proof (state)
this:
  \<Theta>[F2](f) \<subseteq> \<Theta>[F1](f)

goal (14 subgoals):
 1. \<And>f. \<Theta>[bot](f) = UNIV
 2. \<And>f' h' F' g'.
       (f' \<in> \<Theta>[filtermap h' F'](g')) =
       ((\<lambda>x. f' (h' x)) \<in> \<Theta>[F'](\<lambda>x. g' (h' x)))
 3. \<And>f' F'' g' h'.
       f' \<in> \<Theta>[F''](g') \<Longrightarrow>
       (\<lambda>x. f' (h' x))
       \<in> \<Theta>[filtercomap h' F''](\<lambda>x. g' (h' x))
 4. \<And>f F1 g F2.
       \<lbrakk>f \<in> \<Theta>[F1](g); f \<in> \<Theta>[F2](g)\<rbrakk>
       \<Longrightarrow> f \<in> \<Theta>[sup F1 F2](g)
 5. \<And>f g F h.
       \<forall>\<^sub>F x in F. f x = g x \<Longrightarrow>
       (f \<in> \<Theta>[F](h)) = (g \<in> \<Theta>[F](h))
 6. \<And>f g F.
       \<forall>\<^sub>F x in F. f x = g x \<Longrightarrow>
       \<Theta>[F](f) = \<Theta>[F](g)
 7. \<And>c F f.
       c \<noteq> (0::'b) \<Longrightarrow>
       \<Theta>[F](\<lambda>x. c * f x) = \<Theta>[F](f)
 8. \<And>c f F g.
       c \<noteq> (0::'b) \<Longrightarrow>
       ((\<lambda>x. c * f x) \<in> \<Theta>[F](g)) =
       (f \<in> \<Theta>[F](g))
 9. \<And>f F g h.
       f \<in> \<Theta>[F](g) \<Longrightarrow>
       (\<lambda>x. h x * f x) \<in> \<Theta>[F](\<lambda>x. h x * g x)
 10. \<And>f F g.
        \<lbrakk>\<forall>\<^sub>F x in F. f x \<noteq> (0::'b);
         \<forall>\<^sub>F x in F. g x \<noteq> (0::'b);
         f \<in> \<Theta>[F](g)\<rbrakk>
        \<Longrightarrow> (\<lambda>x. inverse (g x))
                          \<in> \<Theta>[F](\<lambda>x. inverse (f x))
A total of 14 subgoals...


proof (prove)
goal (1 subgoal):
 1. \<And>f.
       f \<in> UNIV \<rightarrow>
               carrier (residue_ring (p ^ k)) \<Longrightarrow>
       maps_to_n (int (nat (p ^ k - 1))) f


proof (prove)
goal (1 subgoal):
 1. \<forall>k. i \<noteq> k \<longrightarrow> f (i, k) = bot


proof (prove)
goal (1 subgoal):
 1. pi \<bullet> (x - y) = pi \<bullet> x - pi \<bullet> y


proof (prove)
goal (1 subgoal):
 1. module_pair_on U\<^sub>M\<^sub>_\<^sub>1 U\<^sub>M\<^sub>_\<^sub>2
     (*s\<^sub>1) (*s\<^sub>2)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>i < ar T; j \<le> ar (T !- i)\<rbrakk>
    \<Longrightarrow> P T i j


proof (prove)
using this:
  p = 2

goal (1 subgoal):
 1. p = sum4sq_int (1, 1, 0, 0)


proof (prove)
goal (1 subgoal):
 1. det (addcol (monom (1::'a) (Suc i)) (n - 1) (n - 1 - Suc i)
          (mk_poly_sub A (n - 1) i)) =
    det A


proof (prove)
goal (1 subgoal):
 1. finite A \<Longrightarrow>
    sorted_list_of_set A = sorted_list_of_set_alt A


proof (prove)
goal (1 subgoal):
 1. bitlen (b * 2 ^ c) = bitlen b + int c


proof (prove)
goal (1 subgoal):
 1. OFCLASS('a mod_ring, comm_ring_class)


proof (prove)
goal (1 subgoal):
 1. h i \<in> {- 1<..<1}


proof (prove)
using this:
  \<s> \<equiv> induced_automorph f g

goal (1 subgoal):
 1. chamber (insert v z) &&& chamber (insert v' z')


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Suc 0 \<le> length xs;
     map ((\<lambda>a. rec_exec a (m # xs)) \<circ>
          recf.id (Suc (length xs)))
      [Suc 0..<length xs] =
     map (\<lambda>i. xs ! (i - Suc 0)) [Suc 0..<length xs] \<and>
     (m # xs) ! length xs = xs ! (length xs - Suc 0)\<rbrakk>
    \<Longrightarrow> map (\<lambda>i. xs ! (i - Suc 0))
                       [Suc 0..<length xs] @
                      [xs ! (length xs - Suc 0)] =
                      xs


proof (state)
this:
  pred_cstate (\<lambda>x. length x = \<eta>) ?s8 \<Longrightarrow>
  \<I>_ideal \<eta> \<turnstile>c S_CHAN.sec_oracle ?s8 \<surd>

goal (1 subgoal):
 1. \<I>_ideal \<eta> \<oplus>\<^sub>\<I> \<I>_common \<eta>
    \<turnstile>res S_CHAN.res \<surd>


proof (prove)
goal (1 subgoal):
 1. C' P D B IFSC D' P' C B


proof (prove)
using this:
  i \<in> CBasis
  j \<in> CBasis

goal (1 subgoal):
 1. (\<Sum>k\<in>CBasis. if k = j then cnj (g k) else 0) = cnj (g j)


proof (prove)
goal (1 subgoal):
 1. perzeta (1 / 2) s =
    (if s = 1 then - Ln 2 else (2 powr (1 - s) - 1) / (s - 1)) *
    ((s - 1) * pre_zeta 1 s + 1)


proof (prove)
goal (1 subgoal):
 1. ((array_of_list [], 0), [])
    \<in> {(c, a).
           a = rev (take (snd c) (list_of_array (fst c))) \<and>
           snd c \<le> array_length (fst c)} O
          \<langle>R\<rangle>list_rel


proof (prove)
goal (1 subgoal):
 1. eq_imp
     (\<lambda>r' s.
         (sys_fM s, map_option obj_fields (sys_heap s r'),
          map_option obj_mark (sys_heap s r'),
          filter is_mw_Mutate (sys_mem_store_buffers (mutator m) s)))
     marked_deletions


proof (prove)
using this:
  \<forall>e n c.
     \<exists>p pa s sa m.
        \<forall>ca cb.
           (\<not> c \<turnstile> e \<mapsto> ca \<or>
            msgs ca n \<noteq> [] \<or>
            hd (msgs c n) = Marker \<or>
            msgs c n = [] \<or> Recv n p pa s sa m = e) \<and>
           (\<not> c \<turnstile> e \<mapsto> cb \<or>
            hd (msgs c n) = Marker \<or>
            hd (msgs cb n) = hd (msgs c n) \<or>
            msgs c n = [] \<or> Recv n p pa s sa m = e)
  RecvMarker i' p' q' = ev \<or>
  states c p' = s'' \<and>
  channel i = Some (q', p') \<and>
  recv i p' q' s'' s''' m' \<and>
  0 < length (msgs c i) \<and> hd (msgs c i) = Msg m'
  states c p = s \<and>
  channel i = Some (q, p) \<and>
  recv i p q s s' m \<and>
  0 < length (msgs c i) \<and> hd (msgs c i) = Msg m

goal (1 subgoal):
 1. occurs_on ev = p


proof (prove)
goal (1 subgoal):
 1. (J \<TTurnstile>s clss_of_interp I) = (J = I)


proof (prove)
goal (1 subgoal):
 1. (\<And>x. \<Phi> x) \<Longrightarrow> m \<le>\<^sub>n SPEC \<Phi>


proof (prove)
goal (1 subgoal):
 1. x \<in> A \<Longrightarrow>
    extreme_bound A (\<sqsubseteq>) {x} y = (x = y)


proof (prove)
goal (1 subgoal):
 1. traces_prefixclosed (induceES SES)


proof (prove)
using this:
  embed r' p f
  Well_order r \<and> Well_order r' \<and> Well_order p
  Field r = {0..<n} \<and> Field p = {0..<Suc n}
  embedS r' p f

goal (1 subgoal):
 1. f ` Field r' \<subset> {0..<Suc n}


proof (prove)
using this:
  Sig iS\<^bsub>CI T\<^esub> \<triangleright> Vx : A \<turnstile> e : B'
  Sig iS\<^bsub>CI T\<^esub> \<triangleright> Vx : B' \<turnstile> f E@ Vx : B

goal (1 subgoal):
 1. [A,e,B']\<^bsub>T\<^esub> ;;\<^bsub>iC\<^bsub>CI T\<^esub>\<^esub>
    [B',f E@ Vx,B]\<^bsub>T\<^esub> =
    [A,sub e in f E@ Vx,B]\<^bsub>T\<^esub>


proof (chain)
picking this:
  n' \<in> set ns


proof (prove)
goal (2 subgoals):
 1. \<And>Source Trigger Guard Action Update Target.
       \<lbrakk>Source \<in> States A; (S, Source) \<in> ChiRel (HA ST);
        TS \<in> HPT ST; S \<in> StepConf (HA ST) (Conf ST) TS;
        A \<in> the (CompFun (HA ST) S); S \<in> Conf ST;
        S \<notin> ChiStar (HA ST) `` {y. \<exists>x\<in>TS. y = source x};
        (Source, (Trigger, Guard, Action, Update), Target) \<in> TS;
        Target \<notin> States A\<rbrakk>
       \<Longrightarrow> \<exists>x\<in>TS. S = target x
 2. \<And>T U.
       \<lbrakk>TS \<in> HPT ST; S \<in> StepConf (HA ST) (Conf ST) TS;
        S \<notin> Target TS; A \<in> the (CompFun (HA ST) S);
        S \<in> Conf ST; S \<notin> ChiStar (HA ST) `` Source TS;
        \<forall>x.
           x \<in> States A \<longrightarrow>
           x \<notin> StepConf (HA ST) (Conf ST) TS;
        T \<in> States A; (U, T) \<in> ChiStar (HA ST); U \<in> Source TS;
        (S, T) \<in> ChiRel (HA ST); U \<noteq> T\<rbrakk>
       \<Longrightarrow> False


proof (prove)
using this:
  bst (splay a t)
  f = Insert a
  ss = [t]
  bst t

goal (1 subgoal):
 1. bst (exec f ss)


proof (prove)
goal (1 subgoal):
 1. \<And>x.
       \<lbrakk>new_shadow_root_ptr = the (cast x);
        h' = put (the (cast x)) (create_shadow_root_obj Open []) h;
        shadow_root_ptr.Ref
         (Suc (fMax (shadow_root_ptr.the_ref |`| shadow_root_ptrs h))) =
        the (cast x);
        x |\<in>| document_ptr_kinds h; is_shadow_root_ptr_kind x\<rbrakk>
       \<Longrightarrow> False


proof (prove)
using this:
  if a \<in> externals (ioa.asig A) then tr = [a] else tr = []
  trace (ioa.asig A) (append_exec e_A' e) =
  append (trace (ioa.asig A) e) (trace (ioa.asig A) e_A')

goal (1 subgoal):
 1. trace (ioa.asig A) e_A =
    (if a \<in> externals (ioa.asig A) then Cons a (trace (ioa.asig A) e_A')
     else trace (ioa.asig A) e_A')


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>x. f x \<in> A; \<And>x. g x \<in> A\<rbrakk>
    \<Longrightarrow> prod_fun f g x \<in> A


proof (prove)
using this:
  numbers_of_marks (Suc (Suc n)) (sieve (Suc n) (mark_out n bs)) =
  {q \<in> numbers_of_marks (Suc (Suc n)) (mark_out n bs).
   \<forall>m\<in>numbers_of_marks (Suc (Suc n)) (mark_out n bs).
      \<not> m dvd_strict q}

goal (1 subgoal):
 1. numbers_of_marks (Suc n) (sieve n (True # bs)) =
    {q \<in> numbers_of_marks (Suc n) (True # bs).
     \<forall>m\<in>numbers_of_marks (Suc n) (True # bs).
        \<not> m dvd_strict q}


proof (prove)
using this:
  X = Y

goal (1 subgoal):
 1. Y Out P Q


proof (prove)
goal (1 subgoal):
 1. wf_formula n \<phi> \<Longrightarrow>
    local.wf n (rexp.Inter (rexp_of_alt n \<phi>) (ENC n (FOV \<phi>)))


proof (prove)
using this:
  (\<N>\<lbrakk> the (map_of \<Gamma>
                       x) \<rbrakk>\<^bsub>\<rho>\<^sub>1\<^esub>)\<cdot>
  r' =
  (\<N>\<lbrakk> the (map_of \<Gamma>
                       x) \<rbrakk>\<^bsub>\<rho>\<^sub>2\<^esub>)\<cdot>
  r'
  x \<in> domA \<Gamma>

goal (1 subgoal):
 1. (\<rho> ++\<^bsub>domA
                       \<Gamma>\<^esub> \<^bold>\<N>\<lbrakk> \<Gamma> \<^bold>\<rbrakk>\<^bsub>\<rho>\<^sub>1\<^esub>)
     x\<cdot>
    r' =
    (\<rho>|\<^sup>\<circ>\<^bsub>r\<^esub> ++\<^bsub>domA
                 \<Gamma>\<^esub> \<^bold>\<N>\<lbrakk> \<Gamma> \<^bold>\<rbrakk>\<^bsub>\<rho>\<^sub>2\<^esub>)
     x\<cdot>
    r'


proof (prove)
goal (1 subgoal):
 1. weak_reduction_coupled_simulation (TRel\<^sup>+) Target


proof (prove)
goal (6 subgoals):
 1. \<And>h shadow_root_ptr shadow_root_mode.
       \<lbrakk>ShadowRootClass.type_wf h;
        shadow_root_ptr |\<in>| shadow_root_ptr_kinds h\<rbrakk>
       \<Longrightarrow> h \<turnstile> ok set_mode shadow_root_ptr
      shadow_root_mode
 2. \<And>h shadow_root_ptr shadow_root_mode.
       h \<turnstile> ok set_mode shadow_root_ptr
                          shadow_root_mode \<Longrightarrow>
       shadow_root_ptr |\<in>| shadow_root_ptr_kinds h
 3. \<And>w shadow_root_ptr h h' x.
       \<lbrakk>w \<in> set_mode_locs shadow_root_ptr;
        h \<turnstile> w \<rightarrow>\<^sub>h h';
        x |\<in>| object_ptr_kinds h\<rbrakk>
       \<Longrightarrow> x |\<in>| object_ptr_kinds h'
 4. \<And>w shadow_root_ptr h h' x.
       \<lbrakk>w \<in> set_mode_locs shadow_root_ptr;
        h \<turnstile> w \<rightarrow>\<^sub>h h';
        x |\<in>| object_ptr_kinds h'\<rbrakk>
       \<Longrightarrow> x |\<in>| object_ptr_kinds h
 5. \<And>w shadow_root_ptr h h'.
       \<lbrakk>w \<in> set_mode_locs shadow_root_ptr;
        h \<turnstile> w \<rightarrow>\<^sub>h h';
        ShadowRootClass.type_wf h\<rbrakk>
       \<Longrightarrow> ShadowRootClass.type_wf h'
 6. \<And>w shadow_root_ptr h h'.
       \<lbrakk>w \<in> set_mode_locs shadow_root_ptr;
        h \<turnstile> w \<rightarrow>\<^sub>h h';
        ShadowRootClass.type_wf h'\<rbrakk>
       \<Longrightarrow> ShadowRootClass.type_wf h


proof (prove)
goal (1 subgoal):
 1. |Field r \<times> Field p| \<le>o |Field r' \<times> Field p'|


proof (chain)
picking this:
  set_mset A \<subseteq> {a}


proof (prove)
goal (2 subgoals):
 1. \<And>h ptr' sc thesis ptr.
       \<lbrakk>\<forall>owner_document.
                   h \<turnstile> Shadow_DOM.get_owner_document ptr'
                   \<rightarrow>\<^sub>r owner_document \<longrightarrow>
                   cast\<^sub>d\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r
                    owner_document
                   \<in> set sc \<longrightarrow>
                   thesis;
        Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h;
        ShadowRootClass.known_ptrs h;
        h \<turnstile> Shadow_DOM_SC_DOM_Components.get_scdom_component ptr
        \<rightarrow>\<^sub>r sc;
        ptr' \<in> set sc\<rbrakk>
       \<Longrightarrow> thesis
 2. \<And>h ptr owner_document ptr' owner_document' x.
       \<lbrakk>Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h;
        ShadowRootClass.known_ptrs h;
        h \<turnstile> Shadow_DOM.get_owner_document ptr
        \<rightarrow>\<^sub>r owner_document;
        h \<turnstile> Shadow_DOM.get_owner_document ptr'
        \<rightarrow>\<^sub>r owner_document';
        owner_document \<noteq> owner_document';
        x \<in> set |h \<turnstile> Shadow_DOM_SC_DOM_Components.get_scdom_component
                                     ptr|\<^sub>r;
        x \<in> set |h \<turnstile> Shadow_DOM_SC_DOM_Components.get_scdom_component
                                     ptr'|\<^sub>r\<rbrakk>
       \<Longrightarrow> False


proof (prove)
using this:
  discrete ?X \<Longrightarrow> card {f. CK_nf_pos f} = 1
  \<lbrakk>part ?X; \<not> discrete ?X\<rbrakk>
  \<Longrightarrow> card {f. CK_nf_pos f} = 3
  \<lbrakk>ed_ou ?X; \<not> discrete ?X\<rbrakk>
  \<Longrightarrow> card {f. CK_nf_pos f} = 4
  \<lbrakk>open_unresolvable ?X; \<not> ed_ou ?X\<rbrakk>
  \<Longrightarrow> card {f. CK_nf_pos f} = 5
  \<lbrakk>extremally_disconnected ?X; \<not> part ?X;
   \<not> ed_ou ?X\<rbrakk>
  \<Longrightarrow> card {f. CK_nf_pos f} = 5
  kuratowski ?X \<Longrightarrow> card {f. CK_nf_pos f} = 7

goal (1 subgoal):
 1. card {f. CK_nf_pos f} \<in> {1, 3, 4, 5, 7}


proof (prove)
using this:
  P o\<^sub>C\<^sub>L P = P
  P = P*
  P = A o\<^sub>C\<^sub>L Proj S o\<^sub>C\<^sub>L A*
  \<lbrakk>?P o\<^sub>C\<^sub>L ?P = ?P; ?P = ?P*\<rbrakk>
  \<Longrightarrow> Proj (?P *\<^sub>S \<top>) = ?P

goal (1 subgoal):
 1. \<exists>M.
       P = Proj M \<and>
       space_as_set M =
       range ((*\<^sub>V) (A o\<^sub>C\<^sub>L Proj S o\<^sub>C\<^sub>L A*))


proof (prove)
goal (1 subgoal):
 1. map_fun id MPoly Const\<^sub>0 (0::'a) * P =
    map_fun id MPoly Const\<^sub>0 (0::'a)


proof (prove)
using this:
  \<not> triangle (Suc x\<^sub>0) \<le> x\<^sub>1

goal (1 subgoal):
 1. (if triangle (Suc x\<^sub>0) \<le> x\<^sub>1 then Suc x\<^sub>0
     else GREATEST y. y \<le> x\<^sub>0 \<and> triangle y \<le> x\<^sub>1) =
    (GREATEST y. y \<le> Suc x\<^sub>0 \<and> triangle y \<le> x\<^sub>1)


proof (prove)
goal (1 subgoal):
 1. (rel_pmf R ===> (R ===> (=)) ===> (=)) local.sample_state
     local.sample_state


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<exists>x. L x \<and> K (x, a); L a \<and> L b \<and> L c;
     \<forall>x. L x \<longrightarrow> x = a \<or> x = b \<or> x = c;
     \<forall>y x. K (x, y) \<longrightarrow> H (x, y);
     \<forall>x y. K (x, y) \<longrightarrow> \<not> R (x, y);
     \<forall>x. H (a, x) \<longrightarrow> \<not> H (c, x);
     \<forall>x. x \<noteq> b \<longrightarrow> H (a, x);
     \<forall>x. \<not> R (x, a) \<longrightarrow> H (b, x);
     \<forall>x. H (a, x) \<longrightarrow> H (b, x);
     \<forall>x. \<exists>y. \<not> H (x, y); a \<noteq> b\<rbrakk>
    \<Longrightarrow> K (a, a)


proof (prove)
goal (4 subgoals):
 1. Group.comm_monoid S
 2. inv\<^bsub>S\<^esub> h a \<in> carrier S
 3. h a \<in> carrier S
 4. inv\<^bsub>S\<^esub> h a \<otimes>\<^bsub>S\<^esub> h a =
    \<one>\<^bsub>S\<^esub>


proof (prove)
goal (1 subgoal):
 1. f ` I \<in> {X. directed X r \<and> X \<noteq> {}}


proof (prove)
goal (1 subgoal):
 1. length (filter (\<lambda>y. y < x) xs)
    \<le> nat \<lceil>7 / 10 * real n + 3\<rceil>


proof (prove)
goal (1 subgoal):
 1. nths (weave A is1 is2) A = is1 &&& nths (weave A is1 is2) (- A) = is2


proof (prove)
goal (1 subgoal):
 1. \<Gamma>' \<turnstile> \<theta><s> is \<theta>'<t> : T


proof (prove)
using this:
  finite (supp {P. P \<Turnstile> x})
  \<lbrakk>?P9 \<in> {P. P \<Turnstile> x};
   ?P9 \<approx>\<cdot>\<^sub>S ?Q9\<rbrakk>
  \<Longrightarrow> ?Q9 \<in> {P. P \<Turnstile> x}

goal (1 subgoal):
 1. thesis


proof (prove)
goal (1 subgoal):
 1. P y


proof (state)
goal (3 subgoals):
 1. Ball P finite
 2. \<forall>A\<in>P.
       \<forall>B\<in>P. A \<noteq> B \<longrightarrow> A \<inter> B = {}
 3. sum f {..<n} = sum f (\<Union> P)


proof (state)
this:
  \<forall>i. \<Gamma>\<turnstile> g i \<rightarrow>\<^sup>+ g (i + 1)

goal (1 subgoal):
 1. False


proof (prove)
using this:
  \<forall>x. y \<sqinter> x \<squnion> ! y \<sqinter> x = x

goal (1 subgoal):
 1. (y \<le> ! (d x)) = (y \<sqinter> x \<le> bot)


proof (state)
goal (7 subgoals):
 1. \<And>a volatile t.
       \<lbrakk>is = Read volatile a t # is';
        \<theta>' = \<theta>(t \<mapsto> m a); sb' = sb; m' = m;
        \<D>' = \<D>; \<O>' = \<O>; \<R>' = \<R>; \<S>' = \<S>;
        buffered_val sb a = None\<rbrakk>
       \<Longrightarrow> \<exists>ts\<^sub>h' \<S>\<^sub>h'.
                            (ts\<^sub>h, m,
                             \<S>\<^sub>h) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h',
              m', \<S>\<^sub>h') \<and>
                            ts' \<sim>\<^sub>h ts\<^sub>h'
 2. \<And>a D f A L R W.
       \<lbrakk>is = Write False a (D, f) A L R W # is';
        \<theta>' = \<theta>;
        sb' =
        sb @ [Write\<^sub>s\<^sub>b False a (D, f) (f \<theta>) A L R W];
        m' = m; \<D>' = \<D>; \<O>' = \<O>; \<R>' = \<R>;
        \<S>' = \<S>\<rbrakk>
       \<Longrightarrow> \<exists>ts\<^sub>h' \<S>\<^sub>h'.
                            (ts\<^sub>h, m,
                             \<S>\<^sub>h) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h',
              m', \<S>\<^sub>h') \<and>
                            ts' \<sim>\<^sub>h ts\<^sub>h'
 3. \<And>a D f A L R W.
       \<lbrakk>is = Write True a (D, f) A L R W # is';
        \<theta>' = \<theta>;
        sb' =
        sb @ [Write\<^sub>s\<^sub>b True a (D, f) (f \<theta>) A L R W];
        m' = m; \<D>' = \<D>; \<O>' = \<O>; \<R>' = \<R>;
        \<S>' = \<S>\<rbrakk>
       \<Longrightarrow> \<exists>ts\<^sub>h' \<S>\<^sub>h'.
                            (ts\<^sub>h, m,
                             \<S>\<^sub>h) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h',
              m', \<S>\<^sub>h') \<and>
                            ts' \<sim>\<^sub>h ts\<^sub>h'
 4. \<lbrakk>is = Fence # is'; sb = []; \<theta>' = \<theta>; sb' = [];
     m' = m; \<D>' = \<D>; \<O>' = \<O>; \<R>' = \<R>; \<S>' = \<S>\<rbrakk>
    \<Longrightarrow> \<exists>ts\<^sub>h' \<S>\<^sub>h'.
                         (ts\<^sub>h, m,
                          \<S>\<^sub>h) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h',
           m', \<S>\<^sub>h') \<and>
                         ts' \<sim>\<^sub>h ts\<^sub>h'
 5. \<And>cond t a D f ret A L R W.
       \<lbrakk>is = RMW a t (D, f) cond ret A L R W # is'; sb = [];
        \<theta>' = \<theta>(t \<mapsto> m a); sb' = []; m' = m;
        \<D>' = \<D>; \<O>' = \<O>; \<R>' = \<R>; \<S>' = \<S>;
        \<not> cond (\<theta>(t \<mapsto> m a))\<rbrakk>
       \<Longrightarrow> \<exists>ts\<^sub>h' \<S>\<^sub>h'.
                            (ts\<^sub>h, m,
                             \<S>\<^sub>h) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h',
              m', \<S>\<^sub>h') \<and>
                            ts' \<sim>\<^sub>h ts\<^sub>h'
 6. \<And>cond t a D f ret A L R W.
       \<lbrakk>is = RMW a t (D, f) cond ret A L R W # is'; sb = [];
        \<theta>' = \<theta>(t \<mapsto>
        ret (m a) (f (\<theta>(t \<mapsto> m a))));
        sb' = []; m' = m(a := f (\<theta>(t \<mapsto> m a))); \<D>' = \<D>;
        \<O>' = \<O>; \<R>' = \<R>; \<S>' = \<S>;
        cond (\<theta>(t \<mapsto> m a))\<rbrakk>
       \<Longrightarrow> \<exists>ts\<^sub>h' \<S>\<^sub>h'.
                            (ts\<^sub>h, m,
                             \<S>\<^sub>h) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h',
              m', \<S>\<^sub>h') \<and>
                            ts' \<sim>\<^sub>h ts\<^sub>h'
 7. \<And>A L R W.
       \<lbrakk>is = Ghost A L R W # is'; \<theta>' = \<theta>; sb' = sb;
        m' = m; \<D>' = \<D>; \<O>' = \<O>; \<R>' = \<R>;
        \<S>' = \<S>\<rbrakk>
       \<Longrightarrow> \<exists>ts\<^sub>h' \<S>\<^sub>h'.
                            (ts\<^sub>h, m,
                             \<S>\<^sub>h) \<Rightarrow>\<^sub>s\<^sub>b\<^sub>h\<^sup>* (ts\<^sub>h',
              m', \<S>\<^sub>h') \<and>
                            ts' \<sim>\<^sub>h ts\<^sub>h'


proof (prove)
goal (1 subgoal):
 1. ((=) ===> cyclic ===> cyclic) map map


proof (prove)
using this:
  A \<in> \<A>
  SimplicialComplex.min_maxsimpchain A Cs
  Cs = C # Ds @ [D]

goal (1 subgoal):
 1. min_gallery (C # Ds @ [D])


proof (prove)
goal (1 subgoal):
 1. (\<lambda>k. birkhoff_sum f (1 + k) x) ` {0..n} =
    (\<lambda>k. f x + birkhoff_sum f k (T x)) ` {0..n}


proof (prove)
goal (1 subgoal):
 1. symp R = (R = R\<inverse>\<inverse>)


proof (prove)
goal (1 subgoal):
 1. A $ a $ b = (0::'a)


proof (prove)
goal (1 subgoal):
 1. map_val xs ys \<Longrightarrow> xs = map Val ys


proof (prove)
goal (1 subgoal):
 1. 0 < k \<Longrightarrow>
    xs \<longmapsto> k \<Join>\<^sub> [ k - 1, mod k, n ] =
    xs \<div> k \<Join>\<^sub> [\<dots>n]


proof (prove)
using this:
  h \<noteq> \<zero>

goal (1 subgoal):
 1. deriv f \<alpha> \<oplus> c \<otimes> h = \<zero>


proof (prove)
using this:
  invar_trie (Trie vo ts)
  (?k'2, ?t'2) \<in> set (AList.delete_aux k ts) \<Longrightarrow>
  \<not> is_empty_trie ?t'2 \<and> invar_trie ?t'2

goal (1 subgoal):
 1. invar_trie (Trie vo (AList.delete_aux k ts))


proof (prove)
goal (1 subgoal):
 1. ({Inv}
     WHILE b DO c
     {P} \<sqsubseteq>
     w) =
    (\<exists>Inv' c' P'.
        w = {Inv'}
            WHILE b DO c'
            {P'} \<and>
        c \<sqsubseteq> c' \<and>
        Inv \<sqsubseteq> Inv' \<and> P \<sqsubseteq> P')


proof (prove)
goal (1 subgoal):
 1. dom (EmptyMap S) = S


proof (prove)
using this:
  orthogonal (vector A B) (vector C B)

goal (1 subgoal):
 1. vecsqnorm (vector C A) = vecsqnorm (vector B A) + vecsqnorm (vector C B)


proof (prove)
using this:
  \<Phi> (merge h1 h2) - \<Phi> h1 - \<Phi> h2
  \<le> log 2 (real (size_hp h1 + size_hp h2 + 1)) + 1

goal (1 subgoal):
 1. real (cost f ss) + \<Phi> (exec f ss) - sum_list (map \<Phi> ss)
    \<le> U f ss


proof (prove)
goal (1 subgoal):
 1. drefines \<phi> G (repeat 0 a) (repeat 0 b)


proof (prove)
using this:
  \<guillemotleft>w' : src\<^sub>C
                        \<omega> \<rightarrow>\<^sub>C src\<^sub>C
                  f\<guillemotright> \<and>
  C.ide w' \<and> D.isomorphic (F w') w
  D.iso ?f \<Longrightarrow> D.inv ?f \<cdot>\<^sub>D ?f = D.dom ?f
  src\<^sub>D (F g) = trg\<^sub>D w
  \<lbrakk>D.arr ?f; D.cod ?f = ?b\<rbrakk>
  \<Longrightarrow> ?b \<cdot>\<^sub>D ?f = ?f

goal (1 subgoal):
 1. (D.inv (\<Phi> (r \<star>\<^sub>C f, w')) \<cdot>\<^sub>D
     \<Phi> (r \<star>\<^sub>C f, w')) \<cdot>\<^sub>D
    (F \<rho> \<star>\<^sub>D F w') =
    F \<rho> \<star>\<^sub>D F w'


proof (prove)
goal (1 subgoal):
 1. equivalence_functor (\<cdot>\<^sub>S) (\<cdot>\<^sub>S) R


proof (prove)
using this:
  (pmf (sds R10) a < pmf (sds R5) d \<or>
   pmf (sds R10) a + (pmf (sds R10) c + pmf (sds R10) d)
   < pmf (sds R5) d + (pmf (sds R5) b + pmf (sds R5) a)) \<or>
  pmf (sds R10) a = pmf (sds R5) d \<and>
  pmf (sds R10) a + (pmf (sds R10) c + pmf (sds R10) d) =
  pmf (sds R5) d + (pmf (sds R5) b + pmf (sds R5) a)
  pmf (sds R5) b = 0
  0 \<le> pmf (sds R5) a
  0 \<le> pmf (sds R5) b
  0 \<le> pmf (sds R5) c
  0 \<le> pmf (sds R5) d
  pmf (sds R5) a + pmf (sds R5) b + pmf (sds R5) c + pmf (sds R5) d = 1

goal (1 subgoal):
 1. 1 / 2 \<le> pmf (sds R5) d


proof (prove)
goal (1 subgoal):
 1. [] \<in> V


proof (chain)
picking this:
  fv (throw a) \<subseteq> W


proof (prove)
using this:
  2 ^ s1 * word_of_nat (mq - 2 ^ sq * nq) < 2 ^ s2

goal (1 subgoal):
 1. word_of_nat (mq - 2 ^ sq * nq) < 2 ^ (s2 - s1)


proof (prove)
goal (1 subgoal):
 1. run_option (get f) = get (\<lambda>s. run_option (f s))


proof (prove)
goal (1 subgoal):
 1. atU U {#s#} = atU_s U s


proof (prove)
using this:
  \<sigma> permutes alts
  finite agents

goal (1 subgoal):
 1. {#weak_ranking (map_relation (inv \<sigma>) (R x))
    . x \<in># mset_set agents#} =
    {#map ((`) \<sigma>) (weak_ranking (R x)). x \<in># mset_set agents#}


proof (prove)
goal (4 subgoals):
 1. \<And>f x.
       Generative_Probabilistic_Value.Done f \<diamondop>
       Generative_Probabilistic_Value.Done x =
       Generative_Probabilistic_Value.Done (f x)
 2. \<And>g f x.
       Generative_Probabilistic_Value.Done
        (\<lambda>g f x. g (f x)) \<diamondop>
       g \<diamondop>
       f \<diamondop>
       x =
       g \<diamondop> (f \<diamondop> x)
 3. \<And>x.
       Generative_Probabilistic_Value.Done (\<lambda>x. x) \<diamondop> x =
       x
 4. \<And>f x.
       f \<diamondop> Generative_Probabilistic_Value.Done x =
       Generative_Probabilistic_Value.Done (\<lambda>f. f x) \<diamondop> f


proof (prove)
goal (1 subgoal):
 1. set ls' \<subseteq> set xs &&& set rs' \<subseteq> set xs


proof (prove)
goal (1 subgoal):
 1. inj bd\<^sub>\<R>


proof (prove)
using this:
  i \<in> C
  f pmax = Max (reduce f PR)
  f pmax \<le> f i

goal (1 subgoal):
 1. \<exists>i\<in>C. Max (reduce f PR) \<le> f i


proof (prove)
using this:
  2 < p
  prime p

goal (1 subgoal):
 1. card ((*) 2 ` {0<..(p - 1) div 2} \<inter> {(p - 1) div 2<..}) =
    nat ((p - 1) div 2) -
    card ((*) 2 ` {0<..(p - 1) div 2} - {(p - 1) div 2<..})


proof (prove)
using this:
  DIM('a) = 1
  \<lbrakk>bounded ?S; connected (- ?S); DIM(?'a) = 1\<rbrakk>
  \<Longrightarrow> ?S = {}
  compact ?U \<Longrightarrow> bounded ?U
  (?S homotopy_eqv {}) = (?S = {})
  ({} homotopy_eqv ?S) = (?S = {})
  S homotopy_eqv T
  compact S
  compact T

goal (1 subgoal):
 1. connected (- S) = connected (- T)


proof (prove)
goal (1 subgoal):
 1. min (fpxs_val f) (fpxs_val g) \<le> fpxs_val (f - g)


proof (prove)
using this:
  \<exists>v\<in>V. \<exists>t\<in>V\<^bsub>T\<^esub>. v \<in> bag t
  ?t \<in> V\<^bsub>T\<^esub> \<Longrightarrow> finite (bag ?t)
  (0 < card ?A) = (?A \<noteq> {} \<and> finite ?A)
  ?a \<in> {} \<Longrightarrow> ?P
  (?x < Max bag_cards) = (\<exists>a\<in>bag_cards. ?x < a)

goal (1 subgoal):
 1. 0 < Max bag_cards


proof (prove)
goal (1 subgoal):
 1. (\<And>l.
        \<lbrakk>b = a \<cdot> l; l \<in> L\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  \<Gamma>\<turnstile> \<langle>redex
                                 c1_,s\<rangle> \<Rightarrow> Stuck \<Longrightarrow>
  \<Gamma>\<turnstile> \<langle>c1_,s\<rangle> \<Rightarrow> Stuck
  \<Gamma>\<turnstile> \<langle>redex
                                 c2_,s\<rangle> \<Rightarrow> Stuck \<Longrightarrow>
  \<Gamma>\<turnstile> \<langle>c2_,s\<rangle> \<Rightarrow> Stuck
  \<Gamma>\<turnstile> \<langle>redex
                                 (Catch c1_
                                   c2_),s\<rangle> \<Rightarrow> Stuck

goal (1 subgoal):
 1. \<Gamma>\<turnstile> \<langle>Catch c1_
                                   c2_,s\<rangle> \<Rightarrow> Stuck


proof (prove)
using this:
  multiplicative_function (\<lambda>d. h d / f d)

goal (1 subgoal):
 1. (\<Sum>d | d dvd a \<and> coprime N d. moebius_mu d * (h d / f d)) =
    (\<Prod>p\<in>{p. p \<in># prime_factorization a \<and> \<not> p dvd N}.
       1 - h p / f p)


proof (state)
this:
  B \<in> nhds y

goal (1 subgoal):
 1. \<And>x y.
       \<lbrakk>x \<in> carrier; y \<in> carrier; x \<noteq> y\<rbrakk>
       \<Longrightarrow> \<exists>u\<in>nhds x.
                            \<exists>v\<in>nhds y. u \<inter> v = {}


proof (prove)
using this:
  P \<turnstile> (0, s, stk) \<rightarrow>^k1 (size P, s'', stk'')
  P @ P' \<turnstile> (size P, s'', stk'') \<rightarrow>^k2 (j, s', stk')
  j = size P + j0

goal (1 subgoal):
 1. \<exists>k1 k2 s'' stk''.
       P \<turnstile> (0, s, stk) \<rightarrow>^k1
                      (size P, s'', stk'') \<and>
       P' \<turnstile> (0, s'', stk'') \<rightarrow>^k2
                       (j - size P, s', stk')


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fst i = arith_type UMUL \<or>
             fst i = arith_type SMUL \<or> fst i = arith_type SMULcc;
     get_trap_set s = {}\<rbrakk>
    \<Longrightarrow> (fst i = arith_type SUB \<longrightarrow>
                       \<not> snd (sub_instr i s)) \<and>
                      (fst i = arith_type SUBcc \<longrightarrow>
                       \<not> snd (sub_instr i s)) \<and>
                      (fst i = arith_type SUBX \<longrightarrow>
                       \<not> snd (sub_instr i s)) \<and>
                      (fst i \<noteq> arith_type SUB \<and>
                       fst i \<noteq> arith_type SUBcc \<and>
                       fst i \<noteq> arith_type SUBX \<longrightarrow>
                       (fst i = arith_type ADD \<longrightarrow>
                        \<not> snd (add_instr i s)) \<and>
                       (fst i = arith_type ADDcc \<longrightarrow>
                        \<not> snd (add_instr i s)) \<and>
                       (fst i = arith_type ADDX \<longrightarrow>
                        \<not> snd (add_instr i s)) \<and>
                       (fst i \<noteq> arith_type ADD \<and>
                        fst i \<noteq> arith_type ADDcc \<and>
                        fst i \<noteq> arith_type ADDX \<longrightarrow>
                        (fst i = shift_type SLL \<longrightarrow>
                         \<not> snd (shift_instr i s)) \<and>
                        (fst i = shift_type SRL \<longrightarrow>
                         \<not> snd (shift_instr i s)) \<and>
                        (fst i = shift_type SRA \<longrightarrow>
                         \<not> snd (shift_instr i s)) \<and>
                        (fst i \<noteq> shift_type SLL \<and>
                         fst i \<noteq> shift_type SRL \<and>
                         fst i \<noteq> shift_type SRA \<longrightarrow>
                         (fst i = logic_type ANDs \<longrightarrow>
                          \<not> snd (logical_instr i s)) \<and>
                         (fst i = logic_type ANDcc \<longrightarrow>
                          \<not> snd (logical_instr i s)) \<and>
                         (fst i = logic_type ANDN \<longrightarrow>
                          \<not> snd (logical_instr i s)) \<and>
                         (fst i = logic_type ANDNcc \<longrightarrow>
                          \<not> snd (logical_instr i s)) \<and>
                         (fst i = logic_type ORs \<longrightarrow>
                          \<not> snd (logical_instr i s)) \<and>
                         (fst i = logic_type ORcc \<longrightarrow>
                          \<not> snd (logical_instr i s)) \<and>
                         (fst i = logic_type ORN \<longrightarrow>
                          \<not> snd (logical_instr i s)) \<and>
                         (fst i = logic_type XORs \<longrightarrow>
                          \<not> snd (logical_instr i s)) \<and>
                         (fst i = logic_type XNOR \<longrightarrow>
                          \<not> snd (logical_instr i s)) \<and>
                         (fst i \<noteq> logic_type ANDs \<and>
                          fst i \<noteq> logic_type ANDcc \<and>
                          fst i \<noteq> logic_type ANDN \<and>
                          fst i \<noteq> logic_type ANDNcc \<and>
                          fst i \<noteq> logic_type ORs \<and>
                          fst i \<noteq> logic_type ORcc \<and>
                          fst i \<noteq> logic_type ORN \<and>
                          fst i \<noteq> logic_type XORs \<and>
                          fst i \<noteq> logic_type XNOR \<longrightarrow>
                          (fst i = nop_type NOP \<longrightarrow>
                           \<not> snd (nop_instr i s)) \<and>
                          (fst i \<noteq> nop_type NOP \<longrightarrow>
                           (fst i = sethi_type SETHI \<longrightarrow>
                            \<not> snd (sethi_instr i s)) \<and>
                           (fst i \<noteq>
                            sethi_type SETHI \<longrightarrow>
                            (fst i = load_store_type STB \<longrightarrow>
                             \<not> snd (store_instr i s)) \<and>
                            (fst i = load_store_type STH \<longrightarrow>
                             \<not> snd (store_instr i s)) \<and>
                            (fst i = load_store_type ST \<longrightarrow>
                             \<not> snd (store_instr i s)) \<and>
                            (fst i = load_store_type STA \<longrightarrow>
                             \<not> snd (store_instr i s)) \<and>
                            (fst i = load_store_type STD \<longrightarrow>
                             \<not> snd (store_instr i s)) \<and>
                            (fst i \<noteq> load_store_type STB \<and>
                             fst i \<noteq> load_store_type STH \<and>
                             fst i \<noteq> load_store_type ST \<and>
                             fst i \<noteq> load_store_type STA \<and>
                             fst i \<noteq>
                             load_store_type STD \<longrightarrow>
                             (fst i = load_store_type LDSB \<longrightarrow>
                              \<not> snd (load_instr i s)) \<and>
                             (fst i = load_store_type LDUB \<longrightarrow>
                              \<not> snd (load_instr i s)) \<and>
                             (fst i =
                              load_store_type LDUBA \<longrightarrow>
                              \<not> snd (load_instr i s)) \<and>
                             (fst i = load_store_type LDUH \<longrightarrow>
                              \<not> snd (load_instr i s)) \<and>
                             (fst i = load_store_type LD \<longrightarrow>
                              \<not> snd (load_instr i s)) \<and>
                             (fst i = load_store_type LDA \<longrightarrow>
                              \<not> snd (load_instr i s)) \<and>
                             (fst i = load_store_type LDD \<longrightarrow>
                              \<not> snd (load_instr i s)) \<and>
                             (fst i \<noteq> load_store_type LDSB \<and>
                              fst i \<noteq> load_store_type LDUB \<and>
                              fst i \<noteq> load_store_type LDUBA \<and>
                              fst i \<noteq> load_store_type LDUH \<and>
                              fst i \<noteq> load_store_type LD \<and>
                              fst i \<noteq> load_store_type LDA \<and>
                              fst i \<noteq>
                              load_store_type LDD \<longrightarrow>
                              \<not> snd (mul_instr i s)))))))))


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>a \<in> carrier R; p \<in> carrier P\<rbrakk>
    \<Longrightarrow> a \<odot>\<^bsub>P\<^esub> p \<in> carrier P


proof (prove)
goal (1 subgoal):
 1. multiplicity p (n choose k) = 0


proof (state)
goal (2 subgoals):
 1. arr \<r>[f] \<and>
    src f \<in> sources \<r>[f] \<and> trg f \<in> targets \<r>[f]
 2. \<guillemotleft>\<r>[f] : f \<star>
                              src f \<Rightarrow> f\<guillemotright>


proof (prove)
using this:
  asymp_powser h F f cs

goal (1 subgoal):
 1. asymp_powser (h \<circ> g) G (f \<circ> g) cs


proof (prove)
goal (1 subgoal):
 1. (\<And>U' V g g'.
        \<lbrakk>open U'; U' \<subseteq> {w. - pi < Im w \<and> Im w < pi};
         Ln z \<in> U'; open V; z \<in> V; homeomorphism U' V exp g;
         \<And>y.
            y \<in> V \<Longrightarrow> (g has_derivative g' y) (at y);
         \<And>y. y \<in> V \<Longrightarrow> g' y = inv ((*) (exp (g y)));
         \<And>y. y \<in> V \<Longrightarrow> bij ((*) (exp (g y)))\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  Enc Y K' \<in> HashSet G \<union> analz H

goal (1 subgoal):
 1. Enc Y K' \<in> analz H


proof (state)
this:
  (\<Sum>y\<in>set (Abs_State.dom S2) - set (Abs_State.dom S1) \<union>
               set (Abs_State.dom S2) \<inter> set (Abs_State.dom S1).
     m_ivl (fun S2 y)) =
  (\<Sum>y\<in>set (Abs_State.dom S2) - set (Abs_State.dom S1).
     m_ivl (fun S2 y)) +
  (\<Sum>y\<in>set (Abs_State.dom S2) \<inter> set (Abs_State.dom S1).
     m_ivl (fun S2 y))

goal (1 subgoal):
 1. \<forall>x\<in>set (Abs_State.dom S2).
       (x \<in> set (Abs_State.dom S1) \<longrightarrow>
        fun S1 x \<sqsubseteq> fun S2 x) \<and>
       (x \<in> set (Abs_State.dom S1) \<or>
        \<top> \<sqsubseteq> fun S2 x) \<Longrightarrow>
    (\<Sum>x\<in>set (Abs_State.dom S2). m_ivl (fun S2 x))
    \<le> (\<Sum>x\<in>set (Abs_State.dom S1). m_ivl (fun S1 x))


proof (prove)
goal (1 subgoal):
 1. Field r \<noteq> {} \<Longrightarrow> o.zero = const


proof (prove)
goal (1 subgoal):
 1. \<And>x y.
       rel_bset (=\<^sub>\<alpha>) x y = rel_bset (=\<^sub>\<alpha>) y x


proof (prove)
goal (1 subgoal):
 1. is_zariski_open Spec


proof (prove)
using this:
  ?x \<in> results_gpv \<I>' gpv' \<Longrightarrow> f ?x = g ?x

goal (1 subgoal):
 1. expectation_gpv fail \<I> f gpv = expectation_gpv fail' \<I>' g gpv'


proof (prove)
goal (1 subgoal):
 1. s \<in> reach \<Longrightarrow>
    \<exists>t ik.
       initk = ik \<longrightarrow>
       hotel t \<and>
       state.cards s = Trace.cards t \<and>
       state.isin s = Trace.isin t \<and>
       state.roomk s = Trace.roomk t \<and>
       state.owns s = Trace.owns t \<and>
       state.currk s = Trace.currk t \<and>
       state.issued s = Trace.issued t \<and>
       state.safe s =
       (\<lambda>r. Trace.safe t r \<or> Trace.owns t r = None)


proof (prove)
using this:
  i < k
  bs ! i \<in> set bs \<Longrightarrow> 0 < bs ! i
  min 1 (min ((bs ! i / 2) powr (p + 1)) ((bs ! i * 3 / 2) powr (p + 1)))
  \<le> min 1 ((bs ! i + (hs ! i) x / x) powr (p + 1))

goal (1 subgoal):
 1. c2 / min 1 ((bs ! i + (hs ! i) x / x) powr (p + 1))
    \<le> c2 /
          min 1
           (min ((bs ! i / 2) powr (p + 1)) ((bs ! i * 3 / 2) powr (p + 1)))


proof (prove)
using this:
  inj S.UP
  inj_on Inr ?A
  \<lbrakk>inj ?f; inj ?g\<rbrakk> \<Longrightarrow> inj (?f \<circ> ?g)

goal (1 subgoal):
 1. inj (S.UP \<circ> Inr)


proof (prove)
using this:
  continuous_on T g
  g ` T = S

goal (1 subgoal):
 1. closedin (top_of_set T) (f ` U)


proof (prove)
goal (1 subgoal):
 1. finite
     {i. \<not> (\<exists>j<i.
                    lt (seq j) adds\<^sub>t lt (seq i) \<and>
                    punit.lt (rep_list (seq j)) adds
                    punit.lt (rep_list (seq i)))}


proof (prove)
goal (1 subgoal):
 1. \<forall>d\<subseteq>Basis.
       \<exists>l r.
          strict_mono r \<and>
          (\<forall>e>0.
              \<forall>\<^sub>F n in sequentially.
                 \<forall>i\<in>d.
                    dist (f (r n) \<bullet> i) (l \<bullet> i) < e)


proof (prove)
goal (1 subgoal):
 1. card
     {x. regular x \<and>
         x \<le> - - h \<and>
         x \<le> - choose_arc h \<and> x \<le> - choose_arc h\<^sup>T}
    < card {x. regular x \<and> x \<le> - - h}


proof (prove)
goal (1 subgoal):
 1. (invKey K \<in> symKeys) = (K \<in> symKeys)


proof (prove)
using this:
  tmbound0 (snd (split0 ?t))

goal (1 subgoal):
 1. islin
     (let (c, s) = split0 (simptm t)
      in if c = 0\<^sub>p then neq s else NEq (CNP 0 c s))


proof (prove)
goal (1 subgoal):
 1. f absolutely_integrable_on S


proof (prove)
goal (6 subgoals):
 1. \<And>c v.
       \<turnstile> v : deriv c Zero \<Longrightarrow>
       \<turnstile> injval Zero c v : Zero
 2. \<And>c v.
       \<turnstile> v : deriv c One \<Longrightarrow>
       \<turnstile> injval One c v : One
 3. \<And>x c v.
       \<turnstile> v : deriv c (Atom x) \<Longrightarrow>
       \<turnstile> injval (Atom x) c v : Atom x
 4. \<And>x1 x2 c v.
       \<lbrakk>\<And>c v.
                   \<turnstile> v : deriv c x1 \<Longrightarrow>
                   \<turnstile> injval x1 c v : x1;
        \<And>c v.
           \<turnstile> v : deriv c x2 \<Longrightarrow>
           \<turnstile> injval x2 c v : x2;
        \<turnstile> v : deriv c (Plus x1 x2)\<rbrakk>
       \<Longrightarrow> \<turnstile> injval (Plus x1 x2) c v : Plus x1 x2
 5. \<And>x1 x2 c v.
       \<lbrakk>\<And>c v.
                   \<turnstile> v : deriv c x1 \<Longrightarrow>
                   \<turnstile> injval x1 c v : x1;
        \<And>c v.
           \<turnstile> v : deriv c x2 \<Longrightarrow>
           \<turnstile> injval x2 c v : x2;
        \<turnstile> v : deriv c (Times x1 x2)\<rbrakk>
       \<Longrightarrow> \<turnstile> injval (Times x1 x2) c v : Times x1 x2
 6. \<And>x c v.
       \<lbrakk>\<And>c v.
                   \<turnstile> v : deriv c x \<Longrightarrow>
                   \<turnstile> injval x c v : x;
        \<turnstile> v : deriv c (Star x)\<rbrakk>
       \<Longrightarrow> \<turnstile> injval (Star x) c v : Star x


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>{} \<turnstile> \<alpha> IMP \<beta>; ground_fm \<alpha>;
     ground_fm \<beta>\<rbrakk>
    \<Longrightarrow> {PfP \<guillemotleft>\<alpha>\<guillemotright>} \<turnstile>
                      PfP \<guillemotleft>\<beta>\<guillemotright>


proof (prove)
using this:
  goodEnv rho
  freshEnv zs z rho
  zs \<noteq> ys \<or> z \<notin> {y, y1}

goal (1 subgoal):
 1. freshEnv zs z (rho &[Var ys y1 / y]_ys)


proof (prove)
using this:
  a = (sfs, i)

goal (1 subgoal):
 1. exec_step_ind (exec_step_input P C M pc ics) P h stk loc C M pc ics frs
     sh (xp', h', frs', sh')


proof (chain)
picking this:
  \<forall>r\<in>#prime_factorization x.
     [a ^ ((p - 1) div r) \<noteq> 1] (mod p)


proof (prove)
goal (1 subgoal):
 1. success (shiftr_f a i) h


proof (prove)
using this:
  ?e \<in> insert tick (range ev)

goal (1 subgoal):
 1. \<lbrakk>a0 \<noteq> tick;
     {x. ev x = a0 \<or> ev x \<in> set al} \<subseteq> A;
     {x. ev x \<in> set al} \<subseteq> A \<Longrightarrow>
     (al, b) \<in> F (CHAOS A);
     tickFree al\<rbrakk>
    \<Longrightarrow> a0 \<in> ev ` A \<and>
                      (\<exists>a. ev a = a0) \<and>
                      (al, b) \<in> F (CHAOS A)


proof (prove)
goal (1 subgoal):
 1. empt_ord.Red_F_\<G> = Red_F_\<G>


proof (prove)
goal (1 subgoal):
 1. OFCLASS(char, cenum_class)


proof (prove)
goal (1 subgoal):
 1. Av + Bv * sqrt Cv = 0 \<Longrightarrow> Av\<^sup>2 = Bv\<^sup>2 * Cv


proof (prove)
using this:
  \<not> finite_list xs \<Longrightarrow> last\<cdot>xs = \<bottom>
  \<not> finite_list (a : xs)

goal (1 subgoal):
 1. last\<cdot>(a : xs) = \<bottom>


proof (prove)
goal (1 subgoal):
 1. \<And>a xs.
       (\<Squnion> i \<in> dom\<^sub>l xs \<bullet> f (xs ! i)) =
       foldr (\<and>) (map f xs) true \<Longrightarrow>
       (\<Squnion> i \<in> dom\<^sub>l
                            (a # xs) \<bullet> f ((a # xs) ! i)) =
       foldr (\<and>) (map f (a # xs)) true


proof (prove)
using this:
  shd ?a \<in> sset ?a

goal (1 subgoal):
 1. sset (gtrace r v) \<noteq> {}


proof (prove)
goal (1 subgoal):
 1. i \<in> \<gamma>_rep p \<Longrightarrow>
    - i \<in> \<gamma>_rep (uminus_rep p)


proof (prove)
using this:
  (monom 1 CARD('a) - monom 1 1) \<circ>\<^sub>p v =
  (\<Prod>x\<in>UNIV. [:0, 1:] - [:x:]) \<circ>\<^sub>p v

goal (1 subgoal):
 1. v ^ CARD('a) - v = (\<Prod>x\<in>UNIV. v - [:x:])


proof (prove)
goal (1 subgoal):
 1. adjuster n w us = a \<and>
    a \<in> carrier_vec n \<and>
    wits' = map (\<mu> i) [0..<i] \<and>
    a =
    sumlist (map (\<lambda>j. - \<mu> i j \<cdot>\<^sub>v gso j) [0..<j])


proof (state)
this:
  \<forall>c. 0 < v c
  \<forall>x y.
     v x \<le> n \<and> v y \<le> n \<and> v x = v y \<longrightarrow> x = y
  \<forall>c.
     v c \<le> n \<longrightarrow>
     dbm_entry_val x None (Some c) (M 0 (v c)) \<and>
     dbm_entry_val x (Some c) None (M (v c) 0)
  \<forall>c1 c2.
     v c1 \<le> n \<and> v c2 \<le> n \<longrightarrow>
     dbm_entry_val x (Some c1) (Some c2) (M (v c1) (v c2))
  \<forall>c.
     v c \<le> n \<longrightarrow>
     dbm_entry_val xa None (Some c)
      (if v c = 0 then \<one> else M 0 (v c)) \<and>
     dbm_entry_val xa (Some c) None (if v c = 0 then \<one> else M (v c) 0)
  \<forall>c1 c2.
     v c1 \<le> n \<and> v c2 \<le> n \<longrightarrow>
     dbm_entry_val xa (Some c1) (Some c2)
      (if v c1 = v c2 then \<one> else M (v c1) (v c2))
  v c1 \<le> n
  v c2 \<le> n

goal (1 subgoal):
 1. \<And>c1 c2.
       \<lbrakk>\<forall>c. 0 < v c;
        \<forall>x y.
           v x \<le> n \<and> v y \<le> n \<and> v x = v y \<longrightarrow>
           x = y;
        \<forall>c.
           v c \<le> n \<longrightarrow>
           dbm_entry_val x None (Some c) (M 0 (v c)) \<and>
           dbm_entry_val x (Some c) None (M (v c) 0);
        \<forall>c1 c2.
           v c1 \<le> n \<and> v c2 \<le> n \<longrightarrow>
           dbm_entry_val x (Some c1) (Some c2) (M (v c1) (v c2));
        \<forall>c.
           v c \<le> n \<longrightarrow>
           dbm_entry_val xa None (Some c)
            (if v c = 0 then \<one> else M 0 (v c)) \<and>
           dbm_entry_val xa (Some c) None
            (if v c = 0 then \<one> else M (v c) 0);
        \<forall>c1 c2.
           v c1 \<le> n \<and> v c2 \<le> n \<longrightarrow>
           dbm_entry_val xa (Some c1) (Some c2)
            (if v c1 = v c2 then \<one> else M (v c1) (v c2));
        v c1 \<le> n; v c2 \<le> n\<rbrakk>
       \<Longrightarrow> dbm_entry_val xa (Some c1) (Some c2)
                          (M (v c1) (v c2))


proof (prove)
goal (1 subgoal):
 1. closed_csubspace (orthogonal_complement A)


proof (state)
this:
  f = Polynomial.smult c' (\<Prod>(a, i)\<in>set fs'. a ^ Suc i)

goal (4 subgoals):
 1. f = Polynomial.smult c (\<Prod>(a, i)\<in>set fs. a ^ Suc i)
 2. \<And>a i. (a, i) \<in> set fs \<Longrightarrow> square_free a
 3. \<And>a i. (a, i) \<in> set fs \<Longrightarrow> 0 < degree a
 4. \<And>a i b j.
       \<lbrakk>(a, i) \<in> set fs; (b, j) \<in> set fs;
        (a, i) \<noteq> (b, j)\<rbrakk>
       \<Longrightarrow> algebraic_semidom_class.coprime a b


proof (prove)
using this:
  d = CARD('n)
  (xi, x) \<in> aforms_rel
  (si, s) \<in> \<langle>rl_rel\<rangle>sctn_rel
  length xi = d
  length (normal si) = d

goal (1 subgoal):
 1. (inter_aform_plane optns (eucl_of_list_aform xi)
      (Sctn (eucl_of_list (normal si)) (pstn si)),
     inter_sctn_spec (Affine (eucl_of_list_aform xi))
      (Sctn (eucl_of_list (normal si)) (pstn si)))
    \<in> \<langle>br Affine top\<rangle>nres_rel


proof (prove)
goal (9 subgoals):
 1. \<And>C I J.
       \<lbrakk>G\<turnstile>C\<leadsto>I;
        G\<turnstile>I\<preceq>I J\<rbrakk>
       \<Longrightarrow> G\<turnstile>C\<leadsto>J
 2. \<And>I J T Ja.
       \<lbrakk>G\<turnstile>I\<preceq>I J;
        G\<turnstile>Iface J\<preceq>Iface Ja\<rbrakk>
       \<Longrightarrow> G\<turnstile>Iface I\<preceq>Iface Ja
 3. \<And>I T D.
       G\<turnstile>Class Object\<preceq>Class D \<Longrightarrow>
       G\<turnstile>Iface I\<preceq>Class D
 4. \<And>I T Ia.
       G\<turnstile>Class Object\<preceq>Iface Ia \<Longrightarrow>
       G\<turnstile>Iface I\<preceq>Iface Ia
 5. \<And>C D T Da.
       \<lbrakk>G\<turnstile>C\<preceq>\<^sub>C D;
        G\<turnstile>Class D\<preceq>Class Da\<rbrakk>
       \<Longrightarrow> G\<turnstile>Class C\<preceq>Class Da
 6. \<And>C D T I.
       \<lbrakk>G\<turnstile>C\<preceq>\<^sub>C D;
        G\<turnstile>Class D\<preceq>Iface I\<rbrakk>
       \<Longrightarrow> G\<turnstile>Class C\<preceq>Iface I
 7. \<And>T Ta D.
       G\<turnstile>Class Object\<preceq>Class D \<Longrightarrow>
       G\<turnstile>T.[]\<preceq>Class D
 8. \<And>T Ta I.
       G\<turnstile>Class Object\<preceq>Iface I \<Longrightarrow>
       G\<turnstile>T.[]\<preceq>Iface I
 9. \<And>S T Ta T'.
       \<lbrakk>G\<turnstile>RefT T\<preceq>T';
        G\<turnstile>RefT S\<preceq>RefT T;
        \<forall>Ta.
           G\<turnstile>RefT T\<preceq>Ta \<longrightarrow>
           G\<turnstile>RefT S\<preceq>Ta;
        G\<turnstile>RefT T.[]\<preceq>T'.[];
        \<exists>t. T' = RefT t\<rbrakk>
       \<Longrightarrow> G\<turnstile>RefT S.[]\<preceq>T'.[]


proof (prove)
goal (4 subgoals):
 1. eqvt HRP_graph_aux
 2. \<And>x y. HRP_graph x y \<Longrightarrow> True
 3. \<And>P x.
       (\<And>s xa x' k.
           \<lbrakk>atom s \<sharp> (xa, x', k); atom k \<sharp> (xa, x');
            x = (xa, x')\<rbrakk>
           \<Longrightarrow> P) \<Longrightarrow>
       P
 4. \<And>s x x' k sa xa x'a ka.
       \<lbrakk>atom s \<sharp> (x, x', k); atom k \<sharp> (x, x');
        atom sa \<sharp> (xa, x'a, ka); atom ka \<sharp> (xa, x'a);
        (x, x') = (xa, x'a)\<rbrakk>
       \<Longrightarrow> SyntaxN.Ex s
                          (SyntaxN.Ex k (SeqHRP x x' (Var s) (Var k))) =
                         SyntaxN.Ex sa
                          (SyntaxN.Ex ka (SeqHRP xa x'a (Var sa) (Var ka)))


proof (prove)
using this:
  xvec \<sharp>* C
  \<Psi> \<turnstile> M \<leftrightarrow> K
  distinct xvec
  set xvec \<subseteq> supp N
  xvec \<sharp>* Tvec
  length xvec = length Tvec
  xvec \<sharp>* \<Psi>
  xvec \<sharp>* M
  xvec \<sharp>* K
  K\<lparr>N[xvec::=Tvec]\<rparr> \<prec> P[xvec::=Tvec] =
  M\<lparr>N\<rparr> \<prec> P'

goal (1 subgoal):
 1. Prop C \<Psi> (M\<lparr>\<lambda>*xvec N\<rparr>.P) M N P'


proof (prove)
using this:
  is_open\<^sub>Y ?U \<Longrightarrow>
  is_open\<^sub>X (f \<^sup>\<inverse> X ?U)
  \<lbrakk>is_open\<^sub>Y ?V; ?q \<in> \<O>\<^sub>Y ?V\<rbrakk>
  \<Longrightarrow> \<phi>\<^sub>f ?V ?q
                    \<in> \<O>\<^sub>X (f \<^sup>\<inverse> X ?V)
  x \<in> X
  is_open\<^sub>X (f \<^sup>\<inverse> X (U \<inter> U'))

goal (1 subgoal):
 1. stx.mult_rel
     (stx.class_of (f \<^sup>\<inverse> X U) (\<phi>\<^sub>f U q))
     (stx.class_of (f \<^sup>\<inverse> X U') (\<phi>\<^sub>f U' q')) =
    stx.class_of (f \<^sup>\<inverse> X (U \<inter> U'))
     (mult_str\<^sub>X (f \<^sup>\<inverse> X (U \<inter> U'))
       (\<rho>\<^sub>X (f \<^sup>\<inverse> X U)
         (f \<^sup>\<inverse> X (U \<inter> U')) (\<phi>\<^sub>f U q))
       (\<rho>\<^sub>X (f \<^sup>\<inverse> X U')
         (f \<^sup>\<inverse> X (U \<inter> U')) (\<phi>\<^sub>f U' q')))


proof (prove)
goal (1 subgoal):
 1. \<And>x y.
       ((Some x, y) \<in> K2.acc) =
       (\<exists>z. y = Some z \<and> (x, z) \<in> acc)


proof (prove)
using this:
  \<lbrakk>fv ?t \<subseteq> subst_domain \<theta>;
   ground (subst_range \<theta>)\<rbrakk>
  \<Longrightarrow> fv (?t \<cdot> \<theta>) = {}

goal (1 subgoal):
 1. interpretation\<^sub>s\<^sub>u\<^sub>b\<^sub>s\<^sub>t
     \<theta> \<Longrightarrow>
    ground (M \<cdot>\<^sub>s\<^sub>e\<^sub>t \<theta>)


proof (prove)
goal (1 subgoal):
 1. [\<Sum>k = 2..n.
        of_nat (n choose k) * p ^ k * 1 ^ (n - k) = 0] (mod p\<^sup>2)


proof (prove)
using this:
  2 \<le> card (f ` {0..<length (x1 # x2 # xs)})
  f ` {0..<length (x1 # x2 # xs)} = {0..<length ys}

goal (1 subgoal):
 1. Suc (Suc 0) \<le> length ys


proof (prove)
goal (1 subgoal):
 1. class.semiring = semiring_ow UNIV


proof (prove)
goal (1 subgoal):
 1. range to_metric_completion
    \<subseteq> closure (to_metric_completion ` A)


proof (prove)
using this:
  set_integrable (count_space UNIV) A f
  set_integrable (count_space UNIV) B f

goal (1 subgoal):
 1. set_integrable (count_space UNIV) (A \<union> B) f


proof (prove)
using this:
  N \<le> m
  m < n

goal (1 subgoal):
 1. - (t * Ln (of_nat n)) - - (t * Ln (of_nat m)) =
    (\<Sum>k = Suc m..n. t * Ln (of_nat (k - 1)) - t * Ln (of_nat k))


proof (prove)
goal (18 subgoals):
 1. eqvt trans_fm_graph_aux
 2. \<And>x y.
       trans_fm_graph x y \<Longrightarrow>
       (case x of (xs, uu_) \<Rightarrow> fresh_star (atom ` set xs)) y
 3. \<And>P x.
       \<lbrakk>\<And>e t u. x = (e, t IN u) \<Longrightarrow> P;
        \<And>e t u. x = (e, t EQ u) \<Longrightarrow> P;
        \<And>e A B. x = (e, A OR B) \<Longrightarrow> P;
        \<And>e A. x = (e, Neg A) \<Longrightarrow> P;
        \<And>k e A.
           \<lbrakk>atom k \<sharp> e; x = (e, SyntaxN.Ex k A)\<rbrakk>
           \<Longrightarrow> P\<rbrakk>
       \<Longrightarrow> P
 4. \<And>e t u ea ta ua.
       (e, t IN u) = (ea, ta IN ua) \<Longrightarrow>
       DBMem (trans_tm e t) (trans_tm e u) =
       DBMem (trans_tm ea ta) (trans_tm ea ua)
 5. \<And>e t u ea ta ua.
       (e, t IN u) = (ea, ta EQ ua) \<Longrightarrow>
       DBMem (trans_tm e t) (trans_tm e u) =
       DBEq (trans_tm ea ta) (trans_tm ea ua)
 6. \<And>e t u ea A B.
       \<lbrakk>eqvt_at trans_fm_sumC (ea, A);
        eqvt_at trans_fm_sumC (ea, B);
        (case (ea, A) of (xs, uu_) \<Rightarrow> fresh_star (atom ` set xs))
         (trans_fm_sumC (ea, A));
        (case (ea, B) of (xs, uu_) \<Rightarrow> fresh_star (atom ` set xs))
         (trans_fm_sumC (ea, B));
        (e, t IN u) = (ea, A OR B)\<rbrakk>
       \<Longrightarrow> DBMem (trans_tm e t) (trans_tm e u) =
                         DBDisj (trans_fm_sumC (ea, A))
                          (trans_fm_sumC (ea, B))
 7. \<And>e t u ea A.
       \<lbrakk>eqvt_at trans_fm_sumC (ea, A);
        (case (ea, A) of (xs, uu_) \<Rightarrow> fresh_star (atom ` set xs))
         (trans_fm_sumC (ea, A));
        (e, t IN u) = (ea, Neg A)\<rbrakk>
       \<Longrightarrow> DBMem (trans_tm e t) (trans_tm e u) =
                         DBNeg (trans_fm_sumC (ea, A))
 8. \<And>e t u k ea A.
       \<lbrakk>eqvt_at trans_fm_sumC (k # ea, A);
        (case (k # ea, A) of
         (xs, uu_) \<Rightarrow> fresh_star (atom ` set xs))
         (trans_fm_sumC (k # ea, A));
        atom k \<sharp> ea; (e, t IN u) = (ea, SyntaxN.Ex k A)\<rbrakk>
       \<Longrightarrow> DBMem (trans_tm e t) (trans_tm e u) =
                         DBEx (trans_fm_sumC (k # ea, A))
 9. \<And>e t u ea ta ua.
       (e, t EQ u) = (ea, ta EQ ua) \<Longrightarrow>
       DBEq (trans_tm e t) (trans_tm e u) =
       DBEq (trans_tm ea ta) (trans_tm ea ua)
 10. \<And>e t u ea A B.
        \<lbrakk>eqvt_at trans_fm_sumC (ea, A);
         eqvt_at trans_fm_sumC (ea, B);
         (case (ea, A) of
          (xs, uu_) \<Rightarrow> fresh_star (atom ` set xs))
          (trans_fm_sumC (ea, A));
         (case (ea, B) of
          (xs, uu_) \<Rightarrow> fresh_star (atom ` set xs))
          (trans_fm_sumC (ea, B));
         (e, t EQ u) = (ea, A OR B)\<rbrakk>
        \<Longrightarrow> DBEq (trans_tm e t) (trans_tm e u) =
                          DBDisj (trans_fm_sumC (ea, A))
                           (trans_fm_sumC (ea, B))
A total of 18 subgoals...


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>0 < k; n < length xs\<rbrakk>
    \<Longrightarrow> localState
                       (f_Exec_Comp_Stream trans_fun (xs \<odot> k) c !
                        (Suc n * k - Suc 0)) =
                      localState
                       (f_Exec_Comp trans_fun (xs \<down> Suc n \<odot> k)
                         c)


proof (prove)
using this:
  \<phi> \<notin> Cn K
  \<phi> \<notin> Cn K

goal (1 subgoal):
 1. B \<in> \<gamma>\<^sub>T\<^sub>R K (\<phi> .\<and>. \<psi>)


proof (state)
this:
  random_variable borel (pf asset (Suc n))

goal (1 subgoal):
 1. (\<lambda>z.
        pf asset (Suc n) z *
        discounted_value r (prices Mkt asset) (Suc n) z)
    \<in> borel_measurable N


proof (prove)
goal (1 subgoal):
 1. Enc_keys_clean (G \<union> H) \<Longrightarrow>
    analz (implSecureSet_aux Ag G \<union> H)
    \<subseteq> synth (analz (G \<union> H)) \<union> - payload


proof (prove)
using this:
  a \<in> allAllocations N G
  finite G
  finite (?r\<inverse>) = finite ?r
  Range (?r\<inverse>) = Domain ?r
  \<lbrakk>?b \<in> ?f ` ?A;
   \<And>x.
      \<lbrakk>?b = ?f x; x \<in> ?A\<rbrakk>
      \<Longrightarrow> ?thesis\<rbrakk>
  \<Longrightarrow> ?thesis
  (?a \<in> possible_allocations_rel ?G ?N) =
  (runiq ?a \<and>
   runiq (?a\<inverse>) \<and>
   Domain ?a partitions ?G \<and> Range ?a \<subseteq> ?N)
  runiq ?f \<Longrightarrow> finite (Domain ?f) = finite ?f
  \<lbrakk>?a \<in> allAllocations ?N ?G; finite ?G\<rbrakk>
  \<Longrightarrow> finite (Range ?a)

goal (1 subgoal):
 1. finite a


proof (prove)
using this:
  P \<turnstile> Path last Cs to C unique
  P \<turnstile> Path last Cs to C via Cs''
  P \<turnstile> Path last Xs to C via Xs''
  a = a' \<and> Cs = Xs

goal (1 subgoal):
 1. Cs'' = Xs''


proof (prove)
using this:
  (restrict_to P A)\<^sup>+\<^sup>+ a b
  accessible_on P A b

goal (1 subgoal):
 1. accessible_on P A a


proof (prove)
goal (1 subgoal):
 1. \<exists>paths.
       DisjointPaths G v0 v1 paths \<and> card paths = Suc sep_size


proof (prove)
using this:
  feasible t
  sound P

goal (1 subgoal):
 1. wp body (t P) s \<ominus> 1
    \<le> wp body (\<lambda>s. t P s \<ominus> 1) s


proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in F. norm (f x - c * g x) \<le> e * norm (g x)


proof (prove)
goal (1 subgoal):
 1. OFCLASS('a ratfps, euclidean_ring_gcd_class)


proof (prove)
goal (1 subgoal):
 1. (poly_rel ===> poly_rel ===> rel_prod poly_rel poly_rel)
     (bezout_coefficients_i ff_ops) bezout_coefficients


proof (prove)
goal (1 subgoal):
 1. AE x in M. norm (s (X (n + N)) x) \<le> w x


proof (chain)
picking this:
  bi_unique T


proof (prove)
using this:
  \<lbrakk>inv2 (Branch B lt z v rta); inv1 (Branch B lt z v rta)\<rbrakk>
  \<Longrightarrow> inv2 (rbt_del y (Branch B lt z v rta)) \<and>
                    (color_of (Branch B lt z v rta) = R \<and>
                     bheight (rbt_del y (Branch B lt z v rta)) =
                     bheight (Branch B lt z v rta) \<and>
                     inv1 (rbt_del y (Branch B lt z v rta)) \<or>
                     color_of (Branch B lt z v rta) = B \<and>
                     bheight (rbt_del y (Branch B lt z v rta)) =
                     bheight (Branch B lt z v rta) - 1 \<and>
                     inv1l (rbt_del y (Branch B lt z v rta)))
  inv2 (Branch B lt z v rta)
  bheight a = bheight (Branch B lt z v rta)
  inv1 (Branch B lt z v rta)
  inv2 a
  inv1 a

goal (1 subgoal):
 1. inv2 (rbt_del_from_right y a y' ss (Branch B lt z v rta)) \<and>
    bheight (rbt_del_from_right y a y' ss (Branch B lt z v rta)) =
    bheight a \<and>
    (color_of a = B \<and>
     color_of (Branch B lt z v rta) = B \<and>
     inv1 (rbt_del_from_right y a y' ss (Branch B lt z v rta)) \<or>
     (color_of a \<noteq> B \<or>
      color_of (Branch B lt z v rta) \<noteq> B) \<and>
     inv1l (rbt_del_from_right y a y' ss (Branch B lt z v rta)))


proof (prove)
goal (1 subgoal):
 1. x [^]\<^bsub>mult_of R\<^esub> order (mult_of R) =
    \<one>\<^bsub>mult_of R\<^esub>


proof (prove)
using this:
  Vagree \<nu> \<nu>' (FVT (args ?i5))

goal (1 subgoal):
 1. dterm_sem I ($f f args) \<nu> = dterm_sem I ($f f args) \<nu>'


proof (prove)
goal (1 subgoal):
 1. dist T (midpoint S T) = dist S (midpoint S T)


proof (prove)
using this:
  arr ?f =
  (?f \<noteq> Null \<and>
   Dom ?f \<in> UNIV \<and>
   Cod ?f \<in> UNIV \<and>
   Map ?f \<in> (if Dom ?f = Cod ?f then {()} else {}))

goal (1 subgoal):
 1. arr f = (f = MkIde False \<or> f = MkIde True)


proof (prove)
goal (1 subgoal):
 1. \<exists>x. \<forall>i\<in>P. [x = g i] (mod i ^ k i)


proof (prove)
goal (1 subgoal):
 1. purge GH (map getGMUserCom (purgeIdle (tl sl))) =
    purge GH (map getGMUserCom (purgeIdle (tl sl')))


proof (prove)
goal (1 subgoal):
 1. \<And>b.
       \<lbrakk>(case nth_visible s n of Inl e \<Rightarrow> Inl e
                 | Inr x \<Rightarrow>
                     case nth_visible s (Suc n) of Inl x \<Rightarrow> Inl x
                     | Inr xa \<Rightarrow>
                         Inr (Insert
                               (InsertMessage x new_id xa \<sigma>))) =
                Inr (Insert (InsertMessage p new_id q \<sigma>));
        nth_visible s n = Inr b\<rbrakk>
       \<Longrightarrow> extended_to_set q \<subseteq> I ` set s


proof (prove)
goal (1 subgoal):
 1. binop_v11 A f


proof (prove)
goal (1 subgoal):
 1. w \<Turnstile>\<^sub>n iterate f \<phi> n =
    w \<Turnstile>\<^sub>n \<phi>


proof (prove)
using this:
  s' \<otimes> s \<otimes> r \<ominus> s \<otimes> (s' \<otimes> r) =
  s' \<otimes> s \<otimes> r \<ominus> s' \<otimes> s \<otimes> r

goal (1 subgoal):
 1. s' \<otimes> s \<otimes> r \<ominus> s \<otimes> (s' \<otimes> r) =
    \<zero>


proof (prove)
using this:
  \<Union> P = I \<and>
  (\<forall>J1 J2.
      J1 \<in> P \<and> J2 \<in> P \<and> J1 \<noteq> J2 \<longrightarrow>
      J1 \<inter> J2 = {})
  \<Union> Q = I \<and>
  (\<forall>J1 J2.
      J1 \<in> Q \<and> J2 \<in> Q \<and> J1 \<noteq> J2 \<longrightarrow>
      J1 \<inter> J2 = {})

goal (1 subgoal):
 1. \<Union> (P \<union> Q) = I


proof (prove)
using this:
  \<bar>spmf
         (connect_obsf \
           (obsf_resource (sim |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)))
         True -
        spmf (connect_obsf \ (obsf_resource real_resource)) True\<bar>
  \<le> adv
  connect_obsf \
   (obsf_resource (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)) =
  connect_obsf \
   (obsf_resource (sim |\<^sub>= 1\<^sub>C \<rhd> ideal_resource))

goal (1 subgoal):
 1. \<bar>spmf
           (connect_obsf \
             (obsf_resource
               (sim' |\<^sub>= 1\<^sub>C \<rhd> ideal_resource)))
           True -
          spmf (connect_obsf \ (obsf_resource real_resource)) True\<bar>
    \<le> adv


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>atom g1 \<sharp> (g2, f1, k1, f2, k2, g, x, y, u);
     atom g2 \<sharp> (f1, k1, f2, k2, g, x, y, u);
     atom u \<sharp> (f1, k1, f2, k2, x, y, g, A);
     \<forall>C\<in>H. atom u \<sharp> C\<rbrakk>
    \<Longrightarrow> {HPair x y IN Var g2, ShiftP f2 k2 k1 (Var g2),
                       UnionP (Var g1) (Var g2) g,
                       RestrictedP f1 k1 (Var g1)} \<turnstile>
                      SyntaxN.Ex u
                       (Var u IN k2 AND
                        HaddP k1 (Var u) x AND HPair (Var u) y IN f2)


proof (prove)
goal (1 subgoal):
 1. \<forall>\<^sub>F x in at_top. eval_primfuns fs x \<noteq> 0


proof (prove)
goal (1 subgoal):
 1. pseudominimal_in (P .\<^bold>\<le> y) w


proof (prove)
goal (1 subgoal):
 1. norm (f x ** g x) \<le> F * G * K


proof (prove)
goal (1 subgoal):
 1. (\<And>FDTs'.
        \<lbrakk>P \<turnstile> D has_fields FDTs';
         FDTs = map (\<lambda>(F, b, T). ((F, C), b, T)) fs @ FDTs'\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  (g \<circ> f \<down> A) (f.source.additive.inverse u) =
  g.target.additive.inverse (g (f u))

goal (1 subgoal):
 1. f.source.additive.inverse u
    \<in> (g \<circ> f \<down> A) \<^sup>\<inverse> A \<ww>\<^sub>C


proof (prove)
goal (1 subgoal):
 1. lo u < relabel_effect f l u u \<Longrightarrow>
    ((f, relabel_effect f l u), fo, lo) \<in> pr_algo_rel\<^sup>*


proof (prove)
goal (1 subgoal):
 1. finite (statesNames s)


proof (prove)
goal (1 subgoal):
 1. BVG (the (snd (usubstappp \<sigma> U \<alpha>^d)))
    \<subseteq> BVG (the (snd (usubstappp \<sigma> U \<alpha>)))


proof (prove)
using this:
  mmonitorable \<phi>

goal (1 subgoal):
 1. future_bounded_mfotl \<phi>


proof (prove)
using this:
  q dvd d \<and> q < d \<and> \<Phi>.induced_modulus q
  [k = 1] (mod q)
  \<Phi>.induced_modulus ?d =
  (?d dvd d \<and>
   (\<forall>a.
       coprime a d \<and> [a = 1] (mod ?d) \<longrightarrow> \<Phi> a = 1))
  induced_modulus d
  coprime k n
  induced_modulus ?d =
  (?d dvd n \<and>
   (\<forall>a.
       coprime a n \<and> [a = 1] (mod ?d) \<longrightarrow> \<chi> a = 1))

goal (1 subgoal):
 1. \<Phi> k = 1


proof (prove)
using this:
  (\<And>\<sigma>'.
      ((?P, ?\<sigma>), {#}, \<sigma>')
      \<notin> matchrel\<^sup>*) \<Longrightarrow>
  matchers_map ?\<sigma> \<inter> matchers (set_mset ?P) = {}
  ((P, \<sigma>), y) \<in> matchrel\<^sup>*
  (y, {#}, ?\<tau>) \<notin> matchrel\<^sup>*

goal (1 subgoal):
 1. matchers_map (snd y) \<inter> matchers (set_mset (fst y)) = {}


proof (prove)
using this:
  sup a (- a) = (0::'a)

goal (1 subgoal):
 1. sup a (- a) + a = a


proof (prove)
using this:
  trimmed F
  basis_wf basis
  (f expands_to F) basis

goal (1 subgoal):
 1. ((\<lambda>x. f x ^ n) expands_to power_expansion abort F n) basis


proof (prove)
goal (1 subgoal):
 1. length \<circ> parOf = length \<circ> parOf \<and>
    intF = intF \<and> intP = intP


proof (prove)
goal (1 subgoal):
 1. trg f \<star> lunit f =
    (\<i>[trg f] \<star> f) \<cdot> \<a>' (trg f) (trg f) f


proof (prove)
using this:
  \<not> ?P \<equiv>\<cdot> ?Q \<Longrightarrow>
  supp (distinguishing_weak_formula ?P ?Q) \<subseteq> supp ?P
  x = distinguishing_weak_formula P Q
  \<not> P \<equiv>\<cdot> Q

goal (1 subgoal):
 1. supp x \<subseteq> supp P


proof (prove)
using this:
  esk48\<^sub>0 \<in> N \<times> (Pow G - {{}})

goal (1 subgoal):
 1. summedBidVector (real \<circ> bids) N G esk48\<^sub>0 =
    real (summedBidVector bids N G esk48\<^sub>0)


proof (prove)
goal (1 subgoal):
 1. (\<Sum>ia\<le>i.
        coeff (poly_of_vec (vec_first v n)) ia * coeff p (i - ia)) +
    (\<Sum>ia\<le>i.
        coeff (poly_of_vec (vec_last v m)) ia * coeff q (i - ia)) =
    (\<Sum>x<n. vec_first v n $ (n - Suc x) * coeff p (i - x)) +
    (\<Sum>x<m. vec_last v m $ (m - Suc x) * coeff q (i - x))


proof (prove)
goal (1 subgoal):
 1. \<And>G.
       \<lbrakk>F \<in> transient A; F ok G;
        F \<squnion> G \<in> A co A \<union> B\<rbrakk>
       \<Longrightarrow> F \<squnion> G \<in> transient A


proof (prove)
goal (1 subgoal):
 1. \<Theta>,\<Gamma> \<turnstile> mk_eq
                                    (subst_bvs
(map (\<lambda>(x, y). Fv x y) vs) t)
                                    (subst_bvs
(map (\<lambda>(x, y). Fv x y) vs) u)


proof (prove)
using this:
  spmf
   (map_spmf (snd \<circ> snd)
     (exec_gpv (rf_encrypt_bad challenge) (\2 cipher \<sigma>)
       (s, False)))
   True
  \<le> 1 / 2 ^ len * real q2

goal (1 subgoal):
 1. \<integral>\<^sup>+ x. ennreal (indicat_real {True} x)
                       \<partial>measure_spmf
                                  (map_spmf (snd \<circ> snd)
                                    (exec_gpv (rf_encrypt_bad challenge)
(\2 cipher \<sigma>) (s, False)))
    \<le> ennreal (1 / 2 ^ len * real q2)


proof (prove)
using this:
  evaluate True ?env ?st ?e ?r = (?r = eval ?env ?e ?st)
  evaluate_list True ?env ?st ?es ?r' = (?r' = eval_list ?env ?es ?st)
  evaluate_match True ?env ?st ?v ?pes ?v' ?r =
  (?r = eval_match ?env ?v ?pes ?v' ?st)
  evaluate True ?env ?st ?e ?r = (?r = eval' ?env ?e ?st)
  evaluate_list True ?env ?st ?es ?r' = (?r' = eval_list' ?env ?es ?st)
  evaluate_match True ?env ?st ?v ?pes ?v' ?r =
  (?r = eval_match' ?env ?v ?pes ?v' ?st)

goal (1 subgoal):
 1. \<And>x xa xb. eval_list' x xa xb = eval_list x xa xb


proof (state)
this:
  nat ` {1..int p - 1} \<subseteq> {1..p - 1}

goal (1 subgoal):
 1. {1..p - 1} \<subseteq> nat ` {1..int p - 1}


proof (chain)
picking this:
  Set_Theory.map \<eta>' M M'
  monoid_homomorphism_axioms \<eta>' M (\<cdot>) \<one> (\<cdot>') \<one>'


proof (prove)
goal (1 subgoal):
 1. wf\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>s S =
    wf\<^sub>l\<^sub>s\<^sub>s\<^sub>t\<^sub>s' S []


proof (prove)
goal (1 subgoal):
 1. \<t>[\<I>] = \<I>


proof (prove)
goal (4 subgoals):
 1. \<And>a b c.
       \<lbrakk>s = (a, b, c); c l = INIT\<rbrakk>
       \<Longrightarrow> (\<exists>s'. blstep l (a, b, c) s') = (l < N)
 2. \<And>a b c x2.
       \<lbrakk>s = (a, b, c); c l = WAIT x2\<rbrakk>
       \<Longrightarrow> (\<exists>s'. blstep l (a, b, c) s') = (l < N)
 3. \<And>a b c x3.
       \<lbrakk>s = (a, b, c); c l = HOLD x3\<rbrakk>
       \<Longrightarrow> (\<exists>s'. blstep l (a, b, c) s') = (l < N)
 4. \<And>a b c x4.
       \<lbrakk>s = (a, b, c); c l = REL x4\<rbrakk>
       \<Longrightarrow> (\<exists>s'. blstep l (a, b, c) s') = (l < N)


proof (prove)
using this:
  f p \<in> dest.carrier

goal (1 subgoal):
 1. inv.push_forward ` dest.tangent_space (f p) = src.tangent_space p


proof (prove)
goal (1 subgoal):
 1. F \<in> Always (- A \<union> B) \<inter>
            (B \<longmapsto>w A) \<Longrightarrow>
    F \<in> UNIV \<longmapsto>w (- A \<union> B) \<inter> (A \<union> - B)


proof (prove)
goal (1 subgoal):
 1. \<exists>bs'. as <~~> bs' \<and> bs' [\<sim>] cs


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>allDistinct (pat_bindings p []);
     pmatch (c env) (refs st) p v2 [] = Match x3_\<rbrakk>
    \<Longrightarrow> evaluate True
                       (update_v
                         (\<lambda>_.
                             nsAppend (alist_to_ns x3_) (sem_env.v env))
                         env)
                       st e
                       (map_prod id (map_result hd id)
                         (fun_evaluate st
                           (update_v
                             (\<lambda>_.
                                 nsAppend (alist_to_ns x3_) (sem_env.v env))
                             env)
                           [e]))


proof (prove)
goal (1 subgoal):
 1. t x \<le> makespan T


proof (prove)
using this:
  \<Gamma>, \<Theta>
      \<tturnstile>\<^bsub>/F\<^esub> (P \<inter> b) c1 Q A, c2
  atom_com Q \<Longrightarrow>
  \<forall>s t c'.
     \<Gamma> \<turnstile> (Q, s) \<rightarrow>\<^sup>*
                           (c', t) \<longrightarrow>
     final (c', t) \<longrightarrow>
     s \<in> Normal ` (P \<inter> b) \<longrightarrow>
     t \<notin> Fault ` F \<longrightarrow>
     c' = Skip \<and> t \<in> Normal ` A \<or>
     c' = Throw \<and> t \<in> Normal ` c2
  \<Gamma>, \<Theta>
      \<tturnstile>\<^bsub>/F\<^esub> (P \<inter> - b) P\<^sub>2_ c\<^sub>2_
A, c2
  atom_com c\<^sub>2_ \<Longrightarrow>
  \<forall>s t c'.
     \<Gamma> \<turnstile> (c\<^sub>2_, s) \<rightarrow>\<^sup>*
                           (c', t) \<longrightarrow>
     final (c', t) \<longrightarrow>
     s \<in> Normal ` (P \<inter> - b) \<longrightarrow>
     t \<notin> Fault ` F \<longrightarrow>
     c' = Skip \<and> t \<in> Normal ` A \<or>
     c' = Throw \<and> t \<in> Normal ` c2
  atom_com (Cond b Q c\<^sub>2_)

goal (1 subgoal):
 1. \<forall>s t c'.
       \<Gamma> \<turnstile> (Cond b Q c\<^sub>2_, s) \<rightarrow>\<^sup>*
                             (c', t) \<longrightarrow>
       final (c', t) \<longrightarrow>
       s \<in> Normal ` P \<longrightarrow>
       t \<notin> Fault ` F \<longrightarrow>
       c' = Skip \<and> t \<in> Normal ` A \<or>
       c' = Throw \<and> t \<in> Normal ` c2


proof (prove)
goal (1 subgoal):
 1. sigma_algebra UNIV UNIV \<and>
    positive UNIV (measure_of_st_vec' x) \<and>
    countably_additive UNIV (measure_of_st_vec' x)


proof (prove)
goal (1 subgoal):
 1. (\<And>fa fb fc.
        \<lbrakk>fa 0 = a; fb 0 = b; fc 0 = c;
         \<And>n.
            convex hull {fa n, fb n, fc n}
            \<subseteq> convex hull {a, b, c};
         \<And>n. dist (fa n) (fb n) \<le> K / 2 ^ n;
         \<And>n. dist (fb n) (fc n) \<le> K / 2 ^ n;
         \<And>n. dist (fc n) (fa n) \<le> K / 2 ^ n;
         \<And>n.
            e * (K / 2 ^ n)\<^sup>2
            \<le> cmod
                   (contour_integral (linepath (fa n) (fb n)) f +
                    contour_integral (linepath (fb n) (fc n)) f +
                    contour_integral (linepath (fc n) (fa n)) f);
         \<And>n.
            convex hull {fa (Suc n), fb (Suc n), fc (Suc n)}
            \<subseteq> convex hull {fa n, fb n, fc n}\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. ev (holds (\<lambda>step. snd step = r)) steps


proof (prove)
goal (1 subgoal):
 1. rel_gpv (=) (eq_onp (\<lambda>x. x \<in> outs_\<I> \<I>)) gpv' gpv'


proof (prove)
goal (1 subgoal):
 1. (u \<in> H.isolated_verts) = (u \<in> G.isolated_verts)


proof (prove)
using this:
  RModule FG (\<cdot>) U \<and> U \<subseteq> V
  KerT \<equiv> ker T \<inter> V
  x \<in> U
  y \<in> U
  (T \<down> U) x = (T \<down> U) y

goal (1 subgoal):
 1. x - y \<in> U \<inter> KerT


proof (prove)
using this:
  K \<subseteq> carrier R

goal (1 subgoal):
 1. a # p = [] \<or>
    set (a # p) \<subseteq> K \<and>
    lead_coeff (a # p) \<noteq> \<zero> \<Longrightarrow>
    a \<in> carrier R - {\<zero>}


proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. infdist (g x) A) \<in> borel_measurable M


proof (prove)
goal (1 subgoal):
 1. \<And>a p.
       \<lbrakk>a \<noteq> (0::'a) \<or> p \<noteq> 0;
        poly_y_x (poly_x_minus_y p) = poly_y_minus_x p\<rbrakk>
       \<Longrightarrow> poly_y_x [:[:a:]:] +
                         poly_y_x (poly_x_minus_y p) * poly_y_x x_y =
                         poly_y_minus_x (pCons a p)


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x \<in> [n\<dots>,d]; n < x\<rbrakk>
    \<Longrightarrow> x - Suc 0 \<in> [n\<dots>,d]


proof (prove)
goal (1 subgoal):
 1. finite (set_pmf (mix_pmf a p q))


proof (state)
this:
  mbody(CT,m,D) = xs . e
  length xs = length Cs

goal (1 subgoal):
 1. \<And>CT C CDef m D Bs B.
       \<lbrakk>CT C = Some CDef;
        lookup (cMethods CDef) (\<lambda>md. mName md = m) = None;
        cSuper CDef = D; mtype(CT,m,D) = Bs \<rightarrow> B;
        \<exists>xs e.
           mbody(CT,m,D) = xs . e \<and> length xs = length Bs\<rbrakk>
       \<Longrightarrow> \<exists>xs e.
                            mbody(CT,m,C) = xs . e \<and>
                            length xs = length Bs


proof (prove)
goal (1 subgoal):
 1. update_b (\<lambda>_. 3) (X 1 2) = X 1 3


proof (prove)
goal (1 subgoal):
 1. \<exists>r.
       evaluate_prog True env s prog r \<and>
       snd r = Rerr (Rabort Rtimeout_error)


proof (prove)
using this:
  valid2 tr_
  \<lbrakk>tgtOf ?trn = srcOf (hd tr_); validTrans ?trn\<rbrakk>
  \<Longrightarrow> valid2 (?trn # tr_)
  tgtOf (last tr_) = srcOf trn_
  validTrans trn_
  tgtOf trn = srcOf (hd (tr_ ## trn_))
  validTrans trn

goal (1 subgoal):
 1. valid2 ((trn # tr_) ## trn_)


proof (prove)
goal (1 subgoal):
 1. (dist B A)\<^sup>2 =
    (dist B D)\<^sup>2 + (dist A D)\<^sup>2 -
    2 * dist A D * dist B D * cos (angle B D A)


proof (prove)
using this:
  \<Gamma>(x \<mapsto> T) \<turnstile> A : \<sigma>
  A \<rightarrow>\<beta> ?M' \<Longrightarrow>
  \<Gamma>(x \<mapsto> T) \<turnstile> ?M' : \<sigma>
  Fn x T A \<rightarrow>\<beta> M'

goal (1 subgoal):
 1. (\<And>A'.
        \<lbrakk>A \<rightarrow>\<beta> A'; M' = Fn x T A'\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
goal (1 subgoal):
 1. wf_sub_rel {}


proof (prove)
goal (1 subgoal):
 1. subpath 0 u (flow_to_path x t t') = flow_to_path x t (t + u * (t' - t))


proof (prove)
goal (1 subgoal):
 1. \<And>i.
       enat i < llength w \<Longrightarrow>
       (w \<bar>\<bar> iterates Suc 0) ?! i = (w ?! i, i)


proof (prove)
goal (1 subgoal):
 1. ring_ops (finite_field_ops32 pp) mod_ring_rel32


proof (prove)
goal (1 subgoal):
 1. extractable K I \<subseteq> I


proof (prove)
using this:
  \<exists>x. g \<midarrow>z\<rightarrow> x \<or> is_pole g z
  \<forall>\<^sub>F w in at z. g w = f w

goal (1 subgoal):
 1. \<exists>x. f \<midarrow>z\<rightarrow> x \<or> is_pole f z


proof (prove)
goal (1 subgoal):
 1. (\<And>element_tag_name h2 new_shadow_root_ptr h3.
        \<lbrakk>h \<turnstile> get_tag_name element_ptr
                 \<rightarrow>\<^sub>r element_tag_name;
         element_tag_name \<in> safe_shadow_root_element_types;
         h \<turnstile> get_shadow_root element_ptr
         \<rightarrow>\<^sub>r None;
         h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M
         \<rightarrow>\<^sub>h h2;
         h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M
         \<rightarrow>\<^sub>r new_shadow_root_ptr;
         h2 \<turnstile> set_mode new_shadow_root_ptr new_mode
         \<rightarrow>\<^sub>h h3;
         h3 \<turnstile> set_shadow_root element_ptr
                          (Some new_shadow_root_ptr)
         \<rightarrow>\<^sub>h h'\<rbrakk>
        \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (state)
this:
  N = density M (\<lambda>x. ennreal (D x))

goal (1 subgoal):
 1. (KL_divergence b M N = 0) = (N = M)


proof (prove)
using this:
  c \<in># add_mset b B

goal (1 subgoal):
 1. c \<in># B


proof (prove)
using this:
  \<lbrakk>?X \<noteq> {#}; ?X \<subseteq># N; M = N - ?X + ?Y;
   ?k \<in># ?Y; \<not> ?k < ?a; ?a \<noteq> ?k\<rbrakk>
  \<Longrightarrow> ?a < ?k
  \<not> (M \<noteq> N \<and>
          (\<forall>y.
              count N y < count M y \<longrightarrow>
              (\<exists>x>y. count M x < count N x)))
  N \<noteq> M

goal (1 subgoal):
 1. N \<noteq> M \<and>
    (\<forall>y.
        count M y < count N y \<longrightarrow>
        (\<exists>x>y. count N x < count M x))


proof (prove)
goal (1 subgoal):
 1. (R ===> R ===> rel_prod (rel_prod R R) R)
     (euclid_ext_aux_i (arith_ops_record.one ops)
       (arith_ops_record.zero ops) (arith_ops_record.zero ops)
       (arith_ops_record.one ops))
     (euclid_ext_aux (1::'a) (0::'a) (0::'a) (1::'a))


proof (prove)
goal (1 subgoal):
 1. composite_functor (\<cdot>\<^sub>A\<^sub>2\<^sub>x\<^sub>A\<^sub>1)
     (\<cdot>\<^sub>A\<^sub>1\<^sub>x\<^sub>A\<^sub>2) (\<cdot>\<^sub>B)
     S.map F


proof (prove)
goal (1 subgoal):
 1. ((c, take i t), The (trace c (take i t)))
    \<in> Collect (case_prod (\<lambda>(x, y). trace x y))


proof (prove)
using this:
  j < dim_vec
       (Matrix.vec (dim_row A)
         (\<lambda>j.
             tensor_from_lookup (input_sizes m)
              (\<lambda>is.
                  (A *\<^sub>v
                   map_vec (\<lambda>T. lookup T is) (tensors_from_net m)) $
                  j)))

goal (1 subgoal):
 1. Matrix.vec (dim_row A)
     (\<lambda>j.
         tensor_from_lookup (input_sizes m)
          (\<lambda>is.
              (A *\<^sub>v
               map_vec (\<lambda>T. lookup T is) (tensors_from_net m)) $
              j)) $
    j =
    tensor_from_lookup (input_sizes m)
     (\<lambda>is.
         (A *\<^sub>v
          map_vec (\<lambda>T. lookup T is) (tensors_from_net m)) $
         j)


proof (prove)
using this:
  ?T \<in> VectorSpaceHomSet (\<cdot>) ?V ?fsmult' ?N \<Longrightarrow>
  VectorSpaceHom (\<cdot>) ?V ?fsmult' ?T
  ?T \<in> VectorSpaceHomSet (\<cdot>) ?V ?fsmult' ?W \<Longrightarrow>
  ?T ` ?V \<subseteq> ?W
  VectorSpaceHom (\<cdot>) ?V ?smult' ?T \<Longrightarrow> GroupHom ?V ?T
  \<lbrakk>GroupHom V ?T; ?T ` V \<subseteq> W\<rbrakk>
  \<Longrightarrow> ?T \<in> GroupHomSet V W
  \<lbrakk>VectorSpaceHom (\<cdot>) ?V ?smult' ?T; ?r \<in> UNIV;
   ?m \<in> ?V\<rbrakk>
  \<Longrightarrow> ?T (?r \<cdot> ?m) = ?smult' ?r (?T ?m)

goal (1 subgoal):
 1. VectorSpaceHomSet (\<cdot>) V (\<star>) W
    \<subseteq> GroupHomSet V W \<inter>
                {T. \<forall>a.
                       \<forall>v\<in>V. T (a \<cdot> v) = a \<star> T v}


proof (prove)
goal (1 subgoal):
 1. subset_mset.bdd_above A


proof (prove)
goal (1 subgoal):
 1. corec_tllist IS_TNIL TNIL THD endORmore TTL_end TTL_more b =
    Lazy_tllist
     (\<lambda>_.
         if IS_TNIL b then Inr (TNIL b)
         else Inl (THD b,
                   if endORmore b then TTL_end b
                   else corec_tllist IS_TNIL TNIL THD endORmore TTL_end
                         TTL_more (TTL_more b)))


proof (prove)
using this:
  wf_plan_action (PAction n args)

goal (1 subgoal):
 1. sound_opr
     (instantiate_action_schema (the (resolve_action_schema n)) args)
     (pddl_opr_to_act
       (instantiate_action_schema (the (resolve_action_schema n)) args))


proof (prove)
goal (1 subgoal):
 1. periodic_orbit y \<and> range (flow0 y) = \<omega>_limit_set x


proof (prove)
using this:
  isVal z

goal (1 subgoal):
 1. (\<exists>y e'. z = Lam [y]. e' \<and> atom y \<sharp> c) \<or>
    (\<exists>b. z = Bool b)


proof (prove)
using this:
  \<guillemotleft>?f : ?a \<rightarrow>\<^sub>J ?b\<guillemotright> \<Longrightarrow>
  \<guillemotleft>\<chi>'
                   ?f : \<chi>'.A.map
                         ?a \<rightarrow> if ?b = m then a
    else null\<guillemotright>
  \<chi>'.A.map ?f = (if J.arr ?f then a' else null)
  J.arr ?f = (?f \<in> {m})
  J.dom ?f = (if ?f \<in> {m} then ?f else J.null)
  J.cod ?f = (if ?f \<in> {m} then ?f else J.null)

goal (1 subgoal):
 1. \<guillemotleft>\<chi>' m : a' \<rightarrow> a\<guillemotright>


proof (prove)
goal (1 subgoal):
 1. fv\<^sub>s\<^sub>t (S \<cdot>\<^sub>s\<^sub>t \<delta>)
    \<subset> fv\<^sub>s\<^sub>t S


proof (prove)
using this:
  x \<in> T \<union> closure S \<inter> closure T \<Longrightarrow>
  (g has_derivative g' x)
   (at x within T \<union> closure S \<inter> closure T)

goal (1 subgoal):
 1. bounded_linear (if x \<in> T then g' x else (\<lambda>x. 0::'b))


proof (prove)
goal (1 subgoal):
 1. factorial_monoid mk_monoid


proof (prove)
goal (1 subgoal):
 1. (t \<in> final_threads s) = final_thread s t


proof (prove)
goal (1 subgoal):
 1. degree
     (\<Sum>p | p permutes {0..<n}.
        signof p *
        (\<Prod>i = 0..<n.
            ([:0::'a, 1::'a:] \<cdot>\<^sub>m 1\<^sub>m (dim_row A) +
             map_mat (\<lambda>a. [:- a:]) A) $$
            (i, p i))) =
    n \<and>
    coeff
     (\<Sum>p | p permutes {0..<n}.
        signof p *
        (\<Prod>i = 0..<n.
            ([:0::'a, 1::'a:] \<cdot>\<^sub>m 1\<^sub>m (dim_row A) +
             map_mat (\<lambda>a. [:- a:]) A) $$
            (i, p i)))
     n =
    (1::'a)


proof (prove)
using this:
  0 < k
  h \<in> {0<..k}
  a \<in> {0<..1}
  s \<notin> {0, 1}

goal (1 subgoal):
 1. complex_of_real (2 * pi) powr - s *
    (\<i> powr - s * perzeta (real_of_int (int h) / real k) s +
     \<i> powr s * perzeta (real_of_int (- int h) / real k) s) =
    complex_of_real (2 * pi) powr - s * of_nat k powr - s *
    ((\<Sum>n = 1..k.
         \<i> powr - s * cis (2 * pi * real n * real h / real k) *
         hurwitz_zeta (real n / real k) s) +
     (\<Sum>n = 1..k.
         \<i> powr s * cis (- 2 * pi * real n * real h / real k) *
         hurwitz_zeta (real n / real k) s))


proof (state)
goal (1 subgoal):
 1. (\<And>x.
        x \<in> set [] \<Longrightarrow>
        x \<in> carrier_vec n) \<Longrightarrow>
    foldr (+) [] (0\<^sub>v n) $ i = (\<Sum>x\<leftarrow>[]. x $ i)


proof (prove)
goal (2 subgoals):
 1. ring_id \<in> carrier (function_ring (carrier Zp) Zp)
 2. \<And>s.
       is_Zp_cauchy s \<Longrightarrow> is_Zp_cauchy (ring_id \<circ> s)


proof (state)
this:
  \<exists>y\<in>fv\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s (f # F).
     x \<in> fv (\<delta> y)

goal (1 subgoal):
 1. \<lbrakk>x \<in> fv\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s
                      (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s
                       \<delta>) \<Longrightarrow>
             \<exists>y\<in>fv\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s F.
                x \<in> fv (\<delta> y);
     x \<in> fv\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s
              (F \<cdot>\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s
               \<delta>)\<rbrakk>
    \<Longrightarrow> \<exists>y\<in>fv\<^sub>p\<^sub>a\<^sub>i\<^sub>r\<^sub>s
(f # F).
                         x \<in> fv (\<delta> y)


proof (state)
this:
  \<forall>\<^sub>F x0 in sequentially.
     \<forall>a\<ge>x0.
        \<forall>b>a.
           cmod
            (\<Sum>n\<in>{a<..b}. \<chi> n * complex_of_real (f (real n)))
           \<le> 2 * real (totient n) * f (real a)

goal (1 subgoal):
 1. (\<lambda>x. 2 * real (totient n) * f (real x))
    \<longlonglongrightarrow> 0


proof (prove)
goal (1 subgoal):
 1. trivial_homomorphism (relative_homology_group p X S)
     (homology_group (p - 1) (subtopology X S)) (hom_boundary p X S)


proof (prove)
using this:
  v \<in> gunodes A w
  gurun A w r v
  smap f' (gtrace r v) = sconst k
  shd r \<in> gureachable A w v

goal (1 subgoal):
 1. (\<lbrakk>shd r \<in> gunodes A w; gurun A w (stl r) (shd r);
      smap f' (gtrace (stl r) (shd r)) = sconst k\<rbrakk>
     \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  solve_lir cs fs g = Some sol

goal (1 subgoal):
 1. solve_ratfps fps = Some sol


proof (prove)
using this:
  \<guillemotleft>derivs xs
                   \<guillemotleft>?r\<guillemotright>\<guillemotright> =
  \<guillemotleft>derivs xs ?r\<guillemotright>
  \<guillemotleft>deriv x
                   \<guillemotleft>derivs xs
                                    r\<guillemotright>\<guillemotright> =
  \<guillemotleft>deriv x (derivs xs r)\<guillemotright>
  \<guillemotleft>deriv x
                   \<guillemotleft>derivs xs
                                    \<guillemotleft>r\<guillemotright>\<guillemotright>\<guillemotright> =
  \<guillemotleft>deriv x
                   (derivs xs
                     \<guillemotleft>r\<guillemotright>)\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>derivs (xs @ [x])
                     \<guillemotleft>r\<guillemotright>\<guillemotright> =
    \<guillemotleft>derivs (xs @ [x]) r\<guillemotright>


proof (prove)
using this:
  \<alpha> \<noteq> \<beta>

goal (1 subgoal):
 1. (Var x
      \<alpha> \<leftrightarrow> Var y
                                  \<alpha>) \<bullet> (Var x \<alpha>,
                 Var x \<beta>) =
    (Var y \<alpha>, Var x \<beta>)


proof (prove)
goal (1 subgoal):
 1. s \<in> \<RR> Tr Up s\<^sub>0 \<Longrightarrow> deadlock_free_v2 (P s)


proof (prove)
goal (1 subgoal):
 1. dc_crypto = Some ` {0..<n} \<times> {xs. length xs = n}


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>f \<in> borel_measurable M; z < esssup M f\<rbrakk>
    \<Longrightarrow> 0 < emeasure M {x \<in> space M. z < f x}


proof (prove)
using this:
  lift n p1 \<Sigma>1 = Ok (p2, \<Sigma>2)
  rel_option (\<lambda>ar fd. arity fd = ar) (get_arity ?x51) (F ?x51)

goal (1 subgoal):
 1. Subx.sp F p2 \<Sigma>1 = Ok \<Sigma>2


proof (prove)
goal (1 subgoal):
 1. (\<lambda>(b, a, i). \<phi> m (b, a, i)) = (\<lambda>(b, a, i). 0)


proof (prove)
goal (2 subgoals):
 1. \<lbrakk>ShadowRootClass.known_ptr ptr; ShadowRootClass.type_wf h;
     ptr |\<in>| object_ptr_kinds h\<rbrakk>
    \<Longrightarrow> known_ptr\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
                       ptr \<longrightarrow>
                      h \<turnstile> ok get_child_nodes\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
   ptr
 2. \<lbrakk>ShadowRootClass.known_ptr ptr; ShadowRootClass.type_wf h;
     ptr |\<in>| object_ptr_kinds h\<rbrakk>
    \<Longrightarrow> \<not> known_ptr\<^sub>C\<^sub>o\<^sub>r\<^sub>e\<^sub>_\<^sub>D\<^sub>O\<^sub>M
                              ptr \<longrightarrow>
                      h \<turnstile> ok invoke local.a_get_child_nodes_tups
   ptr ()


proof (prove)
goal (1 subgoal):
 1. UP.eval (map poly_of_const l') q =
    UP.eval (map poly_of_const (\<zero> # l')) q


proof (prove)
goal (1 subgoal):
 1. in_all_resolvents_upon S A P1


proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<And>A A'.
                \<lbrakk>A \<sqsubseteq> A'; \<D> x1_ A\<rbrakk>
                \<Longrightarrow> \<D> x1_ A';
     \<And>A A'.
        \<lbrakk>A \<sqsubseteq> A'; \<D> x4_ A\<rbrakk>
        \<Longrightarrow> \<D> x4_ A';
     \<And>A A'.
        \<lbrakk>A \<sqsubseteq> A'; \<D> x5_ A\<rbrakk>
        \<Longrightarrow> \<D> x5_ A';
     A_ \<sqsubseteq> A'_;
     \<D> (x1_\<bullet>compareAndSwap(x2_\<bullet>x3_, x4_, x5_))
      A_\<rbrakk>
    \<Longrightarrow> \<D>
                       (x1_\<bullet>compareAndSwap(x2_\<bullet>x3_, x4_, x5_))
                       A'_


proof (prove)
goal (1 subgoal):
 1. fixed_length_sublist (concat (map vec As)) (prod_list ds) i =
    vec (As ! i)


proof (prove)
goal (1 subgoal):
 1. \<And>ra u' v' v u.
       \<lbrakk>Idomain S; t \<in> carrier S;
        t \<noteq> \<zero>\<^bsub>S\<^esub>;
        maximal_ideal S (S \<diamondsuit>\<^sub>p t);
        PolynRg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y;
        f \<in> carrier R; g \<in> carrier R; h \<in> carrier R;
        deg R S X g
        \<le> deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
               (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
                 (pj S (S \<diamondsuit>\<^sub>p t)) g);
        deg R S X h +
        deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
           (pj S (S \<diamondsuit>\<^sub>p t)) g)
        \<le> deg R S X f;
        P_mod R S X (S \<diamondsuit>\<^sub>p (t^\<^bsup>S m\<^esup>))
         (t^\<^bsup>S m\<^esup> \<cdot>\<^sub>r ra);
        0 < m; Subring R S; Ring S; aGroup R;
        Corps (S /\<^sub>r (S \<diamondsuit>\<^sub>p t));
        ideal S (S \<diamondsuit>\<^sub>p t);
        pj S (S \<diamondsuit>\<^sub>p t)
        \<in> rHom S (S /\<^sub>r (S \<diamondsuit>\<^sub>p t));
        t \<in> carrier R; Ring (S /\<^sub>r (S \<diamondsuit>\<^sub>p t));
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t)) g \<noteq>
        \<zero>\<^bsub>R'\<^esub>;
        g \<noteq> \<zero>;
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t)) h \<noteq>
        \<zero>\<^bsub>R'\<^esub>;
        0 \<le> deg R S X h; h \<noteq> \<zero>; f \<noteq> \<zero>;
        ra \<in> carrier R;
        f \<plusminus> -\<^sub>a g \<cdot>\<^sub>r h =
        t^\<^bsup>S m\<^esup> \<cdot>\<^sub>r ra;
        g \<cdot>\<^sub>r h \<in> carrier R; deg R S X ra \<le> deg R S X f;
        t^\<^bsup>S m\<^esup> \<in> carrier S;
        t^\<^bsup>S m\<^esup> \<noteq> \<zero>\<^bsub>S\<^esub>;
        deg R S X (t^\<^bsup>S m\<^esup> \<cdot>\<^sub>r ra) = deg R S X ra;
        u' \<in> carrier R'; v' \<in> carrier R';
        deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y u'
        \<le> amax
               (deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
                 (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
                   (pj S (S \<diamondsuit>\<^sub>p t)) ra) -
                deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
                 (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
                   (pj S (S \<diamondsuit>\<^sub>p t)) g))
               (deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
                 (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
                   (pj S (S \<diamondsuit>\<^sub>p t)) h));
        deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y v'
        \<le> deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
               (erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
                 (pj S (S \<diamondsuit>\<^sub>p t)) g);
        u' \<cdot>\<^sub>r\<^bsub>R'\<^esub>
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t))
         g \<plusminus>\<^bsub>R'\<^esub>
        v' \<cdot>\<^sub>r\<^bsub>R'\<^esub>
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t)) h =
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t)) ra;
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t)) g
        \<in> carrier R';
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t)) h
        \<in> carrier R';
        v \<in> carrier R; u \<in> carrier R;
        deg R S X v
        \<le> deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y v';
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t)) v =
        v';
        deg R S X u
        \<le> deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y u';
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t)) u =
        u';
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t))
         u \<cdot>\<^sub>r\<^bsub>R'\<^esub>
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t)) g =
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t)) (u \<cdot>\<^sub>r g);
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t))
         v \<cdot>\<^sub>r\<^bsub>R'\<^esub>
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t)) h =
        erH R S X R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
         (pj S (S \<diamondsuit>\<^sub>p t)) (v \<cdot>\<^sub>r h);
        t^\<^bsup>S m\<^esup> \<in> carrier R\<rbrakk>
       \<Longrightarrow> deg R S X
                          (g \<plusminus>
                           t^\<^bsup>S m\<^esup> \<cdot>\<^sub>r v)
                         \<le> deg R'
                                (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
                                (erH R S X R'
                                  (S /\<^sub>r (S \<diamondsuit>\<^sub>p t))
                                  Y (pj S (S \<diamondsuit>\<^sub>p t))
                                  (g \<plusminus>
                                   t^\<^bsup>S m\<^esup> \<cdot>\<^sub>r
                                   v)) \<and>
                         P_mod R S X
                          (S \<diamondsuit>\<^sub>p (t^\<^bsup>S m\<^esup>))
                          (g \<plusminus>
                           -\<^sub>a (g \<plusminus>
t^\<^bsup>S m\<^esup> \<cdot>\<^sub>r v)) \<and>
                         deg R S X
                          (h \<plusminus>
                           t^\<^bsup>S m\<^esup> \<cdot>\<^sub>r u) +
                         deg R' (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
                          (erH R S X R'
                            (S /\<^sub>r (S \<diamondsuit>\<^sub>p t)) Y
                            (pj S (S \<diamondsuit>\<^sub>p t))
                            (g \<plusminus>
                             t^\<^bsup>S m\<^esup> \<cdot>\<^sub>r v))
                         \<le> deg R S X f \<and>
                         P_mod R S X
                          (S \<diamondsuit>\<^sub>p (t^\<^bsup>S m\<^esup>))
                          (h \<plusminus>
                           -\<^sub>a (h \<plusminus>
t^\<^bsup>S m\<^esup> \<cdot>\<^sub>r u)) \<and>
                         P_mod R S X
                          (S \<diamondsuit>\<^sub>p
                           (t^\<^bsup>S Suc m\<^esup>))
                          (f \<plusminus>
                           -\<^sub>a (g \<plusminus>
t^\<^bsup>S m\<^esup> \<cdot>\<^sub>r v) \<cdot>\<^sub>r
                                     (h \<plusminus>
t^\<^bsup>S m\<^esup> \<cdot>\<^sub>r u))


proof (prove)
goal (1 subgoal):
 1. \<And>Z\<^sub>1 Z\<^sub>2.
       \<lbrakk>mwb_lens Z;
        Z\<^sub>1 ;\<^sub>L Z \<bowtie> Z\<^sub>2 ;\<^sub>L Z;
        vwb_lens Z\<^sub>1; X = Z\<^sub>1 ;\<^sub>L Z; vwb_lens Z\<^sub>2;
        Y = Z\<^sub>2 ;\<^sub>L Z\<rbrakk>
       \<Longrightarrow> vwb_lens (Z\<^sub>1 +\<^sub>L Z\<^sub>2) \<and>
                         Z\<^sub>1 ;\<^sub>L Z +\<^sub>L
                         Z\<^sub>2 ;\<^sub>L Z =
                         (Z\<^sub>1 +\<^sub>L Z\<^sub>2) ;\<^sub>L Z


proof (prove)
goal (1 subgoal):
 1. Hv (sum f S) = (\<Sum>x\<in>S. Hv (f x))


proof (prove)
goal (1 subgoal):
 1. \<exists>\<V>.
       finite \<V> \<and>
       \<V> \<subseteq> \<U> \<and>
       {x \<in> topspace X. f x = y} \<subseteq> \<Union> \<V>


proof (prove)
goal (1 subgoal):
 1. up\<cdot>x * up\<cdot>y = up\<cdot>(x * y)


proof (prove)
using this:
  \<Gamma> \<turnstile> e : t'

goal (1 subgoal):
 1. the (expr_type \<Gamma> e) = t'


proof (prove)
using this:
  ?t'13 \<noteq> t \<Longrightarrow>
  tbisim (ws ?t'13 = None) ?t'13 (ts1 ?t'13) m1 (ts2 ?t'13) m2
  ts1 t = \<lfloor>xln\<rfloor>
  r2.cond_action_oks (ls, (ts2, m2), ws, is) t cts

goal (1 subgoal):
 1. (\<tau>mRed1 (ls, (ts1, m1), ws, is) s1' &&&
     (\<And>t'.
         t' \<noteq> t \<Longrightarrow>
         tbisim (ws t' = None) t' (thr s1' t') m1 (ts2 t') m2)) &&&
    r1.cond_action_oks s1' t cts &&& thr s1' t = \<lfloor>xln\<rfloor>


proof (prove)
goal (1 subgoal):
 1. fully_faithful_functor (\<cdot>) (\<cdot>) H.R


proof (prove)
using this:
  DIM_precond TYPE('a) n

goal (1 subgoal):
 1. (Basis_list_impl n, Basis_list) \<in> \<langle>lv_rel\<rangle>list_rel


proof (prove)
using this:
  altnst @ cs = us @ [u, x, z] @ zs
  xs = us @ [u]
  Suc (length xs) \<noteq> n
  altnst = alternating_list n s t

goal (1 subgoal):
 1. \<not> order.greater n (length xs)


proof (prove)
using this:
  wf_formula n (FOr \<phi> \<psi>)

goal (1 subgoal):
 1. wf_formula n (FOr \<phi> \<psi>) \<and>
    slow.check_eqvRE enum_class.enum n
     (Plus (rexp_of'' n (norm \<phi>)) One)
     (Plus (rexp_of'' n (norm \<psi>)) One)


proof (prove)
goal (1 subgoal):
 1. P is \<H> \<Longrightarrow> \<^bold>\<bottom> \<sqsubseteq> P


proof (prove)
goal (1 subgoal):
 1. coeffs (Poly ys) = ys


proof (prove)
goal (1 subgoal):
 1. (RETURN
      (find_lasso_tr node_eq_impl node_hash_impl node_def_hash_size G_impl),
     (OP op_find_lasso_spec :::
      igbg_impl_rel_ext Re node_rel \<rightarrow>
      \<langle>fl_rel node_rel\<rangle>nres_rel) $
     G)
    \<in> \<langle>fl_rel node_rel\<rangle>nres_rel


proof (prove)
using this:
  (\<Sum>n\<in>real -` {0<..x}. a n * f (real n)) =
  sum_upto (\<lambda>n. a n * f (real n)) x

goal (1 subgoal):
 1. ((\<lambda>t. A t * f' t) has_integral
     A x * f x - sum_upto (\<lambda>n. a n * f (real n)) x)
     {0..x}


proof (prove)
using this:
  \<not> (order x f = 0 \<or> order x f = 1)

goal (1 subgoal):
 1. (\<And>n.
        order x f = Suc (Suc n) \<Longrightarrow> thesis) \<Longrightarrow>
    thesis


proof (prove)
using this:
  \<Union> (set (A # As)) \<subseteq> carrier
  is_weak_ranking (A # As)
  of_weak_ranking (A # As) = restrict_relation (\<Union> (set (A # As))) le

goal (1 subgoal):
 1. Max_wrt_among (of_weak_ranking (A # As)) (\<Union> (set (A # As))) = A


proof (state)
this:
  nc = Suc ncc

goal (1 subgoal):
 1. \<And>a m1 m2 i nc.
       \<lbrakk>\<And>m2 i nc.
                   \<lbrakk>length m1 = nc \<and> Ball (set m1) (vec nr);
                    length m2 = nc \<and> Ball (set m2) (vec nr); i < nc;
                    length m1 = nc \<and> Ball (set m1) (vec nr);
                    length m2 = nc \<and> Ball (set m2) (vec nr);
                    i < nc\<rbrakk>
                   \<Longrightarrow> vec_plusI pl (m1 ! i) (m2 ! i) ! j =
                                     pl (m1 ! i ! j) (m2 ! i ! j);
        length (a # m1) = nc \<and> Ball (set (a # m1)) (vec nr);
        length m2 = nc \<and> Ball (set m2) (vec nr); i < nc;
        length (a # m1) = nc \<and> Ball (set (a # m1)) (vec nr);
        length m2 = nc \<and> Ball (set m2) (vec nr); i < nc\<rbrakk>
       \<Longrightarrow> vec_plusI pl ((a # m1) ! i) (m2 ! i) ! j =
                         pl ((a # m1) ! i ! j) (m2 ! i ! j)


proof (prove)
goal (1 subgoal):
 1. rel_nondetT (BNF_Def.Grp A f) =
    BNF_Def.Grp {x. set_nondetT x \<subseteq> A} (map_nondetT f)


proof (chain)
picking this:
  x1 = x2
  y1 = y2