proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>arb' x'.
                \<lbrakk>rpre arb' x';
                 (x', x_)
                 \<in> inv_image (finite_psupset local.reachable)
                        fst\<rbrakk>
                \<Longrightarrow> f x' \<le> SPEC (rpost arb' x');
     rpre S x_;
     REC\<^sub>T
      (\<lambda>dfs (V, v).
          if v = tgt then RETURN (V, True)
          else let V = insert v V
               in FOREACH\<^sub>C (E `` {v}) (\<lambda>(V, brk). \<not> brk)
                   (\<lambda>v' (V, brk).
                       if v' \<notin> V then dfs (V, v')
                       else RETURN (V, False))
                   (V, False)) =
     f;
     x_ = (V, v); v \<noteq> tgt\<rbrakk>
    \<Longrightarrow> FOREACH\<^sub>C (E `` {v})
                       (\<lambda>(V, brk). \<not> brk)
                       (\<lambda>v' (V, brk).
                           if v' \<notin> V then f (V, v')
                           else RETURN (V, False))
                       (insert v V, False)
                      \<le> SPEC (rpost S x_)


proof (prove)
using this:
  \<lbrakk>rel (gen_cong R) ?x2 ?y2; R \<le> ?R'2; local.cong ?R'2\<rbrakk>
  \<Longrightarrow> ?R'2 (eval ?x2) (eval ?y2)

goal (1 subgoal):
 1. local.cong (gen_cong R)


proof (prove)
using this:
  g \<in> injectionsUniverse
  x \<in> Domain g

goal (1 subgoal):
 1. g ,, x \<in> g `` {x}


proof (prove)
goal (1 subgoal):
 1. ts t = None \<Longrightarrow> init_fin_descend_thr ts t = None


proof (prove)
goal (1 subgoal):
 1. \<integral>\<^sup>+ generat.
                         integral\<^sup>N
                          (measure_spmf
                            (map_spmf (bad \<circ> snd)
                              (callee s (generat.output generat))))
                          (indicator {True}) +
                         ennreal k *
                         ennreal_of_enat
                          (if consider (generat.output generat) then n - 1
                           else n) *
                         integral\<^sup>N
                          (measure_spmf
                            (map_spmf (bad \<circ> snd)
                              (callee s (generat.output generat))))
                          (indicator {False})
                       \<partial>restrict_space (measure_spmf (the_gpv gpv))
                                  {IO out c |out c. True} =
    \<integral>\<^sup>+ generat.
                         ennreal
                          (spmf
                            (map_spmf (bad \<circ> snd)
                              (callee s (generat.output generat)))
                            True) +
                         ennreal k *
                         ennreal_of_enat
                          (if consider (generat.output generat) then n - 1
                           else n) *
                         ennreal
                          (spmf
                            (map_spmf (bad \<circ> snd)
                              (callee s (generat.output generat)))
                            False)
                       \<partial>restrict_space (measure_spmf (the_gpv gpv))
                                  {IO out c |out c. True}


proof (prove)
using this:
  \<lbrakk>\<lbrakk> \<Phi>_ \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L =
  \<lbrakk>\<lbrakk> remdups
                      \<Phi>_ \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L

goal (1 subgoal):
 1. \<lbrakk>\<lbrakk> a_ #
                       \<Phi>_ \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L =
    \<lbrakk>\<lbrakk> remdups
                        (a_ #
                         \<Phi>_) \<rbrakk>\<rbrakk>\<^sub>T\<^sub>E\<^sub>S\<^sub>L


proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valuation K v;
     x \<in> vp K v \<^bsup>\<diamondsuit>Vr K v n\<^esup>; 0 < an n;
     0 < n\<rbrakk>
    \<Longrightarrow> (an n = 0 \<longrightarrow>
                       x \<in> carrier (Vr K v)) \<and>
                      (an n \<noteq> 0 \<longrightarrow>
                       (an n = \<infinity> \<longrightarrow>
                        x = \<zero>\<^bsub>Vr K v\<^esub>) \<and>
                       (an n \<noteq> \<infinity> \<longrightarrow>
                        x \<in> vp K v
                                   \<^bsup>\<diamondsuit>Vr K
                    v na (an n)\<^esup>))
 2. \<lbrakk>valuation K v;
     x \<in> vp K v \<^bsup>\<diamondsuit>Vr K v n\<^esup>; 0 \<le> an n;
     an n \<le> n_val K v x\<rbrakk>
    \<Longrightarrow> an n \<le> n_val K v x


proof (prove)
using this:
  uniformly_continuous_on (range to_metric_completion) I

goal (1 subgoal):
 1. uniformly_continuous_on (range to_metric_completion)
     (\<lambda>x. f (I x))


proof (prove)
goal (1 subgoal):
 1. rel_reflects_binary_pred TRel (\<lambda>b. hasBarb b TWB)


proof (prove)
using this:
  v \<noteq> t
  isPath v p2 t

goal (1 subgoal):
 1. (\<And>w p2'.
        \<lbrakk>p2 = (v, w) # p2'; (v, w) \<in> E; isPath w p2' t\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  x = s2 !! n

goal (1 subgoal):
 1. sinterleave s1 s2 !! (2 * n + 1) = x


proof (prove)
using this:
  i \<le> n

goal (1 subgoal):
 1. X i -` {X i x} =
    (\<Union>z\<in>comp_proj_i X n i (X i x). proj_stoch_proc X n -` {z})


proof (prove)
using this:
  expr_sem_rf \<rho> e' \<in> space (stock_measure t')
  \<rho> \<in> space (state_measure V' \<Gamma>)

goal (1 subgoal):
 1. dens_ctxt_measure \<Y> \<rho> \<bind>
    (\<lambda>\<sigma>.
        expr_sem \<sigma> e \<bind>
        (\<lambda>x.
            return_val (op_sem oper <|x, expr_sem_rf \<sigma> e'|>))) =
    dens_ctxt_measure \<Y> \<rho> \<bind>
    (\<lambda>\<sigma>.
        expr_sem \<sigma> e \<bind>
        (\<lambda>x. return_val (op_sem oper <|x, expr_sem_rf \<rho> e'|>)))


proof (prove)
using this:
  x < y

goal (1 subgoal):
 1. \<exists>z>x. z < y


proof (prove)
goal (1 subgoal):
 1. \<bar>enn2ereal
           (emeasure (measure_spmf (map_spmf (\<lambda>x. (f x, bad x)) p))
             (A \<times> {False}) +
            \<integral>\<^sup>+ x. indicator (A \<times> {True})
                                    (f x, bad x)
                               \<partial>measure_spmf p) -
          enn2ereal
           (emeasure (measure_spmf (map_spmf (\<lambda>x. (f x, bad x)) q))
             (A \<times> {False}) +
            \<integral>\<^sup>+ x. indicator (A \<times> {True})
                                    (f x, bad x)
                               \<partial>measure_spmf q)\<bar> =
    \<bar>enn2ereal
           (\<integral>\<^sup>+ x. indicator (A \<times> {True})
                                    (f x, bad x)
                               \<partial>measure_spmf p) -
          enn2ereal
           (\<integral>\<^sup>+ x. indicator (A \<times> {True})
                                    (f x, bad x)
                               \<partial>measure_spmf q)\<bar>


proof (prove)
goal (1 subgoal):
 1. OFCLASS('a fps, euclidean_ring_gcd_class)


proof (prove)
goal (1 subgoal):
 1. {SV_inv3} TS.trans sv_TS {> SV_inv3}


proof (prove)
goal (1 subgoal):
 1. x \<in> S \<Longrightarrow> connected_component S x x


proof (prove)
goal (1 subgoal):
 1. while\<^sup>\<top> false do P od = II


proof (prove)
using this:
  CARD('b) \<le> CARD('a)

goal (1 subgoal):
 1. @@x = x


proof (prove)
using this:
  i < Monitor.progress \<sigma> (formula.Until \<phi>1 I \<phi>2)
       (plen \<pi>)

goal (1 subgoal):
 1. (\<And>b. right I = enat b \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<I>_trivial (\<I>\<^sub>1 \<oplus>\<^sub>\<I> \<I>\<^sub>2) =
    (\<I>_trivial \<I>\<^sub>1 \<and> \<I>_trivial \<I>\<^sub>2)


proof (prove)
goal (1 subgoal):
 1. finite
     (m' `
      (\<Union>x\<in>\<Union>
                      (intersecting `
                       V `
                       \<Union> (intersecting ` V ` intersecting (V k))).
          M (V x)))


proof (prove)
using this:
  gb_schema_aux_dom (data, bs, ps)

goal (1 subgoal):
 1. P data bs ps (gb_schema_aux data bs ps)


proof (prove)
goal (1 subgoal):
 1. bdd_below
     ((\<lambda>t. infdist (d t) {c A--c B}) -` {..D0} \<inter> {ty..B})


proof (prove)
goal (1 subgoal):
 1. bst t \<Longrightarrow> bst (delete x t)


proof (prove)
goal (1 subgoal):
 1. local.aligned\<^sub>d (Suc e) (local.encode (Suc e) (n div base))


proof (prove)
using this:
  p \<in> PrimRec1

goal (1 subgoal):
 1. (\<lambda>x y. p x) \<in> PrimRec2


proof (prove)
goal (1 subgoal):
 1. sin (z + of_real pi + of_real pi) = sin z


proof (prove)
using this:
  S.ide ?f \<Longrightarrow> S.lunit' ?f = ?f
  S.ide ?f \<Longrightarrow> S.runit ?f = ?f

goal (1 subgoal):
 1. S.lunit' (S.UP f) \<cdot>\<^sub>S S.runit (S.UP f) = S.UP f


proof (prove)
using this:
  \<not> 0 \<le> x

goal (1 subgoal):
 1. \<bar>ln (1 + x) - x\<bar> \<le> 2 * x\<^sup>2


proof (prove)
goal (1 subgoal):
 1. nondetM return bind merge cempty csingle cUn


proof (state)
this:
  t0 \<le> rt
  rt \<le> t1
  flow0 x rt \<in> P
  \<lbrakk>flow0 x ?t' \<in> P; t0 \<le> ?t'; ?t' \<le> t1\<rbrakk>
  \<Longrightarrow> rt \<le> ?t'

goal (1 subgoal):
 1. \<exists>!t.
       0 < t \<and>
       t \<in> existence_ivl0 x \<and>
       flow0 x t \<in> P \<and>
       (\<forall>s\<in>{0<..<t}. flow0 x s \<notin> P)


proof (prove)
using this:
  Gateway req dt a stop lose d ack i vc

goal (1 subgoal):
 1. GatewayReq req dt a stop lose d ack i vc


proof (prove)
using this:
  s' = fx0.tortoise_hare f x arbitrary
  properties f x ?lambda ?mu \<Longrightarrow>
  \<lbrace>\<lambda>s. True\<rbrace> fx0.tortoise_hare f x
  \<lbrace>\<lambda>s.
              nu s \<in> {0<..?lambda + ?mu} \<and>
              l s = ?lambda \<and> m s = ?mu\<rbrace>

goal (1 subgoal):
 1. fx0.properties f x (l s') (m s')


proof (prove)
goal (1 subgoal):
 1. real_of_int q * pa *
    (\<Sum>j. real_of_int (b (j + n + 1)) / real_of_int (a (j + n + 1)))
    \<le> real_of_int q * pa * 2 * real_of_int (b (n + 1)) /
          real_of_int (a (n + 1))


proof (prove)
goal (1 subgoal):
 1. (\<forall>x. - g x \<le> -  |R\<rangle> (\<lambda>y. - f y) x) =
    (\<forall>x.  |R\<rangle> (\<lambda>y. - f y) x \<le> g x)


proof (prove)
goal (1 subgoal):
 1. diamond_y_gen \<circ> x_coord piecewise_C1_differentiable_on {0..1}


proof (prove)
goal (1 subgoal):
 1. \<lbrace> (x, e1) # \<Gamma> \<rbrace>\<rho> \<sqsubseteq>
    \<lbrace> (x, e2) # \<Gamma> \<rbrace>\<rho>


proof (prove)
using this:
  finite I
  I \<noteq> {}
  i \<notin> I
  \<lbrakk>\<And>i. i \<in> I \<Longrightarrow> 0 < l i;
   \<And>i.
      i \<in> I \<Longrightarrow>
      distributed M lborel (X i)
       (\<lambda>x. ennreal (exponential_density (l i) x));
   indep_vars (\<lambda>i. borel) X I\<rbrakk>
  \<Longrightarrow> distributed M lborel (\<lambda>x. MIN i\<in>I. X i x)
                     (\<lambda>x. ennreal (exponential_density (sum l I) x))
  ?i12 \<in> insert i I \<Longrightarrow> 0 < l ?i12
  ?i12 \<in> insert i I \<Longrightarrow>
  distributed M lborel (X ?i12)
   (\<lambda>x. ennreal (exponential_density (l ?i12) x))
  indep_vars (\<lambda>i. borel) X (insert i I)

goal (1 subgoal):
 1. distributed M lborel (\<lambda>x. min (X i x) (MIN i\<in>I. X i x))
     (\<lambda>x. ennreal (exponential_density (l i + sum l I) x))


proof (prove)
goal (1 subgoal):
 1. (\<lambda>n. (\<Sum>i = 1..n. 1 / (real i)\<^sup>2) - T (real n))
    \<in> \<Theta>(\<lambda>n.
                      - S n -
                      EM_remainder (2 * Suc N + 1)
                       (\<lambda>x.
                           - fact (2 * Suc N + 2) / x ^ (2 * Suc N + 3))
                       (int n))


proof (prove)
goal (1 subgoal):
 1. (\<Sum>y\<in>set (Abs_State.dom S2) - set (Abs_State.dom S1).
       m_ivl (fun S2 y)) =
    0


proof (prove)
goal (1 subgoal):
 1. impl_of_RBT_HM hm_empty_const = HashMap_Impl.empty ()


proof (prove)
goal (1 subgoal):
 1. \<And>x xa.
       \<lbrakk>K1.enabled x1 x; K2.enabled x2 xa\<rbrakk>
       \<Longrightarrow> indicat_real
                          {\<omega>
                           \<in> space (stream_space (count_space UNIV)).
                           P1 (smap fst \<omega>) \<and>
                           P2 (smap snd \<omega>)}
                          (szip\<^sub>E x1 x2 (x, xa)) =
                         indicat_real
                          {\<omega>
                           \<in> space (stream_space (count_space UNIV)).
                           P1 \<omega>}
                          x *
                         indicat_real
                          {\<omega>
                           \<in> space (stream_space (count_space UNIV)).
                           P2 \<omega>}
                          xa


proof (prove)
using this:
  w \<noteq> (0::'w)
  S_reduced_for w ss
  S_reduced_for w ts
  x \<in> set ts
  S_reduced_for ?a ss \<Longrightarrow> ss \<in> lists S
  \<lbrakk>w \<noteq> (0::'w); S_reduced_for w ss;
   S_reduced_for w ?ts\<rbrakk>
  \<Longrightarrow> \<exists>xss. flip_altsublist_chain (ss # xss @ [?ts])
  \<lbrakk>?x \<in> lists S;
   flip_altsublist_chain (?x # ?zs @ [?y])\<rbrakk>
  \<Longrightarrow> set ?y = set ?x

goal (1 subgoal):
 1. x \<in> set ss


proof (prove)
goal (1 subgoal):
 1. C.seq \<pi>\<rho>.prj\<^sub>1
     (\<nu>_\<pi>\<rho>.prj\<^sub>0 \<cdot>
      \<langle>\<mu>_\<nu>_\<pi>\<rho>.Prj\<^sub>0\<^sub>1 \<lbrakk>\<nu>.leg0, \<pi>\<rho>.leg1\<rbrakk> \<mu>_\<nu>_\<pi>\<rho>.Prj\<^sub>0\<rangle>)


proof (prove)
goal (1 subgoal):
 1. snd (Rep_segment x) = fst (Rep_segment y) \<Longrightarrow>
    {ya.
     fst (Rep_segment x) \<le> ya \<and>
     ya \<le> fst (Rep_segment y)} \<union>
    {ya. fst (Rep_segment y) \<le> ya \<and> ya \<le> snd (Rep_segment y)} =
    {ya.
     fst (Rep_segment
           (Abs_segment (fst (Rep_segment x), snd (Rep_segment y))))
     \<le> ya \<and>
     ya \<le> snd (Rep_segment
                    (Abs_segment
                      (fst (Rep_segment x), snd (Rep_segment y))))}


proof (prove)
using this:
  ind_cca'.game \<A> = PRF.game_0 (reduction_prf \<A>)
  game2 \<A> = PRF.game_1 (reduction_prf \<A>)

goal (1 subgoal):
 1. \<bar>spmf (ind_cca'.game \<A>) True - spmf (game2 \<A>) True\<bar> =
    PRF.advantage (reduction_prf \<A>)


proof (prove)
using this:
  p = return_spmf (Inl (Some (a, m)), (), Store m)
  q = return_spmf (Store m, None, [m \<mapsto> a])
  length m = id' \<eta>
  query \<in> local.valid_insecQ <+> nlists UNIV (id' \<eta>) <+> UNIV
  state \<in> set_spmf q
  (answer, state')
  \<in> set_spmf
         ((local.lazy_channel_insec \<oplus>\<^sub>O
           lazy_channel_send \<oplus>\<^sub>O local.lazy_channel_recv_f)
           state query)
  query = Inl adv_query
  adv_query = ForwardOrEdit foe
  foe = Some am'

goal (1 subgoal):
 1. local.S'
     (cond_spmf_fst
       (p \<bind>
        (\<lambda>s.
            (callee_auth_channel sim \<oplus>\<^sub>O
             \<dagger>\<dagger>channel.send_oracle \<oplus>\<^sub>O
             \<dagger>\<dagger>channel.recv_oracle)
             s query))
       answer)
     (cond_spmf_fst
       (q \<bind>
        (\<lambda>s.
            (local.lazy_channel_insec \<oplus>\<^sub>O
             lazy_channel_send \<oplus>\<^sub>O local.lazy_channel_recv_f)
             s query))
       answer)


proof (prove)
using this:
  cmod (lead_coeff f) *
  (\<Prod>a\<leftarrow>complex_roots_complex f. max 1 (cmod a))
  \<le> l2norm_complex f

goal (1 subgoal):
 1. mahler_measure_poly f \<le> l2norm_complex f


proof (prove)
goal (1 subgoal):
 1. \<forall>x. f (\<Sqinter> x) = \<Sqinter> (f ` x) \<Longrightarrow>
    \<forall>x.
       (\<Sqinter>xa. f (fpower f xa x)) = (\<Sqinter>xa. fpower f xa (f x))


proof (prove)
goal (1 subgoal):
 1. (x \<in># product_mset A B) = (x \<in># A \<times># B)


proof (prove)
goal (1 subgoal):
 1. Bseq (\<lambda>n. \<Prod>i\<le>n. 1 + norm (f i - (1::'a)))


proof (prove)
using this:
  is_aligned w n

goal (1 subgoal):
 1. to_bl w = take (LENGTH('a) - n) (to_bl w) @ replicate n False


proof (prove)
goal (3 subgoals):
 1. \<And>n.
       \<lbrakk>i\<Pi>\<^bsub>R,n\<^esub> J =
                R \<diamondsuit>\<^sub>p mprod_expR R e f n;
        f \<in> {j. j \<le> Suc n} \<rightarrow> carrier R;
        \<forall>k\<le>Suc n.
           J k =
           R \<diamondsuit>\<^sub>p f k \<^bsup>\<diamondsuit>R e k\<^esup>;
        f \<in> {j. j \<le> n} \<rightarrow> carrier R;
        f (Suc n) \<in> carrier R;
        R \<diamondsuit>\<^sub>p f (Suc n)
           \<^bsup>\<diamondsuit>R e (Suc n)\<^esup> =
        R \<diamondsuit>\<^sub>p
        (f (Suc n)^\<^bsup>R e (Suc n)\<^esup>)\<rbrakk>
       \<Longrightarrow> mprod_expR R e f n \<in> carrier R
 2. \<And>n.
       \<lbrakk>i\<Pi>\<^bsub>R,n\<^esub> J =
                R \<diamondsuit>\<^sub>p mprod_expR R e f n;
        f \<in> {j. j \<le> Suc n} \<rightarrow> carrier R;
        \<forall>k\<le>Suc n.
           J k =
           R \<diamondsuit>\<^sub>p f k \<^bsup>\<diamondsuit>R e k\<^esup>;
        f \<in> {j. j \<le> n} \<rightarrow> carrier R;
        f (Suc n) \<in> carrier R;
        R \<diamondsuit>\<^sub>p f (Suc n)
           \<^bsup>\<diamondsuit>R e (Suc n)\<^esup> =
        R \<diamondsuit>\<^sub>p
        (f (Suc n)^\<^bsup>R e (Suc n)\<^esup>)\<rbrakk>
       \<Longrightarrow> f (Suc n)^\<^bsup>R e (Suc n)\<^esup>
                         \<in> carrier R
 3. \<And>n.
       \<lbrakk>i\<Pi>\<^bsub>R,n\<^esub> J =
                R \<diamondsuit>\<^sub>p mprod_expR R e f n;
        f \<in> {j. j \<le> Suc n} \<rightarrow> carrier R;
        \<forall>k\<le>Suc n.
           J k =
           R \<diamondsuit>\<^sub>p f k \<^bsup>\<diamondsuit>R e k\<^esup>;
        f \<in> {j. j \<le> n} \<rightarrow> carrier R;
        f (Suc n) \<in> carrier R;
        R \<diamondsuit>\<^sub>p f (Suc n)
           \<^bsup>\<diamondsuit>R e (Suc n)\<^esup> =
        R \<diamondsuit>\<^sub>p
        (f (Suc n)^\<^bsup>R e (Suc n)\<^esup>)\<rbrakk>
       \<Longrightarrow> R \<diamondsuit>\<^sub>p
                         mprod_expR R e f n \<diamondsuit>\<^sub>r
                         R \<diamondsuit>\<^sub>p f (Suc n)
                            \<^bsup>\<diamondsuit>R e (Suc n)\<^esup> =
                         R \<diamondsuit>\<^sub>p
                         mprod_expR R e f n \<diamondsuit>\<^sub>r
                         R \<diamondsuit>\<^sub>p
                         (f (Suc n)^\<^bsup>R e (Suc n)\<^esup>)


proof (prove)
goal (1 subgoal):
 1. composite_functor A B C F G


proof (prove)
using this:
  unitary_schur_decomposition A (e # es) = (C, P, Q)

goal (1 subgoal):
 1. C = four_block_mat A1 (A2 * P') A0 B &&&
    P =
    W *
    four_block_mat (1\<^sub>m 1) (0\<^sub>m 1 (n - 1)) (0\<^sub>m (n - 1) 1)
     P' &&&
    Q =
    four_block_mat (1\<^sub>m 1) (0\<^sub>m 1 (n - 1)) (0\<^sub>m (n - 1) 1)
     Q' *
    W'


proof (prove)
goal (1 subgoal):
 1. p \<bullet> (\<forall>x. P x) = (\<forall>x. (p \<bullet> P) x)


proof (prove)
using this:
  edge \<Delta> x y
  path \<Delta> y p z
  p \<noteq> [] \<Longrightarrow>
  path \<Gamma> (y, hd p) (zip p (tl p)) (last (y # butlast p), z)
  y # p \<noteq> []

goal (1 subgoal):
 1. path \<Gamma> (x, hd (y # p)) (zip (y # p) (tl (y # p)))
     (last (x # butlast (y # p)), z)


proof (prove)
using this:
  ?t1 \<in> tag ` \<G> \<Longrightarrow>
  Sigma_Algebra.measure lebesgue (BOX2 (\<eta> ?t1) ?t1) * 3 ^ DIM('a) =
  Sigma_Algebra.measure lebesgue (BOX (\<eta> ?t1) ?t1) * (2 * 3) ^ DIM('a)

goal (1 subgoal):
 1. Sigma_Algebra.measure lebesgue
     (\<Union>t\<in>tag ` \<G>. BOX2 (\<eta> t) t) *
    3 ^ DIM('a) =
    Sigma_Algebra.measure lebesgue
     (\<Union>t\<in>tag ` \<G>. BOX (\<eta> t) t) *
    6 ^ DIM('a)


proof (prove)
goal (1 subgoal):
 1. internals sig \<inter> externals sig = {}


proof (prove)
goal (1 subgoal):
 1. ldistinct ys \<Longrightarrow> ldistinct (lzip xs ys)


proof (prove)
using this:
  finite X
  card X \<le> 1
  F \<subseteq> P[X]
  f \<in> ideal F
  f \<noteq> 0
  g \<in> punit.reduced_GB F

goal (1 subgoal):
 1. poly_deg g \<le> poly_deg f


proof (prove)
using this:
  singleCombinators p \<longrightarrow>
  distinct p \<longrightarrow>
  allNetsDistinct p \<longrightarrow>
  wellformed_policy1 p \<longrightarrow>
  wellformed_policy2Pr p \<longrightarrow> wellformed_policy3Pr p

goal (1 subgoal):
 1. singleCombinators (a # p) \<longrightarrow>
    distinct (a # p) \<longrightarrow>
    allNetsDistinct (a # p) \<longrightarrow>
    wellformed_policy1 (a # p) \<longrightarrow>
    wellformed_policy2Pr (a # p) \<longrightarrow>
    wellformed_policy3Pr (a # p)


proof (prove)
using this:
  igFresh MOD xs y X
  igFresh MOD xs y X'
  igSwap MOD xs y x X = igSwap MOD xs y x' X'
  igWls MOD s X
  igWls MOD s X'
  \<forall>xs x x' y s X X'.
     isInBar (xs, s) \<and>
     igWls MOD s X \<and> igWls MOD s X' \<longrightarrow>
     igFresh MOD xs y X \<and>
     igFresh MOD xs y X' \<and>
     igSwap MOD xs y x X = igSwap MOD xs y x' X' \<longrightarrow>
     igAbs MOD xs x X = igAbs MOD xs x' X'
  isInBar (xs, s)

goal (1 subgoal):
 1. eAbs MOD xs x (OK X) = eAbs MOD xs x' (OK X')


proof (prove)
using this:
  fst e' = last_state e

goal (1 subgoal):
 1. last_state (append_exec e e') = last_state e'


proof (prove)
using this:
  f \<in> diff_fun_space
  g \<in> diff_fun_space

goal (1 subgoal):
 1. f + g \<in> diff_fun_space


proof (prove)
using this:
  finite X

goal (1 subgoal):
 1. MiscTools.sum' f (X \<inter> Domain f) = MiscTools.sum' f X


proof (prove)
using this:
  v0 \<rightarrow> hd R'
  v0 \<notin> set R'

goal (1 subgoal):
 1. v0 \<leadsto>(v0 # R')\<leadsto> z


proof (prove)
using this:
  {inv_begin1 x} tcopy_begin |+| tcopy_loop {inv_loop0 x}
  {inv_end1 x} tcopy_end {inv_end0 x}
  inv_loop0 x = inv_end1 x

goal (1 subgoal):
 1. {inv_begin1 x} tcopy_begin |+| tcopy_loop |+| tcopy_end {inv_end0 x}


proof (prove)
goal (1 subgoal):
 1. var_monom x * var_monom x \<noteq> 1


proof (prove)
goal (1 subgoal):
 1. exp (fds_nth f (Suc 0)) * eval_fds (fds_exp f') s = exp (eval_fds f s)


proof (state)
this:
  lnull (lscan f w a)

goal (2 subgoals):
 1. \<And>w a. lnull (lscan f w a) \<Longrightarrow> lfinite w
 2. \<And>w a.
       \<lbrakk>lfinite (lscan f w a); \<not> lnull (lscan f w a);
        \<And>wa aa.
           ltl (lscan f w a) = lscan f wa aa \<Longrightarrow>
           lfinite wa\<rbrakk>
       \<Longrightarrow> lfinite w


proof (prove)
goal (1 subgoal):
 1. app xs ys zs \<Longrightarrow> zs = xs @ ys


proof (prove)
using this:
  ?a \<in> H \<Longrightarrow>
  (\<Union>y\<in>J. {?a \<otimes> y}) \<inter>
  (\<Union>y\<in>J. {x \<otimes> y}) =
  {}

goal (1 subgoal):
 1. \<And>a b.
       \<lbrakk>a \<in> insert x H; b \<in> insert x H;
        a \<noteq> b\<rbrakk>
       \<Longrightarrow> (\<otimes>) a ` J \<inter> (\<otimes>) b ` J = {}


proof (prove)
using this:
  llast (ltl xs) \<in> lset xs

goal (1 subgoal):
 1. llast xs \<in> lset xs


proof (prove)
using this:
  \<exists>r af.
     generalized_sfw (lr_of_tran_fbs rt fw ifs) p = Some (r, af) \<and>
     (if snd af = Drop then [] = [] else [] = [Forward (fst af)])

goal (1 subgoal):
 1. (\<And>r oif.
        generalized_sfw (lr_of_tran_fbs rt fw ifs) p =
        Some (r, oif, Drop) \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. (x \<times>\<^sub>7 y = x) = (x = 0) &&&
    (x \<times>\<^sub>7 y = y) = (y = 0)


proof (prove)
goal (1 subgoal):
 1. g ` underS r a = underS s (g a)


proof (prove)
goal (1 subgoal):
 1. f ` S \<in> lmeasurable \<and>
    m * Sigma_Algebra.measure lebesgue S =
    Sigma_Algebra.measure lebesgue (f ` S)


proof (prove)
goal (1 subgoal):
 1. free_name (free name) = name &&&
    (is_free t \<Longrightarrow> free (free_name t) = t)


proof (prove)
goal (1 subgoal):
 1. \<turnstile> DBuffer \<longrightarrow> Buffer inp out


proof (prove)
goal (1 subgoal):
 1. xs \<in> Lxx x y \<Longrightarrow> 2 \<le> length xs


proof (prove)
using this:
  (_Exit_) postdominates n
  n -as'\<rightarrow>\<^sub>\<iota>* pex
  method_exit pex

goal (1 subgoal):
 1. (_Exit_) \<in> set (sourcenodes as')


proof (prove)
goal (1 subgoal):
 1. sort_key f xs = sort_key f ys


proof (prove)
goal (1 subgoal):
 1. (((return \<circ>\<circ>\<circ> (\<circ>))
       (\<lambda>i. show i @ error_msg_notin_dom_err) nat_of_uint64,
      RETURN \<circ> (\<lambda>i. show i @ error_msg_notin_dom_err))
     \<in> uint64_nat_assn\<^sup>k \<rightarrow>\<^sub>a id_assn &&&
     ((return \<circ>\<circ>\<circ> (\<circ>)) error_msg_reused_dom
       nat_of_uint64,
      RETURN \<circ> error_msg_reused_dom)
     \<in> uint64_nat_assn\<^sup>k \<rightarrow>\<^sub>a id_assn) &&&
    (uncurry
      (\<lambda>x. (return \<circ>\<circ> error_msg) (nat_of_uint64 x)),
     uncurry (RETURN \<circ>\<circ> error_msg))
    \<in> uint64_nat_assn\<^sup>k *\<^sub>a
          id_assn\<^sup>k \<rightarrow>\<^sub>a status_assn id_assn &&&
    (uncurry (return \<circ>\<circ> error_msg),
     uncurry (RETURN \<circ>\<circ> error_msg))
    \<in> nat_assn\<^sup>k *\<^sub>a
          id_assn\<^sup>k \<rightarrow>\<^sub>a status_assn id_assn


proof (prove)
goal (2 subgoals):
 1. \<And>Ca c.
       \<lbrakk>is_class G C; ws_prog G;
        \<And>C c. class G C = Some c \<Longrightarrow> unique (cfields c);
        class G Ca = Some c;
        Ca \<noteq> Object \<longrightarrow>
        G\<turnstile>Ca\<prec>\<^sub>C1super c \<and>
        unique (DeclConcepts.fields G (super c)) \<and>
        is_class G (super c)\<rbrakk>
       \<Longrightarrow> ws_prog G
 2. \<And>Ca c.
       \<lbrakk>is_class G C; ws_prog G;
        \<And>C c. class G C = Some c \<Longrightarrow> unique (cfields c);
        class G Ca = Some c;
        Ca \<noteq> Object \<longrightarrow>
        G\<turnstile>Ca\<prec>\<^sub>C1super c \<and>
        unique (DeclConcepts.fields G (super c)) \<and>
        is_class G (super c)\<rbrakk>
       \<Longrightarrow> unique
                          (map (\<lambda>(fn, y). ((fn, Ca), y))
                            (cfields c) @
                           (if Ca = Object then []
                            else DeclConcepts.fields G (super c)))


proof (prove)
using this:
  (1 - u) *\<^sub>R x + u *\<^sub>R y \<in> S

goal (1 subgoal):
 1. False


proof (prove)
using this:
  bdd_below
   {T\<^sub>p init qs as |as. length as = length qs} \<Longrightarrow>
  \<Sqinter> {T\<^sub>p init qs as |as. length as = length qs}
  \<le> T\<^sub>p init qs
         (take x Strat @
          (fst (Strat ! x),
           take l (snd (Strat ! x)) @ drop (Suc l) (snd (Strat ! x))) #
          drop (Suc x) Strat)

goal (1 subgoal):
 1. \<Sqinter> {T\<^sub>p init qs as |as. length as = length qs}
    \<le> T\<^sub>p init qs
           (take x Strat @
            (fst (Strat ! x),
             take l (snd (Strat ! x)) @ drop (Suc l) (snd (Strat ! x))) #
            drop (Suc x) Strat)


proof (prove)
using this:
  es \<noteq> 0

goal (1 subgoal):
 1. e_length es = Suc (pdec1 (es - 1))


proof (prove)
goal (1 subgoal):
 1. bdd_below ((\<lambda>x. x \<bullet> a) ` s)


proof (prove)
using this:
  HNext s s'
  HInv1 s \<and> HInv2 s \<and> HInv2 s' \<and> HInv4 s

goal (1 subgoal):
 1. HInv4b s' p


proof (prove)
goal (1 subgoal):
 1. slow.check_eqv n \<phi> \<psi> \<Longrightarrow>
    \<Phi>.lang\<^sub>W\<^sub>S\<^sub>1\<^sub>S n \<phi> =
    \<Phi>.lang\<^sub>W\<^sub>S\<^sub>1\<^sub>S n \<psi>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>[[\<alpha>]]\<nu> \<down> \<omega>; \<nu> REP \<nu>'\<rbrakk>
    \<Longrightarrow> \<exists>\<omega>'.
                         (\<omega> REP \<omega>') \<and>
                         ([\<alpha>]\<nu>' \<downharpoonleft> \<omega>')


proof (prove)
goal (1 subgoal):
 1. prime_nat p = (1 < p \<and> (\<forall>n\<in>{1<..<p}. \<not> n dvd p))


proof (prove)
goal (1 subgoal):
 1. Func_option A B \<subseteq> Pfunc A B


proof (prove)
using this:
  natural_transformation A B F G \<tau>
  Go\<tau>.A.ide a
  \<lbrakk>natural_transformation ?A ?B ?F ?G ?\<tau>;
   \<not> partial_magma.arr ?A ?f\<rbrakk>
  \<Longrightarrow> ?\<tau> ?f = partial_magma.null ?B
  \<lbrakk>natural_transformation ?A ?B ?F ?G ?\<tau>;
   partial_magma.arr ?A ?f\<rbrakk>
  \<Longrightarrow> ?B (?G ?f) (?\<tau> (partial_magma.dom ?A ?f)) =
                    ?\<tau> ?f
  Go\<tau>.A.ide ?a \<Longrightarrow> Go\<tau>.map ?a = B (G ?a) (\<tau> ?a)
  \<lbrakk>Go\<tau>.B.arr ?f; Go\<tau>.B.cod ?f = ?b\<rbrakk>
  \<Longrightarrow> B ?b ?f = ?f

goal (1 subgoal):
 1. Go\<tau>.map a = \<tau> a


proof (prove)
goal (1 subgoal):
 1. mds_yields_stable_types m \<Longrightarrow>
    tyenv_wellformed m (\<Gamma>_of_mds m) (\<S>_of_mds m) {}


proof (prove)
using this:
  iface_packet_check ifl pi \<noteq> None

goal (1 subgoal):
 1. (\<And>i3.
        iface_packet_check ifl pi = Some i3 \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<And>xa.
       fmlookup xm k = Some x \<Longrightarrow>
       fmlookup xm xa = fmlookup (fmdrop k xm(k \<mapsto>\<^sub>f x)) xa


proof (prove)
using this:
  finite UNIV

goal (1 subgoal):
 1. finite UNIV


proof (prove)
goal (1 subgoal):
 1. a = e \<and> a = b \<or> a \<noteq> e


proof (prove)
using this:
  A \<noteq> B
  A B Le C D
  ?A ?B Le ?C ?C \<Longrightarrow> ?A = ?B

goal (1 subgoal):
 1. C \<noteq> D


proof (prove)
goal (1 subgoal):
 1. w ?! i = w ?! nth_least s k


proof (prove)
using this:
  class.linorder (\<lambda>x y. y \<le> x) (\<lambda>x y. y < x)

goal (1 subgoal):
 1. class.wellorder (\<lambda>x y. y \<le> x) (\<lambda>x y. y < x)


proof (prove)
goal (1 subgoal):
 1. linorder_rank R (insert y A) x =
    (if x \<noteq> y \<and> (y, x) \<in> R then 1 else 0) +
    linorder_rank R A x


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<notin> bad; B \<notin> bad\<rbrakk>
    \<Longrightarrow> extr bad IK (insert (Confid A B X) CH) =
                      extr bad IK CH


proof (prove)
goal (1 subgoal):
 1. list_of_oalist_tc (OAlist_tc_except_min xs) = tl (list_of_oalist_tc xs)


proof (prove)
goal (1 subgoal):
 1. \<And>x s.
       \<lbrakk>0 < return_time p2 x - return_time p1 x; 0 < s;
        s \<le> return_time p1 x; flow0 x s \<in> p2\<rbrakk>
       \<Longrightarrow> False


proof (prove)
goal (1 subgoal):
 1. cotrace (coS t final_i) (Co_Snapshot.ldrop final_i t)


proof (prove)
using this:
  L.seq \<nu> \<mu>

goal (1 subgoal):
 1. L.in_hom \<nu> (L.cod \<mu>) (L.cod \<nu>)


proof (prove)
using this:
  Finite_Set.fold lcm (1::'a) (Set t) = fold_keys lcm t (1::'a)

goal (1 subgoal):
 1. Lcm\<^sub>f\<^sub>i\<^sub>n (Set t) = fold_keys lcm t (1::'a)


proof (prove)
using this:
  ?j \<in> set js \<Longrightarrow> i \<le> ?j
  k < length buf
  buf ! k = []
  length Ps = length js \<and>
  length js = length buf \<and>
  (\<forall>ia<length Ps.
      i \<le> js ! ia \<and> list_all2 (Ps ! ia) [i..<js ! ia] (buf ! ia))

goal (1 subgoal):
 1. (if js = [] then i else Min (set js)) = i


proof (prove)
goal (1 subgoal):
 1. \<And>s. proper_it (succ_it s v) (succ_it s v)


proof (prove)
goal (1 subgoal):
 1. \<And>i j. (CHR ''a'' ^^^ i @ CHR ''b'' ^^^ j \<in> A) = (i = j)


proof (prove)
using this:
  A a' t \<le> log \<alpha> (real (size1 t) / 2) + 1

goal (1 subgoal):
 1. A a t \<le> log \<alpha> (real (size1 t)) + 1


proof (prove)
goal (1 subgoal):
 1. continuous_on {a..b} f \<Longrightarrow>
    f absolutely_integrable_on {a..b}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>F\<in>set Fs\<^sub>1. distinct F;
     \<forall>F\<in>set Fs\<^sub>2. distinct F; distinct Fs\<^sub>1;
     inj_on (\<lambda>xs. {xs} // {\<cong>}) (set Fs\<^sub>1);
     distinct Fs\<^sub>2;
     inj_on (\<lambda>xs. {xs} // {\<cong>}) (set Fs\<^sub>2)\<rbrakk>
    \<Longrightarrow> pr_iso_test0 Map.empty Fs\<^sub>1 Fs\<^sub>2 =
                      (\<exists>\<phi>.
                          is_pr_iso \<phi> Fs\<^sub>1 Fs\<^sub>2)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>U = A \<union> B; A \<subseteq> X; B \<subseteq> Y;
     X \<subseteq> U; X \<inter> Y = {}\<rbrakk>
    \<Longrightarrow> A = X


proof (prove)
using this:
  x \<in> mds\<^sub>2 GuarNoReadOrWrite

goal (1 subgoal):
 1. x \<in> mds GuarNoReadOrWrite


proof (prove)
using this:
  C.obj a
  D.isomorphic ?a ?a' =
  (\<exists>f.
      \<guillemotleft>f : ?a \<Rightarrow>\<^sub>D ?a'\<guillemotright> \<and>
      D.iso f)
  D.isomorphic ?f ?g \<Longrightarrow> D.isomorphic ?g ?f
  D.iso (unit a)

goal (1 subgoal):
 1. D.isomorphic (map\<^sub>0 a \<star>\<^sub>D \<tau>\<^sub>0 a)
     (F.map\<^sub>0 a)


proof (state)
this:
  incseq u
  c < ereal (u ?i)
  ereal (u ?i) < b
  (\<lambda>x. ereal (u x)) \<longlonglongrightarrow> b

goal (1 subgoal):
 1. (\<And>l u.
        \<lbrakk>einterval a b = (\<Union>i. {l i..u i}); incseq u;
         decseq l; \<And>i. l i < u i; \<And>i. a < ereal (l i);
         \<And>i. ereal (u i) < b;
         (\<lambda>x. ereal (l x)) \<longlonglongrightarrow> a;
         (\<lambda>x. ereal (u x)) \<longlonglongrightarrow> b\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  u \<in> limit r
  range r \<subseteq> reachable
  limit ?r \<subseteq> range ?r

goal (1 subgoal):
 1. u \<in> reachable


proof (prove)
goal (1 subgoal):
 1. list_all tfr\<^sub>s\<^sub>t\<^sub>p A''


proof (prove)
goal (1 subgoal):
 1. (row C1 (i - nr1) @\<^sub>v row D1 (i - nr1)) \<bullet>
    (col A2 j @\<^sub>v col C2 j) =
    row C1 (i - nr1) \<bullet> col A2 j +
    row D1 (i - nr1) \<bullet> col C2 j


proof (prove)
goal (1 subgoal):
 1. 1 * x = x


proof (prove)
using this:
  Formula.sat \<sigma> V (map the v) i (formula.Agg y \<omega> b f \<phi>)
  \<not> fv \<phi> \<subseteq> {0..<b}

goal (1 subgoal):
 1. (\<And>zs.
        \<lbrakk>length zs = b;
         Formula.sat \<sigma> V (zs @ map the v) i \<phi>\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (2 subgoals):
 1. \<And>Xa Ya.
       \<lbrakk>overrider Xa; idem_overrider Xa; overrider Ya;
        idem_overrider Ya;
        \<forall>s\<^sub>1 s\<^sub>2 s\<^sub>3.
           Ya (Xa s\<^sub>1 s\<^sub>2) s\<^sub>3 =
           Xa (Ya s\<^sub>1 s\<^sub>3) s\<^sub>2;
        idem_scene X; idem_scene Y; X \<bowtie>\<^sub>S Y;
        \<forall>s\<^sub>1 s\<^sub>2.
           Ya s\<^sub>2 (Xa s\<^sub>2 s\<^sub>1) =
           Xa s\<^sub>2 (Ya s\<^sub>2 s\<^sub>1)\<rbrakk>
       \<Longrightarrow> (\<lambda>x y. Xa x (Ya x y)) = (\<lambda>x y. x)
 2. \<And>Xa Ya s\<^sub>1 s\<^sub>2.
       \<lbrakk>overrider Xa; idem_overrider Xa; overrider Ya;
        idem_overrider Ya;
        \<forall>s\<^sub>1 s\<^sub>2 s\<^sub>3.
           Ya (Xa s\<^sub>1 s\<^sub>2) s\<^sub>3 =
           Xa (Ya s\<^sub>1 s\<^sub>3) s\<^sub>2;
        idem_scene X; idem_scene Y; X \<bowtie>\<^sub>S Y;
        Ya s\<^sub>2 (Xa s\<^sub>2 s\<^sub>1) \<noteq>
        Xa s\<^sub>2 (Ya s\<^sub>2 s\<^sub>1)\<rbrakk>
       \<Longrightarrow> (\<lambda>x y. y) = (\<lambda>x y. x)


proof (prove)
goal (1 subgoal):
 1. 0 smod x = 0


proof (prove)
goal (1 subgoal):
 1. $x\<acute> \<sharp> $y


proof (prove)
using this:
  set_of (mkt_bal_r (fst (delete_max l)) (snd (delete_max l)) r) =
  set_of l \<union> set_of r
  set_of (delete_root t) =
  set_of (mkt_bal_r (fst (delete_max l)) (snd (delete_max l)) r)
  set_of t - {n} = set_of l \<union> set_of r
  t = MKT n (MKT ln ll lr lh) (MKT rn rl rr rh) h
  t = MKT n l r h

goal (1 subgoal):
 1. set_of (delete_root t) = set_of t - {n}


proof (prove)
goal (1 subgoal):
 1. (f1 \<sim>[F] g1) = (f2 \<sim>[F] g2)


proof (prove)
using this:
  \<phi> (\<sigma>\<^bsub>the_singleton\<^esub>t n)

goal (1 subgoal):
 1. eval the_singleton t t' n [\<phi>]\<^sub>b


proof (state)
goal (1 subgoal):
 1. \<exists>C. farkas_coefficients_ns (snd ` set ns) C


proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. Lambert_W (f x)) has_real_derivative
     f' / (f x + exp (Lambert_W (f x))))
     (at x within A)


proof (prove)
goal (1 subgoal):
 1. \<And>ell.
       ell \<in> set (rows_to_keep A) \<Longrightarrow> ell < dim_row A


proof (prove)
using this:
  wf_set_bits_int f

goal (1 subgoal):
 1. bit (BITS a. f a) 0 = f 0


proof (prove)
using this:
  x \<in> Sigma I \<FF>
  y \<in> Sigma I \<FF>
  z \<in> I
  z \<subseteq> fst x
  z \<subseteq> fst y
  z' \<in> I
  z' \<subseteq> fst x
  z' \<subseteq> fst y

goal (1 subgoal):
 1. (z, \<cdot>\<^bsub>z\<^esub> (\<rho> (fst x) z (snd x))
         (\<rho> (fst y) z (snd y)))
    \<in> Sigma I \<FF> &&&
    (z',
     \<cdot>\<^bsub>z'\<^esub> (\<rho> (fst x) z' (snd x))
      (\<rho> (fst y) z' (snd y)))
    \<in> Sigma I \<FF>


proof (prove)
using this:
  (\<Oplus>\<^bsub>V\<^esub>v\<in>B'. a' v \<odot>\<^bsub>V\<^esub> v) =
  \<zero>\<^bsub>V\<^esub>
  a' = (\<lambda>v. if v \<in> A then a v else \<zero>\<^bsub>K\<^esub>)
  b \<notin> A
  b \<in> carrier V

goal (1 subgoal):
 1. a' b \<odot>\<^bsub>V\<^esub> b \<oplus>\<^bsub>V\<^esub>
    (\<Oplus>\<^bsub>V\<^esub>a\<in>B'. a' a \<odot>\<^bsub>V\<^esub> a) =
    \<zero>\<^bsub>V\<^esub>


proof (prove)
goal (1 subgoal):
 1. map_iarray f as = IArray (map f (IArray.list_of as))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>States SA \<inter> \<Union> (States ` F) = {};
     \<exists>x\<in>F. S \<in> States x; dom G = \<Union> (States ` F);
     \<Union> (ran G) = F - {Root F G}; RootEx F G; OneAncestor F G;
     NoCycles F G; SA = Root F G\<rbrakk>
    \<Longrightarrow> States (Root F G) \<subseteq> \<Union> (States ` F)


proof (prove)
goal (1 subgoal):
 1. Q a


proof (prove)
using this:
  X xs

goal (1 subgoal):
 1. lsorted xs


proof (state)
goal (1 subgoal):
 1. \<Squnion>A = x


proof (prove)
goal (1 subgoal):
 1. set (ubounds as) =
    {uu_.
     \<exists>i k ks.
        uu_ = (i, ks) \<and> Le i (k # ks) \<in> set as \<and> k < 0}


proof (prove)
using this:
  nodes H = V \<and> edges H \<subseteq> E

goal (1 subgoal):
 1. nodes H = V


proof (prove)
goal (1 subgoal):
 1. \<And>a d.
       dnf_to_bool \<gamma> (dnf_not d) =
       (\<not> dnf_to_bool \<gamma> d) \<Longrightarrow>
       dnf_to_bool \<gamma> (listprepend (map invert a) (dnf_not d)) =
       (\<not> cnf_to_bool \<gamma> a \<and> \<not> dnf_to_bool \<gamma> d)


proof (prove)
goal (1 subgoal):
 1. s' =
    snd (fst (mul_instr_sub1 (fst instr)
               (ucast
                 (if fst instr = arith_type UMUL \<or>
                     fst instr = arith_type UMULcc
                  then word_of_int
                        (uint
                          (user_reg_val (fst (fst (get_curr_win () s)))
                            (get_operand_w5 (snd instr ! Suc 0))
                            (snd (fst (get_curr_win () s)))) *
                         uint (get_operand2 (snd instr) s))
                  else word_of_int
                        (sint
                          (user_reg_val (fst (fst (get_curr_win () s)))
                            (get_operand_w5 (snd instr ! Suc 0))
                            (snd (fst (get_curr_win () s)))) *
                         sint (get_operand2 (snd instr) s))))
               (snd (fst (write_reg
                           (if get_operand_w5 (snd instr ! 3) \<noteq> 0
                            then ucast
                                  (if fst instr = arith_type UMUL \<or>
fst instr = arith_type UMULcc
                                   then word_of_int
   (uint
     (user_reg_val (fst (fst (get_curr_win () s)))
       (get_operand_w5 (snd instr ! Suc 0))
       (snd (fst (get_curr_win () s)))) *
    uint (get_operand2 (snd instr) s))
                                   else word_of_int
   (sint
     (user_reg_val (fst (fst (get_curr_win () s)))
       (get_operand_w5 (snd instr ! Suc 0))
       (snd (fst (get_curr_win () s)))) *
    sint (get_operand2 (snd instr) s)))
                            else user_reg_val
                                  (fst (fst (get_curr_win () s)))
                                  (get_operand_w5 (snd instr ! 3))
                                  (snd (fst
   (write_cpu
     (ucast
       ((if fst instr = arith_type UMUL \<or> fst instr = arith_type UMULcc
         then word_of_int
               (uint
                 (user_reg_val (fst (fst (get_curr_win () s)))
                   (get_operand_w5 (snd instr ! Suc 0))
                   (snd (fst (get_curr_win () s)))) *
                uint (get_operand2 (snd instr) s))
         else word_of_int
               (sint
                 (user_reg_val (fst (fst (get_curr_win () s)))
                   (get_operand_w5 (snd instr ! Suc 0))
                   (snd (fst (get_curr_win () s)))) *
                sint (get_operand2 (snd instr) s))) >>
        32))
     Y (snd (fst (get_curr_win () s)))))))
                           (fst (fst (get_curr_win () s)))
                           (get_operand_w5 (snd instr ! 3))
                           (snd (fst (write_cpu
 (ucast
   ((if fst instr = arith_type UMUL \<or> fst instr = arith_type UMULcc
     then word_of_int
           (uint
             (user_reg_val (fst (fst (get_curr_win () s)))
               (get_operand_w5 (snd instr ! Suc 0))
               (snd (fst (get_curr_win () s)))) *
            uint (get_operand2 (snd instr) s))
     else word_of_int
           (sint
             (user_reg_val (fst (fst (get_curr_win () s)))
               (get_operand_w5 (snd instr ! Suc 0))
               (snd (fst (get_curr_win () s)))) *
            sint (get_operand2 (snd instr) s))) >>
    32))
 Y (snd (fst (get_curr_win () s))))))))))) \<and>
    get_S (cpu_reg_val PSR s) = 0 \<Longrightarrow>
    (get_operand_w5 (snd instr ! 3) \<noteq> 0 \<longrightarrow>
     (fst instr = arith_type UMUL \<longrightarrow>
      get_S
       (cpu_reg_val PSR
         (snd (fst (mul_instr_sub1 (arith_type UMUL)
                     (ucast
                       (ucast
                         (user_reg_val (fst (fst (get_curr_win () s)))
                           (get_operand_w5 (snd instr ! Suc 0))
                           (snd (fst (get_curr_win () s)))) *
                        ucast (get_operand2 (snd instr) s)))
                     (snd (fst (write_reg
                                 (ucast
                                   (ucast
                                     (user_reg_val
 (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0))
 (snd (fst (get_curr_win () s)))) *
                                    ucast (get_operand2 (snd instr) s)))
                                 (fst (fst (get_curr_win () s)))
                                 (get_operand_w5 (snd instr ! 3))
                                 (snd (fst
  (write_cpu
    (ucast
      (ucast
        (user_reg_val (fst (fst (get_curr_win () s)))
          (get_operand_w5 (snd instr ! Suc 0))
          (snd (fst (get_curr_win () s)))) *
       ucast (get_operand2 (snd instr) s) >>
       32))
    Y (snd (fst (get_curr_win () s))))))))))))) =
      0) \<and>
     (fst instr = arith_type UMULcc \<longrightarrow>
      get_S
       (cpu_reg_val PSR
         (snd (fst (mul_instr_sub1 (arith_type UMULcc)
                     (ucast
                       (ucast
                         (user_reg_val (fst (fst (get_curr_win () s)))
                           (get_operand_w5 (snd instr ! Suc 0))
                           (snd (fst (get_curr_win () s)))) *
                        ucast (get_operand2 (snd instr) s)))
                     (snd (fst (write_reg
                                 (ucast
                                   (ucast
                                     (user_reg_val
 (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0))
 (snd (fst (get_curr_win () s)))) *
                                    ucast (get_operand2 (snd instr) s)))
                                 (fst (fst (get_curr_win () s)))
                                 (get_operand_w5 (snd instr ! 3))
                                 (snd (fst
  (write_cpu
    (ucast
      (ucast
        (user_reg_val (fst (fst (get_curr_win () s)))
          (get_operand_w5 (snd instr ! Suc 0))
          (snd (fst (get_curr_win () s)))) *
       ucast (get_operand2 (snd instr) s) >>
       32))
    Y (snd (fst (get_curr_win () s))))))))))))) =
      0) \<and>
     (fst instr \<noteq> arith_type UMUL \<and>
      fst instr \<noteq> arith_type UMULcc \<longrightarrow>
      get_S
       (cpu_reg_val PSR
         (snd (fst (mul_instr_sub1 (fst instr)
                     (ucast
                       (scast
                         (user_reg_val (fst (fst (get_curr_win () s)))
                           (get_operand_w5 (snd instr ! Suc 0))
                           (snd (fst (get_curr_win () s)))) *
                        scast (get_operand2 (snd instr) s)))
                     (snd (fst (write_reg
                                 (ucast
                                   (scast
                                     (user_reg_val
 (fst (fst (get_curr_win () s))) (get_operand_w5 (snd instr ! Suc 0))
 (snd (fst (get_curr_win () s)))) *
                                    scast (get_operand2 (snd instr) s)))
                                 (fst (fst (get_curr_win () s)))
                                 (get_operand_w5 (snd instr ! 3))
                                 (snd (fst
  (write_cpu
    (ucast
      (scast
        (user_reg_val (fst (fst (get_curr_win () s)))
          (get_operand_w5 (snd instr ! Suc 0))
          (snd (fst (get_curr_win () s)))) *
       scast (get_operand2 (snd instr) s) >>
       32))
    Y (snd (fst (get_curr_win () s))))))))))))) =
      0)) \<and>
    (get_operand_w5 (snd instr ! 3) = 0 \<longrightarrow>
     (fst instr = arith_type UMUL \<longrightarrow>
      get_S
       (cpu_reg_val PSR
         (snd (fst (mul_instr_sub1 (arith_type UMUL)
                     (ucast
                       (ucast
                         (user_reg_val (fst (fst (get_curr_win () s)))
                           (get_operand_w5 (snd instr ! Suc 0))
                           (snd (fst (get_curr_win () s)))) *
                        ucast (get_operand2 (snd instr) s)))
                     (snd (fst (write_reg
                                 (user_reg_val
                                   (fst (fst (get_curr_win () s))) 0
                                   (snd (fst
    (write_cpu
      (ucast
        (ucast
          (user_reg_val (fst (fst (get_curr_win () s)))
            (get_operand_w5 (snd instr ! Suc 0))
            (snd (fst (get_curr_win () s)))) *
         ucast (get_operand2 (snd instr) s) >>
         32))
      Y (snd (fst (get_curr_win () s)))))))
                                 (fst (fst (get_curr_win () s))) 0
                                 (snd (fst
  (write_cpu
    (ucast
      (ucast
        (user_reg_val (fst (fst (get_curr_win () s)))
          (get_operand_w5 (snd instr ! Suc 0))
          (snd (fst (get_curr_win () s)))) *
       ucast (get_operand2 (snd instr) s) >>
       32))
    Y (snd (fst (get_curr_win () s))))))))))))) =
      0) \<and>
     (fst instr = arith_type UMULcc \<longrightarrow>
      get_S
       (cpu_reg_val PSR
         (snd (fst (mul_instr_sub1 (arith_type UMULcc)
                     (ucast
                       (ucast
                         (user_reg_val (fst (fst (get_curr_win () s)))
                           (get_operand_w5 (snd instr ! Suc 0))
                           (snd (fst (get_curr_win () s)))) *
                        ucast (get_operand2 (snd instr) s)))
                     (snd (fst (write_reg
                                 (user_reg_val
                                   (fst (fst (get_curr_win () s))) 0
                                   (snd (fst
    (write_cpu
      (ucast
        (ucast
          (user_reg_val (fst (fst (get_curr_win () s)))
            (get_operand_w5 (snd instr ! Suc 0))
            (snd (fst (get_curr_win () s)))) *
         ucast (get_operand2 (snd instr) s) >>
         32))
      Y (snd (fst (get_curr_win () s)))))))
                                 (fst (fst (get_curr_win () s))) 0
                                 (snd (fst
  (write_cpu
    (ucast
      (ucast
        (user_reg_val (fst (fst (get_curr_win () s)))
          (get_operand_w5 (snd instr ! Suc 0))
          (snd (fst (get_curr_win () s)))) *
       ucast (get_operand2 (snd instr) s) >>
       32))
    Y (snd (fst (get_curr_win () s))))))))))))) =
      0) \<and>
     (fst instr \<noteq> arith_type UMUL \<and>
      fst instr \<noteq> arith_type UMULcc \<longrightarrow>
      get_S
       (cpu_reg_val PSR
         (snd (fst (mul_instr_sub1 (fst instr)
                     (ucast
                       (scast
                         (user_reg_val (fst (fst (get_curr_win () s)))
                           (get_operand_w5 (snd instr ! Suc 0))
                           (snd (fst (get_curr_win () s)))) *
                        scast (get_operand2 (snd instr) s)))
                     (snd (fst (write_reg
                                 (user_reg_val
                                   (fst (fst (get_curr_win () s))) 0
                                   (snd (fst
    (write_cpu
      (ucast
        (scast
          (user_reg_val (fst (fst (get_curr_win () s)))
            (get_operand_w5 (snd instr ! Suc 0))
            (snd (fst (get_curr_win () s)))) *
         scast (get_operand2 (snd instr) s) >>
         32))
      Y (snd (fst (get_curr_win () s)))))))
                                 (fst (fst (get_curr_win () s))) 0
                                 (snd (fst
  (write_cpu
    (ucast
      (scast
        (user_reg_val (fst (fst (get_curr_win () s)))
          (get_operand_w5 (snd instr ! Suc 0))
          (snd (fst (get_curr_win () s)))) *
       scast (get_operand2 (snd instr) s) >>
       32))
    Y (snd (fst (get_curr_win () s))))))))))))) =
      0))


proof (state)
this:
  j = i

goal (1 subgoal):
 1. \<And>x.
       \<lbrakk>x < length ns; 0 < x;
        0 < offs_num (length ns) xs index key mi ma x; x \<le> i\<rbrakk>
       \<Longrightarrow> False


proof (prove)
using this:
  0 < fst w
  ts = h # a # ts'
  Ball (set ts) local.valid
  a \<noteq> Leaf \<and>
  r a = snd (fst w, l h - 1) \<and>
  (case ts' of [] \<Rightarrow> l a = fst (fst w, l h - 1)
   | u # us \<Rightarrow>
       adjacent (fst (fst w, l h - 1), r u) ts' \<and> l a = Suc (r u))
  local.valid z
  l z =
  (case a # ts' of [] \<Rightarrow> fst w
   | t\<^sub>1 # ts'' \<Rightarrow> Suc (r t\<^sub>1))

goal (1 subgoal):
 1. local.valid (combine a z)


proof (prove)
using this:
  class.linorder (\<lambda>c d. of_char c \<le> of_char d)
   (\<lambda>c d. of_char c < of_char d)

goal (1 subgoal):
 1. class.linorder less_eq_char less_char


proof (prove)
using this:
  vpeq (current s) s t \<and> vpeq u s t
  current s = current t

goal (1 subgoal):
 1. vpeq u (snd (snd (CISK_control s (current s) (execs (current s)))))
     (snd (snd (CISK_control t (current t) (execs (current t)))))


proof (prove)
using this:
  \<lbrakk>finite {i}; finite r; {i} \<inter> r = {}\<rbrakk>
  \<Longrightarrow> mset_ran a {i} + mset_ran a r =
                    mset_ran a ({i} \<union> r)

goal (1 subgoal):
 1. \<lbrakk>finite r; i \<notin> r\<rbrakk>
    \<Longrightarrow> add_mset (a i) (mset_ran a r) =
                      mset_ran a (insert i r)


proof (prove)
goal (1 subgoal):
 1. A E'' TS C D


proof (prove)
goal (1 subgoal):
 1. k \<in> X - S


proof (prove)
goal (1 subgoal):
 1. \<l>[u] \<cdot>
    (trg u \<star> \<mu>) \<cdot>
    \<a>[trg f, f, v] \<cdot>
    (\<l>\<^sup>-\<^sup>1[f] \<cdot> \<r>[f] \<star> v) \<cdot>
    \<a>\<^sup>-\<^sup>1[f, trg v, v] \<cdot>
    (f \<star> \<l>\<^sup>-\<^sup>1[v]) =
    \<l>[u] \<cdot>
    (trg u \<star> \<mu>) \<cdot>
    can (\<^bold>\<langle>trg u\<^bold>\<rangle>\<^sub>0 \<^bold>\<star>
         \<^bold>\<langle>f\<^bold>\<rangle> \<^bold>\<star>
         \<^bold>\<langle>v\<^bold>\<rangle>)
     (\<^bold>\<langle>f\<^bold>\<rangle> \<^bold>\<star>
      \<^bold>\<langle>v\<^bold>\<rangle>)


proof (state)
goal (1 subgoal):
 1. \<exists>a b k.
       k \<noteq> 0 \<and>
       M = k *\<^sub>s\<^sub>m (a, b, cnj b, cnj a) \<and>
       sgn k' = sgn (Re (mat_det (a, b, cnj b, cnj a)))


proof (prove)
goal (1 subgoal):
 1. (x\<^sup>T\<^sup>+ \<cdot> 1') ; p \<le> (- 1'\<^sup>T \<cdot> 1') ; p


proof (prove)
goal (1 subgoal):
 1. (\<And>op.
        \<lbrakk>ops' = [op]; op \<in> set \<pi>\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  finite K
  K \<subseteq> I
  Y \<in> sets (Pi\<^sub>M K M)
  finite J
  J \<subseteq> I
  X \<in> sets (Pi\<^sub>M J M)

goal (1 subgoal):
 1. emeasure (P (K \<union> J)) (emb (K \<union> J) J X) = emeasure (P J) X


proof (prove)
using this:
  list_emb
   (\<lambda>y z. P y z \<and> (\<forall>x. P x y \<longrightarrow> P x z))
   ys zs
  list_emb P xs ys

goal (1 subgoal):
 1. list_emb P xs zs


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ts = butlast ts @ [(sub, sep)]; last ts = (sub, sep);
     t = Leaf\<rbrakk>
    \<Longrightarrow> inorder_list (butlast ts) @ inorder sub @ [sep] =
                      inorder_list ts


proof (prove)
goal (1 subgoal):
 1. A *\<^sub>v (v + - w) = A *\<^sub>v v - A *\<^sub>v w


proof (prove)
goal (1 subgoal):
 1. presAtm atm \<Longrightarrow> discr (Atm atm)


proof (prove)
goal (1 subgoal):
 1. in_traverse (delete_elt_tree (Node lt x m rt)) =
    in_traverse lt @ in_traverse rt


proof (prove)
goal (1 subgoal):
 1. Q X \<and> R Y


proof (prove)
goal (1 subgoal):
 1. (length l < length ps &&& 0 < length l) &&&
    length r < length ps &&& 0 < length r


proof (prove)
using this:
  smult d f =m smult (c * d) (\<Prod>\<^sub># fs)

goal (1 subgoal):
 1. factorization_m (smult d f) (c * d, fs)


proof (prove)
using this:
  inverse a \<in> HFinite
  a \<in> \<real>
  a \<noteq> 0
  a * w \<approx> a * z

goal (1 subgoal):
 1. w \<approx> z


proof (prove)
goal (1 subgoal):
 1. x\<^sup>-\<^sup>\<one>\<^sup>-\<^sup>\<one> \<cong>\<^sub>Q x


proof (prove)
goal (1 subgoal):
 1. set (map (($v) v) [0..<dim_vec v]) = {v $v i |i. i < dim_vec v}


proof (prove)
goal (1 subgoal):
 1. (ivl \<subseteq> snd (stopcont ivl) &&&
     fst (stopcont ivl)
     \<subseteq> sbelow_halfspace rsctn \<times> UNIV) &&&
    fst (stopcont ivl) \<subseteq> snd (stopcont ivl) &&&
    snd (stopcont ivl) \<subseteq> sbelow_halfspace rsctn \<times> UNIV &&&
    flowsto ivl {0..} (snd (stopcont ivl))
     (fst (stopcont ivl) \<union> trap)


proof (prove)
using this:
  constructive_security_obsf (real1 ?\<eta>) (ideal1 ?\<eta>) (sim1 ?\<eta>)
   (\<I>_real1 ?\<eta>) (\<I>_inner1 ?\<eta>) (\<I>_common1 ?\<eta>)
   (absorb (\<A> ?\<eta>)
     (obsf_converter
       (parallel_wiring \<odot>
        (1\<^sub>C |\<^sub>\<propto>
         converter_of_resource
          (sim2 ?\<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal2 ?\<eta>)))))
   (advantage
     (absorb (\<A> ?\<eta>)
       (obsf_converter
         (parallel_wiring \<odot>
          (1\<^sub>C |\<^sub>\<propto>
           converter_of_resource
            (sim2 ?\<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal2 ?\<eta>)))))
     (obsf_resource
       (sim1 ?\<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal1 ?\<eta>))
     (obsf_resource (real1 ?\<eta>)))
  constructive_security_obsf (real2 ?\<eta>) (ideal2 ?\<eta>) (sim2 ?\<eta>)
   (\<I>_real2 ?\<eta>) (\<I>_inner2 ?\<eta>) (\<I>_common2 ?\<eta>)
   (absorb (\<A> ?\<eta>)
     (obsf_converter
       (parallel_wiring \<odot>
        (converter_of_resource (real1 ?\<eta>) |\<^sub>\<propto>
         1\<^sub>C))))
   (advantage
     (absorb (\<A> ?\<eta>)
       (obsf_converter
         (parallel_wiring \<odot>
          (converter_of_resource (real1 ?\<eta>) |\<^sub>\<propto>
           1\<^sub>C))))
     (obsf_resource
       (sim2 ?\<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal2 ?\<eta>))
     (obsf_resource (real2 ?\<eta>)))

goal (1 subgoal):
 1. constructive_security_obsf
     (parallel_wiring \<rhd> real1 \<eta> \<parallel> real2 \<eta>)
     (parallel_wiring \<rhd> ideal1 \<eta> \<parallel> ideal2 \<eta>)
     (sim1 \<eta> |\<^sub>= sim2 \<eta>)
     (\<I>_real1 \<eta> \<oplus>\<^sub>\<I> \<I>_real2 \<eta>)
     (\<I>_inner1 \<eta> \<oplus>\<^sub>\<I> \<I>_inner2 \<eta>)
     (\<I>_common1 \<eta> \<oplus>\<^sub>\<I> \<I>_common2 \<eta>)
     (\<A> \<eta>)
     (advantage
       (absorb (\<A> \<eta>)
         (obsf_converter
           (parallel_wiring \<odot>
            (1\<^sub>C |\<^sub>\<propto>
             converter_of_resource
              (sim2 \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal2 \<eta>)))))
       (obsf_resource
         (sim1 \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal1 \<eta>))
       (obsf_resource (real1 \<eta>)) +
      advantage
       (absorb (\<A> \<eta>)
         (obsf_converter
           (parallel_wiring \<odot>
            (converter_of_resource (real1 \<eta>) |\<^sub>\<propto>
             1\<^sub>C))))
       (obsf_resource
         (sim2 \<eta> |\<^sub>= 1\<^sub>C \<rhd> ideal2 \<eta>))
       (obsf_resource (real2 \<eta>)))


proof (prove)
using this:
  mode = invmode statM e
  a = Null \<longrightarrow> is_static statM

goal (1 subgoal):
 1. mode = IntVir \<longrightarrow> a \<noteq> Null


proof (state)
this:
  \<sigma>' i = \<sigma> i
  \<forall>j\<in>{i}. \<zeta> j = \<sigma> j

goal (12 subgoals):
 1. \<And>\<sigma>' \<sigma> l s\<^sub>m\<^sub>s\<^sub>g p.
       \<lbrakk>\<sigma>' i = \<sigma> i;
        \<forall>j\<in>{i}. \<zeta> j = \<sigma> j\<rbrakk>
       \<Longrightarrow> \<exists>\<zeta>'.
                            (\<forall>j\<in>{i}.
                                \<zeta>' j = \<sigma>' j) \<and>
                            ((\<zeta>,
                              {l}broadcast(s\<^sub>m\<^sub>s\<^sub>g) .
                              p),
                             broadcast
                              (s\<^sub>m\<^sub>s\<^sub>g (\<sigma> i)),
                             \<zeta>', p)
                            \<in> oseqp_sos \<Gamma> i
 2. \<And>\<sigma>' \<sigma> l s\<^sub>i\<^sub>p\<^sub>s
       s\<^sub>m\<^sub>s\<^sub>g p.
       \<lbrakk>\<sigma>' i = \<sigma> i;
        \<forall>j\<in>{i}. \<zeta> j = \<sigma> j\<rbrakk>
       \<Longrightarrow> \<exists>\<zeta>'.
                            (\<forall>j\<in>{i}.
                                \<zeta>' j = \<sigma>' j) \<and>
                            ((\<zeta>,
                              {l}groupcast(s\<^sub>i\<^sub>p\<^sub>s,
      s\<^sub>m\<^sub>s\<^sub>g) .
                              p),
                             groupcast
                              (s\<^sub>i\<^sub>p\<^sub>s (\<sigma> i))
                              (s\<^sub>m\<^sub>s\<^sub>g (\<sigma> i)),
                             \<zeta>', p)
                            \<in> oseqp_sos \<Gamma> i
 3. \<And>\<sigma>' \<sigma> l s\<^sub>i\<^sub>p s\<^sub>m\<^sub>s\<^sub>g p
       q. \<lbrakk>\<sigma>' i = \<sigma> i;
           \<forall>j\<in>{i}. \<zeta> j = \<sigma> j\<rbrakk>
          \<Longrightarrow> \<exists>\<zeta>'.
                               (\<forall>j\<in>{i}.
                                   \<zeta>' j = \<sigma>' j) \<and>
                               ((\<zeta>,
                                 {l}unicast(s\<^sub>i\<^sub>p,
       s\<^sub>m\<^sub>s\<^sub>g) .
                                    p \<triangleright> q),
                                unicast (s\<^sub>i\<^sub>p (\<sigma> i))
                                 (s\<^sub>m\<^sub>s\<^sub>g (\<sigma> i)),
                                \<zeta>', p)
                               \<in> oseqp_sos \<Gamma> i
 4. \<And>\<sigma>' \<sigma> l s\<^sub>i\<^sub>p s\<^sub>m\<^sub>s\<^sub>g p
       q. \<lbrakk>\<sigma>' i = \<sigma> i;
           \<forall>j\<in>{i}. \<zeta> j = \<sigma> j\<rbrakk>
          \<Longrightarrow> \<exists>\<zeta>'.
                               (\<forall>j\<in>{i}.
                                   \<zeta>' j = \<sigma>' j) \<and>
                               ((\<zeta>,
                                 {l}unicast(s\<^sub>i\<^sub>p,
       s\<^sub>m\<^sub>s\<^sub>g) .
                                    p \<triangleright> q),
                                \<not>unicast (s\<^sub>i\<^sub>p
          (\<sigma> i)),
                                \<zeta>', q)
                               \<in> oseqp_sos \<Gamma> i
 5. \<And>\<sigma>' \<sigma> l s\<^sub>m\<^sub>s\<^sub>g p.
       \<lbrakk>\<sigma>' i = \<sigma> i;
        \<forall>j\<in>{i}. \<zeta> j = \<sigma> j\<rbrakk>
       \<Longrightarrow> \<exists>\<zeta>'.
                            (\<forall>j\<in>{i}.
                                \<zeta>' j = \<sigma>' j) \<and>
                            ((\<zeta>, {l}send(s\<^sub>m\<^sub>s\<^sub>g) .
                              p),
                             send (s\<^sub>m\<^sub>s\<^sub>g (\<sigma> i)),
                             \<zeta>', p)
                            \<in> oseqp_sos \<Gamma> i
 6. \<And>\<sigma>' \<sigma> l s\<^sub>d\<^sub>a\<^sub>t\<^sub>a p.
       \<lbrakk>\<sigma>' i = \<sigma> i;
        \<forall>j\<in>{i}. \<zeta> j = \<sigma> j\<rbrakk>
       \<Longrightarrow> \<exists>\<zeta>'.
                            (\<forall>j\<in>{i}.
                                \<zeta>' j = \<sigma>' j) \<and>
                            ((\<zeta>,
                              {l}deliver(s\<^sub>d\<^sub>a\<^sub>t\<^sub>a) .
                              p),
                             deliver
                              (s\<^sub>d\<^sub>a\<^sub>t\<^sub>a
                                (\<sigma> i)),
                             \<zeta>', p)
                            \<in> oseqp_sos \<Gamma> i
 7. \<And>\<sigma>' u\<^sub>m\<^sub>s\<^sub>g msg \<sigma> l p.
       \<lbrakk>\<sigma>' i = u\<^sub>m\<^sub>s\<^sub>g msg (\<sigma> i);
        \<forall>j\<in>{i}. \<zeta> j = \<sigma> j\<rbrakk>
       \<Longrightarrow> \<exists>\<zeta>'.
                            (\<forall>j\<in>{i}.
                                \<zeta>' j = \<sigma>' j) \<and>
                            ((\<zeta>,
                              {l}receive(u\<^sub>m\<^sub>s\<^sub>g) .
                              p),
                             receive msg, \<zeta>', p)
                            \<in> oseqp_sos \<Gamma> i
 8. \<And>\<sigma>' u \<sigma> l p.
       \<lbrakk>\<sigma>' i = u (\<sigma> i);
        \<forall>j\<in>{i}. \<zeta> j = \<sigma> j\<rbrakk>
       \<Longrightarrow> \<exists>\<zeta>'.
                            (\<forall>j\<in>{i}.
                                \<zeta>' j = \<sigma>' j) \<and>
                            ((\<zeta>, {l}\<lbrakk>u\<rbrakk>
                              p),
                             \<tau>, \<zeta>', p)
                            \<in> oseqp_sos \<Gamma> i
 9. \<And>\<sigma> pn a \<sigma>' p'.
       \<lbrakk>((\<sigma>, \<Gamma> pn), a, \<sigma>', p')
                \<in> oseqp_sos \<Gamma> i;
        \<forall>j\<in>{i}. \<zeta> j = \<sigma> j \<Longrightarrow>
        \<exists>\<zeta>'.
           (\<forall>j\<in>{i}. \<zeta>' j = \<sigma>' j) \<and>
           ((\<zeta>, \<Gamma> pn), a, \<zeta>', p')
           \<in> oseqp_sos \<Gamma> i;
        \<forall>j\<in>{i}. \<zeta> j = \<sigma> j\<rbrakk>
       \<Longrightarrow> \<exists>\<zeta>'.
                            (\<forall>j\<in>{i}.
                                \<zeta>' j = \<sigma>' j) \<and>
                            ((\<zeta>, call(pn)), a, \<zeta>', p')
                            \<in> oseqp_sos \<Gamma> i
 10. \<And>\<sigma> p a \<sigma>' p' q.
        \<lbrakk>((\<sigma>, p), a, \<sigma>', p')
                 \<in> oseqp_sos \<Gamma> i;
         \<forall>j\<in>{i}. \<zeta> j = \<sigma> j \<Longrightarrow>
         \<exists>\<zeta>'.
            (\<forall>j\<in>{i}. \<zeta>' j = \<sigma>' j) \<and>
            ((\<zeta>, p), a, \<zeta>', p') \<in> oseqp_sos \<Gamma> i;
         \<forall>j\<in>{i}. \<zeta> j = \<sigma> j\<rbrakk>
        \<Longrightarrow> \<exists>\<zeta>'.
                             (\<forall>j\<in>{i}.
                                 \<zeta>' j = \<sigma>' j) \<and>
                             ((\<zeta>, p
  \<oplus>
  q),
                              a, \<zeta>', p')
                             \<in> oseqp_sos \<Gamma> i
A total of 12 subgoals...


proof (prove)
goal (1 subgoal):
 1. monoid N (\<cdot>) \<one>


proof (prove)
goal (1 subgoal):
 1. good_prob_primality_test (\<lambda>n a. strong_fermat_liar a n) n
     (1 / 2)


proof (prove)
goal (1 subgoal):
 1. inj_on
     (\<lambda>s.
         \<langle>(\<Union>(f, g)\<in>fundfoldpairs.
                      {Abs_induced_automorph f g}) -
                  {s}\<rangle>)
     (\<Union>(f, g)\<in>fundfoldpairs. {Abs_induced_automorph f g})


proof (prove)
goal (1 subgoal):
 1. effect (!i) h\<^sub>2 h\<^sub>2 (Ref.get h\<^sub>2 i) &&&
    Ref.get h\<^sub>2 i \<le> Ref.get h\<^sub>1 i &&&
    Ref.get h\<^sub>2 i < Array.length h\<^sub>2 a


proof (prove)
goal (1 subgoal):
 1. possible_allocations_rel G N =
    injectionsUniverse \<inter>
    {a. Domain a \<in> all_partitions G \<and> Range a \<subseteq> N}


proof (prove)
goal (1 subgoal):
 1. \<And>\<pi>' a b c s.
       \<lbrakk>small_step \<pi>' (c, s) = Some (a, b);
        small_steps \<pi>' (a, b) (Some (c', s'));
        small_steps \<pi> (PScope \<pi>' a, b)
         (Some (PScope \<pi>' c', s'))\<rbrakk>
       \<Longrightarrow> small_steps \<pi> (PScope \<pi>' c, s)
                          (Some (PScope \<pi>' c', s'))


proof (prove)
using this:
  \<lbrakk>ide (tab\<^sub>0 r); seq (local.inv (rep r)) (rep r)\<rbrakk>
  \<Longrightarrow> local.inv (rep r) \<cdot> rep r \<star> tab\<^sub>0 r =
                    (local.inv (rep r) \<star> tab\<^sub>0 r) \<cdot>
                    (rep r \<star> tab\<^sub>0 r)
  ide ?r \<Longrightarrow> local.iso (rep ?r)
  ide ?r \<Longrightarrow>
  \<guillemotleft>rep ?r : src ?r \<rightarrow> trg ?r\<guillemotright>
  ide ?r \<Longrightarrow>
  \<guillemotleft>rep ?r : tab\<^sub>1 ?r \<star>
                           (tab\<^sub>0
                             ?r)\<^sup>* \<Rightarrow> ?r\<guillemotright>
  local.iso ?f \<Longrightarrow> inverse_arrows ?f (local.inv ?f)
  inverse_arrows ?f ?g \<Longrightarrow> ?g \<cdot> ?f = local.dom ?f

goal (1 subgoal):
 1. (local.inv (rep r) \<star> tab\<^sub>0 r) \<cdot>
    (rep r \<star> tab\<^sub>0 r) =
    (tab\<^sub>1 r \<star> (tab\<^sub>0 r)\<^sup>*) \<star> tab\<^sub>0 r


proof (prove)
using this:
  local.gen_lossless_gpv gpv

goal (1 subgoal):
 1. thesis


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>result = i_Exec_Comp_Stream_Init trans_fun input c;
     \<forall>x_n c_n.
        P1 x_n \<and> P2 c_n \<longrightarrow> Q (trans_fun x_n c_n);
     \<forall>t\<in>I. inext t I' = Suc t\<rbrakk>
    \<Longrightarrow> \<box> t I.
                         P1 (input t) \<and> P2 (result t) \<longrightarrow>
                         (\<circle> t1 t I'. Q (result t1))


proof (chain)
picking this:
  \<parallel>(B)\<parallel> \<equiv> \<parallel>(B)\<parallel>


proof (prove)
goal (1 subgoal):
 1. sigma_finite_measure (Pi\<^sub>M I M)


proof (prove)
goal (1 subgoal):
 1. \<exists>d>0.
       \<forall>x\<in>X.
          \<forall>x'\<in>X.
             dist x' x < d \<longrightarrow> dist (f x') (f x) < e


proof (prove)
using this:
  cyclic_on f S

goal (1 subgoal):
 1. cyclic_on (perm_swap x y f) ((x \<rightleftharpoons>\<^sub>F y) ` S)


proof (prove)
using this:
  M $$ (i, j) =
  mat_mult (mult.row_length (mat_to_cols_list A)) (mat_to_cols_list A)
   (mat_to_cols_list B) !
  j !
  i
  Matrix_Legacy.mat (mult.row_length (mat_to_cols_list A)) (dim_col A)
   (mat_to_cols_list A)
  Matrix_Legacy.mat (dim_col A) (dim_col B) (mat_to_cols_list B)
  0 < dim_col A
  i < dim_row M
  j < dim_col M
  0 < dim_col ?A \<Longrightarrow>
  mult.row_length (mat_to_cols_list ?A) = dim_row ?A
  \<lbrakk>plus_mult (1::?'a1) (*) (0::?'a1) (+) ?inver;
   Matrix_Legacy.mat (mult.row_length ?m1.0) ?n ?m1.0;
   Matrix_Legacy.mat ?n ?nc ?m2.0; ?i < mult.row_length ?m1.0;
   ?j < ?nc\<rbrakk>
  \<Longrightarrow> mat_multI (0::?'a1) (+) (*) (mult.row_length ?m1.0)
                     ?m1.0 ?m2.0 !
                    ?j !
                    ?i =
                    plus_mult.scalar_product (*) (0::?'a1) (+)
                     (Matrix_Legacy.row ?m1.0 ?i)
                     (Matrix_Legacy.col ?m2.0 ?j)
  plus_mult 1 (*) 0 (+) (a_inv cpx_rng)

goal (1 subgoal):
 1. M $$ (i, j) =
    plus_mult.scalar_product (*) 0 (+)
     (Matrix_Legacy.row (mat_to_cols_list A) i)
     (Matrix_Legacy.col (mat_to_cols_list B) j)


proof (prove)
using this:
  p = 0

goal (1 subgoal):
 1. singular_subdivision (Suc (p - Suc 0))
     (k (p - Suc 0) (chain_boundary p c)) =
    singular_subdivision p (k (p - Suc 0) (chain_boundary p c))


proof (prove)
using this:
  b = - 1

goal (1 subgoal):
 1. a = (0::'b)


proof (prove)
goal (1 subgoal):
 1. const_list ($* [e])


proof (prove)
goal (1 subgoal):
 1. \<And>host shadow_root_ptra.
       \<lbrakk>\<forall>host shadow_root_ptra.
                   h' \<turnstile> get_shadow_root host
                   \<rightarrow>\<^sub>r Some
    shadow_root_ptra \<longrightarrow>
                   shadow_root_ptra = shadow_root_ptr \<or>
                   shadow_root_ptra |\<in>| shadow_root_ptr_kinds h';
        h' \<turnstile> get_shadow_root host
        \<rightarrow>\<^sub>r Some shadow_root_ptra\<rbrakk>
       \<Longrightarrow> shadow_root_ptra |\<in>| shadow_root_ptr_kinds h'


proof (prove)
goal (2 subgoals):
 1. \<And>n.
       \<lbrakk>\<forall>n. A (Suc n) \<subseteq> A n;
        normal_set (A (Suc n))\<rbrakk>
       \<Longrightarrow> (LEAST z. z \<in> A (Suc n)) \<in> A (Suc n)
 2. \<And>y.
       \<lbrakk>\<forall>n. normal_set (A n);
        \<forall>n. A (Suc n) \<subseteq> A n;
        y \<in> \<Inter> (range A)\<rbrakk>
       \<Longrightarrow> oLimit (\<lambda>n. OrdinalVeblen.ordering (A n) 0)
                         \<le> y


proof (prove)
goal (1 subgoal):
 1. \<And>x y. - - x \<le> - (- x \<sqinter> y)


proof (prove)
goal (1 subgoal):
 1. Predicate.the A =
    singleton
     (\<lambda>x.
         Code.abort STR ''not_unique'' (\<lambda>_. Predicate.the A))
     A


proof (prove)
goal (1 subgoal):
 1. card (set (ap gs bs (ps -- sps) [] data')) \<le> card (set (ps -- sps))


proof (prove)
goal (1 subgoal):
 1. coreflexive
     ((x\<^sup>\<star> \<squnion> x\<^sup>T\<^sup>\<star>) \<sqinter>
      x\<^sup>T * x)


proof (prove)
goal (1 subgoal):
 1. bprv
     (imp (subst \<phi> \<langle>\<psi>\<rangle> xx)
       (subst \<chi> \<langle>\<chi>\<rangle> xx))


proof (prove)
using this:
  extended_ord.is_hom_GB_bound (homogenize None ` extend_indets ` F) b
  ?f7 \<in> homogenize None ` extend_indets ` F \<Longrightarrow>
  homogeneous ?f7
  g' \<in> extended_ord.punit.reduced_GB
            (homogenize None ` extend_indets ` F)

goal (1 subgoal):
 1. poly_deg g' \<le> b


proof (prove)
using this:
  atom i \<sharp> (x, y)
  atom j \<sharp> (i, x, y)
  atom k \<sharp> (i, j, y)

goal (1 subgoal):
 1. atom j \<sharp> (i, Var i EQ y IFF Var i SUBS y AND y SUBS Var i)