    {randomEl
      (takeAll
        (\<lambda>x. x \<in> maximalStrictAllocations N (set \<Omega>) b)
        (allAllocationsAlg ({seller} \<union> N) \<Omega>))
      r}


proof (prove)
using this:
  v |\<in>| vertices

goal (1 subgoal):
 1. \<lbrakk>\<And>c.
                \<lbrakk>c \<in> set conclusions; v = (c, [])\<rbrakk>
                \<Longrightarrow> thesis;
     \<And>c is.
        \<lbrakk>c \<in> set conclusions; is \<in> it_paths (it' c);
         v = (c, 0 # is)\<rbrakk>
        \<Longrightarrow> thesis\<rbrakk>
    \<Longrightarrow> thesis


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>b_ag A \<guillemotright> H ; x \<in> H; Group (b_ag A)\<rbrakk>
    \<Longrightarrow> x \<in> carrier A


proof (prove)
goal (1 subgoal):
 1. Ord i \<Longrightarrow> WR (succ i) (q_Eats y y) = WR i y


proof (prove)
using this:
  arr ?f = ide ?f

goal (1 subgoal):
 1. seq g f = (arr f \<and> f = g)


proof (prove)
using this:
  ide ?a = \<guillemotleft>?a : ?a \<rightarrow> ?a\<guillemotright>
  C1.ide ?a =
  \<guillemotleft>?a : ?a \<rightarrow>\<^sub>1 ?a\<guillemotright>
  C2.ide ?a =
  \<guillemotleft>?a : ?a \<rightarrow>\<^sub>2 ?a\<guillemotright>

goal (1 subgoal):
 1. ide f = (C1.ide (fst f) \<and> C2.ide (snd f))


proof (prove)
using this:
  (h, as) \<Turnstile>
  P1 a ap * P2 b bp * F \<and>\<^sub>A P1 a' ap * P2 b' bp * F'

goal (1 subgoal):
 1. (h, as) \<Turnstile>
    P2 b bp * (P1 a ap * F) \<and>\<^sub>A P2 b' bp * (P1 a' ap * F')


proof (prove)
goal (1 subgoal):
 1. {. \<Squnion>X .} = \<Squnion>(assert ` X)


proof (prove)
goal (1 subgoal):
 1. bij (put \<sigma>)


proof (prove)
goal (1 subgoal):
 1. ACI_nullable s_ = ([] \<in> ACI_lang s_)


proof (prove)
goal (1 subgoal):
 1. k = m + n


proof (prove)
goal (1 subgoal):
 1. prod f (A - B') / f x = prod f A / prod f B' / f x


proof (prove)
using this:
  a < 2 ^ n + i \<and> b < 2 ^ n + j \<or>
  2 ^ n + i \<le> a \<and> a < 2 ^ (n + 1) + i \<and> b < 2 ^ n + j \<or>
  a < 2 ^ n + i \<and> 2 ^ n + j \<le> b \<and> b < 2 ^ (n + 1) + j \<or>
  2 ^ n + i \<le> a \<and>
  a < 2 ^ (n + 1) + i \<and> 2 ^ n + j \<le> b \<and> b < 2 ^ (n + 1) + j
  a < 2 ^ n + i \<and> b < 2 ^ n + j \<Longrightarrow>
  square2 (n + 1) i j - {(a, b)} - L0 (2 ^ n + i - 1) (2 ^ n + j - 1)
  \<in> tiling Ls
  2 ^ n + i \<le> a \<and>
  a < 2 ^ (n + 1) + i \<and> b < 2 ^ n + j \<Longrightarrow>
  square2 (n + 1) i j - {(a, b)} - L1 (2 ^ n + i - 1) (2 ^ n + j - 1)
  \<in> tiling Ls
  a < 2 ^ n + i \<and>
  2 ^ n + j \<le> b \<and> b < 2 ^ (n + 1) + j \<Longrightarrow>
  square2 (n + 1) i j - {(a, b)} - L3 (2 ^ n + i - 1) (2 ^ n + j - 1)
  \<in> tiling Ls
  2 ^ n + i \<le> a \<and>
  a < 2 ^ (n + 1) + i \<and>
  2 ^ n + j \<le> b \<and> b < 2 ^ (n + 1) + j \<Longrightarrow>
  square2 (n + 1) i j - {(a, b)} - L2 (2 ^ n + i - 1) (2 ^ n + j - 1)
  \<in> tiling Ls
  a < 2 ^ n + i \<and> b < 2 ^ n + j \<Longrightarrow>
  L0 (2 ^ n + i - 1) (2 ^ n + j - 1)
  \<subseteq> square2 (n + 1) i j - {(a, b)}
  2 ^ n + i \<le> a \<and>
  a < 2 ^ (n + 1) + i \<and> b < 2 ^ n + j \<Longrightarrow>
  L1 (2 ^ n + i - 1) (2 ^ n + j - 1)
  \<subseteq> square2 (n + 1) i j - {(a, b)}
  a < 2 ^ n + i \<and>
  2 ^ n + j \<le> b \<and> b < 2 ^ (n + 1) + j \<Longrightarrow>
  L3 (2 ^ n + i - 1) (2 ^ n + j - 1)
  \<subseteq> square2 (n + 1) i j - {(a, b)}
  2 ^ n + i \<le> a \<and>
  a < 2 ^ (n + 1) + i \<and>
  2 ^ n + j \<le> b \<and> b < 2 ^ (n + 1) + j \<Longrightarrow>
  L2 (2 ^ n + i - 1) (2 ^ n + j - 1)
  \<subseteq> square2 (n + 1) i j - {(a, b)}

goal (1 subgoal):
 1. square2 (Suc n) i j - {(a, b)} \<in> tiling Ls


proof (prove)
using this:
  c \<bullet> c \<le> (c - x) \<bullet> (c - x)
  0 < x \<bullet> b

goal (1 subgoal):
 1. c \<bullet> b < x \<bullet> b


proof (prove)
goal (1 subgoal):
 1. pred_pmf P (p \<bind> f) = pred_pmf (pred_pmf P \<circ> f) p


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>determ (wp a); determ (wp b); well_def b\<rbrakk>
    \<Longrightarrow> determ (wp (a ;; b))


proof (prove)
goal (1 subgoal):
 1. Scoped_Graph nodes inPorts outPorts vertices nodeOf edges hyps


proof (chain)
picking this:
  sum_bot_ord (C ?y' f) (C ?y' g)


proof (prove)
using this:
  (inv\<^bsub>DirProds G I\<^esub> x \<otimes>\<^bsub>DirProds G I\<^esub>
   x)
   i =
  \<one>\<^bsub>G i\<^esub>
  (inv\<^bsub>DirProds G I\<^esub> x \<otimes>\<^bsub>DirProds G I\<^esub>
   x)
   i =
  (inv\<^bsub>DirProds G I\<^esub> x) i \<otimes>\<^bsub>G i\<^esub> x i
  x \<in> carrier (DirProds G I)
  inv\<^bsub>DirProds G I\<^esub> x \<in> carrier (DirProds G I)

goal (1 subgoal):
 1. (inv\<^bsub>DirProds G I\<^esub> x) i = inv\<^bsub>G i\<^esub> x i


proof (prove)
goal (1 subgoal):
 1. integral {real_of_int a..real_of_int b}
     (\<lambda>t. pbernpoly n t *\<^sub>R f t) =
    (bernoulli (Suc n) / real (Suc n)) *\<^sub>R
    (f (real_of_int b) - f (real_of_int a)) -
    integral {real_of_int a..real_of_int b}
     (\<lambda>t. pbernpoly (Suc n) t *\<^sub>R f' t) /\<^sub>R
    real (Suc n)


proof (prove)
using this:
  set (r # rs) \<subseteq> R
  set (s # ss) \<subseteq> R

goal (1 subgoal):
 1. set (map2 (-) (r # rs) (s # ss)) \<subseteq> R


proof (prove)
using this:
  reachable_state sys s
  \<forall>\<sigma>.
     prerun sys \<sigma> \<longrightarrow>
     (\<box>\<lceil>I\<rceil>) \<sigma>

goal (1 subgoal):
 1. I s


proof (prove)
using this:
  w # ws \<in> carrier \<F>\<^bsub>I\<^esub>
  x \<in> X
  snd w \<in> I
  g \<in> I \<rightarrow> carrier G
  g (snd w) \<in> carrier G

goal (1 subgoal):
 1. ws \<in> carrier \<F>\<^bsub>I\<^esub>


proof (prove)
goal (1 subgoal):
 1. thesis


proof (prove)
using this:
  map (\<lambda>i. (i, pdevs_apply X i))
   (filter
     (\<lambda>x. ((\<noteq>) (0::'a) \<circ> snd) (x, pdevs_apply X x))
     [0..<degree X]) =
  filter ((\<noteq>) (0::'a) \<circ> snd)
   (map (\<lambda>i. (i, pdevs_apply X i)) [0..<degree X])

goal (1 subgoal):
 1. rev (list_of_pdevs X) =
    filter ((\<noteq>) (0::'a) \<circ> snd)
     (map (\<lambda>i. (i, pdevs_apply X i)) [0..<degree X])


proof (prove)
using this:
  trsys2.\<tau>Runs_table s2 stlsss2

goal (1 subgoal):
 1. s2 \<Down>2 tmap fst id stlsss2


proof (prove)
using this:
  g = t

goal (1 subgoal):
 1. (THE fa. \<forall>i. f v $ i = (\<Sum>x\<in>UNIV. fa x * Y $ x $ i)) i =
    (\<Sum>x\<in>UNIV.
       (THE f. \<forall>i. v $ i = (\<Sum>x\<in>UNIV. f x * X $ x $ i)) x *
       (THE fa.
           \<forall>i. f (X $ x) $ i = (\<Sum>x\<in>UNIV. fa x * Y $ x $ i))
        i)


proof (prove)
using this:
  \<forall>i<length T.
     \<exists>s. P (T ! i) s \<and> S ! i = s \<cdot> \<delta>
  length T = length S

goal (1 subgoal):
 1. (\<And>U.
        \<lbrakk>length T = length U;
         \<forall>i<length T. P (T ! i) (U ! i);
         S = U \<cdot>\<^sub>l\<^sub>i\<^sub>s\<^sub>t \<delta>\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. (\<parallel>A\<parallel>\<^sub>o\<^sub>p = 0) = (A = 0)


proof (prove)
goal (1 subgoal):
 1. possible_allocations_rel G N
    \<subseteq> injectionsUniverse \<inter>
                {a. Range a \<subseteq> N \<and>
                    Domain a \<in> all_partitions G}


proof (prove)
using this:
  \<lbrakk>\<forall>c. 0 < v c; v c \<le> n; 0 < v c; v c \<le> n;
   \<forall>u. \<not> u \<turnstile>\<^bsub>v,n\<^esub> M\<rbrakk>
  \<Longrightarrow> \<not> u \<turnstile>\<^bsub>v,n\<^esub> reset M n (v c)
                        d
  M' \<equiv> reset M n (v c) d
  \<forall>k\<le>n. 0 < k \<longrightarrow> (\<exists>c. v c = k)
  \<forall>c.
     0 < v c \<and>
     (\<forall>x y.
         v x \<le> n \<and> v y \<le> n \<and> v x = v y \<longrightarrow>
         x = y)
  v c \<le> n
  u \<in> {u. u \<turnstile>\<^bsub>v,n\<^esub> M'}
  {u. u \<turnstile>\<^bsub>v,n\<^esub> M} = {}

goal (1 subgoal):
 1. thesis


proof (prove)
goal (1 subgoal):
 1. \<exists>a b. a \<noteq> 0 \<and> M = moebius_similarity a b


proof (prove)
using this:
  literal_ordering A L
  L \<in> C
  A \<in> C - {L} \<and>
  (\<forall>B.
      B \<in> C - {L} \<and> A \<noteq> B \<longrightarrow>
      literal_ordering B A)
  \<lbrakk>literal_ordering ?A ?B; literal_ordering ?B ?C\<rbrakk>
  \<Longrightarrow> literal_ordering ?A ?C

goal (1 subgoal):
 1. L \<in> C \<and>
    (\<forall>B.
        B \<in> C \<and> L \<noteq> B \<longrightarrow>
        literal_ordering B L)


proof (prove)
goal (1 subgoal):
 1. P,h' \<turnstile> l' (:\<le>) E(V \<mapsto> T)


proof (prove)
using this:
  integrable (lborel \<Otimes>\<^sub>M lborel) f
  integrable (lborel \<Otimes>\<^sub>M lborel) ?f \<Longrightarrow>
  LBINT x. LBINT y. ?f (x, y) =
  integral\<^sup>L (lborel \<Otimes>\<^sub>M lborel) ?f

goal (1 subgoal):
 1. LBINT x. LBINT y. f (x, y) =
    integral\<^sup>L (lborel \<Otimes>\<^sub>M lborel) f


proof (prove)
goal (1 subgoal):
 1. rel_antirange_kleene_algebra.bdia (v ::= e) \<lceil>P\<rceil> =
    \<lceil>\<lambda>s.
               \<exists>w. s v = e (s(v := w)) \<and> P (s(v := w))\<rceil>


proof (prove)
goal (1 subgoal):
 1. relative_homology_group p (subtopology X S) T \<cong>
    relative_homology_group p X T


proof (prove)
using this:
  ss = [h]
  is_root h
  f = Insert x
  is_root ?hp \<Longrightarrow>
  \<Phi> (Pairing_Heap_Tree.insert ?x ?hp) - \<Phi> ?hp
  \<le> log 2 (real (size ?hp + 1))
  \<forall>s\<in>set ss. is_root s
  length ss = arity f

goal (1 subgoal):
 1. real (cost f ss) + \<Phi> (exec f ss) - sum_list (map \<Phi> ss)
    \<le> U f ss


proof (prove)
goal (1 subgoal):
 1. \<forall>heap.
       P heap \<longrightarrow>
       (case run_state (State (\<lambda>heap. the (execute b heap))) heap of
        (v1, heap1) \<Rightarrow>
          case execute b heap of None \<Rightarrow> False
          | Some (v2, heap2) \<Rightarrow>
              v1 = v2 \<and> heap1 = heap2 \<and> P heap2)


proof (prove)
goal (1 subgoal):
 1. (\<exists>S.
        fst SK = Some S \<and>
        Crypt (Auth_ShaKey n) (PriKey S) \<in> used s) \<or>
    fst SK = None


proof (prove)
goal (1 subgoal):
 1. (LEAST i. seq (Suc \<nu> + Suc \<nu> + i) = seq (Suc \<nu>))
    < (LEAST i. seq (\<nu> + \<nu> + i) = seq \<nu>)


proof (state)
this:
  (b / a)\<^sup>2 - 4 * (c / a) = (b\<^sup>2 - 4 * a * c) / a\<^sup>2

goal (4 subgoals):
 1. 0 \<le> (b / a)\<^sup>2 - 4 * (c / a)
 2. \<xi>1\<^sup>2 + b / a * \<xi>1 + c / a = 0
 3. \<xi>2\<^sup>2 + b / a * \<xi>2 + c / a = 0
 4. \<xi>1 \<noteq> \<xi>2


proof (prove)
using this:
  \<not> j < i

goal (1 subgoal):
 1. opt_bst_wpl i j = (local.opt_bst i j, local.wpl i j (local.opt_bst i j))


proof (prove)
using this:
  m = 0

goal (1 subgoal):
 1. bit (set_bit (Suc n) a) m =
    bit (a mod (2::'a) + (2::'a) * set_bit n (a div (2::'a))) m


proof (prove)
using this:
  r p \<le> r i
  r i \<cdot> ad t \<le> r q
  \<langle>x| (d t \<cdot> r i) \<le> r i

goal (1 subgoal):
 1. \<langle>while t inv i do x od| i \<le> r i \<cdot> ad t


proof (prove)
using this:
  internal p ?T \<Longrightarrow> treesize (delete p ?T) < treesize ?T
  internal (a # p) T

goal (1 subgoal):
 1. \<exists>T1 T2. T = Branching T1 T2


proof (prove)
goal (1 subgoal):
 1. arg_max_list f l \<in> set l


proof (prove)
goal (1 subgoal):
 1. x = closest_point S a


proof (prove)
using this:
  cmod (contour_integral (part_circlepath c r a b) f)
  \<le> integral {0..1} (\<lambda>x. B * 1 * (r * \<bar>b - a\<bar>) * 1)

goal (1 subgoal):
 1. cmod (contour_integral (part_circlepath c r a b) f)
    \<le> B * r * \<bar>b - a\<bar>


proof (prove)
goal (1 subgoal):
 1. (\<forall>i. P i) = (P 1 \<and> P 2)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> terminal subs (f n); f (Suc n) \<in> subs (f n);
     x \<in> set (atoms (f n))\<rbrakk>
    \<Longrightarrow> x \<in> set (atoms (f (Suc n)))


proof (prove)
goal (1 subgoal):
 1. monotone (rel_prod orda ordb) ordc f


proof (prove)
goal (1 subgoal):
 1. bit a n = (drop_bit n a AND (1::'a) = (1::'a))


proof (prove)
using this:
  \<exists>y. ?x \<sqsubset> y

goal (1 subgoal):
 1. (\<And>z.
        ord.max (\<sqsubseteq>) z1 z2 \<sqsubset> z \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. ((\<lambda>n. real_of_ereal (enn2ereal (u n))) \<longlongrightarrow> l)
     F


proof (prove)
goal (1 subgoal):
 1. \<And>k::nat. \<exists>(i::nat) j::nat. f (i + j) \<le> f k
variables:
  f :: nat \<Rightarrow> 'c
type variables:
  'c :: complete_lattice


proof (prove)
goal (1 subgoal):
 1. bl \<in># \<B> \<Longrightarrow> del_block_sys.add_block bl bl = \<B>


proof (prove)
goal (1 subgoal):
 1. local.basis_reduction_swap i ((f1, f2), dmus, ds) =
    (let di = ds !! i; dsi = ds !! Suc i; im1 = i - 1; dim1 = ds !! im1;
         fi = hd f2; fim1 = hd f1; dmu_i_im1 = dmus !! i !! im1; fi' = fim1;
         fim1' = fi
     in (False, im1, (tl f1, fim1' # fi' # tl f2),
         local.swap_mu dmus i dmu_i_im1 dim1 di dsi,
         iarray_update ds i ((dsi * dim1 + dmu_i_im1 * dmu_i_im1) div di)))


proof (prove)
using this:
  local.square_free_factorization p (c, bs)

goal (1 subgoal):
 1. (p = smult c (\<Prod>(a, i)\<in>set bs. a ^ Suc i) &&&
     ((a, i) \<in> set bs \<Longrightarrow>
      square_free a \<and> degree a \<noteq> 0)) &&&
    (\<lbrakk>(a, i) \<in> set bs; (b, j) \<in> set bs;
      (a, i) \<noteq> (b, j)\<rbrakk>
     \<Longrightarrow> coprime a b) &&&
    (p = 0 \<Longrightarrow> c = (0::'a) \<and> bs = []) &&& distinct bs


proof (prove)
goal (1 subgoal):
 1. \<exists>eqa\<in>set t.
       lhs eqa = y \<and>
       Mapping.lookup
        (foldl
          (\<lambda>v' e.
              Mapping.update (lhs e) (rhs_eq_val (\<V> s) x v e) v')
          (\<V> s) t)
        y =
       Some (rhs_eq_val (\<V> s) x v eqa)


proof (prove)
goal (1 subgoal):
 1. G,A\<turnstile>{=:n} In1l e\<succ> {G\<rightarrow>} \<Longrightarrow>
    G,A\<turnstile>{Normal
                     ((\<lambda>Y' s' s. s' = s \<and> normal s) \<and>.
                      G\<turnstile>init\<le>n)}
    .Expr e.
    {\<lambda>Y s' s.
        G\<turnstile>s \<midarrow>In1r (Expr e)\<succ>\<rightarrow> (Y, s')}


proof (prove)
goal (1 subgoal):
 1. inside (path_image (p +++ linepath a b)) \<inter>
    outside (path_image (p +++ linepath a b)) =
    {} &&&
    frontier (inside (path_image (p +++ linepath a b))) =
    path_image (p +++ linepath a b) &&&
    frontier (outside (path_image (p +++ linepath a b))) =
    path_image (p +++ linepath a b)


proof (prove)
using this:
  p \<in> {0<..1}

goal (1 subgoal):
 1. measure_pmf.prob (geometric_pmf p) (UNIV - {..<n}) = (1 - p) ^ n


proof (prove)
goal (1 subgoal):
 1. valid DCaxiom


proof (prove)
goal (1 subgoal):
 1. (if \<exists>!x. x \<in> U \<and> P x
     then Some (THE x. x \<in> U \<and> P x) else None) =
    None


proof (prove)
goal (1 subgoal):
 1. norm (f t x) \<le> B


proof (prove)
using this:
  t5 \<in> keys (lookup (i.punit.tail (focus X h)) t4)

goal (1 subgoal):
 1. t5 \<in> keys (lookup (focus X h) t4)


proof (prove)
goal (1 subgoal):
 1. (\<forall>(s1', t1)|\<in>|possible_steps e1 s1 r1 l i.
        \<exists>(s2', t2)|\<in>|possible_steps e2 s2 r2 l i.
           evaluate_outputs t1 i r1 = evaluate_outputs t2 i r2 \<and>
           executionally_equivalent e1 s1' (evaluate_updates t1 i r1) e2 s2'
            (evaluate_updates t2 i r2) es) \<and>
    (\<forall>(s2', t2)|\<in>|possible_steps e2 s2 r2 l i.
        \<exists>(s1', t1)|\<in>|possible_steps e1 s1 r1 l i.
           evaluate_outputs t1 i r1 = evaluate_outputs t2 i r2 \<and>
           executionally_equivalent e1 s1' (evaluate_updates t1 i r1) e2 s2'
            (evaluate_updates t2 i r2) es) \<Longrightarrow>
    executionally_equivalent e1 s1 r1 e2 s2 r2 ((l, i) # es)


proof (prove)
goal (1 subgoal):
 1. bprv (neg (PPf (encPf prf) \<langle>\<phi>\<rangle>))


proof (prove)
goal (1 subgoal):
 1. inside (inside S) \<subseteq> S


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>infinite I; t0 \<in> I\<rbrakk>
    \<Longrightarrow> iNextStrong t0 I P = iNextWeak t0 I P


proof (prove)
goal (1 subgoal):
 1. \<forall>x xa.
       x \<noteq> xa \<longrightarrow>
       (\<nexists>va u.
           move ts ts' v=va\<parallel>u \<and>
           True \<and>
           (\<exists>v ua.
               u=v\<parallel>ua \<and>
               (\<exists>va u.
                   v=va--u \<and>
                   True \<and>
                   (\<exists>v ua.
                       u=v--ua \<and>
                       ((0 < \<parallel>ext v\<parallel> \<and>
                         len v ts' x = ext v \<and>
                         restrict v (res ts') x = lan v \<and>
                         |lan v| = 1) \<and>
                        0 < \<parallel>ext v\<parallel> \<and>
                        len v ts' xa = ext v \<and>
                        restrict v (res ts') xa = lan v \<and>
                        |lan v| = 1) \<and>
                       True)) \<and>
               True)) \<longrightarrow>
       (\<forall>ts'.
           ts' \<^bold>\<leadsto> ts' \<longrightarrow>
           (\<nexists>va u.
               move ts' ts' (move ts ts' v)=va\<parallel>u \<and>
               True \<and>
               (\<exists>v ua.
                   u=v\<parallel>ua \<and>
                   (\<exists>va u.
                       v=va--u \<and>
                       True \<and>
                       (\<exists>v ua.
                           u=v--ua \<and>
                           ((0 < \<parallel>ext v\<parallel> \<and>
                             len v ts' x = ext v \<and>
                             restrict v (res ts') x = lan v \<and>
                             |lan v| = 1) \<and>
                            0 < \<parallel>ext v\<parallel> \<and>
                            len v ts' xa = ext v \<and>
                            restrict v (res ts') xa = lan v \<and>
                            |lan v| = 1) \<and>
                           True)) \<and>
                   True)))


proof (prove)
using this:
  ran (process_mru vs |` Q) \<noteq> {}
  vote_set vs Q \<noteq> {}

goal (1 subgoal):
 1. Q \<inter> voters vs \<noteq> {}


proof (state)
goal (1 subgoal):
 1. P (iti c f \<sigma>0)


proof (prove)
using this:
  x1 \<noteq> b \<and>
  (\<exists>u>0. u < 1 \<and> x2 = (1 - u) *\<^sub>R x1 + u *\<^sub>R b)

goal (1 subgoal):
 1. (\<And>v.
        \<lbrakk>0 < v; v < 1;
         x2 = (1 - v) *\<^sub>R x1 + v *\<^sub>R b\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. degree_m (Polynomial.smult (lead_coeff f) (prod_list hs)) =
    degree (Polynomial.smult (lead_coeff f) (prod_list hs))


proof (prove)
using this:
  \<guillemotleft>\<mu>\<nu>_\<pi>_\<rho>.Prj\<^sub>1\<^sub>1 : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>\<nu>.apex\<guillemotright>
  \<mu> \<star> \<nu> \<equiv>
  if arr \<nu> \<and> arr \<mu> \<and> src \<mu> = trg \<nu>
  then \<lparr>Chn = chine_hcomp \<mu> \<nu>,
          Dom =
            \<lparr>Leg0 = \<nu>.leg0 \<cdot> \<mu>\<nu>.prj\<^sub>0,
               Leg1 = \<mu>.leg1 \<cdot> \<mu>\<nu>.prj\<^sub>1\<rparr>,
          Cod =
            \<lparr>Leg0 =
                      \<nu>.cod.leg0 \<cdot>
                      \<p>\<^sub>0[\<mu>.cod.leg0, \<nu>.cod.leg1],
               Leg1 =
                 \<mu>.cod.leg1 \<cdot>
                 \<p>\<^sub>1[\<mu>.cod.leg0, \<nu>.cod.leg1]\<rparr>\<rparr>
  else null
  \<lbrakk>ide ?g; ide ?f; src ?g = trg ?f\<rbrakk>
  \<Longrightarrow> chine_hcomp ?g ?f =
                    Leg0 (Dom ?g) \<down>\<down> Leg1 (Dom ?f)
  \<mu>\<nu>.cod.apex \<equiv> C.dom \<mu>\<nu>.cod.leg0
  src \<mu> = trg \<nu>
  C.cospan \<mu>.leg0 \<nu>.leg1
  \<lbrakk>C.ide ?b; C.seq ?b ?f\<rbrakk>
  \<Longrightarrow> ?b \<cdot> ?f = ?f

goal (1 subgoal):
 1. \<mu>.chine \<cdot>
    \<mu>\<nu>.prj\<^sub>1 \<cdot>
    \<mu>\<nu>_\<pi>_\<rho>.Prj\<^sub>1\<^sub>1 =
    \<mu>\<nu>.prj\<^sub>1 \<cdot>
    \<mu>\<nu>_\<pi>_\<rho>.Prj\<^sub>1\<^sub>1


proof (prove)
goal (1 subgoal):
 1. S' retract_of UNIV


proof (prove)
using this:
  (\<not> lnull ?xs) = (\<exists>x xs'. ?xs = x % xs')
  \<not> lnull w

goal (1 subgoal):
 1. (\<And>a v. w = <a> $ v \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  size \<phi>1[M]\<^sub>\<Sigma>\<^sub>2 \<le> 2 ^ (size \<phi>1 + 1)
  size \<phi>2[M]\<^sub>\<Sigma>\<^sub>2 \<le> 2 ^ (size \<phi>2 + 1)

goal (1 subgoal):
 1. size \<phi>1 U\<^sub>n \<phi>2[M]\<^sub>\<Sigma>\<^sub>2
    \<le> 2 ^ (size \<phi>1 + 1) + 2 ^ (size \<phi>2 + 1) + 1


proof (prove)
using this:
  (THE xa.
      xa \<in> carrier (K [X]) \<and>
      pirreducible K xa \<and>
      local.eval xa x = \<zero> \<and> lead_coeff xa = \<one>)
  \<in> carrier (K [X]) \<and>
  pirreducible K
   (THE xa.
       xa \<in> carrier (K [X]) \<and>
       pirreducible K xa \<and>
       local.eval xa x = \<zero> \<and> lead_coeff xa = \<one>) \<and>
  local.eval
   (THE xa.
       xa \<in> carrier (K [X]) \<and>
       pirreducible K xa \<and>
       local.eval xa x = \<zero> \<and> lead_coeff xa = \<one>)
   x =
  \<zero> \<and>
  lead_coeff
   (THE xa.
       xa \<in> carrier (K [X]) \<and>
       pirreducible K xa \<and>
       local.eval xa x = \<zero> \<and> lead_coeff xa = \<one>) =
  \<one>

goal (1 subgoal):
 1. (Irr K x \<in> carrier (K [X]) &&& pirreducible K (Irr K x)) &&&
    lead_coeff (Irr K x) = \<one> &&& local.eval (Irr K x) x = \<zero>


proof (prove)
using this:
  vcard xs = ZFC_in_HOL.succ (vcard xs')
  vfinite xs'
  \<D>\<^sub>\<circ> xs = vcard xs

goal (1 subgoal):
 1. xs' = xs \<restriction>\<^sup>l\<^sub>\<circ> vcard xs'


proof (prove)
using this:
  set (map of_int_hom.vec_hom fs_init) \<subseteq> Rn \<and>
  distinct (map of_int_hom.vec_hom fs_init) \<and>
  gs.lin_indpt (set (map of_int_hom.vec_hom fs_init))
  set (rows B) = set (map of_int_hom.vec_hom fs_init)

goal (1 subgoal):
 1. gs.lin_indpt (set (rows B))


proof (prove)
using this:
  O x y
  \<not> O x z

goal (1 subgoal):
 1. P (x \<otimes> (y \<oplus> z)) (x \<otimes> y)


proof (prove)
goal (1 subgoal):
 1. (list_R1 F = l) = (F = unR l)


proof (prove)
goal (1 subgoal):
 1. is_nan x \<Longrightarrow> \<not> is_finite x


proof (prove)
using this:
  C \<in> \<Union>
           (\<Union>(k,
               v)\<in>{0..<length \<pi>} \<times> set (\<Pi>\<^sub>\<V>).
               {{{(State k (index (\<Pi>\<^sub>\<V>) v))\<^sup>+,
                  (State (Suc k)
                    (index (\<Pi>\<^sub>\<V>) v))\<inverse>} \<union>
                 {(Operator k (index (\<Pi>\<^sub>\<O>) op))\<^sup>+ |op.
                  op \<in> set (\<Pi>\<^sub>\<O>) \<and>
                  v \<in> set (add_effects_of op)}}})

goal (1 subgoal):
 1. clause_semantics \<A> C


proof (prove)
goal (13 subgoals):
 1. mapl_G id id = id
 2. \<And>f1 f2 g1 g2.
       mapl_G (g1 \<circ> f1) (g2 \<circ> f2) =
       mapl_G g1 g2 \<circ> mapl_G f1 f2
 3. \<And>x f1 f2 g1 g2.
       \<lbrakk>\<And>z1. z1 \<in> set1_G x \<Longrightarrow> f1 z1 = g1 z1;
        \<And>z2. z2 \<in> set2_G x \<Longrightarrow> f2 z2 = g2 z2\<rbrakk>
       \<Longrightarrow> mapl_G f1 f2 x = mapl_G g1 g2 x
 4. \<And>f1 f2. set1_G \<circ> mapl_G f1 f2 = (`) f1 \<circ> set1_G
 5. \<And>f1 f2. set2_G \<circ> mapl_G f1 f2 = (`) f2 \<circ> set2_G
 6. card_order bd_G
 7. cinfinite bd_G
 8. \<And>x. |set1_G x| \<le>o bd_G
 9. \<And>x. |set2_G x| \<le>o bd_G
 10. \<And>R1 R2 S1 S2.
        rell_G R1 R2 OO rell_G S1 S2 \<le> rell_G (R1 OO S1) (R2 OO S2)
A total of 13 subgoals...


proof (prove)
using this:
  exec_step_input P C M pc ics = StepC C' Cs
  ics = Called Cs

goal (1 subgoal):
 1. ics = Calling C' Cs


proof (prove)
goal (1 subgoal):
 1. lookup (delete k al) = (lookup al)(k := None)


proof (prove)
using this:
   Lam [a].t \<longrightarrow>\<^sub>1 t'
  a \<sharp> t'

goal (1 subgoal):
 1. \<exists>t''. t' = Lam [a].t'' \<and>  t \<longrightarrow>\<^sub>1 t''


proof (prove)
using this:
  x \<notin> \<Union> (fv_trm ` set ts)
  match ts (map (MFOTL.eval_trm (map the v)) ts) = Some f
  v[x := None] = tabulate f 0 n

goal (1 subgoal):
 1. f x = None &&& length v = n


proof (prove)
goal (1 subgoal):
 1. \<And>x xa.
       \<lbrakk>\<forall>x. f x \<le> \<Sqinter>{g xa |xa. (xa, x) \<in> R};
        xa \<in> {f y |y. (x, y) \<in> R}\<rbrakk>
       \<Longrightarrow> xa \<le> g x


proof (prove)
using this:
  var_infinite undefined
  var_regular undefined
  varSortAsSort_inj Delta
  arityOf_lt_var undefined Delta
  barityOf_lt_var undefined Delta
  sort_lt_var undefined undefined

goal (1 subgoal):
 1. FixVars TYPE('var) TYPE('varSort)


proof (prove)
goal (1 subgoal):
 1. Good c \<in> events


proof (prove)
goal (1 subgoal):
 1. c d \<equiv> c d


proof (prove)
goal (1 subgoal):
 1. alw (holds P) xs = pred_stream P xs


proof (prove)
goal (1 subgoal):
 1. gfp = complete_lattice.lfp Sup (\<lambda>x y. y \<le> x)


proof (prove)
goal (1 subgoal):
 1. wf'\<^sub>s\<^sub>s\<^sub>t V S


proof (prove)
goal (1 subgoal):
 1. A B CTSP D E'


proof (prove)
using this:
  folding.gallery (B # C # Cs @ [D]) \<Longrightarrow>
  adjacentchain (B # C # Cs @ [D])
  \<lbrakk>B \<in> f \<turnstile> folding.\<C>;
   C \<in> folding.\<C> - f \<turnstile> folding.\<C>; B \<sim> C\<rbrakk>
  \<Longrightarrow> f ` C = B
  folding.gallery (B # C # Cs @ [D]) \<Longrightarrow>
  folding.gallery (f \<Turnstile> (B # C # Cs @ [D]))
  folding.gallery (B # B # f \<Turnstile> Cs @ [D]) \<Longrightarrow>
  folding.gallery (B # f \<Turnstile> Cs @ [D])
  \<lbrakk>is_arg_min length (\<lambda>Ds. folding.gallery (B # Ds @ [D]))
            ?x;
   folding.gallery (B # f \<Turnstile> Cs @ [D])\<rbrakk>
  \<Longrightarrow> \<not> order.greater (length ?x)
                            (length (f \<Turnstile> Cs))
  min_gallery (B # (C # Cs) @ [D]) =
  (B \<noteq> D \<and>
   is_arg_min length (\<lambda>zs. folding.gallery (B # zs @ [D])) (C # Cs))

goal (1 subgoal):
 1. \<lbrakk>B \<in> f \<turnstile> folding.\<C>;
     C \<in> folding.\<C> - f \<turnstile> folding.\<C>;
     D \<in> f \<turnstile> folding.\<C>;
     folding.gallery (B # C # Cs @ [D])\<rbrakk>
    \<Longrightarrow> \<not> min_gallery (B # C # Cs @ [D])


proof (prove)
goal (1 subgoal):
 1. aform_val e (truncate_aform p z) =
    aform_val e z + aform_val e (truncate_error_aform p z)


proof (prove)
goal (1 subgoal):
 1. aprimedivisor n ^ multiplicity (aprimedivisor n) n = n


proof (prove)
goal (9 subgoals):
 1. (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_ true\<^sub>r,
     rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_ a'h_ true\<^sub>r)
    \<in> Rv
 2. (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_ false\<^sub>r,
     rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_ a'h_ false\<^sub>r)
    \<in> Rv
 3. \<And>ai a'i.
       (ai, a'i) \<in> R \<Longrightarrow>
       (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_ prop\<^sub>r(ai),
        rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_ a'h_
         prop\<^sub>r(a'i))
       \<in> Rv
 4. \<And>ai a'i.
       (ai, a'i) \<in> R \<Longrightarrow>
       (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_ nprop\<^sub>r(ai),
        rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_ a'h_
         nprop\<^sub>r(a'i))
       \<in> Rv
 5. \<And>ai a'i b b'.
       \<lbrakk>(ai, a'i) \<in> \<langle>R\<rangle>ltlr_rel;
        (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_ ai,
         rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_ a'h_ a'i)
        \<in> Rv;
        (b, b') \<in> \<langle>R\<rangle>ltlr_rel;
        (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_ b,
         rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_ a'h_ b')
        \<in> Rv\<rbrakk>
       \<Longrightarrow> (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_
                           (ai and\<^sub>r b),
                          rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_
                           a'h_ (a'i and\<^sub>r b'))
                         \<in> Rv
 6. \<And>ai a'i b b'.
       \<lbrakk>(ai, a'i) \<in> \<langle>R\<rangle>ltlr_rel;
        (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_ ai,
         rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_ a'h_ a'i)
        \<in> Rv;
        (b, b') \<in> \<langle>R\<rangle>ltlr_rel;
        (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_ b,
         rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_ a'h_ b')
        \<in> Rv\<rbrakk>
       \<Longrightarrow> (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_
                           (ai or\<^sub>r b),
                          rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_
                           a'h_ (a'i or\<^sub>r b'))
                         \<in> Rv
 7. \<And>ai a'i.
       \<lbrakk>(ai, a'i) \<in> \<langle>R\<rangle>ltlr_rel;
        (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_ ai,
         rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_ a'h_ a'i)
        \<in> Rv\<rbrakk>
       \<Longrightarrow> (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_
                           (X\<^sub>r ai),
                          rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_
                           a'h_ (X\<^sub>r a'i))
                         \<in> Rv
 8. \<And>ai a'i b b'.
       \<lbrakk>(ai, a'i) \<in> \<langle>R\<rangle>ltlr_rel;
        (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_ ai,
         rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_ a'h_ a'i)
        \<in> Rv;
        (b, b') \<in> \<langle>R\<rangle>ltlr_rel;
        (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_ b,
         rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_ a'h_ b')
        \<in> Rv\<rbrakk>
       \<Longrightarrow> (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_
                           (ai U\<^sub>r b),
                          rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_
                           a'h_ (a'i U\<^sub>r b'))
                         \<in> Rv
 9. \<And>ai a'i b b'.
       \<lbrakk>(ai, a'i) \<in> \<langle>R\<rangle>ltlr_rel;
        (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_ ai,
         rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_ a'h_ a'i)
        \<in> Rv;
        (b, b') \<in> \<langle>R\<rangle>ltlr_rel;
        (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_ b,
         rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_ a'h_ b')
        \<in> Rv\<rbrakk>
       \<Longrightarrow> (rec_ltlr a_ aa_ ab_ ac_ ad_ ae_ af_ ag_ ah_
                           (ai R\<^sub>r b),
                          rec_ltlr a'_ a'a_ a'b_ a'c_ a'd_ a'e_ a'f_ a'g_
                           a'h_ (a'i R\<^sub>r b'))
                         \<in> Rv


proof (prove)
goal (1 subgoal):
 1. AboveS r (f ` T) \<noteq> {}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>bij \<alpha>; bij \<beta>\<rbrakk>
    \<Longrightarrow> (\<R>\<^sub>E (inv \<alpha>) (inv \<beta>) e' = e) =
                      (\<R>\<^sub>E \<alpha> \<beta> e = e')


proof (prove)
using this:
  p x \<noteq> 0
  p x \<noteq> 1
  finite (supp p)
  \<forall>x\<in>supp (dist_remove p x). healthy (wp (a x))

goal (1 subgoal):
 1. bd_cts (wp (SetPC a (\<lambda>_. p)))


proof (prove)
using this:
  rewrite_negated_primitives (disc, sel) C ?negate_f m = m

goal (1 subgoal):
 1. rewrite_negated_primitives (disc, sel) C l4_ports_negate_one m = m


proof (chain)
picking this:
  card (local.blues_seen w' p) = 0
  local.valid w'


proof (prove)
goal (1 subgoal):
 1. fetch (tp1 @ ci ly (start_of ly as) ins @ tp2) s b =
    fetch (ci ly (start_of ly as) ins) (s - length tp1 div 2) b


proof (prove)
using this:
  ((\<sigma> 0 \<in> gba.V0 \<and> ipath gba.E \<sigma>) \<and>
   gba.is_acc \<sigma>) \<and>
  (\<forall>i. local.gba.L (\<sigma> i) (\<xi> i))

goal (1 subgoal):
 1. \<sigma> 0 \<in> gba.V0


proof (prove)
goal (1 subgoal):
 1. P\<^sub>1 \<parallel>\<^bsub>M\<^esub> Q \<sqsubseteq>
    P\<^sub>2 \<parallel>\<^bsub>M\<^esub> Q


proof (prove)
using this:
  a = a' - length E'
  action_obs E'' a' = NormalAction (ReadMem ad al v)
  lnth E'' a' = (t, NormalAction (ReadMem ad al v))
  length E' \<le> a'

goal (1 subgoal):
 1. action_obs E a = NormalAction (ReadMem ad al v) &&&
    lnth E a = (t, NormalAction (ReadMem ad al v))


proof (prove)
using this:
  lalternate xs = LCons x21 x22
  eSuc (enat ?n) = enat (Suc ?n)
  lalternate ?xs =
  (case ?xs of LNil \<Rightarrow> LNil
   | LCons x xs \<Rightarrow> LCons x (lalternate (ltl xs)))
  lnull ?xs \<Longrightarrow> lalternate ?xs = LNil
  \<not> lnull ?llist \<Longrightarrow>
  LCons (lhd ?llist) (ltl ?llist) = ?llist
  lhd (LCons ?x21.0 ?x22.0) = ?x21.0

goal (1 subgoal):
 1. ltake (enat (Suc n)) (lalternate xs) =
    lalternate (ltake (enat (Suc (Suc (2 * n)))) xs)


proof (prove)
using this:
  {X \<in> \<D>. x \<in> X} \<noteq> {}

goal (1 subgoal):
 1. (\<And>Y.
        \<lbrakk>Y \<in> {X \<in> \<D>. x \<in> X};
         \<And>Y'.
            (Y', Y)
            \<in> {(K, L).
                   K \<in> \<D> \<and>
                   L \<in> \<D> \<and> L \<subset> K} \<Longrightarrow>
            Y' \<notin> {X \<in> \<D>. x \<in> X}\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. monom 1 b [^]\<^bsub>R\<^esub> CARD('a) ^ m' = monom 1 b


proof (prove)
goal (1 subgoal):
 1. mono \<top>


proof (prove)
goal (1 subgoal):
 1. (TP, TQ) \<in> TRel


proof (prove)
goal (2 subgoals):
 1. \<And>e.
       \<lbrakk>\<And>a'.
                   \<lbrakk>((fh, lh), a', f', l') \<in> pr_algo_lts';
                    a = project_operation a'\<rbrakk>
                   \<Longrightarrow> thesis;
        a = PUSH; f' = push_effect fh e; l' = lh;
        push_precond fh lh e\<rbrakk>
       \<Longrightarrow> thesis
 2. \<And>u.
       \<lbrakk>\<And>a'.
                   \<lbrakk>((fh, lh), a', f', l') \<in> pr_algo_lts';
                    a = project_operation a'\<rbrakk>
                   \<Longrightarrow> thesis;
        a = RELABEL; f' = fh; l' = relabel_effect fh lh u;
        relabel_precond fh lh u\<rbrakk>
       \<Longrightarrow> thesis


proof (prove)
goal (1 subgoal):
 1. \<forall>A'0 C'0 D'0 F'0.
       B Out A'0 A' \<and>
       B Out C'0 C' \<and>
       E Out D'0 D' \<and>
       E Out F'0 F' \<and>
       Cong B A'0 E D'0 \<and> Cong B C'0 E F'0 \<longrightarrow>
       Cong A'0 C'0 D'0 F'0


proof (prove)
goal (1 subgoal):
 1. (case SUCCEED of FAILi \<Rightarrow> FAIL
     | RES X \<Rightarrow> Sup (f ` X)) =
    SUCCEED


proof (prove)
goal (1 subgoal):
 1. inj \<up>


proof (prove)
using this:
  ?q \<in> accessible \<Longrightarrow> nextl (dfa.init M) (path_to ?q) = ?q
  minimal

goal (1 subgoal):
 1. (path_to (dfa.init M), []) \<in> eq_app_right language


proof (prove)
goal (1 subgoal):
 1. (flow0 x ` (existence_ivl0 x \<inter> {..0}) \<subseteq> K) =
    (rev.flow0 x ` (rev.existence_ivl0 x \<inter> {0..}) \<subseteq> K)


proof (prove)
using this:
  empty_store_buffers ts\<^sub>s\<^sub>b'

goal (1 subgoal):
 1. \<forall>i p is xs sb \<D> \<O> \<R>.
       i < length ts\<^sub>s\<^sub>b' \<longrightarrow>
       ts\<^sub>s\<^sub>b' ! i =
       (p, is, xs, sb, \<D>, \<O>, \<R>) \<longrightarrow>
       sb = []


proof (prove)
using this:
  xs prefix of i
  \<lbrakk>?es prefix of ?i;
   ?m \<in> set (node_deliver_messages ?es)\<rbrakk>
  \<Longrightarrow> Deliver ?m \<in> set ?es

goal (1 subgoal):
 1. \<And>x51 x52 x53 x51a x52a x53a.
       \<lbrakk>(a, Store x51 x52 x53) \<in> set (node_deliver_messages xs);
        (x, Store x51a x52a x53a) \<in> set (node_deliver_messages xs);
        \<not> hb (a, Store x51 x52 x53) (x, Store x51a x52a x53a) \<and>
        \<not> hb (x, Store x51a x52a x53a) (a, Store x51 x52 x53);
        b = Store x51 x52 x53; y = Store x51a x52a x53a\<rbrakk>
       \<Longrightarrow> \<langle>Store x51 x52 x53\<rangle> \<rhd>
                         \<langle>Store x51a x52a x53a\<rangle> =
                         \<langle>Store x51a x52a x53a\<rangle> \<rhd>
                         \<langle>Store x51 x52 x53\<rangle>


proof (prove)
using this:
  d dvd b
  d dvd a

goal (1 subgoal):
 1. (\<And>u v.
        \<lbrakk>d * u = - b; d * v = a\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<exists>ts1'.
       \<tau>mRed1 (ls1, (ts1, m1), ws1, is1)
        (ls1, (ts1', m1), ws1, is1) \<and>
       (\<forall>t.
           no_\<tau>moves2 s2 t \<longrightarrow>
           no_\<tau>moves1 (ls1, (ts1', m1), ws1, is1) t) \<and>
       (ls1, (ts1', m1), ws1, is1) \<approx>m s2


proof (prove)
goal (1 subgoal):
 1. ((\<lambda>i. sup (X i) (Y i)) \<longlongrightarrow> sup x y) net


proof (state)
this:
  continuous_on (s - B) f

goal (1 subgoal):
 1. \<And>x B.
       \<lbrakk>x \<in> s; open B; x \<in> B\<rbrakk>
       \<Longrightarrow> \<exists>A.
                            open A \<and>
                            f x \<in> A \<and>
                            (\<forall>y\<in>s.
                                f y \<in> A \<longrightarrow> y \<in> B)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Order E; Order F; ord_isom D E f; ord_isom E F g\<rbrakk>
    \<Longrightarrow> ord_isom D F (compose (carrier D) g f)


proof (prove)
using this:
  \<Psi> (derive_right x) i1 < \<Psi> (derive_right x) i2
  snd x \<le> \<lbrakk>Final i2\<rbrakk> \<and>
  snd x \<le> \<lbrakk>Final i1\<rbrakk>
  is_interval x

goal (1 subgoal):
 1. \<Psi> x i1 < \<Psi> x i2


proof (state)
this:
  take k (replicate (Suc k) (2::?'a3)) = replicate k (2::?'a3)

goal (1 subgoal):
 1. partial_state.encode1 (replicate (Suc k) 2) {0..<k} i = i mod 2 ^ k


proof (prove)
goal (1 subgoal):
 1. \<And>a l h.
       (l < h \<Longrightarrow>
        mset (lran a (l + 1) h) = mset_ran a {l + 1..<h}) \<Longrightarrow>
       mset (if l < h then a l # lran a (l + 1) h else []) =
       mset_ran a {l..<h}


proof (prove)
goal (1 subgoal):
 1. ground\<^sub>l (flit_of_hlit l)


proof (prove)
goal (1 subgoal):
 1. rcvd (rho n) p
    \<in> SHOmsgVectors A r p (coarse_run rho r) (HOs r p) (SHOs r p)


proof (prove)
using this:
  d_IN j x' \<noteq> \<top>
  \<zeta> < \<top>
  d_IN (\<lambda>e. (if e \<in> set E then \<zeta> else 0) + j e) x' =
  \<zeta> * of_nat (card (set (filter (\<lambda>(y, x''). x'' = x') E))) +
  d_IN j x'

goal (1 subgoal):
 1. d_IN (\<lambda>e. (if e \<in> set E then \<zeta> else 0) + j e)
     x' \<noteq>
    \<top>


proof (prove)
goal (1 subgoal):
 1. \<forall>a b c.
       ideal_generated {a, b, c} = ideal_generated {1::'a} \<longrightarrow>
       (\<exists>p q.
           ideal_generated {p * a, p * b + q * c} = ideal_generated {1::'a})


proof (prove)
using this:
  (nfa_startnode A, q) \<in> (succsr (subset_succs A))\<^sup>*
  p \<in> set (subset_succs A q)

goal (1 subgoal):
 1. (nfa_startnode A, p) \<in> (succsr (subset_succs A))\<^sup>*


proof (prove)
using this:
  atom s1 \<sharp> (v, i, x, x')
  atom k1 \<sharp> (v, i, x, x', s1)
  atom s \<sharp> (v, i, x, x', k1, s1)
  atom k \<sharp> (v, i, x, x', s, k1, s1)

goal (1 subgoal):
 1. {SubstFormP v i x x'} \<turnstile> SubstFormP v i (Q_Neg x) (Q_Neg x')


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<in> carrier A; 0 \<le> m; n < 0; m * n \<le> 0;
     m \<noteq> 0\<rbrakk>
    \<Longrightarrow> aSum A (nat m) (aSum A (nat (- n)) (-\<^sub>a a)) =
                      aSum A (nat (- (m * n))) (-\<^sub>a a)


proof (prove)
goal (1 subgoal):
 1. \<And>l p.
       l \<noteq> [] \<Longrightarrow>
       <cs_list l
         p> cs_pop
             p <\<lambda>r.
                   case r of
                   (r, p') \<Rightarrow>
                     cs_list (tl l) p' * \<up> (r = hd l)>\<^sub>t


proof (prove)
goal (1 subgoal):
 1. cf_sol R S X X c \<Longrightarrow>
    snd c 0 = \<zero>\<^bsub>S\<^esub> \<and>
    snd c (Suc 0) = 1\<^sub>r\<^bsub>S\<^esub>


proof (prove)
goal (1 subgoal):
 1. (\<lambda>f. sum' f \<U>)
    \<in> Group.iso
           (subgroup_generated
             (sum_group \<U> (\<lambda>T. chain_group p (subtopology X T)))
             (carrier
               (sum_group \<U>
                 (\<lambda>T. chain_group p (subtopology X T))) \<inter>
              (\<Pi>\<^sub>E T\<in>\<U>.
                  singular_relcycle_set p (subtopology X T) {})))
           (subgroup_generated (chain_group p X)
             (singular_relcycle_set p X {}))


proof (prove)
goal (1 subgoal):
 1. ga.accept = local.sa.accept


proof (prove)
goal (1 subgoal):
 1. OFCLASS('a vec, show_class)


proof (prove)
goal (1 subgoal):
 1. small
     {b. \<exists>a\<in>elts A. [a, b]\<^sub>\<circ> \<in>\<^sub>\<circ> r}


proof (state)
this:
  \<guillemotleft>\<psi> : F f \<star>\<^sub>D
                           g' \<Rightarrow>\<^sub>D trg\<^sub>D
               (F f)\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>unit
                     (src\<^sub>C
                       g) : trg\<^sub>D
                             (F f) \<Rightarrow>\<^sub>D F
                    (trg\<^sub>C f)\<guillemotright>


proof (prove)
goal (1 subgoal):
 1. unstables r step start =
    sorted_list_of_set {p. succs p \<noteq> {} \<and> p < length start}


proof (prove)
using this:
  lossless_spmf p

goal (1 subgoal):
 1. P (GPV p)


proof (prove)
using this:
  thr'_invar (active_threads s)

goal (1 subgoal):
 1. \<alpha>.active_threads (state_\<alpha> s) = {}


proof (prove)
goal (1 subgoal):
 1. (\<turnstile> #c$ = #c &&&
     (\<And>f. \<turnstile> f<x>$ = f<x$>) &&&
     (\<And>f. \<turnstile> f<x, y>$ = f<x$, y$>)) &&&
    (\<And>f. \<turnstile> f<x, y, z>$ = f<x$, y$, z$>) &&&
    \<turnstile> (\<forall>x. P x)$ = (\<forall>x. P x$) &&&
    \<turnstile> (\<exists>x. P x)$ = (\<exists>x. P x$)


proof (prove)
using this:
  False

goal (1 subgoal):
 1. r \<in> RED \<sigma>


proof (prove)
using this:
  mat\<^sub>h C * mat\<^sub>h D = mat\<^sub>h (1\<^sub>m n)
  mat\<^sub>h D * mat\<^sub>h C = mat\<^sub>h (1\<^sub>m n)

goal (1 subgoal):
 1. {mat\<^sub>h (C * B * D), mat\<^sub>h B, mat\<^sub>h C, mat\<^sub>h D}
    \<subseteq> carrier_mat (dim_row (mat\<^sub>h (C * B * D)))
                 (dim_row (mat\<^sub>h (C * B * D))) \<and>
    mat\<^sub>h C * mat\<^sub>h D =
    1\<^sub>m (dim_row (mat\<^sub>h (C * B * D))) \<and>
    mat\<^sub>h D * mat\<^sub>h C =
    1\<^sub>m (dim_row (mat\<^sub>h (C * B * D))) \<and>
    mat\<^sub>h (C * B * D) = mat\<^sub>h C * mat\<^sub>h B * mat\<^sub>h D


proof (prove)
goal (1 subgoal):
 1. field (image_ring f R)


proof (prove)
using this:
  length x2 \<le> length tss
  length ts' \<le> length x2

goal (1 subgoal):
 1. length ts' < length (a # tss)


proof (prove)
goal (1 subgoal):
 1. monad_altc3 local.return_env local.bind_env local.altc_env


proof (prove)
goal (1 subgoal):
 1. pderiv p = q * pderiv (p div q) + p div q * pderiv q


proof (state)
this:
  coprime q1 q2
  coprime q3 q4

goal (1 subgoal):
 1. \<lbrakk>0 < a; 0 < b; 0 < c; 0 < d; coprime a c; coprime b d\<rbrakk>
    \<Longrightarrow> gcd (a * b) (c * d) = gcd a d * gcd b c


proof (prove)
goal (1 subgoal):
 1. wf\<^sub>s\<^sub>t X A'


proof (prove)
goal (1 subgoal):
 1. \<forall>T' A'.
       lb T' A' (Suc j) \<longrightarrow>
       real
        (makespan (T(min\<^sub>k T m := T (min\<^sub>k T m) + t (Suc j))))
       \<le> 3 / 2 * real (makespan T')


proof (state)
this:
  (\<Sum>n. moebius_mu n / (real n)\<^sup>2) = 6 / pi\<^sup>2

goal (1 subgoal):
 1. (\<lambda>n. moebius_mu n / real (n\<^sup>2)) sums (6 / pi\<^sup>2)


proof (prove)
goal (1 subgoal):
 1. sum fi L = 1


proof (prove)
goal (1 subgoal):
 1. \<And>y. \<exists>x. y = mset x


proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at x0 within S.
       return_time p2 (poincare_map p1 x) + return_time p1 x =
       return_time p2 x


proof (prove)
goal (1 subgoal):
 1. [a].x \<in> ABS_set


proof (prove)
goal (1 subgoal):
 1. \<Sqinter> (f ` set xs) = fold ((\<sqinter>) \<circ> f) xs \<top>


proof (prove)
goal (1 subgoal):
 1. ([], Y) \<in> futures Q []


proof (prove)
using this:
  sim_det_def.perfect_sec_P2 R2_OT12 S2_OT12 ?funct_OT12.0 (?m0.0, ?m1.0)
   ?\<sigma>
  OT_12_sim.perfect_sec_P2 ?m1.0 ?m2.0 \<equiv>
  R2_OT12 ?m1.0 ?m2.0 =
  funct_OT_12 ?m1.0 ?m2.0 \<bind> (\<lambda>(s1, s2). S2_OT12 ?m2.0 s2)

goal (1 subgoal):
 1. R2_OT12 (m0, m1) \<sigma> =
    funct_OT_12 (m0, m1) \<sigma> \<bind>
    (\<lambda>(out1, out2). S2_OT12 \<sigma> out2)


proof (prove)
goal (1 subgoal):
 1. (\<not> eval
             (And (fm.Atom (Leq (A * B)))
               (fm.Atom (Eq (A\<^sup>2 - B\<^sup>2 * c))))
             (L[var := sqrt Cv])) =
    eval
     (Or (fm.Atom (Less (- A * B)))
       (fm.Atom (Neq (A\<^sup>2 - B\<^sup>2 * c))))
     (L[var := sqrt Cv])


proof (prove)
goal (1 subgoal):
 1. ((if hasLR urp1_alice 1 \<Sigma>0 then \<lfloor>allow ()\<rfloor>
      else \<lfloor>deny ()\<rfloor>) =
     \<bottom>) =
    False


proof (prove)
goal (1 subgoal):
 1. u \<in> gureachable A w v


proof (prove)
using this:
  nprv F (subst \<phi> t x)

goal (1 subgoal):
 1. nprv F \<psi>


proof (prove)
goal (1 subgoal):
 1. map f {} {}


proof (prove)
using this:
  \<exists>W.
     W \<in> I \<and>
     W \<subseteq> U \<and>
     W \<subseteq> U' \<and>
     \<rho> U W \<zero>\<^bsub>U\<^esub> =
     \<rho> U' W \<zero>\<^bsub>U'\<^esub>
  \<zero>\<^bsub>U\<^esub> \<in> \<FF> U
  \<zero>\<^bsub>U'\<^esub> \<in> \<FF> U'
  U \<in> I
  U' \<in> I

goal (1 subgoal):
 1. (U, \<zero>\<^bsub>U\<^esub>) \<sim> (U', \<zero>\<^bsub>U'\<^esub>)


proof (prove)
using this:
  x \<in> auto G
  y \<in> auto G

goal (1 subgoal):
 1. x \<otimes>\<^bsub>BijGroup (carrier G)\<^esub> y \<in> auto G


proof (prove)
goal (12 subgoals):
 1. \<And>a b c.
       \<lbrakk>\<forall>k\<in>I. Ring (A k);
        a \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A);
        b \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A);
        c \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A)\<rbrakk>
       \<Longrightarrow> a \<plusminus>\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                         b \<plusminus>\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                         c =
                         a \<plusminus>\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                         (b \<plusminus>\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                          c)
 2. \<And>a b.
       \<lbrakk>\<forall>k\<in>I. Ring (A k);
        a \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A);
        b \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A)\<rbrakk>
       \<Longrightarrow> a \<plusminus>\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                         b =
                         b \<plusminus>\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                         a
 3. \<forall>k\<in>I. Ring (A k) \<Longrightarrow>
    mop (r\<Pi>\<^bsub>I\<^esub> A)
    \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A) \<rightarrow>
          carrier (r\<Pi>\<^bsub>I\<^esub> A)
 4. \<And>a.
       \<lbrakk>\<forall>k\<in>I. Ring (A k);
        a \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A)\<rbrakk>
       \<Longrightarrow> -\<^sub>a\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub> a \<plusminus>\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                         a =
                         \<zero>\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
 5. \<forall>k\<in>I. Ring (A k) \<Longrightarrow>
    \<zero>\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
    \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A)
 6. \<And>a.
       \<lbrakk>\<forall>k\<in>I. Ring (A k);
        a \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A)\<rbrakk>
       \<Longrightarrow> \<zero>\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub> \<plusminus>\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                         a =
                         a
 7. \<forall>k\<in>I. Ring (A k) \<Longrightarrow>
    (\<cdot>\<^sub>r\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>)
    \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A) \<rightarrow>
          carrier (r\<Pi>\<^bsub>I\<^esub> A) \<rightarrow>
          carrier (r\<Pi>\<^bsub>I\<^esub> A)
 8. \<And>a b c.
       \<lbrakk>\<forall>k\<in>I. Ring (A k);
        a \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A);
        b \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A);
        c \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A)\<rbrakk>
       \<Longrightarrow> a \<cdot>\<^sub>r\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                         b \<cdot>\<^sub>r\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                         c =
                         a \<cdot>\<^sub>r\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                         (b \<cdot>\<^sub>r\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                          c)
 9. \<And>a b.
       \<lbrakk>\<forall>k\<in>I. Ring (A k);
        a \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A);
        b \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A)\<rbrakk>
       \<Longrightarrow> a \<cdot>\<^sub>r\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                         b =
                         b \<cdot>\<^sub>r\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
                         a
 10. \<forall>k\<in>I. Ring (A k) \<Longrightarrow>
     1\<^sub>r\<^bsub>r\<Pi>\<^bsub>I\<^esub> A\<^esub>
     \<in> carrier (r\<Pi>\<^bsub>I\<^esub> A)
A total of 12 subgoals...


proof (prove)
using this:
  ct_suffix ts' (map TSome ts)
  \<forall>cs csa.
     \<not> ct_suffix cs csa \<or>
     csa = ccs cs csa @ ccsa cs csa \<and> ct_list_eq (ccsa cs csa) cs

goal (1 subgoal):
 1. take (length (map TSome ts) - length (ccsa ts' (map TSome ts)))
     (map TSome ts) @
    ccsa ts' (map TSome ts) =
    map TSome ts


proof (prove)
using this:
  wtA at
  I.wtE (kE \<xi>)

goal (1 subgoal):
 1. I.satA (kE \<xi>) at = F.satA \<xi> at


proof (prove)
goal (1 subgoal):
 1. ring
     (S\<lparr>carrier :=
                 (\<lambda>X. the_elem (h ` X)) `
                 carrier (R Quot a_kernel R S h),
          zero :=
            the_elem
             (h ` \<zero>\<^bsub>R Quot a_kernel R S h\<^esub>)\<rparr>)


proof (prove)
goal (1 subgoal):
 1. (\<And>m'. m = fmmap f m' \<Longrightarrow> thesis) \<Longrightarrow>
    fmmap id m = fmmap (f \<circ> inv f) m


proof (state)
this:
  t obs = t obs'

goal (1 subgoal):
 1. \<I>( fst ; OB ) = \<I>( fst ; t \<circ> OB )


proof (prove)
using this:
  \<a>[k\<^sup>*, h, u] \<cdot>
  ((k\<^sup>* \<star> h) \<star> \<theta>) \<cdot>
  \<a>[k\<^sup>* \<star> h, p\<^sub>0, w] \<cdot> (tab \<star> w) =
  \<a>[k\<^sup>*, h, u] \<cdot>
  ((k\<^sup>* \<star> h) \<star> \<theta>') \<cdot>
  \<a>[k\<^sup>* \<star> h, p\<^sub>0, w'] \<cdot>
  (tab \<star> w') \<cdot> \<beta>
  seq \<a>[k\<^sup>*, h, u]
   (((k\<^sup>* \<star> h) \<star> \<theta>) \<cdot>
    \<a>[k\<^sup>* \<star> h, p\<^sub>0, w] \<cdot> (tab \<star> w))
  seq \<a>[k\<^sup>*, h, u]
   ((((k\<^sup>* \<star> h) \<star> \<theta>') \<cdot>
     \<a>[k\<^sup>* \<star> h, p\<^sub>0, w'] \<cdot>
     (tab \<star> w')) \<cdot>
    \<beta>)
  ide u
  ide v
  src p\<^sub>0 = trg w
  ide w
  ide w'
  \<guillemotleft>\<beta> : p\<^sub>1 \<star>
                            w \<Rightarrow> p\<^sub>1 \<star>
      w'\<guillemotright>
  trg k\<^sup>* = src k
  src k\<^sup>* = trg k
  trg h = trg k
  \<lbrakk>ide ?f; ide ?g; ide ?h; src ?f = trg ?g; src ?g = trg ?h\<rbrakk>
  \<Longrightarrow> local.iso \<a>[?f, ?g, ?h]
  local.iso ?f \<Longrightarrow> section ?f
  section ?g \<Longrightarrow> local.mono ?g
  \<lbrakk>local.mono \<a>[k\<^sup>*, h, u];
   seq \<a>[k\<^sup>*, h, u]
    (((k\<^sup>* \<star> h) \<star> \<theta>) \<cdot>
     \<a>[k\<^sup>* \<star> h, p\<^sub>0, w] \<cdot> (tab \<star> w));
   seq \<a>[k\<^sup>*, h, u]
    ((((k\<^sup>* \<star> h) \<star> \<theta>') \<cdot>
      \<a>[k\<^sup>* \<star> h, p\<^sub>0, w'] \<cdot>
      (tab \<star> w')) \<cdot>
     \<beta>);
   \<a>[k\<^sup>*, h, u] \<cdot>
   ((k\<^sup>* \<star> h) \<star> \<theta>) \<cdot>
   \<a>[k\<^sup>* \<star> h, p\<^sub>0, w] \<cdot> (tab \<star> w) =
   \<a>[k\<^sup>*, h, u] \<cdot>
   (((k\<^sup>* \<star> h) \<star> \<theta>') \<cdot>
    \<a>[k\<^sup>* \<star> h, p\<^sub>0, w'] \<cdot>
    (tab \<star> w')) \<cdot>
   \<beta>\<rbrakk>
  \<Longrightarrow> (((k\<^sup>* \<star> h) \<star> \<theta>') \<cdot>
                     \<a>[k\<^sup>* \<star> h, p\<^sub>0, w'] \<cdot>
                     (tab \<star> w')) \<cdot>
                    \<beta> =
                    ((k\<^sup>* \<star> h) \<star> \<theta>) \<cdot>
                    \<a>[k\<^sup>* \<star> h, p\<^sub>0, w] \<cdot>
                    (tab \<star> w)
  (?h \<cdot> ?g) \<cdot> ?f = ?h \<cdot> ?g \<cdot> ?f

goal (1 subgoal):
 1. ((k\<^sup>* \<star> h) \<star> \<theta>) \<cdot>
    \<a>[k\<^sup>* \<star> h, p\<^sub>0, w] \<cdot> (tab \<star> w) =
    (((k\<^sup>* \<star> h) \<star> \<theta>') \<cdot>
     \<a>[k\<^sup>* \<star> h, p\<^sub>0, w'] \<cdot>
     (tab \<star> w')) \<cdot>
    \<beta>


proof (prove)
using this:
  \<Gamma> \<turnstile> a1 : t
  \<Gamma> \<turnstile> a2 : t
  \<Gamma> \<turnstile> s
  taval a1 s v1
  taval a2 s v2
  v1 = Rv x2_

goal (1 subgoal):
 1. \<exists>a. tbval (Less a1 a2) s a


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 < ab_; ab_ \<le> aa_; aa_ \<le> length b_;
     aa_ - Suc 0 < length b_; ab_ - Suc 0 < length b_\<rbrakk>
    \<Longrightarrow> last (take ab_ b_) # drop aa_ b_ =
                      drop (aa_ - Suc 0)
                       (b_[aa_ - Suc 0 := b_ ! (ab_ - Suc 0)])


proof (prove)
goal (1 subgoal):
 1. constructive_security
     (\<lambda>\<eta>.
         1\<^sub>C |\<^sub>=
         (CIPHER.enc \<eta> |\<^sub>= CIPHER.dec \<eta>) \<odot>
         parallel_wiring \<rhd>
         parallel_resource1_wiring \<rhd>
         CIPHER.KEY.res \<eta> \<parallel>
         (1\<^sub>C |\<^sub>= MAC.enm \<eta> |\<^sub>= MAC.dem \<eta> \<rhd>
          1\<^sub>C |\<^sub>= parallel_wiring \<rhd>
          parallel_resource1_wiring \<rhd>
          MAC.RO.res \<eta> \<parallel> INSEC.res))
     (\<lambda>_. SEC.res)
     (\<lambda>\<eta>.
         CNV Message_Authentication_Code.sim (Inl None) \<odot>
         CNV One_Time_Pad.sim None)
     (\<lambda>\<eta>.
         \<I>_uniform (Set.Collect (valid_mac_query \<eta>))
          (insert None
            (Some ` (nlists UNIV \<eta> \<times> nlists UNIV \<eta>))))
     (\<lambda>\<eta>. \<I>_uniform UNIV {None, Some \<eta>})
     (\<lambda>\<eta>.
         \<I>_uniform (nlists UNIV \<eta>) UNIV \<oplus>\<^sub>\<I>
         \<I>_uniform UNIV (insert None (Some ` nlists UNIV \<eta>)))
     (\<lambda>_. enat q) True
     (\<lambda>\<eta>.
         (id, map_option length) \<circ>\<^sub>w
         (insec_query_of, map_option snd))


proof (prove)
goal (1 subgoal):
 1. (D x, D y) \<notin> I


proof (prove)
using this:
  Tpows_v = map (\<lambda>S. S v) Tpows
  Tpows = map (VectorSpaceEnd.endpow V T) [0..<Suc (dim_R V)]
  set Tpows_v \<subseteq> V

goal (1 subgoal):
 1. \<not> R_lin_independent Tpows_v


proof (prove)
goal (1 subgoal):
 1. isCont cmod a


proof (prove)
using this:
  e = []

goal (1 subgoal):
 1. \<S>\<bullet>\<C> \<turnstile> e : ts _> ts'


proof (prove)
goal (1 subgoal):
 1. the_elem
     (Outside' {seller} `
      (argmax \<circ> sum)
       (summedBidVector
         (pseudoAllocation
           (randomEl
             (takeAll
               (\<lambda>x.
                   winningAllocationRel (N \<union> {seller}) (set \<Omega>)
                    ((\<in>) x) b)
               (allAllocationsAlg (N \<union> {seller}) \<Omega>))
             r) <|
          ((N \<union> {seller}) \<times> finestpart (set \<Omega>)))
         (N \<union> {seller}) (set \<Omega>))
       ((argmax \<circ> sum) b
         (allAllocations (N \<union> {seller}) (set \<Omega>)))) =
    Outside' {seller}
     (the_elem
       ((argmax \<circ> sum)
         (summedBidVector
           (pseudoAllocation
             (randomEl
               (takeAll
                 (\<lambda>x.
                     winningAllocationRel (N \<union> {seller})
                      (set \<Omega>) ((\<in>) x) b)
                 (allAllocationsAlg (N \<union> {seller}) \<Omega>))
               r) <|
            ((N \<union> {seller}) \<times> finestpart (set \<Omega>)))
           (N \<union> {seller}) (set \<Omega>))
         ((argmax \<circ> sum) b
           (allAllocations ({seller} \<union> N) (set \<Omega>)))))


proof (prove)
goal (1 subgoal):
 1. (SOME xi.
        xi \<in> Gromov_boundary \<and>
        Gromov_extension f xi = xi \<and> additive_strength f xi < 0)
    \<in> Gromov_boundary &&&
    Gromov_extension f
     (SOME xi.
         xi \<in> Gromov_boundary \<and>
         Gromov_extension f xi = xi \<and> additive_strength f xi < 0) =
    (SOME xi.
        xi \<in> Gromov_boundary \<and>
        Gromov_extension f xi = xi \<and> additive_strength f xi < 0) &&&
    additive_strength f
     (SOME xi.
         xi \<in> Gromov_boundary \<and>
         Gromov_extension f xi = xi \<and> additive_strength f xi < 0)
    < 0


proof (state)
this:
  (C * (A @\<^sub>r B))\<^sup>T = (A @\<^sub>r B)\<^sup>T * C\<^sup>T

goal (1 subgoal):
 1. C * (A @\<^sub>r B) = A @\<^sub>r D * B


proof (prove)
goal (1 subgoal):
 1. (?c, gcollapse_impl)
    \<in> node_rel \<rightarrow>
          \<langle>\<langle>nat_rel\<rangle>bs_set_rel\<rangle>as_rel \<times>\<^sub>r
          \<langle>node_rel\<rangle>as_rel \<times>\<^sub>r
          \<langle>nat_rel\<rangle>as_rel \<times>\<^sub>r
          oGSi_rel \<times>\<^sub>r
          \<langle>nat_rel \<times>\<^sub>r
                   \<langle>node_rel\<rangle>list_set_rel\<rangle>as_rel \<rightarrow>
          \<langle>\<langle>\<langle>nat_rel\<rangle>bs_set_rel\<rangle>as_rel \<times>\<^sub>r
                   \<langle>node_rel\<rangle>as_rel \<times>\<^sub>r
                   \<langle>nat_rel\<rangle>as_rel \<times>\<^sub>r
                   oGSi_rel \<times>\<^sub>r
                   \<langle>nat_rel \<times>\<^sub>r
                            \<langle>node_rel\<rangle>list_set_rel\<rangle>as_rel\<rangle>nres_rel


proof (prove)
goal (1 subgoal):
 1. pairwise orthogonal (insert (a - proj_onto a C) C)


proof (prove)
using this:
  \<forall>x y.
     x \<sqinter> g y = bot \<longrightarrow> f x \<sqinter> y = bot

goal (1 subgoal):
 1. conjugate f g


proof (prove)
goal (1 subgoal):
 1. wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (trms\<^sub>s\<^sub>t (to_st A))


proof (prove)
goal (1 subgoal):
 1. ContractsWithSubstitutesAndIRC X3d X3h PX3d CX3h


proof (prove)
goal (1 subgoal):
 1. \<forall>s.
       s \<in> P \<longrightarrow>
       (\<exists>Z.
           s \<in> I Z \<and>
           I Z \<inter> - b \<subseteq> Q \<and> A \<subseteq> A)


proof (prove)
using this:
  depth P = 0
  depth Q = 0
  uhnf P
  uhnf Q

goal (1 subgoal):
 1. P = \<zero> &&& Q = \<zero>


proof (prove)
using this:
  s \<in> sset ss
  x \<in> sset s

goal (1 subgoal):
 1. x \<in> sset (smerge ss)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>wf_prog wf_md P; (C, D) \<in> (subcls1 P)\<^sup>+\<rbrakk>
    \<Longrightarrow> C \<noteq> D


proof (prove)
goal (1 subgoal):
 1. GDERIV (\<lambda>x. k) x :> (0::'a)


proof (prove)
using this:
  xs \<in> set (map (\<lambda>x. [x]) l)

goal (1 subgoal):
 1. (\<And>x. xs = [x] \<Longrightarrow> thesis) \<Longrightarrow> thesis


proof (prove)
using this:
  charts_eucl \<subseteq> manifold_eucl.atlas ?k

goal (1 subgoal):
 1. chart_eucl \<in> manifold_eucl.atlas k


proof (prove)
using this:
  bound0 p

goal (1 subgoal):
 1. Ifm vs (x # bs) p = Ifm vs bs (decr0 p)


proof (prove)
goal (1 subgoal):
 1. (''z'' ::= (\<lambda>s. s ''x'')) ; (''x'' ::= (\<lambda>s. s ''y'')) ;
    (''y'' ::= (\<lambda>s. s ''z''))
    \<subseteq> rel_R
                 \<lceil>\<lambda>s. s ''x'' = a \<and> s ''y'' = b\<rceil>
                 \<lceil>\<lambda>s. s ''x'' = b \<and> s ''y'' = a\<rceil>


proof (prove)
goal (1 subgoal):
 1. (supto\<cdot>(MkI\<cdot>i)\<cdot>(MkI\<cdot>j) = [::]) = (j < i) &&&
    ([::] = supto\<cdot>(MkI\<cdot>i)\<cdot>(MkI\<cdot>j)) = (j < i)


proof (prove)
goal (1 subgoal):
 1. \<exists>n d e.
       Poly_Mapping.keys d
       \<subseteq> singular_simplex_set p (subtopology X (S - U)) \<and>
       Poly_Mapping.keys e
       \<subseteq> singular_simplex_set p (subtopology X T) \<and>
       (singular_subdivision p ^^ n) c = d + e


proof (prove)
goal (1 subgoal):
 1. FEval mo e
     (subst
       (\<lambda>v. case v of 0 \<Rightarrow> u | Suc n \<Rightarrow> n)
       A) =
    FEval mo (case_nat (e u) e) A


proof (prove)
goal (1 subgoal):
 1. fun_eq_on g f (\<Union> X) \<Longrightarrow>
    ChamberComplexMorphism X Y g


proof (prove)
goal (1 subgoal):
 1. quotient_map (prod_topology X Y) Y snd =
    (topspace X = {} \<longrightarrow> topspace Y = {})


proof (prove)
using this:
  ?P Perp2 ?A ?B ?C ?D \<equiv>
  \<exists>X Y. Col ?P X Y \<and> X Y Perp ?A ?B \<and> X Y Perp ?C ?D
  \<lbrakk>?A1.0 ?A2.0 Perp ?C1.0 ?C2.0;
   ?B1.0 ?B2.0 Perp ?C1.0 ?C2.0\<rbrakk>
  \<Longrightarrow> ?A1.0 ?A2.0 Par ?B1.0 ?B2.0
  ?A ?B Perp ?C ?D \<Longrightarrow>
  ?A ?B Perp ?C ?D \<and>
  ?B ?A Perp ?C ?D \<and>
  ?A ?B Perp ?D ?C \<and>
  ?B ?A Perp ?D ?C \<and>
  ?C ?D Perp ?A ?B \<and>
  ?C ?D Perp ?B ?A \<and> ?D ?C Perp ?A ?B \<and> ?D ?C Perp ?B ?A
  PO Perp2 A B C D

goal (1 subgoal):
 1. A B Par C D


proof (state)
this:
  cmp (a, a) =
  G (\<Phi>\<^sub>F (a, a)) \<cdot>\<^sub>D \<Phi>\<^sub>G (F a, F a)

goal (1 subgoal):
 1. (G (F.unit a) \<cdot>\<^sub>D G.unit (F.map\<^sub>0 a)) \<cdot>\<^sub>D
    \<i>\<^sub>D[map\<^sub>0 a] =
    (local.map \<i>\<^sub>B[a] \<cdot>\<^sub>D cmp (a, a)) \<cdot>\<^sub>D
    (G (F.unit a) \<cdot>\<^sub>D G.unit (F.map\<^sub>0 a) \<star>\<^sub>D
     G (F.unit a) \<cdot>\<^sub>D G.unit (F.map\<^sub>0 a))


proof (prove)
using this:
  geq_arg max

goal (1 subgoal):
 1. problem_plan_bound (snapshot PROB (fmrestrict_set vs s))
    \<le> wlp (\<lambda>x y. y \<in> state_successors (prob_proj PROB vs) x)
           (\<lambda>s. problem_plan_bound (snapshot PROB s)) max
           (\<lambda>x y. x + y + 1) (fmrestrict_set vs s) lss


proof (state)
goal (1 subgoal):
 1. simple_fw rs (p\<lparr>p_src := s1\<rparr>) =
    simple_fw rs (p\<lparr>p_src := s2\<rparr>) \<and>
    simple_fw rs (p\<lparr>p_dst := s1\<rparr>) =
    simple_fw rs (p\<lparr>p_dst := s2\<rparr>)


proof (prove)
goal (1 subgoal):
 1. right (Nonce N) = Nonce N


proof (prove)
goal (1 subgoal):
 1. Bag xs + Bag ys = Bag (join (\<lambda>x (n1, n2). n1 + n2) xs ys)


proof (prove)
using this:
  strict_mono r
  monoseq (X \<circ> r)

goal (1 subgoal):
 1. (\<forall>n m.
        m \<le> n \<longrightarrow>
        (X \<circ> r) m \<le> (X \<circ> r) n) \<or>
    (\<forall>n m.
        m \<le> n \<longrightarrow> (X \<circ> r) n \<le> (X \<circ> r) m)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>y \<le> x; z \<le> 0\<rbrakk>
    \<Longrightarrow> x * z \<le> y * z


proof (prove)
using this:
  \<iota>
  \<in> {uu_.
         \<exists>CAs DA AAs As \<sigma> E.
            uu_ = Infer (CAs @ [DA]) E \<and>
            ord_resolve_rename S CAs DA AAs As \<sigma> E}

goal (1 subgoal):
 1. (\<And>CAs AAs As \<sigma>.
        \<lbrakk>ord_resolve_rename S CAs (main_prem_of \<iota>) AAs As
                  \<sigma> (concl_of \<iota>);
         CAs = side_prems_of \<iota>\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. functor (\<cdot>) C S.map


proof (prove)
goal (2 subgoals):
 1. \<And>x1a x2a A t m n S1 t1 m1 S2.
       \<lbrakk>W x2a (gen ($ S1 A) t1 # $ S1 A) m1 = Some (S2, t, m);
        W x1a A n = Some (S1, t1, m1); new_tv n A;
        new_tv m1 (gen ($ S1 A) t1 # $ S1 A) \<longrightarrow>
        Some (S2, t, m) =
        W x2a (gen ($ S1 A) t1 # $ S1 A) m1 \<longrightarrow>
        $ S2 (gen ($ S1 A) t1 # $ S1 A) |- x2a :: t;
        new_tv m1 S1 \<and> new_tv m1 t1\<rbrakk>
       \<Longrightarrow> $ S2 (gen ($ S1 A) t1 # $ S1 A) |- x2a :: t
 2. \<And>x1a x2a A t m n S1 t1 m1 S2.
       \<lbrakk>\<forall>A S t m n.
                   new_tv n A \<longrightarrow>
                   Some (S, t, m) = W x1a A n \<longrightarrow>
                   $ S A |- x1a :: t;
        \<forall>A S t m n.
           new_tv n A \<longrightarrow>
           Some (S, t, m) = W x2a A n \<longrightarrow> $ S A |- x2a :: t;
        W x2a (gen ($ S1 A) t1 # $ S1 A) m1 = Some (S2, t, m);
        W x1a A n = Some (S1, t1, m1); new_tv n A\<rbrakk>
       \<Longrightarrow> free_tv S2 \<inter>
                         (free_tv t1 - free_tv ($ S1 A)) =
                         {}


proof (prove)
using this:
  \<exists>\<G>\<subseteq>\<^bold>G (G \<phi>).
     G \<phi> \<in> \<G> \<and>
     (\<forall>\<psi>.
         G \<psi> \<in> \<G> \<longrightarrow>
         accept\<^sub>R
          (semi_mojmir_def.step \<Sigma> \<up>af\<^sub>G (Abs \<psi>),
           semi_mojmir_def.initial (Abs \<psi>),
           {(mojmir_to_rabin_def.fail\<^sub>R \<Sigma> \<up>af\<^sub>G
              (Abs \<psi>) {q. \<G> \<Turnstile>\<^sub>P Rep q} \<union>
             mojmir_to_rabin_def.merge\<^sub>R \<up>af\<^sub>G (Abs \<psi>)
              {q. \<G> \<Turnstile>\<^sub>P Rep q} i,
             mojmir_to_rabin_def.succeed\<^sub>R \<up>af\<^sub>G
              (Abs \<psi>) {q. \<G> \<Turnstile>\<^sub>P Rep q} i) |
            i. i < semi_mojmir_def.max_rank \<Sigma> \<up>af\<^sub>G
                    (Abs \<psi>)})
          w)

goal (1 subgoal):
 1. (\<And>\<G>.
        \<lbrakk>\<G> \<subseteq> \<^bold>G (G \<phi>); G \<phi> \<in> \<G>;
         \<forall>\<psi>.
            G \<psi> \<in> \<G> \<longrightarrow>
            accept\<^sub>R
             (semi_mojmir_def.step \<Sigma> \<up>af\<^sub>G (Abs \<psi>),
              semi_mojmir_def.initial (Abs \<psi>),
              {(mojmir_to_rabin_def.fail\<^sub>R \<Sigma> \<up>af\<^sub>G
                 (Abs \<psi>) {q. \<G> \<Turnstile>\<^sub>P Rep q} \<union>
                mojmir_to_rabin_def.merge\<^sub>R \<up>af\<^sub>G
                 (Abs \<psi>) {q. \<G> \<Turnstile>\<^sub>P Rep q} i,
                mojmir_to_rabin_def.succeed\<^sub>R \<up>af\<^sub>G
                 (Abs \<psi>) {q. \<G> \<Turnstile>\<^sub>P Rep q} i) |
               i. i < semi_mojmir_def.max_rank \<Sigma> \<up>af\<^sub>G
                       (Abs \<psi>)})
             w\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. class.linorder le lt


proof (prove)
goal (1 subgoal):
 1. (\<forall>x y z.
        (x, y) \<in> Id_on A \<and> (x, z) \<in> Id_on A \<longrightarrow>
        y = z) \<and>
    (\<forall>x y z.
        (x, z) \<in> Id_on A \<and> (y, z) \<in> Id_on A \<longrightarrow>
        x = y)


proof (prove)
using this:
  primitive (Polynomial.monom 1 1) \<and>
  monic (Polynomial.monom 1 1) \<and> degree (Polynomial.monom 1 1) = 1
  (?fi, ?i) \<in> set hs \<Longrightarrow>
  content ?fi = 1 \<and> 0 < lead_coeff ?fi

goal (1 subgoal):
 1. (fi, i)
    \<in> set (if n = 0 then hs
               else (Polynomial.monom 1 1, n - 1) # hs) \<Longrightarrow>
    primitive fi \<and> 0 < lead_coeff fi


proof (prove)
goal (1 subgoal):
 1. a - b \<in> I


proof (prove)
using this:
  k \<le> m
  cond_B x

goal (1 subgoal):
 1. take k a \<bullet> take k x
    \<le> b \<bullet> map (max_y (take k x)) [0..<n]


proof (prove)
goal (1 subgoal):
 1. (c \<noteq> (0::'b) \<Longrightarrow>
     has_bochner_integral M f x) \<Longrightarrow>
    has_bochner_integral M (\<lambda>x. f x / c) (x / c)


proof (prove)
using this:
  finite X
  top_on\<^sub>o (Some x_) (- X)
  top_on\<^sub>o (Some y_) (- X)
  Some x_ \<le> Some y_

goal (1 subgoal):
 1. m\<^sub>o (Some y_) X \<le> m\<^sub>o (Some x_) X


proof (prove)
using this:
  atom i \<sharp> t

goal (1 subgoal):
 1. H \<turnstile> t SUBS t


proof (prove)
goal (1 subgoal):
 1. unit_ball_vol (real (2 * n)) = pi ^ n / fact n


proof (prove)
goal (1 subgoal):
 1. {ys'.
     \<exists>ys.
        xs @ ys \<in> traces P \<and>
        ys' = filter (\<lambda>y. L y = Low) ys}
    \<subseteq> {ys'.
                 \<exists>ys.
                    xs @ x # ys \<in> traces P \<and>
                    ys' = filter (\<lambda>y. L y = Low) ys}


proof (prove)
goal (1 subgoal):
 1. fls_X_intpow i / fls_X_intpow j = fls_X_intpow (i - j)


proof (prove)
goal (1 subgoal):
 1. find_fund_sol D = (if is_square D then (0, 0) else pell.fund_sol D)


proof (prove)
goal (1 subgoal):
 1. sample_uniform q \<bind>
    (\<lambda>b.
        sample_uniform q \<bind>
        (\<lambda>r.
            sample_uniform q \<bind>
            (\<lambda>e2.
                let s1 = (x * ((y + (q - b)) mod q) + (q - r)) mod q;
                    s2 = (x * y + (q - s1)) mod q;
                    d2 = ((e2 + q - x) mod q * b + (q - r)) mod q
                in return_spmf ((y, b, d2, e2), s1, s2)))) =
    sample_uniform q \<bind>
    (\<lambda>b.
        sample_uniform q \<bind>
        (\<lambda>r.
            sample_uniform q \<bind>
            (\<lambda>e2.
                let s1 = (x * ((y + (q - b)) mod q) + (q - r)) mod q;
                    s2 = (x * y + (q - s1)) mod q;
                    d2 = (e2 * b + (q - s2)) mod q
                in return_spmf ((y, b, d2, e2), s1, s2))))


proof (prove)
using this:
  \<nexists>f. f 0 \<in> X \<and> (\<forall>i. (f i, f (Suc i)) \<in> r)
  WCR_on r
   {x. \<nexists>f.
          f 0 \<in> {x} \<and> (\<forall>i. (f i, f (Suc i)) \<in> r)}
  x \<in> X

goal (1 subgoal):
 1. \<nexists>f. f 0 \<in> {x} \<and> (\<forall>i. (f i, f (Suc i)) \<in> r)


proof (prove)
using this:
  ts'' = ts @ [typeof v']

goal (1 subgoal):
 1. typeof v = typeof v' &&& ts' = ts


proof (prove)
using this:
  ?p2 \<in> RED \<sigma> \<Longrightarrow>
  SN ([?p2] \<star> [x]t\<ggreater>K)

goal (1 subgoal):
 1. [x]t\<ggreater>K \<in> SRED \<sigma>


proof (prove)
goal (1 subgoal):
 1. f x \<noteq> f y


proof (prove)
goal (1 subgoal):
 1. compat r r id


proof (prove)
using this:
  qReachable cfg1 Q cfg2
  p \<notin> Q

goal (1 subgoal):
 1. states cfg1 p = states cfg2 p


proof (prove)
goal (1 subgoal):
 1. homotopic_with_canon (\<lambda>f. True) T U (g \<circ> id)
     (g \<circ> (\<lambda>x. b))


proof (prove)
using this:
  inner_aforms' p XS (map pdevs_of_real rs) = Some R

goal (1 subgoal):
 1. approx_slp_outer p (Suc 0)
     [inner_floatariths (map floatarith.Var [0..<length XS])
       (map floatarith.Var [length XS..<length XS + length rs])]
     (XS @ map pdevs_of_real rs) =
    Some R


proof (prove)
goal (1 subgoal):
 1. prappend_signed_list (map (\<lambda>s. (s, b)) xs)
     (map (\<lambda>s. (s, b)) ys) =
    map (\<lambda>s. (s, b)) xs @ map (\<lambda>s. (s, b)) ys


proof (prove)
using this:
  term_ok \<Theta> (mk_eq (Abs \<tau> (t $ Bv 0)) (decr 0 t))
  typ_of (mk_eq (Abs \<tau> (t $ Bv 0)) (decr 0 t)) = Some propT
  wf_term (sig \<Theta>) t
  \<turnstile>\<^sub>\<tau> t : \<tau> \<rightarrow> \<tau>'
  \<turnstile>\<^sub>\<tau> ?t : ?ty \<Longrightarrow> is_closed ?t
  term_ok ?\<Theta> ?t \<Longrightarrow> subst_bv ?u ?t = ?t
  is_closed ?t \<Longrightarrow> subst_bv ?u ?t = ?t

goal (1 subgoal):
 1. typ_of (mk_eq (Abs \<tau> (t $ Bv 0)) t) = Some propT \<and>
    term_ok \<Theta> (mk_eq (Abs \<tau> (t $ Bv 0)) t)


proof (prove)
goal (1 subgoal):
 1. P a\<^sub>1 \<Longrightarrow> P a\<^sub>2


proof (prove)
goal (1 subgoal):
 1. (\<And>C.
        \<lbrakk>countable C; C \<subseteq> K;
         pairwise
          (\<lambda>i j. disjnt (cball (a i) (r i)) (cball (a j) (r j))) C;
         negligible (S - (\<Union>i\<in>C. cball (a i) (r i)))\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. homotopic_loops S g h


proof (prove)
goal (1 subgoal):
 1. \<Union> (partGen P) = \<Union> P


proof (prove)
goal (1 subgoal):
 1. A $$ (if i' < i then i' else Suc i', if j' < j then j' else Suc j') =
    mat (dim_row A - 1) (dim_col A - 1)
     (\<lambda>(i', j').
         A $$
         (if i' < i then i' else Suc i', if j' < j then j' else Suc j')) $$
    (i', j')


proof (prove)
using this:
  RETURN (dfs_impl3' cmpk succi v0i vdi)
  \<le> SPEC (\<lambda>r. r = ((src, tgt) \<in> E\<^sup>*))

goal (1 subgoal):
 1. dfs_impl3' cmpk succi v0i vdi = ((src, tgt) \<in> E\<^sup>*)


proof (prove)
using this:
  word_of_int (- (sint a div - sint b)) * b +
  word_of_int (sint a mod - sint b) =
  a

goal (1 subgoal):
 1. word_of_int (- (- sint a div sint b)) * b +
    word_of_int (- (- sint a mod sint b)) =
    a


proof (prove)
using this:
  f \<circ>\<^sub>A\<^bsub>\<BB>\<^esub> f = f

goal (1 subgoal):
 1. a \<in>\<^sub>\<circ> \<D>\<^sub>\<circ>
                           (\<BB>\<lparr>Comp\<rparr>) \<Longrightarrow>
    \<BB>\<lparr>Comp\<rparr>\<lparr>a\<rparr> =
    ZFC_in_HOL.set
     {\<langle>[f, f]\<^sub>\<circ>, f\<rangle>}\<lparr>a\<rparr>


proof (prove)
using this:
  out_arcs G v = out_arcs H v
  v \<in> verts G - verts H

goal (1 subgoal):
 1. del_vert_props G GM v


proof (prove)
goal (1 subgoal):
 1. cs\<^bsup>\<pi>\<^esup> k =
    map \<pi>
     (sorted_list_of_set {i. k cd\<^bsup>\<pi>\<^esup>\<rightarrow> i}) @
    [\<pi> k]


proof (prove)
goal (1 subgoal):
 1. f \<noteq> 0


proof (prove)
goal (1 subgoal):
 1. typeof v3 = t


proof (prove)
using this:
  (M, N) \<in> ns_mul_ext Id R

goal (1 subgoal):
 1. (\<And>X Z Y.
        \<lbrakk>M = X + Z; N = Y + Z;
         \<forall>y\<in>#Y. \<exists>x\<in>#X. (x, y) \<in> R\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<And>N.
       (N = 0 \<longrightarrow> 1 = fac N) \<and>
       (N \<noteq> 0 \<longrightarrow>
        N - 1 < N \<and>
        (\<forall>R.
            R = fac (N - 1) \<longrightarrow> N * fac (N - 1) = fac N))


proof (prove)
using this:
  x \<in> X

goal (1 subgoal):
 1. ind_mor_btw_stalks_axioms X x


proof (prove)
using this:
  indRelRPO \<subseteq> UNIV \<times> UNIV \<and>
  (\<forall>x\<in>UNIV. x \<lesssim>\<lbrakk>\<cdot>\<rbrakk>R x)

goal (1 subgoal):
 1. P \<lesssim>\<lbrakk>\<cdot>\<rbrakk>R P


proof (prove)
goal (1 subgoal):
 1. f \<circ> linepath a b = linepath (f a) (f b)


proof (prove)
using this:
  c < prod_list (nths (dims (dematricize rmodes A ds)) (- rmodes))

goal (1 subgoal):
 1. mat (prod_list (nths (dims (dematricize rmodes A ds)) rmodes))
     (prod_list (nths (dims (dematricize rmodes A ds)) (- rmodes)))
     (\<lambda>(r, c).
         lookup (dematricize rmodes A ds)
          (weave rmodes
            (digit_encode (nths (dims (dematricize rmodes A ds)) rmodes) r)
            (digit_encode (nths (dims (dematricize rmodes A ds)) (- rmodes))
              c))) $$
    (r, c) =
    A $$ (r, c)


proof (prove)
using this:
  AbstAtomic v i x x'

goal (1 subgoal):
 1. \<exists>A.
       x = \<lbrakk>quot_dbfm A\<rbrakk>e \<and>
       x' =
       \<lbrakk>quot_dbfm
                 (abst_dbfm (decode_Var v) (nat_of_ord i) A)\<rbrakk>e


proof (prove)
using this:
  finite {(u y - u x) / (f x - f y) |x y. x \<prec>[le] y \<and> f y < f x}

goal (1 subgoal):
 1. 0 < Min (insert 1
              {(u y - u x) / (f x - f y) |x y.
               x \<prec>[le] y \<and> f y < f x})


proof (prove)
using this:
   t \<longrightarrow>\<^sub>\<beta> t'
  \<Gamma> \<turnstile> t : T

goal (1 subgoal):
 1. \<Gamma> \<turnstile> t' : T


proof (prove)
using this:
  P (subtopology (prod_topology X Y) ({a} \<times> topspace Y))
  P (subtopology (prod_topology X Y) (topspace X \<times> {b}))
  X homeomorphic_space prod_topology X (subtopology Y {b})
  Y homeomorphic_space prod_topology (subtopology X {a}) Y

goal (1 subgoal):
 1. Q X \<and> R Y