[STATEMENT]
lemma unwind_cont_\<Delta>1: "unwind_cont \<Delta>1 {\<Delta>1,\<Delta>2}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. unwind_cont \<Delta>1 {\<Delta>1, \<Delta>2}
[PROOF STEP]
proof(rule, simp)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>s vl s1 vl1. \<lbrakk>reachNT s; reach s1; \<Delta>1 s vl s1 vl1\<rbrakk> \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
let ?\<Delta> = "\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>s vl s1 vl1. \<lbrakk>reachNT s; reach s1; \<Delta>1 s vl s1 vl1\<rbrakk> \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
fix s s1 :: state and vl vl1 :: "value list"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>s vl s1 vl1. \<lbrakk>reachNT s; reach s1; \<Delta>1 s vl s1 vl1\<rbrakk> \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
assume rsT: "reachNT s" and rs1: "reach s1" and "\<Delta>1 s vl s1 vl1"
[PROOF STATE]
proof (state)
this:
reachNT s
reach s1
\<Delta>1 s vl s1 vl1

goal (1 subgoal):
 1. \<And>s vl s1 vl1. \<lbrakk>reachNT s; reach s1; \<Delta>1 s vl s1 vl1\<rbrakk> \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
hence vlvl1: "vl = [] \<longrightarrow> vl1 = []" and ch1: "corrFrom (post s1 PID) vl1"
  and rs: "reach s" and ss1: "eqButPID s s1" and PID: "PID \<in>\<in> postIDs s"
  and l: "map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)"
[PROOF STATE]
proof (prove)
using this:
reachNT s
reach s1
\<Delta>1 s vl s1 vl1

goal (1 subgoal):
 1. (vl = [] \<longrightarrow> vl1 = [] &&& corrFrom (post s1 PID) vl1 &&& reach s) &&& eqButPID s s1 &&& PID \<in>\<in> postIDs s &&& map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
[PROOF STEP]
using reachNT_reach
[PROOF STATE]
proof (prove)
using this:
reachNT s
reach s1
\<Delta>1 s vl s1 vl1
reachNT ?s \<Longrightarrow> reach ?s

goal (1 subgoal):
 1. (vl = [] \<longrightarrow> vl1 = [] &&& corrFrom (post s1 PID) vl1 &&& reach s) &&& eqButPID s s1 &&& PID \<in>\<in> postIDs s &&& map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
[PROOF STEP]
unfolding \<Delta>1_def
[PROOF STATE]
proof (prove)
using this:
reachNT s
reach s1
PID \<in>\<in> postIDs s \<and> eqButPID s s1 \<and> corrFrom (post s1 PID) vl1 \<and> (vl = [] \<longrightarrow> vl1 = []) \<and> map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
reachNT ?s \<Longrightarrow> reach ?s

goal (1 subgoal):
 1. (vl = [] \<longrightarrow> vl1 = [] &&& corrFrom (post s1 PID) vl1 &&& reach s) &&& eqButPID s s1 &&& PID \<in>\<in> postIDs s &&& map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vl = [] \<longrightarrow> vl1 = []
corrFrom (post s1 PID) vl1
reach s
eqButPID s s1
PID \<in>\<in> postIDs s
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)

goal (1 subgoal):
 1. \<And>s vl s1 vl1. \<lbrakk>reachNT s; reach s1; \<Delta>1 s vl s1 vl1\<rbrakk> \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
have PID1: "PID \<in>\<in> postIDs s1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. PID \<in>\<in> postIDs s1
[PROOF STEP]
using eqButPID_stateSelectors[OF ss1] PID
[PROOF STATE]
proof (prove)
using this:
admin s = admin s1 \<and> pendingUReqs s = pendingUReqs s1 \<and> userReq s = userReq s1 \<and> userIDs s = userIDs s1 \<and> user s = user s1 \<and> pass s = pass s1 \<and> pendingFReqs s = pendingFReqs s1 \<and> friendReq s = friendReq s1 \<and> friendIDs s = friendIDs s1 \<and> sentOuterFriendIDs s = sentOuterFriendIDs s1 \<and> recvOuterFriendIDs s = recvOuterFriendIDs s1 \<and> postIDs s = postIDs s1 \<and> admin s = admin s1 \<and> eeqButPID (post s) (post s1) \<and> owner s = owner s1 \<and> vis s = vis s1 \<and> pendingSApiReqs s = pendingSApiReqs s1 \<and> sApiReq s = sApiReq s1 \<and> serverApiIDs s = serverApiIDs s1 \<and> serverPass s = serverPass s1 \<and> outerPostIDs s = outerPostIDs s1 \<and> outerPost s = outerPost s1 \<and> outerOwner s = outerOwner s1 \<and> outerVis s = outerVis s1 \<and> pendingCApiReqs s = pendingCApiReqs s1 \<and> cApiReq s = cApiReq s1 \<and> clientApiIDs s = clientApiIDs s1 \<and> clientPass s = clientPass s1 \<and> eeqButPID_F (sharedWith s) (sharedWith s1) \<and> IDsOK s = IDsOK s1
PID \<in>\<in> postIDs s

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
PID \<in>\<in> postIDs s1

goal (1 subgoal):
 1. \<And>s vl s1 vl1. \<lbrakk>reachNT s; reach s1; \<Delta>1 s vl s1 vl1\<rbrakk> \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
have own: "owner s PID \<in> set (userIDs s)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. owner s PID \<in>\<in> userIDs s
[PROOF STEP]
using reach_owner_userIDs[OF rs PID]
[PROOF STATE]
proof (prove)
using this:
owner s PID \<in>\<in> userIDs s

goal (1 subgoal):
 1. owner s PID \<in>\<in> userIDs s
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
owner s PID \<in>\<in> userIDs s

goal (1 subgoal):
 1. \<And>s vl s1 vl1. \<lbrakk>reachNT s; reach s1; \<Delta>1 s vl s1 vl1\<rbrakk> \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
hence own1: "owner s1 PID \<in> set (userIDs s1)"
[PROOF STATE]
proof (prove)
using this:
owner s PID \<in>\<in> userIDs s

goal (1 subgoal):
 1. owner s1 PID \<in>\<in> userIDs s1
[PROOF STEP]
using eqButPID_stateSelectors[OF ss1]
[PROOF STATE]
proof (prove)
using this:
owner s PID \<in>\<in> userIDs s
admin s = admin s1 \<and> pendingUReqs s = pendingUReqs s1 \<and> userReq s = userReq s1 \<and> userIDs s = userIDs s1 \<and> user s = user s1 \<and> pass s = pass s1 \<and> pendingFReqs s = pendingFReqs s1 \<and> friendReq s = friendReq s1 \<and> friendIDs s = friendIDs s1 \<and> sentOuterFriendIDs s = sentOuterFriendIDs s1 \<and> recvOuterFriendIDs s = recvOuterFriendIDs s1 \<and> postIDs s = postIDs s1 \<and> admin s = admin s1 \<and> eeqButPID (post s) (post s1) \<and> owner s = owner s1 \<and> vis s = vis s1 \<and> pendingSApiReqs s = pendingSApiReqs s1 \<and> sApiReq s = sApiReq s1 \<and> serverApiIDs s = serverApiIDs s1 \<and> serverPass s = serverPass s1 \<and> outerPostIDs s = outerPostIDs s1 \<and> outerPost s = outerPost s1 \<and> outerOwner s = outerOwner s1 \<and> outerVis s = outerVis s1 \<and> pendingCApiReqs s = pendingCApiReqs s1 \<and> cApiReq s = cApiReq s1 \<and> clientApiIDs s = clientApiIDs s1 \<and> clientPass s = clientPass s1 \<and> eeqButPID_F (sharedWith s) (sharedWith s1) \<and> IDsOK s = IDsOK s1

goal (1 subgoal):
 1. owner s1 PID \<in>\<in> userIDs s1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
owner s1 PID \<in>\<in> userIDs s1

goal (1 subgoal):
 1. \<And>s vl s1 vl1. \<lbrakk>reachNT s; reach s1; \<Delta>1 s vl s1 vl1\<rbrakk> \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
show "iaction ?\<Delta> s vl s1 vl1 \<or>
        ((vl = [] \<longrightarrow> vl1 = []) \<and> reaction ?\<Delta> s vl s1 vl1)" (is "?iact \<or> (_ \<and> ?react)")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
proof(cases vl1)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. vl1 = [] \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>a list. vl1 = a # list \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
case (Cons v1 vll1)
[PROOF STATE]
proof (state)
this:
vl1 = v1 # vll1

goal (2 subgoals):
 1. vl1 = [] \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>a list. vl1 = a # list \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
note vl1 = Cons
[PROOF STATE]
proof (state)
this:
vl1 = v1 # vll1

goal (2 subgoals):
 1. vl1 = [] \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>a list. vl1 = a # list \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
obtain v vll where vl: "vl = v # vll"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>v vll. vl = v # vll \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using vl1 vlvl1
[PROOF STATE]
proof (prove)
using this:
vl1 = v1 # vll1
vl = [] \<longrightarrow> vl1 = []

goal (1 subgoal):
 1. (\<And>v vll. vl = v # vll \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases vl) auto
[PROOF STATE]
proof (state)
this:
vl = v # vll

goal (2 subgoals):
 1. vl1 = [] \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>a list. vl1 = a # list \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
proof(cases v1)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
case (PVal pst1)
[PROOF STATE]
proof (state)
this:
v1 = PVal pst1

goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
note v1 = PVal
[PROOF STATE]
proof (state)
this:
v1 = PVal pst1

goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
let ?uid1 = "owner s1 PID"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
let ?p1 = "pass s1 ?uid1"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
have uid1: "?uid1 \<in>\<in> userIDs s1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. owner s1 PID \<in>\<in> userIDs s1
[PROOF STEP]
using reach_owner_userIDs[OF rs1 PID1]
[PROOF STATE]
proof (prove)
using this:
owner s1 PID \<in>\<in> userIDs s1

goal (1 subgoal):
 1. owner s1 PID \<in>\<in> userIDs s1
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
owner s1 PID \<in>\<in> userIDs s1

goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
define a1 where "a1 \<equiv> Uact (uPost ?uid1 ?p1 PID pst1)"
[PROOF STATE]
proof (state)
this:
a1 \<equiv> Uact (uPost (owner s1 PID) (pass s1 (owner s1 PID)) PID pst1)

goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
obtain s1' ou1 where step1: "step s1 a1 = (ou1,s1')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ou1 s1'. step s1 a1 = (ou1, s1') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
step s1 a1 = (ou1, s1')

goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
hence ou1: "ou1 = outOK"
[PROOF STATE]
proof (prove)
using this:
step s1 a1 = (ou1, s1')

goal (1 subgoal):
 1. ou1 = outOK
[PROOF STEP]
using PID1 uid1
[PROOF STATE]
proof (prove)
using this:
step s1 a1 = (ou1, s1')
PID \<in>\<in> postIDs s1
owner s1 PID \<in>\<in> userIDs s1

goal (1 subgoal):
 1. ou1 = outOK
[PROOF STEP]
unfolding a1_def
[PROOF STATE]
proof (prove)
using this:
step s1 (Uact (uPost (owner s1 PID) (pass s1 (owner s1 PID)) PID pst1)) = (ou1, s1')
PID \<in>\<in> postIDs s1
owner s1 PID \<in>\<in> userIDs s1

goal (1 subgoal):
 1. ou1 = outOK
[PROOF STEP]
by (auto simp: u_defs)
[PROOF STATE]
proof (state)
this:
ou1 = outOK

goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
let ?trn1 = "Trans s1 a1 ou1 s1'"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
have \<phi>1: "\<phi> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<phi> (Trans s1 a1 ou1 s1')
[PROOF STEP]
unfolding a1_def PID1 ou1
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<phi> (Trans s1 (Uact (uPost (owner s1 PID) (pass s1 (owner s1 PID)) PID pst1)) outOK s1')
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<phi> (Trans s1 a1 ou1 s1')

goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
have 2[simp]: "post s1' PID = pst1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. post s1' PID = pst1
[PROOF STEP]
using step1
[PROOF STATE]
proof (prove)
using this:
step s1 a1 = (ou1, s1')

goal (1 subgoal):
 1. post s1' PID = pst1
[PROOF STEP]
unfolding a1_def ou1
[PROOF STATE]
proof (prove)
using this:
step s1 (Uact (uPost (owner s1 PID) (pass s1 (owner s1 PID)) PID pst1)) = (outOK, s1')

goal (1 subgoal):
 1. post s1' PID = pst1
[PROOF STEP]
by (auto simp: u_defs)
[PROOF STATE]
proof (state)
this:
post s1' PID = pst1

goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
have "?uid1 = owner s PID"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. owner s1 PID = owner s PID
[PROOF STEP]
using eqButPID_stateSelectors[OF ss1]
[PROOF STATE]
proof (prove)
using this:
admin s = admin s1 \<and> pendingUReqs s = pendingUReqs s1 \<and> userReq s = userReq s1 \<and> userIDs s = userIDs s1 \<and> user s = user s1 \<and> pass s = pass s1 \<and> pendingFReqs s = pendingFReqs s1 \<and> friendReq s = friendReq s1 \<and> friendIDs s = friendIDs s1 \<and> sentOuterFriendIDs s = sentOuterFriendIDs s1 \<and> recvOuterFriendIDs s = recvOuterFriendIDs s1 \<and> postIDs s = postIDs s1 \<and> admin s = admin s1 \<and> eeqButPID (post s) (post s1) \<and> owner s = owner s1 \<and> vis s = vis s1 \<and> pendingSApiReqs s = pendingSApiReqs s1 \<and> sApiReq s = sApiReq s1 \<and> serverApiIDs s = serverApiIDs s1 \<and> serverPass s = serverPass s1 \<and> outerPostIDs s = outerPostIDs s1 \<and> outerPost s = outerPost s1 \<and> outerOwner s = outerOwner s1 \<and> outerVis s = outerVis s1 \<and> pendingCApiReqs s = pendingCApiReqs s1 \<and> cApiReq s = cApiReq s1 \<and> clientApiIDs s = clientApiIDs s1 \<and> clientPass s = clientPass s1 \<and> eeqButPID_F (sharedWith s) (sharedWith s1) \<and> IDsOK s = IDsOK s1

goal (1 subgoal):
 1. owner s1 PID = owner s PID
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
owner s1 PID = owner s PID

goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
hence uid1: "?uid1 \<notin> UIDs"
[PROOF STATE]
proof (prove)
using this:
owner s1 PID = owner s PID

goal (1 subgoal):
 1. owner s1 PID \<notin> UIDs
[PROOF STEP]
using reachNT_state own rsT PID
[PROOF STATE]
proof (prove)
using this:
owner s1 PID = owner s PID
reachNT ?s \<Longrightarrow> \<not> (\<exists>uid\<in>UIDs. uid \<in>\<in> userIDs ?s \<and> PID \<in>\<in> postIDs ?s \<and> (uid = admin ?s \<or> uid = owner ?s PID \<or> uid \<in>\<in> friendIDs ?s (owner ?s PID) \<or> vis ?s PID = PublicV))
owner s PID \<in>\<in> userIDs s
reachNT s
PID \<in>\<in> postIDs s

goal (1 subgoal):
 1. owner s1 PID \<notin> UIDs
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
owner s1 PID \<notin> UIDs

goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
have "eqButPID s1 s1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eqButPID s1 s1'
[PROOF STEP]
using step1 a1_def Uact_uPaperC_step_eqButPID
[PROOF STATE]
proof (prove)
using this:
step s1 a1 = (ou1, s1')
a1 \<equiv> Uact (uPost (owner s1 PID) (pass s1 (owner s1 PID)) PID pst1)
\<lbrakk>?a = Uact (uPost ?uid ?p PID ?pst); step ?s ?a = (?ou, ?s')\<rbrakk> \<Longrightarrow> eqButPID ?s ?s'

goal (1 subgoal):
 1. eqButPID s1 s1'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
eqButPID s1 s1'

goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
hence ss1': "eqButPID s s1'"
[PROOF STATE]
proof (prove)
using this:
eqButPID s1 s1'

goal (1 subgoal):
 1. eqButPID s s1'
[PROOF STEP]
using ss1
[PROOF STATE]
proof (prove)
using this:
eqButPID s1 s1'
eqButPID s s1

goal (1 subgoal):
 1. eqButPID s s1'
[PROOF STEP]
using eqButPID_trans
[PROOF STATE]
proof (prove)
using this:
eqButPID s1 s1'
eqButPID s s1
\<lbrakk>eqButPID ?s ?s1.0; eqButPID ?s1.0 ?s2.0\<rbrakk> \<Longrightarrow> eqButPID ?s ?s2.0

goal (1 subgoal):
 1. eqButPID s s1'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
eqButPID s s1'

goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
have "?iact"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. step s1 ?a1.0 = (?ou1.0, ?s1')
 2. \<phi> (Trans s1 ?a1.0 ?ou1.0 ?s1')
 3. consume (Trans s1 ?a1.0 ?ou1.0 ?s1') vl1 ?vl1'
 4. \<not> \<gamma> (Trans s1 ?a1.0 ?ou1.0 ?s1')
 5. \<Delta>1 s vl ?s1' ?vl1' \<or> \<Delta>2 s vl ?s1' ?vl1'
[PROOF STEP]
show "step s1 a1 = (ou1, s1')" "\<phi> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. step s1 a1 = (ou1, s1') &&& \<phi> (Trans s1 a1 ou1 s1')
[PROOF STEP]
by fact+
[PROOF STATE]
proof (state)
this:
step s1 a1 = (ou1, s1')
\<phi> (Trans s1 a1 ou1 s1')

goal (3 subgoals):
 1. consume (Trans s1 a1 ou1 s1') vl1 ?vl1'
 2. \<not> \<gamma> (Trans s1 a1 ou1 s1')
 3. \<Delta>1 s vl s1' ?vl1' \<or> \<Delta>2 s vl s1' ?vl1'
[PROOF STEP]
show "consume (Trans s1 a1 ou1 s1') vl1 vll1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. consume (Trans s1 a1 ou1 s1') vl1 vll1
[PROOF STEP]
using \<phi>1
[PROOF STATE]
proof (prove)
using this:
\<phi> (Trans s1 a1 ou1 s1')

goal (1 subgoal):
 1. consume (Trans s1 a1 ou1 s1') vl1 vll1
[PROOF STEP]
unfolding consume_def vl1 a1_def v1
[PROOF STATE]
proof (prove)
using this:
\<phi> (Trans s1 (Uact (uPost (owner s1 PID) (pass s1 (owner s1 PID)) PID pst1)) ou1 s1')

goal (1 subgoal):
 1. if \<phi> (Trans s1 (Uact (uPost (owner s1 PID) (pass s1 (owner s1 PID)) PID pst1)) ou1 s1') then PVal pst1 # vll1 \<noteq> [] \<and> f (Trans s1 (Uact (uPost (owner s1 PID) (pass s1 (owner s1 PID)) PID pst1)) ou1 s1') = hd (PVal pst1 # vll1) \<and> vll1 = tl (PVal pst1 # vll1) else vll1 = PVal pst1 # vll1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
consume (Trans s1 a1 ou1 s1') vl1 vll1

goal (2 subgoals):
 1. \<not> \<gamma> (Trans s1 a1 ou1 s1')
 2. \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
[PROOF STEP]
show "\<not> \<gamma> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> \<gamma> (Trans s1 a1 ou1 s1')
[PROOF STEP]
using uid1
[PROOF STATE]
proof (prove)
using this:
owner s1 PID \<notin> UIDs

goal (1 subgoal):
 1. \<not> \<gamma> (Trans s1 a1 ou1 s1')
[PROOF STEP]
unfolding a1_def
[PROOF STATE]
proof (prove)
using this:
owner s1 PID \<notin> UIDs

goal (1 subgoal):
 1. \<not> \<gamma> (Trans s1 (Uact (uPost (owner s1 PID) (pass s1 (owner s1 PID)) PID pst1)) ou1 s1')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> \<gamma> (Trans s1 a1 ou1 s1')

goal (1 subgoal):
 1. \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
[PROOF STEP]
show "?\<Delta> s vl s1' vll1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
[PROOF STEP]
proof(cases vll1)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. vll1 = [] \<Longrightarrow> \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
 2. \<And>a list. vll1 = a # list \<Longrightarrow> \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
vll1 = []

goal (2 subgoals):
 1. vll1 = [] \<Longrightarrow> \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
 2. \<And>a list. vll1 = a # list \<Longrightarrow> \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
[PROOF STEP]
have "\<Delta>1 s vl s1' vll1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Delta>1 s vl s1' vll1
[PROOF STEP]
using PID ss1' l
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s
eqButPID s s1'
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)

goal (1 subgoal):
 1. \<Delta>1 s vl s1' vll1
[PROOF STEP]
unfolding \<Delta>1_def B_def vl1 v1 Nil
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s
eqButPID s s1'
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS [PVal pst1])

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s \<and> eqButPID s s1' \<and> corrFrom (post s1' PID) [] \<and> (vl = [] \<longrightarrow> [] = []) \<and> map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS [])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Delta>1 s vl s1' vll1

goal (2 subgoals):
 1. vll1 = [] \<Longrightarrow> \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
 2. \<And>a list. vll1 = a # list \<Longrightarrow> \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<Delta>1 s vl s1' vll1

goal (1 subgoal):
 1. \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1

goal (1 subgoal):
 1. \<And>a list. vll1 = a # list \<Longrightarrow> \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a list. vll1 = a # list \<Longrightarrow> \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
[PROOF STEP]
case (Cons w1 vlll1)
[PROOF STATE]
proof (state)
this:
vll1 = w1 # vlll1

goal (1 subgoal):
 1. \<And>a list. vll1 = a # list \<Longrightarrow> \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
[PROOF STEP]
note vll1 = Cons
[PROOF STATE]
proof (state)
this:
vll1 = w1 # vlll1

goal (1 subgoal):
 1. \<And>a list. vll1 = a # list \<Longrightarrow> \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
[PROOF STEP]
have "\<Delta>1 s vl s1' vll1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Delta>1 s vl s1' vll1
[PROOF STEP]
using PID ss1' l ch1
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s
eqButPID s s1'
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
corrFrom (post s1 PID) vl1

goal (1 subgoal):
 1. \<Delta>1 s vl s1' vll1
[PROOF STEP]
unfolding \<Delta>1_def B_def vl1 v1 vl
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s
eqButPID s s1'
map PValS_tgtAPI (filter isPValS (v # vll)) = map PValS_tgtAPI (filter isPValS (PVal pst1 # vll1))
corrFrom (post s1 PID) (PVal pst1 # vll1)

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s \<and> eqButPID s s1' \<and> corrFrom (post s1' PID) vll1 \<and> (v # vll = [] \<longrightarrow> vll1 = []) \<and> map PValS_tgtAPI (filter isPValS (v # vll)) = map PValS_tgtAPI (filter isPValS vll1)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Delta>1 s vl s1' vll1

goal (1 subgoal):
 1. \<And>a list. vll1 = a # list \<Longrightarrow> \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<Delta>1 s vl s1' vll1

goal (1 subgoal):
 1. \<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<Delta>1 s vl s1' vll1 \<or> \<Delta>2 s vl s1' vll1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal (2 subgoals):
 1. \<And>x1. v1 = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal (1 subgoal):
 1. iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal (1 subgoal):
 1. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
case (PValS aid1 pst1)
[PROOF STATE]
proof (state)
this:
v1 = PValS aid1 pst1

goal (1 subgoal):
 1. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
note v1 = PValS
[PROOF STATE]
proof (state)
this:
v1 = PValS aid1 pst1

goal (1 subgoal):
 1. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
have pst1: "pst1 = post s1 PID"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pst1 = post s1 PID
[PROOF STEP]
using ch1
[PROOF STATE]
proof (prove)
using this:
corrFrom (post s1 PID) vl1

goal (1 subgoal):
 1. pst1 = post s1 PID
[PROOF STEP]
unfolding vl1 v1
[PROOF STATE]
proof (prove)
using this:
corrFrom (post s1 PID) (PValS aid1 pst1 # vll1)

goal (1 subgoal):
 1. pst1 = post s1 PID
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
pst1 = post s1 PID

goal (1 subgoal):
 1. \<And>x21 x22. v1 = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
proof(cases v)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x1. v = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
case (PVal "pst")
[PROOF STATE]
proof (state)
this:
v = PVal pst

goal (2 subgoals):
 1. \<And>x1. v = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
note v = PVal
[PROOF STATE]
proof (state)
this:
v = PVal pst

goal (2 subgoals):
 1. \<And>x1. v = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
hence vll: "vll \<noteq> []"
[PROOF STATE]
proof (prove)
using this:
v = PVal pst

goal (1 subgoal):
 1. vll \<noteq> []
[PROOF STEP]
using vlvl1 l
[PROOF STATE]
proof (prove)
using this:
v = PVal pst
vl = [] \<longrightarrow> vl1 = []
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)

goal (1 subgoal):
 1. vll \<noteq> []
[PROOF STEP]
unfolding vl vl1 v v1
[PROOF STATE]
proof (prove)
using this:
PVal pst = PVal pst
PVal pst # vll = [] \<longrightarrow> PValS aid1 pst1 # vll1 = []
map PValS_tgtAPI (filter isPValS (PVal pst # vll)) = map PValS_tgtAPI (filter isPValS (PValS aid1 pst1 # vll1))

goal (1 subgoal):
 1. vll \<noteq> []
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vll \<noteq> []

goal (2 subgoals):
 1. \<And>x1. v = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
have ?react
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
fix a :: act and ou :: out and s' :: state and vl'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
let ?trn = "Trans s a ou s'"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
assume step: "step s a = (ou, s')" and T: "\<not> T ?trn" and c: "consume ?trn vl vl'"
[PROOF STATE]
proof (state)
this:
step s a = (ou, s')
\<not> T (Trans s a ou s')
consume (Trans s a ou s') vl vl'

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have vl': "vl' = vl \<or> vl' = vll"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vl' = vl \<or> vl' = vll
[PROOF STEP]
using c
[PROOF STATE]
proof (prove)
using this:
consume (Trans s a ou s') vl vl'

goal (1 subgoal):
 1. vl' = vl \<or> vl' = vll
[PROOF STEP]
unfolding vl consume_def
[PROOF STATE]
proof (prove)
using this:
if \<phi> (Trans s a ou s') then v # vll \<noteq> [] \<and> f (Trans s a ou s') = hd (v # vll) \<and> vl' = tl (v # vll) else vl' = v # vll

goal (1 subgoal):
 1. vl' = v # vll \<or> vl' = vll
[PROOF STEP]
by (cases "\<phi> ?trn") auto
[PROOF STATE]
proof (state)
this:
vl' = vl \<or> vl' = vll

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
hence vl'NE: "vl' \<noteq> []"
[PROOF STATE]
proof (prove)
using this:
vl' = vl \<or> vl' = vll

goal (1 subgoal):
 1. vl' \<noteq> []
[PROOF STEP]
using vll vl
[PROOF STATE]
proof (prove)
using this:
vl' = vl \<or> vl' = vll
vll \<noteq> []
vl = v # vll

goal (1 subgoal):
 1. vl' \<noteq> []
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vl' \<noteq> []

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have fvl': "filter isPValS vl' = filter isPValS vll"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. filter isPValS vl' = filter isPValS vll
[PROOF STEP]
using vl'
[PROOF STATE]
proof (prove)
using this:
vl' = vl \<or> vl' = vll

goal (1 subgoal):
 1. filter isPValS vl' = filter isPValS vll
[PROOF STEP]
unfolding vl v
[PROOF STATE]
proof (prove)
using this:
vl' = PVal pst # vll \<or> vl' = vll

goal (1 subgoal):
 1. filter isPValS vl' = filter isPValS vll
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
filter isPValS vl' = filter isPValS vll

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
obtain ou1 s1' where step1: "step s1 a = (ou1, s1')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ou1 s1'. step s1 a = (ou1, s1') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
step s1 a = (ou1, s1')

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
let ?trn1 = "Trans s1 a ou1 s1'"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have s's1': "eqButPID s' s1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eqButPID s' s1'
[PROOF STEP]
using eqButPID_step ss1 step step1
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>eqButPID ?s ?s1.0; step ?s ?a = (?ou, ?s'); step ?s1.0 ?a = (?ou1.0, ?s1')\<rbrakk> \<Longrightarrow> eqButPID ?s' ?s1'
eqButPID s s1
step s a = (ou, s')
step s1 a = (ou1, s1')

goal (1 subgoal):
 1. eqButPID s' s1'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
eqButPID s' s1'

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have \<gamma>\<gamma>1: "\<gamma> ?trn \<longleftrightarrow> \<gamma> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have PID': "PID \<in>\<in> postIDs s'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. PID \<in>\<in> postIDs s'
[PROOF STEP]
using step rs PID
[PROOF STATE]
proof (prove)
using this:
step s a = (ou, s')
reach s
PID \<in>\<in> postIDs s

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s'
[PROOF STEP]
using reach_postIDs_persist
[PROOF STATE]
proof (prove)
using this:
step s a = (ou, s')
reach s
PID \<in>\<in> postIDs s
\<lbrakk>?pID \<in>\<in> postIDs ?s; step ?s ?a = (?ou, ?s')\<rbrakk> \<Longrightarrow> ?pID \<in>\<in> postIDs ?s'

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
PID \<in>\<in> postIDs s'

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have 2[simp]: "\<not> \<phi> ?trn1 \<Longrightarrow> post s1' PID = post s1 PID"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> \<phi> (Trans s1 a ou1 s1') \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
using step1 PID1
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')
PID \<in>\<in> postIDs s1

goal (1 subgoal):
 1. \<not> \<phi> (Trans s1 a ou1 s1') \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
unfolding \<phi>_def2
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')
PID \<in>\<in> postIDs s1

goal (1 subgoal):
 1. \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)) \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
(* [OF step1] *)
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')
PID \<in>\<in> postIDs s1

goal (1 subgoal):
 1. \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)) \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases a, auto)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>x1. \<lbrakk>sStep s1 x1 = (ou1, s1'); a = Sact x1; PID \<in>\<in> postIDs s1\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x2. \<lbrakk>cStep s1 x2 = (ou1, s1'); a = Cact x2; PID \<in>\<in> postIDs s1\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x3. \<lbrakk>dStep s1 x3 = (ou1, s1'); a = Dact x3; PID \<in>\<in> postIDs s1\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 4. \<And>x4. \<lbrakk>uStep s1 x4 = (ou1, s1'); a = Uact x4; PID \<in>\<in> postIDs s1; \<forall>uid p pst. x4 \<noteq> uPost uid p PID pst\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 5. \<And>x4. \<lbrakk>uStep s1 x4 = (ou1, s1'); a = Uact x4; PID \<in>\<in> postIDs s1; ou1 \<noteq> outOK\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 6. \<And>x7. \<lbrakk>comStep s1 x7 = (ou1, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; \<forall>uid p aid. x7 \<noteq> comSendPost uid p aid PID\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 7. \<And>x7. \<lbrakk>comStep s1 x7 = (outErr, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; ou1 = outErr\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x1
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sStep s1 x1 = (ou1, s1'); a = Sact x1; PID \<in>\<in> postIDs s1\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x1, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>x2. \<lbrakk>cStep s1 x2 = (ou1, s1'); a = Cact x2; PID \<in>\<in> postIDs s1\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x3. \<lbrakk>dStep s1 x3 = (ou1, s1'); a = Dact x3; PID \<in>\<in> postIDs s1\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x4. \<lbrakk>uStep s1 x4 = (ou1, s1'); a = Uact x4; PID \<in>\<in> postIDs s1; \<forall>uid p pst. x4 \<noteq> uPost uid p PID pst\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 4. \<And>x4. \<lbrakk>uStep s1 x4 = (ou1, s1'); a = Uact x4; PID \<in>\<in> postIDs s1; ou1 \<noteq> outOK\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 5. \<And>x7. \<lbrakk>comStep s1 x7 = (ou1, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; \<forall>uid p aid. x7 \<noteq> comSendPost uid p aid PID\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 6. \<And>x7. \<lbrakk>comStep s1 x7 = (outErr, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; ou1 = outErr\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x2
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cStep s1 x2 = (ou1, s1'); a = Cact x2; PID \<in>\<in> postIDs s1\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x2, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>x3. \<lbrakk>dStep s1 x3 = (ou1, s1'); a = Dact x3; PID \<in>\<in> postIDs s1\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x4. \<lbrakk>uStep s1 x4 = (ou1, s1'); a = Uact x4; PID \<in>\<in> postIDs s1; \<forall>uid p pst. x4 \<noteq> uPost uid p PID pst\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x4. \<lbrakk>uStep s1 x4 = (ou1, s1'); a = Uact x4; PID \<in>\<in> postIDs s1; ou1 \<noteq> outOK\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 4. \<And>x7. \<lbrakk>comStep s1 x7 = (ou1, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; \<forall>uid p aid. x7 \<noteq> comSendPost uid p aid PID\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 5. \<And>x7. \<lbrakk>comStep s1 x7 = (outErr, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; ou1 = outErr\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x3
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>dStep s1 x3 = (ou1, s1'); a = Dact x3; PID \<in>\<in> postIDs s1\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x3, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>x4. \<lbrakk>uStep s1 x4 = (ou1, s1'); a = Uact x4; PID \<in>\<in> postIDs s1; \<forall>uid p pst. x4 \<noteq> uPost uid p PID pst\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x4. \<lbrakk>uStep s1 x4 = (ou1, s1'); a = Uact x4; PID \<in>\<in> postIDs s1; ou1 \<noteq> outOK\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x7. \<lbrakk>comStep s1 x7 = (ou1, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; \<forall>uid p aid. x7 \<noteq> comSendPost uid p aid PID\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 4. \<And>x7. \<lbrakk>comStep s1 x7 = (outErr, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; ou1 = outErr\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x4
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>uStep s1 x4 = (ou1, s1'); a = Uact x4; PID \<in>\<in> postIDs s1; \<forall>uid p pst. x4 \<noteq> uPost uid p PID pst\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x4, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x4. \<lbrakk>uStep s1 x4 = (ou1, s1'); a = Uact x4; PID \<in>\<in> postIDs s1; ou1 \<noteq> outOK\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x7. \<lbrakk>comStep s1 x7 = (ou1, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; \<forall>uid p aid. x7 \<noteq> comSendPost uid p aid PID\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x7. \<lbrakk>comStep s1 x7 = (outErr, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; ou1 = outErr\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x4
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>uStep s1 x4 = (ou1, s1'); a = Uact x4; PID \<in>\<in> postIDs s1; ou1 \<noteq> outOK\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x4, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x7. \<lbrakk>comStep s1 x7 = (ou1, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; \<forall>uid p aid. x7 \<noteq> comSendPost uid p aid PID\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x7. \<lbrakk>comStep s1 x7 = (outErr, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; ou1 = outErr\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x7
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>comStep s1 x7 = (ou1, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; \<forall>uid p aid. x7 \<noteq> comSendPost uid p aid PID\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x7, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x7. \<lbrakk>comStep s1 x7 = (outErr, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; ou1 = outErr\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x7
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>comStep s1 x7 = (outErr, s1'); a = COMact x7; PID \<in>\<in> postIDs s1; ou1 = outErr\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x7, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<not> \<phi> (Trans s1 a ou1 s1') \<Longrightarrow> post s1' PID = post s1 PID

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
show "match ?\<Delta> s s1 vl1 a ou s' vl' \<or> ignore ?\<Delta> s s1 vl1 a ou s' vl'" (is "?match \<or> ?ignore")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
proof(cases "\<gamma> ?trn")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
note \<gamma> = True
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have ou: "(\<exists> uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or>
                                        ou = ou1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1
[PROOF STEP]
using eqButPID_step_\<gamma>_out[OF ss1 step step1 rsT T rs1 \<gamma>]
[PROOF STATE]
proof (prove)
using this:
(\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1

goal (1 subgoal):
 1. (\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
{
[PROOF STATE]
proof (state)
this:
(\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
assume \<phi>: "\<phi> ?trn"
[PROOF STATE]
proof (state)
this:
\<phi> (Trans s a ou s')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
hence "f ?trn = v"
[PROOF STATE]
proof (prove)
using this:
\<phi> (Trans s a ou s')

goal (1 subgoal):
 1. f (Trans s a ou s') = v
[PROOF STEP]
using c
[PROOF STATE]
proof (prove)
using this:
\<phi> (Trans s a ou s')
consume (Trans s a ou s') vl vl'

goal (1 subgoal):
 1. f (Trans s a ou s') = v
[PROOF STEP]
unfolding consume_def vl
[PROOF STATE]
proof (prove)
using this:
\<phi> (Trans s a ou s')
if \<phi> (Trans s a ou s') then v # vll \<noteq> [] \<and> f (Trans s a ou s') = hd (v # vll) \<and> vl' = tl (v # vll) else vl' = v # vll

goal (1 subgoal):
 1. f (Trans s a ou s') = v
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
f (Trans s a ou s') = v

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
hence "\<forall>ca. a \<noteq> COMact ca"
[PROOF STATE]
proof (prove)
using this:
f (Trans s a ou s') = v

goal (1 subgoal):
 1. \<forall>ca. a \<noteq> COMact ca
[PROOF STEP]
using \<phi>
[PROOF STATE]
proof (prove)
using this:
f (Trans s a ou s') = v
\<phi> (Trans s a ou s')

goal (1 subgoal):
 1. \<forall>ca. a \<noteq> COMact ca
[PROOF STEP]
unfolding \<phi>_def3[OF step] v
[PROOF STATE]
proof (prove)
using this:
f (Trans s a ou s') = PVal pst
(\<exists>pst. a = Uact (uPost (owner s PID) (pass s (owner s PID)) PID pst) \<and> ou = outOK) \<or> (\<exists>aid. a = COMact (comSendPost (admin s) (pass s (admin s)) aid PID) \<and> ou = O_sendPost (aid, clientPass s aid, PID, post s PID, owner s PID, vis s PID))

goal (1 subgoal):
 1. \<forall>ca. a \<noteq> COMact ca
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>ca. a \<noteq> COMact ca

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
hence False
[PROOF STATE]
proof (prove)
using this:
\<forall>ca. a \<noteq> COMact ca

goal (1 subgoal):
 1. False
[PROOF STEP]
using T_\<phi>_\<gamma>[OF rsT step \<phi>] \<gamma>
[PROOF STATE]
proof (prove)
using this:
\<forall>ca. a \<noteq> COMact ca
\<forall>ca. a \<noteq> COMact ca \<Longrightarrow> \<not> \<gamma> (Trans s a ou s')
\<gamma> (Trans s a ou s')

goal (1 subgoal):
 1. False
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
False

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
}
[PROOF STATE]
proof (state)
this:
\<phi> (Trans s a ou s') \<Longrightarrow> False

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
hence \<phi>: "\<not> \<phi> ?trn"
[PROOF STATE]
proof (prove)
using this:
\<phi> (Trans s a ou s') \<Longrightarrow> False

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<not> \<phi> (Trans s a ou s')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have vl': "vl' = vl"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vl' = vl
[PROOF STEP]
using \<phi> c
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s a ou s')
consume (Trans s a ou s') vl vl'

goal (1 subgoal):
 1. vl' = vl
[PROOF STEP]
unfolding consume_def
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s a ou s')
if \<phi> (Trans s a ou s') then vl \<noteq> [] \<and> f (Trans s a ou s') = hd vl \<and> vl' = tl vl else vl' = vl

goal (1 subgoal):
 1. vl' = vl
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
vl' = vl

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have \<phi>1: "\<not> \<phi> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> \<phi> (Trans s1 a ou1 s1')
[PROOF STEP]
using step step1 ss1 \<phi> eqButPID_step_\<phi>
[PROOF STATE]
proof (prove)
using this:
step s a = (ou, s')
step s1 a = (ou1, s1')
eqButPID s s1
\<not> \<phi> (Trans s a ou s')
\<lbrakk>eqButPID ?s ?s1.0; step ?s ?a = (?ou, ?s'); step ?s1.0 ?a = (?ou1.0, ?s1')\<rbrakk> \<Longrightarrow> \<phi> (Trans ?s ?a ?ou ?s') = \<phi> (Trans ?s1.0 ?a ?ou1.0 ?s1')

goal (1 subgoal):
 1. \<not> \<phi> (Trans s1 a ou1 s1')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> \<phi> (Trans s1 a ou1 s1')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have ?match
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. validTrans (Trans s1 ?a1.0 ?ou1.0 ?s1')
 2. consume (Trans s1 ?a1.0 ?ou1.0 ?s1') vl1 ?vl1'
 3. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 ?a1.0 ?ou1.0 ?s1')
 4. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 ?a1.0 ?ou1.0 ?s1')
 5. \<Delta>1 s' vl' ?s1' ?vl1' \<or> \<Delta>2 s' vl' ?s1' ?vl1'
[PROOF STEP]
show "validTrans ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. validTrans (Trans s1 a ou1 s1')
[PROOF STEP]
using step1
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')

goal (1 subgoal):
 1. validTrans (Trans s1 a ou1 s1')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
validTrans (Trans s1 a ou1 s1')

goal (4 subgoals):
 1. consume (Trans s1 a ou1 s1') vl1 ?vl1'
 2. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
 3. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 4. \<Delta>1 s' vl' s1' ?vl1' \<or> \<Delta>2 s' vl' s1' ?vl1'
[PROOF STEP]
show "consume ?trn1 vl1 vl1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. consume (Trans s1 a ou1 s1') vl1 vl1
[PROOF STEP]
using \<phi>1
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. consume (Trans s1 a ou1 s1') vl1 vl1
[PROOF STEP]
unfolding consume_def
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. if \<phi> (Trans s1 a ou1 s1') then vl1 \<noteq> [] \<and> f (Trans s1 a ou1 s1') = hd vl1 \<and> vl1 = tl vl1 else vl1 = vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
consume (Trans s1 a ou1 s1') vl1 vl1

goal (3 subgoals):
 1. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
 2. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 3. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
show "\<gamma> ?trn \<longleftrightarrow> \<gamma> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
show "g ?trn = g ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. g (Trans s a ou s') = g (Trans s1 a ou1 s1')
[PROOF STEP]
using ou
[PROOF STATE]
proof (prove)
using this:
(\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1

goal (1 subgoal):
 1. g (Trans s a ou s') = g (Trans s1 a ou1 s1')
[PROOF STEP]
by (cases a) auto
[PROOF STATE]
proof (state)
this:
g (Trans s a ou s') = g (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
have "\<Delta>1 s' vl' s1' vl1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1
[PROOF STEP]
using PID' s's1' vlvl1 l ch1 \<phi>1
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s'
eqButPID s' s1'
vl = [] \<longrightarrow> vl1 = []
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
corrFrom (post s1 PID) vl1
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1
[PROOF STEP]
unfolding \<Delta>1_def vl'
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s'
eqButPID s' s1'
vl = [] \<longrightarrow> vl1 = []
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
corrFrom (post s1 PID) vl1
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s' \<and> eqButPID s' s1' \<and> corrFrom (post s1' PID) vl1 \<and> (vl = [] \<longrightarrow> vl1 = []) \<and> map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1' vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
thus "?\<Delta> s' vl' s1' vl1"
[PROOF STATE]
proof (prove)
using this:
\<Delta>1 s' vl' s1' vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> \<gamma> (Trans s a ou s')

goal (1 subgoal):
 1. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
note \<gamma> = False
[PROOF STATE]
proof (state)
this:
\<not> \<gamma> (Trans s a ou s')

goal (1 subgoal):
 1. \<not> \<gamma> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
proof(cases "\<phi> ?trn")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
\<phi> (Trans s a ou s')

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
note \<phi> = True
[PROOF STATE]
proof (state)
this:
\<phi> (Trans s a ou s')

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
hence "f ?trn = v"
[PROOF STATE]
proof (prove)
using this:
\<phi> (Trans s a ou s')

goal (1 subgoal):
 1. f (Trans s a ou s') = v
[PROOF STEP]
using c
[PROOF STATE]
proof (prove)
using this:
\<phi> (Trans s a ou s')
consume (Trans s a ou s') vl vl'

goal (1 subgoal):
 1. f (Trans s a ou s') = v
[PROOF STEP]
unfolding consume_def vl
[PROOF STATE]
proof (prove)
using this:
\<phi> (Trans s a ou s')
if \<phi> (Trans s a ou s') then v # vll \<noteq> [] \<and> f (Trans s a ou s') = hd (v # vll) \<and> vl' = tl (v # vll) else vl' = v # vll

goal (1 subgoal):
 1. f (Trans s a ou s') = v
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
f (Trans s a ou s') = v

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
hence "\<forall>ca. a \<noteq> COMact ca"
[PROOF STATE]
proof (prove)
using this:
f (Trans s a ou s') = v

goal (1 subgoal):
 1. \<forall>ca. a \<noteq> COMact ca
[PROOF STEP]
using \<phi>
[PROOF STATE]
proof (prove)
using this:
f (Trans s a ou s') = v
\<phi> (Trans s a ou s')

goal (1 subgoal):
 1. \<forall>ca. a \<noteq> COMact ca
[PROOF STEP]
unfolding \<phi>_def3[OF step] v
[PROOF STATE]
proof (prove)
using this:
f (Trans s a ou s') = PVal pst
(\<exists>pst. a = Uact (uPost (owner s PID) (pass s (owner s PID)) PID pst) \<and> ou = outOK) \<or> (\<exists>aid. a = COMact (comSendPost (admin s) (pass s (admin s)) aid PID) \<and> ou = O_sendPost (aid, clientPass s aid, PID, post s PID, owner s PID, vis s PID))

goal (1 subgoal):
 1. \<forall>ca. a \<noteq> COMact ca
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>ca. a \<noteq> COMact ca

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<forall>ca. a \<noteq> COMact ca
[PROOF STEP]
obtain uid p "pstt" where a: "a = Uact (uPost uid p PID pstt)"
[PROOF STATE]
proof (prove)
using this:
\<forall>ca. a \<noteq> COMact ca

goal (1 subgoal):
 1. (\<And>uid p pstt. a = Uact (uPost uid p PID pstt) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<phi>
[PROOF STATE]
proof (prove)
using this:
\<forall>ca. a \<noteq> COMact ca
\<phi> (Trans s a ou s')

goal (1 subgoal):
 1. (\<And>uid p pstt. a = Uact (uPost uid p PID pstt) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding \<phi>_def2
[PROOF STATE]
proof (prove)
using this:
\<forall>ca. a \<noteq> COMact ca
(\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou \<noteq> outErr)

goal (1 subgoal):
 1. (\<And>uid p pstt. a = Uact (uPost uid p PID pstt) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
(* [OF step] *)
[PROOF STATE]
proof (prove)
using this:
\<forall>ca. a \<noteq> COMact ca
(\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou \<noteq> outErr)

goal (1 subgoal):
 1. (\<And>uid p pstt. a = Uact (uPost uid p PID pstt) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
a = Uact (uPost uid p PID pstt)

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
hence ss': "eqButPID s s'"
[PROOF STATE]
proof (prove)
using this:
a = Uact (uPost uid p PID pstt)

goal (1 subgoal):
 1. eqButPID s s'
[PROOF STEP]
using step Uact_uPaperC_step_eqButPID
[PROOF STATE]
proof (prove)
using this:
a = Uact (uPost uid p PID pstt)
step s a = (ou, s')
\<lbrakk>?a = Uact (uPost ?uid ?p PID ?pst); step ?s ?a = (?ou, ?s')\<rbrakk> \<Longrightarrow> eqButPID ?s ?s'

goal (1 subgoal):
 1. eqButPID s s'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
eqButPID s s'

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
hence s's1: "eqButPID s' s1"
[PROOF STATE]
proof (prove)
using this:
eqButPID s s'

goal (1 subgoal):
 1. eqButPID s' s1
[PROOF STEP]
using ss1 eqButPID_sym eqButPID_trans
[PROOF STATE]
proof (prove)
using this:
eqButPID s s'
eqButPID s s1
eqButPID ?s ?s1.0 \<Longrightarrow> eqButPID ?s1.0 ?s
\<lbrakk>eqButPID ?s ?s1.0; eqButPID ?s1.0 ?s2.0\<rbrakk> \<Longrightarrow> eqButPID ?s ?s2.0

goal (1 subgoal):
 1. eqButPID s' s1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
eqButPID s' s1

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have ?ignore
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<not> \<gamma> (Trans s a ou s')
 2. \<Delta>1 s' vl' s1 vl1 \<or> \<Delta>2 s' vl' s1 vl1
[PROOF STEP]
show "\<not> \<gamma> ?trn"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> \<gamma> (Trans s a ou s')
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
this:
\<not> \<gamma> (Trans s a ou s')

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1 vl1 \<or> \<Delta>2 s' vl' s1 vl1
[PROOF STEP]
have "\<Delta>1 s' vl' s1 vl1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Delta>1 s' vl' s1 vl1
[PROOF STEP]
using PID' s's1' ch1 l vl'NE s's1
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s'
eqButPID s' s1'
corrFrom (post s1 PID) vl1
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
vl' \<noteq> []
eqButPID s' s1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1 vl1
[PROOF STEP]
unfolding \<Delta>1_def fvl' vl v
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s'
eqButPID s' s1'
corrFrom (post s1 PID) vl1
map PValS_tgtAPI (filter isPValS (PVal pst # vll)) = map PValS_tgtAPI (filter isPValS vl1)
vl' \<noteq> []
eqButPID s' s1

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s' \<and> eqButPID s' s1 \<and> corrFrom (post s1 PID) vl1 \<and> (vl' = [] \<longrightarrow> vl1 = []) \<and> map PValS_tgtAPI (filter isPValS vll) = map PValS_tgtAPI (filter isPValS vl1)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1 vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1 vl1 \<or> \<Delta>2 s' vl' s1 vl1
[PROOF STEP]
thus "?\<Delta> s' vl' s1 vl1"
[PROOF STATE]
proof (prove)
using this:
\<Delta>1 s' vl' s1 vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1 vl1 \<or> \<Delta>2 s' vl' s1 vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1 vl1 \<or> \<Delta>2 s' vl' s1 vl1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> \<phi> (Trans s a ou s')

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
note \<phi> = False
[PROOF STATE]
proof (state)
this:
\<not> \<phi> (Trans s a ou s')

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have vl': "vl' = vl"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vl' = vl
[PROOF STEP]
using \<phi> c
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s a ou s')
consume (Trans s a ou s') vl vl'

goal (1 subgoal):
 1. vl' = vl
[PROOF STEP]
unfolding consume_def
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s a ou s')
if \<phi> (Trans s a ou s') then vl \<noteq> [] \<and> f (Trans s a ou s') = hd vl \<and> vl' = tl vl else vl' = vl

goal (1 subgoal):
 1. vl' = vl
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
vl' = vl

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have \<phi>1: "\<not> \<phi> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> \<phi> (Trans s1 a ou1 s1')
[PROOF STEP]
using step step1 ss1 \<phi> eqButPID_step_\<phi>
[PROOF STATE]
proof (prove)
using this:
step s a = (ou, s')
step s1 a = (ou1, s1')
eqButPID s s1
\<not> \<phi> (Trans s a ou s')
\<lbrakk>eqButPID ?s ?s1.0; step ?s ?a = (?ou, ?s'); step ?s1.0 ?a = (?ou1.0, ?s1')\<rbrakk> \<Longrightarrow> \<phi> (Trans ?s ?a ?ou ?s') = \<phi> (Trans ?s1.0 ?a ?ou1.0 ?s1')

goal (1 subgoal):
 1. \<not> \<phi> (Trans s1 a ou1 s1')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have ?match
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. validTrans (Trans s1 ?a1.0 ?ou1.0 ?s1')
 2. consume (Trans s1 ?a1.0 ?ou1.0 ?s1') vl1 ?vl1'
 3. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 ?a1.0 ?ou1.0 ?s1')
 4. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 ?a1.0 ?ou1.0 ?s1')
 5. \<Delta>1 s' vl' ?s1' ?vl1' \<or> \<Delta>2 s' vl' ?s1' ?vl1'
[PROOF STEP]
show "validTrans ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. validTrans (Trans s1 a ou1 s1')
[PROOF STEP]
using step1
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')

goal (1 subgoal):
 1. validTrans (Trans s1 a ou1 s1')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
validTrans (Trans s1 a ou1 s1')

goal (4 subgoals):
 1. consume (Trans s1 a ou1 s1') vl1 ?vl1'
 2. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
 3. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 4. \<Delta>1 s' vl' s1' ?vl1' \<or> \<Delta>2 s' vl' s1' ?vl1'
[PROOF STEP]
show "consume ?trn1 vl1 vl1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. consume (Trans s1 a ou1 s1') vl1 vl1
[PROOF STEP]
using \<phi>1
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. consume (Trans s1 a ou1 s1') vl1 vl1
[PROOF STEP]
unfolding consume_def
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. if \<phi> (Trans s1 a ou1 s1') then vl1 \<noteq> [] \<and> f (Trans s1 a ou1 s1') = hd vl1 \<and> vl1 = tl vl1 else vl1 = vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
consume (Trans s1 a ou1 s1') vl1 vl1

goal (3 subgoals):
 1. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
 2. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 3. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
show "\<gamma> ?trn \<longleftrightarrow> \<gamma> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
assume "\<gamma> ?trn"
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
thus "g ?trn = g ?trn1"
[PROOF STATE]
proof (prove)
using this:
\<gamma> (Trans s a ou s')

goal (1 subgoal):
 1. g (Trans s a ou s') = g (Trans s1 a ou1 s1')
[PROOF STEP]
using \<gamma>
[PROOF STATE]
proof (prove)
using this:
\<gamma> (Trans s a ou s')
\<not> \<gamma> (Trans s a ou s')

goal (1 subgoal):
 1. g (Trans s a ou s') = g (Trans s1 a ou1 s1')
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
g (Trans s a ou s') = g (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
have "\<Delta>1 s' vl' s1' vl1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1
[PROOF STEP]
using PID' s's1' vlvl1 l ch1 \<phi>1
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s'
eqButPID s' s1'
vl = [] \<longrightarrow> vl1 = []
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
corrFrom (post s1 PID) vl1
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1
[PROOF STEP]
unfolding \<Delta>1_def vl'
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s'
eqButPID s' s1'
vl = [] \<longrightarrow> vl1 = []
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
corrFrom (post s1 PID) vl1
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s' \<and> eqButPID s' s1' \<and> corrFrom (post s1' PID) vl1 \<and> (vl = [] \<longrightarrow> vl1 = []) \<and> map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1' vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
thus "?\<Delta> s' vl' s1' vl1"
[PROOF STATE]
proof (prove)
using this:
\<Delta>1 s' vl' s1' vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal (2 subgoals):
 1. \<And>x1. v = PVal x1 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
 2. \<And>x21 x22. v = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal (1 subgoal):
 1. iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
using vlvl1
[PROOF STATE]
proof (prove)
using this:
reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
vl = [] \<longrightarrow> vl1 = []

goal (1 subgoal):
 1. iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal (1 subgoal):
 1. \<And>x21 x22. v = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x21 x22. v = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
case (PValS aid "pst")
[PROOF STATE]
proof (state)
this:
v = PValS aid pst

goal (1 subgoal):
 1. \<And>x21 x22. v = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
note v = PValS
[PROOF STATE]
proof (state)
this:
v = PValS aid pst

goal (1 subgoal):
 1. \<And>x21 x22. v = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
have ?react
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
fix a :: act and ou :: out and s' :: state and vl'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
let ?trn = "Trans s a ou s'"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
assume step: "step s a = (ou, s')" and T: "\<not> T ?trn" and c: "consume ?trn vl vl'"
[PROOF STATE]
proof (state)
this:
step s a = (ou, s')
\<not> T (Trans s a ou s')
consume (Trans s a ou s') vl vl'

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have vl': "vl' = vl \<or> vl' = vll"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vl' = vl \<or> vl' = vll
[PROOF STEP]
using c
[PROOF STATE]
proof (prove)
using this:
consume (Trans s a ou s') vl vl'

goal (1 subgoal):
 1. vl' = vl \<or> vl' = vll
[PROOF STEP]
unfolding vl consume_def
[PROOF STATE]
proof (prove)
using this:
if \<phi> (Trans s a ou s') then v # vll \<noteq> [] \<and> f (Trans s a ou s') = hd (v # vll) \<and> vl' = tl (v # vll) else vl' = v # vll

goal (1 subgoal):
 1. vl' = v # vll \<or> vl' = vll
[PROOF STEP]
by (cases "\<phi> ?trn") auto
[PROOF STATE]
proof (state)
this:
vl' = vl \<or> vl' = vll

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
obtain ou1 s1' where step1: "step s1 a = (ou1, s1')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ou1 s1'. step s1 a = (ou1, s1') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
step s1 a = (ou1, s1')

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
let ?trn1 = "Trans s1 a ou1 s1'"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have s's1': "eqButPID s' s1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eqButPID s' s1'
[PROOF STEP]
using eqButPID_step ss1 step step1
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>eqButPID ?s ?s1.0; step ?s ?a = (?ou, ?s'); step ?s1.0 ?a = (?ou1.0, ?s1')\<rbrakk> \<Longrightarrow> eqButPID ?s' ?s1'
eqButPID s s1
step s a = (ou, s')
step s1 a = (ou1, s1')

goal (1 subgoal):
 1. eqButPID s' s1'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
eqButPID s' s1'

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have \<gamma>\<gamma>1: "\<gamma> ?trn \<longleftrightarrow> \<gamma> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have PID': "PID \<in>\<in> postIDs s'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. PID \<in>\<in> postIDs s'
[PROOF STEP]
using step rs PID
[PROOF STATE]
proof (prove)
using this:
step s a = (ou, s')
reach s
PID \<in>\<in> postIDs s

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s'
[PROOF STEP]
using reach_postIDs_persist
[PROOF STATE]
proof (prove)
using this:
step s a = (ou, s')
reach s
PID \<in>\<in> postIDs s
\<lbrakk>?pID \<in>\<in> postIDs ?s; step ?s ?a = (?ou, ?s')\<rbrakk> \<Longrightarrow> ?pID \<in>\<in> postIDs ?s'

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
PID \<in>\<in> postIDs s'

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
show "match ?\<Delta> s s1 vl1 a ou s' vl' \<or> ignore ?\<Delta> s s1 vl1 a ou s' vl'" (is "?match \<or> ?ignore")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have ?match
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
proof(cases "\<phi> ?trn")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
\<phi> (Trans s a ou s')

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
note \<phi> = True
[PROOF STATE]
proof (state)
this:
\<phi> (Trans s a ou s')

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have \<phi>1: "\<phi> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<phi> (Trans s1 a ou1 s1')
[PROOF STEP]
using step step1 ss1 \<phi> eqButPID_step_\<phi>
[PROOF STATE]
proof (prove)
using this:
step s a = (ou, s')
step s1 a = (ou1, s1')
eqButPID s s1
\<phi> (Trans s a ou s')
\<lbrakk>eqButPID ?s ?s1.0; step ?s ?a = (?ou, ?s'); step ?s1.0 ?a = (?ou1.0, ?s1')\<rbrakk> \<Longrightarrow> \<phi> (Trans ?s ?a ?ou ?s') = \<phi> (Trans ?s1.0 ?a ?ou1.0 ?s1')

goal (1 subgoal):
 1. \<phi> (Trans s1 a ou1 s1')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<phi> (Trans s1 a ou1 s1')

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
let ?ad = "admin s"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
let ?p = "pass s ?ad"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
let ?pst = "post s PID"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
let ?uid = "owner s PID"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
let ?vs = "vis s PID"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
obtain vl': "vl' = vll"
              and ou: "ou = O_sendPost (aid, clientPass s aid, PID, pst, ?uid, ?vs)"
              and a: "a = COMact (comSendPost ?ad ?p aid PID)" and "pst": "pst = ?pst"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lbrakk>vl' = vll; ou = O_sendPost (aid, clientPass s aid, PID, pst, owner s PID, vis s PID); a = COMact (comSendPost (admin s) (pass s (admin s)) aid PID); pst = post s PID\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<phi> c
[PROOF STATE]
proof (prove)
using this:
\<phi> (Trans s a ou s')
consume (Trans s a ou s') vl vl'

goal (1 subgoal):
 1. (\<lbrakk>vl' = vll; ou = O_sendPost (aid, clientPass s aid, PID, pst, owner s PID, vis s PID); a = COMact (comSendPost (admin s) (pass s (admin s)) aid PID); pst = post s PID\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding \<phi>_def3[OF step] consume_def vl v
[PROOF STATE]
proof (prove)
using this:
(\<exists>pst. a = Uact (uPost (owner s PID) (pass s (owner s PID)) PID pst) \<and> ou = outOK) \<or> (\<exists>aid. a = COMact (comSendPost (admin s) (pass s (admin s)) aid PID) \<and> ou = O_sendPost (aid, clientPass s aid, PID, post s PID, owner s PID, vis s PID))
if (\<exists>pst. a = Uact (uPost (owner s PID) (pass s (owner s PID)) PID pst) \<and> ou = outOK) \<or> (\<exists>aid. a = COMact (comSendPost (admin s) (pass s (admin s)) aid PID) \<and> ou = O_sendPost (aid, clientPass s aid, PID, post s PID, owner s PID, vis s PID)) then PValS aid pst # vll \<noteq> [] \<and> f (Trans s a ou s') = hd (PValS aid pst # vll) \<and> vl' = tl (PValS aid pst # vll) else vl' = PValS aid pst # vll

goal (1 subgoal):
 1. (\<lbrakk>vl' = vll; ou = O_sendPost (aid, clientPass s aid, PID, pst, owner s PID, vis s PID); a = COMact (comSendPost (admin s) (pass s (admin s)) aid PID); pst = post s PID\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vl' = vll
ou = O_sendPost (aid, clientPass s aid, PID, pst, owner s PID, vis s PID)
a = COMact (comSendPost (admin s) (pass s (admin s)) aid PID)
pst = post s PID

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
let ?pst1 = "post s1 PID"
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have "clientPass s aid = clientPass s1 aid" and "?uid = owner s1 PID"
              and "?vs = vis s1 PID"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. clientPass s aid = clientPass s1 aid &&& owner s PID = owner s1 PID &&& vis s PID = vis s1 PID
[PROOF STEP]
using eqButPID_stateSelectors[OF ss1]
[PROOF STATE]
proof (prove)
using this:
admin s = admin s1 \<and> pendingUReqs s = pendingUReqs s1 \<and> userReq s = userReq s1 \<and> userIDs s = userIDs s1 \<and> user s = user s1 \<and> pass s = pass s1 \<and> pendingFReqs s = pendingFReqs s1 \<and> friendReq s = friendReq s1 \<and> friendIDs s = friendIDs s1 \<and> sentOuterFriendIDs s = sentOuterFriendIDs s1 \<and> recvOuterFriendIDs s = recvOuterFriendIDs s1 \<and> postIDs s = postIDs s1 \<and> admin s = admin s1 \<and> eeqButPID (post s) (post s1) \<and> owner s = owner s1 \<and> vis s = vis s1 \<and> pendingSApiReqs s = pendingSApiReqs s1 \<and> sApiReq s = sApiReq s1 \<and> serverApiIDs s = serverApiIDs s1 \<and> serverPass s = serverPass s1 \<and> outerPostIDs s = outerPostIDs s1 \<and> outerPost s = outerPost s1 \<and> outerOwner s = outerOwner s1 \<and> outerVis s = outerVis s1 \<and> pendingCApiReqs s = pendingCApiReqs s1 \<and> cApiReq s = cApiReq s1 \<and> clientApiIDs s = clientApiIDs s1 \<and> clientPass s = clientPass s1 \<and> eeqButPID_F (sharedWith s) (sharedWith s1) \<and> IDsOK s = IDsOK s1

goal (1 subgoal):
 1. clientPass s aid = clientPass s1 aid &&& owner s PID = owner s1 PID &&& vis s PID = vis s1 PID
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
clientPass s aid = clientPass s1 aid
owner s PID = owner s1 PID
vis s PID = vis s1 PID

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
hence ou1: "ou1 = O_sendPost (aid, clientPass s aid, PID, ?pst1, ?uid, ?vs)"
[PROOF STATE]
proof (prove)
using this:
clientPass s aid = clientPass s1 aid
owner s PID = owner s1 PID
vis s PID = vis s1 PID

goal (1 subgoal):
 1. ou1 = O_sendPost (aid, clientPass s aid, PID, post s1 PID, owner s PID, vis s PID)
[PROOF STEP]
using step1 \<phi>1
[PROOF STATE]
proof (prove)
using this:
clientPass s aid = clientPass s1 aid
owner s PID = owner s1 PID
vis s PID = vis s1 PID
step s1 a = (ou1, s1')
\<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. ou1 = O_sendPost (aid, clientPass s aid, PID, post s1 PID, owner s PID, vis s PID)
[PROOF STEP]
unfolding \<phi>_def3[OF step1] vl1 v1 a
[PROOF STATE]
proof (prove)
using this:
clientPass s aid = clientPass s1 aid
owner s PID = owner s1 PID
vis s PID = vis s1 PID
step s1 (COMact (comSendPost (admin s) (pass s (admin s)) aid PID)) = (ou1, s1')
\<phi> (Trans s1 (COMact (comSendPost (admin s) (pass s (admin s)) aid PID)) ou1 s1')

goal (1 subgoal):
 1. ou1 = O_sendPost (aid, clientPass s aid, PID, post s1 PID, owner s PID, vis s PID)
[PROOF STEP]
by (auto simp: com_defs)
[PROOF STATE]
proof (state)
this:
ou1 = O_sendPost (aid, clientPass s aid, PID, post s1 PID, owner s PID, vis s PID)

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have 2[simp]: "post s1' PID = pst1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. post s1' PID = pst1
[PROOF STEP]
using step1
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')

goal (1 subgoal):
 1. post s1' PID = pst1
[PROOF STEP]
unfolding a ou1 pst1
[PROOF STATE]
proof (prove)
using this:
step s1 (COMact (comSendPost (admin s) (pass s (admin s)) aid PID)) = (O_sendPost (aid, clientPass s aid, PID, post s1 PID, owner s PID, vis s PID), s1')

goal (1 subgoal):
 1. post s1' PID = post s1 PID
[PROOF STEP]
by (auto simp: com_defs)
[PROOF STATE]
proof (state)
this:
post s1' PID = pst1

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have ch_vll1: "corrFrom pst1 vll1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. corrFrom pst1 vll1
[PROOF STEP]
using ch1
[PROOF STATE]
proof (prove)
using this:
corrFrom (post s1 PID) vl1

goal (1 subgoal):
 1. corrFrom pst1 vll1
[PROOF STEP]
unfolding pst1[symmetric] vl1 v1
[PROOF STATE]
proof (prove)
using this:
corrFrom pst1 (PValS aid1 pst1 # vll1)

goal (1 subgoal):
 1. corrFrom pst1 vll1
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
corrFrom pst1 vll1

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. validTrans (Trans s1 ?a1.0 ?ou1.0 ?s1')
 2. consume (Trans s1 ?a1.0 ?ou1.0 ?s1') vl1 ?vl1'
 3. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 ?a1.0 ?ou1.0 ?s1')
 4. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 ?a1.0 ?ou1.0 ?s1')
 5. \<Delta>1 s' vl' ?s1' ?vl1' \<or> \<Delta>2 s' vl' ?s1' ?vl1'
[PROOF STEP]
show "validTrans ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. validTrans (Trans s1 a ou1 s1')
[PROOF STEP]
using step1
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')

goal (1 subgoal):
 1. validTrans (Trans s1 a ou1 s1')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
validTrans (Trans s1 a ou1 s1')

goal (4 subgoals):
 1. consume (Trans s1 a ou1 s1') vl1 ?vl1'
 2. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
 3. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 4. \<Delta>1 s' vl' s1' ?vl1' \<or> \<Delta>2 s' vl' s1' ?vl1'
[PROOF STEP]
show "consume (Trans s1 a ou1 s1') vl1 vll1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. consume (Trans s1 a ou1 s1') vl1 vll1
[PROOF STEP]
using l \<phi>1 pst1
[PROOF STATE]
proof (prove)
using this:
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
\<phi> (Trans s1 a ou1 s1')
pst1 = post s1 PID

goal (1 subgoal):
 1. consume (Trans s1 a ou1 s1') vl1 vll1
[PROOF STEP]
unfolding consume_def vl vl1 v v1 a ou1
[PROOF STATE]
proof (prove)
using this:
map PValS_tgtAPI (filter isPValS (PValS aid pst # vll)) = map PValS_tgtAPI (filter isPValS (PValS aid1 pst1 # vll1))
\<phi> (Trans s1 (COMact (comSendPost (admin s) (pass s (admin s)) aid PID)) (O_sendPost (aid, clientPass s aid, PID, post s1 PID, owner s PID, vis s PID)) s1')
pst1 = post s1 PID

goal (1 subgoal):
 1. if \<phi> (Trans s1 (COMact (comSendPost (admin s) (pass s (admin s)) aid PID)) (O_sendPost (aid, clientPass s aid, PID, post s1 PID, owner s PID, vis s PID)) s1') then PValS aid1 pst1 # vll1 \<noteq> [] \<and> f (Trans s1 (COMact (comSendPost (admin s) (pass s (admin s)) aid PID)) (O_sendPost (aid, clientPass s aid, PID, post s1 PID, owner s PID, vis s PID)) s1') = hd (PValS aid1 pst1 # vll1) \<and> vll1 = tl (PValS aid1 pst1 # vll1) else vll1 = PValS aid1 pst1 # vll1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
consume (Trans s1 a ou1 s1') vl1 vll1

goal (3 subgoals):
 1. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
 2. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 3. \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
show "\<gamma> ?trn \<longleftrightarrow> \<gamma> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
show "g ?trn = g ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. g (Trans s a ou s') = g (Trans s1 a ou1 s1')
[PROOF STEP]
unfolding a ou ou1
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. g (Trans s (COMact (comSendPost (admin s) (pass s (admin s)) aid PID)) (O_sendPost (aid, clientPass s aid, PID, pst, owner s PID, vis s PID)) s') = g (Trans s1 (COMact (comSendPost (admin s) (pass s (admin s)) aid PID)) (O_sendPost (aid, clientPass s aid, PID, post s1 PID, owner s PID, vis s PID)) s1')
[PROOF STEP]
by (simp add: ss1)
[PROOF STATE]
proof (state)
this:
g (Trans s a ou s') = g (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
show "?\<Delta> s' vl' s1' vll1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
proof(cases "vll = []")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. vll = [] \<Longrightarrow> \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
 2. vll \<noteq> [] \<Longrightarrow> \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
vll \<noteq> []

goal (2 subgoals):
 1. vll = [] \<Longrightarrow> \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
 2. vll \<noteq> [] \<Longrightarrow> \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
hence "\<Delta>1 s' vl' s1' vll1"
[PROOF STATE]
proof (prove)
using this:
vll \<noteq> []

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vll1
[PROOF STEP]
using PID' s's1' vlvl1 l ch1 ch_vll1
[PROOF STATE]
proof (prove)
using this:
vll \<noteq> []
PID \<in>\<in> postIDs s'
eqButPID s' s1'
vl = [] \<longrightarrow> vl1 = []
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
corrFrom (post s1 PID) vl1
corrFrom pst1 vll1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vll1
[PROOF STEP]
unfolding \<Delta>1_def vl' vl vl1 v v1
[PROOF STATE]
proof (prove)
using this:
vll \<noteq> []
PID \<in>\<in> postIDs s'
eqButPID s' s1'
PValS aid pst # vll = [] \<longrightarrow> PValS aid1 pst1 # vll1 = []
map PValS_tgtAPI (filter isPValS (PValS aid pst # vll)) = map PValS_tgtAPI (filter isPValS (PValS aid1 pst1 # vll1))
corrFrom (post s1 PID) (PValS aid1 pst1 # vll1)
corrFrom pst1 vll1

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s' \<and> eqButPID s' s1' \<and> corrFrom (post s1' PID) vll1 \<and> (vll = [] \<longrightarrow> vll1 = []) \<and> map PValS_tgtAPI (filter isPValS vll) = map PValS_tgtAPI (filter isPValS vll1)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1' vll1

goal (2 subgoals):
 1. vll = [] \<Longrightarrow> \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
 2. vll \<noteq> [] \<Longrightarrow> \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<Delta>1 s' vl' s1' vll1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1

goal (1 subgoal):
 1. vll = [] \<Longrightarrow> \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vll = [] \<Longrightarrow> \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
vll = []

goal (1 subgoal):
 1. vll = [] \<Longrightarrow> \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
hence "list_all isPVal vll1"
[PROOF STATE]
proof (prove)
using this:
vll = []

goal (1 subgoal):
 1. list_all isPVal vll1
[PROOF STEP]
using l
[PROOF STATE]
proof (prove)
using this:
vll = []
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)

goal (1 subgoal):
 1. list_all isPVal vll1
[PROOF STEP]
unfolding vl vl1 v v1
[PROOF STATE]
proof (prove)
using this:
vll = []
map PValS_tgtAPI (filter isPValS (PValS aid pst # vll)) = map PValS_tgtAPI (filter isPValS (PValS aid1 pst1 # vll1))

goal (1 subgoal):
 1. list_all isPVal vll1
[PROOF STEP]
by (simp add: filter_isPValS_Nil)
[PROOF STATE]
proof (state)
this:
list_all isPVal vll1

goal (1 subgoal):
 1. vll = [] \<Longrightarrow> \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
hence "\<Delta>2 s' vl' s1' vll1"
[PROOF STATE]
proof (prove)
using this:
list_all isPVal vll1

goal (1 subgoal):
 1. \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
using True PID' s's1' vlvl1 l ch1 ch_vll1
[PROOF STATE]
proof (prove)
using this:
list_all isPVal vll1
vll = []
PID \<in>\<in> postIDs s'
eqButPID s' s1'
vl = [] \<longrightarrow> vl1 = []
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
corrFrom (post s1 PID) vl1
corrFrom pst1 vll1

goal (1 subgoal):
 1. \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
unfolding \<Delta>2_def vl' vl vl1 v v1
[PROOF STATE]
proof (prove)
using this:
list_all isPVal vll1
vll = []
PID \<in>\<in> postIDs s'
eqButPID s' s1'
PValS aid pst # vll = [] \<longrightarrow> PValS aid1 pst1 # vll1 = []
map PValS_tgtAPI (filter isPValS (PValS aid pst # vll)) = map PValS_tgtAPI (filter isPValS (PValS aid1 pst1 # vll1))
corrFrom (post s1 PID) (PValS aid1 pst1 # vll1)
corrFrom pst1 vll1

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s' \<and> eqButPID s' s1' \<and> vll = [] \<and> list_all isPVal vll1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Delta>2 s' vl' s1' vll1

goal (1 subgoal):
 1. vll = [] \<Longrightarrow> \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<Delta>2 s' vl' s1' vll1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1' vll1 \<or> \<Delta>2 s' vl' s1' vll1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> \<phi> (Trans s a ou s')

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
note \<phi> = False
[PROOF STATE]
proof (state)
this:
\<not> \<phi> (Trans s a ou s')

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have vl': "vl' = vl"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vl' = vl
[PROOF STEP]
using \<phi> c
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s a ou s')
consume (Trans s a ou s') vl vl'

goal (1 subgoal):
 1. vl' = vl
[PROOF STEP]
unfolding consume_def
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s a ou s')
if \<phi> (Trans s a ou s') then vl \<noteq> [] \<and> f (Trans s a ou s') = hd vl \<and> vl' = tl vl else vl' = vl

goal (1 subgoal):
 1. vl' = vl
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
vl' = vl

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have \<phi>1: "\<not> \<phi> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> \<phi> (Trans s1 a ou1 s1')
[PROOF STEP]
using step step1 ss1 \<phi> eqButPID_step_\<phi>
[PROOF STATE]
proof (prove)
using this:
step s a = (ou, s')
step s1 a = (ou1, s1')
eqButPID s s1
\<not> \<phi> (Trans s a ou s')
\<lbrakk>eqButPID ?s ?s1.0; step ?s ?a = (?ou, ?s'); step ?s1.0 ?a = (?ou1.0, ?s1')\<rbrakk> \<Longrightarrow> \<phi> (Trans ?s ?a ?ou ?s') = \<phi> (Trans ?s1.0 ?a ?ou1.0 ?s1')

goal (1 subgoal):
 1. \<not> \<phi> (Trans s1 a ou1 s1')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have ?match
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. validTrans (Trans s1 ?a1.0 ?ou1.0 ?s1')
 2. consume (Trans s1 ?a1.0 ?ou1.0 ?s1') vl1 ?vl1'
 3. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 ?a1.0 ?ou1.0 ?s1')
 4. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 ?a1.0 ?ou1.0 ?s1')
 5. \<Delta>1 s' vl' ?s1' ?vl1' \<or> \<Delta>2 s' vl' ?s1' ?vl1'
[PROOF STEP]
show "validTrans ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. validTrans (Trans s1 a ou1 s1')
[PROOF STEP]
using step1
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')

goal (1 subgoal):
 1. validTrans (Trans s1 a ou1 s1')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
validTrans (Trans s1 a ou1 s1')

goal (4 subgoals):
 1. consume (Trans s1 a ou1 s1') vl1 ?vl1'
 2. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
 3. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 4. \<Delta>1 s' vl' s1' ?vl1' \<or> \<Delta>2 s' vl' s1' ?vl1'
[PROOF STEP]
show "consume ?trn1 vl1 vl1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. consume (Trans s1 a ou1 s1') vl1 vl1
[PROOF STEP]
using \<phi>1
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. consume (Trans s1 a ou1 s1') vl1 vl1
[PROOF STEP]
unfolding consume_def
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. if \<phi> (Trans s1 a ou1 s1') then vl1 \<noteq> [] \<and> f (Trans s1 a ou1 s1') = hd vl1 \<and> vl1 = tl vl1 else vl1 = vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
consume (Trans s1 a ou1 s1') vl1 vl1

goal (3 subgoals):
 1. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
 2. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 3. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
show "\<gamma> ?trn \<longleftrightarrow> \<gamma> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
assume "\<gamma> ?trn"
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
note \<gamma> = this
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
have ou: "(\<exists> uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or>
                                        ou = ou1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1
[PROOF STEP]
using eqButPID_step_\<gamma>_out[OF ss1 step step1 rsT T rs1 \<gamma>]
[PROOF STATE]
proof (prove)
using this:
(\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1

goal (1 subgoal):
 1. (\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
thus "g ?trn = g ?trn1"
[PROOF STATE]
proof (prove)
using this:
(\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1

goal (1 subgoal):
 1. g (Trans s a ou s') = g (Trans s1 a ou1 s1')
[PROOF STEP]
by (cases a) auto
[PROOF STATE]
proof (state)
this:
g (Trans s a ou s') = g (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
have 2[simp]: "post s1' PID  = post s1 PID"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. post s1' PID = post s1 PID
[PROOF STEP]
using step1 PID1 \<phi>1
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')
PID \<in>\<in> postIDs s1
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. post s1' PID = post s1 PID
[PROOF STEP]
unfolding \<phi>_def2
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')
PID \<in>\<in> postIDs s1
\<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr))

goal (1 subgoal):
 1. post s1' PID = post s1 PID
[PROOF STEP]
(* [OF step1] *)
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')
PID \<in>\<in> postIDs s1
\<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr))

goal (1 subgoal):
 1. post s1' PID = post s1 PID
[PROOF STEP]
apply(cases a)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>x1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Sact x1\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x2. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Cact x2\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x3. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Dact x3\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 4. \<And>x4. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Uact x4\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 5. \<And>x5. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Ract x5\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 6. \<And>x6. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 7. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x1
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Sact x1\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x1, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>x2. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Cact x2\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x3. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Dact x3\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x4. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Uact x4\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 4. \<And>x5. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Ract x5\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 5. \<And>x6. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 6. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x2
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Cact x2\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x2, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>x3. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Dact x3\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x4. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Uact x4\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x5. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Ract x5\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 4. \<And>x6. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 5. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x3
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Dact x3\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x3, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>x4. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Uact x4\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x5. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Ract x5\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x6. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 4. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x4
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Uact x4\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x4, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x5. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Ract x5\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x6. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Ract x5_\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x6. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6_\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x7
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x7, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
post s1' PID = post s1 PID

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
have "\<Delta>1 s' vl' s1' vl1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1
[PROOF STEP]
using PID' s's1' vlvl1 l ch1
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s'
eqButPID s' s1'
vl = [] \<longrightarrow> vl1 = []
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
corrFrom (post s1 PID) vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1
[PROOF STEP]
unfolding \<Delta>1_def vl' vl vl1 v v1
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s'
eqButPID s' s1'
PValS aid pst # vll = [] \<longrightarrow> PValS aid1 pst1 # vll1 = []
map PValS_tgtAPI (filter isPValS (PValS aid pst # vll)) = map PValS_tgtAPI (filter isPValS (PValS aid1 pst1 # vll1))
corrFrom (post s1 PID) (PValS aid1 pst1 # vll1)

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s' \<and> eqButPID s' s1' \<and> corrFrom (post s1' PID) (PValS aid1 pst1 # vll1) \<and> (PValS aid pst # vll = [] \<longrightarrow> PValS aid1 pst1 # vll1 = []) \<and> map PValS_tgtAPI (filter isPValS (PValS aid pst # vll)) = map PValS_tgtAPI (filter isPValS (PValS aid1 pst1 # vll1))
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1' vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
thus "?\<Delta> s' vl' s1' vl1"
[PROOF STATE]
proof (prove)
using this:
\<Delta>1 s' vl' s1' vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal (1 subgoal):
 1. \<And>x21 x22. v = PValS x21 x22 \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal (1 subgoal):
 1. iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
using vlvl1
[PROOF STATE]
proof (prove)
using this:
reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
vl = [] \<longrightarrow> vl1 = []

goal (1 subgoal):
 1. iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal (1 subgoal):
 1. vl1 = [] \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vl1 = [] \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
vl1 = []

goal (1 subgoal):
 1. vl1 = [] \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
note vl1 = Nil
[PROOF STATE]
proof (state)
this:
vl1 = []

goal (1 subgoal):
 1. vl1 = [] \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
have ?react
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
fix a :: act and ou :: out and s' :: state and vl'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
let ?trn = "Trans s a ou s'"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
assume step: "step s a = (ou, s')" and T: "\<not> T ?trn" and c: "consume ?trn vl vl'"
[PROOF STATE]
proof (state)
this:
step s a = (ou, s')
\<not> T (Trans s a ou s')
consume (Trans s a ou s') vl vl'

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
obtain ou1 s1' where step1: "step s1 a = (ou1, s1')"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>ou1 s1'. step s1 a = (ou1, s1') \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
step s1 a = (ou1, s1')

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
let ?trn1 = "Trans s1 a ou1 s1'"
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have s's1': "eqButPID s' s1'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eqButPID s' s1'
[PROOF STEP]
using eqButPID_step ss1 step step1
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>eqButPID ?s ?s1.0; step ?s ?a = (?ou, ?s'); step ?s1.0 ?a = (?ou1.0, ?s1')\<rbrakk> \<Longrightarrow> eqButPID ?s' ?s1'
eqButPID s s1
step s a = (ou, s')
step s1 a = (ou1, s1')

goal (1 subgoal):
 1. eqButPID s' s1'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
eqButPID s' s1'

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have \<gamma>\<gamma>1: "\<gamma> ?trn \<longleftrightarrow> \<gamma> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have PID': "PID \<in>\<in> postIDs s'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. PID \<in>\<in> postIDs s'
[PROOF STEP]
using step rs PID
[PROOF STATE]
proof (prove)
using this:
step s a = (ou, s')
reach s
PID \<in>\<in> postIDs s

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s'
[PROOF STEP]
using reach_postIDs_persist
[PROOF STATE]
proof (prove)
using this:
step s a = (ou, s')
reach s
PID \<in>\<in> postIDs s
\<lbrakk>?pID \<in>\<in> postIDs ?s; step ?s ?a = (?ou, ?s')\<rbrakk> \<Longrightarrow> ?pID \<in>\<in> postIDs ?s'

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
PID \<in>\<in> postIDs s'

goal (1 subgoal):
 1. \<And>a ou s' vl'. \<lbrakk>step s a = (ou, s'); \<not> T (Trans s a ou s'); consume (Trans s a ou s') vl vl'\<rbrakk> \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
show "match ?\<Delta> s s1 vl1 a ou s' vl' \<or> ignore ?\<Delta> s s1 vl1 a ou s' vl'" (is "?match \<or> ?ignore")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
proof(cases "\<phi> ?trn")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
\<phi> (Trans s a ou s')

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
note \<phi> = True
[PROOF STATE]
proof (state)
this:
\<phi> (Trans s a ou s')

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<phi> (Trans s a ou s')
[PROOF STEP]
obtain v vll where vl: "vl = v # vll"
        and f: "f ?trn = v"
[PROOF STATE]
proof (prove)
using this:
\<phi> (Trans s a ou s')

goal (1 subgoal):
 1. (\<And>v vll. \<lbrakk>vl = v # vll; f (Trans s a ou s') = v\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using c
[PROOF STATE]
proof (prove)
using this:
\<phi> (Trans s a ou s')
consume (Trans s a ou s') vl vl'

goal (1 subgoal):
 1. (\<And>v vll. \<lbrakk>vl = v # vll; f (Trans s a ou s') = v\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding consume_def
[PROOF STATE]
proof (prove)
using this:
\<phi> (Trans s a ou s')
if \<phi> (Trans s a ou s') then vl \<noteq> [] \<and> f (Trans s a ou s') = hd vl \<and> vl' = tl vl else vl' = vl

goal (1 subgoal):
 1. (\<And>v vll. \<lbrakk>vl = v # vll; f (Trans s a ou s') = v\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases vl) auto
[PROOF STATE]
proof (state)
this:
vl = v # vll
f (Trans s a ou s') = v

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
obtain "pst" where v: "v = PVal pst"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>pst. v = PVal pst \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using l
[PROOF STATE]
proof (prove)
using this:
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)

goal (1 subgoal):
 1. (\<And>pst. v = PVal pst \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding vl1 vl
[PROOF STATE]
proof (prove)
using this:
map PValS_tgtAPI (filter isPValS (v # vll)) = map PValS_tgtAPI (filter isPValS [])

goal (1 subgoal):
 1. (\<And>pst. v = PVal pst \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (cases v) auto
[PROOF STATE]
proof (state)
this:
v = PVal pst

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have fvll: "filter isPValS vll = []"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. filter isPValS vll = []
[PROOF STEP]
using l
[PROOF STATE]
proof (prove)
using this:
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)

goal (1 subgoal):
 1. filter isPValS vll = []
[PROOF STEP]
unfolding vl1 vl
[PROOF STATE]
proof (prove)
using this:
map PValS_tgtAPI (filter isPValS (v # vll)) = map PValS_tgtAPI (filter isPValS [])

goal (1 subgoal):
 1. filter isPValS vll = []
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
filter isPValS vll = []

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have vl': "vl' = vll"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vl' = vll
[PROOF STEP]
using c \<phi>
[PROOF STATE]
proof (prove)
using this:
consume (Trans s a ou s') vl vl'
\<phi> (Trans s a ou s')

goal (1 subgoal):
 1. vl' = vll
[PROOF STEP]
unfolding vl consume_def
[PROOF STATE]
proof (prove)
using this:
if \<phi> (Trans s a ou s') then v # vll \<noteq> [] \<and> f (Trans s a ou s') = hd (v # vll) \<and> vl' = tl (v # vll) else vl' = v # vll
\<phi> (Trans s a ou s')

goal (1 subgoal):
 1. vl' = vll
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vl' = vll

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
hence 0: "\<forall>ca. a \<noteq> COMact ca"
[PROOF STATE]
proof (prove)
using this:
vl' = vll

goal (1 subgoal):
 1. \<forall>ca. a \<noteq> COMact ca
[PROOF STEP]
using \<phi> v f
[PROOF STATE]
proof (prove)
using this:
vl' = vll
\<phi> (Trans s a ou s')
v = PVal pst
f (Trans s a ou s') = v

goal (1 subgoal):
 1. \<forall>ca. a \<noteq> COMact ca
[PROOF STEP]
unfolding \<phi>_def3[OF step]
[PROOF STATE]
proof (prove)
using this:
vl' = vll
(\<exists>pst. a = Uact (uPost (owner s PID) (pass s (owner s PID)) PID pst) \<and> ou = outOK) \<or> (\<exists>aid. a = COMact (comSendPost (admin s) (pass s (admin s)) aid PID) \<and> ou = O_sendPost (aid, clientPass s aid, PID, post s PID, owner s PID, vis s PID))
v = PVal pst
f (Trans s a ou s') = v

goal (1 subgoal):
 1. \<forall>ca. a \<noteq> COMact ca
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>ca. a \<noteq> COMact ca

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<forall>ca. a \<noteq> COMact ca
[PROOF STEP]
obtain uid p "pstt" where a: "a = Uact (uPost uid p PID pstt)"
[PROOF STATE]
proof (prove)
using this:
\<forall>ca. a \<noteq> COMact ca

goal (1 subgoal):
 1. (\<And>uid p pstt. a = Uact (uPost uid p PID pstt) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using \<phi>
[PROOF STATE]
proof (prove)
using this:
\<forall>ca. a \<noteq> COMact ca
\<phi> (Trans s a ou s')

goal (1 subgoal):
 1. (\<And>uid p pstt. a = Uact (uPost uid p PID pstt) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
unfolding \<phi>_def2
[PROOF STATE]
proof (prove)
using this:
\<forall>ca. a \<noteq> COMact ca
(\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou \<noteq> outErr)

goal (1 subgoal):
 1. (\<And>uid p pstt. a = Uact (uPost uid p PID pstt) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
(* [OF step] *)
[PROOF STATE]
proof (prove)
using this:
\<forall>ca. a \<noteq> COMact ca
(\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou \<noteq> outErr)

goal (1 subgoal):
 1. (\<And>uid p pstt. a = Uact (uPost uid p PID pstt) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
a = Uact (uPost uid p PID pstt)

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
hence ss': "eqButPID s s'"
[PROOF STATE]
proof (prove)
using this:
a = Uact (uPost uid p PID pstt)

goal (1 subgoal):
 1. eqButPID s s'
[PROOF STEP]
using step Uact_uPaperC_step_eqButPID
[PROOF STATE]
proof (prove)
using this:
a = Uact (uPost uid p PID pstt)
step s a = (ou, s')
\<lbrakk>?a = Uact (uPost ?uid ?p PID ?pst); step ?s ?a = (?ou, ?s')\<rbrakk> \<Longrightarrow> eqButPID ?s ?s'

goal (1 subgoal):
 1. eqButPID s s'
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
eqButPID s s'

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
hence s's1: "eqButPID s' s1"
[PROOF STATE]
proof (prove)
using this:
eqButPID s s'

goal (1 subgoal):
 1. eqButPID s' s1
[PROOF STEP]
using ss1 eqButPID_sym eqButPID_trans
[PROOF STATE]
proof (prove)
using this:
eqButPID s s'
eqButPID s s1
eqButPID ?s ?s1.0 \<Longrightarrow> eqButPID ?s1.0 ?s
\<lbrakk>eqButPID ?s ?s1.0; eqButPID ?s1.0 ?s2.0\<rbrakk> \<Longrightarrow> eqButPID ?s ?s2.0

goal (1 subgoal):
 1. eqButPID s' s1
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
eqButPID s' s1

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have ?ignore
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<not> \<gamma> (Trans s a ou s')
 2. \<Delta>1 s' vl' s1 vl1 \<or> \<Delta>2 s' vl' s1 vl1
[PROOF STEP]
show "\<not> \<gamma> ?trn"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> \<gamma> (Trans s a ou s')
[PROOF STEP]
using T_\<phi>_\<gamma>[OF rsT step \<phi> 0]
[PROOF STATE]
proof (prove)
using this:
\<not> \<gamma> (Trans s a ou s')

goal (1 subgoal):
 1. \<not> \<gamma> (Trans s a ou s')
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
\<not> \<gamma> (Trans s a ou s')

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1 vl1 \<or> \<Delta>2 s' vl' s1 vl1
[PROOF STEP]
have "\<Delta>1 s' vl' s1 vl1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Delta>1 s' vl' s1 vl1
[PROOF STEP]
using PID' s's1' ch1 l s's1 vl1 fvll
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s'
eqButPID s' s1'
corrFrom (post s1 PID) vl1
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
eqButPID s' s1
vl1 = []
filter isPValS vll = []

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1 vl1
[PROOF STEP]
unfolding \<Delta>1_def vl v vl'
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s'
eqButPID s' s1'
corrFrom (post s1 PID) vl1
map PValS_tgtAPI (filter isPValS (PVal pst # vll)) = map PValS_tgtAPI (filter isPValS vl1)
eqButPID s' s1
vl1 = []
filter isPValS vll = []

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s' \<and> eqButPID s' s1 \<and> corrFrom (post s1 PID) vl1 \<and> (vll = [] \<longrightarrow> vl1 = []) \<and> map PValS_tgtAPI (filter isPValS vll) = map PValS_tgtAPI (filter isPValS vl1)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1 vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1 vl1 \<or> \<Delta>2 s' vl' s1 vl1
[PROOF STEP]
thus "?\<Delta> s' vl' s1 vl1"
[PROOF STATE]
proof (prove)
using this:
\<Delta>1 s' vl' s1 vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1 vl1 \<or> \<Delta>2 s' vl' s1 vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1 vl1 \<or> \<Delta>2 s' vl' s1 vl1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (2 subgoals):
 1. \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
 2. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> \<phi> (Trans s a ou s')

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
note \<phi> = False
[PROOF STATE]
proof (state)
this:
\<not> \<phi> (Trans s a ou s')

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have vl': "vl' = vl"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vl' = vl
[PROOF STEP]
using \<phi> c
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s a ou s')
consume (Trans s a ou s') vl vl'

goal (1 subgoal):
 1. vl' = vl
[PROOF STEP]
unfolding consume_def
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s a ou s')
if \<phi> (Trans s a ou s') then vl \<noteq> [] \<and> f (Trans s a ou s') = hd vl \<and> vl' = tl vl else vl' = vl

goal (1 subgoal):
 1. vl' = vl
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
vl' = vl

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have \<phi>1: "\<not> \<phi> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> \<phi> (Trans s1 a ou1 s1')
[PROOF STEP]
using step step1 ss1 \<phi> eqButPID_step_\<phi>
[PROOF STATE]
proof (prove)
using this:
step s a = (ou, s')
step s1 a = (ou1, s1')
eqButPID s s1
\<not> \<phi> (Trans s a ou s')
\<lbrakk>eqButPID ?s ?s1.0; step ?s ?a = (?ou, ?s'); step ?s1.0 ?a = (?ou1.0, ?s1')\<rbrakk> \<Longrightarrow> \<phi> (Trans ?s ?a ?ou ?s') = \<phi> (Trans ?s1.0 ?a ?ou1.0 ?s1')

goal (1 subgoal):
 1. \<not> \<phi> (Trans s1 a ou1 s1')
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
have ?match
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. validTrans (Trans s1 ?a1.0 ?ou1.0 ?s1')
 2. consume (Trans s1 ?a1.0 ?ou1.0 ?s1') vl1 ?vl1'
 3. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 ?a1.0 ?ou1.0 ?s1')
 4. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 ?a1.0 ?ou1.0 ?s1')
 5. \<Delta>1 s' vl' ?s1' ?vl1' \<or> \<Delta>2 s' vl' ?s1' ?vl1'
[PROOF STEP]
show "validTrans ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. validTrans (Trans s1 a ou1 s1')
[PROOF STEP]
using step1
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')

goal (1 subgoal):
 1. validTrans (Trans s1 a ou1 s1')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
validTrans (Trans s1 a ou1 s1')

goal (4 subgoals):
 1. consume (Trans s1 a ou1 s1') vl1 ?vl1'
 2. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
 3. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 4. \<Delta>1 s' vl' s1' ?vl1' \<or> \<Delta>2 s' vl' s1' ?vl1'
[PROOF STEP]
show "consume ?trn1 vl1 vl1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. consume (Trans s1 a ou1 s1') vl1 vl1
[PROOF STEP]
using \<phi>1
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. consume (Trans s1 a ou1 s1') vl1 vl1
[PROOF STEP]
unfolding consume_def
[PROOF STATE]
proof (prove)
using this:
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. if \<phi> (Trans s1 a ou1 s1') then vl1 \<noteq> [] \<and> f (Trans s1 a ou1 s1') = hd vl1 \<and> vl1 = tl vl1 else vl1 = vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
consume (Trans s1 a ou1 s1') vl1 vl1

goal (3 subgoals):
 1. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
 2. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 3. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
show "\<gamma> ?trn \<longleftrightarrow> \<gamma> ?trn1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')
[PROOF STEP]
by fact
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s') = \<gamma> (Trans s1 a ou1 s1')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
assume "\<gamma> ?trn"
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
note \<gamma> = this
[PROOF STATE]
proof (state)
this:
\<gamma> (Trans s a ou s')

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
have ou: "(\<exists> uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or>
                                        ou = ou1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1
[PROOF STEP]
using eqButPID_step_\<gamma>_out[OF ss1 step step1 rsT T rs1 \<gamma>]
[PROOF STATE]
proof (prove)
using this:
(\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1

goal (1 subgoal):
 1. (\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1

goal (2 subgoals):
 1. \<gamma> (Trans s a ou s') \<Longrightarrow> g (Trans s a ou s') = g (Trans s1 a ou1 s1')
 2. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
thus "g ?trn = g ?trn1"
[PROOF STATE]
proof (prove)
using this:
(\<exists>uid p aid pid. a = COMact (comSendPost uid p aid pid) \<and> outPurge ou = outPurge ou1) \<or> ou = ou1

goal (1 subgoal):
 1. g (Trans s a ou s') = g (Trans s1 a ou1 s1')
[PROOF STEP]
by (cases a) auto
[PROOF STATE]
proof (state)
this:
g (Trans s a ou s') = g (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
have 2[simp]: "post s1' PID  = post s1 PID"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. post s1' PID = post s1 PID
[PROOF STEP]
using step1 PID1 \<phi>1
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')
PID \<in>\<in> postIDs s1
\<not> \<phi> (Trans s1 a ou1 s1')

goal (1 subgoal):
 1. post s1' PID = post s1 PID
[PROOF STEP]
unfolding \<phi>_def2
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')
PID \<in>\<in> postIDs s1
\<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr))

goal (1 subgoal):
 1. post s1' PID = post s1 PID
[PROOF STEP]
(* [OF step1] *)
[PROOF STATE]
proof (prove)
using this:
step s1 a = (ou1, s1')
PID \<in>\<in> postIDs s1
\<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr))

goal (1 subgoal):
 1. post s1' PID = post s1 PID
[PROOF STEP]
apply(cases a)
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>x1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Sact x1\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x2. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Cact x2\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x3. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Dact x3\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 4. \<And>x4. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Uact x4\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 5. \<And>x5. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Ract x5\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 6. \<And>x6. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 7. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x1
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Sact x1\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x1, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>x2. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Cact x2\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x3. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Dact x3\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x4. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Uact x4\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 4. \<And>x5. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Ract x5\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 5. \<And>x6. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 6. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x2
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Cact x2\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x2, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>x3. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Dact x3\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x4. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Uact x4\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x5. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Ract x5\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 4. \<And>x6. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 5. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x3
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Dact x3\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x3, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>x4. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Uact x4\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x5. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Ract x5\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x6. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 4. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x4
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Uact x4\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x4, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>x5. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Ract x5\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x6. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 3. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Ract x5_\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x6. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
 2. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = Lact x6_\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
by auto
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x7. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
subgoal for x7
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>step s1 a = (ou1, s1'); PID \<in>\<in> postIDs s1; \<not> ((\<exists>uid p pst. a = Uact (uPost uid p PID pst) \<and> ou1 = outOK) \<or> (\<exists>uid p aid. a = COMact (comSendPost uid p aid PID) \<and> ou1 \<noteq> outErr)); a = COMact x7\<rbrakk> \<Longrightarrow> post s1' PID = post s1 PID
[PROOF STEP]
apply(cases x7, auto simp: all_defs)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
.
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
post s1' PID = post s1 PID

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
have "\<Delta>1 s' vl' s1' vl1"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1
[PROOF STEP]
using PID' s's1' vlvl1 l ch1
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s'
eqButPID s' s1'
vl = [] \<longrightarrow> vl1 = []
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS vl1)
corrFrom (post s1 PID) vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1
[PROOF STEP]
unfolding \<Delta>1_def vl' vl1
[PROOF STATE]
proof (prove)
using this:
PID \<in>\<in> postIDs s'
eqButPID s' s1'
vl = [] \<longrightarrow> [] = []
map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS [])
corrFrom (post s1 PID) []

goal (1 subgoal):
 1. PID \<in>\<in> postIDs s' \<and> eqButPID s' s1' \<and> corrFrom (post s1' PID) [] \<and> (vl = [] \<longrightarrow> [] = []) \<and> map PValS_tgtAPI (filter isPValS vl) = map PValS_tgtAPI (filter isPValS [])
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1' vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
thus "?\<Delta> s' vl' s1' vl1"
[PROOF STATE]
proof (prove)
using this:
\<Delta>1 s' vl' s1' vl1

goal (1 subgoal):
 1. \<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<Delta>1 s' vl' s1' vl1 \<or> \<Delta>2 s' vl' s1' vl1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. \<not> \<phi> (Trans s a ou s') \<Longrightarrow> match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal (1 subgoal):
 1. match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
match (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl' \<or> ignore (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s s1 vl1 a ou s' vl'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal (1 subgoal):
 1. vl1 = [] \<Longrightarrow> iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal (1 subgoal):
 1. iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
using vl1
[PROOF STATE]
proof (prove)
using this:
reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
vl1 = []

goal (1 subgoal):
 1. iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
iaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1 \<or> (vl = [] \<longrightarrow> vl1 = []) \<and> reaction (\<lambda>s vl s1 vl1. \<Delta>1 s vl s1 vl1 \<or> \<Delta>2 s vl s1 vl1) s vl s1 vl1

goal:
No subgoals!
[PROOF STEP]
qed