proof (prove)
using this:
  F (\<lambda>A. if g integrable_on A then Some (integral A g) else None)
   p =
  Some i

goal (1 subgoal):
 1. (g has_integral i) (cbox a b)


proof (prove)
goal (1 subgoal):
 1. 0 < Im ((b - a) * cnj (b - z)) \<and>
    0 < Im ((c - b) * cnj (c - z)) \<and>
    0 < Im ((a - c) * cnj (a - z)) \<or>
    Im ((b - a) * cnj (b - z)) < 0 \<and>
    0 < Im ((b - c) * cnj (b - z)) \<and>
    0 < Im ((a - b) * cnj (a - z)) \<and> 0 < Im ((c - a) * cnj (c - z))


proof (prove)
goal (3 subgoals):
 1. \<And>ja.
       \<lbrakk>distinct_pds K n P; ideal (O\<^bsub>K P n\<^esub>) I;
        I \<noteq> {\<zero>\<^bsub>O\<^bsub>K P n\<^esub>\<^esub>};
        I \<noteq> carrier (O\<^bsub>K P n\<^esub>); j \<le> n; Ring K;
        aGroup K; j \<noteq> n; valuation K (\<nu>\<^bsub>K P j\<^esub>);
        Zl_mI K P I j \<in> I;
        (\<nu>\<^bsub>K P j\<^esub>) (Zl_mI K P I j) =
        LI K (\<nu>\<^bsub>K P j\<^esub>) I;
        ja \<le> n - Suc 0; (\<tau>\<^bsub>j n\<^esub>) ja \<le> n\<rbrakk>
       \<Longrightarrow> ant (m_zmax_pdsI K n P I)
                         \<le> (\<nu>\<^bsub>K P j\<^esub>)
                                (Zl_mI K P I
                                  ((\<tau>\<^bsub>j n\<^esub>) ja)) +
                               (\<nu>\<^bsub>K P j\<^esub>)
                                (mprod_exp K
                                  (K_gamma ((\<tau>\<^bsub>j n\<^esub>) ja))
                                  (Kb\<^bsub>K n P\<^esub>)
                                  n\<^bsub>K\<^esub>\<^bsup>m_zmax_pdsI K n
                       P I\<^esup>)
 2. \<lbrakk>distinct_pds K n P; ideal (O\<^bsub>K P n\<^esub>) I;
     I \<noteq> {\<zero>\<^bsub>O\<^bsub>K P n\<^esub>\<^esub>};
     I \<noteq> carrier (O\<^bsub>K P n\<^esub>); j \<le> n; Ring K;
     aGroup K; j \<noteq> n; valuation K (\<nu>\<^bsub>K P j\<^esub>);
     Zl_mI K P I j \<in> I;
     (\<nu>\<^bsub>K P j\<^esub>) (Zl_mI K P I j) =
     LI K (\<nu>\<^bsub>K P j\<^esub>) I;
     ant (m_zmax_pdsI K n P I)
     \<le> (\<nu>\<^bsub>K P j\<^esub>)
            (\<Sigma>\<^sub>e K (\<lambda>x.
                                    Zl_mI K P I
                                     ((\<tau>\<^bsub>j n\<^esub>)
 x) \<cdot>\<^sub>r
                                    mprod_exp K
                                     (K_gamma
 ((\<tau>\<^bsub>j n\<^esub>) x))
                                     (Kb\<^bsub>K n P\<^esub>)
                                     n\<^bsub>K\<^esub>\<^bsup>m_zmax_pdsI K
                          n P I\<^esup>) (n - Suc 0))\<rbrakk>
    \<Longrightarrow> LI K (\<nu>\<^bsub>K P j\<^esub>) I
                      < (\<nu>\<^bsub>K P j\<^esub>)
                         (\<Sigma>\<^sub>e K (\<lambda>x.
           Zl_mI K P I ((\<tau>\<^bsub>j n\<^esub>) x) \<cdot>\<^sub>r
           mprod_exp K (K_gamma ((\<tau>\<^bsub>j n\<^esub>) x))
            (Kb\<^bsub>K n P\<^esub>)
            n\<^bsub>K\<^esub>\<^bsup>m_zmax_pdsI K n P
 I\<^esup>) (n - Suc 0))
 3. \<lbrakk>distinct_pds K n P; ideal (O\<^bsub>K P n\<^esub>) I;
     I \<noteq> {\<zero>\<^bsub>O\<^bsub>K P n\<^esub>\<^esub>};
     I \<noteq> carrier (O\<^bsub>K P n\<^esub>); j \<le> n; Ring K;
     aGroup K; j \<noteq> n;
     valuation K (\<nu>\<^bsub>K P j\<^esub>)\<rbrakk>
    \<Longrightarrow> (\<nu>\<^bsub>K P j\<^esub>)
                       (Zl_mI K P I j \<cdot>\<^sub>r
                        mprod_exp K (K_gamma j) (Kb\<^bsub>K n P\<^esub>)
                         n\<^bsub>K\<^esub>\<^bsup>m_zmax_pdsI K n P
              I\<^esup>) =
                      LI K (\<nu>\<^bsub>K P j\<^esub>) I


proof (prove)
using this:
  mset_factors ?F ?p \<Longrightarrow>
  mset_factors (image_mset poly_lift ?F) (poly_lift ?p)
  mset_factors G q

goal (1 subgoal):
 1. mset_factors (image_mset poly_lift G) (poly_lift q)


proof (prove)
goal (1 subgoal):
 1. (if sWlsVal SEM val
     then if sWlsVal SEM (val (y := Y val)_ys)
          then sOp SEM delta
                (lift (\<lambda>X. X (val (y := Y val)_ys)) inp)
                (lift (\<lambda>A. A (val (y := Y val)_ys)) binp)
          else undefined
     else undefined) =
    (if sWlsVal SEM val
     then sOp SEM delta
           (lift (\<lambda>X. X val) (igSubstInp (asIMOD SEM) ys Y y inp))
           (lift (\<lambda>A. A val) (igSubstBinp (asIMOD SEM) ys Y y binp))
     else undefined)


proof (prove)
using this:
  poss \<noteq> []
  list_all safe_formula (map remove_neg negs)
  \<Union> (fv ` set negs) \<subseteq> \<Union> (fv ` set poss)
  (poss, negs) = partition safe_formula l

goal (1 subgoal):
 1. safe_formula (formula.Ands l)


proof (prove)
using this:
  [m] \<langle>g\<rangle> [l] \<odot> [l] \<langle>f\<rangle> [l] \<preceq>
  [m] \<langle>g\<rangle> [l] \<and>
  ms \<langle>g\<rangle> [l] \<odot> [l] \<langle>f\<rangle> [l] \<preceq>
  ms \<langle>g\<rangle> [l]
  \<lbrakk>distinct ms;
   ms \<langle>g\<rangle> [l] \<odot> [l] \<langle>f\<rangle> [l] \<preceq>
   ms \<langle>g\<rangle> [l]\<rbrakk>
  \<Longrightarrow> ms \<langle>g\<rangle> [l] \<odot>
                    [l] \<langle>star \<circ> f\<rangle> [l] \<preceq>
                    ms \<langle>g\<rangle> [l]
  distinct (m # ms)

goal (1 subgoal):
 1. ms \<langle>g\<rangle> [l] \<odot>
    [l] \<langle>star \<circ> f\<rangle> [l] \<preceq>
    ms \<langle>g\<rangle> [l]


proof (prove)
goal (1 subgoal):
 1. A $ a $ b = (P ** A ** Q) $ a $ b


proof (prove)
goal (1 subgoal):
 1. newpkt p \<Longrightarrow>
    newpkt (p\<lparr>p_iiface := iface_sel iface\<rparr>)


proof (prove)
goal (1 subgoal):
 1. (rec_option Map.empty (\<lambda>x f. f x),
     rec_option Map.empty (\<lambda>x f. f x))
    \<in> \<langle>S\<rangle>option_rel \<rightarrow>
          (S \<rightarrow> \<langle>R\<rangle>option_rel) \<rightarrow>
          \<langle>R\<rangle>option_rel


proof (prove)
goal (2 subgoals):
 1. length (fst z) = 2
 2. x \<noteq> y


proof (prove)
goal (1 subgoal):
 1. Y \<noteq> {} \<Longrightarrow>
    \<Sqinter> (c ` X) ; \<Sqinter> (d ` Y) =
    (\<Sqinter>x::'c\<in>X. \<Sqinter>y::'b\<in>Y. c x ; d y)
variables:
  d :: 'b \<Rightarrow> 'a
  X :: 'c set
  c :: 'c \<Rightarrow> 'a
  (;) :: 'a \<Rightarrow> 'a \<Rightarrow> 'a
  Y :: 'b set
type variables:
  'b, 'c :: type
  'a :: refinement_lattice


proof (prove)
goal (1 subgoal):
 1. App s u \<rightarrow>\<^sub>\<beta>\<^sup>* App t v


proof (prove)
using this:
  B i \<subseteq> (T ^^ (n - i - 1)) --` (T ^^ (i + 1)) --` A
  (T ^^ (n - i - 1)) --` (T ^^ (i + 1)) --` A =
  (T ^^ (n - i - 1 + (i + 1))) --` A
  i < n

goal (1 subgoal):
 1. B i \<subseteq> (T ^^ n) --` A


proof (prove)
goal (9 subgoals):
 1. Tree2.inorder PST_RBT.empty = []
 2. \<And>t a.
       rbt t \<and> sorted1 (Tree2.inorder t) \<Longrightarrow>
       lookup t a = AList_Upd_Del.map_of (Tree2.inorder t) a
 3. \<And>t a b.
       rbt t \<and> sorted1 (Tree2.inorder t) \<Longrightarrow>
       Tree2.inorder (update a b t) = upd_list a b (Tree2.inorder t)
 4. \<And>t a.
       rbt t \<and> sorted1 (Tree2.inorder t) \<Longrightarrow>
       Tree2.inorder (delete a t) =
       AList_Upd_Del.del_list a (Tree2.inorder t)
 5. rbt PST_RBT.empty
 6. \<And>t a b.
       rbt t \<and> sorted1 (Tree2.inorder t) \<Longrightarrow>
       rbt (update a b t)
 7. \<And>t a.
       rbt t \<and> sorted1 (Tree2.inorder t) \<Longrightarrow>
       rbt (delete a t)
 8. \<And>t.
       \<lbrakk>rbt t; sorted1 (Tree2.inorder t)\<rbrakk>
       \<Longrightarrow> rbt_is_empty t = (Tree2.inorder t = [])
 9. \<And>t a b.
       \<lbrakk>rbt t; sorted1 (Tree2.inorder t);
        Tree2.inorder t \<noteq> []; pst_getmin t = (a, b)\<rbrakk>
       \<Longrightarrow> is_min2 (a, b) (set (Tree2.inorder t))


proof (prove)
using this:
  \<lbrakk>isOK (mapM (concurrent ?w ?l ?u) ?t);
   ?x \<in> set (concat (projr (mapM (concurrent ?w ?l ?u) ?t)))\<rbrakk>
  \<Longrightarrow> ?x \<in> (InString \<circ> I) ` set ?t
  \<lbrakk>?x \<in> (InString \<circ> I) ` set (substr ?w ?l ?u);
   isOK (idx ?w ?x)\<rbrakk>
  \<Longrightarrow> ?l < projr (idx ?w ?x) \<and> projr (idx ?w ?x) < ?u
  mapM (concurrent w l u) (substr w l u) = Inr d

goal (1 subgoal):
 1. \<And>x y.
       \<lbrakk>x \<in> set (concat d); idx w x = Inr y\<rbrakk>
       \<Longrightarrow> l < y \<and> y < u


proof (prove)
using this:
  Px \<in> borel_measurable S
  Py \<in> borel_measurable T

goal (1 subgoal):
 1. density S Px \<Otimes>\<^sub>M density T Py =
    density (S \<Otimes>\<^sub>M T) (\<lambda>(x, y). Px x * Py y)


proof (prove)
goal (1 subgoal):
 1. (\<And>a'.
        \<lbrakk>rtrancl3p r a bs a'; rtrancl3p r a' bs' a''\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. well_complete B (\<sqsubseteq>)


proof (prove)
goal (1 subgoal):
 1. G \<subseteq> dgrad_sig_set' (length fs) d


proof (prove)
using this:
  \<not> n < dfg
  df \<equiv> fls_subdegree f
  dg \<equiv> fls_subdegree g

goal (1 subgoal):
 1. (f * g) $$ n =
    (\<Sum>i = 0..nat (n - dfg).
        f $$ (df + int i) * g $$ (dg + int (nat (n - dfg) - i)))


proof (prove)
goal (1 subgoal):
 1. wf {(x, y). strictly_generalizes_atm x y}


proof (prove)
goal (1 subgoal):
 1. (toFull \<sigma> a = toFull \<sigma> b) = (a = b)


proof (prove)
goal (1 subgoal):
 1. \<turnstile>\<^sub>p {wlp S (wlp (While M S) P)} S {wlp (While M S) P}


proof (prove)
using this:
  ?y \<in># mset_set (\<V> - {x}) \<Longrightarrow> ?y \<noteq> x

goal (1 subgoal):
 1. \<And>y.
       y \<in># mset_set (\<V> - {x}) \<Longrightarrow>
       size
        (filter_mset ((\<subseteq>) {x, y})
          (filter_mset ((\<in>) x) \<B>)) =
       nat \<Lambda>


proof (prove)
goal (1 subgoal):
 1. |Field (cardSuc |UNIV|)| =o |{} <+> Field (cardSuc |UNIV|)|


proof (prove)
goal (1 subgoal):
 1. IArray
     (map (\<lambda>x. vec_to_iarray ((A + B) $ mod_type_class.from_nat x))
       [0..<CARD('c)]) =
    IArray
     (map (\<lambda>x. vec_to_iarray (A $ mod_type_class.from_nat x))
       [0..<CARD('c)]) +
    IArray
     (map (\<lambda>x. vec_to_iarray (B $ mod_type_class.from_nat x))
       [0..<CARD('c)])


proof (state)
goal (1 subgoal):
 1. \<And>H.
       \<lbrakk>hermitean H \<and> H \<noteq> mat_zero;
        circline_type_cmat H < 0; is_diag_circline_cmat H\<rbrakk>
       \<Longrightarrow> \<exists>A\<in>{v. v \<noteq> vec_zero}.
                            \<exists>B\<in>{v. v \<noteq> vec_zero}.
                               \<exists>C\<in>{v. v \<noteq> vec_zero}.
                                  \<not> A \<approx>\<^sub>v B \<and>
                                  \<not> A \<approx>\<^sub>v C \<and>
                                  \<not> B \<approx>\<^sub>v C \<and>
                                  on_circline_cmat_cvec H A \<and>
                                  on_circline_cmat_cvec H B \<and>
                                  on_circline_cmat_cvec H C


proof (prove)
using this:
  length xvec = length Tvec
  distinct xvec
  xvec \<sharp>* Tvec

goal (1 subgoal):
 1. xvec \<sharp>* subs P xvec Tvec &&&
    xvec \<sharp>* subs' I xvec Tvec &&& xvec \<sharp>* subs'' C xvec Tvec


proof (state)
this:
  \<not> zcount (c_work c loc1) t' < 0

goal (1 subgoal):
 1. \<lbrakk>zcount (c_work c loc1) t' < 0 \<or>
             t' \<in>#\<^sub>z zmset_of
                                (mset_set
                                  (set_antichain
                                    (frontier (c_pts c loc1)))) +
                               (\<Sum>loc'\<in>UNIV.
                                  after_summary
                                   (zmset_of
                                     (mset_set
 (set_antichain (frontier (c_imp c loc')))))
                                   (summary loc' loc1));
     \<not> zcount (c_work c loc1) t' < 0\<rbrakk>
    \<Longrightarrow> \<exists>t' loc1 xs.
                         path loc1 loc2 xs \<and>
                         t =
                         results_in t'
                          (sum_weights
                            (map (\<lambda>(s, l, t). l) xs)) \<and>
                         (t' \<in>\<^sub>A frontier (c_pts c loc1) \<or>
                          zcount (c_work c loc1) t' < 0)


proof (prove)
goal (1 subgoal):
 1. card
     (inversions xs \<union>
      map_prod ((+) m) ((+) m) ` inversions ys \<union>
      map_prod id ((+) m) ` inversions_between xs ys) =
    card (inversions xs \<union> map_prod ((+) m) ((+) m) ` inversions ys) +
    card (map_prod id ((+) m) ` inversions_between xs ys)


proof (prove)
goal (3 subgoals):
 1. \<And>xa x.
       \<lbrakk>extr (bad xa) (ik xa) (chan xa)
                \<subseteq> synth (analz (generators xa));
        chan xa \<subseteq> faked_chan_msgs xa \<union> chan_generators;
        x \<in> extr (bad xa) (ik xa) (chan xa)\<rbrakk>
       \<Longrightarrow> x \<in> synth
                                  (analz
                                    (generators
(xa\<lparr>ik := insert M (ik xa)\<rparr>)))
 2. \<And>xa xb.
       \<lbrakk>M \<in> dy_fake_msg (bad xa) (ik xa) (chan xa);
        extr (bad xa) (ik xa) (chan xa)
        \<subseteq> synth (analz (generators xa));
        chan xa \<subseteq> faked_chan_msgs xa \<union> chan_generators;
        xb \<in> extr (bad xa) (ik xa) (chan xa)\<rbrakk>
       \<Longrightarrow> xb \<in> synth
                                   (analz
                                     (generators
 (xa\<lparr>ik := insert M (ik xa)\<rparr>)))
 3. \<And>xa xb.
       \<lbrakk>M \<in> dy_fake_msg (bad xa) (ik xa) (chan xa);
        extr (bad xa) (ik xa) (chan xa)
        \<subseteq> synth (analz (generators xa));
        chan xa \<subseteq> faked_chan_msgs xa \<union> chan_generators;
        xb \<in> chan xa; xb \<notin> chan_generators\<rbrakk>
       \<Longrightarrow> xb \<in> faked_chan_msgs
                                   (xa\<lparr>ik :=
          insert M (ik xa)\<rparr>)


proof (prove)
goal (1 subgoal):
 1. sum (X <| Y) (X \<union> Y) = sum (chi X) (X \<union> Y)


proof (state)
this:
  to_fract y' / to_fract z' = to_fract r

goal (1 subgoal):
 1. z' \<noteq> (0::'a) \<Longrightarrow> x = to_fract x'


proof (prove)
using this:
  wf_fmla_atom tys a
  list_all2 (is_of_type tys) ?xs16 ?Ts16 \<Longrightarrow>
  list_all2 (is_of_type tys') ?xs16 ?Ts16

goal (1 subgoal):
 1. wf_fmla_atom tys' a


proof (prove)
using this:
  is_final (steps c p n2)

goal (1 subgoal):
 1. is_final (steps c p n1)


proof (prove)
goal (4 subgoals):
 1. \<And>f x. return_spmf f \<diamondop> return_spmf x = return_spmf (f x)
 2. \<And>g f x.
       return_spmf (\<lambda>g f x. g (f x)) \<diamondop> g \<diamondop>
       f \<diamondop>
       x =
       g \<diamondop> (f \<diamondop> x)
 3. \<And>f x y.
       return_spmf (\<lambda>f x y. f y x) \<diamondop> f \<diamondop>
       x \<diamondop>
       y =
       f \<diamondop> y \<diamondop> x
 4. \<And>x. return_spmf (\<lambda>x. x) \<diamondop> x = x


proof (prove)
using this:
  pmf (bv (Suc n)) xs = pmf (bv n) as * pmf (bernoulli_pmf (5 / 10)) a
  pmf (bv n) as = (1 / 2) ^ n

goal (1 subgoal):
 1. pmf (bv (Suc n)) xs = (1 / 2) ^ n * 1 / 2


proof (prove)
goal (2 subgoals):
 1. \<not> l < u \<Longrightarrow>
    (if c (l, s0) then f (l, s0) \<bind> WHILE\<^sub>T c f
     else RETURN (l, s0))
    \<le> SPEC
           (\<lambda>(uu_, r).
               r = F {list ! i |i. l \<le> i \<and> i < u} s0)
 2. \<not> \<not> l < u \<Longrightarrow>
    WHILE\<^sub>T c f (l, s0)
    \<le> SPEC
           (\<lambda>(uu_, r).
               r = F {list ! i |i. l \<le> i \<and> i < u} s0)


proof (prove)
goal (1 subgoal):
 1. (\<forall>f.
        continuous_on U f \<and> f ` U \<subseteq> S \<longrightarrow>
        (\<exists>c.
            homotopic_with_canon (\<lambda>x. True) U S f
             (\<lambda>x. c))) =
    (\<forall>f.
        continuous_on U f \<and> f ` U \<subseteq> T \<longrightarrow>
        (\<exists>c.
            homotopic_with_canon (\<lambda>x. True) U T f (\<lambda>x. c)))


proof (prove)
using this:
  f integrable_on s
  g integrable_on s
  ?x \<in> s \<Longrightarrow> f ?x \<le> g ?x

goal (1 subgoal):
 1. integral s f \<le> integral s g


proof (prove)
goal (1 subgoal):
 1. local.hanoi (Suc n) =
    repeat (2 ^ n - 1 + 1 + (2 ^ n - 1)) (tick (return ()))


proof (prove)
goal (1 subgoal):
 1. sep < p


proof (prove)
goal (1 subgoal):
 1. \<not> (learn_lim \<phi> U s \<and>
            (\<forall>f\<in>U.
                \<forall>n k.
                   k \<le> n \<longrightarrow>
                   \<phi> (the (s (f \<triangleright> n))) k = f k))


proof (prove)
using this:
  C.ide a
  \<T>o ?e ?b =
  S.mkArr (Hom.set (?b, a)) (Ya'.SET ?b)
   (\<lambda>x. Ya'.FUN (\<psi> (?b, a) x) ?e)
  Cop.ide ?b \<Longrightarrow> S.arr (\<T> e ?b)
  Cop.ide ?b \<Longrightarrow>
  \<T> e ?b =
  S.mkArr (Hom.set (?b, a)) (Ya'.SET ?b)
   (\<lambda>x. Ya'.FUN (\<psi> (?b, a) x) e)

goal (1 subgoal):
 1. \<T> e a =
    S.mkArr (Hom.set (a, a)) (Ya'.SET a)
     (\<lambda>x. Ya'.FUN (\<psi> (a, a) x) e)


proof (prove)
using this:
  r = \<langle>\<rangle>
  invar \<langle>l, (xy, n), r\<rangle>

goal (1 subgoal):
 1. l = \<langle>\<rangle>


proof (prove)
goal (1 subgoal):
 1. eventually ((\<le>) M) sequentially


proof (prove)
using this:
  set (concat
        (map (possible_assignments_for \<Psi>)
          (filter (\<lambda>v. s v \<noteq> None)
            (\<Psi>\<^sub>\<V>\<^sub>+)))) =
  (\<Union>v\<in>{v |v.
                  v \<in> set (\<Psi>\<^sub>\<V>\<^sub>+) \<and>
                  s v \<noteq> None}.
      set (possible_assignments_for \<Psi> v))

goal (1 subgoal):
 1. set (concat
          (map (possible_assignments_for \<Psi>)
            (filter (\<lambda>v. s v \<noteq> None)
              (\<Psi>\<^sub>\<V>\<^sub>+)))) =
    (\<Union>v\<in>{v |v.
                    v \<in> set (\<Psi>\<^sub>\<V>\<^sub>+) \<and>
                    s v \<noteq> None}.
        {(v, a) |a. a \<in> \<R>\<^sub>+ \<Psi> v})


proof (prove)
using this:
  simulation as\<^sub>0 alstep bs\<^sub>0 blstep R\<^sub>1
  simulation bs\<^sub>0 blstep cs\<^sub>0 clstep R\<^sub>2

goal (1 subgoal):
 1. simulation as\<^sub>0 alstep cs\<^sub>0 clstep (R\<^sub>1 OO R\<^sub>2)


proof (prove)
using this:
  f = prod_list us
  u \<in> set us

goal (1 subgoal):
 1. u dvd f


proof (prove)
using this:
  \<tt>\<tt> (\<tt>\<tt> p \<cdot> !r) = !r \<cdot> \<tt>\<tt> p \<cdot> !r
  H (\<tt>\<tt> p \<cdot> \<tt>\<tt> r) x p
  H ?p ?x ?q =
  \<lparr>\<tt>\<tt> ?p\<rparr>?x\<lparr>?x \<cdot> \<tt>\<tt> ?q\<rparr>
  H (\<tt>\<tt> ?p \<cdot> \<tt>\<tt> ?r) ?x ?q \<Longrightarrow>
  H ?p (\<tt>\<tt> ?r \<cdot> ?x) ?q
  \<lparr>?y\<rparr>?x\<lparr>?x \<cdot> ?y\<rparr> \<Longrightarrow>
  \<lparr>?y\<rparr>?x\<^sup>\<star>\<lparr>?x\<^sup>\<star> \<cdot>
      ?y\<rparr>
  \<lbrakk>\<lparr>?z\<rparr>?w\<lparr>?w \<cdot> ?z \<cdot> ?w\<rparr>;
   \<lparr>?x\<rparr>?y\<lparr>?y \<cdot> ?z\<rparr>\<rbrakk>
  \<Longrightarrow> \<lparr>?x\<rparr>?y \<cdot>
?w\<lparr>?y \<cdot> ?w \<cdot> (?z \<cdot> ?w)\<rparr>
  while ?b do ?x = (\<tt>\<tt> ?b \<cdot> ?x)\<^sup>\<star> \<cdot> !?b

goal (1 subgoal):
 1. H p (while r do x) (\<tt>\<tt> p \<cdot> !r)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>x\<in>set M.
                case x of
                (m_impl, m_spec) \<Rightarrow>
                  SecurityInvariant_complies_formal_def m_impl m_spec;
     wf_list_graph G; valid_reqs (get_spec M);
     TopoS_Composition_Theory.all_security_requirements_fulfilled
      (get_spec M) (list_graph_to_graph G);
     \<T> =
     \<lparr>hostsL = nodesL G, flows_fixL = edgesL G,
        flows_stateL =
          inefficient_list_intersect
           (TopoS_Stateful_Policy_impl.filter_IFS_no_violations G
             (get_impl M))
           (TopoS_Stateful_Policy_impl.filter_compliant_stateful_ACS G
             (get_impl M))\<rparr>\<rbrakk>
    \<Longrightarrow> set (nodesL G) = nodes (list_graph_to_graph G) \<and>
                      set (edgesL G) = edges (list_graph_to_graph G) \<and>
                      set (inefficient_list_intersect
                            (TopoS_Stateful_Policy_impl.filter_IFS_no_violations
                              G (get_impl M))
                            (TopoS_Stateful_Policy_impl.filter_compliant_stateful_ACS
                              G (get_impl M))) =
                      set (TopoS_Stateful_Policy_Algorithm.filter_IFS_no_violations
                            (list_graph_to_graph G) (get_spec M)
                            (edgesL G)) \<inter>
                      set (TopoS_Stateful_Policy_Algorithm.filter_compliant_stateful_ACS
                            (list_graph_to_graph G) (get_spec M) (edgesL G))


proof (prove)
using this:
  xs ! j = x'
  j < length xs - 1
  j < length xs
  ys ! k = y'
  k < length ys - 1
  k < length ys
  \<lbrakk>j \<in> {0..<length xs}; k \<in> {0..<length ys}\<rbrakk>
  \<Longrightarrow> xs ! j = ys ! k \<longrightarrow>
                    j = length xs - 1 \<or> k = length ys - 1

goal (1 subgoal):
 1. False


proof (prove)
using this:
  split ts x = (ls, rrs)
  a = (sub, sep)
  rrs = a # rs
  abs_split.ins k x sub = abs_split.Up\<^sub>i l w r
  x \<noteq> sep

goal (2 subgoals):
 1. \<lbrakk>abs_split.ins k x sub = abs_split.Up\<^sub>i l w r;
     sep \<noteq> x; tia__ = Some p; split (ls @ a # rs) x = (ls, a # rs);
     rrs = a # rs; ts = ls @ a # rs;
     (ab_, bb_) \<Turnstile>
     is_pfa (2 * k) (zs1 @ (suba, sepi) # zs2) (tsil, tsin) *
     blist_assn k ls zs1 *
     (btree_assn k \<times>\<^sub>a id_assn) a (suba, sepi) *
     blist_assn k rs zs2 *
     p \<mapsto>\<^sub>r Btnode (tsil, tsin) ti *
     btree_assn k t ti *
     true;
     n = Suc (length zs1 + length zs2);
     length ls < Suc (length zs1 + length zs2);
     (zs1 @ (suba, sepi) # zs2) ! length ls = (suba, sepa);
     z = (suba, sepa); sepa \<noteq> x; subi = suba\<rbrakk>
    \<Longrightarrow> <is_pfa (2 * k) (zs1 @ (suba, sepi) # zs2)
                        (tsil, tsin) *
                       blist_assn k ls zs1 *
                       (btree_assn k \<times>\<^sub>a id_assn) a
                        (suba, sepi) *
                       blist_assn k rs zs2 *
                       p \<mapsto>\<^sub>r Btnode (tsil, tsin) ti *
                       btree_assn k t ti *
                       true> ins k x suba \<bind>
                             case_btupi
                              (\<lambda>lp.
                                  pfa_set (tsil, tsin) (length ls)
                                   (lp, sepa) \<bind>
                                  (\<lambda>_. return (T\<^sub>i (Some p))))
                              (\<lambda>lp x' rp.
                                  pfa_set (tsil, tsin) (length ls)
                                   (rp, sepa) \<bind>
                                  (\<lambda>_.
if Suc (length zs1 + length zs2) < 2 * k
then pfa_insert (tsil, tsin) (length ls) (lp, x') \<bind>
     (\<lambda>kvs'.
         p := Btnode kvs' ti \<bind>
         (\<lambda>_. return (T\<^sub>i (Some p))))
else pfa_insert_grow (tsil, tsin) (length ls) (lp, x') \<bind>
     (\<lambda>kvs'.
         node\<^sub>i k kvs'
          ti))) <btupi_assn k
                  (abs_split.node\<^sub>i k (ls @ (l, w) # (r, sep) # rs)
                    t)>\<^sub>t
 2. \<lbrakk>abs_split.ins k x sub = abs_split.Up\<^sub>i l w r;
     sep \<noteq> x; tia__ = Some p; split (ls @ a # rs) x = (ls, a # rs);
     rrs = a # rs; ts = ls @ a # rs;
     (ab_, bb_) \<Turnstile>
     is_pfa (2 * k) (zs1 @ (subi, sepi) # zs2) (tsil, tsin) *
     blist_assn k ls zs1 *
     (btree_assn k \<times>\<^sub>a id_assn) a (subi, sepi) *
     blist_assn k rs zs2 *
     p \<mapsto>\<^sub>r Btnode (tsil, tsin) ti *
     btree_assn k t ti *
     true;
     n = length (zs1 @ (subi, sepi) # zs2);
     length ls < length (zs1 @ (subi, sepi) # zs2);
     (zs1 @ (subi, sepi) # zs2) ! length ls = (suba, sepa);
     z = (suba, sepa); sepa \<noteq> x\<rbrakk>
    \<Longrightarrow> subi = suba


proof (prove)
goal (1 subgoal):
 1. {fin_cut_same (any, replicate (length I) False) xa @
     replicate m (any, replicate (length I) False) |
     xa m. xa \<in> map \<pi> ` enc (w, x # I)} =
    enc (w, I)


proof (prove)
using this:
  \<forall>x.
     (\<forall>y.
         (y, x) \<in> Tree_wf \<longrightarrow> P y) \<longrightarrow>
     P x

goal (1 subgoal):
 1. P (tPred x1a_ x2a_)


proof (prove)
goal (1 subgoal):
 1. {k. k \<le> n \<and>
        \<not> (\<forall>i xs.
                   i \<le> n \<and>
                   set xs \<subseteq> {0..k} \<longrightarrow>
                   (0::'a) \<le> len m i i xs)} \<noteq>
    {}


proof (prove)
goal (1 subgoal):
 1. wf_graph
     \<lparr>nodes = hosts \<T>,
        edges =
          flows_fix \<T> \<union> flows_state \<T> \<union>
          backflows (flows_state \<T>)\<rparr> \<Longrightarrow>
    wf_graph
     \<lparr>nodes = hosts \<T>,
        edges =
          flows_fix \<T> \<union>
          (flows_state \<T> - backflows (flows_fix \<T>)) \<union>
          (backflows (flows_state \<T>) - flows_fix \<T>)\<rparr>


proof (prove)
goal (1 subgoal):
 1. block_design \<V>\<^sup>+ \<B>\<^sup>+ \<k>


proof (prove)
goal (1 subgoal):
 1. \<And>f x.
       measure_pmf.expectation (K' (Some x)) f =
       measure_pmf.expectation (K x) (\<lambda>x. f (Some x))


proof (prove)
goal (1 subgoal):
 1. nc\<^sup>\<omega> = U


proof (prove)
goal (1 subgoal):
 1. A = UNIV \<Longrightarrow> bij_lens typedef\<^sub>L


proof (state)
this:
  r x a
  rtrancl_path r a (as @ y # ys) z

goal (1 subgoal):
 1. \<And>a xs x.
       \<lbrakk>\<And>x.
                   \<lbrakk>\<lbrakk>rtrancl_path r x (xs @ [y]) y;
                             rtrancl_path r y ys z\<rbrakk>
                            \<Longrightarrow> thesis;
                    rtrancl_path r x (xs @ y # ys) z\<rbrakk>
                   \<Longrightarrow> thesis;
        \<lbrakk>rtrancl_path r x ((a # xs) @ [y]) y;
         rtrancl_path r y ys z\<rbrakk>
        \<Longrightarrow> thesis;
        rtrancl_path r x ((a # xs) @ y # ys) z\<rbrakk>
       \<Longrightarrow> thesis


proof (prove)
goal (1 subgoal):
 1. top_pres ((`) map_IInf)


proof (prove)
goal (1 subgoal):
 1. \<Union> (range T) = (\<Union>n. T (f n))


proof (state)
this:
  target (w || r2) p2 = last r2

goal (1 subgoal):
 1. \<And>nat.
       \<lbrakk>length w = 0 \<Longrightarrow>
                target (w || r1 || r2) (p1, p2) = (p1, p2);
        0 < length w \<Longrightarrow>
        target (w || r1 || r2) (p1, p2) = last (r1 || r2);
        length w = Suc nat\<rbrakk>
       \<Longrightarrow> target (w || r1) p1 =
                         fst (target (w || r1 || r2) (p1, p2)) \<and>
                         target (w || r2) p2 =
                         snd (target (w || r1 || r2) (p1, p2))


proof (prove)
using this:
  j < n
  j = i + Suc k

goal (1 subgoal):
 1. (replicate i ze @ on # replicate (n - 1 - i) ze) ! j =
    (if i = j then on else ze)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>q @ p \<noteq> []; x \<notin> dom (C a)\<rbrakk>
    \<Longrightarrow> C (list2FWpolicy (q @ p @ [a])) x =
                      C (list2FWpolicy (q @ p)) x


proof (prove)
goal (1 subgoal):
 1. abs_Gromov_completion u \<in> Gromov_boundary


proof (prove)
using this:
  distinct l0
  x \<notin> set l0
  x \<in> S0
  set l0 \<subseteq> S0
  distinct (map \<alpha> l0)
  sorted_wrt Ra (map \<alpha> l0)
  ?x' \<in> set l0 \<Longrightarrow> Rc x ?x'

goal (1 subgoal):
 1. distinct (map \<alpha> (x # l0)) \<and>
    sorted_wrt Ra (map \<alpha> (x # l0))


proof (prove)
goal (1 subgoal):
 1. \<And>w a wa aa wb ab.
       \<lbrakk>f\<cdot>a = Writer\<cdot>wa\<cdot>aa;
        g\<cdot>aa = Writer\<cdot>wb\<cdot>ab\<rbrakk>
       \<Longrightarrow> bindU\<cdot>
                         (bindU\<cdot>(Writer\<cdot>w\<cdot>a)\<cdot>
                          f)\<cdot>
                         g =
                         bindU\<cdot>(Writer\<cdot>w\<cdot>a)\<cdot>
                         (\<Lambda> x. bindU\<cdot>(f\<cdot>x)\<cdot>g)


proof (prove)
goal (1 subgoal):
 1. homeomorphism (UNIV - {bot_sphere}) UNIV st_proj2 st_proj2_inv


proof (prove)
using this:
  A Out P B \<and> Cong A B X Y
  Cong ?A ?B ?C ?D \<Longrightarrow>
  Cong ?A ?B ?C ?D \<and>
  Cong ?A ?B ?D ?C \<and>
  Cong ?B ?A ?C ?D \<and>
  Cong ?B ?A ?D ?C \<and>
  Cong ?C ?D ?A ?B \<and>
  Cong ?C ?D ?B ?A \<and> Cong ?D ?C ?A ?B \<and> Cong ?D ?C ?B ?A
  ?A Out ?B ?C \<or> ?A Out ?C ?B \<Longrightarrow> ?A Out ?B ?C
  \<forall>X0 Y0. Cong X Y X0 Y0 = l X0 Y0

goal (1 subgoal):
 1. \<exists>B. l A B \<and> A Out B P


proof (prove)
using this:
  0 < degree_m f \<and>
  (\<forall>g h.
      degree_m g < degree_m f \<longrightarrow>
      degree_m h < degree_m f \<longrightarrow> Mp f \<noteq> Mp (g * h))
  f =m g

goal (1 subgoal):
 1. 0 < degree_m g \<and>
    (\<forall>ga h.
        degree_m ga < degree_m g \<longrightarrow>
        degree_m h < degree_m g \<longrightarrow> Mp g \<noteq> Mp (ga * h))


proof (prove)
goal (1 subgoal):
 1. OFCLASS('a admS, order_class)


proof (prove)
using this:
  A B Perp C D
  \<not> ?A ?B Perp ?A ?B
  \<lbrakk>?A ?B Perp ?X ?Y; ?C \<noteq> ?D; Col ?A ?B ?C;
   Col ?A ?B ?D\<rbrakk>
  \<Longrightarrow> ?C ?D Perp ?X ?Y
  ?A ?B Perp ?C ?D \<Longrightarrow> ?A \<noteq> ?B \<and> ?C \<noteq> ?D

goal (1 subgoal):
 1. \<not> Col A B C \<or> \<not> Col A B D


proof (state)
goal (1 subgoal):
 1. 2 < M \<Longrightarrow>
    <emp> icount_impl M <\<lambda>r. \<up> (r = lcount M)>\<^sub>t


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>RETURN
              (msort f_
                (take (length (v_ # vb_ # vc_) div 2) (v_ # vb_ # vc_))) =
             REC\<^sub>T
              (\<lambda>g xs.
                  case xs of [] \<Rightarrow> RETURN []
                  | [x] \<Rightarrow> RETURN [x]
                  | x # aa # lista \<Rightarrow>
                      g (take (length xs div 2) xs) \<bind>
                      (\<lambda>a.
                          g (drop (length xs div 2) xs) \<bind>
                          (\<lambda>b.
                              RETURN (PAC_Checker_Init.merge f_ a b))))
              (take (length (v_ # vb_ # vc_) div 2) (v_ # vb_ # vc_));
     RETURN
      (msort f_ (drop (length (v_ # vb_ # vc_) div 2) (v_ # vb_ # vc_))) =
     REC\<^sub>T
      (\<lambda>g xs.
          case xs of [] \<Rightarrow> RETURN []
          | [x] \<Rightarrow> RETURN [x]
          | x # aa # lista \<Rightarrow>
              g (take (length xs div 2) xs) \<bind>
              (\<lambda>a.
                  g (drop (length xs div 2) xs) \<bind>
                  (\<lambda>b. RETURN (PAC_Checker_Init.merge f_ a b))))
      (drop (length (v_ # vb_ # vc_) div 2) (v_ # vb_ # vc_))\<rbrakk>
    \<Longrightarrow> RETURN (msort f_ (v_ # vb_ # vc_)) =
                      REC\<^sub>T
                       (\<lambda>g xs.
                           case xs of [] \<Rightarrow> RETURN []
                           | [x] \<Rightarrow> RETURN [x]
                           | x # aa # lista \<Rightarrow>
                               g (take (length xs div 2) xs) \<bind>
                               (\<lambda>a.
                                   g (drop (length xs div 2) xs) \<bind>
                                   (\<lambda>b.
 RETURN (PAC_Checker_Init.merge f_ a b))))
                       (v_ # vb_ # vc_)


proof (prove)
goal (1 subgoal):
 1. (\<And>a.
        \<lbrakk>(c, a) \<in> R; \<Phi> a\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<^bold>g [^] y \<otimes> g' [^] ya \<otimes>
    ((\<^bold>g [^] fst w') [^] e \<otimes> (g' [^] snd w') [^] e) =
    \<^bold>g [^] y \<otimes> g' [^] ya \<otimes>
    (\<^bold>g [^] fst w' \<otimes> g' [^] snd w') [^] e


proof (prove)
goal (1 subgoal):
 1. \<forall>x y.
       x \<le> y \<longrightarrow> prod a {..x} \<le> prod a {..y}


proof (state)
this:
  satPB \<xi> Wax

goal (1 subgoal):
 1. eintP (Guard \<sigma>) [eintF (Wit \<sigma>) []]


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<approx> a'; b \<approx> b'\<rbrakk>
    \<Longrightarrow> appendS\<cdot>a\<cdot>b \<approx>
                      appendS\<cdot>a'\<cdot>b'


proof (prove)
goal (1 subgoal):
 1. plain_floatarith 0
     (Num (of_nat n) * Num (float_of xe) *
      Power (Abs (Num (float_of x0))) (n - 1) +
      Sum\<^sub>e
       (\<lambda>k.
           Num (of_nat (n choose k)) *
           Power (Abs (Num (float_of x0))) (n - k) *
           Power (Num (float_of xe) + Num (float_of t)) k)
       [2..<Suc n])


proof (prove)
using this:
  C.ide f
  C.ide g
  \<guillemotleft>\<eta> : src\<^sub>C
                            f \<Rightarrow>\<^sub>C g \<star>\<^sub>C
              f\<guillemotright>
  \<guillemotleft>\<epsilon> : f \<star>\<^sub>C
                               g \<Rightarrow>\<^sub>C src\<^sub>C
                  g\<guillemotright>
  adjunction_in_bicategory (\<cdot>\<^sub>D) (\<star>\<^sub>D) \<a>\<^sub>D
   \<i>\<^sub>D src\<^sub>D trg\<^sub>D (F f) (F g)
   (D.inv (\<Phi> (g, f)) \<cdot>\<^sub>D
    F \<eta> \<cdot>\<^sub>D unit (src\<^sub>C f))
   (D.inv (unit (trg\<^sub>C f)) \<cdot>\<^sub>D
    F \<epsilon> \<cdot>\<^sub>D \<Phi> (f, g))
  trg\<^sub>C g = src\<^sub>C f
  src\<^sub>C g = trg\<^sub>C f

goal (1 subgoal):
 1. C.par
     ((g \<star>\<^sub>C \<epsilon>) \<cdot>\<^sub>C
      \<a>\<^sub>C[g, f, g] \<cdot>\<^sub>C (\<eta> \<star>\<^sub>C g))
     (\<r>\<^sub>C\<^sup>-\<^sup>1[g] \<cdot>\<^sub>C \<l>\<^sub>C[g])


proof (prove)
using this:
  \<Gamma> \<turnstile> s \<leftrightarrow> t : T

goal (1 subgoal):
 1. s \<leadsto>| &&& t \<leadsto>|


proof (prove)
using this:
  - (- - x \<sqinter> - - y) = - x \<squnion> - y

goal (1 subgoal):
 1. - - x \<sqinter> - y \<squnion> - x \<sqinter> - z =
    (- x \<squnion> - y) \<sqinter> (- - x \<squnion> - z)


proof (prove)
using this:
  new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t
   h =
  (new_shadow_root_ptr, h')

goal (1 subgoal):
 1. object_ptr_kinds h' =
    object_ptr_kinds h |\<union>| {|cast (cast new_shadow_root_ptr)|}


proof (prove)
goal (1 subgoal):
 1. sum (card \<circ>
         (\<lambda>i.
             (\<lambda>l. replicate i R @ B # l) `
             {l. length l = n - i - 1 \<and> valid l}))
     {3..<n} =
    (\<Sum>i = 3..<n. lcount (n - i - 1))


proof (prove)
goal (1 subgoal):
 1. set (mk_rtrancl_list subsumes r init) = mk_rtrancl init


proof (prove)
goal (4 subgoals):
 1. while_algo (brw_algo (hs.\<alpha> Qi) (ls.\<alpha> \<delta>))
 2. wa_invar (det_wa_wa (brec_det_algo rqrm Qi \<delta>)) =
    ?addi \<inter>
    {s. brec_\<alpha> s
        \<in> wa_invar (brw_algo (hs.\<alpha> Qi) (ls.\<alpha> \<delta>))}
 3. \<And>s s'.
       \<lbrakk>s \<in> ?addi;
        s \<in> wa_cond (det_wa_wa (brec_det_algo rqrm Qi \<delta>));
        brec_\<alpha> s
        \<in> wa_invar (brw_algo (hs.\<alpha> Qi) (ls.\<alpha> \<delta>));
        (s, s')
        \<in> wa_step (det_wa_wa (brec_det_algo rqrm Qi \<delta>))\<rbrakk>
       \<Longrightarrow> s' \<in> ?addi
 4. wa_initial (det_wa_wa (brec_det_algo rqrm Qi \<delta>))
    \<subseteq> ?addi


proof (prove)
using this:
  a \<in>\<^sub>\<circ> \<D>\<^sub>\<circ> r
  a \<in>\<^sub>\<circ> A

goal (1 subgoal):
 1. vinsert (r\<lparr>a\<rparr>) (r `\<^sub>\<circ> A) = r `\<^sub>\<circ> A


proof (prove)
using this:
  0 < x
  (x * 2 - inverse x * 2) / (2 * x + 2 * inverse x) =
  (x\<^sup>2 - 1) / (x\<^sup>2 + 1)

goal (1 subgoal):
 1. tanh (ln x) = (x\<^sup>2 - 1) / (x\<^sup>2 + 1)


proof (prove)
goal (1 subgoal):
 1. (\<Sum>i\<in>B. (f x \<bullet> i) *\<^sub>R i) = f x


proof (prove)
using this:
  \<xi>' \<in> is_rreq \<xi>

goal (1 subgoal):
 1. \<exists>hops' rreqid' dip' dsn' dsk' oip' osn' sip'.
       msg \<xi> = Rreq hops' rreqid' dip' dsn' dsk' oip' osn' sip' \<and>
       \<xi>' = \<xi>
       \<lparr>hops := hops', rreqid := rreqid', dip := dip', dsn := dsn',
          dsk := dsk', oip := oip', osn := osn', sip := sip'\<rparr>


proof (prove)
using this:
  r'\<^sub>1 \<le> r1 \<and> (w1 \<equiv>\<^sub>E r'\<^sub>1)
  r'\<^sub>2 \<le> r2 \<and> (w2 \<equiv>\<^sub>E r'\<^sub>2)
  \<lbrakk>?a \<le> ?b; ?c \<le> ?d\<rbrakk>
  \<Longrightarrow> ?a + ?c \<le> ?b + ?d
  r'\<^sub>1 + r'\<^sub>2 =
  real_of_int
   (sint
     (SCAST(64 \<rightarrow> 32)
       (SCAST(32 \<rightarrow> 64) w1 + SCAST(32 \<rightarrow> 64) w2)))
  sint
   (SCAST(64 \<rightarrow> 32)
     (SCAST(32 \<rightarrow> 64) w1 + SCAST(32 \<rightarrow> 64) w2)) =
  sint w1 + sint w2
  sint w1 + sint w2 < 2147483647
  sint w1 + sint w2 < 2147483647
  - 2147483647 < sint w1 + sint w2
  - 2147483647 < sint w1 + sint w2
  r'\<^sub>1 + r'\<^sub>2 =
  real_of_int
   (sint
     (SCAST(64 \<rightarrow> 32)
       (SCAST(32 \<rightarrow> 64) w1 + SCAST(32 \<rightarrow> 64) w2)))

goal (1 subgoal):
 1. r'\<^sub>1 + r'\<^sub>2 =
    real_of_int
     (sint
       (SCAST(64 \<rightarrow> 32)
         (SCAST(32 \<rightarrow> 64) w1 +
          SCAST(32 \<rightarrow> 64) w2))) \<and>
    r'\<^sub>1 + r'\<^sub>2 < 2147483647 \<and>
    - 2147483647 < r'\<^sub>1 + r'\<^sub>2


proof (prove)
goal (1 subgoal):
 1. ring (S\<lparr>carrier := h ` carrier R, zero := h \<zero>\<rparr>)


proof (prove)
using this:
  DN.map\<^sub>0 (UP.map\<^sub>0 a') = a'
  B.obj a'
  B.obj ?a \<Longrightarrow> B.equivalent_objects ?a ?a

goal (1 subgoal):
 1. B.equivalent_objects (DN.map\<^sub>0 (UP.map\<^sub>0 a')) a'


proof (state)
this:
  \<langle>\<p>\<^sub>1[g.leg0, f.leg1] \<lbrakk>g.cod.leg0, f.cod.leg1\<rbrakk> \<p>\<^sub>0[g.leg0, f.leg1]\<rangle> =
  \<langle>\<p>\<^sub>1[g.leg0, f.leg1] \<cdot>
           (g.leg0 \<down>\<down>
            f.leg1) \<lbrakk>g.cod.leg0, f.cod.leg1\<rbrakk> \<p>\<^sub>0[g.leg0, f.leg1] \<cdot>
                       (g.leg0 \<down>\<down> f.leg1)\<rangle>

goal (1 subgoal):
 1. chine_hcomp g f = g.leg0 \<down>\<down> f.leg1


proof (prove)
goal (3 subgoals):
 1. finite
     (ta_rules
       \<lparr>ta_initial = ta.Qi \<union> ta'.Qi,
          ta_rules = ta.\<delta> \<union> ta'.\<delta>\<rparr>)
 2. finite
     (ta_initial
       \<lparr>ta_initial = ta.Qi \<union> ta'.Qi,
          ta_rules = ta.\<delta> \<union> ta'.\<delta>\<rparr>)
 3. \<And>q f qs.
       q \<rightarrow> f qs
       \<in> ta_rules
              \<lparr>ta_initial = ta.Qi \<union> ta'.Qi,
                 ta_rules =
                   ta.\<delta> \<union>
                   ta'.\<delta>\<rparr> \<Longrightarrow>
       A f = Some (length qs)


proof (prove)
using this:
  evaluate True ?env ?s ?e
   ((SOME x. \<forall>env e s. evaluate True env s e (x env e s)) ?env ?e
     ?s)

goal (1 subgoal):
 1. evaluate True env_ s_ e_
     ((SOME f. \<forall>env e s. evaluate True env s e (f env e s)) env_ e_
       s_)


proof (prove)
goal (1 subgoal):
 1. ((\<lambda>t. exp (t *\<^sub>R - s) * f' t) has_integral s * L - f0)
     {0..}


proof (state)
goal (1 subgoal):
 1. \<S>\<bullet>\<C> \<turnstile> [$C v] : ts _> ts'


proof (state)
this:
  \<forall>twoC\<in>{diamond_cube}.
     analytically_valid (cubeImage twoC) (\<lambda>x. F x \<bullet> i) j

goal (1 subgoal):
 1. integral (cubeImage diamond_cube)
     (\<lambda>x.
         partial_vector_derivative (\<lambda>x. F x \<bullet> j) i x -
         partial_vector_derivative (\<lambda>x. F x \<bullet> i) j x) =
    one_chain_line_integral F {i, j} (boundary diamond_cube)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>f 0 = (c # cs, s); \<forall>i. f i \<rightarrow> f (Suc i);
     \<exists>i. fst (f i) = cs\<rbrakk>
    \<Longrightarrow> \<forall>i\<le>LEAST i. fst (f i) = cs.
                         \<exists>p.
                            (p \<noteq> []) =
                            (i < (LEAST i. fst (f i) = cs)) \<and>
                            fst (f i) = p @ cs


proof (prove)
goal (1 subgoal):
 1. Sorting_Algorithms.sort cmp ys = xs


proof (prove)
goal (1 subgoal):
 1. uniformly_continuous_on s (\<lambda>x. c)


proof (prove)
using this:
  (P, B, Q) = diagonal_to_Smith_PQ A bezout

goal (1 subgoal):
 1. (P, B, Q) =
    diagonal_to_Smith_aux_PQ [0..<min (nrows A) (ncols A) - 1] bezout
     (mat (1::'a), A, mat (1::'a))


proof (prove)
goal (1 subgoal):
 1. (rel_\<I> C (=) ===> rel_gpv A C ===> (=)) (gen_lossless_gpv b)
     (gen_lossless_gpv b)


proof (prove)
goal (1 subgoal):
 1. Tree2.set_tree (list_to_rbt xs) = set xs


proof (state)
this:
  bad1 s1'' \<and> X_bad s1'' s2'

goal (2 subgoals):
 1. \<And>a b aa ba.
       \<lbrakk>(a, b) \<in> set_spmf (exec_gpv oracle1 (c r1) s1');
        (aa, ba) \<in> set_spmf (exec_gpv oracle2 (c r2) s2')\<rbrakk>
       \<Longrightarrow> bad1 b = bad2 ba
 2. \<And>a b aa ba.
       \<lbrakk>(a, b) \<in> set_spmf (exec_gpv oracle1 (c r1) s1');
        (aa, ba) \<in> set_spmf (exec_gpv oracle2 (c r2) s2')\<rbrakk>
       \<Longrightarrow> if bad2 ba then X_bad b ba
                         else a = aa \<and> X b ba


proof (prove)
using this:
  S'.arr f'
  \<Phi> ?f =
  (if S.arr ?f
   then S'.mkArr (S'.set (\<Phi>o (S.dom ?f))) (S'.set (\<Phi>o (S.cod ?f)))
         (\<Phi>a ?f)
   else S'.null)
  S'.arr ?f \<Longrightarrow>
  \<Psi> ?f \<in> S.hom (\<Psi>o (S'.dom ?f)) (\<Psi>o (S'.cod ?f))
  S'.ide ?a' \<Longrightarrow> \<Phi>o (\<Psi>o ?a') = ?a'

goal (1 subgoal):
 1. \<Phi> (\<Psi> f') =
    S'.mkArr (S'.set (S'.dom f')) (S'.set (S'.cod f')) (\<Phi>a (\<Psi> f'))


proof (prove)
goal (1 subgoal):
 1. OFCLASS(of_match_field, linorder_class)


proof (prove)
goal (1 subgoal):
 1. finite S


proof (prove)
goal (1 subgoal):
 1. a \<sqsubset> b \<Longrightarrow> rank a < rank b


proof (prove)
goal (1 subgoal):
 1. sum f {..n} = Suc n


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>dom f = dom lz; dom f' = dom f; finite L1;
     \<forall>l\<in>dom f.
        \<forall>s p.
           s \<notin> L1 \<and>
           p \<notin> L1 \<and> s \<noteq> p \<longrightarrow>
           (\<exists>t.
               (the (f l)\<^bsup>[Fvar s,Fvar p]\<^esup> => t \<and>
                (\<forall>z.
                    the (f l)\<^bsup>[Fvar s,Fvar p]\<^esup> =>
                    z \<longrightarrow>
                    (\<exists>u. t => u \<and> z => u))) \<and>
               the (f' l) = \<sigma>[s,p] t);
     finite L2;
     \<forall>l\<in>dom lz.
        \<forall>s p.
           s \<notin> L2 \<and>
           p \<notin> L2 \<and> s \<noteq> p \<longrightarrow>
           (\<exists>t.
               the (f l)\<^bsup>[Fvar s,Fvar p]\<^esup> => t \<and>
               the (lz l) = \<sigma>[s,p] t)\<rbrakk>
    \<Longrightarrow> \<exists>L'.
                         finite L' \<and>
                         (\<exists>lu.
                             dom lu = dom f \<and>
                             (\<forall>l\<in>dom f.
                                 \<forall>s p.
                                    s \<notin> L' \<and>
                                    p \<notin> L' \<and>
                                    s \<noteq> p \<longrightarrow>
                                    (\<exists>t.
  the (f' l)\<^bsup>[Fvar s,Fvar p]\<^esup> => t \<and>
  the (lu l) = \<sigma>[s,p] t)) \<and>
                             (\<forall>l\<in>dom f.
                                 body (the (f' l))) \<and>
                             (\<forall>l\<in>dom f.
                                 \<forall>s p.
                                    s \<notin> L' \<and>
                                    p \<notin> L' \<and>
                                    s \<noteq> p \<longrightarrow>
                                    (\<exists>t.
  the (lz l)\<^bsup>[Fvar s,Fvar p]\<^esup> => t \<and>
  the (lu l) = \<sigma>[s,p] t)) \<and>
                             (\<forall>l\<in>dom f. body (the (lz l))))


proof (prove)
goal (1 subgoal):
 1. (\<Prod>a\<leftarrow>(b, i) #
                         bs. case a of (a, i) \<Rightarrow> a * a ^ i) =
    smult
     (\<Prod>x\<leftarrow>(b, i) #
                          bs. fst (case x of
                                   (b, i) \<Rightarrow>
                                     case f b of
                                     (d, fs) \<Rightarrow>
 (d ^ Suc i, map (\<lambda>f. (f, i)) fs)))
     (\<Prod>a\<leftarrow>concat
                           (map (\<lambda>x.
                                    snd (case x of
   (b, i) \<Rightarrow>
     case f b of
     (d, fs) \<Rightarrow> (d ^ Suc i, map (\<lambda>f. (f, i)) fs)))
                             ((b, i) #
                              bs)). case a of
                                    (a, i) \<Rightarrow> a * a ^ i)


proof (prove)
goal (1 subgoal):
 1. f \<longlonglongrightarrow> lim f


proof (prove)
goal (1 subgoal):
 1. \<And>fun.
       inf (pred_fun top bounded_linear) bounded_bilinear
        fun \<Longrightarrow>
       inf (pred_fun top bounded_linear) bounded_bilinear
        (\<lambda>x y. fun y x)


proof (prove)
goal (1 subgoal):
 1. (\<sqinter>x\<in>range left \<union> range right \<rightarrow>
        \<bottom>)
    \<le> COPY


proof (prove)
goal (1 subgoal):
 1. vars_term_ms (SCF (Fun f (ss1 @ t # ss2))) \<subseteq>#
    vars_term_ms (SCF (Fun f (ss1 @ s # ss2)))


proof (prove)
using this:
  \<exists>g. g \<circ> f = id \<and> f \<circ> g = id

goal (1 subgoal):
 1. inj f


proof (prove)
goal (1 subgoal):
 1. ssubst x v k = k


proof (prove)
goal (1 subgoal):
 1. pmf_prob p (set xs) = sum (pmf p) (set xs) &&&
    pmf_prob p (List.coset xs) = 1 - sum (pmf p) (set xs)


proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>local.inv t\<^sub>0u\<^sub>1.\<phi> \<star>
                    chine : (u\<^sub>1 \<star>
                             t\<^sub>0u\<^sub>1.p\<^sub>0) \<star>
                            chine \<Rightarrow> (t\<^sub>0 \<star>
           t\<^sub>0u\<^sub>1.p\<^sub>1) \<star>
          chine\<guillemotright>


proof (prove)
using this:
  valid_edge a''
  kind a'' = Q''\<hookleftarrow>\<^bsub>p\<^esub>f''

goal (1 subgoal):
 1. method_exit (sourcenode a'')


proof (prove)
goal (1 subgoal):
 1. {y. \<exists>v\<ge>0.
           \<exists>u.
              (\<forall>x\<in>{b, c}. 0 \<le> u x) \<and>
              sum u {b, c} = 1 - v \<and>
              (\<Sum>x\<in>{b, c}. u x *\<^sub>R x) = y - v *\<^sub>R a} =
    {u *\<^sub>R a + v *\<^sub>R b + w *\<^sub>R c |u v w.
     0 \<le> u \<and> 0 \<le> v \<and> 0 \<le> w \<and> u = 1 - v - w}


proof (prove)
goal (1 subgoal):
 1. mono f \<Longrightarrow> gfp f = \<Squnion> Fix f


proof (prove)
goal (1 subgoal):
 1. freshEnv xs x rho = qFreshEnv xs x (pickE rho)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ifex_ordered (IF v t e); v' < v\<rbrakk>
    \<Longrightarrow> restrict_top (IF v t e) v' val = IF v t e


proof (prove)
goal (1 subgoal):
 1. fv s \<subseteq> fv t \<Longrightarrow>
    fv (s \<cdot> \<theta>) \<subseteq> fv (t \<cdot> \<theta>)


proof (prove)
using this:
  Range
   (a \<union> {seller} \<times> ({\<Omega> - \<Union> (Range a)} - {{}})) =
  Range a \<union> ({\<Omega> - \<Union> (Range a)} - {{}})
  ?A \<union> (?B - ?A) = ?A \<union> ?B
  ?B - ?A \<union> ?A = ?B \<union> ?A
  \<Union> (?A \<union> ?B) = \<Union> ?A \<union> \<Union> ?B
  \<Union> {} = {}
  \<Union> (insert ?a ?B) = ?a \<union> \<Union> ?B

goal (1 subgoal):
 1. \<Union>
     (Range
       (a \<union>
        {seller} \<times> ({\<Omega> - \<Union> (Range a)} - {{}}))) =
    \<Omega>


proof (prove)
goal (1 subgoal):
 1. x\<^sup>T = x


proof (prove)
goal (1 subgoal):
 1. is_finite_Float TYPE((11, 52) IEEE.float) f =
    (let e = Float.exponent f; bm = bitlen \<bar>mantissa f\<bar>
     in bm \<le> 53 \<and> e + bm < 1025 \<and> - 1075 < e)


proof (prove)
using this:
  (\<And>\<phi>.
      ?w \<Turnstile>\<^sub>n (rewrite_modal \<circ> rewrite_X) \<phi> =
      ?w \<Turnstile>\<^sub>n \<phi>) \<Longrightarrow>
  ?w \<Turnstile>\<^sub>n iterate (rewrite_modal \<circ> rewrite_X) ?\<phi>
                           ?n =
  ?w \<Turnstile>\<^sub>n ?\<phi>

goal (1 subgoal):
 1. w \<Turnstile>\<^sub>n rewrite_iter_fast \<phi> =
    w \<Turnstile>\<^sub>n \<phi>


proof (prove)
using this:
  2 * n + c_main \<le> 2 * n + (2 * n + 1 + 2 * i) * i

goal (1 subgoal):
 1. result (dmu_array_row_cost dmus i) = dmu_array_row fs dmus i \<and>
    cost (dmu_array_row_cost dmus i) \<le> 2 * n + (2 * n + 1 + 2 * i) * i


proof (prove)
using this:
  iwf fc t ent

goal (1 subgoal):
 1. length (iAnts t) \<le> length (inPorts' (iNodeOf (tree_at t [])))


proof (state)
this:
  ?w \<in> ball \<xi> (min r0 r1) \<Longrightarrow>
  f ?w = (?w - \<xi>) ^ n * g ?w

goal (4 subgoals):
 1. 0 < n
 2. 0 < min r0 r1
 3. ball \<xi> (min r0 r1) \<subseteq> S
 4. \<And>w. w \<in> ball \<xi> (min r0 r1) \<Longrightarrow> g w \<noteq> 0


proof (prove)
using this:
  Limit \<beta>
  0 \<in>\<^sub>\<circ> \<alpha>

goal (1 subgoal):
 1. \<alpha> * \<xi> + 1
    \<subseteq>\<^sub>\<circ> \<alpha> * \<xi> + \<alpha>


proof (prove)
goal (1 subgoal):
 1. x [^]\<^bsub>R\<^esub> (CARD('a) ^ m' - 1) = \<one>\<^bsub>R\<^esub>


proof (prove)
goal (1 subgoal):
 1. (positive (b - a) \<or> a = b) \<or> positive (a - b) \<or> b = a


proof (prove)
goal (1 subgoal):
 1. dim_row
     (mat_of_rows_list (degree f')
       (map (\<lambda>cs.
                cs @
                replicate (degree f' - length cs)
                 (arith_ops_record.zero ff_ops))
         (power_polys_i ff_ops
           (power_poly_f_mod_i ff_ops
             (\<lambda>v. mod_field_poly_i ff_ops v f)
             [arith_ops_record.zero ff_ops, arith_ops_record.one ff_ops]
             (nat p))
           f [arith_ops_record.one ff_ops] (degree f')))) =
    dim_row
     (mat_of_rows_list (degree f')
       (map (\<lambda>cs.
                coeffs cs @ replicate (degree f' - length (coeffs cs)) 0)
         (power_polys (power_poly_f_mod f' [:0, 1:] (nat p)) f' 1
           (degree f')))) \<and>
    dim_col
     (mat_of_rows_list (degree f')
       (map (\<lambda>cs.
                cs @
                replicate (degree f' - length cs)
                 (arith_ops_record.zero ff_ops))
         (power_polys_i ff_ops
           (power_poly_f_mod_i ff_ops
             (\<lambda>v. mod_field_poly_i ff_ops v f)
             [arith_ops_record.zero ff_ops, arith_ops_record.one ff_ops]
             (nat p))
           f [arith_ops_record.one ff_ops] (degree f')))) =
    dim_col
     (mat_of_rows_list (degree f')
       (map (\<lambda>cs.
                coeffs cs @ replicate (degree f' - length (coeffs cs)) 0)
         (power_polys (power_poly_f_mod f' [:0, 1:] (nat p)) f' 1
           (degree f')))) \<and>
    (\<forall>i j.
        i < dim_row
             (mat_of_rows_list (degree f')
               (map (\<lambda>cs.
                        coeffs cs @
                        replicate (degree f' - length (coeffs cs)) 0)
                 (power_polys (power_poly_f_mod f' [:0, 1:] (nat p)) f' 1
                   (degree f')))) \<longrightarrow>
        j < dim_col
             (mat_of_rows_list (degree f')
               (map (\<lambda>cs.
                        coeffs cs @
                        replicate (degree f' - length (coeffs cs)) 0)
                 (power_polys (power_poly_f_mod f' [:0, 1:] (nat p)) f' 1
                   (degree f')))) \<longrightarrow>
        R (mat_of_rows_list (degree f')
            (map (\<lambda>cs.
                     cs @
                     replicate (degree f' - length cs)
                      (arith_ops_record.zero ff_ops))
              (power_polys_i ff_ops
                (power_poly_f_mod_i ff_ops
                  (\<lambda>v. mod_field_poly_i ff_ops v f)
                  [arith_ops_record.zero ff_ops,
                   arith_ops_record.one ff_ops]
                  (nat p))
                f [arith_ops_record.one ff_ops] (degree f'))) $$
           (i, j))
         (mat_of_rows_list (degree f')
           (map (\<lambda>cs.
                    coeffs cs @
                    replicate (degree f' - length (coeffs cs)) 0)
             (power_polys (power_poly_f_mod f' [:0, 1:] (nat p)) f' 1
               (degree f'))) $$
          (i, j)))


proof (prove)
using this:
  vertex_subtree w \<subseteq> T.left_tree s t
  vertex_subtree w \<inter> T.left_tree t s \<noteq> {}
  ?s \<rightarrow>\<^bsub>T\<^esub> ?t \<Longrightarrow>
  T.left_tree ?s ?t \<inter> T.left_tree ?t ?s = {}
  s \<rightarrow>\<^bsub>T\<^esub> t

goal (1 subgoal):
 1. False


proof (prove)
using this:
  Domain r \<union> Range r = {r.zero}
  r.zero \<in> Domain r \<union> Range r \<Longrightarrow>
  (r.zero, r.zero) \<in> r

goal (1 subgoal):
 1. r = {(r.zero, r.zero)}


proof (prove)
using this:
  x \<in> X
  \<forall>xa. real xa \<noteq> u x
  \<not> real (k x) < u x
  \<forall>x\<in>X. 0 \<le> u x
  (\<lfloor>?x\<rfloor> < ?z) = (?x < of_int ?z)
  0 \<le> ?w \<Longrightarrow> (nat ?w < ?m) = (?w < int ?m)

goal (1 subgoal):
 1. valid_intv (k x) (Intv (nat \<lfloor>u x\<rfloor>))


proof (prove)
using this:
  p \<in> phull (monomial (1::'a) ` deg_sect X z)

goal (1 subgoal):
 1. (\<And>M u.
        \<lbrakk>M \<subseteq> monomial (1::'a) ` deg_sect X z; finite M;
         p = (\<Sum>m\<in>M. u m \<cdot> m)\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. sum f {..<n} = sum f ({..<n} \<inter> range g)


proof (prove)
goal (1 subgoal):
 1. rel_language letter_eq (Language1 (init1 r)) (Language2 (init2 s)) =
    (\<forall>(r', s')
              \<in>{((r, s), delta1 a r, delta2 b s) |a b r s.
                    a \<in> set alphabet1 \<and>
                    b \<in> set alphabet2 \<and> letter_eq a b}\<^sup>* ``
                   {(init1 r, init2 s)}.
        accept1 r' = accept2 s')


proof (prove)
goal (1 subgoal):
 1. (\<Union>y\<in>A \<inter> range (X i). X i -` {y}) =
    (\<Union>y\<in>A \<inter> range (X i).
        proj_stoch_proc X n -`
        \<Union>
         (stream_space_single (proj_stoch_proc X n) ` comp_proj_i X n i y))


proof (prove)
goal (1 subgoal):
 1. \<And>\<gamma> p m a rs.
       \<lbrakk>\<lbrakk>\<not> matches \<gamma> m a p;
                 Undecided = Undecided\<rbrakk>
                \<Longrightarrow> approximating_bigstep_fun \<gamma> p
                                   (cut_off_after_match_any rs) Undecided =
                                  approximating_bigstep_fun \<gamma> p rs
                                   Undecided;
        \<lbrakk>\<not> \<not> matches \<gamma> m a p; a = Log;
         Undecided = Undecided\<rbrakk>
        \<Longrightarrow> approximating_bigstep_fun \<gamma> p
                           (cut_off_after_match_any rs) Undecided =
                          approximating_bigstep_fun \<gamma> p rs Undecided;
        \<lbrakk>\<not> \<not> matches \<gamma> m a p; a = Empty;
         Undecided = Undecided\<rbrakk>
        \<Longrightarrow> approximating_bigstep_fun \<gamma> p
                           (cut_off_after_match_any rs) Undecided =
                          approximating_bigstep_fun \<gamma> p rs Undecided;
        Undecided = Undecided\<rbrakk>
       \<Longrightarrow> approximating_bigstep_fun \<gamma> p
                          (cut_off_after_match_any (Rule m a # rs))
                          Undecided =
                         approximating_bigstep_fun \<gamma> p
                          (Rule m a # rs) Undecided


proof (prove)
using this:
  (h, as) \<Turnstile> P
  (h, as') \<Turnstile> Q
  as \<inter> as' = {}

goal (1 subgoal):
 1. (h, as \<union> as') \<Turnstile>
    Abs_assn (times_assn_raw (Rep_assn P) (Rep_assn Q))


proof (prove)
using this:
  \<Sigma> \<noteq> {}
  finite (af_abs.abs_reach (Abs ?\<phi>))

goal (1 subgoal):
 1. finite (reach \<Sigma> \<up>af (Abs \<phi>))


proof (prove)
using this:
  \<lbrakk>set (labels_conv
                 (fst (conv_mirror
                        (fst \<delta>1''',
                         map (Pair True) (snd \<delta>1'''))),
                  snd (conv_mirror
                        (fst \<delta>1''',
                         map (Pair True) (snd \<delta>1'''))) @
                  snd \<delta>3))
           \<subseteq> ?S;
   set (labels_conv (conv_mirror \<gamma>3)) \<subseteq> ?T\<rbrakk>
  \<Longrightarrow> set (labels_conv
                          (fst (fst (conv_mirror
(fst \<delta>1''', map (Pair True) (snd \<delta>1'''))),
                                snd (conv_mirror
(fst \<delta>1''', map (Pair True) (snd \<delta>1'''))) @
                                snd \<delta>3),
                           snd (fst (conv_mirror
(fst \<delta>1''', map (Pair True) (snd \<delta>1'''))),
                                snd (conv_mirror
(fst \<delta>1''', map (Pair True) (snd \<delta>1'''))) @
                                snd \<delta>3) @
                           snd (conv_mirror \<gamma>3)))
                    \<subseteq> ?S \<union> ?T
  set (labels_conv
        (fst (conv_mirror
               (fst \<delta>1''', map (Pair True) (snd \<delta>1'''))),
         snd (conv_mirror
               (fst \<delta>1''', map (Pair True) (snd \<delta>1'''))) @
         snd \<delta>3))
  \<subseteq> r \<down>s {fst \<alpha>_step, fst \<beta>_step}
  conv_mirror \<gamma>3 \<in> conv ars
  set (labels_conv (conv_mirror \<gamma>3))
  \<subseteq> r \<down>s {fst \<alpha>_step, fst \<beta>_step}
  fst (conv_mirror \<gamma>3) = lst_conv \<delta>3
  lst_conv (conv_mirror \<gamma>3) = fst \<gamma>1'''

goal (1 subgoal):
 1. set (labels_conv
          (fst (fst (conv_mirror
                      (fst \<delta>1''',
                       map (Pair True) (snd \<delta>1'''))),
                snd (conv_mirror
                      (fst \<delta>1''',
                       map (Pair True) (snd \<delta>1'''))) @
                snd \<delta>3),
           snd (fst (conv_mirror
                      (fst \<delta>1''',
                       map (Pair True) (snd \<delta>1'''))),
                snd (conv_mirror
                      (fst \<delta>1''',
                       map (Pair True) (snd \<delta>1'''))) @
                snd \<delta>3) @
           snd (conv_mirror \<gamma>3)))
    \<subseteq> r \<down>s {fst \<alpha>_step, fst \<beta>_step}


proof (prove)
using this:
  i.lpp g \<in> keys g

goal (1 subgoal):
 1. except (i.lpp g) {x} \<in> (\<lambda>t. except t {x}) ` keys g


proof (prove)
goal (1 subgoal):
 1. \<forall>S\<in>S.
       wf\<^sub>s\<^sub>t (wfrestrictedvars\<^sub>e\<^sub>s\<^sub>t A)
        (dual\<^sub>s\<^sub>t S)


proof (prove)
goal (1 subgoal):
 1. birkhoff_sum (indicator A) n \<in> borel_measurable M


proof (state)
this:
  \<forall>a\<in>set (atoms\<^sub>0 \<phi>).
     divisor a dvd zlcms (map divisor (atoms\<^sub>0 \<phi>))

goal (1 subgoal):
 1. Z.I (qe_cooper\<^sub>1 \<phi>) xs = (\<exists>x. Z.I \<phi> (x # xs))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>length key = len; length plain = len\<rbrakk>
    \<Longrightarrow> encrypt key plain \<bind>
                      (\<lambda>cipher. return_spmf (decrypt key cipher)) =
                      return_spmf (Some plain)


proof (prove)
using this:
  S.arr m \<and>
  S.set (S.dom m) \<subseteq> S.set (S.cod m) \<and>
  m = S.mkArr (S.set (S.dom m)) (S.set (S.cod m)) (\<lambda>x. x)
  S.ide ?a \<Longrightarrow> \<Phi> ?a = \<Phi>o ?a

goal (1 subgoal):
 1. S'.mkArr (S'.set (\<Phi>o (S.dom m))) (S'.set (\<Phi>o (S.cod m)))
     (\<Phi>a m) =
    S'.mkArr (S'.set (S'.dom (\<Phi> m))) (S'.set (S'.cod (\<Phi> m)))
     (\<Phi>a m)


proof (prove)
goal (1 subgoal):
 1. s \<in> \<gamma>\<^sub>s S \<Longrightarrow>
    aval a s \<in> \<gamma> (aval' a S)


proof (prove)
using this:
  HNext s s'
  HInv1 s \<and> HInv2 s \<and> HInv2 s' \<and> HInv4 s

goal (1 subgoal):
 1. HInv4a s' p


proof (prove)
using this:
  finite S

goal (1 subgoal):
 1. extract_var (p + p') v = extract_var p v + extract_var p' v


proof (prove)
goal (1 subgoal):
 1. total1 (amalgamation (the (f 0)) (the (f 1)))


proof (prove)
goal (1 subgoal):
 1. safe_formula \<phi> \<Longrightarrow>
    mstate_n
     \<lparr>mstate_i = 0, mstate_m = minit0 (Formula.nfv \<phi>) \<phi>,
        mstate_n = Formula.nfv \<phi>\<rparr> =
    Formula.nfv \<phi> \<and>
    (\<forall>\<sigma>.
        prefix_of pnil \<sigma> \<longrightarrow>
        mstate_i
         \<lparr>mstate_i = 0,
            mstate_m = minit0 (Formula.nfv \<phi>) \<phi>,
            mstate_n = Formula.nfv \<phi>\<rparr> =
        Monitor.progress \<sigma> Map.empty \<phi> (plen pnil) \<and>
        wf_mformula \<sigma> (plen pnil) Map.empty Map.empty
         (mstate_n
           \<lparr>mstate_i = 0,
              mstate_m = minit0 (Formula.nfv \<phi>) \<phi>,
              mstate_n = Formula.nfv \<phi>\<rparr>)
         R (mstate_m
             \<lparr>mstate_i = 0,
                mstate_m = minit0 (Formula.nfv \<phi>) \<phi>,
                mstate_n = Formula.nfv \<phi>\<rparr>)
         \<phi>)


proof (prove)
using this:
  wset_final_ok ws ts
  ws t = \<lfloor>w\<rfloor>
  \<lbrakk>ts t = \<lfloor>(?x5, ?ln5)\<rfloor>; \<not> final ?x5\<rbrakk>
  \<Longrightarrow> thesis

goal (1 subgoal):
 1. thesis


proof (prove)
using this:
  t0 \<in> T'
  is_interval T'
  T' \<subseteq> existence_ivl t0 x0
  (z solves_ode f) T' X
  z t0 = flow t0 x0 t0
  t \<in> T'
  t0 \<in> T'
  is_interval T'
  T' \<subseteq> existence_ivl t0 x0
  (z solves_ode f) T' X
  z t0 = flow t0 x0 t0
  t \<in> T'
  existence_ivl t0 ?x0.0 \<subseteq> T
  ?t \<in> existence_ivl t0 ?x0.0 \<Longrightarrow> t0 \<in> T
  ?t \<in> existence_ivl t0 ?x0.0 \<Longrightarrow> ?x0.0 \<in> X

goal (1 subgoal):
 1. t0 \<in> T \<and> x0 \<in> X


proof (prove)
goal (1 subgoal):
 1. vars p = vars\<^sub>0 \<and>
    (\<exists>s\<^sub>H.
        body_split p s\<^sub>L\<^sub>0 s\<^sub>H \<and>
        wfs \<Gamma>\<^sub>0 s\<^sub>H \<and>
        high_proc\<^sub>2 s\<^sub>H \<and>
        high_proc_no_low_output_change s\<^sub>H) \<Longrightarrow>
    vars p = vars\<^sub>0 \<and>
    (\<exists>s\<^sub>L s\<^sub>H.
        body_split p s\<^sub>L s\<^sub>H \<and>
        wfs \<Gamma>\<^sub>0 s\<^sub>L \<and>
        wfs \<Gamma>\<^sub>0 s\<^sub>H \<and>
        low_proc_non0\<^sub>2 s\<^sub>L \<and>
        low_proc_0\<^sub>2 s\<^sub>L \<and>
        low_proc_no_input_change s\<^sub>L \<and>
        high_proc\<^sub>2 s\<^sub>H \<and>
        high_proc_no_low_output_change s\<^sub>H)


proof (prove)
goal (1 subgoal):
 1. blinfun_apply (blinfun_scaleR a b) c = blinfun_apply a c *\<^sub>R b


proof (prove)
using this:
  a \<in> carrier Zp
  b \<in> carrier Zp
  c \<in> carrier Zp
  val_Zp a = val_Zp b
  val_Zp b < val_Zp (c \<ominus> a)

goal (1 subgoal):
 1. val_Zp c = val_Zp (c \<ominus> a \<oplus> a)


proof (prove)
goal (1 subgoal):
 1. local.triangular_column l A'


proof (state)
this:
  (\<exists>tst d.
      compatTst tst \<and> ?ca3 = while tst do d \<and> siso0 d) \<or>
  (\<exists>tst d1 d.
      compatTst tst \<and>
      ?ca3 = d1 ;; while tst do d \<and>
      siso0 d1 \<and> siso0 d) \<Longrightarrow>
  siso0 ?ca3

goal (1 subgoal):
 1. siso0 (while tst do c)


proof (prove)
goal (1 subgoal):
 1. r -`\<^sub>\<bullet> A -\<^sub>\<circ> r -`\<^sub>\<bullet> B
    \<subseteq>\<^sub>\<circ> r -`\<^sub>\<bullet> (A -\<^sub>\<circ> B)


proof (prove)
using this:
  CC \<subseteq> N

goal (1 subgoal):
 1. CC \<subseteq> N -
                   {C. \<exists>DD\<subseteq>N.
                          DD \<Turnstile> {C} \<and>
                          (\<forall>D\<in>DD. D < C)}


proof (prove)
using this:
  X \<subseteq> {..n + 1}

goal (1 subgoal):
 1. (if R `` X' \<inter> {n + 1..} = {} then 0 else g' n (n + 1)) +
    sum (g' n) (Y' \<inter> {..n}) =
    sum (g' n) (R' n `` X)


proof (prove)
using this:
  path ?v ?v []
  terminal_vertex (c, [])

goal (1 subgoal):
 1. \<exists>pth v'. path (c, []) v' pth \<and> terminal_vertex v'


proof (prove)
using this:
  invariant composition P18
  reachable composition (s1, s2)

goal (1 subgoal):
 1. P18 (s1, s2)


proof (prove)
goal (1 subgoal):
 1. advantage3 \<A> = local.dis_log.advantage (adversary3 \<A>)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fgmodule_condition R f i s A z; ideal R (carrier R);
     R module fgmodule R A z i f s\<rbrakk>
    \<Longrightarrow> linear_span R (fgmodule R A z i f s) (carrier R) A =
                      carrier (fgmodule R A z i f s)


proof (prove)
goal (1 subgoal):
 1. rsquarefree ([:- a, 1::'a:] * (p * q))


proof (prove)
goal (2 subgoals):
 1. \<And>x. a \<in> x \<and> x \<in> P \<Longrightarrow> x = A
 2. \<And>x.
       a \<in> x \<and> x \<in> P \<Longrightarrow>
       a \<in> S \<longrightarrow> {b \<in> S. (b, a) \<in> Equivalence} = x


proof (prove)
using this:
  \<lbrakk>?u \<cdot> ?v = \<one>; ?v \<cdot> ?u = \<one>; ?u \<in> M;
   ?v \<in> M\<rbrakk>
  \<Longrightarrow> invertible ?u

goal (1 subgoal):
 1. \<lbrakk>sub.invertible u; u \<in> N\<rbrakk>
    \<Longrightarrow> invertible u


proof (prove)
goal (1 subgoal):
 1. cyc_post blues reds onstack u0 (init_wit_blue_early u0 t)


proof (state)
this:
  0 < k
  prime q
  p ^ n = q ^ k

goal (2 subgoals):
 1. primepow (p ^ n) \<Longrightarrow> primepow p
 2. \<lbrakk>primepow p; 0 < n\<rbrakk> \<Longrightarrow> primepow (p ^ n)


proof (prove)
goal (1 subgoal):
 1. (weak_ranking R1 = weak_ranking R2) = (R1 = R2)


proof (prove)
goal (1 subgoal):
 1. \<And>b l aa ba.
       \<lbrakk>\<And>s' r.
                   recognises_execution e s' r t \<Longrightarrow>
                   \<exists>c1 s. obtains s c1 e s' r t;
        recognises_execution e s' r ((l, b) # t); a = (l, b);
        (aa, ba) |\<in>| possible_steps e s' r l b;
        recognises_execution e aa (evaluate_updates ba b r) t\<rbrakk>
       \<Longrightarrow> \<exists>c1 s.
                            \<exists>(s'', T)
                                     |\<in>|possible_steps e s' r l b.
                               obtains s c1 e s'' (evaluate_updates T b r) t


proof (prove)
using this:
  a \<le> b'
  b \<le> b'
  D - c * g b' \<le> c * g x
  b' \<le> x
  f \<in> O(g')
  filterlim g at_top at_top
  \<lbrakk>a \<le> ?a'; ?a' \<le> ?x\<rbrakk>
  \<Longrightarrow> f integrable_on {?a'..?x}
  a \<le> ?x \<Longrightarrow>
  (g has_real_derivative g' ?x) (at ?x within {a..})
  continuous_on {a..} g'
  a \<le> ?x \<Longrightarrow> 0 \<le> g' ?x
  0 < c
  (\<lambda>x. \<bar>g' x\<bar>) integrable_on {b'..x}

goal (1 subgoal):
 1. norm (integral {b'..x} f)
    \<le> integral {b'..x} (\<lambda>x. c * norm (g' x))


proof (prove)
goal (1 subgoal):
 1. (\<not> ((\<forall>x\<in>state_set (state_list s as).
                 last x \<in> valid_states PROB) \<and>
             (\<forall>x\<in>state_set (state_list s as).
                 \<forall>y\<in>state_set (state_list s as).
                    last x = last y \<longrightarrow> x = y))) =
    (\<not> (\<forall>x\<in>state_set (state_list s as).
                \<forall>y\<in>state_set (state_list s as).
                   last x = last y \<longrightarrow> x = y))


proof (prove)
using this:
  d = degree u
  d \<le> n
  u \<noteq> 0
  k \<noteq> (0::'a)
  i < n

goal (1 subgoal):
 1. i < n - degree u \<Longrightarrow>
    degree (u * monom (1::'a) (n - Suc (degree u + i))) = n - Suc i


proof (prove)
goal (1 subgoal):
 1. nearly_healthy
     (wlp (\<mu>x.
              body ;;
              x \<^bsub>\<guillemotleft> G \<guillemotright>\<^esub>\<oplus> Skip))


proof (prove)
goal (1 subgoal):
 1. \<forall>e\<in>challenge_space.
       (\<forall>(h, w)\<in>R_DL.
           Schnorr_\<Sigma>.R h w e = Schnorr_\<Sigma>.S h e) \<and>
       (\<forall>h\<in>valid_pub.
           \<forall>(a, z)\<in>set_spmf (S2 h e). check h a e z)


proof (prove)
using this:
  e_take
   (Suc (GREATEST j.
            j < e_length (f \<triangleright> n\<^sub>1) \<and>
            0 < the (eval r_result1
                      [e_length (f \<triangleright> n\<^sub>1), i,
                       e_take (Suc j) (f \<triangleright> n\<^sub>1)])))
   (f \<triangleright> n\<^sub>1) =
  e_take
   (Suc (GREATEST j.
            j < e_length (f \<triangleright> n\<^sub>1) \<and>
            0 < the (eval r_result1
                      [e_length (f \<triangleright> n\<^sub>1), i,
                       e_take (Suc j) (f \<triangleright> n\<^sub>1)])))
   (f \<triangleright> n\<^sub>2)
  (GREATEST j.
      j < e_length (f \<triangleright> n\<^sub>1) \<and>
      0 < the (eval r_result1
                [e_length (f \<triangleright> n\<^sub>1), i,
                 e_take (Suc j) (f \<triangleright> n\<^sub>1)]))
  < e_length (f \<triangleright> n\<^sub>1) \<and>
  0 < the (eval r_result1
            [e_length (f \<triangleright> n\<^sub>1), i,
             e_take
              (Suc (GREATEST j.
                       j < e_length (f \<triangleright> n\<^sub>1) \<and>
                       0 < the (eval r_result1
                                 [e_length (f \<triangleright> n\<^sub>1),
                                  i, e_take (Suc j)
(f \<triangleright> n\<^sub>1)])))
              (f \<triangleright> n\<^sub>1)])
  (GREATEST j.
      j < e_length (f \<triangleright> n\<^sub>1) \<and>
      0 < the (eval r_result1
                [e_length (f \<triangleright> n\<^sub>1), i,
                 e_take (Suc j) (f \<triangleright> n\<^sub>1)]))
  < e_length (f \<triangleright> n\<^sub>2)

goal (1 subgoal):
 1. 0 < the (eval r_result1
              [e_length (f \<triangleright> n\<^sub>1), i,
               e_take
                (Suc (GREATEST j.
                         j < e_length (f \<triangleright> n\<^sub>1) \<and>
                         0 < the (eval r_result1
                                   [e_length (f \<triangleright> n\<^sub>1),
                                    i, e_take (Suc j)
  (f \<triangleright> n\<^sub>1)])))
                (f \<triangleright> n\<^sub>2)])


proof (prove)
goal (1 subgoal):
 1. pairwise (\<lambda>i j. disjnt (ball (a i) (r i)) (ball (a j) (r j))) C


proof (prove)
using this:
  \<k> \<le> des.\<v> - 1
  ?bl \<in># \<B>\<^sup>C \<Longrightarrow> int (card ?bl) = des.\<v> - \<k>

goal (1 subgoal):
 1. block_design \<V> \<B>\<^sup>C (des.\<v> - \<k>)


proof (prove)
goal (1 subgoal):
 1. map_pmf con
     (map_pmf noc
       (Sum_pmf (8 / 10) (Partial_Cost_Model.config'_rand BIT Da qs)
         (Partial_Cost_Model.config'_rand
           (Partial_Cost_Model.embed (rTS [])) Db qs))) =
    Sum_pmf (8 / 10) (Partial_Cost_Model.config'_rand BIT Da qs)
     (Partial_Cost_Model.config'_rand (Partial_Cost_Model.embed (rTS [])) Db
       qs)


proof (prove)
goal (1 subgoal):
 1. (\<forall>a\<in>a. a \<sharp> Alts e1 e2) =
    ((\<forall>a\<in>a. a \<sharp> e1) \<and>
     (\<forall>a\<in>a. a \<sharp> e2))


proof (prove)
using this:
  l_set_shadow_root ShadowRootClass.type_wf set_shadow_root
   set_shadow_root_locs
  l_get_tag_name ShadowRootClass.type_wf get_tag_name get_tag_name_locs

goal (1 subgoal):
 1. l_set_shadow_root_get_tag_name set_shadow_root_locs get_tag_name_locs


proof (prove)
using this:
  \<lbrakk>?P \<in> S; ?P \<approx>\<cdot> ?Q\<rbrakk>
  \<Longrightarrow> ?Q \<in> S
  P \<Turnstile> Disj (Abs_bset (characteristic_weak_formula ` S)) =
  (\<exists>x\<in>characteristic_weak_formula ` S. P \<Turnstile> x)
  ?Q \<Turnstile> characteristic_weak_formula ?P = ?P \<approx>\<cdot> ?Q
  ?Q \<Turnstile> characteristic_weak_formula ?P = (?P \<equiv>\<cdot> ?Q)
  ?P \<equiv>\<cdot> ?Q \<equiv>
  \<forall>x.
     weak_formula x \<longrightarrow> ?P \<Turnstile> x = ?Q \<Turnstile> x

goal (1 subgoal):
 1. P \<Turnstile> Disj (Abs_bset (characteristic_weak_formula ` S)) =
    (P \<in> S)


proof (prove)
goal (1 subgoal):
 1. r *\<^sub>R b = One \<Longrightarrow> b = (1 / r) *\<^sub>R One


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>connectedin X C; separatedin X S T;
     C \<subseteq> S \<union> T\<rbrakk>
    \<Longrightarrow> C \<subseteq> S \<or> C \<subseteq> T


proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. arcosh (f x)) \<longlongrightarrow> arcosh a) F


proof (prove)
using this:
  (rev_H uw \<rightleftharpoons>\<^sub>F rev_H vw)
   (edge_succ HM (rev_G a)) =
  edge_succ HM (rev_G a)

goal (1 subgoal):
 1. perm_rem (rev_H vw) (perm_rem (rev_H uw) (edge_succ HM)) (rev_G a) =
    edge_succ HM (rev_G a)


proof (prove)
goal (1 subgoal):
 1. of_nat (card X) * Bnd \<le> of_nat k * Bnd


proof (prove)
goal (1 subgoal):
 1. real_of_rat c *
    (\<Prod>ai\<in>set fs.
       case ai of (a, i) \<Rightarrow> rpoly (a ^ Suc i) x) =
    real_of_rat c *
    (\<Prod>ai\<in>set fs.
       case ai of (a, i) \<Rightarrow> rpoly a x ^ Suc i)


proof (prove)
goal (1 subgoal):
 1. integrable (lebesgue_on {a..b})
     (\<lambda>x. if x = a then d\<^sup>2 else 0)


proof (prove)
goal (1 subgoal):
 1. non_inf {(a, b). b < a}


proof (state)
this:
  a \<cdot>\<^sub>B \<i>[a] =
  \<i>[a] \<cdot>\<^sub>B cmp (a, a) \<cdot>\<^sub>B a \<star>\<^sub>B a

goal (1 subgoal):
 1. a \<cdot>\<^sub>B \<i>[map\<^sub>0 a] =
    (local.map \<i>[a] \<cdot>\<^sub>B cmp (a, a)) \<cdot>\<^sub>B
    a \<star>\<^sub>B a


proof (prove)
goal (1 subgoal):
 1. \<And>sigma. Implementation sigma \<Longrightarrow> EEx Hist sigma


proof (prove)
using this:
  Discr (Inr (call.Let l binds c', \<beta>, ve, b)) \<in> arg_poss p

goal (1 subgoal):
 1. (l \<in> labels p &&&
     c' \<in> calls p &&& fst ` set binds \<subseteq> vars p) &&&
    snd ` set binds \<subseteq> lambdas p &&&
    \<beta> \<in> maps_over (labels p) UNIV &&&
    ve \<in> smaps_over (vars p \<times> UNIV) (proc_poss p)


proof (prove)
goal (1 subgoal):
 1. (\<nu> X \<bullet> X) = false


proof (prove)
goal (1 subgoal):
 1. set (roots_of_real_main p) = {x. poly p x = 0}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i < length ts; \<forall>sop\<in>write_sops sb. valid_sop sop;
     \<forall>sop\<in>store_sops is. valid_sop sop\<rbrakk>
    \<Longrightarrow> valid_sops
                       (ts[i := (p, is, xs, sb, \<D>, \<O>, \<R>)])


proof (prove)
using this:
  b \<in> ideal (ideal B \<div> x)

goal (1 subgoal):
 1. b \<in> ideal B \<div> x


proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. the_elem (f ` x)) \<circ> (+>) I
    \<in> ring_hom R (image_ring f R)


proof (prove)
goal (1 subgoal):
 1. integrable M (\<lambda>x. indicat_real {a..} x *\<^sub>R norm (f x))


proof (prove)
using this:
  E F D CongA G F D

goal (1 subgoal):
 1. F D E CongA F D G


proof (prove)
goal (1 subgoal):
 1. strong_reduction_simulation (TRel\<^sup>+) Target \<and>
    (\<forall>P Q Q'.
        (P, Q) \<in> TRel\<^sup>+ \<and>
        Q \<longmapsto>Target Q' \<longrightarrow>
        (\<exists>P'.
            P \<longmapsto>Target P' \<and> (P', Q') \<in> TRel\<^sup>+))


proof (chain)
picking this:
  p\<^sub>0 \<notin> ps\<^sub>L \<or> p\<^sub>1 \<notin> ps\<^sub>L
  p\<^sub>0 \<notin> ps\<^sub>R \<or> p\<^sub>1 \<notin> ps\<^sub>R


proof (prove)
goal (1 subgoal):
 1. lincomb
     (\<lambda>v.
         (if v \<in> b1 then a1 v else \<zero>) \<oplus>
         (if v \<in> b2 then a2 v else \<zero>))
     (b1 \<union> b2) =
    x


proof (prove)
goal (1 subgoal):
 1. \<And>xa xaa.
       \<lbrakk>xa \<in> {..<n}; xaa \<in> {..<n}\<rbrakk>
       \<Longrightarrow> cnj (x $ xa) *\<^sub>C
                         y $ xaa *\<^sub>C
                         (canonical_basis ! xa \<bullet>\<^sub>C
                          canonical_basis ! xaa) =
                         cnj (x $ xa) *\<^sub>C
                         y $ xaa *\<^sub>C (if xa = xaa then 1 else 0)


proof (prove)
using this:
  finite A
  A \<noteq> {}
  x \<notin> A

goal (1 subgoal):
 1. card (insert x ` Set.filter (odd \<circ> card) (Pow A)) =
    card (Set.filter (odd \<circ> card) (Pow A))


proof (prove)
goal (1 subgoal):
 1. basis_enum_of_vec ` vec_of_basis_enum ` cspan X =
    basis_enum_of_vec ` local.span (vec_of_basis_enum ` X)


proof (prove)
using this:
  \<forall>v F. [\<lparr>F,x\<rparr> in v] = [\<lparr>F,y\<rparr> in v]

goal (1 subgoal):
 1. \<forall>v.
       (\<omega>\<nu> o\<^sub>1 \<in> ex1 r v) =
       (\<omega>\<nu> o\<^sub>2 \<in> ex1 r v)


proof (prove)
using this:
  fixed_length_sublist (concat (map vec As)) (prod_list ds) i = vec (As ! i)
  (\<And>A.
      A \<in> set ?As \<Longrightarrow> dims A = ?ds) \<Longrightarrow>
  dims (subtensor_combine ?ds ?As) = length ?As # ?ds
  (\<And>A.
      A \<in> set ?As \<Longrightarrow> dims A = ?ds) \<Longrightarrow>
  vec (subtensor_combine ?ds ?As) = concat (map vec ?As)

goal (1 subgoal):
 1. tensor_from_vec (tl (dims (subtensor_combine ds As)))
     (fixed_length_sublist (vec (subtensor_combine ds As))
       (prod_list (tl (dims (subtensor_combine ds As)))) i) =
    As ! i


proof (prove)
goal (1 subgoal):
 1. ((A ===> A ===> A) ===> A ===> (A ===> A ===> A) ===> (=))
     (comm_semiring_0_ow (Collect (Domainp A)))
     (\<lambda>a b c.
         class.comm_semiring_0 a b c \<and>
         (\<forall>a b.
             a \<in> UNIV \<longrightarrow>
             b \<in> UNIV \<longrightarrow> c a b \<in> UNIV) \<and>
         b \<in> UNIV)


proof (prove)
using this:
  Digraph_Component.connected G
  u \<in> verts G
  v \<in> verts G
  \<lbrakk>?w2 \<in> verts G; u \<noteq> ?w2; v \<noteq> ?w2\<rbrakk>
  \<Longrightarrow> in_degree G ?w2 = out_degree G ?w2
  in_degree G u + 1 = out_degree G u
  out_degree G v + 1 = in_degree G v

goal (1 subgoal):
 1. \<exists>u p v. euler_trail u p v \<and> u \<noteq> v


proof (prove)
goal (1 subgoal):
 1. fpxs_const (1::'a) = 1


proof (prove)
goal (2 subgoals):
 1. t \<in> set (args
                  (worst_chain (\<lambda>t s. ground t \<and> t >\<^sub>t s)
                    (\<lambda>t s. hsize s < hsize t) i)) \<Longrightarrow>
    {u. worst_chain (\<lambda>t s. ground t \<and> t >\<^sub>t s)
         (\<lambda>t s. hsize s < hsize t) i \<rhd>\<^sub>e\<^sub>m\<^sub>b
        u}
    \<in> range
           (\<lambda>i.
               {u. worst_chain (\<lambda>t s. ground t \<and> t >\<^sub>t s)
                    (\<lambda>t s. hsize s < hsize t)
                    i \<rhd>\<^sub>e\<^sub>m\<^sub>b
                   u})
 2. t \<in> set (args
                  (worst_chain (\<lambda>t s. ground t \<and> t >\<^sub>t s)
                    (\<lambda>t s. hsize s < hsize t) i)) \<Longrightarrow>
    t \<in> {u. worst_chain (\<lambda>t s. ground t \<and> t >\<^sub>t s)
                 (\<lambda>t s. hsize s < hsize t)
                 i \<rhd>\<^sub>e\<^sub>m\<^sub>b
                u}


proof (prove)
using this:
  {0..t} = {0--t}

goal (1 subgoal):
 1. {s--0} \<subseteq> {0--t}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>B \<subseteq> A2; F \<in> A1 - B co A1 \<union> B;
     F \<in> A2 - C co A2 \<union> C\<rbrakk>
    \<Longrightarrow> F \<in> A1 \<union> A2 - C co
                              A1 \<union> A2 \<union> C


proof (state)
this:
  \<forall>X x.
     derivation X \<longrightarrow>
     x \<in> X \<longrightarrow> f x \<sqsubseteq> f x

goal (1 subgoal):
 1. \<exists>p.
       extreme {q \<in> A. f q = q} (\<lambda>x y. y \<sqsubseteq> x) p


proof (prove)
using this:
  A \<in> \
  C \<in> A
  B \<in> \
  chamber C
  chamber C'
  C' \<in> B
  ChamberComplexIsomorphism A (CoxeterComplex.TheComplex S) \<psi>
  B' \<in> \
  C \<in> B'
  C' \<in> B'

goal (1 subgoal):
 1. \<exists>\<phi>.
       ChamberComplexIsomorphism B (CoxeterComplex.TheComplex S) \<phi>


proof (prove)
using this:
  finite L
  finite (L \<union> FV t) \<Longrightarrow>
  \<exists>s p.
     s \<notin> L \<union> FV t \<and>
     p \<notin> L \<union> FV t \<and> s \<noteq> p

goal (1 subgoal):
 1. (\<And>s p.
        \<lbrakk>s \<notin> L; p \<notin> L; s \<noteq> p; s \<notin> FV t;
         p \<notin> FV t\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  lookup_pp (rep_nat_pp (PP_oalist xs)) (rep_nat y) =
  lookup_pp (rep_nat_pp (PP_oalist ys)) (rep_nat y)

goal (1 subgoal):
 1. OAlist_tc_lookup xs y = OAlist_tc_lookup ys y


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sorted (map fst kvs); distinct (map fst kvs)\<rbrakk>
    \<Longrightarrow> is_rbt (rbtreeify kvs)


proof (state)
this:
  r1 < r2 \<or> r1 = r2 \<or> r2 < r1

goal (1 subgoal):
 1. v = w


proof (prove)
using this:
  finite (pderivs_lang ?A ?r)

goal (1 subgoal):
 1. card (Timess (pderivs_lang A r) s) \<le> card (pderivs_lang A r)


proof (prove)
goal (1 subgoal):
 1. ((M ===> (S ===> M) ===> M) ===>
     (S ===> (A ===> M) ===> M) ===>
     rel_nondetT M ===> (A ===> rel_nondetT M) ===> rel_nondetT M)
     nondetM_base.bind_nondet nondetM_base.bind_nondet


proof (prove)
goal (1 subgoal):
 1. map of_int_hom.vec_hom fs ! i - gs2.gso i
    \<in> gs.span (gs1.gso ` {0..<i})


proof (prove)
using this:
  strict_border ?x ?y = (border ?x ?y \<and> \<not> border ?y ?x)
  \<lbrakk>border ?a ?b; border ?b ?c\<rbrakk>
  \<Longrightarrow> border ?a ?c
  border (take (\<ff> ?s ?i - 1) ?s) (take ?i ?s)

goal (1 subgoal):
 1. \<lbrakk>y = \<ff> s (i - 1);
     strict_border (take (i - 1) s) (take (j - 1) s)\<rbrakk>
    \<Longrightarrow> strict_border (take (y - 1) s) (take (j - 1) s)


proof (prove)
using this:
  a \<in> (\<lambda>a. if a \<in> A then the_inv_into A f' (f a) else a) ` A

goal (1 subgoal):
 1. (\<And>a'.
        \<lbrakk>a' \<in> A; a = the_inv_into A f' (f a')\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  A \<noteq> X

goal (1 subgoal):
 1. A B Perp P A \<and> Col A B T \<and> Bet C T P


proof (prove)
goal (1 subgoal):
 1. degree p = 4 \<Longrightarrow>
    \<exists>a b c d e. p = [:e, d, c, b, a:] \<and> a \<noteq> (0::'a)


proof (prove)
using this:
  Postdomination.standard_control_dependence src trg
   (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit)
   NewExit n n'

goal (1 subgoal):
 1. \<exists>as.
       CFG.path src trg
        (lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit) n
        as n' \<and>
       as \<noteq> []


proof (prove)
using this:
  types_agree t1 a

goal (1 subgoal):
 1. \<lparr>s;vs;vs_to_es ves @
                 [$b_e]\<rparr> \<leadsto>_ i \<lparr>s';vs';es'\<rparr>


proof (prove)
goal (1 subgoal):
 1. Fun f U \<cdot> \<theta> = Fun f U &&&
    Fun f T \<cdot> \<theta> = Fun f T


proof (prove)
using this:
  \<lbrakk>Ana ?t = (?K, ?R);
   \<And>g S. Fun g S \<sqsubseteq> ?t \<Longrightarrow> length S = arity g;
   ?k \<in> set ?K; Fun ?f ?T \<sqsubseteq> ?k\<rbrakk>
  \<Longrightarrow> length ?T = arity ?f

goal (1 subgoal):
 1. \<lbrakk>Ana t = (K, T);
     \<forall>f T.
        Fun f T \<sqsubseteq> t \<longrightarrow> length T = arity f;
     k \<in> set K\<rbrakk>
    \<Longrightarrow> \<forall>f T.
                         Fun f T \<sqsubseteq> k \<longrightarrow>
                         length T = arity f


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>D \<subseteq> C; project h C F \<in> stable A\<rbrakk>
    \<Longrightarrow> project h D F \<in> stable A


proof (prove)
using this:
  ide g
  trg ?F \<equiv> if arr ?F then MkIde (E.Trg (Dom ?F)) else null

goal (1 subgoal):
 1. E.Trg (Dom g) = Dom (trg g)


proof (prove)
using this:
  SP \<in>S P

goal (1 subgoal):
 1. P \<lesssim>\<lbrakk>\<cdot>\<rbrakk>LT<TRel> P


proof (state)
goal (1 subgoal):
 1. set_kdt r \<inter> cbox p\<^sub>0 p\<^sub>1 = {}


proof (prove)
goal (1 subgoal):
 1. \<And>node_ptr.
       \<lbrakk>\<forall>node_ptr\<in>fset (node_ptr_kinds h').
                   (\<exists>document_ptr.
                       (document_ptr =
                        cast\<^sub>s\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>r\<^sub>o\<^sub>o\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r
                         shadow_root_ptr \<or>
                        document_ptr |\<in>| document_ptr_kinds h') \<and>
                       node_ptr
                       \<in> set |h2 \<turnstile> get_disconnected_nodes
             document_ptr|\<^sub>r) \<or>
                   (\<exists>parent_ptr.
                       parent_ptr |\<in>| object_ptr_kinds h2 \<and>
                       node_ptr
                       \<in> set |h2 \<turnstile> get_child_nodes
             parent_ptr|\<^sub>r);
        node_ptr |\<in>| node_ptr_kinds h';
        \<forall>parent_ptr.
           parent_ptr |\<in>| object_ptr_kinds h' \<longrightarrow>
           node_ptr
           \<notin> set |h' \<turnstile> get_child_nodes
    parent_ptr|\<^sub>r\<rbrakk>
       \<Longrightarrow> \<exists>document_ptr.
                            document_ptr |\<in>|
                            document_ptr_kinds h' \<and>
                            node_ptr
                            \<in> set |h'
 \<turnstile> get_disconnected_nodes document_ptr|\<^sub>r


proof (prove)
using this:
  d \<sqinter> top * e\<^sup>T * H \<sqinter>
  (H * d\<^sup>T)\<^sup>\<star> * H * a\<^sup>T * top \<noteq>
  bot

goal (1 subgoal):
 1. times_top_class.total
     (top *
      (d \<sqinter> top * e\<^sup>T * H \<sqinter>
       (H * d\<^sup>T)\<^sup>\<star> * H * a\<^sup>T * top))


proof (prove)
goal (1 subgoal):
 1. move_matrix (A * B) j i = move_matrix A j 0 * move_matrix B 0 i


proof (prove)
using this:
  LLL_invariant upw i fs
  set (map of_int_hom.vec_hom fs) \<subseteq> Rn
  ?i < length (map of_int_hom.vec_hom fs) \<Longrightarrow>
  map of_int_hom.vec_hom fs ! ?i \<in> Rn
  ?i < length (map of_int_hom.vec_hom fs) \<Longrightarrow>
  gs'.gso ?i \<in> Rn

goal (1 subgoal):
 1. ((gs.lin_indpt_list (map of_int_hom.vec_hom fs) \<and>
      length (map of_int_hom.vec_hom fs) = m) \<and>
     set fs \<subseteq> carrier_vec n \<and>
     (\<forall>i<m. fs ! i \<in> carrier_vec n) \<and>
     (\<forall>i<m. gs'.gso i \<in> Rn)) \<and>
    (length fs = m \<and>
     lattice_of fs = L \<and> gs'.weakly_reduced \<alpha> i) \<and>
    i \<le> m \<and>
    gs'.reduced \<alpha> i \<and> (upw \<or> \<mu>_small fs i)


proof (prove)
using this:
  c' = While e c \<and> mds' \<le> mdsa
  \<langle>While ?e ?c, ?mds, ?mem\<rangle> \<leadsto>
  \<langle>Stmt.If ?e (?c ;; While ?e ?c) Stop, ?mds, ?mem\<rangle>
  \<langle>While ?e ?c, ?mds, ?mem\<rangle> \<leadsto>
  \<langle>?c', ?mds', ?mem'\<rangle> \<Longrightarrow>
  ?c' = Stmt.If ?e (?c ;; While ?e ?c) Stop \<and>
  ?mds' = ?mds \<and> ?mem' = ?mem

goal (1 subgoal):
 1. (x \<in> mds' GuarNoReadOrWrite \<longrightarrow>
     (\<forall>mds mem c'a mds' mem'.
         \<langle>c', mds, mem\<rangle> \<leadsto>
         \<langle>c'a, mds', mem'\<rangle> \<longrightarrow>
         (\<forall>x\<in>{x} \<union> \<C>_vars x.
             \<forall>v.
                \<langle>c', mds, mem(x := v)\<rangle> \<leadsto>
                \<langle>c'a, mds', mem'(x := v)\<rangle>))) \<and>
    (x \<in> mds' GuarNoWrite \<longrightarrow>
     (\<forall>mds mem c'a mds' mem'.
         \<langle>c', mds, mem\<rangle> \<leadsto>
         \<langle>c'a, mds', mem'\<rangle> \<longrightarrow>
         mem x = mem' x \<and> dma mem x = dma mem' x))


proof (prove)
using this:
  select_return_top cts c1 c2 = ctm
  ctm \<noteq> Bot

goal (1 subgoal):
 1. \<exists>xs. ctm = TopType xs


proof (prove)
using this:
  finite \<Gamma>' \<and>
  \<Gamma>' \<subseteq> \<Gamma> \<and> \<Gamma>' \<TTurnstile> F
  \<Gamma>' = set \<Gamma>''

goal (1 subgoal):
 1. thesis


proof (prove)
using this:
  PROP ?psi \<Longrightarrow> PROP ?psi
  integral {0..1}
   (\<lambda>s.
       (1 - s) *\<^sub>R
       (h\<^sup>2 * p\<^sup>2) *\<^sub>R
       f'' (t + s * (h * p), x t + (s * (h * p)) *\<^sub>R f (t, x t)) $
       (1, f (t, x t)) $
       (1, f (t, x t))) =
  (discrete_evolution (rk2_increment p (\<lambda>t x. f (t, x))) (t + h) t
    (x t) -
   x t -
   h *\<^sub>R f (t, x t) -
   (h\<^sup>2 / 2) *\<^sub>R f' (t, x t) $ (1, f (t, x t))) /\<^sub>R
  (h / (p * 2))
  ((\<lambda>s.
       (1 - s) *\<^sub>R
       (h\<^sup>2 * p\<^sup>2) *\<^sub>R
       f'' (t + s * (h * p), x t + (s * (h * p)) *\<^sub>R f (t, x t)) $
       (1, f (t, x t)) $
       (1, f (t, x t))) has_integral
   f ((t, x t) + (h * p) *\<^sub>R (1, f (t, x t))) - f (t, x t) -
   f' (t, x t) $ (h * p, (h * p) *\<^sub>R f (t, x t)))
   {0..1}

goal (1 subgoal):
 1. ((\<lambda>s.
         (1 - s) *\<^sub>R
         (h\<^sup>2 * p\<^sup>2) *\<^sub>R
         f'' (t + s * (h * p), x t + (s * (h * p)) *\<^sub>R f (t, x t)) $
         (1, f (t, x t)) $
         (1, f (t, x t))) has_integral
     (discrete_evolution (rk2_increment p (\<lambda>t x. f (t, x))) (t + h)
       t (x t) -
      x t -
      h *\<^sub>R f (t, x t) -
      (h\<^sup>2 / 2) *\<^sub>R f' (t, x t) $ (1, f (t, x t))) /\<^sub>R
     (h / (p * 2)))
     {0..1}


proof (prove)
using this:
  \<forall>c\<in>{wax \<sigma> |\<sigma>.
                  \<not> unprot \<sigma> \<and>
                  (\<not> isRes \<sigma> \<or> protCl \<sigma>)}.
     satC \<xi> c
  \<not> unprot \<sigma>
  \<not> isRes \<sigma> \<or> protCl \<sigma>

goal (1 subgoal):
 1. satC \<xi> (wax \<sigma>)


proof (prove)
using this:
  Calculus SWB = Source
  Calculus TWB = Target

goal (1 subgoal):
 1. Calculus
     \<lparr>Calculus = STCal (Calculus SWB) (Calculus TWB),
        HasBarb =
          \<lambda>P a.
             (\<exists>SP. SP \<in>S P \<and> SP\<down><SWB>a) \<or>
             (\<exists>TP. TP \<in>T P \<and> TP\<down><TWB>a)\<rparr> =
    STCal Source Target


proof (prove)
using this:
  Class a = Class g

goal (1 subgoal):
 1. a \<in> Class g


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>dist_perm xs ys; Suc n < length xs\<rbrakk>
    \<Longrightarrow> x < y in swap n xs =
                      (x < y in xs \<and>
                       \<not> (x = xs ! n \<and> y = xs ! Suc n) \<or>
                       x = xs ! Suc n \<and> y = xs ! n)


proof (prove)
goal (1 subgoal):
 1. (\<And>h.
        \<lbrakk>\<And>p. h p 0 = 0;
         \<And>p c1 c2. h p (c1 - c2) = h p c1 - h p c2;
         \<And>p X c.
            singular_chain p X c \<Longrightarrow>
            singular_chain (Suc p) X (h p c);
         \<And>p X c.
            singular_chain p X c \<Longrightarrow>
            chain_boundary (Suc p) (h p c) +
            h (p - Suc 0) (chain_boundary p c) =
            (singular_subdivision p ^^ m) c - c\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. opnet (\<lambda>i. optoy i \<langle>\<langle>\<^bsub>i\<^esub> qmsg)
     n \<Turnstile> (otherwith nos_inc (net_tree_ips n) (oarrivemsg msg_ok),
                     other nos_inc (net_tree_ips n) \<rightarrow>)
                     global
                      (\<lambda>\<sigma>.
                          \<forall>i\<in>net_tree_ips n.
                             no (\<sigma> i)
                             \<le> no (\<sigma> (nhid (\<sigma> i))))


proof (prove)
goal (1 subgoal):
 1. countable (SOME B. countable B \<and> topological_basis B) &&&
    topological_basis (SOME B. countable B \<and> topological_basis B)


proof (prove)
goal (1 subgoal):
 1. \<not> simple_matches simple_match_none p


proof (prove)
goal (1 subgoal):
 1. \<And>n.
       \<lbrakk>x < a; x * ordinal_of_nat n < a\<rbrakk>
       \<Longrightarrow> x * ordinal_of_nat (Suc n) < a


proof (prove)
using this:
  euler_liar 1 p
  int x * int y mod int p = 1
  1 < p

goal (1 subgoal):
 1. euler_liar (int x * int y) p


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>equiv V R; (x, y) \<in> R\<rbrakk>
    \<Longrightarrow> (y, x) \<in> R


proof (prove)
using this:
  a = (l, b)

goal (1 subgoal):
 1. t \<in> trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t
             (S \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<delta>) \<or>
    t \<in> trms\<^sub>s\<^sub>s\<^sub>t\<^sub>p
             (b \<cdot>\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<delta>)


proof (prove)
goal (1 subgoal):
 1. start_heap P (addr_of_sys_xcpt C) = \<lfloor>blank P C\<rfloor>


proof (prove)
using this:
  \<lbrakk>basis_wf bs; (l expands_to L) bs; trimmed_pos L\<rbrakk>
  \<Longrightarrow> \<forall>\<^sub>F x in at_top. 0 < l x
  (l expands_to L) bs
  \<forall>\<^sub>F x in at_top. l x \<le> f x
  trimmed_pos L
  basis_wf bs

goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. 0 < l x


proof (prove)
goal (1 subgoal):
 1. \<And>x y A.
       \<lbrakk>bi_unique A; rel_set (rel_set A) x y\<rbrakk>
       \<Longrightarrow> rel_set A
                          (if finite (\<Union> x) then \<Union> x else {})
                          (if finite (\<Union> y) then \<Union> y else {})


proof (prove)
using this:
  enat n < llength P

goal (1 subgoal):
 1. vmc_path G (ldropn n P) (P $ n) p \<sigma>


proof (prove)
goal (1 subgoal):
 1. invariant3p (mredT P)
     ({s. sync_es_ok (thr s) (shr s) \<and>
          lock_ok (locks s) (thr s)} \<inter>
      {s. \<exists>Es. sconf_type_ts_ok Es (thr s) (shr s)} \<inter>
      {s. def_ass_ts_ok (thr s) (shr s)})


proof (prove)
using this:
  \<lbrakk>?n \<in> num; ?\<phi> \<in> fmla; Fvars ?\<phi> = {};
   isTrue (B.neg (PPf ?n \<langle>?\<phi>\<rangle>))\<rbrakk>
  \<Longrightarrow> bprv (B.neg (PPf ?n \<langle>?\<phi>\<rangle>))

goal (1 subgoal):
 1. \<And>n \<phi>.
       \<lbrakk>n \<in> num; \<phi> \<in> fmla; Fvars \<phi> = {}\<rbrakk>
       \<Longrightarrow> isTrue (B.neg (PPf n \<langle>\<phi>\<rangle>)) =
                         bprv (B.neg (PPf n \<langle>\<phi>\<rangle>))


proof (prove)
goal (1 subgoal):
 1. concrete_category {A. |A| <o \<AA>}
     (\<lambda>A B. extensional A \<inter> (A \<rightarrow> B))
     (restrict (\<lambda>x. x)) (\<lambda>C B. compose)


proof (prove)
using this:
  i < dim_row U\<^sub>f
  j < dim_col U\<^sub>f

goal (1 subgoal):
 1. U\<^sub>f\<^sup>t $$ (i, j) = U\<^sub>f $$ (i, j)


proof (prove)
using this:
  derivable D P S \<theta> FirstOrder C'
  \<forall>P C' D \<theta>.
     derivable D P S \<theta> FirstOrder C' \<longrightarrow> D \<in> S

goal (1 subgoal):
 1. D \<in> S


proof (prove)
goal (1 subgoal):
 1. x \<sharp> \<theta><\<Gamma>> = x \<sharp> \<Gamma>


proof (prove)
goal (1 subgoal):
 1. \<iota> \<in> F.Inf_from M


proof (prove)
goal (3 subgoals):
 1. \<And>par body l0 G C m T MI k la codea a b ins.
       \<lbrakk>\<Sigma>\<down>(a, b) = Some n;
        MST\<down>(a, b) = Some (mkSPEC (Cachera n) Anno2);
        mbody_is a b (par, body, l0); MST\<down>(C, m) = Some (T, MI, Anno);
        derivAssum G C m (la + 1) (Cachera k); f = (a, b);
        Anno\<down>la = None; ins_is C m la ins;
        codea[la\<mapsto>invokeS a b]\<down>la = Some ins\<rbrakk>
       \<Longrightarrow> deriv G C m la (Cachera (n + k))
 2. \<And>par body l0 l code code1 l1 G C m T MI k la codea x fa args OUT.
       \<lbrakk>\<Sigma>\<down>f = Some n;
        MST\<down>f = Some (mkSPEC (Cachera n) Anno2);
        mbody_is (fst f) (snd f) (par, body, l0);
        MST\<down>(C, m) = Some (T, MI, Anno); Segment C m l l1 code1;
        derivAssum G C m l1 (Cachera k); l = la; code = codea;
        CallPrim f [] = CallPrim fa (x # args); (code1, l1) = OUT;
        (la + 1, codea[la\<mapsto>load x], CallPrim fa args, OUT)
        \<in> compilePrim\<rbrakk>
       \<Longrightarrow> deriv G C m l (Cachera (n + k))
 3. \<And>a args.
       \<Sigma>\<down>f = Some n \<longrightarrow>
       MST\<down>(fst f, snd f) =
       Some (mkSPEC (Cachera n) Anno2) \<longrightarrow>
       (\<exists>par body l0.
           mbody_is (fst f) (snd f) (par, body, l0)) \<longrightarrow>
       (\<forall>l code code1 l1 G C m T MI k.
           (l, code, CallPrim f args, code1, l1)
           \<in> compilePrim \<longrightarrow>
           MST\<down>(C, m) = Some (T, MI, Anno) \<longrightarrow>
           Segment C m l l1 code1 \<longrightarrow>
           derivAssum G C m l1 (Cachera k) \<longrightarrow>
           deriv G C m l (Cachera (n + k))) \<Longrightarrow>
       \<Sigma>\<down>f = Some n \<longrightarrow>
       MST\<down>(fst f, snd f) =
       Some (mkSPEC (Cachera n) Anno2) \<longrightarrow>
       (\<exists>par body l0.
           mbody_is (fst f) (snd f) (par, body, l0)) \<longrightarrow>
       (\<forall>l code code1 l1 G C m T MI k.
           (l, code, CallPrim f (a # args), code1, l1)
           \<in> compilePrim \<longrightarrow>
           MST\<down>(C, m) = Some (T, MI, Anno) \<longrightarrow>
           Segment C m l l1 code1 \<longrightarrow>
           derivAssum G C m l1 (Cachera k) \<longrightarrow>
           deriv G C m l (Cachera (n + k)))


proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. f (g x)) has_vderiv_on
     (\<lambda>x. g' x *\<^sub>R f' (g x)))
     T


proof (prove)
goal (1 subgoal):
 1. Formula.formula.Abs_formula
     (L_transform_formula (FL_Formula.Pred f \<phi>)) =
    Formula.Act (Eff f) (Formula.Pred \<phi>)


proof (prove)
using this:
  ?A \<in> carrier_mat ?n ?n \<Longrightarrow>
  invertible_mat ?A = (det ?A \<noteq> (0::?'a))
  M_mat signs subsets \<in> carrier_mat (length signs) (length signs)

goal (1 subgoal):
 1. invertible_mat
     (take_rows_from_matrix
       (reduce_mat_cols (M_mat signs subsets)
         (solve_for_lhs p qs subsets (M_mat signs subsets)))
       (rows_to_keep
         (reduce_mat_cols (M_mat signs subsets)
           (solve_for_lhs p qs subsets (M_mat signs subsets)))))


proof (prove)
goal (1 subgoal):
 1. \<exists>U.
       openin (top_of_set T) U \<and>
       (\<exists>v.
           Q v \<and>
           y \<in> U \<and> U \<subseteq> v \<and> v \<subseteq> W)


proof (state)
this:
  rational_preference (\<P> outcomes) \<R> \<and>
  independent_vnm (\<P> outcomes) \<R> \<and>
  continuous_vnm (\<P> outcomes) \<R>

goal (2 subgoals):
 1. rational_preference (\<P> outcomes) \<R> \<and>
    independent_vnm (\<P> outcomes) \<R> \<and>
    continuous_vnm (\<P> outcomes) \<R> \<Longrightarrow>
    \<exists>u. vNM_utility outcomes \<R> u
 2. \<exists>u. vNM_utility outcomes \<R> u \<Longrightarrow>
    rational_preference (\<P> outcomes) \<R> \<and>
    independent_vnm (\<P> outcomes) \<R> \<and>
    continuous_vnm (\<P> outcomes) \<R>


proof (prove)
goal (1 subgoal):
 1. plus_p p (to_int_mod_ring x) (to_int_mod_ring y) =
    to_int_mod_ring (x + y)


proof (prove)
goal (1 subgoal):
 1. (v \<in> fmdom' (fst a) \<longrightarrow>
     v \<in> fmdom' (fst (action_proj a (prob_dom PROB - vs)))) \<and>
    (v \<in> fmdom' (snd a) \<longrightarrow>
     v \<in> fmdom' (snd (action_proj a (prob_dom PROB - vs))))


proof (prove)
using this:
  FW M n (v c) 0 = len M (v c) 0 xs
  set xs \<subseteq> {0..n}
  0 \<notin> set xs
  v c \<notin> set xs
  distinct xs
  \<forall>k\<le>n. 0 < k \<longrightarrow> (\<exists>c. v c = k)
  v c \<le> n

goal (1 subgoal):
 1. dbm_entry_val u (Some c) None (len M (v c) 0 xs)


proof (prove)
goal (1 subgoal):
 1. (rel_id A ===> (A ===> rel_id A) ===> rel_id A) bind_id bind_id


proof (prove)
using this:
  val_Zp (f \<bullet> a) < val_Zp (f \<bullet> ns (Suc k))

goal (1 subgoal):
 1. val_Zp (a \<ominus> ns (Suc k))
    < val_Zp (ns (Suc k) \<ominus> ns (Suc (Suc k)))


proof (prove)
goal (1 subgoal):
 1. on_init param \<bind> (\<lambda>e. RETURN (empty_state e)) \<le>\<^sub>n
    SPEC I


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>a. to (from a) = a; \<And>b. from (to b) = b\<rbrakk>
    \<Longrightarrow> local.iso from to


proof (prove)
goal (1 subgoal):
 1. P * addrow a i' i B = P * addrow_mat nr a i' i * B


proof (prove)
goal (1 subgoal):
 1. card E =
    card
     ((\<lambda>x. x * 2 mod p) ` {0<..(p - 1) div 2} \<inter>
      {(p - 1) div 2<..})


proof (prove)
using this:
  u \<in> V - {s, t}
  QD_invar u f Qr

goal (1 subgoal):
 1. fifo_discharge f l Q
    \<le> SPEC
           (\<lambda>(f', l', Q').
               Height_Bounded_Labeling c s t f' l' \<and>
               Q_invar f' Q' \<and>
               ((f', l'), f, l) \<in> gap_algo_rel\<^sup>+)


proof (prove)
goal (1 subgoal):
 1. Height_Bounded_Labeling c s t f
     (let l' = relabel_effect f l u
      in if gap_precond l' (l u) then gap_effect l' (l u) else l')