proof (prove)
goal (1 subgoal):
 1. \<not> [0] \<sqsubseteq>\<^bsub>r\<^esub> rev [0..<n]


proof (prove)
using this:
  Plus_Times_pre_cong R L K

goal (1 subgoal):
 1. \<oo> L \<le> \<oo> K \<and>
    (\<forall>x. Plus_Times_pre_cong R (\<dd> L x) (\<dd> K x))


proof (prove)
goal (1 subgoal):
 1. Chernoff (CD_on ds)


proof (prove)
goal (1 subgoal):
 1. (\<tau>mRed1 (ls, (ts1, m1), ws, is) s1' &&&
     (\<And>t'.
         t' \<noteq> t \<Longrightarrow>
         tbisim (ws t' = None) t' (thr s1' t') m1 (ts2 t') m2)) &&&
    r1.cond_action_oks s1' t cts &&& thr s1' t = \<lfloor>xln\<rfloor>


proof (prove)
using this:
  fmpred P (foldl (++\<^sub>f) (init ++\<^sub>f x) xs)

goal (1 subgoal):
 1. fmpred P (foldl (++\<^sub>f) init (x # xs))


proof (prove)
goal (1 subgoal):
 1. evaluate True env s (exp0.If e1 e2 e3) (?s', ?r1)


proof (prove)
using this:
  xs ! V = Addr A
  V < length xs

goal (1 subgoal):
 1. True,P,t \<turnstile>1 \<langle>insync\<^bsub>V\<^esub> (a) Throw a',
                            (h, xs)\<rangle> -\<lbrace>(Unlock, A),
                           SyncUnlock A\<rbrace>\<rightarrow>
                           \<langle>Throw a',(h, xs)\<rangle> &&&
    True,P,t \<turnstile>1 \<langle>insync\<^bsub>V\<^esub> (a) Throw a',
                            (h, xs)\<rangle> -\<lbrace>(UnlockFail,
                  A)\<rbrace>\<rightarrow>
                           \<langle>Throw
                                     (addr_of_sys_xcpt IllegalMonitorState),
                            (h, xs)\<rangle>


proof (prove)
using this:
  a \<in>\<^sub>\<circ> \<D>\<^sub>\<circ>
                         ((\<FF> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M
                           dghm_id \<AA>)\<lparr>ArrMap\<rparr>)

goal (1 subgoal):
 1. (\<FF> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M
     dghm_id \<AA>)\<lparr>ArrMap\<rparr>\<lparr>a\<rparr> =
    \<FF>\<lparr>ArrMap\<rparr>\<lparr>a\<rparr>


proof (prove)
goal (1 subgoal):
 1. p *\<^sub>p (1::'a)\<^sub>p = p &&& (1::'a)\<^sub>p *\<^sub>p p = p


proof (prove)
goal (1 subgoal):
 1. j < length xs \<longrightarrow> local.times a xs ! j = a * xs ! j


proof (prove)
goal (1 subgoal):
 1. (uncurry ?f2, uncurry (RETURN \<circ>\<circ> lexord_eq))
    \<in> monom_assn\<^sup>k *\<^sub>a
          monom_assn\<^sup>k \<rightarrow>\<^sub>a bool_assn


proof (prove)
goal (1 subgoal):
 1. UNIV // eq_nextl \<subseteq> left_lang ` states M


proof (prove)
using this:
  \<lbrakk>encF N t \<in> trm; FvarsT (encF N t) = {}\<rbrakk>
  \<Longrightarrow> prv (imp (PP (encF N t))
                          (PP \<langle>PP (encF N t)\<rangle>))
  PP (encF N t) = inst \<psi> t
  \<phi>J ?\<psi> \<equiv> subst ?\<psi> (tJ ?\<psi>) xx
  \<phi> \<equiv> \<phi>J \<psi>
  \<psi> \<equiv> PP (encF N (Var xx))
  inst ?\<phi> ?t = subst ?\<phi> ?t xx
  t \<equiv> tJ \<psi>

goal (1 subgoal):
 1. prv (imp \<phi> (PP \<langle>\<phi>\<rangle>))


proof (prove)
using this:
  \<exists>f. inj_on f (elts A) \<and> f ` elts A \<subseteq> elts B

goal (1 subgoal):
 1. (\<And>f.
        \<lbrakk>inj_on f (elts A); f ` elts A \<subseteq> elts B\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  span f g
  tuple ?f ?g =
  mkArr (Dom ?f) (local.set (local.prod (cod ?f) (cod ?g)))
   (\<lambda>x. UP \<langle>DOWN (Fun ?f x), DOWN (Fun ?g x)\<rangle>)
  HF'.tuple ?f ?g \<equiv>
  if span ?f ?g
  then THE l.
          local.comp (pr1 (cod ?f) (cod ?g)) l = ?f \<and>
          local.comp (pr0 (cod ?f) (cod ?g)) l = ?g
  else null

goal (1 subgoal):
 1. tuple f g = HF'.tuple f g


proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>ps\<^sub>R.
       (case x of (x, y) \<Rightarrow> (real_of_int x, real_of_int y))
       \<in> LSQ \<longrightarrow>
       (case x of (x, y) \<Rightarrow> (real_of_int x, real_of_int y))
       \<in> RSQ


proof (state)
goal (1 subgoal):
 1. mon_ww fg w2 \<subseteq> mon_ww fg (map le_rem_s (env w))


proof (prove)
using this:
  {r \<in> \<delta>. qw \<in> set (rhsq r) \<and> the (rcm r) \<le> Suc 0} =
  {r \<in> \<delta>.
   qw \<in> set (rhsq r) \<and> set (rhsq r) \<subseteq> dom Q - (W - {qw})}

goal (1 subgoal):
 1. dsqr =
    {r \<in> \<delta>.
     qw \<in> set (rhsq r) \<and>
     set (rhsq r) \<subseteq> dom Q - (W - {qw})}


proof (prove)
goal (1 subgoal):
 1. valof topfloat = largest TYPE(('e, 'f) IEEE.float)


proof (prove)
using this:
  {} \<subseteq> {a. irreducible a}
  \<forall>c\<in>{}. [a = b] (mod c)
  \<forall>p1 p2.
     p1 \<in> {} \<and> p2 \<in> {} \<and> p1 \<noteq> p2 \<longrightarrow>
     comm_monoid_mult_class.coprime p1 p2

goal (1 subgoal):
 1. [a = b] (mod \<Prod>{})


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<exists>T. connectedin X T \<and> x \<in> T \<and> y \<in> T;
     \<exists>T. connectedin X T \<and> y \<in> T \<and> z \<in> T\<rbrakk>
    \<Longrightarrow> \<exists>T.
                         connectedin X T \<and> x \<in> T \<and> z \<in> T


proof (prove)
goal (1 subgoal):
 1. set (trd (xs @ ys) a # ys)
    \<subseteq> set (comp_red_basis_aux xs (trd (xs @ ys) a # ys))


proof (prove)
goal (1 subgoal):
 1. \<And>a Q'.
       \<lbrakk>x \<sharp> P;
        \<And>y R.
           y \<sharp> R \<Longrightarrow>
           (\<lparr>\<nu>y\<rparr>R, R) \<in> Rel;
        Id \<subseteq> Rel;
        P \<oplus>
        \<lparr>\<nu>x\<rparr>Q \<longmapsto>a \<prec> Q'\<rbrakk>
       \<Longrightarrow> \<exists>P'.
                            \<lparr>\<nu>x\<rparr>(P \<oplus>
             Q) \<longmapsto>a \<prec> P' \<and>
                            (P', Q') \<in> Rel


proof (prove)
goal (5 subgoals):
 1. \<And>x. x \<in> cbox t (t + h) \<Longrightarrow> 0 \<le> t + h - x
 2. bounded F'
 3. closed F'
 4. convex F'
 5. cbox t (t + h) \<noteq> {}


proof (prove)
goal (1 subgoal):
 1. key_sets (Hash X) (crypts H) \<subseteq> key_sets X (crypts H)


proof (prove)
using this:
  x \<in> s
  y \<in> s
  convex s
  ?x \<in> s \<Longrightarrow>
  (f has_derivative (\<lambda>h. 0::'b)) (at ?x within s)

goal (1 subgoal):
 1. norm (f x - f y) \<le> 0 * norm (x - y)


proof (prove)
goal (1 subgoal):
 1. \<integral>\<^sup>+ y. j (y, \<langle>a\<rangle>)
                       \<partial>embed_measure (count_space UNIV) Some
    \<le> (\<Sum>\<^sup>+ x. j (x, \<langle>a\<rangle>))


proof (prove)
goal (1 subgoal):
 1. has_sort oss (Tv idn S) S' \<Longrightarrow>
    sort_leq (subclass oss) S S'


proof (state)
this:
  (SUP \<beta>\<in>elts \<mu>. \<beta>)
  \<le> \<Squnion> ((+) \<alpha> ` elts \<mu>)

goal (1 subgoal):
 1. \<And>\<alpha>'.
       \<lbrakk>Limit \<alpha>';
        \<And>\<xi>.
           \<xi> \<in> elts \<alpha>' \<Longrightarrow>
           \<xi> \<le> \<alpha> + \<xi>\<rbrakk>
       \<Longrightarrow> (SUP \<xi>\<in>elts \<alpha>'. \<xi>)
                         \<le> \<alpha> +
                               (SUP \<xi>\<in>elts \<alpha>'. \<xi>)


proof (prove)
goal (1 subgoal):
 1. map_option (\<lambda>v'. v' + m\<^sub>1(k $$:= v) $$! k')
     (if k = k' then Some v' else {$$} $$ k') =
    {k $$:= v' + v} $$ k'


proof (prove)
goal (1 subgoal):
 1. (\<And>w.
        \<lbrakk>infdist w {x--y} \<le> 4 * deltaG TYPE('a);
         infdist w {x--z} \<le> 4 * deltaG TYPE('a);
         infdist w {y--z} \<le> 4 * deltaG TYPE('a);
         dist w x = Gromov_product_at x y z\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. (map (inv p)
      (filter (\<lambda>x. x \<in> range p)
        (xs @
         ipurge_tr (con_comp_pol I) (con_comp_map D E p q)
          (con_comp_map D E p q y) ys)),
     inv p `
     ipurge_ref (con_comp_pol I) (con_comp_map D E p q)
      (con_comp_map D E p q y) ys R)
    \<in> failures P


proof (prove)
goal (1 subgoal):
 1. s + t + punit.lt (rep_list f) \<in> keys (rep_list (monom_mult c s p))


proof (state)
goal (4 subgoals):
 1. \<And>x y. (x < y) = (x \<le> y \<and> \<not> y \<le> x)
 2. \<And>x. x \<le> x
 3. \<And>x y z.
       \<lbrakk>x \<le> y; y \<le> z\<rbrakk> \<Longrightarrow> x \<le> z
 4. \<And>x y.
       \<lbrakk>x \<le> y; y \<le> x\<rbrakk> \<Longrightarrow> x = y


proof (prove)
goal (1 subgoal):
 1. \<And>S.
       S \<subseteq> fix f (pset cl) \<Longrightarrow>
       \<exists>L.
          isLub S
           \<lparr>pset = fix f (pset cl),
              order = induced (fix f (pset cl)) (order cl)\<rparr>
           L


proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F y in at a within C. y \<in> C


proof (prove)
using this:
  match_list ?d [(p, t)] = Some ?\<sigma> \<Longrightarrow>
  ?\<sigma> \<in> matchers (set [(p, t)])
  match_list ?d [(p, t)] = None \<Longrightarrow>
  matchers (set [(p, t)]) = {}

goal (1 subgoal):
 1. matches t p = (\<exists>\<sigma>. p \<cdot> \<sigma> = t)


proof (prove)
goal (1 subgoal):
 1. \<And>Event Source Trigger Guard Action Update Target SA.
       \<lbrakk>(Source, (Trigger, Guard, Action, Update), Target) \<in> TS;
        Event \<in> Action; SA \<in> SAs (HA ST);
        (Source, (Trigger, Guard, Action, Update), Target) \<in> Delta SA;
        Source \<in> Conf ST;
        (Conf ST, Events ST, Value ST) |= (Trigger, Guard, Action, Update);
        (Trigger, Guard, Action, Update) \<notin> Label (Delta SA)\<rbrakk>
       \<Longrightarrow> Event \<in> HAEvents (HA ST)


proof (prove)
using this:
  ((\<sigma>, k), \<sigma>', k') \<in> cp

goal (1 subgoal):
 1. ((\<sigma>, k), \<sigma>', k') \<in> cop


proof (prove)
using this:
  Card_order (natLeq_on n) \<and>
  Card_order (cardSuc (natLeq_on n)) \<and> Card_order (natLeq_on (Suc n))
  (natLeq_on ?m <o natLeq_on ?n) = (?m < ?n)
  \<lbrakk>Card_order ?r; Card_order ?r'\<rbrakk>
  \<Longrightarrow> (?r <o ?r') = (cardSuc ?r \<le>o ?r')

goal (1 subgoal):
 1. cardSuc (natLeq_on n) \<le>o natLeq_on (Suc n)


proof (prove)
using this:
  s \<in> carrier R\<^bsup>\<omega>\<^esup>
  f \<in> carrier (function_ring (carrier R) R)
  ?s \<in> carrier ?R\<^bsup>\<omega>\<^esup> \<Longrightarrow>
  ?s ?k \<in> carrier ?R

goal (1 subgoal):
 1. \<And>k. (f \<circ> s) k \<in> carrier R


proof (prove)
goal (1 subgoal):
 1. Set.filter P (set xs) = set (filter P xs)


proof (prove)
goal (1 subgoal):
 1. 0 \<le> valof x


proof (prove)
goal (3 subgoals):
 1. P +\<^sub>\<S> bexp_neg e \<turnstile> P
 2. \<forall>mds.
       tyenv_wellformed mds \<Gamma> \<S> P \<longrightarrow>
       tyenv_wellformed mds \<Gamma> \<S> P
 3. \<forall>mds.
       tyenv_wellformed mds \<Gamma> \<S>
        P +\<^sub>\<S> bexp_neg e \<longrightarrow>
       tyenv_wellformed mds \<Gamma> \<S> P


proof (prove)
goal (4 subgoals):
 1. \<And>h some_ptr ancestors child_node parent.
       \<lbrakk>Shadow_DOM.heap_is_wellformed h;
        h \<turnstile> Shadow_DOM.get_ancestors some_ptr
        \<rightarrow>\<^sub>r ancestors;
        cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r
         child_node
        \<in> set ancestors;
        h \<turnstile> Shadow_DOM.get_parent child_node
        \<rightarrow>\<^sub>r Some parent;
        ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h\<rbrakk>
       \<Longrightarrow> parent \<in> set ancestors
 2. \<And>h ancestor ptr ancestors thesis.
       \<lbrakk>Shadow_DOM.heap_is_wellformed h; ancestor \<noteq> ptr;
        ancestor \<in> set ancestors;
        h \<turnstile> Shadow_DOM.get_ancestors ptr
        \<rightarrow>\<^sub>r ancestors;
        ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h;
        \<forall>children.
           h \<turnstile> Shadow_DOM.get_child_nodes ancestor
           \<rightarrow>\<^sub>r children \<longrightarrow>
           (\<forall>ancestor_child.
               ancestor_child \<in> set children \<longrightarrow>
               cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r
                ancestor_child
               \<in> set ancestors \<longrightarrow>
               thesis)\<rbrakk>
       \<Longrightarrow> thesis
 3. \<And>h child ancestors ptr.
       \<lbrakk>Shadow_DOM.heap_is_wellformed h;
        h \<turnstile> Shadow_DOM.get_ancestors child
        \<rightarrow>\<^sub>r ancestors;
        ShadowRootClass.known_ptrs h; ShadowRootClass.type_wf h;
        (ptr, child) \<in> (Shadow_DOM.parent_child_rel h)\<^sup>*\<rbrakk>
       \<Longrightarrow> ptr \<in> set ancestors
 4. \<And>h child ancestors ptr.
       \<lbrakk>Shadow_DOM.heap_is_wellformed h;
        h \<turnstile> Shadow_DOM.get_ancestors child
        \<rightarrow>\<^sub>r ancestors;
        ShadowRootClass.known_ptrs h; ShadowRootClass.type_wf h;
        ptr \<in> set ancestors\<rbrakk>
       \<Longrightarrow> (ptr, child)
                         \<in> (Shadow_DOM.parent_child_rel h)\<^sup>*


proof (prove)
using this:
  y \<in> unit_disc
  y \<in> circline_set H \<inter> circline_set y_axis
  moebius_circline (moebius_rotation (pi / 2)) y_axis = x_axis

goal (1 subgoal):
 1. moebius_pt (moebius_rotation (pi / 2)) y \<in> unit_disc \<and>
    moebius_pt (moebius_rotation (pi / 2)) y
    \<in> circline_set
           (moebius_circline (moebius_rotation (pi / 2)) H) \<inter>
          circline_set x_axis


proof (state)
this:
  u ?n \<in> space\<^sub>N N

goal (1 subgoal):
 1. \<And>u.
       \<lbrakk>cauchy_in\<^sub>N N u;
        \<forall>n. u n \<in> space\<^sub>N N\<rbrakk>
       \<Longrightarrow> \<exists>x\<in>space\<^sub>N N.
                            tendsto_in\<^sub>N N u x


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<delta> X) \<tau> \<noteq> \<bottom>;
     \<bottom> = true \<tau>\<rbrakk>
    \<Longrightarrow> False


proof (prove)
goal (1 subgoal):
 1. sets
     (gen_subalgebra M
       (sigma_sets (space M)
         (\<Union>i\<in>{m. m \<le> n}.
             {X i -` A \<inter> space M |A. A \<in> sets P}))) =
    sets
     (gen_subalgebra N
       (sigma_sets (space N)
         (\<Union>i\<in>{m. m \<le> n}.
             {X i -` A \<inter> space N |A. A \<in> sets P})))


proof (prove)
goal (1 subgoal):
 1. P xs = P (remdups xs)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Worder D; x = ordinal_number D; y \<in> ODnums;
     y \<sqsubset> x; ODNmap D y \<in> carrier D;
     \<forall>Y\<in>y. ord_equiv Y (Iod D (segment D (ODNmap D y)));
     \<exists>c.
        c \<in> carrier D \<and>
        y = ordinal_number (Iod D (segment D c))\<rbrakk>
    \<Longrightarrow> y = ordinal_number (Iod D (segment D (ODNmap D y)))


proof (prove)
using this:
  ?a \<in> A \<Longrightarrow> g (Min A) \<le> g ?a
  \<lbrakk>xs = sorted_list_of_set ?A; finite ?A; mono_on g ?A;
   inj_on g ?A\<rbrakk>
  \<Longrightarrow> sorted_list_of_set (g ` ?A) =
                    map g (sorted_list_of_set ?A)
  x # xs = sorted_list_of_set A
  finite A
  mono_on g A
  inj_on g A
  A \<noteq> {}

goal (1 subgoal):
 1. Min (g ` A) = g (Min A)


proof (prove)
goal (1 subgoal):
 1. aff_dim {x. r \<le> a \<bullet> x} =
    (if a = (0::'a) \<and> 0 < r then - 1 else int DIM('a))


proof (prove)
goal (1 subgoal):
 1. - mtx [[a, b], [c, d]] = mtx [[- a, - b], [- c, - d]]


proof (prove)
using this:
  v \<notin> {v. v \<turnstile> EQ x c}
  v \<turnstile> EQ x c

goal (1 subgoal):
 1. False


proof (prove)
using this:
  ?i \<in> I \<Longrightarrow> Group.group (G ?i)

goal (1 subgoal):
 1. (x \<otimes>\<^bsub>DirProds G I\<^esub>
     y \<otimes>\<^bsub>DirProds G I\<^esub>
     z)
     i =
    (x \<otimes>\<^bsub>DirProds G I\<^esub> y)
     i \<otimes>\<^bsub>G i\<^esub>
    z i


proof (prove)
goal (1 subgoal):
 1. sum card {S' \<inter> p |p. p \<in> P}
    \<le> card {S' \<inter> p |p. p \<in> P} * \<Delta>


proof (state)
this:
  (f (real_of_float l) + f (real_of_float u) -
   real_of_float (a * (l + u))) /
  2
  \<in>\<^sub>r bivl
  Y = affine_unop p (real_of_float a) b (real_of_float (upper divl)) X
  (f (real_of_float u) - f (real_of_float l) -
   real_of_float (a * (u - l))) /
  2 +
  be
  \<in>\<^sub>r divl
  real_of_float a \<le> f' (real_of_float l)
  real_of_float a \<le> f' (real_of_float u)
  b = real_of_float (lower bivl + upper bivl) / 2
  be = real_of_float (upper bivl - lower bivl) / 2

goal (1 subgoal):
 1. f x \<in> aform_err e Y


proof (prove)
goal (1 subgoal):
 1. {x. x ^ n = 1} = {x. 1 * x ^ n - poly 1 x = 0}


proof (prove)
goal (1 subgoal):
 1. if tst then c1 else c2 \<approx>01 if tst then d1 else d2


proof (prove)
goal (1 subgoal):
 1. ta_seq_consist P vs (lappend obs obs') =
    (ta_seq_consist P vs obs \<and>
     ta_seq_consist P (mrw_values P vs (list_of obs)) obs')


proof (prove)
goal (2 subgoals):
 1. \<And>w f.
       \<lbrakk>\<forall>w r.
                   (\<forall>v<w. p v \<le> r) \<longrightarrow>
                   hoare (p w \<sqinter> b) x r;
        \<forall>u. p u \<le> q;
        \<And>v.
           v < w \<Longrightarrow> hoare (p v) f (q \<sqinter> - b)\<rbrakk>
       \<Longrightarrow> hoare (p w) ([\<cdot> b ] * x)
                          (wp f (q \<sqinter> - b))
 2. \<And>w f.
       \<lbrakk>\<forall>w r.
                   (\<forall>v<w. p v \<le> r) \<longrightarrow>
                   hoare (p w \<sqinter> b) x r;
        \<forall>u. p u \<le> q;
        \<And>v.
           v < w \<Longrightarrow> hoare (p v) f (q \<sqinter> - b)\<rbrakk>
       \<Longrightarrow> hoare (p w) [\<cdot> - b ] (q \<sqinter> - b)


proof (prove)
goal (1 subgoal):
 1. all_normalized_and_ex_tcsigs (set cs) (translate_ars arss)


proof (prove)
goal (1 subgoal):
 1. (\<And>i.
        \<forall>x\<in>S.
           (f i \<longlongrightarrow> f i x)
            (at x within S)) \<Longrightarrow>
    \<forall>x\<in>S.
       ((\<lambda>x. \<chi>i. f i x) \<longlongrightarrow> (\<chi>i. f i x))
        (at x within S)


proof (prove)
goal (1 subgoal):
 1. nfa (Reverse_nfa M)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>well_formed procs;
     (Main, ins, outs, c) \<in> set procs\<rbrakk>
    \<Longrightarrow> False


proof (prove)
using this:
  shd (stl s) = shd s
  \<lparr>c_msg := (c_msg (shd s))
            (p := \<lambda>q.
                     c_msg (shd s) p q @
                     [{#t \<in>#\<^sub>z c_temp (shd s) p. t \<in> tt#}]),
     c_temp := (c_temp (shd s))
       (p := c_temp (shd s) p -
             {#t \<in>#\<^sub>z c_temp (shd s) p. t \<in> tt#})\<rparr>
  p \<noteq> p'

goal (1 subgoal):
 1. InfoAt (shd (stl s)) k' p' q' = InfoAt (shd s) k' p' q'


proof (prove)
goal (1 subgoal):
 1. \<I>, \<I>' \<turnstile>\<^sub>C fail_converter \<surd>


proof (prove)
goal (1 subgoal):
 1. Gauss_Jordan_in_ij A i j =
    (\<chi>s.
        if s = i then A' $ s
        else row_add A' s i (- interchange_A $ s $ j) $ s)


proof (prove)
using this:
  \<forall>x\<in>s. \<exists>f'. (f has_field_derivative f') (at x within s)
  w \<noteq> 0

goal (1 subgoal):
 1. \<forall>x\<in>s.
       \<exists>f'.
          ((\<lambda>z. w powr f z) has_field_derivative f') (at x within s)


proof (prove)
goal (1 subgoal):
 1. 0 < r1 &&& 0 < r2


proof (prove)
goal (1 subgoal):
 1. (A ^\<^sub>m k *\<^sub>v v) $v j =
    (map_mat cmod (of_real_hom.mat_hom A ^\<^sub>m k) *\<^sub>v v) $v j


proof (prove)
goal (1 subgoal):
 1. functor (\<cdot>\<^sub>A\<^sub>1\<^sub>x\<^sub>A\<^sub>2)
     (\<cdot>\<^sub>B) (uncurry G)


proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<forall>c. c = 0 \<or> b \<noteq> c *\<^sub>R a;
     a \<noteq> (0::'a); b \<noteq> (0::'a);
     \<And>c.
        c \<noteq> 0 \<Longrightarrow> b \<noteq> c *\<^sub>R a\<rbrakk>
    \<Longrightarrow> \<exists>A.
                         (\<forall>x\<in>A. x \<noteq> (0::'a)) \<and>
                         open A \<and>
                         (\<exists>B.
                             (\<forall>x\<in>B. x \<noteq> (0::'a)) \<and>
                             open B \<and>
                             a \<in> A \<and>
                             b \<in> B \<and>
                             A \<times> B
                             \<subseteq> - {x.
      (\<exists>c. c \<noteq> 0 \<and> snd x = c *\<^sub>R fst x) \<and>
      (\<exists>a b.
          x = (a, b) \<and>
          a \<noteq> (0::'a) \<and> b \<noteq> (0::'a))} \<and>
                             A \<times> B
                             \<subseteq> {a. a \<noteq> (0::'a)} \<times>
   {b. b \<noteq> (0::'a)})
 2. \<And>c.
       \<lbrakk>\<forall>c. c = 0 \<or> b \<noteq> c *\<^sub>R a;
        a \<noteq> (0::'a); b \<noteq> (0::'a); c \<noteq> 0\<rbrakk>
       \<Longrightarrow> b \<noteq> c *\<^sub>R a


proof (prove)
using this:
  \<forall>\<^sub>F x in at_top. 0 < l x
  \<forall>\<^sub>F x in at_top. l x \<le> f x
  \<forall>\<^sub>F x in at_top. f x \<le> g x

goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. g x powr p \<le> f x powr p


proof (prove)
using this:
  x \<in> A \<Gamma> \<Longrightarrow> x \<in> RF (TER f)

goal (1 subgoal):
 1. x \<in> SAT (quotient_web \<Gamma> f) (g \<upharpoonleft> \<Gamma> / f)


proof (prove)
goal (1 subgoal):
 1. pnderiv a r = pnorm (deriv a r)


proof (prove)
goal (1 subgoal):
 1. {card B |B. basis_in \<E> B} = {card B}


proof (prove)
goal (1 subgoal):
 1. pmf (Pi_pmf A dflt p) f =
    (if \<forall>x. x \<notin> A \<longrightarrow> f x = dflt
     then \<Prod>x\<in>A. pmf (p x) (f x) else 0)


proof (prove)
goal (1 subgoal):
 1. OFCLASS(real, euclidean_ring_gcd_class)


proof (prove)
using this:
  \<guillemotleft>Cop_S.MkArr (\<Phi>'.Y a) (\<Phi>'.Y a')
                   \<Phi>\<Psi>'.map : local.map
  a \<rightarrow>\<^sub>[\<^sub>C\<^sub>o\<^sub>p\<^sub>,\<^sub>S\<^sub>] local.map
                                     a'\<guillemotright>

goal (1 subgoal):
 1. \<exists>f.
       \<guillemotleft>f : a \<rightarrow> a'\<guillemotright> \<and>
       local.map f =
       Cop_S.MkArr (\<Phi>'.Y a) (\<Phi>'.Y a') \<Phi>\<Psi>'.map


proof (prove)
goal (1 subgoal):
 1. X \<noteq> {} \<Longrightarrow>
    op_set_npick_remove X =
    ASSERT (X \<noteq> {}) \<bind>
    (\<lambda>_.
        op_set_pick X \<bind>
        (\<lambda>x.
            op_set_ndelete x X \<bind> (\<lambda>X'. RETURN (x, X'))))


proof (chain)
picking this:
  \<turnstile>\<^sub>p {wlp S (wlp (While M S) P)} S
                       {adjoint (M 0) * P * M 0 +
                        adjoint (M 1) * wlp S (wlp (While M S) P) * M 1}


proof (state)
goal (1 subgoal):
 1. (\<And>ns.
        \<lbrakk>DirProds (\<lambda>n. Z (ns ! n)) {..<length ns} \<cong> G;
         \<forall>n\<in>set ns.
            n = 0 \<or>
            (\<exists>p k.
                normalization_semidom_class.prime p \<and>
                0 < k \<and> n = p ^ k)\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. complex_of_real (2 * pi) * \<i> * of_int (unwinding z) = z - Ln (exp z)


proof (prove)
using this:
  \<lbrakk>\<And>r r3.
              (\<And>r r2 r3.
                  Done\<cdot>cfcomp \<diamondop> c1\<cdot>r \<diamondop>
                  r2 \<diamondop>
                  r3 =
                  c1\<cdot>r \<diamondop>
                  (r2 \<diamondop> r3)) \<Longrightarrow>
              Done\<cdot>cfcomp \<diamondop>
              More\<cdot>(fmap\<cdot>c1\<cdot>p1) \<diamondop>
              c2\<cdot>r \<diamondop>
              r3 =
              More\<cdot>(fmap\<cdot>c1\<cdot>p1) \<diamondop>
              (c2\<cdot>r \<diamondop> r3);
   \<And>r r2 r3.
      Done\<cdot>cfcomp \<diamondop> c1\<cdot>r \<diamondop> r2 \<diamondop>
      r3 =
      c1\<cdot>r \<diamondop> (r2 \<diamondop> r3)\<rbrakk>
  \<Longrightarrow> Done\<cdot>cfcomp \<diamondop>
                    More\<cdot>(fmap\<cdot>c1\<cdot>p1) \<diamondop>
                    More\<cdot>(fmap\<cdot>c2\<cdot>p2) \<diamondop>
                    c3\<cdot>?r =
                    More\<cdot>(fmap\<cdot>c1\<cdot>p1) \<diamondop>
                    (More\<cdot>(fmap\<cdot>c2\<cdot>p2) \<diamondop>
                     c3\<cdot>?r)
  (\<And>r r2 r3.
      Done\<cdot>cfcomp \<diamondop> c1\<cdot>r \<diamondop> r2 \<diamondop>
      r3 =
      c1\<cdot>r \<diamondop> (r2 \<diamondop> r3)) \<Longrightarrow>
  Done\<cdot>cfcomp \<diamondop>
  More\<cdot>(fmap\<cdot>c1\<cdot>p1) \<diamondop>
  c2\<cdot>?r \<diamondop>
  ?r3.0 =
  More\<cdot>(fmap\<cdot>c1\<cdot>p1) \<diamondop>
  (c2\<cdot>?r \<diamondop> ?r3.0)
  Done\<cdot>cfcomp \<diamondop> c1\<cdot>?r \<diamondop> ?r2.0 \<diamondop>
  ?r3.0 =
  c1\<cdot>?r \<diamondop> (?r2.0 \<diamondop> ?r3.0)

goal (1 subgoal):
 1. Done\<cdot>cfcomp \<diamondop>
    More\<cdot>(fmap\<cdot>c1\<cdot>p1) \<diamondop>
    More\<cdot>(fmap\<cdot>c2\<cdot>p2) \<diamondop>
    More\<cdot>(fmap\<cdot>c3\<cdot>p3) =
    More\<cdot>(fmap\<cdot>c1\<cdot>p1) \<diamondop>
    (More\<cdot>(fmap\<cdot>c2\<cdot>p2) \<diamondop>
     More\<cdot>(fmap\<cdot>c3\<cdot>p3))


proof (prove)
goal (2 subgoals):
 1. \<And>q x.
       \<lbrakk>0 < k; 0 < q;
        [ r, mod q * k ] = [ r div k * k, mod q * k ] \<oplus> r mod k;
        x mod (q * k) = r div k * k mod (q * k);
        r div k * k \<le> x\<rbrakk>
       \<Longrightarrow> x mod k + r mod k mod k < k
 2. \<And>q.
       \<lbrakk>0 < k; 0 < q;
        [ r, mod q * k ] = [ r div k, mod q ] \<otimes> k \<oplus> r mod k;
        [ r div k, mod q ] \<otimes> k \<oplus> r mod k \<oslash> k =
        [ r div k, mod q ] \<otimes> k \<oslash> k \<oplus>
        r mod k div k\<rbrakk>
       \<Longrightarrow> [ r div k, mod q ] \<otimes> k \<oplus>
                         r mod k \<oslash>
                         k =
                         [ r div k, mod q ]


proof (prove)
goal (1 subgoal):
 1. generalize_instr (generalize_instr x) = generalize_instr x


proof (prove)
goal (1 subgoal):
 1. fgraph ` TameEnum \<subseteq>\<^sub>\<simeq> Archive


proof (prove)
using this:
  sds (lift (\<lambda>x. R (\<pi> x))) = sds (lift R)

goal (1 subgoal):
 1. sds (lift (\<lambda>x. R (\<pi> x))) = sds (lift R)


proof (state)
goal (1 subgoal):
 1. quorum_of p Q


proof (prove)
goal (2 subgoals):
 1. is_cupcake_ns (alist_to_ns env')
 2. is_cupcake_ns (sem_env.v env)


proof (prove)
using this:
  finite A
  A \<subseteq> {a..b}
  a \<in> A
  b \<in> A
  a < b

goal (1 subgoal):
 1. A \<inter> {Max (A \<inter> {..<u})<..<u} = {}


proof (chain)
picking this:
  \<Psi> \<otimes>
  \<Psi>\<^sub>Q \<rhd> P \<longmapsto> M\<lparr>\<nu>*xvec\<rparr>\<langle>N\<rangle> \<prec> P'
  extractFrame P = \<langle>A\<^sub>P, \<Psi>\<^sub>P\<rangle>
  distinct A\<^sub>P
  (\<Psi> \<otimes> \<Psi>\<^sub>Q) \<otimes>
  \<Psi>\<^sub>P \<turnstile> M \<leftrightarrow> K'


proof (prove)
goal (1 subgoal):
 1. d p \<le> d r + wp y q


proof (prove)
goal (1 subgoal):
 1. (length l = x1 \<longrightarrow> eval F (l @ init @ xs)) =
    (length l = x1 \<longrightarrow>
     eval (map_fm_binders (\<lambda>a x. liftAtom (i + x) amount a) F x1)
      (l @ init @ I @ xs))


proof (prove)
goal (1 subgoal):
 1. module_on U\<^sub>M s


proof (prove)
goal (1 subgoal):
 1. color_of (rbt_map_entry k f t) = color_of t


proof (prove)
goal (1 subgoal):
 1. relation_subsumption_impl r subsumes set
     (\<lambda>x. case x of h # t \<Rightarrow> (h, t)) (@) length


proof (prove)
goal (1 subgoal):
 1. <mtx_curry_assn n M
      Mi> fw_impl n
           Mi <\<lambda>r.
                  \<exists>\<^sub>AM'.
                     mtx_curry_assn n M' r *
                     \<up>
                      (if \<exists>i\<le>n. M' i i < (0::'a)
                       then \<not> cycle_free M n
                       else \<forall>i\<le>n.
                               \<forall>j\<le>n.
                                  M' i j = D M i j n \<and>
                                  cycle_free M n)>\<^sub>t


proof (prove)
goal (1 subgoal):
 1. s[x::=v][y::=u] = s[y::=u][x::=v[y::=u]]


proof (prove)
using this:
  invariant ?ds cop_F_closed_inv
  cop_F_closed_inv ds fp
  x \<in> cop_F ds fp
  Xd x \<notin> Xd ` CH (cop_F ds fp)

goal (1 subgoal):
 1. \<exists>fp'\<subseteq>cop_F ds fp.
       x \<in> fp' \<and>
       above (Pd (Xd x)) x \<subseteq> fp' \<and> Xd x \<notin> Xd ` CH fp'


proof (prove)
using this:
  resumption_ord (h (the (Resumption.resumption.result f')))
   (k (the (Resumption.resumption.result f')))
  resumption_ord f' g'
  \<forall>x. resumption_ord (h x) (k x)
  \<not> Resumption.resumption.is_Done (g' \<bind> k)
  Resumption.resumption.is_Done (f' \<bind> h)

goal (1 subgoal):
 1. Resumption.resumption.result (f' \<bind> h) = None


proof (prove)
goal (1 subgoal):
 1. sa.is_run r =
    (\<exists>r'. r = pidgc_\<alpha> \<circ> r' \<and> pid.is_run r')


proof (prove)
using this:
  Some cl \<in> set (concat (s.tab s))
  list_all (tab_agree \<S>) (concat (s.tab s))

goal (1 subgoal):
 1. \<exists>tf. cl_typing \<S> cl tf


proof (prove)
goal (1 subgoal):
 1. \<R>\<^sub>\<circ> (vprojection I A i) = A i


proof (prove)
using this:
  Xh ` {d2h1, d3h1} = {Xh d1h1}
  Xh ` {d2h2, d3h2} = {Xh d1h2}
  Xh ` {d2h3, d3h3} = {Xh d1h3}
  distinct [Xh d1h1, Xh d1h2, Xh d1h3]
  distinct [d1h1, d1h2, d1h3, d2h1, d2h2, d2h3, d3h1, d3h2, d3h3]
  {Xd d1h1, Xd d2h1, Xd d3h1} \<subseteq> ds
  \<phi> BPd' BCh ds = {d1h1, d3h3}
  \<phi> BPd' BCh' ds = {d3h1, d1h3}

goal (1 subgoal):
 1. False


proof (prove)
using this:
  \<forall>op\<in>set ops.
     v \<notin> set (add_effects_of op) \<and>
     v \<notin> set (delete_effects_of op)

goal (1 subgoal):
 1. foldl (++) (s ++ (map_of \<circ> effect_to_assignments) a)
     (map (map_of \<circ> effect_to_assignments) ops) v =
    (s ++ (map_of \<circ> effect_to_assignments) a) v


proof (prove)
goal (1 subgoal):
 1. c\<^sub>2 \<noteq> c'';; c\<^sub>2


proof (prove)
using this:
  P \<tturnstile> wp a (wp b R)

goal (1 subgoal):
 1. P \<tturnstile> wp (a ;; b) R


proof (prove)
using this:
  \<tau>.A.ide a

goal (1 subgoal):
 1. D (\<mu> (H a)) (\<sigma> (C (\<nu> a) (\<tau> a))) =
    D (\<mu> (\<nu> a)) (\<sigma> (\<tau> a))


proof (prove)
goal (1 subgoal):
 1. norm x \<in> CF


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       \<lbrakk>LeftDerivation a D b \<Longrightarrow> D = []; i < length a;
        is_nonterminal (a ! i); LeftDerivation x D b; Suc i \<le> fst d;
        \<forall>d\<in>set D. Suc i \<le> fst d; leftmost (fst d) a;
        Derives1 a (fst d) (snd d) x\<rbrakk>
       \<Longrightarrow> False


proof (prove)
using this:
  NR\<^sub>N n u l =
  ennreal p * (of_nat l + NR\<^sub>N (n - 1) u l) +
  ennreal q *
  (of_nat u +
   (\<Sum>k<n - 1. NR\<^sub>N (k + 1) u l * ennreal (B (n - 1) k))) +
  ennreal (q ^ n) * NR\<^sub>N n u l
  NR\<^sub>N n u l \<noteq> \<top>
  0 < n
  p \<in> {0<..<1}
  q ^ n \<in> {0<..<1}

goal (1 subgoal):
 1. NR\<^sub>N n u l =
    (ennreal p * (of_nat l + NR\<^sub>N (n - 1) u l) +
     ennreal q *
     (of_nat u +
      (\<Sum>k<n - 1. NR\<^sub>N (k + 1) u l * ennreal (B (n - 1) k)))) /
    ennreal (1 - q ^ n)


proof (prove)
goal (1 subgoal):
 1. col P Q R


proof (prove)
goal (1 subgoal):
 1. Tree2.inorder (combine l r) = Tree2.inorder l @ Tree2.inorder r


proof (prove)
using this:
  \<forall>m. j \<in># m \<longrightarrow> P m = \<zero>
  i \<noteq> j

goal (1 subgoal):
 1. \<forall>m.
       j \<in># m \<longrightarrow>
       (if i \<in># m then P (m - {#i#}) else \<zero>) = \<zero>


proof (prove)
goal (1 subgoal):
 1. topspace X \<times> topspace Y
    \<subseteq> \<Union>
                 ((\<times>) (topspace X) ` Collect (openin Y) \<union>
                  (\<lambda>U. U \<times> topspace Y) ` Collect (openin X))


proof (prove)
goal (1 subgoal):
 1. OFCLASS('a \<times> 'b, cancellative_pam_class)


proof (prove)
goal (1 subgoal):
 1. (\<Sum>p | p permutes {0..<Suc n}.
       signof p * (\<Prod>i = 0..<Suc n. A $$ (p i, i))) =
    (\<Sum>p | p permutes {0..<Suc n}.
       A $$ (p n, n) * signof p * (\<Prod>i = 0..<n. A $$ (p i, i)))


proof (prove)
goal (1 subgoal):
 1. {: R :} \<bottom> = {}


proof (prove)
using this:
  kind ax = (\<lambda>s. True)\<^sub>\<surd>
  kind a = (\<lambda>s. True)\<^sub>\<surd>
  kind a\<^sub>1 = \<Up>id
  kind a\<^sub>2 = \<Up>id
  transfers (kinds as\<^sub>1) [(cf\<^sub>1, undefined)] = cfs\<^sub>1
  map fst cfs\<^sub>1 = s\<^sub>1
  transfers (kinds as\<^sub>2) [(cf\<^sub>2, undefined)] = cfs\<^sub>2
  map fst cfs\<^sub>2 = s\<^sub>2
  map fst
   (transfers (kinds (ax # (a # as\<^sub>1) @ [a\<^sub>1]))
     [(cf\<^sub>1, undefined)]) \<approx>\<^sub>L
  map fst
   (transfers (kinds (ax # (a # as\<^sub>2) @ [a\<^sub>2]))
     [(cf\<^sub>2, undefined)])

goal (1 subgoal):
 1. s\<^sub>1 \<approx>\<^sub>L s\<^sub>2


proof (prove)
using this:
  a < b
  \<lbrakk>a \<le> ?z; ?z \<le> b\<rbrakk> \<Longrightarrow> isCont f ?z
  \<lbrakk>a \<le> ?z; ?z \<le> b\<rbrakk> \<Longrightarrow> isCont g ?z
  \<lbrakk>a < ?z; ?z < b\<rbrakk>
  \<Longrightarrow> (g has_real_derivative g' ?z) (at ?z)
  \<lbrakk>a < ?z; ?z < b\<rbrakk>
  \<Longrightarrow> (f has_real_derivative f' ?z) (at ?z)

goal (1 subgoal):
 1. \<exists>g'c f'c c.
       (g has_real_derivative g'c) (at c) \<and>
       (f has_real_derivative f'c) (at c) \<and>
       a < c \<and> c < b \<and> (f b - f a) * g'c = (g b - g a) * f'c


proof (prove)
using this:
  Complete_Partial_Order.chain orda Y
  Y \<noteq> {}
  Complete_Partial_Order.chain ordb (t ` Y)

goal (1 subgoal):
 1. f (luba Y) (t (luba Y)) = (\<Squnion>x\<in>Y. f x (t x))


proof (prove)
using this:
  well_base\<^sub>h (i + 2) (encode (i + 2) 0 (local.goodstein i))

goal (1 subgoal):
 1. well_base\<^sub>h (i + 3) (encode (i + 2) 0 (local.goodstein i))


proof (prove)
goal (1 subgoal):
 1. ordinate B - ordinate C \<in> radical_sqrt


proof (prove)
using this:
  p \<in> succs (hd w)

goal (1 subgoal):
 1. ss ! p \<sqsubseteq>\<^bsub>r\<^esub> ssa ! p


proof (prove)
goal (1 subgoal):
 1. \<forall>x y.
       x =
       Matrix.mat CARD('nr) CARD('nc)
        (\<lambda>(i, j).
            y $h mod_type_class.from_nat i $h
            mod_type_class.from_nat j) \<longrightarrow>
       (\<forall>xa ya.
           xa =
           Matrix.mat CARD('nr) CARD('nc)
            (\<lambda>(i, j).
                ya $h mod_type_class.from_nat i $h
                mod_type_class.from_nat j) \<longrightarrow>
           x + map_mat uminus xa =
           Matrix.mat CARD('nr) CARD('nc)
            (\<lambda>(i, j).
                (y - ya) $h mod_type_class.from_nat i $h
                mod_type_class.from_nat j))


proof (prove)
goal (1 subgoal):
 1. OUTfromChCorrect data6


proof (prove)
goal (1 subgoal):
 1. OFCLASS(H2, enum_class)


proof (prove)
using this:
  x \<in> G
  y \<in> G
  \<forall>z\<in>G. binop (binop x (\<ii> y)) z = z

goal (1 subgoal):
 1. binop x (binop (\<ii> y) y) = y


proof (prove)
using this:
  P \<approx>\<^sup>s Q

goal (1 subgoal):
 1. [a\<noteq>b]P \<approx>\<^sup>s [a\<noteq>b]Q


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>continuous f S T;
     \<lbrakk>f \<in> carrier \<rightarrow> carrier\<^bsub>T\<^esub>;
      \<forall>m.
         m open\<^bsub>T\<^esub> \<longrightarrow>
         carrier \<inter> f -` m open\<rbrakk>
     \<Longrightarrow> P\<rbrakk>
    \<Longrightarrow> P


proof (prove)
goal (1 subgoal):
 1. surj pp.mapping_of


proof (prove)
goal (1 subgoal):
 1. |SIGMA i:I. B (f i)| \<le>o |Sigma J B|


proof (prove)
using this:
  (0::'a) \<le> \<bar>b\<bar>
  (0::'a) \<le> \<bar>b\<bar>
  (0::'a) \<le> a / \<bar>b\<bar>
  (\<bar>?a\<bar> = (0::'a)) = (?a = (0::'a))
  \<lbrakk>(0::'a) \<le> ?a; (0::'a) \<le> ?b\<rbrakk>
  \<Longrightarrow> (0::'a) \<le> ?a * ?b

goal (1 subgoal):
 1. (0::'a) \<le> a \<or> b = (0::'a)


proof (state)
this:
  {olv_ref_rel \<inter>
   (OV_inv2 \<inter> OV_inv3 \<inter> OV_inv4) \<times>
   UNIV} TS.trans obsv_TS, TS.trans olv_TS {> olv_ref_rel}

goal (4 subgoals):
 1. {OV_inv2 \<inter> OV_inv3 \<inter> OV_inv4 \<inter>
     Domain
      (olv_ref_rel \<inter>
       UNIV \<times>
       UNIV)} TS.trans obsv_TS {> OV_inv2 \<inter> OV_inv3 \<inter> OV_inv4}
 2. {UNIV \<inter>
     Range
      (olv_ref_rel \<inter>
       (OV_inv2 \<inter> OV_inv3 \<inter> OV_inv4) \<times>
       UNIV)} TS.trans olv_TS {> UNIV}
 3. init obsv_TS \<subseteq> OV_inv2 \<inter> OV_inv3 \<inter> OV_inv4
 4. init olv_TS \<subseteq> UNIV


proof (prove)
using this:
  oalist_inv_raw ko xs'

goal (1 subgoal):
 1. oalist_inv_raw ko (filter P xs')


proof (prove)
goal (1 subgoal):
 1. map_option f (while_option b c s) = while_option b' c' (f s)


proof (prove)
goal (1 subgoal):
 1. from_bool (to_bool (x AND 1)) = x AND 1


proof (prove)
goal (1 subgoal):
 1. (HMA_M ===> (=)) Spectral_Radius.spectral_radius
     HMA_Connect.spectral_radius


proof (state)
this:
  safe_free_flowing c\<^sub>0

goal (2 subgoals):
 1. safe_reach_upto 0 safe_free_flowing c\<^sub>0 \<Longrightarrow>
    safe_reach_upto 0 safe_delayed c\<^sub>0
 2. \<And>n.
       \<lbrakk>safe_reach_upto n safe_free_flowing
                 c\<^sub>0 \<Longrightarrow>
                safe_reach_upto n safe_delayed c\<^sub>0;
        safe_reach_upto (Suc n) safe_free_flowing c\<^sub>0\<rbrakk>
       \<Longrightarrow> safe_reach_upto (Suc n) safe_delayed c\<^sub>0


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>non_terminating P; lifelock_free_v2 Q\<rbrakk>
    \<Longrightarrow> non_terminating (P \<lbrakk>C\<rbrakk> Q)


proof (prove)
using this:
  \<forall>\<^sub>F n in F. x \<le> u

goal (1 subgoal):
 1. x \<le> u


proof (prove)
goal (1 subgoal):
 1. (bisim ===> (=)) dom fst


proof (prove)
goal (1 subgoal):
 1. \<lparr>xc = x, yc = y, zc = z\<rparr> = p
    \<lparr>xc := x, yc := y, zc := z\<rparr>


proof (prove)
using this:
  j < length fs
  p = Inr j
  Inr j \<notin> set ps

goal (1 subgoal):
 1. is_RB_in dgrad rword (set bs) (term_of_pair (0::'a, j)) \<and>
    rep_list (monomial (1::'b) (term_of_pair (0::'a, j)))
    \<in> ideal (rep_list ` set bs)


proof (prove)
goal (1 subgoal):
 1. LIM x F. f x * inverse (g x) :> at_top


proof (prove)
using this:
  card B < card (C\<^sub>1 \<union> C\<^sub>2 - {x})
  \<lbrakk>indep_in (C\<^sub>1 \<union> C\<^sub>2)
            (C\<^sub>1 \<union> C\<^sub>2 - {x});
   basis_in (C\<^sub>1 \<union> C\<^sub>2) B\<rbrakk>
  \<Longrightarrow> card (C\<^sub>1 \<union> C\<^sub>2 - {x}) \<le> card B
  basis_in (C\<^sub>1 \<union> C\<^sub>2) B
  C\<^sub>2 - {y} \<subseteq> B
  indep_in (C\<^sub>1 \<union> C\<^sub>2)
   (C\<^sub>1 \<union> C\<^sub>2 - {x})

goal (1 subgoal):
 1. False


proof (prove)
goal (1 subgoal):
 1. (\<exists>m. obs n (PDG_BS S) = {m}) \<or> obs n (PDG_BS S) = {}


proof (chain)
picking this:
  PROP ?psi \<Longrightarrow> PROP ?psi
  dickson_less_v d m (seq (Suc ?i27)) (seq ?i27)
  i < j


proof (chain)
picking this:
  fv e \<union> fv (RI (D,throw a) ; Cs \<leftarrow> unit)
  \<subseteq> fv (RI (C,e) ; D # Cs \<leftarrow> unit)


proof (prove)
using this:
  x \<in> ball (0::'a) 2

goal (1 subgoal):
 1. 0 < H x


proof (prove)
using this:
  Vagree ?v ?w (- {z}) \<Longrightarrow> term_sem I t ?v = term_sem I t ?w

goal (1 subgoal):
 1. term_sem I t (stateinterpol \<omega> \<omega>' S) =
    term_sem I t (stateinterpol \<omega> \<omega>' (insert z S))


proof (chain)
picking this:
  x \<in> {a--b}


proof (state)
this:
  order.greater_eq (chamber_distance C D)
   (ChamberComplex.chamber_distance A C D)

goal (1 subgoal):
 1. C \<noteq> D \<Longrightarrow>
    ChamberComplex.chamber_distance A C D = chamber_distance C D


proof (prove)
goal (1 subgoal):
 1. connected (\<Inter> (range X))


proof (prove)
goal (1 subgoal):
 1. (a * x ^ 3 + b * x\<^sup>2 + c * x + d = (0::'a)) =
    (y ^ 3 + e * y + f = (0::'a))


proof (prove)
goal (1 subgoal):
 1. \<And>x y z.
       x \<sqinter> y \<squnion> x \<sqinter> z \<squnion>
       x \<sqinter> (y \<squnion> z) =
       x \<sqinter> (y \<squnion> z)


proof (prove)
using this:
  f < 0 \<or> f = 0 \<or> 0 < f

goal (1 subgoal):
 1. v \<Turnstile>\<^sub>n\<^sub>s (f *R ns)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>compact S; closedin (top_of_set S) T\<rbrakk>
    \<Longrightarrow> compact T


proof (prove)
using this:
  T =
  (if Ground = FirstOrder
   then filter_trms C
         (dom_trms (subst_cl D \<sigma>) (subst_set E \<sigma>))
   else dom_trms (subst_cl D \<sigma>) (subst_set E \<sigma>))

goal (1 subgoal):
 1. T = dom_trms (subst_cl D \<sigma>) (subst_set E \<sigma>)


proof (prove)
goal (1 subgoal):
 1. (\<Sum>d = 1..n.
        mangoldt d *
        real_of_int
         \<lfloor>real (2 * (n div 2) + n mod 2) / real d\<rfloor>)
    \<le> (\<Sum>d = 1..n.
              mangoldt d *
              real_of_int
               (2 * \<lfloor>real (n div 2) / real d\<rfloor> + 1))


proof (prove)
goal (1 subgoal):
 1. (x \<in># mset_pos M) = (0 < zcount M x)


proof (prove)
goal (1 subgoal):
 1. (a, b) \<in> E \<Longrightarrow>
    a \<in> (\<lambda>a\<in>S. {b \<in> S. (b, a) \<in> E}) b


proof (prove)
using this:
  LIM x at_bot. poly q x / poly p x :> at_top

goal (1 subgoal):
 1. (if LIM x at_bot. poly q x / poly p x :> at_top then 1 / 2
     else if LIM x at_bot. poly q x / poly p x :> at_bot then - 1 / 2
          else 0) =
    1 / 2


proof (prove)
using this:
  x \<le> (x \<sqinter> - y\<^sup>\<star> \<squnion> y)\<^sup>\<star>

goal (1 subgoal):
 1. x \<sqinter> - y\<^sup>\<star> \<squnion> y = x


proof (prove)
using this:
  Seed\<^bsub>p\<^esub> [next_plane\<^bsub>p\<^esub>]\<rightarrow>* g
  tame g
  final g
  p \<le> 3
  fgraph ` TameEnum \<subseteq>\<^sub>\<simeq> Archive

goal (1 subgoal):
 1. fgraph g \<in>\<^sub>\<simeq> Archive


proof (prove)
goal (1 subgoal):
 1. a + b + c = a + (b + c)


proof (prove)
goal (1 subgoal):
 1. bprv (PPf p \<langle>neg \<phi>R\<rangle>)


proof (state)
this:
  dupe_monic (of_int_poly (Mp D)) (of_int_poly (Mp H)) (of_int_poly (Mp S))
   (of_int_poly (Mp T)) (of_int_poly (Mp U)) =
  (A', B')

goal (4 subgoals):
 1. A * D + B * H =m U
 2. B = 0 \<or> degree B < degree D
 3. Mp_rel_i a A
 4. Mp_rel_i b B


proof (prove)
using this:
  xo = \<langle>x\<rangle>
  x \<in> B \<Gamma>
  x \<in> \<^bold>V
  A \<Gamma> \<inter> B \<Gamma> = {}

goal (1 subgoal):
 1. (\<Sum>\<^sup>+ xa. f n (xa, \<langle>x\<rangle>)) =
    (\<Sum>\<^sup>+ y.
       f n (y, \<langle>x\<rangle>) * indicator (range Inner) y +
       f n (y, \<langle>x\<rangle>) * indicator {SOURCE} y)


proof (prove)
using this:
  c_rec + c_sig + 2 * n + 2 \<le> (\<Sum>jj = j..<i. 2 * n + 2 + 4 * jj + 1)

goal (1 subgoal):
 1. result (dmu_array_row_main_cost fi i dmus j) =
    dmu_array_row_main fs fi i dmus j \<and>
    cost (dmu_array_row_main_cost fi i dmus j)
    \<le> (\<Sum>jj = j..<i. 2 * n + 2 + 4 * jj + 1)


proof (prove)
goal (1 subgoal):
 1. pmf local.pmf_of_set x = indicat_real S x / real (card S)


proof (prove)
goal (1 subgoal):
 1. uniformly_convergent_on (cball \<xi> r)
     (\<lambda>n x. \<Sum>i<n. a i * (x - \<xi>) ^ i)


proof (prove)
goal (1 subgoal):
 1. <gridI a v> upI d a <\<lambda>r. gridI a (up dm lm d v)>


proof (chain)
picking this:
  i < length (l # ts)
  (l # ts) ! i =
  (p, is, \<theta>, Ghost\<^sub>s\<^sub>b A L R W # sb, \<D>, \<O>, \<R>)


proof (prove)
goal (1 subgoal):
 1. rbl_mul (x # xs) ys =
    rbl_plus False (map ((\<and>) x) ys) (False # rbl_mul xs ys) &&&
    rbl_mul [] ys = []


proof (prove)
goal (3 subgoals):
 1. \<And>c l x.
       \<lbrakk>c \<in> gPB; l \<in> set c; x \<in> nv2L l;
        \<not> infTp (GE.tpOfV x)\<rbrakk>
       \<Longrightarrow> grdOf c l x \<in> set c
 2. \<And>\<sigma> c. c \<in> gPB \<Longrightarrow> mcalc2 \<sigma> c
 3. \<And>\<sigma>1 P \<sigma>2. pol \<sigma>1 P = pol \<sigma>2 P


proof (prove)
goal (1 subgoal):
 1. \<And>a b. (a \<le> b) = (a \<squnion> b = b)


proof (prove)
goal (1 subgoal):
 1. \<exists>d. R\<^sup>*\<^sup>* b d \<and> R\<^sup>*\<^sup>* c d


proof (prove)
goal (1 subgoal):
 1. pnorm_alt ` pset r = pset r


proof (prove)
using this:
  has_subprob_density M lborel f
  X = {a..b}

goal (1 subgoal):
 1. emeasure (distr M lborel h) X = emeasure (density lborel g) X


proof (prove)
goal (1 subgoal):
 1. a \<in> G \<Longrightarrow> bij_betw (a)\<^sub>L G G


proof (prove)
goal (1 subgoal):
 1. dist x y \<le> infdist x A


proof (state)
this:
  x \<cdot> u = z

goal (1 subgoal):
 1. x \<cdot> y = y \<cdot> x


proof (prove)
goal (1 subgoal):
 1. {0..n} \<inter> {Suc n..m} = {}


proof (prove)
goal (1 subgoal):
 1. ssat (fst (tree.root t))


proof (prove)
using this:
  linears (snd (strip_comb t\<^sub>1) @ [t\<^sub>2])

goal (1 subgoal):
 1. linears (snd (strip_comb (app t\<^sub>1 t\<^sub>2)))


proof (state)
this:
  (\<exists>t.
      \<Gamma>,\<gamma>,p\<turnstile> \<langle>rs_called, Undecided\<rangle> \<Rightarrow> t) \<or>
  (\<exists>rs_called1 rs_called2 m'.
      \<Gamma> chain_name_neu =
      Some (rs_called1 @ [Rule m' Return] @ rs_called2) \<and>
      matches \<gamma> m' p \<and>
      \<Gamma>,\<gamma>,p\<turnstile> \<langle>rs_called1, Undecided\<rangle> \<Rightarrow> Undecided)

goal (1 subgoal):
 1. \<And>x m.
       \<lbrakk>\<And>y m.
                   \<lbrakk>(y, x) \<in> called_by_chain \<Gamma>;
                    matches \<gamma> m p;
                    wf_chain \<Gamma> [Rule m (Call y)];
                    Ball (ran \<Gamma>) (wf_chain \<Gamma>);
                    \<forall>rsg\<in>ran \<Gamma>.
                       \<forall>r\<in>set rsg.
                          (\<forall>chain.
                              get_action r \<noteq> Goto chain) \<and>
                          get_action r \<noteq> Unknown\<rbrakk>
                   \<Longrightarrow> Ex
(iptables_bigstep \<Gamma> \<gamma> p [Rule m (Call y)] Undecided);
        matches \<gamma> m p; wf_chain \<Gamma> [Rule m (Call x)];
        Ball (ran \<Gamma>) (wf_chain \<Gamma>);
        \<forall>rsg\<in>ran \<Gamma>.
           \<forall>r\<in>set rsg.
              (\<forall>chain. get_action r \<noteq> Goto chain) \<and>
              get_action r \<noteq> Unknown\<rbrakk>
       \<Longrightarrow> Ex (iptables_bigstep \<Gamma> \<gamma> p
                              [Rule m (Call x)] Undecided)


proof (prove)
goal (1 subgoal):
 1. 0 < n \<and>
    [- a, 1::'a] %^ n divides p \<and>
    \<not> [- a, 1::'a] %^ Suc n divides p \<Longrightarrow>
    poly p a = (0::'a)


proof (prove)
goal (1 subgoal):
 1. inverse x \<in> aform_err e Y


proof (prove)
goal (1 subgoal):
 1. path (E \<inter> UNIV \<times> - R) u (x # xs) v =
    (\<exists>w.
        w \<notin> R \<and>
        x = u \<and> (u, w) \<in> E \<and> path (rel_restrict E R) w xs v)


proof (prove)
goal (1 subgoal):
 1. \<forall>u'\<in>{u \<oplus> d |u d.
                     u \<in> Z_ \<inter>
                             {u. u \<turnstile> inv_of A_ l_} \<and>
                     (0::'c) \<le> d} \<inter>
                    {u. u \<turnstile> inv_of A_ l_}.
       \<exists>u\<in>Z_.
          A_ \<turnstile> \<langle>l_, u\<rangle> \<rightarrow> \<langle>l_,u'\<rangle>


proof (prove)
goal (1 subgoal):
 1. igSubstIGOpSTR MOD \<Longrightarrow> igSubstIGOp MOD


proof (prove)
goal (1 subgoal):
 1. a' \<in> I


proof (prove)
goal (1 subgoal):
 1. C.arr f0


proof (prove)
using this:
  finite A

goal (1 subgoal):
 1. Mapping.lookup_default 0 (fold_combine_plus.combine.F f A) x =
    (\<Sum>y\<in>A. Mapping.lookup_default 0 (f y) x)


proof (state)
this:
  0 \<le> a ?k

goal (1 subgoal):
 1. \<And>e.
       0 < e \<Longrightarrow>
       \<exists>N. \<forall>n\<ge>N. dist (\<phi> n) (\<phi> N) < e


proof (prove)
goal (1 subgoal):
 1. f |`| fset_from_list l = fset_from_list (map f l)


proof (prove)
using this:
  ins n d x \<langle>\<rangle> = Bal t'
  bal_i n (height \<langle>\<rangle> + d)

goal (1 subgoal):
 1. bal_i (n + 1) (height t' + d)


proof (state)
this:
  \<S>\<bullet>\<C> \<turnstile> vs : [] _> tls

goal (1 subgoal):
 1. \<S>\<bullet>\<C> \<turnstile> vs @ es0 : ts _> ts'


proof (prove)
goal (1 subgoal):
 1. (map (inv q)
      (filter (\<lambda>x. x \<in> range q)
        (xs @
         ipurge_tr (con_comp_pol I) (con_comp_map D E p q)
          (con_comp_map D E p q y) ys)),
     inv q `
     ipurge_ref (con_comp_pol I) (con_comp_map D E p q)
      (con_comp_map D E p q y) ys S)
    \<in> failures Q


proof (prove)
using this:
  dist a (fst x) < r
  dist b (snd x) < s

goal (1 subgoal):
 1. sqrt
     ((dist (fst (a, b)) (fst x))\<^sup>2 +
      (dist (snd (a, b)) (snd x))\<^sup>2)
    < sqrt (r\<^sup>2 + s\<^sup>2)


proof (prove)
using this:
  y \<in> \<C>_vars x

goal (1 subgoal):
 1. y \<in> vars_\<C> X


proof (prove)
goal (1 subgoal):
 1. (x \<in> topspace X \<and>
     (\<forall>x\<in>topspace X. f x \<in> topspace Y) \<and>
     (\<forall>V.
         openin Y V \<and> f x \<in> V \<longrightarrow>
         (\<exists>U.
             openin X U \<and>
             x \<in> U \<and> (\<forall>y\<in>U. f y \<in> V)))) =
    (x \<in> topspace X \<and>
     (\<forall>x\<in>topspace X. f x \<in> topspace Y) \<and>
     limitin Y f (f x) (atin X x))


proof (prove)
using this:
  a ! k * maxne0 ys b < a ! k * xs ! k

goal (1 subgoal):
 1. a ! k < sum_list ys


proof (prove)
using this:
  p * x \<noteq> (0::'a)
  prime p

goal (1 subgoal):
 1. normalize (\<Prod>\<^sub># (prime_factorization (p * x))) =
    normalize (p * normalize (\<Prod>\<^sub># (prime_factorization x)))


proof (prove)
goal (1 subgoal):
 1. t \<in> set ts \<Longrightarrow>
    size t < Suc (Suc (size s + size_list size ts))


proof (prove)
goal (1 subgoal):
 1. matchers (set P) = {}


proof (prove)
using this:
  \<lbrakk>prime i; i \<le> i\<rbrakk>
  \<Longrightarrow> multiplicity i factor_pr = 0
  prime i
  prime j
  0 < factor_pr
  j = i

goal (1 subgoal):
 1. multiplicity j (factor_pr * i) \<le> 1


proof (prove)
goal (1 subgoal):
 1. OFCLASS(finite_2, field_class) &&&
    OFCLASS(finite_2, idom_abs_sgn_class) &&&
    OFCLASS(finite_2, idom_modulo_class)


proof (prove)
using this:
  \<exists>x. valid_selection Rs (n, E) (fst x) (snd x)
  (case ?prod of (x, xa) \<Rightarrow> ?f x xa) = ?f (fst ?prod) (snd ?prod)
  \<forall>P x. P x \<longrightarrow> P (Eps P)

goal (1 subgoal):
 1. \<not> valid_selection Rs (n, E)
            (fst (SOME (R, f). valid_selection Rs (n, E) R f))
            (snd (SOME (R, f).
                     valid_selection Rs (n, E) R f)) \<Longrightarrow>
    False


proof (prove)
goal (1 subgoal):
 1. i \<le> r \<Longrightarrow>
    arr_mset arr (i - 1) r = arr_mset arr i r + {#arr (i - 1)#}


proof (prove)
goal (1 subgoal):
 1. weakSimAct P (\<alpha> \<prec> Q') P Rel


proof (prove)
goal (1 subgoal):
 1. map (Poly_Mapping.map_key PP) (punit.Macaulay_list fs) =
    pp_pm.punit.Macaulay_list (map (Poly_Mapping.map_key PP) fs)


proof (prove)
goal (1 subgoal):
 1. add_col_sub_row a i j A $$ (i', j') = (0::'a)


proof (prove)
goal (1 subgoal):
 1. Id_on B = (\<lambda>x. (x, x)) ` B &&&
    Id_on (Complement A) =
    (case ID CEQ('a) of
     None \<Rightarrow>
       Code.abort STR ''Id_on Complement: ceq = None''
        (\<lambda>_. Id_on (Complement A))
     | Some eq \<Rightarrow>
         Collect_set (\<lambda>(x, y). eq x y \<and> x \<notin> A)) &&&
    Id_on (Collect_set P) =
    (case ID CEQ('a) of
     None \<Rightarrow>
       Code.abort STR ''Id_on Collect_set: ceq = None''
        (\<lambda>_. Id_on (Collect_set P))
     | Some eq \<Rightarrow>
         Collect_set (\<lambda>(x, y). eq x y \<and> P x)) &&&
    Id_on (DList_set dxs) =
    (case ID CEQ('a) of
     None \<Rightarrow>
       Code.abort STR ''Id_on DList_set: ceq = None''
        (\<lambda>_. Id_on (DList_set dxs))
     | Some x \<Rightarrow> DList_set (DList_Set.Id_on dxs)) &&&
    Id_on (RBT_set rbt) =
    (case ID ccompare of
     None \<Rightarrow>
       Code.abort STR ''Id_on RBT_set: ccompare = None''
        (\<lambda>_. Id_on (RBT_set rbt))
     | Some x \<Rightarrow> RBT_set (RBT_Set2.Id_on rbt))


proof (prove)
goal (1 subgoal):
 1. Min {extended_Gromov_product_at e x y, extended_Gromov_product_at e y z,
         extended_Gromov_product_at e z t} -
    ereal (2 * deltaG TYPE('a))
    \<le> extended_Gromov_product_at e x t


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x_ \<in> subterms f_; x_ \<notin> Mapping.keys M2;
     f_ \<in> Mapping.keys M2\<rbrakk>
    \<Longrightarrow> x_ = Binop fa1 fa2


proof (prove)
using this:
  P,E(V \<mapsto>
  T) \<turnstile> \<langle>e,(h, l(V \<mapsto> v'))\<rangle> \<rightarrow>*
                  \<langle>e',(h', l')\<rangle>
  P \<turnstile> T casts v to v'
  wf_prog wf_md P

goal (1 subgoal):
 1. (\<And>v'' w.
        \<lbrakk>P,E \<turnstile> \<langle>{V:T; V:=Val v;; e},
                                   (h, l)\<rangle> \<rightarrow>*
                                  \<langle>{V:T; V:=Val v'';; e'},
                                   (h', l'(V := l V))\<rangle>;
         P \<turnstile> T casts v'' to w \<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  k' \<le> k

goal (1 subgoal):
 1. {\<Sqinter> (M k)..} \<subseteq> {\<Sqinter> (M k')..}


proof (prove)
goal (1 subgoal):
 1. card (older_seniors x n)
    < card (reach \<Sigma> \<delta> q\<^sub>0 - Collect sink)


proof (prove)
goal (1 subgoal):
 1. p \<sim>[sequentially] (\<lambda>n.
                               16 ^ n * fact n ^ 4 /
                               (fact (2 * n))\<^sup>2 /
                               (2 * real n + 1))


proof (prove)
goal (1 subgoal):
 1. f =
    monom P (T\<^bsub>a\<^esub> f 0) 0 \<oplus>\<^bsub>P\<^esub>
    X_poly_minus R a \<otimes>\<^bsub>P\<^esub>
    Cring_Poly.compose R (poly_shift (T\<^bsub>a\<^esub> f))
     (X_poly_minus R a)


proof (prove)
goal (3 subgoals):
 1. \<And>A a b.
       \<lbrakk>wf_prog G;
        G,insert
           ({Normal \<doteq>} In1l (Methd a b)\<succ> {G\<rightarrow>})
           A\<turnstile>{Normal
                          \<doteq>} In1l
                                     (body G a
 b)\<succ> {G\<rightarrow>}\<rbrakk>
       \<Longrightarrow> G,A\<turnstile>{Normal
    \<doteq>} In1l (Methd a b)\<succ> {G\<rightarrow>}
 2. \<And>A t.
       \<lbrakk>wf_prog G;
        \<forall>pn\<in>?U2.
           G,A\<turnstile>{Normal
                            \<doteq>} (case pn of
 (C, sig) \<Rightarrow> In1l (Methd C sig))\<succ> {G\<rightarrow>}\<rbrakk>
       \<Longrightarrow> G,A\<turnstile>{Normal
    \<doteq>} t\<succ> {G\<rightarrow>}
 3. wf_prog G \<Longrightarrow> finite ?U2


proof (prove)
using this:
  (INF n. f (A n - \<Inter> (range A))) = 0
  (INF n. f (\<Inter> (range A))) = f (\<Inter> (range A))

goal (1 subgoal):
 1. (INF n. f (A n - \<Inter> (range A)) + f (\<Inter> (range A))) =
    0 + f (\<Inter> (range A))


proof (prove)
using this:
  p \<bullet> \<Psi> \<turnstile> p \<bullet> M \<leftrightarrow> N

goal (1 subgoal):
 1. p \<bullet>
    \<Psi> \<turnstile> p \<bullet> M \<leftrightarrow> p \<bullet> N


proof (prove)
goal (1 subgoal):
 1. A \<inter> List.coset xs = fold Set.remove xs A


proof (prove)
goal (1 subgoal):
 1. prv (imp \<phi>
          (cnj (PP \<langle>\<phi>\<rangle>)
            (PP (encF N \<langle>\<phi>\<rangle>))))


proof (prove)
goal (1 subgoal):
 1. prime_factorization
     (\<Prod>\<^sub>#
       (prime_factorization a \<inter># prime_factorization b)) =
    prime_factorization a \<inter># prime_factorization b


proof (prove)
using this:
  B.obj a

goal (1 subgoal):
 1. \<guillemotleft>a : a \<Rightarrow>\<^sub>B a\<guillemotright>


proof (prove)
goal (3 subgoals):
 1. \<And>Phi y.
       \<lbrakk>Phi (monom P \<one> (Suc 0)) \<in> carrier S;
        \<And>s.
           s \<in> carrier S \<Longrightarrow>
           eval R S h s (monom P \<one> (Suc 0)) = s;
        Phi \<in> ring_hom P S; y \<in> ring_hom P S;
        Phi \<in> extensional (carrier P); y \<in> extensional (carrier P);
        \<forall>r\<in>carrier R. Phi (monom P r 0) = h r;
        s = Phi (monom P \<one> (Suc 0));
        y (monom P \<one> (Suc 0)) = Phi (monom P \<one> (Suc 0));
        \<forall>r\<in>carrier R. y (monom P r 0) = h r\<rbrakk>
       \<Longrightarrow> Phi \<in> extensional (?A39 Phi y)
 2. \<And>Phi y.
       \<lbrakk>Phi (monom P \<one> (Suc 0)) \<in> carrier S;
        \<And>s.
           s \<in> carrier S \<Longrightarrow>
           eval R S h s (monom P \<one> (Suc 0)) = s;
        Phi \<in> ring_hom P S; y \<in> ring_hom P S;
        Phi \<in> extensional (carrier P); y \<in> extensional (carrier P);
        \<forall>r\<in>carrier R. Phi (monom P r 0) = h r;
        s = Phi (monom P \<one> (Suc 0));
        y (monom P \<one> (Suc 0)) = Phi (monom P \<one> (Suc 0));
        \<forall>r\<in>carrier R. y (monom P r 0) = h r\<rbrakk>
       \<Longrightarrow> y \<in> extensional (?A39 Phi y)
 3. \<And>Phi y x.
       \<lbrakk>Phi (monom P \<one> (Suc 0)) \<in> carrier S;
        \<And>s.
           s \<in> carrier S \<Longrightarrow>
           eval R S h s (monom P \<one> (Suc 0)) = s;
        Phi \<in> ring_hom P S; y \<in> ring_hom P S;
        Phi \<in> extensional (carrier P); y \<in> extensional (carrier P);
        \<forall>r\<in>carrier R. Phi (monom P r 0) = h r;
        s = Phi (monom P \<one> (Suc 0));
        y (monom P \<one> (Suc 0)) = Phi (monom P \<one> (Suc 0));
        \<forall>r\<in>carrier R. y (monom P r 0) = h r;
        x \<in> ?A39 Phi y\<rbrakk>
       \<Longrightarrow> Phi x = y x


proof (prove)
goal (1 subgoal):
 1. (\<lambda>x.
        (LINT xa|lebesgue_on {- pi..pi}.
            sin (real x * xa) * (cos (1 / 2 * xa) * f xa)) +
        (LINT xa|lebesgue_on {- pi..pi}.
            cos (real x * xa) * (sin (1 / 2 * xa) * f xa)))
    \<longlonglongrightarrow> 0 + 0


proof (prove)
using this:
  fn \<le> fn'
  l = ?x # ?xs \<Longrightarrow> fc ?x ?xs \<le> fc' ?x ?xs

goal (1 subgoal):
 1. (case l of [] \<Rightarrow> fn | x # xa \<Rightarrow> fc x xa)
    \<le> (case l of [] \<Rightarrow> fn' | x # xa \<Rightarrow> fc' x xa)


proof (prove)
goal (1 subgoal):
 1. \<not> ({#}, {#}, Q, n) \<leadsto>\<^sub>w St


proof (prove)
using this:
  ?z2 \<in> a \<Longrightarrow>
  ?z2
  \<in> {(x, {(x, Y) |Y x.
              Y \<in> finestpart (a ,, x) \<and> x \<in> Domain a} ,,,
             x) |
         x. x \<in> Domain
                     {(x, Y) |Y x.
                      Y \<in> finestpart (a ,, x) \<and> x \<in> Domain a}}

goal (1 subgoal):
 1. a =
    {(x, {(x, Y) |Y x.
          Y \<in> finestpart (a ,, x) \<and> x \<in> Domain a} ,,,
         x) |
     x. x \<in> Domain
                 {(x, Y) |Y x.
                  Y \<in> finestpart (a ,, x) \<and> x \<in> Domain a}}


proof (prove)
using this:
  xs = xs' @ xs''
  xs'' \<noteq> []

goal (1 subgoal):
 1. prefix (xs' @ [hd xs'']) xs


proof (prove)
goal (1 subgoal):
 1. Red_F_\<G>_empty_L_q q = local.ord_q_lifting.Red_F_\<G>


proof (prove)
goal (1 subgoal):
 1. \<And>s. guard' s \<Longrightarrow> lossless_spmf (body1' s)


proof (prove)
using this:
  numsub ?s ?t = (if ?s = ?t then C 0 else numadd ?s (numneg ?t))

goal (1 subgoal):
 1. Inum bs (numsub a b) = Inum bs (Sub a b)


proof (state)
goal (1 subgoal):
 1. Opair x (f \<acute> x) |\<in>| f


proof (prove)
goal (1 subgoal):
 1. set_nn_integral M A f \<le> set_nn_integral M A g


proof (prove)
goal (1 subgoal):
 1. card {f. CK_nf_pos f} \<in> {1, 3, 4, 5, 7}


proof (prove)
using this:
  \<lbrakk>C.arr ?f; C.dom ?f = ?a\<rbrakk>
  \<Longrightarrow> ?f \<cdot> ?a = ?f

goal (1 subgoal):
 1. arrow_of_spans (\<cdot>)
     \<lparr>Chn = \<mu>.dom.apex, Dom = Dom \<mu>, Cod = Dom \<mu>\<rparr>


proof (prove)
goal (1 subgoal):
 1. \<And>Us. Xs = Abs_ExpList Us \<Longrightarrow> args (FnCall F Xs) = Xs


proof (prove)
goal (1 subgoal):
 1. vec (dim_vec v) (\<lambda>i. - (1::'b) * v $ i) =
    vec (dim_vec v) (\<lambda>i. - v $ i)


proof (prove)
using this:
  ins (size t) 0 x t = Bal x2_
  bal_i (size t) (height t + 0) \<Longrightarrow>
  bal_i (size t + 1) (height x2_ + 0)
  bal_i (size t) (height t)
  ins ?n ?d ?x ?t = Bal ?t' \<Longrightarrow> size ?t' = size ?t + 1
  ins ?n ?d ?x ?t = Unbal ?t' \<Longrightarrow> size ?t' = size ?t + 1

goal (1 subgoal):
 1. bal_i (size (local.insert x t)) (height (local.insert x t))


proof (prove)
using this:
  ?x \<in> S \<Longrightarrow> f differentiable at ?x
  ?x \<in> S \<Longrightarrow> g differentiable at ?x
  open S
  \<lbrakk>higher_differentiable_on S ?f n; higher_differentiable_on S ?g n;
   open S\<rbrakk>
  \<Longrightarrow> higher_differentiable_on S (\<lambda>x. ?f x ** ?g x) n
  higher_differentiable_on S f (Suc n)
  higher_differentiable_on S g (Suc n)
  open S

goal (1 subgoal):
 1. higher_differentiable_on S (\<lambda>x. f x ** g x) (Suc n)


proof (prove)
goal (1 subgoal):
 1. monom_mult c t (atomize_poly (idx_pm_of_pm bs s')) =
    atomize_poly (idx_pm_of_pm bs (monomial c t \<cdot> s'))


proof (prove)
using this:
  ii < brnL cl (length cl)

goal (1 subgoal):
 1. locateT cl ii < length cl


proof (prove)
using this:
  \<lbrakk>class.nontriv TYPE('b);
   class.bezout_ring (*) (1::?'aa) (+) (0::?'aa) (-) uminus\<rbrakk>
  \<Longrightarrow> Ball {A. A \<in> carrier_mat p p} admits_SNF_JNF

goal (1 subgoal):
 1. Ball {A. A \<in> carrier_mat p p} admits_SNF_JNF


proof (prove)
using this:
  deg_pp t \<le> 0
  keys_pp t \<subseteq> set xs

goal (1 subgoal):
 1. t \<in> keys (deg_le_sect_pp_aux xs 0)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>H \<subseteq> carrier M;
     f \<in> {k. k \<le> Suc n} \<rightarrow> H;
     s \<in> {k. k \<le> Suc n} \<rightarrow> carrier R; l \<le> Suc n;
     f l \<notin> f ` ({k. k \<le> Suc n} - {l}); l \<noteq> Suc n\<rbrakk>
    \<Longrightarrow> \<exists>g m t.
                         g \<in> {k. k \<le> m} \<rightarrow> H \<and>
                         inj_on g {k. k \<le> m} \<and>
                         t \<in> {k. k \<le> m} \<rightarrow>
                                 carrier R \<and>
                         l_comb R M (Suc n) s f = l_comb R M m t g \<and>
                         t m = s l \<and> g m = f l


proof (prove)
using this:
  \<lbrakk>x \<sqsubseteq> y; y \<sqsubseteq> x; y \<sqsubseteq> z\<rbrakk>
  \<Longrightarrow> x \<sqsubseteq> z
  x \<sim> y
  y \<sqsubseteq> z

goal (1 subgoal):
 1. x \<sqsubseteq> z


proof (prove)
goal (1 subgoal):
 1. subalgebra (nat_filtration n) (G n)


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       (\<upsilon> x) \<tau> = true \<tau> \<Longrightarrow>
       (\<delta> (\<lambda>\<tau>.
                     if (\<upsilon> x) \<tau> = true \<tau>
                     then \<lfloor>\<lfloor>x \<tau>
      \<in> \<lceil>\<lceil>Rep_Set\<^sub>b\<^sub>a\<^sub>s\<^sub>e
                             (H .allInstances()
                               \<tau>)\<rceil>\<rceil>\<rfloor>\<rfloor>
                     else \<bottom>))
        \<tau> =
       true \<tau>


proof (prove)
using this:
  c \<in> atlas
  x \<in> domain c
  k-smooth_on (codomain c) (a \<circ> inv_chart c)

goal (1 subgoal):
 1. \<exists>c1\<in>atlas.
       x \<in> domain c1 \<and>
       k-smooth_on (codomain c1) (a + b \<circ> inv_chart c1)


proof (prove)
goal (1 subgoal):
 1. LINT x|measure_spmf (map_spmf fst p).
       Sigma_Algebra.measure (measure_spmf p)
        ({x} \<times> UNIV \<inter> (Pair x \<circ> snd) -` {i}) /
       Sigma_Algebra.measure (measure_spmf p) ({x} \<times> UNIV) =
    spmf (map_spmf fst p) (fst i) * spmf p i /
    Sigma_Algebra.measure (measure_spmf p) ({fst i} \<times> UNIV)


proof (prove)
using this:
  \<forall>x\<in>fv u'.
     \<exists>a. \<Gamma>\<^sub>v x = Var (prot_atom.Atom a)
  u = u' \<cdot> \<delta>
  \<Gamma> ?t = \<Gamma> (?t \<cdot> \<delta>)
  \<forall>x\<in>fv u'.
     \<exists>a. \<Gamma> (Var x) = Var a \<Longrightarrow>
  \<forall>x\<in>fv (u' \<cdot> \<delta>).
     \<exists>y\<in>fv u'. \<Gamma> (Var x) = \<Gamma> (Var y)

goal (1 subgoal):
 1. \<forall>x\<in>fv u.
       \<exists>a. \<Gamma>\<^sub>v x = Var (prot_atom.Atom a)


proof (prove)
goal (1 subgoal):
 1. det_int = det


proof (prove)
goal (1 subgoal):
 1. is_root' h \<Longrightarrow>
    hom (del_min' h) = Pairing_Heap_Tree.del_min (hom h)


proof (prove)
goal (1 subgoal):
 1. exp (2 * ln (ln (real n)) * (4 * (f n / ln (f n)))) =
    2 powr (c * f n * ln (ln (real n)) / ln (f n))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>wtL (Neg (Pr p Tl)); I.wtE \<xi>;
     \<And>x.
        \<lbrakk>\<not> infTp (tpOfV x);
         x \<in> nv2L (Neg (Pr p Tl))\<rbrakk>
        \<Longrightarrow> \<exists>l'.
                             wtL l' \<and>
                             \<not> I.satL \<xi> l' \<and> isGuard x l';
     Ik.satL (transE \<xi>) (Neg (Pr p Tl)); polC p = Fext\<rbrakk>
    \<Longrightarrow> I.satL \<xi> (Neg (Pr p Tl))


proof (prove)
goal (1 subgoal):
 1. \<phi> \<sim> \<psi> \<Longrightarrow> af \<phi> xs \<sim> af \<psi> xs


proof (prove)
using this:
  max_depth \<phi> = Suc m
  \<exists>belowNext Next.
     (extendLevel ^^ m) (atoms, depth1) = (belowNext, Next) \<and>
     i.R belowNext = {\<phi>. max_depth \<phi> < 1 + m} \<and>
     i.R Next = {\<phi>. max_depth \<phi> = 1 + m}

goal (1 subgoal):
 1. \<phi> \<in> i.R fmlas


proof (prove)
goal (3 subgoals):
 1. \<And>m.
       \<lbrakk>0 < N; j \<le> Suc n; vals_nonequiv K (Suc n) vv; Ring K;
        aGroup K; (\<Omega>\<^bsub>K vv Suc n\<^esub>) j \<in> carrier K;
        (\<Omega>\<^bsub>K vv Suc n\<^esub>) j^\<^bsup>K N\<^esup>
        \<in> carrier K;
        -\<^sub>a (\<Omega>\<^bsub>K vv Suc n\<^esub>) j^\<^bsup>K N\<^esup>
        \<in> carrier K;
        m \<le> Suc n; j \<noteq> m;
        0 < vv m ((\<Omega>\<^bsub>K vv Suc n\<^esub>) j);
        int N *\<^sub>a vv m ((\<Omega>\<^bsub>K vv Suc n\<^esub>) j) = 0;
        valuation K (vv m);
        vv m ((\<Omega>\<^bsub>K vv Suc n\<^esub>) j^\<^bsup>K N\<^esup>) =
        0\<rbrakk>
       \<Longrightarrow> False
 2. \<lbrakk>0 < N; j \<le> Suc n; vals_nonequiv K (Suc n) vv; Ring K;
     aGroup K; (\<Omega>\<^bsub>K vv Suc n\<^esub>) j \<in> carrier K;
     (\<Omega>\<^bsub>K vv Suc n\<^esub>) j^\<^bsup>K N\<^esup>
     \<in> carrier K;
     -\<^sub>a (\<Omega>\<^bsub>K vv Suc n\<^esub>) j^\<^bsup>K N\<^esup>
     \<in> carrier K;
     (\<Omega>\<^bsub>K vv Suc n\<^esub>) j^\<^bsup>K N\<^esup> \<plusminus>
     -\<^sub>a (\<Omega>\<^bsub>K vv Suc n\<^esub>) j^\<^bsup>K N\<^esup>
     \<in> carrier K;
     1\<^sub>r = (\<Omega>\<^bsub>K vv Suc n\<^esub>) j^\<^bsup>K N\<^esup>;
     \<forall>m\<le>Suc n.
        j \<noteq> m \<longrightarrow>
        0 < vv m ((\<Omega>\<^bsub>K vv Suc n\<^esub>) j)\<rbrakk>
    \<Longrightarrow> j \<in> {h. h \<le> Suc n}
 3. \<lbrakk>0 < N; j \<le> Suc n; vals_nonequiv K (Suc n) vv; Ring K;
     aGroup K; (\<Omega>\<^bsub>K vv Suc n\<^esub>) j \<in> carrier K;
     (\<Omega>\<^bsub>K vv Suc n\<^esub>) j^\<^bsup>K N\<^esup>
     \<in> carrier K;
     -\<^sub>a (\<Omega>\<^bsub>K vv Suc n\<^esub>) j^\<^bsup>K N\<^esup>
     \<in> carrier K;
     (\<Omega>\<^bsub>K vv Suc n\<^esub>) j^\<^bsup>K N\<^esup> \<plusminus>
     -\<^sub>a (\<Omega>\<^bsub>K vv Suc n\<^esub>) j^\<^bsup>K N\<^esup>
     \<in> carrier K;
     1\<^sub>r =
     (\<Omega>\<^bsub>K vv Suc n\<^esub>) j^\<^bsup>K N\<^esup>\<rbrakk>
    \<Longrightarrow> \<forall>m\<le>Suc n.
                         j \<noteq> m \<longrightarrow>
                         0 < vv m ((\<Omega>\<^bsub>K vv Suc n\<^esub>) j)


proof (prove)
goal (1 subgoal):
 1. (\<Sum>i\<le>degree (map_poly (pCons (0::'a)) p).
        \<Sum>j\<le>degree (coeff (map_poly (pCons (0::'a)) p) i).
           monom (monom (coeff (coeff (map_poly (pCons (0::'a)) p) i) j) i)
            j) =
    pCons 0
     (\<Sum>i\<le>degree p.
         \<Sum>j\<le>degree (coeff p i).
            monom (monom (coeff (coeff p i) j) i) j)


proof (prove)
using this:
  0 < k
  (\<Sum>d | d dvd ?k. \<chi> d) \<in> \<real>

goal (1 subgoal):
 1. Re (\<Sum>d | d dvd k. \<chi> d) =
    (\<Prod>p\<in>prime_factors k.
       Re (\<Sum>d | d dvd p ^ multiplicity p k. \<chi> d))


proof (prove)
using this:
  0 \<le> pi / 2
  \<lbrakk>0 \<le> ?\<phi>; ?\<phi> \<le> pi; cos ?\<phi> = 0\<rbrakk>
  \<Longrightarrow> ?\<phi> = \<theta>

goal (1 subgoal):
 1. pi / 2 = \<theta>


proof (prove)
goal (1 subgoal):
 1. uint32_of_uint x = Abs_uint32' (ucast (Rep_uint x))


proof (prove)
using this:
  c \<noteq> (0::'a) \<Longrightarrow> integrable (count_space A) f

goal (1 subgoal):
 1. LINT x|count_space A. f x *\<^sub>R c =
    integral\<^sup>L (count_space A) f *\<^sub>R c


proof (prove)
goal (1 subgoal):
 1. twoNetsDistinct a b c d


proof (prove)
goal (1 subgoal):
 1. COERCE('c \<oplus> 'd, 'a \<oplus> 'b)\<cdot>(sinr\<cdot>x) =
    sinr\<cdot>(COERCE('d, 'b)\<cdot>x)


proof (prove)
using this:
  local.set a \<subseteq> local.set b

goal (1 subgoal):
 1. (\<lambda>x. x) \<in> local.set a \<rightarrow> local.set b


proof (prove)
goal (1 subgoal):
 1. continuous_on UNIV (\<lambda>x. Blinfun (\<lambda>y'. y' * x))


proof (prove)
using this:
  finite A
  A \<noteq> {}

goal (1 subgoal):
 1. bo a u


proof (prove)
using this:
  R2 (m0, m1) \<sigma> = S2 \<sigma> (if \<sigma> then m1 else m0)

goal (1 subgoal):
 1. sim_def.perfect_sec_P2 (m0, m1) \<sigma>


proof (prove)
goal (1 subgoal):
 1. \<exists>C D.
       prefix C B \<and>
       prefix D A \<and>
       C \<in> set (tr\<^sub>p\<^sub>c D []) \<and>
       ik\<^sub>s\<^sub>t (proj_unl n C) \<cdot>\<^sub>s\<^sub>e\<^sub>t
       \<I> \<turnstile>
       t \<cdot> \<I>


proof (prove)
using this:
  CT Object = None

goal (1 subgoal):
 1. [] = Cf'


proof (prove)
using this:
  \<Gamma>1 \<union> (\<Gamma>2 - {F}) \<union>
  (\<Gamma>3 - {G}) \<turnstile>
  H

goal (1 subgoal):
 1. \<exists>\<Gamma>''\<subseteq>\<Gamma>.
       finite \<Gamma>'' \<and> (\<Gamma>'' \<turnstile> H)


proof (state)
goal (3 subgoals):
 1. ring_isomorphism (identity stk1.carrier_stalk) stk1.carrier_stalk
     stk1.add_stalk stk1.mult_stalk (stk1.zero_stalk U) (stk1.one_stalk U)
     stk2.carrier_stalk stk2.add_stalk stk2.mult_stalk (stk2.zero_stalk U)
     (stk2.one_stalk U)
 2. stk1.carrier_stalk = stk2.carrier_stalk
 3. stk1.class_of = stk2.class_of


proof (prove)
using this:
  \<lbrakk>closedin (top_of_set ?U) S';
   \<And>V.
      \<lbrakk>openin (top_of_set ?U) V; S' retract_of V\<rbrakk>
      \<Longrightarrow> ?thesis\<rbrakk>
  \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<And>V.
        \<lbrakk>open V; S' retract_of V\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (18 subgoals):
 1. \<And>G.
       G \<rhd> Skip : Sec (\<lambda>(s, t, \<beta>).
                               s \<equiv>\<^sub>\<beta> t)
 2. \<And>e G x.
       Expr_low e \<Longrightarrow>
       G \<rhd> Assign x
                 e : Sec (\<lambda>(s, t, \<beta>).
                             \<exists>r.
                                s =
                                (update (fst r) x (evalE e (fst r)),
                                 snd r) \<and>
                                r \<equiv>\<^sub>\<beta> t)
 3. \<And>G c1 \<Phi> c2 \<Psi>.
       \<lbrakk>(G, c1, Sec \<Phi>) \<in> Deriv; G \<rhd> c1 : Sec \<Phi>;
        (G, c2, Sec \<Psi>) \<in> Deriv; G \<rhd> c2 : Sec \<Psi>\<rbrakk>
       \<Longrightarrow> G \<rhd> Comp c1
                                   c2 : Sec
   (\<lambda>(s, t, \<beta>).
       \<exists>r.
          \<Phi> (r, t, \<beta>) \<and>
          (\<forall>w \<gamma>.
              r \<equiv>\<^sub>\<gamma> w \<longrightarrow>
              \<Psi> (s, w, \<gamma>)))
 4. \<And>b G c1 \<Phi> c2 \<Psi>.
       \<lbrakk>BExpr_low b; (G, c1, Sec \<Phi>) \<in> Deriv;
        G \<rhd> c1 : Sec \<Phi>; (G, c2, Sec \<Psi>) \<in> Deriv;
        G \<rhd> c2 : Sec \<Psi>\<rbrakk>
       \<Longrightarrow> G \<rhd> Iff b c1
                                   c2 : Sec
   (\<lambda>(s, t, \<beta>).
       (evalB b (fst t) \<longrightarrow> \<Phi> (s, t, \<beta>)) \<and>
       (\<not> evalB b (fst t) \<longrightarrow> \<Psi> (s, t, \<beta>)))
 5. \<And>x G C.
       CONTEXT x = low \<Longrightarrow>
       G \<rhd> New x
                 C : Sec (\<lambda>(s, t, \<beta>).
                             \<exists>l r.
                                l \<notin> Dom (snd r) \<and>
                                r \<equiv>\<^sub>\<beta> t \<and>
                                s =
                                (update (fst r) x (RVal (Loc l)),
                                 (l, C, []) # snd r))
 6. \<And>y f G x.
       \<lbrakk>CONTEXT y = low; GAMMA f = low\<rbrakk>
       \<Longrightarrow> G \<rhd> Get x y
                                   f : Sec
  (\<lambda>(s, t, \<beta>).
      \<exists>r l C Flds v.
         fst r y = RVal (Loc l) \<and>
         lookup (snd r) l = Some (C, Flds) \<and>
         lookup Flds f = Some v \<and>
         r \<equiv>\<^sub>\<beta> t \<and> s = (update (fst r) x v, snd r))
 7. \<And>x f e G.
       \<lbrakk>CONTEXT x = low; GAMMA f = low; Expr_low e\<rbrakk>
       \<Longrightarrow> G \<rhd> Put x f
                                   e : Sec
  (\<lambda>(s, t, \<beta>).
      \<exists>r l C F h.
         fst r x = RVal (Loc l) \<and>
         r \<equiv>\<^sub>\<beta> t \<and>
         lookup (snd r) l = Some (C, F) \<and>
         h = (l, C, (f, evalE e (fst r)) # F) # snd r \<and> s = (fst r, h))
 8. \<And>b G c \<Phi>.
       \<lbrakk>BExpr_low b; (G, c, Sec \<Phi>) \<in> Deriv;
        G \<rhd> c : Sec \<Phi>\<rbrakk>
       \<Longrightarrow> G \<rhd> While b c : Sec (PhiWhile b \<Phi>)
 9. \<And>\<phi> G.
       \<lbrakk>({Sec (FIX \<phi>)} \<union> G, body,
                 Sec (\<phi> (FIX \<phi>)))
                \<in> Deriv;
        ({Sec (FIX \<phi>)} \<union>
         G) \<rhd> body : Sec (\<phi> (FIX \<phi>));
        Monotone \<phi>\<rbrakk>
       \<Longrightarrow> G \<rhd> Call : Sec (FIX \<phi>)
 10. \<And>G. G \<rhd> Skip : HighSec
A total of 18 subgoals...


proof (prove)
goal (1 subgoal):
 1. \<And>xs ys v.
       \<lbrakk>xs \<in> paths; ys \<in> paths; xs \<noteq> ys;
        v \<in> set xs; v \<in> set ys\<rbrakk>
       \<Longrightarrow> v = v0 \<or> v = v1


proof (prove)
using this:
  \<lbrace>b \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
           c\<rbrace> \<cdot>
  (\<l>[\<lbrace>b \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
                 c\<rbrace>] \<cdot>
   (\<I> \<otimes> \<lbrace>b \<^bold>\<Down> c\<rbrace>)) \<cdot>
  \<a>[\<I>, \<lbrace>b\<rbrace>, \<lbrace>c\<rbrace>] =
  \<lbrace>b \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
           c\<rbrace> \<cdot>
  (\<lbrace>b \<^bold>\<Down> c\<rbrace> \<cdot>
   \<l>[\<lbrace>b\<rbrace> \<otimes> \<lbrace>c\<rbrace>]) \<cdot>
  \<a>[\<I>, \<lbrace>b\<rbrace>, \<lbrace>c\<rbrace>]

goal (1 subgoal):
 1. \<lbrace>b \<^bold>\<Down> c\<rbrace> \<cdot>
    (\<lbrace>b\<rbrace> \<cdot> \<l>[\<lbrace>b\<rbrace>] \<otimes>
     \<lbrace>c\<rbrace>) =
    ((\<lbrace>b \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
               c\<rbrace> \<cdot>
      \<l>[\<lbrace>b \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
                    c\<rbrace>]) \<cdot>
     (\<I> \<otimes> \<lbrace>b \<^bold>\<Down> c\<rbrace>)) \<cdot>
    \<a>[\<I>, \<lbrace>b\<rbrace>, \<lbrace>c\<rbrace>]


proof (prove)
goal (2 subgoals):
 1. to_fun x \<oplus>\<^bsub>function_ring (carrier R) R\<^esub> to_fun y
    \<in> carrier (function_ring (carrier R) R)
 2. \<And>a.
       a \<in> carrier R \<Longrightarrow>
       to_fun (x \<oplus>\<^bsub>P\<^esub> y) a =
       (to_fun x \<oplus>\<^bsub>function_ring (carrier R) R\<^esub>
        to_fun y)
        a


proof (prove)
goal (1 subgoal):
 1. (\<lbrakk>i < dim_row A; j < dim_col A\<rbrakk>
     \<Longrightarrow> (- A) $$ (i, j) = - A $$ (i, j)) &&&
    dim_row (- A) = dim_row A &&& dim_col (- A) = dim_col A


proof (prove)
goal (1 subgoal):
 1. \<And>x y.
       \<lbrakk>closed_csubspace x; closed_csubspace y;
        x \<subseteq> y\<rbrakk>
       \<Longrightarrow> x +\<^sub>M orthogonal_complement x \<inter> y = y


proof (prove)
goal (1 subgoal):
 1. card
     {xs.
      (\<forall>i\<in>X. xs ! i) \<and>
      (\<forall>i\<in>Y. \<not> xs ! i) \<and> length xs = m} =
    2 ^ (m - card X - card Y)


proof (prove)
goal (1 subgoal):
 1. local_ring stfx.carrier_stalk stfx.add_stalk stfx.mult_stalk
     (stfx.zero_stalk V) (stfx.one_stalk V)


proof (prove)
goal (1 subgoal):
 1. simple_distributed M (\<lambda>x. (X x, Y x)) Pxy


proof (prove)
goal (3 subgoals):
 1. Eq p \<in> set L
 2. MPoly_Type.degree p var = 1 \<or> MPoly_Type.degree p var = 2
 3. \<forall>x.
       insertion (nth_default 0 (xs @ x # \<Gamma>))
        (isolate_variable_sparse p var 2) \<noteq>
       0 \<or>
       insertion (nth_default 0 (xs @ x # \<Gamma>))
        (isolate_variable_sparse p var 1) \<noteq>
       0 \<or>
       insertion (nth_default 0 (xs @ x # \<Gamma>))
        (isolate_variable_sparse p var 0) \<noteq>
       0


proof (prove)
goal (2 subgoals):
 1. \<And>a b c d.
       \<lbrakk>wf_jvm_prog\<^bsub>\<Phi>\<^esub> P;
        \<not> is_class P Start;
        P \<turnstile> C sees M, Static :  []\<rightarrow>Void = (a, b, c,
                            d) in C;
        M \<noteq> clinit; \<Phi>' Start start_m = start_\<phi>\<^sub>m;
        is_class P Object;
        \<exists>Mm. P \<turnstile> Object sees_methods Mm;
        m = (a, b, c, d)\<rbrakk>
       \<Longrightarrow> class_add P
                          (Start, Object, [],
                           [start_method C M,
                            (clinit, Static, [], Void, Suc 0, 0,
                             [Push Unit, Return],
                             [])]) \<turnstile> start_heap P \<surd>
 2. \<And>a b c d.
       \<lbrakk>wf_jvm_prog\<^bsub>\<Phi>\<^esub> P;
        \<not> is_class P Start;
        P \<turnstile> C sees M, Static :  []\<rightarrow>Void = (a, b, c,
                            d) in C;
        M \<noteq> clinit; \<Phi>' Start start_m = start_\<phi>\<^sub>m;
        is_class P Object;
        \<exists>Mm. P \<turnstile> Object sees_methods Mm;
        m = (a, b, c, d)\<rbrakk>
       \<Longrightarrow> class_add P
                          (Start, Object, [],
                           [start_method C M,
                            (clinit, Static, [], Void, Suc 0, 0,
                             [Push Unit, Return],
                             [])]),start_heap
                                    P \<turnstile>\<^sub>s [Start \<mapsto>
                      (Map.empty, Done)] \<surd> \<and>
                         conf_clinit
                          (class_add P
                            (Start, Object, [],
                             [start_method C M,
                              (clinit, Static, [], Void, Suc 0, 0,
                               [Push Unit, Return], [])]))
                          [Start \<mapsto> (Map.empty, Done)]
                          [([], [], Start, start_m, 0, No_ics)] \<and>
                         (\<exists>b Ts T mxs mxl\<^sub>0 is.
                             (\<exists>xt.
                                 class_add P
                                  (Start, Object, [],
                                   [start_method C M,
                                    (clinit, Static, [], Void, Suc 0, 0,
                                     [Push Unit, Return],
                                     [])]) \<turnstile> Start sees start_m, b :  Ts\<rightarrow>T = (mxs,
                         mxl\<^sub>0, is, xt) in Start) \<and>
                             conf_f
                              (class_add P
                                (Start, Object, [],
                                 [start_method C M,
                                  (clinit, Static, [], Void, Suc 0, 0,
                                   [Push Unit, Return], [])]))
                              (start_heap P)
                              [Start \<mapsto> (Map.empty, Done)] ([], [])
                              is ([], [], Start, start_m, 0, No_ics))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a < (0::'a); b < (0::'a)\<rbrakk>
    \<Longrightarrow> (0::'a) < a * b


proof (prove)
using this:
  local.path g ns \<and> n = hd ns \<and> m = last ns
  local.path g ms \<and> m = hd ms \<and> l = last ms
  last (ns @ tl ms) = last ms

goal (1 subgoal):
 1. local.path g (ns @ tl ms) \<and>
    n = hd (ns @ tl ms) \<and> l = last (ns @ tl ms)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Key K \<in> analz H; Key (invKey K) \<in> analz H\<rbrakk>
    \<Longrightarrow> (Crypt K X \<in> synth (analz H)) =
                      (X \<in> synth (analz H))


proof (prove)
using this:
  f \<noteq> 0 \<and>
  lookup p (t \<oplus> lt f) \<noteq> (0::'b) \<and>
  p0 = p - monom_mult (lookup p (t \<oplus> lt f) / lc f) t f

goal (1 subgoal):
 1. lookup p (t \<oplus> lt f) \<noteq> (0::'b)


proof (prove)
using this:
  CD_on ds X = X

goal (1 subgoal):
 1. Cd d X = dX X d


proof (prove)
using this:
  SubRel.subpath g (tgt e') es v2 subs
  e \<noteq> e' \<and> e \<in> set es

goal (1 subgoal):
 1. \<exists>es'. e' # es = es' @ [e] \<and> e \<notin> set es'


proof (prove)
using this:
  \<lbrakk>finite ?L; unifier\<^sub>l\<^sub>s ?\<sigma> ?L\<rbrakk>
  \<Longrightarrow> \<exists>\<theta>. mgu\<^sub>l\<^sub>s \<theta> ?L

goal (1 subgoal):
 1. unification


proof (prove)
goal (1 subgoal):
 1. \<forall>x.
       bd\<^sub>\<F> (\<lambda>x. g x \<union> h x) (f x) =
       bd\<^sub>\<F> g (f x) \<union> bd\<^sub>\<F> h (f x)


proof (prove)
goal (1 subgoal):
 1. - 1 AND x = x


proof (prove)
goal (1 subgoal):
 1. FiniteGraph.add_edge v v' (list_graph_to_graph G) =
    list_graph_to_graph (FiniteListGraph.add_edge v v' G)


proof (prove)
goal (1 subgoal):
 1. divide_poly_main lc
     (smult (lc ^ n) (smult lc q) + monom (lc ^ n * coeff r dr) n)
     (smult (lc ^ n) (smult lc r) - monom (lc ^ n * coeff r dr) n * d) d
     (dr - 1) n =
    divide_poly_main lc (smult (lc ^ Suc n) q) (smult (lc ^ Suc n) r) d dr
     (Suc n)


proof (prove)
goal (1 subgoal):
 1. gen_refine.mds\<^sub>A_of x = x


proof (prove)
using this:
  Ipol ls (Commutative_Ring.pow (k div 2) (sqr P)) =
  Ipol ls (sqr P) [^] (k div 2)
  in_carrier ls
  odd k

goal (1 subgoal):
 1. Ipol ls (Commutative_Ring.pow k P) = Ipol ls P [^] k


proof (prove)
goal (1 subgoal):
 1. count_terminals a \<le> count_terminals b


proof (prove)
goal (1 subgoal):
 1. known_ptr
     (cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r
       new_shadow_root_ptr)


proof (prove)
goal (1 subgoal):
 1. bd\<^sub>\<R> R X = {y. \<exists>x\<in>X. s2p R (x, y)}


proof (prove)
goal (4 subgoals):
 1. degree u \<le> d
 2. degree [:k:] \<le> n - d
 3. vec n c \<in> carrier_vec (d + (n - d))
 4. poly_of_vec (vec_first (vec n c) (n - d)) * u +
    poly_of_vec (vec_last (vec n c) d) * [:k:] =
    q * u + smult k r


proof (prove)
using this:
  {t. h ?n (g t) = ?y} \<inter> S \<in> sets lebesgue
  S \<in> sets lebesgue

goal (1 subgoal):
 1. (\<lambda>x. indicat_real {x. h n x = y} (g x))
    \<in> borel_measurable (lebesgue_on S)


proof (chain)
picking this:
  front_tickFree a
  (a, b) \<notin> F P
  [] \<in> D P


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sorted (rev xs); i \<le> j; j < length xs\<rbrakk>
    \<Longrightarrow> xs ! j \<le> xs ! i


proof (prove)
goal (1 subgoal):
 1. (degeneralize_ext_impl Gi ecnvi, igb_graph.degeneralize_ext G ecnv)
    \<in> bg_impl_rel_ext Re' (Rv \<times>\<^sub>r nat_rel)


proof (prove)
using this:
  v \<in> set vs

goal (1 subgoal):
 1. v \<notin> f ` set (remdups_wrt_rev f (x # xs) vs)


proof (state)
goal (4 subgoals):
 1. uniformity = (INF e\<in>{0<..}. principal {(x, y). dist x y < e})
 2. \<And>U.
       open U =
       (\<forall>x\<in>U.
           \<forall>\<^sub>F (x', y) in uniformity.
              x' = x \<longrightarrow> y \<in> U)
 3. \<And>x y. (dist x y = 0) = (x = y)
 4. \<And>x y z. dist x y \<le> dist x z + dist y z


proof (prove)
goal (1 subgoal):
 1. (\<And>a b.
        quotient_of p = (a, b) \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  f \<equiv>
  restrict1 (canonical_retraction A D \<circ> canonical_retraction B C)
   (\<Union> A)
  g \<equiv>
  restrict1 (canonical_retraction A C \<circ> canonical_retraction B' D)
   (\<Union> A)

goal (1 subgoal):
 1. (ChamberComplexFolding A f &&& ChamberComplexFolding A g) &&&
    f ` D = C &&& g ` C = D


proof (prove)
using this:
  A_BxA.seq Fg' Fg
  \<lbrakk>A_BxA.seq ?g ?f;
   \<lbrakk>A_B.seq (fst ?g) (fst ?f); A.seq (snd ?g) (snd ?f)\<rbrakk>
   \<Longrightarrow> ?T\<rbrakk>
  \<Longrightarrow> ?T

goal (1 subgoal):
 1. A_B.arr (fst Fg')


proof (prove)
goal (1 subgoal):
 1. y\<^sup>\<circ> * x * y\<^sup>\<circ>
    \<le> x * y\<^sup>\<circ> \<squnion> y\<^sup>\<circ> * bot


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>C.ide f;
     \<guillemotleft>\<nu> : G f \<Rightarrow>\<^sub>D G
                  f'\<guillemotright>;
     \<guillemotleft>D.inv (\<tau>.\<psi> f') \<cdot>\<^sub>D
                     (\<sigma>'.map\<^sub>0 (trg\<^sub>C f) \<star>\<^sub>D
                      \<nu> \<star>\<^sub>D
                      \<tau>\<^sub>0 (src\<^sub>C f)) \<cdot>\<^sub>D
                     \<tau>.\<psi>
                      f : F f \<Rightarrow>\<^sub>D F f'\<guillemotright>;
     \<guillemotleft>\<mu> : f \<Rightarrow>\<^sub>C f'\<guillemotright>;
     F \<mu> =
     D.inv (\<tau>.\<psi> f') \<cdot>\<^sub>D
     (\<sigma>'.map\<^sub>0 (trg\<^sub>C f) \<star>\<^sub>D
      \<nu> \<star>\<^sub>D \<tau>\<^sub>0 (src\<^sub>C f)) \<cdot>\<^sub>D
     \<tau>.\<psi> f\<rbrakk>
    \<Longrightarrow> D.cod
                       (G \<mu> \<star>\<^sub>D
                        \<tau>\<^sub>0 (src\<^sub>C f)) =
                      D.cod
                       (\<nu> \<star>\<^sub>D
                        \<tau>\<^sub>0 (src\<^sub>C f))


proof (prove)
goal (1 subgoal):
 1. degree (pdev_upd X n x) = degree X


proof (state)
this:
  list_all2 (\<lambda>x y. x = norm_instr y) xs (rewrite ys pc instr)

goal (1 subgoal):
 1. \<And>x1a x2a y1a y2a.
       \<lbrakk>fd1 = Fundef x1a x2a; fd2 = Fundef y1a y2a;
        list_all2 (\<lambda>x y. x = norm_instr y) x1a y1a;
        x2a = y2a\<rbrakk>
       \<Longrightarrow> rel_fundef (\<lambda>x y. x = norm_instr y) fd1
                          (rewrite_fundef_body fd2 pc instr)


proof (prove)
goal (1 subgoal):
 1. l3_inv2 \<inter> l3_inv3 \<subseteq> l3_inv5


proof (prove)
goal (1 subgoal):
 1. ((=) ===>
     rel_prod2 (=) ===> (=) ===> rel_spmf (rel_prod (=) (rel_prod2 (=))))
     local.ind_cca.oracle_decrypt oracle_decrypt0'


proof (prove)
goal (1 subgoal):
 1. (u, v)
    \<in> {(u, v). c (u, v) \<noteq> (0::'capacity)} \<Longrightarrow>
    (0::'capacity) < c (u, v)


proof (prove)
goal (1 subgoal):
 1. closed_map X (prod_topology Y X) (\<lambda>x. (f x, x))


proof (prove)
goal (1 subgoal):
 1. factor_preserving_hom poly_x_minus_y


proof (prove)
goal (1 subgoal):
 1. locale_poly ((\<le>) 0)


proof (prove)
using this:
  subcocycle u
  0 \<le> c
  - \<infinity> < subcocycle_avg_ereal u
  subcocycle_avg_ereal ?u < \<infinity>

goal (1 subgoal):
 1. - \<infinity> < subcocycle_avg_ereal (\<lambda>n x. c * u n x) &&&
    subcocycle_avg (\<lambda>n x. c * u n x) = c * subcocycle_avg u


proof (prove)
goal (1 subgoal):
 1. map_ran (\<lambda>x. lift_transform t (ae x)) (restrictA S \<Gamma>) =
    restrictA S (map_ran (\<lambda>x. lift_transform t (ae x)) \<Gamma>)


proof (prove)
using this:
  support_flow (\<Squnion>g\<in>Y. (\<lambda>e. f e - g e))
  \<subseteq> support_flow f

goal (1 subgoal):
 1. countable (support_flow (\<Squnion>g\<in>Y. (\<lambda>e. f e - g e)))


proof (prove)
using this:
  local.eval p x = local.eval r x
  a \<in> carrier R

goal (1 subgoal):
 1. a = \<zero>


proof (prove)
using this:
  \<tau>Exec_movet ci P t e h (stk, loc, pc, xcp)
   (stk'', loc'', pc'', xcp'')

goal (1 subgoal):
 1. Q stk'' loc'' pc'' xcp''


proof (prove)
using this:
  t \<in> U (Suc h)

goal (1 subgoal):
 1. ins x t \<in> T (Suc h)


proof (prove)
goal (1 subgoal):
 1. color (paint Black t) = Black


proof (prove)
goal (1 subgoal):
 1. i < length (xs \<sqinter> ys) \<Longrightarrow>
    (xs \<sqinter> ys) ! i = ys ! i


proof (prove)
using this:
  (f \<odot> g) (i, j) =
  sup_monoid.sum (\<lambda>k. f (i, k)) {k. True} \<sqinter> g (i, j)

goal (1 subgoal):
 1. (f \<odot> g) (i, j) = f (i, i) \<sqinter> g (i, j)


proof (prove)
goal (1 subgoal):
 1. SPN_fgh.\<nu>.leg0 \<odot> SPN_fgh.Prj\<^sub>0\<^sub>1 =
    SPN_fgh.\<pi>.leg1 \<odot> SPN_fgh.Prj\<^sub>0


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>w \<Turnstile>\<^sub>n \<phi>[M]\<^sub>\<Sigma>\<^sub>2;
     M \<subseteq> M'\<rbrakk>
    \<Longrightarrow> w \<Turnstile>\<^sub>n \<phi>[M']\<^sub>\<Sigma>\<^sub>2


proof (state)
goal (1 subgoal):
 1. continuous_on s g \<and>
    (\<exists>S. finite S \<and> g C1_differentiable_on s - S)


proof (prove)
using this:
  \<langle>col_fst (U * |v\<rangle>)|col_fst (U * |v\<rangle>)\<rangle> =
  (\<langle>|v\<rangle>| * U\<^sup>\<dagger> * (U * |v\<rangle>)) $$ (0, 0)
  dim_col \<langle>|v\<rangle>| = dim_vec v
  dim_row U\<^sup>\<dagger> = dim_vec v
  \<lbrakk>?A \<in> carrier_mat ?n\<^sub>1 ?n\<^sub>2;
   ?B \<in> carrier_mat ?n\<^sub>2 ?n\<^sub>3;
   ?C \<in> carrier_mat ?n\<^sub>3 ?n\<^sub>4\<rbrakk>
  \<Longrightarrow> ?A * ?B * ?C = ?A * (?B * ?C)

goal (1 subgoal):
 1. \<langle>col_fst (U * |v\<rangle>)|col_fst (U * |v\<rangle>)\<rangle> =
    (\<langle>|v\<rangle>| * (U\<^sup>\<dagger> * U) * |v\<rangle>) $$
    (0, 0)


proof (prove)
using this:
  Rel = indRelRTPO TRel
  rel_weakly_preserves_barb_set TRel TWB {success}
  rel_weakly_reflects_barb_set TRel TWB {success}
  \<forall>S x.
     x \<in> {success} \<and>
     ((\<exists>Sa. Sa \<in>S SourceTerm S \<and> Sa\<Down><SWB>x) \<or>
      (\<exists>T.
          T \<in>T SourceTerm S \<and> T\<Down><TWB>x)) \<longrightarrow>
     x \<in> {success} \<and>
     ((\<exists>Sa.
          Sa \<in>S TargetTerm (\<lbrakk>S\<rbrakk>) \<and>
          Sa\<Down><SWB>x) \<or>
      (\<exists>T.
          T \<in>T TargetTerm (\<lbrakk>S\<rbrakk>) \<and> T\<Down><TWB>x))
  \<forall>S x.
     x \<in> {success} \<and>
     ((\<exists>Sa.
          Sa \<in>S TargetTerm (\<lbrakk>S\<rbrakk>) \<and>
          Sa\<Down><SWB>x) \<or>
      (\<exists>T.
          T \<in>T TargetTerm (\<lbrakk>S\<rbrakk>) \<and>
          T\<Down><TWB>x)) \<longrightarrow>
     x \<in> {success} \<and>
     ((\<exists>Sa. Sa \<in>S SourceTerm S \<and> Sa\<Down><SWB>x) \<or>
      (\<exists>T. T \<in>T SourceTerm S \<and> T\<Down><TWB>x))

goal (1 subgoal):
 1. rel_weakly_respects_barb_set Rel (STCalWB SWB TWB) {success}


proof (prove)
goal (1 subgoal):
 1. llexord r (Lazy_llist xs) (Lazy_llist ys) =
    (case xs () of None \<Rightarrow> True
     | Some (x, xs') \<Rightarrow>
         case ys () of None \<Rightarrow> False
         | Some (y, ys') \<Rightarrow>
             r x y \<or> x = y \<and> llexord r xs' ys')


proof (prove)
using this:
  T \<in> B
  disjoint B

goal (1 subgoal):
 1. T \<inter> \<Union> (B - {T}) = {}


proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>space N.
       real_cond_exp N (G 0) (discounted_value r (\<lambda>m. der) matur)
        x =
       integral\<^sup>L N (discounted_value r (\<lambda>m. der) matur)


proof (prove)
goal (1 subgoal):
 1. \<And>t guest room key1 key2.
       \<lbrakk>\<lparr>state.owns = Trace.owns t, currk = Trace.currk t,
                   issued = Trace.issued t, cards = Trace.cards t,
                   roomk = Trace.roomk t, isin = Trace.isin t,
                   safe =
                     \<lambda>r.
                        Trace.safe t r \<or> Trace.owns t r = None\<rparr>
                \<in> reach;
        inj initk; hotel t; (key1, key2) \<in> Trace.cards t guest;
        Trace.roomk t room = key1 \<or> Trace.roomk t room = key2\<rbrakk>
       \<Longrightarrow> \<lparr>state.owns =
                                   Trace.owns
                                    (Enter guest room (key1, key2) # t),
                            currk =
                              Trace.currk
                               (Enter guest room (key1, key2) # t),
                            issued = Trace.issued t,
                            cards =
                              Trace.cards
                               (Enter guest room (key1, key2) # t),
                            roomk =
                              Trace.roomk
                               (Enter guest room (key1, key2) # t),
                            isin =
                              Trace.isin
                               (Enter guest room (key1, key2) # t),
                            safe =
                              \<lambda>r.
                                 Trace.safe
                                  (Enter guest room (key1, key2) # t)
                                  r \<or>
                                 Trace.owns t r = None\<rparr>
                         \<in> reach


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>has_dist_on G m n V; p \<in> path_set_on G m n V\<rbrakk>
    \<Longrightarrow> dist_on G m n V \<le> path_weight G p


proof (prove)
goal (1 subgoal):
 1. (\<And>m. n = m + 2 \<Longrightarrow> thesis) \<Longrightarrow> thesis


proof (prove)
goal (1 subgoal):
 1. U.wtE \<xi> \<Longrightarrow> F.wtE \<xi>


proof (prove)
using this:
  \<forall>m. i \<in># m \<longrightarrow> P m = \<zero>
  \<forall>m. i \<in># m \<longrightarrow> Q m = \<zero>

goal (1 subgoal):
 1. \<forall>m. i \<in># m \<longrightarrow> P m \<oplus> Q m = \<zero>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<turnstile> p \<rhd> u \<Rightarrow> \<theta>;
     supp p \<sharp>* u\<rbrakk>
    \<Longrightarrow> supp (map fst \<theta>) \<sharp>* map snd \<theta>


proof (prove)
goal (3 subgoals):
 1. countable UNIV
 2. countable (Collect TE_wtFsym)
 3. countable {p. wtPsym p}


proof (prove)
using this:
  S.is_left_adjoint (S.UP f \<star>\<^sub>S S.UP f')
  S.isomorphic (S.UP f \<star>\<^sub>S S.UP f') (S.UP (f \<star> f'))

goal (1 subgoal):
 1. S.is_left_adjoint (S.UP (f \<star> f'))


proof (prove)
using this:
  env = Env b es
  es x = Some e'
  xs = []
  e = e'

goal (1 subgoal):
 1. lookup (update ((x # xs) @ y # ys) opt env) (x # xs) =
    Some (update (y # ys) opt e)


proof (prove)
goal (1 subgoal):
 1. orthogonal x a


proof (prove)
goal (1 subgoal):
 1. bounded (range f)


proof (prove)
goal (1 subgoal):
 1. (if k = 0 then ([], map_poly hom p)
     else if map_poly hom (root_unity k) dvd map_poly hom p
          then if map_poly hom p = 0 then ([], 0)
               else map_prod ((#) k) id
                     (decompose_prod_root_unity_main
                       (map_poly hom p div map_poly hom (root_unity k)) k)
          else decompose_prod_root_unity_main (map_poly hom p) (k - 1)) =
    (if k = 0 then map_prod id (map_poly hom) ([], p)
     else if root_unity k dvd p
          then if p = 0 then map_prod id (map_poly hom) ([], 0)
               else map_prod id (map_poly hom)
                     (map_prod ((#) k) id
                       (decompose_prod_root_unity_main (p div root_unity k)
                         k))
          else map_prod id (map_poly hom)
                (decompose_prod_root_unity_main p (k - 1)))


proof (prove)
using this:
  winning_path p (LCons v0 P)
  \<lbrakk>winning_path p (LCons v0 P); \<not> lnull (LCons v0 P);
   \<not> lnull (ltl (LCons v0 P))\<rbrakk>
  \<Longrightarrow> winning_path p (ltl (LCons v0 P))

goal (1 subgoal):
 1. winning_path p P


proof (prove)
goal (1 subgoal):
 1. map (\<lambda>t. vars_term_ms (t \<cdot> \<sigma>)) ts =
    map (\<lambda>t. \<Sum>x\<in>#vars_term_ms t. vars_term_ms (\<sigma> x))
     ts


proof (prove)
using this:
  \<MM>.token_run x (Suc n) \<in> {q. \<G> \<Turnstile>\<^sub>P Rep q}
  x \<le> n
  ?x \<le> ?n \<Longrightarrow>
  \<MM>.token_run ?x (Suc ?n) = \<up>step (\<UU>.token_run ?x ?n) (w ?n)

goal (1 subgoal):
 1. \<G> \<Turnstile>\<^sub>P Rep (\<up>step (\<UU>.token_run x n) (w n))


proof (state)
this:
  t \<equiv> inverse B

goal (1 subgoal):
 1. (\<And>et ex B L.
        \<lbrakk>0 < et; 0 < ex; cball t0 et \<subseteq> T;
         cball x0 ex \<subseteq> X;
         unique_on_cylinder t0 (cball t0 et) x0 ex f B L\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  stfx.mult_stalk C C' = stfx.class_of (U \<inter> U') mult

goal (1 subgoal):
 1. stfx.class_of (U \<inter> U') mult \<in> stfx.carrier_stalk


proof (prove)
using this:
  \<lbrakk>Q (smap state ?xa7);
   smap abss (smap state ?xa7) = smap state (smap absc ?xa7);
   smap state ?xa7 \<in> Y\<rbrakk>
  \<Longrightarrow> smap state (smap absc ?xa7) \<in> X \<and>
                    P (smap state (smap absc ?xa7))

goal (1 subgoal):
 1. stream_all2 (\<lambda>s t. t = absc s) x y \<Longrightarrow>
    (x \<in> {y. smap state y \<in> Y \<and> Q (smap state y)}) =
    (y \<in> {y. smap state y \<in> X \<and> P (smap state y)})


proof (prove)
using this:
  Finca_get F2 f = Some fd2
  pc < length (body fd2)
  body fd2 ! pc = Inca.instr.IPush d
  Frame f pc \<Sigma> # st' = st
  Fstd_get F1 f = Some fd1
  rel_fundef (\<lambda>x y. x = norm_instr y) fd1 fd2

goal (1 subgoal):
 1. Sstd.step (State F1 H st)
     (State F1 H (Frame f (Suc pc) (d # \<Sigma>) # st'))


proof (prove)
goal (1 subgoal):
 1. \<eta> a \<cdot>' \<eta> l = \<eta> b


proof (state)
this:
  solve_exec_code cs = Inl I

goal (2 subgoals):
 1. solve_exec_code cs = Inl I \<Longrightarrow>
    set I \<subseteq> fst ` set cs \<and>
    (\<nexists>v.
        (set I, v) \<Turnstile>\<^sub>i\<^sub>c\<^sub>s set cs) \<and>
    (distinct_indices cs \<longrightarrow>
     (\<forall>J\<subset>set I.
         \<exists>v. (J, v) \<Turnstile>\<^sub>i\<^sub>c\<^sub>s set cs))
 2. solve_exec_code cs = Inr v \<Longrightarrow>
    \<langle>v\<rangle> \<Turnstile>\<^sub>c\<^sub>s (snd ` set cs)


proof (prove)
goal (1 subgoal):
 1. l_append_child_wf\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
     Shadow_DOM.get_owner_document Shadow_DOM.get_parent
     Shadow_DOM.get_parent_locs Shadow_DOM.remove_child
     Shadow_DOM.remove_child_locs get_disconnected_nodes
     get_disconnected_nodes_locs set_disconnected_nodes
     set_disconnected_nodes_locs Shadow_DOM.adopt_node
     Shadow_DOM.adopt_node_locs ShadowRootClass.known_ptr
     ShadowRootClass.type_wf Shadow_DOM.get_child_nodes
     Shadow_DOM.get_child_nodes_locs ShadowRootClass.known_ptrs
     Shadow_DOM.set_child_nodes Shadow_DOM.set_child_nodes_locs
     Shadow_DOM.remove get_ancestors_si Shadow_DOM.insert_before
     Shadow_DOM.insert_before_locs Shadow_DOM.append_child
     Shadow_DOM.heap_is_wellformed


proof (prove)
goal (1 subgoal):
 1. x = rat_of_int a / rat_of_int b &&& y = rat_of_int c / rat_of_int d


proof (chain)
picking this:
  finite_ReZ_segments (subpath 0 s g) z


proof (prove)
using this:
  bi \<noteq> 0
  bj \<noteq> 0

goal (1 subgoal):
 1. (bi - 1 = bj - 1) = (bi = bj)


proof (prove)
goal (1 subgoal):
 1. top_pres (\<P> fb\<^sup>-\<^sub>\<R>)


proof (prove)
using this:
  positive (tensor_mat (A + - m1) m2)
  tensor_mat (- m1) m2 = - tensor_mat m1 m2
  tensor_mat (A + - m1) m2 = tensor_mat A m2 + tensor_mat (- m1) m2

goal (1 subgoal):
 1. tensor_mat (A + - m1) m2 = tensor_mat A m2 - tensor_mat m1 m2


proof (prove)
using this:
  f = Empty
  length ss = arity f

goal (1 subgoal):
 1. real (cost f ss) + \<Phi> (exec f ss) - sum_list (map \<Phi> ss)
    \<le> U f ss


proof (prove)
using this:
  x \<in> {0..1} - S

goal (1 subgoal):
 1. ((\<lambda>x. - \<gamma> x) has_vector_derivative
     - vector_derivative \<gamma> (at x within cbox 0 1))
     (at x within cbox 0 1)


proof (prove)
goal (1 subgoal):
 1. \<forall>x.
       ((``) (R ; S) \<circ> \<eta>) x =
       (\<mu> \<circ> \<P> ((``) S \<circ> \<eta>) \<circ>
        ((``) R \<circ> \<eta>))
        x