[STATEMENT]
lemma establish_convergence_static_properties :
  assumes "observable M1"
      and "observable M2"
      and "minimal M1"
      and "minimal M2"
      and "inputs M2 = inputs M1"
      and "outputs M2 = outputs M1"
      and "t \<in> transitions M1"
      and "t_source t \<in> reachable_states M1"
      and "is_state_cover_assignment M1 V"
      and "V (t_source t) @ [(t_input t, t_output t)] \<in> L M2"
      and "V ` reachable_states M1 \<subseteq> set T"
      and "preserves_divergence M1 M2 (V ` reachable_states M1)"
      and "convergence_graph_lookup_invar M1 M2 cg_lookup G"
      and "convergence_graph_insert_invar M1 M2 cg_lookup cg_insert"
      and "\<And> q1 q2 . q1 \<in> states M1 \<Longrightarrow> q2 \<in> states M1 \<Longrightarrow> q1 \<noteq> q2 \<Longrightarrow> \<exists> io . \<forall> k1 k2 . io \<in> set (dist_fun k1 q1) \<inter> set (dist_fun k2 q2) \<and> distinguishes M1 q1 q2 io"
      and "\<And> q . q \<in> reachable_states M1 \<Longrightarrow> set (dist_fun 0 q) \<subseteq> set (after T (V q))"
      and "\<And> q k . q \<in> states M1 \<Longrightarrow> finite_tree (dist_fun k q)"
      and "L M1 \<inter> set (fst (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t)) = L M2 \<inter> set (fst (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))"
shows "\<forall> \<gamma> x y . length (\<gamma>@[(x,y)]) \<le> m - size_r M1 \<longrightarrow>
                  \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow>
                  x \<in> inputs M1 \<longrightarrow> y \<in> outputs M1 \<longrightarrow>
                  L M1 \<inter> ((V ` reachable_states M1) \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))}) = L M2 \<inter>  ((V ` reachable_states M1) \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))})
                  \<and> preserves_divergence M1 M2 ((V ` reachable_states M1) \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))})"
(is "?P1a")
and   "preserves_divergence M1 M2 ((V ` reachable_states M1) \<union> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))})"
(is "?P1b")
and   "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))"
(is "?P2")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) &&& preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
define \<alpha> where \<alpha>: "\<alpha> = V (t_source t)"
[PROOF STATE]
proof (state)
this:
\<alpha> = V (t_source t)

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
define xy where xy: "xy = (t_input t, t_output t)"
[PROOF STATE]
proof (state)
this:
xy = (t_input t, t_output t)

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
define \<beta> where \<beta>: "\<beta> = V (t_target t)"
[PROOF STATE]
proof (state)
this:
\<beta> = V (t_target t)

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
define qSource where qSource: "qSource = (after_initial M1 (V (t_source t)))"
[PROOF STATE]
proof (state)
this:
qSource = after_initial M1 (V (t_source t))

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
define qTarget where qTarget: "qTarget = (after_initial M1 (V (t_target t)))"
[PROOF STATE]
proof (state)
this:
qTarget = after_initial M1 (V (t_target t))

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
define k where k: "k = m - size_r M1"
[PROOF STATE]
proof (state)
this:
k = m - size_r M1

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
define ttc where ttc : "ttc = [] # traces_to_check M1 qTarget k"
[PROOF STATE]
proof (state)
this:
ttc = [] # traces_to_check M1 qTarget k

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
define handleTrace where handleTrace: "handleTrace = (\<lambda> (T,G) u .
          if is_in_language M1 qTarget u
            then let
                qu = FSM.after M1 qTarget u;
                ws = sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length u)) qu);
                appendDistTrace = (\<lambda> (T,G) w . let
                                                  (T',G') = distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy#u@w) False (append_heuristic_input M1)
                                                in distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (u@w) False (append_heuristic_input M1))
                in foldl appendDistTrace (T,G) ws
            else let
                (T',G') = distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy#u) False (append_heuristic_input M1)
                in distribute_extension M1 T' G' cg_lookup cg_insert \<beta> u False (append_heuristic_input M1))"
[PROOF STATE]
proof (state)
this:
handleTrace = (\<lambda>(T, G) u. if is_in_language M1 qTarget u then let qu = FSM.after M1 qTarget u; ws = sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length u)) qu); appendDistTrace = \<lambda>(T, G) w. let (T', G') = distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy # u @ w) False (append_heuristic_input M1) in distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (u @ w) False (append_heuristic_input M1) in foldl appendDistTrace (T, G) ws else let (T', G') = distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy # u) False (append_heuristic_input M1) in distribute_extension M1 T' G' cg_lookup cg_insert \<beta> u False (append_heuristic_input M1))

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
have result: "establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t = foldl handleTrace (T,G) ttc"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t = foldl handleTrace (T, G) ttc
[PROOF STEP]
unfolding establish_convergence_static.simps \<alpha> xy \<beta> qSource qTarget k ttc handleTrace Let_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl (\<lambda>(T, G) u. if is_in_language M1 (after_initial M1 (V (t_target t))) u then foldl (\<lambda>(T, G) w. case distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) ((t_input t, t_output t) # u @ w) False (append_heuristic_input M1) of (T', G') \<Rightarrow> distribute_extension M1 T' G' cg_lookup cg_insert (V (t_target t)) (u @ w) False (append_heuristic_input M1)) (T, G) (sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length u)) (FSM.after M1 (after_initial M1 (V (t_target t))) u))) else case distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) ((t_input t, t_output t) # u) False (append_heuristic_input M1) of (T', G') \<Rightarrow> distribute_extension M1 T' G' cg_lookup cg_insert (V (t_target t)) u False (append_heuristic_input M1)) (T, G) ([] # traces_to_check M1 (after_initial M1 (V (t_target t))) (m - size_r M1)) = foldl (\<lambda>(T, G) u. if is_in_language M1 (after_initial M1 (V (t_target t))) u then foldl (\<lambda>(T, G) w. case distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) ((t_input t, t_output t) # u @ w) False (append_heuristic_input M1) of (T', G') \<Rightarrow> distribute_extension M1 T' G' cg_lookup cg_insert (V (t_target t)) (u @ w) False (append_heuristic_input M1)) (T, G) (sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length u)) (FSM.after M1 (after_initial M1 (V (t_target t))) u))) else case distribute_extension M1 T G cg_lookup cg_insert (V (t_source t)) ((t_input t, t_output t) # u) False (append_heuristic_input M1) of (T', G') \<Rightarrow> distribute_extension M1 T' G' cg_lookup cg_insert (V (t_target t)) u False (append_heuristic_input M1)) (T, G) ([] # traces_to_check M1 (after_initial M1 (V (t_target t))) (m - size_r M1))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t = foldl handleTrace (T, G) ttc

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t = foldl handleTrace (T, G) ttc
[PROOF STEP]
have result_pass: "L M1 \<inter> set (fst (foldl handleTrace (T,G) ttc)) = L M2 \<inter> set (fst (foldl handleTrace (T,G) ttc))"
[PROOF STATE]
proof (prove)
using this:
establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t = foldl handleTrace (T, G) ttc

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc))
[PROOF STEP]
using assms(18)
[PROOF STATE]
proof (prove)
using this:
establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t = foldl handleTrace (T, G) ttc
L M1 \<inter> Prefix_Tree.set (fst (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t)) = L M2 \<inter> Prefix_Tree.set (fst (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc))

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
have "V (t_source t) \<in> L M1" and "t_source t = qSource"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_source t) \<in> L M1 &&& t_source t = qSource
[PROOF STEP]
using state_cover_assignment_after[OF assms(1,9,8)]
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M1
after_initial M1 (V (t_source t)) = t_source t

goal (1 subgoal):
 1. V (t_source t) \<in> L M1 &&& t_source t = qSource
[PROOF STEP]
unfolding qSource
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M1
after_initial M1 (V (t_source t)) = t_source t

goal (1 subgoal):
 1. V (t_source t) \<in> L M1 &&& t_source t = after_initial M1 (V (t_source t))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
V (t_source t) \<in> L M1
t_source t = qSource

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V (t_source t) \<in> L M1
t_source t = qSource
[PROOF STEP]
have "qSource \<in> states M1"
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M1
t_source t = qSource

goal (1 subgoal):
 1. qSource \<in> FSM.states M1
[PROOF STEP]
unfolding qSource
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M1
t_source t = after_initial M1 (V (t_source t))

goal (1 subgoal):
 1. after_initial M1 (V (t_source t)) \<in> FSM.states M1
[PROOF STEP]
by (simp add: assms(8) reachable_state_is_state)
[PROOF STATE]
proof (state)
this:
qSource \<in> FSM.states M1

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
have "\<alpha> \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<alpha> \<in> L M1
[PROOF STEP]
using \<open>V (t_source t) \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M1

goal (1 subgoal):
 1. \<alpha> \<in> L M1
[PROOF STEP]
unfolding \<alpha>
[PROOF STATE]
proof (prove)
using this:
V (t_source t) \<in> L M1

goal (1 subgoal):
 1. V (t_source t) \<in> L M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> L M1

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
have "\<alpha> \<in> L M2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<alpha> \<in> L M2
[PROOF STEP]
by (metis \<alpha> assms(10) language_prefix)
[PROOF STATE]
proof (state)
this:
\<alpha> \<in> L M2

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
have "qTarget \<in> reachable_states M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. qTarget \<in> reachable_states M1
[PROOF STEP]
using reachable_states_next[OF assms(8,7)]
[PROOF STATE]
proof (prove)
using this:
t_source t = t_source t \<Longrightarrow> t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. qTarget \<in> reachable_states M1
[PROOF STEP]
unfolding qTarget
[PROOF STATE]
proof (prove)
using this:
t_source t = t_source t \<Longrightarrow> t_target t \<in> reachable_states M1

goal (1 subgoal):
 1. after_initial M1 (V (t_target t)) \<in> reachable_states M1
[PROOF STEP]
by (metis assms(1) assms(9) is_state_cover_assignment_observable_after)
[PROOF STATE]
proof (state)
this:
qTarget \<in> reachable_states M1

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
qTarget \<in> reachable_states M1
[PROOF STEP]
have "qTarget \<in> states M1"
[PROOF STATE]
proof (prove)
using this:
qTarget \<in> reachable_states M1

goal (1 subgoal):
 1. qTarget \<in> FSM.states M1
[PROOF STEP]
using reachable_state_is_state
[PROOF STATE]
proof (prove)
using this:
qTarget \<in> reachable_states M1
?q \<in> reachable_states ?M \<Longrightarrow> ?q \<in> FSM.states ?M

goal (1 subgoal):
 1. qTarget \<in> FSM.states M1
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
qTarget \<in> FSM.states M1

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
have "V (t_target t) \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_target t) \<in> L M1
[PROOF STEP]
by (meson assms(7) assms(8) assms(9) is_state_cover_assignment_language reachable_states_next)
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> L M1

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V (t_target t) \<in> L M1
[PROOF STEP]
have "\<beta> \<in> L M1"
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M1

goal (1 subgoal):
 1. \<beta> \<in> L M1
[PROOF STEP]
unfolding \<beta>
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> L M1

goal (1 subgoal):
 1. V (t_target t) \<in> L M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<beta> \<in> L M1

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
have "t_target t = qTarget"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. t_target t = qTarget
[PROOF STEP]
by (metis assms(1) assms(7) assms(8) assms(9) is_state_cover_assignment_observable_after qTarget reachable_states_next)
[PROOF STATE]
proof (state)
this:
t_target t = qTarget

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
have "converge M1 (\<alpha>@[xy]) \<beta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 (\<alpha> @ [xy]) \<beta>
[PROOF STEP]
using state_cover_transition_converges[OF assms(1,9,7,8)]
[PROOF STATE]
proof (prove)
using this:
converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. converge M1 (\<alpha> @ [xy]) \<beta>
[PROOF STEP]
unfolding \<alpha> xy \<beta>
[PROOF STATE]
proof (prove)
using this:
converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
converge M1 (\<alpha> @ [xy]) \<beta>

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 (\<alpha> @ [xy]) \<beta>
[PROOF STEP]
have "\<alpha>@[xy] \<in> L M1"
[PROOF STATE]
proof (prove)
using this:
converge M1 (\<alpha> @ [xy]) \<beta>

goal (1 subgoal):
 1. \<alpha> @ [xy] \<in> L M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<alpha> @ [xy] \<in> L M1

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
have "L M1 \<inter> set T = L M2 \<inter> set T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
[PROOF STEP]
using assms(18) establish_convergence_static_subset[of T dist_fun M1 V G cg_insert cg_lookup m t]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t)) = L M2 \<inter> Prefix_Tree.set (fst (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
Prefix_Tree.set T \<subseteq> Prefix_Tree.set (fst (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
[PROOF STEP]
have "\<beta> \<in> L M2"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T

goal (1 subgoal):
 1. \<beta> \<in> L M2
[PROOF STEP]
using reachable_states_next[OF assms(8,7)] assms(11) \<open>\<beta> \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
t_source t = t_source t \<Longrightarrow> t_target t \<in> reachable_states M1
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
\<beta> \<in> L M1

goal (1 subgoal):
 1. \<beta> \<in> L M2
[PROOF STEP]
unfolding \<beta> qTarget
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T
t_source t = t_source t \<Longrightarrow> t_target t \<in> reachable_states M1
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
V (t_target t) \<in> L M1

goal (1 subgoal):
 1. V (t_target t) \<in> L M2
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<beta> \<in> L M2

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
have "(\<forall> u w . u \<in> list.set ttc \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w})
        \<and> (\<forall> u w . u \<in> list.set ttc \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha>@[xy]@u,\<beta>@u} = L M2 \<inter> {\<alpha>@[xy]@u,\<beta>@u})
        \<and> (convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T,G) ttc)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))
[PROOF STEP]
using result_pass
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc))

goal (1 subgoal):
 1. (\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))
[PROOF STEP]
proof (induction ttc rule: rev_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) [])) \<Longrightarrow> (\<forall>u w. u \<in> list.set [] \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set [] \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) []))
 2. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) \<Longrightarrow> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (xs @ [x])))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) []))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) [])) \<Longrightarrow> (\<forall>u w. u \<in> list.set [] \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set [] \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) []))
 2. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) \<Longrightarrow> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) []))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) []))

goal (1 subgoal):
 1. (\<forall>u w. u \<in> list.set [] \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set [] \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) []))
[PROOF STEP]
using assms(13)
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) []))
convergence_graph_lookup_invar M1 M2 cg_lookup G

goal (1 subgoal):
 1. (\<forall>u w. u \<in> list.set [] \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set [] \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) []))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<forall>u w. u \<in> list.set [] \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set [] \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) []))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) \<Longrightarrow> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (xs @ [x])))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) \<Longrightarrow> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (xs @ [x])))
[PROOF STEP]
case (snoc a ttc)
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) \<Longrightarrow> (\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) \<Longrightarrow> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (xs @ [x])))
[PROOF STEP]
have *:"foldl handleTrace (T, G) (ttc@[a]) = handleTrace (foldl handleTrace (T,G) ttc) a"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl handleTrace (T, G) (ttc @ [a]) = handleTrace (foldl handleTrace (T, G) ttc) a
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
foldl handleTrace (T, G) (ttc @ [a]) = handleTrace (foldl handleTrace (T, G) ttc) a

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) \<Longrightarrow> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (xs @ [x])))
[PROOF STEP]
have "L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc))
[PROOF STEP]
using snoc.prems handleTrace_subset_helper[of handleTrace M1 qTarget dist_fun cg_lookup cg_insert, OF handleTrace]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (handleTrace (?T, ?G) ?u))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc))
[PROOF STEP]
unfolding *
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (handleTrace (foldl handleTrace (T, G) ttc) a)) = L M2 \<inter> Prefix_Tree.set (fst (handleTrace (foldl handleTrace (T, G) ttc) a))
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (handleTrace (?T, ?G) ?u))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc))
[PROOF STEP]
by (metis (no_types, opaque_lifting) fst_conv inter_eq_subsetI old.prod.exhaust)
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) \<Longrightarrow> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc))
[PROOF STEP]
have IH1: "\<And> u w. u \<in> list.set ttc \<Longrightarrow> u \<in> LS M1 qTarget \<Longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}"
          and IH2: "\<And>u w. u \<in> list.set ttc \<Longrightarrow> u \<notin> LS M1 qTarget \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}"
          and IH3: "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc))

goal (1 subgoal):
 1. (\<And>u w. \<lbrakk>u \<in> list.set ttc; u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) &&& (\<And>u w. \<lbrakk>u \<in> list.set ttc; u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))
[PROOF STEP]
using snoc.IH
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc))
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) \<Longrightarrow> (\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))

goal (1 subgoal):
 1. (\<And>u w. \<lbrakk>u \<in> list.set ttc; u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) &&& (\<And>u w. \<lbrakk>u \<in> list.set ttc; u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))
[PROOF STEP]
by presburger+
[PROOF STATE]
proof (state)
this:
\<lbrakk>?u \<in> list.set ttc; ?u \<in> LS M1 qTarget; ?w \<in> Prefix_Tree.set (dist_fun (Suc (length ?u)) (FSM.after M1 qTarget ?u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u @ ?w, \<beta> @ ?u @ ?w} = L M2 \<inter> {\<alpha> @ [xy] @ ?u @ ?w, \<beta> @ ?u @ ?w}
\<lbrakk>?u \<in> list.set ttc; ?u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u, \<beta> @ ?u} = L M2 \<inter> {\<alpha> @ [xy] @ ?u, \<beta> @ ?u}
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) xs)) \<Longrightarrow> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set xs \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (xs @ [x]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (xs @ [x])))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
proof (cases "is_in_language M1 qTarget a")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
is_in_language M1 qTarget a

goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
define qa where qa: "qa = FSM.after M1 qTarget a"
[PROOF STATE]
proof (state)
this:
qa = FSM.after M1 qTarget a

goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
define ws where ws: "ws = sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length a)) qa)"
[PROOF STATE]
proof (state)
this:
ws = sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length a)) qa)

goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
define appendDistTrace where appendDistTrace: "appendDistTrace = (\<lambda> (T,G) w . let
                                                (T',G') = distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy#a@w) False (append_heuristic_input M1)
                                                in distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a@w) False (append_heuristic_input M1))"
[PROOF STATE]
proof (state)
this:
appendDistTrace = (\<lambda>(T, G) w. let (T', G') = distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy # a @ w) False (append_heuristic_input M1) in distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ w) False (append_heuristic_input M1))

goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
have **: "\<And> TG . handleTrace TG a = foldl appendDistTrace TG ws"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>TG. handleTrace TG a = foldl appendDistTrace TG ws
[PROOF STEP]
using \<open>is_in_language M1 qTarget a\<close>
[PROOF STATE]
proof (prove)
using this:
is_in_language M1 qTarget a

goal (1 subgoal):
 1. \<And>TG. handleTrace TG a = foldl appendDistTrace TG ws
[PROOF STEP]
unfolding qa ws appendDistTrace Let_def case_prod_conv assms True handleTrace
[PROOF STATE]
proof (prove)
using this:
is_in_language M1 qTarget a

goal (1 subgoal):
 1. \<And>TG. (case TG of (T, G) \<Rightarrow> \<lambda>u. if is_in_language M1 qTarget u then foldl (\<lambda>(T, G) w. case distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy # u @ w) False (append_heuristic_input M1) of (T', G') \<Rightarrow> distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (u @ w) False (append_heuristic_input M1)) (T, G) (sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))) else case distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy # u) False (append_heuristic_input M1) of (T', G') \<Rightarrow> distribute_extension M1 T' G' cg_lookup cg_insert \<beta> u False (append_heuristic_input M1)) a = foldl (\<lambda>(T, G) w. case distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy # a @ w) False (append_heuristic_input M1) of (T', G') \<Rightarrow> distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ w) False (append_heuristic_input M1)) TG (sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length a)) (FSM.after M1 qTarget a)))
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
handleTrace ?TG1 a = foldl appendDistTrace ?TG1 ws

goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
have "foldl handleTrace (T, G) (ttc@[a]) = foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl handleTrace (T, G) (ttc @ [a]) = foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws
[PROOF STEP]
unfolding *
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. handleTrace (foldl handleTrace (T, G) ttc) a = foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws
[PROOF STEP]
unfolding True
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. handleTrace (foldl handleTrace (T, G) ttc) a = foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws
[PROOF STEP]
unfolding **
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws = foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
foldl handleTrace (T, G) (ttc @ [a]) = foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws

goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
foldl handleTrace (T, G) (ttc @ [a]) = foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws
[PROOF STEP]
have "L M1 \<inter> set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) = L M2 \<inter> set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))"
[PROOF STATE]
proof (prove)
using this:
foldl handleTrace (T, G) (ttc @ [a]) = foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
[PROOF STEP]
using snoc.prems
[PROOF STATE]
proof (prove)
using this:
foldl handleTrace (T, G) (ttc @ [a]) = foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))

goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
[PROOF STEP]
have handleTrace_props: "(\<forall> w . w \<in> list.set ws \<longrightarrow> ((\<exists> \<alpha>' . converge M1 \<alpha> \<alpha>' \<and> (\<alpha>'@[xy]@a@w) \<in> set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<alpha> \<alpha>')
                                        \<and> (\<exists> \<beta>' . converge M1 \<beta> \<beta>' \<and> (\<beta>'@a@w) \<in> set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<beta> \<beta>')))
            \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))

goal (1 subgoal):
 1. (\<forall>w. w \<in> list.set ws \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
[PROOF STEP]
proof (induction ws rule: rev_induct)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) \<Longrightarrow> (\<forall>w. w \<in> list.set [] \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) []))
 2. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) []))

goal (2 subgoals):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) \<Longrightarrow> (\<forall>w. w \<in> list.set [] \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) []))
 2. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) []))
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) []))

goal (1 subgoal):
 1. (\<forall>w. w \<in> list.set [] \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) []))
[PROOF STEP]
using IH3
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) []))
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))

goal (1 subgoal):
 1. (\<forall>w. w \<in> list.set [] \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) []))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(\<forall>w. w \<in> list.set [] \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) [])) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) []))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
case (snoc v ws)
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<Longrightarrow> (\<forall>w. w \<in> list.set ws \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
have *:"foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws@[v]) = appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]) = appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]) = appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
define Tws where Tws: "Tws = fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)"
[PROOF STATE]
proof (state)
this:
Tws = fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
define Gws where Gws: "Gws = snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)"
[PROOF STATE]
proof (state)
this:
Gws = snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
have "(foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) = (Tws,Gws)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws = (Tws, Gws)
[PROOF STEP]
unfolding Tws Gws
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws = (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws), snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws = (Tws, Gws)

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
obtain T' G' where "distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy#a@v) False (append_heuristic_input M1) = (T',G')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>T' G'. distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1) = (T', G') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.exhaust
[PROOF STATE]
proof (prove)
using this:
(\<And>x1 x2. ?y = (x1, x2) \<Longrightarrow> ?P) \<Longrightarrow> ?P

goal (1 subgoal):
 1. (\<And>T' G'. distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1) = (T', G') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1) = (T', G')

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
have **: "appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v
                = distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a@v) False (append_heuristic_input M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v = distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)
[PROOF STEP]
using \<open>distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1) = (T', G')\<close> \<open>foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws = (Tws, Gws)\<close> appendDistTrace
[PROOF STATE]
proof (prove)
using this:
distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1) = (T', G')
foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws = (Tws, Gws)
appendDistTrace = (\<lambda>(T, G) w. let (T', G') = distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy # a @ w) False (append_heuristic_input M1) in distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ w) False (append_heuristic_input M1))

goal (1 subgoal):
 1. appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v = distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v = distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
have pass_outer : "L M1 \<inter> set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a@v) False (append_heuristic_input M1)))
                            = L M2 \<inter> set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a@v) False (append_heuristic_input M1)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
using snoc.prems
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v])))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
unfolding * **
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
have "set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy#a@v) False (append_heuristic_input M1))) \<subseteq> set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a@v) False (append_heuristic_input M1)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
using distribute_extension_subset[of T' M1 G' cg_lookup cg_insert \<beta> "(a@v)" False "(append_heuristic_input M1)"]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T' \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
using \<open>distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy#a@v) False (append_heuristic_input M1) = (T',G')\<close>
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T' \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))
distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1) = (T', G')

goal (1 subgoal):
 1. Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
by (metis fst_conv)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))
Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
have pass_inner: "L M1 \<inter> set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy#a@v) False (append_heuristic_input M1)))
                            = L M2 \<inter> set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy#a@v) False (append_heuristic_input M1)))"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))
Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
have pass_ws: "L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) =
                              L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
[PROOF STEP]
using distribute_extension_subset[of Tws M1 Gws cg_lookup cg_insert]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))
Prefix_Tree.set Tws \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert ?u ?w ?b ?heuristic))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
[PROOF STEP]
unfolding Tws Gws
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))
Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) cg_lookup cg_insert ?u ?w ?b ?heuristic))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
have "set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<subseteq> set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws@[v])))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<subseteq> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v])))
[PROOF STEP]
using appendDistTrace_subset_helper[OF appendDistTrace]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set ?T \<subseteq> Prefix_Tree.set (fst (appendDistTrace (?T, ?G) ?w))

goal (1 subgoal):
 1. Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<subseteq> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v])))
[PROOF STEP]
by (metis "*" Tws \<open>foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws = (Tws, Gws)\<close>)
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<subseteq> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v])))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
[PROOF STEP]
using snoc.IH[OF pass_ws ]
[PROOF STATE]
proof (prove)
using this:
(\<forall>w. w \<in> list.set ws \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy#a@v) False (append_heuristic_input M1)))"
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
using distribute_extension_adds_sequence(2)[OF assms(1,3) \<open>\<alpha> \<in> L M1\<close> \<open>\<alpha> \<in> L M2\<close> _ assms(14) pass_inner append_heuristic_input_in]
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
convergence_graph_lookup_invar M1 M2 cg_lookup Gws \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
unfolding Gws
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tws (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tws (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v))"
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v))
[PROOF STEP]
unfolding ** \<open>distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy#a@v) False (append_heuristic_input M1) = (T',G')\<close> snd_conv
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G'

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
using distribute_extension_adds_sequence(2)[OF assms(1,3) \<open>\<beta> \<in> L M1\<close> \<open>\<beta> \<in> L M2\<close> _ assms(14) pass_outer append_heuristic_input_in]
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G'
convergence_graph_lookup_invar M1 M2 cg_lookup G' \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v))

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
have "\<And> w . w \<in> list.set (ws@[v]) \<Longrightarrow> ((\<exists> \<alpha>' . converge M1 \<alpha> \<alpha>' \<and> (\<alpha>'@[xy]@a@w) \<in> set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws@[v]))) \<and> converge M2 \<alpha> \<alpha>')
                                        \<and> (\<exists> \<beta>' . converge M1 \<beta> \<beta>' \<and> (\<beta>'@a@w) \<in> set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws@[v]))) \<and> converge M2 \<beta> \<beta>'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>w. w \<in> list.set (ws @ [v]) \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>w. w \<in> list.set (ws @ [v]) \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
fix w
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>w. w \<in> list.set (ws @ [v]) \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
assume "w \<in> list.set (ws@[v])"
[PROOF STATE]
proof (state)
this:
w \<in> list.set (ws @ [v])

goal (1 subgoal):
 1. \<And>w. w \<in> list.set (ws @ [v]) \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w \<in> list.set (ws @ [v])
[PROOF STEP]
consider "w \<in> list.set ws" | "v = w"
[PROOF STATE]
proof (prove)
using this:
w \<in> list.set (ws @ [v])

goal (1 subgoal):
 1. \<lbrakk>w \<in> list.set ws \<Longrightarrow> thesis; v = w \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>w \<in> list.set ws \<Longrightarrow> ?thesis1; v = w \<Longrightarrow> ?thesis1\<rbrakk> \<Longrightarrow> ?thesis1

goal (1 subgoal):
 1. \<And>w. w \<in> list.set (ws @ [v]) \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>w \<in> list.set ws \<Longrightarrow> ?thesis1; v = w \<Longrightarrow> ?thesis1\<rbrakk> \<Longrightarrow> ?thesis1
[PROOF STEP]
show "((\<exists> \<alpha>' . converge M1 \<alpha> \<alpha>' \<and> (\<alpha>'@[xy]@a@w) \<in> set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws@[v]))) \<and> converge M2 \<alpha> \<alpha>')
                                        \<and> (\<exists> \<beta>' . converge M1 \<beta> \<beta>' \<and> (\<beta>'@a@w) \<in> set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws@[v]))) \<and> converge M2 \<beta> \<beta>'))"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>w \<in> list.set ws \<Longrightarrow> ?thesis1; v = w \<Longrightarrow> ?thesis1\<rbrakk> \<Longrightarrow> ?thesis1

goal (1 subgoal):
 1. (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. w \<in> list.set ws \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
 2. v = w \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
w \<in> list.set ws

goal (2 subgoals):
 1. w \<in> list.set ws \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
 2. v = w \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w \<in> list.set ws
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
w \<in> list.set ws

goal (1 subgoal):
 1. (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
using snoc.IH[OF pass_ws]
[PROOF STATE]
proof (prove)
using this:
w \<in> list.set ws
(\<forall>w. w \<in> list.set ws \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))

goal (1 subgoal):
 1. (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
using \<open>set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<subseteq> set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws@[v])))\<close>
[PROOF STATE]
proof (prove)
using this:
w \<in> list.set ws
(\<forall>w. w \<in> list.set ws \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<subseteq> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v])))

goal (1 subgoal):
 1. (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')

goal (1 subgoal):
 1. v = w \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. v = w \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
v = w

goal (1 subgoal):
 1. v = w \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
have "\<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ w \<in> set T' \<and> converge M2 \<alpha> u'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ w \<in> Prefix_Tree.set T' \<and> converge M2 \<alpha> u'
[PROOF STEP]
using distribute_extension_adds_sequence(1)[OF assms(1,3) \<open>\<alpha> \<in> L M1\<close> \<open>\<alpha> \<in> L M2\<close> _ assms(14) pass_inner append_heuristic_input_in]
                    \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))\<close>
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup Gws \<Longrightarrow> \<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ v \<in> Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) \<and> converge M2 \<alpha> u'
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))

goal (1 subgoal):
 1. \<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ w \<in> Prefix_Tree.set T' \<and> converge M2 \<alpha> u'
[PROOF STEP]
unfolding Gws[symmetric]
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup Gws \<Longrightarrow> \<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ v \<in> Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) \<and> converge M2 \<alpha> u'
convergence_graph_lookup_invar M1 M2 cg_lookup Gws

goal (1 subgoal):
 1. \<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ w \<in> Prefix_Tree.set T' \<and> converge M2 \<alpha> u'
[PROOF STEP]
unfolding \<open>distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy#a@v) False (append_heuristic_input M1) = (T',G')\<close>
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup Gws \<Longrightarrow> \<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ v \<in> Prefix_Tree.set (fst (T', G')) \<and> converge M2 \<alpha> u'
convergence_graph_lookup_invar M1 M2 cg_lookup Gws

goal (1 subgoal):
 1. \<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ w \<in> Prefix_Tree.set T' \<and> converge M2 \<alpha> u'
[PROOF STEP]
unfolding 2 fst_conv
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup Gws \<Longrightarrow> \<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ w \<in> Prefix_Tree.set T' \<and> converge M2 \<alpha> u'
convergence_graph_lookup_invar M1 M2 cg_lookup Gws

goal (1 subgoal):
 1. \<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ w \<in> Prefix_Tree.set T' \<and> converge M2 \<alpha> u'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ w \<in> Prefix_Tree.set T' \<and> converge M2 \<alpha> u'

goal (1 subgoal):
 1. v = w \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ w \<in> Prefix_Tree.set T' \<and> converge M2 \<alpha> u'
[PROOF STEP]
have "(\<exists> \<alpha>' . converge M1 \<alpha> \<alpha>' \<and> (\<alpha>'@[xy]@a@w) \<in> set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws@[v]))) \<and> converge M2 \<alpha> \<alpha>')"
[PROOF STATE]
proof (prove)
using this:
\<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ w \<in> Prefix_Tree.set T' \<and> converge M2 \<alpha> u'

goal (1 subgoal):
 1. \<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>'
[PROOF STEP]
using "**" \<open>Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))\<close> \<open>distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1) = (T', G')\<close>
[PROOF STATE]
proof (prove)
using this:
\<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a @ w \<in> Prefix_Tree.set T' \<and> converge M2 \<alpha> u'
appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v = distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)
Prefix_Tree.set (fst (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1)))
distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1) = (T', G')

goal (1 subgoal):
 1. \<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>'

goal (1 subgoal):
 1. v = w \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>'

goal (1 subgoal):
 1. v = w \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
have "(\<exists> \<beta>' . converge M1 \<beta> \<beta>' \<and> (\<beta>'@a@w) \<in> set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws@[v]))) \<and> converge M2 \<beta> \<beta>')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>'
[PROOF STEP]
using distribute_extension_adds_sequence(1)[OF assms(1,3) \<open>\<beta> \<in> L M1\<close> \<open>\<beta> \<in> L M2\<close> _ assms(14) pass_outer append_heuristic_input_in]
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G' \<Longrightarrow> \<exists>u'. converge M1 \<beta> u' \<and> u' @ a @ v \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1))) \<and> converge M2 \<beta> u'

goal (1 subgoal):
 1. \<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>'
[PROOF STEP]
using \<open>convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy#a@v) False (append_heuristic_input M1)))\<close>
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G' \<Longrightarrow> \<exists>u'. converge M1 \<beta> u' \<and> u' @ a @ v \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1))) \<and> converge M2 \<beta> u'
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy # a @ v) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. \<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>'
[PROOF STEP]
unfolding \<open>distribute_extension M1 Tws Gws cg_lookup cg_insert \<alpha> (xy#a@v) False (append_heuristic_input M1) = (T',G')\<close> snd_conv
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G' \<Longrightarrow> \<exists>u'. converge M1 \<beta> u' \<and> u' @ a @ v \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1))) \<and> converge M2 \<beta> u'
convergence_graph_lookup_invar M1 M2 cg_lookup G'

goal (1 subgoal):
 1. \<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>'
[PROOF STEP]
unfolding * **
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G' \<Longrightarrow> \<exists>u'. converge M1 \<beta> u' \<and> u' @ a @ v \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1))) \<and> converge M2 \<beta> u'
convergence_graph_lookup_invar M1 M2 cg_lookup G'

goal (1 subgoal):
 1. \<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ v) False (append_heuristic_input M1))) \<and> converge M2 \<beta> \<beta>'
[PROOF STEP]
unfolding 2
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G' \<Longrightarrow> \<exists>u'. converge M1 \<beta> u' \<and> u' @ a @ w \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ w) False (append_heuristic_input M1))) \<and> converge M2 \<beta> u'
convergence_graph_lookup_invar M1 M2 cg_lookup G'

goal (1 subgoal):
 1. \<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ w) False (append_heuristic_input M1))) \<and> converge M2 \<beta> \<beta>'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>'

goal (1 subgoal):
 1. v = w \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>'
\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>'
\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>'

goal (1 subgoal):
 1. (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?w1 \<in> list.set (ws @ [v]) \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ ?w1 \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ ?w1 \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')

goal (1 subgoal):
 1. \<And>x xs. \<lbrakk>L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<Longrightarrow> (\<forall>w. w \<in> list.set xs \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) xs)); L M1 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))\<rbrakk> \<Longrightarrow> (\<forall>w. w \<in> list.set (xs @ [x]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (xs @ [x])))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v))
?w1 \<in> list.set (ws @ [v]) \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ ?w1 \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ ?w1 \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (appendDistTrace (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws) v))
?w1 \<in> list.set (ws @ [v]) \<Longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ ?w1 \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ ?w1 \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')

goal (1 subgoal):
 1. (\<forall>w. w \<in> list.set (ws @ [v]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v])))
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
(\<forall>w. w \<in> list.set (ws @ [v]) \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) (ws @ [v])))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<forall>w. w \<in> list.set ws \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))

goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
have "\<And> u w. u \<in> list.set (ttc@[a]) \<Longrightarrow> u \<in> LS M1 qTarget \<Longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
fix u w
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
assume "u \<in> list.set (ttc@[a])" and a1:"u \<in> LS M1 qTarget" and a2:"w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))"
[PROOF STATE]
proof (state)
this:
u \<in> list.set (ttc @ [a])
u \<in> LS M1 qTarget
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))

goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> list.set (ttc @ [a])
u \<in> LS M1 qTarget
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))
[PROOF STEP]
consider "u \<in> list.set ttc" | "a = u"
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set (ttc @ [a])
u \<in> LS M1 qTarget
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))

goal (1 subgoal):
 1. \<lbrakk>u \<in> list.set ttc \<Longrightarrow> thesis; a = u \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>u \<in> list.set ttc \<Longrightarrow> ?thesis1; a = u \<Longrightarrow> ?thesis1\<rbrakk> \<Longrightarrow> ?thesis1

goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>u \<in> list.set ttc \<Longrightarrow> ?thesis1; a = u \<Longrightarrow> ?thesis1\<rbrakk> \<Longrightarrow> ?thesis1
[PROOF STEP]
show "L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>u \<in> list.set ttc \<Longrightarrow> ?thesis1; a = u \<Longrightarrow> ?thesis1\<rbrakk> \<Longrightarrow> ?thesis1

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. u \<in> list.set ttc \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
 2. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
u \<in> list.set ttc

goal (2 subgoals):
 1. u \<in> list.set ttc \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
 2. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> list.set ttc
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set ttc

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
using IH1[OF _ a1 a2]
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set ttc
u \<in> list.set ttc \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
a = u

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
obtain w' where "w@w' \<in> list.set ws"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>w'. w @ w' \<in> list.set ws \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (\<And>w'. w @ w' \<in> list.set ws \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
have "qa \<in> reachable_states M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. qa \<in> reachable_states M1
[PROOF STEP]
using \<open>qTarget \<in> reachable_states M1\<close> \<open>u \<in> LS M1 qTarget\<close>
[PROOF STATE]
proof (prove)
using this:
qTarget \<in> reachable_states M1
u \<in> LS M1 qTarget

goal (1 subgoal):
 1. qa \<in> reachable_states M1
[PROOF STEP]
by (metis "2" after_reachable assms(1) qa)
[PROOF STATE]
proof (state)
this:
qa \<in> reachable_states M1

goal (1 subgoal):
 1. (\<And>w'. w @ w' \<in> list.set ws \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
qa \<in> reachable_states M1
[PROOF STEP]
have "finite_tree (dist_fun (Suc (length u)) qa)"
[PROOF STATE]
proof (prove)
using this:
qa \<in> reachable_states M1

goal (1 subgoal):
 1. finite_tree (dist_fun (Suc (length u)) qa)
[PROOF STEP]
using \<open>\<And> q k . q \<in> states M1 \<Longrightarrow> finite_tree (dist_fun k q)\<close> reachable_state_is_state[of qa M1]
[PROOF STATE]
proof (prove)
using this:
qa \<in> reachable_states M1
?q \<in> FSM.states M1 \<Longrightarrow> finite_tree (dist_fun ?k ?q)
qa \<in> reachable_states M1 \<Longrightarrow> qa \<in> FSM.states M1

goal (1 subgoal):
 1. finite_tree (dist_fun (Suc (length u)) qa)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
finite_tree (dist_fun (Suc (length u)) qa)

goal (1 subgoal):
 1. (\<And>w'. w @ w' \<in> list.set ws \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
finite_tree (dist_fun (Suc (length u)) qa)

goal (1 subgoal):
 1. (\<And>w'. w @ w' \<in> list.set ws \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
have "w \<in> set (dist_fun (Suc (length u)) qa)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) qa)
[PROOF STEP]
using \<open>w \<in> set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<close>
[PROOF STATE]
proof (prove)
using this:
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))

goal (1 subgoal):
 1. w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) qa)
[PROOF STEP]
unfolding qa 2
[PROOF STATE]
proof (prove)
using this:
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))

goal (1 subgoal):
 1. w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) qa)

goal (1 subgoal):
 1. (\<And>w'. w @ w' \<in> list.set ws \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
finite_tree (dist_fun (Suc (length u)) qa)
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) qa)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
finite_tree (dist_fun (Suc (length u)) qa)
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) qa)

goal (1 subgoal):
 1. thesis
[PROOF STEP]
using sorted_list_of_maximal_sequences_in_tree_ob[of "dist_fun (Suc (length u)) qa" w]
[PROOF STATE]
proof (prove)
using this:
finite_tree (dist_fun (Suc (length u)) qa)
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) qa)
\<lbrakk>finite_tree (dist_fun (Suc (length u)) qa); w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) qa); \<And>xs'. w @ xs' \<in> list.set (sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length u)) qa)) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. thesis
[PROOF STEP]
using that
[PROOF STATE]
proof (prove)
using this:
finite_tree (dist_fun (Suc (length u)) qa)
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) qa)
\<lbrakk>finite_tree (dist_fun (Suc (length u)) qa); w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) qa); \<And>xs'. w @ xs' \<in> list.set (sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length u)) qa)) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
w @ ?w'1 \<in> list.set ws \<Longrightarrow> thesis

goal (1 subgoal):
 1. thesis
[PROOF STEP]
unfolding ws 2
[PROOF STATE]
proof (prove)
using this:
finite_tree (dist_fun (Suc (length u)) qa)
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) qa)
\<lbrakk>finite_tree (dist_fun (Suc (length u)) qa); w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) qa); \<And>xs'. w @ xs' \<in> list.set (sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length u)) qa)) \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis
w @ ?w'1 \<in> list.set (sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length u)) qa)) \<Longrightarrow> thesis

goal (1 subgoal):
 1. thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
thesis

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
w @ w' \<in> list.set ws

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w @ w' \<in> list.set ws
[PROOF STEP]
obtain \<alpha>' \<beta>' where "converge M1 \<alpha> \<alpha>'" and "\<alpha>' @ [xy] @ a @ w@w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc@[a])))" and "converge M2 \<alpha> \<alpha>'"
                               and "converge M1 \<beta> \<beta>'" and "\<beta>' @ a @ w@w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc@[a])))" and "converge M2 \<beta> \<beta>'"
[PROOF STATE]
proof (prove)
using this:
w @ w' \<in> list.set ws

goal (1 subgoal):
 1. (\<And>\<alpha>' \<beta>'. \<lbrakk>converge M1 \<alpha> \<alpha>'; \<alpha>' @ [xy] @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))); converge M2 \<alpha> \<alpha>'; converge M1 \<beta> \<beta>'; \<beta>' @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))); converge M2 \<beta> \<beta>'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using handleTrace_props
[PROOF STATE]
proof (prove)
using this:
w @ w' \<in> list.set ws
(\<forall>w. w \<in> list.set ws \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))

goal (1 subgoal):
 1. (\<And>\<alpha>' \<beta>'. \<lbrakk>converge M1 \<alpha> \<alpha>'; \<alpha>' @ [xy] @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))); converge M2 \<alpha> \<alpha>'; converge M1 \<beta> \<beta>'; \<beta>' @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))); converge M2 \<beta> \<beta>'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding **[symmetric] *[symmetric]
[PROOF STATE]
proof (prove)
using this:
w @ w' \<in> list.set ws
(\<forall>w. w \<in> list.set ws \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. (\<And>\<alpha>' \<beta>'. \<lbrakk>converge M1 \<alpha> \<alpha>'; \<alpha>' @ [xy] @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))); converge M2 \<alpha> \<alpha>'; converge M1 \<beta> \<beta>'; \<beta>' @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))); converge M2 \<beta> \<beta>'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
converge M1 \<alpha> \<alpha>'
\<alpha>' @ [xy] @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
converge M2 \<alpha> \<alpha>'
converge M1 \<beta> \<beta>'
\<beta>' @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
converge M2 \<beta> \<beta>'

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
converge M1 \<alpha> \<alpha>'
\<alpha>' @ [xy] @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
converge M2 \<alpha> \<alpha>'
converge M1 \<beta> \<beta>'
\<beta>' @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
converge M2 \<beta> \<beta>'
[PROOF STEP]
have "\<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc@[u])))"
                and "\<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc@[u])))"
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> \<alpha>'
\<alpha>' @ [xy] @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
converge M2 \<alpha> \<alpha>'
converge M1 \<beta> \<beta>'
\<beta>' @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
converge M2 \<beta> \<beta>'

goal (1 subgoal):
 1. \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u]))) &&& \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))
[PROOF STEP]
using set_prefix[of "\<alpha>' @ [xy] @ a @ w" w']
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> \<alpha>'
\<alpha>' @ [xy] @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
converge M2 \<alpha> \<alpha>'
converge M1 \<beta> \<beta>'
\<beta>' @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
converge M2 \<beta> \<beta>'
(\<alpha>' @ [xy] @ a @ w) @ w' \<in> Prefix_Tree.set ?T \<Longrightarrow> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set ?T

goal (1 subgoal):
 1. \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u]))) &&& \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))
[PROOF STEP]
using set_prefix[of "\<beta>' @ a @ w" w']
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> \<alpha>'
\<alpha>' @ [xy] @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
converge M2 \<alpha> \<alpha>'
converge M1 \<beta> \<beta>'
\<beta>' @ a @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
converge M2 \<beta> \<beta>'
(\<alpha>' @ [xy] @ a @ w) @ w' \<in> Prefix_Tree.set ?T \<Longrightarrow> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set ?T
(\<beta>' @ a @ w) @ w' \<in> Prefix_Tree.set ?T \<Longrightarrow> \<beta>' @ a @ w \<in> Prefix_Tree.set ?T

goal (1 subgoal):
 1. \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u]))) &&& \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))
[PROOF STEP]
unfolding 2
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> \<alpha>'
\<alpha>' @ [xy] @ u @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))
converge M2 \<alpha> \<alpha>'
converge M1 \<beta> \<beta>'
\<beta>' @ u @ w @ w' \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))
converge M2 \<beta> \<beta>'
(\<alpha>' @ [xy] @ u @ w) @ w' \<in> Prefix_Tree.set ?T \<Longrightarrow> \<alpha>' @ [xy] @ u @ w \<in> Prefix_Tree.set ?T
(\<beta>' @ u @ w) @ w' \<in> Prefix_Tree.set ?T \<Longrightarrow> \<beta>' @ u @ w \<in> Prefix_Tree.set ?T

goal (1 subgoal):
 1. \<alpha>' @ [xy] @ u @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u]))) &&& \<beta>' @ u @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))
\<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
have "\<alpha> @ [xy] @ u @ w \<in> L M1 = (\<alpha>' @ [xy] @ u @ w \<in> L M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<alpha> @ [xy] @ u @ w \<in> L M1) = (\<alpha>' @ [xy] @ u @ w \<in> L M1)
[PROOF STEP]
using \<open>converge M1 \<alpha> \<alpha>'\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> \<alpha>'

goal (1 subgoal):
 1. (\<alpha> @ [xy] @ u @ w \<in> L M1) = (\<alpha>' @ [xy] @ u @ w \<in> L M1)
[PROOF STEP]
using assms(1) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> \<alpha>'
observable M1
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. (\<alpha> @ [xy] @ u @ w \<in> L M1) = (\<alpha>' @ [xy] @ u @ w \<in> L M1)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<alpha> @ [xy] @ u @ w \<in> L M1) = (\<alpha>' @ [xy] @ u @ w \<in> L M1)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<alpha> @ [xy] @ u @ w \<in> L M1) = (\<alpha>' @ [xy] @ u @ w \<in> L M1)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
have "\<dots> = (\<alpha>' @ [xy] @ u @ w \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u @ w \<in> L M1) = (\<alpha>' @ [xy] @ u @ w \<in> L M2)
[PROOF STEP]
using \<open>\<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc@[u])))\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))

goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u @ w \<in> L M1) = (\<alpha>' @ [xy] @ u @ w \<in> L M2)
[PROOF STEP]
using snoc.prems
[PROOF STATE]
proof (prove)
using this:
\<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u @ w \<in> L M1) = (\<alpha>' @ [xy] @ u @ w \<in> L M2)
[PROOF STEP]
unfolding 2
[PROOF STATE]
proof (prove)
using this:
\<alpha>' @ [xy] @ u @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))

goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u @ w \<in> L M1) = (\<alpha>' @ [xy] @ u @ w \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<alpha>' @ [xy] @ u @ w \<in> L M1) = (\<alpha>' @ [xy] @ u @ w \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<alpha>' @ [xy] @ u @ w \<in> L M1) = (\<alpha>' @ [xy] @ u @ w \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
have "\<dots> = (\<alpha> @ [xy] @ u @ w \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u @ w \<in> L M2) = (\<alpha> @ [xy] @ u @ w \<in> L M2)
[PROOF STEP]
using \<open>converge M2 \<alpha> \<alpha>'\<close>
[PROOF STATE]
proof (prove)
using this:
converge M2 \<alpha> \<alpha>'

goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u @ w \<in> L M2) = (\<alpha> @ [xy] @ u @ w \<in> L M2)
[PROOF STEP]
using assms(2) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
converge M2 \<alpha> \<alpha>'
observable M2
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u @ w \<in> L M2) = (\<alpha> @ [xy] @ u @ w \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<alpha>' @ [xy] @ u @ w \<in> L M2) = (\<alpha> @ [xy] @ u @ w \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<alpha> @ [xy] @ u @ w \<in> L M1) = (\<alpha> @ [xy] @ u @ w \<in> L M2)
[PROOF STEP]
have "\<alpha> @ [xy] @ u @ w \<in> L M1 = (\<alpha> @ [xy] @ u @ w \<in> L M2)"
[PROOF STATE]
proof (prove)
using this:
(\<alpha> @ [xy] @ u @ w \<in> L M1) = (\<alpha> @ [xy] @ u @ w \<in> L M2)

goal (1 subgoal):
 1. (\<alpha> @ [xy] @ u @ w \<in> L M1) = (\<alpha> @ [xy] @ u @ w \<in> L M2)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<alpha> @ [xy] @ u @ w \<in> L M1) = (\<alpha> @ [xy] @ u @ w \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
have "\<beta> @ u @ w \<in> L M1 = (\<beta>' @ u @ w \<in> L M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<beta> @ u @ w \<in> L M1) = (\<beta>' @ u @ w \<in> L M1)
[PROOF STEP]
using \<open>converge M1 \<beta> \<beta>'\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 \<beta> \<beta>'

goal (1 subgoal):
 1. (\<beta> @ u @ w \<in> L M1) = (\<beta>' @ u @ w \<in> L M1)
[PROOF STEP]
using assms(1) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
converge M1 \<beta> \<beta>'
observable M1
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. (\<beta> @ u @ w \<in> L M1) = (\<beta>' @ u @ w \<in> L M1)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<beta> @ u @ w \<in> L M1) = (\<beta>' @ u @ w \<in> L M1)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<beta> @ u @ w \<in> L M1) = (\<beta>' @ u @ w \<in> L M1)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
have "\<dots> = (\<beta>' @ u @ w \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<beta>' @ u @ w \<in> L M1) = (\<beta>' @ u @ w \<in> L M2)
[PROOF STEP]
using \<open>\<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc@[u])))\<close>
[PROOF STATE]
proof (prove)
using this:
\<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))

goal (1 subgoal):
 1. (\<beta>' @ u @ w \<in> L M1) = (\<beta>' @ u @ w \<in> L M2)
[PROOF STEP]
using snoc.prems
[PROOF STATE]
proof (prove)
using this:
\<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. (\<beta>' @ u @ w \<in> L M1) = (\<beta>' @ u @ w \<in> L M2)
[PROOF STEP]
unfolding 2
[PROOF STATE]
proof (prove)
using this:
\<beta>' @ u @ w \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))

goal (1 subgoal):
 1. (\<beta>' @ u @ w \<in> L M1) = (\<beta>' @ u @ w \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<beta>' @ u @ w \<in> L M1) = (\<beta>' @ u @ w \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<beta>' @ u @ w \<in> L M1) = (\<beta>' @ u @ w \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
have "\<dots> = (\<beta> @ u @ w \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<beta>' @ u @ w \<in> L M2) = (\<beta> @ u @ w \<in> L M2)
[PROOF STEP]
using \<open>converge M2 \<beta> \<beta>'\<close>
[PROOF STATE]
proof (prove)
using this:
converge M2 \<beta> \<beta>'

goal (1 subgoal):
 1. (\<beta>' @ u @ w \<in> L M2) = (\<beta> @ u @ w \<in> L M2)
[PROOF STEP]
using assms(2) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
converge M2 \<beta> \<beta>'
observable M2
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. (\<beta>' @ u @ w \<in> L M2) = (\<beta> @ u @ w \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<beta>' @ u @ w \<in> L M2) = (\<beta> @ u @ w \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<beta> @ u @ w \<in> L M1) = (\<beta> @ u @ w \<in> L M2)
[PROOF STEP]
have "\<beta> @ u @ w \<in> L M1 = (\<beta> @ u @ w \<in> L M2)"
[PROOF STATE]
proof (prove)
using this:
(\<beta> @ u @ w \<in> L M1) = (\<beta> @ u @ w \<in> L M2)

goal (1 subgoal):
 1. (\<beta> @ u @ w \<in> L M1) = (\<beta> @ u @ w \<in> L M2)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<beta> @ u @ w \<in> L M1) = (\<beta> @ u @ w \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<beta> @ u @ w \<in> L M1) = (\<beta> @ u @ w \<in> L M2)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<beta> @ u @ w \<in> L M1) = (\<beta> @ u @ w \<in> L M2)

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
using \<open>\<alpha> @ [xy] @ u @ w \<in> L M1 = (\<alpha> @ [xy] @ u @ w \<in> L M2)\<close>
[PROOF STATE]
proof (prove)
using this:
(\<beta> @ u @ w \<in> L M1) = (\<beta> @ u @ w \<in> L M2)
(\<alpha> @ [xy] @ u @ w \<in> L M1) = (\<alpha> @ [xy] @ u @ w \<in> L M2)

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<in> LS M1 qTarget; ?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length ?u1)) (FSM.after M1 qTarget ?u1))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1}

goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<in> LS M1 qTarget; ?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length ?u1)) (FSM.after M1 qTarget ?u1))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1}

goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
have "\<And> u w . u \<in> list.set (ttc@[a]) \<Longrightarrow> u \<notin> LS M1 qTarget \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
fix u w
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
assume "u \<in> list.set (ttc@[a])" and "u \<notin> LS M1 qTarget"
[PROOF STATE]
proof (state)
this:
u \<in> list.set (ttc @ [a])
u \<notin> LS M1 qTarget

goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> list.set (ttc @ [a])
u \<notin> LS M1 qTarget
[PROOF STEP]
have "u \<noteq> a"
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set (ttc @ [a])
u \<notin> LS M1 qTarget

goal (1 subgoal):
 1. u \<noteq> a
[PROOF STEP]
using True
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set (ttc @ [a])
u \<notin> LS M1 qTarget
is_in_language M1 qTarget a

goal (1 subgoal):
 1. u \<noteq> a
[PROOF STEP]
unfolding is_in_language_iff[OF assms(1) \<open>qTarget \<in> states M1\<close>]
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set (ttc @ [a])
u \<notin> LS M1 qTarget
a \<in> LS M1 qTarget

goal (1 subgoal):
 1. u \<noteq> a
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u \<noteq> a

goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<noteq> a
[PROOF STEP]
have "u \<in> list.set ttc"
[PROOF STATE]
proof (prove)
using this:
u \<noteq> a

goal (1 subgoal):
 1. u \<in> list.set ttc
[PROOF STEP]
using \<open>u \<in> list.set (ttc@[a])\<close>
[PROOF STATE]
proof (prove)
using this:
u \<noteq> a
u \<in> list.set (ttc @ [a])

goal (1 subgoal):
 1. u \<in> list.set ttc
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u \<in> list.set ttc

goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> list.set ttc
[PROOF STEP]
show "L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}"
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set ttc

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
using IH2[OF _ \<open>u \<notin> LS M1 qTarget\<close>]
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set ttc
u \<in> list.set ttc \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1}

goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1}

goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc@[a])))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
using handleTrace_props
[PROOF STATE]
proof (prove)
using this:
(\<forall>w. w \<in> list.set ws \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
unfolding * **
[PROOF STATE]
proof (prove)
using this:
(\<forall>w. w \<in> list.set ws \<longrightarrow> (\<exists>\<alpha>'. converge M1 \<alpha> \<alpha>' \<and> \<alpha>' @ [xy] @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<alpha> \<alpha>') \<and> (\<exists>\<beta>'. converge M1 \<beta> \<beta>' \<and> \<beta>' @ a @ w \<in> Prefix_Tree.set (fst (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws)) \<and> converge M2 \<beta> \<beta>')) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl appendDistTrace (foldl handleTrace (T, G) ttc) ws))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))

goal (2 subgoals):
 1. is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
 2. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<in> LS M1 qTarget; ?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length ?u1)) (FSM.after M1 qTarget ?u1))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1}
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1}
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<in> LS M1 qTarget; ?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length ?u1)) (FSM.after M1 qTarget ?u1))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1}
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1}
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> is_in_language M1 qTarget a

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
define Tc where Tc: "Tc = fst (foldl handleTrace (T, G) ttc)"
[PROOF STATE]
proof (state)
this:
Tc = fst (foldl handleTrace (T, G) ttc)

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
define Gc where Gc: "Gc = snd (foldl handleTrace (T, G) ttc)"
[PROOF STATE]
proof (state)
this:
Gc = snd (foldl handleTrace (T, G) ttc)

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
have "(foldl handleTrace (T, G) ttc) = (Tc,Gc)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl handleTrace (T, G) ttc = (Tc, Gc)
[PROOF STEP]
unfolding Tc Gc
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. foldl handleTrace (T, G) ttc = (fst (foldl handleTrace (T, G) ttc), snd (foldl handleTrace (T, G) ttc))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
foldl handleTrace (T, G) ttc = (Tc, Gc)

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
define T' where T': "T' = fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy#a) False (append_heuristic_input M1))"
[PROOF STATE]
proof (state)
this:
T' = fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
define G' where G': "G' = snd (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy#a) False (append_heuristic_input M1))"
[PROOF STATE]
proof (state)
this:
G' = snd (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
have **: "handleTrace (foldl handleTrace (T,G) ttc) a = distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. handleTrace (foldl handleTrace (T, G) ttc) a = distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)
[PROOF STEP]
using False
[PROOF STATE]
proof (prove)
using this:
\<not> is_in_language M1 qTarget a

goal (1 subgoal):
 1. handleTrace (foldl handleTrace (T, G) ttc) a = distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)
[PROOF STEP]
unfolding \<open>(foldl handleTrace (T, G) ttc) = (Tc,Gc)\<close>
[PROOF STATE]
proof (prove)
using this:
\<not> is_in_language M1 qTarget a

goal (1 subgoal):
 1. handleTrace (Tc, Gc) a = distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)
[PROOF STEP]
unfolding handleTrace
[PROOF STATE]
proof (prove)
using this:
\<not> is_in_language M1 qTarget a

goal (1 subgoal):
 1. (case (Tc, Gc) of (T, G) \<Rightarrow> \<lambda>u. if is_in_language M1 qTarget u then let qu = FSM.after M1 qTarget u; ws = sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length u)) qu); appendDistTrace = \<lambda>(T, G) w. let (T', G') = distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy # u @ w) False (append_heuristic_input M1) in distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (u @ w) False (append_heuristic_input M1) in foldl appendDistTrace (T, G) ws else let (T', G') = distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy # u) False (append_heuristic_input M1) in distribute_extension M1 T' G' cg_lookup cg_insert \<beta> u False (append_heuristic_input M1)) a = distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)
[PROOF STEP]
unfolding case_prod_conv Let_def
[PROOF STATE]
proof (prove)
using this:
\<not> is_in_language M1 qTarget a

goal (1 subgoal):
 1. (if is_in_language M1 qTarget a then foldl (\<lambda>(T, G) w. case distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy # a @ w) False (append_heuristic_input M1) of (T', G') \<Rightarrow> distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ w) False (append_heuristic_input M1)) (Tc, Gc) (sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length a)) (FSM.after M1 qTarget a))) else case distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1) of (T', G') \<Rightarrow> distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)) = distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)
[PROOF STEP]
unfolding T' G' Tc Gc
[PROOF STATE]
proof (prove)
using this:
\<not> is_in_language M1 qTarget a

goal (1 subgoal):
 1. (if is_in_language M1 qTarget a then foldl (\<lambda>(T, G) w. case distribute_extension M1 T G cg_lookup cg_insert \<alpha> (xy # a @ w) False (append_heuristic_input M1) of (T', G') \<Rightarrow> distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a @ w) False (append_heuristic_input M1)) (fst (foldl handleTrace (T, G) ttc), snd (foldl handleTrace (T, G) ttc)) (sorted_list_of_maximal_sequences_in_tree (dist_fun (Suc (length a)) (FSM.after M1 qTarget a))) else case distribute_extension M1 (fst (foldl handleTrace (T, G) ttc)) (snd (foldl handleTrace (T, G) ttc)) cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1) of (T', G') \<Rightarrow> distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)) = distribute_extension M1 (fst (distribute_extension M1 (fst (foldl handleTrace (T, G) ttc)) (snd (foldl handleTrace (T, G) ttc)) cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))) (snd (distribute_extension M1 (fst (foldl handleTrace (T, G) ttc)) (snd (foldl handleTrace (T, G) ttc)) cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))) cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)
[PROOF STEP]
by (meson case_prod_beta')
[PROOF STATE]
proof (state)
this:
handleTrace (foldl handleTrace (T, G) ttc) a = distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
have pass_outer : "L M1 \<inter> set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
                            = L M2 \<inter> set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
[PROOF STEP]
using snoc.prems
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
[PROOF STEP]
unfolding * **
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
have "set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy#a) False (append_heuristic_input M1))) \<subseteq> set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> (a) False (append_heuristic_input M1)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Prefix_Tree.set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
[PROOF STEP]
using distribute_extension_subset[of T' M1 G' cg_lookup cg_insert \<beta> "a" False "(append_heuristic_input M1)"]
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T' \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))

goal (1 subgoal):
 1. Prefix_Tree.set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
[PROOF STEP]
using \<open>(foldl handleTrace (T, G) ttc) = (Tc,Gc)\<close>
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T' \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
foldl handleTrace (T, G) ttc = (Tc, Gc)

goal (1 subgoal):
 1. Prefix_Tree.set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
[PROOF STEP]
using T'
[PROOF STATE]
proof (prove)
using this:
Prefix_Tree.set T' \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
foldl handleTrace (T, G) ttc = (Tc, Gc)
T' = fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))

goal (1 subgoal):
 1. Prefix_Tree.set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
Prefix_Tree.set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
Prefix_Tree.set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
[PROOF STEP]
have pass_inner: "L M1 \<inter> set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy#a) False (append_heuristic_input M1)))
                          = L M2 \<inter> set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy#a) False (append_heuristic_input M1)))"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
Prefix_Tree.set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))) \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))

goal (1 subgoal):
 1. L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))) = L M2 \<inter> Prefix_Tree.set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup Gc"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup Gc
[PROOF STEP]
using snoc.IH[OF \<open>L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc)) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) ttc))\<close>]
[PROOF STATE]
proof (prove)
using this:
(\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup Gc
[PROOF STEP]
unfolding Gc
[PROOF STATE]
proof (prove)
using this:
(\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup Gc

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
convergence_graph_lookup_invar M1 M2 cg_lookup Gc
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup G'"
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup Gc

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup G'
[PROOF STEP]
using distribute_extension_adds_sequence(2)[OF assms(1,3) \<open>\<alpha> \<in> L M1\<close> \<open>\<alpha> \<in> L M2\<close> _ assms(14) pass_inner append_heuristic_input_in]
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup Gc
convergence_graph_lookup_invar M1 M2 cg_lookup Gc \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup G'
[PROOF STEP]
unfolding G'
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup Gc
convergence_graph_lookup_invar M1 M2 cg_lookup Gc \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1)))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup G'

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
convergence_graph_lookup_invar M1 M2 cg_lookup G'
[PROOF STEP]
have "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc@[a])))"
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G'

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
unfolding * **
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G'

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
[PROOF STEP]
using distribute_extension_adds_sequence(2)[OF assms(1,3) \<open>\<beta> \<in> L M1\<close> \<open>\<beta> \<in> L M2\<close> _ assms(14) pass_outer append_heuristic_input_in]
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G'
convergence_graph_lookup_invar M1 M2 cg_lookup G' \<Longrightarrow> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
have "\<And> u w. u \<in> list.set (ttc@[a]) \<Longrightarrow> u \<in> LS M1 qTarget \<Longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
fix u w
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
assume "u \<in> list.set (ttc@[a])" and a1:"u \<in> LS M1 qTarget" and a2:"w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))"
[PROOF STATE]
proof (state)
this:
u \<in> list.set (ttc @ [a])
u \<in> LS M1 qTarget
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))

goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> list.set (ttc @ [a])
u \<in> LS M1 qTarget
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))
[PROOF STEP]
have "u \<noteq> a"
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set (ttc @ [a])
u \<in> LS M1 qTarget
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))

goal (1 subgoal):
 1. u \<noteq> a
[PROOF STEP]
using False
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set (ttc @ [a])
u \<in> LS M1 qTarget
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))
\<not> is_in_language M1 qTarget a

goal (1 subgoal):
 1. u \<noteq> a
[PROOF STEP]
unfolding is_in_language_iff[OF assms(1) \<open>qTarget \<in> states M1\<close>]
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set (ttc @ [a])
u \<in> LS M1 qTarget
w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))
a \<notin> LS M1 qTarget

goal (1 subgoal):
 1. u \<noteq> a
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u \<noteq> a

goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<noteq> a
[PROOF STEP]
have "u \<in> list.set ttc"
[PROOF STATE]
proof (prove)
using this:
u \<noteq> a

goal (1 subgoal):
 1. u \<in> list.set ttc
[PROOF STEP]
using \<open>u \<in> list.set (ttc@[a])\<close>
[PROOF STATE]
proof (prove)
using this:
u \<noteq> a
u \<in> list.set (ttc @ [a])

goal (1 subgoal):
 1. u \<in> list.set ttc
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u \<in> list.set ttc

goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> list.set ttc
[PROOF STEP]
show "L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}"
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set ttc

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
using IH1[OF _ a1 a2]
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set ttc
u \<in> list.set ttc \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<in> LS M1 qTarget; ?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length ?u1)) (FSM.after M1 qTarget ?u1))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1}

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<in> LS M1 qTarget; ?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length ?u1)) (FSM.after M1 qTarget ?u1))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1}

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
have "\<And> u w . u \<in> list.set (ttc@[a]) \<Longrightarrow> u \<notin> LS M1 qTarget \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
fix u w
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
assume "u \<in> list.set (ttc@[a])" and "u \<notin> LS M1 qTarget"
[PROOF STATE]
proof (state)
this:
u \<in> list.set (ttc @ [a])
u \<notin> LS M1 qTarget

goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> list.set (ttc @ [a])
u \<notin> LS M1 qTarget
[PROOF STEP]
consider "u \<in> list.set ttc" | "a = u"
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set (ttc @ [a])
u \<notin> LS M1 qTarget

goal (1 subgoal):
 1. \<lbrakk>u \<in> list.set ttc \<Longrightarrow> thesis; a = u \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<lbrakk>u \<in> list.set ttc \<Longrightarrow> ?thesis1; a = u \<Longrightarrow> ?thesis1\<rbrakk> \<Longrightarrow> ?thesis1

goal (1 subgoal):
 1. \<And>u w. \<lbrakk>u \<in> list.set (ttc @ [a]); u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>u \<in> list.set ttc \<Longrightarrow> ?thesis1; a = u \<Longrightarrow> ?thesis1\<rbrakk> \<Longrightarrow> ?thesis1
[PROOF STEP]
show "L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>u \<in> list.set ttc \<Longrightarrow> ?thesis1; a = u \<Longrightarrow> ?thesis1\<rbrakk> \<Longrightarrow> ?thesis1

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. u \<in> list.set ttc \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
 2. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
u \<in> list.set ttc

goal (2 subgoals):
 1. u \<in> list.set ttc \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
 2. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> list.set ttc
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set ttc

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
using IH2[OF _ \<open>u \<notin> LS M1 qTarget\<close>]
[PROOF STATE]
proof (prove)
using this:
u \<in> list.set ttc
u \<in> list.set ttc \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
a = u

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
obtain \<alpha>' where "converge M1 \<alpha> \<alpha>'" and "\<alpha>' @ xy # a \<in> set (fst (foldl handleTrace (T, G) (ttc@[a])))" and "converge M2 \<alpha> \<alpha>'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>\<alpha>'. \<lbrakk>converge M1 \<alpha> \<alpha>'; \<alpha>' @ xy # a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))); converge M2 \<alpha> \<alpha>'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using distribute_extension_adds_sequence(1)[OF assms(1,3) \<open>\<alpha> \<in> L M1\<close> \<open>\<alpha> \<in> L M2\<close> _ assms(14) pass_inner append_heuristic_input_in] \<open>convergence_graph_lookup_invar M1 M2 cg_lookup Gc\<close>
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup Gc \<Longrightarrow> \<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a \<in> Prefix_Tree.set (fst (distribute_extension M1 Tc Gc cg_lookup cg_insert \<alpha> (xy # a) False (append_heuristic_input M1))) \<and> converge M2 \<alpha> u'
convergence_graph_lookup_invar M1 M2 cg_lookup Gc

goal (1 subgoal):
 1. (\<And>\<alpha>'. \<lbrakk>converge M1 \<alpha> \<alpha>'; \<alpha>' @ xy # a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))); converge M2 \<alpha> \<alpha>'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding T'[symmetric]
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup Gc \<Longrightarrow> \<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a \<in> Prefix_Tree.set T' \<and> converge M2 \<alpha> u'
convergence_graph_lookup_invar M1 M2 cg_lookup Gc

goal (1 subgoal):
 1. (\<And>\<alpha>'. \<lbrakk>converge M1 \<alpha> \<alpha>'; \<alpha>' @ xy # a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))); converge M2 \<alpha> \<alpha>'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using distribute_extension_subset[of T' M1 G' cg_lookup cg_insert \<beta> "a" False "(append_heuristic_input M1)"]
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup Gc \<Longrightarrow> \<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a \<in> Prefix_Tree.set T' \<and> converge M2 \<alpha> u'
convergence_graph_lookup_invar M1 M2 cg_lookup Gc
Prefix_Tree.set T' \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))

goal (1 subgoal):
 1. (\<And>\<alpha>'. \<lbrakk>converge M1 \<alpha> \<alpha>'; \<alpha>' @ xy # a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))); converge M2 \<alpha> \<alpha>'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding * **
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup Gc \<Longrightarrow> \<exists>u'. converge M1 \<alpha> u' \<and> u' @ xy # a \<in> Prefix_Tree.set T' \<and> converge M2 \<alpha> u'
convergence_graph_lookup_invar M1 M2 cg_lookup Gc
Prefix_Tree.set T' \<subseteq> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1)))

goal (1 subgoal):
 1. (\<And>\<alpha>'. \<lbrakk>converge M1 \<alpha> \<alpha>'; \<alpha>' @ xy # a \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1))); converge M2 \<alpha> \<alpha>'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
converge M1 \<alpha> \<alpha>'
\<alpha>' @ xy # a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
converge M2 \<alpha> \<alpha>'

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
have "\<And> \<alpha>' . \<alpha>' @ xy # u = \<alpha>' @ [xy] @ u"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<alpha>'. \<alpha>' @ xy # u = \<alpha>' @ [xy] @ u
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
?\<alpha>'1 @ xy # u = ?\<alpha>'1 @ [xy] @ u

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
obtain \<beta>' where "converge M1 \<beta> \<beta>'" and "\<beta>' @ a \<in> set (fst (foldl handleTrace (T, G) (ttc@[a])))" and "converge M2 \<beta> \<beta>'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>\<beta>'. \<lbrakk>converge M1 \<beta> \<beta>'; \<beta>' @ a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))); converge M2 \<beta> \<beta>'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using distribute_extension_adds_sequence(1)[OF assms(1,3) \<open>\<beta> \<in> L M1\<close> \<open>\<beta> \<in> L M2\<close> _ assms(14) pass_outer append_heuristic_input_in] \<open>convergence_graph_lookup_invar M1 M2 cg_lookup G'\<close>
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G' \<Longrightarrow> \<exists>u'. converge M1 \<beta> u' \<and> u' @ a \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1))) \<and> converge M2 \<beta> u'
convergence_graph_lookup_invar M1 M2 cg_lookup G'

goal (1 subgoal):
 1. (\<And>\<beta>'. \<lbrakk>converge M1 \<beta> \<beta>'; \<beta>' @ a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))); converge M2 \<beta> \<beta>'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding * **
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup G' \<Longrightarrow> \<exists>u'. converge M1 \<beta> u' \<and> u' @ a \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1))) \<and> converge M2 \<beta> u'
convergence_graph_lookup_invar M1 M2 cg_lookup G'

goal (1 subgoal):
 1. (\<And>\<beta>'. \<lbrakk>converge M1 \<beta> \<beta>'; \<beta>' @ a \<in> Prefix_Tree.set (fst (distribute_extension M1 T' G' cg_lookup cg_insert \<beta> a False (append_heuristic_input M1))); converge M2 \<beta> \<beta>'\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
converge M1 \<beta> \<beta>'
\<beta>' @ a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
converge M2 \<beta> \<beta>'

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
have "\<alpha> @ [xy] @ u \<in> L M1 = (\<alpha>' @ [xy] @ u \<in> L M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<alpha> @ [xy] @ u \<in> L M1) = (\<alpha>' @ [xy] @ u \<in> L M1)
[PROOF STEP]
using \<open>converge M1 \<alpha> \<alpha>'\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> \<alpha>'

goal (1 subgoal):
 1. (\<alpha> @ [xy] @ u \<in> L M1) = (\<alpha>' @ [xy] @ u \<in> L M1)
[PROOF STEP]
using assms(1) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
converge M1 \<alpha> \<alpha>'
observable M1
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. (\<alpha> @ [xy] @ u \<in> L M1) = (\<alpha>' @ [xy] @ u \<in> L M1)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<alpha> @ [xy] @ u \<in> L M1) = (\<alpha>' @ [xy] @ u \<in> L M1)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<alpha> @ [xy] @ u \<in> L M1) = (\<alpha>' @ [xy] @ u \<in> L M1)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
have "\<dots> = (\<alpha>' @ [xy] @ u \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u \<in> L M1) = (\<alpha>' @ [xy] @ u \<in> L M2)
[PROOF STEP]
using \<open>\<alpha>' @ xy # a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc@[a])))\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha>' @ xy # a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u \<in> L M1) = (\<alpha>' @ [xy] @ u \<in> L M2)
[PROOF STEP]
using snoc.prems
[PROOF STATE]
proof (prove)
using this:
\<alpha>' @ xy # a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u \<in> L M1) = (\<alpha>' @ [xy] @ u \<in> L M2)
[PROOF STEP]
unfolding 2 \<open>\<And> \<alpha>' . \<alpha>' @ xy # u = \<alpha>' @ [xy] @ u\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha>' @ [xy] @ u \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))

goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u \<in> L M1) = (\<alpha>' @ [xy] @ u \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<alpha>' @ [xy] @ u \<in> L M1) = (\<alpha>' @ [xy] @ u \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<alpha>' @ [xy] @ u \<in> L M1) = (\<alpha>' @ [xy] @ u \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
have "\<dots> = (\<alpha> @ [xy] @ u \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u \<in> L M2) = (\<alpha> @ [xy] @ u \<in> L M2)
[PROOF STEP]
using \<open>converge M2 \<alpha> \<alpha>'\<close>
[PROOF STATE]
proof (prove)
using this:
converge M2 \<alpha> \<alpha>'

goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u \<in> L M2) = (\<alpha> @ [xy] @ u \<in> L M2)
[PROOF STEP]
using assms(2) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
converge M2 \<alpha> \<alpha>'
observable M2
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. (\<alpha>' @ [xy] @ u \<in> L M2) = (\<alpha> @ [xy] @ u \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<alpha>' @ [xy] @ u \<in> L M2) = (\<alpha> @ [xy] @ u \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<alpha> @ [xy] @ u \<in> L M1) = (\<alpha> @ [xy] @ u \<in> L M2)
[PROOF STEP]
have "\<alpha> @ [xy] @ u \<in> L M1 = (\<alpha> @ [xy] @ u \<in> L M2)"
[PROOF STATE]
proof (prove)
using this:
(\<alpha> @ [xy] @ u \<in> L M1) = (\<alpha> @ [xy] @ u \<in> L M2)

goal (1 subgoal):
 1. (\<alpha> @ [xy] @ u \<in> L M1) = (\<alpha> @ [xy] @ u \<in> L M2)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<alpha> @ [xy] @ u \<in> L M1) = (\<alpha> @ [xy] @ u \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
have "\<beta> @ u \<in> L M1 = (\<beta>' @ u \<in> L M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<beta> @ u \<in> L M1) = (\<beta>' @ u \<in> L M1)
[PROOF STEP]
using \<open>converge M1 \<beta> \<beta>'\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 \<beta> \<beta>'

goal (1 subgoal):
 1. (\<beta> @ u \<in> L M1) = (\<beta>' @ u \<in> L M1)
[PROOF STEP]
using assms(1) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
converge M1 \<beta> \<beta>'
observable M1
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. (\<beta> @ u \<in> L M1) = (\<beta>' @ u \<in> L M1)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<beta> @ u \<in> L M1) = (\<beta>' @ u \<in> L M1)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<beta> @ u \<in> L M1) = (\<beta>' @ u \<in> L M1)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
have "\<dots> = (\<beta>' @ u \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<beta>' @ u \<in> L M1) = (\<beta>' @ u \<in> L M2)
[PROOF STEP]
using \<open>\<beta>' @ a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc@[a])))\<close>
[PROOF STATE]
proof (prove)
using this:
\<beta>' @ a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. (\<beta>' @ u \<in> L M1) = (\<beta>' @ u \<in> L M2)
[PROOF STEP]
using snoc.prems
[PROOF STATE]
proof (prove)
using this:
\<beta>' @ a \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [a])))

goal (1 subgoal):
 1. (\<beta>' @ u \<in> L M1) = (\<beta>' @ u \<in> L M2)
[PROOF STEP]
unfolding 2
[PROOF STATE]
proof (prove)
using this:
\<beta>' @ u \<in> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))
L M1 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u]))) = L M2 \<inter> Prefix_Tree.set (fst (foldl handleTrace (T, G) (ttc @ [u])))

goal (1 subgoal):
 1. (\<beta>' @ u \<in> L M1) = (\<beta>' @ u \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<beta>' @ u \<in> L M1) = (\<beta>' @ u \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(\<beta>' @ u \<in> L M1) = (\<beta>' @ u \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
have "\<dots> = (\<beta> @ u \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<beta>' @ u \<in> L M2) = (\<beta> @ u \<in> L M2)
[PROOF STEP]
using \<open>converge M2 \<beta> \<beta>'\<close>
[PROOF STATE]
proof (prove)
using this:
converge M2 \<beta> \<beta>'

goal (1 subgoal):
 1. (\<beta>' @ u \<in> L M2) = (\<beta> @ u \<in> L M2)
[PROOF STEP]
using assms(2) converge_append_language_iff
[PROOF STATE]
proof (prove)
using this:
converge M2 \<beta> \<beta>'
observable M2
\<lbrakk>observable ?M; converge ?M ?\<alpha> ?\<beta>\<rbrakk> \<Longrightarrow> (?\<alpha> @ ?\<gamma> \<in> L ?M) = (?\<beta> @ ?\<gamma> \<in> L ?M)

goal (1 subgoal):
 1. (\<beta>' @ u \<in> L M2) = (\<beta> @ u \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<beta>' @ u \<in> L M2) = (\<beta> @ u \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(\<beta> @ u \<in> L M1) = (\<beta> @ u \<in> L M2)
[PROOF STEP]
have "\<beta> @ u \<in> L M1 = (\<beta> @ u \<in> L M2)"
[PROOF STATE]
proof (prove)
using this:
(\<beta> @ u \<in> L M1) = (\<beta> @ u \<in> L M2)

goal (1 subgoal):
 1. (\<beta> @ u \<in> L M1) = (\<beta> @ u \<in> L M2)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<beta> @ u \<in> L M1) = (\<beta> @ u \<in> L M2)

goal (1 subgoal):
 1. a = u \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<beta> @ u \<in> L M1) = (\<beta> @ u \<in> L M2)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(\<beta> @ u \<in> L M1) = (\<beta> @ u \<in> L M2)

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
using \<open>\<alpha> @ [xy] @ u \<in> L M1 = (\<alpha> @ [xy] @ u \<in> L M2)\<close>
[PROOF STATE]
proof (prove)
using this:
(\<beta> @ u \<in> L M1) = (\<beta> @ u \<in> L M2)
(\<alpha> @ [xy] @ u \<in> L M1) = (\<alpha> @ [xy] @ u \<in> L M2)

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1}

goal (1 subgoal):
 1. \<not> is_in_language M1 qTarget a \<Longrightarrow> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<in> LS M1 qTarget; ?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length ?u1)) (FSM.after M1 qTarget ?u1))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1}
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<in> LS M1 qTarget; ?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length ?u1)) (FSM.after M1 qTarget ?u1))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1}
\<lbrakk>?u1 \<in> list.set (ttc @ [a]); ?u1 \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1}

goal (1 subgoal):
 1. (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set (ttc @ [a]) \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) (ttc @ [a])))

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
(\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))
[PROOF STEP]
have handleTrace_foldl_props_1: "\<And> u w. u \<in> list.set ttc \<Longrightarrow>
            u \<in> LS M1 qTarget \<Longrightarrow>
            w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<Longrightarrow>
            L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}"
  and  handleTrace_foldl_props_2: "\<And>u w. u \<in> list.set ttc \<Longrightarrow> u \<notin> LS M1 qTarget \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}"
  and  "convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))"
[PROOF STATE]
proof (prove)
using this:
(\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<in> LS M1 qTarget \<longrightarrow> w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u)) \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) \<and> (\<forall>u w. u \<in> list.set ttc \<longrightarrow> u \<notin> LS M1 qTarget \<longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) \<and> convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))

goal (1 subgoal):
 1. (\<And>u w. \<lbrakk>u \<in> list.set ttc; u \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length u)) (FSM.after M1 qTarget u))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w} = L M2 \<inter> {\<alpha> @ [xy] @ u @ w, \<beta> @ u @ w}) &&& (\<And>u w. \<lbrakk>u \<in> list.set ttc; u \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u} = L M2 \<inter> {\<alpha> @ [xy] @ u, \<beta> @ u}) &&& convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))
[PROOF STEP]
by presburger+
[PROOF STATE]
proof (state)
this:
\<lbrakk>?u1 \<in> list.set ttc; ?u1 \<in> LS M1 qTarget; ?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length ?u1)) (FSM.after M1 qTarget ?u1))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1}
\<lbrakk>?u1 \<in> list.set ttc; ?u1 \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1}
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))

goal (3 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
 3. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?u1 \<in> list.set ttc; ?u1 \<in> LS M1 qTarget; ?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length ?u1)) (FSM.after M1 qTarget ?u1))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1}
\<lbrakk>?u1 \<in> list.set ttc; ?u1 \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1}
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))
[PROOF STEP]
show "?P2"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?u1 \<in> list.set ttc; ?u1 \<in> LS M1 qTarget; ?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length ?u1)) (FSM.after M1 qTarget ?u1))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1}
\<lbrakk>?u1 \<in> list.set ttc; ?u1 \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1}
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))
[PROOF STEP]
unfolding result
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?u1 \<in> list.set ttc; ?u1 \<in> LS M1 qTarget; ?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length ?u1)) (FSM.after M1 qTarget ?u1))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1 @ ?w1, \<beta> @ ?u1 @ ?w1}
\<lbrakk>?u1 \<in> list.set ttc; ?u1 \<notin> LS M1 qTarget\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1} = L M2 \<inter> {\<alpha> @ [xy] @ ?u1, \<beta> @ ?u1}
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))

goal (1 subgoal):
 1. convergence_graph_lookup_invar M1 M2 cg_lookup (snd (foldl handleTrace (T, G) ttc))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
convergence_graph_lookup_invar M1 M2 cg_lookup (snd (establish_convergence_static dist_fun M1 V T G cg_insert cg_lookup m t))

goal (2 subgoals):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
show "preserves_divergence M1 M2 ((V ` reachable_states M1) \<union> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
let ?w = "((V (t_source t)) @ [(t_input t,t_output t)])"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
have "V (t_target t) \<in> (V ` reachable_states M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. V (t_target t) \<in> V ` reachable_states M1
[PROOF STEP]
by (simp add: \<open>qTarget \<in> reachable_states M1\<close> \<open>t_target t = qTarget\<close>)
[PROOF STATE]
proof (state)
this:
V (t_target t) \<in> V ` reachable_states M1

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
V (t_target t) \<in> V ` reachable_states M1
[PROOF STEP]
have "((V ` reachable_states M1) \<union> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))}) = Set.insert ((V (t_source t)) @ [(t_input t,t_output t)]) (V ` reachable_states M1)"
[PROOF STATE]
proof (prove)
using this:
V (t_target t) \<in> V ` reachable_states M1

goal (1 subgoal):
 1. V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} = Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} = Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1)

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} = Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1)

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
have "Set.insert ?w (V ` reachable_states M1) \<subseteq> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1) \<subseteq> L M1
[PROOF STEP]
using state_cover_assignment_language[OF assms(9)]
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> L M1

goal (1 subgoal):
 1. Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1) \<subseteq> L M1
[PROOF STEP]
using \<alpha> \<open>converge M1 (\<alpha> @ [xy]) \<beta>\<close> xy
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> L M1
\<alpha> = V (t_source t)
converge M1 (\<alpha> @ [xy]) \<beta>
xy = (t_input t, t_output t)

goal (1 subgoal):
 1. Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1) \<subseteq> L M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1) \<subseteq> L M1

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} = Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1)
Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1) \<subseteq> L M1
[PROOF STEP]
have *:"L M1 \<inter> (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)}) = Set.insert ?w (V ` reachable_states M1)"
                and **:"L M1 \<inter> (V ` reachable_states M1) = (V ` reachable_states M1)"
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} = Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1)
Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1) \<subseteq> L M1

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)}) = Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1) &&& L M1 \<inter> V ` reachable_states M1 = V ` reachable_states M1
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)}) = Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1)
L M1 \<inter> V ` reachable_states M1 = V ` reachable_states M1

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
have "\<And> u . u \<in> Set.insert ?w (V ` reachable_states M1) \<Longrightarrow> \<not>converge M1 u ?w \<Longrightarrow> \<not>converge M2 u ?w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
fix u
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
assume "u \<in> Set.insert ?w (V ` reachable_states M1)" and "\<not>converge M1 u ?w"
[PROOF STATE]
proof (state)
this:
u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1)
\<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1)
\<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "converge M1 ?w ?w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
using \<open>\<alpha>@[xy] \<in> L M1\<close>
[PROOF STATE]
proof (prove)
using this:
\<alpha> @ [xy] \<in> L M1

goal (1 subgoal):
 1. converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
unfolding \<alpha> xy
[PROOF STATE]
proof (prove)
using this:
V (t_source t) @ [(t_input t, t_output t)] \<in> L M1

goal (1 subgoal):
 1. converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_source t) @ [(t_input t, t_output t)])

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1)
\<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])
converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "u \<in> (V ` reachable_states M1)"
[PROOF STATE]
proof (prove)
using this:
u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1)
\<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])
converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_source t) @ [(t_input t, t_output t)])

goal (1 subgoal):
 1. u \<in> V ` reachable_states M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u \<in> V ` reachable_states M1

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "\<not>converge M1 u \<beta>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> converge M1 u \<beta>
[PROOF STEP]
using \<open>\<not>converge M1 u ?w\<close> \<open>converge M1 (\<alpha>@[xy]) \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
\<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])
converge M1 (\<alpha> @ [xy]) \<beta>

goal (1 subgoal):
 1. \<not> converge M1 u \<beta>
[PROOF STEP]
unfolding \<alpha> xy \<beta>
[PROOF STATE]
proof (prove)
using this:
\<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])
converge M1 (V (t_source t) @ [(t_input t, t_output t)]) (V (t_target t))

goal (1 subgoal):
 1. \<not> converge M1 u (V (t_target t))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> converge M1 u \<beta>

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "\<beta> = V qTarget"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<beta> = V qTarget
[PROOF STEP]
by (simp add: \<beta> \<open>t_target t = qTarget\<close>)
[PROOF STATE]
proof (state)
this:
\<beta> = V qTarget

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
obtain qU where "qU \<in> reachable_states M1" and "u = V qU"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>qU. \<lbrakk>qU \<in> reachable_states M1; u = V qU\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<open>u \<in> (V ` reachable_states M1)\<close>
[PROOF STATE]
proof (prove)
using this:
u \<in> V ` reachable_states M1

goal (1 subgoal):
 1. (\<And>qU. \<lbrakk>qU \<in> reachable_states M1; u = V qU\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
qU \<in> reachable_states M1
u = V qU

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
qU \<in> reachable_states M1
u = V qU
[PROOF STEP]
have "qU = after_initial M1 u"
[PROOF STATE]
proof (prove)
using this:
qU \<in> reachable_states M1
u = V qU

goal (1 subgoal):
 1. qU = after_initial M1 u
[PROOF STEP]
using state_cover_assignment_after[OF assms(1,9)]
[PROOF STATE]
proof (prove)
using this:
qU \<in> reachable_states M1
u = V qU
?q \<in> reachable_states M1 \<Longrightarrow> V ?q \<in> L M1
?q \<in> reachable_states M1 \<Longrightarrow> after_initial M1 (V ?q) = ?q

goal (1 subgoal):
 1. qU = after_initial M1 u
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
qU = after_initial M1 u

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
qU = after_initial M1 u
[PROOF STEP]
have "qU \<noteq> qTarget"
[PROOF STATE]
proof (prove)
using this:
qU = after_initial M1 u

goal (1 subgoal):
 1. qU \<noteq> qTarget
[PROOF STEP]
using \<open>\<not>converge M1 u \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
qU = after_initial M1 u
\<not> converge M1 u \<beta>

goal (1 subgoal):
 1. qU \<noteq> qTarget
[PROOF STEP]
using \<beta> \<open>\<beta> \<in> L M1\<close> \<open>t_target t = qTarget\<close> \<open>u = V qU\<close>
[PROOF STATE]
proof (prove)
using this:
qU = after_initial M1 u
\<not> converge M1 u \<beta>
\<beta> = V (t_target t)
\<beta> \<in> L M1
t_target t = qTarget
u = V qU

goal (1 subgoal):
 1. qU \<noteq> qTarget
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
qU \<noteq> qTarget

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
qU \<noteq> qTarget
[PROOF STEP]
obtain w where "\<forall> k1 k2 . w \<in> set (dist_fun k1 qU) \<inter> set (dist_fun k2 qTarget)" and "distinguishes M1 qU qTarget w"
[PROOF STATE]
proof (prove)
using this:
qU \<noteq> qTarget

goal (1 subgoal):
 1. (\<And>w. \<lbrakk>\<forall>k1 k2. w \<in> Prefix_Tree.set (dist_fun k1 qU) \<inter> Prefix_Tree.set (dist_fun k2 qTarget); distinguishes M1 qU qTarget w\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms(15)[OF reachable_state_is_state[OF \<open>qU \<in> reachable_states M1\<close>] \<open>qTarget \<in> states M1\<close>]
[PROOF STATE]
proof (prove)
using this:
qU \<noteq> qTarget
qU \<noteq> qTarget \<Longrightarrow> \<exists>io. \<forall>k1 k2. io \<in> Prefix_Tree.set (dist_fun k1 qU) \<inter> Prefix_Tree.set (dist_fun k2 qTarget) \<and> distinguishes M1 qU qTarget io

goal (1 subgoal):
 1. (\<And>w. \<lbrakk>\<forall>k1 k2. w \<in> Prefix_Tree.set (dist_fun k1 qU) \<inter> Prefix_Tree.set (dist_fun k2 qTarget); distinguishes M1 qU qTarget w\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>k1 k2. w \<in> Prefix_Tree.set (dist_fun k1 qU) \<inter> Prefix_Tree.set (dist_fun k2 qTarget)
distinguishes M1 qU qTarget w

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<forall>k1 k2. w \<in> Prefix_Tree.set (dist_fun k1 qU) \<inter> Prefix_Tree.set (dist_fun k2 qTarget)
distinguishes M1 qU qTarget w
[PROOF STEP]
have "w \<in> set (after T (V qU))" and "w \<in> set (after T (V qTarget))"
[PROOF STATE]
proof (prove)
using this:
\<forall>k1 k2. w \<in> Prefix_Tree.set (dist_fun k1 qU) \<inter> Prefix_Tree.set (dist_fun k2 qTarget)
distinguishes M1 qU qTarget w

goal (1 subgoal):
 1. w \<in> Prefix_Tree.set (Prefix_Tree.after T (V qU)) &&& w \<in> Prefix_Tree.set (Prefix_Tree.after T (V qTarget))
[PROOF STEP]
using assms(16)[OF \<open>qU \<in> reachable_states M1\<close>]
[PROOF STATE]
proof (prove)
using this:
\<forall>k1 k2. w \<in> Prefix_Tree.set (dist_fun k1 qU) \<inter> Prefix_Tree.set (dist_fun k2 qTarget)
distinguishes M1 qU qTarget w
Prefix_Tree.set (dist_fun 0 qU) \<subseteq> Prefix_Tree.set (Prefix_Tree.after T (V qU))

goal (1 subgoal):
 1. w \<in> Prefix_Tree.set (Prefix_Tree.after T (V qU)) &&& w \<in> Prefix_Tree.set (Prefix_Tree.after T (V qTarget))
[PROOF STEP]
using assms(16)[OF \<open>qTarget \<in> reachable_states M1\<close>]
[PROOF STATE]
proof (prove)
using this:
\<forall>k1 k2. w \<in> Prefix_Tree.set (dist_fun k1 qU) \<inter> Prefix_Tree.set (dist_fun k2 qTarget)
distinguishes M1 qU qTarget w
Prefix_Tree.set (dist_fun 0 qU) \<subseteq> Prefix_Tree.set (Prefix_Tree.after T (V qU))
Prefix_Tree.set (dist_fun 0 qTarget) \<subseteq> Prefix_Tree.set (Prefix_Tree.after T (V qTarget))

goal (1 subgoal):
 1. w \<in> Prefix_Tree.set (Prefix_Tree.after T (V qU)) &&& w \<in> Prefix_Tree.set (Prefix_Tree.after T (V qTarget))
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
w \<in> Prefix_Tree.set (Prefix_Tree.after T (V qU))
w \<in> Prefix_Tree.set (Prefix_Tree.after T (V qTarget))

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "[] \<in> list.set ttc"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [] \<in> list.set ttc
[PROOF STEP]
unfolding ttc
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [] \<in> list.set ([] # traces_to_check M1 qTarget k)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
[] \<in> list.set ttc

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
[] \<in> list.set ttc

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "[] \<in> LS M1 qTarget"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [] \<in> LS M1 qTarget
[PROOF STEP]
using \<open>qTarget \<in> states M1\<close>
[PROOF STATE]
proof (prove)
using this:
qTarget \<in> FSM.states M1

goal (1 subgoal):
 1. [] \<in> LS M1 qTarget
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
[] \<in> LS M1 qTarget

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
[] \<in> LS M1 qTarget

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "w \<in> set (dist_fun (Suc (length [])) (FSM.after M1 qTarget []))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. w \<in> Prefix_Tree.set (dist_fun (Suc (length [])) (FSM.after M1 qTarget []))
[PROOF STEP]
using \<open>\<forall> k1 k2 . w \<in> set (dist_fun k1 qU) \<inter> set (dist_fun k2 qTarget)\<close>
[PROOF STATE]
proof (prove)
using this:
\<forall>k1 k2. w \<in> Prefix_Tree.set (dist_fun k1 qU) \<inter> Prefix_Tree.set (dist_fun k2 qTarget)

goal (1 subgoal):
 1. w \<in> Prefix_Tree.set (dist_fun (Suc (length [])) (FSM.after M1 qTarget []))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
w \<in> Prefix_Tree.set (dist_fun (Suc (length [])) (FSM.after M1 qTarget []))

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
[] \<in> list.set ttc
[] \<in> LS M1 qTarget
w \<in> Prefix_Tree.set (dist_fun (Suc (length [])) (FSM.after M1 qTarget []))
[PROOF STEP]
have "L M1 \<inter> {?w @ w, \<beta> @ w} = L M2 \<inter> {?w @ w, \<beta> @ w}"
[PROOF STATE]
proof (prove)
using this:
[] \<in> list.set ttc
[] \<in> LS M1 qTarget
w \<in> Prefix_Tree.set (dist_fun (Suc (length [])) (FSM.after M1 qTarget []))

goal (1 subgoal):
 1. L M1 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w} = L M2 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w}
[PROOF STEP]
using handleTrace_foldl_props_1[of "[]" w]
[PROOF STATE]
proof (prove)
using this:
[] \<in> list.set ttc
[] \<in> LS M1 qTarget
w \<in> Prefix_Tree.set (dist_fun (Suc (length [])) (FSM.after M1 qTarget []))
\<lbrakk>[] \<in> list.set ttc; [] \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length [])) (FSM.after M1 qTarget []))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ [] @ w, \<beta> @ [] @ w} = L M2 \<inter> {\<alpha> @ [xy] @ [] @ w, \<beta> @ [] @ w}

goal (1 subgoal):
 1. L M1 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w} = L M2 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w}
[PROOF STEP]
unfolding \<alpha> xy
[PROOF STATE]
proof (prove)
using this:
[] \<in> list.set ttc
[] \<in> LS M1 qTarget
w \<in> Prefix_Tree.set (dist_fun (Suc (length [])) (FSM.after M1 qTarget []))
\<lbrakk>[] \<in> list.set ttc; [] \<in> LS M1 qTarget; w \<in> Prefix_Tree.set (dist_fun (Suc (length [])) (FSM.after M1 qTarget []))\<rbrakk> \<Longrightarrow> L M1 \<inter> {V (t_source t) @ [(t_input t, t_output t)] @ [] @ w, \<beta> @ [] @ w} = L M2 \<inter> {V (t_source t) @ [(t_input t, t_output t)] @ [] @ w, \<beta> @ [] @ w}

goal (1 subgoal):
 1. L M1 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w} = L M2 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w} = L M2 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w}

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w} = L M2 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w}

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "(?w @ w \<in> L M1) = (\<beta>@w \<in> L M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M1) = (\<beta> @ w \<in> L M1)
[PROOF STEP]
using converge_extend[OF assms(1) \<open>converge M1 (\<alpha>@[xy]) \<beta>\<close> _ \<open>\<beta> \<in> L M1\<close>, of w]
[PROOF STATE]
proof (prove)
using this:
(\<alpha> @ [xy]) @ w \<in> L M1 \<Longrightarrow> \<beta> @ w \<in> L M1

goal (1 subgoal):
 1. ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M1) = (\<beta> @ w \<in> L M1)
[PROOF STEP]
using converge_extend[OF assms(1) _ _ \<open>\<alpha>@[xy] \<in> L M1\<close>, of \<beta> w]
[PROOF STATE]
proof (prove)
using this:
(\<alpha> @ [xy]) @ w \<in> L M1 \<Longrightarrow> \<beta> @ w \<in> L M1
\<lbrakk>converge M1 \<beta> (\<alpha> @ [xy]); \<beta> @ w \<in> L M1\<rbrakk> \<Longrightarrow> (\<alpha> @ [xy]) @ w \<in> L M1

goal (1 subgoal):
 1. ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M1) = (\<beta> @ w \<in> L M1)
[PROOF STEP]
using \<open>converge M1 (\<alpha>@[xy]) \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
(\<alpha> @ [xy]) @ w \<in> L M1 \<Longrightarrow> \<beta> @ w \<in> L M1
\<lbrakk>converge M1 \<beta> (\<alpha> @ [xy]); \<beta> @ w \<in> L M1\<rbrakk> \<Longrightarrow> (\<alpha> @ [xy]) @ w \<in> L M1
converge M1 (\<alpha> @ [xy]) \<beta>

goal (1 subgoal):
 1. ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M1) = (\<beta> @ w \<in> L M1)
[PROOF STEP]
unfolding converge_sym[where u=\<beta>]
[PROOF STATE]
proof (prove)
using this:
(\<alpha> @ [xy]) @ w \<in> L M1 \<Longrightarrow> \<beta> @ w \<in> L M1
\<lbrakk>converge M1 (\<alpha> @ [xy]) \<beta>; \<beta> @ w \<in> L M1\<rbrakk> \<Longrightarrow> (\<alpha> @ [xy]) @ w \<in> L M1
converge M1 (\<alpha> @ [xy]) \<beta>

goal (1 subgoal):
 1. ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M1) = (\<beta> @ w \<in> L M1)
[PROOF STEP]
unfolding \<alpha>[symmetric] xy[symmetric]
[PROOF STATE]
proof (prove)
using this:
(\<alpha> @ [xy]) @ w \<in> L M1 \<Longrightarrow> \<beta> @ w \<in> L M1
\<lbrakk>converge M1 (\<alpha> @ [xy]) \<beta>; \<beta> @ w \<in> L M1\<rbrakk> \<Longrightarrow> (\<alpha> @ [xy]) @ w \<in> L M1
converge M1 (\<alpha> @ [xy]) \<beta>

goal (1 subgoal):
 1. ((\<alpha> @ [xy]) @ w \<in> L M1) = (\<beta> @ w \<in> L M1)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M1) = (\<beta> @ w \<in> L M1)

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w} = L M2 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w}
((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M1) = (\<beta> @ w \<in> L M1)
[PROOF STEP]
have "(?w @ w \<in> L M2) = (\<beta>@w \<in> L M2)"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w} = L M2 \<inter> {(V (t_source t) @ [(t_input t, t_output t)]) @ w, \<beta> @ w}
((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M1) = (\<beta> @ w \<in> L M1)

goal (1 subgoal):
 1. ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2) = (\<beta> @ w \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2) = (\<beta> @ w \<in> L M2)

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "(w \<in> LS M1 qU) \<noteq> (w \<in> LS M1 qTarget)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (w \<in> LS M1 qU) \<noteq> (w \<in> LS M1 qTarget)
[PROOF STEP]
using \<open>distinguishes M1 qU qTarget w\<close>
[PROOF STATE]
proof (prove)
using this:
distinguishes M1 qU qTarget w

goal (1 subgoal):
 1. (w \<in> LS M1 qU) \<noteq> (w \<in> LS M1 qTarget)
[PROOF STEP]
unfolding distinguishes_def
[PROOF STATE]
proof (prove)
using this:
w \<in> LS M1 qU \<union> LS M1 qTarget \<and> w \<notin> LS M1 qU \<inter> LS M1 qTarget

goal (1 subgoal):
 1. (w \<in> LS M1 qU) \<noteq> (w \<in> LS M1 qTarget)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(w \<in> LS M1 qU) \<noteq> (w \<in> LS M1 qTarget)

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(w \<in> LS M1 qU) \<noteq> (w \<in> LS M1 qTarget)

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "(w \<in> LS M1 qU) = (u@w \<in> L M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (w \<in> LS M1 qU) = (u @ w \<in> L M1)
[PROOF STEP]
by (metis "**" IntD1 \<open>qU = after_initial M1 u\<close> \<open>u \<in> V ` reachable_states M1\<close> after_language_iff assms(1))
[PROOF STATE]
proof (state)
this:
(w \<in> LS M1 qU) = (u @ w \<in> L M1)

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(w \<in> LS M1 qU) = (u @ w \<in> L M1)

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "(w \<in> LS M1 qTarget) = (\<beta>@w \<in> L M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (w \<in> LS M1 qTarget) = (\<beta> @ w \<in> L M1)
[PROOF STEP]
by (metis \<open>\<beta> = V qTarget\<close> \<open>\<beta> \<in> L M1\<close> \<open>qTarget \<in> reachable_states M1\<close> after_language_iff assms(1) assms(9) is_state_cover_assignment_observable_after)
[PROOF STATE]
proof (state)
this:
(w \<in> LS M1 qTarget) = (\<beta> @ w \<in> L M1)

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(w \<in> LS M1 qU) \<noteq> (w \<in> LS M1 qTarget)
(w \<in> LS M1 qU) = (u @ w \<in> L M1)
(w \<in> LS M1 qTarget) = (\<beta> @ w \<in> L M1)
[PROOF STEP]
have "(u@w \<in> L M1) \<noteq> (\<beta>@w \<in> L M1)"
[PROOF STATE]
proof (prove)
using this:
(w \<in> LS M1 qU) \<noteq> (w \<in> LS M1 qTarget)
(w \<in> LS M1 qU) = (u @ w \<in> L M1)
(w \<in> LS M1 qTarget) = (\<beta> @ w \<in> L M1)

goal (1 subgoal):
 1. (u @ w \<in> L M1) \<noteq> (\<beta> @ w \<in> L M1)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(u @ w \<in> L M1) \<noteq> (\<beta> @ w \<in> L M1)

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(u @ w \<in> L M1) \<noteq> (\<beta> @ w \<in> L M1)

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "u@w \<in> set T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u @ w \<in> Prefix_Tree.set T
[PROOF STEP]
using \<open>w \<in> set (after T (V qU))\<close>
[PROOF STATE]
proof (prove)
using this:
w \<in> Prefix_Tree.set (Prefix_Tree.after T (V qU))

goal (1 subgoal):
 1. u @ w \<in> Prefix_Tree.set T
[PROOF STEP]
unfolding after_set \<open>u = V qU\<close>[symmetric]
[PROOF STATE]
proof (prove)
using this:
w \<in> Set.insert [] {xs'. u @ xs' \<in> Prefix_Tree.set T}

goal (1 subgoal):
 1. u @ w \<in> Prefix_Tree.set T
[PROOF STEP]
using \<open>u \<in> V ` reachable_states M1\<close> assms(11)
[PROOF STATE]
proof (prove)
using this:
w \<in> Set.insert [] {xs'. u @ xs' \<in> Prefix_Tree.set T}
u \<in> V ` reachable_states M1
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. u @ w \<in> Prefix_Tree.set T
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u @ w \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
u @ w \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "\<beta>@w \<in> set T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<beta> @ w \<in> Prefix_Tree.set T
[PROOF STEP]
using \<open>w \<in> set (after T (V qTarget))\<close>
[PROOF STATE]
proof (prove)
using this:
w \<in> Prefix_Tree.set (Prefix_Tree.after T (V qTarget))

goal (1 subgoal):
 1. \<beta> @ w \<in> Prefix_Tree.set T
[PROOF STEP]
unfolding after_set \<open>\<beta> = V qTarget\<close>
[PROOF STATE]
proof (prove)
using this:
w \<in> Set.insert [] {xs'. V qTarget @ xs' \<in> Prefix_Tree.set T}

goal (1 subgoal):
 1. V qTarget @ w \<in> Prefix_Tree.set T
[PROOF STEP]
using \<open>qTarget \<in> reachable_states M1\<close> assms(11)
[PROOF STATE]
proof (prove)
using this:
w \<in> Set.insert [] {xs'. V qTarget @ xs' \<in> Prefix_Tree.set T}
qTarget \<in> reachable_states M1
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. V qTarget @ w \<in> Prefix_Tree.set T
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<beta> @ w \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(u @ w \<in> L M1) \<noteq> (\<beta> @ w \<in> L M1)
u @ w \<in> Prefix_Tree.set T
\<beta> @ w \<in> Prefix_Tree.set T
[PROOF STEP]
have "(u@w \<in> L M2) \<noteq> (\<beta>@w \<in> L M2)"
[PROOF STATE]
proof (prove)
using this:
(u @ w \<in> L M1) \<noteq> (\<beta> @ w \<in> L M1)
u @ w \<in> Prefix_Tree.set T
\<beta> @ w \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. (u @ w \<in> L M2) \<noteq> (\<beta> @ w \<in> L M2)
[PROOF STEP]
using \<open>L M1 \<inter> set T = L M2 \<inter> set T\<close>
[PROOF STATE]
proof (prove)
using this:
(u @ w \<in> L M1) \<noteq> (\<beta> @ w \<in> L M1)
u @ w \<in> Prefix_Tree.set T
\<beta> @ w \<in> Prefix_Tree.set T
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T

goal (1 subgoal):
 1. (u @ w \<in> L M2) \<noteq> (\<beta> @ w \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(u @ w \<in> L M2) \<noteq> (\<beta> @ w \<in> L M2)

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(u @ w \<in> L M2) \<noteq> (\<beta> @ w \<in> L M2)
[PROOF STEP]
have "(u@w \<in> L M2) \<noteq> (?w@w \<in> L M2)"
[PROOF STATE]
proof (prove)
using this:
(u @ w \<in> L M2) \<noteq> (\<beta> @ w \<in> L M2)

goal (1 subgoal):
 1. (u @ w \<in> L M2) \<noteq> ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2)
[PROOF STEP]
unfolding \<open>(?w @ w \<in> L M2) = (\<beta>@w \<in> L M2)\<close>
[PROOF STATE]
proof (prove)
using this:
(u @ w \<in> L M2) \<noteq> (\<beta> @ w \<in> L M2)

goal (1 subgoal):
 1. (u @ w \<in> L M2) \<noteq> (\<beta> @ w \<in> L M2)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(u @ w \<in> L M2) \<noteq> ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2)

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(u @ w \<in> L M2) \<noteq> ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2)

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "(u@w \<in> L M2) = (w \<in> LS M2 (after_initial M2 u))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (u @ w \<in> L M2) = (w \<in> LS M2 (after_initial M2 u))
[PROOF STEP]
by (metis (no_types, lifting) "**" Int_iff \<open>L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T\<close> \<open>u \<in> V ` reachable_states M1\<close> after_language_iff assms(11) assms(2) inter_eq_subsetI)
[PROOF STATE]
proof (state)
this:
(u @ w \<in> L M2) = (w \<in> LS M2 (after_initial M2 u))

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(u @ w \<in> L M2) = (w \<in> LS M2 (after_initial M2 u))

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
have "(?w@w \<in> L M2) = (w \<in> LS M2 (after_initial M2 ?w))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2) = (w \<in> LS M2 (after_initial M2 (V (t_source t) @ [(t_input t, t_output t)])))
[PROOF STEP]
using assms(10)
[PROOF STATE]
proof (prove)
using this:
V (t_source t) @ [(t_input t, t_output t)] \<in> L M2

goal (1 subgoal):
 1. ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2) = (w \<in> LS M2 (after_initial M2 (V (t_source t) @ [(t_input t, t_output t)])))
[PROOF STEP]
unfolding \<alpha>[symmetric] xy[symmetric]
[PROOF STATE]
proof (prove)
using this:
\<alpha> @ [xy] \<in> L M2

goal (1 subgoal):
 1. ((\<alpha> @ [xy]) @ w \<in> L M2) = (w \<in> LS M2 (after_initial M2 (\<alpha> @ [xy])))
[PROOF STEP]
by (metis assms(2) observable_after_language_append observable_after_language_none)
[PROOF STATE]
proof (state)
this:
((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2) = (w \<in> LS M2 (after_initial M2 (V (t_source t) @ [(t_input t, t_output t)])))

goal (1 subgoal):
 1. \<And>u. \<lbrakk>u \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 u (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(u @ w \<in> L M2) \<noteq> ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2)
(u @ w \<in> L M2) = (w \<in> LS M2 (after_initial M2 u))
((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2) = (w \<in> LS M2 (after_initial M2 (V (t_source t) @ [(t_input t, t_output t)])))
[PROOF STEP]
show "\<not>converge M2 u ?w"
[PROOF STATE]
proof (prove)
using this:
(u @ w \<in> L M2) \<noteq> ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2)
(u @ w \<in> L M2) = (w \<in> LS M2 (after_initial M2 u))
((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2) = (w \<in> LS M2 (after_initial M2 (V (t_source t) @ [(t_input t, t_output t)])))

goal (1 subgoal):
 1. \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
using converge.elims(2)
[PROOF STATE]
proof (prove)
using this:
(u @ w \<in> L M2) \<noteq> ((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2)
(u @ w \<in> L M2) = (w \<in> LS M2 (after_initial M2 u))
((V (t_source t) @ [(t_input t, t_output t)]) @ w \<in> L M2) = (w \<in> LS M2 (after_initial M2 (V (t_source t) @ [(t_input t, t_output t)])))
\<lbrakk>converge ?x ?xa ?xb; \<And>M \<pi> \<tau>. \<lbrakk>?x = M; ?xa = \<pi>; ?xb = \<tau>; \<pi> \<in> L M \<and> \<tau> \<in> L M \<and> LS M (after_initial M \<pi>) = LS M (after_initial M \<tau>)\<rbrakk> \<Longrightarrow> ?P\<rbrakk> \<Longrightarrow> ?P

goal (1 subgoal):
 1. \<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> converge M2 u (V (t_source t) @ [(t_input t, t_output t)])

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?u2 \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 ?u2 (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 ?u2 (V (t_source t) @ [(t_input t, t_output t)])

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<lbrakk>?u2 \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 ?u2 (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 ?u2 (V (t_source t) @ [(t_input t, t_output t)])

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
have "\<And> v . v \<in> (V ` reachable_states M1) \<Longrightarrow> \<not>converge M1 ?w v \<Longrightarrow> \<not>converge M2 ?w v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>v. \<lbrakk>v \<in> V ` reachable_states M1; \<not> converge M1 (V (t_source t) @ [(t_input t, t_output t)]) v\<rbrakk> \<Longrightarrow> \<not> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) v
[PROOF STEP]
using calculation
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?u2 \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 ?u2 (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 ?u2 (V (t_source t) @ [(t_input t, t_output t)])

goal (1 subgoal):
 1. \<And>v. \<lbrakk>v \<in> V ` reachable_states M1; \<not> converge M1 (V (t_source t) @ [(t_input t, t_output t)]) v\<rbrakk> \<Longrightarrow> \<not> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) v
[PROOF STEP]
unfolding converge_sym[where v="?w"]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?u2 \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 (V (t_source t) @ [(t_input t, t_output t)]) ?u2\<rbrakk> \<Longrightarrow> \<not> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) ?u2

goal (1 subgoal):
 1. \<And>v. \<lbrakk>v \<in> V ` reachable_states M1; \<not> converge M1 (V (t_source t) @ [(t_input t, t_output t)]) v\<rbrakk> \<Longrightarrow> \<not> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) v
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>?v2 \<in> V ` reachable_states M1; \<not> converge M1 (V (t_source t) @ [(t_input t, t_output t)]) ?v2\<rbrakk> \<Longrightarrow> \<not> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) ?v2

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?u2 \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 ?u2 (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 ?u2 (V (t_source t) @ [(t_input t, t_output t)])
\<lbrakk>?v2 \<in> V ` reachable_states M1; \<not> converge M1 (V (t_source t) @ [(t_input t, t_output t)]) ?v2\<rbrakk> \<Longrightarrow> \<not> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) ?v2
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?u2 \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 ?u2 (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 ?u2 (V (t_source t) @ [(t_input t, t_output t)])
\<lbrakk>?v2 \<in> V ` reachable_states M1; \<not> converge M1 (V (t_source t) @ [(t_input t, t_output t)]) ?v2\<rbrakk> \<Longrightarrow> \<not> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) ?v2

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
using assms(12)
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?u2 \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 ?u2 (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 ?u2 (V (t_source t) @ [(t_input t, t_output t)])
\<lbrakk>?v2 \<in> V ` reachable_states M1; \<not> converge M1 (V (t_source t) @ [(t_input t, t_output t)]) ?v2\<rbrakk> \<Longrightarrow> \<not> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) ?v2
preserves_divergence M1 M2 (V ` reachable_states M1)

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})
[PROOF STEP]
unfolding preserves_divergence.simps
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?u2 \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 ?u2 (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 ?u2 (V (t_source t) @ [(t_input t, t_output t)])
\<lbrakk>?v2 \<in> V ` reachable_states M1; \<not> converge M1 (V (t_source t) @ [(t_input t, t_output t)]) ?v2\<rbrakk> \<Longrightarrow> \<not> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) ?v2
\<forall>\<alpha>\<in>L M1 \<inter> V ` reachable_states M1. \<forall>\<beta>\<in>L M1 \<inter> V ` reachable_states M1. \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>

goal (1 subgoal):
 1. \<forall>\<alpha>\<in>L M1 \<inter> (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)}). \<forall>\<beta>\<in>L M1 \<inter> (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)}). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
unfolding * **
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?u2 \<in> Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1); \<not> converge M1 ?u2 (V (t_source t) @ [(t_input t, t_output t)])\<rbrakk> \<Longrightarrow> \<not> converge M2 ?u2 (V (t_source t) @ [(t_input t, t_output t)])
\<lbrakk>?v2 \<in> V ` reachable_states M1; \<not> converge M1 (V (t_source t) @ [(t_input t, t_output t)]) ?v2\<rbrakk> \<Longrightarrow> \<not> converge M2 (V (t_source t) @ [(t_input t, t_output t)]) ?v2
\<forall>\<alpha>\<in>V ` reachable_states M1. \<forall>\<beta>\<in>V ` reachable_states M1. \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>

goal (1 subgoal):
 1. \<forall>\<alpha>\<in>Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1). \<forall>\<beta>\<in>Set.insert (V (t_source t) @ [(t_input t, t_output t)]) (V ` reachable_states M1). \<not> converge M1 \<alpha> \<beta> \<longrightarrow> \<not> converge M2 \<alpha> \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)})

goal (1 subgoal):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
have "\<And> \<gamma> x y . length (\<gamma>@[(x,y)]) \<le> m - size_r M1 \<Longrightarrow>
                  \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<Longrightarrow>
                  x \<in> inputs M1 \<Longrightarrow> y \<in> outputs M1 \<Longrightarrow>
                  L M1 \<inter> ((V ` reachable_states M1) \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))}) = L M2 \<inter>  ((V ` reachable_states M1) \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))})
                  \<and> preserves_divergence M1 M2 ((V ` reachable_states M1) \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
fix \<gamma> x y
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
assume "length (\<gamma>@[(x,y)]) \<le> m - size_r M1"
    and    "\<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)]))"
    and    "x \<in> inputs M1"
    and    "y \<in> outputs M1"
[PROOF STATE]
proof (state)
this:
length (\<gamma> @ [(x, y)]) \<le> m - size_r M1
\<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)]))
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1

goal (2 subgoals):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
have "(after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) = qTarget"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. after_initial M1 (V (t_source t) @ [(t_input t, t_output t)]) = qTarget
[PROOF STEP]
using \<open>converge M1 (\<alpha>@[xy]) \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
converge M1 (\<alpha> @ [xy]) \<beta>

goal (1 subgoal):
 1. after_initial M1 (V (t_source t) @ [(t_input t, t_output t)]) = qTarget
[PROOF STEP]
unfolding \<alpha>[symmetric] xy[symmetric] qTarget \<beta>[symmetric]
[PROOF STATE]
proof (prove)
using this:
converge M1 (\<alpha> @ [xy]) \<beta>

goal (1 subgoal):
 1. after_initial M1 (\<alpha> @ [xy]) = after_initial M1 \<beta>
[PROOF STEP]
using \<open>\<alpha> @ [xy] \<in> L M1\<close> \<open>\<beta> \<in> L M1\<close> assms(1) assms(3) convergence_minimal
[PROOF STATE]
proof (prove)
using this:
converge M1 (\<alpha> @ [xy]) \<beta>
\<alpha> @ [xy] \<in> L M1
\<beta> \<in> L M1
observable M1
minimal M1
\<lbrakk>minimal ?M; observable ?M; ?\<alpha> \<in> L ?M; ?\<beta> \<in> L ?M\<rbrakk> \<Longrightarrow> converge ?M ?\<alpha> ?\<beta> = (after_initial ?M ?\<alpha> = after_initial ?M ?\<beta>)

goal (1 subgoal):
 1. after_initial M1 (\<alpha> @ [xy]) = after_initial M1 \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
after_initial M1 (V (t_source t) @ [(t_input t, t_output t)]) = qTarget

goal (2 subgoals):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
after_initial M1 (V (t_source t) @ [(t_input t, t_output t)]) = qTarget
[PROOF STEP]
have "\<gamma> \<in> LS M1 qTarget"
[PROOF STATE]
proof (prove)
using this:
after_initial M1 (V (t_source t) @ [(t_input t, t_output t)]) = qTarget

goal (1 subgoal):
 1. \<gamma> \<in> LS M1 qTarget
[PROOF STEP]
using \<open>\<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)]))\<close>
[PROOF STATE]
proof (prove)
using this:
after_initial M1 (V (t_source t) @ [(t_input t, t_output t)]) = qTarget
\<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)]))

goal (1 subgoal):
 1. \<gamma> \<in> LS M1 qTarget
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<gamma> \<in> LS M1 qTarget

goal (2 subgoals):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<gamma> \<in> LS M1 qTarget
[PROOF STEP]
have "\<gamma>@[(x,y)] \<in> list.set (traces_to_check M1 qTarget k)"
[PROOF STATE]
proof (prove)
using this:
\<gamma> \<in> LS M1 qTarget

goal (1 subgoal):
 1. \<gamma> @ [(x, y)] \<in> list.set (traces_to_check M1 qTarget k)
[PROOF STEP]
unfolding traces_to_check_set[OF assms(1) \<open>qTarget \<in> states M1\<close>] k
[PROOF STATE]
proof (prove)
using this:
\<gamma> \<in> LS M1 qTarget

goal (1 subgoal):
 1. \<gamma> @ [(x, y)] \<in> {\<gamma> @ [(x, y)] |\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<and> \<gamma> \<in> LS M1 qTarget \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1}
[PROOF STEP]
using \<open>length (\<gamma>@[(x,y)]) \<le> m - size_r M1\<close> \<open>x \<in> inputs M1\<close> \<open>y \<in> outputs M1\<close>
[PROOF STATE]
proof (prove)
using this:
\<gamma> \<in> LS M1 qTarget
length (\<gamma> @ [(x, y)]) \<le> m - size_r M1
x \<in> FSM.inputs M1
y \<in> FSM.outputs M1

goal (1 subgoal):
 1. \<gamma> @ [(x, y)] \<in> {\<gamma> @ [(x, y)] |\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<and> \<gamma> \<in> LS M1 qTarget \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<gamma> @ [(x, y)] \<in> list.set (traces_to_check M1 qTarget k)

goal (2 subgoals):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<gamma> @ [(x, y)] \<in> list.set (traces_to_check M1 qTarget k)
[PROOF STEP]
have "(\<gamma>@[(x,y)]) \<in> list.set ttc"
[PROOF STATE]
proof (prove)
using this:
\<gamma> @ [(x, y)] \<in> list.set (traces_to_check M1 qTarget k)

goal (1 subgoal):
 1. \<gamma> @ [(x, y)] \<in> list.set ttc
[PROOF STEP]
unfolding ttc
[PROOF STATE]
proof (prove)
using this:
\<gamma> @ [(x, y)] \<in> list.set (traces_to_check M1 qTarget k)

goal (1 subgoal):
 1. \<gamma> @ [(x, y)] \<in> list.set ([] # traces_to_check M1 qTarget k)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<gamma> @ [(x, y)] \<in> list.set ttc

goal (2 subgoals):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
have "\<And> \<gamma>' . \<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> \<gamma>' \<in> list.set ttc \<and> \<gamma>' \<in> LS M1 qTarget"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<gamma>'. \<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> \<gamma>' \<in> list.set ttc \<and> \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<gamma>'. \<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> \<gamma>' \<in> list.set ttc
 2. \<And>\<gamma>'. \<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
fix \<gamma>'
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<gamma>'. \<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> \<gamma>' \<in> list.set ttc
 2. \<And>\<gamma>'. \<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
assume "\<gamma>' \<in> list.set (prefixes \<gamma>)"
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> list.set (prefixes \<gamma>)

goal (2 subgoals):
 1. \<And>\<gamma>'. \<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> \<gamma>' \<in> list.set ttc
 2. \<And>\<gamma>'. \<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<gamma>' \<in> list.set (prefixes \<gamma>)
[PROOF STEP]
obtain \<gamma>'' where "\<gamma> = \<gamma>'@\<gamma>''"
[PROOF STATE]
proof (prove)
using this:
\<gamma>' \<in> list.set (prefixes \<gamma>)

goal (1 subgoal):
 1. (\<And>\<gamma>''. \<gamma> = \<gamma>' @ \<gamma>'' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prefixes_set_ob
[PROOF STATE]
proof (prove)
using this:
\<gamma>' \<in> list.set (prefixes \<gamma>)
\<lbrakk>?xs \<in> list.set (prefixes ?xss); \<And>xs'. ?xss = ?xs @ xs' \<Longrightarrow> ?thesis\<rbrakk> \<Longrightarrow> ?thesis

goal (1 subgoal):
 1. (\<And>\<gamma>''. \<gamma> = \<gamma>' @ \<gamma>'' \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<gamma> = \<gamma>' @ \<gamma>''

goal (2 subgoals):
 1. \<And>\<gamma>'. \<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> \<gamma>' \<in> list.set ttc
 2. \<And>\<gamma>'. \<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<gamma> = \<gamma>' @ \<gamma>''
[PROOF STEP]
show "\<gamma>' \<in> LS M1 qTarget"
[PROOF STATE]
proof (prove)
using this:
\<gamma> = \<gamma>' @ \<gamma>''

goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
using \<open>\<gamma> \<in> LS M1 qTarget\<close> language_prefix
[PROOF STATE]
proof (prove)
using this:
\<gamma> = \<gamma>' @ \<gamma>''
\<gamma> \<in> LS M1 qTarget
?io1.0 @ ?io2.0 \<in> LS ?M ?q \<Longrightarrow> ?io1.0 \<in> LS ?M ?q

goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> LS M1 qTarget

goal (1 subgoal):
 1. \<And>\<gamma>'. \<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> \<gamma>' \<in> list.set ttc
[PROOF STEP]
show "\<gamma>' \<in> list.set ttc"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma>' \<in> list.set ttc
[PROOF STEP]
proof (cases \<gamma>' rule: rev_cases)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<gamma>' = [] \<Longrightarrow> \<gamma>' \<in> list.set ttc
 2. \<And>ys y. \<gamma>' = ys @ [y] \<Longrightarrow> \<gamma>' \<in> list.set ttc
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
\<gamma>' = []

goal (2 subgoals):
 1. \<gamma>' = [] \<Longrightarrow> \<gamma>' \<in> list.set ttc
 2. \<And>ys y. \<gamma>' = ys @ [y] \<Longrightarrow> \<gamma>' \<in> list.set ttc
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<gamma>' = []
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<gamma>' = []

goal (1 subgoal):
 1. \<gamma>' \<in> list.set ttc
[PROOF STEP]
unfolding ttc
[PROOF STATE]
proof (prove)
using this:
\<gamma>' = []

goal (1 subgoal):
 1. \<gamma>' \<in> list.set ([] # traces_to_check M1 qTarget k)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> list.set ttc

goal (1 subgoal):
 1. \<And>ys y. \<gamma>' = ys @ [y] \<Longrightarrow> \<gamma>' \<in> list.set ttc
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>ys y. \<gamma>' = ys @ [y] \<Longrightarrow> \<gamma>' \<in> list.set ttc
[PROOF STEP]
case (snoc ioI ioL)
[PROOF STATE]
proof (state)
this:
\<gamma>' = ioI @ [ioL]

goal (1 subgoal):
 1. \<And>ys y. \<gamma>' = ys @ [y] \<Longrightarrow> \<gamma>' \<in> list.set ttc
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<gamma>' = ioI @ [ioL]
[PROOF STEP]
obtain xL yL where "\<gamma>' = ioI@[(xL,yL)]"
[PROOF STATE]
proof (prove)
using this:
\<gamma>' = ioI @ [ioL]

goal (1 subgoal):
 1. (\<And>xL yL. \<gamma>' = ioI @ [(xL, yL)] \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using prod.exhaust
[PROOF STATE]
proof (prove)
using this:
\<gamma>' = ioI @ [ioL]
(\<And>x1 x2. ?y = (x1, x2) \<Longrightarrow> ?P) \<Longrightarrow> ?P

goal (1 subgoal):
 1. (\<And>xL yL. \<gamma>' = ioI @ [(xL, yL)] \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
\<gamma>' = ioI @ [(xL, yL)]

goal (1 subgoal):
 1. \<And>ys y. \<gamma>' = ys @ [y] \<Longrightarrow> \<gamma>' \<in> list.set ttc
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<gamma>' = ioI @ [(xL, yL)]
[PROOF STEP]
have "xL \<in> inputs M1" and "yL \<in> outputs M1"
[PROOF STATE]
proof (prove)
using this:
\<gamma>' = ioI @ [(xL, yL)]

goal (1 subgoal):
 1. xL \<in> FSM.inputs M1 &&& yL \<in> FSM.outputs M1
[PROOF STEP]
using language_io[OF \<open>\<gamma>' \<in> LS M1 qTarget\<close>, of xL yL]
[PROOF STATE]
proof (prove)
using this:
\<gamma>' = ioI @ [(xL, yL)]
(xL, yL) \<in> list.set \<gamma>' \<Longrightarrow> xL \<in> FSM.inputs M1
(xL, yL) \<in> list.set \<gamma>' \<Longrightarrow> yL \<in> FSM.outputs M1

goal (1 subgoal):
 1. xL \<in> FSM.inputs M1 &&& yL \<in> FSM.outputs M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
xL \<in> FSM.inputs M1
yL \<in> FSM.outputs M1

goal (1 subgoal):
 1. \<And>ys y. \<gamma>' = ys @ [y] \<Longrightarrow> \<gamma>' \<in> list.set ttc
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
xL \<in> FSM.inputs M1
yL \<in> FSM.outputs M1

goal (1 subgoal):
 1. \<And>ys y. \<gamma>' = ys @ [y] \<Longrightarrow> \<gamma>' \<in> list.set ttc
[PROOF STEP]
have "length \<gamma>' \<le> m - size_r M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. length \<gamma>' \<le> m - size_r M1
[PROOF STEP]
using \<open>length (\<gamma>@[(x,y)]) \<le> m - size_r M1\<close> \<open>\<gamma> = \<gamma>'@\<gamma>''\<close>
[PROOF STATE]
proof (prove)
using this:
length (\<gamma> @ [(x, y)]) \<le> m - size_r M1
\<gamma> = \<gamma>' @ \<gamma>''

goal (1 subgoal):
 1. length \<gamma>' \<le> m - size_r M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
length \<gamma>' \<le> m - size_r M1

goal (1 subgoal):
 1. \<And>ys y. \<gamma>' = ys @ [y] \<Longrightarrow> \<gamma>' \<in> list.set ttc
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
length \<gamma>' \<le> m - size_r M1

goal (1 subgoal):
 1. \<And>ys y. \<gamma>' = ys @ [y] \<Longrightarrow> \<gamma>' \<in> list.set ttc
[PROOF STEP]
have "ioI \<in> LS M1 qTarget"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ioI \<in> LS M1 qTarget
[PROOF STEP]
using \<open>\<gamma>' \<in> LS M1 qTarget\<close> \<open>\<gamma>' = ioI@[(xL,yL)]\<close> language_prefix
[PROOF STATE]
proof (prove)
using this:
\<gamma>' \<in> LS M1 qTarget
\<gamma>' = ioI @ [(xL, yL)]
?io1.0 @ ?io2.0 \<in> LS ?M ?q \<Longrightarrow> ?io1.0 \<in> LS ?M ?q

goal (1 subgoal):
 1. ioI \<in> LS M1 qTarget
[PROOF STEP]
by metis
[PROOF STATE]
proof (state)
this:
ioI \<in> LS M1 qTarget

goal (1 subgoal):
 1. \<And>ys y. \<gamma>' = ys @ [y] \<Longrightarrow> \<gamma>' \<in> list.set ttc
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
xL \<in> FSM.inputs M1
yL \<in> FSM.outputs M1
length \<gamma>' \<le> m - size_r M1
ioI \<in> LS M1 qTarget
[PROOF STEP]
have "\<gamma>' \<in> list.set (traces_to_check M1 qTarget k)"
[PROOF STATE]
proof (prove)
using this:
xL \<in> FSM.inputs M1
yL \<in> FSM.outputs M1
length \<gamma>' \<le> m - size_r M1
ioI \<in> LS M1 qTarget

goal (1 subgoal):
 1. \<gamma>' \<in> list.set (traces_to_check M1 qTarget k)
[PROOF STEP]
unfolding traces_to_check_set[OF assms(1) \<open>qTarget \<in> states M1\<close>] k \<open>\<gamma>' = ioI@[(xL,yL)]\<close>
[PROOF STATE]
proof (prove)
using this:
xL \<in> FSM.inputs M1
yL \<in> FSM.outputs M1
length (ioI @ [(xL, yL)]) \<le> m - size_r M1
ioI \<in> LS M1 qTarget

goal (1 subgoal):
 1. ioI @ [(xL, yL)] \<in> {\<gamma> @ [(x, y)] |\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<and> \<gamma> \<in> LS M1 qTarget \<and> x \<in> FSM.inputs M1 \<and> y \<in> FSM.outputs M1}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> list.set (traces_to_check M1 qTarget k)

goal (1 subgoal):
 1. \<And>ys y. \<gamma>' = ys @ [y] \<Longrightarrow> \<gamma>' \<in> list.set ttc
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<gamma>' \<in> list.set (traces_to_check M1 qTarget k)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<gamma>' \<in> list.set (traces_to_check M1 qTarget k)

goal (1 subgoal):
 1. \<gamma>' \<in> list.set ttc
[PROOF STEP]
unfolding ttc
[PROOF STATE]
proof (prove)
using this:
\<gamma>' \<in> list.set (traces_to_check M1 qTarget k)

goal (1 subgoal):
 1. \<gamma>' \<in> list.set ([] # traces_to_check M1 qTarget k)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> list.set ttc

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> list.set ttc

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?\<gamma>'2 \<in> list.set (prefixes \<gamma>) \<Longrightarrow> ?\<gamma>'2 \<in> list.set ttc \<and> ?\<gamma>'2 \<in> LS M1 qTarget

goal (2 subgoals):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
 2. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
show "L M1 \<inter> ((V ` reachable_states M1) \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))}) = L M2 \<inter>  ((V ` reachable_states M1) \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
have "L M1 \<inter> (V ` reachable_states M1) = L M2 \<inter> (V ` reachable_states M1)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
[PROOF STEP]
using assms(11) \<open>L M1 \<inter> set T = L M2 \<inter> set T\<close>
[PROOF STATE]
proof (prove)
using this:
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T

goal (1 subgoal):
 1. L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
have "L M1 \<inter> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))} = L M2 \<inter> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}
[PROOF STEP]
have *:"{\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {\<alpha>@[xy],\<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))}
                = {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {\<alpha>@[xy],\<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<union> {(\<alpha>@[xy])@(\<gamma>@[(x,y)]),\<beta>@(\<gamma>@[(x,y)])}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} = {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<union> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
[PROOF STEP]
unfolding prefixes_set_Cons_insert
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> Set.insert (\<gamma> @ [(x, y)]) (list.set (prefixes \<gamma>))} = {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<union> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
{\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} = {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<union> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}

goal (1 subgoal):
 1. L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}
[PROOF STEP]
have "L M1 \<inter> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {\<alpha>@[xy],\<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = L M2 \<inter> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {\<alpha>@[xy],\<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}
[PROOF STEP]
have "\<And> io . io \<in> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {\<alpha>@[xy],\<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<Longrightarrow> (io \<in> L M1) = (io \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>io. io \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<Longrightarrow> (io \<in> L M1) = (io \<in> L M2)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>io. io \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<Longrightarrow> (io \<in> L M1) = (io \<in> L M2)
[PROOF STEP]
fix io
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>io. io \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<Longrightarrow> (io \<in> L M1) = (io \<in> L M2)
[PROOF STEP]
assume "io \<in> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {\<alpha>@[xy],\<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}"
[PROOF STATE]
proof (state)
this:
io \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}

goal (1 subgoal):
 1. \<And>io. io \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<Longrightarrow> (io \<in> L M1) = (io \<in> L M2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}
[PROOF STEP]
obtain \<gamma>' where "io \<in> {\<alpha>@[xy]@\<gamma>',\<beta>@\<gamma>'}" and "\<gamma>' \<in> list.set (prefixes \<gamma>)"
[PROOF STATE]
proof (prove)
using this:
io \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}

goal (1 subgoal):
 1. (\<And>\<gamma>'. \<lbrakk>io \<in> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'}; \<gamma>' \<in> list.set (prefixes \<gamma>)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
io \<in> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'}
\<gamma>' \<in> list.set (prefixes \<gamma>)

goal (1 subgoal):
 1. \<And>io. io \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<Longrightarrow> (io \<in> L M1) = (io \<in> L M2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
io \<in> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'}
\<gamma>' \<in> list.set (prefixes \<gamma>)
[PROOF STEP]
have "\<gamma>' \<in> list.set ttc" and "\<gamma>' \<in> LS M1 qTarget"
[PROOF STATE]
proof (prove)
using this:
io \<in> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'}
\<gamma>' \<in> list.set (prefixes \<gamma>)

goal (1 subgoal):
 1. \<gamma>' \<in> list.set ttc &&& \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
using \<open>\<And> \<gamma>' . \<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> \<gamma>' \<in> list.set ttc \<and> \<gamma>' \<in> LS M1 qTarget\<close>
[PROOF STATE]
proof (prove)
using this:
io \<in> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'}
\<gamma>' \<in> list.set (prefixes \<gamma>)
?\<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> ?\<gamma>' \<in> list.set ttc \<and> ?\<gamma>' \<in> LS M1 qTarget

goal (1 subgoal):
 1. \<gamma>' \<in> list.set ttc &&& \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
by blast+
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> list.set ttc
\<gamma>' \<in> LS M1 qTarget

goal (1 subgoal):
 1. \<And>io. io \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<Longrightarrow> (io \<in> L M1) = (io \<in> L M2)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> list.set ttc
\<gamma>' \<in> LS M1 qTarget

goal (1 subgoal):
 1. \<And>io. io \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<Longrightarrow> (io \<in> L M1) = (io \<in> L M2)
[PROOF STEP]
have "[] \<in> Prefix_Tree.set (dist_fun (length \<gamma>') (FSM.after M1 qTarget \<gamma>'))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. [] \<in> Prefix_Tree.set (dist_fun (length \<gamma>') (FSM.after M1 qTarget \<gamma>'))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
[] \<in> Prefix_Tree.set (dist_fun (length \<gamma>') (FSM.after M1 qTarget \<gamma>'))

goal (1 subgoal):
 1. \<And>io. io \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<Longrightarrow> (io \<in> L M1) = (io \<in> L M2)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
\<gamma>' \<in> list.set ttc
\<gamma>' \<in> LS M1 qTarget
[] \<in> Prefix_Tree.set (dist_fun (length \<gamma>') (FSM.after M1 qTarget \<gamma>'))
[PROOF STEP]
have "L M1 \<inter> {\<alpha>@[xy]@\<gamma>',\<beta>@\<gamma>'} = L M2 \<inter> {\<alpha>@[xy]@\<gamma>',\<beta>@\<gamma>'}"
[PROOF STATE]
proof (prove)
using this:
\<gamma>' \<in> list.set ttc
\<gamma>' \<in> LS M1 qTarget
[] \<in> Prefix_Tree.set (dist_fun (length \<gamma>') (FSM.after M1 qTarget \<gamma>'))

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'} = L M2 \<inter> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'}
[PROOF STEP]
using handleTrace_foldl_props_1[of \<gamma>' "[]"]
[PROOF STATE]
proof (prove)
using this:
\<gamma>' \<in> list.set ttc
\<gamma>' \<in> LS M1 qTarget
[] \<in> Prefix_Tree.set (dist_fun (length \<gamma>') (FSM.after M1 qTarget \<gamma>'))
\<lbrakk>\<gamma>' \<in> list.set ttc; \<gamma>' \<in> LS M1 qTarget; [] \<in> Prefix_Tree.set (dist_fun (Suc (length \<gamma>')) (FSM.after M1 qTarget \<gamma>'))\<rbrakk> \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ \<gamma>' @ [], \<beta> @ \<gamma>' @ []} = L M2 \<inter> {\<alpha> @ [xy] @ \<gamma>' @ [], \<beta> @ \<gamma>' @ []}

goal (1 subgoal):
 1. L M1 \<inter> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'} = L M2 \<inter> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'} = L M2 \<inter> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'}

goal (1 subgoal):
 1. \<And>io. io \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<Longrightarrow> (io \<in> L M1) = (io \<in> L M2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'} = L M2 \<inter> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'}
[PROOF STEP]
show "(io \<in> L M1) = (io \<in> L M2)"
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'} = L M2 \<inter> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'}

goal (1 subgoal):
 1. (io \<in> L M1) = (io \<in> L M2)
[PROOF STEP]
using \<open>io \<in> {\<alpha>@[xy]@\<gamma>',\<beta>@\<gamma>'}\<close>
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'} = L M2 \<inter> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'}
io \<in> {\<alpha> @ [xy] @ \<gamma>', \<beta> @ \<gamma>'}

goal (1 subgoal):
 1. (io \<in> L M1) = (io \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(io \<in> L M1) = (io \<in> L M2)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?io2 \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<Longrightarrow> (?io2 \<in> L M1) = (?io2 \<in> L M2)

goal (1 subgoal):
 1. L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?io2 \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<Longrightarrow> (?io2 \<in> L M1) = (?io2 \<in> L M2)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
?io2 \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<Longrightarrow> (?io2 \<in> L M1) = (?io2 \<in> L M2)

goal (1 subgoal):
 1. L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}

goal (1 subgoal):
 1. L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}

goal (1 subgoal):
 1. L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}
[PROOF STEP]
have "L M1 \<inter> {(\<alpha>@[xy])@(\<gamma>@[(x,y)]),\<beta>@(\<gamma>@[(x,y)])} = L M2 \<inter> {(\<alpha>@[xy])@(\<gamma>@[(x,y)]),\<beta>@(\<gamma>@[(x,y)])}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
[PROOF STEP]
proof (cases "(\<gamma>@[(x,y)]) \<in> LS M1 qTarget")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<gamma> @ [(x, y)] \<in> LS M1 qTarget \<Longrightarrow> L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
 2. \<gamma> @ [(x, y)] \<notin> LS M1 qTarget \<Longrightarrow> L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
\<gamma> @ [(x, y)] \<in> LS M1 qTarget

goal (2 subgoals):
 1. \<gamma> @ [(x, y)] \<in> LS M1 qTarget \<Longrightarrow> L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
 2. \<gamma> @ [(x, y)] \<notin> LS M1 qTarget \<Longrightarrow> L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
[PROOF STEP]
using handleTrace_foldl_props_1[OF \<open>(\<gamma>@[(x,y)]) \<in> list.set ttc\<close> True, of "[]"]
[PROOF STATE]
proof (prove)
using this:
[] \<in> Prefix_Tree.set (dist_fun (Suc (length (\<gamma> @ [(x, y)]))) (FSM.after M1 qTarget (\<gamma> @ [(x, y)]))) \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ (\<gamma> @ [(x, y)]) @ [], \<beta> @ (\<gamma> @ [(x, y)]) @ []} = L M2 \<inter> {\<alpha> @ [xy] @ (\<gamma> @ [(x, y)]) @ [], \<beta> @ (\<gamma> @ [(x, y)]) @ []}

goal (1 subgoal):
 1. L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}

goal (1 subgoal):
 1. \<gamma> @ [(x, y)] \<notin> LS M1 qTarget \<Longrightarrow> L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<gamma> @ [(x, y)] \<notin> LS M1 qTarget \<Longrightarrow> L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<gamma> @ [(x, y)] \<notin> LS M1 qTarget

goal (1 subgoal):
 1. \<gamma> @ [(x, y)] \<notin> LS M1 qTarget \<Longrightarrow> L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
[PROOF STEP]
using handleTrace_foldl_props_2[OF \<open>(\<gamma>@[(x,y)]) \<in> list.set ttc\<close> False]
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> {\<alpha> @ [xy] @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {\<alpha> @ [xy] @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}

goal (1 subgoal):
 1. L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}

goal (1 subgoal):
 1. L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}
L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}
L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}

goal (1 subgoal):
 1. L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}
[PROOF STEP]
unfolding \<alpha>[symmetric] xy[symmetric] \<beta>[symmetric] *
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)}
L M1 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]} = L M2 \<inter> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}

goal (1 subgoal):
 1. L M1 \<inter> ({\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<union> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]}) = L M2 \<inter> ({\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes \<gamma>)} \<union> {(\<alpha> @ [xy]) @ \<gamma> @ [(x, y)], \<beta> @ \<gamma> @ [(x, y)]})
[PROOF STEP]
by (metis (no_types, lifting) Int_Un_distrib)
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
L M1 \<inter> V ` reachable_states M1 = L M2 \<inter> V ` reachable_states M1
L M1 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} = L M2 \<inter> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}

goal (1 subgoal):
 1. L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
by (metis (no_types, lifting) Int_Un_distrib)
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal (1 subgoal):
 1. \<And>\<gamma> x y. \<lbrakk>length (\<gamma> @ [(x, y)]) \<le> m - size_r M1; \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); x \<in> FSM.inputs M1; y \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
show "preserves_divergence M1 M2 ((V ` reachable_states M1) \<union> {\<omega>@\<omega>' | \<omega> \<omega>' . \<omega> \<in> {((V (t_source t)) @ [(t_input t,t_output t)]), (V (t_target t))} \<and> \<omega>' \<in> list.set (prefixes (\<gamma>@[(x,y)]))})"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
have "\<And> u v . u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<Longrightarrow>
                     v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<Longrightarrow>
                     \<not> converge M1 u v \<Longrightarrow>
                     \<not> converge M2 u v"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
fix u v
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
assume "u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})"
                   and "v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})"
                   and "\<not> converge M1 u v"
[PROOF STATE]
proof (state)
this:
u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
\<not> converge M1 u v

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
\<not> converge M1 u v
[PROOF STEP]
have "u \<in> L M1" and "v \<in> L M1" and "after_initial M1 u \<noteq> after_initial M1 v"
[PROOF STATE]
proof (prove)
using this:
u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
\<not> converge M1 u v

goal (1 subgoal):
 1. u \<in> L M1 &&& v \<in> L M1 &&& after_initial M1 u \<noteq> after_initial M1 v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u \<in> L M1
v \<in> L M1
after_initial M1 u \<noteq> after_initial M1 v

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> L M1
v \<in> L M1
after_initial M1 u \<noteq> after_initial M1 v
[PROOF STEP]
have "after_initial M1 u \<in> states M1"
              and "after_initial M1 v \<in> states M1"
[PROOF STATE]
proof (prove)
using this:
u \<in> L M1
v \<in> L M1
after_initial M1 u \<noteq> after_initial M1 v

goal (1 subgoal):
 1. after_initial M1 u \<in> FSM.states M1 &&& after_initial M1 v \<in> FSM.states M1
[PROOF STEP]
using after_is_state[OF assms(1)]
[PROOF STATE]
proof (prove)
using this:
u \<in> L M1
v \<in> L M1
after_initial M1 u \<noteq> after_initial M1 v
?io \<in> LS M1 ?q \<Longrightarrow> FSM.after M1 ?q ?io \<in> FSM.states M1

goal (1 subgoal):
 1. after_initial M1 u \<in> FSM.states M1 &&& after_initial M1 v \<in> FSM.states M1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
after_initial M1 u \<in> FSM.states M1
after_initial M1 v \<in> FSM.states M1

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
have pass_dist: "\<And> u . u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<Longrightarrow>
                     (\<exists> k . \<forall> w \<in> Prefix_Tree.set (dist_fun k (after_initial M1 u)) . (u@w \<in> L M1) = (u@w \<in> L M2))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>u. u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u. u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
fix u
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>u. u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
assume "u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})"
[PROOF STATE]
proof (state)
this:
u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal (1 subgoal):
 1. \<And>u. u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
consider "u \<in> V ` reachable_states M1" | "u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}"
[PROOF STATE]
proof (prove)
using this:
u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal (1 subgoal):
 1. \<lbrakk>u \<in> V ` reachable_states M1 \<Longrightarrow> thesis; u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> thesis\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<lbrakk>u \<in> V ` reachable_states M1 \<Longrightarrow> ?thesis2; u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> ?thesis2\<rbrakk> \<Longrightarrow> ?thesis2

goal (1 subgoal):
 1. \<And>u. u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>u \<in> V ` reachable_states M1 \<Longrightarrow> ?thesis2; u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> ?thesis2\<rbrakk> \<Longrightarrow> ?thesis2
[PROOF STEP]
show "(\<exists> k . \<forall> w \<in> Prefix_Tree.set (dist_fun k (after_initial M1 u)) . (u@w \<in> L M1) = (u@w \<in> L M2))"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>u \<in> V ` reachable_states M1 \<Longrightarrow> ?thesis2; u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> ?thesis2\<rbrakk> \<Longrightarrow> ?thesis2

goal (1 subgoal):
 1. \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. u \<in> V ` reachable_states M1 \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
 2. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
case 1
[PROOF STATE]
proof (state)
this:
u \<in> V ` reachable_states M1

goal (2 subgoals):
 1. u \<in> V ` reachable_states M1 \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
 2. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> V ` reachable_states M1
[PROOF STEP]
obtain qU where "qU \<in> reachable_states M1" and "V qU = u"
[PROOF STATE]
proof (prove)
using this:
u \<in> V ` reachable_states M1

goal (1 subgoal):
 1. (\<And>qU. \<lbrakk>qU \<in> reachable_states M1; V qU = u\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
qU \<in> reachable_states M1
V qU = u

goal (2 subgoals):
 1. u \<in> V ` reachable_states M1 \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
 2. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
have "after_initial M1 u = qU"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. after_initial M1 u = qU
[PROOF STEP]
by (metis \<open>V qU = u\<close> \<open>qU \<in> reachable_states M1\<close> assms(1) assms(9) is_state_cover_assignment_observable_after)
[PROOF STATE]
proof (state)
this:
after_initial M1 u = qU

goal (2 subgoals):
 1. u \<in> V ` reachable_states M1 \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
 2. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
have "\<And>w . w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u)) \<Longrightarrow> (u@w \<in> L M1) = (u@w \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>w. w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>w. w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
fix w
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>w. w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
assume "w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u))"
[PROOF STATE]
proof (state)
this:
w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u))

goal (1 subgoal):
 1. \<And>w. w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u))
[PROOF STEP]
have "w \<in> Prefix_Tree.set (Prefix_Tree.after T u)"
[PROOF STATE]
proof (prove)
using this:
w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u))

goal (1 subgoal):
 1. w \<in> Prefix_Tree.set (Prefix_Tree.after T u)
[PROOF STEP]
using assms(16)[OF \<open>qU \<in> reachable_states M1\<close>]
[PROOF STATE]
proof (prove)
using this:
w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u))
Prefix_Tree.set (dist_fun 0 qU) \<subseteq> Prefix_Tree.set (Prefix_Tree.after T (V qU))

goal (1 subgoal):
 1. w \<in> Prefix_Tree.set (Prefix_Tree.after T u)
[PROOF STEP]
unfolding \<open>V qU = u\<close> \<open>after_initial M1 u = qU\<close>
[PROOF STATE]
proof (prove)
using this:
w \<in> Prefix_Tree.set (dist_fun 0 qU)
Prefix_Tree.set (dist_fun 0 qU) \<subseteq> Prefix_Tree.set (Prefix_Tree.after T u)

goal (1 subgoal):
 1. w \<in> Prefix_Tree.set (Prefix_Tree.after T u)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
w \<in> Prefix_Tree.set (Prefix_Tree.after T u)

goal (1 subgoal):
 1. \<And>w. w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
w \<in> Prefix_Tree.set (Prefix_Tree.after T u)

goal (1 subgoal):
 1. \<And>w. w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
have "u \<in> set T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u \<in> Prefix_Tree.set T
[PROOF STEP]
using "1" assms(11)
[PROOF STATE]
proof (prove)
using this:
u \<in> V ` reachable_states M1
V ` reachable_states M1 \<subseteq> Prefix_Tree.set T

goal (1 subgoal):
 1. u \<in> Prefix_Tree.set T
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. \<And>w. w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
w \<in> Prefix_Tree.set (Prefix_Tree.after T u)
u \<in> Prefix_Tree.set T
[PROOF STEP]
have "u@w \<in> set T"
[PROOF STATE]
proof (prove)
using this:
w \<in> Prefix_Tree.set (Prefix_Tree.after T u)
u \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. u @ w \<in> Prefix_Tree.set T
[PROOF STEP]
unfolding after_set
[PROOF STATE]
proof (prove)
using this:
w \<in> Set.insert [] {xs'. u @ xs' \<in> Prefix_Tree.set T}
u \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. u @ w \<in> Prefix_Tree.set T
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
u @ w \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. \<And>w. w \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u @ w \<in> Prefix_Tree.set T
[PROOF STEP]
show "(u@w \<in> L M1) = (u@w \<in> L M2)"
[PROOF STATE]
proof (prove)
using this:
u @ w \<in> Prefix_Tree.set T

goal (1 subgoal):
 1. (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
using \<open>L M1 \<inter> set T = L M2 \<inter> set T\<close>
[PROOF STATE]
proof (prove)
using this:
u @ w \<in> Prefix_Tree.set T
L M1 \<inter> Prefix_Tree.set T = L M2 \<inter> Prefix_Tree.set T

goal (1 subgoal):
 1. (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(u @ w \<in> L M1) = (u @ w \<in> L M2)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?w2 \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u)) \<Longrightarrow> (u @ ?w2 \<in> L M1) = (u @ ?w2 \<in> L M2)

goal (2 subgoals):
 1. u \<in> V ` reachable_states M1 \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
 2. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?w2 \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u)) \<Longrightarrow> (u @ ?w2 \<in> L M1) = (u @ ?w2 \<in> L M2)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
?w2 \<in> Prefix_Tree.set (dist_fun 0 (after_initial M1 u)) \<Longrightarrow> (u @ ?w2 \<in> L M1) = (u @ ?w2 \<in> L M2)

goal (1 subgoal):
 1. \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)

goal (1 subgoal):
 1. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
case 2
[PROOF STATE]
proof (state)
this:
u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}

goal (1 subgoal):
 1. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}
[PROOF STEP]
obtain \<gamma>' where "u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}" and "\<gamma>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))"
[PROOF STATE]
proof (prove)
using this:
u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}

goal (1 subgoal):
 1. (\<And>\<gamma>'. \<lbrakk>u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}; \<gamma>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}
\<gamma>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))

goal (1 subgoal):
 1. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}
\<gamma>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))
[PROOF STEP]
have "\<gamma>' \<in> list.set ttc"
[PROOF STATE]
proof (prove)
using this:
u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}
\<gamma>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))

goal (1 subgoal):
 1. \<gamma>' \<in> list.set ttc
[PROOF STEP]
using \<open>(\<gamma> @ [(x, y)]) \<in> list.set ttc\<close> \<open>\<And> \<gamma>' . \<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> \<gamma>' \<in> list.set ttc \<and> \<gamma>' \<in> LS M1 qTarget\<close>
[PROOF STATE]
proof (prove)
using this:
u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}
\<gamma>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))
\<gamma> @ [(x, y)] \<in> list.set ttc
?\<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> ?\<gamma>' \<in> list.set ttc \<and> ?\<gamma>' \<in> LS M1 qTarget

goal (1 subgoal):
 1. \<gamma>' \<in> list.set ttc
[PROOF STEP]
unfolding prefixes_set_Cons_insert
[PROOF STATE]
proof (prove)
using this:
u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}
\<gamma>' \<in> Set.insert (\<gamma> @ [(x, y)]) (list.set (prefixes \<gamma>))
\<gamma> @ [(x, y)] \<in> list.set ttc
?\<gamma>' \<in> list.set (prefixes \<gamma>) \<Longrightarrow> ?\<gamma>' \<in> list.set ttc \<and> ?\<gamma>' \<in> LS M1 qTarget

goal (1 subgoal):
 1. \<gamma>' \<in> list.set ttc
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> list.set ttc

goal (1 subgoal):
 1. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
have "\<gamma>' \<in> LS M1 qTarget"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
have "u \<in> L M1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. u \<in> L M1
[PROOF STEP]
using \<open>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})\<close>
[PROOF STATE]
proof (prove)
using this:
u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal (1 subgoal):
 1. u \<in> L M1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
u \<in> L M1

goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
u \<in> L M1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
u \<in> L M1

goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
using \<open>u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}\<close> \<open>converge M1 (\<alpha> @ [xy]) \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
u \<in> L M1
u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}
converge M1 (\<alpha> @ [xy]) \<beta>

goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
unfolding qTarget \<beta>[symmetric]
[PROOF STATE]
proof (prove)
using this:
u \<in> L M1
u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}
converge M1 (\<alpha> @ [xy]) \<beta>

goal (1 subgoal):
 1. \<gamma>' \<in> LS M1 (after_initial M1 \<beta>)
[PROOF STEP]
by (metis \<open>\<beta> \<in> L M1\<close> assms(1) converge_append_language_iff insert_iff observable_after_language_none singleton_iff)
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> LS M1 qTarget

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<gamma>' \<in> LS M1 qTarget

goal (1 subgoal):
 1. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<gamma>' \<in> LS M1 qTarget
[PROOF STEP]
have "(FSM.after M1 qTarget \<gamma>') = (after_initial M1 u)"
[PROOF STATE]
proof (prove)
using this:
\<gamma>' \<in> LS M1 qTarget

goal (1 subgoal):
 1. FSM.after M1 qTarget \<gamma>' = after_initial M1 u
[PROOF STEP]
using \<open>u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}\<close> \<open>converge M1 (\<alpha> @ [xy]) \<beta>\<close>
[PROOF STATE]
proof (prove)
using this:
\<gamma>' \<in> LS M1 qTarget
u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}
converge M1 (\<alpha> @ [xy]) \<beta>

goal (1 subgoal):
 1. FSM.after M1 qTarget \<gamma>' = after_initial M1 u
[PROOF STEP]
unfolding qTarget \<beta>[symmetric]
[PROOF STATE]
proof (prove)
using this:
\<gamma>' \<in> LS M1 (after_initial M1 \<beta>)
u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}
converge M1 (\<alpha> @ [xy]) \<beta>

goal (1 subgoal):
 1. FSM.after M1 (after_initial M1 \<beta>) \<gamma>' = after_initial M1 u
[PROOF STEP]
by (metis \<open>\<alpha> @ [xy] \<in> L M1\<close> \<open>\<beta> \<in> L M1\<close> after_split assms(1) assms(3) convergence_minimal insert_iff observable_after_language_append singleton_iff)
[PROOF STATE]
proof (state)
this:
FSM.after M1 qTarget \<gamma>' = after_initial M1 u

goal (1 subgoal):
 1. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
have "\<And> w . {\<alpha> @ [xy] @ \<gamma>' @ w, \<beta> @ \<gamma>' @ w} = {((\<alpha> @ [xy]) @ \<gamma>') @ w, (\<beta> @ \<gamma>') @ w}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>w. {\<alpha> @ [xy] @ \<gamma>' @ w, \<beta> @ \<gamma>' @ w} = {((\<alpha> @ [xy]) @ \<gamma>') @ w, (\<beta> @ \<gamma>') @ w}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
{\<alpha> @ [xy] @ \<gamma>' @ ?w2, \<beta> @ \<gamma>' @ ?w2} = {((\<alpha> @ [xy]) @ \<gamma>') @ ?w2, (\<beta> @ \<gamma>') @ ?w2}

goal (1 subgoal):
 1. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
have "\<And> w . w \<in> set (dist_fun (Suc (length \<gamma>')) (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>w. w \<in> Prefix_Tree.set (dist_fun (Suc (length \<gamma>')) (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
using handleTrace_foldl_props_1[OF \<open>\<gamma>' \<in> list.set ttc\<close> \<open>\<gamma>' \<in> LS M1 qTarget\<close>]
[PROOF STATE]
proof (prove)
using this:
?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length \<gamma>')) (FSM.after M1 qTarget \<gamma>')) \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ \<gamma>' @ ?w1, \<beta> @ \<gamma>' @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ \<gamma>' @ ?w1, \<beta> @ \<gamma>' @ ?w1}

goal (1 subgoal):
 1. \<And>w. w \<in> Prefix_Tree.set (dist_fun (Suc (length \<gamma>')) (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
unfolding \<open>(FSM.after M1 qTarget \<gamma>') = (after_initial M1 u)\<close>
[PROOF STATE]
proof (prove)
using this:
?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length \<gamma>')) (after_initial M1 u)) \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ \<gamma>' @ ?w1, \<beta> @ \<gamma>' @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ \<gamma>' @ ?w1, \<beta> @ \<gamma>' @ ?w1}

goal (1 subgoal):
 1. \<And>w. w \<in> Prefix_Tree.set (dist_fun (Suc (length \<gamma>')) (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
using \<open>u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}\<close>
[PROOF STATE]
proof (prove)
using this:
?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length \<gamma>')) (after_initial M1 u)) \<Longrightarrow> L M1 \<inter> {\<alpha> @ [xy] @ \<gamma>' @ ?w1, \<beta> @ \<gamma>' @ ?w1} = L M2 \<inter> {\<alpha> @ [xy] @ \<gamma>' @ ?w1, \<beta> @ \<gamma>' @ ?w1}
u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}

goal (1 subgoal):
 1. \<And>w. w \<in> Prefix_Tree.set (dist_fun (Suc (length \<gamma>')) (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
unfolding \<open>\<And> w . {\<alpha> @ [xy] @ \<gamma>' @ w, \<beta> @ \<gamma>' @ w} = {((\<alpha> @ [xy]) @ \<gamma>') @ w, (\<beta> @ \<gamma>') @ w}\<close>
[PROOF STATE]
proof (prove)
using this:
?w1 \<in> Prefix_Tree.set (dist_fun (Suc (length \<gamma>')) (after_initial M1 u)) \<Longrightarrow> L M1 \<inter> {((\<alpha> @ [xy]) @ \<gamma>') @ ?w1, (\<beta> @ \<gamma>') @ ?w1} = L M2 \<inter> {((\<alpha> @ [xy]) @ \<gamma>') @ ?w1, (\<beta> @ \<gamma>') @ ?w1}
u \<in> {(\<alpha> @ [xy]) @ \<gamma>', \<beta> @ \<gamma>'}

goal (1 subgoal):
 1. \<And>w. w \<in> Prefix_Tree.set (dist_fun (Suc (length \<gamma>')) (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
?w2 \<in> Prefix_Tree.set (dist_fun (Suc (length \<gamma>')) (after_initial M1 u)) \<Longrightarrow> (u @ ?w2 \<in> L M1) = (u @ ?w2 \<in> L M2)

goal (1 subgoal):
 1. u \<in> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))} \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?w2 \<in> Prefix_Tree.set (dist_fun (Suc (length \<gamma>')) (after_initial M1 u)) \<Longrightarrow> (u @ ?w2 \<in> L M1) = (u @ ?w2 \<in> L M2)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
?w2 \<in> Prefix_Tree.set (dist_fun (Suc (length \<gamma>')) (after_initial M1 u)) \<Longrightarrow> (u @ ?w2 \<in> L M1) = (u @ ?w2 \<in> L M2)

goal (1 subgoal):
 1. \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?u2 \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<Longrightarrow> \<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 ?u2)). (?u2 @ w \<in> L M1) = (?u2 @ w \<in> L M2)

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
obtain ku where "\<And> w . w \<in> set (dist_fun ku (after_initial M1 u)) \<Longrightarrow> (u@w \<in> L M1) = (u@w \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ku. (\<And>w. w \<in> Prefix_Tree.set (dist_fun ku (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using pass_dist[OF \<open>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})\<close>]
[PROOF STATE]
proof (prove)
using this:
\<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 u)). (u @ w \<in> L M1) = (u @ w \<in> L M2)

goal (1 subgoal):
 1. (\<And>ku. (\<And>w. w \<in> Prefix_Tree.set (dist_fun ku (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
?w2 \<in> Prefix_Tree.set (dist_fun ku (after_initial M1 u)) \<Longrightarrow> (u @ ?w2 \<in> L M1) = (u @ ?w2 \<in> L M2)

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
obtain kv where "\<And> w . w \<in> set (dist_fun kv (after_initial M1 v)) \<Longrightarrow> (v@w \<in> L M1) = (v@w \<in> L M2)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>kv. (\<And>w. w \<in> Prefix_Tree.set (dist_fun kv (after_initial M1 v)) \<Longrightarrow> (v @ w \<in> L M1) = (v @ w \<in> L M2)) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using pass_dist[OF \<open>v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})\<close>]
[PROOF STATE]
proof (prove)
using this:
\<exists>k. \<forall>w\<in>Prefix_Tree.set (dist_fun k (after_initial M1 v)). (v @ w \<in> L M1) = (v @ w \<in> L M2)

goal (1 subgoal):
 1. (\<And>kv. (\<And>w. w \<in> Prefix_Tree.set (dist_fun kv (after_initial M1 v)) \<Longrightarrow> (v @ w \<in> L M1) = (v @ w \<in> L M2)) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
?w2 \<in> Prefix_Tree.set (dist_fun kv (after_initial M1 v)) \<Longrightarrow> (v @ ?w2 \<in> L M1) = (v @ ?w2 \<in> L M2)

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
obtain w where "w \<in> set (dist_fun ku (after_initial M1 u))"
                   and "w \<in> set (dist_fun kv (after_initial M1 v))"
                   and "distinguishes M1 (after_initial M1 u) (after_initial M1 v) w"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>w. \<lbrakk>w \<in> Prefix_Tree.set (dist_fun ku (after_initial M1 u)); w \<in> Prefix_Tree.set (dist_fun kv (after_initial M1 v)); distinguishes M1 (after_initial M1 u) (after_initial M1 v) w\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms(15)[OF \<open>after_initial M1 u \<in> states M1\<close> \<open>after_initial M1 v \<in> states M1\<close> \<open>after_initial M1 u \<noteq> after_initial M1 v\<close>]
[PROOF STATE]
proof (prove)
using this:
\<exists>io. \<forall>k1 k2. io \<in> Prefix_Tree.set (dist_fun k1 (after_initial M1 u)) \<inter> Prefix_Tree.set (dist_fun k2 (after_initial M1 v)) \<and> distinguishes M1 (after_initial M1 u) (after_initial M1 v) io

goal (1 subgoal):
 1. (\<And>w. \<lbrakk>w \<in> Prefix_Tree.set (dist_fun ku (after_initial M1 u)); w \<in> Prefix_Tree.set (dist_fun kv (after_initial M1 v)); distinguishes M1 (after_initial M1 u) (after_initial M1 v) w\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
w \<in> Prefix_Tree.set (dist_fun ku (after_initial M1 u))
w \<in> Prefix_Tree.set (dist_fun kv (after_initial M1 v))
distinguishes M1 (after_initial M1 u) (after_initial M1 v) w

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
w \<in> Prefix_Tree.set (dist_fun ku (after_initial M1 u))
w \<in> Prefix_Tree.set (dist_fun kv (after_initial M1 v))
distinguishes M1 (after_initial M1 u) (after_initial M1 v) w
[PROOF STEP]
have "(w \<in> LS M1 (after_initial M1 u)) \<noteq> (w \<in> LS M1 (after_initial M1 v))"
[PROOF STATE]
proof (prove)
using this:
w \<in> Prefix_Tree.set (dist_fun ku (after_initial M1 u))
w \<in> Prefix_Tree.set (dist_fun kv (after_initial M1 v))
distinguishes M1 (after_initial M1 u) (after_initial M1 v) w

goal (1 subgoal):
 1. (w \<in> LS M1 (after_initial M1 u)) \<noteq> (w \<in> LS M1 (after_initial M1 v))
[PROOF STEP]
unfolding distinguishes_def
[PROOF STATE]
proof (prove)
using this:
w \<in> Prefix_Tree.set (dist_fun ku (after_initial M1 u))
w \<in> Prefix_Tree.set (dist_fun kv (after_initial M1 v))
w \<in> LS M1 (after_initial M1 u) \<union> LS M1 (after_initial M1 v) \<and> w \<notin> LS M1 (after_initial M1 u) \<inter> LS M1 (after_initial M1 v)

goal (1 subgoal):
 1. (w \<in> LS M1 (after_initial M1 u)) \<noteq> (w \<in> LS M1 (after_initial M1 v))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(w \<in> LS M1 (after_initial M1 u)) \<noteq> (w \<in> LS M1 (after_initial M1 v))

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(w \<in> LS M1 (after_initial M1 u)) \<noteq> (w \<in> LS M1 (after_initial M1 v))

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
have "w \<in> LS M1 (after_initial M1 u) = (w \<in> LS M2 (after_initial M2 u))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (w \<in> LS M1 (after_initial M1 u)) = (w \<in> LS M2 (after_initial M2 u))
[PROOF STEP]
by (metis \<open>\<And>w. w \<in> Prefix_Tree.set (dist_fun ku (after_initial M1 u)) \<Longrightarrow> (u @ w \<in> L M1) = (u @ w \<in> L M2)\<close> \<open>u \<in> L M1\<close> \<open>w \<in> Prefix_Tree.set (dist_fun ku (after_initial M1 u))\<close> append_Nil2 assms(1) assms(2) observable_after_language_append observable_after_language_none set_Nil)
[PROOF STATE]
proof (state)
this:
(w \<in> LS M1 (after_initial M1 u)) = (w \<in> LS M2 (after_initial M2 u))

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
(w \<in> LS M1 (after_initial M1 u)) = (w \<in> LS M2 (after_initial M2 u))

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
have "w \<in> LS M1 (after_initial M1 v) = (w \<in> LS M2 (after_initial M2 v))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (w \<in> LS M1 (after_initial M1 v)) = (w \<in> LS M2 (after_initial M2 v))
[PROOF STEP]
by (metis \<open>\<And>w. w \<in> Prefix_Tree.set (dist_fun kv (after_initial M1 v)) \<Longrightarrow> (v @ w \<in> L M1) = (v @ w \<in> L M2)\<close> \<open>v \<in> L M1\<close> \<open>w \<in> Prefix_Tree.set (dist_fun kv (after_initial M1 v))\<close> append_Nil2 assms(1) assms(2) observable_after_language_append observable_after_language_none set_Nil)
[PROOF STATE]
proof (state)
this:
(w \<in> LS M1 (after_initial M1 v)) = (w \<in> LS M2 (after_initial M2 v))

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
(w \<in> LS M1 (after_initial M1 u)) \<noteq> (w \<in> LS M1 (after_initial M1 v))
(w \<in> LS M1 (after_initial M1 u)) = (w \<in> LS M2 (after_initial M2 u))
(w \<in> LS M1 (after_initial M1 v)) = (w \<in> LS M2 (after_initial M2 v))
[PROOF STEP]
have "(w \<in> LS M2 (after_initial M2 u)) \<noteq> (w \<in> LS M2 (after_initial M2 v))"
[PROOF STATE]
proof (prove)
using this:
(w \<in> LS M1 (after_initial M1 u)) \<noteq> (w \<in> LS M1 (after_initial M1 v))
(w \<in> LS M1 (after_initial M1 u)) = (w \<in> LS M2 (after_initial M2 u))
(w \<in> LS M1 (after_initial M1 v)) = (w \<in> LS M2 (after_initial M2 v))

goal (1 subgoal):
 1. (w \<in> LS M2 (after_initial M2 u)) \<noteq> (w \<in> LS M2 (after_initial M2 v))
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
(w \<in> LS M2 (after_initial M2 u)) \<noteq> (w \<in> LS M2 (after_initial M2 v))

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(w \<in> LS M2 (after_initial M2 u)) \<noteq> (w \<in> LS M2 (after_initial M2 v))
[PROOF STEP]
have "after_initial M2 u \<noteq> after_initial M2 v"
[PROOF STATE]
proof (prove)
using this:
(w \<in> LS M2 (after_initial M2 u)) \<noteq> (w \<in> LS M2 (after_initial M2 v))

goal (1 subgoal):
 1. after_initial M2 u \<noteq> after_initial M2 v
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
after_initial M2 u \<noteq> after_initial M2 v

goal (1 subgoal):
 1. \<And>u v. \<lbrakk>u \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); v \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 u v\<rbrakk> \<Longrightarrow> \<not> converge M2 u v
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
after_initial M2 u \<noteq> after_initial M2 v
[PROOF STEP]
show "\<not> converge M2 u v"
[PROOF STATE]
proof (prove)
using this:
after_initial M2 u \<noteq> after_initial M2 v

goal (1 subgoal):
 1. \<not> converge M2 u v
[PROOF STEP]
using assms(2) assms(4) converge.simps convergence_minimal
[PROOF STATE]
proof (prove)
using this:
after_initial M2 u \<noteq> after_initial M2 v
observable M2
minimal M2
converge ?M ?\<pi> ?\<tau> = (?\<pi> \<in> L ?M \<and> ?\<tau> \<in> L ?M \<and> LS ?M (after_initial ?M ?\<pi>) = LS ?M (after_initial ?M ?\<tau>))
\<lbrakk>minimal ?M; observable ?M; ?\<alpha> \<in> L ?M; ?\<beta> \<in> L ?M\<rbrakk> \<Longrightarrow> converge ?M ?\<alpha> ?\<beta> = (after_initial ?M ?\<alpha> = after_initial ?M ?\<beta>)

goal (1 subgoal):
 1. \<not> converge M2 u v
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> converge M2 u v

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>?u2 \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); ?v2 \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 ?u2 ?v2\<rbrakk> \<Longrightarrow> \<not> converge M2 ?u2 ?v2

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>?u2 \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); ?v2 \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 ?u2 ?v2\<rbrakk> \<Longrightarrow> \<not> converge M2 ?u2 ?v2
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?u2 \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); ?v2 \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 ?u2 ?v2\<rbrakk> \<Longrightarrow> \<not> converge M2 ?u2 ?v2

goal (1 subgoal):
 1. preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
unfolding preserves_divergence.simps \<alpha>[symmetric] xy[symmetric] \<beta>[symmetric]
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?u2 \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); ?v2 \<in> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}); \<not> converge M1 ?u2 ?v2\<rbrakk> \<Longrightarrow> \<not> converge M2 ?u2 ?v2

goal (1 subgoal):
 1. \<forall>\<alpha>'\<in>L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}). \<forall>\<beta>\<in>L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {\<alpha> @ [xy], \<beta>} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}). \<not> converge M1 \<alpha>' \<beta> \<longrightarrow> \<not> converge M2 \<alpha>' \<beta>
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>length (?\<gamma>2 @ [(?x2, ?y2)]) \<le> m - size_r M1; ?\<gamma>2 \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); ?x2 \<in> FSM.inputs M1; ?y2 \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma>2 @ [(?x2, ?y2)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma>2 @ [(?x2, ?y2)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma>2 @ [(?x2, ?y2)]))})

goal (1 subgoal):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<lbrakk>length (?\<gamma>2 @ [(?x2, ?y2)]) \<le> m - size_r M1; ?\<gamma>2 \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); ?x2 \<in> FSM.inputs M1; ?y2 \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma>2 @ [(?x2, ?y2)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma>2 @ [(?x2, ?y2)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma>2 @ [(?x2, ?y2)]))})
[PROOF STEP]
show "?P1a"
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>length (?\<gamma>2 @ [(?x2, ?y2)]) \<le> m - size_r M1; ?\<gamma>2 \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])); ?x2 \<in> FSM.inputs M1; ?y2 \<in> FSM.outputs M1\<rbrakk> \<Longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma>2 @ [(?x2, ?y2)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma>2 @ [(?x2, ?y2)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (?\<gamma>2 @ [(?x2, ?y2)]))})

goal (1 subgoal):
 1. \<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<forall>\<gamma> x y. length (\<gamma> @ [(x, y)]) \<le> m - size_r M1 \<longrightarrow> \<gamma> \<in> LS M1 (after_initial M1 (V (t_source t) @ [(t_input t, t_output t)])) \<longrightarrow> x \<in> FSM.inputs M1 \<longrightarrow> y \<in> FSM.outputs M1 \<longrightarrow> L M1 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) = L M2 \<inter> (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))}) \<and> preserves_divergence M1 M2 (V ` reachable_states M1 \<union> {\<omega> @ \<omega>' |\<omega> \<omega>'. \<omega> \<in> {V (t_source t) @ [(t_input t, t_output t)], V (t_target t)} \<and> \<omega>' \<in> list.set (prefixes (\<gamma> @ [(x, y)]))})

goal:
No subgoals!
[PROOF STEP]
qed