proof (state)
goal (8 subgoals):
 1. \<And>s s' t.
       \<lbrakk>[p] to x in m = App s t; r' = App s' t;
        s \<mapsto> s'\<rbrakk>
       \<Longrightarrow> SN r
 2. \<And>t t' s.
       \<lbrakk>[p] to x in m = App s t; r' = App s t';
        t \<mapsto> t'\<rbrakk>
       \<Longrightarrow> SN r
 3. \<And>s t.
       (\<lbrakk>x \<sharp> [p] to x in m; x \<sharp> r'\<rbrakk>
        \<Longrightarrow> [p] to x in m = App (\<Lambda> x . t) s \<and>
                          r' = t[x::=s] \<and>
                          x \<sharp> s) \<Longrightarrow>
       SN r
 4. \<And>t t'.
       (\<lbrakk>x \<sharp> [p] to x in m; x \<sharp> r'\<rbrakk>
        \<Longrightarrow> [p] to x in m = \<Lambda> x . t \<and>
                          r' = \<Lambda> x . t' \<and>
                          t \<mapsto> t') \<Longrightarrow>
       SN r
 5. \<And>t.
       (\<lbrakk>x \<sharp> [p] to x in m; x \<sharp> r'\<rbrakk>
        \<Longrightarrow> [p] to x in m = \<Lambda> x . App t (Var x) \<and>
                          r' = t \<and> x \<sharp> t) \<Longrightarrow>
       SN r
 6. \<And>s.
       (\<lbrakk>x \<sharp> [p] to x in m; x \<sharp> r'\<rbrakk>
        \<Longrightarrow> [p] to x in m = s to x in [Var x] \<and>
                          r' = s \<and> x \<sharp> s) \<Longrightarrow>
       SN r
 7. \<And>s u t.
       (\<lbrakk>x \<noteq> z; x \<sharp> [p] to x in m; x \<sharp> r';
         z \<sharp> [p] to x in m; z \<sharp> r'\<rbrakk>
        \<Longrightarrow> [p] to x in m = (s to x in t) to z in u \<and>
                          r' = s to x in t to z in u \<and>
                          x \<sharp> (z, s, u) \<and>
                          z \<sharp> (s, t)) \<Longrightarrow>
       SN r
 8. \<And>s s'.
       \<lbrakk>[p] to x in m = [s]; r' = [s']; s \<mapsto> s'\<rbrakk>
       \<Longrightarrow> SN r


proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2 i.
       \<lbrakk>\<And>i.
                   (\<lbrakk>\<guillemotleft>x2\<guillemotright>\<rbrakk>e =
                    \<langle>\<langle>0, 0, 0, 0, 0, 0, 0\<rangle>,
                             \<lbrakk>quot_dbfm
 (trans_fm [i] \<alpha>)\<rbrakk>e\<rangle>) =
                   (x2 = SyntaxN.Ex i \<alpha>);
        \<And>A.
           (\<lbrakk>\<guillemotleft>A\<guillemotright>\<rbrakk>e =
            \<lbrakk>\<guillemotleft>\<alpha>\<guillemotright>\<rbrakk>e) =
           (A = \<alpha>);
        \<forall>c.
           atom c \<sharp> (x2, \<alpha>) \<longrightarrow>
           atom c \<sharp> (x1, i, x2, \<alpha>) \<longrightarrow>
           (x1 \<leftrightarrow> c) \<bullet> x2 =
           (i \<leftrightarrow> c) \<bullet> \<alpha>\<rbrakk>
       \<Longrightarrow> trans_fm [x1] x2 = trans_fm [i] \<alpha>


proof (prove)
using this:
  \<forall>\<^sub>F n in sequentially. dist x (f n) \<le> a

goal (1 subgoal):
 1. dist x y \<le> a


proof (prove)
using this:
  P {||}
  \<lbrakk>\<forall>y. y |\<in>| ?S \<longrightarrow> y < ?x; P ?S\<rbrakk>
  \<Longrightarrow> P (finsert ?x ?S)

goal (1 subgoal):
 1. P S


proof (prove)
goal (1 subgoal):
 1. cs\<^bsup>\<pi>'\<^esup> l' = cs\<^bsup>\<rho>'\<^esup> l'


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<in> carrier R; a \<noteq> \<zero>\<rbrakk>
    \<Longrightarrow> inv (inv a) = a


proof (prove)
using this:
  pc2 (s 0) = a \<longrightarrow> 0 < sem (s 0)

goal (1 subgoal):
 1. (Enabled n2) s


proof (prove)
goal (1 subgoal):
 1. lookup (\<Sum>b\<in>B0. u b \<cdot> b) t =
    (\<Sum>b\<in>B0. u b * lookup b t)


proof (prove)
goal (1 subgoal):
 1. A * D + B * H = (D * S + H * T) * U


proof (prove)
using this:
  h measurable_on S

goal (1 subgoal):
 1. (\<And>N g.
        \<lbrakk>N \<in> null_sets lebesgue;
         \<And>n. continuous_on UNIV (g n);
         \<And>x.
            x \<notin> N \<Longrightarrow>
            (\<lambda>n. g n x)
            \<longlonglongrightarrow> (if x \<in> S then h x
 else (0::'b))\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  invar1 m
  \<alpha>1 m |` {k. (\<exists>v. \<alpha>1 m k = Some v) \<and> P k} =
  \<alpha>1 m |` {k. P k}

goal (1 subgoal):
 1. \<alpha>2 (restrict (\<lambda>(k, uu_). P k) m) =
    \<alpha>1 m |` {k. P k}


proof (prove)
using this:
  \<guillemotleft>fst f : fst a \<rightarrow>\<^sub>1 fst b\<guillemotright>
  \<guillemotleft>snd f : snd a \<rightarrow>\<^sub>2 snd b\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>f : a \<rightarrow> b\<guillemotright>


proof (prove)
goal (1 subgoal):
 1. cauchy_filter F


proof (prove)
goal (1 subgoal):
 1. double_dual_iso \<in> hom G (Characters (Characters G))


proof (chain)
picking this:
  Opaque x' \<cong> y


proof (prove)
goal (1 subgoal):
 1. \<And>x ya.
       poly_rel x ya \<Longrightarrow>
       list_all2 (list_all2 poly_rel)
        (map (\<lambda>s.
                 if gcd_poly_i ff_ops x
                     (minus_poly_i ff_ops y
                       (if s = 0 then []
                        else [arith_ops_record.of_int ff_ops
                               (int s)])) \<noteq>
                    [arith_ops_record.one ff_ops]
                 then [gcd_poly_i ff_ops x
                        (minus_poly_i ff_ops y
                          (if s = 0 then []
                           else [arith_ops_record.of_int ff_ops (int s)]))]
                 else [])
          [0..<nat p])
        (map (\<lambda>x.
                 if gcd ya (y' - [:of_nat x:]) \<noteq> 1
                 then [gcd ya (y' - [:of_int (int x):])] else [])
          [0..<nat p])


proof (prove)
goal (1 subgoal):
 1. Closed_Kernel_From \<K> \<K>\<^sub>s


proof (prove)
using this:
  [?a\<^sub>\<rat>]\<^sub>\<circ>
  \<in>\<^sub>\<circ> \<rat>\<^sub>\<circ> ^\<^sub>\<times> 1\<^sub>\<nat>

goal (1 subgoal):
 1. (cr_vrat ===> cr_vrat ===> (=)) vrat_le' (\<le>)


proof (prove)
goal (1 subgoal):
 1. \<top>\<^bsub>fpl \<P> \<H>\<^esub> = \<H> \<top>\<^bsub>\<P>\<^esub>


proof (prove)
using this:
  \<Phi>\<^sub>G (F (f \<star>\<^sub>B g), F h) =
  \<Phi>\<^sub>G (C.VV.cod (\<Phi>\<^sub>F (f, g), F h))
  G (\<Phi>\<^sub>F (f, g)) \<star>\<^sub>D G (F h) =
  G.H\<^sub>DoFF.map (\<Phi>\<^sub>F (f, g), F h)
  G.FoH\<^sub>C.map (\<Phi>\<^sub>F (f, g), F h) =
  G (\<Phi>\<^sub>F (f, g) \<star>\<^sub>C F h)
  \<Phi>\<^sub>G (C.VV.dom (\<Phi>\<^sub>F (f, g), F h)) =
  \<Phi>\<^sub>G (F f \<star>\<^sub>C F g, F h)
  B.ide f
  B.ide g
  B.ide h
  src\<^sub>B f = trg\<^sub>B g
  src\<^sub>B g = trg\<^sub>B h
  B.VV.arr ?f =
  (B.arr (fst ?f) \<and>
   B.arr (snd ?f) \<and> src\<^sub>B (fst ?f) = trg\<^sub>B (snd ?f))
  C.VV.arr ?f \<Longrightarrow>
  \<Phi>\<^sub>G (C.VV.cod ?f) \<cdot>\<^sub>D G.H\<^sub>DoFF.map ?f =
  G.FoH\<^sub>C.map ?f \<cdot>\<^sub>D \<Phi>\<^sub>G (C.VV.dom ?f)

goal (1 subgoal):
 1. G (F \<a>\<^sub>B[f, g, h] \<cdot>\<^sub>C
       \<Phi>\<^sub>F (f \<star>\<^sub>B g, h)) \<cdot>\<^sub>D
    (\<Phi>\<^sub>G (F (f \<star>\<^sub>B g), F h) \<cdot>\<^sub>D
     (G (\<Phi>\<^sub>F (f, g)) \<star>\<^sub>D G (F h))) \<cdot>\<^sub>D
    (\<Phi>\<^sub>G (F f, F g) \<star>\<^sub>D G (F h)) =
    G (F \<a>\<^sub>B[f, g, h] \<cdot>\<^sub>C
       \<Phi>\<^sub>F (f \<star>\<^sub>B g, h)) \<cdot>\<^sub>D
    (G (\<Phi>\<^sub>F (f, g) \<star>\<^sub>C F h) \<cdot>\<^sub>D
     \<Phi>\<^sub>G (F f \<star>\<^sub>C F g, F h)) \<cdot>\<^sub>D
    (\<Phi>\<^sub>G (F f, F g) \<star>\<^sub>D G (F h))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite I; i \<in> I;
     \<And>j.
        \<lbrakk>j \<in> I; j \<noteq> i\<rbrakk>
        \<Longrightarrow> degree (p j) < degree (p i)\<rbrakk>
    \<Longrightarrow> degree (sum p I) = degree (p i)


proof (prove)
using this:
  \<lbrakk>?C2 \<in> f \<turnstile> folding_g.\<C>;
   folding_g.gallery (?C2 # Bs @ [D])\<rbrakk>
  \<Longrightarrow> H \<in> set (wall_crossings (?C2 # Bs @ [D]))
  folding_g.gallery (C # (B # Bs) @ [D])
  B \<in> f \<turnstile> folding_g.\<C>
  folding_g.gallery (?x # ?xs) \<Longrightarrow> folding_g.gallery ?xs

goal (1 subgoal):
 1. H \<in> set (wall_crossings (C # (B # Bs) @ [D]))


proof (prove)
goal (1 subgoal):
 1. monom_mult_punit c t (Pm_fmap xs) =
    Pm_fmap
     (if c = (0::'b) then fmempty else shift_map_keys_punit t ((*) c) xs)


proof (prove)
goal (30 subgoals):
 1. V0 = id ` V0
A total of 30 subgoals...


proof (prove)
goal (1 subgoal):
 1. dual.check_eqv n \<phi> \<psi> \<Longrightarrow>
    \<Phi>.lang\<^sub>M\<^sub>2\<^sub>L n \<phi> =
    \<Phi>.lang\<^sub>M\<^sub>2\<^sub>L n \<psi>


proof (prove)
goal (1 subgoal):
 1. RES (fused_resource.fuse core rest) (s_core, s_rest) =
    fuse_converter \<rhd>
    RES (callee_of_core core) s_core \<parallel>
    RES (callee_of_rest rest) s_rest


proof (prove)
goal (1 subgoal):
 1. supp None = {}


proof (prove)
goal (1 subgoal):
 1. sublist (xs @ [x]) (ys @ [y]) =
    (x = y \<and> suffix xs ys \<or> sublist (xs @ [x]) ys)


proof (state)
this:
  distinct (map ((*\<^sub>R) 2) (ccw.selsort 0 (inl (snd X))))
  (\<lambda>i. 1 / 2 * (f i + 1)) \<in> UNIV \<rightarrow> {0<..<1}

goal (1 subgoal):
 1. \<lbrakk>e \<in> UNIV \<rightarrow> {- 1<..<1};
     seg
     \<in> set (polychain_of (lowest_vertex (fst X, nlex_pdevs (snd X)))
                 (map ((*\<^sub>R) 2) (ccw.selsort 0 (inl (snd X)))));
     length
      (polychain_of (lowest_vertex (fst X, nlex_pdevs (snd X)))
        (map ((*\<^sub>R) 2) (ccw.selsort 0 (inl (snd X))))) \<noteq>
     1\<rbrakk>
    \<Longrightarrow> ccw' (fst seg) (snd seg) (aform_val e X)


proof (prove)
goal (1 subgoal):
 1. (?c, go_is_done_impl)
    \<in> node_rel \<rightarrow>
          ce_rel node_rel \<times>\<^sub>r oGSi_rel \<rightarrow> bool_rel


proof (prove)
goal (1 subgoal):
 1. c_rec + c_sig + 2 * n + 2
    \<le> 2 * n + 2 + 4 * j + 1 +
          (\<Sum>jj = Suc j..<i. 2 * n + 2 + 4 * jj + 1)


proof (prove)
goal (1 subgoal):
 1. map_poly_zero_hom_0 of_int


proof (prove)
goal (1 subgoal):
 1. emeasure (Pi\<^sub>M UNIV (\<lambda>i. measure_pmf (bernoulli_pmf p)))
     (prod_emb UNIV (\<lambda>i. measure_pmf (bernoulli_pmf p)) {n}
       ({n} \<rightarrow>\<^sub>E {True})) =
    (\<Prod>i\<in>{n}. emeasure (measure_pmf (bernoulli_pmf p)) {True})


proof (prove)
using this:
  N \<in> null_sets M
  null_part M A \<subseteq> N
  main_part M A \<union> N - A \<subseteq> N

goal (1 subgoal):
 1. main_part M A \<union> N - A \<in> null_sets (completion M)


proof (prove)
using this:
  f analytic_on S
  z \<in> S

goal (1 subgoal):
 1. (\<And>a b.
        \<lbrakk>z \<in> box a b; f analytic_on box a b\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. OFCLASS('a tree, semiring_char_0_class)


proof (prove)
goal (1 subgoal):
 1. (\<And>a.
        Im a = Im (Complex rb ib) \<and>
        Re a < Re (Complex rb ib) \<Longrightarrow>
        Im a = Im (Complex rc ic) \<and>
        Re a \<le> Re (Complex rc ic)) \<Longrightarrow>
    Im (Complex rb ib) = Im (Complex rc ic) \<and>
    Re (Complex rb ib) \<le> Re (Complex rc ic)


proof (prove)
using this:
  w_vec p qs signs =
  matr_option (dim_row (M_mat signs subsets))
   (mat_inverse (M_mat signs subsets)) *\<^sub>v
  v_vec p qs subsets

goal (1 subgoal):
 1. w_vec p qs signs =
    matr_option (dim_row (M_mat signs subsets))
     (mat_inverse_var (M_mat signs subsets)) *\<^sub>v
    v_vec p qs subsets


proof (prove)
goal (1 subgoal):
 1. \<^bold>\<not> (F \<^bold>\<rightarrow> G)
    \<in> \<Gamma> \<Longrightarrow>
    \<Gamma> \<union> AX10 \<turnstile>\<^sub>H \<^bold>\<not> G


proof (prove)
goal (1 subgoal):
 1. lex_ext_unbounded f (a # as) ys =
    ((\<exists>i<length (a # as).
         i < length ys \<and>
         (\<forall>j<i. snd (f ((a # as) ! j) (ys ! j))) \<and>
         fst (f ((a # as) ! i) (ys ! i))) \<or>
     (\<forall>i<length ys. snd (f ((a # as) ! i) (ys ! i))) \<and>
     length ys < length (a # as),
     (\<exists>i<length (a # as).
         i < length ys \<and>
         (\<forall>j<i. snd (f ((a # as) ! j) (ys ! j))) \<and>
         fst (f ((a # as) ! i) (ys ! i))) \<or>
     (\<forall>i<length ys. snd (f ((a # as) ! i) (ys ! i))) \<and>
     length ys \<le> length (a # as))


proof (prove)
goal (1 subgoal):
 1. \<exists>n. count_it \<pi> b c s n


proof (prove)
goal (1 subgoal):
 1. V = 0 \<Longrightarrow> W = 0


proof (prove)
goal (1 subgoal):
 1. shows_words xs (r @ s) = shows_words xs r @ s


proof (prove)
using this:
  \<not> lfinite us

goal (1 subgoal):
 1. lappend us vs = us


proof (prove)
goal (1 subgoal):
 1. A \<turnstile>\<^sub>C obsf_oracle callee1(Fault) \<approx>
    obsf_oracle callee2(Fault)


proof (prove)
using this:
  f \<in> X \<rightarrow>\<^sub>M tree_sigma M
  ?x \<in> space X \<Longrightarrow> f ?x \<noteq> \<langle>\<rangle>

goal (1 subgoal):
 1. f \<in> X \<rightarrow>\<^sub>M
            restrict_space (tree_sigma M) (- {\<langle>\<rangle>})


proof (chain)
picking this:
  x = \<lbrakk>\<guillemotleft>A\<guillemotright>\<rbrakk>e
  atom (decode_Var w) \<sharp> A


proof (prove)
goal (1 subgoal):
 1. (\<Sum>i\<le>m. a i * x ^ i) * (\<Sum>j\<le>n. b j * x ^ j) =
    (\<Sum>r\<le>m + n. (\<Sum>k\<le>r. a k * b (r - k)) * x ^ r)


proof (prove)
using this:
  funToCone F j \<in> S.hom S.unity (D j)
  J.arr j
  J.arr ?f \<Longrightarrow> U.map ?f = S.unity

goal (1 subgoal):
 1. S.dom (funToCone F j) = U.map (J.dom j)


proof (prove)
goal (1 subgoal):
 1. \<integral>\<^sup>+ x. ennreal
                            (extract_real
                              (cexpr_sem (merge V V' (x, \<rho>))
                                (e1 *\<^sub>c
                                 \<langle>e2\<rangle>\<^sub>c)))
                       \<partial>state_measure V \<Gamma> =
    \<integral>\<^sup>+ x. ennreal
                            (extract_real
                              (cexpr_sem (merge V V' (x, \<rho>)) e1) *
                             extract_real
                              (cexpr_sem (merge V V' (x, \<rho>))
                                (\<langle>e2\<rangle>\<^sub>c)))
                       \<partial>state_measure V \<Gamma>


proof (prove)
goal (1 subgoal):
 1. equivalence_of_monoidal_categories (\<cdot>\<^sub>S)
     T\<^sub>F\<^sub>S\<^sub>M\<^sub>C
     \<alpha>\<^sub>F\<^sub>S\<^sub>M\<^sub>C
     \<iota>\<^sub>F\<^sub>S\<^sub>M\<^sub>C (\<cdot>)
     \<F>C.T\<^sub>F\<^sub>M\<^sub>C \<F>C.\<alpha>\<^sub>F\<^sub>M\<^sub>C
     \<F>C.\<iota>\<^sub>F\<^sub>M\<^sub>C \<F>C.D D.\<phi> local.map
     \<F>C.\<nu> \<F>C.\<mu>


proof (prove)
goal (1 subgoal):
 1. deterministic R \<Longrightarrow> w\<diamond> R


proof (prove)
goal (1 subgoal):
 1. class.quantale (\<cdot>) Infs Sup infs (\<le>) le sups bots tops


proof (prove)
goal (1 subgoal):
 1. 0 \<le> root_int_floor_pos p x


proof (prove)
using this:
  digraph_isomorphism hom
  subgraph H1 G
  subgraph H2 G
  app_iso (inv_iso hom) (app_iso hom H1) =
  app_iso (inv_iso hom) (app_iso hom H2)

goal (1 subgoal):
 1. H1 = H2


proof (prove)
using this:
  (\<exists>m. wf'.obs n (PDGx.PDG_BS S) = {m}) \<or>
  wf'.obs n (PDGx.PDG_BS S) = {}

goal (1 subgoal):
 1. finite (wf'.obs n (PDGx.PDG_BS S))


proof (prove)
goal (1 subgoal):
 1. (\<And>\<alpha>.
        \<lbrakk>f \<bullet> \<alpha> = \<zero>;
         \<alpha> \<in> carrier Zp\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. p =
    (\<Sum>x\<in>keys (mapping_of p).
       MPoly_Type.monom x (MPoly_Type.coeff p x))


proof (prove)
using this:
  value_flow (residual_network (f_i i))
   (f_aux (Suc i) \<ominus> f_i i) \<noteq>
  \<top>
  \<^bold>V - {source \<Delta>, sink \<Delta>} \<noteq> {}
  flow (residual_network (f_i i)) (f_aux (Suc i) \<ominus> f_i i)

goal (1 subgoal):
 1. flow_network (residual_network (f_i i)) (f_aux (Suc i) \<ominus> f_i i)


proof (prove)
using this:
  a \<in>\<^sub>\<circ> \<D>\<^sub>\<circ>
                         ((dghm_id
                            \<BB> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M
                           \<FF>)\<lparr>ObjMap\<rparr>)

goal (1 subgoal):
 1. (dghm_id \<BB> \<circ>\<^sub>D\<^sub>G\<^sub>H\<^sub>M
     \<FF>)\<lparr>ObjMap\<rparr>\<lparr>a\<rparr> =
    \<FF>\<lparr>ObjMap\<rparr>\<lparr>a\<rparr>


proof (prove)
goal (1 subgoal):
 1. linearize (takeWhile_queue f q) = takeWhile f (linearize q)


proof (state)
this:
  b \<in> alphabet t\<^sub>1

goal (2 subgoals):
 1. ?P \<Longrightarrow>
    if a \<in> alphabet (Node w t\<^sub>1 t\<^sub>2)
    then if b \<in> alphabet (Node w t\<^sub>1 t\<^sub>2)
         then weight
               (swapLeaves (Node w t\<^sub>1 t\<^sub>2) w\<^sub>a a
                 w\<^sub>b b) +
              freq (Node w t\<^sub>1 t\<^sub>2) a +
              freq (Node w t\<^sub>1 t\<^sub>2) b =
              weight (Node w t\<^sub>1 t\<^sub>2) + w\<^sub>a + w\<^sub>b
         else weight
               (swapLeaves (Node w t\<^sub>1 t\<^sub>2) w\<^sub>a a
                 w\<^sub>b b) +
              freq (Node w t\<^sub>1 t\<^sub>2) a =
              weight (Node w t\<^sub>1 t\<^sub>2) + w\<^sub>b
    else if b \<in> alphabet (Node w t\<^sub>1 t\<^sub>2)
         then weight
               (swapLeaves (Node w t\<^sub>1 t\<^sub>2) w\<^sub>a a
                 w\<^sub>b b) +
              freq (Node w t\<^sub>1 t\<^sub>2) b =
              weight (Node w t\<^sub>1 t\<^sub>2) + w\<^sub>a
         else weight
               (swapLeaves (Node w t\<^sub>1 t\<^sub>2) w\<^sub>a a
                 w\<^sub>b b) =
              weight (Node w t\<^sub>1 t\<^sub>2)
 2. \<not> ?P \<Longrightarrow>
    if a \<in> alphabet (Node w t\<^sub>1 t\<^sub>2)
    then if b \<in> alphabet (Node w t\<^sub>1 t\<^sub>2)
         then weight
               (swapLeaves (Node w t\<^sub>1 t\<^sub>2) w\<^sub>a a
                 w\<^sub>b b) +
              freq (Node w t\<^sub>1 t\<^sub>2) a +
              freq (Node w t\<^sub>1 t\<^sub>2) b =
              weight (Node w t\<^sub>1 t\<^sub>2) + w\<^sub>a + w\<^sub>b
         else weight
               (swapLeaves (Node w t\<^sub>1 t\<^sub>2) w\<^sub>a a
                 w\<^sub>b b) +
              freq (Node w t\<^sub>1 t\<^sub>2) a =
              weight (Node w t\<^sub>1 t\<^sub>2) + w\<^sub>b
    else if b \<in> alphabet (Node w t\<^sub>1 t\<^sub>2)
         then weight
               (swapLeaves (Node w t\<^sub>1 t\<^sub>2) w\<^sub>a a
                 w\<^sub>b b) +
              freq (Node w t\<^sub>1 t\<^sub>2) b =
              weight (Node w t\<^sub>1 t\<^sub>2) + w\<^sub>a
         else weight
               (swapLeaves (Node w t\<^sub>1 t\<^sub>2) w\<^sub>a a
                 w\<^sub>b b) =
              weight (Node w t\<^sub>1 t\<^sub>2)


proof (prove)
using this:
  list_all2 cr_dual_ord ?xs ?ys \<Longrightarrow> ?xs = map of_dual_ord ?ys

goal (1 subgoal):
 1. (list_all2 (pcr_dual_ord (=)) ===> pcr_dual_ord (=)) med med'


proof (prove)
goal (1 subgoal):
 1. SN r \<Longrightarrow> non_inf r


proof (prove)
using this:
  P \<turnstile> Ts'' [\<le>] Ts'

goal (1 subgoal):
 1. length Ts'' = length Ts'


proof (prove)
goal (1 subgoal):
 1. \<And>nat.
       \<lbrakk>steps0
                 (Suc 0, Bk # Oc \<up> m @ [Oc],
                  Bk #
                  Oc #
                  Bk \<up> ln @ Bk # Bk # Oc \<up> nat @ Oc # Bk \<up> rn)
                 t_wcode_adjust n =
                (0, a, b);
        wadjust_stop m nat (a, b); bl_bin (<args>) = Suc nat\<rbrakk>
       \<Longrightarrow> is_final
                          (steps0
                            (Suc 0, Bk # Oc # Oc \<up> m,
                             Bk #
                             Oc #
                             Bk \<up> ln @
                             Bk # Bk # Oc \<up> nat @ Oc # Bk \<up> rn)
                            t_wcode_adjust n) \<and>
                         wadjust_stop m
                          nat holds_for steps0
   (Suc 0, Bk # Oc # Oc \<up> m,
    Bk # Oc # Bk \<up> ln @ Bk # Bk # Oc \<up> nat @ Oc # Bk \<up> rn)
   t_wcode_adjust n


proof (prove)
goal (1 subgoal):
 1. \<And>set.
       closed_csubspace set \<Longrightarrow>
       bounded_clinear (projection set)


proof (prove)
using this:
  \<i>[trg f] =
  \<lparr>Chn = \<p>\<^sub>1[f.dtrg, f.dtrg],
     Dom =
       \<lparr>Leg0 = \<p>\<^sub>1[f.dtrg, f.dtrg],
          Leg1 = \<p>\<^sub>1[f.dtrg, f.dtrg]\<rparr>,
     Cod = \<lparr>Leg0 = f.dtrg, Leg1 = f.dtrg\<rparr>\<rparr>
  arrow_of_spans (\<cdot>) \<i>[trg f]
  ide f
  \<i>[?a] \<equiv>
  \<lparr>Chn = \<p>\<^sub>0[Chn ?a, Chn ?a], Dom = Dom (?a \<star> ?a),
     Cod = Cod ?a\<rparr>
  ?\<nu> \<star> ?\<mu> \<equiv>
  if arr ?\<mu> \<and> arr ?\<nu> \<and> src ?\<nu> = trg ?\<mu>
  then \<lparr>Chn = chine_hcomp ?\<nu> ?\<mu>,
          Dom =
            \<lparr>Leg0 =
                      Leg0 (Dom ?\<mu>) \<cdot>
                      \<p>\<^sub>0[Leg0 (Dom ?\<nu>), Leg1 (Dom ?\<mu>)],
               Leg1 =
                 Leg1 (Dom ?\<nu>) \<cdot>
                 \<p>\<^sub>1[Leg0 (Dom ?\<nu>), Leg1 (Dom ?\<mu>)]\<rparr>,
          Cod =
            \<lparr>Leg0 =
                      Leg0 (Cod ?\<mu>) \<cdot>
                      \<p>\<^sub>0[Leg0 (Cod ?\<nu>), Leg1 (Cod ?\<mu>)],
               Leg1 =
                 Leg1 (Cod ?\<nu>) \<cdot>
                 \<p>\<^sub>1[Leg0
                               (Cod ?\<nu>), Leg1
        (Cod ?\<mu>)]\<rparr>\<rparr>
  else null
  \<lbrakk>arr ?\<mu>; ide ?f; src ?\<mu> = trg ?f\<rbrakk>
  \<Longrightarrow> chine_hcomp ?\<mu> ?f =
                    \<langle>Chn ?\<mu> \<cdot>
                             \<p>\<^sub>1[Leg0
     (Dom ?\<mu>), Leg1
                    (Dom ?f)] \<lbrakk>Leg0
  (Cod ?\<mu>), Leg1
                 (Cod ?f)\<rbrakk> \<p>\<^sub>0[Leg0
           (Dom ?\<mu>), Leg1 (Dom ?f)]\<rangle>
  arrow_of_spans (\<cdot>)
   \<lparr>Chn = \<p>\<^sub>0[f.dtrg, f.leg1],
      Dom =
        \<lparr>Leg0 = f.leg0 \<cdot> \<p>\<^sub>0[f.dtrg, f.leg1],
           Leg1 = \<p>\<^sub>1[f.dtrg, f.leg1]\<rparr>,
      Cod = Cod f\<rparr>
  arrow_of_spans (\<cdot>) (trg f)
  arrow_of_spans (\<cdot>) f
  arr ?\<mu> = arrow_of_spans (\<cdot>) ?\<mu>
  \<lbrakk>C.arr ?f; C.cod ?f = ?b\<rbrakk>
  \<Longrightarrow> ?b \<cdot> ?f = ?f
  src ?\<mu> \<equiv>
  if arr ?\<mu> then mkObj (C.cod (Leg0 (Dom ?\<mu>))) else null
  trg ?\<mu> \<equiv>
  if arr ?\<mu> then mkObj (C.cod (Leg1 (Dom ?\<mu>))) else null

goal (1 subgoal):
 1. Chn (\<i>[trg f] \<star> f) =
    \<langle>trg_trg_f.Prj\<^sub>0\<^sub>1 \<lbrakk>trg.leg0, f.leg1\<rbrakk> trg_trg_f.Prj\<^sub>0\<rangle>


proof (prove)
goal (1 subgoal):
 1. risk_neutral_prob N = (q = (1 + r - d) / (u - d))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_rbt lt; is_rbt rt\<rbrakk>
    \<Longrightarrow> is_rbt (rbt_union_with f lt rt)


proof (prove)
goal (1 subgoal):
 1. map_option (map_prod f id) (redT_updT ts ta t) =
    redT_updT (\<lambda>t. map_option (map_prod f id) (ts t))
     (convert_new_thread_action f ta) t


proof (prove)
goal (1 subgoal):
 1. seqll i (onll \<Gamma> P) = onll \<Gamma> (seqll i P)


proof (prove)
using this:
  finite ((\<lambda>x. indicat_real \<Omega> x *\<^sub>R f x) ` space M)

goal (1 subgoal):
 1. simple_bochner_integral (restrict_space M \<Omega>) f =
    simple_bochner_integral M
     (\<lambda>x. indicat_real \<Omega> x *\<^sub>R f x)


proof (prove)
using this:
  a \<in> carrier R
  b \<in> carrier R
  nonsingular a b
  on_curve a b p\<^sub>1
  on_curve a b p\<^sub>2
  on_curve a b p\<^sub>2

goal (1 subgoal):
 1. local.add a p\<^sub>1 (local.add a p\<^sub>2 p\<^sub>2) =
    local.add a (local.add a p\<^sub>1 p\<^sub>2) p\<^sub>2


proof (prove)
goal (1 subgoal):
 1. lcs x y - y = b - gcs a b


proof (prove)
goal (1 subgoal):
 1. (\<forall>x. P x) = (\<forall>y z. P (y ||| z))


proof (prove)
using this:
  dt (Suc t) \<noteq> [] \<or> dt (Suc (Suc t)) \<noteq> []

goal (1 subgoal):
 1. inf_last_ti dt (t + 2 + k) \<noteq> []


proof (prove)
using this:
  v = [y, x] @ c @ [x]
  T\<^sub>p [x, y] (c @ d) (OPT2 (c @ d) [x, y]) =
  length c div 2 + T\<^sub>p [x, y] d (OPT2 d [x, y]) \<and>
  length c mod 2 = 0

goal (1 subgoal):
 1. 1 + length c div 2 = length v div 2


proof (prove)
using this:
  \<lbrakk>nofail (step s); rwof m0 cond step s; cond s;
   inres (step s) ?s'\<rbrakk>
  \<Longrightarrow> rwof m0 cond step ?s'

goal (1 subgoal):
 1. \<lbrakk>nofail (step s); rwof m0 cond step s; cond s\<rbrakk>
    \<Longrightarrow> step s \<le> SPEC (rwof m0 cond step)


proof (prove)
goal (1 subgoal):
 1. pp_pm.deg_shifts (set xs) d (map (Poly_Mapping.map_key PP) fs) =
    map (Poly_Mapping.map_key PP) (deg_shifts_pp xs d fs)


proof (prove)
goal (2 subgoals):
 1. (\<lambda>n. 0) \<longlonglongrightarrow> 0
 2. \<And>x.
       1 \<le> x \<Longrightarrow>
       0 =
       ((\<Sum>r<x.
            \<Sum>k\<le>2 * r.
               Fourier_coefficient f k * trigonometric_set k t) /
        real x -
        l) *
       pi -
       (LINT xa|lebesgue_on {0..pi}.
           Fejer_kernel x xa * (f (t + xa) + f (t - xa) - 2 * l))


proof (prove)
using this:
  supp (\<lambda>n. if n = 0 then c else (0::'a)) =
  (if c = (0::'a) then {} else {0})

goal (1 subgoal):
 1. bdd_below (supp (\<lambda>n. if n = 0 then c else (0::'a))) \<and>
    (LCM r\<in>supp (\<lambda>n. if n = 0 then c else (0::'a)).
        snd (quotient_of r)) \<noteq>
    0


proof (prove)
goal (1 subgoal):
 1. (\<lbrace> \<Delta> \<rbrace>\<rho> f|` (- domA \<Gamma>))
     x \<sqsubseteq>
    ((\<lbrace> \<Delta> @ \<Gamma> \<rbrace>\<rho>) f|` (- domA \<Gamma>))
     x


proof (prove)
goal (1 subgoal):
 1. (f(x := y), f) \<in> oexp


proof (prove)
goal (1 subgoal):
 1. invar (deleteMin bq) =
    invar
     (insertList
       (filter (\<lambda>t. rank t = 0) (children (getMinTree bq)))
       (meld
         (rev (filter (\<lambda>t. 0 < rank t) (children (getMinTree bq))))
         (remove1 (getMinTree bq) bq)))


proof (prove)
using this:
  mantissa f \<noteq> 0
  m = mantissa f * 2 ^ i
  e = exponent f - int i

goal (1 subgoal):
 1. bitlen \<bar>mantissa f\<bar> + exponent f =
    (if m = 0 then 0 else bitlen \<bar>m\<bar> + e)


proof (prove)
goal (1 subgoal):
 1. atoms
     ((F \<^bold>\<rightarrow> G) \<^bold>\<and>
      (G \<^bold>\<rightarrow> F)) =
    atoms F \<union> atoms G


proof (prove)
goal (1 subgoal):
 1. \<And>x1 t1 t2.
       \<lbrakk>bt_map (f \<circ> g) t1 = bt_map f (bt_map g t1);
        bt_map (f \<circ> g) t2 = bt_map f (bt_map g t2)\<rbrakk>
       \<Longrightarrow> bt_map (f \<circ> g) (Br x1 t1 t2) =
                         bt_map f (bt_map g (Br x1 t1 t2))


proof (prove)
using this:
  \<forall>(x, m)\<in>clkp_set A.
     m \<le> real (k x) \<and> x \<in> X \<and> m \<in> \<nat>
  A \<turnstile> l \<longrightarrow>\<^bsup>g,a,r\<^esup> l'

goal (1 subgoal):
 1. \<forall>(x, m)\<in>collect_clock_pairs g.
       m \<le> real (k x) \<and> x \<in> X \<and> m \<in> \<nat>


proof (prove)
using this:
  \<forall>\<^sub>F x in at_top. 0 < x powr p'

goal (1 subgoal):
 1. \<forall>\<^sub>F x in sequentially. 0 < f x


proof (state)
goal (1 subgoal):
 1. \<exists>m\<le>n.
       ( \<Gamma> \<oplus> A \<Rightarrow>* B, m)
       \<in> derivable Ax \<union> g3ip*


proof (prove)
goal (1 subgoal):
 1. R \<upharpoonleft> P \<otimes> (\<lambda>_. False) = \<bottom>


proof (prove)
using this:
  {(y, xc'). y \<in> cbox (g2 xc) (g1 xc) \<and> xc' = xc}
  \<subseteq> Dx_pair

goal (1 subgoal):
 1. ((\<lambda>y.
         partial_vector_derivative (\<lambda>a. F a \<bullet> j) i
          (y, xc)) has_integral
     F (g1 xc, xc) \<bullet> j - F (g2 xc, xc) \<bullet> j)
     (cbox (g2 xc) (g1 xc))


proof (prove)
using this:
  sum_list (replicate n w1) \<le> sum_list (replicate n w2)
  w1 \<le> w2

goal (1 subgoal):
 1. sum_list (replicate (Suc n) w1) \<le> sum_list (replicate (Suc n) w2)


proof (state)
this:
  \<forall>i.
     (case u i of (u, v) \<Rightarrow> \<lambda>(u', v'). r u u' OO r' v v')
      (u (Suc i)) (x i) (z i)

goal (1 subgoal):
 1. \<And>x xa.
       \<forall>f.
          (case u f of
           (u, v) \<Rightarrow> \<lambda>(u', v'). r u u' OO r' v v')
           (u (Suc f)) (x f) (xa f) \<Longrightarrow>
       \<exists>ua.
          (\<forall>f. r (fst (u f)) (fst (u (Suc f))) (x f) (ua f)) \<and>
          (\<forall>f. r' (snd (u f)) (snd (u (Suc f))) (ua f) (xa f))


proof (prove)
goal (1 subgoal):
 1. card (dom \<sigma>') \<le> q + card (dom \<sigma>)


proof (prove)
goal (2 subgoals):
 1. \<lbrakk>R module M1; R module M2; R module N; m1 \<in> carrier M1;
     m2 \<in> carrier M2; r \<in> carrier R; bilinear_map f R M1 M2 N;
     aGroup N\<rbrakk>
    \<Longrightarrow> r \<cdot>\<^sub>s\<^bsub>N\<^esub> f (m1, m2)
                      \<in> carrier N
 2. \<lbrakk>R module M1; R module M2; R module N; m1 \<in> carrier M1;
     m2 \<in> carrier M2; r \<in> carrier R; bilinear_map f R M1 M2 N;
     aGroup N\<rbrakk>
    \<Longrightarrow> f (r \<cdot>\<^sub>s\<^bsub>M1\<^esub> m1, m2) =
                      r \<cdot>\<^sub>s\<^bsub>N\<^esub> f (m1, m2)


proof (prove)
using this:
  g \<in> carrier G
  U = N #> g
  ?x \<in> carrier G \<Longrightarrow> inv ?x \<in> carrier G
  g \<otimes> h \<in> carrier G
  N \<lhd> G
  \<lbrakk>?H \<lhd> ?G; ?x \<in> carrier ?G; ?y \<in> carrier ?G\<rbrakk>
  \<Longrightarrow> ?H #>\<^bsub>?G\<^esub> ?x <#>\<^bsub>?G\<^esub>
                    (?H #>\<^bsub>?G\<^esub> ?y) =
                    ?H #>\<^bsub>?G\<^esub>
                    ?x \<otimes>\<^bsub>?G\<^esub> ?y

goal (1 subgoal):
 1. N #> g \<otimes> h <#> (N #> inv g) = N #> g \<otimes> h \<otimes> inv g


proof (prove)
goal (1 subgoal):
 1. unit_factor f = f


proof (prove)
goal (1 subgoal):
 1. (x \<in> set_option (local.MaxR.MaxR_opt X)) =
    (set_option (local.MaxR.MaxR_opt X) = {x})


proof (prove)
using this:
  \<exists>v.
     fetch_instruction (delayed_pool_write s1) = Inr v \<and>
     fetch_instruction (delayed_pool_write s2) = Inr v \<and>
     (\<nexists>e. decode_instruction v = Inl e)
  \<nexists>e. decode_instruction ?v1.0 = Inl e \<Longrightarrow>
  \<exists>v2. decode_instruction ?v1.0 = Inr v2

goal (1 subgoal):
 1. \<exists>v.
       fetch_instruction (delayed_pool_write s1) = Inr v \<and>
       fetch_instruction (delayed_pool_write s2) = Inr v \<and>
       (\<exists>v1. decode_instruction v = Inr v1)


proof (prove)
goal (1 subgoal):
 1. (\<sigma>\<^bsup>Suc l\<^esup>) v = (\<sigma>'\<^bsup>Suc l'\<^esup>) v


proof (prove)
goal (1 subgoal):
 1. span_in_category (\<cdot>)
     \<lparr>Leg0 = f.leg0 \<cdot> \<p>\<^sub>0[f.dtrg, f.leg1],
        Leg1 = \<p>\<^sub>1[f.dtrg, f.leg1]\<rparr>


proof (prove)
goal (1 subgoal):
 1. independent S \<Longrightarrow> finite S \<and> card S \<le> DIM('a)


proof (prove)
using this:
  distincts (xs # xss)
  ?xs \<in> set (xs # xss) \<Longrightarrow>
  list_succ ?xs = perm_restrict f (set ?xs)
  f permutes \<Union> (sset (xs # xss))

goal (1 subgoal):
 1. f = lists_succ (xs # xss)


proof (prove)
using this:
  0 < 2 \<Longrightarrow>
  ((\<lambda>x.
       ((1 - x) ^ (2 - 1) / fact (2 - 1)) *\<^sub>R
       nth_derivative 2 f (X + x *\<^sub>R H) H) has_integral
   f (X + H) - (\<Sum>i<2. (1 / fact i) *\<^sub>R nth_derivative i f X H))
   {0..1}
  0 < 2 \<Longrightarrow>
  f (X + H) =
  (\<Sum>i<2. (1 / fact i) *\<^sub>R nth_derivative i f X H) +
  integral {0..1}
   (\<lambda>x.
       ((1 - x) ^ (2 - 1) / fact (2 - 1)) *\<^sub>R
       nth_derivative 2 f (X + x *\<^sub>R H) H)
  0 < 2 \<Longrightarrow>
  (\<lambda>x.
      ((1 - x) ^ (2 - 1) / fact (2 - 1)) *\<^sub>R
      nth_derivative 2 f (X + x *\<^sub>R H) H) integrable_on
  {0..1}

goal (1 subgoal):
 1. (i has_integral f (X + H) - (f X + nth_derivative 1 f X H)) {0..1} &&&
    f (X + H) = f X + nth_derivative 1 f X H + integral {0..1} i &&&
    i integrable_on {0..1}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>gallery Cs; \<not> min_gallery Cs;
     {} \<notin> set (wall_crossings Cs)\<rbrakk>
    \<Longrightarrow> \<exists>f g As A B Bs E F Fs.
                         (f, g) \<in> foldpairs \<and>
                         A \<in> f \<turnstile> \<C> \<and>
                         B \<in> g \<turnstile> \<C> \<and>
                         E \<in> g \<turnstile> \<C> \<and>
                         F \<in> f \<turnstile> \<C> \<and>
                         (Cs = As @ [A, B, F] @ Fs \<or>
                          Cs = As @ [A, B] @ Bs @ [E, F] @ Fs)


proof (prove)
using this:
  k-smooth_on S f
  0 < k

goal (1 subgoal):
 1. f differentiable_on S


proof (prove)
using this:
  (\<lambda>xs.
      case xs of TNil b \<Rightarrow> bot b
      | TCons x xs' \<Rightarrow> f x xs' xs) `
  Y =
  bot ` terminal ` Y
  local.tSup Y = TNil (flat_lub b (terminal ` Y))
  Complete_Partial_Order.chain (flat_ord b) (terminal ` Y)
  Y \<noteq> {}

goal (1 subgoal):
 1. (case local.tSup Y of TNil b \<Rightarrow> bot b
     | TCons x xs' \<Rightarrow> f x xs' (local.tSup Y)) =
    lub ((\<lambda>xs.
             case xs of TNil b \<Rightarrow> bot b
             | TCons x xs' \<Rightarrow> f x xs' xs) `
         Y)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>H \<turnstile> SeqSubstFormP v tm x z s k;
     insert (SeqSubstFormP v tm y z s k) H \<turnstile> A\<rbrakk>
    \<Longrightarrow> insert (x EQ y) H \<turnstile> A


proof (prove)
goal (1 subgoal):
 1. R_scalar_mult.R_lin_independent UNIV (\<currency>\<currency>)
     (concat hfvss)


proof (state)
this:
  det (interchange_rows (bezout_matrix A a b j bezout) a b) = - (1::'a)

goal (2 subgoals):
 1. p = (0::'a) \<Longrightarrow>
    det (bezout_matrix A a b j bezout) = (1::'a)
 2. p \<noteq> (0::'a) \<Longrightarrow>
    det (bezout_matrix A a b j bezout) = (1::'a)


proof (prove)
using this:
  Keys (fst ` set (full_gb (gs @ bs))) = {}

goal (1 subgoal):
 1. dgrad_p_set_le d (fst ` set (fst (full_gb (gs @ bs), D)))
     (args_to_set (gs, bs, ps))


proof (prove)
goal (1 subgoal):
 1. A \<in> set As \<and> B \<in> set As


proof (prove)
using this:
  smem_ind s i = Some j
  run_one_step d i (s, vs, ves, $b_e) = (s', vs', RSNormal es')
  b_e = Grow_memory
  ves = a # list
  a = ConstInt32 x1
  \<lbrakk>smem_ind ?s ?i = Some ?j1; s.mem ?s ! ?j1 = ?m1;
   mem_size ?m1 = ?n1; mem_grow ?m1 (nat_of_int ?c1) = ?mem'1;
   const_list ?cs\<rbrakk>
  \<Longrightarrow> \<lparr>?s;?vs;?cs @
                                   [$C ConstInt32 ?c1,
                                    $Grow_memory]\<rparr> \<leadsto>_ ?i \<lparr>?s
                    \<lparr>s.mem := (s.mem ?s)
                              [?j1 :=
                                 ?mem'1]\<rparr>;?vs;?cs @
               [$C ConstInt32 (int_of_nat ?n1)]\<rparr>
  \<lbrakk>smem_ind ?s ?i = Some ?j1; s.mem ?s ! ?j1 = ?m1;
   mem_size ?m1 = ?n1; const_list ?cs\<rbrakk>
  \<Longrightarrow> \<lparr>?s;?vs;?cs @
                                   [$C ConstInt32 ?c1,
                                    $Grow_memory]\<rparr> \<leadsto>_ ?i \<lparr>?s;?vs;?cs @
            [$C ConstInt32 int32_minus_one]\<rparr>
  const_list (vs_to_es list)

goal (1 subgoal):
 1. \<lparr>s;vs;vs_to_es ves @
                 [$b_e]\<rparr> \<leadsto>_ i \<lparr>s';vs';es'\<rparr>


proof (state)
this:
  P y

goal (2 subgoals):
 1. ?P \<Longrightarrow>
    \<exists>us vs.
       y # ys = us @ x # vs \<and>
       (\<forall>u\<in>set us. \<not> P u) \<and>
       P x \<and> xs = filter P vs
 2. \<not> ?P \<Longrightarrow>
    \<exists>us vs.
       y # ys = us @ x # vs \<and>
       (\<forall>u\<in>set us. \<not> P u) \<and>
       P x \<and> xs = filter P vs


proof (prove)
using this:
  \<not> nonrec \<Gamma>

goal (1 subgoal):
 1. ccHeap \<Gamma> e\<cdot>a G|` (- domA \<Gamma>) \<sqsubseteq>
    ccExp_syn a (Terms.Let \<Gamma> e)


proof (prove)
using this:
  S' \<turnstile> \<^bold>\<bottom>
  set S' \<subseteq> \<Union> (range (extend S f))

goal (1 subgoal):
 1. (\<And>m.
        set S' \<subseteq> \<Union> (extend S f ` {..m}) \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<And>G.
       \<lbrakk>F ok G; F \<squnion> G \<in> X;
        extend h F ok extend h G \<longrightarrow>
        extend h F \<squnion> extend h G
        \<in> extend h ` X \<longrightarrow>
        extend h F \<squnion> extend h G \<in> extend h ` Y\<rbrakk>
       \<Longrightarrow> F \<squnion> G \<in> Y


proof (prove)
goal (1 subgoal):
 1. (A <: B \<longrightarrow> V B \<sqsubseteq> V A) \<and>
    (f1 <:: f2 \<longrightarrow> Vf f2 \<lesssim> Vf f1)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valuation K v; s \<in> carrier K; t \<in> carrier K;
     0 \<le> v s; v t < 0\<rbrakk>
    \<Longrightarrow> 0 < v (1\<^sub>r \<plusminus>
                             -\<^sub>a t \<cdot>\<^sub>r
 (s \<plusminus> t)\<^bsup>\<hyphen> K\<^esup>)


proof (prove)
goal (1 subgoal):
 1. j permutes UNIV \<Longrightarrow>
    degree (\<Prod>i\<in>UNIV. to_fun A i (j i)) \<le> max_perm_degree A


proof (prove)
using this:
  enat n \<le> llength E
  E' n \<in> \<E> \<and>
  is_write_seen P (E' n) (ws' n) \<and>
  thread_start_actions_ok (E' n) \<and>
  (enat n \<le> llength E \<longrightarrow>
   enat n \<le> llength (E' n)) \<and>
  ltake (enat (n - Suc 0)) E = ltake (enat (n - Suc 0)) (E' n) \<and>
  (0 < n \<longrightarrow>
   action_tid (E' n) (n - Suc 0) = action_tid E (n - Suc 0) \<and>
   (if n - Suc 0 \<in> read_actions E then sim_action else (=))
    (action_obs (E' n) (n - Suc 0)) (action_obs E (n - Suc 0)) \<and>
   (\<forall>i<n - Suc 0.
       i \<in> read_actions E \<longrightarrow> ws' n i = ws i)) \<and>
  (\<forall>r\<in>read_actions (E' n).
      n - Suc 0 \<le> r \<longrightarrow>
      P,E' n \<turnstile> ws' n r \<le>hb r)

goal (1 subgoal):
 1. llength (ltake (enat n) (E' n)) = llength (ltake (enat n) E)


proof (prove)
using this:
  ((\<lambda>t. V (flow0 x t)) has_derivative
   (\<lambda>t. t *\<^sub>R V' (flow0 x s) (f (flow0 x s))))
   (at s)

goal (1 subgoal):
 1. ((\<lambda>t. V (flow0 x t)) has_derivative
     (*) (V' (flow0 x s) (f (flow0 x s))))
     (at s)


proof (prove)
using this:
  n cd\<^bsup>\<pi>\<^esup>\<rightarrow> m

goal (1 subgoal):
 1. \<exists>ns.
       cs\<^bsup>\<pi>\<^esup> n =
       cs\<^bsup>\<pi>\<^esup> m @ ns @ [\<pi> n]


proof (prove)
using this:
  ?bl \<in># filter_mset ((\<in>) x) \<B> \<Longrightarrow>
  size {#p \<in># mset_set (\<V> - {x}). p \<in> ?bl#} = nat (\<k> - 1)

goal (1 subgoal):
 1. size
     (\<Sum>bl\<in>#filter_mset ((\<in>) x)
                     \<B>. {#p \<in># mset_set (\<V> - {x}).
                            p \<in> bl#} \<times>#
                           {#bl#}) =
    size (filter_mset ((\<in>) x) \<B>) * nat (\<k> - 1)


proof (state)
this:
  (V, V') \<in> S

goal (2 subgoals):
 1. \<And>a b aa ba.
       \<lbrakk>(a, b) \<in> S; (aa, ba) \<in> S\<rbrakk>
       \<Longrightarrow> length aa = length ba
 2. \<And>a b aa ba i m1 m1' m2 W.
       \<lbrakk>(a, b) \<in> S; (aa, ba) \<in> S; i < length aa;
        \<langle>aa ! i,m1\<rangle> \<rightarrow> \<langle>W,m2\<rangle>;
        m1 =\<^bsub>d\<^esub> m1'\<rbrakk>
       \<Longrightarrow> \<exists>W' m2'.
                            \<langle>ba ! i,m1'\<rangle> \<rightarrow>
                            \<langle>W',m2'\<rangle> \<and>
                            (W, W') \<in> S \<and> m2 =\<^bsub>d\<^esub> m2'


proof (prove)
goal (1 subgoal):
 1. A - Coset t = rbt_filter (\<lambda>k. k \<in> A) t


proof (prove)
using this:
  a = check
  \<S>' =
  update\<^sub>s\<^sub>t \<S>
   (\<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t # S)
  \<A>' = \<A> @ [Step \<langle>a: t \<doteq> t'\<rangle>\<^sub>s\<^sub>t]

goal (1 subgoal):
 1. assignment_rhs\<^sub>e\<^sub>s\<^sub>t \<A>' =
    assignment_rhs\<^sub>e\<^sub>s\<^sub>t \<A>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>c21'.
                \<lbrakk>c1 = c1' @ qs' # c21';
                 c2' = c21' @ qs # c2\<rbrakk>
                \<Longrightarrow> thesis;
     \<lbrakk>c1' = c1; qs' = qs; c2' = c2\<rbrakk>
     \<Longrightarrow> thesis;
     \<And>c21.
        \<lbrakk>c1' = c1 @ qs # c21; c2 = c21 @ qs' # c2'\<rbrakk>
        \<Longrightarrow> thesis;
     c1 = c1' @ us \<and> us @ qs # c2 = qs' # c2' \<or>
     c1 @ us = c1' \<and> qs # c2 = us @ qs' # c2'\<rbrakk>
    \<Longrightarrow> thesis


proof (prove)
using this:
  length xl = length al
  distinct xl
  ?i1 < length xl \<Longrightarrow> intT (tpOfV (xl ! ?i1)) (al ! ?i1)
  i < length xl
  \<lbrakk>length ?xl = length ?al; distinct ?xl;
   \<And>i.
      i < length ?xl \<Longrightarrow>
      intT (tpOfV (?xl ! i)) (?al ! i)\<rbrakk>
  \<Longrightarrow> wtE (pickE ?xl ?al) \<and>
                    (\<forall>i<length ?xl.
                        pickE ?xl ?al (?xl ! i) = ?al ! i)

goal (1 subgoal):
 1. pickE xl al (xl ! i) = al ! i


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>y1 - y2 \<in> carrier_vec n; y1 \<in> carrier_vec n;
     y2 \<in> carrier_vec n; x \<in> carrier_vec n;
     - y1 \<in> carrier_vec n; 0\<^sub>v n \<in> carrier_vec n\<rbrakk>
    \<Longrightarrow> y1 \<bullet> y1 - y1 \<bullet> y2 -
                      (y2 \<bullet> y1 - y2 \<bullet> y2) =
                      (0::'a)


proof (prove)
goal (1 subgoal):
 1. \<one>\<^bsub>int_group\<^esub>
    \<in> \<langle>{1}\<rangle>\<^bsub>int_group\<^esub>


proof (prove)
using this:
  C.ide b
  C.ide a
  ?A \<subseteq> S.Univ \<Longrightarrow>
  S.mkArr ?A ?A (\<lambda>x. x) = S.mkIde ?A
  \<lbrakk>C.ide ?b; C.ide ?a\<rbrakk>
  \<Longrightarrow> local.set (?b, ?a) \<subseteq> S.Univ

goal (1 subgoal):
 1. S.mkArr (local.set (b, a)) (local.set (b, a)) (\<lambda>h. h) =
    S.mkIde (local.set (b, a))


proof (prove)
using this:
  {x. A *v x = 0} = {0}
  A *v x = 0

goal (1 subgoal):
 1. x = 0


proof (prove)
goal (1 subgoal):
 1. hom (\<lambda>i. var (f i)) \<bottom> = \<bottom>


proof (prove)
using this:
  ?i \<in> agents' \<Longrightarrow> finite_total_preorder_on alts' (R' ?i)
  ?i \<notin> agents' \<Longrightarrow> R' ?i = (\<lambda>_ _. False)
  pref_profile_wf agents alts R
  agents \<subseteq> agents'
  alts \<subseteq> alts'
  finite alts'
  R' \<equiv> lift_pref_profile agents alts agents' alts' R

goal (1 subgoal):
 1. (agents' \<noteq> {} \<and> alts' \<noteq> {}) \<and>
    (\<forall>i.
        i \<in> agents' \<longrightarrow>
        finite_total_preorder_on alts' (R' i)) \<and>
    (\<forall>i x y. i \<notin> agents' \<longrightarrow> \<not> R' i x y)


proof (prove)
goal (1 subgoal):
 1. \<forall>na.
       \<exists>m.
          \<forall>s1 s2.
             X na s1 s2 \<longrightarrow>
             wf_state s1 \<and>
             wf_state s2 \<and>
             final s1 = final s2 \<and>
             (\<forall>x\<in>set (\<sigma> n).
                 \<exists>x' y'.
                    Y m x' y' \<and>
                    post x' = post (delta x s1) \<and>
                    post y' = post (delta x s2)) \<Longrightarrow>
    \<forall>s1 s2.
       Sup (range X) s1 s2 \<longrightarrow>
       wf_state s1 \<and>
       wf_state s2 \<and>
       final s1 = final s2 \<and>
       (\<forall>x\<in>set (\<sigma> n).
           \<exists>x' y'.
              Sup (range Y) x' y' \<and>
              post x' = post (delta x s1) \<and>
              post y' = post (delta x s2))


proof (prove)
using this:
  D.ide ?a \<Longrightarrow> \<l>\<^sub>D[?a] = ?a

goal (1 subgoal):
 1. \<And>t.
       \<lbrakk>Can t \<Longrightarrow> D.ide \<lbrace>t\<rbrace>;
        Can \<^bold>\<l>\<^bold>[t\<^bold>]\<rbrakk>
       \<Longrightarrow> D.ide
                          \<lbrace>\<^bold>\<l>\<^bold>[t\<^bold>]\<rbrace>


proof (prove)
using this:
  ?y2 \<in> M' \<Longrightarrow> ?y2 \<cdot>' \<eta> \<one> = ?y2

goal (1 subgoal):
 1. \<eta> \<one> = \<one>'


proof (prove)
goal (1 subgoal):
 1. {} \<turnstile>
    AbstFormP \<guillemotleft>Var i\<guillemotright> (ORD_OF n)
     (quot_dbfm db) (quot_dbfm (abst_dbfm i n db))


proof (state)
this:
  int (y mod order \<G>) =
  (int d' - int d) * Number_Theory_Aux.inverse (m - m') (order \<G>) mod
  int (order \<G>)

goal (1 subgoal):
 1. y =
    nat ((int d' - int d) *
         Number_Theory_Aux.inverse (m - m') (order \<G>) mod
         int (order \<G>))


proof (prove)
goal (1 subgoal):
 1. comm_group (monoid_vec TYPE('a) n)


proof (prove)
goal (1 subgoal):
 1. (mset (map ((!) ss) (\<sigma> (f, length ss))),
     mset (map ((!) ss) (\<sigma> (f, length ss))))
    \<in> ns_mul_ext WPO_NS WPO_S


proof (prove)
using this:
  sanity_wf_ruleset \<Gamma>
  chain_name \<in> set (map fst \<Gamma>)
  default_action = action.Accept \<or> default_action = action.Drop
  matcher_agree_on_exact_matches \<gamma> common_matcher
  unfold_ruleset_CHAIN_safe chain_name default_action (map_of \<Gamma>) =
  Some rs

goal (3 subgoals):
 1. \<And>m.
       Semantics.matches \<gamma> (optimize_primitive_univ m) p =
       Semantics.matches \<gamma> m p
 2. unfold_optimize_ruleset_CHAIN optimize_primitive_univ chain_name
     default_action (map_of \<Gamma>) =
    Some rs
 3. simple_ruleset rs


proof (prove)
goal (1 subgoal):
 1. mon_loc fg (e # w) =
    (case e of LOC a \<Rightarrow> mon_w fg a
     | ENV a \<Rightarrow> {}) \<union>
    mon_loc fg w


proof (prove)
using this:
  continuous_on S f \<and>
  (\<exists>Sa. finite Sa \<and> f C1_differentiable_on S - Sa)
  f ` S \<subseteq> {0<..}

goal (1 subgoal):
 1. continuous_on S (\<lambda>x. sqrt (f x)) \<and>
    (\<exists>Sa.
        finite Sa \<and>
        (\<lambda>x. sqrt (f x)) C1_differentiable_on S - Sa)


Step error: Outer syntax error (line 1)
At command "<malformed>" (line 1)


proof (prove)
goal (1 subgoal):
 1. length [0..<length B] = length B


proof (prove)
using this:
  0 \<le> fls_subdegree g
  fls_base_factor g \<noteq> 0

goal (1 subgoal):
 1. fls_regpart (f / g) = fls_regpart f / fls_regpart g


proof (prove)
using this:
  proj2_rep ` (range (($) a) - {a $ i}) =
  proj2_rep ` range (($) a) - {proj2_rep (a $ i)}
  proj2_rep (a $ i) \<in> proj2_rep ` range (($) a)
  card (proj2_rep ` range (($) a)) = 3

goal (1 subgoal):
 1. card (proj2_rep ` (range (($) a) - {a $ i})) = 2


proof (prove)
goal (1 subgoal):
 1. i1 = i2


proof (prove)
using this:
  \<Psi> \<otimes>
  \<Psi>\<^sub>P \<rhd> \<lparr>\<nu>x\<rparr>Q \<longmapsto> M'\<lparr>N\<rparr> \<prec> xQ'
  x \<sharp> \<Psi> \<otimes> \<Psi>\<^sub>P
  x \<sharp> M'
  x \<sharp> N
  x \<sharp> xQ'

goal (1 subgoal):
 1. \<exists>P'a.
       \<Psi> \<rhd> \<lparr>\<nu>x\<rparr>(P \<parallel>
      Q) \<longmapsto> \<tau> \<prec> P'a \<and>
       (\<Psi>, P'a, \<lparr>\<nu>*xvec\<rparr>P' \<parallel> xQ') \<in> Rel


proof (prove)
using this:
  NEST a \<and>
  NEST a \<and>
  (\<exists>n m. n \<in> a \<and> m \<in> a \<and> (n, m) \<in> b)

goal (1 subgoal):
 1. NEST a


proof (prove)
using this:
  ?i \<in> I \<Longrightarrow> {x \<in> \<Omega>. P ?i x} \<in> M
  countable I
  {x \<in> \<Omega>. \<exists>!i. i \<in> I \<and> P i x} =
  {x \<in> \<Omega>.
   \<exists>i\<in>I.
      P i x \<and> (\<forall>j\<in>I. P j x \<longrightarrow> i = j)}

goal (1 subgoal):
 1. {x \<in> \<Omega>. \<exists>!i. i \<in> I \<and> P i x} \<in> M


proof (prove)
goal (1 subgoal):
 1. simple_match_port (sports r) (p_sport p)


proof (prove)
using this:
  Nom i at j in' H
  ?k \<in> A \<longrightarrow>
  Nom ?k at ?j in' H \<longrightarrow>
  Nom ?i at ?j in' H \<longrightarrow> Nom ?k at ?i in' H
  k \<in> A
  Nom j at i in' H
  Nom k at j in' H

goal (1 subgoal):
 1. Nom k at i in' H


proof (prove)
using this:
  <a>:M \<in> \<parallel><B>\<parallel>
  SNa M
  x:N \<in> \<parallel>(B)\<parallel>
  SNa N

goal (1 subgoal):
 1. SNa (Cut <a>.M x.N)


proof (prove)
using this:
  ?x \<in> space M \<Longrightarrow>
  (\<lambda>i. u i ?x) \<longlonglongrightarrow> u' ?x

goal (1 subgoal):
 1. \<And>x.
       x \<in> space M \<Longrightarrow>
       liminf (\<lambda>n. ereal (u n x)) = ereal (u' x)


proof (prove)
goal (1 subgoal):
 1. finite (nodes g) \<Longrightarrow>
    num_of_odd_nodes (g\<lparr>edges := {}\<rparr>) = 0


proof (prove)
using this:
  ?ss \<in> lists S \<Longrightarrow>
  flipped_reflections (sum_list ?ss) =
  {t \<in> \<Union>w\<in>W. lconjby w ` S.
   \<not> gcd_nat.greater_eq (count_list (lconjseq ?ss) t) 2}
  odd ?m \<Longrightarrow> ?m \<noteq> (0::?'b)
  ?x \<notin> set (lconjseq ss) \<Longrightarrow>
  count_list (lconjseq ss) ?x = 0

goal (1 subgoal):
 1. ss \<in> lists S \<Longrightarrow>
    order.greater_eq (set (lconjseq ss)) (flipped_reflections (sum_list ss))


proof (prove)
goal (1 subgoal):
 1. v \<in> reachable_nodes g r


proof (prove)
using this:
  is_cnf \<^bold>\<Or>l # ls

goal (1 subgoal):
 1. is_cnf \<^bold>\<Or>ls


proof (prove)
using this:
  R \<subseteq> B \<times> B

goal (1 subgoal):
 1. Domain R \<union> Range R \<subseteq> B


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       x \<in> cball \<xi> r \<Longrightarrow>
       (\<Sum>i. a i * (x - \<xi>) ^ i) = f x


proof (prove)
goal (1 subgoal):
 1. game \<A> = game_multi (\<lambda>_. \<A>)


proof (prove)
goal (1 subgoal):
 1. indexed_weak_nominal_ts TYPE('idx) (S_action.Act \<tau>)
     (\<turnstile>\<^sub>S) (\<rightarrow>\<^sub>S)


proof (prove)
goal (1 subgoal):
 1. \<And>k.
       \<lbrakk>k \<in> \<int>; \<bar>k\<bar> \<le> 2 ^ (2 * n)\<rbrakk>
       \<Longrightarrow> Measurable.pred (lebesgue_on S)
                          (\<lambda>x.
                              k / 2 ^ n \<le> f x \<and>
                              f x < (k + 1) / 2 ^ n)


proof (state)
goal (1 subgoal):
 1. AE x in P. \<forall>\<^sub>F n in sequentially.
                  2 < (\<Sum>i<n. h ((T ^^ i) x))


proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<not> zeroring R; M fgover R; submodule R M N; ideal R A;
     A \<subseteq> J_rad R;
     carrier (M /\<^sub>m N) =
     {\<zero>\<^bsub>M /\<^sub>m N\<^esub>}\<rbrakk>
    \<Longrightarrow> carrier M = N
 2. \<lbrakk>\<not> zeroring R; M fgover R; submodule R M N; ideal R A;
     A \<subseteq> J_rad R;
     carrier M = A \<odot>\<^bsub>R\<^esub> M \<minusplus> N\<rbrakk>
    \<Longrightarrow> A \<odot>\<^bsub>R\<^esub> M /\<^sub>m N =
                      carrier (M /\<^sub>m N)


proof (prove)
goal (1 subgoal):
 1. kmp_SPEC s t =
    RETURN (if sublist s t then Some (LEAST i. sublist_at s t i) else None)


proof (prove)
using this:
  \<lbrakk>?s \<in> valid_states;
   \<forall>op\<in>set ops.
      \<exists>ast_op\<in>set ast\<delta>. op = abs_ast_operator ast_op;
   sat_preconds_as ?s ops\<rbrakk>
  \<Longrightarrow> path_to ?s
                     (map (fst \<circ> the \<circ> lookup_action) ops)
                     (execute_serial_plan_sas_plus ?s ops)
  s \<in> valid_states
  \<forall>op\<in>set (a # ops).
     \<exists>ast_op\<in>set ast\<delta>. op = abs_ast_operator ast_op
  sat_preconds_as s (a # ops)

goal (1 subgoal):
 1. path_to s (map (fst \<circ> the \<circ> lookup_action) (a # ops))
     (execute_serial_plan_sas_plus s (a # ops))


proof (prove)
goal (4 subgoals):
 1. \<forall>n.
       n \<in> set (gen_wf_\<alpha>n gen_cfg_wf) \<longrightarrow>
       gen_wf_uses gen_cfg_wf n =
       gen_wf_var gen_cfg_wf ` gen_wf.uses' gen_cfg_wf n
 2. \<forall>n ns m.
       graph_path_base.path2 (\<lambda>_. gen_wf_\<alpha>n gen_cfg_wf)
        (\<lambda>_. True) (\<lambda>_. gen_wf_inEdges' gen_cfg_wf) () n ns
        m \<longrightarrow>
       n \<notin> set (tl ns) \<longrightarrow>
       (\<forall>a aa b.
           (a, aa, b)
           \<in> CFG_SSA_base.allDefs (\<lambda>_. gen_wf_defs' gen_cfg_wf)
                  (\<lambda>_. gen_wf.phis' gen_cfg_wf) ()
                  n \<longrightarrow>
           (a, aa, b)
           \<in> CFG_SSA_base.allUses
                  (\<lambda>_. gen_wf_\<alpha>n gen_cfg_wf)
                  (\<lambda>_. gen_wf_inEdges' gen_cfg_wf)
                  (\<lambda>_. gen_wf.uses' gen_cfg_wf)
                  (\<lambda>_. gen_wf.phis' gen_cfg_wf) ()
                  m \<longrightarrow>
           (\<forall>x.
               x \<in> set (tl ns) \<longrightarrow>
               (\<forall>ab ac ba.
                   (ab, ac, ba)
                   \<in> CFG_SSA_base.allDefs
                          (\<lambda>_. gen_wf_defs' gen_cfg_wf)
                          (\<lambda>_. gen_wf.phis' gen_cfg_wf) ()
                          x \<longrightarrow>
                   gen_wf_var gen_cfg_wf (ab, ac, ba) \<noteq>
                   gen_wf_var gen_cfg_wf (a, aa, b))))
 3. \<forall>n a aa b vs.
       gen_wf.phis' gen_cfg_wf (n, a, aa, b) = Some vs \<longrightarrow>
       (\<forall>ab ac ba.
           (ab, ac, ba) \<in> set vs \<longrightarrow>
           gen_wf_var gen_cfg_wf (ab, ac, ba) =
           gen_wf_var gen_cfg_wf (a, aa, b))
 4. \<forall>n.
       n \<in> set (gen_wf_\<alpha>n gen_cfg_wf) \<longrightarrow>
       (\<forall>a aa b.
           (a, aa, b)
           \<in> CFG_SSA_base.allDefs (\<lambda>_. gen_wf_defs' gen_cfg_wf)
                  (\<lambda>_. gen_wf.phis' gen_cfg_wf) ()
                  n \<longrightarrow>
           (\<forall>ab ac ba.
               (ab, ac, ba)
               \<in> CFG_SSA_base.allDefs
                      (\<lambda>_. gen_wf_defs' gen_cfg_wf)
                      (\<lambda>_. gen_wf.phis' gen_cfg_wf) ()
                      n \<longrightarrow>
               (a = ab \<longrightarrow>
                aa = ac \<longrightarrow> b \<noteq> ba) \<longrightarrow>
               gen_wf_var gen_cfg_wf (ab, ac, ba) \<noteq>
               gen_wf_var gen_cfg_wf (a, aa, b)))


proof (prove)
goal (1 subgoal):
 1. class.enum (map abs [0..<n]) (Ball (set (map abs [0..<n])))
     (Bex (set (map abs [0..<n])))


proof (prove)
goal (1 subgoal):
 1. sum_list xs = sum ((!) xs) {0..<length xs}


proof (prove)
goal (1 subgoal):
 1. (concat xs, concat ys) \<in> \<langle>A\<rangle>list_rel


proof (prove)
goal (1 subgoal):
 1. \<And>x y xa ya.
       rel_pred A xa ya \<Longrightarrow>
       rel_pred (rel_option A) (Some ` xa) (Some ` ya)


proof (prove)
goal (1 subgoal):
 1. (MP_Rel ===> (=)) prime_elem_m prime_elem


proof (prove)
goal (1 subgoal):
 1. simply_connected (rel_frontier S)


proof (prove)
goal (1 subgoal):
 1. mpoly_of_poly i 1 = 1


proof (prove)
using this:
  exec_meth_d (compP2 P) ([Push v, Store V] @ compE2 e)
   (shift (length [Push v, Store V]) (compxE2 e 0 0)) t h
   (stk, loc, length [Push v, Store V] + pc, xcp) ta h'
   (stk', loc', pc', xcp')

goal (1 subgoal):
 1. length [Push v, Store V] \<le> pc'


proof (prove)
goal (1 subgoal):
 1. sgn z = cis c


proof (prove)
goal (1 subgoal):
 1. monotone option.le_fun option_ord B \<Longrightarrow>
    monotone option.le_fun option_ord
     (\<lambda>f. Option.bind (B f) (Some \<circ> g))


proof (prove)
goal (1 subgoal):
 1. finite {EqOnUOut p p' u ou |u ou. (u, ou) \<in> GL \<times> UNIV}


proof (prove)
using this:
  \<exists>vs. es = map Val vs

goal (1 subgoal):
 1. (P,sh \<turnstile>\<^sub>b (C\<bullet>\<^sub>sM(es),b) \<surd>) =
    (P,sh \<turnstile>\<^sub>b (es,b) \<surd>)


proof (prove)
goal (1 subgoal):
 1. \<forall>x y. (f x \<le> y) = (x \<le> g y) \<Longrightarrow>
    (\<forall>y. \<exists>x. y = f x) = ((\<lambda>x. f (g x)) = id)


proof (state)
this:
  \<I> k \<subseteq> \<J> (Suc k) 0

goal (1 subgoal):
 1. \<I> k \<subseteq> \<J> (Suc k) u


proof (prove)
goal (6 subgoals):
 1. \<And>L N ja.
       \<lbrakk>vals_nonequiv K (Suc n) vv; Ring K; aGroup K;
        valuation K (vv j);
        \<forall>N>L. \<forall>l\<le>Suc n. an m < vv j (x l) + an N; L < N;
        j \<le> Suc n; ja = j; vv j (x j) \<noteq> - \<infinity>;
        1\<^sub>r \<in> carrier K;
        -\<^sub>a 1\<^sub>r \<in> carrier K\<rbrakk>
       \<Longrightarrow> 1\<^sub>r \<plusminus>
                         -\<^sub>a (\<Omega>\<^bsub>K vv Suc n\<^esub>)
                                    j^\<^bsup>K N\<^esup> \<noteq>
                         \<zero>
 2. \<And>L N ja.
       \<lbrakk>vals_nonequiv K (Suc n) vv; Ring K; aGroup K;
        valuation K (vv j);
        \<forall>N>L. \<forall>l\<le>Suc n. an m < vv j (x l) + an N; L < N;
        j \<le> Suc n; ja = j; vv j (x j) \<noteq> - \<infinity>;
        1\<^sub>r \<in> carrier K;
        -\<^sub>a 1\<^sub>r \<in> carrier K\<rbrakk>
       \<Longrightarrow> an m
                         \<le> vv j (x j) +
                               int N *\<^sub>a
                               vv j
                                (1\<^sub>r \<plusminus>
                                 -\<^sub>a (\<Omega>\<^bsub>K vv Suc
                            n\<^esub>)
      j^\<^bsup>K N\<^esup>)
 3. \<And>L N ja.
       \<lbrakk>vals_nonequiv K (Suc n) vv;
        \<forall>l\<le>Suc n. x l \<in> carrier K; j \<le> Suc n; Ring K;
        aGroup K; valuation K (vv j);
        \<forall>N ja.
           ja \<le> Suc n \<longrightarrow>
           1\<^sub>r \<plusminus>
           -\<^sub>a (1\<^sub>r \<plusminus>
                      -\<^sub>a (\<Omega>\<^bsub>K vv Suc n\<^esub>)
                                 ja^\<^bsup>K N\<^esup>)^\<^bsup>K N\<^esup>
           \<in> carrier K;
        \<forall>N.
           1\<^sub>r \<plusminus>
           -\<^sub>a (1\<^sub>r \<plusminus>
                      -\<^sub>a (\<Omega>\<^bsub>K vv Suc n\<^esub>)
                                 j^\<^bsup>K N\<^esup>)^\<^bsup>K N\<^esup> \<plusminus>
           -\<^sub>a 1\<^sub>r
           \<in> carrier K;
        \<forall>ja\<le>Suc n. vv j (x ja) \<noteq> - \<infinity>;
        \<forall>N>L. \<forall>l\<le>Suc n. an m < vv j (x l) + an N; L < N;
        ja \<le> Suc n; ja \<noteq> j\<rbrakk>
       \<Longrightarrow> (ja \<noteq> j \<longrightarrow>
                          an m
                          \<le> vv j (x ja) +
                                vv j
                                 (1\<^sub>r \<plusminus>
                                  -\<^sub>a (1\<^sub>r \<plusminus>
       -\<^sub>a (\<Omega>\<^bsub>K vv Suc n\<^esub>)
                  ja^\<^bsup>K N\<^esup>)^\<^bsup>K N\<^esup>)) \<and>
                         (ja = j \<longrightarrow>
                          an m
                          \<le> vv j (x j) +
                                vv j
                                 (1\<^sub>r \<plusminus>
                                  -\<^sub>a (1\<^sub>r \<plusminus>
       -\<^sub>a (\<Omega>\<^bsub>K vv Suc n\<^esub>)
                  j^\<^bsup>K N\<^esup>)^\<^bsup>K N\<^esup> \<plusminus>
                                  -\<^sub>a 1\<^sub>r))
 4. \<lbrakk>vals_nonequiv K (Suc n) vv;
     \<forall>l\<le>Suc n. x l \<in> carrier K; j \<le> Suc n; Ring K;
     aGroup K; valuation K (vv j);
     \<forall>N ja.
        ja \<le> Suc n \<longrightarrow>
        1\<^sub>r \<plusminus>
        -\<^sub>a (1\<^sub>r \<plusminus>
                   -\<^sub>a (\<Omega>\<^bsub>K vv Suc n\<^esub>)
                              ja^\<^bsup>K N\<^esup>)^\<^bsup>K N\<^esup>
        \<in> carrier K;
     \<forall>N.
        1\<^sub>r \<plusminus>
        -\<^sub>a (1\<^sub>r \<plusminus>
                   -\<^sub>a (\<Omega>\<^bsub>K vv Suc n\<^esub>)
                              j^\<^bsup>K N\<^esup>)^\<^bsup>K N\<^esup> \<plusminus>
        -\<^sub>a 1\<^sub>r
        \<in> carrier K;
     (\<forall>ja\<le>Suc n.
         (vv j \<circ> x) ja \<noteq> - \<infinity>) \<longrightarrow>
     (\<exists>L.
         \<forall>N>L.
            \<forall>l\<le>Suc n. an m < (vv j \<circ> x) l + an N)\<rbrakk>
    \<Longrightarrow> \<forall>ja\<le>Suc n.
                         (vv j \<circ> x) ja \<noteq> - \<infinity>
 5. \<lbrakk>vals_nonequiv K (Suc n) vv;
     \<forall>l\<le>Suc n. x l \<in> carrier K; j \<le> Suc n; Ring K;
     aGroup K; valuation K (vv j);
     \<forall>N ja.
        ja \<le> Suc n \<longrightarrow>
        1\<^sub>r \<plusminus>
        -\<^sub>a (1\<^sub>r \<plusminus>
                   -\<^sub>a (\<Omega>\<^bsub>K vv Suc n\<^esub>)
                              ja^\<^bsup>K N\<^esup>)^\<^bsup>K N\<^esup>
        \<in> carrier K\<rbrakk>
    \<Longrightarrow> \<forall>N.
                         1\<^sub>r \<plusminus>
                         -\<^sub>a (1\<^sub>r \<plusminus>
                                    -\<^sub>a (\<Omega>\<^bsub>K vv Suc
                               n\<^esub>)
         j^\<^bsup>K N\<^esup>)^\<^bsup>K N\<^esup> \<plusminus>
                         -\<^sub>a 1\<^sub>r
                         \<in> carrier K
 6. \<lbrakk>vals_nonequiv K (Suc n) vv;
     \<forall>l\<le>Suc n. x l \<in> carrier K; j \<le> Suc n; Ring K;
     aGroup K; valuation K (vv j)\<rbrakk>
    \<Longrightarrow> \<forall>N ja.
                         ja \<le> Suc n \<longrightarrow>
                         1\<^sub>r \<plusminus>
                         -\<^sub>a (1\<^sub>r \<plusminus>
                                    -\<^sub>a (\<Omega>\<^bsub>K vv Suc
                               n\<^esub>)
         ja^\<^bsup>K N\<^esup>)^\<^bsup>K N\<^esup>
                         \<in> carrier K


proof (prove)
goal (1 subgoal):
 1. fun_eq_on f g (\<Union> W)


proof (chain)
picking this:
  P (f i) (g i)
  P (g j) (f j)
  \<forall>k<i. f k = g k
  \<forall>k<j. g k = f k


proof (prove)
using this:
  lift_valid_edge valid_edge sourcenode targetnode kind Entry Exit a
  intra_kind (knd a)

goal (1 subgoal):
 1. lift_get_proc get_proc Main (src a) =
    lift_get_proc get_proc Main (trg a)


proof (prove)
using this:
  g \<in> S
  S \<subseteq> H <#> S

goal (1 subgoal):
 1. g \<in> H <#> S


proof (prove)
using this:
  Norm s0\<Colon>\<preceq>(G, L)
  \<lparr>prg = G, cls = accC,
     lcl = L\<rparr>\<turnstile>In1r (l\<bullet> c)\<Colon>T
  \<lparr>prg = G, cls = accC,
     lcl =
       L\<rparr>\<turnstile> dom (locals
                                   (snd (Norm
    s0))) \<guillemotright>In1r (l\<bullet> c)\<guillemotright> A

goal (1 subgoal):
 1. (\<And>C.
        \<lparr>prg = G, cls = accC,
           lcl =
             L\<rparr>\<turnstile> dom (locals
   (snd (Norm
          s0))) \<guillemotright>In1r c\<guillemotright> C \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. (f \<circ> iscale) ` {- 1..1} \<subseteq> cbox (- 1) 1 &&&
    (g \<circ> iscale) ` {- 1..1} \<subseteq> cbox (- 1) 1


proof (prove)
goal (1 subgoal):
 1. C.seq
     \<langle>\<mu>_\<nu>\<pi>_\<rho>.Prj\<^sub>0\<^sub>1 \<lbrakk>\<nu>\<pi>.leg0, \<rho>.leg1\<rbrakk> \<mu>_\<nu>\<pi>_\<rho>.Prj\<^sub>0\<rangle>
     (chine_hcomp
       \<lparr>Chn = \<mu>\<nu>\<pi>.chine_assoc,
          Dom = Dom ((\<mu> \<star> \<nu>) \<star> \<pi>),
          Cod = Cod (\<mu> \<star> \<nu> \<star> \<pi>)\<rparr>
       \<rho>)


proof (prove)
goal (1 subgoal):
 1. \<And>F Fs.
       \<lbrakk>r \<in> upRules; R1 \<subseteq> upRules;
        R2 \<subseteq> modRules2; R3 \<subseteq> modRules2;
        r \<in> p_e R2 M1 M2; Ax \<inter> upRules = {};
        \<And>M N. Ax \<inter> p_e modRules2 M N = {};
        Ax \<inter> modRules2 = {}; upRules \<inter> modRules2 = {};
        \<And>M N. upRules \<inter> p_e modRules2 M N = {};
        snd r = ( \<Empt> \<Rightarrow>* \<LM> Compound F Fs  \<RM>) \<or>
        snd r = ( \<LM> Compound F Fs  \<RM> \<Rightarrow>* \<Empt>);
        \<lbrakk>(fst r, snd r) \<in> p_e R2 M1 M2;
         R2 \<subseteq> modRules2\<rbrakk>
        \<Longrightarrow> \<exists>F Fs \<Gamma> \<Delta> ps ra.
                             (fst r, snd r) =
                             extendRule
                              ( M1 \<cdot>
                                \<Gamma> \<Rightarrow>* M2 \<cdot> \<Delta>)
                              ra \<and>
                             ra \<in> R2 \<and>
                             (ra =
                              (ps,
                                \<Empt> \<Rightarrow>* \<LM> Modal F
                        Fs  \<RM>) \<or>
                              ra =
                              (ps,
                                \<LM> Modal F
 Fs  \<RM> \<Rightarrow>* \<Empt>))\<rbrakk>
       \<Longrightarrow> r \<in> R1


proof (prove)
using this:
  {k \<in> \<D>. content k \<noteq> 0} \<noteq> \<D>

goal (1 subgoal):
 1. (\<And>K c d.
        \<lbrakk>K \<in> \<D>; content K = 0; K = cbox c d\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. igAbsRenSTR MOD \<Longrightarrow> igAbsCongUSTR MOD


proof (state)
goal (1 subgoal):
 1. \<turnstile> \<box>F \<longrightarrow>
                 \<box>[F \<longrightarrow> \<circle>F]_v


proof (prove)
goal (1 subgoal):
 1. manifold_eucl.tangent_space.dim \<infinity> a
     (range (directional_derivative \<infinity> a)) =
    vs1.dim UNIV


proof (prove)
goal (1 subgoal):
 1. gc_invar Ns (enat (Suc i))


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       \<lbrakk>finite UNIV; root \<noteq> nil;
        (root, x) \<in> next\<^sup>* \<and> x \<noteq> nil;
        x \<notin> path {root} {root}\<rbrakk>
       \<Longrightarrow> x = root


proof (prove)
goal (1 subgoal):
 1. cBall C (\<lambda>x. f x = g x) \<Longrightarrow>
    rel_cset (eq_onp (\<lambda>x. cin x C)) C C


proof (state)
goal (1 subgoal):
 1. G \<restriction> S \<in> sccs


proof (prove)
goal (1 subgoal):
 1. partial_equivalence A r = partial_equivalence A r'


proof (prove)
using this:
  \<lbrakk>?x2 \<in> A; ?y2 \<in> A\<rbrakk>
  \<Longrightarrow> (card {i \<in> Is. F i = ?y2}
                     \<le> card {i \<in> Is. F i = ?x2}) =
                    (card
                      {i \<in> Is.
                       ?y2 \<^bsub>(single_vote_to_RPR A
                                     (F i))\<^esub>\<prec> ?x2}
                     \<le> card
                            {i \<in> Is.
                             ?x2 \<^bsub>(single_vote_to_RPR A
     (F i))\<^esub>\<prec> ?y2})

goal (1 subgoal):
 1. plurality_rule A Is F =
    MMD_plurality_rule A Is (single_vote_to_RPR A \<circ> F)


proof (state)
goal (1 subgoal):
 1. \<not> sinvar G (nP(i := \<bottom>))


proof (prove)
goal (1 subgoal):
 1. A B OS X D


proof (prove)
goal (1 subgoal):
 1. sort_poly_spec p \<bind> (\<lambda>p. RETURN (merge_coeffs p))
    \<le> \<Down> sorted_poly_rel
           (RETURN p' \<bind>
            (\<lambda>p'. SPEC (normalize_poly_p\<^sup>*\<^sup>* p')))


proof (prove)
goal (1 subgoal):
 1. S.seq (Hom_DopxG.map gf) (\<Phi>o (DopxC.dom gf))


proof (prove)
using this:
  AE y in stock_measure t'. 0 \<le> eval_cexpr f (case_nat x \<rho>) y

goal (1 subgoal):
 1. integrable (stock_measure t') (eval_cexpr f (case_nat x \<rho>))


proof (state)
this:
  T = []
  P f = []

goal (2 subgoals):
 1. \<And>x1.
       t = Var x1 \<Longrightarrow>
       \<exists>u.
          term_variants_pred P t u \<and> Fun f S = u \<cdot> \<delta>
 2. \<And>x21 x22.
       t = Fun x21 x22 \<Longrightarrow>
       \<exists>u.
          term_variants_pred P t u \<and> Fun f S = u \<cdot> \<delta>


proof (prove)
goal (1 subgoal):
 1. B.seq (Map \<mu> \<star>\<^sub>B Map \<nu>)
     (B.can (Dom \<mu> \<^bold>\<star> Dom \<nu>)
       (Dom \<mu> \<^bold>\<lfloor>\<^bold>\<star>\<^bold>\<rfloor>
        Dom \<nu>))


proof (prove)
using this:
  atom i \<sharp> db

goal (1 subgoal):
 1. {} \<turnstile>
    SubstFormP \<guillemotleft>Var i\<guillemotright> Zero (quot_dbfm db)
     (quot_dbfm db)


proof (prove)
using this:
  a \<le> b

goal (1 subgoal):
 1. {..- inverse (real (Suc i))} \<inter> {a..b} =
    {a..min (- inverse (real (Suc i))) b}


proof (prove)
goal (1 subgoal):
 1. P (invoke (a_get_owner_document_tups @ xs) ptr ()) =
    ((known_ptr ptr \<longrightarrow> P (get_owner_document ptr)) \<and>
     (\<not> known_ptr ptr \<longrightarrow> P (invoke xs ptr ())))


proof (prove)
using this:
  range A \<subseteq> M

goal (1 subgoal):
 1. (\<Sum>i<N. f (A i)) = f (\<Union> (A ` {..<N}))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>v \<noteq> Null; P,h \<turnstile> v :\<le> Class C\<rbrakk>
    \<Longrightarrow> \<exists>a hT.
                         v = Addr a \<and>
                         typeof_addr h a = \<lfloor>hT\<rfloor> \<and>
                         P \<turnstile> class_type_of hT \<preceq>\<^sup>* C


proof (prove)
goal (1 subgoal):
 1. (\<lambda>n.
        EM_remainder' 1
         (\<lambda>x.
             (- 1) ^ 1 * pochhammer s 1 *
             complex_of_real (x + a) powr (- s - of_nat 1))
         0 (real n))
    \<longlonglongrightarrow> EM_remainder 1
                               (\<lambda>x.
                                   (- 1) ^ 1 * pochhammer s 1 *
                                   complex_of_real (x + a) powr
                                   (- s - of_nat 1))
                               0


proof (chain)
picking this:
  g fine {(x, cbox c d)}


proof (prove)
using this:
  Result.those (map (compile_env_entry \<A> \<O>) []) = Ok ys

goal (1 subgoal):
 1. rel_option (\<lambda>fd1 fd2. compile_fundef \<A> (\<O> f) fd1 = Ok fd2)
     (map_of [] f) (map_of ys f)


proof (prove)
goal (1 subgoal):
 1. Cop.H f \<epsilon> \<cdot>
    \<a>\<^sup>-\<^sup>1[f, g, f] \<cdot> Cop.H \<eta> f =
    \<l>\<^sup>-\<^sup>1[f] \<cdot> \<r>[f] \<Longrightarrow>
    Cop.H \<epsilon> g \<cdot> \<a>[g, f, g] \<cdot> Cop.H g \<eta> =
    \<r>\<^sup>-\<^sup>1[g] \<cdot> \<l>[g]


proof (prove)
goal (1 subgoal):
 1. cinner x y =
    (complex_of_real ((norm (x + y))\<^sup>2 - (norm (x - y))\<^sup>2) -
     \<i> * complex_of_real ((norm (x + \<i> *\<^sub>C y))\<^sup>2) +
     \<i> * complex_of_real ((norm (x - \<i> *\<^sub>C y))\<^sup>2)) /
    4


proof (prove)
using this:
  Cs = map (\<lambda>w. w `\<rightarrow> C0) (sums ss)
  gallery Cs
  {} \<notin> set (wall_crossings Cs)

goal (1 subgoal):
 1. (\<And>f g A B E F As Fs Bs.
        \<lbrakk>(f, g) \<in> foldpairs; A \<in> f \<turnstile> \<C>;
         B \<in> g \<turnstile> \<C>; E \<in> g \<turnstile> \<C>;
         F \<in> f \<turnstile> \<C>;
         Cs = As @ [A, B, F] @ Fs \<or>
         Cs = As @ [A, B] @ Bs @ [E, F] @ Fs\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. prob_dom PROB1 \<subseteq> prob_dom PROB2


proof (prove)
using this:
  set (insertions A) = set (insertions (remove1 a A)) \<union> {(oid, ref)}
  set (insertions (ops @ [a])) = set (insertions ops) \<union> {(oid, ref)}
  set (insertions (remove1 a A)) \<subseteq> set (insertions ops)

goal (1 subgoal):
 1. set (insertions A) \<subseteq> set (insertions (ops @ [a]))


proof (prove)
goal (1 subgoal):
 1. - \<mu>
       (\<P>
         (\<lambda>x.
             {(x, y).
              (\<lambda>x xa.
                  s2p {(x, y). s2p (R `` \<eta> x) y}
                   (x, xa))\<inverse>\<inverse>
               x y} ``
             \<eta> x)
         (- UNIV)) =
    UNIV


proof (prove)
using this:
  other.p x2 = ego.p x2
  0 < x2
  x2 < other.t_stop
  \<not> x2 < ego.t_stop

goal (1 subgoal):
 1. other.p x2 \<le> ego.p ego.t_stop


proof (prove)
using this:
  y\<^sup>+ \<squnion> y\<^sup>+\<^sup>T = x\<^sup>+ \<sqinter> - (1::'a)

goal (1 subgoal):
 1. transitively_orientable (x\<^sup>+ \<sqinter> - (1::'a))


proof (prove)
goal (1 subgoal):
 1. right_gpv (Generative_Probabilistic_Value.Done x) =
    Generative_Probabilistic_Value.Done x


proof (prove)
goal (1 subgoal):
 1. ccBinds \<Gamma>\<cdot>(\<bottom>, \<bottom>) = \<bottom>


proof (prove)
goal (1 subgoal):
 1. \<exists>po'. simple_linux_router_nol12 rt fw pi = Some po'


proof (prove)
goal (1 subgoal):
 1. pair_prob_space (K1.T x) (K2.T y)


proof (prove)
goal (1 subgoal):
 1. \<exists>xs ys.
       list = xs @ ys \<and> insert_spec list (oid, ref) = xs @ oid # ys


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>s -t\<triangleright>ta\<rightarrow> s';
     wset_thread_ok (wset s) (thr s)\<rbrakk>
    \<Longrightarrow> wset_thread_ok (wset s') (thr s')


proof (prove)
using this:
  rk {A, B, C, A', B', C', P, Q} \<le> rk {P, Q, R, A', A, B, C, B', C'}

goal (1 subgoal):
 1. rk {R, a} = 2


proof (prove)
using this:
  \<lbrakk>?i < card {i. i < dim_row ?A \<and> i \<in> ?I};
   ?j < card {j. j < dim_col ?A \<and> j \<in> ?J}\<rbrakk>
  \<Longrightarrow> submatrix ?A ?I ?J $$ (?i, ?j) =
                    ?A $$ (pick ?I ?i, pick ?J ?j)

goal (1 subgoal):
 1. \<And>x. submatrix (A x) I J $$ (i, j) = A x $$ (pick I i, pick J j)


proof (prove)
goal (1 subgoal):
 1. C = C'


proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. V_of (inv_into X f (f x))) ` X =
    elts (set (V_of ` inv_into X f ` f ` X))


proof (prove)
goal (1 subgoal):
 1. AE x in measure_pmf (p N M). AE y in m' N M x. y !! 0 \<in> \<Omega>


proof (prove)
goal (1 subgoal):
 1. inj_on (inverse x \<cdot> y)\<^sub>R (H |\<cdot> x)


proof (prove)
using this:
  aff_dim T \<le> aff_dim (cball a r)

goal (1 subgoal):
 1. thesis


proof (prove)
using this:
  (X, Y) \<in> swapped
  good X

goal (1 subgoal):
 1. skel Y = skel X


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Big_Step_Unclocked_Single.evaluate env s e (s', res);
     is_cupcake_all_env env; is_cupcake_exp e\<rbrakk>
    \<Longrightarrow> cupcake_evaluate_single env e res


proof (prove)
goal (1 subgoal):
 1. 220 Amic 284


proof (prove)
goal (1 subgoal):
 1. Astack (map Dummy l) = 0


proof (state)
goal (1 subgoal):
 1. \<l>\<^sub>C[a] \<in> C.hom (\<I>\<^sub>C \<otimes>\<^sub>C a) a \<and>
    \<I>\<^sub>C \<otimes>\<^sub>C \<l>\<^sub>C[a] =
    (\<iota>\<^sub>C \<otimes>\<^sub>C a) \<cdot>\<^sub>C
    C.assoc' \<I>\<^sub>C \<I>\<^sub>C a \<Longrightarrow>
    F \<l>\<^sub>C[a]
    \<in> D.hom (\<I>\<^sub>D \<otimes>\<^sub>D F a) (F a) \<and>
    \<I>\<^sub>D \<otimes>\<^sub>D F \<l>\<^sub>C[a] =
    (\<iota>\<^sub>D \<otimes>\<^sub>D F a) \<cdot>\<^sub>D
    D.assoc' \<I>\<^sub>D \<I>\<^sub>D (F a)


proof (prove)
goal (1 subgoal):
 1. (\<Union>p\<in>S.
        (\<lambda>(r, v). ((r, p), v)) ` map_graph (\<lambda>r. v_hist r p))
    \<subseteq> (\<Union>p\<in>S.
                    (\<lambda>r. ((r, p), the (v_hist r p))) ` {0..<r})


proof (prove)
using this:
  finite N
  finite G
  finite (Pow ?A) = finite ?A

goal (1 subgoal):
 1. finite (Pow (N \<times> (Pow G - {{}})))


proof (prove)
goal (1 subgoal):
 1. at (a' \<cdot>\<^sub>A a) D j = Da'oDa.map j


proof (prove)
goal (1 subgoal):
 1. vpath (vwalk_to_vpath p) G


proof (state)
this:
  trg (tab\<^sub>0 r) = r

goal (1 subgoal):
 1. tab\<^sub>0 r \<cong> r \<star> tab\<^sub>0 r


proof (prove)
using this:
  subseq (l1 @ l2 @ l3) []
  subseq ?l1.0 [] = (?l1.0 = [])

goal (1 subgoal):
 1. subseq (l1 @ l3) []


proof (prove)
using this:
  set (snd (snd (reduce_system p
                  (qs, M_mat [[1], [- 1]] [[], [0]], [[], [0]],
                   [[1], [- 1]])))) =
  set (characterize_consistent_signs_at_roots_copr p qs)

goal (1 subgoal):
 1. set (snd (snd (reduce_system p
                    (qs, mat_of_rows_list 2 [[1, 1], [1, - 1]], [[], [0]],
                     [[1], [- 1]])))) =
    set (characterize_consistent_signs_at_roots_copr p qs)


proof (prove)
using this:
  ov = None

goal (1 subgoal):
 1. one_final (subdivFace' g f v n (ov # ovs))


proof (prove)
goal (1 subgoal):
 1. x + y = bot \<longrightarrow> x = bot


proof (prove)
goal (1 subgoal):
 1. (((S ===> M) ===> A) ===> rel_stateT S M ===> A) case_stateT case_stateT


proof (prove)
using this:
  edge_succ M a = a

goal (1 subgoal):
 1. card (out_arcs G (tail G a)) = 1


proof (prove)
goal (1 subgoal):
 1. S $h 0 $h 1 = (0::'a)


proof (prove)
using this:
  generator g s = Skip ?x2.0 \<Longrightarrow>
  unstream (filter_trans P g) ?x2.0 = filter P (unstream g ?x2.0)
  generator g s = Yield ?x31.0 ?x32.0 \<Longrightarrow>
  unstream (filter_trans P g) ?x32.0 = filter P (unstream g ?x32.0)

goal (1 subgoal):
 1. unstream (filter_trans P g) s = filter P (unstream g s)


proof (prove)
goal (1 subgoal):
 1. x1a \<in> SIGT ($f x1a x2a)


proof (prove)
goal (12 subgoals):
 1. \<lbrakk>servK \<in> symKeys; A \<notin> bad; B \<notin> bad\<rbrakk>
    \<Longrightarrow> Key authK
                      \<notin> analz (knows Spy []) \<longrightarrow>
                      Says Tgs A
                       (Crypt authK
                         \<lbrace>Key servK, Agent B, Number Ts,
                           Crypt (shrK B)
                            \<lbrace>Agent A, Agent B, Key servK,
                              Number Ts\<rbrace>\<rbrace>)
                      \<in> set [] \<longrightarrow>
                      Key servK \<in> analz (knows Spy []) \<longrightarrow>
                      expiredSK Ts []
 2. \<And>evsf X Ba.
       \<lbrakk>servK \<in> symKeys; A \<notin> bad; B \<notin> bad;
        evsf \<in> kerbIV; X \<in> synth (analz (knows Spy evsf));
        Key authK \<notin> analz (knows Spy evsf);
        Says Tgs A
         (Crypt authK
           \<lbrace>Key servK, Agent B, Number Ts,
             Crypt (shrK B)
              \<lbrace>Agent A, Agent B, Key servK,
                Number Ts\<rbrace>\<rbrace>)
        \<in> set evsf \<longrightarrow>
        Key servK \<in> analz (knows Spy evsf) \<longrightarrow>
        expiredSK Ts evsf\<rbrakk>
       \<Longrightarrow> Says Tgs A
                          (Crypt authK
                            \<lbrace>Key servK, Agent B, Number Ts,
                              Crypt (shrK B)
                               \<lbrace>Agent A, Agent B, Key servK,
                                 Number Ts\<rbrace>\<rbrace>)
                         \<in> set (Says Spy Ba X # evsf) \<longrightarrow>
                         Key servK
                         \<in> analz
                                (knows Spy
                                  (Says Spy Ba X # evsf)) \<longrightarrow>
                         expiredSK Ts (Says Spy Ba X # evsf)
 3. \<And>evs1 Aa.
       \<lbrakk>servK \<in> symKeys; A \<notin> bad; B \<notin> bad;
        evs1 \<in> kerbIV; Key authK \<notin> analz (knows Spy evs1);
        Says Tgs A
         (Crypt authK
           \<lbrace>Key servK, Agent B, Number Ts,
             Crypt (shrK B)
              \<lbrace>Agent A, Agent B, Key servK,
                Number Ts\<rbrace>\<rbrace>)
        \<in> set evs1 \<longrightarrow>
        Key servK \<in> analz (knows Spy evs1) \<longrightarrow>
        expiredSK Ts evs1\<rbrakk>
       \<Longrightarrow> Says Tgs A
                          (Crypt authK
                            \<lbrace>Key servK, Agent B, Number Ts,
                              Crypt (shrK B)
                               \<lbrace>Agent A, Agent B, Key servK,
                                 Number Ts\<rbrace>\<rbrace>)
                         \<in> set (Says Aa Kas
                                     \<lbrace>Agent Aa, Agent Tgs,
 Number (CT evs1)\<rbrace> #
                                    evs1) \<longrightarrow>
                         Key servK
                         \<in> analz
                                (knows Spy
                                  (Says Aa Kas
                                    \<lbrace>Agent Aa, Agent Tgs,
Number (CT evs1)\<rbrace> #
                                   evs1)) \<longrightarrow>
                         expiredSK Ts
                          (Says Aa Kas
                            \<lbrace>Agent Aa, Agent Tgs,
                              Number (CT evs1)\<rbrace> #
                           evs1)
 4. \<And>evs2 authKa A' Aa T1.
       \<lbrakk>servK \<in> symKeys; A \<notin> bad; B \<notin> bad;
        evs2 \<in> kerbIV; Key authKa \<notin> used evs2;
        authKa \<in> symKeys;
        Says A' Kas \<lbrace>Agent Aa, Agent Tgs, Number T1\<rbrace>
        \<in> set evs2;
        Key authK \<notin> analz (knows Spy evs2);
        Says Tgs A
         (Crypt authK
           \<lbrace>Key servK, Agent B, Number Ts,
             Crypt (shrK B)
              \<lbrace>Agent A, Agent B, Key servK,
                Number Ts\<rbrace>\<rbrace>)
        \<in> set evs2 \<longrightarrow>
        Key servK \<in> analz (knows Spy evs2) \<longrightarrow>
        expiredSK Ts evs2\<rbrakk>
       \<Longrightarrow> Says Tgs A
                          (Crypt authK
                            \<lbrace>Key servK, Agent B, Number Ts,
                              Crypt (shrK B)
                               \<lbrace>Agent A, Agent B, Key servK,
                                 Number Ts\<rbrace>\<rbrace>)
                         \<in> set (Says Kas Aa
                                     (Crypt (shrK Aa)
 \<lbrace>Key authKa, Agent Tgs, Number (CT evs2),
   Crypt (shrK Tgs)
    \<lbrace>Agent Aa, Agent Tgs, Key authKa,
      Number (CT evs2)\<rbrace>\<rbrace>) #
                                    evs2) \<longrightarrow>
                         Key servK
                         \<in> analz
                                (knows Spy
                                  (Says Kas Aa
                                    (Crypt (shrK Aa)
\<lbrace>Key authKa, Agent Tgs, Number (CT evs2),
  Crypt (shrK Tgs)
   \<lbrace>Agent Aa, Agent Tgs, Key authKa,
     Number (CT evs2)\<rbrace>\<rbrace>) #
                                   evs2)) \<longrightarrow>
                         expiredSK Ts
                          (Says Kas Aa
                            (Crypt (shrK Aa)
                              \<lbrace>Key authKa, Agent Tgs,
                                Number (CT evs2),
                                Crypt (shrK Tgs)
                                 \<lbrace>Agent Aa, Agent Tgs, Key authKa,
                                   Number (CT evs2)\<rbrace>\<rbrace>) #
                           evs2)
 5. \<And>evs3 Aa T1 Kas' authKa Ta authTicket Ba.
       \<lbrakk>servK \<in> symKeys; A \<notin> bad; B \<notin> bad;
        evs3 \<in> kerbIV;
        Says Aa Kas \<lbrace>Agent Aa, Agent Tgs, Number T1\<rbrace>
        \<in> set evs3;
        Says Kas' Aa
         (Crypt (shrK Aa)
           \<lbrace>Key authKa, Agent Tgs, Number Ta,
             Crypt (shrK Tgs)
              \<lbrace>Agent Aa, Agent Tgs, Key authKa,
                Number Ta\<rbrace>\<rbrace>)
        \<in> set evs3;
        valid Ta wrt T1; Key authK \<notin> analz (knows Spy evs3);
        Says Tgs A
         (Crypt authK
           \<lbrace>Key servK, Agent B, Number Ts,
             Crypt (shrK B)
              \<lbrace>Agent A, Agent B, Key servK,
                Number Ts\<rbrace>\<rbrace>)
        \<in> set evs3 \<longrightarrow>
        Key servK \<in> analz (knows Spy evs3) \<longrightarrow>
        expiredSK Ts evs3;
        authKa \<notin> range shrK; authKa \<in> symKeys\<rbrakk>
       \<Longrightarrow> Says Tgs A
                          (Crypt authK
                            \<lbrace>Key servK, Agent B, Number Ts,
                              Crypt (shrK B)
                               \<lbrace>Agent A, Agent B, Key servK,
                                 Number Ts\<rbrace>\<rbrace>)
                         \<in> set (Says Aa Tgs
                                     \<lbrace>Crypt (shrK Tgs)
         \<lbrace>Agent Aa, Agent Tgs, Key authKa, Number Ta\<rbrace>,
 Crypt authKa \<lbrace>Agent Aa, Number (CT evs3)\<rbrace>,
 Agent Ba\<rbrace> #
                                    evs3) \<longrightarrow>
                         Key servK
                         \<in> analz
                                (knows Spy
                                  (Says Aa Tgs
                                    \<lbrace>Crypt (shrK Tgs)
        \<lbrace>Agent Aa, Agent Tgs, Key authKa, Number Ta\<rbrace>,
Crypt authKa \<lbrace>Agent Aa, Number (CT evs3)\<rbrace>,
Agent Ba\<rbrace> #
                                   evs3)) \<longrightarrow>
                         expiredSK Ts
                          (Says Aa Tgs
                            \<lbrace>Crypt (shrK Tgs)
\<lbrace>Agent Aa, Agent Tgs, Key authKa, Number Ta\<rbrace>,
                              Crypt authKa
                               \<lbrace>Agent Aa, Number (CT evs3)\<rbrace>,
                              Agent Ba\<rbrace> #
                           evs3)
 6. \<And>evs3 Aa T1 Kas' authKa Ta authTicket Ba.
       \<lbrakk>servK \<in> symKeys; A \<notin> bad; B \<notin> bad;
        evs3 \<in> kerbIV;
        Says Aa Kas \<lbrace>Agent Aa, Agent Tgs, Number T1\<rbrace>
        \<in> set evs3;
        Says Kas' Aa
         (Crypt (shrK Aa)
           \<lbrace>Key authKa, Agent Tgs, Number Ta, authTicket\<rbrace>)
        \<in> set evs3;
        valid Ta wrt T1; Key authK \<notin> analz (knows Spy evs3);
        Says Tgs A
         (Crypt authK
           \<lbrace>Key servK, Agent B, Number Ts,
             Crypt (shrK B)
              \<lbrace>Agent A, Agent B, Key servK,
                Number Ts\<rbrace>\<rbrace>)
        \<in> set evs3 \<longrightarrow>
        Key servK \<in> analz (knows Spy evs3) \<longrightarrow>
        expiredSK Ts evs3;
        authTicket \<in> analz (knows Spy evs3)\<rbrakk>
       \<Longrightarrow> Says Tgs A
                          (Crypt authK
                            \<lbrace>Key servK, Agent B, Number Ts,
                              Crypt (shrK B)
                               \<lbrace>Agent A, Agent B, Key servK,
                                 Number Ts\<rbrace>\<rbrace>)
                         \<in> set (Says Aa Tgs
                                     \<lbrace>authTicket,
 Crypt authKa \<lbrace>Agent Aa, Number (CT evs3)\<rbrace>,
 Agent Ba\<rbrace> #
                                    evs3) \<longrightarrow>
                         Key servK
                         \<in> analz
                                (knows Spy
                                  (Says Aa Tgs
                                    \<lbrace>authTicket,
Crypt authKa \<lbrace>Agent Aa, Number (CT evs3)\<rbrace>,
Agent Ba\<rbrace> #
                                   evs3)) \<longrightarrow>
                         expiredSK Ts
                          (Says Aa Tgs
                            \<lbrace>authTicket,
                              Crypt authKa
                               \<lbrace>Agent Aa, Number (CT evs3)\<rbrace>,
                              Agent Ba\<rbrace> #
                           evs3)
 7. \<And>evs4 servKa Ba authKa A' Aa Ta T2.
       \<lbrakk>servK \<in> symKeys; A \<notin> bad; B \<notin> bad;
        evs4 \<in> kerbIV; Key servKa \<notin> used evs4;
        servKa \<in> symKeys; Ba \<noteq> Tgs; authKa \<in> symKeys;
        Says A' Tgs
         \<lbrace>Crypt (shrK Tgs)
                   \<lbrace>Agent Aa, Agent Tgs, Key authKa,
                     Number Ta\<rbrace>,
           Crypt authKa \<lbrace>Agent Aa, Number T2\<rbrace>,
           Agent Ba\<rbrace>
        \<in> set evs4;
        \<not> expiredAK Ta evs4; \<not> expiredA T2 evs4;
        servKlife + CT evs4 \<le> authKlife + Ta;
        Key authK \<notin> analz (knows Spy evs4);
        Says Tgs A
         (Crypt authK
           \<lbrace>Key servK, Agent B, Number Ts,
             Crypt (shrK B)
              \<lbrace>Agent A, Agent B, Key servK,
                Number Ts\<rbrace>\<rbrace>)
        \<in> set evs4 \<longrightarrow>
        Key servK \<in> analz (knows Spy evs4) \<longrightarrow>
        expiredSK Ts evs4\<rbrakk>
       \<Longrightarrow> Says Tgs A
                          (Crypt authK
                            \<lbrace>Key servK, Agent B, Number Ts,
                              Crypt (shrK B)
                               \<lbrace>Agent A, Agent B, Key servK,
                                 Number Ts\<rbrace>\<rbrace>)
                         \<in> set (Says Tgs Aa
                                     (Crypt authKa
 \<lbrace>Key servKa, Agent Ba, Number (CT evs4),
   Crypt (shrK Ba)
    \<lbrace>Agent Aa, Agent Ba, Key servKa,
      Number (CT evs4)\<rbrace>\<rbrace>) #
                                    evs4) \<longrightarrow>
                         Key servK
                         \<in> analz
                                (knows Spy
                                  (Says Tgs Aa
                                    (Crypt authKa
\<lbrace>Key servKa, Agent Ba, Number (CT evs4),
  Crypt (shrK Ba)
   \<lbrace>Agent Aa, Agent Ba, Key servKa,
     Number (CT evs4)\<rbrace>\<rbrace>) #
                                   evs4)) \<longrightarrow>
                         expiredSK Ts
                          (Says Tgs Aa
                            (Crypt authKa
                              \<lbrace>Key servKa, Agent Ba,
                                Number (CT evs4),
                                Crypt (shrK Ba)
                                 \<lbrace>Agent Aa, Agent Ba, Key servKa,
                                   Number (CT evs4)\<rbrace>\<rbrace>) #
                           evs4)
 8. \<And>evs5 authKa servKa Aa authTicket T2 Ba Tgs' Tsa servTicket Aaa.
       \<lbrakk>servK \<in> symKeys; A \<notin> bad; B \<notin> bad;
        evs5 \<in> kerbIV; authKa \<in> symKeys; servKa \<in> symKeys;
        Says Aa Tgs
         \<lbrace>authTicket,
           Crypt authKa \<lbrace>Agent Aa, Number T2\<rbrace>,
           Agent Ba\<rbrace>
        \<in> set evs5;
        Says Tgs' Aa
         (Crypt authKa
           \<lbrace>Key servKa, Agent Ba, Number Tsa,
             Crypt (shrK Ba)
              \<lbrace>Agent Aaa, Agent Ba, Key servKa,
                Number Tsa\<rbrace>\<rbrace>)
        \<in> set evs5;
        valid Tsa wrt T2; Key authK \<notin> analz (knows Spy evs5);
        Says Tgs A
         (Crypt authK
           \<lbrace>Key servK, Agent B, Number Ts,
             Crypt (shrK B)
              \<lbrace>Agent A, Agent B, Key servK,
                Number Ts\<rbrace>\<rbrace>)
        \<in> set evs5 \<longrightarrow>
        Key servK \<in> analz (knows Spy evs5) \<longrightarrow>
        expiredSK Ts evs5;
        servKa \<notin> range shrK\<rbrakk>
       \<Longrightarrow> Says Tgs A
                          (Crypt authK
                            \<lbrace>Key servK, Agent B, Number Ts,
                              Crypt (shrK B)
                               \<lbrace>Agent A, Agent B, Key servK,
                                 Number Ts\<rbrace>\<rbrace>)
                         \<in> set (Says Aa Ba
                                     \<lbrace>Crypt (shrK Ba)
         \<lbrace>Agent Aaa, Agent Ba, Key servKa, Number Tsa\<rbrace>,
 Crypt servKa \<lbrace>Agent Aa, Number (CT evs5)\<rbrace>\<rbrace> #
                                    evs5) \<longrightarrow>
                         Key servK
                         \<in> analz
                                (knows Spy
                                  (Says Aa Ba
                                    \<lbrace>Crypt (shrK Ba)
        \<lbrace>Agent Aaa, Agent Ba, Key servKa, Number Tsa\<rbrace>,
Crypt servKa \<lbrace>Agent Aa, Number (CT evs5)\<rbrace>\<rbrace> #
                                   evs5)) \<longrightarrow>
                         expiredSK Ts
                          (Says Aa Ba
                            \<lbrace>Crypt (shrK Ba)
\<lbrace>Agent Aaa, Agent Ba, Key servKa, Number Tsa\<rbrace>,
                              Crypt servKa
                               \<lbrace>Agent Aa,
                                 Number (CT evs5)\<rbrace>\<rbrace> #
                           evs5)
 9. \<And>evs5 authKa servKa Aa authTicket T2 Ba Tgs' Tsa servTicket.
       \<lbrakk>servK \<in> symKeys; A \<notin> bad; B \<notin> bad;
        evs5 \<in> kerbIV; authKa \<in> symKeys; servKa \<in> symKeys;
        Says Aa Tgs
         \<lbrace>authTicket,
           Crypt authKa \<lbrace>Agent Aa, Number T2\<rbrace>,
           Agent Ba\<rbrace>
        \<in> set evs5;
        Says Tgs' Aa
         (Crypt authKa
           \<lbrace>Key servKa, Agent Ba, Number Tsa, servTicket\<rbrace>)
        \<in> set evs5;
        valid Tsa wrt T2; Key authK \<notin> analz (knows Spy evs5);
        Says Tgs A
         (Crypt authK
           \<lbrace>Key servK, Agent B, Number Ts,
             Crypt (shrK B)
              \<lbrace>Agent A, Agent B, Key servK,
                Number Ts\<rbrace>\<rbrace>)
        \<in> set evs5 \<longrightarrow>
        Key servK \<in> analz (knows Spy evs5) \<longrightarrow>
        expiredSK Ts evs5;
        servTicket \<in> analz (knows Spy evs5)\<rbrakk>
       \<Longrightarrow> Says Tgs A
                          (Crypt authK
                            \<lbrace>Key servK, Agent B, Number Ts,
                              Crypt (shrK B)
                               \<lbrace>Agent A, Agent B, Key servK,
                                 Number Ts\<rbrace>\<rbrace>)
                         \<in> set (Says Aa Ba
                                     \<lbrace>servTicket,
 Crypt servKa \<lbrace>Agent Aa, Number (CT evs5)\<rbrace>\<rbrace> #
                                    evs5) \<longrightarrow>
                         Key servK
                         \<in> analz
                                (knows Spy
                                  (Says Aa Ba
                                    \<lbrace>servTicket,
Crypt servKa \<lbrace>Agent Aa, Number (CT evs5)\<rbrace>\<rbrace> #
                                   evs5)) \<longrightarrow>
                         expiredSK Ts
                          (Says Aa Ba
                            \<lbrace>servTicket,
                              Crypt servKa
                               \<lbrace>Agent Aa,
                                 Number (CT evs5)\<rbrace>\<rbrace> #
                           evs5)
 10. \<And>evs6 A' Ba Aa servKa Tsa T3.
        \<lbrakk>servK \<in> symKeys; A \<notin> bad; B \<notin> bad;
         evs6 \<in> kerbIV;
         Says A' Ba
          \<lbrace>Crypt (shrK Ba)
                    \<lbrace>Agent Aa, Agent Ba, Key servKa,
                      Number Tsa\<rbrace>,
            Crypt servKa \<lbrace>Agent Aa, Number T3\<rbrace>\<rbrace>
         \<in> set evs6;
         \<not> expiredSK Tsa evs6; \<not> expiredA T3 evs6;
         Key authK \<notin> analz (knows Spy evs6);
         Says Tgs A
          (Crypt authK
            \<lbrace>Key servK, Agent B, Number Ts,
              Crypt (shrK B)
               \<lbrace>Agent A, Agent B, Key servK,
                 Number Ts\<rbrace>\<rbrace>)
         \<in> set evs6 \<longrightarrow>
         Key servK \<in> analz (knows Spy evs6) \<longrightarrow>
         expiredSK Ts evs6\<rbrakk>
        \<Longrightarrow> Says Tgs A
                           (Crypt authK
                             \<lbrace>Key servK, Agent B, Number Ts,
                               Crypt (shrK B)
                                \<lbrace>Agent A, Agent B, Key servK,
                                  Number Ts\<rbrace>\<rbrace>)
                          \<in> set (Says Ba Aa (Crypt servKa (Number T3)) #
                                     evs6) \<longrightarrow>
                          Key servK
                          \<in> analz
                                 (knows Spy
                                   (Says Ba Aa (Crypt servKa (Number T3)) #
                                    evs6)) \<longrightarrow>
                          expiredSK Ts
                           (Says Ba Aa (Crypt servKa (Number T3)) # evs6)
A total of 12 subgoals...


proof (prove)
using this:
  \<forall>i xs.
     i \<le> n \<and> set xs \<subseteq> {0..0} \<longrightarrow>
     (0::'a) \<le> len m i i xs
  0 \<le> n
  \<lbrakk>\<forall>i xs.
              i \<le> n \<and>
              set xs \<subseteq> {} \<union> {0} \<longrightarrow>
              (0::'a) \<le> len m i i xs;
   canonical_subs n {} m; {} \<subseteq> {0..n}; 0 \<le> n\<rbrakk>
  \<Longrightarrow> \<forall>i xs.
                       i \<le> n \<and>
                       set xs \<subseteq> {} \<union> {0} \<longrightarrow>
                       (0::'a) \<le> len (fwi m n 0 n n) i i xs
  \<lbrakk>canonical_subs n {} ?m; {} \<subseteq> {0..n};
   (0::'a) \<le> ?m ?k ?k; ?k \<le> n\<rbrakk>
  \<Longrightarrow> canonical_subs n ({} \<union> {?k}) (fwi ?m n ?k n n)

goal (1 subgoal):
 1. canonical_subs n {0..0} (fw m n 0) \<and>
    (\<forall>i xs.
        i \<le> n \<and> set xs \<subseteq> {0..0} \<longrightarrow>
        (0::'a) \<le> len (fw m n 0) i i xs)


proof (prove)
using this:
  (?m, ?\<nu>, ?m') = \<rho> ?i \<Longrightarrow>
  \<exists>p p'. ?m k = Some p \<and> ?m' k = Some p'
  limit ?r \<subseteq> range ?r

goal (1 subgoal):
 1. \<And>m \<nu> m'.
       (m, \<nu>, m') \<in> limit \<rho> \<Longrightarrow>
       \<exists>p p'. m k = Some p \<and> m' k = Some p'


proof (prove)
goal (4 subgoals):
 1. \<And>it \<sigma> it' \<sigma>'.
       \<lbrakk>it \<subseteq> S; \<alpha> ` it \<subseteq> \<alpha> ` S;
        it' = \<alpha> ` it;
        ((it, \<sigma>), \<alpha> ` it, \<sigma>') \<in> R\<rbrakk>
       \<Longrightarrow> c \<sigma> = c' \<sigma>'
 2. \<And>x it \<sigma> x' it' \<sigma>'.
       \<lbrakk>it \<subseteq> S; it' \<subseteq> \<alpha> ` S;
        x' = \<alpha> x; it' = \<alpha> ` it;
        ((it, \<sigma>), it', \<sigma>') \<in> R; x \<in> it; x' \<in> it';
        c \<sigma>; c' \<sigma>'\<rbrakk>
       \<Longrightarrow> f x \<sigma>
                         \<le> \<Down>
                                {(\<sigma>, \<sigma>').
                                 ((it - {x}, \<sigma>), it' - {x'},
                                  \<sigma>')
                                 \<in> R}
                                (f' x' \<sigma>')
 3. \<And>\<sigma> \<sigma>'.
       (({}, \<sigma>), {}, \<sigma>') \<in> R \<Longrightarrow>
       (\<sigma>, \<sigma>') \<in> R'
 4. \<And>it \<sigma> it' \<sigma>'.
       \<lbrakk>it \<subseteq> S; it' \<subseteq> \<alpha> ` S;
        it' = \<alpha> ` it; ((it, \<sigma>), it', \<sigma>') \<in> R;
        it \<noteq> {}; it' \<noteq> {}; \<not> c \<sigma>;
        \<not> c' \<sigma>'\<rbrakk>
       \<Longrightarrow> (\<sigma>, \<sigma>') \<in> R'


proof (prove)
using this:
  isrlfm p

goal (1 subgoal):
 1. Ifm (x # bs) (\<upsilon> p (t, n)) =
    Ifm (Inum (x # bs) t / real_of_int n # bs) p \<and>
    bound0 (\<upsilon> p (t, n))


proof (prove)
goal (1 subgoal):
 1. P \<turnstile> ty_of_htype U \<le> Class (class_type_of U)


proof (prove)
using this:
  (HF.Inl ?q \<in> ST.nextl {HF.Inl (dfa.init MS)} u) =
  (?q = dfa.nextl MS (dfa.init MS) u)

goal (1 subgoal):
 1. (HF.Inl q \<in> ST.nextl {HF.Inl (dfa.init MS)} (u @ [x])) =
    (q = dfa.nextl MS (dfa.init MS) (u @ [x]))


proof (prove)
goal (1 subgoal):
 1. (CASE 0 \<equiv> c) &&& CASE (eSuc n) \<equiv> d n


proof (prove)
goal (1 subgoal):
 1. !x \<le> !y \<Longrightarrow> t y \<le> t x


proof (prove)
using this:
  w \<noteq> x
  w \<noteq> y
  w \<notin> V
  w \<in> pverts G - V
  G.gen_iapath V x q y
  w \<in> set (pawalk_verts x q)
  in_degree (with_proj G) w \<le> 2

goal (1 subgoal):
 1. (\<And>e.
        \<lbrakk>e \<in> set q; snd e = w\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. findIndices\<cdot>P\<cdot>(a : xs) =
    If P\<cdot>a
    then 0 : map\<cdot>(+1)\<cdot>(findIndices\<cdot>P\<cdot>xs)
    else map\<cdot>(+1)\<cdot>(findIndices\<cdot>P\<cdot>xs)


proof (prove)
goal (1 subgoal):
 1. [\<^bold>\<diamond>\<^bold>\<not>\<lbrace>x,F\<rbrace> \<^bold>\<equiv>
     \<^bold>\<box>\<^bold>\<not>\<lbrace>x,F\<rbrace> in v]


proof (prove)
goal (1 subgoal):
 1. \<Down> R (\<Down> S M) = \<Down> (R O S) M


proof (state)
this:
  \<forall>\<sigma>.
     \<Gamma>,\<Theta>
        \<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter>
          I \<inter>
          b)
         c ({t. (t, \<sigma>) \<in> V} \<inter> I),A

goal (1 subgoal):
 1. \<Gamma>,\<Theta>
       \<turnstile>\<^sub>t\<^bsub>/F\<^esub> P whileAnno b I V c Q,A


proof (state)
this:
  \<forall>x\<in>{0..1}.
     onorm (\<lambda>i. f' (a + x *\<^sub>R (b - a)) i - f' x0 i) \<le> B

goal (1 subgoal):
 1. norm (f b - f a - f' x0 (b - a)) \<le> norm (b - a) * B


proof (prove)
using this:
  (u, mon_w fg w, P) \<in> S_cs fg k
  mon_e fg e = {}
  (u, ?M, ?P) \<in> S_cs fg ?k \<Longrightarrow>
  (v, ?M, ?P) \<in> S_cs fg ?k

goal (1 subgoal):
 1. (v, mon_w fg (w @ [e]), P) \<in> S_cs fg k