proof (state)
this:
  ((\<lambda>t. v t $ i) has_vderiv_on (\<lambda>t. 0)) T

goal (1 subgoal):
 1. v t $ i = x0


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mcont lub ord Sup (\<le>) f;
     mcont lub ord Sup (\<le>) g\<rbrakk>
    \<Longrightarrow> mcont lub ord Sup (\<le>) (\<lambda>x. f x + g x)


proof (prove)
using this:
  \<exists>as'.
     exec_plan s as = exec_plan s as' \<and>
     subseq as' as \<and> length as' \<le> problem_plan_bound PROB

goal (1 subgoal):
 1. \<exists>as'.
       exec_plan s as = exec_plan s as' \<and>
       subseq as' as \<and> length as' < problem_plan_bound PROB + 1


proof (prove)
goal (1 subgoal):
 1. count cs (shd w) k < length cs


proof (prove)
goal (1 subgoal):
 1. wellformed_policy2Pr (x # xs) \<Longrightarrow> wellformed_policy2Pr xs


proof (prove)
goal (1 subgoal):
 1. map vec\<^sub>h (factorization_lattice u k m) =
    factorization_lattice (map_poly hom u) k (hom m)


proof (prove)
using this:
  porder_on (actions E) (happens_before P E)
  \<not> P,E \<turnstile> w' \<le>hb ws r'
  ws r' \<in> write_actions E
  w' = ws r'

goal (1 subgoal):
 1. False


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Dag p low high pret; no \<noteq> Null;
     \<And>not. Dag no low high not \<Longrightarrow> thesis;
     no \<in> set_of pret \<and> var no = n\<rbrakk>
    \<Longrightarrow> thesis


proof (prove)
goal (1 subgoal):
 1. OFCLASS('a fract, euclidean_ring_gcd_class)


proof (prove)
goal (1 subgoal):
 1. coeff
     (\<Sum>X\<in>Pow A.
        monom ((- (1::'b)) ^ card X * prod f X) (card (A - X)))
     k =
    (\<Sum>X | X \<subseteq> A \<and> card X = card A - k.
       (- (1::'b)) ^ (card A - k) * prod f X)


proof (prove)
goal (1 subgoal):
 1. component_of_term ` Keys B
    \<subseteq> component_of_term ` Keys (phull B)


proof (prove)
using this:
  0 < a
  0 < b
  \<forall>\<^sub>F x in at_top. 0 < ln x / x powr (b / a)

goal (1 subgoal):
 1. ((\<lambda>x. (ln x / x powr (b / a)) powr a) \<longlongrightarrow> 0)
     at_top


proof (prove)
goal (1 subgoal):
 1. \<turnstile> DBSpec \<longrightarrow> FullSpec


proof (chain)
picking this:
  n \<le> m


proof (prove)
goal (1 subgoal):
 1. abss (l, u) = (l, [u]\<^sub>\<R>)


proof (prove)
using this:
  LeftDerivation \<alpha> (take (ladder_n L' (Suc index)) D')
   (ladder_\<gamma> \<alpha> D' L' (Suc index))
  ladder_\<gamma> (\<delta> @ \<alpha>) D L (Suc index) =
  \<delta> @ \<gamma>' \<and>
  LeftDerivationIntro (ladder_\<alpha> \<alpha> D' L' (Suc index))
   (ladder_i L (Suc index) - length \<delta>) (snd e)
   (ladder_ix L (Suc index)) (derivation_shift E (length \<delta>) 0)
   (ladder_j L (Suc index) - length \<delta>) \<gamma>'
  D' = derivation_shift D (length \<delta>) 0
  Derivation ?a ?D ?b \<Longrightarrow> Derive ?a ?D = ?b
  L' = ladder_cut_prefix (length \<delta>) L
  LeftDerivationIntro ?\<alpha> ?i ?r ?ix ?D ?j ?\<gamma> =
  (\<exists>\<beta>.
      LeftDerives1 ?\<alpha> ?i ?r \<beta> \<and>
      ?ix < length (snd ?r) \<and>
      snd ?r ! ?ix = ?\<gamma> ! ?j \<and>
      LeftDerivationFix \<beta> (?i + ?ix) ?D ?j ?\<gamma>)
  n = ladder_n L (Suc index - 1)
  m = ladder_n L (Suc index)
  e = D ! n
  E = drop (Suc n) (take m D)
  LeftDerivation \<alpha> (take (ladder_n L' (Suc index)) D')
   (ladder_\<gamma> \<alpha> D' L' (Suc index))
  LeftDerivation ?a ?D ?b \<Longrightarrow> Derivation ?a ?D ?b
  ladder_\<gamma> ?a ?D ?L ?index = Derive ?a (take (ladder_n ?L ?index) ?D)
  \<lbrakk>?index < length ?L; 0 < length ?L\<rbrakk>
  \<Longrightarrow> ladder_n (ladder_cut_prefix ?d ?L) ?index =
                    ladder_n ?L ?index
  take ?n (derivation_shift ?D ?left ?right) =
  derivation_shift (take ?n ?D) ?left ?right

goal (1 subgoal):
 1. LeftDerivation \<alpha> (take (ladder_n L' (Suc index)) D')
     (ladder_\<gamma> \<alpha> D' L' (Suc index)) \<and>
    ladder_\<alpha> (\<delta> @ \<alpha>) D L (Suc index) =
    \<delta> @ ladder_\<alpha> \<alpha> D' L' (Suc index) \<and>
    ladder_\<gamma> (\<delta> @ \<alpha>) D L (Suc index) =
    \<delta> @ ladder_\<gamma> \<alpha> D' L' (Suc index)


proof (prove)
using this:
  Right_a.arr \<mu> \<and> arr \<mu> \<and> \<mu> \<star> a \<noteq> null
  H\<^sub>R ?f \<equiv> \<lambda>\<mu>. \<mu> \<star> ?f
  Right_a.arr ?f \<Longrightarrow> Right_a.arr (H\<^sub>R a' ?f)

goal (1 subgoal):
 1. Right_a.arr (\<mu> \<star> a')


proof (prove)
using this:
  m1 \<le> m2
  m2 \<le> m1

goal (1 subgoal):
 1. m1 = m2


proof (prove)
goal (1 subgoal):
 1. k \<le> (GREATEST k. P k)


proof (prove)
goal (1 subgoal):
 1. smap f (of_seq g) = of_seq (f \<circ> g)


proof (prove)
goal (1 subgoal):
 1. AE x in lborel. x \<notin> s m ` cbox a b


proof (prove)
using this:
  infs (even \<circ> f)
   (gtrace (sdrop n (fromN 1 ||| r))
     (gtarget (stake n (fromN 1 ||| r)) (0, p)))

goal (1 subgoal):
 1. infs even
     (smap f
       (gtrace (sdrop n (fromN 1 ||| r))
         (gtarget (stake n (fromN 1 ||| r)) (0, p))))


proof (prove)
using this:
  a \<rightarrow> a

goal (1 subgoal):
 1. False


proof (prove)
goal (1 subgoal):
 1. (\<lambda>m.
        real (card {(n, d). n \<in> {0<..m} \<and> d dvd n}) /
        real (card {0<..m}) -
        (ln (real m) + 2 * euler_mascheroni - 1))
    \<in> \<Theta>(\<lambda>m.
                      (sum_upto (\<lambda>n. real (divisor_count n))
                        (real m) -
                       (real m * ln (real m) +
                        (2 * euler_mascheroni - 1) * real m)) /
                      real m)


proof (prove)
goal (1 subgoal):
 1. similar_mat_wit (four_block_mat A1 A2 A0 A3)
     (four_block_mat A1 (A2 * P') A0 B)
     (four_block_mat (1\<^sub>m 1) (0\<^sub>m 1 (n - 1))
       (0\<^sub>m (n - 1) 1) P')
     (four_block_mat (1\<^sub>m 1) (0\<^sub>m 1 (n - 1))
       (0\<^sub>m (n - 1) 1) Q')


proof (prove)
goal (1 subgoal):
 1. fls_shift k (of_nat a) $$ n = (if n = - k then of_nat a else (0::'a))


proof (prove)
goal (1 subgoal):
 1. rel_bset R (bset_of_option x1) (bset_of_option x2) = rel_option R x1 x2


proof (prove)
goal (1 subgoal):
 1. \<forall>B\<subseteq>X.
       \<forall>a\<in>X.
          a \<notin> set_option
                      (local.MaxR.MaxR_opt
                        (B \<union> {a})) \<longrightarrow>
          set_option (local.MaxR.MaxR_opt (B \<union> {a})) =
          set_option (local.MaxR.MaxR_opt B)


proof (prove)
using this:
  \<lbrakk>\<triangle> (\<T> ?s); ?x\<^sub>i \<in> lvars (\<T> ?s);
   ?x\<^sub>j \<in> rvars_eq (eq_for_lvar (\<T> ?s) ?x\<^sub>i)\<rbrakk>
  \<Longrightarrow> \<triangle> (\<T> (pivot ?x\<^sub>i ?x\<^sub>j ?s))
  \<lbrakk>\<triangle> (\<T> ?s); ?x\<^sub>i \<in> lvars (\<T> ?s);
   ?x\<^sub>j \<in> rvars_eq (eq_for_lvar (\<T> ?s) ?x\<^sub>i)\<rbrakk>
  \<Longrightarrow> ?x\<^sub>i
                    \<notin> lvars (\<T> (pivot ?x\<^sub>i ?x\<^sub>j ?s))

goal (1 subgoal):
 1. PivotAndUpdate eq_idx_for_lvar pivot_and_update


proof (prove)
goal (1 subgoal):
 1. (path \<sigma>, k) \<in> scop \<and> (path \<sigma>', k') \<in> scp


proof (prove)
goal (1 subgoal):
 1. blinfun_apply -` UNIV \<inter> UNIV = UNIV


proof (prove)
using this:
  igSwapAbsIPresIGWlsAbs MOD
  igWlsAbsDisj MOD
  igWlsAbsIsInBar MOD

goal (1 subgoal):
 1. igSwapAbsIPresIGWlsAbsSTR (errMOD MOD)


proof (prove)
goal (1 subgoal):
 1. vector_space = vector_space_with (+) (0::'b) (-) uminus


proof (prove)
goal (1 subgoal):
 1. \<And>stp ln rn.
       steps0 (Suc 0, Bk # Bk # ires, Oc \<up> Suc rs @ Bk \<up> n)
        t_fourtimes stp =
       (Suc t_fourtimes_len, Bk \<up> ln @ Bk # Bk # ires,
        Oc \<up> Suc (4 * rs) @ Bk \<up> rn) \<Longrightarrow>
       \<exists>stp ln rn.
          steps0
           (Suc 0 +
            length
             (t_wcode_main_first_part @
              shift t_twice (length t_wcode_main_first_part div 2) @
              [(L, 1), (L, 1)]) div
            2,
            Bk # Bk # ires, Oc \<up> Suc rs @ Bk \<up> n)
           ((t_wcode_main_first_part @
             shift t_twice (length t_wcode_main_first_part div 2) @
             [(L, 1), (L, 1)]) @
            shift t_fourtimes (t_twice_len + 13) @ [(L, 1), (L, 1)])
           stp =
          (Suc t_fourtimes_len +
           length
            (t_wcode_main_first_part @
             shift t_twice (length t_wcode_main_first_part div 2) @
             [(L, 1), (L, 1)]) div
           2,
           Bk \<up> ln @ Bk # Bk # ires,
           Oc \<up> Suc (4 * rs) @ Bk \<up> rn)


proof (prove)
goal (1 subgoal):
 1. det (mat_of_rows n (map (row A) [0..<n]) *
         (mat_of_rows n (map (row A) [0..<n]))\<^sup>T) =
    gso.Gramian_determinant (map (row A) [0..<n]) n


proof (prove)
using this:
  chain A
  adm (\<lambda>x. x \<in> X)
  adm (\<lambda>x. x \<in> Y)
  \<forall>i. fst (A i) \<in> X
  \<forall>i. snd (A i) \<in> Y

goal (1 subgoal):
 1. Lub A \<in> X \<times> Y


proof (prove)
goal (1 subgoal):
 1. x \<in> B \<Longrightarrow> [x \<noteq> 0] (mod int p)


proof (prove)
goal (2 subgoals):
 1. \<And>n f a b.
       \<lbrakk>Ring R;
        surjec\<^bsub>R,(r\<Pi>\<^bsub>{j. j \<le> Suc n}\<^esub>
                         B)\<^esub> A_to_prodag R {j. j \<le> Suc n} S B;
        \<forall>k\<le>Suc (Suc n). ideal R (J k);
        \<forall>k\<le>Suc (Suc n). B k = R /\<^sub>r J k;
        \<forall>k\<le>Suc (Suc n). S k = pj R (J k);
        \<forall>i\<le>Suc (Suc n).
           \<forall>j\<le>Suc (Suc n).
              i \<noteq> j \<longrightarrow> coprime_ideals R (J i) (J j);
        \<forall>k\<le>Suc (Suc n). Ring (R /\<^sub>r J k);
        A_to_prodag R {i. i \<le> Suc (Suc n)} S B
        \<in> rHom R (r\<Pi>\<^bsub>{i. i \<le> Suc (Suc n)}\<^esub> B);
        A_to_prodag R {j. j \<le> Suc (Suc n)} S B
        \<in> carrier R \<rightarrow>
              carrier (r\<Pi>\<^bsub>{i. i \<le> Suc (Suc n)}\<^esub> B);
        f \<in> carrier (r\<Pi>\<^bsub>{j. j \<le> Suc (Suc n)}\<^esub> B);
        ideal R (i\<Pi>\<^bsub>R,Suc n\<^esub> J);
        a \<in> i\<Pi>\<^bsub>R,Suc n\<^esub> J; b \<in> J (Suc (Suc n));
        a \<plusminus> b = 1\<^sub>r\<rbrakk>
       \<Longrightarrow> \<exists>a\<in>carrier R.
                            A_to_prodag R {j. j \<le> Suc (Suc n)} S B a = f
 2. \<And>n.
       \<lbrakk>Ring R;
        (\<forall>k\<le>Suc n. ideal R (J k)) \<and>
        (\<forall>k\<le>Suc n. B k = R /\<^sub>r J k) \<and>
        (\<forall>k\<le>Suc n. S k = pj R (J k)) \<and>
        (\<forall>i\<le>Suc n.
            \<forall>j\<le>Suc n.
               i \<noteq> j \<longrightarrow>
               coprime_ideals R (J i) (J j)) \<longrightarrow>
        surjec\<^bsub>R,(r\<Pi>\<^bsub>{j. j \<le> Suc n}\<^esub>
                         B)\<^esub> A_to_prodag R {j. j \<le> Suc n} S B;
        \<forall>k\<le>Suc (Suc n). ideal R (J k);
        \<forall>k\<le>Suc (Suc n). B k = R /\<^sub>r J k;
        \<forall>k\<le>Suc (Suc n). S k = pj R (J k);
        \<forall>i\<le>Suc (Suc n).
           \<forall>j\<le>Suc (Suc n).
              i \<noteq> j \<longrightarrow> coprime_ideals R (J i) (J j);
        \<forall>j.
           j \<in> {j. j \<le> Suc n} \<longrightarrow>
           j \<in> {j. j \<le> Suc (Suc n)}\<rbrakk>
       \<Longrightarrow> \<forall>k\<in>{i. i \<le> Suc (Suc n)}. Ring (B k)


proof (prove)
using this:
  sym theta
  theta \<subseteq> RetrT (theta \<union> bis RetrT)
  Bisim.mono Sretr
  Bisim.mono ZOretr
  Bisim.mono ZOretrT
  Bisim.mono Wretr
  Bisim.mono WretrT
  Bisim.mono RetrT
  \<lbrakk>Bisim.mono ?Retr; sym ?theta;
   ?theta \<subseteq> ?Retr (?theta \<union> bis ?Retr)\<rbrakk>
  \<Longrightarrow> ?theta \<subseteq> bis ?Retr

goal (1 subgoal):
 1. theta \<subseteq> bis RetrT


proof (prove)
using this:
  convex (Epigraph UNIV f)

goal (1 subgoal):
 1. convex (domain f)


proof (prove)
using this:
  (l # ls) ! i = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)
  i = 0

goal (1 subgoal):
 1. l = (p, Read volatile a t # is, \<theta>, sb, \<D>, \<O>)


proof (prove)
goal (1 subgoal):
 1. lm.ball m P = (\<forall>x\<in>set (assoc_list.impl_of m). P x)


proof (prove)
goal (1 subgoal):
 1. ((\<lambda>x. f1 x / f2 x) \<in> L F (\<lambda>x. g1 x / g2 x)) =
    (f1 \<in> L F g1)


proof (prove)
using this:
  Suc n \<le> N
  1 \<le> n
  n < m
  a \<le> b
  finite Y

goal (1 subgoal):
 1. ((- 1) ^ n * bernoulli (Suc n) / fact (Suc n)) *\<^sub>R
    (fs n (real_of_int b) - fs n (real_of_int a)) +
    EM_remainder' n (fs n) (real_of_int a) (real_of_int b) =
    EM_remainder' (Suc n) (fs (Suc n)) (real_of_int a) (real_of_int b)


proof (prove)
goal (1 subgoal):
 1. (A - B) $$ i = A $$ i - B $$ i


proof (state)
this:
  n = 0

goal (2 subgoals):
 1. n = 0 \<Longrightarrow>
    \<exists>m y.
       odd m \<and>
       0 < m \<and>
       m < 2 ^ Suc n \<and>
       y \<in> {a (real m / 2 ^ Suc n)..b (real m / 2 ^ Suc n)} \<and>
       f y = f x
 2. n \<noteq> 0 \<Longrightarrow>
    \<exists>m y.
       odd m \<and>
       0 < m \<and>
       m < 2 ^ Suc n \<and>
       y \<in> {a (real m / 2 ^ Suc n)..b (real m / 2 ^ Suc n)} \<and>
       f y = f x


proof (prove)
goal (1 subgoal):
 1. SN (inv_image
         (lex_two
           {(fss, gts).
            (case gts of (f, ss) \<Rightarrow> weight (Fun f ss))
            < (case fss of (f, ss) \<Rightarrow> weight (Fun f ss))}
           {(fss, gts).
            (case gts of (f, ss) \<Rightarrow> weight (Fun f ss))
            \<le> (case fss of (f, ss) \<Rightarrow> weight (Fun f ss))}
           {(fss, gts).
            pr_strict (case fss of (f, ss) \<Rightarrow> (f, length ss))
             (case gts of (f, ss) \<Rightarrow> (f, length ss))})
         (\<lambda>x. (x, x)))


proof (prove)
goal (1 subgoal):
 1. pmf (N \<bind> K) i \<le> pmf N i


proof (prove)
using this:
  u ?n \<le> real_cond_exp M F f x

goal (1 subgoal):
 1. c \<le> real_cond_exp M F f x


proof (prove)
using this:
  op\<^sub>2 \<in> set ops
  op\<^sub>1 \<in> set ((\<Phi>\<inverse> \<Pi> \<A> t) ! k)
  op\<^sub>2 \<in> set ((\<Phi>\<inverse> \<Pi> \<A> t) ! k)
  index (\<Pi>\<^sub>\<O>) op\<^sub>1 \<noteq>
  index (\<Pi>\<^sub>\<O>) op\<^sub>2

goal (1 subgoal):
 1. \<not> are_operators_interfering op\<^sub>1 op\<^sub>2


proof (state)
goal (1 subgoal):
 1. T \<inter> u exposed_face_of S


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 < n; distinct_pds K n P; ideal (O\<^bsub>K P n\<^esub>) I;
     I \<noteq> {\<zero>\<^bsub>O\<^bsub>K P n\<^esub>\<^esub>};
     I \<noteq> carrier (O\<^bsub>K P n\<^esub>); j \<le> n; Ring K;
     aGroup K; j \<noteq> n\<rbrakk>
    \<Longrightarrow> (\<nu>\<^bsub>K P j\<^esub>)
                       (\<Sigma>\<^sub>e K (\<lambda>k.
         Zl_mI K P I k \<cdot>\<^sub>r
         mprod_exp K (K_gamma k) (Kb\<^bsub>K n P\<^esub>)
          n\<^bsub>K\<^esub>\<^bsup>m_zmax_pdsI K n P I\<^esup>) n) =
                      LI K (\<nu>\<^bsub>K P j\<^esub>) I


proof (prove)
goal (1 subgoal):
 1. timpl_closure_set M TI \<turnstile>\<^sub>c u


proof (prove)
using this:
  valid_edge ax
  sourcenode ax = sourcenode a'
  kind ax = (\<lambda>cf. False)\<^sub>\<surd>
  \<forall>a''.
     valid_edge a'' \<and>
     sourcenode a'' = sourcenode a' \<and>
     intra_kind (kind a'') \<longrightarrow>
     a'' = a

goal (1 subgoal):
 1. ax = a


proof (state)
this:
  order (G\<lparr>carrier := P\<rparr>) = p ^ a * k

goal (1 subgoal):
 1. snd_sylow (G\<lparr>carrier := P\<rparr>) p a (card P div p ^ a)


proof (prove)
using this:
  qGood (qOp delta inp binp)
  liftAll (\<lambda>a. qGood a \<longrightarrow> qGood a #[[rho]]) inp
  liftAll (\<lambda>a. qGoodAbs a \<longrightarrow> qGoodAbs a $[[rho]])
   binp

goal (1 subgoal):
 1. liftAll (\<lambda>x. qGood x #[[rho]]) inp \<and>
    liftAll (\<lambda>x. qGoodAbs x $[[rho]]) binp


proof (prove)
goal (1 subgoal):
 1. isDERIV j (fa ^\<^sub>e n) xs =
    (if n = 0 then True else isDERIV j fa xs)


proof (prove)
using this:
  a = 0

goal (1 subgoal):
 1. \<And>x. 1 \<le> x \<Longrightarrow> Im (Ln (Complex a x)) = pi / 2


proof (prove)
using this:
  \<guillemotleft>\<omega> : w \<star>\<^sub>B
                             w \<Rightarrow> w\<guillemotright>
  ?g \<star> ?f =
  (if arr ?f \<and> arr ?g \<and> trg\<^sub>B ?f = src\<^sub>B ?g
   then ?g \<star>\<^sub>B ?f else null)
  arr ?f = (B.arr ?f \<and> src\<^sub>B ?f = a \<and> trg\<^sub>B ?f = a)

goal (1 subgoal):
 1. \<guillemotleft>\<omega> : fst (cod \<omega>, cod \<omega>) \<star>
                               snd (cod \<omega>,
                                    cod \<omega>) \<Rightarrow> cod
                           \<omega>\<guillemotright>


proof (prove)
goal (1 subgoal):
 1. X #= X''


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>complete t; sorted1 (inorder t)\<rbrakk>
    \<Longrightarrow> inorder (treeD (Tree23_Map.del x t)) =
                      AList_Upd_Del.del_list x (inorder t)


proof (prove)
goal (1 subgoal):
 1. \<And>i.
       (sterm_sem I (if i = vid1 then Var vid1 else Const 0) has_derivative
        frechet I (if i = vid1 then Var vid1 else Const 0) x)
        (at x)


proof (prove)
goal (1 subgoal):
 1. ANR S \<Longrightarrow> ANR (connected_component_set S x)


proof (prove)
goal (1 subgoal):
 1. monom 1 1 [^]\<^bsub>mult_of R\<^esub> CARD('a) ^ degree f = monom 1 1


proof (prove)
goal (1 subgoal):
 1. xa \<notin># dom_m N \<Longrightarrow>
    fmrestrict_set (insert xa l1) N = fmrestrict_set l1 N


proof (prove)
goal (1 subgoal):
 1. mersenne_mod k n < 2 ^ n + 2 ^ (2 * n + 2 - n)


proof (prove)
goal (1 subgoal):
 1. PRE (\<lambda>s.
            True) (IF (\<lambda>s.
                          s ''y''
                          \<le> s ''x'') THEN (''z'' ::= (\<lambda>s.
                       s ''x'')) ELSE (''z'' ::= (\<lambda>s.
               s ''y'')) FI) POST (\<lambda>s.
s ''z'' = max (s ''x'') (s ''y''))


proof (prove)
goal (1 subgoal):
 1. map_poly complex_of_real (map_poly Im r) = 0 \<Longrightarrow>
    map_poly complex_of_real (map_poly Re r) +
    smult \<i> (map_poly complex_of_real (map_poly Im r)) =
    map_poly complex_of_real (map_poly Re r)


proof (prove)
using this:
  P t

goal (1 subgoal):
 1. \<And>k. k \<in> set K \<Longrightarrow> P k


proof (prove)
using this:
  pt TYPE('b) TYPE('a)
  pt TYPE('c) TYPE('a)
  fs TYPE('b) TYPE('a)
  fs TYPE('c) TYPE('a)
  at TYPE('a)
  finite Xs
  finite Ys
  Xs \<noteq> {}
  Ys \<noteq> {}

goal (1 subgoal):
 1. x \<sharp> Xs \<times> Ys = (x \<sharp> Xs \<and> x \<sharp> Ys)


proof (prove)
using this:
  (neg A IMP neg A) IMP (neg (neg A) IMP neg (neg A)) IMP A IMP neg (neg A)
  \<in> boolean_axioms

goal (1 subgoal):
 1. H \<turnstile> A \<Longrightarrow> H \<turnstile> neg (neg A)


proof (prove)
using this:
  sorted (map fst auxlist)
  ?t1 \<in> set (map fst auxlist) \<Longrightarrow> ?t1 \<le> nt

goal (1 subgoal):
 1. sorted
     (map fst
       (map (\<lambda>(t, a1, a2).
                (t, if pos then join a1 True rel1 else a1 \<union> rel1,
                 if mem (nt - t) I then a2 \<union> join rel2 pos a1
                 else a2))
         auxlist @
        [(nt, rel1, if left I = 0 then rel2 else empty_table)]))


proof (prove)
using this:
  continuous_on ({0..1} \<times> {0..1}) h
  h ` ({0..1} \<times> {0..1}) \<subseteq> s
  ?x \<in> {0..1} \<Longrightarrow> h (0, ?x) = p ?x
  ?x \<in> {0..1} \<Longrightarrow> h (1, ?x) = q ?x
  ?x \<in> {0..1} \<Longrightarrow>
  pathstart (h \<circ> Pair ?x) = pathstart p
  ?x \<in> {0..1} \<Longrightarrow>
  pathfinish (h \<circ> Pair ?x) = pathfinish p

goal (1 subgoal):
 1. homotopic_paths s p q


proof (prove)
goal (1 subgoal):
 1. CU.Model wtFsym wtPsym (length \<circ> arOf) (length \<circ> parOf)
     \<Phi> (intT any) intF intP


proof (prove)
using this:
  outstanding_refs is_volatile_Read\<^sub>s\<^sub>b (r # sb) \<subseteq> A

goal (1 subgoal):
 1. outstanding_refs is_volatile_Read\<^sub>s\<^sub>b sb \<subseteq> A


proof (prove)
goal (1 subgoal):
 1. uniform_limit (cball s \<delta>)
     (\<lambda>x s. EM_remainder' n (f s) (real_of_int a) (real x))
     (\<lambda>s. EM_remainder n (f s) a) sequentially


proof (prove)
using this:
  match (t\<^sub>1 $ t\<^sub>2) u = Some env

goal (1 subgoal):
 1. (\<And>u\<^sub>1 u\<^sub>2 env\<^sub>1 env\<^sub>2.
        \<lbrakk>u = app u\<^sub>1 u\<^sub>2;
         match t\<^sub>1 u\<^sub>1 = Some env\<^sub>1;
         match t\<^sub>2 u\<^sub>2 = Some env\<^sub>2;
         env = env\<^sub>1 ++\<^sub>f env\<^sub>2\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. correctCompositionDiffLevelsSYSTEM


proof (prove)
goal (1 subgoal):
 1. expectation_gpv' (c response) \<le> 1


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<exists>Ma. M = Ma \<and> (\<forall>n. count Ma n < base);
     inj_on f (set_mset M)\<rbrakk>
    \<Longrightarrow> \<exists>Ma.
                         image_mset f M = Ma \<and>
                         (\<forall>n. count Ma n < base)


proof (prove)
using this:
  g \<equiv> Cn 1 r_ifeq_else_diverg [f, Z, Z]

goal (1 subgoal):
 1. eval g [x] =
    (if x \<notin> {x. eval r_phi [x, x] \<down>} then Some 0 else None)


proof (prove)
using this:
  2 \<le> ?x \<Longrightarrow> \<pi> ?x < 443 / 139 * (?x / ln ?x)

goal (1 subgoal):
 1. 0 < n \<Longrightarrow>
    139 / 443 * (real n * ln (real n)) \<le> real (nth_prime (n - 1))


proof (prove)
using this:
  prim_invar2_init Q \<pi> \<or> prim_invar2_ctd Q \<pi>
  prim_invar2_init Q ?\<pi> \<Longrightarrow>
  prim_invar2_ctd (Q' Q ?\<pi> u) (\<pi>' Q ?\<pi> u)
  prim_invar2_init Q ?\<pi> \<Longrightarrow>
  T_measure2 (Q' Q ?\<pi> u) (\<pi>' Q ?\<pi> u) < T_measure2 Q ?\<pi>
  prim_invar2_ctd Q ?\<pi> \<Longrightarrow>
  prim_invar2_ctd (Q' Q ?\<pi> u) (\<pi>' Q ?\<pi> u)
  prim_invar2_ctd Q ?\<pi> \<Longrightarrow>
  T_measure2 (Q' Q ?\<pi> u) (\<pi>' Q ?\<pi> u) < T_measure2 Q ?\<pi>

goal (1 subgoal):
 1. prim_invar2_init (Q' Q \<pi> u) (\<pi>' Q \<pi> u) \<or>
    prim_invar2_ctd (Q' Q \<pi> u) (\<pi>' Q \<pi> u) &&&
    T_measure2 (Q' Q \<pi> u) (\<pi>' Q \<pi> u) < T_measure2 Q \<pi>


proof (prove)
goal (1 subgoal):
 1. Ord i \<Longrightarrow> Goedel_I.HF i = W i


proof (prove)
using this:
  set (coeffs (\<Prod>(x, i)\<leftarrow>xis. [:- x, 1:] ^ Suc i))
  \<subseteq> \<real>

goal (1 subgoal):
 1. map_poly Re (\<Prod>(x, i)\<leftarrow>xis. [:- x, 1:] ^ Suc i) =
    (\<Prod>(q,
        i)\<leftarrow>complex_roots_to_real_factorization xis. q ^ i) \<and>
    ((q, j)
     \<in> set (complex_roots_to_real_factorization xis) \<longrightarrow>
     irreducible q \<and>
     j \<noteq> 0 \<and> monic q \<and> degree q \<in> {1, 2})


proof (prove)
using this:
  trg g = src f
  src g = trg f
  trg g' = src f
  src g' = trg f
  \<guillemotleft>\<eta>' : src f \<rightarrow> src f\<guillemotright>
  \<guillemotleft>\<eta>' : src f \<Rightarrow> g' \<star>
          f\<guillemotright>
  \<guillemotleft>\<epsilon>' : trg f \<rightarrow> trg f\<guillemotright>
  \<guillemotleft>\<epsilon>' : f \<star>
                                g' \<Rightarrow> trg f\<guillemotright>
  \<lbrakk>arr ?f; cod ?f = ?b\<rbrakk> \<Longrightarrow> ?b \<cdot> ?f = ?f

goal (1 subgoal):
 1. (g' \<star> \<epsilon>') \<cdot>
    ((g' \<star> f) \<star> g') \<cdot> (\<eta>' \<star> g') =
    (g' \<star> \<epsilon>') \<cdot> (\<eta>' \<star> g')


proof (state)
this:
  e \<in> funcset UNIV {- 1..1}
  x = aform_val e X
  y = aform_val e Y

goal (1 subgoal):
 1. f x y \<in> Affine (F d X Y)


proof (prove)
using this:
  \<lbrakk>x = ?\<Gamma>';
   xa = ?e1.0 \<guillemotleft>?bop\<guillemotright> ?e2.0; xb = High;
   ?\<Gamma>' \<turnstile> ?e1.0 : High;
   ?\<Gamma>' \<turnstile> ?e2.0 : High\<rbrakk>
  \<Longrightarrow> thesis
  \<lbrakk>x = ?\<Gamma>';
   xa = ?e1.0 \<guillemotleft>?bop\<guillemotright> ?e2.0; xb = High;
   ?\<Gamma>' \<turnstile> ?e1.0 : Low;
   ?\<Gamma>' \<turnstile> ?e2.0 : High\<rbrakk>
  \<Longrightarrow> thesis
  x = \<Gamma>
  xa = e1 \<guillemotleft>bop\<guillemotright> e2
  xb = High
  \<Gamma> \<turnstile> e1 : lev
  \<Gamma> \<turnstile> e2 : High

goal (1 subgoal):
 1. thesis


proof (chain)
picking this:
  At = Eq p


proof (prove)
using this:
  \<forall>i u.
     k + k' \<le> i \<and>
     (P \<W> Q) (stake i \<sigma> @- u) \<longrightarrow>
     (\<exists>m\<le>k.
         Q (\<sigma>(m \<rightarrow> i - m) @- u) \<and>
         (\<forall>p<m. P (\<sigma>(p \<rightarrow> i - p) @- u)))

goal (1 subgoal):
 1. \<forall>i.
       \<exists>n\<ge>i.
          \<exists>m\<le>k.
             \<exists>u.
                Q (\<sigma>(m \<rightarrow> n - m) @- u) \<and>
                (\<forall>p<m. P (\<sigma>(p \<rightarrow> n - p) @- u))


proof (prove)
using this:
  t \<in> SPR.jkbpC
  x \<in> rel_ext
           (\<lambda>uu_.
               \<exists>t'.
                  uu_ = (tFirst t', tLast t') \<and>
                  t' \<in> SPR.jkbpC \<and> spr_jview a t' = spr_jview a t)
  y \<in> rel_ext
           (\<lambda>uu_.
               \<exists>t'.
                  uu_ = (tFirst t', tLast t') \<and>
                  t' \<in> SPR.jkbpC \<and> spr_jview a t' = spr_jview a t)

goal (1 subgoal):
 1. (x, y)
    \<in> rel_ext
           (\<lambda>((u, v), u', v').
               envObs a u = envObs a u' \<and> envObs a v = envObs a v')


proof (prove)
goal (1 subgoal):
 1. (R \<union> R') `` X \<subseteq> X \<Longrightarrow>
    SN_on (R \<union> R') X =
    (SN_on (R'\<^sup>* O R O R'\<^sup>*) X \<and> SN_on R' X)


proof (prove)
goal (1 subgoal):
 1. Set.is_empty (DList_set dxs) =
    (case ID CEQ('a) of
     None \<Rightarrow>
       Code.abort STR ''is_empty DList_set: ceq = None''
        (\<lambda>_. Set.is_empty (DList_set dxs))
     | Some x \<Rightarrow> DList_Set.null dxs)


proof (prove)
using this:
  evaluate True env s e' (s', r)

goal (1 subgoal):
 1. \<exists>s' r. evaluate True env s (Raise e') (s', r)


proof (chain)
picking this:
  w \<le> T


proof (prove)
goal (1 subgoal):
 1. \<And>i.
       (f (Suc (j_of ((j_of ^^ i) 0))), f (Suc ((j_of ^^ i) 0))) \<in> R


proof (prove)
using this:
  \<lbrakk>ys \<in> set (subseqs xs); distinct xs\<rbrakk>
  \<Longrightarrow> sorted_on (linord_of_list (rev xs)) ys
  y # ys \<in> set (subseqs xs)
  distinct xs
  \<lbrakk>distinct (rev xs);
   Field (linord_of_list (rev xs)) = set (rev xs)\<rbrakk>
  \<Longrightarrow> Linear_order (linord_of_list (rev xs))

goal (1 subgoal):
 1. sorted_on (linord_of_list (rev xs)) (y # ys)


proof (prove)
using this:
  \<forall>x\<in>A. x \<sqsubseteq> t
  t \<in> A

goal (1 subgoal):
 1. extremed A (\<sqsubseteq>)


proof (prove)
goal (1 subgoal):
 1. \<And>mem.
       \<lbrakk>\<forall>mem.
                   locally_sound_mode_use
                    \<langle>(x \<leftarrow> e) \<otimes>
                             annos, mds\<^sub>2, mem\<rangle>;
        \<langle>Stop, mds\<^sub>2', mem'\<rangle>
        \<in> loc_reach
               \<langle>(x \<leftarrow> e) \<otimes>
                        annos, mds\<^sub>2, mem\<rangle>\<rbrakk>
       \<Longrightarrow> mds\<^sub>2' \<sqsubseteq> mds \<oplus> annos


proof (prove)
goal (1 subgoal):
 1. \<exists>(c, s)\<in>set (uset p).
       \<lparr>c\<rparr>\<^sub>p\<^bsup>vs\<^esup> < (0::'a) \<and>
       - Itm vs (x # bs) s
       \<le> \<lparr>c\<rparr>\<^sub>p\<^bsup>vs\<^esup> * x \<or>
       (0::'a) < \<lparr>c\<rparr>\<^sub>p\<^bsup>vs\<^esup> \<and>
       \<lparr>c\<rparr>\<^sub>p\<^bsup>vs\<^esup> * x
       \<le> - Itm vs (x # bs) s


proof (prove)
goal (1 subgoal):
 1. \<And>l r n.
       \<exists>k. (l, r) = (Bk \<up> k, <0>) \<Longrightarrow>
       \<not> is_final (steps0 (1, l, r) dither n)


proof (prove)
goal (1 subgoal):
 1. z \<in> \<int>\<^sub>\<le>\<^sub>0 \<Longrightarrow>
    Gamma_series z \<longlonglongrightarrow> (0::'a)


proof (prove)
goal (1 subgoal):
 1. \<pi> \<bullet> (if \<Gamma> = [] then e else Let \<Gamma> e) =
    (if \<pi> \<bullet> \<Gamma> = [] then \<pi> \<bullet> e
     else Let (\<pi> \<bullet> \<Gamma>) (\<pi> \<bullet> e))


proof (state)
goal (1 subgoal):
 1. [A,e,B]\<^bsub>T\<^esub> = [A,d,B]\<^bsub>T\<^esub>


proof (prove)
using this:
  x\<^sub>C \<in> (mdss ! i) AsmNoWrite
  priv_is_asm_priv mdss \<and>
  priv_is_guar_priv mdss \<and>
  new_asms_only_for_priv mdss \<and>
  (\<forall>i<length cms.
      (mdss ! i) AsmNoWrite \<inter> - range var\<^sub>C_of = {})
  x\<^sub>C \<in> - range var\<^sub>C_of
  i < length (conc.restrict_modes mdss (- range var\<^sub>C_of))
  length (conc.restrict_modes ?mdss ?X) = length ?mdss
  length mdss = length cms

goal (1 subgoal):
 1. False


proof (prove)
using this:
  d' = 0 \<and> e \<noteq> 0 \<Longrightarrow>
  \<exists>(a', b', c')\<in>set b.
     (a' = 0 \<and> b' \<noteq> 0) \<and>
     (\<forall>(d, e, f)\<in>set a.
         \<exists>y'>- c' / b'.
            \<forall>x\<in>{- c' / b'<..y'}.
               d * x\<^sup>2 + e * x + f = 0) \<and>
     (\<forall>(d, e, f)\<in>set b.
         \<exists>y'>- c' / b'.
            \<forall>x\<in>{- c' / b'<..y'}.
               d * x\<^sup>2 + e * x + f < 0) \<and>
     (\<forall>(d, e, f)\<in>set c.
         \<exists>y'>- c' / b'.
            \<forall>x\<in>{- c' / b'<..y'}.
               d * x\<^sup>2 + e * x + f \<le> 0) \<and>
     (\<forall>(d, e, f)\<in>set d.
         \<exists>y'>- c' / b'.
            \<forall>x\<in>{- c' / b'<..y'}.
               d * x\<^sup>2 + e * x + f \<noteq> 0)
  \<not> (\<exists>(a', b', c')\<in>set b.
             (a' = 0 \<and> b' \<noteq> 0) \<and>
             (\<forall>(d, e, f)\<in>set a.
                 \<exists>y'>- c' / b'.
                    \<forall>x\<in>{- c' / b'<..y'}.
                       d * x\<^sup>2 + e * x + f = 0) \<and>
             (\<forall>(d, e, f)\<in>set b.
                 \<exists>y'>- c' / b'.
                    \<forall>x\<in>{- c' / b'<..y'}.
                       d * x\<^sup>2 + e * x + f < 0) \<and>
             (\<forall>(d, e, f)\<in>set c.
                 \<exists>y'>- c' / b'.
                    \<forall>x\<in>{- c' / b'<..y'}.
                       d * x\<^sup>2 + e * x + f \<le> 0) \<and>
             (\<forall>(d, e, f)\<in>set d.
                 \<exists>y'>- c' / b'.
                    \<forall>x\<in>{- c' / b'<..y'}.
                       d * x\<^sup>2 + e * x + f \<noteq> 0))

goal (1 subgoal):
 1. d' = 0 \<and> e \<noteq> 0 \<Longrightarrow> False


proof (prove)
using this:
  lead_coeff
   (map2 (\<oplus>) p1 (replicate (length p1 - length p2) \<zero> @ p2)) =
  lead_coeff p1 \<oplus>
  lead_coeff (replicate (length p1 - length p2) \<zero> @ p2)
  lead_coeff p1 \<in> carrier R
  length p2 < length p1

goal (1 subgoal):
 1. lead_coeff
     (map2 (\<oplus>) p1 (replicate (length p1 - length p2) \<zero> @ p2)) =
    lead_coeff p1


proof (prove)
goal (1 subgoal):
 1. F \<squnion> G \<in> UNIV \<inter> A \<longmapsto> B


proof (state)
goal (1 subgoal):
 1. P


proof (prove)
goal (1 subgoal):
 1. even (sum_list (map f xs)) = even (sum_list (map g xs))


proof (prove)
goal (1 subgoal):
 1. set {\<langle>0\<^sub>\<nat>, a\<rangle>,
         \<langle>1\<^sub>\<nat>, b\<rangle>}
    \<in>\<^sub>\<circ> vproduct (set {[]\<^sub>\<circ>, 1\<^sub>\<nat>})
                         f \<Longrightarrow>
    \<langle>a, b\<rangle>
    \<in>\<^sub>\<circ> f (0\<^sub>\<nat>) \<times>\<^sub>\<circ>
                        f (1\<^sub>\<nat>)


proof (chain)
picking this:
  SecurityInvariant_preliminaries sinvar_spec


proof (state)
this:
  C = D @ [(l, u)]
  D \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta> = B
  [(l, u)] \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta> = [(l, s')]

goal (1 subgoal):
 1. \<exists>l B s'.
       (l, s) =
       dual\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p
        ((l, s') \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p
         \<theta>) \<and>
       prefix
        ((B \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>) @
         [(l, s') \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p \<theta>])
        (A \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t \<theta>)


proof (prove)
using this:
  example.is_valid_state_id (PeerA, 3)
  example.is_valid_state_id (PeerB, 3)
  set (example.received_messages (PeerA, 3)) =
  set (example.received_messages (PeerB, 3))

goal (1 subgoal):
 1. example.state (PeerA, 3) = example.state (PeerB, 3)


proof (prove)
goal (1 subgoal):
 1. Fvars (psubst \<phi> txs) =
    Fvars \<phi> - snd ` set txs \<union>
    \<Union>
     {if x \<in> Fvars \<phi> then FvarsT t else {} |t x.
      (t, x) \<in> set txs}


proof (prove)
using this:
  p = p1 @ (a, w) # (w, b) # p2
  (a, b) = (u, v) \<or> (a, b) = (v, u)

goal (1 subgoal):
 1. co_path (u, v) w ((a, w) # (w, b) # p2) = (a, b) # co_path (u, v) w p2


proof (prove)
goal (1 subgoal):
 1. (LEAST n. A $ i $ n \<noteq> (0::'a))
    < (LEAST n. A $ (i + (1::'rows)) $ n \<noteq> (0::'a))


proof (prove)
goal (1 subgoal):
 1. (any, replicate n False) \<in> (set \<circ> \<sigma> \<Sigma>) n


proof (prove)
goal (1 subgoal):
 1. cmod (f z) \<le> exp (cmod (complex_of_real pi * h z))


proof (prove)
goal (1 subgoal):
 1. \<forall>a\<in>set as.
       hd_coeff a \<noteq> 0 \<and> divisor a \<noteq> 0 \<Longrightarrow>
    Z.normal ((qe_pres\<^sub>1 \<circ> hd_coeffs1) as)


proof (prove)
goal (1 subgoal):
 1. list_of_lazy_sequence hit_bound = [None]


proof (prove)
goal (3 subgoals):
 1. hs_dfs_\<alpha> ` wa_initial (det_wa_wa (hs_dfs_dwa \<Sigma>i post))
    \<subseteq> wa_initial (dfs_algo (hs.\<alpha> \<Sigma>i) (hs_R post))
 2. hs_dfs_\<alpha> ` wa_invar (det_wa_wa (hs_dfs_dwa \<Sigma>i post))
    \<subseteq> wa_invar (dfs_algo (hs.\<alpha> \<Sigma>i) (hs_R post))
 3. \<forall>s.
       s \<in> wa_invar (det_wa_wa (hs_dfs_dwa \<Sigma>i post)) \<and>
       hs_dfs_\<alpha> s
       \<in> wa_cond
              (dfs_algo (hs.\<alpha> \<Sigma>i)
                (hs_R post)) \<longrightarrow>
       s \<in> wa_cond (det_wa_wa (hs_dfs_dwa \<Sigma>i post))


proof (prove)
goal (1 subgoal):
 1. \<exists>t x.
       thr s t = \<lfloor>(x, no_wait_locks)\<rfloor> \<and>
       wset s t = None \<and> \<tau>diverge t (x, shr s)


proof (prove)
using this:
  \<not> lfinite P
  \<lbrakk>\<not> lfinite ?P; lset ?P \<subseteq> S; valid_path ?P;
   path_conforms_with_strategy p ?P well_ordered_strategy\<rbrakk>
  \<Longrightarrow> \<exists>n.
                       \<forall>m\<ge>n.
                          path_strategies ?P $ n = path_strategies ?P $ m
  lset P \<subseteq> S
  valid_path P
  path_conforms_with_strategy p P well_ordered_strategy

goal (1 subgoal):
 1. (\<And>n.
        (\<And>m.
            n \<le> m \<Longrightarrow>
            path_strategies P $ n = path_strategies P $ m) \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. foldr (\<lambda>xs. max (length xs)) xss 0 =
    foldr (\<lambda>x. max (length x))
     (filter (\<lambda>ys. ys \<noteq> []) xss) 0


proof (prove)
goal (1 subgoal):
 1. kbo_std ground_heads_var (>\<^sub>s) \<epsilon> 0 extf
     (\<lambda>_. \<infinity>) (\<lambda>_. \<infinity>) wt_sym


proof (prove)
goal (1 subgoal):
 1. \<^bold>g [^] (n * int (order G)) = (\<^bold>g [^] order G) [^] n


proof (prove)
using this:
  qGood qX
  (qX, qY) \<in> {(qY, qY') |qY qY'. (asTerm qY, asTerm qY') \<in> rel}
  good (asTerm ?qX) = qGood ?qX
  qGood ?qX \<Longrightarrow> pick (asTerm ?qX) #= ?qX
  \<lbrakk>good ?X90; (?X90, ?Y90) \<in> rel\<rbrakk>
  \<Longrightarrow> good ?Y90 \<and> skel ?Y90 = skel ?X90
  qGood ?qX \<Longrightarrow> skel (asTerm ?qX) = qSkel ?qX

goal (1 subgoal):
 1. qGood qY \<and> qSkel qY = qSkel qX


proof (prove)
using this:
  p \<noteq> q
  a \<noteq> p
  a \<noteq> q
  proj2_Col p q a

goal (1 subgoal):
 1. cross_ratio p q a b = 1


proof (prove)
goal (1 subgoal):
 1. partial_function_definitions Heap_ord Heap_lub &&&
    Heap_lub {} \<equiv> Heap Map.empty


proof (prove)
using this:
  list_all (eval e f g) G \<longrightarrow>
  eval (e\<langle>0:z\<rangle>) f g a
  G \<turnstile> Exists a
  \<forall>e f g.
     list_all (eval e f g) G \<longrightarrow> eval e f g (Exists a)
  a[App n []/0] # G \<turnstile> b
  \<forall>e f g.
     list_all (eval e f g) (a[App n []/0] # G) \<longrightarrow>
     eval e f g b
  list_all (\<lambda>p. n \<notin> params p) G
  n \<notin> params a
  n \<notin> params b

goal (1 subgoal):
 1. list_all (eval e (f(n := \<lambda>x. z)) g) G \<longrightarrow>
    eval e (f(n := \<lambda>x. z)) g b


proof (prove)
goal (1 subgoal):
 1. x = 0


proof (chain)
picking this:
  j = i \<and> i \<notin> set js \<or> i \<noteq> j \<and> i \<in> set js


proof (prove)
goal (1 subgoal):
 1. (?fi1, cp_array)
    \<in> (array_assn
            nat_assn)\<^sup>k \<rightarrow>\<^sub>a array_assn nat_assn


proof (prove)
using this:
  a \<in>\<^sub>\<circ> \<AA>\<lparr>Obj\<rparr>

goal (1 subgoal):
 1. (\<NN> \<circ>\<^sub>T\<^sub>D\<^sub>G\<^sub>H\<^sub>M\<^sub>-\<^sub>D\<^sub>G\<^sub>H\<^sub>M
     dghm_id \<AA>)\<lparr>NTMap\<rparr>\<lparr>a\<rparr> =
    \<NN>\<lparr>NTMap\<rparr>\<lparr>a\<rparr>


proof (prove)
using this:
  te q (i + 1) \<le> t
  correct p t
  correct q t
  \<lbrakk>?s \<le> ?t; correct ?p ?t; correct ?q ?t\<rbrakk>
  \<Longrightarrow> \<bar>IC ?p ?i ?t - IC ?q ?j ?t\<bar>
                    \<le> \<bar>IC ?p ?i ?s - IC ?q ?j ?s\<bar> +
                          2 * \<rho> * (?t - ?s)

goal (1 subgoal):
 1. \<bar>IC p i t - IC q (i + 1) t\<bar>
    \<le> \<bar>IC p i (te q (i + 1)) - IC q (i + 1) (te q (i + 1))\<bar> +
          2 * \<rho> * (t - te q (i + 1))


proof (prove)
goal (1 subgoal):
 1. F' = hensel_fpxs1 * hensel_fpxs2


proof (prove)
goal (1 subgoal):
 1. (uncurry2 full_checker_l_impl,
     uncurry2 (\<lambda>spec A _. PAC_checker_specification spec A))
    \<in> full_poly_assn\<^sup>k *\<^sub>a
          full_poly_input_assn\<^sup>d *\<^sub>a
          fully_pac_assn\<^sup>k \<rightarrow>\<^sub>a hr_comp
                  (code_status_assn \<times>\<^sub>a
                   full_vars_assn \<times>\<^sub>a
                   hr_comp polys_assn
                    (\<langle>nat_rel,
                     sorted_poly_rel O mset_poly_rel\<rangle>fmap_rel))
                  {((st, G), st', G').
                   st = st' \<and>
                   (st \<noteq> FAILED \<longrightarrow>
                    (G, G') \<in> Id \<times>\<^sub>r polys_rel)}


proof (prove)
goal (1 subgoal):
 1. enc_respects_binary_pred Pred = rel_respects_binary_pred indRelR Pred


proof (chain)
picking this:
  p = smult c (\<Prod>(x, i)\<leftarrow>xis. [:- x, 1:] ^ Suc i)


proof (prove)
using this:
  (?x = ?y) =
  (Ree ?x = Ree ?y \<and>
   Im1 ?x = Im1 ?y \<and>
   Im2 ?x = Im2 ?y \<and>
   Im3 ?x = Im3 ?y \<and>
   Im4 ?x = Im4 ?y \<and>
   Im5 ?x = Im5 ?y \<and> Im6 ?x = Im6 ?y \<and> Im7 ?x = Im7 ?y)
  (\<bullet>) = (*)
  ln (1::?'a) = (0::?'a)
  of_real ?x \<bullet> (1::?'a) = ?x

goal (1 subgoal):
 1. Octonions.cnj (r *\<^sub>R x) = r *\<^sub>R Octonions.cnj x


proof (chain)
picking this:
  dim_col x = dim_row x
  \<lbrakk>x * ?B = 1\<^sub>m (dim_row x);
   ?B * x = 1\<^sub>m (dim_row ?B)\<rbrakk>
  \<Longrightarrow> \<exists>A'.
                       y ** A' = mat (1::'a) \<and> A' ** y = mat (1::'a)
  \<lbrakk>y ** ?A' = mat (1::'a); ?A' ** y = mat (1::'a)\<rbrakk>
  \<Longrightarrow> \<exists>B.
                       x * B = 1\<^sub>m (dim_row x) \<and>
                       B * x = 1\<^sub>m (dim_row B)


proof (prove)
goal (1 subgoal):
 1. \<I>1 \<oplus>\<^sub>\<I> \<I>2,
    \<I>1' \<oplus>\<^sub>\<I> \<I>2' \<turnstile>\<^sub>C
    map_converter id id (map_sum f1 f2) (map_sum g1 g2) 1\<^sub>C \<surd>


proof (prove)
goal (1 subgoal):
 1. B abs_summable_on I


proof (prove)
using this:
  cmod (croot n x) ^ n = cmod y ^ n
  n \<noteq> 0

goal (1 subgoal):
 1. cmod (croot n x) = cmod y


proof (prove)
goal (1 subgoal):
 1. (sfilter P s = x ## s') =
    (P x \<and>
     ((\<lambda>xs. \<not> holds P xs) suntil
      (\<lambda>xs.
          HLD {x} xs \<and> nxt (\<lambda>s. sfilter P s = s') xs))
      s)


proof (prove)
goal (1 subgoal):
 1. refl Le


proof (prove)
using this:
  \<lbrakk>r k (1 $ 0) ^ k = 1 $ 0; r k (a $ 0) ^ k = a $ 0;
   1 $ 0 \<noteq> (0::'a); a $ 0 \<noteq> (0::'a)\<rbrakk>
  \<Longrightarrow> (r k (1 $ 0 / a $ 0) = r k (1 $ 0) / r k (a $ 0)) =
                    (fps_radical r k (1 / a) =
                     fps_radical r k 1 / fps_radical r k a)
  r k (a $ 0) ^ k = a $ 0
  r k (1::'a) ^ k = (1::'a)
  a $ 0 \<noteq> (0::'a)

goal (1 subgoal):
 1. (r k (inverse (a $ 0)) = r k (1::'a) / r k (a $ 0)) =
    (fps_radical r k (inverse a) = fps_radical r k 1 / fps_radical r k a)


proof (prove)
using this:
  card {1, 2} = 2

goal (1 subgoal):
 1. 2 \<le> card (Units (residue_ring (p ^ n)))


proof (prove)
goal (1 subgoal):
 1. local.iso (\<rr> (local.dom \<lbrace>t\<rbrace>))


proof (prove)
goal (1 subgoal):
 1. 2 * spmf (P1_game_alt m1 m2 D) True - 1 =
    spmf
     (R1 m1 m2 \<bind>
      (\<lambda>rview.
          D rview \<bind> (\<lambda>b'. return_spmf (True = b'))))
     True -
    (1 -
     spmf
      (funct m1 m2 \<bind>
       (\<lambda>(out1, out2).
           S1 m1 out1 \<bind>
           (\<lambda>sview.
               D sview \<bind> (\<lambda>b'. return_spmf (False = b')))))
      True)


proof (prove)
goal (1 subgoal):
 1. fUnionM ((\<lambda>x. ask (\<lambda>r. run_nondet (f x r))) |`| A) =
    ask (\<lambda>r. fUnionM ((\<lambda>x. run_nondet (f x r)) |`| A))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>StableNoDecomp.stable_pair_on UNIV (XD, XH);
     XD = {Xd1, Xd1', Xd2, Xd2'} \<or>
     XD = {Xd1, Xd1', Xd2} \<or>
     XD = {Xd1, Xd1', Xd2'} \<or>
     XD = {Xd1, Xd1'} \<or>
     XD = {Xd1, Xd2, Xd2'} \<or>
     XD = {Xd1, Xd2} \<or>
     XD = {Xd1, Xd2'} \<or>
     XD = {Xd1} \<or>
     XD = {Xd1', Xd2, Xd2'} \<or>
     XD = {Xd1', Xd2} \<or>
     XD = {Xd1', Xd2'} \<or>
     XD = {Xd1'} \<or>
     XD = {Xd2, Xd2'} \<or> XD = {Xd2} \<or> XD = {Xd2'} \<or> XD = {};
     XH = {Xd1, Xd1', Xd2, Xd2'} \<or>
     XH = {Xd1, Xd1', Xd2} \<or>
     XH = {Xd1, Xd1', Xd2'} \<or>
     XH = {Xd1, Xd1'} \<or>
     XH = {Xd1, Xd2, Xd2'} \<or>
     XH = {Xd1, Xd2} \<or>
     XH = {Xd1, Xd2'} \<or>
     XH = {Xd1} \<or>
     XH = {Xd1', Xd2, Xd2'} \<or>
     XH = {Xd1', Xd2} \<or>
     XH = {Xd1', Xd2'} \<or>
     XH = {Xd1'} \<or>
     XH = {Xd2, Xd2'} \<or>
     XH = {Xd2} \<or> XH = {Xd2'} \<or> XH = {}\<rbrakk>
    \<Longrightarrow> XD = {} \<and> XH = {Xd1, Xd1', Xd2, Xd2'}


proof (prove)
using this:
  x \<in> orbit f a
  f x \<in> orbit f b
  y \<in> segment f b (f x)

goal (1 subgoal):
 1. x \<in> orbit f b


proof (prove)
using this:
  f = Insert x

goal (1 subgoal):
 1. t\<^sub>s f s + \<Phi>\<^sub>d (nxt f s) - \<Phi>\<^sub>d s
    \<le> (case s of
           (t, uu_) \<Rightarrow>
             case f of
             Insert x \<Rightarrow> (6 * e + 2) * real (height t + 1) + 1
             | Delete x \<Rightarrow>
                 (6 * e + 1) * real (height t) + 4 / cd + 4)


proof (prove)
using this:
  \<forall>p2\<in>carrier.
     \<exists>\<psi>.
        \<psi> \<in> atlas \<and>
        codomain \<psi> = ball (0::'b) 3 \<and>
        (\<exists>c\<in>I. domain \<psi> \<subseteq> \<X> c) \<and>
        (\<forall>j.
            p2 \<in> V j \<longrightarrow>
            domain \<psi> \<subseteq> V j) \<and>
        p2 \<in> domain \<psi> \<and> apply_chart \<psi> p2 = (0::'b)

goal (1 subgoal):
 1. (\<And>\<psi>.
        \<lbrakk>\<And>p.
                    p \<in> carrier \<Longrightarrow>
                    codomain (\<psi> p) = ball (0::'b) 3;
         \<And>p.
            p \<in> carrier \<Longrightarrow>
            \<exists>c\<in>I. domain (\<psi> p) \<subseteq> \<X> c;
         \<And>p j.
            p \<in> V j \<Longrightarrow> domain (\<psi> p) \<subseteq> V j;
         \<And>p j.
            p \<in> carrier \<Longrightarrow> p \<in> domain (\<psi> p);
         \<And>p.
            p \<in> carrier \<Longrightarrow>
            apply_chart (\<psi> p) p = (0::'b);
         \<And>p.
            p \<in> carrier \<Longrightarrow> \<psi> p \<in> atlas\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. (\<And>C'. A' B' Perp C' B' \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. (\<Sum>a\<in>#A. image_mset (Pair a) (B a + C a)) =
    (\<Sum>a\<in>#A. image_mset (Pair a) (B a)) +
    (\<Sum>a\<in>#A. image_mset (Pair a) (C a))


proof (prove)
goal (1 subgoal):
 1. \<forall>i\<in>elts n.
       (xs #\<^sub>\<circ> x)\<lparr>i\<rparr> \<in>\<^sub>\<circ> A i


proof (state)
this:
  Well_order s
  Well_order t
  embedS s t f

goal (1 subgoal):
 1. r *o s <o r *o t


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<notin> F; y \<notin> F\<rbrakk>
    \<Longrightarrow> (if x \<squnion> y \<in> F then top else bot) =
                      (if x \<in> F then top else bot) \<squnion>
                      (if y \<in> F then top else bot)


proof (prove)
goal (1 subgoal):
 1. insert (u IN Eats t z) H \<turnstile> C


proof (prove)
using this:
  type_wf h2
  \<lbrakk>\<And>h h' w.
              \<lbrakk>w \<in> set_val_locs new_character_data_ptr;
               h \<turnstile> w \<rightarrow>\<^sub>h h'\<rbrakk>
              \<Longrightarrow> type_wf h \<longrightarrow> type_wf h';
   reflp (\<lambda>h h'. type_wf h \<longrightarrow> type_wf h');
   transp (\<lambda>h h'. type_wf h \<longrightarrow> type_wf h')\<rbrakk>
  \<Longrightarrow> type_wf h2 \<longrightarrow> type_wf h3

goal (1 subgoal):
 1. type_wf h3


proof (prove)
using this:
  v \<in> V
  polymap (pCons a p) v =
  lincomb' (coeffs (pCons a p))
   (v #
    map (\<lambda>S. S v)
     (map ((\<circ>) T) (map endpow [0..<Suc (degree p)])))

goal (1 subgoal):
 1. polymap (pCons a p) v =
    lincomb' (coeffs (pCons a p))
     (map (\<lambda>S. S v)
       (id \<down> V # map ((\<circ>) T) (map endpow [0..<Suc (degree p)])))


proof (prove)
goal (1 subgoal):
 1. rec_exec
     (rec_embranch
       (zip [Cn 3 rec_newleft0 [recf.id 3 0, recf.id 3 1],
             Cn 3 rec_newleft2 [recf.id 3 0, recf.id 3 1],
             Cn 3 rec_newleft3 [recf.id 3 0, recf.id 3 1], recf.id 3 0]
         [Cn 3 rec_disj
           [Cn 3 rec_eq [recf.id 3 2, Cn 3 (constn 0) [recf.id 3 0]],
            Cn 3 rec_eq [recf.id 3 2, Cn 3 (constn 1) [recf.id 3 0]]],
          Cn 3 rec_eq [recf.id 3 2, Cn 3 (constn 2) [recf.id 3 0]],
          Cn 3 rec_eq [recf.id 3 2, Cn 3 (constn 3) [recf.id 3 0]],
          Cn 3 rec_less [Cn 3 (constn 3) [recf.id 3 0], recf.id 3 2]]))
     [p, r, a] =
    Embranch
     (zip (map rec_exec
            [Cn 3 rec_newleft0 [recf.id 3 0, recf.id 3 1],
             Cn 3 rec_newleft2 [recf.id 3 0, recf.id 3 1],
             Cn 3 rec_newleft3 [recf.id 3 0, recf.id 3 1], recf.id 3 0])
       (map (\<lambda>r args. 0 < rec_exec r args)
         [Cn 3 rec_disj
           [Cn 3 rec_eq [recf.id 3 2, Cn 3 (constn 0) [recf.id 3 0]],
            Cn 3 rec_eq [recf.id 3 2, Cn 3 (constn 1) [recf.id 3 0]]],
          Cn 3 rec_eq [recf.id 3 2, Cn 3 (constn 2) [recf.id 3 0]],
          Cn 3 rec_eq [recf.id 3 2, Cn 3 (constn 3) [recf.id 3 0]],
          Cn 3 rec_less [Cn 3 (constn 3) [recf.id 3 0], recf.id 3 2]]))
     [p, r, a]


proof (prove)
goal (1 subgoal):
 1. cost
     (if i = 0 then ((True, Suc i, inc_state state), 0)
      else let (state', cost_add) = (state', c_add); di = d_state state' i;
               dsi = d_state state' (Suc i); dim1 = d_state state' (i - 1);
               (num, denom) = quotient_of \<alpha>;
               cond = di * di * denom \<le> num * dim1 * dsi; local_cost = 5
           in if cond
              then ((True, Suc i, inc_state state'), local_cost + cost_add)
              else case basis_reduction_swap_cost i state' of
                   (res, cost_swap) \<Rightarrow>
                     (res, local_cost + cost_swap + cost_add))
    \<le> body_cost


proof (prove)
using this:
  \<exists>n.
     Bernstein_Poly x p c d = Bernstein_Poly n p c d \<and> n \<le> p

goal (1 subgoal):
 1. Bernstein_Poly x p c d
    \<in> poly_vs.span {Bernstein_Poly n p c d |n. n \<le> p}


proof (state)
this:
  \<forall>A\<in>set (map wordinterval_to_set V).
     \<forall>a1\<in>A. \<forall>a2\<in>A. same_fw_behaviour_one a1 a2 c rs

goal (1 subgoal):
 1. V \<in> set (groupWIs c rs) \<Longrightarrow>
    \<forall>w1\<in>set V.
       \<forall>w2\<in>set V.
          \<forall>a1\<in>wordinterval_to_set w1.
             \<forall>a2\<in>wordinterval_to_set w2.
                same_fw_behaviour_one a1 a2 c rs


proof (prove)
goal (2 subgoals):
 1. interfree_aux (Some Mutator, \<lbrace>False\<rbrace>, Some Collector)
 2. OG_Hoare.post (Some Mutator, \<lbrace>False\<rbrace>) \<inter>
    (OG_Hoare.post (Some Collector, \<lbrace>False\<rbrace>) \<inter>
     \<lbrace>\<forall>i.
                 False \<longrightarrow>
                 \<acute>(\<in>)
                  (OG_Hoare.post ((Collector
                                   \<lbrace>False\<rbrace>
                                   \<parallel>
                                   Mutator
                                   \<lbrace>False\<rbrace>) !
                                  i))\<rbrace>)
    \<subseteq> \<lbrace>False\<rbrace>


proof (prove)
using this:
  Arr v1 \<and>
  \<^bold>\<langle>C.dom (un_Prim t1)\<^bold>\<rangle> = Cod v1
  t1 = \<^bold>\<langle>un_Prim t1\<^bold>\<rangle> \<and>
  C.arr (un_Prim t1) \<and> Diag t1
  Diag t2 \<and> t2 \<noteq> \<^bold>\<I>
  v1 = \<^bold>\<langle>un_Prim v1\<^bold>\<rangle> \<and>
  C.arr (un_Prim v1) \<and> Diag v1
  Diag v2 \<and> v2 \<noteq> \<^bold>\<I>
  Diag u
  Diag w
  Seq u w
  u \<noteq> \<^bold>\<I>
  \<lbrakk>Diag ?t; Diag ?u; Dom ?t = Cod ?u\<rbrakk>
  \<Longrightarrow> Diag
                     (?t \<^bold>\<lfloor>\<^bold>\<cdot>\<^bold>\<rfloor>
                      ?u)
  \<lbrakk>Diag ?t; Diag ?u; Dom ?t = Cod ?u\<rbrakk>
  \<Longrightarrow> Dom (?t \<^bold>\<lfloor>\<^bold>\<cdot>\<^bold>\<rfloor>
                         ?u) =
                    Dom ?u
  \<lbrakk>Diag ?t; Diag ?u; Dom ?t = Cod ?u\<rbrakk>
  \<Longrightarrow> Cod (?t \<^bold>\<lfloor>\<^bold>\<cdot>\<^bold>\<rfloor>
                         ?u) =
                    Cod ?t
  \<lbrakk>Diag ?t; Diag ?u\<rbrakk>
  \<Longrightarrow> Diag
                     (?t \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
                      ?u)
  \<lbrakk>Diag ?t; Diag ?u\<rbrakk>
  \<Longrightarrow> Dom (?t \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
                         ?u) =
                    Dom ?t \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
                    Dom ?u
  \<lbrakk>Diag ?t; Diag ?u\<rbrakk>
  \<Longrightarrow> Cod (?t \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
                         ?u) =
                    Cod ?t \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
                    Cod ?u
  ?t \<noteq> \<^bold>\<I> \<Longrightarrow>
  \<^bold>\<langle>?f\<^bold>\<rangle> \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
  ?t =
  \<^bold>\<langle>?f\<^bold>\<rangle> \<^bold>\<otimes> ?t

goal (1 subgoal):
 1. u \<^bold>\<lfloor>\<^bold>\<cdot>\<^bold>\<rfloor> w \<noteq>
    \<^bold>\<I>


proof (prove)
using this:
  \<Gamma>,\<gamma>,p\<turnstile>\<^sub>g \<langle>r #
             rs, s\<rangle> \<Rightarrow> t

goal (1 subgoal):
 1. \<lbrakk>\<And>ti.
                \<lbrakk>\<Gamma>,\<gamma>,p\<turnstile>\<^sub>g \<langle>[r], s\<rangle> \<Rightarrow> ti;
                 \<Gamma>,\<gamma>,p\<turnstile>\<^sub>g \<langle>rs, ti\<rangle> \<Rightarrow> t;
                 no_matching_Goto \<gamma> p [r]\<rbrakk>
                \<Longrightarrow> thesis;
     \<lbrakk>\<Gamma>,\<gamma>,p\<turnstile>\<^sub>g \<langle>[r], s\<rangle> \<Rightarrow> t;
      \<not> no_matching_Goto \<gamma> p [r]\<rbrakk>
     \<Longrightarrow> thesis\<rbrakk>
    \<Longrightarrow> thesis


proof (prove)
using this:
  incidence_system (?f ` \<V>) (blocks_image \<B> ?f)
  finite \<V>

goal (1 subgoal):
 1. finite_incidence_system (f ` \<V>) (blocks_image \<B> f)


proof (prove)
goal (1 subgoal):
 1. p \<bullet> projr f = projr (p \<bullet> f)


proof (prove)
goal (1 subgoal):
 1. Gromov_hyperbolic_subset delta A


proof (prove)
using this:
  gen infs cs (u @- a ## v)

goal (1 subgoal):
 1. gen infs cs v


proof (prove)
goal (1 subgoal):
 1. \<And>p. p \<in> carrier (K [X]) \<Longrightarrow> h p = local.eval p x


proof (prove)
goal (1 subgoal):
 1. while_option (uninst_code.cond uses phis g)
     (uninst.step (usesOf \<circ> uses)
       (\<lambda>g. Mapping.lookup (phis g)) g)
     ((usesOf \<circ> uses) g, Mapping.lookup (phis g)) =
    map_option (\<lambda>a. map_prod usesOf Mapping.lookup (fst a))
     (while_option
       (\<lambda>((u, p), triv_phis, nodes_of_uses, nodes_of_phis).
           \<not> Set.is_empty triv_phis)
       (\<lambda>((u, p), triv_phis, nodes_of_uses, nodes_of_phis).
           case uninst_code.step_codem (\<lambda>_. u) (\<lambda>_. p) g
                 (Max triv_phis)
                 (uninst_code.substitution_code (\<lambda>g. p) g
                   (Max triv_phis))
                 nodes_of_uses nodes_of_phis of
           (u', p') \<Rightarrow>
             ((u', p'),
              uninst_code.triv_phis' (\<lambda>_. p') g (Max triv_phis)
               triv_phis nodes_of_phis,
              uninst_code.nodes_of_uses' g (Max triv_phis)
               (uninst_code.substitution_code (\<lambda>g. p) g
                 (Max triv_phis))
               (Mapping.keys (uninst_code.ssa.phidefNodes phis g))
               nodes_of_uses,
              uninst_code.nodes_of_phis' g (Max triv_phis)
               (uninst_code.substitution_code (\<lambda>g. p) g
                 (Max triv_phis))
               nodes_of_phis))
       ((uses g, phis g), ssa.trivial_phis g,
        uninst_code.ssa.useNodes_of uses g,
        uninst_code.ssa.phiNodes_of phis g))


proof (prove)
using this:
  arr \<mu>
  arr \<nu>
  src \<nu> = trg \<mu>
  arr \<mu>'
  arr \<nu>'
  src \<nu>' = trg \<mu>'
  seq \<mu>' \<mu>
  seq \<nu>' \<nu>
  Dom \<nu>' = Cod \<nu> \<and> Dom \<mu>' = Cod \<mu>
  Dom (\<mu>' \<bullet> \<mu>) = Dom \<mu> \<and>
  Dom (\<nu>' \<bullet> \<nu>) = Dom \<nu> \<and>
  Cod (\<mu>' \<bullet> \<mu>) = Cod \<mu>' \<and>
  Cod (\<nu>' \<bullet> \<nu>) = Cod \<nu>'
  C.span
   (Chn (\<nu>' \<bullet> \<nu>) \<cdot>
    \<p>\<^sub>1[\<nu>.dom.leg0, \<mu>.dom.leg1])
   (Chn (\<mu>' \<bullet> \<mu>) \<cdot>
    \<p>\<^sub>0[\<nu>.dom.leg0, \<mu>.dom.leg1])
  ?\<nu> \<bullet> ?\<mu> \<equiv>
  if arrow_of_spans (\<cdot>) ?\<mu> \<and>
     arrow_of_spans (\<cdot>) ?\<nu> \<and> Dom ?\<nu> = Cod ?\<mu>
  then \<lparr>Chn = Chn ?\<nu> \<cdot> Chn ?\<mu>, Dom = Dom ?\<mu>,
          Cod = Cod ?\<nu>\<rparr>
  else Null
  seq ?\<nu> ?\<mu> =
  (arrow_of_spans (\<cdot>) ?\<mu> \<and>
   arrow_of_spans (\<cdot>) ?\<nu> \<and> Dom ?\<nu> = Cod ?\<mu>)
  arr ?\<mu> = arrow_of_spans (\<cdot>) ?\<mu>
  \<lbrakk>arr ?\<mu>; arr ?\<nu>; src ?\<nu> = trg ?\<mu>\<rbrakk>
  \<Longrightarrow> \<guillemotleft>chine_hcomp ?\<nu>
                                     ?\<mu> : Leg0
         (Dom ?\<nu>) \<down>\<down>
        Leg1
         (Dom ?\<mu>) \<rightarrow>\<^sub>C Leg0 (Cod ?\<nu>) \<down>\<down>
      Leg1 (Cod ?\<mu>)\<guillemotright>
  \<lbrakk>arr ?\<mu>; arr ?\<nu>; src ?\<nu> = trg ?\<mu>\<rbrakk>
  \<Longrightarrow> C.commutative_square (Leg0 (Cod ?\<nu>))
                     (Leg1 (Cod ?\<mu>))
                     (Chn ?\<nu> \<cdot>
                      \<p>\<^sub>1[Leg0 (Dom ?\<nu>), Leg1 (Dom ?\<mu>)])
                     (Chn ?\<mu> \<cdot>
                      \<p>\<^sub>0[Leg0 (Dom ?\<nu>), Leg1 (Dom ?\<mu>)])
  seq ?\<nu> ?\<mu> \<Longrightarrow>
  src (?\<nu> \<bullet> ?\<mu>) = src ?\<nu> \<bullet> src ?\<mu>
  seq ?\<nu> ?\<mu> \<Longrightarrow>
  trg (?\<nu> \<bullet> ?\<mu>) = trg ?\<nu> \<bullet> trg ?\<mu>

goal (1 subgoal):
 1. C.dom \<nu>'.cod.leg0 =
    C.cod
     (Chn (\<nu>' \<bullet> \<nu>) \<cdot>
      \<p>\<^sub>1[\<nu>.dom.leg0, \<mu>.dom.leg1])


proof (prove)
goal (1 subgoal):
 1. insert (OrdP (Var i)) H \<turnstile> A


proof (prove)
goal (1 subgoal):
 1. alw (state_eq None) j


proof (prove)
goal (1 subgoal):
 1. set (option2list k) = option2set k


proof (prove)
goal (1 subgoal):
 1. cxt_to_stmt E c = Stop \<Longrightarrow> c = Stop \<and> E = []


proof (prove)
using this:
  rank y n = Some i
  rank x n = Some j
  stable_rank x j

goal (1 subgoal):
 1. i \<le> j \<Longrightarrow> stable_rank y i


proof (prove)
goal (1 subgoal):
 1. FF (C.VV.comp \<mu>\<nu> \<tau>\<pi>) =
    (F (fst \<mu>\<nu>) \<cdot>\<^sub>D F (fst \<tau>\<pi>),
     F (snd \<mu>\<nu>) \<cdot>\<^sub>D F (snd \<tau>\<pi>))


proof (prove)
using this:
  \<forall>i. G'.L (r i) (w i)

goal (1 subgoal):
 1. \<exists>r. is_acc_run r \<and> (\<forall>i. L (r i) (w i))


proof (prove)
goal (1 subgoal):
 1. (\<And>ns'' ms'' z.
        \<lbrakk>old.pathsConverge g n ns'' m ms'' z;
         prefix ns'' ((ns @ tl ns') @ [defNode g p]);
         prefix ms'' ((ms @ tl ms') @ [defNode g p])\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  \<forall>i. 0 < \<omega> i

goal (1 subgoal):
 1. (\<lambda>i. \<Prod>i<i. eexp (- ereal (\<omega> i)))
    \<longlonglongrightarrow> eexp (\<Sum>n. - ereal (\<omega> n))


proof (prove)
goal (1 subgoal):
 1. (\<And>x y.
        wordinterval_CIDR_split1 rs = (Some x, y) \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. Max_by fst (ran (process_mru vs |` Q)) = Max_by fst (vote_set vs Q)


proof (prove)
goal (1 subgoal):
 1. in_language
     (subst
       \<lparr>init = (),
          prod = \<lambda>_. {|[], [\<aa>, \<bb>, S, S, \<aa>]|}\<rparr>
       {|[Inr (init
                \<lparr>init = (),
                   prod =
                     \<lambda>_.
                        {|[], [\<aa>, \<bb>, S, S, \<aa>]|}\<rparr>)]|})
     []


proof (prove)
goal (1 subgoal):
 1. uint (w >>> n) = take_bit LENGTH('a) (sint w div 2 ^ n)


proof (prove)
using this:
  \<forall>j\<le>2 * d. lose (t + j + (3 + k)) = [False]

goal (1 subgoal):
 1. \<forall>j\<le>2 * d. lose (t + 3 + k + j) = [False]


proof (prove)
goal (1 subgoal):
 1. x \<approx> u \<Longrightarrow> x \<in> monad u


proof (prove)
goal (1 subgoal):
 1. diameter (ball a r) = 2 * r


proof (prove)
goal (1 subgoal):
 1. 0 \<notin> X \<Longrightarrow>
    (x \<in> (\<lambda>x. x - Suc 0) ` X) = (Suc x \<in> X)


proof (prove)
using this:
  z \<in> (\<Union>u\<in>A\<^sup>\<infinity>.
              \<Union>v\<in>A\<^sup>\<infinity>. {u @@ v})

goal (1 subgoal):
 1. (\<And>u v.
        \<lbrakk>u \<in> A\<^sup>\<infinity>; v \<in> A\<^sup>\<infinity>;
         z = u @@ v\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (chain)
picking this:
  C =m
  \<Prod>\<^sub># (factors_of_factor_tree l) *
  \<Prod>\<^sub># (factors_of_factor_tree r)


proof (prove)
goal (1 subgoal):
 1. punit.monom_mult (lookup q 0) 0
     (subst_pp
       (\<lambda>x. monomial (1::'a) (monomial 1 x) - monomial (a x) 0) 0) +
    (\<Sum>t\<in>keys q - {0}.
       monomial (lookup q t) 0 *
       subst_pp
        (\<lambda>x. monomial (1::'a) (monomial 1 x) - monomial (a x) 0)
        t) =
    monomial (lookup q 0) 0 +
    (\<Sum>t\<in>keys q - {0}.
       monomial (lookup q t) 0 *
       subst_pp
        (\<lambda>x. monomial (1::'a) (monomial 1 x) - monomial (a x) 0) t)


proof (prove)
goal (1 subgoal):
 1. faccs \<delta> t = {q. accs \<delta> t q}


proof (prove)
goal (1 subgoal):
 1. P.events =
    sigma_sets UNIV
     {Pi\<^sub>E UNIV X |X.
      (\<forall>i. X i \<in> sets borel) \<and>
      finite {i. X i \<noteq> UNIV}}


proof (prove)
using this:
  evalUni F1 x =
  (\<exists>l\<in>set (map (list_conj_Uni \<circ> map AtomUni) (DNFUni F1)).
      evalUni l x)
  evalUni F2 x =
  (\<exists>l\<in>set (map (list_conj_Uni \<circ> map AtomUni) (DNFUni F2)).
      evalUni l x)

goal (1 subgoal):
 1. (evalUni F1 x \<or> evalUni F2 x) =
    (\<exists>l\<in>set (map (list_conj_Uni \<circ> map AtomUni)
                          (DNFUni F1)) \<union>
                    set (map (list_conj_Uni \<circ> map AtomUni)
                          (DNFUni F2)).
        evalUni l x)


proof (prove)
using this:
  class P C = \<lfloor>(D, fs, ms)\<rfloor>

goal (1 subgoal):
 1. (\<And>FDTs'.
        FDTs = map (\<lambda>(F, b, T). ((F, C), b, T)) fs @ FDTs' \<and>
        map_of FDTs' (F, C) = None \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  set xs = A
  distinct xs
  Linorder_Relations.sorted_wrt R xs
  length xs = card A

goal (1 subgoal):
 1. bij_betw (linorder_rank R A) A {..<card A}


proof (prove)
using this:
  x # xs \<in> paths t \<or> x # xs \<in> paths t'

goal (1 subgoal):
 1. x # xs \<in> paths (t \<otimes>\<otimes> t')


proof (prove)
using this:
  ?i \<in> I \<Longrightarrow> y ?i \<in> S ?i
  x \<in> Pi\<^sub>E J S
  J \<subseteq> I
  J \<inter> (I - J) = {} \<Longrightarrow>
  (merge J (I - J) (x, y) \<in> Pi\<^sub>E (J \<union> (I - J)) S) =
  (x \<in> Pi J S \<and> y \<in> Pi (I - J) S)
  x \<in> A

goal (1 subgoal):
 1. merge J (I - J) (x, y)
    \<in> (\<lambda>x. restrict x J) -` A \<inter> Pi\<^sub>E I S


proof (prove)
using this:
  n < length ias

goal (1 subgoal):
 1. interrupt_action_ok' (redT_updIs (redT_updI is ia) (take n ias))
     (ias ! n)


proof (state)
goal (1 subgoal):
 1. set_iterator (set_iterator_union it_a it_b) (S_a \<union> S_b)


proof (prove)
goal (1 subgoal):
 1. (f ^^ k) x = x \<Longrightarrow> (f ^^ l) x = (f ^^ (l mod k)) x


proof (prove)
using this:
  \<exists>N.
     \<forall>m\<ge>N.
        \<forall>n\<ge>N. dist (X m $ ?i) (X n $ ?i) < r / real CARD('n)

goal (1 subgoal):
 1. \<And>i.
       \<forall>m\<ge>N i.
          \<forall>n\<ge>N i. dist (X m $ i) (X n $ i) < r / real CARD('n)


proof (state)
this:
  \<forall>x\<in>E - E'.
     \<not> (forest
              \<lparr>nodes = fst ` E \<union> (snd \<circ> snd) ` E,
                 edges = insert x E'\<rparr> \<and>
             subgraph
              \<lparr>nodes = fst ` E \<union> (snd \<circ> snd) ` E,
                 edges = insert x E'\<rparr>
              \<lparr>nodes = fst ` E \<union> (snd \<circ> snd) ` E,
                 edges = E\<rparr>)

goal (1 subgoal):
 1. spanning_forest
     \<lparr>nodes = fst ` E \<union> (snd \<circ> snd) ` E,
        edges = E'\<rparr>
     \<lparr>nodes = fst ` E \<union> (snd \<circ> snd) ` E,
        edges = E\<rparr> \<Longrightarrow>
    s.SpanningForest E'


proof (prove)
using this:
  proj.quorum (I - S)
  proj.quorum U

goal (1 subgoal):
 1. False


proof (prove)
using this:
  \<not> isVal e
  heap_upds_ok (\<Gamma>, S)

goal (1 subgoal):
 1. thesis


proof (prove)
goal (1 subgoal):
 1. \<Squnion>(f ` R `` {x}) \<le> \<Squnion>{f y |y. (x, y) \<in> R}


proof (prove)
goal (1 subgoal):
 1. homeomorphism (Collect (chart_basis_domainP b)) UNIV (chart_basis b)
     local.chart_basis_inv


proof (prove)
goal (1 subgoal):
 1. F \<subseteq> \<Union> (range f) \<Longrightarrow>
    \<exists>n. F \<subseteq> f n


proof (prove)
using this:
  \<forall>n'. \<pi>' n' \<noteq> local.return
  ?x \<in> local.nodes \<Longrightarrow>
  \<exists>\<pi> n.
     is_path \<pi> \<and> \<pi> 0 = ?x \<and> \<pi> n = local.return
  is_path \<pi>
  is_path ?\<pi> \<Longrightarrow> ?\<pi> ?k \<in> local.nodes

goal (1 subgoal):
 1. (\<And>\<pi>l n.
        \<lbrakk>is_path \<pi>l; \<pi> k = \<pi>l 0;
         \<pi>l n = local.return\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  f \<circ> h holomorphic_on S
  \<forall>z\<in>S. (f \<circ> h) z \<noteq> 0

goal (1 subgoal):
 1. thesis


proof (prove)
using this:
  a \<le> c
  b \<le> c

goal (1 subgoal):
 1. - inf (- a) (- b) \<le> c


proof (state)
this:
  unit p = (fst (unit p), fst (snd (unit p)), snd (snd (unit p)))

goal (1 subgoal):
 1. (\<exists>x. Ifm (real_of_int x # bs) p) = Ifm bs (cooper p) \<and>
    qfree (cooper p)


proof (prove)
using this:
  \<lbrace>p \<and> b\<rbrace> S \<lbrace>p\<rbrace>\<^sub>u

goal (1 subgoal):
 1. \<lbrace>p\<rbrace> while\<^sup>\<top> b do S od
    \<lbrace>\<not> b \<and> p\<rbrace>\<^sub>u


proof (prove)
goal (1 subgoal):
 1. sum power2 {..n} = (2 * n ^ 3 + 3 * n\<^sup>2 + n) div 6


proof (prove)
goal (2 subgoals):
 1. \<forall>l s.
       pre C1 Q l s \<and>
       preList upds (IF b THEN C1 ELSE C2) l s \<and>
       bval b s \<longrightarrow>
       pre C1 Q l s \<and> preList upds C1 l s
 2. \<turnstile>\<^sub>1 {\<lambda>l s.
                             pre C1 Q l s \<and> preList upds C1 l s}
                         strip C1
                         { time
                            C1 \<Down> \<lambda>l s.
    Q l s \<and> postList upds l s}


proof (prove)
goal (1 subgoal):
 1. (init_fin_descend_thr ts t = None) = (ts t = None)


proof (prove)
using this:
  s \<in> ball z \<epsilon>
  t \<in> {real_of_int a..real x}
  0 < \<epsilon>
  ball z \<epsilon> \<subseteq> U

goal (1 subgoal):
 1. ((\<lambda>z. f z t) has_field_derivative f' s t)
     (at s within ball z \<epsilon>)


proof (prove)
goal (1 subgoal):
 1. finprod G f A \<in> carrier G


proof (prove)
goal (4 subgoals):
 1. \<And>g' n v vs v'.
       \<lbrakk>p_g g' (n, v) = Some vs; v' \<in> set vs; g' = g\<rbrakk>
       \<Longrightarrow> var g' v' = var g' v
 2. \<And>g' n v vs v'.
       \<lbrakk>p_g g' (n, v) = Some vs; v' \<in> set vs;
        g' \<noteq> g\<rbrakk>
       \<Longrightarrow> var g' v' = var g' v
 3. \<And>n g v v'.
       \<lbrakk>n \<in> set (\<alpha>n g); v \<in> step.allDefs g n;
        v' \<in> step.allDefs g n; v \<noteq> v'\<rbrakk>
       \<Longrightarrow> var g v' \<noteq> var g v
 4. \<And>u p g.
       \<lbrakk>CFG_SSA_Transformed \<alpha>e \<alpha>n invar inEdges' Entry
                 oldDefs oldUses defs u p var;
        CFG_SSA_wf_base.redundant \<alpha>n inEdges' defs u p g\<rbrakk>
       \<Longrightarrow> chooseNext_all (u g) (p g) g \<in> dom (p g) \<and>
                         CFG_SSA_wf_base.trivial \<alpha>n inEdges' defs u p
                          g (snd (chooseNext_all (u g) (p g) g))


proof (prove)
goal (1 subgoal):
 1. A $ from_nat c $ from_nat c dvd
    diagonal_to_Smith_i [i + 1..<min (nrows A) (ncols A)] A i bezout $ a $ b


proof (prove)
goal (1 subgoal):
 1. ((B\<^sub>1 ===> B\<^sub>1 ===> B\<^sub>1) ===>
     B\<^sub>1 ===>
     (B\<^sub>1 ===> B\<^sub>1 ===> B\<^sub>1) ===>
     (B\<^sub>1 ===> B\<^sub>1) ===>
     ((=) ===> B\<^sub>1 ===> B\<^sub>1) ===>
     (B\<^sub>2 ===> B\<^sub>2 ===> B\<^sub>2) ===>
     B\<^sub>2 ===>
     (B\<^sub>2 ===> B\<^sub>2 ===> B\<^sub>2) ===>
     (B\<^sub>2 ===> B\<^sub>2) ===>
     ((=) ===> B\<^sub>2 ===> B\<^sub>2) ===> (=))
     (\<lambda>plus\<^sub>V\<^sub>S\<^sub>_\<^sub>1
         zero\<^sub>V\<^sub>S\<^sub>_\<^sub>1
         minus\<^sub>V\<^sub>S\<^sub>_\<^sub>1
         uminus\<^sub>V\<^sub>S\<^sub>_\<^sub>1 scale\<^sub>1.
         vector_space_pair_ow (Collect (Domainp B\<^sub>1))
          plus\<^sub>V\<^sub>S\<^sub>_\<^sub>1
          zero\<^sub>V\<^sub>S\<^sub>_\<^sub>1
          minus\<^sub>V\<^sub>S\<^sub>_\<^sub>1
          uminus\<^sub>V\<^sub>S\<^sub>_\<^sub>1 scale\<^sub>1
          (Collect (Domainp B\<^sub>2)))
     vector_space_pair_with


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sv \<in> atoms
                       \<^bold>\<And>map
(\<lambda>(x, y).
    encode_negative_transition_frame_axiom (\<phi> prob_with_noop abs_prob )
     x y)
(List.product [0..<t]
  ((\<phi> prob_with_noop abs_prob )\<^sub>\<V>)) \<union>
                      atoms
                       \<^bold>\<And>map
(\<lambda>(x, y).
    encode_positive_transition_frame_axiom (\<phi> prob_with_noop abs_prob )
     x y)
(List.product [0..<t] ((\<phi> prob_with_noop abs_prob )\<^sub>\<V>));
     t < Suc h\<rbrakk>
    \<Longrightarrow> valid_state_var sv


proof (prove)
goal (1 subgoal):
 1. (uncurry2 ?f3, uncurry2 remap_polys_l2)
    \<in> poly_assn\<^sup>k *\<^sub>a
          (hs.assn string_assn)\<^sup>d *\<^sub>a
          polys_assn_input\<^sup>d \<rightarrow>\<^sub>a status_assn
                    raw_string_assn \<times>\<^sub>a
                   hs.assn string_assn \<times>\<^sub>a polys_assn


proof (prove)
using this:
  B.internal_equivalence g f (B.inv \<epsilon>') (B.inv \<eta>)
  B.equivalence_map ?f \<Longrightarrow> B.is_left_adjoint ?f
  B.equivalence_map ?f \<equiv>
  \<exists>g \<eta> \<epsilon>.
     B.internal_equivalence ?f g \<eta> \<epsilon>
  \<guillemotleft>g : local.Cod
                       F \<rightarrow>\<^sub>B local.Dom F\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>g : local.Cod
                         F \<rightarrow>\<^sub>B local.Dom
            F\<guillemotright> \<and>
    B.is_left_adjoint g \<and>
    \<lbrakk>g\<rbrakk>\<^sub>B = \<lbrakk>g\<rbrakk>\<^sub>B


proof (prove)
goal (1 subgoal):
 1. a_kernel R (image_ring f R) f = I


proof (prove)
goal (1 subgoal):
 1. insert (SeqWRP s k' y) H \<turnstile>
    SyntaxN.Ex y' (SeqWRP s k (Var y') AND y EQ Q_Succ (Var y'))


proof (prove)
goal (1 subgoal):
 1. Group.group (add_monoid (R\<lparr>carrier := H\<rparr>)) &&&
    Group.monoid (R\<lparr>carrier := H\<rparr>)


proof (prove)
goal (1 subgoal):
 1. (\<Sum>l. \<Sum>n. poly_mapping.lookup p l * g l *
                       (poly_mapping.lookup q n * g n)) =
    (\<Sum>m. poly_mapping.lookup p m * g m) *
    (\<Sum>m. poly_mapping.lookup q m * g m)


proof (prove)
using this:
  ss = [t]
  bst t
  bst t \<Longrightarrow>
  real (T_insert a t) + \<Phi> (Splay_Tree.insert a t) - \<Phi> t
  \<le> 4 * \<phi> t + 3

goal (1 subgoal):
 1. real (cost f ss) + \<Phi> (exec f ss) - sum_list (map \<Phi> ss)
    \<le> U f ss


proof (state)
this:
  continuous_on UNIV (\<lambda>x. Blinfun (FunctionFrechet I ?f5 x))

goal (3 subgoals):
 1. \<And>args i.
       \<lbrakk>\<And>i. dfree (args i);
        \<And>i.
           continuous_on UNIV
            (blin_frechet (good_interp I) (simple_term (args i)))\<rbrakk>
       \<Longrightarrow> continuous_on UNIV
                          (blin_frechet (good_interp I)
                            (simple_term ($f i args)))
 2. \<And>\<theta>\<^sub>1 \<theta>\<^sub>2.
       \<lbrakk>dfree \<theta>\<^sub>1;
        continuous_on UNIV
         (blin_frechet (good_interp I) (simple_term \<theta>\<^sub>1));
        dfree \<theta>\<^sub>2;
        continuous_on UNIV
         (blin_frechet (good_interp I)
           (simple_term \<theta>\<^sub>2))\<rbrakk>
       \<Longrightarrow> continuous_on UNIV
                          (blin_frechet (good_interp I)
                            (simple_term
                              (Plus \<theta>\<^sub>1 \<theta>\<^sub>2)))
 3. \<And>\<theta>\<^sub>1 \<theta>\<^sub>2.
       \<lbrakk>dfree \<theta>\<^sub>1;
        continuous_on UNIV
         (blin_frechet (good_interp I) (simple_term \<theta>\<^sub>1));
        dfree \<theta>\<^sub>2;
        continuous_on UNIV
         (blin_frechet (good_interp I)
           (simple_term \<theta>\<^sub>2))\<rbrakk>
       \<Longrightarrow> continuous_on UNIV
                          (blin_frechet (good_interp I)
                            (simple_term
                              (Times \<theta>\<^sub>1 \<theta>\<^sub>2)))


proof (prove)
goal (1 subgoal):
 1. legendre_aux (real k) 2 = multiplicity 2 (fact k)


proof (prove)
goal (1 subgoal):
 1. \<And>nat prod.
       prod \<in> {(x, y). x \<le> y} \<Longrightarrow>
       (case prod of
        (lx, ux) \<Rightarrow> (lb_arctan nat lx, ub_arctan nat ux))
       \<in> {(x, y). x \<le> y}


proof (prove)
goal (1 subgoal):
 1. local.ev_blocks_part m A


proof (state)
this:
  \<turnstile> \<box>N \<and>
               \<box>P \<and>
               \<diamond>\<langle>A\<rangle>_v \<longrightarrow>
               \<diamond>Q

goal (1 subgoal):
 1. \<turnstile> \<box>N \<and>
                 \<box>(\<box>P \<longrightarrow>
                        \<diamond>\<langle>A\<rangle>_v) \<longrightarrow>
                 P \<leadsto> Q


proof (prove)
using this:
  x \<sqsubseteq> y
  z \<sqsubseteq> y

goal (1 subgoal):
 1. x \<squnion> z \<sqsubseteq> y


proof (prove)
using this:
  interaction_bound' (Generative_Probabilistic_Value.Done None)
  \<le> interaction_bound consider
         (Generative_Probabilistic_Value.Done None)

goal (1 subgoal):
 1. interaction_bound' (Generative_Probabilistic_Value.Done None) = 0


proof (prove)
goal (1 subgoal):
 1. LLL_impl_inv state' i fs' \<and>
    local.basis_reduction_add_rows_loop i fs (Suc j) = fs'


proof (prove)
using this:
  qGoodBinp qbinp
  asBinp qbinp = asBinp qbinp'

goal (1 subgoal):
 1. (qbinp, qbinp')
    \<in> {(qbinp, qbinp').
           (\<forall>i. (qbinp i = None) = (qbinp' i = None)) \<and>
           (\<forall>i v1 v2.
               qbinp i = Some v1 \<and> qbinp' i = Some v2 \<longrightarrow>
               v1 $= v2)}


proof (state)
this:
  \<forall>f.
     f \<in> A \<and> nofail (f x) \<longrightarrow> <P> c
     <\<lambda>r. hn_rel Ry (f x) r * F>

goal (1 subgoal):
 1. <P> c <\<lambda>r. hn_rel Ry (INF f\<in>A. f x) r * F>


proof (prove)
using this:
  [\<Sum>m<p.
      (- 1) ^ m * int (p - 1 choose m) * int (m ^ (2 * n)) = 0] (mod int p)

goal (1 subgoal):
 1. [\<Sum>m<p.
        (- 1) ^ m * int (p - 1 choose m) *
        int m ^ (2 * n) = if p - 1 dvd 2 * n then - 1 else 0] (mod int p)


proof (prove)
using this:
  False

goal (1 subgoal):
 1. thesis


proof (prove)
using this:
  \<exists>lholed'. Lfilled 0 lholed' [$Return] (cs1 @ cs2 @ ($* es))

goal (1 subgoal):
 1. False


proof (prove)
goal (1 subgoal):
 1. mat_kernel A \<subseteq> mat_kernel (B * A)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite A; finite B; A \<inter> B = {}\<rbrakk>
    \<Longrightarrow> mset_set (A \<union> B) = mset_set A + mset_set B


proof (prove)
using this:
  f = x # xs
  st_inv (App (Suc ok') f r)

goal (1 subgoal):
 1. st_inv (exec (App (Suc ok') f r))


proof (prove)
goal (1 subgoal):
 1. \<bar>etp.OT_12.adv_P2 n m1 m2 D\<bar> = etp.OT_12.adv_P2 n m1 m2 D


proof (prove)
goal (1 subgoal):
 1. compact (\<Union> (F ` {..n}))


proof (prove)
using this:
  0 \<le> pmf (sds R36) a
  0 \<le> pmf (sds R36) b
  0 \<le> pmf (sds R36) c
  0 \<le> pmf (sds R36) d
  pmf (sds R36) a + pmf (sds R36) b + pmf (sds R36) c + pmf (sds R36) d = 1

goal (1 subgoal):
 1. pmf (sds R36) d = 1 / 2 - pmf (sds R36) c


proof (state)
this:
  Diag b \<and> Ide b

goal (1 subgoal):
 1. Can ((a \<^bold>\<otimes> b) \<^bold>\<Down> c) \<and>
    Arr ((a \<^bold>\<otimes> b) \<^bold>\<Down> c) \<and>
    Dom ((a \<^bold>\<otimes> b) \<^bold>\<Down> c) =
    (a \<^bold>\<otimes> b) \<^bold>\<otimes> c \<and>
    Cod ((a \<^bold>\<otimes> b) \<^bold>\<Down> c) =
    (\<^bold>\<lfloor>a\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
     \<^bold>\<lfloor>b\<^bold>\<rfloor>) \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
    c


proof (prove)
goal (1 subgoal):
 1. exp (ln_Gamma x) < exp (ln_Gamma y)


proof (prove)
using this:
  x1a_ ::= x2_ {x3_} \<in> {c'. strip c' = i}
  \<forall>a\<in>A. x1a_ ::= x2_ {x3_} \<le> a

goal (1 subgoal):
 1. x1a_ ::= x2_ {x3_} \<le> lift \<Inter> i A


proof (prove)
using this:
  ?q \<in> accessible \<Longrightarrow>
  path_to ?q \<in> {u. nextl (init M) u = ?q}

goal (1 subgoal):
 1. q \<in> accessible \<Longrightarrow> nextl (init M) (path_to q) = q


proof (prove)
using this:
  (k, \<gamma>)
  \<in> {(1, \<lambda>x.
                case (x, 0) of
                (x, y) \<Rightarrow>
                  ((x - 1 / 2) * d,
                   (2 * y - 1) * d *
                   sqrt (1 / 4 - (x - 1 / 2) * (x - 1 / 2)))),
         (- 1,
          \<lambda>x.
             case (x, 1) of
             (x, y) \<Rightarrow>
               ((x - 1 / 2) * d,
                (2 * y - 1) * d *
                sqrt (1 / 4 - (x - 1 / 2) * (x - 1 / 2))))} \<union>
        {(- 1,
          \<lambda>y.
             case (0, y) of
             (x, y) \<Rightarrow>
               ((x - 1 / 2) * d,
                (2 * y - 1) * d *
                sqrt (1 / 4 - (x - 1 / 2) * (x - 1 / 2)))),
         (1, \<lambda>y.
                case (1, y) of
                (x, y) \<Rightarrow>
                  ((x - 1 / 2) * d,
                   (2 * y - 1) * d *
                   sqrt (1 / 4 - (x - 1 / 2) * (x - 1 / 2))))}

goal (1 subgoal):
 1. continuous_on {0..1} \<gamma> \<and>
    (\<exists>S. finite S \<and> \<gamma> C1_differentiable_on {0..1} - S)


proof (prove)
using this:
  \<exists>Ts'. P,E,h \<turnstile> es' [:] Ts' \<and> conformable Ts' Ts''
  es = e' # es'
  P,E,h \<turnstile> e' : T'
  T' = T'' \<or> (\<exists>C. T' = NT \<and> T'' = Class C)

goal (1 subgoal):
 1. \<exists>Ts'.
       P,E,h \<turnstile> es [:] Ts' \<and> conformable Ts' (T'' # Ts'')


proof (prove)
goal (1 subgoal):
 1. (P \<Leftrightarrow> P) = true


proof (prove)
using this:
  (0::'a)
  \<notin> (\<Union>x\<in>T. \<Union>y\<in>S. {x - y}) \<Longrightarrow>
  \<exists>a.
     a \<noteq> (0::'a) \<and>
     (\<forall>x\<in>\<Union>x\<in>T. \<Union>y\<in>S. {x - y}.
         0 \<le> a \<bullet> x)

goal (1 subgoal):
 1. (\<And>a.
        \<lbrakk>a \<noteq> (0::'a);
         \<forall>x\<in>{x - y |x y. x \<in> T \<and> y \<in> S}.
            0 \<le> a \<bullet> x\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ss \<in> list n A;
     \<forall>(q, t)\<in>set qs. q < n \<and> t \<in> A; p \<in> w;
     semilat (A, r, f); ss = merges f qs ss\<rbrakk>
    \<Longrightarrow> {q. \<exists>t.
                             (q, t) \<in> set qs \<and>
                             t \<squnion>\<^bsub>f\<^esub> ss ! q \<noteq>
                             ss ! q} \<union>
                      (w - {p})
                      \<subset> w


proof (prove)
goal (1 subgoal):
 1. distinct (zip xs ys)


proof (prove)
goal (1 subgoal):
 1. \<forall>xs.
       eval (AllQ (fm.Atom x)) xs = eval (push_forall (AllQ (fm.Atom x))) xs


proof (prove)
using this:
  \<exists>cnv.
     \<forall>\<eta>.
        wiring (\<I>_ideal \<eta>) (\<I>_real \<eta>) (cnv \<eta>)
         (w \<eta>) \<and>
        wiring (\<I>_ideal \<eta>) (\<I>_ideal \<eta>)
         (cnv \<eta> \<odot> sim \<eta>) (id, id)

goal (1 subgoal):
 1. (\<And>cnv.
        \<lbrakk>\<And>\<eta>.
                    wiring (\<I>_ideal \<eta>) (\<I>_real \<eta>)
                     (cnv \<eta>) (w \<eta>);
         \<And>\<eta>.
            wiring (\<I>_ideal \<eta>) (\<I>_ideal \<eta>)
             (cnv \<eta> \<odot> sim \<eta>) (id, id)\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. factors_of_factor_tree (create_factor_tree xs) = mset xs


proof (prove)
goal (3 subgoals):
 1. finite {..<length (annos C2)}
 2. \<forall>x\<in>{..<length (annos C2)}.
       m\<^sub>o (annos C2 ! x) (vars (strip C2))
       \<le> m\<^sub>o (annos C1 ! x) (vars (strip C2))
 3. \<exists>a\<in>{..<length (annos C2)}.
       m\<^sub>o (annos C2 ! a) (vars (strip C2))
       < m\<^sub>o (annos C1 ! a) (vars (strip C2))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite UNIV;
     \<exists>x. (if atom0 x then some else none) \<noteq> label0 x\<rbrakk>
    \<Longrightarrow> False


proof (prove)
goal (1 subgoal):
 1. \<And>q.
       \<lbrakk>0 < k; 0 < q;
        [ r, mod q * k ] = [ r div k, mod q ] \<otimes> k \<oplus> r mod k;
        [ r div k, mod q ] \<otimes> k \<oplus> r mod k \<oslash> k =
        [ r div k, mod q ] \<otimes> k \<oslash> k\<rbrakk>
       \<Longrightarrow> [ r div k, mod q ] \<otimes> k \<oslash> k =
                         [ r div k, mod q ]


proof (prove)
using this:
  F' \<subseteq> X
  F' \<subseteq> E
  E \<inter> X = {}
  {} \<noteq> F'

goal (1 subgoal):
 1. False


proof (prove)
goal (1 subgoal):
 1. u \<cdot> w = w \<cdot> u


proof (prove)
goal (1 subgoal):
 1. \<exists>y.
       \<forall>x<y.
          \<forall>(a, b, c)\<in>set c. a * x\<^sup>2 + b * x + c \<le> 0


proof (chain)
picking this:
  \<forall>t\<in>\<K> M i s. M, t \<Turnstile> p


proof (prove)
goal (1 subgoal):
 1. fragmentsLS s' \<subseteq> fragmentsLS s


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i \<le> Suc n;
     P \<in> {j. j \<le> Suc n} \<rightarrow> Collect (prime_ideal R);
     skip i \<in> {i. i \<le> n} \<rightarrow> {i. i \<le> Suc n}\<rbrakk>
    \<Longrightarrow> compose {j. j \<le> n} P (skip i) ` {j. j \<le> n} =
                      P ` ({j. j \<le> Suc n} - {i})


proof (prove)
goal (1 subgoal):
 1. transp (ko.lt (key_order_of_nat_term_order_inv ox))


proof (prove)
goal (1 subgoal):
 1. (\<And>c d.
        \<lbrakk>c \<noteq> 0; d \<noteq> 0;
         (\<lambda>x.
             real x powr p *
             (1 +
              integral {a..real x}
               (\<lambda>u. u powr p * ln u powr p' / u powr (p + 1))))
         \<in> \<Theta>(\<lambda>x.
                           c * real x powr p +
                           d * real x powr p *
                           ln (real x) powr (p' + 1))\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  gAbsCongS MOD

goal (1 subgoal):
 1. igAbsCongS (fromMOD MOD)


proof (prove)
using this:
  \<lbrakk>inv\<^bsub>C\<^esub> \<chi>' \<in> carrier C;
   \<chi> \<in> carrier C\<rbrakk>
  \<Longrightarrow> inv\<^bsub>C\<^esub> (inv\<^bsub>C\<^esub> \<chi>') =
                    \<chi>
  character G \<chi>
  character G \<chi>'

goal (1 subgoal):
 1. \<chi> = \<chi>'


proof (prove)
goal (1 subgoal):
 1. \<And>k.
       \<lbrakk>\<And>j. j < D * E \<Longrightarrow> isDERIV i (A ! j) xs;
        \<And>j. j < E \<Longrightarrow> isDERIV i (B ! j) xs;
        k < E\<rbrakk>
       \<Longrightarrow> isDERIV i (A ! (k + E * j)) xs


proof (prove)
goal (1 subgoal):
 1. circuit_in carrier C\<^sub>1 &&& circuit_in carrier C\<^sub>2


proof (prove)
using this:
  summable g'
  (\<Sum>\<^sup>+ x. ennreal (g' x)) = integral\<^sup>N (count_space B) g
  suminf g' = enn2real (\<Sum>\<^sup>+ x. ennreal (g' x))

goal (1 subgoal):
 1. g' sums s


proof (prove)
using this:
  Gramian_matrix fs l \<in> carrier_mat l l

goal (1 subgoal):
 1. \<kappa> i l t * det (Gramian_matrix fs l) =
    det (replace_col (Gramian_matrix fs l)
          (Gramian_matrix fs l *\<^sub>v vec l (\<kappa> i l)) t)


proof (prove)
using this:
  (a, b) \<in> symcl Rel

goal (1 subgoal):
 1. (a, b) \<in> Rel \<or> (b, a) \<in> Rel


proof (state)
this:
  while_option (\<lambda>A. f A \<noteq> A) f a = Some P

goal (1 subgoal):
 1. fixp_above a = the (while_option (\<lambda>A. f A \<noteq> A) f a)


proof (prove)
goal (1 subgoal):
 1. (\<And>eP\<^sub>3 eV\<^sub>3 \<pi>'.
        \<lbrakk>{$$} \<turnstile> e\<^sub>3, eP\<^sub>3, eV\<^sub>3 : \<tau>;
         \<And>\<pi>\<^sub>P.
            \<lless>\<pi>\<^sub>P, eP\<^sub>2\<ggreater> P\<rightarrow> \<lless>\<pi>\<^sub>P @
    \<pi>', eP\<^sub>3\<ggreater>;
         \<And>\<pi>''.
            \<lless>\<pi>' @
                    \<pi>'', eV\<^sub>2\<ggreater> V\<rightarrow> \<lless>\<pi>'', eV\<^sub>3\<ggreater>\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i < length (filter P xs);
     \<And>i'.
        \<lbrakk>i' < length xs; P (xs ! i')\<rbrakk>
        \<Longrightarrow> Q (xs ! i')\<rbrakk>
    \<Longrightarrow> Q (filter P xs ! i)


proof (prove)
goal (1 subgoal):
 1. OFCLASS(sdim, card_UNIV_class)


proof (prove)
using this:
  prod_list ds dvd a div d
  prod_list ds dvd ?a \<Longrightarrow>
  digit_encode ds ?a = replicate (length ds) 0
  prod_list (d # ds) dvd a
  ?a dvd ?b \<Longrightarrow> ?b mod ?a = (0::?'a)
  ?a * ?b dvd ?c \<Longrightarrow> ?a dvd ?c
  prod_list (?x # ?xs) = ?x * prod_list ?xs

goal (1 subgoal):
 1. a mod d # digit_encode ds (a div d) = 0 # replicate (length ds) 0


proof (prove)
goal (1 subgoal):
 1. (INF p\<in>{}. ereal (awalk_cost f p)) = \<infinity>


proof (prove)
using this:
  pes = init @ (p, e) # rest
  cupcake_pmatch cenv p v0 [] = Match env'

goal (1 subgoal):
 1. (p, e) \<in> set pes


proof (prove)
goal (1 subgoal):
 1. (\<Oplus>\<^bsub>vector_space_poly.vs {v. [v ^ CARD('a) = v] (mod u) \<and> degree v < degree u}\<^esub>v\<in>B. a
    v \<odot>\<^bsub>vector_space_poly.vs {v. [v ^ CARD('a) = v] (mod u) \<and> degree v < degree u}\<^esub>
   v) =
    (\<Sum>v\<in>B. Polynomial.smult (a v) v)


proof (chain)
picking this:
  EH\<^sub>N n =
  (\<Sum>\<^sub>ai\<in>{1..}. measure_pmf.prob (H\<^sub>N n) {i..})
  integrable (measure_pmf (H\<^sub>N n)) real


proof (prove)
goal (1 subgoal):
 1. P \<in> carrier_mat m m \<and>
    A \<in> carrier_mat m n \<and> Q \<in> carrier_mat n n


proof (prove)
using this:
  A \<subseteq> Univ
  |A| <o \<AA>
  arr (mkIde ?A) = (?A \<subseteq> Univ \<and> |?A| <o \<AA>)
  arr (mkArr ?A ?B ?F) =
  (?A \<subseteq> Univ \<and>
   |?A| <o \<AA> \<and>
   ?B \<subseteq> Univ \<and>
   |?B| <o \<AA> \<and> ?F \<in> ?A \<rightarrow> ?B)
  \<lbrakk>?A \<subseteq> Univ; |?A| <o \<AA>\<rbrakk>
  \<Longrightarrow> local.dom (mkIde ?A) = mkIde ?A
  \<lbrakk>?A \<subseteq> Univ; |?A| <o \<AA>\<rbrakk>
  \<Longrightarrow> cod (mkIde ?A) = mkIde ?A
  \<lbrakk>?A \<subseteq> Univ; |?A| <o \<AA>\<rbrakk>
  \<Longrightarrow> Fun (mkIde ?A) = (\<lambda>x\<in>?A. x)

goal (1 subgoal):
 1. mkArr A A (\<lambda>x. x) = mkIde A


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>P'' p.
                \<lbrakk>\<alpha> \<prec> P' = \<alpha>' \<prec> P'';
                 set p
                 \<subseteq> set (bn \<alpha>') \<times> set (bn \<alpha>);
                 PQ' = P'' \<parallel> (p \<bullet> Q)\<rbrakk>
                \<Longrightarrow> thesis;
     bn \<alpha> \<sharp>* \<alpha>';
     \<alpha>' \<prec> PQ' = \<alpha> \<prec> P' \<parallel> Q\<rbrakk>
    \<Longrightarrow> thesis


proof (prove)
using this:
  mC_C theta c c1 s s1 P (lift P1 F1)

goal (1 subgoal):
 1. mC_C theta c1 c s1 s (lift P1 F1 ` P) (inv_into P (lift P1 F1))


proof (prove)
goal (1 subgoal):
 1. (case fmlookup xs s of None \<Rightarrow> 0::'a
     | Some v \<Rightarrow> v) =
    (case fmlookup
           (fmfilter (\<lambda>k. fmlookup xs k \<noteq> Some (0::'a)) xs)
           s of
     None \<Rightarrow> 0::'a | Some v \<Rightarrow> v)


proof (prove)
goal (1 subgoal):
 1. \<bar>1 / 2 - ln (ln 2) - meissel_mertens\<bar> \<le> 2 / ln 2 + 1 / 2


proof (prove)
goal (1 subgoal):
 1. \<forall>n\<le>n\<^sub>0'. f n \<le> C\<^sub>4


proof (prove)
using this:
  hconf h
  preallocated h

goal (1 subgoal):
 1. bisim1_list1 t h (Throw a', loc) [] \<lfloor>a'\<rfloor> []


proof (state)
goal (1 subgoal):
 1. \<exists>s_repr d_repr s_range d_range.
       (s_repr, d_repr) \<in> set E \<and>
       map_of V s_repr = Some s_range \<and>
       p_src p \<in> wordinterval_to_set s_range \<and>
       map_of V d_repr = Some d_range \<and>
       p_dst p \<in> wordinterval_to_set d_range


proof (prove)
goal (1 subgoal):
 1. no_trailing P (x # xs) =
    (no_trailing P xs \<and> (xs = [] \<longrightarrow> \<not> P x))


proof (prove)
goal (1 subgoal):
 1. close_eq s (Eq a b) = (a = b)


proof (prove)
using this:
  P \<in> subgroups_of_size p
  P \<subseteq> conjP.stabilizer P

goal (1 subgoal):
 1. P \<in> conjP.fixed_points


proof (state)
this:
  norm (f y - f x) / norm (y - x) \<le> Nf y + kF

goal (2 subgoals):
 1. norm (g' (f y - f x - f' (y - x))) / norm (y - x) \<le> Nf y * kG
 2. 0 \<le> Ng y


proof (prove)
using this:
  \<lbrakk>?j1.0 < ?j2.0; ?j2.0 < length zs\<rbrakk>
  \<Longrightarrow> zs ! ?j1.0 < zs ! ?j2.0
  ?x \<in> set zs \<Longrightarrow> ?x < Suc i
  j1 < j2
  j2 < length (snd (mk_eqcl xs zs (Suc i) T))

goal (1 subgoal):
 1. snd (mk_eqcl xs zs (Suc i) T) ! j1 < snd (mk_eqcl xs zs (Suc i) T) ! j2


proof (state)
this:
  group_hom G2 G3 g2

goal (1 subgoal):
 1. solvable G2 \<Longrightarrow> solvable G1 \<and> solvable G3


proof (prove)
goal (1 subgoal):
 1. drlex_pp 0 s


proof (prove)
using this:
  run c \<sigma> \<sigma>' r
  run c \<sigma> \<tau> s
  \<not> is_exn \<sigma>

goal (1 subgoal):
 1. \<lbrakk>\<lbrakk>is_exn \<sigma>'; \<sigma>' = \<tau>\<rbrakk>
             \<Longrightarrow> thesis;
     \<lbrakk>\<not> is_exn \<sigma>'; \<sigma>' = \<tau>; r = s\<rbrakk>
     \<Longrightarrow> thesis\<rbrakk>
    \<Longrightarrow> thesis


proof (prove)
goal (1 subgoal):
 1. (\<lambda>i.
        of_int_complex_interval a +
        C i *
        ipoly_complex_interval p (C i)) \<longlonglongrightarrow>\<^sub>c
    of_int a + c * ipoly p c


proof (prove)
using this:
  x\<^sup>T ; r ; x\<^sup>T \<cdot> - r\<^sup>T \<le> x\<^sup>\<star>

goal (1 subgoal):
 1. x\<^sup>T ; r ; x\<^sup>T \<cdot> - r\<^sup>T +
    x\<^sup>T ; r ; x\<^sup>T \<cdot> r\<^sup>T
    \<le> x\<^sup>\<star> + x\<^sup>T\<^sup>\<star>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 < n; d dvd n\<rbrakk>
    \<Longrightarrow> card {k \<in> {0<..n}. gcd k n = d} =
                      card (totatives (n div d))


proof (prove)
using this:
  \<E> f\<^sub>1 \<inter> \<E> f\<^sub>2 = {}
  \<lbrakk>?f'2 \<in> \<F> g; ?f'2 \<noteq> f\<rbrakk>
  \<Longrightarrow> (\<E> f\<^sub>1 \<union> \<E> f\<^sub>2) \<inter>
                    \<E> ?f'2 =
                    {}
  edges_disj g

goal (1 subgoal):
 1. edges_disj g'


proof (prove)
using this:
  instance_of\<^sub>l\<^sub>s Cg C\<^sub>1 \<and> falsifies\<^sub>g G Cg
  instance_of\<^sub>l\<^sub>s Cg
   (C\<^sub>1 \<cdot>\<^sub>l\<^sub>s (\<lambda>x. \<epsilon> (''1'' @ x)))

goal (1 subgoal):
 1. falsifies\<^sub>c G
     (C\<^sub>1 \<cdot>\<^sub>l\<^sub>s
      (\<lambda>x. \<epsilon> (''1'' @ x)))


proof (prove)
goal (1 subgoal):
 1. \<exists>P. invertible P \<and> P ** A = A


proof (prove)
using this:
  dim_col x = dim_row x
  \<lbrakk>x * ?B = 1\<^sub>m (dim_row x);
   ?B * x = 1\<^sub>m (dim_row ?B)\<rbrakk>
  \<Longrightarrow> \<exists>A'.
                       y ** A' = mat (1::'a) \<and> A' ** y = mat (1::'a)
  \<lbrakk>y ** ?A' = mat (1::'a); ?A' ** y = mat (1::'a)\<rbrakk>
  \<Longrightarrow> \<exists>B.
                       x * B = 1\<^sub>m (dim_row x) \<and>
                       B * x = 1\<^sub>m (dim_row B)

goal (1 subgoal):
 1. (square_mat x \<and>
     (\<exists>B.
         x * B = 1\<^sub>m (dim_row x) \<and>
         B * x = 1\<^sub>m (dim_row B))) =
    (\<exists>A'. y ** A' = mat (1::'a) \<and> A' ** y = mat (1::'a))


proof (prove)
goal (1 subgoal):
 1. a \<in> G \<Longrightarrow> quotient.invertible (Class a)


proof (prove)
using this:
  (\<lambda>x. ennreal (Px x)) \<in> borel_measurable MX
  emeasure MX {x \<in> space MX. ennreal (Px x) \<noteq> 0} \<noteq> 0

goal (1 subgoal):
 1. log b \<P>(x in MX. Px x \<noteq> 0)
    \<le> log b (Sigma_Algebra.measure MX (space MX))


proof (prove)
goal (1 subgoal):
 1. extended_ord_pm_powerprod (\<lambda>s t. ord (PP s) (PP t))
     (\<lambda>s t. ord_strict (PP s) (PP t))


proof (prove)
goal (1 subgoal):
 1. \<forall>k\<le>n. Ring (B k) \<Longrightarrow>
    Ring
     \<lparr>carrier = ac_fProd_Rg n B, pop = prod_pOp {i. i \<le> n} B,
        mop = prod_mOp {i. i \<le> n} B, zero = prod_zero {i. i \<le> n} B,
        tp = prod_tOp {i. i \<le> n} B,
        un = prod_one {i. i \<le> n} B\<rparr>


proof (prove)
goal (1 subgoal):
 1. UCAST('a \<rightarrow> 'b) w !! n =
    (w !! n \<and> n < min LENGTH('a) LENGTH('b))


proof (prove)
goal (1 subgoal):
 1. (uncurry2
      (uncurry
        (\<lambda>x.
            return \<circ>\<circ>\<circ> check_mult_l_mult_err_impl x)),
     uncurry2 (uncurry check_mult_l_mult_err))
    \<in> poly_assn\<^sup>k *\<^sub>a poly_assn\<^sup>k *\<^sub>a
          poly_assn\<^sup>k *\<^sub>a
          poly_assn\<^sup>k \<rightarrow>\<^sub>a raw_string_assn


proof (prove)
goal (1 subgoal):
 1. \<And>s x.
       \<lbrakk>stable pre rely; stable post rely;
        \<forall>V.
           \<turnstile> P sat [pre \<inter> b \<inter>
                               {V}, {(s, t).
                                     s =
                                     t}, UNIV, {s.
          (V, s) \<in> guar} \<inter>
         post] \<and>
           (\<forall>s.
               {l. l ! 0 = (Some P, s) \<and> l \<in> cptn} \<inter>
               assum (pre \<inter> b \<inter> {V}, {(x, y). x = y})
               \<subseteq> {c. fst (last c) = None \<longrightarrow>
                               (V, snd (last c)) \<in> guar \<and>
                               snd (last c) \<in> post});
        x \<in> assum (pre, rely); fst (last x) = None;
        x ! 0 = (Some (Await b P), s); x \<in> cptn\<rbrakk>
       \<Longrightarrow> snd (last x) \<in> post


proof (prove)
goal (1 subgoal):
 1. (\<forall>x. \<not> P (dual x)) = (\<forall>x'. \<not> P x')


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>string_unop_type op \<tau> \<sigma>\<^sub>1;
     string_unop_type op \<tau> \<sigma>\<^sub>2\<rbrakk>
    \<Longrightarrow> \<sigma>\<^sub>1 = \<sigma>\<^sub>2


proof (prove)
goal (1 subgoal):
 1. (rel_set A ===> (A ===> A ===> A) ===> (=)) semigroup_add_ow
     semigroup_add_ow


proof (prove)
goal (1 subgoal):
 1. Big_Step_Unclocked_Single.evaluate v s e bv \<Longrightarrow>
    Big_Step_Unclocked.evaluate v s e bv


proof (prove)
using this:
  \<forall>x\<in>one_chain1.
     case x of
     (k, \<gamma>) \<Rightarrow>
       real_of_int k * line_integral F basis \<gamma> =
       (case f x of
        (k, \<gamma>) \<Rightarrow>
          real_of_int k * line_integral F basis \<gamma>) \<and>
       line_integral_exists F basis \<gamma>

goal (1 subgoal):
 1. one_chain_line_integral F basis one_chain1 =
    one_chain_line_integral F basis one_chain2


proof (prove)
goal (1 subgoal):
 1. {R23s \<inter>
     UNIV \<times>
     (l3_inv5 \<inter> l3_inv6 \<inter> l3_inv7 \<inter> l3_inv8 \<inter>
      l3_inv9)} TS.trans l2, TS.trans l3 {> R23s}


proof (prove)
goal (1 subgoal):
 1. k_dfs = KBPAlg.dfs k_empt (k_frontier a)


proof (prove)
goal (1 subgoal):
 1. {B. B \<subseteq>\<^sub>c A \<and> cfinite B} =
    acset ` {B. B \<subseteq> rcset A \<and> finite B}


proof (prove)
goal (1 subgoal):
 1. common_sudiv_exists (two_chain_vertical_boundary {rot_diamond_cube})
     (boundary diamond_cube) \<or>
    common_reparam_exists (boundary diamond_cube)
     (two_chain_vertical_boundary {rot_diamond_cube})


proof (prove)
goal (1 subgoal):
 1. \<exists>B.
       lower_asymptotic_density B = 1 \<and>
       (\<lambda>n.
           Sigma_Algebra.measure P (space M \<inter> (T ^^ n) -` A n) *
           indicat_real B n)
       \<longlonglongrightarrow> 0


proof (prove)
using this:
  \<not> is_empty q

goal (1 subgoal):
 1. the (priority q (PQ.min q)) = snd (hd (alist_of q))


proof (prove)
goal (1 subgoal):
 1. inversions_between (permute_list \<pi>1 xs) (permute_list \<pi>2 ys) =
    map_prod (inv \<pi>1) (inv \<pi>2) ` inversions_between xs ys


proof (prove)
goal (1 subgoal):
 1. (Node\<cdot>a\<cdot>l\<cdot>r = Node\<cdot>a'\<cdot>l'\<cdot>r') =
    (a = a' \<and>
     (a \<noteq> \<bottom> \<longrightarrow> l = l' \<and> r = r'))


proof (prove)
goal (1 subgoal):
 1. 2 - 2 ^ (LENGTH('e) - Suc 0) - int LENGTH('f)
    \<le> denormal_exponent TYPE(('e, 'f) IEEE.float) + int i


proof (prove)
using this:
  \<forall>u\<in>U. 0 < w u \<and> w u \<le> real c
  u \<in> V
  \<Union>
   (P\<^sub>1 \<union> wrap B\<^sub>1 \<union> P\<^sub>2 \<union>
    wrap B\<^sub>2 \<union>
    {{v} |v. v \<in> V}) =
  U

goal (1 subgoal):
 1. 0 < w u


proof (prove)
goal (1 subgoal):
 1. tw_cmpser G m f \<Longrightarrow> {h. red_ch_cd G f m h} \<noteq> {}


proof (prove)
goal (1 subgoal):
 1. dlist_eq \<le> equivclp double


proof (prove)
using this:
  locally path_connected T
  S retract_of T

goal (1 subgoal):
 1. locally path_connected S


proof (prove)
goal (1 subgoal):
 1. card (P\<^sub>1 \<union> wrap B\<^sub>1 \<union> {{v} |v. v \<in> L}) +
    card (P\<^sub>2 \<union> wrap B\<^sub>2)
    \<le> card P + card (P\<^sub>2 \<union> wrap B\<^sub>2)


proof (prove)
goal (1 subgoal):
 1. \<And>ff.
       \<lbrakk>I \<noteq> {}; \<forall>j\<in>I. aGroup (A j); aGroup S;
        \<forall>j\<in>I. g j \<in> aHom S (A j);
        aGroup (a\<Pi>\<^bsub>I\<^esub> A);
        aGroup (Ag_ind (a\<Pi>\<^bsub>I\<^esub> A) ff);
        ff \<in> carrier (a\<Pi>\<^bsub>I\<^esub> A) \<rightarrow> B;
        bij_to ff (carrier (a\<Pi>\<^bsub>I\<^esub> A)) B;
        aGroup (Ag_ind (a\<Pi>\<^bsub>I\<^esub> A) ff);
        \<forall>j\<in>I.
           g j \<in> aHom S (A j) \<longrightarrow>
           (\<exists>!f.
               f \<in> aHom S S \<and>
               (\<forall>j\<in>I. compos S (g j) f = g j));
        \<forall>j\<in>I.
           ProjInd I A ff j
           \<in> aHom (Ag_ind (a\<Pi>\<^bsub>I\<^esub> A) ff)
                  (A j) \<longrightarrow>
           (\<exists>!f.
               f \<in> aHom (Ag_ind (a\<Pi>\<^bsub>I\<^esub> A) ff) S \<and>
               (\<forall>j\<in>I.
                   compos (Ag_ind (a\<Pi>\<^bsub>I\<^esub> A) ff) (g j) f =
                   ProjInd I A ff j))\<rbrakk>
       \<Longrightarrow> \<exists>h.
                            bijec\<^bsub>(a\<Pi>\<^bsub>I\<^esub> A),S\<^esub> h


proof (prove)
using this:
  connected (sphere a r)
  0 < r
  sphere a r = {x, y}
  x \<noteq> y
  finite (sphere a r)
  connected ?S \<Longrightarrow>
  finite ?S = (?S = {} \<or> (\<exists>a. ?S = {a}))

goal (1 subgoal):
 1. False


proof (prove)
goal (1 subgoal):
 1. App t u \<in> RED \<sigma>


proof (prove)
using this:
  b |\<union>| c \<in> {b |\<union>| c |b c. b \<in> B \<and> c \<in> C}
  a \<in> A

goal (1 subgoal):
 1. \<exists>a' bc.
       a |\<union>| b |\<union>| c = a' |\<union>| bc \<and>
       a' \<in> A \<and>
       bc \<in> {b |\<union>| c |b c. b \<in> B \<and> c \<in> C}


proof (prove)
using this:
  naturally_isomorphic (\<cdot>) (\<cdot>) (\<lambda>x. x \<otimes> b)
   (\<lambda>x. CCC.prod x b)
  left_adjoint_functor (\<cdot>) (\<cdot>) (\<lambda>x. x \<otimes> b)

goal (1 subgoal):
 1. left_adjoint_functor (\<cdot>) (\<cdot>) (\<lambda>x. CCC.prod x b)


proof (prove)
using this:
  0 < x \<Longrightarrow> lg (2 ^ x) = x
  0 < Suc x

goal (1 subgoal):
 1. lg (2 ^ Suc x) = Suc x


proof (prove)
goal (1 subgoal):
 1. \<And>y.
       \<lbrakk>mem_context_val_w32 9
                 (ucast (ptp OR ucast (ucast (va >> 18)))) (mem s1) =
                Some y;
        mem_context_val_w32 9 (ucast (ptp OR ucast (ucast (va >> 18))))
         ((mem s1)
          (10 := mem s1 10(addr \<mapsto> val),
           11 := (mem s1 11)(addr := None))) =
        Some y\<rbrakk>
       \<Longrightarrow> (let et_val = y AND 3
                          in if et_val = 0 then None
                             else if et_val = 1
                                  then let ptp = y AND 4294967292
 in ptd_lookup va ptp (mem s1) (2 + 1)
                                  else if et_val = 2
 then let ppn = ucast (y >> 8); va_offset = ucast (ucast va)
      in Some ((ucast ppn << 12) OR va_offset, ucast y)
 else None) =
                         (let et_val = y AND 3
                          in if et_val = 0 then None
                             else if et_val = 1
                                  then let ptp = y AND 4294967292
 in ptd_lookup va ptp
     ((mem s1)
      (10 := mem s1 10(addr \<mapsto> val),
       11 := (mem s1 11)(addr := None)))
     (2 + 1)
                                  else if et_val = 2
 then let ppn = ucast (y >> 8); va_offset = ucast (ucast va)
      in Some ((ucast ppn << 12) OR va_offset, ucast y)
 else None)


proof (prove)
using this:
  v = combine Ks Us \<otimes> u \<oplus> \<zero>
  combine Ks Us \<in> F
  Span F [u] = E
  (?u \<in> line_extension ?K ?a ?E) =
  (\<exists>k\<in>?K. \<exists>v\<in>?E. ?u = k \<otimes> ?a \<oplus> v)

goal (1 subgoal):
 1. v \<in> E