proof (prove)
goal (1 subgoal):
 1. at_infinity = sup at_top at_bot


proof (prove)
using this:
  R \<subseteq> S

goal (1 subgoal):
 1. (\<And>k.
        \<lbrakk>strict_mono k;
         \<And>x.
            x \<in> R \<Longrightarrow>
            \<exists>l.
               (\<lambda>n. \<F> (k n) x)
               \<longlonglongrightarrow> l\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<forall>e\<in>challenge_space.
       (\<forall>(h, w)\<in>R.
           local.\<Sigma>_protocols_base.R h w e =
           local.\<Sigma>_protocols_base.S h e) \<and>
       (\<forall>h\<in>valid_pub.
           \<forall>(a, z)\<in>set_spmf (S2 h e). check h a e z)


proof (prove)
goal (1 subgoal):
 1. insertion f (Const 0) = 0


proof (prove)
goal (1 subgoal):
 1. ((h', a) \<in> allocate h hT \<Longrightarrow>
     P,h' \<turnstile> v :\<le> T) &&&
    (heap_write h a al v' h' \<Longrightarrow> P,h' \<turnstile> v :\<le> T)


proof (state)
goal (1 subgoal):
 1. S \<inter> \<Inter> \<F> \<noteq> {}


proof (state)
this:
  identity stk1.carrier_stalk (stk1.add_stalk X' Y') =
  stk2.add_stalk (identity stk1.carrier_stalk X')
   (identity stk1.carrier_stalk Y')

goal (1 subgoal):
 1. identity stk1.carrier_stalk (stk1.mult_stalk X' Y') =
    stk2.mult_stalk (identity stk1.carrier_stalk X')
     (identity stk1.carrier_stalk Y')


proof (prove)
goal (1 subgoal):
 1. wf_formula n \<phi> \<Longrightarrow>
    local.wf n (rexp.Inter (rexp_of_alt' n \<phi>) (ENC n (FOV \<phi>)))


proof (prove)
goal (1 subgoal):
 1. \<exists>x. x \<in> Collect sg


proof (prove)
goal (1 subgoal):
 1. (\<And>xs ys.
        us = xs \<cdot> [u] \<cdot> ys \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (2 subgoals):
 1. \<And>d' t'.
       \<lbrakk>(d2, t) \<rightarrow>*c (d', t'); s' \<approx> t';
        discr d'\<rbrakk>
       \<Longrightarrow> (\<exists>d' t'.
                             (d1 | d2, t) \<rightarrow>*c (d', t') \<and>
                             s' \<approx> t' \<and>
                             ((\<exists>c1a c2.
                                  c1 = c1a | c2 \<and>
                                  (\<exists>d1 d2.
d' = d1 | d2 \<and> c1a \<approx>w d1 \<and> c2 \<approx>w d2)) \<or>
                              c1 \<approx>w d')) \<or>
                         (\<exists>t'.
                             (d1 | d2, t) \<rightarrow>*t t' \<and>
                             s' \<approx> t' \<and> discr c1)
 2. \<And>t'.
       \<lbrakk>(d2, t) \<rightarrow>*t t'; s' \<approx> t'\<rbrakk>
       \<Longrightarrow> (\<exists>d' t'.
                             (d1 | d2, t) \<rightarrow>*c (d', t') \<and>
                             s' \<approx> t' \<and>
                             (c1, d')
                             \<in> {(c1 | c2, d1 | d2) |c1 c2 d1 d2.
                                    c1 \<approx>w d1 \<and>
                                    c2 \<approx>w d2} \<union>
                                   Wbis) \<or>
                         (\<exists>t'.
                             (d1 | d2, t) \<rightarrow>*t t' \<and>
                             s' \<approx> t' \<and> discr c1)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<noteq> Suc 0; n \<in> [n\<dots>]\<rbrakk>
    \<Longrightarrow> [n\<dots>] \<noteq> [ r, mod m ]


proof (prove)
goal (15 subgoals):
 1. \<And>P. P \<sim> P
 2. \<And>P Q.
       \<lbrakk>P \<equiv>\<^sub>s Q; P \<sim> Q\<rbrakk>
       \<Longrightarrow> Q \<sim> P
 3. \<And>P Q R.
       \<lbrakk>P \<equiv>\<^sub>s Q; P \<sim> Q; Q \<equiv>\<^sub>s R;
        Q \<sim> R\<rbrakk>
       \<Longrightarrow> P \<sim> R
 4. \<And>P Q. P \<parallel> Q \<sim> Q \<parallel> P
 5. \<And>P Q R.
       P \<parallel> Q \<parallel> R \<sim> P \<parallel> (Q \<parallel> R)
 6. \<And>P. P \<parallel> \<zero> \<sim> P
 7. \<And>P Q. P \<oplus> Q \<sim> Q \<oplus> P
 8. \<And>P Q R. P \<oplus> Q \<oplus> R \<sim> P \<oplus> (Q \<oplus> R)
 9. \<And>P. P \<oplus> \<zero> \<sim> P
 10. \<And>x. \<lparr>\<nu>x\<rparr>\<zero> \<sim> \<zero>
A total of 15 subgoals...


proof (prove)
goal (1 subgoal):
 1. (Mod_Type_Connect.HMA_M ===>
     Mod_Type_Connect.HMA_I ===>
     Mod_Type_Connect.HMA_I ===> (=) ===> Mod_Type_Connect.HMA_M)
     (\<lambda>A a b q. addrow q a b A) row_add


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>in_carrier l; Imon_pol_list l mps\<rbrakk>
    \<Longrightarrow> Ipol l (psubstl1 P1 mps n) = Ipol l P1


proof (prove)
using this:
  ?a2 \<notin> arcs G \<Longrightarrow> edge_rev M ?a2 = ?a2
  ?a2 \<in> arcs G \<Longrightarrow> edge_rev M ?a2 \<noteq> ?a2
  ?a2 \<in> arcs G \<Longrightarrow> edge_rev M (edge_rev M ?a2) = ?a2
  ?a2 \<in> arcs G \<Longrightarrow> tail G (edge_rev M ?a2) = head G ?a2
  edge_succ M permutes arcs G
  \<lbrakk>?v2 \<in> verts G; out_arcs G ?v2 \<noteq> {}\<rbrakk>
  \<Longrightarrow> cyclic_on (edge_succ M) (out_arcs G ?v2)

goal (1 subgoal):
 1. digraph_map G M


proof (prove)
using this:
  2 * (bernoulli_fps oo - fps_X) = 2 * (bernoulli_fps + fps_X)

goal (1 subgoal):
 1. bernoulli_fps oo - fps_X = bernoulli_fps + fps_X


proof (prove)
goal (1 subgoal):
 1. is_prefix' xs ys
    \<le> ESPEC (\<lambda>_. False)
           (\<lambda>r. r = (xs = take (length xs) ys))


proof (prove)
using this:
  bprv (imp (PP \<langle>\<phi>L \<phi>\<rangle>) \<phi>)

goal (1 subgoal):
 1. bprv (\<phi>L \<phi>)


proof (prove)
goal (1 subgoal):
 1. Group.group H \<Longrightarrow>
    (f \<in> Group.iso G (subgroup_generated H (f ` carrier G))) =
    (f \<in> mon G H)


proof (chain)
picking this:
  ops \<in> set (List_Supplement.embed \<pi>)
  op \<in> set \<pi>
  ops = [op]


proof (prove)
goal (1 subgoal):
 1. card (atoms (tseytin_tran F)) \<le> size F + card (atoms F)


proof (prove)
using this:
  dist
   (sum (confine (\<lambda>i. (orthonormal_coeff S w f i)\<^sup>2) I) {..n})
   (sum (confine (\<lambda>i. (orthonormal_coeff S w f i)\<^sup>2) I) {..m})
  < e\<^sup>2

goal (1 subgoal):
 1. \<bar>(\<Sum>i\<in>I \<inter> {..n}.
             (orthonormal_coeff S w f i)\<^sup>2) -
          (\<Sum>i\<in>I \<inter> {..m}.
             (orthonormal_coeff S w f i)\<^sup>2)\<bar>
    < e\<^sup>2


proof (prove)
using this:
  V.arr ?\<mu> = arrow_of_spans (\<cdot>) ?\<mu>
  V.ide ?\<mu> = (arrow_of_spans (\<cdot>) ?\<mu> \<and> C.ide (Chn ?\<mu>))
  identity_arrow_of_spans_axioms ?C ?\<mu> \<equiv>
  partial_magma.ide ?C (Chn ?\<mu>)
  identity_arrow_of_spans ?C ?\<mu> \<equiv>
  arrow_of_spans ?C ?\<mu> \<and> identity_arrow_of_spans_axioms ?C ?\<mu>
  identity_arrow_of_spans ?C ?\<mu> \<Longrightarrow>
  arrow_of_spans ?C ?\<mu>
  identity_arrow_of_spans ?C ?\<mu> \<Longrightarrow>
  partial_magma.ide ?C (Chn ?\<mu>)

goal (1 subgoal):
 1. V.ide \<mu> = identity_arrow_of_spans (\<cdot>) \<mu>


proof (prove)
goal (1 subgoal):
 1. COMP f g = f


proof (prove)
goal (1 subgoal):
 1. Select0 (LiftInitData [V0 0, V1 0]) = 0


proof (prove)
goal (1 subgoal):
 1. \<exists>\<I>\<^sub>\<tau>.
       (subst_domain \<I>\<^sub>\<tau> = \<V> \<and>
        ground (subst_range \<I>\<^sub>\<tau>)) \<and>
       \<I>\<^sub>\<tau> \<Turnstile> \<langle>\<A>\<rangle> \<and>
       wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<I>\<^sub>\<tau> \<and>
       wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<I>\<^sub>\<tau>)


proof (prove)
using this:
  smem_ind s i = Some j

goal (1 subgoal):
 1. \<lparr>s;vs;vs_to_es ves @
                 [$b_e]\<rparr> \<leadsto>_ i \<lparr>s';vs';es'\<rparr>


proof (prove)
goal (1 subgoal):
 1. {(X, Y). X < Y} = depth_nmset <*mlex*> {(X, Y). |X| = |Y| \<and> X < Y}


proof (prove)
goal (1 subgoal):
 1. interpret_floatariths (map Var d1s) xs1 =
    interpret_floatariths (map Var d2s) xs2


proof (prove)
using this:
  invar (a # bq)

goal (1 subgoal):
 1. invar bq


proof (prove)
using this:
  order \<G> \<noteq> 0
  \<lbrakk>[?b = ?c] (mod ?a); [?d = ?e] (mod ?a)\<rbrakk>
  \<Longrightarrow> [?b + ?d = ?c + ?e] (mod ?a)
  [?b = ?c] (mod ?a) = (?b mod ?a = ?c mod ?a)
  ?a * (?b mod ?c) mod ?c = ?a * ?b mod ?c

goal (1 subgoal):
 1. [r *
     ((order \<G> * order \<G> -
       s * (nat (fst (bezw t (order \<G>))) mod order \<G>) +
       x) mod
      order \<G>) +
     (r * s * nat (fst (bezw t (order \<G>))) + xa) mod
     order
      \<G> = r *
             (order \<G> * order \<G> -
              s * (nat (fst (bezw t (order \<G>))) mod order \<G>) +
              x) +
             (r * s * nat (fst (bezw t (order \<G>))) +
              xa)] (mod order \<G>)


proof (prove)
using this:
  \<Psi> \<rhd> P \<longmapsto> M\<lparr>\<nu>*(xvec @
          yvec)\<rparr>\<langle>N\<rangle> \<prec> P'
  x \<in> supp N
  Prop ?Cb2 \<Psi> P
   (M\<lparr>\<nu>*(xvec @ yvec)\<rparr>\<langle>N\<rangle>) P' A\<^sub>P
   \<Psi>\<^sub>P
  y \<sharp> \<Psi>
  y \<noteq> x
  y \<sharp> P
  y \<sharp> xvec
  y \<sharp> yvec
  y \<sharp> \<alpha>
  y \<sharp> P'
  y \<sharp> A\<^sub>P
  y \<sharp> \<Psi>\<^sub>P
  y \<sharp> M
  y \<sharp> N
  y \<sharp> C
  y \<sharp> p
  x \<sharp> \<Psi>
  x \<sharp> M
  x \<sharp> xvec
  x \<sharp> yvec
  xvec \<sharp>* \<Psi>
  xvec \<sharp>* P
  xvec \<sharp>* M
  yvec \<sharp>* \<Psi>
  yvec \<sharp>* P
  yvec \<sharp>* M
  yvec \<sharp>* C
  x \<sharp> C
  xvec \<sharp>* C
  distinct xvec
  distinct yvec
  extractFrame P = \<langle>A\<^sub>P, \<Psi>\<^sub>P\<rangle>
  distinct A\<^sub>P
  x \<sharp> A\<^sub>P
  xvec \<sharp>* yvec
  xvec \<sharp>* \<Psi>\<^sub>P
  A\<^sub>P \<sharp>* \<Psi>
  A\<^sub>P \<sharp>* P
  A\<^sub>P \<sharp>* M
  A\<^sub>P \<sharp>* xvec
  A\<^sub>P \<sharp>* yvec
  A\<^sub>P \<sharp>* N
  A\<^sub>P \<sharp>* P'
  A\<^sub>P \<sharp>* C

goal (1 subgoal):
 1. Prop C \<Psi> (\<lparr>\<nu>x\<rparr>P)
     (M\<lparr>\<nu>*(xvec @
                      y #
                      yvec)\<rparr>\<langle>([(x, y)] \<bullet> N)\<rangle>)
     ([(x, y)] \<bullet> P') (x # A\<^sub>P) \<Psi>\<^sub>P


proof (prove)
goal (1 subgoal):
 1. l_get_dom_component_insert_before\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
     heap_is_wellformed parent_child_rel DocumentClass.type_wf
     DocumentClass.known_ptr DocumentClass.known_ptrs to_tree_order
     get_parent get_parent_locs get_child_nodes get_child_nodes_locs
     get_dom_component is_strongly_dom_component_safe
     is_weakly_dom_component_safe get_root_node get_root_node_locs
     get_ancestors get_ancestors_locs get_disconnected_nodes
     get_disconnected_nodes_locs get_element_by_id get_elements_by_tag_name
     set_child_nodes set_child_nodes_locs set_disconnected_nodes
     set_disconnected_nodes_locs get_owner_document remove_child
     remove_child_locs remove adopt_node adopt_node_locs insert_before
     insert_before_locs append_child get_scdom_component
     is_strongly_scdom_component_safe is_weakly_scdom_component_safe


proof (prove)
using this:
  rvars (\<T> s') = rvars (\<T> s) - {x\<^sub>j} \<union> {x\<^sub>i}
  x \<in> rvars (\<T> s) \<or> x = x\<^sub>i
  x \<noteq> x\<^sub>j
  x \<noteq> x\<^sub>i \<longrightarrow> x \<notin> lvars (\<T> s)
  \<lbrakk>\<triangle> (\<T> s); \<nabla> s; x\<^sub>i \<in> lvars (\<T> s);
   x\<^sub>j \<in> rvars_eq (eq_for_lvar (\<T> s) x\<^sub>i)\<rbrakk>
  \<Longrightarrow> Mapping.lookup
                     (\<V> (pivot_and_update x\<^sub>i x\<^sub>j b s))
                     x\<^sub>i =
                    Some b
  \<lbrakk>\<triangle> (\<T> s); \<nabla> s; x\<^sub>i \<in> lvars (\<T> s);
   x\<^sub>j \<in> rvars_eq (eq_for_lvar (\<T> s) x\<^sub>i);
   x \<notin> lvars (\<T> s); x \<noteq> x\<^sub>j\<rbrakk>
  \<Longrightarrow> Mapping.lookup
                     (\<V> (pivot_and_update x\<^sub>i x\<^sub>j b s)) x =
                    Mapping.lookup (\<V> s) x
  x\<^sub>i \<in> lvars (\<T> s)
  x\<^sub>j \<in> rvars_eq (eq_for_lvar (\<T> s) x\<^sub>i)
  \<triangle> (\<T> s)
  \<nabla> s
  s' = pivot_and_update x\<^sub>i x\<^sub>j b s
  b = the (\<B>\<^sub>l s x\<^sub>i) \<or>
  b = the (\<B>\<^sub>u s x\<^sub>i)

goal (1 subgoal):
 1. \<langle>\<V> s'\<rangle> x = \<langle>\<V> s\<rangle> x \<or>
    \<langle>\<V> s'\<rangle> x = the (\<B>\<^sub>l s x) \<or>
    \<langle>\<V> s'\<rangle> x = the (\<B>\<^sub>u s x)


proof (prove)
using this:
  xs \<noteq> []
  run (xs @- ys) \<Longrightarrow>
  steps xs \<and> run ys \<and> E (last xs) (shd ys)
  run ((x # xs) @- ys)

goal (1 subgoal):
 1. steps (x # xs) \<and> run ys \<and> E (last (x # xs)) (shd ys)


proof (prove)
using this:
  ins ! pc = Invoke M n

goal (1 subgoal):
 1. (ta', xcp', h', (stk' @ stk'', loc', C, M, pc') # frs)
    \<in> exec_instr (ins ! pc) P t h (stk @ stk'') loc C M pc frs


proof (prove)
using this:
  \<p>\<^sub>1[ra, ru.prj\<^sub>1 \<cdot> \<omega>.chine] =
  (ru.prj\<^sub>1 \<cdot> \<omega>.chine) \<cdot>
  \<p>\<^sub>0[ra, ru.prj\<^sub>1 \<cdot> \<omega>.chine]

goal (1 subgoal):
 1. ru.prj\<^sub>1 \<cdot> \<omega>.chine =
    \<p>\<^sub>1[ra, ru.prj\<^sub>1 \<cdot> \<omega>.chine] \<cdot>
    C.inv \<p>\<^sub>0[ra, ru.prj\<^sub>1 \<cdot> \<omega>.chine]


proof (prove)
using this:
  enat i \<le> llength t' \<Longrightarrow>
  cotrace (local.cos c' t' i) (Co_Snapshot.ldrop i t')
  enat (Suc i) \<le> llength t
  c \<turnstile> ev \<mapsto> c'
  cotrace c' t'

goal (1 subgoal):
 1. cotrace (local.cos c t (Suc i)) (Co_Snapshot.ldrop (Suc i) t)


proof (prove)
using this:
  rotate2 x = rotate2 y

goal (1 subgoal):
 1. rotate2 (rotate2 x) = rotate2 (rotate2 y)


proof (prove)
using this:
  agree fm fm1
  agree fm fm2

goal (1 subgoal):
 1. \<forall>v.
       v \<in> fmdom' fm \<and>
       v \<in> fmdom' (fm2 ++\<^sub>f fm1) \<longrightarrow>
       fmlookup fm v = fmlookup (fm2 ++\<^sub>f fm1) v


proof (prove)
goal (1 subgoal):
 1. set_lebesgue_integral M (\<Union>n. (T ^^ n) --` A) f =
    set_lebesgue_integral M (space M) f


proof (state)
this:
  (ut, mon_w fg w1, P1) \<in> S_cs fg k
  (return fg q, mon_w fg w2, P2) \<in> S_cs fg k

goal (2 subgoals):
 1. \<And>p.
       \<lbrakk>sh = [return fg p, v]; e = LRet; c' = ch\<rbrakk>
       \<Longrightarrow> (v, mon_w fg (w @ [e]), P) \<in> S_cs fg k
 2. \<And>u p.
       \<lbrakk>sh = [u]; e = LSpawn p; c' = add_mset [entry fg p] ch;
        (u, Spawn p, v) \<in> edges fg\<rbrakk>
       \<Longrightarrow> (v, mon_w fg (w @ [e]), P) \<in> S_cs fg k


proof (prove)
goal (1 subgoal):
 1. (mem_val_alt 10 (a AND 68719476732)
      (s1\<lparr>mem := (mem s1)
                   (10 := mem s1 10(addr \<mapsto> val),
                    11 := (mem s1 11)(addr := None))\<rparr>) =
     None \<longrightarrow>
     mem_val_alt 10 (a AND 68719476732)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None \<or>
     mem_val_alt 10 ((a AND 68719476732) + 1)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None \<or>
     mem_val_alt 10 ((a AND 68719476732) + 2)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None \<or>
     mem_val_alt 10 ((a AND 68719476732) + 3)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None) \<and>
    (mem_val_alt 10 ((a AND 68719476732) + 1)
      (s1\<lparr>mem := (mem s1)
                   (10 := mem s1 10(addr \<mapsto> val),
                    11 := (mem s1 11)(addr := None))\<rparr>) =
     None \<longrightarrow>
     mem_val_alt 10 (a AND 68719476732)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None \<or>
     mem_val_alt 10 ((a AND 68719476732) + 1)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None \<or>
     mem_val_alt 10 ((a AND 68719476732) + 2)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None \<or>
     mem_val_alt 10 ((a AND 68719476732) + 3)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None) \<and>
    (mem_val_alt 10 ((a AND 68719476732) + 2)
      (s1\<lparr>mem := (mem s1)
                   (10 := mem s1 10(addr \<mapsto> val),
                    11 := (mem s1 11)(addr := None))\<rparr>) =
     None \<longrightarrow>
     mem_val_alt 10 (a AND 68719476732)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None \<or>
     mem_val_alt 10 ((a AND 68719476732) + 1)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None \<or>
     mem_val_alt 10 ((a AND 68719476732) + 2)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None \<or>
     mem_val_alt 10 ((a AND 68719476732) + 3)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None) \<and>
    (mem_val_alt 10 ((a AND 68719476732) + 3)
      (s1\<lparr>mem := (mem s1)
                   (10 := mem s1 10(addr \<mapsto> val),
                    11 := (mem s1 11)(addr := None))\<rparr>) =
     None \<longrightarrow>
     mem_val_alt 10 (a AND 68719476732)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None \<or>
     mem_val_alt 10 ((a AND 68719476732) + 1)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None \<or>
     mem_val_alt 10 ((a AND 68719476732) + 2)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None \<or>
     mem_val_alt 10 ((a AND 68719476732) + 3)
      (s2\<lparr>mem := (mem s2)
                   (10 := mem s2 10(addr \<mapsto> val),
                    11 := (mem s2 11)(addr := None))\<rparr>) =
     None) \<and>
    ((\<exists>y.
         mem_val_alt 10 (a AND 68719476732)
          (s1\<lparr>mem := (mem s1)
                       (10 := mem s1 10(addr \<mapsto> val),
                        11 := (mem s1 11)(addr := None))\<rparr>) =
         Some y) \<and>
     (\<exists>y.
         mem_val_alt 10 ((a AND 68719476732) + 1)
          (s1\<lparr>mem := (mem s1)
                       (10 := mem s1 10(addr \<mapsto> val),
                        11 := (mem s1 11)(addr := None))\<rparr>) =
         Some y) \<and>
     (\<exists>y.
         mem_val_alt 10 ((a AND 68719476732) + 2)
          (s1\<lparr>mem := (mem s1)
                       (10 := mem s1 10(addr \<mapsto> val),
                        11 := (mem s1 11)(addr := None))\<rparr>) =
         Some y) \<and>
     (\<exists>y.
         mem_val_alt 10 ((a AND 68719476732) + 3)
          (s1\<lparr>mem := (mem s1)
                       (10 := mem s1 10(addr \<mapsto> val),
                        11 := (mem s1 11)(addr := None))\<rparr>) =
         Some y) \<longrightarrow>
     (\<exists>y.
         mem_val_alt 10 (a AND 68719476732)
          (s2\<lparr>mem := (mem s2)
                       (10 := mem s2 10(addr \<mapsto> val),
                        11 := (mem s2 11)(addr := None))\<rparr>) =
         Some y) \<and>
     (\<exists>y.
         mem_val_alt 10 ((a AND 68719476732) + 1)
          (s2\<lparr>mem := (mem s2)
                       (10 := mem s2 10(addr \<mapsto> val),
                        11 := (mem s2 11)(addr := None))\<rparr>) =
         Some y) \<and>
     (\<exists>y.
         mem_val_alt 10 ((a AND 68719476732) + 2)
          (s2\<lparr>mem := (mem s2)
                       (10 := mem s2 10(addr \<mapsto> val),
                        11 := (mem s2 11)(addr := None))\<rparr>) =
         Some y) \<and>
     (\<exists>y.
         mem_val_alt 10 ((a AND 68719476732) + 3)
          (s2\<lparr>mem := (mem s2)
                       (10 := mem s2 10(addr \<mapsto> val),
                        11 := (mem s2 11)(addr := None))\<rparr>) =
         Some y) \<and>
     ((\<exists>y.
          mem_val_alt 10 (a AND 68719476732)
           (s2\<lparr>mem := (mem s2)
                        (10 := mem s2 10(addr \<mapsto> val),
                         11 := (mem s2 11)(addr := None))\<rparr>) =
          Some y) \<and>
      (\<exists>y.
          mem_val_alt 10 ((a AND 68719476732) + 1)
           (s2\<lparr>mem := (mem s2)
                        (10 := mem s2 10(addr \<mapsto> val),
                         11 := (mem s2 11)(addr := None))\<rparr>) =
          Some y) \<and>
      (\<exists>y.
          mem_val_alt 10 ((a AND 68719476732) + 2)
           (s2\<lparr>mem := (mem s2)
                        (10 := mem s2 10(addr \<mapsto> val),
                         11 := (mem s2 11)(addr := None))\<rparr>) =
          Some y) \<and>
      (\<exists>y.
          mem_val_alt 10 ((a AND 68719476732) + 3)
           (s2\<lparr>mem := (mem s2)
                        (10 := mem s2 10(addr \<mapsto> val),
                         11 := (mem s2 11)(addr := None))\<rparr>) =
          Some y) \<longrightarrow>
      (((ucast
          (case mem_val_alt 10 (a AND 68719476732)
                 (s1\<lparr>mem := (mem s1)
                              (10 := mem s1 10(addr \<mapsto> val),
                               11 := (mem s1 11)(addr := None))\<rparr>) of
           Some v \<Rightarrow> v) <<
         24) OR
        (ucast
          (case mem_val_alt 10 ((a AND 68719476732) + 1)
                 (s1\<lparr>mem := (mem s1)
                              (10 := mem s1 10(addr \<mapsto> val),
                               11 := (mem s1 11)(addr := None))\<rparr>) of
           Some v \<Rightarrow> v) <<
         16)) OR
       (ucast
         (case mem_val_alt 10 ((a AND 68719476732) + 2)
                (s1\<lparr>mem := (mem s1)
                             (10 := mem s1 10(addr \<mapsto> val),
                              11 := (mem s1 11)(addr := None))\<rparr>) of
          Some v \<Rightarrow> v) <<
        8)) OR
      ucast
       (case mem_val_alt 10 ((a AND 68719476732) + 3)
              (s1\<lparr>mem := (mem s1)
                           (10 := mem s1 10(addr \<mapsto> val),
                            11 := (mem s1 11)(addr := None))\<rparr>) of
        Some v \<Rightarrow> v) =
      (((ucast
          (case mem_val_alt 10 (a AND 68719476732)
                 (s2\<lparr>mem := (mem s2)
                              (10 := mem s2 10(addr \<mapsto> val),
                               11 := (mem s2 11)(addr := None))\<rparr>) of
           Some v \<Rightarrow> v) <<
         24) OR
        (ucast
          (case mem_val_alt 10 ((a AND 68719476732) + 1)
                 (s2\<lparr>mem := (mem s2)
                              (10 := mem s2 10(addr \<mapsto> val),
                               11 := (mem s2 11)(addr := None))\<rparr>) of
           Some v \<Rightarrow> v) <<
         16)) OR
       (ucast
         (case mem_val_alt 10 ((a AND 68719476732) + 2)
                (s2\<lparr>mem := (mem s2)
                             (10 := mem s2 10(addr \<mapsto> val),
                              11 := (mem s2 11)(addr := None))\<rparr>) of
          Some v \<Rightarrow> v) <<
        8)) OR
      ucast
       (case mem_val_alt 10 ((a AND 68719476732) + 3)
              (s2\<lparr>mem := (mem s2)
                           (10 := mem s2 10(addr \<mapsto> val),
                            11 := (mem s2 11)(addr := None))\<rparr>) of
        Some v \<Rightarrow> v)))


proof (state)
goal (1 subgoal):
 1. \<lbrace>Cod t\<^bold>\<down>\<rbrace> \<cdot>
    \<lbrace>t\<rbrace> \<cdot> \<lbrace>u\<rbrace> =
    (\<lbrace>Cod t\<^bold>\<down>\<rbrace> \<cdot>
     \<lbrace>t\<rbrace>) \<cdot>
    \<lbrace>u\<rbrace>


proof (prove)
using this:
  (\<lambda>idx. if idx < r1 then 0 else if idx < r2 then i else l)
  \<in> {0..<k} \<rightarrow> {0..l}
  \<forall>j\<le>r2 - 1. (if j < r1 then 0 else if j < r2 then i else l) < l

goal (1 subgoal):
 1. col (f (\<lambda>idx.
               if idx < r1 then 0 else if idx < r2 then i else l)) =
    col (f (\<lambda>ia.
               if ia \<le> r2 - 1 then 0
               else if ia < r1 then 0 else if ia < r2 then i else l))


proof (prove)
using this:
  a * b = x * c
  c = (0::'a) \<or> a = (0::'a) \<or> b = (0::'a)

goal (1 subgoal):
 1. x dvd a \<or> x dvd b


proof (prove)
using this:
  y \<sharp> (x, t, v)
  val v

goal (1 subgoal):
 1. APP LAM [y].[(y, x)] \<bullet> t
     v \<longrightarrow>cbv ([(y, x)] \<bullet> t)[y::=v]


proof (prove)
goal (1 subgoal):
 1. invertible (fst (Gauss_Jordan_in_ij_PA (P, A) i j))


proof (prove)
goal (1 subgoal):
 1. [\<lbrace>\<^bold>\<iota>x.
                 \<lparr>A!,x\<^sup>P\<rparr> \<^bold>&
                 (\<^bold>\<forall>F.
                     \<lbrace>x\<^sup>P,F\<rbrace> \<^bold>\<equiv>
                     \<phi> F),G\<rbrace> in v]


proof (prove)
goal (1 subgoal):
 1. (\<lambda>n.
        \<Sum>k = 1..card (uverts H).
           real (card (uverts H) ^ k) *
           (real n ^ (2 * card (uverts H) - k) *
            p n powr
            (real (2 * card (uedges H)) - max_density H * real k)) /
           (1 / real (card (uverts H) ^ card (uverts H)) *
            (real n ^ card (uverts H) * p n ^ card (uedges H)))\<^sup>2) =
    (\<lambda>n.
        (\<Sum>k = 1..card (uverts H).
            real (card (uverts H) ^ k) *
            (real n ^ (2 * card (uverts H) - k) *
             p n powr
             (real (2 * card (uedges H)) - max_density H * real k))) /
        (1 / real (card (uverts H) ^ card (uverts H)) *
         (real n ^ card (uverts H) * p n ^ card (uedges H)))\<^sup>2)


proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. g (f x)) \<midarrow>a\<rightarrow> l


proof (prove)
goal (5 subgoals):
 1. \<forall>a ec t.
       t \<in> SPR.jkbpC \<and>
       spr_simAbs ec = SPRdet.sim_equiv_class a t \<longrightarrow>
       local.spr_simObs a ec = envObs a (tLast t)
 2. \<forall>a ec t.
       t \<in> SPR.jkbpC \<and>
       spr_simAbs ec = SPRdet.sim_equiv_class a t \<longrightarrow>
       set (local.spr_simAction a ec) = set (jAction SPR.MC t a)
 3. \<forall>a ec t.
       t \<in> SPR.jkbpC \<and>
       spr_simAbs ec = SPRdet.sim_equiv_class a t \<longrightarrow>
       spr_simAbs ` set (local.spr_simTrans a ec) =
       rel_ext
        (\<lambda>uu_.
            \<exists>t' s.
               uu_ = SPRdet.sim_equiv_class a (t' \<leadsto> s) \<and>
               t' \<leadsto> s \<in> SPR.jkbpC \<and>
               spr_jview a t' = spr_jview a t)
 4. MapOps spr_simAbs (\<Union>a. SPRdet.sim_equiv_class a ` SPR.jkbpC)
     acts_MapOps
 5. MapOps (\<lambda>k. (spr_simAbs (fst k), snd k))
     ((\<Union>a. SPRdet.sim_equiv_class a ` SPR.jkbpC) \<times> UNIV)
     trans_MapOps


proof (prove)
using this:
  (\<lparr>\<nu>x\<rparr>\<zero>, \<zero>)
  \<in> {(\<lparr>\<nu>x\<rparr>\<zero>, \<zero>),
         (\<zero>, \<lparr>\<nu>x\<rparr>\<zero>)}

goal (1 subgoal):
 1. \<lparr>\<nu>x\<rparr>\<zero> \<sim> \<zero>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>is_rendered_commutative_by (\<chi> J.AA) (\<chi> J.BB);
     \<And>p0 p1.
        mkCone p0 p1 \<equiv>
        \<lambda>j.
           if j = J.AA then p0
           else if j = J.BB then p1
                else if j = J.AT then f0 \<cdot> p0
                     else if j = J.BT then f1 \<cdot> p1
                          else if j = J.TT then f0 \<cdot> p0 else C.null;
     \<And>f. \<not> J.arr f \<Longrightarrow> \<chi> f = C.null;
     \<And>f' f.
        f = J.AA \<and> (f' = J.AA \<or> f' = J.AT) \<or>
        f = J.BB \<and> (f' = J.BB \<or> f' = J.BT) \<or>
        f = J.AT \<and> f' = J.TT \<or>
        f = J.BT \<and> f' = J.TT \<or>
        f = J.TT \<and> f' = J.TT \<Longrightarrow>
        \<chi> (f' \<cdot>\<^sub>J f) = local.map f' \<cdot> \<chi> f;
     \<And>g f.
        J.seq g f =
        (f = J.AA \<and> (g = J.AA \<or> g = J.AT) \<or>
         f = J.BB \<and> (g = J.BB \<or> g = J.BT) \<or>
         f = J.AT \<and> g = J.TT \<or>
         f = J.BT \<and> g = J.TT \<or> f = J.TT \<and> g = J.TT);
     \<And>f.
        J.arr f \<Longrightarrow>
        \<chi> (J.cod f) \<cdot> a = \<chi> f\<rbrakk>
    \<Longrightarrow> f1 \<cdot> \<chi> J.BB = \<chi> J.TT


proof (prove)
using this:
  A * B =
  upd_rows 0 UNIV
   (\<lambda>i. \<Sum>j\<in>UNIV. to_fun A i j *s Square_Matrix.row B j)
  upd_rows 0 UNIV (\<lambda>i. Square_Matrix.row B (?f i)) = perm_rows B ?f
  Square_Matrix.det A =
  (\<Sum>p | p permutes UNIV.
     of_int (sign p) * (\<Prod>i\<in>UNIV. to_fun A i (p i)))

goal (1 subgoal):
 1. Square_Matrix.det (A * B) = Square_Matrix.det A * Square_Matrix.det B


proof (prove)
goal (1 subgoal):
 1. length xs \<noteq> n \<Longrightarrow> pmf (bv n) xs = 0


proof (prove)
goal (1 subgoal):
 1. gcd (a * n div d) n = n div d * gcd a d


proof (prove)
goal (1 subgoal):
 1. \<I>, \<I>' \<turnstile>\<^sub>C
    map_converter id id f g id_converter \<surd> \<Longrightarrow>
    \<I> \<le> map_\<I> f g \<I>'


proof (state)
this:
  ((ps' @ ps, a) # branch) !. v = Some (qs, a') \<or>
  ((ps' @ ps, a) # branch) !. v = Some (ps' @ qs, a')

goal (1 subgoal):
 1. \<And>v qs a v' p k i xs w w' rs b ps aa branch.
       \<lbrakk>((ps, aa) # branch) !. v = Some (qs, a); qs !. v' = Some p;
        descendants k i ((ps, aa) # branch) xs;
        descendants k i ((ps' @ ps, aa) # branch) xs; (w, w') \<in> xs;
        ((ps, aa) # branch) !. w = Some (rs, b); rs !. w' = Some p;
        Nom a at b in (ps, aa) # branch\<rbrakk>
       \<Longrightarrow> descendants k i ((ps' @ ps, aa) # branch)
                          ({(v, v')} \<union> xs)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(\<lambda>x. f (- inverse x))
             \<in> L' at_top (\<lambda>x. g (- inverse x));
     (\<lambda>x. f (inverse x))
     \<in> L' at_top (\<lambda>x. g (inverse x))\<rbrakk>
    \<Longrightarrow> f \<in> L (at 0) g


proof (state)
this:
  \<lbrakk>M \<in> multisets A; M \<in> multisets A; M \<noteq> {#}\<rbrakk>
  \<Longrightarrow> mulex_on P A M (M + M)
  M \<in> multisets A
  add_mset a M \<in> multisets A
  add_mset a M \<noteq> {#}

goal (1 subgoal):
 1. \<And>x K.
       \<lbrakk>\<lbrakk>M \<in> multisets A; K \<in> multisets A;
                 K \<noteq> {#}\<rbrakk>
                \<Longrightarrow> mulex_on P A M (M + K);
        M \<in> multisets A; add_mset x K \<in> multisets A;
        add_mset x K \<noteq> {#}\<rbrakk>
       \<Longrightarrow> mulex_on P A M (M + add_mset x K)


proof (prove)
using this:
  x \<in> carrier R
  y \<in> carrier R
  1 < n

goal (1 subgoal):
 1. x \<oplus>\<^bsub>R\<^esub> y \<in> carrier R


proof (prove)
using this:
  \<lless>\<pi>\<^sub>P, eP\<ggreater> P\<rightarrow>i \<lless>\<pi>\<^sub>P @
                         \<pi>, eP'\<ggreater>
  {$$} \<turnstile> e, eP, eV : \<tau>

goal (1 subgoal):
 1. (\<And>e' eV'.
        \<lbrakk>{$$} \<turnstile> e', eP', eV' : \<tau>;
         \<lless>[], e\<ggreater> I\<rightarrow>i \<lless>[], e'\<ggreater>;
         \<lless>\<pi>, eV\<ggreater> V\<rightarrow>i \<lless>[], eV'\<ggreater>\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. ContractsWithUnilateralSubstitutesAndIRC Xd Xh Pd' Ch


proof (prove)
goal (1 subgoal):
 1. (x \<in> i.R (y ## s)) = (x = y \<or> x \<in> i.R s)


proof (prove)
goal (1 subgoal):
 1. continuous_map euclidean euclidean (\<lambda>f. f x)


proof (prove)
goal (1 subgoal):
 1. mustT c1 s


proof (prove)
goal (1 subgoal):
 1. wf'\<^sub>s\<^sub>s\<^sub>t X (T1 @ T2 @ T3 @ T4 @ T5)


proof (prove)
using this:
  ES_valid ES1
  ES_valid ES2
  composable ES1 ES2
  isViewOn
   \<lparr>V = V\<^bsub>\<V>\<^esub> \<union> N\<^bsub>\<V>\<^esub>, N = {},
      C = C\<^bsub>\<V>\<^esub>\<rparr>
   E\<^bsub>ES1 \<parallel> ES2\<^esub>
  isViewOn
   \<lparr>V = V\<^bsub>\<V>1\<^esub> \<union> N\<^bsub>\<V>1\<^esub>,
      N = {}, C = C\<^bsub>\<V>1\<^esub>\<rparr>
   E\<^bsub>ES1\<^esub>
  isViewOn
   \<lparr>V = V\<^bsub>\<V>2\<^esub> \<union> N\<^bsub>\<V>2\<^esub>,
      N = {}, C = C\<^bsub>\<V>2\<^esub>\<rparr>
   E\<^bsub>ES2\<^esub>
  V\<^bsub>\<lparr>V = V\<^bsub>\<V>\<^esub> \<union> N\<^bsub>\<V>\<^esub>,
              N = {}, C = C\<^bsub>\<V>\<^esub>\<rparr>\<^esub> \<inter>
  E\<^bsub>ES1\<^esub> =
  V\<^bsub>\<lparr>V = V\<^bsub>\<V>1\<^esub> \<union>
                       N\<^bsub>\<V>1\<^esub>,
              N = {}, C = C\<^bsub>\<V>1\<^esub>\<rparr>\<^esub>
  V\<^bsub>\<lparr>V = V\<^bsub>\<V>\<^esub> \<union> N\<^bsub>\<V>\<^esub>,
              N = {}, C = C\<^bsub>\<V>\<^esub>\<rparr>\<^esub> \<inter>
  E\<^bsub>ES2\<^esub> =
  V\<^bsub>\<lparr>V = V\<^bsub>\<V>2\<^esub> \<union>
                       N\<^bsub>\<V>2\<^esub>,
              N = {}, C = C\<^bsub>\<V>2\<^esub>\<rparr>\<^esub>
  C\<^bsub>\<lparr>V = V\<^bsub>\<V>\<^esub> \<union> N\<^bsub>\<V>\<^esub>,
              N = {}, C = C\<^bsub>\<V>\<^esub>\<rparr>\<^esub> \<inter>
  E\<^bsub>ES1\<^esub>
  \<subseteq> C\<^bsub>\<lparr>V = V\<^bsub>\<V>1\<^esub> \<union>
                                   N\<^bsub>\<V>1\<^esub>,
                          N = {}, C = C\<^bsub>\<V>1\<^esub>\<rparr>\<^esub>
  C\<^bsub>\<lparr>V = V\<^bsub>\<V>\<^esub> \<union> N\<^bsub>\<V>\<^esub>,
              N = {}, C = C\<^bsub>\<V>\<^esub>\<rparr>\<^esub> \<inter>
  E\<^bsub>ES2\<^esub>
  \<subseteq> C\<^bsub>\<lparr>V = V\<^bsub>\<V>2\<^esub> \<union>
                                   N\<^bsub>\<V>2\<^esub>,
                          N = {}, C = C\<^bsub>\<V>2\<^esub>\<rparr>\<^esub>
  N\<^bsub>\<lparr>V = V\<^bsub>\<V>1\<^esub> \<union>
                       N\<^bsub>\<V>1\<^esub>,
              N = {}, C = C\<^bsub>\<V>1\<^esub>\<rparr>\<^esub> \<inter>
  N\<^bsub>\<lparr>V = V\<^bsub>\<V>2\<^esub> \<union>
                       N\<^bsub>\<V>2\<^esub>,
              N = {}, C = C\<^bsub>\<V>2\<^esub>\<rparr>\<^esub> =
  {}
  N\<^bsub>\<lparr>V = V\<^bsub>\<V>1\<^esub> \<union>
                       N\<^bsub>\<V>1\<^esub>,
              N = {}, C = C\<^bsub>\<V>1\<^esub>\<rparr>\<^esub> \<inter>
  E\<^bsub>ES1\<^esub> =
  {} \<and>
  N\<^bsub>\<lparr>V = V\<^bsub>\<V>2\<^esub> \<union>
                       N\<^bsub>\<V>2\<^esub>,
              N = {}, C = C\<^bsub>\<V>2\<^esub>\<rparr>\<^esub> \<inter>
  E\<^bsub>ES2\<^esub> =
  {}

goal (1 subgoal):
 1. Compositionality ES1 ES2
     \<lparr>V = V\<^bsub>\<V>\<^esub> \<union> N\<^bsub>\<V>\<^esub>,
        N = {}, C = C\<^bsub>\<V>\<^esub>\<rparr>
     \<lparr>V = V\<^bsub>\<V>1\<^esub> \<union> N\<^bsub>\<V>1\<^esub>,
        N = {}, C = C\<^bsub>\<V>1\<^esub>\<rparr>
     \<lparr>V = V\<^bsub>\<V>2\<^esub> \<union> N\<^bsub>\<V>2\<^esub>,
        N = {}, C = C\<^bsub>\<V>2\<^esub>\<rparr>


proof (prove)
using this:
  0 < real (prod_list ys)

goal (1 subgoal):
 1. sum_list (map (log b) (map real (y # ys))) =
    log b (real (prod_list (y # ys)))


proof (state)
this:
  \<forall>x1 x2.
     x1 \<in> unit_disc \<and>
     x2 \<in> unit_disc \<and>
     \<not> poincare_collinear {a, x1, x2} \<longrightarrow>
     (\<exists>a1\<in>unit_disc.
         \<exists>a2\<in>unit_disc.
            \<not> poincare_on_line a a1 a2 \<and>
            \<not> poincare_ray_meets_line a a1 x1 x2 \<and>
            \<not> poincare_ray_meets_line a a2 x1 x2 \<and>
            (\<forall>a'\<in>unit_disc.
                poincare_in_angle a' a1 a a2 \<longrightarrow>
                poincare_ray_meets_line a a' x1 x2))

goal (1 subgoal):
 1. \<exists>a1\<in>unit_disc.
       \<exists>a2\<in>unit_disc.
          \<not> poincare_on_line a a1 a2 \<and>
          \<not> poincare_ray_meets_line a a1 x1 x2 \<and>
          \<not> poincare_ray_meets_line a a2 x1 x2 \<and>
          (\<forall>a'\<in>unit_disc.
              poincare_in_angle a' a1 a a2 \<longrightarrow>
              poincare_ray_meets_line a a' x1 x2)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(c, s) \<Rightarrow> t; s \<in> S\<rbrakk>
    \<Longrightarrow> t \<in> post (Collecting.lfp c (step S))


proof (prove)
goal (1 subgoal):
 1. VARtoCorrectSYSTEM


proof (prove)
goal (1 subgoal):
 1. single_valued (\<Union>n. (f ^^ n) {})


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>P \<subseteq> g \<inter> R;
     \<Gamma>,\<Theta>
        \<turnstile>\<^sub>t\<^bsub>/F\<^esub> R c Q,A\<rbrakk>
    \<Longrightarrow> \<Gamma>,\<Theta>
                         \<turnstile>\<^sub>t\<^bsub>/F\<^esub> P
                          guaranteeStrip f g c Q,A


proof (prove)
using this:
  \<forall>m\<ge>M. \<forall>n\<ge>M. dist (X m) (X n) < r / sqrt 2
  \<forall>m\<ge>N. \<forall>n\<ge>N. dist (Y m) (Y n) < r / sqrt 2

goal (1 subgoal):
 1. \<forall>m\<ge>max M N.
       \<forall>n\<ge>max M N. dist (X m, Y m) (X n, Y n) < r


proof (prove)
goal (1 subgoal):
 1. normal_form F (- p) = - normal_form F p


proof (prove)
goal (1 subgoal):
 1. e \<in> UNIV \<rightarrow> {- 1..1} \<Longrightarrow>
    \<bar>pdevs_val e x\<bar> \<le> tdev x


proof (prove)
using this:
  x =
  (\<Sum>i = 0..<length Gs.
      if x \<in> (\<Oplus>G\<leftarrow>Gs. G)
      then \<Oplus>Gs\<leftarrow> x ! i else (0::'a))
  \<forall>i<length Gs.
     (if x \<in> (\<Oplus>G\<leftarrow>Gs. G)
      then \<Oplus>Gs\<leftarrow> x ! i else (0::'a)) =
     (0::'a)

goal (1 subgoal):
 1. x \<in> 0


proof (prove)
using this:
  closed S
  closed T
  S \<inter> T = {}

goal (1 subgoal):
 1. (\<And>f.
        \<lbrakk>continuous_on UNIV f;
         \<And>x. f x \<in> closed_segment a b;
         \<And>x. x \<in> S \<Longrightarrow> f x = a;
         \<And>x. x \<in> T \<Longrightarrow> f x = b\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  P \<turnstile> \<langle>e_,s\<^sub>0_\<rangle> \<Rightarrow>
                 \<langle>Val v_,(h_, l_)\<rangle>
  P \<turnstile> \<langle>e_,s\<^sub>0_\<rangle> \<rightarrow>*
                 \<langle>Val v_,(h_, l_)\<rangle>
  l'_ = l_(V_ \<mapsto> v_)

goal (1 subgoal):
 1. P \<turnstile> \<langle>V_:=e_,s\<^sub>0_\<rangle> \<rightarrow>*
                   \<langle>unit,(h_, l'_)\<rangle>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>start_heap P a = \<lfloor>(C, S)\<rfloor>;
     Subobjs P C Cs\<rbrakk>
    \<Longrightarrow> \<exists>fs. (Cs, fs) \<in> S


proof (prove)
using this:
  Re B \<noteq> 0

goal (1 subgoal):
 1. (sgn (Re B))\<^sup>2 = 1


proof (prove)
goal (1 subgoal):
 1. LIM x F. - g x :> at_top


proof (prove)
goal (1 subgoal):
 1. flat ((x # xs) ## ws) = x ## flat (if xs = [] then ws else xs ## ws)


proof (prove)
using this:
  CONSTRAINT (IS_PURE single_valued) K
  CONSTRAINT (IS_PURE IS_LEFT_UNIQUE) K
  CONSTRAINT is_pure V
  CONSTRAINT (is_unused_elem dflt) V

goal (1 subgoal):
 1. True \<Longrightarrow>
    comp_PRE
     ((the_pure K \<times>\<^sub>r the_pure V) \<times>\<^sub>r
      \<langle>the_pure K, the_pure V\<rangle>map_rel)
     (\<lambda>_. True) (\<lambda>x ((a, b), ba). b \<noteq> dflt)
     (\<lambda>x.
         nofail (uncurry2 (RETURN \<circ>\<circ>\<circ> op_map_update) x))
     x_


proof (state)
this:
  prod_list (list_neq x (mean x)) = 1

goal (1 subgoal):
 1. x \<noteq> [] \<and> het x = 0 \<Longrightarrow>
    prod_list x = mean x ^ length x


proof (prove)
using this:
  (?ps2, ?c2) \<in> g3mod1 \<Longrightarrow> (?ps2, ?c2) \<in> modRules2

goal (1 subgoal):
 1. g3mod1 \<subseteq> modRules2


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       x \<in> Hom A B \<Longrightarrow>
       (\<lambda>f\<in>Hom A B.
           compose (Hom A A) (set_func (u B))
            (set_func (Hom(A,_) \<^bsub>\<a>\<^esub> f)) (Id A))
        x =
       restrict (set_func (u B)) (Hom A B) x


proof (prove)
using this:
  1 < card N
  p ^ a = card N * card (stabilizer m)

goal (1 subgoal):
 1. p dvd card N


proof (prove)
goal (1 subgoal):
 1. local.map f2 =
    A1_B.MkArr (\<lambda>f1. F (f1, A2.dom f2))
     (\<lambda>f1. F (f1, A2.cod f2)) (\<lambda>f1. F (f1, f2))


proof (prove)
goal (1 subgoal):
 1. N - (m - n) + m = N + n


proof (chain)
picking this:
  t \<subseteq> \<Union> E
  finite (\<Union> E)


proof (prove)
using this:
  f permutes carrier

goal (1 subgoal):
 1. inv f -` carrier = carrier


proof (prove)
goal (1 subgoal):
 1. \<exists>x.
       x \<in> {e. f e \<noteq> bot \<and> f e + bot = fe + bot} \<and>
       (\<forall>y.
           y \<in> {e. f e \<noteq> bot \<and>
                       f e + bot = fe + bot} \<longrightarrow>
           enum_lex_less_eq x y)


proof (prove)
using this:
  is \<lhd> dims A

goal (1 subgoal):
 1. lookup A is = a * prod_list (map2 (\<lambda>i B. lookup B [i]) is Bs)


proof (prove)
goal (1 subgoal):
 1. cinner (a / of_complex m) b = cinner a b / cnj m


proof (prove)
using this:
  replay' thy vs ns Hs P = Some res'
  beta_eta_norm res' = Some res
  thy,set Hs \<turnstile> res'

goal (1 subgoal):
 1. thy,set Hs \<turnstile> res


proof (prove)
using this:
  dom\<^bsub>C\<^esub> f = X
  LSCategory C
  f maps\<^bsub>C\<^esub> X to Y

goal (1 subgoal):
 1. Hom\<^bsub>C\<^esub>[\<midarrow>,dom\<^bsub>C\<^esub> f] = YFtor C @@ X


proof (prove)
goal (1 subgoal):
 1. bits_of k \<noteq> []


proof (prove)
goal (1 subgoal):
 1. \<forall>x\<in>carrier.
       \<exists>c1\<in>atlas.
          \<exists>c2\<in>manifold_eucl.atlas k.
             x \<in> domain c1 \<and>
             f ` domain c1 \<subseteq> domain c2 \<and>
             k-smooth_on (codomain c1)
              (apply_chart c2 \<circ> f \<circ> inv_chart c1)


proof (prove)
goal (1 subgoal):
 1. \<And>x y.
       \<lbrakk>lleq_charlist (Rep_fin_string x) (Rep_fin_string y);
        lleq_charlist (Rep_fin_string y) (Rep_fin_string x)\<rbrakk>
       \<Longrightarrow> x = y


proof (prove)
goal (1 subgoal):
 1. wf_J_prog P \<Longrightarrow> wwf_J_prog P


proof (prove)
using this:
  u' \<in> [?D]\<^bsub>v,n\<^esub> \<Longrightarrow>
  \<exists>D'.
     A \<turnstile> \<langle>l', ?D\<rangle> \<leadsto>*\<^bsub>v,n\<^esub> \<langle>l'', D'\<rangle> \<and>
     u'' \<in> [D']\<^bsub>v,n\<^esub>
  A \<turnstile> \<langle>l, D\<rangle> \<leadsto>\<^bsub>v,n\<^esub> \<langle>l', D'\<rangle>
  u' \<in> [D']\<^bsub>v,n\<^esub>

goal (1 subgoal):
 1. (\<And>D''.
        \<lbrakk>A \<turnstile> \<langle>l', D'\<rangle> \<leadsto>*\<^bsub>v,n\<^esub> \<langle>l'', D''\<rangle>;
         u'' \<in> [D'']\<^bsub>v,n\<^esub>\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (2 subgoals):
 1. F \<subseteq> E \<Longrightarrow>
    sym {(x, y) |x y.
         nodes_connected
          \<lparr>nodes = fst ` E \<union> (snd \<circ> snd) ` E,
             edges = F\<rparr>
          x y}
 2. F \<subseteq> E \<Longrightarrow>
    trans
     {(x, y) |x y.
      nodes_connected
       \<lparr>nodes = fst ` E \<union> (snd \<circ> snd) ` E,
          edges = F\<rparr>
       x y}


proof (prove)
goal (1 subgoal):
 1. F g S = F h T


proof (prove)
using this:
  a \<in> set_pmf M
  set_pmf (return_pmf x) = {x}

goal (1 subgoal):
 1. (x, a) \<in> set_pmf pq


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>length qs = length as; length as = n; dist_perm s s\<rbrakk>
    \<Longrightarrow> dist_perm (steps' s qs as n) (steps' s qs as n)


proof (prove)
goal (1 subgoal):
 1. \<turnstile> I \<and> \<box>[N]_f \<longrightarrow> \<box>P


proof (prove)
goal (1 subgoal):
 1. xs = ys


proof (prove)
goal (1 subgoal):
 1. s \<cdot> l\<^sup>\<infinity> \<cdot> b\<^sup>\<infinity> \<cdot>
    r\<^sup>\<infinity> \<cdot>
    q \<cdot>
    (a \<cdot> b\<^sup>\<infinity> \<cdot> r\<^sup>\<infinity> \<cdot>
     q)\<^sup>\<infinity>
    \<le> s \<cdot> l\<^sup>\<infinity> \<cdot> r\<^sup>\<infinity> \<cdot>
          (a \<cdot> b\<^sup>\<infinity> \<cdot> q \<cdot>
           r\<^sup>\<infinity>)\<^sup>\<infinity>


proof (prove)
goal (1 subgoal):
 1. map CAs0f [0..<n] \<cdot>\<cdot>cl map \<eta>s0f [0..<n] = CAs


proof (prove)
using this:
  {\<lambda>tp. tp = (Bk \<up> i, <args>)} p
  {\<lambda>tp. tp = (Bk \<up> m, Oc \<up> rs @ Bk \<up> k)}
  is_final (steps0 (Suc 0, Bk \<up> i, <args>) p n)
  (\<lambda>tp.
      tp =
      (Bk \<up> m,
       Oc \<up> rs @
       Bk \<up> k)) holds_for steps0 (Suc 0, Bk \<up> i, <args>) p n

goal (1 subgoal):
 1. \<exists>stp.
       steps0 (Suc 0, Bk \<up> i, <args>) p stp =
       (0, Bk \<up> m, Oc \<up> rs @ Bk \<up> k)


proof (prove)
goal (1 subgoal):
 1. gFreshGVar MOD \<Longrightarrow> igFreshIGVar (fromMOD MOD)


proof (prove)
using this:
  f ` (A - B)
  \<subseteq> {X. X \<subseteq> A \<and> finite X \<and> card X = k}
  infinite (f ` (A - B))

goal (1 subgoal):
 1. infinite {X. X \<subseteq> A \<and> finite X \<and> card X = k}


proof (state)
this:
  rho_bound2 (ICf i) \<and> rho_bound2 (ICf j)

goal (1 subgoal):
 1. \<bar>IC p i t - IC q j t\<bar>
    \<le> \<bar>IC p i s - IC q j s\<bar> + 2 * \<rho> * (t - s)


proof (prove)
goal (1 subgoal):
 1. bij G.face_cycle_succ


proof (prove)
goal (1 subgoal):
 1. finite (short_cycles G k)


proof (prove)
using this:
  domain.gallery (zx # ws @ [zy])
  x = f ` zx
  y = f ` zy
  domain.gallery (zx # ws @ [zy])

goal (1 subgoal):
 1. SimplicialComplex.maxsimpchain (f \<turnstile> X)
     (x # f \<Turnstile> ws @ [y])


proof (prove)
goal (1 subgoal):
 1. group.ord (Z (p ^ multiplicity p n))
     ((\<lambda>p\<in>prime_factors n. 1) p) =
    p ^ multiplicity p n


proof (prove)
goal (1 subgoal):
 1. distinct (insert_spec xs (oid, ref))


proof (prove)
using this:
  (remove_rels ts, m,
   \<S>) \<Rightarrow>\<^sub>v\<^sup>* (remove_rels ts', m', \<S>')

goal (1 subgoal):
 1. (remove_rels ts, m,
     \<S>) \<Rightarrow>\<^sub>v\<^sup>* (remove_rels ts', m', \<S>')


proof (prove)
using this:
  SN_on r A
  x \<in> A

goal (1 subgoal):
 1. x \<in> SN_part r


proof (prove)
goal (1 subgoal):
 1. nprv {eql (Num n) t, neg (eql t (Num n)), LLq (Num n) t}
     (dsj (LLq t (suc (Num n))) (LLq (suc (Num n)) t))


proof (prove)
goal (1 subgoal):
 1. signed_take_bit n k = concat_bit n k (- of_bool (bit k n))


proof (state)
this:
  timpls_transformable_to_pred A (Fun f T) s

goal (1 subgoal):
 1. \<And>x.
       x \<in> {s. timpls_transformable_to_pred A (Fun f T)
                    s} \<Longrightarrow>
       x \<in> Fun f `
               {S. length T = length S \<and>
                   (\<forall>s\<in>set S.
                       \<exists>t\<in>set T.
                          timpls_transformable_to_pred A t s)}


proof (prove)
using this:
  i \<in> Basis

goal (1 subgoal):
 1. \<And>z b.
       \<lbrakk>z \<in> C; b = z * e / (2 * real DIM('a))\<rbrakk>
       \<Longrightarrow> i \<bullet> x \<le> b \<and>
                         i \<bullet> y \<le> b \<or>
                         b \<le> i \<bullet> x \<and> b \<le> i \<bullet> y


proof (prove)
goal (1 subgoal):
 1. Ifm vs (x # bs) (subst0 t p) = Ifm vs (Itm vs (x # bs) t # bs) p


proof (prove)
using this:
  order.pseudominimal_in (Pow A) x
  order.pseudominimal_in ?P ?x \<Longrightarrow> ?x \<noteq> order.bottom ?P
  order.bottom (Pow A) = {}

goal (1 subgoal):
 1. (\<And>a.
        order.greater_eq x {a} \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  Y = lang_rhs (Arden Y yrhs)
  finite (ES \<union> {(Y, yrhs)}) \<and>
  (\<forall>X rhs.
      (X, rhs) \<in> ES \<union> {(Y, yrhs)} \<longrightarrow>
      finite rhs) \<and>
  (\<forall>(X, rhs)\<in>ES \<union> {(Y, yrhs)}. X = lang_rhs rhs) \<and>
  distinctness (ES \<union> {(Y, yrhs)}) \<and>
  ardenable_all (ES \<union> {(Y, yrhs)}) \<and>
  validity (ES \<union> {(Y, yrhs)})

goal (1 subgoal):
 1. \<forall>(X, rhs)
             \<in>{(Ya, Subst yrhsa Y (Arden Y yrhs)) |Ya yrhsa.
                   (Ya, yrhsa) \<in> ES}.
       X = lang_rhs rhs


proof (prove)
goal (1 subgoal):
 1. (set xs = set ys) =
    ((\<forall>x\<in>set xs. x \<in> set ys) \<and>
     (\<forall>y\<in>set ys. y \<in> set xs))


proof (prove)
using this:
  (\<not> (?p \<and>* ?pa) ?a \<or>
   ?p (aaa ?p ?pb) \<or> (?pb \<and>* ?pa) ?a) \<and>
  (\<not> ?pb (aaa ?p ?pb) \<or>
   \<not> (?p \<and>* ?pc) ?aa \<or> (?pb \<and>* ?pc) ?aa)

goal (1 subgoal):
 1. \<exists>p. ((\<lambda>a. a = (0::'a)) \<and>* p) aa


proof (prove)
goal (1 subgoal):
 1. \<And>x y.
       (x, y) \<in> rel_nabla_bin X Q \<Longrightarrow>
       \<exists>y.
          y = x \<and>
          (x, x) \<in> rel_nabla_bin X Q \<and>
          (\<forall>y. (x, y) \<notin> relfdia (X\<^sup>*) Q) \<or>
          (x, y) \<in> relfdia (X\<^sup>*) Q


proof (prove)
using this:
  Fun f ts \<rhd> s

goal (1 subgoal):
 1. (\<And>t.
        \<lbrakk>t \<in> set ts; t \<unrhd> s\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. j \<le> f i


proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. sum f (x \<inter> A)) \<longlongrightarrow> limA)
     (finite_subsets_at_top B)


proof (prove)
goal (1 subgoal):
 1. simplicial_chain p (standard_simplex (Suc p))
     (chain_boundary (Suc p)
       (frag_of (restrict id (standard_simplex (Suc p)))))


proof (prove)
using this:
  (case c1 (f y) (f z) of Eq \<Rightarrow> c2 (g y) (g z)
   | Lt \<Rightarrow> Lt | Gt \<Rightarrow> Gt) =
  Lt

goal (1 subgoal):
 1. c1 (f y) (f z) = Lt \<or> c1 (f y) (f z) = Eq \<and> c2 (g y) (g z) = Lt


proof (prove)
goal (19 subgoals):
 1. \<And>G c.
       \<lbrakk>(G, c, HighSec) \<in> Deriv; G \<rhd> c : HighSec\<rbrakk>
       \<Longrightarrow> G \<rhd> c : Sec
 (\<lambda>(s, t, \<beta>). s \<equiv>\<^sub>\<beta> t)
 2. \<And>G.
       G \<rhd> Skip : Sec (\<lambda>(s, t, \<beta>).
                               s \<equiv>\<^sub>\<beta> t)
 3. \<And>e G x.
       Expr_low e \<Longrightarrow>
       G \<rhd> Assign x
                 e : Sec (\<lambda>(s, t, \<beta>).
                             \<exists>r.
                                s =
                                (update (fst r) x (evalE e (fst r)),
                                 snd r) \<and>
                                r \<equiv>\<^sub>\<beta> t)
 4. \<And>G c1 \<Phi> c2 \<Psi>.
       \<lbrakk>(G, c1, Sec \<Phi>) \<in> Deriv; G \<rhd> c1 : Sec \<Phi>;
        (G, c2, Sec \<Psi>) \<in> Deriv; G \<rhd> c2 : Sec \<Psi>\<rbrakk>
       \<Longrightarrow> G \<rhd> Comp c1
                                   c2 : Sec
   (\<lambda>(s, t, \<beta>).
       \<exists>r.
          \<Phi> (r, t, \<beta>) \<and>
          (\<forall>w \<gamma>.
              r \<equiv>\<^sub>\<gamma> w \<longrightarrow>
              \<Psi> (s, w, \<gamma>)))
 5. \<And>b G c1 \<Phi> c2 \<Psi>.
       \<lbrakk>BExpr_low b; (G, c1, Sec \<Phi>) \<in> Deriv;
        G \<rhd> c1 : Sec \<Phi>; (G, c2, Sec \<Psi>) \<in> Deriv;
        G \<rhd> c2 : Sec \<Psi>\<rbrakk>
       \<Longrightarrow> G \<rhd> Iff b c1
                                   c2 : Sec
   (\<lambda>(s, t, \<beta>).
       (evalB b (fst t) \<longrightarrow> \<Phi> (s, t, \<beta>)) \<and>
       (\<not> evalB b (fst t) \<longrightarrow> \<Psi> (s, t, \<beta>)))
 6. \<And>x G C.
       CONTEXT x = low \<Longrightarrow>
       G \<rhd> New x
                 C : Sec (\<lambda>(s, t, \<beta>).
                             \<exists>l r.
                                l \<notin> Dom (snd r) \<and>
                                r \<equiv>\<^sub>\<beta> t \<and>
                                s =
                                (update (fst r) x (RVal (Loc l)),
                                 (l, C, []) # snd r))
 7. \<And>y f G x.
       \<lbrakk>CONTEXT y = low; GAMMA f = low\<rbrakk>
       \<Longrightarrow> G \<rhd> Get x y
                                   f : Sec
  (\<lambda>(s, t, \<beta>).
      \<exists>r l C Flds v.
         fst r y = RVal (Loc l) \<and>
         lookup (snd r) l = Some (C, Flds) \<and>
         lookup Flds f = Some v \<and>
         r \<equiv>\<^sub>\<beta> t \<and> s = (update (fst r) x v, snd r))
 8. \<And>x f e G.
       \<lbrakk>CONTEXT x = low; GAMMA f = low; Expr_low e\<rbrakk>
       \<Longrightarrow> G \<rhd> Put x f
                                   e : Sec
  (\<lambda>(s, t, \<beta>).
      \<exists>r l C F h.
         fst r x = RVal (Loc l) \<and>
         r \<equiv>\<^sub>\<beta> t \<and>
         lookup (snd r) l = Some (C, F) \<and>
         h = (l, C, (f, evalE e (fst r)) # F) # snd r \<and> s = (fst r, h))
 9. \<And>b G c \<Phi>.
       \<lbrakk>BExpr_low b; (G, c, Sec \<Phi>) \<in> Deriv;
        G \<rhd> c : Sec \<Phi>\<rbrakk>
       \<Longrightarrow> G \<rhd> While b c : Sec (PhiWhile b \<Phi>)
 10. \<And>\<phi> G.
        \<lbrakk>({Sec (FIX \<phi>)} \<union> G, body,
                  Sec (\<phi> (FIX \<phi>)))
                 \<in> Deriv;
         ({Sec (FIX \<phi>)} \<union>
          G) \<rhd> body : Sec (\<phi> (FIX \<phi>));
         Monotone \<phi>\<rbrakk>
        \<Longrightarrow> G \<rhd> Call : Sec (FIX \<phi>)
A total of 19 subgoals...


proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. f (g x)) -` Y \<inter> space N \<in> sets N


proof (prove)
goal (1 subgoal):
 1. igSwapIPresIGWlsSTR MOD \<Longrightarrow> igSwapInpIPresIGWlsInpSTR MOD


proof (prove)
using this:
  x + y + z = 1
  x\<^sup>2 + y\<^sup>2 + z\<^sup>2 = 2
  x ^ 3 + y ^ 3 + z ^ 3 = 3

goal (1 subgoal):
 1. power_sum_puzzle_example x y z


proof (prove)
goal (1 subgoal):
 1. l_new_character_data_get_disconnected_nodes get_disconnected_nodes_locs


proof (prove)
using this:
  \<lbrakk>D.arr ?f; D.cod ?f = ?b\<rbrakk>
  \<Longrightarrow> ?b \<cdot>\<^sub>D ?f = ?f
  C.ide ?f \<Longrightarrow> C.iso \<r>\<^sub>C[?f]
  C.ide ?f \<Longrightarrow> C.iso \<l>\<^sub>C[?f]
  C.iso ?f \<Longrightarrow> D.iso (F ?f)
  D.iso ?f \<Longrightarrow> ?f \<cdot>\<^sub>D D.inv ?f = D.cod ?f
  C.iso ?f \<Longrightarrow> F (C.inv ?f) = D.inv (F ?f)

goal (1 subgoal):
 1. \<l>\<^sub>D\<^sup>-\<^sup>1[F f] \<cdot>\<^sub>D
    ((F \<l>\<^sub>C[f] \<cdot>\<^sub>D
      F \<l>\<^sub>C\<^sup>-\<^sup>1[f]) \<cdot>\<^sub>D
     F \<r>\<^sub>C[f] \<cdot>\<^sub>D
     D.inv (F \<r>\<^sub>C[f])) \<cdot>\<^sub>D
    \<r>\<^sub>D[F f] =
    \<l>\<^sub>D\<^sup>-\<^sup>1[F f] \<cdot>\<^sub>D \<r>\<^sub>D[F f]


proof (prove)
goal (1 subgoal):
 1. vectorspace.dim class_ring (vs (subspace_sum W1 W2))
    \<le> vectorspace.dim class_ring (vs (local.span (set (cols A)))) +
          vectorspace.dim class_ring (vs (local.span (set (cols B))))


proof (prove)
goal (1 subgoal):
 1. space
     (uniform_measure lborel {0..1} \<Otimes>\<^sub>M
      Pi\<^sub>M (set xs)
       (\<lambda>x. uniform_measure lborel {0..1})) \<noteq>
    {}


proof (prove)
using this:
  \<lbrakk>\<And>xa y.
              xa \<le> y \<Longrightarrow>
              xa + \<bar>a * (x - x')\<bar>
              \<le> y + \<bar>a * (x - x')\<bar>;
   \<And>x y. x \<le> y \<Longrightarrow> d + x \<le> d + y\<rbrakk>
  \<Longrightarrow> \<bar>f x - b -
                          (a * fst (fst X) +
                           a * pdevs_val e (snd (fst X)))\<bar>
                    \<le> d + truncate_up p (\<bar>a\<bar> * snd X)

goal (1 subgoal):
 1. \<bar>f x - b - (a * fst (fst X) + a * pdevs_val e (snd (fst X)))\<bar>
    \<le> truncate_up p (\<bar>a\<bar> * snd X) + d


proof (prove)
using this:
  t \<in> SPR.jkbpC

goal (1 subgoal):
 1. set (jAction (spr_simMCt t) (spr_sim t) agent) =
    set (jAction spr_simMC (spr_sim t) agent)


proof (prove)
using this:
  b \<in> set as
  a = hd_coeff1 (zlcms (map hd_coeff as)) b

goal (1 subgoal):
 1. hd_coeff b \<noteq> 0 &&& divisor b \<noteq> 0


proof (prove)
goal (1 subgoal):
 1. hn_refine (hn_ctxt Rx ax px * F) (heap.fixp_fun cB px) (F' ax px) Ry
     (REC\<^sub>T aB ax)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>ys.
                length xs = length ys \<Longrightarrow>
                vec_of_list xs \<bullet> vec_of_list ys =
                sum_list (map2 (*) xs ys);
     Suc (length xs) = length ys\<rbrakk>
    \<Longrightarrow> vCons a (vec_of_list xs) \<bullet> vec_of_list ys =
                      sum_list (map2 (*) (a # xs) ys)


proof (prove)
using this:
  x = lincomb a (A \<inter> U \<union> (A \<inter> W - U))

goal (1 subgoal):
 1. x =
    lincomb a (A \<inter> U) \<oplus>\<^bsub>V\<^esub>
    lincomb a (A \<inter> W - U)


proof (chain)
picking this:
  mds\<^sub>C' = mds\<^sub>C
  (m := {y \<in> mds\<^sub>C m. y \<noteq> Eg2_var\<^sub>C_of_Eg1 x})


proof (prove)
goal (1 subgoal):
 1. \<not> A D C CongA A C D


proof (prove)
using this:
  enat i < llength Ns \<Longrightarrow> lhd Ns \<Turnstile> lnth Ns i
  enat (Suc i) < llength Ns
  (enat (Suc ?m) \<le> ?n) = (enat ?m < ?n)
  chain (\<Turnstile>) Ns
  \<lbrakk>chain ?R ?xs; enat (Suc ?j) < llength ?xs\<rbrakk>
  \<Longrightarrow> ?R (lnth ?xs ?j) (lnth ?xs (Suc ?j))
  \<lbrakk>?N1.0 \<Turnstile> ?N2.0; ?N2.0 \<Turnstile> ?N3.0\<rbrakk>
  \<Longrightarrow> ?N1.0 \<Turnstile> ?N3.0
  (?x < ?y) = (?x \<le> ?y \<and> ?x \<noteq> ?y)

goal (1 subgoal):
 1. lhd Ns \<Turnstile> lnth Ns (Suc i)


proof (prove)
goal (2 subgoals):
 1. rat_poly_inv (rat_poly_times B (rat_poly_times B B)) =
    rat_poly_inv (rat_poly_times A (rat_poly_times B A)) -
    rat_poly_times B
     (rat_poly_times (B - rat_poly_times (rat_poly_times A A) A) B)
 2. rat_poly_inv (rat_poly_times A (rat_poly_times B A)) -
    rat_poly_times B
     (rat_poly_times (B - rat_poly_times (rat_poly_times A A) A) B) =
    rat_poly_inv (rat_poly_times B (rat_poly_times B B))


proof (prove)
goal (1 subgoal):
 1. poly (of_nat n) x = of_nat n


proof (prove)
goal (1 subgoal):
 1. (\<exists>x.
        \<forall>(a, b, c)\<in>set les. a * x\<^sup>2 + b * x + c < 0) =
    ((\<forall>(a, b, c)\<in>set les.
         \<exists>x. \<forall>y<x. a * y\<^sup>2 + b * y + c < 0) \<or>
     (\<exists>(a', b', c')\<in>set les.
         a' = 0 \<and>
         b' \<noteq> 0 \<and>
         (\<forall>(d, e, f)\<in>set les.
             \<exists>y'>- (c' / b').
                \<forall>x\<in>{- (c' / b')<..y'}.
                   d * x\<^sup>2 + e * x + f < 0) \<or>
         a' \<noteq> 0 \<and>
         4 * a' * c' \<le> b'\<^sup>2 \<and>
         ((\<forall>(d, e, f)\<in>set les.
              \<exists>y'>(sqrt (b'\<^sup>2 - 4 * a' * c') - b') / (2 * a').
                 \<forall>x\<in>{(sqrt (b'\<^sup>2 - 4 * a' * c') - b') /
                                 (2 * a')<..y'}.
                    d * x\<^sup>2 + e * x + f < 0) \<or>
          (\<forall>(d, e, f)\<in>set les.
              \<exists>y'>(- b' - sqrt (b'\<^sup>2 - 4 * a' * c')) /
                          (2 * a').
                 \<forall>x\<in>{(- b' - sqrt (b'\<^sup>2 - 4 * a' * c')) /
                                 (2 * a')<..y'}.
                    d * x\<^sup>2 + e * x + f < 0))))


proof (prove)
goal (1 subgoal):
 1. {k. k \<le> n \<and> \<not> cycle_free_up_to m k n} \<noteq> {}


proof (prove)
using this:
  0 \<le> k
  0 \<le> 1 - k

goal (1 subgoal):
 1. \<guillemotleft> \<N> G \<guillemotright> s +
    \<guillemotleft> G \<guillemotright> s *
    (wp body
      (\<lambda>s. \<guillemotleft> \<N> G \<guillemotright> s * (1 - k))
      s +
     wp body (\<lambda>s. k) s)
    \<le> \<guillemotleft> \<N> G \<guillemotright> s +
          \<guillemotleft> G \<guillemotright> s *
          wp body
           (\<lambda>s.
               \<guillemotleft> \<N> G \<guillemotright> s * (1 - k) + k)
           s


proof (prove)
goal (1 subgoal):
 1. \<exists>s. snd d = Fun (Set s) []


proof (prove)
goal (1 subgoal):
 1. \<And>x xa y.
       \<lbrakk>Wellfounded.accp (step1 r) x;
        \<And>y.
           step1 r y x \<Longrightarrow> listsp (Wellfounded.accp r) y;
        xa \<in> set x; r y xa\<rbrakk>
       \<Longrightarrow> Wellfounded.accp r y


proof (prove)
goal (1 subgoal):
 1. CFG_SSA_Transformed (\<lambda>_. gen_wf_\<alpha>e gen_cfg_wf)
     (\<lambda>_. gen_wf_\<alpha>n gen_cfg_wf) (\<lambda>_. True)
     (\<lambda>_. gen_wf_inEdges' gen_cfg_wf)
     (\<lambda>_. gen_wf_Entry gen_cfg_wf)
     (\<lambda>_. gen_wf_defs gen_cfg_wf)
     (\<lambda>_. gen_wf_uses gen_cfg_wf)
     (\<lambda>_. gen_wf_defs' gen_cfg_wf)
     (\<lambda>_. gen_wf.uses' gen_cfg_wf)
     (\<lambda>_. gen_wf.phis' gen_cfg_wf)
     (\<lambda>_. gen_wf_var gen_cfg_wf)


proof (prove)
goal (1 subgoal):
 1. deterministic_RP St0 \<noteq> None


proof (prove)
goal (1 subgoal):
 1. lmap fst
     (lproject {(x, y). y \<in> s} (w \<bar>\<bar> iterates Suc 0)) =
    lmap fst (lproject (UNIV \<times> s) (w \<bar>\<bar> iterates Suc 0))


proof (prove)
goal (1 subgoal):
 1. set (Cubic_Polynomials.croots3 p) = {x. poly p x = 0}


proof (prove)
using this:
  antisym (set l) \<Longrightarrow> exe_antisym l
  antisym (set (a # l))

goal (1 subgoal):
 1. exe_antisym (a # l)


proof (prove)
using this:
  \<Gamma> \<turnstile> Var x : T

goal (1 subgoal):
 1. (x, T) \<in> set \<Gamma>


proof (prove)
using this:
  v \<in> elts y'
  u \<in> elts (TC v)

goal (1 subgoal):
 1. (u, y') \<in> VWO


proof (prove)
using this:
  \<lbrakk>(?y, x) \<in> r; ?y \<in> A\<rbrakk>
  \<Longrightarrow> ordermap (\<pi> ` A) s (\<pi> ?y) = ordermap A r ?y
  x \<in> A

goal (1 subgoal):
 1. ordermap (\<pi> ` A) s (\<pi> x) = ordermap A r x


proof (prove)
goal (1 subgoal):
 1. \<integral>\<^sup>+ x. emeasure
                            (K.lim_stream x \<bind>
                             (\<lambda>\<omega>.
                                 K.lim_stream
                                  (j, trace_at s (x ## \<omega>) j) \<bind>
                                 (\<lambda>\<omega>'.
                                     return (stream_space S)
(merge_at (x ## \<omega>) j \<omega>'))))
                            A *
                           indicator {j<..} (fst x)
                       \<partial>K (t, s) =
    \<integral>\<^sup>+ x. emeasure (K.lim_stream (j, s)) A *
                           indicator {j<..} (fst x)
                       \<partial>K (t, s)


proof (prove)
goal (1 subgoal):
 1. \<And>S. open S \<Longrightarrow> open ((\<lambda>x. c * x + b) ` S)


proof (prove)
using this:
  FW M n 0 (v c) = len M 0 (v c) xs
  set xs \<subseteq> {0..n}
  0 \<notin> set xs
  v c \<notin> set xs
  distinct xs
  \<forall>k\<le>n. 0 < k \<longrightarrow> (\<exists>c. v c = k)
  v c \<le> n

goal (1 subgoal):
 1. dbm_entry_val u None (Some c) (len M 0 (v c) xs)


proof (prove)
goal (1 subgoal):
 1. components g * e\<^sup>T * top
    \<le> forest_components v * e\<^sup>T * top


proof (prove)
using this:
  y = BRANCH c rs

goal (1 subgoal):
 1. thesis


proof (prove)
using this:
  S t i \<turnstile> t ! i \<mapsto> S t (i + 1)

goal (1 subgoal):
 1. snd (cs (S t (i + 1)) cid) = Done


proof (prove)
goal (1 subgoal):
 1. X \<approx>\<^sub>L Y


proof (prove)
goal (1 subgoal):
 1. insertion (nth_default 0 (init @ xs)) p =
    insertion (nth_default 0 (init @ I @ xs))
     (liftPoly (length init) (length I) p)


proof (state)
this:
  [i..<j] = i # [Suc i..<j]

goal (1 subgoal):
 1. j \<noteq> i \<Longrightarrow>
    \<exists>h'. effect (for [i..<j] f) h h' () \<and> I j h'


proof (prove)
using this:
  inj_on Xd Y
  cop ds = Pds'.cop ds
  Pds'.stable_on ds (Pds'.cop ds)
  d \<notin> ds'
  x \<in> Pds'.cop ds

goal (1 subgoal):
 1. x \<in> Pdds'.CD_on ds (Pds'.cop ds)


proof (prove)
goal (2 subgoals):
 1. \<And>m::nat.
       (0::nat) < m \<Longrightarrow>
       \<exists>j>i. f (j - i) \<sqsubseteq> f m
 2. \<Sqinter> (f ` {k::nat. (0::nat) < k}) \<sqsubseteq>
    (\<Sqinter>j::nat\<in>{j::nat. i < j}. f (j - i))
variables:
  f :: nat \<Rightarrow> 'a
  i :: nat
type variables:
  'a :: refinement_lattice


proof (prove)
using this:
  T x \<in> space M
  A \<in> sets (M \<Otimes>\<^sub>M N)

goal (1 subgoal):
 1. (\<lambda>y. indicator A (T x, y)) \<in> borel_measurable N


proof (prove)
goal (1 subgoal):
 1. local.gen_llength_cons' n s =
    (case lgenerator g s of Done \<Rightarrow> n
     | Skip s' \<Rightarrow> local.gen_llength_cons' n s'
     | Yield x s' \<Rightarrow> local.gen_llength_cons' (eSuc n) s')


proof (state)
goal (1 subgoal):
 1. \<exists>E F \<gamma>1 \<gamma>2 L'.
       D = E @ F \<and>
       \<gamma> = \<gamma>1 @ \<gamma>2 \<and>
       LeftDerivationLadder \<alpha> E L' \<gamma>1 \<and>
       derivation_ge F (length \<gamma>1) \<and>
       LeftDerivation \<delta> (derivation_shift F (length \<gamma>1) 0)
        \<gamma>2 \<and>
       length L' = length L \<and>
       ladder_i L' 0 = ladder_i L 0 \<and>
       ladder_last_j L' = ladder_last_j L


proof (prove)
using this:
  (\<Squnion>n. F n x) = (\<Squnion>n. f x \<sqinter> of_nat n)

goal (1 subgoal):
 1. (\<Squnion>n. F n x) = f x


proof (prove)
using this:
  local.inv C R \<and> \<not> R \<noteq> {}
  sc C U

goal (1 subgoal):
 1. sc C U \<and>
    (\<forall>C'.
        sc C' U \<longrightarrow> sum w C \<le> harm d\<^sup>* * sum w C')


proof (prove)
goal (1 subgoal):
 1. valid_ownership \<S> (t # ts) \<Longrightarrow> valid_ownership \<S> ts


proof (prove)
goal (1 subgoal):
 1. list_of_oalist_tc (OAlist_tc_update_by_fun k f xs) =
    update_by_fun_pair_tc k f (list_of_oalist_tc xs)


proof (prove)
goal (1 subgoal):
 1. Span.dom (\<Phi>.map (f, g) \<circ> SPN h) =
    Span.dom (\<Phi>.map (f, g)) \<circ> Span.dom (SPN h)


proof (state)
this:
  \<ominus>\<^bsub>P\<^esub> b = \<ominus> \<one> \<odot>\<^bsub>P\<^esub> b

goal (1 subgoal):
 1. pderiv (a \<ominus>\<^bsub>P\<^esub> b) =
    pderiv a \<ominus>\<^bsub>P\<^esub> pderiv b


proof (prove)
using this:
  \<guillemotleft>f : x \<rightarrow>\<^sub>A x'\<guillemotright>
  \<guillemotleft>g : y' \<rightarrow>\<^sub>B y\<guillemotright>
  \<guillemotleft>h : F y \<rightarrow>\<^sub>A x\<guillemotright>
  B.arr ?y \<Longrightarrow> G (F ?y) = ?y
  A.arr ?x \<Longrightarrow> F (G ?x) = ?x
  G \<circ> F = B.map
  F \<circ> G = A.map
  A.map ?f = (if A.arr ?f then ?f else A.null)
  B.map ?f = (if B.arr ?f then ?f else B.null)

goal (1 subgoal):
 1. G (C f (C h (F g))) = D (G f) (D (G h) g)


proof (prove)
using this:
  e \<in> b
  \<Gamma>\<turnstile> \<langle>c,Normal e\<rangle> \<Rightarrow> Abrupt u

goal (1 subgoal):
 1. \<Gamma>\<turnstile> \<langle>While b
                                   c,Normal
e\<rangle> \<Rightarrow> Abrupt u


proof (prove)
goal (1 subgoal):
 1. map_indets g \<circ> map_indets f = id


proof (prove)
using this:
  l = l1 @ x # l2
  l1 = l1' @ y # c
  l2' = c @ x # l2

goal (1 subgoal):
 1. l = l1' @ y # c @ x # l2


proof (prove)
using this:
  disjoint_family F
  emeasure lborel (\<Union>x. F x \<inter> box a b)
  \<le> emeasure lborel (box a b)

goal (1 subgoal):
 1. (\<lambda>i. content (F i \<inter> box a b)) sums
    content (\<Union>x. F x \<inter> box a b)


proof (prove)
goal (1 subgoal):
 1. \<And>x y z.
       \<lbrakk>x \<in> carrier rec_monoid_rng_of_frac;
        y \<in> carrier rec_monoid_rng_of_frac;
        z \<in> carrier rec_monoid_rng_of_frac\<rbrakk>
       \<Longrightarrow> x \<otimes>\<^bsub>rec_monoid_rng_of_frac\<^esub>
                         y \<otimes>\<^bsub>rec_monoid_rng_of_frac\<^esub>
                         z =
                         x \<otimes>\<^bsub>rec_monoid_rng_of_frac\<^esub>
                         (y \<otimes>\<^bsub>rec_monoid_rng_of_frac\<^esub>
                          z)


proof (prove)
goal (3 subgoals):
 1. \<lbrakk>Mapping.lookup
              (fst (foldr (aux_2 g) ns (Mapping.empty, Mapping.empty))) n =
             None;
     finite
      (Mapping.keys
        (snd (foldr (aux_2 g) ns (Mapping.empty, Mapping.empty))));
     \<And>n v.
        (n, v)
        \<in> Mapping.keys
               (snd (foldr (aux_2 g) ns
                      (Mapping.empty, Mapping.empty))) \<Longrightarrow>
        length (predecessors g n) \<noteq> 1;
     \<And>v.
        Mapping.lookup
         (snd (foldr (aux_2 g) ns (Mapping.empty, Mapping.empty)))
         (Entry g, v)
        \<in> {None, Some []}\<rbrakk>
    \<Longrightarrow> lookupDef g n ` uses g n = lookup_multimap u' n
 2. \<And>m.
       \<lbrakk>m \<noteq> n;
        Mapping.lookup
         (fst (foldr (aux_2 g) ns (Mapping.empty, Mapping.empty))) n =
        None;
        finite
         (Mapping.keys
           (snd (foldr (aux_2 g) ns (Mapping.empty, Mapping.empty))));
        \<And>n v.
           (n, v)
           \<in> Mapping.keys
                  (snd (foldr (aux_2 g) ns
                         (Mapping.empty, Mapping.empty))) \<Longrightarrow>
           length (predecessors g n) \<noteq> 1;
        \<And>v.
           Mapping.lookup
            (snd (foldr (aux_2 g) ns (Mapping.empty, Mapping.empty)))
            (Entry g, v)
           \<in> {None, Some []}\<rbrakk>
       \<Longrightarrow> Mapping.lookup u' m =
                         Mapping.lookup
                          (fst (foldr (aux_2 g) ns
                                 (Mapping.empty, Mapping.empty)))
                          m
 3. \<And>m v.
       \<lbrakk>Mapping.lookup
                 (fst (foldr (aux_2 g) ns (Mapping.empty, Mapping.empty)))
                 n =
                None;
        finite
         (Mapping.keys
           (snd (foldr (aux_2 g) ns (Mapping.empty, Mapping.empty))));
        \<And>n v.
           (n, v)
           \<in> Mapping.keys
                  (snd (foldr (aux_2 g) ns
                         (Mapping.empty, Mapping.empty))) \<Longrightarrow>
           length (predecessors g n) \<noteq> 1;
        \<And>v.
           Mapping.lookup
            (snd (foldr (aux_2 g) ns (Mapping.empty, Mapping.empty)))
            (Entry g, v)
           \<in> {None, Some []}\<rbrakk>
       \<Longrightarrow> (if m \<in> phiDefNodes_aux g v
(filter
  (\<lambda>n.
      (n, v)
      \<notin> Mapping.keys
                (snd (foldr (aux_2 g) ns (Mapping.empty, Mapping.empty))))
  (\<alpha>n g))
n \<and>
                             v \<in> uses g n
                          then Some
                                (map (\<lambda>m. lookupDef g m v)
                                  (predecessors g m))
                          else Mapping.lookup
                                (snd (foldr (aux_2 g) ns
 (Mapping.empty, Mapping.empty)))
                                (m, v)) =
                         Mapping.lookup p' (m, v)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>bounded_clinear A; A (1::'a) = (0::'b)\<rbrakk>
    \<Longrightarrow> A = (\<lambda>_. 0::'b)


proof (prove)
using this:
  init_config c

goal (1 subgoal):
 1. inv_implications_nonneg c


proof (prove)
goal (1 subgoal):
 1. open X \<Longrightarrow>
    open X \<and> X = X \<inter> Collect (Domainp (pcr_nonzero (=)))


proof (prove)
using this:
  intra_kind (kind a')
  upd_rev_cs cs (a # as') = upd_rev_cs cs as'

goal (1 subgoal):
 1. upd_rev_cs cs ((a # as') @ [a']) = upd_rev_cs cs (as' @ [a'])


proof (prove)
goal (1 subgoal):
 1. (\<smile> \<circ> f = g) = (\<smile> \<circ> g = f)


proof (prove)
goal (1 subgoal):
 1. \<forall>n.
       (u n = - 1 \<longrightarrow> z n) \<and>
       (u n = 1 \<longrightarrow> \<not> z n) \<and>
       - 1 \<le> u n \<and> u n \<le> 1


proof (prove)
using this:
  \<I> \<turnstile>g gpv' \<surd> \<Longrightarrow>
  expectation_gpv fail \<I> (\<lambda>_. c) gpv' \<le> max c fail
  fail \<le> c
  expectation_gpv' gpv' \<le> expectation_gpv fail \<I> (\<lambda>a. c) gpv'
  \<I> \<turnstile>g gpv' \<surd>

goal (1 subgoal):
 1. expectation_gpv' gpv' \<le> c


proof (prove)
goal (1 subgoal):
 1. length (map tpOf (map Var (getVars \<sigma>l))) =
    length \<sigma>l \<and>
    (\<forall>i<length (map tpOf (map Var (getVars \<sigma>l))).
        map tpOf (map Var (getVars \<sigma>l)) ! i = \<sigma>l ! i)


proof (prove)
using this:
  \<Gamma>\<turnstile> \<langle>sequence Seq
                                 ((x # xs) @
                                  ys),Normal s\<rangle> =n\<Rightarrow> t
  xs = []

goal (1 subgoal):
 1. \<exists>s'.
       \<Gamma>\<turnstile> \<langle>sequence Seq
(x # xs),Normal s\<rangle> =n\<Rightarrow> s' \<and>
       \<Gamma>\<turnstile> \<langle>sequence Seq
ys,s'\<rangle> =n\<Rightarrow> t


proof (prove)
using this:
  sub P =
  ksrp
   (\<sigma>\<^bsub>sKs p\<^esub>t \<langle>sKs
       p \<rightarrow> t\<rangle>\<^bsub>n\<^sub>r\<^esub>)
  \<parallel>sKs p\<parallel>\<^bsub>t
\<langle>sKs p \<rightarrow> t\<rangle>\<^bsub>n\<^sub>r\<^esub>\<^esub>

goal (1 subgoal):
 1. sub P
    \<in> bbrp
           (\<sigma>\<^bsub>the_bb\<^esub>t
     \<langle>sKs p \<rightarrow> t\<rangle>\<^bsub>n\<^sub>r\<^esub>)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x - y\<rbrakk>\<^sub>Q =
    \<lbrakk>x\<rbrakk>\<^sub>Q - \<lbrakk>y\<rbrakk>\<^sub>Q


proof (prove)
using this:
  finite A
  a \<notin> A
  \<lbrakk>c \<in> carrier R; g \<in> A \<rightarrow> carrier M\<rbrakk>
  \<Longrightarrow> c \<odot>\<^bsub>M\<^esub> finsum M g A =
                    (\<Oplus>\<^bsub>M\<^esub>x\<in>A. c \<odot>\<^bsub>M\<^esub>
                 g x)
  c \<in> carrier R
  g \<in> insert a A \<rightarrow> carrier M

goal (1 subgoal):
 1. c \<odot>\<^bsub>M\<^esub> finsum M g (insert a A) =
    (\<Oplus>\<^bsub>M\<^esub>x\<in>insert a
                                     A. c \<odot>\<^bsub>M\<^esub> g x)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_prefixes rtbl; has_default_route rtbl\<rbrakk>
    \<Longrightarrow> \<forall>p. rpf_loose rtbl p


proof (prove)
goal (1 subgoal):
 1. inj_comm_ring_hom (map_poly hom)


proof (prove)
using this:
  \<forall>q\<in>set qs. degree q = 0 \<Longrightarrow>
  consistent_sign_vectors qs UNIV =
  {map (\<lambda>x.
           if poly x 0 < 0 then - 1 else if poly x 0 = 0 then 0 else 1)
    qs}

goal (1 subgoal):
 1. set (find_consistent_signs qs) = consistent_sign_vectors qs UNIV


proof (prove)
using this:
  a \<in> arcs G
  a \<notin> {uv, rev_G uv}

goal (1 subgoal):
 1. edge_succ HM (rev_G a) = (edge_succ HM \<circ> rev_H) a


proof (prove)
using this:
  T \<in> Pow S
  ts \<in> lists T
  us \<in> ssubseqs ts
  S_reduced_for w us

goal (1 subgoal):
 1. word_length T w = S_length w


proof (prove)
using this:
  safe_reach_upto ?n safe_free_flowing (ts, m, \<S>)

goal (1 subgoal):
 1. safe_reach_upto k safe_free_flowing (ts, m, \<S>)


proof (prove)
using this:
  (?a, the_NF A ?a) \<in> A\<^sup>!
  (a, b) \<in> A

goal (1 subgoal):
 1. the_NF A a = the_NF A b


proof (prove)
using this:
  - real_of ?x = real_of (ma_uminus ?x)

goal (1 subgoal):
 1. - real_of_u r = real_of_u (mau_uminus r)


proof (prove)
goal (1 subgoal):
 1. inline callee (map_gpv f g gpv) s =
    map_gpv (map_prod f id) id (inline (\<lambda>s x. callee s (g x)) gpv s)


proof (prove)
goal (1 subgoal):
 1. (DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A \<sqsubseteq>\<^sub>F\<^sub>D
     DF A &&&
     DF A \<sqsubseteq>\<^sub>F\<^sub>D RUN A) &&&
    CHAOS A \<sqsubseteq>\<^sub>F\<^sub>D DF A &&&
    CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A \<sqsubseteq>\<^sub>F\<^sub>D
    CHAOS A &&&
    CHAOS\<^sub>S\<^sub>K\<^sub>I\<^sub>P A \<sqsubseteq>\<^sub>F\<^sub>D
    DF\<^sub>S\<^sub>K\<^sub>I\<^sub>P A


proof (prove)
using this:
  M 0 0 \<prec> Le 0
  i = 0
  dbm_int M n
  Le 0 \<prec> M 0 0

goal (1 subgoal):
 1. \<infinity> \<prec> Le 0


proof (prove)
goal (3 subgoals):
 1. (\<lambda>(x, y). Pxy (x, y) * log b (Pxy (x, y) / Py y))
    \<in> borel_measurable (S \<Otimes>\<^sub>M T)
 2. (\<lambda>x. Pxy x * log b (Pxy x) - Pxy x * log b (Py (snd x)))
    \<in> borel_measurable (S \<Otimes>\<^sub>M T)
 3. AE x in S \<Otimes>\<^sub>M
            T. (case x of
                (x, y) \<Rightarrow>
                  Pxy (x, y) * log b (Pxy (x, y) / Py y)) =
               Pxy x * log b (Pxy x) - Pxy x * log b (Py (snd x))


proof (prove)
using this:
  f ((0::'a) - of_nat 1) = f (0::'a)

goal (1 subgoal):
 1. f (- (1::'a)) = f (0::'a)


proof (prove)
goal (1 subgoal):
 1. (CDPlayer_CTRL_States, CDPlayer_CTRL_Init, CDPlayer_CTRL_Labels,
     CDPlayer_CTRL_Delta)
    \<in> seqauto


proof (prove)
goal (1 subgoal):
 1. deg_comp cmp (splus t u) (splus t v) = Lt


proof (prove)
goal (1 subgoal):
 1. \<And>l ta.
       \<lbrakk>lock_thread_ok ls ts; ts t = \<lfloor>xw\<rfloor>;
        thread_oks ts tas; has_lock (upd_locks (ls $ l) t (las $ l)) ta;
        ta \<noteq> t\<rbrakk>
       \<Longrightarrow> \<exists>xw.
                            redT_updTs ts tas ta = \<lfloor>xw\<rfloor>


proof (state)
this:
  a \<in> domain

goal (1 subgoal):
 1. a \<in> domain \<Longrightarrow>
    (SOME aa. \<lfloor>a\<rfloor> = \<lfloor>aa\<rfloor>) \<sim> a


proof (chain)
picking this:
  \<one> = \<one>\<^bsub>G\<lparr>carrier := H\<rparr>\<^esub>


proof (prove)
using this:
  \<lbrakk>?w \<in> W; ?s \<in> S\<rbrakk>
  \<Longrightarrow> dual_order.poset_simplex_map \<P>
                     (?w +o \<langle>{?s}\<rangle>) \<lhd>
                    dual_order.poset_simplex_map \<P> {?w}

goal (1 subgoal):
 1. \<lbrakk>w \<in> W; s \<in> S\<rbrakk>
    \<Longrightarrow> dual_order.poset_simplex_map \<P> {w, w + s} \<lhd>
                      dual_order.poset_simplex_map \<P> {w}


proof (prove)
using this:
  merges f qs ss ! q = [] \<Squnion>\<^bsub>f\<^esub> ss ! q

goal (1 subgoal):
 1. merges f qs ss ! q = ss ! q


proof (prove)
goal (1 subgoal):
 1. fx0.brent f x = ?code


proof (prove)
using this:
  ((bi_unique poly_rel \<and> right_total poly_rel) \<and>
   poly_rel (arith_ops_record.zero (poly_ops ops)) 0 \<and>
   poly_rel (arith_ops_record.one (poly_ops ops)) 1 \<and>
   (poly_rel ===> poly_rel ===> poly_rel)
    (arith_ops_record.plus (poly_ops ops)) (+)) \<and>
  ((poly_rel ===> poly_rel ===> poly_rel)
    (arith_ops_record.minus (poly_ops ops)) (-) \<and>
   (poly_rel ===> poly_rel) (arith_ops_record.uminus (poly_ops ops))
    uminus_class.uminus) \<and>
  (poly_rel ===> poly_rel ===> poly_rel)
   (arith_ops_record.times (poly_ops ops)) (*) \<and>
  (poly_rel ===> poly_rel ===> (=)) (=) (=) \<and>
  Domainp poly_rel = arith_ops_record.DP (poly_ops ops)

goal (1 subgoal):
 1. ((bi_unique poly_rel \<and> right_total poly_rel) \<and>
     poly_rel (arith_ops_record.zero (poly_ops ops)) 0 \<and>
     poly_rel (arith_ops_record.one (poly_ops ops)) 1 \<and>
     (poly_rel ===> poly_rel ===> poly_rel)
      (arith_ops_record.plus (poly_ops ops)) (+)) \<and>
    ((poly_rel ===> poly_rel ===> poly_rel)
      (arith_ops_record.minus (poly_ops ops)) (-) \<and>
     (poly_rel ===> poly_rel) (arith_ops_record.uminus (poly_ops ops))
      uminus_class.uminus) \<and>
    (poly_rel ===> poly_rel ===> poly_rel)
     (arith_ops_record.times (poly_ops ops)) (*) \<and>
    (poly_rel ===> poly_rel ===> (=)) (=) (=) \<and>
    Domainp poly_rel = arith_ops_record.DP (poly_ops ops)


proof (prove)
goal (1 subgoal):
 1. program_inv (fst (setUp ast))


proof (prove)
goal (1 subgoal):
 1. {0..Suc k} = insert (Suc k) {0..k} \<Longrightarrow> Suc k \<le> n


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sv \<in> atoms
                       (encode_operator_precondition
                         (\<phi> prob_with_noop abs_prob ) t op);
     t < h;
     op \<in> set ((\<phi> prob_with_noop abs_prob )\<^sub>\<O>)\<rbrakk>
    \<Longrightarrow> valid_state_var sv


proof (prove)
goal (1 subgoal):
 1. \<Sqinter> {n. P n x} = n


proof (prove)
goal (1 subgoal):
 1. arctan (sqrt (real_of_float y))
    \<in> {sqrt (real_of_float y) *
           real_of_float
            (lb_arctan_horner prec (get_even n) 1
              y)..sqrt (real_of_float y) *
                  real_of_float (ub_arctan_horner prec (get_odd n) 1 y)}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> carrier L; \<Sigma>1.\<Sigma>_protocol;
     (a, b) \<in> set_spmf (S1_raw x1 x); aa = x\<rbrakk>
    \<Longrightarrow> check1 x1 a x b


proof (prove)
using this:
  \<rho>
  \<in> \<lbrakk> \<Gamma>, n \<turnstile> \<Psi> \<triangleright> \<Phi> \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g

goal (1 subgoal):
 1. \<exists>\<Gamma>\<^sub>k \<Psi>\<^sub>k \<Phi>\<^sub>k k.
       \<Gamma>, n \<turnstile> \<Psi> \<triangleright> \<Phi> \<hookrightarrow>\<^bsup>k\<^esup> \<Gamma>\<^sub>k, 0 +
  Suc n \<turnstile> \<Psi>\<^sub>k \<triangleright> \<Phi>\<^sub>k \<and>
       \<rho>
       \<in> \<lbrakk> \<Gamma>\<^sub>k, 0 +
   Suc n \<turnstile> \<Psi>\<^sub>k \<triangleright> \<Phi>\<^sub>k \<rbrakk>\<^sub>c\<^sub>o\<^sub>n\<^sub>f\<^sub>i\<^sub>g


proof (prove)
using this:
  ((f', l'), f, l) \<in> pr_algo_rel

goal (1 subgoal):
 1. Height_Bounded_Labeling c s t f l


proof (state)
this:
  formulaEntailsClause F0 (getC state)

goal (1 subgoal):
 1. let l = getCl state; bClause = getC state; bLiteral = opposite l;
        level = getBackjumpLevel state;
        prefix = prefixToLevel level (getM state);
        state'' = applyBackjump state
    in (formulaEntailsClause F0 bClause \<and>
        isUnitClause bClause bLiteral (elements prefix) \<and>
        getM state'' = prefix @ [(bLiteral, False)]) \<and>
       getF state'' = getF state


proof (prove)
goal (1 subgoal):
 1. 0 < y * (z / (x + y))


proof (prove)
goal (1 subgoal):
 1. RF (\<E> (TER f \<union> TER g)) \<subseteq> RF (TER (f \<frown> g))


proof (prove)
goal (1 subgoal):
 1. op_eventually_within_sctn X sctn S
    \<le> SPEC
           (\<lambda>b.
               b \<longrightarrow>
               (\<forall>x\<in>X.
                   x \<in> S \<and>
                   (\<forall>\<^sub>F x in at x within plane_of sctn.
                       x \<in> S)))


proof (prove)
goal (1 subgoal):
 1. emeasure M (G i j) = \<mu> i j


proof (prove)
using this:
  bounded ?S = (\<exists>b>0. \<forall>x\<in>?S. norm x \<le> b)

goal (1 subgoal):
 1. (\<And>C.
        \<lbrakk>0 < C;
         \<And>x. x \<in> S \<Longrightarrow> norm (f x) \<le> C\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  {card {y \<in> {0..<Suc (Suc k)}. y < x} |x. x \<in> {0..<Suc k}} =
  {0..<Suc k}

goal (1 subgoal):
 1. st2.vars1' = {0..<Suc k}


proof (prove)
using this:
  ?x \<in> {len ?m1 ?i1 ?j1 xs |xs.
            set xs \<subseteq> {0..?k1} \<and>
            ?i1 \<notin> set xs \<and>
            ?j1 \<notin> set xs \<and> distinct xs} \<Longrightarrow>
  Min {len ?m1 ?i1 ?j1 xs |xs.
       set xs \<subseteq> {0..?k1} \<and>
       ?i1 \<notin> set xs \<and> ?j1 \<notin> set xs \<and> distinct xs}
  \<le> ?x

goal (1 subgoal):
 1. \<lbrakk>set xs \<subseteq> {0..k}; i \<notin> set xs;
     j \<notin> set xs; distinct xs\<rbrakk>
    \<Longrightarrow> D m i j k \<le> len m i j xs


proof (prove)
using this:
  u \<in> ginitial A
  gupath A w t u
  v = gtarget t u
  gurun A w s v

goal (1 subgoal):
 1. gtarget (stake (Suc l) (t @- s)) u \<in> gunodes A w


proof (prove)
goal (1 subgoal):
 1. ovalidNF (\<lambda>s. P (f s) s) (ogets f) P


proof (prove)
goal (1 subgoal):
 1. restrict_indets ` ideal F = ideal (restrict_indets ` F)


proof (prove)
goal (1 subgoal):
 1. list_all (\<lambda>f. \<tau> \<Turnstile> \<upsilon> f) l


proof (state)
this:
  (?eqa4, ?st'a4) \<in> code_status_status_rel \<Longrightarrow>
  (merge_cstatus cst ?eqa4, merge_status cst' ?st'a4)
  \<in> code_status_status_rel

goal (1 subgoal):
 1. PAC_checker_l_step spec Ast st
    \<le> \<Down>
           (code_status_status_rel \<times>\<^sub>r
            \<langle>var_rel\<rangle>set_rel \<times>\<^sub>r
            \<langle>nat_rel,
            sorted_poly_rel O mset_poly_rel\<rangle>fmap_rel)
           (PAC_checker_step spec' Bst st')


proof (state)
this:
  \<mu> (h \<circ> l) = h (\<mu> (l \<circ> h))

goal (1 subgoal):
 1. \<mu> (h \<circ> l) \<le> \<mu> (h \<circ> g)


proof (prove)
using this:
  S.ide f
  S.ide f \<Longrightarrow>
  \<guillemotleft>\<r>[f] : R f \<Rightarrow>\<^sub>S f\<guillemotright>
  S.ide (R f) \<Longrightarrow>
  \<guillemotleft>\<r>[R f] : R (R f) \<Rightarrow>\<^sub>S R
                       f\<guillemotright>

goal (1 subgoal):
 1. S.seq \<r>[f] \<r>[R f]


proof (prove)
goal (1 subgoal):
 1. \<forall>x xs.
       (distinct xs \<longrightarrow>
        set (injections_alg xs Y) = injections (set xs) Y) \<longrightarrow>
       distinct (x # xs) \<longrightarrow>
       set (injections_alg (x # xs) Y) = injections (set (x # xs)) Y


proof (prove)
using this:
  strong_low_bisim_mm (\<R> ?\<Gamma>')
  \<lbrakk>\<turnstile> ?\<Gamma> {?c} ?\<Gamma>';
   mds_consistent ?mds ?\<Gamma>;
   \<forall>x.
      to_total ?\<Gamma> x = Low \<longrightarrow>
      ?mem\<^sub>1 x = ?mem\<^sub>2 x\<rbrakk>
  \<Longrightarrow> \<langle>?c, ?mds, ?mem\<^sub>1\<rangle> \<R>\<^sup>u\<^bsub>?\<Gamma>'\<^esub> \<langle>?c, ?mds, ?mem\<^sub>2\<rangle>

goal (1 subgoal):
 1. \<langle>c, mds, mem\<^sub>1\<rangle> \<approx>
    \<langle>c, mds, mem\<^sub>2\<rangle>


proof (chain)
picking this:
  [(p - 1) ^ (2 ^ x * m) = 1] (mod p)
  [(p - 1) ^ (2 ^ x * m) = p - 1] (mod p)


proof (prove)
goal (1 subgoal):
 1. \<And>m f.
       (\<And>f.
           map_poly hom (graeffe_poly_impl_main c f m) =
           graeffe_poly_impl_main (hom c) (map_poly hom f)
            m) \<Longrightarrow>
       map_poly hom (graeffe_one_step c (graeffe_poly_impl_main c f m)) =
       graeffe_one_step (hom c)
        (graeffe_poly_impl_main (hom c) (map_poly hom f) m)


proof (prove)
using this:
  B * cnj a = cnj B * a
  C = cnj B
  cor (Re (- 4 * a / B)) = - 4 * a / B
  B \<noteq> 0

goal (1 subgoal):
 1. - 4 * cnj a = cor (Re (- 4 * a / B)) * C


proof (prove)
using this:
  ?l \<in> lists A \<Longrightarrow> (?l, ?l) \<in> listrel r

goal (1 subgoal):
 1. refl_on (lists A) (listrel r)


proof (prove)
goal (1 subgoal):
 1. \<And>a aa b ab ac ba.
       \<lbrakk>semilat (err a, Err.le aa, lift2 b);
        semilat (err ab, Err.le ac, lift2 ba)\<rbrakk>
       \<Longrightarrow> order (Err.le (Product.le aa ac)) \<and>
                         closed (err (a \<times> ab))
                          (lift2 (Product.sup b ba)) \<and>
                         (\<forall>x\<in>err (a \<times> ab).
                             \<forall>y\<in>err (a \<times> ab).
                                x \<sqsubseteq>\<^bsub>Err.le
                  (Product.le aa
                    ac)\<^esub> x \<squnion>\<^bsub>lift2
               (Product.sup b ba)\<^esub> y) \<and>
                         (\<forall>x\<in>err (a \<times> ab).
                             \<forall>y\<in>err (a \<times> ab).
                                y \<sqsubseteq>\<^bsub>Err.le
                  (Product.le aa
                    ac)\<^esub> x \<squnion>\<^bsub>lift2
               (Product.sup b ba)\<^esub> y) \<and>
                         (\<forall>x\<in>err (a \<times> ab).
                             \<forall>y\<in>err (a \<times> ab).
                                \<forall>z\<in>err (a \<times> ab).
                                   x \<sqsubseteq>\<^bsub>Err.le
                     (Product.le aa ac)\<^esub> z \<and>
                                   y \<sqsubseteq>\<^bsub>Err.le
                     (Product.le aa ac)\<^esub> z \<longrightarrow>
                                   x \<squnion>\<^bsub>lift2
                  (Product.sup b ba)\<^esub> y
                                   \<sqsubseteq>\<^bsub>Err.le
                   (Product.le aa ac)\<^esub> z)


proof (prove)
using this:
  \<forall>heap.
     P heap \<and>
     Q heap \<and> state_dp_consistency.cmem heap \<longrightarrow>
     (case execute b heap of None \<Rightarrow> False
      | Some (v', heap') \<Rightarrow>
          P heap' \<and>
          Q heap' \<and> R a v' \<and> state_dp_consistency.cmem heap')
  P heap
  Q heap
  state_dp_consistency.cmem heap

goal (1 subgoal):
 1. (\<And>x heap'.
        \<lbrakk>execute b heap = Some (x, heap'); P heap'; Q heap';
         state_dp_consistency.cmem heap'; R a x\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<not> valid2 []


proof (prove)
goal (1 subgoal):
 1. Abs_freeword (map (\<lambda>s. (s, b)) (xs @ ys)) =
    Abs_freeword (map (\<lambda>s. (s, b)) xs) +
    Abs_freeword (map (\<lambda>s. (s, b)) ys)


proof (prove)
using this:
  pointermap_p_valid p m
  pointermap_getmk a m = (x, u)

goal (1 subgoal):
 1. pointermap_p_valid p u


proof (prove)
goal (1 subgoal):
 1. l_set_shadow_root_get_shadow_root ShadowRootClass.type_wf
     set_shadow_root set_shadow_root_locs get_shadow_root
     get_shadow_root_locs


proof (prove)
goal (1 subgoal):
 1. \<And>x y z. - - (x \<sqinter> y) \<sqinter> (- x \<sqinter> z) = bot


proof (prove)
goal (1 subgoal):
 1. typ_of (mk_all x ty A) = Some propT


proof (prove)
goal (1 subgoal):
 1. is_Msg m =
    (case m of NoMsg \<Rightarrow> False | Msg x \<Rightarrow> True)


proof (prove)
goal (1 subgoal):
 1. OFCLASS('a expr', card_UNIV_class)


proof (prove)
goal (1 subgoal):
 1. M\<^sup>\<dagger>\<^sup>\<dagger> $$ (i, j) = M $$ (i, j)


proof (prove)
goal (1 subgoal):
 1. \<And>a b.
       \<lbrakk>P a; Q b\<rbrakk>
       \<Longrightarrow> \<exists>aa ba ab.
                            aa ## ab \<and>
                            (\<exists>bb.
                                ba ## bb \<and>
                                a = aa + ab \<and>
                                b = ba + bb \<and>
                                P aa \<and>
                                ba = (0::'d) \<and>
                                ab = (0::'c) \<and> Q bb)


proof (prove)
goal (1 subgoal):
 1. ((M, M'), M \<cdot> N, M' \<cdot> N')
    \<in> measures
           [\<lambda>(M, N). card (vars_of M \<union> vars_of N),
            \<lambda>(M, N). size M]


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<le> b; \<forall>x\<in>{a..b}. isCont f x;
     f b \<bullet> k \<le> y; y \<le> f a \<bullet> k\<rbrakk>
    \<Longrightarrow> \<exists>x\<in>{a..b}. f x \<bullet> k = y


proof (prove)
goal (1 subgoal):
 1. (closure {ou_witness.a} = {ou_witness.a} &&&
     closure {ou_witness.b} = {ou_witness.a, ou_witness.b} &&&
     closure {ou_witness.c} = {ou_witness.a, ou_witness.c}) &&&
    (closure {ou_witness.a, ou_witness.b} = {ou_witness.a, ou_witness.b} &&&
     closure {ou_witness.a, ou_witness.c} =
     {ou_witness.a, ou_witness.c}) &&&
    closure {ou_witness.a, ou_witness.b, ou_witness.c} =
    {ou_witness.a, ou_witness.b, ou_witness.c} &&&
    closure {ou_witness.b, ou_witness.c} =
    {ou_witness.a, ou_witness.b, ou_witness.c}


proof (prove)
using this:
  vwb_lens x
  \<lbrakk>vwb_lens ?x; Idempotent id;
   uex ?x \<circ> id = id \<circ> uex ?x\<rbrakk>
  \<Longrightarrow> retract
                     ((uex ?x \<circ>
                       id) \<Leftarrow>\<langle>uex
           ?x,id\<rangle>\<Rightarrow> id)

goal (1 subgoal):
 1. retract (uex x \<Leftarrow>\<langle>uex x,id\<rangle>\<Rightarrow> id)


proof (prove)
goal (1 subgoal):
 1. distributed M S (\<lambda>x. (X x, Y x, Z x))
     (\<lambda>x. ennreal (P x))


proof (prove)
using this:
  finite Z
  z \<notin> Z
  \<lbrakk>Z \<subseteq> carrier V;
   a \<in> Z \<rightarrow> {\<zero>\<^bsub>K\<^esub>}\<rbrakk>
  \<Longrightarrow> lincomb a (A \<union> Z) = lincomb a A
  insert z Z \<subseteq> carrier V
  a \<in> insert z Z \<rightarrow> {\<zero>\<^bsub>K\<^esub>}

goal (1 subgoal):
 1. lincomb a (A \<union> Z) = lincomb a A


proof (prove)
using this:
  \<forall>x\<in>free_vars (Var x). val_type (\<sigma> x) = \<Gamma> x

goal (1 subgoal):
 1. sets (expr_sem \<sigma> (Var x)) = sets (stock_measure (\<Gamma> x))


proof (prove)
goal (5 subgoals):
 1. \<And>a b aa ba W \<sigma> Wtl Wn \<Sigma> W' \<Sigma>'.
       \<lbrakk>(a, b) \<in> dfs_invar \<Sigma>i R; b \<noteq> [];
        a = \<Sigma>; b = W; aa = \<Sigma>'; ba = W'; W = \<sigma> # Wtl;
        distinct Wn; set Wn = R `` {\<sigma>} - \<Sigma>; W' = Wn @ Wtl;
        \<Sigma>' = R `` {\<sigma>} \<union> \<Sigma>\<rbrakk>
       \<Longrightarrow> \<sigma> \<in> set b
 2. \<And>a b aa ba W \<sigma> Wtl Wn \<Sigma> W' \<Sigma>'.
       \<lbrakk>(a, b) \<in> dfs_invar \<Sigma>i R; b \<noteq> [];
        a = \<Sigma>; b = W; aa = \<Sigma>'; ba = W'; W = \<sigma> # Wtl;
        distinct Wn; set Wn = R `` {\<sigma>} - \<Sigma>; W' = Wn @ Wtl;
        \<Sigma>' = R `` {\<sigma>} \<union> \<Sigma>\<rbrakk>
       \<Longrightarrow> aa = a \<union> R `` {\<sigma>}
 3. \<And>a b aa ba W \<sigma> Wtl Wn \<Sigma> W' \<Sigma>'.
       \<lbrakk>(a, b) \<in> dfs_invar \<Sigma>i R; b \<noteq> [];
        a = \<Sigma>; b = W; aa = \<Sigma>'; ba = W'; W = \<sigma> # Wtl;
        distinct Wn; set Wn = R `` {\<sigma>} - \<Sigma>; W' = Wn @ Wtl;
        \<Sigma>' = R `` {\<sigma>} \<union> \<Sigma>\<rbrakk>
       \<Longrightarrow> set ba =
                         set b - {\<sigma>} \<union> (R `` {\<sigma>} - a)
 4. \<And>aa ba.
       (aa, ba) \<in> dfs_initial \<Sigma>i \<Longrightarrow>
       (aa, set ba) = sse_initial \<Sigma>i
 5. \<And>aa ba.
       (aa, ba) \<in> dfs_invar \<Sigma>i R \<Longrightarrow>
       (aa, set ba) \<in> sse_invar \<Sigma>i R


proof (prove)
using this:
  Finite_Set.fold f z B = Finite_Set.fold g z B
  f a = g a
  finite B
  a \<notin> B

goal (1 subgoal):
 1. Finite_Set.fold f z (insert a B) = Finite_Set.fold g z (insert a B)


proof (prove)
using this:
  a = (l, b)

goal (1 subgoal):
 1. trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t
     (dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t (a # A)) =
    trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (a # A)


proof (prove)
goal (1 subgoal):
 1. {v. atom v \<in> supp (Bool b)} = {}


proof (prove)
using this:
  \<pi>\<^sub>D\<^sub>G I \<AA> i :
  dg_prod I
   \<AA> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<AA> i
  \<FF> :
  \<CC> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> dg_prod I
                              \<AA>
  a \<in>\<^sub>\<circ> \<CC>\<lparr>Arr\<rparr>
  i \<in>\<^sub>\<circ> I

goal (1 subgoal):
 1. dghm_up I \<AA> \<CC>
     \<phi>\<lparr>ArrMap\<rparr>\<lparr>a\<rparr>\<lparr>i\<rparr> =
    \<FF>\<lparr>ArrMap\<rparr>\<lparr>a\<rparr>\<lparr>i\<rparr>


proof (prove)
using this:
  Fstd_get F1 f = Some fd1
  rel_fundef (\<lambda>x y. x = norm_instr y) fd1 fd2
  pc = length (body fd2)
  length (body fd1) = length (body fd2)

goal (1 subgoal):
 1. Sstd.final (State F1 H [Frame f pc \<Sigma>])


proof (prove)
goal (1 subgoal):
 1. rel_weakly_respects_barbs SRel SWB


proof (prove)
using this:
  \<not> p dvd p'
  prime p
  p dvd z
  p dvd gauss_cnj z

goal (1 subgoal):
 1. p * p' dvd z


proof (prove)
goal (1 subgoal):
 1. avl t \<Longrightarrow>
    AVL_Bal_Set.insert x t \<noteq>
    \<langle>l, (a, Rh), \<langle>\<rangle>\<rangle> \<and>
    AVL_Bal_Set.insert x t \<noteq>
    \<langle>\<langle>\<rangle>, (a, Lh), r\<rangle>


proof (prove)
goal (1 subgoal):
 1. V \<subseteq> attractor p K \<union> (V - W1 - attractor p K) \<union>
                  W1


proof (prove)
using this:
  map_of (zip xs ys)(x \<mapsto> y) = map_of (zip xs zs)(x \<mapsto> z)

goal (1 subgoal):
 1. y = z


proof (prove)
goal (1 subgoal):
 1. ideal_generated S = {y. \<exists>f. (\<Sum>i\<in>S. f i * i) = y}


proof (prove)
goal (1 subgoal):
 1. (\<And>init rest.
        \<lbrakk>pes = init @ (p, e) # rest; distinct (pat_bindings p []);
         list_all
          (\<lambda>(p, e).
              cupcake_pmatch cenv p v0 [] = No_match \<and>
              distinct (pat_bindings p []))
          init;
         cupcake_pmatch cenv p v0 [] = Match env'\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. inres (ASSERT (\<exists>x. P x) \<bind> (\<lambda>_. SPEC P)) x =
    ((\<forall>x. \<not> P x) \<or> P x)


proof (prove)
using this:
  xs \<noteq> []

goal (1 subgoal):
 1. 0 < natural_of_nat (length xs)


proof (prove)
goal (1 subgoal):
 1. rat_of (mediant X) < rat_of (mediant (X \<otimes> UR \<otimes> Y))


proof (prove)
using this:
  c_row + c_rec \<le> (\<Sum>ii = i..<m. 2 * n + (2 * n + 1 + 2 * ii) * ii)

goal (1 subgoal):
 1. result (dmu_array_cost dmus i) = dmu_array fs m dmus i \<and>
    cost (dmu_array_cost dmus i)
    \<le> (\<Sum>ii = i..<m. 2 * n + (2 * n + 1 + 2 * ii) * ii)


proof (prove)
using this:
  \<lbrakk>0 < ?rs;
   {\<lambda>tp. tp = (Bk \<up> 0, <args>)} p
   {\<lambda>tp. tp = (Bk \<up> ?m, Oc \<up> ?rs @ Bk \<up> ?k)}\<rbrakk>
  \<Longrightarrow> {\<lambda>tp. tp = ([], <code p # args>)} UTM
                    {\<lambda>tp.
                        \<exists>m n.
                           tp = (Bk \<up> m, Oc \<up> ?rs @ Bk \<up> n)}

goal (1 subgoal):
 1. {\<lambda>tp. tp = ([], <code p # args>)} UTM
    {\<lambda>tp. \<exists>m k. tp = (Bk \<up> m, <n> @ Bk \<up> k)}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<le> y; y \<le> z\<rbrakk> \<Longrightarrow> x \<le> z


proof (prove)
goal (1 subgoal):
 1. a $ k = \<langle>x\<rangle> k


proof (prove)
goal (1 subgoal):
 1. oclosed
     (opnet (\<lambda>i. optoy i \<langle>\<langle>\<^bsub>i\<^esub> qmsg)
       n) \<Turnstile> (\<lambda>_ _ _. True,
                        other nos_inc (net_tree_ips n) \<rightarrow>)
                        global
                         (\<lambda>\<sigma>.
                             \<forall>i\<in>net_tree_ips n.
                                no (\<sigma> i)
                                \<le> no (\<sigma> (nhid (\<sigma> i))))


proof (prove)
goal (1 subgoal):
 1. (\<And>s. s \<in> productive_on g) \<Longrightarrow> productive g


proof (prove)
using this:
  ms \<in> LPDs mr

goal (1 subgoal):
 1. (fv_regex (from_mregex ms \<phi>s) = fv_regex r &&&
     safe_regex Futu Strict (from_mregex ms \<phi>s)) &&&
    ok (length \<phi>s) ms &&& LPD ms \<subseteq> LPDs mr


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite X; fun S1 = fun S2 on - X; S2 \<le> S1;
     S1 \<triangle> S2 < S1\<rbrakk>
    \<Longrightarrow> n\<^sub>s (S1 \<triangle> S2) X < n\<^sub>s S1 X


proof (prove)
using this:
  Gmod3 = Gmod4

goal (1 subgoal):
 1. Gmod1 \<cong> Gmod2


proof (prove)
goal (3 subgoals):
 1. 1-lipschitz_on (c ` {A..B}) to_Bonk_Schramm_extension
 2. geodesic_segment_between (to_Bonk_Schramm_extension ` G)
     ((to_Bonk_Schramm_extension \<circ> c) A)
     ((to_Bonk_Schramm_extension \<circ> c) B)
 3. to_Bonk_Schramm_extension x \<in> to_Bonk_Schramm_extension ` G


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>H \<subseteq> carrier G; x \<in> carrier G\<rbrakk>
    \<Longrightarrow> x <+ H \<subseteq> carrier G


proof (prove)
goal (1 subgoal):
 1. continuous_on {a..b} f


proof (prove)
using this:
  x * y < (0::'a)
  xs \<noteq> []
  hd xs \<noteq> (0::'a)
  last xs \<noteq> (0::'a)

goal (1 subgoal):
 1. even (sign_changes (y # xs'')) =
    (sgn (hd (y # xs'')) = sgn (last (y # xs'')))


proof (prove)
using this:
  i \<in>\<^sub>\<circ> \<D>\<^sub>\<circ> x
  J \<subseteq>\<^sub>\<circ> I

goal (1 subgoal):
 1. x\<lparr>i\<rparr> =
    ((\<lambda>i\<in>\<^sub>\<circ>I.
         if i \<in>\<^sub>\<circ> J \<Rightarrow> x\<lparr>i\<rparr>
          | otherwise \<Rightarrow> SOME x.
 x \<in>\<^sub>\<circ> A i) \<restriction>\<^sup>l\<^sub>\<circ>
     J)\<lparr>i\<rparr>


proof (prove)
goal (1 subgoal):
 1. OFCLASS(nterm, pre_term_class)


proof (prove)
goal (1 subgoal):
 1. ccTTree S G \<otimes>\<otimes> ccTTree S' G' \<sqsubseteq>
    ccTTree (S \<union> S') (G \<squnion> G' \<squnion> S G\<times> S')


proof (prove)
goal (1 subgoal):
 1. consts t |\<union>|
    ffUnion (consts |`| fmimage (fmdrop x env) (frees t)) =
    consts t |\<union>| ffUnion (consts |`| fmimage env (frees t |-| {|x|}))