proof (prove)
using this:
  length ps = length vs
  left_nesting f \<noteq> left_nesting g
  is_const (fst (strip_comb f))

goal (1 subgoal):
 1. match (list_comb f ps) (list_comb g vs) = None


proof (prove)
using this:
  \<lbrakk>?F \<triangleright> ?G \<triangleright> ?\<Gamma> \<union>
             AX10 \<turnstile>\<^sub>H
           ?H;
   ?\<Gamma> \<union> AX10 \<turnstile>\<^sub>H ?F;
   ?\<Gamma> \<union> AX10 \<turnstile>\<^sub>H ?G\<rbrakk>
  \<Longrightarrow> ?\<Gamma> \<union> AX10 \<turnstile>\<^sub>H ?H

goal (1 subgoal):
 1. \<lbrakk>F_ \<^bold>\<and> G_ \<in> S_;
     F_ \<triangleright> G_ \<triangleright> S_ \<union>
       AX10 \<turnstile>\<^sub>H
     \<bottom>\<rbrakk>
    \<Longrightarrow> S_ \<union> AX10 \<turnstile>\<^sub>H \<bottom>


proof (prove)
goal (1 subgoal):
 1. \<And>i. i < nr \<Longrightarrow> f i \<le> nc


proof (prove)
using this:
  monic v

goal (1 subgoal):
 1. degree (#v * w') = degree (#v) + degree w'


proof (prove)
goal (1 subgoal):
 1. \<Delta> (\<Sigma> f j) k = f k


proof (prove)
goal (1 subgoal):
 1. wstate_of_dstate ((C', i) # N', P, Q, n) \<leadsto>\<^sub>w\<^sup>*
    wstate_of_dstate ((C', i) # N', reduce_all C' P, Q, n)


proof (prove)
goal (1 subgoal):
 1. (\<exists>P'. P \<rightarrow>\<beta> P' \<and> M' = Fst P') \<or>
    (\<exists>A B. P = SimplyTyped.Pair A B \<and> M' = A)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>regular (prim_EP w v e); e \<le> w; injective w; w * v \<le> v;
     e \<le> v * - v\<^sup>T; vector v\<rbrakk>
    \<Longrightarrow> prim_W w v e = w


proof (prove)
goal (1 subgoal):
 1. OF_priority_match OF_match_fields_safe oft =
    OF_match_linear OF_match_fields_safe oft


proof (prove)
using this:
  wlp R1 w1 g1 f1 x1 l2 = wlp R2 w2 g2 f2 x2 l2
  wlp R1 w1 g1 f1 a l2 = wlp R2 w2 g2 f2 a l2

goal (1 subgoal):
 1. wlp R1 w1 g1 f1 x1 l1 = wlp R2 w2 g2 f2 x2 (a # l2)


proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. root n (f x)) expands_to zero_expansion) basis


proof (state)
this:
  \<exists>A b nr.
     A \<in> carrier_mat nr n \<and>
     b \<in> carrier_vec nr \<and> P = polyhedron A b

goal (2 subgoals):
 1. polytope P \<Longrightarrow>
    \<exists>A b nr bnd.
       A \<in> carrier_mat nr n \<and>
       b \<in> carrier_vec nr \<and>
       P = polyhedron A b \<and> P \<subseteq> Bounded_vec bnd
 2. \<exists>A b nr bnd.
       A \<in> carrier_mat nr n \<and>
       b \<in> carrier_vec nr \<and>
       P = polyhedron A b \<and>
       P \<subseteq> Bounded_vec bnd \<Longrightarrow>
    polytope P


proof (prove)
using this:
  t1 \<in> atrm
  t2 \<in> atrm
  fst ` set txs \<subseteq> atrm
  snd ` set txs \<subseteq> var
  distinct (map snd txs)
  t1 \<in> trm
  t2 \<in> trm
  fst ` set txs \<subseteq> trm
  z \<in> var
  z \<noteq> xx
  z \<noteq> yy
  z \<notin> FvarsT t1
  z \<notin> FvarsT t2
  z \<notin> \<Union> (FvarsT ` fst ` set txs)
  z \<notin> snd ` set txs

goal (1 subgoal):
 1. psubst (LLs t1 t2) txs = LLs (psubstT t1 txs) (psubstT t2 txs)


proof (prove)
using this:
  is_quantum_predicate (adjoint (U2 * U1) * P * (U2 * U1))

goal (1 subgoal):
 1. \<turnstile>\<^sub>p {adjoint (U2 * U1) * P * (U2 * U1)}
                         Utrans U1;; Utrans U2 {P}


proof (prove)
goal (1 subgoal):
 1. f sums infsetsum f UNIV


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>3 < length l; n = length l; valid (tl l); l ! 0 = B\<rbrakk>
    \<Longrightarrow> l \<in> (#) B `
                              {la.
                               length la = length l - Suc 0 \<and> valid la}


proof (prove)
goal (1 subgoal):
 1. Partial_Cost_Model.T_on' (rTS h0) ([x, y], h) qs = length qs - 2 \<and>
    TS_inv' (Partial_Cost_Model.config' (rTS h0) ([x, y], h) qs) (last qs)
     [x, y]


proof (prove)
goal (1 subgoal):
 1. \<And>a.
       \<lbrakk>S_inductive_set D; carrier D \<noteq> {};
        a \<in> carrier D\<rbrakk>
       \<Longrightarrow> \<exists>m. maximal m


proof (prove)
goal (1 subgoal):
 1. w * ((1::'a) \<sqinter> (v \<sqinter> - r) * top) =
    w * ((1::'a) \<sqinter> (v \<sqinter> - r) * (v \<sqinter> - r)\<^sup>T)


proof (prove)
goal (1 subgoal):
 1. \<integral>\<^sup>+ y. \<integral>\<^sup>+ x. f x y \<partial>M x
                       \<partial>M y =
    \<integral>\<^sup>+ z. f (fst z) (snd z)
                       \<partial>M x \<Otimes>\<^sub>M M y


proof (prove)
using this:
  C.ide w'
  \<guillemotleft>\<theta>' : f \<star>\<^sub>C
                              w' \<Rightarrow>\<^sub>C u\<guillemotright>
  \<guillemotleft>\<gamma>' : F w \<Rightarrow>\<^sub>D F
                   w'\<guillemotright> \<and>
  D.inv (\<Phi> (g, w')) \<cdot>\<^sub>D
  F \<beta> \<cdot>\<^sub>D \<Phi> (g, w) =
  F g \<star>\<^sub>D \<gamma>' \<and>
  F \<theta> \<cdot>\<^sub>D \<Phi> (f, w) =
  (F \<theta>' \<cdot>\<^sub>D \<Phi> (f, w')) \<cdot>\<^sub>D
  (F f \<star>\<^sub>D \<gamma>')
  C.hseq ?\<mu> ?\<nu> \<Longrightarrow>
  F (?\<mu> \<star>\<^sub>C ?\<nu>) =
  \<Phi> (C.cod ?\<mu>, C.cod ?\<nu>) \<cdot>\<^sub>D
  (F ?\<mu> \<star>\<^sub>D F ?\<nu>) \<cdot>\<^sub>D
  D.inv (\<Phi> (C.dom ?\<mu>, C.dom ?\<nu>))
  src\<^sub>C f = trg\<^sub>C w \<and> src\<^sub>C f = trg\<^sub>C w'
  (?h \<cdot>\<^sub>D ?g) \<cdot>\<^sub>D ?f =
  ?h \<cdot>\<^sub>D ?g \<cdot>\<^sub>D ?f
  \<lbrakk>D.arr ?h; ?f \<cdot>\<^sub>D ?g = ?h; D.iso ?f\<rbrakk>
  \<Longrightarrow> D.seq (D.inv ?f) ?h \<and>
                    ?g = D.inv ?f \<cdot>\<^sub>D ?h
  \<lbrakk>D.arr ?h; ?f \<cdot>\<^sub>D ?g = ?h; D.iso ?g\<rbrakk>
  \<Longrightarrow> D.seq ?h (D.inv ?g) \<and>
                    ?f = ?h \<cdot>\<^sub>D D.inv ?g

goal (1 subgoal):
 1. F \<theta> =
    F \<theta>' \<cdot>\<^sub>D
    \<Phi> (f, w') \<cdot>\<^sub>D
    (F f \<star>\<^sub>D \<gamma>') \<cdot>\<^sub>D D.inv (\<Phi> (f, w))


proof (prove)
goal (1 subgoal):
 1. x \<cdot> z \<le> y \<cdot> z


proof (prove)
using this:
  \<guillemotleft>f : F y \<rightarrow>\<^sub>C x\<guillemotright>

goal (1 subgoal):
 1. C.ide x


proof (prove)
goal (1 subgoal):
 1. VLambda I f \<in>\<^sub>\<circ> vproduct I A


proof (prove)
goal (1 subgoal):
 1. \<exists>v'.
       (\<forall>var\<in>V. v var = v' var) \<and>
       v' \<Turnstile>\<^sub>a\<^sub>s
       (snd `
        (set (Atoms (preprocess' t start)) \<inter> I \<times> UNIV)) \<and>
       v' \<Turnstile>\<^sub>t Tableau (preprocess' t start)


proof (prove)
using this:
  Ide a \<and> Diag a
  Ide b \<and> Diag b
  Ide c \<and> Diag c
  C.ide f \<and> C.arr f
  Ide b \<and>
  Diag b \<and>
  Arr b \<and>
  b \<noteq> \<^bold>\<I> \<and>
  ide \<lbrace>b\<rbrace> \<and>
  arr \<lbrace>b\<rbrace> \<and>
  \<^bold>\<lfloor>b\<^bold>\<rfloor> = b \<and>
  b\<^bold>\<down> = b \<and> Dom b = b \<and> Cod b = b
  Ide c \<and>
  Diag c \<and>
  Arr c \<and>
  c \<noteq> \<^bold>\<I> \<and>
  ide \<lbrace>c\<rbrace> \<and>
  arr \<lbrace>c\<rbrace> \<and>
  \<^bold>\<lfloor>c\<^bold>\<rfloor> = c \<and>
  c\<^bold>\<down> = c \<and> Dom c = c \<and> Cod c = c
  Diag (?a \<^bold>\<otimes> ?b) \<Longrightarrow>
  ?a \<^bold>\<Down> ?b = ?a \<^bold>\<otimes> ?b

goal (1 subgoal):
 1. \<lbrace>\<^bold>\<langle>f\<^bold>\<rangle> \<^bold>\<Down>
             b\<rbrace> =
    V f \<otimes> \<lbrace>b\<rbrace>


proof (prove)
goal (1 subgoal):
 1. spec\<^sub>2 p \<Longrightarrow> spec\<^sub>1 p


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x_ \<le> y_; y_ \<le> z_\<rbrakk> \<Longrightarrow> x_ \<le> z_


proof (prove)
using this:
  B \<in> \<gamma>\<^sub>T\<^sub>R K (\<phi> .\<and>. \<psi>)
  \<not> B \<turnstile> \<phi>

goal (1 subgoal):
 1. B \<in> K .\<bottom>. \<phi>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>hom_boundary (int n) (subtopology (nsphere n) (upper n))
              (equator n) zn =
             z;
     subtopology (nsphere n) (equator n) = nsphere (n - Suc 0);
     subtopology (lsphere n) (equator n) = nsphere (n - Suc 0);
     subtopology (subtopology (nsphere n) (upper n)) (equator n) =
     nsphere (n - Suc 0)\<rbrakk>
    \<Longrightarrow> hom_induced (int n - 1) (nsphere (n - Suc 0)) {}
                       (nsphere (n - Suc 0)) {} id z =
                      z


proof (prove)
goal (1 subgoal):
 1. orthogonal (column i (fst (QR_decomposition A)))
     (column ia (fst (QR_decomposition A)))


proof (prove)
goal (1 subgoal):
 1. x =
    lincomb_list (lc(j := lc j - lc i * c))
     (us[i := us ! i + c \<cdot>\<^sub>v us ! j])


proof (prove)
using this:
  a \<in> carrier Zp
  b \<in> carrier Zp
  a k = b k
  a \<noteq> b
  ?b \<in> carrier Zp \<Longrightarrow>
  (?a \<ominus> ?b) ?k =
  ?a ?k \<ominus>\<^bsub>residue_ring (p ^ ?k)\<^esub> ?b ?k

goal (1 subgoal):
 1. (a \<ominus> b) k = 0


proof (prove)
goal (1 subgoal):
 1. \<forall>h e e' a z z'.
       h \<in> valid_pub \<longrightarrow>
       e \<in> challenge_space \<longrightarrow>
       e' \<in> challenge_space \<longrightarrow>
       e \<noteq> e' \<longrightarrow>
       check h a e z \<longrightarrow>
       check h a e' z' \<longrightarrow>
       lossless_spmf (ss_adversary h (a, e, z) (a, e', z')) \<and>
       (\<forall>w'\<in>set_spmf (ss_adversary h (a, e, z) (a, e', z')).
           (h, w') \<in> R_DL)


proof (prove)
goal (1 subgoal):
 1. if v then R (tv \<cdot> tp) q else R (at v \<cdot> tp) q fi \<le> R p q


proof (prove)
using this:
  X \<in> E
  Int_stable E
  E \<subseteq> Pow \<Omega>
  ?X \<in> E \<Longrightarrow> emeasure M ?X = emeasure N ?X
  \<Omega> \<in> sets M

goal (1 subgoal):
 1. emeasure (restrict_space M \<Omega>) X =
    emeasure (restrict_space N \<Omega>) X


proof (prove)
using this:
  Q + N = Q + I + J
  Q + M = Q + I + K

goal (1 subgoal):
 1. (Q + M, Q + N) \<in> mul r


proof (prove)
goal (1 subgoal):
 1. length xs = 2 ^ k \<Longrightarrow> C_msort_bu xs \<le> k * 2 ^ k


proof (prove)
using this:
  C.arr f

goal (1 subgoal):
 1. constant_transformation (\<cdot>\<^sub>J) (\<cdot>) f


proof (prove)
goal (1 subgoal):
 1. qtable n C P
     (\<lambda>x.
         Q1 (restrict A x) \<and>
         (if b then Q2 (restrict B x) else \<not> Q2 (restrict B x)))
     (join X b Y)


proof (prove)
using this:
  y \<noteq> v1
  y = new_last
  ProofStepInduct G v0 v1 ?paths' ?P_new' sep_size \<Longrightarrow>
  H.distance (last P_new) v1 \<le> H.distance (last ?P_new') v1

goal (1 subgoal):
 1. ProofStepInduct_y_eq_new_last G v0 v1 paths P_new sep_size P_k_pre y
     P_k_post


proof (prove)
goal (1 subgoal):
 1. fps_deriv (fps_ln c + fps_ln d) =
    fps_const ((1::'a) / c + (1::'a) / d) * inverse (1 + fps_X)


proof (prove)
goal (1 subgoal):
 1. supp (ccTransform a e) \<subseteq> supp e


proof (prove)
goal (1 subgoal):
 1. set (mk_rtrancl_list_main subsumes r init []) = mk_rtrancl_main init {}


proof (prove)
goal (1 subgoal):
 1. weak_unit a'


proof (prove)
goal (1 subgoal):
 1. (map fi, f) \<in> clw_rel A \<rightarrow> clw_rel B


proof (prove)
goal (16 subgoals):
 1. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms = 0; ms \<le> s;
     me = - 1\<rbrakk>
    \<Longrightarrow> wordinterval_to_set
                       (if e < s \<or> me < ms then WordInterval s e
                        else if e \<le> me
                             then WordInterval (if ms = 0 then 1 else s)
                                   (min e (word_prev ms))
                             else if ms \<le> s
                                  then WordInterval (max s (word_next me))
  (if me = - 1 then 0 else e)
                                  else RangeUnion
  (WordInterval (if ms = 0 then 1 else s) (word_prev ms))
  (WordInterval (word_next me) (if me = - 1 then 0 else e))) =
                      wordinterval_to_set (WordInterval s e) -
                      wordinterval_to_set (WordInterval ms me)
 2. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms = 0; ms \<le> s;
     me \<noteq> - 1\<rbrakk>
    \<Longrightarrow> wordinterval_to_set
                       (if e < s \<or> me < ms then WordInterval s e
                        else if e \<le> me
                             then WordInterval (if ms = 0 then 1 else s)
                                   (min e (word_prev ms))
                             else if ms \<le> s
                                  then WordInterval (max s (word_next me))
  (if me = - 1 then 0 else e)
                                  else RangeUnion
  (WordInterval (if ms = 0 then 1 else s) (word_prev ms))
  (WordInterval (word_next me) (if me = - 1 then 0 else e))) =
                      wordinterval_to_set (WordInterval s e) -
                      wordinterval_to_set (WordInterval ms me)
 3. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms = 0;
     \<not> ms \<le> s; me = - 1\<rbrakk>
    \<Longrightarrow> wordinterval_to_set
                       (if e < s \<or> me < ms then WordInterval s e
                        else if e \<le> me
                             then WordInterval (if ms = 0 then 1 else s)
                                   (min e (word_prev ms))
                             else if ms \<le> s
                                  then WordInterval (max s (word_next me))
  (if me = - 1 then 0 else e)
                                  else RangeUnion
  (WordInterval (if ms = 0 then 1 else s) (word_prev ms))
  (WordInterval (word_next me) (if me = - 1 then 0 else e))) =
                      wordinterval_to_set (WordInterval s e) -
                      wordinterval_to_set (WordInterval ms me)
 4. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms = 0;
     \<not> ms \<le> s; me \<noteq> - 1\<rbrakk>
    \<Longrightarrow> wordinterval_to_set
                       (if e < s \<or> me < ms then WordInterval s e
                        else if e \<le> me
                             then WordInterval (if ms = 0 then 1 else s)
                                   (min e (word_prev ms))
                             else if ms \<le> s
                                  then WordInterval (max s (word_next me))
  (if me = - 1 then 0 else e)
                                  else RangeUnion
  (WordInterval (if ms = 0 then 1 else s) (word_prev ms))
  (WordInterval (word_next me) (if me = - 1 then 0 else e))) =
                      wordinterval_to_set (WordInterval s e) -
                      wordinterval_to_set (WordInterval ms me)
 5. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0;
     ms \<le> s; me = - 1\<rbrakk>
    \<Longrightarrow> wordinterval_to_set
                       (if e < s \<or> me < ms then WordInterval s e
                        else if e \<le> me
                             then WordInterval (if ms = 0 then 1 else s)
                                   (min e (word_prev ms))
                             else if ms \<le> s
                                  then WordInterval (max s (word_next me))
  (if me = - 1 then 0 else e)
                                  else RangeUnion
  (WordInterval (if ms = 0 then 1 else s) (word_prev ms))
  (WordInterval (word_next me) (if me = - 1 then 0 else e))) =
                      wordinterval_to_set (WordInterval s e) -
                      wordinterval_to_set (WordInterval ms me)
 6. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0;
     ms \<le> s; me \<noteq> - 1\<rbrakk>
    \<Longrightarrow> wordinterval_to_set
                       (if e < s \<or> me < ms then WordInterval s e
                        else if e \<le> me
                             then WordInterval (if ms = 0 then 1 else s)
                                   (min e (word_prev ms))
                             else if ms \<le> s
                                  then WordInterval (max s (word_next me))
  (if me = - 1 then 0 else e)
                                  else RangeUnion
  (WordInterval (if ms = 0 then 1 else s) (word_prev ms))
  (WordInterval (word_next me) (if me = - 1 then 0 else e))) =
                      wordinterval_to_set (WordInterval s e) -
                      wordinterval_to_set (WordInterval ms me)
 7. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0;
     \<not> ms \<le> s; me = - 1\<rbrakk>
    \<Longrightarrow> wordinterval_to_set
                       (if e < s \<or> me < ms then WordInterval s e
                        else if e \<le> me
                             then WordInterval (if ms = 0 then 1 else s)
                                   (min e (word_prev ms))
                             else if ms \<le> s
                                  then WordInterval (max s (word_next me))
  (if me = - 1 then 0 else e)
                                  else RangeUnion
  (WordInterval (if ms = 0 then 1 else s) (word_prev ms))
  (WordInterval (word_next me) (if me = - 1 then 0 else e))) =
                      wordinterval_to_set (WordInterval s e) -
                      wordinterval_to_set (WordInterval ms me)
 8. \<lbrakk>\<not> e < s; \<not> me < ms; e \<le> me; ms \<noteq> 0;
     \<not> ms \<le> s; me \<noteq> - 1\<rbrakk>
    \<Longrightarrow> wordinterval_to_set
                       (if e < s \<or> me < ms then WordInterval s e
                        else if e \<le> me
                             then WordInterval (if ms = 0 then 1 else s)
                                   (min e (word_prev ms))
                             else if ms \<le> s
                                  then WordInterval (max s (word_next me))
  (if me = - 1 then 0 else e)
                                  else RangeUnion
  (WordInterval (if ms = 0 then 1 else s) (word_prev ms))
  (WordInterval (word_next me) (if me = - 1 then 0 else e))) =
                      wordinterval_to_set (WordInterval s e) -
                      wordinterval_to_set (WordInterval ms me)
 9. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms = 0;
     ms \<le> s; me = - 1\<rbrakk>
    \<Longrightarrow> wordinterval_to_set
                       (if e < s \<or> me < ms then WordInterval s e
                        else if e \<le> me
                             then WordInterval (if ms = 0 then 1 else s)
                                   (min e (word_prev ms))
                             else if ms \<le> s
                                  then WordInterval (max s (word_next me))
  (if me = - 1 then 0 else e)
                                  else RangeUnion
  (WordInterval (if ms = 0 then 1 else s) (word_prev ms))
  (WordInterval (word_next me) (if me = - 1 then 0 else e))) =
                      wordinterval_to_set (WordInterval s e) -
                      wordinterval_to_set (WordInterval ms me)
 10. \<lbrakk>\<not> e < s; \<not> me < ms; \<not> e \<le> me; ms = 0;
      ms \<le> s; me \<noteq> - 1\<rbrakk>
     \<Longrightarrow> wordinterval_to_set
                        (if e < s \<or> me < ms then WordInterval s e
                         else if e \<le> me
                              then WordInterval (if ms = 0 then 1 else s)
                                    (min e (word_prev ms))
                              else if ms \<le> s
                                   then WordInterval (max s (word_next me))
   (if me = - 1 then 0 else e)
                                   else RangeUnion
   (WordInterval (if ms = 0 then 1 else s) (word_prev ms))
   (WordInterval (word_next me) (if me = - 1 then 0 else e))) =
                       wordinterval_to_set (WordInterval s e) -
                       wordinterval_to_set (WordInterval ms me)
A total of 16 subgoals...


proof (prove)
goal (1 subgoal):
 1. rel_spmf R (p \<bind> f) (return_spmf x \<bind> (\<lambda>_. q))


proof (prove)
goal (1 subgoal):
 1. hn_refine (hn_val (A \<rightarrow> B) f fi * hn_val A x xi)
     (return (pho_apply $ fi $ xi))
     (hn_val (A \<rightarrow> B) f fi * hn_val A x xi) (pure B)
     (RETURN $ (pho_apply $ f $ x))


proof (prove)
goal (1 subgoal):
 1. \<bottom> \<bind> k \<sqsubseteq> return\<cdot>\<bottom> \<bind> k


proof (prove)
goal (1 subgoal):
 1. LstSeq s k z \<Longrightarrow>
    app (insf s (succ k) y) k' = (if k' = succ k then y else app s k')


proof (prove)
goal (1 subgoal):
 1. invpst (mkNode c l a r) = (invpst l \<and> invpst r)


proof (prove)
using this:
  \<forall>\<^sub>F i in sequentially. K \<subseteq> C i

goal (1 subgoal):
 1. \<forall>\<^sub>F i in sequentially. t i \<notin> K


proof (prove)
goal (1 subgoal):
 1. set_integrable lborel {r..}
     (\<lambda>x. x powr s * exp (- a * x) / (1 - exp (- x)))


proof (prove)
using this:
  x \<notin> \<^bold>V
  (y, x) \<notin> \<^bold>E \<Longrightarrow> h_plus ?i (y, x) = 0

goal (1 subgoal):
 1. (y, x) \<notin> support_flow (\<lambda>e. \<Squnion>n. h_plus n e)


proof (prove)
using this:
  reachable composition (s1, s2)
  invariant composition P7

goal (1 subgoal):
 1. P7 (s1, s2)


proof (prove)
goal (1 subgoal):
 1. certify cert =
    (subgraph (with_proj cert) (with_proj G) \<and>
     verts3 (with_proj cert) =
     verts3 (with_proj (pair_pre_digraph.slim cert)) \<and>
     (\<exists>H.
         (K\<^bsub>3,3\<^esub> (with_proj H) \<or>
          K\<^bsub>5\<^esub> (with_proj H)) \<and>
         subdivision_pair H (pair_pre_digraph.slim cert)))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>set (fos \<phi>) \<subseteq> set bs1;
     set (sos \<phi>) \<subseteq> set bs2;
     \<AA> = mk_I I1 I2 bs1 bs2\<rbrakk>
    \<Longrightarrow> satisfies (dec_I1 \<AA> bs1) (dec_I2 \<AA> bs2)
                       \<phi> =
                      satisfies I1 I2 \<phi>


proof (prove)
goal (1 subgoal):
 1. gmd pr + gmft m + gmnl sf =
    sum_list (map snd (digitToList pr @ toList m @ nlistToList sf))


proof (prove)
using this:
  r \<noteq> r'

goal (1 subgoal):
 1. \<exists>s\<^sub>3 s\<^sub>3'.
       s\<^sub>3 \<approx> s\<^sub>3' \<and>
       (revision_step r' s\<^sub>2 s\<^sub>3 \<or>
        s\<^sub>2 = s\<^sub>3) \<and>
       (revision_step r s\<^sub>2' s\<^sub>3' \<or> s\<^sub>2' = s\<^sub>3')


proof (prove)
goal (1 subgoal):
 1. pmf (sds R24) a = 0 &&&
    pmf (sds R24) b = 0 &&& pmf (sds R24) d = 1 - pmf (sds R24) c


proof (prove)
goal (1 subgoal):
 1. eq a'
     (\<lbrakk> \<T>\<^bsub>a'\<^esub> e' \<rbrakk>\<^bsub>\<rho>1\<^esub>)
     (\<lbrakk> e' \<rbrakk>\<^bsub>\<rho>1\<^esub>)


proof (prove)
goal (1 subgoal):
 1. infdist y X = dist y x


proof (prove)
using this:
  \<lbrakk>?g \<in> carrier G; ?h \<in> carrier G\<rbrakk>
  \<Longrightarrow> (?g \<odot> ?x = ?h \<odot> ?x) =
                    (inv ?g \<otimes> ?h \<in> stabiliser ?x)
  inv g \<otimes> h \<in> stabiliser x
  g \<in> carrier G
  h \<in> carrier G

goal (1 subgoal):
 1. g \<odot> x = h \<odot> x


proof (prove)
goal (1 subgoal):
 1. basis_enum_of_vec ` local.span (set base) =
    basis_enum_of_vec ` mat_kernel Ag


proof (prove)
goal (1 subgoal):
 1. (\<And>A C B.
        \<lbrakk>M = zhmset_of A + C; N = zhmset_of B + C;
         A \<le> B\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  Q u = enat d

goal (1 subgoal):
 1. (\<And>v.
        \<lbrakk>\<pi> u = Some v; d = w {u, v}\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. igb.accept = accept &&& igba_rec.more G' = ecnv G


proof (prove)
goal (1 subgoal):
 1. (simple_fw rs1 p = Decision FinalAllow \<and>
     simple_fw rs2 p = Decision FinalAllow) =
    (simple_fw
      (rule_translate
        (generalized_fw_join (map simple_rule_dtor rs1)
          (map simple_rule_dtor rs2)))
      p =
     Decision FinalAllow)


proof (prove)
goal (1 subgoal):
 1. val e


proof (prove)
goal (1 subgoal):
 1. (\<exists>\<^sub>\<infinity>i. P (i - Suc n)) =
    (\<exists>\<^sub>\<infinity>i. P (Suc i - Suc n))


proof (prove)
goal (1 subgoal):
 1. mcont luba orda lub_spmf (ord_spmf (=))
     (\<lambda>x. p \<bind> (\<lambda>y. g y x))


proof (prove)
using this:
  fst (if vars_term_ms (SCF (f (Suc i))) \<subseteq>#
          vars_term_ms (SCF (f i)) \<and>
          weight (f (Suc i)) \<le> weight (f i)
       then if weight (f (Suc i)) < weight (f i) then (True, True)
            else case f i of
                 Var y \<Rightarrow>
                   (False,
                    case f (Suc i) of Var x \<Rightarrow> x = y
                    | Fun g ts \<Rightarrow> ts = [] \<and> least g)
                 | Fun fa ss \<Rightarrow>
                     case f (Suc i) of Var x \<Rightarrow> (True, True)
                     | Fun g ts \<Rightarrow>
                         if pr_strict (fa, length ss) (g, length ts)
                         then (True, True)
                         else if pr_weak (fa, length ss) (g, length ts)
                              then lex_ext_unbounded kbo ss ts
                              else (False, False)
       else (False, False))

goal (1 subgoal):
 1. weight (f (Suc i)) \<le> weight (f i)


proof (prove)
goal (1 subgoal):
 1. sgn1 (Suc y) = 1


proof (prove)
goal (1 subgoal):
 1. C.dom (g.leg0 \<cdot> fg.prj\<^sub>0) = f.leg0 \<down>\<down> g.leg1


proof (prove)
using this:
  finite A \<and> A \<noteq> {}

goal (1 subgoal):
 1. Finite_Set.fold (\<lambda>x yo. yo \<bind> m x)
     (Some (SOME x. x \<in> A)) (insert x A) =
    (if A = {} then Some x else Merge A \<bind> m x)


proof (prove)
using this:
  VVV.arr ?f =
  (arr (fst ?f) \<and>
   VV.arr (snd ?f) \<and> src (fst ?f) = trg (fst (snd ?f)))
  VV.arr ?f =
  (arr (fst ?f) \<and> arr (snd ?f) \<and> src (fst ?f) = trg (snd ?f))
  src ?\<mu> = (if arr ?\<mu> then src\<^sub>B ?\<mu> else null)
  trg ?\<mu> = (if arr ?\<mu> then trg\<^sub>B ?\<mu> else null)
  B.arr ?f \<and>
  src\<^sub>B ?f = a \<and> trg\<^sub>B ?f = a \<Longrightarrow>
  B.arr ?f
  arr ?f = (B.arr ?f \<and> src\<^sub>B ?f = a \<and> trg\<^sub>B ?f = a)

goal (1 subgoal):
 1. VxVxV.arr f = VVV.arr f


proof (prove)
goal (1 subgoal):
 1. create_gba \<phi> \<le> SPEC (\<lambda>\<A>. nds_invars (g_V \<A>))


proof (prove)
using this:
  ?l < length xs \<Longrightarrow>
  pick (map (Pair 1) xs) (natural_of_nat ?l) = xs ! ?l
  l < length (x # xs)

goal (1 subgoal):
 1. pick (map (Pair 1) (x # xs)) (natural_of_nat l) = (x # xs) ! l


proof (prove)
goal (1 subgoal):
 1. i \<le> mod_type_class.from_nat a


proof (prove)
goal (1 subgoal):
 1. e \<sqinter> - v * - v\<^sup>T \<squnion>
    - v * - v\<^sup>T \<sqinter> top * v\<^sup>T
    \<le> v * - v\<^sup>T \<sqinter> - v * - v\<^sup>T


proof (state)
goal (2 subgoals):
 1. bounded_linear (g' y)
 2. \<exists>e.
       (\<forall>h.
           y + h \<in> V \<longrightarrow>
           g (y + h) = g y + g' y h + e h) \<and>
       (\<lambda>h. norm (e h) / norm h) \<midarrow>0::'a\<rightarrow> 0


proof (prove)
goal (1 subgoal):
 1. \<exists>t3.
        t2 \<longrightarrow>\<^sub>1\<^sup>* t3 \<and>
        t1 \<longrightarrow>\<^sub>1\<^sup>* t3


proof (prove)
goal (1 subgoal):
 1. AE x in MI. \<forall>m n.
                   uJ n (projI ((TI ^^ m) x)) = vI n ((TI ^^ m) x)


proof (prove)
goal (1 subgoal):
 1. ground_fm (WRP x y) = (ground x \<and> ground y)


proof (prove)
using this:
  productF A B FAIL AB
  FAIL \<in> succ AB w (p1, p2)
  well_formed A
  well_formed B
  p1 \<in> nodes A \<and>
  p2 \<in> nodes B \<and>
  fst w \<in> inputs A \<and> snd w \<in> outputs A \<union> outputs B

goal (1 subgoal):
 1. succ B w p2 \<subseteq> nodes B


proof (prove)
using this:
  finite S'
  finite T'
  ?a1 \<in> S' \<Longrightarrow> g ?a1 = \<^bold>1
  ?b1 \<in> T' \<Longrightarrow> h ?b1 = \<^bold>1
  ?a1 \<in> S \<Longrightarrow> h (j ?a1) = g ?a1

goal (1 subgoal):
 1. F (\<lambda>x. h (j x)) S = F h T


proof (prove)
goal (1 subgoal):
 1. \<exists>y. if t = 0 then g (ws' 0) y = 0 else h (ws' 0) y = 0


proof (prove)
goal (1 subgoal):
 1. subformulas\<^sub>\<mu> (af \<phi> w) = subformulas\<^sub>\<mu> \<phi>


proof (chain)
picking this:
  \<Psi> \<rhd> P'' \<longmapsto> \<alpha> \<prec> P'
  x \<sharp> P''


proof (prove)
goal (1 subgoal):
 1. ennreal (1 - d2 / 2)
    < emeasure M
       {x \<in> space M.
        \<forall>B\<ge>N1.
           real
            (card
              ({n. \<exists>l\<in>{1..n}.
                      u n x - u (n - l) x \<le> - c0 * real l} \<inter>
               {..<B}))
           < d2 / 2 * real B}


proof (chain)
picking this:
  C = C' + {#L#}


proof (prove)
using this:
  wf {(x, y). cancels_to_1 y x}

goal (1 subgoal):
 1. wfP cancels_to_1\<inverse>\<inverse>


proof (prove)
goal (1 subgoal):
 1. \<And>a b c.
       (b r\<rightarrow> a) \<squnion>1 (a r\<rightarrow> b) r\<rightarrow>
       c
       \<le> c


proof (prove)
goal (1 subgoal):
 1. isnpolyh p n0 \<Longrightarrow> isconstant p = polybound0 p


proof (prove)
goal (1 subgoal):
 1. (\<lambda>n.
        prob
         {x \<in> space M.
          \<epsilon>
          < \<bar>(\<Sum>i<n. X i x) / real n - expectation (X 0)\<bar>})
    \<longlonglongrightarrow> 0


proof (chain)
picking this:
  as \<Turnstile>\<^sub>i \<B>\<I> s


proof (prove)
goal (1 subgoal):
 1. \<^bold>|w\<^bold>| = 1 \<or>
    (\<exists>l m.
        w = l \<cdot> m \<and> Lyndon l \<and> Lyndon m \<and> l <lex m)


proof (prove)
goal (1 subgoal):
 1. P (\<Squnion>i. iterate i\<cdot>f\<cdot>\<bottom>)


proof (prove)
goal (3 subgoals):
 1. \<And>h ptr' sc thesis ptr.
       \<lbrakk>\<forall>c.
                   h \<turnstile> get_dom_component ptr'
                   \<rightarrow>\<^sub>r c \<longrightarrow>
                   set c \<subseteq> set sc \<longrightarrow> thesis;
        heap_is_wellformed h; DocumentClass.type_wf h;
        DocumentClass.known_ptrs h;
        h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc;
        ptr' \<in> set sc\<rbrakk>
       \<Longrightarrow> thesis
 2. \<And>h ptr' sc thesis ptr.
       \<lbrakk>\<forall>owner_document.
                   h \<turnstile> get_owner_document ptr'
                   \<rightarrow>\<^sub>r owner_document \<longrightarrow>
                   cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r
                    owner_document
                   \<in> set sc \<longrightarrow>
                   thesis;
        heap_is_wellformed h; DocumentClass.type_wf h;
        DocumentClass.known_ptrs h;
        h \<turnstile> get_scdom_component ptr \<rightarrow>\<^sub>r sc;
        ptr' \<in> set sc\<rbrakk>
       \<Longrightarrow> thesis
 3. \<And>h ptr owner_document ptr' owner_document' x.
       \<lbrakk>heap_is_wellformed h; DocumentClass.type_wf h;
        DocumentClass.known_ptrs h;
        h \<turnstile> get_owner_document ptr
        \<rightarrow>\<^sub>r owner_document;
        h \<turnstile> get_owner_document ptr'
        \<rightarrow>\<^sub>r owner_document';
        owner_document \<noteq> owner_document';
        x \<in> set |h \<turnstile> get_scdom_component ptr|\<^sub>r;
        x \<in> set |h \<turnstile> get_scdom_component
                                     ptr'|\<^sub>r\<rbrakk>
       \<Longrightarrow> False


proof (prove)
goal (1 subgoal):
 1. \<exists>f S.
       flow \<Delta> f \<and>
       MFMC_Network.cut \<Delta> S \<and> orthogonal \<Delta> f S


proof (prove)
using this:
  x \<in> V

goal (1 subgoal):
 1. \<parallel>- 1 \<cdot> x\<parallel> =
    \<bar>- 1\<bar> * \<parallel>x\<parallel>


proof (prove)
goal (1 subgoal):
 1. \<And>x y.
       \<lbrakk>x \<in> \<D>; y \<in> \<D>; x \<noteq> y;
        x \<inter> {x. x \<bullet> i \<le> c} =
        y \<inter> {x. x \<bullet> i \<le> c}\<rbrakk>
       \<Longrightarrow> content (y \<inter> {x. x \<bullet> i \<le> c}) = 0


proof (prove)
goal (1 subgoal):
 1. \<And>P' r.
       \<lbrakk>t \<in> g; t \<in> r; s = t; ca = Guard f g c'; c = c';
        sa = t; a = AnnRec r P';
        \<Gamma>, \<Theta> \<turnstile>\<^bsub>/F\<^esub> P' c' Q, A;
        r \<inter> g \<subseteq> pre P';
        r \<inter> - g \<noteq> {} \<longrightarrow> f \<in> F\<rbrakk>
       \<Longrightarrow> t \<in> pre P' \<and>
                         (\<forall>as.
                             assertionsR \<Gamma> \<Theta> Q A P' c'
                              as \<longrightarrow>
                             assertionsR \<Gamma> \<Theta> Q A (AnnRec r P')
                              (Guard f g c') as) \<and>
                         (\<forall>pm cm.
                             atomicsR \<Gamma> \<Theta> P' c'
                              (pm, cm) \<longrightarrow>
                             atomicsR \<Gamma> \<Theta> (AnnRec r P')
                              (Guard f g c') (pm, cm))


proof (prove)
goal (1 subgoal):
 1. rank 0 = 0


proof (prove)
goal (1 subgoal):
 1. (\<lambda>(a, b).
        hom_induced p (subtopology X S) {} X {} id
         a \<otimes>\<^bsub>homology_group p X\<^esub>
        hom_induced p (subtopology X T) {} X {} id b)
    \<in> Group.iso
           (homology_group p (subtopology X S) \<times>\<times>
            homology_group p (subtopology X T))
           (homology_group p X)


proof (prove)
goal (1 subgoal):
 1. class.left_complemented_monoid_algebra (*) (\<sqinter>) (l\<rightarrow>)
     (\<le>) (<) (1::'a)


proof (prove)
using this:
  SecurityInvariant_preliminaries sinvar_spec
  \<lbrakk>SecurityInvariant_preliminaries ?sinvar; wf_graph ?G;
   \<not> ?sinvar ?G ?nP\<rbrakk>
  \<Longrightarrow> SecurityInvariant_withOffendingFlows.set_offending_flows
                     ?sinvar ?G ?nP \<noteq>
                    {}
  \<lbrakk>SecurityInvariant_withOffendingFlows.sinvar_mono ?sinvar;
   wf_graph \<lparr>nodes = ?N, edges = ?E\<rparr>; ?E' \<subseteq> ?E;
   ?sinvar \<lparr>nodes = ?N, edges = ?E\<rparr> ?nP\<rbrakk>
  \<Longrightarrow> ?sinvar \<lparr>nodes = ?N, edges = ?E'\<rparr> ?nP
  \<lbrakk>SecurityInvariant_withOffendingFlows.sinvar_mono ?sinvar;
   wf_graph ?G; \<not> ?sinvar ?G ?nP\<rbrakk>
  \<Longrightarrow> ?sinvar \<lparr>nodes = nodes ?G, edges = {}\<rparr>
                     ?nP =
                    (SecurityInvariant_withOffendingFlows.set_offending_flows
                      ?sinvar ?G ?nP \<noteq>
                     {})
  SecurityInvariant_withOffendingFlows.sinvar_mono sinvar_spec
  {} \<subseteq> ?A
  nodes \<lparr>nodes = ?nodes, edges = ?edges, \<dots> = ?more\<rparr> =
  ?nodes
  list_graph_to_graph ?G =
  \<lparr>nodes = set (nodesL ?G), edges = set (edgesL ?G)\<rparr>
  wf_list_graph G
  wf_list_graph ?G =
  (distinct (nodesL ?G) \<and>
   distinct (edgesL ?G) \<and> wf_list_graph_axioms ?G)
  wf_graph (list_graph_to_graph ?G) = wf_list_graph_axioms ?G

goal (1 subgoal):
 1. sinvar_spec \<lparr>nodes = set (nodesL G), edges = {}\<rparr> nP


proof (prove)
using this:
  P \<sharp>* C
  bn \<alpha> \<sharp>* C
  \<Psi> \<otimes> \<Psi>\<^sub>P \<rhd> Q \<longmapsto> \<alpha> \<prec> Q'
  \<alpha> \<prec> Q' = \<tau> \<prec> ?P' \<Longrightarrow>
  Prop ?b (\<Psi> \<otimes> \<Psi>\<^sub>P) Q ?P'
  extractFrame A\<^sub>P = \<langle>P, \<Psi>\<^sub>P\<rangle>
  distinct P
  P \<sharp>* A\<^sub>P
  P \<sharp>* Q
  P \<sharp>* \<Psi>
  P \<sharp>* \<alpha>
  P \<sharp>* Q'
  distinct (bn \<alpha>)
  bn \<alpha> \<sharp>* \<Psi>
  bn \<alpha> \<sharp>* \<Psi>\<^sub>P
  bn \<alpha> \<sharp>* A\<^sub>P
  bn \<alpha> \<sharp>* Q
  bn \<alpha> \<sharp>* subject \<alpha>
  \<alpha> \<prec> A\<^sub>P \<parallel> Q' = \<tau> \<prec> Q''

goal (1 subgoal):
 1. Prop C \<Psi> (A\<^sub>P \<parallel> Q) Q''


proof (state)
this:
  norm a ^ n * norm a ^ (k + i - j) = norm a ^ (n + (k + i - j))

goal (1 subgoal):
 1. norm a ^ n * norm a ^ (k + i - j) \<le> norm a ^ n * (c * norm a ^ k)


proof (prove)
goal (1 subgoal):
 1. (\<forall>x. fml_sem fml x) = decide_universal fml &&&
    \<exists>x. fml_sem fml x = decide_existential fml


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>B \<inter> B' = {}; T \<subseteq> B \<union> B'\<rbrakk>
    \<Longrightarrow> (\<Sum>v\<in>T \<inter> B \<union> T \<inter> B'.
                         f v *\<^sub>R v) =
                      (\<Sum>v\<in>T. f v *\<^sub>R v)


proof (prove)
goal (1 subgoal):
 1. class.ring_1 = ring_1_ow UNIV


proof (prove)
using this:
  is_equalized_by e
  J.arr j
  \<forall>a.
     if a = J.Zero then local.map a = C.dom f0
     else if a = J.One then local.map a = C.cod f0
          else if a = J.j0 then local.map a = f0
               else if a = J.j1 then local.map a = f1
                    else local.map a = C.null
  local.map j = f1 \<or> j = J.One \<or> j = J.Zero \<or> j = J.j0
  mkCone ?e \<equiv>
  \<lambda>j.
     if J.arr j then if j = J.Zero then ?e else f0 \<cdot> ?e else C.null
  C.seq ?g ?f \<Longrightarrow> C.cod (?g \<cdot> ?f) = C.cod ?g

goal (1 subgoal):
 1. j = J.Zero \<or> local.map j \<cdot> mkCone e (J.dom j) = mkCone e j


proof (prove)
using this:
  monotone (\<le>) (\<sqsubseteq>) (\<lambda>n. f^n \<bottom>)

goal (1 subgoal):
 1. Ex (extreme_bound A (\<sqsubseteq>) {f^n \<bottom> |. n})


proof (prove)
goal (1 subgoal):
 1. \<exists>us v vs. ys = us @ v # vs \<and> P x v \<and> list_emb P xs vs


proof (prove)
using this:
  k' \<equiv> k \<circ> Abs_freeword
  proper_signed_list xs
  proper_signed_list ys

goal (1 subgoal):
 1. k' (prappend_signed_list xs ys) = k' xs + k' ys


proof (prove)
goal (1 subgoal):
 1. transformation_by_components.map (\<cdot>\<^sub>C) (\<cdot>\<^sub>C)
     C.map \<eta>o a =
    G'\<eta>F'o\<eta>'.map a


proof (prove)
goal (1 subgoal):
 1. vertical_composite A B G F G \<tau>'.map \<tau>


proof (prove)
using this:
  length m = ?nc \<and> Ball (set m) (vec nr) \<Longrightarrow>
  length (Matrix_Legacy.transpose nr m) = nr \<and>
  Ball (set (Matrix_Legacy.transpose nr m)) (vec ?nc)
  length (v # m) = nc \<and> Ball (set (v # m)) (vec nr)
  nc = Suc ncc

goal (1 subgoal):
 1. length (Matrix_Legacy.transpose nr m) = nr \<and>
    Ball (set (Matrix_Legacy.transpose nr m)) (vec ncc)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invar g; n \<in> set (\<alpha>n g) - {Entry g}\<rbrakk>
    \<Longrightarrow> isIdom g n (THE m. isIdom g n m)


proof (prove)
goal (1 subgoal):
 1. sum content (extend ` \<D>) \<le> content (cbox a b)


proof (prove)
using this:
  B \<inter> s \<noteq> {}

goal (1 subgoal):
 1. False


proof (prove)
using this:
  x \<in> {x. order.greater_eq S (fst ` set (freeword x))}
  y \<in> {x. order.greater_eq S (fst ` set (freeword x))}
  order.greater_eq (fst ` (set (freeword x) \<union> set (freeword y)))
   (fst ` set (freeword (x - y)))

goal (1 subgoal):
 1. x - y \<in> {x. order.greater_eq S (fst ` set (freeword x))}


proof (prove)
goal (1 subgoal):
 1. [e * d = 1] (mod (P - 1) * (Q - 1))


proof (chain)
picking this:
  infinite S


proof (state)
this:
  \<integral>\<^sup>+ x. ennreal (f x) \<partial>M \<noteq> \<infinity>

goal (1 subgoal):
 1. \<exists>epsilon>0.
       \<forall>U\<in>sets M.
          emeasure M U < ennreal epsilon \<longrightarrow>
          set_nn_integral M U h < ennreal delta


proof (prove)
using this:
  (\<And>x. ?P x = ?Q x) \<Longrightarrow> {x. ?P x} = {x. ?Q x}

goal (1 subgoal):
 1. {v. v \<notin> {uu_.
                    \<exists>\<nu> \<omega>.
                       uu_ = \<nu> \<and>
                       (\<nu>, \<omega>) \<in> prog_sem I \<alpha> \<and>
                       \<omega> \<in> {v. v \<notin> fml_sem I \<phi>}}} =
    {\<nu>.
     \<forall>\<omega>.
        (\<nu>, \<omega>) \<in> prog_sem I \<alpha> \<longrightarrow>
        \<omega> \<in> fml_sem I \<phi>}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Suc 0 < k; m \<noteq> NoMsg;
     \<And>t. event t = (t mod k = Suc 0); t0 = Suc (t * k);
     s =
     output_fun \<circ>
     i_Exec_Comp_Stream_Init trans_fun (input \<odot> k) c\<rbrakk>
    \<Longrightarrow> (i_Exec_Comp_Stream_Acc_Output k output_fun trans_fun
                        input c t =
                       m) =
                      (s t0 = m \<and>
                       (\<circle> t' t0 [0\<dots>].
                           s t1 = NoMsg. t1 \<U> t2 [0\<dots>] \<oplus> t'.
                           event t2) \<or>
                       (\<circle> t' t0 [0\<dots>].
                           \<not> event t1.
                           t1 \<U> t2 [0\<dots>] \<oplus> t'.
                           s t2 = m \<and>
                           \<not> event t2 \<and>
                           (\<circle> t'' t2 [0\<dots>].
                               s t3 = NoMsg.
                               t3 \<U> t4 [0\<dots>] \<oplus> t''.
                               event t4)))


proof (prove)
goal (1 subgoal):
 1. set_offending_flows \<lparr>nodes = V, edges = E \<union> X\<rparr> nP
    \<subseteq> pow_combine X
                 (set_offending_flows \<lparr>nodes = V, edges = E\<rparr>
                   nP)


proof (prove)
goal (1 subgoal):
 1. trace_core_eq core1 core2 E IA IU p q


proof (prove)
using this:
  Mapping.keys
   (fst (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
          (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1)) g))
          (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
            (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                   g)))
          (fst (snd (snd s1))) (snd (snd (snd s1)))))
  \<subseteq> set (\<alpha>n g) \<and>
  Mapping.keys
   (snd (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
          (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1)) g))
          (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
            (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                   g)))
          (fst (snd (snd s1))) (snd (snd (snd s1)))))
  \<subseteq> Mapping.keys (phis g) \<and>
  CFG_SSA_Transformed_notriv_linorder_code \<alpha>e \<alpha>n invar
   inEdges' Entry oldDefs oldUses defs
   (u g (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
          (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1)) g))
          (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
            (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                   g)))
          s1_nodes_of_uses s1_phi_nodes_of))
   (p g (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
          (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1)) g))
          (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
            (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                   g)))
          s1_nodes_of_uses s1_phi_nodes_of))
   var chooseNext_all
  uninst_code.triv_phis'
   (\<lambda>_.
       snd (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
             (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                    g))
             (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
               (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                      g)))
             (fst (snd (snd s1))) (snd (snd (snd s1)))))
   g (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1)) g))
   s1_triv_phis (snd (snd (snd s1))) =
  uninst_code.ssa.trivial_phis
   (\<lambda>_.
       snd (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
             (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                    g))
             (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
               (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                      g)))
             (fst (snd (snd s1))) (snd (snd (snd s1)))))
   g
  uninst_code.nodes_of_uses' g
   (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1)) g))
   (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
     (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1)) g)))
   (snd ` dom (Mapping.lookup (phis g))) (fst (snd (snd s1))) =
  uninst_code.nodes_of_uses' g
   (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1)) g))
   (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
     (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1)) g)))
   (snd ` dom (Mapping.lookup s1_phis)) (fst (snd (snd s1)))

goal (1 subgoal):
 1. Mapping.keys
     (fst (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
            (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                   g))
            (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
              (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                     g)))
            (fst (snd (snd s1))) (snd (snd (snd s1)))))
    \<subseteq> set (\<alpha>n g) \<and>
    Mapping.keys
     (snd (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
            (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                   g))
            (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
              (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                     g)))
            (fst (snd (snd s1))) (snd (snd (snd s1)))))
    \<subseteq> Mapping.keys (phis g) \<and>
    CFG_SSA_Transformed_notriv_linorder_code \<alpha>e \<alpha>n invar
     inEdges' Entry oldDefs oldUses defs
     (u g (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
            (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                   g))
            (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
              (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                     g)))
            (fst (snd (snd s1))) (snd (snd (snd s1)))))
     (p g (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
            (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                   g))
            (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
              (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                     g)))
            (fst (snd (snd s1))) (snd (snd (snd s1)))))
     var chooseNext_all \<and>
    uninst_code.triv_phis'
     (\<lambda>_.
         snd (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
               (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                      g))
               (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
                 (Max (uninst_code.ssa.trivial_phis
                        (\<lambda>_. snd (fst s1)) g)))
               (fst (snd (snd s1))) (snd (snd (snd s1)))))
     g (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1)) g))
     (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1)) g)
     (snd (snd (snd s1))) =
    uninst_code.ssa.trivial_phis
     (\<lambda>_.
         snd (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
               (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                      g))
               (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
                 (Max (uninst_code.ssa.trivial_phis
                        (\<lambda>_. snd (fst s1)) g)))
               (fst (snd (snd s1))) (snd (snd (snd s1)))))
     g \<and>
    uninst_code.phi_equiv_mapping
     (\<lambda>_.
         snd (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
               (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                      g))
               (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
                 (Max (uninst_code.ssa.trivial_phis
                        (\<lambda>_. snd (fst s1)) g)))
               (fst (snd (snd s1))) (snd (snd (snd s1)))))
     g (uninst_code.nodes_of_uses' g
         (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1)) g))
         (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
           (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                  g)))
         (snd ` dom (Mapping.lookup (phis g))) (fst (snd (snd s1))))
     (uninst_code.ssa.useNodes_of
       (\<lambda>_.
           fst (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
                 (Max (uninst_code.ssa.trivial_phis
                        (\<lambda>_. snd (fst s1)) g))
                 (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
                   (Max (uninst_code.ssa.trivial_phis
                          (\<lambda>_. snd (fst s1)) g)))
                 (fst (snd (snd s1))) (snd (snd (snd s1)))))
       g) \<and>
    uninst_code.phi_equiv_mapping
     (\<lambda>_.
         snd (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
               (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                      g))
               (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
                 (Max (uninst_code.ssa.trivial_phis
                        (\<lambda>_. snd (fst s1)) g)))
               (fst (snd (snd s1))) (snd (snd (snd s1)))))
     g (uninst_code.nodes_of_phis' g
         (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1)) g))
         (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
           (Max (uninst_code.ssa.trivial_phis (\<lambda>_. snd (fst s1))
                  g)))
         (snd (snd (snd s1))))
     (uninst_code.ssa.phiNodes_of
       (\<lambda>ga.
           snd (uninst_code.step_codem (u g (fst s1)) (p g (fst s1)) g
                 (Max (uninst_code.ssa.trivial_phis
                        (\<lambda>_. snd (fst s1)) g))
                 (uninst_code.substitution_code (\<lambda>g. snd (fst s1)) g
                   (Max (uninst_code.ssa.trivial_phis
                          (\<lambda>_. snd (fst s1)) g)))
                 (fst (snd (snd s1))) (snd (snd (snd s1)))))
       g)


proof (prove)
goal (1 subgoal):
 1. mat n n
     (\<lambda>(i, j).
         if i = j then D $$ (i, i) * adjoint D $$ (i, i) else 0) =
    mat n n (\<lambda>(i, j). if i = j then B $$ (i, i) else 0)


proof (prove)
goal (1 subgoal):
 1. (\<And>n.
        norm (b - a) / 2 ^ n < e \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. outSetOfComponents level1 {data1, data10, data11} = {sA12, sA21}


proof (prove)
using this:
  ({#[entry fg p]#}, ww, {#u # ?r#} + ({#uh # rh#} + (ceh - {#u # r#})))
  \<in> trcl (ntr fg) \<Longrightarrow>
  \<exists>ww'.
     ({#[entry fg p]#}, ww',
      {#r' @ ?r#} + (csp' + ({#uh # rh#} + (ceh - {#u # r#}))))
     \<in> trcl (ntr fg)
  ({#[entry fg p]#}, ww, ch) \<in> trcl (ntr fg)
  ch = {#u # r#} + ({#uh # rh#} + (ceh - {#u # r#}))

goal (1 subgoal):
 1. (\<And>ww'.
        ({#[entry fg p]#}, ww',
         {#r' @ r#} + (csp' + ({#uh # rh#} + (ceh - {#u # r#}))))
        \<in> trcl (ntr fg) \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. unique_on_cylinder t0 T x0 b f B B' &&& X \<equiv> cball x0 b


proof (prove)
goal (1 subgoal):
 1. list_rec (a # l) c h = h a l (list_rec l c h)


proof (prove)
using this:
  (poly (p div d) x = 0) = (poly p x = 0)
  d dvd p
  d dvd pderiv p
  sgn (poly (p * pderiv p) x) = (if x\<^sub>0 < x then 1 else - 1) \<and>
  poly d x \<noteq> 0

goal (1 subgoal):
 1. sgn (poly (p div d * sturm_squarefree' p ! 1) x) =
    (if x\<^sub>0 < x then 1 else - 1)


proof (prove)
goal (1 subgoal):
 1. Imon l (mkMinj i M) = Imon l (Minj i M)


proof (prove)
goal (1 subgoal):
 1. (x \<in> outs_\<I>
              (map_\<I> rsuml lsumr
                (\<I>1 \<oplus>\<^sub>\<I>
                 (\<I>2 \<oplus>\<^sub>\<I> \<I>3)))) =
    (x \<in> outs_\<I>
              ((\<I>1 \<oplus>\<^sub>\<I> \<I>2) \<oplus>\<^sub>\<I> \<I>3))


proof (prove)
goal (1 subgoal):
 1. (\<N>\<lbrakk> e \<rbrakk>\<^bsub>(\<N>\<lbrace>\<Gamma>\<rbrace>)|\<^sup>\<circ>\<^bsub>r\<^esub>\<^esub>)\<cdot>
    (C\<cdot>r) \<sqsubseteq>
    (\<N>\<lbrakk> e \<rbrakk>\<^bsub>\<N>\<lbrace>delete x
              \<Gamma>\<rbrace>\<^esub>)\<cdot>
    (C\<cdot>r)


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       \<lbrakk>valuation K v; x \<in> carrier K; v x = 1;
        n_val K v x * Lv K v = v x; 0 < Lv K v\<rbrakk>
       \<Longrightarrow> Lv K v = 1


proof (prove)
goal (1 subgoal):
 1. (f \<in> borel_measurable M) =
    (\<forall>i\<in>Basis.
        \<forall>a. {w \<in> space M. a < f w \<bullet> i} \<in> sets M)


proof (prove)
using this:
  \<bottom> \<in> S

goal (1 subgoal):
 1. False


proof (prove)
using this:
  vars_of (t \<lhd> \<sigma>') = {}
  vars_of (v \<lhd> \<sigma>') = {}
  replace_subterm t p v t'

goal (1 subgoal):
 1. vars_of (t' \<lhd> \<sigma>') = {}


proof (prove)
using this:
  Policy.sp_spec_subj_subj (Step.partition tid) (Step.partition partner)
  Policy.sp_spec_subj_obj (Step.partition partner) (PAGE mypage) WRITE

goal (1 subgoal):
 1. \<not> Policy.sp_spec_subj_obj u (PAGE mypage) READ


proof (prove)
goal (1 subgoal):
 1. blinding_of_blindable h bo
    \<le> vimage2p (hash_blindable h) (hash_blindable h) (=)


proof (state)
this:
  ?F1, \<^bold>\<And>?G1, ?\<Gamma>1 = \<^bold>\<And>?G1, ?F1, ?\<Gamma>1

goal (1 subgoal):
 1. \<exists>S' R'.
       \<forall>\<Gamma>.
          is_nnf_mset \<Gamma> \<longrightarrow>
          is_disj R' \<and>
          is_nnf S' \<and>
          cnf R' = {R} \<and>
          cnf S' \<subseteq> S \<and>
          (R', S', \<Gamma> \<Rightarrow>\<^sub>n \<longrightarrow>
           S', \<Gamma> \<Rightarrow>\<^sub>n)


proof (prove)
using this:
  a \<in>\<^sub>\<circ> \<D>\<^sub>\<circ> r

goal (1 subgoal):
 1. r\<lparr>a\<rparr> = b


proof (prove)
goal (1 subgoal):
 1. is_scc E U =
    (U \<noteq> {} \<and>
     (\<forall>u\<in>U.
         \<forall>v\<in>U. (u, v) \<in> (Restr E U)\<^sup>*) \<and>
     (\<forall>u\<in>U.
         \<forall>v.
            v \<notin> U \<and> (u, v) \<in> E\<^sup>* \<longrightarrow>
            (\<forall>u'\<in>U. (v, u') \<notin> E\<^sup>*)))


proof (prove)
using this:
  a = ConstInt32 x1

goal (1 subgoal):
 1. \<lparr>s;vs;vs_to_es ves @
                 [$b_e]\<rparr> \<leadsto>_ i \<lparr>s';vs';es'\<rparr>


proof (prove)
using this:
  List.member \<Delta> (\<Delta> ! j)
  List.member \<Delta> (\<Delta> ! j)
  \<lbrakk>List.member ?\<Gamma> ?\<phi>;
   ?\<nu> \<in> fml_sem ?I ?\<phi>\<rbrakk>
  \<Longrightarrow> ?\<nu> \<in> fml_sem ?I (foldr (||) ?\<Gamma> FF)

goal (1 subgoal):
 1. \<nu> \<in> fml_sem I (foldr (||) \<Delta> FF)


proof (state)
this:
  simple_ownership_distinct ts\<^sub>k

goal (1 subgoal):
 1. safe_delayed (c' (n + k)) \<Longrightarrow>
    \<exists>c' l.
       l \<le> Suc k \<and>
       trace c' n l \<and>
       c' n = (u_ts, u_m, u_shared) \<and>
       (\<forall>x\<le>l.
           length (fst (c' (n + x))) = length (fst (c (n + x)))) \<and>
       (\<forall>x<l. safe_delayed (c' (n + x))) \<and>
       (l < Suc k \<longrightarrow> \<not> safe_delayed (c' (n + l))) \<and>
       (\<forall>x\<le>l.
           \<forall>ts\<^sub>x \<S>\<^sub>x m\<^sub>x ts\<^sub>x'
              \<S>\<^sub>x' m\<^sub>x'.
              c (n + x) =
              (ts\<^sub>x, m\<^sub>x, \<S>\<^sub>x) \<longrightarrow>
              c' (n + x) =
              (ts\<^sub>x', m\<^sub>x', \<S>\<^sub>x') \<longrightarrow>
              ts\<^sub>x' ! i = u_ts ! i \<and>
              (\<forall>a\<in>u_owns. \<S>\<^sub>x' a = u_shared a) \<and>
              (\<forall>a\<in>u_owns. \<S>\<^sub>x a = \<S> a) \<and>
              (\<forall>a\<in>u_owns. m\<^sub>x' a = u_m a) \<and>
              (\<forall>a\<in>u_owns. m\<^sub>x a = m a)) \<and>
       (\<forall>x\<le>l.
           \<forall>ts\<^sub>x \<S>\<^sub>x m\<^sub>x ts\<^sub>x'
              \<S>\<^sub>x' m\<^sub>x'.
              c (n + x) =
              (ts\<^sub>x, m\<^sub>x, \<S>\<^sub>x) \<longrightarrow>
              c' (n + x) =
              (ts\<^sub>x', m\<^sub>x', \<S>\<^sub>x') \<longrightarrow>
              (\<forall>j<length ts\<^sub>x.
                  j \<noteq> i \<longrightarrow>
                  ts\<^sub>x' ! j = ts\<^sub>x ! j) \<and>
              (\<forall>a.
                  a \<notin> u_owns \<longrightarrow>
                  a \<notin> owned (ts ! i) \<longrightarrow>
                  \<S>\<^sub>x' a = \<S>\<^sub>x a) \<and>
              (\<forall>a.
                  a \<notin> u_owns \<longrightarrow>
                  m\<^sub>x' a = m\<^sub>x a))


proof (prove)
goal (1 subgoal):
 1. (G ===> (=)) vars CFG_base2.vars


proof (prove)
goal (1 subgoal):
 1. 2 powr numeral i \<in> float


proof (prove)
goal (1 subgoal):
 1. homogeneous_set (ideal {f} \<inter> P[X]) \<and>
    phull.subspace (ideal {f} \<inter> P[X])


proof (prove)
goal (1 subgoal):
 1. (- F \<sqinter> v) * (F \<sqinter> v)\<^sup>T * top \<squnion>
    (- F \<sqinter> v) *
    (v\<^sup>\<star> \<sqinter> v\<^sup>T\<^sup>\<star>)
    \<le> bot \<squnion>
          (- F \<sqinter> v) *
          (v\<^sup>\<star> \<sqinter> v\<^sup>T\<^sup>\<star>)


proof (prove)
goal (1 subgoal):
 1. \<pi> \<diamondop> [a \<leftrightarrow> b] =
    [\<pi> $ a \<leftrightarrow> \<pi> $ b] \<diamondop> \<pi>


proof (prove)
goal (1 subgoal):
 1. u \<turnstile> PTA.inv_of A l'


proof (prove)
using this:
  J.ide j
  A_B.arr (\<chi>' j) \<Longrightarrow>
  A_B.Map (A_B.cod (\<chi>' j)) = A_B.Cod (\<chi>' j)
  \<guillemotleft>?f : ?a \<rightarrow>\<^sub>J ?b\<guillemotright> \<Longrightarrow>
  \<guillemotleft>\<chi>'
                   ?f : \<chi>'.A.map
                         ?a \<rightarrow>\<^sub>[\<^sub>A\<^sub>,\<^sub>B\<^sub>] D
       ?b\<guillemotright>

goal (1 subgoal):
 1. A_B.Map (D (J.cod j)) = A_B.Cod (\<chi>' j)


proof (prove)
using this:
  mbufn_take f z buf = (z', buf')
  list_all3 (\<lambda>P j xs. i \<le> j \<and> list_all2 P [i..<j] xs) Ps js
   buf
  U i z
  \<lbrakk>i \<le> ?k; Suc ?k \<le> Mini i js;
   list_all2 (\<lambda>P. P ?k) Ps ?xs; U ?k ?z\<rbrakk>
  \<Longrightarrow> U (Suc ?k) (f ?xs ?z)
  buf \<noteq> []
  [] \<in> set buf
  Mini i js = i

goal (1 subgoal):
 1. U (Mini i js) z'


proof (prove)
using this:
  ab_spec ab
  D' =
  D \<union>
  (set hs \<times> (set gs \<union> set bs \<union> set hs) \<union>
   set (ps -- sps) -\<^sub>p
   set (ap gs bs (ps -- sps) hs data'))
  set ps \<subseteq> set bs \<times> (set gs \<union> set bs)
  D \<subseteq> (set gs \<union> set bs) \<times> (set gs \<union> set bs)

goal (1 subgoal):
 1. D' \<subseteq> (set gs \<union> set (ab gs bs hs data')) \<times>
                   (set gs \<union> set (ab gs bs hs data'))


proof (prove)
goal (1 subgoal):
 1. (0 = \<Union>\<^sub>\<circ> A) = (\<forall>x\<in>elts A. x = 0)


proof (prove)
using this:
  compP\<^sub>1
   P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs e\<^sub>2,
                           (h, ls, sh)\<rangle> \<Rightarrow>
                          \<langle>fin\<^sub>1 (Val v),
                           (h\<^sub>2, ls\<^sub>2,
                            sh\<^sub>2)\<rangle> \<and>
  l\<^sub>2 \<subseteq>\<^sub>m [Vs [\<mapsto>] ls\<^sub>2]
  P \<turnstile> \<langle>e\<^sub>2,(h, l, sh)\<rangle> \<Rightarrow>
                 \<langle>Val v,(h\<^sub>2, l\<^sub>2, sh\<^sub>2)\<rangle>
  \<lbrakk>fv e\<^sub>2 \<subseteq> set ?Vs;
   l \<subseteq>\<^sub>m [?Vs [\<mapsto>] ?ls];
   length ?Vs + max_vars e\<^sub>2 \<le> length ?ls\<rbrakk>
  \<Longrightarrow> \<exists>ls'.
                       compP\<^sub>1
                        P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 ?Vs
                   e\<^sub>2,
          (h, ?ls, sh)\<rangle> \<Rightarrow>
         \<langle>fin\<^sub>1 (Val v),
          (h\<^sub>2, ls', sh\<^sub>2)\<rangle> \<and>
                       l\<^sub>2 \<subseteq>\<^sub>m [?Vs [\<mapsto>] ls']
  \<nexists>b t. P \<turnstile> C has F,b:t in D
  fv (C\<bullet>\<^sub>sF{D} := e\<^sub>2) \<subseteq> set Vs
  l \<subseteq>\<^sub>m [Vs [\<mapsto>] ls]
  length Vs + max_vars (C\<bullet>\<^sub>sF{D} := e\<^sub>2) \<le> length ls

goal (1 subgoal):
 1. \<exists>ls'.
       compP\<^sub>1
        P \<turnstile>\<^sub>1 \<langle>compE\<^sub>1 Vs
   (C\<bullet>\<^sub>sF{D} := e\<^sub>2),
                                (h, ls, sh)\<rangle> \<Rightarrow>
                               \<langle>fin\<^sub>1
   (THROW NoSuchFieldError),
                                (h\<^sub>2, ls', sh\<^sub>2)\<rangle> \<and>
       l\<^sub>2 \<subseteq>\<^sub>m [Vs [\<mapsto>] ls']


proof (state)
this:
  Cut <a>.NotR u.M a v.NotL <b>.N v{c:=y.P} =
  Cut <a>.NotR u.M{c:=y.P} a v.NotL <b>.N{c:=y.P} v

goal (1 subgoal):
 1. \<lbrakk>b \<sharp> y; b \<sharp> c; b \<sharp> P; v \<sharp> y;
     v \<sharp> c; v \<sharp> P; u \<sharp> y; u \<sharp> c; u \<sharp> P;
     a \<sharp> y; a \<sharp> c; a \<sharp> P; b \<noteq> a; v \<noteq> u;
     v \<sharp> M; v \<sharp> N; u \<sharp> N; u \<sharp> v; a \<sharp> M;
     a \<sharp> N; a \<sharp> b; b \<sharp> M; v \<noteq> u;
     b \<noteq> a\<rbrakk>
    \<Longrightarrow> Cut <a>.NotR u.M a v.NotL <b>.N v{c:=y.P} \<longrightarrow>\<^sub>a* Cut <b>.N u.M{c:=y.P}


proof (prove)
goal (1 subgoal):
 1. (strip C = x ::= e) = (\<exists>P. C = x ::= e {P})


proof (prove)
using this:
  (\<alpha>.P, \<alpha>.Q) \<in> {(\<alpha>.P, \<alpha>.Q) |P Q. P \<sim> Q}

goal (1 subgoal):
 1. \<alpha>.P \<sim> \<alpha>.Q


proof (prove)
goal (1 subgoal):
 1. total_ordered_set A r = total_ordered_set A r'


proof (prove)
using this:
  antirange_semiring.bdia (\<cdot>) ar ?x ?y = ar (ar (?y \<cdot> ?x))
  (antirange_semiring.bdia (\<cdot>) ar ?x ?y \<le> ar (ar ?z)) =
  (ar (ar ?y) \<cdot> ?x \<le> ?x \<cdot> ar (ar ?z))
  r ?x = ar (ar ?x)

goal (1 subgoal):
 1. \<And>y.
       (\<And>i.
           \<exists>q.
              i = r q \<and>
              r p \<cdot> x \<le> x \<cdot> r q \<Longrightarrow>
           y \<le> i) \<Longrightarrow>
       y \<le> antirange_semiring.bdia (\<cdot>) ar x (r p)


proof (prove)
goal (1 subgoal):
 1. desargues_config A B C A' B' C'
     (Pascal_Property.inter (line B C) (line B' C'))
     (Pascal_Property.inter (line A C) (line A' C'))
     (Pascal_Property.inter (line A B) (line A' B')) R


proof (prove)
goal (1 subgoal):
 1. (\<And>q1 q2.
        \<lbrakk>q1 + q2 \<le> q; interaction_any_bounded_by \1 q1;
         \<And>cipher \<sigma>.
            interaction_any_bounded_by (\2 cipher \<sigma>) q2\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  \<lbrakk>generator g s = Skip ?x2.0;
   local.force ?x2.0 = Some (x, s')\<rbrakk>
  \<Longrightarrow> local.unstream ?x2.0 = x # local.unstream s'
  local.force s = Some (x, s')

goal (1 subgoal):
 1. local.unstream s = x # local.unstream s'


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>well_def a; well_def b\<rbrakk>
    \<Longrightarrow> well_def (a ;; b)


proof (prove)
goal (1 subgoal):
 1. (?c, gbg_to_idx_ext)
    \<in> (gbgv_impl_rel_ext Re Rv \<rightarrow> Ri) \<rightarrow>
          gbgv_impl_rel_ext Re Rv \<rightarrow>
          \<langle>igbgv_impl_rel_ext Ri Rv\<rangle>nres_rel


proof (prove)
goal (1 subgoal):
 1. rel_FGcontra L1\<inverse>\<inverse> Co1\<inverse>\<inverse>
     Co2\<inverse>\<inverse> Co3\<inverse>\<inverse> Co4\<inverse>\<inverse>
     Co5\<inverse>\<inverse> Contra1\<inverse>\<inverse>
     Contra2\<inverse>\<inverse> Contra3\<inverse>\<inverse>
     Contra4\<inverse>\<inverse> Contra5\<inverse>\<inverse> =
    (rel_FGcontra L1 Co1 Co2 Co3 Co4 Co5 Contra1 Contra2 Contra3 Contra4
      Contra5)\<inverse>\<inverse>


proof (prove)
goal (1 subgoal):
 1. \<forall>p\<^sub>0\<in>set (take 8 PS).
       \<forall>p\<^sub>1\<in>set (drop 8 PS).
          snd p\<^sub>0 \<le> snd p\<^sub>1


proof (prove)
goal (1 subgoal):
 1. x \<in> set xs \<Longrightarrow> x \<le> fold max xs z


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>GDERIV f x :> df; f x \<noteq> 0\<rbrakk>
    \<Longrightarrow> GDERIV (\<lambda>x. inverse (f x)) x
                      :> - (inverse (f x))\<^sup>2 *\<^sub>R df


proof (prove)
goal (1 subgoal):
 1. set_mset
     (r|map fst (snd (fst ((s, []), s, [])))| +
      r|map fst (snd (snd ((s, []), s, [])))|)
    \<subseteq> r \<down>m M


proof (prove)
goal (1 subgoal):
 1. fv\<^sub>s\<^sub>e\<^sub>t (subterms (t \<cdot> \<theta>)) =
    fv\<^sub>s\<^sub>e\<^sub>t
     (subterms t \<cdot>\<^sub>s\<^sub>e\<^sub>t \<theta>)


proof (prove)
using this:
  Arr t
  Arr u
  Src t = Trg u
  coherent t
  coherent u
  Arr t \<and>
  Ide (Dom t) \<and>
  Ide (Cod t) \<and>
  Ide \<^bold>\<lfloor>Dom t\<^bold>\<rfloor> \<and>
  Ide \<^bold>\<lfloor>Cod t\<^bold>\<rfloor> \<and>
  arr \<lbrace>t\<rbrace> \<and>
  arr \<lbrace>Dom t\<rbrace> \<and>
  ide \<lbrace>Dom t\<rbrace> \<and>
  arr \<lbrace>Cod t\<rbrace> \<and> ide \<lbrace>Cod t\<rbrace>
  Arr u \<and>
  Ide (Dom u) \<and>
  Ide (Cod u) \<and>
  Ide \<^bold>\<lfloor>Dom u\<^bold>\<rfloor> \<and>
  Ide \<^bold>\<lfloor>Cod u\<^bold>\<rfloor> \<and>
  arr \<lbrace>u\<rbrace> \<and>
  arr \<lbrace>Dom u\<rbrace> \<and>
  ide \<lbrace>Dom u\<rbrace> \<and>
  arr \<lbrace>Cod u\<rbrace> \<and> ide \<lbrace>Cod u\<rbrace>
  Arr ?t \<Longrightarrow> Nml \<^bold>\<lfloor>?t\<^bold>\<rfloor>
  Arr ?t \<Longrightarrow> Src \<^bold>\<lfloor>?t\<^bold>\<rfloor> = Src ?t
  Arr ?t \<Longrightarrow> Trg \<^bold>\<lfloor>?t\<^bold>\<rfloor> = Trg ?t
  Arr ?t \<Longrightarrow>
  Dom \<^bold>\<lfloor>?t\<^bold>\<rfloor> =
  \<^bold>\<lfloor>Dom ?t\<^bold>\<rfloor>
  Arr ?t \<Longrightarrow>
  Cod \<^bold>\<lfloor>?t\<^bold>\<rfloor> =
  \<^bold>\<lfloor>Cod ?t\<^bold>\<rfloor>
  Arr ?t \<Longrightarrow>
  \<^bold>\<lfloor>?t\<^bold>\<rfloor> \<in> HHom (Src ?t) (Trg ?t)
  Arr ?t \<Longrightarrow>
  \<^bold>\<lfloor>?t\<^bold>\<rfloor>
  \<in> VHom \<^bold>\<lfloor>Dom ?t\<^bold>\<rfloor>
         \<^bold>\<lfloor>Cod ?t\<^bold>\<rfloor>
  \<lbrakk>Nml \<^bold>\<lfloor>t\<^bold>\<rfloor>;
   Nml \<^bold>\<lfloor>u\<^bold>\<rfloor>;
   Src \<^bold>\<lfloor>t\<^bold>\<rfloor> =
   Trg \<^bold>\<lfloor>u\<^bold>\<rfloor>\<rbrakk>
  \<Longrightarrow> \<lbrace>Cod \<^bold>\<lfloor>t\<^bold>\<rfloor> \<^bold>\<Down>
                             Cod \<^bold>\<lfloor>u\<^bold>\<rfloor>\<rbrace> \<cdot>
                    (\<lbrace>\<^bold>\<lfloor>t\<^bold>\<rfloor>\<rbrace> \<star>
                     \<lbrace>\<^bold>\<lfloor>u\<^bold>\<rfloor>\<rbrace>) =
                    \<lbrace>\<^bold>\<lfloor>t\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor>
                             \<^bold>\<lfloor>u\<^bold>\<rfloor>\<rbrace> \<cdot>
                    \<lbrace>Dom \<^bold>\<lfloor>t\<^bold>\<rfloor> \<^bold>\<Down>
                             Dom \<^bold>\<lfloor>u\<^bold>\<rfloor>\<rbrace>

goal (1 subgoal):
 1. (\<lbrace>\<^bold>\<lfloor>Cod t\<^bold>\<rfloor> \<^bold>\<Down>
              \<^bold>\<lfloor>Cod u\<^bold>\<rfloor>\<rbrace> \<cdot>
     (\<lbrace>\<^bold>\<lfloor>t\<^bold>\<rfloor>\<rbrace> \<star>
      \<lbrace>\<^bold>\<lfloor>u\<^bold>\<rfloor>\<rbrace>)) \<cdot>
    (\<lbrace>Dom t\<^bold>\<down>\<rbrace> \<star>
     \<lbrace>Dom u\<^bold>\<down>\<rbrace>) =
    (\<lbrace>\<^bold>\<lfloor>t\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor>
              \<^bold>\<lfloor>u\<^bold>\<rfloor>\<rbrace> \<cdot>
     \<lbrace>\<^bold>\<lfloor>Dom t\<^bold>\<rfloor> \<^bold>\<Down>
              \<^bold>\<lfloor>Dom u\<^bold>\<rfloor>\<rbrace>) \<cdot>
    (\<lbrace>Dom t\<^bold>\<down>\<rbrace> \<star>
     \<lbrace>Dom u\<^bold>\<down>\<rbrace>)


proof (prove)
using this:
  g1 \<noteq> g2

goal (1 subgoal):
 1. f bl index {(x, ix), (y, iy)} = 1


proof (prove)
using this:
  (?\<phi>1, ?Q1) mem CsQ \<Longrightarrow>
  \<exists>P.
     (?\<phi>1, P) mem CsP \<and>
     guarded P \<and> (\<forall>\<Psi>. \<Psi> \<rhd> P \<doteq> ?Q1)
  ?\<Psi>1 \<rhd> ?P1 \<approx> ?Q1 \<Longrightarrow>
  ?\<Psi>1 \<rhd> ?P1 \<leadsto><weakBisim> ?Q1
  ?\<Psi> \<rhd> ?P \<doteq> ?Q \<Longrightarrow>
  ?\<Psi> \<rhd> ?P \<approx> ?Q
  ?\<Psi> \<rhd> ?P \<doteq> ?Q \<Longrightarrow>
  ?\<Psi> \<rhd> ?P \<leadsto>\<guillemotleft>weakBisim\<guillemotright> ?Q

goal (1 subgoal):
 1. \<Psi> \<rhd> Cases CsP \<leadsto><weakBisim> Cases CsQ


proof (prove)
goal (1 subgoal):
 1. col (- A) i = - col A i


proof (prove)
using this:
  \<lbrakk>\<And>v. v \<in> x \<Longrightarrow> wf_tuple n A_x v;
   \<And>v. v \<in> y \<Longrightarrow> wf_tuple n A_y v;
   \<not> True \<Longrightarrow> A_y \<subseteq> A_x\<rbrakk>
  \<Longrightarrow> (?v \<in> join x True y) =
                    (wf_tuple n (A_x \<union> A_y) ?v \<and>
                     restrict A_x ?v \<in> x \<and>
                     join_cond True y (restrict A_y ?v))
  \<lbrakk>wf_tuple n ?B ?v; A_x \<union> A_y \<subseteq> ?B\<rbrakk>
  \<Longrightarrow> wf_tuple n (A_x \<union> A_y)
                     (restrict (A_x \<union> A_y) ?v)
  table n A_x x
  table n A_y y

goal (1 subgoal):
 1. \<And>z Z.
       \<lbrakk>wf_tuple n Z z; A_x \<union> A_y \<subseteq> Z\<rbrakk>
       \<Longrightarrow> (restrict (A_x \<union> A_y) z
                          \<in> join x True y) =
                         (restrict A_x z \<in> x \<and>
                          restrict A_y z \<in> y)


proof (prove)
using this:
  \<forall>m\<in>set M.
     set ` set (implc_offending_flows (fst m) G) =
     c_offending_flows (snd m) (list_graph_to_graph G)

goal (1 subgoal):
 1. set ` set (implc_get_offending_flows (get_impl M) G) =
    get_offending_flows (get_spec M) (list_graph_to_graph G)


proof (prove)
using this:
  subgroup H (homology_group p (subtopology X S))

goal (1 subgoal):
 1. (\<lambda>(x, y).
        x \<otimes>\<^bsub>homology_group p (subtopology X S)\<^esub> y)
    \<in> Group.iso
           (subgroup_generated (homology_group p (subtopology X S))
             H \<times>\<times>
            subgroup_generated (homology_group p (subtopology X S)) K)
           (homology_group p (subtopology X S))


proof (prove)
goal (1 subgoal):
 1. nfoldli [a..<b] c f =
    nfoldli [a + ofs..<b + ofs] c
     (\<lambda>x s.
         ASSERT (ofs \<le> x) \<bind> (\<lambda>_. f (x - ofs) s))


proof (state)
this:
  partition_on A ((\<lambda>b. {x \<in> A. f' x = b}) ` B - {{}})

goal (1 subgoal):
 1. (\<And>p\<^sub>A p\<^sub>B.
        \<lbrakk>p\<^sub>A permutes A; p\<^sub>B permutes B;
         \<forall>x\<in>A. f x = p\<^sub>B (f' (p\<^sub>A x))\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (state)
this:
  tfr\<^sub>s\<^sub>e\<^sub>t
   (\<Union> (trms\<^sub>s\<^sub>t ` \<S>2) \<union>
    \<Union> (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p ` set \2)) \<and>
  wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s
   (\<Union> (trms\<^sub>s\<^sub>t ` \<S>2) \<union>
    \<Union> (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p ` set \2))

goal (4 subgoals):
 1. \<And>t S.
       \<lbrakk>send\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1;
        \<S>2 =
        update\<^sub>s\<^sub>t \<S>1
         (send\<langle>t\<rangle>\<^sub>s\<^sub>t # S);
        \2 = \1 @ [Step (receive\<langle>t\<rangle>\<^sub>s\<^sub>t)];
        tfr\<^sub>s\<^sub>e\<^sub>t
         (\<Union> (trms\<^sub>s\<^sub>t ` \<S>1) \<union>
          \<Union>
           (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p ` set \1)) \<and>
        wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s
         (\<Union> (trms\<^sub>s\<^sub>t ` \<S>1) \<union>
          \<Union>
           (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p ` set \1))\<rbrakk>
       \<Longrightarrow> tfr\<^sub>s\<^sub>e\<^sub>t
                          (\<Union> (trms\<^sub>s\<^sub>t ` \<S>2) \<union>
                           \<Union>
                            (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p `
                             set \2)) \<and>
                         wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s
                          (\<Union> (trms\<^sub>s\<^sub>t ` \<S>2) \<union>
                           \<Union>
                            (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p `
                             set \2))
 2. \<And>t S.
       \<lbrakk>receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S \<in> \<S>1;
        \<S>2 =
        update\<^sub>s\<^sub>t \<S>1
         (receive\<langle>t\<rangle>\<^sub>s\<^sub>t # S);
        \2 = \1 @ [Step (send\<langle>t\<rangle>\<^sub>s\<^sub>t)];
        tfr\<^sub>s\<^sub>e\<^sub>t
         (\<Union> (trms\<^sub>s\<^sub>t ` \<S>1) \<union>
          \<Union>
           (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p ` set \1)) \<and>
        wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s
         (\<Union> (trms\<^sub>s\<^sub>t ` \<S>1) \<union>
          \<Union>
           (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p ` set \1))\<rbrakk>
       \<Longrightarrow> tfr\<^sub>s\<^sub>e\<^sub>t
                          (\<Union> (trms\<^sub>s\<^sub>t ` \<S>2) \<union>
                           \<Union>
                            (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p `
                             set \2)) \<and>
                         wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s
                          (\<Union> (trms\<^sub>s\<^sub>t ` \<S>2) \<union>
                           \<Union>
                            (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p `
                             set \2))
 3. \<And>a t t' S.
       \<lbrakk>\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S
                \<in> \<S>1;
        \<S>2 =
        update\<^sub>s\<^sub>t \<S>1
         (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S);
        \2 =
        \1 @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t];
        tfr\<^sub>s\<^sub>e\<^sub>t
         (\<Union> (trms\<^sub>s\<^sub>t ` \<S>1) \<union>
          \<Union>
           (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p ` set \1)) \<and>
        wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s
         (\<Union> (trms\<^sub>s\<^sub>t ` \<S>1) \<union>
          \<Union>
           (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p ` set \1))\<rbrakk>
       \<Longrightarrow> tfr\<^sub>s\<^sub>e\<^sub>t
                          (\<Union> (trms\<^sub>s\<^sub>t ` \<S>2) \<union>
                           \<Union>
                            (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p `
                             set \2)) \<and>
                         wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s
                          (\<Union> (trms\<^sub>s\<^sub>t ` \<S>2) \<union>
                           \<Union>
                            (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p `
                             set \2))
 4. \<And>X F S.
       \<lbrakk>\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t #
                S
                \<in> \<S>1;
        \<S>2 =
        update\<^sub>s\<^sub>t \<S>1
         (\<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t # S);
        \2 =
        \1 @
        [Step \<forall>X\<langle>\<or>\<noteq>: F\<rangle>\<^sub>s\<^sub>t];
        tfr\<^sub>s\<^sub>e\<^sub>t
         (\<Union> (trms\<^sub>s\<^sub>t ` \<S>1) \<union>
          \<Union>
           (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p ` set \1)) \<and>
        wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s
         (\<Union> (trms\<^sub>s\<^sub>t ` \<S>1) \<union>
          \<Union>
           (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p ` set \1))\<rbrakk>
       \<Longrightarrow> tfr\<^sub>s\<^sub>e\<^sub>t
                          (\<Union> (trms\<^sub>s\<^sub>t ` \<S>2) \<union>
                           \<Union>
                            (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p `
                             set \2)) \<and>
                         wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s
                          (\<Union> (trms\<^sub>s\<^sub>t ` \<S>2) \<union>
                           \<Union>
                            (trms\<^sub>e\<^sub>s\<^sub>t\<^sub>p `
                             set \2))


proof (prove)
goal (1 subgoal):
 1. mon_c fg csp = {}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<phi> \<in> fmla; set ts \<subseteq> trm;
     set xs \<subseteq> var; distinct xs; set us \<subseteq> var;
     distinct us; set us \<inter> Fvars \<phi> = {};
     set us \<inter> \<Union> (FvarsT ` set ts) = {};
     set us \<inter> set xs = {}; set vs \<subseteq> var; distinct vs;
     set vs \<inter> Fvars \<phi> = {};
     set vs \<inter> \<Union> (FvarsT ` set ts) = {};
     set vs \<inter> set xs = {}; length us = length xs;
     length vs = length xs; length ts = length xs\<rbrakk>
    \<Longrightarrow> set (getFrN (xs @ us @ vs) ts [\<phi>]
                            (length xs)) \<inter>
                      Fvars \<phi> =
                      {}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(1::'a) + x \<le> y; y \<cdot> y = y\<rbrakk>
    \<Longrightarrow> x\<^sup>\<star> \<le> y


proof (prove)
using this:
  g permutes A
  a < b

goal (1 subgoal):
 1. distr (Pi\<^sub>M A (\<lambda>_. uniform_measure lborel {a..b}))
     (Pi\<^sub>M A (\<lambda>_. lborel)) (\<lambda>f. f \<circ> g) =
    distr (Pi\<^sub>M A (\<lambda>_. uniform_measure lborel {a..b}))
     (Pi\<^sub>M A (\<lambda>_. uniform_measure lborel {a..b}))
     (\<lambda>f. \<lambda>x\<in>A. f (g x))


proof (prove)
goal (2 subgoals):
 1. conucleus f \<Longrightarrow> Sup_closed_set (Fix f)
 2. conucleus f \<Longrightarrow> comp_closed_set (Fix f)


proof (prove)
goal (1 subgoal):
 1. (top * e * (w\<^sup>T \<sqinter> - v\<^sup>T)\<^sup>\<star> \<squnion>
     - - v\<^sup>T) *
    w\<^sup>T =
    top * e * (w\<^sup>T \<sqinter> - v\<^sup>T)\<^sup>\<star> *
    w\<^sup>T \<squnion>
    - - v\<^sup>T * w\<^sup>T


proof (prove)
goal (1 subgoal):
 1. closure (cspan (range ket)) = UNIV


proof (state)
this:
  (ts, m, \<S>) \<Rightarrow>\<^sub>d\<^sup>* (ts, m, \<S>)

goal (3 subgoals):
 1. \<And>x21 x22 x23 x24.
       r = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow>
       valid_ownership \<S>\<^sub>s\<^sub>b' ts\<^sub>s\<^sub>b' \<and>
       valid_reads m\<^sub>s\<^sub>b' ts\<^sub>s\<^sub>b' \<and>
       valid_history program_step ts\<^sub>s\<^sub>b' \<and>
       valid_sharing \<S>\<^sub>s\<^sub>b' ts\<^sub>s\<^sub>b' \<and>
       tmps_distinct ts\<^sub>s\<^sub>b' \<and>
       valid_data_dependency ts\<^sub>s\<^sub>b' \<and>
       valid_sops ts\<^sub>s\<^sub>b' \<and>
       load_tmps_fresh ts\<^sub>s\<^sub>b' \<and>
       enough_flushs ts\<^sub>s\<^sub>b' \<and>
       valid_program_history ts\<^sub>s\<^sub>b' \<and>
       valid ts\<^sub>s\<^sub>b' \<and>
       (\<exists>ts' \<S>' m'.
           (ts, m,
            \<S>) \<Rightarrow>\<^sub>d\<^sup>* (ts', m', \<S>') \<and>
           (ts\<^sub>s\<^sub>b', m\<^sub>s\<^sub>b',
            \<S>\<^sub>s\<^sub>b') \<sim> (ts', m', \<S>'))
 2. \<And>x31 x32 x33.
       r = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow>
       valid_ownership \<S>\<^sub>s\<^sub>b' ts\<^sub>s\<^sub>b' \<and>
       valid_reads m\<^sub>s\<^sub>b' ts\<^sub>s\<^sub>b' \<and>
       valid_history program_step ts\<^sub>s\<^sub>b' \<and>
       valid_sharing \<S>\<^sub>s\<^sub>b' ts\<^sub>s\<^sub>b' \<and>
       tmps_distinct ts\<^sub>s\<^sub>b' \<and>
       valid_data_dependency ts\<^sub>s\<^sub>b' \<and>
       valid_sops ts\<^sub>s\<^sub>b' \<and>
       load_tmps_fresh ts\<^sub>s\<^sub>b' \<and>
       enough_flushs ts\<^sub>s\<^sub>b' \<and>
       valid_program_history ts\<^sub>s\<^sub>b' \<and>
       valid ts\<^sub>s\<^sub>b' \<and>
       (\<exists>ts' \<S>' m'.
           (ts, m,
            \<S>) \<Rightarrow>\<^sub>d\<^sup>* (ts', m', \<S>') \<and>
           (ts\<^sub>s\<^sub>b', m\<^sub>s\<^sub>b',
            \<S>\<^sub>s\<^sub>b') \<sim> (ts', m', \<S>'))
 3. \<And>x41 x42 x43 x44.
       r = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow>
       valid_ownership \<S>\<^sub>s\<^sub>b' ts\<^sub>s\<^sub>b' \<and>
       valid_reads m\<^sub>s\<^sub>b' ts\<^sub>s\<^sub>b' \<and>
       valid_history program_step ts\<^sub>s\<^sub>b' \<and>
       valid_sharing \<S>\<^sub>s\<^sub>b' ts\<^sub>s\<^sub>b' \<and>
       tmps_distinct ts\<^sub>s\<^sub>b' \<and>
       valid_data_dependency ts\<^sub>s\<^sub>b' \<and>
       valid_sops ts\<^sub>s\<^sub>b' \<and>
       load_tmps_fresh ts\<^sub>s\<^sub>b' \<and>
       enough_flushs ts\<^sub>s\<^sub>b' \<and>
       valid_program_history ts\<^sub>s\<^sub>b' \<and>
       valid ts\<^sub>s\<^sub>b' \<and>
       (\<exists>ts' \<S>' m'.
           (ts, m,
            \<S>) \<Rightarrow>\<^sub>d\<^sup>* (ts', m', \<S>') \<and>
           (ts\<^sub>s\<^sub>b', m\<^sub>s\<^sub>b',
            \<S>\<^sub>s\<^sub>b') \<sim> (ts', m', \<S>'))


proof (prove)
using this:
  fic M' a
  y':N'' \<in> \<parallel>(A)\<parallel>
  M' = NotR y'.N'' a

goal (1 subgoal):
 1. <a>:M' \<in> NOTRIGHT (NOT A) (\<parallel>(A)\<parallel>)


proof (prove)
goal (1 subgoal):
 1. Mapping.lookup (fold (addN g) xs m) v =
    (case Mapping.lookup m v of
     None \<Rightarrow>
       if \<exists>n\<in>set xs. v \<in> uses g n
       then Some {n \<in> set xs. v \<in> uses g n} else None
     | Some N \<Rightarrow>
         Some ({n \<in> set xs. v \<in> uses g n} \<union> N))


proof (chain)
picking this:
  D' \<in> inferred_clause_sets R S M


proof (prove)
goal (1 subgoal):
 1. (w \<sqinter> w\<^sup>T\<^sup>+) * r = bot


proof (prove)
using this:
  Q_invar Qi \<and>
  M_invar \<pi>i \<and> prim_invar2 (Q_\<alpha> Qi) (M_lookup \<pi>i)

goal (1 subgoal):
 1. Q_invar Qi &&& M_invar \<pi>i


proof (prove)
goal (10 subgoals):
 1. \<And>SK KK.
       \<lbrakk>SK \<in> symKeys; KK \<subseteq> - range shrK\<rbrakk>
       \<Longrightarrow> (\<forall>K\<in>KK.
                             \<not> AKcryptSK K SK []) \<longrightarrow>
                         Key SK
                         \<in> analz
                                (Key ` KK \<union>
                                 knows Spy []) \<longrightarrow>
                         SK \<in> KK \<or> Key SK \<in> analz (knows Spy [])
 2. \<And>evsf X B SK KK.
       \<lbrakk>evsf \<in> kerbV;
        \<forall>SK KK.
           SK \<in> symKeys \<and>
           KK \<subseteq> - range shrK \<longrightarrow>
           (\<forall>K\<in>KK. \<not> AKcryptSK K SK evsf) \<longrightarrow>
           (Key SK \<in> analz (Key ` KK \<union> knows Spy evsf)) =
           (SK \<in> KK \<or> Key SK \<in> analz (knows Spy evsf));
        X \<in> synth (analz (knows Spy evsf)); SK \<in> symKeys;
        KK \<subseteq> - range shrK\<rbrakk>
       \<Longrightarrow> (\<forall>K\<in>KK.
                             \<not> AKcryptSK K SK
                                     (Says Spy B X #
evsf)) \<longrightarrow>
                         Key SK
                         \<in> analz
                                (Key ` KK \<union>
                                 knows Spy
                                  (Says Spy B X # evsf)) \<longrightarrow>
                         SK \<in> KK \<or>
                         Key SK
                         \<in> analz (knows Spy (Says Spy B X # evsf))
 3. \<And>evs1 A SK KK.
       \<lbrakk>evs1 \<in> kerbV;
        \<forall>SK KK.
           SK \<in> symKeys \<and>
           KK \<subseteq> - range shrK \<longrightarrow>
           (\<forall>K\<in>KK. \<not> AKcryptSK K SK evs1) \<longrightarrow>
           (Key SK \<in> analz (Key ` KK \<union> knows Spy evs1)) =
           (SK \<in> KK \<or> Key SK \<in> analz (knows Spy evs1));
        SK \<in> symKeys; KK \<subseteq> - range shrK\<rbrakk>
       \<Longrightarrow> (\<forall>K\<in>KK.
                             \<not> AKcryptSK K SK
                                     (Says A Kas
 \<lbrace>Agent A, Agent Tgs, Number (CT evs1)\<rbrace> #
evs1)) \<longrightarrow>
                         Key SK
                         \<in> analz
                                (Key ` KK \<union>
                                 knows Spy
                                  (Says A Kas
                                    \<lbrace>Agent A, Agent Tgs,
Number (CT evs1)\<rbrace> #
                                   evs1)) \<longrightarrow>
                         SK \<in> KK \<or>
                         Key SK
                         \<in> analz
                                (knows Spy
                                  (Says A Kas
                                    \<lbrace>Agent A, Agent Tgs,
Number (CT evs1)\<rbrace> #
                                   evs1))
 4. \<And>evs2 authK A' A T1 SK KK.
       \<lbrakk>evs2 \<in> kerbV;
        \<forall>SK KK.
           SK \<in> symKeys \<and>
           KK \<subseteq> - range shrK \<longrightarrow>
           (\<forall>K\<in>KK. \<not> AKcryptSK K SK evs2) \<longrightarrow>
           (Key SK \<in> analz (Key ` KK \<union> knows Spy evs2)) =
           (SK \<in> KK \<or> Key SK \<in> analz (knows Spy evs2));
        Key authK \<notin> used evs2; authK \<in> symKeys;
        Says A' Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace>
        \<in> set evs2;
        SK \<in> symKeys; KK \<subseteq> - range shrK\<rbrakk>
       \<Longrightarrow> (\<forall>K\<in>KK.
                             \<not> AKcryptSK K SK
                                     (Says Kas A
 \<lbrace>Crypt (shrK A)
           \<lbrace>Key authK, Agent Tgs, Number (CT evs2)\<rbrace>,
   Crypt (shrK Tgs)
    \<lbrace>Agent A, Agent Tgs, Key authK,
      Number (CT evs2)\<rbrace>\<rbrace> #
evs2)) \<longrightarrow>
                         Key SK
                         \<in> analz
                                (Key ` KK \<union>
                                 knows Spy
                                  (Says Kas A
                                    \<lbrace>Crypt (shrK A)
        \<lbrace>Key authK, Agent Tgs, Number (CT evs2)\<rbrace>,
Crypt (shrK Tgs)
 \<lbrace>Agent A, Agent Tgs, Key authK,
   Number (CT evs2)\<rbrace>\<rbrace> #
                                   evs2)) \<longrightarrow>
                         SK \<in> KK \<or>
                         Key SK
                         \<in> analz
                                (knows Spy
                                  (Says Kas A
                                    \<lbrace>Crypt (shrK A)
        \<lbrace>Key authK, Agent Tgs, Number (CT evs2)\<rbrace>,
Crypt (shrK Tgs)
 \<lbrace>Agent A, Agent Tgs, Key authK,
   Number (CT evs2)\<rbrace>\<rbrace> #
                                   evs2))
 5. \<And>evs3 A T1 Kas' authK Ta authTicket B SK KK.
       \<lbrakk>evs3 \<in> kerbV;
        \<forall>SK KK.
           SK \<in> symKeys \<and>
           KK \<subseteq> - range shrK \<longrightarrow>
           (\<forall>K\<in>KK. \<not> AKcryptSK K SK evs3) \<longrightarrow>
           (Key SK \<in> analz (Key ` KK \<union> knows Spy evs3)) =
           (SK \<in> KK \<or> Key SK \<in> analz (knows Spy evs3));
        A \<noteq> Kas; A \<noteq> Tgs;
        Says A Kas \<lbrace>Agent A, Agent Tgs, Number T1\<rbrace>
        \<in> set evs3;
        valid Ta wrt T1; authTicket \<in> analz (knows Spy evs3);
        SK \<in> symKeys; KK \<subseteq> - range shrK\<rbrakk>
       \<Longrightarrow> (\<forall>K\<in>KK.
                             \<not> AKcryptSK K SK
                                     (Says A Tgs
 \<lbrace>authTicket,
   Crypt authK \<lbrace>Agent A, Number (CT evs3)\<rbrace>,
   Agent B\<rbrace> #
evs3)) \<longrightarrow>
                         Key SK
                         \<in> analz
                                (Key ` KK \<union>
                                 knows Spy
                                  (Says A Tgs
                                    \<lbrace>authTicket,
Crypt authK \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent B\<rbrace> #
                                   evs3)) \<longrightarrow>
                         SK \<in> KK \<or>
                         Key SK
                         \<in> analz
                                (knows Spy
                                  (Says A Tgs
                                    \<lbrace>authTicket,
Crypt authK \<lbrace>Agent A, Number (CT evs3)\<rbrace>, Agent B\<rbrace> #
                                   evs3))
 6. \<And>evs4 servK B authK A' A Ta T2 SK KK.
       \<lbrakk>evs4 \<in> kerbV;
        \<forall>SK KK.
           SK \<in> symKeys \<and>
           KK \<subseteq> - range shrK \<longrightarrow>
           (\<forall>K\<in>KK. \<not> AKcryptSK K SK evs4) \<longrightarrow>
           (Key SK \<in> analz (Key ` KK \<union> knows Spy evs4)) =
           (SK \<in> KK \<or> Key SK \<in> analz (knows Spy evs4));
        Key servK \<notin> used evs4; servK \<in> symKeys; B \<noteq> Tgs;
        authK \<in> symKeys;
        Says A' Tgs
         \<lbrace>Crypt (shrK Tgs)
                   \<lbrace>Agent A, Agent Tgs, Key authK,
                     Number Ta\<rbrace>,
           Crypt authK \<lbrace>Agent A, Number T2\<rbrace>,
           Agent B\<rbrace>
        \<in> set evs4;
        \<not> expiredAK Ta evs4; \<not> expiredA T2 evs4;
        servKlife + CT evs4 \<le> authKlife + Ta; SK \<in> symKeys;
        KK \<subseteq> - range shrK\<rbrakk>
       \<Longrightarrow> (\<forall>K\<in>KK.
                             \<not> AKcryptSK K SK
                                     (Says Tgs A
 \<lbrace>Crypt authK
           \<lbrace>Key servK, Agent B, Number (CT evs4)\<rbrace>,
   Crypt (shrK B)
    \<lbrace>Agent A, Agent B, Key servK,
      Number (CT evs4)\<rbrace>\<rbrace> #
evs4)) \<longrightarrow>
                         Key SK
                         \<in> analz
                                (Key ` KK \<union>
                                 knows Spy
                                  (Says Tgs A
                                    \<lbrace>Crypt authK
        \<lbrace>Key servK, Agent B, Number (CT evs4)\<rbrace>,
Crypt (shrK B)
 \<lbrace>Agent A, Agent B, Key servK, Number (CT evs4)\<rbrace>\<rbrace> #
                                   evs4)) \<longrightarrow>
                         SK \<in> KK \<or>
                         Key SK
                         \<in> analz
                                (knows Spy
                                  (Says Tgs A
                                    \<lbrace>Crypt authK
        \<lbrace>Key servK, Agent B, Number (CT evs4)\<rbrace>,
Crypt (shrK B)
 \<lbrace>Agent A, Agent B, Key servK, Number (CT evs4)\<rbrace>\<rbrace> #
                                   evs4))
 7. \<And>evs5 authK servK A authTicket T2 B Tgs' Ts servTicket SK KK.
       \<lbrakk>evs5 \<in> kerbV;
        \<forall>SK KK.
           SK \<in> symKeys \<and>
           KK \<subseteq> - range shrK \<longrightarrow>
           (\<forall>K\<in>KK. \<not> AKcryptSK K SK evs5) \<longrightarrow>
           (Key SK \<in> analz (Key ` KK \<union> knows Spy evs5)) =
           (SK \<in> KK \<or> Key SK \<in> analz (knows Spy evs5));
        authK \<in> symKeys; servK \<in> symKeys; A \<noteq> Kas;
        A \<noteq> Tgs;
        Says A Tgs
         \<lbrace>authTicket,
           Crypt authK \<lbrace>Agent A, Number T2\<rbrace>,
           Agent B\<rbrace>
        \<in> set evs5;
        valid Ts wrt T2; servTicket \<in> analz (knows Spy evs5);
        SK \<in> symKeys; KK \<subseteq> - range shrK\<rbrakk>
       \<Longrightarrow> (\<forall>K\<in>KK.
                             \<not> AKcryptSK K SK
                                     (Says A B
 \<lbrace>servTicket,
   Crypt servK \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> #
evs5)) \<longrightarrow>
                         Key SK
                         \<in> analz
                                (Key ` KK \<union>
                                 knows Spy
                                  (Says A B
                                    \<lbrace>servTicket,
Crypt servK \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> #
                                   evs5)) \<longrightarrow>
                         SK \<in> KK \<or>
                         Key SK
                         \<in> analz
                                (knows Spy
                                  (Says A B
                                    \<lbrace>servTicket,
Crypt servK \<lbrace>Agent A, Number (CT evs5)\<rbrace>\<rbrace> #
                                   evs5))
 8. \<And>evs6 B A' A servK Ts T3 Ta2 SK KK.
       \<lbrakk>evs6 \<in> kerbV;
        \<forall>SK KK.
           SK \<in> symKeys \<and>
           KK \<subseteq> - range shrK \<longrightarrow>
           (\<forall>K\<in>KK. \<not> AKcryptSK K SK evs6) \<longrightarrow>
           (Key SK \<in> analz (Key ` KK \<union> knows Spy evs6)) =
           (SK \<in> KK \<or> Key SK \<in> analz (knows Spy evs6));
        B \<noteq> Kas; B \<noteq> Tgs;
        Says A' B
         \<lbrace>Crypt (shrK B)
                   \<lbrace>Agent A, Agent B, Key servK, Number Ts\<rbrace>,
           Crypt servK \<lbrace>Agent A, Number T3\<rbrace>\<rbrace>
        \<in> set evs6;
        \<not> expiredSK Ts evs6; \<not> expiredA T3 evs6; SK \<in> symKeys;
        KK \<subseteq> - range shrK\<rbrakk>
       \<Longrightarrow> (\<forall>K\<in>KK.
                             \<not> AKcryptSK K SK
                                     (Says B A (Crypt servK (Number Ta2)) #
evs6)) \<longrightarrow>
                         Key SK
                         \<in> analz
                                (Key ` KK \<union>
                                 knows Spy
                                  (Says B A (Crypt servK (Number Ta2)) #
                                   evs6)) \<longrightarrow>
                         SK \<in> KK \<or>
                         Key SK
                         \<in> analz
                                (knows Spy
                                  (Says B A (Crypt servK (Number Ta2)) #
                                   evs6))
 9. \<And>evsO1 A authK Ta authTicket SK KK.
       \<lbrakk>evsO1 \<in> kerbV;
        \<forall>SK KK.
           SK \<in> symKeys \<and>
           KK \<subseteq> - range shrK \<longrightarrow>
           (\<forall>K\<in>KK.
               \<not> AKcryptSK K SK evsO1) \<longrightarrow>
           (Key SK \<in> analz (Key ` KK \<union> knows Spy evsO1)) =
           (SK \<in> KK \<or> Key SK \<in> analz (knows Spy evsO1));
        A \<noteq> Spy;
        Says Kas A
         \<lbrace>Crypt (shrK A)
                   \<lbrace>Key authK, Agent Tgs, Number Ta\<rbrace>,
           authTicket\<rbrace>
        \<in> set evsO1;
        expiredAK Ta evsO1; authK \<notin> range shrK; authK \<in> symKeys;
        SK \<in> symKeys; KK \<subseteq> - range shrK\<rbrakk>
       \<Longrightarrow> (\<forall>K\<in>KK.
                             \<not> AKcryptSK K SK
                                     (Notes Spy
 \<lbrace>Agent A, Agent Tgs, Number Ta, Key authK\<rbrace> #
evsO1)) \<longrightarrow>
                         Key SK
                         \<in> analz
                                (Key ` KK \<union>
                                 knows Spy
                                  (Notes Spy
                                    \<lbrace>Agent A, Agent Tgs, Number Ta,
Key authK\<rbrace> #
                                   evsO1)) \<longrightarrow>
                         SK \<in> KK \<or>
                         Key SK
                         \<in> analz
                                (knows Spy
                                  (Notes Spy
                                    \<lbrace>Agent A, Agent Tgs, Number Ta,
Key authK\<rbrace> #
                                   evsO1))
 10. \<And>evsO2 A authK servK B Ts servTicket SK KK.
        \<lbrakk>evsO2 \<in> kerbV;
         \<forall>SK KK.
            SK \<in> symKeys \<and>
            KK \<subseteq> - range shrK \<longrightarrow>
            (\<forall>K\<in>KK.
                \<not> AKcryptSK K SK evsO2) \<longrightarrow>
            (Key SK \<in> analz (Key ` KK \<union> knows Spy evsO2)) =
            (SK \<in> KK \<or> Key SK \<in> analz (knows Spy evsO2));
         A \<noteq> Spy;
         Says Tgs A
          \<lbrace>Crypt authK
                    \<lbrace>Key servK, Agent B, Number Ts\<rbrace>,
            servTicket\<rbrace>
         \<in> set evsO2;
         expiredSK Ts evsO2; servK \<notin> range shrK; servK \<in> symKeys;
         SK \<in> symKeys; KK \<subseteq> - range shrK\<rbrakk>
        \<Longrightarrow> (\<forall>K\<in>KK.
                              \<not> AKcryptSK K SK
(Notes Spy \<lbrace>Agent A, Agent B, Number Ts, Key servK\<rbrace> #
 evsO2)) \<longrightarrow>
                          Key SK
                          \<in> analz
                                 (Key ` KK \<union>
                                  knows Spy
                                   (Notes Spy
                                     \<lbrace>Agent A, Agent B, Number Ts,
 Key servK\<rbrace> #
                                    evsO2)) \<longrightarrow>
                          SK \<in> KK \<or>
                          Key SK
                          \<in> analz
                                 (knows Spy
                                   (Notes Spy
                                     \<lbrace>Agent A, Agent B, Number Ts,
 Key servK\<rbrace> #
                                    evsO2))


proof (prove)
using this:
  \<phi> g \<in> Bij M
  \<phi> h \<in> Bij M

goal (1 subgoal):
 1. (\<phi>
      g \<otimes>\<^bsub>\<lparr>carrier = Bij M, monoid.mult = \<lambda>g\<in>Bij M. restrict (compose M g) (Bij M), one = \<lambda>x\<in>M. x\<rparr>\<^esub>
     \<phi> h)
     m =
    compose M (\<phi> g) (\<phi> h) m


proof (prove)
using this:
  \<lbrakk>fmlookup \<Gamma> ?n3 = Some ?v3;
   value_pred.pred
    (\<lambda>_.
        list_all (\<lambda>(uu_, t). consts t |\<subseteq>| all_consts))
    (\<lambda>name. name |\<in>| C) (\<lambda>dom. dom |\<subseteq>| heads)
    ?v3\<rbrakk>
  \<Longrightarrow> consts (value_to_sterm ?v3) |\<subseteq>| all_consts
  fmpred
   (\<lambda>_.
       value_pred.pred
        (\<lambda>_.
            list_all (\<lambda>(uu_, t). consts t |\<subseteq>| all_consts))
        (\<lambda>name. name |\<in>| C)
        (\<lambda>dom. dom |\<subseteq>| heads))
   \<Gamma>
  list_all (\<lambda>(uu_, t). consts t |\<subseteq>| all_consts) cs

goal (1 subgoal):
 1. \<And>xb y.
       \<lbrakk>x_ =
                consts
                 (subst b_
                   (fmmap value_to_sterm
                     (fmdrop_fset (frees a_) \<Gamma>)));
        (a_, b_) \<in> set cs; x = (a_, b_);
        fmlookup \<Gamma> xb = Some y\<rbrakk>
       \<Longrightarrow> consts (value_to_sterm y) |\<subseteq>| all_consts