proof (prove)
using this:
  \<lhd>\<^sub>l\<^sub>b (lt dir) (\<langle>\<V> s\<rangle> x\<^sub>i)
   (LB dir s x\<^sub>i)
  \<not> \<rhd>\<^sub>u\<^sub>b (lt dir)
          (\<langle>\<V> s\<rangle> x\<^sub>i) (UB dir s x\<^sub>i)
  \<langle>\<V> s\<rangle> x\<^sub>i' <\<^sub>l\<^sub>b
  \<B>\<^sub>l s x\<^sub>i' \<and>
  c = the (\<B>\<^sub>l s x\<^sub>i') \<and>
  min_rvar_incdec Positive s x\<^sub>i' = Inr x\<^sub>j \<or>
  \<not> \<langle>\<V> s\<rangle> x\<^sub>i' <\<^sub>l\<^sub>b
         \<B>\<^sub>l s x\<^sub>i' \<and>
  c = the (\<B>\<^sub>u s x\<^sub>i') \<and>
  min_rvar_incdec Negative s x\<^sub>i' = Inr x\<^sub>j
  x\<^sub>i = x\<^sub>i'
  s' = pivot_and_update x\<^sub>i' x\<^sub>j c s
  \<triangle> (\<T> s)
  \<nabla> s
  x\<^sub>i' \<in> lvars (\<T> s)
  x\<^sub>j \<in> rvars_eq (eq_for_lvar (\<T> s) x\<^sub>i')
  \<lbrakk>\<triangle> (\<T> s); \<nabla> s; x\<^sub>i \<in> lvars (\<T> s);
   x\<^sub>j \<in> rvars_eq (eq_for_lvar (\<T> s) x\<^sub>i)\<rbrakk>
  \<Longrightarrow> Mapping.lookup
                     (\<V> (pivot_and_update x\<^sub>i x\<^sub>j c s))
                     x\<^sub>i =
                    Some c
  dir = Positive \<or> dir = Negative

goal (1 subgoal):
 1. \<langle>\<V> s'\<rangle> x\<^sub>i = the (LB dir s x\<^sub>i)


proof (prove)
using this:
  e \<in> set (cycle_edges p)
  h_minus i e = h_plus i e
  cycle \<Delta> p

goal (1 subgoal):
 1. h_diff i e = 0


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<noteq> 0 \<or> p \<noteq> 0;
     poly_y_x (poly_y_x p) = p\<rbrakk>
    \<Longrightarrow> poly_y_x (poly_y_x ([:a:] + pCons 0 p)) =
                      [:a:] + pCons 0 p


proof (state)
this:
  \<exists>tst c1 c2.
     ?c3 = if tst then c1 else c2 \<and>
     discr c1 \<and> discr c2 \<Longrightarrow>
  discr ?c3

goal (1 subgoal):
 1. discr (if tst then c1 else c2)


proof (prove)
goal (1 subgoal):
 1. x + y = y + x


proof (prove)
using this:
  c \<noteq> i

goal (1 subgoal):
 1. (case inv_map \<pi> i of None \<Rightarrow> 0
     | Some a \<Rightarrow> ket a) \<bullet>\<^sub>C
    ket j =
    ket i \<bullet>\<^sub>C
    (case \<pi> j of None \<Rightarrow> 0 | Some a \<Rightarrow> ket a)


proof (prove)
goal (1 subgoal):
 1. mset (zip (take j xsa @ x # drop j xsa) (take j ysa @ y # drop j ysa)) =
    mset (zip (x # xs) (y # ys))


proof (prove)
goal (1 subgoal):
 1. dim_row (post_meas0 2 |\<beta>\<^sub>1\<^sub>0\<rangle> 1) =
    dim_row |unit_vec 4 0\<rangle>


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       \<bar>spmf
              (connect (\<A> x)
                (sim_outer x \<odot> sim_inner x |\<^sub>= 1\<^sub>C \<rhd>
                 ideal x))
              True -
             ?c12 x\<bar> +
       \<bar>?c12 x - spmf (connect (\<A> x) (real x)) True\<bar>
       \<le> \<bar>spmf
                    (connect
                      (absorb (\<A> x) (sim_outer x |\<^sub>= 1\<^sub>C))
                      (sim_inner x |\<^sub>= 1\<^sub>C \<rhd> ideal x))
                    True -
                   spmf
                    (connect
                      (absorb (\<A> x) (sim_outer x |\<^sub>= 1\<^sub>C))
                      (middle x))
                    True\<bar> +
             \<bar>spmf
                    (connect (\<A> x)
                      (sim_outer x |\<^sub>= 1\<^sub>C \<rhd> middle x))
                    True -
                   spmf (connect (\<A> x) (real x)) True\<bar>


proof (prove)
goal (1 subgoal):
 1. \<And>U.
       U \<in> top.neighborhoods \<pp> \<Longrightarrow>
       ring_homomorphism (local.key_map U) (\<O> U) (add_sheaf_spec U)
        (mult_sheaf_spec U) (zero_sheaf_spec U) (one_sheaf_spec U)
        pi.carrier_local_ring_at pi.add_local_ring_at pi.mult_local_ring_at
        pi.zero_local_ring_at pi.one_local_ring_at


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>PAC_Format (\<V>, A) (\<V>', B);
     \<Union> (vars ` set_mset A) \<subseteq> \<V>\<rbrakk>
    \<Longrightarrow> {p \<in> pac_ideal (set_mset B).
                       vars p \<subseteq> \<V>}
                      \<subseteq> {p \<in> pac_ideal (set_mset A).
                                   vars p \<subseteq> \<V>} \<and>
                      \<V> \<subseteq> \<V>' \<and>
                      \<Union> (vars ` set_mset B) \<subseteq> \<V>'


proof (prove)
using this:
  List.member (sorted_list_of_set {x. \<exists>q\<in>set qs. rpoly q x = 0})
   r

goal (1 subgoal):
 1. sorted_list_of_set {x. \<exists>q\<in>set qs. rpoly q x = 0} ! 0 \<le> r


proof (prove)
goal (1 subgoal):
 1. ((ccExp_syn a (Var x) = \<bottom> &&&
      ccExp_syn 0 (Lam [x]. e) = fv (Lam [x]. e)\<^sup>2) &&&
     ccExp_syn (inc\<cdot>a) (Lam [x]. e) = cc_delete x (ccExp_syn a e) &&&
     ccExp_syn a (App e x) =
     ccExp_syn (inc\<cdot>a) e \<squnion> {x} G\<times> insert x (fv e)) &&&
    ((\<not> nonrec \<Gamma> \<Longrightarrow>
      ccExp_syn a (Terms.Let \<Gamma> e) =
      CCfix \<Gamma>\<cdot>
      (Afix \<Gamma>\<cdot>
       (Aexp_syn' a e \<squnion>
        (\<lambda>_. up\<cdot>0) f|` thunks \<Gamma>),
       ccExp_syn a e) G|`
      (- domA \<Gamma>)) &&&
     (x \<notin> fv e' \<Longrightarrow>
      ccExp_syn a (let x be e' in e ) =
      cc_delete x
       (ccBind x e'\<cdot>
        (Aheap_nonrec x e'\<cdot>(Aexp_syn' a e, ccExp_syn a e),
         ccExp_syn a e) \<squnion>
        fv e' G\<times>
        (ccNeighbors x (ccExp_syn a e) -
         (if isVal e' then {} else {x})) \<squnion>
        ccExp_syn a e))) &&&
    ccExp_syn a (Bool b) = \<bottom> &&&
    ccExp_syn a (scrut ? e1 : e2) =
    ccExp_syn 0 scrut \<squnion>
    (ccExp_syn a e1 \<squnion> ccExp_syn a e2) \<squnion>
    edom (Aexp_syn' 0 scrut) G\<times>
    (edom (Aexp_syn' a e1) \<union> edom (Aexp_syn' a e2))


proof (prove)
goal (1 subgoal):
 1. \<And>r x.
       Some r =
       map_fun (\<lambda>x. x) id Some
        (\<lambda>u s w.
            case u of \<omega>\<upsilon> x \<Rightarrow> ConcreteInWorld x w
            | \<sigma>\<upsilon> \<sigma> \<Rightarrow>
                False) \<Longrightarrow>
       \<exists>w. \<omega>\<nu> x \<in> {x. r (\<nu>\<upsilon> x) dj w}


proof (prove)
goal (1 subgoal):
 1. Abs_uint64 (numeral n) = numeral n


proof (prove)
goal (1 subgoal):
 1. igSwapIGAbsSTR MOD \<Longrightarrow> igSwapIGAbs MOD


proof (prove)
goal (1 subgoal):
 1. test (x \<squnion> y)


proof (prove)
goal (1 subgoal):
 1. lang Allreg = (\<Union>a. {[a]})


proof (state)
goal (1 subgoal):
 1. \<And>x xa.
       \<exists>y\<le>1.
          (P x \<and> Q xa \<and> x xa = 0 \<longrightarrow> y = 0) \<and>
          (P x \<and> Q xa \<and> x xa = 1 \<longrightarrow> y = 1) \<and>
          (P x \<and> Q xa \<and> y = 0 \<longrightarrow>
           x xa \<le> f x xa) \<and>
          (P x \<and> Q xa \<and> y = 1 \<longrightarrow> f x xa \<le> x xa)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>unfree t = None; unapp t = None; unconst t = None;
     term_cases (\<lambda>_. True) (\<lambda>_. True)
      (\<lambda>t u. no_abs t \<and> no_abs u) False t\<rbrakk>
    \<Longrightarrow> False


proof (state)
this:
  A \<turnstile> \<langle>l, D\<rangle> \<leadsto>\<^bsub>(k \<circ>
                     v'),v,n\<^esub>* \<langle>l', D'\<rangle>
  valid_dbm D n
  [D']\<^bsub>v,n\<^esub> \<noteq> {}

goal (1 subgoal):
 1. (\<And>k v n.
        A \<turnstile> \<langle>l, D\<rangle> \<leadsto>\<^bsub>k,v,n\<^esub>* \<langle>l', D'\<rangle> \<and>
        valid_dbm D n \<and>
        [D']\<^bsub>v,n\<^esub> \<noteq> {} \<longrightarrow>
        (\<exists>Z.
            A \<turnstile> \<langle>l, [D]\<^bsub>v,n\<^esub>\<rangle> \<leadsto>* \<langle>l', Z\<rangle> \<and>
            Z \<noteq> {}) \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<pi>\<^sub>D\<^sub>G\<^sub>.\<^sub>1 \<AA> \<BB> :
    \<AA> \<times>\<^sub>D\<^sub>G
    \<BB> \<mapsto>\<mapsto>\<^sub>D\<^sub>G\<^bsub>\<alpha>\<^esub> \<AA>


proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m \<noteq> 0; n \<noteq> 0; m < 0; n < 0;
     (\<exists>z. x = ant z) \<or> x = \<infinity>\<rbrakk>
    \<Longrightarrow> m *\<^sub>a (n *\<^sub>a x) = (m * n) *\<^sub>a x
 2. \<lbrakk>m \<noteq> 0; n \<noteq> 0;
     x = - \<infinity> \<or> (\<exists>z. x = ant z) \<or> x = \<infinity>;
     m < 0; n = 0 \<or> 0 < n\<rbrakk>
    \<Longrightarrow> m *\<^sub>a (n *\<^sub>a x) = (m * n) *\<^sub>a x
 3. \<lbrakk>m \<noteq> 0; n \<noteq> 0; n < 0 \<or> n = 0 \<or> 0 < n;
     x = - \<infinity> \<or> (\<exists>z. x = ant z) \<or> x = \<infinity>;
     m = 0 \<or> 0 < m\<rbrakk>
    \<Longrightarrow> m *\<^sub>a (n *\<^sub>a x) = (m * n) *\<^sub>a x


proof (state)
this:
  lin_indpt (set ws)

goal (1 subgoal):
 1. lin_indpt (set (ws @ normal_vectors ws))


proof (prove)
goal (2 subgoals):
 1. \<And>b1 b2.
       u ` JF1col 0 b1 = JF1col 0 (JF1map u b1) \<and>
       u ` JF2col 0 b2 = JF2col 0 (JF2map u b2)
 2. \<And>n.
       \<forall>b1 b2.
          u ` JF1col n b1 = JF1col n (JF1map u b1) \<and>
          u ` JF2col n b2 = JF2col n (JF2map u b2) \<Longrightarrow>
       \<forall>b1 b2.
          u ` JF1col (Suc n) b1 = JF1col (Suc n) (JF1map u b1) \<and>
          u ` JF2col (Suc n) b2 = JF2col (Suc n) (JF2map u b2)


proof (prove)
goal (1 subgoal):
 1. cring (union_ring C)


proof (prove)
goal (1 subgoal):
 1. List_Factoring.pairwise BIT


proof (prove)
goal (1 subgoal):
 1. n \<le> \<langle>x\<rangle> i


proof (prove)
goal (1 subgoal):
 1. Key (Auth_ShaKey n) \<notin> spied s'


proof (prove)
goal (1 subgoal):
 1. \<And>n f s g t m x h.
       \<lbrakk>x \<noteq> Suc n;
        \<forall>k\<le>Suc n. t k \<noteq> \<zero>\<^bsub>R\<^esub>;
        inj_on f {j. j \<le> Suc n}; inj_on g {j. j \<le> Suc n}; m = Suc n;
        free_generator R M H; Ring R; aGroup R; H \<subseteq> carrier M;
        \<forall>f s g t m.
           f \<in> {j. j \<le> n} \<rightarrow> H \<and>
           inj_on f {j. j \<le> n} \<and>
           s \<in> {j. j \<le> n} \<rightarrow> carrier R \<and>
           g \<in> {j. j \<le> m} \<rightarrow> H \<and>
           inj_on g {j. j \<le> m} \<and>
           t \<in> {j. j \<le> m} \<rightarrow> carrier R \<and>
           l_comb R M n s f = l_comb R M m t g \<and>
           (\<forall>j\<le>n. s j \<noteq> \<zero>\<^bsub>R\<^esub>) \<and>
           (\<forall>k\<le>m.
               t k \<noteq> \<zero>\<^bsub>R\<^esub>) \<longrightarrow>
           n = m \<and>
           (\<exists>h.
               h \<in> {j. j \<le> n} \<rightarrow> {j. j \<le> n} \<and>
               (\<forall>l\<le>n. cmp f h l = g l \<and> cmp s h l = t l));
        f \<in> {j. j \<le> Suc n} \<rightarrow> H;
        s \<in> {j. j \<le> Suc n} \<rightarrow> carrier R;
        g \<in> {j. j \<le> Suc n} \<rightarrow> H;
        t \<in> {j. j \<le> Suc n} \<rightarrow> carrier R;
        l_comb R M (Suc n) (cmp s (transpos x (Suc n)))
         (cmp f (transpos x (Suc n))) =
        l_comb R M (Suc n) t g;
        \<forall>j\<le>Suc n. s j \<noteq> \<zero>\<^bsub>R\<^esub>;
        {y. \<exists>x\<le>Suc n. y = g x} =
        {y. \<exists>x\<le>Suc n. y = f x};
        x \<le> Suc n; f x = g (Suc n); ideal R (carrier R);
        h \<in> {j. j \<le> Suc n} \<rightarrow> {j. j \<le> Suc n};
        \<forall>l\<le>Suc n.
           cmp f (cmp (transpos x (Suc n)) h) l = g l \<and>
           cmp s (cmp (transpos x (Suc n)) h) l = t l;
        transpos x (Suc n)
        \<in> {i. i \<le> Suc n} \<rightarrow> {i. i \<le> Suc n}\<rbrakk>
       \<Longrightarrow> \<exists>h.
                            h \<in> {j. j \<le> Suc n} \<rightarrow>
                                    {j. j \<le> Suc n} \<and>
                            (\<forall>l\<le>Suc n.
                                cmp f h l = g l \<and> cmp s h l = t l)


proof (prove)
goal (1 subgoal):
 1. (if encode (Mn n f) = 0 then 0
     else if encode (Mn n f) = 1 then 1 else pdec1 (encode (Mn n f))) =
    5


proof (prove)
goal (1 subgoal):
 1. (Group.group (G\<lparr>carrier := P\<rparr>) \<and>
     prime p \<and>
     order (G\<lparr>carrier := P\<rparr>) =
     p ^ a * (card P div p ^ a) \<and>
     finite (carrier (G\<lparr>carrier := P\<rparr>))) \<and>
    \<not> p dvd card P div p ^ a &&&
    (PcalM \<equiv>
     {s. s \<subseteq> carrier (G\<lparr>carrier := P\<rparr>) \<and>
         card s = p ^ a}) &&&
    PRelM \<equiv>
    {(N1, N2).
     N1 \<in> PcalM \<and>
     N2 \<in> PcalM \<and>
     (\<exists>g\<in>carrier (G\<lparr>carrier := P\<rparr>).
         N1 = N2 #>\<^bsub>G\<lparr>carrier := P\<rparr>\<^esub> g)}


proof (prove)
goal (1 subgoal):
 1. cs\<^bsup>\<pi>\<^esup> l = cs\<^bsup>\<pi>'\<^esup> l'


proof (prove)
using this:
  filter_mset ((\<subseteq>) ps) \<B> =
  {#b \<in># \<B>. \<pi> ` ps \<subseteq> \<pi> ` b#}

goal (1 subgoal):
 1. filter_mset ((\<subseteq>) (\<pi> ` ps)) \<B>' =
    image_mset ((`) \<pi>) (filter_mset ((\<subseteq>) ps) \<B>)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>P \<turnstile> T1\<guillemotleft>bop\<guillemotright>T2 :: T;
     P \<turnstile> T1\<guillemotleft>bop\<guillemotright>T2 :: T'\<rbrakk>
    \<Longrightarrow> T = T'


proof (prove)
goal (1 subgoal):
 1. [shd v] \<preceq>\<^sub>F\<^sub>I shd v ## sdrop 1 v


proof (prove)
using this:
  Q \<in> {H. subgroup H G \<and> card H = p ^ a}

goal (1 subgoal):
 1. card Q = p ^ a


proof (prove)
using this:
  load1 p1 s1
  match i s1 s2
  \<exists>b\<^sub>1 i'.
     L1.sem_behaves s1 b\<^sub>1 \<and>
     rel_behaviour (match i') b\<^sub>1 b2

goal (1 subgoal):
 1. \<exists>b1 i. L1.behaves p1 b1 \<and> rel_behaviour (match i) b1 b2


proof (prove)
using this:
  T = Transaction A B C D E F
  transaction_proj n (Transaction A B C D E F) =
  Transaction A (proj n B) (proj n C) (proj n D) (proj n E) (proj n F)
  trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t (proj n ?A)
  \<subseteq> trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t ?A

goal (1 subgoal):
 1. trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t
     (transaction_receive (transaction_proj n T) @
      transaction_selects (transaction_proj n T) @
      transaction_checks (transaction_proj n T) @
      transaction_updates (transaction_proj n T) @
      transaction_send (transaction_proj n T))
    \<subseteq> trms\<^sub>l\<^sub>s\<^sub>s\<^sub>t
                 (transaction_receive T @
                  transaction_selects T @
                  transaction_checks T @
                  transaction_updates T @ transaction_send T)


proof (prove)
goal (1 subgoal):
 1. x \<in> assertion \<Longrightarrow>
    (x ^ o * \<bottom> \<sqinter> (1::'a)) ^ o * \<bottom> \<sqinter>
    (1::'a) =
    x


proof (prove)
using this:
  (\<^bold>g [^] \<alpha>0) [^] r \<otimes>
  inv ((\<^bold>g [^] \<alpha>1) [^] r) =
  (\<^bold>g [^] \<alpha>0) [^] r \<otimes>
  inv (\<^bold>g [^] \<alpha>1) [^] r

goal (1 subgoal):
 1. (\<^bold>g [^] \<alpha>0) [^] r \<otimes>
    inv ((\<^bold>g [^] \<alpha>1) [^] r) =
    (\<^bold>g [^] \<alpha>0 \<otimes> inv (\<^bold>g [^] \<alpha>1)) [^] r


proof (prove)
goal (1 subgoal):
 1. listsp B l \<Longrightarrow> listsp (A \<sqinter> B) l


proof (prove)
goal (1 subgoal):
 1. rel_spmf (\<lambda>(a, s1') (b, s2'). a = b \<and> X s1' s2')
     (exec_gpv oracle1 gpv s1) (exec_gpv oracle2 gpv s2)


proof (chain)
picking this:
  fold_graph f z B y'
  insert x B \<subseteq> A


proof (prove)
using this:
  a' = b'
  finpref A l' \<subseteq> finpref A l''

goal (1 subgoal):
 1. lnull a = lnull b \<and>
    (\<not> lnull a \<longrightarrow>
     \<not> lnull b \<longrightarrow>
     lhd a = lhd b \<and>
     (ltl a \<in> A\<^sup>\<omega> \<and>
      ltl b \<in> A\<^sup>\<omega> \<and>
      finpref A (ltl a) \<subseteq> finpref A (ltl b) \<or>
      ltl a = ltl b))


proof (prove)
using this:
  r \<noteq> 0 \<and>
  lookup p (s \<oplus> lt r) \<noteq> (0::'b) \<and>
  q = p - monom_mult (lookup p (s \<oplus> lt r) / lc r) s r

goal (1 subgoal):
 1. lookup p (s \<oplus> lt r) \<noteq> (0::'b) &&&
    q = p - monom_mult (lookup p (s \<oplus> lt r) / lc r) s r


proof (prove)
goal (3 subgoals):
 1. \<And>h ptr child.
       \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr
                 ShadowRootClass.known_ptrs;
        Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h;
        ShadowRootClass.known_ptrs h;
        h \<turnstile> Shadow_DOM.get_root_node ptr
        \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r
                               child\<rbrakk>
       \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child
                         \<rightarrow>\<^sub>r None
 2. \<And>h child ptr root.
       \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr
                 ShadowRootClass.known_ptrs;
        h \<turnstile> Shadow_DOM.get_parent child
        \<rightarrow>\<^sub>r Some ptr;
        h \<turnstile> Shadow_DOM.get_root_node
                        (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r
                          child)
        \<rightarrow>\<^sub>r root\<rbrakk>
       \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr
                         \<rightarrow>\<^sub>r root
 3. \<And>h child ptr root.
       \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr
                 ShadowRootClass.known_ptrs;
        h \<turnstile> Shadow_DOM.get_parent child
        \<rightarrow>\<^sub>r Some ptr;
        h \<turnstile> Shadow_DOM.get_root_node ptr
        \<rightarrow>\<^sub>r root\<rbrakk>
       \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node
   (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r
     child)
                         \<rightarrow>\<^sub>r root


proof (prove)
goal (1 subgoal):
 1. x \<rightarrow> y = - x \<squnion> y


proof (prove)
using this:
  C.obj a
  C.obj a'
  \<guillemotleft>\<sigma>'.map\<^sub>0 a' \<star>\<^sub>D
                  g \<star>\<^sub>D
                  \<tau>\<^sub>0
                   a : F.map\<^sub>0
                        a \<rightarrow>\<^sub>D F.map\<^sub>0
           a'\<guillemotright>
  \<guillemotleft>\<xi> : F f \<Rightarrow>\<^sub>D \<sigma>'.map\<^sub>0
               a' \<star>\<^sub>D
              g \<star>\<^sub>D \<tau>\<^sub>0 a\<guillemotright> \<and>
  D.iso \<xi>
  D.isomorphic ?a ?a' =
  (\<exists>f.
      \<guillemotleft>f : ?a \<Rightarrow>\<^sub>D ?a'\<guillemotright> \<and>
      D.iso f)

goal (1 subgoal):
 1. D.isomorphic
     (\<tau>\<^sub>0 a' \<star>\<^sub>D
      F f \<star>\<^sub>D \<sigma>'.map\<^sub>0 a)
     (\<tau>\<^sub>0 a' \<star>\<^sub>D
      (\<sigma>'.map\<^sub>0 a' \<star>\<^sub>D
       g \<star>\<^sub>D \<tau>\<^sub>0 a) \<star>\<^sub>D
      \<sigma>'.map\<^sub>0 a)


proof (state)
this:
  \<Union> \<F> \<subseteq> cbox (- vec c) (vec c)

goal (2 subgoals):
 1. \<Union> \<F> \<in> sets lebesgue
 2. cbox (- vec c) (vec c) \<in> lmeasurable


proof (prove)
goal (1 subgoal):
 1. eexp (ereal x) = ereal (exp x)


proof (prove)
goal (1 subgoal):
 1. stutter_extend_edges UNIV (rel_of_enex enex) =
    rel_of_enex (stutter_extend_enex enex)


proof (prove)
goal (1 subgoal):
 1. \<And>x31 x32.
       \<lbrakk>a = \<^bold>\<langle>un_Prim a\<^bold>\<rangle>;
        Nml (x31 \<^bold>\<star> x32); b = x31 \<^bold>\<star> x32\<rbrakk>
       \<Longrightarrow> a \<^bold>\<Down> x31 \<^bold>\<star> x32 =
                         a \<^bold>\<star> x31 \<^bold>\<star> x32


proof (prove)
using this:
  emeasure (PAR x)
   {p \<in> space (PAR x). \<exists>y\<in>I x. select_first x p y} =
  1
  countable (I ?x)

goal (1 subgoal):
 1. AE p in PAR x. \<exists>y\<in>I x. select_first x p y


proof (prove)
goal (1 subgoal):
 1. sem\<^sub>e\<^sub>s\<^sub>t_d M\<^sub>0 \<I> \<A>


proof (prove)
using this:
  (r', s') .=\<^bsub>rel\<^esub> (r, s)
  equivalence rel
  equivalence ?S \<equiv>
  (\<forall>x.
      x \<in> carrier ?S \<longrightarrow> x .=\<^bsub>?S\<^esub> x) \<and>
  (\<forall>x y.
      x .=\<^bsub>?S\<^esub> y \<longrightarrow>
      x \<in> carrier ?S \<longrightarrow>
      y \<in> carrier ?S \<longrightarrow> y .=\<^bsub>?S\<^esub> x) \<and>
  (\<forall>x y z.
      x .=\<^bsub>?S\<^esub> y \<longrightarrow>
      y .=\<^bsub>?S\<^esub> z \<longrightarrow>
      x \<in> carrier ?S \<longrightarrow>
      y \<in> carrier ?S \<longrightarrow>
      z \<in> carrier ?S \<longrightarrow> x .=\<^bsub>?S\<^esub> z)

goal (1 subgoal):
 1. (r, s) .=\<^bsub>rel\<^esub> (r', s')


proof (prove)
goal (1 subgoal):
 1. \<exists>a. \<turnstile> PVar T \<rhd> t \<Rightarrow> a


proof (state)
this:
  P \<turnstile> \<langle>e0,s0,b0\<rangle> \<rightarrow>
                 \<langle>e1,s1,b1\<rangle>
  P \<turnstile> \<langle>e1,s1,b1\<rangle> \<rightarrow>*
                 \<langle>Val v',s\<^sub>1,b\<^sub>1\<rangle>
  \<lbrakk>init_exp_of e1 = \<lfloor>unit\<rfloor>;
   INIT_class e1 = \<lfloor>C\<rfloor>; \<not> sub_RI ?e'\<rbrakk>
  \<Longrightarrow> P \<turnstile> \<langle>init_switch e1 ?e',s1,
                                    b1\<rangle> \<rightarrow>*
                                   \<langle>?e',s\<^sub>1,
                                    icheck P (the (INIT_class e1))
                                     ?e'\<rangle>
  init_exp_of e0 = \<lfloor>unit\<rfloor>
  INIT_class e0 = \<lfloor>C\<rfloor>
  \<not> sub_RI e'

goal (1 subgoal):
 1. \<And>a aa b ab ac ba e'.
       \<lbrakk>P \<turnstile> \<langle>a,aa,b\<rangle> \<rightarrow>
                               \<langle>ab,ac,ba\<rangle>;
        P \<turnstile> \<langle>ab,ac,ba\<rangle> \<rightarrow>*
                       \<langle>Val v',s\<^sub>1,b\<^sub>1\<rangle>;
        \<And>e'.
           \<lbrakk>init_exp_of ab = \<lfloor>unit\<rfloor>;
            INIT_class ab = \<lfloor>C\<rfloor>; \<not> sub_RI e'\<rbrakk>
           \<Longrightarrow> P \<turnstile> \<langle>init_switch ab e',ac,
       ba\<rangle> \<rightarrow>*
      \<langle>e',s\<^sub>1,icheck P (the (INIT_class ab)) e'\<rangle>;
        init_exp_of a = \<lfloor>unit\<rfloor>;
        INIT_class a = \<lfloor>C\<rfloor>; \<not> sub_RI e'\<rbrakk>
       \<Longrightarrow> P \<turnstile> \<langle>init_switch a e',aa,
   b\<rangle> \<rightarrow>*
  \<langle>e',s\<^sub>1,icheck P (the (INIT_class a)) e'\<rangle>


proof (prove)
goal (1 subgoal):
 1. x \<restriction>\<^sub>e a = x /\<^sub>L a


proof (prove)
goal (1 subgoal):
 1. 2 ^ N\<^sup>2 * B2_LLL F ^ (2 * N) \<le> 1


proof (prove)
goal (1 subgoal):
 1. favorites R i \<subseteq> alts


proof (prove)
goal (1 subgoal):
 1. \<And>a b.
       \<lbrakk>Monotone \<phi>; FIX \<phi> (a, b)\<rbrakk>
       \<Longrightarrow> \<phi> (FIX \<phi>) (a, b)


proof (prove)
using this:
  risk_neutral_prob N
  filt_equiv F M N
  trading_strategy pf
  self_financing Mkt pf
  stock_portfolio Mkt pf
  \<forall>n.
     \<forall>asset\<in>support_set pf.
        integrable N (\<lambda>w. prices Mkt asset n w * pf asset (Suc n) w)
  \<forall>n.
     \<forall>asset\<in>support_set pf.
        integrable N
         (\<lambda>w. prices Mkt asset (Suc n) w * pf asset (Suc n) w)

goal (1 subgoal):
 1. \<forall>x\<in>support_set pf.
       AEeq N
        (real_cond_exp N (F n)
          (discounted_value r (\<lambda>m y. prices Mkt x m y * pf x m y)
            (Suc n)))
        (discounted_value r
          (\<lambda>m y. prices Mkt x m y * pf x (Suc m) y) n)


proof (prove)
goal (1 subgoal):
 1. ring_hom_ring R (S Quot P) ((+>\<^bsub>S\<^esub>) P \<circ> h)


proof (prove)
goal (1 subgoal):
 1. ccomp c \<Turnstile> cfs\<box> \<Longrightarrow>
    cpred c (cfs ! 0) (cfs ! (length cfs - 1))


proof (prove)
using this:
  (?x = ?y) = (\<forall>z. P z ?x = P z ?y)
  \<forall>z. P z x = P z y

goal (1 subgoal):
 1. x = y


proof (prove)
goal (1 subgoal):
 1. hd\<^sub>L \<bowtie> tl\<^sub>L


proof (prove)
goal (1 subgoal):
 1. inv_fg (inv_fg l) = l


proof (prove)
goal (2 subgoals):
 1. (x \<in> set (insort y [])) = (x = y \<or> x \<in> set [])
 2. \<And>a xs.
       (x \<in> set (insort y xs)) =
       (x = y \<or> x \<in> set xs) \<Longrightarrow>
       (x \<in> set (insort y (a # xs))) =
       (x = y \<or> x \<in> set (a # xs))


proof (state)
this:
  bv_to_int w2 = 0

goal (2 subgoals):
 1. bv_to_int w2 = 0 \<Longrightarrow>
    length (bv_sub w1 w2) \<le> Suc (max (length w1) (length w2))
 2. bv_to_int w2 \<noteq> 0 \<Longrightarrow>
    length (bv_sub w1 w2) \<le> Suc (max (length w1) (length w2))


proof (state)
this:
  a = 2 * m

goal (2 subgoals):
 1. a = 2 * m \<Longrightarrow>
    dist (geod (Suc n) a) (geod (Suc n) (Suc a)) = dist x0 y0 / (2 * 2 ^ n)
 2. a = Suc (2 * m) \<Longrightarrow>
    dist (geod (Suc n) a) (geod (Suc n) (Suc a)) = dist x0 y0 / (2 * 2 ^ n)


proof (prove)
goal (1 subgoal):
 1. l_attach_shadow_root\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>_\<^sub>D\<^sub>O\<^sub>M
     ShadowRootClass.known_ptr set_shadow_root set_shadow_root_locs set_mode
     set_mode_locs attach_shadow_root ShadowRootClass.type_wf get_tag_name
     get_tag_name_locs get_shadow_root get_shadow_root_locs


proof (prove)
goal (1 subgoal):
 1. \<And>x1a x2a bv S1 S2.
       S1 \<le> S2 \<Longrightarrow>
       \<forall>x1 x2.
          inv_less' bv (aval'' x1a S1) (aval'' x2a S1) =
          (x1, x2) \<longrightarrow>
          (\<forall>x1b x2b.
              inv_less' bv (aval'' x1a S2) (aval'' x2a S2) =
              (x1b, x2b) \<longrightarrow>
              inv_aval' x1a x1 (inv_aval' x2a x2 S1)
              \<le> inv_aval' x1a x1b (inv_aval' x2a x2b S2))


proof (prove)
goal (1 subgoal):
 1. class.bounded_lattice (\<squnion>) (\<lambda>x y. y \<le> x)
     (\<lambda>x y. y < x) (\<sqinter>) \<top> \<bottom>


proof (prove)
using this:
  Determinant.det
   (Matrix.mat 2 2
     (\<lambda>(i, j).
         if i = 0 \<and> j = 0 then s
         else if i = 0 \<and> j = 1 then - b1
              else if i = 1 \<and> j = 0 then t else a1)) =
  (1::'a)
  invertible_mat
   (Matrix.mat 2 2
     (\<lambda>(i, j).
         if i = 0 \<and> j = 0 then s
         else if i = 0 \<and> j = 1 then - b1
              else if i = 1 \<and> j = 0 then t else a1)) =
  (Determinant.det
    (Matrix.mat 2 2
      (\<lambda>(i, j).
          if i = 0 \<and> j = 0 then s
          else if i = 0 \<and> j = 1 then - b1
               else if i = 1 \<and> j = 0 then t else a1)) dvd
   (1::'a))

goal (1 subgoal):
 1. invertible_mat
     (Matrix.mat 2 2
       (\<lambda>(i, j).
           if i = 0 \<and> j = 0 then s
           else if i = 0 \<and> j = 1 then - b1
                else if i = 1 \<and> j = 0 then t else a1))


proof (state)
this:
  c \<in> insert c' (set cl)

goal (2 subgoals):
 1. cl[n := c'] = [] \<Longrightarrow> False
 2. \<And>c. c \<in> set (cl[n := c']) \<Longrightarrow> proper c


proof (prove)
using this:
  (q, \<nu>, q') \<in> \<downharpoonleft>\<^sub>k ` limit \<rho>
  (q, \<nu>, q') \<in> S
  (?m, ?\<nu>, ?m') \<in> limit \<rho> \<Longrightarrow>
  \<exists>p p'. ?m k = Some p \<and> ?m' k = Some p'

goal (1 subgoal):
 1. (\<And>m m'.
        \<lbrakk>m k = Some q; m' k = Some q';
         (m, \<nu>, m') \<in> limit \<rho>\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (state)
goal (2 subgoals):
 1. \<And>i x.
       \<lbrakk>i < length (sturm p) - 2;
        poly (sturm p ! (i + 1)) x = 0\<rbrakk>
       \<Longrightarrow> poly (sturm p ! (i + 2)) x * poly (sturm p ! i) x
                         < 0
 2. \<And>x\<^sub>0.
       poly p x\<^sub>0 = 0 \<Longrightarrow>
       \<forall>\<^sub>F x in at x\<^sub>0.
          sgn (poly (p * sturm p ! 1) x) =
          (if x\<^sub>0 < x then 1 else - 1)


proof (prove)
using this:
  z = x

goal (1 subgoal):
 1. z \<sqsubseteq> s


proof (prove)
goal (1 subgoal):
 1. x \<in>\<^sub>\<circ> set (list.set xs)


proof (state)
this:
  l = l1
  (e, a) = n_unwrap nd
  r = r1

goal (2 subgoals):
 1. ft_invar l
 2. ft_invar r


proof (prove)
goal (1 subgoal):
 1. inj h \<Longrightarrow>
    inj_on (\<lambda>(k, v). (k, h v)) (fset (fset_of_fmap m))


proof (prove)
goal (1 subgoal):
 1. {l..<u + 1} = {l..u}


proof (prove)
goal (1 subgoal):
 1. return_spmf ((), if \<sigma> then snd (x0, x1) else fst (x0, x1)) =
    (case (x0, x1) of
     (x0, x1) \<Rightarrow>
       sample_uniform (order \<G>) \<bind>
       (\<lambda>r.
           sample_uniform (order \<G>) \<bind>
           (\<lambda>\<alpha>0.
               sample_uniform (order \<G>) \<bind>
               (\<lambda>\<alpha>1.
                   assert_spmf
                    (\<^bold>g [^] r = \<^bold>g [^] r \<and>
                     (\<^bold>g [^] \<alpha>0) [^] r \<otimes>
                     \<^bold>g [^] (if \<sigma> then 1 else 0) \<otimes>
                     inv ((\<^bold>g [^] \<alpha>1) [^] r \<otimes>
                          \<^bold>g [^] (if \<sigma> then 1 else 0)) =
                     (\<^bold>g [^] \<alpha>0 \<otimes>
                      inv (\<^bold>g [^] \<alpha>1)) [^]
                     r) \<bind>
                   (\<lambda>_.
                       sample_uniform (order \<G>) \<bind>
                       (\<lambda>u0.
                           sample_uniform (order \<G>) \<bind>
                           (\<lambda>u1.
                               sample_uniform (order \<G>) \<bind>
                               (\<lambda>v0.
                                   sample_uniform (order \<G>) \<bind>
                                   (\<lambda>v1.
 return_spmf
  ((),
   if \<sigma>
   then ((\<^bold>g [^] \<alpha>1) [^] r \<otimes>
         \<^bold>g [^] (if \<sigma> then 1 else 0) \<otimes>
         inv \<^bold>g) [^]
        u1 \<otimes>
        (\<^bold>g [^] \<alpha>1) [^] v1 \<otimes>
        x1 \<otimes>
        inv (((\<^bold>g [^] r) [^] u1 \<otimes> \<^bold>g [^] v1) [^]
             \<alpha>1)
   else ((\<^bold>g [^] \<alpha>0) [^] r \<otimes>
         \<^bold>g [^] (if \<sigma> then 1 else 0)) [^]
        u0 \<otimes>
        (\<^bold>g [^] \<alpha>0) [^] v0 \<otimes>
        x0 \<otimes>
        inv (((\<^bold>g [^] r) [^] u0 \<otimes> \<^bold>g [^] v0) [^]
             \<alpha>0)))))))))))


proof (prove)
goal (1 subgoal):
 1. (\<And>t t' u u'.
        \<lbrakk>atom t \<sharp> (v, tm, y, y', t', u, u');
         atom t' \<sharp> (v, tm, y, y', u, u');
         atom u \<sharp> (v, tm, y, y', u');
         atom u' \<sharp> (v, tm, y, y')\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. All local.power_p32_dom


proof (prove)
using this:
  (\<sigma>, p) \<in> oreachable A S U

goal (1 subgoal):
 1. (\<sigma>, p) \<in> oreachable A S' U'


proof (prove)
goal (1 subgoal):
 1. Abs ((p1 + p2) \<bullet> Rep a) =
    Abs (p1 \<bullet> Rep (Abs (p2 \<bullet> Rep a)))


proof (prove)
goal (1 subgoal):
 1. ((\<lbrace>\<^bold>\<lfloor>a\<^bold>\<rfloor> \<^bold>\<Down>
               \<^bold>\<lfloor>b\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
               \<^bold>\<lfloor>c\<^bold>\<rfloor>\<rbrace> \<cdot>
      (\<lbrace>\<^bold>\<lfloor>a\<^bold>\<rfloor>\<rbrace> \<otimes>
       \<lbrace>\<^bold>\<lfloor>b\<^bold>\<rfloor> \<^bold>\<Down>
                \<^bold>\<lfloor>c\<^bold>\<rfloor>\<rbrace>)) \<cdot>
     \<a>[\<lbrace>\<^bold>\<lfloor>a\<^bold>\<rfloor>\<rbrace>, \<lbrace>\<^bold>\<lfloor>b\<^bold>\<rfloor>\<rbrace>, \<lbrace>\<^bold>\<lfloor>c\<^bold>\<rfloor>\<rbrace>]) \<cdot>
    ((\<lbrace>a\<^bold>\<down>\<rbrace> \<otimes>
      \<lbrace>b\<^bold>\<down>\<rbrace>) \<otimes>
     \<lbrace>c\<^bold>\<down>\<rbrace>) =
    (\<lbrace>(\<^bold>\<lfloor>a\<^bold>\<rfloor> \<^bold>\<lfloor>\<^bold>\<otimes>\<^bold>\<rfloor>
               \<^bold>\<lfloor>b\<^bold>\<rfloor>) \<^bold>\<Down>
              \<^bold>\<lfloor>c\<^bold>\<rfloor>\<rbrace> \<cdot>
     (\<lbrace>\<^bold>\<lfloor>a\<^bold>\<rfloor> \<^bold>\<Down>
               \<^bold>\<lfloor>b\<^bold>\<rfloor>\<rbrace> \<otimes>
      \<lbrace>\<^bold>\<lfloor>c\<^bold>\<rfloor>\<rbrace>)) \<cdot>
    ((\<lbrace>a\<^bold>\<down>\<rbrace> \<otimes>
      \<lbrace>b\<^bold>\<down>\<rbrace>) \<otimes>
     \<lbrace>c\<^bold>\<down>\<rbrace>)


proof (prove)
using this:
  \<lbrakk>?r \<longlonglongrightarrow> ?L;
   \<forall>n. ?r n \<in> {x. f x = (0::'b)}\<rbrakk>
  \<Longrightarrow> ?L \<in> {x. f x = (0::'b)}

goal (1 subgoal):
 1. closed (f -` {0::'b})


proof (prove)
goal (1 subgoal):
 1. \<And>k.
       Max {k. (T ^^ k) ((T ^^ n) x) \<in> A} < k \<Longrightarrow>
       (T ^^ k) ((T ^^ n) x) \<notin> A


proof (prove)
using this:
  subterms fa \<subseteq> Mapping.keys M1 \<and>
  Mapping.keys M \<subseteq> Mapping.keys M1 \<and>
  (\<forall>f\<in>Mapping.keys M1.
      subterms f \<subseteq> Mapping.keys M1 \<and>
      the (Mapping.lookup M1 f) < length slp1 \<and>
      interpret_slp slp1 xs ! slp_index_lookup slp1 M1 f =
      interpret_floatarith f xs)
  slp_of_fas' (fa # fas) M slp = (M', slp')
  ?f \<in> Mapping.keys M \<Longrightarrow>
  subterms ?f \<subseteq> Mapping.keys M
  ?f \<in> Mapping.keys M \<Longrightarrow>
  the (Mapping.lookup M ?f) < length slp
  ?f \<in> Mapping.keys M \<Longrightarrow>
  interpret_slp slp xs ! slp_index_lookup slp M ?f =
  interpret_floatarith ?f xs

goal (1 subgoal):
 1. \<Union> (subterms ` set fas) \<subseteq> Mapping.keys M' \<and>
    Mapping.keys M1 \<subseteq> Mapping.keys M' \<and>
    (\<forall>f\<in>Mapping.keys M'.
        subterms f \<subseteq> Mapping.keys M' \<and>
        the (Mapping.lookup M' f) < length slp' \<and>
        interpret_slp slp' xs ! slp_index_lookup slp' M' f =
        interpret_floatarith f xs)


proof (prove)
goal (1 subgoal):
 1. eq\<cdot>[::]\<cdot>ys =
    (eq\<cdot>(slength\<cdot>[::])\<cdot>
     (slength\<cdot>ys) andalso prefix\<cdot>[::]\<cdot>ys)


proof (state)
this:
  ?x / ?y = ?x * inverse ?y

goal (1 subgoal):
 1. \<And>a. inverse (a *\<^sub>C 1) = 1 /\<^sub>C a


proof (prove)
goal (1 subgoal):
 1. \<And>name input xvec Tvec.
       \<lbrakk>\<And>b ba.
                   p \<bullet> subs' input b ba =
                   subs' (p \<bullet> input) (p \<bullet> b)
                    (p \<bullet> ba);
        p \<bullet> name \<sharp> p \<bullet> xvec;
        p \<bullet> name \<sharp> p \<bullet> Tvec\<rbrakk>
       \<Longrightarrow> \<nu>(p \<bullet>
                               name)subs' (p \<bullet> input)
                                     (p \<bullet> xvec) (p \<bullet> Tvec) =
                         subs' (\<nu>(p \<bullet> name)(p \<bullet> input))
                          (p \<bullet> xvec) (p \<bullet> Tvec)


proof (state)
goal (1 subgoal):
 1. sum_upto (\<lambda>n. real n powr - s)
    \<in> O(\<lambda>x. x powr max 0 (1 - s))


proof (prove)
goal (1 subgoal):
 1. (\<Sum>m. poly_mapping.lookup (p + q) m *
              (\<Prod>v. f v ^ poly_mapping.lookup m v)) =
    (\<Sum>m. poly_mapping.lookup p m *
              (\<Prod>v. f v ^ poly_mapping.lookup m v)) +
    (\<Sum>m. poly_mapping.lookup q m *
              (\<Prod>v. f v ^ poly_mapping.lookup m v))


proof (prove)
goal (1 subgoal):
 1. generate_check a b =
    concat
     (map (\<lambda>ys.
              map (\<lambda>xs. (xs, ys))
               (filter (suffs (C\<^sub>1 b (fst ys)) a)
                 (alls (B\<^sub>1 b) a)))
       (filter (suffs C\<^sub>2 b) (alls B\<^sub>2 b)))


proof (prove)
goal (2 subgoals):
 1. \<And>x y.
       \<lbrakk>(Label x, Arity x, Guards x, Outputs x, Updates x, more x)
                < (Label y, Arity y, Guards y, Outputs y, Updates y,
                   more y) \<or>
                x = y;
        (Label y, Arity y, Guards y, Outputs y, Updates y, more y)
        < (Label x, Arity x, Guards x, Outputs x, Updates x, more x) \<or>
        y = x\<rbrakk>
       \<Longrightarrow> x = y
 2. \<And>x y.
       ((Label x, Arity x, Guards x, Outputs x, Updates x, more x)
        < (Label y, Arity y, Guards y, Outputs y, Updates y, more y) \<or>
        x = y) \<or>
       (Label y, Arity y, Guards y, Outputs y, Updates y, more y)
       < (Label x, Arity x, Guards x, Outputs x, Updates x, more x) \<or>
       y = x


proof (prove)
goal (1 subgoal):
 1. \<exists>x.
       x \<in> {(e, f e) |e. f e \<noteq> bot} \<and>
       (\<forall>y.
           y \<in> {(e, f e) |e. f e \<noteq> bot} \<longrightarrow>
           (case x of
            (e, fe) \<Rightarrow> \<lambda>(d, fd). fe + bot \<le> fd + bot)
            y)


proof (state)
this:
  \<exists>y r c.
     y \<in> X \<and> r \<notin> D y \<and> r \<in> D xa \<and> r @ [c] = x

goal (1 subgoal):
 1. \<not> (\<forall>t.
               t \<in> D xa \<longrightarrow>
               \<not> t < x) \<Longrightarrow>
    x \<in> T u


proof (prove)
goal (1 subgoal):
 1. (\<And>xs' ox.
        list_of_oalist_ntm xs = (xs', ox) \<Longrightarrow>
        thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  I \<inter> II \<noteq> {}

goal (1 subgoal):
 1. \<exists>II. II \<in> Q \<and> I \<subseteq> II


proof (prove)
using this:
  \<Psi> \<rhd> \<alpha>\<cdot>P \<longmapsto> \<beta> \<prec> P'
  \<beta> = \<tau>

goal (1 subgoal):
 1. Prop \<alpha> P'


proof (state)
this:
  xd = (x, d)

goal (1 subgoal):
 1. \<And>a m.
       eval_monom_list g m \<le> eval_monom_list f m \<and>
       (0::'a) \<le> eval_monom_list g m \<Longrightarrow>
       eval_monom_list g (a # m) \<le> eval_monom_list f (a # m) \<and>
       (0::'a) \<le> eval_monom_list g (a # m)


proof (prove)
goal (1 subgoal):
 1. vars_clause (subst_cls C \<sigma>)
    \<subseteq> \<Union> (vars_term ` range \<sigma>)


proof (prove)
goal (1 subgoal):
 1. correctDeCompositionVARSYSTEM


proof (prove)
using this:
  q g0 = q' g0

goal (1 subgoal):
 1. q g0 \<in> punit.dgrad_p_set d m \<and>
    lt (q g0 \<odot> g0) \<preceq>\<^sub>t lt p


proof (prove)
goal (1 subgoal):
 1. \<And>self res \<tau>.
       ((\<lambda>_. res \<tau>) \<triangleq>
        (\<lambda>_.
            (if (\<lambda>_.
                    (self.boss@pre \<doteq> null)
                     \<tau>) then (\<lambda>_.
Set{self.salary@pre}
 \<tau>) else (\<lambda>_.
                  self.boss@pre.contents@pre()->including\<^sub>S\<^sub>e\<^sub>t(self.salary@pre)
                   \<tau>) endif)
             \<tau>))
        \<tau> =
       ((\<lambda>_. res \<tau>) \<triangleq>
        (\<lambda>_.
            (if (\<lambda>_.
                    (\<lambda>_. self \<tau>.boss@pre \<doteq> null)
                     \<tau>) then (\<lambda>_.
Set{\<lambda>_. self \<tau>.salary@pre}
 \<tau>) else (\<lambda>_.
                  \<lambda>_.
                     self
                      \<tau>.boss@pre.contents@pre()->including\<^sub>S\<^sub>e\<^sub>t(\<lambda>_.
               self \<tau>.salary@pre)
                   \<tau>) endif)
             \<tau>))
        \<tau>


proof (prove)
using this:
  [] = sorted_list_of_set A
  finite A
  mono_on g A
  inj_on g A
  finite ?A \<Longrightarrow> (sorted_list_of_set ?A = []) = (?A = {})

goal (1 subgoal):
 1. sorted_list_of_set (g ` A) = map g (sorted_list_of_set A)


proof (state)
this:
  finite (gState_progress_rel prog `` {g})

goal (1 subgoal):
 1. gState_inv prog g \<Longrightarrow>
    finite ((gState_progress_rel prog)\<^sup>* `` {g})


proof (prove)
goal (1 subgoal):
 1. mpoly_to_nested_poly (p * q) v =
    mpoly_to_nested_poly p v * mpoly_to_nested_poly q v


proof (prove)
goal (1 subgoal):
 1. t \<approx> s


proof (prove)
using this:
  q \<rightarrow> l qs \<in> \<delta>

goal (1 subgoal):
 1. f_accessible \<delta> {qs ! i} \<subseteq> f_accessible \<delta> {q}


proof (state)
this:
  x \<noteq> y

goal (1 subgoal):
 1. \<lbrakk>\<And>ys. cnt x (remove_cycles xs x ys) \<le> max 1 (cnt x ys);
     x \<noteq> y\<rbrakk>
    \<Longrightarrow> cnt x (remove_cycles (y # xs) x ys)
                      \<le> max 1 (cnt x ys)


proof (state)
this:
  \<lbrakk>?x \<in> C; ?y \<in> C; ?x < ?y\<rbrakk>
  \<Longrightarrow> f' ?x * (?y - ?x) \<le> f ?y - f ?x
  \<lbrakk>?x \<in> C; ?y \<in> C; ?x < ?y\<rbrakk>
  \<Longrightarrow> f' ?y * (?x - ?y) \<le> f ?x - f ?y

goal (1 subgoal):
 1. \<lbrakk>convex C;
     \<And>x.
        x \<in> C \<Longrightarrow> (f has_real_derivative f' x) (at x);
     \<And>x.
        x \<in> C \<Longrightarrow> (f' has_real_derivative f'' x) (at x);
     \<And>x. x \<in> C \<Longrightarrow> 0 \<le> f'' x; x \<in> C;
     y \<in> C\<rbrakk>
    \<Longrightarrow> f' x * (y - x) \<le> f y - f x


proof (prove)
using this:
  (\<^bold>\<diamond> Nom j) at b in' H
  b \<in> assign A H a
  (\<^bold>\<not> (\<^bold>\<diamond> p)) at b in' H

goal (1 subgoal):
 1. (\<^bold>\<not> (\<^bold>@ j p)) at b in' H


proof (prove)
goal (1 subgoal):
 1. (((new_array v \<equiv> new_array' v \<circ> integer_of_nat) &&&
      array_length \<equiv> nat_of_integer \<circ> array_length') &&&
     (array_get a \<equiv> array_get' a \<circ> integer_of_nat) &&&
     array_set a \<equiv> array_set' a \<circ> integer_of_nat) &&&
    ((array_grow a \<equiv> array_grow' a \<circ> integer_of_nat) &&&
     array_shrink a \<equiv> array_shrink' a \<circ> integer_of_nat) &&&
    (array_get_oo x a \<equiv> array_get_oo' x a \<circ> integer_of_nat) &&&
    array_set_oo f a \<equiv> array_set_oo' f a \<circ> integer_of_nat


proof (prove)
goal (1 subgoal):
 1. neg\<cdot>(le\<cdot>x\<cdot>y) = lt\<cdot>y\<cdot>x


proof (state)
this:
  sd_chain k = Some q

goal (2 subgoals):
 1. \<exists>n. sd_chain n = None \<Longrightarrow> thesis
 2. \<forall>n. \<exists>q. sd_chain n = Some q \<Longrightarrow> thesis


proof (prove)
using this:
  BG \<in> Bot_G

goal (1 subgoal):
 1. \<exists>BG'\<in>Bot_G. BG' \<in> lifted_q_calc.\<G>_Fset N


proof (prove)
goal (1 subgoal):
 1. \<And>s f ts.
       \<lbrakk>Node f ts \<in> trees A; s \<in> set ts; f \<in> A;
        \<forall>t\<in>set ts. t \<in> trees A\<rbrakk>
       \<Longrightarrow> size s < Suc (size_list size ts)


proof (prove)
goal (1 subgoal):
 1. sbis B1 B2 s1 s2
     (\<Union> (fst ` {(R1, R2) |R1 R2. sbis B1 B2 s1 s2 R1 R2}))
     (\<Union> (snd ` {(R1, R2) |R1 R2. sbis B1 B2 s1 s2 R1 R2}))


proof (prove)
goal (1 subgoal):
 1. \<And>a aa ba ab ac baa.
       \<lbrakk>P \<turnstile> \<langle>e,s,b\<rangle> \<rightarrow>*
                               \<langle>a,aa,ba\<rangle>;
        P \<turnstile> \<langle>a,aa,ba\<rangle> \<rightarrow>
                       \<langle>ab,ac,baa\<rangle>\<rbrakk>
       \<Longrightarrow> P \<turnstile> \<langle>Val
            v \<guillemotleft>bop\<guillemotright> a,
   aa,ba\<rangle> \<rightarrow>
  \<langle>Val v \<guillemotleft>bop\<guillemotright> ab,ac,baa\<rangle>


proof (prove)
goal (1 subgoal):
 1. sum_to_tup\<cdot>(tup_to_sum\<cdot>F) = F


proof (prove)
goal (1 subgoal):
 1. A B C CongA A' B' C'


proof (prove)
using this:
  t \<in> ball z d

goal (1 subgoal):
 1. t \<notin> \<int>\<^sub>\<le>\<^sub>0


proof (prove)
goal (1 subgoal):
 1. permutations_of_set A \<inter> shuffles xs ys = shuffles xs ys


proof (prove)
goal (1 subgoal):
 1. \<Gamma>\<turnstile> \<langle>cs,css,s\<rangle> \<Rightarrow> t


proof (prove)
goal (1 subgoal):
 1. (\<And>b. red F a b \<Longrightarrow> thesis) \<Longrightarrow> thesis


proof (prove)
using this:
  P ?p \<and> f ?p \<le> ?p \<and> ?p \<le> p0 \<Longrightarrow>
  P (?p \<triangle> f ?p) \<and>
  f (?p \<triangle> f ?p) \<le> ?p \<triangle> f ?p \<and>
  ?p \<triangle> f ?p \<le> p0
  \<lbrakk>\<And>s.
              \<lbrakk>P s \<and> f s \<le> s \<and> s \<le> p0;
               s \<triangle> f s < s\<rbrakk>
              \<Longrightarrow> P (s \<triangle> f s) \<and>
                                f (s \<triangle> f s)
                                \<le> s \<triangle> f s \<and>
                                s \<triangle> f s \<le> p0;
   P p0 \<and> f p0 \<le> p0 \<and> p0 \<le> p0\<rbrakk>
  \<Longrightarrow> P p \<and> f p \<le> p \<and> p \<le> p0

goal (1 subgoal):
 1. P p \<and> f p \<le> p


proof (prove)
using this:
  i \<le> j \<Longrightarrow> stable_rank y i

goal (1 subgoal):
 1. j < i


proof (prove)
using this:
  \<forall>s.
     \<forall>fmla
              \<in>set (adds
                         (ground_action.effect
                           (Ground_Action pre (Effect add del)))).
        \<not> is_predAtom fmla \<longrightarrow> s \<Turnstile> fmla
  fmla
  \<in> apply_effect
         (ground_action.effect (Ground_Action pre (Effect add del)))
         M\<^sub>0
  Ball (close_world M\<^sub>0) ((\<Turnstile>) (close_eq s\<^sub>0)) \<and>
  wm_basic M\<^sub>0 \<and>
  (\<forall>\<alpha>\<in>\<Sigma>. sound_opr \<alpha> (f \<alpha>))

goal (1 subgoal):
 1. (\<forall>atm. fmla \<noteq> Atom atm) \<longrightarrow>
    s \<Turnstile> fmla


proof (prove)
goal (1 subgoal):
 1. (x \<bind> y = \<lfloor>z\<rfloor>) =
    (\<exists>x'.
        x = \<lfloor>x'\<rfloor> \<and> y x' = \<lfloor>z\<rfloor>)


proof (prove)
goal (1 subgoal):
 1. map_\<Gamma> id s = s


proof (prove)
goal (1 subgoal):
 1. monom (1::'a) 1 * pderiv (charpoly A) =
    sum_UNIV_type (\<lambda>i. charpoly (erase_mat A i i)) TYPE('n)


proof (prove)
goal (1 subgoal):
 1. dim_row (step_3_c x l k i A) = dim_row A &&&
    dim_col (step_3_c x l k i A) = dim_col A


proof (state)
this:
  e_0 \<noteq> e_1

goal (1 subgoal):
 1. \<lbrakk>index_set A; A \<noteq> {}; A \<noteq> UNIV;
     \<exists>n\<in>A. nat_to_ce_set n = {}\<rbrakk>
    \<Longrightarrow> one_reducible_to univ_ce (- A)


proof (prove)
goal (1 subgoal):
 1. zeroring R \<Longrightarrow> J_rad R = carrier R


proof (state)
goal (1 subgoal):
 1. (\<Sum>x\<in>chain.
       case x of
       (k, g) \<Rightarrow> real_of_int k * line_integral F basis g) =
    0


proof (prove)
using this:
  \<forall>s X. igWls MOD s X \<longrightarrow> igWls MOD' s (h X)
  \<forall>xs x s X.
     isInBar (xs, s) \<and> igWls MOD s X \<longrightarrow>
     hA (igAbs MOD xs x X) = igAbs MOD' xs x (h X)
  \<forall>xs x s X.
     isInBar (xs, s) \<and> igWls MOD' s X \<longrightarrow>
     hA' (igAbs MOD' xs x X) = igAbs MOD'' xs x (h' X)

goal (1 subgoal):
 1. \<forall>xs x s X.
       isInBar (xs, s) \<and> igWls MOD s X \<longrightarrow>
       (hA' \<circ> hA) (igAbs MOD xs x X) =
       igAbs MOD'' xs x ((h' \<circ> h) X)


proof (prove)
goal (1 subgoal):
 1. 25001 / 10 ^ 5 + (xs ! 0)\<^sup>2 + 2 * (xs ! 1)\<^sup>2 +
    2 * (xs ! 2)\<^sup>2 +
    2 * (xs ! 3)\<^sup>2 +
    2 * (xs ! 4)\<^sup>2 +
    2 * (xs ! 5)\<^sup>2 +
    2 * (xs ! 6)\<^sup>2 -
    xs ! 0 =
    interpret_floatarith magnetism xs


proof (prove)
goal (1 subgoal):
 1. 1 / real (f j') -
    x * (\<Sum>j = 0..<n. (- 1) ^ j * (1 / real (f (Suc j' + j))) * x ^ j) =
    (\<Sum>j = 0..<Suc n. (- 1) ^ j * (1 / real (f (j' + j))) * x ^ j)


proof (prove)
using this:
  chaum_ped_\<Sigma>_commit.rel_game \<A> =
  TRY sample_uniform (order \<G>) \<bind>
      (\<lambda>w.
          let (h, w) = ((\<^bold>g [^] w, g' [^] w), w)
          in \<A> h \<bind>
             (\<lambda>w'.
                 return_spmf
                  ([w = w'] (mod order \<G>) \<and>
                   [x *
                    w = x * w'] (mod order \<G>)))) ELSE return_spmf False
  TRY sample_uniform (order \<G>) \<bind>
      (\<lambda>w.
          let (h, w) = ((\<^bold>g [^] w, g' [^] w), w)
          in \<A> h \<bind>
             (\<lambda>w'.
                 return_spmf
                  ([w = w'] (mod order \<G>) \<and>
                   [x *
                    w = x * w'] (mod order \<G>)))) ELSE return_spmf False =
  local.dis_log_alt.dis_log3 \<A>

goal (1 subgoal):
 1. chaum_ped_\<Sigma>_commit.rel_advantage \<A> =
    local.dis_log_alt.advantage3 \<A>


proof (prove)
using this:
  s \<in> reachable (closed (pnet np n)) TT
  netgmap sr s = netmask (net_tree_ips n) (\<sigma>, \<zeta>)
  wf_net_tree n
  (s, a, s') \<in> automaton.trans (closed (pnet np n))

goal (1 subgoal):
 1. (\<And>\<sigma>' \<zeta>'.
        \<lbrakk>((\<sigma>, \<zeta>), a, \<sigma>', \<zeta>')
                 \<in> automaton.trans (oclosed (opnet onp n));
         netgmap sr s' =
         netmask (net_tree_ips n) (\<sigma>', \<zeta>')\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  ide a
  ide b
  ide c
  \<guillemotleft>g : local.prod a b \<rightarrow> c\<guillemotright>
  x \<in> local.set (local.prod a b)
  \<lbrakk>?X \<^bold>\<in> ?A; hfun (?A * ?B) ?C ?F\<rbrakk>
  \<Longrightarrow> \<exists>!G.
                       \<langle>?X, G\<rangle> \<^bold>\<in>
                       hlam ?A ?B ?C ?F
  \<lbrakk>?X \<^bold>\<in> ?A; hfun (?A * ?B) ?C ?F\<rbrakk>
  \<Longrightarrow> happ (hlam ?A ?B ?C ?F) ?X =
                    (THE G.
                        \<langle>?X, G\<rangle> \<^bold>\<in>
                        hlam ?A ?B ?C ?F)
  \<lbrakk>?X \<^bold>\<in> ?A; hfun (?A * ?B) ?C ?F\<rbrakk>
  \<Longrightarrow> happ (hlam ?A ?B ?C ?F) ?X =
                    \<lbrace>yz \<^bold>\<in> ?B * ?C.
                     \<langle>\<langle>?X, hfst yz\<rangle>,
                              hsnd yz\<rangle> \<^bold>\<in>
                     ?F\<rbrace>
  \<lbrakk>?X \<^bold>\<in> ?A; hfun (?A * ?B) ?C ?F;
   ?Y \<^bold>\<in> ?B\<rbrakk>
  \<Longrightarrow> happ (happ (hlam ?A ?B ?C ?F) ?X) ?Y =
                    happ ?F \<langle>?X, ?Y\<rangle>

goal (1 subgoal):
 1. UP (happ
         (happ
           (hlam (ide_to_hf a) (ide_to_hf b) (ide_to_hf c) (arr_to_hfun g))
           (hfst (DOWN x)))
         (hsnd (DOWN x))) =
    UP (happ (arr_to_hfun g) (DOWN x))


proof (state)
goal (1 subgoal):
 1. cls_val_process Mkt2 (qty_mult_comp pf qty) n
    \<in> borel_measurable (F n)


proof (prove)
goal (1 subgoal):
 1. \<And>t.
       t \<in> {0..1} \<Longrightarrow>
       p ((k \<circ> (\<lambda>t. (t, undefined))) t) = g t


proof (prove)
goal (1 subgoal):
 1. (nf_ACI \<phi> \<Longrightarrow>
     \<phi> = NFOR (norm_ACI ` disjuncts \<phi>)) &&&
    (nf_ACI \<phi> \<Longrightarrow>
     \<phi> = NFAND (norm_ACI ` conjuncts \<phi>))


proof (prove)
using this:
  ics = Throwing Cs a

goal (1 subgoal):
 1. exec_step_ind (exec_step_input P C M pc ics) P h stk loc C M pc ics frs
     sh (xp', h', frs', sh')


proof (prove)
goal (1 subgoal):
 1. dom (C DenyAll) \<noteq> {}


proof (prove)
goal (1 subgoal):
 1. \<turnstile> [HNext rmhist p]_(c p, r p, m p, rmhist!p) \<and>
                 ImpNext p \<and>
                 \<not> unchanged (e p, c p, r p, m p, rmhist!p) \<and>
                 $S5 rmhist p \<longrightarrow>
                 S6 rmhist p$ \<and>
                 RPCReply crCh rmCh rst p \<and>
                 unchanged (e p, c p, m p) \<or>
                 S6 rmhist p$ \<and>
                 RPCFail crCh rmCh rst p \<and> unchanged (e p, c p, m p)


proof (prove)
goal (1 subgoal):
 1. C.inv (\<epsilon> (C.cod f)) \<cdot>\<^sub>C
    f \<cdot>\<^sub>C \<epsilon> (C.dom f) =
    F (G f)


proof (prove)
goal (1 subgoal):
 1. (\<Prod>(n, a)\<leftarrow>n_as. [:- a, 1::'a:] ^ n) =
    [:- a, 1::'a:] ^ n *
    (\<Prod>(n, a)\<leftarrow>as @ bs. [:- a, 1::'a:] ^ n)


proof (state)
this:
  r.eq_m
   ((D + Polynomial.smult q B) * (S - Polynomial.smult p A') +
    (H + Polynomial.smult q A) * (T - Polynomial.smult p B'))
   (D * S + H * T + Polynomial.smult q (B * S + A * T) -
    Polynomial.smult p (A' * D + B' * H) -
    Polynomial.smult (p * q) (A * B' + B * A'))

goal (5 subgoals):
 1. r.Mp D' = D'
 2. r.Mp H' = H'
 3. r.Mp S' = S'
 4. r.Mp T' = T'
 5. r.eq_m (D' * S' + H' * T') 1


proof (prove)
using this:
  valid_edge a
  valid_edge a'
  sourcenode a = Entry
  sourcenode a' = Entry
  targetnode a' = Exit
  targetnode a = Exit

goal (1 subgoal):
 1. a = a'


proof (prove)
using this:
  q \<in> (\<lambda>a. hom_component a z) ` A

goal (1 subgoal):
 1. (\<And>a2.
        \<lbrakk>a2 \<in> A; q = hom_component a2 z\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. finite (rs 1)


proof (prove)
using this:
  flowsto X0 {s + t |s t. s \<in> T \<and> t \<in> {0<..}}
   (CX \<union> CY \<times> UNIV \<union> X1') (fst ` X2 \<times> UNIV)

goal (1 subgoal):
 1. flowsto X0 {0<..} CZ (fst ` X2 \<times> UNIV)


proof (prove)
goal (1 subgoal):
 1. blinding_of_on UNIV id (=)


proof (prove)
goal (1 subgoal):
 1. (\<And>k n1 n2.
        \<lbrakk>B = k + n1; Ba = k + n2;
         head_\<omega> n1 < head_\<omega> n2\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. Ifm vs (x # bs) (msubsteq2 c t a b) =
    Ifm vs
     (Itm vs (x # bs) t / \<lparr>c\<rparr>\<^sub>p\<^bsup>vs\<^esup> # bs)
     (Eq (CNP 0 a b))


proof (prove)
using this:
  a \<notin> supp ((p \<bullet> a \<rightleftharpoons> a) + p)

goal (1 subgoal):
 1. supp ((p \<bullet> a \<rightleftharpoons> a) + p) \<noteq> supp p


proof (prove)
goal (1 subgoal):
 1. \<forall>l1 l2.
       l1 \<noteq> l2 \<longrightarrow>
       GSMP_disjoint (N2 (proj_unl l1 B)) (N2 (proj_unl l2 B))
        (f (set C) - {m. {} \<turnstile>\<^sub>c m})


proof (prove)
goal (1 subgoal):
 1. False \<^bold>\<leftarrow> (\<exists>x. \<^bold>\<not> (E x))


proof (prove)
goal (1 subgoal):
 1. tprg\<turnstile>Ext\<prec>\<^sub>C Base


proof (prove)
goal (1 subgoal):
 1. gba_to_idx_ext ecnv G
    \<le> SPEC
           (\<lambda>G'.
               igba.lang G' = lang \<and>
               igba_rec.more G' = ecnv G \<and> igba G')


proof (prove)
goal (1 subgoal):
 1. Red_F_\<G>_empty_q q = wf_lift.empty_ord.Red_F_\<G>


proof (prove)
goal (1 subgoal):
 1. {.x, u, v. localPrecS (u, v) (a, b) x.} \<circ> [: x, u, v \<leadsto> y,
    u', v' . localRelS (u, v) (u', v') x y :] \<circ>
    {.x, u, v. localPrecS' (u, v) (c, d) x.} \<circ>
    [: x, u, v \<leadsto> y, u', v' . localRelS' (u, v) (u', v') x y :] =
    {.x, u, v. localPrecSS' (u, v) (e, f) x.} \<circ> [: x, u,
    v \<leadsto> y, u', v' . localRelSS' (u, v) (u', v') x y :]


proof (prove)
goal (1 subgoal):
 1. map_SSup (F \<circ> G) = map_SSup F \<circ> map_SSup G


proof (prove)
goal (1 subgoal):
 1. (t = Empty) = (toList t = [])


proof (prove)
goal (1 subgoal):
 1. scf (prefs_from_table xs) = scf (prefs_from_table ys)


proof (prove)
goal (1 subgoal):
 1. (\<And>i.
        i \<in> is \<Longrightarrow>
        refl_on A (f i) \<and>
        (\<forall>x y.
            (x, y) \<in> f i \<longrightarrow> (y, x) \<in> f i) \<and>
        trans (f i)) \<Longrightarrow>
    \<forall>x y.
       (x, y) \<in> \<Union> (f ` is) \<longrightarrow>
       (y, x) \<in> \<Union> (f ` is)


proof (prove)
goal (1 subgoal):
 1. SN_order_pair (s_mul_ext NS S) (ns_mul_ext NS S)


proof (prove)
goal (1 subgoal):
 1. \<And>n.
       \<lbrakk>SEQ n s = Some t \<Longrightarrow> SEQ (Suc n) s = NEXT t;
        SEQ (Suc n) s = Some t\<rbrakk>
       \<Longrightarrow> SEQ (Suc (Suc n)) s = NEXT t


proof (prove)
using this:
  \<guillemotleft>\<lparr>Chn = fgh.chine_assoc',
                     Dom = Cod (f \<star> g \<star> h),
                     Cod =
                       Dom ((f \<star> g) \<star>
                            h)\<rparr> : f \<star>
   g \<star> h \<Rightarrow> (f \<star> g) \<star> h\<guillemotright>

goal (1 subgoal):
 1. (if arr \<lparr>Chn = fgh.chine_assoc',
               Dom = Cod (f \<star> g \<star> h),
               Cod = Dom ((f \<star> g) \<star> h)\<rparr>
     then mkObj assoc'_fgh.dtrg else null) =
    \<lparr>Chn = assoc'_fgh.dtrg,
       Dom = \<lparr>Leg0 = assoc'_fgh.dtrg, Leg1 = assoc'_fgh.dtrg\<rparr>,
       Cod =
         \<lparr>Leg0 = assoc'_fgh.dtrg,
            Leg1 = assoc'_fgh.dtrg\<rparr>\<rparr>


proof (prove)
goal (1 subgoal):
 1. (\<And>A C B.
        \<lbrakk>M = zhmset_of A + C; N = zhmset_of B + C; A < B\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<forall>x. plane_vec_eq x x


proof (prove)
using this:
  \<forall>n. F1 n \<subseteq> F1 (Suc n)
  \<forall>n. F2 n \<subseteq> F2 (Suc n)

goal (1 subgoal):
 1. \<forall>n.
       F1 n \<times> F2 n \<subseteq> F1 (Suc n) \<times> F2 (Suc n)


proof (prove)
using this:
  anybranch T (\<lambda>p. closed_branch p T Cs)

goal (1 subgoal):
 1. \<exists>T.
       anybranch T (\<lambda>p. falsifies\<^sub>c\<^sub>s p Cs) \<and>
       anyinternal T (\<lambda>p. \<not> falsifies\<^sub>c\<^sub>s p Cs)


proof (prove)
goal (1 subgoal):
 1. \<bar>u y k - real k * lim (\<lambda>n. u y n / real n)\<bar>
    \<le> 2 * deltaG TYPE('a)


proof (prove)
goal (1 subgoal):
 1. aB (boolV b) = b


proof (prove)
using this:
  deg R (Cring_Poly.compose R f g) = deg R f * deg R g

goal (1 subgoal):
 1. deg R (Cring_Poly.compose R (Cring_Poly.truncate R f) g)
    < deg R (Cring_Poly.compose R (monom P (f (deg R f)) (deg R f)) g)


proof (prove)
using this:
  (SUP i. F i ?x) = ennreal (f ?x)
  \<integral>\<^sup>+ x. ennreal
                          (enn2real (F i x) *
                           indicat_real
                            (box (- (real i *\<^sub>R One))
                              (real i *\<^sub>R One))
                            x)
                     \<partial>lborel
  < \<infinity>

goal (1 subgoal):
 1. (\<lambda>x.
        enn2real (F i x) *
        indicat_real (box (- (real i *\<^sub>R One)) (real i *\<^sub>R One))
         x) integrable_on
    UNIV


proof (prove)
using this:
  ps = a # ps'
  (List tl p ps \<and>
   List tl q qs \<and>
   set ps \<inter> set qs = {} \<and> rev ps @ qs = rev Ps @ Qs) \<and>
  p = Ref a

goal (1 subgoal):
 1. List (tl(p \<rightarrow> q)) (tl (addr p)) ps' \<and>
    List (tl(p \<rightarrow> q)) p (a # qs) \<and>
    set ps' \<inter> set (a # qs) = {} \<and> rev ps' @ a # qs = rev Ps @ Qs


proof (prove)
using this:
  op \<in> set (\<Pi>\<^sub>\<O>)

goal (1 subgoal):
 1. v \<in> set (\<Pi>\<^sub>\<V>)


proof (prove)
using this:
  inv f -` carrier = carrier

goal (1 subgoal):
 1. finite_total_preorder_on (inv f -` carrier) (map_relation (inv f) le)


proof (prove)
using this:
  y \<in> A

goal (1 subgoal):
 1. orda y (luba A)


proof (prove)
goal (1 subgoal):
 1. \<langle>unit_vec n i|unit_vec n i\<rangle> = 1


proof (prove)
goal (1 subgoal):
 1. hom_induced (p - 1) (subtopology X S) {} (subtopology X S) T id
     (hom_induced (p - 1) (subtopology X T) {} (subtopology X S) {} id z) =
    \<one>\<^bsub>relative_homology_group (p - 1) (subtopology X S) T\<^esub> \<Longrightarrow>
    x =
    hom_induced (p - 1) (subtopology X S) {} (subtopology X S) T id
     (y \<otimes>\<^bsub>homology_group (p - 1) (subtopology X S)\<^esub>
      inv\<^bsub>homology_group (p - 1) (subtopology X S)\<^esub> hom_induced
                             (p - 1) (subtopology X T) {} (subtopology X S)
                             {} id z)


proof (prove)
goal (1 subgoal):
 1. shift_map_keys_punit t f (fmap_of_list xs) =
    fmap_of_list (map (\<lambda>(k, v). (t + k, f v)) xs)


proof (prove)
goal (2 subgoals):
 1. \<forall>x\<in>X.
       n_ivl (lookup (S1 \<triangle> S2) x) \<le> n_ivl (lookup S1 x)
 2. \<exists>a\<in>X.
       n_ivl (lookup (S1 \<triangle> S2) a) < n_ivl (lookup S1 a)


proof (prove)
goal (1 subgoal):
 1. 0 < m


proof (prove)
goal (1 subgoal):
 1. routing_action_next_hop_update h pk =
    routing_action_update (next_hop_update (\<lambda>_. Some h)) pk


proof (prove)
goal (1 subgoal):
 1. new_configured_SecurityInvariant
     (SINVAR_BLPtrusted.sinvar, SINVAR_BLPtrusted.default_node_properties,
      SINVAR_BLPtrusted.receiver_violation,
      BLPtrusted.node_props
       \<lparr>node_properties = BLP_security_levels\<rparr>) =
    new_configured_SecurityInvariant
     (SINVAR_BLPtrusted.sinvar, SINVAR_BLPtrusted.default_node_properties,
      SINVAR_BLPtrusted.receiver_violation,
      nm_node_props SINVAR_LIB_BLPtrusted
       \<lparr>node_properties = BLP_security_levels\<rparr>)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>S \<noteq> {};
     \<And>A.
        A \<in> S \<Longrightarrow>
        A \<subseteq> Field r \<and>
        (\<forall>a\<in>A. local.under a \<subseteq> A)\<rbrakk>
    \<Longrightarrow> \<Inter> S \<subseteq> Field r \<and>
                      (\<forall>a\<in>\<Inter> S.
                          local.under a \<subseteq> \<Inter> S)


proof (prove)
goal (1 subgoal):
 1. one_sheaf_spec U \<in> \<O> U


proof (prove)
goal (1 subgoal):
 1. l \<bullet> i = b


proof (prove)
using this:
  finite K
  inj_on g K
  pdevs_domain x \<subseteq> g ` K
  \<lbrakk>?i \<in> K; g ?i \<notin> pdevs_domain x\<rbrakk>
  \<Longrightarrow> f ?i = (0::'b)
  \<lbrakk>?i \<in> K; g ?i \<in> pdevs_domain x\<rbrakk>
  \<Longrightarrow> f ?i = e (g ?i) *\<^sub>R pdevs_apply x (g ?i)

goal (1 subgoal):
 1. (\<Sum>i\<in>the_inv_into K g ` pdevs_domain x.
       e (g i) *\<^sub>R pdevs_apply x (g i)) =
    sum f K


proof (state)
this:
  {#x \<in># hs1. x dvdm f1#} \<noteq> hs1

goal (1 subgoal):
 1. {#x \<in># hs1. x dvdm f1#} \<noteq> hs1 \<Longrightarrow> False


proof (prove)
using this:
  \<lbrakk>x\<^sub>j
           \<in> rvars_eq (\<T> s ! eq_idx_for_lvar (\<T> s) x\<^sub>i);
   lhs (\<T> s ! eq_idx_for_lvar (\<T> s) x\<^sub>i)
   \<notin> rvars_eq (\<T> s ! eq_idx_for_lvar (\<T> s) x\<^sub>i)\<rbrakk>
  \<Longrightarrow> rvars_eq
                     (pivot_eq (\<T> s ! eq_idx_for_lvar (\<T> s) x\<^sub>i)
                       x\<^sub>j) =
                    {lhs (\<T> s !
                          eq_idx_for_lvar (\<T> s) x\<^sub>i)} \<union>
                    (rvars_eq
                      (\<T> s ! eq_idx_for_lvar (\<T> s) x\<^sub>i) -
                     {x\<^sub>j})
  lhs (\<T> s ! eq_idx_for_lvar (\<T> s) x\<^sub>i) = x\<^sub>i
  x\<^sub>j \<in> rvars_eq (\<T> s ! eq_idx_for_lvar (\<T> s) x\<^sub>i)
  x\<^sub>i \<notin> rvars_eq (\<T> s ! eq_idx_for_lvar (\<T> s) x\<^sub>i)

goal (1 subgoal):
 1. rvars_eq
     (pivot_eq (\<T> s ! eq_idx_for_lvar (\<T> s) x\<^sub>i) x\<^sub>j) =
    {x\<^sub>i} \<union>
    (rvars_eq (\<T> s ! eq_idx_for_lvar (\<T> s) x\<^sub>i) - {x\<^sub>j})


proof (prove)
using this:
  periodic_orbit x
  closed_orbit ?x \<Longrightarrow> ?x \<in> X
  periodic_orbit ?x = (closed_orbit ?x \<and> 0 < period ?x)

goal (1 subgoal):
 1. x \<in> X


proof (prove)
goal (1 subgoal):
 1. \<And>a g.
       \<lbrakk>ide a;
        \<guillemotleft>g : local.prod a
                             b \<rightarrow> c\<guillemotright>\<rbrakk>
       \<Longrightarrow> \<exists>!f.
                            \<guillemotleft>f : a \<rightarrow> x\<guillemotright> \<and>
                            g = C e (local.prod f b)


proof (prove)
using this:
  simply_connected U
  simply_connected ?S =
  (path_connected ?S \<and>
   (\<forall>p.
       path p \<and>
       path_image p \<subseteq> ?S \<and>
       pathfinish p = pathstart p \<longrightarrow>
       (\<exists>a. a \<in> ?S \<and> homotopic_loops ?S p (linepath a a))))

goal (1 subgoal):
 1. path_connected U


proof (prove)
using this:
  0 < stpb \<and>
  crsp ly (abc_step_l (as', am') (Some ins)) (steps0 (s', l', r') tp stpb)
   ires

goal (1 subgoal):
 1. \<exists>stpaa\<ge>Suc stp.
       crsp ly (as, am) (steps0 (Suc 0, l, r) tp stpaa) ires


proof (prove)
goal (1 subgoal):
 1. scalar_prod (map (\<lambda>k. scalar_prod r ((v # m) ! k)) [0..<nc]) c =
    scalar_prod r (map (\<lambda>k. scalar_prod (row (v # m) k) c) [0..<nr])


proof (prove)
goal (1 subgoal):
 1. d (x \<cdot> 1\<^sub>\<pi> \<sqinter> y \<cdot> 1\<^sub>\<pi>) =
    d (x \<cdot> 1\<^sub>\<pi>) \<sqinter> d (y \<cdot> 1\<^sub>\<pi>)


proof (prove)
using this:
  V.in_hom \<tau> f g
  V.ide ?\<mu> = (arrow_of_spans (\<cdot>) ?\<mu> \<and> C.ide (Chn ?\<mu>))
  V.arr ?\<mu> = arrow_of_spans (\<cdot>) ?\<mu>
  V.dom =
  (\<lambda>\<mu>.
      if V.arr \<mu>
      then \<lparr>Chn = span_in_category.apex (\<cdot>) (Dom \<mu>),
              Dom = Dom \<mu>, Cod = Dom \<mu>\<rparr>
      else V.null)
  V.cod =
  (\<lambda>\<mu>.
      if V.arr \<mu>
      then \<lparr>Chn = span_in_category.apex (\<cdot>) (Cod \<mu>),
              Dom = Cod \<mu>, Cod = Cod \<mu>\<rparr>
      else V.null)

goal (1 subgoal):
 1. \<guillemotleft>Chn \<tau> : Chn f \<rightarrow> Chn g\<guillemotright>


proof (state)
goal (8 subgoals):
 1. \<guillemotleft>\<p>\<^sub>0[\<mu>.leg0, HH\<nu>\<pi>\<rho>.leg1] : H\<mu>HH\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<nu>\<pi>\<rho>.chine\<guillemotright>
 2. \<guillemotleft>\<p>\<^sub>1[\<mu>.leg0, H\<nu>H\<pi>\<rho>.leg1] : H\<mu>H\<nu>H\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<mu>.apex\<guillemotright>
 3. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.cod.leg0, \<rho>.cod.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>
 4. \<guillemotleft>\<p>\<^sub>0[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C \<rho>.chine\<guillemotright>
 5. \<guillemotleft>\<p>\<^sub>1[HH\<mu>\<nu>\<pi>.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
 6. \<guillemotleft>\<p>\<^sub>1[\<nu>\<pi>.leg0 \<cdot>
                                 \<mu>_\<nu>\<pi>.prj\<^sub>0, \<rho>.leg1] : HH\<mu>H\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C H\<mu>H\<nu>\<pi>.chine\<guillemotright>
 7. \<guillemotleft>\<p>\<^sub>1[assoc\<mu>\<nu>\<pi>.dom.leg0, \<rho>.leg1] : HHH\<mu>\<nu>\<pi>\<rho>.chine \<rightarrow>\<^sub>C HH\<mu>\<nu>\<pi>.chine\<guillemotright>
 8. \<guillemotleft>\<mu>_\<nu>\<pi>.prj\<^sub>0 : H\<mu>H\<nu>\<pi>.chine \<rightarrow>\<^sub>C \<nu>\<pi>.apex\<guillemotright>


proof (chain)
picking this:
  0 < ?e \<Longrightarrow>
  \<exists>f\<in>R.
     f ` S \<subseteq> {0..1} \<and>
     (\<forall>t\<in>S \<inter> V. f t < ?e) \<and>
     (\<forall>t\<in>S - U. 1 - ?e < f t)
  t0 \<in> V
  S \<inter> V \<subseteq> U


proof (state)
this:
  l \<le> 1

goal (2 subgoals):
 1. ?P \<Longrightarrow> c i j + c i' j' \<le> c i j' + c i' j
 2. \<not> ?P \<Longrightarrow> c i j + c i' j' \<le> c i j' + c i' j


proof (state)
goal (3 subgoals):
 1. \<And>i tsa p is \<theta> sb \<D> \<O> \<R> p' is' ma \<S>''.
       \<lbrakk>(ts, m, \<S>) = (tsa, ma, \<S>'');
        (ts', m', \<S>') =
        (tsa[i := (p', is @ is', \<theta>, sb, \<D>, \<O>, \<R>)], ma,
         \<S>'');
        i < length tsa; tsa ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>);
        \<theta>\<turnstile> p \<rightarrow>\<^sub>p (p', is')\<rbrakk>
       \<Longrightarrow> \<exists>ts\<^sub>h' \<S>\<^sub>h'.
                            (ts\<^sub>h, m,
                             \<S>\<^sub>h) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h',
              m', \<S>\<^sub>h') \<and>
                            ts' \<sim>\<^sub>h ts\<^sub>h'
 2. \<And>i tsa p is \<theta> sb \<D> \<O> \<R> ma \<S>'' is' \<theta>' sb'
       m'a \<D>' \<O>' \<R>' \<S>'''.
       \<lbrakk>(ts, m, \<S>) = (tsa, ma, \<S>'');
        (ts', m', \<S>') =
        (tsa[i := (p, is', \<theta>', sb', \<D>', \<O>', \<R>')], m'a,
         \<S>''');
        i < length tsa; tsa ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>);
        (is, \<theta>, sb, ma, \<D>, \<O>, \<R>,
         \<S>'') \<rightarrow>\<^sub>s\<^sub>b (is', \<theta>', sb', m'a,
          \<D>', \<O>', \<R>', \<S>''')\<rbrakk>
       \<Longrightarrow> \<exists>ts\<^sub>h' \<S>\<^sub>h'.
                            (ts\<^sub>h, m,
                             \<S>\<^sub>h) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h',
              m', \<S>\<^sub>h') \<and>
                            ts' \<sim>\<^sub>h ts\<^sub>h'
 3. \<And>i tsa p is \<theta> sb \<D> \<O> \<R> ma \<S>'' m'a sb' \<O>'
       \<R>' \<S>'''.
       \<lbrakk>(ts, m, \<S>) = (tsa, ma, \<S>'');
        (ts', m', \<S>') =
        (tsa[i := (p, is, \<theta>, sb', \<D>, \<O>', \<R>')], m'a,
         \<S>''');
        i < length tsa; tsa ! i = (p, is, \<theta>, sb, \<D>, \<O>, \<R>);
        (ma, sb, \<O>, \<R>,
         \<S>'') \<rightarrow>\<^sub>w (m'a, sb', \<O>', \<R>',
  \<S>''')\<rbrakk>
       \<Longrightarrow> \<exists>ts\<^sub>h' \<S>\<^sub>h'.
                            (ts\<^sub>h, m,
                             \<S>\<^sub>h) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h',
              m', \<S>\<^sub>h') \<and>
                            ts' \<sim>\<^sub>h ts\<^sub>h'


proof (prove)
goal (1 subgoal):
 1. (\<Sum>x<n. (1 - p) ^ x * p) = 1 - (1 - p) ^ n


proof (prove)
goal (1 subgoal):
 1. qGood (qOp delta qinp qbinp) =
    ((liftAll qGood qinp \<and>
      |{i. qinp i \<noteq> None}| <o |UNIV|) \<and>
     liftAll qGoodAbs qbinp \<and> |{i. qbinp i \<noteq> None}| <o |UNIV|)


proof (prove)
goal (1 subgoal):
 1. mat_kernel A
    \<subseteq> KA.span
                 ((\<lambda>v. v @\<^sub>v 0\<^sub>v m) ` baseB \<union>
                  (@\<^sub>v) (0\<^sub>v n) ` baseD)


proof (prove)
using this:
  i < k
  x\<^sub>1 < x
  x\<^sub>0 \<le> bs ! i * x + (hs ! i) x

goal (1 subgoal):
 1. P (bs ! i * x + (hs ! i) x)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a < b; A \<le> B\<rbrakk>
    \<Longrightarrow> add_mset a A < add_mset b B


proof (prove)
using this:
  Nml (u \<^bold>\<star> v)

goal (1 subgoal):
 1. Nml v \<and>
    \<not> is_Prim\<^sub>0 v \<and>
    \<not> is_Vcomp v \<and> \<not> is_Lunit' v \<and> \<not> is_Runit' v


proof (prove)
using this:
  (\<And>s vl s1 vl1.
      \<Delta> s vl s1 vl1 \<Longrightarrow>
      \<Delta> (?s4 s vl s1 vl1) (?vl4 s vl s1 vl1) (?s1.4 s vl s1 vl1)
       (?vl1.4 s vl s1 vl1)) \<Longrightarrow>
  match
   (\<lambda>s vl s1 vl1.
       \<Delta>' (?s4 s vl s1 vl1) (?vl4 s vl s1 vl1) (?s1.4 s vl s1 vl1)
        (?vl1.4 s vl s1 vl1))
   s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. match \<Delta>' s s1 vl1 a ou s' vl' \<or>
    ignore \<Delta>' s s1 vl1 a ou s' vl'


proof (prove)
goal (4 subgoals):
 1. \<And>queue.
       queue_invar queue \<Longrightarrow>
       queue_\<alpha> (local.enqueue_new_threads queue []) =
       Round_Robin.enqueue_new_threads (queue_\<alpha> queue) []
 2. \<And>queue.
       queue_invar queue \<Longrightarrow>
       queue_invar (local.enqueue_new_threads queue [])
 3. \<And>a ntas queue.
       \<lbrakk>\<And>queue.
                   queue_invar queue \<Longrightarrow>
                   queue_\<alpha> (local.enqueue_new_threads queue ntas) =
                   Round_Robin.enqueue_new_threads (queue_\<alpha> queue)
                    ntas;
        \<And>queue.
           queue_invar queue \<Longrightarrow>
           queue_invar (local.enqueue_new_threads queue ntas);
        queue_invar queue\<rbrakk>
       \<Longrightarrow> queue_\<alpha>
                          (local.enqueue_new_threads queue (a # ntas)) =
                         Round_Robin.enqueue_new_threads
                          (queue_\<alpha> queue) (a # ntas)
 4. \<And>a ntas queue.
       \<lbrakk>\<And>queue.
                   queue_invar queue \<Longrightarrow>
                   queue_\<alpha> (local.enqueue_new_threads queue ntas) =
                   Round_Robin.enqueue_new_threads (queue_\<alpha> queue)
                    ntas;
        \<And>queue.
           queue_invar queue \<Longrightarrow>
           queue_invar (local.enqueue_new_threads queue ntas);
        queue_invar queue\<rbrakk>
       \<Longrightarrow> queue_invar
                          (local.enqueue_new_threads queue (a # ntas))


proof (prove)
using this:
  x \<in> left_app ` pos_of t1

goal (1 subgoal):
 1. (\<And>q.
        \<lbrakk>x = indices.Left # q; position_in q t1\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  equator \<noteq> meridian
  proj2_incident K2_centre equator
  proj2_incident K2_centre meridian
  proj2_incident c (apply_cltn2_line equator J)
  proj2_incident c (apply_cltn2_line meridian J)

goal (1 subgoal):
 1. apply_cltn2 K2_centre J = c


proof (prove)
goal (1 subgoal):
 1. outs_\<I> \<I> \<turnstile>\<^sub>R res \<approx> res'


proof (prove)
goal (1 subgoal):
 1. v $ (j - i) \<le> \<langle>x\<rangle> j


proof (state)
this:
  ?k3 < n \<Longrightarrow> norm (v1 ?k3 * v2 ?k3) \<le> b1 * b2

goal (1 subgoal):
 1. \<And>i j.
       \<lbrakk>i < dim_row (A1 * A2); j < dim_col (A1 * A2)\<rbrakk>
       \<Longrightarrow> norm ((A1 * A2) $$ (i, j)) \<le> b1 * b2 * real n


proof (prove)
goal (1 subgoal):
 1. compare_1_rat y x = compare (real_of_rat x) (real_of_1 y)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>prf \<in> proof; \<phi> \<in> fmla; Fvars \<phi> = {};
     isTrue (PPf (encPf prf) \<langle>\<phi>\<rangle>)\<rbrakk>
    \<Longrightarrow> bprv (PPf (encPf prf) \<langle>\<phi>\<rangle>)


proof (state)
this:
  set prevs' =
  set [] \<union>
  \<Union>
   {next_subseqs2_set tail v [0..<i] |v i. (i, v) \<in> set prevs} \<and>
  set out =
  set [] \<union>
  ((f head \<circ> snd) ` set prevs \<union>
   \<Union> {out_subseqs2_set tail v [0..<i] |v i. (i, v) \<in> set prevs})

goal (2 subgoals):
 1. set prevs' =
    {uu_.
     \<exists>v i j.
        uu_ = (j, f (tail !! j) v) \<and>
        (i, v) \<in> set prevs \<and> j < i}
 2. set out = (f head \<circ> snd) ` set prevs \<union> snd ` set prevs'


proof (prove)
using this:
  lookup (row_to_poly (pps_to_list S) (row A i)) u \<noteq> (0::'b)

goal (1 subgoal):
 1. (\<And>j.
        \<lbrakk>j < length (pps_to_list S); u = pps_to_list S ! j\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  order.greater_eq
   (\<Union>a\<in>fundfoldpairs.
       case a of (f, g) \<Rightarrow> {Abs_induced_automorph f g})
   (set ss) \<Longrightarrow>
  gallery (fold fst (map Spair ss) \<Turnstile> Cs)
  order.greater_eq
   (\<Union>a\<in>fundfoldpairs.
       case a of (f, g) \<Rightarrow> {Abs_induced_automorph f g})
   (set (ss @ [s]))

goal (1 subgoal):
 1. gallery
     (fst (Spair s) \<Turnstile> (fold fst (map Spair ss) \<Turnstile> Cs))


proof (prove)
using this:
  ?A1 \<in> set As \<Longrightarrow> \<not> INTERP N \<Turnstile> C_of ?A1

goal (1 subgoal):
 1. \<not> Multiset.Bex (\<Sum>\<^sub># (mset (map C_of As)))
            ((\<Turnstile>l) (INTERP N))


proof (prove)
goal (1 subgoal):
 1. \<exists>c1 c2.
       \<forall>k.
          norm_bound (of_real_hom.mat_hom A ^\<^sub>m k)
           (c1 + c2 * real k ^ (d - 1))


proof (prove)
goal (1 subgoal):
 1. cos ` set_of (real_interval x)
    \<subseteq> set_of (real_interval (cos_float_interval p x))


proof (prove)
goal (1 subgoal):
 1. Limit.cone J' C (D \<circ> F) a (\<chi> \<circ> F)


proof (prove)
using this:
  weak_barbed_bisimulation Rel CWB

goal (1 subgoal):
 1. weak_barbed_bisimulation (Rel\<^sup>=) CWB


proof (prove)
goal (1 subgoal):
 1. dsn =
    (case dests dip of None \<Rightarrow> \<pi>\<^sub>2 (the (rt dip))
     | Some rsn \<Rightarrow> rsn) \<and>
    dsk = \<pi>\<^sub>3 (the (rt dip)) \<and>
    flag =
    (if dests dip = None then \<pi>\<^sub>4 (the (rt dip))
     else Aodv_Basic.inv) \<and>
    hops = \<pi>\<^sub>5 (the (rt dip)) \<and>
    nhip = \<pi>\<^sub>6 (the (rt dip)) \<and>
    pre = \<pi>\<^sub>7 (the (rt dip))


proof (prove)
using this:
  list_all carrier_coeff []
  list_all (\<lambda>Q. index_free Q i) []

goal (1 subgoal):
 1. \<exists>m.
       count m i = length [] + k \<and>
       indexed_eval_aux ([] @ [P]) i m \<noteq> \<zero>


proof (prove)
using this:
  weak_unit a
  a \<cong> a'
  natural_isomorphism Right_a.comp Right_a.comp Right_a.R Right_a.map
   Right_a.\<rr>
  naturally_isomorphic ?A ?B ?F ?G =
  (\<exists>\<tau>. natural_isomorphism ?A ?B ?F ?G \<tau>)

goal (1 subgoal):
 1. naturally_isomorphic Right_a.comp Right_a.comp Right_a.R Right_a.map


proof (prove)
goal (1 subgoal):
 1. Gauss_Jordan_in_ij A Greatest_plus_one (mod_type_class.from_nat k) $
    Greatest_plus_one $
    mod_type_class.from_nat k =
    (1::'a)


proof (prove)
using this:
  set ?fs \<subseteq> set (deg_shifts ?d ?fs)

goal (1 subgoal):
 1. ideal (set fs) \<subseteq> ideal (set (deg_shifts d fs))


proof (prove)
goal (1 subgoal):
 1. fst ` edges (the_lcg sel Rules (0, {})) \<subseteq> L


proof (prove)
goal (1 subgoal):
 1. \<And>fun rbt.
       ord.is_rbt cless rbt \<or> ID ccompare = None \<Longrightarrow>
       ord.is_rbt cless
        (rbtreeify (filter fun (RBT_Impl.entries rbt))) \<or>
       ID ccompare = None


proof (prove)
using this:
  \<exists>t' p.
     subterm t1 p t' \<and> root_term S t' \<and> trm_rep t' S \<noteq> t'

goal (1 subgoal):
 1. (\<And>p t'.
        \<lbrakk>subterm t1 p t'; root_term S t';
         trm_rep t' S \<noteq> t'\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  Right.ide f
  Right.ide ?f \<Longrightarrow> Right.iso (Right.runit ?f)
  Right.arr ?\<phi> \<Longrightarrow> Right.iso ?\<phi> = local.iso ?\<phi>

goal (1 subgoal):
 1. local.iso (Right.runit f)


proof (prove)
goal (1 subgoal):
 1. prod f {m..n} =
    (if n < m then 1::'a
     else if n = 0 then f 0 else f n * prod f {m..n - 1})


proof (prove)
goal (2 subgoals):
 1. \<And>ca mu c'a E.
       \<lbrakk>While e c = cxt_to_stmt E (ca@[mu]); c' = cxt_to_stmt E c'a;
        \<langle>ca, update_modes mu
                      mds, mem\<rangle>\<^sub>w \<leadsto>\<^sub>w
        \<langle>c'a, mds', mem'\<rangle>\<^sub>w\<rbrakk>
       \<Longrightarrow> c' = Stmt.If e (c ;; While e c) Stop \<and>
                         mds' = mds \<and> mem' = mem
 2. \<And>b c\<^sub>1.
       \<lbrakk>While e c = Await b c\<^sub>1; eval\<^sub>B mem b;
        no_await c\<^sub>1;
        \<langle>c\<^sub>1, mds, mem\<rangle>\<^sub>w \<leadsto>\<^sub>w\<^sup>+ \<langle>c', mds', mem'\<rangle>\<^sub>w;
        is_final c'\<rbrakk>
       \<Longrightarrow> c' = Stmt.If e (c ;; While e c) Stop \<and>
                         mds' = mds \<and> mem' = mem


proof (prove)
using this:
  [:d:] * factor = [:c:] * local.g

goal (1 subgoal):
 1. smult d factor = [:c:] * local.g


proof (prove)
using this:
  0 < e_orig

goal (1 subgoal):
 1. 0 < e


proof (chain)
picking this:
  pres_type step (length is) A
  PROP ?psi \<Longrightarrow> PROP ?psi
  PROP ?psi \<Longrightarrow> PROP ?psi
  wtl (take n is) c 0 s \<in> A
  n < length is


proof (prove)
using this:
  ?x \<in> carrier G \<Longrightarrow>
  h (?x [^] ?n) = h ?x [^]\<^bsub>H\<^esub> ?n

goal (1 subgoal):
 1. x \<in> carrier G \<Longrightarrow>
    h (x [^] n) = h x [^]\<^bsub>H\<^esub> n


proof (prove)
using this:
  isVal (Lam [y]. e') \<Longrightarrow>
  \<Gamma> : e \<Down>\<^bsub>upds_list
                               (Arg x # S)\<^esub> \<Delta>' : Lam [y]. e'

goal (1 subgoal):
 1. \<Gamma> : e \<Down>\<^bsub>upds_list S\<^esub> \<Delta>' : Lam [y]. e'


proof (prove)
using this:
  i < length a
  big_d' a b y i \<noteq> []
  length y \<le> length b
  finite (set (big_d' a b ?y ?i))
  \<lbrakk>finite ?A; ?A \<noteq> {}\<rbrakk>
  \<Longrightarrow> Min ?A \<in> ?A

goal (1 subgoal):
 1. Min (set (big_d' a b y i)) \<in> set (big_d' a b y i)


proof (state)
this:
  cor (1 - Z) = 2 / cor (1 + (cmod z)\<^sup>2)

goal (1 subgoal):
 1. \<exists>k.
       k \<noteq> 0 \<and>
       (cor X + \<i> * cor Y, cor (1 - Z)) = k *\<^sub>s\<^sub>v (z1, z2)


proof (prove)
goal (1 subgoal):
 1. (Collect ((\<in>) i) \<subseteq> Collect ((\<in>) j) \<and>
     Collect ((\<in>) j) \<subseteq> Collect ((\<in>) i)) =
    (i = j) &&&
    \<not> (Collect ((\<in>) i) \<subseteq> - Collect ((\<in>) j) \<and>
            - Collect ((\<in>) j) \<subseteq> Collect ((\<in>) i)) &&&
    \<not> (- Collect ((\<in>) i) \<subseteq> Collect ((\<in>) j) \<and>
            Collect ((\<in>) j) \<subseteq> - Collect ((\<in>) i))


proof (prove)
goal (1 subgoal):
 1. poly_deg g = Suc (deg_pm t')


proof (state)
goal (1 subgoal):
 1. \<And>x xa. normalization_euclidean_semiring_class.gcd x xa = gcd x xa


proof (prove)
goal (1 subgoal):
 1. countable
     ((\<lambda>(x, y). ball x y) `
      (\<Union> (f ` (\<rat> \<inter> {0<..})) \<times> \<rat>))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>xT \<noteq> yU; fresh yU u\<rbrakk>
    \<Longrightarrow> subst xT u (close_Var i yU t) =
                      close_Var i yU (subst xT u t)


proof (prove)
using this:
  a \<in>\<^sub>\<circ> \<BB>\<lparr>Obj\<rparr>
  b \<in>\<^sub>\<circ> \<BB>\<lparr>Obj\<rparr>

goal (1 subgoal):
 1. v11 (vid_on
          (\<BB>\<lparr>Arr\<rparr>) \<restriction>\<^sup>l\<^sub>\<circ>
         Hom \<BB> a b)


proof (prove)
goal (1 subgoal):
 1. sim_val SPR.MC spr_simMC spr_sim


proof (prove)
goal (1 subgoal):
 1. \<And>i.
       \<lbrakk>i < DIM('a); DIM('a) - Suc 0 \<le> i\<rbrakk>
       \<Longrightarrow> b \<bullet> Basis_list ! (DIM('a) - Suc 0) =
                         b \<bullet> Basis_list ! i


proof (prove)
goal (1 subgoal):
 1. \<forall>b\<in>set (proj l B).
       \<exists>a\<in>set (proj l A).
          \<exists>\<delta>.
             b =
             a \<cdot>\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>p
             \<delta> \<and>
             wt\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t \<delta> \<and>
             wf\<^sub>t\<^sub>r\<^sub>m\<^sub>s (subst_range \<delta>)


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       \<lbrakk>Group_Theory.monoid (f ` I) addB zeroB; x \<in> I\<rbrakk>
       \<Longrightarrow> \<exists>v\<in>I.
                            addB (f x) (f v) = zeroB \<and>
                            addB (f v) (f x) = zeroB


proof (prove)
using this:
  \<D>\<^sub>\<circ> (fflip (fflip f)) = \<D>\<^sub>\<circ> f
  fbrelation (\<D>\<^sub>\<circ> f)
  x \<in>\<^sub>\<circ> \<D>\<^sub>\<circ> (fflip (fflip f))

goal (1 subgoal):
 1. (\<And>a b.
        x = [a, b]\<^sub>\<circ> \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Derivation u D []; t \<in> set u\<rbrakk>
    \<Longrightarrow> is_nonterminal t


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>finite X; X \<noteq> {}\<rbrakk>
    \<Longrightarrow> \<exists>x\<in>X. Max X = x


proof (prove)
using this:
  (cnj (y' * cnj z' - cnj y' * z') = y' * cnj z' - cnj y' * z') =
  is_real (y' * cnj z' - cnj y' * z')

goal (1 subgoal):
 1. is_real (\<i> * (y' * cnj z' - cnj y' * z'))


proof (state)
this:
  w = ls' ! last_index Vs V

goal (1 subgoal):
 1. \<And>a.
       l V = \<lfloor>a\<rfloor> \<Longrightarrow>
       [Vs [\<mapsto>] ls'](V := l V) \<subseteq>\<^sub>m
       [Vs [\<mapsto>] ls']


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<noteq> {};
     \<exists>!m. m \<in> A \<and> (\<forall>x\<in>A. m \<le> x)\<rbrakk>
    \<Longrightarrow> Nleast A \<in> A \<and>
                      (\<forall>x\<in>A. Nleast A \<le> x)


proof (prove)
goal (1 subgoal):
 1. atm_of ` set_mset {#L#} = {atm_of L}


proof (prove)
goal (1 subgoal):
 1. OFCLASS('a word, set_bit_class)


proof (prove)
goal (1 subgoal):
 1. \<Union> (range A) \<inter> b \<in> smallest_ccdi_sets \<Omega> M


proof (prove)
using this:
  hindrance_by (\<Gamma>\<lparr>weight := weight \<Gamma> - u\<rparr>) f
   \<epsilon>

goal (1 subgoal):
 1. (\<And>a.
        \<lbrakk>a \<in> A \<Gamma>;
         a \<notin> \<E>\<^bsub>\<Gamma>\<lparr>weight := weight \<Gamma> - u\<rparr>\<^esub>
                     (TER\<^bsub>\<Gamma>\<lparr>weight := weight \<Gamma> - u\<rparr>\<^esub>
                       f);
         d_OUT f a < weight \<Gamma> a;
         \<epsilon> < weight \<Gamma> a - d_OUT f a;
         0 \<le> \<epsilon>\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. the (enum_alt (THE n. enum_alt n = Some x)) = x


proof (prove)
using this:
  a = snd (splitAt ram2 vs)
  before vs ram1 ram2
  pre_between vs ram1 ram2
  vs =
  (hd vs # b) @
  [ram1] @
  fst (splitAt ram2 (snd (splitAt ram1 vs))) @
  [ram2] @ snd (splitAt ram2 vs)

goal (1 subgoal):
 1. vs = [hd vs] @ b @ [ram1] @ between vs ram1 ram2 @ [ram2] @ a


proof (prove)
using this:
  finite A

goal (1 subgoal):
 1. distinct (sorted_list_of_set A)


proof (state)
goal (1 subgoal):
 1. P S


proof (prove)
goal (1 subgoal):
 1. spmf (completeness_game h w e) True = spmf (return_spmf True) True


proof (prove)
goal (1 subgoal):
 1. \<forall>x y.
       A x y \<longrightarrow>
       (\<forall>xa ya.
           (\<forall>t.
               cin t xa \<longrightarrow>
               (\<exists>u. cin u ya \<and> A t u)) \<and>
           (\<forall>t.
               cin t ya \<longrightarrow>
               (\<exists>u. cin u xa \<and> A u t)) \<longrightarrow>
           (\<forall>t.
               cin t (cinsert x xa) \<longrightarrow>
               (\<exists>u. cin u (cinsert y ya) \<and> A t u)) \<and>
           (\<forall>t.
               cin t (cinsert y ya) \<longrightarrow>
               (\<exists>u. cin u (cinsert x xa) \<and> A u t)))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Crypt (pubK TTP)
              \<lbrace>Agent S, Number AO, Key K, Agent R, hs\<rbrace>
             \<in> used evs;
     Key K \<notin> analz (knows Spy evs); evs \<in> certified_mail\<rbrakk>
    \<Longrightarrow> \<exists>m ctxt q.
                         hs =
                         Hash
                          \<lbrace>Number ctxt, Nonce q, response S R q,
                            Crypt K (Number m)\<rbrace> \<and>
                         Says S R
                          \<lbrace>Agent S, Agent TTP, Crypt K (Number m),
                            Number AO, Number ctxt, Nonce q,
                            Crypt (pubK TTP)
                             \<lbrace>Agent S, Number AO, Key K, Agent R,
                               hs\<rbrace>\<rbrace>
                         \<in> set evs


proof (prove)
goal (1 subgoal):
 1. \<And>a br.
       br \<in> {(b, y). ok2 y} \<Longrightarrow>
       (case case br of (m, r) \<Rightarrow> (False, shift2 m r a) of
        (m, r) \<Rightarrow> L_a (m, strip2 r)) =
       Deriv a (case br of (m, r) \<Rightarrow> L_a (m, strip2 r))


proof (prove)
goal (1 subgoal):
 1. (THE pa. lift_spmf p = lift_spmf pa) = p


proof (prove)
goal (1 subgoal):
 1. pmf z (x, y) = enn2real (h x y)


proof (state)
this:
  connected (real_of ` inside)

goal (1 subgoal):
 1. (\<And>inside outside.
        \<lbrakk>inside \<noteq> {}; open inside; connected inside;
         outside \<noteq> {}; open outside; connected outside;
         bounded inside; \<not> bounded outside;
         inside \<inter> outside = {};
         inside \<union> outside = - path_image c;
         frontier inside = path_image c;
         frontier outside = path_image c\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (state)
this:
  (transform a (Terms.Let \<Delta> body))[x::=y] =
  transform a (Terms.Let \<Delta> body)[x::=y]

goal (5 subgoals):
 1. \<And>var x y a.
       (transform a (Var var))[x::=y] = transform a (Var var)[x::=y]
 2. \<And>exp var x y a.
       (\<And>b ba a.
           (transform a exp)[b::=ba] =
           transform a exp[b::=ba]) \<Longrightarrow>
       (transform a (App exp var))[x::=y] = transform a (App exp var)[x::=y]
 3. \<And>var exp x y a.
       \<lbrakk>atom var \<sharp> x; atom var \<sharp> y;
        \<And>b ba a.
           (transform a exp)[b::=ba] = transform a exp[b::=ba]\<rbrakk>
       \<Longrightarrow> (transform a (Lam [var]. exp))[x::=y] =
                         transform a (Lam [var]. exp)[x::=y]
 4. \<And>b x y a.
       (transform a (Bool b))[x::=y] = transform a (Bool b)[x::=y]
 5. \<And>scrut e1 e2 x y a.
       \<lbrakk>\<And>b ba a.
                   (transform a scrut)[b::=ba] = transform a scrut[b::=ba];
        \<And>b ba a. (transform a e1)[b::=ba] = transform a e1[b::=ba];
        \<And>b ba a.
           (transform a e2)[b::=ba] = transform a e2[b::=ba]\<rbrakk>
       \<Longrightarrow> (transform a (scrut ? e1 : e2))[x::=y] =
                         transform a (scrut ? e1 : e2)[x::=y]


proof (prove)
goal (1 subgoal):
 1. w \<sqinter> top * e\<^sup>T * w\<^sup>T\<^sup>\<star> \<sqinter>
    F * e\<^sup>T * top \<sqinter>
    top * e * - F \<sqinter>
    F
    \<le> F * e\<^sup>T * top \<sqinter> F


proof (prove)
using this:
  conc.globally_sound_mode_use gc\<^sub>C
  list_all (\<lambda>cm. conc.locally_sound_mode_use (cm, snd gc\<^sub>C))
   (fst gc\<^sub>C)

goal (1 subgoal):
 1. case gc\<^sub>C of
    (cms, mem) \<Rightarrow>
      list_all (\<lambda>cm. conc.locally_sound_mode_use (cm, mem))
       cms \<and>
      conc.globally_sound_mode_use (cms, mem)


proof (prove)
using this:
  f_range_on A f
  C \<subseteq> A \<and> B - C \<subseteq> A \<longrightarrow>
  f (C \<union> (B - C)) \<subseteq> f C \<union> f (B - C)
  B \<subseteq> A
  C \<subseteq> B

goal (1 subgoal):
 1. f B \<inter> C \<subseteq> f C


proof (prove)
goal (1 subgoal):
 1. DList_set dxs1 \<union> DList_set dxs2 =
    (case ID CEQ('c) of
     None \<Rightarrow>
       Code.abort STR ''union DList_set DList_set: ceq = None''
        (\<lambda>_. DList_set dxs1 \<union> DList_set dxs2)
     | Some x \<Rightarrow> DList_set (DList_Set.union dxs1 dxs2))


proof (prove)
using this:
  \<forall>i. f i \<noteq> []
  f \<in> SEQ (lists A)

goal (1 subgoal):
 1. f' \<in> SEQ (lists A)


proof (prove)
using this:
  S = Some S'
  s \<in> \<gamma>\<^sub>f S'
  s x \<in> \<gamma> (lookup S' x)
  s x \<in> \<gamma> a
  s \<in> \<gamma>\<^sub>o S

goal (1 subgoal):
 1. s \<in> \<gamma>\<^sub>o (afilter (V x) a S)


proof (prove)
goal (1 subgoal):
 1. \<And>a x y.
       \<lbrakk>a \<in> carrier R; x \<in> carrier M;
        y \<in> carrier M\<rbrakk>
       \<Longrightarrow> a \<odot>\<^bsub>M\<^esub>
                         x \<otimes>\<^bsub>M\<^esub>
                         y =
                         a \<odot>\<^bsub>M\<^esub>
                         (x \<otimes>\<^bsub>M\<^esub> y)


proof (prove)
using this:
  x \<notin> path_image \<gamma>

goal (1 subgoal):
 1. x \<in> inside (path_image \<gamma>)


proof (prove)
goal (1 subgoal):
 1. P \<turnstile> C sees M, b :  Ts\<rightarrow>T = m in D \<Longrightarrow>
    P \<turnstile> D sees M, b :  Ts\<rightarrow>T = m in D


proof (prove)
goal (1 subgoal):
 1. rec_eval rec_imp [x, y] = (if 0 < x \<and> y = 0 then 0 else 1)


proof (prove)
goal (1 subgoal):
 1. set (map prot_atom.Atom enum_class.enum) \<inter>
    set [Value, SetType, AttackType, Bottom, OccursSecType] =
    {}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<subseteq>\<^sub>\<preceq> B;
     B \<subseteq>\<^sub>\<preceq> C\<rbrakk>
    \<Longrightarrow> A \<subseteq>\<^sub>\<preceq> C


proof (prove)
goal (1 subgoal):
 1. eval
     (Cn 1 r_ifz
       [r_e2stack, Cn 1 r_prod_encode [Z, r_e2rv],
        Cn 1 r_ifz
         [r_e2i, Cn 1 r_prod_encode [r_e2tail, r_const 1],
          Cn 1 r_ifeq
           [r_e2i, r_const 1,
            Cn 1 r_prod_encode
             [r_e2tail, Cn 1 S [Cn 1 S [Cn 1 r_hd [r_e2xs]]]],
            Cn 1 r_ifeq
             [Cn 1 r_kind [r_e2i], r_const 2,
              Cn 1 r_prod_encode
               [r_e2tail,
                Cn 1 S [Cn 1 r_nth [r_e2xs, Cn 1 r_pdec22 [r_e2i]]]],
              Cn 1 r_ifeq
               [Cn 1 r_kind [r_e2i], r_const 3, r_step_Cn,
                Cn 1 r_ifeq
                 [Cn 1 r_kind [r_e2i], r_const 4, r_step_Pr,
                  Cn 1 r_ifeq
                   [Cn 1 r_kind [r_e2i], r_const 5, r_step_Mn, Z]]]]]]])
     [e] \<down>=
    (if e2stack e = 0 then prod_encode (0, e2rv e)
     else if e2i e = 0 then prod_encode (e2tail e, 1)
          else if e2i e = 1
               then prod_encode (e2tail e, Suc (Suc (e_hd (e2xs e))))
               else if encode_kind (e2i e) = 2
                    then prod_encode
                          (e2tail e, Suc (e_nth (e2xs e) (pdec22 (e2i e))))
                    else if encode_kind (e2i e) = 3 then estep_Cn e
                         else if encode_kind (e2i e) = 4 then estep_Pr e
                              else if encode_kind (e2i e) = 5
                                   then estep_Mn e else 0)


proof (prove)
using this:
  ID cbl \<noteq> None

goal (1 subgoal):
 1. keys t = dom (lookup t)


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       (\<sigma> \<circ> \<mu>) x \<le> (\<sigma> \<circ> \<P> \<sigma>) x


proof (state)
goal (1 subgoal):
 1. \<guillemotleft>\<l>\<^sub>D\<^sup>-\<^sup>1[G f \<star>\<^sub>D
           G.map\<^sub>0
            (F.map\<^sub>0
              b)] : G f \<star>\<^sub>D
                    G.map\<^sub>0
                     (F.map\<^sub>0
                       b) \<cong>\<^sub>D G.map\<^sub>0
     (F.map\<^sub>0 b') \<star>\<^sub>D
    G f \<star>\<^sub>D G.map\<^sub>0 (F.map\<^sub>0 b)\<guillemotright>


proof (prove)
goal (1 subgoal):
 1. apply_chart d1 y \<in> X


proof (prove)
goal (1 subgoal):
 1. \<exists>x. \<phi> i x \<up>


proof (state)
goal (1 subgoal):
 1. gen_model M t = gen_model M' t


proof (prove)
using this:
  ?x \<in> sets ?M \<Longrightarrow> ?x \<subseteq> space ?M

goal (1 subgoal):
 1. {uu_.
     \<exists>S N N'.
        uu_ = S \<union> N \<and>
        S \<in> sets M \<and> N' \<in> null_sets M \<and> N \<subseteq> N'}
    \<subseteq> Pow (space M)


proof (prove)
goal (1 subgoal):
 1. sin (2 * pi * k) \<noteq> sin (2 * pi * n)


proof (prove)
using this:
  invariant_1_2 (p1, l1, r1)

goal (1 subgoal):
 1. poly (real_of_int_poly p1) (real_of_1 (p1, l1, r1)) = 0 \<and>
    p1 \<noteq> 0


proof (prove)
using this:
  c \<in> P[- X]

goal (1 subgoal):
 1. monomial c t = focus X (monomial (1::'b) t * c)


proof (prove)
goal (1 subgoal):
 1. z * z \<sqinter> y * y\<^sup>T \<le> (1::'a) '


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>v\<^sub>e\<^sup>2 / (2 * a\<^sub>o - 2 * a\<^sub>e) +
             v\<^sub>o\<^sup>2 / (2 * a\<^sub>o) +
             v\<^sub>e * \<delta>
             < s\<^sub>o - s\<^sub>e;
     other.t_stop \<le> 0; u_max < s\<^sub>o; \<not> \<delta> \<le> 0;
     other.p_max \<le> u_max\<rbrakk>
    \<Longrightarrow> v\<^sub>e\<^sup>2 / (2 * a\<^sub>o - 2 * a\<^sub>e)
                      < s\<^sub>o + v\<^sub>o\<^sup>2 / (2 * a\<^sub>o) -
                        s\<^sub>e -
                        v\<^sub>e * \<delta>


proof (prove)
using this:
  ts_tuple_rel (set auxlist) =
  {as \<in> ts_tuple_rel
             (set (linearize data_prev) \<union> set (linearize data_in)).
   valid_tuple tuple_since as}

goal (1 subgoal):
 1. ts_tuple_rel
     (set (filter (\<lambda>(t, rel). enat (nt - t) \<le> right I)
            auxlist)) =
    {as \<in> ts_tuple_rel
               (set (linearize data_prev') \<union>
                set (linearize data_in')).
     valid_tuple tuple_since as}


proof (prove)
goal (1 subgoal):
 1. \<And>m n.
       \<lbrakk>prime p; x * x = real p; 0 \<le> x; n \<noteq> 0;
        \<bar>x\<bar> = real m / real n; coprime m n\<rbrakk>
       \<Longrightarrow> False


proof (prove)
using this:
  intact slices W I\<^sub>1
  intact slices W I\<^sub>2

goal (1 subgoal):
 1. i1.orig.quorum (I\<^sub>1 \<union> I\<^sub>2)


proof (prove)
goal (1 subgoal):
 1. finite UNIV


proof (prove)
goal (1 subgoal):
 1. statically_complete_calculus Bot_FL Inf_FL (\<Turnstile>\<inter>\<G>L)
     Red_I Red_F


proof (prove)
goal (1 subgoal):
 1. principalideal {x * a |x. True} \<Z>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>g' \<in> set (next_plane0\<^bsub>p\<^esub> g);
     Invariants.inv g; Invariants.inv g';
     set (ExcessTable g (vertices g))
     \<subseteq> set (ExcessTable g' (vertices g'))\<rbrakk>
    \<Longrightarrow> ExcessNotAt g None \<le> ExcessNotAt g' None


proof (prove)
goal (1 subgoal):
 1. subgroup {a [^] i |i. i \<in> {0..ord a - 1}} G


proof (prove)
goal (1 subgoal):
 1. (\<And>q.
        \<lbrakk>q \<in> W; Q' = Q \<union> br_dsq \<delta> q (Q, W);
         W' = W - {q} \<union> (br_dsq \<delta> q (Q, W) - Q)\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (state)
this:
  list_all2 (rel_prod yun_erel (=)) fs Fs

goal (2 subgoals):
 1. square_free_heuristic f = None \<Longrightarrow>
    square_free_factorization f (1, fs) \<and>
    (\<forall>fi i.
        (fi, i) \<in> set fs \<longrightarrow>
        content fi = 1 \<and> 0 < lead_coeff fi) \<and>
    distinct (map snd fs)
 2. \<And>a.
       square_free_heuristic f = Some a \<Longrightarrow>
       square_free_factorization f (1, fs) \<and>
       (\<forall>fi i.
           (fi, i) \<in> set fs \<longrightarrow>
           content fi = 1 \<and> 0 < lead_coeff fi) \<and>
       distinct (map snd fs)


proof (prove)
using this:
  inj_on (inv_into (path_components_of X) h) (path_components_of Y) \<and>
  inv_into (path_components_of X) h ` path_components_of Y =
  path_components_of X

goal (1 subgoal):
 1. path_components_of Y \<subseteq> {a} \<Longrightarrow>
    path_components_of X \<subseteq> {inv_into (path_components_of X) h a}


proof (prove)
goal (1 subgoal):
 1. linear_orderable_1 x \<Longrightarrow>
    linear_orderable_2 (x \<sqinter> - (1::'a))


proof (prove)
using this:
  ((\<lambda>x. enn2ereal (ennreal (f x))) \<longlongrightarrow>
   enn2ereal (ennreal x))
   F =
  ((\<lambda>x. ereal (f x)) \<longlongrightarrow> enn2ereal (ennreal x)) F

goal (1 subgoal):
 1. (f \<longlongrightarrow> x) F


proof (prove)
using this:
  i \<notin> block_nominals (ps, a)
  j \<notin> block_nominals (ps, a)
  sub_block id ?block = ?block
  ?i \<notin> block_nominals ?block \<Longrightarrow>
  sub_block (?f(?i := ?j)) ?block = sub_block ?f ?block

goal (1 subgoal):
 1. sub_block (id(i := j, j := i)) (ps, a) = (ps, a)


proof (prove)
using this:
  \<not> \<U>
          (foldl (\<lambda>s' a. if \<U> s' then s' else assert a s')
            (init t) as')
  P (set as') (assert_all_state t as') \<and>
  index_valid (set as') (assert_all_state t as')

goal (1 subgoal):
 1. P (set (as' @ [a])) (assert_all_state t (as' @ [a])) \<and>
    index_valid (set (as' @ [a])) (assert_all_state t (as' @ [a]))


proof (prove)
goal (1 subgoal):
 1. 1 \<le> j


proof (prove)
goal (1 subgoal):
 1. z \<cdot> a' \<cdot> b\<^sup>\<star>
    \<le> a \<cdot> z \<cdot> b\<^sup>\<star>


proof (prove)
goal (1 subgoal):
 1. matrix_to_iarray (echelon_form_of_upt_k A (ncols A - 1) bezout) =
    echelon_form_of_upt_k_iarrays (matrix_to_iarray A)
     (ncols_iarray (matrix_to_iarray A) - 1) bezout


proof (prove)
goal (1 subgoal):
 1. p = 0\<^sub>p


proof (prove)
goal (1 subgoal):
 1. set X \<inter> range_vars (rm_vars (set X) \<theta>) = {}


proof (prove)
using this:
  ?e2 \<in> parcs G \<Longrightarrow>
  \<exists>u p v. gen_iapath (pverts G) u p v \<and> ?e2 \<in> set p
  gen_iapath (pverts G) ?u2 ?p2 ?v2 \<Longrightarrow> ?p2 = [(?u2, ?v2)]

goal (1 subgoal):
 1. (\<forall>v\<in>pverts G.
        v \<in> pverts G \<or>
        in_degree (with_proj G) v \<le> 2 \<and>
        (\<exists>x p y.
            gen_iapath (pverts G) x p y \<and>
            v \<in> set (pawalk_verts x p))) \<and>
    (\<forall>e\<in>parcs G.
        fst e \<noteq> snd e \<and>
        (\<exists>x p y.
            gen_iapath (pverts G) x p y \<and> e \<in> set p)) \<and>
    (\<forall>u v p q.
        gen_iapath (pverts G) u p v \<and>
        gen_iapath (pverts G) u q v \<longrightarrow>
        p = q) \<and>
    pverts G \<subseteq> pverts G


proof (prove)
using this:
  X \<sharp> \<theta>
  X \<sharp> \<Gamma>

goal (1 subgoal):
 1. X \<sharp> \<theta><\<Gamma>>


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(b, b') \<in> stutter_extend_edges b.V b.E;
     (a, b) \<in> R\<rbrakk>
    \<Longrightarrow> \<exists>a'.
                         (a, a') \<in> stutter_extend_edges a.V a.E \<and>
                         (a', b') \<in> R


proof (prove)
goal (1 subgoal):
 1. d' dvd d


proof (prove)
using this:
  (\<not> eventually ?p ?f \<or>
   eventually ?pa ?f \<or> ?p (rr ?p ?pa)) \<and>
  (\<not> eventually ?p ?fa \<or>
   \<not> ?pa (rr ?p ?pa) \<or> eventually ?pa ?fa)
  ?r \<notin> existence_ivl ?ra ?rb \<or> ?rb \<in> X
  \<forall>\<^sub>F i in at_right (y t0). t \<in> existence_ivl t0 i

goal (1 subgoal):
 1. \<forall>\<^sub>F i in at_right (y t0). i \<in> X