[STATEMENT]
theorem mrbst_inter_diff_correct:
  fixes A B :: "'a :: linorder set" and b :: bool
  defines "setop \<equiv> (if b then (\<inter>) else (-) :: 'a set \<Rightarrow> _)"
  assumes "finite A" "finite B"
  shows   "do {t1 \<leftarrow> random_bst A; t2 \<leftarrow> random_bst B; mrbst_inter_diff b t1 t2} =
             random_bst (setop A B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (setop A B)
[PROOF STEP]
using assms(2-)
[PROOF STATE]
proof (prove)
using this:
finite A
finite B

goal (1 subgoal):
 1. random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (setop A B)
[PROOF STEP]
proof (induction A arbitrary: B rule: finite_psubset_induct)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>A B. \<lbrakk>finite A; \<And>B Ba. \<lbrakk>B \<subset> A; finite Ba\<rbrakk> \<Longrightarrow> random_bst B \<bind> (\<lambda>t1. random_bst Ba \<bind> mrbst_inter_diff b t1) = random_bst (setop B Ba); finite B\<rbrakk> \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (setop A B)
[PROOF STEP]
case (psubset A B)
[PROOF STATE]
proof (state)
this:
finite A
\<lbrakk>?B \<subset> A; finite ?Ba\<rbrakk> \<Longrightarrow> random_bst ?B \<bind> (\<lambda>t1. random_bst ?Ba \<bind> mrbst_inter_diff b t1) = random_bst (setop ?B ?Ba)
finite B

goal (1 subgoal):
 1. \<And>A B. \<lbrakk>finite A; \<And>B Ba. \<lbrakk>B \<subset> A; finite Ba\<rbrakk> \<Longrightarrow> random_bst B \<bind> (\<lambda>t1. random_bst Ba \<bind> mrbst_inter_diff b t1) = random_bst (setop B Ba); finite B\<rbrakk> \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (setop A B)
[PROOF STEP]
write setop (infixl "\<diamondop>" 80)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>A B. \<lbrakk>finite A; \<And>B Ba. \<lbrakk>B \<subset> A; finite Ba\<rbrakk> \<Longrightarrow> random_bst B \<bind> (\<lambda>t1. random_bst Ba \<bind> mrbst_inter_diff b t1) = random_bst (B \<diamondop> Ba); finite B\<rbrakk> \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
include monad_normalisation
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>A B. \<lbrakk>finite A; \<And>B Ba. \<lbrakk>B \<subset> A; finite Ba\<rbrakk> \<Longrightarrow> random_bst B \<bind> (\<lambda>t1. random_bst Ba \<bind> mrbst_inter_diff b t1) = random_bst (B \<diamondop> Ba); finite B\<rbrakk> \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
proof (cases "A = {}")
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. A = {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
 2. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
A = {}

goal (2 subgoals):
 1. A = {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
 2. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
A = {}

goal (1 subgoal):
 1. random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
by (auto simp: setop_def)
[PROOF STATE]
proof (state)
this:
random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
A \<noteq> {}

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
define R1 R2 where "R1 = (\<lambda>x. random_bst {y\<in>A. y < x})" "R2 = (\<lambda>x. random_bst {y\<in>A. y > x})"
[PROOF STATE]
proof (state)
this:
R1 = (\<lambda>x. random_bst {y \<in> A. y < x})
R2 = (\<lambda>x. random_bst {y \<in> A. x < y})

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have A_eq: "A = (A \<inter> B) \<union> (A - B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A = A \<inter> B \<union> (A - B)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
A = A \<inter> B \<union> (A - B)

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have card_A_eq: "card A = card (A \<inter> B) + card (A - B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. card A = card (A \<inter> B) + card (A - B)
[PROOF STEP]
using \<open>finite A\<close> \<open>finite B\<close>
[PROOF STATE]
proof (prove)
using this:
finite A
finite B

goal (1 subgoal):
 1. card A = card (A \<inter> B) + card (A - B)
[PROOF STEP]
by (subst A_eq, subst card_Un_disjoint) auto
[PROOF STATE]
proof (state)
this:
card A = card (A \<inter> B) + card (A - B)

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have eq: "pmf_of_set A =
                do {b \<leftarrow> bernoulli_pmf (card (A \<inter> B) / card A);
                    if b then pmf_of_set (A \<inter> B) else pmf_of_set (A - B)}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b. if b then pmf_of_set (A \<inter> B) else pmf_of_set (A - B))
[PROOF STEP]
using psubset.prems False \<open>finite A\<close> A_eq card_A_eq
[PROOF STATE]
proof (prove)
using this:
finite B
A \<noteq> {}
finite A
A = A \<inter> B \<union> (A - B)
card A = card (A \<inter> B) + card (A - B)

goal (1 subgoal):
 1. pmf_of_set A = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b. if b then pmf_of_set (A \<inter> B) else pmf_of_set (A - B))
[PROOF STEP]
by (subst A_eq, intro pmf_of_set_union_split [symmetric]) auto
[PROOF STATE]
proof (state)
this:
pmf_of_set A = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b. if b then pmf_of_set (A \<inter> B) else pmf_of_set (A - B))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "card A > 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 < card A
[PROOF STEP]
using \<open>finite A\<close> \<open>A \<noteq> {}\<close>
[PROOF STATE]
proof (prove)
using this:
finite A
A \<noteq> {}

goal (1 subgoal):
 1. 0 < card A
[PROOF STEP]
by (subst card_gt_0_iff) auto
[PROOF STATE]
proof (state)
this:
0 < card A

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have not_subset: "\<not>A \<subseteq> B" if "card (A \<inter> B) < card A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> A \<subseteq> B
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. A \<subseteq> B \<Longrightarrow> False
[PROOF STEP]
assume "A \<subseteq> B"
[PROOF STATE]
proof (state)
this:
A \<subseteq> B

goal (1 subgoal):
 1. A \<subseteq> B \<Longrightarrow> False
[PROOF STEP]
hence "A \<inter> B = A"
[PROOF STATE]
proof (prove)
using this:
A \<subseteq> B

goal (1 subgoal):
 1. A \<inter> B = A
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
A \<inter> B = A

goal (1 subgoal):
 1. A \<subseteq> B \<Longrightarrow> False
[PROOF STEP]
with that
[PROOF STATE]
proof (chain)
picking this:
card (A \<inter> B) < card A
A \<inter> B = A
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
card (A \<inter> B) < card A
A \<inter> B = A

goal (1 subgoal):
 1. False
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
card (A \<inter> B) < card A \<Longrightarrow> \<not> A \<subseteq> B

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "do {t1 \<leftarrow> random_bst A; t2 \<leftarrow> random_bst B; mrbst_inter_diff b t1 t2} =
          do {
            x \<leftarrow> pmf_of_set A;
            l1 \<leftarrow> random_bst {y\<in>A. y < x};
            r1 \<leftarrow> random_bst {y\<in>A. y > x};
            t2 \<leftarrow> random_bst B;
            let (l2, r2) = split_bst x t2;
            l \<leftarrow> mrbst_inter_diff b l1 l2;
            r \<leftarrow> mrbst_inter_diff b r1 r2;
            if isin t2 x = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r
          }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. let (l2, r2) = split_bst x t2 in mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if isin t2 x = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))
[PROOF STEP]
using \<open>finite A\<close> \<open>A \<noteq> {}\<close>
[PROOF STATE]
proof (prove)
using this:
finite A
A \<noteq> {}

goal (1 subgoal):
 1. random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. let (l2, r2) = split_bst x t2 in mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if isin t2 x = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))
[PROOF STEP]
by (subst random_bst_reduce)
         (auto simp: mrbst_inter_diff_reduce map_pmf_def split_bst'_altdef)
[PROOF STATE]
proof (state)
this:
random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. let (l2, r2) = split_bst x t2 in mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if isin t2 x = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. let (l2, r2) = split_bst x t2 in mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if isin t2 x = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "\<dots> = do {
                      x \<leftarrow> pmf_of_set A;
                      l1 \<leftarrow> random_bst {y\<in>A. y < x};
                      r1 \<leftarrow> random_bst {y\<in>A. y > x};
                      t2 \<leftarrow> random_bst B;
                      let (l2, r2) = split_bst x t2;
                      l \<leftarrow> mrbst_inter_diff b l1 l2;
                      r \<leftarrow> mrbst_inter_diff b r1 r2;
                      if x \<in> B = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r
                    }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. let (l2, r2) = split_bst x t2 in mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if isin t2 x = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. let (l2, r2) = split_bst x t2 in mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))
[PROOF STEP]
unfolding Let_def case_prod_unfold
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. mrbst_inter_diff b l1 (fst (split_bst x t2)) \<bind> (\<lambda>l. mrbst_inter_diff b r1 (snd (split_bst x t2)) \<bind> (\<lambda>r. if isin t2 x = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. mrbst_inter_diff b l1 (fst (split_bst x t2)) \<bind> (\<lambda>l. mrbst_inter_diff b r1 (snd (split_bst x t2)) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))
[PROOF STEP]
using \<open>finite B\<close>
[PROOF STATE]
proof (prove)
using this:
finite B

goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. mrbst_inter_diff b l1 (fst (split_bst x t2)) \<bind> (\<lambda>l. mrbst_inter_diff b r1 (snd (split_bst x t2)) \<bind> (\<lambda>r. if isin t2 x = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. mrbst_inter_diff b l1 (fst (split_bst x t2)) \<bind> (\<lambda>l. mrbst_inter_diff b r1 (snd (split_bst x t2)) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))
[PROOF STEP]
by (intro bind_pmf_cong refl) (auto simp: isin_random_bst)
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. let (l2, r2) = split_bst x t2 in mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if isin t2 x = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. let (l2, r2) = split_bst x t2 in mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. let (l2, r2) = split_bst x t2 in mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if isin t2 x = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. let (l2, r2) = split_bst x t2 in mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "\<dots> = do {
                      x \<leftarrow> pmf_of_set A;
                      l1 \<leftarrow> random_bst {y\<in>A. y < x};
                      r1 \<leftarrow> random_bst {y\<in>A. y > x};
                      (l2, r2) \<leftarrow> map_pmf (split_bst x) (random_bst B);
                      l \<leftarrow> mrbst_inter_diff b l1 l2;
                      r \<leftarrow> mrbst_inter_diff b r1 r2;
                      if x \<in> B = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r
                    }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. let (l2, r2) = split_bst x t2 in mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. map_pmf (split_bst x) (random_bst B) \<bind> (\<lambda>(l2, r2). mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))
[PROOF STEP]
by (simp add: Let_def map_pmf_def)
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. let (l2, r2) = split_bst x t2 in mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. map_pmf (split_bst x) (random_bst B) \<bind> (\<lambda>(l2, r2). mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst B \<bind> (\<lambda>t2. let (l2, r2) = split_bst x t2 in mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. map_pmf (split_bst x) (random_bst B) \<bind> (\<lambda>(l2, r2). mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "\<dots> = do {
                      x \<leftarrow> pmf_of_set A;
                      l1 \<leftarrow> random_bst {y\<in>A. y < x};
                      r1 \<leftarrow> random_bst {y\<in>A. y > x};
                      (l2, r2) \<leftarrow> pair_pmf (random_bst {y\<in>B. y < x}) (random_bst {y\<in>B. y > x});
                      l \<leftarrow> mrbst_inter_diff b l1 l2;
                      r \<leftarrow> mrbst_inter_diff b r1 r2;
                      if x \<in> B = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r
                    }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. map_pmf (split_bst x) (random_bst B) \<bind> (\<lambda>(l2, r2). mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. pair_pmf (random_bst {y \<in> B. y < x}) (random_bst {y \<in> B. x < y}) \<bind> (\<lambda>(l2, r2). mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))
[PROOF STEP]
by (intro bind_pmf_cong refl split_random_bst \<open>finite B\<close>)
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. map_pmf (split_bst x) (random_bst B) \<bind> (\<lambda>(l2, r2). mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. pair_pmf (random_bst {y \<in> B. y < x}) (random_bst {y \<in> B. x < y}) \<bind> (\<lambda>(l2, r2). mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. map_pmf (split_bst x) (random_bst B) \<bind> (\<lambda>(l2, r2). mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. pair_pmf (random_bst {y \<in> B. y < x}) (random_bst {y \<in> B. x < y}) \<bind> (\<lambda>(l2, r2). mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "\<dots> = do {
                      x \<leftarrow> pmf_of_set A;
                      l1 \<leftarrow> R1 x;
                      r1 \<leftarrow> R2 x;
                      l2 \<leftarrow> random_bst {y\<in>B. y < x};
                      r2 \<leftarrow> random_bst {y\<in>B. y > x};
                      l \<leftarrow> mrbst_inter_diff b l1 l2;
                      r \<leftarrow> mrbst_inter_diff b r1 r2;
                      if x \<in> B = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r
                    }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. pair_pmf (random_bst {y \<in> B. y < x}) (random_bst {y \<in> B. x < y}) \<bind> (\<lambda>(l2, r2). mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. y < x} \<bind> (\<lambda>l2. random_bst {y \<in> B. x < y} \<bind> (\<lambda>r2. mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))))
[PROOF STEP]
unfolding pair_pmf_def bind_assoc_pmf R1_R2_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst {y \<in> B. y < x} \<bind> (\<lambda>xa. random_bst {y \<in> B. x < y} \<bind> (\<lambda>xb. return_pmf (xa, xb) \<bind> (\<lambda>(l2, r2). mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))))) = pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst {y \<in> B. y < x} \<bind> (\<lambda>l2. random_bst {y \<in> B. x < y} \<bind> (\<lambda>r2. mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. pair_pmf (random_bst {y \<in> B. y < x}) (random_bst {y \<in> B. x < y}) \<bind> (\<lambda>(l2, r2). mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. y < x} \<bind> (\<lambda>l2. random_bst {y \<in> B. x < y} \<bind> (\<lambda>r2. mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. pair_pmf (random_bst {y \<in> B. y < x}) (random_bst {y \<in> B. x < y}) \<bind> (\<lambda>(l2, r2). mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))) = pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. y < x} \<bind> (\<lambda>l2. random_bst {y \<in> B. x < y} \<bind> (\<lambda>r2. mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "\<dots> = do {
                      x \<leftarrow> pmf_of_set A;
                      l \<leftarrow> do {l1 \<leftarrow> R1 x; l2 \<leftarrow> random_bst {y\<in>B. y < x}; mrbst_inter_diff b l1 l2};
                      r \<leftarrow> do {r1 \<leftarrow> R2 x; r2 \<leftarrow> random_bst {y\<in>B. y > x}; mrbst_inter_diff b r1 r2};
                      if x \<in> B = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r
                    }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. y < x} \<bind> (\<lambda>l2. random_bst {y \<in> B. x < y} \<bind> (\<lambda>r2. mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))) = pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. random_bst {y \<in> B. y < x} \<bind> mrbst_inter_diff b l1) \<bind> (\<lambda>l. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. x < y} \<bind> mrbst_inter_diff b r1) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))
[PROOF STEP]
unfolding bind_assoc_pmf
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. y < x} \<bind> (\<lambda>l2. random_bst {y \<in> B. x < y} \<bind> (\<lambda>r2. mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))) = pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>xa. random_bst {y \<in> B. y < x} \<bind> (\<lambda>xb. mrbst_inter_diff b xa xb \<bind> (\<lambda>l. R2 x \<bind> (\<lambda>xa. random_bst {y \<in> B. x < y} \<bind> (\<lambda>xb. mrbst_inter_diff b xa xb \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))))))
[PROOF STEP]
by (intro bind_pmf_cong[OF refl]) simp
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. y < x} \<bind> (\<lambda>l2. random_bst {y \<in> B. x < y} \<bind> (\<lambda>r2. mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))) = pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. random_bst {y \<in> B. y < x} \<bind> mrbst_inter_diff b l1) \<bind> (\<lambda>l. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. x < y} \<bind> mrbst_inter_diff b r1) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. y < x} \<bind> (\<lambda>l2. random_bst {y \<in> B. x < y} \<bind> (\<lambda>r2. mrbst_inter_diff b l1 l2 \<bind> (\<lambda>l. mrbst_inter_diff b r1 r2 \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))))))) = pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. random_bst {y \<in> B. y < x} \<bind> mrbst_inter_diff b l1) \<bind> (\<lambda>l. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. x < y} \<bind> mrbst_inter_diff b r1) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "\<dots> = do {
                      x \<leftarrow> pmf_of_set A;
                      l \<leftarrow> random_bst ({y\<in>A. y < x} \<diamondop> {y\<in>B. y < x});
                      r \<leftarrow> random_bst ({y\<in>A. y > x} \<diamondop> {y\<in>B. y > x});
                      if x \<in> B = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r
                    }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. random_bst {y \<in> B. y < x} \<bind> mrbst_inter_diff b l1) \<bind> (\<lambda>l. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. x < y} \<bind> mrbst_inter_diff b r1) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))) = pmf_of_set A \<bind> (\<lambda>x. random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))
[PROOF STEP]
using \<open>finite A\<close> \<open>finite B\<close> \<open>A \<noteq> {}\<close>
[PROOF STATE]
proof (prove)
using this:
finite A
finite B
A \<noteq> {}

goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. random_bst {y \<in> B. y < x} \<bind> mrbst_inter_diff b l1) \<bind> (\<lambda>l. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. x < y} \<bind> mrbst_inter_diff b r1) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))) = pmf_of_set A \<bind> (\<lambda>x. random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))
[PROOF STEP]
unfolding R1_R2_def
[PROOF STATE]
proof (prove)
using this:
finite A
finite B
A \<noteq> {}

goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. random_bst {y \<in> A. y < x} \<bind> (\<lambda>l1. random_bst {y \<in> B. y < x} \<bind> mrbst_inter_diff b l1) \<bind> (\<lambda>l. random_bst {y \<in> A. x < y} \<bind> (\<lambda>r1. random_bst {y \<in> B. x < y} \<bind> mrbst_inter_diff b r1) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))) = pmf_of_set A \<bind> (\<lambda>x. random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))
[PROOF STEP]
by (intro bind_pmf_cong refl psubset.IH) auto
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. random_bst {y \<in> B. y < x} \<bind> mrbst_inter_diff b l1) \<bind> (\<lambda>l. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. x < y} \<bind> mrbst_inter_diff b r1) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))) = pmf_of_set A \<bind> (\<lambda>x. random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. R1 x \<bind> (\<lambda>l1. random_bst {y \<in> B. y < x} \<bind> mrbst_inter_diff b l1) \<bind> (\<lambda>l. R2 x \<bind> (\<lambda>r1. random_bst {y \<in> B. x < y} \<bind> mrbst_inter_diff b r1) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))) = pmf_of_set A \<bind> (\<lambda>x. random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r)))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "\<dots> = do {
                      x \<leftarrow> pmf_of_set A;
                      if x \<in> B = b then do {
                        l \<leftarrow> random_bst ({y\<in>A. y < x} \<diamondop> {y\<in>B. y < x});
                        r \<leftarrow> random_bst ({y\<in>A. y > x} \<diamondop> {y\<in>B. y > x});
                        return_pmf \<langle>l, x, r\<rangle>
                      } else do {
                        l \<leftarrow> random_bst ({y\<in>A. y < x} \<diamondop> {y\<in>B. y < x});
                        r \<leftarrow> random_bst ({y\<in>A. y > x} \<diamondop> {y\<in>B. y > x});
                        mrbst_join l r
                      }
                    }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))) = pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> mrbst_join l))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))) = pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> mrbst_join l))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. if (x \<in> B) = b then return_pmf \<langle>l, x, r\<rangle> else mrbst_join l r))) = pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> mrbst_join l))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "\<dots> = do {
                      x \<leftarrow> pmf_of_set A;
                      if x \<in> B = b then do {
                        l \<leftarrow> random_bst ({y\<in>A. y < x} \<diamondop> {y\<in>B. y < x});
                        r \<leftarrow> random_bst ({y\<in>A. y > x} \<diamondop> {y\<in>B. y > x});
                        return_pmf \<langle>l, x, r\<rangle>
                      } else do {
                        random_bst ({y\<in>A. y < x} \<diamondop> {y\<in>B. y < x} \<union> {y\<in>A. y > x} \<diamondop> {y\<in>B. y > x})
                      }
                    }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> mrbst_join l)) = pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x} \<union> {y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}))
[PROOF STEP]
using \<open>finite A\<close> \<open>finite B\<close>
[PROOF STATE]
proof (prove)
using this:
finite A
finite B

goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> mrbst_join l)) = pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x} \<union> {y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}))
[PROOF STEP]
by (intro bind_pmf_cong refl mrbst_join_correct if_cong) (auto simp: setop_def)
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> mrbst_join l)) = pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x} \<union> {y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> mrbst_join l)) = pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x} \<union> {y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "\<dots> = do {
                      x \<leftarrow> pmf_of_set A;
                      if x \<in> B = b then do {
                        l \<leftarrow> random_bst ({y\<in>A \<diamondop> B. y < x});
                        r \<leftarrow> random_bst ({y\<in>A \<diamondop> B. y > x});
                        return_pmf \<langle>l, x, r\<rangle>
                      } else do {
                        random_bst (A \<diamondop> B)
                      }
                    }" (is "_ = pmf_of_set A \<bind> ?f")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x} \<union> {y \<in> A. x < y} \<diamondop> {y \<in> B. x < y})) = pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B))
[PROOF STEP]
using \<open>finite A\<close> \<open>A \<noteq> {}\<close>
[PROOF STATE]
proof (prove)
using this:
finite A
A \<noteq> {}

goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x} \<union> {y \<in> A. x < y} \<diamondop> {y \<in> B. x < y})) = pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B))
[PROOF STEP]
by (intro bind_pmf_cong refl if_cong arg_cong[of _ _ random_bst])
         (auto simp: order.strict_iff_order setop_def)
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x} \<union> {y \<in> A. x < y} \<diamondop> {y \<in> B. x < y})) = pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x}) \<bind> (\<lambda>l. random_bst ({y \<in> A. x < y} \<diamondop> {y \<in> B. x < y}) \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst ({y \<in> A. y < x} \<diamondop> {y \<in> B. y < x} \<union> {y \<in> A. x < y} \<diamondop> {y \<in> B. x < y})) = pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "\<dots> = do {
                      b' \<leftarrow> bernoulli_pmf (card (A \<inter> B) / card A);
                      x \<leftarrow> (if b' then pmf_of_set (A \<inter> B) else pmf_of_set (A - B));
                      if b' = b then do {
                        l \<leftarrow> random_bst ({y\<in>A \<diamondop> B. y < x});
                        r \<leftarrow> random_bst ({y\<in>A \<diamondop> B. y > x});
                        return_pmf \<langle>l, x, r\<rangle>
                      } else do {
                        random_bst (A \<diamondop> B)
                      }
                    }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B)) = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. (if b' then pmf_of_set (A \<inter> B) else pmf_of_set (A - B)) \<bind> (\<lambda>x. if b' = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B)))
[PROOF STEP]
unfolding bind_assoc_pmf eq
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>x. (if x then pmf_of_set (A \<inter> B) else pmf_of_set (A - B)) \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B))) = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. (if b' then pmf_of_set (A \<inter> B) else pmf_of_set (A - B)) \<bind> (\<lambda>x. if b' = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B)))
[PROOF STEP]
using \<open>card A > 0\<close> \<open>finite A\<close> \<open>finite B\<close> not_subset
[PROOF STATE]
proof (prove)
using this:
0 < card A
finite A
finite B
card (A \<inter> B) < card A \<Longrightarrow> \<not> A \<subseteq> B

goal (1 subgoal):
 1. bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>x. (if x then pmf_of_set (A \<inter> B) else pmf_of_set (A - B)) \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B))) = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. (if b' then pmf_of_set (A \<inter> B) else pmf_of_set (A - B)) \<bind> (\<lambda>x. if b' = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B)))
[PROOF STEP]
by (intro bind_pmf_cong refl if_cong)
         (auto intro: bind_pmf_cong split: if_splits simp: divide_simps card_gt_0_iff
               dest!: in_set_pmf_of_setD)
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B)) = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. (if b' then pmf_of_set (A \<inter> B) else pmf_of_set (A - B)) \<bind> (\<lambda>x. if b' = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B)))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
pmf_of_set A \<bind> (\<lambda>x. if (x \<in> B) = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B)) = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. (if b' then pmf_of_set (A \<inter> B) else pmf_of_set (A - B)) \<bind> (\<lambda>x. if b' = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B)))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "\<dots> = do {
                      b' \<leftarrow> bernoulli_pmf (card (A \<inter> B) / card A);
                      if b' = b then do {
                        x \<leftarrow> pmf_of_set (A \<diamondop> B);
                        l \<leftarrow> random_bst ({y\<in>A \<diamondop> B. y < x});
                        r \<leftarrow> random_bst ({y\<in>A \<diamondop> B. y > x});
                        return_pmf \<langle>l, x, r\<rangle>
                      } else do {
                        random_bst (A \<diamondop> B)
                      }
                    }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. (if b' then pmf_of_set (A \<inter> B) else pmf_of_set (A - B)) \<bind> (\<lambda>x. if b' = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B))) = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. if b' = b then pmf_of_set (A \<diamondop> B) \<bind> (\<lambda>x. random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>))) else random_bst (A \<diamondop> B))
[PROOF STEP]
by (intro bind_pmf_cong) (auto simp: setop_def)
[PROOF STATE]
proof (state)
this:
bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. (if b' then pmf_of_set (A \<inter> B) else pmf_of_set (A - B)) \<bind> (\<lambda>x. if b' = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B))) = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. if b' = b then pmf_of_set (A \<diamondop> B) \<bind> (\<lambda>x. random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>))) else random_bst (A \<diamondop> B))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. (if b' then pmf_of_set (A \<inter> B) else pmf_of_set (A - B)) \<bind> (\<lambda>x. if b' = b then random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>)) else random_bst (A \<diamondop> B))) = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. if b' = b then pmf_of_set (A \<diamondop> B) \<bind> (\<lambda>x. random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>))) else random_bst (A \<diamondop> B))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "\<dots> = do {
                      b' \<leftarrow> bernoulli_pmf (card (A \<inter> B) / card A);
                      if b' = b then do {
                        random_bst (A \<diamondop> B)
                      } else do {
                        random_bst (A \<diamondop> B)
                      }
                    }"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. if b' = b then pmf_of_set (A \<diamondop> B) \<bind> (\<lambda>x. random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>))) else random_bst (A \<diamondop> B)) = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. if b' = b then random_bst (A \<diamondop> B) else random_bst (A \<diamondop> B))
[PROOF STEP]
using \<open>finite A\<close> \<open>finite B\<close> \<open>A \<noteq> {}\<close> not_subset \<open>card A > 0\<close>
[PROOF STATE]
proof (prove)
using this:
finite A
finite B
A \<noteq> {}
card (A \<inter> B) < card A \<Longrightarrow> \<not> A \<subseteq> B
0 < card A

goal (1 subgoal):
 1. bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. if b' = b then pmf_of_set (A \<diamondop> B) \<bind> (\<lambda>x. random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>))) else random_bst (A \<diamondop> B)) = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. if b' = b then random_bst (A \<diamondop> B) else random_bst (A \<diamondop> B))
[PROOF STEP]
by (intro bind_pmf_cong refl if_cong random_bst_reduce [symmetric])
         (auto simp: setop_def field_simps)
[PROOF STATE]
proof (state)
this:
bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. if b' = b then pmf_of_set (A \<diamondop> B) \<bind> (\<lambda>x. random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>))) else random_bst (A \<diamondop> B)) = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. if b' = b then random_bst (A \<diamondop> B) else random_bst (A \<diamondop> B))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. if b' = b then pmf_of_set (A \<diamondop> B) \<bind> (\<lambda>x. random_bst {y \<in> A \<diamondop> B. y < x} \<bind> (\<lambda>l. random_bst {y \<in> A \<diamondop> B. x < y} \<bind> (\<lambda>r. return_pmf \<langle>l, x, r\<rangle>))) else random_bst (A \<diamondop> B)) = bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. if b' = b then random_bst (A \<diamondop> B) else random_bst (A \<diamondop> B))

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
have "\<dots> = random_bst (A \<diamondop> B)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. if b' = b then random_bst (A \<diamondop> B) else random_bst (A \<diamondop> B)) = random_bst (A \<diamondop> B)
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
bernoulli_pmf (real (card (A \<inter> B)) / real (card A)) \<bind> (\<lambda>b'. if b' = b then random_bst (A \<diamondop> B) else random_bst (A \<diamondop> B)) = random_bst (A \<diamondop> B)

goal (1 subgoal):
 1. A \<noteq> {} \<Longrightarrow> random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)

goal (1 subgoal):
 1. random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
random_bst A \<bind> (\<lambda>t1. random_bst B \<bind> mrbst_inter_diff b t1) = random_bst (A \<diamondop> B)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma ipv4addr_of_nat_nat_of_ipv4addr: "ipv4addr_of_nat (nat_of_ipv4addr addr) = addr"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ipv4addr_of_nat (nat_of_ipv4addr addr) = addr
[PROOF STEP]
by(simp add: ipv4addr_of_nat_def nat_of_ipv4addr_def)


[STATEMENT]
lemma Maclaurin_sin_expansion:
  "\<exists>t. sin x = (\<Sum>m<n. sin_coeff m * x ^ m) + (sin (t + 1/2 * real n * pi) / fact n) * x ^ n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>t. sin x = (\<Sum>m<n. sin_coeff m * x ^ m) + sin (t + 1 / 2 * real n * pi) / fact n * x ^ n
[PROOF STEP]
using Maclaurin_sin_expansion2 [of x n]
[PROOF STATE]
proof (prove)
using this:
\<exists>t. \<bar>t\<bar> \<le> \<bar>x\<bar> \<and> sin x = (\<Sum>m<n. sin_coeff m * x ^ m) + sin (t + 1 / 2 * real n * pi) / fact n * x ^ n

goal (1 subgoal):
 1. \<exists>t. sin x = (\<Sum>m<n. sin_coeff m * x ^ m) + sin (t + 1 / 2 * real n * pi) / fact n * x ^ n
[PROOF STEP]
by blast


[STATEMENT]
lemma H_inv_plus: "\<tt>\<tt> i = i \<Longrightarrow> \<tt>\<tt> j = j \<Longrightarrow> H i x i \<Longrightarrow>  H j x j \<Longrightarrow>  H (i + j) x (i + j)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<tt>\<tt> i = i; \<tt>\<tt> j = j; H i x i; H j x j\<rbrakk> \<Longrightarrow> H (i + j) x (i + j)
[PROOF STEP]
unfolding Hoare_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<tt>\<tt> i = i; \<tt>\<tt> j = j; \<lparr>\<tt>\<tt> i\<rparr>x\<lparr>x \<cdot> \<tt>\<tt> i\<rparr>; \<lparr>\<tt>\<tt> j\<rparr>x\<lparr>x \<cdot> \<tt>\<tt> j\<rparr>\<rbrakk> \<Longrightarrow> \<lparr>\<tt>\<tt> (i + j)\<rparr>x\<lparr>x \<cdot> \<tt>\<tt> (i + j)\<rparr>
[PROOF STEP]
using combine_common_factor
[PROOF STATE]
proof (prove)
using this:
?a \<cdot> ?e + (?b \<cdot> ?e + ?c) = (?a + ?b) \<cdot> ?e + ?c

goal (1 subgoal):
 1. \<lbrakk>\<tt>\<tt> i = i; \<tt>\<tt> j = j; \<lparr>\<tt>\<tt> i\<rparr>x\<lparr>x \<cdot> \<tt>\<tt> i\<rparr>; \<lparr>\<tt>\<tt> j\<rparr>x\<lparr>x \<cdot> \<tt>\<tt> j\<rparr>\<rbrakk> \<Longrightarrow> \<lparr>\<tt>\<tt> (i + j)\<rparr>x\<lparr>x \<cdot> \<tt>\<tt> (i + j)\<rparr>
[PROOF STEP]
by (smt add_commute add.left_commute distrib_left join.sup.absorb_iff1 t_add_closed)


[STATEMENT]
lemma neg_sym_diff_pos_meas_set:
  assumes "hahn_space_decomp M1 M2"
    and "hahn_space_decomp N1 N2"
  shows "pos_meas_set ((sym_diff M2 N2) \<inter> space M)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. pos_meas_set (sym_diff M2 N2 \<inter> space M)
[PROOF STEP]
using assms
    neg_diff_pos_meas_set
[PROOF STATE]
proof (prove)
using this:
hahn_space_decomp M1 M2
hahn_space_decomp N1 N2
\<lbrakk>neg_meas_set ?M2.0; pos_meas_set ?N1.0; space M = ?N1.0 \<union> ?N2.0; ?N2.0 \<in> sets M\<rbrakk> \<Longrightarrow> pos_meas_set ((?M2.0 - ?N2.0) \<inter> space M)

goal (1 subgoal):
 1. pos_meas_set (sym_diff M2 N2 \<inter> space M)
[PROOF STEP]
unfolding hahn_space_decomp_def
[PROOF STATE]
proof (prove)
using this:
pos_meas_set M1 \<and> neg_meas_set M2 \<and> space M = M1 \<union> M2 \<and> M1 \<inter> M2 = {}
pos_meas_set N1 \<and> neg_meas_set N2 \<and> space M = N1 \<union> N2 \<and> N1 \<inter> N2 = {}
\<lbrakk>neg_meas_set ?M2.0; pos_meas_set ?N1.0; space M = ?N1.0 \<union> ?N2.0; ?N2.0 \<in> sets M\<rbrakk> \<Longrightarrow> pos_meas_set ((?M2.0 - ?N2.0) \<inter> space M)

goal (1 subgoal):
 1. pos_meas_set (sym_diff M2 N2 \<inter> space M)
[PROOF STEP]
by (metis (no_types, lifting) Int_Un_distrib2 neg_meas_setD1
      pos_meas_set_union)


[STATEMENT]
lemma conditionally_complete_imp_nonempty_imp_ex_extreme_bound_iff_ex_bound:
  assumes comp: "conditionally_complete A r"
  assumes "X \<subseteq> A" and "X \<noteq> {}"
  shows "(\<exists>s. extreme_bound A r X s) \<longleftrightarrow> (\<exists>b\<in>A. bound X r b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Ex (extreme_bound A r X) = (\<exists>b\<in>A. bound X r b)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
conditionally_complete A r
X \<subseteq> A
X \<noteq> {}

goal (1 subgoal):
 1. Ex (extreme_bound A r X) = (\<exists>b\<in>A. bound X r b)
[PROOF STEP]
by (auto 0 4 intro!:completeD[OF comp])


[STATEMENT]
lemma twice_field_differentiable_at_cos_fun [intro]:
  assumes "f twice_field_differentiable_at x"
  shows   "(\<lambda>x. cos (f x)) twice_field_differentiable_at x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. cos (f x)) twice_field_differentiable_at x
[PROOF STEP]
by (simp add: assms twice_field_differentiable_at_compose)


[STATEMENT]
lemma (in prob_space) distributed_AE2:
  assumes [measurable]: "distributed M N X f" "Measurable.pred N P"
  shows "(AE x in M. P (X x)) \<longleftrightarrow> (AE x in N. 0 < f x \<longrightarrow> P x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (AE x in M. P (X x)) = (AE x in N. 0 < f x \<longrightarrow> P x)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (AE x in M. P (X x)) = (AE x in N. 0 < f x \<longrightarrow> P x)
[PROOF STEP]
have "(AE x in M. P (X x)) \<longleftrightarrow> (AE x in distr M N X. P x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (AE x in M. P (X x)) = almost_everywhere (distr M N X) P
[PROOF STEP]
by (simp add: AE_distr_iff)
[PROOF STATE]
proof (state)
this:
(AE x in M. P (X x)) = almost_everywhere (distr M N X) P

goal (1 subgoal):
 1. (AE x in M. P (X x)) = (AE x in N. 0 < f x \<longrightarrow> P x)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
(AE x in M. P (X x)) = almost_everywhere (distr M N X) P

goal (1 subgoal):
 1. (AE x in M. P (X x)) = (AE x in N. 0 < f x \<longrightarrow> P x)
[PROOF STEP]
have "\<dots> \<longleftrightarrow> (AE x in density N f. P x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. almost_everywhere (distr M N X) P = almost_everywhere (density N f) P
[PROOF STEP]
unfolding distributed_distr_eq_density[OF assms(1)]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. almost_everywhere (density N f) P = almost_everywhere (density N f) P
[PROOF STEP]
..
[PROOF STATE]
proof (state)
this:
almost_everywhere (distr M N X) P = almost_everywhere (density N f) P

goal (1 subgoal):
 1. (AE x in M. P (X x)) = (AE x in N. 0 < f x \<longrightarrow> P x)
[PROOF STEP]
also
[PROOF STATE]
proof (state)
this:
almost_everywhere (distr M N X) P = almost_everywhere (density N f) P

goal (1 subgoal):
 1. (AE x in M. P (X x)) = (AE x in N. 0 < f x \<longrightarrow> P x)
[PROOF STEP]
have "\<dots> \<longleftrightarrow>  (AE x in N. 0 < f x \<longrightarrow> P x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. almost_everywhere (density N f) P = (AE x in N. 0 < f x \<longrightarrow> P x)
[PROOF STEP]
by (rule AE_density) simp
[PROOF STATE]
proof (state)
this:
almost_everywhere (density N f) P = (AE x in N. 0 < f x \<longrightarrow> P x)

goal (1 subgoal):
 1. (AE x in M. P (X x)) = (AE x in N. 0 < f x \<longrightarrow> P x)
[PROOF STEP]
finally
[PROOF STATE]
proof (chain)
picking this:
(AE x in M. P (X x)) = (AE x in N. 0 < f x \<longrightarrow> P x)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
(AE x in M. P (X x)) = (AE x in N. 0 < f x \<longrightarrow> P x)

goal (1 subgoal):
 1. (AE x in M. P (X x)) = (AE x in N. 0 < f x \<longrightarrow> P x)
[PROOF STEP]
.
[PROOF STATE]
proof (state)
this:
(AE x in M. P (X x)) = (AE x in N. 0 < f x \<longrightarrow> P x)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma IVT'_closed_segment_real:
  fixes f :: "real \<Rightarrow> real"
  assumes "y \<in> closed_segment (f a) (f b)"
  assumes "continuous_on (closed_segment a b) f"
  shows "\<exists>x \<in> closed_segment a b. f x = y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<exists>x\<in>closed_segment a b. f x = y
[PROOF STEP]
using IVT'[of f a y b]
    IVT'[of "-f" a "-y" b]
    IVT'[of f b y a]
    IVT'[of "-f" b "-y" a] assms
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>f a \<le> y; y \<le> f b; a \<le> b; continuous_on {a..b} f\<rbrakk> \<Longrightarrow> \<exists>x\<ge>a. x \<le> b \<and> f x = y
\<lbrakk>(- f) a \<le> - y; - y \<le> (- f) b; a \<le> b; continuous_on {a..b} (- f)\<rbrakk> \<Longrightarrow> \<exists>x\<ge>a. x \<le> b \<and> (- f) x = - y
\<lbrakk>f b \<le> y; y \<le> f a; b \<le> a; continuous_on {b..a} f\<rbrakk> \<Longrightarrow> \<exists>x\<ge>b. x \<le> a \<and> f x = y
\<lbrakk>(- f) b \<le> - y; - y \<le> (- f) a; b \<le> a; continuous_on {b..a} (- f)\<rbrakk> \<Longrightarrow> \<exists>x\<ge>b. x \<le> a \<and> (- f) x = - y
y \<in> closed_segment (f a) (f b)
continuous_on (closed_segment a b) f

goal (1 subgoal):
 1. \<exists>x\<in>closed_segment a b. f x = y
[PROOF STEP]
by (cases "a \<le> b"; cases "f b \<ge> f a") (auto simp: closed_segment_eq_real_ivl continuous_on_minus)


[STATEMENT]
lemma map_spmf_eq_map_spmf_iff: "map_spmf f p = map_spmf g q \<longleftrightarrow> rel_spmf (\<lambda>x y. f x = g y) p q"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (map_spmf f p = map_spmf g q) = rel_spmf (\<lambda>x y. f x = g y) p q
[PROOF STEP]
by(simp add: spmf_rel_eq[symmetric] spmf_rel_map)


[STATEMENT]
lemma Sup_sup_pred: "x \<squnion> Sup{y. P y} = Sup{y. y = x \<or> P y}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<squnion> Sup {y. P y} = Sup {y. y = x \<or> P y}
[PROOF STEP]
apply (rule order.antisym)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. x \<squnion> Sup {y. P y} \<le> Sup {y. y = x \<or> P y}
 2. Sup {y. y = x \<or> P y} \<le> x \<squnion> Sup {y. P y}
[PROOF STEP]
apply (simp add: Collect_mono Sup_subset_mono Sup_upper)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. Sup {y. y = x \<or> P y} \<le> x \<squnion> Sup {y. P y}
[PROOF STEP]
using Sup_least Sup_upper le_supI2
[PROOF STATE]
proof (prove)
using this:
(\<And>x. x \<in> ?A \<Longrightarrow> x \<le> ?z) \<Longrightarrow> Sup ?A \<le> ?z
?x \<in> ?A \<Longrightarrow> ?x \<le> Sup ?A
?x \<le> ?b \<Longrightarrow> ?x \<le> ?a \<squnion> ?b

goal (1 subgoal):
 1. Sup {y. y = x \<or> P y} \<le> x \<squnion> Sup {y. P y}
[PROOF STEP]
by fastforce


[STATEMENT]
lemma int_pow_diff_val:
  assumes "a \<in> nonzero Q\<^sub>p"
  shows "val (a[^]((i::int) - j)) =  (val (a[^]i)) - val (a[^]j)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. val (a [^] (i - j)) = val (a [^] i) - val (a [^] j)
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. val (a [^] (i - j)) = val (a [^] i) - val (a [^] j)
[PROOF STEP]
obtain k where k_def: "val a = eint k"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>k. val a = eint k \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using assms val_ord
[PROOF STATE]
proof (prove)
using this:
a \<in> nonzero Q\<^sub>p
?a \<in> nonzero Q\<^sub>p \<Longrightarrow> val ?a = eint (ord ?a)

goal (1 subgoal):
 1. (\<And>k. val a = eint k \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
val a = eint k

goal (1 subgoal):
 1. val (a [^] (i - j)) = val (a [^] i) - val (a [^] j)
[PROOF STEP]
have 0: "val (a[^]((i::int) - j)) = eint ((i-j)*k)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. val (a [^] (i - j)) = eint ((i - j) * k)
[PROOF STEP]
using assms k_def int_pow_val times_eint_simps(1)
[PROOF STATE]
proof (prove)
using this:
a \<in> nonzero Q\<^sub>p
val a = eint k
?a \<in> nonzero Q\<^sub>p \<Longrightarrow> val (?a [^] ?i) = eint ?i * val ?a
eint ?m * eint ?n = eint (?m * ?n)

goal (1 subgoal):
 1. val (a [^] (i - j)) = eint ((i - j) * k)
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
val (a [^] (i - j)) = eint ((i - j) * k)

goal (1 subgoal):
 1. val (a [^] (i - j)) = val (a [^] i) - val (a [^] j)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. val (a [^] (i - j)) = val (a [^] i) - val (a [^] j)
[PROOF STEP]
unfolding 0
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. eint ((i - j) * k) = val (a [^] i) - val (a [^] j)
[PROOF STEP]
using k_def
[PROOF STATE]
proof (prove)
using this:
val a = eint k

goal (1 subgoal):
 1. eint ((i - j) * k) = val (a [^] i) - val (a [^] j)
[PROOF STEP]
by (metis "0" Qp_int_pow_nonzero Rings.ring_distribs(3) assms eint.simps(1) idiff_eint_eint int_pow_ord val_ord)
[PROOF STATE]
proof (state)
this:
val (a [^] (i - j)) = val (a [^] i) - val (a [^] j)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma flatten1_im:
  fixes f :: "'a \<Rightarrow> 'a \<Rightarrow> 'b::join_semilattice_zero"
  assumes "finite (A :: 'a set)"
  and "finite (B :: 'a set)"
  shows "\<Sum>((\<lambda>x. \<Sum>(f x ` B)) ` A) = \<Sum>((\<lambda>p. f (fst p) (snd p)) ` (A \<times> B))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<Sum> ((\<lambda>x. \<Sum> (f x ` B)) ` A) = \<Sum> ((\<lambda>p. f (fst p) (snd p)) ` (A \<times> B))
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<Sum> ((\<lambda>x. \<Sum> (f x ` B)) ` A) = \<Sum> ((\<lambda>p. f (fst p) (snd p)) ` (A \<times> B))
[PROOF STEP]
have "\<forall>z. \<Sum>((\<lambda>x. \<Sum>(f x ` B)) ` A) \<le> z \<longleftrightarrow> \<Sum>((\<lambda>p. f (fst p) (snd p)) ` (A \<times> B)) \<le> z"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>z. (\<Sum> ((\<lambda>x. \<Sum> (f x ` B)) ` A) \<le> z) = (\<Sum> ((\<lambda>p. f (fst p) (snd p)) ` (A \<times> B)) \<le> z)
[PROOF STEP]
by (simp add: assms finite_cartesian_product sum_fun_image_sup)
[PROOF STATE]
proof (state)
this:
\<forall>z. (\<Sum> ((\<lambda>x. \<Sum> (f x ` B)) ` A) \<le> z) = (\<Sum> ((\<lambda>p. f (fst p) (snd p)) ` (A \<times> B)) \<le> z)

goal (1 subgoal):
 1. \<Sum> ((\<lambda>x. \<Sum> (f x ` B)) ` A) = \<Sum> ((\<lambda>p. f (fst p) (snd p)) ` (A \<times> B))
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
\<forall>z. (\<Sum> ((\<lambda>x. \<Sum> (f x ` B)) ` A) \<le> z) = (\<Sum> ((\<lambda>p. f (fst p) (snd p)) ` (A \<times> B)) \<le> z)

goal (1 subgoal):
 1. \<Sum> ((\<lambda>x. \<Sum> (f x ` B)) ` A) = \<Sum> ((\<lambda>p. f (fst p) (snd p)) ` (A \<times> B))
[PROOF STEP]
by (simp add: eq_iff)
[PROOF STATE]
proof (state)
this:
\<Sum> ((\<lambda>x. \<Sum> (f x ` B)) ` A) = \<Sum> ((\<lambda>p. f (fst p) (snd p)) ` (A \<times> B))

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma linear_eq_stdbasis:
  fixes f :: "'a::euclidean_space \<Rightarrow> _"
  assumes lf: "linear f"
    and lg: "linear g"
    and fg: "\<And>b. b \<in> Basis \<Longrightarrow> f b = g b"
  shows "f = g"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f = g
[PROOF STEP]
using linear_eq_on_span[OF lf lg, of Basis] fg
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<And>x. x \<in> Basis \<Longrightarrow> f x = g x; ?x \<in> span Basis\<rbrakk> \<Longrightarrow> f ?x = g ?x
?b \<in> Basis \<Longrightarrow> f ?b = g ?b

goal (1 subgoal):
 1. f = g
[PROOF STEP]
by auto


[STATEMENT]
lemma interfree_Map:
  "(\<forall>i j. a\<le>i \<and> i<b \<and> a\<le>j \<and> j<b  \<and> i\<noteq>j \<longrightarrow> interfree_aux (c i, Q i, c j))
  \<Longrightarrow> interfree (map (\<lambda>k. (c k, Q k)) [a..<b])"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>i j. a \<le> i \<and> i < b \<and> a \<le> j \<and> j < b \<and> i \<noteq> j \<longrightarrow> interfree_aux (c i, Q i, c j) \<Longrightarrow> interfree (map (\<lambda>k. (c k, Q k)) [a..<b])
[PROOF STEP]
by(force simp add: interfree_def less_diff_conv)


[STATEMENT]
lemma "(SOME x. x : {1::nat, 2, 3}) = x \<Longrightarrow> x = 1 \<or> x = 2 \<or> x = 3"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (SOME x. x \<in> {1, 2, 3}) = x \<Longrightarrow> x = 1 \<or> x = 2 \<or> x = 3
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. (SOME x. x \<in> {1, 2, 3}) = x \<Longrightarrow> x = 1 \<or> x = 2 \<or> x = 3
[PROOF STEP]
have "(SOME x. x \<in> {1::nat, 2, 3}) \<in> {1::nat, 2, 3}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (SOME x. x \<in> {1, 2, 3}) \<in> {1, 2, 3}
[PROOF STEP]
unfolding some_in_eq
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. {1, 2, 3} \<noteq> {}
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
(SOME x. x \<in> {1, 2, 3}) \<in> {1, 2, 3}

goal (1 subgoal):
 1. (SOME x. x \<in> {1, 2, 3}) = x \<Longrightarrow> x = 1 \<or> x = 2 \<or> x = 3
[PROOF STEP]
thus "(SOME x. x : {1::nat, 2, 3}) = x \<Longrightarrow> x = 1 \<or> x = 2 \<or> x = 3"
[PROOF STATE]
proof (prove)
using this:
(SOME x. x \<in> {1, 2, 3}) \<in> {1, 2, 3}

goal (1 subgoal):
 1. (SOME x. x \<in> {1, 2, 3}) = x \<Longrightarrow> x = 1 \<or> x = 2 \<or> x = 3
[PROOF STEP]
by fast
[PROOF STATE]
proof (state)
this:
(SOME x. x \<in> {1, 2, 3}) = x \<Longrightarrow> x = 1 \<or> x = 2 \<or> x = 3

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma to_bl_mask:
  "to_bl (mask n :: 'a::len word) =
  replicate (LENGTH('a) - n) False @
    replicate (min (LENGTH('a)) n) True"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. to_bl (mask n) = replicate (LENGTH('a) - n) False @ replicate (min LENGTH('a) n) True
[PROOF STEP]
by (simp add: mask_bl word_rep_drop min_def)


[STATEMENT]
lemma fps_exp_power_mult: "(fps_exp (c::'a::field_char_0))^n = fps_exp (of_nat n * c)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. fps_exp c ^ n = fps_exp (of_nat n * c)
[PROOF STEP]
by (induct n) (simp_all add: field_simps fps_exp_add_mult)


[STATEMENT]
lemma min_union_comm:
  "A \<union>\<^sub>m B = B \<union>\<^sub>m A"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A \<union>\<^sub>m B = B \<union>\<^sub>m A
[PROOF STEP]
unfolding min_union_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. min_set (A \<union> B) = min_set (B \<union> A)
[PROOF STEP]
by (simp add: sup.commute)


[STATEMENT]
lemma has_integral_bound_spike_finite:
  fixes f :: "'a::euclidean_space \<Rightarrow> 'b::real_normed_vector"
  assumes "0 \<le> B" and "finite S"
    and f: "(f has_integral i) (cbox a b)"
    and leB: "\<And>x. x \<in> cbox a b - S \<Longrightarrow> norm (f x) \<le> B"
  shows "norm i \<le> B * content (cbox a b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. norm i \<le> B * content (cbox a b)
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. norm i \<le> B * content (cbox a b)
[PROOF STEP]
define g where "g \<equiv> (\<lambda>x. if x \<in> S then 0 else f x)"
[PROOF STATE]
proof (state)
this:
g \<equiv> \<lambda>x. if x \<in> S then 0::'b else f x

goal (1 subgoal):
 1. norm i \<le> B * content (cbox a b)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
g \<equiv> \<lambda>x. if x \<in> S then 0::'b else f x
[PROOF STEP]
have "\<And>x. x \<in> cbox a b - S \<Longrightarrow> norm (g x) \<le> B"
[PROOF STATE]
proof (prove)
using this:
g \<equiv> \<lambda>x. if x \<in> S then 0::'b else f x

goal (1 subgoal):
 1. \<And>x. x \<in> cbox a b - S \<Longrightarrow> norm (g x) \<le> B
[PROOF STEP]
using leB
[PROOF STATE]
proof (prove)
using this:
g \<equiv> \<lambda>x. if x \<in> S then 0::'b else f x
?x \<in> cbox a b - S \<Longrightarrow> norm (f ?x) \<le> B

goal (1 subgoal):
 1. \<And>x. x \<in> cbox a b - S \<Longrightarrow> norm (g x) \<le> B
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
?x \<in> cbox a b - S \<Longrightarrow> norm (g ?x) \<le> B

goal (1 subgoal):
 1. norm i \<le> B * content (cbox a b)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
?x \<in> cbox a b - S \<Longrightarrow> norm (g ?x) \<le> B

goal (1 subgoal):
 1. norm i \<le> B * content (cbox a b)
[PROOF STEP]
have "(g has_integral i) (cbox a b)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (g has_integral i) (cbox a b)
[PROOF STEP]
using has_integral_spike_finite [OF \<open>finite S\<close> _ f]
[PROOF STATE]
proof (prove)
using this:
(\<And>x. x \<in> cbox a b - S \<Longrightarrow> ?g x = f x) \<Longrightarrow> (?g has_integral i) (cbox a b)

goal (1 subgoal):
 1. (g has_integral i) (cbox a b)
[PROOF STEP]
by (simp add: g_def)
[PROOF STATE]
proof (state)
this:
(g has_integral i) (cbox a b)

goal (1 subgoal):
 1. norm i \<le> B * content (cbox a b)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
?x \<in> cbox a b - S \<Longrightarrow> norm (g ?x) \<le> B
(g has_integral i) (cbox a b)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
?x \<in> cbox a b - S \<Longrightarrow> norm (g ?x) \<le> B
(g has_integral i) (cbox a b)

goal (1 subgoal):
 1. norm i \<le> B * content (cbox a b)
[PROOF STEP]
by (simp add: \<open>0 \<le> B\<close> g_def has_integral_bound)
[PROOF STATE]
proof (state)
this:
norm i \<le> B * content (cbox a b)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma convex_rel_interior_inter_two:
  fixes S T :: "'n::euclidean_space set"
  assumes "convex S"
    and "convex T"
    and "rel_interior S \<inter> rel_interior T \<noteq> {}"
  shows "rel_interior (S \<inter> T) = rel_interior S \<inter> rel_interior T"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. rel_interior (S \<inter> T) = rel_interior S \<inter> rel_interior T
[PROOF STEP]
using convex_rel_interior_finite_inter[of "{S,T}"] assms
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>\<forall>S\<in>{S, T}. convex S; \<Inter> {rel_interior Sa |Sa. Sa \<in> {S, T}} \<noteq> {}; finite {S, T}\<rbrakk> \<Longrightarrow> rel_interior (\<Inter> {S, T}) = \<Inter> {rel_interior Sa |Sa. Sa \<in> {S, T}}
convex S
convex T
rel_interior S \<inter> rel_interior T \<noteq> {}

goal (1 subgoal):
 1. rel_interior (S \<inter> T) = rel_interior S \<inter> rel_interior T
[PROOF STEP]
by auto


[STATEMENT]
lemma "(\<lambda>x::real. 2 * x + x ^ 2) \<in> \<Theta>[at_left 0](\<lambda>x. x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<lambda>x. 2 * x + x\<^sup>2) \<in> \<Theta>[at_left 0](\<lambda>x. x)
[PROOF STEP]
by real_asymp


[STATEMENT]
lemma lub_sum_iff:
  fixes f :: "'b::finite \<Rightarrow> 'a"
  shows "(\<forall>k . f k \<le> x) \<longleftrightarrow> (\<Squnion>\<^sub>k f k) \<le> x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>k. f k \<le> x) = (comm_monoid_add.sum (\<squnion>) bot f {k. True} \<le> x)
[PROOF STEP]
using order.trans ub_sum lub_sum
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?a \<le> ?b; ?b \<le> ?c\<rbrakk> \<Longrightarrow> ?a \<le> ?c
?f ?i \<le> comm_monoid_add.sum (\<squnion>) bot ?f {k. True}
\<forall>k. ?f k \<le> ?x \<Longrightarrow> comm_monoid_add.sum (\<squnion>) bot ?f {k. True} \<le> ?x

goal (1 subgoal):
 1. (\<forall>k. f k \<le> x) = (comm_monoid_add.sum (\<squnion>) bot f {k. True} \<le> x)
[PROOF STEP]
by blast


[STATEMENT]
lemma le_lt_per2__lt:
  assumes "Per A B C" and
    "Per A' B' C'" and
    "A B Le A' B'" and
    "B C Lt B' C'"
  shows "A C Lt A' C'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. A C Lt A' C'
[PROOF STEP]
using Lt_def assms(1) assms(2) assms(3) assms(4) cong_lt_per2__lt lt2_per2__lt
[PROOF STATE]
proof (prove)
using this:
?A ?B Lt ?C ?D \<equiv> ?A ?B Le ?C ?D \<and> \<not> Cong ?A ?B ?C ?D
Per A B C
Per A' B' C'
A B Le A' B'
B C Lt B' C'
\<lbrakk>Per ?A ?B ?C; Per ?A' ?B' ?C'; Cong ?A ?B ?A' ?B'; ?B ?C Lt ?B' ?C'\<rbrakk> \<Longrightarrow> ?A ?C Lt ?A' ?C'
\<lbrakk>Per ?A ?B ?C; Per ?A' ?B' ?C'; ?A ?B Lt ?A' ?B'; ?B ?C Lt ?B' ?C'\<rbrakk> \<Longrightarrow> ?A ?C Lt ?A' ?C'

goal (1 subgoal):
 1. A C Lt A' C'
[PROOF STEP]
by blast


[STATEMENT]
lemma "(\<forall>x. honest(x) \<and> industrious(x) \<longrightarrow> healthy(x)) \<and>
      \<not> (\<exists>x. grocer(x) \<and> healthy(x)) \<and>
      (\<forall>x. industrious(x) \<and> grocer(x) \<longrightarrow> honest(x)) \<and>
      (\<forall>x. cyclist(x) \<longrightarrow> industrious(x)) \<and>
      (\<forall>x. \<not>healthy(x) \<and> cyclist(x) \<longrightarrow> \<not>honest(x))
      \<longrightarrow> (\<forall>x. grocer(x) \<longrightarrow> \<not>cyclist(x))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<forall>x. honest x \<and> industrious x \<longrightarrow> healthy x) \<and> (\<nexists>x. grocer x \<and> healthy x) \<and> (\<forall>x. industrious x \<and> grocer x \<longrightarrow> honest x) \<and> (\<forall>x. cyclist x \<longrightarrow> industrious x) \<and> (\<forall>x. \<not> healthy x \<and> cyclist x \<longrightarrow> \<not> honest x) \<longrightarrow> (\<forall>x. grocer x \<longrightarrow> \<not> cyclist x)
[PROOF STEP]
by blast


[STATEMENT]
lemma sum_list_split:
  fixes xs::"real list"
  shows "\<Sum>:xs = (\<Sum>:(list_neq xs m) + \<Sum>:(list_eq xs m))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. sum_list xs = sum_list (list_neq xs m) + sum_list (list_eq xs m)
[PROOF STEP]
apply (induct xs)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. sum_list [] = sum_list (list_neq [] m) + sum_list (list_eq [] m)
 2. \<And>a xs. sum_list xs = sum_list (list_neq xs m) + sum_list (list_eq xs m) \<Longrightarrow> sum_list (a # xs) = sum_list (list_neq (a # xs) m) + sum_list (list_eq (a # xs) m)
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>a xs. sum_list xs = sum_list (list_neq xs m) + sum_list (list_eq xs m) \<Longrightarrow> sum_list (a # xs) = sum_list (list_neq (a # xs) m) + sum_list (list_eq (a # xs) m)
[PROOF STEP]
apply clarsimp
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma geodesic_segment_commute:
  assumes "geodesic_segment_between G x y"
  shows "geodesic_segment_between G y x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. geodesic_segment_between G y x
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. geodesic_segment_between G y x
[PROOF STEP]
obtain g::"real\<Rightarrow>'a" where g: "g 0 = x" "g (dist x y) = y" "isometry_on {0..dist x y} g" "G = g`{0..dist x y}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>g. \<lbrakk>g 0 = x; g (dist x y) = y; isometry_on {0..dist x y} g; G = g ` {0..dist x y}\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (meson \<open>geodesic_segment_between G x y\<close> geodesic_segment_between_def)
[PROOF STATE]
proof (state)
this:
g 0 = x
g (dist x y) = y
isometry_on {0..dist x y} g
G = g ` {0..dist x y}

goal (1 subgoal):
 1. geodesic_segment_between G y x
[PROOF STEP]
define h::"real\<Rightarrow>'a" where "h = (\<lambda>t. g(dist x y-t))"
[PROOF STATE]
proof (state)
this:
h = (\<lambda>t. g (dist x y - t))

goal (1 subgoal):
 1. geodesic_segment_between G y x
[PROOF STEP]
have "(\<lambda>t. dist x y -t)`{0..dist x y} = {0..dist x y}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (-) (dist x y) ` {0..dist x y} = {0..dist x y}
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
(-) (dist x y) ` {0..dist x y} = {0..dist x y}

goal (1 subgoal):
 1. geodesic_segment_between G y x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
(-) (dist x y) ` {0..dist x y} = {0..dist x y}
[PROOF STEP]
have "h`{0..dist x y} = G"
[PROOF STATE]
proof (prove)
using this:
(-) (dist x y) ` {0..dist x y} = {0..dist x y}

goal (1 subgoal):
 1. h ` {0..dist x y} = G
[PROOF STEP]
unfolding g(4) h_def
[PROOF STATE]
proof (prove)
using this:
(-) (dist x y) ` {0..dist x y} = {0..dist x y}

goal (1 subgoal):
 1. (\<lambda>t. g (dist x y - t)) ` {0..dist x y} = g ` {0..dist x y}
[PROOF STEP]
by (metis image_image)
[PROOF STATE]
proof (state)
this:
h ` {0..dist x y} = G

goal (1 subgoal):
 1. geodesic_segment_between G y x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
h ` {0..dist x y} = G

goal (1 subgoal):
 1. geodesic_segment_between G y x
[PROOF STEP]
have "h 0 = y" "h (dist x y) = x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h 0 = y &&& h (dist x y) = x
[PROOF STEP]
unfolding h_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. g (dist x y - 0) = y &&& g (dist x y - dist x y) = x
[PROOF STEP]
using g
[PROOF STATE]
proof (prove)
using this:
g 0 = x
g (dist x y) = y
isometry_on {0..dist x y} g
G = g ` {0..dist x y}

goal (1 subgoal):
 1. g (dist x y - 0) = y &&& g (dist x y - dist x y) = x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
h 0 = y
h (dist x y) = x

goal (1 subgoal):
 1. geodesic_segment_between G y x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
h 0 = y
h (dist x y) = x

goal (1 subgoal):
 1. geodesic_segment_between G y x
[PROOF STEP]
have "isometry_on {0..dist x y} h"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. isometry_on {0..dist x y} h
[PROOF STEP]
unfolding h_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. isometry_on {0..dist x y} (\<lambda>t. g (dist x y - t))
[PROOF STEP]
apply (rule isometry_on_compose[of _ _ g])
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. isometry_on {0..dist x y} ((-) (dist x y))
 2. isometry_on ((-) (dist x y) ` {0..dist x y}) g
[PROOF STEP]
using g(3)
[PROOF STATE]
proof (prove)
using this:
isometry_on {0..dist x y} g

goal (2 subgoals):
 1. isometry_on {0..dist x y} ((-) (dist x y))
 2. isometry_on ((-) (dist x y) ` {0..dist x y}) g
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
isometry_on {0..dist x y} h

goal (1 subgoal):
 1. geodesic_segment_between G y x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
h ` {0..dist x y} = G
h 0 = y
h (dist x y) = x
isometry_on {0..dist x y} h
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
h ` {0..dist x y} = G
h 0 = y
h (dist x y) = x
isometry_on {0..dist x y} h

goal (1 subgoal):
 1. geodesic_segment_between G y x
[PROOF STEP]
unfolding geodesic_segment_between_def
[PROOF STATE]
proof (prove)
using this:
h ` {0..dist x y} = G
h 0 = y
h (dist x y) = x
isometry_on {0..dist x y} h

goal (1 subgoal):
 1. \<exists>g. g 0 = y \<and> g (dist y x) = x \<and> isometry_on {0..dist y x} g \<and> G = g ` {0..dist y x}
[PROOF STEP]
by (auto simp add: dist_commute)
[PROOF STATE]
proof (state)
this:
geodesic_segment_between G y x

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma scale_eq_0_iff [simp]: "scale a x = 0 \<longleftrightarrow> a = 0 \<or> x = 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (a *s x = (0::'b)) = (a = (0::'a) \<or> x = (0::'b))
[PROOF STEP]
by (metis scale_left_commute right_inverse scale_one scale_scale scale_zero_left)